@reddoorla/maintenance 0.91.0 → 0.92.0

package/dist/{bump-deps-KGH5UYSF.js → bump-deps-GI7PHMOC.js}

@@ -5,19 +5,19 @@ import {
   appendSkipNotice,
   fleetWorkdir,
   prepareFleetSites
-} from "./chunk-TVL5MVUF.js";
+} from "./chunk-TCF6S7AD.js";
 import {
   resolveSites
 } from "./chunk-Q47DU255.js";
 import {
   bumpDeps
-} from "./chunk-2NJQLSEU.js";
-import "./chunk-3G25KIWW.js";
+} from "./chunk-PPIZHDJL.js";
+import "./chunk-ZTPPCHDB.js";
 import "./chunk-Z3JXLULD.js";
-import "./chunk-RARREDQE.js";
-import "./chunk-XTK5VIQB.js";
 import "./chunk-LBYOLBW7.js";
+import "./chunk-RARREDQE.js";
 import "./chunk-XXTZBPUY.js";
+import "./chunk-XTK5VIQB.js";
 
 // src/cli/commands/bump-deps.ts
 import { resolve } from "path";
@@ -57,4 +57,4 @@ async function runBumpDepsCommand(site, opts) {
 export {
   runBumpDepsCommand
 };
-//# sourceMappingURL=bump-deps-KGH5UYSF.js.map
+//# sourceMappingURL=bump-deps-GI7PHMOC.js.map

package/dist/{chunk-A6T2R63Z.js → chunk-3HS6LPFX.js}

@@ -1,6 +1,6 @@
 import {
   withRecipe
-} from "./chunk-3G25KIWW.js";
+} from "./chunk-ZTPPCHDB.js";
 import {
   ALL_TEMPLATES,
   RENOVATE_ACTION_CONFIG,
@@ -229,4 +229,4 @@ export {
   planTemplateDiffs,
   syncConfigs
 };
-//# sourceMappingURL=chunk-A6T2R63Z.js.map
+//# sourceMappingURL=chunk-3HS6LPFX.js.map

package/dist/{chunk-UXJZU23T.js → chunk-4NUKMPOO.js}

@@ -1,27 +1,27 @@
 import {
   convertToPnpm
-} from "./chunk-XIDUYLSR.js";
+} from "./chunk-7CJ3DVZW.js";
 import {
   svelteCodemods
-} from "./chunk-IYSEC543.js";
+} from "./chunk-LS6QPANO.js";
 import {
   healthEndpoint
-} from "./chunk-BQRFQSGY.js";
+} from "./chunk-4R3YAQNV.js";
 import {
   smokeSuite
-} from "./chunk-Y53WOQIJ.js";
+} from "./chunk-CVJF2IC5.js";
 import {
   onboard
-} from "./chunk-7RJ2HMMJ.js";
+} from "./chunk-NTLSMJHW.js";
 import {
   syncConfigs
-} from "./chunk-A6T2R63Z.js";
+} from "./chunk-3HS6LPFX.js";
 import {
   withRecipe
-} from "./chunk-3G25KIWW.js";
+} from "./chunk-ZTPPCHDB.js";
 import {
   runAudits
-} from "./chunk-QD427NIO.js";
+} from "./chunk-JB4Q3C3M.js";
 import {
   siteLabel
 } from "./chunk-XXTZBPUY.js";
@@ -143,4 +143,4 @@ export {
   DEFAULT_INIT_STEPS,
   init
 };
-//# sourceMappingURL=chunk-UXJZU23T.js.map
+//# sourceMappingURL=chunk-4NUKMPOO.js.map

package/dist/{chunk-BQRFQSGY.js → chunk-4R3YAQNV.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-R53VL3RI.js";
 import {
   withRecipe
-} from "./chunk-3G25KIWW.js";
+} from "./chunk-ZTPPCHDB.js";
 import {
   defaultSpawn
 } from "./chunk-LBYOLBW7.js";
@@ -142,4 +142,4 @@ async function healthEndpoint(site, deps = { spawn: defaultSpawn }) {
 export {
   healthEndpoint
 };
-//# sourceMappingURL=chunk-BQRFQSGY.js.map
+//# sourceMappingURL=chunk-4R3YAQNV.js.map

package/dist/{chunk-JRHIFA5R.js → chunk-5XMKJX74.js}

@@ -1,6 +1,9 @@
 import {
   SPAM_THRESHOLD
 } from "./chunk-NO74DXDP.js";
+import {
+  parseReplyCopy
+} from "./chunk-PJ23RDHT.js";
 import {
   SUBMISSION_FORM_TYPES
 } from "./chunk-2OP4JKIQ.js";
@@ -17,7 +20,8 @@ var KNOWN_KEYS = /* @__PURE__ */ new Set([
   "sourceUrl",
   "utm",
   "extra",
-  "_meta"
+  "_meta",
+  "_reply"
 ]);
 var DANGEROUS_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
 var EMAIL_RE = /^[^@\s]+@[^@\s]+\.[^@\s]+$/;
@@ -47,12 +51,14 @@ function normalizeSubmission(payload) {
   const extra = p.extra;
   if (typeof extra === "object" && extra !== null) {
     for (const [k, v] of Object.entries(extra)) {
-      if (!DANGEROUS_KEYS.has(k)) extraFields[k] = v;
+      if (!DANGEROUS_KEYS.has(k) && !k.startsWith("_")) extraFields[k] = v;
     }
   }
   for (const [k, v] of Object.entries(p)) {
-    if (!KNOWN_KEYS.has(k) && !DANGEROUS_KEYS.has(k)) extraFields[k] = v;
+    if (!KNOWN_KEYS.has(k) && !DANGEROUS_KEYS.has(k) && !k.startsWith("_")) extraFields[k] = v;
   }
+  const reply = parseReplyCopy(p._reply);
+  if (reply) extraFields._reply = reply;
   const value = {
     formType,
     name,
@@ -281,4 +287,4 @@ export {
   ingestSubmission,
   hostsMatch
 };
-//# sourceMappingURL=chunk-JRHIFA5R.js.map
+//# sourceMappingURL=chunk-5XMKJX74.js.map

