@prosopo/procaptcha-frictionless 2.12.24 → 2.13.1

package/dist/detectorLoader.js.map

@@ -1 +1 @@
-{"version":3,"file":"detectorLoader.js","sourceRoot":"","sources":["../src/detectorLoader.ts"],"names":[],"mappings":"AAgBA,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,IAA2B,EAAE,CAC/D,CAAC,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC"}
+{"version":3,"file":"detectorLoader.js","sourceRoot":"","sources":["../src/detectorLoader.ts"],"names":[],"mappings":"AAkEA,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,EAC5C,MAAc,EACU,EAAE;IAC1B,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAoB,GAAG,CAAC,CAEhD,CAAC;QACF,OAAO,GAAG,CAAC,OAAO,CAAC;IACpB,CAAC;YAAS,CAAC;QACV,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;AACF,CAAC,CAAC"}

package/dist/detectorPrefetch.d.ts

@@ -0,0 +1,12 @@
+import { getProcaptchaRandomActiveProvider } from "@prosopo/procaptcha-common";
+import type { AssignDetectorBundleResponse, EnvironmentTypes, RandomProvider } from "@prosopo/types";
+type IpModeParam = Parameters<typeof getProcaptchaRandomActiveProvider>[1];
+export interface PrefetchedDetector {
+    provider: RandomProvider;
+    assigned: AssignDetectorBundleResponse;
+}
+export declare const prefetchDetector: (environment: EnvironmentTypes, ipMode: IpModeParam, siteKey: string) => void;
+export declare const takePrefetchedDetector: (environment: EnvironmentTypes, ipMode: IpModeParam, siteKey: string) => Promise<PrefetchedDetector> | undefined;
+export declare const clearPrefetchedDetectors: () => void;
+export {};
+//# sourceMappingURL=detectorPrefetch.d.ts.map

package/dist/detectorPrefetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detectorPrefetch.d.ts","sourceRoot":"","sources":["../src/detectorPrefetch.ts"],"names":[],"mappings":"AAoCA,OAAO,EAAE,iCAAiC,EAAE,MAAM,4BAA4B,CAAC;AAC/E,OAAO,KAAK,EACX,4BAA4B,EAC5B,gBAAgB,EAChB,cAAc,EACd,MAAM,gBAAgB,CAAC;AAMxB,KAAK,WAAW,GAAG,UAAU,CAAC,OAAO,iCAAiC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE3E,MAAM,WAAW,kBAAkB;IAClC,QAAQ,EAAE,cAAc,CAAC;IACzB,QAAQ,EAAE,4BAA4B,CAAC;CACvC;AAmBD,eAAO,MAAM,gBAAgB,gBACf,gBAAgB,UACrB,WAAW,WACV,MAAM,KACb,IAmBF,CAAC;AAMF,eAAO,MAAM,sBAAsB,gBACrB,gBAAgB,UACrB,WAAW,WACV,MAAM,KACb,OAAO,CAAC,kBAAkB,CAAC,GAAG,SAKhC,CAAC;AAGF,eAAO,MAAM,wBAAwB,QAAO,IAE3C,CAAC"}

package/dist/detectorPrefetch.js

@@ -0,0 +1,63 @@
+import { getProcaptchaRandomActiveProvider } from "@prosopo/procaptcha-common";
+import { ProviderApi } from "@prosopo/api";
+//#region src/detectorPrefetch.ts
+/**
+* Detector bundle prefetch.
+*
+* Since the detector moved into the provider-served pool, the frictionless flow
+* cannot start until `/detector/assign` has returned. That request is issued by
+* `customDetectBot`, which only runs once React has mounted the widget — and
+* that mount sits behind the bundle's dynamic-import chain. Measured on a
+* staging demo page the assign request did not leave the browser until 1513 ms,
+* of which ~700 ms was purely waiting for chunks to arrive in sequence.
+*
+* Nothing in the request depends on React, i18n or the widget config: it needs
+* the site key (a DOM attribute, readable immediately), the environment (a
+* build-time constant) and the IP-mode flags (DOM attributes). So the entry
+* point kicks it off as soon as it has read those, and `customDetectBot` picks
+* up the in-flight promise instead of starting its own.
+*
+* The cache is deliberately single-use. A provider pin is only valid for the
+* attempt it was made for — on a retry the previous pronode is the one that
+* just failed — so a consumed entry is dropped and the retry re-resolves.
+*/
+var inFlight = /* @__PURE__ */ new Map();
+var keyOf = (environment, ipMode, siteKey) => `${environment}|${ipMode ?? "auto"}|${siteKey}`;
+/**
+* Start resolving a provider and assigning a detector bundle. Safe to call more
+* than once for the same key — subsequent calls join the in-flight request.
+*
+* Never rejects to the caller: a failed prefetch is indistinguishable from
+* never having prefetched, and `customDetectBot` already handles assign failure
+* by falling back to PoW. Returning a rejected promise here would surface as an
+* unhandled rejection in the host page.
+*/
+var prefetchDetector = (environment, ipMode, siteKey) => {
+	const key = keyOf(environment, ipMode, siteKey);
+	if (inFlight.has(key)) return;
+	const promise = (async () => {
+		const provider = await getProcaptchaRandomActiveProvider(environment, ipMode);
+		return {
+			provider,
+			assigned: await new ProviderApi(provider.provider.url, siteKey).assignDetectorBundle(siteKey)
+		};
+	})();
+	promise.catch(() => void 0);
+	inFlight.set(key, promise);
+};
+/**
+* Claim a prefetched assignment, if one was started for this exact key. The
+* entry is removed, so a retry does not reuse a pin that may have just failed.
+*/
+var takePrefetchedDetector = (environment, ipMode, siteKey) => {
+	const key = keyOf(environment, ipMode, siteKey);
+	const promise = inFlight.get(key);
+	if (promise) inFlight.delete(key);
+	return promise;
+};
+/** Test seam — drops any in-flight prefetches. */
+var clearPrefetchedDetectors = () => {
+	inFlight.clear();
+};
+//#endregion
+export { clearPrefetchedDetectors, prefetchDetector, takePrefetchedDetector };

