@reddoorla/maintenance 0.95.1 → 0.96.0

package/dist/{chunk-QF6IQQFP.js → chunk-Z7FDJ35L.js}

@@ -84,24 +84,30 @@ async function ingestSubmission(deps, slug, rawPayload, turnstileInput = "unveri
   if (!normalized.ok) {
     return { status: "rejected", reason: "invalid-payload", errors: normalized.errors };
   }
-  let site;
-  try {
-    site = await deps.getWebsiteBySlug(slug);
-  } catch (err) {
-    if (!deps.deadLetter || isTestMode(rawPayload)) throw err;
+  const captureDeadLetter = async (error) => {
+    if (!deps.deadLetter || isTestMode(rawPayload)) return null;
     const dl = await deps.deadLetter({
       siteSlug: slug,
       payload: rawPayload,
       turnstile: verification,
-      error: String(err),
+      error,
       receivedAt: deps.now()
     });
-    console.error(
-      `[ingest] site lookup failed for '${slug}' \u2014 lead dead-lettered as ${dl.id}: ${String(err)}`
-    );
-    return { status: "accepted", submissionId: dl.id, notifyStatus: "skipped" };
+    console.error(`[ingest] lead for '${slug}' dead-lettered as ${dl.id}: ${error}`);
+    return dl.id;
+  };
+  let site;
+  try {
+    site = await deps.getWebsiteBySlug(slug);
+  } catch (err) {
+    const id = await captureDeadLetter(String(err));
+    if (id === null) throw err;
+    return { status: "accepted", submissionId: id, notifyStatus: "skipped" };
+  }
+  if (!site) {
+    const id = await captureDeadLetter(`unknown-site: no fleet row for '${slug}'`);
+    return id === null ? { status: "unknown-site", slug } : { status: "unknown-site", slug, deadLetterId: id };
   }
-  if (!site) return { status: "unknown-site", slug };
   if (isTestMode(rawPayload)) {
     return { status: "accepted", submissionId: "test-mode", notifyStatus: "skipped" };
   }
@@ -287,4 +293,4 @@ export {
   ingestSubmission,
   hostsMatch
 };
-//# sourceMappingURL=chunk-QF6IQQFP.js.map
+//# sourceMappingURL=chunk-Z7FDJ35L.js.map

package/dist/chunk-Z7FDJ35L.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/forms/payload.ts","../src/forms/ingest.ts"],"sourcesContent":["import { SUBMISSION_FORM_TYPES, type FormType } from \"./types.js\";\nimport type { SubmissionMeta } from \"./meta.js\";\nimport { parseReplyCopy, type ReplyCopy } from \"./reply-copy.js\";\n\n/** The JSON wire format a fleet site forwards to the ingest endpoint.\n *\n *  Underscore-prefixed keys are RESERVED for transport concerns and are never\n *  lead data: `_meta` (below) and `_screenOut` (the bot screen-out beacon —\n *  a `{ _screenOut: \"honeypot\" | \"too-fast\" }` body is a counter ping, not a\n *  submission; see ingest.ts `parseScreenOut`). Site field names must not\n *  start with `_`. */\nexport type SubmissionPayload = {\n  formType?: string;\n  name?: string;\n  firstName?: string;\n  lastName?: string;\n  email?: string;\n  phone?: string;\n  message?: string;\n  sourceUrl?: string;\n  utm?: string;\n  /** Any additional, site-specific fields. */\n  extra?: Record<string, unknown>;\n  /** Reserved transport envelope (token/IP/UA); stripped by normalizeSubmission, never persisted. */\n  _meta?: SubmissionMeta;\n  /** Reserved: confirmation-email copy the SITE resolved from its own CMS.\n   *  Validated by parseReplyCopy, then stored under the same key in extraFields\n   *  so a replayed submission sends the same email it would have sent live. */\n  _reply?: ReplyCopy;\n};\n\nexport type NormalizedSubmission = {\n  formType: FormType;\n  name: string;\n  email: string;\n  phone?: string;\n  message?: string;\n  sourceUrl?: string;\n  utm?: string;\n  extraFields: Record<string, unknown>;\n};\n\nexport type NormalizeResult =\n  { ok: true; value: NormalizedSubmission } | { ok: false; errors: string[] };\n\nconst KNOWN_KEYS = new Set([\n  \"formType\",\n  \"name\",\n  \"firstName\",\n  \"lastName\",\n  \"email\",\n  \"phone\",\n  \"message\",\n  \"sourceUrl\",\n  \"utm\",\n  \"extra\",\n  \"_meta\",\n  \"_reply\",\n]);\n\n// Keys that, copied as own-properties into the captured object, could surprise a\n// downstream consumer (template/DB layer). This is an untrusted boundary, so the\n// extraFields merge drops them rather than trusting the caller.\nconst DANGEROUS_KEYS = new Set([\"__proto__\", \"constructor\", \"prototype\"]);\n\nconst EMAIL_RE = /^[^@\\s]+@[^@\\s]+\\.[^@\\s]+$/;\n\nfunction str(v: unknown): string {\n  return typeof v === \"string\" ? v.trim() : \"\";\n}\n\n/**\n * Resolve the submission's formType. An ABSENT/blank value defaults to \"contact\"\n * (the long-standing minimal-form contract). A PRESENT but unrecognized value\n * (e.g. a typo'd \"news\") returns null → the caller rejects it, rather than\n * silently storing it as contact — which would, for a newsletter signup, drop the\n * Mailchimp fan-out. Mirrors createIngestEndpoint's reject-invalid behavior.\n */\nfunction resolveFormType(raw: unknown): FormType | null {\n  const s = str(raw);\n  if (s === \"\") return \"contact\";\n  return (SUBMISSION_FORM_TYPES as readonly string[]).includes(s) ? (s as FormType) : null;\n}\n\n/**\n * Defensively normalize an untrusted ingest payload into typed fields. Folds\n * name/first+last, lowercases email, and dumps every unclaimed key into\n * extraFields so no site-specific data is lost. Rejects only when there's\n * nothing to act on (no email AND no message) or a present email is malformed.\n */\nexport function normalizeSubmission(payload: unknown): NormalizeResult {\n  if (typeof payload !== \"object\" || payload === null) {\n    return { ok: false, errors: [\"payload must be a JSON object\"] };\n  }\n  const p = payload as Record<string, unknown>;\n  const name = str(p.name) || [str(p.firstName), str(p.lastName)].filter(Boolean).join(\" \");\n  const email = str(p.email).toLowerCase();\n  const message = str(p.message);\n\n  const formType = resolveFormType(p.formType);\n  const errors: string[] = [];\n  if (!email && !message) errors.push(\"at least one of email or message is required\");\n  if (email && !EMAIL_RE.test(email)) errors.push(\"email is not a valid address\");\n  if (formType === null) errors.push(\"formType is not a recognized form type\");\n  // The `|| formType === null` is redundant for control flow (the push above\n  // already made errors non-empty) but narrows formType to FormType past this line.\n  if (errors.length > 0 || formType === null) return { ok: false, errors };\n\n  const extraFields: Record<string, unknown> = {};\n  const extra = p.extra;\n  if (typeof extra === \"object\" && extra !== null) {\n    for (const [k, v] of Object.entries(extra)) {\n      if (!DANGEROUS_KEYS.has(k) && !k.startsWith(\"_\")) extraFields[k] = v;\n    }\n  }\n  for (const [k, v] of Object.entries(p)) {\n    if (!KNOWN_KEYS.has(k) && !DANGEROUS_KEYS.has(k) && !k.startsWith(\"_\")) extraFields[k] = v;\n  }\n  // The ONE underscore key a caller may set. Both loops above dropped the rest,\n  // including any `_reply` smuggled in through `extra` — this is the only way a\n  // value reaches that key, and it is validated on the way through. Without it,\n  // a bot could POST its own copy and dictate the text of an email we send from\n  // a domain with real sending reputation.