@ingram-tech/bot-protection 0.1.2 → 0.3.0

package/README.md

@@ -59,6 +59,61 @@ export async function POST(request: Request) {
 `verifyHuman` also accepts a plain object (`{ formData: { ...fields } }`) and a
 `timing` window (`{ minMs, maxMs }`). Pass `botid: false` to skip layer 3.
 
+### Client forms (JSON POST)
+
+For client components that POST JSON instead of a server-rendered `<form>`, use
+the `/react` hook. It fetches the token from your route's `GET` on mount and
+hands you the fields to merge into the body. The route's `GET` returns the
+token; its `POST` verifies:
+
+```tsx
+"use client";
+import { HoneypotInput, useBotProtection } from "@ingram-tech/bot-protection/react";
+
+export function ContactForm() {
+	const { honeypotRef, botFields } = useBotProtection("/api/contact");
+
+	async function onSubmit(values: FormValues) {
+		await fetch("/api/contact", {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({ ...values, ...botFields() }),
+		});
+	}
+	return (
+		<form onSubmit={/* ... */}>
+			{/* ...your real fields... */}
+			<HoneypotInput inputRef={honeypotRef} />
+		</form>
+	);
+}
+```
+
+```ts
+// app/api/contact/route.ts
+import { createFormToken, verifyHuman } from "@ingram-tech/bot-protection";
+
+export const GET = () => Response.json({ token: createFormToken() });
+
+export async function POST(request: Request) {
+	const body = await request.json();
+	const result = await verifyHuman({ formData: body });
+	if (!result.ok) return Response.json({ ok: true }); // silently drop
+	// ...send the email / save the lead...
+	return Response.json({ ok: true });
+}
+```
+
+The honeypot field defaults to a name browsers and password managers won't
+autofill (filling it would falsely flag real users). If that default collides
+with a real field in your form, override it on both sides — they must match:
+
+```tsx
+<HoneypotField token={token} field="subject_trap" />
+// ...and on the server:
+await verifyHuman({ formData, honeypotField: "subject_trap" });
+```
+
 ## Vercel BotID wiring (per app, layer 3 only)
 
 ```ts

package/dist/fields.d.ts

@@ -2,8 +2,17 @@
  * Shared field names used by the honeypot component and the server verifier.
  * Kept in one place so the client and server never drift.
  */
-/** Hidden field real users never fill; bots auto-complete it. */
-export declare const HONEYPOT_FIELD = "company_url";
+/**
+ * Default hidden field real users never fill; bots auto-complete it.
+ *
+ * Deliberately *not* a name browsers or password managers autofill — anything
+ * containing company / url / email / name / phone / address / organization /
+ * website gets filled for real users, which trips the trap and silently drops
+ * legitimate submissions. If this default would collide with a real field in
+ * your form (e.g. a genuine "subject"), override it: pass the same name as
+ * `field` to `<HoneypotField/>` and `honeypotField` to `verifyHuman()`.
+ */
+export declare const HONEYPOT_FIELD = "contact_detail";
 /** Hidden field carrying the signed timing token. */
 export declare const TOKEN_FIELD = "_bp_token";
 //# sourceMappingURL=fields.d.ts.map

package/dist/fields.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fields.d.ts","sourceRoot":"","sources":["../src/fields.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,iEAAiE;AACjE,eAAO,MAAM,cAAc,gBAAgB,CAAC;AAE5C,qDAAqD;AACrD,eAAO,MAAM,WAAW,cAAc,CAAC"}
+{"version":3,"file":"fields.d.ts","sourceRoot":"","sources":["../src/fields.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,mBAAmB,CAAC;AAE/C,qDAAqD;AACrD,eAAO,MAAM,WAAW,cAAc,CAAC"}

package/dist/fields.js

@@ -2,8 +2,17 @@
  * Shared field names used by the honeypot component and the server verifier.
  * Kept in one place so the client and server never drift.
  */
-/** Hidden field real users never fill; bots auto-complete it. */
-export const HONEYPOT_FIELD = "company_url";
+/**
+ * Default hidden field real users never fill; bots auto-complete it.
