@reddoorla/maintenance 0.66.0 → 0.67.0

package/dist/{digest-SIZUXT67.js → digest-MECMZPFE.js}

@@ -8,7 +8,7 @@ import {
   diffAttention,
   readDigestState,
   writeDigestState
-} from "./chunk-CH6K2VMM.js";
+} from "./chunk-JDGIO54P.js";
 import {
   isIdempotencyConflict
 } from "./chunk-OGGRFBL4.js";
@@ -20,7 +20,7 @@ import {
 import {
   listWebsites,
   siteSlug
-} from "./chunk-4P6UQG5L.js";
+} from "./chunk-CL5DYUWQ.js";
 import {
   openBase,
   readAirtableConfig
@@ -226,4 +226,4 @@ export {
   renderDigestHtml,
   runDigest
 };
-//# sourceMappingURL=digest-SIZUXT67.js.map
+//# sourceMappingURL=digest-MECMZPFE.js.map

package/dist/forms/index.d.ts

@@ -2,6 +2,13 @@ import { F as FormType } from '../types-RXY-vY-5.js';
 export { S as SUBMISSION_FORM_TYPES } from '../types-RXY-vY-5.js';
 import { RequestEvent, ActionFailure } from '@sveltejs/kit';
 
+/** The reserved wire envelope a fleet site forwards alongside the lead fields. */
+type SubmissionMeta = {
+    turnstileToken?: string;
+    clientIp?: string;
+    userAgent?: string;
+};
+
 /**
  * The JSON a fleet site forwards to the dashboard ingest endpoint. Typed fields
  * are optional; the index signature lets a site include its own extra fields
@@ -22,6 +29,8 @@ type SubmissionPayload = {
     message?: string | undefined;
     sourceUrl?: string | undefined;
     utm?: string | undefined;
+    /** Reserved transport envelope (token/IP/UA); stripped centrally, never persisted. */
+    _meta?: SubmissionMeta | undefined;
     [key: string]: unknown;
 };
 type IngestClientResult = {
@@ -100,6 +109,8 @@ type CreateIngestActionOptions = {
     botFieldName?: string;
     /** Hidden timestamp input name (planted in `load`). Default "ts". */
     tsFieldName?: string;
+    /** Field carrying the Cloudflare Turnstile token. Default "cf-turnstile-response". */
+    turnstileFieldName?: string;
     /** fail(500) copy when env vars are unset. */
     unavailableMessage?: string;
     /** fail(502) copy when the ingest endpoint rejects/errors. */
@@ -140,6 +151,8 @@ type CreateIngestEndpointOptions = {
     formType?: string;
     /** Honeypot field name in the JSON body. Default "bot-field". */
     botFieldName?: string;
+    /** Field carrying the Cloudflare Turnstile token. Default "cf-turnstile-response". */
+    turnstileFieldName?: string;
     /** json(500) copy when env vars are unset. */
     unavailableMessage?: string;
     /** json(400/502) copy for bad input / ingest failure. */

package/dist/forms/index.js

@@ -58,9 +58,29 @@ function screenSubmission(input) {
 
 // src/forms/action.ts
 import { fail, redirect } from "@sveltejs/kit";
+
+// src/forms/meta.ts
+function buildSubmissionMeta(event, turnstileToken) {
+  const meta = {};
+  const token = typeof turnstileToken === "string" ? turnstileToken.trim() : "";
+  if (token) meta.turnstileToken = token;
+  if (typeof event.getClientAddress === "function") {
+    try {
+      const ip = event.getClientAddress();
+      if (typeof ip === "string" && ip.trim()) meta.clientIp = ip.trim();
+    } catch {
+    }
+  }
+  const ua = event.request?.headers?.get?.("user-agent");
+  if (typeof ua === "string" && ua.trim()) meta.userAgent = ua.trim();
+  return Object.keys(meta).length > 0 ? meta : void 0;
+}
+
+// src/forms/action.ts
 function createIngestAction(opts) {
   const botFieldName = opts.botFieldName ?? "bot-field";
   const tsFieldName = opts.tsFieldName ?? "ts";
+  const turnstileFieldName = opts.turnstileFieldName ?? "cf-turnstile-response";
   const now = opts.now ?? Date.now;
   const unavailable = opts.unavailableMessage ?? "This form is temporarily unavailable. Please email us directly.";
   const failed = opts.errorMessage ?? "Something went wrong sending your message. Please try again.";
@@ -97,7 +117,11 @@ function createIngestAction(opts) {
       url,
       token,
       fetch: event.fetch,
-      payload: { ...opts.buildPayload(form, event), formType: opts.formType }
+      payload: {
+        ...opts.buildPayload(form, event),
+        formType: opts.formType,
+        _meta: buildSubmissionMeta(event, form.get(turnstileFieldName)?.toString())
+      }
     });
     if (!result.ok) {
       console.error(`[forms-ingest] ${opts.formType} \u2192 ${result.status}: ${result.error}`);
@@ -126,6 +150,7 @@ function str(v) {
 }
 function createIngestEndpoint(opts) {
   const botFieldName = opts.botFieldName ?? "bot-field";
+  const turnstileFieldName = opts.turnstileFieldName ?? "cf-turnstile-response";
   const unavailable = opts.unavailableMessage ?? "This form is temporarily unavailable. Please email us directly.";
   const failed = opts.errorMessage ?? "Something went wrong sending your message. Please try again.";
   return async (event) => {
@@ -155,7 +180,8 @@ function createIngestEndpoint(opts) {
     try {
       payload = {
         ...opts.buildPayload(body, event),
-        ...opts.formType ? { formType: opts.formType } : {}
+        ...opts.formType ? { formType: opts.formType } : {},
+        _meta: buildSubmissionMeta(event, str(body[turnstileFieldName]))
       };
     } catch (err) {
       console.error(`[forms-ingest] buildPayload threw: ${String(err)}`);

