@prosopo/procaptcha-frictionless 2.13.0 → 2.13.2

package/dist/tests/customDetectBotAssignTimeout.test.js

@@ -0,0 +1,118 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+const mocks = vi.hoisted(() => ({
+    getFrictionlessCaptcha: vi.fn(),
+    getProcaptchaRandomActiveProvider: vi.fn(),
+    assignDetectorBundle: vi.fn(),
+    detectorLoaderFromScript: vi.fn(),
+    detect: vi.fn(),
+}));
+vi.mock("@prosopo/api", () => ({
+    ProviderApi: vi.fn(function () {
+        return {
+            getFrictionlessCaptcha: mocks.getFrictionlessCaptcha,
+            assignDetectorBundle: mocks.assignDetectorBundle,
+        };
+    }),
+}));
+vi.mock("@prosopo/procaptcha-common", () => ({
+    ExtensionLoader: vi.fn(async () => {
+        return class FakeExtension {
+            getAccount() {
+                return Promise.resolve({
+                    account: { address: "5FakeUserAccountAddress" },
+                });
+            }
+        };
+    }),
+    getProcaptchaRandomActiveProvider: mocks.getProcaptchaRandomActiveProvider,
+    pickIpMode: vi.fn(() => undefined),
+}));
+vi.mock("../detectorLoader.js", () => ({
+    DetectorLoaderFromScript: mocks.detectorLoaderFromScript,
+}));
+import customDetectBot from "../customDetectBot.js";
+const baseConfig = {
+    account: { address: "5CcNvLUdiXFpzKDMjThGLSK9rhWHA1H4EF3zrgkpkjAdqmuP" },
+    defaultEnvironment: "staging",
+    web2: true,
+    mode: "visible",
+};
+const assignResponse = {
+    useProviderBundle: true,
+    detectorSessionId: "det-5cad2419-43c0-41b7-a9b8-0117767624bc",
+    detectorScript: "SELF_CONTAINED_ESM",
+    status: "ok",
+};
+const detectionResult = {
+    token: "ENCRYPTED_TOKEN",
+    encryptHeadHash: "ENCRYPTED_HEAD_HASH",
+    userAccount: { account: { address: "5FakeUserAccountAddress" } },
+    shadowDomCleanup: () => undefined,
+};
+const captchaResponse = {
+    captchaType: "pow",
+    sessionId: "SID",
+    status: "ok",
+};
+const SLOW_MS = 6700;
+const resolveAfter = (ms, value) => new Promise((resolve) => {
+    setTimeout(() => resolve(value), ms);
+});
+const postedToken = () => {
+    const call = mocks.getFrictionlessCaptcha.mock.calls[0];
+    return call?.[0];
+};
+const postedDetectorSessionId = () => {
+    const call = mocks.getFrictionlessCaptcha.mock.calls[0];
+    return call?.[6];
+};
+beforeEach(() => {
+    vi.useFakeTimers();
+    mocks.getFrictionlessCaptcha.mockReset();
+    mocks.getProcaptchaRandomActiveProvider.mockReset();
+    mocks.assignDetectorBundle.mockReset();
+    mocks.detectorLoaderFromScript.mockReset();
+    mocks.detect.mockReset();
+    mocks.getProcaptchaRandomActiveProvider.mockResolvedValue({
+        providerAccount: "dns-routed",
+        provider: { url: "https://staging-pronode3.prosopo.io" },
+    });
+    mocks.detect.mockResolvedValue(detectionResult);
+    mocks.detectorLoaderFromScript.mockResolvedValue(mocks.detect);
+    mocks.assignDetectorBundle.mockResolvedValue(assignResponse);
+    mocks.getFrictionlessCaptcha.mockResolvedValue(captchaResponse);
+});
+afterEach(() => {
+    vi.useRealTimers();
+});
+const runDetection = async () => {
+    const pending = customDetectBot(baseConfig, undefined, () => undefined);
+    await vi.advanceTimersByTimeAsync(SLOW_MS + 1000);
+    await pending;
+};
+describe("customDetectBot detector-assignment deadline", () => {
+    it("uses a bundle whose assign POST is slow", async () => {
+        mocks.assignDetectorBundle.mockImplementation(() => resolveAfter(SLOW_MS, assignResponse));
+        await runDetection();
+        expect(mocks.detectorLoaderFromScript).toHaveBeenCalledWith(assignResponse.detectorScript);
+        expect(postedToken()).toBe("ENCRYPTED_TOKEN");
+        expect(postedDetectorSessionId()).toBe(assignResponse.detectorSessionId);
+    });
+    it("uses a bundle whose blob import is slow", async () => {
+        mocks.detectorLoaderFromScript.mockImplementation(() => resolveAfter(SLOW_MS, mocks.detect));
+        await runDetection();
+        expect(postedToken()).toBe("ENCRYPTED_TOKEN");
+        expect(postedDetectorSessionId()).toBe(assignResponse.detectorSessionId);
+    });
+    it("still sends an empty token when the provider has no bundle to assign", async () => {
+        mocks.assignDetectorBundle.mockResolvedValue({
+            useProviderBundle: false,
+            status: "ok",
+        });
+        await runDetection();
+        expect(mocks.detectorLoaderFromScript).not.toHaveBeenCalled();
+        expect(postedToken()).toBeUndefined();
+        expect(postedDetectorSessionId()).toBeUndefined();
+    });
+});
+//# sourceMappingURL=customDetectBotAssignTimeout.test.js.map

