@ingram-tech/bot-protection 0.3.1 → 0.4.0

package/README.md

@@ -17,7 +17,10 @@ bun add @ingram-tech/bot-protection
 bun add botid
 ```
 
-Set `BOT_PROTECTION_SECRET` (e.g. `openssl rand -hex 32`).
+Set `BOT_PROTECTION_SECRET` (e.g. `openssl rand -hex 32`). To rotate it, set a
+comma-separated list (`new,old`): tokens sign with the first secret and verify
+against all of them, so in-flight forms keep working; drop the old one after
+the token window (1h) has passed.
 
 ## Use
 
@@ -27,6 +30,12 @@ Set `BOT_PROTECTION_SECRET` (e.g. `openssl rand -hex 32`).
 import { createFormToken } from "@ingram-tech/bot-protection";
 import { HoneypotField } from "@ingram-tech/bot-protection/honeypot";
 
+// The page that mints the token MUST render per-request. On a statically
+// prerendered (or ISR/cached) page the timestamp is the BUILD time: once the
+// deploy is older than the token window (default 1h), every real submission
+// verifies as "expired" and is silently dropped.
+export const dynamic = "force-dynamic";
+
 export default function ContactPage() {
 	const token = createFormToken(); // server component / server-side
 	return (
@@ -39,6 +48,9 @@ export default function ContactPage() {
 }
 ```
 
+Prefer keeping the page static? Mint the token from a route handler instead
+and fetch it client-side — that's exactly what the `/react` hook does (below).
+
 **Verify on submit** (API route or server action):
 
 ```ts
@@ -71,7 +83,9 @@ token; its `POST` verifies:
 import { HoneypotInput, useBotProtection } from "@ingram-tech/bot-protection/react";
 
 export function ContactForm() {
-	const { honeypotRef, botFields } = useBotProtection("/api/contact");
+	// `ready` flips true once the token fetch resolves — gate the submit button
+	// on it if you don't want early submissions treated as bot-ish.
+	const { honeypotRef, botFields, ready } = useBotProtection("/api/contact");
 
 	async function onSubmit(values: FormValues) {
 		await fetch("/api/contact", {
@@ -93,6 +107,10 @@ export function ContactForm() {
 // app/api/contact/route.ts
 import { createFormToken, verifyHuman } from "@ingram-tech/bot-protection";
 
+// Same freshness rule as above: the GET must not be cached, or the token
+// ages with the cache entry and eventually expires every submission.
+export const dynamic = "force-dynamic";
+
 export const GET = () => Response.json({ token: createFormToken() });
 
 export async function POST(request: Request) {

package/dist/botid.d.ts

@@ -7,6 +7,11 @@
  *   - if it isn't installed (or the call throws off-Vercel/in dev), we degrade
  *     to "not a bot" rather than blocking real users.
  *
+ * The degrade is logged once per process: bundler file-tracing can exclude
+ * `botid/server` from a deployed function even when the package is installed
+ * (nothing imports it statically), and a silently disabled layer 3 is
+ * otherwise indistinguishable from "no bots today".
+ *
  * App-side wiring (per site, not in this package): add `withBotId(nextConfig)`
  * in next.config and `initBotId({ protect: [...] })` in instrumentation-client.
  */

package/dist/botid.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"botid.d.ts","sourceRoot":"","sources":["../src/botid.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,eAAO,MAAM,QAAQ,QAAa,OAAO,CAAC;IAAE,KAAK,EAAE,OAAO,CAAA;CAAE,CAW3D,CAAC"}
+{"version":3,"file":"botid.d.ts","sourceRoot":"","sources":["../src/botid.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAYH,eAAO,MAAM,QAAQ,QAAa,OAAO,CAAC;IAAE,KAAK,EAAE,OAAO,CAAA;CAAE,CAmB3D,CAAC"}

package/dist/botid.js

@@ -7,17 +7,37 @@
  *   - if it isn't installed (or the call throws off-Vercel/in dev), we degrade
  *     to "not a bot" rather than blocking real users.
  *
+ * The degrade is logged once per process: bundler file-tracing can exclude
+ * `botid/server` from a deployed function even when the package is installed
+ * (nothing imports it statically), and a silently disabled layer 3 is
+ * otherwise indistinguishable from "no bots today".
+ *
  * App-side wiring (per site, not in this package): add `withBotId(nextConfig)`
  * in next.config and `initBotId({ protect: [...] })` in instrumentation-client.