package/dist/forms/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/forms/client.ts","../../src/forms/action.ts","../../src/forms/endpoint.ts"],"sourcesContent":["import { SUBMISSION_FORM_TYPES, type FormType } from \"./types.js\";\n\n/**\n * The JSON a fleet site forwards to the dashboard ingest endpoint. Typed fields\n * are optional; the index signature lets a site include its own extra fields\n * (e.g. `company`) which the dashboard normalizer captures into `extraFields`.\n *\n * Each typed field allows `string | undefined` (not just `string`) so a\n * `buildPayload` mapping can use the idiomatic `form.get(\"name\")?.toString()`\n * pattern under `exactOptionalPropertyTypes` without a cast — an absent field\n * and an explicit `undefined` both serialize away in the JSON body.\n */\nexport type SubmissionPayload = {\n  formType?: FormType | string | undefined;\n  name?: string | undefined;\n  firstName?: string | undefined;\n  lastName?: string | undefined;\n  email?: string | undefined;\n  phone?: string | undefined;\n  message?: string | undefined;\n  sourceUrl?: string | undefined;\n  utm?: string | undefined;\n  [key: string]: unknown;\n};\n\nexport type IngestClientResult =\n  | { ok: true; id: string }\n  | { ok: false; status: number; error: string };\n\nexport type SubmitToIngestOptions = {\n  /** Full ingest endpoint incl. the site slug, e.g. https://…/api/forms/reddoor */\n  url: string;\n  /** The shared FORMS_INGEST_TOKEN. */\n  token: string;\n  payload: SubmissionPayload;\n  /** Injectable fetch (pass SvelteKit's `event.fetch`); defaults to global fetch. */\n  fetch?: typeof fetch;\n};\n\n/**\n * Forward a submission to the dashboard ingest endpoint. Never throws — a network\n * failure or a non-2xx response is returned as `{ ok: false }` so the caller can\n * show a friendly error rather than a 500.\n */\nexport async function submitToIngest(opts: SubmitToIngestOptions): Promise<IngestClientResult> {\n  const doFetch = opts.fetch ?? fetch;\n  let res: Response;\n  try {\n    res = await doFetch(opts.url, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/json\", \"x-forms-token\": opts.token },\n      body: JSON.stringify(opts.payload),\n    });\n  } catch (err) {\n    return { ok: false, status: 0, error: `network error: ${String(err)}` };\n  }\n  let body: unknown = null;\n  try {\n    body = await res.json();\n  } catch {\n    // non-JSON response — fall through to the error path\n  }\n  const obj = body && typeof body === \"object\" ? (body as Record<string, unknown>) : null;\n  if (res.ok && obj && obj.ok === true) {\n    return { ok: true, id: String(obj.id ?? \"\") };\n  }\n  const error = obj && typeof obj.error === \"string\" ? obj.error : `ingest failed (${res.status})`;\n  return { ok: false, status: res.status, error };\n}\n\nexport type SubmitScreenOutOptions = {\n  /** Same ingest endpoint the site already posts submissions to. */\n  url: string;\n  token: string;\n  reason: \"honeypot\" | \"too-fast\";\n  fetch?: typeof fetch;\n  /** Abort budget so a slow/hung beacon can't delay the (already-successful) response. */\n  timeoutMs?: number;\n};\n\n/**\n * Best-effort screen-out beacon: tells the central ingest \"a bot was screened here\"\n * (no PII) so caught-vs-delivered is observable. Never throws — a failure is returned\n * as { ok: false } and the caller ignores it (the visitor already saw success).\n */\nexport async function submitScreenOut(\n  opts: SubmitScreenOutOptions,\n): Promise<{ ok: boolean; status: number }> {\n  const doFetch = opts.fetch ?? fetch;\n  const controller = new AbortController();\n  const timer = setTimeout(() => controller.abort(), opts.timeoutMs ?? 1500);\n  try {\n    const res = await doFetch(opts.url, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/json\", \"x-forms-token\": opts.token },\n      body: JSON.stringify({ screenOut: opts.reason }),\n      signal: controller.signal,\n    });\n    return { ok: res.ok, status: res.status };\n  } catch {\n    return { ok: false, status: 0 };\n  } finally {\n    clearTimeout(timer);\n  }\n}\n\nexport type ScreenInput = { botField?: string | null; elapsedMs?: number | null };\nexport type ScreenResult = { ok: true } | { ok: false; reason: \"honeypot\" | \"too-fast\" };\n\n/**\n * Minimum plausible fill time; faster than this reads as a bot. Kept low (800ms)\n * on purpose: a too-fast fill is dropped *silently* (the visitor sees success),\n * so a real human who happens to be quick — autofill, a short form, a returning\n * visitor — would lose their lead with no trace. Below this, a submit is\n * effectively instant (page render → fill → click → network all under ~0.8s),\n * which a human realistically never beats but a script does. The honeypot is the\n * primary bot signal; this is the secondary one, so it errs toward letting\n * borderline-fast humans through.\n */\nexport const MIN_FILL_MS = 800;\n\n/**\n * Cheap bot screen for the site action. A filled honeypot is a bot; a submission\n * faster than MIN_FILL_MS is a bot. Missing timing data (null/undefined) is NOT a\n * rejection — a prerendered/cached page can't plant a fresh timestamp, and the\n * honeypot remains the primary signal.\n *\n * Any numeric elapsed BELOW the floor — including a NEGATIVE value — is too-fast. A\n * negative elapsed time is impossible for a real fill: it means the client posted a\n * FUTURE timestamp. The earlier `>= 0` guard let that slip through (negative skipped\n * the `< MIN_FILL_MS` branch and returned ok), silently bypassing the timing gate.\n */\nexport function screenSubmission(input: ScreenInput): ScreenResult {\n  if (typeof input.botField === \"string\" && input.botField.trim().length > 0) {\n    return { ok: false, reason: \"honeypot\" };\n  }\n  if (typeof input.elapsedMs === \"number\" && input.elapsedMs < MIN_FILL_MS) {\n    return { ok: false, reason: \"too-fast\" };\n  }\n  return { ok: true };\n}\n\nexport { SUBMISSION_FORM_TYPES, type FormType };\n","import { fail, redirect, type ActionFailure, type RequestEvent } from \"@sveltejs/kit\";\nimport {\n  submitToIngest,\n  screenSubmission,\n  submitScreenOut,\n  type SubmissionPayload,\n} from \"./client.js\";\n\n/** Endpoint + token for the dashboard ingest, read per-request from site env. */\nexport type IngestActionConfig = { url?: string; token?: string };\n\nexport type CreateIngestActionOptions = {\n  /** Stamped onto every payload as `formType` (a SUBMISSION_FORM_TYPES value). */\n  formType: string;\n  /** Read at call time so SvelteKit's dynamic private env resolves per-request. */\n  getConfig: () => IngestActionConfig;\n  /**\n   * Map this form's fields to a payload. The factory's `formType` is always\n   * authoritative and cannot be overridden by `buildPayload`.\n   */\n  buildPayload: (form: FormData, event: RequestEvent) => SubmissionPayload;\n  /** Honeypot input name. Default \"bot-field\". */\n  botFieldName?: string;\n  /** Hidden timestamp input name (planted in `load`). Default \"ts\". */\n  tsFieldName?: string;\n  /** fail(500) copy when env vars are unset. */\n  unavailableMessage?: string;\n  /** fail(502) copy when the ingest endpoint rejects/errors. */\n  errorMessage?: string;\n  /** Injectable clock for tests. Default Date.now. */\n  now?: () => number;\n  /** If set, a successful OR bot-screened submission throws redirect(303, redirectTo)\n   *  instead of returning {success:true} (e.g. a dedicated /thank-you page). */\n  redirectTo?: string;\n};\n\nexport type IngestActionData = { success: true } | ActionFailure<{ error: string }>;\n\n/**\n * Build a SvelteKit `default` form action that screens for bots, forwards the\n * submission to the dashboard ingest endpoint, and returns SvelteKit-shaped\n * results. The per-form field mapping is the only thing a site must supply.\n */\nexport function createIngestAction(\n  opts: CreateIngestActionOptions,\n): (event: RequestEvent) => Promise<IngestActionData> {\n  const botFieldName = opts.botFieldName ?? \"bot-field\";\n  const tsFieldName = opts.tsFieldName ?? \"ts\";\n  const now = opts.now ?? Date.now;\n  const unavailable =\n    opts.unavailableMessage ?? \"This form is temporarily unavailable. Please email us directly.\";\n  const failed =\n    opts.errorMessage ?? \"Something went wrong sending your message. Please try again.\";\n\n  return async (event) => {\n    let form: FormData;\n    try {\n      form = await event.request.formData();\n    } catch {\n      console.error(`[forms-ingest] ${opts.formType}: could not parse form body`);\n      return fail(400, { error: failed });\n    }\n\n    // Bot screen: a filled honeypot OR an implausibly fast fill is silently\n    // accepted (return success, do NOT forward) so bots get no signal.\n    const screen = screenSubmission({\n      botField: form.get(botFieldName)?.toString() ?? null,\n      elapsedMs: elapsedMs(form.get(tsFieldName), now),\n    });\n    if (!screen.ok) {\n      // Best-effort screen-out beacon (no PII) so catch-rate is observable, then\n      // succeed exactly as before — the bot/visitor still sees success.