package/dist/tests/customDetectBotAssignTimeout.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"customDetectBotAssignTimeout.test.js","sourceRoot":"","sources":["../../src/tests/customDetectBotAssignTimeout.test.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAIzE,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/B,sBAAsB,EAAE,EAAE,CAAC,EAAE,EAAE;IAC/B,iCAAiC,EAAE,EAAE,CAAC,EAAE,EAAE;IAC1C,oBAAoB,EAAE,EAAE,CAAC,EAAE,EAAE;IAC7B,wBAAwB,EAAE,EAAE,CAAC,EAAE,EAAE;IACjC,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE;CACf,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAG9B,WAAW,EAAE,EAAE,CAAC,EAAE,CAAC;QAClB,OAAO;YACN,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;YACpD,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;SAChD,CAAC;IACH,CAAC,CAAC;CACF,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,4BAA4B,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5C,eAAe,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE;QACjC,OAAO,MAAM,aAAa;YACzB,UAAU;gBACT,OAAO,OAAO,CAAC,OAAO,CAAC;oBACtB,OAAO,EAAE,EAAE,OAAO,EAAE,yBAAyB,EAAE;iBAC/C,CAAC,CAAC;YACJ,CAAC;SACD,CAAC;IACH,CAAC,CAAC;IACF,iCAAiC,EAAE,KAAK,CAAC,iCAAiC;IAC1E,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;CAClC,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC;IACtC,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;CACxD,CAAC,CAAC,CAAC;AAEJ,OAAO,eAAe,MAAM,uBAAuB,CAAC;AAEpD,MAAM,UAAU,GAAG;IAClB,OAAO,EAAE,EAAE,OAAO,EAAE,kDAAkD,EAAE;IACxE,kBAAkB,EAAE,SAAkB;IACtC,IAAI,EAAE,IAAI;IACV,IAAI,EAAE,SAAkB;CAC4B,CAAC;AAEtD,MAAM,cAAc,GAAiC;IACpD,iBAAiB,EAAE,IAAI;IACvB,iBAAiB,EAAE,0CAA0C;IAC7D,cAAc,EAAE,oBAAoB;IACpC,MAAM,EAAE,IAAI;CACZ,CAAC;AAEF,MAAM,eAAe,GAAG;IACvB,KAAK,EAAE,iBAAiB;IACxB,eAAe,EAAE,qBAAqB;IACtC,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE;IAChE,gBAAgB,EAAE,GAAG,EAAE,CAAC,SAAS;CACjC,CAAC;AAEF,MAAM,eAAe,GAAG;IACvB,WAAW,EAAE,KAAK;IAClB,SAAS,EAAE,KAAK;IAChB,MAAM,EAAE,IAAI;CACZ,CAAC;AAGF,MAAM,OAAO,GAAG,IAAI,CAAC;AAErB,MAAM,YAAY,GAAG,CAAI,EAAU,EAAE,KAAQ,EAAc,EAAE,CAC5D,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,EAAE;IAC1B,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;AACtC,CAAC,CAAC,CAAC;AAIJ,MAAM,WAAW,GAAG,GAAuB,EAAE;IAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACxD,OAAO,IAAI,EAAE,CAAC,CAAC,CAAuB,CAAC;AACxC,CAAC,CAAC;AAEF,MAAM,uBAAuB,GAAG,GAAuB,EAAE;IACxD,MAAM,IAAI,GAAG,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACxD,OAAO,IAAI,EAAE,CAAC,CAAC,CAAuB,CAAC;AACxC,CAAC,CAAC;AAEF,UAAU,CAAC,GAAG,EAAE;IACf,EAAE,CAAC,aAAa,EAAE,CAAC;IACnB,KAAK,CAAC,sBAAsB,CAAC,SAAS,EAAE,CAAC;IACzC,KAAK,CAAC,iCAAiC,CAAC,SAAS,EAAE,CAAC;IACpD,KAAK,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAAC;IACvC,KAAK,CAAC,wBAAwB,CAAC,SAAS,EAAE,CAAC;IAC3C,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;IAEzB,KAAK,CAAC,iCAAiC,CAAC,iBAAiB,CAAC;QACzD,eAAe,EAAE,YAAY;QAC7B,QAAQ,EAAE,EAAE,GAAG,EAAE,qCAAqC,EAAE;KACxD,CAAC,CAAC;IACH,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,eAAe,CAAC,CAAC;IAChD,KAAK,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/D,KAAK,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;IAC7D,KAAK,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,eAAe,CAAC,CAAC;AACjE,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,GAAG,EAAE;IACd,EAAE,CAAC,aAAa,EAAE,CAAC;AACpB,CAAC,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,KAAK,IAAmB,EAAE;IAC9C,MAAM,OAAO,GAAG,eAAe,CAAC,UAAU,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACxE,MAAM,EAAE,CAAC,wBAAwB,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAClD,MAAM,OAAO,CAAC;AACf,CAAC,CAAC;AAEF,QAAQ,CAAC,8CAA8C,EAAE,GAAG,EAAE;IAC7D,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACxD,KAAK,CAAC,oBAAoB,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAClD,YAAY,CAAC,OAAO,EAAE,cAAc,CAAC,CACrC,CAAC;QAEF,MAAM,YAAY,EAAE,CAAC;QAErB,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,oBAAoB,CAC1D,cAAc,CAAC,cAAc,CAC7B,CAAC;QACF,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC9C,MAAM,CAAC,uBAAuB,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACxD,KAAK,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,GAAG,EAAE,CACtD,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CACnC,CAAC;QAEF,MAAM,YAAY,EAAE,CAAC;QAErB,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC9C,MAAM,CAAC,uBAAuB,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACrF,KAAK,CAAC,oBAAoB,CAAC,iBAAiB,CAAC;YAC5C,iBAAiB,EAAE,KAAK;YACxB,MAAM,EAAE,IAAI;SAC2B,CAAC,CAAC;QAE1C,MAAM,YAAY,EAAE,CAAC;QAErB,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAC9D,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC;QACtC,MAAM,CAAC,uBAAuB,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC;IACnD,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/tests/detectorPrefetch.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=detectorPrefetch.test.d.ts.map

