@reddoorla/maintenance 0.93.0 → 0.94.0

package/dist/forms/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/forms/action.ts","../../src/forms/meta.ts","../../src/forms/endpoint.ts"],"sourcesContent":["import { fail, redirect, type ActionFailure, type RequestEvent } from \"@sveltejs/kit\";\nimport {\n  submitToIngest,\n  screenSubmission,\n  submitScreenOut,\n  type SubmissionPayload,\n} from \"./client.js\";\nimport { buildSubmissionMeta } from \"./meta.js\";\n\n/** Endpoint + token for the dashboard ingest, read per-request from site env. */\nexport type IngestActionConfig = { url?: string; token?: string };\n\nexport type CreateIngestActionOptions = {\n  /** Stamped onto every payload as `formType` (a SUBMISSION_FORM_TYPES value). */\n  formType: string;\n  /** Read at call time so SvelteKit's dynamic private env resolves per-request. */\n  getConfig: () => IngestActionConfig;\n  /**\n   * Map this form's fields to a payload. The factory's `formType` is always\n   * authoritative and cannot be overridden by `buildPayload`.\n   */\n  buildPayload: (form: FormData, event: RequestEvent) => SubmissionPayload;\n  /** Honeypot input name. Default \"bot-field\". */\n  botFieldName?: string;\n  /** Hidden timestamp input name (planted in `load`). Default \"ts\". */\n  tsFieldName?: string;\n  /** Field carrying the Cloudflare Turnstile token. Default \"cf-turnstile-response\". */\n  turnstileFieldName?: string;\n  /** fail(500) copy when env vars are unset. */\n  unavailableMessage?: string;\n  /** fail(502) copy when the ingest endpoint rejects/errors. */\n  errorMessage?: string;\n  /** Injectable clock for tests. Default Date.now. */\n  now?: () => number;\n  /** If set, a successful OR bot-screened submission throws redirect(303, redirectTo)\n   *  instead of returning {success:true} (e.g. a dedicated /thank-you page). */\n  redirectTo?: string;\n};\n\nexport type IngestActionData = { success: true } | ActionFailure<{ error: string }>;\n\n/**\n * Build a SvelteKit `default` form action that screens for bots, forwards the\n * submission to the dashboard ingest endpoint, and returns SvelteKit-shaped\n * results. The per-form field mapping is the only thing a site must supply.\n */\nexport function createIngestAction(\n  opts: CreateIngestActionOptions,\n): (event: RequestEvent) => Promise<IngestActionData> {\n  const botFieldName = opts.botFieldName ?? \"bot-field\";\n  const tsFieldName = opts.tsFieldName ?? \"ts\";\n  const turnstileFieldName = opts.turnstileFieldName ?? \"cf-turnstile-response\";\n  const now = opts.now ?? Date.now;\n  const unavailable =\n    opts.unavailableMessage ?? \"This form is temporarily unavailable. Please email us directly.\";\n  const failed =\n    opts.errorMessage ?? \"Something went wrong sending your message. Please try again.\";\n\n  return async (event) => {\n    let form: FormData;\n    try {\n      form = await event.request.formData();\n    } catch {\n      console.error(`[forms-ingest] ${opts.formType}: could not parse form body`);\n      return fail(400, { error: failed });\n    }\n\n    // Bot screen: a filled honeypot OR an implausibly fast fill is silently\n    // accepted (return success, do NOT forward) so bots get no signal.\n    const screen = screenSubmission({\n      botField: form.get(botFieldName)?.toString() ?? null,\n      elapsedMs: elapsedMs(form.get(tsFieldName), now),\n    });\n    if (!screen.ok) {\n      // Best-effort screen-out beacon (no PII) so catch-rate is observable, then\n      // succeed exactly as before — the bot/visitor still sees success.\n      const cfg = opts.getConfig();\n      if (cfg.url && cfg.token) {\n        await submitScreenOut({\n          url: cfg.url,\n          token: cfg.token,\n          reason: screen.reason,\n          fetch: event.fetch,\n        });\n      }\n      return succeed();\n    }\n\n    const { url, token } = opts.getConfig();\n    if (!url || !token) {\n      console.error(`[forms-ingest] config missing for formType=${opts.formType}`);\n      return fail(500, { error: unavailable });\n    }\n\n    // buildPayload runs on untrusted form data; a careless field access (e.g.\n    // `form.get(\"email\")!.toString()` on an absent field) would otherwise escape\n    // as an uncaught 500. Treat a throw as a malformed request (400), mirroring\n    // endpoint.ts's guard and its \"never 500s\" guarantee.\n    let payload: SubmissionPayload;\n    try {\n      payload = {\n        ...opts.buildPayload(form, event),\n        formType: opts.formType,\n        _meta: buildSubmissionMeta(event, form.get(turnstileFieldName)?.toString()),\n      };\n    } catch (err) {\n      console.error(`[forms-ingest] ${opts.formType}: buildPayload threw: ${String(err)}`);\n      return fail(400, { error: failed });\n    }\n\n    const result = await submitToIngest({\n      url,\n      token,\n      fetch: event.fetch,\n      payload,\n    });\n    if (!result.ok) {\n      console.error(`[forms-ingest] ${opts.formType} → ${result.status}: ${result.error}`);\n      return fail(502, { error: failed });\n    }\n    return succeed();\n  };\n\n  // Single success path: redirect when configured (e.g. a dedicated /thank-you\n  // page), otherwise return the SvelteKit-shaped success. `redirect()` throws, so\n  // the trailing `return` keeps the `{ success: true }` type.\n  function succeed(): { success: true } {\n    if (opts.redirectTo) redirect(303, opts.redirectTo);\n    return { success: true };\n  }\n}\n\n// `FormDataEntryValue` is a DOM-lib global; this package compiles with only the\n// ES2022 lib + @types/node, where it is not in scope. Derive the type from the\n// in-scope `FormData.get` return instead — same value, no DOM-lib dependency.\nfunction elapsedMs(tsRaw: ReturnType<FormData[\"get\"]>, now: () => number): number | null {\n  const ts = Number(tsRaw);\n  if (!Number.isFinite(ts) || ts <= 0) return null;\n  // Clamp at 0: elapsed time can't be negative. A future `ts` (clock skew or a bot\n  // forging one) would otherwise yield a negative value; clamping makes it read as\n  // 0ms (effectively instant) so the MIN_FILL_MS gate still trips. Defense-in-depth\n  // with screenSubmission, which also treats any sub-floor elapsed as too-fast.\n  return Math.max(0, now() - ts);\n}\n","/** The reserved wire envelope a fleet site forwards alongside the lead fields.