frontpage-host 0.1.16 → 0.1.18

package/AGENTS.md

@@ -26,17 +26,22 @@ Frontpage has two surfaces:
 | **Staging** | `https://<subdomain>.frontpage.host` | Working copy for edits, previews, and review |
 | **Production** | Custom domain (when connected), after **publish** | What end customers see on the live domain |
 
-**How changes become visible on staging**
+**Three clocks (do not collapse these)**
 
-- `frontpage push`, `frontpage prompt`, and `frontpage edit` update the site branch and the **staging** surface.
-- After a push or agent run finishes building, changes are on the site branch behind `https://<subdomain>.frontpage.host`.
-- There is **no separate “deploy to staging” step** agents must run. Do not treat `frontpage deploy wait` as “going live.” At most it waits for an in-flight build to finish before you open the subdomain to review.
+1. **Git tip** — `frontpage push` / `prompt` / `edit` land a new SHA. Fast.
+2. **Site compile** — Fly (or Vercel on legacy hosts) builds that SHA. This is what visitors get. Poll `GET /api/v1/sites/<slug>/deploy` until `ready` is true (`liveCommit` equals the tip).
+3. **Editor agent run** — a chat job (`queued` / `running` / `deploying`). `frontpage runs wait` watches this clock only.
+
+- After the compile is ready, staging is `https://<subdomain>.frontpage.host`.
+- There is **no separate “deploy to staging” step**. `frontpage deploy wait` waits for agent-run idle (if a run is in flight) **and** for the tip compile. It is not go-live.
+- A file-only push has **no** agent run. Do not treat a historical run that says “Your changes are live” as this push.
 - `frontpage open` opens the subdomain staging URL.
 - **Custom-domain caveat:** `<subdomain>.frontpage.host` is publicly viewable (anonymous) only when the site has **no** custom domain and subdomain sharing is public. If a custom domain is connected (e.g. `arbiter.wiki`), the subdomain is often **owner-private** — an unauthenticated browser/curl may see the app login page. That login wall is **not** a failed push. Anonymous public review is then on the **published custom domain**; editing the subdomain still needs an owner browser session (CLI API key ≠ browser cookie).
 
 **Production publish is a deliberate promote**
 
-- `frontpage publish` copies the current **staging tip** to **production** (custom domain / published site).
+- `frontpage publish` copies the last **ready staging compile** to **production** (custom domain / published site). It 409s if the tip is not compiled yet. Use `frontpage publish --wait` (or `deploy wait` then `publish`) so you do not promote the previous build.
+- After publish, compare `<meta name="frontpage:commit">` on the custom domain to the push SHA. History’s `P` marker is the stamped tip; it is only trustworthy when it matches the SHA in `productionUrl`.
 - **Never run `publish` or `unpublish` unless the user explicitly asked**, or the user’s own automation/workflow clearly requires autonomous publishing.
 - Default: finish work on staging, tell the user to review the staging subdomain when it is publicly shareable (see custom-domain caveat above), and let **them** publish (or ask you to publish after they approve).
 
@@ -88,34 +93,39 @@ Rules:
 2. **Pull before push** so `baseCommitSha` is set (CAS). Still required even if you already pulled to edit.
 3. **Do not push** while an agent run is active (`status` / `runs`).
 4. Push updates **staging** (subdomain). Production is unchanged until someone runs `publish`.
-5. Pushing module markup may auto-activate modules (same as the editor agent).
-6. Binaries use base64; do not UTF-8 round-trip them.
-7. Prefer reviewing the subdomain after push; only use `deploy wait` if you need to block until a build finishes.
-8. The **UI / canvas agent does not use this CLI** — it edits the live tip in-process. Only CLI checkouts need `pull`.
+5. A local delete of an allowlisted path is part of the next push (remote-only files are sent as deletes). `frontpage diff` shows them as `D`.
+6. Pushing module markup may auto-activate modules (same as the editor agent).
+7. Binaries use base64; do not UTF-8 round-trip them.
+8. After push, wait for the site compile (`frontpage push --wait` or `frontpage deploy wait`) before reviewing or publishing. Verify `<meta name="frontpage:commit">` when checking production.
+9. The **UI / canvas agent does not use this CLI** — it edits the live tip in-process. Only CLI checkouts need `pull`.
 