\n      const cfg = opts.getConfig();\n      if (cfg.url && cfg.token) {\n        await submitScreenOut({\n          url: cfg.url,\n          token: cfg.token,\n          reason: screen.reason,\n          fetch: event.fetch,\n        });\n      }\n      return succeed();\n    }\n\n    const { url, token } = opts.getConfig();\n    if (!url || !token) {\n      console.error(`[forms-ingest] config missing for formType=${opts.formType}`);\n      return fail(500, { error: unavailable });\n    }\n\n    const result = await submitToIngest({\n      url,\n      token,\n      fetch: event.fetch,\n      payload: { ...opts.buildPayload(form, event), formType: opts.formType },\n    });\n    if (!result.ok) {\n      console.error(`[forms-ingest] ${opts.formType} → ${result.status}: ${result.error}`);\n      return fail(502, { error: failed });\n    }\n    return succeed();\n  };\n\n  // Single success path: redirect when configured (e.g. a dedicated /thank-you\n  // page), otherwise return the SvelteKit-shaped success. `redirect()` throws, so\n  // the trailing `return` keeps the `{ success: true }` type.\n  function succeed(): { success: true } {\n    if (opts.redirectTo) redirect(303, opts.redirectTo);\n    return { success: true };\n  }\n}\n\n// `FormDataEntryValue` is a DOM-lib global; this package compiles with only the\n// ES2022 lib + @types/node, where it is not in scope. Derive the type from the\n// in-scope `FormData.get` return instead — same value, no DOM-lib dependency.\nfunction elapsedMs(tsRaw: ReturnType<FormData[\"get\"]>, now: () => number): number | null {\n  const ts = Number(tsRaw);\n  if (!Number.isFinite(ts) || ts <= 0) return null;\n  // Clamp at 0: elapsed time can't be negative. A future `ts` (clock skew or a bot\n  // forging one) would otherwise yield a negative value; clamping makes it read as\n  // 0ms (effectively instant) so the MIN_FILL_MS gate still trips. Defense-in-depth\n  // with screenSubmission, which also treats any sub-floor elapsed as too-fast.\n  return Math.max(0, now() - ts);\n}\n","import { json, type RequestEvent } from \"@sveltejs/kit\";\nimport {\n  submitToIngest,\n  screenSubmission,\n  submitScreenOut,\n  type SubmissionPayload,\n} from \"./client.js\";\nimport { SUBMISSION_FORM_TYPES, type FormType } from \"./types.js\";\nimport type { IngestActionConfig } from \"./action.js\";\n\n/**\n * Options for {@link createIngestEndpoint} — the JSON sibling of\n * `createIngestAction` for client-driven forms (modals / lightboxes / fetch)\n * that POST JSON to a `+server.ts` route instead of using a form action.\n */\nexport type CreateIngestEndpointOptions = {\n  /** Read at call time so SvelteKit's dynamic private env resolves per-request. */\n  getConfig: () => IngestActionConfig;\n  /**\n   * Map the parsed JSON body to a payload. Must set `formType` UNLESS the fixed\n   * `formType` option is provided (then that is authoritative and overrides it).\n   */\n  buildPayload: (body: Record<string, unknown>, event: RequestEvent) => SubmissionPayload;\n  /** Fixed formType for single-type endpoints; omit for multi-type endpoints\n   *  where `buildPayload` derives formType from the body. */\n  formType?: string;\n  /** Honeypot field name in the JSON body. Default \"bot-field\". */\n  botFieldName?: string;\n  /** json(500) copy when env vars are unset. */\n  unavailableMessage?: string;\n  /** json(400/502) copy for bad input / ingest failure. */\n  errorMessage?: string;\n};\n\nfunction isFormType(v: unknown): v is FormType {\n  return typeof v === \"string\" && (SUBMISSION_FORM_TYPES as readonly string[]).includes(v);\n}\n\nfunction str(v: unknown): string | undefined {\n  return typeof v === \"string\" ? v : undefined;\n}\n\n/**\n * Build a JSON `POST` handler that screens for bots, forwards the submission to\n * the dashboard ingest endpoint, and returns `{ ok }`-shaped JSON. The per-form\n * field mapping (`buildPayload`) is the only thing a site must supply. The\n * returned function is structurally a SvelteKit `RequestHandler`.\n */\nexport function createIngestEndpoint(\n  opts: CreateIngestEndpointOptions,\n): (event: RequestEvent) => Promise<Response> {\n  const botFieldName = opts.botFieldName ?? \"bot-field\";\n  const unavailable =\n    opts.unavailableMessage ?? \"This form is temporarily unavailable. Please email us directly.\";\n  const failed =\n    opts.errorMessage ?? \"Something went wrong sending your message. Please try again.\";\n\n  return async (event) => {\n    let body: Record<string, unknown>;\n    try {\n      const parsed: unknown = await event.request.json();\n      if (!parsed || typeof parsed !== \"object\") throw new Error(\"body is not an object\");\n      body = parsed as Record<string, unknown>;\n    } catch {\n      console.error(\"[forms-ingest] could not parse JSON body\");\n      return json({ ok: false, error: failed }, { status: 400 });\n    }\n\n    // Bot screen: honeypot only. A client POST carries no server-planted ts, and\n    // screenSubmission treats a missing elapsedMs as OK. A filled honeypot is\n    // silently accepted (return ok, do NOT forward) so bots get no signal.\n    const screen = screenSubmission({ botField: str(body[botFieldName]) ?? null });\n    if (!screen.ok) {\n      // Best-effort screen-out beacon (no PII) so catch-rate is observable, then\n      // return success exactly as before — the bot/visitor still sees success.\n      const cfg = opts.getConfig();\n      if (cfg.url && cfg.token) {\n        await submitScreenOut({\n          url: cfg.url,\n          token: cfg.token,\n          reason: screen.reason,\n          fetch: event.fetch,\n        });\n      }\n      return json({ ok: true });\n    }\n\n    // buildPayload runs on untrusted JSON; a careless field access (e.g.\n    // `body.name.trim()` on a non-string) would otherwise escape as a 500. Treat\n    // a throw as a malformed request (400), keeping the \"never 500s\" guarantee.\n    let payload: SubmissionPayload;\n    try {\n      payload = {\n        ...opts.buildPayload(body, event),\n        ...(opts.formType ? { formType: opts.formType } : {}),\n      };\n    } catch (err) {\n      console.error(`[forms-ingest] buildPayload threw: ${String(err)}`);\n      return json({ ok: false, error: failed }, { status: 400 });\n    }\n    if (!isFormType(payload.formType)) {\n      console.error(`[forms-ingest] invalid formType: ${String(payload.formType)}`);\n      return json({ ok: false, error: failed }, { status: 400 });\n    }\n\n    const { url, token } = opts.getConfig();\n    if (!url || !token) {\n      console.error(`[forms-ingest] config missing for formType=${payload.formType}`);\n      return json({ ok: false, error: unavailable }, { status: 500 });\n    }\n\n    const result = await submitToIngest({ url, token, fetch: event.fetch, payload });\n    if (!result.ok) {\n      console.error(`[forms-ingest] ${payload.formType} → ${result.status}: ${result.error}`);\n      return json({ ok: false, error: failed }, { status: 502 });\n    }\n    return json({ ok: true });\n  };\n}\n"],"mappings":";;;;;AA4CA,eAAsB,eAAe,MAA0D;AAC7F,QAAM,UAAU,KAAK,SAAS;AAC9B,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,QAAQ,KAAK,KAAK;AAAA,MAC5B,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,oBAAoB,iBAAiB,KAAK,MAAM;AAAA,MAC3E,MAAM,KAAK,UAAU,KAAK,OAAO;AAAA,IACnC,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,WAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,OAAO,kBAAkB,OAAO,GAAG,CAAC,GAAG;AAAA,EACxE;AACA,MAAI,OAAgB;AACpB,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AAAA,EAER;AACA,QAAM,MAAM,QAAQ,OAAO,SAAS,WAAY,OAAmC;AACnF,MAAI,IAAI,MAAM,OAAO,IAAI,OAAO,MAAM;AACpC,WAAO,EAAE,IAAI,MAAM,IAAI,OAAO,IAAI,MAAM,EAAE,EAAE;AAAA,EAC9C;AACA,QAAM,QAAQ,OAAO,OAAO,IAAI,UAAU,WAAW,IAAI,QAAQ,kBAAkB,IAAI,MAAM;AAC7F,SAAO,EAAE,IAAI,OAAO,QAAQ,IAAI,QAAQ,MAAM;AAChD;AAiBA,eAAsB,gBACpB,MAC0C;AAC1C,QAAM,UAAU,KAAK,SAAS;AAC9B,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,KAAK,aAAa,IAAI;AACzE,MAAI;AACF,UAAM,MAAM,MAAM,QAAQ,KAAK,KAAK;AAAA,MAClC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,oBAAoB,iBAAiB,KAAK,MAAM;AAAA,MAC3E,MAAM,KAAK,UAAU,EAAE,WAAW,KAAK,OAAO,CAAC;AAAA,MAC/C,QAAQ,WAAW;AAAA,IACrB,CAAC;AACD,WAAO,EAAE,IAAI,IAAI,IAAI,QAAQ,IAAI,OAAO;AAAA,EAC1C,QAAQ;AACN,WAAO,EAAE,IAAI,OAAO,QAAQ,EAAE;AAAA,EAChC,UAAE;AACA,iBAAa,KAAK;AAAA,EACpB;AACF;AAeO,IAAM,cAAc;AAapB,SAAS,iBAAiB,OAAkC;AACjE,MAAI,OAAO,MAAM,aAAa,YAAY,MAAM,SAAS,KAAK,EAAE,SAAS,GAAG;AAC1E,WAAO,EAAE,IAAI,OAAO,QAAQ,WAAW;AAAA,EACzC;AACA,MAAI,OAAO,MAAM,cAAc,YAAY,MAAM,YAAY,aAAa;AACxE,WAAO,EAAE,IAAI,OAAO,QAAQ,WAAW;AAAA,EACzC;AACA,SAAO,EAAE,IAAI,KAAK;AACpB;;;AC5IA,SAAS,MAAM,gBAAuD;AA2C/D,SAAS,mBACd,MACoD;AACpD,QAAM,eAAe,KAAK,gBAAgB;AAC1C,QAAM,cAAc,KAAK,eAAe;AACxC,QAAM,MAAM,KAAK,OAAO,KAAK;AAC7B,QAAM,cACJ,KAAK,sBAAsB;AAC7B,QAAM,SACJ,KAAK,gBAAgB;AAEvB,SAAO,OAAO,UAAU;AACtB,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,MAAM,QAAQ,SAAS;AAAA,IACtC,QAAQ;AACN,cAAQ,MAAM,kBAAkB,KAAK,QAAQ,6BAA6B;AAC1E,aAAO,KAAK,KAAK,EAAE,OAAO,OAAO,CAAC;AAAA,IACpC;AAIA,UAAM,SAAS,iBAAiB;AAAA,MAC9B,UAAU,KAAK,IAAI,YAAY,GAAG,SAAS,KAAK;AAAA,MAChD,WAAW,UAAU,KAAK,IAAI,WAAW,GAAG,GAAG;AAAA,IACjD,CAAC;AACD,QAAI,CAAC,OAAO,IAAI;AAGd,YAAM,MAAM,KAAK,UAAU;AAC3B,UAAI,IAAI,OAAO,IAAI,OAAO;AACxB,cAAM,gBAAgB;AAAA,UACpB,KAAK,IAAI;AAAA,UACT,OAAO,IAAI;AAAA,UACX,QAAQ,OAAO;AAAA,UACf,OAAO,MAAM;AAAA,QACf,CAAC;AAAA,MACH;AACA,aAAO,QAAQ;AAAA,IACjB;AAEA,UAAM,EAAE,KAAK,MAAM,IAAI,KAAK,UAAU;AACtC,QAAI,CAAC,OAAO,CAAC,OAAO;AAClB,cAAQ,MAAM,8CAA8C,KAAK,QAAQ,EAAE;AAC3E,aAAO,KAAK,KAAK,EAAE,OAAO,YAAY,CAAC;AAAA,IACzC;AAEA,UAAM,SAAS,MAAM,eAAe;AAAA,MAClC;AAAA,MACA;AAAA,MACA,OAAO,MAAM;AAAA,MACb,SAAS,EAAE,GAAG,KAAK,aAAa,MAAM,KAAK,GAAG,UAAU,KAAK,SAAS