\n *  (Older package versions also sent a `userAgent` — central never consumed it,\n *  so it is no longer forwarded; `readMeta` simply ignores it from old senders.) */\nexport type SubmissionMeta = {\n  turnstileToken?: string;\n  clientIp?: string;\n};\n\nfunction str(v: unknown): string {\n  return typeof v === \"string\" ? v.trim() : \"\";\n}\n\n/**\n * Defensively read the reserved `_meta` envelope off an untrusted ingest payload\n * (CENTRAL side, used by the ingest handler). Keeps only non-blank string fields\n * among the KNOWN keys, dropping everything else — a bot cannot smuggle a\n * non-string clientIp in, and unknown fields (e.g. the `userAgent` older package\n * versions still send) are silently ignored. The token/IP read here are used\n * transiently (Turnstile verify + `remoteip`) and are NEVER persisted; the token\n * is never stored. The SITE-side writer (`buildSubmissionMeta`) is added by the\n * site-factory task; `readMeta` is the single reader (there is no `parseMeta`).\n */\nexport function readMeta(payload: unknown): SubmissionMeta {\n  const meta: SubmissionMeta = {};\n  if (typeof payload !== \"object\" || payload === null) return meta;\n  const raw = (payload as Record<string, unknown>)._meta;\n  if (typeof raw !== \"object\" || raw === null) return meta;\n  const m = raw as Record<string, unknown>;\n  const token = str(m.turnstileToken);\n  if (token) meta.turnstileToken = token;\n  const ip = str(m.clientIp);\n  if (ip) meta.clientIp = ip;\n  return meta;\n}\n\n/**\n * SITE-side event shape `buildSubmissionMeta` reads. Structural (not SvelteKit's\n * `RequestEvent`) so this leaf stays SDK-free; a real `RequestEvent` is\n * structurally assignable (`getClientAddress: () => string`).\n */\ntype MetaEvent = {\n  getClientAddress?: () => string;\n};\n\n/**\n * Build the transient `_meta` envelope a site forwards to central ingest:\n * `{ turnstileToken?, clientIp? }`. Returns `undefined` when no field yields a\n * value so callers can attach it unconditionally without polluting the payload\n * (an `undefined` value is dropped by `JSON.stringify`). `getClientAddress` is\n * guarded (some adapters lack a client address and can throw). The visitor's\n * user-agent is deliberately NOT forwarded — central never consumed it, so\n * shipping it was pure transient-PII surface. None of this is ever persisted.\n */\nexport function buildSubmissionMeta(\n  event: MetaEvent,\n  turnstileToken: string | null | undefined,\n): SubmissionMeta | undefined {\n  const meta: SubmissionMeta = {};\n\n  const token = typeof turnstileToken === \"string\" ? turnstileToken.trim() : \"\";\n  if (token) meta.turnstileToken = token;\n\n  if (typeof event.getClientAddress === \"function\") {\n    try {\n      const ip = event.getClientAddress();\n      if (typeof ip === \"string\" && ip.trim()) meta.clientIp = ip.trim();\n    } catch {\n      // Some adapters have no client address and throw; drop clientIp silently.\n    }\n  }\n\n  return Object.keys(meta).length > 0 ? meta : undefined;\n}\n","import { json, type RequestEvent } from \"@sveltejs/kit\";\nimport {\n  submitToIngest,\n  screenSubmission,\n  submitScreenOut,\n  type SubmissionPayload,\n} from \"./client.js\";\nimport { SUBMISSION_FORM_TYPES, type FormType } from \"./types.js\";\nimport type { IngestActionConfig } from \"./action.js\";\nimport { buildSubmissionMeta } from \"./meta.js\";\n\n/**\n * Options for {@link createIngestEndpoint} — the JSON sibling of\n * `createIngestAction` for client-driven forms (modals / lightboxes / fetch)\n * that POST JSON to a `+server.ts` route instead of using a form action.\n */\nexport type CreateIngestEndpointOptions = {\n  /** Read at call time so SvelteKit's dynamic private env resolves per-request. */\n  getConfig: () => IngestActionConfig;\n  /**\n   * Map the parsed JSON body to a payload. Must set `formType` UNLESS the fixed\n   * `formType` option is provided (then that is authoritative and overrides it).\n   *\n   * May be async. A site that resolves confirmation copy from its own CMS does a\n   * read here — see `@reddoorla/maintenance/forms/prismic`. A rejection is\n   * handled exactly like a throw from a sync one: a 400, never a 500.\n   */\n  buildPayload: (\n    body: Record<string, unknown>,\n    event: RequestEvent,\n  ) => SubmissionPayload | Promise<SubmissionPayload>;\n  /** Fixed formType for single-type endpoints; omit for multi-type endpoints\n   *  where `buildPayload` derives formType from the body. */\n  formType?: string;\n  /** Honeypot field name in the JSON body. Default \"bot-field\". */\n  botFieldName?: string;\n  /** Field carrying the Cloudflare Turnstile token. Default \"cf-turnstile-response\". */\n  turnstileFieldName?: string;\n  /** json(500) copy when env vars are unset. */\n  unavailableMessage?: string;\n  /** json(400/502) copy for bad input / ingest failure. */\n  errorMessage?: string;\n};\n\nfunction isFormType(v: unknown): v is FormType {\n  return typeof v === \"string\" && (SUBMISSION_FORM_TYPES as readonly string[]).includes(v);\n}\n\nfunction str(v: unknown): string | undefined {\n  return typeof v === \"string\" ? v : undefined;\n}\n\n/**\n * Build a JSON `POST` handler that screens for bots, forwards the submission to\n * the dashboard ingest endpoint, and returns `{ ok }`-shaped JSON. The per-form\n * field mapping (`buildPayload`) is the only thing a site must supply. The\n * returned function is structurally a SvelteKit `RequestHandler`.\n */\nexport function createIngestEndpoint(\n  opts: CreateIngestEndpointOptions,\n): (event: RequestEvent) => Promise<Response> {\n  const botFieldName = opts.botFieldName ?? \"bot-field\";\n  const turnstileFieldName = opts.turnstileFieldName ?? \"cf-turnstile-response\";\n  const unavailable =\n    opts.unavailableMessage ?? \"This form is temporarily unavailable. Please email us directly.\";\n  const failed =\n    opts.errorMessage ?? \"Something went wrong sending your message. Please try again.\";\n\n  return async (event) => {\n    let body: Record<string, unknown>;\n    try {\n      const parsed: unknown = await event.request.json();\n      if (!parsed || typeof parsed !== \"object\") throw new Error(\"body is not an object\");\n      body = parsed as Record<string, unknown>;\n    } catch {\n      console.error(\"[forms-ingest] could not parse JSON body\");\n      return json({ ok: false, error: failed }, { status: 400 });\n    }\n\n    // Bot screen: honeypot only. A client POST carries no server-planted ts, and\n    // screenSubmission treats a missing elapsedMs as OK. A filled honeypot is\n    // silently accepted (return ok, do NOT forward) so bots get no signal.