package/dist/detectorPrefetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detectorPrefetch.js","sourceRoot":"","sources":["../src/detectorPrefetch.ts"],"names":[],"mappings":"AAmCA,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,iCAAiC,EAAE,MAAM,4BAA4B,CAAC;AAkB/E,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAuC,CAAC;AAEhE,MAAM,KAAK,GAAG,CACb,WAA6B,EAC7B,MAAmB,EACnB,OAAe,EACN,EAAE,CAAC,GAAG,WAAW,IAAI,MAAM,IAAI,MAAM,IAAI,OAAO,EAAE,CAAC;AAW7D,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC/B,WAA6B,EAC7B,MAAmB,EACnB,OAAe,EACR,EAAE;IACT,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAChD,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO;IAE9B,MAAM,OAAO,GAAG,CAAC,KAAK,IAAiC,EAAE;QACxD,MAAM,QAAQ,GAAG,MAAM,iCAAiC,CACvD,WAAW,EACX,MAAM,CACN,CAAC;QACF,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACpE,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACjE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAC/B,CAAC,CAAC,EAAE,CAAC;IAKL,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC/B,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC,CAAC;AAMF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACrC,WAA6B,EAC7B,MAAmB,EACnB,OAAe,EAC2B,EAAE;IAC5C,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,OAAO;QAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,OAAO,CAAC;AAChB,CAAC,CAAC;AAGF,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAS,EAAE;IAClD,QAAQ,CAAC,KAAK,EAAE,CAAC;AAClB,CAAC,CAAC"}

package/dist/index.d.ts

@@ -1,2 +1,3 @@
 export * from "./ProcaptchaFrictionless.js";
+export * from "./detectorPrefetch.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAaA,cAAc,6BAA6B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAaA,cAAc,6BAA6B,CAAC;AAC5C,cAAc,uBAAuB,CAAC"}

package/dist/index.js

@@ -1,3 +1,4 @@
 import "./_virtual/_rolldown/runtime.js";
+import { clearPrefetchedDetectors, prefetchDetector, takePrefetchedDetector } from "./detectorPrefetch.js";
 import { ProcaptchaFrictionless } from "./ProcaptchaFrictionless.js";
-export { ProcaptchaFrictionless };
+export { ProcaptchaFrictionless, clearPrefetchedDetectors, prefetchDetector, takePrefetchedDetector };

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAaA,cAAc,6BAA6B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAaA,cAAc,6BAA6B,CAAC;AAC5C,cAAc,uBAAuB,CAAC"}

package/dist/tests/customDetectBotSimd.test.js

@@ -2,12 +2,14 @@ import { beforeEach, describe, expect, it, vi } from "vitest";
 const mocks = vi.hoisted(() => ({
     getFrictionlessCaptcha: vi.fn(),
     getProcaptchaRandomActiveProvider: vi.fn(),
+    assignDetectorBundle: vi.fn(),
     detect: vi.fn(),
 }));
 vi.mock("@prosopo/api", () => ({
     ProviderApi: vi.fn(function () {
         return {
             getFrictionlessCaptcha: mocks.getFrictionlessCaptcha,
+            assignDetectorBundle: mocks.assignDetectorBundle,
         };
     }),
 }));
@@ -25,7 +27,7 @@ vi.mock("@prosopo/procaptcha-common", () => ({
     pickIpMode: vi.fn(() => undefined),
 }));
 vi.mock("../detectorLoader.js", () => ({
-    DetectorLoader: vi.fn(async () => mocks.detect),
+    DetectorLoaderFromScript: vi.fn(async () => mocks.detect),
 }));
 import customDetectBot from "../customDetectBot.js";
 const baseConfig = {
@@ -51,11 +53,18 @@ const captchaResponse = {
 beforeEach(() => {
     mocks.getFrictionlessCaptcha.mockReset();
     mocks.getProcaptchaRandomActiveProvider.mockReset();
+    mocks.assignDetectorBundle.mockReset();
     mocks.detect.mockReset();
     mocks.getProcaptchaRandomActiveProvider.mockResolvedValue({
         providerAccount: "dns-routed",
         provider: { url: "https://provider.test" },
     });
+    mocks.assignDetectorBundle.mockResolvedValue({
+        useProviderBundle: true,
+        detectorSessionId: "det-1",
+        detectorScript: "SELF_CONTAINED_ESM",
+        status: "ok",
+    });
     mocks.getFrictionlessCaptcha.mockResolvedValue(captchaResponse);
 });
 describe("customDetectBot SIMD deferral", () => {

