@reddoorla/maintenance 0.36.1 → 0.39.0

package/dist/cli/commands/audit.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/util/url.ts","../../../src/util/credentials.ts","../../../src/reports/airtable/client.ts","../../../src/reports/airtable/websites.ts","../../../src/inventory/airtable.ts","../../../src/audits/lighthouse-airtable.ts","../../../src/audits/a11y-airtable.ts","../../../src/audits/deps-airtable.ts","../../../src/audits/security-airtable.ts","../../../src/audits/write-audits-to-airtable.ts","../../../src/cli/commands/audit.ts","../../../src/audits/util/spawn.ts","../../../src/audits/deps.ts","../../../src/util/site.ts","../../../src/configs/baseline-versions.ts","../../../src/audits/deps-outdated.ts","../../../src/audits/lint.ts","../../../src/audits/security.ts","../../../src/audits/lighthouse.ts","../../../src/configs/lighthouse.ts","../../../src/audits/util/site-config.ts","../../../src/util/free-port.ts","../../../src/audits/a11y.ts","../../../src/configs/playwright-a11y.ts","../../../src/audits/index.ts","../../../src/cli/fleet/resolve-sites.ts","../../../src/inventory/local.ts","../../../src/inventory/json.ts","../../../src/cli/fleet/clone-if-needed.ts","../../../src/util/git.ts","../../../src/cli/fleet/prepare-sites.ts","../../../src/util/fleet-workdir.ts"],"sourcesContent":["/**\n * True when `s` parses as an absolute URL whose scheme is `http:` or `https:`.\n *\n * The single allowlist gate for any value we hand to Chrome/Lighthouse. A\n * deployed-audit URL flows in from Airtable's `url` column (or a JSON\n * inventory's `deployedUrl`), so a `file://`/`gopher://`/`data:` value — or a\n * value pointing at an internal host — would otherwise become a local-file read\n * or SSRF when lhci drives a headless browser at it. Restricting to http(s)\n * keeps the audit to the real, network-reachable site.\n */\nexport function isHttpUrl(s: string): boolean {\n  let parsed: URL;\n  try {\n    parsed = new URL(s);\n  } catch {\n    return false;\n  }\n  return parsed.protocol === \"http:\" || parsed.protocol === \"https:\";\n}\n","import { readFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { join } from \"node:path\";\n\n/** Resolve the canonical credentials file path. Respects $XDG_CONFIG_HOME\n *  (Linux/macOS convention) and falls back to ~/.config/reddoor-maint/. */\nexport function defaultCredentialsPath(): string {\n  const base = process.env.XDG_CONFIG_HOME ?? join(homedir(), \".config\");\n  return join(base, \"reddoor-maint\", \"credentials.env\");\n}\n\n/** Parse a tiny subset of dotenv: `KEY=value` per line, `# comments`,\n *  blank lines. A leading `export ` token is stripped (dotenv does this),\n *  so a hand-edited `export AIRTABLE_PAT=…` parses instead of being dropped.\n *  Quoted values strip the surrounding quotes. A non-blank, non-comment line\n *  that still doesn't parse (no `=`, bad key) is skipped with a one-line\n *  stderr warning naming the line number — this is a credentials file, so a\n *  silent drop turns into a confusing \"missing credential\" downstream. */\nexport function parseEnvFile(contents: string): Record<string, string> {\n  const out: Record<string, string> = {};\n  const lines = contents.split(/\\r?\\n/);\n  for (let i = 0; i < lines.length; i++) {\n    const trimmed = lines[i]!.trim();\n    if (!trimmed || trimmed.startsWith(\"#\")) continue;\n    // Strip a leading `export ` so `export KEY=value` (a common hand-edit)\n    // parses the same as `KEY=value`.\n    const line = trimmed.replace(/^export\\s+/, \"\");\n    const eq = line.indexOf(\"=\");\n    const key = eq > 0 ? line.slice(0, eq).trim() : \"\";\n    if (eq <= 0 || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {\n      console.warn(`credentials: skipping unparseable line ${i + 1}: ${trimmed}`);\n      continue;\n    }\n    let value = line.slice(eq + 1).trim();\n    if (\n      (value.startsWith('\"') && value.endsWith('\"')) ||\n      (value.startsWith(\"'\") && value.endsWith(\"'\"))\n    ) {\n      value = value.slice(1, -1);\n    }\n    out[key] = value;\n  }\n  return out;\n}\n\n/** Load credentials from `path` (default: canonical file) into `process.env`.\n *  `process.env` values win — file-defined keys are only applied when the\n *  env var is currently undefined. Missing/unreadable file is a silent\n *  no-op; commands that need the credentials will fail downstream with\n *  their own clear error. Returns the keys actually applied (diagnostics). */\nexport function loadCredentialsIntoEnv(path: string = defaultCredentialsPath()): string[] {\n  let contents: string;\n  try {\n    contents = readFileSync(path, \"utf-8\");\n  } catch {\n    return [];\n  }\n  const parsed = parseEnvFile(contents);\n  const applied: string[] = [];\n  for (const [k, v] of Object.entries(parsed)) {\n    if (process.env[k] === undefined) {\n      process.env[k] = v;\n      applied.push(k);\n    }\n  }\n  return applied;\n}\n","import Airtable from \"airtable\";\nimport { defaultCredentialsPath } from \"../../util/credentials.js\";\n\nexport type AirtableConfig = {\n  apiKey: string;\n  baseId: string;\n};\n\nfunction missing(name: string): Error {\n  return Object.assign(\n    new Error(\n      `${name} not set. Export it in your shell or put it in ${defaultCredentialsPath()} as ${name}=...`,\n    ),\n    { exitCode: 2 },\n  );\n}\n\nexport function readAirtableConfig(): AirtableConfig {\n  const apiKey = process.env.AIRTABLE_PAT;\n  const baseId = process.env.AIRTABLE_BASE_ID;\n  if (!apiKey) throw missing(\"AIRTABLE_PAT\");\n  if (!baseId) throw missing(\"AIRTABLE_BASE_ID\");\n  return { apiKey, baseId };\n}\n\nexport type AirtableBase = ReturnType<typeof openBase>;\n\nexport function openBase(cfg: AirtableConfig) {\n  return new Airtable({ apiKey: cfg.apiKey }).base(cfg.baseId);\n}\n","import type { FieldSet } from \"airtable\";\nimport type { AirtableBase } from \"./client.js\";\nimport type { LighthouseScores } from \"../types.js\";\n\nexport const WEBSITES_TABLE = \"Websites\";\n\nexport type Frequency = \"None\" | \"Monthly\" | \"Quarterly\" | \"Yearly\";\n\nexport type Status =\n  | \"in development\"\n  | \"launch period\"\n  | \"maintenance\"\n  | \"hosting\"\n  | \"probably not our problem\"\n  | \"deprecated\";\n\nexport type WebsiteRow = {\n  id: string;\n  name: string;\n  url: string;\n  status: Status | null;\n  pointOfContact: string | null;\n  maintenanceFreq: Frequency;\n  testingFreq: Frequency;\n  /** Last manually-recorded maintenance day (used as fallback when no Reports row exists). */\n  maintenanceDay: string | null;\n  testingDay: string | null;\n  ga4PropertyId: string | null;\n  /** Operator-supplied query for the Google search-presence check (e.g. the business name).\n   *  Null = no query set → the check is skipped for this site. */\n  searchQuery: string | null;\n  /** Explicit Search Console property for this site (`sc-domain:...` or `https://.../`).\n   *  Null = auto-resolve from the SA's visible properties by host. */\n  searchConsoleProperty: string | null;\n  /** GitHub repo identity as `owner/repo`. Null = no git wiring → self-update ops skip\n   *  (or, for local runs, fall back to the checkout's origin remote). */\n  gitRepo: string | null;\n  reportRecipientsTo: string | null;\n  reportRecipientsCc: string | null;\n  /** First attachment in the Header image field (Airtable's signed URL — fetch before expiry). */\n  headerImage: { url: string; filename: string; type: string } | null;\n  /** Lighthouse \"current state\" snapshot, kept fresh by `audit lighthouse --write-airtable`. */\n  pScore: number | null;\n  rScore: number | null;\n  bpScore: number | null;\n  seoScore: number | null;\n  /** ISO timestamp set by `audit lighthouse --write-airtable` when scores were last refreshed. */\n  lastLighthouseAuditAt: string | null;\n  /** Last-known counts from non-lighthouse audits, written by\n   *  `audit --write-airtable`. `null` = never audited (or this audit\n   *  type was skipped on the last run). 0 = audited, clean. */\n  a11yViolations: number | null;\n  /** Declared-range drift vs the Reddoor baseline (what package.json asks for). */\n  depsDrifted: number | null;\n  depsMajorBehind: number | null;\n  /** Real installed-version drift: deps behind the registry's latest, from the\n   *  committed lockfile (`pnpm outdated`). Null = not determined this run. */\n  depsOutdated: number | null;\n  securityVulnsCritical: number | null;\n  securityVulnsHigh: number | null;\n  securityVulnsModerate: number | null;\n  securityVulnsLow: number | null;\n  /** Per-site copy overrides (M6a). Blank → null → the DEFAULT_COPY value. */\n  copyIntro: string | null;\n  copyContact: string | null;\n  copyFooter: string | null;\n  /** Go-live timestamp, stamped when a Launch report sends (M6b). Null = not yet launched. */\n  launchedAt: string | null;\n  /** GitHub-signals sweep (slice 2a), written nightly by `github-signals --fleet`. */\n  renovateFailingCis: number | null;\n  defaultBranchCi: string | null; // \"passing\" | \"failing\" | \"pending\" | \"none\"\n  lastCommitAt: string | null;\n  githubSignalsAt: string | null;\n};\n\nexport function siteSlug(name: string): string {\n  return name\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, \"-\")\n    .replace(/^-|-$/g, \"\");\n}\n\n/** Blank-trim-to-null: a non-string or whitespace-only value becomes null,\n *  otherwise the trimmed string. */\nfunction trimToNull(raw: unknown): string | null {\n  if (typeof raw !== \"string\") return null;\n  const trimmed = raw.trim();\n  return trimmed.length > 0 ? trimmed : null;\n}\n\n/**\n * Active sites: actively-maintained or pre-launch. Single source of truth for\n * \"is this a live site\" — the operator cockpit shows these, and the fleet\n * audit/report path runs against these. A `null` status (not-yet-active) is\n * deliberately excluded.\n */\nexport const ACTIVE_STATUSES: ReadonlySet<Status> = new Set<Status>([\n  \"maintenance\",\n  \"launch period\",\n]);\n\nexport function isDashboardVisible(site: WebsiteRow): boolean {\n  return site.status !== null && ACTIVE_STATUSES.has(site.status);\n}\n\n// NOTE: every `f[\"...\"]` key below is a load-bearing magic string that must match\n// the live Airtable \"Websites\" column name EXACTLY — including the legacy\n// misspelling `\"maintenence freq\"`, the mixed-case `\"GA4 property ID\"`, and the\n// lowercase `\"url\"` / `\"point of contact\"`. A column rename in Airtable silently\n// returns undefined here (→ null), which degrades quietly (GA skipped, recipients\n// empty) with no error. If you rename a column, change it here too.\nexport function mapRow(rec: { id: string; fields: Record<string, unknown> }): WebsiteRow {\n  const f = rec.fields;\n  const attachments =\n    (f[\"Header image\"] as Array<{ url: string; filename: string; type: string }> | undefined) ?? [];\n  const header = attachments[0] ?? null;\n  return {\n    id: rec.id,\n    name: String(f[\"Name\"] ?? \"\"),\n    url: String(f[\"url\"] ?? \"\"),\n    status: (f[\"Status\"] as Status | undefined) ?? null,\n    pointOfContact: (f[\"point of contact\"] as string | undefined) ?? null,\n    maintenanceFreq: ((f[\"maintenence freq\"] as string | undefined) ?? \"None\") as Frequency,\n    testingFreq: ((f[\"testing freq\"] as string | undefined) ?? \"None\") as Frequency,\n    maintenanceDay: (f[\"maintenance day\"] as string | undefined) ?? null,\n    testingDay: (f[\"testing day\"] as string | undefined) ?? null,\n    ga4PropertyId: (f[\"GA4 property ID\"] as string | undefined) ?? null,\n    searchQuery: (f[\"Search query\"] as string | undefined) ?? null,\n    searchConsoleProperty: (f[\"Search Console property\"] as string | undefined) ?? null,\n    gitRepo: (f[\"Git repo\"] as string | undefined) ?? null,\n    reportRecipientsTo: (f[\"Report recipients (To)\"] as string | undefined) ?? null,\n    reportRecipientsCc: (f[\"Report recipients (CC)\"] as string | undefined) ?? null,\n    headerImage: header,\n    pScore: (f[\"pScore\"] as number | undefined) ?? null,\n    rScore: (f[\"rScore\"] as number | undefined) ?? null,\n    bpScore: (f[\"bpScore\"] as number | undefined) ?? null,\n    seoScore: (f[\"seoScore\"] as number | undefined) ?? null,\n    lastLighthouseAuditAt: (f[\"Last lighthouse audit at\"] as string | undefined) ?? null,\n    a11yViolations: (f[\"A11y Violations\"] as number | undefined) ?? null,\n    depsDrifted: (f[\"Deps Drifted\"] as number | undefined) ?? null,\n    depsMajorBehind: (f[\"Deps Major Behind\"] as number | undefined) ?? null,\n    depsOutdated: (f[\"Deps Outdated\"] as number | undefined) ?? null,\n    securityVulnsCritical: (f[\"Security Vulns Critical\"] as number | undefined) ?? null,\n    securityVulnsHigh: (f[\"Security Vulns High\"] as number | undefined) ?? null,\n    securityVulnsModerate: (f[\"Security Vulns Moderate\"] as number | undefined) ?? null,\n    securityVulnsLow: (f[\"Security Vulns Low\"] as number | undefined) ?? null,\n    copyIntro: trimToNull(f[\"Copy — Intro\"]),\n    copyContact: trimToNull(f[\"Copy — Contact\"]),\n    copyFooter: trimToNull(f[\"Copy — Footer\"]),\n    launchedAt: (f[\"Launched at\"] as string | undefined) ?? null,\n    renovateFailingCis: (f[\"Renovate Failing CIs\"] as number | undefined) ?? null,\n    defaultBranchCi: (f[\"Default Branch CI\"] as string | undefined) ?? null,\n    lastCommitAt: (f[\"Last Commit At\"] as string | undefined) ?? null,\n    githubSignalsAt: (f[\"GitHub Signals At\"] as string | undefined) ?? null,\n  };\n}\n\nexport async function listWebsites(base: AirtableBase): Promise<WebsiteRow[]> {\n  const out: WebsiteRow[] = [];\n  await base(WEBSITES_TABLE)\n    .select({ pageSize: 100 })\n    .eachPage((records, fetchNextPage) => {\n      for (const rec of records) out.push(mapRow({ id: rec.id, fields: rec.fields }));\n      fetchNextPage();\n    });\n  return out;\n}\n\nexport async function getWebsiteBySlug(\n  base: AirtableBase,\n  slug: string,\n): Promise<WebsiteRow | null> {\n  // Slugs are siteSlug() output: [a-z0-9] segments joined by single hyphens.\n  // Reject anything else — it can't match a real row, and it keeps URL-supplied\n  // input out of the filter formula below (formula-injection guard).\n  if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(slug)) return null;\n\n  // Narrow the fetch to the slug-matching row server-side instead of paging the\n  // whole table per request (MEDIUM-H). The formula replicates siteSlug() on\n  // {Name} — lowercase → non-alnum runs to \"-\" → strip leading/trailing \"-\" —\n  // verified against the live base. maxRecords caps it (slug collisions keep the\n  // prior first-match-wins behavior).\n  const formula = `REGEX_REPLACE(REGEX_REPLACE(LOWER({Name}),\"[^a-z0-9]+\",\"-\"),\"^-|-$\",\"\")=${JSON.stringify(\n    slug,\n  )}`;\n  const rows: WebsiteRow[] = [];\n  await base(WEBSITES_TABLE)\n    .select({ filterByFormula: formula, maxRecords: 1 })\n    .eachPage((records, fetchNextPage) => {\n      for (const rec of records) rows.push(mapRow({ id: rec.id, fields: rec.fields }));\n      fetchNextPage();\n    });\n  // Confirm the match in JS too: keeps the function correct if the formula and\n  // siteSlug() ever drift, and under test fakes that don't evaluate the formula.\n  return rows.find((w) => siteSlug(w.name) === slug) ?? null;\n}\n\n// ── audit-field builders ─────────────────────────────────────────────────────\n// One source of truth for the column-name → value mappings of each audit type.\n// The per-audit `updateXxxCounts` writers delegate to these (for their other\n// callers), and `updateAuditFields` merges whichever are present into ONE write —\n// so the field-name magic strings live in exactly one place.\n\nexport type A11yCounts = { violations: number };\nexport type DepsCounts = { drifted: number; majorBehind: number; outdated: number | null };\nexport type SecurityCounts = { critical: number; high: number; moderate: number; low: number };\n\nfunction scoreFields(scores: LighthouseScores): FieldSet {\n  return {\n    pScore: scores.performance,\n    rScore: scores.accessibility,\n    bpScore: scores.bestPractices,\n    seoScore: scores.seo,\n    \"Last lighthouse audit at\": new Date().toISOString(),\n  };\n}\n\nfunction a11yFields(counts: A11yCounts): FieldSet {\n  return { \"A11y Violations\": counts.violations };\n}\n\nfunction depsFields(counts: DepsCounts): FieldSet {\n  const fields: FieldSet = {\n    \"Deps Drifted\": counts.drifted,\n    \"Deps Major Behind\": counts.majorBehind,\n  };\n  // Only write the outdated count when it was determined — a null (no/stale\n  // lockfile this run) must not clobber a previously-good value.\n  if (counts.outdated !== null) {\n    fields[\"Deps Outdated\"] = counts.outdated;\n  }\n  return fields;\n}\n\nfunction securityFields(counts: SecurityCounts): FieldSet {\n  return {\n    \"Security Vulns Critical\": counts.critical,\n    \"Security Vulns High\": counts.high,\n    \"Security Vulns Moderate\": counts.moderate,\n    \"Security Vulns Low\": counts.low,\n  };\n}\n\n/**\n * Write the four Lighthouse scores + a refreshed-at timestamp onto a Websites row.\n * Called by `audit lighthouse --write-airtable` after a successful audit run, so\n * the operator never has to paste numbers manually before drafting a report.\n */\nexport async function updateScores(\n  base: AirtableBase,\n  recordId: string,\n  scores: LighthouseScores,\n): Promise<void> {\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields: scoreFields(scores) }]);\n}\n\n/** Persist a11y violation count. */\nexport async function updateA11yCounts(\n  base: AirtableBase,\n  recordId: string,\n  counts: A11yCounts,\n): Promise<void> {\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields: a11yFields(counts) }]);\n}\n\n/** Persist deps drift counts (declared-range drift + real outdated installs). */\nexport async function updateDepsCounts(\n  base: AirtableBase,\n  recordId: string,\n  counts: DepsCounts,\n): Promise<void> {\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields: depsFields(counts) }]);\n}\n\n/** Persist security vulnerability counts by severity. */\nexport async function updateSecurityCounts(\n  base: AirtableBase,\n  recordId: string,\n  counts: SecurityCounts,\n): Promise<void> {\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields: securityFields(counts) }]);\n}\n\n/**\n * Persist all of a single audit run's results to one Websites row in ONE atomic\n * `update()` — instead of up to four sequential updates on the same id (which left\n * a row half-written on a mid-sequence failure and quadrupled the request volume).\n * Pass only the audit slices that produced real values; each present slice is merged\n * via the SAME field mappings the per-audit writers use. Omit a slice (or pass\n * undefined) to leave those columns untouched. Returns the merged FieldSet so the\n * caller can enumerate what was written.\n */\nexport async function updateAuditFields(\n  base: AirtableBase,\n  recordId: string,\n  audits: {\n    scores?: LighthouseScores;\n    a11y?: A11yCounts;\n    deps?: DepsCounts;\n    security?: SecurityCounts;\n  },\n): Promise<FieldSet> {\n  const fields: FieldSet = {};\n  if (audits.scores) Object.assign(fields, scoreFields(audits.scores));\n  if (audits.a11y) Object.assign(fields, a11yFields(audits.a11y));\n  if (audits.deps) Object.assign(fields, depsFields(audits.deps));\n  if (audits.security) Object.assign(fields, securityFields(audits.security));\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);\n  return fields;\n}\n\n/** Persist the GitHub-signals sweep onto a Websites row (slice 2a). A null\n *  `lastCommitAt` is OMITTED so a not-determined-this-run value never clobbers a\n *  previously-good timestamp (mirrors updateDepsCounts' outdated handling). */\nexport async function updateGitHubSignals(\n  base: AirtableBase,\n  recordId: string,\n  signals: {\n    renovateFailingCis: number;\n    ciState: string;\n    lastCommitAt: string | null;\n    sweptAt: string;\n  },\n): Promise<void> {\n  const fields: FieldSet = {\n    \"Renovate Failing CIs\": signals.renovateFailingCis,\n    \"Default Branch CI\": signals.ciState,\n    \"GitHub Signals At\": signals.sweptAt,\n  };\n  if (signals.lastCommitAt !== null) {\n    fields[\"Last Commit At\"] = signals.lastCommitAt;\n  }\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);\n}\n\n/** Mark a site launched: flip Status → maintenance + stamp Launched at (M6b).\n *  The first code that writes Status. Called after a Launch report sends. */\nexport async function updateLaunched(\n  base: AirtableBase,\n  recordId: string,\n  at: string,\n): Promise<void> {\n  const fields: FieldSet = { Status: \"maintenance\", \"Launched at\": at };\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);\n}\n","import type { Site, InventoryProvider } from \"../types.js\";\nimport type { AirtableBase } from \"../reports/airtable/client.js\";\nimport { listWebsites, siteSlug, ACTIVE_STATUSES } from \"../reports/airtable/websites.js\";\nimport { isHttpUrl } from \"../util/url.js\";\n\nexport type AirtableInventoryOptions = {\n  /**\n   * Local workdir to compute each site's path as `{workdir}/{slug}`.\n   * Defaults to REDDOOR_FLEET_WORKDIR env var if not provided.\n   * Airtable doesn't store local checkout paths, so this is required.\n   */\n  workdir?: string;\n};\n\n/**\n * Read sites from the Airtable Websites table as an InventoryProvider.\n * Each row becomes one Site; `path` is computed as `{workdir}/{slug}`.\n * Only `maintenance` / `launch period` sites that have a `url` are included\n * (the live sites we audit + report on). The production URL is exposed as\n * `Site.deployedUrl` so the lighthouse audit can run against it with no\n * checkout. `repoUrl` is intentionally NOT set from `url` — a clone source\n * must come from `gitRepo` (`owner/repo`), never the production URL.\n */\nexport function fromAirtableBase(\n  base: AirtableBase,\n  opts: AirtableInventoryOptions = {},\n): InventoryProvider {\n  return async (): Promise<Site[]> => {\n    const workdir = opts.workdir ?? process.env.REDDOOR_FLEET_WORKDIR;\n    if (!workdir) {\n      throw new Error(\n        \"fromAirtableBase requires `workdir` option or REDDOOR_FLEET_WORKDIR env (sites need a local path)\",\n      );\n    }\n    const websites = await listWebsites(base);\n    return websites\n      .filter((w) => w.status !== null && ACTIVE_STATUSES.has(w.status) && w.url.length > 0)\n      .flatMap((w) => {\n        const slug = siteSlug(w.name);\n        // An empty slug (a Name with no slug-able characters) can't form a stable\n        // path and — fatally — can't be matched back to its Websites row on\n        // write-back: every empty-slug site would collapse under the \"\" key and\n        // mis-write or fail. Skip it loudly rather than silently mis-map it.\n        if (slug.length === 0) {\n          console.warn(\n            `[inventory] skipping \"${w.name}\" (row ${w.id}): Name has no slug-able characters (empty slug)`,\n          );\n          return [];\n        }\n        const site: Site = {\n          path: `${workdir}/${slug}`,\n          name: slug,\n          meta: { airtableRowId: w.id, displayName: w.name },\n        };\n        // Scheme-allowlist the Airtable `url` before exposing it as the\n        // deployed-audit target (it's handed straight to Chrome/lhci). A\n        // `file://`/`gopher://`/internal-host value would be a local-file read\n        // or SSRF — skip the deployed audit for that site rather than trust it.\n        if (isHttpUrl(w.url)) {\n          site.deployedUrl = w.url;\n        } else {\n          console.warn(\n            `[inventory] skipping deployed audit for \"${w.name}\": url is not http(s): ${JSON.stringify(w.url)}`,\n          );\n        }\n        if (w.gitRepo) site.gitRepo = w.gitRepo;\n        return [site];\n      });\n  };\n}\n","import { readFile } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport type { AuditResult } from \"../types.js\";\nimport type { LighthouseScores } from \"../reports/types.js\";\nimport { siteSlug } from \"../reports/airtable/websites.js\";\n\nconst LIGHTHOUSE_CATEGORIES = [\"performance\", \"accessibility\", \"best-practices\", \"seo\"] as const;\n\n/**\n * True when the result carries real lighthouse scores worth persisting.\n *\n * The `audit --write-airtable` policy used to refuse on any `status: \"fail\"`,\n * but that conflates two very different failure modes:\n *   1. Infrastructure failure (no lhr-*.json written, spawn timeout, etc.)\n *      → `details.summary` empty → all-zeros would corrupt the dashboard\n *   2. Assertion failure (scores below threshold, e.g. best-practices < 0.9)\n *      → `details.summary` has real numbers → tracking these IS the point\n *\n * The dashboard exists to surface drift over time. Refusing to write the\n * very numbers the dashboard wants to plot — just because one assertion\n * tripped — defeats the purpose. Write whenever real scores exist.\n */\nexport function hasRealScores(result: AuditResult): boolean {\n  if (result.audit !== \"lighthouse\") return false;\n  const details = (result.details ?? {}) as { summary?: Record<string, number> };\n  const summary = details.summary ?? {};\n  return LIGHTHOUSE_CATEGORIES.some(\n    (k) => typeof summary[k] === \"number\" && !Number.isNaN(summary[k]),\n  );\n}\n\n/**\n * Extract the four Lighthouse scores (as integer percentages) from a\n * `lighthouse` AuditResult. LHCI manifest summaries are floats in [0,1];\n * multiply + round.\n */\nexport function lighthouseScoresFromResult(result: AuditResult): LighthouseScores {\n  if (result.audit !== \"lighthouse\") {\n    throw new Error(`Expected a 'lighthouse' AuditResult, got '${result.audit}'`);\n  }\n  const details = (result.details ?? {}) as { summary?: Record<string, number> };\n  const summary = details.summary ?? {};\n  const toPct = (n: number | undefined) =>\n    typeof n === \"number\" && !Number.isNaN(n) ? Math.round(n * 100) : 0;\n  return {\n    performance: toPct(summary[\"performance\"]),\n    accessibility: toPct(summary[\"accessibility\"]),\n    bestPractices: toPct(summary[\"best-practices\"]),\n    seo: toPct(summary[\"seo\"]),\n  };\n}\n\n/**\n * Derive a site slug from the cwd's package.json#name. Used by\n * `audit lighthouse --write-airtable` when the operator doesn't pass an\n * explicit slug — the cwd is the site checkout, so package.json#name is\n * usually the canonical site name.\n */\nexport async function resolveSlugFromCwd(cwd: string): Promise<string> {\n  try {\n    const pkgPath = join(cwd, \"package.json\");\n    const raw = await readFile(pkgPath, \"utf-8\");\n    const pkg = JSON.parse(raw) as { name?: string };\n    if (!pkg.name) throw new Error(\"package.json has no 'name' field\");\n    return siteSlug(pkg.name);\n  } catch (e) {\n    throw new Error(\n      `Could not derive site slug from ${cwd}/package.json: ${(e as Error).message}. ` +\n        `Pass --write-airtable=<slug> explicitly.`,\n      { cause: e },\n    );\n  }\n}\n","import type { AuditResult } from \"../types.js\";\n\ntype A11yDetails = {\n  totalViolations: number;\n  byImpact: Partial<Record<\"minor\" | \"moderate\" | \"serious\" | \"critical\", number>>;\n};\n\n/** True when an a11y AuditResult carries real counts worth persisting.\n *  Mirrors the `hasRealScores` policy on lighthouse: write whenever real\n *  data exists, regardless of status (a \"warn\" or \"fail\" with concrete\n *  violation counts is exactly what the dashboard needs to track). */\nexport function hasA11yCounts(result: AuditResult): boolean {\n  if (result.audit !== \"a11y\") return false;\n  const details = result.details as A11yDetails | undefined;\n  return typeof details?.totalViolations === \"number\";\n}\n\nexport function a11yCountsFromResult(result: AuditResult): { violations: number } {\n  if (result.audit !== \"a11y\") {\n    throw new Error(`Expected an 'a11y' AuditResult, got '${result.audit}'`);\n  }\n  const details = result.details as A11yDetails | undefined;\n  return { violations: details?.totalViolations ?? 0 };\n}\n","import type { AuditResult } from \"../types.js\";\nimport type { DepsDetails, DepsDriftEntry } from \"./deps.js\";\n\n/** True when a deps AuditResult carries the structured details (an entries\n *  array, per {@link DepsDetails}). */\nexport function hasDepsCounts(result: AuditResult): boolean {\n  if (result.audit !== \"deps\") return false;\n  const d = result.details as Partial<DepsDetails> | undefined;\n  return Array.isArray(d?.entries);\n}\n\nexport function depsCountsFromResult(result: AuditResult): {\n  drifted: number;\n  majorBehind: number;\n  outdated: number | null;\n} {\n  if (result.audit !== \"deps\") {\n    throw new Error(`Expected a 'deps' AuditResult, got '${result.audit}'`);\n  }\n  const details = (result.details ?? {}) as Partial<DepsDetails>;\n  const entries = (details.entries ?? []) as DepsDriftEntry[];\n  // \"drifted\" = drift !== \"same\", which intentionally includes \"newer\" (ahead of\n  // baseline) — parity with the deps audit summary text.\n  const drifted = entries.filter((e) => e.drift !== \"same\").length;\n  const majorBehind = entries.filter((e) => e.drift === \"major\").length;\n  // The real installed-version drift, distinct from declared-range drift. Null\n  // when the audit couldn't determine it (no/stale lockfile) — kept null (not 0)\n  // so the dashboard shows \"—\" rather than a misleading \"clean\".\n  const outdated = details.outdated?.outdated ?? null;\n  return { drifted, majorBehind, outdated };\n}\n","import type { AuditResult } from \"../types.js\";\n\ntype SecurityDetails = {\n  counts: { low: number; moderate: number; high: number; critical: number };\n};\n\n/** True when a security AuditResult carries a counts object. Skipped runs\n *  (no pnpm + no npm) have no details and return false. */\nexport function hasSecurityCounts(result: AuditResult): boolean {\n  if (result.audit !== \"security\") return false;\n  const details = result.details as SecurityDetails | undefined;\n  return !!details && typeof details.counts === \"object\";\n}\n\nexport function securityCountsFromResult(result: AuditResult): {\n  critical: number;\n  high: number;\n  moderate: number;\n  low: number;\n} {\n  if (result.audit !== \"security\") {\n    throw new Error(`Expected a 'security' AuditResult, got '${result.audit}'`);\n  }\n  const details = result.details as SecurityDetails | undefined;\n  const c = details?.counts ?? { low: 0, moderate: 0, high: 0, critical: 0 };\n  return { critical: c.critical, high: c.high, moderate: c.moderate, low: c.low };\n}\n","import type { AuditResult } from \"../types.js\";\nimport type { AirtableBase } from \"../reports/airtable/client.js\";\nimport { type WebsiteRow, siteSlug, updateAuditFields } from \"../reports/airtable/websites.js\";\nimport type { A11yCounts, DepsCounts, SecurityCounts } from \"../reports/airtable/websites.js\";\nimport type { LighthouseScores } from \"../reports/types.js\";\nimport { hasRealScores, lighthouseScoresFromResult } from \"./lighthouse-airtable.js\";\nimport { hasA11yCounts, a11yCountsFromResult } from \"./a11y-airtable.js\";\nimport { hasDepsCounts, depsCountsFromResult } from \"./deps-airtable.js\";\nimport { hasSecurityCounts, securityCountsFromResult } from \"./security-airtable.js\";\n\ntype WriteSummary = {\n  siteName: string;\n  writes: Array<{\n    audit: \"lighthouse\" | \"a11y\" | \"deps\" | \"security\" | \"github-signals\";\n    counts: object;\n  }>;\n};\n\n/** Orchestrates the per-audit Airtable writes for `audit --write-airtable`.\n *  Extracted from the CLI command so it can be unit-tested with a fake base\n *  and so adding new audit types is a one-line addition here rather than\n *  growing the CLI handler.\n *\n *  Throws (with .exitCode set) on the failure modes the CLI surfaces today:\n *   - 2: --only ran without lighthouse, or no Websites row matched the slug\n *   - 1: lighthouse ran but produced no real scores (infrastructure failure).\n *        The a11y/deps/security writes still complete FIRST — a Lighthouse\n *        miss flags the site without discarding its other audit data.\n *\n *  Precedence note: the Websites-row lookup (exitCode 2) is checked BEFORE the\n *  no-scores gate (exitCode 1), so the rare no-row + no-scores combo surfaces\n *  as exitCode 2. */\nexport async function writeAuditsToAirtable(args: {\n  base: AirtableBase;\n  websites: WebsiteRow[];\n  slug: string;\n  results: AuditResult[];\n}): Promise<WriteSummary> {\n  const { base, websites, slug, results } = args;\n\n  const lhResult = results.find((r) => r.audit === \"lighthouse\");\n  if (!lhResult) {\n    throw Object.assign(\n      new Error(\n        \"--write-airtable requires a lighthouse result; did you pass --only without lighthouse?\",\n      ),\n      { exitCode: 2 },\n    );\n  }\n  const target = websites.find((w) => siteSlug(w.name) === slug);\n  if (!target) {\n    throw Object.assign(new Error(`No Websites row matched slug \"${slug}\"`), { exitCode: 2 });\n  }\n\n  const writes: WriteSummary[\"writes\"] = [];\n  const audits: {\n    scores?: LighthouseScores;\n    a11y?: A11yCounts;\n    deps?: DepsCounts;\n    security?: SecurityCounts;\n  } = {};\n\n  // Collect every audit that produced real values into ONE merged input, then do a\n  // SINGLE atomic Airtable update (was: up to four sequential updates on the same\n  // row — a mid-sequence failure left it half-written yet reported fully failed, at\n  // 4× the request volume). Lighthouse is the most timeout-prone audit: a Lighthouse\n  // miss must NOT discard the site's valid a11y/deps/security results (morning-brief\n  // 2026-06-10 MEDIUM-E). So include Lighthouse scores only when real, include the\n  // other audits whenever present, write all of them in one update, then — if\n  // Lighthouse missed — throw AFTER that atomic write so the site is still flagged\n  // (exitCode 1 / collected in FleetWriteResult.failed) without losing its other data.\n  const lhHasScores = hasRealScores(lhResult);\n  if (lhHasScores) {\n    const scores = lighthouseScoresFromResult(lhResult);\n    audits.scores = scores;\n    writes.push({ audit: \"lighthouse\", counts: scores });\n  }\n\n  const a11y = results.find((r) => r.audit === \"a11y\");\n  if (a11y && hasA11yCounts(a11y)) {\n    const counts = a11yCountsFromResult(a11y);\n    audits.a11y = counts;\n    writes.push({ audit: \"a11y\", counts });\n  }\n\n  const deps = results.find((r) => r.audit === \"deps\");\n  if (deps && hasDepsCounts(deps)) {\n    const counts = depsCountsFromResult(deps);\n    audits.deps = counts;\n    writes.push({ audit: \"deps\", counts });\n  }\n\n  const sec = results.find((r) => r.audit === \"security\");\n  if (sec && hasSecurityCounts(sec)) {\n    const counts = securityCountsFromResult(sec);\n    audits.security = counts;\n    writes.push({ audit: \"security\", counts });\n  }\n\n  // One atomic write of everything that ran. Skip the call only if there is nothing\n  // to write at all (no real scores AND no other audit produced values) — an empty\n  // update is a wasted request.\n  if (Object.keys(audits).length > 0) {\n    await updateAuditFields(base, target.id, audits);\n  }\n\n  if (!lhHasScores) {\n    // Enumerate what WAS persisted so the failure (surfaced to the single-site\n    // CLI operator via console.error) reads as a partial write, not a total one.\n    const persisted = writes.map((w) => w.audit);\n    throw Object.assign(\n      new Error(\n        `Lighthouse audit produced no scores; ${\n          persisted.length ? `wrote ${persisted.join(\"/\")} but refused Lighthouse` : \"wrote nothing\"\n        }. Summary: ${lhResult.summary}`,\n      ),\n      { exitCode: 1 },\n    );\n  }\n\n  return { siteName: target.name, writes };\n}\n\nexport type FleetWriteResult = {\n  written: WriteSummary[];\n  failed: Array<{ slug: string; error: string }>;\n};\n\n/** Render the fleet write-back outcome for the CLI/CI. Beyond the human-readable\n *  lines, it emits a single deterministic, machine-parseable line —\n *  `FLEET_WRITE_SUMMARY wrote=N failed=M total=T` — that the nightly workflow\n *  greps to decide pass/fail. Keying CI on this line (not the prose, and not a\n *  \"wrote ≥ 1\" heuristic) lets the gate tolerate a single known flake while\n *  still reding on a total or mass write-back failure. */\nexport function formatFleetWriteSummary(result: FleetWriteResult): string {\n  const wrote = result.written.length;\n  const failed = result.failed.length;\n  const total = wrote + failed;\n  let out = `→ wrote ${wrote} site(s) to Airtable`;\n  if (failed > 0) {\n    out += `\\n⚠ ${failed} site(s) not written: ${result.failed\n      .map((f) => `${f.slug} (${f.error})`)\n      .join(\"; \")}`;\n  }\n  out += `\\nFLEET_WRITE_SUMMARY wrote=${wrote} failed=${failed} total=${total}`;\n  return out;\n}\n\n/** Write each site's pooled audit results back to its own Websites row,\n *  best-effort. Results are grouped by `result.site` (the slug the fleet\n *  inventory stamped as Site.name). A per-site failure (no scores, no matching\n *  row) is collected — not thrown — so one bad site never aborts the batch. */\nexport async function writeFleetAuditsToAirtable(args: {\n  base: AirtableBase;\n  websites: WebsiteRow[];\n  results: AuditResult[];\n}): Promise<FleetWriteResult> {\n  const { base, websites, results } = args;\n\n  const bySlug = new Map<string, AuditResult[]>();\n  for (const r of results) {\n    const arr = bySlug.get(r.site) ?? [];\n    arr.push(r);\n    bySlug.set(r.site, arr);\n  }\n\n  const written: WriteSummary[] = [];\n  const failed: FleetWriteResult[\"failed\"] = [];\n  // Serial on purpose: even at one (now atomic) update call per site, Airtable's\n  // ~5 req/sec limit means a Promise.all fan-out across the fleet would burst and\n  // trip 429s (silently filed as failures). Below a few dozen sites, serial trades\n  // wall-clock for safety. (morning-brief 2026-06-09 MEDIUM-3.) Add a bounded pool\n  // when the fleet grows.\n  for (const [slug, siteResults] of bySlug) {\n    try {\n      written.push(await writeAuditsToAirtable({ base, websites, slug, results: siteResults }));\n    } catch (e) {\n      failed.push({ slug, error: (e as Error).message });\n    }\n  }\n  return { written, failed };\n}\n","import { resolve } from \"node:path\";\nimport { Listr } from \"listr2\";\nimport { runOneAudit, ALL_AUDIT_NAMES } from \"../../audits/index.js\";\nimport type { AuditName, AuditResult, Site } from \"../../types.js\";\nimport { resolveSites } from \"../fleet/resolve-sites.js\";\nimport {\n  prepareFleetSites,\n  formatSkippedNotice,\n  type SkippedSite,\n} from \"../fleet/prepare-sites.js\";\nimport { isHttpUrl } from \"../../util/url.js\";\nimport { fleetWorkdir } from \"../../util/fleet-workdir.js\";\n\nexport type AuditCommandOptions = {\n  only?: string;\n  json?: boolean;\n  fleet?: string;\n  workdir?: string;\n  cwd?: string;\n  /**\n   * After running, push the lighthouse scores to the matching Websites row\n   * in Airtable. `true` (no value) = derive slug from cwd/package.json#name;\n   * string = explicit slug (e.g. \"med-solutions-of-texas\").\n   */\n  writeAirtable?: string | boolean;\n  /** Exit non-zero if any a11y violations are found (overrides warn). For CI gates. */\n  failOnViolations?: boolean;\n  /** Audit this deployed URL directly (lighthouse only; single-site). */\n  url?: string;\n  /** Max sites to audit in parallel (fleet mode). Unset = all at once;\n   *  `1` = sequential (used by the nightly CI workflow). */\n  concurrency?: string;\n};\n\nfunction parseOnly(value: string | undefined): AuditName[] | undefined {\n  if (!value) return undefined;\n  const names = value.split(\",\").map((s) => s.trim());\n  for (const n of names) {\n    if (!ALL_AUDIT_NAMES.includes(n as AuditName)) {\n      throw Object.assign(new Error(`unknown audit in --only: ${n}`), { exitCode: 2 });\n    }\n  }\n  return names as AuditName[];\n}\n\nfunction formatTable(results: AuditResult[]): string {\n  return results\n    .map((r) => `${r.audit.padEnd(12)} ${r.status.padEnd(5)} ${r.site}\\n  ${r.summary}`)\n    .join(\"\\n\");\n}\n\nexport function auditExitCode(results: AuditResult[], failOnViolations: boolean): number {\n  if (results.some((r) => r.status === \"fail\")) return 1;\n  if (failOnViolations) {\n    const a11yViolations = results\n      .filter((r) => r.audit === \"a11y\")\n      .reduce(\n        (n, r) =>\n          n + ((r.details as { totalViolations?: number } | undefined)?.totalViolations ?? 0),\n        0,\n      );\n    if (a11yViolations > 0) return 1;\n  }\n  return 0;\n}\n\nfunction formatDuration(ms: number): string {\n  if (ms < 1_000) return `${ms}ms`;\n  const totalSeconds = Math.round(ms / 1_000);\n  if (totalSeconds < 60) return `${totalSeconds}s`;\n  const m = Math.floor(totalSeconds / 60);\n  const s = totalSeconds % 60;\n  return `${m}m${s.toString().padStart(2, \"0\")}s`;\n}\n\ntype Renderer = \"default\" | \"silent\";\n\n/** Parse the `--concurrency <n>` flag into a Listr `concurrent` value. Unset →\n *  `true` (all sites in parallel, the interactive default). A positive integer\n *  bounds how many sites audit at once — `--concurrency 1` runs sequentially,\n *  which is what the nightly CI workflow uses so ~10 deployed-Lighthouse runs\n *  don't saturate a 2-core runner (one flaked locally at full parallelism). */\nexport function parseConcurrency(value: string | undefined): boolean | number {\n  if (value === undefined) return true;\n  const n = Number(value);\n  if (!Number.isInteger(n) || n < 1) {\n    throw Object.assign(new Error(`--concurrency must be a positive integer, got \"${value}\"`), {\n      exitCode: 2,\n    });\n  }\n  return n;\n}\n\n/** Build the audit-progress task list. Single-site → each audit is a sibling\n *  task. Fleet → each site is a task whose `output` shows X/N audits done as\n *  they complete (audits-per-site still run in parallel). Results are pushed\n *  into the shared `results` array; tasks throw on `fail` status so listr2\n *  paints them red, but `exitOnError: false` keeps other tasks running. */\nfunction buildAuditTasks(\n  sites: Site[],\n  which: AuditName[],\n  results: AuditResult[],\n  renderer: Renderer,\n  concurrency: boolean | number,\n) {\n  const singleSite = sites.length === 1;\n\n  if (singleSite) {\n    const site = sites[0]!;\n    return new Listr(\n      which.map((name) => ({\n        title: name,\n        task: async (_ctx, task) => {\n          const start = Date.now();\n          const result = await runOneAudit(site, name);\n          results.push(result);\n          const elapsed = formatDuration(Date.now() - start);\n          task.title = `${name}: ${result.summary} (${elapsed})`;\n          if (result.status === \"fail\") throw new Error(result.summary);\n        },\n      })),\n      { concurrent: true, exitOnError: false, renderer },\n    );\n  }\n\n  return new Listr(\n    sites.map((site) => {\n      const label = site.name || site.path; // `||`: empty slug must fall back to path, not blank\n      return {\n        title: label,\n        task: async (_ctx, task) => {\n          const start = Date.now();\n          let done = 0;\n          task.output = `0/${which.length} audits`;\n          const settled = await Promise.all(\n            which.map(async (name) => {\n              const r = await runOneAudit(site, name);\n              results.push(r);\n              done += 1;\n              task.output = `${done}/${which.length} audits`;\n              return r;\n            }),\n          );\n          const elapsed = formatDuration(Date.now() - start);\n          const failed = settled.filter((r) => r.status === \"fail\").length;\n          const warned = settled.filter((r) => r.status === \"warn\").length;\n          const note =\n            failed > 0\n              ? `${failed} failed`\n              : warned > 0\n                ? `${warned} warning${warned === 1 ? \"\" : \"s\"}`\n                : \"all green\";\n          task.title = `${label}: ${note} (${elapsed})`;\n          if (failed > 0) throw new Error(`${label}: ${failed} audit(s) failed`);\n        },\n      };\n    }),\n    { concurrent: concurrency, exitOnError: false, renderer },\n  );\n}\n\ntype WriteSummary = Awaited<\n  ReturnType<typeof import(\"../../audits/write-audits-to-airtable.js\").writeAuditsToAirtable>\n>;\n\nfunction formatWriteSummary(summary: WriteSummary): string {\n  const lines = summary.writes.map((w) => {\n    if (w.audit === \"lighthouse\") {\n      const s = w.counts as {\n        performance: number;\n        accessibility: number;\n        bestPractices: number;\n        seo: number;\n      };\n      return `  lighthouse: P=${s.performance} A=${s.accessibility} BP=${s.bestPractices} SEO=${s.seo}`;\n    }\n    if (w.audit === \"a11y\") {\n      return `  a11y: ${(w.counts as { violations: number }).violations} violations`;\n    }\n    if (w.audit === \"deps\") {\n      const c = w.counts as { drifted: number; majorBehind: number };\n      return `  deps: ${c.drifted} drifted (${c.majorBehind} major)`;\n    }\n    const c = w.counts as { critical: number; high: number; moderate: number; low: number };\n    return `  security: ${c.critical}C/${c.high}H/${c.moderate}M/${c.low}L`;\n  });\n  return `→ wrote to Websites[${summary.siteName}]:\\n${lines.join(\"\\n\")}`;\n}\n\n/** Listr renderer choice. `--json` → silent so stdout stays clean for piping.