package/dist/chunk-5XMKJX74.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/forms/payload.ts","../src/forms/ingest.ts"],"sourcesContent":["import { SUBMISSION_FORM_TYPES, type FormType } from \"./types.js\";\nimport type { SubmissionMeta } from \"./meta.js\";\nimport { parseReplyCopy, type ReplyCopy } from \"./reply-copy.js\";\n\n/** The JSON wire format a fleet site forwards to the ingest endpoint.\n *\n *  Underscore-prefixed keys are RESERVED for transport concerns and are never\n *  lead data: `_meta` (below) and `_screenOut` (the bot screen-out beacon —\n *  a `{ _screenOut: \"honeypot\" | \"too-fast\" }` body is a counter ping, not a\n *  submission; see ingest.ts `parseScreenOut`). Site field names must not\n *  start with `_`. */\nexport type SubmissionPayload = {\n  formType?: string;\n  name?: string;\n  firstName?: string;\n  lastName?: string;\n  email?: string;\n  phone?: string;\n  message?: string;\n  sourceUrl?: string;\n  utm?: string;\n  /** Any additional, site-specific fields. */\n  extra?: Record<string, unknown>;\n  /** Reserved transport envelope (token/IP/UA); stripped by normalizeSubmission, never persisted. */\n  _meta?: SubmissionMeta;\n  /** Reserved: confirmation-email copy the SITE resolved from its own CMS.\n   *  Validated by parseReplyCopy, then stored under the same key in extraFields\n   *  so a replayed submission sends the same email it would have sent live. */\n  _reply?: ReplyCopy;\n};\n\nexport type NormalizedSubmission = {\n  formType: FormType;\n  name: string;\n  email: string;\n  phone?: string;\n  message?: string;\n  sourceUrl?: string;\n  utm?: string;\n  extraFields: Record<string, unknown>;\n};\n\nexport type NormalizeResult =\n  { ok: true; value: NormalizedSubmission } | { ok: false; errors: string[] };\n\nconst KNOWN_KEYS = new Set([\n  \"formType\",\n  \"name\",\n  \"firstName\",\n  \"lastName\",\n  \"email\",\n  \"phone\",\n  \"message\",\n  \"sourceUrl\",\n  \"utm\",\n  \"extra\",\n  \"_meta\",\n  \"_reply\",\n]);\n\n// Keys that, copied as own-properties into the captured object, could surprise a\n// downstream consumer (template/DB layer). This is an untrusted boundary, so the\n// extraFields merge drops them rather than trusting the caller.\nconst DANGEROUS_KEYS = new Set([\"__proto__\", \"constructor\", \"prototype\"]);\n\nconst EMAIL_RE = /^[^@\\s]+@[^@\\s]+\\.[^@\\s]+$/;\n\nfunction str(v: unknown): string {\n  return typeof v === \"string\" ? v.trim() : \"\";\n}\n\n/**\n * Resolve the submission's formType. An ABSENT/blank value defaults to \"contact\"\n * (the long-standing minimal-form contract). A PRESENT but unrecognized value\n * (e.g. a typo'd \"news\") returns null → the caller rejects it, rather than\n * silently storing it as contact — which would, for a newsletter signup, drop the\n * Mailchimp fan-out. Mirrors createIngestEndpoint's reject-invalid behavior.\n */\nfunction resolveFormType(raw: unknown): FormType | null {\n  const s = str(raw);\n  if (s === \"\") return \"contact\";\n  return (SUBMISSION_FORM_TYPES as readonly string[]).includes(s) ? (s as FormType) : null;\n}\n\n/**\n * Defensively normalize an untrusted ingest payload into typed fields. Folds\n * name/first+last, lowercases email, and dumps every unclaimed key into\n * extraFields so no site-specific data is lost. Rejects only when there's\n * nothing to act on (no email AND no message) or a present email is malformed.\n */\nexport function normalizeSubmission(payload: unknown): NormalizeResult {\n  if (typeof payload !== \"object\" || payload === null) {\n    return { ok: false, errors: [\"payload must be a JSON object\"] };\n  }\n  const p = payload as Record<string, unknown>;\n  const name = str(p.name) || [str(p.firstName), str(p.lastName)].filter(Boolean).join(\" \");\n  const email = str(p.email).toLowerCase();\n  const message = str(p.message);\n\n  const formType = resolveFormType(p.formType);\n  const errors: string[] = [];\n  if (!email && !message) errors.push(\"at least one of email or message is required\");\n  if (email && !EMAIL_RE.test(email)) errors.push(\"email is not a valid address\");\n  if (formType === null) errors.push(\"formType is not a recognized form type\");\n  // The `|| formType === null` is redundant for control flow (the push above\n  // already made errors non-empty) but narrows formType to FormType past this line.\n  if (errors.length > 0 || formType === null) return { ok: false, errors };\n\n  const extraFields: Record<string, unknown> = {};\n  const extra = p.extra;\n  if (typeof extra === \"object\" && extra !== null) {\n    for (const [k, v] of Object.entries(extra)) {\n      if (!DANGEROUS_KEYS.has(k) && !k.startsWith(\"_\")) extraFields[k] = v;\n    }\n  }\n  for (const [k, v] of Object.entries(p)) {\n    if (!KNOWN_KEYS.has(k) && !DANGEROUS_KEYS.has(k) && !k.startsWith(\"_\")) extraFields[k] = v;\n  }\n  // The ONE underscore key a caller may set. Both loops above dropped the rest,\n  // including any `_reply` smuggled in through `extra` — this is the only way a\n  // value reaches that key, and it is validated on the way through. Without it,\n  // a bot could POST its own copy and dictate the text of an email we send from\n  // a domain with real sending reputation.\n  const reply = parseReplyCopy(p._reply);\n  if (reply) extraFields._reply = reply;\n\n  const value: NormalizedSubmission = {\n    formType,\n    name,\n    email,\n    extraFields,\n  };\n  const phone = str(p.phone);\n  if (phone) value.phone = phone;\n  if (message) value.message = message;\n  const sourceUrl = str(p.sourceUrl);\n  if (sourceUrl) value.sourceUrl = sourceUrl;\n  const utm = str(p.utm);\n  if (utm) value.utm = utm;\n  return { ok: true, value };\n}\n","import type { WebsiteRow } from \"../reports/airtable/websites.js\";\nimport type {\n  SubmissionRow,\n  SubmissionInput,\n  NotifyStatus,\n  SubmissionStatus,\n} from \"../reports/submission-row.js\";\nimport { normalizeSubmission, type NormalizedSubmission } from \"./payload.js\";\nimport type { TurnstileOutcome, TurnstileVerification } from \"./turnstile.js\";\nimport { SPAM_THRESHOLD, type SpamVerdict } from \"./spam-classifier.js\";\n\n/** How far back the duplicate-spray AND repeat-sender lookups scan. Sprays arrive in\n *  bursts but bots also re-run for weeks; 30 days catches repeats without an unbounded\n *  table scan. */\nconst DUPLICATE_WINDOW_MS = 30 * 24 * 60 * 60 * 1000;\n\nexport type IngestDeps = {\n  getWebsiteBySlug: (slug: string) => Promise<WebsiteRow | null>;\n  createSubmission: (input: SubmissionInput) => Promise<SubmissionRow>;\n  /** Optional last-resort capture for a lead whose site lookup THREW (a store\n   *  outage, not an unknown slug). When present, the lead is persisted here and\n   *  the visitor still gets \"accepted\"; `db replay-deadletters` re-runs it once\n   *  the lookup recovers. Absent → the error propagates exactly as before, so\n   *  callers that never wired it are byte-for-byte unchanged. */\n  deadLetter?: (input: {\n    siteSlug: string;\n    payload: unknown;\n    turnstile: TurnstileVerification;\n    error: string;\n    receivedAt: Date;\n  }) => Promise<{ id: string }>;\n  notify: (\n    site: WebsiteRow,\n    submission: SubmissionRow,\n  ) => Promise<{ status: NotifyStatus; messageId: string | null }>;\n  stampNotified: (id: string, status: NotifyStatus, messageId: string | null) => Promise<void>;\n  now: () => Date;\n  /** Optional spam classifier. When present, its verdict drives the stored\n   *  status/score/reason; absent → every submission scores 0 (fail-open, clean).\n   *  Injected so the classifier stays a pure, transport-agnostic leaf. */\n  classifySpam?: (n: NormalizedSubmission, turnstile: TurnstileOutcome) => SpamVerdict;\n  /** Optional: fleet-wide duplicate/near-duplicate body lookup since `since`. Drives\n   *  the duplicate-spray signal — the same pitch blasted to many sites shows up as\n   *  identical (`exact`) or template-substituted (`similar`, token-set Jaccard) bodies.