@contact-api/core 0.0.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Contact API, Mason L'Etoile
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,13 @@
+# Contact API Core
+
+Contact form logic: CORS evaluation, validation, honeypot handling, and email orchestration. Will be paired with one or more providers, (`Resend` or `Nodemailer`), and a platform, (`Vercel`).
+
+## Exports
+- `handleContact(req, deps)` — orchestrates the full contact-form flow
+- `evaluateCors(req, allowedOrigins)` — CORS decision logic
+- `sendEmail(config, body)` — dispatches to a given `EmailProvider`
+- `isValidBody(body)` — input validation
+- Types: `ContactRequest`, `ContactResult`, `EmailProvider`, `EmailPayload`, `EmailBody`
+
+## License
+MIT License - see [LICENSE](./LICENSE) for details.

package/dist/contact.d.mts

@@ -0,0 +1,13 @@
+//#region src/contact.d.ts
+interface ContactRequest {
+  method: string;
+  headers: Record<string, string | undefined>;
+  body: unknown;
+}
+interface ContactResult {
+  status: number;
+  body: unknown;
+}
+//#endregion
+export { ContactRequest, ContactResult };
+//# sourceMappingURL=contact.d.mts.map

package/dist/contact.mjs

@@ -0,0 +1 @@
+export {};

package/dist/cors.d.mts

@@ -0,0 +1,12 @@
+import { ContactRequest } from "./contact.mjs";
+
+//#region src/cors.d.ts
+interface CorsResult {
+  outcome: "preflight" | "forbidden" | "ok";
+  headers: Record<string, string>;
+  status?: number;
+}
+declare function evaluateCors(req: ContactRequest, allowedOrigins: string[]): CorsResult;
+//#endregion
+export { CorsResult, evaluateCors };
+//# sourceMappingURL=cors.d.mts.map

package/dist/cors.mjs

@@ -0,0 +1,32 @@
+//#region src/cors.ts
+function evaluateCors(req, allowedOrigins) {
+	const headers = { "X-Content-Type-Options": "nosniff" };
+	const origin = req.headers["origin"];
+	if (!(!!origin && allowedOrigins.includes(origin))) {
+		if (req.method === "OPTIONS") return {
+			outcome: "preflight",
+			headers,
+			status: 403
+		};
+		return {
+			outcome: "forbidden",
+			headers
+		};
+	}
+	headers["Access-Control-Allow-Origin"] = origin;
+	headers["Access-Control-Allow-Methods"] = "POST, OPTIONS";
+	headers["Access-Control-Allow-Headers"] = "Content-Type";
+	if (req.method === "OPTIONS") return {
+		outcome: "preflight",
+		headers,
+		status: 204
+	};
+	return {
+		outcome: "ok",
+		headers
+	};
+}
+//#endregion
+export { evaluateCors };
+
+//# sourceMappingURL=cors.mjs.map

