v1.46.0

Changed

• Breaking for /recaptcha/api/siteverify callers: score on that path now
  follows reCAPTCHA v3, where higher is more human (1 - score), so an app's
  existing score >= threshold check works. FCaptcha's own score is returned
  alongside as fcaptcha_score. Turnstile and hCaptcha paths are unchanged
  (#132).

Fixed

• Two checks that fired for ordinary visitors no longer add to the score: the
  console-attach probe (cdpRuntime.consoleAttached), which fired in every
  real Chrome and Safari session measured, and "Modern macOS UA but SF Pro
  font not detected", which flagged every Firefox on macOS (#130).

Added

• pointer-movement-v1 in experimental.observations: reports whether pointer
  moves ever show zero movement, as real mice and trackpads do. Observe-only;
  it does not affect the score or the token decision (#134).
• Next.js App Router example with server-side verification, by
  @CreedTech (#131).

Subresource Integrity

fcaptcha.js           sha384-G83TqKxOCpDiQGnevlvfio6/7Bb7D6NowhrcMJwvseZBX3LNWg60jtbUuorXjCOJ
dist/fcaptcha.min.js  sha384-BtKyaqS4/1iFCx3oEk+nsKvIlLLujvWpgI2opkt+pUgWvxSf9iVs/RjayvswnCkU