@reddoorla/maintenance 0.41.0 → 0.42.0

package/dist/forms/index.d.ts

@@ -57,8 +57,17 @@ type ScreenResult = {
     ok: false;
     reason: "honeypot" | "too-fast";
 };
-/** Minimum plausible fill time; faster than this reads as a bot. */
-declare const MIN_FILL_MS = 2000;
+/**
+ * Minimum plausible fill time; faster than this reads as a bot. Kept low (800ms)
+ * on purpose: a too-fast fill is dropped *silently* (the visitor sees success),
+ * so a real human who happens to be quick — autofill, a short form, a returning
+ * visitor — would lose their lead with no trace. Below this, a submit is
+ * effectively instant (page render → fill → click → network all under ~0.8s),
+ * which a human realistically never beats but a script does. The honeypot is the
+ * primary bot signal; this is the secondary one, so it errs toward letting
+ * borderline-fast humans through.
+ */
+declare const MIN_FILL_MS = 800;
 /**
  * Cheap bot screen for the site action. A filled honeypot is a bot; a submission
  * faster than MIN_FILL_MS is a bot. Missing timing data (null) is NOT a rejection

package/dist/forms/index.js

@@ -32,7 +32,7 @@ async function submitToIngest(opts) {
   const error = obj && typeof obj.error === "string" ? obj.error : `ingest failed (${res.status})`;
   return { ok: false, status: res.status, error };
 }
-var MIN_FILL_MS = 2e3;
+var MIN_FILL_MS = 800;
 function screenSubmission(input) {
   if (typeof input.botField === "string" && input.botField.trim().length > 0) {
     return { ok: false, reason: "honeypot" };

package/dist/forms/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/forms/types.ts","../../src/forms/client.ts","../../src/forms/action.ts","../../src/forms/endpoint.ts"],"sourcesContent":["/**\n * Form-type enum, kept in a leaf module (no Airtable/Resend imports) so it can\n * be shared with fleet sites via the `@reddoorla/maintenance/forms` subpath\n * without dragging server SDKs into a site bundle.\n */\nexport const SUBMISSION_FORM_TYPES = [\n  \"contact\",\n  \"inquiry\",\n  \"newsletter\",\n  \"rsvp\",\n  \"reserve\",\n] as const;\nexport type FormType = (typeof SUBMISSION_FORM_TYPES)[number];\n","import { SUBMISSION_FORM_TYPES, type FormType } from \"./types.js\";\n\n/**\n * The JSON a fleet site forwards to the dashboard ingest endpoint. Typed fields\n * are optional; the index signature lets a site include its own extra fields\n * (e.g. `company`) which the dashboard normalizer captures into `extraFields`.\n *\n * Each typed field allows `string | undefined` (not just `string`) so a\n * `buildPayload` mapping can use the idiomatic `form.get(\"name\")?.toString()`\n * pattern under `exactOptionalPropertyTypes` without a cast — an absent field\n * and an explicit `undefined` both serialize away in the JSON body.\n */\nexport type SubmissionPayload = {\n  formType?: FormType | string | undefined;\n  name?: string | undefined;\n  firstName?: string | undefined;\n  lastName?: string | undefined;\n  email?: string | undefined;\n  phone?: string | undefined;\n  message?: string | undefined;\n  sourceUrl?: string | undefined;\n  utm?: string | undefined;\n  [key: string]: unknown;\n};\n\nexport type IngestClientResult =\n  | { ok: true; id: string }\n  | { ok: false; status: number; error: string };\n\nexport type SubmitToIngestOptions = {\n  /** Full ingest endpoint incl. the site slug, e.g. https://…/api/forms/reddoor */\n  url: string;\n  /** The shared FORMS_INGEST_TOKEN. */\n  token: string;\n  payload: SubmissionPayload;\n  /** Injectable fetch (pass SvelteKit's `event.fetch`); defaults to global fetch. */\n  fetch?: typeof fetch;\n};\n\n/**\n * Forward a submission to the dashboard ingest endpoint. Never throws — a network\n * failure or a non-2xx response is returned as `{ ok: false }` so the caller can\n * show a friendly error rather than a 500.\n */\nexport async function submitToIngest(opts: SubmitToIngestOptions): Promise<IngestClientResult> {\n  const doFetch = opts.fetch ?? fetch;\n  let res: Response;\n  try {\n    res = await doFetch(opts.url, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/json\", \"x-forms-token\": opts.token },\n      body: JSON.stringify(opts.payload),\n    });\n  } catch (err) {\n    return { ok: false, status: 0, error: `network error: ${String(err)}` };\n  }\n  let body: unknown = null;\n  try {\n    body = await res.json();\n  } catch {\n    // non-JSON response — fall through to the error path\n  }\n  const obj = body && typeof body === \"object\" ? (body as Record<string, unknown>) : null;\n  if (res.ok && obj && obj.ok === true) {\n    return { ok: true, id: String(obj.id ?? \"\") };\n  }\n  const error = obj && typeof obj.error === \"string\" ? obj.error : `ingest failed (${res.status})`;\n  return { ok: false, status: res.status, error };\n}\n\nexport type ScreenInput = { botField?: string | null; elapsedMs?: number | null };\nexport type ScreenResult = { ok: true } | { ok: false; reason: \"honeypot\" | \"too-fast\" };\n\n/** Minimum plausible fill time; faster than this reads as a bot. */\nexport const MIN_FILL_MS = 2000;\n\n/**\n * Cheap bot screen for the site action. A filled honeypot is a bot; a submission\n * faster than MIN_FILL_MS is a bot. Missing timing data (null) is NOT a rejection\n * — a prerendered/cached page can't plant a fresh timestamp, and the honeypot\n * remains the primary signal.