@prosopo/procaptcha-common 2.14.1 → 2.15.0

package/.turbo/turbo-build$colon$cjs.log

@@ -1,5 +1,5 @@
 
-> @prosopo/procaptcha-common@2.14.1 build:cjs
+> @prosopo/procaptcha-common@2.15.0 build:cjs
 > NODE_ENV=${NODE_ENV:-development}; vite build --config vite.cjs.config.ts --mode $NODE_ENV
 
 ViteCommonJSConfig: .
@@ -39,25 +39,26 @@ ViteCommonJSConfig: .
 vite v8.1.5 building ssr environment for production...
 Bundle build started
 
-✓ 17 modules transformed.
+✓ 18 modules transformed.
 rendering chunks...
 computing gzip size...
 dist/cjs/extensionLoader.cjs                   0.27 kB │ gzip: 0.16 kB
 dist/cjs/callbacks/defaultEvents.cjs           0.28 kB │ gzip: 0.16 kB
 dist/cjs/elements/form.cjs                     0.62 kB │ gzip: 0.31 kB
 dist/cjs/simdReadings.cjs                      0.79 kB │ gzip: 0.36 kB
-dist/cjs/clientMetaData.cjs                    0.83 kB │ gzip: 0.47 kB
 dist/cjs/events/trust.cjs                      0.91 kB │ gzip: 0.53 kB
 dist/cjs/_virtual/_rolldown/runtime.cjs        1.00 kB │ gzip: 0.50 kB
 dist/cjs/elements/window.cjs                   1.12 kB │ gzip: 0.60 kB
+dist/cjs/clientMetaData.cjs                    1.31 kB │ gzip: 0.67 kB
 dist/cjs/reactComponents/TestModeBanner.cjs    1.36 kB │ gzip: 0.75 kB
 dist/cjs/providers.cjs                         1.54 kB │ gzip: 0.64 kB
 dist/cjs/reactComponents/Honeypot.cjs          2.03 kB │ gzip: 0.91 kB
-dist/cjs/index.cjs                             2.45 kB │ gzip: 0.63 kB
+dist/cjs/index.cjs                             2.66 kB │ gzip: 0.67 kB
+dist/cjs/protectSession.cjs                    2.80 kB │ gzip: 1.32 kB
 dist/cjs/reactComponents/Reload.cjs            2.94 kB │ gzip: 1.30 kB
 dist/cjs/state/builder.cjs                     3.13 kB │ gzip: 0.84 kB
 dist/cjs/callbacks/defaultCallbacks.cjs        3.78 kB │ gzip: 1.01 kB
 dist/cjs/reactComponents/Checkbox.cjs          6.21 kB │ gzip: 2.42 kB
 dist/cjs/reactComponents/ChallengeSurface.cjs  6.72 kB │ gzip: 2.29 kB
 
-✓ built in 86ms
+✓ built in 89ms

package/.turbo/turbo-build$colon$tsc.log

@@ -1,8 +1,8 @@
 
-> @prosopo/procaptcha-common@2.14.1 build:tsc
+> @prosopo/procaptcha-common@2.15.0 build:tsc
 > tsc --build --verbose
 
-1:04:33 PM - Projects in this build: 
+2:42:45 PM - Projects in this build: 
     * ../../dev/config/tsconfig.json
     * ../locale/tsconfig.json
     * ../util/tsconfig.json
@@ -18,35 +18,35 @@
     * ../account/tsconfig.json
     * tsconfig.json
 
-1:04:34 PM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/webpack/webpack.config.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
+2:42:45 PM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/webpack/webpack.config.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
 
-1:04:34 PM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/translationKey.ts' is older than output '../locale/tsconfig.tsbuildinfo'
+2:42:45 PM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/translationKey.ts' is older than output '../locale/tsconfig.tsbuildinfo'
 
-1:04:34 PM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
+2:42:45 PM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
 
-1:04:34 PM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/logger.ts' is older than output '../logger/tsconfig.tsbuildinfo'
+2:42:45 PM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/index.ts' is older than output '../logger/tsconfig.tsbuildinfo'
 
-1:04:34 PM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
+2:42:45 PM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
 
-1:04:34 PM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/types.test-d.ts' is older than output '../types/tsconfig.tsbuildinfo'
+2:42:45 PM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/types.test-d.ts' is older than output '../types/tsconfig.tsbuildinfo'
 
-1:04:34 PM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/tests/utils/batches.unit.test.ts' is older than output '../common/tsconfig.tsbuildinfo'
+2:42:45 PM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/utils/batches.ts' is older than output '../common/tsconfig.tsbuildinfo'
 
-1:04:34 PM - Project '../load-balancer/tsconfig.json' is up to date because newest input '../load-balancer/src/tests/productionProviderList.unit.test.ts' is older than output '../load-balancer/tsconfig.tsbuildinfo'
+2:42:45 PM - Project '../load-balancer/tsconfig.json' is up to date because newest input '../load-balancer/src/tests/productionProviderList.unit.test.ts' is older than output '../load-balancer/tsconfig.tsbuildinfo'
 
