@reddoorla/maintenance 0.91.0 → 0.92.0

package/dist/cli/bin.js

@@ -111,7 +111,7 @@ cli.command("sync-configs [site]", "Sync canonical configs into a site.").option
   'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../sync-configs-PVRLZRKL.js")).runSyncConfigsCommand(site, opts),
+    async () => (await import("../sync-configs-KSESOHFF.js")).runSyncConfigsCommand(site, opts),
     opts
   )
 );
@@ -120,7 +120,7 @@ cli.command("bump-deps [site]", "Bump dependencies.").option("--group <group>",
   'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../bump-deps-KGH5UYSF.js")).runBumpDepsCommand(site, opts),
+    async () => (await import("../bump-deps-GI7PHMOC.js")).runBumpDepsCommand(site, opts),
     opts
   )
 );
@@ -129,7 +129,7 @@ cli.command(
   "Bootstrap a repo to keep itself updated (Renovate + protection; platform auto-merge off; ci.yml is the starter's, not managed here)."
 ).option("--dry", "List what would be enabled without writing or opening PRs").option("--fleet <inventory>", 'Inventory file (.json or .mjs/.js), or "airtable"').option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../self-updating-VQIW24RZ.js")).runSelfUpdatingCommand(site, opts),
+    async () => (await import("../self-updating-D5XOWS7V.js")).runSelfUpdatingCommand(site, opts),
     opts
   )
 );
@@ -138,7 +138,7 @@ cli.command(
   "Add the Prismic model delivery workflow to a site via PR (one PR per repo; never pushes to main)."
 ).option("--dry", "List the sites that would be offered the workflow, without opening any PR").option("--fleet <inventory>", 'Inventory file (.json or .mjs/.js), or "airtable"').option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../prismic-ci-6YGRIOHT.js")).runPrismicCiCommand(site, opts),
+    async () => (await import("../prismic-ci-A2HI7NNJ.js")).runPrismicCiCommand(site, opts),
     opts
   )
 );
@@ -153,7 +153,7 @@ cli.command(
   "Write the report to this file (the CI workflow posts it as a PR comment)"
 ).action(
   async (site, opts) => runOrExit(
-    async () => (await import("../prismic-models-FPDSUXDO.js")).runPrismicModelsCommand(site, opts),
+    async () => (await import("../prismic-models-QTKIMFBC.js")).runPrismicModelsCommand(site, opts),
     opts
   )
 );
@@ -162,7 +162,7 @@ cli.command("upgrade <upgrade> [site]", "Run a named upgrade recipe (svelte-4-to
   'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (upgrade, site, opts) => runOrExit(
-    async () => (await import("../upgrade-IR2OO3KP.js")).runUpgradeCommand(upgrade, site, opts),
+    async () => (await import("../upgrade-ZLNVEIEA.js")).runUpgradeCommand(upgrade, site, opts),
     opts
   )
 );
@@ -174,7 +174,7 @@ cli.command(
   'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../convert-to-pnpm-NWB5FCQ2.js")).runConvertToPnpmCommand(site, opts),
+    async () => (await import("../convert-to-pnpm-ONFP3JKF.js")).runConvertToPnpmCommand(site, opts),
     opts
   )
 );
@@ -183,7 +183,7 @@ cli.command("svelte-codemods [site]", "Apply Svelte 5 gotcha codemods to an alre
   'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../svelte-codemods-QAPDZC6F.js")).runSvelteCodemodsCommand(site, opts),
+    async () => (await import("../svelte-codemods-A3EARSRP.js")).runSvelteCodemodsCommand(site, opts),
     opts
   )
 );
@@ -195,7 +195,7 @@ cli.command(
   'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../health-endpoint-UVX6R5N5.js")).runHealthEndpointCommand(site, opts),
+    async () => (await import("../health-endpoint-DHKJUPRM.js")).runHealthEndpointCommand(site, opts),
     opts
   )
 );
@@ -207,7 +207,7 @@ cli.command(
   'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../smoke-suite-4JFZZYVW.js")).runSmokeSuiteCommand(site, opts),
+    async () => (await import("../smoke-suite-GXC5JZPH.js")).runSmokeSuiteCommand(site, opts),
     opts
   )
 );
@@ -219,7 +219,7 @@ cli.command(
   'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../onboard-BKCYBAVW.js")).runOnboardCommand(site, opts),
+    async () => (await import("../onboard-6NHGCKGB.js")).runOnboardCommand(site, opts),
     opts
   )
 );
@@ -230,14 +230,14 @@ cli.command(
   "--fleet <inventory>",
   'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
-  async (site, opts) => runOrExit(async () => (await import("../init-NXZ4NXTL.js")).runInitCommand(site, opts), opts)
+  async (site, opts) => runOrExit(async () => (await import("../init-ZRKWYCKA.js")).runInitCommand(site, opts), opts)
 );
 cli.command(
   "launch <site>",
   "Bootstrap + first-audit a site, then draft its launch email for approval."
 ).action(
   async (site, opts) => runOrExit(
-    async () => (await import("../launch-WPEQ3TY2.js")).runLaunchCommand(site, opts),
+    async () => (await import("../launch-6X5OXPF2.js")).runLaunchCommand(site, opts),
     opts
   )
 );
@@ -261,7 +261,7 @@ cli.command(
   "Show who a form submission would email, and optionally flip the pre-launch guard (read-back confirmed)."
 ).option("--set <on|off>", "Flip the guard: on = route to operator, off = restore.").option("--restore <status>", "Status to restore with --set off. Required; never inferred.").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../forms-notify-target-YCZUAHTY.js")).runFormsNotifyTargetCommand(
+    async () => (await import("../forms-notify-target-MNNOGSJ7.js")).runFormsNotifyTargetCommand(
       site,
       opts
     ),
@@ -312,7 +312,7 @@ cli.command(
   "Email the internal sheet (scores, what wasn't measured, top fixes, the link) to PROSPECT_AUDIT_RECIPIENTS."
 ).action(
   async (url, opts) => runOrExit(
-    async () => (await import("../prospect-audit-TFIXSTE5.js")).runProspectAuditCommand(url, opts),
+    async () => (await import("../prospect-audit-RKUVSTLN.js")).runProspectAuditCommand(url, opts),
     opts
   )
 );
@@ -373,7 +373,7 @@ cli.command(
   "--force",
   "import-airtable / sync: run despite the freeze (#643) \u2014 a deliberate rollback-window converge from the frozen Airtable shadow. Without it both refuse while Turso is authoritative, because an import overwrites authoritative rows."
 ).action(
-  async (action, opts) => runOrExit(async () => (await import("../db-IMMQSRAB.js")).runDbCommand(action, opts), opts)
+  async (action, opts) => runOrExit(async () => (await import("../db-DJVW6ZSE.js")).runDbCommand(action, opts), opts)
 );
 cli.command(
   "submissions <action>",
@@ -432,7 +432,7 @@ cli.command(
   "Output directory for capture (default: webflow-out) / docs (default: dirname of the ir.json)"
 ).action(
   async (action, target, opts) => runOrExit(
-    async () => (await import("../webflow-624FEBFD.js")).runWebflowCommand(action, target, opts),
+    async () => (await import("../webflow-IRKOIT7S.js")).runWebflowCommand(action, target, opts),
     opts
   )
 );

package/dist/cli/commands/audit.js

@@ -1,18 +1,18 @@
+import {
+  fleetSweptEvent
+} from "../../chunk-5L3FPQIJ.js";
 import {
   fleetWorkdir,
   formatSkippedNotice,
   prepareFleetSites
-} from "../../chunk-TVL5MVUF.js";
+} from "../../chunk-TCF6S7AD.js";
 import {
   resolveSites
 } from "../../chunk-Q47DU255.js";
-import {
-  fleetSweptEvent
-} from "../../chunk-5L3FPQIJ.js";
 import {
   ALL_AUDIT_NAMES,
   runOneAudit
-} from "../../chunk-QD427NIO.js";
+} from "../../chunk-JB4Q3C3M.js";
 import "../../chunk-LKGVSM2O.js";
 import "../../chunk-GASBX52O.js";
 import "../../chunk-XHHMM5HX.js";
@@ -21,18 +21,18 @@ import {
   recordFleetEventsBestEffort
 } from "../../chunk-DMPHP7UP.js";
 import "../../chunk-22GKJO5F.js";
+import "../../chunk-OCNSIBMP.js";
+import "../../chunk-2NQUCS7O.js";
 import "../../chunk-UDRHAQT7.js";
+import "../../chunk-PTDMVGKL.js";
+import "../../chunk-LBYOLBW7.js";
 import {
   isHttpUrl
 } from "../../chunk-RARREDQE.js";
-import "../../chunk-OCNSIBMP.js";
 import "../../chunk-A3WDWNN5.js";
 import "../../chunk-2OP4JKIQ.js";
-import "../../chunk-XTK5VIQB.js";
-import "../../chunk-2NQUCS7O.js";
-import "../../chunk-PTDMVGKL.js";
-import "../../chunk-LBYOLBW7.js";
 import "../../chunk-XXTZBPUY.js";
+import "../../chunk-XTK5VIQB.js";
 import "../../chunk-6VAL7XJT.js";
 import "../../chunk-NMAWXBJA.js";
 import "../../chunk-YLYXW5PH.js";

package/dist/{convert-to-pnpm-NWB5FCQ2.js → convert-to-pnpm-ONFP3JKF.js}

@@ -5,20 +5,20 @@ import {
   appendSkipNotice,
   fleetWorkdir,
   prepareFleetSites
-} from "./chunk-TVL5MVUF.js";
+} from "./chunk-TCF6S7AD.js";
 import {
   resolveSites
 } from "./chunk-Q47DU255.js";
 import {
   convertToPnpm
-} from "./chunk-XIDUYLSR.js";
-import "./chunk-3G25KIWW.js";
+} from "./chunk-7CJ3DVZW.js";
+import "./chunk-ZTPPCHDB.js";
 import "./chunk-OTGB6YQO.js";
 import "./chunk-Z3JXLULD.js";
-import "./chunk-RARREDQE.js";
-import "./chunk-XTK5VIQB.js";
 import "./chunk-LBYOLBW7.js";
+import "./chunk-RARREDQE.js";
 import "./chunk-XXTZBPUY.js";
+import "./chunk-XTK5VIQB.js";
 