\n */\nexport function screenSubmission(input: ScreenInput): ScreenResult {\n  if (typeof input.botField === \"string\" && input.botField.trim().length > 0) {\n    return { ok: false, reason: \"honeypot\" };\n  }\n  if (\n    typeof input.elapsedMs === \"number\" &&\n    input.elapsedMs >= 0 &&\n    input.elapsedMs < MIN_FILL_MS\n  ) {\n    return { ok: false, reason: \"too-fast\" };\n  }\n  return { ok: true };\n}\n\nexport { SUBMISSION_FORM_TYPES, type FormType };\n","import { fail, redirect, type ActionFailure, type RequestEvent } from \"@sveltejs/kit\";\nimport { submitToIngest, screenSubmission, type SubmissionPayload } from \"./client.js\";\n\n/** Endpoint + token for the dashboard ingest, read per-request from site env. */\nexport type IngestActionConfig = { url?: string; token?: string };\n\nexport type CreateIngestActionOptions = {\n  /** Stamped onto every payload as `formType` (a SUBMISSION_FORM_TYPES value). */\n  formType: string;\n  /** Read at call time so SvelteKit's dynamic private env resolves per-request. */\n  getConfig: () => IngestActionConfig;\n  /**\n   * Map this form's fields to a payload. The factory's `formType` is always\n   * authoritative and cannot be overridden by `buildPayload`.\n   */\n  buildPayload: (form: FormData, event: RequestEvent) => SubmissionPayload;\n  /** Honeypot input name. Default \"bot-field\". */\n  botFieldName?: string;\n  /** Hidden timestamp input name (planted in `load`). Default \"ts\". */\n  tsFieldName?: string;\n  /** fail(500) copy when env vars are unset. */\n  unavailableMessage?: string;\n  /** fail(502) copy when the ingest endpoint rejects/errors. */\n  errorMessage?: string;\n  /** Injectable clock for tests. Default Date.now. */\n  now?: () => number;\n  /** If set, a successful OR bot-screened submission throws redirect(303, redirectTo)\n   *  instead of returning {success:true} (e.g. a dedicated /thank-you page). */\n  redirectTo?: string;\n};\n\nexport type IngestActionData = { success: true } | ActionFailure<{ error: string }>;\n\n/**\n * Build a SvelteKit `default` form action that screens for bots, forwards the\n * submission to the dashboard ingest endpoint, and returns SvelteKit-shaped\n * results. The per-form field mapping is the only thing a site must supply.\n */\nexport function createIngestAction(\n  opts: CreateIngestActionOptions,\n): (event: RequestEvent) => Promise<IngestActionData> {\n  const botFieldName = opts.botFieldName ?? \"bot-field\";\n  const tsFieldName = opts.tsFieldName ?? \"ts\";\n  const now = opts.now ?? Date.now;\n  const unavailable =\n    opts.unavailableMessage ?? \"This form is temporarily unavailable. Please email us directly.\";\n  const failed =\n    opts.errorMessage ?? \"Something went wrong sending your message. Please try again.\";\n\n  return async (event) => {\n    let form: FormData;\n    try {\n      form = await event.request.formData();\n    } catch {\n      console.error(`[forms-ingest] ${opts.formType}: could not parse form body`);\n      return fail(400, { error: failed });\n    }\n\n    // Bot screen: a filled honeypot OR an implausibly fast fill is silently\n    // accepted (return success, do NOT forward) so bots get no signal.\n    const screen = screenSubmission({\n      botField: form.get(botFieldName)?.toString() ?? null,\n      elapsedMs: elapsedMs(form.get(tsFieldName), now),\n    });\n    if (!screen.ok) return succeed();\n\n    const { url, token } = opts.getConfig();\n    if (!url || !token) {\n      console.error(`[forms-ingest] config missing for formType=${opts.formType}`);\n      return fail(500, { error: unavailable });\n    }\n\n    const result = await submitToIngest({\n      url,\n      token,\n      fetch: event.fetch,\n      payload: { ...opts.buildPayload(form, event), formType: opts.formType },\n    });\n    if (!result.ok) {\n      console.error(`[forms-ingest] ${opts.formType} → ${result.status}: ${result.error}`);\n      return fail(502, { error: failed });\n    }\n    return succeed();\n  };\n\n  // Single success path: redirect when configured (e.g. a dedicated /thank-you\n  // page), otherwise return the SvelteKit-shaped success. `redirect()` throws, so\n  // the trailing `return` keeps the `{ success: true }` type.\n  function succeed(): { success: true } {\n    if (opts.redirectTo) redirect(303, opts.redirectTo);\n    return { success: true };\n  }\n}\n\n// `FormDataEntryValue` is a DOM-lib global; this package compiles with only the\n// ES2022 lib + @types/node, where it is not in scope. Derive the type from the\n// in-scope `FormData.get` return instead — same value, no DOM-lib dependency.\nfunction elapsedMs(tsRaw: ReturnType<FormData[\"get\"]>, now: () => number): number | null {\n  const ts = Number(tsRaw);\n  if (!Number.isFinite(ts) || ts <= 0) return null;\n  return now() - ts;\n}\n","import { json, type RequestEvent } from \"@sveltejs/kit\";\nimport { submitToIngest, screenSubmission, type SubmissionPayload } from \"./client.js\";\nimport { SUBMISSION_FORM_TYPES, type FormType } from \"./types.js\";\nimport type { IngestActionConfig } from \"./action.js\";\n\n/**\n * Options for {@link createIngestEndpoint} — the JSON sibling of\n * `createIngestAction` for client-driven forms (modals / lightboxes / fetch)\n * that POST JSON to a `+server.ts` route instead of using a form action.\n */\nexport type CreateIngestEndpointOptions = {\n  /** Read at call time so SvelteKit's dynamic private env resolves per-request. */\n  getConfig: () => IngestActionConfig;\n  /**\n   * Map the parsed JSON body to a payload. Must set `formType` UNLESS the fixed\n   * `formType` option is provided (then that is authoritative and overrides it).