@ingram-tech/bot-protection 0.1.1 → 0.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +10 -0
- package/dist/fields.d.ts +11 -2
- package/dist/fields.d.ts.map +1 -1
- package/dist/fields.js +11 -2
- package/dist/fields.js.map +1 -1
- package/dist/honeypot.d.ts +2 -1
- package/dist/honeypot.d.ts.map +1 -1
- package/dist/honeypot.js +5 -1
- package/dist/honeypot.js.map +1 -1
- package/dist/token.d.ts +5 -1
- package/dist/token.d.ts.map +1 -1
- package/dist/token.js +10 -2
- package/dist/token.js.map +1 -1
- package/dist/verify.d.ts +5 -0
- package/dist/verify.d.ts.map +1 -1
- package/dist/verify.js +10 -4
- package/dist/verify.js.map +1 -1
- package/package.json +2 -2
package/README.md
CHANGED
|
@@ -59,6 +59,16 @@ export async function POST(request: Request) {
|
|
|
59
59
|
`verifyHuman` also accepts a plain object (`{ formData: { ...fields } }`) and a
|
|
60
60
|
`timing` window (`{ minMs, maxMs }`). Pass `botid: false` to skip layer 3.
|
|
61
61
|
|
|
62
|
+
The honeypot field defaults to a name browsers and password managers won't
|
|
63
|
+
autofill (filling it would falsely flag real users). If that default collides
|
|
64
|
+
with a real field in your form, override it on both sides — they must match:
|
|
65
|
+
|
|
66
|
+
```tsx
|
|
67
|
+
<HoneypotField token={token} field="subject_trap" />
|
|
68
|
+
// ...and on the server:
|
|
69
|
+
await verifyHuman({ formData, honeypotField: "subject_trap" });
|
|
70
|
+
```
|
|
71
|
+
|
|
62
72
|
## Vercel BotID wiring (per app, layer 3 only)
|
|
63
73
|
|
|
64
74
|
```ts
|
package/dist/fields.d.ts
CHANGED
|
@@ -2,8 +2,17 @@
|
|
|
2
2
|
* Shared field names used by the honeypot component and the server verifier.
|
|
3
3
|
* Kept in one place so the client and server never drift.
|
|
4
4
|
*/
|
|
5
|
-
/**
|
|
6
|
-
|
|
5
|
+
/**
|
|
6
|
+
* Default hidden field real users never fill; bots auto-complete it.
|
|
7
|
+
*
|
|
8
|
+
* Deliberately *not* a name browsers or password managers autofill — anything
|
|
9
|
+
* containing company / url / email / name / phone / address / organization /
|
|
10
|
+
* website gets filled for real users, which trips the trap and silently drops
|
|
11
|
+
* legitimate submissions. If this default would collide with a real field in
|
|
12
|
+
* your form (e.g. a genuine "subject"), override it: pass the same name as
|
|
13
|
+
* `field` to `<HoneypotField/>` and `honeypotField` to `verifyHuman()`.
|
|
14
|
+
*/
|
|
15
|
+
export declare const HONEYPOT_FIELD = "contact_detail";
|
|
7
16
|
/** Hidden field carrying the signed timing token. */
|
|
8
17
|
export declare const TOKEN_FIELD = "_bp_token";
|
|
9
18
|
//# sourceMappingURL=fields.d.ts.map
|
package/dist/fields.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"fields.d.ts","sourceRoot":"","sources":["../src/fields.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH
|
|
1
|
+
{"version":3,"file":"fields.d.ts","sourceRoot":"","sources":["../src/fields.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,mBAAmB,CAAC;AAE/C,qDAAqD;AACrD,eAAO,MAAM,WAAW,cAAc,CAAC"}
|
package/dist/fields.js
CHANGED
|
@@ -2,8 +2,17 @@
|
|
|
2
2
|
* Shared field names used by the honeypot component and the server verifier.
|
|
3
3
|
* Kept in one place so the client and server never drift.
|
|
4
4
|
*/
|
|
5
|
-
/**
|
|
6
|
-
|
|
5
|
+
/**
|
|
6
|
+
* Default hidden field real users never fill; bots auto-complete it.
|
|
7
|
+
*
|
|
8
|
+
* Deliberately *not* a name browsers or password managers autofill — anything
|
|
9
|
+
* containing company / url / email / name / phone / address / organization /
|
|
10
|
+
* website gets filled for real users, which trips the trap and silently drops
|
|
11
|
+
* legitimate submissions. If this default would collide with a real field in
|
|
12
|
+
* your form (e.g. a genuine "subject"), override it: pass the same name as
|
|
13
|
+
* `field` to `<HoneypotField/>` and `honeypotField` to `verifyHuman()`.
