@reddoorla/maintenance 0.55.0 → 0.56.0

package/dist/chunk-W3G7XFBZ.js

@@ -0,0 +1,444 @@
+import {
+  queueDraft
+} from "./chunk-6LIWDIXU.js";
+import {
+  renderReportHtml,
+  resolveCopy,
+  uploadAttachment
+} from "./chunk-BWLUNY7L.js";
+import {
+  checklistFor,
+  createDraft,
+  listReportsForSite
+} from "./chunk-OCS7SZUZ.js";
+import {
+  isNetlifyAppUrl
+} from "./chunk-U5SZ4FOP.js";
+import {
+  siteSlug,
+  updateAnalyticsHealth
+} from "./chunk-CLVTVDOU.js";
+import {
+  defaultCredentialsPath
+} from "./chunk-6VAL7XJT.js";
+
+// src/reports/ga/config.ts
+import { dirname, join } from "path";
+function readGaConfig() {
+  const subject = process.env.GA_SUBJECT?.trim();
+  if (!subject) return null;
+  const keyPath = process.env.GA_SA_KEY_PATH?.trim() || join(dirname(defaultCredentialsPath()), "ga-service-account.json");
+  return { subject, keyPath };
+}
+
+// src/reports/draft.ts
+import { mkdir, writeFile } from "fs/promises";
+import { dirname as dirname2 } from "path";
+
+// src/reports/auto-tick.ts
+var STALE_DAYS = 3;
+var MS_PER_DAY = 24 * 60 * 60 * 1e3;
+function isFresh(checkedAt, now) {
+  if (!checkedAt) return false;
+  const t = new Date(checkedAt).getTime();
+  if (Number.isNaN(t)) return false;
+  return now.getTime() - t <= STALE_DAYS * MS_PER_DAY;
+}
+var CERT_MIN_DAYS = 14;
+function autoTickChecklist(site, reportType, now, signals) {
+  const out = /* @__PURE__ */ new Map();
+  const fields = new Set(checklistFor(reportType).map((i) => i.field));
+  if (fields.has("Maint: Google Indexed")) {
+    const g = googleEvidence(now, signals.search);
+    if (g) out.set("Maint: Google Indexed", g);
+  }
+  if (fields.has("Maint: Security Updates")) {
+    const s = securityEvidence(site, now);
+    if (s) out.set("Maint: Security Updates", s);
+  }
+  if (fields.has("Maint: Domain, DNS & SSL")) {
+    const d = domainEvidence(site, now);
+    if (d) out.set("Maint: Domain, DNS & SSL", d);
+  }
+  if (fields.has("Test: Desktop Browsers")) {
+    const e = browserEvidence(
+      site.crossbrowserOk,
+      site,
+      now,
+      "Desktop renders cleanly",
+      "render errors"
+    );
+    if (e) out.set("Test: Desktop Browsers", e);
+  }
+  if (fields.has("Test: Mobile Browsers")) {
+    const e = browserEvidence(
+      site.mobileOk,
+      site,
+      now,
+      "Mobile renders cleanly",
+      "overflow/errors"
+    );
+    if (e) out.set("Test: Mobile Browsers", e);
+  }
+  if (fields.has("Test: Links & Navigation")) {
+    const broken = site.brokenLinks;
+    const failNote = broken && broken > 0 ? `${broken} broken link(s)` : "broken links / nav";
+    const e = browserEvidence(site.linksOk, site, now, "All internal links resolve", failNote);
+    if (e) out.set("Test: Links & Navigation", e);
+  }
+  return out;
+}
+function browserEvidence(ok, site, now, passNote, failNote) {
+  if (ok === null || !site.browserCheckedAt) return null;
+  const at = site.browserCheckedAt;
+  if (!isFresh(at, now)) {
+    return { result: "unknown", checkedAt: at, note: "Browser check is stale (>3d)" };
+  }
+  return ok ? { result: "pass", checkedAt: at, note: passNote } : { result: "fail", checkedAt: at, note: failNote };
+}
+function securityEvidence(site, now) {
+  const crit = site.securityVulnsCritical;
+  const high = site.securityVulnsHigh;
+  if (crit === null || high === null || !site.lastSecurityAuditAt) return null;
+  const at = site.lastSecurityAuditAt;
+  if (!isFresh(at, now)) {
+    return { result: "unknown", checkedAt: at, note: "Security audit is stale (>3d)" };
+  }
+  if (crit === 0 && high === 0) {
+    return { result: "pass", checkedAt: at, note: "No known critical/high vulnerabilities" };
+  }
+  return { result: "fail", checkedAt: at, note: `${crit} critical / ${high} high vuln(s)` };
+}
+function googleEvidence(now, search) {
