Release v0.6.2

What's Changed

• fix: instantiate TurnstileVerifier once per router, not per request (#76) (1eed8ba)
• feat: export SUPPORTED_DIFFICULTIES constant (6ea8728)
• fix: replace deprecated sha256_hash op with fnv1a_cascade in HARD_OPS (#75) (75dcae3)
• feat: add listAgents() to AdaptiveDifficulty for agent monitoring (#73) (98cfb29)
• feat: expose maxRequests as public getter on RateLimiter (#72) (bce29cc)
• chore: bump version to 0.6.2 (#66) (56ca202)
• feat: expose destroy() on createAgentRouter for graceful server cleanup (2693f04)
• test: add LRU eviction coverage for AdaptiveDifficulty.maxAgents (#69) (8f9d45a)
• fix: capture Date.now() once in createToken for consistent timestamp/elapsed (#70) (eff0b43)
• fix: make auto-release PR creation resilient to Actions permission setting (#68) (7d34b94)

---

Auto-released on 2026-05-08

Release v0.6.1

What's Changed

• fix: validate --difficulty and --count CLI flags at runtime (#61) (2b69516)
• build(deps-dev): bump postcss (#65) (29384f1)
• ci: let CI run on auto-generated bump PRs (#64) (149c04b)
• chore: bump version to 0.6.1 (#63) (19c4dd7)
• ci: make Friday auto-release self-healing when tag already exists (#62) (258825f)
• chore: senior tech-lead audit — JWT compliance, sliding-window limiter, Web Component focus fix (#60) (215cd81)
• feat: add coverage thresholds to vitest config (#59) (30b9f9b)
• feat: Cloudflare Turnstile integration (BP-001) (#58) (f2c4448)
• fix: add backoff when server returns valid:false in invisibleVerify (#57) (1fb2fad)
• fix: add parameter guards to byte_xor and hash_chain operations (#55) (7cc22b2)
• fix: demo features section — missing closing tag and duplicate cards (#56) (4db019a)
• fix: add agentProof and agentVerified to MiddlewareRequest interface (#54) (e93a958)
• fix: docs page mobile responsiveness — grid overflow on small screens (#53) (9ef0d4c)
• fix: replace Math.random() with crypto.getRandomValues() in image-challenge (#52) (7f8142f)
• fix: CLI version auto-sync, add missing scripts and docs (#51) (92746e5)
• fix: security audit hardening — IP spoofing, timing attack, release sync (#50) (84c405e)
• fix: security audit April 2026 — hardening & replay guard (#49) (06acba0)
• fix: release pipeline respects branch protection rules (#48) (c2cf8fc)
• style: fix prettier formatting (91fabfe)
• fix: address HIGH and MEDIUM security audit findings (April 2026) (0ab4622)
• ci: add Friday auto-release workflow (d26a0bb)
• fix: update version badges to v0.6.0 (#45) (ecbdf94)

---

Auto-released on 2026-04-24

v0.6.0 — AI challenges, analytics & replay guard

What's New

Features

• AI Image Challenges — new challenge type using AI-generated images with adaptive difficulty (#40)
• Analytics Engine — server-side analytics for tracking verification patterns (#43)
• Replay Guard — prevents challenge token reuse for stronger security (#43)
• Rate Limiter — configurable rate limiting for verification endpoints (#32)
• Discovery Endpoint — .well-known/imrobot.json for agent discovery (#29)
• Router Handler — handler property on createAgentRouter (#33)
• Enhanced Demo — improved demo page with new challenge showcases (#43)

Fixes

• CLI version sync with package.json (#37, #36)
• Accessibility, contrast, and UX improvements (#27)
• Relaxed backoff timer threshold for CI stability (#35)
• Private field bracket access fix in rate limiter (#36)

Testing

• Comprehensive invisibleVerify test coverage (#34)
• Analytics, adaptive, image-challenge, discovery, rate-limiter, CLI tests

Full Changelog: v0.5.0...v0.6.0

v0.5.0 — Natural-language challenge formatting

What's New

Natural-language challenge formatting (anti-scraping)

New formatOperationNL and formatPipelineNL functions that produce randomised natural-language descriptions of pipeline operations. Each of the 23 operation types has 3-4 distinct phrasings selected at random, making regex-based scraping of display text unreliable.

Example

import { formatPipelineNL } from 'imrobot/core'

console.log(formatPipelineNL(challenge.visibleSeed, challenge.pipeline))
// "Begin with the text: "a7f3..."
// "Step 1: Flip the string backwards"
// "Then 2: Shift every letter 7 positions in the alphabet"
// "Next 3: Bitwise-XOR every character with the value 42"

Details

• Zero breaking changes — existing formatOperation / formatPipeline unchanged
• 8 new tests (202 total)
• README, demo page, and docs page updated
• Full npm install: npm install imrobot@0.5.0

Full Changelog: v0.4.0...v0.5.0

v0.4.0

What's Changed

• Add comprehensive test suite and developer tooling by @leopechnicki in #6
• feat: add HMAC-SHA256 server SDK and expand challenge operations by @leopechnicki in #7
• chore: remove stray files and bump version to 0.3.0 by @leopechnicki in #11
• build(deps-dev): bump happy-dom from 14.12.3 to 20.8.3 by @dependabot[bot] in #8
• build(deps): bump esbuild and vite in /demo by @dependabot[bot] in #10
• build(deps-dev): bump svelte from 4.2.20 to 5.53.5 by @dependabot[bot] in #9
• feat: animated cyberpunk hero section with AI-generated visuals by @leopechnicki in #12
• chore: add npm metadata and format:check to CI by @leopechnicki in #13
• docs: add missing CHANGELOG entries by @leopechnicki in #15
• chore: bump version to 0.3.1 by @leopechnicki in #16
• Remove Node.js version 18 from CI workflow by @leopechnicki in #18
• build(deps): bump esbuild from 0.21.5 to 0.27.3 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #14
• chore: patch version bump by @leopechnicki in #19
• feat: v0.4.0 — crypto ops, proof tokens, middleware, invisible verify… by @leopechnicki in #20
• fix(docs): correct HTTP method for challenge endpoint by @leopechnicki in #21
• feat(demo): add quickstart section with agent prompt by @leopechnicki in #22
• Fix quickstart chevron to point right instead of down by @leopechnicki in #23

New Contributors

• @dependabot[bot] made their first contribution in #8

Full Changelog: v0.1.1...v0.4.0

v0.1.1

What's new

• Screenshot protection with blur-by-default and screenshot shield
• Anti-cheat hardening with nonce, countdown timer
• Live demo site at https://imrobot.vercel.app
• Multi-framework support: React, Vue, Svelte, Web Components
• Zero dependencies, ~15KB total

Install

npm install imrobot