@prosopo/procaptcha-frictionless 2.13.17 → 2.13.18

package/.turbo/turbo-build$colon$cjs.log

@@ -1,5 +1,5 @@
 
-> @prosopo/procaptcha-frictionless@2.13.17 build:cjs
+> @prosopo/procaptcha-frictionless@2.13.18 build:cjs
 > NODE_ENV=${NODE_ENV:-development}; vite build --config vite.cjs.config.ts --mode $NODE_ENV
 
 ViteCommonJSConfig: .
@@ -64,4 +64,4 @@ dist/cjs/detectorPrefetch.cjs            2.98 kB │ gzip: 1.35 kB
 dist/cjs/customDetectBot.cjs             5.55 kB │ gzip: 1.70 kB
 dist/cjs/ProcaptchaFrictionless.cjs      7.68 kB │ gzip: 2.17 kB
 
-✓ built in 49ms
+✓ built in 50ms

package/.turbo/turbo-build$colon$tsc.log

@@ -1,8 +1,8 @@
 
-> @prosopo/procaptcha-frictionless@2.13.17 build:tsc
+> @prosopo/procaptcha-frictionless@2.13.18 build:tsc
 > tsc --build --verbose
 
-12:32:47 PM - Projects in this build: 
+1:43:30 PM - Projects in this build: 
     * ../../dev/config/tsconfig.json
     * ../locale/tsconfig.json
     * ../util/tsconfig.json
@@ -25,47 +25,47 @@
     * ../procaptcha-react/tsconfig.json
     * tsconfig.json
 
-12:32:47 PM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/webpack/webpack.config.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
+1:43:30 PM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/webpack/webpack.config.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
 
-12:32:47 PM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/translationKey.ts' is older than output '../locale/tsconfig.tsbuildinfo'
+1:43:30 PM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/translationKey.ts' is older than output '../locale/tsconfig.tsbuildinfo'
 
-12:32:47 PM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
+1:43:30 PM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
 
-12:32:47 PM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
+1:43:30 PM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
 
-12:32:47 PM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/types.test-d.ts' is older than output '../types/tsconfig.tsbuildinfo'
+1:43:30 PM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/types.test-d.ts' is older than output '../types/tsconfig.tsbuildinfo'
 
-12:32:47 PM - Project '../api/tsconfig.json' is up to date because newest input '../api/src/index.ts' is older than output '../api/tsconfig.tsbuildinfo'
+1:43:30 PM - Project '../api/tsconfig.json' is up to date because newest input '../api/src/tests/apiHarness.ts' is older than output '../api/tsconfig.tsbuildinfo'
 
-12:32:47 PM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/tests/loggerBrowser.unit.test.ts' is older than output '../logger/tsconfig.tsbuildinfo'
+1:43:30 PM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/index.ts' is older than output '../logger/tsconfig.tsbuildinfo'
 
-12:32:47 PM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/tests/utils/objectUtils.unit.test.ts' is older than output '../common/tsconfig.tsbuildinfo'
+1:43:31 PM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/index.ts' is older than output '../common/tsconfig.tsbuildinfo'
 
-12:32:47 PM - Project '../fingerprintjs/tsconfig.json' is up to date because newest input '../fingerprintjs/src/utils/browser.ts' is older than output '../fingerprintjs/tsconfig.tsbuildinfo'
+1:43:31 PM - Project '../fingerprintjs/tsconfig.json' is up to date because newest input '../fingerprintjs/src/utils/browser.ts' is older than output '../fingerprintjs/tsconfig.tsbuildinfo'
 
-12:32:47 PM - Project '../fingerprint/tsconfig.json' is up to date because newest input '../fingerprint/src/index.ts' is older than output '../fingerprint/tsconfig.tsbuildinfo'
+1:43:31 PM - Project '../fingerprint/tsconfig.json' is up to date because newest input '../fingerprint/src/merkle.ts' is older than output '../fingerprint/tsconfig.tsbuildinfo'
 
-12:32:47 PM - Project '../load-balancer/tsconfig.json' is up to date because newest input '../load-balancer/src/tests/providers.unit.test.ts' is older than output '../load-balancer/tsconfig.tsbuildinfo'
+1:43:31 PM - Project '../load-balancer/tsconfig.json' is up to date because newest input '../load-balancer/src/balancer.ts' is older than output '../load-balancer/tsconfig.tsbuildinfo'
 