+ *
+ * Deliberately *not* a name browsers or password managers autofill — anything
+ * containing company / url / email / name / phone / address / organization /
+ * website gets filled for real users, which trips the trap and silently drops
+ * legitimate submissions. If this default would collide with a real field in
+ * your form (e.g. a genuine "subject"), override it: pass the same name as
+ * `field` to `<HoneypotField/>` and `honeypotField` to `verifyHuman()`.
+ */
+export const HONEYPOT_FIELD = "contact_detail";
 /** Hidden field carrying the signed timing token. */
 export const TOKEN_FIELD = "_bp_token";
 //# sourceMappingURL=fields.js.map

package/dist/fields.js.map

@@ -1 +1 @@
-{"version":3,"file":"fields.js","sourceRoot":"","sources":["../src/fields.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,iEAAiE;AACjE,MAAM,CAAC,MAAM,cAAc,GAAG,aAAa,CAAC;AAE5C,qDAAqD;AACrD,MAAM,CAAC,MAAM,WAAW,GAAG,WAAW,CAAC"}
+{"version":3,"file":"fields.js","sourceRoot":"","sources":["../src/fields.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAE/C,qDAAqD;AACrD,MAAM,CAAC,MAAM,WAAW,GAAG,WAAW,CAAC"}

package/dist/honeypot.d.ts

@@ -1,4 +1,5 @@
-export declare const HoneypotField: ({ token }: {
+export declare const HoneypotField: ({ token, field, }: {
     token: string;
+    field?: string;
 }) => import("react/jsx-runtime").JSX.Element;
 //# sourceMappingURL=honeypot.d.ts.map

package/dist/honeypot.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"honeypot.d.ts","sourceRoot":"","sources":["../src/honeypot.tsx"],"names":[],"mappings":"AAuBA,eAAO,MAAM,aAAa,GAAI,WAAW;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,4CAczD,CAAC"}
+{"version":3,"file":"honeypot.d.ts","sourceRoot":"","sources":["../src/honeypot.tsx"],"names":[],"mappings":"AA2BA,eAAO,MAAM,aAAa,GAAI,mBAG3B;IACF,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CACf,4CAmBA,CAAC"}

package/dist/honeypot.js

@@ -9,6 +9,10 @@ import { HONEYPOT_FIELD, TOKEN_FIELD } from "./fields";
  * Real users never see or fill the honeypot (off-screen, aria-hidden,
  * tabIndex -1, autocomplete off); bots that fill every field give themselves
  * away.
+ *
+ * Pass `field` to use a custom honeypot name — it must match the
+ * `honeypotField` you pass to `verifyHuman()`, or the trap reads the wrong
+ * field and fails open.
  */
 const hidden = {
     position: "absolute",
@@ -18,5 +22,5 @@ const hidden = {
     height: "1px",
     overflow: "hidden",
 };
-export const HoneypotField = ({ token }) => (_jsxs("div", { "aria-hidden": "true", style: hidden, children: [_jsxs("label", { children: ["Leave this field empty", _jsx("input", { type: "text", name: HONEYPOT_FIELD, tabIndex: -1, autoComplete: "off", defaultValue: "" })] }), _jsx("input", { type: "hidden", name: TOKEN_FIELD, defaultValue: token })] }));
+export const HoneypotField = ({ token, field = HONEYPOT_FIELD, }) => (_jsxs("div", { "aria-hidden": "true", style: hidden, children: [_jsxs("label", { children: ["Leave this field empty", _jsx("input", { type: "text", name: field, tabIndex: -1, autoComplete: "off", defaultValue: "", "data-1p-ignore": true, "data-lpignore": "true", "data-form-type": "other" })] }), _jsx("input", { type: "hidden", name: TOKEN_FIELD, defaultValue: token })] }));
 //# sourceMappingURL=honeypot.js.map

package/dist/honeypot.js.map

@@ -1 +1 @@