+  const at = now.toISOString();
+  if (search.softFailed) {
+    return { result: "unknown", checkedAt: at, note: "Search Console unavailable this run" };
+  }
+  if (search.value === null) return null;
+  if (search.value.foundOnPage1) {
+    const pos2 = search.value.position;
+    return {
+      result: "pass",
+      checkedAt: at,
+      note: `Page 1 on Google${pos2 !== null ? ` (#${pos2})` : ""}`
+    };
+  }
+  const pos = search.value.position;
+  return {
+    result: "fail",
+    checkedAt: at,
+    note: `Not on page 1${pos !== null ? ` (avg #${pos})` : ""}`
+  };
+}
+function domainEvidence(site, now) {
+  if (!site.url || isNetlifyAppUrl(site.url)) return null;
+  if (!site.domainCheckedAt) return null;
+  const at = site.domainCheckedAt;
+  if (!isFresh(site.domainCheckedAt, now)) {
+    return { result: "unknown", checkedAt: at, note: "Domain check is stale (>3d)" };
+  }
+  const days = site.certDaysRemaining;
+  if (days === null) {
+    return { result: "fail", checkedAt: at, note: "Did not resolve, or no valid TLS cert" };
+  }
+  if (days <= CERT_MIN_DAYS) {
+    return { result: "fail", checkedAt: at, note: `TLS cert expires in ${days}d` };
+  }
+  return { result: "pass", checkedAt: at, note: `Custom domain, valid cert (${days}d left)` };
+}
+
+// src/reports/ga/client.ts
+import { readFileSync } from "fs";
+import { JWT } from "google-auth-library";
+import { BetaAnalyticsDataClient } from "@google-analytics/data";
+var ANALYTICS_READONLY = "https://www.googleapis.com/auth/analytics.readonly";
+var MS_PER_DAY2 = 864e5;
+function ymd(d) {
+  return d.toISOString().slice(0, 10);
+}
+async function fetchPeriodUsers(query, periodStart, periodEnd) {
+  const key = JSON.parse(readFileSync(query.keyPath, "utf8"));
+  const authClient = new JWT({
+    email: key.client_email,
+    key: key.private_key,
+    scopes: [ANALYTICS_READONLY],
+    subject: query.subject
+  });
+  const client = new BetaAnalyticsDataClient({ authClient });
+  const lengthDays = Math.round((periodEnd.getTime() - periodStart.getTime()) / MS_PER_DAY2);
+  const prevEnd = new Date(periodStart.getTime() - MS_PER_DAY2);
+  const prevStart = new Date(prevEnd.getTime() - lengthDays * MS_PER_DAY2);
+  const property = `properties/${query.propertyId}`;
+  const run = async (start, end) => {
+    const [resp] = await client.runReport({
+      property,
+      dateRanges: [{ startDate: ymd(start), endDate: ymd(end) }],
+      metrics: [{ name: "activeUsers" }]
+    });
+    const raw = resp.rows?.[0]?.metricValues?.[0]?.value ?? "0";
+    const n = Number.parseInt(raw, 10);
+    return Number.isFinite(n) ? n : 0;
+  };
+  const current = await run(periodStart, periodEnd);
+  const previous = await run(prevStart, prevEnd);
+  return { current, previous };
+}
+
+// src/reports/search/client.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { JWT as JWT2 } from "google-auth-library";
+var WEBMASTERS_READONLY = "https://www.googleapis.com/auth/webmasters.readonly";
+var SC_BASE = "https://searchconsole.googleapis.com/webmasters/v3";
+var PAGE_1_MAX_POSITION = 10;
+var BRAND_QUERY_ROW_LIMIT = 100;
+function bareHost(s) {
+  return s.trim().replace(/^sc-domain:/i, "").replace(/^https?:\/\//i, "").split("/")[0].replace(/^www\./i, "").toLowerCase();
+}
+function resolvePropertyCandidates(entries, host) {
+  const target = bareHost(host);
+  const matches = entries.filter((e) => bareHost(e.siteUrl) === target).map((e) => e.siteUrl);
+  const domains = matches.filter((s) => s.toLowerCase().startsWith("sc-domain:"));
+  const prefixes = matches.filter((s) => !s.toLowerCase().startsWith("sc-domain:"));
+  return [...domains, ...prefixes];
+}
+function ymd2(d) {
+  return d.toISOString().slice(0, 10);
+}
+function pickBrandQuery(rows) {
+  let best;
+  for (const r of rows) {