package/dist/tests/detectorPrefetch.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detectorPrefetch.test.d.ts","sourceRoot":"","sources":["../../src/tests/detectorPrefetch.test.ts"],"names":[],"mappings":""}

package/dist/tests/detectorPrefetch.test.js

@@ -0,0 +1,71 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+const assignDetectorBundle = vi.fn();
+const getProcaptchaRandomActiveProvider = vi.fn();
+vi.mock("@prosopo/api", () => ({
+    ProviderApi: class {
+        constructor() {
+            this.assignDetectorBundle = assignDetectorBundle;
+        }
+    },
+}));
+vi.mock("@prosopo/procaptcha-common", () => ({
+    getProcaptchaRandomActiveProvider: (...args) => getProcaptchaRandomActiveProvider(...args),
+}));
+const { prefetchDetector, takePrefetchedDetector, clearPrefetchedDetectors } = await import("../detectorPrefetch.js");
+const ENV = "staging";
+const SITE_KEY = "5CcNvLUdiXFpzKDMjThGLSK9rhWHA1H4EF3zrgkpkjAdqmuP";
+const provider = { provider: { url: "https://pronode.example" } };
+afterEach(() => {
+    clearPrefetchedDetectors();
+    vi.clearAllMocks();
+});
+describe("detectorPrefetch", () => {
+    it("returns undefined when nothing was prefetched", () => {
+        expect(takePrefetchedDetector(ENV, undefined, SITE_KEY)).toBeUndefined();
+    });
+    it("resolves the provider and assigns a bundle", async () => {
+        getProcaptchaRandomActiveProvider.mockResolvedValue(provider);
+        assignDetectorBundle.mockResolvedValue({ useProviderBundle: true });
+        prefetchDetector(ENV, undefined, SITE_KEY);
+        const claimed = takePrefetchedDetector(ENV, undefined, SITE_KEY);
+        expect(claimed).toBeDefined();
+        const result = await claimed;
+        expect(result).toStrictEqual({
+            provider,
+            assigned: { useProviderBundle: true },
+        });
+        expect(assignDetectorBundle).toHaveBeenCalledWith(SITE_KEY);
+    });
+    it("is single-use, so a retry does not reuse a stale provider pin", async () => {
+        getProcaptchaRandomActiveProvider.mockResolvedValue(provider);
+        assignDetectorBundle.mockResolvedValue({ useProviderBundle: true });
+        prefetchDetector(ENV, undefined, SITE_KEY);
+        const first = takePrefetchedDetector(ENV, undefined, SITE_KEY);
+        await first;
+        expect(takePrefetchedDetector(ENV, undefined, SITE_KEY)).toBeUndefined();
+    });
+    it("does not start a second request for the same key", () => {
+        getProcaptchaRandomActiveProvider.mockResolvedValue(provider);
+        assignDetectorBundle.mockResolvedValue({ useProviderBundle: true });
+        prefetchDetector(ENV, undefined, SITE_KEY);
+        prefetchDetector(ENV, undefined, SITE_KEY);
+        expect(getProcaptchaRandomActiveProvider).toHaveBeenCalledTimes(1);
+    });
+    it("keys on site key and ip mode, so a different widget does not claim it", () => {
+        getProcaptchaRandomActiveProvider.mockResolvedValue(provider);
+        assignDetectorBundle.mockResolvedValue({ useProviderBundle: true });
+        prefetchDetector(ENV, "ipv4", SITE_KEY);
+        expect(takePrefetchedDetector(ENV, "ipv6", SITE_KEY)).toBeUndefined();
+        expect(takePrefetchedDetector(ENV, undefined, SITE_KEY)).toBeUndefined();
+        expect(takePrefetchedDetector(ENV, "ipv4", "other-key")).toBeUndefined();
+        expect(takePrefetchedDetector(ENV, "ipv4", SITE_KEY)).toBeDefined();
+    });
+    it("surfaces failure to the claimant without an unhandled rejection", async () => {
+        getProcaptchaRandomActiveProvider.mockRejectedValue(new Error("no providers"));
+        prefetchDetector(ENV, undefined, SITE_KEY);
+        const claimed = takePrefetchedDetector(ENV, undefined, SITE_KEY);
+        expect(claimed).toBeDefined();
+        await expect(claimed).rejects.toThrow("no providers");
+    });
+});
+//# sourceMappingURL=detectorPrefetch.test.js.map

