@getvitops/astro 7.0.0 → 8.0.1

package/dist/routes/conversion.d.mts

@@ -7,6 +7,14 @@ interface ConversionRequestContext {
   request: Request;
   locals?: unknown;
 }
+/**
+ * Records a hit for `id` at time `at` (ms) and returns the ms since the previous
+ * hit for that `id`, or `null` if this is the first. Pure interface — a store
+ * decides nothing, it only remembers.
+ */
+interface RateLimitStore {
+  hit(id: string, at: number): Promise<number | null> | number | null;
+}
 interface ConversionRouteOptions {
   /** Where notifications go. Build it from your site config. */
   context: NotifyContext;
@@ -21,19 +29,94 @@ interface ConversionRouteOptions {
   binding?: (locals: unknown) => EmailBinding | undefined;
   /**
    * Reject a submission before anything is sent. Return a message to refuse.
-   * This is where a consumer puts required-field checks and spam rules.
+   * This is where a consumer puts required-field checks.
    */
   validate?: (body: Record<string, unknown>) => string | null;
   /** Called with every channel outcome, delivered or not. Defaults to console. */
   onResult?: (result: Awaited<ReturnType<typeof notify>>) => void;
   /** Injected in tests. */
   now?: () => number;
+  /**
+   * Where to send a no-JS `<form method="post">` submission on success. Without
+   * this, that visitor's browser navigates to the raw `{"success":true}` JSON
+   * body as its next page — functional, but not a page anyone should see. Has
+   * no effect on the beacon/fetch (JSON) path, which always gets a JSON response.
+   */
+  redirectTo?: string;
+  /**
+   * Where to send a refused no-JS submission (validation, spam checks, malformed
+   * body). Falls back to `redirectTo` if omitted, and to the JSON error response
+   * if neither is set.
+   */
+  errorRedirectTo?: string;
+  /**
+   * Field names treated as honeypots: a bot fills every input it finds, a person
+   * never sees these (hidden by CSS in the form markup). A non-empty value is
+   * silently treated as spam — the response looks identical to a real success,
+   * denying the bot the signal it needs to know the trick worked, but nothing is
+   * notified and the field never reaches `notify()`. Defaults to the same names
+   * `render.ts`'s `OMIT_FIELDS` already knows about (`website`, `_honeypot`,
+   * `honeypot`), so the two lists don't need to be kept in sync by hand.
+   */
+  honeypotFields?: string[];
+  /**
+   * Reject a submission whose `Content-Length` exceeds this many bytes. Default
+   * 25_000 — generous for a contact form with no file upload, tiny for anything
+   * meant to relay large payloads. Best-effort: `Content-Length` can be absent
+   * or spoofed, same caveat as the origin check below.
+   */
+  maxBodyBytes?: number;
+  /**
+   * Reject a submission whose `Origin` header doesn't match this origin.
+   * Defaults to `context.canonical`'s origin. Pass `false` to disable.
+   *
+   * Best-effort, not a CSRF guard: browsers omit `Origin` on plenty of
+   * legitimate same-origin requests, so its *absence* is never treated as a
+   * mismatch — only a present-and-different value is rejected. That still stops
+   * the common case (a script hitting the endpoint directly from elsewhere)
+   * without breaking real submissions from older or privacy-hardened browsers.
+   */
+  allowedOrigin?: string | false;
+  /**
+   * Minimum interval between accepted submissions from the same IP. Pass
+   * `false` to disable. `windowMs` defaults to 10 seconds — enough to blunt a
+   * script firing in a loop without troubling someone who fat-fingers a form
+   * and resubmits.
+   */
+  rateLimit?: {
+    windowMs?: number;
+    store?: RateLimitStore;
+  } | false;
+  /**
+   * Verify a Cloudflare Turnstile token server-side. The **secret** key —
+   * unlike `site.security.turnstile.siteKey`, which is public config — must come
+   * from an env var, never a config file (the same rule as every other
+   * credential in this toolchain).
+   */
+  turnstile?: {
+    secretKey: string;
+    /** The submitted field carrying the token. Default `cf-turnstile-response`
+     * — the name Cloudflare's widget submits under. */
+    fieldName?: string;
+    /**
+     * Reject a submission with no token at all, rather than only a present-and-
+     * invalid one. Default `false`: an absent token is the ordinary shape of a
+     * visitor with JS disabled, and this factory is built around that path
+     * staying usable. Set `true` only for a form where verified-human matters
+     * enough to accept that trade-off — doing so means that form no longer
+     * works without JS, on purpose.
+     */
+    required?: boolean;
+  };
 }
 /**
  * Build a POST handler for conversions.
  *
- * Returns 204 for a beacon and 200 with `{ success }` for a form, matching what
- * `navigator.sendBeacon` and a fetch-submitting form each expect.
+ * Returns 204 for a beacon and 200 with `{ success }` for a JSON (fetch-based)
+ * form submission, matching what `navigator.sendBeacon` and a fetch-submitting
+ * form each expect. A no-JS `<form method="post">` — `application/
+ * x-www-form-urlencoded` or `multipart/form-data` — is parsed the same way and,
+ * on success, redirected to `redirectTo` if one is configured.