-12:32:47 PM - Project '../widget-skeleton/tsconfig.json' is up to date because newest input '../widget-skeleton/src/webComponent/createWidget.ts' is older than output '../widget-skeleton/tsconfig.tsbuildinfo'
+1:43:31 PM - Project '../widget-skeleton/tsconfig.json' is up to date because newest input '../widget-skeleton/src/theme.ts' is older than output '../widget-skeleton/tsconfig.tsbuildinfo'
 
-12:32:47 PM - Project '../keyring/tsconfig.json' is up to date because newest input '../keyring/src/pair/decode.ts' is older than output '../keyring/tsconfig.tsbuildinfo'
+1:43:31 PM - Project '../keyring/tsconfig.json' is up to date because newest input '../keyring/src/keyring/keyring.test.ts' is older than output '../keyring/tsconfig.tsbuildinfo'
 
-12:32:47 PM - Project '../account/tsconfig.json' is up to date because newest input '../account/src/custom.d.ts' is older than output '../account/tsconfig.tsbuildinfo'
+1:43:31 PM - Project '../account/tsconfig.json' is up to date because newest input '../account/src/index.ts' is older than output '../account/tsconfig.tsbuildinfo'
 
-12:32:47 PM - Project '../procaptcha-common/tsconfig.json' is up to date because newest input '../procaptcha-common/src/tests/defaultEvents.test.ts' is older than output '../procaptcha-common/tsconfig.tsbuildinfo'
+1:43:31 PM - Project '../procaptcha-common/tsconfig.json' is up to date because newest input '../procaptcha-common/src/simdReadings.ts' is older than output '../procaptcha-common/tsconfig.tsbuildinfo'
 
-12:32:47 PM - Project '../procaptcha-pow/tsconfig.json' is up to date because newest input '../procaptcha-pow/src/index.ts' is older than output '../procaptcha-pow/tsconfig.tsbuildinfo'
+1:43:31 PM - Project '../procaptcha-pow/tsconfig.json' is up to date because newest input '../procaptcha-pow/src/tests/managerHarness.ts' is older than output '../procaptcha-pow/tsconfig.tsbuildinfo'
 
-12:32:47 PM - Project '../procaptcha-puzzle/tsconfig.json' is up to date because newest input '../procaptcha-puzzle/src/tests/managerHarness.ts' is older than output '../procaptcha-puzzle/tsconfig.tsbuildinfo'
+1:43:31 PM - Project '../procaptcha-puzzle/tsconfig.json' is up to date because newest input '../procaptcha-puzzle/src/index.ts' is older than output '../procaptcha-puzzle/tsconfig.tsbuildinfo'
 
-12:32:47 PM - Project '../datasets/tsconfig.json' is up to date because newest input '../datasets/src/tests/dataset.unit.test.ts' is older than output '../datasets/tsconfig.tsbuildinfo'
+1:43:31 PM - Project '../datasets/tsconfig.json' is up to date because newest input '../datasets/src/tests/mocks/data/captchas.ts' is older than output '../datasets/tsconfig.tsbuildinfo'
 
-12:32:47 PM - Project '../procaptcha/tsconfig.json' is up to date because newest input '../procaptcha/src/modules/ProsopoCaptchaApi.ts' is older than output '../procaptcha/tsconfig.tsbuildinfo'
+1:43:31 PM - Project '../procaptcha/tsconfig.json' is up to date because newest input '../procaptcha/src/index.ts' is older than output '../procaptcha/tsconfig.tsbuildinfo'
 
-12:32:47 PM - Project '../procaptcha-react/tsconfig.json' is up to date because newest input '../procaptcha-react/src/index.ts' is older than output '../procaptcha-react/tsconfig.tsbuildinfo'
+1:43:31 PM - Project '../procaptcha-react/tsconfig.json' is up to date because newest input '../procaptcha-react/src/tests/captchaComponent.unit.test.tsx' is older than output '../procaptcha-react/tsconfig.tsbuildinfo'
 
-12:32:47 PM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
+1:43:31 PM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
 