+    if (typeof r.position !== "number") continue;
+    const impressions = r.impressions ?? 0;
+    if (best === void 0 || impressions > best.impressions || impressions === best.impressions && r.position < best.position) {
+      best = { position: r.position, impressions };
+    }
+  }
+  return best?.position;
+}
+function selectBrandPosition(rows, exactQuery) {
+  const want = exactQuery.toLowerCase();
+  const exact = rows.find(
+    (r) => typeof r.position === "number" && (r.keys?.[0] ?? "").toLowerCase() === want
+  );
+  if (exact) return exact.position;
+  return pickBrandQuery(rows);
+}
+async function fetchSearchPresence(q, periodStart, periodEnd) {
+  const key = JSON.parse(readFileSync2(q.keyPath, "utf8"));
+  const jwt = new JWT2({
+    email: key.client_email,
+    key: key.private_key,
+    scopes: [WEBMASTERS_READONLY],
+    subject: q.subject
+  });
+  const explicit = q.property?.trim();
+  let candidates;
+  if (explicit) {
+    candidates = [explicit];
+  } else {
+    const list = await jwt.request({
+      url: `${SC_BASE}/sites`,
+      method: "GET"
+    });
+    candidates = resolvePropertyCandidates(list.data.siteEntry ?? [], q.host);
+    if (candidates.length === 0) return { foundOnPage1: false, position: null };
+  }
+  for (const property of candidates) {
+    const res = await jwt.request({
+      url: `${SC_BASE}/sites/${encodeURIComponent(property)}/searchAnalytics/query`,
+      method: "POST",
+      data: {
+        startDate: ymd2(periodStart),
+        endDate: ymd2(periodEnd),
+        dimensions: ["query"],
+        dimensionFilterGroups: [
+          {
+            filters: [
+              { dimension: "query", operator: "contains", expression: q.query.toLowerCase() }
+            ]
+          }
+        ],
+        rowLimit: BRAND_QUERY_ROW_LIMIT
+      }
+    });
+    const pos = selectBrandPosition(res.data.rows ?? [], q.query.toLowerCase());
+    if (typeof pos === "number") {
+      return { foundOnPage1: pos <= PAGE_1_MAX_POSITION, position: Math.max(1, Math.round(pos)) };
+    }
+  }
+  return { foundOnPage1: false, position: null };
+}
+
+// src/reports/draft.ts
+function scoresFromWebsite(siteRow) {
+  const { pScore, rScore, bpScore, seoScore } = siteRow;
+  if (pScore === null || rScore === null || bpScore === null || seoScore === null) {
+    throw new Error(
+      `Site '${siteRow.name}' is missing one or more Lighthouse scores on the Websites row (pScore, rScore, bpScore, seoScore). Run 'reddoor-maint audit lighthouse' from the site's checkout and paste the four numbers into Airtable, then retry.`
+    );
+  }
+  return { performance: pScore, accessibility: rScore, bestPractices: bpScore, seo: seoScore };
+}
+function daysAgo(today, n) {
+  const out = new Date(today);
+  out.setUTCDate(out.getUTCDate() - n);
+  return out;
+}
+async function draftReportForSite(base, siteRow, reportType, options = {}) {
+  const scores = scoresFromWebsite(siteRow);
+  const today = /* @__PURE__ */ new Date();
+  const slug = siteSlug(siteRow.name);
+  const periodStart = base !== null ? await derivePeriodStart(base, siteRow, reportType, today) : daysAgo(today, 30);
+  const periodEnd = today;
+  const completedOn = today;
+  const lastTestedDate = reportType === "Maintenance" && siteRow.lastLighthouseAuditAt ? new Date(siteRow.lastLighthouseAuditAt) : null;
+  const gaResult = base !== null ? await fetchGaUsers(siteRow, periodStart, periodEnd) : NO_ENRICHMENT;
+  const searchResult = base !== null ? await fetchSearch(siteRow, periodStart, periodEnd) : NO_ENRICHMENT;
+  const gaUsers = gaResult.value;
+  const search = searchResult.value;
+  const softFailures = [
+    ...gaResult.softFailed ? ["ga"] : [],
+    ...searchResult.softFailed ? ["search"] : []
+  ];
+  const cidName = `${slug}-header`;
+  const { html } = await renderReportHtml({