\n   *  Statuses let the retro re-bucket pick still-'new' prior copies; siteId+email let\n   *  the caller exempt a genuine same-sender resubmission on the same site. Absent →\n   *  the check is skipped (fail-open clean). */\n  findRecentDuplicates?: (\n    message: string,\n    since: Date,\n  ) => Promise<{\n    exact: Array<{ id: string; status: string; siteId: string; email: string }>;\n    similar: Array<{ id: string; status: string; siteId: string; email: string }>;\n  }>;\n  /** Optional: recent non-newsletter submissions from the same email since `since`.\n   *  Drives the cross-site repeat-sender signal — the fleet's sites are unrelated\n   *  businesses, so one address contacting 2+ of them within the window is a\n   *  solicitation tell. Absent → the check is skipped (fail-open clean). */\n  listRecentSubmissionsForEmail?: (\n    email: string,\n    since: Date,\n  ) => Promise<Array<{ id: string; siteId: string; status: string }>>;\n  /** Optional: retroactively re-bucket prior still-'new' rows once a later copy\n   *  identifies a spray (the first copy is delivered by design). Implementations\n   *  must only touch status='new' rows. Best-effort — failures are swallowed. */\n  retroBucket?: (ids: string[], reason: string) => Promise<void>;\n  /** Optional: POST a newsletter submission to the site's configured webhook\n   *  (best-effort). Omitted in tests/handlers that don't need it. */\n  forwardNewsletter?: (\n    webhookUrl: string,\n    submission: SubmissionRow,\n    site: WebsiteRow,\n  ) => Promise<{ ok: boolean; status: number }>;\n  /** Optional: add a newsletter submitter to the site's Mailchimp audience\n   *  (best-effort). Omitted where unused. `tagged:false` reports a member who was\n   *  upserted but could NOT be tagged — recorded separately, see FANOUT below. */\n  addToMailchimp?: (\n    site: WebsiteRow,\n    submission: SubmissionRow,\n  ) => Promise<{ ok: boolean; status: number; tagged?: boolean }>;\n  /** Optional: persist the newsletter fan-out outcome on the row (see FANOUT below).\n   *  Best-effort — failures are swallowed. Absent → the fan-out still runs, just\n   *  unrecorded (older callers and most tests). */\n  stampFanout?: (id: string, fanoutStatus: string) => Promise<void>;\n  /** Optional: run the best-effort tail (notify → stamp → fan-out) AFTER the\n   *  response instead of before it. Production passes Netlify's\n   *  `context.waitUntil`, which keeps the invocation alive until the promise\n   *  settles. Absent → the tail runs inline, exactly as it always did; this is a\n   *  latency change, never a behavioural one.\n   *\n   *  Why it matters: the submitting site waits on this response under an abort\n   *  budget (forms/client.ts `INGEST_TIMEOUT_MS`). Once the row is written the\n   *  lead is captured, so every further second spent on email/webhook providers\n   *  is time in which a captured lead can still be reported to the visitor as a\n   *  failed submission — which is exactly what happened to 1836dig on\n   *  2026-08-03. */\n  defer?: (work: Promise<unknown>) => void;\n};\n\nexport type IngestResult =\n  | { status: \"accepted\"; submissionId: string; notifyStatus: NotifyStatus | \"deferred\" }\n  | { status: \"rejected\"; reason: \"invalid-payload\"; errors: string[] }\n  | { status: \"unknown-site\"; slug: string };\n\nexport type ScreenOutDeps = {\n  getWebsiteBySlug: (slug: string) => Promise<WebsiteRow | null>;\n  recordScreenOut: (siteId: string, reason: \"honeypot\" | \"too-fast\") => Promise<void>;\n};\n\nexport type ScreenOutResult =\n  { status: \"recorded\"; slug: string } | { status: \"unknown-site\"; slug: string };\n\n/** Extract the screen-out reason from a beacon body, or null if it isn't one.\n *  The beacon key is the reserved `_screenOut` (underscore-namespaced like `_meta`,\n *  see payload.ts). The bare `screenOut` key is the DEPRECATED pre-namespacing wire\n *  shape — sites run older package versions for a while, so the central receiver\n *  keeps accepting it. `_screenOut` wins when both are present. */\nexport function parseScreenOut(payload: unknown): \"honeypot\" | \"too-fast\" | null {\n  if (!payload || typeof payload !== \"object\") return null;\n  const body = payload as Record<string, unknown>;\n  const v = \"_screenOut\" in body ? body[\"_screenOut\"] : body[\"screenOut\"];\n  return v === \"honeypot\" || v === \"too-fast\" ? v : null;\n}\n\n/** Resolve the site and record a caught screen-out. Best-effort: a record failure is\n *  the caller's to swallow — a missed count must never error a screened bot. */\nexport async function ingestScreenOut(\n  deps: ScreenOutDeps,\n  slug: string,\n  reason: \"honeypot\" | \"too-fast\",\n): Promise<ScreenOutResult> {\n  const site = await deps.getWebsiteBySlug(slug);\n  if (!site) return { status: \"unknown-site\", slug };\n  await deps.recordScreenOut(site.id, reason);\n  return { status: \"recorded\", slug };\n}\n\n/**\n * Normalize → resolve site → persist → notify → stamp. The order is load-bearing:\n * the row is written BEFORE notify, and notify/stamp failures are swallowed (logged)\n * so a Resend or Airtable-write-back hiccup can never turn an accepted lead into a 502.\n */\nexport async function ingestSubmission(\n  deps: IngestDeps,\n  slug: string,\n  rawPayload: unknown,\n  turnstileInput: TurnstileOutcome | TurnstileVerification = \"unverifiable\",\n): Promise<IngestResult> {\n  // Accept either the full verification (the production handler) or a bare outcome\n  // string (older callers and virtually every test) — a string simply has no solved-\n  // hostname to check. Normalized once so the body has a single shape to reason about.\n  const verification: TurnstileVerification =\n    typeof turnstileInput === \"string\"\n      ? { outcome: turnstileInput, hostname: null }\n      : turnstileInput;\n  const turnstile = verification.outcome;\n  const normalized = normalizeSubmission(rawPayload);\n  if (!normalized.ok) {\n    return { status: \"rejected\", reason: \"invalid-payload\", errors: normalized.errors };\n  }\n  // Persist before enrich (#539 Phase 0). The lookup THROWING is a store outage,\n  // not an answer — and until 2026-08-23 it was the one await that could cost a\n  // lead: the row write comes later, so a thrown lookup 502'd the visitor with\n  // nothing recorded anywhere (the 2026-08-17 Airtable quota outage did exactly\n  // that, while the submissions store itself was healthy the whole time). With\n  // `deadLetter` wired, the lead lands there and the visitor gets an honest\n  // \"accepted\"; `db replay-deadletters` runs it through this same function once\n  // the lookup recovers, producing a normal row with real classification+notify.\n  //\n  // Three deliberate boundaries:\n  // - A lookup that RESOLVES to null is still `unknown-site` — the store answered,\n  //   and a junk slug is a rejection, not a lead to save.\n  // - A testMode probe rethrows: it persists nothing by design, so there is\n  //   nothing to save, and swallowing the outage would green the form-e2e audit\n  //   precisely when central ingest is degraded.\n  // - `deadLetter` itself throwing propagates: both stores are down, and the 502\n  //   is honest — there is nowhere left to put the lead.\n  let site: WebsiteRow | null;\n  try {\n    site = await deps.getWebsiteBySlug(slug);\n  } catch (err) {\n    if (!deps.deadLetter || isTestMode(rawPayload)) throw err;\n    const dl = await deps.deadLetter({\n      siteSlug: slug,\n      payload: rawPayload,\n      turnstile: verification,\n      error: String(err),\n      receivedAt: deps.now(),\n    });\n    console.error(\n      `[ingest] site lookup failed for '${slug}' — lead dead-lettered as ${dl.id}: ${String(err)}`,\n    );\n    return { status: \"accepted\", submissionId: dl.id, notifyStatus: \"skipped\" };\n  }\n  if (!site) return { status: \"unknown-site\", slug };\n\n  // Synthetic end-to-end probe (the `form-e2e` fleet audit). A central-only marker\n  // on the payload routes the submission away from EVERY real sink: no row is\n  // persisted, no spam classification, no operator/autoresponder email, no\n  // newsletter fan-out — and Turnstile enforcement is bypassed (the short-circuit\n  // sits before that check). The marker therefore grants a bot NO benefit: it\n  // reaches no inbox/DB/webhook, so skipping Turnstile costs nothing. This\n  // suppression MUST be central — the submitting site alone cannot stop the real\n  // inbox firing. Validity + site resolution are still enforced above (a junk body\n  // is rejected, an unknown slug is unknown-site), so the marker can't smuggle\n  // anything through. Return accepted+skipped so the probe asserts success.