\n *  Otherwise listr's `default` renderer auto-falls back to `simple` in\n *  non-TTY contexts (CI, log capture, our own integration tests). */\nfunction rendererFor(json: boolean | undefined): Renderer {\n  return json ? \"silent\" : \"default\";\n}\n\n/** When `--url` is set but audits other than lighthouse also ran (those use the\n *  local checkout, not the deployed URL), return a one-line operator notice;\n *  null when there's nothing to warn about. Keeps the mixed-provenance result\n *  table from silently confusing the operator. */\nexport function deployedUrlNotice(\n  which: AuditName[],\n  url: string | undefined,\n  cwd: string,\n): string | null {\n  if (url === undefined) return null;\n  const others = which.filter((n) => n !== \"lighthouse\");\n  if (others.length === 0) return null;\n  return `note: --url only affects lighthouse; ${others.join(\", \")} ran against the local checkout at ${cwd}`;\n}\n\n/** A fleet site needs a local checkout unless every requested audit can run\n *  against its deployed URL. Today only lighthouse has a deployed mode, so a\n *  site is checkout-free exactly when it has a `deployedUrl` and lighthouse is\n *  the only requested audit. */\nexport function auditNeedsCheckout(site: Site, which: AuditName[]): boolean {\n  const deployedCapable = site.deployedUrl !== undefined && which.every((n) => n === \"lighthouse\");\n  return !deployedCapable;\n}\n\n/** Apply a single-site `--url` to the resolved sites. Returns the input\n *  untouched when no url is given; otherwise requires exactly one site and\n *  stamps `deployedUrl` on it so the lighthouse audit takes its deployed path.\n *  The `--url`+`--fleet` combination is rejected earlier in `runAuditCommand`;\n *  this length guard also covers any future multi-site single-run resolver. */\nexport function applyDeployedUrl(sites: Site[], url: string | undefined): Site[] {\n  if (url === undefined) return sites;\n  if (sites.length !== 1) {\n    throw Object.assign(\n      new Error(`--url expects exactly one site, but ${sites.length} resolved.`),\n      { exitCode: 2 },\n    );\n  }\n  // Scheme-allowlist: the URL is handed straight to Chrome/lhci, so only\n  // http(s) is safe (a file:///gopher:// value would be a local-file read /\n  // SSRF). Same predicate the inventory paths use.\n  if (!isHttpUrl(url)) {\n    throw Object.assign(new Error(`--url must be an http(s) URL (got: ${JSON.stringify(url)})`), {\n      exitCode: 2,\n    });\n  }\n  return [{ ...sites[0]!, deployedUrl: url }];\n}\n\nexport async function runAuditCommand(\n  site: string | undefined,\n  opts: AuditCommandOptions,\n): Promise<{ output: string; code: number }> {\n  const which = parseOnly(opts.only) ?? ALL_AUDIT_NAMES;\n  const cwd = opts.cwd ? resolve(opts.cwd) : process.cwd();\n\n  // A literal --write-airtable=<slug> is single-site (the slug names one row).\n  // Boolean --write-airtable + --fleet is fine: each site's slug comes from the\n  // inventory, so there's no cwd-derived-slug ambiguity.\n  if (typeof opts.writeAirtable === \"string\" && opts.fleet !== undefined) {\n    throw Object.assign(\n      new Error(\n        \"--write-airtable=<slug> is single-site; with --fleet each site's slug comes from the inventory. Use --write-airtable (no slug) + --fleet.\",\n      ),\n      { exitCode: 2 },\n    );\n  }\n\n  if (opts.url !== undefined && opts.fleet !== undefined) {\n    throw Object.assign(\n      new Error(\n        \"--url is single-site only and cannot be combined with --fleet. Audit a single site instead.\",\n      ),\n      { exitCode: 2 },\n    );\n  }\n\n  let sites = await resolveSites({\n    ...(site !== undefined ? { site } : {}),\n    ...(opts.fleet !== undefined ? { fleet: opts.fleet } : {}),\n    ...(opts.workdir !== undefined ? { workdir: opts.workdir } : {}),\n    cwd,\n  });\n\n  sites = applyDeployedUrl(sites, opts.url);\n\n  let skippedPrep: SkippedSite[] = [];\n  if (opts.fleet) {\n    const workdir = opts.workdir ?? fleetWorkdir();\n    const prep = await prepareFleetSites(sites, {\n      workdir,\n      needsCheckout: (s) => auditNeedsCheckout(s, which),\n    });\n    sites = prep.prepared;\n    skippedPrep = prep.skipped;\n  }\n\n  const results: AuditResult[] = [];\n  const renderer = rendererFor(opts.json);\n  await buildAuditTasks(sites, which, results, renderer, parseConcurrency(opts.concurrency)).run();\n\n  let output = opts.json ? JSON.stringify(results, null, 2) : formatTable(results);\n\n  // Surface any site that couldn't be prepared (no auditable target, clone\n  // failure) — visibly, but without reding the run. One misconfigured inventory\n  // row is an operator fix, not an outage; the other sites still audited and\n  // wrote back. \"No silent caps\": a dropped site is never invisible.\n  const skipNotice = formatSkippedNotice(skippedPrep);\n  if (skipNotice && !opts.json) output += `\\n\\n${skipNotice}`;\n\n  // Did any site fail to write back to Airtable? The fleet writer collects\n  // per-site failures instead of throwing, so without this the command would\n  // exit 0 while rows silently failed to persist — automation keying on `$?`\n  // would see a clean run. (The single-site writer throws on failure, so it's\n  // already non-zero via the propagated error.)\n  let writeBackFailed = false;\n  if (opts.writeAirtable !== undefined) {\n    const { openBase, readAirtableConfig } = await import(\"../../reports/airtable/client.js\");\n    const { listWebsites } = await import(\"../../reports/airtable/websites.js\");\n\n    if (opts.fleet !== undefined) {\n      const { writeFleetAuditsToAirtable, formatFleetWriteSummary } =\n        await import(\"../../audits/write-audits-to-airtable.js\");\n      const base = openBase(readAirtableConfig());\n      const websites = await listWebsites(base);\n      const fleetWrite = await writeFleetAuditsToAirtable({ base, websites, results });\n      if (fleetWrite.failed.length > 0) writeBackFailed = true;\n      // Gate on !json: the write-summary is human text; appending it after the\n      // results array would corrupt `--json` output (the other notices already\n      // guard this way). The write itself still happens regardless of --json.\n      if (!opts.json) output += `\\n\\n${formatFleetWriteSummary(fleetWrite)}`;\n    } else {\n      const { resolveSlugFromCwd } = await import(\"../../audits/lighthouse-airtable.js\");\n      const { writeAuditsToAirtable } = await import(\"../../audits/write-audits-to-airtable.js\");\n      const slug =\n        typeof opts.writeAirtable === \"string\" && opts.writeAirtable.length > 0\n          ? opts.writeAirtable\n          : await resolveSlugFromCwd(cwd);\n      let writeSummary: WriteSummary | null = null;\n      await new Listr(\n        [\n          {\n            title: `Write to Airtable[${slug}]`,\n            task: async (_ctx, task) => {\n              const base = openBase(readAirtableConfig());\n              task.output = \"loading Websites…\";\n              const websites = await listWebsites(base);\n              task.output = \"writing scores…\";\n              writeSummary = await writeAuditsToAirtable({ base, websites, slug, results });\n              task.title = `Wrote to Websites[${writeSummary.siteName}] (${writeSummary.writes.length} audit type${writeSummary.writes.length === 1 ? \"\" : \"s\"})`;\n            },\n          },\n        ],\n        { renderer },\n      ).run();\n      if (writeSummary && !opts.json) output += `\\n\\n${formatWriteSummary(writeSummary)}`;\n    }\n  }\n\n  const notice = deployedUrlNotice(which, opts.url, cwd);\n  if (notice && !opts.json) output += `\\n\\n${notice}`;\n\n  const code = Math.max(\n    auditExitCode(results, opts.failOnViolations === true),\n    writeBackFailed ? 1 : 0,\n  );\n  return { output, code };\n}\n","import { spawn } from \"node:child_process\";\nimport { StringDecoder } from \"node:string_decoder\";\n\nexport type SpawnResult = { code: number; stdout: string; stderr: string };\n\nexport type SpawnOptions = {\n  cwd?: string;\n  env?: NodeJS.ProcessEnv;\n  timeoutMs?: number;\n  /** When true, the child inherits stdout/stderr so the user sees live\n   * progress (useful for long-running `pnpm up` / `npm install`). The\n   * returned `stdout` and `stderr` will be empty strings in that case. */\n  streaming?: boolean;\n};\n\nexport type SpawnFn = (\n  cmd: string,\n  args: readonly string[],\n  opts?: SpawnOptions,\n) => Promise<SpawnResult>;\n\ntype KillFn = (pid: number, signal: NodeJS.Signals | number) => void;\n\n/** Construction-time knobs, separated from per-call {@link SpawnOptions} mainly\n *  so tests can inject deterministic `spawnImpl`/`killImpl` and a tiny grace. */\nexport type SpawnInternals = {\n  spawnImpl?: typeof spawn;\n  killImpl?: KillFn;\n  /** Delay after SIGTERM before escalating to SIGKILL on a timeout (default 5s). */\n  killGraceMs?: number;\n  /** Cap on captured stdout/stderr length so a runaway child can't OOM the CLI. */\n  maxOutputBytes?: number;\n};\n\nconst TRUNCATION_MARKER = \"\\n…[output truncated]\";\n\nexport function makeSpawn(internals: SpawnInternals = {}): SpawnFn {\n  const spawnImpl = internals.spawnImpl ?? spawn;\n  const killImpl: KillFn = internals.killImpl ?? ((pid, sig) => process.kill(pid, sig));\n  const killGraceMs = internals.killGraceMs ?? 5000;\n  const maxOutputBytes = internals.maxOutputBytes ?? 10 * 1024 * 1024;\n\n  return (cmd, args, opts = {}) =>\n    new Promise((resolve, reject) => {\n      const streaming = opts.streaming === true;\n      const child = spawnImpl(cmd, [...args], {\n        cwd: opts.cwd,\n        env: opts.env ?? process.env,\n        stdio: streaming ? [\"ignore\", \"inherit\", \"inherit\"] : [\"ignore\", \"pipe\", \"pipe\"],\n        // Detach ONLY when a timeout can fire: the child then leads its own\n        // process group, so the timeout can kill the WHOLE tree (vite, and\n        // Chromium under lhci/playwright) via process.kill(-pid), not just the\n        // npx/pnpm wrapper. Without it, killing the wrapper orphaned the\n        // grandchildren — a zombie vite squatting its port, Chrome left running.\n        // We do NOT detach timeout-less streaming calls (pnpm install/up):\n        // detaching gains nothing there (no timeout → no group-kill) and would\n        // break terminal Ctrl-C, which only reaches the foreground group — i.e.\n        // it would re-orphan the very children this guards. We never unref() the\n        // child since we still await it.\n        detached: opts.timeoutMs !== undefined,\n      });\n\n      // Cap appended output so an unbounded stream can't exhaust memory.\n      const cap = (acc: string, chunk: string): string => {\n        if (acc.length >= maxOutputBytes) return acc;\n        const next = acc + chunk;\n        return next.length > maxOutputBytes\n          ? next.slice(0, maxOutputBytes) + TRUNCATION_MARKER\n          : next;\n      };\n\n      let stdout = \"\";\n      let stderr = \"\";\n      // Decode each stream through a StringDecoder so a multibyte UTF-8 char\n      // split across two `data` chunks isn't corrupted: the decoder holds the\n      // partial trailing bytes until the rest arrives, instead of the old\n      // `String(chunk)` which decoded each chunk in isolation (and replaced the\n      // split char with U+FFFD). Flushed via `.end()` on close.\n      const outDecoder = new StringDecoder(\"utf-8\");\n      const errDecoder = new StringDecoder(\"utf-8\");\n      if (!streaming) {\n        child.stdout?.on(\n          \"data\",\n          (chunk: Buffer) => (stdout = cap(stdout, outDecoder.write(chunk))),\n        );\n        child.stderr?.on(\n          \"data\",\n          (chunk: Buffer) => (stderr = cap(stderr, errDecoder.write(chunk))),\n        );\n      }\n\n      /** Signal the child's whole process group; ignore if it's already gone.\n       *  POSIX-only: a negative pid signals the group (the project targets\n       *  macOS/Linux; this is only reached when detached, i.e. on a timeout). */\n      const killGroup = (sig: NodeJS.Signals): void => {\n        if (child.pid === undefined) return;\n        try {\n          killImpl(-child.pid, sig);\n        } catch {\n          // ESRCH: the group already exited between the timeout and the kill.\n        }\n      };\n\n      let killTimer: ReturnType<typeof setTimeout> | undefined;\n      const timer = opts.timeoutMs\n        ? setTimeout(() => {\n            killGroup(\"SIGTERM\");\n            // Escalate if SIGTERM is ignored (a wedged Chrome can swallow it).\n            killTimer = setTimeout(() => killGroup(\"SIGKILL\"), killGraceMs);\n            // Best-effort cleanup AFTER we've already rejected — it must never\n            // hold the CLI open past its real work.\n            killTimer.unref();\n            reject(new Error(`spawn timeout after ${opts.timeoutMs}ms: ${cmd}`));\n          }, opts.timeoutMs)\n        : undefined;\n\n      const clearTimers = (): void => {\n        if (timer) clearTimeout(timer);\n        if (killTimer) clearTimeout(killTimer);\n      };\n\n      child.on(\"error\", (err) => {\n        clearTimers();\n        reject(err);\n      });\n      child.on(\"close\", (code) => {\n        clearTimers();\n        if (!streaming) {\n          // Flush any bytes the decoder buffered mid-character (e.g. a truncated\n          // final UTF-8 sequence). `.end()` returns \"\" when nothing is pending.\n          stdout = cap(stdout, outDecoder.end());\n          stderr = cap(stderr, errDecoder.end());\n        }\n        resolve({ code: code ?? -1, stdout, stderr });\n      });\n    });\n}\n\nexport const defaultSpawn: SpawnFn = makeSpawn();\n","import { readFile } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport type { AuditResult } from \"../types.js\";\nimport { siteLabel } from \"../util/site.js\";\nimport { baselineVersions } from \"../configs/baseline-versions.js\";\nimport type { AuditContext } from \"./util/inject.js\";\nimport { defaultSpawn } from \"./util/spawn.js\";\nimport { scanOutdated, type OutdatedCounts } from \"./deps-outdated.js\";\n\nexport type Drift = \"same\" | \"patch\" | \"minor\" | \"major\" | \"newer\";\n\nexport type DepsDriftEntry = {\n  pkg: string;\n  baseline: string;\n  actual: string;\n  drift: Drift;\n};\n\n/** The deps audit reports TWO signals:\n *  - `entries`: declared-range drift vs the canonical baseline (what the\n *    package.json *asks for*, caret-stripped) — the long-standing signal.\n *  - `outdated`: real installed-version drift vs the registry's latest, from\n *    the committed lockfile (null when it can't be determined). Added so the\n *    \"Deps Drifted\" dashboard number stops being the only — and misleading —\n *    deps signal. */\nexport type DepsDetails = {\n  entries: DepsDriftEntry[];\n  outdated: OutdatedCounts | null;\n};\n\nfunction stripCaret(range: string): string {\n  return range.replace(/^[\\^~]/, \"\");\n}\n\n/** A spec we can drift-compare against a semver baseline: a plain version or\n *  caret/tilde range like \"5.55.10\", \"^5.55.10\", \"~5.0.0\". Excludes \"*\",\n *  \"latest\", \"workspace:*\", \"npm:\"-aliases, and git/URL/file specs — those used\n *  to parse to NaN and produce bogus drift, so they're skipped instead. */\nfunction isComparableRange(spec: string): boolean {\n  return /^[\\^~]?\\d/.test(spec.trim());\n}\n\nfunction parseSemver(v: string): [number, number, number] {\n  const cleaned = stripCaret(v).split(\"-\")[0] ?? \"0.0.0\";\n  const parts = cleaned.split(\".\").map((n) => Number.parseInt(n, 10));\n  return [parts[0] ?? 0, parts[1] ?? 0, parts[2] ?? 0];\n}\n\nfunction compareSemver(actual: string, baseline: string): Drift {\n  const [aMajor, aMinor, aPatch] = parseSemver(actual);\n  const [bMajor, bMinor, bPatch] = parseSemver(baseline);\n  if (aMajor > bMajor) return \"newer\";\n  if (aMajor < bMajor) return \"major\";\n  if (aMinor > bMinor) return \"newer\";\n  if (aMinor < bMinor) return \"minor\";\n  if (aPatch > bPatch) return \"newer\";\n  if (aPatch < bPatch) return \"patch\";\n  return \"same\";\n}\n\nexport async function depsAudit(ctx: AuditContext): Promise<AuditResult> {\n  const pkgPath = join(ctx.site.path, \"package.json\");\n  let pkgRaw: string;\n  try {\n    pkgRaw = await readFile(pkgPath, \"utf-8\");\n  } catch (err) {\n    return {\n      audit: \"deps\",\n      site: siteLabel(ctx.site),\n      status: \"skip\",\n      summary: `no package.json at ${pkgPath}`,\n      details: { error: String(err) },\n    };\n  }\n\n  let pkg: { dependencies?: Record<string, string>; devDependencies?: Record<string, string> };\n  try {\n    pkg = JSON.parse(pkgRaw) as {\n      dependencies?: Record<string, string>;\n      devDependencies?: Record<string, string>;\n    };\n  } catch (err) {\n    return {\n      audit: \"deps\",\n      site: siteLabel(ctx.site),\n      status: \"fail\",\n      summary: `package.json is not valid JSON: ${(err as Error).message}`,\n      details: { error: String(err) },\n    };\n  }\n  const installed: Record<string, string> = {\n    ...(pkg.dependencies ?? {}),\n    ...(pkg.devDependencies ?? {}),\n  };\n\n  const entries: DepsDriftEntry[] = [];\n  for (const [name, baseline] of Object.entries(baselineVersions)) {\n    const actual = installed[name];\n    if (!actual) continue;\n    // Skip non-semver specs (\"*\", \"workspace:*\", \"npm:\"-aliases, git/URL): they\n    // can't be drift-compared and used to yield NaN-driven bogus drift (LOW-3).\n    if (!isComparableRange(actual)) continue;\n    entries.push({\n      pkg: name,\n      baseline,\n      actual,\n      drift: compareSemver(actual, baseline),\n    });\n  }\n\n  const anyMajor = entries.some((d) => d.drift === \"major\");\n  const anyMinor = entries.some((d) => d.drift === \"minor\");\n  const anyNewer = entries.some((d) => d.drift === \"newer\");\n\n  // Status stays driven by the declared-range baseline drift (unchanged\n  // behavior). The outdated count is an independent, informational signal.\n  const status: AuditResult[\"status\"] = anyMajor ? \"fail\" : anyMinor || anyNewer ? \"warn\" : \"pass\";\n\n  const driftSummary =\n    status === \"pass\"\n      ? `all ${entries.length} tracked deps in line with baseline`\n      : status === \"warn\"\n        ? `${entries.filter((d) => d.drift !== \"same\").length} of ${entries.length} tracked deps drifted`\n        : `${entries.filter((d) => d.drift === \"major\").length} deps lagging by a major version`;\n\n  const outdated = await scanOutdated(ctx.site.path, ctx.spawn ?? defaultSpawn);\n  const summary = outdated\n    ? `${driftSummary}; ${outdated.outdated} outdated install(s) (${outdated.major} major)`\n    : driftSummary;\n\n  return {\n    audit: \"deps\",\n    site: siteLabel(ctx.site),\n    status,\n    summary,\n    details: { entries, outdated } satisfies DepsDetails,\n  };\n}\n","import type { Site } from \"../types.js\";\n\n/** Human-friendly label for log/output formatting. Prefer the inventory's\n * `name` when present (e.g. \"caltex-landing\") and fall back to the\n * filesystem `path` when unnamed. Every audit + recipe uses this.\n *\n * Uses `||` (not `??`) deliberately: an Airtable Name that slugs to the EMPTY\n * string (`siteSlug(\"!!!\")` → \"\") is `\"\"`, not null/undefined, so `??` would let\n * it through and render a blank label. `||` falls back to the path. */\nexport function siteLabel(site: Site): string {\n  return site.name || site.path;\n}\n","// Curated map of the framework deps reddoor sites should stay close to.\n// Refreshed at each package release from reddoor-starter's package.json.\n// Versions are caret ranges to mirror what `pnpm add` would produce.\n\nexport const baselineVersions: Record<string, string> = {\n  // SvelteKit core\n  svelte: \"^5.55.10\",\n  \"@sveltejs/kit\": \"^2.61.1\",\n  \"@sveltejs/adapter-netlify\": \"^6.0.4\",\n  \"@sveltejs/adapter-auto\": \"^7.0.1\",\n  \"@sveltejs/vite-plugin-svelte\": \"^7.1.2\",\n  \"svelte-check\": \"^4.4.8\",\n\n  // Build tooling\n  vite: \"^8.0.14\",\n  vitest: \"^4.1.7\",\n  typescript: \"^6.0.3\",\n\n  // Tailwind 4\n  tailwindcss: \"^4.3.0\",\n  \"@tailwindcss/vite\": \"^4.3.0\",\n\n  // Prismic\n  \"@prismicio/client\": \"^7.21.8\",\n  \"@prismicio/svelte\": \"^2.2.1\",\n  \"@slicemachine/adapter-sveltekit\": \"^0.3.96\",\n  \"slice-machine-ui\": \"^2.21.3\",\n\n  // Test tooling\n  \"@playwright/test\": \"^1.60.0\",\n  \"@axe-core/playwright\": \"^4.11.3\",\n  \"@lhci/cli\": \"^0.15.1\",\n\n  // Lint\n  eslint: \"^10.4.0\",\n  \"eslint-plugin-svelte\": \"^3.18.0\",\n  \"eslint-config-prettier\": \"^10.1.8\",\n  prettier: \"^3.8.3\",\n  \"prettier-plugin-svelte\": \"^4.0.1\",\n  \"typescript-eslint\": \"^8.60.0\",\n  \"@eslint/js\": \"^10.0.1\",\n  globals: \"^17.6.0\",\n\n  // Misc\n  \"@lucide/svelte\": \"^1.17.0\",\n  \"@zerodevx/svelte-img\": \"^2.1.2\",\n};\n\nexport default baselineVersions;\n","import { stat } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport type { SpawnFn } from \"./util/spawn.js\";\n\n/** Real installed-version drift, distinct from the declared-range \"drift\" the\n *  deps audit computes against the baseline: how many dependencies are behind\n *  the registry's latest, per the committed lockfile. */\nexport type OutdatedCounts = { outdated: number; major: number };\n\nasync function exists(path: string): Promise<boolean> {\n  try {\n    await stat(path);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nfunction majorOf(version: string): number {\n  const head = version.replace(/^[\\^~]/, \"\").split(\".\")[0] ?? \"0\";\n  const n = Number.parseInt(head, 10);\n  return Number.isNaN(n) ? 0 : n;\n}\n\n/**\n * Count outdated dependencies for a site, using its committed lockfile as the\n * source of truth for \"what's installed/deployed\". Returns `null` (skip — the\n * caller degrades gracefully) when it can't determine this:\n *  - no `pnpm-lock.yaml` (not a pnpm site, or never installed)\n *  - the lockfile is stale vs package.json (`--frozen-lockfile` install fails)\n *  - `pnpm outdated` output isn't parseable\n *\n * `pnpm outdated` exits non-zero precisely WHEN there are outdated packages, so\n * its exit code is ignored and only its JSON is parsed. `--frozen-lockfile`\n * never mutates the lockfile, so this stays read-only with respect to the repo.\n */\nexport async function scanOutdated(\n  sitePath: string,\n  spawn: SpawnFn,\n): Promise<OutdatedCounts | null> {\n  if (!(await exists(join(sitePath, \"pnpm-lock.yaml\")))) return null;\n\n  // Everything below is best-effort: a thrown spawn (timeout, `pnpm` not on\n  // PATH, spawn error) must degrade to a skip (null), NOT bubble up and flip the\n  // whole deps audit to a hard fail — the declared-range drift is independent of\n  // pnpm and must still report. (Mirrors securityAudit's try/catch.)\n  try {\n    // Materialize node_modules from the lockfile, but only when it's missing —\n    // an already-installed checkout skips the cold install. `--frozen-lockfile`\n    // never rewrites the lockfile (read-only wrt the repo) and fails fast on a\n    // lockfile out of sync with package.json → skip.\n    if (!(await exists(join(sitePath, \"node_modules\")))) {\n      const install = await spawn(\"pnpm\", [\"install\", \"--frozen-lockfile\"], {\n        cwd: sitePath,\n        timeoutMs: 180_000,\n      });\n      if (install.code !== 0) return null;\n    }\n\n    // `pnpm outdated` exits non-zero precisely WHEN there are outdated packages,\n    // so its exit code is ignored and only its JSON is parsed.\n    const res = await spawn(\"pnpm\", [\"outdated\", \"--json\"], {\n      cwd: sitePath,\n      timeoutMs: 60_000,\n    });\n    const parsed = JSON.parse(res.stdout || \"{}\") as Record<\n      string,\n      { current?: string; latest?: string }\n    >;\n    const entries = Object.values(parsed);\n    return {\n      outdated: entries.length,\n      major: entries.filter((e) => e.current && e.latest && majorOf(e.latest) > majorOf(e.current))\n        .length,\n    };\n  } catch {\n    return null;\n  }\n}\n","import { existsSync } from \"node:fs\";\nimport { readFile } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport { ESLint } from \"eslint\";\nimport { check as prettierCheck, resolveConfig as prettierResolveConfig } from \"prettier\";\nimport { glob } from \"tinyglobby\";\nimport type { AuditResult } from \"../types.js\";\nimport { siteLabel } from \"../util/site.js\";\nimport type { AuditContext } from \"./util/inject.js\";\n\nconst TARGET_GLOBS = [\"**/*.{ts,js,svelte}\"];\nconst IGNORE = [\"node_modules/**\", \"dist/**\", \".svelte-kit/**\", \"build/**\", \".netlify/**\"];\n\nasync function listFiles(cwd: string): Promise<string[]> {\n  return glob(TARGET_GLOBS, { cwd, ignore: IGNORE, absolute: false });\n}\n\nexport async function lintAudit(ctx: AuditContext): Promise<AuditResult> {\n  const { site } = ctx;\n  const configPath = join(site.path, \"eslint.config.js\");\n\n  if (!existsSync(configPath)) {\n    return {\n      audit: \"lint\",\n      site: siteLabel(site),\n      status: \"skip\",\n      summary: \"no eslint config at site root\",\n    };\n  }\n\n  const eslint = new ESLint({\n    cwd: site.path,\n    overrideConfigFile: configPath,\n    errorOnUnmatchedPattern: false,\n  });\n\n  const relFiles = await listFiles(site.path);\n\n  // Pass relative paths to ESLint; its cwd is already site.path. Avoids\n  // dereferencing symlinks on pnpm workspaces.\n  const eslintResults = await eslint.lintFiles(relFiles);\n  const eslintErrors = eslintResults.reduce((n, r) => n + r.errorCount, 0);\n  const eslintWarnings = eslintResults.reduce((n, r) => n + r.warningCount, 0);\n\n  const prettierUnformatted: string[] = [];\n  for (const rel of relFiles) {\n    const absForResolve = join(site.path, rel);\n    const source = await readFile(absForResolve, \"utf-8\");\n    const options = (await prettierResolveConfig(absForResolve)) ?? {};\n    const ok = await prettierCheck(source, { ...options, filepath: absForResolve });\n    if (!ok) prettierUnformatted.push(rel);\n  }\n\n  const status: AuditResult[\"status\"] =\n    eslintErrors > 0 || prettierUnformatted.length > 0\n      ? \"fail\"\n      : eslintWarnings > 0\n        ? \"warn\"\n        : \"pass\";\n\n  const summary =\n    status === \"pass\"\n      ? `lint clean across ${relFiles.length} files`\n      : `${eslintErrors} eslint errors, ${eslintWarnings} warnings, ${prettierUnformatted.length} unformatted`;\n\n  return {\n    audit: \"lint\",\n    site: siteLabel(site),\n    status,\n    summary,\n    details: {\n      eslintErrors,\n      eslintWarnings,\n      prettierUnformatted,\n      files: relFiles.length,\n    },\n  };\n}\n","import type { AuditResult } from \"../types.js\";\nimport { siteLabel } from \"../util/site.js\";\nimport { defaultSpawn, type SpawnResult } from \"./util/spawn.js\";\nimport type { AuditContext } from \"./util/inject.js\";\n\ntype Severity = \"low\" | \"moderate\" | \"high\" | \"critical\";\n\ntype Counts = { low: number; moderate: number; high: number; critical: number };\n\ntype AdvisoryEntry = {\n  module: string;\n  severity: Severity;\n  title: string;\n  cves?: string[];\n  url?: string;\n};\n\n// pnpm audit output (npm-compat with extra advisories map keyed by ID).\ntype PnpmAuditJson = {\n  metadata?: { vulnerabilities?: Partial<Counts> };\n  advisories?: Record<\n    string,\n    {\n      id?: number;\n      title?: string;\n      module_name?: string;\n      severity?: string;\n      cves?: string[];\n      url?: string;\n    }\n  >;\n};\n\n// npm v7+ shape (vulnerabilities keyed by package name).\ntype NpmAuditJson = {\n  metadata?: { vulnerabilities?: Partial<Counts> };\n  vulnerabilities?: Record<\n    string,\n    {\n      name?: string;\n      severity?: string;\n      via?: unknown;\n      url?: string;\n    }\n  >;\n};\n\nfunction classify(v: Counts) {\n  if (v.critical > 0 || v.high > 0) return \"fail\" as const;\n  if (v.moderate > 0 || v.low > 0) return \"warn\" as const;\n  return \"pass\" as const;\n}\n\nfunction normalizeSeverity(s: unknown): Severity {\n  if (s === \"low\" || s === \"moderate\" || s === \"high\" || s === \"critical\") return s;\n  // npm/pnpm sometimes emit \"info\" for informational advisories. Map down\n  // rather than defaulting to \"moderate\" (which would inflate severity).\n  return \"low\";\n}\n\nfunction extractAdvisoriesFromPnpm(parsed: PnpmAuditJson): AdvisoryEntry[] {\n  const out: AdvisoryEntry[] = [];\n  for (const a of Object.values(parsed.advisories ?? {})) {\n    if (!a) continue;\n    out.push({\n      module: a.module_name ?? \"unknown\",\n      severity: normalizeSeverity(a.severity),\n      title: a.title ?? \"(no title)\",\n      ...(a.cves ? { cves: a.cves } : {}),\n      ...(a.url ? { url: a.url } : {}),\n    });\n  }\n  return out;\n}\n\n/** Walk an npm v7+ `via` chain to find the root entry whose `via` array\n * contains a real advisory object (rather than another package name string).\n * Returns the package name at the root and the advisory detail. */\nfunction resolveNpmAdvisoryRoot(\n  startName: string,\n  vulnerabilities: NonNullable<NpmAuditJson[\"vulnerabilities\"]>,\n): { rootName: string; detail?: { title?: string; url?: string } } {\n  const seen = new Set<string>();\n  let current = startName;\n  while (!seen.has(current)) {\n    seen.add(current);\n    const entry = vulnerabilities[current];\n    if (!entry || !Array.isArray(entry.via)) return { rootName: current };\n\n    const detailed = entry.via.find(\n      (e): e is { title?: string; url?: string } => typeof e === \"object\" && e !== null,\n    );\n    if (detailed) return { rootName: current, detail: detailed };\n\n    const next = entry.via.find((e): e is string => typeof e === \"string\");\n    if (!next || next === current) return { rootName: current };\n    current = next;\n  }\n  return { rootName: current };\n}\n\nfunction extractAdvisoriesFromNpm(parsed: NpmAuditJson): AdvisoryEntry[] {\n  const vulnerabilities = parsed.vulnerabilities ?? {};\n  const roots = new Map<string, AdvisoryEntry>();\n\n  for (const [name, v] of Object.entries(vulnerabilities)) {\n    if (!v) continue;\n    const { rootName, detail } = resolveNpmAdvisoryRoot(name, vulnerabilities);\n    if (roots.has(rootName)) continue; // already surfaced via another transitive entry\n\n    const rootEntry = vulnerabilities[rootName];\n    const severity = normalizeSeverity(rootEntry?.severity ?? v.severity);\n    const title = detail?.title ?? rootName;\n    const url = detail?.url;\n\n    roots.set(rootName, {\n      module: rootEntry?.name ?? rootName,\n      severity,\n      title,\n      ...(url ? { url } : {}),\n    });\n  }\n\n  return [...roots.values()];\n}\n\ntype ToolResult =\n  | { kind: \"missing\" }\n  | { kind: \"error\"; reason: string }\n  | { kind: \"ok\"; parsed: PnpmAuditJson & NpmAuditJson };\n\nasync function runAuditTool(\n  spawn: (cmd: string, args: readonly string[], opts?: { cwd?: string }) => Promise<SpawnResult>,\n  cmd: string,\n  args: readonly string[],\n  cwd: string,\n): Promise<ToolResult> {\n  let raw: SpawnResult;\n  try {\n    raw = await spawn(cmd, args, { cwd });\n  } catch (err) {\n    const e = err as NodeJS.ErrnoException;\n    if (e.code === \"ENOENT\" || /ENOENT/.test(String(err))) return { kind: \"missing\" };\n    return { kind: \"error\", reason: `spawn failed: ${String(err).slice(0, 200)}` };\n  }\n\n  // 0 = clean, 1 = vulns found. Anything else is a real error.\n  if (raw.code !== 0 && raw.code !== 1) {\n    return {\n      kind: \"error\",\n      reason: `exit ${raw.code}${raw.stderr ? `: ${raw.stderr.slice(0, 150)}` : \"\"}`,\n    };\n  }\n\n  let parsed: PnpmAuditJson & NpmAuditJson;\n  try {\n    parsed = JSON.parse(raw.stdout || \"{}\") as PnpmAuditJson & NpmAuditJson;\n  } catch (err) {\n    return { kind: \"error\", reason: `unparseable JSON: ${String(err).slice(0, 100)}` };\n  }\n\n  // pnpm error envelope: { error: { code, message } }. npm sometimes emits\n  // a top-level error too. Either means the audit didn't actually run.\n  const errEnvelope = (parsed as unknown as { error?: { code?: string } }).error;\n  if (errEnvelope && typeof errEnvelope === \"object\") {\n    return { kind: \"error\", reason: errEnvelope.code ?? \"error envelope returned\" };\n  }\n\n  // Without metadata.vulnerabilities there are no counts to report and we\n  // can't trust the result. An empty `{}` is just as suspect as a missing\n  // key — counts default to 0 and we'd silently report \"pass\". Treat both\n  // as a tool failure so the caller can fall through to the other audit.\n  const vulnsMeta = parsed.metadata?.vulnerabilities;\n  if (!vulnsMeta || Object.keys(vulnsMeta).length === 0) {\n    return { kind: \"error\", reason: \"no metadata.vulnerabilities in output\" };\n  }\n\n  return { kind: \"ok\", parsed };\n}\n\nexport async function securityAudit(ctx: AuditContext): Promise<AuditResult> {\n  const spawn = ctx.spawn ?? defaultSpawn;\n  const site = ctx.site;\n  const label = siteLabel(site);\n\n  let used: \"pnpm audit\" | \"npm audit\" = \"pnpm audit\";\n  let result = await runAuditTool(spawn, \"pnpm\", [\"audit\", \"--json\", \"--prod\"], site.path);\n\n  // Fall through to npm if pnpm is missing OR pnpm couldn't actually\n  // audit the project (e.g., no pnpm-lock.yaml). Previously we only fell\n  // through on ENOENT, which meant npm-using sites silently reported \"pass\"\n  // because pnpm returned an error envelope with no metadata.\n  if (result.kind !== \"ok\") {\n    const pnpmReason = result.kind === \"missing\" ? \"not installed\" : result.reason;\n    const npmResult = await runAuditTool(\n      spawn,\n      \"npm\",\n      [\"audit\", \"--json\", \"--omit=dev\"],\n      site.path,\n    );\n    if (npmResult.kind === \"ok\") {\n      result = npmResult;\n      used = \"npm audit\";\n    } else {\n      const npmReason = npmResult.kind === \"missing\" ? \"not installed\" : npmResult.reason;\n      return {\n        audit: \"security\",\n        site: label,\n        status: \"skip\",\n        summary: `cannot run audit — pnpm: ${pnpmReason}; npm: ${npmReason}`,\n      };\n    }\n  }\n\n  const parsed = result.parsed;\n\n  const counts: Counts = {\n    low: parsed.metadata?.vulnerabilities?.low ?? 0,\n    moderate: parsed.metadata?.vulnerabilities?.moderate ?? 0,\n    high: parsed.metadata?.vulnerabilities?.high ?? 0,\n    critical: parsed.metadata?.vulnerabilities?.critical ?? 0,\n  };\n\n  const advisories =\n    used === \"pnpm audit\" ? extractAdvisoriesFromPnpm(parsed) : extractAdvisoriesFromNpm(parsed);\n\n  const status = classify(counts);\n  const total = counts.low + counts.moderate + counts.high + counts.critical;\n  const summary =\n    status === \"pass\"\n      ? `${used}: 0 vulnerabilities`\n      : `${used}: ${total} vulnerabilities (${counts.critical}C/${counts.high}H/${counts.moderate}M/${counts.low}L)`;\n\n  return {\n    audit: \"security\",\n    site: label,\n    status,\n    summary,\n    details: { counts, advisories },\n  };\n}\n","import { readFile, writeFile, mkdtemp, rm, readdir } from \"node:fs/promises\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport type { AuditResult, Site } from \"../types.js\";\nimport { siteLabel } from \"../util/site.js\";\nimport { lighthouseConfig } from \"../configs/lighthouse.js\";\nimport { defaultSpawn } from \"./util/spawn.js\";\nimport type { SpawnFn, SpawnResult } from \"./util/spawn.js\";\nimport type { AuditContext } from \"./util/inject.js\";\nimport { readSiteConfig } from \"./util/site-config.js\";\nimport { findFreePort, withFreePort } from \"../util/free-port.js\";\n\ntype ManifestEntry = {\n  url: string;\n  summary: Record<string, number>;\n  htmlPath?: string;\n  jsonPath?: string;\n};\n\ntype AssertionResult = {\n  name: string;\n  actual: number;\n  expected: number;\n  operator: string;\n  passed: boolean;\n  level: \"warn\" | \"error\";\n  auditProperty?: string;\n  auditId?: string;\n};\n\ntype NormalizedLhciResult = {\n  summary: Record<string, number>;\n  assertionsFailed: number;\n  assertions: Array<{ category: string; level: \"warn\" | \"error\"; message: string }>;\n};\n\nasync function readJsonMaybe<T>(path: string): Promise<T | null> {\n  try {\n    const raw = await readFile(path, \"utf-8\");\n    return JSON.parse(raw) as T;\n  } catch {\n    return null;\n  }\n}\n\ntype LhrFile = {\n  requestedUrl: string;\n  finalUrl?: string;\n  categories: Record<string, { score: number | null }>;\n};\n\n/**\n * Build manifest-equivalent entries by scanning the `.lighthouseci/` dir\n * for `lhr-*.json` files written by `lhci collect`. We used to read\n * `manifest.json` directly, but lhci 0.15+ no longer writes it — the\n * audit would silently return \"no manifest written\" against a perfectly\n * healthy run. Reproduced on caltex 2026-05-28 (0.10.5 dogfood).\n */\nasync function readLhrEntries(resultsDir: string): Promise<ManifestEntry[]> {\n  const files = await readdir(resultsDir).catch(() => [] as string[]);\n  const entries: ManifestEntry[] = [];\n  for (const f of files) {\n    if (!f.startsWith(\"lhr-\") || !f.endsWith(\".json\")) continue;\n    const lhr = await readJsonMaybe<LhrFile>(join(resultsDir, f));\n    if (!lhr || !lhr.categories) continue;\n    const summary: Record<string, number> = {};\n    for (const [k, v] of Object.entries(lhr.categories)) {\n      if (typeof v?.score === \"number\") summary[k] = v.score;\n    }\n    entries.push({ url: lhr.requestedUrl, summary });\n  }\n  return entries;\n}\n\nfunction averageSummaries(entries: ManifestEntry[]): Record<string, number> {\n  if (entries.length === 0) return {};\n  const sums: Record<string, number> = {};\n  const counts: Record<string, number> = {};\n  for (const e of entries) {\n    for (const [k, v] of Object.entries(e.summary ?? {})) {\n      if (typeof v !== \"number\") continue;\n      sums[k] = (sums[k] ?? 0) + v;\n      counts[k] = (counts[k] ?? 0) + 1;\n    }\n  }\n  const out: Record<string, number> = {};\n  for (const k of Object.keys(sums)) {\n    const total = sums[k] ?? 0;\n    const count = counts[k] ?? 1;\n    out[k] = total / count;\n  }\n  return out;\n}\n\nfunction categoryFromAssertion(a: AssertionResult): string {\n  // `name` looks like \"categories:accessibility\" or \"audits:uses-http2\".\n  const colonIdx = a.name.indexOf(\":\");\n  return colonIdx >= 0 ? a.name.slice(colonIdx + 1) : a.name;\n}\n\nfunction messageForAssertion(a: AssertionResult): string {\n  // `a.actual` is parsed from external lhci/Lighthouse JSON; a malformed or\n  // missing value (not a number) would make `.toFixed` throw and crash the whole\n  // audit. Guard it and fall back to a readable string instead.\n  const actual = typeof a.actual === \"number\" ? a.actual.toFixed(2) : \"n/a\";\n  return `${a.name} ${a.operator} ${a.expected} (actual: ${actual})`;\n}\n\n/** Shared tail: scan `.lighthouseci/` for lhr-*.json + assertion-results.json and\n *  build the AuditResult. Identical for the checkout and deployed paths. */\nasync function parseLhciResults(\n  resultsDir: string,\n  label: string,\n  raw: SpawnResult,\n): Promise<AuditResult> {\n  const manifest = await readLhrEntries(resultsDir);\n\n  if (manifest.length === 0) {\n    return {\n      audit: \"lighthouse\",\n      site: label,\n      status: \"fail\",\n      summary: `lighthouse: no lhr-*.json written (exit ${raw.code})${\n        raw.stderr ? ` — ${raw.stderr.slice(0, 200)}` : \"\"\n      }`,\n    };\n  }\n\n  const assertionResults =\n    (await readJsonMaybe<AssertionResult[]>(join(resultsDir, \"assertion-results.json\"))) ?? [];\n\n  const failed = assertionResults.filter((a) => !a.passed);\n  const assertions = failed.map((a) => ({\n    category: categoryFromAssertion(a),\n    level: a.level,\n    message: messageForAssertion(a),\n  }));\n\n  const anyError = assertions.some((a) => a.level === \"error\");\n  const anyWarn = assertions.some((a) => a.level === \"warn\");\n  const status: AuditResult[\"status\"] = anyError ? \"fail\" : anyWarn ? \"warn\" : \"pass\";\n\n  const normalized: NormalizedLhciResult = {\n    summary: averageSummaries(manifest),\n    assertionsFailed: failed.length,\n    assertions,\n  };\n\n  const summary =\n    status === \"pass\"\n      ? \"lighthouse: all categories passing\"\n      : `lighthouse: ${failed.length} assertion(s) failed`;\n\n  return { audit: \"lighthouse\", site: label, status, summary, details: normalized };\n}\n\n/** Checkout mode (unchanged behavior): boot the site's vite dev server on a\n *  pinned free port and audit the local fixtures/override URL. */\nasync function checkoutLighthouse(spawn: SpawnFn, site: Site, label: string): Promise<AuditResult> {\n  const siteCfg = await readSiteConfig(site.path);\n  // Allocate a free port + force vite to `--strictPort` so the spawned dev\n  // server either binds the port we picked or fails loudly (caltex 2026-05-28\n  // zombie-vite incident).\n  const port = await findFreePort();\n  const baseUrl = siteCfg.lighthouseUrl ?? lighthouseConfig.ci.collect.url[0];\n  const resolvedConfig = {\n    ...lighthouseConfig,\n    ci: {\n      ...lighthouseConfig.ci,\n      collect: {\n        ...lighthouseConfig.ci.collect,\n        url: [withFreePort(baseUrl, port)],\n        startServerCommand: `npm run vite:dev -- --port ${port} --strictPort`,\n      },\n    },\n  };\n\n  const configDir = await mkdtemp(join(tmpdir(), \"reddoor-lhci-\"));\n  const configPath = join(configDir, \"lighthouserc.json\");\n  await writeFile(configPath, JSON.stringify(resolvedConfig), \"utf-8\");\n\n  const resultsDir = join(site.path, \".lighthouseci\");\n  await rm(resultsDir, { recursive: true, force: true });\n\n  let raw: SpawnResult;\n  try {\n    raw = await spawn(\"npx\", [\"--yes\", \"@lhci/cli\", \"autorun\", `--config=${configPath}`], {\n      cwd: site.path,\n      timeoutMs: 5 * 60_000,\n    });\n  } catch (err) {\n    await rm(configDir, { recursive: true, force: true });\n    const e = err as NodeJS.ErrnoException;\n    if (e.code === \"ENOENT\" || /ENOENT/.test(String(err))) {\n      return {\n        audit: \"lighthouse\",\n        site: label,\n        status: \"skip\",\n        summary: \"npx/@lhci/cli not available\",\n      };\n    }\n    throw err;\n  }\n  await rm(configDir, { recursive: true, force: true });\n\n  return parseLhciResults(resultsDir, label, raw);\n}\n\n/** Deployed mode: audit a production URL directly — no checkout, no dev server.\n *  Runs in a throwaway tmp cwd; uploads to the filesystem so fleet runs never\n *  push 200 public reports to temporary-public-storage. */\nasync function deployedLighthouse(\n  spawn: SpawnFn,\n  deployedUrl: string,\n  label: string,\n): Promise<AuditResult> {\n  const workDir = await mkdtemp(join(tmpdir(), \"reddoor-lh-deployed-\"));\n  const resolvedConfig = {\n    ci: {\n      // Deliberately NOT spread from lighthouseConfig.ci.collect: deployed mode\n      // must omit startServerCommand and the dev-server settings entirely.\n      collect: {\n        url: [deployedUrl],\n        // 3 runs to damp Lighthouse's run-to-run variance; parseLhciResults\n        // averages the lhr files. (Median is a tracked future refinement.)