 ## Site contract (Astro)
 
 Sites are Astro 6 + Tailwind v4. More detail: `frontpage help site-building` or https://frontpage.host/developers/site-building
 
-1. **Every page** wraps content in `<BaseLayout title="…" description="…">` (import from `src/layouts/BaseLayout.astro`).
+1. **Every page** wraps content in `<BaseLayout title="…" description="…">` (import from `src/layouts/BaseLayout.astro`), or in a site layout that itself wraps `BaseLayout`. A custom wrapper MUST identity-forward `description={description}` and `ogImage={ogImage}` from a 1:1 `Astro.props` destructure (no default, no rename, no reassignment), and `title={seoTitle ?? <derived fallback>}` so the H1 can stay on `title` while Search & Social edits `seoTitle`. NEVER pass a derived local as `title={pageTitle}` with no `seoTitle` alias: the editor will lock Title and Share image on every page that uses that layout. Pages set literal `title` / `description` / optional `seoTitle` / `ogImage` on that tag.
 2. **`src/config/site.ts`** — keep `pages` (path registry) and `nav` in sync when adding/renaming/deleting page files. Tab title comes from BaseLayout, not the `pages` map label.
 3. **One file per URL** for similar page sets (services, guides, …). Do not default to `getStaticPaths()` over `src/data/*.ts`. Blog/news → `frontpage articles`, not a hand-rolled catalog.
 4. **No backends / databases / fake forms or checkout.** Real forms use `<form data-fp-form="slug">` + `frontpage modules`. Refuse or use modules for payments.
-5. **Tokens** in `src/config/tokens.ts` — keep required color/font/spacing/radii keys; style via CSS variables / token Tailwind. **Fonts load rule:** the build bundles catalog faces when the family string appears in `tokens.ts` and/or in a real CSS `font-family` / `fontFamily` / `font-['…']` context under `src/pages|components|styles` — not from prose alone. Preferred path: `frontpage fonts` → exact `value` → `frontpage tokens set --group fonts --key <role> --value "…"` → **APPLY** `font-sans` / `font-serif` / `font-mono` / `font-display` (or `var(--font-*)`) on elements. Inline catalog `font-family` accents can bundle after rebuild, but brand roles still prefer tokens + utilities. Off-catalog families silently fall back to system fonts (push may warn). Module how-tos: `frontpage modules docs <key>` / `frontpage extensions docs <key>`.
-6. **Shared chrome** — prefer `src/components/Header.astro` + `Footer.astro` (or `chrome: { managed: true }` in `site.ts`).
-7. **404** — customize `src/pages/404.astro` if needed; keep `frontpage:404` meta; never register `/404` in `nav`/`pages`.
-8. **Platform-owned paths** stay off-limits (BaseLayout overlay, module/extension shells, `package.json`, …). Customer layouts like `DocsLayout` / `GuideLayout` are OK.
+5. **Quoted attributes vs frontmatter.** In frontmatter JavaScript, a backslash-quote is an escape. In an Astro attribute it is not — the quote after `href=` closes the string and the next token fails the compile. Put HTML in a frontmatter const and pass it as an expression (`auditBody={auditBody}`), or use an expression attribute. Never put an HTML tag or a backslash-quote inside a quoted JSX attribute.
+6. **Tokens** in `src/config/tokens.ts` — keep required color/font/spacing/radii keys; style via CSS variables / token Tailwind. **Fonts load rule:** the build bundles catalog faces when the family string appears in `tokens.ts` and/or in a real CSS `font-family` / `fontFamily` / `font-['…']` context under `src/pages|components|styles` — not from prose alone. Preferred path: `frontpage fonts` → exact `value` → `frontpage tokens set --group fonts --key <role> --value "…"` → **APPLY** `font-sans` / `font-serif` / `font-mono` / `font-display` (or `var(--font-*)`) on elements. Inline catalog `font-family` accents can bundle after rebuild, but brand roles still prefer tokens + utilities. Off-catalog families silently fall back to system fonts (push may warn). Module how-tos: `frontpage modules docs <key>` / `frontpage extensions docs <key>`.
+7. **Shared chrome** — prefer `src/components/Header.astro` + `Footer.astro` (or `chrome: { managed: true }` in `site.ts`).
+8. **404** — customize `src/pages/404.astro` if needed; keep `frontpage:404` meta; never register `/404` in `nav`/`pages`.
+9. **Redirects** — real 301/308s are `frontpage redirects list|set|rm`, not site files. `set --from /old --to /new` is instant (no push/build). Do not ship `Astro.redirect`, `location.replace`, or meta refresh for a permanent move. `frontpage revert` does not undo redirects; `redirects rm` does.
+10. **Platform-owned paths** stay off-limits (BaseLayout overlay, module/extension shells, `package.json`, …). Customer layouts like `DocsLayout` / `GuideLayout` are OK.
 