package/dist/cors.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.mjs","names":[],"sources":["../src/cors.ts"],"sourcesContent":["import type { ContactRequest } from \"./contact.js\";\n\nexport interface CorsResult {\n  outcome: \"preflight\" | \"forbidden\" | \"ok\";\n  headers: Record<string, string>;\n  status?: number;\n}\n\nexport function evaluateCors(req: ContactRequest, allowedOrigins: string[]): CorsResult {\n  const headers: Record<string, string> = { \"X-Content-Type-Options\": \"nosniff\" };\n  const origin = req.headers[\"origin\"];\n  const isAllowed = !!origin && allowedOrigins.includes(origin);\n\n  if (!isAllowed) {\n    if (req.method === \"OPTIONS\") return { outcome: \"preflight\", headers, status: 403 };\n    return { outcome: \"forbidden\", headers };\n  }\n\n  headers[\"Access-Control-Allow-Origin\"] = origin;\n  headers[\"Access-Control-Allow-Methods\"] = \"POST, OPTIONS\";\n  headers[\"Access-Control-Allow-Headers\"] = \"Content-Type\";\n\n  if (req.method === \"OPTIONS\") return { outcome: \"preflight\", headers, status: 204 };\n  return { outcome: \"ok\", headers };\n}\n"],"mappings":";AAQA,SAAgB,aAAa,KAAqB,gBAAsC;CACtF,MAAM,UAAkC,EAAE,0BAA0B,UAAU;CAC9E,MAAM,SAAS,IAAI,QAAQ;CAG3B,IAAI,EAFc,CAAC,CAAC,UAAU,eAAe,SAAS,MAAM,IAE5C;EACd,IAAI,IAAI,WAAW,WAAW,OAAO;GAAE,SAAS;GAAa;GAAS,QAAQ;EAAI;EAClF,OAAO;GAAE,SAAS;GAAa;EAAQ;CACzC;CAEA,QAAQ,iCAAiC;CACzC,QAAQ,kCAAkC;CAC1C,QAAQ,kCAAkC;CAE1C,IAAI,IAAI,WAAW,WAAW,OAAO;EAAE,SAAS;EAAa;EAAS,QAAQ;CAAI;CAClF,OAAO;EAAE,SAAS;EAAM;CAAQ;AAClC"}

package/dist/email.d.mts

@@ -0,0 +1,12 @@
+import { EmailBody, EmailProvider } from "./types.mjs";
+
+//#region src/email.d.ts
+interface EmailConfig {
+  provider: EmailProvider;
+  from: string;
+  to: string[];
+}
+declare function sendEmail(config: EmailConfig, body: EmailBody): Promise<void>;
+//#endregion
+export { EmailConfig, sendEmail };
+//# sourceMappingURL=email.d.mts.map

package/dist/email.mjs

@@ -0,0 +1,18 @@
+//#region src/email.ts
+async function sendEmail(config, body) {
+	const safeSubject = body.subject?.replace(/[\r\n]+/g, " ").trim() ?? "New message";
+	const safeName = body.name?.replace(/[\r\n]+/g, " ").trim();
+	const fromLine = safeName ? `${safeName} <${body.email}>` : body.email;
+	const payload = {
+		from: config.from,
+		to: config.to,
+		replyTo: body.email,
+		subject: `Contact form: ${safeSubject}`,
+		text: `From: ${fromLine}\n\n${body.message.trim()}`
+	};
+	await config.provider.send(payload);
+}
+//#endregion
+export { sendEmail };
+
+//# sourceMappingURL=email.mjs.map

package/dist/email.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"email.mjs","names":[],"sources":["../src/email.ts"],"sourcesContent":["import type { EmailProvider, EmailPayload, EmailBody } from \"./types.js\";\n\nexport interface EmailConfig {\n  provider: EmailProvider;\n  from: string;\n  to: string[];\n}\n\nexport async function sendEmail(\n  config: EmailConfig,\n  body: EmailBody\n): Promise<void> {\n  const safeSubject = body.subject?.replace(/[\\r\\n]+/g, \" \").trim() ?? \"New message\";\n  const safeName = body.name?.replace(/[\\r\\n]+/g, \" \").trim();\n  const fromLine = safeName ? `${safeName} <${body.email}>` : body.email;\n\n  const payload: EmailPayload = {\n    from: config.from,\n    to: config.to,\n    replyTo: body.email,\n    subject: `Contact form: ${safeSubject}`,\n    text: `From: ${fromLine}\\n\\n${body.message.trim()}`\n  }\n\n  await config.provider.send(payload);\n}\n"],"mappings":";AAQA,eAAsB,UACpB,QACA,MACe;CACf,MAAM,cAAc,KAAK,SAAS,QAAQ,YAAY,GAAG,CAAC,CAAC,KAAK,KAAK;CACrE,MAAM,WAAW,KAAK,MAAM,QAAQ,YAAY,GAAG,CAAC,CAAC,KAAK;CAC1D,MAAM,WAAW,WAAW,GAAG,SAAS,IAAI,KAAK,MAAM,KAAK,KAAK;CAEjE,MAAM,UAAwB;EAC5B,MAAM,OAAO;EACb,IAAI,OAAO;EACX,SAAS,KAAK;EACd,SAAS,iBAAiB;EAC1B,MAAM,SAAS,SAAS,MAAM,KAAK,QAAQ,KAAK;CAClD;CAEA,MAAM,OAAO,SAAS,KAAK,OAAO;AACpC"}

