@reddoorla/maintenance 0.90.1 → 0.92.0

package/dist/{bump-deps-KGH5UYSF.js → bump-deps-GI7PHMOC.js}

@@ -5,19 +5,19 @@ import {
   appendSkipNotice,
   fleetWorkdir,
   prepareFleetSites
-} from "./chunk-TVL5MVUF.js";
+} from "./chunk-TCF6S7AD.js";
 import {
   resolveSites
 } from "./chunk-Q47DU255.js";
 import {
   bumpDeps
-} from "./chunk-2NJQLSEU.js";
-import "./chunk-3G25KIWW.js";
+} from "./chunk-PPIZHDJL.js";
+import "./chunk-ZTPPCHDB.js";
 import "./chunk-Z3JXLULD.js";
-import "./chunk-RARREDQE.js";
-import "./chunk-XTK5VIQB.js";
 import "./chunk-LBYOLBW7.js";
+import "./chunk-RARREDQE.js";
 import "./chunk-XXTZBPUY.js";
+import "./chunk-XTK5VIQB.js";
 
 // src/cli/commands/bump-deps.ts
 import { resolve } from "path";
@@ -57,4 +57,4 @@ async function runBumpDepsCommand(site, opts) {
 export {
   runBumpDepsCommand
 };
-//# sourceMappingURL=bump-deps-KGH5UYSF.js.map
+//# sourceMappingURL=bump-deps-GI7PHMOC.js.map

package/dist/{chunk-WS6NU475.js → chunk-22GKJO5F.js}

@@ -1,6 +1,6 @@
 import {
   runMigrations
-} from "./chunk-MFHS7IQ2.js";
+} from "./chunk-OCNSIBMP.js";
 import {
   defaultCredentialsPath
 } from "./chunk-6VAL7XJT.js";
@@ -48,4 +48,4 @@ export {
   readDbConfig,
   openDb
 };
-//# sourceMappingURL=chunk-WS6NU475.js.map
+//# sourceMappingURL=chunk-22GKJO5F.js.map

package/dist/{chunk-A6T2R63Z.js → chunk-3HS6LPFX.js}

@@ -1,6 +1,6 @@
 import {
   withRecipe
-} from "./chunk-3G25KIWW.js";
+} from "./chunk-ZTPPCHDB.js";
 import {
   ALL_TEMPLATES,
   RENOVATE_ACTION_CONFIG,
@@ -229,4 +229,4 @@ export {
   planTemplateDiffs,
   syncConfigs
 };
-//# sourceMappingURL=chunk-A6T2R63Z.js.map
+//# sourceMappingURL=chunk-3HS6LPFX.js.map

package/dist/{chunk-UXJZU23T.js → chunk-4NUKMPOO.js}

@@ -1,27 +1,27 @@
 import {
   convertToPnpm
-} from "./chunk-XIDUYLSR.js";
+} from "./chunk-7CJ3DVZW.js";
 import {
   svelteCodemods
-} from "./chunk-IYSEC543.js";
+} from "./chunk-LS6QPANO.js";
 import {
   healthEndpoint
-} from "./chunk-BQRFQSGY.js";
+} from "./chunk-4R3YAQNV.js";
 import {
   smokeSuite
-} from "./chunk-Y53WOQIJ.js";
+} from "./chunk-CVJF2IC5.js";
 import {
   onboard
-} from "./chunk-7RJ2HMMJ.js";
+} from "./chunk-NTLSMJHW.js";
 import {
   syncConfigs
-} from "./chunk-A6T2R63Z.js";
+} from "./chunk-3HS6LPFX.js";
 import {
   withRecipe
-} from "./chunk-3G25KIWW.js";
+} from "./chunk-ZTPPCHDB.js";
 import {
   runAudits
-} from "./chunk-QD427NIO.js";
+} from "./chunk-JB4Q3C3M.js";
 import {
   siteLabel
 } from "./chunk-XXTZBPUY.js";
@@ -143,4 +143,4 @@ export {
   DEFAULT_INIT_STEPS,
   init
 };
-//# sourceMappingURL=chunk-UXJZU23T.js.map
+//# sourceMappingURL=chunk-4NUKMPOO.js.map

package/dist/{chunk-BQRFQSGY.js → chunk-4R3YAQNV.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-R53VL3RI.js";
 import {
   withRecipe
-} from "./chunk-3G25KIWW.js";
+} from "./chunk-ZTPPCHDB.js";
 import {
   defaultSpawn
 } from "./chunk-LBYOLBW7.js";
@@ -142,4 +142,4 @@ async function healthEndpoint(site, deps = { spawn: defaultSpawn }) {
 export {
   healthEndpoint
 };
-//# sourceMappingURL=chunk-BQRFQSGY.js.map
+//# sourceMappingURL=chunk-4R3YAQNV.js.map

package/dist/{chunk-JRHIFA5R.js → chunk-5XMKJX74.js}

@@ -1,6 +1,9 @@
 import {
   SPAM_THRESHOLD
 } from "./chunk-NO74DXDP.js";
+import {
+  parseReplyCopy
+} from "./chunk-PJ23RDHT.js";
 import {
   SUBMISSION_FORM_TYPES
 } from "./chunk-2OP4JKIQ.js";
@@ -17,7 +20,8 @@ var KNOWN_KEYS = /* @__PURE__ */ new Set([
   "sourceUrl",
   "utm",
   "extra",
-  "_meta"
+  "_meta",
+  "_reply"
 ]);
 var DANGEROUS_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
 var EMAIL_RE = /^[^@\s]+@[^@\s]+\.[^@\s]+$/;
@@ -47,12 +51,14 @@ function normalizeSubmission(payload) {
   const extra = p.extra;
   if (typeof extra === "object" && extra !== null) {
     for (const [k, v] of Object.entries(extra)) {
-      if (!DANGEROUS_KEYS.has(k)) extraFields[k] = v;
+      if (!DANGEROUS_KEYS.has(k) && !k.startsWith("_")) extraFields[k] = v;
     }
   }
   for (const [k, v] of Object.entries(p)) {
-    if (!KNOWN_KEYS.has(k) && !DANGEROUS_KEYS.has(k)) extraFields[k] = v;
+    if (!KNOWN_KEYS.has(k) && !DANGEROUS_KEYS.has(k) && !k.startsWith("_")) extraFields[k] = v;
   }
+  const reply = parseReplyCopy(p._reply);
+  if (reply) extraFields._reply = reply;
   const value = {
     formType,
     name,
@@ -281,4 +287,4 @@ export {
   ingestSubmission,
   hostsMatch
 };
-//# sourceMappingURL=chunk-JRHIFA5R.js.map
+//# sourceMappingURL=chunk-5XMKJX74.js.map

