@prosopo/procaptcha-bundle 4.2.4 → 4.3.0

package/.turbo/turbo-build$colon$cjs.log

@@ -1,5 +1,5 @@
 
-> @prosopo/procaptcha-bundle@4.2.4 build:cjs
+> @prosopo/procaptcha-bundle@4.3.0 build:cjs
 > NODE_ENV=${NODE_ENV:-development}; vite build --config vite.cjs.config.ts --mode $NODE_ENV
 
 ViteCommonJSConfig: .
@@ -57,21 +57,22 @@ ViteCommonJSConfig: .
 vite v8.1.5 building ssr environment for production...
 Bundle build started
 
-✓ 11 modules transformed.
+✓ 12 modules transformed.
 rendering chunks...
 computing gzip size...
-dist/cjs/util/widgetThemeResolver.cjs               0.57 kB │ gzip: 0.29 kB
-dist/cjs/util/timeout.cjs                           0.63 kB │ gzip: 0.29 kB
-dist/cjs/util/config.cjs                            0.66 kB │ gzip: 0.33 kB
-dist/cjs/util/captcha/components/bundleCaptcha.cjs  0.82 kB │ gzip: 0.39 kB
-dist/cjs/util/configCreator.cjs                     0.88 kB │ gzip: 0.46 kB
-dist/cjs/_virtual/_rolldown/runtime.cjs             1.00 kB │ gzip: 0.50 kB
-dist/cjs/util/clientSession.cjs                     1.08 kB │ gzip: 0.56 kB
-dist/cjs/util/language.cjs                          1.08 kB │ gzip: 0.45 kB
-dist/cjs/util/captcha/captchaRenderer.cjs           2.40 kB │ gzip: 0.80 kB
-dist/cjs/util/widgetFactory.cjs                     2.73 kB │ gzip: 0.89 kB
-dist/cjs/index.cjs                                  9.20 kB │ gzip: 3.22 kB
+dist/cjs/util/widgetThemeResolver.cjs                0.57 kB │ gzip: 0.29 kB
+dist/cjs/util/timeout.cjs                            0.63 kB │ gzip: 0.29 kB
+dist/cjs/util/config.cjs                             0.66 kB │ gzip: 0.33 kB
+dist/cjs/util/captcha/components/bundleCaptcha.cjs   0.82 kB │ gzip: 0.39 kB
+dist/cjs/util/configCreator.cjs                      0.88 kB │ gzip: 0.46 kB
+dist/cjs/util/startMode.cjs                          0.89 kB │ gzip: 0.40 kB
+dist/cjs/_virtual/_rolldown/runtime.cjs              1.00 kB │ gzip: 0.50 kB
+dist/cjs/util/clientSession.cjs                      1.08 kB │ gzip: 0.56 kB
+dist/cjs/util/language.cjs                           1.08 kB │ gzip: 0.45 kB
+dist/cjs/util/captcha/captchaRenderer.cjs            2.52 kB │ gzip: 0.82 kB
+dist/cjs/util/widgetFactory.cjs                      2.73 kB │ gzip: 0.89 kB
+dist/cjs/index.cjs                                  10.34 kB │ gzip: 3.46 kB
 
-[MIXED_EXPORTS] Entry module "src/index.ts" is using named (including "default", "execute", "remove", "render", "reset") and default exports together. Consumers of your bundle will have to use `..default` to access the default export, which may not be what you want. Use `output.exports: "named"` to disable this warning.
+[MIXED_EXPORTS] Entry module "src/index.ts" is using named (including "default", "execute", "remove", "render", "reset", "start") and default exports together. Consumers of your bundle will have to use `..default` to access the default export, which may not be what you want. Use `output.exports: "named"` to disable this warning.
 
-✓ built in 55ms
+✓ built in 68ms

package/.turbo/turbo-build$colon$tsc.log

@@ -1,8 +1,8 @@
 
-> @prosopo/procaptcha-bundle@4.2.4 build:tsc
+> @prosopo/procaptcha-bundle@4.3.0 build:tsc
 > tsc --build --verbose
 
-10:02:45 PM - Projects in this build: 
+10:40:06 PM - Projects in this build: 
     * ../../dev/config/tsconfig.json
     * ../util/tsconfig.json
     * ../logger/tsconfig.json
@@ -27,51 +27,51 @@
     * ../procaptcha-frictionless/tsconfig.json
     * tsconfig.json
 
-10:02:45 PM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/webpack/webpack.config.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
+10:40:06 PM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/vite/NodejsPolarsNativeFilePlugin.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
 
-10:02:45 PM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
+10:40:06 PM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
 
-10:02:45 PM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/logger.ts' is older than output '../logger/tsconfig.tsbuildinfo'
+10:40:06 PM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/logger.ts' is older than output '../logger/tsconfig.tsbuildinfo'
 