-{"version":3,"file":"honeypot.js","sourceRoot":"","sources":["../src/honeypot.tsx"],"names":[],"mappings":";AACA,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAEvD;;;;;;;;;GASG;AAEH,MAAM,MAAM,GAAkB;IAC7B,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,SAAS;IACf,GAAG,EAAE,SAAS;IACd,KAAK,EAAE,KAAK;IACZ,MAAM,EAAE,KAAK;IACb,QAAQ,EAAE,QAAQ;CAClB,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,EAAE,KAAK,EAAqB,EAAE,EAAE,CAAC,CAC9D,8BAAiB,MAAM,EAAC,KAAK,EAAE,MAAM,aACpC,sDAEC,gBACC,IAAI,EAAC,MAAM,EACX,IAAI,EAAE,cAAc,EACpB,QAAQ,EAAE,CAAC,CAAC,EACZ,YAAY,EAAC,KAAK,EAClB,YAAY,EAAC,EAAE,GACd,IACK,EACR,gBAAO,IAAI,EAAC,QAAQ,EAAC,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,KAAK,GAAI,IAC1D,CACN,CAAC"}
+{"version":3,"file":"honeypot.js","sourceRoot":"","sources":["../src/honeypot.tsx"],"names":[],"mappings":";AACA,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAEvD;;;;;;;;;;;;;GAaG;AAEH,MAAM,MAAM,GAAkB;IAC7B,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,SAAS;IACf,GAAG,EAAE,SAAS;IACd,KAAK,EAAE,KAAK;IACZ,MAAM,EAAE,KAAK;IACb,QAAQ,EAAE,QAAQ;CAClB,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,EAC7B,KAAK,EACL,KAAK,GAAG,cAAc,GAItB,EAAE,EAAE,CAAC,CACL,8BAAiB,MAAM,EAAC,KAAK,EAAE,MAAM,aACpC,sDAEC,gBACC,IAAI,EAAC,MAAM,EACX,IAAI,EAAE,KAAK,EACX,QAAQ,EAAE,CAAC,CAAC,EACZ,YAAY,EAAC,KAAK,EAClB,YAAY,EAAC,EAAE,2CAID,MAAM,oBACL,OAAO,GACrB,IACK,EACR,gBAAO,IAAI,EAAC,QAAQ,EAAC,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,KAAK,GAAI,IAC1D,CACN,CAAC"}

package/dist/react.d.ts

@@ -0,0 +1,31 @@
+import { type RefObject } from "react";
+/**
+ * Client-side bot protection for forms that POST JSON to your own route.
+ *
+ * Fetches a signed timing token from `tokenEndpoint` on mount — the route's GET
+ * handler should return `{ token: createFormToken() }` — then exposes a honeypot
+ * ref plus a `botFields()` helper returning the fields to spread into the
+ * request body. The matching POST handler calls `verifyHuman({ formData: body })`.
+ *
+ * Pair with {@link HoneypotInput}, which renders the trap and wires the ref.
+ *
+ * @param tokenEndpoint - GET route that mints the token (e.g. "/api/contact").
+ *
+ * @example
+ * const { honeypotRef, botFields } = useBotProtection("/api/contact");
+ * // ...in the form:  <HoneypotInput inputRef={honeypotRef} />
+ * // ...on submit:    body: JSON.stringify({ ...values, ...botFields() })
+ */
+export declare function useBotProtection(tokenEndpoint: string): {
+    honeypotRef: RefObject<HTMLInputElement | null>;
+    botFields: () => Record<string, string>;
+};
+/**
+ * Visually-hidden honeypot input for {@link useBotProtection}. Real users never
+ * see or fill it (off-screen, aria-hidden, tabIndex -1, autofill opted out);
+ * bots that fill every field give themselves away.
+ */
+export declare function HoneypotInput({ inputRef, }: {
+    inputRef: RefObject<HTMLInputElement | null>;
+}): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=react.d.ts.map

package/dist/react.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"react.d.ts","sourceRoot":"","sources":["../src/react.tsx"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,SAAS,EAA+B,MAAM,OAAO,CAAC;AAGpE;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,CAAC,aAAa,EAAE,MAAM;;qBAW/B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;EAM5C;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,EAC7B,QAAQ,GACR,EAAE;IACF,QAAQ,EAAE,SAAS,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;CAC7C,2CAuBA"}

package/dist/react.js

@@ -0,0 +1,51 @@
+"use client";
+import { jsx as _jsx } from "react/jsx-runtime";
+import { useEffect, useRef, useState } from "react";
+import { HONEYPOT_FIELD, TOKEN_FIELD } from "./fields";
+/**
+ * Client-side bot protection for forms that POST JSON to your own route.