package/dist/chunk-5XMKJX74.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/forms/payload.ts","../src/forms/ingest.ts"],"sourcesContent":["import { SUBMISSION_FORM_TYPES, type FormType } from \"./types.js\";\nimport type { SubmissionMeta } from \"./meta.js\";\nimport { parseReplyCopy, type ReplyCopy } from \"./reply-copy.js\";\n\n/** The JSON wire format a fleet site forwards to the ingest endpoint.\n *\n *  Underscore-prefixed keys are RESERVED for transport concerns and are never\n *  lead data: `_meta` (below) and `_screenOut` (the bot screen-out beacon —\n *  a `{ _screenOut: \"honeypot\" | \"too-fast\" }` body is a counter ping, not a\n *  submission; see ingest.ts `parseScreenOut`). Site field names must not\n *  start with `_`. */\nexport type SubmissionPayload = {\n  formType?: string;\n  name?: string;\n  firstName?: string;\n  lastName?: string;\n  email?: string;\n  phone?: string;\n  message?: string;\n  sourceUrl?: string;\n  utm?: string;\n  /** Any additional, site-specific fields. */\n  extra?: Record<string, unknown>;\n  /** Reserved transport envelope (token/IP/UA); stripped by normalizeSubmission, never persisted. */\n  _meta?: SubmissionMeta;\n  /** Reserved: confirmation-email copy the SITE resolved from its own CMS.\n   *  Validated by parseReplyCopy, then stored under the same key in extraFields\n   *  so a replayed submission sends the same email it would have sent live. */\n  _reply?: ReplyCopy;\n};\n\nexport type NormalizedSubmission = {\n  formType: FormType;\n  name: string;\n  email: string;\n  phone?: string;\n  message?: string;\n  sourceUrl?: string;\n  utm?: string;\n  extraFields: Record<string, unknown>;\n};\n\nexport type NormalizeResult =\n  { ok: true; value: NormalizedSubmission } | { ok: false; errors: string[] };\n\nconst KNOWN_KEYS = new Set([\n  \"formType\",\n  \"name\",\n  \"firstName\",\n  \"lastName\",\n  \"email\",\n  \"phone\",\n  \"message\",\n  \"sourceUrl\",\n  \"utm\",\n  \"extra\",\n  \"_meta\",\n  \"_reply\",\n]);\n\n// Keys that, copied as own-properties into the captured object, could surprise a\n// downstream consumer (template/DB layer). This is an untrusted boundary, so the\n// extraFields merge drops them rather than trusting the caller.\nconst DANGEROUS_KEYS = new Set([\"__proto__\", \"constructor\", \"prototype\"]);\n\nconst EMAIL_RE = /^[^@\\s]+@[^@\\s]+\\.[^@\\s]+$/;\n\nfunction str(v: unknown): string {\n  return typeof v === \"string\" ? v.trim() : \"\";\n}\n\n/**\n * Resolve the submission's formType. An ABSENT/blank value defaults to \"contact\"\n * (the long-standing minimal-form contract). A PRESENT but unrecognized value\n * (e.g. a typo'd \"news\") returns null → the caller rejects it, rather than\n * silently storing it as contact — which would, for a newsletter signup, drop the\n * Mailchimp fan-out. Mirrors createIngestEndpoint's reject-invalid behavior.\n */\nfunction resolveFormType(raw: unknown): FormType | null {\n  const s = str(raw);\n  if (s === \"\") return \"contact\";\n  return (SUBMISSION_FORM_TYPES as readonly string[]).includes(s) ? (s as FormType) : null;\n}\n\n/**\n * Defensively normalize an untrusted ingest payload into typed fields. Folds\n * name/first+last, lowercases email, and dumps every unclaimed key into\n * extraFields so no site-specific data is lost. Rejects only when there's\n * nothing to act on (no email AND no message) or a present email is malformed.\n */\nexport function normalizeSubmission(payload: unknown): NormalizeResult {\n  if (typeof payload !== \"object\" || payload === null) {\n    return { ok: false, errors: [\"payload must be a JSON object\"] };\n  }\n  const p = payload as Record<string, unknown>;\n  const name = str(p.name) || [str(p.firstName), str(p.lastName)].filter(Boolean).join(\" \");\n  const email = str(p.email).toLowerCase();\n  const message = str(p.message);\n\n  const formType = resolveFormType(p.formType);\n  const errors: string[] = [];\n  if (!email && !message) errors.push(\"at least one of email or message is required\");\n  if (email && !EMAIL_RE.test(email)) errors.push(\"email is not a valid address\");\n  if (formType === null) errors.push(\"formType is not a recognized form type\");\n  // The `|| formType === null` is redundant for control flow (the push above\n  // already made errors non-empty) but narrows formType to FormType past this line.\n  if (errors.length > 0 || formType === null) return { ok: false, errors };\n\n  const extraFields: Record<string, unknown> = {};\n  const extra = p.extra;\n  if (typeof extra === \"object\" && extra !== null) {\n    for (const [k, v] of Object.entries(extra)) {\n      if (!DANGEROUS_KEYS.has(k) && !k.startsWith(\"_\")) extraFields[k] = v;\n    }\n  }\n  for (const [k, v] of Object.entries(p)) {\n    if (!KNOWN_KEYS.has(k) && !DANGEROUS_KEYS.has(k) && !k.startsWith(\"_\")) extraFields[k] = v;\n  }\n  // The ONE underscore key a caller may set. Both loops above dropped the rest,\n  // including any `_reply` smuggled in through `extra` — this is the only way a\n  // value reaches that key, and it is validated on the way through. Without it,\n  // a bot could POST its own copy and dictate the text of an email we send from\n  // a domain with real sending reputation.\n  const reply = parseReplyCopy(p._reply);\n  if (reply) extraFields._reply = reply;\n\n  const value: NormalizedSubmission = {\n    formType,\n    name,\n    email,\n    extraFields,\n  };\n  const phone = str(p.phone);\n  if (phone) value.phone = phone;\n  if (message) value.message = message;\n  const sourceUrl = str(p.sourceUrl);\n  if (sourceUrl) value.sourceUrl = sourceUrl;\n  const utm = str(p.utm);\n  if (utm) value.utm = utm;\n  return { ok: true, value };\n}\n","import type { WebsiteRow } from \"../reports/airtable/websites.js\";\nimport type {\n  SubmissionRow,\n  SubmissionInput,\n  NotifyStatus,\n  SubmissionStatus,\n} from \"../reports/submission-row.js\";\nimport { normalizeSubmission, type NormalizedSubmission } from \"./payload.js\";\nimport type { TurnstileOutcome, TurnstileVerification } from \"./turnstile.js\";\nimport { SPAM_THRESHOLD, type SpamVerdict } from \"./spam-classifier.js\";\n\n/** How far back the duplicate-spray AND repeat-sender lookups scan. Sprays arrive in\n *  bursts but bots also re-run for weeks; 30 days catches repeats without an unbounded\n *  table scan. */\nconst DUPLICATE_WINDOW_MS = 30 * 24 * 60 * 60 * 1000;\n\nexport type IngestDeps = {\n  getWebsiteBySlug: (slug: string) => Promise<WebsiteRow | null>;\n  createSubmission: (input: SubmissionInput) => Promise<SubmissionRow>;\n  /** Optional last-resort capture for a lead whose site lookup THREW (a store\n   *  outage, not an unknown slug). When present, the lead is persisted here and\n   *  the visitor still gets \"accepted\"; `db replay-deadletters` re-runs it once\n   *  the lookup recovers. Absent → the error propagates exactly as before, so\n   *  callers that never wired it are byte-for-byte unchanged. */\n  deadLetter?: (input: {\n    siteSlug: string;\n    payload: unknown;\n    turnstile: TurnstileVerification;\n    error: string;\n    receivedAt: Date;\n  }) => Promise<{ id: string }>;\n  notify: (\n    site: WebsiteRow,\n    submission: SubmissionRow,\n  ) => Promise<{ status: NotifyStatus; messageId: string | null }>;\n  stampNotified: (id: string, status: NotifyStatus, messageId: string | null) => Promise<void>;\n  now: () => Date;\n  /** Optional spam classifier. When present, its verdict drives the stored\n   *  status/score/reason; absent → every submission scores 0 (fail-open, clean).\n   *  Injected so the classifier stays a pure, transport-agnostic leaf. */\n  classifySpam?: (n: NormalizedSubmission, turnstile: TurnstileOutcome) => SpamVerdict;\n  /** Optional: fleet-wide duplicate/near-duplicate body lookup since `since`. Drives\n   *  the duplicate-spray signal — the same pitch blasted to many sites shows up as\n   *  identical (`exact`) or template-substituted (`similar`, token-set Jaccard) bodies.