altcha 2.3.0 → 3.0.0-beta.2

package/LICENSE.txt

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2023 Daniel Regeci, BAU Software s.r.o.
+Copyright (c) 2023-2026 Daniel Regeci, BAU Software s.r.o.
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -9,43 +9,32 @@ ALTCHA is fully compliant with:
 
 For more details, visit [altcha.org](https://altcha.org).
 
-> [!NOTE]
-> **Breaking change (v2.3.0)**
->
-> As of version **2.3.0**, the obfuscation and other plugins have been removed from the main package and moved to a separate package: `@altcha/plugins`.
->
-> If you do not use any plugins, no changes are required.
->
-> See the [migration guide for v2.3.0](https://github.com/altcha-org/altcha/blob/main/MIGRATION-v2.3.0.md).
+## Playground
 
+Want to see it in action? Visit the official ALTCHA Playground to experiment with widget configurations, fine-tune the Proof-of-Work (PoW) settings, and see how the security mechanisms hold up in real-time.
 
-## Features
-
-- **Frictionless Experience**: Uses proof-of-work (PoW) instead of visual puzzles for a seamless user experience.
-- **Code Challenge (New in v2)**: Supports accessible code challenges ("enter code from image") with an audio option.
-- **Cookie-Free Design**: GDPR-compliant by default—no cookies or tracking.
-- **Fully Accessible**: Meets WCAG 2.2 AA-level standards and complies with the European Accessibility Act (EAA).
-- **Lightweight**: Minimal bundle size for fast page loads and optimal performance.
-- **Self-Hosted**: No dependency on third-party services.
-
-## What’s New in v2
+[Open ALTCHA Playground](https://playground.altcha.org)
 
-Version 2 introduces enhanced accessibility, expanded language support, and integration with **ALTCHA Sentinel**—a self-hosted anti-spam solution for websites, apps, and services.
+## Features
 
-### Key Improvements in v2
+- **Frictionless Experience**: Eliminates frustrating visual puzzles by using background **Proof-of-Work (PoW)** for a seamless user journey.
+- **Hardware-Resistant Security**: Leverages **Argon2 and Scrypt** memory-bound algorithms to neutralize hardware acceleration (ASICs/GPUs) and sophisticated bot farms.
+- **Accessible Code Challenges**: Provides "Enter code from image" fallbacks with built-in **audio support** for visually impaired users.
+- **Privacy by Design**: Fully **GDPR compliant** and cookie-free—no tracking, no fingerprinting, and no data collection.
+- **Universal Accessibility**: Engineered to exceed **WCAG 2.2 AA** standards, ensuring compliance with the **European Accessibility Act (EAA)**.
+- **Lightweight**: Minimal footprint, optimized for rapid page loads and high-performance environments.
+- **100% Self-Hosted**: Maintain full sovereignty over your infrastructure with no reliance on third-party API availability.
 
-- **Built-in Internationalization (i18n)** for 50+ languages
-- **Improved RTL (right-to-left) language support**
-- **Enhanced WCAG accessibility**
-- **Support for accessible code challenges** (image + audio options)
-- **Overlay UI**
+## What’s New in v3
 
-### Migrating from v1
+- **Next-Gen PoW**: Significant performance gains and reduced CPU overhead through an optimized verification mechanism.
+- **Advanced Bot Defense**: Native support for **Argon2 and Scrypt**, raising the cost of attack for automated scripts and specialized hardware.
+- **Modern UI**: Refined styling options, including a suite of new built-in themes and improved CSS custom property support.
+- **Developer Experience**: Improved TypeScript support and streamlined integration.
 
-Version 2 (v2) is fully compatible with v1, and minimal migration steps are required. However, be sure to test your integration after updating.
+### Migrating from v2
 
-- Translations: v2 introduces a new [built-in internationalization (i18n) system](#internationalization-i18n). The use of the `strings` attribute is now discouraged in favor of this new system.
-- [ALTCHA Sentinel](https://altcha.org/docs/v2/sentinel): Sentinel is a new self-hosted solution that replaces the previous SaaS services and the SpamFilter. We recommend migrating to Sentinel for better compliance, enhanced security, unlimited verifications, and an adaptive Captcha with code-challenge support.
+See [MIGRATION-v2.md](https://github.com/altcha-org/altcha/blob/v3/MIGRATION-v2.md).
 
 ## Examples
 
@@ -74,7 +63,7 @@ Explore starter templates for popular frameworks:
 
 ## Usage
 
-The ALTCHA widget is distributed as a **Web Component** and [supports all modern browsers](https://developer.mozilla.org/en-US/docs/Web/API/Web_components#browser_compatibility).
+The ALTCHA widget is distributed as a **Web Component**.
 