\n    const screen = screenSubmission({ botField: str(body[botFieldName]) ?? null });\n    if (!screen.ok) {\n      // Best-effort screen-out beacon (no PII) so catch-rate is observable, then\n      // return success exactly as before — the bot/visitor still sees success.\n      const cfg = opts.getConfig();\n      if (cfg.url && cfg.token) {\n        await submitScreenOut({\n          url: cfg.url,\n          token: cfg.token,\n          reason: screen.reason,\n          fetch: event.fetch,\n        });\n      }\n      return json({ ok: true });\n    }\n\n    // buildPayload runs on untrusted JSON; a careless field access (e.g.\n    // `body.name.trim()` on a non-string) would otherwise escape as a 500. Treat\n    // a throw as a malformed request (400), keeping the \"never 500s\" guarantee.\n    let payload: SubmissionPayload;\n    try {\n      payload = {\n        ...(await opts.buildPayload(body, event)),\n        ...(opts.formType ? { formType: opts.formType } : {}),\n        _meta: buildSubmissionMeta(event, str(body[turnstileFieldName])),\n      };\n    } catch (err) {\n      console.error(`[forms-ingest] buildPayload threw: ${String(err)}`);\n      return json({ ok: false, error: failed }, { status: 400 });\n    }\n    if (!isFormType(payload.formType)) {\n      console.error(`[forms-ingest] invalid formType: ${String(payload.formType)}`);\n      return json({ ok: false, error: failed }, { status: 400 });\n    }\n\n    const { url, token } = opts.getConfig();\n    if (!url || !token) {\n      console.error(`[forms-ingest] config missing for formType=${payload.formType}`);\n      return json({ ok: false, error: unavailable }, { status: 500 });\n    }\n\n    const result = await submitToIngest({ url, token, fetch: event.fetch, payload });\n    if (!result.ok) {\n      console.error(`[forms-ingest] ${payload.formType} → ${result.status}: ${result.error}`);\n      return json({ ok: false, error: failed }, { status: 502 });\n    }\n    return json({ ok: true });\n  };\n}\n"],"mappings":";;;;;;;;;;;AAAA,SAAS,MAAM,gBAAuD;;;ACqD/D,SAAS,oBACd,OACA,gBAC4B;AAC5B,QAAM,OAAuB,CAAC;AAE9B,QAAM,QAAQ,OAAO,mBAAmB,WAAW,eAAe,KAAK,IAAI;AAC3E,MAAI,MAAO,MAAK,iBAAiB;AAEjC,MAAI,OAAO,MAAM,qBAAqB,YAAY;AAChD,QAAI;AACF,YAAM,KAAK,MAAM,iBAAiB;AAClC,UAAI,OAAO,OAAO,YAAY,GAAG,KAAK,EAAG,MAAK,WAAW,GAAG,KAAK;AAAA,IACnE,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,SAAO,OAAO,KAAK,IAAI,EAAE,SAAS,IAAI,OAAO;AAC/C;;;AD1BO,SAAS,mBACd,MACoD;AACpD,QAAM,eAAe,KAAK,gBAAgB;AAC1C,QAAM,cAAc,KAAK,eAAe;AACxC,QAAM,qBAAqB,KAAK,sBAAsB;AACtD,QAAM,MAAM,KAAK,OAAO,KAAK;AAC7B,QAAM,cACJ,KAAK,sBAAsB;AAC7B,QAAM,SACJ,KAAK,gBAAgB;AAEvB,SAAO,OAAO,UAAU;AACtB,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,MAAM,QAAQ,SAAS;AAAA,IACtC,QAAQ;AACN,cAAQ,MAAM,kBAAkB,KAAK,QAAQ,6BAA6B;AAC1E,aAAO,KAAK,KAAK,EAAE,OAAO,OAAO,CAAC;AAAA,IACpC;AAIA,UAAM,SAAS,iBAAiB;AAAA,MAC9B,UAAU,KAAK,IAAI,YAAY,GAAG,SAAS,KAAK;AAAA,MAChD,WAAW,UAAU,KAAK,IAAI,WAAW,GAAG,GAAG;AAAA,IACjD,CAAC;AACD,QAAI,CAAC,OAAO,IAAI;AAGd,YAAM,MAAM,KAAK,UAAU;AAC3B,UAAI,IAAI,OAAO,IAAI,OAAO;AACxB,cAAM,gBAAgB;AAAA,UACpB,KAAK,IAAI;AAAA,UACT,OAAO,IAAI;AAAA,UACX,QAAQ,OAAO;AAAA,UACf,OAAO,MAAM;AAAA,QACf,CAAC;AAAA,MACH;AACA,aAAO,QAAQ;AAAA,IACjB;AAEA,UAAM,EAAE,KAAK,MAAM,IAAI,KAAK,UAAU;AACtC,QAAI,CAAC,OAAO,CAAC,OAAO;AAClB,cAAQ,MAAM,8CAA8C,KAAK,QAAQ,EAAE;AAC3E,aAAO,KAAK,KAAK,EAAE,OAAO,YAAY,CAAC;AAAA,IACzC;AAMA,QAAI;AACJ,QAAI;AACF,gBAAU;AAAA,QACR,GAAG,KAAK,aAAa,MAAM,KAAK;AAAA,QAChC,UAAU,KAAK;AAAA,QACf,OAAO,oBAAoB,OAAO,KAAK,IAAI,kBAAkB,GAAG,SAAS,CAAC;AAAA,MAC5E;AAAA,IACF,SAAS,KAAK;AACZ,cAAQ,MAAM,kBAAkB,KAAK,QAAQ,yBAAyB,OAAO,GAAG,CAAC,EAAE;AACnF,aAAO,KAAK,KAAK,EAAE,OAAO,OAAO,CAAC;AAAA,IACpC;AAEA,UAAM,SAAS,MAAM,eAAe;AAAA,MAClC;AAAA,MACA;AAAA,MACA,OAAO,MAAM;AAAA,MACb;AAAA,IACF,CAAC;AACD,QAAI,CAAC,OAAO,IAAI;AACd,cAAQ,MAAM,kBAAkB,KAAK,QAAQ,WAAM,OAAO,MAAM,KAAK,OAAO,KAAK,EAAE;AACnF,aAAO,KAAK,KAAK,EAAE,OAAO,OAAO,CAAC;AAAA,IACpC;AACA,WAAO,QAAQ;AAAA,EACjB;AAKA,WAAS,UAA6B;AACpC,QAAI,KAAK,WAAY,UAAS,KAAK,KAAK,UAAU;AAClD,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB;AACF;AAKA,SAAS,UAAU,OAAoC,KAAkC;AACvF,QAAM,KAAK,OAAO,KAAK;AACvB,MAAI,CAAC,OAAO,SAAS,EAAE,KAAK,MAAM,EAAG,QAAO;AAK5C,SAAO,KAAK,IAAI,GAAG,IAAI,IAAI,EAAE;AAC/B;;;AE/IA,SAAS,YAA+B;AA4CxC,SAAS,WAAW,GAA2B;AAC7C,SAAO,OAAO,MAAM,YAAa,sBAA4C,SAAS,CAAC;AACzF;AAEA,SAAS,IAAI,GAAgC;AAC3C,SAAO,OAAO,MAAM,WAAW,IAAI;AACrC;AAQO,SAAS,qBACd,MAC4C;AAC5C,QAAM,eAAe,KAAK,gBAAgB;AAC1C,QAAM,qBAAqB,KAAK,sBAAsB;AACtD,QAAM,cACJ,KAAK,sBAAsB;AAC7B,QAAM,SACJ,KAAK,gBAAgB;AAEvB,SAAO,OAAO,UAAU;AACtB,QAAI;AACJ,QAAI;AACF,YAAM,SAAkB,MAAM,MAAM,QAAQ,KAAK;AACjD,UAAI,CAAC,UAAU,OAAO,WAAW,SAAU,OAAM,IAAI,MAAM,uBAAuB;AAClF,aAAO;AAAA,IACT,QAAQ;AACN,cAAQ,MAAM,0CAA0C;AACxD,aAAO,KAAK,EAAE,IAAI,OAAO,OAAO,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3D;AAKA,UAAM,SAAS,iBAAiB,EAAE,UAAU,IAAI,KAAK,YAAY,CAAC,KAAK,KAAK,CAAC;AAC7E,QAAI,CAAC,OAAO,IAAI;AAGd,YAAM,MAAM,KAAK,UAAU;AAC3B,UAAI,IAAI,OAAO,IAAI,OAAO;AACxB,cAAM,gBAAgB;AAAA,UACpB,KAAK,IAAI;AAAA,UACT,OAAO,IAAI;AAAA,UACX,QAAQ,OAAO;AAAA,UACf,OAAO,MAAM;AAAA,QACf,CAAC;AAAA,MACH;AACA,aAAO,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,IAC1B;AAKA,QAAI;AACJ,QAAI;AACF,gBAAU;AAAA,QACR,GAAI,MAAM,KAAK,aAAa,MAAM,KAAK;AAAA,QACvC,GAAI,KAAK,WAAW,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC;AAAA,QACnD,OAAO,oBAAoB,OAAO,IAAI,KAAK,kBAAkB,CAAC,CAAC;AAAA,MACjE;AAAA,IACF,SAAS,KAAK;AACZ,cAAQ,MAAM,sCAAsC,OAAO,GAAG,CAAC,EAAE;AACjE,aAAO,KAAK,EAAE,IAAI,OAAO,OAAO,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3D;AACA,QAAI,CAAC,WAAW,QAAQ,QAAQ,GAAG;AACjC,cAAQ,MAAM,oCAAoC,OAAO,QAAQ,QAAQ,CAAC,EAAE;AAC5E,aAAO,KAAK,EAAE,IAAI,OAAO,OAAO,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3D;AAEA,UAAM,EAAE,KAAK,MAAM,IAAI,KAAK,UAAU;AACtC,QAAI,CAAC,OAAO,CAAC,OAAO;AAClB,cAAQ,MAAM,8CAA8C,QAAQ,QAAQ,EAAE;AAC9E,aAAO,KAAK,EAAE,IAAI,OAAO,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAChE;AAEA,UAAM,SAAS,MAAM,eAAe,EAAE,KAAK,OAAO,OAAO,MAAM,OAAO,QAAQ,CAAC;AAC/E,QAAI,CAAC,OAAO,IAAI;AACd,cAAQ,MAAM,kBAAkB,QAAQ,QAAQ,WAAM,OAAO,MAAM,KAAK,OAAO,KAAK,EAAE;AACtF,aAAO,KAAK,EAAE,IAAI,OAAO,OAAO,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3D;AACA,WAAO,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EAC1B;AACF;","names":[]}