-12:32:47 PM - Building project '/home/runner/work/captcha/captcha/packages/procaptcha-frictionless/tsconfig.json'...
+1:43:31 PM - Building project '/home/runner/work/captcha/captcha/packages/procaptcha-frictionless/tsconfig.json'...
 

package/.turbo/turbo-build.log

@@ -1,9 +1,9 @@
 
-> @prosopo/procaptcha-frictionless@2.13.17 build
+> @prosopo/procaptcha-frictionless@2.13.18 build
 > npm run build:cross-env -- --mode ${NODE_ENV:-development}
 
 
-> @prosopo/procaptcha-frictionless@2.13.17 build:cross-env
+> @prosopo/procaptcha-frictionless@2.13.18 build:cross-env
 > vite build --config vite.esm.config.ts --mode production
 
 ViteEsmConfig: .
@@ -69,4 +69,4 @@ dist/detectorPrefetch.js            2.86 kB │ gzip: 1.32 kB
 dist/customDetectBot.js             5.37 kB │ gzip: 1.67 kB
 dist/ProcaptchaFrictionless.js      7.09 kB │ gzip: 2.12 kB
 
-✓ built in 43ms
+✓ built in 59ms

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # @prosopo/procaptcha-frictionless
 
+## 2.13.18
+### Patch Changes
+
+- 4b1cb19: Correlate a site-supplied session id across render and verify.
+  
+  A site can now hand the widget its own session identifier — Protect's JTI, or any per-user session id it already holds — and have the provider confirm at verify time that the token was earned in that same session. Render it with `data-sessionid="..."` or `renderOptions.sessionId`, resolved the same way `mode` and `language` already are, so implicit, explicit and invisible-button renders all pick it up. Pass the same value as the new trailing `clientSessionId` argument to `ProsopoServer.isVerified`.
+  
+  The widget attaches it to the solution as `clientMetaData.clientSessionId`. It is persisted on the captcha record (PoW, puzzle and image alike) and mirrored to a new top-level `clientMetaData` key on the session record — an object rather than a flat field, because more render-time metadata is expected to land there. It survives the PoW→image/puzzle escalation handoff, since the escalated widget is mounted with the same config.
+  
+  At verify, when the value is supplied and the solve does not carry exactly that value — including carrying none at all, which is what a token minted outside the site's session looks like — the token is disapproved with the new `ResultReason.CLIENT_SESSION_MISMATCH` (`API.CLIENT_SESSION_MISMATCH`, translated in all 31 locales), recorded on both the captcha record and the session.
+  
+  Omitting the id preserves existing behaviour, so this is opt-in and backward compatible. The verify request field is `clientSessionId` rather than `sessionId` because `VerificationResponse.sessionId` already means the provider's own frictionless session; same-named request and response fields meaning different things would be a trap for integrators.
+- Updated dependencies [4b1cb19]
+  - @prosopo/types@5.4.0
+  - @prosopo/locale@3.4.0
+  - @prosopo/procaptcha-common@2.12.0
+  - @prosopo/procaptcha-pow@2.11.0
+  - @prosopo/procaptcha-puzzle@2.11.0
+  - @prosopo/api@4.1.0
+  - @prosopo/common@3.1.52
+  - @prosopo/procaptcha-react@2.9.116
+
 ## 2.13.17
 ### Patch Changes
 

package/dist/tests/escalationClientSession.test.d.ts

@@ -0,0 +1,5 @@
+declare global {
+    var IS_REACT_ACT_ENVIRONMENT: boolean;
+}
+export {};
+//# sourceMappingURL=escalationClientSession.test.d.ts.map

package/dist/tests/escalationClientSession.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"escalationClientSession.test.d.ts","sourceRoot":"","sources":["../../src/tests/escalationClientSession.test.tsx"],"names":[],"mappings":"AA2BA,OAAO,CAAC,MAAM,CAAC;IACd,IAAI,wBAAwB,EAAE,OAAO,CAAC;CACtC"}

