@sharadox/form-web-library 0.0.0-stage → 0.1.0

package/LICENCA.md

@@ -0,0 +1,76 @@
+# Licença Sharadox de Código Aberto
+
+Versão 0.1.0
+
+O texto em língua portuguesa é o único texto original e vinculativo desta licença. A tradução para inglês (`LICENSE.md`) é meramente informativa; em caso de divergência prevalece o texto em português.
+
+## 1. Definições
+
+Para efeitos desta licença:
+
+1. **«Obra»** — o programa de computador, a sua documentação e quaisquer outros conteúdos disponibilizados pelo Licenciante ao abrigo desta licença, em código-fonte ou em qualquer outra forma.
+2. **«Licenciante»** — o titular dos direitos de autor identificado no aviso de direitos de autor que acompanha a Obra.
+3. **«Licenciado»** — qualquer pessoa, singular ou coletiva, que exerça os direitos concedidos por esta licença.
+4. **«Obra Derivada»** — qualquer obra baseada na Obra ou que a incorpore, total ou parcialmente, com ou sem modificações, incluindo traduções, adaptações e programas que a integrem.
+5. **«Aviso»** — o aviso de direitos de autor do Licenciante e a indicação de que a Obra está licenciada ao abrigo desta licença, incluindo a respetiva versão.
+
+## 2. Concessão de direitos
+
+1. Nos termos desta licença, o Licenciante concede ao Licenciado uma licença mundial, gratuita, não exclusiva e por todo o prazo de proteção dos direitos de autor para:
+   1. utilizar a Obra para qualquer finalidade, incluindo finalidades comerciais;
+   2. reproduzir a Obra, total ou parcialmente, por qualquer meio e sob qualquer forma;
+   3. modificar, traduzir, adaptar e transformar a Obra e criar Obras Derivadas;
+   4. distribuir, publicar, comunicar ao público, colocar à disposição, vender e sublicenciar a Obra e as Obras Derivadas.
+2. Na medida em que o Licenciante seja titular de patentes necessariamente infringidas pela Obra tal como por si disponibilizada, concede igualmente ao Licenciado, nos mesmos termos, uma licença para utilizar essas patentes no exercício dos direitos previstos no número anterior.
+3. Esta licença não transmite a titularidade de quaisquer direitos, que permanecem do Licenciante.
+
+## 3. Condições
+
+O exercício dos direitos concedidos fica sujeito às seguintes condições:
+
+1. Todas as cópias da Obra, ou de partes substanciais da mesma, e todas as Obras Derivadas distribuídas devem incluir o Aviso e uma cópia desta licença ou uma ligação estável para o seu texto.
+2. Quem distribuir uma versão modificada da Obra deve indicar de forma visível que a mesma foi modificada, não podendo apresentá-la como versão original do Licenciante.
+3. O Licenciado pode licenciar as suas próprias modificações ao abrigo de outros termos, desde que a parte da Obra que delas faça parte continue sujeita às condições desta licença.
+
+## 4. Nomes e marcas
+
+Esta licença não concede qualquer direito sobre o nome, as marcas, os logótipos ou outros sinais distintivos do Licenciante, incluindo a designação «Sharadox», salvo na medida estritamente necessária para cumprir o dever de incluir o Aviso. É proibido utilizá-los para promover ou sugerir o apoio do Licenciante a Obras Derivadas ou a quaisquer produtos ou serviços sem autorização prévia e escrita.
+
+## 5. Exclusão de garantias
+
+A Obra é disponibilizada «tal como está» e «conforme disponível», sem qualquer garantia, expressa ou tácita, incluindo, designadamente, garantias de comerciabilidade, de adequação a um fim específico, de ausência de erros ou de não violação de direitos de terceiros, na medida máxima permitida pela lei aplicável.
+
+## 6. Limitação de responsabilidade
+
+1. Na medida máxima permitida pela lei aplicável, o Licenciante não é responsável por quaisquer danos, diretos ou indiretos, incluindo lucros cessantes, perda de dados ou interrupção de atividade, resultantes da utilização ou da impossibilidade de utilização da Obra, ainda que tenha sido avisado da possibilidade da sua ocorrência.
+2. Nada nesta licença exclui ou limita a responsabilidade do Licenciante nos casos em que tal exclusão ou limitação não seja permitida por lei, designadamente por atos praticados com dolo ou culpa grave, nos termos do artigo 809.º e do n.º 2 do artigo 800.º do Código Civil, nem afeta os direitos que a lei imperativamente reconheça aos consumidores.
+
+## 7. Cessação
+
+1. Os direitos concedidos por esta licença cessam automaticamente se o Licenciado violar qualquer das suas condições.
+2. Os direitos são repostos se a violação for sanada no prazo de 30 dias a contar do momento em que o Licenciado dela tome conhecimento, salvo se o Licenciante tiver entretanto comunicado por escrito a sua oposição.
+3. A cessação não afeta as licenças validamente concedidas pelo Licenciado a terceiros que cumpram esta licença.
+
+## 8. Lei aplicável e foro
+
+1. Esta licença rege-se pela lei portuguesa, designadamente pelo Código do Direito de Autor e dos Direitos Conexos, aprovado pelo Decreto-Lei n.º 63/85, de 14 de março, e pelo Decreto-Lei n.º 252/94, de 20 de outubro, relativo à proteção jurídica dos programas de computador.
+2. Para a resolução de quaisquer litígios emergentes desta licença é competente o Tribunal Judicial da Comarca de Faro, sem prejuízo das normas imperativas de competência aplicáveis, nomeadamente as que protegem os consumidores.
+
+## 9. Versões da licença
+
+O Licenciante pode publicar novas versões desta licença, identificadas por um número de versão. A Obra fica sujeita à versão indicada no Aviso. O Licenciado pode, se o Aviso o permitir, optar por qualquer versão posterior.
+
+## 10. Disposições finais
+
+1. Se alguma disposição desta licença for considerada inválida ou ineficaz, as restantes mantêm-se em vigor, devendo a disposição afetada ser interpretada de forma a aproximar-se, tanto quanto possível, da intenção original.
+2. A não exigência, em qualquer momento, do cumprimento de uma disposição desta licença não constitui renúncia ao direito de o exigir posteriormente.
+
+## Como aplicar esta licença
+
+Inclua na Obra um ficheiro `LICENCA.md` com este texto, a tradução `LICENSE.md` e o seguinte aviso, preenchendo o ano e o titular:
+
+```
+Direitos de autor © <ano> <titular>.
+Licenciado ao abrigo da Licença Sharadox de Código Aberto, versão 0.1.0.
+https://github.com/Sharadox/sharadox-open-source-license
+```