+ *
+ * Fetches a signed timing token from `tokenEndpoint` on mount — the route's GET
+ * handler should return `{ token: createFormToken() }` — then exposes a honeypot
+ * ref plus a `botFields()` helper returning the fields to spread into the
+ * request body. The matching POST handler calls `verifyHuman({ formData: body })`.
+ *
+ * Pair with {@link HoneypotInput}, which renders the trap and wires the ref.
+ *
+ * @param tokenEndpoint - GET route that mints the token (e.g. "/api/contact").
+ *
+ * @example
+ * const { honeypotRef, botFields } = useBotProtection("/api/contact");
+ * // ...in the form:  <HoneypotInput inputRef={honeypotRef} />
+ * // ...on submit:    body: JSON.stringify({ ...values, ...botFields() })
+ */
+export function useBotProtection(tokenEndpoint) {
+    const [token, setToken] = useState("");
+    const honeypotRef = useRef(null);
+    useEffect(() => {
+        fetch(tokenEndpoint)
+            .then((res) => res.json())
+            .then((data) => setToken(data.token ?? ""))
+            .catch(() => { });
+    }, [tokenEndpoint]);
+    const botFields = () => ({
+        [HONEYPOT_FIELD]: honeypotRef.current?.value ?? "",
+        [TOKEN_FIELD]: token,
+    });
+    return { honeypotRef, botFields };
+}
+/**
+ * Visually-hidden honeypot input for {@link useBotProtection}. Real users never
+ * see or fill it (off-screen, aria-hidden, tabIndex -1, autofill opted out);
+ * bots that fill every field give themselves away.
+ */
+export function HoneypotInput({ inputRef, }) {
+    return (_jsx("input", { ref: inputRef, type: "text", name: HONEYPOT_FIELD, tabIndex: -1, autoComplete: "off", "aria-hidden": "true", defaultValue: "", "data-1p-ignore": true, "data-lpignore": "true", "data-form-type": "other", style: {
+            position: "absolute",
+            left: "-9999px",
+            width: "1px",
+            height: "1px",
+            overflow: "hidden",
+        } }));
+}
+//# sourceMappingURL=react.js.map

package/dist/react.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"react.js","sourceRoot":"","sources":["../src/react.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,EAAkB,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAEvD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,gBAAgB,CAAC,aAAqB;IACrD,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IACvC,MAAM,WAAW,GAAG,MAAM,CAAmB,IAAI,CAAC,CAAC;IAEnD,SAAS,CAAC,GAAG,EAAE;QACd,KAAK,CAAC,aAAa,CAAC;aAClB,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;aACzB,IAAI,CAAC,CAAC,IAAwB,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;aAC9D,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACnB,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC;IAEpB,MAAM,SAAS,GAAG,GAA2B,EAAE,CAAC,CAAC;QAChD,CAAC,cAAc,CAAC,EAAE,WAAW,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;QAClD,CAAC,WAAW,CAAC,EAAE,KAAK;KACpB,CAAC,CAAC;IAEH,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,EAC7B,QAAQ,GAGR;IACA,OAAO,CACN,gBACC,GAAG,EAAE,QAAQ,EACb,IAAI,EAAC,MAAM,EACX,IAAI,EAAE,cAAc,EACpB,QAAQ,EAAE,CAAC,CAAC,EACZ,YAAY,EAAC,KAAK,iBACN,MAAM,EAClB,YAAY,EAAC,EAAE,2CAGD,MAAM,oBACL,OAAO,EACtB,KAAK,EAAE;YACN,QAAQ,EAAE,UAAU;YACpB,IAAI,EAAE,SAAS;YACf,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,QAAQ;SAClB,GACA,CACF,CAAC;AACH,CAAC"}

package/dist/verify.d.ts

@@ -11,6 +11,11 @@ export interface VerifyOptions {
     timing?: TokenCheck;
     /** Run the Vercel BotID layer (default true). Set false to skip. */
     botid?: boolean;
+    /**
+     * Honeypot field name to check. Must match the `field` rendered by
+     * `<HoneypotField/>`. Defaults to {@link HONEYPOT_FIELD}.