 ### 1. Install ALTCHA
 
@@ -94,22 +83,11 @@ Or load via `<script>` tag:
 <script async defer src="/altcha.js" type="module"></script>
 ```
 
-**CDN**:
-
-```html
-<script
-  async
-  defer
-  src="https://cdn.jsdelivr.net/gh/altcha-org/altcha@main/dist/altcha.min.js"
-  type="module"
-></script>
-```
-
 ### 2. Add `<altcha-widget>` to Your Forms
 
 ```html
 <form>
-  <altcha-widget challengeurl="https://..."></altcha-widget>
+	<altcha-widget challenge="https://..."></altcha-widget>
 </form>
 ```
 
@@ -141,61 +119,159 @@ ALTCHA is optimized for performance:
 
 | Distribution                 | Size (GZIPped) |
 | ---------------------------- | -------------- |
-| ALTCHA                       | 30 kB          |
-| ALTCHA with all translations | 46 kB          |
+| ALTCHA                       | 31 kB          |
+| ALTCHA with all translations | 49 kB          |
 | Cloudflare Turnstile         | 85+ kB         |
 | hCaptcha                     | 250+ kB        |
 | reCAPTCHA                    | 300+ kB        |
 
-When GZIPped, it totals about 30 kB, making ALTCHA’s widget about 90% smaller than reCAPTCHA.
+When GZIPped, it totals about 31 kB, making ALTCHA’s widget about 90% smaller than reCAPTCHA.
 
 ## Content Security Policy (CSP)
 
-The default bundle includes styles and workers in a single file. For strict CSP compliance, use scripts from `/dist_external`. Learn more in the [documentation](https://altcha.org/docs/v2/widget-integration).
+The default bundle includes styles and workers in a single file. For strict CSP compliance, use scripts from `/dist/external`. Learn more in the [documentation](https://altcha.org/docs/v2/widget-integration).
 
 ## Configuration
 
-Required options (at least one is required):
-
-- **challengeurl**: Server endpoint to fetch the challenge.
-- **challengejson**: Preloaded JSON challenge data (avoids HTTP requests).
-
-Additional options:
-
-- **auto**: Automatically verify without user interaction (possible values: `off`, `onfocus`, `onload`, `onsubmit`).
-- **credentials**: Whether to include [credentials](https://developer.mozilla.org/en-US/docs/Web/API/RequestInit#credentials) with the challenge request (possible values: `omit`, `same-origin`, `include`).
-- **customfetch**: A custom `fetch` function for retrieving the challenge.  
-  Accepts `url: string` and `init: RequestInit` as arguments and must return a [`Response`](https://developer.mozilla.org/en-US/docs/Web/API/Response).
-- **delay**: Artificial delay in milliseconds before verification (defaults to 0).
-- **disableautofocus**: If true, prevents the code-challenge input from automatically receiving focus on render (defaults to `false`).
-- **disablerefetchonexpire**: Whether to disable automatic re-fetch and re-validation when the challenge expires (defaults to `false`).
-- **expire**: Challenge expiration duration in milliseconds.
-- **floating**: Enable floating UI (possible values: `auto`, `top`, `bottom`).
-- **floatinganchor**: CSS selector of the "anchor" to which the floating UI will be attached (defaults to the `button[type="submit"]` in the related form).
-- **floatingoffset**: Y offset from the anchor element for the floating UI in pixels (defaults to `12`).
-- **floatingpersist**: Whether to "persist" (keep visible) the floating widget after verification (possible values: `true` | `false` | `focus`; defaults to `false`, meaning the widget will hide).
-- **hidefooter**: Hide the footer (ALTCHA link).
-- **hidelogo**: Hide the ALTCHA logo.
-- **id**: The checkbox `id` attribute. Useful for multiple instances of the widget on the same page.
-- **language**: The ISO alpha-2 code of the language to use (the language file be imported from `altcha/i18n/*`).
-- **maxnumber**: Max number to iterate to (defaults to 1,000,000).
-- **name**: Name of the hidden field containing the payload (defaults to "altcha").
-- **overlay**: Enables overlay UI mode (automatically sets `auto="onsubmit"`).
-- **overlaycontent**: CSS selector of the HTML element to display in the overlay modal before the widget.
-- **strings**: JSON-encoded translation strings. Refer to [customization](https://altcha.org/docs/v2/widget-customization).
-- **verifyurl**: URL for server-side verification requests. This option is automatically configured with Sentinel. Override this setting only if using a custom server implementation. Supports `fn:function_name` format to call a global JS function instead.
-- **workers**: Number of workers to utilize for PoW (defaults to `navigator.hardwareConcurrency || 8`, max value `16`).
-- **workerurl**: URL of the Worker script (defaults to `./worker.js`, only works with `external` build).
-
-Data Obfuscation options:
-
-- **obfuscated**: The [obfuscated data](https://altcha.org/docs/v2/obfuscation) provided as a base64-encoded string (requires `altcha/obfuscation` plugin). Use only without `challengeurl`/`challengejson`.
-
-Development / Testing options:
-
-- **debug**: Print log messages in the console.
-- **mockerror**: Causes verification to always fail with a "mock" error.
-- **test**: Generates a "mock" challenge within the widget, bypassing the request to `challengeurl`.
+### Programmatic Configuration
+
+The widget provides a global `$altcha` object to manage defaults, register new algorithms, or add custom translations.
+