\n  if (isTestMode(rawPayload)) {\n    return { status: \"accepted\", submissionId: \"test-mode\", notifyStatus: \"skipped\" };\n  }\n\n  const n = normalized.value;\n\n  // A site still under construction is where the operator tests their OWN forms:\n  // one address, several unrelated sites, minutes apart. That is byte-for-byte the\n  // cross-site repeat-sender signature below, so a site in development reliably\n  // auto-spams its own builder's test submissions — the row lands `spam_auto`,\n  // notify is skipped and the cockpit hides it, which reads exactly like \"the form\n  // is broken\" (it did, on 2026-08-17). Spam handling on a site with no real\n  // visitors protects nothing, so skip ALL of it: content scoring, the Turnstile\n  // escalation, the repeat-sender scan and the duplicate/spray scan — including\n  // their retroactive re-bucketing of OTHER sites' rows, which a test submission\n  // has no business triggering. Re-enabled the moment the site leaves development.\n  const spamHandlingEnabled = site.status !== \"building\";\n\n  // Fold the content signals + the Turnstile verdict into ONE spam decision.\n  // Absent classifier → treat as clean (fail-open). A throwing classifier is\n  // swallowed the same way — a bug in the heuristic must never turn an\n  // otherwise-good lead into a 500; it just scores clean. On a `requireTurnstile`\n  // site, both an ACTUAL \"fail\" (forged token) AND an \"absent\" token escalate to\n  // auto-spam regardless of score — a real browser that renders the widget ALWAYS\n  // sends a token, so a completely missing one is the direct-POST-bot signature. A\n  // present-but-\"unverifiable\" token (expired/duplicate — a real browser DID render\n  // the widget) stays neutral, as does anything on a site that hasn't opted in.\n  let verdict: SpamVerdict = { score: 0, reasons: [] };\n  if (spamHandlingEnabled && deps.classifySpam) {\n    try {\n      verdict = deps.classifySpam(n, turnstile);\n    } catch (err) {\n      console.error(`[ingest] classifySpam threw: ${String(err)}`);\n    }\n  }\n  const reasons = [...verdict.reasons];\n  let status: SubmissionStatus = verdict.score >= SPAM_THRESHOLD ? \"spam_auto\" : \"new\";\n  if (\n    spamHandlingEnabled &&\n    site.requireTurnstile &&\n    (turnstile === \"fail\" || turnstile === \"absent\")\n  ) {\n    status = \"spam_auto\";\n    const reason = turnstile === \"fail\" ? \"turnstile-required-failed\" : \"turnstile-required-absent\";\n    if (!reasons.includes(reason)) reasons.push(reason);\n  } else if (\n    spamHandlingEnabled &&\n    site.requireTurnstile &&\n    turnstile === \"pass\" &&\n    verification.hostname !== null &&\n    !turnstileHostnameAcceptable(verification.hostname, site.url)\n  ) {\n    // Defense-in-depth vs token farming: the token PASSED, but Cloudflare says it was\n    // solved on a host unrelated to this site. Cloudflare domain-binds sitekeys, so\n    // this only trips on a loose widget allowlist — still, a passing token from a\n    // foreign host accompanying a gated site's submission is not a real visitor. A\n    // null hostname (older responses) or an unparseable site.url skips the check\n    // entirely (fail-open); subdomains of the site's host (www., previews) match.\n    status = \"spam_auto\";\n    if (!reasons.includes(\"turnstile-required-hostname\"))\n      reasons.push(\"turnstile-required-hostname\");\n  }\n\n  // Cross-site repeat-sender signal: the fleet's sites are UNRELATED businesses\n  // (art gallery, realtor, home builder…), so the same email writing to 2+ different\n  // sites within the window is a solicitation tell no single-message scan can see.\n  // Same-site repeats alone must NOT trigger — those are genuine follow-ups. The\n  // operator explicitly accepts overblocking here (spam_auto is recoverable). Prior\n  // still-'new' rows on OTHER sites are retro-bucketed too: the first copy of a\n  // spray is delivered by design, so the copy that identifies it also cleans the\n  // queue. The scan runs EVEN WHEN the incoming copy is already spam_auto — after the\n  // classifier began catching whole spray families, an already-bucketed copy was\n  // skipping this scan and the retro cleanup never fired for exactly the sprays it\n  // was built for; escalation/reason still only applies when not already spam.\n  // Best-effort — a lookup failure never blocks a lead.\n  if (spamHandlingEnabled && n.formType !== \"newsletter\" && deps.listRecentSubmissionsForEmail) {\n    try {\n      const since = new Date(deps.now().getTime() - DUPLICATE_WINDOW_MS);\n      const prior = await deps.listRecentSubmissionsForEmail(n.email, since);\n      const otherSites = prior.filter((p) => p.siteId !== site.id);\n      if (otherSites.length > 0) {\n        if (status !== \"spam_auto\") {\n          status = \"spam_auto\";\n          if (!reasons.includes(\"repeat-sender\")) reasons.push(\"repeat-sender\");\n        }\n        const retroIds = otherSites.filter((p) => p.status === \"new\").map((p) => p.id);\n        if (deps.retroBucket && retroIds.length > 0) {\n          try {\n            await deps.retroBucket(retroIds, \"retro:repeat-sender\");\n          } catch (err) {\n            console.error(`[ingest] retroBucket (repeat-sender) threw: ${String(err)}`);\n          }\n        }\n      }\n    } catch (err) {\n      console.error(`[ingest] listRecentSubmissionsForEmail threw: ${String(err)}`);\n    }\n  }\n\n  // Duplicate/spray signal: the same pitch blasted across the fleet (or repeated) is\n  // a bot tell a lone content scan can't see. An identical body ('exact') OR a\n  // template-substituted near-copy ('similar' — the live dog-harness spray differed\n  // only in greeting; SEO sprays swap the target domain per site) → auto-spam\n  // (recoverable). Prior still-'new' copies are retro-bucketed for the same reason\n  // as above, and the scan runs even when the incoming copy is already spam_auto\n  // (see the repeat-sender note). GENUINE-RESUBMIT EXEMPTION: a match from the SAME\n  // sender on the SAME site is a real visitor double-submitting or resending after\n  // silence, not spray evidence — without this exemption the resend was silently\n  // bucketed AND retro-flipped the delivered original, vanishing an active lead\n  // with no signal. Only cross-site or different-sender copies count. Guarded:\n  // non-newsletter forms with a real body; the db helper ignores short bodies /\n  // small token sets. Best-effort — a lookup failure never blocks a lead.\n  if (\n    spamHandlingEnabled &&\n    n.formType !== \"newsletter\" &&\n    n.message !== undefined &&\n    deps.findRecentDuplicates\n  ) {\n    try {\n      const since = new Date(deps.now().getTime() - DUPLICATE_WINDOW_MS);\n      const dupes = await deps.findRecentDuplicates(n.message, since);\n      const senderEmail = n.email.trim().toLowerCase();\n      const isOwnResend = (m: { siteId: string; email: string }) =>\n        m.siteId === site.id && m.email.trim().toLowerCase() === senderEmail;\n      const exact = dupes.exact.filter((m) => !isOwnResend(m));\n      const similar = dupes.similar.filter((m) => !isOwnResend(m));\n      const reason =\n        exact.length > 0 ? \"duplicate-body\" : similar.length > 0 ? \"similar-body\" : null;\n      if (reason !== null) {\n        if (status !== \"spam_auto\") {\n          status = \"spam_auto\";\n          if (!reasons.includes(reason)) reasons.push(reason);\n        }\n        const retroIds = [...exact, ...similar].filter((m) => m.status === \"new\").map((m) => m.id);\n        if (deps.retroBucket && retroIds.length > 0) {\n          try {\n            await deps.retroBucket(retroIds, \"retro:duplicate-body\");\n          } catch (err) {\n            console.error(`[ingest] retroBucket (duplicate-body) threw: ${String(err)}`);\n          }\n        }\n      }\n    } catch (err) {\n      console.error(`[ingest] findRecentDuplicates threw: ${String(err)}`);\n    }\n  }\n  const spamReason = reasons.length > 0 ? reasons.join(\",\") : null;\n\n  const row = await deps.createSubmission({\n    siteId: site.id,\n    formType: n.formType,\n    name: n.name,\n    email: n.email,\n    extraFields: n.extraFields,\n    status,\n    spamScore: verdict.score,\n    spamReason,\n    // Optional fields spread only when present — exactOptionalPropertyTypes\n    // forbids assigning `undefined` to an optional `phone?: string` etc.