package/dist/tests/customDetectBotSimd.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"customDetectBotSimd.test.js","sourceRoot":"","sources":["../../src/tests/customDetectBotSimd.test.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAI9D,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/B,sBAAsB,EAAE,EAAE,CAAC,EAAE,EAAE;IAC/B,iCAAiC,EAAE,EAAE,CAAC,EAAE,EAAE;IAC1C,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE;CACf,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAI9B,WAAW,EAAE,EAAE,CAAC,EAAE,CAAC;QAClB,OAAO;YACN,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;SACpD,CAAC;IACH,CAAC,CAAC;CACF,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,4BAA4B,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5C,eAAe,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE;QACjC,OAAO,MAAM,aAAa;YACzB,UAAU;gBACT,OAAO,OAAO,CAAC,OAAO,CAAC;oBACtB,OAAO,EAAE,EAAE,OAAO,EAAE,yBAAyB,EAAE;iBAC/C,CAAC,CAAC;YACJ,CAAC;SACD,CAAC;IACH,CAAC,CAAC;IACF,iCAAiC,EAAE,KAAK,CAAC,iCAAiC;IAC1E,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;CAClC,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC;IACtC,cAAc,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;CAC/C,CAAC,CAAC,CAAC;AAEJ,OAAO,eAAe,MAAM,uBAAuB,CAAC;AAEpD,MAAM,UAAU,GAAG;IAClB,OAAO,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;IACpC,kBAAkB,EAAE,YAAqB;IACzC,IAAI,EAAE,IAAI;IACV,IAAI,EAAE,cAAuB;CACuB,CAAC;AAEtD,MAAM,mBAAmB,GAAG,CAC3B,eAAoE,EACnE,EAAE,CAAC,CAAC;IACL,KAAK,EAAE,OAAO;IACd,eAAe,EAAE,MAAM;IACvB,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE;IAChE,eAAe;IACf,YAAY,EAAE,SAAS;IACvB,YAAY,EAAE,SAAS;IACvB,YAAY,EAAE,SAAS;CACvB,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG;IACvB,WAAW,EAAE,KAAK;IAClB,SAAS,EAAE,KAAK;IAChB,MAAM,EAAE,IAAI;CACZ,CAAC;AAEF,UAAU,CAAC,GAAG,EAAE;IACf,KAAK,CAAC,sBAAsB,CAAC,SAAS,EAAE,CAAC;IACzC,KAAK,CAAC,iCAAiC,CAAC,SAAS,EAAE,CAAC;IACpD,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;IACzB,KAAK,CAAC,iCAAiC,CAAC,iBAAiB,CAAC;QACzD,eAAe,EAAE,YAAY;QAC7B,QAAQ,EAAE,EAAE,GAAG,EAAE,uBAAuB,EAAE;KAC1C,CAAC,CAAC;IACH,KAAK,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,eAAe,CAAC,CAAC;AACjE,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC9C,EAAE,CAAC,0GAA0G,EAAE,KAAK,IAAI,EAAE;QACzH,MAAM,eAAe,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;QAClE,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC,CAAC;QAErE,MAAM,eAAe,CAAC,UAAU,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAE9D,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAExD,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;QACjG,MAAM,SAAS,GAAa,EAAE,CAAC;QAC/B,KAAK,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,GAAG,EAAE;YACpD,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAC/B,OAAO,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;QACH,MAAM,eAAe,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE;YACvD,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC5B,OAAO,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC,CAAC;QAErE,MAAM,eAAe,CAAC,UAAU,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAE9D,MAAM,CAAC,eAAe,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAEjD,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,YAAY,CACrD,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,CAC9B,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC/E,IAAI,WAAiC,CAAC;QACtC,MAAM,WAAW,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;YACnD,WAAW,GAAG,OAAO,CAAC;QACvB,CAAC,CAAC,CAAC;QACH,MAAM,eAAe,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;QAC7D,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC,CAAC;QAGrE,MAAM,MAAM,GAAG,MAAM,eAAe,CACnC,UAAU,EACV,SAAS,EACT,GAAG,EAAE,CAAC,SAAS,CACf,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAErC,WAAW,CAAC,cAAc,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACxF,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC;QAE/D,MAAM,MAAM,GAAG,MAAM,eAAe,CACnC,UAAU,EACV,SAAS,EACT,GAAG,EAAE,CAAC,SAAS,CACf,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}