|
|
14
|
+
*/
|
|
15
|
+
export const HONEYPOT_FIELD = "contact_detail";
|
|
7
16
|
/** Hidden field carrying the signed timing token. */
|
|
8
17
|
export const TOKEN_FIELD = "_bp_token";
|
|
9
18
|
//# sourceMappingURL=fields.js.map
|
package/dist/fields.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"fields.js","sourceRoot":"","sources":["../src/fields.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH
|
|
1
|
+
{"version":3,"file":"fields.js","sourceRoot":"","sources":["../src/fields.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAE/C,qDAAqD;AACrD,MAAM,CAAC,MAAM,WAAW,GAAG,WAAW,CAAC"}
|
package/dist/honeypot.d.ts
CHANGED
package/dist/honeypot.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"honeypot.d.ts","sourceRoot":"","sources":["../src/honeypot.tsx"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"honeypot.d.ts","sourceRoot":"","sources":["../src/honeypot.tsx"],"names":[],"mappings":"AA2BA,eAAO,MAAM,aAAa,GAAI,mBAG3B;IACF,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CACf,4CAmBA,CAAC"}
|
package/dist/honeypot.js
CHANGED
|
@@ -9,6 +9,10 @@ import { HONEYPOT_FIELD, TOKEN_FIELD } from "./fields";
|
|
|
9
9
|
* Real users never see or fill the honeypot (off-screen, aria-hidden,
|
|
10
10
|
* tabIndex -1, autocomplete off); bots that fill every field give themselves
|
|
11
11
|
* away.
|
|
12
|
+
*
|
|
13
|
+
* Pass `field` to use a custom honeypot name — it must match the
|
|
14
|
+
* `honeypotField` you pass to `verifyHuman()`, or the trap reads the wrong
|
|
15
|
+
* field and fails open.
|
|
12
16
|
*/
|
|
13
17
|
const hidden = {
|
|
14
18
|
position: "absolute",
|
|
@@ -18,5 +22,5 @@ const hidden = {
|
|
|
18
22
|
height: "1px",
|
|
19
23
|
overflow: "hidden",
|
|
20
24
|
};
|
|
21
|
-
export const HoneypotField = ({ token }) => (_jsxs("div", { "aria-hidden": "true", style: hidden, children: [_jsxs("label", { children: ["Leave this field empty", _jsx("input", { type: "text", name:
|
|
25
|
+
export const HoneypotField = ({ token, field = HONEYPOT_FIELD, }) => (_jsxs("div", { "aria-hidden": "true", style: hidden, children: [_jsxs("label", { children: ["Leave this field empty", _jsx("input", { type: "text", name: field, tabIndex: -1, autoComplete: "off", defaultValue: "", "data-1p-ignore": true, "data-lpignore": "true", "data-form-type": "other" })] }), _jsx("input", { type: "hidden", name: TOKEN_FIELD, defaultValue: token })] }));
|
|
22
26
|
//# sourceMappingURL=honeypot.js.map
|
package/dist/honeypot.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"honeypot.js","sourceRoot":"","sources":["../src/honeypot.tsx"],"names":[],"mappings":";AACA,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAEvD
|
|
1
|
+
{"version":3,"file":"honeypot.js","sourceRoot":"","sources":["../src/honeypot.tsx"],"names":[],"mappings":";AACA,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAEvD;;;;;;;;;;;;;GAaG;AAEH,MAAM,MAAM,GAAkB;IAC7B,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,SAAS;IACf,GAAG,EAAE,SAAS;IACd,KAAK,EAAE,KAAK;IACZ,MAAM,EAAE,KAAK;IACb,QAAQ,EAAE,QAAQ;CAClB,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,EAC7B,KAAK,EACL,KAAK,GAAG,cAAc,GAItB,EAAE,EAAE,CAAC,CACL,8BAAiB,MAAM,EAAC,KAAK,EAAE,MAAM,aACpC,sDAEC,gBACC,IAAI,EAAC,MAAM,EACX,IAAI,EAAE,KAAK,EACX,QAAQ,EAAE,CAAC,CAAC,EACZ,YAAY,EAAC,KAAK,EAClB,YAAY,EAAC,EAAE,2CAID,MAAM,oBACL,OAAO,GACrB,IACK,EACR,gBAAO,IAAI,EAAC,QAAQ,EAAC,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,KAAK,GAAI,IAC1D,CACN,CAAC"}
|
package/dist/token.d.ts
CHANGED
|
@@ -1,4 +1,8 @@
|
|
|
1
|
-
/**
|
|
1
|
+
/**
|
|
2
|
+
* Mint a token. Call server-side when rendering the form. If
|
|
3
|
+
* BOT_PROTECTION_SECRET isn't configured, returns "" (the timing layer is
|
|
4
|
+
* disabled) rather than throwing, so a misconfigured site still works.