-10:02:45 PM - Project '../dotenv/tsconfig.json' is up to date because newest input '../dotenv/src/env.ts' is older than output '../dotenv/tsconfig.tsbuildinfo'
+10:40:06 PM - Project '../dotenv/tsconfig.json' is up to date because newest input '../dotenv/src/env.ts' is older than output '../dotenv/tsconfig.tsbuildinfo'
 
-10:02:45 PM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/translationKey.ts' is older than output '../locale/tsconfig.tsbuildinfo'
+10:40:06 PM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/translationKey.ts' is older than output '../locale/tsconfig.tsbuildinfo'
 
-10:02:45 PM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
+10:40:06 PM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
 
-10:02:45 PM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/types.test-d.ts' is older than output '../types/tsconfig.tsbuildinfo'
+10:40:06 PM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/types.test-d.ts' is older than output '../types/tsconfig.tsbuildinfo'
 
-10:02:45 PM - Project '../api/tsconfig.json' is up to date because newest input '../api/src/tests/apiHarness.ts' is older than output '../api/tsconfig.tsbuildinfo'
+10:40:06 PM - Project '../api/tsconfig.json' is up to date because newest input '../api/src/tests/apiHarness.ts' is older than output '../api/tsconfig.tsbuildinfo'
 
-10:02:45 PM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/index.ts' is older than output '../common/tsconfig.tsbuildinfo'
+10:40:06 PM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/tests/utils/batches.unit.test.ts' is older than output '../common/tsconfig.tsbuildinfo'
 
-10:02:45 PM - Project '../fingerprintjs/tsconfig.json' is up to date because newest input '../fingerprintjs/src/utils/browser.ts' is older than output '../fingerprintjs/tsconfig.tsbuildinfo'
+10:40:06 PM - Project '../fingerprintjs/tsconfig.json' is up to date because newest input '../fingerprintjs/src/utils/browser.ts' is older than output '../fingerprintjs/tsconfig.tsbuildinfo'
 
-10:02:45 PM - Project '../fingerprint/tsconfig.json' is up to date because newest input '../fingerprint/src/index.ts' is older than output '../fingerprint/tsconfig.tsbuildinfo'
+10:40:06 PM - Project '../fingerprint/tsconfig.json' is up to date because newest input '../fingerprint/src/index.ts' is older than output '../fingerprint/tsconfig.tsbuildinfo'
 
-10:02:45 PM - Project '../load-balancer/tsconfig.json' is up to date because newest input '../load-balancer/src/balancer.ts' is older than output '../load-balancer/tsconfig.tsbuildinfo'
+10:40:06 PM - Project '../load-balancer/tsconfig.json' is up to date because newest input '../load-balancer/src/index.ts' is older than output '../load-balancer/tsconfig.tsbuildinfo'
 
-10:02:45 PM - Project '../widget-skeleton/tsconfig.json' is up to date because newest input '../widget-skeleton/src/webComponent/createWidget.ts' is older than output '../widget-skeleton/tsconfig.tsbuildinfo'
+10:40:06 PM - Project '../widget-skeleton/tsconfig.json' is up to date because newest input '../widget-skeleton/src/webComponent/createWidget.ts' is older than output '../widget-skeleton/tsconfig.tsbuildinfo'
 
-10:02:45 PM - Project '../keyring/tsconfig.json' is up to date because newest input '../keyring/src/index.ts' is older than output '../keyring/tsconfig.tsbuildinfo'
+10:40:06 PM - Project '../keyring/tsconfig.json' is up to date because newest input '../keyring/src/pair/decode.ts' is older than output '../keyring/tsconfig.tsbuildinfo'
 
-10:02:45 PM - Project '../account/tsconfig.json' is up to date because newest input '../account/src/tests/cryptoWorker.unit.test.ts' is older than output '../account/tsconfig.tsbuildinfo'
+10:40:06 PM - Project '../account/tsconfig.json' is up to date because newest input '../account/src/custom.d.ts' is older than output '../account/tsconfig.tsbuildinfo'
 
-10:02:45 PM - Project '../procaptcha-common/tsconfig.json' is up to date because newest input '../procaptcha-common/src/simdReadings.ts' is older than output '../procaptcha-common/tsconfig.tsbuildinfo'
+10:40:06 PM - Project '../procaptcha-common/tsconfig.json' is up to date because newest input '../procaptcha-common/src/simdReadings.ts' is older than output '../procaptcha-common/tsconfig.tsbuildinfo'
 
-10:02:45 PM - Project '../procaptcha-pow/tsconfig.json' is up to date because newest input '../procaptcha-pow/src/tests/managerHarness.ts' is older than output '../procaptcha-pow/tsconfig.tsbuildinfo'
+10:40:06 PM - Project '../procaptcha-pow/tsconfig.json' is up to date because newest input '../procaptcha-pow/src/tests/managerHarness.ts' is older than output '../procaptcha-pow/tsconfig.tsbuildinfo'
 