+{"version":3,"file":"customDetectBotSimd.test.js","sourceRoot":"","sources":["../../src/tests/customDetectBotSimd.test.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAI9D,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/B,sBAAsB,EAAE,EAAE,CAAC,EAAE,EAAE;IAC/B,iCAAiC,EAAE,EAAE,CAAC,EAAE,EAAE;IAC1C,oBAAoB,EAAE,EAAE,CAAC,EAAE,EAAE;IAC7B,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE;CACf,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAI9B,WAAW,EAAE,EAAE,CAAC,EAAE,CAAC;QAClB,OAAO;YACN,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;YACpD,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;SAChD,CAAC;IACH,CAAC,CAAC;CACF,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,4BAA4B,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5C,eAAe,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE;QACjC,OAAO,MAAM,aAAa;YACzB,UAAU;gBACT,OAAO,OAAO,CAAC,OAAO,CAAC;oBACtB,OAAO,EAAE,EAAE,OAAO,EAAE,yBAAyB,EAAE;iBAC/C,CAAC,CAAC;YACJ,CAAC;SACD,CAAC;IACH,CAAC,CAAC;IACF,iCAAiC,EAAE,KAAK,CAAC,iCAAiC;IAC1E,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;CAClC,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC;IACtC,wBAAwB,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;CACzD,CAAC,CAAC,CAAC;AAEJ,OAAO,eAAe,MAAM,uBAAuB,CAAC;AAEpD,MAAM,UAAU,GAAG;IAClB,OAAO,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;IACpC,kBAAkB,EAAE,YAAqB;IACzC,IAAI,EAAE,IAAI;IACV,IAAI,EAAE,cAAuB;CACuB,CAAC;AAEtD,MAAM,mBAAmB,GAAG,CAC3B,eAAoE,EACnE,EAAE,CAAC,CAAC;IACL,KAAK,EAAE,OAAO;IACd,eAAe,EAAE,MAAM;IACvB,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE;IAChE,eAAe;IACf,YAAY,EAAE,SAAS;IACvB,YAAY,EAAE,SAAS;IACvB,YAAY,EAAE,SAAS;CACvB,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG;IACvB,WAAW,EAAE,KAAK;IAClB,SAAS,EAAE,KAAK;IAChB,MAAM,EAAE,IAAI;CACZ,CAAC;AAEF,UAAU,CAAC,GAAG,EAAE;IACf,KAAK,CAAC,sBAAsB,CAAC,SAAS,EAAE,CAAC;IACzC,KAAK,CAAC,iCAAiC,CAAC,SAAS,EAAE,CAAC;IACpD,KAAK,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAAC;IACvC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;IACzB,KAAK,CAAC,iCAAiC,CAAC,iBAAiB,CAAC;QACzD,eAAe,EAAE,YAAY;QAC7B,QAAQ,EAAE,EAAE,GAAG,EAAE,uBAAuB,EAAE;KAC1C,CAAC,CAAC;IAEH,KAAK,CAAC,oBAAoB,CAAC,iBAAiB,CAAC;QAC5C,iBAAiB,EAAE,IAAI;QACvB,iBAAiB,EAAE,OAAO;QAC1B,cAAc,EAAE,oBAAoB;QACpC,MAAM,EAAE,IAAI;KACZ,CAAC,CAAC;IACH,KAAK,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,eAAe,CAAC,CAAC;AACjE,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC9C,EAAE,CAAC,0GAA0G,EAAE,KAAK,IAAI,EAAE;QACzH,MAAM,eAAe,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;QAClE,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC,CAAC;QAErE,MAAM,eAAe,CAAC,UAAU,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAE9D,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAExD,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;QACjG,MAAM,SAAS,GAAa,EAAE,CAAC;QAC/B,KAAK,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,GAAG,EAAE;YACpD,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAC/B,OAAO,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;QACH,MAAM,eAAe,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE;YACvD,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC5B,OAAO,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC,CAAC;QAErE,MAAM,eAAe,CAAC,UAAU,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAE9D,MAAM,CAAC,eAAe,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAEjD,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,YAAY,CACrD,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,CAC9B,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC/E,IAAI,WAAiC,CAAC;QACtC,MAAM,WAAW,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;YACnD,WAAW,GAAG,OAAO,CAAC;QACvB,CAAC,CAAC,CAAC;QACH,MAAM,eAAe,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;QAC7D,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC,CAAC;QAGrE,MAAM,MAAM,GAAG,MAAM,eAAe,CACnC,UAAU,EACV,SAAS,EACT,GAAG,EAAE,CAAC,SAAS,CACf,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAErC,WAAW,CAAC,cAAc,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACxF,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC;QAE/D,MAAM,MAAM,GAAG,MAAM,eAAe,CACnC,UAAU,EACV,SAAS,EACT,GAAG,EAAE,CAAC,SAAS,CACf,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/tests/detectorPrefetch.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=detectorPrefetch.test.d.ts.map

