@takuhon/contact 0.24.0

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Takuhon contributors
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/NOTICE

@@ -0,0 +1,7 @@
+@takuhon/contact
+Copyright 2026 Takuhon contributors
+
+This product includes software developed by the Takuhon project
+(https://github.com/takuhon-dev/takuhon).
+
+Licensed under the Apache License, Version 2.0 (see LICENSE).

package/README.md

@@ -0,0 +1,32 @@
+# @takuhon/contact
+
+Portable, framework-agnostic core for a lightweight contact form — input
+validation, a stateless request pipeline, and the challenge/email transport
+seams an adapter fills.
+
+> **Status:** early skeleton (private, unpublished). Host wiring (e.g. Cloudflare
+> Turnstile + `send_email`) lives in the adapters. This package carries no
+> Cloudflare, Node, or framework dependency, so the same core runs anywhere.
+
+## What this package is
+
+- **`handleContact(request, deps)`** — a Web-standard `(Request) => Response`
+  pipeline: method / content-type / origin guards, a size-bounded JSON parse,
+  validation, challenge verification, then delivery via an `EmailTransport`. It
+  is stateless: no database, no admin UI, no auto-reply.
+- **`validateSubmission(raw, config)`** — strict, pure validation. The email
+  rules reject any CR/LF and only accept a single address, so the value is safe
+  to place in a `Reply-To` header (no email header injection). Length limits and
+  a honeypot are enforced too.
+- **`ChallengeVerifier` / `EmailTransport`** — the two interfaces an adapter
+  implements (e.g. a Turnstile verifier and a `send_email` transport).
+
+## Design
+
+See the design notes for the full plan (dogfood on two sites, then publish for
+reuse). The deliberate non-goals are realtime chat, storage, an admin UI, and
+auto-replies to the visitor; the received inbox is the history.
+
+## License
+
+Apache-2.0 (see [LICENSE](./LICENSE) and [NOTICE](./NOTICE)).

package/dist/contact-widget.css

@@ -0,0 +1,2 @@
+.tkc-root{z-index:2147483000;font-family:system-ui,-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Noto Sans,Ubuntu,Cantarell,Helvetica Neue,sans-serif;font-size:14px;line-height:1.5;position:fixed;bottom:1rem;right:1rem}.tkc-launcher{color:#fff;cursor:pointer;background:#1e1888;border:none;border-radius:50%;justify-content:center;align-items:center;width:3.5rem;height:3.5rem;padding:0;transition:transform .15s,background .15s;display:inline-flex;box-shadow:0 6px 20px #00000038}.tkc-launcher:hover{background:#2a23a8;transform:scale(1.06)}.tkc-launcher:focus-visible{outline-offset:2px;outline:2px solid #818cf8}.tkc-send:focus-visible{outline-offset:2px;outline:2px solid #818cf8}.tkc-input:focus-visible{outline-offset:2px;outline:2px solid #818cf8}.tkc-close:focus-visible{outline-offset:2px;outline:2px solid #818cf8}.tkc-panel{color:#1f2430;background:#fff;border-radius:14px;flex-direction:column;width:min(22rem,100vw - 2rem);height:min(30rem,100vh - 4rem);display:flex;overflow:hidden;box-shadow:0 12px 40px #00000038}.tkc-header{color:#fff;background:#1e1888;justify-content:space-between;align-items:center;padding:.75rem 1rem;font-weight:600;display:flex}.tkc-close{color:inherit;cursor:pointer;background:0 0;border:none;padding:0 .25rem;font-size:1.3rem;line-height:1}.tkc-log{background:#f6f7fb;flex-direction:column;flex:1;gap:.5rem;padding:.9rem;display:flex;overflow-y:auto}.tkc-msg{white-space:pre-wrap;word-break:break-word;border-radius:12px;max-width:85%;padding:.5rem .75rem}.tkc-msg-bot{background:#fff;border:1px solid #e4e6ef;align-self:flex-start}.tkc-msg-user{color:#fff;background:#1e1888;align-self:flex-end}.tkc-turnstile{padding:0 .9rem}.tkc-turnstile:empty{display:none}.tkc-form{border-top:1px solid #e4e6ef;gap:.5rem;padding:.75rem;display:flex}.tkc-input{min-width:0;font:inherit;border:1px solid #c8ccda;border-radius:8px;flex:1;padding:.55rem .7rem}.tkc-honeypot{opacity:0;width:1px;height:1px;position:absolute;left:-9999px}.tkc-send{color:#fff;font:inherit;cursor:pointer;background:#1e1888;border:none;border-radius:8px;padding:.55rem 1rem;font-weight:600}.tkc-send:disabled{opacity:.55;cursor:default}.tkc-hidden{display:none!important}@media (prefers-color-scheme:dark){.tkc-panel{color:#e6e8f0;background:#1a1d29}.tkc-log{background:#11131c}.tkc-msg-bot{color:#e6e8f0;background:#232737;border-color:#2f3550}.tkc-form{border-top-color:#2f3550}.tkc-input{color:#e6e8f0;background:#232737;border-color:#3a4060}}
+/*$vite$:1*/

package/dist/contact-widget.js

@@ -0,0 +1 @@