\n   *  Statuses let the retro re-bucket pick still-'new' prior copies; siteId+email let\n   *  the caller exempt a genuine same-sender resubmission on the same site. Absent →\n   *  the check is skipped (fail-open clean). */\n  findRecentDuplicates?: (\n    message: string,\n    since: Date,\n  ) => Promise<{\n    exact: Array<{ id: string; status: string; siteId: string; email: string }>;\n    similar: Array<{ id: string; status: string; siteId: string; email: string }>;\n  }>;\n  /** Optional: recent non-newsletter submissions from the same email since `since`.\n   *  Drives the cross-site repeat-sender signal — the fleet's sites are unrelated\n   *  businesses, so one address contacting 2+ of them within the window is a\n   *  solicitation tell. Absent → the check is skipped (fail-open clean). */\n  listRecentSubmissionsForEmail?: (\n    email: string,\n    since: Date,\n  ) => Promise<Array<{ id: string; siteId: string; status: string }>>;\n  /** Optional: retroactively re-bucket prior still-'new' rows once a later copy\n   *  identifies a spray (the first copy is delivered by design). Implementations\n   *  must only touch status='new' rows. Best-effort — failures are swallowed. */\n  retroBucket?: (ids: string[], reason: string) => Promise<void>;\n  /** Optional: POST a newsletter submission to the site's configured webhook\n   *  (best-effort). Omitted in tests/handlers that don't need it. */\n  forwardNewsletter?: (\n    webhookUrl: string,\n    submission: SubmissionRow,\n    site: WebsiteRow,\n  ) => Promise<{ ok: boolean; status: number }>;\n  /** Optional: add a newsletter submitter to the site's Mailchimp audience\n   *  (best-effort). Omitted where unused. `tagged:false` reports a member who was\n   *  upserted but could NOT be tagged — recorded separately, see FANOUT below. */\n  addToMailchimp?: (\n    site: WebsiteRow,\n    submission: SubmissionRow,\n  ) => Promise<{ ok: boolean; status: number; tagged?: boolean }>;\n  /** Optional: persist the newsletter fan-out outcome on the row (see FANOUT below).\n   *  Best-effort — failures are swallowed. Absent → the fan-out still runs, just\n   *  unrecorded (older callers and most tests). */\n  stampFanout?: (id: string, fanoutStatus: string) => Promise<void>;\n  /** Optional: run the best-effort tail (notify → stamp → fan-out) AFTER the\n   *  response instead of before it. Production passes Netlify's\n   *  `context.waitUntil`, which keeps the invocation alive until the promise\n   *  settles. Absent → the tail runs inline, exactly as it always did; this is a\n   *  latency change, never a behavioural one.\n   *\n   *  Why it matters: the submitting site waits on this response under an abort\n   *  budget (forms/client.ts `INGEST_TIMEOUT_MS`). Once the row is written the\n   *  lead is captured, so every further second spent on email/webhook providers\n   *  is time in which a captured lead can still be reported to the visitor as a\n   *  failed submission — which is exactly what happened to 1836dig on\n   *  2026-08-03. */\n  defer?: (work: Promise<unknown>) => void;\n};\n\nexport type IngestResult =\n  | { status: \"accepted\"; submissionId: string; notifyStatus: NotifyStatus | \"deferred\" }\n  | { status: \"rejected\"; reason: \"invalid-payload\"; errors: string[] }\n  | { status: \"unknown-site\"; slug: string };\n\nexport type ScreenOutDeps = {\n  getWebsiteBySlug: (slug: string) => Promise<WebsiteRow | null>;\n  recordScreenOut: (siteId: string, reason: \"honeypot\" | \"too-fast\") => Promise<void>;\n};\n\nexport type ScreenOutResult =\n  { status: \"recorded\"; slug: string } | { status: \"unknown-site\"; slug: string };\n\n/** Extract the screen-out reason from a beacon body, or null if it isn't one.\n *  The beacon key is the reserved `_screenOut` (underscore-namespaced like `_meta`,\n *  see payload.ts). The bare `screenOut` key is the DEPRECATED pre-namespacing wire\n *  shape — sites run older package versions for a while, so the central receiver\n *  keeps accepting it. `_screenOut` wins when both are present. */\nexport function parseScreenOut(payload: unknown): \"honeypot\" | \"too-fast\" | null {\n  if (!payload || typeof payload !== \"object\") return null;\n  const body = payload as Record<string, unknown>;\n  const v = \"_screenOut\" in body ? body[\"_screenOut\"] : body[\"screenOut\"];\n  return v === \"honeypot\" || v === \"too-fast\" ? v : null;\n}\n\n/** Resolve the site and record a caught screen-out. Best-effort: a record failure is\n *  the caller's to swallow — a missed count must never error a screened bot. */\nexport async function ingestScreenOut(\n  deps: ScreenOutDeps,\n  slug: string,\n  reason: \"honeypot\" | \"too-fast\",\n): Promise<ScreenOutResult> {\n  const site = await deps.getWebsiteBySlug(slug);\n  if (!site) return { status: \"unknown-site\", slug };\n  await deps.recordScreenOut(site.id, reason);\n  return { status: \"recorded\", slug };\n}\n\n/**\n * Normalize → resolve site → persist → notify → stamp. The order is load-bearing:\n * the row is written BEFORE notify, and notify/stamp failures are swallowed (logged)\n * so a Resend or Airtable-write-back hiccup can never turn an accepted lead into a 502.\n */\nexport async function ingestSubmission(\n  deps: IngestDeps,\n  slug: string,\n  rawPayload: unknown,\n  turnstileInput: TurnstileOutcome | TurnstileVerification = \"unverifiable\",\n): Promise<IngestResult> {\n  // Accept either the full verification (the production handler) or a bare outcome\n  // string (older callers and virtually every test) — a string simply has no solved-\n  // hostname to check. Normalized once so the body has a single shape to reason about.\n  const verification: TurnstileVerification =\n    typeof turnstileInput === \"string\"\n      ? { outcome: turnstileInput, hostname: null }\n      : turnstileInput;\n  const turnstile = verification.outcome;\n  const normalized = normalizeSubmission(rawPayload);\n  if (!normalized.ok) {\n    return { status: \"rejected\", reason: \"invalid-payload\", errors: normalized.errors };\n  }\n  // Persist before enrich (#539 Phase 0). The lookup THROWING is a store outage,\n  // not an answer — and until 2026-08-23 it was the one await that could cost a\n  // lead: the row write comes later, so a thrown lookup 502'd the visitor with\n  // nothing recorded anywhere (the 2026-08-17 Airtable quota outage did exactly\n  // that, while the submissions store itself was healthy the whole time). With\n  // `deadLetter` wired, the lead lands there and the visitor gets an honest\n  // \"accepted\"; `db replay-deadletters` runs it through this same function once\n  // the lookup recovers, producing a normal row with real classification+notify.\n  //\n  // Three deliberate boundaries:\n  // - A lookup that RESOLVES to null is still `unknown-site` — the store answered,\n  //   and a junk slug is a rejection, not a lead to save.\n  // - A testMode probe rethrows: it persists nothing by design, so there is\n  //   nothing to save, and swallowing the outage would green the form-e2e audit\n  //   precisely when central ingest is degraded.\n  // - `deadLetter` itself throwing propagates: both stores are down, and the 502\n  //   is honest — there is nowhere left to put the lead.\n  let site: WebsiteRow | null;\n  try {\n    site = await deps.getWebsiteBySlug(slug);\n  } catch (err) {\n    if (!deps.deadLetter || isTestMode(rawPayload)) throw err;\n    const dl = await deps.deadLetter({\n      siteSlug: slug,\n      payload: rawPayload,\n      turnstile: verification,\n      error: String(err),\n      receivedAt: deps.now(),\n    });\n    console.error(\n      `[ingest] site lookup failed for '${slug}' — lead dead-lettered as ${dl.id}: ${String(err)}`,\n    );\n    return { status: \"accepted\", submissionId: dl.id, notifyStatus: \"skipped\" };\n  }\n  if (!site) return { status: \"unknown-site\", slug };\n\n  // Synthetic end-to-end probe (the `form-e2e` fleet audit). A central-only marker\n  // on the payload routes the submission away from EVERY real sink: no row is\n  // persisted, no spam classification, no operator/autoresponder email, no\n  // newsletter fan-out — and Turnstile enforcement is bypassed (the short-circuit\n  // sits before that check). The marker therefore grants a bot NO benefit: it\n  // reaches no inbox/DB/webhook, so skipping Turnstile costs nothing. This\n  // suppression MUST be central — the submitting site alone cannot stop the real\n  // inbox firing. Validity + site resolution are still enforced above (a junk body\n  // is rejected, an unknown slug is unknown-site), so the marker can't smuggle\n  // anything through. Return accepted+skipped so the probe asserts success.