 ## Modules & articles
 
-- Forms: `data-fp-form` markup in pages + `frontpage modules` for enable/config. No submit JS / honeypot / `action`.
-- Wizard / connect-once modules (payments/shop/ordering): `frontpage modules <key> connect` opens Frontpage (you must be logged in there), then Stripe or Square. Already-connected sites stay live — do not retry connect. payments/shop connect needs an **admin** key; ordering connect needs **editor**. `--no-open` for CI. `request-setup` remains valid when you want the **editor amber bar** instead. payments and shop share one Stripe account — payments disconnect fails if the store still uses it. Auto-active modules (forms/callbar/…) need markup, not request-setup. Typed settings: `frontpage modules callbar|forms|booking|signups get|set` (forms set needs `--instance`; do not target `default`). `frontpage modules <key>` prints that key's CLI usage (exit 2). Index: https://frontpage.host/developers/modules · payments/shop/ordering pages under /developers/modules/<key>
+- Forms: `data-fp-form` markup in pages + `frontpage modules` for enable/config. No submit JS / honeypot / `action`. Do not put a CRM webhook or token in HTML.
+- Wizard / connect-once modules (payments/shop/ordering): `frontpage modules <key> connect` opens Frontpage (you must be logged in there), then Stripe or Square. Already-connected sites stay live — do not retry connect. payments/shop connect needs an **admin** key; ordering connect needs **editor**. `--no-open` for CI. `request-setup` remains valid when you want the **editor amber bar** instead. payments and shop share one Stripe account — payments disconnect fails if the store still uses it. Auto-active modules (forms/callbar/…) need markup, not request-setup. Typed settings: `frontpage modules callbar|forms|booking|signups get|set` (forms set needs `--instance`; do not target `default`). Form destinations (HubSpot / Pipedrive / Privyr): connect once, then attach each form. `frontpage modules forms destinations|connect-destination|attach-destination|detach-destination|remove-destination --yes|request-destination-setup`. Token write is **admin**; `request-destination-setup` lights the editor amber bar (**editor** key). Do not use `request-setup forms` for a CRM (no-op). Connecting does not attach every form. Privyr: paste the Incoming Webhook URL from Automations → Lead Sources → Webhooks (`https://www.privyr.com/api/v1/incoming-leads/…`), not a token and not Outgoing Webhooks. HubSpot: Development → Keys → Service keys or Development → Legacy apps → Auth → Show token. Pipedrive: profile → Company settings → Personal preferences → API. Full docs: https://frontpage.host/developers/modules#forms-destinations. `frontpage modules <key>` prints that key's CLI usage (exit 2). Index: https://frontpage.host/developers/modules · payments/shop/ordering pages under /developers/modules/<key>
 - Google reviews: platform nodes only (`data-fp-google-reviews` / `data-fp-google-ask` + required `data-fp-requires="google_reviews"`). `data-layout` is `feed` (default), `badge`, or `link`. Never invent stars, quotes, a 1–10, or a Maps URL. Do not pick a Place ID via Autocomplete and do not write `placeId` through `modules config`. Owner-supplied Place ID / Maps URL: `frontpage modules google_reviews connect --place-id …` or `--maps-url …` (server resolves + seeds). Curation: `list-reviews`, `hide --id`, `show --id`, `set-stars`, `set-sort`, `set-weight`, `reset-weights`, `refresh`, `disconnect`. Usage: `frontpage modules google_reviews`. Docs: https://frontpage.host/developers/modules/google-reviews. Ask-widget scores: `frontpage inbox google_reviews`.
 - Articles: `frontpage articles …` for lifecycle; bodies via sync under `content/` or `articles content get|set`. Section landing is an owned `src/pages/<section>/index.astro`.
 - Migrate a folder into Articles: prefer `frontpage prompt "migrate … into articles"` — do not invent a mass delete+write migration.
 - Extensions: `frontpage extensions`; if LOCKED on plan, do not fake charts/etc.
 - Media: `frontpage media upload <file>` — images/PDF ≤25 MB, video (MP4/WebM/MOV) ≤50 MB, SVG/text ≤4 MB (sanitizing proxy). Human output prints `sitePath:` first (use that in markup — never raw blob hosts), then optional `url:`. Optional `?w=` on rasters only. **Text/CSV** uploads are inline only — **not** added to the media library and **cannot** be linked via `/__media` (`media upload --json` omits full `content`; use `inbox … --csv` for submission exports).
+- Generated images: `frontpage images generate --prompt "…"` `[--count N]` — one prompt, 1–4 variations of that same picture. Prints `sitePath:` first. Counts against AI $ and storage. Flag-off environments return 404 (`Image generation is not enabled.`). Do not call xAI / Imagine yourself.
 - Analytics: bare `frontpage analytics` = dashboard; also `summary|query|funnel|timeseries|compare|sql` for structured reads (SQL is guard + RLS site-scoped).
+- People: `frontpage people list|get|add|set|note|rm-note|follow-up|hide|unhide`. Site-scoped person graph (email or phone). Inbox stays the raw ledger. Hide is not forget.
 
