@flamingo-stack/openframe-frontend-core 0.0.572 → 0.0.573-1933.5266.1

package/dist/index.js

@@ -9,7 +9,7 @@ import {
   SoftwareInfo,
   SoftwareSourceBadge,
   ToolBadge
-} from "./chunk-JS3U2V7J.js";
+} from "./chunk-CNNRCN6S.js";
 import {
   AppHeader,
   AppLayout,
@@ -28,14 +28,14 @@ import {
   SlidingSidebar,
   TicketAlertsButton,
   TopNavigation
-} from "./chunk-L6C7SYRU.js";
+} from "./chunk-ET5V44BF.js";
 import {
   MobileNavigationDropdown,
   MultiLevelNavigation,
   StickySectionNav,
   useSectionNavigation
-} from "./chunk-II52DW7X.js";
-import "./chunk-RXMY3LTP.js";
+} from "./chunk-OZGDWUVN.js";
+import "./chunk-X4M3KSFH.js";
 import {
   ADMIN_APPROVAL_REQUEST_CONTEXT_TYPE,
   AIEnrichButton,
@@ -576,7 +576,7 @@ import {
   withFirstTouchAttribution,
   withWalkthroughOpenParam,
   writeDismissCookie
-} from "./chunk-OQNIQVET.js";
+} from "./chunk-6QJYO3SB.js";
 import "./chunk-L2SLFCXP.js";
 import "./chunk-BJXDHKUX.js";
 import {
@@ -586,6 +586,7 @@ import {
   GraphQLIntrospector,
   HONEYPOT_FIELD,
   HUMANITY_SIGNAL_KEYS,
+  LEGACY_HONEYPOT_FIELD,
   ToastCard,
   Toaster,
   batchFetchAuthenticatedImages,
@@ -682,7 +683,7 @@ import {
   validateSchema,
   validateVariables,
   variablesToUrlParams
-} from "./chunk-QCWTNMWZ.js";
+} from "./chunk-KELXUVJW.js";
 import "./chunk-ZRIVCLPR.js";
 import {
   CONTENT_REF_GROUPS,
@@ -2080,6 +2081,7 @@ export {
   JsonDetailList,
   JumpInIcon,
   KnowledgeBaseLinksManager,
+  LEGACY_HONEYPOT_FIELD,
   LOG_SEVERITY_COLORS,
   LOG_SEVERITY_LABELS,
   Label,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/components/logs-list.tsx","../src/components/log-severity-dot.tsx","../src/types/logs.types.ts","../src/assets/index.ts"],"sourcesContent":["import { type FC, forwardRef, useRef } from 'react';\nimport type { LogsListProps, LogEntry } from '../types/logs.types';\nimport { cn } from '../utils/cn';\nimport { LogSeverityDot } from './log-severity-dot';\nimport { ToolIcon } from './tool-icon';\n\nconst formatTimestamp = (timestamp: string | Date): string => {\n  const date = timestamp instanceof Date ? timestamp : new Date(timestamp);\n\n  // UTC getters so the timestamp is identical on server (UTC) and client\n  // (local) — otherwise React #418 hydration mismatch.\n  const year = date.getUTCFullYear();\n  const month = String(date.getUTCMonth() + 1).padStart(2, '0');\n  const day = String(date.getUTCDate()).padStart(2, '0');\n  const hours = String(date.getUTCHours()).padStart(2, '0');\n  const minutes = String(date.getUTCMinutes()).padStart(2, '0');\n\n  return `${year}/${month}/${day},${hours}:${minutes}`;\n};\n\nconst LogCard: FC<{\n  log: LogEntry;\n  isLast: boolean;\n  showConnector: boolean;\n  onClick?: () => void;\n}> = ({ log, isLast, showConnector, onClick }) => {\n  return (\n    <div className=\"relative\">\n      <div\n        className={cn(\n          'relative box-border flex w-full items-start gap-3 rounded px-1 py-2',\n          'cursor-pointer transition-colors hover:bg-ods-bg-hover/50',\n        )}\n        onClick={onClick}\n        role=\"button\"\n        tabIndex={0}\n        onKeyDown={e => {\n          if (e.key === 'Enter' || e.key === ' ') {\n            e.preventDefault();\n            onClick?.();\n          }\n        }}\n      >\n        <LogSeverityDot severity={log.severity} size=\"md\" />\n\n        <div className=\"min-w-0 flex-1 space-y-1\">\n          <p className=\"text-ods-text-primary text-h6\">{log.title}</p>\n          <div className=\"flex items-center gap-2\">\n            <p className=\"text-ods-text-secondary text-h5\">{formatTimestamp(log.timestamp)}</p>\n            {log.toolType && <ToolIcon toolType={log.toolType} size={16} />}\n          </div>\n        </div>\n      </div>\n\n      {showConnector && !isLast && (\n        <div\n          className=\"absolute left-[15px] w-[2px] bg-ods-border\"\n          style={{\n            top: '28px',\n            bottom: '-10px',\n          }}\n          aria-hidden=\"true\"\n        />\n      )}\n    </div>\n  );\n};\n\nexport const LogsList = forwardRef<HTMLDivElement, LogsListProps>(\n  (\n    {\n      logs,\n      maxHeight = '400px',\n      showConnector = true,\n      onLogClick,\n      loading = false,\n      emptyMessage = 'No logs to display',\n      className,\n    },\n    ref,\n  ) => {\n    const containerRef = useRef<HTMLDivElement>(null);\n\n    const isFullHeight = maxHeight === '100%';\n\n    const getContainerStyles = () => {\n      if (isFullHeight) return undefined;\n      return { maxHeight, minHeight: '200px' };\n    };\n\n    const getContainerClasses = () => {\n      if (isFullHeight) return 'h-full';\n      return '';\n    };\n\n    if (loading) {\n      return (\n        <div\n          ref={ref}\n          className={cn(\n            'rounded-lg border border-ods-border bg-ods-card p-4',\n            'flex items-center justify-center',\n            getContainerClasses(),\n            className,\n          )}\n          style={getContainerStyles()}\n        >\n          <div className=\"text-ods-text-muted text-h6\">Loading logs...</div>\n        </div>\n      );\n    }\n\n    if (logs.length === 0) {\n      return (\n        <div\n          ref={ref}\n          className={cn(\n            'rounded-lg border border-ods-border bg-ods-card p-4',\n            'flex items-center justify-center',\n            getContainerClasses(),\n            className,\n          )}\n          style={getContainerStyles()}\n        >\n          <div className=\"text-ods-text-muted text-h6\">{emptyMessage}</div>\n        </div>\n      );\n    }\n\n    return (\n      <div\n        ref={ref}\n        className={cn(\n          'relative rounded-lg border border-ods-border bg-ods-card',\n          'flex flex-col overflow-hidden',\n          getContainerClasses(),\n          className,\n        )}\n        style={getContainerStyles()}\n      >\n        <div ref={containerRef} className=\"flex-1 overflow-y-auto px-4 py-3\">\n          {logs.map((log, index) => (\n            <LogCard\n              key={log.id}\n              log={log}\n              isLast={index === logs.length - 1}\n              showConnector={showConnector}\n              onClick={() => onLogClick?.(log)}\n            />\n          ))}\n        </div>\n      </div>\n    );\n  },\n);\n\nLogsList.displayName = 'LogsList';\n","import { forwardRef } from 'react';\nimport { type LogSeverityDotProps, LOG_SEVERITY_COLORS, LOG_SEVERITY_LABELS } from '../types/logs.types';\nimport { cn } from '../utils/cn';\n\nexport const LogSeverityDot = forwardRef<HTMLDivElement, LogSeverityDotProps>(\n  ({ severity, size = 'md', className }, ref) => {\n    const sizeClasses = {\n      sm: 'w-4 h-4',\n      md: 'w-6 h-6',\n      lg: 'w-8 h-8',\n    };\n\n    const dotSizeClasses = {\n      sm: 'w-2 h-2',\n      md: 'w-3 h-3',\n      lg: 'w-4 h-4',\n    };\n\n    return (\n      <div\n        ref={ref}\n        className={cn('relative flex shrink-0 items-center justify-center', sizeClasses[size], className)}\n        aria-label={`${LOG_SEVERITY_LABELS[severity]} severity`}\n      >\n        <div\n          className={cn('rounded-full', dotSizeClasses[size])}\n          style={{ backgroundColor: LOG_SEVERITY_COLORS[severity] }}\n        />\n      </div>\n    );\n  },\n);\n\nLogSeverityDot.displayName = 'LogSeverityDot';\n","import type { ToolType } from './tool.types';\n\nexport type LogSeverity = 'DEBUG' | 'INFO' | 