\n  if (isTestMode(rawPayload)) {\n    return { status: \"accepted\", submissionId: \"test-mode\", notifyStatus: \"skipped\" };\n  }\n\n  const n = normalized.value;\n\n  // A site still under construction is where the operator tests their OWN forms:\n  // one address, several unrelated sites, minutes apart. That is byte-for-byte the\n  // cross-site repeat-sender signature below, so a site in development reliably\n  // auto-spams its own builder's test submissions — the row lands `spam_auto`,\n  // notify is skipped and the cockpit hides it, which reads exactly like \"the form\n  // is broken\" (it did, on 2026-08-17). Spam handling on a site with no real\n  // visitors protects nothing, so skip ALL of it: content scoring, the Turnstile\n  // escalation, the repeat-sender scan and the duplicate/spray scan — including\n  // their retroactive re-bucketing of OTHER sites' rows, which a test submission\n  // has no business triggering. Re-enabled the moment the site leaves development.\n  const spamHandlingEnabled = site.status !== \"building\";\n\n  // Fold the content signals + the Turnstile verdict into ONE spam decision.\n  // Absent classifier → treat as clean (fail-open). A throwing classifier is\n  // swallowed the same way — a bug in the heuristic must never turn an\n  // otherwise-good lead into a 500; it just scores clean. On a `requireTurnstile`\n  // site, both an ACTUAL \"fail\" (forged token) AND an \"absent\" token escalate to\n  // auto-spam regardless of score — a real browser that renders the widget ALWAYS\n  // sends a token, so a completely missing one is the direct-POST-bot signature. A\n  // present-but-\"unverifiable\" token (expired/duplicate — a real browser DID render\n  // the widget) stays neutral, as does anything on a site that hasn't opted in.\n  let verdict: SpamVerdict = { score: 0, reasons: [] };\n  if (spamHandlingEnabled && deps.classifySpam) {\n    try {\n      verdict = deps.classifySpam(n, turnstile);\n    } catch (err) {\n      console.error(`[ingest] classifySpam threw: ${String(err)}`);\n    }\n  }\n  const reasons = [...verdict.reasons];\n  let status: SubmissionStatus = verdict.score >= SPAM_THRESHOLD ? \"spam_auto\" : \"new\";\n  if (\n    spamHandlingEnabled &&\n    site.requireTurnstile &&\n    (turnstile === \"fail\" || turnstile === \"absent\")\n  ) {\n    status = \"spam_auto\";\n    const reason = turnstile === \"fail\" ? \"turnstile-required-failed\" : \"turnstile-required-absent\";\n    if (!reasons.includes(reason)) reasons.push(reason);\n  } else if (\n    spamHandlingEnabled &&\n    site.requireTurnstile &&\n    turnstile === \"pass\" &&\n    verification.hostname !== null &&\n    !turnstileHostnameAcceptable(verification.hostname, site.url)\n  ) {\n    // Defense-in-depth vs token farming: the token PASSED, but Cloudflare says it was\n    // solved on a host unrelated to this site. Cloudflare domain-binds sitekeys, so\n    // this only trips on a loose widget allowlist — still, a passing token from a\n    // foreign host accompanying a gated site's submission is not a real visitor. A\n    // null hostname (older responses) or an unparseable site.url skips the check\n    // entirely (fail-open); subdomains of the site's host (www., previews) match.\n    status = \"spam_auto\";\n    if (!reasons.includes(\"turnstile-required-hostname\"))\n      reasons.push(\"turnstile-required-hostname\");\n  }\n\n  // Cross-site repeat-sender signal: the fleet's sites are UNRELATED businesses\n  // (art gallery, realtor, home builder…), so the same email writing to 2+ different\n  // sites within the window is a solicitation tell no single-message scan can see.\n  // Same-site repeats alone must NOT trigger — those are genuine follow-ups. The\n  // operator explicitly accepts overblocking here (spam_auto is recoverable). Prior\n  // still-'new' rows on OTHER sites are retro-bucketed too: the first copy of a\n  // spray is delivered by design, so the copy that identifies it also cleans the\n  // queue. The scan runs EVEN WHEN the incoming copy is already spam_auto — after the\n  // classifier began catching whole spray families, an already-bucketed copy was\n  // skipping this scan and the retro cleanup never fired for exactly the sprays it\n  // was built for; escalation/reason still only applies when not already spam.\n  // Best-effort — a lookup failure never blocks a lead.\n  if (spamHandlingEnabled && n.formType !== \"newsletter\" && deps.listRecentSubmissionsForEmail) {\n    try {\n      const since = new Date(deps.now().getTime() - DUPLICATE_WINDOW_MS);\n      const prior = await deps.listRecentSubmissionsForEmail(n.email, since);\n      const otherSites = prior.filter((p) => p.siteId !== site.id);\n      if (otherSites.length > 0) {\n        if (status !== \"spam_auto\") {\n          status = \"spam_auto\";\n          if (!reasons.includes(\"repeat-sender\")) reasons.push(\"repeat-sender\");\n        }\n        const retroIds = otherSites.filter((p) => p.status === \"new\").map((p) => p.id);\n        if (deps.retroBucket && retroIds.length > 0) {\n          try {\n            await deps.retroBucket(retroIds, \"retro:repeat-sender\");\n          } catch (err) {\n            console.error(`[ingest] retroBucket (repeat-sender) threw: ${String(err)}`);\n          }\n        }\n      }\n    } catch (err) {\n      console.error(`[ingest] listRecentSubmissionsForEmail threw: ${String(err)}`);\n    }\n  }\n\n  // Duplicate/spray signal: the same pitch blasted across the fleet (or repeated) is\n  // a bot tell a lone content scan can't see. An identical body ('exact') OR a\n  // template-substituted near-copy ('similar' — the live dog-harness spray differed\n  // only in greeting; SEO sprays swap the target domain per site) → auto-spam\n  // (recoverable). Prior still-'new' copies are retro-bucketed for the same reason\n  // as above, and the scan runs even when the incoming copy is already spam_auto\n  // (see the repeat-sender note). GENUINE-RESUBMIT EXEMPTION: a match from the SAME\n  // sender on the SAME site is a real visitor double-submitting or resending after\n  // silence, not spray evidence — without this exemption the resend was silently\n  // bucketed AND retro-flipped the delivered original, vanishing an active lead\n  // with no signal. Only cross-site or different-sender copies count. Guarded:\n  // non-newsletter forms with a real body; the db helper ignores short bodies /\n  // small token sets. Best-effort — a lookup failure never blocks a lead.\n  if (\n    spamHandlingEnabled &&\n    n.formType !== \"newsletter\" &&\n    n.message !== undefined &&\n    deps.findRecentDuplicates\n  ) {\n    try {\n      const since = new Date(deps.now().getTime() - DUPLICATE_WINDOW_MS);\n      const dupes = await deps.findRecentDuplicates(n.message, since);\n      const senderEmail = n.email.trim().toLowerCase();\n      const isOwnResend = (m: { siteId: string; email: string }) =>\n        m.siteId === site.id && m.email.trim().toLowerCase() === senderEmail;\n      const exact = dupes.exact.filter((m) => !isOwnResend(m));\n      const similar = dupes.similar.filter((m) => !isOwnResend(m));\n      const reason =\n        exact.length > 0 ? \"duplicate-body\" : similar.length > 0 ? \"similar-body\" : null;\n      if (reason !== null) {\n        if (status !== \"spam_auto\") {\n          status = \"spam_auto\";\n          if (!reasons.includes(reason)) reasons.push(reason);\n        }\n        const retroIds = [...exact, ...similar].filter((m) => m.status === \"new\").map((m) => m.id);\n        if (deps.retroBucket && retroIds.length > 0) {\n          try {\n            await deps.retroBucket(retroIds, \"retro:duplicate-body\");\n          } catch (err) {\n            console.error(`[ingest] retroBucket (duplicate-body) threw: ${String(err)}`);\n          }\n        }\n      }\n    } catch (err) {\n      console.error(`[ingest] findRecentDuplicates threw: ${String(err)}`);\n    }\n  }\n  const spamReason = reasons.length > 0 ? reasons.join(\",\") : null;\n\n  const row = await deps.createSubmission({\n    siteId: site.id,\n    formType: n.formType,\n    name: n.name,\n    email: n.email,\n    extraFields: n.extraFields,\n    status,\n    spamScore: verdict.score,\n    spamReason,\n    // Optional fields spread only when present — exactOptionalPropertyTypes\n    // forbids assigning `undefined` to an optional `phone?: string` etc.