+{"version":3,"sources":["../../src/forms/action.ts","../../src/forms/meta.ts","../../src/forms/endpoint.ts"],"sourcesContent":["import { fail, redirect, type ActionFailure, type RequestEvent } from \"@sveltejs/kit\";\nimport {\n  submitToIngest,\n  screenSubmission,\n  submitScreenOut,\n  type SubmissionPayload,\n} from \"./client.js\";\nimport { buildSubmissionMeta } from \"./meta.js\";\n\n/** Endpoint + token for the dashboard ingest, read per-request from site env. */\nexport type IngestActionConfig = { url?: string; token?: string };\n\nexport type CreateIngestActionOptions = {\n  /** Stamped onto every payload as `formType` (a SUBMISSION_FORM_TYPES value). */\n  formType: string;\n  /** Read at call time so SvelteKit's dynamic private env resolves per-request. */\n  getConfig: () => IngestActionConfig;\n  /**\n   * Map this form's fields to a payload. The factory's `formType` is always\n   * authoritative and cannot be overridden by `buildPayload`.\n   *\n   * May be async, matching `createIngestEndpoint` — a site that resolves\n   * confirmation copy from its CMS does a read here (see\n   * `@reddoorla/maintenance/forms/prismic`). A rejection is handled exactly\n   * like a throw from a sync one: a failure result, never a 500.\n   */\n  buildPayload: (\n    form: FormData,\n    event: RequestEvent,\n  ) => SubmissionPayload | Promise<SubmissionPayload>;\n  /** Honeypot input name. Default \"bot-field\". */\n  botFieldName?: string;\n  /** Hidden timestamp input name (planted in `load`). Default \"ts\". */\n  tsFieldName?: string;\n  /** Field carrying the Cloudflare Turnstile token. Default \"cf-turnstile-response\". */\n  turnstileFieldName?: string;\n  /** fail(500) copy when env vars are unset. */\n  unavailableMessage?: string;\n  /** fail(502) copy when the ingest endpoint rejects/errors. */\n  errorMessage?: string;\n  /** Injectable clock for tests. Default Date.now. */\n  now?: () => number;\n  /** If set, a successful OR bot-screened submission throws redirect(303, redirectTo)\n   *  instead of returning {success:true} (e.g. a dedicated /thank-you page). */\n  redirectTo?: string;\n};\n\nexport type IngestActionData = { success: true } | ActionFailure<{ error: string }>;\n\n/**\n * Build a SvelteKit `default` form action that screens for bots, forwards the\n * submission to the dashboard ingest endpoint, and returns SvelteKit-shaped\n * results. The per-form field mapping is the only thing a site must supply.\n */\nexport function createIngestAction(\n  opts: CreateIngestActionOptions,\n): (event: RequestEvent) => Promise<IngestActionData> {\n  const botFieldName = opts.botFieldName ?? \"bot-field\";\n  const tsFieldName = opts.tsFieldName ?? \"ts\";\n  const turnstileFieldName = opts.turnstileFieldName ?? \"cf-turnstile-response\";\n  const now = opts.now ?? Date.now;\n  const unavailable =\n    opts.unavailableMessage ?? \"This form is temporarily unavailable. Please email us directly.\";\n  const failed =\n    opts.errorMessage ?? \"Something went wrong sending your message. Please try again.\";\n\n  return async (event) => {\n    let form: FormData;\n    try {\n      form = await event.request.formData();\n    } catch {\n      console.error(`[forms-ingest] ${opts.formType}: could not parse form body`);\n      return fail(400, { error: failed });\n    }\n\n    // Bot screen: a filled honeypot OR an implausibly fast fill is silently\n    // accepted (return success, do NOT forward) so bots get no signal.\n    const screen = screenSubmission({\n      botField: form.get(botFieldName)?.toString() ?? null,\n      elapsedMs: elapsedMs(form.get(tsFieldName), now),\n    });\n    if (!screen.ok) {\n      // Best-effort screen-out beacon (no PII) so catch-rate is observable, then\n      // succeed exactly as before — the bot/visitor still sees success.\n      const cfg = opts.getConfig();\n      if (cfg.url && cfg.token) {\n        await submitScreenOut({\n          url: cfg.url,\n          token: cfg.token,\n          reason: screen.reason,\n          fetch: event.fetch,\n        });\n      }\n      return succeed();\n    }\n\n    const { url, token } = opts.getConfig();\n    if (!url || !token) {\n      console.error(`[forms-ingest] config missing for formType=${opts.formType}`);\n      return fail(500, { error: unavailable });\n    }\n\n    // buildPayload runs on untrusted form data; a careless field access (e.g.\n    // `form.get(\"email\")!.toString()` on an absent field) would otherwise escape\n    // as an uncaught 500. Treat a throw as a malformed request (400), mirroring\n    // endpoint.ts's guard and its \"never 500s\" guarantee.\n    let payload: SubmissionPayload;\n    try {\n      payload = {\n        ...(await opts.buildPayload(form, event)),\n        formType: opts.formType,\n        _meta: buildSubmissionMeta(event, form.get(turnstileFieldName)?.toString()),\n      };\n    } catch (err) {\n      console.error(`[forms-ingest] ${opts.formType}: buildPayload threw: ${String(err)}`);\n      return fail(400, { error: failed });\n    }\n\n    const result = await submitToIngest({\n      url,\n      token,\n      fetch: event.fetch,\n      payload,\n    });\n    if (!result.ok) {\n      console.error(`[forms-ingest] ${opts.formType} → ${result.status}: ${result.error}`);\n      return fail(502, { error: failed });\n    }\n    return succeed();\n  };\n\n  // Single success path: redirect when configured (e.g. a dedicated /thank-you\n  // page), otherwise return the SvelteKit-shaped success. `redirect()` throws, so\n  // the trailing `return` keeps the `{ success: true }` type.\n  function succeed(): { success: true } {\n    if (opts.redirectTo) redirect(303, opts.redirectTo);\n    return { success: true };\n  }\n}\n\n// `FormDataEntryValue` is a DOM-lib global; this package compiles with only the\n// ES2022 lib + @types/node, where it is not in scope. Derive the type from the\n// in-scope `FormData.get` return instead — same value, no DOM-lib dependency.\nfunction elapsedMs(tsRaw: ReturnType<FormData[\"get\"]>, now: () => number): number | null {\n  const ts = Number(tsRaw);\n  if (!Number.isFinite(ts) || ts <= 0) return null;\n  // Clamp at 0: elapsed time can't be negative. A future `ts` (clock skew or a bot\n  // forging one) would otherwise yield a negative value; clamping makes it read as\n  // 0ms (effectively instant) so the MIN_FILL_MS gate still trips. Defense-in-depth\n  // with screenSubmission, which also treats any sub-floor elapsed as too-fast.\n  return Math.max(0, now() - ts);\n}\n","/** The reserved wire envelope a fleet site forwards alongside the lead fields.