+To update an existing widget instance, use the `.configure()` [method](). This is the preferred way to handle complex objects or functions that cannot be passed via HTML attributes.
+
+```ts
+// Set defaults for all future widget instances:
+$altcha.defaults.set({
+	challenge: 'https://api.example.com/challenge',
+	debug: true
+});
+
+// Update a specific instance dynamically:
+const widget = document.querySelector('altcha-widget');
+widget.configure({
+	workers: 2,
+	language: 'fr'
+});
+```
+
+### Attribute Configuration
+
+For simple implementations, the widget supports a subset of configuration options directly as HTML attributes. For more advanced properties, use the programmatic approach above.
+
+**Supported Attributes:**
+
+```html
+<altcha-widget
+	auto="off"
+	challenge="https://api.example.com/challenge"
+	configuration='{"delay": 500}'
+	display="standard"
+	language="en"
+	name="altcha"
+	theme="default"
+	type="checkbox"
+	workers="4"
+></altcha-widget>
+```
+
+> [!TIP]
+> The `configuration` attribute accepts a JSON-encoded string, allowing you to pass complex settings directly in your HTML markup.
+
+### Core Settings
+
+- **`name`**: The `name` attribute of the hidden input field containing the payload. (Default: `"altcha"`)
+- **`challenge`**: The challenge data or the URL to fetch a new challenge from.
+- **`type`**: Visual style of the interaction element (`'native'`, `'checkbox'`, or `'switch'`).
+- **`language`**: The ISO alpha-2 language code for localization (requires corresponding i18n file).
+- **`workers`**: The number of Web Workers to spawn for proof-of-work calculations.
+
+### Automation & Timing
+
+- **`auto`**: Determines when verification triggers automatically (`'off'`, `'onfocus'`, `'onload'`, or `'onsubmit'`).
+- **`minDuration`**: The minimum verification time in milliseconds; adds an artificial delay if the PoW is faster. (Default: `500`)
+- **`retryOnOutOfMemoryError`**: Automatically attempts to restart verification with fewer workers if the browser runs out of memory (Argon2 and Scrypt only).
+
+### UI & Display
+
+- **`display`**: The visual layout mode (`'standard'`, `'bar'`, `'floating'`, `'overlay'`, or `'invisible'`).
+- **`barPlacement`**: Vertical position of the widget when `display` is set to `bar` (`'bottom'` or `'top'`).
+- **`hideLogo`**: Hides the ALTCHA logo icon.
+- **`hideFooter`**: Hides the "ALTCHA" attribution link.
+- **`validationMessage`**: Custom validation message for the HTML5 `setCustomValidity` API.
+
+### Floating Widget Settings
+
+- **`floatingAnchor`**: The element or CSS selector the floating UI attaches to. Defaults to the first submit button.
+- **`floatingPlacement`**: Preferred position relative to the anchor (`'auto'`, `'bottom'`, or `'top'`).
+- **`floatingOffset`**: Vertical offset in pixels between the UI and its anchor. (Default: `12`)
+- **`floatingPersist`**: Whether the floating widget remains visible after successful verification.
+
+### Modal & Challenge Settings
+
+- **`codeChallengeDisplay`**: UI layout for the code-challenge modal (`'standard'`, `'overlay'`, or `'bottomsheet'`).
+- **`overlayContent`**: CSS selector for an element to be mirrored inside the overlay modal.
+- **`audioChallengeLanguage`**: Forces a specific language for audio-based challenges.
+- **`disableAutoFocus`**: Prevents the code-challenge modal from stealing focus when opened.
+
+### Advanced & Debugging
+
+- **`debug`**: Enables verbose logging in the browser console.
+- **`test`**: Mocks a successful verification for testing environments.
+- **`mockError`**: Forces the widget into a failed state for UI testing.
+- **`fetch`**: A custom `fetch` implementation for network requests.
+- **`setCookie`**: When configured, sends the payload as a cookie.
+- **`verifyFunction`**: A custom verification handler that overrides default network verification.
+
+## Cookies
+
+By default, the widget sends the ALTCHA payload as a form field by creating a hidden input. It can also be configured to send the payload via a cookie.
+
+To enable this behavior, use the `setCookie` configuration option:
+
+```ts
+widget.configure({
+	setCookie: {
+		name: 'altcha',
+		path: '/'
+	}
+});
+```
+
+`setCookie` accepts the following cookie options:
+
+```ts
+interface SetCookieOptions {
+	domain?: string;
+	name?: string;
+	maxAge?: number;
+	path?: string;
+	sameSite?: string;
+	secure?: boolean;
+}
+```
+
+## Server Configuration
+
+When the widget fetches a challenge from the server, the server can override widget configuration using either the `X-Altcha-Config` response header or the `configuration` property in the challenge response.
+
+Example using the `configuration` property in the challenge JSON response to force cookie usage:
+
+```json
+{
+	"configuration": {
+		"setCookie": {
+			"name": "altcha",
+			"path": "/submit"
+		}
+	},
+	"parameters": {
+		// ...
+	},
+	"signature": "..."
+}
+```
+
+The `X-Altcha-Config` header must contain a JSON-encoded object with configuration options.
 
 ## Internationalization (i18n)
 
@@ -237,14 +313,14 @@ To override the language manually, use the `language` attribute:
 
 ### Customizing Translations
 
-You can override default translations by updating the global `altchaI18n` registry (`globalThis.altchaI18n` or `window.altchaI18n`):
+You can override default translations by updating the global `$altcha` registry (`globalThis.$altcha.i18n`):
 