\n    ...(n.phone !== undefined ? { phone: n.phone } : {}),\n    ...(n.message !== undefined ? { message: n.message } : {}),\n    ...(n.sourceUrl !== undefined ? { sourceUrl: n.sourceUrl } : {}),\n    ...(n.utm !== undefined ? { utm: n.utm } : {}),\n    submittedAt: deps.now(),\n  });\n\n  // Auto-spam (and operator-marked spam) is captured but silent: no operator\n  // email, no autoresponder, no newsletter fan-out. Skip notify entirely and\n  // record the honest \"skipped\" stamp. notify.ts also nulls both builders for\n  // these statuses (defense in depth), but short-circuiting here means the\n  // injected notify dep is never even invoked for a spam row.\n  const isSpam = row.status === \"spam_auto\" || row.status === \"spam\";\n\n  // ── best-effort tail ───────────────────────────────────────────────────────\n  // notify → stamp → newsletter fan-out. NOTHING below can cost the lead: the\n  // row is already durable, and every step here is swallowed+logged rather than\n  // allowed to turn an accepted lead into a 502. That is precisely why it does\n  // not belong on the visitor's critical path — the submitting site waits on\n  // this response under an abort budget (forms/client.ts INGEST_TIMEOUT_MS), so\n  // Resend latency used to be able to make a captured lead read as a failed\n  // submission in the visitor's browser (1836dig, 2026-08-03).\n  //\n  // `deps.defer` (Netlify's `context.waitUntil` in production) runs the tail\n  // AFTER the response goes out. Absent — every test, and any runtime without\n  // post-response execution — it runs inline exactly as before, so this is a\n  // latency change and never a behavioural one.\n  const runTail = async (): Promise<NotifyStatus> => {\n    let notify: { status: NotifyStatus; messageId: string | null };\n    if (isSpam) {\n      notify = { status: \"skipped\", messageId: null };\n    } else {\n      try {\n        notify = await deps.notify(site, row);\n      } catch (err) {\n        console.error(`[ingest] notify threw: ${String(err)}`);\n        notify = { status: \"failed\", messageId: null };\n      }\n    }\n    try {\n      await deps.stampNotified(row.id, notify.status, notify.messageId);\n    } catch (err) {\n      console.error(`[ingest] stampNotified failed: ${String(err)}`);\n    }\n\n    await runFanout();\n    return notify.status;\n  };\n\n  // Newsletter fan-out: each configured destination fires best-effort and is\n  // swallowed+logged — the lead is already persisted; never turn it into a 502.\n  // Guarded on the row status so a spam signup is never forwarded to a site\n  // webhook or added to a Mailchimp audience.\n  //\n  // FANOUT provenance (2026-07-31): the outcome is ALSO recorded on the row, one\n  // `<destination>:<outcome>` token per attempt, comma-joined in attempt order —\n  // `webhook:ok,mailchimp:401`. Outcome is `ok`, the HTTP status of a non-2xx\n  // (`0` for a network error / misconfiguration, see mailchimp.ts), or `threw`.\n  // `mailchimp-tags:failed` is appended when the member was upserted but the tag\n  // write did not land. Until this existed the results were console.error-only, so\n  // an expired Mailchimp key stopped signups reaching the audience while the row\n  // still read `notify=sent` — healthy-looking, with the failure visible nowhere the\n  // operator ever looks. Nothing attempted → nothing stamped (null stays \"no\n  // destination configured\", NOT \"we tried and lost the answer\"). The stamp is\n  // best-effort like everything else here: a provenance write must never cost a lead.\n  // A const arrow, not a hoisted declaration: `site` is narrowed non-null above,\n  // and that narrowing only survives into a closure created after it. Declared\n  // below runTail (which calls it) but before either call site, so there is no TDZ.\n  const runFanout = async (): Promise<void> => {\n    const fanout: string[] = [];\n    if (n.formType === \"newsletter\" && !isSpam) {\n      if (site.newsletterWebhook && deps.forwardNewsletter) {\n        try {\n          const fwd = await deps.forwardNewsletter(site.newsletterWebhook, row, site);\n          if (!fwd.ok)\n            console.error(`[ingest] newsletter webhook → ${fwd.status} for ${site.name}`);\n          fanout.push(fwd.ok ? \"webhook:ok\" : `webhook:${fwd.status}`);\n        } catch (err) {\n          console.error(`[ingest] newsletter webhook threw: ${String(err)}`);\n          fanout.push(\"webhook:threw\");\n        }\n      }\n      if (site.mailchimpApiKey && site.mailchimpAudienceId && deps.addToMailchimp) {\n        try {\n          const mc = await deps.addToMailchimp(site, row);\n          if (!mc.ok) console.error(`[ingest] mailchimp add → ${mc.status} for ${site.name}`);\n          fanout.push(mc.ok ? \"mailchimp:ok\" : `mailchimp:${mc.status}`);\n          // Only meaningful alongside a successful add — a failed add was never tagged\n          // either, and one token per real problem keeps the row readable.\n          if (mc.ok && mc.tagged === false) {\n            console.error(`[ingest] mailchimp tags not applied for ${site.name}`);\n            fanout.push(\"mailchimp-tags:failed\");\n          }\n        } catch (err) {\n          console.error(`[ingest] mailchimp add threw: ${String(err)}`);\n          fanout.push(\"mailchimp:threw\");\n        }\n      }\n    }\n    if (fanout.length > 0 && deps.stampFanout) {\n      try {\n        await deps.stampFanout(row.id, fanout.join(\",\"));\n      } catch (err) {\n        console.error(`[ingest] stampFanout failed: ${String(err)}`);\n      }\n    }\n  };\n\n  if (deps.defer) {\n    // A rejection escaping here would land as an unhandled rejection in the\n    // platform's post-response context, where nothing is left to catch it — so\n    // the boundary is made unrejectable. Everything inside is already swallowed;\n    // this guards the shape, not a known throw.\n    deps.defer(\n      runTail().catch((err) => {\n        console.error(`[ingest] deferred tail threw: ${String(err)}`);\n      }),\n    );\n    // The lead is durable and the response can go out now. The real notify\n    // outcome lands on the ROW via stampNotified moments later — this field is\n    // only ever read by callers wanting the in-request outcome, which by\n    // definition does not exist once the tail is deferred.\n    return { status: \"accepted\", submissionId: row.id, notifyStatus: \"deferred\" };\n  }\n  return { status: \"accepted\", submissionId: row.id, notifyStatus: await runTail() };\n}\n\n/** True when `a` and `b` are the same host or one is a subdomain of the other\n *  (case-insensitive): `www.reddoorla.com` vs `reddoorla.com` matches both ways.\n *  Exported for tests. PURE. */\nexport function hostsMatch(a: string, b: string): boolean {\n  const ha = a.trim().toLowerCase();\n  const hb = b.trim().toLowerCase();\n  if (ha.length === 0 || hb.length === 0) return false;\n  return ha === hb || ha.endsWith(`.${hb}`) || hb.endsWith(`.${ha}`);\n}\n\n/** Whether a passing token's solved-hostname is acceptable for the site at `siteUrl`.\n *  An unparseable/hostless `siteUrl` returns TRUE — the check self-disables rather\n *  than punishing a possibly-real visitor for an operator data problem (fail-open,\n *  same philosophy as verifyTurnstile). PURE. */\nexport function turnstileHostnameAcceptable(tokenHostname: string, siteUrl: string): boolean {\n  let siteHost: string;\n  try {\n    siteHost = new URL(siteUrl).hostname;\n  } catch {\n    return true;\n  }\n  if (!siteHost) return true;\n  return hostsMatch(tokenHostname, siteHost);\n}\n\n/** True when an untrusted ingest payload carries the synthetic-probe marker\n *  (top-level `testMode: true`). Read from the RAW payload so the branch never\n *  depends on normalization internals; any non-`true` value is ignored (a real\n *  visitor's form never sets it — the starter only forwards it when the submitted\n *  form field `testMode` equals \"true\"). */\nexport function isTestMode(rawPayload: unknown): boolean {\n  if (!rawPayload || typeof rawPayload !