\n        numberOfRuns: 3,\n        settings: { preset: \"desktop\", skipAudits: [\"uses-http2\"] },\n      },\n      assert: lighthouseConfig.ci.assert,\n      upload: { target: \"filesystem\", outputDir: join(workDir, \"lhci-report\") },\n    },\n  };\n\n  const configPath = join(workDir, \"lighthouserc.json\");\n  await writeFile(configPath, JSON.stringify(resolvedConfig), \"utf-8\");\n\n  const resultsDir = join(workDir, \".lighthouseci\");\n\n  let raw: SpawnResult;\n  try {\n    raw = await spawn(\"npx\", [\"--yes\", \"@lhci/cli\", \"autorun\", `--config=${configPath}`], {\n      cwd: workDir,\n      // 3 serial cold runs of a slow deployed site (lhci's own maxWaitForLoad\n      // ~45-60s each) + first-use Chrome download can plausibly exceed 3 min →\n      // SIGTERM → no lhr-*.json → spurious \"no scores\". Match the 5-min budget\n      // the checkout path already gives (erp-industrials nightly flake,\n      // morning-brief 2026-06-10 MEDIUM-F).\n      timeoutMs: 5 * 60_000,\n    });\n  } catch (err) {\n    await rm(workDir, { recursive: true, force: true });\n    const e = err as NodeJS.ErrnoException;\n    if (e.code === \"ENOENT\" || /ENOENT/.test(String(err))) {\n      return {\n        audit: \"lighthouse\",\n        site: label,\n        status: \"skip\",\n        summary: \"npx/@lhci/cli not available\",\n      };\n    }\n    throw err;\n  }\n\n  try {\n    return await parseLhciResults(resultsDir, label, raw);\n  } finally {\n    await rm(workDir, { recursive: true, force: true });\n  }\n}\n\nexport async function lighthouseAudit(ctx: AuditContext): Promise<AuditResult> {\n  const spawn = ctx.spawn ?? defaultSpawn;\n  const site = ctx.site;\n  const label = siteLabel(site);\n\n  return site.deployedUrl\n    ? deployedLighthouse(spawn, site.deployedUrl, label)\n    : checkoutLighthouse(spawn, site, label);\n}\n","export const lighthouseConfig = {\n  ci: {\n    collect: {\n      url: [\"http://localhost:5173/dev/a11y-fixtures\"],\n      // `npm run vite:dev` works on both pnpm and npm sites — pnpm respects\n      // the `run` form too. Keeps this config portable across the fleet\n      // while sites transition to pnpm.\n      startServerCommand: \"npm run vite:dev\",\n      startServerReadyPattern: \"ready in\",\n      startServerReadyTimeout: 120_000,\n      numberOfRuns: 1,\n      settings: {\n        preset: \"desktop\",\n        skipAudits: [\"uses-http2\"],\n      },\n    },\n    assert: {\n      assertions: {\n        \"categories:accessibility\": [\"error\", { minScore: 0.95 }],\n        \"categories:best-practices\": [\"error\", { minScore: 0.9 }],\n        \"categories:seo\": [\"error\", { minScore: 0.9 }],\n        \"categories:performance\": [\"warn\", { minScore: 0.7 }],\n      },\n    },\n    upload: {\n      target: \"temporary-public-storage\",\n    },\n  },\n} as const;\n\nexport default lighthouseConfig;\n","import { readFile } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\nexport type SiteConfig = {\n  /** Override URL the lighthouse audit hits. Sites without the default\n   * `/dev/a11y-fixtures` dev route set this to their homepage. */\n  lighthouseUrl?: string;\n};\n\n/**\n * Read per-site overrides from `package.json#reddoor`. Returns `{}` on any\n * failure (missing file, malformed JSON, missing key, wrong type) so every\n * caller can safely fall back to its built-in default. Never throws.\n */\nexport async function readSiteConfig(sitePath: string): Promise<SiteConfig> {\n  let raw: string;\n  try {\n    raw = await readFile(join(sitePath, \"package.json\"), \"utf-8\");\n  } catch {\n    return {};\n  }\n  let pkg: unknown;\n  try {\n    pkg = JSON.parse(raw);\n  } catch {\n    return {};\n  }\n  if (!pkg || typeof pkg !== \"object\") return {};\n  const cfg = (pkg as { reddoor?: unknown }).reddoor;\n  if (!cfg || typeof cfg !== \"object\") return {};\n\n  const out: SiteConfig = {};\n  const url = (cfg as { lighthouseUrl?: unknown }).lighthouseUrl;\n  if (typeof url === \"string\" && url.length > 0) {\n    out.lighthouseUrl = url;\n  }\n  return out;\n}\n","import { createServer } from \"node:net\";\n\n/**\n * Bind an ephemeral TCP port, capture it, release it, and return it. Used\n * by the lighthouse and a11y audits to pick a port the audit's own dev\n * server will then bind via `--strictPort`.\n *\n * Why: vite's default behavior on a busy port is to bump to the next free\n * one (5173 → 5174 → …). When zombie vite processes (or any squatter) are\n * already on 5173, the audit's spawned vite lands on a higher port, but\n * the audit tooling (lhci, playwright) still probes 5173 — hits the\n * zombie — gets stale 404s — fails with \"no manifest written\" / \"no\n * results written (exit 1)\". Reproduced on caltex 2026-05-28 with 10\n * orphaned vite processes accumulated across this repo, the reports repo,\n * and caltex itself. Allocating a free port up front + `--strictPort`\n * makes the audit immune to port collisions.\n *\n * TOCTOU note: the small window between close() and the spawned vite\n * binding is theoretically racy, but in practice we run one audit at a\n * time and the OS keeps the port free for re-use. If vite still fails to\n * bind under `--strictPort`, the audit fails loudly — that's the correct\n * outcome (vs. silently auditing the wrong server).\n */\nexport async function findFreePort(): Promise<number> {\n  return new Promise((resolve, reject) => {\n    const server = createServer();\n    server.unref();\n    server.on(\"error\", reject);\n    server.listen(0, \"127.0.0.1\", () => {\n      const addr = server.address();\n      if (typeof addr === \"object\" && addr) {\n        const port = addr.port;\n        server.close(() => resolve(port));\n      } else {\n        server.close();\n        reject(new Error(\"findFreePort: could not determine assigned port from socket\"));\n      }\n    });\n  });\n}\n\n/**\n * Swap the port (and force `localhost` host) on a URL so it points at the\n * audit's freshly-allocated dev server. Preserves the path + any query.\n * Used to rewrite the lighthouse `url` so lhci probes the correct port.\n */\nexport function withFreePort(url: string, port: number): string {\n  const u = new URL(url);\n  u.hostname = \"localhost\";\n  u.port = String(port);\n  return u.toString();\n}\n","import { readFile, writeFile, mkdtemp, rm } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport type { AuditResult } from \"../types.js\";\nimport { siteLabel } from \"../util/site.js\";\nimport { a11yRoutes, smokeRoutes } from \"../configs/playwright-a11y.js\";\nimport { defaultSpawn } from \"./util/spawn.js\";\nimport type { AuditContext } from \"./util/inject.js\";\nimport { findFreePort } from \"../util/free-port.js\";\n\ntype Impact = \"minor\" | \"moderate\" | \"serious\" | \"critical\";\n\ntype AxeViolation = {\n  id: string;\n  impact: Impact;\n  route: string;\n  help?: string;\n  helpUrl?: string;\n  nodes?: Array<{ html?: string; target?: string[] }>;\n};\n\ntype NormalizedA11y = {\n  totalViolations: number;\n  byImpact: Partial<Record<Impact, number>>;\n  violations: AxeViolation[];\n};\n\nconst RESULTS_REL = \".reddoor-a11y/results.json\";\n\nasync function readJsonMaybe<T>(path: string): Promise<T | null> {\n  try {\n    const raw = await readFile(path, \"utf-8\");\n    return JSON.parse(raw) as T;\n  } catch {\n    return null;\n  }\n}\n\n// The audit-controlled playwright config. We synthesize it (rather than\n// rely on the site's playwright.config.ts) so we can pin the dev server\n// port + force `--strictPort` — same fix as the lighthouse audit, same\n// reason (zombie vite processes squatting on 5173 would otherwise eat\n// the audit's request and return stale 404s).\nfunction buildPlaywrightConfig(port: number, sitePath: string): string {\n  return `import { defineConfig } from \"@playwright/test\";\n\nexport default defineConfig({\n  testDir: \".\",\n  testMatch: /.*\\\\.spec\\\\.ts$/,\n  fullyParallel: true,\n  forbidOnly: !!process.env.CI,\n  retries: process.env.CI ? 2 : 0,\n  reporter: process.env.CI ? \"github\" : \"list\",\n  use: {\n    baseURL: \"http://localhost:${port}\",\n    trace: \"on-first-retry\",\n  },\n  webServer: {\n    // --strictPort: refuse to bump to a different port if ours is taken,\n    //   so the audit fails loudly instead of probing a zombie.\n    // reuseExistingServer:false: never reuse — we control the lifecycle.\n    // cwd: playwright's default webServer.cwd is the config file's\n    //   directory. Our config lives in /tmp so without this override,\n    //   \"npm run vite:dev\" tries to read /tmp/.../package.json and\n    //   ENOENTs before vite ever starts. Caltex 2026-05-28 (0.10.5).\n    command: \"npm run vite:dev -- --port ${port} --strictPort\",\n    url: \"http://localhost:${port}/dev/a11y-fixtures\",\n    cwd: ${JSON.stringify(sitePath)},\n    reuseExistingServer: false,\n    timeout: 120_000,\n  },\n});\n`;\n}\n\n// The spec the audit writes runs all configured routes through axe in a single\n// test (so worker isolation doesn't fragment the collected violations) and\n// writes the structured result to <cwd>/.reddoor-a11y/results.json before\n// asserting. That way, the audit can read real axe details even when the\n// expect(...).toEqual([]) assertion fails.\nfunction buildSpec(): string {\n  return `import { test, expect } from \"@playwright/test\";\nimport AxeBuilder from \"@axe-core/playwright\";\nimport { mkdir, writeFile } from \"node:fs/promises\";\nimport { dirname } from \"node:path\";\n\nconst pages = ${JSON.stringify(a11yRoutes)};\nconst smokePages = ${JSON.stringify(smokeRoutes)};\nconst OUTPUT = process.env.REDDOOR_A11Y_OUTPUT;\n\n// Playwright's default per-test timeout is 30s. We loop through every\n// configured route in a single test, so the budget needs to scale.\ntest.setTimeout(5 * 60_000);\n\ntest(\"a11y + hydration across configured routes\", async ({ page }) => {\n  const violations = [];\n\n  // Capture uncaught client-side exceptions across every route we visit. A page\n  // that builds + SSRs cleanly can still throw on hydrate and blank itself\n  // (data-dynamiq: a Svelte 4->5 run() referenced a $state declared after it) --\n  // axe never sees that, so we listen for it directly and tag the route in scope.\n  let currentRoute = \"\";\n  page.on(\"pageerror\", (err) => {\n    violations.push({\n      id: \"client-error\",\n      impact: \"critical\",\n      route: currentRoute,\n      help: String(err && err.message ? err.message : err),\n    });\n  });\n\n  for (const { path, name } of pages) {\n    currentRoute = name;\n    await page.goto(path);\n    // Snap CSS transitions/animations to their resting state before axe runs.\n    // AnimateIn-style fixtures transition opacity 0->1; sampling mid-transition\n    // makes axe compute color-contrast against semi-transparent text, yielding a\n    // flaky \"serious\" color-contrast violation (~1/3 of runs on /dev/animate-in).\n    // Disabling transitions/animations forces the final, rendered state\n    // deterministically -- which is also what users (and prefers-reduced-motion\n    // users) actually see, so it's the correct thing to assert.\n    await page.addStyleTag({\n      content: \"*,*::before,*::after{transition:none!important;animation:none!important;}\",\n    });\n    const results = await new AxeBuilder({ page })\n      .withTags([\"wcag2a\",\"wcag2aa\",\"wcag21a\",\"wcag21aa\",\"wcag22aa\"])\n      .analyze();\n    for (const v of results.violations) {\n      violations.push({\n        id: v.id,\n        impact: v.impact ?? \"moderate\",\n        route: name,\n        help: v.help,\n        helpUrl: v.helpUrl,\n        nodes: v.nodes.map((n) => ({ html: n.html, target: n.target })),\n      });\n    }\n  }\n\n  // Hydration smoke check: load real routes (the homepage) and fail on any\n  // uncaught client-side error. No axe here -- real routes carry pre-existing\n  // a11y debt we don't gate on; we only assert they don't crash on hydrate.\n  // HTTP/SSR errors don't fire 'pageerror', so a data-less CI homepage that\n  // renders empty-but-valid won't false-fail -- only a real client crash does.\n  for (const { path, name } of smokePages) {\n    currentRoute = name;\n    await page.goto(path);\n    // Let hydration + first effects run so a TDZ/ReferenceError surfaces.\n    await page.waitForTimeout(2000);\n  }\n\n  const byImpact = {};\n  for (const v of violations) {\n    byImpact[v.impact] = (byImpact[v.impact] ?? 0) + 1;\n  }\n  if (OUTPUT) {\n    await mkdir(dirname(OUTPUT), { recursive: true });\n    await writeFile(\n      OUTPUT,\n      JSON.stringify({ totalViolations: violations.length, byImpact, violations }, null, 2),\n    );\n  }\n  expect(violations).toEqual([]);\n});\n`;\n}\n\nexport async function a11yAudit(ctx: AuditContext): Promise<AuditResult> {\n  const spawn = ctx.spawn ?? defaultSpawn;\n  const site = ctx.site;\n  const label = siteLabel(site);\n\n  // specDir lives INSIDE site.path (not /tmp) so the spec's\n  // `import AxeBuilder from \"@axe-core/playwright\"` resolves via Node's\n  // walk-up — the site's node_modules is the nearest one. A spec written\n  // to /tmp ENOENTs at module resolution before any test runs. Caltex\n  // 2026-05-28 (0.10.6 dogfood), third layer of the same class as the\n  // webServer.cwd bug.\n  const specDir = await mkdtemp(join(site.path, \".reddoor-a11y-spec-\"));\n  // Everything past mkdtemp is wrapped so the transient specDir is removed on\n  // EVERY catchable exit — success, skip-return, or any throw (a failed\n  // writeFile/findFreePort used to orphan it). A timeout-SIGKILL of the parent\n  // can't be caught here; `.reddoor-a11y-spec-*/` is fleet-gitignored as the\n  // backstop for that. (2026-06-10 MEDIUM-D; recurred from 06-05 M3.)\n  try {\n    const specPath = join(specDir, \"a11y.spec.ts\");\n    await writeFile(specPath, buildSpec(), \"utf-8\");\n\n    const port = await findFreePort();\n    const configPath = join(specDir, \"playwright.config.ts\");\n    await writeFile(configPath, buildPlaywrightConfig(port, site.path), \"utf-8\");\n\n    const resultsPath = join(site.path, RESULTS_REL);\n    // Clear stale artifacts so a failed spawn never reports old data.\n    await rm(join(site.path, \".reddoor-a11y\"), { recursive: true, force: true });\n\n    let raw;\n    try {\n      raw = await spawn(\n        \"npx\",\n        [\"--yes\", \"playwright\", \"test\", `--config=${configPath}`, \"--reporter=line\", specPath],\n        {\n          cwd: site.path,\n          env: { ...process.env, REDDOOR_A11Y_OUTPUT: resultsPath },\n          // playwright on a cold tree downloads Chrome, boots the site's dev\n          // server, and runs axe over every configured route. The shared 30 s\n          // default in runAudits is fine for deps/lint/security but starves\n          // playwright (mirrors the lighthouse fix shipped earlier).\n          timeoutMs: 5 * 60_000,\n        },\n      );\n    } catch (err) {\n      const e = err as NodeJS.ErrnoException;\n      if (e.code === \"ENOENT\" || /ENOENT/.test(String(err))) {\n        return {\n          audit: \"a11y\",\n          site: label,\n          status: \"skip\",\n          summary: \"npx/playwright not available\",\n        };\n      }\n      throw err;\n    }\n\n    const artifact = await readJsonMaybe<NormalizedA11y>(resultsPath);\n\n    if (!artifact) {\n      return {\n        audit: \"a11y\",\n        site: label,\n        status: \"fail\",\n        summary: `a11y: no results written (exit ${raw.code})${\n          raw.stderr ? ` — ${raw.stderr.slice(0, 200)}` : \"\"\n        }`,\n      };\n    }\n\n    const hasSerious =\n      (artifact.byImpact.serious ?? 0) > 0 || (artifact.byImpact.critical ?? 0) > 0;\n    const hasAny = artifact.totalViolations > 0;\n\n    const status: AuditResult[\"status\"] = hasSerious ? \"fail\" : hasAny ? \"warn\" : \"pass\";\n    const summary =\n      status === \"pass\"\n        ? `a11y: 0 violations across ${a11yRoutes.length} routes (+${smokeRoutes.length} hydration smoke)`\n        : `a11y: ${artifact.totalViolations} violations`;\n\n    return {\n      audit: \"a11y\",\n      site: label,\n      status,\n      summary,\n      details: artifact,\n    };\n  } finally {\n    await rm(specDir, { recursive: true, force: true });\n  }\n}\n","import { defineConfig, devices, type PlaywrightTestConfig } from \"@playwright/test\";\n\nexport type A11yRoute = { path: string; name: string };\n\nexport const a11yRoutes: A11yRoute[] = [\n  { path: \"/dev/a11y-fixtures\", name: \"a11y fixtures\" },\n  { path: \"/dev/animate-in\", name: \"animate-in demo\" },\n];\n\n// Routes smoke-loaded for client-side (hydration) errors only — NOT axe-scanned.\n// Catches the class of bug where build + SSR succeed but client hydration throws\n// and blanks the page (data-dynamiq 2026-06-09: a Svelte 4->5 `run()` referenced\n// a `$state` declared after it → TDZ ReferenceError on hydrate). `/` is the one\n// route every site has; real routes carry a11y debt we don't gate on here, so we\n// assert only that they don't crash on hydrate.\nexport const smokeRoutes: A11yRoute[] = [{ path: \"/\", name: \"home\" }];\n\nexport const playwrightA11yConfig: PlaywrightTestConfig = defineConfig({\n  testDir: \"tests\",\n  testMatch: /.*\\.spec\\.ts$/,\n  fullyParallel: true,\n  forbidOnly: !!process.env.CI,\n  retries: process.env.CI ? 2 : 0,\n  reporter: process.env.CI ? \"github\" : \"list\",\n  use: {\n    baseURL: \"http://localhost:5173\",\n    trace: \"on-first-retry\",\n  },\n  projects: [\n    {\n      name: \"chromium\",\n      use: { ...devices[\"Desktop Chrome\"] },\n    },\n  ],\n  webServer: {\n    // Portable across pnpm and npm sites — pnpm respects `npm run` too.\n    command: \"npm run vite:dev\",\n    url: \"http://localhost:5173/dev/a11y-fixtures\",\n    reuseExistingServer: !process.env.CI,\n    timeout: 120_000,\n  },\n});\n\nexport default playwrightA11yConfig;\n","import type { AuditName, AuditResult, Site } from \"../types.js\";\nimport type { AuditContext } from \"./util/inject.js\";\nimport { defaultSpawn } from \"./util/spawn.js\";\nimport type { SpawnFn } from \"./util/spawn.js\";\nimport { depsAudit } from \"./deps.js\";\nimport { lintAudit } from \"./lint.js\";\nimport { securityAudit } from \"./security.js\";\nimport { lighthouseAudit } from \"./lighthouse.js\";\nimport { a11yAudit } from \"./a11y.js\";\n\nconst REGISTRY: Record<AuditName, (ctx: AuditContext) => Promise<AuditResult>> = {\n  deps: depsAudit,\n  lint: lintAudit,\n  security: securityAudit,\n  lighthouse: lighthouseAudit,\n  a11y: a11yAudit,\n};\n\nexport const ALL_AUDIT_NAMES = Object.keys(REGISTRY) as AuditName[];\n\n/** Default per-audit spawn timeout when running via runAudits (30 s). */\nconst DEFAULT_AUDIT_TIMEOUT_MS = 30_000;\n\nfunction timedSpawn(timeoutMs: number): SpawnFn {\n  return (cmd, args, opts = {}) =>\n    defaultSpawn(cmd, args, { ...opts, timeoutMs: opts.timeoutMs ?? timeoutMs });\n}\n\n/** Single-audit runner with the same error-to-result conversion that\n *  `runAudits` applies. Exposed so the CLI can wrap each audit in its\n *  own progress task (listr2) and surface per-audit completion timing,\n *  while keeping audit implementations UI-free. */\nexport async function runOneAudit(site: Site, name: AuditName): Promise<AuditResult> {\n  if (!(name in REGISTRY)) throw new Error(`unknown audit: ${name}`);\n  const spawn = timedSpawn(DEFAULT_AUDIT_TIMEOUT_MS);\n  // `||` not `??`: an empty-string slug (Airtable Name with no slug-able chars)\n  // must fall back to the path, not render a blank `AuditResult.site` that would\n  // then collapse fleet write-back grouping under the \"\" key.\n  const label = site.name || site.path;\n  try {\n    return await REGISTRY[name]({ site, spawn });\n  } catch (err) {\n    return {\n      audit: name,\n      site: label,\n      status: \"fail\",\n      summary: `${name}: unexpected error — ${String(err)}`,\n    };\n  }\n}\n\nexport async function runAudits(site: Site, which?: AuditName[]): Promise<AuditResult[]> {\n  const names = which ?? ALL_AUDIT_NAMES;\n  for (const n of names) {\n    if (!(n in REGISTRY)) throw new Error(`unknown audit: ${n}`);\n  }\n  return Promise.all(names.map((n) => runOneAudit(site, n)));\n}\n\nexport async function runAuditsAcross(sites: Site[], which?: AuditName[]): Promise<AuditResult[]> {\n  const all = await Promise.all(sites.map((s) => runAudits(s, which)));\n  return all.flat();\n}\n\nexport { depsAudit, lintAudit, securityAudit, lighthouseAudit, a11yAudit };\n","import { pathToFileURL } from \"node:url\";\nimport { resolve, extname } from \"node:path\";\nimport type { InventoryProvider, Site } from \"../../types.js\";\nimport { localPath } from \"../../inventory/local.js\";\nimport { fromJsonFile } from \"../../inventory/json.js\";\n\nexport type ResolveSitesInput = {\n  site?: string;\n  fleet?: string;\n  /** Optional workdir for the `--fleet airtable` keyword path (computes site.path as {workdir}/{slug}). */\n  workdir?: string;\n  cwd: string;\n};\n\nexport async function resolveSites(input: ResolveSitesInput): Promise<Site[]> {\n  if (input.site && input.fleet) {\n    throw Object.assign(new Error(\"cannot combine a positional [site] with --fleet\"), {\n      exitCode: 2,\n    });\n  }\n\n  if (input.fleet === \"airtable\") {\n    const { openBase, readAirtableConfig } = await import(\"../../reports/airtable/client.js\");\n    const { fromAirtableBase } = await import(\"../../inventory/airtable.js\");\n    const base = openBase(readAirtableConfig());\n    const provider = fromAirtableBase(base, input.workdir ? { workdir: input.workdir } : {});\n    return provider();\n  }\n\n  if (input.fleet) {\n    const fleetPath = resolve(input.cwd, input.fleet);\n    const ext = extname(fleetPath).toLowerCase();\n    let provider: InventoryProvider;\n    if (ext === \".json\") {\n      provider = fromJsonFile(fleetPath);\n    } else if (ext === \".js\" || ext === \".mjs\" || ext === \".cjs\") {\n      const mod = (await import(pathToFileURL(fleetPath).href)) as {\n        default?: InventoryProvider;\n      };\n      if (!mod.default || typeof mod.default !== \"function\") {\n        throw Object.assign(new Error(`--fleet ${input.fleet}: default export is not a function`), {\n          exitCode: 2,\n        });\n      }\n      provider = mod.default;\n    } else {\n      throw Object.assign(\n        new Error(`--fleet ${input.fleet}: unsupported extension ${ext || \"(none)\"}`),\n        { exitCode: 2 },\n      );\n    }\n    return provider();\n  }\n\n  return localPath(resolve(input.cwd, input.site ?? input.cwd))();\n}\n","import { basename } from \"node:path\";\nimport type { InventoryProvider, Site } from \"../types.js\";\n\nexport type LocalPathOptions = {\n  name?: string;\n};\n\nexport function localPath(path: string, opts: LocalPathOptions = {}): InventoryProvider {\n  // `||` not `??`: an explicit empty `--name \"\"` should fall back to the path's\n  // basename, not become a blank site name.\n  const site: Site = { path, name: opts.name || basename(path) };\n  return async () => [site];\n}\n","import { readFile } from \"node:fs/promises\";\nimport { isAbsolute } from \"node:path\";\nimport type { InventoryProvider, Site } from \"../types.js\";\nimport { isHttpUrl } from \"../util/url.js\";\n\nfunction validate(raw: unknown): Site[] {\n  if (!Array.isArray(raw)) {\n    throw new Error(\"inventory JSON must be an array of sites\");\n  }\n  return raw.map((entry, i) => {\n    if (!entry || typeof entry !== \"object\") {\n      throw new Error(`inventory entry ${i} is not an object`);\n    }\n    const e = entry as Record<string, unknown>;\n    if (typeof e.path !== \"string\" || e.path.length === 0) {\n      throw new Error(`inventory entry ${i} is missing required field: path`);\n    }\n    if (!isAbsolute(e.path)) {\n      throw new Error(\n        `inventory entry ${i}: path must be absolute (got \"${e.path}\"). ` +\n          `Relative paths are rejected so cwd at invocation can't change which site is targeted.`,\n      );\n    }\n    const site: Site = { path: e.path };\n    if (typeof e.name === \"string\") site.name = e.name;\n    if (typeof e.repoUrl === \"string\") site.repoUrl = e.repoUrl;\n    // Carry gitRepo/deployedUrl like the Airtable provider does, so a JSON\n    // inventory can drive checkout (clone-from-gitRepo) and deployed-URL audits.\n    if (typeof e.gitRepo === \"string\") site.gitRepo = e.gitRepo;\n    // Scheme-allowlist deployedUrl before it can reach Chrome/lhci (same SSRF /\n    // local-file gate as the Airtable provider). A non-http(s) value is dropped\n    // with a warning rather than trusted into the deployed audit.\n    if (typeof e.deployedUrl === \"string\") {\n      if (isHttpUrl(e.deployedUrl)) {\n        site.deployedUrl = e.deployedUrl;\n      } else {\n        console.warn(\n          `[inventory] entry ${i}: ignoring deployedUrl that is not http(s): ${JSON.stringify(e.deployedUrl)}`,\n        );\n      }\n    }\n    if (typeof e.meta === \"object\" && e.meta !== null) {\n      site.meta = e.meta as Record<string, unknown>;\n    }\n    return site;\n  });\n}\n\nexport function fromJsonFile(path: string): InventoryProvider {\n  return async () => {\n    const text = await readFile(path, \"utf-8\");\n    let raw: unknown;\n    try {\n      raw = JSON.parse(text);\n    } catch (e) {\n      // A bare JSON.parse SyntaxError (\"Unexpected token … at position N\") names\n      // neither the file nor that it's the inventory — useless to an operator\n      // running a fleet command. Rethrow with the path for an actionable message,\n      // preserving the original SyntaxError as `cause`.\n      throw new Error(`could not parse inventory file ${path}: ${(e as Error).message}`, {\n        cause: e,\n      });\n    }\n    return validate(raw);\n  };\n}\n","import { stat, readdir, mkdir } from \"node:fs/promises\";\nimport { isAbsolute, join } from \"node:path\";\nimport type { Site } from \"../../types.js\";\nimport { defaultSpawn, type SpawnFn } from \"../../audits/util/spawn.js\";\nimport { sameOwnerRepo } from \"../../util/git.js\";\n\nexport type CloneIfNeededOptions = {\n  workdir: string;\n  spawn?: SpawnFn;\n};\n\nfunction deriveNameFromRepoUrl(repoUrl: string): string {\n  const slash = repoUrl.split(\"/\").pop() ?? repoUrl;\n  return slash.replace(/\\.git$/, \"\");\n}\n\n/** Reject names that would let an inventory entry write outside `workdir`. */\nfunction assertSafeName(name: string): void {\n  if (name.length === 0) {\n    // `join(workdir, \"\")` collapses to the workdir root — the clone would land\n    // there (and two empty-named sites would collide). An empty name is never a\n    // legitimate checkout dir.\n    throw new Error(\"unsafe site name (empty)\");\n  }\n  if (isAbsolute(name)) {\n    throw new Error(`unsafe site name (absolute path not allowed): ${name}`);\n  }\n  if (name.includes(\"/\") || name.includes(\"\\\\\")) {\n    throw new Error(`unsafe site name (path separator not allowed): ${name}`);\n  }\n  if (name.split(/[\\\\/]/).some((seg) => seg === \"..\")) {\n    throw new Error(`unsafe site name (traversal segment not allowed): ${name}`);\n  }\n}\n\n/**\n * Reject repo URLs that don't look like a normal clone target. Without this,\n * a `repoUrl` starting with `-` would be interpreted by git as a flag\n * (CVE-2017-1000117 family) — e.g. `--upload-pack=…` allows arbitrary command\n * execution. Inventory files are usually trusted, but `.mjs`/`.js` inventories\n * could pull from environments or external sources, so harden the boundary.\n *\n * Accepts: `https://`, `http://`, `ssh://`, `git://`, `file://`, and\n * `[user@]host:path` shorthand (e.g. `git@github.com:org/repo.git`).\n */\nfunction assertSafeRepoUrl(repoUrl: string): void {\n  if (\n    !/^(https?|ssh|git|file):\\/\\//.test(repoUrl) &&\n    !/^[A-Za-z0-9._-]+@[A-Za-z0-9._-]+:/.test(repoUrl)\n  ) {\n    throw new Error(\n      `unsafe repoUrl: must start with a scheme (https://, ssh://, git://, file://) ` +\n        `or use scp-style \"user@host:path\" (got: ${JSON.stringify(repoUrl)})`,\n    );\n  }\n}\n\nasync function isNonEmptyDir(path: string): Promise<boolean> {\n  try {\n    const s = await stat(path);\n    if (!s.isDirectory()) return false;\n    const entries = await readdir(path);\n    return entries.length > 0;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * The repo identity (`owner/repo` or a clone URL) the site is *expected* to be.\n * `gitRepo` (Airtable's `owner/repo`) is canonical; fall back to `repoUrl`.\n * `undefined` when the inventory carries neither — there's nothing to verify\n * against, so a reused checkout can't be checked (we keep current behavior).\n */\nfunction expectedRepoRef(site: Site): string | undefined {\n  return site.gitRepo ?? site.repoUrl ?? undefined;\n}\n\n/**\n * Verify an existing checkout at `path` is the SAME repo as the site expects.\n * The `siteSlug` that derives the path is lossy (distinct site names can\n * collapse to one slug → one path), so without this a fleet run could read,\n * audit, or commit against the WRONG repo's working tree.\n *\n * Reads `git -C <path> remote get-url origin` (via the injected spawn so tests\n * can fake it) and compares `owner/repo` on both sides, normalizing scheme,\n * host, `.git`, and case. Throws on a mismatch — never silently proceeds.\n * No-ops when the site carries no expected identity, or the dir isn't a git\n * checkout (no origin) — those are handled by the normal clone path.\n */\nasync function assertCheckoutMatches(site: Site, path: string, spawn: SpawnFn): Promise<void> {\n  const expected = expectedRepoRef(site);\n  if (!expected) return; // nothing to verify against\n\n  const r = await spawn(\"git\", [\"-C\", path, \"remote\", \"get-url\", \"origin\"], {\n    timeoutMs: 30_000,\n  });\n  // Not a git checkout / no origin remote → can't verify; let the clone path\n  // (or the caller) deal with a non-repo directory rather than guessing.\n  if (r.code !== 0) return;\n  const origin = r.stdout.trim();\n  if (origin.length === 0) return;\n\n  if (!sameOwnerRepo(origin, expected)) {\n    throw new Error(\n      `checkout at ${path} is the wrong repo: origin is ${JSON.stringify(origin)} ` +\n        `but site expects ${JSON.stringify(expected)} (slug collision?) — refusing to reuse it`,\n    );\n  }\n}\n\n/** GitHub repo identity `owner/repo`: exactly two `[\\w.-]` segments. Constrained\n *  so it can't smuggle a scheme, host, extra path segment, traversal, or an argv\n *  flag into the derived clone URL below. */\nconst GIT_REPO_RE = /^[\\w.-]+\\/[\\w.-]+$/;\n\n/**\n * Resolve the URL to clone from. An explicit `repoUrl` wins; otherwise derive\n * one from `gitRepo` (`owner/repo` → `https://github.com/owner/repo.git`). The\n * Airtable inventory deliberately sets `gitRepo` and NOT `repoUrl` (a clone\n * source must never be the production `url`), so without this derivation every\n * checkout-based fleet recipe throws on the first site with an empty workdir.\n *\n * Returns `undefined` when neither is set; throws on a malformed `gitRepo`.\n */\nfunction resolveCloneUrl(site: Site): string | undefined {\n  if (site.repoUrl) return site.repoUrl;\n  if (!site.gitRepo) return undefined;\n  if (!GIT_REPO_RE.test(site.gitRepo)) {\n    throw new Error(`unsafe gitRepo: expected \"owner/repo\" (got: ${JSON.stringify(site.gitRepo)})`);\n  }\n  return `https://github.com/${site.gitRepo}.git`;\n}\n\nexport async function cloneIfNeeded(site: Site, opts: CloneIfNeededOptions): Promise<Site> {\n  const spawn = opts.spawn ?? defaultSpawn;\n\n  if (await isNonEmptyDir(site.path)) {\n    // Reusing an existing checkout: confirm it's actually this site's repo\n    // before any audit/recipe operates on it (slug collisions can point two\n    // sites at the same path). Throws on mismatch.\n    await assertCheckoutMatches(site, site.path, spawn);\n    return site;\n  }\n\n  const repoUrl = resolveCloneUrl(site);\n  if (!repoUrl) {\n    throw new Error(\n      `site path does not exist (${site.path}) and no repoUrl or gitRepo is set — cannot clone`,\n    );\n  }\n\n  const name = site.name || deriveNameFromRepoUrl(repoUrl); // `||`: empty name derives from the repo\n  assertSafeName(name);\n  assertSafeRepoUrl(repoUrl);\n  const target = join(opts.workdir, name);\n  await mkdir(opts.workdir, { recursive: true });\n\n  if (await isNonEmptyDir(target)) {\n    // Same guard for the workdir/<name> reuse path.\n    await assertCheckoutMatches(site, target, spawn);\n    return { ...site, name, path: target };\n  }\n\n  // `--` separator so git won't treat repoUrl as a flag if validation slips.\n  const result = await spawn(\"git\", [\"clone\", \"--\", repoUrl, target], {\n    cwd: opts.workdir,\n    timeoutMs: 5 * 60_000,\n  });\n  if (result.code !== 0) {\n    throw new Error(`git clone failed (code ${result.code}): ${result.stderr}`);\n  }\n  return { ...site, name, path: target };\n}\n","import { execFile } from \"node:child_process\";\nimport { promisify } from \"node:util\";\n\nconst exec = promisify(execFile);\n\nasync function git(cwd: string, args: string[]): Promise<{ stdout: string; stderr: string }> {\n  return exec(\"git\", args, { cwd, env: process.env });\n}\n\nexport function branchName(recipe: string, when: Date = new Date()): string {\n  // ISO with millisecond precision: 2026-05-20T10:30:00.123Z → 20260520T103000123Z.\n  // Millis (vs. second-precision) shrinks the collision window for parallel runs.\n  const compact = when.toISOString().replace(/[-:.]/g, \"\");\n  return `maint/${recipe}-${compact}`;\n}\n\nexport async function currentBranch(cwd: string): Promise<string> {\n  const { stdout } = await git(cwd, [\"rev-parse\", \"--abbrev-ref\", \"HEAD\"]);\n  return stdout.trim();\n}\n\nexport async function isWorkingTreeClean(cwd: string): Promise<boolean> {\n  const { stdout } = await git(cwd, [\"status\", \"--porcelain\"]);\n  return stdout.trim().length === 0;\n}\n\nexport async function createBranch(cwd: string, name: string): Promise<void> {\n  await git(cwd, [\"checkout\", \"-b\", name]);\n}\n\n/** Check out an existing branch. Throws (via git) if the branch is missing or\n *  the checkout is blocked (e.g. uncommitted changes that would be overwritten). */\nexport async function checkoutBranch(cwd: string, name: string): Promise<void> {\n  await git(cwd, [\"checkout\", name]);\n}\n\n/**\n * Force-check-out an existing branch, DISCARDING any uncommitted changes on the\n * current branch. Used by the recipe failure path to return the operator to\n * their original branch even when a recipe left the work-in-progress branch\n * dirty. Only ever called with the operator's ORIGINAL branch as `name`. Does\n * not run `git clean`, so untracked operator files are left untouched.\n */\nexport async function forceCheckoutBranch(cwd: string, name: string): Promise<void> {\n  await git(cwd, [\"checkout\", \"-f\", name]);\n}\n\n/**\n * Delete a local branch with `-D` (force). Used by the recipe failure path to\n * remove the branch the recipe itself created so a re-run starts clean. Callers\n * MUST only ever pass the recipe-created branch here, never the operator's\n * original branch.\n */\nexport async function deleteBranch(cwd: string, name: string): Promise<void> {\n  await git(cwd, [\"branch\", \"-D\", name]);\n}\n\nexport async function stageAll(cwd: string): Promise<void> {\n  await git(cwd, [\"add\", \"-A\"]);\n}\n\nexport async function listTrackedFiles(cwd: string): Promise<string[]> {\n  const { stdout } = await git(cwd, [\"ls-files\"]);\n  return stdout\n    .split(\"\\n\")\n    .map((l) => l.trim())\n    .filter((l) => l.length > 0);\n}\n\nexport async function removeFromIndex(cwd: string, paths: string[]): Promise<void> {\n  if (paths.length === 0) return;\n  await git(cwd, [\"rm\", \"-r\", \"--cached\", \"--\", ...paths]);\n}\n\n/**\n * Stages all current changes and commits with `message`. Returns the commit SHA,\n * or `null` if there was nothing to commit.\n */\nexport async function commit(cwd: string, message: string): Promise<string | null> {\n  await stageAll(cwd);\n  const { stdout: status } = await git(cwd, [\"status\", \"--porcelain\"]);\n  if (status.trim().length === 0) return null;\n  await git(cwd, [\"commit\", \"-m\", message]);\n  const { stdout: sha } = await git(cwd, [\"rev-parse\", \"HEAD\"]);\n  return sha.trim();\n}\n\n/**\n * Strict GitHub repo identity: exactly two `[A-Za-z0-9._-]` segments separated\n * by a single slash. Rejects a scheme, host, extra path segment, traversal\n * (`..`), whitespace, or an argv flag — anything that could retarget a `gh`\n * write at an unintended (attacker/typo-controlled) repo.\n */\nexport const OWNER_REPO_RE = /^[A-Za-z0-9._-]+\\/[A-Za-z0-9._-]+$/;\n\n/** True when `repo` is a clean `owner/repo` (see {@link OWNER_REPO_RE}). The\n *  explicit `..` reject covers traversal segments the char-class would otherwise\n *  admit (`.` is a legal repo char, so `../evil` matches the shape regex). */\nexport function isOwnerRepo(repo: string): boolean {\n  if (repo.includes(\"..\")) return false;\n  return OWNER_REPO_RE.test(repo);\n}\n\n/**\n * True when two repo references name the same `owner/repo`. Each side may be a\n * full remote URL (https or scp-style), or already an `owner/repo`. Used to\n * verify an existing checkout's `origin` matches the site's expected repo\n * before reusing it. Returns false if either side is unparseable.\n */\nexport function sameOwnerRepo(a: string, b: string): boolean {\n  const na = isOwnerRepo(a.trim()) ? a.trim() : parseOwnerRepo(a);\n  const nb = isOwnerRepo(b.trim()) ? b.trim() : parseOwnerRepo(b);\n  if (na === null || nb === null) return false;\n  return na.toLowerCase() === nb.toLowerCase();\n}\n\n/** Derive `owner/repo` from a git remote URL (https or scp-style). Null if unparseable. */\nexport function parseOwnerRepo(remoteUrl: string): string | null {\n  const trimmed = remoteUrl\n    .trim()\n    .replace(/\\.git$/, \"\")\n    .replace(/\\/$/, \"\");\n  // scp-style: git@github.com:owner/repo\n  const scp = trimmed.match(/^[A-Za-z0-9._-]+@[A-Za-z0-9._-]+:(.+)$/);\n  const path = scp ? scp[1]! : trimmed.replace(/^https?:\\/\\/[^/]+\\//, \"\");\n  const segments = path.split(\"/\").filter(Boolean);\n  if (segments.length < 2) return null;\n  return `${segments[segments.length - 2]}/${segments[segments.length - 1]}`;\n}\n\n/** `origin` remote URL for a checkout, trimmed. Throws (via git) if there's no origin. */\nexport async function getRemoteUrl(cwd: string): Promise<string> {\n  const { stdout } = await git(cwd, [\"remote\", \"get-url\", \"origin\"]);\n  return stdout.trim();\n}\n\n/** Push a branch to origin, setting upstream. Throws on non-zero (execFile rejects). */\nexport async function push(cwd: string, branch: string): Promise<void> {\n  await git(cwd, [\"push\", \"-u\", \"origin\", branch]);\n}\n","import type { Site } from \"../../types.js\";\nimport { cloneIfNeeded } from \"./clone-if-needed.js\";\n\n/** A fleet site that couldn't be prepared for a command, with the reason. */\nexport type SkippedSite = { site: string; reason: string };\nexport type FleetPrepResult = { prepared: Site[]; skipped: SkippedSite[] };\n\ntype CloneFn = (site: Site, opts: { workdir: string }) => Promise<Site>;\n\n/**\n * Prepare every fleet site for a command, tolerating per-site failures.\n *\n * A site is cloned into `workdir` unless `needsCheckout` says otherwise (the\n * default is \"always clone\" — recipe commands operate on a local checkout; the\n * audit command overrides this so a deployed-URL site skips the clone). The\n * critical property is ISOLATION: a per-site prep failure (no clone source,\n * clone error, the wrong-repo guard) is CAUGHT and recorded in `skipped` rather\n * than thrown. A single malformed inventory row can therefore never abort the\n * whole fleet run — a bare `Promise.all(map(cloneIfNeeded))` used to (one site\n * with no repo threw and rejected prep for EVERY site, so nothing ran). Each\n * site is prepared independently (parallel) so one slow/failed clone can't\n * serialize or sink the rest.\n *\n * The skipped-site label prefers `site.name` but uses a truthiness check (not\n * `??`) so an empty-string name (an Airtable row whose slug came out empty)\n * still falls back to the path instead of rendering blank.\n */\nexport async function prepareFleetSites(\n  sites: Site[],\n  opts: { workdir: string; needsCheckout?: (site: Site) => boolean; clone?: CloneFn },\n): Promise<FleetPrepResult> {\n  const clone = opts.clone ?? cloneIfNeeded;\n  const needsCheckout = opts.needsCheckout ?? (() => true);\n  const settled = await Promise.all(\n    sites.map(async (site): Promise<{ ok: true; site: Site } | ({ ok: false } & SkippedSite)> => {\n      if (!needsCheckout(site)) return { ok: true, site };\n      try {\n        return { ok: true, site: await clone(site, { workdir: opts.workdir }) };\n      } catch (e) {\n        return { ok: false, site: site.name || site.path, reason: (e as Error).message };\n      }\n    }),\n  );\n  const prepared: Site[] = [];\n  const skipped: SkippedSite[] = [];\n  for (const r of settled) {\n    if (r.ok) prepared.push(r.site);\n    else skipped.push({ site: r.site, reason: r.reason });\n  }\n  return { prepared, skipped };\n}\n\n/** One-line operator notice for sites dropped during fleet prep; null when none\n *  were skipped. The leading \"⚠ … site(s) skipped (could not prepare)\" token is\n *  what the nightly fleet-lighthouse workflow greps to raise a `::warning::`, so\n *  a tolerated skip stays visible in the Actions UI rather than buried. */\nexport function formatSkippedNotice(skipped: SkippedSite[]): string | null {\n  if (skipped.length === 0) return null;\n  const detail = skipped.map((s) => `${s.site} (${s.reason})`).join(\"; \");\n  return `⚠ ${skipped.length} site(s) skipped (could not prepare): ${detail}`;\n}\n\n/** Append the skip notice to a command's output on a blank line, or return the\n *  output unchanged when nothing was skipped. Keeps every fleet command's\n *  return paths uniform. */\nexport function appendSkipNotice(output: string, skipped: SkippedSite[]): string {\n  const notice = formatSkippedNotice(skipped);\n  return notice ? `${output}\\n\\n${notice}` : output;\n}\n","import { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\n\n/** The default clone target for `--fleet` mode. Normally `~/.reddoor-maint/sites`.\n *\n *  When `HOME` is unset or empty (cron, minimal CI containers) the old\n *  `${HOME}/.reddoor-maint/sites` expression collapsed to `/.reddoor-maint/sites`\n *  — a filesystem-root path the process almost never has permission to write,\n *  and a dangerous one if it did. Fall back to a tmpdir-based path instead so a\n *  HOME-less environment clones somewhere writable rather than at `/`.