+var TakuhonContact=(function(e){Object.defineProperty(e,Symbol.toStringTag,{value:`Module`});var t=[`ja`,`en`];function n(e){if(typeof e==`string`){let n=e.trim().toLowerCase().split(`-`)[0];if(n!==void 0&&t.includes(n))return n}return`ja`}var r=`/api/contact`;function i(e){let t=typeof e.endpoint==`string`&&e.endpoint.trim()!==``?e.endpoint.trim():r;return{siteKey:e.siteKey,endpoint:t,locale:n(e.locale??e.lang),...e.pageUrl?{pageUrl:e.pageUrl}:{}}}var a={ja:{launcher:`お問い合わせ`,title:`お問い合わせ`,close:`閉じる`,greeting:`こんにちは。お問い合わせ内容をお送りください。確認後、メールで返信します。`,askEmail:`まず、返信先のメールアドレスを入力してください。`,askMessage:`ありがとうございます。次にお問い合わせ内容を入力してください。`,confirm:`送信してよろしいですか？`,send:`送信`,sending:`送信中…`,verifying:`確認中…`,done:`お問い合わせを受け付けました。確認後、メールで返信します。`,retry:`もう一度送信する`,challengePrompt:`送信前に確認にお答えください。`,emailPlaceholder:`you@example.com`,messagePlaceholder:`お問い合わせ内容`,errorEmail:`メールアドレスの形式が正しくないようです。`,errorChallenge:`確認に失敗しました。もう一度お試しください。`,errorGeneric:`送信に失敗しました。時間をおいて再度お試しください。`},en:{launcher:`Contact`,title:`Contact`,close:`Close`,greeting:`Hi! Send your question below and we'll reply by email.`,askEmail:`First, what email address should we reply to?`,askMessage:`Thanks! Now, what would you like to ask?`,confirm:`Ready to send?`,send:`Send`,sending:`Sending…`,verifying:`Verifying…`,done:`Got it — we'll review your message and reply by email.`,retry:`Try again`,challengePrompt:`Please complete the check before sending.`,emailPlaceholder:`you@example.com`,messagePlaceholder:`Your message`,errorEmail:`That email address doesn't look right.`,errorChallenge:`Verification failed. Please try again.`,errorGeneric:`Something went wrong. Please try again later.`}};function o(e,t){return a[e][t]}function s(e){return{email:e.email,message:e.message,locale:e.locale,token:e.token,hp:e.honeypot,...e.pageUrl?{pageUrl:e.pageUrl}:{}}}function c(e){switch(e){case`email_invalid`:case`email_missing`:case`email_too_long`:return`errorEmail`;case`challenge_failed`:return`errorChallenge`;default:return`errorGeneric`}}function l(e){"@babel/helpers - typeof";return l=typeof Symbol==`function`&&typeof Symbol.iterator==`symbol`?function(e){return typeof e}:function(e){return e&&typeof Symbol==`function`&&e.constructor===Symbol&&e!==Symbol.prototype?`symbol`:typeof e},l(e)}function u(e,t){if(l(e)!=`object`||!e)return e;var n=e[Symbol.toPrimitive];if(n!==void 0){var r=n.call(e,t||`default`);if(l(r)!=`object`)return r;throw TypeError(`@@toPrimitive must return a primitive value.`)}return(t===`string`?String:Number)(e)}function d(e){var t=u(e,`string`);return l(t)==`symbol`?t:t+``}function f(e,t,n){return(t=d(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}var p=`https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit`;function m(e){return/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(e.trim())}function h(){return globalThis.turnstile}var g;function _(){let e=h();return e?Promise.resolve(e):g||(g=new Promise((e,t)=>{let n=document.createElement(`script`);n.src=p,n.async=!0,n.addEventListener(`load`,()=>{let n=h();n?e(n):t(Error(`turnstile unavailable after load`))}),n.addEventListener(`error`,()=>t(Error(`turnstile script failed to load`))),document.head.appendChild(n)}),g)}function v(e,t,n){let r=document.createElement(e);return t&&(r.className=t),n!==void 0&&(r.textContent=n),r}var y=`http://www.w3.org/2000/svg`;function b(){let e=document.createElementNS(y,`svg`);e.setAttribute(`viewBox`,`0 0 24 24`),e.setAttribute(`width`,`26`),e.setAttribute(`height`,`26`),e.setAttribute(`aria-hidden`,`true`),e.setAttribute(`focusable`,`false`);let t=document.createElementNS(y,`path`);return t.setAttribute(`fill`,`currentColor`),t.setAttribute(`d`,`M12 3C6.5 3 2 6.58 2 11c0 2.4 1.32 4.56 3.4 6.04L5 21l3.9-2.05c.98.26 2.02.4 3.1.4 5.5 0 10-3.58 10-8s-4.5-8-10-8z`),e.appendChild(t),e}var x=class{constructor(e){f(this,`cfg`,void 0),f(this,`state`,void 0),f(this,`step`,`email`),f(this,`opened`,!1),f(this,`greeted`,!1),f(this,`turnstileRendered`,!1),f(this,`pendingSubmit`,!1),f(this,`root`,void 0),f(this,`launcher`,void 0),f(this,`panel`,void 0),f(this,`log`,void 0),f(this,`turnstileHost`,void 0),f(this,`form`,void 0),f(this,`input`,void 0),f(this,`honeypot`,void 0),f(this,`send`,void 0),this.cfg=i(e),this.state={email:``,message:``,token:``,honeypot:``,locale:this.cfg.locale,...this.cfg.pageUrl?