\n    ...(n.phone !== undefined ? { phone: n.phone } : {}),\n    ...(n.message !== undefined ? { message: n.message } : {}),\n    ...(n.sourceUrl !== undefined ? { sourceUrl: n.sourceUrl } : {}),\n    ...(n.utm !== undefined ? { utm: n.utm } : {}),\n    submittedAt: deps.now(),\n  });\n\n  // Auto-spam (and operator-marked spam) is captured but silent: no operator\n  // email, no autoresponder, no newsletter fan-out. Skip notify entirely and\n  // record the honest \"skipped\" stamp. notify.ts also nulls both builders for\n  // these statuses (defense in depth), but short-circuiting here means the\n  // injected notify dep is never even invoked for a spam row.\n  const isSpam = row.status === \"spam_auto\" || row.status === \"spam\";\n\n  // ── best-effort tail ───────────────────────────────────────────────────────\n  // notify → stamp → newsletter fan-out. NOTHING below can cost the lead: the\n  // row is already durable, and every step here is swallowed+logged rather than\n  // allowed to turn an accepted lead into a 502. That is precisely why it does\n  // not belong on the visitor's critical path — the submitting site waits on\n  // this response under an abort budget (forms/client.ts INGEST_TIMEOUT_MS), so\n  // Resend latency used to be able to make a captured lead read as a failed\n  // submission in the visitor's browser (1836dig, 2026-08-03).\n  //\n  // `deps.defer` (Netlify's `context.waitUntil` in production) runs the tail\n  // AFTER the response goes out. Absent — every test, and any runtime without\n  // post-response execution — it runs inline exactly as before, so this is a\n  // latency change and never a behavioural one.\n  const runTail = async (): Promise<NotifyStatus> => {\n    let notify: { status: NotifyStatus; messageId: string | null };\n    if (isSpam) {\n      notify = { status: \"skipped\", messageId: null };\n    } else {\n      try {\n        notify = await deps.notify(site, row);\n      } catch (err) {\n        console.error(`[ingest] notify threw: ${String(err)}`);\n        notify = { status: \"failed\", messageId: null };\n      }\n    }\n    try {\n      await deps.stampNotified(row.id, notify.status, notify.messageId);\n    } catch (err) {\n      console.error(`[ingest] stampNotified failed: ${String(err)}`);\n    }\n\n    await runFanout();\n    return notify.status;\n  };\n\n  // Newsletter fan-out: each configured destination fires best-effort and is\n  // swallowed+logged — the lead is already persisted; never turn it into a 502.\n  // Guarded on the row status so a spam signup is never forwarded to a site\n  // webhook or added to a Mailchimp audience.\n  //\n  // FANOUT provenance (2026-07-31): the outcome is ALSO recorded on the row, one\n  // `<destination>:<outcome>` token per attempt, comma-joined in attempt order —\n  // `webhook:ok,mailchimp:401`. Outcome is `ok`, the HTTP status of a non-2xx\n  // (`0` for a network error / misconfiguration, see mailchimp.ts), or `threw`.\n  // `mailchimp-tags:failed` is appended when the member was upserted but the tag\n  // write did not land. Until this existed the results were console.error-only, so\n  // an expired Mailchimp key stopped signups reaching the audience while the row\n  // still read `notify=sent` — healthy-looking, with the failure visible nowhere the\n  // operator ever looks. Nothing attempted → nothing stamped (null stays \"no\n  // destination configured\", NOT \"we tried and lost the answer\"). The stamp is\n  // best-effort like everything else here: a provenance write must never cost a lead.\n  // A const arrow, not a hoisted declaration: `site` is narrowed non-null above,\n  // and that narrowing only survives into a closure created after it. Declared\n  // below runTail (which calls it) but before either call site, so there is no TDZ.\n  const runFanout = async (): Promise<void> => {\n    const fanout: string[] = [];\n    if (n.formType === \"newsletter\" && !isSpam) {\n      if (site.newsletterWebhook && deps.forwardNewsletter) {\n        try {\n          const fwd = await deps.forwardNewsletter(site.newsletterWebhook, row, site);\n          if (!fwd.ok)\n            console.error(`[ingest] newsletter webhook → ${fwd.status} for ${site.name}`);\n          fanout.push(fwd.ok ? \"webhook:ok\" : `webhook:${fwd.status}`);\n        } catch (err) {\n          console.error(`[ingest] newsletter webhook threw: ${String(err)}`);\n          fanout.push(\"webhook:threw\");\n        }\n      }\n      if (site.mailchimpApiKey && site.mailchimpAudienceId && deps.addToMailchimp) {\n        try {\n          const mc = await deps.addToMailchimp(site, row);\n          if (!mc.ok) console.error(`[ingest] mailchimp add → ${mc.status} for ${site.name}`);\n          fanout.push(mc.ok ? \"mailchimp:ok\" : `mailchimp:${mc.status}`);\n          // Only meaningful alongside a successful add — a failed add was never tagged\n          // either, and one token per real problem keeps the row readable.\n          if (mc.ok && mc.tagged === false) {\n            console.error(`[ingest] mailchimp tags not applied for ${site.name}`);\n            fanout.push(\"mailchimp-tags:failed\");\n          }\n        } catch (err) {\n          console.error(`[ingest] mailchimp add threw: ${String(err)}`);\n          fanout.push(\"mailchimp:threw\");\n        }\n      }\n    }\n    if (fanout.length > 0 && deps.stampFanout) {\n      try {\n        await deps.stampFanout(row.id, fanout.join(\",\"));\n      } catch (err) {\n        console.error(`[ingest] stampFanout failed: ${String(err)}`);\n      }\n    }\n  };\n\n  if (deps.defer) {\n    // A rejection escaping here would land as an unhandled rejection in the\n    // platform's post-response context, where nothing is left to catch it — so\n    // the boundary is made unrejectable. Everything inside is already swallowed;\n    // this guards the shape, not a known throw.\n    deps.defer(\n      runTail().catch((err) => {\n        console.error(`[ingest] deferred tail threw: ${String(err)}`);\n      }),\n    );\n    // The lead is durable and the response can go out now. The real notify\n    // outcome lands on the ROW via stampNotified moments later — this field is\n    // only ever read by callers wanting the in-request outcome, which by\n    // definition does not exist once the tail is deferred.\n    return { status: \"accepted\", submissionId: row.id, notifyStatus: \"deferred\" };\n  }\n  return { status: \"accepted\", submissionId: row.id, notifyStatus: await runTail() };\n}\n\n/** True when `a` and `b` are the same host or one is a subdomain of the other\n *  (case-insensitive): `www.reddoorla.com` vs `reddoorla.com` matches both ways.\n *  Exported for tests. PURE. */\nexport function hostsMatch(a: string, b: string): boolean {\n  const ha = a.trim().toLowerCase();\n  const hb = b.trim().toLowerCase();\n  if (ha.length === 0 || hb.length === 0) return false;\n  return ha === hb || ha.endsWith(`.${hb}`) || hb.endsWith(`.${ha}`);\n}\n\n/** Whether a passing token's solved-hostname is acceptable for the site at `siteUrl`.\n *  An unparseable/hostless `siteUrl` returns TRUE — the check self-disables rather\n *  than punishing a possibly-real visitor for an operator data problem (fail-open,\n *  same philosophy as verifyTurnstile). PURE. */\nexport function turnstileHostnameAcceptable(tokenHostname: string, siteUrl: string): boolean {\n  let siteHost: string;\n  try {\n    siteHost = new URL(siteUrl).hostname;\n  } catch {\n    return true;\n  }\n  if (!siteHost) return true;\n  return hostsMatch(tokenHostname, siteHost);\n}\n\n/** True when an untrusted ingest payload carries the synthetic-probe marker\n *  (top-level `testMode: true`). Read from the RAW payload so the branch never\n *  depends on normalization internals; any non-`true` value is ignored (a real\n *  visitor's form never sets it — the starter only forwards it when the submitted\n *  form field `testMode` equals \"true\"). */\nexport function isTestMode(rawPayload: unknown): boolean {\n  if (!rawPayload || typeof rawPayload !