@logeix/contact-form 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 LOGEIX
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,157 @@
+# @logeix/contact-form
+
+Lead form intake for LOGEIX client sites (Astro + Cloudflare Pages + D1 + Brevo).
+
+Stores **every** submission in the site's own D1 `form_submissions` table (including blocked spam). Sends notification email via Brevo only when the spam engine allows it.
+
+This is a sibling of [`@logeix/phone-intent`](https://github.com/logeix/phone-intent). Same install style. **Not** the same package — and **not** a shared database across clients.
+
+## Install
+
+```json
+"@logeix/contact-form": "^1.0.0"
+```
+
+```bash
+npm install
+```
+
+Same npm org as [`@logeix/phone-intent`](https://www.npmjs.com/package/@logeix/phone-intent). Public, unlisted-by-search unless you know the name.
+
+GitHub tarball still works if a CI job cannot hit npm:
+
+```json
+"@logeix/contact-form": "https://github.com/logeix/contact-form/archive/refs/tags/v1.0.0.tar.gz"
+```
+
+## Site setup
+
+### 1. D1 migration
+
+Each site keeps its own D1 (e.g. `asap-plumbing-pros-forms`). Same binding `DB` as phone-intent.
+
+```bash
+npx wrangler d1 execute YOUR-FORMS-DB --remote --file=node_modules/@logeix/contact-form/migrations/form_submissions.sql
+```
+
+Existing sites that already have `form_submissions` with spam columns do **not** need to re-run this.
+
+### 2. Pages Function
+
+`functions/api/submit-form.ts`:
+
+```ts
+import { createSubmitFormHandler } from "@logeix/contact-form/server/submit-form";
+
+export const onRequestPost = createSubmitFormHandler({
+  phoneLocale: "nanp", // or "uk"
+  fallbackEmails: ["leads@example.com"],
+  buildEmail(formName, data) {
+    return {
+      subject: `[Example Co] New contact — ${data.name || "Unknown"}`,
+      html: `<p>${data.message || "—"}</p>`, // site-branded HTML
+    };
+  },
+  // Optional per-site extras (merged with the packaged lists):
+  extraHardTerms: ["that one local scam phrase"],
+  extraScoreTerms: ["odd sales pitch"],
+  extraHoneypotFields: ["company_fax"],
+  // gateFormNames: ["instant-quote"], // timing + aux only, no phrase lists
+});
+```
+
+Requires D1 binding `DB`, vars `SITE_NAME`, `NOTIFICATION_EMAIL`, and secret `BREVO_API_KEY`. Sender is `LOGEIX Agency <noreply@logeix.com>` unless you pass `sender`.
+
+### 3. Form HTML
+
+Tag the form and any decoy fields. **Do not** name fields or attributes `honeypot`, `trap`, `spam`, or `bot` — crawlers skip those.
+
+| Attribute | Where | What it does |
+|-----------|--------|----------------|
+| `data-lgx-lead` | `<form>` | Client binds timestamp, aux fields, fetch POST |
+| `data-lgx-aux` | decoy `<input>` | Hidden; any value → block. Name should look real (`confirm_email`) |
+| `data-lgx-aux-row` | optional wrapper | Whole row is clipped off-screen |
+
+```html
+<form name="contact" method="POST" action="/api/submit-form" data-lgx-lead>
+  <input type="hidden" name="form-name" value="contact" />
+  <input type="hidden" name="submitted_at_client" value="" />
+  <input type="hidden" name="source" value="" />
+
+  <div data-lgx-aux-row>
+    <label for="confirm_email">Please leave this field blank</label>
+    <input id="confirm_email" name="confirm_email" type="email" data-lgx-aux />
+  </div>
+
+  <!-- real fields: name, phone, email, message, … -->
+  <button type="submit" class="submit-btn">Send</button>
+  <p class="status-message"></p>
+</form>
+```
+
+Default aux names the **server** always checks (even without JS): `confirm_email`, `bot-field`. Tagged names are sent in a boring meta field `form_build` so extra decoys work without listing them in the handler.
+
+### 4. Client init
+
+In the page/component script (same pattern as phone-intent):
+
+```astro
+<script>
+  import { initContactForms } from "@logeix/contact-form/client";
+  document.addEventListener("DOMContentLoaded", () => {
+    initContactForms({ debug: true });
+  });
+</script>
+```
+
+`debug` defaults to **true** (verbose `[lgx-contact-form]` logs). Set `{ debug: false }` in production if it is noisy.
+
+Keep site-specific JS (service dropdown from `?service=`, scroll-to-book) in the Astro file. Do not also attach a second submit handler.
+
+## Handler options
+
+Hardcoded defaults, then per-site overrides:
+
+| Option | Default | Purpose |
+|--------|---------|---------|
+| `buildEmail` | required | Subject + HTML for Brevo |
+| `phoneLocale` | `"nanp"` | `"uk"` for UK numbers |
+| `fallbackEmails` | `[]` | If `NOTIFICATION_EMAIL` is empty |
+| `extraHardTerms` | `[]` | Immediate block phrases |
+| `extraScoreTerms` | `[]` | +2 each; block at `blockScoreAt` |
+| `extraHoneypotFields` | `[]` | Extra POST names treated as aux |
+| `assessFormNames` | `["contact"]` | Full scoring |
+| `gateFormNames` | `[]` | Timing + aux only |
+| `minFillMs` | `3000` | Fill-time gate (negative elapsed also blocks) |
+| `blockScoreAt` | `4` | Accumulated score threshold |
+| `debug` | `true` | Server `console.log` |
+| `sender` | LOGEIX / noreply@logeix.com | Brevo from |
+
+Phrase lists live in `src/server/terms.ts`. Bump the package to change them for every site.
+
+## Spam behaviour
+
+Runs in order. Immediate block → `score: 100`. Blocked rows still insert to D1 and return `{ success: true }` so bots cannot probe.
+
+1. Aux field has a value (`honeypot-field-filled`)
+2. Missing / non-numeric / **negative** `submitted_at_client`
+3. Elapsed &lt; `minFillMs`
+4. URL in `message`
+5. Hard phrase
+6. Scored phrases, long message, many paragraphs, non-local phone
+7. ≥ 3 same IP in 10 min, ≥ 2 same email in 10 min
+8. Score ≥ `blockScoreAt`
+
+## Publish (maintainers)
+
+1. Bump `version` in `package.json`
+2. `npm test` && `npm run build`
+3. Commit, tag (`git tag v1.0.1`), push tag
+4. `npm publish --access public`
+5. Update client sites to `"@logeix/contact-form": "^1.0.1"`
+
+## Debug
+
+- Client: `{ debug: true }` or default — `[lgx-contact-form]` in the browser console
+- Server: Pages Function logs `[submit-form]`
+- Query D1: `spam_decision`, `spam_reasons`, `spam_elapsed_ms` on `form_submissions`

package/dist/client/index.d.ts

@@ -0,0 +1,27 @@
+interface BindContactFormOptions {
+    endpoint?: string;
+    thankYouPath?: string;
+    /** Verbose console logs. Default true. */
+    debug?: boolean;
+    errorMessage?: string;
+}
+declare function bindContactForm(form: HTMLFormElement, options?: BindContactFormOptions): void;
+/** Bind every `form[data-lgx-lead]` on the page. */
+declare function initContactForms(options?: BindContactFormOptions): void;
+
+/**
+ * Names used in HTML and POST bodies.
+ *
+ * Keep these boring. Do not use "honeypot", "trap", "spam", or "bot" —
+ * crawlers that read the source skip those.
+ *
+ * `data-lgx-aux` = auxiliary field (LOGEIX prefix, looks like a form helper).
+ * `form_build` = which aux field names were on the page (client → server).
+ */
+declare const AUX_ATTR = "data-lgx-aux";
+declare const AUX_ROW_ATTR = "data-lgx-aux-row";
+declare const LEAD_FORM_ATTR = "data-lgx-lead";
+declare const FORM_BUILD_FIELD = "form_build";
+declare const TIMESTAMP_FIELD = "submitted_at_client";
+
+export { AUX_ATTR, AUX_ROW_ATTR, type BindContactFormOptions, FORM_BUILD_FIELD, LEAD_FORM_ATTR, TIMESTAMP_FIELD, bindContactForm, initContactForms };

package/dist/client/index.js

@@ -0,0 +1,128 @@
+// src/shared.ts
+var AUX_ATTR = "data-lgx-aux";
+var AUX_ROW_ATTR = "data-lgx-aux-row";
+var LEAD_FORM_ATTR = "data-lgx-lead";
+var FORM_BUILD_FIELD = "form_build";
+var TIMESTAMP_FIELD = "submitted_at_client";
+var SOURCE_FIELD = "source";
+var FORM_BUILD_VERSION = "1";
+function encodeFormBuild(auxNames) {
+  const names = uniqueFieldNames(auxNames);
+  return names.length ? `${FORM_BUILD_VERSION}~${names.join(",")}` : FORM_BUILD_VERSION;
+}
+function uniqueFieldNames(names) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const name of names) {
+    const n = name.trim();
+    if (!n || !/^[A-Za-z][\w:-]*$/.test(n)) continue;
+    const key = n.toLowerCase();
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push(n);
+  }
+  return out;
+}
+
+// src/client/bind.ts
+var HIDE_STYLE = "position:absolute!important;left:-10000px!important;width:1px!important;height:1px!important;overflow:hidden!important;clip:rect(0,0,0,0)!important;";
+function debugLog(enabled, ...args) {
+  if (enabled) console.log("[lgx-contact-form]", ...args);
+}
+function ensureHiddenInput(form, name) {
+  const existing = form.querySelector(`input[name="${CSS.escape(name)}"]`);
+  if (existing instanceof HTMLInputElement) return existing;
+  const input = document.createElement("input");
+  input.type = "hidden";
+  input.name = name;
+  form.appendChild(input);
+  return input;
+}
+function collectAuxNames(form) {
+  const names = [];
+  form.querySelectorAll(`[${AUX_ATTR}]`).forEach((el) => {
+    if (!(el instanceof HTMLInputElement) && !(el instanceof HTMLTextAreaElement)) return;
+    if (!el.name) return;
+    names.push(el.name);
+    el.setAttribute("tabindex", "-1");
+    el.setAttribute("autocomplete", "off");
+    el.setAttribute("aria-hidden", "true");
+    el.style.cssText += HIDE_STYLE;
+    const row = el.closest(`[${AUX_ROW_ATTR}]`);
+    if (row instanceof HTMLElement) {
+      row.setAttribute("aria-hidden", "true");
+      row.style.cssText += HIDE_STYLE;
+    }
+  });
+  return names;
+}
+function bindContactForm(form, options = {}) {
+  const debug = options.debug !== false;
+  const endpoint = options.endpoint || form.getAttribute("action") || "/api/submit-form";