{pageUrl:this.cfg.pageUrl}:{}}}tr(e){return o(this.cfg.locale,e)}mount(e=document.body){this.root=v(`div`,`tkc-root`),this.launcher=v(`button`,`tkc-launcher`),this.launcher.type=`button`,this.launcher.setAttribute(`aria-haspopup`,`dialog`),this.launcher.setAttribute(`aria-label`,this.tr(`launcher`)),this.launcher.append(b()),this.launcher.addEventListener(`click`,()=>this.open()),this.panel=v(`div`,`tkc-panel tkc-hidden`),this.panel.setAttribute(`role`,`dialog`),this.panel.setAttribute(`aria-label`,this.tr(`title`));let t=v(`div`,`tkc-header`);t.append(v(`span`,void 0,this.tr(`title`)));let n=v(`button`,`tkc-close`,`×`);n.type=`button`,n.setAttribute(`aria-label`,this.tr(`close`)),n.addEventListener(`click`,()=>this.close()),t.append(n),this.log=v(`div`,`tkc-log`),this.log.setAttribute(`role`,`log`),this.log.setAttribute(`aria-live`,`polite`),this.turnstileHost=v(`div`,`tkc-turnstile`),this.form=v(`form`,`tkc-form`),this.honeypot=v(`input`,`tkc-honeypot`),this.honeypot.type=`text`,this.honeypot.tabIndex=-1,this.honeypot.autocomplete=`off`,this.honeypot.setAttribute(`aria-hidden`,`true`),this.honeypot.name=`company`,this.input=v(`input`,`tkc-input`),this.input.type=`text`,this.input.autocomplete=`off`,this.input.setAttribute(`aria-label`,this.tr(`title`)),this.send=v(`button`,`tkc-send`,this.tr(`send`)),this.send.type=`submit`,this.form.append(this.honeypot,this.input,this.send),this.form.addEventListener(`submit`,e=>{e.preventDefault(),this.onSubmit()}),this.panel.append(t,this.log,this.turnstileHost,this.form),this.root.append(this.launcher,this.panel),e.append(this.root),document.addEventListener(`click`,e=>{if(!this.opened)return;let t=e.target;t instanceof Node&&this.root.contains(t)||this.close(!1)}),document.addEventListener(`keydown`,e=>{this.opened&&e.key===`Escape`&&this.close()})}open(){this.opened||(this.opened=!0,this.launcher.classList.add(`tkc-hidden`),this.panel.classList.remove(`tkc-hidden`),this.greeted||(this.greeted=!0,this.botSay(`greeting`),this.botSay(`askEmail`)),this.setStep(`email`),this.input.focus())}close(e=!0){this.opened=!1,this.panel.classList.add(`tkc-hidden`),this.launcher.classList.remove(`tkc-hidden`),e&&this.launcher.focus()}botSay(e){this.appendMessage(`tkc-msg-bot`,this.tr(e))}appendMessage(e,t){let n=v(`div`,`tkc-msg ${e}`,t);this.log.append(n),this.log.scrollTop=this.log.scrollHeight}setStep(e){this.step=e;let t=e===`email`||e===`message`;this.input.classList.toggle(`tkc-hidden`,!t),this.input.placeholder=e===`email`?this.tr(`emailPlaceholder`):this.tr(`messagePlaceholder`),this.input.value=``,this.send.disabled=e===`sending`,this.send.textContent=e===`sending`?this.tr(`sending`):this.tr(`send`),this.form.classList.toggle(`tkc-hidden`,e===`done`)}async onSubmit(){switch(this.step){case`email`:{let e=this.input.value.trim();if(!m(e)){this.botSay(`errorEmail`);return}this.state.email=e,this.appendMessage(`tkc-msg-user`,e),this.botSay(`askMessage`),this.setStep(`message`),this.input.focus();return}case`message`:{let e=this.input.value.trim();if(e===``)return;this.state.message=e,this.appendMessage(`tkc-msg-user`,e),this.botSay(`confirm`),this.setStep(`confirm`);return}case`confirm`:if(this.state.token){await this.submitInquiry();return}this.pendingSubmit=!0,this.send.disabled=!0,this.send.textContent=this.tr(`verifying`),this.renderTurnstile();return;default:return}}renderTurnstile(){this.turnstileRendered||(this.turnstileRendered=!0,_().then(e=>{e.render(this.turnstileHost,{sitekey:this.cfg.siteKey,theme:`auto`,language:this.cfg.locale,appearance:`interaction-only`,callback:e=>{this.state.token=e,this.pendingSubmit&&(this.pendingSubmit=!1,this.submitInquiry())},"expired-callback":()=>{this.state.token=``},"error-callback":()=>{this.state.token=``,this.pendingSubmit&&(this.botSay(`errorChallenge`),this.resetSendButton())}})}).catch(()=>{this.botSay(`errorGeneric`),this.resetSendButton()}))}resetSendButton(){this.pendingSubmit=!1,this.send.disabled=!1,this.send.textContent=this.tr(`retry`)}async submitInquiry(){this.state.honeypot=this.honeypot.value,this.setStep(`sending`),this.botSay(`sending`);let e=!1,t;try{let n=await fetch(this.cfg.endpoint,{method:`POST`,headers:{"content-type":`application/json`},body:JSON.stringify(s(this.state))}),r=await n.json().catch(()=>null);e=n.ok&&r?.ok===!0,t=r?.error}catch{}if(e){this.botSay(`done`),this.setStep(`done`);return}this.botSay(c(t)),this.state.token=``;let n=h();n&&n.reset(),this.send.textContent=this.tr(`retry`),this.send.disabled=!1,this.step=`confirm`}};function S(e,t){let n=new x(e);return n.mount(t),n}function C(){let e=window.TAKUHON_CONTACT;e?.siteKey&&S({siteKey:e.siteKey,endpoint:e.endpoint,locale:e.locale,lang:e.lang??document.documentElement.lang,pageUrl:e.pageUrl??window.location.href})}return document.readyState===`loading`?document.addEventListener(`DOMContentLoaded`,C,{once:!0}):C(),e.mountContactWidget=S,e})({});

package/dist/index.d.ts

@@ -0,0 +1,159 @@
+/**
+ * Core types for the takuhon contact-form pipeline.
+ *
+ * These are runtime-agnostic: no Cloudflare, Node, or framework imports. The
+ * two interfaces ({@link ChallengeVerifier}, {@link EmailTransport}) are the
+ * seams an adapter fills — e.g. a Cloudflare adapter provides a Turnstile
+ * verifier and a `send_email` transport. Keeping them abstract is what lets the
+ * same contact core run on any host (the takuhon "host anywhere" promise).