'WARNING' | 'ERROR' | 'CRITICAL';\n\nexport interface LogEntry {\n  id: string;\n  ingestDay: string;\n  eventType: string;\n  severity: LogSeverity;\n  title: string;\n  timestamp: string | Date;\n  toolType?: ToolType;\n  toolIcon?: string;\n  message?: string;\n  metadata?: Record<string, unknown>;\n}\n\nexport interface LogsListProps {\n  logs: LogEntry[];\n  maxHeight?: string | number;\n  showConnector?: boolean;\n  onLogClick?: (log: LogEntry) => void;\n  loading?: boolean;\n  emptyMessage?: string;\n  className?: string;\n}\n\nexport interface LogSeverityDotProps {\n  severity: LogSeverity;\n  size?: 'sm' | 'md' | 'lg';\n  className?: string;\n}\n\nexport const LOG_SEVERITY_COLORS: Record<LogSeverity, string> = {\n  DEBUG: '#888888',\n  INFO: '#888888',\n  WARNING: '#e1b32f',\n  ERROR: '#f36666',\n  CRITICAL: '#b43b3b',\n};\n\nexport const LOG_SEVERITY_LABELS: Record<LogSeverity, string> = {\n  DEBUG: 'Debug',\n  INFO: 'Info',\n  WARNING: 'Warning',\n  ERROR: 'Error',\n  CRITICAL: 'Critical',\n};\n","// Assets exports\n// Font files and other static assets\n// Platform utilities will be available when needed\n\nexport const assets = {} as const;\nexport * from './fae-avatar';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAkB,cAAAA,aAAY,cAAc;;;ACA5C,SAAS,kBAAkB;;;ACiCpB,IAAM,sBAAmD;AAAA,EAC9D,OAAO;AAAA,EACP,MAAM;AAAA,EACN,SAAS;AAAA,EACT,OAAO;AAAA,EACP,UAAU;AACZ;AAEO,IAAM,sBAAmD;AAAA,EAC9D,OAAO;AAAA,EACP,MAAM;AAAA,EACN,SAAS;AAAA,EACT,OAAO;AAAA,EACP,UAAU;AACZ;;;ADvBQ;AApBD,IAAM,iBAAiB;AAAA,EAC5B,CAAC,EAAE,UAAU,OAAO,MAAM,UAAU,GAAG,QAAQ;AAC7C,UAAM,cAAc;AAAA,MAClB,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,IACN;AAEA,UAAM,iBAAiB;AAAA,MACrB,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,IACN;AAEA,WACE;AAAA,MAAC;AAAA;AAAA,QACC;AAAA,QACA,WAAW,GAAG,sDAAsD,YAAY,IAAI,GAAG,SAAS;AAAA,QAChG,cAAY,GAAG,oBAAoB,QAAQ,CAAC;AAAA,QAE5C;AAAA,UAAC;AAAA;AAAA,YACC,WAAW,GAAG,gBAAgB,eAAe,IAAI,CAAC;AAAA,YAClD,OAAO,EAAE,iBAAiB,oBAAoB,QAAQ,EAAE;AAAA;AAAA,QAC1D;AAAA;AAAA,IACF;AAAA,EAEJ;AACF;AAEA,eAAe,cAAc;;;ADUrB,gBAAAC,MAIE,YAJF;AArCR,IAAM,kBAAkB,CAAC,cAAqC;AAC5D,QAAM,OAAO,qBAAqB,OAAO,YAAY,IAAI,KAAK,SAAS;AAIvE,QAAM,OAAO,KAAK,eAAe;AACjC,QAAM,QAAQ,OAAO,KAAK,YAAY,IAAI,CAAC,EAAE,SAAS,GAAG,GAAG;AAC5D,QAAM,MAAM,OAAO,KAAK,WAAW,CAAC,EAAE,SAAS,GAAG,GAAG;AACrD,QAAM,QAAQ,OAAO,KAAK,YAAY,CAAC,EAAE,SAAS,GAAG,GAAG;AACxD,QAAM,UAAU,OAAO,KAAK,cAAc,CAAC,EAAE,SAAS,GAAG,GAAG;AAE5D,SAAO,GAAG,IAAI,IAAI,KAAK,IAAI,GAAG,IAAI,KAAK,IAAI,OAAO;AACpD;AAEA,IAAM,UAKD,CAAC,EAAE,KAAK,QAAQ,eAAe,QAAQ,MAAM;AAChD,SACE,qBAAC,SAAI,WAAU,YACb;AAAA;AAAA,MAAC;AAAA;AAAA,QACC,WAAW;AAAA,UACT;AAAA,UACA;AAAA,QACF;AAAA,QACA;AAAA,QACA,MAAK;AAAA,QACL,UAAU;AAAA,QACV,WAAW,OAAK;AACd,cAAI,EAAE,QAAQ,WAAW,EAAE,QAAQ,KAAK;AACtC,cAAE,eAAe;AACjB,sBAAU;AAAA,UACZ;AAAA,QACF;AAAA,QAEA;AAAA,0BAAAA,KAAC,kBAAe,UAAU,IAAI,UAAU,MAAK,MAAK;AAAA,UAElD,qBAAC,SAAI,WAAU,4BACb;AAAA,4BAAAA,KAAC,OAAE,WAAU,iCAAiC,cAAI,OAAM;AAAA,YACxD,qBAAC,SAAI,WAAU,2BACb;AAAA,8BAAAA,KAAC,OAAE,WAAU,mCAAmC,0BAAgB,IAAI,SAAS,GAAE;AAAA,cAC9E,IAAI,YAAY,gBAAAA,KAAC,YAAS,UAAU,IAAI,UAAU,MAAM,IAAI;AAAA,eAC/D;AAAA,aACF;AAAA;AAAA;AAAA,IACF;AAAA,IAEC,iBAAiB,CAAC,UACjB,gBAAAA;AAAA,MAAC;AAAA;AAAA,QACC,WAAU;AAAA,QACV,OAAO;AAAA,UACL,KAAK;AAAA,UACL,QAAQ;AAAA,QACV;AAAA,QACA,eAAY;AAAA;AAAA,IACd;AAAA,KAEJ;AAEJ;AAEO,IAAM,WAAWC;AAAA,EACtB,CACE;AAAA,IACE;AAAA,IACA,YAAY;AAAA,IACZ,gBAAgB;AAAA,IAChB;AAAA,IACA,UAAU;AAAA,IACV,eAAe;AAAA,IACf;AAAA,EACF,GACA,QACG;AACH,UAAM,eAAe,OAAuB,IAAI;AAEhD,UAAM,eAAe,cAAc;AAEnC,UAAM,qBAAqB,MAAM;AAC/B,UAAI,aAAc,QAAO;AACzB,aAAO,EAAE,WAAW,WAAW,QAAQ;AAAA,IACzC;AAEA,UAAM,sBAAsB,MAAM;AAChC,UAAI,aAAc,QAAO;AACzB,aAAO;AAAA,IACT;AAEA,QAAI,SAAS;AACX,aACE,gBAAAD;AAAA,QAAC;AAAA;AAAA,UACC;AAAA,UACA,WAAW;AAAA,YACT;AAAA,YACA;AAAA,YACA,oBAAoB;AAAA,YACpB;AAAA,UACF;AAAA,UACA,OAAO,mBAAmB;AAAA,UAE1B,0BAAAA,KAAC,SAAI,WAAU,+BAA8B,6BAAe;AAAA;AAAA,MAC9D;AAAA,IAEJ;AAEA,QAAI,KAAK,WAAW,GAAG;AACrB,aACE,gBAAAA;AAAA,QAAC;AAAA;AAAA,UACC;AAAA,UACA,WAAW;AAAA,YACT;AAAA,YACA;AAAA,YACA,oBAAoB;AAAA,YACpB;AAAA,UACF;AAAA,UACA,OAAO,mBAAmB;AAAA,UAE1B,0BAAAA,KAAC,SAAI,WAAU,+BAA+B,wBAAa;AAAA;AAAA,MAC7D;AAAA,IAEJ;AAEA,WACE,gBAAAA;AAAA,MAAC;AAAA;AAAA,QACC;AAAA,QACA,WAAW;AAAA,UACT;AAAA,UACA;AAAA,UACA,oBAAoB;AAAA,UACpB;AAAA,QACF;AAAA,QACA,OAAO,mBAAmB;AAAA,QAE1B,0BAAAA,KAAC,SAAI,KAAK,cAAc,WAAU,oCAC/B,eAAK,IAAI,CAAC,KAAK,UACd,gBAAAA;AAAA,UAAC;AAAA;AAAA,YAEC;AAAA,YACA,QAAQ,UAAU,KAAK,SAAS;AAAA,YAChC;AAAA,YACA,SAAS,MAAM,aAAa,GAAG;AAAA;AAAA,UAJ1B,IAAI;AAAA,QAKX,CACD,GACH;AAAA;AAAA,IACF;AAAA,EAEJ;AACF;AAEA,SAAS,cAAc;;;AGxJhB,IAAM,SAAS,CAAC;","names":["forwardRef","jsx","forwardRef"]}
+{"version":3,"sources":["../src/components/logs-list.tsx","../src/components/log-severity-dot.tsx","../src/types/logs.types.ts","../src/assets/index.ts"],"sourcesContent":["import { type FC, forwardRef, useRef } from 'react';\nimport type { LogsListProps, LogEntry } from '../types/logs.types';\nimport { cn } from '../utils/cn';\nimport { LogSeverityDot } from './log-severity-dot';\nimport { ToolIcon } from './tool-icon';\n\nconst formatTimestamp = (timestamp: string | Date): string => {\n  const date = timestamp instanceof Date ? timestamp : new Date(timestamp);\n\n  // UTC getters so the timestamp is identical on server (UTC) and client\n  // (local) — otherwise React #418 hydration mismatch.\n  const year = date.getUTCFullYear();\n  const month = String(date.getUTCMonth() + 1).padStart(2, '0');\n  const day = String(date.getUTCDate()).padStart(2, '0');\n  const hours = String(date.getUTCHours()).padStart(2, '0');\n  const minutes = String(date.getUTCMinutes()).padStart(2, '0');\n\n  return `${year}/${month}/${day},${hours}:${minutes}`;\n};\n\nconst LogCard: FC<{\n  log: LogEntry;\n  isLast: boolean;\n  showConnector: boolean;\n  onClick?: () => void;\n}> = ({ log, isLast, showConnector, onClick }) => {\n  return (\n    <div className=\"relative\">\n      <div\n        className={cn(\n          'relative box-border flex w-full items-start gap-3 rounded px-1 py-2',\n          'cursor-pointer transition-colors hover:bg-ods-bg-hover/50',\n        )}\n        onClick={onClick}\n        role=\"button\"\n        tabIndex={0}\n        onKeyDown={e => {\n          if (e.key === 'Enter' || e.key === ' ') {\n            e.preventDefault();\n            onClick?.();\n          }\n        }}\n      >\n        <LogSeverityDot severity={log.severity} size=\"md\" />\n\n        <div className=\"min-w-0 flex-1 space-y-1\">\n          <p className=\"text-ods-text-primary text-h6\">{log.title}</p>\n          <div className=\"flex items-center gap-2\">\n            <p className=\"text-ods-text-secondary text-h5\">{formatTimestamp(log.timestamp)}</p>\n            {log.toolType && <ToolIcon toolType={log.toolType} size={16} />}\n          </div>\n        </div>\n      </div>\n\n      {showConnector && !isLast && (\n        <div\n          className=\"absolute left-[15px] w-[2px] bg-ods-border\"\n          style={{\n            top: '28px',\n            bottom: '-10px',\n          }}\n          aria-hidden=\"true\"\n        />\n      )}\n    </div>\n  );\n};\n\nexport const LogsList = forwardRef<HTMLDivElement, LogsListProps>(\n  (\n    {\n      logs,\n      maxHeight = '400px',\n      showConnector = true,\n      onLogClick,\n      loading = false,\n      emptyMessage = 'No logs to display',\n      className,\n    },\n    ref,\n  ) => {\n    const containerRef = useRef<HTMLDivElement>(null);\n\n    const isFullHeight = maxHeight === '100%';\n\n    const getContainerStyles = () => {\n      if (isFullHeight) return undefined;\n      return { maxHeight, minHeight: '200px' };\n    };\n\n    const getContainerClasses = () => {\n      if (isFullHeight) return 'h-full';\n      return '';\n    };\n\n    if (loading) {\n      return (\n        <div\n          ref={ref}\n          className={cn(\n            'rounded-lg border border-ods-border bg-ods-card p-4',\n            'flex items-center justify-center',\n            getContainerClasses(),\n            className,\n          )}\n          style={getContainerStyles()}\n        >\n          <div className=\"text-ods-text-muted text-h6\">Loading logs...