\n *\n *  An explicit `--workdir` always wins; callers pass `opts.workdir ?? fleetWorkdir()`. */\nexport function fleetWorkdir(): string {\n  const home = process.env.HOME?.trim();\n  const base = home ? home : tmpdir();\n  return join(base, \".reddoor-maint\", \"sites\");\n}\n"],"mappings":";;;;;;;;;;;AAUO,SAAS,UAAU,GAAoB;AAC5C,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,CAAC;AAAA,EACpB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAO,OAAO,aAAa,WAAW,OAAO,aAAa;AAC5D;AAlBA;AAAA;AAAA;AAAA;AAAA;;;ACAA,SAAS,oBAAoB;AAC7B,SAAS,eAAe;AACxB,SAAS,QAAAA,aAAY;AAId,SAAS,yBAAiC;AAC/C,QAAM,OAAO,QAAQ,IAAI,mBAAmBA,MAAK,QAAQ,GAAG,SAAS;AACrE,SAAOA,MAAK,MAAM,iBAAiB,iBAAiB;AACtD;AATA;AAAA;AAAA;AAAA;AAAA;;;ACAA;AAAA;AAAA;AAAA;AAAA;AAAA,OAAO,cAAc;AAQrB,SAAS,QAAQ,MAAqB;AACpC,SAAO,OAAO;AAAA,IACZ,IAAI;AAAA,MACF,GAAG,IAAI,kDAAkD,uBAAuB,CAAC,OAAO,IAAI;AAAA,IAC9F;AAAA,IACA,EAAE,UAAU,EAAE;AAAA,EAChB;AACF;AAEO,SAAS,qBAAqC;AACnD,QAAM,SAAS,QAAQ,IAAI;AAC3B,QAAM,SAAS,QAAQ,IAAI;AAC3B,MAAI,CAAC,OAAQ,OAAM,QAAQ,cAAc;AACzC,MAAI,CAAC,OAAQ,OAAM,QAAQ,kBAAkB;AAC7C,SAAO,EAAE,QAAQ,OAAO;AAC1B;AAIO,SAAS,SAAS,KAAqB;AAC5C,SAAO,IAAI,SAAS,EAAE,QAAQ,IAAI,OAAO,CAAC,EAAE,KAAK,IAAI,MAAM;AAC7D;AA7BA;AAAA;AAAA;AACA;AAAA;AAAA;;;ACDA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA2EO,SAAS,SAAS,MAAsB;AAC7C,SAAO,KACJ,YAAY,EACZ,QAAQ,eAAe,GAAG,EAC1B,QAAQ,UAAU,EAAE;AACzB;AAIA,SAAS,WAAW,KAA6B;AAC/C,MAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,QAAM,UAAU,IAAI,KAAK;AACzB,SAAO,QAAQ,SAAS,IAAI,UAAU;AACxC;AAaO,SAAS,mBAAmB,MAA2B;AAC5D,SAAO,KAAK,WAAW,QAAQ,gBAAgB,IAAI,KAAK,MAAM;AAChE;AAQO,SAAS,OAAO,KAAkE;AACvF,QAAM,IAAI,IAAI;AACd,QAAM,cACH,EAAE,cAAc,KAA4E,CAAC;AAChG,QAAM,SAAS,YAAY,CAAC,KAAK;AACjC,SAAO;AAAA,IACL,IAAI,IAAI;AAAA,IACR,MAAM,OAAO,EAAE,MAAM,KAAK,EAAE;AAAA,IAC5B,KAAK,OAAO,EAAE,KAAK,KAAK,EAAE;AAAA,IAC1B,QAAS,EAAE,QAAQ,KAA4B;AAAA,IAC/C,gBAAiB,EAAE,kBAAkB,KAA4B;AAAA,IACjE,iBAAmB,EAAE,kBAAkB,KAA4B;AAAA,IACnE,aAAe,EAAE,cAAc,KAA4B;AAAA,IAC3D,gBAAiB,EAAE,iBAAiB,KAA4B;AAAA,IAChE,YAAa,EAAE,aAAa,KAA4B;AAAA,IACxD,eAAgB,EAAE,iBAAiB,KAA4B;AAAA,IAC/D,aAAc,EAAE,cAAc,KAA4B;AAAA,IAC1D,uBAAwB,EAAE,yBAAyB,KAA4B;AAAA,IAC/E,SAAU,EAAE,UAAU,KAA4B;AAAA,IAClD,oBAAqB,EAAE,wBAAwB,KAA4B;AAAA,IAC3E,oBAAqB,EAAE,wBAAwB,KAA4B;AAAA,IAC3E,aAAa;AAAA,IACb,QAAS,EAAE,QAAQ,KAA4B;AAAA,IAC/C,QAAS,EAAE,QAAQ,KAA4B;AAAA,IAC/C,SAAU,EAAE,SAAS,KAA4B;AAAA,IACjD,UAAW,EAAE,UAAU,KAA4B;AAAA,IACnD,uBAAwB,EAAE,0BAA0B,KAA4B;AAAA,IAChF,gBAAiB,EAAE,iBAAiB,KAA4B;AAAA,IAChE,aAAc,EAAE,cAAc,KAA4B;AAAA,IAC1D,iBAAkB,EAAE,mBAAmB,KAA4B;AAAA,IACnE,cAAe,EAAE,eAAe,KAA4B;AAAA,IAC5D,uBAAwB,EAAE,yBAAyB,KAA4B;AAAA,IAC/E,mBAAoB,EAAE,qBAAqB,KAA4B;AAAA,IACvE,uBAAwB,EAAE,yBAAyB,KAA4B;AAAA,IAC/E,kBAAmB,EAAE,oBAAoB,KAA4B;AAAA,IACrE,WAAW,WAAW,EAAE,mBAAc,CAAC;AAAA,IACvC,aAAa,WAAW,EAAE,qBAAgB,CAAC;AAAA,IAC3C,YAAY,WAAW,EAAE,oBAAe,CAAC;AAAA,IACzC,YAAa,EAAE,aAAa,KAA4B;AAAA,IACxD,oBAAqB,EAAE,sBAAsB,KAA4B;AAAA,IACzE,iBAAkB,EAAE,mBAAmB,KAA4B;AAAA,IACnE,cAAe,EAAE,gBAAgB,KAA4B;AAAA,IAC7D,iBAAkB,EAAE,mBAAmB,KAA4B;AAAA,EACrE;AACF;AAEA,eAAsB,aAAa,MAA2C;AAC5E,QAAM,MAAoB,CAAC;AAC3B,QAAM,KAAK,cAAc,EACtB,OAAO,EAAE,UAAU,IAAI,CAAC,EACxB,SAAS,CAAC,SAAS,kBAAkB;AACpC,eAAW,OAAO,QAAS,KAAI,KAAK,OAAO,EAAE,IAAI,IAAI,IAAI,QAAQ,IAAI,OAAO,CAAC,CAAC;AAC9E,kBAAc;AAAA,EAChB,CAAC;AACH,SAAO;AACT;AAEA,eAAsB,iBACpB,MACA,MAC4B;AAI5B,MAAI,CAAC,6BAA6B,KAAK,IAAI,EAAG,QAAO;AAOrD,QAAM,UAAU,2EAA2E,KAAK;AAAA,IAC9F;AAAA,EACF,CAAC;AACD,QAAM,OAAqB,CAAC;AAC5B,QAAM,KAAK,cAAc,EACtB,OAAO,EAAE,iBAAiB,SAAS,YAAY,EAAE,CAAC,EAClD,SAAS,CAAC,SAAS,kBAAkB;AACpC,eAAW,OAAO,QAAS,MAAK,KAAK,OAAO,EAAE,IAAI,IAAI,IAAI,QAAQ,IAAI,OAAO,CAAC,CAAC;AAC/E,kBAAc;AAAA,EAChB,CAAC;AAGH,SAAO,KAAK,KAAK,CAAC,MAAM,SAAS,EAAE,IAAI,MAAM,IAAI,KAAK;AACxD;AAYA,SAAS,YAAY,QAAoC;AACvD,SAAO;AAAA,IACL,QAAQ,OAAO;AAAA,IACf,QAAQ,OAAO;AAAA,IACf,SAAS,OAAO;AAAA,IAChB,UAAU,OAAO;AAAA,IACjB,6BAA4B,oBAAI,KAAK,GAAE,YAAY;AAAA,EACrD;AACF;AAEA,SAAS,WAAW,QAA8B;AAChD,SAAO,EAAE,mBAAmB,OAAO,WAAW;AAChD;AAEA,SAAS,WAAW,QAA8B;AAChD,QAAM,SAAmB;AAAA,IACvB,gBAAgB,OAAO;AAAA,IACvB,qBAAqB,OAAO;AAAA,EAC9B;AAGA,MAAI,OAAO,aAAa,MAAM;AAC5B,WAAO,eAAe,IAAI,OAAO;AAAA,EACnC;AACA,SAAO;AACT;AAEA,SAAS,eAAe,QAAkC;AACxD,SAAO;AAAA,IACL,2BAA2B,OAAO;AAAA,IAClC,uBAAuB,OAAO;AAAA,IAC9B,2BAA2B,OAAO;AAAA,IAClC,sBAAsB,OAAO;AAAA,EAC/B;AACF;AAOA,eAAsB,aACpB,MACA,UACA,QACe;AACf,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,QAAQ,YAAY,MAAM,EAAE,CAAC,CAAC;AACnF;AAGA,eAAsB,iBACpB,MACA,UACA,QACe;AACf,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,QAAQ,WAAW,MAAM,EAAE,CAAC,CAAC;AAClF;AAGA,eAAsB,iBACpB,MACA,UACA,QACe;AACf,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,QAAQ,WAAW,MAAM,EAAE,CAAC,CAAC;AAClF;AAGA,eAAsB,qBACpB,MACA,UACA,QACe;AACf,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,QAAQ,eAAe,MAAM,EAAE,CAAC,CAAC;AACtF;AAWA,eAAsB,kBACpB,MACA,UACA,QAMmB;AACnB,QAAM,SAAmB,CAAC;AAC1B,MAAI,OAAO,OAAQ,QAAO,OAAO,QAAQ,YAAY,OAAO,MAAM,CAAC;AACnE,MAAI,OAAO,KAAM,QAAO,OAAO,QAAQ,WAAW,OAAO,IAAI,CAAC;AAC9D,MAAI,OAAO,KAAM,QAAO,OAAO,QAAQ,WAAW,OAAO,IAAI,CAAC;AAC9D,MAAI,OAAO,SAAU,QAAO,OAAO,QAAQ,eAAe,OAAO,QAAQ,CAAC;AAC1E,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,OAAO,CAAC,CAAC;AAC5D,SAAO;AACT;AAKA,eAAsB,oBACpB,MACA,UACA,SAMe;AACf,QAAM,SAAmB;AAAA,IACvB,wBAAwB,QAAQ;AAAA,IAChC,qBAAqB,QAAQ;AAAA,IAC7B,qBAAqB,QAAQ;AAAA,EAC/B;AACA,MAAI,QAAQ,iBAAiB,MAAM;AACjC,WAAO,gBAAgB,IAAI,QAAQ;AAAA,EACrC;AACA,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,OAAO,CAAC,CAAC;AAC9D;AAIA,eAAsB,eACpB,MACA,UACA,IACe;AACf,QAAM,SAAmB,EAAE,QAAQ,eAAe,eAAe,GAAG;AACpE,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,OAAO,CAAC,CAAC;AAC9D;AAxVA,IAIa,gBA4FA;AAhGb;AAAA;AAAA;AAIO,IAAM,iBAAiB;AA4FvB,IAAM,kBAAuC,oBAAI,IAAY;AAAA,MAClE;AAAA,MACA;AAAA,IACF,CAAC;AAAA;AAAA;;;ACnGD;AAAA;AAAA;AAAA;AAuBO,SAAS,iBACd,MACA,OAAiC,CAAC,GACf;AACnB,SAAO,YAA6B;AAClC,UAAM,UAAU,KAAK,WAAW,QAAQ,IAAI;AAC5C,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,WAAW,MAAM,aAAa,IAAI;AACxC,WAAO,SACJ,OAAO,CAAC,MAAM,EAAE,WAAW,QAAQ,gBAAgB,IAAI,EAAE,MAAM,KAAK,EAAE,IAAI,SAAS,CAAC,EACpF,QAAQ,CAAC,MAAM;AACd,YAAM,OAAO,SAAS,EAAE,IAAI;AAK5B,UAAI,KAAK,WAAW,GAAG;AACrB,gBAAQ;AAAA,UACN,yBAAyB,EAAE,IAAI,UAAU,EAAE,EAAE;AAAA,QAC/C;AACA,eAAO,CAAC;AAAA,MACV;AACA,YAAM,OAAa;AAAA,QACjB,MAAM,GAAG,OAAO,IAAI,IAAI;AAAA,QACxB,MAAM;AAAA,QACN,MAAM,EAAE,eAAe,EAAE,IAAI,aAAa,EAAE,KAAK;AAAA,MACnD;AAKA,UAAI,UAAU,EAAE,GAAG,GAAG;AACpB,aAAK,cAAc,EAAE;AAAA,MACvB,OAAO;AACL,gBAAQ;AAAA,UACN,4CAA4C,EAAE,IAAI,0BAA0B,KAAK,UAAU,EAAE,GAAG,CAAC;AAAA,QACnG;AAAA,MACF;AACA,UAAI,EAAE,QAAS,MAAK,UAAU,EAAE;AAChC,aAAO,CAAC,IAAI;AAAA,IACd,CAAC;AAAA,EACL;AACF;AArEA;AAAA;AAAA;AAEA;AACA;AAAA;AAAA;;;ACHA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,SAAS,YAAAC,iBAAgB;AACzB,SAAS,QAAAC,cAAY;AAqBd,SAAS,cAAc,QAA8B;AAC1D,MAAI,OAAO,UAAU,aAAc,QAAO;AAC1C,QAAM,UAAW,OAAO,WAAW,CAAC;AACpC,QAAM,UAAU,QAAQ,WAAW,CAAC;AACpC,SAAO,sBAAsB;AAAA,IAC3B,CAAC,MAAM,OAAO,QAAQ,CAAC,MAAM,YAAY,CAAC,OAAO,MAAM,QAAQ,CAAC,CAAC;AAAA,EACnE;AACF;AAOO,SAAS,2BAA2B,QAAuC;AAChF,MAAI,OAAO,UAAU,cAAc;AACjC,UAAM,IAAI,MAAM,6CAA6C,OAAO,KAAK,GAAG;AAAA,EAC9E;AACA,QAAM,UAAW,OAAO,WAAW,CAAC;AACpC,QAAM,UAAU,QAAQ,WAAW,CAAC;AACpC,QAAM,QAAQ,CAAC,MACb,OAAO,MAAM,YAAY,CAAC,OAAO,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,GAAG,IAAI;AACpE,SAAO;AAAA,IACL,aAAa,MAAM,QAAQ,aAAa,CAAC;AAAA,IACzC,eAAe,MAAM,QAAQ,eAAe,CAAC;AAAA,IAC7C,eAAe,MAAM,QAAQ,gBAAgB,CAAC;AAAA,IAC9C,KAAK,MAAM,QAAQ,KAAK,CAAC;AAAA,EAC3B;AACF;AAQA,eAAsB,mBAAmB,KAA8B;AACrE,MAAI;AACF,UAAM,UAAUA,OAAK,KAAK,cAAc;AACxC,UAAM,MAAM,MAAMD,UAAS,SAAS,OAAO;AAC3C,UAAM,MAAM,KAAK,MAAM,GAAG;AAC1B,QAAI,CAAC,IAAI,KAAM,OAAM,IAAI,MAAM,kCAAkC;AACjE,WAAO,SAAS,IAAI,IAAI;AAAA,EAC1B,SAAS,GAAG;AACV,UAAM,IAAI;AAAA,MACR,mCAAmC,GAAG,kBAAmB,EAAY,OAAO;AAAA,MAE5E,EAAE,OAAO,EAAE;AAAA,IACb;AAAA,EACF;AACF;AAxEA,IAMM;AANN;AAAA;AAAA;AAIA;AAEA,IAAM,wBAAwB,CAAC,eAAe,iBAAiB,kBAAkB,KAAK;AAAA;AAAA;;;ACK/E,SAAS,cAAc,QAA8B;AAC1D,MAAI,OAAO,UAAU,OAAQ,QAAO;AACpC,QAAM,UAAU,OAAO;AACvB,SAAO,OAAO,SAAS,oBAAoB;AAC7C;AAEO,SAAS,qBAAqB,QAA6C;AAChF,MAAI,OAAO,UAAU,QAAQ;AAC3B,UAAM,IAAI,MAAM,wCAAwC,OAAO,KAAK,GAAG;AAAA,EACzE;AACA,QAAM,UAAU,OAAO;AACvB,SAAO,EAAE,YAAY,SAAS,mBAAmB,EAAE;AACrD;AAvBA;AAAA;AAAA;AAAA;AAAA;;;ACKO,SAAS,cAAc,QAA8B;AAC1D,MAAI,OAAO,UAAU,OAAQ,QAAO;AACpC,QAAM,IAAI,OAAO;AACjB,SAAO,MAAM,QAAQ,GAAG,OAAO;AACjC;AAEO,SAAS,qBAAqB,QAInC;AACA,MAAI,OAAO,UAAU,QAAQ;AAC3B,UAAM,IAAI,MAAM,uCAAuC,OAAO,KAAK,GAAG;AAAA,EACxE;AACA,QAAM,UAAW,OAAO,WAAW,CAAC;AACpC,QAAM,UAAW,QAAQ,WAAW,CAAC;AAGrC,QAAM,UAAU,QAAQ,OAAO,CAAC,MAAM,EAAE,UAAU,MAAM,EAAE;AAC1D,QAAM,cAAc,QAAQ,OAAO,CAAC,MAAM,EAAE,UAAU,OAAO,EAAE;AAI/D,QAAM,WAAW,QAAQ,UAAU,YAAY;AAC/C,SAAO,EAAE,SAAS,aAAa,SAAS;AAC1C;AA9BA;AAAA;AAAA;AAAA;AAAA;;;ACQO,SAAS,kBAAkB,QAA8B;AAC9D,MAAI,OAAO,UAAU,WAAY,QAAO;AACxC,QAAM,UAAU,OAAO;AACvB,SAAO,CAAC,CAAC,WAAW,OAAO,QAAQ,WAAW;AAChD;AAEO,SAAS,yBAAyB,QAKvC;AACA,MAAI,OAAO,UAAU,YAAY;AAC/B,UAAM,IAAI,MAAM,2CAA2C,OAAO,KAAK,GAAG;AAAA,EAC5E;AACA,QAAM,UAAU,OAAO;AACvB,QAAM,IAAI,SAAS,UAAU,EAAE,KAAK,GAAG,UAAU,GAAG,MAAM,GAAG,UAAU,EAAE;AACzE,SAAO,EAAE,UAAU,EAAE,UAAU,MAAM,EAAE,MAAM,UAAU,EAAE,UAAU,KAAK,EAAE,IAAI;AAChF;AA1BA;AAAA;AAAA;AAAA;AAAA;;;ACAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAgCA,eAAsB,sBAAsB,MAKlB;AACxB,QAAM,EAAE,MAAM,UAAU,MAAM,QAAQ,IAAI;AAE1C,QAAM,WAAW,QAAQ,KAAK,CAAC,MAAM,EAAE,UAAU,YAAY;AAC7D,MAAI,CAAC,UAAU;AACb,UAAM,OAAO;AAAA,MACX,IAAI;AAAA,QACF;AAAA,MACF;AAAA,MACA,EAAE,UAAU,EAAE;AAAA,IAChB;AAAA,EACF;AACA,QAAM,SAAS,SAAS,KAAK,CAAC,MAAM,SAAS,EAAE,IAAI,MAAM,IAAI;AAC7D,MAAI,CAAC,QAAQ;AACX,UAAM,OAAO,OAAO,IAAI,MAAM,iCAAiC,IAAI,GAAG,GAAG,EAAE,UAAU,EAAE,CAAC;AAAA,EAC1F;AAEA,QAAM,SAAiC,CAAC;AACxC,QAAM,SAKF,CAAC;AAWL,QAAM,cAAc,cAAc,QAAQ;AAC1C,MAAI,aAAa;AACf,UAAM,SAAS,2BAA2B,QAAQ;AAClD,WAAO,SAAS;AAChB,WAAO,KAAK,EAAE,OAAO,cAAc,QAAQ,OAAO,CAAC;AAAA,EACrD;AAEA,QAAM,OAAO,QAAQ,KAAK,CAAC,MAAM,EAAE,UAAU,MAAM;AACnD,MAAI,QAAQ,cAAc,IAAI,GAAG;AAC/B,UAAM,SAAS,qBAAqB,IAAI;AACxC,WAAO,OAAO;AACd,WAAO,KAAK,EAAE,OAAO,QAAQ,OAAO,CAAC;AAAA,EACvC;AAEA,QAAM,OAAO,QAAQ,KAAK,CAAC,MAAM,EAAE,UAAU,MAAM;AACnD,MAAI,QAAQ,cAAc,IAAI,GAAG;AAC/B,UAAM,SAAS,qBAAqB,IAAI;AACxC,WAAO,OAAO;AACd,WAAO,KAAK,EAAE,OAAO,QAAQ,OAAO,CAAC;AAAA,EACvC;AAEA,QAAM,MAAM,QAAQ,KAAK,CAAC,MAAM,EAAE,UAAU,UAAU;AACtD,MAAI,OAAO,kBAAkB,GAAG,GAAG;AACjC,UAAM,SAAS,yBAAyB,GAAG;AAC3C,WAAO,WAAW;AAClB,WAAO,KAAK,EAAE,OAAO,YAAY,OAAO,CAAC;AAAA,EAC3C;AAKA,MAAI,OAAO,KAAK,MAAM,EAAE,SAAS,GAAG;AAClC,UAAM,kBAAkB,MAAM,OAAO,IAAI,MAAM;AAAA,EACjD;AAEA,MAAI,CAAC,aAAa;AAGhB,UAAM,YAAY,OAAO,IAAI,CAAC,MAAM,EAAE,KAAK;AAC3C,UAAM,OAAO;AAAA,MACX,IAAI;AAAA,QACF,wCACE,UAAU,SAAS,SAAS,UAAU,KAAK,GAAG,CAAC,4BAA4B,eAC7E,cAAc,SAAS,OAAO;AAAA,MAChC;AAAA,MACA,EAAE,UAAU,EAAE;AAAA,IAChB;AAAA,EACF;AAEA,SAAO,EAAE,UAAU,OAAO,MAAM,OAAO;AACzC;AAaO,SAAS,wBAAwB,QAAkC;AACxE,QAAM,QAAQ,OAAO,QAAQ;AAC7B,QAAM,SAAS,OAAO,OAAO;AAC7B,QAAM,QAAQ,QAAQ;AACtB,MAAI,MAAM,gBAAW,KAAK;AAC1B,MAAI,SAAS,GAAG;AACd,WAAO;AAAA,SAAO,MAAM,yBAAyB,OAAO,OACjD,IAAI,CAAC,MAAM,GAAG,EAAE,IAAI,KAAK,EAAE,KAAK,GAAG,EACnC,KAAK,IAAI,CAAC;AAAA,EACf;AACA,SAAO;AAAA,4BAA+B,KAAK,WAAW,MAAM,UAAU,KAAK;AAC3E,SAAO;AACT;AAMA,eAAsB,2BAA2B,MAInB;AAC5B,QAAM,EAAE,MAAM,UAAU,QAAQ,IAAI;AAEpC,QAAM,SAAS,oBAAI,IAA2B;AAC9C,aAAW,KAAK,SAAS;AACvB,UAAM,MAAM,OAAO,IAAI,EAAE,IAAI,KAAK,CAAC;AACnC,QAAI,KAAK,CAAC;AACV,WAAO,IAAI,EAAE,MAAM,GAAG;AAAA,EACxB;AAEA,QAAM,UAA0B,CAAC;AACjC,QAAM,SAAqC,CAAC;AAM5C,aAAW,CAAC,MAAM,WAAW,KAAK,QAAQ;AACxC,QAAI;AACF,cAAQ,KAAK,MAAM,sBAAsB,EAAE,MAAM,UAAU,MAAM,SAAS,YAAY,CAAC,CAAC;AAAA,IAC1F,SAAS,GAAG;AACV,aAAO,KAAK,EAAE,MAAM,OAAQ,EAAY,QAAQ,CAAC;AAAA,IACnD;AAAA,EACF;AACA,SAAO,EAAE,SAAS,OAAO;AAC3B;AArLA;AAAA;AAAA;AAEA;AAGA;AACA;AACA;AACA;AAAA;AAAA;;;ACRA,SAAS,WAAAE,gBAAe;AACxB,SAAS,aAAa;;;ACDtB,SAAS,aAAa;AACtB,SAAS,qBAAqB;AAiC9B,IAAM,oBAAoB;AAEnB,SAAS,UAAU,YAA4B,CAAC,GAAY;AACjE,QAAM,YAAY,UAAU,aAAa;AACzC,QAAM,WAAmB,UAAU,aAAa,CAAC,KAAK,QAAQ,QAAQ,KAAK,KAAK,GAAG;AACnF,QAAM,cAAc,UAAU,eAAe;AAC7C,QAAM,iBAAiB,UAAU,kBAAkB,KAAK,OAAO;AAE/D,SAAO,CAAC,KAAK,MAAM,OAAO,CAAC,MACzB,IAAI,QAAQ,CAACC,UAAS,WAAW;AAC/B,UAAM,YAAY,KAAK,cAAc;AACrC,UAAM,QAAQ,UAAU,KAAK,CAAC,GAAG,IAAI,GAAG;AAAA,MACtC,KAAK,KAAK;AAAA,MACV,KAAK,KAAK,OAAO,QAAQ;AAAA,MACzB,OAAO,YAAY,CAAC,UAAU,WAAW,SAAS,IAAI,CAAC,UAAU,QAAQ,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAW/E,UAAU,KAAK,cAAc;AAAA,IAC/B,CAAC;AAGD,UAAM,MAAM,CAAC,KAAa,UAA0B;AAClD,UAAI,IAAI,UAAU,eAAgB,QAAO;AACzC,YAAM,OAAO,MAAM;AACnB,aAAO,KAAK,SAAS,iBACjB,KAAK,MAAM,GAAG,cAAc,IAAI,oBAChC;AAAA,IACN;AAEA,QAAI,SAAS;AACb,QAAI,SAAS;AAMb,UAAM,aAAa,IAAI,cAAc,OAAO;AAC5C,UAAM,aAAa,IAAI,cAAc,OAAO;AAC5C,QAAI,CAAC,WAAW;AACd,YAAM,QAAQ;AAAA,QACZ;AAAA,QACA,CAAC,UAAmB,SAAS,IAAI,QAAQ,WAAW,MAAM,KAAK,CAAC;AAAA,MAClE;AACA,YAAM,QAAQ;AAAA,QACZ;AAAA,QACA,CAAC,UAAmB,SAAS,IAAI,QAAQ,WAAW,MAAM,KAAK,CAAC;AAAA,MAClE;AAAA,IACF;AAKA,UAAM,YAAY,CAAC,QAA8B;AAC/C,UAAI,MAAM,QAAQ,OAAW;AAC7B,UAAI;AACF,iBAAS,CAAC,MAAM,KAAK,GAAG;AAAA,MAC1B,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,QAAI;AACJ,UAAM,QAAQ,KAAK,YACf,WAAW,MAAM;AACf,gBAAU,SAAS;AAEnB,kBAAY,WAAW,MAAM,UAAU,SAAS,GAAG,WAAW;AAG9D,gBAAU,MAAM;AAChB,aAAO,IAAI,MAAM,uBAAuB,KAAK,SAAS,OAAO,GAAG,EAAE,CAAC;AAAA,IACrE,GAAG,KAAK,SAAS,IACjB;AAEJ,UAAM,cAAc,MAAY;AAC9B,UAAI,MAAO,cAAa,KAAK;AAC7B,UAAI,UAAW,cAAa,SAAS;AAAA,IACvC;AAEA,UAAM,GAAG,SAAS,CAAC,QAAQ;AACzB,kBAAY;AACZ,aAAO,GAAG;AAAA,IACZ,CAAC;AACD,UAAM,GAAG,SAAS,CAAC,SAAS;AAC1B,kBAAY;AACZ,UAAI,CAAC,WAAW;AAGd,iBAAS,IAAI,QAAQ,WAAW,IAAI,CAAC;AACrC,iBAAS,IAAI,QAAQ,WAAW,IAAI,CAAC;AAAA,MACvC;AACA,MAAAA,SAAQ,EAAE,MAAM,QAAQ,IAAI,QAAQ,OAAO,CAAC;AAAA,IAC9C,CAAC;AAAA,EACH,CAAC;AACL;AAEO,IAAM,eAAwB,UAAU;;;AC1I/C,SAAS,gBAAgB;AACzB,SAAS,QAAAC,aAAY;;;ACQd,SAAS,UAAU,MAAoB;AAC5C,SAAO,KAAK,QAAQ,KAAK;AAC3B;;;ACPO,IAAM,mBAA2C;AAAA;AAAA,EAEtD,QAAQ;AAAA,EACR,iBAAiB;AAAA,EACjB,6BAA6B;AAAA,EAC7B,0BAA0B;AAAA,EAC1B,gCAAgC;AAAA,EAChC,gBAAgB;AAAA;AAAA,EAGhB,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,YAAY;AAAA;AAAA,EAGZ,aAAa;AAAA,EACb,qBAAqB;AAAA;AAAA,EAGrB,qBAAqB;AAAA,EACrB,qBAAqB;AAAA,EACrB,mCAAmC;AAAA,EACnC,oBAAoB;AAAA;AAAA,EAGpB,oBAAoB;AAAA,EACpB,wBAAwB;AAAA,EACxB,aAAa;AAAA;AAAA,EAGb,QAAQ;AAAA,EACR,wBAAwB;AAAA,EACxB,0BAA0B;AAAA,EAC1B,UAAU;AAAA,EACV,0BAA0B;AAAA,EAC1B,qBAAqB;AAAA,EACrB,cAAc;AAAA,EACd,SAAS;AAAA;AAAA,EAGT,kBAAkB;AAAA,EAClB,wBAAwB;AAC1B;;;AC9CA,SAAS,YAAY;AACrB,SAAS,YAAY;AAQrB,eAAe,OAAO,MAAgC;AACpD,MAAI;AACF,UAAM,KAAK,IAAI;AACf,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,QAAQ,SAAyB;AACxC,QAAM,OAAO,QAAQ,QAAQ,UAAU,EAAE,EAAE,MAAM,GAAG,EAAE,CAAC,KAAK;AAC5D,QAAM,IAAI,OAAO,SAAS,MAAM,EAAE;AAClC,SAAO,OAAO,MAAM,CAAC,IAAI,IAAI;AAC/B;AAcA,eAAsB,aACpB,UACAC,QACgC;AAChC,MAAI,CAAE,MAAM,OAAO,KAAK,UAAU,gBAAgB,CAAC,EAAI,QAAO;AAM9D,MAAI;AAKF,QAAI,CAAE,MAAM,OAAO,KAAK,UAAU,cAAc,CAAC,GAAI;AACnD,YAAM,UAAU,MAAMA,OAAM,QAAQ,CAAC,WAAW,mBAAmB,GAAG;AAAA,QACpE,KAAK;AAAA,QACL,WAAW;AAAA,MACb,CAAC;AACD,UAAI,QAAQ,SAAS,EAAG,QAAO;AAAA,IACjC;AAIA,UAAM,MAAM,MAAMA,OAAM,QAAQ,CAAC,YAAY,QAAQ,GAAG;AAAA,MACtD,KAAK;AAAA,MACL,WAAW;AAAA,IACb,CAAC;AACD,UAAM,SAAS,KAAK,MAAM,IAAI,UAAU,IAAI;AAI5C,UAAM,UAAU,OAAO,OAAO,MAAM;AACpC,WAAO;AAAA,MACL,UAAU,QAAQ;AAAA,MAClB,OAAO,QAAQ,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,QAAQ,EAAE,MAAM,IAAI,QAAQ,EAAE,OAAO,CAAC,EACzF;AAAA,IACL;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;AHhDA,SAAS,WAAW,OAAuB;AACzC,SAAO,MAAM,QAAQ,UAAU,EAAE;AACnC;AAMA,SAAS,kBAAkB,MAAuB;AAChD,SAAO,YAAY,KAAK,KAAK,KAAK,CAAC;AACrC;AAEA,SAAS,YAAY,GAAqC;AACxD,QAAM,UAAU,WAAW,CAAC,EAAE,MAAM,GAAG,EAAE,CAAC,KAAK;AAC/C,QAAM,QAAQ,QAAQ,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,OAAO,SAAS,GAAG,EAAE,CAAC;AAClE,SAAO,CAAC,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;AACrD;AAEA,SAAS,cAAc,QAAgB,UAAyB;AAC9D,QAAM,CAAC,QAAQ,QAAQ,MAAM,IAAI,YAAY,MAAM;AACnD,QAAM,CAAC,QAAQ,QAAQ,MAAM,IAAI,YAAY,QAAQ;AACrD,MAAI,SAAS,OAAQ,QAAO;AAC5B,MAAI,SAAS,OAAQ,QAAO;AAC5B,MAAI,SAAS,OAAQ,QAAO;AAC5B,MAAI,SAAS,OAAQ,QAAO;AAC5B,MAAI,SAAS,OAAQ,QAAO;AAC5B,MAAI,SAAS,OAAQ,QAAO;AAC5B,SAAO;AACT;AAEA,eAAsB,UAAU,KAAyC;AACvE,QAAM,UAAUC,MAAK,IAAI,KAAK,MAAM,cAAc;AAClD,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,SAAS,SAAS,OAAO;AAAA,EAC1C,SAAS,KAAK;AACZ,WAAO;AAAA,MACL,OAAO;AAAA,MACP,MAAM,UAAU,IAAI,IAAI;AAAA,MACxB,QAAQ;AAAA,MACR,SAAS,sBAAsB,OAAO;AAAA,MACtC,SAAS,EAAE,OAAO,OAAO,GAAG,EAAE;AAAA,IAChC;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,UAAM,KAAK,MAAM,MAAM;AAAA,EAIzB,SAAS,KAAK;AACZ,WAAO;AAAA,MACL,OAAO;AAAA,MACP,MAAM,UAAU,IAAI,IAAI;AAAA,MACxB,QAAQ;AAAA,MACR,SAAS,mCAAoC,IAAc,OAAO;AAAA,MAClE,SAAS,EAAE,OAAO,OAAO,GAAG,EAAE;AAAA,IAChC;AAAA,EACF;AACA,QAAM,YAAoC;AAAA,IACxC,GAAI,IAAI,gBAAgB,CAAC;AAAA,IACzB,GAAI,IAAI,mBAAmB,CAAC;AAAA,EAC9B;AAEA,QAAM,UAA4B,CAAC;AACnC,aAAW,CAAC,MAAM,QAAQ,KAAK,OAAO,QAAQ,gBAAgB,GAAG;AAC/D,UAAM,SAAS,UAAU,IAAI;AAC7B,QAAI,CAAC,OAAQ;AAGb,QAAI,CAAC,kBAAkB,MAAM,EAAG;AAChC,YAAQ,KAAK;AAAA,MACX,KAAK;AAAA,MACL;AAAA,MACA;AAAA,MACA,OAAO,cAAc,QAAQ,QAAQ;AAAA,IACvC,CAAC;AAAA,EACH;AAEA,QAAM,WAAW,QAAQ,KAAK,CAAC,MAAM,EAAE,UAAU,OAAO;AACxD,QAAM,WAAW,QAAQ,KAAK,CAAC,MAAM,EAAE,UAAU,OAAO;AACxD,QAAM,WAAW,QAAQ,KAAK,CAAC,MAAM,EAAE,UAAU,OAAO;AAIxD,QAAM,SAAgC,WAAW,SAAS,YAAY,WAAW,SAAS;AAE1F,QAAM,eACJ,WAAW,SACP,OAAO,QAAQ,MAAM,wCACrB,WAAW,SACT,GAAG,QAAQ,OAAO,CAAC,MAAM,EAAE,UAAU,MAAM,EAAE,MAAM,OAAO,QAAQ,MAAM,0BACxE,GAAG,QAAQ,OAAO,CAAC,MAAM,EAAE,UAAU,OAAO,EAAE,MAAM;AAE5D,QAAM,WAAW,MAAM,aAAa,IAAI,KAAK,MAAM,IAAI,SAAS,YAAY;AAC5E,QAAM,UAAU,WACZ,GAAG,YAAY,KAAK,SAAS,QAAQ,yBAAyB,SAAS,KAAK,YAC5E;AAEJ,SAAO;AAAA,IACL,OAAO;AAAA,IACP,MAAM,UAAU,IAAI,IAAI;AAAA,IACxB;AAAA,IACA;AAAA,IACA,SAAS,EAAE,SAAS,SAAS;AAAA,EAC/B;AACF;;;AIzIA,SAAS,kBAAkB;AAC3B,SAAS,YAAAC,iBAAgB;AACzB,SAAS,QAAAC,aAAY;AACrB,SAAS,cAAc;AACvB,SAAS,SAAS,eAAe,iBAAiB,6BAA6B;AAC/E,SAAS,YAAY;AAKrB,IAAM,eAAe,CAAC,qBAAqB;AAC3C,IAAM,SAAS,CAAC,mBAAmB,WAAW,kBAAkB,YAAY,aAAa;AAEzF,eAAe,UAAU,KAAgC;AACvD,SAAO,KAAK,cAAc,EAAE,KAAK,QAAQ,QAAQ,UAAU,MAAM,CAAC;AACpE;AAEA,eAAsB,UAAU,KAAyC;AACvE,QAAM,EAAE,KAAK,IAAI;AACjB,QAAM,aAAaC,MAAK,KAAK,MAAM,kBAAkB;AAErD,MAAI,CAAC,WAAW,UAAU,GAAG;AAC3B,WAAO;AAAA,MACL,OAAO;AAAA,MACP,MAAM,UAAU,IAAI;AAAA,MACpB,QAAQ;AAAA,MACR,SAAS;AAAA,IACX;AAAA,EACF;AAEA,QAAM,SAAS,IAAI,OAAO;AAAA,IACxB,KAAK,KAAK;AAAA,IACV,oBAAoB;AAAA,IACpB,yBAAyB;AAAA,EAC3B,CAAC;AAED,QAAM,WAAW,MAAM,UAAU,KAAK,IAAI;AAI1C,QAAM,gBAAgB,MAAM,OAAO,UAAU,QAAQ;AACrD,QAAM,eAAe,cAAc,OAAO,CAAC,GAAG,MAAM,IAAI,EAAE,YAAY,CAAC;AACvE,QAAM,iBAAiB,cAAc,OAAO,CAAC,GAAG,MAAM,IAAI,EAAE,cAAc,CAAC;AAE3E,QAAM,sBAAgC,CAAC;AACvC,aAAW,OAAO,UAAU;AAC1B,UAAM,gBAAgBA,MAAK,KAAK,MAAM,GAAG;AACzC,UAAM,SAAS,MAAMC,UAAS,eAAe,OAAO;AACpD,UAAM,UAAW,MAAM,sBAAsB,aAAa,KAAM,CAAC;AACjE,UAAM,KAAK,MAAM,cAAc,QAAQ,EAAE,GAAG,SAAS,UAAU,cAAc,CAAC;AAC9E,QAAI,CAAC,GAAI,qBAAoB,KAAK,GAAG;AAAA,EACvC;AAEA,QAAM,SACJ,eAAe,KAAK,oBAAoB,SAAS,IAC7C,SACA,iBAAiB,IACf,SACA;AAER,QAAM,UACJ,WAAW,SACP,qBAAqB,SAAS,MAAM,WACpC,GAAG,YAAY,mBAAmB,cAAc,cAAc,oBAAoB,MAAM;AAE9F,SAAO;AAAA,IACL,OAAO;AAAA,IACP,MAAM,UAAU,IAAI;AAAA,IACpB;AAAA,IACA;AAAA,IACA,SAAS;AAAA,MACP;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,SAAS;AAAA,IAClB;AAAA,EACF;AACF;;;AC9BA,SAAS,SAAS,GAAW;AAC3B,MAAI,EAAE,WAAW,KAAK,EAAE,OAAO,EAAG,QAAO;AACzC,MAAI,EAAE,WAAW,KAAK,EAAE,MAAM,EAAG,QAAO;AACxC,SAAO;AACT;AAEA,SAAS,kBAAkB,GAAsB;AAC/C,MAAI,MAAM,SAAS,MAAM,cAAc,MAAM,UAAU,MAAM,WAAY,QAAO;AAGhF,SAAO;AACT;AAEA,SAAS,0BAA0B,QAAwC;AACzE,QAAM,MAAuB,CAAC;AAC9B,aAAW,KAAK,OAAO,OAAO,OAAO,cAAc,CAAC,CAAC,GAAG;AACtD,QAAI,CAAC,EAAG;AACR,QAAI,KAAK;AAAA,MACP,QAAQ,EAAE,eAAe;AAAA,MACzB,UAAU,kBAAkB,EAAE,QAAQ;AAAA,MACtC,OAAO,EAAE,SAAS;AAAA,MAClB,GAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;AAAA,MACjC,GAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC;AAAA,IAChC,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAKA,SAAS,uBACP,WACA,iBACiE;AACjE,QAAM,OAAO,oBAAI,IAAY;AAC7B,MAAI,UAAU;AACd,SAAO,CAAC,KAAK,IAAI,OAAO,GAAG;AACzB,SAAK,IAAI,OAAO;AAChB,UAAM,QAAQ,gBAAgB,OAAO;AACrC,QAAI,CAAC,SAAS,CAAC,MAAM,QAAQ,MAAM,GAAG,EAAG,QAAO,EAAE,UAAU,QAAQ;AAEpE,UAAM,WAAW,MAAM,IAAI;AAAA,MACzB,CAAC,MAA6C,OAAO,MAAM,YAAY,MAAM;AAAA,IAC/E;AACA,QAAI,SAAU,QAAO,EAAE,UAAU,SAAS,QAAQ,SAAS;AAE3D,UAAM,OAAO,MAAM,IAAI,KAAK,CAAC,MAAmB,OAAO,MAAM,QAAQ;AACrE,QAAI,CAAC,QAAQ,SAAS,QAAS,QAAO,EAAE,UAAU,QAAQ;AAC1D,cAAU;AAAA,EACZ;AACA,SAAO,EAAE,UAAU,QAAQ;AAC7B;AAEA,SAAS,yBAAyB,QAAuC;AACvE,QAAM,kBAAkB,OAAO,mBAAmB,CAAC;AACnD,QAAM,QAAQ,oBAAI,IAA2B;AAE7C,aAAW,CAAC,MAAM,CAAC,KAAK,OAAO,QAAQ,eAAe,GAAG;AACvD,QAAI,CAAC,EAAG;AACR,UAAM,EAAE,UAAU,OAAO,IAAI,uBAAuB,MAAM,eAAe;AACzE,QAAI,MAAM,IAAI,QAAQ,EAAG;AAEzB,UAAM,YAAY,gBAAgB,QAAQ;AAC1C,UAAM,WAAW,kBAAkB,WAAW,YAAY,EAAE,QAAQ;AACpE,UAAM,QAAQ,QAAQ,SAAS;AAC/B,UAAM,MAAM,QAAQ;AAEpB,UAAM,IAAI,UAAU;AAAA,MAClB,QAAQ,WAAW,QAAQ;AAAA,MAC3B;AAAA,MACA;AAAA,MACA,GAAI,MAAM,EAAE,IAAI,IAAI,CAAC;AAAA,IACvB,CAAC;AAAA,EACH;AAEA,SAAO,CAAC,GAAG,MAAM,OAAO,CAAC;AAC3B;AAOA,eAAe,aACbC,QACA,KACA,MACA,KACqB;AACrB,MAAI;AACJ,MAAI;AACF,UAAM,MAAMA,OAAM,KAAK,MAAM,EAAE,IAAI,CAAC;AAAA,EACtC,SAAS,KAAK;AACZ,UAAM,IAAI;AACV,QAAI,EAAE,SAAS,YAAY,SAAS,KAAK,OAAO,GAAG,CAAC,EAAG,QAAO,EAAE,MAAM,UAAU;AAChF,WAAO,EAAE,MAAM,SAAS,QAAQ,iBAAiB,OAAO,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC,GAAG;AAAA,EAC/E;AAGA,MAAI,IAAI,SAAS,KAAK,IAAI,SAAS,GAAG;AACpC,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ,QAAQ,IAAI,IAAI,GAAG,IAAI,SAAS,KAAK,IAAI,OAAO,MAAM,GAAG,GAAG,CAAC,KAAK,EAAE;AAAA,IAC9E;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,IAAI,UAAU,IAAI;AAAA,EACxC,SAAS,KAAK;AACZ,WAAO,EAAE,MAAM,SAAS,QAAQ,qBAAqB,OAAO,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC,GAAG;AAAA,EACnF;AAIA,QAAM,cAAe,OAAoD;AACzE,MAAI,eAAe,OAAO,gBAAgB,UAAU;AAClD,WAAO,EAAE,MAAM,SAAS,QAAQ,YAAY,QAAQ,0BAA0B;AAAA,EAChF;AAMA,QAAM,YAAY,OAAO,UAAU;AACnC,MAAI,CAAC,aAAa,OAAO,KAAK,SAAS,EAAE,WAAW,GAAG;AACrD,WAAO,EAAE,MAAM,SAAS,QAAQ,wCAAwC;AAAA,EAC1E;AAEA,SAAO,EAAE,MAAM,MAAM,OAAO;AAC9B;AAEA,eAAsB,cAAc,KAAyC;AAC3E,QAAMA,SAAQ,IAAI,SAAS;AAC3B,QAAM,OAAO,IAAI;AACjB,QAAM,QAAQ,UAAU,IAAI;AAE5B,MAAI,OAAmC;AACvC,MAAI,SAAS,MAAM,aAAaA,QAAO,QAAQ,CAAC,SAAS,UAAU,QAAQ,GAAG,KAAK,IAAI;AAMvF,MAAI,OAAO,SAAS,MAAM;AACxB,UAAM,aAAa,OAAO,SAAS,YAAY,kBAAkB,OAAO;AACxE,UAAM,YAAY,MAAM;AAAA,MACtBA;AAAA,MACA;AAAA,MACA,CAAC,SAAS,UAAU,YAAY;AAAA,MAChC,KAAK;AAAA,IACP;AACA,QAAI,UAAU,SAAS,MAAM;AAC3B,eAAS;AACT,aAAO;AAAA,IACT,OAAO;AACL,YAAM,YAAY,UAAU,SAAS,YAAY,kBAAkB,UAAU;AAC7E,aAAO;AAAA,QACL,OAAO;AAAA,QACP,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,SAAS,iCAA4B,UAAU,UAAU,SAAS;AAAA,MACpE;AAAA,IACF;AAAA,EACF;AAEA,QAAM,SAAS,OAAO;AAEtB,QAAM,SAAiB;AAAA,IACrB,KAAK,OAAO,UAAU,iBAAiB,OAAO;AAAA,IAC9C,UAAU,OAAO,UAAU,iBAAiB,YAAY;AAAA,IACxD,MAAM,OAAO,UAAU,iBAAiB,QAAQ;AAAA,IAChD,UAAU,OAAO,UAAU,iBAAiB,YAAY;AAAA,EAC1D;AAEA,QAAM,aACJ,SAAS,eAAe,0BAA0B,MAAM,IAAI,yBAAyB,MAAM;AAE7F,QAAM,SAAS,SAAS,MAAM;AAC9B,QAAM,QAAQ,OAAO,MAAM,OAAO,WAAW,OAAO,OAAO,OAAO;AAClE,QAAM,UACJ,WAAW,SACP,GAAG,IAAI,wBACP,GAAG,IAAI,KAAK,KAAK,qBAAqB,OAAO,QAAQ,KAAK,OAAO,IAAI,KAAK,OAAO,QAAQ,KAAK,OAAO,GAAG;AAE9G,SAAO;AAAA,IACL,OAAO;AAAA,IACP,MAAM;AAAA,IACN;AAAA,IACA;AAAA,IACA,SAAS,EAAE,QAAQ,WAAW;AAAA,EAChC;AACF;;;AChPA,SAAS,YAAAC,WAAU,WAAW,SAAS,IAAI,eAAe;AAC1D,SAAS,cAAc;AACvB,SAAS,QAAAC,aAAY;;;ACFd,IAAM,mBAAmB;AAAA,EAC9B,IAAI;AAAA,IACF,SAAS;AAAA,MACP,KAAK,CAAC,yCAAyC;AAAA;AAAA;AAAA;AAAA,MAI/C,oBAAoB;AAAA,MACpB,yBAAyB;AAAA,MACzB,yBAAyB;AAAA,MACzB,cAAc;AAAA,MACd,UAAU;AAAA,QACR,QAAQ;AAAA,QACR,YAAY,CAAC,YAAY;AAAA,MAC3B;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,YAAY;AAAA,QACV,4BAA4B,CAAC,SAAS,EAAE,UAAU,KAAK,CAAC;AAAA,QACxD,6BAA6B,CAAC,SAAS,EAAE,UAAU,IAAI,CAAC;AAAA,QACxD,kBAAkB,CAAC,SAAS,EAAE,UAAU,IAAI,CAAC;AAAA,QAC7C,0BAA0B,CAAC,QAAQ,EAAE,UAAU,IAAI,CAAC;AAAA,MACtD;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,QAAQ;AAAA,IACV;AAAA,EACF;AACF;;;AC5BA,SAAS,YAAAC,iBAAgB;AACzB,SAAS,QAAAC,aAAY;AAarB,eAAsB,eAAe,UAAuC;AAC1E,MAAI;AACJ,MAAI;AACF,UAAM,MAAMD,UAASC,MAAK,UAAU,cAAc,GAAG,OAAO;AAAA,EAC9D,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACA,MAAI;AACJ,MAAI;AACF,UAAM,KAAK,MAAM,GAAG;AAAA,EACtB,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACA,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO,CAAC;AAC7C,QAAM,MAAO,IAA8B;AAC3C,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO,CAAC;AAE7C,QAAM,MAAkB,CAAC;AACzB,QAAM,MAAO,IAAoC;AACjD,MAAI,OAAO,QAAQ,YAAY,IAAI,SAAS,GAAG;AAC7C,QAAI,gBAAgB;AAAA,EACtB;AACA,SAAO;AACT;;;ACrCA,SAAS,oBAAoB;AAuB7B,eAAsB,eAAgC;AACpD,SAAO,IAAI,QAAQ,CAACC,UAAS,WAAW;AACtC,UAAM,SAAS,aAAa;AAC5B,WAAO,MAAM;AACb,WAAO,GAAG,SAAS,MAAM;AACzB,WAAO,OAAO,GAAG,aAAa,MAAM;AAClC,YAAM,OAAO,OAAO,QAAQ;AAC5B,UAAI,OAAO,SAAS,YAAY,MAAM;AACpC,cAAM,OAAO,KAAK;AAClB,eAAO,MAAM,MAAMA,SAAQ,IAAI,CAAC;AAAA,MAClC,OAAO;AACL,eAAO,MAAM;AACb,eAAO,IAAI,MAAM,6DAA6D,CAAC;AAAA,MACjF;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AACH;AAOO,SAAS,aAAa,KAAa,MAAsB;AAC9D,QAAM,IAAI,IAAI,IAAI,GAAG;AACrB,IAAE,WAAW;AACb,IAAE,OAAO,OAAO,IAAI;AACpB,SAAO,EAAE,SAAS;AACpB;;;AHfA,eAAe,cAAiB,MAAiC;AAC/D,MAAI;AACF,UAAM,MAAM,MAAMC,UAAS,MAAM,OAAO;AACxC,WAAO,KAAK,MAAM,GAAG;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAeA,eAAe,eAAe,YAA8C;AAC1E,QAAM,QAAQ,MAAM,QAAQ,UAAU,EAAE,MAAM,MAAM,CAAC,CAAa;AAClE,QAAM,UAA2B,CAAC;AAClC,aAAW,KAAK,OAAO;AACrB,QAAI,CAAC,EAAE,WAAW,MAAM,KAAK,CAAC,EAAE,SAAS,OAAO,EAAG;AACnD,UAAM,MAAM,MAAM,cAAuBC,MAAK,YAAY,CAAC,CAAC;AAC5D,QAAI,CAAC,OAAO,CAAC,IAAI,WAAY;AAC7B,UAAM,UAAkC,CAAC;AACzC,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,IAAI,UAAU,GAAG;AACnD,UAAI,OAAO,GAAG,UAAU,SAAU,SAAQ,CAAC,IAAI,EAAE;AAAA,IACnD;AACA,YAAQ,KAAK,EAAE,KAAK,IAAI,cAAc,QAAQ,CAAC;AAAA,EACjD;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,SAAkD;AAC1E,MAAI,QAAQ,WAAW,EAAG,QAAO,CAAC;AAClC,QAAM,OAA+B,CAAC;AACtC,QAAM,SAAiC,CAAC;AACxC,aAAW,KAAK,SAAS;AACvB,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,EAAE,WAAW,CAAC,CAAC,GAAG;AACpD,UAAI,OAAO,MAAM,SAAU;AAC3B,WAAK,CAAC,KAAK,KAAK,CAAC,KAAK,KAAK;AAC3B,aAAO,CAAC,KAAK,OAAO,CAAC,KAAK,KAAK;AAAA,IACjC;AAAA,EACF;AACA,QAAM,MAA8B,CAAC;AACrC,aAAW,KAAK,OAAO,KAAK,IAAI,GAAG;AACjC,UAAM,QAAQ,KAAK,CAAC,KAAK;AACzB,UAAM,QAAQ,OAAO,CAAC,KAAK;AAC3B,QAAI,CAAC,IAAI,QAAQ;AAAA,EACnB;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,GAA4B;AAEzD,QAAM,WAAW,EAAE,KAAK,QAAQ,GAAG;AACnC,SAAO,YAAY,IAAI,EAAE,KAAK,MAAM,WAAW,CAAC,IAAI,EAAE;AACxD;AAEA,SAAS,oBAAoB,GAA4B;AAIvD,QAAM,SAAS,OAAO,EAAE,WAAW,WAAW,EAAE,OAAO,QAAQ,CAAC,IAAI;AACpE,SAAO,GAAG,EAAE,IAAI,IAAI,EAAE,QAAQ,IAAI,EAAE,QAAQ,aAAa,MAAM;AACjE;AAIA,eAAe,iBACb,YACA,OACA,KACsB;AACtB,QAAM,WAAW,MAAM,eAAe,UAAU;AAEhD,MAAI,SAAS,WAAW,GAAG;AACzB,WAAO;AAAA,MACL,OAAO;AAAA,MACP,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,SAAS,2CAA2C,IAAI,IAAI,IAC1D,IAAI,SAAS,WAAM,IAAI,OAAO,MAAM,GAAG,GAAG,CAAC,KAAK,EAClD;AAAA,IACF;AAAA,EACF;AAEA,QAAM,mBACH,MAAM,cAAiCA,MAAK,YAAY,wBAAwB,CAAC,KAAM,CAAC;AAE3F,QAAM,SAAS,iBAAiB,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM;AACvD,QAAM,aAAa,OAAO,IAAI,CAAC,OAAO;AAAA,IACpC,UAAU,sBAAsB,CAAC;AAAA,IACjC,OAAO,EAAE;AAAA,IACT,SAAS,oBAAoB,CAAC;AAAA,EAChC,EAAE;AAEF,QAAM,WAAW,WAAW,KAAK,CAAC,MAAM,EAAE,UAAU,OAAO;AAC3D,QAAM,UAAU,WAAW,KAAK,CAAC,MAAM,EAAE,UAAU,MAAM;AACzD,QAAM,SAAgC,WAAW,SAAS,UAAU,SAAS;AAE7E,QAAM,aAAmC;AAAA,IACvC,SAAS,iBAAiB,QAAQ;AAAA,IAClC,kBAAkB,OAAO;AAAA,IACzB;AAAA,EACF;AAEA,QAAM,UACJ,WAAW,SACP,uCACA,eAAe,OAAO,MAAM;AAElC,SAAO,EAAE,OAAO,cAAc,MAAM,OAAO,QAAQ,SAAS,SAAS,WAAW;AAClF;AAIA,eAAe,mBAAmBC,QAAgB,MAAY,OAAqC;AACjG,QAAM,UAAU,MAAM,eAAe,KAAK,IAAI;AAI9C,QAAM,OAAO,MAAM,aAAa;AAChC,QAAM,UAAU,QAAQ,iBAAiB,iBAAiB,GAAG,QAAQ,IAAI,CAAC;AAC1E,QAAM,iBAAiB;AAAA,IACrB,GAAG;AAAA,IACH,IAAI;AAAA,MACF,GAAG,iBAAiB;AAAA,MACpB,SAAS;AAAA,QACP,GAAG,iBAAiB,GAAG;AAAA,QACvB,KAAK,CAAC,aAAa,SAAS,IAAI,CAAC;AAAA,QACjC,oBAAoB,8BAA8B,IAAI;AAAA,MACxD;AAAA,IACF;AAAA,EACF;AAEA,QAAM,YAAY,MAAM,QAAQD,MAAK,OAAO,GAAG,eAAe,CAAC;AAC/D,QAAM,aAAaA,MAAK,WAAW,mBAAmB;AACtD,QAAM,UAAU,YAAY,KAAK,UAAU,cAAc,GAAG,OAAO;AAEnE,QAAM,aAAaA,MAAK,KAAK,MAAM,eAAe;AAClD,QAAM,GAAG,YAAY,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAErD,MAAI;AACJ,MAAI;AACF,UAAM,MAAMC,OAAM,OAAO,CAAC,SAAS,aAAa,WAAW,YAAY,UAAU,EAAE,GAAG;AAAA,MACpF,KAAK,KAAK;AAAA,MACV,WAAW,IAAI;AAAA,IACjB,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,GAAG,WAAW,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AACpD,UAAM,IAAI;AACV,QAAI,EAAE,SAAS,YAAY,SAAS,KAAK,OAAO,GAAG,CAAC,GAAG;AACrD,aAAO;AAAA,QACL,OAAO;AAAA,QACP,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,SAAS;AAAA,MACX;AAAA,IACF;AACA,UAAM;AAAA,EACR;AACA,QAAM,GAAG,WAAW,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAEpD,SAAO,iBAAiB,YAAY,OAAO,GAAG;AAChD;AAKA,eAAe,mBACbA,QACA,aACA,OACsB;AACtB,QAAM,UAAU,MAAM,QAAQD,MAAK,OAAO,GAAG,sBAAsB,CAAC;AACpE,QAAM,iBAAiB;AAAA,IACrB,IAAI;AAAA;AAAA;AAAA,MAGF,SAAS;AAAA,QACP,KAAK,CAAC,WAAW;AAAA;AAAA;AAAA,QAGjB,cAAc;AAAA,QACd,UAAU,EAAE,QAAQ,WAAW,YAAY,CAAC,YAAY,EAAE;AAAA,MAC5D;AAAA,MACA,QAAQ,iBAAiB,GAAG;AAAA,MAC5B,QAAQ,EAAE,QAAQ,cAAc,WAAWA,MAAK,SAAS,aAAa,EAAE;AAAA,IAC1E;AAAA,EACF;AAEA,QAAM,aAAaA,MAAK,SAAS,mBAAmB;AACpD,QAAM,UAAU,YAAY,KAAK,UAAU,cAAc,GAAG,OAAO;AAEnE,QAAM,aAAaA,MAAK,SAAS,eAAe;AAEhD,MAAI;AACJ,MAAI;AACF,UAAM,MAAMC,OAAM,OAAO,CAAC,SAAS,aAAa,WAAW,YAAY,UAAU,EAAE,GAAG;AAAA,MACpF,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAML,WAAW,IAAI;AAAA,IACjB,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,GAAG,SAAS,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAClD,UAAM,IAAI;AACV,QAAI,EAAE,SAAS,YAAY,SAAS,KAAK,OAAO,GAAG,CAAC,GAAG;AACrD,aAAO;AAAA,QACL,OAAO;AAAA,QACP,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,SAAS;AAAA,MACX;AAAA,IACF;AACA,UAAM;AAAA,EACR;AAEA,MAAI;AACF,WAAO,MAAM,iBAAiB,YAAY,OAAO,GAAG;AAAA,EACtD,UAAE;AACA,UAAM,GAAG,SAAS,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EACpD;AACF;AAEA,eAAsB,gBAAgB,KAAyC;AAC7E,QAAMA,SAAQ,IAAI,SAAS;AAC3B,QAAM,OAAO,IAAI;AACjB,QAAM,QAAQ,UAAU,IAAI;AAE5B,SAAO,KAAK,cACR,mBAAmBA,QAAO,KAAK,aAAa,KAAK,IACjD,mBAAmBA,QAAO,MAAM,KAAK;AAC3C;;;AItRA,SAAS,YAAAC,WAAU,aAAAC,YAAW,WAAAC,UAAS,MAAAC,WAAU;AACjD,SAAS,QAAAC,aAAY;;;ACDrB,SAAS,cAAc,eAA0C;AAI1D,IAAM,aAA0B;AAAA,EACrC,EAAE,MAAM,sBAAsB,MAAM,gBAAgB;AAAA,EACpD,EAAE,MAAM,mBAAmB,MAAM,kBAAkB;AACrD;AAQO,IAAM,cAA2B,CAAC,EAAE,MAAM,KAAK,MAAM,OAAO,CAAC;AAE7D,IAAM,uBAA6C,aAAa;AAAA,EACrE,SAAS;AAAA,EACT,WAAW;AAAA,EACX,eAAe;AAAA,EACf,YAAY,CAAC,CAAC,QAAQ,IAAI;AAAA,EAC1B,SAAS,QAAQ,IAAI,KAAK,IAAI;AAAA,EAC9B,UAAU,QAAQ,IAAI,KAAK,WAAW;AAAA,EACtC,KAAK;AAAA,IACH,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA,EACA,UAAU;AAAA,IACR;AAAA,MACE,MAAM;AAAA,MACN,KAAK,EAAE,GAAG,QAAQ,gBAAgB,EAAE;AAAA,IACtC;AAAA,EACF;AAAA,EACA,WAAW;AAAA;AAAA,IAET,SAAS;AAAA,IACT,KAAK;AAAA,IACL,qBAAqB,CAAC,QAAQ,IAAI;AAAA,IAClC,SAAS;AAAA,EACX;AACF,CAAC;;;ADfD,IAAM,cAAc;AAEpB,eAAeC,eAAiB,MAAiC;AAC/D,MAAI;AACF,UAAM,MAAM,MAAMC,UAAS,MAAM,OAAO;AACxC,WAAO,KAAK,MAAM,GAAG;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAOA,SAAS,sBAAsB,MAAc,UAA0B;AACrE,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iCAUwB,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,2CAWM,IAAI;AAAA,6BAClB,IAAI;AAAA,WACtB,KAAK,UAAU,QAAQ,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAMnC;AAOA,SAAS,YAAoB;AAC3B,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA,gBAKO,KAAK,UAAU,UAAU,CAAC;AAAA,qBACrB,KAAK,UAAU,WAAW,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA8EhD;AAEA,eAAsB,UAAU,KAAyC;AACvE,QAAMC,SAAQ,IAAI,SAAS;AAC3B,QAAM,OAAO,IAAI;AACjB,QAAM,QAAQ,UAAU,IAAI;AAQ5B,QAAM,UAAU,MAAMC,SAAQC,MAAK,KAAK,MAAM,qBAAqB,CAAC;AAMpE,MAAI;AACF,UAAM,WAAWA,MAAK,SAAS,cAAc;AAC7C,UAAMC,WAAU,UAAU,UAAU,GAAG,OAAO;AAE9C,UAAM,OAAO,MAAM,aAAa;AAChC,UAAM,aAAaD,MAAK,SAAS,sBAAsB;AACvD,UAAMC,WAAU,YAAY,sBAAsB,MAAM,KAAK,IAAI,GAAG,OAAO;AAE3E,UAAM,cAAcD,MAAK,KAAK,MAAM,WAAW;AAE/C,UAAME,IAAGF,MAAK,KAAK,MAAM,eAAe,GAAG,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAE3E,QAAI;AACJ,QAAI;AACF,YAAM,MAAMF;AAAA,QACV;AAAA,QACA,CAAC,SAAS,cAAc,QAAQ,YAAY,UAAU,IAAI,mBAAmB,QAAQ;AAAA,QACrF;AAAA,UACE,KAAK,KAAK;AAAA,UACV,KAAK,EAAE,GAAG,QAAQ,KAAK,qBAAqB,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA,UAKxD,WAAW,IAAI;AAAA,QACjB;AAAA,MACF;AAAA,IACF,SAAS,KAAK;AACZ,YAAM,IAAI;AACV,UAAI,EAAE,SAAS,YAAY,SAAS,KAAK,OAAO,GAAG,CAAC,GAAG;AACrD,eAAO;AAAA,UACL,OAAO;AAAA,UACP,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,SAAS;AAAA,QACX;AAAA,MACF;AACA,YAAM;AAAA,IACR;AAEA,UAAM,WAAW,MAAMF,eAA8B,WAAW;AAEhE,QAAI,CAAC,UAAU;AACb,aAAO;AAAA,QACL,OAAO;AAAA,QACP,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,SAAS,kCAAkC,IAAI,IAAI,IACjD,IAAI,SAAS,WAAM,IAAI,OAAO,MAAM,GAAG,GAAG,CAAC,KAAK,EAClD;AAAA,MACF;AAAA,IACF;AAEA,UAAM,cACH,SAAS,SAAS,WAAW,KAAK,MAAM,SAAS,SAAS,YAAY,KAAK;AAC9E,UAAM,SAAS,SAAS,kBAAkB;AAE1C,UAAM,SAAgC,aAAa,SAAS,SAAS,SAAS;AAC9E,UAAM,UACJ,WAAW,SACP,6BAA6B,WAAW,MAAM,aAAa,YAAY,MAAM,sBAC7E,SAAS,SAAS,eAAe;AAEvC,WAAO;AAAA,MACL,OAAO;AAAA,MACP,MAAM;AAAA,MACN;AAAA,MACA;AAAA,MACA,SAAS;AAAA,IACX;AAAA,EACF,UAAE;AACA,UAAMM,IAAG,SAAS,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EACpD;AACF;;;AEtPA,IAAM,WAA2E;AAAA,EAC/E,MAAM;AAAA,EACN,MAAM;AAAA,EACN,UAAU;AAAA,EACV,YAAY;AAAA,EACZ,MAAM;AACR;AAEO,IAAM,kBAAkB,OAAO,KAAK,QAAQ;AAGnD,IAAM,2BAA2B;AAEjC,SAAS,WAAW,WAA4B;AAC9C,SAAO,CAAC,KAAK,MAAM,OAAO,CAAC,MACzB,aAAa,KAAK,MAAM,EAAE,GAAG,MAAM,WAAW,KAAK,aAAa,UAAU,CAAC;AAC/E;AAMA,eAAsB,YAAY,MAAY,MAAuC;AACnF,MAAI,EAAE,QAAQ,UAAW,OAAM,IAAI,MAAM,kBAAkB,IAAI,EAAE;AACjE,QAAMC,SAAQ,WAAW,wBAAwB;AAIjD,QAAM,QAAQ,KAAK,QAAQ,KAAK;AAChC,MAAI;AACF,WAAO,MAAM,SAAS,IAAI,EAAE,EAAE,MAAM,OAAAA,OAAM,CAAC;AAAA,EAC7C,SAAS,KAAK;AACZ,WAAO;AAAA,MACL,OAAO;AAAA,MACP,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,SAAS,GAAG,IAAI,6BAAwB,OAAO,GAAG,CAAC;AAAA,IACrD;AAAA,EACF;AACF;;;ACjDA,SAAS,qBAAqB;AAC9B,SAAS,SAAS,eAAe;;;ACDjC,SAAS,gBAAgB;AAOlB,SAAS,UAAU,MAAc,OAAyB,CAAC,GAAsB;AAGtF,QAAM,OAAa,EAAE,MAAM,MAAM,KAAK,QAAQ,SAAS,IAAI,EAAE;AAC7D,SAAO,YAAY,CAAC,IAAI;AAC1B;;;ACTA;AAHA,SAAS,YAAAC,iBAAgB;AACzB,SAAS,kBAAkB;AAI3B,SAAS,SAAS,KAAsB;AACtC,MAAI,CAAC,MAAM,QAAQ,GAAG,GAAG;AACvB,UAAM,IAAI,MAAM,0CAA0C;AAAA,EAC5D;AACA,SAAO,IAAI,IAAI,CAAC,OAAO,MAAM;AAC3B,QAAI,CAAC,SAAS,OAAO,UAAU,UAAU;AACvC,YAAM,IAAI,MAAM,mBAAmB,CAAC,mBAAmB;AAAA,IACzD;AACA,UAAM,IAAI;AACV,QAAI,OAAO,EAAE,SAAS,YAAY,EAAE,KAAK,WAAW,GAAG;AACrD,YAAM,IAAI,MAAM,mBAAmB,CAAC,kCAAkC;AAAA,IACxE;AACA,QAAI,CAAC,WAAW,EAAE,IAAI,GAAG;AACvB,YAAM,IAAI;AAAA,QACR,mBAAmB,CAAC,iCAAiC,EAAE,IAAI;AAAA,MAE7D;AAAA,IACF;AACA,UAAM,OAAa,EAAE,MAAM,EAAE,KAAK;AAClC,QAAI,OAAO,EAAE,SAAS,SAAU,MAAK,OAAO,EAAE;AAC9C,QAAI,OAAO,EAAE,YAAY,SAAU,MAAK,UAAU,EAAE;AAGpD,QAAI,OAAO,EAAE,YAAY,SAAU,MAAK,UAAU,EAAE;AAIpD,QAAI,OAAO,EAAE,gBAAgB,UAAU;AACrC,UAAI,UAAU,EAAE,WAAW,GAAG;AAC5B,aAAK,cAAc,EAAE;AAAA,MACvB,OAAO;AACL,gBAAQ;AAAA,UACN,qBAAqB,CAAC,+CAA+C,KAAK,UAAU,EAAE,WAAW,CAAC;AAAA,QACpG;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,EAAE,SAAS,YAAY,EAAE,SAAS,MAAM;AACjD,WAAK,OAAO,EAAE;AAAA,IAChB;AACA,WAAO;AAAA,EACT,CAAC;AACH;AAEO,SAAS,aAAa,MAAiC;AAC5D,SAAO,YAAY;AACjB,UAAM,OAAO,MAAMA,UAAS,MAAM,OAAO;AACzC,QAAI;AACJ,QAAI;AACF,YAAM,KAAK,MAAM,IAAI;AAAA,IACvB,SAAS,GAAG;AAKV,YAAM,IAAI,MAAM,kCAAkC,IAAI,KAAM,EAAY,OAAO,IAAI;AAAA,QACjF,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AACA,WAAO,SAAS,GAAG;AAAA,EACrB;AACF;;;AFnDA,eAAsB,aAAa,OAA2C;AAC5E,MAAI,MAAM,QAAQ,MAAM,OAAO;AAC7B,UAAM,OAAO,OAAO,IAAI,MAAM,iDAAiD,GAAG;AAAA,MAChF,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AAEA,MAAI,MAAM,UAAU,YAAY;AAC9B,UAAM,EAAE,UAAAC,WAAU,oBAAAC,oBAAmB,IAAI,MAAM;AAC/C,UAAM,EAAE,kBAAAC,kBAAiB,IAAI,MAAM;AACnC,UAAM,OAAOF,UAASC,oBAAmB,CAAC;AAC1C,UAAM,WAAWC,kBAAiB,MAAM,MAAM,UAAU,EAAE,SAAS,MAAM,QAAQ,IAAI,CAAC,CAAC;AACvF,WAAO,SAAS;AAAA,EAClB;AAEA,MAAI,MAAM,OAAO;AACf,UAAM,YAAY,QAAQ,MAAM,KAAK,MAAM,KAAK;AAChD,UAAM,MAAM,QAAQ,SAAS,EAAE,YAAY;AAC3C,QAAI;AACJ,QAAI,QAAQ,SAAS;AACnB,iBAAW,aAAa,SAAS;AAAA,IACnC,WAAW,QAAQ,SAAS,QAAQ,UAAU,QAAQ,QAAQ;AAC5D,YAAM,MAAO,MAAM,OAAO,cAAc,SAAS,EAAE;AAGnD,UAAI,CAAC,IAAI,WAAW,OAAO,IAAI,YAAY,YAAY;AACrD,cAAM,OAAO,OAAO,IAAI,MAAM,WAAW,MAAM,KAAK,oCAAoC,GAAG;AAAA,UACzF,UAAU;AAAA,QACZ,CAAC;AAAA,MACH;AACA,iBAAW,IAAI;AAAA,IACjB,OAAO;AACL,YAAM,OAAO;AAAA,QACX,IAAI,MAAM,WAAW,MAAM,KAAK,2BAA2B,OAAO,QAAQ,EAAE;AAAA,QAC5E,EAAE,UAAU,EAAE;AAAA,MAChB;AAAA,IACF;AACA,WAAO,SAAS;AAAA,EAClB;AAEA,SAAO,UAAU,QAAQ,MAAM,KAAK,MAAM,QAAQ,MAAM,GAAG,CAAC,EAAE;AAChE;;;AGvDA,SAAS,QAAAC,OAAM,WAAAC,UAAS,aAAa;AACrC,SAAS,cAAAC,aAAY,QAAAC,aAAY;;;ACDjC,SAAS,gBAAgB;AACzB,SAAS,iBAAiB;AAE1B,IAAM,OAAO,UAAU,QAAQ;AA0FxB,IAAM,gBAAgB;AAKtB,SAAS,YAAY,MAAuB;AACjD,MAAI,KAAK,SAAS,IAAI,EAAG,QAAO;AAChC,SAAO,cAAc,KAAK,IAAI;AAChC;AAQO,SAAS,cAAc,GAAW,GAAoB;AAC3D,QAAM,KAAK,YAAY,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,IAAI,eAAe,CAAC;AAC9D,QAAM,KAAK,YAAY,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,IAAI,eAAe,CAAC;AAC9D,MAAI,OAAO,QAAQ,OAAO,KAAM,QAAO;AACvC,SAAO,GAAG,YAAY,MAAM,GAAG,YAAY;AAC7C;AAGO,SAAS,eAAe,WAAkC;AAC/D,QAAM,UAAU,UACb,KAAK,EACL,QAAQ,UAAU,EAAE,EACpB,QAAQ,OAAO,EAAE;AAEpB,QAAM,MAAM,QAAQ,MAAM,wCAAwC;AAClE,QAAM,OAAO,MAAM,IAAI,CAAC,IAAK,QAAQ,QAAQ,uBAAuB,EAAE;AACtE,QAAM,WAAW,KAAK,MAAM,GAAG,EAAE,OAAO,OAAO;AAC/C,MAAI,SAAS,SAAS,EAAG,QAAO;AAChC,SAAO,GAAG,SAAS,SAAS,SAAS,CAAC,CAAC,IAAI,SAAS,SAAS,SAAS,CAAC,CAAC;AAC1E;;;ADrHA,SAAS,sBAAsB,SAAyB;AACtD,QAAM,QAAQ,QAAQ,MAAM,GAAG,EAAE,IAAI,KAAK;AAC1C,SAAO,MAAM,QAAQ,UAAU,EAAE;AACnC;AAGA,SAAS,eAAe,MAAoB;AAC1C,MAAI,KAAK,WAAW,GAAG;AAIrB,UAAM,IAAI,MAAM,0BAA0B;AAAA,EAC5C;AACA,MAAIC,YAAW,IAAI,GAAG;AACpB,UAAM,IAAI,MAAM,iDAAiD,IAAI,EAAE;AAAA,EACzE;AACA,MAAI,KAAK,SAAS,GAAG,KAAK,KAAK,SAAS,IAAI,GAAG;AAC7C,UAAM,IAAI,MAAM,kDAAkD,IAAI,EAAE;AAAA,EAC1E;AACA,MAAI,KAAK,MAAM,OAAO,EAAE,KAAK,CAAC,QAAQ,QAAQ,IAAI,GAAG;AACnD,UAAM,IAAI,MAAM,qDAAqD,IAAI,EAAE;AAAA,EAC7E;AACF;AAYA,SAAS,kBAAkB,SAAuB;AAChD,MACE,CAAC,8BAA8B,KAAK,OAAO,KAC3C,CAAC,oCAAoC,KAAK,OAAO,GACjD;AACA,UAAM,IAAI;AAAA,MACR,wHAC6C,KAAK,UAAU,OAAO,CAAC;AAAA,IACtE;AAAA,EACF;AACF;AAEA,eAAe,cAAc,MAAgC;AAC3D,MAAI;AACF,UAAM,IAAI,MAAMC,MAAK,IAAI;AACzB,QAAI,CAAC,EAAE,YAAY,EAAG,QAAO;AAC7B,UAAM,UAAU,MAAMC,SAAQ,IAAI;AAClC,WAAO,QAAQ,SAAS;AAAA,EAC1B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAQA,SAAS,gBAAgB,MAAgC;AACvD,SAAO,KAAK,WAAW,KAAK,WAAW;AACzC;AAcA,eAAe,sBAAsB,MAAY,MAAcC,QAA+B;AAC5F,QAAM,WAAW,gBAAgB,IAAI;AACrC,MAAI,CAAC,SAAU;AAEf,QAAM,IAAI,MAAMA,OAAM,OAAO,CAAC,MAAM,MAAM,UAAU,WAAW,QAAQ,GAAG;AAAA,IACxE,WAAW;AAAA,EACb,CAAC;AAGD,MAAI,EAAE,SAAS,EAAG;AAClB,QAAM,SAAS,EAAE,OAAO,KAAK;AAC7B,MAAI,OAAO,WAAW,EAAG;AAEzB,MAAI,CAAC,cAAc,QAAQ,QAAQ,GAAG;AACpC,UAAM,IAAI;AAAA,MACR,eAAe,IAAI,iCAAiC,KAAK,UAAU,MAAM,CAAC,qBACpD,KAAK,UAAU,QAAQ,CAAC;AAAA,IAChD;AAAA,EACF;AACF;AAKA,IAAM,cAAc;AAWpB,SAAS,gBAAgB,MAAgC;AACvD,MAAI,KAAK,QAAS,QAAO,KAAK;AAC9B,MAAI,CAAC,KAAK,QAAS,QAAO;AAC1B,MAAI,CAAC,YAAY,KAAK,KAAK,OAAO,GAAG;AACnC,UAAM,IAAI,MAAM,+CAA+C,KAAK,UAAU,KAAK,OAAO,CAAC,GAAG;AAAA,EAChG;AACA,SAAO,sBAAsB,KAAK,OAAO;AAC3C;AAEA,eAAsB,cAAc,MAAY,MAA2C;AACzF,QAAMA,SAAQ,KAAK,SAAS;AAE5B,MAAI,MAAM,cAAc,KAAK,IAAI,GAAG;AAIlC,UAAM,sBAAsB,MAAM,KAAK,MAAMA,MAAK;AAClD,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,gBAAgB,IAAI;AACpC,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI;AAAA,MACR,6BAA6B,KAAK,IAAI;AAAA,IACxC;AAAA,EACF;AAEA,QAAM,OAAO,KAAK,QAAQ,sBAAsB,OAAO;AACvD,iBAAe,IAAI;AACnB,oBAAkB,OAAO;AACzB,QAAM,SAASC,MAAK,KAAK,SAAS,IAAI;AACtC,QAAM,MAAM,KAAK,SAAS,EAAE,WAAW,KAAK,CAAC;AAE7C,MAAI,MAAM,cAAc,MAAM,GAAG;AAE/B,UAAM,sBAAsB,MAAM,QAAQD,MAAK;AAC/C,WAAO,EAAE,GAAG,MAAM,MAAM,MAAM,OAAO;AAAA,EACvC;AAGA,QAAM,SAAS,MAAMA,OAAM,OAAO,CAAC,SAAS,MAAM,SAAS,MAAM,GAAG;AAAA,IAClE,KAAK,KAAK;AAAA,IACV,WAAW,IAAI;AAAA,EACjB,CAAC;AACD,MAAI,OAAO,SAAS,GAAG;AACrB,UAAM,IAAI,MAAM,0BAA0B,OAAO,IAAI,MAAM,OAAO,MAAM,EAAE;AAAA,EAC5E;AACA,SAAO,EAAE,GAAG,MAAM,MAAM,MAAM,OAAO;AACvC;;;AElJA,eAAsB,kBACpB,OACA,MAC0B;AAC1B,QAAM,QAAQ,KAAK,SAAS;AAC5B,QAAM,gBAAgB,KAAK,kBAAkB,MAAM;AACnD,QAAM,UAAU,MAAM,QAAQ;AAAA,IAC5B,MAAM,IAAI,OAAO,SAA4E;AAC3F,UAAI,CAAC,cAAc,IAAI,EAAG,QAAO,EAAE,IAAI,MAAM,KAAK;AAClD,UAAI;AACF,eAAO,EAAE,IAAI,MAAM,MAAM,MAAM,MAAM,MAAM,EAAE,SAAS,KAAK,QAAQ,CAAC,EAAE;AAAA,MACxE,SAAS,GAAG;AACV,eAAO,EAAE,IAAI,OAAO,MAAM,KAAK,QAAQ,KAAK,MAAM,QAAS,EAAY,QAAQ;AAAA,MACjF;AAAA,IACF,CAAC;AAAA,EACH;AACA,QAAM,WAAmB,CAAC;AAC1B,QAAM,UAAyB,CAAC;AAChC,aAAW,KAAK,SAAS;AACvB,QAAI,EAAE,GAAI,UAAS,KAAK,EAAE,IAAI;AAAA,QACzB,SAAQ,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,EAAE,OAAO,CAAC;AAAA,EACtD;AACA,SAAO,EAAE,UAAU,QAAQ;AAC7B;AAMO,SAAS,oBAAoB,SAAuC;AACzE,MAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,QAAM,SAAS,QAAQ,IAAI,CAAC,MAAM,GAAG,EAAE,IAAI,KAAK,EAAE,MAAM,GAAG,EAAE,KAAK,IAAI;AACtE,SAAO,UAAK,QAAQ,MAAM,yCAAyC,MAAM;AAC3E;;;ApBlDA;;;AqBVA,SAAS,UAAAE,eAAc;AACvB,SAAS,QAAAC,aAAY;AAWd,SAAS,eAAuB;AACrC,QAAM,OAAO,QAAQ,IAAI,MAAM,KAAK;AACpC,QAAM,OAAO,OAAO,OAAOD,QAAO;AAClC,SAAOC,MAAK,MAAM,kBAAkB,OAAO;AAC7C;;;ArBkBA,SAAS,UAAU,OAAoD;AACrE,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,QAAQ,MAAM,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC;AAClD,aAAW,KAAK,OAAO;AACrB,QAAI,CAAC,gBAAgB,SAAS,CAAc,GAAG;AAC7C,YAAM,OAAO,OAAO,IAAI,MAAM,4BAA4B,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;AAAA,IACjF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,YAAY,SAAgC;AACnD,SAAO,QACJ,IAAI,CAAC,MAAM,GAAG,EAAE,MAAM,OAAO,EAAE,CAAC,IAAI,EAAE,OAAO,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI;AAAA,IAAO,EAAE,OAAO,EAAE,EAClF,KAAK,IAAI;AACd;AAEO,SAAS,cAAc,SAAwB,kBAAmC;AACvF,MAAI,QAAQ,KAAK,CAAC,MAAM,EAAE,WAAW,MAAM,EAAG,QAAO;AACrD,MAAI,kBAAkB;AACpB,UAAM,iBAAiB,QACpB,OAAO,CAAC,MAAM,EAAE,UAAU,MAAM,EAChC;AAAA,MACC,CAAC,GAAG,MACF,KAAM,EAAE,SAAsD,mBAAmB;AAAA,MACnF;AAAA,IACF;AACF,QAAI,iBAAiB,EAAG,QAAO;AAAA,EACjC;AACA,SAAO;AACT;AAEA,SAAS,eAAe,IAAoB;AAC1C,MAAI,KAAK,IAAO,QAAO,GAAG,EAAE;AAC5B,QAAM,eAAe,KAAK,MAAM,KAAK,GAAK;AAC1C,MAAI,eAAe,GAAI,QAAO,GAAG,YAAY;AAC7C,QAAM,IAAI,KAAK,MAAM,eAAe,EAAE;AACtC,QAAM,IAAI,eAAe;AACzB,SAAO,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,GAAG,GAAG,CAAC;AAC9C;AASO,SAAS,iBAAiB,OAA6C;AAC5E,MAAI,UAAU,OAAW,QAAO;AAChC,QAAM,IAAI,OAAO,KAAK;AACtB,MAAI,CAAC,OAAO,UAAU,CAAC,KAAK,IAAI,GAAG;AACjC,UAAM,OAAO,OAAO,IAAI,MAAM,kDAAkD,KAAK,GAAG,GAAG;AAAA,MACzF,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAOA,SAAS,gBACP,OACA,OACA,SACA,UACA,aACA;AACA,QAAM,aAAa,MAAM,WAAW;AAEpC,MAAI,YAAY;AACd,UAAM,OAAO,MAAM,CAAC;AACpB,WAAO,IAAI;AAAA,MACT,MAAM,IAAI,CAAC,UAAU;AAAA,QACnB,OAAO;AAAA,QACP,MAAM,OAAO,MAAM,SAAS;AAC1B,gBAAM,QAAQ,KAAK,IAAI;AACvB,gBAAM,SAAS,MAAM,YAAY,MAAM,IAAI;AAC3C,kBAAQ,KAAK,MAAM;AACnB,gBAAM,UAAU,eAAe,KAAK,IAAI,IAAI,KAAK;AACjD,eAAK,QAAQ,GAAG,IAAI,KAAK,OAAO,OAAO,KAAK,OAAO;AACnD,cAAI,OAAO,WAAW,OAAQ,OAAM,IAAI,MAAM,OAAO,OAAO;AAAA,QAC9D;AAAA,MACF,EAAE;AAAA,MACF,EAAE,YAAY,MAAM,aAAa,OAAO,SAAS;AAAA,IACnD;AAAA,EACF;AAEA,SAAO,IAAI;AAAA,IACT,MAAM,IAAI,CAAC,SAAS;AAClB,YAAM,QAAQ,KAAK,QAAQ,KAAK;AAChC,aAAO;AAAA,QACL,OAAO;AAAA,QACP,MAAM,OAAO,MAAM,SAAS;AAC1B,gBAAM,QAAQ,KAAK,IAAI;AACvB,cAAI,OAAO;AACX,eAAK,SAAS,KAAK,MAAM,MAAM;AAC/B,gBAAM,UAAU,MAAM,QAAQ;AAAA,YAC5B,MAAM,IAAI,OAAO,SAAS;AACxB,oBAAM,IAAI,MAAM,YAAY,MAAM,IAAI;AACtC,sBAAQ,KAAK,CAAC;AACd,sBAAQ;AACR,mBAAK,SAAS,GAAG,IAAI,IAAI,MAAM,MAAM;AACrC,qBAAO;AAAA,YACT,CAAC;AAAA,UACH;AACA,gBAAM,UAAU,eAAe,KAAK,IAAI,IAAI,KAAK;AACjD,gBAAM,SAAS,QAAQ,OAAO,CAAC,MAAM,EAAE,WAAW,MAAM,EAAE;AAC1D,gBAAM,SAAS,QAAQ,OAAO,CAAC,MAAM,EAAE,WAAW,MAAM,EAAE;AAC1D,gBAAM,OACJ,SAAS,IACL,GAAG,MAAM,YACT,SAAS,IACP,GAAG,MAAM,WAAW,WAAW,IAAI,KAAK,GAAG,KAC3C;AACR,eAAK,QAAQ,GAAG,KAAK,KAAK,IAAI,KAAK,OAAO;AAC1C,cAAI,SAAS,EAAG,OAAM,IAAI,MAAM,GAAG,KAAK,KAAK,MAAM,kBAAkB;AAAA,QACvE;AAAA,MACF;AAAA,IACF,CAAC;AAAA,IACD,EAAE,YAAY,aAAa,aAAa,OAAO,SAAS;AAAA,EAC1D;AACF;AAMA,SAAS,mBAAmB,SAA+B;AACzD,QAAM,QAAQ,QAAQ,OAAO,IAAI,CAAC,MAAM;AACtC,QAAI,EAAE,UAAU,cAAc;AAC5B,YAAM,IAAI,EAAE;AAMZ,aAAO,mBAAmB,EAAE,WAAW,MAAM,EAAE,aAAa,OAAO,EAAE,aAAa,QAAQ,EAAE,GAAG;AAAA,IACjG;AACA,QAAI,EAAE,UAAU,QAAQ;AACtB,aAAO,WAAY,EAAE,OAAkC,UAAU;AAAA,IACnE;AACA,QAAI,EAAE,UAAU,QAAQ;AACtB,YAAMC,KAAI,EAAE;AACZ,aAAO,WAAWA,GAAE,OAAO,aAAaA,GAAE,WAAW;AAAA,IACvD;AACA,UAAM,IAAI,EAAE;AACZ,WAAO,eAAe,EAAE,QAAQ,KAAK,EAAE,IAAI,KAAK,EAAE,QAAQ,KAAK,EAAE,GAAG;AAAA,EACtE,CAAC;AACD,SAAO,4BAAuB,QAAQ,QAAQ;AAAA,EAAO,MAAM,KAAK,IAAI,CAAC;AACvE;AAKA,SAAS,YAAY,MAAqC;AACxD,SAAO,OAAO,WAAW;AAC3B;AAMO,SAAS,kBACd,OACA,KACA,KACe;AACf,MAAI,QAAQ,OAAW,QAAO;AAC9B,QAAM,SAAS,MAAM,OAAO,CAAC,MAAM,MAAM,YAAY;AACrD,MAAI,OAAO,WAAW,EAAG,QAAO;AAChC,SAAO,wCAAwC,OAAO,KAAK,IAAI,CAAC,sCAAsC,GAAG;AAC3G;AAMO,SAAS,mBAAmB,MAAY,OAA6B;AAC1E,QAAM,kBAAkB,KAAK,gBAAgB,UAAa,MAAM,MAAM,CAAC,MAAM,MAAM,YAAY;AAC/F,SAAO,CAAC;AACV;AAOO,SAAS,iBAAiB,OAAe,KAAiC;AAC/E,MAAI,QAAQ,OAAW,QAAO;AAC9B,MAAI,MAAM,WAAW,GAAG;AACtB,UAAM,OAAO;AAAA,MACX,IAAI,MAAM,uCAAuC,MAAM,MAAM,YAAY;AAAA,MACzE,EAAE,UAAU,EAAE;AAAA,IAChB;AAAA,EACF;AAIA,MAAI,CAAC,UAAU,GAAG,GAAG;AACnB,UAAM,OAAO,OAAO,IAAI,MAAM,sCAAsC,KAAK,UAAU,GAAG,CAAC,GAAG,GAAG;AAAA,MAC3F,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AACA,SAAO,CAAC,EAAE,GAAG,MAAM,CAAC,GAAI,aAAa,IAAI,CAAC;AAC5C;AAEA,eAAsB,gBACpB,MACA,MAC2C;AAC3C,QAAM,QAAQ,UAAU,KAAK,IAAI,KAAK;AACtC,QAAM,MAAM,KAAK,MAAMC,SAAQ,KAAK,GAAG,IAAI,QAAQ,IAAI;AAKvD,MAAI,OAAO,KAAK,kBAAkB,YAAY,KAAK,UAAU,QAAW;AACtE,UAAM,OAAO;AAAA,MACX,IAAI;AAAA,QACF;AAAA,MACF;AAAA,MACA,EAAE,UAAU,EAAE;AAAA,IAChB;AAAA,EACF;AAEA,MAAI,KAAK,QAAQ,UAAa,KAAK,UAAU,QAAW;AACtD,UAAM,OAAO;AAAA,MACX,IAAI;AAAA,QACF;AAAA,MACF;AAAA,MACA,EAAE,UAAU,EAAE;AAAA,IAChB;AAAA,EACF;AAEA,MAAI,QAAQ,MAAM,aAAa;AAAA,IAC7B,GAAI,SAAS,SAAY,EAAE,KAAK,IAAI,CAAC;AAAA,IACrC,GAAI,KAAK,UAAU,SAAY,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAAA,IACxD,GAAI,KAAK,YAAY,SAAY,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,IAC9D;AAAA,EACF,CAAC;AAED,UAAQ,iBAAiB,OAAO,KAAK,GAAG;AAExC,MAAI,cAA6B,CAAC;AAClC,MAAI,KAAK,OAAO;AACd,UAAM,UAAU,KAAK,WAAW,aAAa;AAC7C,UAAM,OAAO,MAAM,kBAAkB,OAAO;AAAA,MAC1C;AAAA,MACA,eAAe,CAAC,MAAM,mBAAmB,GAAG,KAAK;AAAA,IACnD,CAAC;AACD,YAAQ,KAAK;AACb,kBAAc,KAAK;AAAA,EACrB;AAEA,QAAM,UAAyB,CAAC;AAChC,QAAM,WAAW,YAAY,KAAK,IAAI;AACtC,QAAM,gBAAgB,OAAO,OAAO,SAAS,UAAU,iBAAiB,KAAK,WAAW,CAAC,EAAE,IAAI;AAE/F,MAAI,SAAS,KAAK,OAAO,KAAK,UAAU,SAAS,MAAM,CAAC,IAAI,YAAY,OAAO;AAM/E,QAAM,aAAa,oBAAoB,WAAW;AAClD,MAAI,cAAc,CAAC,KAAK,KAAM,WAAU;AAAA;AAAA,EAAO,UAAU;AAOzD,MAAI,kBAAkB;AACtB,MAAI,KAAK,kBAAkB,QAAW;AACpC,UAAM,EAAE,UAAAC,WAAU,oBAAAC,oBAAmB,IAAI,MAAM;AAC/C,UAAM,EAAE,cAAAC,cAAa,IAAI,MAAM;AAE/B,QAAI,KAAK,UAAU,QAAW;AAC5B,YAAM,EAAE,4BAAAC,6BAA4B,yBAAAC,yBAAwB,IAC1D,MAAM;AACR,YAAM,OAAOJ,UAASC,oBAAmB,CAAC;AAC1C,YAAM,WAAW,MAAMC,cAAa,IAAI;AACxC,YAAM,aAAa,MAAMC,4BAA2B,EAAE,MAAM,UAAU,QAAQ,CAAC;AAC/E,UAAI,WAAW,OAAO,SAAS,EAAG,mBAAkB;AAIpD,UAAI,CAAC,KAAK,KAAM,WAAU;AAAA;AAAA,EAAOC,yBAAwB,UAAU,CAAC;AAAA,IACtE,OAAO;AACL,YAAM,EAAE,oBAAAC,oBAAmB,IAAI,MAAM;AACrC,YAAM,EAAE,uBAAAC,uBAAsB,IAAI,MAAM;AACxC,YAAM,OACJ,OAAO,KAAK,kBAAkB,YAAY,KAAK,cAAc,SAAS,IAClE,KAAK,gBACL,MAAMD,oBAAmB,GAAG;AAClC,UAAI,eAAoC;AACxC,YAAM,IAAI;AAAA,QACR;AAAA,UACE;AAAA,YACE,OAAO,qBAAqB,IAAI;AAAA,YAChC,MAAM,OAAO,MAAM,SAAS;AAC1B,oBAAM,OAAOL,UAASC,oBAAmB,CAAC;AAC1C,mBAAK,SAAS;AACd,oBAAM,WAAW,MAAMC,cAAa,IAAI;AACxC,mBAAK,SAAS;AACd,6BAAe,MAAMI,uBAAsB,EAAE,MAAM,UAAU,MAAM,QAAQ,CAAC;AAC5E,mBAAK,QAAQ,qBAAqB,aAAa,QAAQ,MAAM,aAAa,OAAO,MAAM,cAAc,aAAa,OAAO,WAAW,IAAI,KAAK,GAAG;AAAA,YAClJ;AAAA,UACF;AAAA,QACF;AAAA,QACA,EAAE,SAAS;AAAA,MACb,EAAE,IAAI;AACN,UAAI,gBAAgB,CAAC,KAAK,KAAM,WAAU;AAAA;AAAA,EAAO,mBAAmB,YAAY,CAAC;AAAA,IACnF;AAAA,EACF;AAEA,QAAM,SAAS,kBAAkB,OAAO,KAAK,KAAK,GAAG;AACrD,MAAI,UAAU,CAAC,KAAK,KAAM,WAAU;AAAA;AAAA,EAAO,MAAM;AAEjD,QAAM,OAAO,KAAK;AAAA,IAChB,cAAc,SAAS,KAAK,qBAAqB,IAAI;AAAA,IACrD,kBAAkB,IAAI;AAAA,EACxB;AACA,SAAO,EAAE,QAAQ,KAAK;AACxB;","names":["join","readFile","join","resolve","resolve","join","spawn","join","readFile","join","join","readFile","spawn","readFile","join","readFile","join","resolve","readFile","join","spawn","readFile","writeFile","mkdtemp","rm","join","readJsonMaybe","readFile","spawn","mkdtemp","join","writeFile","rm","spawn","readFile","openBase","readAirtableConfig","fromAirtableBase","stat","readdir","isAbsolute","join","isAbsolute","stat","readdir","spawn","join","tmpdir","join","c","resolve","openBase","readAirtableConfig","listWebsites","writeFleetAuditsToAirtable","formatFleetWriteSummary","resolveSlugFromCwd","writeAuditsToAirtable"]}