\n  const reply = parseReplyCopy(p._reply);\n  if (reply) extraFields._reply = reply;\n\n  const value: NormalizedSubmission = {\n    formType,\n    name,\n    email,\n    extraFields,\n  };\n  const phone = str(p.phone);\n  if (phone) value.phone = phone;\n  if (message) value.message = message;\n  const sourceUrl = str(p.sourceUrl);\n  if (sourceUrl) value.sourceUrl = sourceUrl;\n  const utm = str(p.utm);\n  if (utm) value.utm = utm;\n  return { ok: true, value };\n}\n","import type { WebsiteRow } from \"../reports/airtable/websites.js\";\nimport type {\n  SubmissionRow,\n  SubmissionInput,\n  NotifyStatus,\n  SubmissionStatus,\n} from \"../reports/submission-row.js\";\nimport { normalizeSubmission, type NormalizedSubmission } from \"./payload.js\";\nimport type { TurnstileOutcome, TurnstileVerification } from \"./turnstile.js\";\nimport { SPAM_THRESHOLD, type SpamVerdict } from \"./spam-classifier.js\";\n\n/** How far back the duplicate-spray AND repeat-sender lookups scan. Sprays arrive in\n *  bursts but bots also re-run for weeks; 30 days catches repeats without an unbounded\n *  table scan. */\nconst DUPLICATE_WINDOW_MS = 30 * 24 * 60 * 60 * 1000;\n\nexport type IngestDeps = {\n  getWebsiteBySlug: (slug: string) => Promise<WebsiteRow | null>;\n  createSubmission: (input: SubmissionInput) => Promise<SubmissionRow>;\n  /** Optional last-resort capture for a lead whose site lookup THREW (a store\n   *  outage, not an unknown slug). When present, the lead is persisted here and\n   *  the visitor still gets \"accepted\"; `db replay-deadletters` re-runs it once\n   *  the lookup recovers. Absent → the error propagates exactly as before, so\n   *  callers that never wired it are byte-for-byte unchanged. */\n  deadLetter?: (input: {\n    siteSlug: string;\n    payload: unknown;\n    turnstile: TurnstileVerification;\n    error: string;\n    receivedAt: Date;\n  }) => Promise<{ id: string }>;\n  notify: (\n    site: WebsiteRow,\n    submission: SubmissionRow,\n  ) => Promise<{ status: NotifyStatus; messageId: string | null }>;\n  stampNotified: (id: string, status: NotifyStatus, messageId: string | null) => Promise<void>;\n  now: () => Date;\n  /** Optional spam classifier. When present, its verdict drives the stored\n   *  status/score/reason; absent → every submission scores 0 (fail-open, clean).\n   *  Injected so the classifier stays a pure, transport-agnostic leaf. */\n  classifySpam?: (n: NormalizedSubmission, turnstile: TurnstileOutcome) => SpamVerdict;\n  /** Optional: fleet-wide duplicate/near-duplicate body lookup since `since`. Drives\n   *  the duplicate-spray signal — the same pitch blasted to many sites shows up as\n   *  identical (`exact`) or template-substituted (`similar`, token-set Jaccard) bodies.\n   *  Statuses let the retro re-bucket pick still-'new' prior copies; siteId+email let\n   *  the caller exempt a genuine same-sender resubmission on the same site. Absent →\n   *  the check is skipped (fail-open clean). */\n  findRecentDuplicates?: (\n    message: string,\n    since: Date,\n  ) => Promise<{\n    exact: Array<{ id: string; status: string; siteId: string; email: string }>;\n    similar: Array<{ id: string; status: string; siteId: string; email: string }>;\n  }>;\n  /** Optional: recent non-newsletter submissions from the same email since `since`.\n   *  Drives the cross-site repeat-sender signal — the fleet's sites are unrelated\n   *  businesses, so one address contacting 2+ of them within the window is a\n   *  solicitation tell. Absent → the check is skipped (fail-open clean). */\n  listRecentSubmissionsForEmail?: (\n    email: string,\n    since: Date,\n  ) => Promise<Array<{ id: string; siteId: string; status: string }>>;\n  /** Optional: retroactively re-bucket prior still-'new' rows once a later copy\n   *  identifies a spray (the first copy is delivered by design). Implementations\n   *  must only touch status='new' rows. Best-effort — failures are swallowed. */\n  retroBucket?: (ids: string[], reason: string) => Promise<void>;\n  /** Optional: POST a newsletter submission to the site's configured webhook\n   *  (best-effort). Omitted in tests/handlers that don't need it. */\n  forwardNewsletter?: (\n    webhookUrl: string,\n    submission: SubmissionRow,\n    site: WebsiteRow,\n  ) => Promise<{ ok: boolean; status: number }>;\n  /** Optional: add a newsletter submitter to the site's Mailchimp audience\n   *  (best-effort). Omitted where unused. `tagged:false` reports a member who was\n   *  upserted but could NOT be tagged — recorded separately, see FANOUT below. */\n  addToMailchimp?: (\n    site: WebsiteRow,\n    submission: SubmissionRow,\n  ) => Promise<{ ok: boolean; status: number; tagged?: boolean }>;\n  /** Optional: persist the newsletter fan-out outcome on the row (see FANOUT below).\n   *  Best-effort — failures are swallowed. Absent → the fan-out still runs, just\n   *  unrecorded (older callers and most tests). */\n  stampFanout?: (id: string, fanoutStatus: string) => Promise<void>;\n  /** Optional: run the best-effort tail (notify → stamp → fan-out) AFTER the\n   *  response instead of before it. Production passes Netlify's\n   *  `context.waitUntil`, which keeps the invocation alive until the promise\n   *  settles. Absent → the tail runs inline, exactly as it always did; this is a\n   *  latency change, never a behavioural one.\n   *\n   *  Why it matters: the submitting site waits on this response under an abort\n   *  budget (forms/client.ts `INGEST_TIMEOUT_MS`). Once the row is written the\n   *  lead is captured, so every further second spent on email/webhook providers\n   *  is time in which a captured lead can still be reported to the visitor as a\n   *  failed submission — which is exactly what happened to 1836dig on\n   *  2026-08-03. */\n  defer?: (work: Promise<unknown>) => void;\n};\n\nexport type IngestResult =\n  | { status: \"accepted\"; submissionId: string; notifyStatus: NotifyStatus | \"deferred\" }\n  | { status: \"rejected\"; reason: \"invalid-payload\"; errors: string[] }\n  /** #645. `deadLetterId` is present whenever the lead was captured on its way\n   *  out — i.e. `deadLetter` was wired and the payload was not a testMode probe.\n   *  The STATUS is unchanged on purpose: the handler still answers 404, so the\n   *  sending site still learns its slug does not resolve. */\n  | { status: \"unknown-site\"; slug: string; deadLetterId?: string };\n\nexport type ScreenOutDeps = {\n  getWebsiteBySlug: (slug: string) => Promise<WebsiteRow | null>;\n  recordScreenOut: (siteId: string, reason: \"honeypot\" | \"too-fast\") => Promise<void>;\n};\n\nexport type ScreenOutResult =\n  { status: \"recorded\"; slug: string } | { status: \"unknown-site\"; slug: string };\n\n/** Extract the screen-out reason from a beacon body, or null if it isn't one.\n *  The beacon key is the reserved `_screenOut` (underscore-namespaced like `_meta`,\n *  see payload.ts). The bare `screenOut` key is the DEPRECATED pre-namespacing wire\n *  shape — sites run older package versions for a while, so the central receiver\n *  keeps accepting it. `_screenOut` wins when both are present. */\nexport function parseScreenOut(payload: unknown): \"honeypot\" | \"too-fast\" | null {\n  if (!payload || typeof payload !== \"object\") return null;\n  const body = payload as Record<string, unknown>;\n  const v = \"_screenOut\" in body ? body[\"_screenOut\"] : body[\"screenOut\"];\n  return v === \"honeypot\" || v === \"too-fast\" ? v : null;\n}\n\n/** Resolve the site and record a caught screen-out. Best-effort: a record failure is\n *  the caller's to swallow — a missed count must never error a screened bot. */\nexport async function ingestScreenOut(\n  deps: ScreenOutDeps,\n  slug: string,\n  reason: \"honeypot\" | \"too-fast\",\n): Promise<ScreenOutResult> {\n  const site = await deps.getWebsiteBySlug(slug);\n  if (!site) return { status: \"unknown-site\", slug };\n  await deps.recordScreenOut(site.id, reason);\n  return { status: \"recorded\", slug };\n}\n\n/**\n * Normalize → resolve site → persist → notify → stamp. The order is load-bearing:\n * the row is written BEFORE notify, and notify/stamp failures are swallowed (logged)\n * so a Resend or Airtable-write-back hiccup can never turn an accepted lead into a 502.