 ## Agent prompt loop
 
@@ -134,8 +144,9 @@ frontpage runs wait          # wait for the agent run to finish (failed/canceled
 - Caps: images/PDF ≤25 MB, video ≤50 MB, SVG/text via proxy ≤4 MB (large text/data Blob upload is editor-only).
 - Prompt text is still required (API). Attachments ride on the same enqueue as the editor.
 - `runs wait` with `--json`: failures use `ok: false` and include `data.run` (with `run.error` when present).
-- `deploy wait` is fail-closed: exit 2 if the waited run (or latest, when already idle) is `failed`/`canceled`.
-- `frontpage push --wait` waits for agent-run idle after push (same busy statuses; not a separate Vercel oracle).
+- `runs wait` watches an editor agent run only.
+- `deploy wait` is fail-closed on a failed/canceled agent run it actually watched (or a latest failed/canceled when idle). It then waits until `GET /deploy` `ready` (live compile SHA equals the tip). Exit 2 on compile failure or timeout.
+- `frontpage push --wait` does the same compile wait for the SHA just pushed. A file-only push still waits for the compile.
 
 Mid-task continuation is automatic. There is **no** `runs continue` in v1.
 
@@ -217,7 +228,7 @@ Safe default after finishing work: summarize what changed and give the staging U
 6. **Active-run guard.** Push/revert refuse while an editor agent run is active (exit 3).
 7. **CAS.** Tip moved since pull → exit 3; pull and retry.
 8. **No invented v1 commands:** `domains*`, `billing*`, `members*`, `suggestions*`, `sites delete|restore`, `runs continue`, MCP, git remotes / clone URLs.
-9. **`deploy wait` ≠ publish.** Optional build wait only; staging visibility is the subdomain.
+9. **`deploy wait` ≠ publish.** It waits for the tip compile. Production still requires `publish`. Verify live HTML with `<meta name="frontpage:commit">`.
 10. **Honesty on stubs.** `open --prod` is currently a no-op stub (still opens the subdomain).
 
 ## Isolation (hard fence)

package/README.md

@@ -23,9 +23,9 @@ Requires Node.js ≥ 20.
 3. `frontpage sites` — note the **subdomain** (not a custom domain).
 4. `mkdir my-site && cd my-site && frontpage use <subdomain>`
 5. `frontpage pull` → edit files under `src/`, `public/`, or `content/`
-6. `frontpage push --message "describe the change"`
-7. Review staging at `https://<subdomain>.frontpage.host` (no separate staging-deploy step).
-8. `frontpage publish` only when you intentionally promote to production.
+6. `frontpage push --message "describe the change"` (add `--wait` to block until the site compile is live)
+7. Review staging at `https://<subdomain>.frontpage.host` after the compile is ready.
+8. `frontpage publish --wait` only when you intentionally promote the ready compile to production.
 
 ## Environment
 

package/dist/bin-path.d.ts

@@ -0,0 +1,21 @@
+export type PathFrontpageVerdict = {
+    stale: boolean;
+    path: string | null;
+    pathVersion: string | null;
+    reason: "older-than-compile-wait" | "older-than-this-package" | "unreadable" | null;
+};
+export declare function resolveRealPath(path: string): string;
+export declare function interpretPathFrontpage(args: {
+    thisVersion: string;
+    thisBin: string | null;
+    pathBin: string | null;
+    pathVersionLine: string | null;
+    minVersion?: string;
+}): PathFrontpageVerdict;
+export declare function whichFrontpage(): string | null;
+export declare function frontpageVersionAt(bin: string): string | null;
+export declare function inspectPathFrontpage(opts?: {
+    thisBin?: string | null;
+    thisVersion?: string;
+}): PathFrontpageVerdict;
+export declare function stalePathUpgradeMessage(v: PathFrontpageVerdict): string;