package/dist/tests/detectorPrefetch.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detectorPrefetch.test.d.ts","sourceRoot":"","sources":["../../src/tests/detectorPrefetch.test.ts"],"names":[],"mappings":""}

package/dist/tests/detectorPrefetch.test.js

@@ -0,0 +1,71 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+const assignDetectorBundle = vi.fn();
+const getProcaptchaRandomActiveProvider = vi.fn();
+vi.mock("@prosopo/api", () => ({
+    ProviderApi: class {
+        constructor() {
+            this.assignDetectorBundle = assignDetectorBundle;
+        }
+    },
+}));
+vi.mock("@prosopo/procaptcha-common", () => ({
+    getProcaptchaRandomActiveProvider: (...args) => getProcaptchaRandomActiveProvider(...args),
+}));
+const { prefetchDetector, takePrefetchedDetector, clearPrefetchedDetectors } = await import("../detectorPrefetch.js");
+const ENV = "staging";
+const SITE_KEY = "5CcNvLUdiXFpzKDMjThGLSK9rhWHA1H4EF3zrgkpkjAdqmuP";
+const provider = { provider: { url: "https://pronode.example" } };
+afterEach(() => {
+    clearPrefetchedDetectors();
+    vi.clearAllMocks();
+});
+describe("detectorPrefetch", () => {
+    it("returns undefined when nothing was prefetched", () => {
+        expect(takePrefetchedDetector(ENV, undefined, SITE_KEY)).toBeUndefined();
+    });
+    it("resolves the provider and assigns a bundle", async () => {
+        getProcaptchaRandomActiveProvider.mockResolvedValue(provider);
+        assignDetectorBundle.mockResolvedValue({ useProviderBundle: true });
+        prefetchDetector(ENV, undefined, SITE_KEY);
+        const claimed = takePrefetchedDetector(ENV, undefined, SITE_KEY);
+        expect(claimed).toBeDefined();
+        const result = await claimed;
+        expect(result).toStrictEqual({
+            provider,
+            assigned: { useProviderBundle: true },
+        });
+        expect(assignDetectorBundle).toHaveBeenCalledWith(SITE_KEY);
+    });
+    it("is single-use, so a retry does not reuse a stale provider pin", async () => {
+        getProcaptchaRandomActiveProvider.mockResolvedValue(provider);
+        assignDetectorBundle.mockResolvedValue({ useProviderBundle: true });
+        prefetchDetector(ENV, undefined, SITE_KEY);
+        const first = takePrefetchedDetector(ENV, undefined, SITE_KEY);
+        await first;
+        expect(takePrefetchedDetector(ENV, undefined, SITE_KEY)).toBeUndefined();
+    });
+    it("does not start a second request for the same key", () => {
+        getProcaptchaRandomActiveProvider.mockResolvedValue(provider);
+        assignDetectorBundle.mockResolvedValue({ useProviderBundle: true });
+        prefetchDetector(ENV, undefined, SITE_KEY);
+        prefetchDetector(ENV, undefined, SITE_KEY);
+        expect(getProcaptchaRandomActiveProvider).toHaveBeenCalledTimes(1);
+    });
+    it("keys on site key and ip mode, so a different widget does not claim it", () => {
+        getProcaptchaRandomActiveProvider.mockResolvedValue(provider);
+        assignDetectorBundle.mockResolvedValue({ useProviderBundle: true });
+        prefetchDetector(ENV, "ipv4", SITE_KEY);
+        expect(takePrefetchedDetector(ENV, "ipv6", SITE_KEY)).toBeUndefined();
+        expect(takePrefetchedDetector(ENV, undefined, SITE_KEY)).toBeUndefined();
+        expect(takePrefetchedDetector(ENV, "ipv4", "other-key")).toBeUndefined();
+        expect(takePrefetchedDetector(ENV, "ipv4", SITE_KEY)).toBeDefined();
+    });
+    it("surfaces failure to the claimant without an unhandled rejection", async () => {
+        getProcaptchaRandomActiveProvider.mockRejectedValue(new Error("no providers"));
+        prefetchDetector(ENV, undefined, SITE_KEY);
+        const claimed = takePrefetchedDetector(ENV, undefined, SITE_KEY);
+        expect(claimed).toBeDefined();
+        await expect(claimed).rejects.toThrow("no providers");
+    });
+});
+//# sourceMappingURL=detectorPrefetch.test.js.map