\n */\nexport async function ingestSubmission(\n  deps: IngestDeps,\n  slug: string,\n  rawPayload: unknown,\n  turnstileInput: TurnstileOutcome | TurnstileVerification = \"unverifiable\",\n): Promise<IngestResult> {\n  // Accept either the full verification (the production handler) or a bare outcome\n  // string (older callers and virtually every test) — a string simply has no solved-\n  // hostname to check. Normalized once so the body has a single shape to reason about.\n  const verification: TurnstileVerification =\n    typeof turnstileInput === \"string\"\n      ? { outcome: turnstileInput, hostname: null }\n      : turnstileInput;\n  const turnstile = verification.outcome;\n  const normalized = normalizeSubmission(rawPayload);\n  if (!normalized.ok) {\n    return { status: \"rejected\", reason: \"invalid-payload\", errors: normalized.errors };\n  }\n  // Persist before enrich (#539 Phase 0). The lookup THROWING is a store outage,\n  // not an answer — and until 2026-08-23 it was the one await that could cost a\n  // lead: the row write comes later, so a thrown lookup 502'd the visitor with\n  // nothing recorded anywhere (the 2026-08-17 Airtable quota outage did exactly\n  // that, while the submissions store itself was healthy the whole time). With\n  // `deadLetter` wired, the lead lands there and the visitor gets an honest\n  // \"accepted\"; `db replay-deadletters` runs it through this same function once\n  // the lookup recovers, producing a normal row with real classification+notify.\n  //\n  // Three deliberate boundaries:\n  // - A testMode probe rethrows: it persists nothing by design, so there is\n  //   nothing to save, and swallowing the outage would green the form-e2e audit\n  //   precisely when central ingest is degraded.\n  // - `deadLetter` itself throwing propagates: both stores are down, and the 502\n  //   is honest — there is nowhere left to put the lead.\n  // - `deadLetter` absent → unchanged behaviour for every caller that never\n  //   wired it.\n  //\n  // #645: the ONE writer, used by both ways a lookup can fail to place a lead.\n  // Returns null when there is nothing to capture (no writer, or a probe).\n  const captureDeadLetter = async (error: string): Promise<string | null> => {\n    if (!deps.deadLetter || isTestMode(rawPayload)) return null;\n    const dl = await deps.deadLetter({\n      siteSlug: slug,\n      payload: rawPayload,\n      turnstile: verification,\n      error,\n      receivedAt: deps.now(),\n    });\n    console.error(`[ingest] lead for '${slug}' dead-lettered as ${dl.id}: ${error}`);\n    return dl.id;\n  };\n\n  let site: WebsiteRow | null;\n  try {\n    site = await deps.getWebsiteBySlug(slug);\n  } catch (err) {\n    const id = await captureDeadLetter(String(err));\n    if (id === null) throw err;\n    return { status: \"accepted\", submissionId: id, notifyStatus: \"skipped\" };\n  }\n  // #645. A lookup that RESOLVES to null used to return empty-handed — no row,\n  // no alarm, no way back. The comment that justified it (\"a junk slug is a\n  // rejection, not a lead to save\") predates the flip, and two facts retire it:\n  //\n  //  1. `/api/forms/:slug` is TOKEN-GATED before this function runs, so the\n  //     slugs that reach here belong to fleet sites, not to bots guessing.\n  //  2. Post-#643 the lookup reads Turso only, so a real client site whose Turso\n  //     row is missing — a half-finished `ensure-site`, a deleted row, Phase 6 —\n  //     is indistinguishable here from a typo, and dropping it loses a paying\n  //     client's lead permanently and silently. It is the only failure in the\n  //     fleet that does that.\n  //\n  // The STATUS stays `unknown-site`, so the handler still answers 404 and the\n  // sending site still learns its slug does not resolve. What changes is that\n  // the lead now exists somewhere: the row is the record, the `deadletter`\n  // attention item is the alarm, `db replay-deadletters` is the recovery.\n  //\n  // Unlike the throw path, a dead-letter failure here PROPAGATES rather than\n  // degrading: the lookup just succeeded, so Turso is up, and a write failure on\n  // a healthy store is a real error the sending site should see.\n  if (!site) {\n    const id = await captureDeadLetter(`unknown-site: no fleet row for '${slug}'`);\n    return id === null\n      ? { status: \"unknown-site\", slug }\n      : { status: \"unknown-site\", slug, deadLetterId: id };\n  }\n\n  // Synthetic end-to-end probe (the `form-e2e` fleet audit). A central-only marker\n  // on the payload routes the submission away from EVERY real sink: no row is\n  // persisted, no spam classification, no operator/autoresponder email, no\n  // newsletter fan-out — and Turnstile enforcement is bypassed (the short-circuit\n  // sits before that check). The marker therefore grants a bot NO benefit: it\n  // reaches no inbox/DB/webhook, so skipping Turnstile costs nothing. This\n  // suppression MUST be central — the submitting site alone cannot stop the real\n  // inbox firing. Validity + site resolution are still enforced above (a junk body\n  // is rejected, an unknown slug is unknown-site), so the marker can't smuggle\n  // anything through. Return accepted+skipped so the probe asserts success.\n  if (isTestMode(rawPayload)) {\n    return { status: \"accepted\", submissionId: \"test-mode\", notifyStatus: \"skipped\" };\n  }\n\n  const n = normalized.value;\n\n  // A site still under construction is where the operator tests their OWN forms:\n  // one address, several unrelated sites, minutes apart. That is byte-for-byte the\n  // cross-site repeat-sender signature below, so a site in development reliably\n  // auto-spams its own builder's test submissions — the row lands `spam_auto`,\n  // notify is skipped and the cockpit hides it, which reads exactly like \"the form\n  // is broken\" (it did, on 2026-08-17). Spam handling on a site with no real\n  // visitors protects nothing, so skip ALL of it: content scoring, the Turnstile\n  // escalation, the repeat-sender scan and the duplicate/spray scan — including\n  // their retroactive re-bucketing of OTHER sites' rows, which a test submission\n  // has no business triggering. Re-enabled the moment the site leaves development.\n  const spamHandlingEnabled = site.status !== \"building\";\n\n  // Fold the content signals + the Turnstile verdict into ONE spam decision.\n  // Absent classifier → treat as clean (fail-open). A throwing classifier is\n  // swallowed the same way — a bug in the heuristic must never turn an\n  // otherwise-good lead into a 500; it just scores clean. On a `requireTurnstile`\n  // site, both an ACTUAL \"fail\" (forged token) AND an \"absent\" token escalate to\n  // auto-spam regardless of score — a real browser that renders the widget ALWAYS\n  // sends a token, so a completely missing one is the direct-POST-bot signature. A\n  // present-but-\"unverifiable\" token (expired/duplicate — a real browser DID render\n  // the widget) stays neutral, as does anything on a site that hasn't opted in.