From 85a2d8ff329f08fb656ffd1a60c65a13c8154a47 Mon Sep 17 00:00:00 2001 From: "prosoponator[bot]" Date: Fri, 10 Jul 2026 17:00:12 +0000 Subject: [PATCH 1/2] RELEASING: Releasing 4 package(s) Releases: @prosopo/provider@4.15.4 @prosopo/provider-mock@2.8.126 @prosopo/scripts@3.1.126 @prosopo/cli@3.6.62 [skip ci] --- .changeset/restrict-defer-to-verify.md | 20 -------------------- demos/provider-mock/CHANGELOG.md | 6 ++++++ demos/provider-mock/package.json | 4 ++-- dev/scripts/CHANGELOG.md | 7 +++++++ dev/scripts/package.json | 6 +++--- packages/cli/CHANGELOG.md | 6 ++++++ packages/cli/package.json | 4 ++-- packages/provider/CHANGELOG.md | 20 ++++++++++++++++++++ packages/provider/package.json | 2 +- 9 files changed, 47 insertions(+), 28 deletions(-) delete mode 100644 .changeset/restrict-defer-to-verify.md diff --git a/.changeset/restrict-defer-to-verify.md b/.changeset/restrict-defer-to-verify.md deleted file mode 100644 index 06b911c7f0..0000000000 --- a/.changeset/restrict-defer-to-verify.md +++ /dev/null @@ -1,20 +0,0 @@ ---- -"@prosopo/provider": patch ---- - -feat(provider): support `deferToVerify: true` on Restrict rules — serve the challenge, fail at verify - -Extends `findHardBlockPolicy` in `captchaManager.ts` so that a Restrict rule with `deferToVerify: true` is treated as a hard-block at verify time. - -Behaviour: - -- **Frictionless**: the Restrict rule fires as normal — the client is served the configured `captchaType` and `solvedImagesCount` (e.g. `image` / 8 rounds). Compute burden of the challenge is imposed on the caller. -- **Verify**: `checkForHardBlock` matches the same rule and marks the commitment `Disapproved` with `ACCESS_POLICY_BLOCK`, so the dApp's `verify()` returns `{verified: false}` regardless of whether the client's solution was correct. - -Motivation: PROXY_POOL_TLS_NARROW targets solving-farm-backed residential proxy pools that solve image captchas at ~100% (they use human solvers), so we can't stop them by demanding correctness — only by wasting their compute. The existing Restrict/image/8-rounds shape imposes the cost but still lets them through if they solve. Layering `deferToVerify: true` closes that loop: they burn 8 image rounds per session AND fail verify. - -Test coverage updated in `captchaManager.unit.test.ts`: - -- Restrict + deferToVerify → returns the policy (new behaviour). -- Restrict without deferToVerify → returns undefined (routing rule, unchanged). -- All existing Block cases (Block+deferToVerify, Block+no-captchaType, Block+captchaType-without-defer) continue to behave as before. diff --git a/demos/provider-mock/CHANGELOG.md b/demos/provider-mock/CHANGELOG.md index dfe1d039d0..a7ecf20c8c 100644 --- a/demos/provider-mock/CHANGELOG.md +++ b/demos/provider-mock/CHANGELOG.md @@ -1,5 +1,11 @@ # @prosopo/provider-mock +## 2.8.126 +### Patch Changes + +- Updated dependencies [44fe294] + - @prosopo/provider@4.15.4 + ## 2.8.125 ### Patch Changes diff --git a/demos/provider-mock/package.json b/demos/provider-mock/package.json index 65e83d7b5a..20fcdb68bd 100644 --- a/demos/provider-mock/package.json +++ b/demos/provider-mock/package.json @@ -1,6 +1,6 @@ { "name": "@prosopo/provider-mock", - "version": "2.8.125", + "version": "2.8.126", "author": "PROSOPO LIMITED ", "license": "Apache-2.0", "type": "module", @@ -32,7 +32,7 @@ "@prosopo/database": "3.15.12", "@prosopo/dotenv": "3.0.49", "@prosopo/locale": "3.2.6", - "@prosopo/provider": "4.15.3", + "@prosopo/provider": "4.15.4", "@prosopo/types": "4.9.8", "@prosopo/types-database": "4.11.11", "cors": "2.8.5", diff --git a/dev/scripts/CHANGELOG.md b/dev/scripts/CHANGELOG.md index 0d97888fd3..74efa29bf0 100644 --- a/dev/scripts/CHANGELOG.md +++ b/dev/scripts/CHANGELOG.md @@ -1,5 +1,12 @@ # @prosopo/scripts +## 3.1.126 +### Patch Changes + +- Updated dependencies [44fe294] + - @prosopo/provider@4.15.4 + - @prosopo/cli@3.6.62 + ## 3.1.125 ### Patch Changes diff --git a/dev/scripts/package.json b/dev/scripts/package.json index d95c4c3190..4ff030c5ed 100644 --- a/dev/scripts/package.json +++ b/dev/scripts/package.json @@ -1,6 +1,6 @@ { "name": "@prosopo/scripts", - "version": "3.1.125", + "version": "3.1.126", "description": "Dev scripts for working with prosopo packages", "main": "dist/index.js", "types": "dist/index.d.ts", @@ -31,7 +31,7 @@ "@iarna/toml": "2.2.5", "@polkadot/util": "13.5.7", "@polkadot/util-crypto": "13.5.7", - "@prosopo/cli": "3.6.61", + "@prosopo/cli": "3.6.62", "@prosopo/common": "3.1.45", "@prosopo/logger": "2.0.3", "@prosopo/datasets": "3.1.50", @@ -39,7 +39,7 @@ "@prosopo/env": "3.6.12", "@prosopo/keyring": "2.9.56", "@prosopo/locale": "3.2.6", - "@prosopo/provider": "4.15.3", + "@prosopo/provider": "4.15.4", "@prosopo/types": "4.9.8", "@prosopo/types-env": "2.10.11", "@prosopo/util": "3.3.4", diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md index 0eba1f44a9..ceb33ed1a9 100644 --- a/packages/cli/CHANGELOG.md +++ b/packages/cli/CHANGELOG.md @@ -1,5 +1,11 @@ # @prosopo/cli +## 3.6.62 +### Patch Changes + +- Updated dependencies [44fe294] + - @prosopo/provider@4.15.4 + ## 3.6.61 ### Patch Changes diff --git a/packages/cli/package.json b/packages/cli/package.json index 8809107229..b9c0b141b8 100644 --- a/packages/cli/package.json +++ b/packages/cli/package.json @@ -1,6 +1,6 @@ { "name": "@prosopo/cli", - "version": "3.6.61", + "version": "3.6.62", "description": "CLI for Prosopo Provider", "main": "dist/index.js", "types": "dist/index.d.ts", @@ -39,7 +39,7 @@ "@prosopo/env": "3.6.12", "@prosopo/keyring": "2.9.56", "@prosopo/locale": "3.2.6", - "@prosopo/provider": "4.15.3", + "@prosopo/provider": "4.15.4", "@prosopo/types": "4.9.8", "@prosopo/util": "3.3.4", "@prosopo/workspace": "3.1.20", diff --git a/packages/provider/CHANGELOG.md b/packages/provider/CHANGELOG.md index 993fae4852..092b0cbfef 100644 --- a/packages/provider/CHANGELOG.md +++ b/packages/provider/CHANGELOG.md @@ -1,5 +1,25 @@ # @prosopo/provider +## 4.15.4 +### Patch Changes + +- 44fe294: feat(provider): support `deferToVerify: true` on Restrict rules — serve the challenge, fail at verify + + Extends `findHardBlockPolicy` in `captchaManager.ts` so that a Restrict rule with `deferToVerify: true` is treated as a hard-block at verify time. + + Behaviour: + + - **Frictionless**: the Restrict rule fires as normal — the client is served the configured `captchaType` and `solvedImagesCount` (e.g. `image` / 8 rounds). Compute burden of the challenge is imposed on the caller. + - **Verify**: `checkForHardBlock` matches the same rule and marks the commitment `Disapproved` with `ACCESS_POLICY_BLOCK`, so the dApp's `verify()` returns `{verified: false}` regardless of whether the client's solution was correct. + + Motivation: PROXY_POOL_TLS_NARROW targets solving-farm-backed residential proxy pools that solve image captchas at ~100% (they use human solvers), so we can't stop them by demanding correctness — only by wasting their compute. The existing Restrict/image/8-rounds shape imposes the cost but still lets them through if they solve. Layering `deferToVerify: true` closes that loop: they burn 8 image rounds per session AND fail verify. + + Test coverage updated in `captchaManager.unit.test.ts`: + + - Restrict + deferToVerify → returns the policy (new behaviour). + - Restrict without deferToVerify → returns undefined (routing