@evinvest/kitstart 0.8.0 → 0.10.0

package/dist/core/analytics.d.ts

@@ -14,6 +14,9 @@ export declare const EVENTS: {
     readonly formStart: "lead_form_start";
     readonly fieldError: "lead_form_field_error";
     readonly formStep: "lead_form_step";
+    readonly submitError: "lead_form_submit_error";
+    readonly formReject: "lead_form_reject";
+    readonly estimateShown: "lead_estimate_shown";
 };
 export type IntentChannel = "form_open" | "whatsapp" | "phone" | "sms" | "callback" | "booking";
 /**
@@ -30,7 +33,7 @@ export type LeadStep = "need" | "contact";
  * throws, prod drops) rather than by review. `experiment` and `variant` are
  * the site's assignment, passed in; `field` is a field's role, never its value.
  */
-export declare const ALLOWED_PROPS: readonly ["brand_id", "location_id", "source", "device", "channel", "form_id", "experiment", "variant", "field", "step", "layout"];
+export declare const ALLOWED_PROPS: readonly ["brand_id", "location_id", "source", "device", "channel", "form_id", "experiment", "variant", "field", "step", "layout", "reason", "blocking", "need", "cents_bucket"];
 /** What an experiment's assignment looks like on the wire: short slugs, nothing a person typed. */
 export declare const EXPERIMENT_SLUG: RegExp;
 /** An experiment's assignment as event properties, or nothing when it is not a pair of slugs. */

package/dist/core/analytics.js

@@ -17,6 +17,13 @@ export const EVENTS = {
     formStart: "lead_form_start",
     fieldError: "lead_form_field_error",
     formStep: "lead_form_step",
+    // The script's post that never got an answer (no network, no answer in time).
+    submitError: "lead_form_submit_error",
+    // The server's refusal (`reason`, the `field`): the visitor was sent back.
+    formReject: "lead_form_reject",
+    // An estimate's price, shown for a full set of answers: the need and the
+    // price's band (`centsBucket`), never the price — once per band and need.
+    estimateShown: "lead_estimate_shown",
 };
 /**
  * Every property name an event may carry. A customer's phone or address comes
@@ -37,6 +44,13 @@ export const ALLOWED_PROPS = [
     "field",
     "step",
     "layout",
+    "reason",
+    // A field error that blocked the submit (`true`), or a hint (`false`).
+    "blocking",
+    // The brand's subject slug.
+    "need",
+    // A price's band, `"5000-7500"` (`centsBucket`) — never the price.
+    "cents_bucket",
 ];
 /** What an experiment's assignment looks like on the wire: short slugs, nothing a person typed. */
 export const EXPERIMENT_SLUG = /^[a-z0-9_-]{1,32}$/;

package/dist/core/lead-capture-format.d.ts

@@ -4,3 +4,9 @@ import type { Opening } from "./place/hours.js";
 export declare function fillText(template: string, values: Readonly<Record<string, string>>): string;
 /** The promise of the next opening, from real hours — or `null`, never an invented one. */
 export declare function openingText(opening: Opening | null, text: Pick<LeadCaptureText, "openingToday" | "openingTomorrow" | "openingLater">, locale: string): string | null;
+/**
+ * Cents as the page's language writes euros: `84 €`, `84,50 €`, `€84.50`.
+ * Whole euros drop the cents a rounded price never has; a signed line of a
+ * breakdown is `+8,50 €` / `−9,35 €`.
+ */
+export declare function formatCents(cents: number, locale: string, signed?: boolean): string;