+    siteName: siteRow.name,
+    siteUrl: siteRow.url,
+    reportType,
+    completedOn,
+    lighthouse: scores,
+    gaUsersCurrent: gaUsers?.current,
+    gaUsersPrevious: gaUsers?.previous,
+    searchPosition: search?.foundOnPage1 ? search.position ?? void 0 : void 0,
+    lastTestedDate,
+    commentary: null,
+    copy: resolveCopy(siteRow),
+    headerImageCid: cidName
+  });
+  if (options.previewOnly) {
+    const path = options.previewPath ?? `reports/${slug}/draft.html`;
+    await mkdir(dirname2(path), { recursive: true });
+    await writeFile(path, html, "utf-8");
+    return { reportRow: null, htmlPath: path, html, softFailures, queued: null, supersededIds: [] };
+  }
+  if (base === null) throw new Error("base required when previewOnly=false");
+  if (readGaConfig() !== null && Boolean(siteRow.ga4PropertyId || siteRow.searchQuery)) {
+    try {
+      await updateAnalyticsHealth(
+        base,
+        siteRow.id,
+        softFailures.length > 0 ? today.toISOString() : null
+      );
+    } catch (e) {
+      console.warn(`\u26A0 analytics-health write skipped for ${siteRow.name}: ${e.message}`);
+    }
+  }
+  if (options.completeRowId) {
+    await uploadDraftHtml(options.completeRowId, slug, periodEnd, html);
+    const outcome2 = await queueDraft(base, {
+      id: options.completeRowId,
+      siteId: siteRow.id,
+      reportType
+    });
+    return {
+      reportRow: options.existingRow ?? null,
+      htmlPath: null,
+      html,
+      softFailures,
+      queued: outcome2.queued,
+      supersededIds: outcome2.supersededIds
+    };
+  }
+  const evidence = autoTickChecklist(siteRow, reportType, completedOn, { search: searchResult });
+  const checklistTicks = [...evidence.entries()].filter(([, e]) => e.result === "pass").map(([field]) => field);
+  const autoEvidence = Object.fromEntries(evidence);
+  const reportId = `${siteRow.name} \u2014 ${reportType} \u2014 ${periodEnd.toISOString().slice(0, 10)}`;
+  const created = await createDraft(base, {
+    reportId,
+    siteId: siteRow.id,
+    reportType,
+    period: options.period ?? periodEnd.toISOString().slice(0, 7),
+    periodStart,
+    periodEnd,
+    completedOn,
+    lighthouse: scores,
+    lastTestedDate,
+    ...gaUsers ? { gaUsersCurrent: gaUsers.current, gaUsersPrevious: gaUsers.previous } : {},
+    ...search ? { searchFoundPage1: search.foundOnPage1 } : {},
+    ...search?.foundOnPage1 && search.position !== null ? { searchPosition: search.position } : {},
+    checklistTicks,
+    autoEvidence
+  });
+  await uploadDraftHtml(created.id, slug, periodEnd, html);
+  const outcome = await queueDraft(base, {
+    id: created.id,
+    siteId: siteRow.id,
+    reportType
+  });
+  return {
+    reportRow: created,
+    htmlPath: null,
+    html,
+    softFailures,
+    queued: outcome.queued,
+    supersededIds: outcome.supersededIds
+  };
+}
+async function uploadDraftHtml(rowId, slug, periodEnd, html) {
+  const htmlFilename = `${slug}-${periodEnd.toISOString().slice(0, 10)}.html`;
+  await uploadAttachment(rowId, "Rendered HTML", html, htmlFilename, "text/html");
+}
+var NO_ENRICHMENT = { value: null, softFailed: false };
+async function fetchGaUsers(siteRow, periodStart, periodEnd) {
+  const cfg = readGaConfig();
+  if (!cfg || !siteRow.ga4PropertyId) return NO_ENRICHMENT;
+  try {
+    const value = await fetchPeriodUsers(
+      { propertyId: siteRow.ga4PropertyId, subject: cfg.subject, keyPath: cfg.keyPath },
+      periodStart,
+      periodEnd
+    );
+    return { value, softFailed: false };
+  } catch (e) {
+    console.warn(`\u26A0 GA skipped for ${siteRow.name}: ${e.message}`);
+    return { value: null, softFailed: true };
+  }
+}
+async function fetchSearch(siteRow, periodStart, periodEnd) {
+  const cfg = readGaConfig();
+  if (!cfg || !siteRow.searchQuery) return NO_ENRICHMENT;