 // src/cli/commands/convert-to-pnpm.ts
 import { resolve } from "path";
@@ -51,4 +51,4 @@ async function runConvertToPnpmCommand(site, opts) {
 export {
   runConvertToPnpmCommand
 };
-//# sourceMappingURL=convert-to-pnpm-NWB5FCQ2.js.map
+//# sourceMappingURL=convert-to-pnpm-ONFP3JKF.js.map

package/dist/{db-IMMQSRAB.js → db-DJVW6ZSE.js}

@@ -35,12 +35,12 @@ async function runDbCommand(action, opts, deps = {}) {
       listRecentSubmissionsForEmail,
       markSubmissionsSpamRetro
     } = await import("./submissions-3I3GAQAX.js");
-    const { makeNotify } = await import("./notify-4HP4GZ2H.js");
+    const { makeNotify } = await import("./notify-FYSOWKMJ.js");
     const { classifySpam } = await import("./spam-classifier-T5H4VTP6.js");
     const { forwardNewsletterToWebhook } = await import("./webhook-XM6EV4XT.js");
     const { addMailchimpMember, mailchimpTagsFor } = await import("./mailchimp-XYCTEEJY.js");
     const { defaultResendClient } = await import("./resend-G2BJMAQV.js");
-    const { replayDeadLetters } = await import("./replay-4S6ENYCH.js");
+    const { replayDeadLetters } = await import("./replay-HV7MGKBU.js");
     let send = null;
     try {
       send = defaultResendClient().send;
@@ -350,4 +350,4 @@ export {
   freezeGuardsDbWrite,
   runDbCommand
 };
-//# sourceMappingURL=db-IMMQSRAB.js.map
+//# sourceMappingURL=db-DJVW6ZSE.js.map

package/dist/digest-EOA4JLTV.js

@@ -49,8 +49,8 @@ import {
 } from "./chunk-WEKL2HYJ.js";
 import "./chunk-DMPHP7UP.js";
 import "./chunk-22GKJO5F.js";
-import "./chunk-RARREDQE.js";
 import "./chunk-OCNSIBMP.js";
+import "./chunk-RARREDQE.js";
 import "./chunk-6VAL7XJT.js";
 
 // src/reports/digest.ts

package/dist/digest-collectors-ZA3BTS3R.js

@@ -29,8 +29,8 @@ import "./chunk-7NYN2P6I.js";
 import "./chunk-WEKL2HYJ.js";
 import "./chunk-DMPHP7UP.js";
 import "./chunk-22GKJO5F.js";
-import "./chunk-RARREDQE.js";
 import "./chunk-OCNSIBMP.js";
+import "./chunk-RARREDQE.js";
 import "./chunk-6VAL7XJT.js";
 export {
   NOTIFY_BOUNCE_THRESHOLD,

package/dist/{email-PLPDJUDH.js → email-I4BCETI4.js}

@@ -1,8 +1,3 @@
-import {
-  renderProspectReport
-} from "./chunk-H6BLTEFN.js";
-import "./chunk-WVVT6SJK.js";
-import "./chunk-RQLXEMEE.js";
 import {
   escapeHtml,
   safeUrl
@@ -16,8 +11,6 @@ import {
 
 // src/prospect/email.ts
 var FROM_ADDRESS = "Reddoor Reports <reports@reddoorla.com>";
-var IMPACT_ORDER = { high: 0, medium: 1, low: 2 };
-var TOP_FIX_COUNT = 3;
 function resolveName(result) {
   return result.businessName && result.businessName.trim() ? result.businessName : hostnameOf(result.url);
 }
@@ -75,51 +68,21 @@ function notMeasuredLines(result) {
   }
   return lines;
 }
-var SCORE_FIELDS = [
-  { key: "findability", label: "Findability" },
-  { key: "readability", label: "Readability" },
-  { key: "answers", label: "Answers" }
-];
-function scoresTableHtml(scores) {
-  const cells = SCORE_FIELDS.map(({ key, label }) => {
-    const value = scores[key];
-    const display = value === null ? "Not measured" : String(value);
-    const valueStyle = value === null ? "color:#8a857e;font-size:14px;" : "color:#d71920;font-size:28px;";
-    return `<td style="padding:12px 16px;border:1px solid #e6e1da;text-align:center;">
-      <div style="font-weight:600;${valueStyle}">${escapeHtml(display)}</div>
-      <div style="font-size:12px;letter-spacing:.04em;text-transform:uppercase;color:#57544f;margin-top:4px;">${escapeHtml(label)}</div>
-    </td>`;
-  }).join("");
-  return `<table role="presentation" style="border-collapse:collapse;margin:16px 0;"><tr>${cells}</tr></table>`;
-}
 function notMeasuredHtml(lines) {
   if (lines.length === 0) return "";
   const items = lines.map((l) => `<li><strong>${escapeHtml(l.label)}</strong> \u2014 ${escapeHtml(l.reason)}</li>`).join("");
   return `<h2 style="font-size:16px;margin:24px 0 8px;">Not measured</h2><ul style="margin:0;padding-left:20px;">${items}</ul>`;
 }
-function fixesHtml(analyze) {
-  if (!analyze.ok) {
-    return `<p style="color:#8a857e;margin:8px 0 0;">Fixes not available \u2014 ${escapeHtml(analyze.error)}</p>`;
-  }
-  const top = [...analyze.data.fixes].sort((a, b) => IMPACT_ORDER[a.impact] - IMPACT_ORDER[b.impact]).slice(0, TOP_FIX_COUNT);
-  if (top.length === 0) {
-    return `<p style="margin:8px 0 0;">Nothing urgent \u2014 the essentials are already in place.</p>`;
-  }
-  const items = top.map(
-    (f) => `<li><strong>${escapeHtml(f.title)}</strong> \u2014 ${escapeHtml(f.why)} <span style="color:#8a857e;">(${escapeHtml(f.impact)} impact, ${escapeHtml(f.effort)} effort)</span></li>`
-  ).join("");
-  return `<ol style="margin:8px 0 0;padding-left:20px;">${items}</ol>`;
-}
 function linkHtml(link) {
   if (!link) {
-    return `<p style="margin:24px 0 0;color:#8a857e;">No shareable link \u2014 the audit could not be saved to the database. The full report is attached to this email instead.</p>`;
+    return `<p style="margin:24px 0 0;color:#8a857e;">No shareable link \u2014 the audit could not be saved to the database. Re-run it; there is nothing to forward from this email.</p>`;
   }
   const safe = safeUrl(link);
   return `<p style="margin:24px 0 0;"><strong>Full report:</strong> <a href="${escapeHtml(safe)}">${escapeHtml(link)}</a></p>`;
 }
 var INTERNAL_NOTE = `<p style="margin:24px 0 0;padding:12px 14px;background:#f4f2ef;border-left:3px solid #d71920;color:#57544f;font-size:14px;">
-  Internal sheet \u2014 it names the reasons a section could not be measured. The
-  version to send a prospect is the linked report, also attached to this email.
+  Internal note \u2014 it names the reasons a section could not be measured. The
+  report itself is the link above; there is no other version.
 </p>`;
 function buildAuditEmail(result, opts) {
   const name = resolveName(result);
@@ -128,19 +91,16 @@ function buildAuditEmail(result, opts) {
 <html lang="en">
 <head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /></head>
 <body style="margin:0;padding:24px;background:#faf8f5;color:#1a1a1a;font:15px/1.5 -apple-system,BlinkMacSystemFont,'Segoe UI',Helvetica,Arial,sans-serif;">
-  <h1 style="font-size:22px;margin:0 0 4px;">Prospect audit \u2014 ${escapeHtml(name)}</h1>
+  <h1 style="font-size:22px;margin:0 0 4px;">Audit ready \u2014 ${escapeHtml(name)}</h1>
   <p style="margin:0 0 16px;color:#57544f;">
     <a href="${escapeHtml(safeUrl(result.url))}">${escapeHtml(result.url)}</a> \xB7 audited ${escapeHtml(formatIsoDate(result.generatedAt))}
   </p>
-  ${scoresTableHtml(result.scores)}
-  ${notMeasuredHtml(notMeasuredLines(result))}
-  <h2 style="font-size:16px;margin:24px 0 8px;">Top fixes</h2>
-  ${fixesHtml(result.analyze)}
   ${linkHtml(opts.link)}
+  ${notMeasuredHtml(notMeasuredLines(result))}
   ${INTERNAL_NOTE}
 </body>
 </html>`;
-  return { subject, html, attachmentHtml: renderProspectReport(result) };
+  return { subject, html };
 }
 function parseProspectAuditRecipients(raw) {
   if (!raw) return [];
@@ -167,32 +127,23 @@ async function sendAuditEmail(result, opts) {
     };
   }
   const built = buildAuditEmail(result, { link: opts.link });
-  const attachmentHtml = opts.renderReport ? opts.renderReport(result) : built.attachmentHtml;
   const client = opts.client ?? defaultResendClient();
   const idempotencyKey = `prospect-audit:${opts.auditId ?? `${result.url}#${result.generatedAt}`}`;
-  const filename = `prospect-audit-${slugify(hostnameOf(result.url))}.html`;
   const { messageId } = await client.send({
     from: FROM_ADDRESS,
     to: opts.recipients,
     subject: built.subject,
     html: built.html,
-    attachments: [
+    // The print sheet, when one was rendered, and nothing else. The old HTML
+    // attachment was a second rendering of the report that drifted from the
+    // page; the report is the link.
+    attachments: opts.pdf ? [
       {
-        filename,
-        content: Buffer.from(attachmentHtml, "utf-8").toString("base64"),
-        contentType: "text/html"
-      },
-      // The PDF goes second so the HTML sheet stays the first attachment it has
-      // always been, and appears only when one was actually rendered — an empty
-      // or broken attachment is worse than none.
-      ...opts.pdf ? [
-        {
-          filename: filename.replace(/\.html$/, ".pdf"),
-          content: opts.pdf.toString("base64"),
-          contentType: "application/pdf"
-        }
-      ] : []
-    ],
+        filename: `prospect-audit-${slugify(hostnameOf(result.url))}.pdf`,
+        content: opts.pdf.toString("base64"),
+        contentType: "application/pdf"
+      }
+    ] : [],
     idempotencyKey
   });
   return { sent: true, messageId, recipients: opts.recipients };
@@ -202,4 +153,4 @@ export {
   parseProspectAuditRecipients,
   sendAuditEmail
 };
-//# sourceMappingURL=email-PLPDJUDH.js.map
+//# sourceMappingURL=email-I4BCETI4.js.map