package/LICENSE.md

@@ -0,0 +1,76 @@
+# Sharadox Open Source Licence
+
+Version 0.1.0
+
+This is an informative English translation. The Portuguese text (`LICENCA.md`) is the only original and binding text of this licence; if the two differ, the Portuguese text prevails.
+
+## 1. Definitions
+
+For the purposes of this licence:
+
+1. **"Work"** — the computer program, its documentation and any other content made available by the Licensor under this licence, in source code or in any other form.
+2. **"Licensor"** — the copyright holder identified in the copyright notice that accompanies the Work.
+3. **"Licensee"** — any natural or legal person exercising the rights granted by this licence.
+4. **"Derivative Work"** — any work based on or incorporating the Work, in whole or in part, with or without modifications, including translations, adaptations and programs that integrate it.
+5. **"Notice"** — the Licensor's copyright notice and the statement that the Work is licensed under this licence, including its version.
+
+## 2. Grant of rights
+
+1. Under this licence, the Licensor grants the Licensee a worldwide, royalty-free, non-exclusive licence, for the whole term of copyright protection, to:
+   1. use the Work for any purpose, including commercial purposes;
+   2. reproduce the Work, in whole or in part, by any means and in any form;
+   3. modify, translate, adapt and transform the Work and create Derivative Works;
+   4. distribute, publish, communicate to the public, make available, sell and sublicense the Work and Derivative Works.
+2. To the extent the Licensor holds patents necessarily infringed by the Work as made available by it, the Licensor also grants the Licensee, on the same terms, a licence to use those patents in exercising the rights in the previous paragraph.
+3. This licence does not transfer ownership of any rights, which remain with the Licensor.
+
+## 3. Conditions
+
+The exercise of the rights granted is subject to the following conditions:
+
+1. Every copy of the Work, or of substantial parts of it, and every distributed Derivative Work must include the Notice and a copy of this licence or a stable link to its text.
+2. Anyone distributing a modified version of the Work must state visibly that it has been modified and may not present it as the Licensor's original version.
+3. The Licensee may license their own modifications under other terms, provided the part of the Work included in them remains subject to the conditions of this licence.
+
+## 4. Names and trademarks
+
+This licence grants no rights to the Licensor's name, trademarks, logos or other distinctive signs, including the name "Sharadox", except as strictly necessary to comply with the duty to include the Notice. Using them to promote or suggest the Licensor's endorsement of Derivative Works or of any products or services without prior written permission is prohibited.
+
+## 5. Disclaimer of warranties
+
+The Work is provided "as is" and "as available", without any warranty, express or implied, including in particular warranties of merchantability, fitness for a particular purpose, absence of errors or non-infringement of third-party rights, to the maximum extent permitted by applicable law.
+
+## 6. Limitation of liability
+
+1. To the maximum extent permitted by applicable law, the Licensor is not liable for any damages, direct or indirect, including loss of profits, loss of data or business interruption, arising from the use of or inability to use the Work, even if advised of the possibility of such damages.
+2. Nothing in this licence excludes or limits the Licensor's liability where such exclusion or limitation is not permitted by law, in particular for acts committed with intent or gross negligence, under article 809 and article 800(2) of the Portuguese Civil Code, nor does it affect rights that the law mandatorily grants to consumers.
+
+## 7. Termination
+
+1. The rights granted by this licence terminate automatically if the Licensee breaches any of its conditions.
+2. The rights are reinstated if the breach is remedied within 30 days of the Licensee becoming aware of it, unless the Licensor has meanwhile objected in writing.
+3. Termination does not affect licences validly granted by the Licensee to third parties who comply with this licence.
+
+## 8. Governing law and jurisdiction
+
+1. This licence is governed by Portuguese law, in particular the Code of Copyright and Related Rights, approved by Decree-Law no. 63/85 of 14 March, and Decree-Law no. 252/94 of 20 October on the legal protection of computer programs.
+2. The Judicial Court of the District of Faro has jurisdiction over any dispute arising from this licence, without prejudice to applicable mandatory rules of jurisdiction, in particular those protecting consumers.
+
+## 9. Licence versions
+
+The Licensor may publish new versions of this licence, identified by a version number. The Work is subject to the version stated in the Notice. If the Notice allows it, the Licensee may choose any later version.
+
+## 10. Final provisions
+
+1. If any provision of this licence is held invalid or unenforceable, the remaining provisions stay in force, and the affected provision shall be interpreted as closely as possible to its original intent.
+2. Failure to enforce any provision of this licence at any time does not waive the right to enforce it later.
+
+## How to apply this licence
+
+Include in the Work a `LICENCA.md` file with the Portuguese text, this translation as `LICENSE.md`, and the following notice, filling in the year and holder:
+
+```
+Direitos de autor © <ano> <titular>.
+Licenciado ao abrigo da Licença Sharadox de Código Aberto, versão 0.1.0.
+https://github.com/Sharadox/sharadox-open-source-license
+```