== \"object\") return false;\n  return (rawPayload as Record<string, unknown>).testMode === true;\n}\n"],"mappings":";;;;;;;;;;;AA6CA,IAAM,aAAa,oBAAI,IAAI;AAAA,EACzB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAKD,IAAM,iBAAiB,oBAAI,IAAI,CAAC,aAAa,eAAe,WAAW,CAAC;AAExE,IAAM,WAAW;AAEjB,SAAS,IAAI,GAAoB;AAC/B,SAAO,OAAO,MAAM,WAAW,EAAE,KAAK,IAAI;AAC5C;AASA,SAAS,gBAAgB,KAA+B;AACtD,QAAM,IAAI,IAAI,GAAG;AACjB,MAAI,MAAM,GAAI,QAAO;AACrB,SAAQ,sBAA4C,SAAS,CAAC,IAAK,IAAiB;AACtF;AAQO,SAAS,oBAAoB,SAAmC;AACrE,MAAI,OAAO,YAAY,YAAY,YAAY,MAAM;AACnD,WAAO,EAAE,IAAI,OAAO,QAAQ,CAAC,+BAA+B,EAAE;AAAA,EAChE;AACA,QAAM,IAAI;AACV,QAAM,OAAO,IAAI,EAAE,IAAI,KAAK,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI,EAAE,QAAQ,CAAC,EAAE,OAAO,OAAO,EAAE,KAAK,GAAG;AACxF,QAAM,QAAQ,IAAI,EAAE,KAAK,EAAE,YAAY;AACvC,QAAM,UAAU,IAAI,EAAE,OAAO;AAE7B,QAAM,WAAW,gBAAgB,EAAE,QAAQ;AAC3C,QAAM,SAAmB,CAAC;AAC1B,MAAI,CAAC,SAAS,CAAC,QAAS,QAAO,KAAK,8CAA8C;AAClF,MAAI,SAAS,CAAC,SAAS,KAAK,KAAK,EAAG,QAAO,KAAK,8BAA8B;AAC9E,MAAI,aAAa,KAAM,QAAO,KAAK,wCAAwC;AAG3E,MAAI,OAAO,SAAS,KAAK,aAAa,KAAM,QAAO,EAAE,IAAI,OAAO,OAAO;AAEvE,QAAM,cAAuC,CAAC;AAC9C,QAAM,QAAQ,EAAE;AAChB,MAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAC/C,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAK,GAAG;AAC1C,UAAI,CAAC,eAAe,IAAI,CAAC,KAAK,CAAC,EAAE,WAAW,GAAG,EAAG,aAAY,CAAC,IAAI;AAAA,IACrE;AAAA,EACF;AACA,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,CAAC,GAAG;AACtC,QAAI,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,eAAe,IAAI,CAAC,KAAK,CAAC,EAAE,WAAW,GAAG,EAAG,aAAY,CAAC,IAAI;AAAA,EAC3F;AAMA,QAAM,QAAQ,eAAe,EAAE,MAAM;AACrC,MAAI,MAAO,aAAY,SAAS;AAEhC,QAAM,QAA8B;AAAA,IAClC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,QAAQ,IAAI,EAAE,KAAK;AACzB,MAAI,MAAO,OAAM,QAAQ;AACzB,MAAI,QAAS,OAAM,UAAU;AAC7B,QAAM,YAAY,IAAI,EAAE,SAAS;AACjC,MAAI,UAAW,OAAM,YAAY;AACjC,QAAM,MAAM,IAAI,EAAE,GAAG;AACrB,MAAI,IAAK,OAAM,MAAM;AACrB,SAAO,EAAE,IAAI,MAAM,MAAM;AAC3B;;;AC9HA,IAAM,sBAAsB,KAAK,KAAK,KAAK,KAAK;AAgIhD,eAAsB,iBACpB,MACA,MACA,YACA,iBAA2D,gBACpC;AAIvB,QAAM,eACJ,OAAO,mBAAmB,WACtB,EAAE,SAAS,gBAAgB,UAAU,KAAK,IAC1C;AACN,QAAM,YAAY,aAAa;AAC/B,QAAM,aAAa,oBAAoB,UAAU;AACjD,MAAI,CAAC,WAAW,IAAI;AAClB,WAAO,EAAE,QAAQ,YAAY,QAAQ,mBAAmB,QAAQ,WAAW,OAAO;AAAA,EACpF;AAkBA,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,KAAK,iBAAiB,IAAI;AAAA,EACzC,SAAS,KAAK;AACZ,QAAI,CAAC,KAAK,cAAc,WAAW,UAAU,EAAG,OAAM;AACtD,UAAM,KAAK,MAAM,KAAK,WAAW;AAAA,MAC/B,UAAU;AAAA,MACV,SAAS;AAAA,MACT,WAAW;AAAA,MACX,OAAO,OAAO,GAAG;AAAA,MACjB,YAAY,KAAK,IAAI;AAAA,IACvB,CAAC;AACD,YAAQ;AAAA,MACN,oCAAoC,IAAI,kCAA6B,GAAG,EAAE,KAAK,OAAO,GAAG,CAAC;AAAA,IAC5F;AACA,WAAO,EAAE,QAAQ,YAAY,cAAc,GAAG,IAAI,cAAc,UAAU;AAAA,EAC5E;AACA,MAAI,CAAC,KAAM,QAAO,EAAE,QAAQ,gBAAgB,KAAK;AAYjD,MAAI,WAAW,UAAU,GAAG;AAC1B,WAAO,EAAE,QAAQ,YAAY,cAAc,aAAa,cAAc,UAAU;AAAA,EAClF;AAEA,QAAM,IAAI,WAAW;AAYrB,QAAM,sBAAsB,KAAK,WAAW;AAW5C,MAAI,UAAuB,EAAE,OAAO,GAAG,SAAS,CAAC,EAAE;AACnD,MAAI,uBAAuB,KAAK,cAAc;AAC5C,QAAI;AACF,gBAAU,KAAK,aAAa,GAAG,SAAS;AAAA,IAC1C,SAAS,KAAK;AACZ,cAAQ,MAAM,gCAAgC,OAAO,GAAG,CAAC,EAAE;AAAA,IAC7D;AAAA,EACF;AACA,QAAM,UAAU,CAAC,GAAG,QAAQ,OAAO;AACnC,MAAI,SAA2B,QAAQ,SAAS,iBAAiB,cAAc;AAC/E,MACE,uBACA,KAAK,qBACJ,cAAc,UAAU,cAAc,WACvC;AACA,aAAS;AACT,UAAM,SAAS,cAAc,SAAS,8BAA8B;AACpE,QAAI,CAAC,QAAQ,SAAS,MAAM,EAAG,SAAQ,KAAK,MAAM;AAAA,EACpD,WACE,uBACA,KAAK,oBACL,cAAc,UACd,aAAa,aAAa,QAC1B,CAAC,4BAA4B,aAAa,UAAU,KAAK,GAAG,GAC5D;AAOA,aAAS;AACT,QAAI,CAAC,QAAQ,SAAS,6BAA6B;AACjD,cAAQ,KAAK,6BAA6B;AAAA,EAC9C;AAcA,MAAI,uBAAuB,EAAE,aAAa,gBAAgB,KAAK,+BAA+B;AAC5F,QAAI;AACF,YAAM,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,QAAQ,IAAI,mBAAmB;AACjE,YAAM,QAAQ,MAAM,KAAK,8BAA8B,EAAE,OAAO,KAAK;AACrE,YAAM,aAAa,MAAM,OAAO,CAAC,MAAM,EAAE,WAAW,KAAK,EAAE;AAC3D,UAAI,WAAW,SAAS,GAAG;AACzB,YAAI,WAAW,aAAa;AAC1B,mBAAS;AACT,cAAI,CAAC,QAAQ,SAAS,eAAe,EAAG,SAAQ,KAAK,eAAe;AAAA,QACtE;AACA,cAAM,WAAW,WAAW,OAAO,CAAC,MAAM,EAAE,WAAW,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE;AAC7E,YAAI,KAAK,eAAe,SAAS,SAAS,GAAG;AAC3C,cAAI;AACF,kBAAM,KAAK,YAAY,UAAU,qBAAqB;AAAA,UACxD,SAAS,KAAK;AACZ,oBAAQ,MAAM,+CAA+C,OAAO,GAAG,CAAC,EAAE;AAAA,UAC5E;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,KAAK;AACZ,cAAQ,MAAM,iDAAiD,OAAO,GAAG,CAAC,EAAE;AAAA,IAC9E;AAAA,EACF;AAeA,MACE,uBACA,EAAE,aAAa,gBACf,EAAE,YAAY,UACd,KAAK,sBACL;AACA,QAAI;AACF,YAAM,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,QAAQ,IAAI,mBAAmB;AACjE,YAAM,QAAQ,MAAM,KAAK,qBAAqB,EAAE,SAAS,KAAK;AAC9D,YAAM,cAAc,EAAE,MAAM,KAAK,EAAE,YAAY;AAC/C,YAAM,cAAc,CAAC,MACnB,EAAE,WAAW,KAAK,MAAM,EAAE,MAAM,KAAK,EAAE,YAAY,MAAM;AAC3D,YAAM,QAAQ,MAAM,MAAM,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;AACvD,YAAM,UAAU,MAAM,QAAQ,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;AAC3D,YAAM,SACJ,MAAM,SAAS,IAAI,mBAAmB,QAAQ,SAAS,IAAI,iBAAiB;AAC9E,UAAI,WAAW,MAAM;AACnB,YAAI,WAAW,aAAa;AAC1B,mBAAS;AACT,cAAI,CAAC,QAAQ,SAAS,MAAM,EAAG,SAAQ,KAAK,MAAM;AAAA,QACpD;AACA,cAAM,WAAW,CAAC,GAAG,OAAO,GAAG,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE;AACzF,YAAI,KAAK,eAAe,SAAS,SAAS,GAAG;AAC3C,cAAI;AACF,kBAAM,KAAK,YAAY,UAAU,sBAAsB;AAAA,UACzD,SAAS,KAAK;AACZ,oBAAQ,MAAM,gDAAgD,OAAO,GAAG,CAAC,EAAE;AAAA,UAC7E;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,KAAK;AACZ,cAAQ,MAAM,wCAAwC,OAAO,GAAG,CAAC,EAAE;AAAA,IACrE;AAAA,EACF;AACA,QAAM,aAAa,QAAQ,SAAS,IAAI,QAAQ,KAAK,GAAG,IAAI;AAE5D,QAAM,MAAM,MAAM,KAAK,iBAAiB;AAAA,IACtC,QAAQ,KAAK;AAAA,IACb,UAAU,EAAE;AAAA,IACZ,MAAM,EAAE;AAAA,IACR,OAAO,EAAE;AAAA,IACT,aAAa,EAAE;AAAA,IACf;AAAA,IACA,WAAW,QAAQ;AAAA,IACnB;AAAA;AAAA;AAAA,IAGA,GAAI,EAAE,UAAU,SAAY,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAAA,IAClD,GAAI,EAAE,YAAY,SAAY,EAAE,SAAS,EAAE,QAAQ,IAAI,CAAC;AAAA,IACxD,GAAI,EAAE,cAAc,SAAY,EAAE,WAAW,EAAE,UAAU,IAAI,CAAC;AAAA,IAC9D,GAAI,EAAE,QAAQ,SAAY,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC;AAAA,IAC5C,aAAa,KAAK,IAAI;AAAA,EACxB,CAAC;AAOD,QAAM,SAAS,IAAI,WAAW,eAAe,IAAI,WAAW;AAe5D,QAAM,UAAU,YAAmC;AACjD,QAAI;AACJ,QAAI,QAAQ;AACV,eAAS,EAAE,QAAQ,WAAW,WAAW,KAAK;AAAA,IAChD,OAAO;AACL,UAAI;AACF,iBAAS,MAAM,KAAK,OAAO,MAAM,GAAG;AAAA,MACtC,SAAS,KAAK;AACZ,gBAAQ,MAAM,0BAA0B,OAAO,GAAG,CAAC,EAAE;AACrD,iBAAS,EAAE,QAAQ,UAAU,WAAW,KAAK;AAAA,MAC/C;AAAA,IACF;AACA,QAAI;AACF,YAAM,KAAK,cAAc,IAAI,IAAI,OAAO,QAAQ,OAAO,SAAS;AAAA,IAClE,SAAS,KAAK;AACZ,cAAQ,MAAM,kCAAkC,OAAO,GAAG,CAAC,EAAE;AAAA,IAC/D;AAEA,UAAM,UAAU;AAChB,WAAO,OAAO;AAAA,EAChB;AAqBA,QAAM,YAAY,YAA2B;AAC3C,UAAM,SAAmB,CAAC;AAC1B,QAAI,EAAE,aAAa,gBAAgB,CAAC,QAAQ;AAC1C,UAAI,KAAK,qBAAqB,KAAK,mBAAmB;AACpD,YAAI;AACF,gBAAM,MAAM,MAAM,KAAK,kBAAkB,KAAK,mBAAmB,KAAK,IAAI;AAC1E,cAAI,CAAC,IAAI;AACP,oBAAQ,MAAM,sCAAiC,IAAI,MAAM,QAAQ,KAAK,IAAI,EAAE;AAC9E,iBAAO,KAAK,IAAI,KAAK,eAAe,WAAW,IAAI,MAAM,EAAE;AAAA,QAC7D,SAAS,KAAK;AACZ,kBAAQ,MAAM,sCAAsC,OAAO,GAAG,CAAC,EAAE;AACjE,iBAAO,KAAK,eAAe;AAAA,QAC7B;AAAA,MACF;AACA,UAAI,KAAK,mBAAmB,KAAK,uBAAuB,KAAK,gBAAgB;AAC3E,YAAI;AACF,gBAAM,KAAK,MAAM,KAAK,eAAe,MAAM,GAAG;AAC9C,cAAI,CAAC,GAAG,GAAI,SAAQ,MAAM,iCAA4B,GAAG,MAAM,QAAQ,KAAK,IAAI,EAAE;AAClF,iBAAO,KAAK,GAAG,KAAK,iBAAiB,aAAa,GAAG,MAAM,EAAE;AAG7D,cAAI,GAAG,MAAM,GAAG,WAAW,OAAO;AAChC,oBAAQ,MAAM,2CAA2C,KAAK,IAAI,EAAE;AACpE,mBAAO,KAAK,uBAAuB;AAAA,UACrC;AAAA,QACF,SAAS,KAAK;AACZ,kBAAQ,MAAM,iCAAiC,OAAO,GAAG,CAAC,EAAE;AAC5D,iBAAO,KAAK,iBAAiB;AAAA,QAC/B;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,SAAS,KAAK,KAAK,aAAa;AACzC,UAAI;AACF,cAAM,KAAK,YAAY,IAAI,IAAI,OAAO,KAAK,GAAG,CAAC;AAAA,MACjD,SAAS,KAAK;AACZ,gBAAQ,MAAM,gCAAgC,OAAO,GAAG,CAAC,EAAE;AAAA,MAC7D;AAAA,IACF;AAAA,EACF;AAEA,MAAI,KAAK,OAAO;AAKd,SAAK;AAAA,MACH,QAAQ,EAAE,MAAM,CAAC,QAAQ;AACvB,gBAAQ,MAAM,iCAAiC,OAAO,GAAG,CAAC,EAAE;AAAA,MAC9D,CAAC;AAAA,IACH;AAKA,WAAO,EAAE,QAAQ,YAAY,cAAc,IAAI,IAAI,cAAc,WAAW;AAAA,EAC9E;AACA,SAAO,EAAE,QAAQ,YAAY,cAAc,IAAI,IAAI,cAAc,MAAM,QAAQ,EAAE;AACnF;AAKO,SAAS,WAAW,GAAW,GAAoB;AACxD,QAAM,KAAK,EAAE,KAAK,EAAE,YAAY;AAChC,QAAM,KAAK,EAAE,KAAK,EAAE,YAAY;AAChC,MAAI,GAAG,WAAW,KAAK,GAAG,WAAW,EAAG,QAAO;AAC/C,SAAO,OAAO,MAAM,GAAG,SAAS,IAAI,EAAE,EAAE,KAAK,GAAG,SAAS,IAAI,EAAE,EAAE;AACnE;AAMO,SAAS,4BAA4B,eAAuB,SAA0B;AAC3F,MAAI;AACJ,MAAI;AACF,eAAW,IAAI,IAAI,OAAO,EAAE;AAAA,EAC9B,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,CAAC,SAAU,QAAO;AACtB,SAAO,WAAW,eAAe,QAAQ;AAC3C;AAOO,SAAS,WAAW,YAA8B;AACvD,MAAI,CAAC,cAAc,OAAO,eAAe,SAAU,QAAO;AAC1D,SAAQ,WAAuC,aAAa;AAC9D;","names":[]}