+  const thankYouPath = options.thankYouPath || "/thank-you/";
+  const errorMessage = options.errorMessage || "Something went wrong. Please call us or try again.";
+  const auxNames = collectAuxNames(form);
+  const timestampInput = ensureHiddenInput(form, TIMESTAMP_FIELD);
+  timestampInput.value = Date.now().toString();
+  const sourceInput = form.querySelector(`input[name="${SOURCE_FIELD}"]`);
+  if (sourceInput instanceof HTMLInputElement) {
+    sourceInput.value = window.location.href;
+  }
+  const buildInput = ensureHiddenInput(form, FORM_BUILD_FIELD);
+  buildInput.value = encodeFormBuild(auxNames);
+  debugLog(debug, "bound", {
+    endpoint,
+    auxNames,
+    formBuild: buildInput.value,
+    timestamp: timestampInput.value
+  });
+  form.addEventListener("submit", async (event) => {
+    event.preventDefault();
+    const submitBtn = form.querySelector(".submit-btn");
+    const statusMessage = form.querySelector(".status-message");
+    if (!submitBtn) return;
+    const originalText = submitBtn.textContent;
+    submitBtn.disabled = true;
+    submitBtn.textContent = "Sending...";
+    try {
+      const formData = new FormData(form);
+      const body = new URLSearchParams();
+      formData.forEach((value, key) => {
+        if (typeof value === "string") body.append(key, value);
+      });
+      debugLog(debug, "POST", endpoint, Object.fromEntries(body.entries()));
+      const response = await fetch(endpoint, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: body.toString()
+      });
+      const data = await response.json();
+      if (response.ok && data.success) {
+        debugLog(debug, "ok \u2192", thankYouPath);
+        form.reset();
+        window.location.href = thankYouPath;
+        return;
+      }
+      throw new Error(data.error || "Submission failed");
+    } catch (err) {
+      console.error("[lgx-contact-form]", err);
+      if (statusMessage) statusMessage.textContent = errorMessage;
+    } finally {
+      submitBtn.disabled = false;
+      submitBtn.textContent = originalText || "Send message";
+    }
+  });
+}
+function initContactForms(options = {}) {
+  const debug = options.debug !== false;
+  const selector = `form[${LEAD_FORM_ATTR}]`;
+  const forms = document.querySelectorAll(selector);
+  debugLog(debug, `init ${forms.length} form(s) matching`, selector);
+  forms.forEach((form) => {
+    if (form instanceof HTMLFormElement) bindContactForm(form, options);
+  });
+}
+
+export { AUX_ATTR, AUX_ROW_ATTR, FORM_BUILD_FIELD, LEAD_FORM_ATTR, TIMESTAMP_FIELD, bindContactForm, initContactForms };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/client/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/shared.ts","../../src/client/bind.ts"],"names":[],"mappings":";AAUO,IAAM,QAAA,GAAW;AACjB,IAAM,YAAA,GAAe;AACrB,IAAM,cAAA,GAAiB;AACvB,IAAM,gBAAA,GAAmB;AACzB,IAAM,eAAA,GAAkB;AAExB,IAAM,YAAA,GAAe,QAAA;AAKrB,IAAM,kBAAA,GAAqB,GAAA;AAE3B,SAAS,gBAAgB,QAAA,EAA4B;AAC1D,EAAA,MAAM,KAAA,GAAQ,iBAAiB,QAAQ,CAAA;AACvC,EAAA,OAAO,KAAA,CAAM,SAAS,CAAA,EAAG,kBAAkB,IAAI,KAAA,CAAM,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,GAAK,kBAAA;AACrE;AASO,SAAS,iBAAiB,KAAA,EAAmC;AAClE,EAAA,MAAM,MAAgB,EAAC;AACvB,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAC7B,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,MAAM,CAAA,GAAI,KAAK,IAAA,EAAK;AACpB,IAAA,IAAI,CAAC,CAAA,IAAK,CAAC,mBAAA,CAAoB,IAAA,CAAK,CAAC,CAAA,EAAG;AACxC,IAAA,MAAM,GAAA,GAAM,EAAE,WAAA,EAAY;AAC1B,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,GAAG,CAAA,EAAG;AACnB,IAAA,IAAA,CAAK,IAAI,GAAG,CAAA;AACZ,IAAA,GAAA,CAAI,KAAK,CAAC,CAAA;AAAA,EACZ;AACA,EAAA,OAAO,GAAA;AACT;;;AC7BA,IAAM,UAAA,GACJ,sJAAA;AAEF,SAAS,QAAA,CAAS,YAAqB,IAAA,EAAiB;AACtD,EAAA,IAAI,OAAA,EAAS,OAAA,CAAQ,GAAA,CAAI,oBAAA,EAAsB,GAAG,IAAI,CAAA;AACxD;AAEA,SAAS,iBAAA,CAAkB,MAAuB,IAAA,EAAgC;AAChF,EAAA,MAAM,QAAA,GAAW,KAAK,aAAA,CAAc,CAAA,YAAA,EAAe,IAAI,MAAA,CAAO,IAAI,CAAC,CAAA,EAAA,CAAI,CAAA;AACvE,EAAA,IAAI,QAAA,YAAoB,kBAAkB,OAAO,QAAA;AACjD,EAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,aAAA,CAAc,OAAO,CAAA;AAC5C,EAAA,KAAA,CAAM,IAAA,GAAO,QAAA;AACb,EAAA,KAAA,CAAM,IAAA,GAAO,IAAA;AACb,EAAA,IAAA,CAAK,YAAY,KAAK,CAAA;AACtB,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,gBAAgB,IAAA,EAAiC;AACxD,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,IAAA,CAAK,iBAAiB,CAAA,CAAA,EAAI,QAAQ,GAAG,CAAA,CAAE,OAAA,CAAQ,CAAC,EAAA,KAAO;AACrD,IAAA,IAAI,EAAE,EAAA,YAAc,gBAAA,CAAA,IAAqB,EAAE,cAAc,mBAAA,CAAA,EAAsB;AAC/E,IAAA,IAAI,CAAC,GAAG,IAAA,EAAM;AACd,IAAA,KAAA,CAAM,IAAA,CAAK,GAAG,IAAI,CAAA;AAClB,IAAA,EAAA,CAAG,YAAA,CAAa,YAAY,IAAI,CAAA;AAChC,IAAA,EAAA,CAAG,YAAA,CAAa,gBAAgB,KAAK,CAAA;AACrC,IAAA,EAAA,CAAG,YAAA,CAAa,eAAe,MAAM,CAAA;AACrC,IAAA,EAAA,CAAG,MAAM,OAAA,IAAW,UAAA;AACpB,IAAA,MAAM,GAAA,GAAM,EAAA,CAAG,OAAA,CAAQ,CAAA,CAAA,EAAI,YAAY,CAAA,CAAA,CAAG,CAAA;AAC1C,IAAA,IAAI,eAAe,WAAA,EAAa;AAC9B,MAAA,GAAA,CAAI,YAAA,CAAa,eAAe,MAAM,CAAA;AACtC,MAAA,GAAA,CAAI,MAAM,OAAA,IAAW,UAAA;AAAA,IACvB;AAAA,EACF,CAAC,CAAA;AACD,EAAA,OAAO,KAAA;AACT;AAEO,SAAS,eAAA,CACd,IAAA,EACA,OAAA,GAAkC,EAAC,EAC7B;AACN,EAAA,MAAM,KAAA,GAAQ,QAAQ,KAAA,KAAU,KAAA;AAChC,EAAA,MAAM,WAAW,OAAA,CAAQ,QAAA,IAAY,IAAA,CAAK,YAAA,CAAa,QAAQ,CAAA,IAAK,kBAAA;AACpE,EAAA,MAAM,YAAA,GAAe,QAAQ,YAAA,IAAgB,aAAA;AAC7C,EAAA,MAAM,YAAA,GACJ,QAAQ,YAAA,IAAgB,oDAAA;AAE1B,EAAA,MAAM,QAAA,GAAW,gBAAgB,IAAI,CAAA;AACrC,EAAA,MAAM,cAAA,GAAiB,iBAAA,CAAkB,IAAA,EAAM,eAAe,CAAA;AAC9D,EAAA,cAAA,CAAe,KAAA,GAAQ,IAAA,CAAK,GAAA,EAAI,CAAE,QAAA,EAAS;AAE3C,EAAA,MAAM,WAAA,GAAc,IAAA,CAAK,aAAA,CAAc,CAAA,YAAA,EAAe,YAAY,CAAA,EAAA,CAAI,CAAA;AACtE,EAAA,IAAI,uBAAuB,gBAAA,EAAkB;AAC3C,IAAA,WAAA,CAAY,KAAA,GAAQ,OAAO,QAAA,CAAS,IAAA;AAAA,EACtC;AAEA,EAAA,MAAM,UAAA,GAAa,iBAAA,CAAkB,IAAA,EAAM,gBAAgB,CAAA;AAC3D,EAAA,UAAA,CAAW,KAAA,GAAQ,gBAAgB,QAAQ,CAAA;AAE3C,EAAA,QAAA,CAAS,OAAO,OAAA,EAAS;AAAA,IACvB,QAAA;AAAA,IACA,QAAA;AAAA,IACA,WAAW,UAAA,CAAW,KAAA;AAAA,IACtB,WAAW,cAAA,CAAe;AAAA,GAC3B,CAAA;AAED,EAAA,IAAA,CAAK,gBAAA,CAAiB,QAAA,EAAU,OAAO,KAAA,KAAU;AAC/C,IAAA,KAAA,CAAM,cAAA,EAAe;AACrB,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,aAAA,CAAc,aAAa,CAAA;AAClD,IAAA,MAAM,aAAA,GAAgB,IAAA,CAAK,aAAA,CAAc,iBAAiB,CAAA;AAC1D,IAAA,IAAI,CAAC,SAAA,EAAW;AAEhB,IAAA,MAAM,eAAe,SAAA,CAAU,WAAA;AAC/B,IAAA,SAAA,CAAU,QAAA,GAAW,IAAA;AACrB,IAAA,SAAA,CAAU,WAAA,GAAc,YAAA;AAExB,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,IAAI,QAAA,CAAS,IAAI,CAAA;AAClC,MAAA,MAAM,IAAA,GAAO,IAAI,eAAA,EAAgB;AACjC,MAAA,QAAA,CAAS,OAAA,CAAQ,CAAC,KAAA,EAAO,GAAA,KAAQ;AAC/B,QAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,IAAA,CAAK,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,MACvD,CAAC,CAAA;AACD,MAAA,QAAA,CAAS,KAAA,EAAO,QAAQ,QAAA,EAAU,MAAA,CAAO,YAAY,IAAA,CAAK,OAAA,EAAS,CAAC,CAAA;AAEpE,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,QAAA,EAAU;AAAA,QACrC,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,QAC/D,IAAA,EAAM,KAAK,QAAA;AAAS,OACrB,CAAA;AACD,MAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAElC,MAAA,IAAI,QAAA,CAAS,EAAA,IAAM,IAAA,CAAK,OAAA,EAAS;AAC/B,QAAA,QAAA,CAAS,KAAA,EAAO,aAAQ,YAAY,CAAA;AACpC,QAAA,IAAA,CAAK,KAAA,EAAM;AACX,QAAA,MAAA,CAAO,SAAS,IAAA,GAAO,YAAA;AACvB,QAAA;AAAA,MACF;AACA,MAAA,MAAM,IAAI,KAAA,CAAM,IAAA,CAAK,KAAA,IAAS,mBAAmB,CAAA;AAAA,IACnD,SAAS,GAAA,EAAK;AACZ,MAAA,OAAA,CAAQ,KAAA,CAAM,sBAAsB,GAAG,CAAA;AACvC,MAAA,IAAI,aAAA,gBAA6B,WAAA,GAAc,YAAA;AAAA,IACjD,CAAA,SAAE;AACA,MAAA,SAAA,CAAU,QAAA,GAAW,KAAA;AACrB,MAAA,SAAA,CAAU,cAAc,YAAA,IAAgB,cAAA;AAAA,IAC1C;AAAA,EACF,CAAC,CAAA;AACH;AAGO,SAAS,gBAAA,CAAiB,OAAA,GAAkC,EAAC,EAAS;AAC3E,EAAA,MAAM,KAAA,GAAQ,QAAQ,KAAA,KAAU,KAAA;AAChC,EAAA,MAAM,QAAA,GAAW,QAAQ,cAAc,CAAA,CAAA,CAAA;AACvC,EAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,gBAAA,CAAiB,QAAQ,CAAA;AAChD,EAAA,QAAA,CAAS,KAAA,EAAO,CAAA,KAAA,EAAQ,KAAA,CAAM,MAAM,qBAAqB,QAAQ,CAAA;AACjE,EAAA,KAAA,CAAM,OAAA,CAAQ,CAAC,IAAA,KAAS;AACtB,IAAA,IAAI,IAAA,YAAgB,eAAA,EAAiB,eAAA,CAAgB,IAAA,EAAM,OAAO,CAAA;AAAA,EACpE,CAAC,CAAA;AACH","file":"index.js","sourcesContent":["/**\n * Names used in HTML and POST bodies.\n *\n * Keep these boring. Do not use \"honeypot\", \"trap\", \"spam\", or \"bot\" —\n * crawlers that read the source skip those.\n *\n * `data-lgx-aux` = auxiliary field (LOGEIX prefix, looks like a form helper).\n * `form_build` = which aux field names were on the page (client → server).\n */\n\nexport const AUX_ATTR = \"data-lgx-aux\";\nexport const AUX_ROW_ATTR = \"data-lgx-aux-row\";\nexport const LEAD_FORM_ATTR = \"data-lgx-lead\";\nexport const FORM_BUILD_FIELD = \"form_build\";\nexport const TIMESTAMP_FIELD = \"submitted_at_client\";\nexport const FORM_NAME_FIELD = \"form-name\";\nexport const SOURCE_FIELD = \"source\";\n\n/** Always treated as aux fields, even if the client never tags them. */\nexport const DEFAULT_AUX_FIELDS = [\"confirm_email\", \"bot-field\"] as const;\n\nexport const FORM_BUILD_VERSION = \"1\";\n\nexport function encodeFormBuild(auxNames: string[]): string {\n  const names = uniqueFieldNames(auxNames);\n  return names.length ? `${FORM_BUILD_VERSION}~${names.join(\",\")}` : FORM_BUILD_VERSION;\n}\n\nexport function parseFormBuild(raw: string | undefined): string[] {\n  if (!raw) return [];\n  const tilde = raw.indexOf(\"~\");\n  if (tilde < 0) return [];\n  return uniqueFieldNames(raw.slice(tilde + 1).split(\",\"));\n}\n\nexport function uniqueFieldNames(names: Iterable<string>): string[] {\n  const out: string[] = [];\n  const seen = new Set<string>();\n  for (const name of names) {\n    const n = name.trim();\n    if (!n || !