package/NOTICE.md

@@ -0,0 +1,3 @@
+Direitos de autor © 2026 Micael Pires (Sharadox).
+Licenciado ao abrigo da Licença Sharadox de Código Aberto, versão 0.1.0.
+https://github.com/Sharadox/sharadox-open-source-license

package/README.md

@@ -1,3 +1,64 @@
-# Temporary Holding Version
+# @sharadox/form-web-library
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Forms on the server, written once for every site:
+
+- **Field reading:** trimmed and capped in length.
+- **Bot checks:** a hidden honeypot field, and a minimum time to fill the form.
+- **Rate limiting:** a sliding window per key.
+- **A contact form action:** it validates, fakes success for bots, limits each address, and emails the message in text and HTML with the visitor as reply-to, through `@sharadox/email-web-library`.
+
+## Install
+
+```sh
+pnpm add @sharadox/form-web-library
+```
+
+## Use
+
+```ts
+// the site's library
+export const sendContact = createContactAction({
+  to: "contact@example.com",
+  senderName: "Example Web Application",
+  site: "example.com",
+  subject: (message) =>
+    separate("•", "Contact", message.company ? `${message.name} (${message.company})` : message.name),
+  choices: { website: "Website", logo: "Logo", other: "Others" },
+});
+```
+
+```ts
+// the application's server action
+"use server";
+export async function sendContactAction(_: ContactState, form: FormData) {
+  const ip = (await headers()).get("x-forwarded-for")?.split(",")[0]?.trim() ?? "unknown";
+  return sendContact(form, ip);
+}
+```
+
+The form sends these fields:
+
+- **text:** `name`, `email`, `company`, `message`
+- **hidden:** `locale`, and `started-at` (`Date.now()` when the visitor started)
+- **checkboxes:** `need`
+- **honeypot:** `website`, kept off screen
+
+The email server comes from `EMAIL_SERVER_*` and `EMAIL_SENDER_ADDRESS`.
+
+## API
+
+| Import             | Export                                                                                                                                       |
+| ------------------ | -------------------------------------------------------------------------------------------------------------------------------------------- |
+| `…/contact-action` | `createContactAction(options)` → `(form, ip) => Promise<ContactState>`; `ContactState` and `ContactActionOptions` in `…/contact-action/type` |
+| `…/parse-contact`  | `parseContact(form, { choices?, choiceField?, now? })` → `bot`, `invalid` or `valid`                                                         |
+| `…/bot-check`      | `isLikelyBot(form, { honeypotField?, startedAtField?, minimumFillTime?, now? })`                                                             |
+| `…/rate-limit`     | `createRateLimiter({ window, maximum })` → `(key, now?) => boolean` (kept in memory, per server instance)                                    |
+| `…/field`          | `readField(form, name, maximumLength)`                                                                                                       |
+
+## Develop
+
+`pnpm verify` runs formatting, lint, type-check, tests with 100% coverage and the build. Branches follow `<feature>.development` → `development` → `index`, and releases are `v<version>` tags on `index`.
+
+## Licence
+
+Licença Sharadox de Código Aberto, versão 0.1.0. See [português](LICENCA.md) (the binding text) and the [English translation](LICENSE.md).