</div>\n        </div>\n      );\n    }\n\n    if (logs.length === 0) {\n      return (\n        <div\n          ref={ref}\n          className={cn(\n            'rounded-lg border border-ods-border bg-ods-card p-4',\n            'flex items-center justify-center',\n            getContainerClasses(),\n            className,\n          )}\n          style={getContainerStyles()}\n        >\n          <div className=\"text-ods-text-muted text-h6\">{emptyMessage}</div>\n        </div>\n      );\n    }\n\n    return (\n      <div\n        ref={ref}\n        className={cn(\n          'relative rounded-lg border border-ods-border bg-ods-card',\n          'flex flex-col overflow-hidden',\n          getContainerClasses(),\n          className,\n        )}\n        style={getContainerStyles()}\n      >\n        <div ref={containerRef} className=\"flex-1 overflow-y-auto px-4 py-3\">\n          {logs.map((log, index) => (\n            <LogCard\n              key={log.id}\n              log={log}\n              isLast={index === logs.length - 1}\n              showConnector={showConnector}\n              onClick={() => onLogClick?.(log)}\n            />\n          ))}\n        </div>\n      </div>\n    );\n  },\n);\n\nLogsList.displayName = 'LogsList';\n","import { forwardRef } from 'react';\nimport { type LogSeverityDotProps, LOG_SEVERITY_COLORS, LOG_SEVERITY_LABELS } from '../types/logs.types';\nimport { cn } from '../utils/cn';\n\nexport const LogSeverityDot = forwardRef<HTMLDivElement, LogSeverityDotProps>(\n  ({ severity, size = 'md', className }, ref) => {\n    const sizeClasses = {\n      sm: 'w-4 h-4',\n      md: 'w-6 h-6',\n      lg: 'w-8 h-8',\n    };\n\n    const dotSizeClasses = {\n      sm: 'w-2 h-2',\n      md: 'w-3 h-3',\n      lg: 'w-4 h-4',\n    };\n\n    return (\n      <div\n        ref={ref}\n        className={cn('relative flex shrink-0 items-center justify-center', sizeClasses[size], className)}\n        aria-label={`${LOG_SEVERITY_LABELS[severity]} severity`}\n      >\n        <div\n          className={cn('rounded-full', dotSizeClasses[size])}\n          style={{ backgroundColor: LOG_SEVERITY_COLORS[severity] }}\n        />\n      </div>\n    );\n  },\n);\n\nLogSeverityDot.displayName = 'LogSeverityDot';\n","import type { ToolType } from './tool.types';\n\nexport type LogSeverity = 'DEBUG' | 'INFO' | 'WARNING' | 'ERROR' | 'CRITICAL';\n\nexport interface LogEntry {\n  id: string;\n  ingestDay: string;\n  eventType: string;\n  severity: LogSeverity;\n  title: string;\n  timestamp: string | Date;\n  toolType?: ToolType;\n  toolIcon?: string;\n  message?: string;\n  metadata?: Record<string, unknown>;\n}\n\nexport interface LogsListProps {\n  logs: LogEntry[];\n  maxHeight?: string | number;\n  showConnector?: boolean;\n  onLogClick?: (log: LogEntry) => void;\n  loading?: boolean;\n  emptyMessage?: string;\n  className?: string;\n}\n\nexport interface LogSeverityDotProps {\n  severity: LogSeverity;\n  size?: 'sm' | 'md' | 'lg';\n  className?: string;\n}\n\nexport const LOG_SEVERITY_COLORS: Record<LogSeverity, string> = {\n  DEBUG: '#888888',\n  INFO: '#888888',\n  WARNING: '#e1b32f',\n  ERROR: '#f36666',\n  CRITICAL: '#b43b3b',\n};\n\nexport const LOG_SEVERITY_LABELS: Record<LogSeverity, string> = {\n  DEBUG: 'Debug',\n  INFO: 'Info',\n  WARNING: 'Warning',\n  ERROR: 'Error',\n  CRITICAL: 'Critical',\n};\n","// Assets exports\n// Font files and other static assets\n// Platform utilities will be available when needed\n\nexport const assets = {} as const;\nexport * from './fae-avatar';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAkB,cAAAA,aAAY,cAAc;;;ACA5C,SAAS,kBAAkB;;;ACiCpB,IAAM,sBAAmD;AAAA,EAC9D,OAAO;AAAA,EACP,MAAM;AAAA,EACN,SAAS;AAAA,EACT,OAAO;AAAA,EACP,UAAU;AACZ;AAEO,IAAM,sBAAmD;AAAA,EAC9D,OAAO;AAAA,EACP,MAAM;AAAA,EACN,SAAS;AAAA,EACT,OAAO;AAAA,EACP,UAAU;AACZ;;;ADvBQ;AApBD,IAAM,iBAAiB;AAAA,EAC5B,CAAC,EAAE,UAAU,OAAO,MAAM,UAAU,GAAG,QAAQ;AAC7C,UAAM,cAAc;AAAA,MAClB,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,IACN;AAEA,UAAM,iBAAiB;AAAA,MACrB,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI;AAAA,IACN;AAEA,WACE;AAAA,MAAC;AAAA;AAAA,QACC;AAAA,QACA,WAAW,GAAG,sDAAsD,YAAY,IAAI,GAAG,SAAS;AAAA,QAChG,cAAY,GAAG,oBAAoB,QAAQ,CAAC;AAAA,QAE5C;AAAA,UAAC;AAAA;AAAA,YACC,WAAW,GAAG,gBAAgB,eAAe,IAAI,CAAC;AAAA,YAClD,OAAO,EAAE,iBAAiB,oBAAoB,QAAQ,EAAE;AAAA;AAAA,QAC1D;AAAA;AAAA,IACF;AAAA,EAEJ;AACF;AAEA,eAAe,cAAc;;;ADUrB,gBAAAC,MAIE,YAJF;AArCR,IAAM,kBAAkB,CAAC,cAAqC;AAC5D,QAAM,OAAO,qBAAqB,OAAO,YAAY,IAAI,KAAK,SAAS;AAIvE,QAAM,OAAO,KAAK,eAAe;AACjC,QAAM,QAAQ,OAAO,KAAK,YAAY,IAAI,CAAC,EAAE,SAAS,GAAG,GAAG;AAC5D,QAAM,MAAM,OAAO,KAAK,WAAW,CAAC,EAAE,SAAS,GAAG,GAAG;AACrD,QAAM,QAAQ,OAAO,KAAK,YAAY,CAAC,EAAE,SAAS,GAAG,GAAG;AACxD,QAAM,UAAU,OAAO,KAAK,cAAc,CAAC,EAAE,SAAS,GAAG,GAAG;AAE5D,SAAO,GAAG,IAAI,IAAI,KAAK,IAAI,GAAG,IAAI,KAAK,IAAI,OAAO;AACpD;AAEA,IAAM,UAKD,CAAC,EAAE,KAAK,QAAQ,eAAe,QAAQ,MAAM;AAChD,SACE,qBAAC,SAAI,WAAU,YACb;AAAA;AAAA,MAAC;AAAA;AAAA,QACC,WAAW;AAAA,UACT;AAAA,UACA;AAAA,QACF;AAAA,QACA;AAAA,QACA,MAAK;AAAA,QACL,UAAU;AAAA,QACV,WAAW,OAAK;AACd,cAAI,EAAE,QAAQ,WAAW,EAAE,QAAQ,KAAK;AACtC,cAAE,eAAe;AACjB,sBAAU;AAAA,UACZ;AAAA,QACF;AAAA,QAEA;AAAA,0BAAAA,KAAC,kBAAe,UAAU,IAAI,UAAU,MAAK,MAAK;AAAA,UAElD,qBAAC,SAAI,WAAU,4BACb;AAAA,4BAAAA,KAAC,OAAE,WAAU,iCAAiC,cAAI,OAAM;AAAA,YACxD,qBAAC,SAAI,WAAU,2BACb;AAAA,8BAAAA,KAAC,OAAE,WAAU,mCAAmC,0BAAgB,IAAI,SAAS,GAAE;AAAA,cAC9E,IAAI,YAAY,gBAAAA,KAAC,YAAS,UAAU,IAAI,UAAU,MAAM,IAAI;AAAA,eAC/D;AAAA,aACF;AAAA;AAAA;AAAA,IACF;AAAA,IAEC,iBAAiB,CAAC,UACjB,gBAAAA;AAAA,MAAC;AAAA;AAAA,QACC,WAAU;AAAA,QACV,OAAO;AAAA,UACL,KAAK;AAAA,UACL,QAAQ;AAAA,QACV;AAAA,QACA,eAAY;AAAA;AAAA,IACd;AAAA,KAEJ;AAEJ;AAEO,IAAM,WAAWC;AAAA,EACtB,CACE;AAAA,IACE;AAAA,IACA,YAAY;AAAA,IACZ,gBAAgB;AAAA,IAChB;AAAA,IACA,UAAU;AAAA,IACV,eAAe;AAAA,IACf;AAAA,EACF,GACA,QACG;AACH,UAAM,eAAe,OAAuB,IAAI;AAEhD,UAAM,eAAe,cAAc;AAEnC,UAAM,qBAAqB,MAAM;AAC/B,UAAI,aAAc,QAAO;AACzB,aAAO,EAAE,WAAW,WAAW,QAAQ;AAAA,IACzC;AAEA,UAAM,sBAAsB,MAAM;AAChC,UAAI,aAAc,QAAO;AACzB,aAAO;AAAA,IACT;AAEA,QAAI,SAAS;AACX,aACE,gBAAAD;AAAA,QAAC;AAAA;AAAA,UACC;AAAA,UACA,WAAW;AAAA,YACT;AAAA,YACA;AAAA,YACA,oBAAoB;AAAA,YACpB;AAAA,UACF;AAAA,UACA,OAAO,mBAAmB;AAAA,UAE1B,0BAAAA,KAAC,SAAI,WAAU,+BAA8B,6BAAe;AAAA;AAAA,MAC9D;AAAA,IAEJ;AAEA,QAAI,KAAK,WAAW,GAAG;AACrB,aACE,gBAAAA;AAAA,QAAC;AAAA;AAAA,UACC;AAAA,UACA,WAAW;AAAA,YACT;AAAA,YACA;AAAA,YACA,oBAAoB;AAAA,YACpB;AAAA,UACF;AAAA,UACA,OAAO,mBAAmB;AAAA,UAE1B,0BAAAA,KAAC,SAAI,WAAU,+BAA+B,wBAAa;AAAA;AAAA,MAC7D;AAAA,IAEJ;AAEA,WACE,gBAAAA;AAAA,MAAC;AAAA;AAAA,QACC;AAAA,QACA,WAAW;AAAA,UACT;AAAA,UACA;AAAA,UACA,oBAAoB;AAAA,UACpB;AAAA,QACF;AAAA,QACA,OAAO,mBAAmB;AAAA,QAE1B,0BAAAA,KAAC,SAAI,KAAK,cAAc,WAAU,oCAC/B,eAAK,IAAI,CAAC,KAAK,UACd,gBAAAA;AAAA,UAAC;AAAA;AAAA,YAEC;AAAA,YACA,QAAQ,UAAU,KAAK,SAAS;AAAA,YAChC;AAAA,YACA,SAAS,MAAM,aAAa,GAAG;AAAA;AAAA,UAJ1B,IAAI;AAAA,QAKX,CACD,GACH;AAAA;AAAA,IACF;AAAA,EAEJ;AACF;AAEA,SAAS,cAAc;;;AGxJhB,IAAM,SAAS,CAAC;","names":["forwardRef","jsx","forwardRef"]}