package/dist/tests/detectorPrefetch.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detectorPrefetch.test.js","sourceRoot":"","sources":["../../src/tests/detectorPrefetch.test.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE7D,MAAM,oBAAoB,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AACrC,MAAM,iCAAiC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AAElD,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9B,WAAW,EAAE;QAAA;YACZ,yBAAoB,GAAG,oBAAoB,CAAC;QAC7C,CAAC;KAAA;CACD,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,4BAA4B,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5C,iCAAiC,EAAE,CAClC,GAAG,IAA4C,EAC9C,EAAE,CAAC,iCAAiC,CAAC,GAAG,IAAI,CAAC;CAC/C,CAAC,CAAC,CAAC;AAEJ,MAAM,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,GAC3E,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;AAExC,MAAM,GAAG,GAAG,SAA6B,CAAC;AAC1C,MAAM,QAAQ,GAAG,kDAAkD,CAAC;AAEpE,MAAM,QAAQ,GAAG,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,yBAAyB,EAAE,EAAE,CAAC;AAElE,SAAS,CAAC,GAAG,EAAE;IACd,wBAAwB,EAAE,CAAC;IAC3B,EAAE,CAAC,aAAa,EAAE,CAAC;AACpB,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACxD,MAAM,CAAC,sBAAsB,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC3D,iCAAiC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC9D,oBAAoB,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;QAEpE,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QACjE,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;QAE9B,MAAM,MAAM,GAAG,MAAO,OAA4B,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC;YAC5B,QAAQ;YACR,QAAQ,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE;SACrC,CAAC,CAAC;QACH,MAAM,CAAC,oBAAoB,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC9E,iCAAiC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC9D,oBAAoB,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;QAEpE,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,sBAAsB,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC/D,MAAO,KAA0B,CAAC;QAElC,MAAM,CAAC,sBAAsB,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC3D,iCAAiC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC9D,oBAAoB,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;QAEpE,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC3C,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QAE3C,MAAM,CAAC,iCAAiC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;QAChF,iCAAiC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC9D,oBAAoB,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;QAEpE,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAExC,MAAM,CAAC,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACtE,MAAM,CAAC,sBAAsB,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACzE,MAAM,CAAC,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACzE,MAAM,CAAC,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAChF,iCAAiC,CAAC,iBAAiB,CAClD,IAAI,KAAK,CAAC,cAAc,CAAC,CACzB,CAAC;QAEF,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QACjE,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;QAK9B,MAAM,MAAM,CAAC,OAA2B,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@prosopo/procaptcha-frictionless",
-	"version": "2.13.0",
+	"version": "2.13.2",
 	"author": "PROSOPO LIMITED <info@prosopo.io>",
 	"license": "Apache-2.0",
 	"main": "dist/index.js",
@@ -30,20 +30,20 @@
 	},
 	"browserslist": ["> 0.5%, last 2 versions, not dead"],
 	"dependencies": {
-		"@prosopo/api": "4.0.0",
-		"@prosopo/common": "3.1.48",
-		"@prosopo/locale": "3.2.8",
-		"@prosopo/procaptcha-common": "2.11.20",
-		"@prosopo/procaptcha-pow": "2.10.27",
-		"@prosopo/procaptcha-puzzle": "2.10.43",
-		"@prosopo/procaptcha-react": "2.9.100",
-		"@prosopo/types": "5.0.0",
+		"@prosopo/api": "4.0.1",
+		"@prosopo/common": "3.1.49",
+		"@prosopo/locale": "3.2.9",
+		"@prosopo/procaptcha-common": "2.11.21",
+		"@prosopo/procaptcha-pow": "2.10.28",
+		"@prosopo/procaptcha-puzzle": "2.10.44",
+		"@prosopo/procaptcha-react": "2.9.101",
+		"@prosopo/types": "5.0.1",
 		"@prosopo/widget-skeleton": "2.8.5",
 		"dotenv": "16.4.5",
 		"react": "18.3.1"
 	},
 	"devDependencies": {
-		"@prosopo/config": "3.3.6",
+		"@prosopo/config": "3.3.7",
 		"@types/node": "22.10.2",
 		"@vitest/coverage-v8": "4.1.10",
 		"concurrently": "9.0.1",