package/dist/tests/detectorPrefetch.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detectorPrefetch.test.js","sourceRoot":"","sources":["../../src/tests/detectorPrefetch.test.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE7D,MAAM,oBAAoB,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AACrC,MAAM,iCAAiC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AAElD,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9B,WAAW,EAAE;QAAA;YACZ,yBAAoB,GAAG,oBAAoB,CAAC;QAC7C,CAAC;KAAA;CACD,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,4BAA4B,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5C,iCAAiC,EAAE,CAClC,GAAG,IAA4C,EAC9C,EAAE,CAAC,iCAAiC,CAAC,GAAG,IAAI,CAAC;CAC/C,CAAC,CAAC,CAAC;AAEJ,MAAM,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,GAC3E,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;AAExC,MAAM,GAAG,GAAG,SAA6B,CAAC;AAC1C,MAAM,QAAQ,GAAG,kDAAkD,CAAC;AAEpE,MAAM,QAAQ,GAAG,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,yBAAyB,EAAE,EAAE,CAAC;AAElE,SAAS,CAAC,GAAG,EAAE;IACd,wBAAwB,EAAE,CAAC;IAC3B,EAAE,CAAC,aAAa,EAAE,CAAC;AACpB,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACxD,MAAM,CAAC,sBAAsB,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC3D,iCAAiC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC9D,oBAAoB,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;QAEpE,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QACjE,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;QAE9B,MAAM,MAAM,GAAG,MAAO,OAA4B,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC;YAC5B,QAAQ;YACR,QAAQ,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE;SACrC,CAAC,CAAC;QACH,MAAM,CAAC,oBAAoB,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC9E,iCAAiC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC9D,oBAAoB,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;QAEpE,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,sBAAsB,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC/D,MAAO,KAA0B,CAAC;QAElC,MAAM,CAAC,sBAAsB,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC3D,iCAAiC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC9D,oBAAoB,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;QAEpE,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC3C,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QAE3C,MAAM,CAAC,iCAAiC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;QAChF,iCAAiC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC9D,oBAAoB,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;QAEpE,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAExC,MAAM,CAAC,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACtE,MAAM,CAAC,sBAAsB,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACzE,MAAM,CAAC,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACzE,MAAM,CAAC,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAChF,iCAAiC,CAAC,iBAAiB,CAClD,IAAI,KAAK,CAAC,cAAc,CAAC,CACzB,CAAC;QAEF,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QACjE,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;QAK9B,MAAM,MAAM,CAAC,OAA2B,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@prosopo/procaptcha-frictionless",
-	"version": "2.12.24",
+	"version": "2.13.1",
 	"author": "PROSOPO LIMITED <info@prosopo.io>",
 	"license": "Apache-2.0",
 	"main": "dist/index.js",
@@ -30,21 +30,20 @@
 	},
 	"browserslist": ["> 0.5%, last 2 versions, not dead"],
 	"dependencies": {
-		"@prosopo/api": "3.5.21",
+		"@prosopo/api": "4.0.0",
 		"@prosopo/common": "3.1.48",
-		"@prosopo/detector": "3.5.14",
 		"@prosopo/locale": "3.2.8",
-		"@prosopo/procaptcha-common": "2.11.19",
-		"@prosopo/procaptcha-pow": "2.10.26",
-		"@prosopo/procaptcha-puzzle": "2.10.42",
-		"@prosopo/procaptcha-react": "2.9.99",
-		"@prosopo/types": "4.10.0",
-		"@prosopo/widget-skeleton": "2.8.4",
+		"@prosopo/procaptcha-common": "2.11.20",
+		"@prosopo/procaptcha-pow": "2.10.27",
+		"@prosopo/procaptcha-puzzle": "2.10.43",
+		"@prosopo/procaptcha-react": "2.9.100",
+		"@prosopo/types": "5.0.0",
+		"@prosopo/widget-skeleton": "2.8.5",
 		"dotenv": "16.4.5",
 		"react": "18.3.1"
 	},
 	"devDependencies": {
-		"@prosopo/config": "3.3.5",
+		"@prosopo/config": "3.3.6",
 		"@types/node": "22.10.2",
 		"@vitest/coverage-v8": "4.1.10",
 		"concurrently": "9.0.1",

package/src/customDetectBot.ts

@@ -25,7 +25,20 @@ import type {
 	ProviderSelectRetryContext,
 } from "@prosopo/types";
 import type { BotDetectionFunctionResult } from "@prosopo/types";
-import { DetectorLoader } from "./detectorLoader.js";
+import {
+	DetectorLoaderFromScript,
+	type DetectorType,
+} from "./detectorLoader.js";
+import {
+	type PrefetchedDetector,
+	takePrefetchedDetector,
+} from "./detectorPrefetch.js";
+
+// Upper bound on the detector-bundle assignment + load probe. The detector
+// lives ONLY in the provider-served pool bundles, so if the provider is
+// slow/unreachable we abandon the probe and signal `detectorUnavailable`, and
+// the provider serves a PoW challenge instead of running detection.
+const ASSIGN_TIMEOUT_MS = 2000;
 
 // The page(s) the widget is rendered on, reduced to origin + path.
 // Deliberately built from `origin` + `pathname` (never `href`) so the query
@@ -129,80 +142,160 @@ const customDetectBot: BotDetectionFunction = async (
 	restartFn: () => void,
 	retryContext?: ProviderSelectRetryContext,
 ): Promise<BotDetectionFunctionResult> => {
-	// Kick off the provider-pin resolution (which hits `/healthz` on the
-	// load-balancer DNS endpoint) in parallel with the module loaders and
-	// the whole `detect()` flow. `getProcaptchaRandomActiveProvider` is
-	// memoised via `pinPromiseCache` keyed on `(env, ipMode)`, so the
-	// in-flight promise is reused when catcher's internal provider selector
-	// and the awaited `getProcaptchaRandomActiveProvider(...)` below reach
-	// for it — no duplicate healthz request. Before this ordering change
-	// the healthz round-trip was fully serial with `detect()`, adding
-	// ~100–200ms to the frictionless critical path on cold DNS/TLS.
-	//
-	// We warm both cache keys because the catcher-internal selector call
-	// (line ~145 below) passes no ipMode, while the awaited call further
-	// down passes `pickIpMode(config)`. Same key when the dapp opts into
-	// neither ipv4 nor ipv6 (dual stack — the common case); different
-	// keys when the dapp is pinned to a single stack. Fire-and-forget on
-	// both — the real synchronisation happens at the awaits below.
-	const ipMode = pickIpMode(config);
-	void getProcaptchaRandomActiveProvider(config.defaultEnvironment).catch(
-		() => undefined,
-	);
-	if (ipMode !== undefined) {
-		void getProcaptchaRandomActiveProvider(
-			config.defaultEnvironment,
-			ipMode,
-			retryContext,
-		).catch(() => undefined);
-	}
-
-	const [ExtClass, detect] = await Promise.all([
-		ExtensionLoader(config.web2),
-		DetectorLoader(),
-	]);
-	const ext = new ExtClass();
-
-	// The detector bundle still expects the legacy 5-arg signature
-	// `(env, randomProviderSelectorFn, container, restart, accountGenerator)`.
-	// Until the bundle is rebuilt without the provider selector, hand it a
-	// noop selector that resolves to the static DNS endpoint — the detector
-	// no longer uses the returned RandomProvider for routing.
-	const detectionResult = await detect(
-		config.defaultEnvironment,
-		async () => getProcaptchaRandomActiveProvider(config.defaultEnvironment),
-		container,
-		restartFn,
-		() => ext.getAccount(config),
-	);
-
-	const userAccount = detectionResult.userAccount;
-
 	if (!config.account.address) {
 		throw new ProsopoEnvError("GENERAL.SITE_KEY_MISSING");
 	}
 
