SetCaptchaServer was .so-era injection — nothing wasm-side ever called it, so the verifier was permanently nil and captcha-enabled booking blocks failed closed on every submission. A guest can't hold the host's stateful captcha server; the host now verifies+consumes the cap-token before dispatch and stamps the unforgeable X-Bn-Verified-Captcha trusted header (pluginsdk v0.2.2 auth.CaptchaVerified). Fail-closed semantics preserved: no stamp = reject. Deletes the last block/core import (captcha) and the test-side PoW solver; go.mod no longer requires core. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Description
Cal.com Booking — embeddable booking calendar block for BlockNinja CMS with captcha, rate limiting, and webhook receiver (standalone wasm plugin)
Languages
Go
80.3%
templ
10.5%
TypeScript
9%
AMPL
0.1%