package/src/customDetectBot.ts

@@ -29,12 +29,17 @@ import {
 	DetectorLoaderFromScript,
 	type DetectorType,
 } from "./detectorLoader.js";
+import {
+	type PrefetchedDetector,
+	takePrefetchedDetector,
+} from "./detectorPrefetch.js";
 
-// Upper bound on the detector-bundle assignment + load probe. The detector
-// lives ONLY in the provider-served pool bundles, so if the provider is
-// slow/unreachable we abandon the probe and signal `detectorUnavailable`, and
-// the provider serves a PoW challenge instead of running detection.
-const ASSIGN_TIMEOUT_MS = 2000;
+// Upper bound on the assign POST, which serves the detector bundle inline
+// (~215 KB gzipped). The hop is always cold — /healthz pins a different
+// hostname, so it pays fresh DNS + TLS + a CORS preflight before the download
+// even starts, measured at 6.7s against staging. Anything tighter silently
+// drops the detector and sends an empty token.
+const ASSIGN_TIMEOUT_MS = 10_000;
 
 // The page(s) the widget is rendered on, reduced to origin + path.
 // Deliberately built from `origin` + `pathname` (never `href`) so the query
@@ -168,11 +173,39 @@ const customDetectBot: BotDetectionFunction = async (
 	// preference so frictionless and the subsequent captcha hops stay on the
 	// same stack. Resolved up front — before detection rather than alongside it —
 	// because the detector bundle is served BY this provider.
-	const provider = await getProcaptchaRandomActiveProvider(
-		config.defaultEnvironment,
-		ipMode,
-		retryContext,
-	);
+	// The bundle entry starts provider resolution + assign as soon as it has read
+	// the site key off the DOM, which is well before React has mounted this
+	// widget. Claim that in-flight work if it exists rather than repeating it.
+	// Only valid on a first attempt: a retry is retrying *because* the pinned
+	// pronode failed, so it must re-resolve.
+	const isFirstAttempt = !retryContext || retryContext.attempt <= 1;
+	const prefetched = isFirstAttempt
+		? takePrefetchedDetector(
+				config.defaultEnvironment,
+				ipMode,
+				config.account.address,
+			)
+		: undefined;
+
+	// A prefetch that failed must not fail the flow — it is an optimisation, and
+	// the normal path below handles provider selection and assign failure
+	// already. So swallow it and re-resolve.
+	let prefetchedResult: PrefetchedDetector | undefined;
+	if (prefetched) {
+		try {
+			prefetchedResult = await prefetched;
+		} catch {
+			prefetchedResult = undefined;
+		}
+	}
+
+	const provider =
+		prefetchedResult?.provider ??
+		(await getProcaptchaRandomActiveProvider(
+			config.defaultEnvironment,
+			ipMode,
+			retryContext,
+		));
 