/^[A-Za-z][\\w:-]*$/.test(n)) continue;\n    const key = n.toLowerCase();\n    if (seen.has(key)) continue;\n    seen.add(key);\n    out.push(n);\n  }\n  return out;\n}\n","import {\n  AUX_ATTR,\n  AUX_ROW_ATTR,\n  FORM_BUILD_FIELD,\n  LEAD_FORM_ATTR,\n  SOURCE_FIELD,\n  TIMESTAMP_FIELD,\n  encodeFormBuild,\n} from \"../shared\";\n\nexport interface BindContactFormOptions {\n  endpoint?: string;\n  thankYouPath?: string;\n  /** Verbose console logs. Default true. */\n  debug?: boolean;\n  errorMessage?: string;\n}\n\nconst HIDE_STYLE =\n  \"position:absolute!important;left:-10000px!important;width:1px!important;height:1px!important;overflow:hidden!important;clip:rect(0,0,0,0)!important;\";\n\nfunction debugLog(enabled: boolean, ...args: unknown[]) {\n  if (enabled) console.log(\"[lgx-contact-form]\", ...args);\n}\n\nfunction ensureHiddenInput(form: HTMLFormElement, name: string): HTMLInputElement {\n  const existing = form.querySelector(`input[name=\"${CSS.escape(name)}\"]`);\n  if (existing instanceof HTMLInputElement) return existing;\n  const input = document.createElement(\"input\");\n  input.type = \"hidden\";\n  input.name = name;\n  form.appendChild(input);\n  return input;\n}\n\nfunction collectAuxNames(form: HTMLFormElement): string[] {\n  const names: string[] = [];\n  form.querySelectorAll(`[${AUX_ATTR}]`).forEach((el) => {\n    if (!(el instanceof HTMLInputElement) && !(el instanceof HTMLTextAreaElement)) return;\n    if (!el.name) return;\n    names.push(el.name);\n    el.setAttribute(\"tabindex\", \"-1\");\n    el.setAttribute(\"autocomplete\", \"off\");\n    el.setAttribute(\"aria-hidden\", \"true\");\n    el.style.cssText += HIDE_STYLE;\n    const row = el.closest(`[${AUX_ROW_ATTR}]`);\n    if (row instanceof HTMLElement) {\n      row.setAttribute(\"aria-hidden\", \"true\");\n      row.style.cssText += HIDE_STYLE;\n    }\n  });\n  return names;\n}\n\nexport function bindContactForm(\n  form: HTMLFormElement,\n  options: BindContactFormOptions = {},\n): void {\n  const debug = options.debug !== false;\n  const endpoint = options.endpoint || form.getAttribute(\"action\") || \"/api/submit-form\";\n  const thankYouPath = options.thankYouPath || \"/thank-you/\";\n  const errorMessage =\n    options.errorMessage || \"Something went wrong. Please call us or try again.\";\n\n  const auxNames = collectAuxNames(form);\n  const timestampInput = ensureHiddenInput(form, TIMESTAMP_FIELD);\n  timestampInput.value = Date.now().toString();\n\n  const sourceInput = form.querySelector(`input[name=\"${SOURCE_FIELD}\"]`);\n  if (sourceInput instanceof HTMLInputElement) {\n    sourceInput.value = window.location.href;\n  }\n\n  const buildInput = ensureHiddenInput(form, FORM_BUILD_FIELD);\n  buildInput.value = encodeFormBuild(auxNames);\n\n  debugLog(debug, \"bound\", {\n    endpoint,\n    auxNames,\n    formBuild: buildInput.value,\n    timestamp: timestampInput.value,\n  });\n\n  form.addEventListener(\"submit\", async (event) => {\n    event.preventDefault();\n    const submitBtn = form.querySelector(\".submit-btn\") as HTMLButtonElement | null;\n    const statusMessage = form.querySelector(\".status-message\") as HTMLElement | null;\n    if (!submitBtn) return;\n\n    const originalText = submitBtn.textContent;\n    submitBtn.disabled = true;\n    submitBtn.textContent = \"Sending...\";\n\n    try {\n      const formData = new FormData(form);\n      const body = new URLSearchParams();\n      formData.forEach((value, key) => {\n        if (typeof value === \"string\") body.append(key, value);\n      });\n      debugLog(debug, \"POST\", endpoint, Object.fromEntries(body.entries()));\n\n      const response = await fetch(endpoint, {\n        method: \"POST\",\n        headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n        body: body.toString(),\n      });\n      const data = (await response.json()) as { success?: boolean; error?: string };\n\n      if (response.ok && data.success) {\n        debugLog(debug, \"ok →\", thankYouPath);\n        form.reset();\n        window.location.href = thankYouPath;\n        return;\n      }\n      throw new Error(data.error || \"Submission failed\");\n    } catch (err) {\n      console.error(\"[lgx-contact-form]\", err);\n      if (statusMessage) statusMessage.textContent = errorMessage;\n    } finally {\n      submitBtn.disabled = false;\n      submitBtn.textContent = originalText || \"Send message\";\n    }\n  });\n}\n\n/** Bind every `form[data-lgx-lead]` on the page. */\nexport function initContactForms(options: BindContactFormOptions = {}): void {\n  const debug = options.debug !== false;\n  const selector = `form[${LEAD_FORM_ATTR}]`;\n  const forms = document.querySelectorAll(selector);\n  debugLog(debug, `init ${forms.length} form(s) matching`, selector);\n  forms.forEach((form) => {\n    if (form instanceof HTMLFormElement) bindContactForm(form, options);\n  });\n}\n"]}

package/dist/server/submit-form.d.ts

@@ -0,0 +1,55 @@
+type PhoneLocale = "nanp" | "uk";
+interface EmailContent {
+    subject: string;
+    html: string;
+}
+interface SubmitFormEnv {
+    DB: D1Database;
+    BREVO_API_KEY: string;
+    SITE_NAME: string;
+    NOTIFICATION_EMAIL?: string;
+}
+interface SubmitFormOptions {
+    /** Build the notification email. `formName` is `contact`, `instant-quote`, etc. */
+    buildEmail: (formName: string, data: Record<string, string>) => EmailContent;
+    /** Phone format scoring. Default `nanp` (US/CA). Use `uk` for Sam's. */
+    phoneLocale?: PhoneLocale;
+    /** Used when `NOTIFICATION_EMAIL` is unset. */
+    fallbackEmails?: string[];
+    /** Extra immediate-block phrases (lowercased match after normalisation). */
+    extraHardTerms?: string[];
+    /** Extra +2 phrases. */
+    extraScoreTerms?: string[];
+    /**
+     * Extra POST field names treated as aux (filled = bot).
+     * Tagged `data-lgx-aux` fields are picked up automatically via `form_build`.
+     */
+    extraHoneypotFields?: string[];
+    /** Forms that get the full phrase / length / phone / rate-limit scoring. Default `["contact"]`. */
+    assessFormNames?: string[];
+    /**
+     * Forms that get timing + aux only (no phrase lists).
+     * Useful for `instant-quote` without running the contact copy filter.
+     */
+    gateFormNames?: string[];
+    /** Minimum ms between page load timestamp and submit. Default 3000. */
+    minFillMs?: number;
+    /** Accumulated score that blocks. Default 4. */
+    blockScoreAt?: number;
+    debug?: boolean;
+    sender?: {
+        name: string;
+        email: string;
+    };
+}
+
+/**
+ * Cloudflare Pages Function factory — contact (and other) forms → D1 + Brevo.
+ *
+ * Every submission (including spam) is written to D1.
+ * Blocked rows get email suppressed and the reason stored in email_error.
+ */
+
+declare function createSubmitFormHandler(options: SubmitFormOptions): PagesFunction<SubmitFormEnv>;
+
+export { type EmailContent, type PhoneLocale, type SubmitFormOptions, createSubmitFormHandler };

package/dist/server/submit-form.js

@@ -0,0 +1,430 @@
+// src/shared.ts
+var FORM_BUILD_FIELD = "form_build";
+var TIMESTAMP_FIELD = "submitted_at_client";
+var FORM_NAME_FIELD = "form-name";
+var DEFAULT_AUX_FIELDS = ["confirm_email", "bot-field"];
+function parseFormBuild(raw) {
+  if (!raw) return [];
+  const tilde = raw.indexOf("~");
+  if (tilde < 0) return [];
+  return uniqueFieldNames(raw.slice(tilde + 1).split(","));
+}
+function uniqueFieldNames(names) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const name of names) {
+    const n = name.trim();
+    if (!n || !/^[A-Za-z][\w:-]*$/.test(n)) continue;
+    const key = n.toLowerCase();
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push(n);
+  }
+  return out;
+}
+
+// src/server/brevo.ts
+var DEFAULT_SENDER = {
+  name: "LOGEIX Agency",
+  email: "noreply@logeix.com"
+};
+async function sendBrevoEmail(apiKey, toEmails, subject, htmlContent, sender = DEFAULT_SENDER) {
+  const payload = {
+    sender,
+    to: toEmails.map((email) => ({ email })),
+    subject,
+    htmlContent
+  };
+  const res = await fetch("https://api.brevo.com/v3/smtp/email", {
+    method: "POST",
+    headers: {
+      Accept: "application/json",
+      "Content-Type": "application/json",
+      "api-key": apiKey
+    },
+    body: JSON.stringify(payload)
+  });
+  if (!res.ok) {
+    throw new Error(`Brevo API error: ${res.status} \u2013 ${await res.text()}`);
+  }
+}
+function notificationEmails(envEmail, fallback) {
+  const list = (envEmail || "").split(",").map((s) => s.trim()).filter(Boolean);
+  if (list.length) return list;
+  return fallback?.filter(Boolean) ?? [];
+}
+
+// src/server/parse.ts
+async function parseFormBody(request) {
+  const contentType = request.headers.get("content-type") || "";
+  if (contentType.includes("application/x-www-form-urlencoded")) {
+    const text = await request.text();
+    const formData = {};
+    new URLSearchParams(text).forEach((value, key) => {
+      formData[key] = value;
+    });
+    return formData;
+  }
+  if (contentType.includes("application/json")) {
+    const raw = await request.json();
+    const formData = {};
+    for (const [key, value] of Object.entries(raw)) {
+      if (value == null) continue;
+      formData[key] = String(value);
+    }
+    return formData;
+  }
+  return null;
+}
+function jsonResponse(body, status = 200) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "Content-Type": "application/json" }
+  });
+}
+function clientIp(request) {
+  return request.headers.get("CF-Connecting-IP") || request.headers.get("X-Forwarded-For") || "unknown";
+}
+
+// src/server/terms.ts
+var HARD_SPAM_TERMS = [