package/dist/core/lead-capture-format.js

@@ -30,3 +30,16 @@ export function openingText(opening, text, locale) {
         return fillText(text.openingTomorrow, { time });
     return fillText(text.openingLater, { time, day: weekdayText(opening.day, locale) });
 }
+/**
+ * Cents as the page's language writes euros: `84 €`, `84,50 €`, `€84.50`.
+ * Whole euros drop the cents a rounded price never has; a signed line of a
+ * breakdown is `+8,50 €` / `−9,35 €`.
+ */
+export function formatCents(cents, locale, signed = false) {
+    const digits = cents % 100 === 0 ? 0 : 2;
+    const format = new Intl.NumberFormat(locale, { style: "currency", currency: "EUR", minimumFractionDigits: digits, maximumFractionDigits: digits });
+    const text = format.format(Math.abs(cents) / 100);
+    if (!signed)
+        return cents < 0 ? `−${text}` : text;
+    return `${cents < 0 ? "−" : "+"}${text}`;
+}

package/dist/core/lead-capture-text.d.ts

@@ -7,8 +7,12 @@
  * The kit ships French and English (`LEAD_CAPTURE_TEXT`) so every brand asks
  * in the same words and an experiment's arms differ only in what it tests; a
  * brand overrides a key by spreading: `{ ...LEAD_CAPTURE_TEXT.fr, submit: "…" }`.
+ *
+ * The flows' words (`LeadCaptureFlowText`) are optional here so a brand's own
+ * text object written before them still type-checks; a key left out falls
+ * back to the kit's, in the page's language (`flowTextOf`).
  */
-export interface LeadCaptureText {
+export interface LeadCaptureText extends Partial<LeadCaptureFlowText> {
     title: string;
     lede: string;
     needLabel: string;
@@ -18,8 +22,31 @@ export interface LeadCaptureText {
     /** Names the row of communes a tap fills the locality from. */
     servedLabel: string;
     phoneLabel: string;
-    /** The soft check under a number that does not read as one; it never blocks. */
+    /**
+     * Under a number that does not read as one, once the visitor leaves the
+     * field — a hint while typing; the submit is blocked by `phoneInvalid`.
+     */
     phoneHint: string;
+    /** Blocks the submit: a number the server would refuse. */
+    phoneInvalid: string;
+    /** Blocks the submit: a required field left empty — the browser's own words are its UI language, not the page's. */
+    required: string;
+    /** Blocks the submit: no need picked. */
+    needRequired: string;
+    /** Blocks the callback: the consent box unticked. */
+    consentRequired: string;
+    /** The server refused a field the form cannot word better (a brand's own). */
+    fieldInvalid: string;
+    /** The server refused the request without naming a field. */
+    formInvalid: string;
+    /** On the submit while the script posts the form. */
+    sending: string;
+    /** The post never reached the server: nothing was sent, the form is as typed. */
+    networkError: string;
+    /** No answer in time: it may have arrived — a retry cannot make a second lead. */
+    timeoutError: string;
+    /** Beside the two above: sends the same lead again. */
+    retry: string;
     nameLabel: string;
     /**
      * Shown in the empty field. None by default: a placeholder is not a label —
@@ -55,4 +82,31 @@ export interface LeadCaptureText {
     /** The honeypot's label — read only by a bot filling every field. */
     honeypotLabel: string;
 }
+/** What the `estimate` and `fixed` flows, the photos ask and the booking print. */
+export interface LeadCaptureFlowText {
+    /** Heads the live price. */
+    priceTitle: string;
+    /** In place of the price until every input is answered. */
+    pricePending: string;
+    /** Under the price: what it includes and when it is paid. */
+    priceNote: string;
+    /** The breakdown's first line: the need's base. */
+    priceBase: string;
+    priceRounding: string;
+    priceMinimum: string;
+    /** The submit of a priced need. */
+    bookSubmit: string;
+    /** The in-card success of a priced lead; `{price}` the server's. */
+    sentPrice: string;
+    /** After a priced lead: the slot is set by a call (no booking provider yet). */
+    slotCallback: string;
+    /** A `quote` need that is priced from photos: the ask, and its WhatsApp link. */
+    photosTitle: string;
+    photosLede: string;
+    photosCta: string;
+    /** The WhatsApp message, `{need}` the need's label. */
+    photosMessage: string;
+}
 export declare const LEAD_CAPTURE_TEXT: Readonly<Record<"fr" | "en", LeadCaptureText>>;
+/** The flows' words for a page: the brand's, else the kit's in its language (English for `en*`, French otherwise). */
+export declare function flowTextOf(text: LeadCaptureText, locale: string): LeadCaptureFlowText;