\n   */\n  buildPayload: (body: Record<string, unknown>, event: RequestEvent) => SubmissionPayload;\n  /** Fixed formType for single-type endpoints; omit for multi-type endpoints\n   *  where `buildPayload` derives formType from the body. */\n  formType?: string;\n  /** Honeypot field name in the JSON body. Default \"bot-field\". */\n  botFieldName?: string;\n  /** json(500) copy when env vars are unset. */\n  unavailableMessage?: string;\n  /** json(400/502) copy for bad input / ingest failure. */\n  errorMessage?: string;\n};\n\nfunction isFormType(v: unknown): v is FormType {\n  return typeof v === \"string\" && (SUBMISSION_FORM_TYPES as readonly string[]).includes(v);\n}\n\nfunction str(v: unknown): string | undefined {\n  return typeof v === \"string\" ? v : undefined;\n}\n\n/**\n * Build a JSON `POST` handler that screens for bots, forwards the submission to\n * the dashboard ingest endpoint, and returns `{ ok }`-shaped JSON. The per-form\n * field mapping (`buildPayload`) is the only thing a site must supply. The\n * returned function is structurally a SvelteKit `RequestHandler`.\n */\nexport function createIngestEndpoint(\n  opts: CreateIngestEndpointOptions,\n): (event: RequestEvent) => Promise<Response> {\n  const botFieldName = opts.botFieldName ?? \"bot-field\";\n  const unavailable =\n    opts.unavailableMessage ?? \"This form is temporarily unavailable. Please email us directly.\";\n  const failed =\n    opts.errorMessage ?? \"Something went wrong sending your message. Please try again.\";\n\n  return async (event) => {\n    let body: Record<string, unknown>;\n    try {\n      const parsed: unknown = await event.request.json();\n      if (!parsed || typeof parsed !== \"object\") throw new Error(\"body is not an object\");\n      body = parsed as Record<string, unknown>;\n    } catch {\n      console.error(\"[forms-ingest] could not parse JSON body\");\n      return json({ ok: false, error: failed }, { status: 400 });\n    }\n\n    // Bot screen: honeypot only. A client POST carries no server-planted ts, and\n    // screenSubmission treats a missing elapsedMs as OK. A filled honeypot is\n    // silently accepted (return ok, do NOT forward) so bots get no signal.\n    const screen = screenSubmission({ botField: str(body[botFieldName]) ?? null });\n    if (!screen.ok) return json({ ok: true });\n\n    // buildPayload runs on untrusted JSON; a careless field access (e.g.\n    // `body.name.trim()` on a non-string) would otherwise escape as a 500. Treat\n    // a throw as a malformed request (400), keeping the \"never 500s\" guarantee.\n    let payload: SubmissionPayload;\n    try {\n      payload = {\n        ...opts.buildPayload(body, event),\n        ...(opts.formType ? { formType: opts.formType } : {}),\n      };\n    } catch (err) {\n      console.error(`[forms-ingest] buildPayload threw: ${String(err)}`);\n      return json({ ok: false, error: failed }, { status: 400 });\n    }\n    if (!isFormType(payload.formType)) {\n      console.error(`[forms-ingest] invalid formType: ${String(payload.formType)}`);\n      return json({ ok: false, error: failed }, { status: 400 });\n    }\n\n    const { url, token } = opts.getConfig();\n    if (!url || !token) {\n      console.error(`[forms-ingest] config missing for formType=${payload.formType}`);\n      return json({ ok: false, error: unavailable }, { status: 500 });\n    }\n\n    const result = await submitToIngest({ url, token, fetch: event.fetch, payload });\n    if (!result.ok) {\n      console.error(`[forms-ingest] ${payload.formType} → ${result.status}: ${result.error}`);\n      return json({ ok: false, error: failed }, { status: 502 });\n    }\n    return json({ ok: true });\n  };\n}\n"],"mappings":";AAKO,IAAM,wBAAwB;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;;;ACiCA,eAAsB,eAAe,MAA0D;AAC7F,QAAM,UAAU,KAAK,SAAS;AAC9B,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,QAAQ,KAAK,KAAK;AAAA,MAC5B,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,oBAAoB,iBAAiB,KAAK,MAAM;AAAA,MAC3E,MAAM,KAAK,UAAU,KAAK,OAAO;AAAA,IACnC,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,WAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,OAAO,kBAAkB,OAAO,GAAG,CAAC,GAAG;AAAA,EACxE;AACA,MAAI,OAAgB;AACpB,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AAAA,EAER;AACA,QAAM,MAAM,QAAQ,OAAO,SAAS,WAAY,OAAmC;AACnF,MAAI,IAAI,MAAM,OAAO,IAAI,OAAO,MAAM;AACpC,WAAO,EAAE,IAAI,MAAM,IAAI,OAAO,IAAI,MAAM,EAAE,EAAE;AAAA,EAC9C;AACA,QAAM,QAAQ,OAAO,OAAO,IAAI,UAAU,WAAW,IAAI,QAAQ,kBAAkB,IAAI,MAAM;AAC7F,SAAO,EAAE,IAAI,OAAO,QAAQ,IAAI,QAAQ,MAAM;AAChD;AAMO,IAAM,cAAc;AAQpB,SAAS,iBAAiB,OAAkC;AACjE,MAAI,OAAO,MAAM,aAAa,YAAY,MAAM,SAAS,KAAK,EAAE,SAAS,GAAG;AAC1E,WAAO,EAAE,IAAI,OAAO,QAAQ,WAAW;AAAA,EACzC;AACA,MACE,OAAO,MAAM,cAAc,YAC3B,MAAM,aAAa,KACnB,MAAM,YAAY,aAClB;AACA,WAAO,EAAE,IAAI,OAAO,QAAQ,WAAW;AAAA,EACzC;AACA,SAAO,EAAE,IAAI,KAAK;AACpB;;;AC9FA,SAAS,MAAM,gBAAuD;AAsC/D,SAAS,mBACd,MACoD;AACpD,QAAM,eAAe,KAAK,gBAAgB;AAC1C,QAAM,cAAc,KAAK,eAAe;AACxC,QAAM,MAAM,KAAK,OAAO,KAAK;AAC7B,QAAM,cACJ,KAAK,sBAAsB;AAC7B,QAAM,SACJ,KAAK,gBAAgB;AAEvB,SAAO,OAAO,UAAU;AACtB,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,MAAM,QAAQ,SAAS;AAAA,IACtC,QAAQ;AACN,cAAQ,MAAM,kBAAkB,KAAK,QAAQ,6BAA6B;AAC1E,aAAO,KAAK,KAAK,EAAE,OAAO,OAAO,CAAC;AAAA,IACpC;AAIA,UAAM,SAAS,iBAAiB;AAAA,MAC9B,UAAU,KAAK,IAAI,YAAY,GAAG,SAAS,KAAK;AAAA,MAChD,WAAW,UAAU,KAAK,IAAI,WAAW,GAAG,GAAG;AAAA,IACjD,CAAC;AACD,QAAI,CAAC,OAAO,GAAI,QAAO,QAAQ;AAE/B,UAAM,EAAE,KAAK,MAAM,IAAI,KAAK,UAAU;AACtC,QAAI,CAAC,OAAO,CAAC,OAAO;AAClB,cAAQ,MAAM,8CAA8C,KAAK,QAAQ,EAAE;AAC3E,aAAO,KAAK,KAAK,EAAE,OAAO,YAAY,CAAC;AAAA,IACzC;AAEA,UAAM,SAAS,MAAM,eAAe;AAAA,MAClC;AAAA,MACA;AAAA,MACA,OAAO,MAAM;AAAA,MACb,SAAS,EAAE,GAAG,KAAK,aAAa,MAAM,KAAK,GAAG,UAAU,KAAK,SAAS;AAAA,IACxE,CAAC;AACD,QAAI,CAAC,OAAO,IAAI;AACd,cAAQ,MAAM,kBAAkB,KAAK,QAAQ,WAAM,OAAO,MAAM,KAAK,OAAO,KAAK,EAAE;AACnF,aAAO,KAAK,KAAK,EAAE,OAAO,OAAO,CAAC;AAAA,IACpC;AACA,WAAO,QAAQ;AAAA,EACjB;AAKA,WAAS,UAA6B;AACpC,QAAI,KAAK,WAAY,UAAS,KAAK,KAAK,UAAU;AAClD,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB;AACF;AAKA,SAAS,UAAU,OAAoC,KAAkC;AACvF,QAAM,KAAK,OAAO,KAAK;AACvB,MAAI,CAAC,OAAO,SAAS,EAAE,KAAK,MAAM,EAAG,QAAO;AAC5C,SAAO,IAAI,IAAI;AACjB;;;ACrGA,SAAS,YAA+B;AA6BxC,SAAS,WAAW,GAA2B;AAC7C,SAAO,OAAO,MAAM,YAAa,sBAA4C,SAAS,CAAC;AACzF;AAEA,SAAS,IAAI,GAAgC;AAC3C,SAAO,OAAO,MAAM,WAAW,IAAI;AACrC;AAQO,SAAS,qBACd,MAC4C;AAC5C,QAAM,eAAe,KAAK,gBAAgB;AAC1C,QAAM,cACJ,KAAK,sBAAsB;AAC7B,QAAM,SACJ,KAAK,gBAAgB;AAEvB,SAAO,OAAO,UAAU;AACtB,QAAI;AACJ,QAAI;AACF,YAAM,SAAkB,MAAM,MAAM,QAAQ,KAAK;AACjD,UAAI,CAAC,UAAU,OAAO,WAAW,SAAU,OAAM,IAAI,MAAM,uBAAuB;AAClF,aAAO;AAAA,IACT,QAAQ;AACN,cAAQ,MAAM,0CAA0C;AACxD,aAAO,KAAK,EAAE,IAAI,OAAO,OAAO,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3D;AAKA,UAAM,SAAS,iBAAiB,EAAE,UAAU,IAAI,KAAK,YAAY,CAAC,KAAK,KAAK,CAAC;AAC7E,QAAI,CAAC,OAAO,GAAI,QAAO,KAAK,EAAE,IAAI,KAAK,CAAC;AAKxC,QAAI;AACJ,QAAI;AACF,gBAAU;AAAA,QACR,GAAG,KAAK,aAAa,MAAM,KAAK;AAAA,QAChC,GAAI,KAAK,WAAW,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC;AAAA,MACrD;AAAA,IACF,SAAS,KAAK;AACZ,cAAQ,MAAM,sCAAsC,OAAO,GAAG,CAAC,EAAE;AACjE,aAAO,KAAK,EAAE,IAAI,OAAO,OAAO,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3D;AACA,QAAI,CAAC,WAAW,QAAQ,QAAQ,GAAG;AACjC,cAAQ,MAAM,oCAAoC,OAAO,QAAQ,QAAQ,CAAC,EAAE;AAC5E,aAAO,KAAK,EAAE,IAAI,OAAO,OAAO,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3D;AAEA,UAAM,EAAE,KAAK,MAAM,IAAI,KAAK,UAAU;AACtC,QAAI,CAAC,OAAO,CAAC,OAAO;AAClB,cAAQ,MAAM,8CAA8C,QAAQ,QAAQ,EAAE;AAC9E,aAAO,KAAK,EAAE,IAAI,OAAO,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAChE;AAEA,UAAM,SAAS,MAAM,eAAe,EAAE,KAAK,OAAO,OAAO,MAAM,OAAO,QAAQ,CAAC;AAC/E,QAAI,CAAC,OAAO,IAAI;AACd,cAAQ,MAAM,kBAAkB,QAAQ,QAAQ,WAAM,OAAO,MAAM,KAAK,OAAO,KAAK,EAAE;AACtF,aAAO,KAAK,EAAE,IAAI,OAAO,OAAO,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3D;AACA,WAAO,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EAC1B;AACF;","names":[]}
+{"version":3,"sources":["../../src/forms/types.ts","../../src/forms/client.ts","../../src/forms/action.ts","../../src/forms/endpoint.ts"],"sourcesContent":["/**\n * Form-type enum, kept in a leaf module (no Airtable/Resend imports) so it can\n * be shared with fleet sites via the `@reddoorla/maintenance/forms` subpath\n * without dragging server SDKs into a site bundle.\n */\nexport const SUBMISSION_FORM_TYPES = [\n  \"contact\",\n  \"inquiry\",\n  \"newsletter\",\n  \"rsvp\",\n  \"reserve\",\n] as const;\nexport type FormType = (typeof SUBMISSION_FORM_TYPES)[number];\n","import { SUBMISSION_FORM_TYPES, type FormType } from \"./types.js\";\n\n/**\n * The JSON a fleet site forwards to the dashboard ingest endpoint. Typed fields\n * are optional; the index signature lets a site include its own extra fields\n * (e.g. `company`) which the dashboard normalizer captures into `extraFields`.\n *\n * Each typed field allows `string | undefined` (not just `string`) so a\n * `buildPayload` mapping can use the idiomatic `form.get(\"name\")?.toString()`\n * pattern under `exactOptionalPropertyTypes` without a cast — an absent field\n * and an explicit `undefined` both serialize away in the JSON body.\n */\nexport type SubmissionPayload = {\n  formType?: FormType | string | undefined;\n  name?: string | undefined;\n  firstName?: string | undefined;\n  lastName?: string | undefined;\n  email?: string | undefined;\n  phone?: string | undefined;\n  message?: string | undefined;\n  sourceUrl?: string | undefined;\n  utm?: string | undefined;\n  [key: string]: unknown;\n};\n\nexport type IngestClientResult =\n  | { ok: true; id: string }\n  | { ok: false; status: number; error: string };\n\nexport type SubmitToIngestOptions = {\n  /** Full ingest endpoint incl. the site slug, e.g. https://…/api/forms/reddoor */\n  url: string;\n  /** The shared FORMS_INGEST_TOKEN. */\n  token: string;\n  payload: SubmissionPayload;\n  /** Injectable fetch (pass SvelteKit's `event.fetch`); defaults to global fetch. */\n  fetch?: typeof fetch;\n};\n\n/**\n * Forward a submission to the dashboard ingest endpoint. Never throws — a network\n * failure or a non-2xx response is returned as `{ ok: false }` so the caller can\n * show a friendly error rather than a 500.\n */\nexport async function submitToIngest(opts: SubmitToIngestOptions): Promise<IngestClientResult> {\n  const doFetch = opts.fetch ?? fetch;\n  let res: Response;\n  try {\n    res = await doFetch(opts.url, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/json\", \"x-forms-token\": opts.token },\n      body: JSON.stringify(opts.payload),\n    });\n  } catch (err) {\n    return { ok: false, status: 0, error: `network error: ${String(err)}` };\n  }\n  let body: unknown = null;\n  try {\n    body = await res.json();\n  } catch {\n    // non-JSON response — fall through to the error path\n  }\n  const obj = body && typeof body === \"object\" ? (body as Record<string, unknown>) : null;\n  if (res.ok && obj && obj.ok === true) {\n    return { ok: true, id: String(obj.id ?? \"\") };\n  }\n  const error = obj && typeof obj.error === \"string\" ? obj.error : `ingest failed (${res.status})`;\n  return { ok: false, status: res.status, error };\n}\n\nexport type ScreenInput = { botField?: string | null; elapsedMs?: number | null };\nexport type ScreenResult = { ok: true } | { ok: false; reason: \"honeypot\" | \"too-fast\" };\n\n/**\n * Minimum plausible fill time; faster than this reads as a bot. Kept low (800ms)\n * on purpose: a too-fast fill is dropped *silently* (the visitor sees success),\n * so a real human who happens to be quick — autofill, a short form, a returning\n * visitor — would lose their lead with no trace. Below this, a submit is\n * effectively instant (page render → fill → click → network all under ~0.8s),\n * which a human realistically never beats but a script does. The honeypot is the\n * primary bot signal; this is the secondary one, so it errs toward letting\n * borderline-fast humans through.