+ */
+/** Locales the widget and emails support. */
+type ContactLocale = 'ja' | 'en';
+/** Server-derived metadata attached to an inquiry for triage. Never trusted for security. */
+interface InquiryMeta {
+    /** Visitor country (e.g. from `request.cf.country`), if known. */
+    country?: string;
+    /** Visitor IP (e.g. from `CF-Connecting-IP`), if known. */
+    ip?: string;
+    /** ISO 8601 timestamp the inquiry was received. */
+    receivedAt?: string;
+}
+/** A validated inquiry, ready to be delivered to the site owner. */
+interface Inquiry {
+    /**
+     * The visitor's reply-to email address. Validated to be a single address
+     * with no CR/LF, so it is safe to place in a `Reply-To` header.
+     */
+    email: string;
+    /** Free-text message body. Untrusted — render as plain text, escape for HTML. */
+    message: string;
+    /** UI locale the widget was shown in. */
+    locale: ContactLocale;
+    /** URL of the page the widget was embedded on, if the client provided it. */
+    pageUrl?: string;
+    /** The visitor's user agent, if available. */
+    userAgent?: string;
+    /** Best-effort, server-derived metadata. */
+    meta?: InquiryMeta;
+}
+/** Optional context passed to a {@link ChallengeVerifier}. */
+interface ChallengeContext {
+    /** The visitor's IP, if the host can supply it (improves Turnstile scoring). */
+    remoteIp?: string;
+}
+/**
+ * Verifies an anti-abuse challenge token (e.g. Cloudflare Turnstile).
+ * Implementations MUST verify server-side; never trust a client claim of success.
+ */
+interface ChallengeVerifier {
+    verify(token: string, context?: ChallengeContext): Promise<boolean>;
+}
+/**
+ * Delivers a validated {@link Inquiry} to its destination — for the MVP, the
+ * site owner's verified inbox. Implementations set `From` / `Reply-To` / subject.
+ */
+interface EmailTransport {
+    send(inquiry: Inquiry): Promise<void>;
+}
+/** Tunable limits and policy for {@link validateSubmission} and the handler. */
+interface ContactConfig {
+    /** Max message length in characters. Default 5000. */
+    maxMessageLength?: number;
+    /** Max email length in characters. Default 254 (RFC 5321 path limit). */
+    maxEmailLength?: number;
+    /** Max request body size in bytes. Default 16384 (16 KiB). */
+    maxBodyBytes?: number;
+    /**
+     * Allowed page origins for the Origin/Referer check (e.g.
+     * `['https://me.tak3.jp']`). Empty or omitted disables the check — use that
+     * for same-origin deployments where the host already constrains callers.
+     */
+    allowedOrigins?: string[];
+}
+/** Dependencies injected into {@link handleContact}. */
+interface ContactDeps {
+    /** Verifies the anti-abuse challenge (e.g. Turnstile). */
+    verifier: ChallengeVerifier;
+    /** Delivers the validated inquiry (e.g. via `send_email`). */
+    transport: EmailTransport;
+    /** Limits and policy. */
+    config?: ContactConfig;
+    /**
+     * Optional extractor for server-derived metadata (e.g. country/IP from
+     * `request.cf`). Runs after validation; its result is best-effort only.
+     */
+    readMeta?: (request: Request) => InquiryMeta;
+    /** Clock injection for tests. Defaults to `() => new Date()`. */
+    now?: () => Date;
+}
+/** The raw, untrusted JSON body a widget POSTs. Every field is unknown. */
+interface RawSubmission {
+    email?: unknown;
+    message?: unknown;
+    locale?: unknown;
+    pageUrl?: unknown;
+    /** Anti-bot honeypot: must be empty/absent for a human submission. */
+    hp?: unknown;
+    /** Challenge token, verified separately by a {@link ChallengeVerifier}. */
+    token?: unknown;
+}
+/** The clean subset extracted from a {@link RawSubmission} once validated. */
+interface ValidSubmission {
+    email: string;
+    message: string;
+    locale: ContactLocale;
+    pageUrl?: string;
+}
+/** Machine-readable validation failure reasons. */
+type ValidationError = 'email_missing' | 'email_invalid' | 'email_too_long' | 'message_missing' | 'message_too_long' | 'honeypot';
+/** Result of {@link validateSubmission}. */
+type ValidationResult = {
+    ok: true;
+    value: ValidSubmission;
+} | {
+    ok: false;
+    error: ValidationError;
+    spam?: boolean;
+};
+
+/**
+ * Framework-agnostic contact-form request handler.
+ *
+ * Pipeline: method / content-type / origin guards → size-bounded JSON parse →
+ * {@link validateSubmission} → challenge verification → {@link EmailTransport}
+ * delivery. Returns a small JSON {@link Response}. It is intentionally stateless
+ * (no storage) and mountable on any Web-standard runtime; adapters supply the
+ * verifier and transport.
+ */
+
+declare function handleContact(request: Request, deps: ContactDeps): Promise<Response>;
+
+/**
+ * Pure, synchronous validation for an untrusted contact submission.
+ *
+ * No I/O and no challenge check (that is the verifier's job). The email rules
+ * are deliberately strict — a single address with no CR/LF — so the result is
+ * safe to drop into a `Reply-To` header without enabling email header
+ * injection, the most important security invariant of this feature.
+ */
+
+/** Default limits, exported so adapters and the handler share one source of truth. */
+declare const DEFAULT_MAX_MESSAGE_LENGTH = 5000;
+declare const DEFAULT_MAX_EMAIL_LENGTH = 254;
+declare const DEFAULT_MAX_BODY_BYTES = 16384;
+/** True if the string contains a CR or LF (an email header-injection vector). */
+declare function hasLineBreak(value: string): boolean;
+/**
+ * Normalize an unknown locale claim to a supported {@link ContactLocale},
+ * defaulting to `'ja'` (the house default locale).