+  try {
+    const value = await fetchSearchPresence(
+      {
+        keyPath: cfg.keyPath,
+        subject: cfg.subject,
+        property: siteRow.searchConsoleProperty ?? void 0,
+        host: siteRow.url,
+        query: siteRow.searchQuery
+      },
+      periodStart,
+      periodEnd
+    );
+    return { value, softFailed: false };
+  } catch (e) {
+    console.warn(`\u26A0 Search presence skipped for ${siteRow.name}: ${e.message}`);
+    return { value: null, softFailed: true };
+  }
+}
+async function derivePeriodStart(base, siteRow, reportType, today) {
+  const prior = await listReportsForSite(base, siteRow.id);
+  const sameType = prior.filter((r) => r.reportType === reportType && r.periodEnd).map((r) => r.periodEnd).sort();
+  const latest = sameType[sameType.length - 1];
+  if (!latest) return daysAgo(today, 30);
+  const start = new Date(latest);
+  start.setUTCDate(start.getUTCDate() + 1);
+  return start;
+}
+
+export {
+  readGaConfig,
+  draftReportForSite,
+  fetchGaUsers,
+  fetchSearch
+};
+//# sourceMappingURL=chunk-W3G7XFBZ.js.map

package/dist/chunk-W3G7XFBZ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/reports/ga/config.ts","../src/reports/draft.ts","../src/reports/auto-tick.ts","../src/reports/ga/client.ts","../src/reports/search/client.ts"],"sourcesContent":["import { dirname, join } from \"node:path\";\nimport { defaultCredentialsPath } from \"../../util/credentials.js\";\n\nexport type GaConfig = {\n  /** Workspace user the service account impersonates (domain-wide delegation). */\n  subject: string;\n  /** Absolute path to the service-account JSON key file. */\n  keyPath: string;\n};\n\n/**\n * Read GA configuration from the environment (credentials.env is already loaded into\n * process.env by the CLI entrypoint). Returns null when `GA_SUBJECT` is unset — the\n * signal that GA enrichment is simply not configured, so drafting skips it silently.\n *\n * `GA_SA_KEY_PATH` is optional; it defaults to `ga-service-account.json` alongside the\n * credentials file (e.g. ~/.config/reddoor-maint/), keeping the key out of the repo.\n */\nexport function readGaConfig(): GaConfig | null {\n  const subject = process.env.GA_SUBJECT?.trim();\n  if (!subject) return null;\n  const keyPath =\n    process.env.GA_SA_KEY_PATH?.trim() ||\n    join(dirname(defaultCredentialsPath()), \"ga-service-account.json\");\n  return { subject, keyPath };\n}\n","import { mkdir, writeFile } from \"node:fs/promises\";\nimport { dirname } from \"node:path\";\nimport type { ReportType, LighthouseScores } from \"./types.js\";\nimport { renderReportHtml } from \"./render.js\";\nimport { siteSlug, updateAnalyticsHealth } from \"./airtable/websites.js\";\nimport { resolveCopy } from \"./copy.js\";\nimport type { WebsiteRow } from \"./airtable/websites.js\";\nimport type { ReportRow } from \"./airtable/reports.js\";\nimport { createDraft, listReportsForSite } from \"./airtable/reports.js\";\nimport { queueDraft } from \"./queue.js\";\nimport { autoTickChecklist } from \"./auto-tick.js\";\nimport { uploadAttachment } from \"./airtable/attachments.js\";\nimport type { AirtableBase } from \"./airtable/client.js\";\nimport { readGaConfig } from \"./ga/config.js\";\nimport { fetchPeriodUsers } from \"./ga/client.js\";\nimport { fetchSearchPresence } from \"./search/client.js\";\nimport type { SearchPresence } from \"./search/client.js\";\n\nexport type DraftOptions = {\n  /** Where to write the local preview HTML when `previewOnly`. Defaults to `reports/<slug>/draft.html`. */\n  previewPath?: string;\n  /** If true: render locally only, never touch Airtable. */\n  previewOnly?: boolean;\n  /** UTC \"YYYY-MM\" recurrence key; falls back to periodEnd's month when omitted. */\n  period?: string;\n  /** Airtable record id of an EXISTING (not-ready) row to COMPLETE in