\n *  (Older package versions also sent a `userAgent` — central never consumed it,\n *  so it is no longer forwarded; `readMeta` simply ignores it from old senders.) */\nexport type SubmissionMeta = {\n  turnstileToken?: string;\n  clientIp?: string;\n};\n\nfunction str(v: unknown): string {\n  return typeof v === \"string\" ? v.trim() : \"\";\n}\n\n/**\n * Defensively read the reserved `_meta` envelope off an untrusted ingest payload\n * (CENTRAL side, used by the ingest handler). Keeps only non-blank string fields\n * among the KNOWN keys, dropping everything else — a bot cannot smuggle a\n * non-string clientIp in, and unknown fields (e.g. the `userAgent` older package\n * versions still send) are silently ignored. The token/IP read here are used\n * transiently (Turnstile verify + `remoteip`) and are NEVER persisted; the token\n * is never stored. The SITE-side writer (`buildSubmissionMeta`) is added by the\n * site-factory task; `readMeta` is the single reader (there is no `parseMeta`).\n */\nexport function readMeta(payload: unknown): SubmissionMeta {\n  const meta: SubmissionMeta = {};\n  if (typeof payload !== \"object\" || payload === null) return meta;\n  const raw = (payload as Record<string, unknown>)._meta;\n  if (typeof raw !== \"object\" || raw === null) return meta;\n  const m = raw as Record<string, unknown>;\n  const token = str(m.turnstileToken);\n  if (token) meta.turnstileToken = token;\n  const ip = str(m.clientIp);\n  if (ip) meta.clientIp = ip;\n  return meta;\n}\n\n/**\n * SITE-side event shape `buildSubmissionMeta` reads. Structural (not SvelteKit's\n * `RequestEvent`) so this leaf stays SDK-free; a real `RequestEvent` is\n * structurally assignable (`getClientAddress: () => string`).\n */\ntype MetaEvent = {\n  getClientAddress?: () => string;\n};\n\n/**\n * Build the transient `_meta` envelope a site forwards to central ingest:\n * `{ turnstileToken?, clientIp? }`. Returns `undefined` when no field yields a\n * value so callers can attach it unconditionally without polluting the payload\n * (an `undefined` value is dropped by `JSON.stringify`). `getClientAddress` is\n * guarded (some adapters lack a client address and can throw). The visitor's\n * user-agent is deliberately NOT forwarded — central never consumed it, so\n * shipping it was pure transient-PII surface. None of this is ever persisted.\n */\nexport function buildSubmissionMeta(\n  event: MetaEvent,\n  turnstileToken: string | null | undefined,\n): SubmissionMeta | undefined {\n  const meta: SubmissionMeta = {};\n\n  const token = typeof turnstileToken === \"string\" ? turnstileToken.trim() : \"\";\n  if (token) meta.turnstileToken = token;\n\n  if (typeof event.getClientAddress === \"function\") {\n    try {\n      const ip = event.getClientAddress();\n      if (typeof ip === \"string\" && ip.trim()) meta.clientIp = ip.trim();\n    } catch {\n      // Some adapters have no client address and throw; drop clientIp silently.\n    }\n  }\n\n  return Object.keys(meta).length > 0 ? meta : undefined;\n}\n","import { json, type RequestEvent } from \"@sveltejs/kit\";\nimport {\n  submitToIngest,\n  screenSubmission,\n  submitScreenOut,\n  type SubmissionPayload,\n} from \"./client.js\";\nimport { SUBMISSION_FORM_TYPES, type FormType } from \"./types.js\";\nimport type { IngestActionConfig } from \"./action.js\";\nimport { buildSubmissionMeta } from \"./meta.js\";\n\n/**\n * Options for {@link createIngestEndpoint} — the JSON sibling of\n * `createIngestAction` for client-driven forms (modals / lightboxes / fetch)\n * that POST JSON to a `+server.ts` route instead of using a form action.\n */\nexport type CreateIngestEndpointOptions = {\n  /** Read at call time so SvelteKit's dynamic private env resolves per-request. */\n  getConfig: () => IngestActionConfig;\n  /**\n   * Map the parsed JSON body to a payload. Must set `formType` UNLESS the fixed\n   * `formType` option is provided (then that is authoritative and overrides it).\n   *\n   * May be async. A site that resolves confirmation copy from its own CMS does a\n   * read here — see `@reddoorla/maintenance/forms/prismic`. A rejection is\n   * handled exactly like a throw from a sync one: a 400, never a 500.\n   */\n  buildPayload: (\n    body: Record<string, unknown>,\n    event: RequestEvent,\n  ) => SubmissionPayload | Promise<SubmissionPayload>;\n  /** Fixed formType for single-type endpoints; omit for multi-type endpoints\n   *  where `buildPayload` derives formType from the body. */\n  formType?: string;\n  /** Honeypot field name in the JSON body. Default \"bot-field\". */\n  botFieldName?: string;\n  /** Field carrying the Cloudflare Turnstile token. Default \"cf-turnstile-response\". */\n  turnstileFieldName?: string;\n  /** json(500) copy when env vars are unset. */\n  unavailableMessage?: string;\n  /** json(400/502) copy for bad input / ingest failure. */\n  errorMessage?: string;\n};\n\nfunction isFormType(v: unknown): v is FormType {\n  return typeof v === \"string\" && (SUBMISSION_FORM_TYPES as readonly string[]).includes(v);\n}\n\nfunction str(v: unknown): string | undefined {\n  return typeof v === \"string\" ? v : undefined;\n}\n\n/**\n * Build a JSON `POST` handler that screens for bots, forwards the submission to\n * the dashboard ingest endpoint, and returns `{ ok }`-shaped JSON. The per-form\n * field mapping (`buildPayload`) is the only thing a site must supply. The\n * returned function is structurally a SvelteKit `RequestHandler`.\n */\nexport function createIngestEndpoint(\n  opts: CreateIngestEndpointOptions,\n): (event: RequestEvent) => Promise<Response> {\n  const botFieldName = opts.botFieldName ?? \"bot-field\";\n  const turnstileFieldName = opts.turnstileFieldName ?? \"cf-turnstile-response\";\n  const unavailable =\n    opts.unavailableMessage ?? \"This form is temporarily unavailable. Please email us directly.\";\n  const failed =\n    opts.errorMessage ?? \"Something went wrong sending your message. Please try again.\";\n\n  return async (event) => {\n    let body: Record<string, unknown>;\n    try {\n      const parsed: unknown = await event.request.json();\n      if (!parsed || typeof parsed !