+ */
+declare function normalizeLocale(value: unknown): ContactLocale;
+/**
+ * Validate a raw, untrusted submission into a {@link ValidationResult}.
+ *
+ * A tripped honeypot returns `{ ok: false, error: 'honeypot', spam: true }` so
+ * the caller can choose to feign success rather than reveal the trap.
+ */
+declare function validateSubmission(raw: RawSubmission, config?: ContactConfig): ValidationResult;
+
+export { type ChallengeContext, type ChallengeVerifier, type ContactConfig, type ContactDeps, type ContactLocale, DEFAULT_MAX_BODY_BYTES, DEFAULT_MAX_EMAIL_LENGTH, DEFAULT_MAX_MESSAGE_LENGTH, type EmailTransport, type Inquiry, type InquiryMeta, type RawSubmission, type ValidSubmission, type ValidationError, type ValidationResult, handleContact, hasLineBreak, normalizeLocale, validateSubmission };

package/dist/index.js

@@ -0,0 +1,134 @@
+// src/validate.ts
+var DEFAULT_MAX_MESSAGE_LENGTH = 5e3;
+var DEFAULT_MAX_EMAIL_LENGTH = 254;
+var DEFAULT_MAX_BODY_BYTES = 16384;
+var SUPPORTED_LOCALES = ["ja", "en"];
+var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+function hasLineBreak(value) {
+  return /[\r\n]/.test(value);
+}
+function normalizeLocale(value) {
+  if (typeof value === "string") {
+    const primary = value.trim().toLowerCase().split("-")[0];
+    if (primary !== void 0 && SUPPORTED_LOCALES.includes(primary)) {
+      return primary;
+    }
+  }
+  return "ja";
+}
+function validateSubmission(raw, config) {
+  if (typeof raw.hp === "string" && raw.hp.trim() !== "") {
+    return { ok: false, error: "honeypot", spam: true };
+  }
+  const maxEmail = config?.maxEmailLength ?? DEFAULT_MAX_EMAIL_LENGTH;
+  const maxMessage = config?.maxMessageLength ?? DEFAULT_MAX_MESSAGE_LENGTH;
+  if (typeof raw.email !== "string") return { ok: false, error: "email_missing" };
+  const email = raw.email.trim();
+  if (email === "") return { ok: false, error: "email_missing" };
+  if (email.length > maxEmail) return { ok: false, error: "email_too_long" };
+  if (hasLineBreak(email) || !EMAIL_RE.test(email)) return { ok: false, error: "email_invalid" };
+  if (typeof raw.message !== "string") return { ok: false, error: "message_missing" };
+  const message = raw.message.trim();
+  if (message === "") return { ok: false, error: "message_missing" };
+  if (message.length > maxMessage) return { ok: false, error: "message_too_long" };
+  const pageUrl = typeof raw.pageUrl === "string" ? raw.pageUrl.trim() : "";
+  return {
+    ok: true,
+    value: {
+      email,
+      message,
+      locale: normalizeLocale(raw.locale),
+      ...pageUrl !== "" ? { pageUrl } : {}
+    }
+  };
+}
+
+// src/handler.ts
+function json(status, body) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: {
+      "content-type": "application/json; charset=utf-8",
+      "cache-control": "no-store"
+    }
+  });
+}
+function originAllowed(request, allowed) {
+  if (!allowed || allowed.length === 0) return true;
+  const origin = request.headers.get("origin");
+  if (origin) return allowed.includes(origin);
+  const referer = request.headers.get("referer");
+  if (referer) {
+    try {
+      return allowed.includes(new URL(referer).origin);
+    } catch {
+      return false;
+    }
+  }
+  return false;
+}
+function remoteIp(request) {
+  const direct = request.headers.get("cf-connecting-ip");
+  if (direct) return direct;
+  const forwarded = request.headers.get("x-forwarded-for");
+  if (!forwarded) return void 0;
+  const first = forwarded.split(",")[0]?.trim();
+  return first !== void 0 && first !== "" ? first : void 0;
+}
+async function handleContact(request, deps) {
+  if (request.method !== "POST") return json(405, { ok: false, error: "method_not_allowed" });
+  const contentType = request.headers.get("content-type") ?? "";
+  if (!contentType.includes("application/json")) {
+    return json(415, { ok: false, error: "unsupported_media_type" });
+  }
+  if (!originAllowed(request, deps.config?.allowedOrigins)) {
+    return json(403, { ok: false, error: "forbidden_origin" });
+  }
+  const maxBytes = deps.config?.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES;
+  const buffer = await request.arrayBuffer();
+  if (buffer.byteLength > maxBytes) return json(413, { ok: false, error: "payload_too_large" });
+  let raw;
+  try {
+    const parsed = JSON.parse(new TextDecoder().decode(buffer));
+    if (typeof parsed !== "object" || parsed === null) {
+      return json(400, { ok: false, error: "invalid_json" });
+    }
+    raw = parsed;