;AAAA,IACxE,CAAC;AACD,QAAI,CAAC,OAAO,IAAI;AACd,cAAQ,MAAM,kBAAkB,KAAK,QAAQ,WAAM,OAAO,MAAM,KAAK,OAAO,KAAK,EAAE;AACnF,aAAO,KAAK,KAAK,EAAE,OAAO,OAAO,CAAC;AAAA,IACpC;AACA,WAAO,QAAQ;AAAA,EACjB;AAKA,WAAS,UAA6B;AACpC,QAAI,KAAK,WAAY,UAAS,KAAK,KAAK,UAAU;AAClD,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB;AACF;AAKA,SAAS,UAAU,OAAoC,KAAkC;AACvF,QAAM,KAAK,OAAO,KAAK;AACvB,MAAI,CAAC,OAAO,SAAS,EAAE,KAAK,MAAM,EAAG,QAAO;AAK5C,SAAO,KAAK,IAAI,GAAG,IAAI,IAAI,EAAE;AAC/B;;;AC3HA,SAAS,YAA+B;AAkCxC,SAAS,WAAW,GAA2B;AAC7C,SAAO,OAAO,MAAM,YAAa,sBAA4C,SAAS,CAAC;AACzF;AAEA,SAAS,IAAI,GAAgC;AAC3C,SAAO,OAAO,MAAM,WAAW,IAAI;AACrC;AAQO,SAAS,qBACd,MAC4C;AAC5C,QAAM,eAAe,KAAK,gBAAgB;AAC1C,QAAM,cACJ,KAAK,sBAAsB;AAC7B,QAAM,SACJ,KAAK,gBAAgB;AAEvB,SAAO,OAAO,UAAU;AACtB,QAAI;AACJ,QAAI;AACF,YAAM,SAAkB,MAAM,MAAM,QAAQ,KAAK;AACjD,UAAI,CAAC,UAAU,OAAO,WAAW,SAAU,OAAM,IAAI,MAAM,uBAAuB;AAClF,aAAO;AAAA,IACT,QAAQ;AACN,cAAQ,MAAM,0CAA0C;AACxD,aAAO,KAAK,EAAE,IAAI,OAAO,OAAO,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3D;AAKA,UAAM,SAAS,iBAAiB,EAAE,UAAU,IAAI,KAAK,YAAY,CAAC,KAAK,KAAK,CAAC;AAC7E,QAAI,CAAC,OAAO,IAAI;AAGd,YAAM,MAAM,KAAK,UAAU;AAC3B,UAAI,IAAI,OAAO,IAAI,OAAO;AACxB,cAAM,gBAAgB;AAAA,UACpB,KAAK,IAAI;AAAA,UACT,OAAO,IAAI;AAAA,UACX,QAAQ,OAAO;AAAA,UACf,OAAO,MAAM;AAAA,QACf,CAAC;AAAA,MACH;AACA,aAAO,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,IAC1B;AAKA,QAAI;AACJ,QAAI;AACF,gBAAU;AAAA,QACR,GAAG,KAAK,aAAa,MAAM,KAAK;AAAA,QAChC,GAAI,KAAK,WAAW,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC;AAAA,MACrD;AAAA,IACF,SAAS,KAAK;AACZ,cAAQ,MAAM,sCAAsC,OAAO,GAAG,CAAC,EAAE;AACjE,aAAO,KAAK,EAAE,IAAI,OAAO,OAAO,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3D;AACA,QAAI,CAAC,WAAW,QAAQ,QAAQ,GAAG;AACjC,cAAQ,MAAM,oCAAoC,OAAO,QAAQ,QAAQ,CAAC,EAAE;AAC5E,aAAO,KAAK,EAAE,IAAI,OAAO,OAAO,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3D;AAEA,UAAM,EAAE,KAAK,MAAM,IAAI,KAAK,UAAU;AACtC,QAAI,CAAC,OAAO,CAAC,OAAO;AAClB,cAAQ,MAAM,8CAA8C,QAAQ,QAAQ,EAAE;AAC9E,aAAO,KAAK,EAAE,IAAI,OAAO,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAChE;AAEA,UAAM,SAAS,MAAM,eAAe,EAAE,KAAK,OAAO,OAAO,MAAM,OAAO,QAAQ,CAAC;AAC/E,QAAI,CAAC,OAAO,IAAI;AACd,cAAQ,MAAM,kBAAkB,QAAQ,QAAQ,WAAM,OAAO,MAAM,KAAK,OAAO,KAAK,EAAE;AACtF,aAAO,KAAK,EAAE,IAAI,OAAO,OAAO,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3D;AACA,WAAO,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EAC1B;AACF;","names":[]}
+{"version":3,"sources":["../../src/forms/client.ts","../../src/forms/action.ts","../../src/forms/meta.ts","../../src/forms/endpoint.ts"],"sourcesContent":["import { SUBMISSION_FORM_TYPES, type FormType } from \"./types.js\";\nimport type { SubmissionMeta } from \"./meta.js\";\n\n/**\n * The JSON a fleet site forwards to the dashboard ingest endpoint. Typed fields\n * are optional; the index signature lets a site include its own extra fields\n * (e.g. `company`) which the dashboard normalizer captures into `extraFields`.\n *\n * Each typed field allows `string | undefined` (not just `string`) so a\n * `buildPayload` mapping can use the idiomatic `form.get(\"name\")?.toString()`\n * pattern under `exactOptionalPropertyTypes` without a cast — an absent field\n * and an explicit `undefined` both serialize away in the JSON body.\n */\nexport type SubmissionPayload = {\n  formType?: FormType | string | undefined;\n  name?: string | undefined;\n  firstName?: string | undefined;\n  lastName?: string | undefined;\n  email?: string | undefined;\n  phone?: string | undefined;\n  message?: string | undefined;\n  sourceUrl?: string | undefined;\n  utm?: string | undefined;\n  /** Reserved transport envelope (token/IP/UA); stripped centrally, never persisted. */\n  _meta?: SubmissionMeta | undefined;\n  [key: string]: unknown;\n};\n\nexport type IngestClientResult =\n  | { ok: true; id: string }\n  | { ok: false; status: number; error: string };\n\nexport type SubmitToIngestOptions = {\n  /** Full ingest endpoint incl. the site slug, e.g. https://…/api/forms/reddoor */\n  url: string;\n  /** The shared FORMS_INGEST_TOKEN. */\n  token: string;\n  payload: SubmissionPayload;\n  /** Injectable fetch (pass SvelteKit's `event.fetch`); defaults to global fetch. */\n  fetch?: typeof fetch;\n};\n\n/**\n * Forward a submission to the dashboard ingest endpoint. Never throws — a network\n * failure or a non-2xx response is returned as `{ ok: false }` so the caller can\n * show a friendly error rather than a 500.\n */\nexport async function submitToIngest(opts: SubmitToIngestOptions): Promise<IngestClientResult> {\n  const doFetch = opts.fetch ?? fetch;\n  let res: Response;\n  try {\n    res = await doFetch(opts.url, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/json\", \"x-forms-token\": opts.token },\n      body: JSON.stringify(opts.payload),\n    });\n  } catch (err) {\n    return { ok: false, status: 0, error: `network error: ${String(err)}` };\n  }\n  let body: unknown = null;\n  try {\n    body = await res.json();\n  } catch {\n    // non-JSON response — fall through to the error path\n  }\n  const obj = body && typeof body === \"object\" ? (body as Record<string, unknown>) : null;\n  if (res.ok && obj && obj.ok === true) {\n    return { ok: true, id: String(obj.id ?? \"\") };\n  }\n  const error = obj && typeof obj.error === \"string\" ? obj.error : `ingest failed (${res.status})`;\n  return { ok: false, status: res.status, error };\n}\n\nexport type SubmitScreenOutOptions = {\n  /** Same ingest endpoint the site already posts submissions to. */\n  url: string;\n  token: string;\n  reason: \"honeypot\" | \"too-fast\";\n  fetch?: typeof fetch;\n  /** Abort budget so a slow/hung beacon can't delay the (already-successful) response. */\n  timeoutMs?: number;\n};\n\n/**\n * Best-effort screen-out beacon: tells the central ingest \"a bot was screened here\"\n * (no PII) so caught-vs-delivered is observable. Never throws — a failure is returned\n * as { ok: false } and the caller ignores it (the visitor already saw success).\n */\nexport async function submitScreenOut(\n  opts: SubmitScreenOutOptions,\n): Promise<{ ok: boolean; status: number }> {\n  const doFetch = opts.fetch ?? fetch;\n  const controller = new AbortController();\n  const timer = setTimeout(() => controller.abort(), opts.timeoutMs ?? 1500);\n  try {\n    const res = await doFetch(opts.url, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/json\", \"x-forms-token\": opts.token },\n      body: JSON.stringify({ screenOut: opts.reason }),\n      signal: controller.signal,\n    });\n    return { ok: res.ok, status: res.status };\n  } catch {\n    return { ok: false, status: 0 };\n  } finally {\n    clearTimeout(timer);\n  }\n}\n\nexport type ScreenInput = { botField?: string | null; elapsedMs?: number | null };\nexport type ScreenResult = { ok: true } | { ok: false; reason: \"honeypot\" | \"too-fast\" };\n\n/**\n * Minimum plausible fill time; faster than this reads as a bot. Kept low (800ms)\n * on purpose: a too-fast fill is dropped *silently* (the visitor sees success),\n * so a real human who happens to be quick — autofill, a short form, a returning\n * visitor — would lose their lead with no trace. Below this, a submit is\n * effectively instant (page render → fill → click → network all under ~0.8s),\n * which a human realistically never beats but a script does. The honeypot is the\n * primary bot signal; this is the secondary one, so it errs toward letting\n * borderline-fast humans through.\n */\nexport const MIN_FILL_MS = 800;\n\n/**\n * Cheap bot screen for the site action. A filled honeypot is a bot; a submission\n * faster than MIN_FILL_MS is a bot. Missing timing data (null/undefined) is NOT a\n * rejection — a prerendered/cached page can't plant a fresh timestamp, and the\n * honeypot remains the primary signal.\n *\n * Any numeric elapsed BELOW the floor — including a NEGATIVE value — is too-fast. A\n * negative elapsed time is impossible for a real fill: it means the client posted a\n * FUTURE timestamp. The earlier `>= 0` guard let that slip through (negative skipped\n * the `< MIN_FILL_MS` branch and returned ok), silently bypassing the timing gate.\n */\nexport function screenSubmission(input: ScreenInput): ScreenResult {\n  if (typeof input.botField === \"string\" && input.botField.trim().length > 0) {\n    return { ok: false, reason: \"honeypot\" };\n  }\n  if (typeof input.elapsedMs === \"number\" && input.elapsedMs < MIN_FILL_MS) {\n    return { ok: false, reason: \"too-fast\" };\n  }\n  return { ok: true };\n}\n\nexport { SUBMISSION_FORM_TYPES, type FormType };\n","import { fail, redirect, type ActionFailure, type RequestEvent } from \"@sveltejs/kit\";\nimport {\n  submitToIngest,\n  screenSubmission,\n  submitScreenOut,\n  type SubmissionPayload,\n} from \"./client.js\";\nimport { buildSubmissionMeta } from \"./meta.js\";\n\n/** Endpoint + token for the dashboard ingest, read per-request from site env. */\nexport type IngestActionConfig = { url?: string; token?: string };\n\nexport type CreateIngestActionOptions = {\n  /** Stamped onto every payload as `formType` (a SUBMISSION_FORM_TYPES value). */\n  formType: string;\n  /** Read at call time so SvelteKit's dynamic private env resolves per-request. */\n  getConfig: () => IngestActionConfig;\n  /**\n   * Map this form's fields to a payload. The factory's `formType` is always\n   * authoritative and cannot be overridden by `buildPayload`.