-10:02:45 PM - Project '../procaptcha-puzzle/tsconfig.json' is up to date because newest input '../procaptcha-puzzle/src/index.ts' is older than output '../procaptcha-puzzle/tsconfig.tsbuildinfo'
+10:40:06 PM - Project '../procaptcha-puzzle/tsconfig.json' is up to date because newest input '../procaptcha-puzzle/src/index.ts' is older than output '../procaptcha-puzzle/tsconfig.tsbuildinfo'
 
-10:02:45 PM - Project '../datasets/tsconfig.json' is up to date because newest input '../datasets/src/tests/dataset.unit.test.ts' is older than output '../datasets/tsconfig.tsbuildinfo'
+10:40:06 PM - Project '../datasets/tsconfig.json' is up to date because newest input '../datasets/src/index.ts' is older than output '../datasets/tsconfig.tsbuildinfo'
 
-10:02:45 PM - Project '../procaptcha/tsconfig.json' is up to date because newest input '../procaptcha/src/index.ts' is older than output '../procaptcha/tsconfig.tsbuildinfo'
+10:40:06 PM - Project '../procaptcha/tsconfig.json' is up to date because newest input '../procaptcha/src/index.ts' is older than output '../procaptcha/tsconfig.tsbuildinfo'
 
-10:02:45 PM - Project '../procaptcha-react/tsconfig.json' is up to date because newest input '../procaptcha-react/src/tests/captchaComponent.unit.test.tsx' is older than output '../procaptcha-react/tsconfig.tsbuildinfo'
+10:40:06 PM - Project '../procaptcha-react/tsconfig.json' is up to date because newest input '../procaptcha-react/src/tests/captchaComponent.unit.test.tsx' is older than output '../procaptcha-react/tsconfig.tsbuildinfo'
 
-10:02:45 PM - Project '../procaptcha-frictionless/tsconfig.json' is up to date because newest input '../procaptcha-frictionless/src/ProcaptchaFrictionless.tsx' is older than output '../procaptcha-frictionless/tsconfig.tsbuildinfo'
+10:40:06 PM - Project '../procaptcha-frictionless/tsconfig.json' is up to date because newest input '../procaptcha-frictionless/src/ProcaptchaFrictionless.tsx' is older than output '../procaptcha-frictionless/tsconfig.tsbuildinfo'
 
-10:02:45 PM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
+10:40:06 PM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
 
-10:02:45 PM - Building project '/home/runner/work/captcha/captcha/packages/procaptcha-bundle/tsconfig.json'...
+10:40:06 PM - Building project '/home/runner/work/captcha/captcha/packages/procaptcha-bundle/tsconfig.json'...
 

package/.turbo/turbo-build.log

@@ -1,9 +1,9 @@
 
-> @prosopo/procaptcha-bundle@4.2.4 build
+> @prosopo/procaptcha-bundle@4.3.0 build
 > npm run build:cross-env -- --mode ${NODE_ENV:-development}
 
 
-> @prosopo/procaptcha-bundle@4.2.4 build:cross-env
+> @prosopo/procaptcha-bundle@4.3.0 build:cross-env
 > vite build --config vite.esm.config.ts --mode production
 
 ViteEsmConfig: .
@@ -61,7 +61,7 @@ ViteEsmConfig: .
 vite v8.1.5 building ssr environment for production...
 Bundle build started
 
-✓ 11 modules transformed.
+✓ 12 modules transformed.
 rendering chunks...
 computing gzip size...
 dist/_virtual/_rolldown/runtime.js             0.04 kB │ gzip: 0.06 kB
@@ -69,11 +69,12 @@ dist/util/widgetThemeResolver.js               0.55 kB │ gzip: 0.29 kB
 dist/util/timeout.js                           0.61 kB │ gzip: 0.29 kB
 dist/util/config.js                            0.62 kB │ gzip: 0.33 kB
 dist/util/captcha/components/bundleCaptcha.js  0.68 kB │ gzip: 0.35 kB
+dist/util/startMode.js                         0.78 kB │ gzip: 0.39 kB
 dist/util/configCreator.js                     0.86 kB │ gzip: 0.45 kB
 dist/util/language.js                          1.01 kB │ gzip: 0.44 kB
 dist/util/clientSession.js                     1.03 kB │ gzip: 0.55 kB
-dist/util/captcha/captchaRenderer.js           2.04 kB │ gzip: 0.72 kB
+dist/util/captcha/captchaRenderer.js           2.14 kB │ gzip: 0.74 kB
 dist/util/widgetFactory.js                     2.52 kB │ gzip: 0.85 kB
-dist/index.js                                  8.85 kB │ gzip: 3.14 kB
+dist/index.js                                  9.91 kB │ gzip: 3.36 kB
 