+  } catch {
+    return json(400, { ok: false, error: "invalid_json" });
+  }
+  const validation = validateSubmission(raw, deps.config);
+  if (!validation.ok) {
+    if (validation.spam) return json(200, { ok: true });
+    return json(422, { ok: false, error: validation.error });
+  }
+  const token = typeof raw.token === "string" ? raw.token : "";
+  const passed = token.length > 0 && await deps.verifier.verify(token, { remoteIp: remoteIp(request) });
+  if (!passed) return json(422, { ok: false, error: "challenge_failed" });
+  const meta = {
+    ...deps.readMeta?.(request),
+    receivedAt: (deps.now?.() ?? /* @__PURE__ */ new Date()).toISOString()
+  };
+  const userAgent = request.headers.get("user-agent") ?? void 0;
+  const inquiry = {
+    ...validation.value,
+    ...userAgent ? { userAgent } : {},
+    meta
+  };
+  try {
+    await deps.transport.send(inquiry);
+  } catch {
+    return json(502, { ok: false, error: "send_failed" });
+  }
+  return json(200, { ok: true });
+}
+export {
+  DEFAULT_MAX_BODY_BYTES,
+  DEFAULT_MAX_EMAIL_LENGTH,
+  DEFAULT_MAX_MESSAGE_LENGTH,
+  handleContact,
+  hasLineBreak,
+  normalizeLocale,
+  validateSubmission
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/validate.ts","../src/handler.ts"],"sourcesContent":["/**\n * Pure, synchronous validation for an untrusted contact submission.\n *\n * No I/O and no challenge check (that is the verifier's job). The email rules\n * are deliberately strict — a single address with no CR/LF — so the result is\n * safe to drop into a `Reply-To` header without enabling email header\n * injection, the most important security invariant of this feature.\n */\n\nimport type { ContactConfig, ContactLocale, RawSubmission, ValidationResult } from './types.js';\n\n/** Default limits, exported so adapters and the handler share one source of truth. */\nexport const DEFAULT_MAX_MESSAGE_LENGTH = 5000;\nexport const DEFAULT_MAX_EMAIL_LENGTH = 254;\nexport const DEFAULT_MAX_BODY_BYTES = 16384;\n\nconst SUPPORTED_LOCALES: readonly string[] = ['ja', 'en'];\n\n/**\n * A deliberately strict, single-address email check. Rejects whitespace\n * (including CR/LF) and anything with more than one `@`.\n */\nconst EMAIL_RE = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/;\n\n/** True if the string contains a CR or LF (an email header-injection vector). */\nexport function hasLineBreak(value: string): boolean {\n  return /[\\r\\n]/.test(value);\n}\n\n/**\n * Normalize an unknown locale claim to a supported {@link ContactLocale},\n * defaulting to `'ja'` (the house default locale).\n */\nexport function normalizeLocale(value: unknown): ContactLocale {\n  if (typeof value === 'string') {\n    const primary = value.trim().toLowerCase().split('-')[0];\n    if (primary !== undefined && SUPPORTED_LOCALES.includes(primary)) {\n      return primary as ContactLocale;\n    }\n  }\n  return 'ja';\n}\n\n/**\n * Validate a raw, untrusted submission into a {@link ValidationResult}.\n *\n * A tripped honeypot returns `{ ok: false, error: 'honeypot', spam: true }` so\n * the caller can choose to feign success rather than reveal the trap.\n */\nexport function validateSubmission(raw: RawSubmission, config?: ContactConfig): ValidationResult {\n  // Honeypot: any non-empty value means a bot filled a hidden field.\n  if (typeof raw.hp === 'string' && raw.hp.trim() !== '') {\n    return { ok: false, error: 'honeypot', spam: true };\n  }\n\n  const maxEmail = config?.maxEmailLength ?? DEFAULT_MAX_EMAIL_LENGTH;\n  const maxMessage = config?.maxMessageLength ?? DEFAULT_MAX_MESSAGE_LENGTH;\n\n  // Email — required, single address, no CR/LF, within length, well-formed.\n  if (typeof raw.email !== 'string') return { ok: false, error: 'email_missing' };\n  const email = raw.email.trim();\n  if (email === '') return { ok: false, error: 'email_missing' };\n  if (email.length > maxEmail) return { ok: false, error: 'email_too_long' };\n  if (hasLineBreak(email) || !EMAIL_RE.test(email)) return { ok: false, error: 'email_invalid' };\n\n  // Message — required, non-empty after trim, within length. Newlines allowed in the body.\n  if (typeof raw.message !== 'string') return { ok: false, error: 'message_missing' };\n  const message = raw.message.trim();\n  if (message === '') return { ok: false, error: 'message_missing' };\n  if (message.length > maxMessage) return { ok: false, error: 'message_too_long' };\n\n  const pageUrl = typeof raw.pageUrl === 'string' ? raw.pageUrl.trim() : '';\n  return {\n    ok: true,\n    value: {\n      email,\n      message,\n      locale: normalizeLocale(raw.locale),\n      ...