package/dist/handler.d.mts

@@ -0,0 +1,11 @@
+import { ContactRequest, ContactResult } from "./contact.mjs";
+import { EmailConfig } from "./email.mjs";
+
+//#region src/handler.d.ts
+interface HandleContactDeps {
+  emailConfig: EmailConfig | null;
+}
+declare function handleContact(req: ContactRequest, deps: HandleContactDeps): Promise<ContactResult>;
+//#endregion
+export { HandleContactDeps, handleContact };
+//# sourceMappingURL=handler.d.mts.map

package/dist/handler.mjs

@@ -0,0 +1,52 @@
+import { sendEmail } from "./email.mjs";
+import { isValidBody } from "./validation.mjs";
+//#region src/handler.ts
+async function handleContact(req, deps) {
+	if (req.method !== "POST") return {
+		status: 405,
+		body: { error: "Method not allowed" }
+	};
+	if (!req.headers["content-type"]?.startsWith("application/json")) return {
+		status: 415,
+		body: { error: "Unsupported Media Type" }
+	};
+	const body = req.body;
+	if (typeof body?.["fax_number"] === "string" ? body["fax_number"].trim() : "") {
+		console.warn("Honeypot triggered");
+		return {
+			status: 200,
+			body: {
+				success: true,
+				message: "Message sent successfully"
+			}
+		};
+	}
+	if (!deps.emailConfig) return {
+		status: 503,
+		body: { error: "Service temporarily unavailable" }
+	};
+	if (!isValidBody(req.body)) return {
+		status: 400,
+		body: { error: "Invalid or missing fields" }
+	};
+	try {
+		await sendEmail(deps.emailConfig, req.body);
+		return {
+			status: 200,
+			body: {
+				success: true,
+				message: "Message sent successfully"
+			}
+		};
+	} catch (error) {
+		console.error("Email error:", error);
+		return {
+			status: 500,
+			body: { error: "Message delivery failed. Please try again later" }
+		};
+	}
+}
+//#endregion
+export { handleContact };
+
+//# sourceMappingURL=handler.mjs.map