  */
+let warnedUnavailable = false;
+const warnOnce = (detail) => {
+    if (warnedUnavailable)
+        return;
+    warnedUnavailable = true;
+    console.warn(`@ingram-tech/bot-protection: BotID layer unavailable, degrading to "not a bot" (${detail}).`);
+};
 export const checkBot = async () => {
     try {
         // Non-literal specifier: keeps tsc from requiring `botid` at build time.
         const specifier = "botid/server";
+        // Shape-checked below rather than trusted — the cast only names what we
+        // probe for.
         const mod = (await import(specifier));
-        return await mod.checkBotId();
+        if (typeof mod.checkBotId !== "function") {
+            warnOnce("botid/server has no checkBotId export");
+            return { isBot: false };
+        }
+        const result = await mod.checkBotId();
+        return { isBot: result?.isBot === true };
     }
-    catch {
+    catch (error) {
+        warnOnce(error instanceof Error ? error.message : String(error));
         return { isBot: false };
     }
 };

package/dist/botid.js.map

@@ -1 +1 @@
-{"version":3,"file":"botid.js","sourceRoot":"","sources":["../src/botid.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,CAAC,MAAM,QAAQ,GAAG,KAAK,IAAiC,EAAE;IAC/D,IAAI,CAAC;QACJ,yEAAyE;QACzE,MAAM,SAAS,GAAG,cAAc,CAAC;QACjC,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,CAEnC,CAAC;QACF,OAAO,MAAM,GAAG,CAAC,UAAU,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC;AACF,CAAC,CAAC"}
+{"version":3,"file":"botid.js","sourceRoot":"","sources":["../src/botid.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,IAAI,iBAAiB,GAAG,KAAK,CAAC;AAE9B,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAQ,EAAE;IACzC,IAAI,iBAAiB;QAAE,OAAO;IAC9B,iBAAiB,GAAG,IAAI,CAAC;IACzB,OAAO,CAAC,IAAI,CACX,mFAAmF,MAAM,IAAI,CAC7F,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,QAAQ,GAAG,KAAK,IAAiC,EAAE;IAC/D,IAAI,CAAC;QACJ,yEAAyE;QACzE,MAAM,SAAS,GAAG,cAAc,CAAC;QACjC,wEAAwE;QACxE,aAAa;QACb,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,CAEnC,CAAC;QACF,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;YAC1C,QAAQ,CAAC,uCAAuC,CAAC,CAAC;YAClD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACzB,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,EAAE,CAAC;QACtC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,KAAK,IAAI,EAAE,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,QAAQ,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACjE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC;AACF,CAAC,CAAC"}

package/dist/honeypot.js

@@ -1,5 +1,5 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import { HONEYPOT_FIELD, TOKEN_FIELD } from "./fields";
+import { HONEYPOT_FIELD, TOKEN_FIELD } from "./fields.js";
 /**
  * Visually-hidden honeypot + signed timing token, dropped inside any <form>.
  *

package/dist/honeypot.js.map

@@ -1 +1 @@
-{"version":3,"file":"honeypot.js","sourceRoot":"","sources":["../src/honeypot.tsx"],"names":[],"mappings":";AACA,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAEvD;;;;;;;;;;;;;GAaG;AAEH,MAAM,MAAM,GAAkB;IAC7B,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,SAAS;IACf,GAAG,EAAE,SAAS;IACd,KAAK,EAAE,KAAK;IACZ,MAAM,EAAE,KAAK;IACb,QAAQ,EAAE,QAAQ;CAClB,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,EAC7B,KAAK,EACL,KAAK,GAAG,cAAc,GAItB,EAAE,EAAE,CAAC,CACL,8BAAiB,MAAM,EAAC,KAAK,EAAE,MAAM,aACpC,sDAGC,gBACC,IAAI,EAAC,MAAM,EACX,IAAI,EAAE,KAAK,EACX,QAAQ,EAAE,CAAC,CAAC,EACZ,YAAY,EAAC,KAAK,EAClB,YAAY,EAAC,EAAE,2CAID,MAAM,oBACL,OAAO,GACrB,IACK,EACR,gBAAO,IAAI,EAAC,QAAQ,EAAC,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,KAAK,GAAI,IAC1D,CACN,CAAC"}
+{"version":3,"file":"honeypot.js","sourceRoot":"","sources":["../src/honeypot.tsx"],"names":[],"mappings":";AACA,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1D;;;;;;;;;;;;;GAaG;AAEH,MAAM,MAAM,GAAkB;IAC7B,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,SAAS;IACf,GAAG,EAAE,SAAS;IACd,KAAK,EAAE,KAAK;IACZ,MAAM,EAAE,KAAK;IACb,QAAQ,EAAE,QAAQ;CAClB,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,EAC7B,KAAK,EACL,KAAK,GAAG,cAAc,GAItB,EAAE,EAAE,CAAC,CACL,8BAAiB,MAAM,EAAC,KAAK,EAAE,MAAM,aACpC,sDAGC,gBACC,IAAI,EAAC,MAAM,EACX,IAAI,EAAE,KAAK,EACX,QAAQ,EAAE,CAAC,CAAC,EACZ,YAAY,EAAC,KAAK,EAClB,YAAY,EAAC,EAAE,2CAID,MAAM,oBACL,OAAO,GACrB,IACK,EACR,gBAAO,IAAI,EAAC,QAAQ,EAAC,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,KAAK,GAAI,IAC1D,CACN,CAAC"}