package/dist/utils/humanity-signals.cjs

@@ -1,23 +1,41 @@
 'use strict';
 
 // src/utils/humanity-signals.ts
-var HONEYPOT_FIELD = "contact_url_confirm";
+var HONEYPOT_FIELD = "form_extra_note";
+var LEGACY_HONEYPOT_FIELD = "contact_url_confirm";
 var ELAPSED_MS_FIELD = "form_elapsed_ms";
 var DEFAULT_MIN_FILL_MS = 700;
-var HUMANITY_SIGNAL_KEYS = [HONEYPOT_FIELD, ELAPSED_MS_FIELD];
+var HUMANITY_SIGNAL_KEYS = [HONEYPOT_FIELD, LEGACY_HONEYPOT_FIELD, ELAPSED_MS_FIELD];
 function extractHumanitySignals(body) {
   const b = body ?? {};
-  const rawHp = b[HONEYPOT_FIELD];
+  const rawHp = b[HONEYPOT_FIELD] ?? b[LEGACY_HONEYPOT_FIELD];
   const honeypot = rawHp == null ? "" : String(rawHp);
   const rawMs = b[ELAPSED_MS_FIELD];
   const elapsedMs = typeof rawMs === "number" && Number.isFinite(rawMs) ? rawMs : null;
   return { honeypot, elapsedMs };
 }
+function honeypotCopiedFromAnotherField(body, honeypot) {
+  const b = body ?? {};
+  const signalKeys = HUMANITY_SIGNAL_KEYS;
+  for (const [key, value] of Object.entries(b)) {
+    if (signalKeys.includes(key)) continue;
+    if (typeof value === "string" && value === honeypot) return true;
+    if (value && typeof value === "object" && !Array.isArray(value)) {
+      for (const nested of Object.values(value)) {
+        if (typeof nested === "string" && nested === honeypot) return true;
+      }
+    }
+  }
+  return false;
+}
 function evaluateHumanitySignals(body, opts) {
   const { honeypot, elapsedMs } = extractHumanitySignals(body);
-  if (honeypot.trim() !== "") return { ok: false, reason: "honeypot" };
+  const filled = honeypot.trim() !== "";
+  if (filled && !honeypotCopiedFromAnotherField(body, honeypot)) {
+    return { ok: false, reason: "honeypot" };
+  }
   if (elapsedMs !== null && elapsedMs < opts.minFillMs) return { ok: false, reason: "too_fast" };
-  return { ok: true };
+  return filled ? { ok: true, note: "honeypot_autofill" } : { ok: true };
 }
 var splitCsvEnv = (s) => s?.split(",").map((t) => t.trim()).filter(Boolean) ?? [];
 
@@ -25,6 +43,7 @@ exports.DEFAULT_MIN_FILL_MS = DEFAULT_MIN_FILL_MS;
 exports.ELAPSED_MS_FIELD = ELAPSED_MS_FIELD;
 exports.HONEYPOT_FIELD = HONEYPOT_FIELD;
 exports.HUMANITY_SIGNAL_KEYS = HUMANITY_SIGNAL_KEYS;
+exports.LEGACY_HONEYPOT_FIELD = LEGACY_HONEYPOT_FIELD;
 exports.evaluateHumanitySignals = evaluateHumanitySignals;
 exports.extractHumanitySignals = extractHumanitySignals;
 exports.splitCsvEnv = splitCsvEnv;