package/dist/tests/escalationClientSession.test.js

@@ -0,0 +1,132 @@
+import { CaptchaType, ModeEnum, } from "@prosopo/types";
+import { act, createElement } from "react";
+import { createRoot } from "react-dom/client";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+globalThis.IS_REACT_ACT_ENVIRONMENT = true;
+const mocks = vi.hoisted(() => ({
+    mounts: [],
+}));
+const stub = (widget) => (props) => {
+    mocks.mounts.push({ widget, props });
+    return createElement("div", { "data-widget": widget });
+};
+vi.mock("@prosopo/procaptcha-pow", () => ({ ProcaptchaPow: stub("pow") }));
+vi.mock("@prosopo/procaptcha-react", () => ({ Procaptcha: stub("image") }));
+vi.mock("@prosopo/procaptcha-puzzle", () => ({
+    ProcaptchaPuzzle: stub("puzzle"),
+}));
+vi.mock("@prosopo/procaptcha-common", async (importOriginal) => {
+    const actual = await importOriginal();
+    return { ...actual, isSecureBrowserContext: () => true };
+});
+const { ProcaptchaFrictionless } = await import("../ProcaptchaFrictionless.js");
+const SITE_KEY = "5siteKey";
+const CLIENT_SESSION_ID = "jti-from-the-site";
+const FIRST_SESSION_ID = "provider-session-1";
+const ESCALATED_SESSION_ID = "provider-session-2";
+const config = () => ({
+    account: { address: SITE_KEY },
+    userAccountAddress: "",
+    web2: true,
+    mode: ModeEnum.visible,
+    clientSessionId: CLIENT_SESSION_ID,
+});
+const i18nStub = {
+    isInitialized: true,
+    language: "en",
+    t: (key) => key,
+    changeLanguage: vi.fn(),
+};
+const detectBotReturning = (captchaType) => vi.fn().mockResolvedValue({
+    captchaType,
+    sessionId: FIRST_SESSION_ID,
+    provider: { provider: { url: "https://provider.test" } },
+    userAccount: "userAccount",
+});
+let container;
+let root;
+const mountWrapper = async (captchaType) => {
+    await act(async () => {
+        root.render(createElement(ProcaptchaFrictionless, {
+            config: config(),
+            callbacks: {},
+            restart: vi.fn(),
+            i18n: i18nStub,
+            detectBot: detectBotReturning(captchaType),
+        }));
+    });
+};
+const lastMountOf = (widget) => {
+    const mount = mocks.mounts.filter((m) => m.widget === widget).at(-1);
+    if (!mount)
+        throw new Error(`expected the ${widget} widget to have mounted`);
+    return mount;
+};
+beforeEach(() => {
+    mocks.mounts.length = 0;
+    container = document.createElement("div");
+    document.body.appendChild(container);
+    act(() => {
+        root = createRoot(container);
+    });
+});
+afterEach(() => {
+    act(() => {
+        root.unmount();
+    });
+    container.remove();
+    vi.clearAllMocks();
+});
+describe("client session id across a PoW escalation", () => {
+    it("reaches the PoW widget on the first mount", async () => {
+        await mountWrapper(CaptchaType.pow);
+        expect(lastMountOf("pow").props.config.clientSessionId).toBe(CLIENT_SESSION_ID);
+    });
+    it("survives the handoff to the escalated image widget", async () => {
+        await mountWrapper(CaptchaType.pow);
+        const { onEscalate } = lastMountOf("pow").props;
+        await act(async () => {
+            onEscalate?.(CaptchaType.image, ESCALATED_SESSION_ID);
+        });
+        expect(lastMountOf("image").props.config.clientSessionId).toBe(CLIENT_SESSION_ID);
+    });
+    it("survives the handoff to the escalated puzzle widget", async () => {
+        await mountWrapper(CaptchaType.pow);
+        const { onEscalate } = lastMountOf("pow").props;
+        await act(async () => {
+            onEscalate?.(CaptchaType.puzzle, ESCALATED_SESSION_ID);
+        });
+        expect(lastMountOf("puzzle").props.config.clientSessionId).toBe(CLIENT_SESSION_ID);
+    });
+    it("swaps the provider session id but not the client one", async () => {
+        await mountWrapper(CaptchaType.pow);
+        const powState = lastMountOf("pow").props
+            .frictionlessState;
+        expect(powState.sessionId).toBe(FIRST_SESSION_ID);
+        const { onEscalate } = lastMountOf("pow").props;
+        await act(async () => {
+            onEscalate?.(CaptchaType.image, ESCALATED_SESSION_ID);
+        });
+        const imageMount = lastMountOf("image").props;
+        const imageState = imageMount.frictionlessState;
+        expect(imageState.sessionId).toBe(ESCALATED_SESSION_ID);
+        expect(imageMount.config.clientSessionId).toBe(CLIENT_SESSION_ID);
+    });
+    it("carries no client session id when the site rendered without one", async () => {
+        await act(async () => {
+            root.render(createElement(ProcaptchaFrictionless, {
+                config: { ...config(), clientSessionId: undefined },
+                callbacks: {},
+                restart: vi.fn(),
+                i18n: i18nStub,
+                detectBot: detectBotReturning(CaptchaType.pow),
+            }));
+        });
+        const { onEscalate } = lastMountOf("pow").props;
+        await act(async () => {
+            onEscalate?.(CaptchaType.image, ESCALATED_SESSION_ID);
+        });
+        expect(lastMountOf("image").props.config.clientSessionId).toBeUndefined();
+    });
+});
+//# sourceMappingURL=escalationClientSession.test.js.map