place rather\n   *  than creating a new one. When set, we skip createDraft and only re-render →\n   *  upload the HTML attachment → flip Draft ready on this row. Used by the --due\n   *  re-draft path to finish a draft whose createDraft succeeded but whose\n   *  setDraftReady never ran (a crash mid-sequence wedged the period). */\n  completeRowId?: string;\n  /** The mapped ReportRow being completed, returned as `reportRow` from the\n   *  complete path so callers keep the same shape they get on the create path. */\n  existingRow?: ReportRow;\n};\n\n/** An enrichment fetch that *errored* (not one that was legitimately skipped\n *  because it isn't configured / the site lacks the inputs). Surfaced so a\n *  fleet-wide GA/Search outage is visible in a `--due` batch summary instead of\n *  hiding behind one easily-missed console.warn per site. */\nexport type SoftFailure = \"ga\" | \"search\";\n\nexport type DraftResult = {\n  /** null when previewOnly. */\n  reportRow: ReportRow | null;\n  /** Path to the local preview file (only set when previewOnly). */\n  htmlPath: string | null;\n  /** Always present — the rendered HTML string. */\n  html: string;\n  /** Enrichment fetches that errored for this site (empty on success or skip). */\n  softFailures: SoftFailure[];\n  /** Whether the draft was placed in the approve queue. False when a higher-or-equal-tier\n   *  report is already queued for the site (single-queue rule); null on the previewOnly path. */\n  queued: boolean | null;\n  /** Ids of lower-tier queued reports this draft superseded (un-queued). */\n  supersededIds: string[];\n};\n\nfunction scoresFromWebsite(siteRow: WebsiteRow): LighthouseScores {\n  const { pScore, rScore, bpScore, seoScore } = siteRow;\n  if (pScore === null || rScore === null || bpScore === null || seoScore === null) {\n    throw new Error(\n      `Site '${siteRow.name}' is missing one or more Lighthouse scores on the Websites row (pScore, rScore, bpScore, seoScore). ` +\n        `Run 'reddoor-maint audit lighthouse' from the site's checkout and paste the four numbers into Airtable, then retry.`,\n    );\n  }\n  return { performance: pScore, accessibility: rScore, bestPractices: bpScore, seo: seoScore };\n}\n\nfunction daysAgo(today: Date, n: number): Date {\n  // UTC accessors to stay TZ-consistent with `due.ts` (and avoid landing\n  // Airtable's `Period start` on a different calendar day than the operator\n  // expects on late-night runs near a month boundary). See morning brief\n  // 2026-05-29 (M1) for context.\n  const out = new Date(today);\n  out.setUTCDate(out.getUTCDate() - n);\n  return out;\n}\n\n/**\n * Render and create an Airtable draft for one site.\n *\n * No idempotency guard here — the recurrence guard lives in draftDueReports\n * (cli/commands/report.ts), keyed on reportPeriodKey(dueDate).  The manual\n * single-site path intentionally always drafts (an operator asking for a draft\n * gets one).  findReportByPeriod (airtable/reports.ts) is the real-Airtable\n * point lookup available to dashboard/digest callers that need the same\n * idempotency guarantee outside the CLI batch loop.\n */\nexport async function draftReportForSite(\n  base: AirtableBase | null,\n  siteRow: WebsiteRow,\n  reportType: ReportType,\n  options: DraftOptions = {},\n): Promise<DraftResult> {\n  const scores = scoresFromWebsite(siteRow);\n\n  const today = new Date();\n  const slug = siteSlug(siteRow.name);\n\n  const periodStart =\n    base !== null ? await derivePeriodStart(base, siteRow, reportType, today) : daysAgo(today, 30);\n\n  const periodEnd = today;\n  const completedOn = today;\n  // \"Last Tested\" on the Maintenance email is the REAL timestamp of the most recent automated\n  // Lighthouse audit — stamped live on the Websites row (`Last lighthouse audit at`) by\n  // `audit lighthouse --write-airtable` every time the scores refresh. It is deliberately NOT\n  // the `testing day` field: that's the recurrence anchor consumed by due.ts and is hand-set, so\n  // it goes stale. Reading the audit timestamp keeps the date current with no manual upkeep.