package/dist/email-I4BCETI4.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/prospect/email.ts"],"sourcesContent":["import { escapeHtml, safeUrl } from \"../util/html.js\";\nimport { hostnameOf } from \"../util/url.js\";\nimport { defaultResendClient, type ResendClient } from \"../reports/send/resend.js\";\nimport type { ProspectAuditResult } from \"./types.js\";\n\n/**\n * Mirrors `reports/send/orchestrate.ts`'s `FROM_ADDRESS` (its line 18) — copied,\n * not imported, exactly like `digest.ts` and `recipes/selftest-email.ts` already\n * do. orchestrate.ts's own `FROM_ADDRESS` isn't exported, and importing it would\n * drag its whole Airtable/MJML dependency chain into this module's graph, which\n * stays lazy-loaded on purpose (see bin.ts's central-dep-blocker comment — this\n * module reaches `resend`, a devDependency, and must only ever be reached via a\n * dynamic `import()` from the CLI).\n */\nconst FROM_ADDRESS = \"Reddoor Reports <reports@reddoorla.com>\";\n\nexport type AuditEmailContent = {\n  subject: string;\n  html: string;\n};\n\n/** The searchable business name when the pipeline resolved one, else the\n *  hostname — mirrors render.ts's identical fallback (types.ts's businessName\n *  doc: \"Null when no name was ever resolved... itself a finding, not an\n *  error\"). Used for both the subject line and the sheet's own heading. */\nfunction resolveName(result: ProspectAuditResult): string {\n  return result.businessName && result.businessName.trim()\n    ? result.businessName\n    : hostnameOf(result.url);\n}\n\n/**\n * Mail subject headers are plain text, never HTML-rendered by a client — no\n * `escapeHtml` needed there (that would wrongly show literal \"&lt;\" etc. in\n * the subject line). A raw newline/control character IS worth collapsing:\n * a business name that embeds one (scraped page title, model output) would\n * otherwise visibly break the subject, and a stray CR/LF in a header value\n * is the classic email-header-injection vector — defense-in-depth even\n * though the Resend API's JSON transport already neutralizes it here.\n */\nfunction subjectSafe(s: string): string {\n  return s.replace(/\\s+/g, \" \").trim();\n}\n\n/** Local copy of render.ts's date formatter — small enough that importing it\n *  (render.ts doesn't export it) isn't worth the coupling. */\nfunction formatIsoDate(iso: string): string {\n  const d = new Date(iso);\n  if (Number.isNaN(d.getTime())) return iso;\n  return d.toLocaleDateString(\"en-US\", {\n    year: \"numeric\",\n    month: \"long\",\n    day: \"numeric\",\n    timeZone: \"UTC\",\n  });\n}\n\ntype NotMeasuredLine = { label: string; reason: string };\n\n/**\n * Everything on the sheet that reads \"not measured\", and why — in plain\n * words. Unlike render.ts's client-facing report (which collapses every\n * stage failure to STAGE_FAILED_MESSAGE so a stranger never sees operator\n * vocabulary), this email goes to Tucker/Tim/Erik: the real diagnostic\n * (a fetch error, an LLM timeout) is more useful to them than a sanitized\n * phrase, so stage `error` strings are surfaced verbatim (still escaped —\n * they can embed arbitrary text from a fetch response).\n *\n * The four-Scores branches mirror checks.ts's `computeScores` exactly: which\n * stage feeds which score, and the cases where that stage's OWN data still\n * nulls the score even though the stage itself succeeded (crawlerAccessMeasured\n * false, avgMissing null, empty buyerQuestions, a null visibilityScore). If\n * computeScores' conditions change, this needs the matching update.\n */\nfunction notMeasuredLines(result: ProspectAuditResult): NotMeasuredLine[] {\n  const lines: NotMeasuredLine[] = [];\n\n  if (!result.checks.ok) {\n    lines.push({\n      label: \"Findability\",\n      reason: `the checks stage failed — ${result.checks.error}`,\n    });\n    lines.push({\n      label: \"Readability\",\n      reason: `the checks stage failed — ${result.checks.error}`,\n    });\n  } else {\n    const c = result.checks.data;\n    if (result.scores.findability === null) {\n      lines.push({\n        label: \"Findability\",\n        reason: !c.crawlerAccessMeasured\n          ? \"robots.txt could not be fetched, so crawler access wasn't measured\"\n          : \"every crawled page failed to produce readable content\",\n      });\n    }\n    if (result.scores.readability === null) {\n      lines.push({\n        label: \"Readability\",\n        reason: \"no page produced a comparable raw/rendered pair to measure JavaScript dependence\",\n      });\n    }\n  }\n\n  if (!result.lighthouse.ok) {\n    lines.push({ label: \"Lighthouse\", reason: result.lighthouse.error });\n  }\n\n  if (!result.analyze.ok) {\n    lines.push({ label: \"Answers\", reason: result.analyze.error });\n  } else if (result.scores.answers === null) {\n    lines.push({ label: \"Answers\", reason: \"the model found no buyer questions to check\" });\n  }\n\n  // Named for what the stage measures (the receipts section), not for the\n  // removed score label — the email no longer presents an AI Visibility score.\n  if (!result.probes.ok) {\n    lines.push({ label: \"AI engine answers\", reason: result.probes.error });\n  } else if (result.scores.aiVisibility === null) {\n    lines.push({ label: \"AI engine answers\", reason: \"no category (buyer-question) query ran\" });\n  }\n\n  return lines;\n}\n\nfunction notMeasuredHtml(lines: NotMeasuredLine[]): string {\n  if (lines.length === 0) return \"\";\n  const items = lines\n    .map((l) => `<li><strong>${escapeHtml(l.label)}</strong> — ${escapeHtml(l.reason)}</li>`)\n    .join(\"\");\n  return `<h2 style=\"font-size:16px;margin:24px 0 8px;\">Not measured</h2><ul style=\"margin:0;padding-left:20px;\">${items}</ul>`;\n}\n\n/** analyze.error and fix titles/why are untrusted (LLM output, or text lifted\n *  from the prospect's own site) — every interpolation below is escaped. */\n\nfunction linkHtml(link: string | null): string {\n  if (!link) {\n    return `<p style=\"margin:24px 0 0;color:#8a857e;\">No shareable link — the audit could not be saved to the database. Re-run it; there is nothing to forward from this email.</p>`;\n  }\n  const safe = safeUrl(link);\n  return `<p style=\"margin:24px 0 0;\"><strong>Full report:</strong> <a href=\"${escapeHtml(safe)}\">${escapeHtml(link)}</a></p>`;\n}\n\n/** This sheet is for us, and it says so. It carries the real reasons a stage did\n *  not run — useful internally, wrong in front of a prospect — so it has to be\n *  obvious that the shareable artefact is the attachment and the link, not this\n *  body. Without the label, the natural thing to do with a useful email is\n *  forward it. */\nconst INTERNAL_NOTE = `<p style=\"margin:24px 0 0;padding:12px 14px;background:#f4f2ef;border-left:3px solid #d71920;color:#57544f;font-size:14px;\">\n  Internal note — it names the reasons a section could not be measured. The\n  report itself is the link above; there is no other version.\n</p>`;\n\n/**\n * Build the internal sheet — a SHORT summary for Tucker/Tim/Erik, distinct\n * and deliberately NOT a second rendering of the report. The old renderer\n * carried a score the web page abolished and a closing promise the web page\n * calls snake-oil; two surfaces drift, so there is one. Pure: no IO, so it's\n * safe to call from a test with no network.\n *\n * Every value that can trace back to the prospect's site or the model —\n * the business name, fixes, stage error text, the narrative-adjacent bits —\n * is escaped with `escapeHtml`/`safeUrl`, the same honesty-and-safety rule\n * render.ts follows for the client-facing report.\n */\nexport function buildAuditEmail(\n  result: ProspectAuditResult,\n  opts: { link: string | null },\n): AuditEmailContent {\n  const name = resolveName(result);\n  const subject = `Prospect audit — ${subjectSafe(name)}`;\n\n  const html = `<!doctype html>\n<html lang=\"en\">\n<head><meta charset=\"utf-8\" /><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" /></head>\n<body style=\"margin:0;padding:24px;background:#faf8f5;color:#1a1a1a;font:15px/1.5 -apple-system,BlinkMacSystemFont,'Segoe UI',Helvetica,Arial,sans-serif;\">\n  <h1 style=\"font-size:22px;margin:0 0 4px;\">Audit ready — ${escapeHtml(name)}</h1>\n  <p style=\"margin:0 0 16px;color:#57544f;\">\n    <a href=\"${escapeHtml(safeUrl(result.url))}\">${escapeHtml(result.url)}</a> · audited ${escapeHtml(formatIsoDate(result.generatedAt))}\n  </p>\n  ${linkHtml(opts.link)}\n  ${notMeasuredHtml(notMeasuredLines(result))}\n  ${INTERNAL_NOTE}\n</body>\n</html>`;\n\n  return { subject, html };\n}\n\n/**\n * Parse `PROSPECT_AUDIT_RECIPIENTS` (comma-separated) into a clean address\n * list: trimmed, empties dropped, case-insensitively deduped — mirrors\n * `reports/send/orchestrate.ts`'s `parseAddresses` for the same reasons (an\n * operator-typed env var, same typo surface). No address is ever hardcoded\n * anywhere in this module; an unset or empty var yields `[]`, which\n * `sendAuditEmail` treats as \"skip, and say why\" rather than an error.\n */\nexport function parseProspectAuditRecipients(raw: string | undefined | null): string[] {\n  if (!raw) return [];\n  const seen = new Set<string>();\n  const list: string[] = [];\n  for (const part of raw.split(\",\")) {\n    const trimmed = part.trim().toLowerCase();\n    if (!trimmed) continue;\n    if (seen.has(trimmed)) continue;\n    seen.add(trimmed);\n    list.push(trimmed);\n  }\n  return list;\n}\n\n/** Filesystem-safe attachment-filename fragment. Tiny local copy of the CLI's\n *  private `slugify` (prospect-audit.ts) — not worth exporting/sharing one\n *  three-line predicate across a module boundary. */\nfunction slugify(s: string): string {\n  const slug = s\n    .toLowerCase()\n    .replace(/[^a-z0-9.-]+/g, \"-\")\n    .replace(/^-+|-+$/g, \"\");\n  return slug || \"prospect\";\n}\n\nexport type SendAuditEmailOptions = {\n  link: string | null;\n  recipients: string[];\n  /**\n   * The persisted `prospect_audits` row id (from `createProspectAudit`), when\n   * persistence succeeded. Mirrors orchestrate.ts's\n   * `idempotencyKey: \\`report:${report.id}\\`` pattern, so re-sending for the\n   * SAME already-persisted audit dedupes at Resend instead of double-mailing.\n   * Null when persistence failed — the sheet can still be sent (it's built to\n   * survive independently of Turso), but then there is no stable row id, so\n   * the key falls back to `url`+`generatedAt`: that still protects a\n   * same-process double-call, though — unlike a DB id — it can't survive an\n   * entire pipeline rerun, which mints genuinely new content anyway.\n   */\n  auditId?: string | null;\n  /**\n   * The print-designed PDF leave-behind, when one was rendered.\n   *\n   * Optional on purpose: rendering it needs a live page and a headless browser,\n   * and neither is worth losing a delivered report over. Absent, the email goes\n   * exactly as it did before — the HTML sheet and the link — and the caller has\n   * already recorded a warning saying why.\n   */\n  pdf?: Buffer | null;\n  /** Defaults to `defaultResendClient()`. */\n  client?: ResendClient;\n};\n\nexport type SendAuditEmailResult =\n  { sent: true; messageId: string; recipients: string[] } | { sent: false; reason: string };\n\n/**\n * Send the audit sheet with the full rendered report attached as an `.html`\n * file (base64), so the sheet survives independently of the link and of\n * Turso. Empty `recipients` is a legitimate, non-exceptional outcome (no\n * `PROSPECT_AUDIT_RECIPIENTS` configured) — returns `{sent:false}` rather\n * than throwing, so a caller can report it as a warning; a genuine send\n * failure (a throwing `client.send`) still propagates as a real exception.\n */\nexport async function sendAuditEmail(\n  result: ProspectAuditResult,\n  opts: SendAuditEmailOptions,\n): Promise<SendAuditEmailResult> {\n  if (opts.recipients.length === 0) {\n    return {\n      sent: false,\n      reason: \"no recipients configured (PROSPECT_AUDIT_RECIPIENTS is unset or empty)\",\n    };\n  }\n\n  const built = buildAuditEmail(result, { link: opts.link });\n  const client = opts.client ?? defaultResendClient();\n  const idempotencyKey = `prospect-audit:${opts.auditId ?? `${result.url}#${result.generatedAt}`}`;\n\n  const { messageId } = await client.send({\n    from: FROM_ADDRESS,\n    to: opts.recipients,\n    subject: built.subject,\n    html: built.html,\n    // The print sheet, when one was rendered, and nothing else. The old HTML\n    // attachment was a second rendering of the report that drifted from the\n    // page; the report is the link.\n    attachments: opts.pdf\n      ? [\n          {\n            filename: `prospect-audit-${slugify(hostnameOf(result.url))}.pdf`,\n            content: opts.pdf.toString(\"base64\"),\n            contentType: \"application/pdf\",\n          },\n        ]\n      : [],\n    idempotencyKey,\n  });\n\n  return { sent: true, messageId, recipients: opts.recipients };\n}\n"],"mappings":";;;;;;;;;;;;AAcA,IAAM,eAAe;AAWrB,SAAS,YAAY,QAAqC;AACxD,SAAO,OAAO,gBAAgB,OAAO,aAAa,KAAK,IACnD,OAAO,eACP,WAAW,OAAO,GAAG;AAC3B;AAWA,SAAS,YAAY,GAAmB;AACtC,SAAO,EAAE,QAAQ,QAAQ,GAAG,EAAE,KAAK;AACrC;AAIA,SAAS,cAAc,KAAqB;AAC1C,QAAM,IAAI,IAAI,KAAK,GAAG;AACtB,MAAI,OAAO,MAAM,EAAE,QAAQ,CAAC,EAAG,QAAO;AACtC,SAAO,EAAE,mBAAmB,SAAS;AAAA,IACnC,MAAM;AAAA,IACN,OAAO;AAAA,IACP,KAAK;AAAA,IACL,UAAU;AAAA,EACZ,CAAC;AACH;AAmBA,SAAS,iBAAiB,QAAgD;AACxE,QAAM,QAA2B,CAAC;AAElC,MAAI,CAAC,OAAO,OAAO,IAAI;AACrB,UAAM,KAAK;AAAA,MACT,OAAO;AAAA,MACP,QAAQ,kCAA6B,OAAO,OAAO,KAAK;AAAA,IAC1D,CAAC;AACD,UAAM,KAAK;AAAA,MACT,OAAO;AAAA,MACP,QAAQ,kCAA6B,OAAO,OAAO,KAAK;AAAA,IAC1D,CAAC;AAAA,EACH,OAAO;AACL,UAAM,IAAI,OAAO,OAAO;AACxB,QAAI,OAAO,OAAO,gBAAgB,MAAM;AACtC,YAAM,KAAK;AAAA,QACT,OAAO;AAAA,QACP,QAAQ,CAAC,EAAE,wBACP,uEACA;AAAA,MACN,CAAC;AAAA,IACH;AACA,QAAI,OAAO,OAAO,gBAAgB,MAAM;AACtC,YAAM,KAAK;AAAA,QACT,OAAO;AAAA,QACP,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,EACF;AAEA,MAAI,CAAC,OAAO,WAAW,IAAI;AACzB,UAAM,KAAK,EAAE,OAAO,cAAc,QAAQ,OAAO,WAAW,MAAM,CAAC;AAAA,EACrE;AAEA,MAAI,CAAC,OAAO,QAAQ,IAAI;AACtB,UAAM,KAAK,EAAE,OAAO,WAAW,QAAQ,OAAO,QAAQ,MAAM,CAAC;AAAA,EAC/D,WAAW,OAAO,OAAO,YAAY,MAAM;AACzC,UAAM,KAAK,EAAE,OAAO,WAAW,QAAQ,8CAA8C,CAAC;AAAA,EACxF;AAIA,MAAI,CAAC,OAAO,OAAO,IAAI;AACrB,UAAM,KAAK,EAAE,OAAO,qBAAqB,QAAQ,OAAO,OAAO,MAAM,CAAC;AAAA,EACxE,WAAW,OAAO,OAAO,iBAAiB,MAAM;AAC9C,UAAM,KAAK,EAAE,OAAO,qBAAqB,QAAQ,yCAAyC,CAAC;AAAA,EAC7F;AAEA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAAkC;AACzD,MAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,QAAM,QAAQ,MACX,IAAI,CAAC,MAAM,eAAe,WAAW,EAAE,KAAK,CAAC,oBAAe,WAAW,EAAE,MAAM,CAAC,OAAO,EACvF,KAAK,EAAE;AACV,SAAO,0GAA0G,KAAK;AACxH;AAKA,SAAS,SAAS,MAA6B;AAC7C,MAAI,CAAC,MAAM;AACT,WAAO;AAAA,EACT;AACA,QAAM,OAAO,QAAQ,IAAI;AACzB,SAAO,sEAAsE,WAAW,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC;AACpH;AAOA,IAAM,gBAAgB;AAAA;AAAA;AAAA;AAiBf,SAAS,gBACd,QACA,MACmB;AACnB,QAAM,OAAO,YAAY,MAAM;AAC/B,QAAM,UAAU,yBAAoB,YAAY,IAAI,CAAC;AAErD,QAAM,OAAO;AAAA;AAAA;AAAA;AAAA,kEAI8C,WAAW,IAAI,CAAC;AAAA;AAAA,eAE9D,WAAW,QAAQ,OAAO,GAAG,CAAC,CAAC,KAAK,WAAW,OAAO,GAAG,CAAC,qBAAkB,WAAW,cAAc,OAAO,WAAW,CAAC,CAAC;AAAA;AAAA,IAEpI,SAAS,KAAK,IAAI,CAAC;AAAA,IACnB,gBAAgB,iBAAiB,MAAM,CAAC,CAAC;AAAA,IACzC,aAAa;AAAA;AAAA;AAIf,SAAO,EAAE,SAAS,KAAK;AACzB;AAUO,SAAS,6BAA6B,KAA0C;AACrF,MAAI,CAAC,IAAK,QAAO,CAAC;AAClB,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,OAAiB,CAAC;AACxB,aAAW,QAAQ,IAAI,MAAM,GAAG,GAAG;AACjC,UAAM,UAAU,KAAK,KAAK,EAAE,YAAY;AACxC,QAAI,CAAC,QAAS;AACd,QAAI,KAAK,IAAI,OAAO,EAAG;AACvB,SAAK,IAAI,OAAO;AAChB,SAAK,KAAK,OAAO;AAAA,EACnB;AACA,SAAO;AACT;AAKA,SAAS,QAAQ,GAAmB;AAClC,QAAM,OAAO,EACV,YAAY,EACZ,QAAQ,iBAAiB,GAAG,EAC5B,QAAQ,YAAY,EAAE;AACzB,SAAO,QAAQ;AACjB;AAyCA,eAAsB,eACpB,QACA,MAC+B;AAC/B,MAAI,KAAK,WAAW,WAAW,GAAG;AAChC,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,IACV;AAAA,EACF;AAEA,QAAM,QAAQ,gBAAgB,QAAQ,EAAE,MAAM,KAAK,KAAK,CAAC;AACzD,QAAM,SAAS,KAAK,UAAU,oBAAoB;AAClD,QAAM,iBAAiB,kBAAkB,KAAK,WAAW,GAAG,OAAO,GAAG,IAAI,OAAO,WAAW,EAAE;AAE9F,QAAM,EAAE,UAAU,IAAI,MAAM,OAAO,KAAK;AAAA,IACtC,MAAM;AAAA,IACN,IAAI,KAAK;AAAA,IACT,SAAS,MAAM;AAAA,IACf,MAAM,MAAM;AAAA;AAAA;AAAA;AAAA,IAIZ,aAAa,KAAK,MACd;AAAA,MACE;AAAA,QACE,UAAU,kBAAkB,QAAQ,WAAW,OAAO,GAAG,CAAC,CAAC;AAAA,QAC3D,SAAS,KAAK,IAAI,SAAS,QAAQ;AAAA,QACnC,aAAa;AAAA,MACf;AAAA,IACF,IACA,CAAC;AAAA,IACL;AAAA,EACF,CAAC;AAED,SAAO,EAAE,MAAM,MAAM,WAAW,YAAY,KAAK,WAAW;AAC9D;","names":[]}