 ```js
 import 'altcha/i18n/de';
 
-globalThis.altchaI18n.set('de', {
-  ...globalThis.altchaI18n.get('de'),
-  label: 'Ich bin ein Mensch', // Custom label
+$altcha.i18n.set('de', {
+	...$altcha.i18n.get('de'),
+	label: 'Ich bin ein Mensch' // Custom label
 });
 ```
 
@@ -252,106 +328,31 @@ globalThis.altchaI18n.set('de', {
 
 For additional verification, ALTCHA supports **image/audio code challenges** (e.g., "Enter the code from the image"). This feature requires [ALTCHA Sentinel](https://altcha.org/docs/v2/sentinel) or a custom server implementation.
 
-## Plugins
+## Data Obfuscation
 
-Extend functionality with plugins:
+[Data obfuscation]() is supported via an official plugin, which must be imported alongside the widget. This is ideal for protecting sensitive information, such as email addresses, from scrapers until the challenge is solved.
 
-```js
-import 'altcha/obfuscation'; // Data obfuscation
-import 'altcha/upload'; // File uploads
-import 'altcha'; // Main package
-```
-
-Enable plugins per widget:
+### Programmatic Usage
 
-```html
-<altcha-widget plugins="upload,obfuscation"></altcha-widget>
-```
+The plugin exports `obfuscate` and `deobfuscate` functions for manual data handling:
 
-### Available Plugins
+```ts
+import { obfuscate } from 'altcha/plugins/obfuscation';
 
-- **obfuscation**: Secure sensitive data (emails, phone numbers).
-- **upload**: File uploads with ALTCHA Sentinel or a custom backend.
+const obfuscatedData = await obfuscate('mailto:hello@example.com');
+```
 
-## Programmatic Configuration
+### Widget Integration
 
-To configure the widget programmatically, use the `configure()` method:
+To use the plugin with the widget, ensure `altcha/plugins/obfuscation` is imported **after** the main library. Use the `data-obfuscated` attribute to provide the Base64-encoded payload:
 
-```ts
-document.querySelector('#altcha').configure({
-  challenge: {
-    algorithm: 'SHA-256',
-    challenge: '...',
-    salt: '...',
-    signature: '...',
-  },
-  strings: {
-    label: 'Verify',
-  },
-});
-```
-
-Available configuration options:
+```html
+<script>
+	import 'altcha';
+	import 'altcha/plugins/obfuscation';
+</script>
 
-```ts
-export interface Configure {
-  auto?: 'off' | 'onfocus' | 'onload' | 'onsubmit';
-  challenge?: {
-    codeChallenge?: {
-      audio?: string;
-      image: string;
-      length?: number;
-    };
-    algorithm: string;
-    challenge: string;
-    maxnumber?: number;
-    salt: string;
-    signature: string;
-  };
-  challengeurl?: string;
-  credentials?: 'omit' | 'same-origin' | 'include' | boolean;
-  customfetch?:
-    | string
-    | ((url: string, init?: RequestInit) => Promise<Response>);
-  debug?: boolean;
-  delay?: number;
-  disableautofocus?: boolean;
-  disablerefetchonexpire?: boolean;
-  expire?: number;
-  floating?: 'auto' | 'top' | 'bottom';
-  floatinganchor?: string;
-  floatingoffset?: number;
-  floatingpersist?: boolean | 'focus';
-  hidefooter?: boolean;
-  hidelogo?: boolean;
-  maxnumber?: number;
-  mockerror?: boolean;
-  name?: string;
-  obfuscated?: string;
-  overlay?: boolean;
-  refetchonexpire?: boolean; // deprecated, use disablerefetchonexpire 
-  spamfilter?: boolean | 'ipAddress' | SpamFilter; // deprecated
-  strings?: {
-    ariaLinkLabel: strin;
-    enterCode: string;
-    enterCodeAria: string;
-    error: string;
-    expired: string;
-    footer: string;
-    getAudioChallenge: string;
-    label: string;
-    loading: string;
-    reload: strin;
-    verificationRequired: string;
-    verified: string;
-    verifying: string;
-    waitAlert: string;
-  };
-  test?: boolean | number | 'delay';
-  verifyurl?: string;
-  workers?: number;
-  workerurl?: string;
-}
+<altcha-widget data-obfuscated="${obfuscatedData}" display="floating"></altcha-widget>
 ```
 
 ## Methods
@@ -359,40 +360,40 @@ export interface Configure {
 - `configure(options)` - Configures the widget with the given options. See Configuration options above.
 - `getConfiguration()` - Returns the current configuration.
 - `getState()` - Returns the current `state` of the widget.
-- `show()` - Displays the widget (used in floating or overlay mode).
-- `hide()` - Hides the widget (used in floating or overlay mode).
+- `show()` - Displays the widget (used in some display modes).
+- `hide()` - Hides the widget (used in some display modes).
 - `reset(state?, err?)` - Resets the internal `state`, optionally with an error.
 - `setState(state, err?)` - Manually sets the specified `state`, optionally with an error.
-- `setFloatingAnchor(element)` - Sets the anchor element for the floating UI.
-- `verify()` - Initiates the verification process.s a "mock" challenge within the widget, bypassing the request to `challengeurl`.
-
+- `updateUI()` - Force UI update or reposition, for example for the floating display mode.
+- `verify()` - Initiates the verification process.
 