package/distribution/bot-check/index.d.ts

@@ -0,0 +1,4 @@
+import type { BotCheckOptions } from "@sharadox/form-web-library/bot-check/type";
+/** Whether a form submission looks automated: the honeypot is filled, or it was submitted faster than people can. */
+export declare function isLikelyBot(form: FormData, { honeypotField, startedAtField, minimumFillTime, now, }?: BotCheckOptions): boolean;
+//# sourceMappingURL=index.d.ts.map

package/distribution/bot-check/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../source/bot-check/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2CAA2C,CAAC;AAEjF,qHAAqH;AACrH,wBAAgB,WAAW,CACzB,IAAI,EAAE,QAAQ,EACd,EACE,aAAyB,EACzB,cAA6B,EAC7B,eAAsB,EACtB,GAAgB,GACjB,GAAE,eAAoB,GACtB,OAAO,CAGT"}

package/distribution/bot-check/index.js

@@ -0,0 +1,6 @@
+/** Whether a form submission looks automated: the honeypot is filled, or it was submitted faster than people can. */
+export function isLikelyBot(form, { honeypotField = "website", startedAtField = "started-at", minimumFillTime = 2500, now = Date.now(), } = {}) {
+    const started = Number(form.get(startedAtField) ?? 0);
+    return Boolean(form.get(honeypotField)) || Boolean(started && now - started < minimumFillTime);
+}
+//# sourceMappingURL=index.js.map

package/distribution/bot-check/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../source/bot-check/index.ts"],"names":[],"mappings":"AAEA,qHAAqH;AACrH,MAAM,UAAU,WAAW,CACzB,IAAc,EACd,EACE,aAAa,GAAG,SAAS,EACzB,cAAc,GAAG,YAAY,EAC7B,eAAe,GAAG,IAAI,EACtB,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,MACG,EAAE;IAEvB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;IACtD,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,OAAO,CAAC,OAAO,IAAI,GAAG,GAAG,OAAO,GAAG,eAAe,CAAC,CAAC;AACjG,CAAC"}

package/distribution/bot-check/type.d.ts

@@ -0,0 +1,11 @@
+export interface BotCheckOptions {
+    /** A field hidden from people; anything typed in it was typed by a bot. Defaults to "website". */
+    honeypotField?: string;
+    /** A hidden field holding when the visitor started filling the form (milliseconds). Defaults to "started-at". */
+    startedAtField?: string;
+    /** People take longer than this to fill a form, in milliseconds. Defaults to 2500. */
+    minimumFillTime?: number;
+    /** Defaults to now. */
+    now?: number;
+}
+//# sourceMappingURL=type.d.ts.map

package/distribution/bot-check/type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"type.d.ts","sourceRoot":"","sources":["../../source/bot-check/type.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,eAAe;IAC9B,kGAAkG;IAClG,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iHAAiH;IACjH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,sFAAsF;IACtF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,uBAAuB;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd"}

package/distribution/bot-check/type.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=type.js.map

package/distribution/bot-check/type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"type.js","sourceRoot":"","sources":["../../source/bot-check/type.ts"],"names":[],"mappings":""}

package/distribution/contact-action/index.d.ts

@@ -0,0 +1,14 @@
+import type { ContactActionOptions, ContactState } from "@sharadox/form-web-library/contact-action/type";
+/**
+ * Builds the work of a contact form's server action: checks for bots (they get a fake success), validates, limits
+ * each address, then emails the message with the visitor as reply-to, in plain text and HTML (user input escaped).
+ * The application's server action reads the visitor's IP address and calls the result.
+ *
+ * @example
+ * const sendContact = createContactAction({ to: "contact@sharadox.com", senderName: "Sharadox Web Application",
+ *   site: "sharadox.com", subject: (message) => separate("•", "Contact", message.name) });
+ * // in a "use server" file:
+ * export async function sendContactAction(_: ContactState, form: FormData) { return sendContact(form, ip); }
+ */
+export declare function createContactAction({ to, senderName, senderAddress, subject, choices, site, rateLimit, readConfiguration, createSender, reportError, }: ContactActionOptions): (form: FormData, ip: string) => Promise<ContactState>;
+//# sourceMappingURL=index.d.ts.map

package/distribution/contact-action/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../source/contact-action/index.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,gDAAgD,CAAC;AAIzG;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,EAAE,EACF,UAAU,EACV,aAAa,EACb,OAAO,EACP,OAAY,EACZ,IAAI,EACJ,SAAkD,EAClD,iBAAgD,EAChD,YAAgC,EAChC,WAA+D,GAChE,EAAE,oBAAoB,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAqC9E"}