package/dist/core/lead-capture-text.js

@@ -1,4 +1,35 @@
+const FR_FLOW = {
+    priceTitle: "Votre prix",
+    pricePending: "Répondez aux questions pour voir le prix.",
+    priceNote: "Prix TTC pour ces réponses, payé après la prestation.",
+    priceBase: "Prix de base",
+    priceRounding: "Arrondi",
+    priceMinimum: "Minimum de prestation",
+    bookSubmit: "Réserver",
+    sentPrice: "Demande enregistrée au prix de {price}.",
+    slotCallback: "Nous vous rappelons pour fixer le créneau.",
+    photosTitle: "Envoyez des photos",
+    photosLede: "Pour ce besoin, quelques photos nous permettent de vous donner un prix juste.",
+    photosCta: "Envoyer des photos sur WhatsApp",
+    photosMessage: "Bonjour, voici des photos pour : {need}.",
+};
+const EN_FLOW = {
+    priceTitle: "Your price",
+    pricePending: "Answer the questions to see the price.",
+    priceNote: "Price incl. VAT for these answers, paid after the job.",
+    priceBase: "Base price",
+    priceRounding: "Rounding",
+    priceMinimum: "Minimum charge",
+    bookSubmit: "Book",
+    sentPrice: "Request saved at {price}.",
+    slotCallback: "We will call you to set the slot.",
+    photosTitle: "Send photos",
+    photosLede: "For this job, a few photos let us give you a fair price.",
+    photosCta: "Send photos on WhatsApp",
+    photosMessage: "Hello, here are photos for: {need}.",
+};
 const FR = {
+    ...FR_FLOW,
     title: "Recevoir un prix",
     lede: "Réponse rapide, sans engagement.",
     needLabel: "Votre besoin",
@@ -7,6 +38,16 @@ const FR = {
     servedLabel: "Communes desservies",
     phoneLabel: "Téléphone",
     phoneHint: "Vérifiez le numéro : 06 12 34 56 78 ou +33 6 12 34 56 78.",
+    phoneInvalid: "Ce numéro n’est pas valide. Exemple : 06 12 34 56 78 ou +33 6 12 34 56 78.",
+    required: "Ce champ est obligatoire.",
+    needRequired: "Choisissez votre besoin.",
+    consentRequired: "Cochez la case pour que nous puissions vous rappeler.",
+    fieldInvalid: "Vérifiez ce champ.",
+    formInvalid: "Votre demande n’a pas pu être envoyée. Vérifiez le formulaire.",
+    sending: "Envoi…",
+    networkError: "Pas de connexion : votre demande n’est pas partie. Vérifiez le réseau et réessayez.",
+    timeoutError: "Le serveur ne répond pas. Réessayez : votre demande ne sera pas envoyée deux fois.",
+    retry: "Réessayer",
     nameLabel: "Nom",
     optional: "facultatif",
     submit: "Recevoir le prix",
@@ -27,6 +68,7 @@ const FR = {
     honeypotLabel: "Site web",
 };
 const EN = {
+    ...EN_FLOW,
     title: "Get a price",
     lede: "A quick answer, no commitment.",
     needLabel: "What you need",
@@ -35,6 +77,16 @@ const EN = {
     servedLabel: "Towns we serve",
     phoneLabel: "Phone",
     phoneHint: "Check the number: 06 12 34 56 78 or +33 6 12 34 56 78.",
+    phoneInvalid: "This number is not valid. For example: 06 12 34 56 78 or +33 6 12 34 56 78.",
+    required: "This field is required.",
+    needRequired: "Choose what you need.",
+    consentRequired: "Tick the box so we can call you back.",
+    fieldInvalid: "Check this field.",
+    formInvalid: "Your request could not be sent. Check the form.",
+    sending: "Sending…",
+    networkError: "No connection: your request was not sent. Check the network and try again.",
+    timeoutError: "The server is not answering. Try again: your request will not be sent twice.",
+    retry: "Try again",
     nameLabel: "Name",
     optional: "optional",
     submit: "Get the price",
@@ -55,3 +107,14 @@ const EN = {
     honeypotLabel: "Website",
 };
 export const LEAD_CAPTURE_TEXT = { fr: FR, en: EN };
+/** The flows' words for a page: the brand's, else the kit's in its language (English for `en*`, French otherwise). */
+export function flowTextOf(text, locale) {
+    const kit = locale.startsWith("en") ? EN_FLOW : FR_FLOW;
+    const out = { ...kit };
+    for (const key of Object.keys(kit)) {
+        const own = text[key];
+        if (own !== undefined)
+            out[key] = own;
+    }
+    return out;
+}

