@flamingo-stack/openframe-frontend-core 0.0.572 → 0.0.573-1933.5266.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flamingo-stack/openframe-frontend-core",
-  "version": "0.0.572",
+  "version": "0.0.573-1933.5266.1",
   "description": "Shared design system and components for all Flamingo platforms",
   "type": "module",
   "main": "./dist/index.js",

package/src/components/ui/honeypot-field.tsx

@@ -13,13 +13,39 @@ import { forwardRef } from 'react';
  * <label> (avoids id coupling); `aria-hidden` + `tabIndex={-1}` keep it out of
  * the accessibility tree and tab order.
  *
+ * AUTOFILL-PROOFING (load-bearing — real users were 403'd when autofill filled
+ * the decoy; see humanity-signals.ts module doc): browsers ignore
+ * `autocomplete="off"` for address-like fields, so the input is `readOnly`
+ * until focused — autofill and password managers skip read-only inputs, while
+ * a DOM-driving bot that focuses the field to type into it lifts the guard and
+ * still trips the trap. The `data-*` attributes opt out of the major password
+ * managers (1Password, LastPass, Bitwarden, Dashlane) by their documented
+ * ignore contracts. React never re-applies the prop after the focus handler
+ * flips the DOM property (same-value props aren't re-committed), so the
+ * lift-on-focus sticks.
+ *
  * forwardRef so `<HoneypotField {...honeypotInputProps} />` (which carries the
  * ref from useHumanitySignals) works on both React 18 and 19.
  */
 export const HoneypotField = forwardRef<HTMLInputElement, { name: string }>(function HoneypotFieldImpl({ name }, ref) {
   return (
     <div aria-hidden="true" className="pointer-events-none absolute -m-px h-px w-px overflow-hidden p-0 opacity-0">
-      <input ref={ref} type="text" name={name} tabIndex={-1} autoComplete="off" />
+      <input
+        ref={ref}
+        type="text"
+        name={name}
+        tabIndex={-1}
+        autoComplete="off"
+        readOnly
+        onFocus={e => {
+          const input = e.currentTarget;
+          input.readOnly = false;
+        }}
+        data-1p-ignore="true"
+        data-lpignore="true"
+        data-bwignore="true"
+        data-form-type="other"
+      />
     </div>
   );
 });

package/src/hooks/use-meeting-booking.ts

@@ -31,9 +31,9 @@ import { MAX_MONTH_OFFSET } from '../utils/hubspot-meetings-convention';
  * it keeps rendering (with nothing selectable yet) while only the times column
  * — the part that genuinely has no answer — shows a placeholder.
  *
- * `staleTime` is deliberately short: HubSpot slots go stale in about a minute,
- * and a slot that is gone by the time it is clicked costs a booking. Fresh
- * enough to trust, cached enough not to blink.
+ * `staleTime` is ZERO: the host serves availability live (no-store), and a
+ * cached month re-shown while paging back is organizer-visible staleness. A
+ * slot gone by the time it is clicked costs a booking — always refetch.
  *
  * Booking: a mutation, guarded so a second submit can't start while one is in
  * flight (the transport never retries POST — this is the only double-booking
@@ -60,8 +60,10 @@ const KNOWN_CODES: MeetingBookingErrorCode[] = [
   'MEETING_UNAVAILABLE',
 ];
 
-/** ~half HubSpot's own slot volatility window — see the docblock. */
-const AVAILABILITY_STALE_MS = 30_000;
+/** Always refetch — availability is served live (no-store) by the host; a
+ *  cached month shown while paging back is exactly the staleness the server
+ *  layers were stripped to kill (2026-08-27). */
+const AVAILABILITY_STALE_MS = 0;
 