(pageUrl !== '' ? { pageUrl } : {}),\n    },\n  };\n}\n","/**\n * Framework-agnostic contact-form request handler.\n *\n * Pipeline: method / content-type / origin guards → size-bounded JSON parse →\n * {@link validateSubmission} → challenge verification → {@link EmailTransport}\n * delivery. Returns a small JSON {@link Response}. It is intentionally stateless\n * (no storage) and mountable on any Web-standard runtime; adapters supply the\n * verifier and transport.\n */\n\nimport type { ContactDeps, Inquiry, InquiryMeta, RawSubmission } from './types.js';\nimport { DEFAULT_MAX_BODY_BYTES, validateSubmission } from './validate.js';\n\nfunction json(status: number, body: Record<string, unknown>): Response {\n  return new Response(JSON.stringify(body), {\n    status,\n    headers: {\n      'content-type': 'application/json; charset=utf-8',\n      'cache-control': 'no-store',\n    },\n  });\n}\n\n/** True if the request's Origin (or Referer origin) is allowed, or no allowlist is set. */\nfunction originAllowed(request: Request, allowed?: string[]): boolean {\n  if (!allowed || allowed.length === 0) return true;\n  const origin = request.headers.get('origin');\n  if (origin) return allowed.includes(origin);\n  // Fall back to the Referer's origin when Origin is absent.\n  const referer = request.headers.get('referer');\n  if (referer) {\n    try {\n      return allowed.includes(new URL(referer).origin);\n    } catch {\n      return false;\n    }\n  }\n  return false;\n}\n\n/** Best-effort visitor IP from common edge headers (used only for challenge scoring). */\nfunction remoteIp(request: Request): string | undefined {\n  const direct = request.headers.get('cf-connecting-ip');\n  if (direct) return direct;\n  const forwarded = request.headers.get('x-forwarded-for');\n  if (!forwarded) return undefined;\n  const first = forwarded.split(',')[0]?.trim();\n  return first !== undefined && first !== '' ? first : undefined;\n}\n\nexport async function handleContact(request: Request, deps: ContactDeps): Promise<Response> {\n  if (request.method !== 'POST') return json(405, { ok: false, error: 'method_not_allowed' });\n\n  const contentType = request.headers.get('content-type') ?? '';\n  if (!contentType.includes('application/json')) {\n    return json(415, { ok: false, error: 'unsupported_media_type' });\n  }\n\n  if (!originAllowed(request, deps.config?.allowedOrigins)) {\n    return json(403, { ok: false, error: 'forbidden_origin' });\n  }\n\n  const maxBytes = deps.config?.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES;\n  const buffer = await request.arrayBuffer();\n  if (buffer.byteLength > maxBytes) return json(413, { ok: false, error: 'payload_too_large' });\n\n  let raw: RawSubmission;\n  try {\n    const parsed: unknown = JSON.parse(new TextDecoder().decode(buffer));\n    if (typeof parsed !== 'object' || parsed === null) {\n      return json(400, { ok: false, error: 'invalid_json' });\n    }\n    raw = parsed;\n  } catch {\n    return json(400, { ok: false, error: 'invalid_json' });\n  }\n\n  const validation = validateSubmission(raw, deps.config);\n  if (!validation.ok) {\n    // Honeypot: feign success so a bot cannot learn it was caught.\n    if (validation.spam) return json(200, { ok: true });\n    return json(422, { ok: false, error: validation.error });\n  }\n\n  const token = typeof raw.token === 'string' ? raw.token : '';\n  const passed =\n    token.length > 0 && (await deps.verifier.verify(token, { remoteIp: remoteIp(request) }));\n  if (!passed) return json(422, { ok: false, error: 'challenge_failed' });\n\n  const meta: InquiryMeta = {\n    ...deps.readMeta?.(request),\n    receivedAt: (deps.now?.() ?? new Date()).toISOString(),\n  };\n  const userAgent = request.headers.get('user-agent') ?? undefined;\n  const inquiry: Inquiry = {\n    ...validation.value,\n    ...