package/distribution/contact-action/index.js

@@ -0,0 +1,61 @@
+import { createEmailSender, EmailError, readEmailServerConfiguration } from "@sharadox/email-web-library";
+import { escapeHtml } from "@sharadox/web-library/html/escape";
+import { separate } from "@sharadox/web-library/text/separate";
+import { createRateLimiter } from "@sharadox/form-web-library/rate-limit";
+import { parseContact } from "@sharadox/form-web-library/parse-contact";
+const oneLine = (text) => text.replace(/[\r\n]+/g, " ");
+/**
+ * Builds the work of a contact form's server action: checks for bots (they get a fake success), validates, limits
+ * each address, then emails the message with the visitor as reply-to, in plain text and HTML (user input escaped).
+ * The application's server action reads the visitor's IP address and calls the result.
+ *
+ * @example
+ * const sendContact = createContactAction({ to: "contact@sharadox.com", senderName: "Sharadox Web Application",
+ *   site: "sharadox.com", subject: (message) => separate("•", "Contact", message.name) });
+ * // in a "use server" file:
+ * export async function sendContactAction(_: ContactState, form: FormData) { return sendContact(form, ip); }
+ */
+export function createContactAction({ to, senderName, senderAddress, subject, choices = {}, site, rateLimit = { window: 60 * 60 * 1000, maximum: 5 }, readConfiguration = readEmailServerConfiguration, createSender = createEmailSender, reportError = (message, error) => console.error(message, error), }) {
+    const allow = createRateLimiter(rateLimit);
+    return async (form, ip) => {
+        const parsed = parseContact(form, { choices: Object.keys(choices) });
+        if (parsed.kind === "bot")
+            return { status: "sent" };
+        if (parsed.kind === "invalid")
+            return { status: "invalid" };
+        if (!allow(ip))
+            return { status: "rate-limited" };
+        const message = parsed.value;
+        const named = message.choices.map((choice) => choices[choice]);
+        const text = `Name: ${message.name}\nEmail: ${message.email}\nCompany: ${message.company || "—"}\nNeeds: ${named.join(", ") || "—"}\nLanguage: ${message.locale}\nIP: ${ip}\n\n${message.message}`;
+        const html = `<div style="font-family:-apple-system,Segoe UI,sans-serif;font-size:15px;line-height:1.6;color:#111">
+    <p style="color:#666;font-size:13px;margin:0 0 16px">New message from ${escapeHtml(site)} (${escapeHtml(message.locale)})</p>
+    <p style="margin:0">${separate("·", `<b>${escapeHtml(message.name)}</b>`, message.company && escapeHtml(message.company))}<br><a href="mailto:${escapeHtml(message.email)}">${escapeHtml(message.email)}</a></p>
+    ${named.length ? `<p style="margin:12px 0 0;color:#444">${escapeHtml(named.join(", "))}</p>` : ""}
+    <hr style="border:0;border-top:1px solid #eee;margin:18px 0">
+    <p style="white-space:pre-wrap;margin:0">${escapeHtml(message.message)}</p></div>`;
+        try {
+            const configuration = readConfiguration();
+            await createSender(configuration).send({
+                from: {
+                    name: senderName,
+                    address: senderAddress || process.env.EMAIL_SENDER_ADDRESS || configuration.username,
+                },
+                to,
+                // Replying to the email answers the visitor at the address they typed.
+                replyTo: { name: oneLine(message.name), address: message.email },
+                subject: oneLine(subject(message)).slice(0, 300),
+                text,
+                html,
+            });
+            return { status: "sent" };
+        }
+        catch (error) {
+            if (error instanceof EmailError && error.code === "invalid-message")
+                return { status: "invalid" };
+            reportError("contact: sending failed", error);
+            return { status: "failed" };
+        }
+    };
+}
+//# sourceMappingURL=index.js.map

package/distribution/contact-action/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../source/contact-action/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AAC1G,OAAO,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,0CAA0C,CAAC;AAGxE,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;AAEhE;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,EAAE,EACF,UAAU,EACV,aAAa,EACb,OAAO,EACP,OAAO,GAAG,EAAE,EACZ,IAAI,EACJ,SAAS,GAAG,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,EAClD,iBAAiB,GAAG,4BAA4B,EAChD,YAAY,GAAG,iBAAiB,EAChC,WAAW,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,GAC1C;IACrB,MAAM,KAAK,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC3C,OAAO,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE;QACxB,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACrE,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QACrD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC5D,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC;QAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAE,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,SAAS,OAAO,CAAC,IAAI,YAAY,OAAO,CAAC,KAAK,cAAc,OAAO,CAAC,OAAO,IAAI,GAAG,YAAY,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,eAAe,OAAO,CAAC,MAAM,SAAS,EAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QACnM,MAAM,IAAI,GAAG;4EAC2D,UAAU,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC;0BACjG,QAAQ,CAAC,GAAG,EAAE,MAAM,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,uBAAuB,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC;MACrM,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,yCAAyC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;;+CAEtD,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;QACnF,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,iBAAiB,EAAE,CAAC;YAC1C,MAAM,YAAY,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC;gBACrC,IAAI,EAAE;oBACJ,IAAI,EAAE,UAAU;oBAChB,OAAO,EAAE,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,aAAa,CAAC,QAAQ;iBACrF;gBACD,EAAE;gBACF,uEAAuE;gBACvE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE;gBAChE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBAChD,IAAI;gBACJ,IAAI;aACL,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC5B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,UAAU,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB;gBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAClG,WAAW,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;YAC9C,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC9B,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/distribution/contact-action/type.d.ts