package/dist/tests/escalationClientSession.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"escalationClientSession.test.js","sourceRoot":"","sources":["../../src/tests/escalationClientSession.test.tsx"],"names":[],"mappings":"AAeA,OAAO,EACN,WAAW,EAEX,QAAQ,GAIR,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAqB,GAAG,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AAC9D,OAAO,EAAa,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAQzE,UAAU,CAAC,wBAAwB,GAAG,IAAI,CAAC;AAK3C,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/B,MAAM,EAAE,EAGL;CACH,CAAC,CAAC,CAAC;AAEJ,MAAM,IAAI,GACT,CAAC,MAAkC,EAAE,EAAE,CAAC,CAAC,KAAsB,EAAE,EAAE;IAClE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACrC,OAAO,aAAa,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC;AACxD,CAAC,CAAC;AAEH,EAAE,CAAC,IAAI,CAAC,yBAAyB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;AAC3E,EAAE,CAAC,IAAI,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;AAC5E,EAAE,CAAC,IAAI,CAAC,4BAA4B,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5C,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC;CAChC,CAAC,CAAC,CAAC;AAMJ,EAAE,CAAC,IAAI,CAAC,4BAA4B,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IAC9D,MAAM,MAAM,GACX,MAAM,cAAc,EAA+C,CAAC;IACrE,OAAO,EAAE,GAAG,MAAM,EAAE,sBAAsB,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;AAC1D,CAAC,CAAC,CAAC;AAGH,MAAM,EAAE,sBAAsB,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;AAEhF,MAAM,QAAQ,GAAG,UAAU,CAAC;AAC5B,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AAC9C,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAC9C,MAAM,oBAAoB,GAAG,oBAAoB,CAAC;AAElD,MAAM,MAAM,GAAG,GAAgC,EAAE,CAAC,CAAC;IAClD,OAAO,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE;IAC9B,kBAAkB,EAAE,EAAE;IACtB,IAAI,EAAE,IAAI;IACV,IAAI,EAAE,QAAQ,CAAC,OAAO;IAEtB,eAAe,EAAE,iBAAiB;CAClC,CAAC,CAAC;AAEH,MAAM,QAAQ,GAAG;IAChB,aAAa,EAAE,IAAI;IACnB,QAAQ,EAAE,IAAI;IACd,CAAC,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG;IACvB,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE;CACH,CAAC;AAItB,MAAM,kBAAkB,GAAG,CAAC,WAAwB,EAAE,EAAE,CACvD,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC;IACzB,WAAW;IACX,SAAS,EAAE,gBAAgB;IAC3B,QAAQ,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,uBAAuB,EAAE,EAAoB;IAC1E,WAAW,EAAE,aAAa;CAC1B,CAAC,CAAC;AAEJ,IAAI,SAAyB,CAAC;AAC9B,IAAI,IAAU,CAAC;AAEf,MAAM,YAAY,GAAG,KAAK,EAAE,WAAwB,EAAiB,EAAE;IACtE,MAAM,GAAG,CAAC,KAAK,IAAI,EAAE;QACpB,IAAI,CAAC,MAAM,CACV,aAAa,CAAC,sBAAsB,EAAE;YACrC,MAAM,EAAE,MAAM,EAAE;YAChB,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE;YAChB,IAAI,EAAE,QAAQ;YACd,SAAS,EAAE,kBAAkB,CAAC,WAAW,CAAC;SAC1C,CAAiB,CAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,MAAkC,EAAE,EAAE;IAC1D,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,MAAM,yBAAyB,CAAC,CAAC;IAC7E,OAAO,KAAK,CAAC;AACd,CAAC,CAAC;AAEF,UAAU,CAAC,GAAG,EAAE;IACf,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IACxB,SAAS,GAAG,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IAC1C,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACrC,GAAG,CAAC,GAAG,EAAE;QACR,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,GAAG,EAAE;IACd,GAAG,CAAC,GAAG,EAAE;QACR,IAAI,CAAC,OAAO,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;IACH,SAAS,CAAC,MAAM,EAAE,CAAC