  *
  * **A failed notification does not fail the request.** The visitor has already
  * submitted; refusing them because our mail did not go out turns a lost
@@ -44,5 +127,5 @@ declare function createConversionRoute(options: ConversionRouteOptions): ({
   locals
 }: ConversionRequestContext) => Promise<Response>;
 //#endregion
-export { ConversionRequestContext, ConversionRouteOptions, createConversionRoute };
+export { ConversionRequestContext, ConversionRouteOptions, RateLimitStore, createConversionRoute };
 //# sourceMappingURL=conversion.d.mts.map

package/dist/routes/conversion.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"conversion.d.mts","names":[],"sources":["../../src/routes/conversion.ts"],"mappings":";;;;;UAkDiB,wBAAA;EACf,OAAA,EAAS,OAAO;EAChB,MAAA;AAAA;AAAA,UAGe,sBAAA;EAiDD;EA/Cd,OAAA,EAAS,aAAA;EA+CK;;;;;;AAAgE;;EAtC9E,OAAA,IAAW,MAAA,cAAoB,YAAA;;;;;EAK/B,QAAA,IAAY,IAAA,EAAM,MAAA;;EAElB,QAAA,IAAY,MAAA,EAAQ,OAAA,CAAQ,UAAA,QAAkB,MAAA;;EAE9C,GAAA;AAAA;;;;;;;;;;;iBA0Bc,qBAAA,CAAsB,OAAA,EAAS,sBAAA;EAG/B,OAAA;EAAA;AAAA,GAAqB,wBAAA,KAA2B,OAAA,CAAQ,QAAA"}
+{"version":3,"file":"conversion.d.mts","names":[],"sources":["../../src/routes/conversion.ts"],"mappings":";;;AAsPA;;AAAA,UAjLiB,wBAAA;EACf,OAAA,EAAS,OAAO;EAChB,MAAA;AAAA;;;;;;UAQe,cAAA;EACf,GAAA,CAAI,EAAA,UAAY,EAAA,WAAa,OAAO;AAAA;AAAA,UAkBrB,sBAAA;EA4KD;EA1Kd,OAAA,EAAS,aAAA;EA0K0B;;;;AAA2C;;;;EAjK9E,OAAA,IAAW,MAAA,cAAoB,YAAA;;;;;EAK/B,QAAA,IAAY,IAAA,EAAM,MAAA;;EAElB,QAAA,IAAY,MAAA,EAAQ,OAAA,CAAQ,UAAA,QAAkB,MAAA;;EAE9C,GAAA;;;;;;;EAOA,UAAA;;;;;;EAMA,eAAA;;;;;;;;;;EAUA,cAAA;;;;;;;EAOA,YAAA;;;;;;;;;;;EAWA,aAAA;;;;;;;EAOA,SAAA;IAAc,QAAA;IAAmB,KAAA,GAAQ,cAAA;EAAA;;;;;;;EAOzC,SAAA;IACE,SAAA;;;IAGA,SAAA;;;;;;;;;IASA,QAAA;EAAA;AAAA;;;;;;;;;;;;;;iBA4DY,qBAAA,CAAsB,OAAA,EAAS,sBAAA;EAwB/B,OAAA;EAAA;AAAA,GAAqB,wBAAA,KAA2B,OAAA,CAAQ,QAAA"}

package/dist/routes/conversion.mjs

@@ -1,4 +1,5 @@
 import { notify } from "@getvitops/utils/notify";
+import { verifyTurnstileToken } from "@getvitops/utils/security";
 import { parseTrackingCookie } from "@getvitops/utils/tracking";
 
 //#region src/routes/conversion.ts
@@ -10,11 +11,14 @@ import { parseTrackingCookie } from "@getvitops/utils/tracking";
 * off the request, build the event, notify whoever the config says. That is the
 * same three lines in every project, so it ships here.
 *
-* What deliberately does **not** ship here is validation and business rules. A
-* consumer's form has its own required fields, its own spam handling and its own
-* response shape, and baking a guess at those in would make the factory something
-* to fight rather than mount. The handler takes the parsed body and an optional
-* `validate`; everything else is the caller's.
+* What deliberately does **not** ship here is field-level validation and business
+* rules — a consumer's form has its own required fields and its own response
+* shape, and baking a guess at those in would make the factory something to
+* fight rather than mount. The handler takes the parsed body and an optional
+* `validate`; that part is the caller's. What **does** ship here is generic abuse
+* resistance (honeypot, origin, rate limit, body size): this is a public,
+* unauthenticated endpoint that sends email, so leaving it wide open makes it a
+* relay and a cost amplifier regardless of whose form is behind it.
 *
 * The path matters: the capture script beacons `tel:` conversions at
 * `TRACKING_ENDPOINT` (`/api/track`, exported from `@getvitops/astro/tracking`),
@@ -34,9 +38,24 @@ import { parseTrackingCookie } from "@getvitops/utils/tracking";
 *     organizationName: 'Acme',
 *   },
 *   binding: () => env.EMAIL,
+*   // A no-JS <form method="post"> submission never sees a JSON response body —
+*   // it's a full navigation, so send it somewhere real.
+*   redirectTo: '/thanks',
 * });
 * ```
 *
+* Cloudflare Turnstile is a separate, opt-in layer on top of the checks above —
+* pass `turnstile: { secretKey }` and a submission carrying a
+* `cf-turnstile-response` token gets it verified server-side via
+* `verifyTurnstileToken` (`@getvitops/utils/security`). The widget itself is the
+* consumer's own markup (`<script src="https://challenges.cloudflare.com/
+* turnstile/v0/api.js" async defer><\/script>` + `<div class="cf-turnstile"
+* data-sitekey="…">` on their form) — there is no `FormRenderer` for this to hook
+* into generically, matching how the rest of the form is already hand-written.
+* `site.security.turnstile.siteKey` is what the generated privacy policy reads to
+* name Turnstile as a processor; wiring this option up is what makes that true
+* rather than an assertion nothing checks.
+*
 * Two things this example used to get wrong, both of which cost a consumer real
 * time. It read the binding off `locals.runtime.env`, which Astro removed in v6
 * — and because the resulting throw precedes the response, Astro re-reads the
@@ -46,65 +65,154 @@ import { parseTrackingCookie } from "@getvitops/utils/tracking";
 * current one. It also called a `toNotifyContext(config)` helper that does not
 * exist — `context` is a plain `NotifyContext`, built however you like.
 */
-/** Fields that are never part of a submission's meaning. */
-const CONTROL_FIELDS = new Set(["event", "phone"]);
-function toFormData(body) {
+/**
+* Per-isolate, in-memory default. Good enough for a single Worker instance
+* fielding occasional contact-form spam; not durable across a fleet, and not
+* shared with other routes. Inject a KV- or Durable-Object-backed `store` for
+* real cross-instance limiting — the interface is one method wide on purpose.
+*/
+var MemoryRateLimitStore = class {
+	lastHit = /* @__PURE__ */ new Map();
+	hit(id, at) {
+		const prev = this.lastHit.get(id);
+		this.lastHit.set(id, at);
+		return prev === void 0 ? null : at - prev;
+	}
+};
+/** Fields that are never part of a submission's meaning. `cf-turnstile-response`
+* is excluded unconditionally, matching `render.ts`'s `OMIT_FIELDS` — the field
+* carries a verification token, not something the visitor wrote. */
+const CONTROL_FIELDS = new Set([
+	"event",
+	"phone",
+	"cf-turnstile-response"
+]);
+const DEFAULT_HONEYPOT_FIELDS = [
+	"website",
+	"_honeypot",
+	"honeypot"
+];
+const DEFAULT_MAX_BODY_BYTES = 25e3;
+const DEFAULT_RATE_LIMIT_WINDOW_MS = 1e4;
+function toFormData(body, honeypotFields) {
 	const out = {};
 	for (const [key, value] of Object.entries(body)) {
-		if (CONTROL_FIELDS.has(key)) continue;
+		if (CONTROL_FIELDS.has(key) || honeypotFields.includes(key)) continue;
 		if (value === void 0 || value === null) continue;
 		out[key] = String(value);
 	}
 	return out;
 }
+function hasHoneypot(body, honeypotFields) {
+	return honeypotFields.some((field) => {
+		const value = body[field];
+		return typeof value === "string" && value.trim() !== "";
+	});
+}
+function originOf(url) {
+	if (!url) return null;
+	try {
+		return new URL(url).origin;
+	} catch {
+		return null;
+	}
+}
+/** A `Location` header response — used for the no-JS form path instead of
+* `Response.redirect()`, which requires a base URL this factory doesn't have. */
+function redirectTo(location, status = 303) {
+	return new Response(null, {
+		status,
+		headers: { Location: location }
+	});
+}
 /**
 * Build a POST handler for conversions.
 *
-* Returns 204 for a beacon and 200 with `{ success }` for a form, matching what
-* `navigator.sendBeacon` and a fetch-submitting form each expect.