package/dist/forms/index.d.ts

@@ -147,8 +147,12 @@ type CreateIngestEndpointOptions = {
     /**
      * Map the parsed JSON body to a payload. Must set `formType` UNLESS the fixed
      * `formType` option is provided (then that is authoritative and overrides it).
+     *
+     * May be async. A site that resolves confirmation copy from its own CMS does a
+     * read here — see `@reddoorla/maintenance/forms/prismic`. A rejection is
+     * handled exactly like a throw from a sync one: a 400, never a 500.
      */
-    buildPayload: (body: Record<string, unknown>, event: RequestEvent) => SubmissionPayload;
+    buildPayload: (body: Record<string, unknown>, event: RequestEvent) => SubmissionPayload | Promise<SubmissionPayload>;
     /** Fixed formType for single-type endpoints; omit for multi-type endpoints
      *  where `buildPayload` derives formType from the body. */
     formType?: string;

package/dist/forms/index.js

@@ -136,7 +136,7 @@ function createIngestEndpoint(opts) {
     let payload;
     try {
       payload = {
-        ...opts.buildPayload(body, event),
+        ...await opts.buildPayload(body, event),
         ...opts.formType ? { formType: opts.formType } : {},
         _meta: buildSubmissionMeta(event, str(body[turnstileFieldName]))
       };