-1:04:34 PM - Project '../widget-skeleton/tsconfig.json' is up to date because newest input '../widget-skeleton/src/webComponent/createWidget.ts' is older than output '../widget-skeleton/tsconfig.tsbuildinfo'
+2:42:45 PM - Project '../widget-skeleton/tsconfig.json' is up to date because newest input '../widget-skeleton/src/webComponent/createWebComponent.ts' is older than output '../widget-skeleton/tsconfig.tsbuildinfo'
 
-1:04:34 PM - Project '../fingerprintjs/tsconfig.json' is up to date because newest input '../fingerprintjs/src/utils/browser.ts' is older than output '../fingerprintjs/tsconfig.tsbuildinfo'
+2:42:45 PM - Project '../fingerprintjs/tsconfig.json' is up to date because newest input '../fingerprintjs/src/utils/browser.ts' is older than output '../fingerprintjs/tsconfig.tsbuildinfo'
 
-1:04:34 PM - Project '../fingerprint/tsconfig.json' is up to date because newest input '../fingerprint/src/index.ts' is older than output '../fingerprint/tsconfig.tsbuildinfo'
+2:42:45 PM - Project '../fingerprint/tsconfig.json' is up to date because newest input '../fingerprint/src/index.ts' is older than output '../fingerprint/tsconfig.tsbuildinfo'
 
-1:04:34 PM - Project '../keyring/tsconfig.json' is up to date because newest input '../keyring/src/pair/decode.ts' is older than output '../keyring/tsconfig.tsbuildinfo'
+2:42:45 PM - Project '../keyring/tsconfig.json' is up to date because newest input '../keyring/src/pair/decode.ts' is older than output '../keyring/tsconfig.tsbuildinfo'
 
-1:04:34 PM - Project '../account/tsconfig.json' is out of date because output file '../account/tsconfig.tsbuildinfo' does not exist
+2:42:45 PM - Project '../account/tsconfig.json' is out of date because output file '../account/tsconfig.tsbuildinfo' does not exist
 
-1:04:34 PM - Building project '/home/runner/work/captcha/captcha/packages/account/tsconfig.json'...
+2:42:45 PM - Building project '/home/runner/work/captcha/captcha/packages/account/tsconfig.json'...
 
-1:04:37 PM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
+2:42:48 PM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
 
-1:04:37 PM - Building project '/home/runner/work/captcha/captcha/packages/procaptcha-common/tsconfig.json'...
+2:42:48 PM - Building project '/home/runner/work/captcha/captcha/packages/procaptcha-common/tsconfig.json'...
 

package/.turbo/turbo-build.log

@@ -1,9 +1,9 @@
 
-> @prosopo/procaptcha-common@2.14.1 build
+> @prosopo/procaptcha-common@2.15.0 build
 > npm run build:cross-env -- --mode ${NODE_ENV:-development}
 
 
-> @prosopo/procaptcha-common@2.14.1 build:cross-env
+> @prosopo/procaptcha-common@2.15.0 build:cross-env
 > vite build --config vite.esm.config.ts --mode production
 
 ViteEsmConfig: .
@@ -43,7 +43,7 @@ ViteEsmConfig: .
 vite v8.1.5 building ssr environment for production...
 Bundle build started
 
-✓ 17 modules transformed.
+✓ 18 modules transformed.
 rendering chunks...
 computing gzip size...
 dist/_virtual/_rolldown/runtime.js        0.04 kB │ gzip: 0.06 kB
@@ -51,17 +51,18 @@ dist/callbacks/defaultEvents.js           0.23 kB │ gzip: 0.15 kB
 dist/extensionLoader.js                   0.25 kB │ gzip: 0.16 kB
 dist/elements/form.js                     0.56 kB │ gzip: 0.30 kB
 dist/simdReadings.js                      0.72 kB │ gzip: 0.35 kB
-dist/clientMetaData.js                    0.81 kB │ gzip: 0.47 kB
 dist/events/trust.js                      0.89 kB │ gzip: 0.52 kB
 dist/elements/window.js                   1.07 kB │ gzip: 0.60 kB
 dist/reactComponents/TestModeBanner.js    1.23 kB │ gzip: 0.71 kB
+dist/clientMetaData.js                    1.27 kB │ gzip: 0.66 kB
 dist/providers.js                         1.41 kB │ gzip: 0.62 kB
-dist/index.js                             1.49 kB │ gzip: 0.50 kB
+dist/index.js                             1.60 kB │ gzip: 0.53 kB
 dist/reactComponents/Honeypot.js          1.86 kB │ gzip: 0.89 kB
 dist/reactComponents/Reload.js            2.69 kB │ gzip: 1.26 kB
+dist/protectSession.js                    2.74 kB │ gzip: 1.31 kB
 dist/state/builder.js                     3.09 kB │ gzip: 0.84 kB
 dist/callbacks/defaultCallbacks.js        3.58 kB │ gzip: 0.98 kB
 dist/reactComponents/Checkbox.js          5.66 kB │ gzip: 2.34 kB
 dist/reactComponents/ChallengeSurface.js  6.39 kB │ gzip: 2.21 kB
 