+  "seo report",
+  "seo strategy",
+  "seo services",
+  "seo specialist",
+  "seo expert",
+  "seo audit",
+  "search engine optimisation",
+  "search engine optimization",
+  "digital marketing",
+  "digital marketing manager",
+  "guest post",
+  "domain authority",
+  "dr 50",
+  "backlink",
+  "cold outreach",
+  "reddit demand",
+  "real reddit conversations",
+  "monitoring relevant subreddits",
+  "warm inbound interest",
+  "proposal package",
+  "if this is relevant for you",
+  "if my previous email didn t go through",
+  "if your previous email didn t go through",
+  "if you're not interested",
+  "if you re not interested",
+  'send us "no"',
+  "send us no",
+  "motivated clients",
+  "ethical strategies to draw",
+  "social media content",
+  "ready to post social media content",
+  "7 days of posting content for free",
+  "internet marketing warlock",
+  "creating money out of thin air",
+  "hidden money",
+  "trigger points",
+  "sell to the affluent",
+  "escort application",
+  "spellpros com",
+  "unsubscribe",
+  "trustpilot",
+  "fake reviews",
+  "purchase reviews",
+  "buy reviews",
+  "buy google reviews",
+  "verified reviews package",
+  "reputation repair service",
+  "reputation management",
+  "manage your online reputation",
+  "suppress negative reviews",
+  "negative review removal",
+  "remove negative reviews",
+  "remove bad reviews",
+  "selling your business",
+  "sell your business",
+  "business broker",
+  "interested in selling",
+  "buying plumbing businesses",
+  "buying businesses in your industry",
+  "quantity takeoff",
+  "stop to opt out"
+];
+var SCORE_SPAM_TERMS = [
+  "search results",
+  "rankings",
+  "online presence",
+  "visibility on google",
+  "search visibility",
+  "organic traffic",
+  "relevant traffic",
+  "convenient time to connect",
+  "let me know a convenient time",
+  "i recently came across your website",
+  "came across your website",
+  "came across your business",
+  "i noticed your website",
+  "pricing and packages",
+  "my services and pricing",
+  "leads",
+  "learn more",
+  "book a call",
+  "operational systems",
+  "day to day workflows",
+  "specific examples",
+  "high quality email list",
+  "free posting content",
+  "local business owners",
+  "show up online",
+  "quote/package/proposal",
+  "brand-safe",
+  "aged-account",
+  "b2b",
+  "saas",
+  "high-intent threads",
+  "google reviews",
+  "yelp reviews",
+  "tripadvisor reviews",
+  "review building",
+  "boost your reviews",
+  "improve your reviews",
+  "more reviews for",
+  "positive reviews package",
+  "ratings and reviews",
+  "reviews for your business",
+  "reply yes",
+  "vas 4 hire",
+  "vas4hire",
+  "takeoff services",
+  "senior estimator"
+];
+
+// src/server/spam.ts
+var DEFAULT_MIN_FILL_MS = 3e3;
+var DEFAULT_BLOCK_SCORE = 4;
+function auxFieldNames(formData, extra) {
+  return uniqueFieldNames([
+    ...DEFAULT_AUX_FIELDS,
+    ...extra ?? [],
+    ...parseFormBuild(formData[FORM_BUILD_FIELD])
+  ]);
+}
+function auxFieldFilled(formData, names) {
+  return names.some((name) => Boolean((formData[name] || "").trim()));
+}
+function stripMetaFields(formData, auxNames) {
+  const clean = { ...formData };
+  delete clean[FORM_NAME_FIELD];
+  delete clean[TIMESTAMP_FIELD];
+  delete clean[FORM_BUILD_FIELD];
+  for (const name of auxNames) delete clean[name];
+  return clean;
+}
+function normaliseText(input) {
+  return input.toLowerCase().replace(/[^\w\s]/g, " ").replace(/\s+/g, " ").trim();
+}
+function phoneScoreReason(rawPhone, locale) {
+  if (!rawPhone) return null;
+  if (locale === "uk") {
+    const compact = rawPhone.replace(/[\s\-().]/g, "");
+    if (!/^(\+44|0)[0-9]{9,10}$/.test(compact)) return "non-uk-phone";
+    return null;
+  }
+  const digits = rawPhone.replace(/\D/g, "");
+  if (digits.length > 0 && !/^1?[2-9]\d{9}$/.test(digits)) return "non-us-phone";
+  return null;
+}
+async function assessFormSpam(params) {
+  const { db, formData, ipAddress, options, mode } = params;
+  const reasons = [];
+  let score = 0;
+  const minFillMs = options.minFillMs ?? DEFAULT_MIN_FILL_MS;
+  const blockScoreAt = options.blockScoreAt ?? DEFAULT_BLOCK_SCORE;
+  const locale = options.phoneLocale ?? "nanp";
+  const clientTimestamp = Number(formData[TIMESTAMP_FIELD] || 0);
+  let elapsedMs;
+  if (Number.isFinite(clientTimestamp) && clientTimestamp > 0) {
+    elapsedMs = Date.now() - clientTimestamp;
+    if (elapsedMs < 0 || elapsedMs < minFillMs) {
+      reasons.push(elapsedMs < 0 ? "invalid-client-timestamp" : "submitted-too-fast");
+      return { decision: "blocked", score: 100, reasons, elapsedMs };
+    }
+  } else {
+    reasons.push("missing-client-timestamp");
+    return { decision: "blocked", score: 100, reasons, elapsedMs };
+  }
+  if (mode === "gates") {
+    return { decision: "allow", score: 0, reasons, elapsedMs };
+  }
+  if (/(https?:\/\/|www\.)/i.test(formData.message || "")) {
+    reasons.push("contains-link");
+    return { decision: "blocked", score: 100, reasons, elapsedMs };
+  }
+  const msg = normaliseText(formData.message || "");
+  const hardTerms = [...HARD_SPAM_TERMS, ...options.extraHardTerms ?? []];
+  for (const term of hardTerms) {
+    if (msg.includes(normaliseText(term))) {
+      reasons.push(`hard-term:${term}`);
+      return { decision: "blocked", score: 100, reasons, elapsedMs };
+    }
+  }
+  const scoreTerms = [...SCORE_SPAM_TERMS, ...options.extraScoreTerms ?? []];
+  for (const term of scoreTerms) {
+    if (msg.includes(normaliseText(term))) {
+      score += 2;
+      reasons.push(`score-term:${term}`);
+    }
+  }
+  if ((formData.message || "").length > 550) {
+    score += 2;
+    reasons.push("message-too-long");
+  }
+  const paragraphBreaks = (formData.message || "").split(/\r?\n/).filter(Boolean).length;
+  if (paragraphBreaks >= 8) {
+    score += 1;
+    reasons.push("many-paragraphs");
+  }
+  const phoneReason = phoneScoreReason(formData.phone || "", locale);
+  if (phoneReason) {
+    score += 2;
+    reasons.push(phoneReason);
+  }
+  const tenMinutesAgo = new Date(Date.now() - 10 * 60 * 1e3).toISOString();
+  const formName = formData[FORM_NAME_FIELD] || "contact";
+  const ipRow = await db.prepare(
+    `SELECT COUNT(*) AS c FROM form_submissions
+       WHERE form_name = ? AND submitted_at >= ? AND ip_address = ?`
+  ).bind(formName, tenMinutesAgo, ipAddress).first();
+  if (Number(ipRow?.c || 0) >= 3) {
+    reasons.push("ip-rate-limited");
+    return { decision: "blocked", score: 100, reasons, elapsedMs };
+  }
+  const email = (formData.email || "").trim().toLowerCase();
+  if (email) {
+    const emailRow = await db.prepare(
+      `SELECT COUNT(*) AS c FROM form_submissions
+         WHERE form_name = ? AND submitted_at >= ?
+           AND json_extract(form_data, '$.email') = ?`
+    ).bind(formName, tenMinutesAgo, email).first();
+    if (Number(emailRow?.c || 0) >= 2) {
+      reasons.push("email-rate-limited");
+      return { decision: "blocked", score: 100, reasons, elapsedMs };
+    }
+  }
+  if (score >= blockScoreAt) {
+    return { decision: "blocked", score, reasons, elapsedMs };
+  }
+  return { decision: "allow", score, reasons, elapsedMs };
+}
+
+// src/server/submit-form.ts
+function createSubmitFormHandler(options) {
+  const debug = options.debug !== false;
+  const assessFormNames = options.assessFormNames ?? ["contact"];
+  const gateFormNames = options.gateFormNames ?? [];
+  function debugLog(...args) {
+    if (debug) console.log("[submit-form]", ...args);
+  }
+  return async (context) => {
+    const { request, env } = context;
+    try {
+      const formData = await parseFormBody(request);
+      if (!formData) {
+        return jsonResponse({ error: "Unsupported content type" }, 400);
+      }
+      const formName = formData[FORM_NAME_FIELD] || "unknown";
+      const siteName = env.SITE_NAME || "unknown";
+      const auxNames = auxFieldNames(formData, options.extraHoneypotFields);
+      const honeypotTriggered = auxFieldFilled(formData, auxNames);
+      const ipAddress = clientIp(request);
+      const userAgent = request.headers.get("User-Agent") || "unknown";
+      const submittedAt = (/* @__PURE__ */ new Date()).toISOString();
+      let spamAssessment = { decision: "allow", score: 0, reasons: [] };
+      if (honeypotTriggered) {
+        spamAssessment = {
+          decision: "blocked",
+          score: 100,
+          reasons: ["honeypot-field-filled"]
+        };
+        debugLog("aux field filled \u2014 logging row without email");
+      } else if (assessFormNames.includes(formName)) {
+        spamAssessment = await assessFormSpam({
+          db: env.DB,
+          formData,
+          ipAddress,
+          options,
+          mode: "full"
+        });
+        if (spamAssessment.decision === "blocked") {
+          debugLog("submission blocked (logged):", spamAssessment.reasons.join("; "));
+        }
+      } else if (gateFormNames.includes(formName)) {
+        spamAssessment = await assessFormSpam({
+          db: env.DB,
+          formData,
+          ipAddress,
+          options,
+          mode: "gates"
+        });
+        if (spamAssessment.decision === "blocked") {
+          debugLog("gated form blocked (logged):", spamAssessment.reasons.join("; "));
+        }
+      }
+      const cleanFormData = stripMetaFields(formData, auxNames);
+      const recordSpam = honeypotTriggered || assessFormNames.includes(formName) || gateFormNames.includes(formName);