+     */
+    honeypotField?: string;
 }
 /**
  * Run all configured layers in order (cheapest first):

package/dist/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,UAAU,EAAmB,MAAM,SAAS,CAAC;AAE3D,MAAM,WAAW,YAAY;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC7B,0DAA0D;IAC1D,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7C,0CAA0C;IAC1C,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,oEAAoE;IACpE,KAAK,CAAC,EAAE,OAAO,CAAC;CAChB;AAUD;;;;;;;;;GASG;AACH,eAAO,MAAM,WAAW,GAAU,SAAS,aAAa,KAAG,OAAO,CAAC,YAAY,CAqB9E,CAAC"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,UAAU,EAAmB,MAAM,SAAS,CAAC;AAE3D,MAAM,WAAW,YAAY;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC7B,0DAA0D;IAC1D,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7C,0CAA0C;IAC1C,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,oEAAoE;IACpE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACvB;AAUD;;;;;;;;;GASG;AACH,eAAO,MAAM,WAAW,GAAU,SAAS,aAAa,KAAG,OAAO,CAAC,YAAY,CAsB9E,CAAC"}

package/dist/verify.js

@@ -19,7 +19,8 @@ const getField = (formData, name) => {
  * what tripped them.
  */
 export const verifyHuman = async (options) => {
-    if (getField(options.formData, HONEYPOT_FIELD).trim() !== "") {
+    const honeypotField = options.honeypotField ?? HONEYPOT_FIELD;
+    if (getField(options.formData, honeypotField).trim() !== "") {
         return { ok: false, reason: "honeypot" };
     }
     // Timing layer only applies when a secret is configured; otherwise it's

package/dist/verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,EAAmB,eAAe,EAAE,MAAM,SAAS,CAAC;AAiB3D,MAAM,QAAQ,GAAG,CAAC,QAAmC,EAAE,IAAY,EAAU,EAAE;IAC9E,MAAM,KAAK,GACV,QAAQ,YAAY,QAAQ;QAC3B,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;QACpB,CAAC,CAAE,QAAoC,CAAC,IAAI,CAAC,CAAC;IAChD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/C,CAAC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAAE,OAAsB,EAAyB,EAAE;IAClF,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC9D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC1C,CAAC;IAED,wEAAwE;IACxE,+EAA+E;IAC/E,IAAI,YAAY,EAAE,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,eAAe,CAC5B,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,EACvC,OAAO,CAAC,MAAM,CACd,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;IAC7B,CAAC;IAED,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QAC7B,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,EAAE,CAAC;QACnC,IAAI,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAClD,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACrB,CAAC,CAAC"}
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,EAAmB,eAAe,EAAE,MAAM,SAAS,CAAC;AAsB3D,MAAM,QAAQ,GAAG,CAAC,QAAmC,EAAE,IAAY,EAAU,EAAE;IAC9E,MAAM,KAAK,GACV,QAAQ,YAAY,QAAQ;QAC3B,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;QACpB,CAAC,CAAE,QAAoC,CAAC,IAAI,CAAC,CAAC;IAChD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/C,CAAC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAAE,OAAsB,EAAyB,EAAE;IAClF,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,cAAc,CAAC;IAC9D,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC7D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC1C,CAAC;IAED,wEAAwE;IACxE,+EAA+E;IAC/E,IAAI,YAAY,EAAE,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,eAAe,CAC5B,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,EACvC,OAAO,CAAC,MAAM,CACd,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;IAC7B,CAAC;IAED,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QAC7B,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,EAAE,CAAC;QACnC,IAAI,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAClD,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACrB,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@ingram-tech/bot-protection",
-	"version": "0.1.2",
+	"version": "0.3.0",
 	"description": "Invisible, layered bot protection for forms — honeypot + signed timing token + Vercel BotID.",
 	"license": "MIT",
 	"type": "module",
@@ -24,6 +24,10 @@
 			"types": "./dist/honeypot.d.ts",
 			"import": "./dist/honeypot.js"
 		},
+		"./react": {
+			"types": "./dist/react.d.ts",
+			"import": "./dist/react.js"
+		},
 		"./fields": {
 			"types": "./dist/fields.d.ts",
 			"import": "./dist/fields.js"
@@ -35,7 +39,7 @@
 		"test": "vitest run"
 	},
 	"devDependencies": {
-		"@ingram-tech/typescript-config": "0.1.0",
+		"@ingram-tech/typescript-config": "workspace:*",
 		"@types/node": "^20.0.0",
 		"@types/react": "^19.0.0",
 		"react": "^19.0.0",