 	const providerApi = new ProviderApi(
 		provider.provider.url,
@@ -183,21 +216,24 @@ const customDetectBot: BotDetectionFunction = async (
 	// in the provider-served pool: when the provider has a populated pool it
 	// returns the obfuscated detector (each with its own keys + inner cipher)
 	// plus a detectorSessionId. When it cannot (no pool, network, decode, or
-	// timeout) we have NO detector to run — there is no bundled fallback — so we
-	// signal `detectorUnavailable` and the provider serves a PoW challenge.
+	// timeout) we have NO detector to run and there is no bundled fallback.
 	let detectorSessionId: string | undefined;
 	let providerDetect: DetectorType | undefined;
 	try {
-		const assigned = await withTimeout(
-			providerApi.assignDetectorBundle(config.account.address),
-			ASSIGN_TIMEOUT_MS,
-		);
+		// Reuse the prefetched assignment when the entry already fetched one for
+		// this provider; otherwise issue it now.
+		const assigned =
+			prefetchedResult?.assigned ??
+			(await withTimeout(
+				providerApi.assignDetectorBundle(config.account.address),
+				ASSIGN_TIMEOUT_MS,
+			));
 		if (assigned.useProviderBundle && assigned.detectorScript) {
+			// Deliberately untimed: this is a local parse + evaluate, so a timer
+			// cannot rescue a stalled main thread — it can only throw away a bundle
+			// we are already holding.
+			providerDetect = await DetectorLoaderFromScript(assigned.detectorScript);
 			detectorSessionId = assigned.detectorSessionId;
-			providerDetect = await withTimeout(
-				DetectorLoaderFromScript(assigned.detectorScript),
-				ASSIGN_TIMEOUT_MS,
-			);
 		}
 	} catch {
 		// No detector available — fall through to the PoW request below.
@@ -206,14 +242,14 @@ const customDetectBot: BotDetectionFunction = async (
 	const ExtClass = await extClassPromise;
 	const ext = new ExtClass();
 
-	// No provider detector ⇒ no detection is possible. Request a PoW challenge
-	// directly: send no token and the detectorUnavailable flag so the provider
-	// serves PoW rather than attempting to score an absent payload.
+	// No provider detector ⇒ no detection is possible, so there is nothing to
+	// send. The request goes out with an empty token and the provider decides
+	// what to serve; the client gets no say in that.
 	if (providerDetect === undefined) {
 		const userAccount = await ext.getAccount(config);
 		const { currentUrl: fallbackUrl, iframeUrl: fallbackIframeUrl } =
 			getCurrentPageUrls();
-		const powCaptcha = await withTimeout(
+		const captcha = await withTimeout(
 			providerApi.getFrictionlessCaptcha(
 				undefined,
 				undefined,
@@ -222,15 +258,14 @@ const customDetectBot: BotDetectionFunction = async (
 				config.mode,
 				undefined,
 				undefined,
-				true,
 				fallbackUrl,
 				fallbackIframeUrl,
 			),
 			10000,
 		);
-		if (powCaptcha.dns_url) {
+		if (captcha.dns_url) {
 			try {
-				void fetch(powCaptcha.dns_url, {
+				void fetch(captcha.dns_url, {
 					method: "GET",
 					mode: "no-cors",
 					credentials: "omit",
@@ -242,13 +277,13 @@ const customDetectBot: BotDetectionFunction = async (
 			}
 		}
 		return {
-			captchaType: powCaptcha.captchaType,
-			sessionId: powCaptcha.sessionId,
+			captchaType: captcha.captchaType,
+			sessionId: captcha.sessionId,
 			provider: provider,
-			status: powCaptcha.status,
+			status: captcha.status,
 			userAccount: userAccount,
-			error: powCaptcha.error,
-			hp: powCaptcha.hp,
+			error: captcha.error,
+			hp: captcha.hp,
 		};
 	}
 
@@ -275,7 +310,6 @@ const customDetectBot: BotDetectionFunction = async (
 		config.mode,
 		undefined,
 		detectorSessionId,
-		undefined,
 		currentUrl,
 		iframeUrl,
 	);

