Skip the backend work for your Replit Agent contact form

Update the contact form so submitting it sends the data to PostTo instead of
building a new email feature. Don't add Nodemailer, an SMTP provider, or a
submissions table for this — just POST the form fields as JSON to
https://postto.dev/api/v1/send/YOUR_TOKEN from the client, with a
"Content-Type: application/json" and "Accept: application/json" header. Show
the existing success state if the response is ok, and the existing error
state otherwise. Add a hidden "_hp" honeypot input that real visitors never
see. Keep all other current fields, validation, and styling unchanged.

export function ContactForm() {
  const [status, setStatus] = useState<'idle' | 'sent' | 'error'>('idle');

  async function handleSubmit(e: React.FormEvent<HTMLFormElement>) {
    e.preventDefault();
    const payload = Object.fromEntries(new FormData(e.currentTarget));

    const res = await fetch('https://postto.dev/api/v1/send/YOUR_TOKEN', {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
        'Accept': 'application/json',
      },
      body: JSON.stringify(payload),
    });

    setStatus(res.ok ? 'sent' : 'error');
  }

  return (
    <form onSubmit={handleSubmit}>
      <input type="text" name="name" placeholder="Name" required />
      <input type="email" name="email" placeholder="Email" required />
      <textarea name="message" required />

      {/* Honeypot: bots fill this in, humans never see it */}
      <input type="text" name="_hp" tabIndex={-1} autoComplete="off" style={{ display: 'none' }} />

      <button type="submit">Send</button>
    </form>
  );
}

import crypto from 'node:crypto';
import type { Express } from 'express';

export function registerRoutes(app: Express) {
  app.post('/api/contact', async (req, res) => {
    const ts = Math.floor(Date.now() / 1000).toString();
    const body = JSON.stringify(req.body);

    const sig = crypto
      .createHmac('sha256', process.env.POSTTO_SECRET!)
      .update(`${ts}.${body}`)
      .digest('hex');

    const response = await fetch('https://postto.dev/api/v1/send/YOUR_TOKEN', {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
        'Accept': 'application/json',
        'X-PostTo-Timestamp': ts,
        'X-PostTo-Signature': sig,
      },
      body, // exact bytes that were signed
    });

    res.status(response.status).json(await response.json());
  });
}