;IACnB,EAAE,CAAC,aAAa,EAAE,CAAC;AACpB,CAAC,CAAC,CAAC;AAOH,QAAQ,CAAC,2CAA2C,EAAE,GAAG,EAAE;IAC1D,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,YAAY,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAEpC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,CAC3D,iBAAiB,CACjB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,YAAY,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAIpC,MAAM,EAAE,UAAU,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC;QAChD,MAAM,GAAG,CAAC,KAAK,IAAI,EAAE;YACpB,UAAU,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,CAC7D,iBAAiB,CACjB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,YAAY,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAEpC,MAAM,EAAE,UAAU,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC;QAChD,MAAM,GAAG,CAAC,KAAK,IAAI,EAAE;YACpB,UAAU,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,CAC9D,iBAAiB,CACjB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,YAAY,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAEpC,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,KAAK;aACvC,iBAAsC,CAAC;QACzC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAElD,MAAM,EAAE,UAAU,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC;QAChD,MAAM,GAAG,CAAC,KAAK,IAAI,EAAE;YACpB,UAAU,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC;QAC9C,MAAM,UAAU,GAAG,UAAU,CAAC,iBAAsC,CAAC;QAIrE,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACxD,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,GAAG,CAAC,KAAK,IAAI,EAAE;YACpB,IAAI,CAAC,MAAM,CACV,aAAa,CAAC,sBAAsB,EAAE;gBACrC,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,eAAe,EAAE,SAAS,EAAE;gBACnD,SAAS,EAAE,EAAE;gBACb,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE;gBAChB,IAAI,EAAE,QAAQ;gBACd,SAAS,EAAE,kBAAkB,CAAC,WAAW,CAAC,GAAG,CAAC;aAC9C,CAAiB,CAClB,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,EAAE,UAAU,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC;QAChD,MAAM,GAAG,CAAC,KAAK,IAAI,EAAE;YACpB,UAAU,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,aAAa,EAAE,CAAC;IAC3E,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@prosopo/procaptcha-frictionless",
-	"version": "2.13.17",
+	"version": "2.13.18",
 	"author": "PROSOPO LIMITED <info@prosopo.io>",
 	"license": "Apache-2.0",
 	"main": "dist/index.js",
@@ -30,14 +30,14 @@
 	},
 	"browserslist": ["> 0.5%, last 2 versions, not dead"],
 	"dependencies": {
-		"@prosopo/api": "4.0.15",
-		"@prosopo/common": "3.1.51",
-		"@prosopo/locale": "3.3.1",
-		"@prosopo/procaptcha-common": "2.11.35",
-		"@prosopo/procaptcha-pow": "2.10.42",
-		"@prosopo/procaptcha-puzzle": "2.10.58",
-		"@prosopo/procaptcha-react": "2.9.115",
-		"@prosopo/types": "5.3.0",
+		"@prosopo/api": "4.1.0",
+		"@prosopo/common": "3.1.52",
+		"@prosopo/locale": "3.4.0",
+		"@prosopo/procaptcha-common": "2.12.0",
+		"@prosopo/procaptcha-pow": "2.11.0",
+		"@prosopo/procaptcha-puzzle": "2.11.0",
+		"@prosopo/procaptcha-react": "2.9.116",
+		"@prosopo/types": "5.4.0",
 		"@prosopo/widget-skeleton": "2.8.6",
 		"dotenv": "16.4.5",
 		"react": "19.2.8"
@@ -49,6 +49,7 @@
 		"concurrently": "9.0.1",
 		"del-cli": "6.0.0",
 		"npm-run-all": "4.1.5",
+		"react-dom": "19.2.8",
 		"tslib": "2.7.0",
 		"tsx": "4.20.3",
 		"typescript": "5.6.2",