-✓ built in 89ms
+✓ built in 98ms

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # @prosopo/procaptcha-common
 
+## 2.15.0
+### Minor Changes
+
+- 0f23010: Correlate captcha sessions with Prosopo Protect sessions on sites that run both.
+  
+  Protect's challenge page already renders the widget with `data-sessionid=<its session id>`, so captchas served from the interstitial can be matched back to the Protect session. A widget the site embeds itself — on its own pages — had no way to know that id, so those sessions could not be matched to anything.
+  
+  The widget now falls back to reading Protect's session id from the page (`window.prosopo_protect.jti`, or the `prosopo_session` cookie Protect sets on the site's domain) when the site has not supplied a session id of its own. A session id the site does supply always wins, so nothing changes for sites that use the field themselves, and sites without Protect are unaffected. Only the id is read — the session token that shares the cookie never leaves the page.
+  
+  Two gaps in the existing field are closed alongside it: the widget now sends the session id when it first asks for a captcha rather than only when submitting a solution, and the provider records it on the session at that point. Previously a session that was allowed without a challenge, or abandoned before the user solved one, carried no session id at all. An escalated session now inherits the id from the session it escalated from.
+
+### Patch Changes
+
+- Updated dependencies [a606f54]
+- Updated dependencies [0f23010]
+  - @prosopo/types@5.9.0
+  - @prosopo/account@2.8.95
+  - @prosopo/load-balancer@2.10.47
+
+## 2.14.2
+### Patch Changes
+
+- Updated dependencies [be25974]
+  - @prosopo/types@5.8.5
+  - @prosopo/account@2.8.94
+  - @prosopo/load-balancer@2.10.46
+
 ## 2.14.1
 ### Patch Changes
 

package/dist/cjs/clientMetaData.cjs

@@ -1,3 +1,4 @@
+const require_protectSession = require("./protectSession.cjs");
 //#region src/clientMetaData.ts
 /**
 * Assembles the widget-controlled metadata attached to a captcha solution.
@@ -7,14 +8,21 @@
 * Returns `undefined` when nothing is set, so the submission body omits the
 * key entirely rather than carrying an empty object.
 *
+* A site that renders no session id of its own but runs Prosopo Protect falls
+* back to Protect's session id, which is the same value Protect's own
+* challenge page renders the widget with. Read here rather than at render time
+* because Protect initialises asynchronously and may not have a session yet
+* when the widget mounts.
+*
 * @param hp - live honeypot input value, if the honeypot was filled in
 * @param clientSessionId - the site's session id, if the widget was rendered
 *   with `data-sessionid` / `renderOptions.sessionId`
 */
 var buildClientMetaData = (hp, clientSessionId) => {
+	const sessionId = require_protectSession.resolveClientSessionId(clientSessionId);
 	const clientMetaData = {
 		...hp && { hp },
-		...clientSessionId && { clientSessionId }
+		...sessionId && { clientSessionId: sessionId }
 	};
 	return Object.keys(clientMetaData).length > 0 ? clientMetaData : void 0;
 };

package/dist/cjs/index.cjs

@@ -1,5 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_providers = require("./providers.cjs");
+const require_protectSession = require("./protectSession.cjs");
 const require_clientMetaData = require("./clientMetaData.cjs");
 const require_trust = require("./events/trust.cjs");
 const require_builder = require("./state/builder.cjs");
@@ -26,6 +27,7 @@ exports.computeFloatPosition = require_ChallengeSurface.computeFloatPosition;
 exports.getDefaultCallbacks = require_defaultCallbacks.getDefaultCallbacks;
 exports.getDefaultEvents = require_defaultEvents.getDefaultEvents;
 exports.getProcaptchaRandomActiveProvider = require_providers.getProcaptchaRandomActiveProvider;
+exports.getProtectJti = require_protectSession.getProtectJti;
 exports.getRetryDelayMs = require_providers.getRetryDelayMs;
 exports.getSimdReadingsForSubmit = require_simdReadings.getSimdReadingsForSubmit;
 exports.getWindowCallback = require_window.getWindowCallback;
@@ -33,5 +35,6 @@ exports.isEventTrusted = require_trust.isEventTrusted;
 exports.isSecureBrowserContext = require_window.isSecureBrowserContext;
 exports.pickIpMode = require_providers.pickIpMode;
 exports.providerRetry = require_providers.providerRetry;
+exports.resolveClientSessionId = require_protectSession.resolveClientSessionId;
 exports.setUserCallbacks = require_defaultCallbacks.setUserCallbacks;
 exports.useProcaptcha = require_builder.useProcaptcha;