@@ -0,0 +1,31 @@
+import type { EmailSender, EmailServerConfiguration } from "@sharadox/email-web-library";
+import type { ContactMessage } from "@sharadox/form-web-library/parse-contact/type";
+/** What the form shows after a submission. */
+export interface ContactState {
+    status: "idle" | "sent" | "invalid" | "rate-limited" | "failed";
+}
+export interface ContactActionOptions {
+    /** Where messages go, for example "contact@sharadox.com". */
+    to: string;
+    /** The sender's display name, for example "Sharadox Web Application". */
+    senderName: string;
+    /** The sender address (an address the email server may send from); `EMAIL_SENDER_ADDRESS` or the server user. */
+    senderAddress?: string;
+    /** The email subject for a message, for example `Contact • Ana (Café)`. */
+    subject: (message: ContactMessage) => string;
+    /** Choices the form may send, and how each is named in the email; none by default. */
+    choices?: Readonly<Record<string, string>>;
+    /** Where the email says the message came from, for example "sharadox.com". */
+    site: string;
+    /** Messages per address per window; 5 per hour by default. */
+    rateLimit?: {
+        window: number;
+        maximum: number;
+    };
+    /** The email server; read from `EMAIL_SERVER_*` by default. */
+    readConfiguration?: () => EmailServerConfiguration;
+    createSender?: (configuration: EmailServerConfiguration) => EmailSender;
+    /** Where failures are reported; `console.error` by default. */
+    reportError?: (message: string, error: unknown) => void;
+}
+//# sourceMappingURL=type.d.ts.map

package/distribution/contact-action/type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"type.d.ts","sourceRoot":"","sources":["../../source/contact-action/type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AACzF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+CAA+C,CAAC;AAEpF,8CAA8C;AAC9C,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,cAAc,GAAG,QAAQ,CAAC;CACjE;AAED,MAAM,WAAW,oBAAoB;IACnC,6DAA6D;IAC7D,EAAE,EAAE,MAAM,CAAC;IACX,yEAAyE;IACzE,UAAU,EAAE,MAAM,CAAC;IACnB,iHAAiH;IACjH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,2EAA2E;IAC3E,OAAO,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,MAAM,CAAC;IAC7C,sFAAsF;IACtF,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3C,8EAA8E;IAC9E,IAAI,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,SAAS,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAChD,+DAA+D;IAC/D,iBAAiB,CAAC,EAAE,MAAM,wBAAwB,CAAC;IACnD,YAAY,CAAC,EAAE,CAAC,aAAa,EAAE,wBAAwB,KAAK,WAAW,CAAC;IACxE,+DAA+D;IAC/D,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;CACzD"}

package/distribution/contact-action/type.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=type.js.map

package/distribution/contact-action/type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"type.js","sourceRoot":"","sources":["../../source/contact-action/type.ts"],"names":[],"mappings":""}

package/distribution/field/index.d.ts

@@ -0,0 +1,3 @@
+/** A text field from submitted form data, trimmed and cut to `maximumLength` characters ("" when missing). */
+export declare function readField(form: FormData, name: string, maximumLength: number): string;
+//# sourceMappingURL=index.d.ts.map

package/distribution/field/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../source/field/index.ts"],"names":[],"mappings":"AAAA,8GAA8G;AAC9G,wBAAgB,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAIrF"}

package/distribution/field/index.js

@@ -0,0 +1,7 @@
+/** A text field from submitted form data, trimmed and cut to `maximumLength` characters ("" when missing). */
+export function readField(form, name, maximumLength) {
+    return String(form.get(name) ?? "")
+        .trim()
+        .slice(0, maximumLength);
+}
+//# sourceMappingURL=index.js.map

package/distribution/field/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../source/field/index.ts"],"names":[],"mappings":"AAAA,8GAA8G;AAC9G,MAAM,UAAU,SAAS,CAAC,IAAc,EAAE,IAAY,EAAE,aAAqB;IAC3E,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAChC,IAAI,EAAE;SACN,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;AAC7B,CAAC"}

package/distribution/parse-contact/index.d.ts

@@ -0,0 +1,11 @@
+import type { ParseContactOptions, ParsedContact } from "@sharadox/form-web-library/parse-contact/type";
+/**
+ * Reads and validates a contact form (`name`, `email`, `company`, `message`, `locale` and checkbox choices), and
+ * flags likely bots (honeypot filled or submitted too fast). Fields are trimmed and capped in length.
+ *
+ * @example
+ * const parsed = parseContact(form, { choices: ["website", "logo", "other"] });
+ * if (parsed.kind === "valid") console.log(parsed.value.choices);
+ */
+export declare function parseContact(form: FormData, { choices, choiceField, now }?: ParseContactOptions): ParsedContact;
+//# sourceMappingURL=index.d.ts.map

package/distribution/parse-contact/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../source/parse-contact/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,+CAA+C,CAAC;AAIxG;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,QAAQ,EACd,EAAE,OAAY,EAAE,WAAoB,EAAE,GAAgB,EAAE,GAAE,mBAAwB,GACjF,aAAa,CAYf"}