\n */\nexport const MIN_FILL_MS = 800;\n\n/**\n * Cheap bot screen for the site action. A filled honeypot is a bot; a submission\n * faster than MIN_FILL_MS is a bot. Missing timing data (null) is NOT a rejection\n * — a prerendered/cached page can't plant a fresh timestamp, and the honeypot\n * remains the primary signal.\n */\nexport function screenSubmission(input: ScreenInput): ScreenResult {\n  if (typeof input.botField === \"string\" && input.botField.trim().length > 0) {\n    return { ok: false, reason: \"honeypot\" };\n  }\n  if (\n    typeof input.elapsedMs === \"number\" &&\n    input.elapsedMs >= 0 &&\n    input.elapsedMs < MIN_FILL_MS\n  ) {\n    return { ok: false, reason: \"too-fast\" };\n  }\n  return { ok: true };\n}\n\nexport { SUBMISSION_FORM_TYPES, type FormType };\n","import { fail, redirect, type ActionFailure, type RequestEvent } from \"@sveltejs/kit\";\nimport { submitToIngest, screenSubmission, type SubmissionPayload } from \"./client.js\";\n\n/** Endpoint + token for the dashboard ingest, read per-request from site env. */\nexport type IngestActionConfig = { url?: string; token?: string };\n\nexport type CreateIngestActionOptions = {\n  /** Stamped onto every payload as `formType` (a SUBMISSION_FORM_TYPES value). */\n  formType: string;\n  /** Read at call time so SvelteKit's dynamic private env resolves per-request. */\n  getConfig: () => IngestActionConfig;\n  /**\n   * Map this form's fields to a payload. The factory's `formType` is always\n   * authoritative and cannot be overridden by `buildPayload`.\n   */\n  buildPayload: (form: FormData, event: RequestEvent) => SubmissionPayload;\n  /** Honeypot input name. Default \"bot-field\". */\n  botFieldName?: string;\n  /** Hidden timestamp input name (planted in `load`). Default \"ts\". */\n  tsFieldName?: string;\n  /** fail(500) copy when env vars are unset. */\n  unavailableMessage?: string;\n  /** fail(502) copy when the ingest endpoint rejects/errors. */\n  errorMessage?: string;\n  /** Injectable clock for tests. Default Date.now. */\n  now?: () => number;\n  /** If set, a successful OR bot-screened submission throws redirect(303, redirectTo)\n   *  instead of returning {success:true} (e.g. a dedicated /thank-you page). */\n  redirectTo?: string;\n};\n\nexport type IngestActionData = { success: true } | ActionFailure<{ error: string }>;\n\n/**\n * Build a SvelteKit `default` form action that screens for bots, forwards the\n * submission to the dashboard ingest endpoint, and returns SvelteKit-shaped\n * results. The per-form field mapping is the only thing a site must supply.\n */\nexport function createIngestAction(\n  opts: CreateIngestActionOptions,\n): (event: RequestEvent) => Promise<IngestActionData> {\n  const botFieldName = opts.botFieldName ?? \"bot-field\";\n  const tsFieldName = opts.tsFieldName ?? \"ts\";\n  const now = opts.now ?? Date.now;\n  const unavailable =\n    opts.unavailableMessage ?? \"This form is temporarily unavailable. Please email us directly.\";\n  const failed =\n    opts.errorMessage ?? \"Something went wrong sending your message. Please try again.\";\n\n  return async (event) => {\n    let form: FormData;\n    try {\n      form = await event.request.formData();\n    } catch {\n      console.error(`[forms-ingest] ${opts.formType}: could not parse form body`);\n      return fail(400, { error: failed });\n    }\n\n    // Bot screen: a filled honeypot OR an implausibly fast fill is silently\n    // accepted (return success, do NOT forward) so bots get no signal.\n    const screen = screenSubmission({\n      botField: form.get(botFieldName)?.toString() ?? null,\n      elapsedMs: elapsedMs(form.get(tsFieldName), now),\n    });\n    if (!screen.ok) return succeed();\n\n    const { url, token } = opts.getConfig();\n    if (!url || !token) {\n      console.error(`[forms-ingest] config missing for formType=${opts.formType}`);\n      return fail(500, { error: unavailable });\n    }\n\n    const result = await submitToIngest({\n      url,\n      token,\n      fetch: event.fetch,\n      payload: { ...opts.buildPayload(form, event), formType: opts.formType },\n    });\n    if (!result.ok) {\n      console.error(`[forms-ingest] ${opts.formType} → ${result.status}: ${result.error}`);\n      return fail(502, { error: failed });\n    }\n    return succeed();\n  };\n\n  // Single success path: redirect when configured (e.g. a dedicated /thank-you\n  // page), otherwise return the SvelteKit-shaped success. `redirect()` throws, so\n  // the trailing `return` keeps the `{ success: true }` type.\n  function succeed(): { success: true } {\n    if (opts.redirectTo) redirect(303, opts.redirectTo);\n    return { success: true };\n  }\n}\n\n// `FormDataEntryValue` is a DOM-lib global; this package compiles with only the\n// ES2022 lib + @types/node, where it is not in scope. Derive the type from the\n// in-scope `FormData.get` return instead — same value, no DOM-lib dependency.