package/dist/forms/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/forms/action.ts","../../src/forms/meta.ts","../../src/forms/endpoint.ts"],"sourcesContent":["import { fail, redirect, type ActionFailure, type RequestEvent } from \"@sveltejs/kit\";\nimport {\n  submitToIngest,\n  screenSubmission,\n  submitScreenOut,\n  type SubmissionPayload,\n} from \"./client.js\";\nimport { buildSubmissionMeta } from \"./meta.js\";\n\n/** Endpoint + token for the dashboard ingest, read per-request from site env. */\nexport type IngestActionConfig = { url?: string; token?: string };\n\nexport type CreateIngestActionOptions = {\n  /** Stamped onto every payload as `formType` (a SUBMISSION_FORM_TYPES value). */\n  formType: string;\n  /** Read at call time so SvelteKit's dynamic private env resolves per-request. */\n  getConfig: () => IngestActionConfig;\n  /**\n   * Map this form's fields to a payload. The factory's `formType` is always\n   * authoritative and cannot be overridden by `buildPayload`.\n   */\n  buildPayload: (form: FormData, event: RequestEvent) => SubmissionPayload;\n  /** Honeypot input name. Default \"bot-field\". */\n  botFieldName?: string;\n  /** Hidden timestamp input name (planted in `load`). Default \"ts\". */\n  tsFieldName?: string;\n  /** Field carrying the Cloudflare Turnstile token. Default \"cf-turnstile-response\". */\n  turnstileFieldName?: string;\n  /** fail(500) copy when env vars are unset. */\n  unavailableMessage?: string;\n  /** fail(502) copy when the ingest endpoint rejects/errors. */\n  errorMessage?: string;\n  /** Injectable clock for tests. Default Date.now. */\n  now?: () => number;\n  /** If set, a successful OR bot-screened submission throws redirect(303, redirectTo)\n   *  instead of returning {success:true} (e.g. a dedicated /thank-you page). */\n  redirectTo?: string;\n};\n\nexport type IngestActionData = { success: true } | ActionFailure<{ error: string }>;\n\n/**\n * Build a SvelteKit `default` form action that screens for bots, forwards the\n * submission to the dashboard ingest endpoint, and returns SvelteKit-shaped\n * results. The per-form field mapping is the only thing a site must supply.\n */\nexport function createIngestAction(\n  opts: CreateIngestActionOptions,\n): (event: RequestEvent) => Promise<IngestActionData> {\n  const botFieldName = opts.botFieldName ?? \"bot-field\";\n  const tsFieldName = opts.tsFieldName ?? \"ts\";\n  const turnstileFieldName = opts.turnstileFieldName ?? \"cf-turnstile-response\";\n  const now = opts.now ?? Date.now;\n  const unavailable =\n    opts.unavailableMessage ?? \"This form is temporarily unavailable. Please email us directly.\";\n  const failed =\n    opts.errorMessage ?? \"Something went wrong sending your message. Please try again.\";\n\n  return async (event) => {\n    let form: FormData;\n    try {\n      form = await event.request.formData();\n    } catch {\n      console.error(`[forms-ingest] ${opts.formType}: could not parse form body`);\n      return fail(400, { error: failed });\n    }\n\n    // Bot screen: a filled honeypot OR an implausibly fast fill is silently\n    // accepted (return success, do NOT forward) so bots get no signal.\n    const screen = screenSubmission({\n      botField: form.get(botFieldName)?.toString() ?? null,\n      elapsedMs: elapsedMs(form.get(tsFieldName), now),\n    });\n    if (!screen.ok) {\n      // Best-effort screen-out beacon (no PII) so catch-rate is observable, then\n      // succeed exactly as before — the bot/visitor still sees success.\n      const cfg = opts.getConfig();\n      if (cfg.url && cfg.token) {\n        await submitScreenOut({\n          url: cfg.url,\n          token: cfg.token,\n          reason: screen.reason,\n          fetch: event.fetch,\n        });\n      }\n      return succeed();\n    }\n\n    const { url, token } = opts.getConfig();\n    if (!url || !token) {\n      console.error(`[forms-ingest] config missing for formType=${opts.formType}`);\n      return fail(500, { error: unavailable });\n    }\n\n    // buildPayload runs on untrusted form data; a careless field access (e.g.\n    // `form.get(\"email\")!.toString()` on an absent field) would otherwise escape\n    // as an uncaught 500. Treat a throw as a malformed request (400), mirroring\n    // endpoint.ts's guard and its \"never 500s\" guarantee.\n    let payload: SubmissionPayload;\n    try {\n      payload = {\n        ...opts.buildPayload(form, event),\n        formType: opts.formType,\n        _meta: buildSubmissionMeta(event, form.get(turnstileFieldName)?.toString()),\n      };\n    } catch (err) {\n      console.error(`[forms-ingest] ${opts.formType}: buildPayload threw: ${String(err)}`);\n      return fail(400, { error: failed });\n    }\n\n    const result = await submitToIngest({\n      url,\n      token,\n      fetch: event.fetch,\n      payload,\n    });\n    if (!result.ok) {\n      console.error(`[forms-ingest] ${opts.formType} → ${result.status}: ${result.error}`);\n      return fail(502, { error: failed });\n    }\n    return succeed();\n  };\n\n  // Single success path: redirect when configured (e.g. a dedicated /thank-you\n  // page), otherwise return the SvelteKit-shaped success. `redirect()` throws, so\n  // the trailing `return` keeps the `{ success: true }` type.\n  function succeed(): { success: true } {\n    if (opts.redirectTo) redirect(303, opts.redirectTo);\n    return { success: true };\n  }\n}\n\n// `FormDataEntryValue` is a DOM-lib global; this package compiles with only the\n// ES2022 lib + @types/node, where it is not in scope. Derive the type from the\n// in-scope `FormData.get` return instead — same value, no DOM-lib dependency.\nfunction elapsedMs(tsRaw: ReturnType<FormData[\"get\"]>, now: () => number): number | null {\n  const ts = Number(tsRaw);\n  if (!Number.isFinite(ts) || ts <= 0) return null;\n  // Clamp at 0: elapsed time can't be negative. A future `ts` (clock skew or a bot\n  // forging one) would otherwise yield a negative value; clamping makes it read as\n  // 0ms (effectively instant) so the MIN_FILL_MS gate still trips. Defense-in-depth\n  // with screenSubmission, which also treats any sub-floor elapsed as too-fast.\n  return Math.max(0, now() - ts);\n}\n","/** The reserved wire envelope a fleet site forwards alongside the lead fields.\n *  (Older package versions also sent a `userAgent` — central never consumed it,\n *  so it is no longer forwarded; `readMeta` simply ignores it from old senders.) */\nexport type SubmissionMeta = {\n  turnstileToken?: string;\n  clientIp?: string;\n};\n\nfunction str(v: unknown): string {\n  return typeof v === \"string\" ? v.trim() : \"\";\n}\n\n/**\n * Defensively read the reserved `_meta` envelope off an untrusted ingest payload\n * (CENTRAL side, used by the ingest handler). Keeps only non-blank string fields\n * among the KNOWN keys, dropping everything else — a bot cannot smuggle a\n * non-string clientIp in, and unknown fields (e.g. the `userAgent` older package\n * versions still send) are silently ignored. The token/IP read here are used\n * transiently (Turnstile verify + `remoteip`) and are NEVER persisted; the token\n * is never stored. The SITE-side writer (`buildSubmissionMeta`) is added by the\n * site-factory task; `readMeta` is the single reader (there is no `parseMeta`).\n */\nexport function readMeta(payload: unknown): SubmissionMeta {\n  const meta: SubmissionMeta = {};\n  if (typeof payload !== \"object\" || payload === null) return meta;\n  const raw = (payload as Record<string, unknown>)._meta;\n  if (typeof raw !== \"object\" || raw === null) return meta;\n  const m = raw as Record<string, unknown>;\n  const token = str(m.turnstileToken);\n  if (token) meta.turnstileToken = token;\n  const ip = str(m.clientIp);\n  if (ip) meta.clientIp = ip;\n  return meta;\n}\n\n/**\n * SITE-side event shape `buildSubmissionMeta` reads. Structural (not SvelteKit's\n * `RequestEvent`) so this leaf stays SDK-free; a real `RequestEvent` is\n * structurally assignable (`getClientAddress: () => string`).\n */\ntype MetaEvent = {\n  getClientAddress?: () => string;\n};\n\n/**\n * Build the transient `_meta` envelope a site forwards to central ingest:\n * `{ turnstileToken?, clientIp? }`. Returns `undefined` when no field yields a\n * value so callers can attach it unconditionally without polluting the payload\n * (an `undefined` value is dropped by `JSON.stringify`). `getClientAddress` is\n * guarded (some adapters lack a client address and can throw). The visitor's\n * user-agent is deliberately NOT forwarded — central never consumed it, so\n * shipping it was pure transient-PII surface. None of this is ever persisted.\n */\nexport function buildSubmissionMeta(\n  event: MetaEvent,\n  turnstileToken: string | null | undefined,\n): SubmissionMeta | undefined {\n  const meta: SubmissionMeta = {};\n\n  const token = typeof turnstileToken === \"string\" ? turnstileToken.trim() : \"\";\n  if (token) meta.turnstileToken = token;\n\n  if (typeof event.getClientAddress === \"function\") {\n    try {\n      const ip = event.getClientAddress();\n      if (typeof ip === \"string\" && ip.trim()) meta.clientIp = ip.trim();\n    } catch {\n      // Some adapters have no client address and throw; drop clientIp silently.