package/distribution/parse-contact/index.js

@@ -0,0 +1,27 @@
+import { isLikelyBot } from "@sharadox/form-web-library/bot-check";
+import { readField } from "@sharadox/form-web-library/field";
+const EMAIL = /^[^\s@]+@[^\s@]+\.[^\s@]{2,}$/;
+/**
+ * Reads and validates a contact form (`name`, `email`, `company`, `message`, `locale` and checkbox choices), and
+ * flags likely bots (honeypot filled or submitted too fast). Fields are trimmed and capped in length.
+ *
+ * @example
+ * const parsed = parseContact(form, { choices: ["website", "logo", "other"] });
+ * if (parsed.kind === "valid") console.log(parsed.value.choices);
+ */
+export function parseContact(form, { choices = [], choiceField = "need", now = Date.now() } = {}) {
+    if (isLikelyBot(form, { now }))
+        return { kind: "bot" };
+    const value = {
+        name: readField(form, "name", 120),
+        email: readField(form, "email", 200),
+        company: readField(form, "company", 160),
+        message: readField(form, "message", 5000),
+        locale: readField(form, "locale", 10) || "en",
+        choices: [...new Set(form.getAll(choiceField).map(String))].filter((choice) => choices.includes(choice)),
+    };
+    if (!value.name || !value.message || !EMAIL.test(value.email))
+        return { kind: "invalid" };
+    return { kind: "valid", value };
+}
+//# sourceMappingURL=index.js.map

package/distribution/parse-contact/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../source/parse-contact/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sCAAsC,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAG7D,MAAM,KAAK,GAAG,+BAA+B,CAAC;AAE9C;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAC1B,IAAc,EACd,EAAE,OAAO,GAAG,EAAE,EAAE,WAAW,GAAG,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,KAA0B,EAAE;IAElF,IAAI,WAAW,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACvD,MAAM,KAAK,GAAG;QACZ,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC;QAClC,KAAK,EAAE,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC;QACpC,OAAO,EAAE,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC;QACxC,OAAO,EAAE,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC;QACzC,MAAM,EAAE,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,IAAI;QAC7C,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;KACzG,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC1F,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAClC,CAAC"}

package/distribution/parse-contact/type.d.ts

@@ -0,0 +1,29 @@
+/** A validated contact form submission. */
+export interface ContactMessage {
+    name: string;
+    email: string;
+    /** Optional; "" when not given. */
+    company: string;
+    message: string;
+    /** The page's locale, sent in a hidden field. */
+    locale: string;
+    /** The ticked choices (for example "what do you need?"), only from the allowed list. */
+    choices: string[];
+}
+export type ParsedContact = {
+    kind: "bot";
+} | {
+    kind: "invalid";
+} | {
+    kind: "valid";
+    value: ContactMessage;
+};
+export interface ParseContactOptions {
+    /** Choice values the form may send; anything else is ignored. None by default. */
+    choices?: readonly string[];
+    /** The checkbox field holding the choices; "need" by default. */
+    choiceField?: string;
+    /** Now, for the fill-time check (tests). */
+    now?: number;
+}
+//# sourceMappingURL=type.d.ts.map

package/distribution/parse-contact/type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"type.d.ts","sourceRoot":"","sources":["../../source/parse-contact/type.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,mCAAmC;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,wFAAwF;IACxF,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,MAAM,aAAa,GAAG;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,cAAc,CAAA;CAAE,CAAC;AAE7G,MAAM,WAAW,mBAAmB;IAClC,kFAAkF;IAClF,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,iEAAiE;IACjE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4CAA4C;IAC5C,GAAG,CAAC,EAAE,MAAM,CAAC;CACd"}

package/distribution/parse-contact/type.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=type.js.map

package/distribution/parse-contact/type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"type.js","sourceRoot":"","sources":["../../source/parse-contact/type.ts"],"names":[],"mappings":""}

package/distribution/rate-limit/index.d.ts

@@ -0,0 +1,4 @@
+import type { RateLimiter, RateLimitOptions } from "@sharadox/form-web-library/rate-limit/type";
+/** In-memory sliding-window rate limiter. Best effort: each server instance keeps its own memory. */
+export declare function createRateLimiter({ window, maximum }: RateLimitOptions): RateLimiter;
+//# sourceMappingURL=index.d.ts.map

package/distribution/rate-limit/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../source/rate-limit/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,4CAA4C,CAAC;AAEhG,qGAAqG;AACrG,wBAAgB,iBAAiB,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,gBAAgB,GAAG,WAAW,CAWpF"}

package/distribution/rate-limit/index.js

@@ -0,0 +1,14 @@
+/** In-memory sliding-window rate limiter. Best effort: each server instance keeps its own memory. */
+export function createRateLimiter({ window, maximum }) {
+    const hits = new Map();
+    return (key, now = Date.now()) => {
+        const recent = (hits.get(key) ?? []).filter((time) => now - time < window);
+        if (recent.length >= maximum) {
+            hits.set(key, recent);
+            return false;
+        }
+        hits.set(key, [...recent, now]);
+        return true;
+    };
+}
+//# sourceMappingURL=index.js.map

package/distribution/rate-limit/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../source/rate-limit/index.ts"],"names":[],"mappings":"AAEA,qGAAqG;AACrG,MAAM,UAAU,iBAAiB,CAAC,EAAE,MAAM,EAAE,OAAO,EAAoB;IACrE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAoB,CAAC;IACzC,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE;QAC/B,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,GAAG,MAAM,CAAC,CAAC;QAC3E,IAAI,MAAM,CAAC,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACtB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC"}