package/dist/utils/humanity-signals.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utils/humanity-signals.ts"],"names":[],"mappings":";;;AAgBO,IAAM,cAAA,GAAiB;AAEvB,IAAM,gBAAA,GAAmB;AAEzB,IAAM,mBAAA,GAAsB;AAS5B,IAAM,oBAAA,GAAuB,CAAC,cAAA,EAAgB,gBAAgB;AAS9D,SAAS,uBAAuB,IAAA,EAA+D;AACpG,EAAA,MAAM,CAAA,GAAK,QAAQ,EAAC;AACpB,EAAA,MAAM,KAAA,GAAQ,EAAE,cAAc,CAAA;AAK9B,EAAA,MAAM,QAAA,GAAW,KAAA,IAAS,IAAA,GAAO,EAAA,GAAK,OAAO,KAAK,CAAA;AAClD,EAAA,MAAM,KAAA,GAAQ,EAAE,gBAAgB,CAAA;AAChC,EAAA,MAAM,SAAA,GAAY,OAAO,KAAA,KAAU,QAAA,IAAY,OAAO,QAAA,CAAS,KAAK,IAAI,KAAA,GAAQ,IAAA;AAChF,EAAA,OAAO,EAAE,UAAU,SAAA,EAAU;AAC/B;AAOO,SAAS,uBAAA,CAAwB,MAAe,IAAA,EAA8C;AACnG,EAAA,MAAM,EAAE,QAAA,EAAU,SAAA,EAAU,GAAI,uBAAuB,IAAI,CAAA;AAC3D,EAAA,IAAI,QAAA,CAAS,MAAK,KAAM,EAAA,SAAW,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,UAAA,EAAW;AACnE,EAAA,IAAI,SAAA,KAAc,IAAA,IAAQ,SAAA,GAAY,IAAA,CAAK,SAAA,SAAkB,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,UAAA,EAAW;AAC7F,EAAA,OAAO,EAAE,IAAI,IAAA,EAAK;AACpB;AAGO,IAAM,cAAc,CAAC,CAAA,KAC1B,CAAA,EACI,KAAA,CAAM,GAAG,CAAA,CACV,GAAA,CAAI,CAAA,CAAA,KAAK,CAAA,CAAE,MAAM,CAAA,CACjB,MAAA,CAAO,OAAO,KAAK","file":"humanity-signals.cjs","sourcesContent":["/**\n * Humanity signals — invisible bot-protection primitives shared by the lib's\n * public forms (client) and the hub's per-route `verifyHuman` gate (server).\n *\n * PURE + React-free on purpose: this module is a tsup SERVER entry (no\n * \"use client\" banner) so the hub can import it server-side without pulling a\n * client-reference boundary — same pattern as `schemas/contact-schema` and\n * `components/features/mux-origins`.\n *\n * Two origin-independent signals travel in the POST body: a honeypot (a hidden\n * field real users never fill) and timing (ms from form mount to submit).\n * `evaluateHumanitySignals` is the SINGLE source of truth for the block/allow\n * decision — the hub imports + calls it rather than re-implementing the rules.\n */\n\n/** Hidden honeypot field name. Innocuous + autofill-resistant (deliberately NOT name/email). */\nexport const HONEYPOT_FIELD = 'contact_url_confirm';\n/** Client-measured ms between form mount and submit. */\nexport const ELAPSED_MS_FIELD = 'form_elapsed_ms';\n/** Default minimum fill time (ms). A submit faster than this is treated as a bot. */\nexport const DEFAULT_MIN_FILL_MS = 700;\n\n/**\n * Every humanity-signal key that rides in a public form's POST body.\n * Server-side handlers that forward form payloads upstream (HubSpot booking,\n * CRM pushes, …) MUST strip by THIS array — never hand-typed strings — so a\n * field rename here propagates everywhere and the honeypot value can never\n * silently leak into an upstream record.\n */\nexport const HUMANITY_SIGNAL_KEYS = [HONEYPOT_FIELD, ELAPSED_MS_FIELD] as const;\n\n/** Keyed wire object produced by `useHumanitySignals().getSignals()` and spread into the POST body. */\nexport type HumanitySignals = Record<string, string | number>;\n\n/** Result of {@link evaluateHumanitySignals}. */\nexport type HumanityVerdict = { ok: true } | { ok: false; reason: 'honeypot' | 'too_fast' };\n\n/** Tolerant reader — never throws; missing/garbage timing → null. */\nexport function extractHumanitySignals(body: unknown): { honeypot: string; elapsedMs: number | null } {\n  const b = (body ?? {}) as Record<string, unknown>;\n  const rawHp = b[HONEYPOT_FIELD];\n  // A legit client always sends a STRING here (getSignals → ref.value ?? ''),\n  // so ANY present non-string value is a bot filling the decoy with a non-string\n  // to dodge the empty-check — coerce to a (non-empty) string so it still trips.\n  // null/undefined → '' = the correct \"field absent / unfilled\" allow case.\n  const honeypot = rawHp == null ? '' : String(rawHp);\n  const rawMs = b[ELAPSED_MS_FIELD];\n  const elapsedMs = typeof rawMs === 'number' && Number.isFinite(rawMs) ? rawMs : null;\n  return { honeypot, elapsedMs };\n}\n\n/**\n * SINGLE decision fn for honeypot + timing (the hub's `verifyHuman` imports + calls this):\n * - honeypot non-empty → bot (real users never fill the off-screen field)\n * - elapsed below `minFillMs` → bot (humans take time; a MISSING timing value never blocks)\n */\nexport function evaluateHumanitySignals(body: unknown, opts: { minFillMs: number }): HumanityVerdict {\n  const { honeypot, elapsedMs } = extractHumanitySignals(body);\n  if (honeypot.trim() !== '') return { ok: false, reason: 'honeypot' };\n  if (elapsedMs !== null && elapsedMs < opts.minFillMs) return { ok: false, reason: 'too_fast' };\n  return { ok: true };\n}\n\n/** Parse a comma-separated env string → trimmed, non-empty entries (undefined → []). */\nexport const splitCsvEnv = (s?: string): string[] =>\n  s\n    ?.split(',')\n    .map(t => t.trim())\n    .filter(Boolean) ?? [];\n"]}
+{"version":3,"sources":["../../src/utils/humanity-signals.ts"],"names":[],"mappings":";;;AA8BO,IAAM,cAAA,GAAiB;AAMvB,IAAM,qBAAA,GAAwB;AAE9B,IAAM,gBAAA,GAAmB;AAEzB,IAAM,mBAAA,GAAsB;AAS5B,IAAM,oBAAA,GAAuB,CAAC,cAAA,EAAgB,qBAAA,EAAuB,gBAAgB;AASrF,SAAS,uBAAuB,IAAA,EAA+D;AACpG,EAAA,MAAM,CAAA,GAAK,QAAQ,EAAC;AAEpB,EAAA,MAAM,KAAA,GAAQ,CAAA,CAAE,cAAc,CAAA,IAAK,EAAE,qBAAqB,CAAA;AAK1D,EAAA,MAAM,QAAA,GAAW,KAAA,IAAS,IAAA,GAAO,EAAA,GAAK,OAAO,KAAK,CAAA;AAClD,EAAA,MAAM,KAAA,GAAQ,EAAE,gBAAgB,CAAA;AAChC,EAAA,MAAM,SAAA,GAAY,OAAO,KAAA,KAAU,QAAA,IAAY,OAAO,QAAA,CAAS,KAAK,IAAI,KAAA,GAAQ,IAAA;AAChF,EAAA,OAAO,EAAE,UAAU,SAAA,EAAU;AAC/B;AASA,SAAS,8BAAA,CAA+B,MAAe,QAAA,EAA2B;AAChF,EAAA,MAAM,CAAA,GAAK,QAAQ,EAAC;AACpB,EAAA,MAAM,UAAA,GAAgC,oBAAA;AACtC,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,CAAC,CAAA,EAAG;AAC5C,IAAA,IAAI,UAAA,CAAW,QAAA,CAAS,GAAG,CAAA,EAAG;AAC9B,IAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,UAAU,OAAO,IAAA;AAC5D,IAAA,IAAI,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC/D,MAAA,KAAA,MAAW,MAAA,IAAU,MAAA,CAAO,MAAA,CAAO,KAAgC,CAAA,EAAG;AACpE,QAAA,IAAI,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,KAAW,UAAU,OAAO,IAAA;AAAA,MAChE;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,KAAA;AACT;AASO,SAAS,uBAAA,CAAwB,MAAe,IAAA,EAA8C;AACnG,EAAA,MAAM,EAAE,QAAA,EAAU,SAAA,EAAU,GAAI,uBAAuB,IAAI,CAAA;AAC3D,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,IAAA,EAAK,KAAM,EAAA;AACnC,EAAA,IAAI,MAAA,IAAU,CAAC,8BAAA,CAA+B,IAAA,EAAM,QAAQ,CAAA,EAAG;AAC7D,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,UAAA,EAAW;AAAA,EACzC;AACA,EAAA,IAAI,SAAA,KAAc,IAAA,IAAQ,SAAA,GAAY,IAAA,CAAK,SAAA,SAAkB,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,UAAA,EAAW;AAC7F,EAAA,OAAO,MAAA,GAAS,EAAE,EAAA,EAAI,IAAA,EAAM,MAAM,mBAAA,EAAoB,GAAI,EAAE,EAAA,EAAI,IAAA,EAAK;AACvE;AAGO,IAAM,cAAc,CAAC,CAAA,KAC1B,CAAA,EACI,KAAA,CAAM,GAAG,CAAA,CACV,GAAA,CAAI,CAAA,CAAA,KAAK,CAAA,CAAE,MAAM,CAAA,CACjB,MAAA,CAAO,OAAO,KAAK","file":"humanity-signals.cjs","sourcesContent":["/**\n * Humanity signals — invisible bot-protection primitives shared by the lib's\n * public forms (client) and the hub's per-route `verifyHuman` gate (server).\n *\n * PURE + React-free on purpose: this module is a tsup SERVER entry (no\n * \"use client\" banner) so the hub can import it server-side without pulling a\n * client-reference boundary — same pattern as `schemas/contact-schema` and\n * `components/features/mux-origins`.\n *\n * Two origin-independent signals travel in the POST body: a honeypot (a hidden\n * field real users never fill) and timing (ms from form mount to submit).\n * `evaluateHumanitySignals` is the SINGLE source of truth for the block/allow\n * decision — the hub imports + calls it rather than re-implementing the rules.\n *\n * FALSE-POSITIVE HISTORY (2026-08-27): the honeypot was named\n * `contact_url_confirm`, and browser/password-manager autofill (which ignores\n * `autocomplete=\"off\"` and matches \"url\"/\"confirm\" name heuristics) filled it\n * for REAL users — every production `BOT_DETECTED` in the log window was a\n * legitimate Chrome user whose autofill tripped the decoy. Three layers now\n * prevent a recurrence; keep all three when touching this system:\n *   1. The field name avoids every autofill-heuristic token (name/email/\n *      phone/url/website/confirm/company/address/code/…).\n *   2. `HoneypotField` renders `readOnly`-until-focus + password-manager\n *      ignore attributes — autofill skips read-only inputs.\n *   3. `evaluateHumanitySignals` forgives a filled decoy whose value was\n *      COPIED from another field in the same body (the autofill signature —\n *      a human, not a bot).\n */\n\n/** Hidden honeypot field name. Deliberately free of autofill-heuristic tokens (see module doc). */\nexport const HONEYPOT_FIELD = 'form_extra_note';\n/**\n * Prior honeypot field name — still EVALUATED (a stale-lib embedder's client\n * keeps its bot protection) and still STRIPPED before upstream forwarding.\n * Remove once no deployed embedder ships a lib older than the rename.\n */\nexport const LEGACY_HONEYPOT_FIELD = 'contact_url_confirm';\n/** Client-measured ms between form mount and submit. */\nexport const ELAPSED_MS_FIELD = 'form_elapsed_ms';\n/** Default minimum fill time (ms). A submit faster than this is treated as a bot. */\nexport const DEFAULT_MIN_FILL_MS = 700;\n\n/**\n * Every humanity-signal key that rides in a public form's POST body.\n * Server-side handlers that forward form payloads upstream (HubSpot booking,\n * CRM pushes, …) MUST strip by THIS array — never hand-typed strings — so a\n * field rename here propagates everywhere and the honeypot value can never\n * silently leak into an upstream record.\n */\nexport const HUMANITY_SIGNAL_KEYS = [HONEYPOT_FIELD, LEGACY_HONEYPOT_FIELD, ELAPSED_MS_FIELD] as const;\n\n/** Keyed wire object produced by `useHumanitySignals().getSignals()` and spread into the POST body. */\nexport type HumanitySignals = Record<string, string | number>;\n\n/** Result of {@link evaluateHumanitySignals}. */\nexport type HumanityVerdict = { ok: true; note?: 'honeypot_autofill' } | { ok: false; reason: 'honeypot' | 'too_fast' };\n\n/** Tolerant reader — never throws; missing/garbage timing → null. */\nexport function extractHumanitySignals(body: unknown): { honeypot: string; elapsedMs: number | null } {\n  const b = (body ?? {}) as Record<string, unknown>;\n  // Current field name first; a stale-lib client still posts the legacy name.\n  const rawHp = b[HONEYPOT_FIELD] ?? b[LEGACY_HONEYPOT_FIELD];\n  // A legit client always sends a STRING here (getSignals → ref.value ?? ''),\n  // so ANY present non-string value is a bot filling the decoy with a non-string\n  // to dodge the empty-check — coerce to a (non-empty) string so it still trips.\n  // null/undefined → '' = the correct \"field absent / unfilled\" allow case.\n  const honeypot = rawHp == null ? '' : String(rawHp);\n  const rawMs = b[ELAPSED_MS_FIELD];\n  const elapsedMs = typeof rawMs === 'number' && Number.isFinite(rawMs) ? rawMs : null;\n  return { honeypot, elapsedMs };\n}\n\n/**\n * Was the decoy value COPIED from a real field in the same body? That is the\n * autofill signature: browsers and password-manager extensions fill the hidden\n * input with the same value they put in a visible field (email, phone, …) —\n * a human with autofill, not a bot. Scans top-level string values plus one\n * nested level (the booking form's custom `formFields` object).\n */\nfunction honeypotCopiedFromAnotherField(body: unknown, honeypot: string): boolean {\n  const b = (body ?? {}) as Record<string, unknown>;\n  const signalKeys: readonly string[] = HUMANITY_SIGNAL_KEYS;\n  for (const [key, value] of Object.entries(b)) {\n    if (signalKeys.includes(key)) continue;\n    if (typeof value === 'string' && value === honeypot) return true;\n    if (value && typeof value === 'object' && !Array.isArray(value)) {\n      for (const nested of Object.values(value as Record<string, unknown>)) {\n        if (typeof nested === 'string' && nested === honeypot) return true;\n      }\n    }\n  }\n  return false;\n}\n\n/**\n * SINGLE decision fn for honeypot + timing (the hub's `verifyHuman` imports + calls this):\n * - honeypot non-empty → bot (real users never fill the off-screen field) — UNLESS the\n *   value was copied from another field in the body (autofill reached the decoy → human;\n *   the verdict carries `note: 'honeypot_autofill'` so the caller can log it)\n * - elapsed below `minFillMs` → bot (humans take time; a MISSING timing value never blocks)\n */\nexport function evaluateHumanitySignals(body: unknown, opts: { minFillMs: number }): HumanityVerdict {\n  const { honeypot, elapsedMs } = extractHumanitySignals(body);\n  const filled = honeypot.trim() !== '';\n  if (filled && !honeypotCopiedFromAnotherField(body, honeypot)) {\n    return { ok: false, reason: 'honeypot' };\n  }\n  if (elapsedMs !== null && elapsedMs < opts.minFillMs) return { ok: false, reason: 'too_fast' };\n  return filled ? { ok: true, note: 'honeypot_autofill' } : { ok: true };\n}\n\n/** Parse a comma-separated env string → trimmed, non-empty entries (undefined → []). */\nexport const splitCsvEnv = (s?: string): string[] =>\n  s\n    ?.split(',')\n    .map(t => t.trim())\n    .filter(Boolean) ?? [];\n"]}