package/dist/core/lead.d.ts

@@ -9,6 +9,8 @@
  * `LeadSchema.wire` names the posted fields (a page cached before a rename
  * still delivers) — both deliberate departures from the first design.
  */
+import type { LeadFlow, LeadFlows } from "./pricing/flow.js";
+import type { PricingInputs } from "./pricing/model.js";
 /** Why a submission was kept but not acted on. `null` is a clean lead. */
 export type SpamVerdict = "honeypot" | "too-fast" | "rate-limited";
 /**
@@ -18,7 +20,24 @@ export type SpamVerdict = "honeypot" | "too-fast" | "rate-limited";
 export interface LeadExtra {
     name: string;
     max: number;
+    /**
+     * A free-text note keeps its line breaks. Off by default: every other field
+     * is one line, and a line break posted into one forges a line of the mail.
+     */
+    multiline?: boolean;
+}
+/**
+ * Why a candidate is refused, and the field it is about — `phone`, `locality`,
+ * `need`, `name`, `consent`, an extra's name, or `form` when the rule cannot
+ * say. The field goes back to the form, which shows the error there; `why` is
+ * for the log only, never rendered.
+ */
+export interface LeadRejection {
+    field: string;
+    why: string;
 }
+/** What a rule may answer: a rejection, a bare reason (read as `form`), or `null` to accept. */
+export type LeadVerdict = LeadRejection | string | null;
 /**
  * The form field each core value is posted under. Brand config, not a
  * constant: a page cached before a rename still posts the old names, and a
@@ -35,16 +54,20 @@ export interface LeadSchema<S extends string> {
     wire: LeadWire;
     extras?: readonly LeadExtra[];
     /**
-     * The one rule worth enforcing, as a reason for the log (never rendered), or
-     * `null` to accept. Absent → every candidate is a lead.
+     * The rule a form lead must pass, or `null` to accept. Absent →
+     * `validateLead`: the number the form itself blocks on. A brand adding its
+     * own rule composes it — `lead => validateLead(lead) ?? mine(lead)` — and
+     * the landing contract holds it to the form's phone rule, so the server
+     * never refuses a number the form let through. A bare string is a reason
+     * about the whole form (`field: "form"`).
      */
-    validate?: (lead: LeadCandidate) => string | null;
+    validate?: (lead: LeadCandidate) => LeadVerdict;
     /**
      * The rule for a callback request, which carries a phone and little else —
      * a form's rule would refuse it for the locality it never asked. Absent →
-     * `validateCallbackLead`: a number we can read.
+     * `validateCallbackLead`: a number we can call.
      */
-    validateCallback?: (lead: LeadCandidate) => string | null;
+    validateCallback?: (lead: LeadCandidate) => LeadVerdict;
     /**
      * How the mobile is kept: `typed` (default), exactly as posted, or `e164`,
      * `+33612345678` when it reads as a number and as typed when it does not.
@@ -52,6 +75,13 @@ export interface LeadSchema<S extends string> {
      * number as typed.
      */
     mobileFormat?: "typed" | "e164";
+    /**
+     * How each need is sold (`quote` | `estimate` | `fixed`); a need left out
+     * is a `quote`. The form and the server read the same map, and a need runs
+     * its flow only when the price list prices it that way (`flowOf`) — so a
+     * flow the brand has not switched on is never run by a posted field.
+     */
+    flows?: LeadFlows;
 }
 /**
  * How the lead was asked for: the quote form, or "call me back" — the form cut
@@ -74,8 +104,23 @@ export interface LeadConsent {
     text: string;
     at: string;
 }
-/** The default callback rule: a phone number that reads as one. */
-export declare function validateCallbackLead(lead: Pick<LeadCandidate, "mobile">): string | null;
+/** The script's id for one submission, minted once and kept across its resends. */
+export declare const SUBMISSION_FIELD = "submission_id";
+export declare const SUBMISSION_ID: RegExp;
+/** The query a refused submission is sent back to the form with: `?lead_error=<field>`. */
+export declare const LEAD_ERROR_PARAM = "lead_error";
+/**
+ * The card's id, posted so a refusal lands back on it (`#devis`, not a
+ * hard-coded `#quote`). Only a slug is ever echoed into the redirect.
+ */
+export declare const CARD_FIELD = "card";
+export declare const CARD_ID: RegExp;
+/** A rule's answer as a rejection: a bare reason, or a field that is not a slug, is about the `form`. */
+export declare function rejectionOf(verdict: LeadVerdict): LeadRejection | null;