package/distribution/rate-limit/type.d.ts

@@ -0,0 +1,9 @@
+export interface RateLimitOptions {
+    /** Window length in milliseconds. */
+    window: number;
+    /** Allowed hits per key inside the window. */
+    maximum: number;
+}
+/** Records a hit for a key; returns false when the key is over its limit. */
+export type RateLimiter = (key: string, now?: number) => boolean;
+//# sourceMappingURL=type.d.ts.map

package/distribution/rate-limit/type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"type.d.ts","sourceRoot":"","sources":["../../source/rate-limit/type.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,gBAAgB;IAC/B,qCAAqC;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,6EAA6E;AAC7E,MAAM,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC"}

package/distribution/rate-limit/type.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=type.js.map

package/distribution/rate-limit/type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"type.js","sourceRoot":"","sources":["../../source/rate-limit/type.ts"],"names":[],"mappings":""}

package/llms.txt

@@ -0,0 +1,9 @@
+# @sharadox/form-web-library
+
+> Server-side forms: bot checks, rate limit, contact action emailing via @sharadox/email-web-library.
+
+- /contact-action: createContactAction({ to, senderName, senderAddress?, site, subject(message), choices?: { key: label }, rateLimit? = 5/hour, readConfiguration?, createSender?, reportError? }) → (form, ip) => { status: idle|sent|invalid|rate-limited|failed }. Reply-to = visitor; bots get fake 'sent'.
+- Form fields: name, email, company, message, locale, started-at, website (honeypot), need (checkboxes).
+- /parse-contact: parseContact(form, { choices, choiceField='need', now })
+- /bot-check isLikelyBot; /rate-limit createRateLimiter({ window, maximum }); /field readField(form, name, max)
+- Env: EMAIL_SERVER_HOST/PORT/USERNAME/PASSWORD, EMAIL_SENDER_ADDRESS. Licence: Sharadox Open Source Licence 0.1.0

package/package.json

@@ -1,6 +1,81 @@
 {
   "name": "@sharadox/form-web-library",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.0",
+  "description": "Forms on the server: field reading, honeypot and fill-time bot checks, rate limiting and a contact form action that emails messages with the visitor as reply-to.",
+  "private": false,
+  "license": "SEE LICENSE IN LICENCA.md",
+  "author": "Sharadox <contact@sharadox.com>",
+  "type": "module",
+  "exports": {
+    "./*/type": {
+      "sharadox-source": "./source/*/type.ts",
+      "types": "./distribution/*/type.d.ts"
+    },
+    "./*": {
+      "sharadox-source": [
+        "./source/*/index.ts",
+        "./source/*/index.tsx"
+      ],
+      "types": "./distribution/*/index.d.ts",
+      "default": "./distribution/*/index.js"
+    }
+  },
+  "files": [
+    "distribution",
+    "LICENCA.md",
+    "LICENSE.md",
+    "NOTICE.md",
+    "llms.txt"
+  ],
+  "sideEffects": false,
+  "engines": {
+    "node": ">=24"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "lint-staged": {
+    "*.{ts,tsx,js,mjs,cjs}": [
+      "prettier --write",
+      "eslint --fix --max-warnings=0"
+    ],
+    "*.{json,md,yml,yaml,scss}": "prettier --write"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Sharadox/form-web-library.git"
+  },
+  "homepage": "https://github.com/Sharadox/form-web-library#readme",
+  "devDependencies": {
+    "@sharadox/es-lint-configuration-web-library": "^0.1.1",
+    "@sharadox/prettier-configuration-web-library": "^0.1.0",
+    "@sharadox/turborepo-configuration-web-library": "^0.1.0",
+    "@sharadox/type-script-configuration-web-library": "^0.2.0",
+    "@sharadox/vitest-configuration-web-library": "^0.1.2",
+    "@types/node": "^24.19.2",
+    "@vitest/coverage-v8": "^5.1.0",
+    "eslint": "9.39.5",
+    "husky": "^9.1.7",
+    "lint-staged": "^17.6.0",
+    "prettier": "^3.10.0",
+    "turbo": "^2.11.10",
+    "typedoc": "^0.28.20",
+    "typescript": "6.0.3",
+    "vitest": "^5.1.0"
+  },
+  "dependencies": {
+    "@sharadox/email-web-library": "^0.2.1",
+    "@sharadox/web-library": "^0.5.0"
+  },
+  "scripts": {
+    "build": "rm -rf distribution && tsc -p tsconfig.build.json",
+    "lint": "eslint --max-warnings=0 .",
+    "format": "prettier --write .",
+    "format:check": "prettier --check .",
+    "type-check": "tsc --noEmit",
+    "test:unit": "vitest run --coverage",
+    "documentation": "typedoc",
+    "verify": "turbo run format:check lint type-check test:unit build",
+    "test:benchmark": "vitest bench --run --passWithNoTests"
+  }
 }