package/dist/cjs/protectSession.cjs

@@ -0,0 +1,64 @@
+let _prosopo_types = require("@prosopo/types");
+//#region src/protectSession.ts
+var PROTECT_GLOBAL = "prosopo_protect";
+var PROTECT_COOKIE = "prosopo_session";
+var isProtectGlobal = (value) => typeof value === "object" && value !== null;
+/**
+* `bumblebee-<uuid>` today, but the prefix names the edge that issued the
+* session, so this only rejects what could not be an id at all.
+*
+* The length bound is load-bearing rather than defensive: the provider caps
+* `clientSessionId` at `INPUT_LIMITS.ID` and rejects the whole solution body
+* when it is longer, so an oversized value here would fail the solve rather
+* than just losing the correlation.
+*/
+var isUsableJti = (value) => value.length > 0 && value.length <= _prosopo_types.INPUT_LIMITS.ID && /^[A-Za-z0-9._-]+$/.test(value);
+var readGlobalJti = () => {
+	const global = Reflect.get(window, PROTECT_GLOBAL);
+	if (!isProtectGlobal(global) || typeof global.jti !== "string") return;
+	const jti = global.jti.trim();
+	return isUsableJti(jti) ? jti : void 0;
+};
+var readCookieJti = () => {
+	if (typeof document === "undefined") return;
+	for (const pair of document.cookie.split(";")) {
+		const separator = pair.indexOf("=");
+		if (separator === -1 || pair.slice(0, separator).trim() !== PROTECT_COOKIE) continue;
+		const jti = pair.slice(separator + 1).trim().split("|")[0];
+		return jti !== void 0 && isUsableJti(jti) ? jti : void 0;
+	}
+};
+/**
+* The Protect session id (JTI) for this page, when the site runs Prosopo
+* Protect alongside the captcha.
+*
+* Protect publishes it two ways, both read here: `window.prosopo_protect.jti`,
+* and the `prosopo_session` cookie it sets on the registrable domain (so a
+* session minted at `protect.example.com` is visible on `www.example.com`).
+* The global is preferred — it is the value Protect itself is using, whereas
+* the cookie may have been rewritten by anything on the page.
+*
+* Undefined whenever the site does not run Protect, the widget is embedded
+* cross-origin, or Protect has not finished initialising. Every caller treats
+* that as "no correlation available", never as a fault.
+*/
+var getProtectJti = () => {
+	if (typeof window === "undefined") return;
+	try {
+		return readGlobalJti() ?? readCookieJti();
+	} catch {
+		return;
+	}
+};
+/**
+* The session id this widget reports to the provider: whatever the site asked
+* for, and Protect's session id only when the site asked for nothing.
+*
+* One function so the precedence is stated once — the frictionless request and
+* the solution submit have to agree on it, or the provider's own
+* mismatch check would fire on a session it built both halves of.
+*/
+var resolveClientSessionId = (clientSessionId) => clientSessionId || getProtectJti();
+//#endregion
+exports.getProtectJti = getProtectJti;
+exports.resolveClientSessionId = resolveClientSessionId;

package/dist/clientMetaData.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"clientMetaData.d.ts","sourceRoot":"","sources":["../src/clientMetaData.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAcrD,eAAO,MAAM,mBAAmB,QAC1B,MAAM,oBACO,MAAM,KACtB,cAAc,GAAG,SAOnB,CAAC"}
+{"version":3,"file":"clientMetaData.d.ts","sourceRoot":"","sources":["../src/clientMetaData.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAqBrD,eAAO,MAAM,mBAAmB,QAC1B,MAAM,oBACO,MAAM,KACtB,cAAc,GAAG,SAQnB,CAAC"}

package/dist/clientMetaData.js

@@ -1,3 +1,4 @@
+import { resolveClientSessionId } from "./protectSession.js";
 //#region src/clientMetaData.ts
 /**
 * Assembles the widget-controlled metadata attached to a captcha solution.
@@ -7,14 +8,21 @@
 * Returns `undefined` when nothing is set, so the submission body omits the
 * key entirely rather than carrying an empty object.
 *
+* A site that renders no session id of its own but runs Prosopo Protect falls
+* back to Protect's session id, which is the same value Protect's own
+* challenge page renders the widget with. Read here rather than at render time
+* because Protect initialises asynchronously and may not have a session yet
+* when the widget mounts.
+*
 * @param hp - live honeypot input value, if the honeypot was filled in
 * @param clientSessionId - the site's session id, if the widget was rendered
 *   with `data-sessionid` / `renderOptions.sessionId`
 */
 var buildClientMetaData = (hp, clientSessionId) => {
+	const sessionId = resolveClientSessionId(clientSessionId);
 	const clientMetaData = {
 		...hp && { hp },
-		...clientSessionId && { clientSessionId }
+		...sessionId && { clientSessionId: sessionId }
 	};
 	return Object.keys(clientMetaData).length > 0 ? clientMetaData : void 0;
 };