-✓ built in 54ms
+✓ built in 57ms

package/CHANGELOG.md

@@ -1,5 +1,73 @@
 # @prosopo/procaptcha-bundle
 
+## 4.3.0
+### Minor Changes
+
+- 80f73c1: Sites can now control when the widget starts working.
+  
+  By default the widget runs bot detection, starts the behavioural collectors and calls `/frictionless` as soon as it mounts. Rendering with `data-start-mode="manual"` (or `startMode: "manual"` in the render options) keeps all of that off the page load: the checkbox still appears immediately, at its final size, so nothing shifts, but the widget does nothing else until one of two things happens.
+  
+  - The site calls `window.procaptcha.start()`, optionally with a widget id, or dispatches a `procaptcha:start` event on `document`. The frictionless flow runs and the widget then waits for a click exactly as it does today.
+  - The visitor clicks the checkbox. The frictionless flow runs and whichever challenge the provider chooses opens straight away, carrying that click's position, so the visitor is never asked to click twice.
+  
+  Both triggers are one-shot: whichever comes first wins and the other is ignored. `window.procaptcha.execute()` also starts a manual widget, opening its challenge immediately. Widgets in the default `auto` mode are unaffected.
+
+### Patch Changes
+
+- 89dd38a: chore(deps): batch the outstanding dependabot bumps into one upgrade
+  
+  Rolls up dependabot PRs #3112, #3127-#3134 and #3159. Majors: `mongoose`
+  8 -> 9, `bson` 6 -> 7, `@noble/curves` 1 -> 2, `@polkadot/util-crypto`
+  13 -> 14, `@typegoose/auto-increment` 4 -> 5, `@babel/preset-env` 7 -> 8,
+  `@types/jsdom` 21 -> 30, `@types/bcrypt` 5 -> 6, `@actions/github` 6 -> 9,
+  `testcontainers` 11 -> 12. The rest are minor/patch.
+  
+  Code changes the majors forced:
+  - `@noble/curves` v2 requires `.js` specifiers and renamed the point API,
+    so `secp256k1.ProjectivePoint.fromHex(...).toRawBytes()` becomes
+    `secp256k1.Point.fromBytes(...).toBytes()`, `RistrettoPoint` becomes
+    `ristretto255.Point`, and `abstract/utils` moves to `utils.js`.
+  - mongoose 9 drops `RootFilterQuery` (now `QueryFilter`), no longer sets
+    `background: true` on schema indexes by default, and no longer declares
+    `id` on `Document`, which un-hid a mismatch between
+    `updateDappUserCommitment`'s `Hash` parameter and the `string` `id` it
+    filters on.
+  - mongoose 9 rejects an aggregation-pipeline update (an array) unless the
+    call passes `updatePipeline: true`, so the six pipeline writes in
+    `ProviderDatabase` now opt in explicitly.
+  - mongoose 9's `castUpdate` throws on a `$setOnInsert` key inside `$set`.
+    `storeUserImageCaptchaSolution` passed its record straight in as the
+    update, and mongoose's `moveImmutableProperties` mutates that object on
+    an upsert -- adding the very `$setOnInsert` key the record then carried
+    into `CentralDbStreamer.streamImageRecord`. Image records stopped
+    reaching the central DB (the streamer is fire-and-forget, so it only
+    logged) and signup verification returned 500. The update is now an
+    explicit `$set` over a shallow copy.
+  - `@prosopo/database` moves from mongodb 6.20 to 7.5 to match the driver
+    mongoose 9 pulls, so bson 7 is the only copy resolvable in the package.
+  - `vitest`/`@vitest/coverage-v8` go to 4.1.11 alongside dependabot's
+    `@vitest/spy` bump; leaving them at 4.1.10 installed a second copy of
+    `@vitest/spy` and broke type inference in the provider test utils.
+- Updated dependencies [89dd38a]
+- Updated dependencies [80f73c1]
+- Updated dependencies [8a670d3]
+  - @prosopo/dotenv@3.0.54
+  - @prosopo/locale@3.4.1
+  - @prosopo/procaptcha-common@2.12.6
+  - @prosopo/procaptcha-frictionless@2.14.0
+  - @prosopo/types@5.6.0
+  - @prosopo/util@3.3.8
+  - @prosopo/widget-skeleton@2.8.7
+
+## 4.2.5
+### Patch Changes
+
+- Updated dependencies [a62b994]
+- Updated dependencies [a447afa]
+  - @prosopo/types@5.5.3
+  - @prosopo/procaptcha-common@2.12.5
+  - @prosopo/procaptcha-frictionless@2.13.23
+
 ## 4.2.4
 ### Patch Changes
 

