# Bundled open-source components

## ALTCHA browser widget 3.2.3

- Project and original source: https://github.com/altcha-org/altcha/tree/v3.2.3
- Published package: https://www.npmjs.com/package/altcha/v/3.2.3
- License: MIT, reproduced in `assets/vendor/altcha/LICENSE.txt`.
- Shipped files are the upstream unminified `dist/external/altcha.umd.cjs`, `dist/i18n/all.umd.cjs`, and `dist/workers/pbkdf2.js`, renamed to `altcha.js`, `i18n.js`, and `pbkdf2.js`. To avoid conflicts with another plugin's ALTCHA version, the widget/translation bundles replace the global name `$altcha` with `$accessibleFormsAltcha` and the exact quoted custom-element name `"altcha-widget"` with `"accessible-forms-altcha"`. No algorithm code is modified; the worker is unchanged.
- Upstream build: check out tag `v3.2.3`, install the locked development dependencies with `npm ci`, and run `npm run build`. This plugin itself does not require a JavaScript build or a runtime package download.

The integration uses a worker served from the WordPress site, disables the optional human-interaction collector, and does not configure cookies, Cloud, Sentinel, or external verification. Proof of work raises the cost of automated submissions; it does not classify message content or eliminate all spam.

## ALTCHA PHP library 2.1.0

- Original source: https://github.com/altcha-org/altcha-lib-php/tree/v2.1.0
- Upstream commit: `63038786ae51b572f8f1de5a29079bea5971dd84`.
- License: MIT, reproduced in `vendor/altcha/LICENSE.txt`.
- This package includes only the classes required to create and verify PBKDF2 challenges, plus the solver used by integration tests. The namespace is changed from `AltchaOrg\Altcha` to `AccessibleForms\Vendor\Altcha` to avoid conflicting with another plugin's library version, and each file gains the standard WordPress direct-access guard (`if ( ! defined( 'ABSPATH' ) ) exit;`). No algorithm code is modified.
- The library requires PHP 8.1 or newer. Accessible Forms declares the same minimum version.

Challenge expiry, binding to the form and site, request limits, bounded payload validation, atomic single-use receipts, and scheduled receipt cleanup are implemented by Accessible Forms around the upstream verification library.