package/dist/clientMetaData.js.map

@@ -1 +1 @@
-{"version":3,"file":"clientMetaData.js","sourceRoot":"","sources":["../src/clientMetaData.ts"],"names":[],"mappings":"AA4BA,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAClC,EAAW,EACX,eAAwB,EACK,EAAE;IAC/B,MAAM,cAAc,GAAmB;QACtC,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QACjB,GAAG,CAAC,eAAe,IAAI,EAAE,eAAe,EAAE,CAAC;KAC3C,CAAC;IAEF,OAAO,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5E,CAAC,CAAC"}
+{"version":3,"file":"clientMetaData.js","sourceRoot":"","sources":["../src/clientMetaData.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAoB7D,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAClC,EAAW,EACX,eAAwB,EACK,EAAE;IAC/B,MAAM,SAAS,GAAG,sBAAsB,CAAC,eAAe,CAAC,CAAC;IAC1D,MAAM,cAAc,GAAmB;QACtC,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QACjB,GAAG,CAAC,SAAS,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC;KAChD,CAAC;IAEF,OAAO,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5E,CAAC,CAAC"}

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 export * from "./providers.js";
 export * from "./clientMetaData.js";
+export * from "./protectSession.js";
 export * from "./events/trust.js";
 export * from "./state/builder.js";
 export * from "./callbacks/defaultCallbacks.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAcA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iCAAiC,CAAC;AAChD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,uCAAuC,CAAC;AACtD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,qCAAqC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAcA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iCAAiC,CAAC;AAChD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,uCAAuC,CAAC;AACtD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,qCAAqC,CAAC"}

package/dist/index.js

@@ -1,5 +1,6 @@
 import "./_virtual/_rolldown/runtime.js";
 import { getProcaptchaRandomActiveProvider, getRetryDelayMs, pickIpMode, providerRetry } from "./providers.js";
+import { getProtectJti, resolveClientSessionId } from "./protectSession.js";
 import { buildClientMetaData } from "./clientMetaData.js";
 import { isEventTrusted } from "./events/trust.js";
 import { buildUpdateState, useProcaptcha } from "./state/builder.js";
@@ -13,4 +14,4 @@ import { Checkbox } from "./reactComponents/Checkbox.js";
 import { ChallengeSurface, computeFloatPosition } from "./reactComponents/ChallengeSurface.js";
 import { Honeypot } from "./reactComponents/Honeypot.js";
 import { TestModeBanner } from "./reactComponents/TestModeBanner.js";
-export { ChallengeSurface, Checkbox, ExtensionLoader, Honeypot, ReloadButton, SIMD_READINGS_SUBMIT_TIMEOUT_MS, TestModeBanner, buildClientMetaData, buildUpdateState, computeFloatPosition, getDefaultCallbacks, getDefaultEvents, getProcaptchaRandomActiveProvider, getRetryDelayMs, getSimdReadingsForSubmit, getWindowCallback, isEventTrusted, isSecureBrowserContext, pickIpMode, providerRetry, setUserCallbacks, useProcaptcha };
+export { ChallengeSurface, Checkbox, ExtensionLoader, Honeypot, ReloadButton, SIMD_READINGS_SUBMIT_TIMEOUT_MS, TestModeBanner, buildClientMetaData, buildUpdateState, computeFloatPosition, getDefaultCallbacks, getDefaultEvents, getProcaptchaRandomActiveProvider, getProtectJti, getRetryDelayMs, getSimdReadingsForSubmit, getWindowCallback, isEventTrusted, isSecureBrowserContext, pickIpMode, providerRetry, resolveClientSessionId, setUserCallbacks, useProcaptcha };

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAcA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iCAAiC,CAAC;AAChD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,uCAAuC,CAAC;AACtD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,qCAAqC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAcA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iCAAiC,CAAC;AAChD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,uCAAuC,CAAC;AACtD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,qCAAqC,CAAC"}

package/dist/protectSession.d.ts

@@ -0,0 +1,3 @@
+export declare const getProtectJti: () => string | undefined;
+export declare const resolveClientSessionId: (clientSessionId?: string) => string | undefined;
+//# sourceMappingURL=protectSession.d.ts.map

package/dist/protectSession.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protectSession.d.ts","sourceRoot":"","sources":["../src/protectSession.ts"],"names":[],"mappings":"AAsFA,eAAO,MAAM,aAAa,QAAO,MAAM,GAAG,SAWzC,CAAC;AAUF,eAAO,MAAM,sBAAsB,qBAChB,MAAM,KACtB,MAAM,GAAG,SAA+C,CAAC"}