package/dist/cjs/index.cjs

@@ -3,9 +3,11 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_config = require("./util/config.cjs");
+const require_startMode = require("./util/startMode.cjs");
 const require_widgetFactory = require("./util/widgetFactory.cjs");
 const require_widgetThemeResolver = require("./util/widgetThemeResolver.cjs");
 let _prosopo_procaptcha_common = require("@prosopo/procaptcha-common");
+let _prosopo_types = require("@prosopo/types");
 let _prosopo_util = require("@prosopo/util");
 //#region src/index.ts
 var BUNDLE_NAMES = ["procaptcha.bundle.iife.js", "procaptcha.bundle.js"];
@@ -37,6 +39,7 @@ var widgetFactory = new require_widgetFactory.WidgetFactory(new require_widgetTh
 */
 var startDetectorPrefetch = (siteKey, flags) => {
 	if (!siteKey) return;
+	if (flags.startMode === _prosopo_types.StartModeEnum.manual) return;
 	Promise.all([import("@prosopo/procaptcha-frictionless"), import("@prosopo/procaptcha-common")]).then(([frictionless, common]) => {
 		frictionless.prefetchDetector(process.env.PROSOPO_DEFAULT_ENVIRONMENT, common.pickIpMode(flags), siteKey);
 	}).catch(() => void 0);
@@ -51,18 +54,21 @@ var implicitRender = async () => {
 		const web3 = firstElement.getAttribute("data-web3");
 		const ipv4 = firstElement.getAttribute("data-ipv4") === "true";
 		const ipv6 = firstElement.getAttribute("data-ipv6") === "true";
+		const startMode = require_startMode.resolveStartMode(void 0, firstElement);
 		if (!siteKey) {
 			console.error("No site key found");
 			return;
 		}
 		startDetectorPrefetch(siteKey, {
 			ipv4,
-			ipv6
+			ipv6,
+			startMode
 		});
 		const implicitRenderOptions = {
 			siteKey,
 			ipv4,
-			ipv6
+			ipv6,
+			startMode
 		};
 		registerWidgets(await widgetFactory.createWidgets(elements, implicitRenderOptions, !(web3 === "true")), elements, implicitRenderOptions, !(web3 === "true"), false);
 	}
@@ -72,15 +78,18 @@ var implicitRender = async () => {
 		const callback = button.getAttribute("data-callback") || "";
 		const ipv4 = button.getAttribute("data-ipv4") === "true";
 		const ipv6 = button.getAttribute("data-ipv6") === "true";
+		const startMode = require_startMode.resolveStartMode(void 0, button);
 		startDetectorPrefetch(siteKey, {
 			ipv4,
-			ipv6
+			ipv6,
+			startMode
 		});
 		const buttonRenderOptions = {
 			siteKey,
 			callback,
 			ipv4,
-			ipv6
+			ipv6,
+			startMode
 		};
 		registerWidgets(await widgetFactory.createWidgets([button], buttonRenderOptions, true, true), [button], buttonRenderOptions, true, true);
 		button.addEventListener("click", async (event) => {
@@ -99,7 +108,10 @@ var implicitRender = async () => {
 * factory legitimately yields nothing for an element it cannot mount into.
 */
 var render = async (element, renderOptions) => {
-	startDetectorPrefetch(renderOptions.siteKey, renderOptions);
+	startDetectorPrefetch(renderOptions.siteKey, {
+		...renderOptions,
+		startMode: require_startMode.resolveStartMode(renderOptions, element)
+	});
 	const hasInvisibleSize = Object.prototype.hasOwnProperty.call(renderOptions, "size") && renderOptions.size === "invisible";
 	const isWeb2 = !renderOptions.web3;
 	const invisible = hasInvisibleSize || element.tagName.toLowerCase() === "button";
@@ -135,6 +147,27 @@ var execute = () => {
 	});
 	document.dispatchEvent(executeEvent);
 };
+/** Starts a `startMode: "manual"` widget; omit the id to start all of them. */
+var start = (widgetId) => {
+	const ids = void 0 === widgetId ? Array.from(procaptchaWidgets.keys()) : [widgetId];
+	if (ids.length === 0) {
+		console.error("No Procaptcha widgets found to start");
+		return;
+	}
+	for (const id of ids) {
+		const entry = procaptchaWidgets.get(id);
+		if (!entry) {
+			console.error(`No Procaptcha widget found with id ${id}`);
+			continue;
+		}
+		const detail = { element: entry.element };
+		document.dispatchEvent(new CustomEvent(_prosopo_types.PROCAPTCHA_START_EVENT, {
+			detail,
+			bubbles: true,
+			cancelable: false
+		}));
+	}
+};
 function findProcaptchaContainers() {
 	const containers = [];
 	const invisibleContainers = Array.from(document.querySelectorAll("[data-size=\"invisible\"]"));
@@ -145,7 +178,7 @@ function findProcaptchaContainers() {
 	for (const container of idContainers) if (!containers.includes(container)) containers.push(container);
 	return containers;
 }
-var start = () => {
+var boot = () => {
 	const { onloadUrlCallback, renderExplicit } = require_config.extractParams(BUNDLE_NAMES);
 	let readyCalled = false;
 	if (renderExplicit !== "explicit") {
@@ -167,7 +200,7 @@ var start = () => {
 * widget id to reset one widget, or omit it to reset every widget on the page.
 *
 * This remounts rather than merely unmounting. The previous implementation
-* unmounted every root and then called `start()`, which only re-renders when
+* unmounted every root and then called `boot()`, which only re-renders when
 * the page uses implicit rendering — and even then only via the
 * `document.readyState` fallback, because the script's `load` event has long
 * since fired. On an explicitly-rendered page nothing came back at all: the
@@ -175,7 +208,7 @@ var start = () => {
 * request was ever made. Rebuilding from the stored descriptor makes reset
 * behave the same way on both paths.
 *
-* `start()` is deliberately not called here any more. It re-renders implicit
+* `boot()` is deliberately not called here any more. It re-renders implicit
 * widgets, which would double up with the remount below, and it attaches
 * another `load` listener to the script tag on every call.
 */
@@ -214,7 +247,8 @@ window.procaptcha = {
 	render,
 	reset,
 	remove,
-	execute
+	execute,
+	start
 };
 var procaptchaReadyEvent = new CustomEvent(PROCAPTCHA_READY_EVENT, {
 	detail: { timestamp: Date.now() },
@@ -222,10 +256,11 @@ var procaptchaReadyEvent = new CustomEvent(PROCAPTCHA_READY_EVENT, {
 	cancelable: false
 });
 document.dispatchEvent(procaptchaReadyEvent);
-start();
+boot();
 //#endregion
 exports.default = ready;
 exports.execute = execute;
 exports.remove = remove;
 exports.render = render;
 exports.reset = reset;
+exports.start = start;