\n   */\n  buildPayload: (form: FormData, event: RequestEvent) => SubmissionPayload;\n  /** Honeypot input name. Default \"bot-field\". */\n  botFieldName?: string;\n  /** Hidden timestamp input name (planted in `load`). Default \"ts\". */\n  tsFieldName?: string;\n  /** Field carrying the Cloudflare Turnstile token. Default \"cf-turnstile-response\". */\n  turnstileFieldName?: string;\n  /** fail(500) copy when env vars are unset. */\n  unavailableMessage?: string;\n  /** fail(502) copy when the ingest endpoint rejects/errors. */\n  errorMessage?: string;\n  /** Injectable clock for tests. Default Date.now. */\n  now?: () => number;\n  /** If set, a successful OR bot-screened submission throws redirect(303, redirectTo)\n   *  instead of returning {success:true} (e.g. a dedicated /thank-you page). */\n  redirectTo?: string;\n};\n\nexport type IngestActionData = { success: true } | ActionFailure<{ error: string }>;\n\n/**\n * Build a SvelteKit `default` form action that screens for bots, forwards the\n * submission to the dashboard ingest endpoint, and returns SvelteKit-shaped\n * results. The per-form field mapping is the only thing a site must supply.\n */\nexport function createIngestAction(\n  opts: CreateIngestActionOptions,\n): (event: RequestEvent) => Promise<IngestActionData> {\n  const botFieldName = opts.botFieldName ?? \"bot-field\";\n  const tsFieldName = opts.tsFieldName ?? \"ts\";\n  const turnstileFieldName = opts.turnstileFieldName ?? \"cf-turnstile-response\";\n  const now = opts.now ?? Date.now;\n  const unavailable =\n    opts.unavailableMessage ?? \"This form is temporarily unavailable. Please email us directly.\";\n  const failed =\n    opts.errorMessage ?? \"Something went wrong sending your message. Please try again.\";\n\n  return async (event) => {\n    let form: FormData;\n    try {\n      form = await event.request.formData();\n    } catch {\n      console.error(`[forms-ingest] ${opts.formType}: could not parse form body`);\n      return fail(400, { error: failed });\n    }\n\n    // Bot screen: a filled honeypot OR an implausibly fast fill is silently\n    // accepted (return success, do NOT forward) so bots get no signal.\n    const screen = screenSubmission({\n      botField: form.get(botFieldName)?.toString() ?? null,\n      elapsedMs: elapsedMs(form.get(tsFieldName), now),\n    });\n    if (!screen.ok) {\n      // Best-effort screen-out beacon (no PII) so catch-rate is observable, then\n      // succeed exactly as before — the bot/visitor still sees success.\n      const cfg = opts.getConfig();\n      if (cfg.url && cfg.token) {\n        await submitScreenOut({\n          url: cfg.url,\n          token: cfg.token,\n          reason: screen.reason,\n          fetch: event.fetch,\n        });\n      }\n      return succeed();\n    }\n\n    const { url, token } = opts.getConfig();\n    if (!url || !token) {\n      console.error(`[forms-ingest] config missing for formType=${opts.formType}`);\n      return fail(500, { error: unavailable });\n    }\n\n    const result = await submitToIngest({\n      url,\n      token,\n      fetch: event.fetch,\n      payload: {\n        ...opts.buildPayload(form, event),\n        formType: opts.formType,\n        _meta: buildSubmissionMeta(event, form.get(turnstileFieldName)?.toString()),\n      },\n    });\n    if (!result.ok) {\n      console.error(`[forms-ingest] ${opts.formType} → ${result.status}: ${result.error}`);\n      return fail(502, { error: failed });\n    }\n    return succeed();\n  };\n\n  // Single success path: redirect when configured (e.g. a dedicated /thank-you\n  // page), otherwise return the SvelteKit-shaped success. `redirect()` throws, so\n  // the trailing `return` keeps the `{ success: true }` type.\n  function succeed(): { success: true } {\n    if (opts.redirectTo) redirect(303, opts.redirectTo);\n    return { success: true };\n  }\n}\n\n// `FormDataEntryValue` is a DOM-lib global; this package compiles with only the\n// ES2022 lib + @types/node, where it is not in scope. Derive the type from the\n// in-scope `FormData.get` return instead — same value, no DOM-lib dependency.\nfunction elapsedMs(tsRaw: ReturnType<FormData[\"get\"]>, now: () => number): number | null {\n  const ts = Number(tsRaw);\n  if (!Number.isFinite(ts) || ts <= 0) return null;\n  // Clamp at 0: elapsed time can't be negative. A future `ts` (clock skew or a bot\n  // forging one) would otherwise yield a negative value; clamping makes it read as\n  // 0ms (effectively instant) so the MIN_FILL_MS gate still trips. Defense-in-depth\n  // with screenSubmission, which also treats any sub-floor elapsed as too-fast.\n  return Math.max(0, now() - ts);\n}\n","/** The reserved wire envelope a fleet site forwards alongside the lead fields. */\nexport type SubmissionMeta = {\n  turnstileToken?: string;\n  clientIp?: string;\n  userAgent?: string;\n};\n\nfunction str(v: unknown): string {\n  return typeof v === \"string\" ? v.trim() : \"\";\n}\n\n/**\n * Defensively read the reserved `_meta` envelope off an untrusted ingest payload\n * (CENTRAL side, used by the ingest handler). Keeps only non-blank string fields,\n * dropping the rest, so a bot cannot smuggle a non-string clientIp/userAgent into\n * the transient scoring path. The token/IP/UA read here are used transiently\n * (Turnstile `remoteip` + scoring) and are NEVER persisted; the token is never\n * stored. The SITE-side writer (`buildSubmissionMeta`) is added by the\n * site-factory task; `readMeta` is the single reader (there is no `parseMeta`).\n */\nexport function readMeta(payload: unknown): SubmissionMeta {\n  const meta: SubmissionMeta = {};\n  if (typeof payload !== \"object\" || payload === null) return meta;\n  const raw = (payload as Record<string, unknown>)._meta;\n  if (typeof raw !== \"object\" || raw === null) return meta;\n  const m = raw as Record<string, unknown>;\n  const token = str(m.turnstileToken);\n  if (token) meta.turnstileToken = token;\n  const ip = str(m.clientIp);\n  if (ip) meta.clientIp = ip;\n  const ua = str(m.userAgent);\n  if (ua) meta.userAgent = ua;\n  return meta;\n}\n\n/**\n * SITE-side event shape `buildSubmissionMeta` reads. Structural (not SvelteKit's\n * `RequestEvent`) so this leaf stays SDK-free; a real `RequestEvent` is\n * structurally assignable (`getClientAddress: () => string`, `request.headers`\n * is a `Headers` with a `get`).\n */\ntype MetaEvent = {\n  getClientAddress?: () => string;\n  request?: { headers?: { get?: (name: string) => string | null } };\n};\n\n/**\n * Build the transient `_meta` envelope a site forwards to central ingest:\n * `{ turnstileToken?, clientIp?, userAgent? }`. Returns `undefined` when no\n * field yields a value so callers can attach it unconditionally without\n * polluting the payload (an `undefined` value is dropped by `JSON.stringify`).\n * `getClientAddress` is guarded (some adapters lack a client address and can\n * throw); UA is read defensively. None of this is ever persisted.\n */\nexport function buildSubmissionMeta(\n  event: MetaEvent,\n  turnstileToken: string | null | undefined,\n): SubmissionMeta | undefined {\n  const meta: SubmissionMeta = {};\n\n  const token = typeof turnstileToken === \"string\" ? turnstileToken.trim() : \"\";\n  if (token) meta.turnstileToken = token;\n\n  if (typeof event.getClientAddress === \"function\") {\n    try {\n      const ip = event.getClientAddress();\n      if (typeof ip === \"string\" && ip.trim()) meta.clientIp = ip.trim();\n    } catch {\n      // Some adapters have no client address and throw; drop clientIp silently.\n    }\n  }\n\n  const ua = event.request?.headers?.get?.(\"user-agent\");\n  if (typeof ua === \"string\" && ua.trim()) meta.userAgent = ua.trim();\n\n  return Object.keys(meta).length > 0 ? meta : undefined;\n}\n","import { json, type RequestEvent } from \"@sveltejs/kit\";\nimport {\n  submitToIngest,\n  screenSubmission,\n  submitScreenOut,\n  type SubmissionPayload,\n} from \"./client.js\";\nimport { SUBMISSION_FORM_TYPES, type FormType } from \"./types.js\";\nimport type { IngestActionConfig } from \"./action.js\";\nimport { buildSubmissionMeta } from \"./meta.js\";\n\n/**\n * Options for {@link createIngestEndpoint} — the JSON sibling of\n * `createIngestAction` for client-driven forms (modals / lightboxes / fetch)\n * that POST JSON to a `+server.ts` route instead of using a form action.\n */\nexport type CreateIngestEndpointOptions = {\n  /** Read at call time so SvelteKit's dynamic private env resolves per-request. */\n  getConfig: () => IngestActionConfig;\n  /**\n   * Map the parsed JSON body to a payload. Must set `formType` UNLESS the fixed\n   * `formType` option is provided (then that is authoritative and overrides it).\n   */\n  buildPayload: (body: Record<string, unknown>, event: RequestEvent) => SubmissionPayload;\n  /** Fixed formType for single-type endpoints; omit for multi-type endpoints\n   *  where `buildPayload` derives formType from the body. */\n  formType?: string;\n  /** Honeypot field name in the JSON body. Default \"bot-field\". */\n  botFieldName?: string;\n  /** Field carrying the Cloudflare Turnstile token. Default \"cf-turnstile-response\". */\n  turnstileFieldName?: string;\n  /** json(500) copy when env vars are unset. */\n  unavailableMessage?: string;\n  /** json(400/502) copy for bad input / ingest failure. */\n  errorMessage?: string;\n};\n\nfunction isFormType(v: unknown): v is FormType {\n  return typeof v === \"string\" && (SUBMISSION_FORM_TYPES as readonly string[]).includes(v);\n}\n\nfunction str(v: unknown): string | undefined {\n  return typeof v === \"string\" ? v : undefined;\n}\n\n/**\n * Build a JSON `POST` handler that screens for bots, forwards the submission to\n * the dashboard ingest endpoint, and returns `{ ok }`-shaped JSON. The per-form\n * field mapping (`buildPayload`) is the only thing a site must supply. The\n * returned function is structurally a SvelteKit `RequestHandler`.