+	const ipMode = pickIpMode(config);
+
+	// Start the extension/account module load now rather than after the bundle
+	// assignment. It depends on nothing above, so it overlaps the provider-pin
+	// `/healthz` round-trip and the assign request for free; it is awaited below
+	// at the point `ExtClass` is first needed.
+	//
+	// This is what survives of main's parallel-pin optimisation. That change
+	// warmed BOTH `pinPromiseCache` keys — with and without ipMode — because the
+	// catcher-internal provider selector called with no ipMode while the awaited
+	// call passed one. The 3-arg detector has no provider selector at all, so
+	// only the `(env, ipMode)` key is ever used now and warming the bare-env key
+	// would just issue a healthz request nothing consumes. Nor can the pin be
+	// moved off the critical path the way it was before: the detector now comes
+	// FROM the provider, so resolving the provider is a hard prerequisite of
+	// having anything to run, not something that can proceed alongside it.
+	const extClassPromise = ExtensionLoader(config.web2);
+
 	// On the first attempt this resolves the static DNS endpoint for this env —
 	// the DNS layer load-balances across the pronode fleet. On a retry
 	// (`retryContext.attempt > 1`) the previously used pronode errored, so we
 	// pick a random provider straight from the list instead of re-pinning the
 	// same one. `pickIpMode(config)` honours the dapp's data-ipv4 / data-ipv6
 	// preference so frictionless and the subsequent captcha hops stay on the
-	// same stack.
-	//
-	// This await usually hits the in-flight/resolved promise warmed at the
-	// top of this function — see the prefetch call there.
-	const provider = await getProcaptchaRandomActiveProvider(
-		config.defaultEnvironment,
-		ipMode,
-		retryContext,
-	);
+	// same stack. Resolved up front — before detection rather than alongside it —
+	// because the detector bundle is served BY this provider.
+	// The bundle entry starts provider resolution + assign as soon as it has read
+	// the site key off the DOM, which is well before React has mounted this
+	// widget. Claim that in-flight work if it exists rather than repeating it.
+	// Only valid on a first attempt: a retry is retrying *because* the pinned
+	// pronode failed, so it must re-resolve.
+	const isFirstAttempt = !retryContext || retryContext.attempt <= 1;
+	const prefetched = isFirstAttempt
+		? takePrefetchedDetector(
+				config.defaultEnvironment,
+				ipMode,
+				config.account.address,
+			)
+		: undefined;
+
+	// A prefetch that failed must not fail the flow — it is an optimisation, and
+	// the normal path below handles provider selection and assign failure
+	// already. So swallow it and re-resolve.
+	let prefetchedResult: PrefetchedDetector | undefined;
+	if (prefetched) {
+		try {
+			prefetchedResult = await prefetched;
+		} catch {
+			prefetchedResult = undefined;
+		}
+	}
+
+	const provider =
+		prefetchedResult?.provider ??
+		(await getProcaptchaRandomActiveProvider(
+			config.defaultEnvironment,
+			ipMode,
+			retryContext,
+		));
 
 	const providerApi = new ProviderApi(
 		provider.provider.url,
 		config.account.address,
 	);
 