package/dist/cjs/util/captcha/captchaRenderer.cjs

@@ -1,4 +1,5 @@
 const require_runtime = require("../../_virtual/_rolldown/runtime.cjs");
+const require_startMode = require("../startMode.cjs");
 const require_language = require("../language.cjs");
 const require_clientSession = require("../clientSession.cjs");
 const require_configCreator = require("../configCreator.cjs");
@@ -29,6 +30,7 @@ var CaptchaRenderer = class {
 		require_timeout.setValidChallengeLength(renderOptions, element, config);
 		require_language.setLanguage(renderOptions, element, config);
 		require_clientSession.setClientSessionId(renderOptions, element, config);
+		require_startMode.setStartMode(renderOptions, element, config);
 	}
 	makeEmotionCache(cacheKey, container) {
 		return (0, _emotion_cache.default)({

package/dist/cjs/util/startMode.cjs

@@ -0,0 +1,20 @@
+let _prosopo_types = require("@prosopo/types");
+//#region src/util/startMode.ts
+var START_MODE_ATTRIBUTE = "data-start-mode";
+var resolveStartMode = (renderOptions, element) => {
+	const requested = renderOptions?.startMode || element.getAttribute("data-start-mode");
+	if (!requested) return _prosopo_types.StartModeEnum.auto;
+	const parsed = _prosopo_types.StartModeSchema.safeParse(requested);
+	if (!parsed.success) {
+		console.error(`Ignoring unknown start mode "${requested}"; expected one of ${_prosopo_types.StartModeSchema.options.join(", ")}`);
+		return _prosopo_types.StartModeEnum.auto;
+	}
+	return parsed.data;
+};
+var setStartMode = (renderOptions, element, config) => {
+	config.startMode = resolveStartMode(renderOptions, element);
+};
+//#endregion
+exports.START_MODE_ATTRIBUTE = START_MODE_ATTRIBUTE;
+exports.resolveStartMode = resolveStartMode;
+exports.setStartMode = setStartMode;

package/dist/index.d.ts

@@ -1,7 +1,8 @@
-import type { ProcaptchaRenderOptions } from "@prosopo/types";
+import { type ProcaptchaRenderOptions } from "@prosopo/types";
 export declare const render: (element: Element, renderOptions: ProcaptchaRenderOptions) => Promise<string | undefined>;
 export default function ready(fn: () => void): void;
 export declare const execute: () => void;
+export declare const start: (widgetId?: string) => void;
 declare global {
     interface Window {
         procaptcha: {
@@ -10,6 +11,7 @@ declare global {
             reset: typeof reset;
             remove: typeof remove;
             execute: typeof execute;
+            start: typeof start;
         };
     }
 }