+/** The default form rule: a number we can call — the one the form blocks on (`phoneProblem`). */
+export declare function validateLead(lead: Pick<LeadCandidate, "mobile">): LeadRejection | null;
+/** The default callback rule: the same number rule, worded for the log. */
+export declare function validateCallbackLead(lead: Pick<LeadCandidate, "mobile">): LeadRejection | null;
 /**
  * A submitted lead. Values are trimmed and capped but not otherwise parsed: a
  * lead that cannot be fully validated is still a lead, and rejecting it loses
@@ -97,14 +142,47 @@ export interface Lead {
     channel?: LeadChannel;
     /** Only on a callback lead: the consent it was posted with. */
     consent?: LeadConsent;
+    /**
+     * The script's id for this submission (`SUBMISSION_FIELD`): a resend after
+     * a lost answer carries the same one, and the store keeps one row per id.
+     * Absent on a plain post, which has no script to mint one.
+     */
+    submissionId?: string;
+    /**
+     * How the need was sold, when the brand sells by flow (`LeadSchema.flows`)
+     * and the lead came through the form; absent otherwise — a callback, or a
+     * lead from before the field existed.
+     */
+    flow?: LeadFlow;
+    /** Only on an `estimate` or `fixed` lead: the price the server computed. */
+    price?: LeadPrice;
+}
+/**
+ * The price a lead was taken at — the server's own number, from the posted
+ * answers, never a posted amount — and the model it came from.
+ */
+export interface LeadPrice {
+    cents: number;
+    /** The model's `validFrom`, `YYYY-MM-DD`. */
+    validFrom: string;
+    /** An estimate's answers, input id → option id; absent for a fixed price. */
+    inputs?: PricingInputs;
 }
+/** What the panel may be told of a suspected lead. */
+export type LeadSuspect = "rate_limited" | "too_fast";
+/**
+ * Why a lead the panel receives is suspect, for its `suspect` property, or
+ * nothing for a clean one. Never `honeypot`: a lead that filled the trap is a
+ * bot's, kept in the table and sent nowhere.
+ */
+export declare function suspectOf(lead: Pick<Lead, "spamVerdict">): LeadSuspect | undefined;
 /** The lead's channel, `form` for one that predates the field. */
 export declare function channelOf(lead: Pick<Lead, "channel">): LeadChannel;
 /**
  * What the form posted, before the funnel judges it: the consent is the
  * posted sentence, and the funnel stamps when it accepted it.
  */
-export type LeadCandidate = Omit<Lead, "spamVerdict" | "consent"> & {
+export type LeadCandidate = Omit<Lead, "spamVerdict" | "consent" | "flow" | "price"> & {
     consentText?: string;
 };
 /**
@@ -118,7 +196,16 @@ export type LeadCandidate = Omit<Lead, "spamVerdict" | "consent"> & {
  * (`@evinvest/kitstart/testing`) before `LEADS_DB_URL` may select it.
  */
 export interface LeadStore {
+    /** Rejects a second lead with a `submissionId` the store already holds (a unique index). */
     insert(lead: Lead): Promise<number>;
+    /**
+     * The row a submission id was stored under, read back as a lead, or `null`.
+     * Absent on an adapter that does not dedupe: every post is then a lead.
+     */
+    findSubmission?(submissionId: string): Promise<{
+        id: number;
+        lead: Lead;
+    } | null>;
     count(): Promise<number>;
     /** The schema version the storage stands at after opening. */
     schemaVersion(): Promise<number>;
@@ -129,9 +216,11 @@ export interface LeadStore {
 /**
  * The lead schema's version, shared by every adapter: 1 the Rust server's
  * table (`job`, `zip`, `mobile`, `at`), 2 + the place, 3 + the spam verdict,
- * 4 + the brand's extras, 5 + the channel and the callback's consent. Append only.
+ * 4 + the brand's extras, 5 + the channel and the callback's consent, 6 + the
+ * script's submission id, unique, 7 + the flow and the price it was taken at.
+ * Append only.
  */
-export declare const LEAD_SCHEMA_VERSION = 5;
+export declare const LEAD_SCHEMA_VERSION = 7;
 /** A field is capped, not rejected: a long answer is still a customer. */
 export declare const MAX_FIELD = 200;
 /**
@@ -140,4 +229,5 @@ export declare const MAX_FIELD = 200;
  * sees it.
  */
 export declare function readCandidate(schema: LeadSchema<string>, form: FormData, placeSlug: string | null): LeadCandidate;
-export declare function validateCandidate(schema: LeadSchema<string>, lead: LeadCandidate): string | null;
+/** The rule the candidate's channel answers to: the field a refusal is about, or `null`. */
+export declare function validateCandidate(schema: LeadSchema<string>, lead: LeadCandidate): LeadRejection | null;