package/dist/bin-path.js

@@ -0,0 +1,65 @@
+/**
+ * Detect a stale `frontpage` on PATH (global 0.1.9 vs this package).
+ * Does not uninstall anything — doctor prints the uninstall command.
+ */
+import { spawnSync } from "node:child_process";
+import { realpathSync } from "node:fs";
+import { COMPILE_WAIT_MIN_VERSION, isOlderThan, packageIdentity, parseVersionLine, } from "./version.js";
+export function resolveRealPath(path) {
+    try {
+        return realpathSync(path);
+    }
+    catch {
+        return path;
+    }
+}
+export function interpretPathFrontpage(args) {
+    if (!args.pathBin) {
+        return { stale: false, path: null, pathVersion: null, reason: null };
+    }
+    if (args.thisBin && resolveRealPath(args.pathBin) === resolveRealPath(args.thisBin)) {
+        return { stale: false, path: args.pathBin, pathVersion: args.thisVersion, reason: null };
+    }
+    const pathVersion = parseVersionLine(args.pathVersionLine ?? "");
+    if (!pathVersion) {
+        return { stale: true, path: args.pathBin, pathVersion: null, reason: "unreadable" };
+    }
+    const floor = args.minVersion ?? COMPILE_WAIT_MIN_VERSION;
+    if (isOlderThan(pathVersion, floor)) {
+        return { stale: true, path: args.pathBin, pathVersion, reason: "older-than-compile-wait" };
+    }
+    if (isOlderThan(pathVersion, args.thisVersion)) {
+        return { stale: true, path: args.pathBin, pathVersion, reason: "older-than-this-package" };
+    }
+    return { stale: false, path: args.pathBin, pathVersion, reason: null };
+}
+export function whichFrontpage() {
+    const r = spawnSync("sh", ["-c", "command -v frontpage"], { encoding: "utf8" });
+    const line = (r.stdout ?? "").trim().split("\n")[0]?.trim();
+    return line || null;
+}
+export function frontpageVersionAt(bin) {
+    const r = spawnSync(bin, ["--version"], { encoding: "utf8" });
+    const text = `${r.stdout ?? ""}\n${r.stderr ?? ""}`;
+    return parseVersionLine(text);
+}
+export function inspectPathFrontpage(opts) {
+    const thisVersion = opts?.thisVersion ?? packageIdentity().version;
+    const thisBin = opts?.thisBin ?? process.argv[1] ?? null;
+    const pathBin = whichFrontpage();
+    const pathVersionLine = pathBin ? frontpageVersionAt(pathBin) : null;
+    return interpretPathFrontpage({
+        thisVersion,
+        thisBin,
+        pathBin,
+        pathVersionLine,
+    });
+}
+export function stalePathUpgradeMessage(v) {
+    const found = v.pathVersion ? `frontpage-host ${v.pathVersion}` : "an unknown frontpage-host";
+    const where = v.path ? ` at ${v.path}` : "";
+    return (`PATH frontpage is ${found}${where}. Compile-wait needs frontpage-host ${COMPILE_WAIT_MIN_VERSION} or newer. ` +
+        `Uninstall the stale global (npm uninstall -g frontpage-host) and install ` +
+        `npm i -g frontpage-host@${COMPILE_WAIT_MIN_VERSION} (or npx frontpage-host@${COMPILE_WAIT_MIN_VERSION}). ` +
+        `In the Frontpage repo, run node <repo>/cli/dist/bin.js instead of a global binary.`);
+}

package/dist/bin.js

@@ -24,8 +24,11 @@ import { runPages } from "./commands/pages.js";
 import { runModules } from "./commands/modules.js";
 import { runExtensions } from "./commands/extensions.js";
 import { runMedia } from "./commands/media.js";
+import { runImages } from "./commands/images.js";
 import { runInbox } from "./commands/inbox.js";
 import { runSeo } from "./commands/seo.js";
+import { runRedirects } from "./commands/redirects.js";
+import { runPeople } from "./commands/people.js";
 import { runArticles } from "./commands/articles.js";
 import { runSettings } from "./commands/settings.js";
 import { runEdit } from "./commands/edit.js";
@@ -107,10 +110,16 @@ async function main() {
             return runExtensions(args);
         case "media":
             return runMedia(args);
+        case "images":
+            return runImages(args);
         case "inbox":
             return runInbox(args);
+        case "people":
+            return runPeople(args);
         case "seo":
             return runSeo(args);
+        case "redirects":
+            return runRedirects(args);
         case "articles":
             return runArticles(args);
         case "settings":

package/dist/commands/deploy.d.ts

@@ -1,2 +1,2 @@
-/** `frontpage deploy wait` — wait until no run is in deploying/queued/running. */
+/** `frontpage deploy wait` — agent-run idle, then the tip's site compile. */
 export declare function runDeploy(args: string[]): Promise<number>;