\n  let verdict: SpamVerdict = { score: 0, reasons: [] };\n  if (spamHandlingEnabled && deps.classifySpam) {\n    try {\n      verdict = deps.classifySpam(n, turnstile);\n    } catch (err) {\n      console.error(`[ingest] classifySpam threw: ${String(err)}`);\n    }\n  }\n  const reasons = [...verdict.reasons];\n  let status: SubmissionStatus = verdict.score >= SPAM_THRESHOLD ? \"spam_auto\" : \"new\";\n  if (\n    spamHandlingEnabled &&\n    site.requireTurnstile &&\n    (turnstile === \"fail\" || turnstile === \"absent\")\n  ) {\n    status = \"spam_auto\";\n    const reason = turnstile === \"fail\" ? \"turnstile-required-failed\" : \"turnstile-required-absent\";\n    if (!reasons.includes(reason)) reasons.push(reason);\n  } else if (\n    spamHandlingEnabled &&\n    site.requireTurnstile &&\n    turnstile === \"pass\" &&\n    verification.hostname !== null &&\n    !turnstileHostnameAcceptable(verification.hostname, site.url)\n  ) {\n    // Defense-in-depth vs token farming: the token PASSED, but Cloudflare says it was\n    // solved on a host unrelated to this site. Cloudflare domain-binds sitekeys, so\n    // this only trips on a loose widget allowlist — still, a passing token from a\n    // foreign host accompanying a gated site's submission is not a real visitor. A\n    // null hostname (older responses) or an unparseable site.url skips the check\n    // entirely (fail-open); subdomains of the site's host (www., previews) match.\n    status = \"spam_auto\";\n    if (!reasons.includes(\"turnstile-required-hostname\"))\n      reasons.push(\"turnstile-required-hostname\");\n  }\n\n  // Cross-site repeat-sender signal: the fleet's sites are UNRELATED businesses\n  // (art gallery, realtor, home builder…), so the same email writing to 2+ different\n  // sites within the window is a solicitation tell no single-message scan can see.\n  // Same-site repeats alone must NOT trigger — those are genuine follow-ups. The\n  // operator explicitly accepts overblocking here (spam_auto is recoverable). Prior\n  // still-'new' rows on OTHER sites are retro-bucketed too: the first copy of a\n  // spray is delivered by design, so the copy that identifies it also cleans the\n  // queue. The scan runs EVEN WHEN the incoming copy is already spam_auto — after the\n  // classifier began catching whole spray families, an already-bucketed copy was\n  // skipping this scan and the retro cleanup never fired for exactly the sprays it\n  // was built for; escalation/reason still only applies when not already spam.\n  // Best-effort — a lookup failure never blocks a lead.\n  if (spamHandlingEnabled && n.formType !== \"newsletter\" && deps.listRecentSubmissionsForEmail) {\n    try {\n      const since = new Date(deps.now().getTime() - DUPLICATE_WINDOW_MS);\n      const prior = await deps.listRecentSubmissionsForEmail(n.email, since);\n      const otherSites = prior.filter((p) => p.siteId !== site.id);\n      if (otherSites.length > 0) {\n        if (status !== \"spam_auto\") {\n          status = \"spam_auto\";\n          if (!reasons.includes(\"repeat-sender\")) reasons.push(\"repeat-sender\");\n        }\n        const retroIds = otherSites.filter((p) => p.status === \"new\").map((p) => p.id);\n        if (deps.retroBucket && retroIds.length > 0) {\n          try {\n            await deps.retroBucket(retroIds, \"retro:repeat-sender\");\n          } catch (err) {\n            console.error(`[ingest] retroBucket (repeat-sender) threw: ${String(err)}`);\n          }\n        }\n      }\n    } catch (err) {\n      console.error(`[ingest] listRecentSubmissionsForEmail threw: ${String(err)}`);\n    }\n  }\n\n  // Duplicate/spray signal: the same pitch blasted across the fleet (or repeated) is\n  // a bot tell a lone content scan can't see. An identical body ('exact') OR a\n  // template-substituted near-copy ('similar' — the live dog-harness spray differed\n  // only in greeting; SEO sprays swap the target domain per site) → auto-spam\n  // (recoverable). Prior still-'new' copies are retro-bucketed for the same reason\n  // as above, and the scan runs even when the incoming copy is already spam_auto\n  // (see the repeat-sender note). GENUINE-RESUBMIT EXEMPTION: a match from the SAME\n  // sender on the SAME site is a real visitor double-submitting or resending after\n  // silence, not spray evidence — without this exemption the resend was silently\n  // bucketed AND retro-flipped the delivered original, vanishing an active lead\n  // with no signal. Only cross-site or different-sender copies count. Guarded:\n  // non-newsletter forms with a real body; the db helper ignores short bodies /\n  // small token sets. Best-effort — a lookup failure never blocks a lead.\n  if (\n    spamHandlingEnabled &&\n    n.formType !== \"newsletter\" &&\n    n.message !== undefined &&\n    deps.findRecentDuplicates\n  ) {\n    try {\n      const since = new Date(deps.now().getTime() - DUPLICATE_WINDOW_MS);\n      const dupes = await deps.findRecentDuplicates(n.message, since);\n      const senderEmail = n.email.trim().toLowerCase();\n      const isOwnResend = (m: { siteId: string; email: string }) =>\n        m.siteId === site.id && m.email.trim().toLowerCase() === senderEmail;\n      const exact = dupes.exact.filter((m) => !isOwnResend(m));\n      const similar = dupes.similar.filter((m) => !isOwnResend(m));\n      const reason =\n        exact.length > 0 ? \"duplicate-body\" : similar.length > 0 ? \"similar-body\" : null;\n      if (reason !== null) {\n        if (status !== \"spam_auto\") {\n          status = \"spam_auto\";\n          if (!reasons.includes(reason)) reasons.push(reason);\n        }\n        const retroIds = [...exact, ...similar].filter((m) => m.status === \"new\").map((m) => m.id);\n        if (deps.retroBucket && retroIds.length > 0) {\n          try {\n            await deps.retroBucket(retroIds, \"retro:duplicate-body\");\n          } catch (err) {\n            console.error(`[ingest] retroBucket (duplicate-body) threw: ${String(err)}`);\n          }\n        }\n      }\n    } catch (err) {\n      console.error(`[ingest] findRecentDuplicates threw: ${String(err)}`);\n    }\n  }\n  const spamReason = reasons.length > 0 ? reasons.join(\",\") : null;\n\n  const row = await deps.createSubmission({\n    siteId: site.id,\n    formType: n.formType,\n    name: n.name,\n    email: n.email,\n    extraFields: n.extraFields,\n    status,\n    spamScore: verdict.score,\n    spamReason,\n    // Optional fields spread only when present — exactOptionalPropertyTypes\n    // forbids assigning `undefined` to an optional `phone?: string` etc.\n    ...(n.phone !== undefined ? { phone: n.phone } : {}),\n    ...(n.message !== undefined ? { message: n.message } : {}),\n    ...(n.sourceUrl !== undefined ? { sourceUrl: n.sourceUrl } : {}),\n    ...(n.utm !== undefined ? { utm: n.utm } : {}),\n    submittedAt: deps.now(),\n  });\n\n  // Auto-spam (and operator-marked spam) is captured but silent: no operator\n  // email, no autoresponder, no newsletter fan-out. Skip notify entirely and\n  // record the honest \"skipped\" stamp. notify.ts also nulls both builders for\n  // these statuses (defense in depth), but short-circuiting here means the\n  // injected notify dep is never even invoked for a spam row.\n  const isSpam = row.status === \"spam_auto\" || row.status === \"spam\";\n\n  // ── best-effort tail ───────────────────────────────────────────────────────\n  // notify → stamp → newsletter fan-out. NOTHING below can cost the lead: the\n  // row is already durable, and every step here is swallowed+logged rather than\n  // allowed to turn an accepted lead into a 502. That is precisely why it does\n  // not belong on the visitor's critical path — the submitting site waits on\n  // this response under an abort budget (forms/client.ts INGEST_TIMEOUT_MS), so\n  // Resend latency used to be able to make a captured lead read as a failed\n  // submission in the visitor's browser (1836dig, 2026-08-03).