+{"version":3,"sources":["../../../src/util/url.ts","../../../src/util/credentials.ts","../../../src/reports/airtable/client.ts","../../../src/reports/airtable/websites.ts","../../../src/inventory/airtable.ts","../../../src/audits/lighthouse-airtable.ts","../../../src/audits/a11y-airtable.ts","../../../src/audits/deps-airtable.ts","../../../src/audits/security-airtable.ts","../../../src/audits/write-audits-to-airtable.ts","../../../src/cli/commands/audit.ts","../../../src/audits/util/spawn.ts","../../../src/audits/deps.ts","../../../src/util/site.ts","../../../src/configs/baseline-versions.ts","../../../src/audits/deps-outdated.ts","../../../src/audits/lint.ts","../../../src/audits/security.ts","../../../src/audits/lighthouse.ts","../../../src/configs/lighthouse.ts","../../../src/audits/util/site-config.ts","../../../src/util/free-port.ts","../../../src/audits/a11y.ts","../../../src/configs/playwright-a11y.ts","../../../src/audits/index.ts","../../../src/cli/fleet/resolve-sites.ts","../../../src/inventory/local.ts","../../../src/inventory/json.ts","../../../src/cli/fleet/clone-if-needed.ts","../../../src/util/git.ts","../../../src/cli/fleet/prepare-sites.ts","../../../src/util/fleet-workdir.ts"],"sourcesContent":["/**\n * True when `s` parses as an absolute URL whose scheme is `http:` or `https:`.\n *\n * The single allowlist gate for any value we hand to Chrome/Lighthouse. A\n * deployed-audit URL flows in from Airtable's `url` column (or a JSON\n * inventory's `deployedUrl`), so a `file://`/`gopher://`/`data:` value — or a\n * value pointing at an internal host — would otherwise become a local-file read\n * or SSRF when lhci drives a headless browser at it. Restricting to http(s)\n * keeps the audit to the real, network-reachable site.\n */\nexport function isHttpUrl(s: string): boolean {\n  let parsed: URL;\n  try {\n    parsed = new URL(s);\n  } catch {\n    return false;\n  }\n  return parsed.protocol === \"http:\" || parsed.protocol === \"https:\";\n}\n","import { readFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { join } from \"node:path\";\n\n/** Resolve the canonical credentials file path. Respects $XDG_CONFIG_HOME\n *  (Linux/macOS convention) and falls back to ~/.config/reddoor-maint/. */\nexport function defaultCredentialsPath(): string {\n  const base = process.env.XDG_CONFIG_HOME ?? join(homedir(), \".config\");\n  return join(base, \"reddoor-maint\", \"credentials.env\");\n}\n\n/** Parse a tiny subset of dotenv: `KEY=value` per line, `# comments`,\n *  blank lines. A leading `export ` token is stripped (dotenv does this),\n *  so a hand-edited `export AIRTABLE_PAT=…` parses instead of being dropped.\n *  Quoted values strip the surrounding quotes. A non-blank, non-comment line\n *  that still doesn't parse (no `=`, bad key) is skipped with a one-line\n *  stderr warning naming the line number — this is a credentials file, so a\n *  silent drop turns into a confusing \"missing credential\" downstream. */\nexport function parseEnvFile(contents: string): Record<string, string> {\n  const out: Record<string, string> = {};\n  const lines = contents.split(/\\r?\\n/);\n  for (let i = 0; i < lines.length; i++) {\n    const trimmed = lines[i]!.trim();\n    if (!trimmed || trimmed.startsWith(\"#\")) continue;\n    // Strip a leading `export ` so `export KEY=value` (a common hand-edit)\n    // parses the same as `KEY=value`.\n    const line = trimmed.replace(/^export\\s+/, \"\");\n    const eq = line.indexOf(\"=\");\n    const key = eq > 0 ? line.slice(0, eq).trim() : \"\";\n    if (eq <= 0 || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {\n      console.warn(`credentials: skipping unparseable line ${i + 1}: ${trimmed}`);\n      continue;\n    }\n    let value = line.slice(eq + 1).trim();\n    if (\n      (value.startsWith('\"') && value.endsWith('\"')) ||\n      (value.startsWith(\"'\") && value.endsWith(\"'\"))\n    ) {\n      value = value.slice(1, -1);\n    }\n    out[key] = value;\n  }\n  return out;\n}\n\n/** Load credentials from `path` (default: canonical file) into `process.env`.\n *  `process.env` values win — file-defined keys are only applied when the\n *  env var is currently undefined. Missing/unreadable file is a silent\n *  no-op; commands that need the credentials will fail downstream with\n *  their own clear error. Returns the keys actually applied (diagnostics). */\nexport function loadCredentialsIntoEnv(path: string = defaultCredentialsPath()): string[] {\n  let contents: string;\n  try {\n    contents = readFileSync(path, \"utf-8\");\n  } catch {\n    return [];\n  }\n  const parsed = parseEnvFile(contents);\n  const applied: string[] = [];\n  for (const [k, v] of Object.entries(parsed)) {\n    if (process.env[k] === undefined) {\n      process.env[k] = v;\n      applied.push(k);\n    }\n  }\n  return applied;\n}\n","import Airtable from \"airtable\";\nimport { defaultCredentialsPath } from \"../../util/credentials.js\";\n\nexport type AirtableConfig = {\n  apiKey: string;\n  baseId: string;\n};\n\nfunction missing(name: string): Error {\n  return Object.assign(\n    new Error(\n      `${name} not set. Export it in your shell or put it in ${defaultCredentialsPath()} as ${name}=...`,\n    ),\n    { exitCode: 2 },\n  );\n}\n\nexport function readAirtableConfig(): AirtableConfig {\n  const apiKey = process.env.AIRTABLE_PAT;\n  const baseId = process.env.AIRTABLE_BASE_ID;\n  if (!apiKey) throw missing(\"AIRTABLE_PAT\");\n  if (!baseId) throw missing(\"AIRTABLE_BASE_ID\");\n  return { apiKey, baseId };\n}\n\nexport type AirtableBase = ReturnType<typeof openBase>;\n\nexport function openBase(cfg: AirtableConfig) {\n  return new Airtable({ apiKey: cfg.apiKey }).base(cfg.baseId);\n}\n","import type { FieldSet } from \"airtable\";\nimport type { AirtableBase } from \"./client.js\";\nimport type { LighthouseScores } from \"../types.js\";\n\nexport const WEBSITES_TABLE = \"Websites\";\n\nexport type Frequency = \"None\" | \"Monthly\" | \"Quarterly\" | \"Yearly\";\n\nexport type Status =\n  | \"in development\"\n  | \"launch period\"\n  | \"maintenance\"\n  | \"hosting\"\n  | \"probably not our problem\"\n  | \"deprecated\";\n\nexport type WebsiteRow = {\n  id: string;\n  name: string;\n  url: string;\n  status: Status | null;\n  pointOfContact: string | null;\n  maintenanceFreq: Frequency;\n  testingFreq: Frequency;\n  /** Last manually-recorded maintenance day (used as fallback when no Reports row exists). */\n  maintenanceDay: string | null;\n  testingDay: string | null;\n  ga4PropertyId: string | null;\n  /** Operator-supplied query for the Google search-presence check (e.g. the business name).\n   *  Null = no query set → the check is skipped for this site. */\n  searchQuery: string | null;\n  /** Explicit Search Console property for this site (`sc-domain:...` or `https://.../`).\n   *  Null = auto-resolve from the SA's visible properties by host. */\n  searchConsoleProperty: string | null;\n  /** GitHub repo identity as `owner/repo`. Null = no git wiring → self-update ops skip\n   *  (or, for local runs, fall back to the checkout's origin remote). */\n  gitRepo: string | null;\n  reportRecipientsTo: string | null;\n  reportRecipientsCc: string | null;\n  /** First attachment in the Header image field (Airtable's signed URL — fetch before expiry). */\n  headerImage: { url: string; filename: string; type: string } | null;\n  /** Lighthouse \"current state\" snapshot, kept fresh by `audit lighthouse --write-airtable`. */\n  pScore: number | null;\n  rScore: number | null;\n  bpScore: number | null;\n  seoScore: number | null;\n  /** ISO timestamp set by `audit lighthouse --write-airtable` when scores were last refreshed. */\n  lastLighthouseAuditAt: string | null;\n  /** Last-known counts from non-lighthouse audits, written by\n   *  `audit --write-airtable`. `null` = never audited (or this audit\n   *  type was skipped on the last run). 0 = audited, clean. */\n  a11yViolations: number | null;\n  /** Declared-range drift vs the Reddoor baseline (what package.json asks for). */\n  depsDrifted: number | null;\n  depsMajorBehind: number | null;\n  /** Real installed-version drift: deps behind the registry's latest, from the\n   *  committed lockfile (`pnpm outdated`). Null = not determined this run. */\n  depsOutdated: number | null;\n  securityVulnsCritical: number | null;\n  securityVulnsHigh: number | null;\n  securityVulnsModerate: number | null;\n  securityVulnsLow: number | null;\n  /** Per-site copy overrides (M6a). Blank → null → the DEFAULT_COPY value. */\n  copyIntro: string | null;\n  copyContact: string | null;\n  copyFooter: string | null;\n  /** Go-live timestamp, stamped when a Launch report sends (M6b). Null = not yet launched. */\n  launchedAt: string | null;\n  /** Optional per-site webhook (e.g. Zapier Catch Hook). When set, the ingest\n   *  POSTs newsletter-formType submissions here (best-effort). Blank → null. */\n  newsletterWebhook: string | null;\n  /** GitHub-signals sweep (slice 2a), written nightly by `github-signals --fleet`. */\n  renovateFailingCis: number | null;\n  defaultBranchCi: string | null; // \"passing\" | \"failing\" | \"pending\" | \"none\"\n  lastCommitAt: string | null;\n  githubSignalsAt: string | null;\n};\n\nexport function siteSlug(name: string): string {\n  return name\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, \"-\")\n    .replace(/^-|-$/g, \"\");\n}\n\n/** Blank-trim-to-null: a non-string or whitespace-only value becomes null,\n *  otherwise the trimmed string. */\nfunction trimToNull(raw: unknown): string | null {\n  if (typeof raw !== \"string\") return null;\n  const trimmed = raw.trim();\n  return trimmed.length > 0 ? trimmed : null;\n}\n\n/**\n * Active sites: actively-maintained or pre-launch. Single source of truth for\n * \"is this a live site\" — the operator cockpit shows these, and the fleet\n * audit/report path runs against these. A `null` status (not-yet-active) is\n * deliberately excluded.\n */\nexport const ACTIVE_STATUSES: ReadonlySet<Status> = new Set<Status>([\n  \"maintenance\",\n  \"launch period\",\n]);\n\nexport function isDashboardVisible(site: WebsiteRow): boolean {\n  return site.status !== null && ACTIVE_STATUSES.has(site.status);\n}\n\n// NOTE: every `f[\"...\"]` key below is a load-bearing magic string that must match\n// the live Airtable \"Websites\" column name EXACTLY — including the legacy\n// misspelling `\"maintenence freq\"`, the mixed-case `\"GA4 property ID\"`, and the\n// lowercase `\"url\"` / `\"point of contact\"`. A column rename in Airtable silently\n// returns undefined here (→ null), which degrades quietly (GA skipped, recipients\n// empty) with no error. If you rename a column, change it here too.\nexport function mapRow(rec: { id: string; fields: Record<string, unknown> }): WebsiteRow {\n  const f = rec.fields;\n  const attachments =\n    (f[\"Header image\"] as Array<{ url: string; filename: string; type: string }> | undefined) ?? [];\n  const header = attachments[0] ?? null;\n  return {\n    id: rec.id,\n    name: String(f[\"Name\"] ?? \"\"),\n    url: String(f[\"url\"] ?? \"\"),\n    status: (f[\"Status\"] as Status | undefined) ?? null,\n    pointOfContact: (f[\"point of contact\"] as string | undefined) ?? null,\n    maintenanceFreq: ((f[\"maintenence freq\"] as string | undefined) ?? \"None\") as Frequency,\n    testingFreq: ((f[\"testing freq\"] as string | undefined) ?? \"None\") as Frequency,\n    maintenanceDay: (f[\"maintenance day\"] as string | undefined) ?? null,\n    testingDay: (f[\"testing day\"] as string | undefined) ?? null,\n    ga4PropertyId: (f[\"GA4 property ID\"] as string | undefined) ?? null,\n    searchQuery: (f[\"Search query\"] as string | undefined) ?? null,\n    searchConsoleProperty: (f[\"Search Console property\"] as string | undefined) ?? null,\n    gitRepo: (f[\"Git repo\"] as string | undefined) ?? null,\n    reportRecipientsTo: (f[\"Report recipients (To)\"] as string | undefined) ?? null,\n    reportRecipientsCc: (f[\"Report recipients (CC)\"] as string | undefined) ?? null,\n    headerImage: header,\n    pScore: (f[\"pScore\"] as number | undefined) ?? null,\n    rScore: (f[\"rScore\"] as number | undefined) ?? null,\n    bpScore: (f[\"bpScore\"] as number | undefined) ?? null,\n    seoScore: (f[\"seoScore\"] as number | undefined) ?? null,\n    lastLighthouseAuditAt: (f[\"Last lighthouse audit at\"] as string | undefined) ?? null,\n    a11yViolations: (f[\"A11y Violations\"] as number | undefined) ?? null,\n    depsDrifted: (f[\"Deps Drifted\"] as number | undefined) ?? null,\n    depsMajorBehind: (f[\"Deps Major Behind\"] as number | undefined) ?? null,\n    depsOutdated: (f[\"Deps Outdated\"] as number | undefined) ?? null,\n    securityVulnsCritical: (f[\"Security Vulns Critical\"] as number | undefined) ?? null,\n    securityVulnsHigh: (f[\"Security Vulns High\"] as number | undefined) ?? null,\n    securityVulnsModerate: (f[\"Security Vulns Moderate\"] as number | undefined) ?? null,\n    securityVulnsLow: (f[\"Security Vulns Low\"] as number | undefined) ?? null,\n    copyIntro: trimToNull(f[\"Copy — Intro\"]),\n    copyContact: trimToNull(f[\"Copy — Contact\"]),\n    copyFooter: trimToNull(f[\"Copy — Footer\"]),\n    launchedAt: (f[\"Launched at\"] as string | undefined) ?? null,\n    newsletterWebhook: trimToNull(f[\"Newsletter Webhook\"]),\n    renovateFailingCis: (f[\"Renovate Failing CIs\"] as number | undefined) ?? null,\n    defaultBranchCi: (f[\"Default Branch CI\"] as string | undefined) ?? null,\n    lastCommitAt: (f[\"Last Commit At\"] as string | undefined) ?? null,\n    githubSignalsAt: (f[\"GitHub Signals At\"] as string | undefined) ?? null,\n  };\n}\n\nexport async function listWebsites(base: AirtableBase): Promise<WebsiteRow[]> {\n  const out: WebsiteRow[] = [];\n  await base(WEBSITES_TABLE)\n    .select({ pageSize: 100 })\n    .eachPage((records, fetchNextPage) => {\n      for (const rec of records) out.push(mapRow({ id: rec.id, fields: rec.fields }));\n      fetchNextPage();\n    });\n  return out;\n}\n\nexport async function getWebsiteBySlug(\n  base: AirtableBase,\n  slug: string,\n): Promise<WebsiteRow | null> {\n  // Slugs are siteSlug() output: [a-z0-9] segments joined by single hyphens.\n  // Reject anything else — it can't match a real row, and it keeps URL-supplied\n  // input out of the filter formula below (formula-injection guard).\n  if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(slug)) return null;\n\n  // Narrow the fetch to the slug-matching row server-side instead of paging the\n  // whole table per request (MEDIUM-H). The formula replicates siteSlug() on\n  // {Name} — lowercase → non-alnum runs to \"-\" → strip leading/trailing \"-\" —\n  // verified against the live base. maxRecords caps it (slug collisions keep the\n  // prior first-match-wins behavior).\n  const formula = `REGEX_REPLACE(REGEX_REPLACE(LOWER({Name}),\"[^a-z0-9]+\",\"-\"),\"^-|-$\",\"\")=${JSON.stringify(\n    slug,\n  )}`;\n  const rows: WebsiteRow[] = [];\n  await base(WEBSITES_TABLE)\n    .select({ filterByFormula: formula, maxRecords: 1 })\n    .eachPage((records, fetchNextPage) => {\n      for (const rec of records) rows.push(mapRow({ id: rec.id, fields: rec.fields }));\n      fetchNextPage();\n    });\n  // Confirm the match in JS too: keeps the function correct if the formula and\n  // siteSlug() ever drift, and under test fakes that don't evaluate the formula.\n  return rows.find((w) => siteSlug(w.name) === slug) ?? null;\n}\n\n// ── audit-field builders ─────────────────────────────────────────────────────\n// One source of truth for the column-name → value mappings of each audit type.\n// The per-audit `updateXxxCounts` writers delegate to these (for their other\n// callers), and `updateAuditFields` merges whichever are present into ONE write —\n// so the field-name magic strings live in exactly one place.\n\nexport type A11yCounts = { violations: number };\nexport type DepsCounts = { drifted: number; majorBehind: number; outdated: number | null };\nexport type SecurityCounts = { critical: number; high: number; moderate: number; low: number };\n\nfunction scoreFields(scores: LighthouseScores): FieldSet {\n  return {\n    pScore: scores.performance,\n    rScore: scores.accessibility,\n    bpScore: scores.bestPractices,\n    seoScore: scores.seo,\n    \"Last lighthouse audit at\": new Date().toISOString(),\n  };\n}\n\nfunction a11yFields(counts: A11yCounts): FieldSet {\n  return { \"A11y Violations\": counts.violations };\n}\n\nfunction depsFields(counts: DepsCounts): FieldSet {\n  const fields: FieldSet = {\n    \"Deps Drifted\": counts.drifted,\n    \"Deps Major Behind\": counts.majorBehind,\n  };\n  // Only write the outdated count when it was determined — a null (no/stale\n  // lockfile this run) must not clobber a previously-good value.\n  if (counts.outdated !== null) {\n    fields[\"Deps Outdated\"] = counts.outdated;\n  }\n  return fields;\n}\n\nfunction securityFields(counts: SecurityCounts): FieldSet {\n  return {\n    \"Security Vulns Critical\": counts.critical,\n    \"Security Vulns High\": counts.high,\n    \"Security Vulns Moderate\": counts.moderate,\n    \"Security Vulns Low\": counts.low,\n  };\n}\n\n/**\n * Write the four Lighthouse scores + a refreshed-at timestamp onto a Websites row.\n * Called by `audit lighthouse --write-airtable` after a successful audit run, so\n * the operator never has to paste numbers manually before drafting a report.\n */\nexport async function updateScores(\n  base: AirtableBase,\n  recordId: string,\n  scores: LighthouseScores,\n): Promise<void> {\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields: scoreFields(scores) }]);\n}\n\n/** Persist a11y violation count. */\nexport async function updateA11yCounts(\n  base: AirtableBase,\n  recordId: string,\n  counts: A11yCounts,\n): Promise<void> {\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields: a11yFields(counts) }]);\n}\n\n/** Persist deps drift counts (declared-range drift + real outdated installs). */\nexport async function updateDepsCounts(\n  base: AirtableBase,\n  recordId: string,\n  counts: DepsCounts,\n): Promise<void> {\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields: depsFields(counts) }]);\n}\n\n/** Persist security vulnerability counts by severity. */\nexport async function updateSecurityCounts(\n  base: AirtableBase,\n  recordId: string,\n  counts: SecurityCounts,\n): Promise<void> {\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields: securityFields(counts) }]);\n}\n\n/**\n * Persist all of a single audit run's results to one Websites row in ONE atomic\n * `update()` — instead of up to four sequential updates on the same id (which left\n * a row half-written on a mid-sequence failure and quadrupled the request volume).\n * Pass only the audit slices that produced real values; each present slice is merged\n * via the SAME field mappings the per-audit writers use. Omit a slice (or pass\n * undefined) to leave those columns untouched. Returns the merged FieldSet so the\n * caller can enumerate what was written.\n */\nexport async function updateAuditFields(\n  base: AirtableBase,\n  recordId: string,\n  audits: {\n    scores?: LighthouseScores;\n    a11y?: A11yCounts;\n    deps?: DepsCounts;\n    security?: SecurityCounts;\n  },\n): Promise<FieldSet> {\n  const fields: FieldSet = {};\n  if (audits.scores) Object.assign(fields, scoreFields(audits.scores));\n  if (audits.a11y) Object.assign(fields, a11yFields(audits.a11y));\n  if (audits.deps) Object.assign(fields, depsFields(audits.deps));\n  if (audits.security) Object.assign(fields, securityFields(audits.security));\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);\n  return fields;\n}\n\n/** Persist the GitHub-signals sweep onto a Websites row (slice 2a). A null\n *  `lastCommitAt` is OMITTED so a not-determined-this-run value never clobbers a\n *  previously-good timestamp (mirrors updateDepsCounts' outdated handling). */\nexport async function updateGitHubSignals(\n  base: AirtableBase,\n  recordId: string,\n  signals: {\n    renovateFailingCis: number;\n    ciState: string;\n    lastCommitAt: string | null;\n    sweptAt: string;\n  },\n): Promise<void> {\n  const fields: FieldSet = {\n    \"Renovate Failing CIs\": signals.renovateFailingCis,\n    \"Default Branch CI\": signals.ciState,\n    \"GitHub Signals At\": signals.sweptAt,\n  };\n  if (signals.lastCommitAt !== null) {\n    fields[\"Last Commit At\"] = signals.lastCommitAt;\n  }\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);\n}\n\n/** Mark a site launched: flip Status → maintenance + stamp Launched at (M6b).\n *  The first code that writes Status. Called after a Launch report sends. */\nexport async function updateLaunched(\n  base: AirtableBase,\n  recordId: string,\n  at: string,\n): Promise<void> {\n  const fields: FieldSet = { Status: \"maintenance\", \"Launched at\": at };\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);\n}\n","import type { Site, InventoryProvider } from \"../types.js\";\nimport type { AirtableBase } from \"../reports/airtable/client.js\";\nimport { listWebsites, siteSlug, ACTIVE_STATUSES } from \"../reports/airtable/websites.js\";\nimport { isHttpUrl } from \"../util/url.js\";\n\nexport type AirtableInventoryOptions = {\n  /**\n   * Local workdir to compute each site's path as `{workdir}/{slug}`.\n   * Defaults to REDDOOR_FLEET_WORKDIR env var if not provided.\n   * Airtable doesn't store local checkout paths, so this is required.\n   */\n  workdir?: string;\n};\n\n/**\n * Read sites from the Airtable Websites table as an InventoryProvider.\n * Each row becomes one Site; `path` is computed as `{workdir}/{slug}`.\n * Only `maintenance` / `launch period` sites that have a `url` are included\n * (the live sites we audit + report on). The production URL is exposed as\n * `Site.deployedUrl` so the lighthouse audit can run against it with no\n * checkout. `repoUrl` is intentionally NOT set from `url` — a clone source\n * must come from `gitRepo` (`owner/repo`), never the production URL.\n */\nexport function fromAirtableBase(\n  base: AirtableBase,\n  opts: AirtableInventoryOptions = {},\n): InventoryProvider {\n  return async (): Promise<Site[]> => {\n    const workdir = opts.workdir ?? process.env.REDDOOR_FLEET_WORKDIR;\n    if (!workdir) {\n      throw new Error(\n        \"fromAirtableBase requires `workdir` option or REDDOOR_FLEET_WORKDIR env (sites need a local path)\",\n      );\n    }\n    const websites = await listWebsites(base);\n    return websites\n      .filter((w) => w.status !== null && ACTIVE_STATUSES.has(w.status) && w.url.length > 0)\n      .flatMap((w) => {\n        const slug = siteSlug(w.name);\n        // An empty slug (a Name with no slug-able characters) can't form a stable\n        // path and — fatally — can't be matched back to its Websites row on\n        // write-back: every empty-slug site would collapse under the \"\" key and\n        // mis-write or fail. Skip it loudly rather than silently mis-map it.\n        if (slug.length === 0) {\n          console.warn(\n            `[inventory] skipping \"${w.name}\" (row ${w.id}): Name has no slug-able characters (empty slug)`,\n          );\n          return [];\n        }\n        const site: Site = {\n          path: `${workdir}/${slug}`,\n          name: slug,\n          meta: { airtableRowId: w.id, displayName: w.name },\n        };\n        // Scheme-allowlist the Airtable `url` before exposing it as the\n        // deployed-audit target (it's handed straight to Chrome/lhci). A\n        // `file://`/`gopher://`/internal-host value would be a local-file read\n        // or SSRF — skip the deployed audit for that site rather than trust it.\n        if (isHttpUrl(w.url)) {\n          site.deployedUrl = w.url;\n        } else {\n          console.warn(\n            `[inventory] skipping deployed audit for \"${w.name}\": url is not http(s): ${JSON.stringify(w.url)}`,\n          );\n        }\n        if (w.gitRepo) site.gitRepo = w.gitRepo;\n        return [site];\n      });\n  };\n}\n","import { readFile } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport type { AuditResult } from \"../types.js\";\nimport type { LighthouseScores } from \"../reports/types.js\";\nimport { siteSlug } from \"../reports/airtable/websites.js\";\n\nconst LIGHTHOUSE_CATEGORIES = [\"performance\", \"accessibility\", \"best-practices\", \"seo\"] as const;\n\n/**\n * True when the result carries real lighthouse scores worth persisting.\n *\n * The `audit --write-airtable` policy used to refuse on any `status: \"fail\"`,\n * but that conflates two very different failure modes:\n *   1. Infrastructure failure (no lhr-*.json written, spawn timeout, etc.)\n *      → `details.summary` empty → all-zeros would corrupt the dashboard\n *   2. Assertion failure (scores below threshold, e.g. best-practices < 0.9)\n *      → `details.summary` has real numbers → tracking these IS the point\n *\n * The dashboard exists to surface drift over time. Refusing to write the\n * very numbers the dashboard wants to plot — just because one assertion\n * tripped — defeats the purpose. Write whenever real scores exist.\n */\nexport function hasRealScores(result: AuditResult): boolean {\n  if (result.audit !== \"lighthouse\") return false;\n  const details = (result.details ?? {}) as { summary?: Record<string, number> };\n  const summary = details.summary ?? {};\n  return LIGHTHOUSE_CATEGORIES.some(\n    (k) => typeof summary[k] === \"number\" && !Number.isNaN(summary[k]),\n  );\n}\n\n/**\n * Extract the four Lighthouse scores (as integer percentages) from a\n * `lighthouse` AuditResult. LHCI manifest summaries are floats in [0,1];\n * multiply + round.\n */\nexport function lighthouseScoresFromResult(result: AuditResult): LighthouseScores {\n  if (result.audit !== \"lighthouse\") {\n    throw new Error(`Expected a 'lighthouse' AuditResult, got '${result.audit}'`);\n  }\n  const details = (result.details ?? {}) as { summary?: Record<string, number> };\n  const summary = details.summary ?? {};\n  const toPct = (n: number | undefined) =>\n    typeof n === \"number\" && !Number.isNaN(n) ? Math.round(n * 100) : 0;\n  return {\n    performance: toPct(summary[\"performance\"]),\n    accessibility: toPct(summary[\"accessibility\"]),\n    bestPractices: toPct(summary[\"best-practices\"]),\n    seo: toPct(summary[\"seo\"]),\n  };\n}\n\n/**\n * Derive a site slug from the cwd's package.json#name. Used by\n * `audit lighthouse --write-airtable` when the operator doesn't pass an\n * explicit slug — the cwd is the site checkout, so package.json#name is\n * usually the canonical site name.\n */\nexport async function resolveSlugFromCwd(cwd: string): Promise<string> {\n  try {\n    const pkgPath = join(cwd, \"package.json\");\n    const raw = await readFile(pkgPath, \"utf-8\");\n    const pkg = JSON.parse(raw) as { name?: string };\n    if (!pkg.name) throw new Error(\"package.json has no 'name' field\");\n    return siteSlug(pkg.name);\n  } catch (e) {\n    throw new Error(\n      `Could not derive site slug from ${cwd}/package.json: ${(e as Error).message}. ` +\n        `Pass --write-airtable=<slug> explicitly.`,\n      { cause: e },\n    );\n  }\n}\n","import type { AuditResult } from \"../types.js\";\n\ntype A11yDetails = {\n  totalViolations: number;\n  byImpact: Partial<Record<\"minor\" | \"moderate\" | \"serious\" | \"critical\", number>>;\n};\n\n/** True when an a11y AuditResult carries real counts worth persisting.\n *  Mirrors the `hasRealScores` policy on lighthouse: write whenever real\n *  data exists, regardless of status (a \"warn\" or \"fail\" with concrete\n *  violation counts is exactly what the dashboard needs to track). */\nexport function hasA11yCounts(result: AuditResult): boolean {\n  if (result.audit !== \"a11y\") return false;\n  const details = result.details as A11yDetails | undefined;\n  return typeof details?.totalViolations === \"number\";\n}\n\nexport function a11yCountsFromResult(result: AuditResult): { violations: number } {\n  if (result.audit !== \"a11y\") {\n    throw new Error(`Expected an 'a11y' AuditResult, got '${result.audit}'`);\n  }\n  const details = result.details as A11yDetails | undefined;\n  return { violations: details?.totalViolations ?? 0 };\n}\n","import type { AuditResult } from \"../types.js\";\nimport type { DepsDetails, DepsDriftEntry } from \"./deps.js\";\n\n/** True when a deps AuditResult carries the structured details (an entries\n *  array, per {@link DepsDetails}). */\nexport function hasDepsCounts(result: AuditResult): boolean {\n  if (result.audit !== \"deps\") return false;\n  const d = result.details as Partial<DepsDetails> | undefined;\n  return Array.isArray(d?.entries);\n}\n\nexport function depsCountsFromResult(result: AuditResult): {\n  drifted: number;\n  majorBehind: number;\n  outdated: number | null;\n} {\n  if (result.audit !== \"deps\") {\n    throw new Error(`Expected a 'deps' AuditResult, got '${result.audit}'`);\n  }\n  const details = (result.details ?? {}) as Partial<DepsDetails>;\n  const entries = (details.entries ?? []) as DepsDriftEntry[];\n  // \"drifted\" = drift !== \"same\", which intentionally includes \"newer\" (ahead of\n  // baseline) — parity with the deps audit summary text.\n  const drifted = entries.filter((e) => e.drift !== \"same\").length;\n  const majorBehind = entries.filter((e) => e.drift === \"major\").length;\n  // The real installed-version drift, distinct from declared-range drift. Null\n  // when the audit couldn't determine it (no/stale lockfile) — kept null (not 0)\n  // so the dashboard shows \"—\" rather than a misleading \"clean\".\n  const outdated = details.outdated?.outdated ?? null;\n  return { drifted, majorBehind, outdated };\n}\n","import type { AuditResult } from \"../types.js\";\n\ntype SecurityDetails = {\n  counts: { low: number; moderate: number; high: number; critical: number };\n};\n\n/** True when a security AuditResult carries a counts object. Skipped runs\n *  (no pnpm + no npm) have no details and return false. */\nexport function hasSecurityCounts(result: AuditResult): boolean {\n  if (result.audit !== \"security\") return false;\n  const details = result.details as SecurityDetails | undefined;\n  return !!details && typeof details.counts === \"object\";\n}\n\nexport function securityCountsFromResult(result: AuditResult): {\n  critical: number;\n  high: number;\n  moderate: number;\n  low: number;\n} {\n  if (result.audit !== \"security\") {\n    throw new Error(`Expected a 'security' AuditResult, got '${result.audit}'`);\n  }\n  const details = result.details as SecurityDetails | undefined;\n  const c = details?.counts ?? { low: 0, moderate: 0, high: 0, critical: 0 };\n  return { critical: c.critical, high: c.high, moderate: c.moderate, low: c.low };\n}\n","import type { AuditResult } from \"../types.js\";\nimport type { AirtableBase } from \"../reports/airtable/client.js\";\nimport { type WebsiteRow, siteSlug, updateAuditFields } from \"../reports/airtable/websites.js\";\nimport type { A11yCounts, DepsCounts, SecurityCounts } from \"../reports/airtable/websites.js\";\nimport type { LighthouseScores } from \"../reports/types.js\";\nimport { hasRealScores, lighthouseScoresFromResult } from \"./lighthouse-airtable.js\";\nimport { hasA11yCounts, a11yCountsFromResult } from \"./a11y-airtable.js\";\nimport { hasDepsCounts, depsCountsFromResult } from \"./deps-airtable.js\";\nimport { hasSecurityCounts, securityCountsFromResult } from \"./security-airtable.js\";\n\ntype WriteSummary = {\n  siteName: string;\n  writes: Array<{\n    audit: \"lighthouse\" | \"a11y\" | \"deps\" | \"security\" | \"github-signals\";\n    counts: object;\n  }>;\n};\n\n/** Orchestrates the per-audit Airtable writes for `audit --write-airtable`.\n *  Extracted from the CLI command so it can be unit-tested with a fake base\n *  and so adding new audit types is a one-line addition here rather than\n *  growing the CLI handler.\n *\n *  Throws (with .exitCode set) on the failure modes the CLI surfaces today:\n *   - 2: --only ran without lighthouse, or no Websites row matched the slug\n *   - 1: lighthouse ran but produced no real scores (infrastructure failure).\n *        The a11y/deps/security writes still complete FIRST — a Lighthouse\n *        miss flags the site without discarding its other audit data.\n *\n *  Precedence note: the Websites-row lookup (exitCode 2) is checked BEFORE the\n *  no-scores gate (exitCode 1), so the rare no-row + no-scores combo surfaces\n *  as exitCode 2. */\nexport async function writeAuditsToAirtable(args: {\n  base: AirtableBase;\n  websites: WebsiteRow[];\n  slug: string;\n  results: AuditResult[];\n}): Promise<WriteSummary> {\n  const { base, websites, slug, results } = args;\n\n  const lhResult = results.find((r) => r.audit === \"lighthouse\");\n  if (!lhResult) {\n    throw Object.assign(\n      new Error(\n        \"--write-airtable requires a lighthouse result; did you pass --only without lighthouse?\",\n      ),\n      { exitCode: 2 },\n    );\n  }\n  const target = websites.find((w) => siteSlug(w.name) === slug);\n  if (!target) {\n    throw Object.assign(new Error(`No Websites row matched slug \"${slug}\"`), { exitCode: 2 });\n  }\n\n  const writes: WriteSummary[\"writes\"] = [];\n  const audits: {\n    scores?: LighthouseScores;\n    a11y?: A11yCounts;\n    deps?: DepsCounts;\n    security?: SecurityCounts;\n  } = {};\n\n  // Collect every audit that produced real values into ONE merged input, then do a\n  // SINGLE atomic Airtable update (was: up to four sequential updates on the same\n  // row — a mid-sequence failure left it half-written yet reported fully failed, at\n  // 4× the request volume). Lighthouse is the most timeout-prone audit: a Lighthouse\n  // miss must NOT discard the site's valid a11y/deps/security results (morning-brief\n  // 2026-06-10 MEDIUM-E). So include Lighthouse scores only when real, include the\n  // other audits whenever present, write all of them in one update, then — if\n  // Lighthouse missed — throw AFTER that atomic write so the site is still flagged\n  // (exitCode 1 / collected in FleetWriteResult.failed) without losing its other data.\n  const lhHasScores = hasRealScores(lhResult);\n  if (lhHasScores) {\n    const scores = lighthouseScoresFromResult(lhResult);\n    audits.scores = scores;\n    writes.push({ audit: \"lighthouse\", counts: scores });\n  }\n\n  const a11y = results.find((r) => r.audit === \"a11y\");\n  if (a11y && hasA11yCounts(a11y)) {\n    const counts = a11yCountsFromResult(a11y);\n    audits.a11y = counts;\n    writes.push({ audit: \"a11y\", counts });\n  }\n\n  const deps = results.find((r) => r.audit === \"deps\");\n  if (deps && hasDepsCounts(deps)) {\n    const counts = depsCountsFromResult(deps);\n    audits.deps = counts;\n    writes.push({ audit: \"deps\", counts });\n  }\n\n  const sec = results.find((r) => r.audit === \"security\");\n  if (sec && hasSecurityCounts(sec)) {\n    const counts = securityCountsFromResult(sec);\n    audits.security = counts;\n    writes.push({ audit: \"security\", counts });\n  }\n\n  // One atomic write of everything that ran. Skip the call only if there is nothing\n  // to write at all (no real scores AND no other audit produced values) — an empty\n  // update is a wasted request.\n  if (Object.keys(audits).length > 0) {\n    await updateAuditFields(base, target.id, audits);\n  }\n\n  if (!lhHasScores) {\n    // Enumerate what WAS persisted so the failure (surfaced to the single-site\n    // CLI operator via console.error) reads as a partial write, not a total one.\n    const persisted = writes.map((w) => w.audit);\n    throw Object.assign(\n      new Error(\n        `Lighthouse audit produced no scores; ${\n          persisted.length ? `wrote ${persisted.join(\"/\")} but refused Lighthouse` : \"wrote nothing\"\n        }. Summary: ${lhResult.summary}`,\n      ),\n      { exitCode: 1 },\n    );\n  }\n\n  return { siteName: target.name, writes };\n}\n\nexport type FleetWriteResult = {\n  written: WriteSummary[];\n  failed: Array<{ slug: string; error: string }>;\n};\n\n/** Render the fleet write-back outcome for the CLI/CI. Beyond the human-readable\n *  lines, it emits a single deterministic, machine-parseable line —\n *  `FLEET_WRITE_SUMMARY wrote=N failed=M total=T` — that the nightly workflow\n *  greps to decide pass/fail. Keying CI on this line (not the prose, and not a\n *  \"wrote ≥ 1\" heuristic) lets the gate tolerate a single known flake while\n *  still reding on a total or mass write-back failure. */\nexport function formatFleetWriteSummary(result: FleetWriteResult): string {\n  const wrote = result.written.length;\n  const failed = result.failed.length;\n  const total = wrote + failed;\n  let out = `→ wrote ${wrote} site(s) to Airtable`;\n  if (failed > 0) {\n    out += `\\n⚠ ${failed} site(s) not written: ${result.failed\n      .map((f) => `${f.slug} (${f.error})`)\n      .join(\"; \")}`;\n  }\n  out += `\\nFLEET_WRITE_SUMMARY wrote=${wrote} failed=${failed} total=${total}`;\n  return out;\n}\n\n/** Write each site's pooled audit results back to its own Websites row,\n *  best-effort. Results are grouped by `result.site` (the slug the fleet\n *  inventory stamped as Site.name). A per-site failure (no scores, no matching\n *  row) is collected — not thrown — so one bad site never aborts the batch. */\nexport async function writeFleetAuditsToAirtable(args: {\n  base: AirtableBase;\n  websites: WebsiteRow[];\n  results: AuditResult[];\n}): Promise<FleetWriteResult> {\n  const { base, websites, results } = args;\n\n  const bySlug = new Map<string, AuditResult[]>();\n  for (const r of results) {\n    const arr = bySlug.get(r.site) ?? [];\n    arr.push(r);\n    bySlug.set(r.site, arr);\n  }\n\n  const written: WriteSummary[] = [];\n  const failed: FleetWriteResult[\"failed\"] = [];\n  // Serial on purpose: even at one (now atomic) update call per site, Airtable's\n  // ~5 req/sec limit means a Promise.all fan-out across the fleet would burst and\n  // trip 429s (silently filed as failures). Below a few dozen sites, serial trades\n  // wall-clock for safety. (morning-brief 2026-06-09 MEDIUM-3.) Add a bounded pool\n  // when the fleet grows.\n  for (const [slug, siteResults] of bySlug) {\n    try {\n      written.push(await writeAuditsToAirtable({ base, websites, slug, results: siteResults }));\n    } catch (e) {\n      failed.push({ slug, error: (e as Error).message });\n    }\n  }\n  return { written, failed };\n}\n","import { resolve } from \"node:path\";\nimport { Listr } from \"listr2\";\nimport { runOneAudit, ALL_AUDIT_NAMES } from \"../../audits/index.js\";\nimport type { AuditName, AuditResult, Site } from \"../../types.js\";\nimport { resolveSites } from \"../fleet/resolve-sites.js\";\nimport {\n  prepareFleetSites,\n  formatSkippedNotice,\n  type SkippedSite,\n} from \"../fleet/prepare-sites.js\";\nimport { isHttpUrl } from \"../../util/url.js\";\nimport { fleetWorkdir } from \"../../util/fleet-workdir.js\";\n\nexport type AuditCommandOptions = {\n  only?: string;\n  json?: boolean;\n  fleet?: string;\n  workdir?: string;\n  cwd?: string;\n  /**\n   * After running, push the lighthouse scores to the matching Websites row\n   * in Airtable. `true` (no value) = derive slug from cwd/package.json#name;\n   * string = explicit slug (e.g. \"med-solutions-of-texas\").\n   */\n  writeAirtable?: string | boolean;\n  /** Exit non-zero if any a11y violations are found (overrides warn). For CI gates. */\n  failOnViolations?: boolean;\n  /** Audit this deployed URL directly (lighthouse only; single-site). */\n  url?: string;\n  /** Max sites to audit in parallel (fleet mode). Unset = all at once;\n   *  `1` = sequential (used by the nightly CI workflow). */\n  concurrency?: string;\n};\n\nfunction parseOnly(value: string | undefined): AuditName[] | undefined {\n  if (!value) return undefined;\n  const names = value.split(\",\").map((s) => s.trim());\n  for (const n of names) {\n    if (!ALL_AUDIT_NAMES.includes(n as AuditName)) {\n      throw Object.assign(new Error(`unknown audit in --only: ${n}`), { exitCode: 2 });\n    }\n  }\n  return names as AuditName[];\n}\n\nfunction formatTable(results: AuditResult[]): string {\n  return results\n    .map((r) => `${r.audit.padEnd(12)} ${r.status.padEnd(5)} ${r.site}\\n  ${r.summary}`)\n    .join(\"\\n\");\n}\n\nexport function auditExitCode(results: AuditResult[], failOnViolations: boolean): number {\n  if (results.some((r) => r.status === \"fail\")) return 1;\n  if (failOnViolations) {\n    const a11yViolations = results\n      .filter((r) => r.audit === \"a11y\")\n      .reduce(\n        (n, r) =>\n          n + ((r.details as { totalViolations?: number } | undefined)?.totalViolations ?? 0),\n        0,\n      );\n    if (a11yViolations > 0) return 1;\n  }\n  return 0;\n}\n\nfunction formatDuration(ms: number): string {\n  if (ms < 1_000) return `${ms}ms`;\n  const totalSeconds = Math.round(ms / 1_000);\n  if (totalSeconds < 60) return `${totalSeconds}s`;\n  const m = Math.floor(totalSeconds / 60);\n  const s = totalSeconds % 60;\n  return `${m}m${s.toString().padStart(2, \"0\")}s`;\n}\n\ntype Renderer = \"default\" | \"silent\";\n\n/** Parse the `--concurrency <n>` flag into a Listr `concurrent` value. Unset →\n *  `true` (all sites in parallel, the interactive default). A positive integer\n *  bounds how many sites audit at once — `--concurrency 1` runs sequentially,\n *  which is what the nightly CI workflow uses so ~10 deployed-Lighthouse runs\n *  don't saturate a 2-core runner (one flaked locally at full parallelism). */\nexport function parseConcurrency(value: string | undefined): boolean | number {\n  if (value === undefined) return true;\n  const n = Number(value);\n  if (!Number.isInteger(n) || n < 1) {\n    throw Object.assign(new Error(`--concurrency must be a positive integer, got \"${value}\"`), {\n      exitCode: 2,\n    });\n  }\n  return n;\n}\n\n/** Build the audit-progress task list. Single-site → each audit is a sibling\n *  task. Fleet → each site is a task whose `output` shows X/N audits done as\n *  they complete (audits-per-site still run in parallel). Results are pushed\n *  into the shared `results` array; tasks throw on `fail` status so listr2\n *  paints them red, but `exitOnError: false` keeps other tasks running. */\nfunction buildAuditTasks(\n  sites: Site[],\n  which: AuditName[],\n  results: AuditResult[],\n  renderer: Renderer,\n  concurrency: boolean | number,\n) {\n  const singleSite = sites.length === 1;\n\n  if (singleSite) {\n    const site = sites[0]!;\n    return new Listr(\n      which.map((name) => ({\n        title: name,\n        task: async (_ctx, task) => {\n          const start = Date.now();\n          const result = await runOneAudit(site, name);\n          results.push(result);\n          const elapsed = formatDuration(Date.now() - start);\n          task.title = `${name}: ${result.summary} (${elapsed})`;\n          if (result.status === \"fail\") throw new Error(result.summary);\n        },\n      })),\n      { concurrent: true, exitOnError: false, renderer },\n    );\n  }\n\n  return new Listr(\n    sites.map((site) => {\n      const label = site.name || site.path; // `||`: empty slug must fall back to path, not blank\n      return {\n        title: label,\n        task: async (_ctx, task) => {\n          const start = Date.now();\n          let done = 0;\n          task.output = `0/${which.length} audits`;\n          const settled = await Promise.all(\n            which.map(async (name) => {\n              const r = await runOneAudit(site, name);\n              results.push(r);\n              done += 1;\n              task.output = `${done}/${which.length} audits`;\n              return r;\n            }),\n          );\n          const elapsed = formatDuration(Date.now() - start);\n          const failed = settled.filter((r) => r.status === \"fail\").length;\n          const warned = settled.filter((r) => r.status === \"warn\").length;\n          const note =\n            failed > 0\n              ? `${failed} failed`\n              : warned > 0\n                ? `${warned} warning${warned === 1 ? \"\" : \"s\"}`\n                : \"all green\";\n          task.title = `${label}: ${note} (${elapsed})`;\n          if (failed > 0) throw new Error(`${label}: ${failed} audit(s) failed`);\n        },\n      };\n    }),\n    { concurrent: concurrency, exitOnError: false, renderer },\n  );\n}\n\ntype WriteSummary = Awaited<\n  ReturnType<typeof import(\"../../audits/write-audits-to-airtable.js\").writeAuditsToAirtable>\n>;\n\nfunction formatWriteSummary(summary: WriteSummary): string {\n  const lines = summary.writes.map((w) => {\n    if (w.audit === \"lighthouse\") {\n      const s = w.counts as {\n        performance: number;\n        accessibility: number;\n        bestPractices: number;\n        seo: number;\n      };\n      return `  lighthouse: P=${s.performance} A=${s.accessibility} BP=${s.bestPractices} SEO=${s.seo}`;\n    }\n    if (w.audit === \"a11y\") {\n      return `  a11y: ${(w.counts as { violations: number }).violations} violations`;\n    }\n    if (w.audit === \"deps\") {\n      const c = w.counts as { drifted: number; majorBehind: number };\n      return `  deps: ${c.drifted} drifted (${c.majorBehind} major)`;\n    }\n    const c = w.counts as { critical: number; high: number; moderate: number; low: number };\n    return `  security: ${c.critical}C/${c.high}H/${c.moderate}M/${c.low}L`;\n  });\n  return `→ wrote to Websites[${summary.siteName}]:\\n${lines.join(\"\\n\")}`;\n}\n\n/** Listr renderer choice. `--json` → silent so stdout stays clean for piping.