package/dist/index.d.ts

@@ -1,6 +1,6 @@
-export { checkBot } from "./botid";
-export { HONEYPOT_FIELD, TOKEN_FIELD } from "./fields";
-export { isConfigured } from "./keys";
-export { createFormToken, type TokenCheck, type TokenResult, verifyFormToken, } from "./token";
-export { type VerifyOptions, type VerifyResult, verifyHuman } from "./verify";
+export { checkBot } from "./botid.js";
+export { HONEYPOT_FIELD, TOKEN_FIELD } from "./fields.js";
+export { isConfigured } from "./keys.js";
+export { createFormToken, type TokenCheck, type TokenResult, verifyFormToken, } from "./token.js";
+export { type VerifyOptions, type VerifyResult, verifyHuman } from "./verify.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,EACN,eAAe,EACf,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,eAAe,GACf,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EACN,eAAe,EACf,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,eAAe,GACf,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -1,8 +1,8 @@
 // Server entry. The honeypot component lives at "@ingram-tech/bot-protection/honeypot"
 // so importing the verifier server-side never pulls in React.
-export { checkBot } from "./botid";
-export { HONEYPOT_FIELD, TOKEN_FIELD } from "./fields";
-export { isConfigured } from "./keys";
-export { createFormToken, verifyFormToken, } from "./token";
-export { verifyHuman } from "./verify";
+export { checkBot } from "./botid.js";
+export { HONEYPOT_FIELD, TOKEN_FIELD } from "./fields.js";
+export { isConfigured } from "./keys.js";
+export { createFormToken, verifyFormToken, } from "./token.js";
+export { verifyHuman } from "./verify.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,8DAA8D;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,EACN,eAAe,EAGf,eAAe,GACf,MAAM,SAAS,CAAC;AACjB,OAAO,EAAyC,WAAW,EAAE,MAAM,UAAU,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,8DAA8D;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EACN,eAAe,EAGf,eAAe,GACf,MAAM,YAAY,CAAC;AACpB,OAAO,EAAyC,WAAW,EAAE,MAAM,aAAa,CAAC"}

package/dist/keys.d.ts

@@ -4,8 +4,16 @@
  * BOT_PROTECTION_SECRET — secret used to HMAC-sign the timing token so bots
  * can't forge a "this form was rendered long enough ago" claim. Generate with
  * e.g. `openssl rand -hex 32`.
+ *
+ * Rotation: a comma-separated list is accepted — tokens are signed with the
+ * FIRST secret and verified against ALL of them, so `new,old` rotates without
+ * invalidating up-to-an-hour-old in-flight forms (which would silently drop
+ * every open form's submission).
  */
+/** The signing secret (first of the list). */
 export declare const getSecret: () => string;
+/** All accepted verification secrets, newest first. */
+export declare const getSecrets: () => string[];
 /** Whether the signed-timing layer is configured. */
 export declare const isConfigured: () => boolean;
 //# sourceMappingURL=keys.d.ts.map

package/dist/keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,eAAO,MAAM,SAAS,QAAO,MAQ5B,CAAC;AAEF,qDAAqD;AACrD,eAAO,MAAM,YAAY,QAAO,OAAqD,CAAC"}
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAQH,8CAA8C;AAC9C,eAAO,MAAM,SAAS,QAAO,MAQ5B,CAAC;AAEF,uDAAuD;AACvD,eAAO,MAAM,UAAU,QAAO,MAAM,EACW,CAAC;AAEhD,qDAAqD;AACrD,eAAO,MAAM,YAAY,QAAO,OAAqD,CAAC"}

package/dist/keys.js

@@ -4,14 +4,26 @@
  * BOT_PROTECTION_SECRET — secret used to HMAC-sign the timing token so bots
  * can't forge a "this form was rendered long enough ago" claim. Generate with
  * e.g. `openssl rand -hex 32`.
+ *
+ * Rotation: a comma-separated list is accepted — tokens are signed with the
+ * FIRST secret and verified against ALL of them, so `new,old` rotates without
+ * invalidating up-to-an-hour-old in-flight forms (which would silently drop
+ * every open form's submission).