package/dist/{chunk-XIDUYLSR.js → chunk-7CJ3DVZW.js}

@@ -1,6 +1,6 @@
 import {
   withRecipe
-} from "./chunk-3G25KIWW.js";
+} from "./chunk-ZTPPCHDB.js";
 import {
   readPackageJson,
   writePackageJson
@@ -96,4 +96,4 @@ async function convertToPnpm(site, opts = {}) {
 export {
   convertToPnpm
 };
-//# sourceMappingURL=chunk-XIDUYLSR.js.map
+//# sourceMappingURL=chunk-7CJ3DVZW.js.map

package/dist/{chunk-NYUYNYQL.js → chunk-7MKT4I5T.js}

@@ -9,6 +9,18 @@ function isValidToken(s) {
 function newProspectAuditId() {
   return `pa_${crypto.randomUUID()}`;
 }
+function siteKey(url) {
+  const raw = url.trim();
+  if (raw === "") return "";
+  try {
+    const u = new URL(/^[a-z][a-z0-9+.-]*:\/\//i.test(raw) ? raw : `https://${raw}`);
+    const host = u.hostname.toLowerCase().replace(/^www\./, "");
+    const path = u.pathname.replace(/\/+$/, "");
+    return `${host}${path}`;
+  } catch {
+    return raw;
+  }
+}
 async function createProspectAudit(db, audit) {
   const id = newProspectAuditId();
   const token = generateToken();
@@ -16,6 +28,7 @@ async function createProspectAudit(db, audit) {
     id,
     token,
     url: audit.url,
+    site_key: siteKey(audit.url),
     business: audit.business,
     created_at: (/* @__PURE__ */ new Date()).toISOString(),
     status: audit.status ?? "complete",
@@ -40,9 +53,10 @@ export {
   generateToken,
   isValidToken,
   newProspectAuditId,
+  siteKey,
   createProspectAudit,
   getProspectAuditByToken,
   MAX_RECENT_PROSPECT_AUDITS,
   listRecentProspectAudits
 };
-//# sourceMappingURL=chunk-NYUYNYQL.js.map
+//# sourceMappingURL=chunk-7MKT4I5T.js.map