package/dist/core/lead.js

@@ -9,7 +9,7 @@
  * `LeadSchema.wire` names the posted fields (a page cached before a rename
  * still delivers) — both deliberate departures from the first design.
  */
-import { isPlausiblePhone, normalizePhone } from "./phone.js";
+import { normalizePhone, phoneProblem } from "./phone.js";
 export const LEAD_CHANNELS = ["form", "callback"];
 export const CHANNEL_FIELD = "channel";
 /**
@@ -20,9 +20,47 @@ export const CHANNEL_FIELD = "channel";
 export const CONSENT_FIELD = "consent";
 /** Longer than any consent sentence; past it, the text is cut, not refused. */
 export const MAX_CONSENT = 500;
-/** The default callback rule: a phone number that reads as one. */
+/** The script's id for one submission, minted once and kept across its resends. */
+export const SUBMISSION_FIELD = "submission_id";
+export const SUBMISSION_ID = /^[A-Za-z0-9-]{16,64}$/;
+/** The query a refused submission is sent back to the form with: `?lead_error=<field>`. */
+export const LEAD_ERROR_PARAM = "lead_error";
+/**
+ * The card's id, posted so a refusal lands back on it (`#devis`, not a
+ * hard-coded `#quote`). Only a slug is ever echoed into the redirect.
+ */
+export const CARD_FIELD = "card";
+export const CARD_ID = /^[a-z0-9-]{1,64}$/;
+/** A field as a refusal names it: a short slug, or the whole `form`. */
+const FIELD_SLUG = /^[a-z][a-z0-9_]{0,31}$/;
+/** A rule's answer as a rejection: a bare reason, or a field that is not a slug, is about the `form`. */
+export function rejectionOf(verdict) {
+    if (verdict === null)
+        return null;
+    if (typeof verdict === "string")
+        return { field: "form", why: verdict };
+    return FIELD_SLUG.test(verdict.field) ? verdict : { field: "form", why: verdict.why };
+}
+/** The default form rule: a number we can call — the one the form blocks on (`phoneProblem`). */
+export function validateLead(lead) {
+    const problem = phoneProblem(lead.mobile);
+    return problem === null ? null : { field: "phone", why: problem === "required" ? "a phone number" : "a phone number we can call" };
+}
+/** The default callback rule: the same number rule, worded for the log. */
 export function validateCallbackLead(lead) {
-    return isPlausiblePhone(lead.mobile) ? null : "a phone number to call back";
+    return phoneProblem(lead.mobile) === null ? null : { field: "phone", why: "a phone number to call back" };
+}
+/**
+ * Why a lead the panel receives is suspect, for its `suspect` property, or
+ * nothing for a clean one. Never `honeypot`: a lead that filled the trap is a
+ * bot's, kept in the table and sent nowhere.
+ */
+export function suspectOf(lead) {
+    if (lead.spamVerdict === "rate-limited")
+        return "rate_limited";
+    if (lead.spamVerdict === "too-fast")
+        return "too_fast";
+    return undefined;
 }
 /** The lead's channel, `form` for one that predates the field. */
 export function channelOf(lead) {
@@ -31,14 +69,28 @@ export function channelOf(lead) {
 /**
  * The lead schema's version, shared by every adapter: 1 the Rust server's
  * table (`job`, `zip`, `mobile`, `at`), 2 + the place, 3 + the spam verdict,
- * 4 + the brand's extras, 5 + the channel and the callback's consent. Append only.