\nfunction elapsedMs(tsRaw: ReturnType<FormData[\"get\"]>, now: () => number): number | null {\n  const ts = Number(tsRaw);\n  if (!Number.isFinite(ts) || ts <= 0) return null;\n  return now() - ts;\n}\n","import { json, type RequestEvent } from \"@sveltejs/kit\";\nimport { submitToIngest, screenSubmission, type SubmissionPayload } from \"./client.js\";\nimport { SUBMISSION_FORM_TYPES, type FormType } from \"./types.js\";\nimport type { IngestActionConfig } from \"./action.js\";\n\n/**\n * Options for {@link createIngestEndpoint} — the JSON sibling of\n * `createIngestAction` for client-driven forms (modals / lightboxes / fetch)\n * that POST JSON to a `+server.ts` route instead of using a form action.\n */\nexport type CreateIngestEndpointOptions = {\n  /** Read at call time so SvelteKit's dynamic private env resolves per-request. */\n  getConfig: () => IngestActionConfig;\n  /**\n   * Map the parsed JSON body to a payload. Must set `formType` UNLESS the fixed\n   * `formType` option is provided (then that is authoritative and overrides it).\n   */\n  buildPayload: (body: Record<string, unknown>, event: RequestEvent) => SubmissionPayload;\n  /** Fixed formType for single-type endpoints; omit for multi-type endpoints\n   *  where `buildPayload` derives formType from the body. */\n  formType?: string;\n  /** Honeypot field name in the JSON body. Default \"bot-field\". */\n  botFieldName?: string;\n  /** json(500) copy when env vars are unset. */\n  unavailableMessage?: string;\n  /** json(400/502) copy for bad input / ingest failure. */\n  errorMessage?: string;\n};\n\nfunction isFormType(v: unknown): v is FormType {\n  return typeof v === \"string\" && (SUBMISSION_FORM_TYPES as readonly string[]).includes(v);\n}\n\nfunction str(v: unknown): string | undefined {\n  return typeof v === \"string\" ? v : undefined;\n}\n\n/**\n * Build a JSON `POST` handler that screens for bots, forwards the submission to\n * the dashboard ingest endpoint, and returns `{ ok }`-shaped JSON. The per-form\n * field mapping (`buildPayload`) is the only thing a site must supply. The\n * returned function is structurally a SvelteKit `RequestHandler`.\n */\nexport function createIngestEndpoint(\n  opts: CreateIngestEndpointOptions,\n): (event: RequestEvent) => Promise<Response> {\n  const botFieldName = opts.botFieldName ?? \"bot-field\";\n  const unavailable =\n    opts.unavailableMessage ?? \"This form is temporarily unavailable. Please email us directly.\";\n  const failed =\n    opts.errorMessage ?? \"Something went wrong sending your message. Please try again.\";\n\n  return async (event) => {\n    let body: Record<string, unknown>;\n    try {\n      const parsed: unknown = await event.request.json();\n      if (!parsed || typeof parsed !== \"object\") throw new Error(\"body is not an object\");\n      body = parsed as Record<string, unknown>;\n    } catch {\n      console.error(\"[forms-ingest] could not parse JSON body\");\n      return json({ ok: false, error: failed }, { status: 400 });\n    }\n\n    // Bot screen: honeypot only. A client POST carries no server-planted ts, and\n    // screenSubmission treats a missing elapsedMs as OK. A filled honeypot is\n    // silently accepted (return ok, do NOT forward) so bots get no signal.\n    const screen = screenSubmission({ botField: str(body[botFieldName]) ?? null });\n    if (!screen.ok) return json({ ok: true });\n\n    // buildPayload runs on untrusted JSON; a careless field access (e.g.\n    // `body.name.trim()` on a non-string) would otherwise escape as a 500. Treat\n    // a throw as a malformed request (400), keeping the \"never 500s\" guarantee.\n    let payload: SubmissionPayload;\n    try {\n      payload = {\n        ...opts.buildPayload(body, event),\n        ...(opts.formType ? { formType: opts.formType } : {}),\n      };\n    } catch (err) {\n      console.error(`[forms-ingest] buildPayload threw: ${String(err)}`);\n      return json({ ok: false, error: failed }, { status: 400 });\n    }\n    if (!isFormType(payload.formType)) {\n      console.error(`[forms-ingest] invalid formType: ${String(payload.formType)}`);\n      return json({ ok: false, error: failed }, { status: 400 });\n    }\n\n    const { url, token } = opts.getConfig();\n    if (!url || !token) {\n      console.error(`[forms-ingest] config missing for formType=${payload.formType}`);\n      return json({ ok: false, error: unavailable }, { status: 500 });\n    }\n\n    const result = await submitToIngest({ url, token, fetch: event.fetch, payload });\n    if (!result.ok) {\n      console.error(`[forms-ingest] ${payload.formType} → ${result.status}: ${result.error}`);\n      return json({ ok: false, error: failed }, { status: 502 });\n    }\n    return json({ ok: true });\n  };\n}\n"],"mappings":";AAKO,IAAM,wBAAwB;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;;;ACiCA,eAAsB,eAAe,MAA0D;AAC7F,QAAM,UAAU,KAAK,SAAS;AAC9B,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,QAAQ,KAAK,KAAK;AAAA,MAC5B,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,oBAAoB,iBAAiB,KAAK,MAAM;AAAA,MAC3E,MAAM,KAAK,UAAU,KAAK,OAAO;AAAA,IACnC,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,WAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,OAAO,kBAAkB,OAAO,GAAG,CAAC,GAAG;AAAA,EACxE;AACA,MAAI,OAAgB;AACpB,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AAAA,EAER;AACA,QAAM,MAAM,QAAQ,OAAO,SAAS,WAAY,OAAmC;AACnF,MAAI,IAAI,MAAM,OAAO,IAAI,OAAO,MAAM;AACpC,WAAO,EAAE,IAAI,MAAM,IAAI,OAAO,IAAI,MAAM,EAAE,EAAE;AAAA,EAC9C;AACA,QAAM,QAAQ,OAAO,OAAO,IAAI,UAAU,WAAW,IAAI,QAAQ,kBAAkB,IAAI,MAAM;AAC7F,SAAO,EAAE,IAAI,OAAO,QAAQ,IAAI,QAAQ,MAAM;AAChD;AAeO,IAAM,cAAc;AAQpB,SAAS,iBAAiB,OAAkC;AACjE,MAAI,OAAO,MAAM,aAAa,YAAY,MAAM,SAAS,KAAK,EAAE,SAAS,GAAG;AAC1E,WAAO,EAAE,IAAI,OAAO,QAAQ,WAAW;AAAA,EACzC;AACA,MACE,OAAO,MAAM,cAAc,YAC3B,MAAM,aAAa,KACnB,MAAM,YAAY,aAClB;AACA,WAAO,EAAE,IAAI,OAAO,QAAQ,WAAW;AAAA,EACzC;AACA,SAAO,EAAE,IAAI,KAAK;AACpB;;;ACvGA,SAAS,MAAM,gBAAuD;AAsC/D,SAAS,mBACd,MACoD;AACpD,QAAM,eAAe,KAAK,gBAAgB;AAC1C,QAAM,cAAc,KAAK,eAAe;AACxC,QAAM,MAAM,KAAK,OAAO,KAAK;AAC7B,QAAM,cACJ,KAAK,sBAAsB;AAC7B,QAAM,SACJ,KAAK,gBAAgB;AAEvB,SAAO,OAAO,UAAU;AACtB,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,MAAM,QAAQ,SAAS;AAAA,IACtC,QAAQ;AACN,cAAQ,MAAM,kBAAkB,KAAK,QAAQ,6BAA6B;AAC1E,aAAO,KAAK,KAAK,EAAE,OAAO,OAAO,CAAC;AAAA,IACpC;AAIA,UAAM,SAAS,iBAAiB;AAAA,MAC9B,UAAU,KAAK,IAAI,YAAY,GAAG,SAAS,KAAK;AAAA,MAChD,WAAW,UAAU,KAAK,IAAI,WAAW,GAAG,GAAG;AAAA,IACjD,CAAC;AACD,QAAI,CAAC,OAAO,GAAI,QAAO,QAAQ;AAE/B,UAAM,EAAE,KAAK,MAAM,IAAI,KAAK,UAAU;AACtC,QAAI,CAAC,OAAO,CAAC,OAAO;AAClB,cAAQ,MAAM,8CAA8C,KAAK,QAAQ,EAAE;AAC3E,aAAO,KAAK,KAAK,EAAE,OAAO,YAAY,CAAC;AAAA,IACzC;AAEA,UAAM,SAAS,MAAM,eAAe;AAAA,MAClC;AAAA,MACA;AAAA,MACA,OAAO,MAAM;AAAA,MACb,SAAS,EAAE,GAAG,KAAK,aAAa,MAAM,KAAK,GAAG,UAAU,KAAK,SAAS;AAAA,IACxE,CAAC;AACD,QAAI,CAAC,OAAO,IAAI;AACd,cAAQ,MAAM,kBAAkB,KAAK,QAAQ,WAAM,OAAO,MAAM,KAAK,OAAO,KAAK,EAAE;AACnF,aAAO,KAAK,KAAK,EAAE,OAAO,OAAO,CAAC;AAAA,IACpC;AACA,WAAO,QAAQ;AAAA,EACjB;AAKA,WAAS,UAA6B;AACpC,QAAI,KAAK,WAAY,UAAS,KAAK,KAAK,UAAU;AAClD,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB;AACF;AAKA,SAAS,UAAU,OAAoC,KAAkC;AACvF,QAAM,KAAK,OAAO,KAAK;AACvB,MAAI,CAAC,OAAO,SAAS,EAAE,KAAK,MAAM,EAAG,QAAO;AAC5C,SAAO,IAAI,IAAI;AACjB;;;ACrGA,SAAS,YAA+B;AA6BxC,SAAS,WAAW,GAA2B;AAC7C,SAAO,OAAO,MAAM,YAAa,sBAA4C,SAAS,CAAC;AACzF;AAEA,SAAS,IAAI,GAAgC;AAC3C,SAAO,OAAO,MAAM,WAAW,IAAI;AACrC;AAQO,SAAS,qBACd,MAC4C;AAC5C,QAAM,eAAe,KAAK,gBAAgB;AAC1C,QAAM,cACJ,KAAK,sBAAsB;AAC7B,QAAM,SACJ,KAAK,gBAAgB;AAEvB,SAAO,OAAO,UAAU;AACtB,QAAI;AACJ,QAAI;AACF,YAAM,SAAkB,MAAM,MAAM,QAAQ,KAAK;AACjD,UAAI,CAAC,UAAU,OAAO,WAAW,SAAU,OAAM,IAAI,MAAM,uBAAuB;AAClF,aAAO;AAAA,IACT,QAAQ;AACN,cAAQ,MAAM,0CAA0C;AACxD,aAAO,KAAK,EAAE,IAAI,OAAO,OAAO,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3D;AAKA,UAAM,SAAS,iBAAiB,EAAE,UAAU,IAAI,KAAK,YAAY,CAAC,KAAK,KAAK,CAAC;AAC7E,QAAI,CAAC,OAAO,GAAI,QAAO,KAAK,EAAE,IAAI,KAAK,CAAC;AAKxC,QAAI;AACJ,QAAI;AACF,gBAAU;AAAA,QACR,GAAG,KAAK,aAAa,MAAM,KAAK;AAAA,QAChC,GAAI,KAAK,WAAW,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC;AAAA,MACrD;AAAA,IACF,SAAS,KAAK;AACZ,cAAQ,MAAM,sCAAsC,OAAO,GAAG,CAAC,EAAE;AACjE,aAAO,KAAK,EAAE,IAAI,OAAO,OAAO,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3D;AACA,QAAI,CAAC,WAAW,QAAQ,QAAQ,GAAG;AACjC,cAAQ,MAAM,oCAAoC,OAAO,QAAQ,QAAQ,CAAC,EAAE;AAC5E,aAAO,KAAK,EAAE,IAAI,OAAO,OAAO,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3D;AAEA,UAAM,EAAE,KAAK,MAAM,IAAI,KAAK,UAAU;AACtC,QAAI,CAAC,OAAO,CAAC,OAAO;AAClB,cAAQ,MAAM,8CAA8C,QAAQ,QAAQ,EAAE;AAC9E,aAAO,KAAK,EAAE,IAAI,OAAO,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAChE;AAEA,UAAM,SAAS,MAAM,eAAe,EAAE,KAAK,OAAO,OAAO,MAAM,OAAO,QAAQ,CAAC;AAC/E,QAAI,CAAC,OAAO,IAAI;AACd,cAAQ,MAAM,kBAAkB,QAAQ,QAAQ,WAAM,OAAO,MAAM,KAAK,OAAO,KAAK,EAAE;AACtF,aAAO,KAAK,EAAE,IAAI,OAAO,OAAO,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3D;AACA,WAAO,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EAC1B;AACF;","names":[]}

package/dist/index.d.ts

@@ -282,9 +282,17 @@ type ResolvedCopy = {
     launchHeading: string;
     launchBody: string;
     launchSetupItems: string[];
+    announceHeading: string;
+    announceBody: string;
+    announceMonitorItems: string[];
+    announcePreviewLabel: string;
+    announceImprovementResend: string;
+    announceImprovementSvelte5: string;
+    announceCadence: string;
+    announceOpenDoor: string;
 };
 
-type ReportType = "Maintenance" | "Testing" | "Launch";
+type ReportType = "Maintenance" | "Testing" | "Launch" | "Announcement";
 type LighthouseScores = {
     performance: number;
     accessibility: number;
@@ -318,6 +326,12 @@ type ReportData = {
     lastTestedDate: Date | null;
     /** Optional free-text rendered as a section above the footer. */
     commentary: string | null;
+    /** Announcement-only: which recent-improvement callouts to render. Undefined for
+     *  Maintenance/Testing/Launch → the section is absent. */
+    improvements?: {
+        resendForms?: boolean;
+        svelte5?: boolean;
+    };
     /** Resolved per-site copy (M6a). Omitted → the template falls back to DEFAULT_COPY. */
     copy?: ResolvedCopy;
     /** Used in the header `mj-image src`; the email attaches the bytes with this CID. */

package/dist/index.js

@@ -2781,7 +2781,15 @@ var DEFAULT_COPY = {
     "Hosting, DNS, and SSL configured",
     "Continuous integration + automatic dependency updates",
     "Analytics and uptime monitoring"
-  ]
+  ],
+  announceHeading: "YOUR MONTHLY REPORT",
+  announceBody: "We've set up ongoing monitoring and maintenance for your site. Each month we quietly check that everything's healthy and up to date \u2014 and now you'll get a short report so you can see it at a glance.",
+  announceMonitorItems: ["Performance", "Accessibility", "Security", "Uptime"],
+  announcePreviewLabel: "A snapshot of your latest scores:",
+  announceImprovementResend: "Your contact forms now deliver straight to your inbox through reliable infrastructure, so no inquiry slips through the cracks.",
+  announceImprovementSvelte5: "We've modernized your site to the latest framework \u2014 it's faster, more secure, and built to last.",
+  announceCadence: "You'll receive this every month. There's nothing you need to do.",
+  announceOpenDoor: "And if you'd ever like to expand the scope, add features, or freshen anything up, just reply \u2014 we'd love to help."