rule, unchanged). + - All existing Block cases (Block+deferToVerify, Block+no-captchaType, Block+captchaType-without-defer) continue to behave as before. + ## 4.15.3 ### Patch Changes diff --git a/packages/provider/package.json b/packages/provider/package.json index d63413f693..b3736b08a9 100644 --- a/packages/provider/package.json +++ b/packages/provider/package.json @@ -1,6 +1,6 @@ { "name": "@prosopo/provider", - "version": "4.15.3", + "version": "4.15.4", "author": "PROSOPO LIMITED ", "license": "Apache-2.0", "type": "module", From e7808a9956ddbcd766b43f799ee454e0e1c35a68 Mon Sep 17 00:00:00 2001 From: "prosoponator[bot]" Date: Fri, 10 Jul 2026 17:01:57 +0000 Subject: [PATCH 2/2] chore: version bump v3.6.62 --- docker/images/provider/package.json | 2 +- package-lock.json | 20 ++++++++++---------- package.json | 2 +- 3 files changed, 12 insertions(+), 12 deletions(-) diff --git a/docker/images/provider/package.json b/docker/images/provider/package.json index 25b8090afa..5e36327dcf 100644 --- a/docker/images/provider/package.json +++ b/docker/images/provider/package.json @@ -1,6 +1,6 @@ { "name": "@prosopo/provider-docker", - "version": "3.6.61", + "version": "3.6.62", "engines": { "node": "^24", "npm": "^11" diff --git a/package-lock.json b/package-lock.json index 6f938d01ef..f1990dcf37 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "@prosopo/captcha", - "version": "3.6.60", + "version": "3.6.61", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@prosopo/captcha", - "version": "3.6.60", + "version": "3.6.61", "license": "Apache-2.0", "workspaces": [ "dev/*", @@ -153,7 +153,7 @@ }, "demos/provider-mock": { "name": "@prosopo/provider-mock", - "version": "2.8.125", + "version": "2.8.126", "license": "Apache-2.0", "dependencies": { "@prosopo/api-express-router": "3.1.43", @@ -162,7 +162,7 @@ "@prosopo/dotenv": "3.0.49", "@prosopo/locale": "3.2.6", "@prosopo/logger": "2.0.3", - "@prosopo/provider": "4.15.3", + "@prosopo/provider": "4.15.4", "@prosopo/types": "4.9.8", "@prosopo/types-database": "4.11.11", "cors": "2.8.5", @@ -1794,13 +1794,13 @@ }, "dev/scripts": { "name": "@prosopo/scripts", - "version": "3.1.125", + "version": "3.1.126", "license": "Apache-2.0", "dependencies": { "@iarna/toml": "2.2.5", "@polkadot/util": "13.5.7", "@polkadot/util-crypto": "13.5.7", - "@prosopo/cli": "3.6.61", + "@prosopo/cli": "3.6.62", "@prosopo/common": "3.1.45", "@prosopo/datasets": "3.1.50", "@prosopo/dotenv": "3.0.49", @@ -1808,7 +1808,7 @@ "@prosopo/keyring": "2.9.56", "@prosopo/locale": "3.2.6", "@prosopo/logger": "2.0.3", - "@prosopo/provider": "4.15.3", + "@prosopo/provider": "4.15.4", "@prosopo/types": "4.9.8", "@prosopo/types-env": "2.10.11", "@prosopo/util": "3.3.4", @@ -38981,7 +38981,7 @@ }, "packages/cli": { "name": "@prosopo/cli", - "version": "3.6.61", + "version": "3.6.62", "license": "Apache-2.0", "dependencies": { "@polkadot/types-codec": "16.4.9", @@ -38992,7 +38992,7 @@ "@prosopo/keyring": "2.9.56", "@prosopo/locale": "3.2.6", "@prosopo/logger": "2.0.3", - "@prosopo/provider": "4.15.3", + "@prosopo/provider": "4.15.4", "@prosopo/types": "4.9.8", "@prosopo/util": "3.3.4", "@prosopo/workspace": "3.1.20", @@ -40502,7 +40502,7 @@ }, "packages/provider": { "name": "@prosopo/provider", - "version": "4.15.3", + "version": "4.15.4", "license": "Apache-2.0", "dependencies": { "@noble/hashes": "1.8.0", diff --git a/package.json b/package.json index 7fffc720cc..92822e412b 100644 --- a/package.json +++ b/package.json @@ -1,7 +1,7 @@ { "name": "@prosopo/captcha", "packageManager": "npm@11.0.0", - "version": "3.6.61", + "version": "3.6.62", "author": "Prosopo", "type": "module", "repository": {