+ * 4 + the brand's extras, 5 + the channel and the callback's consent, 6 + the
+ * script's submission id, unique, 7 + the flow and the price it was taken at.
+ * Append only.
  */
-export const LEAD_SCHEMA_VERSION = 5;
+export const LEAD_SCHEMA_VERSION = 7;
 /** A field is capped, not rejected: a long answer is still a customer. */
 export const MAX_FIELD = 200;
-function field(form, name, max) {
+// C0 and C1 controls, DEL, and the Unicode line and paragraph separators.
+const CONTROL = /[\u0000-\u001f\u007f-\u009f\u2028\u2029]+/g;
+// The same less the line feed: what a multi-line note keeps.
+const CONTROL_BUT_NEWLINE = /[\u0000-\u0009\u000b-\u001f\u007f-\u009f\u2028\u2029]+/g;
+/**
+ * A posted value, trimmed and capped. One line unless `multiline`: a line
+ * break or a control character posted into a one-line field (`63130\nMobile
+ * : 07…`) would forge a line of the mail, so each run becomes one space.
+ */
+function field(form, name, max, multiline = false) {
     const value = form.get(name);
-    return typeof value === "string" ? value.trim().slice(0, max) : null;
+    if (typeof value !== "string")
+        return null;
+    const clean = multiline ? value.replace(/\r\n?/g, "\n").replace(CONTROL_BUT_NEWLINE, "") : value.replace(CONTROL, " ").replace(/ {2,}/g, " ");
+    return clean.trim().slice(0, max);
 }
 /**
  * The candidate a form posted, read through the schema's field names. Under
@@ -48,13 +100,14 @@ function field(form, name, max) {
 export function readCandidate(schema, form, placeSlug) {
     const extras = {};
     for (const extra of schema.extras ?? []) {
-        const value = field(form, extra.name, extra.max);
+        const value = field(form, extra.name, extra.max, extra.multiline);
         if (value)
             extras[extra.name] = value;
     }
     const mobile = field(form, schema.wire.mobile, MAX_FIELD) ?? "";
     const callback = form.get(CHANNEL_FIELD) === "callback";
     const consent = callback ? field(form, CONSENT_FIELD, MAX_CONSENT) : null;
+    const submission = field(form, SUBMISSION_FIELD, 64);
     return {
         subject: field(form, schema.wire.subject, MAX_FIELD) ?? "",
         locality: field(form, schema.wire.locality, MAX_FIELD) ?? "",
@@ -63,14 +116,16 @@ export function readCandidate(schema, form, placeSlug) {
         placeSlug,
         channel: callback ? "callback" : "form",
         ...(consent ? { consentText: consent } : {}),
+        ...(submission && SUBMISSION_ID.test(submission) ? { submissionId: submission } : {}),
     };
 }
+/** The rule the candidate's channel answers to: the field a refusal is about, or `null`. */
 export function validateCandidate(schema, lead) {
     if (channelOf(lead) === "callback") {
         // Not the brand's to waive: calling someone back needs their word for it.
         if (!lead.consentText)
-            return "consent to be called back";
-        return (schema.validateCallback ?? validateCallbackLead)(lead);
+            return { field: "consent", why: "consent to be called back" };
+        return rejectionOf((schema.validateCallback ?? validateCallbackLead)(lead));
     }
-    return schema.validate?.(lead) ?? null;
+    return rejectionOf((schema.validate ?? validateLead)(lead));
 }