package/dist/protectSession.js

@@ -0,0 +1,63 @@
+import { INPUT_LIMITS } from "@prosopo/types";
+//#region src/protectSession.ts
+var PROTECT_GLOBAL = "prosopo_protect";
+var PROTECT_COOKIE = "prosopo_session";
+var isProtectGlobal = (value) => typeof value === "object" && value !== null;
+/**
+* `bumblebee-<uuid>` today, but the prefix names the edge that issued the
+* session, so this only rejects what could not be an id at all.
+*
+* The length bound is load-bearing rather than defensive: the provider caps
+* `clientSessionId` at `INPUT_LIMITS.ID` and rejects the whole solution body
+* when it is longer, so an oversized value here would fail the solve rather
+* than just losing the correlation.
+*/
+var isUsableJti = (value) => value.length > 0 && value.length <= INPUT_LIMITS.ID && /^[A-Za-z0-9._-]+$/.test(value);
+var readGlobalJti = () => {
+	const global = Reflect.get(window, PROTECT_GLOBAL);
+	if (!isProtectGlobal(global) || typeof global.jti !== "string") return;
+	const jti = global.jti.trim();
+	return isUsableJti(jti) ? jti : void 0;
+};
+var readCookieJti = () => {
+	if (typeof document === "undefined") return;
+	for (const pair of document.cookie.split(";")) {
+		const separator = pair.indexOf("=");
+		if (separator === -1 || pair.slice(0, separator).trim() !== PROTECT_COOKIE) continue;
+		const jti = pair.slice(separator + 1).trim().split("|")[0];
+		return jti !== void 0 && isUsableJti(jti) ? jti : void 0;
+	}
+};
+/**
+* The Protect session id (JTI) for this page, when the site runs Prosopo
+* Protect alongside the captcha.
+*
+* Protect publishes it two ways, both read here: `window.prosopo_protect.jti`,
+* and the `prosopo_session` cookie it sets on the registrable domain (so a
+* session minted at `protect.example.com` is visible on `www.example.com`).
+* The global is preferred — it is the value Protect itself is using, whereas
+* the cookie may have been rewritten by anything on the page.
+*
+* Undefined whenever the site does not run Protect, the widget is embedded
+* cross-origin, or Protect has not finished initialising. Every caller treats
+* that as "no correlation available", never as a fault.
+*/
+var getProtectJti = () => {
+	if (typeof window === "undefined") return;
+	try {
+		return readGlobalJti() ?? readCookieJti();
+	} catch {
+		return;
+	}
+};
+/**
+* The session id this widget reports to the provider: whatever the site asked
+* for, and Protect's session id only when the site asked for nothing.
+*
+* One function so the precedence is stated once — the frictionless request and
+* the solution submit have to agree on it, or the provider's own
+* mismatch check would fire on a session it built both halves of.
+*/
+var resolveClientSessionId = (clientSessionId) => clientSessionId || getProtectJti();
+//#endregion
+export { getProtectJti, resolveClientSessionId };

package/dist/protectSession.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protectSession.js","sourceRoot":"","sources":["../src/protectSession.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,MAAM,cAAc,GAAG,iBAAiB,CAAC;AACzC,MAAM,cAAc,GAAG,iBAAiB,CAAC;AAMzC,MAAM,eAAe,GAAG,CAAC,KAAc,EAA0B,EAAE,CAClE,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AAW7C,MAAM,WAAW,GAAG,CAAC,KAAa,EAAW,EAAE,CAC9C,KAAK,CAAC,MAAM,GAAG,CAAC;IAChB,KAAK,CAAC,MAAM,IAAI,YAAY,CAAC,EAAE;IAC/B,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAEjC,MAAM,aAAa,GAAG,GAAuB,EAAE;IAC9C,MAAM,MAAM,GAAY,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC5D,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QAChE,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3C,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,GAAuB,EAAE;IAC9C,IAAI,OAAO,QAAQ,KAAK,WAAW,EAAE,CAAC;QACrC,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,IACC,SAAS,KAAK,CAAC,CAAC;YAChB,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,KAAK,cAAc,EACjD,CAAC;YACF,SAAS;QACV,CAAC;QAGD,MAAM,GAAG,GAAG,IAAI;aACd,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;aACpB,IAAI,EAAE;aACN,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO,GAAG,KAAK,SAAS,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC,CAAC;AAgBF,MAAM,CAAC,MAAM,aAAa,GAAG,GAAuB,EAAE;IACrD,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QACnC,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,CAAC;QACJ,OAAO,aAAa,EAAE,IAAI,aAAa,EAAE,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QAGR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC,CAAC;AAUF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACrC,eAAwB,EACH,EAAE,CAAC,eAAe,IAAI,aAAa,EAAE,CAAC"}