== \"object\") throw new Error(\"body is not an object\");\n      body = parsed as Record<string, unknown>;\n    } catch {\n      console.error(\"[forms-ingest] could not parse JSON body\");\n      return json({ ok: false, error: failed }, { status: 400 });\n    }\n\n    // Bot screen: honeypot only. A client POST carries no server-planted ts, and\n    // screenSubmission treats a missing elapsedMs as OK. A filled honeypot is\n    // silently accepted (return ok, do NOT forward) so bots get no signal.\n    const screen = screenSubmission({ botField: str(body[botFieldName]) ?? null });\n    if (!screen.ok) {\n      // Best-effort screen-out beacon (no PII) so catch-rate is observable, then\n      // return success exactly as before — the bot/visitor still sees success.\n      const cfg = opts.getConfig();\n      if (cfg.url && cfg.token) {\n        await submitScreenOut({\n          url: cfg.url,\n          token: cfg.token,\n          reason: screen.reason,\n          fetch: event.fetch,\n        });\n      }\n      return json({ ok: true });\n    }\n\n    // buildPayload runs on untrusted JSON; a careless field access (e.g.\n    // `body.name.trim()` on a non-string) would otherwise escape as a 500. Treat\n    // a throw as a malformed request (400), keeping the \"never 500s\" guarantee.\n    let payload: SubmissionPayload;\n    try {\n      payload = {\n        ...(await opts.buildPayload(body, event)),\n        ...(opts.formType ? { formType: opts.formType } : {}),\n        _meta: buildSubmissionMeta(event, str(body[turnstileFieldName])),\n      };\n    } catch (err) {\n      console.error(`[forms-ingest] buildPayload threw: ${String(err)}`);\n      return json({ ok: false, error: failed }, { status: 400 });\n    }\n    if (!isFormType(payload.formType)) {\n      console.error(`[forms-ingest] invalid formType: ${String(payload.formType)}`);\n      return json({ ok: false, error: failed }, { status: 400 });\n    }\n\n    const { url, token } = opts.getConfig();\n    if (!url || !token) {\n      console.error(`[forms-ingest] config missing for formType=${payload.formType}`);\n      return json({ ok: false, error: unavailable }, { status: 500 });\n    }\n\n    const result = await submitToIngest({ url, token, fetch: event.fetch, payload });\n    if (!result.ok) {\n      console.error(`[forms-ingest] ${payload.formType} → ${result.status}: ${result.error}`);\n      return json({ ok: false, error: failed }, { status: 502 });\n    }\n    return json({ ok: true });\n  };\n}\n"],"mappings":";;;;;;;;;;;AAAA,SAAS,MAAM,gBAAuD;;;ACqD/D,SAAS,oBACd,OACA,gBAC4B;AAC5B,QAAM,OAAuB,CAAC;AAE9B,QAAM,QAAQ,OAAO,mBAAmB,WAAW,eAAe,KAAK,IAAI;AAC3E,MAAI,MAAO,MAAK,iBAAiB;AAEjC,MAAI,OAAO,MAAM,qBAAqB,YAAY;AAChD,QAAI;AACF,YAAM,KAAK,MAAM,iBAAiB;AAClC,UAAI,OAAO,OAAO,YAAY,GAAG,KAAK,EAAG,MAAK,WAAW,GAAG,KAAK;AAAA,IACnE,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,SAAO,OAAO,KAAK,IAAI,EAAE,SAAS,IAAI,OAAO;AAC/C;;;ADlBO,SAAS,mBACd,MACoD;AACpD,QAAM,eAAe,KAAK,gBAAgB;AAC1C,QAAM,cAAc,KAAK,eAAe;AACxC,QAAM,qBAAqB,KAAK,sBAAsB;AACtD,QAAM,MAAM,KAAK,OAAO,KAAK;AAC7B,QAAM,cACJ,KAAK,sBAAsB;AAC7B,QAAM,SACJ,KAAK,gBAAgB;AAEvB,SAAO,OAAO,UAAU;AACtB,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,MAAM,QAAQ,SAAS;AAAA,IACtC,QAAQ;AACN,cAAQ,MAAM,kBAAkB,KAAK,QAAQ,6BAA6B;AAC1E,aAAO,KAAK,KAAK,EAAE,OAAO,OAAO,CAAC;AAAA,IACpC;AAIA,UAAM,SAAS,iBAAiB;AAAA,MAC9B,UAAU,KAAK,IAAI,YAAY,GAAG,SAAS,KAAK;AAAA,MAChD,WAAW,UAAU,KAAK,IAAI,WAAW,GAAG,GAAG;AAAA,IACjD,CAAC;AACD,QAAI,CAAC,OAAO,IAAI;AAGd,YAAM,MAAM,KAAK,UAAU;AAC3B,UAAI,IAAI,OAAO,IAAI,OAAO;AACxB,cAAM,gBAAgB;AAAA,UACpB,KAAK,IAAI;AAAA,UACT,OAAO,IAAI;AAAA,UACX,QAAQ,OAAO;AAAA,UACf,OAAO,MAAM;AAAA,QACf,CAAC;AAAA,MACH;AACA,aAAO,QAAQ;AAAA,IACjB;AAEA,UAAM,EAAE,KAAK,MAAM,IAAI,KAAK,UAAU;AACtC,QAAI,CAAC,OAAO,CAAC,OAAO;AAClB,cAAQ,MAAM,8CAA8C,KAAK,QAAQ,EAAE;AAC3E,aAAO,KAAK,KAAK,EAAE,OAAO,YAAY,CAAC;AAAA,IACzC;AAMA,QAAI;AACJ,QAAI;AACF,gBAAU;AAAA,QACR,GAAI,MAAM,KAAK,aAAa,MAAM,KAAK;AAAA,QACvC,UAAU,KAAK;AAAA,QACf,OAAO,oBAAoB,OAAO,KAAK,IAAI,kBAAkB,GAAG,SAAS,CAAC;AAAA,MAC5E;AAAA,IACF,SAAS,KAAK;AACZ,cAAQ,MAAM,kBAAkB,KAAK,QAAQ,yBAAyB,OAAO,GAAG,CAAC,EAAE;AACnF,aAAO,KAAK,KAAK,EAAE,OAAO,OAAO,CAAC;AAAA,IACpC;AAEA,UAAM,SAAS,MAAM,eAAe;AAAA,MAClC;AAAA,MACA;AAAA,MACA,OAAO,MAAM;AAAA,MACb;AAAA,IACF,CAAC;AACD,QAAI,CAAC,OAAO,IAAI;AACd,cAAQ,MAAM,kBAAkB,KAAK,QAAQ,WAAM,OAAO,MAAM,KAAK,OAAO,KAAK,EAAE;AACnF,aAAO,KAAK,KAAK,EAAE,OAAO,OAAO,CAAC;AAAA,IACpC;AACA,WAAO,QAAQ;AAAA,EACjB;AAKA,WAAS,UAA6B;AACpC,QAAI,KAAK,WAAY,UAAS,KAAK,KAAK,UAAU;AAClD,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB;AACF;AAKA,SAAS,UAAU,OAAoC,KAAkC;AACvF,QAAM,KAAK,OAAO,KAAK;AACvB,MAAI,CAAC,OAAO,SAAS,EAAE,KAAK,MAAM,EAAG,QAAO;AAK5C,SAAO,KAAK,IAAI,GAAG,IAAI,IAAI,EAAE;AAC/B;;;AEvJA,SAAS,YAA+B;AA4CxC,SAAS,WAAW,GAA2B;AAC7C,SAAO,OAAO,MAAM,YAAa,sBAA4C,SAAS,CAAC;AACzF;AAEA,SAAS,IAAI,GAAgC;AAC3C,SAAO,OAAO,MAAM,WAAW,IAAI;AACrC;AAQO,SAAS,qBACd,MAC4C;AAC5C,QAAM,eAAe,KAAK,gBAAgB;AAC1C,QAAM,qBAAqB,KAAK,sBAAsB;AACtD,QAAM,cACJ,KAAK,sBAAsB;AAC7B,QAAM,SACJ,KAAK,gBAAgB;AAEvB,SAAO,OAAO,UAAU;AACtB,QAAI;AACJ,QAAI;AACF,YAAM,SAAkB,MAAM,MAAM,QAAQ,KAAK;AACjD,UAAI,CAAC,UAAU,OAAO,WAAW,SAAU,OAAM,IAAI,MAAM,uBAAuB;AAClF,aAAO;AAAA,IACT,QAAQ;AACN,cAAQ,MAAM,0CAA0C;AACxD,aAAO,KAAK,EAAE,IAAI,OAAO,OAAO,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3D;AAKA,UAAM,SAAS,iBAAiB,EAAE,UAAU,IAAI,KAAK,YAAY,CAAC,KAAK,KAAK,CAAC;AAC7E,QAAI,CAAC,OAAO,IAAI;AAGd,YAAM,MAAM,KAAK,UAAU;AAC3B,UAAI,IAAI,OAAO,IAAI,OAAO;AACxB,cAAM,gBAAgB;AAAA,UACpB,KAAK,IAAI;AAAA,UACT,OAAO,IAAI;AAAA,UACX,QAAQ,OAAO;AAAA,UACf,OAAO,MAAM;AAAA,QACf,CAAC;AAAA,MACH;AACA,aAAO,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,IAC1B;AAKA,QAAI;AACJ,QAAI;AACF,gBAAU;AAAA,QACR,GAAI,MAAM,KAAK,aAAa,MAAM,KAAK;AAAA,QACvC,GAAI,KAAK,WAAW,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC;AAAA,QACnD,OAAO,oBAAoB,OAAO,IAAI,KAAK,kBAAkB,CAAC,CAAC;AAAA,MACjE;AAAA,IACF,SAAS,KAAK;AACZ,cAAQ,MAAM,sCAAsC,OAAO,GAAG,CAAC,EAAE;AACjE,aAAO,KAAK,EAAE,IAAI,OAAO,OAAO,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3D;AACA,QAAI,CAAC,WAAW,QAAQ,QAAQ,GAAG;AACjC,cAAQ,MAAM,oCAAoC,OAAO,QAAQ,QAAQ,CAAC,EAAE;AAC5E,aAAO,KAAK,EAAE,IAAI,OAAO,OAAO,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3D;AAEA,UAAM,EAAE,KAAK,MAAM,IAAI,KAAK,UAAU;AACtC,QAAI,CAAC,OAAO,CAAC,OAAO;AAClB,cAAQ,MAAM,8CAA8C,QAAQ,QAAQ,EAAE;AAC9E,aAAO,KAAK,EAAE,IAAI,OAAO,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAChE;AAEA,UAAM,SAAS,MAAM,eAAe,EAAE,KAAK,OAAO,OAAO,MAAM,OAAO,QAAQ,CAAC;AAC/E,QAAI,CAAC,OAAO,IAAI;AACd,cAAQ,MAAM,kBAAkB,QAAQ,QAAQ,WAAM,OAAO,MAAM,KAAK,OAAO,KAAK,EAAE;AACtF,aAAO,KAAK,EAAE,IAAI,OAAO,OAAO,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3D;AACA,WAAO,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EAC1B;AACF;","names":[]}

