@webdecoy/fcaptcha 1.40.0 → 1.41.0

package/experimental.js

@@ -6,6 +6,26 @@ const { calculateCategoryScores, BEHAVIOURAL_CATEGORIES, CORROBORATION_AGREE_AT,
 // Change this ID whenever the policy's evidence, thresholds, or scoring semantics
 // change. An old selector must never silently opt an operator into a new policy.
 const EXPERIMENTAL_POLICY = 'stealth-corroboration-v1';
+const ANIMATION_POLICY = 'animation-consistency-v1';
+
+function animationObservation(signals) {
+  const probe = signals.environmental?.animationConsistency;
+  const realm = (value) => {
+    if (value?.status !== 'ok' || !Array.isArray(value.specified) || value.specified.length !== 3 ||
+        !value.specified.every((n) => n === 1000) || !Array.isArray(value.durations) || value.durations.length !== 3 ||
+        !value.durations.every((row) => Array.isArray(row) && row.length === 4 &&
+          row.every((n) => typeof n === 'number' && Number.isFinite(n) && n >= 0 && n <= 1e9))) return null;
+    return value.durations.every((row, i) => row.every((n) => n === (i === 2 ? 1000 : 0)));
+  };
+  const main = probe?.version === 1 ? realm(probe.main) : null;
+  const frame = probe?.version === 1 ? realm(probe.iframe) : null;
+  const status = main === null || frame === null ? 'unknown' : main && frame ? 'detected' : 'clear';
+  // Always observe: existing policy selectors must never enable new evidence.
+  return { mode: 'observe', status, detections: status === 'detected' ? [{
+    id: 'animation-timing-inconsistency',
+    reason: 'Browser API timing inconsistency; experimental observation, not proof of automation',
+  }] : [] };
+}
 
 // Observe by default. This intentionally measures a known-ambiguous hypothesis:
 // #87's stealth session and a DevTools hardware override can look identical.
@@ -31,6 +51,7 @@ function evaluateExperimental(signals, productionScore, detections, blocking = f
       reason: 'Page and Worker disagree on hardwareConcurrency; also possible with DevTools or privacy tools',
     }] : [],
     corroboratingCategories,
+    observations: { [ANIMATION_POLICY]: animationObservation(signals) },
   };
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webdecoy/fcaptcha",
-  "version": "1.40.0",
+  "version": "1.41.0",
   "description": "Open source CAPTCHA with PoW, bot detection, and Vision AI protection",
   "main": "index.js",
   "exports": {