\n  //\n  // `deps.defer` (Netlify's `context.waitUntil` in production) runs the tail\n  // AFTER the response goes out. Absent — every test, and any runtime without\n  // post-response execution — it runs inline exactly as before, so this is a\n  // latency change and never a behavioural one.\n  const runTail = async (): Promise<NotifyStatus> => {\n    let notify: { status: NotifyStatus; messageId: string | null };\n    if (isSpam) {\n      notify = { status: \"skipped\", messageId: null };\n    } else {\n      try {\n        notify = await deps.notify(site, row);\n      } catch (err) {\n        console.error(`[ingest] notify threw: ${String(err)}`);\n        notify = { status: \"failed\", messageId: null };\n      }\n    }\n    try {\n      await deps.stampNotified(row.id, notify.status, notify.messageId);\n    } catch (err) {\n      console.error(`[ingest] stampNotified failed: ${String(err)}`);\n    }\n\n    await runFanout();\n    return notify.status;\n  };\n\n  // Newsletter fan-out: each configured destination fires best-effort and is\n  // swallowed+logged — the lead is already persisted; never turn it into a 502.\n  // Guarded on the row status so a spam signup is never forwarded to a site\n  // webhook or added to a Mailchimp audience.\n  //\n  // FANOUT provenance (2026-07-31): the outcome is ALSO recorded on the row, one\n  // `<destination>:<outcome>` token per attempt, comma-joined in attempt order —\n  // `webhook:ok,mailchimp:401`. Outcome is `ok`, the HTTP status of a non-2xx\n  // (`0` for a network error / misconfiguration, see mailchimp.ts), or `threw`.\n  // `mailchimp-tags:failed` is appended when the member was upserted but the tag\n  // write did not land. Until this existed the results were console.error-only, so\n  // an expired Mailchimp key stopped signups reaching the audience while the row\n  // still read `notify=sent` — healthy-looking, with the failure visible nowhere the\n  // operator ever looks. Nothing attempted → nothing stamped (null stays \"no\n  // destination configured\", NOT \"we tried and lost the answer\"). The stamp is\n  // best-effort like everything else here: a provenance write must never cost a lead.\n  // A const arrow, not a hoisted declaration: `site` is narrowed non-null above,\n  // and that narrowing only survives into a closure created after it. Declared\n  // below runTail (which calls it) but before either call site, so there is no TDZ.\n  const runFanout = async (): Promise<void> => {\n    const fanout: string[] = [];\n    if (n.formType === \"newsletter\" && !isSpam) {\n      if (site.newsletterWebhook && deps.forwardNewsletter) {\n        try {\n          const fwd = await deps.forwardNewsletter(site.newsletterWebhook, row, site);\n          if (!fwd.ok)\n            console.error(`[ingest] newsletter webhook → ${fwd.status} for ${site.name}`);\n          fanout.push(fwd.ok ? \"webhook:ok\" : `webhook:${fwd.status}`);\n        } catch (err) {\n          console.error(`[ingest] newsletter webhook threw: ${String(err)}`);\n          fanout.push(\"webhook:threw\");\n        }\n      }\n      if (site.mailchimpApiKey && site.mailchimpAudienceId && deps.addToMailchimp) {\n        try {\n          const mc = await deps.addToMailchimp(site, row);\n          if (!mc.ok) console.error(`[ingest] mailchimp add → ${mc.status} for ${site.name}`);\n          fanout.push(mc.ok ? \"mailchimp:ok\" : `mailchimp:${mc.status}`);\n          // Only meaningful alongside a successful add — a failed add was never tagged\n          // either, and one token per real problem keeps the row readable.\n          if (mc.ok && mc.tagged === false) {\n            console.error(`[ingest] mailchimp tags not applied for ${site.name}`);\n            fanout.push(\"mailchimp-tags:failed\");\n          }\n        } catch (err) {\n          console.error(`[ingest] mailchimp add threw: ${String(err)}`);\n          fanout.push(\"mailchimp:threw\");\n        }\n      }\n    }\n    if (fanout.length > 0 && deps.stampFanout) {\n      try {\n        await deps.stampFanout(row.id, fanout.join(\",\"));\n      } catch (err) {\n        console.error(`[ingest] stampFanout failed: ${String(err)}`);\n      }\n    }\n  };\n\n  if (deps.defer) {\n    // A rejection escaping here would land as an unhandled rejection in the\n    // platform's post-response context, where nothing is left to catch it — so\n    // the boundary is made unrejectable. Everything inside is already swallowed;\n    // this guards the shape, not a known throw.\n    deps.defer(\n      runTail().catch((err) => {\n        console.error(`[ingest] deferred tail threw: ${String(err)}`);\n      }),\n    );\n    // The lead is durable and the response can go out now. The real notify\n    // outcome lands on the ROW via stampNotified moments later — this field is\n    // only ever read by callers wanting the in-request outcome, which by\n    // definition does not exist once the tail is deferred.\n    return { status: \"accepted\", submissionId: row.id, notifyStatus: \"deferred\" };\n  }\n  return { status: \"accepted\", submissionId: row.id, notifyStatus: await runTail() };\n}\n\n/** True when `a` and `b` are the same host or one is a subdomain of the other\n *  (case-insensitive): `www.reddoorla.com` vs `reddoorla.com` matches both ways.\n *  Exported for tests. PURE. */\nexport function hostsMatch(a: string, b: string): boolean {\n  const ha = a.trim().toLowerCase();\n  const hb = b.trim().toLowerCase();\n  if (ha.length === 0 || hb.length === 0) return false;\n  return ha === hb || ha.endsWith(`.${hb}`) || hb.endsWith(`.${ha}`);\n}\n\n/** Whether a passing token's solved-hostname is acceptable for the site at `siteUrl`.\n *  An unparseable/hostless `siteUrl` returns TRUE — the check self-disables rather\n *  than punishing a possibly-real visitor for an operator data problem (fail-open,\n *  same philosophy as verifyTurnstile). PURE. */\nexport function turnstileHostnameAcceptable(tokenHostname: string, siteUrl: string): boolean {\n  let siteHost: string;\n  try {\n    siteHost = new URL(siteUrl).hostname;\n  } catch {\n    return true;\n  }\n  if (!siteHost) return true;\n  return hostsMatch(tokenHostname, siteHost);\n}\n\n/** True when an untrusted ingest payload carries the synthetic-probe marker\n *  (top-level `testMode: true`). Read from the RAW payload so the branch never\n *  depends on normalization internals; any non-`true` value is ignored (a real\n *  visitor's form never sets it — the starter only forwards it when the submitted\n *  form field `testMode` equals \"true\"). */\nexport function isTestMode(rawPayload: unknown): boolean {\n  if (!rawPayload || typeof rawPayload !