package/dist/utils/humanity-signals.d.ts

@@ -11,9 +11,29 @@
  * field real users never fill) and timing (ms from form mount to submit).
  * `evaluateHumanitySignals` is the SINGLE source of truth for the block/allow
  * decision — the hub imports + calls it rather than re-implementing the rules.
+ *
+ * FALSE-POSITIVE HISTORY (2026-08-27): the honeypot was named
+ * `contact_url_confirm`, and browser/password-manager autofill (which ignores
+ * `autocomplete="off"` and matches "url"/"confirm" name heuristics) filled it
+ * for REAL users — every production `BOT_DETECTED` in the log window was a
+ * legitimate Chrome user whose autofill tripped the decoy. Three layers now
+ * prevent a recurrence; keep all three when touching this system:
+ *   1. The field name avoids every autofill-heuristic token (name/email/
+ *      phone/url/website/confirm/company/address/code/…).
+ *   2. `HoneypotField` renders `readOnly`-until-focus + password-manager
+ *      ignore attributes — autofill skips read-only inputs.
+ *   3. `evaluateHumanitySignals` forgives a filled decoy whose value was
+ *      COPIED from another field in the same body (the autofill signature —
+ *      a human, not a bot).
+ */
+/** Hidden honeypot field name. Deliberately free of autofill-heuristic tokens (see module doc). */
+export declare const HONEYPOT_FIELD = "form_extra_note";
+/**
+ * Prior honeypot field name — still EVALUATED (a stale-lib embedder's client
+ * keeps its bot protection) and still STRIPPED before upstream forwarding.
+ * Remove once no deployed embedder ships a lib older than the rename.
  */
-/** Hidden honeypot field name. Innocuous + autofill-resistant (deliberately NOT name/email). */
-export declare const HONEYPOT_FIELD = "contact_url_confirm";
+export declare const LEGACY_HONEYPOT_FIELD = "contact_url_confirm";
 /** Client-measured ms between form mount and submit. */
 export declare const ELAPSED_MS_FIELD = "form_elapsed_ms";
 /** Default minimum fill time (ms). A submit faster than this is treated as a bot. */
@@ -25,12 +45,13 @@ export declare const DEFAULT_MIN_FILL_MS = 700;
  * field rename here propagates everywhere and the honeypot value can never
  * silently leak into an upstream record.
  */
-export declare const HUMANITY_SIGNAL_KEYS: readonly ["contact_url_confirm", "form_elapsed_ms"];
+export declare const HUMANITY_SIGNAL_KEYS: readonly ["form_extra_note", "contact_url_confirm", "form_elapsed_ms"];
 /** Keyed wire object produced by `useHumanitySignals().getSignals()` and spread into the POST body. */
 export type HumanitySignals = Record<string, string | number>;
 /** Result of {@link evaluateHumanitySignals}. */
 export type HumanityVerdict = {
     ok: true;
+    note?: 'honeypot_autofill';
 } | {
     ok: false;
     reason: 'honeypot' | 'too_fast';
@@ -42,7 +63,9 @@ export declare function extractHumanitySignals(body: unknown): {
 };
 /**
  * SINGLE decision fn for honeypot + timing (the hub's `verifyHuman` imports + calls this):
- * - honeypot non-empty → bot (real users never fill the off-screen field)
+ * - honeypot non-empty → bot (real users never fill the off-screen field) — UNLESS the
+ *   value was copied from another field in the body (autofill reached the decoy → human;
+ *   the verdict carries `note: 'honeypot_autofill'` so the caller can log it)
  * - elapsed below `minFillMs` → bot (humans take time; a MISSING timing value never blocks)
  */
 export declare function evaluateHumanitySignals(body: unknown, opts: {

package/dist/utils/humanity-signals.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"humanity-signals.d.ts","sourceRoot":"","sources":["../../src/utils/humanity-signals.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,gGAAgG;AAChG,eAAO,MAAM,cAAc,wBAAwB,CAAC;AACpD,wDAAwD;AACxD,eAAO,MAAM,gBAAgB,oBAAoB,CAAC;AAClD,qFAAqF;AACrF,eAAO,MAAM,mBAAmB,MAAM,CAAC;AAEvC;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,qDAA8C,CAAC;AAEhF,uGAAuG;AACvG,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;AAE9D,iDAAiD;AACjD,MAAM,MAAM,eAAe,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAAA;CAAE,CAAC;AAE5F,qEAAqE;AACrE,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,OAAO,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAWpG;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,eAAe,CAKnG;AAED,wFAAwF;AACxF,eAAO,MAAM,WAAW,GAAI,IAAI,MAAM,KAAG,MAAM,EAIrB,CAAC"}
+{"version":3,"file":"humanity-signals.d.ts","sourceRoot":"","sources":["../../src/utils/humanity-signals.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,mGAAmG;AACnG,eAAO,MAAM,cAAc,oBAAoB,CAAC;AAChD;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,wBAAwB,CAAC;AAC3D,wDAAwD;AACxD,eAAO,MAAM,gBAAgB,oBAAoB,CAAC;AAClD,qFAAqF;AACrF,eAAO,MAAM,mBAAmB,MAAM,CAAC;AAEvC;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,wEAAqE,CAAC;AAEvG,uGAAuG;AACvG,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;AAE9D,iDAAiD;AACjD,MAAM,MAAM,eAAe,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,CAAC,EAAE,mBAAmB,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAAA;CAAE,CAAC;AAExH,qEAAqE;AACrE,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,OAAO,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAYpG;AAwBD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,eAAe,CAQnG;AAED,wFAAwF;AACxF,eAAO,MAAM,WAAW,GAAI,IAAI,MAAM,KAAG,MAAM,EAIrB,CAAC"}

package/dist/utils/humanity-signals.js

@@ -1,24 +1,42 @@
 // src/utils/humanity-signals.ts
-var HONEYPOT_FIELD = "contact_url_confirm";
+var HONEYPOT_FIELD = "form_extra_note";
+var LEGACY_HONEYPOT_FIELD = "contact_url_confirm";
 var ELAPSED_MS_FIELD = "form_elapsed_ms";
 var DEFAULT_MIN_FILL_MS = 700;
-var HUMANITY_SIGNAL_KEYS = [HONEYPOT_FIELD, ELAPSED_MS_FIELD];
+var HUMANITY_SIGNAL_KEYS = [HONEYPOT_FIELD, LEGACY_HONEYPOT_FIELD, ELAPSED_MS_FIELD];
 function extractHumanitySignals(body) {
   const b = body ?? {};
-  const rawHp = b[HONEYPOT_FIELD];
+  const rawHp = b[HONEYPOT_FIELD] ?? b[LEGACY_HONEYPOT_FIELD];
   const honeypot = rawHp == null ? "" : String(rawHp);
   const rawMs = b[ELAPSED_MS_FIELD];
   const elapsedMs = typeof rawMs === "number" && Number.isFinite(rawMs) ? rawMs : null;
   return { honeypot, elapsedMs };
 }
+function honeypotCopiedFromAnotherField(body, honeypot) {
+  const b = body ?? {};
+  const signalKeys = HUMANITY_SIGNAL_KEYS;
+  for (const [key, value] of Object.entries(b)) {
+    if (signalKeys.includes(key)) continue;
+    if (typeof value === "string" && value === honeypot) return true;
+    if (value && typeof value === "object" && !Array.isArray(value)) {
+      for (const nested of Object.values(value)) {
+        if (typeof nested === "string" && nested === honeypot) return true;
+      }
+    }
+  }
+  return false;
+}
 function evaluateHumanitySignals(body, opts) {
   const { honeypot, elapsedMs } = extractHumanitySignals(body);
-  if (honeypot.trim() !== "") return { ok: false, reason: "honeypot" };
+  const filled = honeypot.trim() !== "";
+  if (filled && !honeypotCopiedFromAnotherField(body, honeypot)) {
+    return { ok: false, reason: "honeypot" };
+  }
   if (elapsedMs !== null && elapsedMs < opts.minFillMs) return { ok: false, reason: "too_fast" };
-  return { ok: true };
+  return filled ? { ok: true, note: "honeypot_autofill" } : { ok: true };
 }
 var splitCsvEnv = (s) => s?.split(",").map((t) => t.trim()).filter(Boolean) ?? [];
 
