release: WRNexusJS 0.5.0

2026-07-29 12:51:10 +05:30
parent 76c768099d
commit 6afe32f63f
456 changed files with 40879 additions and 8850 deletions
@@ -211,6 +211,38 @@ export async function POST(ctx) {

 The CAPTCHA runtime binds its required-form check in the capture phase, so a `data-schema` validator cannot submit the form before CAPTCHA verification. After a successful form request, the component automatically creates a fresh challenge.

+### Retryable operations such as login
+
+A login may consume a valid CAPTCHA and then fail because the password is
+incorrect. Configure a short action-bound session grant so the user can correct
+their credentials without solving CAPTCHA again:
+
+```ts
+const guard = captchaGuard({
+  action: "auth-login",
+  engine,
+  bindHostname: true,
+  bindSession: true,
+  verifiedForMs: 5 * 60_000,
+});
+```
+
+Keep the verified widget state for non-CAPTCHA form errors:
+
+```wrn
+<Captcha
+  action="auth-login"
+  required="true"
+  resetOnError="false"
+/>
+```
+
+The grant is stored in the current session and bound to the configured action.
+Expired grants and CAPTCHA-specific errors still require and load a fresh
+challenge. Keep login rate limits and authentication lockout enabled;
+`verifiedForMs` removes repeated human verification, not credential-abuse
+controls.
+
 ## Validate a schema and CAPTCHA together

 ```ts