\n    }\n  }\n\n  return Object.keys(meta).length > 0 ? meta : undefined;\n}\n","import { json, type RequestEvent } from \"@sveltejs/kit\";\nimport {\n  submitToIngest,\n  screenSubmission,\n  submitScreenOut,\n  type SubmissionPayload,\n} from \"./client.js\";\nimport { SUBMISSION_FORM_TYPES, type FormType } from \"./types.js\";\nimport type { IngestActionConfig } from \"./action.js\";\nimport { buildSubmissionMeta } from \"./meta.js\";\n\n/**\n * Options for {@link createIngestEndpoint} — the JSON sibling of\n * `createIngestAction` for client-driven forms (modals / lightboxes / fetch)\n * that POST JSON to a `+server.ts` route instead of using a form action.\n */\nexport type CreateIngestEndpointOptions = {\n  /** Read at call time so SvelteKit's dynamic private env resolves per-request. */\n  getConfig: () => IngestActionConfig;\n  /**\n   * Map the parsed JSON body to a payload. Must set `formType` UNLESS the fixed\n   * `formType` option is provided (then that is authoritative and overrides it).\n   */\n  buildPayload: (body: Record<string, unknown>, event: RequestEvent) => SubmissionPayload;\n  /** Fixed formType for single-type endpoints; omit for multi-type endpoints\n   *  where `buildPayload` derives formType from the body. */\n  formType?: string;\n  /** Honeypot field name in the JSON body. Default \"bot-field\". */\n  botFieldName?: string;\n  /** Field carrying the Cloudflare Turnstile token. Default \"cf-turnstile-response\". */\n  turnstileFieldName?: string;\n  /** json(500) copy when env vars are unset. */\n  unavailableMessage?: string;\n  /** json(400/502) copy for bad input / ingest failure. */\n  errorMessage?: string;\n};\n\nfunction isFormType(v: unknown): v is FormType {\n  return typeof v === \"string\" && (SUBMISSION_FORM_TYPES as readonly string[]).includes(v);\n}\n\nfunction str(v: unknown): string | undefined {\n  return typeof v === \"string\" ? v : undefined;\n}\n\n/**\n * Build a JSON `POST` handler that screens for bots, forwards the submission to\n * the dashboard ingest endpoint, and returns `{ ok }`-shaped JSON. The per-form\n * field mapping (`buildPayload`) is the only thing a site must supply. The\n * returned function is structurally a SvelteKit `RequestHandler`.\n */\nexport function createIngestEndpoint(\n  opts: CreateIngestEndpointOptions,\n): (event: RequestEvent) => Promise<Response> {\n  const botFieldName = opts.botFieldName ?? \"bot-field\";\n  const turnstileFieldName = opts.turnstileFieldName ?? \"cf-turnstile-response\";\n  const unavailable =\n    opts.unavailableMessage ?? \"This form is temporarily unavailable. Please email us directly.\";\n  const failed =\n    opts.errorMessage ?? \"Something went wrong sending your message. Please try again.\";\n\n  return async (event) => {\n    let body: Record<string, unknown>;\n    try {\n      const parsed: unknown = await event.request.json();\n      if (!parsed || typeof parsed !== \"object\") throw new Error(\"body is not an object\");\n      body = parsed as Record<string, unknown>;\n    } catch {\n      console.error(\"[forms-ingest] could not parse JSON body\");\n      return json({ ok: false, error: failed }, { status: 400 });\n    }\n\n    // Bot screen: honeypot only. A client POST carries no server-planted ts, and\n    // screenSubmission treats a missing elapsedMs as OK. A filled honeypot is\n    // silently accepted (return ok, do NOT forward) so bots get no signal.\n    const screen = screenSubmission({ botField: str(body[botFieldName]) ?? null });\n    if (!screen.ok) {\n      // Best-effort screen-out beacon (no PII) so catch-rate is observable, then\n      // return success exactly as before — the bot/visitor still sees success.\n      const cfg = opts.getConfig();\n      if (cfg.url && cfg.token) {\n        await submitScreenOut({\n          url: cfg.url,\n          token: cfg.token,\n          reason: screen.reason,\n          fetch: event.fetch,\n        });\n      }\n      return json({ ok: true });\n    }\n\n    // buildPayload runs on untrusted JSON; a careless field access (e.g.\n    // `body.name.trim()` on a non-string) would otherwise escape as a 500. Treat\n    // a throw as a malformed request (400), keeping the \"never 500s\" guarantee.\n    let payload: SubmissionPayload;\n    try {\n      payload = {\n        ...opts.buildPayload(body, event),\n        ...(opts.formType ? { formType: opts.formType } : {}),\n        _meta: buildSubmissionMeta(event, str(body[turnstileFieldName])),\n      };\n    } catch (err) {\n      console.error(`[forms-ingest] buildPayload threw: ${String(err)}`);\n      return json({ ok: false, error: failed }, { status: 400 });\n    }\n    if (!isFormType(payload.formType)) {\n      console.error(`[forms-ingest] invalid formType: ${String(payload.formType)}`);\n      return json({ ok: false, error: failed }, { status: 400 });\n    }\n\n    const { url, token } = opts.getConfig();\n    if (!url || !token) {\n      console.error(`[forms-ingest] config missing for formType=${payload.formType}`);\n      return json({ ok: false, error: unavailable }, { status: 500 });\n    }\n\n    const result = await submitToIngest({ url, token, fetch: event.fetch, payload });\n    if (!result.ok) {\n      console.error(`[forms-ingest] ${payload.formType} → ${result.status}: ${result.error}`);\n      return json({ ok: false, error: failed }, { status: 502 });\n    }\n    return json({ ok: true });\n  };\n}\n"],"mappings":";;;;;;;;;;;AAAA,SAAS,MAAM,gBAAuD;;;ACqD/D,SAAS,oBACd,OACA,gBAC4B;AAC5B,QAAM,OAAuB,CAAC;AAE9B,QAAM,QAAQ,OAAO,mBAAmB,WAAW,eAAe,KAAK,IAAI;AAC3E,MAAI,MAAO,MAAK,iBAAiB;AAEjC,MAAI,OAAO,MAAM,qBAAqB,YAAY;AAChD,QAAI;AACF,YAAM,KAAK,MAAM,iBAAiB;AAClC,UAAI,OAAO,OAAO,YAAY,GAAG,KAAK,EAAG,MAAK,WAAW,GAAG,KAAK;AAAA,IACnE,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,SAAO,OAAO,KAAK,IAAI,EAAE,SAAS,IAAI,OAAO;AAC/C;;;AD1BO,SAAS,mBACd,MACoD;AACpD,QAAM,eAAe,KAAK,gBAAgB;AAC1C,QAAM,cAAc,KAAK,eAAe;AACxC,QAAM,qBAAqB,KAAK,sBAAsB;AACtD,QAAM,MAAM,KAAK,OAAO,KAAK;AAC7B,QAAM,cACJ,KAAK,sBAAsB;AAC7B,QAAM,SACJ,KAAK,gBAAgB;AAEvB,SAAO,OAAO,UAAU;AACtB,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,MAAM,QAAQ,SAAS;AAAA,IACtC,QAAQ;AACN,cAAQ,MAAM,kBAAkB,KAAK,QAAQ,6BAA6B;AAC1E,aAAO,KAAK,KAAK,EAAE,OAAO,OAAO,CAAC;AAAA,IACpC;AAIA,UAAM,SAAS,iBAAiB;AAAA,MAC9B,UAAU,KAAK,IAAI,YAAY,GAAG,SAAS,KAAK;AAAA,MAChD,WAAW,UAAU,KAAK,IAAI,WAAW,GAAG,GAAG;AAAA,IACjD,CAAC;AACD,QAAI,CAAC,OAAO,IAAI;AAGd,YAAM,MAAM,KAAK,UAAU;AAC3B,UAAI,IAAI,OAAO,IAAI,OAAO;AACxB,cAAM,gBAAgB;AAAA,UACpB,KAAK,IAAI;AAAA,UACT,OAAO,IAAI;AAAA,UACX,QAAQ,OAAO;AAAA,UACf,OAAO,MAAM;AAAA,QACf,CAAC;AAAA,MACH;AACA,aAAO,QAAQ;AAAA,IACjB;AAEA,UAAM,EAAE,KAAK,MAAM,IAAI,KAAK,UAAU;AACtC,QAAI,CAAC,OAAO,CAAC,OAAO;AAClB,cAAQ,MAAM,8CAA8C,KAAK,QAAQ,EAAE;AAC3E,aAAO,KAAK,KAAK,EAAE,OAAO,YAAY,CAAC;AAAA,IACzC;AAMA,QAAI;AACJ,QAAI;AACF,gBAAU;AAAA,QACR,GAAG,KAAK,aAAa,MAAM,KAAK;AAAA,QAChC,UAAU,KAAK;AAAA,QACf,OAAO,oBAAoB,OAAO,KAAK,IAAI,kBAAkB,GAAG,SAAS,CAAC;AAAA,MAC5E;AAAA,IACF,SAAS,KAAK;AACZ,cAAQ,MAAM,kBAAkB,KAAK,QAAQ,yBAAyB,OAAO,GAAG,CAAC,EAAE;AACnF,aAAO,KAAK,KAAK,EAAE,OAAO,OAAO,CAAC;AAAA,IACpC;AAEA,UAAM,SAAS,MAAM,eAAe;AAAA,MAClC;AAAA,MACA;AAAA,MACA,OAAO,MAAM;AAAA,MACb;AAAA,IACF,CAAC;AACD,QAAI,CAAC,OAAO,IAAI;AACd,cAAQ,MAAM,kBAAkB,KAAK,QAAQ,WAAM,OAAO,MAAM,KAAK,OAAO,KAAK,EAAE;AACnF,aAAO,KAAK,KAAK,EAAE,OAAO,OAAO,CAAC;AAAA,IACpC;AACA,WAAO,QAAQ;AAAA,EACjB;AAKA,WAAS,UAA6B;AACpC,QAAI,KAAK,WAAY,UAAS,KAAK,KAAK,UAAU;AAClD,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB;AACF;AAKA,SAAS,UAAU,OAAoC,KAAkC;AACvF,QAAM,KAAK,OAAO,KAAK;AACvB,MAAI,CAAC,OAAO,SAAS,EAAE,KAAK,MAAM,EAAG,QAAO;AAK5C,SAAO,KAAK,IAAI,GAAG,IAAI,IAAI,EAAE;AAC/B;;;AE/IA,SAAS,YAA+B;AAqCxC,SAAS,WAAW,GAA2B;AAC7C,SAAO,OAAO,MAAM,YAAa,sBAA4C,SAAS,CAAC;AACzF;AAEA,SAAS,IAAI,GAAgC;AAC3C,SAAO,OAAO,MAAM,WAAW,IAAI;AACrC;AAQO,SAAS,qBACd,MAC4C;AAC5C,QAAM,eAAe,KAAK,gBAAgB;AAC1C,QAAM,qBAAqB,KAAK,sBAAsB;AACtD,QAAM,cACJ,KAAK,sBAAsB;AAC7B,QAAM,SACJ,KAAK,gBAAgB;AAEvB,SAAO,OAAO,UAAU;AACtB,QAAI;AACJ,QAAI;AACF,YAAM,SAAkB,MAAM,MAAM,QAAQ,KAAK;AACjD,UAAI,CAAC,UAAU,OAAO,WAAW,SAAU,OAAM,IAAI,MAAM,uBAAuB;AAClF,aAAO;AAAA,IACT,QAAQ;AACN,cAAQ,MAAM,0CAA0C;AACxD,aAAO,KAAK,EAAE,IAAI,OAAO,OAAO,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3D;AAKA,UAAM,SAAS,iBAAiB,EAAE,UAAU,IAAI,KAAK,YAAY,CAAC,KAAK,KAAK,CAAC;AAC7E,QAAI,CAAC,OAAO,IAAI;AAGd,YAAM,MAAM,KAAK,UAAU;AAC3B,UAAI,IAAI,OAAO,IAAI,OAAO;AACxB,cAAM,gBAAgB;AAAA,UACpB,KAAK,IAAI;AAAA,UACT,OAAO,IAAI;AAAA,UACX,QAAQ,OAAO;AAAA,UACf,OAAO,MAAM;AAAA,QACf,CAAC;AAAA,MACH;AACA,aAAO,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,IAC1B;AAKA,QAAI;AACJ,QAAI;AACF,gBAAU;AAAA,QACR,GAAG,KAAK,aAAa,MAAM,KAAK;AAAA,QAChC,GAAI,KAAK,WAAW,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC;AAAA,QACnD,OAAO,oBAAoB,OAAO,IAAI,KAAK,kBAAkB,CAAC,CAAC;AAAA,MACjE;AAAA,IACF,SAAS,KAAK;AACZ,cAAQ,MAAM,sCAAsC,OAAO,GAAG,CAAC,EAAE;AACjE,aAAO,KAAK,EAAE,IAAI,OAAO,OAAO,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3D;AACA,QAAI,CAAC,WAAW,QAAQ,QAAQ,GAAG;AACjC,cAAQ,MAAM,oCAAoC,OAAO,QAAQ,QAAQ,CAAC,EAAE;AAC5E,aAAO,KAAK,EAAE,IAAI,OAAO,OAAO,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3D;AAEA,UAAM,EAAE,KAAK,MAAM,IAAI,KAAK,UAAU;AACtC,QAAI,CAAC,OAAO,CAAC,OAAO;AAClB,cAAQ,MAAM,8CAA8C,QAAQ,QAAQ,EAAE;AAC9E,aAAO,KAAK,EAAE,IAAI,OAAO,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAChE;AAEA,UAAM,SAAS,MAAM,eAAe,EAAE,KAAK,OAAO,OAAO,MAAM,OAAO,QAAQ,CAAC;AAC/E,QAAI,CAAC,OAAO,IAAI;AACd,cAAQ,MAAM,kBAAkB,QAAQ,QAAQ,WAAM,OAAO,MAAM,KAAK,OAAO,KAAK,EAAE;AACtF,aAAO,KAAK,EAAE,IAAI,OAAO,OAAO,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3D;AACA,WAAO,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EAC1B;AACF;","names":[]}
