Handling form submissions on the server (Next.js Server Actions) with validation and spam protection, without a form library.
Overview
Turn a FormData into typed, validated data with a honeypot + timing spam guard, and get back either your data or per-field errors ready to re-render. createForm().action matches Next.js useActionState, so a full contact form is a few lines. Framework-agnostic, zero-dep.
Install
$ npm install @lacspace/form
Quick example
@lacspace/formts
contact.action(prev, formData)
Returns { ok, data | errors }
Key API
createForm(opts)→ { handle, action } bound to a schema + spam options.
honeypotProps(name) / timestampValue()Client helpers for spam protection.
Tips
`createForm({ schema }).action` matches `useActionState`, so a full contact form is a few lines.
Add a `honeypot` field and `minSubmitMs` to block bots; internal fields are stripped before validation.
The result echoes `values`, so you can re-render the form with what the user typed on error.
Zero-dependency and isomorphic — safe to import on the server, in the browser, on the edge and in React Native. It tree-shakes, so you only ship what you import.
Watch out for
The honeypot input must be visually hidden but present in the DOM — use the provided `honeypotProps()` helper.