+	// Ask the provider for a per-session detector bundle. The detector lives ONLY
+	// in the provider-served pool: when the provider has a populated pool it
+	// returns the obfuscated detector (each with its own keys + inner cipher)
+	// plus a detectorSessionId. When it cannot (no pool, network, decode, or
+	// timeout) we have NO detector to run — there is no bundled fallback — so we
+	// signal `detectorUnavailable` and the provider serves a PoW challenge.
+	let detectorSessionId: string | undefined;
+	let providerDetect: DetectorType | undefined;
+	try {
+		// Reuse the prefetched assignment when the entry already fetched one for
+		// this provider; otherwise issue it now.
+		const assigned =
+			prefetchedResult?.assigned ??
+			(await withTimeout(
+				providerApi.assignDetectorBundle(config.account.address),
+				ASSIGN_TIMEOUT_MS,
+			));
+		if (assigned.useProviderBundle && assigned.detectorScript) {
+			detectorSessionId = assigned.detectorSessionId;
+			providerDetect = await withTimeout(
+				DetectorLoaderFromScript(assigned.detectorScript),
+				ASSIGN_TIMEOUT_MS,
+			);
+		}
+	} catch {
+		// No detector available — fall through to the PoW request below.
+	}
+
+	const ExtClass = await extClassPromise;
+	const ext = new ExtClass();
+
+	// No provider detector ⇒ no detection is possible. Request a PoW challenge
+	// directly: send no token and the detectorUnavailable flag so the provider
+	// serves PoW rather than attempting to score an absent payload.
+	if (providerDetect === undefined) {
+		const userAccount = await ext.getAccount(config);
+		const { currentUrl: fallbackUrl, iframeUrl: fallbackIframeUrl } =
+			getCurrentPageUrls();
+		const powCaptcha = await withTimeout(
+			providerApi.getFrictionlessCaptcha(
+				undefined,
+				undefined,
+				config.account.address,
+				userAccount.account.address,
+				config.mode,
+				undefined,
+				undefined,
+				true,
+				fallbackUrl,
+				fallbackIframeUrl,
+			),
+			10000,
+		);
+		if (powCaptcha.dns_url) {
+			try {
+				void fetch(powCaptcha.dns_url, {
+					method: "GET",
+					mode: "no-cors",
+					credentials: "omit",
+					keepalive: true,
+					cache: "no-store",
+				}).catch(() => undefined);
+			} catch {
+				/* swallow */
+			}
+		}
+		return {
+			captchaType: powCaptcha.captchaType,
+			sessionId: powCaptcha.sessionId,
+			provider: provider,
+			status: powCaptcha.status,
+			userAccount: userAccount,
+			error: powCaptcha.error,
+			hp: powCaptcha.hp,
+		};
+	}
+
+	const detect: DetectorType = providerDetect;
+
+	const detectionResult = await detect(container, restartFn, () =>
+		ext.getAccount(config),
+	);
+
+	const userAccount = detectionResult.userAccount;
+
 	// SIMD readings deliberately omitted from the frictionless hop. The WASM
 	// benchmark is a CPU-bound loop that contends with BotScoreWorker if it
 	// runs during detection; deferring it until after the POST is in flight
@@ -217,6 +310,8 @@ const customDetectBot: BotDetectionFunction = async (
 		userAccount.account.address,
 		config.mode,
 		undefined,
+		detectorSessionId,
+		undefined,
 		currentUrl,
 		iframeUrl,
 	);

package/src/detectorLoader.ts

@@ -12,7 +12,69 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-type DetectorType = typeof import("@prosopo/detector").default;
+import type {
+	Account,
+	BehavioralData,
+	ClickEventPoint,
+	MouseMovementPoint,
+	PackedBehavioralData,
+	TouchEventPoint,
+} from "@prosopo/types";
 
-export const DetectorLoader = async (): Promise<DetectorType> =>
-	(await import("@prosopo/detector")).default;
+// The detector is NOT bundled into the widget — it lives only in the
+// provider-served pool bundles, loaded at runtime via a blob URL below. So the
+// signature is declared locally here (mirroring `@prosopo/detector`'s default
+// export) from shared @prosopo/types primitives, rather than importing the
+// detector package as a build-time type dependency.
+export type DetectorType = (
+	container: HTMLElement | undefined,
+	restart: () => void,
+	accountGenerator: () => Promise<Account>,
+) => Promise<{
+	token: string;
+	shadowDomCleanup: () => void;
+	encryptHeadHash: string;
+	mouseTracker?: {
+		start: () => void;
+		stop: () => void;
+		getData: () => MouseMovementPoint[];
+		clear: () => void;
+	};
+	touchTracker?: {
+		start: () => void;
+		stop: () => void;
+		getData: () => TouchEventPoint[];
+		clear: () => void;
+	};
+	clickTracker?: {
+		start: () => void;
+		stop: () => void;
+		getData: () => ClickEventPoint[];
+		clear: () => void;
+	};
+	hasTouchSupport?: string;
+	encryptBehavioralData?: (data: string) => Promise<string>;
+	packBehavioralData?: (behavioralData: BehavioralData) => PackedBehavioralData;
+	getSimdReadings?: (timeoutMs?: number) => Promise<string | undefined>;
+	userAccount: Account;
+}>;
+
+/**
+ * Loads a detector from a provider-served obfuscated ESM string (the per-session
+ * pool bundle). Evaluated via a blob URL — the served module is self-contained
+ * (no imports), so dynamic `import()` of the blob yields its default export.
+ */
+export const DetectorLoaderFromScript = async (
+	script: string,
+): Promise<DetectorType> => {
+	const blob = new Blob([script], { type: "text/javascript" });
+	const url = URL.createObjectURL(blob);
+	try {
+		const mod = (await import(/* @vite-ignore */ url)) as {
+			default: DetectorType;
+		};
+		return mod.default;
+	} finally {
+		URL.revokeObjectURL(url);
+	}
+};