 /** Query key for one month of one link. Exported so a host can prefetch or
  *  invalidate a month it knows changed (e.g. after booking elsewhere). */

package/src/utils/__tests__/hubspot-meetings-convention.test.ts

@@ -14,6 +14,7 @@ import {
   parseSchedulingLinkName,
   schedulingAudienceKey,
 } from '../hubspot-meetings-convention';
+import { HUMANITY_SIGNAL_KEYS } from '../humanity-signals';
 
 describe('slug shape validator', () => {
   it('allows N segments and rejects invalid characters', () => {
@@ -150,11 +151,12 @@ describe('makeBookingSchema × SUPPORTED_FORM_FIELD_TYPES', () => {
 
   it('strips unknown keys (humanity signals ride alongside, read raw pre-parse)', () => {
     const schema = makeBookingSchema([], null);
-    const parsed = schema.safeParse({ ...base, contact_url_confirm: '', form_elapsed_ms: 4200 });
+    const signals = Object.fromEntries(HUMANITY_SIGNAL_KEYS.map(key => [key, key === 'form_elapsed_ms' ? 4200 : '']));
+    const parsed = schema.safeParse({ ...base, ...signals });
     // Throw rather than `if (parsed.success)`: the guard has to narrow the
     // discriminated union AND fail the test, and a conditional `expect` would
     // pass silently the day the parse starts failing.
     if (!parsed.success) throw new Error(`expected a successful parse: ${JSON.stringify(parsed.error.issues)}`);
-    expect('contact_url_confirm' in parsed.data).toBe(false);
+    for (const key of HUMANITY_SIGNAL_KEYS) expect(key in parsed.data).toBe(false);
   });
 });

package/src/utils/__tests__/humanity-signals.test.ts

@@ -0,0 +1,75 @@
+import { describe, expect, it } from 'vitest';
+
+import {
+  DEFAULT_MIN_FILL_MS,
+  ELAPSED_MS_FIELD,
+  evaluateHumanitySignals,
+  extractHumanitySignals,
+  HONEYPOT_FIELD,
+  LEGACY_HONEYPOT_FIELD,
+} from '../humanity-signals';
+
+const opts = { minFillMs: DEFAULT_MIN_FILL_MS };
+
+describe('evaluateHumanitySignals', () => {
+  it('allows a clean human submission', () => {
+    expect(evaluateHumanitySignals({ email: 'a@b.co', [HONEYPOT_FIELD]: '', [ELAPSED_MS_FIELD]: 5000 }, opts)).toEqual({
+      ok: true,
+    });
+  });
+
+  it('blocks a filled honeypot with a value matching no other field', () => {
+    expect(evaluateHumanitySignals({ email: 'a@b.co', [HONEYPOT_FIELD]: 'https://spam.example' }, opts)).toEqual({
+      ok: false,
+      reason: 'honeypot',
+    });
+  });
+
+  it('blocks the legacy honeypot field name too (stale-lib embedder clients stay protected)', () => {
+    expect(evaluateHumanitySignals({ email: 'a@b.co', [LEGACY_HONEYPOT_FIELD]: 'filled' }, opts)).toEqual({
+      ok: false,
+      reason: 'honeypot',
+    });
+  });
+
+  it('forgives a honeypot value copied from another field (browser autofill signature)', () => {
+    expect(
+      evaluateHumanitySignals({ email: 'a@b.co', [HONEYPOT_FIELD]: 'a@b.co', [ELAPSED_MS_FIELD]: 5000 }, opts),
+    ).toEqual({ ok: true, note: 'honeypot_autofill' });
+  });
+
+  it('forgives autofill copied from a nested field (booking formFields)', () => {
+    expect(
+      evaluateHumanitySignals(
+        { email: 'a@b.co', formFields: { phone: '+1 555 0100' }, [HONEYPOT_FIELD]: '+1 555 0100' },
+        opts,
+      ),
+    ).toEqual({ ok: true, note: 'honeypot_autofill' });
+  });
+
+  it('still applies the timing check when the honeypot is autofill-forgiven', () => {
+    expect(
+      evaluateHumanitySignals({ email: 'a@b.co', [HONEYPOT_FIELD]: 'a@b.co', [ELAPSED_MS_FIELD]: 50 }, opts),
+    ).toEqual({ ok: false, reason: 'too_fast' });
+  });
+
+  it('a honeypot value matching only another SIGNAL key is not forgiven', () => {
+    expect(evaluateHumanitySignals({ [HONEYPOT_FIELD]: 'x', [LEGACY_HONEYPOT_FIELD]: 'x' }, opts)).toEqual({
+      ok: false,
+      reason: 'honeypot',
+    });
+  });
+
+  it('blocks sub-minimum fill time; missing timing never blocks', () => {
+    expect(evaluateHumanitySignals({ [ELAPSED_MS_FIELD]: 100 }, opts)).toEqual({ ok: false, reason: 'too_fast' });
+    expect(evaluateHumanitySignals({}, opts)).toEqual({ ok: true });
+  });
+});
+
+describe('extractHumanitySignals', () => {
+  it('coerces a non-string honeypot to a tripping string; prefers the current field name', () => {
+    expect(extractHumanitySignals({ [HONEYPOT_FIELD]: 123 }).honeypot).toBe('123');
+    expect(extractHumanitySignals({ [HONEYPOT_FIELD]: '', [LEGACY_HONEYPOT_FIELD]: 'old' }).honeypot).toBe('');
+    expect(extractHumanitySignals({ [LEGACY_HONEYPOT_FIELD]: 'old' }).honeypot).toBe('old');
+  });
+});