package/src/tests/escalationClientSession.test.tsx

@@ -0,0 +1,225 @@
+// Copyright 2021-2026 Prosopo (UK) Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import type { Ti18n } from "@prosopo/locale";
+import {
+	CaptchaType,
+	type FrictionlessState,
+	ModeEnum,
+	type ProcaptchaClientConfigInput,
+	type ProcaptchaProps,
+	type RandomProvider,
+} from "@prosopo/types";
+import { type ReactElement, act, createElement } from "react";
+import { type Root, createRoot } from "react-dom/client";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+declare global {
+	var IS_REACT_ACT_ENVIRONMENT: boolean;
+}
+
+// React only lets act() drive its scheduler when the environment says so;
+// without this every render warns and updates flush unpredictably.
+globalThis.IS_REACT_ACT_ENVIRONMENT = true;
+
+// Every widget the frictionless wrapper can mount records the props it was
+// handed, so a test can assert on the config that reached the *second* mount
+// after an escalation without rendering a real captcha.
+const mocks = vi.hoisted(() => ({
+	mounts: [] as {
+		widget: "pow" | "image" | "puzzle";
+		props: ProcaptchaProps;
+	}[],
+}));
+
+const stub =
+	(widget: "pow" | "image" | "puzzle") => (props: ProcaptchaProps) => {
+		mocks.mounts.push({ widget, props });
+		return createElement("div", { "data-widget": widget });
+	};
+
+vi.mock("@prosopo/procaptcha-pow", () => ({ ProcaptchaPow: stub("pow") }));
+vi.mock("@prosopo/procaptcha-react", () => ({ Procaptcha: stub("image") }));
+vi.mock("@prosopo/procaptcha-puzzle", () => ({
+	ProcaptchaPuzzle: stub("puzzle"),
+}));
+
+// The wrapper refuses to run outside a secure context, and jsdom's
+// `isSecureContext` is not reliably true across environments. Everything else
+// from procaptcha-common (Checkbox, getDefaultEvents, providerRetry) is the
+// real implementation.
+vi.mock("@prosopo/procaptcha-common", async (importOriginal) => {
+	const actual =
+		await importOriginal<typeof import("@prosopo/procaptcha-common")>();
+	return { ...actual, isSecureBrowserContext: () => true };
+});
+
+// Imported after the mocks so the lazy loaders inside resolve to the stubs.
+const { ProcaptchaFrictionless } = await import("../ProcaptchaFrictionless.js");
+
+const SITE_KEY = "5siteKey";
+const CLIENT_SESSION_ID = "jti-from-the-site";
+const FIRST_SESSION_ID = "provider-session-1";
+const ESCALATED_SESSION_ID = "provider-session-2";
+
+const config = (): ProcaptchaClientConfigInput => ({
+	account: { address: SITE_KEY },
+	userAccountAddress: "",
+	web2: true,
+	mode: ModeEnum.visible,
+	// What the site set via data-sessionid / renderOptions.sessionId.
+	clientSessionId: CLIENT_SESSION_ID,
+});
+
+const i18nStub = {
+	isInitialized: true,
+	language: "en",
+	t: (key: string) => key,
+	changeLanguage: vi.fn(),
+} as unknown as Ti18n;
+
+// Minimal shape of what customDetectBot resolves to; only the fields the
+// wrapper reads on the happy path need to be present.
+const detectBotReturning = (captchaType: CaptchaType) =>
+	vi.fn().mockResolvedValue({
+		captchaType,
+		sessionId: FIRST_SESSION_ID,
+		provider: { provider: { url: "https://provider.test" } } as RandomProvider,
+		userAccount: "userAccount",
+	});
+
+let container: HTMLDivElement;
+let root: Root;
+
+const mountWrapper = async (captchaType: CaptchaType): Promise<void> => {
+	await act(async () => {
+		root.render(
+			createElement(ProcaptchaFrictionless, {
+				config: config(),
+				callbacks: {},
+				restart: vi.fn(),
+				i18n: i18nStub,
+				detectBot: detectBotReturning(captchaType),
+			}) as ReactElement,