+* Returns 204 for a beacon and 200 with `{ success }` for a JSON (fetch-based)
+* form submission, matching what `navigator.sendBeacon` and a fetch-submitting
+* form each expect. A no-JS `<form method="post">` — `application/
+* x-www-form-urlencoded` or `multipart/form-data` — is parsed the same way and,
+* on success, redirected to `redirectTo` if one is configured.
 *
 * **A failed notification does not fail the request.** The visitor has already
 * submitted; refusing them because our mail did not go out turns a lost
 * notification into a lost conversion. Failures are reported through `onResult`.
 */
 function createConversionRoute(options) {
-	const { context, binding, validate, onResult, now = Date.now } = options;
+	const { context, binding, validate, onResult, now = Date.now, redirectTo: successRedirect, errorRedirectTo = successRedirect, honeypotFields = DEFAULT_HONEYPOT_FIELDS, maxBodyBytes = DEFAULT_MAX_BODY_BYTES } = options;
+	const allowedOrigin = options.allowedOrigin === false ? null : options.allowedOrigin ?? originOf(context.canonical);
+	const rateLimit = options.rateLimit === false ? null : {
+		windowMs: options.rateLimit?.windowMs ?? DEFAULT_RATE_LIMIT_WINDOW_MS,
+		store: options.rateLimit?.store ?? new MemoryRateLimitStore()
+	};
 	return async ({ request, locals }) => {
+		const contentType = request.headers.get("content-type") ?? "";
+		const isFormPost = contentType.includes("multipart/form-data") || contentType.includes("application/x-www-form-urlencoded");
+		const respondError = (error, status) => isFormPost && errorRedirectTo ? redirectTo(errorRedirectTo) : Response.json({
+			success: false,
+			error
+		}, { status });
+		if (Number(request.headers.get("content-length") ?? 0) > maxBodyBytes) return respondError("Request too large.", 413);
+		if (allowedOrigin) {
+			const requestOrigin = request.headers.get("origin");
+			if (requestOrigin && requestOrigin !== allowedOrigin) return respondError("Origin not allowed.", 403);
+		}
 		let body;
 		try {
-			const parsed = await request.json();
-			if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return Response.json({
-				success: false,
-				error: "Malformed request."
-			}, { status: 400 });
-			body = parsed;
+			if (isFormPost) {
+				const formData = await request.formData();
+				body = {};
+				for (const [key, value] of formData.entries()) if (typeof value === "string") body[key] = value;
+			} else {
+				const parsed = await request.json();
+				if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return respondError("Malformed request.", 400);
+				body = parsed;
+			}
 		} catch {
-			return Response.json({
-				success: false,
-				error: "Malformed request."
-			}, { status: 400 });
+			return respondError("Malformed request.", 400);
+		}
+		const ip = request.headers.get("cf-connecting-ip") ?? request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? void 0;
+		if (rateLimit && ip) {
+			const sinceLastHit = await rateLimit.store.hit(ip, now());
+			if (sinceLastHit !== null && sinceLastHit < rateLimit.windowMs) return respondError("Too many requests.", 429);
 		}
 		const isCall = body["event"] === "call";
-		if (isCall && typeof body["phone"] !== "string") return Response.json({
-			success: false,
-			error: "Missing phone."
-		}, { status: 400 });
-		const refusal = validate?.(body);
-		if (refusal) return Response.json({
-			success: false,
-			error: refusal
-		}, { status: 400 });
+		if (isCall && typeof body["phone"] !== "string") return respondError("Missing phone.", 400);
+		const spam = !isCall && hasHoneypot(body, honeypotFields);
+		if (!isCall && !spam && options.turnstile) {
+			const { secretKey, fieldName = "cf-turnstile-response", required = false } = options.turnstile;
+			const token = body[fieldName];
+			if (typeof token === "string" && token) {
+				if (!(await verifyTurnstileToken(token, secretKey, ip)).success) return respondError("Verification failed.", 400);
+			} else if (required) return respondError("Verification required.", 400);
+		}
+		const refusal = !spam && validate?.(body);
+		if (refusal) return respondError(refusal, 400);
+		const respondSuccess = () => isCall ? new Response(null, { status: 204 }) : isFormPost && successRedirect ? redirectTo(successRedirect) : Response.json({ success: true });
+		if (spam) {
+			onResult?.({
+				results: [{
+					channel: "email",
+					sent: false,
+					reason: "Skipped: honeypot triggered."
+				}],
+				delivered: false
+			});
+			return respondSuccess();
+		}
+		const turnstileFieldName = options.turnstile?.fieldName;
+		const excludedFields = turnstileFieldName ? [...honeypotFields, turnstileFieldName] : honeypotFields;
 		const result = await notify({
 			type: isCall ? "call" : "form",
-			...isCall ? { phone: String(body["phone"]).replace(/^tel:/, "") } : { formData: toFormData(body) },
+			...isCall ? { phone: String(body["phone"]).replace(/^tel:/, "") } : { formData: toFormData(body, excludedFields) },
 			tracking: parseTrackingCookie(request.headers.get("cookie")),
 			userAgent: request.headers.get("user-agent") ?? void 0,
-			ip: request.headers.get("cf-connecting-ip") ?? request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? void 0,
+			ip,
 			at: now()
 		}, context, { email: binding?.(locals) });
 		if (onResult) onResult(result);
 		else for (const r of result.results) if (!r.sent) console.warn(`[vitops] notification not sent (${r.channel}): ${r.reason}`);
-		return isCall ? new Response(null, { status: 204 }) : Response.json({ success: true });
+		return respondSuccess();
 	};
 }
 