package/src/utils/humanity-signals.ts

@@ -11,10 +11,30 @@
  * field real users never fill) and timing (ms from form mount to submit).
  * `evaluateHumanitySignals` is the SINGLE source of truth for the block/allow
  * decision — the hub imports + calls it rather than re-implementing the rules.
+ *
+ * FALSE-POSITIVE HISTORY (2026-08-27): the honeypot was named
+ * `contact_url_confirm`, and browser/password-manager autofill (which ignores
+ * `autocomplete="off"` and matches "url"/"confirm" name heuristics) filled it
+ * for REAL users — every production `BOT_DETECTED` in the log window was a
+ * legitimate Chrome user whose autofill tripped the decoy. Three layers now
+ * prevent a recurrence; keep all three when touching this system:
+ *   1. The field name avoids every autofill-heuristic token (name/email/
+ *      phone/url/website/confirm/company/address/code/…).
+ *   2. `HoneypotField` renders `readOnly`-until-focus + password-manager
+ *      ignore attributes — autofill skips read-only inputs.
+ *   3. `evaluateHumanitySignals` forgives a filled decoy whose value was
+ *      COPIED from another field in the same body (the autofill signature —
+ *      a human, not a bot).
  */
 
-/** Hidden honeypot field name. Innocuous + autofill-resistant (deliberately NOT name/email). */
-export const HONEYPOT_FIELD = 'contact_url_confirm';
+/** Hidden honeypot field name. Deliberately free of autofill-heuristic tokens (see module doc). */
+export const HONEYPOT_FIELD = 'form_extra_note';
+/**
+ * Prior honeypot field name — still EVALUATED (a stale-lib embedder's client
+ * keeps its bot protection) and still STRIPPED before upstream forwarding.
+ * Remove once no deployed embedder ships a lib older than the rename.
+ */
+export const LEGACY_HONEYPOT_FIELD = 'contact_url_confirm';
 /** Client-measured ms between form mount and submit. */
 export const ELAPSED_MS_FIELD = 'form_elapsed_ms';
 /** Default minimum fill time (ms). A submit faster than this is treated as a bot. */
@@ -27,18 +47,19 @@ export const DEFAULT_MIN_FILL_MS = 700;
  * field rename here propagates everywhere and the honeypot value can never
  * silently leak into an upstream record.
  */
-export const HUMANITY_SIGNAL_KEYS = [HONEYPOT_FIELD, ELAPSED_MS_FIELD] as const;
+export const HUMANITY_SIGNAL_KEYS = [HONEYPOT_FIELD, LEGACY_HONEYPOT_FIELD, ELAPSED_MS_FIELD] as const;
 