package/src/detectorPrefetch.ts

@@ -0,0 +1,115 @@
+// Copyright 2021-2026 Prosopo (UK) Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+/**
+ * Detector bundle prefetch.
+ *
+ * Since the detector moved into the provider-served pool, the frictionless flow
+ * cannot start until `/detector/assign` has returned. That request is issued by
+ * `customDetectBot`, which only runs once React has mounted the widget — and
+ * that mount sits behind the bundle's dynamic-import chain. Measured on a
+ * staging demo page the assign request did not leave the browser until 1513 ms,
+ * of which ~700 ms was purely waiting for chunks to arrive in sequence.
+ *
+ * Nothing in the request depends on React, i18n or the widget config: it needs
+ * the site key (a DOM attribute, readable immediately), the environment (a
+ * build-time constant) and the IP-mode flags (DOM attributes). So the entry
+ * point kicks it off as soon as it has read those, and `customDetectBot` picks
+ * up the in-flight promise instead of starting its own.
+ *
+ * The cache is deliberately single-use. A provider pin is only valid for the
+ * attempt it was made for — on a retry the previous pronode is the one that
+ * just failed — so a consumed entry is dropped and the retry re-resolves.
+ */
+
+import { ProviderApi } from "@prosopo/api";
+import { getProcaptchaRandomActiveProvider } from "@prosopo/procaptcha-common";
+import type {
+	AssignDetectorBundleResponse,
+	EnvironmentTypes,
+	RandomProvider,
+} from "@prosopo/types";
+
+// `IpMode` is declared in @prosopo/load-balancer, which this package does not
+// depend on. Derive it from the selector we already call rather than adding a
+// dependency (and a matching tsconfig project reference) for one type alias —
+// this also cannot drift from the function's real signature.
+type IpModeParam = Parameters<typeof getProcaptchaRandomActiveProvider>[1];
+
+export interface PrefetchedDetector {
+	provider: RandomProvider;
+	assigned: AssignDetectorBundleResponse;
+}
+
+const inFlight = new Map<string, Promise<PrefetchedDetector>>();
+
+const keyOf = (
+	environment: EnvironmentTypes,
+	ipMode: IpModeParam,
+	siteKey: string,
+): string => `${environment}|${ipMode ?? "auto"}|${siteKey}`;
+
+/**
+ * Start resolving a provider and assigning a detector bundle. Safe to call more
+ * than once for the same key — subsequent calls join the in-flight request.
+ *
+ * Never rejects to the caller: a failed prefetch is indistinguishable from
+ * never having prefetched, and `customDetectBot` already handles assign failure
+ * by falling back to PoW. Returning a rejected promise here would surface as an
+ * unhandled rejection in the host page.
+ */
+export const prefetchDetector = (
+	environment: EnvironmentTypes,
+	ipMode: IpModeParam,
+	siteKey: string,
+): void => {
+	const key = keyOf(environment, ipMode, siteKey);
+	if (inFlight.has(key)) return;
+
+	const promise = (async (): Promise<PrefetchedDetector> => {
+		const provider = await getProcaptchaRandomActiveProvider(
+			environment,
+			ipMode,
+		);
+		const providerApi = new ProviderApi(provider.provider.url, siteKey);
+		const assigned = await providerApi.assignDetectorBundle(siteKey);
+		return { provider, assigned };
+	})();
+
+	// Attach a no-op catch so a failed prefetch never becomes an unhandled
+	// rejection. `takePrefetchedDetector`'s consumer still sees the rejection on
+	// the original promise and falls back.
+	promise.catch(() => undefined);
+	inFlight.set(key, promise);
+};
+
+/**
+ * Claim a prefetched assignment, if one was started for this exact key. The
+ * entry is removed, so a retry does not reuse a pin that may have just failed.
+ */
+export const takePrefetchedDetector = (
+	environment: EnvironmentTypes,
+	ipMode: IpModeParam,
+	siteKey: string,
+): Promise<PrefetchedDetector> | undefined => {
+	const key = keyOf(environment, ipMode, siteKey);
+	const promise = inFlight.get(key);
+	if (promise) inFlight.delete(key);
+	return promise;
+};
+
+/** Test seam — drops any in-flight prefetches. */
+export const clearPrefetchedDetectors = (): void => {
+	inFlight.clear();
+};

package/src/index.ts

@@ -12,3 +12,4 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 export * from "./ProcaptchaFrictionless.js";
+export * from "./detectorPrefetch.js";