package/dist/routes/conversion.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"conversion.mjs","names":[],"sources":["../../src/routes/conversion.ts"],"sourcesContent":["/**\n * The conversion endpoint, as a factory.\n *\n * A site's contact form and its `tel:` beacon both mean the same thing — someone\n * got in touch — and both want the same treatment: read the attribution cookie\n * off the request, build the event, notify whoever the config says. That is the\n * same three lines in every project, so it ships here.\n *\n * What deliberately does **not** ship here is validation and business rules. A\n * consumer's form has its own required fields, its own spam handling and its own\n * response shape, and baking a guess at those in would make the factory something\n * to fight rather than mount. The handler takes the parsed body and an optional\n * `validate`; everything else is the caller's.\n *\n * The path matters: the capture script beacons `tel:` conversions at\n * `TRACKING_ENDPOINT` (`/api/track`, exported from `@getvitops/astro/tracking`),\n * and the integration warns at build if no route answers it.\n *\n * ```ts\n * // src/pages/api/track.ts\n * export const prerender = false;\n * import { env } from 'cloudflare:workers';\n * import { createConversionRoute } from '@getvitops/astro/routes';\n *\n * export const POST = createConversionRoute({\n *   context: {\n *     // A bare address is shorthand for `{ provider: 'cloudflare', to }`.\n *     notifications: { email: 'sales@acme.ca' },\n *     canonical: 'https://acme.ca',\n *     organizationName: 'Acme',\n *   },\n *   binding: () => env.EMAIL,\n * });\n * ```\n *\n * Two things this example used to get wrong, both of which cost a consumer real\n * time. It read the binding off `locals.runtime.env`, which Astro removed in v6\n * — and because the resulting throw precedes the response, Astro re-reads the\n * request and reports a misleading \"Body has already been used\" instead of the\n * actual error. This package peers on `astro >= 7`, so that form could not work\n * for any supported consumer; `import { env } from 'cloudflare:workers'` is the\n * current one. It also called a `toNotifyContext(config)` helper that does not\n * exist — `context` is a plain `NotifyContext`, built however you like.\n */\nimport { type EmailBinding, notify, type NotifyContext } from '@getvitops/utils/notify';\nimport { parseTrackingCookie } from '@getvitops/utils/tracking';\nimport type { ConversionEvent } from '@getvitops/utils/tracking';\n\n/** The subset of Astro's `APIContext` this needs — typed structurally so the\n * factory does not pin an Astro version. */\nexport interface ConversionRequestContext {\n  request: Request;\n  locals?: unknown;\n}\n\nexport interface ConversionRouteOptions {\n  /** Where notifications go. Build it from your site config. */\n  context: NotifyContext;\n  /**\n   * The Workers `send_email` binding for this request, e.g. `() => env.EMAIL`\n   * with `env` imported from `cloudflare:workers`. Omit it in dev and the\n   * notification is printed instead of sent.\n   *\n   * Not `(locals) => locals.runtime.env.EMAIL` — Astro removed `locals.runtime`\n   * in v6, and this package peers on `>= 7`.\n   */\n  binding?: (locals: unknown) => EmailBinding | undefined;\n  /**\n   * Reject a submission before anything is sent. Return a message to refuse.\n   * This is where a consumer puts required-field checks and spam rules.\n   */\n  validate?: (body: Record<string, unknown>) => string | null;\n  /** Called with every channel outcome, delivered or not. Defaults to console. */\n  onResult?: (result: Awaited<ReturnType<typeof notify>>) => void;\n  /** Injected in tests. */\n  now?: () => number;\n}\n\n/** Fields that are never part of a submission's meaning. */\nconst CONTROL_FIELDS = new Set(['event', 'phone']);\n\nfunction toFormData(body: Record<string, unknown>): Record<string, string> {\n  const out: Record<string, string> = {};\n  for (const [key, value] of Object.entries(body)) {\n    if (CONTROL_FIELDS.has(key)) continue;\n    if (value === undefined || value === null) continue;\n    out[key] = String(value);\n  }\n  return out;\n}\n\n/**\n * Build a POST handler for conversions.\n *\n * Returns 204 for a beacon and 200 with `{ success }` for a form, matching what\n * `navigator.sendBeacon` and a fetch-submitting form each expect.\n *\n * **A failed notification does not fail the request.** The visitor has already\n * submitted; refusing them because our mail did not go out turns a lost\n * notification into a lost conversion. Failures are reported through `onResult`.\n */\nexport function createConversionRoute(options: ConversionRouteOptions) {\n  const { context, binding, validate, onResult, now = Date.now } = options;\n\n  return async ({ request, locals }: ConversionRequestContext): Promise<Response> => {\n    let body: Record<string, unknown>;\n    try {\n      const parsed: unknown = await request.json();\n      if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {\n        return Response.json({ success: false, error: 'Malformed request.' }, { status: 400 });\n      }\n      body = parsed as Record<string, unknown>;\n    } catch {\n      return Response.json({ success: false, error: 'Malformed request.' }, { status: 400 });\n    }\n\n    const isCall = body['event'] === 'call';\n    if (isCall && typeof body['phone'] !== 'string') {\n      return Response.json({ success: false, error: 'Missing phone.' }, { status: 400 });\n    }\n\n    const refusal = validate?.(body);\n    if (refusal) return Response.json({ success: false, error: refusal }, { status: 400 });\n\n    const event: ConversionEvent = {\n      type: isCall ? 'call' : 'form',\n      ...(isCall\n        ? { phone: String(body['phone']).replace(/^tel:/, '') }\n        : { formData: toFormData(body) }),\n      tracking: parseTrackingCookie(request.headers.get('cookie')),\n      userAgent: request.headers.get('user-agent') ?? undefined,\n      // Cloudflare's own header first; `x-forwarded-for` is the portable fallback\n      // and may carry a proxy chain, whose first entry is the client.\n      ip:\n        request.headers.get('cf-connecting-ip') ??\n        request.headers.get('x-forwarded-for')?.split(',')[0]?.trim() ??\n        undefined,\n      at: now(),\n    };\n\n    const result = await notify(event, context, { email: binding?.