\n *  Otherwise listr's `default` renderer auto-falls back to `simple` in\n *  non-TTY contexts (CI, log capture, our own integration tests). */\nfunction rendererFor(json: boolean | undefined): Renderer {\n  return json ? \"silent\" : \"default\";\n}\n\n/** When `--url` is set but audits other than lighthouse also ran (those use the\n *  local checkout, not the deployed URL), return a one-line operator notice;\n *  null when there's nothing to warn about. Keeps the mixed-provenance result\n *  table from silently confusing the operator. */\nexport function deployedUrlNotice(\n  which: AuditName[],\n  url: string | undefined,\n  cwd: string,\n): string | null {\n  if (url === undefined) return null;\n  const others = which.filter((n) => n !== \"lighthouse\");\n  if (others.length === 0) return null;\n  return `note: --url only affects lighthouse; ${others.join(\", \")} ran against the local checkout at ${cwd}`;\n}\n\n/** A fleet site needs a local checkout unless every requested audit can run\n *  against its deployed URL. Today only lighthouse has a deployed mode, so a\n *  site is checkout-free exactly when it has a `deployedUrl` and lighthouse is\n *  the only requested audit. */\nexport function auditNeedsCheckout(site: Site, which: AuditName[]): boolean {\n  const deployedCapable = site.deployedUrl !== undefined && which.every((n) => n === \"lighthouse\");\n  return !deployedCapable;\n}\n\n/** Apply a single-site `--url` to the resolved sites. Returns the input\n *  untouched when no url is given; otherwise requires exactly one site and\n *  stamps `deployedUrl` on it so the lighthouse audit takes its deployed path.\n *  The `--url`+`--fleet` combination is rejected earlier in `runAuditCommand`;\n *  this length guard also covers any future multi-site single-run resolver. */\nexport function applyDeployedUrl(sites: Site[], url: string | undefined): Site[] {\n  if (url === undefined) return sites;\n  if (sites.length !== 1) {\n    throw Object.assign(\n      new Error(`--url expects exactly one site, but ${sites.length} resolved.`),\n      { exitCode: 2 },\n    );\n  }\n  // Scheme-allowlist: the URL is handed straight to Chrome/lhci, so only\n  // http(s) is safe (a file:///gopher:// value would be a local-file read /\n  // SSRF). Same predicate the inventory paths use.\n  if (!isHttpUrl(url)) {\n    throw Object.assign(new Error(`--url must be an http(s) URL (got: ${JSON.stringify(url)})`), {\n      exitCode: 2,\n    });\n  }\n  return [{ ...sites[0]!, deployedUrl: url }];\n}\n\nexport async function runAuditCommand(\n  site: string | undefined,\n  opts: AuditCommandOptions,\n): Promise<{ output: string; code: number }> {\n  const which = parseOnly(opts.only) ?? ALL_AUDIT_NAMES;\n  const cwd = opts.cwd ? resolve(opts.cwd) : process.cwd();\n\n  // A literal --write-airtable=<slug> is single-site (the slug names one row).\n  // Boolean --write-airtable + --fleet is fine: each site's slug comes from the\n  // inventory, so there's no cwd-derived-slug ambiguity.\n  if (typeof opts.writeAirtable === \"string\" && opts.fleet !== undefined) {\n    throw Object.assign(\n      new Error(\n        \"--write-airtable=<slug> is single-site; with --fleet each site's slug comes from the inventory. Use --write-airtable (no slug) + --fleet.\",\n      ),\n      { exitCode: 2 },\n    );\n  }\n\n  if (opts.url !== undefined && opts.fleet !== undefined) {\n    throw Object.assign(\n      new Error(\n        \"--url is single-site only and cannot be combined with --fleet. Audit a single site instead.\",\n      ),\n      { exitCode: 2 },\n    );\n  }\n\n  let sites = await resolveSites({\n    ...(site !== undefined ? { site } : {}),\n    ...(opts.fleet !== undefined ? { fleet: opts.fleet } : {}),\n    ...(opts.workdir !== undefined ? { workdir: opts.workdir } : {}),\n    cwd,\n  });\n\n  sites = applyDeployedUrl(sites, opts.url);\n\n  let skippedPrep: SkippedSite[] = [];\n  if (opts.fleet) {\n    const workdir = opts.workdir ?? fleetWorkdir();\n    const prep = await prepareFleetSites(sites, {\n      workdir,\n      needsCheckout: (s) => auditNeedsCheckout(s, which),\n    });\n    sites = prep.prepared;\n    skippedPrep = prep.skipped;\n  }\n\n  const results: AuditResult[] = [];\n  const renderer = rendererFor(opts.json);\n  await buildAuditTasks(sites, which, results, renderer, parseConcurrency(opts.concurrency)).run();\n\n  let output = opts.json ? JSON.stringify(results, null, 2) : formatTable(results);\n\n  // Surface any site that couldn't be prepared (no auditable target, clone\n  // failure) — visibly, but without reding the run. One misconfigured inventory\n  // row is an operator fix, not an outage; the other sites still audited and\n  // wrote back. \"No silent caps\": a dropped site is never invisible.\n  const skipNotice = formatSkippedNotice(skippedPrep);\n  if (skipNotice && !opts.json) output += `\\n\\n${skipNotice}`;\n\n  // Did any site fail to write back to Airtable? The fleet writer collects\n  // per-site failures instead of throwing, so without this the command would\n  // exit 0 while rows silently failed to persist — automation keying on `$?`\n  // would see a clean run. (The single-site writer throws on failure, so it's\n  // already non-zero via the propagated error.)\n  let writeBackFailed = false;\n  if (opts.writeAirtable !== undefined) {\n    const { openBase, readAirtableConfig } = await import(\"../../reports/airtable/client.js\");\n    const { listWebsites } = await import(\"../../reports/airtable/websites.js\");\n\n    if (opts.fleet !== undefined) {\n      const { writeFleetAuditsToAirtable, formatFleetWriteSummary } =\n        await import(\"../../audits/write-audits-to-airtable.js\");\n      const base = openBase(readAirtableConfig());\n      const websites = await listWebsites(base);\n      const fleetWrite = await writeFleetAuditsToAirtable({ base, websites, results });\n      if (fleetWrite.failed.length > 0) writeBackFailed = true;\n      // Gate on !json: the write-summary is human text; appending it after the\n      // results array would corrupt `--json` output (the other notices already\n      // guard this way). The write itself still happens regardless of --json.\n      if (!opts.json) output += `\\n\\n${formatFleetWriteSummary(fleetWrite)}`;\n    } else {\n      const { resolveSlugFromCwd } = await import(\"../../audits/lighthouse-airtable.js\");\n      const { writeAuditsToAirtable } = await import(\"../../audits/write-audits-to-airtable.js\");\n      const slug =\n        typeof opts.writeAirtable === \"string\" && opts.writeAirtable.length > 0\n          ? opts.writeAirtable\n          : await resolveSlugFromCwd(cwd);\n      let writeSummary: WriteSummary | null = null;\n      await new Listr(\n        [\n          {\n            title: `Write to Airtable[${slug}]`,\n            task: async (_ctx, task) => {\n              const base = openBase(readAirtableConfig());\n              task.output = \"loading Websites…\";\n              const websites = await listWebsites(base);\n              task.output = \"writing scores…\";\n              writeSummary = await writeAuditsToAirtable({ base, websites, slug, results });\n              task.title = `Wrote to Websites[${writeSummary.siteName}] (${writeSummary.writes.length} audit type${writeSummary.writes.length === 1 ? \"\" : \"s\"})`;\n            },\n          },\n        ],\n        { renderer },\n      ).run();\n      if (writeSummary && !opts.json) output += `\\n\\n${formatWriteSummary(writeSummary)}`;\n    }\n  }\n\n  const notice = deployedUrlNotice(which, opts.url, cwd);\n  if (notice && !opts.json) output += `\\n\\n${notice}`;\n\n  const code = Math.max(\n    auditExitCode(results, opts.failOnViolations === true),\n    writeBackFailed ? 1 : 0,\n  );\n  return { output, code };\n}\n","import { spawn } from \"node:child_process\";\nimport { StringDecoder } from \"node:string_decoder\";\n\nexport type SpawnResult = { code: number; stdout: string; stderr: string };\n\nexport type SpawnOptions = {\n  cwd?: string;\n  env?: NodeJS.ProcessEnv;\n  timeoutMs?: number;\n  /** When true, the child inherits stdout/stderr so the user sees live\n   * progress (useful for long-running `pnpm up` / `npm install`). The\n   * returned `stdout` and `stderr` will be empty strings in that case. */\n  streaming?: boolean;\n};\n\nexport type SpawnFn = (\n  cmd: string,\n  args: readonly string[],\n  opts?: SpawnOptions,\n) => Promise<SpawnResult>;\n\ntype KillFn = (pid: number, signal: NodeJS.Signals | number) => void;\n\n/** Construction-time knobs, separated from per-call {@link SpawnOptions} mainly\n *  so tests can inject deterministic `spawnImpl`/`killImpl` and a tiny grace. */\nexport type SpawnInternals = {\n  spawnImpl?: typeof spawn;\n  killImpl?: KillFn;\n  /** Delay after SIGTERM before escalating to SIGKILL on a timeout (default 5s). */\n  killGraceMs?: number;\n  /** Cap on captured stdout/stderr length so a runaway child can't OOM the CLI. */\n  maxOutputBytes?: number;\n};\n\nconst TRUNCATION_MARKER = \"\\n…[output truncated]\";\n\nexport function makeSpawn(internals: SpawnInternals = {}): SpawnFn {\n  const spawnImpl = internals.spawnImpl ?? spawn;\n  const killImpl: KillFn = internals.killImpl ?? ((pid, sig) => process.kill(pid, sig));\n  const killGraceMs = internals.killGraceMs ?? 5000;\n  const maxOutputBytes = internals.maxOutputBytes ?? 10 * 1024 * 1024;\n\n  return (cmd, args, opts = {}) =>\n    new Promise((resolve, reject) => {\n      const streaming = opts.streaming === true;\n      const child = spawnImpl(cmd, [...args], {\n        cwd: opts.cwd,\n        env: opts.env ?? process.env,\n        stdio: streaming ? [\"ignore\", \"inherit\", \"inherit\"] : [\"ignore\", \"pipe\", \"pipe\"],\n        // Detach ONLY when a timeout can fire: the child then leads its own\n        // process group, so the timeout can kill the WHOLE tree (vite, and\n        // Chromium under lhci/playwright) via process.kill(-pid), not just the\n        // npx/pnpm wrapper. Without it, killing the wrapper orphaned the\n        // grandchildren — a zombie vite squatting its port, Chrome left running.\n        // We do NOT detach timeout-less streaming calls (pnpm install/up):\n        // detaching gains nothing there (no timeout → no group-kill) and would\n        // break terminal Ctrl-C, which only reaches the foreground group — i.e.\n        // it would re-orphan the very children this guards. We never unref() the\n        // child since we still await it.\n        detached: opts.timeoutMs !== undefined,\n      });\n\n      // Cap appended output so an unbounded stream can't exhaust memory.\n      const cap = (acc: string, chunk: string): string => {\n        if (acc.length >= maxOutputBytes) return acc;\n        const next = acc + chunk;\n        return next.length > maxOutputBytes\n          ? next.slice(0, maxOutputBytes) + TRUNCATION_MARKER\n          : next;\n      };\n\n      let stdout = \"\";\n      let stderr = \"\";\n      // Decode each stream through a StringDecoder so a multibyte UTF-8 char\n      // split across two `data` chunks isn't corrupted: the decoder holds the\n      // partial trailing bytes until the rest arrives, instead of the old\n      // `String(chunk)` which decoded each chunk in isolation (and replaced the\n      // split char with U+FFFD). Flushed via `.end()` on close.\n      const outDecoder = new StringDecoder(\"utf-8\");\n      const errDecoder = new StringDecoder(\"utf-8\");\n      if (!streaming) {\n        child.stdout?.on(\n          \"data\",\n          (chunk: Buffer) => (stdout = cap(stdout, outDecoder.write(chunk))),\n        );\n        child.stderr?.on(\n          \"data\",\n          (chunk: Buffer) => (stderr = cap(stderr, errDecoder.write(chunk))),\n        );\n      }\n\n      /** Signal the child's whole process group; ignore if it's already gone.\n       *  POSIX-only: a negative pid signals the group (the project targets\n       *  macOS/Linux; this is only reached when detached, i.e. on a timeout). */\n      const killGroup = (sig: NodeJS.Signals): void => {\n        if (child.pid === undefined) return;\n        try {\n          killImpl(-child.pid, sig);\n        } catch {\n          // ESRCH: the group already exited between the timeout and the kill.\n        }\n      };\n\n      let killTimer: ReturnType<typeof setTimeout> | undefined;\n      const timer = opts.timeoutMs\n        ? setTimeout(() => {\n            killGroup(\"SIGTERM\");\n            // Escalate if SIGTERM is ignored (a wedged Chrome can swallow it).\n            killTimer = setTimeout(() => killGroup(\"SIGKILL\"), killGraceMs);\n            // Best-effort cleanup AFTER we've already rejected — it must never\n            // hold the CLI open past its real work.\n            killTimer.unref();\n            reject(new Error(`spawn timeout after ${opts.timeoutMs}ms: ${cmd}`));\n          }, opts.timeoutMs)\n        : undefined;\n\n      const clearTimers = (): void => {\n        if (timer) clearTimeout(timer);\n        if (killTimer) clearTimeout(killTimer);\n      };\n\n      child.on(\"error\", (err) => {\n        clearTimers();\n        reject(err);\n      });\n      child.on(\"close\", (code) => {\n        clearTimers();\n        if (!streaming) {\n          // Flush any bytes the decoder buffered mid-character (e.g. a truncated\n          // final UTF-8 sequence). `.end()` returns \"\" when nothing is pending.\n          stdout = cap(stdout, outDecoder.end());\n          stderr = cap(stderr, errDecoder.end());\n        }\n        resolve({ code: code ?? -1, stdout, stderr });\n      });\n    });\n}\n\nexport const defaultSpawn: SpawnFn = makeSpawn();\n","import { readFile } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport type { AuditResult } from \"../types.js\";\nimport { siteLabel } from \"../util/site.js\";\nimport { baselineVersions } from \"../configs/baseline-versions.js\";\nimport type { AuditContext } from \"./util/inject.js\";\nimport { defaultSpawn } from \"./util/spawn.js\";\nimport { scanOutdated, type OutdatedCounts } from \"./deps-outdated.js\";\n\nexport type Drift = \"same\" | \"patch\" | \"minor\" | \"major\" | \"newer\";\n\nexport type DepsDriftEntry = {\n  pkg: string;\n  baseline: string;\n  actual: string;\n  drift: Drift;\n};\n\n/** The deps audit reports TWO signals:\n *  - `entries`: declared-range drift vs the canonical baseline (what the\n *    package.json *asks for*, caret-stripped) — the long-standing signal.\n *  - `outdated`: real installed-version drift vs the registry's latest, from\n *    the committed lockfile (null when it can't be determined). Added so the\n *    \"Deps Drifted\" dashboard number stops being the only — and misleading —\n *    deps signal. */\nexport type DepsDetails = {\n  entries: DepsDriftEntry[];\n  outdated: OutdatedCounts | null;\n};\n\nfunction stripCaret(range: string): string {\n  return range.replace(/^[\\^~]/, \"\");\n}\n\n/** A spec we can drift-compare against a semver baseline: a plain version or\n *  caret/tilde range like \"5.55.10\", \"^5.55.10\", \"~5.0.0\". Excludes \"*\",\n *  \"latest\", \"workspace:*\", \"npm:\"-aliases, and git/URL/file specs — those used\n *  to parse to NaN and produce bogus drift, so they're skipped instead. */\nfunction isComparableRange(spec: string): boolean {\n  return /^[\\^~]?\\d/.test(spec.trim());\n}\n\nfunction parseSemver(v: string): [number, number, number] {\n  const cleaned = stripCaret(v).split(\"-\")[0] ?? \"0.0.0\";\n  const parts = cleaned.split(\".\").map((n) => Number.parseInt(n, 10));\n  return [parts[0] ?? 0, parts[1] ?? 0, parts[2] ?? 0];\n}\n\nfunction compareSemver(actual: string, baseline: string): Drift {\n  const [aMajor, aMinor, aPatch] = parseSemver(actual);\n  const [bMajor, bMinor, bPatch] = parseSemver(baseline);\n  if (aMajor > bMajor) return \"newer\";\n  if (aMajor < bMajor) return \"major\";\n  if (aMinor > bMinor) return \"newer\";\n  if (aMinor < bMinor) return \"minor\";\n  if (aPatch > bPatch) return \"newer\";\n  if (aPatch < bPatch) return \"patch\";\n  return \"same\";\n}\n\nexport async function depsAudit(ctx: AuditContext): Promise<AuditResult> {\n  const pkgPath = join(ctx.site.path, \"package.json\");\n  let pkgRaw: string;\n  try {\n    pkgRaw = await readFile(pkgPath, \"utf-8\");\n  } catch (err) {\n    return {\n      audit: \"deps\",\n      site: siteLabel(ctx.site),\n      status: \"skip\",\n      summary: `no package.json at ${pkgPath}`,\n      details: { error: String(err) },\n    };\n  }\n\n  let pkg: { dependencies?: Record<string, string>; devDependencies?: Record<string, string> };\n  try {\n    pkg = JSON.parse(pkgRaw) as {\n      dependencies?: Record<string, string>;\n      devDependencies?: Record<string, string>;\n    };\n  } catch (err) {\n    return {\n      audit: \"deps\",\n      site: siteLabel(ctx.site),\n      status: \"fail\",\n      summary: `package.json is not valid JSON: ${(err as Error).message}`,\n      details: { error: String(err) },\n    };\n  }\n  const installed: Record<string, string> = {\n    ...(pkg.dependencies ?? {}),\n    ...(pkg.devDependencies ?? {}),\n  };\n\n  const entries: DepsDriftEntry[] = [];\n  for (const [name, baseline] of Object.entries(baselineVersions)) {\n    const actual = installed[name];\n    if (!actual) continue;\n    // Skip non-semver specs (\"*\", \"workspace:*\", \"npm:\"-aliases, git/URL): they\n    // can't be drift-compared and used to yield NaN-driven bogus drift (LOW-3).\n    if (!isComparableRange(actual)) continue;\n    entries.push({\n      pkg: name,\n      baseline,\n      actual,\n      drift: compareSemver(actual, baseline),\n    });\n  }\n\n  const anyMajor = entries.some((d) => d.drift === \"major\");\n  const anyMinor = entries.some((d) => d.drift === \"minor\");\n  const anyNewer = entries.some((d) => d.drift === \"newer\");\n\n  // Status stays driven by the declared-range baseline drift (unchanged\n  // behavior). The outdated count is an independent, informational signal.\n  const status: AuditResult[\"status\"] = anyMajor ? \"fail\" : anyMinor || anyNewer ? \"warn\" : \"pass\";\n\n  const driftSummary =\n    status === \"pass\"\n      ? `all ${entries.length} tracked deps in line with baseline`\n      : status === \"warn\"\n        ? `${entries.filter((d) => d.drift !== \"same\").length} of ${entries.length} tracked deps drifted`\n        : `${entries.filter((d) => d.drift === \"major\").length} deps lagging by a major version`;\n\n  const outdated = await scanOutdated(ctx.site.path, ctx.spawn ?? defaultSpawn);\n  const summary = outdated\n    ? `${driftSummary}; ${outdated.outdated} outdated install(s) (${outdated.major} major)`\n    : driftSummary;\n\n  return {\n    audit: \"deps\",\n    site: siteLabel(ctx.site),\n    status,\n    summary,\n    details: { entries, outdated } satisfies DepsDetails,\n  };\n}\n","import type { Site } from \"../types.js\";\n\n/** Human-friendly label for log/output formatting. Prefer the inventory's\n * `name` when present (e.g. \"caltex-landing\") and fall back to the\n * filesystem `path` when unnamed. Every audit + recipe uses this.\n *\n * Uses `||` (not `??`) deliberately: an Airtable Name that slugs to the EMPTY\n * string (`siteSlug(\"!!!\")` → \"\") is `\"\"`, not null/undefined, so `??` would let\n * it through and render a blank label. `||` falls back to the path. */\nexport function siteLabel(site: Site): string {\n  return site.name || site.path;\n}\n","// Curated map of the framework deps reddoor sites should stay close to.\n// Refreshed at each package release from reddoor-starter's package.json.\n// Versions are caret ranges to mirror what `pnpm add` would produce.\n\nexport const baselineVersions: Record<string, string> = {\n  // SvelteKit core\n  svelte: \"^5.55.10\",\n  \"@sveltejs/kit\": \"^2.61.1\",\n  \"@sveltejs/adapter-netlify\": \"^6.0.4\",\n  \"@sveltejs/adapter-auto\": \"^7.0.1\",\n  \"@sveltejs/vite-plugin-svelte\": \"^7.1.2\",\n  \"svelte-check\": \"^4.4.8\",\n\n  // Build tooling\n  vite: \"^8.0.14\",\n  vitest: \"^4.1.7\",\n  typescript: \"^6.0.3\",\n\n  // Tailwind 4\n  tailwindcss: \"^4.3.0\",\n  \"@tailwindcss/vite\": \"^4.3.0\",\n\n  // Prismic\n  \"@prismicio/client\": \"^7.21.8\",\n  \"@prismicio/svelte\": \"^2.2.1\",\n  \"@slicemachine/adapter-sveltekit\": \"^0.3.96\",\n  \"slice-machine-ui\": \"^2.21.3\",\n\n  // Test tooling\n  \"@playwright/test\": \"^1.60.0\",\n  \"@axe-core/playwright\": \"^4.11.3\",\n  \"@lhci/cli\": \"^0.15.1\",\n\n  // Lint\n  eslint: \"^10.4.0\",\n  \"eslint-plugin-svelte\": \"^3.18.0\",\n  \"eslint-config-prettier\": \"^10.1.8\",\n  prettier: \"^3.8.3\",\n  \"prettier-plugin-svelte\": \"^4.0.1\",\n  \"typescript-eslint\": \"^8.60.0\",\n  \"@eslint/js\": \"^10.0.1\",\n  globals: \"^17.6.0\",\n\n  // Misc\n  \"@lucide/svelte\": \"^1.17.0\",\n  \"@zerodevx/svelte-img\": \"^2.1.2\",\n};\n\nexport default baselineVersions;\n","import { stat } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport type { SpawnFn } from \"./util/spawn.js\";\n\n/** Real installed-version drift, distinct from the declared-range \"drift\" the\n *  deps audit computes against the baseline: how many dependencies are behind\n *  the registry's latest, per the committed lockfile. */\nexport type OutdatedCounts = { outdated: number; major: number };\n\nasync function exists(path: string): Promise<boolean> {\n  try {\n    await stat(path);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nfunction majorOf(version: string): number {\n  const head = version.replace(/^[\\^~]/, \"\").split(\".\")[0] ?? \"0\";\n  const n = Number.parseInt(head, 10);\n  return Number.isNaN(n) ? 0 : n;\n}\n\n/**\n * Count outdated dependencies for a site, using its committed lockfile as the\n * source of truth for \"what's installed/deployed\". Returns `null` (skip — the\n * caller degrades gracefully) when it can't determine this:\n *  - no `pnpm-lock.yaml` (not a pnpm site, or never installed)\n *  - the lockfile is stale vs package.json (`--frozen-lockfile` install fails)\n *  - `pnpm outdated` output isn't parseable\n *\n * `pnpm outdated` exits non-zero precisely WHEN there are outdated packages, so\n * its exit code is ignored and only its JSON is parsed. `--frozen-lockfile`\n * never mutates the lockfile, so this stays read-only with respect to the repo.\n */\nexport async function scanOutdated(\n  sitePath: string,\n  spawn: SpawnFn,\n): Promise<OutdatedCounts | null> {\n  if (!(await exists(join(sitePath, \"pnpm-lock.yaml\")))) return null;\n\n  // Everything below is best-effort: a thrown spawn (timeout, `pnpm` not on\n  // PATH, spawn error) must degrade to a skip (null), NOT bubble up and flip the\n  // whole deps audit to a hard fail — the declared-range drift is independent of\n  // pnpm and must still report. (Mirrors securityAudit's try/catch.)\n  try {\n    // Materialize node_modules from the lockfile, but only when it's missing —\n    // an already-installed checkout skips the cold install. `--frozen-lockfile`\n    // never rewrites the lockfile (read-only wrt the repo) and fails fast on a\n    // lockfile out of sync with package.json → skip.\n    if (!(await exists(join(sitePath, \"node_modules\")))) {\n      const install = await spawn(\"pnpm\", [\"install\", \"--frozen-lockfile\"], {\n        cwd: sitePath,\n        timeoutMs: 180_000,\n      });\n      if (install.code !== 0) return null;\n    }\n\n    // `pnpm outdated` exits non-zero precisely WHEN there are outdated packages,\n    // so its exit code is ignored and only its JSON is parsed.\n    const res = await spawn(\"pnpm\", [\"outdated\", \"--json\"], {\n      cwd: sitePath,\n      timeoutMs: 60_000,\n    });\n    const parsed = JSON.parse(res.stdout || \"{}\") as Record<\n      string,\n      { current?: string; latest?: string }\n    >;\n    const entries = Object.values(parsed);\n    return {\n      outdated: entries.length,\n      major: entries.filter((e) => e.current && e.latest && majorOf(e.latest) > majorOf(e.current))\n        .length,\n    };\n  } catch {\n    return null;\n  }\n}\n","import { existsSync } from \"node:fs\";\nimport { readFile } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport { ESLint } from \"eslint\";\nimport { check as prettierCheck, resolveConfig as prettierResolveConfig } from \"prettier\";\nimport { glob } from \"tinyglobby\";\nimport type { AuditResult } from \"../types.js\";\nimport { siteLabel } from \"../util/site.js\";\nimport type { AuditContext } from \"./util/inject.js\";\n\nconst TARGET_GLOBS = [\"**/*.{ts,js,svelte}\"];\nconst IGNORE = [\"node_modules/**\", \"dist/**\", \".svelte-kit/**\", \"build/**\", \".netlify/**\"];\n\nasync function listFiles(cwd: string): Promise<string[]> {\n  return glob(TARGET_GLOBS, { cwd, ignore: IGNORE, absolute: false });\n}\n\nexport async function lintAudit(ctx: AuditContext): Promise<AuditResult> {\n  const { site } = ctx;\n  const configPath = join(site.path, \"eslint.config.js\");\n\n  if (!existsSync(configPath)) {\n    return {\n      audit: \"lint\",\n      site: siteLabel(site),\n      status: \"skip\",\n      summary: \"no eslint config at site root\",\n    };\n  }\n\n  const eslint = new ESLint({\n    cwd: site.path,\n    overrideConfigFile: configPath,\n    errorOnUnmatchedPattern: false,\n  });\n\n  const relFiles = await listFiles(site.path);\n\n  // Pass relative paths to ESLint; its cwd is already site.path. Avoids\n  // dereferencing symlinks on pnpm workspaces.\n  const eslintResults = await eslint.lintFiles(relFiles);\n  const eslintErrors = eslintResults.reduce((n, r) => n + r.errorCount, 0);\n  const eslintWarnings = eslintResults.reduce((n, r) => n + r.warningCount, 0);\n\n  const prettierUnformatted: string[] = [];\n  for (const rel of relFiles) {\n    const absForResolve = join(site.path, rel);\n    const source = await readFile(absForResolve, \"utf-8\");\n    const options = (await prettierResolveConfig(absForResolve)) ?? {};\n    const ok = await prettierCheck(source, { ...options, filepath: absForResolve });\n    if (!ok) prettierUnformatted.push(rel);\n  }\n\n  const status: AuditResult[\"status\"] =\n    eslintErrors > 0 || prettierUnformatted.length > 0\n      ? \"fail\"\n      : eslintWarnings > 0\n        ? \"warn\"\n        : \"pass\";\n\n  const summary =\n    status === \"pass\"\n      ? `lint clean across ${relFiles.length} files`\n      : `${eslintErrors} eslint errors, ${eslintWarnings} warnings, ${prettierUnformatted.length} unformatted`;\n\n  return {\n    audit: \"lint\",\n    site: siteLabel(site),\n    status,\n    summary,\n    details: {\n      eslintErrors,\n      eslintWarnings,\n      prettierUnformatted,\n      files: relFiles.length,\n    },\n  };\n}\n","import type { AuditResult } from \"../types.js\";\nimport { siteLabel } from \"../util/site.js\";\nimport { defaultSpawn, type SpawnResult } from \"./util/spawn.js\";\nimport type { AuditContext } from \"./util/inject.js\";\n\ntype Severity = \"low\" | \"moderate\" | \"high\" | \"critical\";\n\ntype Counts = { low: number; moderate: number; high: number; critical: number };\n\ntype AdvisoryEntry = {\n  module: string;\n  severity: Severity;\n  title: string;\n  cves?: string[];\n  url?: string;\n};\n\n// pnpm audit output (npm-compat with extra advisories map keyed by ID).\ntype PnpmAuditJson = {\n  metadata?: { vulnerabilities?: Partial<Counts> };\n  advisories?: Record<\n    string,\n    {\n      id?: number;\n      title?: string;\n      module_name?: string;\n      severity?: string;\n      cves?: string[];\n      url?: string;\n    }\n  >;\n};\n\n// npm v7+ shape (vulnerabilities keyed by package name).\ntype NpmAuditJson = {\n  metadata?: { vulnerabilities?: Partial<Counts> };\n  vulnerabilities?: Record<\n    string,\n    {\n      name?: string;\n      severity?: string;\n      via?: unknown;\n      url?: string;\n    }\n  >;\n};\n\nfunction classify(v: Counts) {\n  if (v.critical > 0 || v.high > 0) return \"fail\" as const;\n  if (v.moderate > 0 || v.low > 0) return \"warn\" as const;\n  return \"pass\" as const;\n}\n\nfunction normalizeSeverity(s: unknown): Severity {\n  if (s === \"low\" || s === \"moderate\" || s === \"high\" || s === \"critical\") return s;\n  // npm/pnpm sometimes emit \"info\" for informational advisories. Map down\n  // rather than defaulting to \"moderate\" (which would inflate severity).\n  return \"low\";\n}\n\nfunction extractAdvisoriesFromPnpm(parsed: PnpmAuditJson): AdvisoryEntry[] {\n  const out: AdvisoryEntry[] = [];\n  for (const a of Object.values(parsed.advisories ?? {})) {\n    if (!a) continue;\n    out.push({\n      module: a.module_name ?? \"unknown\",\n      severity: normalizeSeverity(a.severity),\n      title: a.title ?? \"(no title)\",\n      ...(a.cves ? { cves: a.cves } : {}),\n      ...(a.url ? { url: a.url } : {}),\n    });\n  }\n  return out;\n}\n\n/** Walk an npm v7+ `via` chain to find the root entry whose `via` array\n * contains a real advisory object (rather than another package name string).\n * Returns the package name at the root and the advisory detail. */\nfunction resolveNpmAdvisoryRoot(\n  startName: string,\n  vulnerabilities: NonNullable<NpmAuditJson[\"vulnerabilities\"]>,\n): { rootName: string; detail?: { title?: string; url?: string } } {\n  const seen = new Set<string>();\n  let current = startName;\n  while (!seen.has(current)) {\n    seen.add(current);\n    const entry = vulnerabilities[current];\n    if (!entry || !Array.isArray(entry.via)) return { rootName: current };\n\n    const detailed = entry.via.find(\n      (e): e is { title?: string; url?: string } => typeof e === \"object\" && e !== null,\n    );\n    if (detailed) return { rootName: current, detail: detailed };\n\n    const next = entry.via.find((e): e is string => typeof e === \"string\");\n    if (!next || next === current) return { rootName: current };\n    current = next;\n  }\n  return { rootName: current };\n}\n\nfunction extractAdvisoriesFromNpm(parsed: NpmAuditJson): AdvisoryEntry[] {\n  const vulnerabilities = parsed.vulnerabilities ?? {};\n  const roots = new Map<string, AdvisoryEntry>();\n\n  for (const [name, v] of Object.entries(vulnerabilities)) {\n    if (!v) continue;\n    const { rootName, detail } = resolveNpmAdvisoryRoot(name, vulnerabilities);\n    if (roots.has(rootName)) continue; // already surfaced via another transitive entry\n\n    const rootEntry = vulnerabilities[rootName];\n    const severity = normalizeSeverity(rootEntry?.severity ?? v.severity);\n    const title = detail?.title ?? rootName;\n    const url = detail?.url;\n\n    roots.set(rootName, {\n      module: rootEntry?.name ?? rootName,\n      severity,\n      title,\n      ...(url ? { url } : {}),\n    });\n  }\n\n  return [...roots.values()];\n}\n\ntype ToolResult =\n  | { kind: \"missing\" }\n  | { kind: \"error\"; reason: string }\n  | { kind: \"ok\"; parsed: PnpmAuditJson & NpmAuditJson };\n\nasync function runAuditTool(\n  spawn: (cmd: string, args: readonly string[], opts?: { cwd?: string }) => Promise<SpawnResult>,\n  cmd: string,\n  args: readonly string[],\n  cwd: string,\n): Promise<ToolResult> {\n  let raw: SpawnResult;\n  try {\n    raw = await spawn(cmd, args, { cwd });\n  } catch (err) {\n    const e = err as NodeJS.ErrnoException;\n    if (e.code === \"ENOENT\" || /ENOENT/.test(String(err))) return { kind: \"missing\" };\n    return { kind: \"error\", reason: `spawn failed: ${String(err).slice(0, 200)}` };\n  }\n\n  // 0 = clean, 1 = vulns found. Anything else is a real error.\n  if (raw.code !== 0 && raw.code !== 1) {\n    return {\n      kind: \"error\",\n      reason: `exit ${raw.code}${raw.stderr ? `: ${raw.stderr.slice(0, 150)}` : \"\"}`,\n    };\n  }\n\n  let parsed: PnpmAuditJson & NpmAuditJson;\n  try {\n    parsed = JSON.parse(raw.stdout || \"{}\") as PnpmAuditJson & NpmAuditJson;\n  } catch (err) {\n    return { kind: \"error\", reason: `unparseable JSON: ${String(err).slice(0, 100)}` };\n  }\n\n  // pnpm error envelope: { error: { code, message } }. npm sometimes emits\n  // a top-level error too. Either means the audit didn't actually run.\n  const errEnvelope = (parsed as unknown as { error?: { code?: string } }).error;\n  if (errEnvelope && typeof errEnvelope === \"object\") {\n    return { kind: \"error\", reason: errEnvelope.code ?? \"error envelope returned\" };\n  }\n\n  // Without metadata.vulnerabilities there are no counts to report and we\n  // can't trust the result. An empty `{}` is just as suspect as a missing\n  // key — counts default to 0 and we'd silently report \"pass\". Treat both\n  // as a tool failure so the caller can fall through to the other audit.\n  const vulnsMeta = parsed.metadata?.vulnerabilities;\n  if (!vulnsMeta || Object.keys(vulnsMeta).length === 0) {\n    return { kind: \"error\", reason: \"no metadata.vulnerabilities in output\" };\n  }\n\n  return { kind: \"ok\", parsed };\n}\n\nexport async function securityAudit(ctx: AuditContext): Promise<AuditResult> {\n  const spawn = ctx.spawn ?? defaultSpawn;\n  const site = ctx.site;\n  const label = siteLabel(site);\n\n  let used: \"pnpm audit\" | \"npm audit\" = \"pnpm audit\";\n  let result = await runAuditTool(spawn, \"pnpm\", [\"audit\", \"--json\", \"--prod\"], site.path);\n\n  // Fall through to npm if pnpm is missing OR pnpm couldn't actually\n  // audit the project (e.g., no pnpm-lock.yaml). Previously we only fell\n  // through on ENOENT, which meant npm-using sites silently reported \"pass\"\n  // because pnpm returned an error envelope with no metadata.\n  if (result.kind !== \"ok\") {\n    const pnpmReason = result.kind === \"missing\" ? \"not installed\" : result.reason;\n    const npmResult = await runAuditTool(\n      spawn,\n      \"npm\",\n      [\"audit\", \"--json\", \"--omit=dev\"],\n      site.path,\n    );\n    if (npmResult.kind === \"ok\") {\n      result = npmResult;\n      used = \"npm audit\";\n    } else {\n      const npmReason = npmResult.kind === \"missing\" ? \"not installed\" : npmResult.reason;\n      return {\n        audit: \"security\",\n        site: label,\n        status: \"skip\",\n        summary: `cannot run audit — pnpm: ${pnpmReason}; npm: ${npmReason}`,\n      };\n    }\n  }\n\n  const parsed = result.parsed;\n\n  const counts: Counts = {\n    low: parsed.metadata?.vulnerabilities?.low ?? 0,\n    moderate: parsed.metadata?.vulnerabilities?.moderate ?? 0,\n    high: parsed.metadata?.vulnerabilities?.high ?? 0,\n    critical: parsed.metadata?.vulnerabilities?.critical ?? 0,\n  };\n\n  const advisories =\n    used === \"pnpm audit\" ? extractAdvisoriesFromPnpm(parsed) : extractAdvisoriesFromNpm(parsed);\n\n  const status = classify(counts);\n  const total = counts.low + counts.moderate + counts.high + counts.critical;\n  const summary =\n    status === \"pass\"\n      ? `${used}: 0 vulnerabilities`\n      : `${used}: ${total} vulnerabilities (${counts.critical}C/${counts.high}H/${counts.moderate}M/${counts.low}L)`;\n\n  return {\n    audit: \"security\",\n    site: label,\n    status,\n    summary,\n    details: { counts, advisories },\n  };\n}\n","import { readFile, writeFile, mkdtemp, rm, readdir } from \"node:fs/promises\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport type { AuditResult, Site } from \"../types.js\";\nimport { siteLabel } from \"../util/site.js\";\nimport { lighthouseConfig } from \"../configs/lighthouse.js\";\nimport { defaultSpawn } from \"./util/spawn.js\";\nimport type { SpawnFn, SpawnResult } from \"./util/spawn.js\";\nimport type { AuditContext } from \"./util/inject.js\";\nimport { readSiteConfig } from \"./util/site-config.js\";\nimport { findFreePort, withFreePort } from \"../util/free-port.js\";\n\ntype ManifestEntry = {\n  url: string;\n  summary: Record<string, number>;\n  htmlPath?: string;\n  jsonPath?: string;\n};\n\ntype AssertionResult = {\n  name: string;\n  actual: number;\n  expected: number;\n  operator: string;\n  passed: boolean;\n  level: \"warn\" | \"error\";\n  auditProperty?: string;\n  auditId?: string;\n};\n\ntype NormalizedLhciResult = {\n  summary: Record<string, number>;\n  assertionsFailed: number;\n  assertions: Array<{ category: string; level: \"warn\" | \"error\"; message: string }>;\n};\n\nasync function readJsonMaybe<T>(path: string): Promise<T | null> {\n  try {\n    const raw = await readFile(path, \"utf-8\");\n    return JSON.parse(raw) as T;\n  } catch {\n    return null;\n  }\n}\n\ntype LhrFile = {\n  requestedUrl: string;\n  finalUrl?: string;\n  categories: Record<string, { score: number | null }>;\n};\n\n/**\n * Build manifest-equivalent entries by scanning the `.lighthouseci/` dir\n * for `lhr-*.json` files written by `lhci collect`. We used to read\n * `manifest.json` directly, but lhci 0.15+ no longer writes it — the\n * audit would silently return \"no manifest written\" against a perfectly\n * healthy run. Reproduced on caltex 2026-05-28 (0.10.5 dogfood).\n */\nasync function readLhrEntries(resultsDir: string): Promise<ManifestEntry[]> {\n  const files = await readdir(resultsDir).catch(() => [] as string[]);\n  const entries: ManifestEntry[] = [];\n  for (const f of files) {\n    if (!f.startsWith(\"lhr-\") || !f.endsWith(\".json\")) continue;\n    const lhr = await readJsonMaybe<LhrFile>(join(resultsDir, f));\n    if (!lhr || !lhr.categories) continue;\n    const summary: Record<string, number> = {};\n    for (const [k, v] of Object.entries(lhr.categories)) {\n      if (typeof v?.score === \"number\") summary[k] = v.score;\n    }\n    entries.push({ url: lhr.requestedUrl, summary });\n  }\n  return entries;\n}\n\nfunction averageSummaries(entries: ManifestEntry[]): Record<string, number> {\n  if (entries.length === 0) return {};\n  const sums: Record<string, number> = {};\n  const counts: Record<string, number> = {};\n  for (const e of entries) {\n    for (const [k, v] of Object.entries(e.summary ?? {})) {\n      if (typeof v !== \"number\") continue;\n      sums[k] = (sums[k] ?? 0) + v;\n      counts[k] = (counts[k] ?? 0) + 1;\n    }\n  }\n  const out: Record<string, number> = {};\n  for (const k of Object.keys(sums)) {\n    const total = sums[k] ?? 0;\n    const count = counts[k] ?? 1;\n    out[k] = total / count;\n  }\n  return out;\n}\n\nfunction categoryFromAssertion(a: AssertionResult): string {\n  // `name` looks like \"categories:accessibility\" or \"audits:uses-http2\".\n  const colonIdx = a.name.indexOf(\":\");\n  return colonIdx >= 0 ? a.name.slice(colonIdx + 1) : a.name;\n}\n\nfunction messageForAssertion(a: AssertionResult): string {\n  // `a.actual` is parsed from external lhci/Lighthouse JSON; a malformed or\n  // missing value (not a number) would make `.toFixed` throw and crash the whole\n  // audit. Guard it and fall back to a readable string instead.\n  const actual = typeof a.actual === \"number\" ? a.actual.toFixed(2) : \"n/a\";\n  return `${a.name} ${a.operator} ${a.expected} (actual: ${actual})`;\n}\n\n/** Shared tail: scan `.lighthouseci/` for lhr-*.json + assertion-results.json and\n *  build the AuditResult. Identical for the checkout and deployed paths. */\nasync function parseLhciResults(\n  resultsDir: string,\n  label: string,\n  raw: SpawnResult,\n): Promise<AuditResult> {\n  const manifest = await readLhrEntries(resultsDir);\n\n  if (manifest.length === 0) {\n    return {\n      audit: \"lighthouse\",\n      site: label,\n      status: \"fail\",\n      summary: `lighthouse: no lhr-*.json written (exit ${raw.code})${\n        raw.stderr ? ` — ${raw.stderr.slice(0, 200)}` : \"\"\n      }`,\n    };\n  }\n\n  const assertionResults =\n    (await readJsonMaybe<AssertionResult[]>(join(resultsDir, \"assertion-results.json\"))) ?? [];\n\n  const failed = assertionResults.filter((a) => !a.passed);\n  const assertions = failed.map((a) => ({\n    category: categoryFromAssertion(a),\n    level: a.level,\n    message: messageForAssertion(a),\n  }));\n\n  const anyError = assertions.some((a) => a.level === \"error\");\n  const anyWarn = assertions.some((a) => a.level === \"warn\");\n  const status: AuditResult[\"status\"] = anyError ? \"fail\" : anyWarn ? \"warn\" : \"pass\";\n\n  const normalized: NormalizedLhciResult = {\n    summary: averageSummaries(manifest),\n    assertionsFailed: failed.length,\n    assertions,\n  };\n\n  const summary =\n    status === \"pass\"\n      ? \"lighthouse: all categories passing\"\n      : `lighthouse: ${failed.length} assertion(s) failed`;\n\n  return { audit: \"lighthouse\", site: label, status, summary, details: normalized };\n}\n\n/** Checkout mode (unchanged behavior): boot the site's vite dev server on a\n *  pinned free port and audit the local fixtures/override URL. */\nasync function checkoutLighthouse(spawn: SpawnFn, site: Site, label: string): Promise<AuditResult> {\n  const siteCfg = await readSiteConfig(site.path);\n  // Allocate a free port + force vite to `--strictPort` so the spawned dev\n  // server either binds the port we picked or fails loudly (caltex 2026-05-28\n  // zombie-vite incident).\n  const port = await findFreePort();\n  const baseUrl = siteCfg.lighthouseUrl ?? lighthouseConfig.ci.collect.url[0];\n  const resolvedConfig = {\n    ...lighthouseConfig,\n    ci: {\n      ...lighthouseConfig.ci,\n      collect: {\n        ...lighthouseConfig.ci.collect,\n        url: [withFreePort(baseUrl, port)],\n        startServerCommand: `npm run vite:dev -- --port ${port} --strictPort`,\n      },\n    },\n  };\n\n  const configDir = await mkdtemp(join(tmpdir(), \"reddoor-lhci-\"));\n  const configPath = join(configDir, \"lighthouserc.json\");\n  await writeFile(configPath, JSON.stringify(resolvedConfig), \"utf-8\");\n\n  const resultsDir = join(site.path, \".lighthouseci\");\n  await rm(resultsDir, { recursive: true, force: true });\n\n  let raw: SpawnResult;\n  try {\n    raw = await spawn(\"npx\", [\"--yes\", \"@lhci/cli\", \"autorun\", `--config=${configPath}`], {\n      cwd: site.path,\n      timeoutMs: 5 * 60_000,\n    });\n  } catch (err) {\n    await rm(configDir, { recursive: true, force: true });\n    const e = err as NodeJS.ErrnoException;\n    if (e.code === \"ENOENT\" || /ENOENT/.test(String(err))) {\n      return {\n        audit: \"lighthouse\",\n        site: label,\n        status: \"skip\",\n        summary: \"npx/@lhci/cli not available\",\n      };\n    }\n    throw err;\n  }\n  await rm(configDir, { recursive: true, force: true });\n\n  return parseLhciResults(resultsDir, label, raw);\n}\n\n/** Deployed mode: audit a production URL directly — no checkout, no dev server.\n *  Runs in a throwaway tmp cwd; uploads to the filesystem so fleet runs never\n *  push 200 public reports to temporary-public-storage. */\nasync function deployedLighthouse(\n  spawn: SpawnFn,\n  deployedUrl: string,\n  label: string,\n): Promise<AuditResult> {\n  const workDir = await mkdtemp(join(tmpdir(), \"reddoor-lh-deployed-\"));\n  const resolvedConfig = {\n    ci: {\n      // Deliberately NOT spread from lighthouseConfig.ci.collect: deployed mode\n      // must omit startServerCommand and the dev-server settings entirely.\n      collect: {\n        url: [deployedUrl],\n        // 3 runs to damp Lighthouse's run-to-run variance; parseLhciResults\n        // averages the lhr files. (Median is a tracked future refinement.)