+      const insertResult = await env.DB.prepare(
+        `INSERT INTO form_submissions
+         (site_name, form_name, submitted_at, ip_address, user_agent, form_data, email_sent,
+          spam_decision, spam_score, spam_reasons, spam_elapsed_ms)
+         VALUES (?, ?, ?, ?, ?, ?, 0, ?, ?, ?, ?)`
+      ).bind(
+        siteName,
+        formName,
+        submittedAt,
+        ipAddress,
+        userAgent,
+        JSON.stringify(cleanFormData),
+        recordSpam ? spamAssessment.decision : null,
+        recordSpam ? spamAssessment.score : null,
+        recordSpam ? JSON.stringify(spamAssessment.reasons) : null,
+        recordSpam ? spamAssessment.elapsedMs ?? null : null
+      ).run();
+      if (!insertResult.success) throw new Error("Database insert failed");
+      const submissionId = insertResult.meta.last_row_id;
+      const emailSuppressedReason = spamAssessment.decision === "blocked" ? `Suppressed (score ${spamAssessment.score}): ${spamAssessment.reasons.join(", ")}` : null;
+      if (emailSuppressedReason) {
+        await env.DB.prepare(`UPDATE form_submissions SET email_error = ? WHERE id = ?`).bind(emailSuppressedReason, submissionId).run();
+        return jsonResponse({ success: true });
+      }
+      const to = notificationEmails(env.NOTIFICATION_EMAIL, options.fallbackEmails);
+      if (!to.length) {
+        throw new Error("No notification emails configured");
+      }
+      try {
+        const { subject, html } = options.buildEmail(formName, cleanFormData);
+        await sendBrevoEmail(
+          env.BREVO_API_KEY,
+          to,
+          subject,
+          html,
+          options.sender ?? DEFAULT_SENDER
+        );
+        await env.DB.prepare(
+          `UPDATE form_submissions SET email_sent = 1, email_sent_at = ? WHERE id = ?`
+        ).bind((/* @__PURE__ */ new Date()).toISOString(), submissionId).run();
+        debugLog("email sent", { to, submissionId });
+      } catch (emailError) {
+        console.error("Email send failed:", emailError);
+        await env.DB.prepare(`UPDATE form_submissions SET email_error = ? WHERE id = ?`).bind(String(emailError), submissionId).run();
+      }
+      return jsonResponse({ success: true, submissionId });
+    } catch (error) {
+      console.error("Form submission error:", error);
+      return jsonResponse({ error: "Submission failed", message: String(error) }, 500);
+    }
+  };
+}
+
+export { createSubmitFormHandler };
+//# sourceMappingURL=submit-form.js.map
+//# sourceMappingURL=submit-form.js.map

package/dist/server/submit-form.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/shared.ts","../../src/server/brevo.ts","../../src/server/parse.ts","../../src/server/terms.ts","../../src/server/spam.ts","../../src/server/submit-form.ts"],"names":[],"mappings":";AAaO,IAAM,gBAAA,GAAmB,YAAA;AACzB,IAAM,eAAA,GAAkB,qBAAA;AACxB,IAAM,eAAA,GAAkB,WAAA;AAIxB,IAAM,kBAAA,GAAqB,CAAC,eAAA,EAAiB,WAAW,CAAA;AASxD,SAAS,eAAe,GAAA,EAAmC;AAChE,EAAA,IAAI,CAAC,GAAA,EAAK,OAAO,EAAC;AAClB,EAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA;AAC7B,EAAA,IAAI,KAAA,GAAQ,CAAA,EAAG,OAAO,EAAC;AACvB,EAAA,OAAO,gBAAA,CAAiB,IAAI,KAAA,CAAM,KAAA,GAAQ,CAAC,CAAA,CAAE,KAAA,CAAM,GAAG,CAAC,CAAA;AACzD;AAEO,SAAS,iBAAiB,KAAA,EAAmC;AAClE,EAAA,MAAM,MAAgB,EAAC;AACvB,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAC7B,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,MAAM,CAAA,GAAI,KAAK,IAAA,EAAK;AACpB,IAAA,IAAI,CAAC,CAAA,IAAK,CAAC,mBAAA,CAAoB,IAAA,CAAK,CAAC,CAAA,EAAG;AACxC,IAAA,MAAM,GAAA,GAAM,EAAE,WAAA,EAAY;AAC1B,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,GAAG,CAAA,EAAG;AACnB,IAAA,IAAA,CAAK,IAAI,GAAG,CAAA;AACZ,IAAA,GAAA,CAAI,KAAK,CAAC,CAAA;AAAA,EACZ;AACA,EAAA,OAAO,GAAA;AACT;;;ACxCO,IAAM,cAAA,GAAiB;AAAA,EAC5B,IAAA,EAAM,eAAA;AAAA,EACN,KAAA,EAAO;AACT,CAAA;AAEA,eAAsB,eACpB,MAAA,EACA,QAAA,EACA,OAAA,EACA,WAAA,EACA,SAA0C,cAAA,EAC3B;AACf,EAAA,MAAM,OAAA,GAA6B;AAAA,IACjC,MAAA;AAAA,IACA,IAAI,QAAA,CAAS,GAAA,CAAI,CAAC,KAAA,MAAW,EAAE,OAAM,CAAE,CAAA;AAAA,IACvC,OAAA;AAAA,IACA;AAAA,GACF;AAEA,EAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,qCAAA,EAAuC;AAAA,IAC7D,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS;AAAA,MACP,MAAA,EAAQ,kBAAA;AAAA,MACR,cAAA,EAAgB,kBAAA;AAAA,MAChB,SAAA,EAAW;AAAA,KACb;AAAA,IACA,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,OAAO;AAAA,GAC7B,CAAA;AAED,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,iBAAA,EAAoB,GAAA,CAAI,MAAM,WAAM,MAAM,GAAA,CAAI,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,EACxE;AACF;AAEO,SAAS,kBAAA,CACd,UACA,QAAA,EACU;AACV,EAAA,MAAM,IAAA,GAAA,CAAQ,QAAA,IAAY,EAAA,EACvB,KAAA,CAAM,GAAG,CAAA,CACT,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,CAAA,CACnB,OAAO,OAAO,CAAA;AACjB,EAAA,IAAI,IAAA,CAAK,QAAQ,OAAO,IAAA;AACxB,EAAA,OAAO,QAAA,EAAU,MAAA,CAAO,OAAO,CAAA,IAAK,EAAC;AACvC;;;ACnDA,eAAsB,cAAc,OAAA,EAA0D;AAC5F,EAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK,EAAA;AAE3D,EAAA,IAAI,WAAA,CAAY,QAAA,CAAS,mCAAmC,CAAA,EAAG;AAC7D,IAAA,MAAM,IAAA,GAAO,MAAM,OAAA,CAAQ,IAAA,EAAK;AAChC,IAAA,MAAM,WAAmC,EAAC;AAC1C,IAAA,IAAI,gBAAgB,IAAI,CAAA,CAAE,OAAA,CAAQ,CAAC,OAAO,GAAA,KAAQ;AAChD,MAAA,QAAA,CAAS,GAAG,CAAA,GAAI,KAAA;AAAA,IAClB,CAAC,CAAA;AACD,IAAA,OAAO,QAAA;AAAA,EACT;AAEA,EAAA,IAAI,WAAA,CAAY,QAAA,CAAS,kBAAkB,CAAA,EAAG;AAC5C,IAAA,MAAM,GAAA,GAAO,MAAM,OAAA,CAAQ,IAAA,EAAK;AAChC,IAAA,MAAM,WAAmC,EAAC;AAC1C,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAA,EAAG;AAC9C,MAAA,IAAI,SAAS,IAAA,EAAM;AACnB,MAAA,QAAA,CAAS,GAAG,CAAA,GAAI,MAAA,CAAO,KAAK,CAAA;AAAA,IAC9B;AACA,IAAA,OAAO,QAAA;AAAA,EACT;AAEA,EAAA,OAAO,IAAA;AACT;AAEO,SAAS,YAAA,CAAa,IAAA,EAAe,MAAA,GAAS,GAAA,EAAe;AAClE,EAAA,OAAO,IAAI,QAAA,CAAS,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA,EAAG;AAAA,IACxC,MAAA;AAAA,IACA,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB,GAC/C,CAAA;AACH;AAEO,SAAS,SAAS,OAAA,EAA0B;AACjD,EAAA,OACE,OAAA,CAAQ,QAAQ,GAAA,CAAI,kBAAkB,KACtC,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,iBAAiB,CAAA,IACrC,SAAA;AAEJ;;;ACjCO,IAAM,eAAA,GAAqC;AAAA,EAChD,YAAA;AAAA,EACA,cAAA;AAAA,EACA,cAAA;AAAA,EACA,gBAAA;AAAA,EACA,YAAA;AAAA,EACA,WAAA;AAAA,EACA,4BAAA;AAAA,EACA,4BAAA;AAAA,EACA,mBAAA;AAAA,EACA,2BAAA;AAAA,EACA,YAAA;AAAA,EACA,kBAAA;AAAA,EACA,OAAA;AAAA,EACA,UAAA;AAAA,EACA,eAAA;AAAA,EACA,eAAA;AAAA,EACA,2BAAA;AAAA,EACA,gCAAA;AAAA,EACA,uBAAA;AAAA,EACA,kBAAA;AAAA,EACA,6BAAA;AAAA,EACA,wCAAA;AAAA,EACA,0CAAA;AAAA,EACA,0BAAA;AAAA,EACA,0BAAA;AAAA,EACA,cAAA;AAAA,EACA,YAAA;AAAA,EACA,mBAAA;AAAA,EACA,4BAAA;AAAA,EACA,sBAAA;AAAA,EACA,oCAAA;AAAA,EACA,oCAAA;AAAA,EACA,4BAAA;AAAA,EACA,gCAAA;AAAA,EACA,cAAA;AAAA,EACA,gBAAA;AAAA,EACA,sBAAA;AAAA,EACA,oBAAA;AAAA,EACA,eAAA;AAAA,EACA,aAAA;AAAA,EACA,YAAA;AAAA,EACA,cAAA;AAAA,EACA,kBAAA;AAAA,EACA,aAAA;AAAA,EACA,oBAAA;AAAA,EACA,0BAAA;AAAA,EACA,2BAAA;AAAA,EACA,uBAAA;AAAA,EACA,+BAAA;AAAA,EACA,2BAAA;AAAA,EACA,yBAAA;AAAA,EACA,yBAAA;AAAA,EACA,oBAAA;AAAA,EACA,uBAAA;AAAA,EACA,oBAAA;AAAA,EACA,iBAAA;AAAA,EACA,uBAAA;AAAA,EACA,4BAAA;AAAA,EACA,oCAAA;AAAA,EACA,kBAAA;AAAA,EACA;AACF,CAAA;AAEO,IAAM,gBAAA,GAAsC;AAAA,EACjD,gBAAA;AAAA,EACA,UAAA;AAAA,EACA,iBAAA;AAAA,EACA,sBAAA;AAAA,EACA,mBAAA;AAAA,EACA,iBAAA;AAAA,EACA,kBAAA;AAAA,EACA,4BAAA;AAAA,EACA,+BAAA;AAAA,EACA,qCAAA;AAAA,EACA,0BAAA;AAAA,EACA,2BAAA;AAAA,EACA,wBAAA;AAAA,EACA,sBAAA;AAAA,EACA,yBAAA;AAAA,EACA,OAAA;AAAA,EACA,YAAA;AAAA,EACA,aAAA;AAAA,EACA,qBAAA;AAAA,EACA,sBAAA;AAAA,EACA,mBAAA;AAAA,EACA,yBAAA;AAAA,EACA,sBAAA;AAAA,EACA,uBAAA;AAAA,EACA,gBAAA;AAAA,EACA,wBAAA;AAAA,EACA,YAAA;AAAA,EACA,cAAA;AAAA,EACA,KAAA;AAAA,EACA,MAAA;AAAA,EACA,qBAAA;AAAA,EACA,gBAAA;AAAA,EACA,cAAA;AAAA,EACA,qBAAA;AAAA,EACA,iBAAA;AAAA,EACA,oBAAA;AAAA,EACA,sBAAA;AAAA,EACA,kBAAA;AAAA,EACA,0BAAA;AAAA,EACA,qBAAA;AAAA,EACA,2BAAA;AAAA,EACA,WAAA;AAAA,EACA,YAAA;AAAA,EACA,UAAA;AAAA,EACA,kBAAA;AAAA,EACA;AACF,CAAA;;;ACvGA,IAAM,mBAAA,GAAsB,GAAA;AAC5B,IAAM,mBAAA,GAAsB,CAAA;AAErB,SAAS,aAAA,CACd,UACA,KAAA,EACU;AACV,EAAA,OAAO,gBAAA,CAAiB;AAAA,IACtB,GAAG,kBAAA;AAAA,IACH,GAAI,SAAS,EAAC;AAAA,IACd,GAAG,cAAA,CAAe,QAAA,CAAS,gBAAgB,CAAC;AAAA,GAC7C,CAAA;AACH;AAEO,SAAS,cAAA,CACd,UACA,KAAA,EACS;AACT,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,CAAC,IAAA,KAAS,OAAA,CAAA,CAAS,QAAA,CAAS,IAAI,CAAA,IAAK,EAAA,EAAI,IAAA,EAAM,CAAC,CAAA;AACpE;AAEO,SAAS,eAAA,CACd,UACA,QAAA,EACwB;AACxB,EAAA,MAAM,KAAA,GAAQ,EAAE,GAAG,QAAA,EAAS;AAC5B,EAAA,OAAO,MAAM,eAAe,CAAA;AAC5B,EAAA,OAAO,MAAM,eAAe,CAAA;AAC5B,EAAA,OAAO,MAAM,gBAAgB,CAAA;AAC7B,EAAA,KAAA,MAAW,IAAA,IAAQ,QAAA,EAAU,OAAO,KAAA,CAAM,IAAI,CAAA;AAC9C,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,cAAc,KAAA,EAAuB;AAC5C,EAAA,OAAO,KAAA,CAAM,WAAA,EAAY,CAAE,OAAA,CAAQ,UAAA,EAAY,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAA,EAAQ,GAAG,CAAA,CAAE,IAAA,EAAK;AAChF;AAEA,SAAS,gBAAA,CAAiB,UAAkB,MAAA,EAAoC;AAC9E,EAAA,IAAI,CAAC,UAAU,OAAO,IAAA;AACtB,EAAA,IAAI,WAAW,IAAA,EAAM;AACnB,IAAA,MAAM,OAAA,GAAU,QAAA,CAAS,OAAA,CAAQ,YAAA,EAAc,EAAE,CAAA;AACjD,IAAA,IAAI,CAAC,uBAAA,CAAwB,IAAA,CAAK,OAAO,GAAG,OAAO,cAAA;AACnD,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AACzC,EAAA,IAAI,MAAA,CAAO,SAAS,CAAA,IAAK,CAAC,iBAAiB,IAAA,CAAK,MAAM,GAAG,OAAO,cAAA;AAChE,EAAA,OAAO,IAAA;AACT;AAEA,eAAsB,eAAe,MAAA,EAMT;AAC1B,EAAA,MAAM,EAAE,EAAA,EAAI,QAAA,EAAU,SAAA,EAAW,OAAA,EAAS,MAAK,GAAI,MAAA;AACnD,EAAA,MAAM,UAAoB,EAAC;AAC3B,EAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,EAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,mBAAA;AACvC,EAAA,MAAM,YAAA,GAAe,QAAQ,YAAA,IAAgB,mBAAA;AAC7C,EAAA,MAAM,MAAA,GAAS,QAAQ,WAAA,IAAe,MAAA;AAEtC,EAAA,MAAM,eAAA,GAAkB,MAAA,CAAO,QAAA,CAAS,eAAe,KAAK,CAAC,CAAA;AAC7D,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI,MAAA,CAAO,QAAA,CAAS,eAAe,CAAA,IAAK,kBAAkB,CAAA,EAAG;AAC3D,IAAA,SAAA,GAAY,IAAA,CAAK,KAAI,GAAI,eAAA;AAEzB,IAAA,IAAI,SAAA,GAAY,CAAA,IAAK,SAAA,GAAY,SAAA,EAAW;AAC1C,MAAA,OAAA,CAAQ,IAAA,CAAK,SAAA,GAAY,CAAA,GAAI,0BAAA,GAA6B,oBAAoB,CAAA;AAC9E,MAAA,OAAO,EAAE,QAAA,EAAU,SAAA,EAAW,KAAA,EAAO,GAAA,EAAK,SAAS,SAAA,EAAU;AAAA,IAC/D;AAAA,EACF,CAAA,MAAO;AACL,IAAA,OAAA,CAAQ,KAAK,0BAA0B,CAAA;AACvC,IAAA,OAAO,EAAE,QAAA,EAAU,SAAA,EAAW,KAAA,EAAO,GAAA,EAAK,SAAS,SAAA,EAAU;AAAA,EAC/D;AAEA,EAAA,IAAI,SAAS,OAAA,EAAS;AACpB,IAAA,OAAO,EAAE,QAAA,EAAU,OAAA,EAAS,KAAA,EAAO,CAAA,EAAG,SAAS,SAAA,EAAU;AAAA,EAC3D;AAEA,EAAA,IAAI,sBAAA,CAAuB,IAAA,CAAK,QAAA,CAAS,OAAA,IAAW,EAAE,CAAA,EAAG;AACvD,IAAA,OAAA,CAAQ,KAAK,eAAe,CAAA;AAC5B,IAAA,OAAO,EAAE,QAAA,EAAU,SAAA,EAAW,KAAA,EAAO,GAAA,EAAK,SAAS,SAAA,EAAU;AAAA,EAC/D;AAEA,EAAA,MAAM,GAAA,GAAM,aAAA,CAAc,QAAA,CAAS,OAAA,IAAW,EAAE,CAAA;AAChD,EAAA,MAAM,SAAA,GAAY,CAAC,GAAG,eAAA,EAAiB,GAAI,OAAA,CAAQ,cAAA,IAAkB,EAAG,CAAA;AACxE,EAAA,KAAA,MAAW,QAAQ,SAAA,EAAW;AAC5B,IAAA,IAAI,GAAA,CAAI,QAAA,CAAS,aAAA,CAAc,IAAI,CAAC,CAAA,EAAG;AACrC,MAAA,OAAA,CAAQ,IAAA,CAAK,CAAA,UAAA,EAAa,IAAI,CAAA,CAAE,CAAA;AAChC,MAAA,OAAO,EAAE,QAAA,EAAU,SAAA,EAAW,KAAA,EAAO,GAAA,EAAK,SAAS,SAAA,EAAU;AAAA,IAC/D;AAAA,EACF;AAEA,EAAA,MAAM,UAAA,GAAa,CAAC,GAAG,gBAAA,EAAkB,GAAI,OAAA,CAAQ,eAAA,IAAmB,EAAG,CAAA;AAC3E,EAAA,KAAA,MAAW,QAAQ,UAAA,EAAY;AAC7B,IAAA,IAAI,GAAA,CAAI,QAAA,CAAS,aAAA,CAAc,IAAI,CAAC,CAAA,EAAG;AACrC,MAAA,KAAA,IAAS,CAAA;AACT,MAAA,OAAA,CAAQ,IAAA,CAAK,CAAA,WAAA,EAAc,IAAI,CAAA,CAAE,CAAA;AAAA,IACnC;AAAA,EACF;AAEA,EAAA,IAAA,CAAK,QAAA,CAAS,OAAA,IAAW,EAAA,EAAI,MAAA,GAAS,GAAA,EAAK;AACzC,IAAA,KAAA,IAAS,CAAA;AACT,IAAA,OAAA,CAAQ,KAAK,kBAAkB,CAAA;AAAA,EACjC;AAEA,EAAA,MAAM,eAAA,GAAA,CAAmB,SAAS,OAAA,IAAW,EAAA,EAAI,MAAM,OAAO,CAAA,CAAE,MAAA,CAAO,OAAO,CAAA,CAAE,MAAA;AAChF,EAAA,IAAI,mBAAmB,CAAA,EAAG;AACxB,IAAA,KAAA,IAAS,CAAA;AACT,IAAA,OAAA,CAAQ,KAAK,iBAAiB,CAAA;AAAA,EAChC;AAEA,EAAA,MAAM,WAAA,GAAc,gBAAA,CAAiB,QAAA,CAAS,KAAA,IAAS,IAAI,MAAM,CAAA;AACjE,EAAA,IAAI,WAAA,EAAa;AACf,IAAA,KAAA,IAAS,CAAA;AACT,IAAA,OAAA,CAAQ,KAAK,WAAW,CAAA;AAAA,EAC1B;AAEA,EAAA,MAAM,aAAA,GAAgB,IAAI,IAAA,CAAK,IAAA,CAAK,GAAA,KAAQ,EAAA,GAAK,EAAA,GAAK,GAAI,CAAA,CAAE,WAAA,EAAY;AACxE,EAAA,MAAM,QAAA,GAAW,QAAA,CAAS,eAAe,CAAA,IAAK,SAAA;AAE9C,EAAA,MAAM,KAAA,GAAQ,MAAM,EAAA,CACjB,OAAA;AAAA,IACC,CAAA;AAAA,mEAAA;AAAA,IAGD,IAAA,CAAK,QAAA,EAAU,aAAA,EAAe,SAAS,EACvC,KAAA,EAAqB;AACxB,EAAA,IAAI,MAAA,CAAO,KAAA,EAAO,CAAA,IAAK,CAAC,KAAK,CAAA,EAAG;AAC9B,IAAA,OAAA,CAAQ,KAAK,iBAAiB,CAAA;AAC9B,IAAA,OAAO,EAAE,QAAA,EAAU,SAAA,EAAW,KAAA,EAAO,GAAA,EAAK,SAAS,SAAA,EAAU;AAAA,EAC/D;AAEA,EAAA,MAAM,SAAS,QAAA,CAAS,KAAA,IAAS,EAAA,EAAI,IAAA,GAAO,WAAA,EAAY;AACxD,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,MAAM,QAAA,GAAW,MAAM,EAAA,CACpB,OAAA;AAAA,MACC,CAAA;AAAA;AAAA,qDAAA;AAAA,MAID,IAAA,CAAK,QAAA,EAAU,aAAA,EAAe,KAAK,EACnC,KAAA,EAAqB;AACxB,IAAA,IAAI,MAAA,CAAO,QAAA,EAAU,CAAA,IAAK,CAAC,KAAK,CAAA,EAAG;AACjC,MAAA,OAAA,CAAQ,KAAK,oBAAoB,CAAA;AACjC,MAAA,OAAO,EAAE,QAAA,EAAU,SAAA,EAAW,KAAA,EAAO,GAAA,EAAK,SAAS,SAAA,EAAU;AAAA,IAC/D;AAAA,EACF;AAEA,EAAA,IAAI,SAAS,YAAA,EAAc;AACzB,IAAA,OAAO,EAAE,QAAA,EAAU,SAAA,EAAW,KAAA,EAAO,SAAS,SAAA,EAAU;AAAA,EAC1D;AAEA,EAAA,OAAO,EAAE,QAAA,EAAU,OAAA,EAAS,KAAA,EAAO,SAAS,SAAA,EAAU;AACxD;;;ACzJO,SAAS,wBACd,OAAA,EAC8B;AAC9B,EAAA,MAAM,KAAA,GAAQ,QAAQ,KAAA,KAAU,KAAA;AAChC,EAAA,MAAM,eAAA,GAAkB,OAAA,CAAQ,eAAA,IAAmB,CAAC,SAAS,CAAA;AAC7D,EAAA,MAAM,aAAA,GAAgB,OAAA,CAAQ,aAAA,IAAiB,EAAC;AAEhD,EAAA,SAAS,YAAY,IAAA,EAAiB;AACpC,IAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,eAAA,EAAiB,GAAG,IAAI,CAAA;AAAA,EACjD;AAEA,EAAA,OAAO,OAAO,OAAA,KAAY;AACxB,IAAA,MAAM,EAAE,OAAA,EAAS,GAAA,EAAI,GAAI,OAAA;AAEzB,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,aAAA,CAAc,OAAO,CAAA;AAC5C,MAAA,IAAI,CAAC,QAAA,EAAU;AACb,QAAA,OAAO,YAAA,CAAa,EAAE,KAAA,EAAO,0BAAA,IAA8B,GAAG,CAAA;AAAA,MAChE;AAEA,MAAA,MAAM,QAAA,GAAW,QAAA,CAAS,eAAe,CAAA,IAAK,SAAA;AAC9C,MAAA,MAAM,QAAA,GAAW,IAAI,SAAA,IAAa,SAAA;AAClC,MAAA,MAAM,QAAA,GAAW,aAAA,CAAc,QAAA,EAAU,OAAA,CAAQ,mBAAmB,CAAA;AACpE,MAAA,MAAM,iBAAA,GAAoB,cAAA,CAAe,QAAA,EAAU,QAAQ,CAAA;AAE3D,MAAA,MAAM,SAAA,GAAY,SAAS,OAAO,CAAA;AAClC,MAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,YAAY,CAAA,IAAK,SAAA;AACvD,MAAA,MAAM,WAAA,GAAA,iBAAc,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAE3C,MAAA,IAAI,cAAA,GAAiC,EAAE,QAAA,EAAU,OAAA,EAAS,OAAO,CAAA,EAAG,OAAA,EAAS,EAAC,EAAE;AAEhF,MAAA,IAAI,iBAAA,EAAmB;AACrB,QAAA,cAAA,GAAiB;AAAA,UACf,QAAA,EAAU,SAAA;AAAA,UACV,KAAA,EAAO,GAAA;AAAA,UACP,OAAA,EAAS,CAAC,uBAAuB;AAAA,SACnC;AACA,QAAA,QAAA,CAAS,mDAA8C,CAAA;AAAA,MACzD,CAAA,MAAA,IAAW,eAAA,CAAgB,QAAA,CAAS,QAAQ,CAAA,EAAG;AAC7C,QAAA,cAAA,GAAiB,MAAM,cAAA,CAAe;AAAA,UACpC,IAAI,GAAA,CAAI,EAAA;AAAA,UACR,QAAA;AAAA,UACA,SAAA;AAAA,UACA,OAAA;AAAA,UACA,IAAA,EAAM;AAAA,SACP,CAAA;AACD,QAAA,IAAI,cAAA,CAAe,aAAa,SAAA,EAAW;AACzC,UAAA,QAAA,CAAS,8BAAA,EAAgC,cAAA,CAAe,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,QAC5E;AAAA,MACF,CAAA,MAAA,IAAW,aAAA,CAAc,QAAA,CAAS,QAAQ,CAAA,EAAG;AAC3C,QAAA,cAAA,GAAiB,MAAM,cAAA,CAAe;AAAA,UACpC,IAAI,GAAA,CAAI,EAAA;AAAA,UACR,QAAA;AAAA,UACA,SAAA;AAAA,UACA,OAAA;AAAA,UACA,IAAA,EAAM;AAAA,SACP,CAAA;AACD,QAAA,IAAI,cAAA,CAAe,aAAa,SAAA,EAAW;AACzC,UAAA,QAAA,CAAS,8BAAA,EAAgC,cAAA,CAAe,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,QAC5E;AAAA,MACF;AAEA,MAAA,MAAM,aAAA,GAAgB,eAAA,CAAgB,QAAA,EAAU,QAAQ,CAAA;AACxD,MAAA,MAAM,UAAA,GACJ,qBACA,eAAA,CAAgB,QAAA,CAAS,QAAQ,CAAA,IACjC,aAAA,CAAc,SAAS,QAAQ,CAAA;AAEjC,MAAA,MAAM,YAAA,GAAe,MAAM,GAAA,CAAI,EAAA,CAAG,OAAA;AAAA,QAChC,CAAA;AAAA;AAAA;AAAA,iDAAA;AAAA,OAIF,CACG,IAAA;AAAA,QACC,QAAA;AAAA,QACA,QAAA;AAAA,QACA,WAAA;AAAA,QACA,SAAA;AAAA,QACA,SAAA;AAAA,QACA,IAAA,CAAK,UAAU,aAAa,CAAA;AAAA,QAC5B,UAAA,GAAa,eAAe,QAAA,GAAW,IAAA;AAAA,QACvC,UAAA,GAAa,eAAe,KAAA,GAAQ,IAAA;AAAA,QACpC,UAAA,GAAa,IAAA,CAAK,SAAA,CAAU,cAAA,CAAe,OAAO,CAAA,GAAI,IAAA;AAAA,QACtD,UAAA,GAAc,cAAA,CAAe,SAAA,IAAa,IAAA,GAAQ;AAAA,QAEnD,GAAA,EAAI;AAEP,MAAA,IAAI,CAAC,YAAA,CAAa,OAAA,EAAS,MAAM,IAAI,MAAM,wBAAwB,CAAA;AAEnE,MAAA,MAAM,YAAA,GAAe,aAAa,IAAA,CAAK,WAAA;AAEvC,MAAA,MAAM,qBAAA,GACJ,cAAA,CAAe,QAAA,KAAa,SAAA,GACxB,CAAA,kBAAA,EAAqB,cAAA,CAAe,KAAK,CAAA,GAAA,EAAM,cAAA,CAAe,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,GAChF,IAAA;AAEN,MAAA,IAAI,qBAAA,EAAuB;AACzB,QAAA,MAAM,GAAA,CAAI,GAAG,OAAA,CAAQ,CAAA,wDAAA,CAA0D,EAC5E,IAAA,CAAK,qBAAA,EAAuB,YAAY,CAAA,CACxC,GAAA,EAAI;AACP,QAAA,OAAO,YAAA,CAAa,EAAE,OAAA,EAAS,IAAA,EAAM,CAAA;AAAA,MACvC;AAEA,MAAA,MAAM,EAAA,GAAK,kBAAA,CAAmB,GAAA,CAAI,kBAAA,EAAoB,QAAQ,cAAc,CAAA;AAC5E,MAAA,IAAI,CAAC,GAAG,MAAA,EAAQ;AACd,QAAA,MAAM,IAAI,MAAM,mCAAmC,CAAA;AAAA,MACrD;AAEA,MAAA,IAAI;AACF,QAAA,MAAM,EAAE,OAAA,EAAS,IAAA,KAAS,OAAA,CAAQ,UAAA,CAAW,UAAU,aAAa,CAAA;AACpE,QAAA,MAAM,cAAA;AAAA,UACJ,GAAA,CAAI,aAAA;AAAA,UACJ,EAAA;AAAA,UACA,OAAA;AAAA,UACA,IAAA;AAAA,UACA,QAAQ,MAAA,IAAU;AAAA,SACpB;AACA,QAAA,MAAM,IAAI,EAAA,CAAG,OAAA;AAAA,UACX,CAAA,0EAAA;AAAA,SACF,CACG,sBAAK,IAAI,IAAA,IAAO,WAAA,EAAY,EAAG,YAAY,CAAA,CAC3C,GAAA,EAAI;AACP,QAAA,QAAA,CAAS,YAAA,EAAc,EAAE,EAAA,EAAI,YAAA,EAAc,CAAA;AAAA,MAC7C,SAAS,UAAA,EAAY;AACnB,QAAA,OAAA,CAAQ,KAAA,CAAM,sBAAsB,UAAU,CAAA;AAC9C,QAAA,MAAM,GAAA,CAAI,EAAA,CAAG,OAAA,CAAQ,CAAA,wDAAA,CAA0D,CAAA,CAC5E,IAAA,CAAK,MAAA,CAAO,UAAU,CAAA,EAAG,YAAY,CAAA,CACrC,GAAA,EAAI;AAAA,MACT;AAEA,MAAA,OAAO,YAAA,CAAa,EAAE,OAAA,EAAS,IAAA,EAAM,cAAc,CAAA;AAAA,IACrD,SAAS,KAAA,EAAO;AACd,MAAA,OAAA,CAAQ,KAAA,CAAM,0BAA0B,KAAK,CAAA;AAC7C,MAAA,OAAO,YAAA,CAAa,EAAE,KAAA,EAAO,mBAAA,EAAqB,SAAS,MAAA,CAAO,KAAK,CAAA,EAAE,EAAG,GAAG,CAAA;AAAA,IACjF;AAAA,EACF,CAAA;AACF","file":"submit-form.js","sourcesContent":["/**\n * Names used in HTML and POST bodies.\n *\n * Keep these boring. Do not use \"honeypot\", \"trap\", \"spam\", or \"bot\" —\n * crawlers that read the source skip those.\n *\n * `data-lgx-aux` = auxiliary field (LOGEIX prefix, looks like a form helper).\n * `form_build` = which aux field names were on the page (client → server).\n */\n\nexport const AUX_ATTR = \"data-lgx-aux\";\nexport const AUX_ROW_ATTR = \"data-lgx-aux-row\";\nexport const LEAD_FORM_ATTR = \"data-lgx-lead\";\nexport const FORM_BUILD_FIELD = \"form_build\";\nexport const TIMESTAMP_FIELD = \"submitted_at_client\";\nexport const FORM_NAME_FIELD = \"form-name\";\nexport const SOURCE_FIELD = \"source\";\n\n/** Always treated as aux fields, even if the client never tags them. */\nexport const DEFAULT_AUX_FIELDS = [\"confirm_email\", \"bot-field\"] as const;\n\nexport const FORM_BUILD_VERSION = \"1\";\n\nexport function encodeFormBuild(auxNames: string[]): string {\n  const names = uniqueFieldNames(auxNames);\n  return names.length ? `${FORM_BUILD_VERSION}~${names.join(\",\")}` : FORM_BUILD_VERSION;\n}\n\nexport function parseFormBuild(raw: string | undefined): string[] {\n  if (!raw) return [];\n  const tilde = raw.indexOf(\"~\");\n  if (tilde < 0) return [];\n  return uniqueFieldNames(raw.slice(tilde + 1).split(\",\"));\n}\n\nexport function uniqueFieldNames(names: Iterable<string>): string[] {\n  const out: string[] = [];\n  const seen = new Set<string>();\n  for (const name of names) {\n    const n = name.trim();\n    if (!n || !