package/dist/commands/deploy.js

@@ -1,8 +1,8 @@
 import { resolveSlug } from "../site.js";
 import { EXIT_USAGE } from "../http/client.js";
 import { emitErr, emitUsage } from "../runtime.js";
-import { emitWaitOutcome, waitForAgentIdle } from "./wait-agent-idle.js";
-/** `frontpage deploy wait` — wait until no run is in deploying/queued/running. */
+import { waitForAgentThenCompile } from "./wait-site-compile.js";
+/** `frontpage deploy wait` — agent-run idle, then the tip's site compile. */
 export async function runDeploy(args) {
     try {
         const sub = args[0];
@@ -10,12 +10,11 @@ export async function runDeploy(args) {
             return emitUsage("deploy", "Usage: frontpage deploy wait [--site <slug>]", EXIT_USAGE);
         }
         const { slug } = await resolveSlug(args.slice(1));
-        const result = await waitForAgentIdle({
+        return waitForAgentThenCompile({
+            command: "deploy",
             slug,
-            // Fail-closed: idle with latest failed/canceled is not success.
             failClosedOnIdleTerminalFailure: true,
         });
-        return emitWaitOutcome({ command: "deploy", slug, result });
     }
     catch (err) {
         return emitErr("deploy", err);

package/dist/commands/images.d.ts

@@ -0,0 +1 @@
+export declare function runImages(args: string[]): Promise<number>;

package/dist/commands/images.js

@@ -0,0 +1,57 @@
+import { resolveSlug } from "../site.js";
+import { EXIT_OK, EXIT_USAGE, exitCodeForError, v1Post } from "../http/client.js";
+import { assertNoUnknownFlags, takeFlag } from "../argv.js";
+import { emitErr, emitOk, isJson } from "../runtime.js";
+const USAGE = 'Usage: frontpage images generate --prompt "…" [--count N] [--site <slug>] [--json]';
+const GENERATE_TIMEOUT_MS = 180_000;
+export async function runImages(args) {
+    try {
+        const { slug, rest } = await resolveSlug(args);
+        const sub = rest[0];
+        if (sub !== "generate") {
+            console.error(USAGE);
+            return EXIT_USAGE;
+        }
+        const work = rest.slice(1);
+        const prompt = takeFlag(work, "--prompt");
+        const countRaw = takeFlag(work, "--count");
+        assertNoUnknownFlags(work, "images");
+        if (work.length > 0) {
+            console.error(`Unexpected argument: ${work[0]}\n${USAGE}`);
+            return EXIT_USAGE;
+        }
+        if (!prompt) {
+            console.error(USAGE);
+            return EXIT_USAGE;
+        }
+        let count;
+        if (countRaw !== undefined) {
+            const n = Number(countRaw);
+            if (!Number.isInteger(n) || n < 1 || n > 4) {
+                console.error("Ask for 1 to 4 variations.");
+                return EXIT_USAGE;
+            }
+            count = n;
+        }
+        const body = { prompt };
+        if (count !== undefined)
+            body.count = count;
+        const data = await v1Post(`/api/v1/sites/${encodeURIComponent(slug)}/images`, body, { timeoutMs: GENERATE_TIMEOUT_MS });
+        if (isJson()) {
+            emitOk("images", { slug, images: data.images });
+            return EXIT_OK;
+        }
+        for (const img of data.images ?? []) {
+            console.log(`sitePath: ${img.sitePath}`);
+            if (img.filename)
+                console.log(`filename: ${img.filename}`);
+        }
+        return EXIT_OK;
+    }
+    catch (err) {
+        if (isJson())
+            return emitErr("images", err);
+        console.error(err instanceof Error ? err.message : String(err));
+        return exitCodeForError(err);
+    }
+}

package/dist/commands/modules.js

@@ -5,6 +5,7 @@ import { emitUsage } from "../runtime.js";
 import { formatModuleUsage, formatModulesIndex, isCliModuleAction, isDocumentedModuleKey, isGenericModuleVerb, } from "../modules/commands.js";
 import { runGoogleReviews } from "../modules/google_reviews.js";
 import { isTypedConfigCliKey, runTypedConfig } from "../modules/typed_config.js";
+import { isFormsDestinationCliAction, runFormsDestinations } from "../modules/forms_destinations.js";
 import { isOauthCliKey, runOauthHandoff } from "../modules/oauth.js";
 /** Drop --site so we can print local usage without resolving a checkout. */
 function positionalArgs(args) {
@@ -44,6 +45,9 @@ export async function runModules(args) {
                 if (peekedKey === "google_reviews") {
                     return await runGoogleReviews(slug, peekedAction, extraFlags);
                 }
+                if (peekedKey === "forms" && isFormsDestinationCliAction(peekedAction)) {
+                    return await runFormsDestinations(slug, peekedAction, extraFlags);
+                }
                 if (isTypedConfigCliKey(peekedKey)) {
                     return await runTypedConfig(peekedKey, slug, peekedAction, extraFlags);
                 }

package/dist/commands/people.d.ts

@@ -0,0 +1 @@
+export declare function runPeople(args: string[]): Promise<number>;