  */
+const parse = (raw) => raw
+    .split(",")
+    .map((s) => s.trim())
+    .filter((s) => s.length > 0);
+/** The signing secret (first of the list). */
 export const getSecret = () => {
-    const secret = process.env.BOT_PROTECTION_SECRET;
+    const secret = getSecrets()[0];
     if (!secret) {
         throw new Error("@ingram-tech/bot-protection: BOT_PROTECTION_SECRET is not configured");
     }
     return secret;
 };
+/** All accepted verification secrets, newest first. */
+export const getSecrets = () => parse(process.env.BOT_PROTECTION_SECRET ?? "");
 /** Whether the signed-timing layer is configured. */
 export const isConfigured = () => Boolean(process.env.BOT_PROTECTION_SECRET);
 //# sourceMappingURL=keys.js.map

package/dist/keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"keys.js","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,CAAC,MAAM,SAAS,GAAG,GAAW,EAAE;IACrC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IACjD,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACd,sEAAsE,CACtE,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC,CAAC;AAEF,qDAAqD;AACrD,MAAM,CAAC,MAAM,YAAY,GAAG,GAAY,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC"}
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,KAAK,GAAG,CAAC,GAAW,EAAY,EAAE,CACvC,GAAG;KACD,KAAK,CAAC,GAAG,CAAC;KACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;KACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAE/B,8CAA8C;AAC9C,MAAM,CAAC,MAAM,SAAS,GAAG,GAAW,EAAE;IACrC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACd,sEAAsE,CACtE,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC,CAAC;AAEF,uDAAuD;AACvD,MAAM,CAAC,MAAM,UAAU,GAAG,GAAa,EAAE,CACxC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC;AAEhD,qDAAqD;AACrD,MAAM,CAAC,MAAM,YAAY,GAAG,GAAY,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC"}

package/dist/react.d.ts

@@ -10,22 +10,32 @@ import { type RefObject } from "react";
  * Pair with {@link HoneypotInput}, which renders the trap and wires the ref.
  *
  * @param tokenEndpoint - GET route that mints the token (e.g. "/api/contact").
+ * @param options.honeypotField - Override the trap field name; must match the
+ *   server's `verifyHuman({ honeypotField })` and the `<HoneypotInput name>`.
  *
  * @example
- * const { honeypotRef, botFields } = useBotProtection("/api/contact");
+ * const { honeypotRef, botFields, ready } = useBotProtection("/api/contact");
  * // ...in the form:  <HoneypotInput inputRef={honeypotRef} />
  * // ...on submit:    body: JSON.stringify({ ...values, ...botFields() })
+ * // Optionally gate the submit button on `ready` — an empty token is
+ * // silently dropped server-side, so submitting before the token resolves
+ * // loses the message.
  */
-export declare function useBotProtection(tokenEndpoint: string): {
+export declare function useBotProtection(tokenEndpoint: string, options?: {
+    honeypotField?: string;
+}): {
     honeypotRef: RefObject<HTMLInputElement | null>;
     botFields: () => Record<string, string>;
+    ready: boolean;
 };
 /**
  * Visually-hidden honeypot input for {@link useBotProtection}. Real users never
  * see or fill it (off-screen, aria-hidden, tabIndex -1, autofill opted out);
  * bots that fill every field give themselves away.
  */
-export declare function HoneypotInput({ inputRef, }: {
+export declare function HoneypotInput({ inputRef, name, }: {
     inputRef: RefObject<HTMLInputElement | null>;
+    /** Must match `useBotProtection`'s `honeypotField` when overridden. */
+    name?: string;
 }): import("react").JSX.Element;
 //# sourceMappingURL=react.d.ts.map

package/dist/react.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"react.d.ts","sourceRoot":"","sources":["../src/react.tsx"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,SAAS,EAA+B,MAAM,OAAO,CAAC;AAGpE;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,CAAC,aAAa,EAAE,MAAM;;qBAW/B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;EAM5C;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,EAC7B,QAAQ,GACR,EAAE;IACF,QAAQ,EAAE,SAAS,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;CAC7C,+BAuBA"}
+{"version":3,"file":"react.d.ts","sourceRoot":"","sources":["../src/react.tsx"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,SAAS,EAA+B,MAAM,OAAO,CAAC;AAGpE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,gBAAgB,CAC/B,aAAa,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE;;qBAsCd,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;;EAQ5C;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,EAC7B,QAAQ,EACR,IAAqB,GACrB,EAAE;IACF,QAAQ,EAAE,SAAS,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC7C,uEAAuE;IACvE,IAAI,CAAC,EAAE,MAAM,CAAC;CACd,+BAuBA"}

package/dist/react.js

@@ -1,7 +1,7 @@
 "use client";
 import { jsx as _jsx } from "react/jsx-runtime";
 import { useEffect, useRef, useState } from "react";
-import { HONEYPOT_FIELD, TOKEN_FIELD } from "./fields";
+import { HONEYPOT_FIELD, TOKEN_FIELD } from "./fields.js";
 /**
  * Client-side bot protection for forms that POST JSON to your own route.