\n */\nexport function createIngestEndpoint(\n  opts: CreateIngestEndpointOptions,\n): (event: RequestEvent) => Promise<Response> {\n  const botFieldName = opts.botFieldName ?? \"bot-field\";\n  const turnstileFieldName = opts.turnstileFieldName ?? \"cf-turnstile-response\";\n  const unavailable =\n    opts.unavailableMessage ?? \"This form is temporarily unavailable. Please email us directly.\";\n  const failed =\n    opts.errorMessage ?? \"Something went wrong sending your message. Please try again.\";\n\n  return async (event) => {\n    let body: Record<string, unknown>;\n    try {\n      const parsed: unknown = await event.request.json();\n      if (!parsed || typeof parsed !== \"object\") throw new Error(\"body is not an object\");\n      body = parsed as Record<string, unknown>;\n    } catch {\n      console.error(\"[forms-ingest] could not parse JSON body\");\n      return json({ ok: false, error: failed }, { status: 400 });\n    }\n\n    // Bot screen: honeypot only. A client POST carries no server-planted ts, and\n    // screenSubmission treats a missing elapsedMs as OK. A filled honeypot is\n    // silently accepted (return ok, do NOT forward) so bots get no signal.\n    const screen = screenSubmission({ botField: str(body[botFieldName]) ?? null });\n    if (!screen.ok) {\n      // Best-effort screen-out beacon (no PII) so catch-rate is observable, then\n      // return success exactly as before — the bot/visitor still sees success.\n      const cfg = opts.getConfig();\n      if (cfg.url && cfg.token) {\n        await submitScreenOut({\n          url: cfg.url,\n          token: cfg.token,\n          reason: screen.reason,\n          fetch: event.fetch,\n        });\n      }\n      return json({ ok: true });\n    }\n\n    // buildPayload runs on untrusted JSON; a careless field access (e.g.\n    // `body.name.trim()` on a non-string) would otherwise escape as a 500. Treat\n    // a throw as a malformed request (400), keeping the \"never 500s\" guarantee.\n    let payload: SubmissionPayload;\n    try {\n      payload = {\n        ...opts.buildPayload(body, event),\n        ...(opts.formType ? { formType: opts.formType } : {}),\n        _meta: buildSubmissionMeta(event, str(body[turnstileFieldName])),\n      };\n    } catch (err) {\n      console.error(`[forms-ingest] buildPayload threw: ${String(err)}`);\n      return json({ ok: false, error: failed }, { status: 400 });\n    }\n    if (!isFormType(payload.formType)) {\n      console.error(`[forms-ingest] invalid formType: ${String(payload.formType)}`);\n      return json({ ok: false, error: failed }, { status: 400 });\n    }\n\n    const { url, token } = opts.getConfig();\n    if (!url || !token) {\n      console.error(`[forms-ingest] config missing for formType=${payload.formType}`);\n      return json({ ok: false, error: unavailable }, { status: 500 });\n    }\n\n    const result = await submitToIngest({ url, token, fetch: event.fetch, payload });\n    if (!result.ok) {\n      console.error(`[forms-ingest] ${payload.formType} → ${result.status}: ${result.error}`);\n      return json({ ok: false, error: failed }, { status: 502 });\n    }\n    return json({ ok: true });\n  };\n}\n"],"mappings":";;;;;AA+CA,eAAsB,eAAe,MAA0D;AAC7F,QAAM,UAAU,KAAK,SAAS;AAC9B,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,QAAQ,KAAK,KAAK;AAAA,MAC5B,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,oBAAoB,iBAAiB,KAAK,MAAM;AAAA,MAC3E,MAAM,KAAK,UAAU,KAAK,OAAO;AAAA,IACnC,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,WAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,OAAO,kBAAkB,OAAO,GAAG,CAAC,GAAG;AAAA,EACxE;AACA,MAAI,OAAgB;AACpB,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AAAA,EAER;AACA,QAAM,MAAM,QAAQ,OAAO,SAAS,WAAY,OAAmC;AACnF,MAAI,IAAI,MAAM,OAAO,IAAI,OAAO,MAAM;AACpC,WAAO,EAAE,IAAI,MAAM,IAAI,OAAO,IAAI,MAAM,EAAE,EAAE;AAAA,EAC9C;AACA,QAAM,QAAQ,OAAO,OAAO,IAAI,UAAU,WAAW,IAAI,QAAQ,kBAAkB,IAAI,MAAM;AAC7F,SAAO,EAAE,IAAI,OAAO,QAAQ,IAAI,QAAQ,MAAM;AAChD;AAiBA,eAAsB,gBACpB,MAC0C;AAC1C,QAAM,UAAU,KAAK,SAAS;AAC9B,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,KAAK,aAAa,IAAI;AACzE,MAAI;AACF,UAAM,MAAM,MAAM,QAAQ,KAAK,KAAK;AAAA,MAClC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,oBAAoB,iBAAiB,KAAK,MAAM;AAAA,MAC3E,MAAM,KAAK,UAAU,EAAE,WAAW,KAAK,OAAO,CAAC;AAAA,MAC/C,QAAQ,WAAW;AAAA,IACrB,CAAC;AACD,WAAO,EAAE,IAAI,IAAI,IAAI,QAAQ,IAAI,OAAO;AAAA,EAC1C,QAAQ;AACN,WAAO,EAAE,IAAI,OAAO,QAAQ,EAAE;AAAA,EAChC,UAAE;AACA,iBAAa,KAAK;AAAA,EACpB;AACF;AAeO,IAAM,cAAc;AAapB,SAAS,iBAAiB,OAAkC;AACjE,MAAI,OAAO,MAAM,aAAa,YAAY,MAAM,SAAS,KAAK,EAAE,SAAS,GAAG;AAC1E,WAAO,EAAE,IAAI,OAAO,QAAQ,WAAW;AAAA,EACzC;AACA,MAAI,OAAO,MAAM,cAAc,YAAY,MAAM,YAAY,aAAa;AACxE,WAAO,EAAE,IAAI,OAAO,QAAQ,WAAW;AAAA,EACzC;AACA,SAAO,EAAE,IAAI,KAAK;AACpB;;;AC/IA,SAAS,MAAM,gBAAuD;;;ACsD/D,SAAS,oBACd,OACA,gBAC4B;AAC5B,QAAM,OAAuB,CAAC;AAE9B,QAAM,QAAQ,OAAO,mBAAmB,WAAW,eAAe,KAAK,IAAI;AAC3E,MAAI,MAAO,MAAK,iBAAiB;AAEjC,MAAI,OAAO,MAAM,qBAAqB,YAAY;AAChD,QAAI;AACF,YAAM,KAAK,MAAM,iBAAiB;AAClC,UAAI,OAAO,OAAO,YAAY,GAAG,KAAK,EAAG,MAAK,WAAW,GAAG,KAAK;AAAA,IACnE,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,QAAM,KAAK,MAAM,SAAS,SAAS,MAAM,YAAY;AACrD,MAAI,OAAO,OAAO,YAAY,GAAG,KAAK,EAAG,MAAK,YAAY,GAAG,KAAK;AAElE,SAAO,OAAO,KAAK,IAAI,EAAE,SAAS,IAAI,OAAO;AAC/C;;;AD9BO,SAAS,mBACd,MACoD;AACpD,QAAM,eAAe,KAAK,gBAAgB;AAC1C,QAAM,cAAc,KAAK,eAAe;AACxC,QAAM,qBAAqB,KAAK,sBAAsB;AACtD,QAAM,MAAM,KAAK,OAAO,KAAK;AAC7B,QAAM,cACJ,KAAK,sBAAsB;AAC7B,QAAM,SACJ,KAAK,gBAAgB;AAEvB,SAAO,OAAO,UAAU;AACtB,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,MAAM,QAAQ,SAAS;AAAA,IACtC,QAAQ;AACN,cAAQ,MAAM,kBAAkB,KAAK,QAAQ,6BAA6B;AAC1E,aAAO,KAAK,KAAK,EAAE,OAAO,OAAO,CAAC;AAAA,IACpC;AAIA,UAAM,SAAS,iBAAiB;AAAA,MAC9B,UAAU,KAAK,IAAI,YAAY,GAAG,SAAS,KAAK;AAAA,MAChD,WAAW,UAAU,KAAK,IAAI,WAAW,GAAG,GAAG;AAAA,IACjD,CAAC;AACD,QAAI,CAAC,OAAO,IAAI;AAGd,YAAM,MAAM,KAAK,UAAU;AAC3B,UAAI,IAAI,OAAO,IAAI,OAAO;AACxB,cAAM,gBAAgB;AAAA,UACpB,KAAK,IAAI;AAAA,UACT,OAAO,IAAI;AAAA,UACX,QAAQ,OAAO;AAAA,UACf,OAAO,MAAM;AAAA,QACf,CAAC;AAAA,MACH;AACA,aAAO,QAAQ;AAAA,IACjB;AAEA,UAAM,EAAE,KAAK,MAAM,IAAI,KAAK,UAAU;AACtC,QAAI,CAAC,OAAO,CAAC,OAAO;AAClB,cAAQ,MAAM,8CAA8C,KAAK,QAAQ,EAAE;AAC3E,aAAO,KAAK,KAAK,EAAE,OAAO,YAAY,CAAC;AAAA,IACzC;AAEA,UAAM,SAAS,MAAM,eAAe;AAAA,MAClC;AAAA,MACA;AAAA,MACA,OAAO,MAAM;AAAA,MACb,SAAS;AAAA,QACP,GAAG,KAAK,aAAa,MAAM,KAAK;AAAA,QAChC,UAAU,KAAK;AAAA,QACf,OAAO,oBAAoB,OAAO,KAAK,IAAI,kBAAkB,GAAG,SAAS,CAAC;AAAA,MAC5E;AAAA,IACF,CAAC;AACD,QAAI,CAAC,OAAO,IAAI;AACd,cAAQ,MAAM,kBAAkB,KAAK,QAAQ,WAAM,OAAO,MAAM,KAAK,OAAO,KAAK,EAAE;AACnF,aAAO,KAAK,KAAK,EAAE,OAAO,OAAO,CAAC;AAAA,IACpC;AACA,WAAO,QAAQ;AAAA,EACjB;AAKA,WAAS,UAA6B;AACpC,QAAI,KAAK,WAAY,UAAS,KAAK,KAAK,UAAU;AAClD,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB;AACF;AAKA,SAAS,UAAU,OAAoC,KAAkC;AACvF,QAAM,KAAK,OAAO,KAAK;AACvB,MAAI,CAAC,OAAO,SAAS,EAAE,KAAK,MAAM,EAAG,QAAO;AAK5C,SAAO,KAAK,IAAI,GAAG,IAAI,IAAI,EAAE;AAC/B;;;AEnIA,SAAS,YAA+B;AAqCxC,SAAS,WAAW,GAA2B;AAC7C,SAAO,OAAO,MAAM,YAAa,sBAA4C,SAAS,CAAC;AACzF;AAEA,SAAS,IAAI,GAAgC;AAC3C,SAAO,OAAO,MAAM,WAAW,IAAI;AACrC;AAQO,SAAS,qBACd,MAC4C;AAC5C,QAAM,eAAe,KAAK,gBAAgB;AAC1C,QAAM,qBAAqB,KAAK,sBAAsB;AACtD,QAAM,cACJ,KAAK,sBAAsB;AAC7B,QAAM,SACJ,KAAK,gBAAgB;AAEvB,SAAO,OAAO,UAAU;AACtB,QAAI;AACJ,QAAI;AACF,YAAM,SAAkB,MAAM,MAAM,QAAQ,KAAK;AACjD,UAAI,CAAC,UAAU,OAAO,WAAW,SAAU,OAAM,IAAI,MAAM,uBAAuB;AAClF,aAAO;AAAA,IACT,QAAQ;AACN,cAAQ,MAAM,0CAA0C;AACxD,aAAO,KAAK,EAAE,IAAI,OAAO,OAAO,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3D;AAKA,UAAM,SAAS,iBAAiB,EAAE,UAAU,IAAI,KAAK,YAAY,CAAC,KAAK,KAAK,CAAC;AAC7E,QAAI,CAAC,OAAO,IAAI;AAGd,YAAM,MAAM,KAAK,UAAU;AAC3B,UAAI,IAAI,OAAO,IAAI,OAAO;AACxB,cAAM,gBAAgB;AAAA,UACpB,KAAK,IAAI;AAAA,UACT,OAAO,IAAI;AAAA,UACX,QAAQ,OAAO;AAAA,UACf,OAAO,MAAM;AAAA,QACf,CAAC;AAAA,MACH;AACA,aAAO,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,IAC1B;AAKA,QAAI;AACJ,QAAI;AACF,gBAAU;AAAA,QACR,GAAG,KAAK,aAAa,MAAM,KAAK;AAAA,QAChC,GAAI,KAAK,WAAW,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC;AAAA,QACnD,OAAO,oBAAoB,OAAO,IAAI,KAAK,kBAAkB,CAAC,CAAC;AAAA,MACjE;AAAA,IACF,SAAS,KAAK;AACZ,cAAQ,MAAM,sCAAsC,OAAO,GAAG,CAAC,EAAE;AACjE,aAAO,KAAK,EAAE,IAAI,OAAO,OAAO,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3D;AACA,QAAI,CAAC,WAAW,QAAQ,QAAQ,GAAG;AACjC,cAAQ,MAAM,oCAAoC,OAAO,QAAQ,QAAQ,CAAC,EAAE;AAC5E,aAAO,KAAK,EAAE,IAAI,OAAO,OAAO,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3D;AAEA,UAAM,EAAE,KAAK,MAAM,IAAI,KAAK,UAAU;AACtC,QAAI,CAAC,OAAO,CAAC,OAAO;AAClB,cAAQ,MAAM,8CAA8C,QAAQ,QAAQ,EAAE;AAC9E,aAAO,KAAK,EAAE,IAAI,OAAO,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAChE;AAEA,UAAM,SAAS,MAAM,eAAe,EAAE,KAAK,OAAO,OAAO,MAAM,OAAO,QAAQ,CAAC;AAC/E,QAAI,CAAC,OAAO,IAAI;AACd,cAAQ,MAAM,kBAAkB,QAAQ,QAAQ,WAAM,OAAO,MAAM,KAAK,OAAO,KAAK,EAAE;AACtF,aAAO,KAAK,EAAE,IAAI,OAAO,OAAO,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3D;AACA,WAAO,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EAC1B;AACF;","names":[]}