package/dist/chunk-7MKT4I5T.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/db/prospect-audits.ts"],"sourcesContent":["import { randomBytes } from \"node:crypto\";\nimport type { Db } from \"./client.js\";\n\n/** 16 random bytes → 22-char base64url string: unguessable, URL-safe. */\nexport function generateToken(): string {\n  return randomBytes(16).toString(\"base64url\");\n}\n\n/** Anything not exactly generateToken()-shaped is a probe, not a report. */\nexport function isValidToken(s: string): boolean {\n  return /^[A-Za-z0-9_-]{22}$/.test(s);\n}\n\n/** Opaque, collision-free id (mirrors newSubmissionId / newDeadLetterId).\n *  crypto is a Node 20 global — no new dep. Nothing reads this format; `token`\n *  is the public handle. */\nexport function newProspectAuditId(): string {\n  return `pa_${crypto.randomUUID()}`;\n}\n\n/** \"complete\" when every pipeline stage succeeded; \"partial\" when any stage\n *  failed or was deliberately skipped (StageResult's `ok: false` covers\n *  both — the pipeline doesn't distinguish them at this layer). The report\n *  itself already degrades each failed section to \"not measured\"; this is\n *  what lets a future dashboard tell complete from partial without\n *  deserializing the whole result_json. */\nexport type ProspectAuditStatus = \"complete\" | \"partial\";\n\n/**\n * The lineage handle for a site: one key for every way of writing its address.\n *\n * `url` is kept exactly as it was given, because what we audited is a fact\n * about the run. It is the wrong thing to group by, though, and the corpus\n * already proves it — `beachfrontdentistry.com` and `beachfrontdentistry.com/`\n * are two separate histories in the table today, as are the two spellings of\n * ludlowkingsley.com. Nothing has broken only because nothing yet compares two\n * audits of one site. The moment the report offers a before and an after, a\n * trailing slash turns a returning client into a stranger.\n *\n * Scheme, a leading \"www.\", a trailing slash, a query string and a fragment all\n * go: none of them distinguish one site from another. The path stays, because a\n * site living in a subdirectory genuinely is a different site.\n *\n * Never throws. A key we cannot compute must not take an audit down with it —\n * an unparseable input falls back to its trimmed self, which groups nothing and\n * so is no worse than having no key at all.\n */\nexport function siteKey(url: string): string {\n  const raw = url.trim();\n  if (raw === \"\") return \"\";\n  try {\n    const u = new URL(/^[a-z][a-z0-9+.-]*:\\/\\//i.test(raw) ? raw : `https://${raw}`);\n    const host = u.hostname.toLowerCase().replace(/^www\\./, \"\");\n    const path = u.pathname.replace(/\\/+$/, \"\");\n    return `${host}${path}`;\n  } catch {\n    return raw;\n  }\n}\n\nexport type NewProspectAudit = {\n  url: string;\n  business: string | null;\n  resultJson: string;\n  /** Defaults to \"complete\" — the column's own SQL default — for callers\n   *  (tests, ad-hoc scripts) that don't track per-stage outcomes. The\n   *  prospect-audit CLI, the only real writer, always computes and passes\n   *  this explicitly. */\n  status?: ProspectAuditStatus;\n};\n\nexport async function createProspectAudit(\n  db: Db,\n  audit: NewProspectAudit,\n): Promise<{ id: string; token: string }> {\n  const id = newProspectAuditId();\n  const token = generateToken();\n  await db\n    .insertInto(\"prospect_audits\")\n    .values({\n      id,\n      token,\n      url: audit.url,\n      site_key: siteKey(audit.url),\n      business: audit.business,\n      created_at: new Date().toISOString(),\n      status: audit.status ?? \"complete\",\n      result_json: audit.resultJson,\n    })\n    .execute();\n  return { id, token };\n}\n\nexport type ProspectAuditRow = {\n  id: string;\n  url: string;\n  business: string | null;\n  created_at: string;\n  status: string;\n  result_json: string;\n};\n\nexport async function getProspectAuditByToken(\n  db: Db,\n  token: string,\n): Promise<ProspectAuditRow | null> {\n  const row = await db\n    .selectFrom(\"prospect_audits\")\n    .select([\"id\", \"url\", \"business\", \"created_at\", \"status\", \"result_json\"])\n    .where(\"token\", \"=\", token)\n    .executeTakeFirst();\n  return row ?? null;\n}\n\n/** The columns the cockpit's /audits listing page shows. Deliberately NOT\n *  `result_json` — large, and useless to a list — but `token` IS selected:\n *  the listing needs it to build each row's `/r/{token}` link, so it's\n *  rendered only into an href, never displayed as a raw value. */\nexport type ProspectAuditListItem = {\n  id: string;\n  token: string;\n  url: string;\n  business: string | null;\n  status: string;\n  created_at: string;\n};\n\n/** Ceiling on `listRecentProspectAudits`' `limit`, enforced defensively (a\n *  caller passing 10_000 must not get 10_000 rows) — well past anything a\n *  listing page would ever render on one screen. */\nexport const MAX_RECENT_PROSPECT_AUDITS = 100;\n\n/** Clamp a caller-supplied limit into [1, MAX_RECENT_PROSPECT_AUDITS], with a\n *  safe fallback of 1 for anything non-finite (NaN, ±Infinity) rather than\n *  letting a bad input reach the query unclamped. */\nfunction clampLimit(limit: number): number {\n  const n = Number.isFinite(limit) ? Math.trunc(limit) : 1;\n  return Math.min(Math.max(n, 1), MAX_RECENT_PROSPECT_AUDITS);\n}\n\n/** Newest-first audits for the cockpit's /audits listing page, capped both\n *  defensively (see clampLimit) and by an index (migration 0010) so the\n *  ORDER BY never falls back to a raw scan + a temp b-tree sort — see the\n *  EXPLAIN-query-plan gate, tests/db/query-plans.test.ts. */\nexport async function listRecentProspectAudits(\n  db: Db,\n  limit: number,\n): Promise<ProspectAuditListItem[]> {\n  return db\n    .selectFrom(\"prospect_audits\")\n    .select([\"id\", \"token\", \"url\", \"business\", \"status\", \"created_at\"])\n    .orderBy(\"created_at\", \"desc\")\n    .limit(clampLimit(limit))\n    .execute();\n}\n"],"mappings":";AAAA,SAAS,mBAAmB;AAIrB,SAAS,gBAAwB;AACtC,SAAO,YAAY,EAAE,EAAE,SAAS,WAAW;AAC7C;AAGO,SAAS,aAAa,GAAoB;AAC/C,SAAO,sBAAsB,KAAK,CAAC;AACrC;AAKO,SAAS,qBAA6B;AAC3C,SAAO,MAAM,OAAO,WAAW,CAAC;AAClC;AA6BO,SAAS,QAAQ,KAAqB;AAC3C,QAAM,MAAM,IAAI,KAAK;AACrB,MAAI,QAAQ,GAAI,QAAO;AACvB,MAAI;AACF,UAAM,IAAI,IAAI,IAAI,2BAA2B,KAAK,GAAG,IAAI,MAAM,WAAW,GAAG,EAAE;AAC/E,UAAM,OAAO,EAAE,SAAS,YAAY,EAAE,QAAQ,UAAU,EAAE;AAC1D,UAAM,OAAO,EAAE,SAAS,QAAQ,QAAQ,EAAE;AAC1C,WAAO,GAAG,IAAI,GAAG,IAAI;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAaA,eAAsB,oBACpB,IACA,OACwC;AACxC,QAAM,KAAK,mBAAmB;AAC9B,QAAM,QAAQ,cAAc;AAC5B,QAAM,GACH,WAAW,iBAAiB,EAC5B,OAAO;AAAA,IACN;AAAA,IACA;AAAA,IACA,KAAK,MAAM;AAAA,IACX,UAAU,QAAQ,MAAM,GAAG;AAAA,IAC3B,UAAU,MAAM;AAAA,IAChB,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,IACnC,QAAQ,MAAM,UAAU;AAAA,IACxB,aAAa,MAAM;AAAA,EACrB,CAAC,EACA,QAAQ;AACX,SAAO,EAAE,IAAI,MAAM;AACrB;AAWA,eAAsB,wBACpB,IACA,OACkC;AAClC,QAAM,MAAM,MAAM,GACf,WAAW,iBAAiB,EAC5B,OAAO,CAAC,MAAM,OAAO,YAAY,cAAc,UAAU,aAAa,CAAC,EACvE,MAAM,SAAS,KAAK,KAAK,EACzB,iBAAiB;AACpB,SAAO,OAAO;AAChB;AAkBO,IAAM,6BAA6B;AAK1C,SAAS,WAAW,OAAuB;AACzC,QAAM,IAAI,OAAO,SAAS,KAAK,IAAI,KAAK,MAAM,KAAK,IAAI;AACvD,SAAO,KAAK,IAAI,KAAK,IAAI,GAAG,CAAC,GAAG,0BAA0B;AAC5D;AAMA,eAAsB,yBACpB,IACA,OACkC;AAClC,SAAO,GACJ,WAAW,iBAAiB,EAC5B,OAAO,CAAC,MAAM,SAAS,OAAO,YAAY,UAAU,YAAY,CAAC,EACjE,QAAQ,cAAc,MAAM,EAC5B,MAAM,WAAW,KAAK,CAAC,EACvB,QAAQ;AACb;","names":[]}

package/dist/{chunk-Z3KYFUN6.js → chunk-B6NUZ2ZX.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-J7SZQUCW.js";
 import {
   withRecipe
-} from "./chunk-3G25KIWW.js";
+} from "./chunk-ZTPPCHDB.js";
 import {
   bumpDep,
   readPackageJson,
@@ -243,4 +243,4 @@ async function upgradeSvelte4to5(site, opts = {}) {
 export {
   upgradeSvelte4to5
 };
-//# sourceMappingURL=chunk-Z3KYFUN6.js.map
+//# sourceMappingURL=chunk-B6NUZ2ZX.js.map