  *
@@ -13,34 +13,68 @@ import { HONEYPOT_FIELD, TOKEN_FIELD } from "./fields";
  * Pair with {@link HoneypotInput}, which renders the trap and wires the ref.
  *
  * @param tokenEndpoint - GET route that mints the token (e.g. "/api/contact").
+ * @param options.honeypotField - Override the trap field name; must match the
+ *   server's `verifyHuman({ honeypotField })` and the `<HoneypotInput name>`.
  *
  * @example
- * const { honeypotRef, botFields } = useBotProtection("/api/contact");
+ * const { honeypotRef, botFields, ready } = useBotProtection("/api/contact");
  * // ...in the form:  <HoneypotInput inputRef={honeypotRef} />
  * // ...on submit:    body: JSON.stringify({ ...values, ...botFields() })
+ * // Optionally gate the submit button on `ready` — an empty token is
+ * // silently dropped server-side, so submitting before the token resolves
+ * // loses the message.
  */
-export function useBotProtection(tokenEndpoint) {
+export function useBotProtection(tokenEndpoint, options) {
     const [token, setToken] = useState("");
+    const honeypotField = options?.honeypotField ?? HONEYPOT_FIELD;
     const honeypotRef = useRef(null);
     useEffect(() => {
-        fetch(tokenEndpoint)
-            .then((res) => res.json())
-            .then((data) => setToken(data.token ?? ""))
-            .catch(() => { });
+        let cancelled = false;
+        const load = async () => {
+            // One retry: a transiently failed fetch would otherwise leave the token
+            // empty forever, and the server then silently drops a REAL user's
+            // submission — the exact failure mode this package promises to avoid.
+            for (let attempt = 0; attempt < 2 && !cancelled; attempt++) {
+                try {
+                    const res = await fetch(tokenEndpoint);
+                    if (!res.ok)
+                        throw new Error(`HTTP ${res.status}`);
+                    const data = await res.json();
+                    if (typeof data === "object" &&
+                        data !== null &&
+                        "token" in data &&
+                        typeof data.token === "string" &&
+                        data.token !== "") {
+                        if (!cancelled)
+                            setToken(data.token);
+                        return;
+                    }
+                }
+                catch {
+                    // fall through to retry
+                }
+            }
+        };
+        void load();
+        return () => {
+            cancelled = true;
+        };
     }, [tokenEndpoint]);
     const botFields = () => ({
-        [HONEYPOT_FIELD]: honeypotRef.current?.value ?? "",
+        [honeypotField]: honeypotRef.current?.value ?? "",
         [TOKEN_FIELD]: token,
     });
-    return { honeypotRef, botFields };
+    // `ready` = the timing token resolved. Not required — the server treats a
+    // missing token as bot-ish — but lets forms wait instead of losing input.
+    return { honeypotRef, botFields, ready: token !== "" };
 }
 /**
  * Visually-hidden honeypot input for {@link useBotProtection}. Real users never
  * see or fill it (off-screen, aria-hidden, tabIndex -1, autofill opted out);
  * bots that fill every field give themselves away.