package/dist/commands/people.js

@@ -0,0 +1,239 @@
+import { resolveSlug } from "../site.js";
+import { CliHttpError, EXIT_OK, EXIT_USAGE, exitCodeForError, v1Delete, v1Get, v1Patch, v1Post, } from "../http/client.js";
+import { assertNoUnknownFlags, hasFlag, takeFlag } from "../argv.js";
+import { emitErr, emitOk, isJson } from "../runtime.js";
+const USAGE = "Usage: frontpage people list|get|add|set|note|rm-note|follow-up|hide|unhide [--site <slug>] [--json]";
+function requireId(work) {
+    const fromFlag = takeFlag(work, "--id");
+    if (fromFlag)
+        return fromFlag;
+    const positional = work.find((a) => !a.startsWith("-"));
+    if (positional) {
+        work.splice(work.indexOf(positional), 1);
+        return positional;
+    }
+    throw new CliHttpError(`Person id is required. Run: frontpage help people`, EXIT_USAGE, 0, "bad_request");
+}
+function displayName(row) {
+    return row.name || row.email || row.phone || row.id;
+}
+function printPerson(row) {
+    const bits = [row.status ?? "—", displayName(row)];
+    if (row.email && row.email !== row.name)
+        bits.push(row.email);
+    if (row.phone && row.phone !== row.name)
+        bits.push(row.phone);
+    if (row.followUpAt)
+        bits.push(`follow-up ${row.followUpAt}`);
+    if (row.hiddenAt)
+        bits.push("hidden");
+    if (row.lastEvent?.summary)
+        bits.push(row.lastEvent.summary);
+    console.log(`${row.id}  ${bits.join("  ·  ")}`);
+}
+export async function runPeople(args) {
+    try {
+        const { slug, rest } = await resolveSlug(args);
+        const sub = rest[0];
+        const base = `/api/v1/sites/${encodeURIComponent(slug)}/people`;
+        if (!sub || sub === "list") {
+            const work = sub === "list" ? rest.slice(1) : [...rest];
+            const q = takeFlag(work, "--q") ?? takeFlag(work, "--query");
+            const status = takeFlag(work, "--status");
+            const source = takeFlag(work, "--source");
+            const formSlug = takeFlag(work, "--form-slug");
+            const followUp = takeFlag(work, "--follow-up");
+            const sort = takeFlag(work, "--sort");
+            const lastSeenDays = takeFlag(work, "--last-seen-days");
+            const limit = takeFlag(work, "--limit");
+            const cursor = takeFlag(work, "--cursor");
+            const hidden = hasFlag(work, "--hidden");
+            assertNoUnknownFlags(work, "people");
+            const params = new URLSearchParams();
+            if (q)
+                params.set("q", q);
+            if (status)
+                params.set("status", status);
+            if (source)
+                params.set("source", source);
+            if (formSlug)
+                params.set("formSlug", formSlug);
+            if (followUp)
+                params.set("followUp", followUp);
+            if (sort)
+                params.set("sort", sort);
+            if (lastSeenDays)
+                params.set("lastSeenDays", lastSeenDays);
+            if (limit)
+                params.set("limit", limit);
+            if (cursor)
+                params.set("cursor", cursor);
+            if (hidden)
+                params.set("hidden", "1");
+            const qs = params.toString();
+            const data = await v1Get(qs ? `${base}?${qs}` : base);
+            if (isJson()) {
+                emitOk("people", data);
+                return EXIT_OK;
+            }
+            const rows = data.people ?? [];
+            if (rows.length === 0) {
+                console.log(hidden ? "No hidden people." : "No people.");
+                return EXIT_OK;
+            }
+            for (const row of rows)
+                printPerson(row);
+            if (data.nextCursor)
+                console.log(`next: ${data.nextCursor}`);
+            return EXIT_OK;
+        }
+        if (sub === "get") {
+            const work = rest.slice(1);
+            const id = requireId(work);
+            assertNoUnknownFlags(work, "people");
+            const data = await v1Get(`${base}/${encodeURIComponent(id)}`);
+            if (isJson()) {
+                emitOk("people", data);
+                return EXIT_OK;
+            }
+            printPerson(data.person);
+            const events = data.events ?? [];
+            for (const ev of events) {
+                const row = ev;
+                const extra = typeof row.payload?.body === "string" ? `  ${row.payload.body}` : "";
+                console.log(`  ${row.occurredAt ?? ""}  ${row.type ?? ""}${extra}`);
+            }
+            return EXIT_OK;
+        }
+        if (sub === "add") {
+            const work = rest.slice(1);
+            const email = takeFlag(work, "--email");
+            const phone = takeFlag(work, "--phone");
+            const name = takeFlag(work, "--name");
+            const note = takeFlag(work, "--note");
+            assertNoUnknownFlags(work, "people");
+            if (!email && !phone) {
