Tech specs

/** The epoch ms timestamp rendered into the form, or null if it is missing or malformed. */
export function readStartedAt(formData: FormData): number | null {
  const raw = readString(formData, STARTED_AT_NAME).trim();
  if (!/^\d{10,16}$/.test(raw)) return null;
  const value = Number(raw);
  return Number.isSafeInteger(value) ? value : null;
}

/** Returns why a submission looks automated, or null when it looks human. */
export function detectBot(formData: FormData, now: number): BotSignal | null {
  if (readString(formData, HONEYPOT_NAME).trim() !== "") return "honeypot";
  const startedAt = readStartedAt(formData);
  if (startedAt === null) return "missing-timestamp";
  if (now - startedAt < MIN_FILL_MS) return "too-fast";
  return null;
}