@flamingo-stack/openframe-frontend-core 0.0.227 → 0.0.228

package/dist/utils/humanity-signals.js

@@ -0,0 +1,23 @@
+// src/utils/humanity-signals.ts
+var HONEYPOT_FIELD = "contact_url_confirm";
+var ELAPSED_MS_FIELD = "form_elapsed_ms";
+var DEFAULT_MIN_FILL_MS = 700;
+function extractHumanitySignals(body) {
+  const b = body ?? {};
+  const rawHp = b[HONEYPOT_FIELD];
+  const honeypot = rawHp == null ? "" : String(rawHp);
+  const rawMs = b[ELAPSED_MS_FIELD];
+  const elapsedMs = typeof rawMs === "number" && Number.isFinite(rawMs) ? rawMs : null;
+  return { honeypot, elapsedMs };
+}
+function evaluateHumanitySignals(body, opts) {
+  const { honeypot, elapsedMs } = extractHumanitySignals(body);
+  if (honeypot.trim() !== "") return { ok: false, reason: "honeypot" };
+  if (elapsedMs !== null && elapsedMs < opts.minFillMs) return { ok: false, reason: "too_fast" };
+  return { ok: true };
+}
+var splitCsvEnv = (s) => s?.split(",").map((t) => t.trim()).filter(Boolean) ?? [];
+
+export { DEFAULT_MIN_FILL_MS, ELAPSED_MS_FIELD, HONEYPOT_FIELD, evaluateHumanitySignals, extractHumanitySignals, splitCsvEnv };
+//# sourceMappingURL=humanity-signals.js.map
+//# sourceMappingURL=humanity-signals.js.map