(locals) });\n\n    if (onResult) onResult(result);\n    else\n      for (const r of result.results) {\n        if (!r.sent) console.warn(`[vitops] notification not sent (${r.channel}): ${r.reason}`);\n      }\n\n    return isCall ? new Response(null, { status: 204 }) : Response.json({ success: true });\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+EA,MAAM,iBAAiB,IAAI,IAAI,CAAC,SAAS,OAAO,CAAC;AAEjD,SAAS,WAAW,MAAuD;CACzE,MAAM,MAA8B,CAAC;CACrC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,IAAI,GAAG;EAC/C,IAAI,eAAe,IAAI,GAAG,GAAG;EAC7B,IAAI,UAAU,UAAa,UAAU,MAAM;EAC3C,IAAI,OAAO,OAAO,KAAK;CACzB;CACA,OAAO;AACT;;;;;;;;;;;AAYA,SAAgB,sBAAsB,SAAiC;CACrE,MAAM,EAAE,SAAS,SAAS,UAAU,UAAU,MAAM,KAAK,QAAQ;CAEjE,OAAO,OAAO,EAAE,SAAS,aAA0D;EACjF,IAAI;EACJ,IAAI;GACF,MAAM,SAAkB,MAAM,QAAQ,KAAK;GAC3C,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,MAAM,QAAQ,MAAM,GACvE,OAAO,SAAS,KAAK;IAAE,SAAS;IAAO,OAAO;GAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;GAEvF,OAAO;EACT,QAAQ;GACN,OAAO,SAAS,KAAK;IAAE,SAAS;IAAO,OAAO;GAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;EACvF;EAEA,MAAM,SAAS,KAAK,aAAa;EACjC,IAAI,UAAU,OAAO,KAAK,aAAa,UACrC,OAAO,SAAS,KAAK;GAAE,SAAS;GAAO,OAAO;EAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;EAGnF,MAAM,UAAU,WAAW,IAAI;EAC/B,IAAI,SAAS,OAAO,SAAS,KAAK;GAAE,SAAS;GAAO,OAAO;EAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;EAkBrF,MAAM,SAAS,MAAM,OAAO;GAf1B,MAAM,SAAS,SAAS;GACxB,GAAI,SACA,EAAE,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,QAAQ,SAAS,EAAE,EAAE,IACpD,EAAE,UAAU,WAAW,IAAI,EAAE;GACjC,UAAU,oBAAoB,QAAQ,QAAQ,IAAI,QAAQ,CAAC;GAC3D,WAAW,QAAQ,QAAQ,IAAI,YAAY,KAAK;GAGhD,IACE,QAAQ,QAAQ,IAAI,kBAAkB,KACtC,QAAQ,QAAQ,IAAI,iBAAiB,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,KAC5D;GACF,IAAI,IAAI;EAGsB,GAAG,SAAS,EAAE,OAAO,UAAU,MAAM,EAAE,CAAC;EAExE,IAAI,UAAU,SAAS,MAAM;OAE3B,KAAK,MAAM,KAAK,OAAO,SACrB,IAAI,CAAC,EAAE,MAAM,QAAQ,KAAK,mCAAmC,EAAE,QAAQ,KAAK,EAAE,QAAQ;EAG1F,OAAO,SAAS,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC,IAAI,SAAS,KAAK,EAAE,SAAS,KAAK,CAAC;CACvF;AACF"}
+{"version":3,"file":"conversion.mjs","names":[],"sources":["../../src/routes/conversion.ts"],"sourcesContent":["/**\n * The conversion endpoint, as a factory.\n *\n * A site's contact form and its `tel:` beacon both mean the same thing — someone\n * got in touch — and both want the same treatment: read the attribution cookie\n * off the request, build the event, notify whoever the config says. That is the\n * same three lines in every project, so it ships here.\n *\n * What deliberately does **not** ship here is field-level validation and business\n * rules — a consumer's form has its own required fields and its own response\n * shape, and baking a guess at those in would make the factory something to\n * fight rather than mount. The handler takes the parsed body and an optional\n * `validate`; that part is the caller's. What **does** ship here is generic abuse\n * resistance (honeypot, origin, rate limit, body size): this is a public,\n * unauthenticated endpoint that sends email, so leaving it wide open makes it a\n * relay and a cost amplifier regardless of whose form is behind it.\n *\n * The path matters: the capture script beacons `tel:` conversions at\n * `TRACKING_ENDPOINT` (`/api/track`, exported from `@getvitops/astro/tracking`),\n * and the integration warns at build if no route answers it.\n *\n * ```ts\n * // src/pages/api/track.ts\n * export const prerender = false;\n * import { env } from 'cloudflare:workers';\n * import { createConversionRoute } from '@getvitops/astro/routes';\n *\n * export const POST = createConversionRoute({\n *   context: {\n *     // A bare address is shorthand for `{ provider: 'cloudflare', to }`.\n *     notifications: { email: 'sales@acme.ca' },\n *     canonical: 'https://acme.ca',\n *     organizationName: 'Acme',\n *   },\n *   binding: () => env.EMAIL,\n *   // A no-JS <form method=\"post\"> submission never sees a JSON response body —\n *   // it's a full navigation, so send it somewhere real.\n *   redirectTo: '/thanks',\n * });\n * ```\n *\n * Cloudflare Turnstile is a separate, opt-in layer on top of the checks above —\n * pass `turnstile: { secretKey }` and a submission carrying a\n * `cf-turnstile-response` token gets it verified server-side via\n * `verifyTurnstileToken` (`@getvitops/utils/security`). The widget itself is the\n * consumer's own markup (`<script src=\"https://challenges.cloudflare.com/\n * turnstile/v0/api.js\" async defer></script>` + `<div class=\"cf-turnstile\"\n * data-sitekey=\"…\">` on their form) — there is no `FormRenderer` for this to hook\n * into generically, matching how the rest of the form is already hand-written.\n * `site.security.turnstile.siteKey` is what the generated privacy policy reads to\n * name Turnstile as a processor; wiring this option up is what makes that true\n * rather than an assertion nothing checks.\n *\n * Two things this example used to get wrong, both of which cost a consumer real\n * time. It read the binding off `locals.runtime.env`, which Astro removed in v6\n * — and because the resulting throw precedes the response, Astro re-reads the\n * request and reports a misleading \"Body has already been used\" instead of the\n * actual error. This package peers on `astro >= 7`, so that form could not work\n * for any supported consumer; `import { env } from 'cloudflare:workers'` is the\n * current one. It also called a `toNotifyContext(config)` helper that does not\n * exist — `context` is a plain `NotifyContext`, built however you like.\n */\nimport { type EmailBinding, notify, type NotifyContext } from '@getvitops/utils/notify';\nimport { verifyTurnstileToken } from '@getvitops/utils/security';\nimport { parseTrackingCookie } from '@getvitops/utils/tracking';\nimport type { ConversionEvent } from '@getvitops/utils/tracking';\n\n/** The subset of Astro's `APIContext` this needs — typed structurally so the\n * factory does not pin an Astro version. */\nexport interface ConversionRequestContext {\n  request: Request;\n  locals?: unknown;\n}\n\n/**\n * Records a hit for `id` at time `at` (ms) and returns the ms since the previous\n * hit for that `id`, or `null` if this is the first. Pure interface — a store\n * decides nothing, it only remembers.