package/dist/{forms-notify-target-RMZPKT6S.js → forms-notify-target-2LWF5C5B.js}

@@ -16,7 +16,7 @@ import {
   siteSlug,
   toAirtableStatus,
   updateSiteField
-} from "./chunk-7NYN2P6I.js";
+} from "./chunk-3Z6X3BHU.js";
 import "./chunk-2OP4JKIQ.js";
 import "./chunk-6VAL7XJT.js";
 
@@ -144,7 +144,7 @@ async function runFormsNotifyTargetCommand(site, opts) {
     return { output: `--set must be 'on' or 'off' (got '${opts.set}')`, code: 2 };
   }
   try {
-    const { makeSiteMirror } = await import("./site-mirror-3E7JYTJG.js");
+    const { makeSiteMirror } = await import("./site-mirror-UKHREAD6.js");
     const result = await formsNotifyTarget({
       siteMirror: await makeSiteMirror(),
       site: site.trim(),
@@ -164,4 +164,4 @@ export {
   formatNotifyTarget,
   runFormsNotifyTargetCommand
 };
-//# sourceMappingURL=forms-notify-target-RMZPKT6S.js.map
+//# sourceMappingURL=forms-notify-target-2LWF5C5B.js.map

package/dist/{github-signals-3WLIJ5RR.js → github-signals-GAHNOAHS.js}

@@ -3,8 +3,8 @@ import {
 } from "./chunk-PZQ3WED2.js";
 import {
   formatFleetWriteSummary
-} from "./chunk-QLIUDTY6.js";
-import "./chunk-7BZUOZPU.js";
+} from "./chunk-5EEMTJMT.js";
+import "./chunk-XN37VTDB.js";
 import "./chunk-SVAAONYB.js";
 import {
   detectSignalEvents,
@@ -18,7 +18,7 @@ import {
   listWebsites,
   siteSlug,
   updateGitHubSignals
-} from "./chunk-7NYN2P6I.js";
+} from "./chunk-3Z6X3BHU.js";
 import {
   makeGitHub
 } from "./chunk-XHHMM5HX.js";
@@ -91,7 +91,7 @@ async function runGitHubSignalsCommand(opts, deps = {}) {
   );
   const sweptAt = (/* @__PURE__ */ new Date()).toISOString();
   const makeMirror = deps.makeMirror ?? (async () => {
-    const { makeHealthMirrorBestEffort } = await import("./health-mirror-55RRU6BI.js");
+    const { makeHealthMirrorBestEffort } = await import("./health-mirror-EB76EERV.js");
     return makeHealthMirrorBestEffort();
   });
   const mirror = await makeMirror();
@@ -156,4 +156,4 @@ export {
   githubSignalsExitCode,
   runGitHubSignalsCommand
 };
-//# sourceMappingURL=github-signals-3WLIJ5RR.js.map
+//# sourceMappingURL=github-signals-GAHNOAHS.js.map

package/dist/{header-image-DOCDFFRO.js → header-image-YN3AQRY3.js}

@@ -12,7 +12,7 @@ import {
   ACTIVE_STATUSES,
   listWebsites,
   siteSlug
-} from "./chunk-7NYN2P6I.js";
+} from "./chunk-3Z6X3BHU.js";
 import "./chunk-6VAL7XJT.js";
 
 // src/cli/commands/header-image.ts
@@ -115,4 +115,4 @@ export {
   resolveTargets,
   runHeaderImageCommand
 };
-//# sourceMappingURL=header-image-DOCDFFRO.js.map
+//# sourceMappingURL=header-image-YN3AQRY3.js.map

package/dist/{health-endpoint-DHKJUPRM.js → health-endpoint-XLNBWVHK.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-TCF6S7AD.js";
 import {
   resolveSites
-} from "./chunk-Q47DU255.js";
+} from "./chunk-Z2K4JPQ3.js";
 import {
   healthEndpoint
 } from "./chunk-4R3YAQNV.js";
@@ -51,4 +51,4 @@ async function runHealthEndpointCommand(site, opts) {
 export {
   runHealthEndpointCommand
 };
-//# sourceMappingURL=health-endpoint-DHKJUPRM.js.map
+//# sourceMappingURL=health-endpoint-XLNBWVHK.js.map

package/dist/{health-mirror-55RRU6BI.js → health-mirror-EB76EERV.js}

@@ -1,14 +1,14 @@
 import {
   mirrorHealthFields,
   mirrorScheduleFields
-} from "./chunk-QBAAZY7W.js";
-import "./chunk-P6AORG32.js";
+} from "./chunk-WVNDEYXL.js";
+import "./chunk-6R56OKJZ.js";
 import {
   TURSO_IS_AUTHORITATIVE
 } from "./chunk-SVAAONYB.js";
 import "./chunk-F3JWOPTG.js";
 import "./chunk-VAD43MOR.js";
-import "./chunk-7NYN2P6I.js";
+import "./chunk-3Z6X3BHU.js";
 import {
   openDb,
   readDbConfig
@@ -43,4 +43,4 @@ export {
   makeHealthMirrorBestEffort,
   makeScheduleMirrorBestEffort
 };
-//# sourceMappingURL=health-mirror-55RRU6BI.js.map
+//# sourceMappingURL=health-mirror-EB76EERV.js.map

package/dist/{import-airtable-OHVY344G.js → import-airtable-TAKSN4NV.js}

@@ -14,9 +14,9 @@ import {
   renderedHtmlUrl,
   scheduleColumnFor,
   siteValueFor
-} from "./chunk-P6AORG32.js";
+} from "./chunk-6R56OKJZ.js";
 import "./chunk-VAD43MOR.js";
-import "./chunk-7NYN2P6I.js";
+import "./chunk-3Z6X3BHU.js";
 export {
   EXCLUDED_WEBSITE_FIELDS,
   HEALTH_BOOLEAN,
@@ -34,4 +34,4 @@ export {
   scheduleColumnFor,
   siteValueFor
 };
-//# sourceMappingURL=import-airtable-OHVY344G.js.map
+//# sourceMappingURL=import-airtable-TAKSN4NV.js.map

package/dist/index.d.ts

@@ -116,6 +116,7 @@ type VerifyDeps = {
  *  which never manufactures a verdict. */
 type FormSubmitOutcome = {
     formPresent: false;
+    formsHealth?: FormsHealth;
 } | {
     formPresent: true;
     success: boolean;
@@ -136,9 +137,70 @@ type FormSubmitOutcome = {
      *  re-filled once before the click. On a pass this is production proof the
      *  wipe happens; on a failure it says one refill wasn't enough. */
     refilled?: boolean;
+    /** What the site's REAL Turnstile widget did while the probe was on the
+     *  page. The probe does NOT swap the sitekey — `testSitekey` only names the
+     *  fake token VALUE it injects — so the real widget renders with the real
+     *  `PUBLIC_TURNSTILE_SITE_KEY` on every run, and this records what it did.
+     *  Undefined = not observed (an older runner, or the page never loaded). */
+    turnstile?: TurnstileObservation;
+    /** The `forms` block the preflight already read. Carried out rather than
+     *  re-fetched so the verdict cannot disagree with the gate that admitted
+     *  the probe. Undefined = an older runner that did not report it. */
+    formsHealth?: FormsHealth;
 } | {
     testModeUndeclared: true;
 };
+/**
+ * What a browser saw the site's own Turnstile widget do. Only two of Cloudflare's
+ * failure modes are BROWSER-INDEPENDENT, and the distinction is the whole point:
+ *
+ * - `110200` is a domain-binding rejection, emitted before any challenge is
+ *   attempted. It means this hostname is not on the widget's allowlist, the widget
+ *   mints NO token, and on a `Require Turnstile` site every real lead is bucketed
+ *   as spam. It fires identically for a human and for automation, so a probe can
+ *   assert on it.
+ * - `600010` is a challenge failure, and Cloudflare returns it to ANY driven
+ *   browser whatever the configuration — measured 2026-09-04 against the
+ *   known-good reddoorla.com canary and against Playwright headed and headless,
+ *   while the same page in an ordinary Chrome window minted a token siteverify
+ *   accepted. It carries NO information about the site and must never be a verdict.
+ *
+ * A "pass" therefore needs POSITIVE evidence — the mount point AND Cloudflare's
+ * script — never merely the absence of an error string. The SSR'd container alone
+ * proves only that the env var is set.
+ */
+type TurnstileObservation = {
+    /** A `.cf-turnstile` mount point was in the DOM on the route the probe settled
+     *  on. NOT sufficient on its own: the starter server-renders that div from
+     *  `{#if turnstileSiteKey}`, so it is present whenever the env var is set —
+     *  including when the widget never initialises. Pairing it with `scriptLoaded`
+     *  is what makes "pass" positive evidence rather than the absence of a string. */
+    containerPresent: boolean;
+    /** Cloudflare's `api.js` was actually fetched and answered 2xx. Without it
+     *  `window.turnstile` never exists, no widget is created and no token is ever
+     *  minted — while the SSR'd container sits there looking healthy. */
+    scriptLoaded: boolean;
+    /** An uncaught (or logged) `110200` — this hostname is not on the widget. */
+    hostnameRejected: boolean;
+    /** The page reported the widget could not render. The starter catches a
+     *  `loadTurnstile()` rejection and logs `[turnstile] widget did not render` at
+     *  console.WARN — not error — so this is deliberately matched across every
+     *  console level, not just errors. */
+    initFailed: boolean;
+    /** Cloudflare raised some OTHER error against the widget — an invalid, deleted,
+     *  rotated or disabled sitekey (110100, 110110, 400020, 400070), or another
+     *  `110xxx`. Its whole job is to deny the green: without it, a widget deleted at
+     *  Cloudflare scores "pass", because api.js still answers 2xx (its URL carries no
+     *  sitekey), the mount point is still server-rendered, and the pass arm's negative
+     *  half was the absence of one six-digit string.
+     *
+     *  Never a fail. This fleet has MEASURED only 110200 and 600010 verbatim, and an
+     *  unmeasured code does not get the authority to raise a red on a gated site — it
+     *  lands as `null`, "looked, cannot tell", which the cockpit already renders as
+     *  the amber `turnstile-unverified` watch. That asymmetry is what makes it safe to
+     *  match a family by prefix rather than a list by measurement. */
+    widgetError: boolean;
+};
 /** Injected browser IO. The real impl drives Playwright; tests pass a fake. */
 type FormRunner = {
     submit: (opts: {
@@ -148,6 +210,17 @@ type FormRunner = {
     }) => Promise<FormSubmitOutcome>;
     close?: () => Promise<void>;
 };
+/**
+ * The site's `/health` `forms` block, read once in the preflight. `testMode` gates
+ * whether the probe may submit at all; `turnstile` is `!!PUBLIC_TURNSTILE_SITE_KEY`
+ * on the deployed site — it says a sitekey is CONFIGURED and nothing more, since
+ * /health never contacts Cloudflare. Null = absent or malformed (an older site
+ * package whose /health has no such key).
+ */
+type FormsHealth = {
+    testMode: boolean;
+    turnstile: boolean | null;
+};
 