  */
-export function HoneypotInput({ inputRef, }) {
-    return (_jsx("input", { ref: inputRef, type: "text", name: HONEYPOT_FIELD, tabIndex: -1, autoComplete: "off", "aria-hidden": "true", defaultValue: "", "data-1p-ignore": true, "data-lpignore": "true", "data-form-type": "other", style: {
+export function HoneypotInput({ inputRef, name = HONEYPOT_FIELD, }) {
+    return (_jsx("input", { ref: inputRef, type: "text", name: name, tabIndex: -1, autoComplete: "off", "aria-hidden": "true", defaultValue: "", "data-1p-ignore": true, "data-lpignore": "true", "data-form-type": "other", style: {
             position: "absolute",
             left: "-9999px",
             width: "1px",

package/dist/react.js.map

@@ -1 +1 @@
-{"version":3,"file":"react.js","sourceRoot":"","sources":["../src/react.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,EAAkB,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAEvD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,gBAAgB,CAAC,aAAqB;IACrD,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IACvC,MAAM,WAAW,GAAG,MAAM,CAAmB,IAAI,CAAC,CAAC;IAEnD,SAAS,CAAC,GAAG,EAAE;QACd,KAAK,CAAC,aAAa,CAAC;aAClB,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;aACzB,IAAI,CAAC,CAAC,IAAwB,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;aAC9D,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACnB,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC;IAEpB,MAAM,SAAS,GAAG,GAA2B,EAAE,CAAC,CAAC;QAChD,CAAC,cAAc,CAAC,EAAE,WAAW,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;QAClD,CAAC,WAAW,CAAC,EAAE,KAAK;KACpB,CAAC,CAAC;IAEH,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,EAC7B,QAAQ,GAGR;IACA,OAAO,CACN,gBACC,GAAG,EAAE,QAAQ,EACb,IAAI,EAAC,MAAM,EACX,IAAI,EAAE,cAAc,EACpB,QAAQ,EAAE,CAAC,CAAC,EACZ,YAAY,EAAC,KAAK,iBACN,MAAM,EAClB,YAAY,EAAC,EAAE,2CAGD,MAAM,oBACL,OAAO,EACtB,KAAK,EAAE;YACN,QAAQ,EAAE,UAAU;YACpB,IAAI,EAAE,SAAS;YACf,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,QAAQ;SAClB,GACA,CACF,CAAC;AACH,CAAC"}
+{"version":3,"file":"react.js","sourceRoot":"","sources":["../src/react.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,EAAkB,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,gBAAgB,CAC/B,aAAqB,EACrB,OAAoC;IAEpC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IACvC,MAAM,aAAa,GAAG,OAAO,EAAE,aAAa,IAAI,cAAc,CAAC;IAC/D,MAAM,WAAW,GAAG,MAAM,CAAmB,IAAI,CAAC,CAAC;IAEnD,SAAS,CAAC,GAAG,EAAE;QACd,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;YACtC,wEAAwE;YACxE,kEAAkE;YAClE,sEAAsE;YACtE,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC;gBAC5D,IAAI,CAAC;oBACJ,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,CAAC;oBACvC,IAAI,CAAC,GAAG,CAAC,EAAE;wBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;oBACnD,MAAM,IAAI,GAAY,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;oBACvC,IACC,OAAO,IAAI,KAAK,QAAQ;wBACxB,IAAI,KAAK,IAAI;wBACb,OAAO,IAAI,IAAI;wBACf,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;wBAC9B,IAAI,CAAC,KAAK,KAAK,EAAE,EAChB,CAAC;wBACF,IAAI,CAAC,SAAS;4BAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;wBACrC,OAAO;oBACR,CAAC;gBACF,CAAC;gBAAC,MAAM,CAAC;oBACR,wBAAwB;gBACzB,CAAC;YACF,CAAC;QACF,CAAC,CAAC;QACF,KAAK,IAAI,EAAE,CAAC;QACZ,OAAO,GAAG,EAAE;YACX,SAAS,GAAG,IAAI,CAAC;QAClB,CAAC,CAAC;IACH,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC;IAEpB,MAAM,SAAS,GAAG,GAA2B,EAAE,CAAC,CAAC;QAChD,CAAC,aAAa,CAAC,EAAE,WAAW,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;QACjD,CAAC,WAAW,CAAC,EAAE,KAAK;KACpB,CAAC,CAAC;IAEH,0EAA0E;IAC1E,0EAA0E;IAC1E,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,KAAK,EAAE,EAAE,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,EAC7B,QAAQ,EACR,IAAI,GAAG,cAAc,GAKrB;IACA,OAAO,CACN,gBACC,GAAG,EAAE,QAAQ,EACb,IAAI,EAAC,MAAM,EACX,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,CAAC,CAAC,EACZ,YAAY,EAAC,KAAK,iBACN,MAAM,EAClB,YAAY,EAAC,EAAE,2CAGD,MAAM,oBACL,OAAO,EACtB,KAAK,EAAE;YACN,QAAQ,EAAE,UAAU;YACpB,IAAI,EAAE,SAAS;YACf,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,QAAQ;SAClB,GACA,CACF,CAAC;AACH,CAAC"}

package/dist/token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAmBA;;;;GAIG;AACH,eAAO,MAAM,eAAe,QAAO,MASlC,CAAC;AAEF,MAAM,WAAW,UAAU;IAC1B,+EAA+E;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,WAAW;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,6EAA6E;AAC7E,eAAO,MAAM,eAAe,GAC3B,OAAO,MAAM,GAAG,SAAS,GAAG,IAAI,EAChC,mBAA0C,UAAe,KACvD,WAqBF,CAAC"}
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAmBA;;;;GAIG;AACH,eAAO,MAAM,eAAe,QAAO,MASlC,CAAC;AAEF,MAAM,WAAW,UAAU;IAC1B,+EAA+E;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,WAAW;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,6EAA6E;AAC7E,eAAO,MAAM,eAAe,GAC3B,OAAO,MAAM,GAAG,SAAS,GAAG,IAAI,EAChC,mBAA0C,UAAe,KACvD,WA0BF,CAAC"}