-export { DEFAULT_MIN_FILL_MS, ELAPSED_MS_FIELD, HONEYPOT_FIELD, HUMANITY_SIGNAL_KEYS, evaluateHumanitySignals, extractHumanitySignals, splitCsvEnv };
+export { DEFAULT_MIN_FILL_MS, ELAPSED_MS_FIELD, HONEYPOT_FIELD, HUMANITY_SIGNAL_KEYS, LEGACY_HONEYPOT_FIELD, evaluateHumanitySignals, extractHumanitySignals, splitCsvEnv };
 //# sourceMappingURL=humanity-signals.js.map
 //# sourceMappingURL=humanity-signals.js.map

package/dist/utils/humanity-signals.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utils/humanity-signals.ts"],"names":[],"mappings":";AAgBO,IAAM,cAAA,GAAiB;AAEvB,IAAM,gBAAA,GAAmB;AAEzB,IAAM,mBAAA,GAAsB;AAS5B,IAAM,oBAAA,GAAuB,CAAC,cAAA,EAAgB,gBAAgB;AAS9D,SAAS,uBAAuB,IAAA,EAA+D;AACpG,EAAA,MAAM,CAAA,GAAK,QAAQ,EAAC;AACpB,EAAA,MAAM,KAAA,GAAQ,EAAE,cAAc,CAAA;AAK9B,EAAA,MAAM,QAAA,GAAW,KAAA,IAAS,IAAA,GAAO,EAAA,GAAK,OAAO,KAAK,CAAA;AAClD,EAAA,MAAM,KAAA,GAAQ,EAAE,gBAAgB,CAAA;AAChC,EAAA,MAAM,SAAA,GAAY,OAAO,KAAA,KAAU,QAAA,IAAY,OAAO,QAAA,CAAS,KAAK,IAAI,KAAA,GAAQ,IAAA;AAChF,EAAA,OAAO,EAAE,UAAU,SAAA,EAAU;AAC/B;AAOO,SAAS,uBAAA,CAAwB,MAAe,IAAA,EAA8C;AACnG,EAAA,MAAM,EAAE,QAAA,EAAU,SAAA,EAAU,GAAI,uBAAuB,IAAI,CAAA;AAC3D,EAAA,IAAI,QAAA,CAAS,MAAK,KAAM,EAAA,SAAW,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,UAAA,EAAW;AACnE,EAAA,IAAI,SAAA,KAAc,IAAA,IAAQ,SAAA,GAAY,IAAA,CAAK,SAAA,SAAkB,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,UAAA,EAAW;AAC7F,EAAA,OAAO,EAAE,IAAI,IAAA,EAAK;AACpB;AAGO,IAAM,cAAc,CAAC,CAAA,KAC1B,CAAA,EACI,KAAA,CAAM,GAAG,CAAA,CACV,GAAA,CAAI,CAAA,CAAA,KAAK,CAAA,CAAE,MAAM,CAAA,CACjB,MAAA,CAAO,OAAO,KAAK","file":"humanity-signals.js","sourcesContent":["/**\n * Humanity signals — invisible bot-protection primitives shared by the lib's\n * public forms (client) and the hub's per-route `verifyHuman` gate (server).\n *\n * PURE + React-free on purpose: this module is a tsup SERVER entry (no\n * \"use client\" banner) so the hub can import it server-side without pulling a\n * client-reference boundary — same pattern as `schemas/contact-schema` and\n * `components/features/mux-origins`.\n *\n * Two origin-independent signals travel in the POST body: a honeypot (a hidden\n * field real users never fill) and timing (ms from form mount to submit).\n * `evaluateHumanitySignals` is the SINGLE source of truth for the block/allow\n * decision — the hub imports + calls it rather than re-implementing the rules.\n */\n\n/** Hidden honeypot field name. Innocuous + autofill-resistant (deliberately NOT name/email). */\nexport const HONEYPOT_FIELD = 'contact_url_confirm';\n/** Client-measured ms between form mount and submit. */\nexport const ELAPSED_MS_FIELD = 'form_elapsed_ms';\n/** Default minimum fill time (ms). A submit faster than this is treated as a bot. */\nexport const DEFAULT_MIN_FILL_MS = 700;\n\n/**\n * Every humanity-signal key that rides in a public form's POST body.\n * Server-side handlers that forward form payloads upstream (HubSpot booking,\n * CRM pushes, …) MUST strip by THIS array — never hand-typed strings — so a\n * field rename here propagates everywhere and the honeypot value can never\n * silently leak into an upstream record.\n */\nexport const HUMANITY_SIGNAL_KEYS = [HONEYPOT_FIELD, ELAPSED_MS_FIELD] as const;\n\n/** Keyed wire object produced by `useHumanitySignals().getSignals()` and spread into the POST body. */\nexport type HumanitySignals = Record<string, string | number>;\n\n/** Result of {@link evaluateHumanitySignals}. */\nexport type HumanityVerdict = { ok: true } | { ok: false; reason: 'honeypot' | 'too_fast' };\n\n/** Tolerant reader — never throws; missing/garbage timing → null. */\nexport function extractHumanitySignals(body: unknown): { honeypot: string; elapsedMs: number | null } {\n  const b = (body ?? {}) as Record<string, unknown>;\n  const rawHp = b[HONEYPOT_FIELD];\n  // A legit client always sends a STRING here (getSignals → ref.value ?? ''),\n  // so ANY present non-string value is a bot filling the decoy with a non-string\n  // to dodge the empty-check — coerce to a (non-empty) string so it still trips.\n  // null/undefined → '' = the correct \"field absent / unfilled\" allow case.\n  const honeypot = rawHp == null ? '' : String(rawHp);\n  const rawMs = b[ELAPSED_MS_FIELD];\n  const elapsedMs = typeof rawMs === 'number' && Number.isFinite(rawMs) ? rawMs : null;\n  return { honeypot, elapsedMs };\n}\n\n/**\n * SINGLE decision fn for honeypot + timing (the hub's `verifyHuman` imports + calls this):\n * - honeypot non-empty → bot (real users never fill the off-screen field)\n * - elapsed below `minFillMs` → bot (humans take time; a MISSING timing value never blocks)\n */\nexport function evaluateHumanitySignals(body: unknown, opts: { minFillMs: number }): HumanityVerdict {\n  const { honeypot, elapsedMs } = extractHumanitySignals(body);\n  if (honeypot.trim() !== '') return { ok: false, reason: 'honeypot' };\n  if (elapsedMs !== null && elapsedMs < opts.minFillMs) return { ok: false, reason: 'too_fast' };\n  return { ok: true };\n}\n\n/** Parse a comma-separated env string → trimmed, non-empty entries (undefined → []). */\nexport const splitCsvEnv = (s?: string): string[] =>\n  s\n    ?.split(',')\n    .map(t => t.trim())\n    .filter(Boolean) ?? [];\n"]}
+{"version":3,"sources":["../../src/utils/humanity-signals.ts"],"names":[],"mappings":";AA8BO,IAAM,cAAA,GAAiB;AAMvB,IAAM,qBAAA,GAAwB;AAE9B,IAAM,gBAAA,GAAmB;AAEzB,IAAM,mBAAA,GAAsB;AAS5B,IAAM,oBAAA,GAAuB,CAAC,cAAA,EAAgB,qBAAA,EAAuB,gBAAgB;AASrF,SAAS,uBAAuB,IAAA,EAA+D;AACpG,EAAA,MAAM,CAAA,GAAK,QAAQ,EAAC;AAEpB,EAAA,MAAM,KAAA,GAAQ,CAAA,CAAE,cAAc,CAAA,IAAK,EAAE,qBAAqB,CAAA;AAK1D,EAAA,MAAM,QAAA,GAAW,KAAA,IAAS,IAAA,GAAO,EAAA,GAAK,OAAO,KAAK,CAAA;AAClD,EAAA,MAAM,KAAA,GAAQ,EAAE,gBAAgB,CAAA;AAChC,EAAA,MAAM,SAAA,GAAY,OAAO,KAAA,KAAU,QAAA,IAAY,OAAO,QAAA,CAAS,KAAK,IAAI,KAAA,GAAQ,IAAA;AAChF,EAAA,OAAO,EAAE,UAAU,SAAA,EAAU;AAC/B;AASA,SAAS,8BAAA,CAA+B,MAAe,QAAA,EAA2B;AAChF,EAAA,MAAM,CAAA,GAAK,QAAQ,EAAC;AACpB,EAAA,MAAM,UAAA,GAAgC,oBAAA;AACtC,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,CAAC,CAAA,EAAG;AAC5C,IAAA,IAAI,UAAA,CAAW,QAAA,CAAS,GAAG,CAAA,EAAG;AAC9B,IAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,UAAU,OAAO,IAAA;AAC5D,IAAA,IAAI,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC/D,MAAA,KAAA,MAAW,MAAA,IAAU,MAAA,CAAO,MAAA,CAAO,KAAgC,CAAA,EAAG;AACpE,QAAA,IAAI,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,KAAW,UAAU,OAAO,IAAA;AAAA,MAChE;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,KAAA;AACT;AASO,SAAS,uBAAA,CAAwB,MAAe,IAAA,EAA8C;AACnG,EAAA,MAAM,EAAE,QAAA,EAAU,SAAA,EAAU,GAAI,uBAAuB,IAAI,CAAA;AAC3D,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,IAAA,EAAK,KAAM,EAAA;AACnC,EAAA,IAAI,MAAA,IAAU,CAAC,8BAAA,CAA+B,IAAA,EAAM,QAAQ,CAAA,EAAG;AAC7D,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,UAAA,EAAW;AAAA,EACzC;AACA,EAAA,IAAI,SAAA,KAAc,IAAA,IAAQ,SAAA,GAAY,IAAA,CAAK,SAAA,SAAkB,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,UAAA,EAAW;AAC7F,EAAA,OAAO,MAAA,GAAS,EAAE,EAAA,EAAI,IAAA,EAAM,MAAM,mBAAA,EAAoB,GAAI,EAAE,EAAA,EAAI,IAAA,EAAK;AACvE;AAGO,IAAM,cAAc,CAAC,CAAA,KAC1B,CAAA,EACI,KAAA,CAAM,GAAG,CAAA,CACV,GAAA,CAAI,CAAA,CAAA,KAAK,CAAA,CAAE,MAAM,CAAA,CACjB,MAAA,CAAO,OAAO,KAAK","file":"humanity-signals.js","sourcesContent":["/**\n * Humanity signals — invisible bot-protection primitives shared by the lib's\n * public forms (client) and the hub's per-route `verifyHuman` gate (server).\n *\n * PURE + React-free on purpose: this module is a tsup SERVER entry (no\n * \"use client\" banner) so the hub can import it server-side without pulling a\n * client-reference boundary — same pattern as `schemas/contact-schema` and\n * `components/features/mux-origins`.\n *\n * Two origin-independent signals travel in the POST body: a honeypot (a hidden\n * field real users never fill) and timing (ms from form mount to submit).\n * `evaluateHumanitySignals` is the SINGLE source of truth for the block/allow\n * decision — the hub imports + calls it rather than re-implementing the rules.\n *\n * FALSE-POSITIVE HISTORY (2026-08-27): the honeypot was named\n * `contact_url_confirm`, and browser/password-manager autofill (which ignores\n * `autocomplete=\"off\"` and matches \"url\"/\"confirm\" name heuristics) filled it\n * for REAL users — every production `BOT_DETECTED` in the log window was a\n * legitimate Chrome user whose autofill tripped the decoy. Three layers now\n * prevent a recurrence; keep all three when touching this system:\n *   1. The field name avoids every autofill-heuristic token (name/email/\n *      phone/url/website/confirm/company/address/code/…).\n *   2. `HoneypotField` renders `readOnly`-until-focus + password-manager\n *      ignore attributes — autofill skips read-only inputs.\n *   3. `evaluateHumanitySignals` forgives a filled decoy whose value was\n *      COPIED from another field in the same body (the autofill signature —\n *      a human, not a bot).\n */\n\n/** Hidden honeypot field name. Deliberately free of autofill-heuristic tokens (see module doc). */\nexport const HONEYPOT_FIELD = 'form_extra_note';\n/**\n * Prior honeypot field name — still EVALUATED (a stale-lib embedder's client\n * keeps its bot protection) and still STRIPPED before upstream forwarding.\n * Remove once no deployed embedder ships a lib older than the rename.\n */\nexport const LEGACY_HONEYPOT_FIELD = 'contact_url_confirm';\n/** Client-measured ms between form mount and submit. */\nexport const ELAPSED_MS_FIELD = 'form_elapsed_ms';\n/** Default minimum fill time (ms). A submit faster than this is treated as a bot. */\nexport const DEFAULT_MIN_FILL_MS = 700;\n\n/**\n * Every humanity-signal key that rides in a public form's POST body.\n * Server-side handlers that forward form payloads upstream (HubSpot booking,\n * CRM pushes, …) MUST strip by THIS array — never hand-typed strings — so a\n * field rename here propagates everywhere and the honeypot value can never\n * silently leak into an upstream record.\n */\nexport const HUMANITY_SIGNAL_KEYS = [HONEYPOT_FIELD, LEGACY_HONEYPOT_FIELD, ELAPSED_MS_FIELD] as const;\n\n/** Keyed wire object produced by `useHumanitySignals().getSignals()` and spread into the POST body. */\nexport type HumanitySignals = Record<string, string | number>;\n\n/** Result of {@link evaluateHumanitySignals}. */\nexport type HumanityVerdict = { ok: true; note?: 'honeypot_autofill' } | { ok: false; reason: 'honeypot' | 'too_fast' };\n\n/** Tolerant reader — never throws; missing/garbage timing → null. */\nexport function extractHumanitySignals(body: unknown): { honeypot: string; elapsedMs: number | null } {\n  const b = (body ?? {}) as Record<string, unknown>;\n  // Current field name first; a stale-lib client still posts the legacy name.\n  const rawHp = b[HONEYPOT_FIELD] ?? b[LEGACY_HONEYPOT_FIELD];\n  // A legit client always sends a STRING here (getSignals → ref.value ?? ''),\n  // so ANY present non-string value is a bot filling the decoy with a non-string\n  // to dodge the empty-check — coerce to a (non-empty) string so it still trips.\n  // null/undefined → '' = the correct \"field absent / unfilled\" allow case.\n  const honeypot = rawHp == null ? '' : String(rawHp);\n  const rawMs = b[ELAPSED_MS_FIELD];\n  const elapsedMs = typeof rawMs === 'number' && Number.isFinite(rawMs) ? rawMs : null;\n  return { honeypot, elapsedMs };\n}\n\n/**\n * Was the decoy value COPIED from a real field in the same body? That is the\n * autofill signature: browsers and password-manager extensions fill the hidden\n * input with the same value they put in a visible field (email, phone, …) —\n * a human with autofill, not a bot. Scans top-level string values plus one\n * nested level (the booking form's custom `formFields` object).\n */\nfunction honeypotCopiedFromAnotherField(body: unknown, honeypot: string): boolean {\n  const b = (body ?? {}) as Record<string, unknown>;\n  const signalKeys: readonly string[] = HUMANITY_SIGNAL_KEYS;\n  for (const [key, value] of Object.entries(b)) {\n    if (signalKeys.includes(key)) continue;\n    if (typeof value === 'string' && value === honeypot) return true;\n    if (value && typeof value === 'object' && !Array.isArray(value)) {\n      for (const nested of Object.values(value as Record<string, unknown>)) {\n        if (typeof nested === 'string' && nested === honeypot) return true;\n      }\n    }\n  }\n  return false;\n}\n\n/**\n * SINGLE decision fn for honeypot + timing (the hub's `verifyHuman` imports + calls this):\n * - honeypot non-empty → bot (real users never fill the off-screen field) — UNLESS the\n *   value was copied from another field in the body (autofill reached the decoy → human;\n *   the verdict carries `note: 'honeypot_autofill'` so the caller can log it)\n * - elapsed below `minFillMs` → bot (humans take time; a MISSING timing value never blocks)\n */\nexport function evaluateHumanitySignals(body: unknown, opts: { minFillMs: number }): HumanityVerdict {\n  const { honeypot, elapsedMs } = extractHumanitySignals(body);\n  const filled = honeypot.trim() !== '';\n  if (filled && !honeypotCopiedFromAnotherField(body, honeypot)) {\n    return { ok: false, reason: 'honeypot' };\n  }\n  if (elapsedMs !== null && elapsedMs < opts.minFillMs) return { ok: false, reason: 'too_fast' };\n  return filled ? { ok: true, note: 'honeypot_autofill' } : { ok: true };\n}\n\n/** Parse a comma-separated env string → trimmed, non-empty entries (undefined → []). */\nexport const splitCsvEnv = (s?: string): string[] =>\n  s\n    ?.split(',')\n    .map(t => t.trim())\n    .filter(Boolean) ?? [];\n"]}