 ## Events
 
-- **code** - Triggers when code-challenge verification is requested.
+- **codechallenge** - Triggers when code-challenge verification is requested.
+- **expired** - Triggers when the challenge expires.
 - **load** - Triggers when the widget loads. The exported methods become available after this event.
-- **sentinelverification** - Triggers upon a verification with ALTCHA Sentinel.
-- **serververification** - (Deprecated) Triggers upon a server verification (only in conjunction with `spamfilter`).
+- **outofmemory** - Triggers when an Out-Of-Memory error is received (Argon2 and Scrypt only).
+- **serververification** -Triggers upon a server verification.
 - **statechange** - Triggers whenever an internal `state` changes.
 - **verified** - Triggers when the challenge is verified.
 
 ```ts
 enum State {
-  CODE = 'code',
-  ERROR = 'error',
-  VERIFIED = 'verified',
-  VERIFYING = 'verifying',
-  UNVERIFIED = 'unverified',
-  EXPIRED = 'expired',
+	CODE = 'code',
+	ERROR = 'error',
+	VERIFIED = 'verified',
+	VERIFYING = 'verifying',
+	UNVERIFIED = 'unverified',
+	EXPIRED = 'expired'
 }
 ```
 
 Using events:
 
 ```js
-document.querySelector('#altcha').addEventListener('statechange', (ev) => {
-  // See enum State above
-  console.log('state:', ev.detail.state);
+document.querySelector('altcha-widget').addEventListener('statechange', (ev) => {
+	// See enum State above
+	console.log('state:', ev.detail.state);
 });
 ```
 
@@ -403,10 +404,6 @@ document.querySelector('#altcha').addEventListener('statechange', (ev) => {
 
 See [Contributing Guide](https://github.com/altcha-org/altcha/blob/main/CONTRIBUTING.md) and please follow our [Code of Conduct](https://github.com/altcha-org/altcha/blob/main/CODE_OF_CONDUCT.md).
 
-## Sponsorship
-
-This project is sponsored by [BAUSW.com - Digital Construction Site Diary](https://bausw.com/digital-construction-diary/), promoting transparency and trust in construction projects with real-time documentation.
-
 ## License
 