(userAgent ? { userAgent } : {}),\n    meta,\n  };\n\n  try {\n    await deps.transport.send(inquiry);\n  } catch {\n    return json(502, { ok: false, error: 'send_failed' });\n  }\n\n  return json(200, { ok: true });\n}\n"],"mappings":";AAYO,IAAM,6BAA6B;AACnC,IAAM,2BAA2B;AACjC,IAAM,yBAAyB;AAEtC,IAAM,oBAAuC,CAAC,MAAM,IAAI;AAMxD,IAAM,WAAW;AAGV,SAAS,aAAa,OAAwB;AACnD,SAAO,SAAS,KAAK,KAAK;AAC5B;AAMO,SAAS,gBAAgB,OAA+B;AAC7D,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,UAAU,MAAM,KAAK,EAAE,YAAY,EAAE,MAAM,GAAG,EAAE,CAAC;AACvD,QAAI,YAAY,UAAa,kBAAkB,SAAS,OAAO,GAAG;AAChE,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAQO,SAAS,mBAAmB,KAAoB,QAA0C;AAE/F,MAAI,OAAO,IAAI,OAAO,YAAY,IAAI,GAAG,KAAK,MAAM,IAAI;AACtD,WAAO,EAAE,IAAI,OAAO,OAAO,YAAY,MAAM,KAAK;AAAA,EACpD;AAEA,QAAM,WAAW,QAAQ,kBAAkB;AAC3C,QAAM,aAAa,QAAQ,oBAAoB;AAG/C,MAAI,OAAO,IAAI,UAAU,SAAU,QAAO,EAAE,IAAI,OAAO,OAAO,gBAAgB;AAC9E,QAAM,QAAQ,IAAI,MAAM,KAAK;AAC7B,MAAI,UAAU,GAAI,QAAO,EAAE,IAAI,OAAO,OAAO,gBAAgB;AAC7D,MAAI,MAAM,SAAS,SAAU,QAAO,EAAE,IAAI,OAAO,OAAO,iBAAiB;AACzE,MAAI,aAAa,KAAK,KAAK,CAAC,SAAS,KAAK,KAAK,EAAG,QAAO,EAAE,IAAI,OAAO,OAAO,gBAAgB;AAG7F,MAAI,OAAO,IAAI,YAAY,SAAU,QAAO,EAAE,IAAI,OAAO,OAAO,kBAAkB;AAClF,QAAM,UAAU,IAAI,QAAQ,KAAK;AACjC,MAAI,YAAY,GAAI,QAAO,EAAE,IAAI,OAAO,OAAO,kBAAkB;AACjE,MAAI,QAAQ,SAAS,WAAY,QAAO,EAAE,IAAI,OAAO,OAAO,mBAAmB;AAE/E,QAAM,UAAU,OAAO,IAAI,YAAY,WAAW,IAAI,QAAQ,KAAK,IAAI;AACvE,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,OAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,QAAQ,gBAAgB,IAAI,MAAM;AAAA,MAClC,GAAI,YAAY,KAAK,EAAE,QAAQ,IAAI,CAAC;AAAA,IACtC;AAAA,EACF;AACF;;;ACpEA,SAAS,KAAK,QAAgB,MAAyC;AACrE,SAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;AAAA,IACxC;AAAA,IACA,SAAS;AAAA,MACP,gBAAgB;AAAA,MAChB,iBAAiB;AAAA,IACnB;AAAA,EACF,CAAC;AACH;AAGA,SAAS,cAAc,SAAkB,SAA6B;AACpE,MAAI,CAAC,WAAW,QAAQ,WAAW,EAAG,QAAO;AAC7C,QAAM,SAAS,QAAQ,QAAQ,IAAI,QAAQ;AAC3C,MAAI,OAAQ,QAAO,QAAQ,SAAS,MAAM;AAE1C,QAAM,UAAU,QAAQ,QAAQ,IAAI,SAAS;AAC7C,MAAI,SAAS;AACX,QAAI;AACF,aAAO,QAAQ,SAAS,IAAI,IAAI,OAAO,EAAE,MAAM;AAAA,IACjD,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAGA,SAAS,SAAS,SAAsC;AACtD,QAAM,SAAS,QAAQ,QAAQ,IAAI,kBAAkB;AACrD,MAAI,OAAQ,QAAO;AACnB,QAAM,YAAY,QAAQ,QAAQ,IAAI,iBAAiB;AACvD,MAAI,CAAC,UAAW,QAAO;AACvB,QAAM,QAAQ,UAAU,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AAC5C,SAAO,UAAU,UAAa,UAAU,KAAK,QAAQ;AACvD;AAEA,eAAsB,cAAc,SAAkB,MAAsC;AAC1F,MAAI,QAAQ,WAAW,OAAQ,QAAO,KAAK,KAAK,EAAE,IAAI,OAAO,OAAO,qBAAqB,CAAC;AAE1F,QAAM,cAAc,QAAQ,QAAQ,IAAI,cAAc,KAAK;AAC3D,MAAI,CAAC,YAAY,SAAS,kBAAkB,GAAG;AAC7C,WAAO,KAAK,KAAK,EAAE,IAAI,OAAO,OAAO,yBAAyB,CAAC;AAAA,EACjE;AAEA,MAAI,CAAC,cAAc,SAAS,KAAK,QAAQ,cAAc,GAAG;AACxD,WAAO,KAAK,KAAK,EAAE,IAAI,OAAO,OAAO,mBAAmB,CAAC;AAAA,EAC3D;AAEA,QAAM,WAAW,KAAK,QAAQ,gBAAgB;AAC9C,QAAM,SAAS,MAAM,QAAQ,YAAY;AACzC,MAAI,OAAO,aAAa,SAAU,QAAO,KAAK,KAAK,EAAE,IAAI,OAAO,OAAO,oBAAoB,CAAC;AAE5F,MAAI;AACJ,MAAI;AACF,UAAM,SAAkB,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,MAAM,CAAC;AACnE,QAAI,OAAO,WAAW,YAAY,WAAW,MAAM;AACjD,aAAO,KAAK,KAAK,EAAE,IAAI,OAAO,OAAO,eAAe,CAAC;AAAA,IACvD;AACA,UAAM;AAAA,EACR,QAAQ;AACN,WAAO,KAAK,KAAK,EAAE,IAAI,OAAO,OAAO,eAAe,CAAC;AAAA,EACvD;AAEA,QAAM,aAAa,mBAAmB,KAAK,KAAK,MAAM;AACtD,MAAI,CAAC,WAAW,IAAI;AAElB,QAAI,WAAW,KAAM,QAAO,KAAK,KAAK,EAAE,IAAI,KAAK,CAAC;AAClD,WAAO,KAAK,KAAK,EAAE,IAAI,OAAO,OAAO,WAAW,MAAM,CAAC;AAAA,EACzD;AAEA,QAAM,QAAQ,OAAO,IAAI,UAAU,WAAW,IAAI,QAAQ;AAC1D,QAAM,SACJ,MAAM,SAAS,KAAM,MAAM,KAAK,SAAS,OAAO,OAAO,EAAE,UAAU,SAAS,OAAO,EAAE,CAAC;AACxF,MAAI,CAAC,OAAQ,QAAO,KAAK,KAAK,EAAE,IAAI,OAAO,OAAO,mBAAmB,CAAC;AAEtE,QAAM,OAAoB;AAAA,IACxB,GAAG,KAAK,WAAW,OAAO;AAAA,IAC1B,aAAa,KAAK,MAAM,KAAK,oBAAI,KAAK,GAAG,YAAY;AAAA,EACvD;AACA,QAAM,YAAY,QAAQ,QAAQ,IAAI,YAAY,KAAK;AACvD,QAAM,UAAmB;AAAA,IACvB,GAAG,WAAW;AAAA,IACd,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;AAAA,IACjC;AAAA,EACF;AAEA,MAAI;AACF,UAAM,KAAK,UAAU,KAAK,OAAO;AAAA,EACnC,QAAQ;AACN,WAAO,KAAK,KAAK,EAAE,IAAI,OAAO,OAAO,cAAc,CAAC;AAAA,EACtD;AAEA,SAAO,KAAK,KAAK,EAAE,IAAI,KAAK,CAAC;AAC/B;","names":[]}

package/package.json

@@ -0,0 +1,51 @@
+{
+  "name": "@takuhon/contact",
+  "version": "0.24.0",
+  "description": "Portable, framework-agnostic contact-form core for takuhon — validation, a stateless inquiry pipeline, and challenge/email transport interfaces. Host wiring (e.g. Cloudflare Turnstile + send_email) lives in the adapters.",
+  "license": "Apache-2.0",
+  "author": "Takuhon contributors",
+  "homepage": "https://github.com/takuhon-dev/takuhon/tree/main/packages/contact#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/takuhon-dev/takuhon.git",
+    "directory": "packages/contact"
+  },
+  "bugs": {
+    "url": "https://github.com/takuhon-dev/takuhon/issues"
+  },
+  "keywords": [
+    "takuhon",
+    "contact",
+    "form",
+    "turnstile",
+    "portable"
+  ],
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE",
+    "NOTICE"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "engines": {
+    "node": ">=22.0.0"
+  },
+  "scripts": {
+    "typecheck": "tsc",
+    "build": "tsup src/index.ts --format esm --dts --clean --sourcemap && vite build",
+    "test": "vitest run"
+  }
+}