altcha-lib 2.3.0

v2.3.0

on Node.js NPM

Added

• verifyServer() — verify a payload remotely via ALTCHA Sentinel's POST /v1/verify/signature API instead of checking the HMAC signature locally. Supports timeouts, retries (fixed/exponential backoff), custom fetch, and abort via AbortController.
• All framework plugins (Express, Fastify, NestJS, Next.js, Nuxt/H3, SvelteKit, Hono) now accept a verifyServer option. When set, Sentinel-issued payloads are verified remotely through the existing verifyHandler/middleware — no custom routing needed.

Changed

• hmacSignatureSecret, deriveKey, and createChallengeParameters are now optional on framework plugin options. A pure Sentinel-remote setup can be as small as create({ verifyServer: { url, secret } }) — no secret/deriveKey required. Calling challengeHandler without deriveKey/createChallengeParameters now fails with a clear configuration error instead of a confusing runtime failure.