 /** Keyed wire object produced by `useHumanitySignals().getSignals()` and spread into the POST body. */
 export type HumanitySignals = Record<string, string | number>;
 
 /** Result of {@link evaluateHumanitySignals}. */
-export type HumanityVerdict = { ok: true } | { ok: false; reason: 'honeypot' | 'too_fast' };
+export type HumanityVerdict = { ok: true; note?: 'honeypot_autofill' } | { ok: false; reason: 'honeypot' | 'too_fast' };
 
 /** Tolerant reader — never throws; missing/garbage timing → null. */
 export function extractHumanitySignals(body: unknown): { honeypot: string; elapsedMs: number | null } {
   const b = (body ?? {}) as Record<string, unknown>;
-  const rawHp = b[HONEYPOT_FIELD];
+  // Current field name first; a stale-lib client still posts the legacy name.
+  const rawHp = b[HONEYPOT_FIELD] ?? b[LEGACY_HONEYPOT_FIELD];
   // A legit client always sends a STRING here (getSignals → ref.value ?? ''),
   // so ANY present non-string value is a bot filling the decoy with a non-string
   // to dodge the empty-check — coerce to a (non-empty) string so it still trips.
@@ -49,16 +70,43 @@ export function extractHumanitySignals(body: unknown): { honeypot: string; elaps
   return { honeypot, elapsedMs };
 }
 
+/**
+ * Was the decoy value COPIED from a real field in the same body? That is the
+ * autofill signature: browsers and password-manager extensions fill the hidden
+ * input with the same value they put in a visible field (email, phone, …) —
+ * a human with autofill, not a bot. Scans top-level string values plus one
+ * nested level (the booking form's custom `formFields` object).
+ */
+function honeypotCopiedFromAnotherField(body: unknown, honeypot: string): boolean {
+  const b = (body ?? {}) as Record<string, unknown>;
+  const signalKeys: readonly string[] = HUMANITY_SIGNAL_KEYS;
+  for (const [key, value] of Object.entries(b)) {
+    if (signalKeys.includes(key)) continue;
+    if (typeof value === 'string' && value === honeypot) return true;
+    if (value && typeof value === 'object' && !Array.isArray(value)) {
+      for (const nested of Object.values(value as Record<string, unknown>)) {
+        if (typeof nested === 'string' && nested === honeypot) return true;
+      }
+    }
+  }
+  return false;
+}
+
 /**
  * SINGLE decision fn for honeypot + timing (the hub's `verifyHuman` imports + calls this):
- * - honeypot non-empty → bot (real users never fill the off-screen field)
+ * - honeypot non-empty → bot (real users never fill the off-screen field) — UNLESS the
+ *   value was copied from another field in the body (autofill reached the decoy → human;
+ *   the verdict carries `note: 'honeypot_autofill'` so the caller can log it)
  * - elapsed below `minFillMs` → bot (humans take time; a MISSING timing value never blocks)
  */
 export function evaluateHumanitySignals(body: unknown, opts: { minFillMs: number }): HumanityVerdict {
   const { honeypot, elapsedMs } = extractHumanitySignals(body);
-  if (honeypot.trim() !== '') return { ok: false, reason: 'honeypot' };
+  const filled = honeypot.trim() !== '';
+  if (filled && !honeypotCopiedFromAnotherField(body, honeypot)) {
+    return { ok: false, reason: 'honeypot' };
+  }
   if (elapsedMs !== null && elapsedMs < opts.minFillMs) return { ok: false, reason: 'too_fast' };
-  return { ok: true };
+  return filled ? { ok: true, note: 'honeypot_autofill' } : { ok: true };
 }
 
 /** Parse a comma-separated env string → trimmed, non-empty entries (undefined → []). */