+{"version":3,"sources":["../../src/forms/action.ts","../../src/forms/meta.ts","../../src/forms/endpoint.ts"],"sourcesContent":["import { fail, redirect, type ActionFailure, type RequestEvent } from \"@sveltejs/kit\";\nimport {\n  submitToIngest,\n  screenSubmission,\n  submitScreenOut,\n  type SubmissionPayload,\n} from \"./client.js\";\nimport { buildSubmissionMeta } from \"./meta.js\";\n\n/** Endpoint + token for the dashboard ingest, read per-request from site env. */\nexport type IngestActionConfig = { url?: string; token?: string };\n\nexport type CreateIngestActionOptions = {\n  /** Stamped onto every payload as `formType` (a SUBMISSION_FORM_TYPES value). */\n  formType: string;\n  /** Read at call time so SvelteKit's dynamic private env resolves per-request. */\n  getConfig: () => IngestActionConfig;\n  /**\n   * Map this form's fields to a payload. The factory's `formType` is always\n   * authoritative and cannot be overridden by `buildPayload`.\n   */\n  buildPayload: (form: FormData, event: RequestEvent) => SubmissionPayload;\n  /** Honeypot input name. Default \"bot-field\". */\n  botFieldName?: string;\n  /** Hidden timestamp input name (planted in `load`). Default \"ts\". */\n  tsFieldName?: string;\n  /** Field carrying the Cloudflare Turnstile token. Default \"cf-turnstile-response\". */\n  turnstileFieldName?: string;\n  /** fail(500) copy when env vars are unset. */\n  unavailableMessage?: string;\n  /** fail(502) copy when the ingest endpoint rejects/errors. */\n  errorMessage?: string;\n  /** Injectable clock for tests. Default Date.now. */\n  now?: () => number;\n  /** If set, a successful OR bot-screened submission throws redirect(303, redirectTo)\n   *  instead of returning {success:true} (e.g. a dedicated /thank-you page). */\n  redirectTo?: string;\n};\n\nexport type IngestActionData = { success: true } | ActionFailure<{ error: string }>;\n\n/**\n * Build a SvelteKit `default` form action that screens for bots, forwards the\n * submission to the dashboard ingest endpoint, and returns SvelteKit-shaped\n * results. The per-form field mapping is the only thing a site must supply.\n */\nexport function createIngestAction(\n  opts: CreateIngestActionOptions,\n): (event: RequestEvent) => Promise<IngestActionData> {\n  const botFieldName = opts.botFieldName ?? \"bot-field\";\n  const tsFieldName = opts.tsFieldName ?? \"ts\";\n  const turnstileFieldName = opts.turnstileFieldName ?? \"cf-turnstile-response\";\n  const now = opts.now ?? Date.now;\n  const unavailable =\n    opts.unavailableMessage ?? \"This form is temporarily unavailable. Please email us directly.\";\n  const failed =\n    opts.errorMessage ?? \"Something went wrong sending your message. Please try again.\";\n\n  return async (event) => {\n    let form: FormData;\n    try {\n      form = await event.request.formData();\n    } catch {\n      console.error(`[forms-ingest] ${opts.formType}: could not parse form body`);\n      return fail(400, { error: failed });\n    }\n\n    // Bot screen: a filled honeypot OR an implausibly fast fill is silently\n    // accepted (return success, do NOT forward) so bots get no signal.\n    const screen = screenSubmission({\n      botField: form.get(botFieldName)?.toString() ?? null,\n      elapsedMs: elapsedMs(form.get(tsFieldName), now),\n    });\n    if (!screen.ok) {\n      // Best-effort screen-out beacon (no PII) so catch-rate is observable, then\n      // succeed exactly as before — the bot/visitor still sees success.\n      const cfg = opts.getConfig();\n      if (cfg.url && cfg.token) {\n        await submitScreenOut({\n          url: cfg.url,\n          token: cfg.token,\n          reason: screen.reason,\n          fetch: event.fetch,\n        });\n      }\n      return succeed();\n    }\n\n    const { url, token } = opts.getConfig();\n    if (!url || !token) {\n      console.error(`[forms-ingest] config missing for formType=${opts.formType}`);\n      return fail(500, { error: unavailable });\n    }\n\n    // buildPayload runs on untrusted form data; a careless field access (e.g.\n    // `form.get(\"email\")!.toString()` on an absent field) would otherwise escape\n    // as an uncaught 500. Treat a throw as a malformed request (400), mirroring\n    // endpoint.ts's guard and its \"never 500s\" guarantee.\n    let payload: SubmissionPayload;\n    try {\n      payload = {\n        ...opts.buildPayload(form, event),\n        formType: opts.formType,\n        _meta: buildSubmissionMeta(event, form.get(turnstileFieldName)?.toString()),\n      };\n    } catch (err) {\n      console.error(`[forms-ingest] ${opts.formType}: buildPayload threw: ${String(err)}`);\n      return fail(400, { error: failed });\n    }\n\n    const result = await submitToIngest({\n      url,\n      token,\n      fetch: event.fetch,\n      payload,\n    });\n    if (!result.ok) {\n      console.error(`[forms-ingest] ${opts.formType} → ${result.status}: ${result.error}`);\n      return fail(502, { error: failed });\n    }\n    return succeed();\n  };\n\n  // Single success path: redirect when configured (e.g. a dedicated /thank-you\n  // page), otherwise return the SvelteKit-shaped success. `redirect()` throws, so\n  // the trailing `return` keeps the `{ success: true }` type.\n  function succeed(): { success: true } {\n    if (opts.redirectTo) redirect(303, opts.redirectTo);\n    return { success: true };\n  }\n}\n\n// `FormDataEntryValue` is a DOM-lib global; this package compiles with only the\n// ES2022 lib + @types/node, where it is not in scope. Derive the type from the\n// in-scope `FormData.get` return instead — same value, no DOM-lib dependency.\nfunction elapsedMs(tsRaw: ReturnType<FormData[\"get\"]>, now: () => number): number | null {\n  const ts = Number(tsRaw);\n  if (!Number.isFinite(ts) || ts <= 0) return null;\n  // Clamp at 0: elapsed time can't be negative. A future `ts` (clock skew or a bot\n  // forging one) would otherwise yield a negative value; clamping makes it read as\n  // 0ms (effectively instant) so the MIN_FILL_MS gate still trips. Defense-in-depth\n  // with screenSubmission, which also treats any sub-floor elapsed as too-fast.\n  return Math.max(0, now() - ts);\n}\n","/** The reserved wire envelope a fleet site forwards alongside the lead fields.\n *  (Older package versions also sent a `userAgent` — central never consumed it,\n *  so it is no longer forwarded; `readMeta` simply ignores it from old senders.) */\nexport type SubmissionMeta = {\n  turnstileToken?: string;\n  clientIp?: string;\n};\n\nfunction str(v: unknown): string {\n  return typeof v === \"string\" ? v.trim() : \"\";\n}\n\n/**\n * Defensively read the reserved `_meta` envelope off an untrusted ingest payload\n * (CENTRAL side, used by the ingest handler). Keeps only non-blank string fields\n * among the KNOWN keys, dropping everything else — a bot cannot smuggle a\n * non-string clientIp in, and unknown fields (e.g. the `userAgent` older package\n * versions still send) are silently ignored. The token/IP read here are used\n * transiently (Turnstile verify + `remoteip`) and are NEVER persisted; the token\n * is never stored. The SITE-side writer (`buildSubmissionMeta`) is added by the\n * site-factory task; `readMeta` is the single reader (there is no `parseMeta`).\n */\nexport function readMeta(payload: unknown): SubmissionMeta {\n  const meta: SubmissionMeta = {};\n  if (typeof payload !== \"object\" || payload === null) return meta;\n  const raw = (payload as Record<string, unknown>)._meta;\n  if (typeof raw !== \"object\" || raw === null) return meta;\n  const m = raw as Record<string, unknown>;\n  const token = str(m.turnstileToken);\n  if (token) meta.turnstileToken = token;\n  const ip = str(m.clientIp);\n  if (ip) meta.clientIp = ip;\n  return meta;\n}\n\n/**\n * SITE-side event shape `buildSubmissionMeta` reads. Structural (not SvelteKit's\n * `RequestEvent`) so this leaf stays SDK-free; a real `RequestEvent` is\n * structurally assignable (`getClientAddress: () => string`).\n */\ntype MetaEvent = {\n  getClientAddress?: () => string;\n};\n\n/**\n * Build the transient `_meta` envelope a site forwards to central ingest:\n * `{ turnstileToken?, clientIp? }`. Returns `undefined` when no field yields a\n * value so callers can attach it unconditionally without polluting the payload\n * (an `undefined` value is dropped by `JSON.stringify`). `getClientAddress` is\n * guarded (some adapters lack a client address and can throw). The visitor's\n * user-agent is deliberately NOT forwarded — central never consumed it, so\n * shipping it was pure transient-PII surface. None of this is ever persisted.\n */\nexport function buildSubmissionMeta(\n  event: MetaEvent,\n  turnstileToken: string | null | undefined,\n): SubmissionMeta | undefined {\n  const meta: SubmissionMeta = {};\n\n  const token = typeof turnstileToken === \"string\" ? turnstileToken.trim() : \"\";\n  if (token) meta.turnstileToken = token;\n\n  if (typeof event.getClientAddress === \"function\") {\n    try {\n      const ip = event.getClientAddress();\n      if (typeof ip === \"string\" && ip.trim()) meta.clientIp = ip.trim();\n    } catch {\n      // Some adapters have no client address and throw; drop clientIp silently.\n    }\n  }\n\n  return Object.keys(meta).length > 0 ? meta : undefined;\n}\n","import { json, type RequestEvent } from \"@sveltejs/kit\";\nimport {\n  submitToIngest,\n  screenSubmission,\n  submitScreenOut,\n  type SubmissionPayload,\n} from \"./client.js\";\nimport { SUBMISSION_FORM_TYPES, type FormType } from \"./types.js\";\nimport type { IngestActionConfig } from \"./action.js\";\nimport { buildSubmissionMeta } from \"./meta.js\";\n\n/**\n * Options for {@link createIngestEndpoint} — the JSON sibling of\n * `createIngestAction` for client-driven forms (modals / lightboxes / fetch)\n * that POST JSON to a `+server.ts` route instead of using a form action.