package/dist/tests/clientMetaData.test.js

@@ -1,5 +1,12 @@
-import { describe, expect, it } from "vitest";
+import { afterEach, describe, expect, it } from "vitest";
 import { buildClientMetaData } from "../clientMetaData.js";
+const PROTECT_JTI = "bumblebee-0f1e2d3c-4b5a-6978-8796-a5b4c3d2e1f0";
+const runProtect = () => {
+    Reflect.set(window, "prosopo_protect", { jti: PROTECT_JTI, ready: true });
+};
+afterEach(() => {
+    Reflect.deleteProperty(window, "prosopo_protect");
+});
 describe("buildClientMetaData", () => {
     it("returns undefined when the widget has nothing to report", () => {
         expect(buildClientMetaData(undefined, undefined)).toBeUndefined();
@@ -23,5 +30,17 @@ describe("buildClientMetaData", () => {
             clientSessionId: "jti-1",
         });
     });
+    it("falls back to Protect's session id when the site rendered none", () => {
+        runProtect();
+        expect(buildClientMetaData(undefined, undefined)).toEqual({
+            clientSessionId: PROTECT_JTI,
+        });
+    });
+    it("leaves the site's own session id alone when Protect is also present", () => {
+        runProtect();
+        expect(buildClientMetaData(undefined, "site-session-1")).toEqual({
+            clientSessionId: "site-session-1",
+        });
+    });
 });
 //# sourceMappingURL=clientMetaData.test.js.map

package/dist/tests/clientMetaData.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"clientMetaData.test.js","sourceRoot":"","sources":["../../src/tests/clientMetaData.test.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAE3D,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QAClE,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QAC1E,MAAM,CAAC,mBAAmB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,mBAAmB,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;YAChE,EAAE,EAAE,gBAAgB;SACpB,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;YACvD,eAAe,EAAE,OAAO;SACxB,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;YACpD,EAAE,EAAE,MAAM;YACV,eAAe,EAAE,OAAO;SACxB,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}
+{"version":3,"file":"clientMetaData.test.js","sourceRoot":"","sources":["../../src/tests/clientMetaData.test.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAE3D,MAAM,WAAW,GAAG,gDAAgD,CAAC;AAErE,MAAM,UAAU,GAAG,GAAS,EAAE;IAC7B,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC3E,CAAC,CAAC;AAEF,SAAS,CAAC,GAAG,EAAE;IACd,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;AACnD,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QAClE,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QAC1E,MAAM,CAAC,mBAAmB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,mBAAmB,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;YAChE,EAAE,EAAE,gBAAgB;SACpB,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;YACvD,eAAe,EAAE,OAAO;SACxB,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;YACpD,EAAE,EAAE,MAAM;YACV,eAAe,EAAE,OAAO;SACxB,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACzE,UAAU,EAAE,CAAC;QAEb,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;YACzD,eAAe,EAAE,WAAW;SAC5B,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC9E,UAAU,EAAE,CAAC;QAEb,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC;YAChE,eAAe,EAAE,gBAAgB;SACjC,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/tests/protectSession.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=protectSession.test.d.ts.map

package/dist/tests/protectSession.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protectSession.test.d.ts","sourceRoot":"","sources":["../../src/tests/protectSession.test.ts"],"names":[],"mappings":""}

package/dist/tests/protectSession.test.js

@@ -0,0 +1,95 @@
+import { INPUT_LIMITS } from "@prosopo/types";
+import { afterEach, describe, expect, it } from "vitest";
+import { getProtectJti, resolveClientSessionId } from "../protectSession.js";
+const JTI = "bumblebee-0f1e2d3c-4b5a-6978-8796-a5b4c3d2e1f0";
+const JWT = "eyJhbGciOiJzcjI1NTE5In0.eyJqdGkiOiJ4In0.c2lnbmF0dXJl";
+const setCookie = (value) => {
+    document.cookie = `prosopo_session=${value}; path=/`;
+};
+const clearCookie = () => {
+    document.cookie = "prosopo_session=; path=/; max-age=0";
+};
+const setGlobal = (value) => {
+    Reflect.set(window, "prosopo_protect", value);
+};
+afterEach(() => {
+    Reflect.deleteProperty(window, "prosopo_protect");
+    clearCookie();
+});
+describe("getProtectJti", () => {
+    it("returns undefined when the site does not run Protect", () => {
+        expect(getProtectJti()).toBeUndefined();
+    });
+    it("reads the jti from the Protect global", () => {
+        setGlobal({ version: "0.1.0", jti: JTI, ready: true });
+        expect(getProtectJti()).toBe(JTI);
+    });
+    it("falls back to the session cookie when the global has no jti yet", () => {
+        setGlobal({ version: "0.1.0", ready: false });
+        setCookie(`${JTI}|${JWT}`);
+        expect(getProtectJti()).toBe(JTI);
+    });
+    it("never returns the jwt half of the cookie", () => {
+        setCookie(`${JTI}|${JWT}`);
+        const jti = getProtectJti();
+        expect(jti).toBe(JTI);
+        expect(jti).not.toContain(JWT);
+    });
+    it("reads a cookie that carries the jti alone", () => {
+        setCookie(JTI);
+        expect(getProtectJti()).toBe(JTI);
+    });
+    it("ignores an empty jti in the cookie", () => {
+        setCookie(`|${JWT}`);
+        expect(getProtectJti()).toBeUndefined();
+    });
+    it("ignores other cookies whose name merely ends in the same suffix", () => {
+        document.cookie = `not_prosopo_session=${JTI}; path=/`;
+        expect(getProtectJti()).toBeUndefined();
+        document.cookie = "not_prosopo_session=; path=/; max-age=0";
+    });
+    it("ignores a jti longer than the provider accepts", () => {
+        setGlobal({ jti: "a".repeat(INPUT_LIMITS.ID + 1) });
+        expect(getProtectJti()).toBeUndefined();
+    });
+    it("accepts a jti exactly at the limit", () => {
+        const atLimit = "a".repeat(INPUT_LIMITS.ID);
+        setGlobal({ jti: atLimit });
+        expect(getProtectJti()).toBe(atLimit);
+    });
+    it("ignores a jti containing characters an id cannot have", () => {
+        setGlobal({ jti: "bumblebee-<script>" });
+        expect(getProtectJti()).toBeUndefined();
+    });
+    it("ignores a non-string jti", () => {
+        setGlobal({ jti: 42 });
+        expect(getProtectJti()).toBeUndefined();
+    });
+    it("survives a page that defines the global as a throwing getter", () => {
+        Object.defineProperty(window, "prosopo_protect", {
+            configurable: true,
+            get: () => {
+                throw new Error("nope");
+            },
+        });
+        expect(getProtectJti()).toBeUndefined();
+    });
+});
+describe("resolveClientSessionId", () => {
+    it("prefers the session id the site rendered the widget with", () => {
+        setGlobal({ jti: JTI });
+        expect(resolveClientSessionId("site-session-1")).toBe("site-session-1");
+    });
+    it("falls back to Protect when the site rendered no session id", () => {
+        setGlobal({ jti: JTI });
+        expect(resolveClientSessionId(undefined)).toBe(JTI);
+    });
+    it("treats an empty site session id as none", () => {
+        setGlobal({ jti: JTI });
+        expect(resolveClientSessionId("")).toBe(JTI);
+    });
+    it("returns undefined when neither is available", () => {
+        expect(resolveClientSessionId(undefined)).toBeUndefined();
+    });
+});
+//# sourceMappingURL=protectSession.test.js.map