\n */\nexport interface RateLimitStore {\n  hit(id: string, at: number): Promise<number | null> | number | null;\n}\n\n/**\n * Per-isolate, in-memory default. Good enough for a single Worker instance\n * fielding occasional contact-form spam; not durable across a fleet, and not\n * shared with other routes. Inject a KV- or Durable-Object-backed `store` for\n * real cross-instance limiting — the interface is one method wide on purpose.\n */\nclass MemoryRateLimitStore implements RateLimitStore {\n  private lastHit = new Map<string, number>();\n  hit(id: string, at: number): number | null {\n    const prev = this.lastHit.get(id);\n    this.lastHit.set(id, at);\n    return prev === undefined ? null : at - prev;\n  }\n}\n\nexport interface ConversionRouteOptions {\n  /** Where notifications go. Build it from your site config. */\n  context: NotifyContext;\n  /**\n   * The Workers `send_email` binding for this request, e.g. `() => env.EMAIL`\n   * with `env` imported from `cloudflare:workers`. Omit it in dev and the\n   * notification is printed instead of sent.\n   *\n   * Not `(locals) => locals.runtime.env.EMAIL` — Astro removed `locals.runtime`\n   * in v6, and this package peers on `>= 7`.\n   */\n  binding?: (locals: unknown) => EmailBinding | undefined;\n  /**\n   * Reject a submission before anything is sent. Return a message to refuse.\n   * This is where a consumer puts required-field checks.\n   */\n  validate?: (body: Record<string, unknown>) => string | null;\n  /** Called with every channel outcome, delivered or not. Defaults to console. */\n  onResult?: (result: Awaited<ReturnType<typeof notify>>) => void;\n  /** Injected in tests. */\n  now?: () => number;\n  /**\n   * Where to send a no-JS `<form method=\"post\">` submission on success. Without\n   * this, that visitor's browser navigates to the raw `{\"success\":true}` JSON\n   * body as its next page — functional, but not a page anyone should see. Has\n   * no effect on the beacon/fetch (JSON) path, which always gets a JSON response.\n   */\n  redirectTo?: string;\n  /**\n   * Where to send a refused no-JS submission (validation, spam checks, malformed\n   * body). Falls back to `redirectTo` if omitted, and to the JSON error response\n   * if neither is set.\n   */\n  errorRedirectTo?: string;\n  /**\n   * Field names treated as honeypots: a bot fills every input it finds, a person\n   * never sees these (hidden by CSS in the form markup). A non-empty value is\n   * silently treated as spam — the response looks identical to a real success,\n   * denying the bot the signal it needs to know the trick worked, but nothing is\n   * notified and the field never reaches `notify()`. Defaults to the same names\n   * `render.ts`'s `OMIT_FIELDS` already knows about (`website`, `_honeypot`,\n   * `honeypot`), so the two lists don't need to be kept in sync by hand.\n   */\n  honeypotFields?: string[];\n  /**\n   * Reject a submission whose `Content-Length` exceeds this many bytes. Default\n   * 25_000 — generous for a contact form with no file upload, tiny for anything\n   * meant to relay large payloads. Best-effort: `Content-Length` can be absent\n   * or spoofed, same caveat as the origin check below.\n   */\n  maxBodyBytes?: number;\n  /**\n   * Reject a submission whose `Origin` header doesn't match this origin.\n   * Defaults to `context.canonical`'s origin. Pass `false` to disable.\n   *\n   * Best-effort, not a CSRF guard: browsers omit `Origin` on plenty of\n   * legitimate same-origin requests, so its *absence* is never treated as a\n   * mismatch — only a present-and-different value is rejected. That still stops\n   * the common case (a script hitting the endpoint directly from elsewhere)\n   * without breaking real submissions from older or privacy-hardened browsers.\n   */\n  allowedOrigin?: string | false;\n  /**\n   * Minimum interval between accepted submissions from the same IP. Pass\n   * `false` to disable. `windowMs` defaults to 10 seconds — enough to blunt a\n   * script firing in a loop without troubling someone who fat-fingers a form\n   * and resubmits.\n   */\n  rateLimit?: { windowMs?: number; store?: RateLimitStore } | false;\n  /**\n   * Verify a Cloudflare Turnstile token server-side. The **secret** key —\n   * unlike `site.security.turnstile.siteKey`, which is public config — must come\n   * from an env var, never a config file (the same rule as every other\n   * credential in this toolchain).\n   */\n  turnstile?: {\n    secretKey: string;\n    /** The submitted field carrying the token. Default `cf-turnstile-response`\n     * — the name Cloudflare's widget submits under. */\n    fieldName?: string;\n    /**\n     * Reject a submission with no token at all, rather than only a present-and-\n     * invalid one. Default `false`: an absent token is the ordinary shape of a\n     * visitor with JS disabled, and this factory is built around that path\n     * staying usable. Set `true` only for a form where verified-human matters\n     * enough to accept that trade-off — doing so means that form no longer\n     * works without JS, on purpose.\n     */\n    required?: boolean;\n  };\n}\n\n/** Fields that are never part of a submission's meaning. `cf-turnstile-response`\n * is excluded unconditionally, matching `render.ts`'s `OMIT_FIELDS` — the field\n * carries a verification token, not something the visitor wrote. */\nconst CONTROL_FIELDS = new Set(['event', 'phone', 'cf-turnstile-response']);\nconst DEFAULT_HONEYPOT_FIELDS = ['website', '_honeypot', 'honeypot'];\nconst DEFAULT_MAX_BODY_BYTES = 25_000;\nconst DEFAULT_RATE_LIMIT_WINDOW_MS = 10_000;\n\nfunction toFormData(\n  body: Record<string, unknown>,\n  honeypotFields: string[],\n): Record<string, string> {\n  const out: Record<string, string> = {};\n  for (const [key, value] of Object.entries(body)) {\n    if (CONTROL_FIELDS.has(key) || honeypotFields.includes(key)) continue;\n    if (value === undefined || value === null) continue;\n    out[key] = String(value);\n  }\n  return out;\n}\n\nfunction hasHoneypot(body: Record<string, unknown>, honeypotFields: string[]): boolean {\n  return honeypotFields.some((field) => {\n    const value = body[field];\n    return typeof value === 'string' && value.trim() !