\n        numberOfRuns: 3,\n        settings: { preset: \"desktop\", skipAudits: [\"uses-http2\"] },\n      },\n      assert: lighthouseConfig.ci.assert,\n      upload: { target: \"filesystem\", outputDir: join(workDir, \"lhci-report\") },\n    },\n  };\n\n  const configPath = join(workDir, \"lighthouserc.json\");\n  await writeFile(configPath, JSON.stringify(resolvedConfig), \"utf-8\");\n\n  const resultsDir = join(workDir, \".lighthouseci\");\n\n  let raw: SpawnResult;\n  try {\n    raw = await spawn(\"npx\", [\"--yes\", \"@lhci/cli\", \"autorun\", `--config=${configPath}`], {\n      cwd: workDir,\n      // 3 serial cold runs of a slow deployed site (lhci's own maxWaitForLoad\n      // ~45-60s each) + first-use Chrome download can plausibly exceed 3 min →\n      // SIGTERM → no lhr-*.json → spurious \"no scores\". Match the 5-min budget\n      // the checkout path already gives (erp-industrials nightly flake,\n      // morning-brief 2026-06-10 MEDIUM-F).\n      timeoutMs: 5 * 60_000,\n    });\n  } catch (err) {\n    await rm(workDir, { recursive: true, force: true });\n    const e = err as NodeJS.ErrnoException;\n    if (e.code === \"ENOENT\" || /ENOENT/.test(String(err))) {\n      return {\n        audit: \"lighthouse\",\n        site: label,\n        status: \"skip\",\n        summary: \"npx/@lhci/cli not available\",\n      };\n    }\n    throw err;\n  }\n\n  try {\n    return await parseLhciResults(resultsDir, label, raw);\n  } finally {\n    await rm(workDir, { recursive: true, force: true });\n  }\n}\n\nexport async function lighthouseAudit(ctx: AuditContext): Promise<AuditResult> {\n  const spawn = ctx.spawn ?? defaultSpawn;\n  const site = ctx.site;\n  const label = siteLabel(site);\n\n  return site.deployedUrl\n    ? deployedLighthouse(spawn, site.deployedUrl, label)\n    : checkoutLighthouse(spawn, site, label);\n}\n","export const lighthouseConfig = {\n  ci: {\n    collect: {\n      url: [\"http://localhost:5173/dev/a11y-fixtures\"],\n      // `npm run vite:dev` works on both pnpm and npm sites — pnpm respects\n      // the `run` form too. Keeps this config portable across the fleet\n      // while sites transition to pnpm.\n      startServerCommand: \"npm run vite:dev\",\n      startServerReadyPattern: \"ready in\",\n      startServerReadyTimeout: 120_000,\n      numberOfRuns: 1,\n      settings: {\n        preset: \"desktop\",\n        skipAudits: [\"uses-http2\"],\n      },\n    },\n    assert: {\n      assertions: {\n        \"categories:accessibility\": [\"error\", { minScore: 0.95 }],\n        \"categories:best-practices\": [\"error\", { minScore: 0.9 }],\n        \"categories:seo\": [\"error\", { minScore: 0.9 }],\n        \"categories:performance\": [\"warn\", { minScore: 0.7 }],\n      },\n    },\n    upload: {\n      target: \"temporary-public-storage\",\n    },\n  },\n} as const;\n\nexport default lighthouseConfig;\n","import { readFile } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\nexport type SiteConfig = {\n  /** Override URL the lighthouse audit hits. Sites without the default\n   * `/dev/a11y-fixtures` dev route set this to their homepage. */\n  lighthouseUrl?: string;\n};\n\n/**\n * Read per-site overrides from `package.json#reddoor`. Returns `{}` on any\n * failure (missing file, malformed JSON, missing key, wrong type) so every\n * caller can safely fall back to its built-in default. Never throws.\n */\nexport async function readSiteConfig(sitePath: string): Promise<SiteConfig> {\n  let raw: string;\n  try {\n    raw = await readFile(join(sitePath, \"package.json\"), \"utf-8\");\n  } catch {\n    return {};\n  }\n  let pkg: unknown;\n  try {\n    pkg = JSON.parse(raw);\n  } catch {\n    return {};\n  }\n  if (!pkg || typeof pkg !== \"object\") return {};\n  const cfg = (pkg as { reddoor?: unknown }).reddoor;\n  if (!cfg || typeof cfg !== \"object\") return {};\n\n  const out: SiteConfig = {};\n  const url = (cfg as { lighthouseUrl?: unknown }).lighthouseUrl;\n  if (typeof url === \"string\" && url.length > 0) {\n    out.lighthouseUrl = url;\n  }\n  return out;\n}\n","import { createServer } from \"node:net\";\n\n/**\n * Bind an ephemeral TCP port, capture it, release it, and return it. Used\n * by the lighthouse and a11y audits to pick a port the audit's own dev\n * server will then bind via `--strictPort`.\n *\n * Why: vite's default behavior on a busy port is to bump to the next free\n * one (5173 → 5174 → …). When zombie vite processes (or any squatter) are\n * already on 5173, the audit's spawned vite lands on a higher port, but\n * the audit tooling (lhci, playwright) still probes 5173 — hits the\n * zombie — gets stale 404s — fails with \"no manifest written\" / \"no\n * results written (exit 1)\". Reproduced on caltex 2026-05-28 with 10\n * orphaned vite processes accumulated across this repo, the reports repo,\n * and caltex itself. Allocating a free port up front + `--strictPort`\n * makes the audit immune to port collisions.\n *\n * TOCTOU note: the small window between close() and the spawned vite\n * binding is theoretically racy, but in practice we run one audit at a\n * time and the OS keeps the port free for re-use. If vite still fails to\n * bind under `--strictPort`, the audit fails loudly — that's the correct\n * outcome (vs. silently auditing the wrong server).\n */\nexport async function findFreePort(): Promise<number> {\n  return new Promise((resolve, reject) => {\n    const server = createServer();\n    server.unref();\n    server.on(\"error\", reject);\n    server.listen(0, \"127.0.0.1\", () => {\n      const addr = server.address();\n      if (typeof addr === \"object\" && addr) {\n        const port = addr.port;\n        server.close(() => resolve(port));\n      } else {\n        server.close();\n        reject(new Error(\"findFreePort: could not determine assigned port from socket\"));\n      }\n    });\n  });\n}\n\n/**\n * Swap the port (and force `localhost` host) on a URL so it points at the\n * audit's freshly-allocated dev server. Preserves the path + any query.\n * Used to rewrite the lighthouse `url` so lhci probes the correct port.\n */\nexport function withFreePort(url: string, port: number): string {\n  const u = new URL(url);\n  u.hostname = \"localhost\";\n  u.port = String(port);\n  return u.toString();\n}\n","import { readFile, writeFile, mkdtemp, rm } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport type { AuditResult } from \"../types.js\";\nimport { siteLabel } from \"../util/site.js\";\nimport { a11yRoutes, smokeRoutes } from \"../configs/playwright-a11y.js\";\nimport { defaultSpawn } from \"./util/spawn.js\";\nimport type { AuditContext } from \"./util/inject.js\";\nimport { findFreePort } from \"../util/free-port.js\";\n\ntype Impact = \"minor\" | \"moderate\" | \"serious\" | \"critical\";\n\ntype AxeViolation = {\n  id: string;\n  impact: Impact;\n  route: string;\n  help?: string;\n  helpUrl?: string;\n  nodes?: Array<{ html?: string; target?: string[] }>;\n};\n\ntype NormalizedA11y = {\n  totalViolations: number;\n  byImpact: Partial<Record<Impact, number>>;\n  violations: AxeViolation[];\n};\n\nconst RESULTS_REL = \".reddoor-a11y/results.json\";\n\nasync function readJsonMaybe<T>(path: string): Promise<T | null> {\n  try {\n    const raw = await readFile(path, \"utf-8\");\n    return JSON.parse(raw) as T;\n  } catch {\n    return null;\n  }\n}\n\n// The audit-controlled playwright config. We synthesize it (rather than\n// rely on the site's playwright.config.ts) so we can pin the dev server\n// port + force `--strictPort` — same fix as the lighthouse audit, same\n// reason (zombie vite processes squatting on 5173 would otherwise eat\n// the audit's request and return stale 404s).\nfunction buildPlaywrightConfig(port: number, sitePath: string): string {\n  return `import { defineConfig } from \"@playwright/test\";\n\nexport default defineConfig({\n  testDir: \".\",\n  testMatch: /.*\\\\.spec\\\\.ts$/,\n  fullyParallel: true,\n  forbidOnly: !!process.env.CI,\n  retries: process.env.CI ? 2 : 0,\n  reporter: process.env.CI ? \"github\" : \"list\",\n  use: {\n    baseURL: \"http://localhost:${port}\",\n    trace: \"on-first-retry\",\n  },\n  webServer: {\n    // --strictPort: refuse to bump to a different port if ours is taken,\n    //   so the audit fails loudly instead of probing a zombie.\n    // reuseExistingServer:false: never reuse — we control the lifecycle.\n    // cwd: playwright's default webServer.cwd is the config file's\n    //   directory. Our config lives in /tmp so without this override,\n    //   \"npm run vite:dev\" tries to read /tmp/.../package.json and\n    //   ENOENTs before vite ever starts. Caltex 2026-05-28 (0.10.5).\n    command: \"npm run vite:dev -- --port ${port} --strictPort\",\n    url: \"http://localhost:${port}/dev/a11y-fixtures\",\n    cwd: ${JSON.stringify(sitePath)},\n    reuseExistingServer: false,\n    timeout: 120_000,\n  },\n});\n`;\n}\n\n// The spec the audit writes runs all configured routes through axe in a single\n// test (so worker isolation doesn't fragment the collected violations) and\n// writes the structured result to <cwd>/.reddoor-a11y/results.json before\n// asserting. That way, the audit can read real axe details even when the\n// expect(...).toEqual([]) assertion fails.\nfunction buildSpec(): string {\n  return `import { test, expect } from \"@playwright/test\";\nimport AxeBuilder from \"@axe-core/playwright\";\nimport { mkdir, writeFile } from \"node:fs/promises\";\nimport { dirname } from \"node:path\";\n\nconst pages = ${JSON.stringify(a11yRoutes)};\nconst smokePages = ${JSON.stringify(smokeRoutes)};\nconst OUTPUT = process.env.REDDOOR_A11Y_OUTPUT;\n\n// Playwright's default per-test timeout is 30s. We loop through every\n// configured route in a single test, so the budget needs to scale.\ntest.setTimeout(5 * 60_000);\n\ntest(\"a11y + hydration across configured routes\", async ({ page }) => {\n  const violations = [];\n\n  // Capture uncaught client-side exceptions across every route we visit. A page\n  // that builds + SSRs cleanly can still throw on hydrate and blank itself\n  // (data-dynamiq: a Svelte 4->5 run() referenced a $state declared after it) --\n  // axe never sees that, so we listen for it directly and tag the route in scope.\n  let currentRoute = \"\";\n  page.on(\"pageerror\", (err) => {\n    violations.push({\n      id: \"client-error\",\n      impact: \"critical\",\n      route: currentRoute,\n      help: String(err && err.message ? err.message : err),\n    });\n  });\n\n  for (const { path, name } of pages) {\n    currentRoute = name;\n    await page.goto(path);\n    // Snap CSS transitions/animations to their resting state before axe runs.\n    // AnimateIn-style fixtures transition opacity 0->1; sampling mid-transition\n    // makes axe compute color-contrast against semi-transparent text, yielding a\n    // flaky \"serious\" color-contrast violation (~1/3 of runs on /dev/animate-in).\n    // Disabling transitions/animations forces the final, rendered state\n    // deterministically -- which is also what users (and prefers-reduced-motion\n    // users) actually see, so it's the correct thing to assert.\n    await page.addStyleTag({\n      content: \"*,*::before,*::after{transition:none!important;animation:none!important;}\",\n    });\n    const results = await new AxeBuilder({ page })\n      .withTags([\"wcag2a\",\"wcag2aa\",\"wcag21a\",\"wcag21aa\",\"wcag22aa\"])\n      .analyze();\n    for (const v of results.violations) {\n      violations.push({\n        id: v.id,\n        impact: v.impact ?? \"moderate\",\n        route: name,\n        help: v.help,\n        helpUrl: v.helpUrl,\n        nodes: v.nodes.map((n) => ({ html: n.html, target: n.target })),\n      });\n    }\n  }\n\n  // Hydration smoke check: load real routes (the homepage) and fail on any\n  // uncaught client-side error. No axe here -- real routes carry pre-existing\n  // a11y debt we don't gate on; we only assert they don't crash on hydrate.\n  // HTTP/SSR errors don't fire 'pageerror', so a data-less CI homepage that\n  // renders empty-but-valid won't false-fail -- only a real client crash does.\n  for (const { path, name } of smokePages) {\n    currentRoute = name;\n    await page.goto(path);\n    // Let hydration + first effects run so a TDZ/ReferenceError surfaces.\n    await page.waitForTimeout(2000);\n  }\n\n  const byImpact = {};\n  for (const v of violations) {\n    byImpact[v.impact] = (byImpact[v.impact] ?? 0) + 1;\n  }\n  if (OUTPUT) {\n    await mkdir(dirname(OUTPUT), { recursive: true });\n    await writeFile(\n      OUTPUT,\n      JSON.stringify({ totalViolations: violations.length, byImpact, violations }, null, 2),\n    );\n  }\n  expect(violations).toEqual([]);\n});\n`;\n}\n\nexport async function a11yAudit(ctx: AuditContext): Promise<AuditResult> {\n  const spawn = ctx.spawn ?? defaultSpawn;\n  const site = ctx.site;\n  const label = siteLabel(site);\n\n  // specDir lives INSIDE site.path (not /tmp) so the spec's\n  // `import AxeBuilder from \"@axe-core/playwright\"` resolves via Node's\n  // walk-up — the site's node_modules is the nearest one. A spec written\n  // to /tmp ENOENTs at module resolution before any test runs. Caltex\n  // 2026-05-28 (0.10.6 dogfood), third layer of the same class as the\n  // webServer.cwd bug.\n  const specDir = await mkdtemp(join(site.path, \".reddoor-a11y-spec-\"));\n  // Everything past mkdtemp is wrapped so the transient specDir is removed on\n  // EVERY catchable exit — success, skip-return, or any throw (a failed\n  // writeFile/findFreePort used to orphan it). A timeout-SIGKILL of the parent\n  // can't be caught here; `.reddoor-a11y-spec-*/` is fleet-gitignored as the\n  // backstop for that. (2026-06-10 MEDIUM-D; recurred from 06-05 M3.)\n  try {\n    const specPath = join(specDir, \"a11y.spec.ts\");\n    await writeFile(specPath, buildSpec(), \"utf-8\");\n\n    const port = await findFreePort();\n    const configPath = join(specDir, \"playwright.config.ts\");\n    await writeFile(configPath, buildPlaywrightConfig(port, site.path), \"utf-8\");\n\n    const resultsPath = join(site.path, RESULTS_REL);\n    // Clear stale artifacts so a failed spawn never reports old data.\n    await rm(join(site.path, \".reddoor-a11y\"), { recursive: true, force: true });\n\n    let raw;\n    try {\n      raw = await spawn(\n        \"npx\",\n        [\"--yes\", \"playwright\", \"test\", `--config=${configPath}`, \"--reporter=line\", specPath],\n        {\n          cwd: site.path,\n          env: { ...process.env, REDDOOR_A11Y_OUTPUT: resultsPath },\n          // playwright on a cold tree downloads Chrome, boots the site's dev\n          // server, and runs axe over every configured route. The shared 30 s\n          // default in runAudits is fine for deps/lint/security but starves\n          // playwright (mirrors the lighthouse fix shipped earlier).\n          timeoutMs: 5 * 60_000,\n        },\n      );\n    } catch (err) {\n      const e = err as NodeJS.ErrnoException;\n      if (e.code === \"ENOENT\" || /ENOENT/.test(String(err))) {\n        return {\n          audit: \"a11y\",\n          site: label,\n          status: \"skip\",\n          summary: \"npx/playwright not available\",\n        };\n      }\n      throw err;\n    }\n\n    const artifact = await readJsonMaybe<NormalizedA11y>(resultsPath);\n\n    if (!artifact) {\n      return {\n        audit: \"a11y\",\n        site: label,\n        status: \"fail\",\n        summary: `a11y: no results written (exit ${raw.code})${\n          raw.stderr ? ` — ${raw.stderr.slice(0, 200)}` : \"\"\n        }`,\n      };\n    }\n\n    const hasSerious =\n      (artifact.byImpact.serious ?? 0) > 0 || (artifact.byImpact.critical ?? 0) > 0;\n    const hasAny = artifact.totalViolations > 0;\n\n    const status: AuditResult[\"status\"] = hasSerious ? \"fail\" : hasAny ? \"warn\" : \"pass\";\n    const summary =\n      status === \"pass\"\n        ? `a11y: 0 violations across ${a11yRoutes.length} routes (+${smokeRoutes.length} hydration smoke)`\n        : `a11y: ${artifact.totalViolations} violations`;\n\n    return {\n      audit: \"a11y\",\n      site: label,\n      status,\n      summary,\n      details: artifact,\n    };\n  } finally {\n    await rm(specDir, { recursive: true, force: true });\n  }\n}\n","import { defineConfig, devices, type PlaywrightTestConfig } from \"@playwright/test\";\n\nexport type A11yRoute = { path: string; name: string };\n\nexport const a11yRoutes: A11yRoute[] = [\n  { path: \"/dev/a11y-fixtures\", name: \"a11y fixtures\" },\n  { path: \"/dev/animate-in\", name: \"animate-in demo\" },\n];\n\n// Routes smoke-loaded for client-side (hydration) errors only — NOT axe-scanned.\n// Catches the class of bug where build + SSR succeed but client hydration throws\n// and blanks the page (data-dynamiq 2026-06-09: a Svelte 4->5 `run()` referenced\n// a `$state` declared after it → TDZ ReferenceError on hydrate). `/` is the one\n// route every site has; real routes carry a11y debt we don't gate on here, so we\n// assert only that they don't crash on hydrate.\nexport const smokeRoutes: A11yRoute[] = [{ path: \"/\", name: \"home\" }];\n\nexport const playwrightA11yConfig: PlaywrightTestConfig = defineConfig({\n  testDir: \"tests\",\n  testMatch: /.*\\.spec\\.ts$/,\n  fullyParallel: true,\n  forbidOnly: !!process.env.CI,\n  retries: process.env.CI ? 2 : 0,\n  reporter: process.env.CI ? \"github\" : \"list\",\n  use: {\n    baseURL: \"http://localhost:5173\",\n    trace: \"on-first-retry\",\n  },\n  projects: [\n    {\n      name: \"chromium\",\n      use: { ...devices[\"Desktop Chrome\"] },\n    },\n  ],\n  webServer: {\n    // Portable across pnpm and npm sites — pnpm respects `npm run` too.\n    command: \"npm run vite:dev\",\n    url: \"http://localhost:5173/dev/a11y-fixtures\",\n    reuseExistingServer: !process.env.CI,\n    timeout: 120_000,\n  },\n});\n\nexport default playwrightA11yConfig;\n","import type { AuditName, AuditResult, Site } from \"../types.js\";\nimport type { AuditContext } from \"./util/inject.js\";\nimport { defaultSpawn } from \"./util/spawn.js\";\nimport type { SpawnFn } from \"./util/spawn.js\";\nimport { depsAudit } from \"./deps.js\";\nimport { lintAudit } from \"./lint.js\";\nimport { securityAudit } from \"./security.js\";\nimport { lighthouseAudit } from \"./lighthouse.js\";\nimport { a11yAudit } from \"./a11y.js\";\n\nconst REGISTRY: Record<AuditName, (ctx: AuditContext) => Promise<AuditResult>> = {\n  deps: depsAudit,\n  lint: lintAudit,\n  security: securityAudit,\n  lighthouse: lighthouseAudit,\n  a11y: a11yAudit,\n};\n\nexport const ALL_AUDIT_NAMES = Object.keys(REGISTRY) as AuditName[];\n\n/** Default per-audit spawn timeout when running via runAudits (30 s). */\nconst DEFAULT_AUDIT_TIMEOUT_MS = 30_000;\n\nfunction timedSpawn(timeoutMs: number): SpawnFn {\n  return (cmd, args, opts = {}) =>\n    defaultSpawn(cmd, args, { ...opts, timeoutMs: opts.timeoutMs ?? timeoutMs });\n}\n\n/** Single-audit runner with the same error-to-result conversion that\n *  `runAudits` applies. Exposed so the CLI can wrap each audit in its\n *  own progress task (listr2) and surface per-audit completion timing,\n *  while keeping audit implementations UI-free. */\nexport async function runOneAudit(site: Site, name: AuditName): Promise<AuditResult> {\n  if (!(name in REGISTRY)) throw new Error(`unknown audit: ${name}`);\n  const spawn = timedSpawn(DEFAULT_AUDIT_TIMEOUT_MS);\n  // `||` not `??`: an empty-string slug (Airtable Name with no slug-able chars)\n  // must fall back to the path, not render a blank `AuditResult.site` that would\n  // then collapse fleet write-back grouping under the \"\" key.\n  const label = site.name || site.path;\n  try {\n    return await REGISTRY[name]({ site, spawn });\n  } catch (err) {\n    return {\n      audit: name,\n      site: label,\n      status: \"fail\",\n      summary: `${name}: unexpected error — ${String(err)}`,\n    };\n  }\n}\n\nexport async function runAudits(site: Site, which?: AuditName[]): Promise<AuditResult[]> {\n  const names = which ?? ALL_AUDIT_NAMES;\n  for (const n of names) {\n    if (!(n in REGISTRY)) throw new Error(`unknown audit: ${n}`);\n  }\n  return Promise.all(names.map((n) => runOneAudit(site, n)));\n}\n\nexport async function runAuditsAcross(sites: Site[], which?: AuditName[]): Promise<AuditResult[]> {\n  const all = await Promise.all(sites.map((s) => runAudits(s, which)));\n  return all.flat();\n}\n\nexport { depsAudit, lintAudit, securityAudit, lighthouseAudit, a11yAudit };\n","import { pathToFileURL } from \"node:url\";\nimport { resolve, extname } from \"node:path\";\nimport type { InventoryProvider, Site } from \"../../types.js\";\nimport { localPath } from \"../../inventory/local.js\";\nimport { fromJsonFile } from \"../../inventory/json.js\";\n\nexport type ResolveSitesInput = {\n  site?: string;\n  fleet?: string;\n  /** Optional workdir for the `--fleet airtable` keyword path (computes site.path as {workdir}/{slug}). */\n  workdir?: string;\n  cwd: string;\n};\n\nexport async function resolveSites(input: ResolveSitesInput): Promise<Site[]> {\n  if (input.site && input.fleet) {\n    throw Object.assign(new Error(\"cannot combine a positional [site] with --fleet\"), {\n      exitCode: 2,\n    });\n  }\n\n  if (input.fleet === \"airtable\") {\n    const { openBase, readAirtableConfig } = await import(\"../../reports/airtable/client.js\");\n    const { fromAirtableBase } = await import(\"../../inventory/airtable.js\");\n    const base = openBase(readAirtableConfig());\n    const provider = fromAirtableBase(base, input.workdir ? { workdir: input.workdir } : {});\n    return provider();\n  }\n\n  if (input.fleet) {\n    const fleetPath = resolve(input.cwd, input.fleet);\n    const ext = extname(fleetPath).toLowerCase();\n    let provider: InventoryProvider;\n    if (ext === \".json\") {\n      provider = fromJsonFile(fleetPath);\n    } else if (ext === \".js\" || ext === \".mjs\" || ext === \".cjs\") {\n      const mod = (await import(pathToFileURL(fleetPath).href)) as {\n        default?: InventoryProvider;\n      };\n      if (!mod.default || typeof mod.default !== \"function\") {\n        throw Object.assign(new Error(`--fleet ${input.fleet}: default export is not a function`), {\n          exitCode: 2,\n        });\n      }\n      provider = mod.default;\n    } else {\n      throw Object.assign(\n        new Error(`--fleet ${input.fleet}: unsupported extension ${ext || \"(none)\"}`),\n        { exitCode: 2 },\n      );\n    }\n    return provider();\n  }\n\n  return localPath(resolve(input.cwd, input.site ?? input.cwd))();\n}\n","import { basename } from \"node:path\";\nimport type { InventoryProvider, Site } from \"../types.js\";\n\nexport type LocalPathOptions = {\n  name?: string;\n};\n\nexport function localPath(path: string, opts: LocalPathOptions = {}): InventoryProvider {\n  // `||` not `??`: an explicit empty `--name \"\"` should fall back to the path's\n  // basename, not become a blank site name.\n  const site: Site = { path, name: opts.name || basename(path) };\n  return async () => [site];\n}\n","import { readFile } from \"node:fs/promises\";\nimport { isAbsolute } from \"node:path\";\nimport type { InventoryProvider, Site } from \"../types.js\";\nimport { isHttpUrl } from \"../util/url.js\";\n\nfunction validate(raw: unknown): Site[] {\n  if (!Array.isArray(raw)) {\n    throw new Error(\"inventory JSON must be an array of sites\");\n  }\n  return raw.map((entry, i) => {\n    if (!entry || typeof entry !== \"object\") {\n      throw new Error(`inventory entry ${i} is not an object`);\n    }\n    const e = entry as Record<string, unknown>;\n    if (typeof e.path !== \"string\" || e.path.length === 0) {\n      throw new Error(`inventory entry ${i} is missing required field: path`);\n    }\n    if (!isAbsolute(e.path)) {\n      throw new Error(\n        `inventory entry ${i}: path must be absolute (got \"${e.path}\"). ` +\n          `Relative paths are rejected so cwd at invocation can't change which site is targeted.`,\n      );\n    }\n    const site: Site = { path: e.path };\n    if (typeof e.name === \"string\") site.name = e.name;\n    if (typeof e.repoUrl === \"string\") site.repoUrl = e.repoUrl;\n    // Carry gitRepo/deployedUrl like the Airtable provider does, so a JSON\n    // inventory can drive checkout (clone-from-gitRepo) and deployed-URL audits.\n    if (typeof e.gitRepo === \"string\") site.gitRepo = e.gitRepo;\n    // Scheme-allowlist deployedUrl before it can reach Chrome/lhci (same SSRF /\n    // local-file gate as the Airtable provider). A non-http(s) value is dropped\n    // with a warning rather than trusted into the deployed audit.\n    if (typeof e.deployedUrl === \"string\") {\n      if (isHttpUrl(e.deployedUrl)) {\n        site.deployedUrl = e.deployedUrl;\n      } else {\n        console.warn(\n          `[inventory] entry ${i}: ignoring deployedUrl that is not http(s): ${JSON.stringify(e.deployedUrl)}`,\n        );\n      }\n    }\n    if (typeof e.meta === \"object\" && e.meta !== null) {\n      site.meta = e.meta as Record<string, unknown>;\n    }\n    return site;\n  });\n}\n\nexport function fromJsonFile(path: string): InventoryProvider {\n  return async () => {\n    const text = await readFile(path, \"utf-8\");\n    let raw: unknown;\n    try {\n      raw = JSON.parse(text);\n    } catch (e) {\n      // A bare JSON.parse SyntaxError (\"Unexpected token … at position N\") names\n      // neither the file nor that it's the inventory — useless to an operator\n      // running a fleet command. Rethrow with the path for an actionable message,\n      // preserving the original SyntaxError as `cause`.\n      throw new Error(`could not parse inventory file ${path}: ${(e as Error).message}`, {\n        cause: e,\n      });\n    }\n    return validate(raw);\n  };\n}\n","import { stat, readdir, mkdir } from \"node:fs/promises\";\nimport { isAbsolute, join } from \"node:path\";\nimport type { Site } from \"../../types.js\";\nimport { defaultSpawn, type SpawnFn } from \"../../audits/util/spawn.js\";\nimport { sameOwnerRepo } from \"../../util/git.js\";\n\nexport type CloneIfNeededOptions = {\n  workdir: string;\n  spawn?: SpawnFn;\n};\n\nfunction deriveNameFromRepoUrl(repoUrl: string): string {\n  const slash = repoUrl.split(\"/\").pop() ?? repoUrl;\n  return slash.replace(/\\.git$/, \"\");\n}\n\n/** Reject names that would let an inventory entry write outside `workdir`. */\nfunction assertSafeName(name: string): void {\n  if (name.length === 0) {\n    // `join(workdir, \"\")` collapses to the workdir root — the clone would land\n    // there (and two empty-named sites would collide). An empty name is never a\n    // legitimate checkout dir.\n    throw new Error(\"unsafe site name (empty)\");\n  }\n  if (isAbsolute(name)) {\n    throw new Error(`unsafe site name (absolute path not allowed): ${name}`);\n  }\n  if (name.includes(\"/\") || name.includes(\"\\\\\")) {\n    throw new Error(`unsafe site name (path separator not allowed): ${name}`);\n  }\n  if (name.split(/[\\\\/]/).some((seg) => seg === \"..\")) {\n    throw new Error(`unsafe site name (traversal segment not allowed): ${name}`);\n  }\n}\n\n/**\n * Reject repo URLs that don't look like a normal clone target. Without this,\n * a `repoUrl` starting with `-` would be interpreted by git as a flag\n * (CVE-2017-1000117 family) — e.g. `--upload-pack=…` allows arbitrary command\n * execution. Inventory files are usually trusted, but `.mjs`/`.js` inventories\n * could pull from environments or external sources, so harden the boundary.\n *\n * Accepts: `https://`, `http://`, `ssh://`, `git://`, `file://`, and\n * `[user@]host:path` shorthand (e.g. `git@github.com:org/repo.git`).\n */\nfunction assertSafeRepoUrl(repoUrl: string): void {\n  if (\n    !/^(https?|ssh|git|file):\\/\\//.test(repoUrl) &&\n    !/^[A-Za-z0-9._-]+@[A-Za-z0-9._-]+:/.test(repoUrl)\n  ) {\n    throw new Error(\n      `unsafe repoUrl: must start with a scheme (https://, ssh://, git://, file://) ` +\n        `or use scp-style \"user@host:path\" (got: ${JSON.stringify(repoUrl)})`,\n    );\n  }\n}\n\nasync function isNonEmptyDir(path: string): Promise<boolean> {\n  try {\n    const s = await stat(path);\n    if (!s.isDirectory()) return false;\n    const entries = await readdir(path);\n    return entries.length > 0;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * The repo identity (`owner/repo` or a clone URL) the site is *expected* to be.\n * `gitRepo` (Airtable's `owner/repo`) is canonical; fall back to `repoUrl`.\n * `undefined` when the inventory carries neither — there's nothing to verify\n * against, so a reused checkout can't be checked (we keep current behavior).\n */\nfunction expectedRepoRef(site: Site): string | undefined {\n  return site.gitRepo ?? site.repoUrl ?? undefined;\n}\n\n/**\n * Verify an existing checkout at `path` is the SAME repo as the site expects.\n * The `siteSlug` that derives the path is lossy (distinct site names can\n * collapse to one slug → one path), so without this a fleet run could read,\n * audit, or commit against the WRONG repo's working tree.\n *\n * Reads `git -C <path> remote get-url origin` (via the injected spawn so tests\n * can fake it) and compares `owner/repo` on both sides, normalizing scheme,\n * host, `.git`, and case. Throws on a mismatch — never silently proceeds.\n * No-ops when the site carries no expected identity, or the dir isn't a git\n * checkout (no origin) — those are handled by the normal clone path.\n */\nasync function assertCheckoutMatches(site: Site, path: string, spawn: SpawnFn): Promise<void> {\n  const expected = expectedRepoRef(site);\n  if (!expected) return; // nothing to verify against\n\n  const r = await spawn(\"git\", [\"-C\", path, \"remote\", \"get-url\", \"origin\"], {\n    timeoutMs: 30_000,\n  });\n  // Not a git checkout / no origin remote → can't verify; let the clone path\n  // (or the caller) deal with a non-repo directory rather than guessing.\n  if (r.code !== 0) return;\n  const origin = r.stdout.trim();\n  if (origin.length === 0) return;\n\n  if (!sameOwnerRepo(origin, expected)) {\n    throw new Error(\n      `checkout at ${path} is the wrong repo: origin is ${JSON.stringify(origin)} ` +\n        `but site expects ${JSON.stringify(expected)} (slug collision?) — refusing to reuse it`,\n    );\n  }\n}\n\n/** GitHub repo identity `owner/repo`: exactly two `[\\w.-]` segments. Constrained\n *  so it can't smuggle a scheme, host, extra path segment, traversal, or an argv\n *  flag into the derived clone URL below. */\nconst GIT_REPO_RE = /^[\\w.-]+\\/[\\w.-]+$/;\n\n/**\n * Resolve the URL to clone from. An explicit `repoUrl` wins; otherwise derive\n * one from `gitRepo` (`owner/repo` → `https://github.com/owner/repo.git`). The\n * Airtable inventory deliberately sets `gitRepo` and NOT `repoUrl` (a clone\n * source must never be the production `url`), so without this derivation every\n * checkout-based fleet recipe throws on the first site with an empty workdir.\n *\n * Returns `undefined` when neither is set; throws on a malformed `gitRepo`.\n */\nfunction resolveCloneUrl(site: Site): string | undefined {\n  if (site.repoUrl) return site.repoUrl;\n  if (!site.gitRepo) return undefined;\n  if (!GIT_REPO_RE.test(site.gitRepo)) {\n    throw new Error(`unsafe gitRepo: expected \"owner/repo\" (got: ${JSON.stringify(site.gitRepo)})`);\n  }\n  return `https://github.com/${site.gitRepo}.git`;\n}\n\nexport async function cloneIfNeeded(site: Site, opts: CloneIfNeededOptions): Promise<Site> {\n  const spawn = opts.spawn ?? defaultSpawn;\n\n  if (await isNonEmptyDir(site.path)) {\n    // Reusing an existing checkout: confirm it's actually this site's repo\n    // before any audit/recipe operates on it (slug collisions can point two\n    // sites at the same path). Throws on mismatch.\n    await assertCheckoutMatches(site, site.path, spawn);\n    return site;\n  }\n\n  const repoUrl = resolveCloneUrl(site);\n  if (!repoUrl) {\n    throw new Error(\n      `site path does not exist (${site.path}) and no repoUrl or gitRepo is set — cannot clone`,\n    );\n  }\n\n  const name = site.name || deriveNameFromRepoUrl(repoUrl); // `||`: empty name derives from the repo\n  assertSafeName(name);\n  assertSafeRepoUrl(repoUrl);\n  const target = join(opts.workdir, name);\n  await mkdir(opts.workdir, { recursive: true });\n\n  if (await isNonEmptyDir(target)) {\n    // Same guard for the workdir/<name> reuse path.\n    await assertCheckoutMatches(site, target, spawn);\n    return { ...site, name, path: target };\n  }\n\n  // `--` separator so git won't treat repoUrl as a flag if validation slips.\n  const result = await spawn(\"git\", [\"clone\", \"--\", repoUrl, target], {\n    cwd: opts.workdir,\n    timeoutMs: 5 * 60_000,\n  });\n  if (result.code !== 0) {\n    throw new Error(`git clone failed (code ${result.code}): ${result.stderr}`);\n  }\n  return { ...site, name, path: target };\n}\n","import { execFile } from \"node:child_process\";\nimport { promisify } from \"node:util\";\n\nconst exec = promisify(execFile);\n\nasync function git(cwd: string, args: string[]): Promise<{ stdout: string; stderr: string }> {\n  return exec(\"git\", args, { cwd, env: process.env });\n}\n\nexport function branchName(recipe: string, when: Date = new Date()): string {\n  // ISO with millisecond precision: 2026-05-20T10:30:00.123Z → 20260520T103000123Z.\n  // Millis (vs. second-precision) shrinks the collision window for parallel runs.\n  const compact = when.toISOString().replace(/[-:.]/g, \"\");\n  return `maint/${recipe}-${compact}`;\n}\n\nexport async function currentBranch(cwd: string): Promise<string> {\n  const { stdout } = await git(cwd, [\"rev-parse\", \"--abbrev-ref\", \"HEAD\"]);\n  return stdout.trim();\n}\n\nexport async function isWorkingTreeClean(cwd: string): Promise<boolean> {\n  const { stdout } = await git(cwd, [\"status\", \"--porcelain\"]);\n  return stdout.trim().length === 0;\n}\n\nexport async function createBranch(cwd: string, name: string): Promise<void> {\n  await git(cwd, [\"checkout\", \"-b\", name]);\n}\n\n/** Check out an existing branch. Throws (via git) if the branch is missing or\n *  the checkout is blocked (e.g. uncommitted changes that would be overwritten). */\nexport async function checkoutBranch(cwd: string, name: string): Promise<void> {\n  await git(cwd, [\"checkout\", name]);\n}\n\n/**\n * Force-check-out an existing branch, DISCARDING any uncommitted changes on the\n * current branch. Used by the recipe failure path to return the operator to\n * their original branch even when a recipe left the work-in-progress branch\n * dirty. Only ever called with the operator's ORIGINAL branch as `name`. Does\n * not run `git clean`, so untracked operator files are left untouched.\n */\nexport async function forceCheckoutBranch(cwd: string, name: string): Promise<void> {\n  await git(cwd, [\"checkout\", \"-f\", name]);\n}\n\n/**\n * Delete a local branch with `-D` (force). Used by the recipe failure path to\n * remove the branch the recipe itself created so a re-run starts clean. Callers\n * MUST only ever pass the recipe-created branch here, never the operator's\n * original branch.\n */\nexport async function deleteBranch(cwd: string, name: string): Promise<void> {\n  await git(cwd, [\"branch\", \"-D\", name]);\n}\n\nexport async function stageAll(cwd: string): Promise<void> {\n  await git(cwd, [\"add\", \"-A\"]);\n}\n\nexport async function listTrackedFiles(cwd: string): Promise<string[]> {\n  const { stdout } = await git(cwd, [\"ls-files\"]);\n  return stdout\n    .split(\"\\n\")\n    .map((l) => l.trim())\n    .filter((l) => l.length > 0);\n}\n\nexport async function removeFromIndex(cwd: string, paths: string[]): Promise<void> {\n  if (paths.length === 0) return;\n  await git(cwd, [\"rm\", \"-r\", \"--cached\", \"--\", ...paths]);\n}\n\n/**\n * Stages all current changes and commits with `message`. Returns the commit SHA,\n * or `null` if there was nothing to commit.\n */\nexport async function commit(cwd: string, message: string): Promise<string | null> {\n  await stageAll(cwd);\n  const { stdout: status } = await git(cwd, [\"status\", \"--porcelain\"]);\n  if (status.trim().length === 0) return null;\n  await git(cwd, [\"commit\", \"-m\", message]);\n  const { stdout: sha } = await git(cwd, [\"rev-parse\", \"HEAD\"]);\n  return sha.trim();\n}\n\n/**\n * Strict GitHub repo identity: exactly two `[A-Za-z0-9._-]` segments separated\n * by a single slash. Rejects a scheme, host, extra path segment, traversal\n * (`..`), whitespace, or an argv flag — anything that could retarget a `gh`\n * write at an unintended (attacker/typo-controlled) repo.\n */\nexport const OWNER_REPO_RE = /^[A-Za-z0-9._-]+\\/[A-Za-z0-9._-]+$/;\n\n/** True when `repo` is a clean `owner/repo` (see {@link OWNER_REPO_RE}). The\n *  explicit `..` reject covers traversal segments the char-class would otherwise\n *  admit (`.` is a legal repo char, so `../evil` matches the shape regex). */\nexport function isOwnerRepo(repo: string): boolean {\n  if (repo.includes(\"..\")) return false;\n  return OWNER_REPO_RE.test(repo);\n}\n\n/**\n * True when two repo references name the same `owner/repo`. Each side may be a\n * full remote URL (https or scp-style), or already an `owner/repo`. Used to\n * verify an existing checkout's `origin` matches the site's expected repo\n * before reusing it. Returns false if either side is unparseable.\n */\nexport function sameOwnerRepo(a: string, b: string): boolean {\n  const na = isOwnerRepo(a.trim()) ? a.trim() : parseOwnerRepo(a);\n  const nb = isOwnerRepo(b.trim()) ? b.trim() : parseOwnerRepo(b);\n  if (na === null || nb === null) return false;\n  return na.toLowerCase() === nb.toLowerCase();\n}\n\n/** Derive `owner/repo` from a git remote URL (https or scp-style). Null if unparseable. */\nexport function parseOwnerRepo(remoteUrl: string): string | null {\n  const trimmed = remoteUrl\n    .trim()\n    .replace(/\\.git$/, \"\")\n    .replace(/\\/$/, \"\");\n  // scp-style: git@github.com:owner/repo\n  const scp = trimmed.match(/^[A-Za-z0-9._-]+@[A-Za-z0-9._-]+:(.+)$/);\n  const path = scp ? scp[1]! : trimmed.replace(/^https?:\\/\\/[^/]+\\//, \"\");\n  const segments = path.split(\"/\").filter(Boolean);\n  if (segments.length < 2) return null;\n  return `${segments[segments.length - 2]}/${segments[segments.length - 1]}`;\n}\n\n/** `origin` remote URL for a checkout, trimmed. Throws (via git) if there's no origin. */\nexport async function getRemoteUrl(cwd: string): Promise<string> {\n  const { stdout } = await git(cwd, [\"remote\", \"get-url\", \"origin\"]);\n  return stdout.trim();\n}\n\n/** Push a branch to origin, setting upstream. Throws on non-zero (execFile rejects). */\nexport async function push(cwd: string, branch: string): Promise<void> {\n  await git(cwd, [\"push\", \"-u\", \"origin\", branch]);\n}\n","import type { Site } from \"../../types.js\";\nimport { cloneIfNeeded } from \"./clone-if-needed.js\";\n\n/** A fleet site that couldn't be prepared for a command, with the reason. */\nexport type SkippedSite = { site: string; reason: string };\nexport type FleetPrepResult = { prepared: Site[]; skipped: SkippedSite[] };\n\ntype CloneFn = (site: Site, opts: { workdir: string }) => Promise<Site>;\n\n/**\n * Prepare every fleet site for a command, tolerating per-site failures.\n *\n * A site is cloned into `workdir` unless `needsCheckout` says otherwise (the\n * default is \"always clone\" — recipe commands operate on a local checkout; the\n * audit command overrides this so a deployed-URL site skips the clone). The\n * critical property is ISOLATION: a per-site prep failure (no clone source,\n * clone error, the wrong-repo guard) is CAUGHT and recorded in `skipped` rather\n * than thrown. A single malformed inventory row can therefore never abort the\n * whole fleet run — a bare `Promise.all(map(cloneIfNeeded))` used to (one site\n * with no repo threw and rejected prep for EVERY site, so nothing ran). Each\n * site is prepared independently (parallel) so one slow/failed clone can't\n * serialize or sink the rest.\n *\n * The skipped-site label prefers `site.name` but uses a truthiness check (not\n * `??`) so an empty-string name (an Airtable row whose slug came out empty)\n * still falls back to the path instead of rendering blank.\n */\nexport async function prepareFleetSites(\n  sites: Site[],\n  opts: { workdir: string; needsCheckout?: (site: Site) => boolean; clone?: CloneFn },\n): Promise<FleetPrepResult> {\n  const clone = opts.clone ?? cloneIfNeeded;\n  const needsCheckout = opts.needsCheckout ?? (() => true);\n  const settled = await Promise.all(\n    sites.map(async (site): Promise<{ ok: true; site: Site } | ({ ok: false } & SkippedSite)> => {\n      if (!needsCheckout(site)) return { ok: true, site };\n      try {\n        return { ok: true, site: await clone(site, { workdir: opts.workdir }) };\n      } catch (e) {\n        return { ok: false, site: site.name || site.path, reason: (e as Error).message };\n      }\n    }),\n  );\n  const prepared: Site[] = [];\n  const skipped: SkippedSite[] = [];\n  for (const r of settled) {\n    if (r.ok) prepared.push(r.site);\n    else skipped.push({ site: r.site, reason: r.reason });\n  }\n  return { prepared, skipped };\n}\n\n/** One-line operator notice for sites dropped during fleet prep; null when none\n *  were skipped. The leading \"⚠ … site(s) skipped (could not prepare)\" token is\n *  what the nightly fleet-lighthouse workflow greps to raise a `::warning::`, so\n *  a tolerated skip stays visible in the Actions UI rather than buried. */\nexport function formatSkippedNotice(skipped: SkippedSite[]): string | null {\n  if (skipped.length === 0) return null;\n  const detail = skipped.map((s) => `${s.site} (${s.reason})`).join(\"; \");\n  return `⚠ ${skipped.length} site(s) skipped (could not prepare): ${detail}`;\n}\n\n/** Append the skip notice to a command's output on a blank line, or return the\n *  output unchanged when nothing was skipped. Keeps every fleet command's\n *  return paths uniform. */\nexport function appendSkipNotice(output: string, skipped: SkippedSite[]): string {\n  const notice = formatSkippedNotice(skipped);\n  return notice ? `${output}\\n\\n${notice}` : output;\n}\n","import { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\n\n/** The default clone target for `--fleet` mode. Normally `~/.reddoor-maint/sites`.\n *\n *  When `HOME` is unset or empty (cron, minimal CI containers) the old\n *  `${HOME}/.reddoor-maint/sites` expression collapsed to `/.reddoor-maint/sites`\n *  — a filesystem-root path the process almost never has permission to write,\n *  and a dangerous one if it did. Fall back to a tmpdir-based path instead so a\n *  HOME-less environment clones somewhere writable rather than at `/`.