-**MIT**
+MIT

package/dist/external/altcha.css

@@ -0,0 +1 @@
+:root{--altcha-border-color:var(--altcha-color-neutral);--altcha-border-width:1px;--altcha-border-radius:6px;--altcha-color-base:light-dark(oklch(100% 0.00011 271.152),oklch(20.904% 0.00002 271.152));--altcha-color-base-content:light-dark(oklch(20.904% 0.00002 271.152),oklch(100% 0.00011 271.152));--altcha-color-error:oklch(51.284% 0.20527 28.678);--altcha-color-error-content:oklch(100% 0.00011 271.152);--altcha-color-neutral:light-dark(oklch(83.591% 0.0001 271.152),oklch(46.04% 0.00005 271.152));--altcha-color-neutral-content:light-dark(oklch(46.76% 0.00005 271.152),oklch(100% 0.00011 271.152));--altcha-color-primary:oklch(40.279% 0.2449 268.131);--altcha-color-primary-content:oklch(100% 0.00011 271.152);--altcha-color-success:oklch(55.748% 0.18968 142.511);--altcha-color-success-content:oklch(100% 0.00011 271.152);--altcha-checkbox-border-color:var(--altcha-color-neutral);--altcha-checkbox-border-radius:5px;--altcha-checkbox-border-width:var(--altcha-border-width);--altcha-checkbox-outline:2px solid var(--altcha-checkbox-outline-color);--altcha-checkbox-outline-color:light-dark(color-mix(in srgb,var(--altcha-color-primary) 20%,transparent),color-mix(in srgb,var(--altcha-color-primary) 60%,transparent));--altcha-checkbox-outline-offset:2px;--altcha-checkbox-size:22px;--altcha-checkbox-transition-duration:var(--altcha-transition-duration);--altcha-input-background-color:var(--altcha-color-base);--altcha-input-border-radius:3px;--altcha-input-border-width:1px;--altcha-input-color:var(--altcha-color-base-content);--altcha-max-width:320px;--altcha-padding:0.75rem;--altcha-popover-arrow-size:6px;--altcha-popover-color:var(--altcha-border-color);--altcha-shadow:drop-shadow(3px 3px 6px oklch(0% 0 0/0.2));--altcha-spinner-color:var(--altcha-color-base-content);--altcha-switch-background-color:var(--altcha-color-neutral);--altcha-switch-border-radius:calc(infinity*1px);--altcha-switch-height:var(--altcha-checkbox-size);--altcha-switch-padding:0.25rem;--altcha-switch-width:calc(var(--altcha-checkbox-size)*1.75);--altcha-switch-toggle-border-radius:100%;--altcha-switch-toggle-color:var(--altcha-color-neutral-content);--altcha-switch-toggle-size:calc(var(--altcha-switch-height) - var(--altcha-switch-padding)*2);--altcha-transition-duration:0.6s;--altcha-z-index:99999999;--altcha-z-index-popover:999999999}.altcha{all:revert-layer;display:none;font-family:inherit;font-size:inherit;position:relative}.altcha[data-visible]{display:block}.altcha *,.altcha-popover,.altcha-popover *{all:revert-layer;box-sizing:border-box;font-family:inherit;font-size:inherit;line-height:1.25}.altcha a,.altcha-popover a{color:currentColor;text-decoration:none}.altcha a:hover,.altcha-popover a:hover{color:currentColor}.altcha-main{align-items:start;background-color:var(--altcha-color-base);border:var(--altcha-border-width,1px) solid var(--altcha-border-color);border-radius:var(--altcha-border-radius,0);color:var(--altcha-color-base-content);display:flex;flex-direction:column;gap:.5rem;justify-content:space-between;max-width:var(--altcha-max-width,100%);padding:var(--altcha-padding)}.altcha-main>*{display:flex;width:100%}.altcha-main>:first-child{flex-grow:1}.altcha-checkbox-wrap{align-items:center;display:flex;flex-direction:row;flex-grow:1;gap:.5rem}.altcha-checkbox-wrap>*{display:flex}.altcha-logo{opacity:.7}.altcha-footer{align-items:center;display:flex;flex-grow:1;font-size:.7rem;gap:.5rem;justify-content:flex-end;opacity:.7}.altcha-error{font-size:.85rem}.altcha-button{align-items:center;background:var(--altcha-color-primary);border:var(--altcha-input-border-width) solid var(--altcha-color-primary);border-radius:var(--altcha-input-border-radius);color:var(--altcha-color-primary-content);cursor:pointer;display:flex;font-size:.9rem;gap:.5rem;padding:.35rem}.altcha-button:focus{border-color:var(--altcha-color-primary);outline:var(--altcha-checkbox-outline);outline-offset:var(--altcha-checkbox-outline-offset)}.altcha-button>.altcha-spinner,.altcha-button>svg{height:20px;width:20px}.altcha-button-secondary{background:transparent;border-color:var(--altcha-color-neutral);color:var(--altcha-color-neutral-content)}.altcha-input{background:var(--altcha-input-background-color);border:var(--altcha-input-border-width) solid var(--altcha-color-neutral);border-radius:var(--altcha-input-border-radius);color:var(--altcha-input-color);flex-grow:1;font-size:1rem;min-width:0;padding:.25rem;width:auto}.altcha-input:focus{border-color:var(--altcha-color-primary);outline:var(--altcha-checkbox-outline);outline-offset:var(--altcha-checkbox-outline-offset)}.altcha-spinner{animation:altcha-rotate .6s linear infinite;border:var(--altcha-checkbox-border-width) solid var(--altcha-spinner-color);border-bottom-color:transparent;border-radius:100%;border-right-color:transparent;opacity:.5}.altcha-popover{background-color:var(--altcha-color-base);border:var(--altcha-border-width) solid