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAoB,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AA0LhF,eAAO,MAAM,MAAM,YACT,OAAO,iBACD,uBAAuB,KACpC,OAAO,CAAC,MAAM,GAAG,SAAS,CA6B5B,CAAC;AAEF,MAAM,CAAC,OAAO,UAAU,KAAK,CAAC,EAAE,EAAE,MAAM,IAAI,QAY3C;AAED,eAAO,MAAM,OAAO,YAqBnB,CAAC;AAkCF,OAAO,CAAC,MAAM,CAAC;IACd,UAAU,MAAM;QACf,UAAU,EAAE;YACX,KAAK,EAAE,OAAO,KAAK,CAAC;YACpB,MAAM,EAAE,OAAO,MAAM,CAAC;YACtB,KAAK,EAAE,OAAO,KAAK,CAAC;YACpB,MAAM,EAAE,OAAO,MAAM,CAAC;YACtB,OAAO,EAAE,OAAO,OAAO,CAAC;SACxB,CAAC;KACF;CACD;AAoDD,eAAO,MAAM,KAAK,cAAqB,MAAM,KAAG,OAAO,CAAC,IAAI,CAuB3D,CAAC;AAQF,eAAO,MAAM,MAAM,cAAe,MAAM,KAAG,IAW1C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAeA,OAAO,EAGN,KAAK,uBAAuB,EAG5B,MAAM,gBAAgB,CAAC;AAgMxB,eAAO,MAAM,MAAM,YACT,OAAO,iBACD,uBAAuB,KACpC,OAAO,CAAC,MAAM,GAAG,SAAS,CAgC5B,CAAC;AAEF,MAAM,CAAC,OAAO,UAAU,KAAK,CAAC,EAAE,EAAE,MAAM,IAAI,QAY3C;AAED,eAAO,MAAM,OAAO,YAqBnB,CAAC;AAGF,eAAO,MAAM,KAAK,cAAe,MAAM,KAAG,IAwBzC,CAAC;AAkCF,OAAO,CAAC,MAAM,CAAC;IACd,UAAU,MAAM;QACf,UAAU,EAAE;YACX,KAAK,EAAE,OAAO,KAAK,CAAC;YACpB,MAAM,EAAE,OAAO,MAAM,CAAC;YACtB,KAAK,EAAE,OAAO,KAAK,CAAC;YACpB,MAAM,EAAE,OAAO,MAAM,CAAC;YACtB,OAAO,EAAE,OAAO,OAAO,CAAC;YACxB,KAAK,EAAE,OAAO,KAAK,CAAC;SACpB,CAAC;KACF;CACD;AAoDD,eAAO,MAAM,KAAK,cAAqB,MAAM,KAAG,OAAO,CAAC,IAAI,CAuB3D,CAAC;AAQF,eAAO,MAAM,MAAM,cAAe,MAAM,KAAG,IAW1C,CAAC"}