== \"object\") return false;\n  return (rawPayload as Record<string, unknown>).testMode === true;\n}\n"],"mappings":";;;;;;;;;;;AA6CA,IAAM,aAAa,oBAAI,IAAI;AAAA,EACzB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAKD,IAAM,iBAAiB,oBAAI,IAAI,CAAC,aAAa,eAAe,WAAW,CAAC;AAExE,IAAM,WAAW;AAEjB,SAAS,IAAI,GAAoB;AAC/B,SAAO,OAAO,MAAM,WAAW,EAAE,KAAK,IAAI;AAC5C;AASA,SAAS,gBAAgB,KAA+B;AACtD,QAAM,IAAI,IAAI,GAAG;AACjB,MAAI,MAAM,GAAI,QAAO;AACrB,SAAQ,sBAA4C,SAAS,CAAC,IAAK,IAAiB;AACtF;AAQO,SAAS,oBAAoB,SAAmC;AACrE,MAAI,OAAO,YAAY,YAAY,YAAY,MAAM;AACnD,WAAO,EAAE,IAAI,OAAO,QAAQ,CAAC,+BAA+B,EAAE;AAAA,EAChE;AACA,QAAM,IAAI;AACV,QAAM,OAAO,IAAI,EAAE,IAAI,KAAK,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI,EAAE,QAAQ,CAAC,EAAE,OAAO,OAAO,EAAE,KAAK,GAAG;AACxF,QAAM,QAAQ,IAAI,EAAE,KAAK,EAAE,YAAY;AACvC,QAAM,UAAU,IAAI,EAAE,OAAO;AAE7B,QAAM,WAAW,gBAAgB,EAAE,QAAQ;AAC3C,QAAM,SAAmB,CAAC;AAC1B,MAAI,CAAC,SAAS,CAAC,QAAS,QAAO,KAAK,8CAA8C;AAClF,MAAI,SAAS,CAAC,SAAS,KAAK,KAAK,EAAG,QAAO,KAAK,8BAA8B;AAC9E,MAAI,aAAa,KAAM,QAAO,KAAK,wCAAwC;AAG3E,MAAI,OAAO,SAAS,KAAK,aAAa,KAAM,QAAO,EAAE,IAAI,OAAO,OAAO;AAEvE,QAAM,cAAuC,CAAC;AAC9C,QAAM,QAAQ,EAAE;AAChB,MAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAC/C,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAK,GAAG;AAC1C,UAAI,CAAC,eAAe,IAAI,CAAC,KAAK,CAAC,EAAE,WAAW,GAAG,EAAG,aAAY,CAAC,IAAI;AAAA,IACrE;AAAA,EACF;AACA,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,CAAC,GAAG;AACtC,QAAI,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,eAAe,IAAI,CAAC,KAAK,CAAC,EAAE,WAAW,GAAG,EAAG,aAAY,CAAC,IAAI;AAAA,EAC3F;AAMA,QAAM,QAAQ,eAAe,EAAE,MAAM;AACrC,MAAI,MAAO,aAAY,SAAS;AAEhC,QAAM,QAA8B;AAAA,IAClC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,QAAQ,IAAI,EAAE,KAAK;AACzB,MAAI,MAAO,OAAM,QAAQ;AACzB,MAAI,QAAS,OAAM,UAAU;AAC7B,QAAM,YAAY,IAAI,EAAE,SAAS;AACjC,MAAI,UAAW,OAAM,YAAY;AACjC,QAAM,MAAM,IAAI,EAAE,GAAG;AACrB,MAAI,IAAK,OAAM,MAAM;AACrB,SAAO,EAAE,IAAI,MAAM,MAAM;AAC3B;;;AC9HA,IAAM,sBAAsB,KAAK,KAAK,KAAK,KAAK;AAgIhD,eAAsB,iBACpB,MACA,MACA,YACA,iBAA2D,gBACpC;AAIvB,QAAM,eACJ,OAAO,mBAAmB,WACtB,EAAE,SAAS,gBAAgB,UAAU,KAAK,IAC1C;AACN,QAAM,YAAY,aAAa;AAC/B,QAAM,aAAa,oBAAoB,UAAU;AACjD,MAAI,CAAC,WAAW,IAAI;AAClB,WAAO,EAAE,QAAQ,YAAY,QAAQ,mBAAmB,QAAQ,WAAW,OAAO;AAAA,EACpF;AAkBA,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,KAAK,iBAAiB,IAAI;AAAA,EACzC,SAAS,KAAK;AACZ,QAAI,CAAC,KAAK,cAAc,WAAW,UAAU,EAAG,OAAM;AACtD,UAAM,KAAK,MAAM,KAAK,WAAW;AAAA,MAC/B,UAAU;AAAA,MACV,SAAS;AAAA,MACT,WAAW;AAAA,MACX,OAAO,OAAO,GAAG;AAAA,MACjB,YAAY,KAAK,IAAI;AAAA,IACvB,CAAC;AACD,YAAQ;AAAA,MACN,oCAAoC,IAAI,kCAA6B,GAAG,EAAE,KAAK,OAAO,GAAG,CAAC;AAAA,IAC5F;AACA,WAAO,EAAE,QAAQ,YAAY,cAAc,GAAG,IAAI,cAAc,UAAU;AAAA,EAC5E;AACA,MAAI,CAAC,KAAM,QAAO,EAAE,QAAQ,gBAAgB,KAAK;AAYjD,MAAI,WAAW,UAAU,GAAG;AAC1B,WAAO,EAAE,QAAQ,YAAY,cAAc,aAAa,cAAc,UAAU;AAAA,EAClF;AAEA,QAAM,IAAI,WAAW;AAYrB,QAAM,sBAAsB,KAAK,WAAW;AAW5C,MAAI,UAAuB,EAAE,OAAO,GAAG,SAAS,CAAC,EAAE;AACnD,MAAI,uBAAuB,KAAK,cAAc;AAC5C,QAAI;AACF,gBAAU,KAAK,aAAa,GAAG,SAAS;AAAA,IAC1C,SAAS,KAAK;AACZ,cAAQ,MAAM,gCAAgC,OAAO,GAAG,CAAC,EAAE;AAAA,IAC7D;AAAA,EACF;AACA,QAAM,UAAU,CAAC,GAAG,QAAQ,OAAO;AACnC,MAAI,SAA2B,QAAQ,SAAS,iBAAiB,cAAc;AAC/E,MACE,uBACA,KAAK,qBACJ,cAAc,UAAU,cAAc,WACvC;AACA,aAAS;AACT,UAAM,SAAS,cAAc,SAAS,8BAA8B;AACpE,QAAI,CAAC,QAAQ,SAAS,MAAM,EAAG,SAAQ,KAAK,MAAM;AAAA,EACpD,WACE,uBACA,KAAK,oBACL,cAAc,UACd,aAAa,aAAa,QAC1B,CAAC,4BAA4B,aAAa,UAAU,KAAK,GAAG,GAC5D;AAOA,aAAS;AACT,QAAI,CAAC,QAAQ,SAAS,6BAA6B;AACjD,cAAQ,KAAK,6BAA6B;AAAA,EAC9C;AAcA,MAAI,uBAAuB,EAAE,aAAa,gBAAgB,KAAK,+BAA+B;AAC5F,QAAI;AACF,YAAM,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,QAAQ,IAAI,mBAAmB;AACjE,YAAM,QAAQ,MAAM,KAAK,8BAA8B,EAAE,OAAO,KAAK;AACrE,YAAM,aAAa,MAAM,OAAO,CAAC,MAAM,EAAE,WAAW,KAAK,EAAE;AAC3D,UAAI,WAAW,SAAS,GAAG;AACzB,YAAI,WAAW,aAAa;AAC1B,mBAAS;AACT,cAAI,CAAC,QAAQ,SAAS,eAAe,EAAG,SAAQ,KAAK,eAAe;AAAA,QACtE;AACA,cAAM,WAAW,WAAW,OAAO,CAAC,MAAM,EAAE,WAAW,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE;AAC7E,YAAI,KAAK,eAAe,SAAS,SAAS,GAAG;AAC3C,cAAI;AACF,kBAAM,KAAK,YAAY,UAAU,qBAAqB;AAAA,UACxD,SAAS,KAAK;AACZ,oBAAQ,MAAM,+CAA+C,OAAO,GAAG,CAAC,EAAE;AAAA,UAC5E;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,KAAK;AACZ,cAAQ,MAAM,iDAAiD,OAAO,GAAG,CAAC,EAAE;AAAA,IAC9E;AAAA,EACF;AAeA,MACE,uBACA,EAAE,aAAa,gBACf,EAAE,YAAY,UACd,KAAK,sBACL;AACA,QAAI;AACF,YAAM,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,QAAQ,IAAI,mBAAmB;AACjE,YAAM,QAAQ,MAAM,KAAK,qBAAqB,EAAE,SAAS,KAAK;AAC9D,YAAM,cAAc,EAAE,MAAM,KAAK,EAAE,YAAY;AAC/C,YAAM,cAAc,CAAC,MACnB,EAAE,WAAW,KAAK,MAAM,EAAE,MAAM,KAAK,EAAE,YAAY,MAAM;AAC3D,YAAM,QAAQ,MAAM,MAAM,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;AACvD,YAAM,UAAU,MAAM,QAAQ,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;AAC3D,YAAM,SACJ,MAAM,SAAS,IAAI,mBAAmB,QAAQ,SAAS,IAAI,iBAAiB;AAC9E,UAAI,WAAW,MAAM;AACnB,YAAI,WAAW,aAAa;AAC1B,mBAAS;AACT,cAAI,CAAC,QAAQ,SAAS,MAAM,EAAG,SAAQ,KAAK,MAAM;AAAA,QACpD;AACA,cAAM,WAAW,CAAC,GAAG,OAAO,GAAG,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE;AACzF,YAAI,KAAK,eAAe,SAAS,SAAS,GAAG;AAC3C,cAAI;AACF,kBAAM,KAAK,YAAY,UAAU,sBAAsB;AAAA,UACzD,SAAS,KAAK;AACZ,oBAAQ,MAAM,gDAAgD,OAAO,GAAG,CAAC,EAAE;AAAA,UAC7E;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,KAAK;AACZ,cAAQ,MAAM,wCAAwC,OAAO,GAAG,CAAC,EAAE;AAAA,IACrE;AAAA,EACF;AACA,QAAM,aAAa,QAAQ,SAAS,IAAI,QAAQ,KAAK,GAAG,IAAI;AAE5D,QAAM,MAAM,MAAM,KAAK,iBAAiB;AAAA,IACtC,QAAQ,KAAK;AAAA,IACb,UAAU,EAAE;AAAA,IACZ,MAAM,EAAE;AAAA,IACR,OAAO,EAAE;AAAA,IACT,aAAa,EAAE;AAAA,IACf;AAAA,IACA,WAAW,QAAQ;AAAA,IACnB;AAAA;AAAA;AAAA,IAGA,GAAI,EAAE,UAAU,SAAY,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAAA,IAClD,GAAI,EAAE,YAAY,SAAY,EAAE,SAAS,EAAE,QAAQ,IAAI,CAAC;AAAA,IACxD,GAAI,EAAE,cAAc,SAAY,EAAE,WAAW,EAAE,UAAU,IAAI,CAAC;AAAA,IAC9D,GAAI,EAAE,QAAQ,SAAY,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC;AAAA,IAC5C,aAAa,KAAK,IAAI;AAAA,EACxB,CAAC;AAOD,QAAM,SAAS,IAAI,WAAW,eAAe,IAAI,WAAW;AAe5D,QAAM,UAAU,YAAmC;AACjD,QAAI;AACJ,QAAI,QAAQ;AACV,eAAS,EAAE,QAAQ,WAAW,WAAW,KAAK;AAAA,IAChD,OAAO;AACL,UAAI;AACF,iBAAS,MAAM,KAAK,OAAO,MAAM,GAAG;AAAA,MACtC,SAAS,KAAK;AACZ,gBAAQ,MAAM,0BAA0B,OAAO,GAAG,CAAC,EAAE;AACrD,iBAAS,EAAE,QAAQ,UAAU,WAAW,KAAK;AAAA,MAC/C;AAAA,IACF;AACA,QAAI;AACF,YAAM,KAAK,cAAc,IAAI,IAAI,OAAO,QAAQ,OAAO,SAAS;AAAA,IAClE,SAAS,KAAK;AACZ,cAAQ,MAAM,kCAAkC,OAAO,GAAG,CAAC,EAAE;AAAA,IAC/D;AAEA,UAAM,UAAU;AAChB,WAAO,OAAO;AAAA,EAChB;AAqBA,QAAM,YAAY,YAA2B;AAC3C,UAAM,SAAmB,CAAC;AAC1B,QAAI,EAAE,aAAa,gBAAgB,CAAC,QAAQ;AAC1C,UAAI,KAAK,qBAAqB,KAAK,mBAAmB;AACpD,YAAI;AACF,gBAAM,MAAM,MAAM,KAAK,kBAAkB,KAAK,mBAAmB,KAAK,IAAI;AAC1E,cAAI,CAAC,IAAI;AACP,oBAAQ,MAAM,sCAAiC,IAAI,MAAM,QAAQ,KAAK,IAAI,EAAE;AAC9E,iBAAO,KAAK,IAAI,KAAK,eAAe,WAAW,IAAI,MAAM,EAAE;AAAA,QAC7D,SAAS,KAAK;AACZ,kBAAQ,MAAM,sCAAsC,OAAO,GAAG,CAAC,EAAE;AACjE,iBAAO,KAAK,eAAe;AAAA,QAC7B;AAAA,MACF;AACA,UAAI,KAAK,mBAAmB,KAAK,uBAAuB,KAAK,gBAAgB;AAC3E,YAAI;AACF,gBAAM,KAAK,MAAM,KAAK,eAAe,MAAM,GAAG;AAC9C,cAAI,CAAC,GAAG,GAAI,SAAQ,MAAM,iCAA4B,GAAG,MAAM,QAAQ,KAAK,IAAI,EAAE;AAClF,iBAAO,KAAK,GAAG,KAAK,iBAAiB,aAAa,GAAG,MAAM,EAAE;AAG7D,cAAI,GAAG,MAAM,GAAG,WAAW,OAAO;AAChC,oBAAQ,MAAM,2CAA2C,KAAK,IAAI,EAAE;AACpE,mBAAO,KAAK,uBAAuB;AAAA,UACrC;AAAA,QACF,SAAS,KAAK;AACZ,kBAAQ,MAAM,iCAAiC,OAAO,GAAG,CAAC,EAAE;AAC5D,iBAAO,KAAK,iBAAiB;AAAA,QAC/B;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,SAAS,KAAK,KAAK,aAAa;AACzC,UAAI;AACF,cAAM,KAAK,YAAY,IAAI,IAAI,OAAO,KAAK,GAAG,CAAC;AAAA,MACjD,SAAS,KAAK;AACZ,gBAAQ,MAAM,gCAAgC,OAAO,GAAG,CAAC,EAAE;AAAA,MAC7D;AAAA,IACF;AAAA,EACF;AAEA,MAAI,KAAK,OAAO;AAKd,SAAK;AAAA,MACH,QAAQ,EAAE,MAAM,CAAC,QAAQ;AACvB,gBAAQ,MAAM,iCAAiC,OAAO,GAAG,CAAC,EAAE;AAAA,MAC9D,CAAC;AAAA,IACH;AAKA,WAAO,EAAE,QAAQ,YAAY,cAAc,IAAI,IAAI,cAAc,WAAW;AAAA,EAC9E;AACA,SAAO,EAAE,QAAQ,YAAY,cAAc,IAAI,IAAI,cAAc,MAAM,QAAQ,EAAE;AACnF;AAKO,SAAS,WAAW,GAAW,GAAoB;AACxD,QAAM,KAAK,EAAE,KAAK,EAAE,YAAY;AAChC,QAAM,KAAK,EAAE,KAAK,EAAE,YAAY;AAChC,MAAI,GAAG,WAAW,KAAK,GAAG,WAAW,EAAG,QAAO;AAC/C,SAAO,OAAO,MAAM,GAAG,SAAS,IAAI,EAAE,EAAE,KAAK,GAAG,SAAS,IAAI,EAAE,EAAE;AACnE;AAMO,SAAS,4BAA4B,eAAuB,SAA0B;AAC3F,MAAI;AACJ,MAAI;AACF,eAAW,IAAI,IAAI,OAAO,EAAE;AAAA,EAC9B,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,CAAC,SAAU,QAAO;AACtB,SAAO,WAAW,eAAe,QAAQ;AAC3C;AAOO,SAAS,WAAW,YAA8B;AACvD,MAAI,CAAC,cAAc,OAAO,eAAe,SAAU,QAAO;AAC1D,SAAQ,WAAuC,aAAa;AAC9D;","names":[]}