 /** Result of probing a site's latest PRODUCTION Netlify deploy. Every field is
  *  nullable: a site with no production deploy yet degrades to all-nulls (a real
@@ -649,12 +722,20 @@ type WebsiteRow = {
      *  "ok"`. Single-select `pass`/`fail`; null = never ran. No per-site Prismic token or identity
      *  column is ever built — this rides `/health`. */
     cmsReachable: "pass" | "fail" | null;
-    /** From the same `/health` body's `forms.turnstile` boolean: does the deployed site report
-     *  the Turnstile widget configured (`PUBLIC_TURNSTILE_SITE_KEY` set)? Single-select
-     *  `pass`/`fail`; null = never ran / older site package whose `/health` has no `forms`
-     *  block. Freshness gated by `functionHealthCheckedAt`. Powers the cockpit Require-Turnstile
-     *  guardrail: a site with `requireTurnstile` ON but no widget silently buckets 100% of its
-     *  real leads (and form-e2e can't see it — testMode bypasses the gate). */
+    /** Does the deployed site's Turnstile widget actually work? Single-select `pass`/`fail`;
+     *  null = **unverified**, which is the normal state — see below. Freshness gated by
+     *  `formE2eCheckedAt`, the clock of the audit that writes it. Powers the cockpit Require-Turnstile guardrail: a site with
+     *  `requireTurnstile` ON but no working widget silently buckets 100% of its real leads.
+     *
+     *  One of the two `"fail"` arms is derived from `/health` (the other is a browser seeing
+     *  110200 on the live hostname), whose `forms.turnstile` is a truthiness check
+     *  on `PUBLIC_TURNSTILE_SITE_KEY` that never contacts Cloudflare (see
+     *  audits/function-health-airtable.ts for the incident). No key IS proof the widget can't
+     *  work; a key is NOT proof that it can — a sitekey whose widget is full at Cloudflare's
+     *  10-hostname cap sets the var and still mints no token. So a `"pass"` here has to be
+     *  earned by a real browser rendering the real widget (form-e2e), and until it is, null
+     *  keeps the site in the cockpit's amber "can't verify" watch rather than claiming health
+     *  nobody measured. */
     turnstileWidget: "pass" | "fail" | null;
     /** When the `function-health` audit last ran — the freshness gate for `functionHealth`,
      *  `cmsReachable`, and `turnstileWidget`. Null = never ran. */

package/dist/index.js

@@ -3,10 +3,10 @@ import {
   DEFAULT_INIT_STEPS,
   a11yFixturesPage,
   init
-} from "./chunk-4NUKMPOO.js";
+} from "./chunk-5FCBYK6L.js";
 import {
   draftReportForSite
-} from "./chunk-ZRI5VRPG.js";
+} from "./chunk-BYGPUUCT.js";
 import "./chunk-YFAXOD7Z.js";
 import {
   upgradeSvelte4to5
@@ -19,7 +19,7 @@ import {
 } from "./chunk-LS6QPANO.js";
 import "./chunk-J7SZQUCW.js";
 import "./chunk-4R3YAQNV.js";
-import "./chunk-CVJF2IC5.js";
+import "./chunk-TGUESYGF.js";
 import "./chunk-R53VL3RI.js";
 import {
   onboard,
@@ -29,10 +29,10 @@ import {
 import {
   bumpDeps
 } from "./chunk-PPIZHDJL.js";
-import "./chunk-MVDMKKBN.js";
+import "./chunk-4AIYWWKV.js";
 import {
   approveBlockers
-} from "./chunk-E22WAIF2.js";
+} from "./chunk-AEUABPAJ.js";
 import {
   findDueReports
 } from "./chunk-PZR4EBPY.js";
@@ -40,7 +40,7 @@ import {
   parseAddresses,
   sendApprovedReports,
   withGlobalCc
-} from "./chunk-FCS36FDT.js";
+} from "./chunk-KQB2BX4V.js";
 import {
   isPendingApproval
 } from "./chunk-F3JWOPTG.js";
@@ -53,10 +53,10 @@ import "./chunk-BRYXFH77.js";
 import "./chunk-7MKT4I5T.js";
 import {
   fromAirtableBase
-} from "./chunk-PR343K7F.js";
+} from "./chunk-5GUJ36TL.js";
 import "./chunk-IY6256GK.js";
 import "./chunk-HN6I2XWI.js";
-import "./chunk-SKI23ZZH.js";
+import "./chunk-HTABUCF4.js";
 import "./chunk-GECESMVS.js";
 import {
   BLURRED_CID,
@@ -80,7 +80,7 @@ import {
   SEVERITY_RANK,
   siteSlug,
   toAirtableStatus
-} from "./chunk-7NYN2P6I.js";
+} from "./chunk-3Z6X3BHU.js";
 import "./chunk-WEKL2HYJ.js";
 import "./chunk-T7ZUUOZ2.js";
 import {
@@ -97,7 +97,7 @@ import {
   runAudits,
   runAuditsAcross,
   securityAudit
-} from "./chunk-JB4Q3C3M.js";
+} from "./chunk-TO7DJYLZ.js";
 import "./chunk-LKGVSM2O.js";
 import "./chunk-GASBX52O.js";
 import "./chunk-XHHMM5HX.js";
@@ -114,11 +114,11 @@ import {
 import "./chunk-UDRHAQT7.js";
 import "./chunk-PTDMVGKL.js";
 import "./chunk-LBYOLBW7.js";
-import "./chunk-RARREDQE.js";
 import "./chunk-A3WDWNN5.js";
 import {
   isLeadFormType
 } from "./chunk-2OP4JKIQ.js";
+import "./chunk-RARREDQE.js";
 import "./chunk-XXTZBPUY.js";
 import "./chunk-XTK5VIQB.js";
 import "./chunk-6VAL7XJT.js";
@@ -667,6 +667,9 @@ function siteDetailsSection(site) {
     selectRow("Status", "status", SITE_STATUS_OPTIONS, site.statusRaw, url),
     selectRow("Maintenance cadence", "maintenanceFreq", FREQ_OPTIONS, site.maintenanceFreq, url),
     selectRow("Testing cadence", "testingFreq", FREQ_OPTIONS, site.testingFreq, url),
+    // First, because it is the site's own address and the target every deployed
+    // audit drives. `site.url` is the row's value; `url` is this page's endpoint.
+    inputRow("Site URL", "url", site.url, url),
     inputRow("Report recipients (To)", "reportRecipientsTo", site.reportRecipientsTo, url),
     inputRow("Report recipients (CC)", "reportRecipientsCc", site.reportRecipientsCc, url),
     inputRow("Point of contact", "pointOfContact", site.pointOfContact, url),