|
|
5
|
+
*/
|
|
2
6
|
export declare const createFormToken: () => string;
|
|
3
7
|
export interface TokenCheck {
|
|
4
8
|
/** Reject submissions faster than this (default 2000ms — bots are instant). */
|
package/dist/token.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAYA
|
|
1
|
+
{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAYA;;;;GAIG;AACH,eAAO,MAAM,eAAe,QAAO,MASlC,CAAC;AAEF,MAAM,WAAW,UAAU;IAC1B,+EAA+E;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,WAAW;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,6EAA6E;AAC7E,eAAO,MAAM,eAAe,GAC3B,OAAO,MAAM,GAAG,SAAS,GAAG,IAAI,EAChC,mBAA0C,UAAe,KACvD,WAqBF,CAAC"}
|
package/dist/token.js
CHANGED
|
@@ -1,13 +1,21 @@
|
|
|
1
1
|
import { createHmac, timingSafeEqual } from "node:crypto";
|
|
2
|
-
import { getSecret } from "./keys";
|
|
2
|
+
import { getSecret, isConfigured } from "./keys";
|
|
3
3
|
/**
|
|
4
4
|
* Signed timing token: `<timestamp>.<hmac>`. The timestamp records when the
|
|
5
5
|
* form was rendered; the HMAC (keyed by BOT_PROTECTION_SECRET) prevents a bot
|
|
6
6
|
* from forging an older timestamp to defeat the "submitted too fast" check.
|
|
7
7
|
*/
|
|
8
8
|
const sign = (ts, secret) => createHmac("sha256", secret).update(ts).digest("hex");
|
|
9
|
-
/**
|
|
9
|
+
/**
|
|
10
|
+
* Mint a token. Call server-side when rendering the form. If
|
|
11
|
+
* BOT_PROTECTION_SECRET isn't configured, returns "" (the timing layer is
|
|
12
|
+
* disabled) rather than throwing, so a misconfigured site still works.
|
|
13
|
+
*/
|
|
10
14
|
export const createFormToken = () => {
|
|
15
|
+
if (!isConfigured()) {
|
|
16
|
+
console.warn("@ingram-tech/bot-protection: BOT_PROTECTION_SECRET not set — timing token disabled.");
|
|
17
|
+
return "";
|
|
18
|
+
}
|
|
11
19
|
const ts = Date.now().toString();
|
|
12
20
|
return `${ts}.${sign(ts, getSecret())}`;
|
|
13
21
|
};
|
package/dist/token.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"token.js","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;
|
|
1
|
+
{"version":3,"file":"token.js","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAEjD;;;;GAIG;AAEH,MAAM,IAAI,GAAG,CAAC,EAAU,EAAE,MAAc,EAAU,EAAE,CACnD,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAEvD;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,GAAW,EAAE;IAC3C,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;QACrB,OAAO,CAAC,IAAI,CACX,qFAAqF,CACrF,CAAC;QACF,OAAO,EAAE,CAAC;IACX,CAAC;IACD,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;IACjC,OAAO,GAAG,EAAE,IAAI,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;AACzC,CAAC,CAAC;AAcF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAAG,CAC9B,KAAgC,EAChC,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,KAAiB,EAAE,EAC3C,EAAE;IAChB,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAE1D,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC9D,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAEjC,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IACvC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAC/C,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAC7E,IAAI,OAAO,GAAG,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC9D,IAAI,OAAO,GAAG,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAE7D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACrB,CAAC,CAAC"}
|
package/dist/verify.d.ts
CHANGED
|
@@ -11,6 +11,11 @@ export interface VerifyOptions {
|
|
|
11
11
|
timing?: TokenCheck;
|
|
12
12
|
/** Run the Vercel BotID layer (default true). Set false to skip. */
|
|
13
13
|
botid?: boolean;
|
|
14
|
+
/**
|
|
15
|
+
* Honeypot field name to check. Must match the `field` rendered by
|
|
16
|
+
* `<HoneypotField/>`. Defaults to {@link HONEYPOT_FIELD}.