package/dist/{chunk-XIDUYLSR.js → chunk-7CJ3DVZW.js}

@@ -1,6 +1,6 @@
 import {
   withRecipe
-} from "./chunk-3G25KIWW.js";
+} from "./chunk-ZTPPCHDB.js";
 import {
   readPackageJson,
   writePackageJson
@@ -96,4 +96,4 @@ async function convertToPnpm(site, opts = {}) {
 export {
   convertToPnpm
 };
-//# sourceMappingURL=chunk-XIDUYLSR.js.map
+//# sourceMappingURL=chunk-7CJ3DVZW.js.map

package/dist/{chunk-Z3KYFUN6.js → chunk-B6NUZ2ZX.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-J7SZQUCW.js";
 import {
   withRecipe
-} from "./chunk-3G25KIWW.js";
+} from "./chunk-ZTPPCHDB.js";
 import {
   bumpDep,
   readPackageJson,
@@ -243,4 +243,4 @@ async function upgradeSvelte4to5(site, opts = {}) {
 export {
   upgradeSvelte4to5
 };
-//# sourceMappingURL=chunk-Z3KYFUN6.js.map
+//# sourceMappingURL=chunk-B6NUZ2ZX.js.map

package/dist/{chunk-WVVT6SJK.js → chunk-BJQCIJOY.js}

@@ -1,6 +1,6 @@
 import {
   checkGoal
-} from "./chunk-RQLXEMEE.js";
+} from "./chunk-T7ZUUOZ2.js";
 import {
   isPrivateOrLoopbackHost
 } from "./chunk-RARREDQE.js";
@@ -1273,6 +1273,10 @@ Return:
   at it with a pronoun has no antecedent and the engine will answer that it does not know who is meant.
   These are searches, not conversational questions, and they are not the buyerQuestions above.
 - fixes: prioritized, concrete, specific to this site. No generic SEO advice.
+  Each "why" describes what a buyer or a crawler can or cannot read on the site TODAY. Never predict
+  what an answer engine will cite, repeat, rank or recommend: the report states elsewhere, with
+  evidence, that nothing on the site reliably moves that, and a fix that promises it contradicts the
+  report. "A buyer cannot find a price" is a reason; "an engine will have nothing to cite" is not.
   Set addresses to the key of the measured requirement a fix would satisfy \u2014 one of the keys listed
   under "What we have already measured", exactly as written \u2014 or null when it answers to none of them.
   Null is the normal case: a heavy image, a broken link or a stale copyright year maps to no
@@ -1462,7 +1466,12 @@ async function analyzeSite(url, crawl, checks, deps = defaultAnalyzeDeps(), goal
     ...parsed,
     questionSetId: set.id,
     buyerQuestions: conformToSet(parsed.buyerQuestions, set),
-    fixes: reconcileFixes(parsed.fixes, goalFit)
+    // Stamped here, at the one place model fixes enter the system, so the
+    // renderer can label them as judgement and never as a finding.
+    fixes: reconcileFixes(parsed.fixes, goalFit).map((f) => ({
+      ...f,
+      origin: "recommendation"
+    }))
   };
   return verifyEvidence(conformed, crawl);
 }
@@ -2050,6 +2059,7 @@ async function classifyDomains(prospectUrl, prospectPhones, domains, deps) {
 var MAX_PAGES2 = 14;
 var MAX_TOTAL_CHARS = 12e4;
 var MAX_ASSERTIONS = 12;
+var NO_CONFLATION = { detected: false, otherNames: [], engineQuote: null };
 var AccuracySchema = z2.object({
   assertions: z2.array(
     z2.object({
@@ -2065,7 +2075,15 @@ var AccuracySchema = z2.object({
        */
       searchTerms: z2.array(z2.string()).min(1).max(6)
     })
-  ).max(MAX_ASSERTIONS)
+  ).max(MAX_ASSERTIONS),
+  /** Does the answer describe MORE THAN ONE business under this name, or a
+   *  different business first? Defaulted, so a model that omits it reads as
+   *  "not detected" rather than failing the whole stage. */
+  conflation: z2.object({
+    detected: z2.boolean(),
+    otherNames: z2.array(z2.string()).max(6),
+    engineQuote: z2.string().nullable()
+  }).default({ detected: false, otherNames: [], engineQuote: null })
 });
 function makeFenceTag2() {
   return `data_${randomBytes2(6).toString("hex")}`;
@@ -2103,6 +2121,12 @@ For each assertion return:
 - searchTerms: 1-6 distinctive words or short phrases you would search the site for to find this fact \u2014
   proper nouns, numbers, street names. These are used to re-check "absent" verdicts across pages you were
   not shown, so choose terms that would actually appear if the fact were stated somewhere else on the site.
+
+Separately, return "conflation": does the answer describe MORE THAN ONE business under this name, or
+describe a different business first? If so, detected is true, otherNames lists the OTHER businesses
+named (never this one), and engineQuote is the exact sentence that says the name belongs to several
+businesses \u2014 copied verbatim, it is checked against the answer character by character. Otherwise
+detected is false with an empty otherNames and a null engineQuote.
   Avoid generic words ("dental", "services") that appear on every page.
 