/^[A-Za-z][\\w:-]*$/.test(n)) continue;\n    const key = n.toLowerCase();\n    if (seen.has(key)) continue;\n    seen.add(key);\n    out.push(n);\n  }\n  return out;\n}\n","export interface BrevoEmailRequest {\n  sender: { name: string; email: string };\n  to: Array<{ email: string; name?: string }>;\n  subject: string;\n  htmlContent: string;\n}\n\nexport const DEFAULT_SENDER = {\n  name: \"LOGEIX Agency\",\n  email: \"noreply@logeix.com\",\n} as const;\n\nexport async function sendBrevoEmail(\n  apiKey: string,\n  toEmails: string[],\n  subject: string,\n  htmlContent: string,\n  sender: { name: string; email: string } = DEFAULT_SENDER,\n): Promise<void> {\n  const payload: BrevoEmailRequest = {\n    sender,\n    to: toEmails.map((email) => ({ email })),\n    subject,\n    htmlContent,\n  };\n\n  const res = await fetch(\"https://api.brevo.com/v3/smtp/email\", {\n    method: \"POST\",\n    headers: {\n      Accept: \"application/json\",\n      \"Content-Type\": \"application/json\",\n      \"api-key\": apiKey,\n    },\n    body: JSON.stringify(payload),\n  });\n\n  if (!res.ok) {\n    throw new Error(`Brevo API error: ${res.status} – ${await res.text()}`);\n  }\n}\n\nexport function notificationEmails(\n  envEmail: string | undefined,\n  fallback: string[] | undefined,\n): string[] {\n  const list = (envEmail || \"\")\n    .split(\",\")\n    .map((s) => s.trim())\n    .filter(Boolean);\n  if (list.length) return list;\n  return fallback?.filter(Boolean) ?? [];\n}\n","export async function parseFormBody(request: Request): Promise<Record<string, string> | null> {\n  const contentType = request.headers.get(\"content-type\") || \"\";\n\n  if (contentType.includes(\"application/x-www-form-urlencoded\")) {\n    const text = await request.text();\n    const formData: Record<string, string> = {};\n    new URLSearchParams(text).forEach((value, key) => {\n      formData[key] = value;\n    });\n    return formData;\n  }\n\n  if (contentType.includes(\"application/json\")) {\n    const raw = (await request.json()) as Record<string, unknown>;\n    const formData: Record<string, string> = {};\n    for (const [key, value] of Object.entries(raw)) {\n      if (value == null) continue;\n      formData[key] = String(value);\n    }\n    return formData;\n  }\n\n  return null;\n}\n\nexport function jsonResponse(body: unknown, status = 200): Response {\n  return new Response(JSON.stringify(body), {\n    status,\n    headers: { \"Content-Type\": \"application/json\" },\n  });\n}\n\nexport function clientIp(request: Request): string {\n  return (\n    request.headers.get(\"CF-Connecting-IP\") ||\n    request.headers.get(\"X-Forwarded-For\") ||\n    \"unknown\"\n  );\n}\n","/**\n * Shared phrase lists. Sites add extras via createSubmitFormHandler({ extraHardTerms, extraScoreTerms }).\n * Matching is case-insensitive after punctuation is stripped to spaces.\n */\n\nexport const HARD_SPAM_TERMS: readonly string[] = [\n  \"seo report\",\n  \"seo strategy\",\n  \"seo services\",\n  \"seo specialist\",\n  \"seo expert\",\n  \"seo audit\",\n  \"search engine optimisation\",\n  \"search engine optimization\",\n  \"digital marketing\",\n  \"digital marketing manager\",\n  \"guest post\",\n  \"domain authority\",\n  \"dr 50\",\n  \"backlink\",\n  \"cold outreach\",\n  \"reddit demand\",\n  \"real reddit conversations\",\n  \"monitoring relevant subreddits\",\n  \"warm inbound interest\",\n  \"proposal package\",\n  \"if this is relevant for you\",\n  \"if my previous email didn t go through\",\n  \"if your previous email didn t go through\",\n  \"if you're not interested\",\n  \"if you re not interested\",\n  'send us \"no\"',\n  \"send us no\",\n  \"motivated clients\",\n  \"ethical strategies to draw\",\n  \"social media content\",\n  \"ready to post social media content\",\n  \"7 days of posting content for free\",\n  \"internet marketing warlock\",\n  \"creating money out of thin air\",\n  \"hidden money\",\n  \"trigger points\",\n  \"sell to the affluent\",\n  \"escort application\",\n  \"spellpros com\",\n  \"unsubscribe\",\n  \"trustpilot\",\n  \"fake reviews\",\n  \"purchase reviews\",\n  \"buy reviews\",\n  \"buy google reviews\",\n  \"verified reviews package\",\n  \"reputation repair service\",\n  \"reputation management\",\n  \"manage your online reputation\",\n  \"suppress negative reviews\",\n  \"negative review removal\",\n  \"remove negative reviews\",\n  \"remove bad reviews\",\n  \"selling your business\",\n  \"sell your business\",\n  \"business broker\",\n  \"interested in selling\",\n  \"buying plumbing businesses\",\n  \"buying businesses in your industry\",\n  \"quantity takeoff\",\n  \"stop to opt out\",\n];\n\nexport const SCORE_SPAM_TERMS: readonly string[] = [\n  \"search results\",\n  \"rankings\",\n  \"online presence\",\n  \"visibility on google\",\n  \"search visibility\",\n  \"organic traffic\",\n  \"relevant traffic\",\n  \"convenient time to connect\",\n  \"let me know a convenient time\",\n  \"i recently came across your website\",\n  \"came across your website\",\n  \"came across your business\",\n  \"i noticed your website\",\n  \"pricing and packages\",\n  \"my services and pricing\",\n  \"leads\",\n  \"learn more\",\n  \"book a call\",\n  \"operational systems\",\n  \"day to day workflows\",\n  \"specific examples\",\n  \"high quality email list\",\n  \"free posting content\",\n  \"local business owners\",\n  \"show up online\",\n  \"quote/package/proposal\",\n  \"brand-safe\",\n  \"aged-account\",\n  \"b2b\",\n  \"saas\",\n  \"high-intent threads\",\n  \"google reviews\",\n  \"yelp reviews\",\n  \"tripadvisor reviews\",\n  \"review building\",\n  \"boost your reviews\",\n  \"improve your reviews\",\n  \"more reviews for\",\n  \"positive reviews package\",\n  \"ratings and reviews\",\n  \"reviews for your business\",\n  \"reply yes\",\n  \"vas 4 hire\",\n  \"vas4hire\",\n  \"takeoff services\",\n  \"senior estimator\",\n];\n","/// <reference types=\"@cloudflare/workers-types\" />\n\nimport {\n  DEFAULT_AUX_FIELDS,\n  FORM_BUILD_FIELD,\n  FORM_NAME_FIELD,\n  TIMESTAMP_FIELD,\n  parseFormBuild,\n  uniqueFieldNames,\n} from \"../shared\";\nimport { HARD_SPAM_TERMS, SCORE_SPAM_TERMS } from \"./terms\";\nimport type { PhoneLocale, SpamAssessment, SubmitFormOptions } from \"./types\";\n\nconst DEFAULT_MIN_FILL_MS = 3000;\nconst DEFAULT_BLOCK_SCORE = 4;\n\nexport function auxFieldNames(\n  formData: Record<string, string>,\n  extra: string[] | undefined,\n): string[] {\n  return uniqueFieldNames([\n    ...DEFAULT_AUX_FIELDS,\n    ...(extra ?? []),\n    ...parseFormBuild(formData[FORM_BUILD_FIELD]),\n  ]);\n}\n\nexport function auxFieldFilled(\n  formData: Record<string, string>,\n  names: string[],\n): boolean {\n  return names.some((name) => Boolean((formData[name] || \"\").trim()));\n}\n\nexport function stripMetaFields(\n  formData: Record<string, string>,\n  auxNames: string[],\n): Record<string, string> {\n  const clean = { ...formData };\n  delete clean[FORM_NAME_FIELD];\n  delete clean[TIMESTAMP_FIELD];\n  delete clean[FORM_BUILD_FIELD];\n  for (const name of auxNames) delete clean[name];\n  return clean;\n}\n\nfunction normaliseText(input: string): string {\n  return input.toLowerCase().replace(/[^\\w\\s]/g, \" \").replace(/\\s+/g, \" \").trim();\n}\n\nfunction phoneScoreReason(rawPhone: string, locale: PhoneLocale): string | null {\n  if (!rawPhone) return null;\n  if (locale === \"uk\") {\n    const compact = rawPhone.replace(/[\\s\\-().]/g, \"\");\n    if (!/^(\\+44|0)[0-9]{9,10}$/.test(compact)) return \"non-uk-phone\";\n    return null;\n  }\n  const digits = rawPhone.replace(/\\D/g, \"\");\n  if (digits.length > 0 && !/^1?[2-9]\\d{9}$/.test(digits)) return \"non-us-phone\";\n  return null;\n}\n\nexport async function assessFormSpam(params: {\n  db: D1Database;\n  formData: Record<string, string>;\n  ipAddress: string;\n  options: SubmitFormOptions;\n  mode: \"full\" | \"gates\";\n}): Promise<SpamAssessment> {\n  const { db, formData, ipAddress, options, mode } = params;\n  const reasons: string[] = [];\n  let score = 0;\n  const minFillMs = options.minFillMs ?? DEFAULT_MIN_FILL_MS;\n  const blockScoreAt = options.blockScoreAt ?? DEFAULT_BLOCK_SCORE;\n  const locale = options.phoneLocale ?? \"nanp\";\n\n  const clientTimestamp = Number(formData[TIMESTAMP_FIELD] || 0);\n  let elapsedMs: number | undefined;\n  if (Number.isFinite(clientTimestamp) && clientTimestamp > 0) {\n    elapsedMs = Date.now() - clientTimestamp;\n    // Negative elapsed = client clock ahead / forged future timestamp\n    if (elapsedMs < 0 || elapsedMs < minFillMs) {\n      reasons.push(elapsedMs < 0 ? \"invalid-client-timestamp\" : \"submitted-too-fast\");\n      return { decision: \"blocked\", score: 100, reasons, elapsedMs };\n    }\n  } else {\n    reasons.push(\"missing-client-timestamp\");\n    return { decision: \"blocked\", score: 100, reasons, elapsedMs };\n  }\n\n  if (mode === \"gates\") {\n    return { decision: \"allow\", score: 0, reasons, elapsedMs };\n  }\n\n  if (/(https?:\\/\\/|www\\.)/i.test(formData.message || \"\")) {\n    reasons.push(\"contains-link\");\n    return { decision: \"blocked\", score: 100, reasons, elapsedMs };\n  }\n\n  const msg = normaliseText(formData.message || \"\");\n  const hardTerms = [...HARD_SPAM_TERMS, ...(options.extraHardTerms ?? [])];\n  for (const term of hardTerms) {\n    if (msg.includes(normaliseText(term))) {\n      reasons.push(`hard-term:${term}`);\n      return { decision: \"blocked\", score: 100, reasons, elapsedMs };\n    }\n  }\n\n  const scoreTerms = [...SCORE_SPAM_TERMS, ...(options.extraScoreTerms ?? [])];\n  for (const term of scoreTerms) {\n    if (msg.includes(normaliseText(term))) {\n      score += 2;\n      reasons.push(`score-term:${term}`);\n    }\n  }\n\n  if ((formData.message || \"\").length > 550) {\n    score += 2;\n    reasons.push(\"message-too-long\");\n  }\n\n  const paragraphBreaks = (formData.message || \"\").split(/\\r?\\n/).filter(Boolean).length;\n  if (paragraphBreaks >= 8) {\n    score += 1;\n    reasons.push(\"many-paragraphs\");\n  }\n\n  const phoneReason = phoneScoreReason(formData.phone || \"\", locale);\n  if (phoneReason) {\n    score += 2;\n    reasons.push(phoneReason);\n  }\n\n  const tenMinutesAgo = new Date(Date.now() - 10 * 60 * 1000).toISOString();\n  const formName = formData[FORM_NAME_FIELD] || \"contact\";\n\n  const ipRow = await db\n    .prepare(\n      `SELECT COUNT(*) AS c FROM form_submissions\n       WHERE form_name = ? AND submitted_at >= ? AND ip_address = ?