release: WRNexusJS 0.5.0

2026-07-29 12:51:10 +05:30
parent 76c768099d
commit 6afe32f63f
456 changed files with 40879 additions and 8850 deletions
@@ -8,6 +8,7 @@ CAPTCHA is an anti-automation signal, not authentication or authorization. Conti
 - Challenge IDs and response tokens use cryptographically secure random bytes.
 - Challenges expire, have attempt limits, and are consumed after a correct answer.
 - Response tokens are opaque, hashed at rest, action-bound, and single-use by default.
+- Optional `captchaGuard({ verifiedForMs })` grants are session-bound, action-bound, and short-lived; use them only for retryable operations and retain independent rate limits.
 - Optional hostname, session, and IP bindings are validated with constant-time comparisons.
 - Audio URLs contain a random access key and are private/no-store.
 - Public challenge payloads never include the answer. Renderer names and disturbance metadata are safe to expose because they do not reveal the answer.