 };
 function override(v) {
   if (typeof v !== "string") return null;
@@ -3116,16 +3124,113 @@ function buildLaunchMjml(data) {
 </mjml>`;
 }
 
+// src/reports/announcement-email/template.ts
+var RED2 = "#C00";
+var GREY2 = "#757575";
+var SCORE_PREVIEW = [
+  { label: "Performance", key: "performance" },
+  { label: "Readability", key: "accessibility" },
+  { label: "Best Practices", key: "bestPractices" },
+  { label: "Site Structure", key: "seo" }
+];
+function buildAnnouncementMjml(data) {
+  const copy = data.copy ?? DEFAULT_COPY;
+  const previewText = "Your monthly report from Reddoor";
+  const improvementItems = [];
+  if (data.improvements?.resendForms) improvementItems.push(copy.announceImprovementResend);
+  if (data.improvements?.svelte5) improvementItems.push(copy.announceImprovementSvelte5);
+  const improvementsSection = improvementItems.length > 0 ? `
+    <mj-section background-color="white">
+      <mj-column>
+        <mj-text color="${RED2}" font-size="20px" font-weight="700" padding-top="36px">RECENT IMPROVEMENTS</mj-text>
+        ${improvementItems.map(
+    (item) => `
+        <mj-text color="${GREY2}" font-family="helvetica, sans-serif" font-size="16px" font-weight="300" line-height="24px" padding-top="4px" padding-bottom="4px">\u2022 ${escapeXml(item)}</mj-text>`
+  ).join("")}
+      </mj-column>
+    </mj-section>` : "";
+  const monitorRows = copy.announceMonitorItems.map(
+    (item) => `
+        <mj-text color="${GREY2}" font-family="helvetica, sans-serif" font-size="16px" font-weight="300" line-height="24px" padding-top="4px" padding-bottom="4px">\u2022 ${escapeXml(item)}</mj-text>`
+  ).join("");
+  const scoreRows = SCORE_PREVIEW.map(
+    ({ label, key }) => `
+        <mj-text color="${RED2}" font-size="20px" font-weight="300" padding-top="25px">${label}</mj-text>
+        <mj-text color="${RED2}" font-size="44px" font-weight="400" padding-top="0px">${data.lighthouse[key]}</mj-text>`
+  ).join("");
+  const contactRows = copy.contact.map(
+    (line) => `
+      <mj-text font-family="helvetica, sans-serif" font-size="24px" font-weight="300" line-height="30px">${escapeXml(line)}</mj-text>`
+  ).join("");
+  const footerAddressRows = copy.footerAddress.map(
+    (line) => `
+      <mj-text color="${GREY2}" font-family="helvetica, sans-serif" font-size="12px" font-weight="300" line-height="16px" padding-top="0" padding-bottom="0px">${escapeXml(line)}</mj-text>`
+  ).join("");
+  return `<mjml>
+  <mj-head>
+    <mj-attributes>
+      <mj-text font-family="helvetica, sans-serif" padding-left="5px" padding-right="5px" />
+      <mj-section padding-left="11%" padding-right="11%"/>
+      <mj-image padding="0px" />
+    </mj-attributes>
+    <mj-preview>${escapeXml(previewText)}</mj-preview>
+    ${headerStyleBlock(data)}
+  </mj-head>
+  <mj-body background-color="white">
+    <mj-section background-color="#F4F4F4" padding-top="0px" padding-bottom="0px" padding-left="0px" padding-right="0px">
+      <mj-column>${headerImageTag(data)}</mj-column>
+    </mj-section>
+    <mj-section background-color="white">
+      <mj-column>
+        <mj-text color="${RED2}" font-size="20px" font-weight="700" padding-top="75px">${escapeXml(copy.announceHeading)}</mj-text>
+        <mj-text color="${GREY2}" font-family="helvetica, sans-serif" font-size="16px" font-weight="300" line-height="24px" padding-top="20px">Prepared for ${escapeXml(data.siteName)}</mj-text>
+        <mj-text color="${GREY2}" font-family="helvetica, sans-serif" font-size="16px" font-weight="300" line-height="24px" padding-top="8px">${escapeXml(copy.announceBody)}</mj-text>
+      </mj-column>
+    </mj-section>
+    ${improvementsSection}
+    <mj-section background-color="white">
+      <mj-column>
+        <mj-text color="${RED2}" font-size="20px" font-weight="700" padding-top="36px">WHAT WE MONITOR</mj-text>
+        ${monitorRows}
+      </mj-column>
+    </mj-section>
+    <mj-section background-color="#F4F4F4">
+      <mj-column>
+        <mj-text color="${RED2}" font-size="20px" font-weight="700" padding-top="55px">${escapeXml(copy.announcePreviewLabel)}</mj-text>
+        ${scoreRows}
+      </mj-column>
+    </mj-section>
+    <mj-section background-color="white">
+      <mj-column>
+        <mj-text color="${GREY2}" font-family="helvetica, sans-serif" font-size="16px" font-weight="300" line-height="24px" padding-top="36px">${escapeXml(copy.announceCadence)}</mj-text>
+        <mj-text color="${GREY2}" font-family="helvetica, sans-serif" font-size="16px" font-weight="300" line-height="24px" padding-top="8px">${escapeXml(copy.announceOpenDoor)}</mj-text>
+      </mj-column>
+    </mj-section>
+    <mj-section background-color="white">
+      <mj-column padding-top="36px">
+        <mj-text color="${RED2}" font-family="helvetica, sans-serif" font-size="24px" font-weight="700" padding-top="36px" line-height="36px">Any questions, concerns or requests?</mj-text>
+        ${contactRows}
+        <mj-divider border-width="1px" border-style="solid" border-color="#CCCCCC" padding="0" />
+        <mj-text color="${GREY2}" font-family="helvetica, sans-serif" font-size="12px" font-weight="300" padding-top="24px" line-height="20px" font-style="italic">Copyright ${(/* @__PURE__ */ new Date()).getUTCFullYear()} ${escapeXml(copy.footerOrg)}. All rights reserved.</mj-text>
+        <mj-text color="${GREY2}" font-family="helvetica, sans-serif" font-size="12px" font-weight="700" line-height="16px" padding-top="0" padding-bottom="0px">Our mailing address is:</mj-text>
+        <mj-text color="${GREY2}" font-family="helvetica, sans-serif" font-size="12px" font-weight="300" line-height="16px" padding-top="0" padding-bottom="0px">${escapeXml(copy.footerOrg)}</mj-text>
+        ${footerAddressRows}
+      </mj-column>
+    </mj-section>
+  </mj-body>
+</mjml>`;
+}
+
 // src/reports/render.ts
 async function renderReportHtml(data) {
-  const mjml = data.reportType === "Launch" ? buildLaunchMjml(data) : buildMjml(data);
+  const mjml = data.reportType === "Launch" ? buildLaunchMjml(data) : data.reportType === "Announcement" ? buildAnnouncementMjml(data) : buildMjml(data);
   const out = await mjml2html(mjml, { validationLevel: "strict" });
   return { html: out.html, warnings: out.errors ?? [] };
 }
 
 // src/reports/airtable/reports.ts
 var REPORTS_TABLE = "Reports";
-var REPORT_TYPES = ["Maintenance", "Testing", "Launch"];
+var REPORT_TYPES = ["Maintenance", "Testing", "Launch", "Announcement"];
 function toReportType(raw) {
   if (raw && REPORT_TYPES.includes(raw)) return raw;
   if (raw)
@@ -3198,6 +3303,7 @@ async function createDraft(base, input) {
   if (input.searchFoundPage1 !== void 0) fields["Search found page 1"] = input.searchFoundPage1;
   if (input.searchPosition !== void 0) fields["Search position"] = input.searchPosition;
   if (input.period !== void 0) fields["Period"] = input.period;
+  if (input.subjectOverride !== void 0) fields["Subject override"] = input.subjectOverride;
   const created = await base(REPORTS_TABLE).create([{ fields }]);
   const rec = created[0];
   if (!rec) throw new Error("Airtable create returned no records");
@@ -4244,6 +4350,7 @@ var FILTERS = [
   "prs",
   "ci",
   "stale",
+  "no-domain",
   "pending",
   "submissions"
 ];