package/dist/{github-signals-3O64PFWP.js → github-signals-VWBMQNLH.js}

@@ -3,17 +3,17 @@ import {
 } from "./chunk-PZQ3WED2.js";
 import {
   formatFleetWriteSummary
-} from "./chunk-JD3X3QMP.js";
-import "./chunk-YBYWNUT3.js";
+} from "./chunk-KN5OC5YH.js";
+import "./chunk-T34EUM5B.js";
 import {
   detectSignalEvents,
   fleetSweptEvent
 } from "./chunk-5L3FPQIJ.js";
 import {
   recordFleetEventsBestEffort
-} from "./chunk-G2YRXV26.js";
-import "./chunk-PTPTVVY7.js";
-import "./chunk-XKKTK6WA.js";
+} from "./chunk-OTBA7DON.js";
+import "./chunk-PH3AGF4Z.js";
+import "./chunk-HIN3P4ZN.js";
 import {
   makeGitHub
 } from "./chunk-YEGHUODU.js";
@@ -22,7 +22,7 @@ import {
   listWebsites,
   siteSlug,
   updateGitHubSignals
-} from "./chunk-4P6UQG5L.js";
+} from "./chunk-CL5DYUWQ.js";
 import {
   openBase,
   readAirtableConfig
@@ -134,4 +134,4 @@ export {
   githubSignalsExitCode,
   runGitHubSignalsCommand
 };
-//# sourceMappingURL=github-signals-3O64PFWP.js.map
+//# sourceMappingURL=github-signals-VWBMQNLH.js.map

package/dist/index.d.ts

@@ -432,6 +432,10 @@ type WebsiteRow = {
      *  blank → skipped. The API key is `key-dc` format; dc is derived from it. */
     mailchimpApiKey: string | null;
     mailchimpAudienceId: string | null;
+    /** Per-site Cloudflare Turnstile gate. When true, a submission whose Turnstile
+     *  token verifies as "fail" is escalated to auto-spam regardless of content score
+     *  (an absent/unverifiable token stays neutral — fail-open). Airtable checkbox. */
+    requireTurnstile: boolean;
     /** GitHub-signals sweep (slice 2a), written nightly by `github-signals --fleet`. */
     renovateFailingCis: number | null;
     defaultBranchCi: string | null;
@@ -752,7 +756,7 @@ declare function selfPackageVersion(callerImportMetaUrl: string): string;
 /** Caret-pinned range against this package's own version: e.g. "^0.6.2". */
 declare function selfCaretRange(callerImportMetaUrl: string): string;
 