== '';\n  });\n}\n\nfunction originOf(url: string | undefined): string | null {\n  if (!url) return null;\n  try {\n    return new URL(url).origin;\n  } catch {\n    return null;\n  }\n}\n\n/** A `Location` header response — used for the no-JS form path instead of\n * `Response.redirect()`, which requires a base URL this factory doesn't have. */\nfunction redirectTo(location: string, status = 303): Response {\n  return new Response(null, { status, headers: { Location: location } });\n}\n\n/**\n * Build a POST handler for conversions.\n *\n * Returns 204 for a beacon and 200 with `{ success }` for a JSON (fetch-based)\n * form submission, matching what `navigator.sendBeacon` and a fetch-submitting\n * form each expect. A no-JS `<form method=\"post\">` — `application/\n * x-www-form-urlencoded` or `multipart/form-data` — is parsed the same way and,\n * on success, redirected to `redirectTo` if one is configured.\n *\n * **A failed notification does not fail the request.** The visitor has already\n * submitted; refusing them because our mail did not go out turns a lost\n * notification into a lost conversion. Failures are reported through `onResult`.\n */\nexport function createConversionRoute(options: ConversionRouteOptions) {\n  const {\n    context,\n    binding,\n    validate,\n    onResult,\n    now = Date.now,\n    redirectTo: successRedirect,\n    errorRedirectTo = successRedirect,\n    honeypotFields = DEFAULT_HONEYPOT_FIELDS,\n    maxBodyBytes = DEFAULT_MAX_BODY_BYTES,\n  } = options;\n\n  const allowedOrigin =\n    options.allowedOrigin === false ? null : (options.allowedOrigin ?? originOf(context.canonical));\n\n  const rateLimit =\n    options.rateLimit === false\n      ? null\n      : {\n          windowMs: options.rateLimit?.windowMs ?? DEFAULT_RATE_LIMIT_WINDOW_MS,\n          store: options.rateLimit?.store ?? new MemoryRateLimitStore(),\n        };\n\n  return async ({ request, locals }: ConversionRequestContext): Promise<Response> => {\n    const contentType = request.headers.get('content-type') ?? '';\n    const isFormPost =\n      contentType.includes('multipart/form-data') ||\n      contentType.includes('application/x-www-form-urlencoded');\n\n    const respondError = (error: string, status: number): Response =>\n      isFormPost && errorRedirectTo\n        ? redirectTo(errorRedirectTo)\n        : Response.json({ success: false, error }, { status });\n\n    const contentLength = Number(request.headers.get('content-length') ?? 0);\n    if (contentLength > maxBodyBytes) {\n      return respondError('Request too large.', 413);\n    }\n\n    if (allowedOrigin) {\n      const requestOrigin = request.headers.get('origin');\n      if (requestOrigin && requestOrigin !== allowedOrigin) {\n        return respondError('Origin not allowed.', 403);\n      }\n    }\n\n    let body: Record<string, unknown>;\n    try {\n      if (isFormPost) {\n        const formData = await request.formData();\n        body = {};\n        for (const [key, value] of formData.entries()) {\n          if (typeof value === 'string') body[key] = value;\n        }\n      } else {\n        // Not just `application/json`: `navigator.sendBeacon` sends a bare\n        // string as `text/plain`, and this must keep accepting that body.\n        const parsed: unknown = await request.json();\n        if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {\n          return respondError('Malformed request.', 400);\n        }\n        body = parsed as Record<string, unknown>;\n      }\n    } catch {\n      return respondError('Malformed request.', 400);\n    }\n\n    const ip =\n      request.headers.get('cf-connecting-ip') ??\n      request.headers.get('x-forwarded-for')?.split(',')[0]?.trim() ??\n      undefined;\n\n    if (rateLimit && ip) {\n      const sinceLastHit = await rateLimit.store.hit(ip, now());\n      if (sinceLastHit !== null && sinceLastHit < rateLimit.windowMs) {\n        return respondError('Too many requests.', 429);\n      }\n    }\n\n    const isCall = body['event'] === 'call';\n    if (isCall && typeof body['phone'] !== 'string') {\n      return respondError('Missing phone.', 400);\n    }\n\n    const spam = !isCall && hasHoneypot(body, honeypotFields);\n\n    if (!isCall && !spam && options.turnstile) {\n      const {\n        secretKey,\n        fieldName = 'cf-turnstile-response',\n        required = false,\n      } = options.turnstile;\n      const token = body[fieldName];\n      if (typeof token === 'string' && token) {\n        const verification = await verifyTurnstileToken(token, secretKey, ip);\n        if (!verification.success) return respondError('Verification failed.', 400);\n      } else if (required) {\n        return respondError('Verification required.', 400);\n      }\n    }\n\n    const refusal = !spam && validate?.(body);\n    if (refusal) return respondError(refusal, 400);\n\n    const respondSuccess = (): Response =>\n      isCall\n        ? new Response(null, { status: 204 })\n        : isFormPost && successRedirect\n          ? redirectTo(successRedirect)\n          : Response.json({ success: true });\n\n    // A honeypot trip never reaches `notify()` — the response is identical to a\n    // real success, so a bot gets no signal that it was caught.\n    if (spam) {\n      onResult?.({\n        results: [{ channel: 'email', sent: false, reason: 'Skipped: honeypot triggered.' }],\n        delivered: false,\n      });\n      return respondSuccess();\n    }\n\n    const turnstileFieldName = options.turnstile?.fieldName;\n    const excludedFields = turnstileFieldName\n      ? [...honeypotFields, turnstileFieldName]\n      : honeypotFields;\n\n    const event: ConversionEvent = {\n      type: isCall ? 'call' : 'form',\n      ...(isCall\n        ? { phone: String(body['phone']).replace(/^tel:/, '') }\n        : { formData: toFormData(body, excludedFields) }),\n      tracking: parseTrackingCookie(request.headers.get('cookie')),\n      userAgent: request.headers.get('user-agent') ?? undefined,\n      ip,\n      at: now(),\n    };\n\n    const result = await notify(event, context, { email: binding?.