package/dist/handler.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.mjs","names":[],"sources":["../src/handler.ts"],"sourcesContent":["import type { ContactRequest, ContactResult } from \"./contact.js\";\nimport type { EmailConfig } from \"./email.js\";\nimport { isValidBody } from \"./validation.js\";\nimport { sendEmail } from \"./email.js\";\n\nexport interface HandleContactDeps {\n  emailConfig: EmailConfig | null;\n}\n\nexport async function handleContact(\n  req: ContactRequest,\n  deps: HandleContactDeps\n): Promise<ContactResult> {\n  if (req.method !== \"POST\") {\n    return { status: 405, body: { error: \"Method not allowed\" } };\n  }\n\n  if (!req.headers[\"content-type\"]?.startsWith(\"application/json\")) {\n    return { status: 415, body: { error: \"Unsupported Media Type\" } };\n  }\n\n  const body = req.body as Record<string, unknown> | undefined;\n  const faxNumber = typeof body?.[\"fax_number\"] === \"string\" ? (body[\"fax_number\"] as string).trim() : \"\";\n  if (faxNumber) {\n    console.warn(\"Honeypot triggered\");\n    return { status: 200, body: { success: true, message: \"Message sent successfully\" } };\n  }\n\n  if (!deps.emailConfig) {\n    return { status: 503, body: { error: \"Service temporarily unavailable\" } };\n  }\n\n  if (!isValidBody(req.body)) {\n    return { status: 400, body: { error: \"Invalid or missing fields\" } };\n  }\n\n  try {\n    await sendEmail(deps.emailConfig, req.body);\n    return { status: 200, body: { success: true, message: \"Message sent successfully\" } };\n  } catch (error) {\n    console.error(\"Email error:\", error);\n    return { status: 500, body: { error: \"Message delivery failed. Please try again later\" } };\n  }\n}\n"],"mappings":";;;AASA,eAAsB,cACpB,KACA,MACwB;CACxB,IAAI,IAAI,WAAW,QACjB,OAAO;EAAE,QAAQ;EAAK,MAAM,EAAE,OAAO,qBAAqB;CAAE;CAG9D,IAAI,CAAC,IAAI,QAAQ,eAAe,EAAE,WAAW,kBAAkB,GAC7D,OAAO;EAAE,QAAQ;EAAK,MAAM,EAAE,OAAO,yBAAyB;CAAE;CAGlE,MAAM,OAAO,IAAI;CAEjB,IADkB,OAAO,OAAO,kBAAkB,WAAY,KAAK,aAAa,CAAY,KAAK,IAAI,IACtF;EACb,QAAQ,KAAK,oBAAoB;EACjC,OAAO;GAAE,QAAQ;GAAK,MAAM;IAAE,SAAS;IAAM,SAAS;GAA4B;EAAE;CACtF;CAEA,IAAI,CAAC,KAAK,aACR,OAAO;EAAE,QAAQ;EAAK,MAAM,EAAE,OAAO,kCAAkC;CAAE;CAG3E,IAAI,CAAC,YAAY,IAAI,IAAI,GACvB,OAAO;EAAE,QAAQ;EAAK,MAAM,EAAE,OAAO,4BAA4B;CAAE;CAGrE,IAAI;EACF,MAAM,UAAU,KAAK,aAAa,IAAI,IAAI;EAC1C,OAAO;GAAE,QAAQ;GAAK,MAAM;IAAE,SAAS;IAAM,SAAS;GAA4B;EAAE;CACtF,SAAS,OAAO;EACd,QAAQ,MAAM,gBAAgB,KAAK;EACnC,OAAO;GAAE,QAAQ;GAAK,MAAM,EAAE,OAAO,kDAAkD;EAAE;CAC3F;AACF"}

package/dist/types.d.mts

@@ -0,0 +1,22 @@
+//#region src/types.d.ts
+interface EmailBody {
+  email: string;
+  message: string;
+  subject?: string;
+  name?: string;
+  fax_number?: string;
+}
+interface EmailPayload {
+  from: string;
+  to: string[];
+  replyTo: string;
+  subject: string;
+  text: string;
+}
+interface EmailProvider {
+  readonly id: string;
+  send(body: EmailPayload): Promise<void>;
+}
+//#endregion
+export { EmailBody, EmailPayload, EmailProvider };
+//# sourceMappingURL=types.d.mts.map

package/dist/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/validation.d.mts

@@ -0,0 +1,8 @@
+import { EmailBody } from "./types.mjs";
+
+//#region src/validation.d.ts
+declare const EMAIL_REGEX: RegExp;
+declare function isValidBody(body: unknown): body is EmailBody;
+//#endregion
+export { EMAIL_REGEX, isValidBody };
+//# sourceMappingURL=validation.d.mts.map

package/dist/validation.mjs

@@ -0,0 +1,11 @@
+//#region src/validation.ts
+const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+function isValidBody(body) {
+	if (body === null || typeof body !== "object") return false;
+	const { email, message, subject, name, fax_number } = body;
+	return typeof email === "string" && EMAIL_REGEX.test(email) && typeof message === "string" && !!message.trim() && message.length <= 2e3 && (subject === void 0 || typeof subject === "string" && subject.length <= 200) && (name === void 0 || typeof name === "string" && name.length <= 100) && (fax_number === void 0 || typeof fax_number === "string");
+}
+//#endregion
+export { EMAIL_REGEX, isValidBody };
+
+//# sourceMappingURL=validation.mjs.map