-declare const SUBMISSION_STATUSES: readonly ["new", "read", "archived", "spam"];
+declare const SUBMISSION_STATUSES: readonly ["new", "read", "archived", "spam", "spam_auto"];
 type SubmissionStatus = (typeof SUBMISSION_STATUSES)[number];
 declare const NOTIFY_STATUSES: readonly ["sent", "failed", "skipped"];
 type NotifyStatus = (typeof NOTIFY_STATUSES)[number];
@@ -773,6 +777,10 @@ type SubmissionRow = {
     status: SubmissionStatus;
     notifyStatus: NotifyStatus;
     resendMessageId: string | null;
+    /** Heuristic spam score at ingest time; null for pre-classifier / un-scored rows. */
+    spamScore?: number | null;
+    /** Comma-joined classifier reason codes (e.g. "links:3,disposable-email"); null when unscored. */
+    spamReason?: string | null;
 };
 
 type ScreenOutTotals = {
@@ -892,6 +900,9 @@ type CockpitModel = {
     } | null;
     /** Recent fleet-activity events for the "Recently" lane (optional for back-compat). */
     recent?: RecentEntry[];
+    /** Fleet-wide count of submissions auto-filtered as spam in the affordance window
+     *  (optional for back-compat). Drives the cockpit "N auto-filtered this week" line. */
+    autoFiltered?: number;
 };
 
 /**

package/dist/index.js

@@ -1,4 +1,4 @@
-import "./chunk-CH6K2VMM.js";
+import "./chunk-JDGIO54P.js";
 import {
   findDueReports
 } from "./chunk-VKAYZVMI.js";
@@ -24,11 +24,11 @@ import {
 } from "./chunk-ZYBOT5PM.js";
 import {
   draftReportForSite
-} from "./chunk-G35B5U6F.js";
+} from "./chunk-ULL4AD3Y.js";
 import "./chunk-6LIWDIXU.js";
 import {
   sendApprovedReports
-} from "./chunk-CWSQZ27M.js";
+} from "./chunk-YKOOAWVL.js";
 import "./chunk-OGGRFBL4.js";
 import "./chunk-GECESMVS.js";
 import {
@@ -64,9 +64,9 @@ import {
   securityAudit
 } from "./chunk-WCN54744.js";
 import "./chunk-LKGVSM2O.js";
-import "./chunk-G2YRXV26.js";
-import "./chunk-PTPTVVY7.js";
-import "./chunk-XKKTK6WA.js";
+import "./chunk-OTBA7DON.js";
+import "./chunk-PH3AGF4Z.js";
+import "./chunk-HIN3P4ZN.js";
 import "./chunk-GASBX52O.js";
 import "./chunk-YEGHUODU.js";
 import {
@@ -78,12 +78,12 @@ import "./chunk-XXTZBPUY.js";
 import "./chunk-XTK5VIQB.js";
 import {
   fromAirtableBase
-} from "./chunk-NMGGP5WN.js";
+} from "./chunk-Y4O44LZB.js";
 import "./chunk-U5SZ4FOP.js";
 import {
   SEVERITY_RANK,
   siteSlug
-} from "./chunk-4P6UQG5L.js";
+} from "./chunk-CL5DYUWQ.js";
 import "./chunk-HN6I2XWI.js";
 import "./chunk-WEKL2HYJ.js";
 import "./chunk-6VAL7XJT.js";
@@ -172,6 +172,9 @@ function extraFieldsList(raw) {
   ).join("");
   return rows;
 }
+function isVisibleInStrip(s) {
+  return s.status !== "spam_auto";
+}
 function renderSubmissionRow(s) {
   const when = s.submittedAt ? escapeHtml(relativeTimeFromNow(s.submittedAt)) : "\u2014";
   const type = escapeHtml(s.formType);
@@ -181,6 +184,8 @@ function renderSubmissionRow(s) {
   const id = escapeHtml(s.id);
   const url = `/api/submissions/${encodeURIComponent(s.id)}/status`;
   const btn = (label, action) => `<button class="subm-status" data-id="${id}" data-status="${action}" data-url="${url}">${label}</button>`;
+  const provenance = s.status === "spam_auto" && s.spamScore !== null && s.spamScore !== void 0 ? ` <span class="subm-provenance" title="${escapeHtml(s.spamReason ?? "")}">auto-spam \xB7 ${escapeHtml(String(s.spamScore))}</span>` : "";
+  const recover = s.status === "spam_auto" ? btn("Not spam \u2192 new", "new") : "";
   const kv = (label, value) => value === null || value === "" ? "" : `<div class="subm-kv"><span class="k">${label}</span> ${escapeHtml(String(value))}</div>`;
   const sourceLink = s.sourceUrl ? `<div class="subm-kv"><span class="k">Source</span> <a href="${escapeHtml(safeUrl(s.sourceUrl))}" rel="noopener noreferrer">${escapeHtml(s.sourceUrl)}</a></div>` : "";
   const messageBlock = s.message ? `<div class="subm-kv"><span class="k">Message</span></div><div class="subm-msg">${escapeHtml(s.message)}</div>` : "";
@@ -196,10 +201,10 @@ function renderSubmissionRow(s) {
   ].join("");
   return `<li class="subm-item">
     <details>
-      <summary class="subm-head"><strong>${type}</strong> \xB7 ${who} <span class="muted">${email}</span> <span class="pill subm-${status}">${status}</span> <span class="muted">${when}</span></summary>
+      <summary class="subm-head"><strong>${type}</strong> \xB7 ${who} <span class="muted">${email}</span> <span class="pill subm-${status}">${status}</span>${provenance} <span class="muted">${when}</span></summary>
       <div class="subm-detail">${details}</div>
     </details>
-    <div class="subm-actions">${btn("Read", "read")}${btn("Archive", "archived")}${btn("Spam", "spam")}</div>
+    <div class="subm-actions">${recover}${btn("Read", "read")}${btn("Archive", "archived")}${btn("Spam", "spam")}</div>
   </li>`;
 }
 var SUBMISSION_STYLES = `.subm-list { list-style: none; padding: 0; margin: 0; }
@@ -220,6 +225,8 @@ button.subm-status:disabled { opacity: 0.6; cursor: default; }
 .pill.subm-read { background: #f0f0f0; color: #555; }
 .pill.subm-archived { background: #eee; color: #888; }
 .pill.subm-spam { background: #fdecea; color: #b00; }
+.pill.subm-spam_auto { background: #fff4e5; color: #a65a00; }
+.subm-provenance { font-size: 0.72rem; border-radius: 0.25rem; padding: 0 0.35rem; white-space: nowrap; background: #fff4e5; color: #a65a00; }
 .subm-viewall { font-size: 0.8rem; font-weight: normal; margin-left: 0.4rem; white-space: nowrap; }`;
 var SUBMISSION_STATUS_SCRIPT = `document.querySelectorAll("button.subm-status").forEach((b) => {
       b.addEventListener("click", async () => {
@@ -363,12 +370,13 @@ function reportRow(r) {
 }
 var SUBMISSIONS_PER_SITE_CAP = 25;
 function submissionsSection(submissions, site) {
-  if (submissions.length === 0) return "";
-  const recent = [...submissions].sort((a, b) => (b.submittedAt ?? "").localeCompare(a.submittedAt ?? "")).slice(0, SUBMISSIONS_PER_SITE_CAP);
-  const note = submissions.length > recent.length ? `<span class="muted"> \u2014 showing ${recent.length} of ${submissions.length}</span>` : "";
+  const visible = submissions.filter(isVisibleInStrip);
+  if (visible.length === 0) return "";
+  const recent = [...visible].sort((a, b) => (b.submittedAt ?? "").localeCompare(a.submittedAt ?? "")).slice(0, SUBMISSIONS_PER_SITE_CAP);
+  const note = visible.length > recent.length ? `<span class="muted"> \u2014 showing ${recent.length} of ${visible.length}</span>` : "";
   const viewAll = `<a class="subm-viewall" href="/submissions?site=${escapeHtml(siteSlug(site.name))}">View all for this site \u2192</a>`;
   return `<div class="section submissions">
-    <h2>Form submissions (${submissions.length})${note} ${viewAll}</h2>
+    <h2>Form submissions (${visible.length})${note} ${viewAll}</h2>
     <ul class="subm-list">${recent.map(renderSubmissionRow).join("")}</ul>
   </div>`;
 }
@@ -1103,7 +1111,9 @@ function renderInboxLane(model) {
   const subs = model.submissions ?? [];
   const spam = model.spam;
   const hasSpam = !!spam && (spam.caught > 0 || spam.through > 0);
-  if (subs.length === 0 && !hasSpam) return "";
+  const autoFiltered = model.autoFiltered ?? 0;
+  const hasAutoFiltered = autoFiltered > 0;
+  if (subs.length === 0 && !hasSpam && !hasAutoFiltered) return "";
   const shown = [...subs].sort((a, b) => (b.submittedAt ?? "").localeCompare(a.submittedAt ?? "")).slice(0, SUBMISSIONS_STRIP_CAP);
   const rows = shown.map((sub) => {
     const href = `/s/${escapeHtml(sub.slug)}`;
@@ -1120,10 +1130,12 @@ function renderInboxLane(model) {
   const more = overflow > 0 ? `<div class="approve-row subm-more muted"><a href="/submissions">+${overflow} more \u2014 view all submissions</a></div>` : `<div class="approve-row subm-more muted"><a href="/submissions">View all submissions \u2192</a></div>`;
   const spamLine = hasSpam ? `<div class="spam-rollup muted">\u{1F6E1} Spam (30d) \u2014 caught ${spam.caught} \xB7 through ${spam.through}</div>` : "";
   const spamInSummary = hasSpam ? " \xB7 \u{1F6E1} Spam (30d)" : "";
+  const autoFilteredLine = hasAutoFiltered ? `<div class="spam-rollup muted">\u{1F6AB} ${autoFiltered} auto-filtered this week \u2014 <a href="/submissions?status=spam_auto">review</a></div>` : "";
   return `<details class="inbox">
     <summary>\u{1F4E5} Submissions (${subs.length} new)${spamInSummary}</summary>
     ${rows}${subs.length > 0 ? more : ""}
     ${spamLine}
+    ${autoFilteredLine}
   </details>`;
 }
 var AUDIT_SCRIPT = `<script>