var(--altcha-border-color);border-radius:var(--altcha-border-radius);color:var(--altcha-color-base-content);filter:var(--altcha-shadow);left:calc(var(--altcha-padding)/2);max-width:calc(var(--altcha-max-width) - var(--altcha-padding));position:absolute;top:calc(var(--altcha-padding) + var(--altcha-checkbox-size) + var(--altcha-popover-arrow-size));z-index:var(--altcha-z-index-popover)}.altcha-popover-arrow{border-bottom-color:transparent;border:var(--altcha-popover-arrow-size) solid transparent;border-bottom:var(--altcha-popover-arrow-size) solid var(--altcha-popover-color);content:"";height:0;left:calc(var(--altcha-checkbox-size)/2);position:absolute;top:calc(var(--altcha-popover-arrow-size)*-2);width:0}.altcha-popover-content{max-height:100dvh;overflow:auto;padding:var(--altcha-padding)}.altcha-popover[data-top=true][data-display=standard]{bottom:calc(100% - var(--altcha-padding) + var(--altcha-popover-arrow-size));top:auto}.altcha-popover[data-top=true][data-display=standard] .altcha-popover-arrow{border-bottom-color:transparent;border-top-color:var(--altcha-popover-color);bottom:calc(var(--altcha-popover-arrow-size)*-2);top:auto}.altcha-popover[data-variant=error]{--altcha-popover-color:var(--altcha-color-error);background-color:var(--altcha-color-error);border-color:var(--altcha-color-error);color:var(--altcha-color-error-content)}.altcha-popover[data-variant=error] .altcha-popover-content{padding:calc(var(--altcha-padding)/1.5) var(--altcha-padding)}.altcha-popover[data-display=overlay]{animation:altcha-overlay-slidein .5s forwards;top:45%;transform:translate(-50%,-50%)}.altcha-popover[data-display=bottomsheet],.altcha-popover[data-display=overlay]{left:50%;position:fixed;width:var(--altcha-max-width);z-index:var(--altcha-z-index)}.altcha-popover[data-display=bottomsheet]{animation:altcha-bottomsheet-slideup .5s forwards;border-bottom:0;border-bottom-left-radius:0;border-bottom-right-radius:0;bottom:-100%;top:auto;transform:translate(-50%)}.altcha-popover[data-display=bottomsheet] .altcha-popover-content{padding-bottom:calc(var(--altcha-padding)*2)}.altcha-popover-backdrop{background:var(--altcha-color-base-content);bottom:0;left:0;opacity:.1;position:fixed;right:0;top:0;transition:opacity .5s;z-index:var(--altcha-z-index)}.altcha-popover-close{color:var(--altcha-color-base-content);cursor:pointer;display:inline-block;font-size:1rem;height:1.25rem;line-height:.95;position:absolute;right:0;text-align:center;text-shadow:0 0 1px var(--altcha-color-base);top:-1.5rem;width:1.25rem;z-index:var(--altcha-z-index)}[dir=rtl] .altcha-popover{left:auto;right:calc(var(--altcha-padding)/2)}[dir=rtl] .altcha-popover-arrow{left:auto;right:calc(var(--altcha-checkbox-size)/2)}[dir=rtl] .altcha-popover-close{left:0;right:auto}.altcha-popover[data-display=bottomsheet] .altcha-footer,.altcha-popover[data-display=overlay] .altcha-footer{align-items:center;gap:.5rem;justify-content:center;padding-top:1rem}.altcha-popover[data-display=bottomsheet] .altcha-footer svg,.altcha-popover[data-display=overlay] .altcha-footer svg{height:18px;vertical-align:middle;width:18px}.altcha-code-challenge>form{display:flex;flex-direction:column;gap:.5rem}.altcha-code-challenge-title{font-weight:600}.altcha-code-challenge-text{font-size:.85rem}.altcha-code-challenge-image{background:#fff;border:var(--altcha-input-border-width) solid var(--altcha-color-neutral);border-radius:var(--altcha-input-border-radius);height:50px;object-fit:contain}.altcha-code-challenge-row{display:flex;gap:.5rem}.altcha-code-challenge-buttons{align-items:center;display:flex;flex-direction:column;gap:.5rem;justify-content:space-between;margin-top:var(--altcha-padding)}.altcha-code-challenge-buttons button{justify-content:center;width:100%}.altcha-checkbox{cursor:pointer;position:relative}.altcha-checkbox,.altcha-checkbox input{height:var(--altcha-checkbox-size);width:var(--altcha-checkbox-size)}.altcha-checkbox input{appearance:none;background:var(--altcha-input-background-color);border:var(--altcha-checkbox-border-width,2px) solid var(--altcha-checkbox-border-color);border-radius:var(--altcha-checkbox-border-radius);left:0;margin:0;outline:none;padding:0;position:absolute;top:0}.altcha-checkbox input:before{background:var(--altcha-color-neutral);border-radius:var(--altcha-checkbox-border-radius);content:"";display:block;height:100%;transform:scale(0);width:100%}.altcha-checkbox input:focus{outline:var(--altcha-checkbox-outline);outline-offset:var(--altcha-checkbox-outline-offset)}.altcha-checkbox input:checked{background-color:var(--altcha-color-success);border-color:var(--altcha-color-success)}.altcha-checkbox input:checked:before{background-color:var(--altcha-color-success);opacity:0;transform:scale(2.2);transition:all var(--altcha-checkbox-transition-duration) ease;transition-delay:.1s}.altcha-checkbox svg{--altcha-radio-svg-size:calc(var(--altcha-checkbox-size)*0.5);--altcha-radio-svg-offset:calc(var(--altcha-checkbox-size)*0.25);fill:none;height:var(--altcha-radio-svg-size);left:var(--altcha-radio-svg-offset);opacity:0;position:absolute;stroke:currentColor;stroke-dasharray:16px;stroke-dashoffset:16px;stroke-linecap:round;stroke-linejoin:round;stroke-width:2;top:var(--altcha-radio-svg-offset);transform:translateZ(0);width:var(--altcha-radio-svg-size)}.altcha-checkbox