`,\n    )\n    .bind(formName, tenMinutesAgo, ipAddress)\n    .first<{ c: number }>();\n  if (Number(ipRow?.c || 0) >= 3) {\n    reasons.push(\"ip-rate-limited\");\n    return { decision: \"blocked\", score: 100, reasons, elapsedMs };\n  }\n\n  const email = (formData.email || \"\").trim().toLowerCase();\n  if (email) {\n    const emailRow = await db\n      .prepare(\n        `SELECT COUNT(*) AS c FROM form_submissions\n         WHERE form_name = ? AND submitted_at >= ?\n           AND json_extract(form_data, '$.email') = ?`,\n      )\n      .bind(formName, tenMinutesAgo, email)\n      .first<{ c: number }>();\n    if (Number(emailRow?.c || 0) >= 2) {\n      reasons.push(\"email-rate-limited\");\n      return { decision: \"blocked\", score: 100, reasons, elapsedMs };\n    }\n  }\n\n  if (score >= blockScoreAt) {\n    return { decision: \"blocked\", score, reasons, elapsedMs };\n  }\n\n  return { decision: \"allow\", score, reasons, elapsedMs };\n}\n","/// <reference types=\"@cloudflare/workers-types\" />\n/**\n * Cloudflare Pages Function factory — contact (and other) forms → D1 + Brevo.\n *\n * Every submission (including spam) is written to D1.\n * Blocked rows get email suppressed and the reason stored in email_error.\n */\n\nimport { FORM_NAME_FIELD } from \"../shared\";\nimport { DEFAULT_SENDER, notificationEmails, sendBrevoEmail } from \"./brevo\";\nimport { clientIp, jsonResponse, parseFormBody } from \"./parse\";\nimport { assessFormSpam, auxFieldFilled, auxFieldNames, stripMetaFields } from \"./spam\";\nimport type { SpamAssessment, SubmitFormEnv, SubmitFormOptions } from \"./types\";\n\nexport type { EmailContent, PhoneLocale, SubmitFormOptions } from \"./types\";\n\nexport function createSubmitFormHandler(\n  options: SubmitFormOptions,\n): PagesFunction<SubmitFormEnv> {\n  const debug = options.debug !== false;\n  const assessFormNames = options.assessFormNames ?? [\"contact\"];\n  const gateFormNames = options.gateFormNames ?? [];\n\n  function debugLog(...args: unknown[]) {\n    if (debug) console.log(\"[submit-form]\", ...args);\n  }\n\n  return async (context) => {\n    const { request, env } = context;\n\n    try {\n      const formData = await parseFormBody(request);\n      if (!formData) {\n        return jsonResponse({ error: \"Unsupported content type\" }, 400);\n      }\n\n      const formName = formData[FORM_NAME_FIELD] || \"unknown\";\n      const siteName = env.SITE_NAME || \"unknown\";\n      const auxNames = auxFieldNames(formData, options.extraHoneypotFields);\n      const honeypotTriggered = auxFieldFilled(formData, auxNames);\n\n      const ipAddress = clientIp(request);\n      const userAgent = request.headers.get(\"User-Agent\") || \"unknown\";\n      const submittedAt = new Date().toISOString();\n\n      let spamAssessment: SpamAssessment = { decision: \"allow\", score: 0, reasons: [] };\n\n      if (honeypotTriggered) {\n        spamAssessment = {\n          decision: \"blocked\",\n          score: 100,\n          reasons: [\"honeypot-field-filled\"],\n        };\n        debugLog(\"aux field filled — logging row without email\");\n      } else if (assessFormNames.includes(formName)) {\n        spamAssessment = await assessFormSpam({\n          db: env.DB,\n          formData,\n          ipAddress,\n          options,\n          mode: \"full\",\n        });\n        if (spamAssessment.decision === \"blocked\") {\n          debugLog(\"submission blocked (logged):\", spamAssessment.reasons.join(\"; \"));\n        }\n      } else if (gateFormNames.includes(formName)) {\n        spamAssessment = await assessFormSpam({\n          db: env.DB,\n          formData,\n          ipAddress,\n          options,\n          mode: \"gates\",\n        });\n        if (spamAssessment.decision === \"blocked\") {\n          debugLog(\"gated form blocked (logged):\", spamAssessment.reasons.join(\"; \"));\n        }\n      }\n\n      const cleanFormData = stripMetaFields(formData, auxNames);\n      const recordSpam =\n        honeypotTriggered ||\n        assessFormNames.includes(formName) ||\n        gateFormNames.includes(formName);\n\n      const insertResult = await env.DB.prepare(\n        `INSERT INTO form_submissions\n         (site_name, form_name, submitted_at, ip_address, user_agent, form_data, email_sent,\n          spam_decision, spam_score, spam_reasons, spam_elapsed_ms)\n         VALUES (?, ?, ?, ?, ?, ?, 0, ?, ?, ?, ?)`,\n      )\n        .bind(\n          siteName,\n          formName,\n          submittedAt,\n          ipAddress,\n          userAgent,\n          JSON.stringify(cleanFormData),\n          recordSpam ? spamAssessment.decision : null,\n          recordSpam ? spamAssessment.score : null,\n          recordSpam ? JSON.stringify(spamAssessment.reasons) : null,\n          recordSpam ? (spamAssessment.elapsedMs ?? null) : null,\n        )\n        .run();\n\n      if (!insertResult.success) throw new Error(\"Database insert failed\");\n\n      const submissionId = insertResult.meta.last_row_id as number;\n\n      const emailSuppressedReason =\n        spamAssessment.decision === \"blocked\"\n          ? `Suppressed (score ${spamAssessment.score}): ${spamAssessment.reasons.join(\", \")}`\n          : null;\n\n      if (emailSuppressedReason) {\n        await env.DB.prepare(`UPDATE form_submissions SET email_error = ? WHERE id = ?`)\n          .bind(emailSuppressedReason, submissionId)\n          .run();\n        return jsonResponse({ success: true });\n      }\n\n      const to = notificationEmails(env.NOTIFICATION_EMAIL, options.fallbackEmails);\n      if (!to.length) {\n        throw new Error(\"No notification emails configured\");\n      }\n\n      try {\n        const { subject, html } = options.buildEmail(formName, cleanFormData);\n        await sendBrevoEmail(\n          env.BREVO_API_KEY,\n          to,\n          subject,\n          html,\n          options.sender ?? DEFAULT_SENDER,\n        );\n        await env.DB.prepare(\n          `UPDATE form_submissions SET email_sent = 1, email_sent_at = ? WHERE id = ?`,\n        )\n          .bind(new Date().toISOString(), submissionId)\n          .run();\n        debugLog(\"email sent\", { to, submissionId });\n      } catch (emailError) {\n        console.error(\"Email send failed:\", emailError);\n        await env.DB.prepare(`UPDATE form_submissions SET email_error = ? WHERE id = ?`)\n          .bind(String(emailError), submissionId)\n          .run();\n      }\n\n      return jsonResponse({ success: true, submissionId });\n    } catch (error) {\n      console.error(\"Form submission error:\", error);\n      return jsonResponse({ error: \"Submission failed\", message: String(error) }, 500);\n    }\n  };\n}\n"]}

package/migrations/form_submissions.sql

@@ -0,0 +1,26 @@
+-- D1 baseline schema: form_submissions (contact + other lead forms)
+-- Per-site database. Do not share one D1 across clients.
+--
+--   npx wrangler d1 execute YOUR-FORMS-DB --remote --file=node_modules/@logeix/contact-form/migrations/form_submissions.sql
+--   npx wrangler d1 execute YOUR-FORMS-DB --local  --file=node_modules/@logeix/contact-form/migrations/form_submissions.sql
+
+CREATE TABLE IF NOT EXISTS form_submissions (
+  id              INTEGER PRIMARY KEY AUTOINCREMENT,
+  site_name       TEXT    NOT NULL,
+  form_name       TEXT    NOT NULL,
+  submitted_at    TEXT    NOT NULL,
+  ip_address      TEXT    NOT NULL DEFAULT 'unknown',
+  user_agent      TEXT    NOT NULL DEFAULT 'unknown',
+  form_data       TEXT    NOT NULL,
+  email_sent      INTEGER NOT NULL DEFAULT 0,
+  email_sent_at   TEXT,
+  email_error     TEXT,
+  spam_decision   TEXT,
+  spam_score      INTEGER,
+  spam_reasons    TEXT,
+  spam_elapsed_ms INTEGER
+);
+
+CREATE INDEX IF NOT EXISTS idx_form_submissions_form_name ON form_submissions (form_name);
+CREATE INDEX IF NOT EXISTS idx_form_submissions_submitted_at ON form_submissions (submitted_at);
+CREATE INDEX IF NOT EXISTS idx_form_submissions_ip ON form_submissions (ip_address, form_name, submitted_at);

package/package.json

@@ -0,0 +1,54 @@
+{
+  "name": "@logeix/contact-form",
+  "version": "1.0.0",
+  "description": "Contact form intake for LOGEIX Astro + Cloudflare Pages sites (D1 + Brevo + spam gates)",
+  "type": "module",
+  "license": "MIT",
+  "private": false,
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/logeix/contact-form.git"
+  },
+  "files": [
+    "dist",
+    "migrations",
+    "README.md"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/client/index.d.ts",
+      "import": "./dist/client/index.js"
+    },
+    "./client": {
+      "types": "./dist/client/index.d.ts",
+      "import": "./dist/client/index.js"
+    },
+    "./server/submit-form": {
+      "types": "./dist/server/submit-form.d.ts",
+      "import": "./dist/server/submit-form.js"
+    },
+    "./migrations/*": "./migrations/*"
+  },
+  "scripts": {
+    "build": "tsup",
+    "test": "tsx --test test/spam.test.ts",
+    "prepublishOnly": "npm run build && npm test"
+  },
+  "devDependencies": {
+    "@cloudflare/workers-types": "^4.20260410.1",
+    "tsup": "^8.5.0",
+    "tsx": "^4.20.5",
+    "typescript": "^5.9.3"
+  },
+  "peerDependencies": {
+    "@cloudflare/workers-types": "^4.0.0"
+  },
+  "peerDependenciesMeta": {
+    "@cloudflare/workers-types": {
+      "optional": true
+    }
+  }
+}