\n */\nexport type CreateIngestEndpointOptions = {\n  /** Read at call time so SvelteKit's dynamic private env resolves per-request. */\n  getConfig: () => IngestActionConfig;\n  /**\n   * Map the parsed JSON body to a payload. Must set `formType` UNLESS the fixed\n   * `formType` option is provided (then that is authoritative and overrides it).\n   *\n   * May be async. A site that resolves confirmation copy from its own CMS does a\n   * read here — see `@reddoorla/maintenance/forms/prismic`. A rejection is\n   * handled exactly like a throw from a sync one: a 400, never a 500.\n   */\n  buildPayload: (\n    body: Record<string, unknown>,\n    event: RequestEvent,\n  ) => SubmissionPayload | Promise<SubmissionPayload>;\n  /** Fixed formType for single-type endpoints; omit for multi-type endpoints\n   *  where `buildPayload` derives formType from the body. */\n  formType?: string;\n  /** Honeypot field name in the JSON body. Default \"bot-field\". */\n  botFieldName?: string;\n  /** Field carrying the Cloudflare Turnstile token. Default \"cf-turnstile-response\". */\n  turnstileFieldName?: string;\n  /** json(500) copy when env vars are unset. */\n  unavailableMessage?: string;\n  /** json(400/502) copy for bad input / ingest failure. */\n  errorMessage?: string;\n};\n\nfunction isFormType(v: unknown): v is FormType {\n  return typeof v === \"string\" && (SUBMISSION_FORM_TYPES as readonly string[]).includes(v);\n}\n\nfunction str(v: unknown): string | undefined {\n  return typeof v === \"string\" ? v : undefined;\n}\n\n/**\n * Build a JSON `POST` handler that screens for bots, forwards the submission to\n * the dashboard ingest endpoint, and returns `{ ok }`-shaped JSON. The per-form\n * field mapping (`buildPayload`) is the only thing a site must supply. The\n * returned function is structurally a SvelteKit `RequestHandler`.\n */\nexport function createIngestEndpoint(\n  opts: CreateIngestEndpointOptions,\n): (event: RequestEvent) => Promise<Response> {\n  const botFieldName = opts.botFieldName ?? \"bot-field\";\n  const turnstileFieldName = opts.turnstileFieldName ?? \"cf-turnstile-response\";\n  const unavailable =\n    opts.unavailableMessage ?? \"This form is temporarily unavailable. Please email us directly.\";\n  const failed =\n    opts.errorMessage ?? \"Something went wrong sending your message. Please try again.\";\n\n  return async (event) => {\n    let body: Record<string, unknown>;\n    try {\n      const parsed: unknown = await event.request.json();\n      if (!parsed || typeof parsed !== \"object\") throw new Error(\"body is not an object\");\n      body = parsed as Record<string, unknown>;\n    } catch {\n      console.error(\"[forms-ingest] could not parse JSON body\");\n      return json({ ok: false, error: failed }, { status: 400 });\n    }\n\n    // Bot screen: honeypot only. A client POST carries no server-planted ts, and\n    // screenSubmission treats a missing elapsedMs as OK. A filled honeypot is\n    // silently accepted (return ok, do NOT forward) so bots get no signal.\n    const screen = screenSubmission({ botField: str(body[botFieldName]) ?? null });\n    if (!screen.ok) {\n      // Best-effort screen-out beacon (no PII) so catch-rate is observable, then\n      // return success exactly as before — the bot/visitor still sees success.\n      const cfg = opts.getConfig();\n      if (cfg.url && cfg.token) {\n        await submitScreenOut({\n          url: cfg.url,\n          token: cfg.token,\n          reason: screen.reason,\n          fetch: event.fetch,\n        });\n      }\n      return json({ ok: true });\n    }\n\n    // buildPayload runs on untrusted JSON; a careless field access (e.g.\n    // `body.name.trim()` on a non-string) would otherwise escape as a 500. Treat\n    // a throw as a malformed request (400), keeping the \"never 500s\" guarantee.\n    let payload: SubmissionPayload;\n    try {\n      payload = {\n        ...(await opts.buildPayload(body, event)),\n        ...(opts.formType ? { formType: opts.formType } : {}),\n        _meta: buildSubmissionMeta(event, str(body[turnstileFieldName])),\n      };\n    } catch (err) {\n      console.error(`[forms-ingest] buildPayload threw: ${String(err)}`);\n      return json({ ok: false, error: failed }, { status: 400 });\n    }\n    if (!isFormType(payload.formType)) {\n      console.error(`[forms-ingest] invalid formType: ${String(payload.formType)}`);\n      return json({ ok: false, error: failed }, { status: 400 });\n    }\n\n    const { url, token } = opts.getConfig();\n    if (!url || !token) {\n      console.error(`[forms-ingest] config missing for formType=${payload.formType}`);\n      return json({ ok: false, error: unavailable }, { status: 500 });\n    }\n\n    const result = await submitToIngest({ url, token, fetch: event.fetch, payload });\n    if (!result.ok) {\n      console.error(`[forms-ingest] ${payload.formType} → ${result.status}: ${result.error}`);\n      return json({ ok: false, error: failed }, { status: 502 });\n    }\n    return json({ ok: true });\n  };\n}\n"],"mappings":";;;;;;;;;;;AAAA,SAAS,MAAM,gBAAuD;;;ACqD/D,SAAS,oBACd,OACA,gBAC4B;AAC5B,QAAM,OAAuB,CAAC;AAE9B,QAAM,QAAQ,OAAO,mBAAmB,WAAW,eAAe,KAAK,IAAI;AAC3E,MAAI,MAAO,MAAK,iBAAiB;AAEjC,MAAI,OAAO,MAAM,qBAAqB,YAAY;AAChD,QAAI;AACF,YAAM,KAAK,MAAM,iBAAiB;AAClC,UAAI,OAAO,OAAO,YAAY,GAAG,KAAK,EAAG,MAAK,WAAW,GAAG,KAAK;AAAA,IACnE,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,SAAO,OAAO,KAAK,IAAI,EAAE,SAAS,IAAI,OAAO;AAC/C;;;AD1BO,SAAS,mBACd,MACoD;AACpD,QAAM,eAAe,KAAK,gBAAgB;AAC1C,QAAM,cAAc,KAAK,eAAe;AACxC,QAAM,qBAAqB,KAAK,sBAAsB;AACtD,QAAM,MAAM,KAAK,OAAO,KAAK;AAC7B,QAAM,cACJ,KAAK,sBAAsB;AAC7B,QAAM,SACJ,KAAK,gBAAgB;AAEvB,SAAO,OAAO,UAAU;AACtB,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,MAAM,QAAQ,SAAS;AAAA,IACtC,QAAQ;AACN,cAAQ,MAAM,kBAAkB,KAAK,QAAQ,6BAA6B;AAC1E,aAAO,KAAK,KAAK,EAAE,OAAO,OAAO,CAAC;AAAA,IACpC;AAIA,UAAM,SAAS,iBAAiB;AAAA,MAC9B,UAAU,KAAK,IAAI,YAAY,GAAG,SAAS,KAAK;AAAA,MAChD,WAAW,UAAU,KAAK,IAAI,WAAW,GAAG,GAAG;AAAA,IACjD,CAAC;AACD,QAAI,CAAC,OAAO,IAAI;AAGd,YAAM,MAAM,KAAK,UAAU;AAC3B,UAAI,IAAI,OAAO,IAAI,OAAO;AACxB,cAAM,gBAAgB;AAAA,UACpB,KAAK,IAAI;AAAA,UACT,OAAO,IAAI;AAAA,UACX,QAAQ,OAAO;AAAA,UACf,OAAO,MAAM;AAAA,QACf,CAAC;AAAA,MACH;AACA,aAAO,QAAQ;AAAA,IACjB;AAEA,UAAM,EAAE,KAAK,MAAM,IAAI,KAAK,UAAU;AACtC,QAAI,CAAC,OAAO,CAAC,OAAO;AAClB,cAAQ,MAAM,8CAA8C,KAAK,QAAQ,EAAE;AAC3E,aAAO,KAAK,KAAK,EAAE,OAAO,YAAY,CAAC;AAAA,IACzC;AAMA,QAAI;AACJ,QAAI;AACF,gBAAU;AAAA,QACR,GAAG,KAAK,aAAa,MAAM,KAAK;AAAA,QAChC,UAAU,KAAK;AAAA,QACf,OAAO,oBAAoB,OAAO,KAAK,IAAI,kBAAkB,GAAG,SAAS,CAAC;AAAA,MAC5E;AAAA,IACF,SAAS,KAAK;AACZ,cAAQ,MAAM,kBAAkB,KAAK,QAAQ,yBAAyB,OAAO,GAAG,CAAC,EAAE;AACnF,aAAO,KAAK,KAAK,EAAE,OAAO,OAAO,CAAC;AAAA,IACpC;AAEA,UAAM,SAAS,MAAM,eAAe;AAAA,MAClC;AAAA,MACA;AAAA,MACA,OAAO,MAAM;AAAA,MACb;AAAA,IACF,CAAC;AACD,QAAI,CAAC,OAAO,IAAI;AACd,cAAQ,MAAM,kBAAkB,KAAK,QAAQ,WAAM,OAAO,MAAM,KAAK,OAAO,KAAK,EAAE;AACnF,aAAO,KAAK,KAAK,EAAE,OAAO,OAAO,CAAC;AAAA,IACpC;AACA,WAAO,QAAQ;AAAA,EACjB;AAKA,WAAS,UAA6B;AACpC,QAAI,KAAK,WAAY,UAAS,KAAK,KAAK,UAAU;AAClD,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB;AACF;AAKA,SAAS,UAAU,OAAoC,KAAkC;AACvF,QAAM,KAAK,OAAO,KAAK;AACvB,MAAI,CAAC,OAAO,SAAS,EAAE,KAAK,MAAM,EAAG,QAAO;AAK5C,SAAO,KAAK,IAAI,GAAG,IAAI,IAAI,EAAE;AAC/B;;;AE/IA,SAAS,YAA+B;AA4CxC,SAAS,WAAW,GAA2B;AAC7C,SAAO,OAAO,MAAM,YAAa,sBAA4C,SAAS,CAAC;AACzF;AAEA,SAAS,IAAI,GAAgC;AAC3C,SAAO,OAAO,MAAM,WAAW,IAAI;AACrC;AAQO,SAAS,qBACd,MAC4C;AAC5C,QAAM,eAAe,KAAK,gBAAgB;AAC1C,QAAM,qBAAqB,KAAK,sBAAsB;AACtD,QAAM,cACJ,KAAK,sBAAsB;AAC7B,QAAM,SACJ,KAAK,gBAAgB;AAEvB,SAAO,OAAO,UAAU;AACtB,QAAI;AACJ,QAAI;AACF,YAAM,SAAkB,MAAM,MAAM,QAAQ,KAAK;AACjD,UAAI,CAAC,UAAU,OAAO,WAAW,SAAU,OAAM,IAAI,MAAM,uBAAuB;AAClF,aAAO;AAAA,IACT,QAAQ;AACN,cAAQ,MAAM,0CAA0C;AACxD,aAAO,KAAK,EAAE,IAAI,OAAO,OAAO,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3D;AAKA,UAAM,SAAS,iBAAiB,EAAE,UAAU,IAAI,KAAK,YAAY,CAAC,KAAK,KAAK,CAAC;AAC7E,QAAI,CAAC,OAAO,IAAI;AAGd,YAAM,MAAM,KAAK,UAAU;AAC3B,UAAI,IAAI,OAAO,IAAI,OAAO;AACxB,cAAM,gBAAgB;AAAA,UACpB,KAAK,IAAI;AAAA,UACT,OAAO,IAAI;AAAA,UACX,QAAQ,OAAO;AAAA,UACf,OAAO,MAAM;AAAA,QACf,CAAC;AAAA,MACH;AACA,aAAO,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,IAC1B;AAKA,QAAI;AACJ,QAAI;AACF,gBAAU;AAAA,QACR,GAAI,MAAM,KAAK,aAAa,MAAM,KAAK;AAAA,QACvC,GAAI,KAAK,WAAW,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC;AAAA,QACnD,OAAO,oBAAoB,OAAO,IAAI,KAAK,kBAAkB,CAAC,CAAC;AAAA,MACjE;AAAA,IACF,SAAS,KAAK;AACZ,cAAQ,MAAM,sCAAsC,OAAO,GAAG,CAAC,EAAE;AACjE,aAAO,KAAK,EAAE,IAAI,OAAO,OAAO,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3D;AACA,QAAI,CAAC,WAAW,QAAQ,QAAQ,GAAG;AACjC,cAAQ,MAAM,oCAAoC,OAAO,QAAQ,QAAQ,CAAC,EAAE;AAC5E,aAAO,KAAK,EAAE,IAAI,OAAO,OAAO,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3D;AAEA,UAAM,EAAE,KAAK,MAAM,IAAI,KAAK,UAAU;AACtC,QAAI,CAAC,OAAO,CAAC,OAAO;AAClB,cAAQ,MAAM,8CAA8C,QAAQ,QAAQ,EAAE;AAC9E,aAAO,KAAK,EAAE,IAAI,OAAO,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAChE;AAEA,UAAM,SAAS,MAAM,eAAe,EAAE,KAAK,OAAO,OAAO,MAAM,OAAO,QAAQ,CAAC;AAC/E,QAAI,CAAC,OAAO,IAAI;AACd,cAAQ,MAAM,kBAAkB,QAAQ,QAAQ,WAAM,OAAO,MAAM,KAAK,OAAO,KAAK,EAAE;AACtF,aAAO,KAAK,EAAE,IAAI,OAAO,OAAO,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3D;AACA,WAAO,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EAC1B;AACF;","names":[]}