\n *\n *  An explicit `--workdir` always wins; callers pass `opts.workdir ?? fleetWorkdir()`. */\nexport function fleetWorkdir(): string {\n  const home = process.env.HOME?.trim();\n  const base = home ? home : tmpdir();\n  return join(base, \".reddoor-maint\", \"sites\");\n}\n"],"mappings":";;;;;;;;;;;AAUO,SAAS,UAAU,GAAoB;AAC5C,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,CAAC;AAAA,EACpB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAO,OAAO,aAAa,WAAW,OAAO,aAAa;AAC5D;AAlBA;AAAA;AAAA;AAAA;AAAA;;;ACAA,SAAS,oBAAoB;AAC7B,SAAS,eAAe;AACxB,SAAS,QAAAA,aAAY;AAId,SAAS,yBAAiC;AAC/C,QAAM,OAAO,QAAQ,IAAI,mBAAmBA,MAAK,QAAQ,GAAG,SAAS;AACrE,SAAOA,MAAK,MAAM,iBAAiB,iBAAiB;AACtD;AATA;AAAA;AAAA;AAAA;AAAA;;;ACAA;AAAA;AAAA;AAAA;AAAA;AAAA,OAAO,cAAc;AAQrB,SAAS,QAAQ,MAAqB;AACpC,SAAO,OAAO;AAAA,IACZ,IAAI;AAAA,MACF,GAAG,IAAI,kDAAkD,uBAAuB,CAAC,OAAO,IAAI;AAAA,IAC9F;AAAA,IACA,EAAE,UAAU,EAAE;AAAA,EAChB;AACF;AAEO,SAAS,qBAAqC;AACnD,QAAM,SAAS,QAAQ,IAAI;AAC3B,QAAM,SAAS,QAAQ,IAAI;AAC3B,MAAI,CAAC,OAAQ,OAAM,QAAQ,cAAc;AACzC,MAAI,CAAC,OAAQ,OAAM,QAAQ,kBAAkB;AAC7C,SAAO,EAAE,QAAQ,OAAO;AAC1B;AAIO,SAAS,SAAS,KAAqB;AAC5C,SAAO,IAAI,SAAS,EAAE,QAAQ,IAAI,OAAO,CAAC,EAAE,KAAK,IAAI,MAAM;AAC7D;AA7BA;AAAA;AAAA;AACA;AAAA;AAAA;;;ACDA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA8EO,SAAS,SAAS,MAAsB;AAC7C,SAAO,KACJ,YAAY,EACZ,QAAQ,eAAe,GAAG,EAC1B,QAAQ,UAAU,EAAE;AACzB;AAIA,SAAS,WAAW,KAA6B;AAC/C,MAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,QAAM,UAAU,IAAI,KAAK;AACzB,SAAO,QAAQ,SAAS,IAAI,UAAU;AACxC;AAaO,SAAS,mBAAmB,MAA2B;AAC5D,SAAO,KAAK,WAAW,QAAQ,gBAAgB,IAAI,KAAK,MAAM;AAChE;AAQO,SAAS,OAAO,KAAkE;AACvF,QAAM,IAAI,IAAI;AACd,QAAM,cACH,EAAE,cAAc,KAA4E,CAAC;AAChG,QAAM,SAAS,YAAY,CAAC,KAAK;AACjC,SAAO;AAAA,IACL,IAAI,IAAI;AAAA,IACR,MAAM,OAAO,EAAE,MAAM,KAAK,EAAE;AAAA,IAC5B,KAAK,OAAO,EAAE,KAAK,KAAK,EAAE;AAAA,IAC1B,QAAS,EAAE,QAAQ,KAA4B;AAAA,IAC/C,gBAAiB,EAAE,kBAAkB,KAA4B;AAAA,IACjE,iBAAmB,EAAE,kBAAkB,KAA4B;AAAA,IACnE,aAAe,EAAE,cAAc,KAA4B;AAAA,IAC3D,gBAAiB,EAAE,iBAAiB,KAA4B;AAAA,IAChE,YAAa,EAAE,aAAa,KAA4B;AAAA,IACxD,eAAgB,EAAE,iBAAiB,KAA4B;AAAA,IAC/D,aAAc,EAAE,cAAc,KAA4B;AAAA,IAC1D,uBAAwB,EAAE,yBAAyB,KAA4B;AAAA,IAC/E,SAAU,EAAE,UAAU,KAA4B;AAAA,IAClD,oBAAqB,EAAE,wBAAwB,KAA4B;AAAA,IAC3E,oBAAqB,EAAE,wBAAwB,KAA4B;AAAA,IAC3E,aAAa;AAAA,IACb,QAAS,EAAE,QAAQ,KAA4B;AAAA,IAC/C,QAAS,EAAE,QAAQ,KAA4B;AAAA,IAC/C,SAAU,EAAE,SAAS,KAA4B;AAAA,IACjD,UAAW,EAAE,UAAU,KAA4B;AAAA,IACnD,uBAAwB,EAAE,0BAA0B,KAA4B;AAAA,IAChF,gBAAiB,EAAE,iBAAiB,KAA4B;AAAA,IAChE,aAAc,EAAE,cAAc,KAA4B;AAAA,IAC1D,iBAAkB,EAAE,mBAAmB,KAA4B;AAAA,IACnE,cAAe,EAAE,eAAe,KAA4B;AAAA,IAC5D,uBAAwB,EAAE,yBAAyB,KAA4B;AAAA,IAC/E,mBAAoB,EAAE,qBAAqB,KAA4B;AAAA,IACvE,uBAAwB,EAAE,yBAAyB,KAA4B;AAAA,IAC/E,kBAAmB,EAAE,oBAAoB,KAA4B;AAAA,IACrE,WAAW,WAAW,EAAE,mBAAc,CAAC;AAAA,IACvC,aAAa,WAAW,EAAE,qBAAgB,CAAC;AAAA,IAC3C,YAAY,WAAW,EAAE,oBAAe,CAAC;AAAA,IACzC,YAAa,EAAE,aAAa,KAA4B;AAAA,IACxD,mBAAmB,WAAW,EAAE,oBAAoB,CAAC;AAAA,IACrD,oBAAqB,EAAE,sBAAsB,KAA4B;AAAA,IACzE,iBAAkB,EAAE,mBAAmB,KAA4B;AAAA,IACnE,cAAe,EAAE,gBAAgB,KAA4B;AAAA,IAC7D,iBAAkB,EAAE,mBAAmB,KAA4B;AAAA,EACrE;AACF;AAEA,eAAsB,aAAa,MAA2C;AAC5E,QAAM,MAAoB,CAAC;AAC3B,QAAM,KAAK,cAAc,EACtB,OAAO,EAAE,UAAU,IAAI,CAAC,EACxB,SAAS,CAAC,SAAS,kBAAkB;AACpC,eAAW,OAAO,QAAS,KAAI,KAAK,OAAO,EAAE,IAAI,IAAI,IAAI,QAAQ,IAAI,OAAO,CAAC,CAAC;AAC9E,kBAAc;AAAA,EAChB,CAAC;AACH,SAAO;AACT;AAEA,eAAsB,iBACpB,MACA,MAC4B;AAI5B,MAAI,CAAC,6BAA6B,KAAK,IAAI,EAAG,QAAO;AAOrD,QAAM,UAAU,2EAA2E,KAAK;AAAA,IAC9F;AAAA,EACF,CAAC;AACD,QAAM,OAAqB,CAAC;AAC5B,QAAM,KAAK,cAAc,EACtB,OAAO,EAAE,iBAAiB,SAAS,YAAY,EAAE,CAAC,EAClD,SAAS,CAAC,SAAS,kBAAkB;AACpC,eAAW,OAAO,QAAS,MAAK,KAAK,OAAO,EAAE,IAAI,IAAI,IAAI,QAAQ,IAAI,OAAO,CAAC,CAAC;AAC/E,kBAAc;AAAA,EAChB,CAAC;AAGH,SAAO,KAAK,KAAK,CAAC,MAAM,SAAS,EAAE,IAAI,MAAM,IAAI,KAAK;AACxD;AAYA,SAAS,YAAY,QAAoC;AACvD,SAAO;AAAA,IACL,QAAQ,OAAO;AAAA,IACf,QAAQ,OAAO;AAAA,IACf,SAAS,OAAO;AAAA,IAChB,UAAU,OAAO;AAAA,IACjB,6BAA4B,oBAAI,KAAK,GAAE,YAAY;AAAA,EACrD;AACF;AAEA,SAAS,WAAW,QAA8B;AAChD,SAAO,EAAE,mBAAmB,OAAO,WAAW;AAChD;AAEA,SAAS,WAAW,QAA8B;AAChD,QAAM,SAAmB;AAAA,IACvB,gBAAgB,OAAO;AAAA,IACvB,qBAAqB,OAAO;AAAA,EAC9B;AAGA,MAAI,OAAO,aAAa,MAAM;AAC5B,WAAO,eAAe,IAAI,OAAO;AAAA,EACnC;AACA,SAAO;AACT;AAEA,SAAS,eAAe,QAAkC;AACxD,SAAO;AAAA,IACL,2BAA2B,OAAO;AAAA,IAClC,uBAAuB,OAAO;AAAA,IAC9B,2BAA2B,OAAO;AAAA,IAClC,sBAAsB,OAAO;AAAA,EAC/B;AACF;AAOA,eAAsB,aACpB,MACA,UACA,QACe;AACf,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,QAAQ,YAAY,MAAM,EAAE,CAAC,CAAC;AACnF;AAGA,eAAsB,iBACpB,MACA,UACA,QACe;AACf,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,QAAQ,WAAW,MAAM,EAAE,CAAC,CAAC;AAClF;AAGA,eAAsB,iBACpB,MACA,UACA,QACe;AACf,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,QAAQ,WAAW,MAAM,EAAE,CAAC,CAAC;AAClF;AAGA,eAAsB,qBACpB,MACA,UACA,QACe;AACf,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,QAAQ,eAAe,MAAM,EAAE,CAAC,CAAC;AACtF;AAWA,eAAsB,kBACpB,MACA,UACA,QAMmB;AACnB,QAAM,SAAmB,CAAC;AAC1B,MAAI,OAAO,OAAQ,QAAO,OAAO,QAAQ,YAAY,OAAO,MAAM,CAAC;AACnE,MAAI,OAAO,KAAM,QAAO,OAAO,QAAQ,WAAW,OAAO,IAAI,CAAC;AAC9D,MAAI,OAAO,KAAM,QAAO,OAAO,QAAQ,WAAW,OAAO,IAAI,CAAC;AAC9D,MAAI,OAAO,SAAU,QAAO,OAAO,QAAQ,eAAe,OAAO,QAAQ,CAAC;AAC1E,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,OAAO,CAAC,CAAC;AAC5D,SAAO;AACT;AAKA,eAAsB,oBACpB,MACA,UACA,SAMe;AACf,QAAM,SAAmB;AAAA,IACvB,wBAAwB,QAAQ;AAAA,IAChC,qBAAqB,QAAQ;AAAA,IAC7B,qBAAqB,QAAQ;AAAA,EAC/B;AACA,MAAI,QAAQ,iBAAiB,MAAM;AACjC,WAAO,gBAAgB,IAAI,QAAQ;AAAA,EACrC;AACA,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,OAAO,CAAC,CAAC;AAC9D;AAIA,eAAsB,eACpB,MACA,UACA,IACe;AACf,QAAM,SAAmB,EAAE,QAAQ,eAAe,eAAe,GAAG;AACpE,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,OAAO,CAAC,CAAC;AAC9D;AA5VA,IAIa,gBA+FA;AAnGb;AAAA;AAAA;AAIO,IAAM,iBAAiB;AA+FvB,IAAM,kBAAuC,oBAAI,IAAY;AAAA,MAClE;AAAA,MACA;AAAA,IACF,CAAC;AAAA;AAAA;;;ACtGD;AAAA;AAAA;AAAA;AAuBO,SAAS,iBACd,MACA,OAAiC,CAAC,GACf;AACnB,SAAO,YAA6B;AAClC,UAAM,UAAU,KAAK,WAAW,QAAQ,IAAI;AAC5C,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,WAAW,MAAM,aAAa,IAAI;AACxC,WAAO,SACJ,OAAO,CAAC,MAAM,EAAE,WAAW,QAAQ,gBAAgB,IAAI,EAAE,MAAM,KAAK,EAAE,IAAI,SAAS,CAAC,EACpF,QAAQ,CAAC,MAAM;AACd,YAAM,OAAO,SAAS,EAAE,IAAI;AAK5B,UAAI,KAAK,WAAW,GAAG;AACrB,gBAAQ;AAAA,UACN,yBAAyB,EAAE,IAAI,UAAU,EAAE,EAAE;AAAA,QAC/C;AACA,eAAO,CAAC;AAAA,MACV;AACA,YAAM,OAAa;AAAA,QACjB,MAAM,GAAG,OAAO,IAAI,IAAI;AAAA,QACxB,MAAM;AAAA,QACN,MAAM,EAAE,eAAe,EAAE,IAAI,aAAa,EAAE,KAAK;AAAA,MACnD;AAKA,UAAI,UAAU,EAAE,GAAG,GAAG;AACpB,aAAK,cAAc,EAAE;AAAA,MACvB,OAAO;AACL,gBAAQ;AAAA,UACN,4CAA4C,EAAE,IAAI,0BAA0B,KAAK,UAAU,EAAE,GAAG,CAAC;AAAA,QACnG;AAAA,MACF;AACA,UAAI,EAAE,QAAS,MAAK,UAAU,EAAE;AAChC,aAAO,CAAC,IAAI;AAAA,IACd,CAAC;AAAA,EACL;AACF;AArEA;AAAA;AAAA;AAEA;AACA;AAAA;AAAA;;;ACHA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,SAAS,YAAAC,iBAAgB;AACzB,SAAS,QAAAC,cAAY;AAqBd,SAAS,cAAc,QAA8B;AAC1D,MAAI,OAAO,UAAU,aAAc,QAAO;AAC1C,QAAM,UAAW,OAAO,WAAW,CAAC;AACpC,QAAM,UAAU,QAAQ,WAAW,CAAC;AACpC,SAAO,sBAAsB;AAAA,IAC3B,CAAC,MAAM,OAAO,QAAQ,CAAC,MAAM,YAAY,CAAC,OAAO,MAAM,QAAQ,CAAC,CAAC;AAAA,EACnE;AACF;AAOO,SAAS,2BAA2B,QAAuC;AAChF,MAAI,OAAO,UAAU,cAAc;AACjC,UAAM,IAAI,MAAM,6CAA6C,OAAO,KAAK,GAAG;AAAA,EAC9E;AACA,QAAM,UAAW,OAAO,WAAW,CAAC;AACpC,QAAM,UAAU,QAAQ,WAAW,CAAC;AACpC,QAAM,QAAQ,CAAC,MACb,OAAO,MAAM,YAAY,CAAC,OAAO,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,GAAG,IAAI;AACpE,SAAO;AAAA,IACL,aAAa,MAAM,QAAQ,aAAa,CAAC;AAAA,IACzC,eAAe,MAAM,QAAQ,eAAe,CAAC;AAAA,IAC7C,eAAe,MAAM,QAAQ,gBAAgB,CAAC;AAAA,IAC9C,KAAK,MAAM,QAAQ,KAAK,CAAC;AAAA,EAC3B;AACF;AAQA,eAAsB,mBAAmB,KAA8B;AACrE,MAAI;AACF,UAAM,UAAUA,OAAK,KAAK,cAAc;AACxC,UAAM,MAAM,MAAMD,UAAS,SAAS,OAAO;AAC3C,UAAM,MAAM,KAAK,MAAM,GAAG;AAC1B,QAAI,CAAC,IAAI,KAAM,OAAM,IAAI,MAAM,kCAAkC;AACjE,WAAO,SAAS,IAAI,IAAI;AAAA,EAC1B,SAAS,GAAG;AACV,UAAM,IAAI;AAAA,MACR,mCAAmC,GAAG,kBAAmB,EAAY,OAAO;AAAA,MAE5E,EAAE,OAAO,EAAE;AAAA,IACb;AAAA,EACF;AACF;AAxEA,IAMM;AANN;AAAA;AAAA;AAIA;AAEA,IAAM,wBAAwB,CAAC,eAAe,iBAAiB,kBAAkB,KAAK;AAAA;AAAA;;;ACK/E,SAAS,cAAc,QAA8B;AAC1D,MAAI,OAAO,UAAU,OAAQ,QAAO;AACpC,QAAM,UAAU,OAAO;AACvB,SAAO,OAAO,SAAS,oBAAoB;AAC7C;AAEO,SAAS,qBAAqB,QAA6C;AAChF,MAAI,OAAO,UAAU,QAAQ;AAC3B,UAAM,IAAI,MAAM,wCAAwC,OAAO,KAAK,GAAG;AAAA,EACzE;AACA,QAAM,UAAU,OAAO;AACvB,SAAO,EAAE,YAAY,SAAS,mBAAmB,EAAE;AACrD;AAvBA;AAAA;AAAA;AAAA;AAAA;;;ACKO,SAAS,cAAc,QAA8B;AAC1D,MAAI,OAAO,UAAU,OAAQ,QAAO;AACpC,QAAM,IAAI,OAAO;AACjB,SAAO,MAAM,QAAQ,GAAG,OAAO;AACjC;AAEO,SAAS,qBAAqB,QAInC;AACA,MAAI,OAAO,UAAU,QAAQ;AAC3B,UAAM,IAAI,MAAM,uCAAuC,OAAO,KAAK,GAAG;AAAA,EACxE;AACA,QAAM,UAAW,OAAO,WAAW,CAAC;AACpC,QAAM,UAAW,QAAQ,WAAW,CAAC;AAGrC,QAAM,UAAU,QAAQ,OAAO,CAAC,MAAM,EAAE,UAAU,MAAM,EAAE;AAC1D,QAAM,cAAc,QAAQ,OAAO,CAAC,MAAM,EAAE,UAAU,OAAO,EAAE;AAI/D,QAAM,WAAW,QAAQ,UAAU,YAAY;AAC/C,SAAO,EAAE,SAAS,aAAa,SAAS;AAC1C;AA9BA;AAAA;AAAA;AAAA;AAAA;;;ACQO,SAAS,kBAAkB,QAA8B;AAC9D,MAAI,OAAO,UAAU,WAAY,QAAO;AACxC,QAAM,UAAU,OAAO;AACvB,SAAO,CAAC,CAAC,WAAW,OAAO,QAAQ,WAAW;AAChD;AAEO,SAAS,yBAAyB,QAKvC;AACA,MAAI,OAAO,UAAU,YAAY;AAC/B,UAAM,IAAI,MAAM,2CAA2C,OAAO,KAAK,GAAG;AAAA,EAC5E;AACA,QAAM,UAAU,OAAO;AACvB,QAAM,IAAI,SAAS,UAAU,EAAE,KAAK,GAAG,UAAU,GAAG,MAAM,GAAG,UAAU,EAAE;AACzE,SAAO,EAAE,UAAU,EAAE,UAAU,MAAM,EAAE,MAAM,UAAU,EAAE,UAAU,KAAK,EAAE,IAAI;AAChF;AA1BA;AAAA;AAAA;AAAA;AAAA;;;ACAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAgCA,eAAsB,sBAAsB,MAKlB;AACxB,QAAM,EAAE,MAAM,UAAU,MAAM,QAAQ,IAAI;AAE1C,QAAM,WAAW,QAAQ,KAAK,CAAC,MAAM,EAAE,UAAU,YAAY;AAC7D,MAAI,CAAC,UAAU;AACb,UAAM,OAAO;AAAA,MACX,IAAI;AAAA,QACF;AAAA,MACF;AAAA,MACA,EAAE,UAAU,EAAE;AAAA,IAChB;AAAA,EACF;AACA,QAAM,SAAS,SAAS,KAAK,CAAC,MAAM,SAAS,EAAE,IAAI,MAAM,IAAI;AAC7D,MAAI,CAAC,QAAQ;AACX,UAAM,OAAO,OAAO,IAAI,MAAM,iCAAiC,IAAI,GAAG,GAAG,EAAE,UAAU,EAAE,CAAC;AAAA,EAC1F;AAEA,QAAM,SAAiC,CAAC;AACxC,QAAM,SAKF,CAAC;AAWL,QAAM,cAAc,cAAc,QAAQ;AAC1C,MAAI,aAAa;AACf,UAAM,SAAS,2BAA2B,QAAQ;AAClD,WAAO,SAAS;AAChB,WAAO,KAAK,EAAE,OAAO,cAAc,QAAQ,OAAO,CAAC;AAAA,EACrD;AAEA,QAAM,OAAO,QAAQ,KAAK,CAAC,MAAM,EAAE,UAAU,MAAM;AACnD,MAAI,QAAQ,cAAc,IAAI,GAAG;AAC/B,UAAM,SAAS,qBAAqB,IAAI;AACxC,WAAO,OAAO;AACd,WAAO,KAAK,EAAE,OAAO,QAAQ,OAAO,CAAC;AAAA,EACvC;AAEA,QAAM,OAAO,QAAQ,KAAK,CAAC,MAAM,EAAE,UAAU,MAAM;AACnD,MAAI,QAAQ,cAAc,IAAI,GAAG;AAC/B,UAAM,SAAS,qBAAqB,IAAI;AACxC,WAAO,OAAO;AACd,WAAO,KAAK,EAAE,OAAO,QAAQ,OAAO,CAAC;AAAA,EACvC;AAEA,QAAM,MAAM,QAAQ,KAAK,CAAC,MAAM,EAAE,UAAU,UAAU;AACtD,MAAI,OAAO,kBAAkB,GAAG,GAAG;AACjC,UAAM,SAAS,yBAAyB,GAAG;AAC3C,WAAO,WAAW;AAClB,WAAO,KAAK,EAAE,OAAO,YAAY,OAAO,CAAC;AAAA,EAC3C;AAKA,MAAI,OAAO,KAAK,MAAM,EAAE,SAAS,GAAG;AAClC,UAAM,kBAAkB,MAAM,OAAO,IAAI,MAAM;AAAA,EACjD;AAEA,MAAI,CAAC,aAAa;AAGhB,UAAM,YAAY,OAAO,IAAI,CAAC,MAAM,EAAE,KAAK;AAC3C,UAAM,OAAO;AAAA,MACX,IAAI;AAAA,QACF,wCACE,UAAU,SAAS,SAAS,UAAU,KAAK,GAAG,CAAC,4BAA4B,eAC7E,cAAc,SAAS,OAAO;AAAA,MAChC;AAAA,MACA,EAAE,UAAU,EAAE;AAAA,IAChB;AAAA,EACF;AAEA,SAAO,EAAE,UAAU,OAAO,MAAM,OAAO;AACzC;AAaO,SAAS,wBAAwB,QAAkC;AACxE,QAAM,QAAQ,OAAO,QAAQ;AAC7B,QAAM,SAAS,OAAO,OAAO;AAC7B,QAAM,QAAQ,QAAQ;AACtB,MAAI,MAAM,gBAAW,KAAK;AAC1B,MAAI,SAAS,GAAG;AACd,WAAO;AAAA,SAAO,MAAM,yBAAyB,OAAO,OACjD,IAAI,CAAC,MAAM,GAAG,EAAE,IAAI,KAAK,EAAE,KAAK,GAAG,EACnC,KAAK,IAAI,CAAC;AAAA,EACf;AACA,SAAO;AAAA,4BAA+B,KAAK,WAAW,MAAM,UAAU,KAAK;AAC3E,SAAO;AACT;AAMA,eAAsB,2BAA2B,MAInB;AAC5B,QAAM,EAAE,MAAM,UAAU,QAAQ,IAAI;AAEpC,QAAM,SAAS,oBAAI,IAA2B;AAC9C,aAAW,KAAK,SAAS;AACvB,UAAM,MAAM,OAAO,IAAI,EAAE,IAAI,KAAK,CAAC;AACnC,QAAI,KAAK,CAAC;AACV,WAAO,IAAI,EAAE,MAAM,GAAG;AAAA,EACxB;AAEA,QAAM,UAA0B,CAAC;AACjC,QAAM,SAAqC,CAAC;AAM5C,aAAW,CAAC,MAAM,WAAW,KAAK,QAAQ;AACxC,QAAI;AACF,cAAQ,KAAK,MAAM,sBAAsB,EAAE,MAAM,UAAU,MAAM,SAAS,YAAY,CAAC,CAAC;AAAA,IAC1F,SAAS,GAAG;AACV,aAAO,KAAK,EAAE,MAAM,OAAQ,EAAY,QAAQ,CAAC;AAAA,IACnD;AAAA,EACF;AACA,SAAO,EAAE,SAAS,OAAO;AAC3B;AArLA;AAAA;AAAA;AAEA;AAGA;AACA;AACA;AACA;AAAA;AAAA;;;ACRA,SAAS,WAAAE,gBAAe;AACxB,SAAS,aAAa;;;ACDtB,SAAS,aAAa;AACtB,SAAS,qBAAqB;AAiC9B,IAAM,oBAAoB;AAEnB,SAAS,UAAU,YAA4B,CAAC,GAAY;AACjE,QAAM,YAAY,UAAU,aAAa;AACzC,QAAM,WAAmB,UAAU,aAAa,CAAC,KAAK,QAAQ,QAAQ,KAAK,KAAK,GAAG;AACnF,QAAM,cAAc,UAAU,eAAe;AAC7C,QAAM,iBAAiB,UAAU,kBAAkB,KAAK,OAAO;AAE/D,SAAO,CAAC,KAAK,MAAM,OAAO,CAAC,MACzB,IAAI,QAAQ,CAACC,UAAS,WAAW;AAC/B,UAAM,YAAY,KAAK,cAAc;AACrC,UAAM,QAAQ,UAAU,KAAK,CAAC,GAAG,IAAI,GAAG;AAAA,MACtC,KAAK,KAAK;AAAA,MACV,KAAK,KAAK,OAAO,QAAQ;AAAA,MACzB,OAAO,YAAY,CAAC,UAAU,WAAW,SAAS,IAAI,CAAC,UAAU,QAAQ,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAW/E,UAAU,KAAK,cAAc;AAAA,IAC/B,CAAC;AAGD,UAAM,MAAM,CAAC,KAAa,UAA0B;AAClD,UAAI,IAAI,UAAU,eAAgB,QAAO;AACzC,YAAM,OAAO,MAAM;AACnB,aAAO,KAAK,SAAS,iBACjB,KAAK,MAAM,GAAG,cAAc,IAAI,oBAChC;AAAA,IACN;AAEA,QAAI,SAAS;AACb,QAAI,SAAS;AAMb,UAAM,aAAa,IAAI,cAAc,OAAO;AAC5C,UAAM,aAAa,IAAI,cAAc,OAAO;AAC5C,QAAI,CAAC,WAAW;AACd,YAAM,QAAQ;AAAA,QACZ;AAAA,QACA,CAAC,UAAmB,SAAS,IAAI,QAAQ,WAAW,MAAM,KAAK,CAAC;AAAA,MAClE;AACA,YAAM,QAAQ;AAAA,QACZ;AAAA,QACA,CAAC,UAAmB,SAAS,IAAI,QAAQ,WAAW,MAAM,KAAK,CAAC;AAAA,MAClE;AAAA,IACF;AAKA,UAAM,YAAY,CAAC,QAA8B;AAC/C,UAAI,MAAM,QAAQ,OAAW;AAC7B,UAAI;AACF,iBAAS,CAAC,MAAM,KAAK,GAAG;AAAA,MAC1B,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,QAAI;AACJ,UAAM,QAAQ,KAAK,YACf,WAAW,MAAM;AACf,gBAAU,SAAS;AAEnB,kBAAY,WAAW,MAAM,UAAU,SAAS,GAAG,WAAW;AAG9D,gBAAU,MAAM;AAChB,aAAO,IAAI,MAAM,uBAAuB,KAAK,SAAS,OAAO,GAAG,EAAE,CAAC;AAAA,IACrE,GAAG,KAAK,SAAS,IACjB;AAEJ,UAAM,cAAc,MAAY;AAC9B,UAAI,MAAO,cAAa,KAAK;AAC7B,UAAI,UAAW,cAAa,SAAS;AAAA,IACvC;AAEA,UAAM,GAAG,SAAS,CAAC,QAAQ;AACzB,kBAAY;AACZ,aAAO,GAAG;AAAA,IACZ,CAAC;AACD,UAAM,GAAG,SAAS,CAAC,SAAS;AAC1B,kBAAY;AACZ,UAAI,CAAC,WAAW;AAGd,iBAAS,IAAI,QAAQ,WAAW,IAAI,CAAC;AACrC,iBAAS,IAAI,QAAQ,WAAW,IAAI,CAAC;AAAA,MACvC;AACA,MAAAA,SAAQ,EAAE,MAAM,QAAQ,IAAI,QAAQ,OAAO,CAAC;AAAA,IAC9C,CAAC;AAAA,EACH,CAAC;AACL;AAEO,IAAM,eAAwB,UAAU;;;AC1I/C,SAAS,gBAAgB;AACzB,SAAS,QAAAC,aAAY;;;ACQd,SAAS,UAAU,MAAoB;AAC5C,SAAO,KAAK,QAAQ,KAAK;AAC3B;;;ACPO,IAAM,mBAA2C;AAAA;AAAA,EAEtD,QAAQ;AAAA,EACR,iBAAiB;AAAA,EACjB,6BAA6B;AAAA,EAC7B,0BAA0B;AAAA,EAC1B,gCAAgC;AAAA,EAChC,gBAAgB;AAAA;AAAA,EAGhB,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,YAAY;AAAA;AAAA,EAGZ,aAAa;AAAA,EACb,qBAAqB;AAAA;AAAA,EAGrB,qBAAqB;AAAA,EACrB,qBAAqB;AAAA,EACrB,mCAAmC;AAAA,EACnC,oBAAoB;AAAA;AAAA,EAGpB,oBAAoB;AAAA,EACpB,wBAAwB;AAAA,EACxB,aAAa;AAAA;AAAA,EAGb,QAAQ;AAAA,EACR,wBAAwB;AAAA,EACxB,0BAA0B;AAAA,EAC1B,UAAU;AAAA,EACV,0BAA0B;AAAA,EAC1B,qBAAqB;AAAA,EACrB,cAAc;AAAA,EACd,SAAS;AAAA;AAAA,EAGT,kBAAkB;AAAA,EAClB,wBAAwB;AAC1B;;;AC9CA,SAAS,YAAY;AACrB,SAAS,YAAY;AAQrB,eAAe,OAAO,MAAgC;AACpD,MAAI;AACF,UAAM,KAAK,IAAI;AACf,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,QAAQ,SAAyB;AACxC,QAAM,OAAO,QAAQ,QAAQ,UAAU,EAAE,EAAE,MAAM,GAAG,EAAE,CAAC,KAAK;AAC5D,QAAM,IAAI,OAAO,SAAS,MAAM,EAAE;AAClC,SAAO,OAAO,MAAM,CAAC,IAAI,IAAI;AAC/B;AAcA,eAAsB,aACpB,UACAC,QACgC;AAChC,MAAI,CAAE,MAAM,OAAO,KAAK,UAAU,gBAAgB,CAAC,EAAI,QAAO;AAM9D,MAAI;AAKF,QAAI,CAAE,MAAM,OAAO,KAAK,UAAU,cAAc,CAAC,GAAI;AACnD,YAAM,UAAU,MAAMA,OAAM,QAAQ,CAAC,WAAW,mBAAmB,GAAG;AAAA,QACpE,KAAK;AAAA,QACL,WAAW;AAAA,MACb,CAAC;AACD,UAAI,QAAQ,SAAS,EAAG,QAAO;AAAA,IACjC;AAIA,UAAM,MAAM,MAAMA,OAAM,QAAQ,CAAC,YAAY,QAAQ,GAAG;AAAA,MACtD,KAAK;AAAA,MACL,WAAW;AAAA,IACb,CAAC;AACD,UAAM,SAAS,KAAK,MAAM,IAAI,UAAU,IAAI;AAI5C,UAAM,UAAU,OAAO,OAAO,MAAM;AACpC,WAAO;AAAA,MACL,UAAU,QAAQ;AAAA,MAClB,OAAO,QAAQ,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,QAAQ,EAAE,MAAM,IAAI,QAAQ,EAAE,OAAO,CAAC,EACzF;AAAA,IACL;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;AHhDA,SAAS,WAAW,OAAuB;AACzC,SAAO,MAAM,QAAQ,UAAU,EAAE;AACnC;AAMA,SAAS,kBAAkB,MAAuB;AAChD,SAAO,YAAY,KAAK,KAAK,KAAK,CAAC;AACrC;AAEA,SAAS,YAAY,GAAqC;AACxD,QAAM,UAAU,WAAW,CAAC,EAAE,MAAM,GAAG,EAAE,CAAC,KAAK;AAC/C,QAAM,QAAQ,QAAQ,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,OAAO,SAAS,GAAG,EAAE,CAAC;AAClE,SAAO,CAAC,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;AACrD;AAEA,SAAS,cAAc,QAAgB,UAAyB;AAC9D,QAAM,CAAC,QAAQ,QAAQ,MAAM,IAAI,YAAY,MAAM;AACnD,QAAM,CAAC,QAAQ,QAAQ,MAAM,IAAI,YAAY,QAAQ;AACrD,MAAI,SAAS,OAAQ,QAAO;AAC5B,MAAI,SAAS,OAAQ,QAAO;AAC5B,MAAI,SAAS,OAAQ,QAAO;AAC5B,MAAI,SAAS,OAAQ,QAAO;AAC5B,MAAI,SAAS,OAAQ,QAAO;AAC5B,MAAI,SAAS,OAAQ,QAAO;AAC5B,SAAO;AACT;AAEA,eAAsB,UAAU,KAAyC;AACvE,QAAM,UAAUC,MAAK,IAAI,KAAK,MAAM,cAAc;AAClD,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,SAAS,SAAS,OAAO;AAAA,EAC1C,SAAS,KAAK;AACZ,WAAO;AAAA,MACL,OAAO;AAAA,MACP,MAAM,UAAU,IAAI,IAAI;AAAA,MACxB,QAAQ;AAAA,MACR,SAAS,sBAAsB,OAAO;AAAA,MACtC,SAAS,EAAE,OAAO,OAAO,GAAG,EAAE;AAAA,IAChC;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,UAAM,KAAK,MAAM,MAAM;AAAA,EAIzB,SAAS,KAAK;AACZ,WAAO;AAAA,MACL,OAAO;AAAA,MACP,MAAM,UAAU,IAAI,IAAI;AAAA,MACxB,QAAQ;AAAA,MACR,SAAS,mCAAoC,IAAc,OAAO;AAAA,MAClE,SAAS,EAAE,OAAO,OAAO,GAAG,EAAE;AAAA,IAChC;AAAA,EACF;AACA,QAAM,YAAoC;AAAA,IACxC,GAAI,IAAI,gBAAgB,CAAC;AAAA,IACzB,GAAI,IAAI,mBAAmB,CAAC;AAAA,EAC9B;AAEA,QAAM,UAA4B,CAAC;AACnC,aAAW,CAAC,MAAM,QAAQ,KAAK,OAAO,QAAQ,gBAAgB,GAAG;AAC/D,UAAM,SAAS,UAAU,IAAI;AAC7B,QAAI,CAAC,OAAQ;AAGb,QAAI,CAAC,kBAAkB,MAAM,EAAG;AAChC,YAAQ,KAAK;AAAA,MACX,KAAK;AAAA,MACL;AAAA,MACA;AAAA,MACA,OAAO,cAAc,QAAQ,QAAQ;AAAA,IACvC,CAAC;AAAA,EACH;AAEA,QAAM,WAAW,QAAQ,KAAK,CAAC,MAAM,EAAE,UAAU,OAAO;AACxD,QAAM,WAAW,QAAQ,KAAK,CAAC,MAAM,EAAE,UAAU,OAAO;AACxD,QAAM,WAAW,QAAQ,KAAK,CAAC,MAAM,EAAE,UAAU,OAAO;AAIxD,QAAM,SAAgC,WAAW,SAAS,YAAY,WAAW,SAAS;AAE1F,QAAM,eACJ,WAAW,SACP,OAAO,QAAQ,MAAM,wCACrB,WAAW,SACT,GAAG,QAAQ,OAAO,CAAC,MAAM,EAAE,UAAU,MAAM,EAAE,MAAM,OAAO,QAAQ,MAAM,0BACxE,GAAG,QAAQ,OAAO,CAAC,MAAM,EAAE,UAAU,OAAO,EAAE,MAAM;AAE5D,QAAM,WAAW,MAAM,aAAa,IAAI,KAAK,MAAM,IAAI,SAAS,YAAY;AAC5E,QAAM,UAAU,WACZ,GAAG,YAAY,KAAK,SAAS,QAAQ,yBAAyB,SAAS,KAAK,YAC5E;AAEJ,SAAO;AAAA,IACL,OAAO;AAAA,IACP,MAAM,UAAU,IAAI,IAAI;AAAA,IACxB;AAAA,IACA;AAAA,IACA,SAAS,EAAE,SAAS,SAAS;AAAA,EAC/B;AACF;;;AIzIA,SAAS,kBAAkB;AAC3B,SAAS,YAAAC,iBAAgB;AACzB,SAAS,QAAAC,aAAY;AACrB,SAAS,cAAc;AACvB,SAAS,SAAS,eAAe,iBAAiB,6BAA6B;AAC/E,SAAS,YAAY;AAKrB,IAAM,eAAe,CAAC,qBAAqB;AAC3C,IAAM,SAAS,CAAC,mBAAmB,WAAW,kBAAkB,YAAY,aAAa;AAEzF,eAAe,UAAU,KAAgC;AACvD,SAAO,KAAK,cAAc,EAAE,KAAK,QAAQ,QAAQ,UAAU,MAAM,CAAC;AACpE;AAEA,eAAsB,UAAU,KAAyC;AACvE,QAAM,EAAE,KAAK,IAAI;AACjB,QAAM,aAAaC,MAAK,KAAK,MAAM,kBAAkB;AAErD,MAAI,CAAC,WAAW,UAAU,GAAG;AAC3B,WAAO;AAAA,MACL,OAAO;AAAA,MACP,MAAM,UAAU,IAAI;AAAA,MACpB,QAAQ;AAAA,MACR,SAAS;AAAA,IACX;AAAA,EACF;AAEA,QAAM,SAAS,IAAI,OAAO;AAAA,IACxB,KAAK,KAAK;AAAA,IACV,oBAAoB;AAAA,IACpB,yBAAyB;AAAA,EAC3B,CAAC;AAED,QAAM,WAAW,MAAM,UAAU,KAAK,IAAI;AAI1C,QAAM,gBAAgB,MAAM,OAAO,UAAU,QAAQ;AACrD,QAAM,eAAe,cAAc,OAAO,CAAC,GAAG,MAAM,IAAI,EAAE,YAAY,CAAC;AACvE,QAAM,iBAAiB,cAAc,OAAO,CAAC,GAAG,MAAM,IAAI,EAAE,cAAc,CAAC;AAE3E,QAAM,sBAAgC,CAAC;AACvC,aAAW,OAAO,UAAU;AAC1B,UAAM,gBAAgBA,MAAK,KAAK,MAAM,GAAG;AACzC,UAAM,SAAS,MAAMC,UAAS,eAAe,OAAO;AACpD,UAAM,UAAW,MAAM,sBAAsB,aAAa,KAAM,CAAC;AACjE,UAAM,KAAK,MAAM,cAAc,QAAQ,EAAE,GAAG,SAAS,UAAU,cAAc,CAAC;AAC9E,QAAI,CAAC,GAAI,qBAAoB,KAAK,GAAG;AAAA,EACvC;AAEA,QAAM,SACJ,eAAe,KAAK,oBAAoB,SAAS,IAC7C,SACA,iBAAiB,IACf,SACA;AAER,QAAM,UACJ,WAAW,SACP,qBAAqB,SAAS,MAAM,WACpC,GAAG,YAAY,mBAAmB,cAAc,cAAc,oBAAoB,MAAM;AAE9F,SAAO;AAAA,IACL,OAAO;AAAA,IACP,MAAM,UAAU,IAAI;AAAA,IACpB;AAAA,IACA;AAAA,IACA,SAAS;AAAA,MACP;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,SAAS;AAAA,IAClB;AAAA,EACF;AACF;;;AC9BA,SAAS,SAAS,GAAW;AAC3B,MAAI,EAAE,WAAW,KAAK,EAAE,OAAO,EAAG,QAAO;AACzC,MAAI,EAAE,WAAW,KAAK,EAAE,MAAM,EAAG,QAAO;AACxC,SAAO;AACT;AAEA,SAAS,kBAAkB,GAAsB;AAC/C,MAAI,MAAM,SAAS,MAAM,cAAc,MAAM,UAAU,MAAM,WAAY,QAAO;AAGhF,SAAO;AACT;AAEA,SAAS,0BAA0B,QAAwC;AACzE,QAAM,MAAuB,CAAC;AAC9B,aAAW,KAAK,OAAO,OAAO,OAAO,cAAc,CAAC,CAAC,GAAG;AACtD,QAAI,CAAC,EAAG;AACR,QAAI,KAAK;AAAA,MACP,QAAQ,EAAE,eAAe;AAAA,MACzB,UAAU,kBAAkB,EAAE,QAAQ;AAAA,MACtC,OAAO,EAAE,SAAS;AAAA,MAClB,GAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;AAAA,MACjC,GAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC;AAAA,IAChC,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAKA,SAAS,uBACP,WACA,iBACiE;AACjE,QAAM,OAAO,oBAAI,IAAY;AAC7B,MAAI,UAAU;AACd,SAAO,CAAC,KAAK,IAAI,OAAO,GAAG;AACzB,SAAK,IAAI,OAAO;AAChB,UAAM,QAAQ,gBAAgB,OAAO;AACrC,QAAI,CAAC,SAAS,CAAC,MAAM,QAAQ,MAAM,GAAG,EAAG,QAAO,EAAE,UAAU,QAAQ;AAEpE,UAAM,WAAW,MAAM,IAAI;AAAA,MACzB,CAAC,MAA6C,OAAO,MAAM,YAAY,MAAM;AAAA,IAC/E;AACA,QAAI,SAAU,QAAO,EAAE,UAAU,SAAS,QAAQ,SAAS;AAE3D,UAAM,OAAO,MAAM,IAAI,KAAK,CAAC,MAAmB,OAAO,MAAM,QAAQ;AACrE,QAAI,CAAC,QAAQ,SAAS,QAAS,QAAO,EAAE,UAAU,QAAQ;AAC1D,cAAU;AAAA,EACZ;AACA,SAAO,EAAE,UAAU,QAAQ;AAC7B;AAEA,SAAS,yBAAyB,QAAuC;AACvE,QAAM,kBAAkB,OAAO,mBAAmB,CAAC;AACnD,QAAM,QAAQ,oBAAI,IAA2B;AAE7C,aAAW,CAAC,MAAM,CAAC,KAAK,OAAO,QAAQ,eAAe,GAAG;AACvD,QAAI,CAAC,EAAG;AACR,UAAM,EAAE,UAAU,OAAO,IAAI,uBAAuB,MAAM,eAAe;AACzE,QAAI,MAAM,IAAI,QAAQ,EAAG;AAEzB,UAAM,YAAY,gBAAgB,QAAQ;AAC1C,UAAM,WAAW,kBAAkB,WAAW,YAAY,EAAE,QAAQ;AACpE,UAAM,QAAQ,QAAQ,SAAS;AAC/B,UAAM,MAAM,QAAQ;AAEpB,UAAM,IAAI,UAAU;AAAA,MAClB,QAAQ,WAAW,QAAQ;AAAA,MAC3B;AAAA,MACA;AAAA,MACA,GAAI,MAAM,EAAE,IAAI,IAAI,CAAC;AAAA,IACvB,CAAC;AAAA,EACH;AAEA,SAAO,CAAC,GAAG,MAAM,OAAO,CAAC;AAC3B;AAOA,eAAe,aACbC,QACA,KACA,MACA,KACqB;AACrB,MAAI;AACJ,MAAI;AACF,UAAM,MAAMA,OAAM,KAAK,MAAM,EAAE,IAAI,CAAC;AAAA,EACtC,SAAS,KAAK;AACZ,UAAM,IAAI;AACV,QAAI,EAAE,SAAS,YAAY,SAAS,KAAK,OAAO,GAAG,CAAC,EAAG,QAAO,EAAE,MAAM,UAAU;AAChF,WAAO,EAAE,MAAM,SAAS,QAAQ,iBAAiB,OAAO,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC,GAAG;AAAA,EAC/E;AAGA,MAAI,IAAI,SAAS,KAAK,IAAI,SAAS,GAAG;AACpC,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ,QAAQ,IAAI,IAAI,GAAG,IAAI,SAAS,KAAK,IAAI,OAAO,MAAM,GAAG,GAAG,CAAC,KAAK,EAAE;AAAA,IAC9E;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,IAAI,UAAU,IAAI;AAAA,EACxC,SAAS,KAAK;AACZ,WAAO,EAAE,MAAM,SAAS,QAAQ,qBAAqB,OAAO,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC,GAAG;AAAA,EACnF;AAIA,QAAM,cAAe,OAAoD;AACzE,MAAI,eAAe,OAAO,gBAAgB,UAAU;AAClD,WAAO,EAAE,MAAM,SAAS,QAAQ,YAAY,QAAQ,0BAA0B;AAAA,EAChF;AAMA,QAAM,YAAY,OAAO,UAAU;AACnC,MAAI,CAAC,aAAa,OAAO,KAAK,SAAS,EAAE,WAAW,GAAG;AACrD,WAAO,EAAE,MAAM,SAAS,QAAQ,wCAAwC;AAAA,EAC1E;AAEA,SAAO,EAAE,MAAM,MAAM,OAAO;AAC9B;AAEA,eAAsB,cAAc,KAAyC;AAC3E,QAAMA,SAAQ,IAAI,SAAS;AAC3B,QAAM,OAAO,IAAI;AACjB,QAAM,QAAQ,UAAU,IAAI;AAE5B,MAAI,OAAmC;AACvC,MAAI,SAAS,MAAM,aAAaA,QAAO,QAAQ,CAAC,SAAS,UAAU,QAAQ,GAAG,KAAK,IAAI;AAMvF,MAAI,OAAO,SAAS,MAAM;AACxB,UAAM,aAAa,OAAO,SAAS,YAAY,kBAAkB,OAAO;AACxE,UAAM,YAAY,MAAM;AAAA,MACtBA;AAAA,MACA;AAAA,MACA,CAAC,SAAS,UAAU,YAAY;AAAA,MAChC,KAAK;AAAA,IACP;AACA,QAAI,UAAU,SAAS,MAAM;AAC3B,eAAS;AACT,aAAO;AAAA,IACT,OAAO;AACL,YAAM,YAAY,UAAU,SAAS,YAAY,kBAAkB,UAAU;AAC7E,aAAO;AAAA,QACL,OAAO;AAAA,QACP,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,SAAS,iCAA4B,UAAU,UAAU,SAAS;AAAA,MACpE;AAAA,IACF;AAAA,EACF;AAEA,QAAM,SAAS,OAAO;AAEtB,QAAM,SAAiB;AAAA,IACrB,KAAK,OAAO,UAAU,iBAAiB,OAAO;AAAA,IAC9C,UAAU,OAAO,UAAU,iBAAiB,YAAY;AAAA,IACxD,MAAM,OAAO,UAAU,iBAAiB,QAAQ;AAAA,IAChD,UAAU,OAAO,UAAU,iBAAiB,YAAY;AAAA,EAC1D;AAEA,QAAM,aACJ,SAAS,eAAe,0BAA0B,MAAM,IAAI,yBAAyB,MAAM;AAE7F,QAAM,SAAS,SAAS,MAAM;AAC9B,QAAM,QAAQ,OAAO,MAAM,OAAO,WAAW,OAAO,OAAO,OAAO;AAClE,QAAM,UACJ,WAAW,SACP,GAAG,IAAI,wBACP,GAAG,IAAI,KAAK,KAAK,qBAAqB,OAAO,QAAQ,KAAK,OAAO,IAAI,KAAK,OAAO,QAAQ,KAAK,OAAO,GAAG;AAE9G,SAAO;AAAA,IACL,OAAO;AAAA,IACP,MAAM;AAAA,IACN;AAAA,IACA;AAAA,IACA,SAAS,EAAE,QAAQ,WAAW;AAAA,EAChC;AACF;;;AChPA,SAAS,YAAAC,WAAU,WAAW,SAAS,IAAI,eAAe;AAC1D,SAAS,cAAc;AACvB,SAAS,QAAAC,aAAY;;;ACFd,IAAM,mBAAmB;AAAA,EAC9B,IAAI;AAAA,IACF,SAAS;AAAA,MACP,KAAK,CAAC,yCAAyC;AAAA;AAAA;AAAA;AAAA,MAI/C,oBAAoB;AAAA,MACpB,yBAAyB;AAAA,MACzB,yBAAyB;AAAA,MACzB,cAAc;AAAA,MACd,UAAU;AAAA,QACR,QAAQ;AAAA,QACR,YAAY,CAAC,YAAY;AAAA,MAC3B;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,YAAY;AAAA,QACV,4BAA4B,CAAC,SAAS,EAAE,UAAU,KAAK,CAAC;AAAA,QACxD,6BAA6B,CAAC,SAAS,EAAE,UAAU,IAAI,CAAC;AAAA,QACxD,kBAAkB,CAAC,SAAS,EAAE,UAAU,IAAI,CAAC;AAAA,QAC7C,0BAA0B,CAAC,QAAQ,EAAE,UAAU,IAAI,CAAC;AAAA,MACtD;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,QAAQ;AAAA,IACV;AAAA,EACF;AACF;;;AC5BA,SAAS,YAAAC,iBAAgB;AACzB,SAAS,QAAAC,aAAY;AAarB,eAAsB,eAAe,UAAuC;AAC1E,MAAI;AACJ,MAAI;AACF,UAAM,MAAMD,UAASC,MAAK,UAAU,cAAc,GAAG,OAAO;AAAA,EAC9D,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACA,MAAI;AACJ,MAAI;AACF,UAAM,KAAK,MAAM,GAAG;AAAA,EACtB,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACA,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO,CAAC;AAC7C,QAAM,MAAO,IAA8B;AAC3C,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO,CAAC;AAE7C,QAAM,MAAkB,CAAC;AACzB,QAAM,MAAO,IAAoC;AACjD,MAAI,OAAO,QAAQ,YAAY,IAAI,SAAS,GAAG;AAC7C,QAAI,gBAAgB;AAAA,EACtB;AACA,SAAO;AACT;;;ACrCA,SAAS,oBAAoB;AAuB7B,eAAsB,eAAgC;AACpD,SAAO,IAAI,QAAQ,CAACC,UAAS,WAAW;AACtC,UAAM,SAAS,aAAa;AAC5B,WAAO,MAAM;AACb,WAAO,GAAG,SAAS,MAAM;AACzB,WAAO,OAAO,GAAG,aAAa,MAAM;AAClC,YAAM,OAAO,OAAO,QAAQ;AAC5B,UAAI,OAAO,SAAS,YAAY,MAAM;AACpC,cAAM,OAAO,KAAK;AAClB,eAAO,MAAM,MAAMA,SAAQ,IAAI,CAAC;AAAA,MAClC,OAAO;AACL,eAAO,MAAM;AACb,eAAO,IAAI,MAAM,6DAA6D,CAAC;AAAA,MACjF;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AACH;AAOO,SAAS,aAAa,KAAa,MAAsB;AAC9D,QAAM,IAAI,IAAI,IAAI,GAAG;AACrB,IAAE,WAAW;AACb,IAAE,OAAO,OAAO,IAAI;AACpB,SAAO,EAAE,SAAS;AACpB;;;AHfA,eAAe,cAAiB,MAAiC;AAC/D,MAAI;AACF,UAAM,MAAM,MAAMC,UAAS,MAAM,OAAO;AACxC,WAAO,KAAK,MAAM,GAAG;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAeA,eAAe,eAAe,YAA8C;AAC1E,QAAM,QAAQ,MAAM,QAAQ,UAAU,EAAE,MAAM,MAAM,CAAC,CAAa;AAClE,QAAM,UAA2B,CAAC;AAClC,aAAW,KAAK,OAAO;AACrB,QAAI,CAAC,EAAE,WAAW,MAAM,KAAK,CAAC,EAAE,SAAS,OAAO,EAAG;AACnD,UAAM,MAAM,MAAM,cAAuBC,MAAK,YAAY,CAAC,CAAC;AAC5D,QAAI,CAAC,OAAO,CAAC,IAAI,WAAY;AAC7B,UAAM,UAAkC,CAAC;AACzC,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,IAAI,UAAU,GAAG;AACnD,UAAI,OAAO,GAAG,UAAU,SAAU,SAAQ,CAAC,IAAI,EAAE;AAAA,IACnD;AACA,YAAQ,KAAK,EAAE,KAAK,IAAI,cAAc,QAAQ,CAAC;AAAA,EACjD;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,SAAkD;AAC1E,MAAI,QAAQ,WAAW,EAAG,QAAO,CAAC;AAClC,QAAM,OAA+B,CAAC;AACtC,QAAM,SAAiC,CAAC;AACxC,aAAW,KAAK,SAAS;AACvB,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,EAAE,WAAW,CAAC,CAAC,GAAG;AACpD,UAAI,OAAO,MAAM,SAAU;AAC3B,WAAK,CAAC,KAAK,KAAK,CAAC,KAAK,KAAK;AAC3B,aAAO,CAAC,KAAK,OAAO,CAAC,KAAK,KAAK;AAAA,IACjC;AAAA,EACF;AACA,QAAM,MAA8B,CAAC;AACrC,aAAW,KAAK,OAAO,KAAK,IAAI,GAAG;AACjC,UAAM,QAAQ,KAAK,CAAC,KAAK;AACzB,UAAM,QAAQ,OAAO,CAAC,KAAK;AAC3B,QAAI,CAAC,IAAI,QAAQ;AAAA,EACnB;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,GAA4B;AAEzD,QAAM,WAAW,EAAE,KAAK,QAAQ,GAAG;AACnC,SAAO,YAAY,IAAI,EAAE,KAAK,MAAM,WAAW,CAAC,IAAI,EAAE;AACxD;AAEA,SAAS,oBAAoB,GAA4B;AAIvD,QAAM,SAAS,OAAO,EAAE,WAAW,WAAW,EAAE,OAAO,QAAQ,CAAC,IAAI;AACpE,SAAO,GAAG,EAAE,IAAI,IAAI,EAAE,QAAQ,IAAI,EAAE,QAAQ,aAAa,MAAM;AACjE;AAIA,eAAe,iBACb,YACA,OACA,KACsB;AACtB,QAAM,WAAW,MAAM,eAAe,UAAU;AAEhD,MAAI,SAAS,WAAW,GAAG;AACzB,WAAO;AAAA,MACL,OAAO;AAAA,MACP,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,SAAS,2CAA2C,IAAI,IAAI,IAC1D,IAAI,SAAS,WAAM,IAAI,OAAO,MAAM,GAAG,GAAG,CAAC,KAAK,EAClD;AAAA,IACF;AAAA,EACF;AAEA,QAAM,mBACH,MAAM,cAAiCA,MAAK,YAAY,wBAAwB,CAAC,KAAM,CAAC;AAE3F,QAAM,SAAS,iBAAiB,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM;AACvD,QAAM,aAAa,OAAO,IAAI,CAAC,OAAO;AAAA,IACpC,UAAU,sBAAsB,CAAC;AAAA,IACjC,OAAO,EAAE;AAAA,IACT,SAAS,oBAAoB,CAAC;AAAA,EAChC,EAAE;AAEF,QAAM,WAAW,WAAW,KAAK,CAAC,MAAM,EAAE,UAAU,OAAO;AAC3D,QAAM,UAAU,WAAW,KAAK,CAAC,MAAM,EAAE,UAAU,MAAM;AACzD,QAAM,SAAgC,WAAW,SAAS,UAAU,SAAS;AAE7E,QAAM,aAAmC;AAAA,IACvC,SAAS,iBAAiB,QAAQ;AAAA,IAClC,kBAAkB,OAAO;AAAA,IACzB;AAAA,EACF;AAEA,QAAM,UACJ,WAAW,SACP,uCACA,eAAe,OAAO,MAAM;AAElC,SAAO,EAAE,OAAO,cAAc,MAAM,OAAO,QAAQ,SAAS,SAAS,WAAW;AAClF;AAIA,eAAe,mBAAmBC,QAAgB,MAAY,OAAqC;AACjG,QAAM,UAAU,MAAM,eAAe,KAAK,IAAI;AAI9C,QAAM,OAAO,MAAM,aAAa;AAChC,QAAM,UAAU,QAAQ,iBAAiB,iBAAiB,GAAG,QAAQ,IAAI,CAAC;AAC1E,QAAM,iBAAiB;AAAA,IACrB,GAAG;AAAA,IACH,IAAI;AAAA,MACF,GAAG,iBAAiB;AAAA,MACpB,SAAS;AAAA,QACP,GAAG,iBAAiB,GAAG;AAAA,QACvB,KAAK,CAAC,aAAa,SAAS,IAAI,CAAC;AAAA,QACjC,oBAAoB,8BAA8B,IAAI;AAAA,MACxD;AAAA,IACF;AAAA,EACF;AAEA,QAAM,YAAY,MAAM,QAAQD,MAAK,OAAO,GAAG,eAAe,CAAC;AAC/D,QAAM,aAAaA,MAAK,WAAW,mBAAmB;AACtD,QAAM,UAAU,YAAY,KAAK,UAAU,cAAc,GAAG,OAAO;AAEnE,QAAM,aAAaA,MAAK,KAAK,MAAM,eAAe;AAClD,QAAM,GAAG,YAAY,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAErD,MAAI;AACJ,MAAI;AACF,UAAM,MAAMC,OAAM,OAAO,CAAC,SAAS,aAAa,WAAW,YAAY,UAAU,EAAE,GAAG;AAAA,MACpF,KAAK,KAAK;AAAA,MACV,WAAW,IAAI;AAAA,IACjB,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,GAAG,WAAW,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AACpD,UAAM,IAAI;AACV,QAAI,EAAE,SAAS,YAAY,SAAS,KAAK,OAAO,GAAG,CAAC,GAAG;AACrD,aAAO;AAAA,QACL,OAAO;AAAA,QACP,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,SAAS;AAAA,MACX;AAAA,IACF;AACA,UAAM;AAAA,EACR;AACA,QAAM,GAAG,WAAW,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAEpD,SAAO,iBAAiB,YAAY,OAAO,GAAG;AAChD;AAKA,eAAe,mBACbA,QACA,aACA,OACsB;AACtB,QAAM,UAAU,MAAM,QAAQD,MAAK,OAAO,GAAG,sBAAsB,CAAC;AACpE,QAAM,iBAAiB;AAAA,IACrB,IAAI;AAAA;AAAA;AAAA,MAGF,SAAS;AAAA,QACP,KAAK,CAAC,WAAW;AAAA;AAAA;AAAA,QAGjB,cAAc;AAAA,QACd,UAAU,EAAE,QAAQ,WAAW,YAAY,CAAC,YAAY,EAAE;AAAA,MAC5D;AAAA,MACA,QAAQ,iBAAiB,GAAG;AAAA,MAC5B,QAAQ,EAAE,QAAQ,cAAc,WAAWA,MAAK,SAAS,aAAa,EAAE;AAAA,IAC1E;AAAA,EACF;AAEA,QAAM,aAAaA,MAAK,SAAS,mBAAmB;AACpD,QAAM,UAAU,YAAY,KAAK,UAAU,cAAc,GAAG,OAAO;AAEnE,QAAM,aAAaA,MAAK,SAAS,eAAe;AAEhD,MAAI;AACJ,MAAI;AACF,UAAM,MAAMC,OAAM,OAAO,CAAC,SAAS,aAAa,WAAW,YAAY,UAAU,EAAE,GAAG;AAAA,MACpF,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAML,WAAW,IAAI;AAAA,IACjB,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,GAAG,SAAS,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAClD,UAAM,IAAI;AACV,QAAI,EAAE,SAAS,YAAY,SAAS,KAAK,OAAO,GAAG,CAAC,GAAG;AACrD,aAAO;AAAA,QACL,OAAO;AAAA,QACP,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,SAAS;AAAA,MACX;AAAA,IACF;AACA,UAAM;AAAA,EACR;AAEA,MAAI;AACF,WAAO,MAAM,iBAAiB,YAAY,OAAO,GAAG;AAAA,EACtD,UAAE;AACA,UAAM,GAAG,SAAS,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EACpD;AACF;AAEA,eAAsB,gBAAgB,KAAyC;AAC7E,QAAMA,SAAQ,IAAI,SAAS;AAC3B,QAAM,OAAO,IAAI;AACjB,QAAM,QAAQ,UAAU,IAAI;AAE5B,SAAO,KAAK,cACR,mBAAmBA,QAAO,KAAK,aAAa,KAAK,IACjD,mBAAmBA,QAAO,MAAM,KAAK;AAC3C;;;AItRA,SAAS,YAAAC,WAAU,aAAAC,YAAW,WAAAC,UAAS,MAAAC,WAAU;AACjD,SAAS,QAAAC,aAAY;;;ACDrB,SAAS,cAAc,eAA0C;AAI1D,IAAM,aAA0B;AAAA,EACrC,EAAE,MAAM,sBAAsB,MAAM,gBAAgB;AAAA,EACpD,EAAE,MAAM,mBAAmB,MAAM,kBAAkB;AACrD;AAQO,IAAM,cAA2B,CAAC,EAAE,MAAM,KAAK,MAAM,OAAO,CAAC;AAE7D,IAAM,uBAA6C,aAAa;AAAA,EACrE,SAAS;AAAA,EACT,WAAW;AAAA,EACX,eAAe;AAAA,EACf,YAAY,CAAC,CAAC,QAAQ,IAAI;AAAA,EAC1B,SAAS,QAAQ,IAAI,KAAK,IAAI;AAAA,EAC9B,UAAU,QAAQ,IAAI,KAAK,WAAW;AAAA,EACtC,KAAK;AAAA,IACH,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA,EACA,UAAU;AAAA,IACR;AAAA,MACE,MAAM;AAAA,MACN,KAAK,EAAE,GAAG,QAAQ,gBAAgB,EAAE;AAAA,IACtC;AAAA,EACF;AAAA,EACA,WAAW;AAAA;AAAA,IAET,SAAS;AAAA,IACT,KAAK;AAAA,IACL,qBAAqB,CAAC,QAAQ,IAAI;AAAA,IAClC,SAAS;AAAA,EACX;AACF,CAAC;;;ADfD,IAAM,cAAc;AAEpB,eAAeC,eAAiB,MAAiC;AAC/D,MAAI;AACF,UAAM,MAAM,MAAMC,UAAS,MAAM,OAAO;AACxC,WAAO,KAAK,MAAM,GAAG;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAOA,SAAS,sBAAsB,MAAc,UAA0B;AACrE,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iCAUwB,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,2CAWM,IAAI;AAAA,6BAClB,IAAI;AAAA,WACtB,KAAK,UAAU,QAAQ,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAMnC;AAOA,SAAS,YAAoB;AAC3B,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA,gBAKO,KAAK,UAAU,UAAU,CAAC;AAAA,qBACrB,KAAK,UAAU,WAAW,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA8EhD;AAEA,eAAsB,UAAU,KAAyC;AACvE,QAAMC,SAAQ,IAAI,SAAS;AAC3B,QAAM,OAAO,IAAI;AACjB,QAAM,QAAQ,UAAU,IAAI;AAQ5B,QAAM,UAAU,MAAMC,SAAQC,MAAK,KAAK,MAAM,qBAAqB,CAAC;AAMpE,MAAI;AACF,UAAM,WAAWA,MAAK,SAAS,cAAc;AAC7C,UAAMC,WAAU,UAAU,UAAU,GAAG,OAAO;AAE9C,UAAM,OAAO,MAAM,aAAa;AAChC,UAAM,aAAaD,MAAK,SAAS,sBAAsB;AACvD,UAAMC,WAAU,YAAY,sBAAsB,MAAM,KAAK,IAAI,GAAG,OAAO;AAE3E,UAAM,cAAcD,MAAK,KAAK,MAAM,WAAW;AAE/C,UAAME,IAAGF,MAAK,KAAK,MAAM,eAAe,GAAG,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAE3E,QAAI;AACJ,QAAI;AACF,YAAM,MAAMF;AAAA,QACV;AAAA,QACA,CAAC,SAAS,cAAc,QAAQ,YAAY,UAAU,IAAI,mBAAmB,QAAQ;AAAA,QACrF;AAAA,UACE,KAAK,KAAK;AAAA,UACV,KAAK,EAAE,GAAG,QAAQ,KAAK,qBAAqB,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA,UAKxD,WAAW,IAAI;AAAA,QACjB;AAAA,MACF;AAAA,IACF,SAAS,KAAK;AACZ,YAAM,IAAI;AACV,UAAI,EAAE,SAAS,YAAY,SAAS,KAAK,OAAO,GAAG,CAAC,GAAG;AACrD,eAAO;AAAA,UACL,OAAO;AAAA,UACP,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,SAAS;AAAA,QACX;AAAA,MACF;AACA,YAAM;AAAA,IACR;AAEA,UAAM,WAAW,MAAMF,eAA8B,WAAW;AAEhE,QAAI,CAAC,UAAU;AACb,aAAO;AAAA,QACL,OAAO;AAAA,QACP,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,SAAS,kCAAkC,IAAI,IAAI,IACjD,IAAI,SAAS,WAAM,IAAI,OAAO,MAAM,GAAG,GAAG,CAAC,KAAK,EAClD;AAAA,MACF;AAAA,IACF;AAEA,UAAM,cACH,SAAS,SAAS,WAAW,KAAK,MAAM,SAAS,SAAS,YAAY,KAAK;AAC9E,UAAM,SAAS,SAAS,kBAAkB;AAE1C,UAAM,SAAgC,aAAa,SAAS,SAAS,SAAS;AAC9E,UAAM,UACJ,WAAW,SACP,6BAA6B,WAAW,MAAM,aAAa,YAAY,MAAM,sBAC7E,SAAS,SAAS,eAAe;AAEvC,WAAO;AAAA,MACL,OAAO;AAAA,MACP,MAAM;AAAA,MACN;AAAA,MACA;AAAA,MACA,SAAS;AAAA,IACX;AAAA,EACF,UAAE;AACA,UAAMM,IAAG,SAAS,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EACpD;AACF;;;AEtPA,IAAM,WAA2E;AAAA,EAC/E,MAAM;AAAA,EACN,MAAM;AAAA,EACN,UAAU;AAAA,EACV,YAAY;AAAA,EACZ,MAAM;AACR;AAEO,IAAM,kBAAkB,OAAO,KAAK,QAAQ;AAGnD,IAAM,2BAA2B;AAEjC,SAAS,WAAW,WAA4B;AAC9C,SAAO,CAAC,KAAK,MAAM,OAAO,CAAC,MACzB,aAAa,KAAK,MAAM,EAAE,GAAG,MAAM,WAAW,KAAK,aAAa,UAAU,CAAC;AAC/E;AAMA,eAAsB,YAAY,MAAY,MAAuC;AACnF,MAAI,EAAE,QAAQ,UAAW,OAAM,IAAI,MAAM,kBAAkB,IAAI,EAAE;AACjE,QAAMC,SAAQ,WAAW,wBAAwB;AAIjD,QAAM,QAAQ,KAAK,QAAQ,KAAK;AAChC,MAAI;AACF,WAAO,MAAM,SAAS,IAAI,EAAE,EAAE,MAAM,OAAAA,OAAM,CAAC;AAAA,EAC7C,SAAS,KAAK;AACZ,WAAO;AAAA,MACL,OAAO;AAAA,MACP,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,SAAS,GAAG,IAAI,6BAAwB,OAAO,GAAG,CAAC;AAAA,IACrD;AAAA,EACF;AACF;;;ACjDA,SAAS,qBAAqB;AAC9B,SAAS,SAAS,eAAe;;;ACDjC,SAAS,gBAAgB;AAOlB,SAAS,UAAU,MAAc,OAAyB,CAAC,GAAsB;AAGtF,QAAM,OAAa,EAAE,MAAM,MAAM,KAAK,QAAQ,SAAS,IAAI,EAAE;AAC7D,SAAO,YAAY,CAAC,IAAI;AAC1B;;;ACTA;AAHA,SAAS,YAAAC,iBAAgB;AACzB,SAAS,kBAAkB;AAI3B,SAAS,SAAS,KAAsB;AACtC,MAAI,CAAC,MAAM,QAAQ,GAAG,GAAG;AACvB,UAAM,IAAI,MAAM,0CAA0C;AAAA,EAC5D;AACA,SAAO,IAAI,IAAI,CAAC,OAAO,MAAM;AAC3B,QAAI,CAAC,SAAS,OAAO,UAAU,UAAU;AACvC,YAAM,IAAI,MAAM,mBAAmB,CAAC,mBAAmB;AAAA,IACzD;AACA,UAAM,IAAI;AACV,QAAI,OAAO,EAAE,SAAS,YAAY,EAAE,KAAK,WAAW,GAAG;AACrD,YAAM,IAAI,MAAM,mBAAmB,CAAC,kCAAkC;AAAA,IACxE;AACA,QAAI,CAAC,WAAW,EAAE,IAAI,GAAG;AACvB,YAAM,IAAI;AAAA,QACR,mBAAmB,CAAC,iCAAiC,EAAE,IAAI;AAAA,MAE7D;AAAA,IACF;AACA,UAAM,OAAa,EAAE,MAAM,EAAE,KAAK;AAClC,QAAI,OAAO,EAAE,SAAS,SAAU,MAAK,OAAO,EAAE;AAC9C,QAAI,OAAO,EAAE,YAAY,SAAU,MAAK,UAAU,EAAE;AAGpD,QAAI,OAAO,EAAE,YAAY,SAAU,MAAK,UAAU,EAAE;AAIpD,QAAI,OAAO,EAAE,gBAAgB,UAAU;AACrC,UAAI,UAAU,EAAE,WAAW,GAAG;AAC5B,aAAK,cAAc,EAAE;AAAA,MACvB,OAAO;AACL,gBAAQ;AAAA,UACN,qBAAqB,CAAC,+CAA+C,KAAK,UAAU,EAAE,WAAW,CAAC;AAAA,QACpG;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,EAAE,SAAS,YAAY,EAAE,SAAS,MAAM;AACjD,WAAK,OAAO,EAAE;AAAA,IAChB;AACA,WAAO;AAAA,EACT,CAAC;AACH;AAEO,SAAS,aAAa,MAAiC;AAC5D,SAAO,YAAY;AACjB,UAAM,OAAO,MAAMA,UAAS,MAAM,OAAO;AACzC,QAAI;AACJ,QAAI;AACF,YAAM,KAAK,MAAM,IAAI;AAAA,IACvB,SAAS,GAAG;AAKV,YAAM,IAAI,MAAM,kCAAkC,IAAI,KAAM,EAAY,OAAO,IAAI;AAAA,QACjF,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AACA,WAAO,SAAS,GAAG;AAAA,EACrB;AACF;;;AFnDA,eAAsB,aAAa,OAA2C;AAC5E,MAAI,MAAM,QAAQ,MAAM,OAAO;AAC7B,UAAM,OAAO,OAAO,IAAI,MAAM,iDAAiD,GAAG;AAAA,MAChF,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AAEA,MAAI,MAAM,UAAU,YAAY;AAC9B,UAAM,EAAE,UAAAC,WAAU,oBAAAC,oBAAmB,IAAI,MAAM;AAC/C,UAAM,EAAE,kBAAAC,kBAAiB,IAAI,MAAM;AACnC,UAAM,OAAOF,UAASC,oBAAmB,CAAC;AAC1C,UAAM,WAAWC,kBAAiB,MAAM,MAAM,UAAU,EAAE,SAAS,MAAM,QAAQ,IAAI,CAAC,CAAC;AACvF,WAAO,SAAS;AAAA,EAClB;AAEA,MAAI,MAAM,OAAO;AACf,UAAM,YAAY,QAAQ,MAAM,KAAK,MAAM,KAAK;AAChD,UAAM,MAAM,QAAQ,SAAS,EAAE,YAAY;AAC3C,QAAI;AACJ,QAAI,QAAQ,SAAS;AACnB,iBAAW,aAAa,SAAS;AAAA,IACnC,WAAW,QAAQ,SAAS,QAAQ,UAAU,QAAQ,QAAQ;AAC5D,YAAM,MAAO,MAAM,OAAO,cAAc,SAAS,EAAE;AAGnD,UAAI,CAAC,IAAI,WAAW,OAAO,IAAI,YAAY,YAAY;AACrD,cAAM,OAAO,OAAO,IAAI,MAAM,WAAW,MAAM,KAAK,oCAAoC,GAAG;AAAA,UACzF,UAAU;AAAA,QACZ,CAAC;AAAA,MACH;AACA,iBAAW,IAAI;AAAA,IACjB,OAAO;AACL,YAAM,OAAO;AAAA,QACX,IAAI,MAAM,WAAW,MAAM,KAAK,2BAA2B,OAAO,QAAQ,EAAE;AAAA,QAC5E,EAAE,UAAU,EAAE;AAAA,MAChB;AAAA,IACF;AACA,WAAO,SAAS;AAAA,EAClB;AAEA,SAAO,UAAU,QAAQ,MAAM,KAAK,MAAM,QAAQ,MAAM,GAAG,CAAC,EAAE;AAChE;;;AGvDA,SAAS,QAAAC,OAAM,WAAAC,UAAS,aAAa;AACrC,SAAS,cAAAC,aAAY,QAAAC,aAAY;;;ACDjC,SAAS,gBAAgB;AACzB,SAAS,iBAAiB;AAE1B,IAAM,OAAO,UAAU,QAAQ;AA0FxB,IAAM,gBAAgB;AAKtB,SAAS,YAAY,MAAuB;AACjD,MAAI,KAAK,SAAS,IAAI,EAAG,QAAO;AAChC,SAAO,cAAc,KAAK,IAAI;AAChC;AAQO,SAAS,cAAc,GAAW,GAAoB;AAC3D,QAAM,KAAK,YAAY,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,IAAI,eAAe,CAAC;AAC9D,QAAM,KAAK,YAAY,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,IAAI,eAAe,CAAC;AAC9D,MAAI,OAAO,QAAQ,OAAO,KAAM,QAAO;AACvC,SAAO,GAAG,YAAY,MAAM,GAAG,YAAY;AAC7C;AAGO,SAAS,eAAe,WAAkC;AAC/D,QAAM,UAAU,UACb,KAAK,EACL,QAAQ,UAAU,EAAE,EACpB,QAAQ,OAAO,EAAE;AAEpB,QAAM,MAAM,QAAQ,MAAM,wCAAwC;AAClE,QAAM,OAAO,MAAM,IAAI,CAAC,IAAK,QAAQ,QAAQ,uBAAuB,EAAE;AACtE,QAAM,WAAW,KAAK,MAAM,GAAG,EAAE,OAAO,OAAO;AAC/C,MAAI,SAAS,SAAS,EAAG,QAAO;AAChC,SAAO,GAAG,SAAS,SAAS,SAAS,CAAC,CAAC,IAAI,SAAS,SAAS,SAAS,CAAC,CAAC;AAC1E;;;ADrHA,SAAS,sBAAsB,SAAyB;AACtD,QAAM,QAAQ,QAAQ,MAAM,GAAG,EAAE,IAAI,KAAK;AAC1C,SAAO,MAAM,QAAQ,UAAU,EAAE;AACnC;AAGA,SAAS,eAAe,MAAoB;AAC1C,MAAI,KAAK,WAAW,GAAG;AAIrB,UAAM,IAAI,MAAM,0BAA0B;AAAA,EAC5C;AACA,MAAIC,YAAW,IAAI,GAAG;AACpB,UAAM,IAAI,MAAM,iDAAiD,IAAI,EAAE;AAAA,EACzE;AACA,MAAI,KAAK,SAAS,GAAG,KAAK,KAAK,SAAS,IAAI,GAAG;AAC7C,UAAM,IAAI,MAAM,kDAAkD,IAAI,EAAE;AAAA,EAC1E;AACA,MAAI,KAAK,MAAM,OAAO,EAAE,KAAK,CAAC,QAAQ,QAAQ,IAAI,GAAG;AACnD,UAAM,IAAI,MAAM,qDAAqD,IAAI,EAAE;AAAA,EAC7E;AACF;AAYA,SAAS,kBAAkB,SAAuB;AAChD,MACE,CAAC,8BAA8B,KAAK,OAAO,KAC3C,CAAC,oCAAoC,KAAK,OAAO,GACjD;AACA,UAAM,IAAI;AAAA,MACR,wHAC6C,KAAK,UAAU,OAAO,CAAC;AAAA,IACtE;AAAA,EACF;AACF;AAEA,eAAe,cAAc,MAAgC;AAC3D,MAAI;AACF,UAAM,IAAI,MAAMC,MAAK,IAAI;AACzB,QAAI,CAAC,EAAE,YAAY,EAAG,QAAO;AAC7B,UAAM,UAAU,MAAMC,SAAQ,IAAI;AAClC,WAAO,QAAQ,SAAS;AAAA,EAC1B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAQA,SAAS,gBAAgB,MAAgC;AACvD,SAAO,KAAK,WAAW,KAAK,WAAW;AACzC;AAcA,eAAe,sBAAsB,MAAY,MAAcC,QAA+B;AAC5F,QAAM,WAAW,gBAAgB,IAAI;AACrC,MAAI,CAAC,SAAU;AAEf,QAAM,IAAI,MAAMA,OAAM,OAAO,CAAC,MAAM,MAAM,UAAU,WAAW,QAAQ,GAAG;AAAA,IACxE,WAAW;AAAA,EACb,CAAC;AAGD,MAAI,EAAE,SAAS,EAAG;AAClB,QAAM,SAAS,EAAE,OAAO,KAAK;AAC7B,MAAI,OAAO,WAAW,EAAG;AAEzB,MAAI,CAAC,cAAc,QAAQ,QAAQ,GAAG;AACpC,UAAM,IAAI;AAAA,MACR,eAAe,IAAI,iCAAiC,KAAK,UAAU,MAAM,CAAC,qBACpD,KAAK,UAAU,QAAQ,CAAC;AAAA,IAChD;AAAA,EACF;AACF;AAKA,IAAM,cAAc;AAWpB,SAAS,gBAAgB,MAAgC;AACvD,MAAI,KAAK,QAAS,QAAO,KAAK;AAC9B,MAAI,CAAC,KAAK,QAAS,QAAO;AAC1B,MAAI,CAAC,YAAY,KAAK,KAAK,OAAO,GAAG;AACnC,UAAM,IAAI,MAAM,+CAA+C,KAAK,UAAU,KAAK,OAAO,CAAC,GAAG;AAAA,EAChG;AACA,SAAO,sBAAsB,KAAK,OAAO;AAC3C;AAEA,eAAsB,cAAc,MAAY,MAA2C;AACzF,QAAMA,SAAQ,KAAK,SAAS;AAE5B,MAAI,MAAM,cAAc,KAAK,IAAI,GAAG;AAIlC,UAAM,sBAAsB,MAAM,KAAK,MAAMA,MAAK;AAClD,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,gBAAgB,IAAI;AACpC,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI;AAAA,MACR,6BAA6B,KAAK,IAAI;AAAA,IACxC;AAAA,EACF;AAEA,QAAM,OAAO,KAAK,QAAQ,sBAAsB,OAAO;AACvD,iBAAe,IAAI;AACnB,oBAAkB,OAAO;AACzB,QAAM,SAASC,MAAK,KAAK,SAAS,IAAI;AACtC,QAAM,MAAM,KAAK,SAAS,EAAE,WAAW,KAAK,CAAC;AAE7C,MAAI,MAAM,cAAc,MAAM,GAAG;AAE/B,UAAM,sBAAsB,MAAM,QAAQD,MAAK;AAC/C,WAAO,EAAE,GAAG,MAAM,MAAM,MAAM,OAAO;AAAA,EACvC;AAGA,QAAM,SAAS,MAAMA,OAAM,OAAO,CAAC,SAAS,MAAM,SAAS,MAAM,GAAG;AAAA,IAClE,KAAK,KAAK;AAAA,IACV,WAAW,IAAI;AAAA,EACjB,CAAC;AACD,MAAI,OAAO,SAAS,GAAG;AACrB,UAAM,IAAI,MAAM,0BAA0B,OAAO,IAAI,MAAM,OAAO,MAAM,EAAE;AAAA,EAC5E;AACA,SAAO,EAAE,GAAG,MAAM,MAAM,MAAM,OAAO;AACvC;;;AElJA,eAAsB,kBACpB,OACA,MAC0B;AAC1B,QAAM,QAAQ,KAAK,SAAS;AAC5B,QAAM,gBAAgB,KAAK,kBAAkB,MAAM;AACnD,QAAM,UAAU,MAAM,QAAQ;AAAA,IAC5B,MAAM,IAAI,OAAO,SAA4E;AAC3F,UAAI,CAAC,cAAc,IAAI,EAAG,QAAO,EAAE,IAAI,MAAM,KAAK;AAClD,UAAI;AACF,eAAO,EAAE,IAAI,MAAM,MAAM,MAAM,MAAM,MAAM,EAAE,SAAS,KAAK,QAAQ,CAAC,EAAE;AAAA,MACxE,SAAS,GAAG;AACV,eAAO,EAAE,IAAI,OAAO,MAAM,KAAK,QAAQ,KAAK,MAAM,QAAS,EAAY,QAAQ;AAAA,MACjF;AAAA,IACF,CAAC;AAAA,EACH;AACA,QAAM,WAAmB,CAAC;AAC1B,QAAM,UAAyB,CAAC;AAChC,aAAW,KAAK,SAAS;AACvB,QAAI,EAAE,GAAI,UAAS,KAAK,EAAE,IAAI;AAAA,QACzB,SAAQ,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,EAAE,OAAO,CAAC;AAAA,EACtD;AACA,SAAO,EAAE,UAAU,QAAQ;AAC7B;AAMO,SAAS,oBAAoB,SAAuC;AACzE,MAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,QAAM,SAAS,QAAQ,IAAI,CAAC,MAAM,GAAG,EAAE,IAAI,KAAK,EAAE,MAAM,GAAG,EAAE,KAAK,IAAI;AACtE,SAAO,UAAK,QAAQ,MAAM,yCAAyC,MAAM;AAC3E;;;ApBlDA;;;AqBVA,SAAS,UAAAE,eAAc;AACvB,SAAS,QAAAC,aAAY;AAWd,SAAS,eAAuB;AACrC,QAAM,OAAO,QAAQ,IAAI,MAAM,KAAK;AACpC,QAAM,OAAO,OAAO,OAAOD,QAAO;AAClC,SAAOC,MAAK,MAAM,kBAAkB,OAAO;AAC7C;;;ArBkBA,SAAS,UAAU,OAAoD;AACrE,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,QAAQ,MAAM,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC;AAClD,aAAW,KAAK,OAAO;AACrB,QAAI,CAAC,gBAAgB,SAAS,CAAc,GAAG;AAC7C,YAAM,OAAO,OAAO,IAAI,MAAM,4BAA4B,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;AAAA,IACjF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,YAAY,SAAgC;AACnD,SAAO,QACJ,IAAI,CAAC,MAAM,GAAG,EAAE,MAAM,OAAO,EAAE,CAAC,IAAI,EAAE,OAAO,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI;AAAA,IAAO,EAAE,OAAO,EAAE,EAClF,KAAK,IAAI;AACd;AAEO,SAAS,cAAc,SAAwB,kBAAmC;AACvF,MAAI,QAAQ,KAAK,CAAC,MAAM,EAAE,WAAW,MAAM,EAAG,QAAO;AACrD,MAAI,kBAAkB;AACpB,UAAM,iBAAiB,QACpB,OAAO,CAAC,MAAM,EAAE,UAAU,MAAM,EAChC;AAAA,MACC,CAAC,GAAG,MACF,KAAM,EAAE,SAAsD,mBAAmB;AAAA,MACnF;AAAA,IACF;AACF,QAAI,iBAAiB,EAAG,QAAO;AAAA,EACjC;AACA,SAAO;AACT;AAEA,SAAS,eAAe,IAAoB;AAC1C,MAAI,KAAK,IAAO,QAAO,GAAG,EAAE;AAC5B,QAAM,eAAe,KAAK,MAAM,KAAK,GAAK;AAC1C,MAAI,eAAe,GAAI,QAAO,GAAG,YAAY;AAC7C,QAAM,IAAI,KAAK,MAAM,eAAe,EAAE;AACtC,QAAM,IAAI,eAAe;AACzB,SAAO,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,GAAG,GAAG,CAAC;AAC9C;AASO,SAAS,iBAAiB,OAA6C;AAC5E,MAAI,UAAU,OAAW,QAAO;AAChC,QAAM,IAAI,OAAO,KAAK;AACtB,MAAI,CAAC,OAAO,UAAU,CAAC,KAAK,IAAI,GAAG;AACjC,UAAM,OAAO,OAAO,IAAI,MAAM,kDAAkD,KAAK,GAAG,GAAG;AAAA,MACzF,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAOA,SAAS,gBACP,OACA,OACA,SACA,UACA,aACA;AACA,QAAM,aAAa,MAAM,WAAW;AAEpC,MAAI,YAAY;AACd,UAAM,OAAO,MAAM,CAAC;AACpB,WAAO,IAAI;AAAA,MACT,MAAM,IAAI,CAAC,UAAU;AAAA,QACnB,OAAO;AAAA,QACP,MAAM,OAAO,MAAM,SAAS;AAC1B,gBAAM,QAAQ,KAAK,IAAI;AACvB,gBAAM,SAAS,MAAM,YAAY,MAAM,IAAI;AAC3C,kBAAQ,KAAK,MAAM;AACnB,gBAAM,UAAU,eAAe,KAAK,IAAI,IAAI,KAAK;AACjD,eAAK,QAAQ,GAAG,IAAI,KAAK,OAAO,OAAO,KAAK,OAAO;AACnD,cAAI,OAAO,WAAW,OAAQ,OAAM,IAAI,MAAM,OAAO,OAAO;AAAA,QAC9D;AAAA,MACF,EAAE;AAAA,MACF,EAAE,YAAY,MAAM,aAAa,OAAO,SAAS;AAAA,IACnD;AAAA,EACF;AAEA,SAAO,IAAI;AAAA,IACT,MAAM,IAAI,CAAC,SAAS;AAClB,YAAM,QAAQ,KAAK,QAAQ,KAAK;AAChC,aAAO;AAAA,QACL,OAAO;AAAA,QACP,MAAM,OAAO,MAAM,SAAS;AAC1B,gBAAM,QAAQ,KAAK,IAAI;AACvB,cAAI,OAAO;AACX,eAAK,SAAS,KAAK,MAAM,MAAM;AAC/B,gBAAM,UAAU,MAAM,QAAQ;AAAA,YAC5B,MAAM,IAAI,OAAO,SAAS;AACxB,oBAAM,IAAI,MAAM,YAAY,MAAM,IAAI;AACtC,sBAAQ,KAAK,CAAC;AACd,sBAAQ;AACR,mBAAK,SAAS,GAAG,IAAI,IAAI,MAAM,MAAM;AACrC,qBAAO;AAAA,YACT,CAAC;AAAA,UACH;AACA,gBAAM,UAAU,eAAe,KAAK,IAAI,IAAI,KAAK;AACjD,gBAAM,SAAS,QAAQ,OAAO,CAAC,MAAM,EAAE,WAAW,MAAM,EAAE;AAC1D,gBAAM,SAAS,QAAQ,OAAO,CAAC,MAAM,EAAE,WAAW,MAAM,EAAE;AAC1D,gBAAM,OACJ,SAAS,IACL,GAAG,MAAM,YACT,SAAS,IACP,GAAG,MAAM,WAAW,WAAW,IAAI,KAAK,GAAG,KAC3C;AACR,eAAK,QAAQ,GAAG,KAAK,KAAK,IAAI,KAAK,OAAO;AAC1C,cAAI,SAAS,EAAG,OAAM,IAAI,MAAM,GAAG,KAAK,KAAK,MAAM,kBAAkB;AAAA,QACvE;AAAA,MACF;AAAA,IACF,CAAC;AAAA,IACD,EAAE,YAAY,aAAa,aAAa,OAAO,SAAS;AAAA,EAC1D;AACF;AAMA,SAAS,mBAAmB,SAA+B;AACzD,QAAM,QAAQ,QAAQ,OAAO,IAAI,CAAC,MAAM;AACtC,QAAI,EAAE,UAAU,cAAc;AAC5B,YAAM,IAAI,EAAE;AAMZ,aAAO,mBAAmB,EAAE,WAAW,MAAM,EAAE,aAAa,OAAO,EAAE,aAAa,QAAQ,EAAE,GAAG;AAAA,IACjG;AACA,QAAI,EAAE,UAAU,QAAQ;AACtB,aAAO,WAAY,EAAE,OAAkC,UAAU;AAAA,IACnE;AACA,QAAI,EAAE,UAAU,QAAQ;AACtB,YAAMC,KAAI,EAAE;AACZ,aAAO,WAAWA,GAAE,OAAO,aAAaA,GAAE,WAAW;AAAA,IACvD;AACA,UAAM,IAAI,EAAE;AACZ,WAAO,eAAe,EAAE,QAAQ,KAAK,EAAE,IAAI,KAAK,EAAE,QAAQ,KAAK,EAAE,GAAG;AAAA,EACtE,CAAC;AACD,SAAO,4BAAuB,QAAQ,QAAQ;AAAA,EAAO,MAAM,KAAK,IAAI,CAAC;AACvE;AAKA,SAAS,YAAY,MAAqC;AACxD,SAAO,OAAO,WAAW;AAC3B;AAMO,SAAS,kBACd,OACA,KACA,KACe;AACf,MAAI,QAAQ,OAAW,QAAO;AAC9B,QAAM,SAAS,MAAM,OAAO,CAAC,MAAM,MAAM,YAAY;AACrD,MAAI,OAAO,WAAW,EAAG,QAAO;AAChC,SAAO,wCAAwC,OAAO,KAAK,IAAI,CAAC,sCAAsC,GAAG;AAC3G;AAMO,SAAS,mBAAmB,MAAY,OAA6B;AAC1E,QAAM,kBAAkB,KAAK,gBAAgB,UAAa,MAAM,MAAM,CAAC,MAAM,MAAM,YAAY;AAC/F,SAAO,CAAC;AACV;AAOO,SAAS,iBAAiB,OAAe,KAAiC;AAC/E,MAAI,QAAQ,OAAW,QAAO;AAC9B,MAAI,MAAM,WAAW,GAAG;AACtB,UAAM,OAAO;AAAA,MACX,IAAI,MAAM,uCAAuC,MAAM,MAAM,YAAY;AAAA,MACzE,EAAE,UAAU,EAAE;AAAA,IAChB;AAAA,EACF;AAIA,MAAI,CAAC,UAAU,GAAG,GAAG;AACnB,UAAM,OAAO,OAAO,IAAI,MAAM,sCAAsC,KAAK,UAAU,GAAG,CAAC,GAAG,GAAG;AAAA,MAC3F,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AACA,SAAO,CAAC,EAAE,GAAG,MAAM,CAAC,GAAI,aAAa,IAAI,CAAC;AAC5C;AAEA,eAAsB,gBACpB,MACA,MAC2C;AAC3C,QAAM,QAAQ,UAAU,KAAK,IAAI,KAAK;AACtC,QAAM,MAAM,KAAK,MAAMC,SAAQ,KAAK,GAAG,IAAI,QAAQ,IAAI;AAKvD,MAAI,OAAO,KAAK,kBAAkB,YAAY,KAAK,UAAU,QAAW;AACtE,UAAM,OAAO;AAAA,MACX,IAAI;AAAA,QACF;AAAA,MACF;AAAA,MACA,EAAE,UAAU,EAAE;AAAA,IAChB;AAAA,EACF;AAEA,MAAI,KAAK,QAAQ,UAAa,KAAK,UAAU,QAAW;AACtD,UAAM,OAAO;AAAA,MACX,IAAI;AAAA,QACF;AAAA,MACF;AAAA,MACA,EAAE,UAAU,EAAE;AAAA,IAChB;AAAA,EACF;AAEA,MAAI,QAAQ,MAAM,aAAa;AAAA,IAC7B,GAAI,SAAS,SAAY,EAAE,KAAK,IAAI,CAAC;AAAA,IACrC,GAAI,KAAK,UAAU,SAAY,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAAA,IACxD,GAAI,KAAK,YAAY,SAAY,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,IAC9D;AAAA,EACF,CAAC;AAED,UAAQ,iBAAiB,OAAO,KAAK,GAAG;AAExC,MAAI,cAA6B,CAAC;AAClC,MAAI,KAAK,OAAO;AACd,UAAM,UAAU,KAAK,WAAW,aAAa;AAC7C,UAAM,OAAO,MAAM,kBAAkB,OAAO;AAAA,MAC1C;AAAA,MACA,eAAe,CAAC,MAAM,mBAAmB,GAAG,KAAK;AAAA,IACnD,CAAC;AACD,YAAQ,KAAK;AACb,kBAAc,KAAK;AAAA,EACrB;AAEA,QAAM,UAAyB,CAAC;AAChC,QAAM,WAAW,YAAY,KAAK,IAAI;AACtC,QAAM,gBAAgB,OAAO,OAAO,SAAS,UAAU,iBAAiB,KAAK,WAAW,CAAC,EAAE,IAAI;AAE/F,MAAI,SAAS,KAAK,OAAO,KAAK,UAAU,SAAS,MAAM,CAAC,IAAI,YAAY,OAAO;AAM/E,QAAM,aAAa,oBAAoB,WAAW;AAClD,MAAI,cAAc,CAAC,KAAK,KAAM,WAAU;AAAA;AAAA,EAAO,UAAU;AAOzD,MAAI,kBAAkB;AACtB,MAAI,KAAK,kBAAkB,QAAW;AACpC,UAAM,EAAE,UAAAC,WAAU,oBAAAC,oBAAmB,IAAI,MAAM;AAC/C,UAAM,EAAE,cAAAC,cAAa,IAAI,MAAM;AAE/B,QAAI,KAAK,UAAU,QAAW;AAC5B,YAAM,EAAE,4BAAAC,6BAA4B,yBAAAC,yBAAwB,IAC1D,MAAM;AACR,YAAM,OAAOJ,UAASC,oBAAmB,CAAC;AAC1C,YAAM,WAAW,MAAMC,cAAa,IAAI;AACxC,YAAM,aAAa,MAAMC,4BAA2B,EAAE,MAAM,UAAU,QAAQ,CAAC;AAC/E,UAAI,WAAW,OAAO,SAAS,EAAG,mBAAkB;AAIpD,UAAI,CAAC,KAAK,KAAM,WAAU;AAAA;AAAA,EAAOC,yBAAwB,UAAU,CAAC;AAAA,IACtE,OAAO;AACL,YAAM,EAAE,oBAAAC,oBAAmB,IAAI,MAAM;AACrC,YAAM,EAAE,uBAAAC,uBAAsB,IAAI,MAAM;AACxC,YAAM,OACJ,OAAO,KAAK,kBAAkB,YAAY,KAAK,cAAc,SAAS,IAClE,KAAK,gBACL,MAAMD,oBAAmB,GAAG;AAClC,UAAI,eAAoC;AACxC,YAAM,IAAI;AAAA,QACR;AAAA,UACE;AAAA,YACE,OAAO,qBAAqB,IAAI;AAAA,YAChC,MAAM,OAAO,MAAM,SAAS;AAC1B,oBAAM,OAAOL,UAASC,oBAAmB,CAAC;AAC1C,mBAAK,SAAS;AACd,oBAAM,WAAW,MAAMC,cAAa,IAAI;AACxC,mBAAK,SAAS;AACd,6BAAe,MAAMI,uBAAsB,EAAE,MAAM,UAAU,MAAM,QAAQ,CAAC;AAC5E,mBAAK,QAAQ,qBAAqB,aAAa,QAAQ,MAAM,aAAa,OAAO,MAAM,cAAc,aAAa,OAAO,WAAW,IAAI,KAAK,GAAG;AAAA,YAClJ;AAAA,UACF;AAAA,QACF;AAAA,QACA,EAAE,SAAS;AAAA,MACb,EAAE,IAAI;AACN,UAAI,gBAAgB,CAAC,KAAK,KAAM,WAAU;AAAA;AAAA,EAAO,mBAAmB,YAAY,CAAC;AAAA,IACnF;AAAA,EACF;AAEA,QAAM,SAAS,kBAAkB,OAAO,KAAK,KAAK,GAAG;AACrD,MAAI,UAAU,CAAC,KAAK,KAAM,WAAU;AAAA;AAAA,EAAO,MAAM;AAEjD,QAAM,OAAO,KAAK;AAAA,IAChB,cAAc,SAAS,KAAK,qBAAqB,IAAI;AAAA,IACrD,kBAAkB,IAAI;AAAA,EACxB;AACA,SAAO,EAAE,QAAQ,KAAK;AACxB;","names":["join","readFile","join","resolve","resolve","join","spawn","join","readFile","join","join","readFile","spawn","readFile","join","readFile","join","resolve","readFile","join","spawn","readFile","writeFile","mkdtemp","rm","join","readJsonMaybe","readFile","spawn","mkdtemp","join","writeFile","rm","spawn","readFile","openBase","readAirtableConfig","fromAirtableBase","stat","readdir","isAbsolute","join","isAbsolute","stat","readdir","spawn","join","tmpdir","join","c","resolve","openBase","readAirtableConfig","listWebsites","writeFleetAuditsToAirtable","formatFleetWriteSummary","resolveSlugFromCwd","writeAuditsToAirtable"]}