package/dist/index.js

@@ -1,8 +1,10 @@
 import "./_virtual/_rolldown/runtime.js";
 import { extractParams, getProcaptchaScript } from "./util/config.js";
+import { resolveStartMode } from "./util/startMode.js";
 import { WidgetFactory } from "./util/widgetFactory.js";
 import { WidgetThemeResolver } from "./util/widgetThemeResolver.js";
 import { getWindowCallback } from "@prosopo/procaptcha-common";
+import { PROCAPTCHA_START_EVENT, StartModeEnum } from "@prosopo/types";
 import { at } from "@prosopo/util";
 //#region src/index.ts
 var BUNDLE_NAMES = ["procaptcha.bundle.iife.js", "procaptcha.bundle.js"];
@@ -34,6 +36,7 @@ var widgetFactory = new WidgetFactory(new WidgetThemeResolver());
 */
 var startDetectorPrefetch = (siteKey, flags) => {
 	if (!siteKey) return;
+	if (flags.startMode === StartModeEnum.manual) return;
 	Promise.all([import("@prosopo/procaptcha-frictionless"), import("@prosopo/procaptcha-common")]).then(([frictionless, common]) => {
 		frictionless.prefetchDetector(process.env.PROSOPO_DEFAULT_ENVIRONMENT, common.pickIpMode(flags), siteKey);
 	}).catch(() => void 0);
@@ -48,18 +51,21 @@ var implicitRender = async () => {
 		const web3 = firstElement.getAttribute("data-web3");
 		const ipv4 = firstElement.getAttribute("data-ipv4") === "true";
 		const ipv6 = firstElement.getAttribute("data-ipv6") === "true";
+		const startMode = resolveStartMode(void 0, firstElement);
 		if (!siteKey) {
 			console.error("No site key found");
 			return;
 		}
 		startDetectorPrefetch(siteKey, {
 			ipv4,
-			ipv6
+			ipv6,
+			startMode
 		});
 		const implicitRenderOptions = {
 			siteKey,
 			ipv4,
-			ipv6
+			ipv6,
+			startMode
 		};
 		registerWidgets(await widgetFactory.createWidgets(elements, implicitRenderOptions, !(web3 === "true")), elements, implicitRenderOptions, !(web3 === "true"), false);
 	}
@@ -69,15 +75,18 @@ var implicitRender = async () => {
 		const callback = button.getAttribute("data-callback") || "";
 		const ipv4 = button.getAttribute("data-ipv4") === "true";
 		const ipv6 = button.getAttribute("data-ipv6") === "true";
+		const startMode = resolveStartMode(void 0, button);
 		startDetectorPrefetch(siteKey, {
 			ipv4,
-			ipv6
+			ipv6,
+			startMode
 		});
 		const buttonRenderOptions = {
 			siteKey,
 			callback,
 			ipv4,
-			ipv6
+			ipv6,
+			startMode
 		};
 		registerWidgets(await widgetFactory.createWidgets([button], buttonRenderOptions, true, true), [button], buttonRenderOptions, true, true);
 		button.addEventListener("click", async (event) => {
@@ -96,7 +105,10 @@ var implicitRender = async () => {
 * factory legitimately yields nothing for an element it cannot mount into.
 */
 var render = async (element, renderOptions) => {
-	startDetectorPrefetch(renderOptions.siteKey, renderOptions);
+	startDetectorPrefetch(renderOptions.siteKey, {
+		...renderOptions,
+		startMode: resolveStartMode(renderOptions, element)
+	});
 	const hasInvisibleSize = Object.prototype.hasOwnProperty.call(renderOptions, "size") && renderOptions.size === "invisible";
 	const isWeb2 = !renderOptions.web3;
 	const invisible = hasInvisibleSize || element.tagName.toLowerCase() === "button";
@@ -132,6 +144,27 @@ var execute = () => {
 	});
 	document.dispatchEvent(executeEvent);
 };
+/** Starts a `startMode: "manual"` widget; omit the id to start all of them. */
+var start = (widgetId) => {
+	const ids = void 0 === widgetId ? Array.from(procaptchaWidgets.keys()) : [widgetId];
+	if (ids.length === 0) {
+		console.error("No Procaptcha widgets found to start");
+		return;
+	}
+	for (const id of ids) {
+		const entry = procaptchaWidgets.get(id);
+		if (!entry) {
+			console.error(`No Procaptcha widget found with id ${id}`);
+			continue;
+		}
+		const detail = { element: entry.element };
+		document.dispatchEvent(new CustomEvent(PROCAPTCHA_START_EVENT, {
+			detail,
+			bubbles: true,
+			cancelable: false
+		}));
+	}
+};
 function findProcaptchaContainers() {
 	const containers = [];
 	const invisibleContainers = Array.from(document.querySelectorAll("[data-size=\"invisible\"]"));
@@ -142,7 +175,7 @@ function findProcaptchaContainers() {
 	for (const container of idContainers) if (!containers.includes(container)) containers.push(container);
 	return containers;
 }
-var start = () => {
+var boot = () => {
 	const { onloadUrlCallback, renderExplicit } = extractParams(BUNDLE_NAMES);
 	let readyCalled = false;
 	if (renderExplicit !== "explicit") {
@@ -164,7 +197,7 @@ var start = () => {
 * widget id to reset one widget, or omit it to reset every widget on the page.
 *
 * This remounts rather than merely unmounting. The previous implementation
-* unmounted every root and then called `start()`, which only re-renders when
+* unmounted every root and then called `boot()`, which only re-renders when
 * the page uses implicit rendering — and even then only via the
 * `document.readyState` fallback, because the script's `load` event has long
 * since fired. On an explicitly-rendered page nothing came back at all: the
@@ -172,7 +205,7 @@ var start = () => {
 * request was ever made. Rebuilding from the stored descriptor makes reset
 * behave the same way on both paths.
 *
-* `start()` is deliberately not called here any more. It re-renders implicit
+* `boot()` is deliberately not called here any more. It re-renders implicit
 * widgets, which would double up with the remount below, and it attaches
 * another `load` listener to the script tag on every call.
 */
@@ -211,7 +244,8 @@ window.procaptcha = {
 	render,
 	reset,
 	remove,
-	execute
+	execute,
+	start
 };
 var procaptchaReadyEvent = new CustomEvent(PROCAPTCHA_READY_EVENT, {
 	detail: { timestamp: Date.now() },
@@ -219,6 +253,6 @@ var procaptchaReadyEvent = new CustomEvent(PROCAPTCHA_READY_EVENT, {
 	cancelable: false
 });
 document.dispatchEvent(procaptchaReadyEvent);
-start();
+boot();
 //#endregion
-export { ready as default, execute, remove, render, reset };
+export { ready as default, execute, remove, render, reset, start };