input:checked+svg{color:var(--altcha-color-success-content);opacity:1;stroke-dashoffset:0;transition:all var(--altcha-checkbox-transition-duration) ease;transition-delay:.1s}.altcha-checkbox-spinner{display:none;height:var(--altcha-checkbox-size);left:0;position:absolute;top:0;width:var(--altcha-checkbox-size)}.altcha-checkbox[data-loading=true] input{appearance:none;opacity:0;pointer-events:none}.altcha-checkbox[data-loading=true] .altcha-checkbox-spinner{display:block}.altcha-checkbox-native{position:relative}.altcha-checkbox-native,.altcha-checkbox-native input{height:var(--altcha-checkbox-size);width:var(--altcha-checkbox-size)}.altcha-checkbox-native input{margin:0}.altcha-checkbox-native input:focus{outline:var(--altcha-checkbox-outline);outline-offset:var(--altcha-checkbox-outline-offset)}.altcha-checkbox-native-spinner{display:none;height:var(--altcha-checkbox-size);left:0;position:absolute;top:0;width:var(--altcha-checkbox-size)}.altcha-checkbox-native[data-loading=true] input{appearance:none;opacity:0;pointer-events:none}.altcha-checkbox-native[data-loading=true] .altcha-checkbox-native-spinner{display:block}.altcha-switch{align-items:center;background-color:var(--altcha-switch-background-color);border-radius:var(--altcha-switch-border-radius);cursor:pointer;display:flex;height:var(--altcha-switch-height);padding:var(--altcha-switch-padding);position:relative;width:var(--altcha-switch-width)}.altcha-switch:focus-within{outline:var(--altcha-checkbox-outline);outline-offset:var(--altcha-checkbox-outline-offset)}.altcha-switch input{appearance:none;height:100%;left:0;opacity:0;position:absolute;top:0;width:100%}.altcha-switch-toggle{align-items:center;background-color:var(--altcha-switch-toggle-color);border-radius:var(--altcha-switch-toggle-border-radius);display:flex;justify-content:center;left:var(--altcha-switch-padding);position:absolute;transition:width .15s ease-out,left .15s ease-out}.altcha-switch-spinner,.altcha-switch-toggle{height:var(--altcha-switch-toggle-size);width:var(--altcha-switch-toggle-size)}.altcha-switch-spinner{display:none}.altcha-switch[data-loading=true]{pointer-events:none}.altcha-switch[data-loading=true] .altcha-switch-spinner{display:block}.altcha-switch[data-loading=true] .altcha-switch-toggle{background-color:transparent;left:calc(50% - var(--altcha-switch-toggle-size)/2)}[data-state=verified] .altcha-switch{--altcha-switch-background-color:var(--altcha-color-success)}[data-state=verified] .altcha-switch-toggle{background-color:var(--altcha-color-success-content)}[data-state=verified] .altcha-switch-toggle,[dir=rtl] .altcha-switch-toggle{left:calc(100% - var(--altcha-switch-height) + var(--altcha-switch-padding))}[dir=rtl][data-state=verified] .altcha-switch-toggle{left:var(--altcha-switch-padding)}.altcha-floating-arrow{border:6px solid transparent;border-bottom:6px solid var(--altcha-border-color);content:"";height:0;left:12px;position:absolute;top:-12px;width:0}.altcha-overlay-backdrop{bottom:0;left:0;position:fixed;right:0;top:0;transition:opacity var(--altcha-transition-duration);z-index:var(--altcha-z-index)}.altcha-overlay-close{color:currentColor;cursor:pointer;display:inline-block;font-size:1rem;height:1rem;line-height:.85;position:absolute;right:0;text-align:center;text-shadow:0 0 1px var(--altcha-color-base);top:-1.5rem;width:1rem;z-index:var(--altcha-z-index)}.altcha[data-display=overlay]{animation:altcha-overlay-slidein var(--altcha-transition-duration) forwards;filter:var(--altcha-shadow);left:50%;opacity:0;position:fixed;top:45%;transform:translate(-50%,-50%);z-index:var(--altcha-z-index)}.altcha[data-display=overlay] .altcha-main{width:var(--altcha-max-width)}.altcha[data-display=floating]{display:none;filter:var(--altcha-shadow);left:var(--altcha-floating-left,-100%);position:fixed;top:var(--altcha-floating-top,-100%);z-index:var(--altcha-z-index)}.altcha[data-display=floating] .altcha-main{width:var(--altcha-max-width)}.altcha[data-display=floating][data-placement=top] .altcha-floating-arrow{border-bottom-color:transparent;border-top-color:var(--altcha-border-color);bottom:-12px;top:auto}.altcha[data-display=floating][data-visible]{display:flex}.altcha[data-display=bar]{bottom:-100%;filter:var(--altcha-shadow);left:0;position:fixed;right:0;transition:bottom var(--altcha-transition-duration),top var(--altcha-transition-duration);z-index:var(--altcha-z-index)}.altcha[data-display=bar] .altcha-main{align-items:center;border-radius:0;border-width:var(--altcha-border-width) 0 0 0;flex-direction:row;max-width:100%!important}.altcha[data-display=bar] .altcha-main>*{width:auto}.altcha[data-display=bar][data-placement=top]{bottom:auto;top:-100%}.altcha[data-display=bar][data-placement=top] .altcha-main{border-width:0 0 var(--altcha-border-width) 0}.altcha[data-display=bar][data-placement=bottom]:not([data-state=unverified]){bottom:0}.altcha[data-display=bar][data-placement=top]:not([data-state=unverified]){top:0}.altcha[data-display=invisible]{display:none}@keyframes altcha-rotate{0%{transform:rotate(0deg)}to{transform:rotate(1turn)}}@keyframes altcha-bottomsheet-slideup{to{bottom:0}}@keyframes altcha-overlay-slidein{to{opacity:1;top:50%}}