== \"object\") return false;\n  return (rawPayload as Record<string, unknown>).testMode === true;\n}\n"],"mappings":";;;;;;;;;;;AA6CA,IAAM,aAAa,oBAAI,IAAI;AAAA,EACzB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAKD,IAAM,iBAAiB,oBAAI,IAAI,CAAC,aAAa,eAAe,WAAW,CAAC;AAExE,IAAM,WAAW;AAEjB,SAAS,IAAI,GAAoB;AAC/B,SAAO,OAAO,MAAM,WAAW,EAAE,KAAK,IAAI;AAC5C;AASA,SAAS,gBAAgB,KAA+B;AACtD,QAAM,IAAI,IAAI,GAAG;AACjB,MAAI,MAAM,GAAI,QAAO;AACrB,SAAQ,sBAA4C,SAAS,CAAC,IAAK,IAAiB;AACtF;AAQO,SAAS,oBAAoB,SAAmC;AACrE,MAAI,OAAO,YAAY,YAAY,YAAY,MAAM;AACnD,WAAO,EAAE,IAAI,OAAO,QAAQ,CAAC,+BAA+B,EAAE;AAAA,EAChE;AACA,QAAM,IAAI;AACV,QAAM,OAAO,IAAI,EAAE,IAAI,KAAK,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI,EAAE,QAAQ,CAAC,EAAE,OAAO,OAAO,EAAE,KAAK,GAAG;AACxF,QAAM,QAAQ,IAAI,EAAE,KAAK,EAAE,YAAY;AACvC,QAAM,UAAU,IAAI,EAAE,OAAO;AAE7B,QAAM,WAAW,gBAAgB,EAAE,QAAQ;AAC3C,QAAM,SAAmB,CAAC;AAC1B,MAAI,CAAC,SAAS,CAAC,QAAS,QAAO,KAAK,8CAA8C;AAClF,MAAI,SAAS,CAAC,SAAS,KAAK,KAAK,EAAG,QAAO,KAAK,8BAA8B;AAC9E,MAAI,aAAa,KAAM,QAAO,KAAK,wCAAwC;AAG3E,MAAI,OAAO,SAAS,KAAK,aAAa,KAAM,QAAO,EAAE,IAAI,OAAO,OAAO;AAEvE,QAAM,cAAuC,CAAC;AAC9C,QAAM,QAAQ,EAAE;AAChB,MAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAC/C,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAK,GAAG;AAC1C,UAAI,CAAC,eAAe,IAAI,CAAC,KAAK,CAAC,EAAE,WAAW,GAAG,EAAG,aAAY,CAAC,IAAI;AAAA,IACrE;AAAA,EACF;AACA,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,CAAC,GAAG;AACtC,QAAI,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,eAAe,IAAI,CAAC,KAAK,CAAC,EAAE,WAAW,GAAG,EAAG,aAAY,CAAC,IAAI;AAAA,EAC3F;AAMA,QAAM,QAAQ,eAAe,EAAE,MAAM;AACrC,MAAI,MAAO,aAAY,SAAS;AAEhC,QAAM,QAA8B;AAAA,IAClC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,QAAQ,IAAI,EAAE,KAAK;AACzB,MAAI,MAAO,OAAM,QAAQ;AACzB,MAAI,QAAS,OAAM,UAAU;AAC7B,QAAM,YAAY,IAAI,EAAE,SAAS;AACjC,MAAI,UAAW,OAAM,YAAY;AACjC,QAAM,MAAM,IAAI,EAAE,GAAG;AACrB,MAAI,IAAK,OAAM,MAAM;AACrB,SAAO,EAAE,IAAI,MAAM,MAAM;AAC3B;;;AC9HA,IAAM,sBAAsB,KAAK,KAAK,KAAK,KAAK;AAoIhD,eAAsB,iBACpB,MACA,MACA,YACA,iBAA2D,gBACpC;AAIvB,QAAM,eACJ,OAAO,mBAAmB,WACtB,EAAE,SAAS,gBAAgB,UAAU,KAAK,IAC1C;AACN,QAAM,YAAY,aAAa;AAC/B,QAAM,aAAa,oBAAoB,UAAU;AACjD,MAAI,CAAC,WAAW,IAAI;AAClB,WAAO,EAAE,QAAQ,YAAY,QAAQ,mBAAmB,QAAQ,WAAW,OAAO;AAAA,EACpF;AAqBA,QAAM,oBAAoB,OAAO,UAA0C;AACzE,QAAI,CAAC,KAAK,cAAc,WAAW,UAAU,EAAG,QAAO;AACvD,UAAM,KAAK,MAAM,KAAK,WAAW;AAAA,MAC/B,UAAU;AAAA,MACV,SAAS;AAAA,MACT,WAAW;AAAA,MACX;AAAA,MACA,YAAY,KAAK,IAAI;AAAA,IACvB,CAAC;AACD,YAAQ,MAAM,sBAAsB,IAAI,sBAAsB,GAAG,EAAE,KAAK,KAAK,EAAE;AAC/E,WAAO,GAAG;AAAA,EACZ;AAEA,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,KAAK,iBAAiB,IAAI;AAAA,EACzC,SAAS,KAAK;AACZ,UAAM,KAAK,MAAM,kBAAkB,OAAO,GAAG,CAAC;AAC9C,QAAI,OAAO,KAAM,OAAM;AACvB,WAAO,EAAE,QAAQ,YAAY,cAAc,IAAI,cAAc,UAAU;AAAA,EACzE;AAqBA,MAAI,CAAC,MAAM;AACT,UAAM,KAAK,MAAM,kBAAkB,mCAAmC,IAAI,GAAG;AAC7E,WAAO,OAAO,OACV,EAAE,QAAQ,gBAAgB,KAAK,IAC/B,EAAE,QAAQ,gBAAgB,MAAM,cAAc,GAAG;AAAA,EACvD;AAYA,MAAI,WAAW,UAAU,GAAG;AAC1B,WAAO,EAAE,QAAQ,YAAY,cAAc,aAAa,cAAc,UAAU;AAAA,EAClF;AAEA,QAAM,IAAI,WAAW;AAYrB,QAAM,sBAAsB,KAAK,WAAW;AAW5C,MAAI,UAAuB,EAAE,OAAO,GAAG,SAAS,CAAC,EAAE;AACnD,MAAI,uBAAuB,KAAK,cAAc;AAC5C,QAAI;AACF,gBAAU,KAAK,aAAa,GAAG,SAAS;AAAA,IAC1C,SAAS,KAAK;AACZ,cAAQ,MAAM,gCAAgC,OAAO,GAAG,CAAC,EAAE;AAAA,IAC7D;AAAA,EACF;AACA,QAAM,UAAU,CAAC,GAAG,QAAQ,OAAO;AACnC,MAAI,SAA2B,QAAQ,SAAS,iBAAiB,cAAc;AAC/E,MACE,uBACA,KAAK,qBACJ,cAAc,UAAU,cAAc,WACvC;AACA,aAAS;AACT,UAAM,SAAS,cAAc,SAAS,8BAA8B;AACpE,QAAI,CAAC,QAAQ,SAAS,MAAM,EAAG,SAAQ,KAAK,MAAM;AAAA,EACpD,WACE,uBACA,KAAK,oBACL,cAAc,UACd,aAAa,aAAa,QAC1B,CAAC,4BAA4B,aAAa,UAAU,KAAK,GAAG,GAC5D;AAOA,aAAS;AACT,QAAI,CAAC,QAAQ,SAAS,6BAA6B;AACjD,cAAQ,KAAK,6BAA6B;AAAA,EAC9C;AAcA,MAAI,uBAAuB,EAAE,aAAa,gBAAgB,KAAK,+BAA+B;AAC5F,QAAI;AACF,YAAM,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,QAAQ,IAAI,mBAAmB;AACjE,YAAM,QAAQ,MAAM,KAAK,8BAA8B,EAAE,OAAO,KAAK;AACrE,YAAM,aAAa,MAAM,OAAO,CAAC,MAAM,EAAE,WAAW,KAAK,EAAE;AAC3D,UAAI,WAAW,SAAS,GAAG;AACzB,YAAI,WAAW,aAAa;AAC1B,mBAAS;AACT,cAAI,CAAC,QAAQ,SAAS,eAAe,EAAG,SAAQ,KAAK,eAAe;AAAA,QACtE;AACA,cAAM,WAAW,WAAW,OAAO,CAAC,MAAM,EAAE,WAAW,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE;AAC7E,YAAI,KAAK,eAAe,SAAS,SAAS,GAAG;AAC3C,cAAI;AACF,kBAAM,KAAK,YAAY,UAAU,qBAAqB;AAAA,UACxD,SAAS,KAAK;AACZ,oBAAQ,MAAM,+CAA+C,OAAO,GAAG,CAAC,EAAE;AAAA,UAC5E;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,KAAK;AACZ,cAAQ,MAAM,iDAAiD,OAAO,GAAG,CAAC,EAAE;AAAA,IAC9E;AAAA,EACF;AAeA,MACE,uBACA,EAAE,aAAa,gBACf,EAAE,YAAY,UACd,KAAK,sBACL;AACA,QAAI;AACF,YAAM,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,QAAQ,IAAI,mBAAmB;AACjE,YAAM,QAAQ,MAAM,KAAK,qBAAqB,EAAE,SAAS,KAAK;AAC9D,YAAM,cAAc,EAAE,MAAM,KAAK,EAAE,YAAY;AAC/C,YAAM,cAAc,CAAC,MACnB,EAAE,WAAW,KAAK,MAAM,EAAE,MAAM,KAAK,EAAE,YAAY,MAAM;AAC3D,YAAM,QAAQ,MAAM,MAAM,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;AACvD,YAAM,UAAU,MAAM,QAAQ,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;AAC3D,YAAM,SACJ,MAAM,SAAS,IAAI,mBAAmB,QAAQ,SAAS,IAAI,iBAAiB;AAC9E,UAAI,WAAW,MAAM;AACnB,YAAI,WAAW,aAAa;AAC1B,mBAAS;AACT,cAAI,CAAC,QAAQ,SAAS,MAAM,EAAG,SAAQ,KAAK,MAAM;AAAA,QACpD;AACA,cAAM,WAAW,CAAC,GAAG,OAAO,GAAG,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE;AACzF,YAAI,KAAK,eAAe,SAAS,SAAS,GAAG;AAC3C,cAAI;AACF,kBAAM,KAAK,YAAY,UAAU,sBAAsB;AAAA,UACzD,SAAS,KAAK;AACZ,oBAAQ,MAAM,gDAAgD,OAAO,GAAG,CAAC,EAAE;AAAA,UAC7E;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,KAAK;AACZ,cAAQ,MAAM,wCAAwC,OAAO,GAAG,CAAC,EAAE;AAAA,IACrE;AAAA,EACF;AACA,QAAM,aAAa,QAAQ,SAAS,IAAI,QAAQ,KAAK,GAAG,IAAI;AAE5D,QAAM,MAAM,MAAM,KAAK,iBAAiB;AAAA,IACtC,QAAQ,KAAK;AAAA,IACb,UAAU,EAAE;AAAA,IACZ,MAAM,EAAE;AAAA,IACR,OAAO,EAAE;AAAA,IACT,aAAa,EAAE;AAAA,IACf;AAAA,IACA,WAAW,QAAQ;AAAA,IACnB;AAAA;AAAA;AAAA,IAGA,GAAI,EAAE,UAAU,SAAY,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAAA,IAClD,GAAI,EAAE,YAAY,SAAY,EAAE,SAAS,EAAE,QAAQ,IAAI,CAAC;AAAA,IACxD,GAAI,EAAE,cAAc,SAAY,EAAE,WAAW,EAAE,UAAU,IAAI,CAAC;AAAA,IAC9D,GAAI,EAAE,QAAQ,SAAY,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC;AAAA,IAC5C,aAAa,KAAK,IAAI;AAAA,EACxB,CAAC;AAOD,QAAM,SAAS,IAAI,WAAW,eAAe,IAAI,WAAW;AAe5D,QAAM,UAAU,YAAmC;AACjD,QAAI;AACJ,QAAI,QAAQ;AACV,eAAS,EAAE,QAAQ,WAAW,WAAW,KAAK;AAAA,IAChD,OAAO;AACL,UAAI;AACF,iBAAS,MAAM,KAAK,OAAO,MAAM,GAAG;AAAA,MACtC,SAAS,KAAK;AACZ,gBAAQ,MAAM,0BAA0B,OAAO,GAAG,CAAC,EAAE;AACrD,iBAAS,EAAE,QAAQ,UAAU,WAAW,KAAK;AAAA,MAC/C;AAAA,IACF;AACA,QAAI;AACF,YAAM,KAAK,cAAc,IAAI,IAAI,OAAO,QAAQ,OAAO,SAAS;AAAA,IAClE,SAAS,KAAK;AACZ,cAAQ,MAAM,kCAAkC,OAAO,GAAG,CAAC,EAAE;AAAA,IAC/D;AAEA,UAAM,UAAU;AAChB,WAAO,OAAO;AAAA,EAChB;AAqBA,QAAM,YAAY,YAA2B;AAC3C,UAAM,SAAmB,CAAC;AAC1B,QAAI,EAAE,aAAa,gBAAgB,CAAC,QAAQ;AAC1C,UAAI,KAAK,qBAAqB,KAAK,mBAAmB;AACpD,YAAI;AACF,gBAAM,MAAM,MAAM,KAAK,kBAAkB,KAAK,mBAAmB,KAAK,IAAI;AAC1E,cAAI,CAAC,IAAI;AACP,oBAAQ,MAAM,sCAAiC,IAAI,MAAM,QAAQ,KAAK,IAAI,EAAE;AAC9E,iBAAO,KAAK,IAAI,KAAK,eAAe,WAAW,IAAI,MAAM,EAAE;AAAA,QAC7D,SAAS,KAAK;AACZ,kBAAQ,MAAM,sCAAsC,OAAO,GAAG,CAAC,EAAE;AACjE,iBAAO,KAAK,eAAe;AAAA,QAC7B;AAAA,MACF;AACA,UAAI,KAAK,mBAAmB,KAAK,uBAAuB,KAAK,gBAAgB;AAC3E,YAAI;AACF,gBAAM,KAAK,MAAM,KAAK,eAAe,MAAM,GAAG;AAC9C,cAAI,CAAC,GAAG,GAAI,SAAQ,MAAM,iCAA4B,GAAG,MAAM,QAAQ,KAAK,IAAI,EAAE;AAClF,iBAAO,KAAK,GAAG,KAAK,iBAAiB,aAAa,GAAG,MAAM,EAAE;AAG7D,cAAI,GAAG,MAAM,GAAG,WAAW,OAAO;AAChC,oBAAQ,MAAM,2CAA2C,KAAK,IAAI,EAAE;AACpE,mBAAO,KAAK,uBAAuB;AAAA,UACrC;AAAA,QACF,SAAS,KAAK;AACZ,kBAAQ,MAAM,iCAAiC,OAAO,GAAG,CAAC,EAAE;AAC5D,iBAAO,KAAK,iBAAiB;AAAA,QAC/B;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,SAAS,KAAK,KAAK,aAAa;AACzC,UAAI;AACF,cAAM,KAAK,YAAY,IAAI,IAAI,OAAO,KAAK,GAAG,CAAC;AAAA,MACjD,SAAS,KAAK;AACZ,gBAAQ,MAAM,gCAAgC,OAAO,GAAG,CAAC,EAAE;AAAA,MAC7D;AAAA,IACF;AAAA,EACF;AAEA,MAAI,KAAK,OAAO;AAKd,SAAK;AAAA,MACH,QAAQ,EAAE,MAAM,CAAC,QAAQ;AACvB,gBAAQ,MAAM,iCAAiC,OAAO,GAAG,CAAC,EAAE;AAAA,MAC9D,CAAC;AAAA,IACH;AAKA,WAAO,EAAE,QAAQ,YAAY,cAAc,IAAI,IAAI,cAAc,WAAW;AAAA,EAC9E;AACA,SAAO,EAAE,QAAQ,YAAY,cAAc,IAAI,IAAI,cAAc,MAAM,QAAQ,EAAE;AACnF;AAKO,SAAS,WAAW,GAAW,GAAoB;AACxD,QAAM,KAAK,EAAE,KAAK,EAAE,YAAY;AAChC,QAAM,KAAK,EAAE,KAAK,EAAE,YAAY;AAChC,MAAI,GAAG,WAAW,KAAK,GAAG,WAAW,EAAG,QAAO;AAC/C,SAAO,OAAO,MAAM,GAAG,SAAS,IAAI,EAAE,EAAE,KAAK,GAAG,SAAS,IAAI,EAAE,EAAE;AACnE;AAMO,SAAS,4BAA4B,eAAuB,SAA0B;AAC3F,MAAI;AACJ,MAAI;AACF,eAAW,IAAI,IAAI,OAAO,EAAE;AAAA,EAC9B,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,CAAC,SAAU,QAAO;AACtB,SAAO,WAAW,eAAe,QAAQ;AAC3C;AAOO,SAAS,WAAW,YAA8B;AACvD,MAAI,CAAC,cAAc,OAAO,eAAe,SAAU,QAAO;AAC1D,SAAQ,WAAuC,aAAa;AAC9D;","names":[]}