package/dist/utils/humanity-signals.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utils/humanity-signals.ts"],"names":[],"mappings":";AAgBO,IAAM,cAAA,GAAiB;AAEvB,IAAM,gBAAA,GAAmB;AAEzB,IAAM,mBAAA,GAAsB;AAS5B,SAAS,uBAAuB,IAAA,EAA+D;AACpG,EAAA,MAAM,CAAA,GAAK,QAAQ,EAAC;AACpB,EAAA,MAAM,KAAA,GAAQ,EAAE,cAAc,CAAA;AAK9B,EAAA,MAAM,QAAA,GAAW,KAAA,IAAS,IAAA,GAAO,EAAA,GAAK,OAAO,KAAK,CAAA;AAClD,EAAA,MAAM,KAAA,GAAQ,EAAE,gBAAgB,CAAA;AAChC,EAAA,MAAM,SAAA,GAAY,OAAO,KAAA,KAAU,QAAA,IAAY,OAAO,QAAA,CAAS,KAAK,IAAI,KAAA,GAAQ,IAAA;AAChF,EAAA,OAAO,EAAE,UAAU,SAAA,EAAU;AAC/B;AAOO,SAAS,uBAAA,CAAwB,MAAe,IAAA,EAA8C;AACnG,EAAA,MAAM,EAAE,QAAA,EAAU,SAAA,EAAU,GAAI,uBAAuB,IAAI,CAAA;AAC3D,EAAA,IAAI,QAAA,CAAS,MAAK,KAAM,EAAA,SAAW,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,UAAA,EAAW;AACnE,EAAA,IAAI,SAAA,KAAc,IAAA,IAAQ,SAAA,GAAY,IAAA,CAAK,SAAA,SAAkB,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,UAAA,EAAW;AAC7F,EAAA,OAAO,EAAE,IAAI,IAAA,EAAK;AACpB;AAGO,IAAM,cAAc,CAAC,CAAA,KAC1B,CAAA,EAAG,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,EAAE,IAAA,EAAM,EAAE,MAAA,CAAO,OAAO,KAAK","file":"humanity-signals.js","sourcesContent":["/**\n * Humanity signals — invisible bot-protection primitives shared by the lib's\n * public forms (client) and the hub's per-route `verifyHuman` gate (server).\n *\n * PURE + React-free on purpose: this module is a tsup SERVER entry (no\n * \"use client\" banner) so the hub can import it server-side without pulling a\n * client-reference boundary — same pattern as `schemas/contact-schema` and\n * `components/features/mux-origins`.\n *\n * Two origin-independent signals travel in the POST body: a honeypot (a hidden\n * field real users never fill) and timing (ms from form mount to submit).\n * `evaluateHumanitySignals` is the SINGLE source of truth for the block/allow\n * decision — the hub imports + calls it rather than re-implementing the rules.\n */\n\n/** Hidden honeypot field name. Innocuous + autofill-resistant (deliberately NOT name/email). */\nexport const HONEYPOT_FIELD = 'contact_url_confirm'\n/** Client-measured ms between form mount and submit. */\nexport const ELAPSED_MS_FIELD = 'form_elapsed_ms'\n/** Default minimum fill time (ms). A submit faster than this is treated as a bot. */\nexport const DEFAULT_MIN_FILL_MS = 700\n\n/** Keyed wire object produced by `useHumanitySignals().getSignals()` and spread into the POST body. */\nexport type HumanitySignals = Record<string, string | number>\n\n/** Result of {@link evaluateHumanitySignals}. */\nexport type HumanityVerdict = { ok: true } | { ok: false; reason: 'honeypot' | 'too_fast' }\n\n/** Tolerant reader — never throws; missing/garbage timing → null. */\nexport function extractHumanitySignals(body: unknown): { honeypot: string; elapsedMs: number | null } {\n  const b = (body ?? {}) as Record<string, unknown>\n  const rawHp = b[HONEYPOT_FIELD]\n  // A legit client always sends a STRING here (getSignals → ref.value ?? ''),\n  // so ANY present non-string value is a bot filling the decoy with a non-string\n  // to dodge the empty-check — coerce to a (non-empty) string so it still trips.\n  // null/undefined → '' = the correct \"field absent / unfilled\" allow case.\n  const honeypot = rawHp == null ? '' : String(rawHp)\n  const rawMs = b[ELAPSED_MS_FIELD]\n  const elapsedMs = typeof rawMs === 'number' && Number.isFinite(rawMs) ? rawMs : null\n  return { honeypot, elapsedMs }\n}\n\n/**\n * SINGLE decision fn for honeypot + timing (the hub's `verifyHuman` imports + calls this):\n * - honeypot non-empty → bot (real users never fill the off-screen field)\n * - elapsed below `minFillMs` → bot (humans take time; a MISSING timing value never blocks)\n */\nexport function evaluateHumanitySignals(body: unknown, opts: { minFillMs: number }): HumanityVerdict {\n  const { honeypot, elapsedMs } = extractHumanitySignals(body)\n  if (honeypot.trim() !== '') return { ok: false, reason: 'honeypot' }\n  if (elapsedMs !== null && elapsedMs < opts.minFillMs) return { ok: false, reason: 'too_fast' }\n  return { ok: true }\n}\n\n/** Parse a comma-separated env string → trimmed, non-empty entries (undefined → []). */\nexport const splitCsvEnv = (s?: string): string[] =>\n  s?.split(',').map((t) => t.trim()).filter(Boolean) ?? []\n"]}

package/dist/utils/index.cjs

@@ -3312,6 +3312,26 @@ function buildDefaultHref(basePath, slug) {
   return { href: `${basePath}/${slug}`, targetPlatform: null };
 }
 
