Do not include the external ALTCHA javascript directly in the module

Problem/Motivation

Currently, the external ALTCHA javascript files are committed directly into the module’s repository under /assets/vendor. This approach makes it difficult to:

• Track and manage library updates in a controlled, automated way.
• Comply with Drupal.org’s best practices for third-party libraries
• Keep the repository lightweight and avoid shipping third-party code directly.

Proposed resolution

Move the ALTCHA javascript dependencies to be managed via the composer libraries system, using a composer.json repository entry in the module.

1. Remove the committed ALTCHA javascript files from the module’s /assets/vendor directory.
2. Add the external library to the module’s composer.json, for example:
   

   {
     "require": {
       "altcha/altcha": "^1.0"
     },
     "repositories": [
       {
         "type": "package",
         "package": {
           "name": "altcha/altcha",
           "version": "1.0.0",
           "type": "drupal-library",
           "dist": {
             "url": "https://cdn.jsdelivr.net/npm/altcha@1.0.0/dist/",
             "type": "zip"
           }
         }
       }
     ]
   }

3. Reference the library in the module’s .libraries.yml file using the libraries system path (e.g. /libraries/altcha/altcha.js), rather than from /modules/custom/....
4. Update the README and installation instructions to reflect this change.