(locals) });\n\n    if (onResult) onResult(result);\n    else\n      for (const r of result.results) {\n        if (!r.sent) console.warn(`[vitops] notification not sent (${r.channel}): ${r.reason}`);\n      }\n\n    return respondSuccess();\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyFA,IAAM,uBAAN,MAAqD;CACnD,AAAQ,0BAAU,IAAI,IAAoB;CAC1C,IAAI,IAAY,IAA2B;EACzC,MAAM,OAAO,KAAK,QAAQ,IAAI,EAAE;EAChC,KAAK,QAAQ,IAAI,IAAI,EAAE;EACvB,OAAO,SAAS,SAAY,OAAO,KAAK;CAC1C;AACF;;;;AAiGA,MAAM,iBAAiB,IAAI,IAAI;CAAC;CAAS;CAAS;AAAuB,CAAC;AAC1E,MAAM,0BAA0B;CAAC;CAAW;CAAa;AAAU;AACnE,MAAM,yBAAyB;AAC/B,MAAM,+BAA+B;AAErC,SAAS,WACP,MACA,gBACwB;CACxB,MAAM,MAA8B,CAAC;CACrC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,IAAI,GAAG;EAC/C,IAAI,eAAe,IAAI,GAAG,KAAK,eAAe,SAAS,GAAG,GAAG;EAC7D,IAAI,UAAU,UAAa,UAAU,MAAM;EAC3C,IAAI,OAAO,OAAO,KAAK;CACzB;CACA,OAAO;AACT;AAEA,SAAS,YAAY,MAA+B,gBAAmC;CACrF,OAAO,eAAe,MAAM,UAAU;EACpC,MAAM,QAAQ,KAAK;EACnB,OAAO,OAAO,UAAU,YAAY,MAAM,KAAK,MAAM;CACvD,CAAC;AACH;AAEA,SAAS,SAAS,KAAwC;CACxD,IAAI,CAAC,KAAK,OAAO;CACjB,IAAI;EACF,OAAO,IAAI,IAAI,GAAG,CAAC,CAAC;CACtB,QAAQ;EACN,OAAO;CACT;AACF;;;AAIA,SAAS,WAAW,UAAkB,SAAS,KAAe;CAC5D,OAAO,IAAI,SAAS,MAAM;EAAE;EAAQ,SAAS,EAAE,UAAU,SAAS;CAAE,CAAC;AACvE;;;;;;;;;;;;;;AAeA,SAAgB,sBAAsB,SAAiC;CACrE,MAAM,EACJ,SACA,SACA,UACA,UACA,MAAM,KAAK,KACX,YAAY,iBACZ,kBAAkB,iBAClB,iBAAiB,yBACjB,eAAe,2BACb;CAEJ,MAAM,gBACJ,QAAQ,kBAAkB,QAAQ,OAAQ,QAAQ,iBAAiB,SAAS,QAAQ,SAAS;CAE/F,MAAM,YACJ,QAAQ,cAAc,QAClB,OACA;EACE,UAAU,QAAQ,WAAW,YAAY;EACzC,OAAO,QAAQ,WAAW,SAAS,IAAI,qBAAqB;CAC9D;CAEN,OAAO,OAAO,EAAE,SAAS,aAA0D;EACjF,MAAM,cAAc,QAAQ,QAAQ,IAAI,cAAc,KAAK;EAC3D,MAAM,aACJ,YAAY,SAAS,qBAAqB,KAC1C,YAAY,SAAS,mCAAmC;EAE1D,MAAM,gBAAgB,OAAe,WACnC,cAAc,kBACV,WAAW,eAAe,IAC1B,SAAS,KAAK;GAAE,SAAS;GAAO;EAAM,GAAG,EAAE,OAAO,CAAC;EAGzD,IADsB,OAAO,QAAQ,QAAQ,IAAI,gBAAgB,KAAK,CACtD,IAAI,cAClB,OAAO,aAAa,sBAAsB,GAAG;EAG/C,IAAI,eAAe;GACjB,MAAM,gBAAgB,QAAQ,QAAQ,IAAI,QAAQ;GAClD,IAAI,iBAAiB,kBAAkB,eACrC,OAAO,aAAa,uBAAuB,GAAG;EAElD;EAEA,IAAI;EACJ,IAAI;GACF,IAAI,YAAY;IACd,MAAM,WAAW,MAAM,QAAQ,SAAS;IACxC,OAAO,CAAC;IACR,KAAK,MAAM,CAAC,KAAK,UAAU,SAAS,QAAQ,GAC1C,IAAI,OAAO,UAAU,UAAU,KAAK,OAAO;GAE/C,OAAO;IAGL,MAAM,SAAkB,MAAM,QAAQ,KAAK;IAC3C,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,MAAM,QAAQ,MAAM,GACvE,OAAO,aAAa,sBAAsB,GAAG;IAE/C,OAAO;GACT;EACF,QAAQ;GACN,OAAO,aAAa,sBAAsB,GAAG;EAC/C;EAEA,MAAM,KACJ,QAAQ,QAAQ,IAAI,kBAAkB,KACtC,QAAQ,QAAQ,IAAI,iBAAiB,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,KAC5D;EAEF,IAAI,aAAa,IAAI;GACnB,MAAM,eAAe,MAAM,UAAU,MAAM,IAAI,IAAI,IAAI,CAAC;GACxD,IAAI,iBAAiB,QAAQ,eAAe,UAAU,UACpD,OAAO,aAAa,sBAAsB,GAAG;EAEjD;EAEA,MAAM,SAAS,KAAK,aAAa;EACjC,IAAI,UAAU,OAAO,KAAK,aAAa,UACrC,OAAO,aAAa,kBAAkB,GAAG;EAG3C,MAAM,OAAO,CAAC,UAAU,YAAY,MAAM,cAAc;EAExD,IAAI,CAAC,UAAU,CAAC,QAAQ,QAAQ,WAAW;GACzC,MAAM,EACJ,WACA,YAAY,yBACZ,WAAW,UACT,QAAQ;GACZ,MAAM,QAAQ,KAAK;GACnB,IAAI,OAAO,UAAU,YAAY,OAE/B;QAAI,EAAC,MADsB,qBAAqB,OAAO,WAAW,EAAE,EACnD,CAAC,SAAS,OAAO,aAAa,wBAAwB,GAAG;GAAC,OACtE,IAAI,UACT,OAAO,aAAa,0BAA0B,GAAG;EAErD;EAEA,MAAM,UAAU,CAAC,QAAQ,WAAW,IAAI;EACxC,IAAI,SAAS,OAAO,aAAa,SAAS,GAAG;EAE7C,MAAM,uBACJ,SACI,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC,IAClC,cAAc,kBACZ,WAAW,eAAe,IAC1B,SAAS,KAAK,EAAE,SAAS,KAAK,CAAC;EAIvC,IAAI,MAAM;GACR,WAAW;IACT,SAAS,CAAC;KAAE,SAAS;KAAS,MAAM;KAAO,QAAQ;IAA+B,CAAC;IACnF,WAAW;GACb,CAAC;GACD,OAAO,eAAe;EACxB;EAEA,MAAM,qBAAqB,QAAQ,WAAW;EAC9C,MAAM,iBAAiB,qBACnB,CAAC,GAAG,gBAAgB,kBAAkB,IACtC;EAaJ,MAAM,SAAS,MAAM,OAAO;GAV1B,MAAM,SAAS,SAAS;GACxB,GAAI,SACA,EAAE,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,QAAQ,SAAS,EAAE,EAAE,IACpD,EAAE,UAAU,WAAW,MAAM,cAAc,EAAE;GACjD,UAAU,oBAAoB,QAAQ,QAAQ,IAAI,QAAQ,CAAC;GAC3D,WAAW,QAAQ,QAAQ,IAAI,YAAY,KAAK;GAChD;GACA,IAAI,IAAI;EAGsB,GAAG,SAAS,EAAE,OAAO,UAAU,MAAM,EAAE,CAAC;EAExE,IAAI,UAAU,SAAS,MAAM;OAE3B,KAAK,MAAM,KAAK,OAAO,SACrB,IAAI,CAAC,EAAE,MAAM,QAAQ,KAAK,mCAAmC,EAAE,QAAQ,KAAK,EAAE,QAAQ;EAG1F,OAAO,eAAe;CACxB;AACF"}

package/package.json

@@ -1,8 +1,15 @@
 {
   "name": "@getvitops/astro",
-  "version": "7.0.0",
+  "version": "8.0.1",
   "description": "Astro integration for the Vitops design system — favicons/PWA, web-component scripts, and CSS, via a getvitops() integration + <Head /> component.",
+  "homepage": "https://docs.vitops.ca",
+  "bugs": "https://github.com/getvitops/design-system/issues",
   "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/getvitops/design-system.git",
+    "directory": "packages/astro"
+  },
   "files": [
     "dist",
     "src/components/Head.astro",
@@ -37,7 +44,10 @@
     "src/components/Tree.astro",
     "src/components/TreeNode.astro",
     "src/components/tree.ts",
-    "src/exports/tracking.ts"
+    "src/exports/tracking.ts",
+    "src/components/ReviewCard.astro",
+    "src/components/ReviewCardBody.astro",
+    "src/components/Marquee.astro"
   ],
   "type": "module",
   "types": "./dist/index.d.mts",
@@ -75,6 +85,8 @@
     "./components/NavShellToggle.astro": "./src/components/NavShellToggle.astro",
     "./components/Tree.astro": "./src/components/Tree.astro",
     "./components/tree.ts": "./src/components/tree.ts",
+    "./components/ReviewCard.astro": "./src/components/ReviewCard.astro",
+    "./components/Marquee.astro": "./src/components/Marquee.astro",
     "./schemas/*": "./src/schemas/*",
     "./package.json": "./package.json"
   },
@@ -82,17 +94,17 @@
     "access": "public"
   },
   "dependencies": {
-    "@getvitops/core": "7.0.0",
-    "@getvitops/utils": "7.0.0",
-    "@getvitops/generator": "7.0.0",
-    "@getvitops/vite": "7.0.0"
+    "@getvitops/core": "8.0.1",
+    "@getvitops/generator": "8.0.1",
+    "@getvitops/utils": "8.0.1",
+    "@getvitops/vite": "8.0.1"
   },
   "devDependencies": {
     "@astrojs/sitemap": "^3.7.3",
     "@tailwindcss/vite": "^4.3.3",
     "astro": "^7.1.2",
     "tailwindcss": "^4.3.3",
-    "vitest": "^4.1.9"
+    "vitest": "4.1.9"
   },
   "peerDependencies": {
     "@astrojs/sitemap": ">=3.6",
@@ -114,5 +126,8 @@
     "tailwindcss": {
       "optional": true
     }
+  },
+  "engines": {
+    "node": ">=24"
   }
 }