package/dist/{chunk-5EEMTJMT.js → chunk-ZH5LOQET.js}

@@ -1,10 +1,10 @@
 import {
   hasRealScores,
   lighthouseScoresFromResult
-} from "./chunk-XN37VTDB.js";
+} from "./chunk-37B4LVB3.js";
 import {
   TURSO_IS_AUTHORITATIVE
-} from "./chunk-SVAAONYB.js";
+} from "./chunk-WQLNUEZL.js";
 import {
   detectAuditEvents
 } from "./chunk-5L3FPQIJ.js";
@@ -12,7 +12,7 @@ import {
   normalizeSecurityAdvisory,
   siteSlug,
   updateAuditFields
-} from "./chunk-3Z6X3BHU.js";
+} from "./chunk-KN52PM63.js";
 
 // src/audits/a11y-airtable.ts
 function hasA11yCounts(result) {
@@ -346,4 +346,4 @@ export {
   formatFleetWriteSummary,
   writeFleetAuditsToAirtable
 };
-//# sourceMappingURL=chunk-5EEMTJMT.js.map
+//# sourceMappingURL=chunk-ZH5LOQET.js.map

package/dist/cli/bin.js

@@ -112,7 +112,7 @@ cli.command("sync-configs [site]", "Sync canonical configs into a site.").option
   'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../sync-configs-RRIHNLIJ.js")).runSyncConfigsCommand(site, opts),
+    async () => (await import("../sync-configs-HGLQV55H.js")).runSyncConfigsCommand(site, opts),
     opts
   )
 );
@@ -121,7 +121,7 @@ cli.command("bump-deps [site]", "Bump dependencies.").option("--group <group>",
   'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../bump-deps-C5G2EFBB.js")).runBumpDepsCommand(site, opts),
+    async () => (await import("../bump-deps-EL3TKMIL.js")).runBumpDepsCommand(site, opts),
     opts
   )
 );
@@ -130,7 +130,7 @@ cli.command(
   "Bootstrap a repo to keep itself updated (Renovate + protection; platform auto-merge off; ci.yml is the starter's, not managed here)."
 ).option("--dry", "List what would be enabled without writing or opening PRs").option("--fleet <inventory>", 'Inventory file (.json or .mjs/.js), or "airtable"').option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../self-updating-MWXIZLL7.js")).runSelfUpdatingCommand(site, opts),
+    async () => (await import("../self-updating-RKKIYNV4.js")).runSelfUpdatingCommand(site, opts),
     opts
   )
 );
@@ -139,7 +139,7 @@ cli.command(
   "Add the Prismic model delivery workflow to a site via PR (one PR per repo; never pushes to main)."
 ).option("--dry", "List the sites that would be offered the workflow, without opening any PR").option("--fleet <inventory>", 'Inventory file (.json or .mjs/.js), or "airtable"').option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../prismic-ci-6GKKZGB5.js")).runPrismicCiCommand(site, opts),
+    async () => (await import("../prismic-ci-AHY5ULJR.js")).runPrismicCiCommand(site, opts),
     opts
   )
 );
@@ -154,7 +154,7 @@ cli.command(
   "Write the report to this file (the CI workflow posts it as a PR comment)"
 ).action(
   async (site, opts) => runOrExit(
-    async () => (await import("../prismic-models-P6FWWVRS.js")).runPrismicModelsCommand(site, opts),
+    async () => (await import("../prismic-models-URYGODNY.js")).runPrismicModelsCommand(site, opts),
     opts
   )
 );
@@ -163,7 +163,7 @@ cli.command("upgrade <upgrade> [site]", "Run a named upgrade recipe (svelte-4-to
   'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (upgrade, site, opts) => runOrExit(
-    async () => (await import("../upgrade-VTD6V4HS.js")).runUpgradeCommand(upgrade, site, opts),
+    async () => (await import("../upgrade-WZ44IARG.js")).runUpgradeCommand(upgrade, site, opts),
     opts
   )
 );
@@ -175,7 +175,7 @@ cli.command(
   'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../convert-to-pnpm-YTFREUJK.js")).runConvertToPnpmCommand(site, opts),
+    async () => (await import("../convert-to-pnpm-4DON7IFS.js")).runConvertToPnpmCommand(site, opts),
     opts
   )
 );
@@ -184,7 +184,7 @@ cli.command("svelte-codemods [site]", "Apply Svelte 5 gotcha codemods to an alre
   'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../svelte-codemods-WSV2FGNG.js")).runSvelteCodemodsCommand(site, opts),
+    async () => (await import("../svelte-codemods-QWGIRNN6.js")).runSvelteCodemodsCommand(site, opts),
     opts
   )
 );
@@ -196,7 +196,7 @@ cli.command(
   'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../health-endpoint-KVCJYWET.js")).runHealthEndpointCommand(site, opts),
+    async () => (await import("../health-endpoint-UCLMSSCN.js")).runHealthEndpointCommand(site, opts),
     opts
   )
 );
@@ -208,7 +208,7 @@ cli.command(
   'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../match-harness-QRG6XZAR.js")).runMatchHarnessCommand(site, opts),
+    async () => (await import("../match-harness-OW45CB5H.js")).runMatchHarnessCommand(site, opts),
     opts
   )
 );
@@ -220,7 +220,7 @@ cli.command(
   'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../smoke-suite-7DGITCTZ.js")).runSmokeSuiteCommand(site, opts),
+    async () => (await import("../smoke-suite-BWHR3XX5.js")).runSmokeSuiteCommand(site, opts),
     opts
   )
 );
@@ -232,7 +232,7 @@ cli.command(
   'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../onboard-TM2KESGF.js")).runOnboardCommand(site, opts),
+    async () => (await import("../onboard-CZYBWVWH.js")).runOnboardCommand(site, opts),
     opts
   )
 );
@@ -243,20 +243,23 @@ cli.command(
   "--fleet <inventory>",
   'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
-  async (site, opts) => runOrExit(async () => (await import("../init-FFE4FCO2.js")).runInitCommand(site, opts), opts)
+  async (site, opts) => runOrExit(async () => (await import("../init-3LMZTCVD.js")).runInitCommand(site, opts), opts)
 );
 cli.command(
   "launch <site>",
   "Bootstrap + first-audit a site, then draft its launch email for approval."
 ).action(
   async (site, opts) => runOrExit(
-    async () => (await import("../launch-UD36AHUN.js")).runLaunchCommand(site, opts),
+    async () => (await import("../launch-XTDMC6LD.js")).runLaunchCommand(site, opts),
     opts
   )
 );
-cli.command("header-image [site]", "Generate a site's report header image from its live homepage.").option("--all", "Every live site with no Header image yet (backfill)").option("--force", "With --all, regenerate sites that already have one").option("--write-airtable", "Upload to the Websites row instead of writing a local file").option("--out-dir <path>", "Directory for local output (default: reports/)").option("--settle-ms <ms>", "Override the post-load settle delay for slow/animated homepages").action(
+cli.command("header-image [site]", "Generate a site's report header image from its live homepage.").option("--all", "Every live site with no Header image yet (backfill)").option("--force", "With --all, regenerate sites that already have one").option("--write-airtable", "Upload to the Websites row instead of writing a local file").option("--out-dir <path>", "Directory for local output (default: reports/)").option("--settle-ms <ms>", "Override the post-load settle delay for slow/animated homepages").option(
+  "--consent-selector <css>",
+  "Extra CSS selector(s) to hide before the shutter (consent UI the heuristic misses)"
+).action(
   async (site, opts) => runOrExit(
-    async () => (await import("../header-image-PSPT7CUM.js")).runHeaderImageCommand(site, opts),
+    async () => (await import("../header-image-BRTOLHJF.js")).runHeaderImageCommand(site, opts),
     opts
   )
 );
@@ -265,7 +268,7 @@ cli.command(
   "Draft the monthly-report announcement email for maintenance sites (all, or one) for approval."