|
|
17
|
+
*/
|
|
18
|
+
honeypotField?: string;
|
|
14
19
|
}
|
|
15
20
|
/**
|
|
16
21
|
* Run all configured layers in order (cheapest first):
|
package/dist/verify.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,UAAU,EAAmB,MAAM,SAAS,CAAC;AAE3D,MAAM,WAAW,YAAY;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC7B,0DAA0D;IAC1D,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7C,0CAA0C;IAC1C,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,oEAAoE;IACpE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACvB;AAUD;;;;;;;;;GASG;AACH,eAAO,MAAM,WAAW,GAAU,SAAS,aAAa,KAAG,OAAO,CAAC,YAAY,CAsB9E,CAAC"}
|
package/dist/verify.js
CHANGED
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
import { checkBot } from "./botid";
|
|
2
2
|
import { HONEYPOT_FIELD, TOKEN_FIELD } from "./fields";
|
|
3
|
+
import { isConfigured } from "./keys";
|
|
3
4
|
import { verifyFormToken } from "./token";
|
|
4
5
|
const getField = (formData, name) => {
|
|
5
6
|
const value = formData instanceof FormData
|
|
@@ -18,12 +19,17 @@ const getField = (formData, name) => {
|
|
|
18
19
|
* what tripped them.
|
|
19
20
|
*/
|
|
20
21
|
export const verifyHuman = async (options) => {
|
|
21
|
-
|
|
22
|
+
const honeypotField = options.honeypotField ?? HONEYPOT_FIELD;
|
|
23
|
+
if (getField(options.formData, honeypotField).trim() !== "") {
|
|
22
24
|
return { ok: false, reason: "honeypot" };
|
|
23
25
|
}
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
26
|
+
// Timing layer only applies when a secret is configured; otherwise it's
|
|
27
|
+
// disabled (honeypot + BotID still run) so a misconfigured site keeps working.
|
|
28
|
+
if (isConfigured()) {
|
|
29
|
+
const token = verifyFormToken(getField(options.formData, TOKEN_FIELD), options.timing);
|
|
30
|
+
if (!token.ok)
|
|
31
|
+
return token;
|
|
32
|
+
}
|
|
27
33
|
if (options.botid !== false) {
|
|
28
34
|
const { isBot } = await checkBot();
|
|
29
35
|
if (isBot)
|
package/dist/verify.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,EAAmB,eAAe,EAAE,MAAM,SAAS,CAAC;
|
|
1
|
+
{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,EAAmB,eAAe,EAAE,MAAM,SAAS,CAAC;AAsB3D,MAAM,QAAQ,GAAG,CAAC,QAAmC,EAAE,IAAY,EAAU,EAAE;IAC9E,MAAM,KAAK,GACV,QAAQ,YAAY,QAAQ;QAC3B,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;QACpB,CAAC,CAAE,QAAoC,CAAC,IAAI,CAAC,CAAC;IAChD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/C,CAAC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAAE,OAAsB,EAAyB,EAAE;IAClF,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,cAAc,CAAC;IAC9D,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC7D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC1C,CAAC;IAED,wEAAwE;IACxE,+EAA+E;IAC/E,IAAI,YAAY,EAAE,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,eAAe,CAC5B,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,EACvC,OAAO,CAAC,MAAM,CACd,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;IAC7B,CAAC;IAED,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QAC7B,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,EAAE,CAAC;QACnC,IAAI,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAClD,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACrB,CAAC,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@ingram-tech/bot-protection",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.2.0",
|
|
4
4
|
"description": "Invisible, layered bot protection for forms — honeypot + signed timing token + Vercel BotID.",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"type": "module",
|
|
@@ -35,7 +35,7 @@
|
|
|
35
35
|
"test": "vitest run"
|
|
36
36
|
},
|
|
37
37
|
"devDependencies": {
|
|
38
|
-
"@ingram-tech/typescript-config": "
|
|
38
|
+
"@ingram-tech/typescript-config": "workspace:*",
|
|
39
39
|
"@types/node": "^20.0.0",
|
|
40
40
|
"@types/react": "^19.0.0",
|
|
41
41
|
"react": "^19.0.0",
|