package/dist/validation.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.mjs","names":["record"],"sources":["../src/validation.ts"],"sourcesContent":["import type { EmailBody } from \"./types.js\";\n\nexport const EMAIL_REGEX = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/;\n\nexport function isValidBody(body: unknown): body is EmailBody {\n  if (body === null || typeof body !== \"object\") return false;\n  const record = body as Record<string, unknown>;\n  const { email, message, subject, name, fax_number } = record;\n  return (\n    typeof email === \"string\"\n && EMAIL_REGEX.test(email)\n && typeof message === \"string\"\n && !!message.trim()\n && message.length <= 2000\n && (subject === undefined || (typeof subject === \"string\" && subject.length <= 200))\n && (name === undefined || (typeof name === \"string\" && name.length <= 100))\n && (fax_number === undefined || typeof fax_number === \"string\")\n  );\n}\n\n"],"mappings":";AAEA,MAAa,cAAc;AAE3B,SAAgB,YAAY,MAAkC;CAC5D,IAAI,SAAS,QAAQ,OAAO,SAAS,UAAU,OAAO;CAEtD,MAAM,EAAE,OAAO,SAAS,SAAS,MAAM,eAAeA;CACtD,OACE,OAAO,UAAU,YACjB,YAAY,KAAK,KAAK,KACtB,OAAO,YAAY,YACnB,CAAC,CAAC,QAAQ,KAAK,KACf,QAAQ,UAAU,QACjB,YAAY,KAAA,KAAc,OAAO,YAAY,YAAY,QAAQ,UAAU,SAC3E,SAAS,KAAA,KAAc,OAAO,SAAS,YAAY,KAAK,UAAU,SAClE,eAAe,KAAA,KAAa,OAAO,eAAe;AAEvD"}

package/package.json

@@ -0,0 +1,57 @@
+{
+  "name": "@contact-api/core",
+  "description": "Contact form logic for the contact-api ecosystem",
+  "author": "Mason L'Etoile",
+  "version": "0.0.1",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/contact-api/core.git"
+  },
+  "homepage": "https://github.com/contact-api/core#readme",
+  "bugs": { "url": "https://github.com/contact-api/core/issues" },
+  "keywords": ["contact-form", "cors", "validation", "honeypot", "typescript", "contact-api"],
+  "type": "module",
+  "scripts": {
+    "typecheck": "tsc --noEmit",
+    "test": "vitest",
+    "test:watch": "vitest --watch",
+    "test:coverage": "vitest --coverage",
+    "build": "tsdown",
+    "prepare": "npm run build"
+  },
+  "files": ["dist"],
+  "exports": {
+    "./types": {
+      "types": "./dist/types.d.mts",
+      "import": "./dist/types.mjs"
+    },
+    "./email": {
+      "types": "./dist/email.d.mts",
+      "import": "./dist/email.mjs"
+    },
+    "./contact": {
+      "types": "./dist/contact.d.mts",
+      "import": "./dist/contact.mjs"
+    },
+    "./cors": {
+      "types": "./dist/cors.d.mts",
+      "import": "./dist/cors.mjs"
+    },
+    "./handler": {
+      "types": "./dist/handler.d.mts",
+      "import": "./dist/handler.mjs"
+    },
+    "./validation": {
+      "types": "./dist/validation.d.mts",
+      "import": "./dist/validation.mjs"
+    }
+  },
+  "devDependencies": {
+    "@types/node": "^25.5.0",
+    "@vitest/coverage-v8": "^4.1.0",
+    "typescript": "^5.9.3",
+    "vitest": "^4.1.0",
+    "tsdown": "^0.22.0"
+  }
+}