+		);
+	});
+};
+
+const lastMountOf = (widget: "pow" | "image" | "puzzle") => {
+	const mount = mocks.mounts.filter((m) => m.widget === widget).at(-1);
+	if (!mount) throw new Error(`expected the ${widget} widget to have mounted`);
+	return mount;
+};
+
+beforeEach(() => {
+	mocks.mounts.length = 0;
+	container = document.createElement("div");
+	document.body.appendChild(container);
+	act(() => {
+		root = createRoot(container);
+	});
+});
+
+afterEach(() => {
+	act(() => {
+		root.unmount();
+	});
+	container.remove();
+	vi.clearAllMocks();
+});
+
+// The PoW -> image/puzzle escalation is the one flow where a user solves a
+// second captcha under a *different* provider session. The client session id
+// has to survive that handoff, or the dapp server's verify call would be
+// correlated against an escalated record that never carried it and every
+// escalated user would be rejected.
+describe("client session id across a PoW escalation", () => {
+	it("reaches the PoW widget on the first mount", async () => {
+		await mountWrapper(CaptchaType.pow);
+
+		expect(lastMountOf("pow").props.config.clientSessionId).toBe(
+			CLIENT_SESSION_ID,
+		);
+	});
+
+	it("survives the handoff to the escalated image widget", async () => {
+		await mountWrapper(CaptchaType.pow);
+
+		// The provider accepted the PoW but wants a visual challenge; the PoW
+		// widget calls back with the replacement session the provider minted.
+		const { onEscalate } = lastMountOf("pow").props;
+		await act(async () => {
+			onEscalate?.(CaptchaType.image, ESCALATED_SESSION_ID);
+		});
+
+		expect(lastMountOf("image").props.config.clientSessionId).toBe(
+			CLIENT_SESSION_ID,
+		);
+	});
+
+	it("survives the handoff to the escalated puzzle widget", async () => {
+		await mountWrapper(CaptchaType.pow);
+
+		const { onEscalate } = lastMountOf("pow").props;
+		await act(async () => {
+			onEscalate?.(CaptchaType.puzzle, ESCALATED_SESSION_ID);
+		});
+
+		expect(lastMountOf("puzzle").props.config.clientSessionId).toBe(
+			CLIENT_SESSION_ID,
+		);
+	});
+
+	it("swaps the provider session id but not the client one", async () => {
+		await mountWrapper(CaptchaType.pow);
+
+		const powState = lastMountOf("pow").props
+			.frictionlessState as FrictionlessState;
+		expect(powState.sessionId).toBe(FIRST_SESSION_ID);
+
+		const { onEscalate } = lastMountOf("pow").props;
+		await act(async () => {
+			onEscalate?.(CaptchaType.image, ESCALATED_SESSION_ID);
+		});
+
+		const imageMount = lastMountOf("image").props;
+		const imageState = imageMount.frictionlessState as FrictionlessState;
+		// These are different identifiers and must not be conflated: the
+		// provider session rotates on escalation, the site's own session does
+		// not. The verify-time correlation keys off the latter.
+		expect(imageState.sessionId).toBe(ESCALATED_SESSION_ID);
+		expect(imageMount.config.clientSessionId).toBe(CLIENT_SESSION_ID);
+	});
+
+	it("carries no client session id when the site rendered without one", async () => {
+		await act(async () => {
+			root.render(
+				createElement(ProcaptchaFrictionless, {
+					config: { ...config(), clientSessionId: undefined },
+					callbacks: {},
+					restart: vi.fn(),
+					i18n: i18nStub,
+					detectBot: detectBotReturning(CaptchaType.pow),
+				}) as ReactElement,
+			);
+		});
+
+		const { onEscalate } = lastMountOf("pow").props;
+		await act(async () => {
+			onEscalate?.(CaptchaType.image, ESCALATED_SESSION_ID);
+		});
+
+		expect(lastMountOf("image").props.config.clientSessionId).toBeUndefined();
+	});
+});