package/dist/token.js

@@ -1,5 +1,5 @@
 import { createHmac, timingSafeEqual } from "node:crypto";
-import { getSecret, isConfigured } from "./keys";
+import { getSecret, getSecrets, isConfigured } from "./keys.js";
 /**
  * Signed timing token: `<timestamp>.<hmac>`. The timestamp records when the
  * form was rendered; the HMAC (keyed by BOT_PROTECTION_SECRET) prevents a bot
@@ -35,10 +35,15 @@ export const verifyFormToken = (token, { minMs = 2000, maxMs = 60 * 60 * 1000 }
         return { ok: false, reason: "malformed-token" };
     const ts = token.slice(0, dot);
     const sig = token.slice(dot + 1);
-    const expected = sign(ts, getSecret());
+    // Verify against every configured secret (signing uses the first) so a
+    // rotation doesn't invalidate in-flight forms. Every candidate is compared
+    // timing-safely; the count of secrets is not attacker-relevant.
     const a = Buffer.from(sig);
-    const b = Buffer.from(expected);
-    if (a.length !== b.length || !timingSafeEqual(a, b)) {
+    const valid = getSecrets().some((secret) => {
+        const b = Buffer.from(sign(ts, secret));
+        return a.length === b.length && timingSafeEqual(a, b);
+    });
+    if (!valid) {
         return { ok: false, reason: "bad-signature" };
     }
     const elapsed = Date.now() - Number(ts);

package/dist/token.js.map

@@ -1 +1 @@
-{"version":3,"file":"token.js","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAEjD;;;;;;;;;;;GAWG;AAEH,MAAM,IAAI,GAAG,CAAC,EAAU,EAAE,MAAc,EAAU,EAAE,CACnD,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAEvD;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,GAAW,EAAE;IAC3C,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;QACrB,OAAO,CAAC,IAAI,CACX,qFAAqF,CACrF,CAAC;QACF,OAAO,EAAE,CAAC;IACX,CAAC;IACD,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;IACjC,OAAO,GAAG,EAAE,IAAI,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;AACzC,CAAC,CAAC;AAcF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAAG,CAC9B,KAAgC,EAChC,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,KAAiB,EAAE,EAC3C,EAAE;IAChB,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAE1D,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC9D,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAEjC,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IACvC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAC/C,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAC7E,IAAI,OAAO,GAAG,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC9D,IAAI,OAAO,GAAG,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAE7D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACrB,CAAC,CAAC"}
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEhE;;;;;;;;;;;GAWG;AAEH,MAAM,IAAI,GAAG,CAAC,EAAU,EAAE,MAAc,EAAU,EAAE,CACnD,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAEvD;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,GAAW,EAAE;IAC3C,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;QACrB,OAAO,CAAC,IAAI,CACX,qFAAqF,CACrF,CAAC;QACF,OAAO,EAAE,CAAC;IACX,CAAC;IACD,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;IACjC,OAAO,GAAG,EAAE,IAAI,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;AACzC,CAAC,CAAC;AAcF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAAG,CAC9B,KAAgC,EAChC,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,KAAiB,EAAE,EAC3C,EAAE;IAChB,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAE1D,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC9D,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAEjC,uEAAuE;IACvE,2EAA2E;IAC3E,gEAAgE;IAChE,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QACxC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAC/C,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAC7E,IAAI,OAAO,GAAG,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC9D,IAAI,OAAO,GAAG,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAE7D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACrB,CAAC,CAAC"}

package/dist/verify.d.ts

@@ -1,4 +1,4 @@
-import { type TokenCheck } from "./token";
+import { type TokenCheck } from "./token.js";
 export interface VerifyResult {
     ok: boolean;
     /** Which layer rejected: "honeypot" | token reason | "botid". */