 Be conservative about "confirmed": if the site only gestures at the fact, that is "absent". Being wrong in
@@ -2268,28 +2292,40 @@ function quoteSupportsClaim(claim, quote) {
   for (const w of words(claim)) if (inQuote.has(w)) shared += 1;
   return shared >= 2;
 }
-function verifyQuotes(raw, answerText, siteText, answerOf, prospectDomain) {
+function verifyQuotes(raw, answerText, siteText, answerOf, prospectDomain, searchTermsByClaim = /* @__PURE__ */ new Map()) {
   const answers = normalize(answerText);
   const site = normalize(siteText);
+  const flat = siteText.replace(/\s+/g, " ");
   const out = [];
   for (const a of raw) {
     if (!answers.includes(normalize(a.engineQuote))) continue;
+    let verdict = a.verdict;
+    let siteQuote = a.siteQuote;
+    if (a.verdict === "contradicted") {
+      for (const term of distinctive(searchTermsByClaim.get(a.claim) ?? [])) {
+        if (findTerm(site, term) !== "exact") continue;
+        const at = site.indexOf(normalize(term));
+        verdict = "confirmed";
+        siteQuote = flat.slice(Math.max(0, at - 80), at + term.length + 80).trim();
+        break;
+      }
+    }
     const from = answerOf.get(normalize(a.engineQuote));
     const sourceDomains = [
       ...new Set((from?.citedDomains ?? []).map(domainOf).filter((d) => d !== prospectDomain))
     ];
-    const quoteReal = a.siteQuote !== null && site.includes(normalize(a.siteQuote));
-    const needsQuote = a.verdict === "confirmed" || a.verdict === "contradicted";
-    const quoteSupports = quoteReal && a.siteQuote !== null && quoteSupportsClaim(a.claim, a.siteQuote);
+    const quoteReal = siteQuote !== null && site.includes(normalize(siteQuote));
+    const needsQuote = verdict === "confirmed" || verdict === "contradicted";
+    const quoteSupports = quoteReal && siteQuote !== null && quoteSupportsClaim(a.claim, siteQuote);
     const unsupported = needsQuote && (!quoteReal || !quoteSupports);
     out.push({
       claim: a.claim,
-      verdict: unsupported ? "unverified" : a.verdict,
+      verdict: unsupported ? "unverified" : verdict,
       engineQuote: a.engineQuote,
       // Kept when it is real, even where it does not carry the claim: the
       // reader can see what we looked at and judge it themselves, which is a
       // better position than being told we found nothing.
-      siteQuote: quoteReal ? a.siteQuote : null,
+      siteQuote: quoteReal ? siteQuote : null,
       nearbyMention: null,
       unverifiedReason: !unsupported ? null : !quoteReal ? "We could not find the passage this was based on, so we have not stated it either way." : "The passage we found is about the same subject but does not actually say this, so we have not stated it either way.",
       sourceDomains,
@@ -2332,11 +2368,13 @@ async function checkAccuracy(url, crawl, answers, prospectPhones, deps) {
       siteFullyRead: false,
       pagesRead: 0,
       pagesTotal: crawl.pages.length,
-      answersRead: 0
+      answersRead: 0,
+      conflation: NO_CONFLATION
     };
   }
   const input = buildAccuracyInput(crawl, branded);
   const parsed = AccuracySchema.parse(await deps.run(input));
+  const termsByClaim = new Map(parsed.assertions.map((a) => [a.claim, a.searchTerms]));
   const answerOf = /* @__PURE__ */ new Map();
   for (const a of branded) {
     const text = normalize(a.fullAnswer ?? "");
@@ -2346,14 +2384,17 @@ async function checkAccuracy(url, crawl, answers, prospectPhones, deps) {
     }
   }
   const siteText = fullSiteText(crawl);
+  const answerText = branded.map((a) => a.fullAnswer ?? "").join("\n");
   const verified = verifyQuotes(
     parsed.assertions,
-    branded.map((a) => a.fullAnswer ?? "").join("\n"),
+    answerText,
     siteText,
     answerOf,
-    domainOf(url)
+    domainOf(url),
+    termsByClaim
   );
-  const termsByClaim = new Map(parsed.assertions.map((a) => [a.claim, a.searchTerms]));
+  const c = parsed.conflation;
+  const conflation = c.detected && c.engineQuote !== null && normalize(answerText).includes(normalize(c.engineQuote)) ? { detected: true, otherNames: c.otherNames, engineQuote: c.engineQuote } : NO_CONFLATION;
   const sources = await classifyDomains(
     url,
     prospectPhones,
@@ -2366,7 +2407,8 @@ async function checkAccuracy(url, crawl, answers, prospectPhones, deps) {
     siteFullyRead: input.fullyRead,
     pagesRead: input.pagesRead,
     pagesTotal: crawl.pages.length,
-    answersRead: branded.length
+    answersRead: branded.length,
+    conflation
   };
 }
 
@@ -3155,6 +3197,99 @@ async function checkBasics(crawl, deps) {
   };
 }
 
+// src/prospect/measured-fixes.ts
+var plural = (n, one, many) => `${n} ${n === 1 ? one : many}`;
+function measuredFixes(input) {
+  const out = [];
+  const c = input.checks;
+  if (c && c.crawlerAccessMeasured && c.crawlerAccess.blockedAi.length > 0) {
+    const names = c.crawlerAccess.blockedAi.join(", ");
+    out.push({
+      title: `Let ${names} read your site`,
+      why: `Your robots.txt turns away ${names}. A crawler that is refused cannot read a page, so nothing else in this report can help for it until this changes.`,
+      impact: "high",
+      effort: "low",
+      tier: "crawl",
+      addresses: null,
+      origin: "measured"
+    });
+  }
+  for (const r of input.goalFit?.requirements ?? []) {
+    if (r.status !== "missing") continue;
+    out.push({
+      title: r.label.charAt(0).toUpperCase() + r.label.slice(1),
+      why: r.why,
+      impact: "high",
+      effort: r.scope === "quick" ? "low" : r.scope === "content" ? "medium" : "high",
+      tier: r.scope === "quick" ? "technical" : "content",
+      addresses: r.key,
+      origin: "measured"
+    });
+  }
+  const phoneJudgedByGoal = (input.goalFit?.requirements ?? []).some(
+    (r) => r.key === "tappable-phone"
+  );
+  const plain = phoneJudgedByGoal ? 0 : (input.phones ?? []).filter((p) => p.linked === false).length;
+  if (plain > 0) {
+    out.push({
+      title: "Make your phone number tappable",
+      why: `${plural(plain, "number is", "numbers are")} written as plain text. On a phone that is something a visitor has to memorise and retype; as a link it is one tap, and it is the moment they were most likely to call.`,
+      impact: "medium",
+      effort: "low",
+      tier: "technical",
+      addresses: null,
+      origin: "measured"
+    });
+  }
+  if (input.brokenLinks !== null && input.brokenLinks > 0) {
+    out.push({
+      title: `Repair ${plural(input.brokenLinks, "broken link", "broken links")}`,
+      why: "A visitor who follows one lands on an error page, and a crawler that follows one stops there.",
+      impact: "medium",
+      effort: "low",
+      tier: "technical",
+      addresses: null,
+      origin: "measured"
+    });
+  }
+  if (input.brokenImages !== null && input.brokenImages > 0) {
+    out.push({
+      title: `Replace ${plural(input.brokenImages, "broken image", "broken images")}`,
+      why: "It shows as an empty box or a missing-image icon on the page a visitor is reading.",
+      impact: "low",
+      effort: "low",
+      tier: "technical",
+      addresses: null,
+      origin: "measured"
+    });
+  }
+  if (c) {
+    if (c.headings.pagesWithoutH1 > 0) {
+      out.push({
+        title: `Give ${plural(c.headings.pagesWithoutH1, "page", "pages")} a top heading`,
+        why: `${c.headings.pagesWithoutH1} of ${c.meta.pageCount} pages have no top-level heading, so a reader or a crawler arriving on them is not told what the page is about.`,
+        impact: "medium",
+        effort: "low",
+        tier: "technical",
+        addresses: null,
+        origin: "measured"
+      });
+    }
+    if (c.meta.missingCanonical > 0) {
+      out.push({
+        title: "Tell search engines which address is the real one for each page",
+        why: `${c.meta.missingCanonical} of ${c.meta.pageCount} pages do not declare a canonical address. When the same page is reachable at more than one address, a search engine has to guess which one to keep.`,
+        impact: "medium",
+        effort: "low",
+        tier: "technical",
+        addresses: null,
+        origin: "measured"
+      });
+    }
+  }
+  return out;
+}
+
 // src/prospect/pipeline.ts
 function envAnalyzeDeps(factories = {
   api: defaultAnalyzeDeps,
@@ -3215,6 +3350,10 @@ async function stage(name, deps, fn) {
     return { ok: false, error };
   }
 }
+function mergeFixes(measured, model) {
+  const covered = new Set(measured.map((f) => f.addresses).filter((k) => !!k));
+  return [...measured, ...model.filter((f) => !(f.addresses && covered.has(f.addresses)))];
+}
 async function runProspectAudit(url, opts, deps = {}) {
   const llmAuth = llmAuthMode();
   const crawlDeps = deps.crawl ?? defaultCrawlDeps();
@@ -3320,9 +3459,21 @@ async function runProspectAudit(url, opts, deps = {}) {
       checks.ok ? checks.data : null
     )
   };
-  const reconciled = analyze.ok && goalFit.ok ? {
+  const reconciled = analyze.ok ? {
     ok: true,
-    data: { ...analyze.data, fixes: reconcileFixes(analyze.data.fixes, goalFit.data) }
+    data: {
+      ...analyze.data,
+      fixes: mergeFixes(
+        measuredFixes({
+          goalFit: goalFit.ok ? goalFit.data : null,
+          checks: checks.ok ? checks.data : null,
+          phones: checks.ok ? checks.data.consistency?.phones ?? null : null,
+          brokenLinks: assets.ok ? assets.data.brokenLinks.length : null,
+          brokenImages: assets.ok ? assets.data.brokenImages.length : null
+        }),
+        goalFit.ok ? reconcileFixes(analyze.data.fixes, goalFit.data) : analyze.data.fixes
+      )
+    }
   } : analyze;
   const brandedAnswers = probes.ok ? probes.data.answers.filter((a) => a.kind === "branded") : [];
   const accuracy = brandedAnswers.length === 0 ? { ok: false, error: ACCURACY_SKIPPED } : await stage("accuracy", deps, async () => {
@@ -3377,6 +3528,7 @@ export {
   GOAL_UNRESOLVED,
   ASSET_ACCEPT,
   defaultAssetProbe,
+  mergeFixes,
   runProspectAudit
 };
-//# sourceMappingURL=chunk-WVVT6SJK.js.map
+//# sourceMappingURL=chunk-BJQCIJOY.js.map