package/dist/utils/index.cjs

@@ -4529,23 +4529,41 @@ function buildDefaultHref(basePath, slug) {
 }
 
 // src/utils/humanity-signals.ts
-var HONEYPOT_FIELD = "contact_url_confirm";
+var HONEYPOT_FIELD = "form_extra_note";
+var LEGACY_HONEYPOT_FIELD = "contact_url_confirm";
 var ELAPSED_MS_FIELD = "form_elapsed_ms";
 var DEFAULT_MIN_FILL_MS = 700;
-var HUMANITY_SIGNAL_KEYS = [HONEYPOT_FIELD, ELAPSED_MS_FIELD];
+var HUMANITY_SIGNAL_KEYS = [HONEYPOT_FIELD, LEGACY_HONEYPOT_FIELD, ELAPSED_MS_FIELD];
 function extractHumanitySignals(body) {
   const b = body ?? {};
-  const rawHp = b[HONEYPOT_FIELD];
+  const rawHp = b[HONEYPOT_FIELD] ?? b[LEGACY_HONEYPOT_FIELD];
   const honeypot = rawHp == null ? "" : String(rawHp);
   const rawMs = b[ELAPSED_MS_FIELD];
   const elapsedMs = typeof rawMs === "number" && Number.isFinite(rawMs) ? rawMs : null;
   return { honeypot, elapsedMs };
 }
+function honeypotCopiedFromAnotherField(body, honeypot) {
+  const b = body ?? {};
+  const signalKeys = HUMANITY_SIGNAL_KEYS;
+  for (const [key, value] of Object.entries(b)) {
+    if (signalKeys.includes(key)) continue;
+    if (typeof value === "string" && value === honeypot) return true;
+    if (value && typeof value === "object" && !Array.isArray(value)) {
+      for (const nested of Object.values(value)) {
+        if (typeof nested === "string" && nested === honeypot) return true;
+      }
+    }
+  }
+  return false;
+}
 function evaluateHumanitySignals(body, opts) {
   const { honeypot, elapsedMs } = extractHumanitySignals(body);
-  if (honeypot.trim() !== "") return { ok: false, reason: "honeypot" };
+  const filled = honeypot.trim() !== "";
+  if (filled && !honeypotCopiedFromAnotherField(body, honeypot)) {
+    return { ok: false, reason: "honeypot" };
+  }
   if (elapsedMs !== null && elapsedMs < opts.minFillMs) return { ok: false, reason: "too_fast" };
-  return { ok: true };
+  return filled ? { ok: true, note: "honeypot_autofill" } : { ok: true };
 }
 var splitCsvEnv = (s) => s?.split(",").map((t) => t.trim()).filter(Boolean) ?? [];
 
@@ -4945,6 +4963,7 @@ exports.HONEYPOT_FIELD = HONEYPOT_FIELD;
 exports.HUB_HEADER_OFFSET_PX = HUB_HEADER_OFFSET_PX;
 exports.HUMANITY_SIGNAL_KEYS = HUMANITY_SIGNAL_KEYS;
 exports.ICON_REGISTRY = ICON_REGISTRY;
+exports.LEGACY_HONEYPOT_FIELD = LEGACY_HONEYPOT_FIELD;
 exports.MAX_MONTH_OFFSET = MAX_MONTH_OFFSET;
 exports.OPENFRAME_DEV_SECTIONS = OPENFRAME_DEV_SECTIONS;
 exports.OS_PLATFORMS = OS_PLATFORMS;