package/dist/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,UAAU,EAAmB,MAAM,SAAS,CAAC;AAE3D,MAAM,WAAW,YAAY;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC7B,0DAA0D;IAC1D,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7C,0CAA0C;IAC1C,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,oEAAoE;IACpE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACvB;AAUD;;;;;;;;;GASG;AACH,eAAO,MAAM,WAAW,GAAU,SAAS,aAAa,KAAG,OAAO,CAAC,YAAY,CAsB9E,CAAC"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,UAAU,EAAmB,MAAM,YAAY,CAAC;AAE9D,MAAM,WAAW,YAAY;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC7B,0DAA0D;IAC1D,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7C,0CAA0C;IAC1C,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,oEAAoE;IACpE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACvB;AAUD;;;;;;;;;GASG;AACH,eAAO,MAAM,WAAW,GAAU,SAAS,aAAa,KAAG,OAAO,CAAC,YAAY,CAyB9E,CAAC"}

package/dist/verify.js

@@ -1,7 +1,7 @@
-import { checkBot } from "./botid";
-import { HONEYPOT_FIELD, TOKEN_FIELD } from "./fields";
-import { isConfigured } from "./keys";
-import { verifyFormToken } from "./token";
+import { checkBot } from "./botid.js";
+import { HONEYPOT_FIELD, TOKEN_FIELD } from "./fields.js";
+import { isConfigured } from "./keys.js";
+import { verifyFormToken } from "./token.js";
 const getField = (formData, name) => {
     const value = formData instanceof FormData
         ? formData.get(name)
@@ -20,6 +20,9 @@ const getField = (formData, name) => {
  */
 export const verifyHuman = async (options) => {
     const honeypotField = options.honeypotField ?? HONEYPOT_FIELD;
+    // trim(): whitespace-only values pass the trap on purpose — some browser
+    // autofill/extension quirks insert stray spaces, and per the "never punish
+    // real users" ethos that's a weaker trap, not a false positive.
     if (getField(options.formData, honeypotField).trim() !== "") {
         return { ok: false, reason: "honeypot" };
     }

package/dist/verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,EAAmB,eAAe,EAAE,MAAM,SAAS,CAAC;AAsB3D,MAAM,QAAQ,GAAG,CAAC,QAAmC,EAAE,IAAY,EAAU,EAAE;IAC9E,MAAM,KAAK,GACV,QAAQ,YAAY,QAAQ;QAC3B,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;QACpB,CAAC,CAAE,QAAoC,CAAC,IAAI,CAAC,CAAC;IAChD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/C,CAAC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAAE,OAAsB,EAAyB,EAAE;IAClF,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,cAAc,CAAC;IAC9D,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC7D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC1C,CAAC;IAED,wEAAwE;IACxE,+EAA+E;IAC/E,IAAI,YAAY,EAAE,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,eAAe,CAC5B,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,EACvC,OAAO,CAAC,MAAM,CACd,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;IAC7B,CAAC;IAED,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QAC7B,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,EAAE,CAAC;QACnC,IAAI,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAClD,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACrB,CAAC,CAAC"}
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAmB,eAAe,EAAE,MAAM,YAAY,CAAC;AAsB9D,MAAM,QAAQ,GAAG,CAAC,QAAmC,EAAE,IAAY,EAAU,EAAE;IAC9E,MAAM,KAAK,GACV,QAAQ,YAAY,QAAQ;QAC3B,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;QACpB,CAAC,CAAE,QAAoC,CAAC,IAAI,CAAC,CAAC;IAChD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/C,CAAC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAAE,OAAsB,EAAyB,EAAE;IAClF,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,cAAc,CAAC;IAC9D,yEAAyE;IACzE,2EAA2E;IAC3E,gEAAgE;IAChE,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC7D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC1C,CAAC;IAED,wEAAwE;IACxE,+EAA+E;IAC/E,IAAI,YAAY,EAAE,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,eAAe,CAC5B,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,EACvC,OAAO,CAAC,MAAM,CACd,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;IAC7B,CAAC;IAED,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QAC7B,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,EAAE,CAAC;QACnC,IAAI,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAClD,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACrB,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@ingram-tech/bot-protection",
-	"version": "0.3.1",
+	"version": "0.4.0",
 	"description": "Invisible, layered bot protection for forms — honeypot + signed timing token + Vercel BotID.",
 	"license": "MIT",
 	"type": "module",
@@ -39,12 +39,12 @@
 		"test": "vitest run"
 	},
 	"devDependencies": {
-		"@ingram-tech/typescript-config": "workspace:*",
-		"@types/node": "^20.0.0",
-		"@types/react": "^19.0.0",
-		"react": "^19.0.0",
+		"@ingram-tech/nk-dev": "0.2.5",
+		"@types/node": "^26.0.1",
+		"@types/react": "^19.2.17",
+		"react": "^19.2.7",
 		"typescript": "^6.0.3",
-		"vitest": "^4.1.6"
+		"vitest": "^4.1.9"
 	},
 	"peerDependencies": {
 		"botid": ">=1.0.0",