+// src/utils/humanity-signals.ts
+var HONEYPOT_FIELD = "contact_url_confirm";
+var ELAPSED_MS_FIELD = "form_elapsed_ms";
+var DEFAULT_MIN_FILL_MS = 700;
+function extractHumanitySignals(body) {
+  const b = body ?? {};
+  const rawHp = b[HONEYPOT_FIELD];
+  const honeypot = rawHp == null ? "" : String(rawHp);
+  const rawMs = b[ELAPSED_MS_FIELD];
+  const elapsedMs = typeof rawMs === "number" && Number.isFinite(rawMs) ? rawMs : null;
+  return { honeypot, elapsedMs };
+}
+function evaluateHumanitySignals(body, opts) {
+  const { honeypot, elapsedMs } = extractHumanitySignals(body);
+  if (honeypot.trim() !== "") return { ok: false, reason: "honeypot" };
+  if (elapsedMs !== null && elapsedMs < opts.minFillMs) return { ok: false, reason: "too_fast" };
+  return { ok: true };
+}
+var splitCsvEnv = (s) => s?.split(",").map((t) => t.trim()).filter(Boolean) ?? [];
+
 exports.ANTHROPIC_SUPPORTED_IMAGE_MIME = ANTHROPIC_SUPPORTED_IMAGE_MIME;
 exports.AUTO_CONTINUATION_DIRECTIVE_PREFIX = AUTO_CONTINUATION_DIRECTIVE_PREFIX;
 exports.CHAT_ATTACHMENT_MARKDOWN_PATTERN = CHAT_ATTACHMENT_MARKDOWN_PATTERN;
@@ -3320,12 +3340,15 @@ exports.CHAT_ATTACHMENT_VIEW_URL_PREFIX = CHAT_ATTACHMENT_VIEW_URL_PREFIX;
 exports.CHAT_ATTACHMENT_VIEW_URL_PREFIX_REGEX_ESCAPED = CHAT_ATTACHMENT_VIEW_URL_PREFIX_REGEX_ESCAPED;
 exports.CUSTOM_ITEM_ID = CUSTOM_ITEM_ID;
 exports.DEFAULT_CONTENT_SUFFIXES = DEFAULT_CONTENT_SUFFIXES;
+exports.DEFAULT_MIN_FILL_MS = DEFAULT_MIN_FILL_MS;
 exports.DEFAULT_OS_PLATFORM = DEFAULT_OS_PLATFORM;
 exports.DELIVERY_TASK_TYPE_OPTIONS = DELIVERY_TASK_TYPE_OPTIONS;
 exports.DESIGN_PALETTE = DESIGN_PALETTE;
 exports.DEV_SECTION_PARAM_KEYS = DEV_SECTION_PARAM_KEYS;
+exports.ELAPSED_MS_FIELD = ELAPSED_MS_FIELD;
 exports.GENERIC_EMAIL_DOMAINS = GENERIC_EMAIL_DOMAINS;
 exports.HEX_PATTERN = HEX_PATTERN;
+exports.HONEYPOT_FIELD = HONEYPOT_FIELD;
 exports.ICON_REGISTRY = ICON_REGISTRY;
 exports.OPENFRAME_DEV_SECTIONS = OPENFRAME_DEV_SECTIONS;
 exports.OS_PLATFORMS = OS_PLATFORMS;
@@ -3353,9 +3376,11 @@ exports.deepClone = deepClone;
 exports.delay = delay;
 exports.embedAuthedFetch = embedAuthedFetch;
 exports.escapeMarkdownInline = escapeMarkdownInline;
+exports.evaluateHumanitySignals = evaluateHumanitySignals;
 exports.extractDomainFromEmail = extractDomainFromEmail;
 exports.extractDominantColor = extractDominantColor;
 exports.extractEntityIdFilter = extractEntityIdFilter;
+exports.extractHumanitySignals = extractHumanitySignals;
 exports.extractImageEdgeColorAsync = extractImageEdgeColorAsync;
 exports.fetchPriorityProp = fetchPriorityProp;
 exports.flattenAssistantContent = flattenAssistantContent;
@@ -3475,6 +3500,7 @@ exports.scrollElementIntoView = scrollElementIntoView;
 exports.setEmbedAuthAdapter = setEmbedAuthAdapter;
 exports.setEmbedProxyAuth = setEmbedProxyAuth;
 exports.shouldProxyImage = shouldProxyImage;
+exports.splitCsvEnv = splitCsvEnv;
 exports.stripChatAttachmentMarkdown = stripChatAttachmentMarkdown;
 exports.stripHtml = stripHtml;
 exports.toToolLabel = toToolLabel;