package/dist/core/phone.d.ts

@@ -1,17 +1,28 @@
 /**
- * A phone number as the funnel keeps it: E.164 when the typed value is one we
- * can read, otherwise exactly as typed. Soft by design — a number we cannot
- * parse is still a way to reach someone, and refusing it loses the customer.
+ * A phone number as the funnel reads it: E.164 when the typed value is a
+ * number someone can be reached on, otherwise `null`.
  *
- * Only the French national plan is read (every brand of the vertical is in
- * France): `06 12 34 56 78`, `+33 (0)6 …`, `0033 6 …` and a mobile typed
- * without its trunk zero (`6 12 34 56 78`) all become `+33612345678`. Any
- * other international number is compacted (`+44 7911 123456` →
- * `+447911123456`); anything else is `null`.
+ * Only the French national plan is read closely (every brand of the vertical
+ * is in France): ten digits from `0[1-9]` — `06 12 34 56 78`, `+33 (0)6 …`,
+ * `0033 6 …`, a mobile typed without its trunk zero (`6 12 34 56 78`) — all
+ * become `+33612345678`. Any other international number is a plausible E.164,
+ * 8 to 15 digits after the `+`, compacted (`+44 7911 123456` →
+ * `+447911123456`). Full-width digits read as digits; a run of one digit
+ * (`00 00 00 00 00`, `06 66 66 66 66`) is a refusal to give a number, not one.
  */
 export declare function normalizePhone(raw: string): string | null;
-/** Whether a typed number reads as one — the form's soft check, never a block. */
+/**
+ * Whether a typed number is one we can call back — the one rule the form,
+ * the callback and the server share (`phoneProblem`, `validateLead`).
+ */
 export declare function isPlausiblePhone(raw: string): boolean;
+/**
+ * What is wrong with a typed number, or `null`: `required` when nothing was
+ * typed, `invalid` when it is not a number we can call. The form blocks on it
+ * in the page's words and the server refuses on it — one rule, so a number
+ * the form lets through is never refused behind the visitor's back.
+ */
+export declare function phoneProblem(raw: string): "required" | "invalid" | null;
 /**
  * A French mobile (`+33 6…`, `+33 7…`) — the one kind an SMS reaches. A
  * landline answers a text with silence, so the channel is not offered for it.