+                console.error("Usage: frontpage people add --email you@example.com | --phone +15551234567 [--name …] [--note …]");
+                return EXIT_USAGE;
+            }
+            const data = await v1Post(base, {
+                email,
+                phone,
+                name,
+                note,
+            });
+            if (isJson()) {
+                emitOk("people", data);
+                return EXIT_OK;
+            }
+            printPerson(data.person);
+            return EXIT_OK;
+        }
+        if (sub === "set") {
+            const work = rest.slice(1);
+            const id = requireId(work);
+            const body = {};
+            for (const field of ["name", "email", "phone", "notes", "status"]) {
+                const v = takeFlag(work, `--${field}`);
+                if (v !== undefined)
+                    body[field] = v === "" ? null : v;
+            }
+            assertNoUnknownFlags(work, "people");
+            if (Object.keys(body).length === 0) {
+                console.error("Usage: frontpage people set <id> [--name …] [--email …] [--phone …] [--notes …] [--status …]");
+                return EXIT_USAGE;
+            }
+            const data = await v1Patch(`${base}/${encodeURIComponent(id)}`, body);
+            if (isJson()) {
+                emitOk("people", data);
+                return EXIT_OK;
+            }
+            printPerson(data.person);
+            return EXIT_OK;
+        }
+        if (sub === "note") {
+            const work = rest.slice(1);
+            const id = requireId(work);
+            const body = takeFlag(work, "--body") ?? takeFlag(work, "--note");
+            assertNoUnknownFlags(work, "people");
+            if (!body) {
+                console.error("Usage: frontpage people note <id> --body \"…\"");
+                return EXIT_USAGE;
+            }
+            const data = await v1Post(`${base}/${encodeURIComponent(id)}/events`, { body });
+            if (isJson()) {
+                emitOk("people", data);
+                return EXIT_OK;
+            }
+            console.log(`Noted ${id} (${data.event.id})`);
+            return EXIT_OK;
+        }
+        if (sub === "rm-note") {
+            const work = rest.slice(1);
+            const id = requireId(work);
+            const eventId = takeFlag(work, "--event") ?? takeFlag(work, "--event-id");
+            assertNoUnknownFlags(work, "people");
+            if (!eventId) {
+                console.error("Usage: frontpage people rm-note <id> --event <eventId>");
+                return EXIT_USAGE;
+            }
+            const data = await v1Delete(`${base}/${encodeURIComponent(id)}/events/${encodeURIComponent(eventId)}`);
+            if (isJson()) {
+                emitOk("people", data);
+                return EXIT_OK;
+            }
+            console.log(`Removed note ${data.removed.id}`);
+            return EXIT_OK;
+        }
+        if (sub === "follow-up") {
+            const work = rest.slice(1);
+            const id = requireId(work);
+            const clear = hasFlag(work, "--clear");
+            const at = takeFlag(work, "--at");
+            assertNoUnknownFlags(work, "people");
+            if (!clear && !at) {
+                console.error("Usage: frontpage people follow-up <id> --at <iso> | --clear");
+                return EXIT_USAGE;
+            }
+            const data = await v1Patch(`${base}/${encodeURIComponent(id)}/follow-up`, { at: clear ? null : at });
+            if (isJson()) {
+                emitOk("people", data);
+                return EXIT_OK;
+            }
+            printPerson(data.person);
+            return EXIT_OK;
+        }
+        if (sub === "hide") {
+            const work = rest.slice(1);
+            const id = requireId(work);
+            assertNoUnknownFlags(work, "people");
+            const data = await v1Post(`${base}/${encodeURIComponent(id)}/hide`, {});
+            if (isJson()) {
+                emitOk("people", data);
+                return EXIT_OK;
+            }
+            console.log(`Hidden ${displayName(data.person)}`);
+            return EXIT_OK;
+        }
+        if (sub === "unhide") {
+            const work = rest.slice(1);
+            const id = requireId(work);
+            assertNoUnknownFlags(work, "people");
+            const data = await v1Post(`${base}/${encodeURIComponent(id)}/unhide`, {});
+            if (isJson()) {
+                emitOk("people", data);
+                return EXIT_OK;
+            }
+            console.log(`Restored ${displayName(data.person)}`);
+            return EXIT_OK;
+        }
+        console.error(USAGE);
+        return EXIT_USAGE;
+    }
+    catch (err) {
+        if (isJson())
+            return emitErr("people", err);
+        console.error(err instanceof Error ? err.message : String(err));
+        return exitCodeForError(err);
+    }
+}