package/dist/tests/protectSession.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protectSession.test.js","sourceRoot":"","sources":["../../src/tests/protectSession.test.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAE7E,MAAM,GAAG,GAAG,gDAAgD,CAAC;AAC7D,MAAM,GAAG,GAAG,sDAAsD,CAAC;AAEnE,MAAM,SAAS,GAAG,CAAC,KAAa,EAAQ,EAAE;IACzC,QAAQ,CAAC,MAAM,GAAG,mBAAmB,KAAK,UAAU,CAAC;AACtD,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,GAAS,EAAE;IAC9B,QAAQ,CAAC,MAAM,GAAG,qCAAqC,CAAC;AACzD,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,CAAC,KAAc,EAAQ,EAAE;IAC1C,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE,KAAK,CAAC,CAAC;AAC/C,CAAC,CAAC;AAEF,SAAS,CAAC,GAAG,EAAE;IACd,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAClD,WAAW,EAAE,CAAC;AACf,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC/D,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAChD,SAAS,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAEvD,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QAC1E,SAAS,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9C,SAAS,CAAC,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC;QAE3B,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QACnD,SAAS,CAAC,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC;QAE3B,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;QAE5B,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACpD,SAAS,CAAC,GAAG,CAAC,CAAC;QAEf,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC7C,SAAS,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;QAErB,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QAC1E,QAAQ,CAAC,MAAM,GAAG,uBAAuB,GAAG,UAAU,CAAC;QAEvD,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC;QAExC,QAAQ,CAAC,MAAM,GAAG,yCAAyC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAKH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACzD,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;QAEpD,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC7C,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC5C,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QAE5B,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAChE,SAAS,CAAC,EAAE,GAAG,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAEzC,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;QACnC,SAAS,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QAEvB,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACvE,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,iBAAiB,EAAE;YAChD,YAAY,EAAE,IAAI;YAClB,GAAG,EAAE,GAAG,EAAE;gBACT,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;YACzB,CAAC;SACD,CAAC,CAAC;QAEH,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC;IACzC,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QACnE,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QAExB,MAAM,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACrE,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QAExB,MAAM,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QAClD,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QAExB,MAAM,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IAC3D,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@prosopo/procaptcha-common",
-	"version": "2.14.1",
+	"version": "2.15.0",
 	"author": "PROSOPO LIMITED <info@prosopo.io>",
 	"license": "Apache-2.0",
 	"main": "dist/index.js",
@@ -34,9 +34,9 @@
 	"dependencies": {
 		"@emotion/react": "11.14.0",
 		"@emotion/styled": "11.14.1",
-		"@prosopo/account": "2.8.93",
-		"@prosopo/load-balancer": "2.10.45",
-		"@prosopo/types": "5.8.4",
+		"@prosopo/account": "2.8.95",
+		"@prosopo/load-balancer": "2.10.47",
+		"@prosopo/types": "5.9.0",
 		"@prosopo/widget-skeleton": "2.8.7",
 		"react": "19.3.0",
 		"react-dom": "19.3.0"