 ).action(
   async (site, opts) => runOrExit(
-    async () => (await import("../announce-CLQYX5I4.js")).runAnnounceCommand(site, opts),
+    async () => (await import("../announce-45HVP4J4.js")).runAnnounceCommand(site, opts),
     opts
   )
 );
@@ -274,7 +277,7 @@ cli.command(
   "Show who a form submission would email, and optionally flip the pre-launch guard (read-back confirmed)."
 ).option("--set <on|off>", "Flip the guard: on = route to operator, off = restore.").option("--restore <status>", "Status to restore with --set off. Required; never inferred.").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../forms-notify-target-UC6PF3AE.js")).runFormsNotifyTargetCommand(
+    async () => (await import("../forms-notify-target-4NPLX2UG.js")).runFormsNotifyTargetCommand(
       site,
       opts
     ),
@@ -286,7 +289,7 @@ cli.command(
   "Operator self-tests. kind=email: preview a report email for a site (or --all) to yourself."
 ).option("--type <type>", "Report type: announcement (default) | maintenance | testing | launch").option("--to <addr>", "Recipient(s), comma-separated. Default: OPERATOR_EMAIL.").option("--all", "Send a preview for every maintenance site (to --to/operator).").option("--dry-run", "Render only; write reports/<slug>/selftest-<type>.html; do not send.").action(
   async (kind, site, opts) => runOrExit(
-    async () => (await import("../selftest-VXTHRPRN.js")).runSelftestCommand(kind, site, opts),
+    async () => (await import("../selftest-AFLR7YV7.js")).runSelftestCommand(kind, site, opts),
     opts
   )
 );
@@ -298,13 +301,13 @@ cli.command(
   "Fleet mode: announcement\u2192maintenance sites; maintenance/testing\u2192all schedulable sites."
 ).action(
   async (site, opts) => runOrExit(
-    async () => (await import("../preflight-RYIP54NY.js")).runPreflightCommand(site, opts),
+    async () => (await import("../preflight-POZZI3GN.js")).runPreflightCommand(site, opts),
     opts
   )
 );
 cli.command("ensure-site <slug>", "Create/verify the Airtable Websites row for a new site.").option("--name <display name>", "Human Name for the row (client-facing copy uses it verbatim).").option("--url <url>", "Deployed URL (e.g. the Netlify site URL).").option("--contact <email>", "point of contact \u2014 the client address reports resolve to.").option("--git-repo <owner/repo>", "GitHub identity. Default on create: reddoorla/<slug>.").action(
   async (slug, opts) => runOrExit(
-    async () => (await import("../ensure-site-OAAE5YE2.js")).runEnsureSiteCommand(slug, opts),
+    async () => (await import("../ensure-site-XESZHZEB.js")).runEnsureSiteCommand(slug, opts),
     opts
   )
 );
@@ -323,9 +326,15 @@ cli.command(
 ).option("--no-probes", "Skip the live AI-visibility probes (tier 3).").option("--out <file>", "Also write the rendered report to this file.").option("--json", "Print the raw result JSON instead of the report summary.").option(
   "--email",
   "Email the internal sheet (scores, what wasn't measured, top fixes, the link) to PROSPECT_AUDIT_RECIPIENTS."
+).option(
+  "--terms <list>",
+  "Comma-separated search terms for the visibility section, chosen by hand. Blank generates them from the site, as before."
+).option(
+  "--questions <list>",
+  "Comma-separated buyer questions, chosen by hand. Blank asks the goal's fixed set. A chosen set gets its own version key, so comparisons never mix sets."
 ).action(
   async (url, opts) => runOrExit(
-    async () => (await import("../prospect-audit-PRHU53HS.js")).runProspectAuditCommand(url, opts),
+    async () => (await import("../prospect-audit-AJEE3Z4L.js")).runProspectAuditCommand(url, opts),
     opts
   )
 );
@@ -346,7 +355,7 @@ cli.command("report [site]", "Draft or send maintenance/testing reports.").optio
   "Regenerate one UNSENT report's stored HTML from its current row, so the console preview shows edited commentary. Refuses a sent report."
 ).action(
   async (site, opts) => runOrExit(
-    async () => (await import("../report-LQS4ECTM.js")).runReportCommand(site, opts),
+    async () => (await import("../report-RC5LGPU3.js")).runReportCommand(site, opts),
     opts
   )
 );
@@ -355,7 +364,7 @@ cli.command(
   "Sweep the fleet for GitHub signals (Renovate-failing/CI/last-commit) and write Airtable."
 ).option("--fleet", "Run across every site in the Airtable inventory.").option("--write-airtable", "Write each site's signals back to its Websites row.").action(
   async (opts) => runOrExit(
-    async () => (await import("../github-signals-TX5FPYP6.js")).runGitHubSignalsCommand({
+    async () => (await import("../github-signals-DMU74SAX.js")).runGitHubSignalsCommand({
       fleet: opts.fleet,
       writeAirtable: opts.writeAirtable
     }),
@@ -367,7 +376,7 @@ cli.command(
   "Verify every public org repo carries a sound branch ruleset (empty bypass, PR-required)."
 ).option("--org <org>", "GitHub org to sweep (enumerated from the API, never a hand list).").action(
   async (opts) => runOrExit(
-    async () => (await import("../protection-audit-SJO53MEQ.js")).runProtectionAuditCommand({
+    async () => (await import("../protection-audit-3J3UEOVT.js")).runProtectionAuditCommand({
       org: opts.org
     }),
     opts
@@ -385,8 +394,17 @@ cli.command(
 ).option(
   "--force",
   "import-airtable / sync: run despite the freeze (#643) \u2014 a deliberate rollback-window converge from the frozen Airtable shadow. Without it both refuse while Turso is authoritative, because an import overwrites authoritative rows."
+).option(
+  "--abandon <slug-or-id>",
+  "replay-deadletters: mark a slug's queued leads (or one dl_\u2026 row) abandoned \u2014 terminal by decision, dropped from the replay queue and the cockpit alarm, row and payload kept."
+).option(
+  "--reason <text>",
+  "replay-deadletters --abandon: why the leads are being written off. Required."
+).option(
+  "--by <who>",
+  "replay-deadletters --abandon: who decided (default: OPERATOR_EMAIL, else 'operator')."
 ).action(
-  async (action, opts) => runOrExit(async () => (await import("../db-XKZYDCKM.js")).runDbCommand(action, opts), opts)
+  async (action, opts) => runOrExit(async () => (await import("../db-5K4CDEGJ.js")).runDbCommand(action, opts), opts)
 );
 cli.command(
   "submissions <action>",
@@ -396,7 +414,7 @@ cli.command(
   "Write the re-buckets: status \u2192 spam_auto, spam_score/spam_reason replaced with the new verdict + 'retro-rescore' marker."
 ).action(
   async (action, opts) => runOrExit(
-    async () => (await import("../submissions-OVZPVBYG.js")).runSubmissionsCommand(action, opts),
+    async () => (await import("../submissions-II5J35QM.js")).runSubmissionsCommand(action, opts),
     opts
   )
 );
@@ -405,10 +423,10 @@ cli.command(
   "Trigger Renovate on fleet sites the security sweep flagged with critical/high vulns."
 ).option("--fleet", "Run across every active, repo-backed site in the Airtable inventory.").action(
   async (opts) => runOrExit(
-    async () => (await import("../renovate-dispatch-U5Q52SKT.js")).runRenovateDispatchCommand({
+    async () => (await import("../renovate-dispatch-ONJMBUHJ.js")).runRenovateDispatchCommand({
       fleet: opts.fleet,
       // #539 Phase 5: mirror the auto-fix counter into site_health.
-      siteMirror: await (await import("../site-mirror-WON4FTJ2.js")).makeSiteMirror()
+      siteMirror: await (await import("../site-mirror-H2FYMN55.js")).makeSiteMirror()
     }),
     opts
   )
@@ -433,7 +451,7 @@ cli.command(
   "freeze: JSON declaring slots the template has no token for (video poster, a panel rebuilt from a baked image). Keys must start with 'x.'"
 ).action(
   async (action, dir, opts) => runOrExit(
-    async () => (await import("../blux-4KNXUP2K.js")).runBluxCommand(action, dir, opts),
+    async () => (await import("../blux-RUFMNOUJ.js")).runBluxCommand(action, dir, opts),
     opts
   )
 );
@@ -445,7 +463,7 @@ cli.command(
   "Output directory for capture (default: webflow-out) / docs (default: dirname of the ir.json)"
 ).action(
   async (action, target, opts) => runOrExit(
-    async () => (await import("../webflow-IRKOIT7S.js")).runWebflowCommand(action, target, opts),
+    async () => (await import("../webflow-624FEBFD.js")).runWebflowCommand(action, target, opts),
     opts
   )
 );