\n  const lastTestedDate =\n    reportType === \"Maintenance\" && siteRow.lastLighthouseAuditAt\n      ? new Date(siteRow.lastLighthouseAuditAt)\n      : null;\n\n  // GA enrichment (real path only). Soft-fail: any GA problem leaves the numbers null so\n  // the draft still proceeds (operator fills them manually) — GA is an enhancement, not a\n  // gate. Rendered with the fetched numbers so the review HTML matches the Airtable fields.\n  // An *error* (vs a legitimate not-configured skip) is recorded in softFailures so the\n  // caller can surface a fleet-wide outage in the batch summary.\n  const gaResult =\n    base !== null ? await fetchGaUsers(siteRow, periodStart, periodEnd) : NO_ENRICHMENT;\n  const searchResult =\n    base !== null ? await fetchSearch(siteRow, periodStart, periodEnd) : NO_ENRICHMENT;\n  const gaUsers = gaResult.value;\n  const search = searchResult.value;\n  const softFailures: SoftFailure[] = [\n    ...(gaResult.softFailed ? ([\"ga\"] as const) : []),\n    ...(searchResult.softFailed ? ([\"search\"] as const) : []),\n  ];\n\n  const cidName = `${slug}-header`;\n  const { html } = await renderReportHtml({\n    siteName: siteRow.name,\n    siteUrl: siteRow.url,\n    reportType,\n    completedOn,\n    lighthouse: scores,\n    gaUsersCurrent: gaUsers?.current,\n    gaUsersPrevious: gaUsers?.previous,\n    searchPosition: search?.foundOnPage1 ? (search.position ?? undefined) : undefined,\n    lastTestedDate,\n    commentary: null,\n    copy: resolveCopy(siteRow),\n    headerImageCid: cidName,\n  });\n\n  if (options.previewOnly) {\n    const path = options.previewPath ?? `reports/${slug}/draft.html`;\n    await mkdir(dirname(path), { recursive: true });\n    await writeFile(path, html, \"utf-8\");\n    return { reportRow: null, htmlPath: path, html, softFailures, queued: null, supersededIds: [] };\n  }\n\n  if (base === null) throw new Error(\"base required when previewOnly=false\");\n\n  // Record this site's GA/Search enrichment health for the per-site analytics-failure\n  // signal (cockpit/digest). Only when analytics is configured for THIS site — set the\n  // timestamp on a soft-fail, clear it (null) on a clean enrichment so the signal\n  // self-heals. Best-effort: the `Analytics soft-fail at` column is operator-added, so\n  // until it exists the write throws UNKNOWN_FIELD_NAME — which must NOT break drafting.\n  if (readGaConfig() !== null && Boolean(siteRow.ga4PropertyId || siteRow.searchQuery)) {\n    try {\n      await updateAnalyticsHealth(\n        base,\n        siteRow.id,\n        softFailures.length > 0 ? today.toISOString() : null,\n      );\n    } catch (e) {\n      console.warn(`⚠ analytics-health write skipped for ${siteRow.name}: ${(e as Error).message}`);\n    }\n  }\n\n  // \"Finish an existing row\" path (the --due re-draft wedge fix). When the caller\n  // hands us a row that was created but never made Draft-ready — a crash between\n  // createDraft and setDraftReady leaves exactly this — we DON'T createDraft again\n  // (that would duplicate the period). We re-attach the rendered HTML and queue the\n  // EXISTING row, completing the half-made draft in place. The row's other fields\n  // (scores, period, dates) were already written at create time; the only pieces a\n  // crash drops are the attachment + the ready flag.\n  if (options.completeRowId) {\n    await uploadDraftHtml(options.completeRowId, slug, periodEnd, html);\n    const outcome = await queueDraft(base, {\n      id: options.completeRowId,\n      siteId: siteRow.id,\n      reportType,\n    });\n    return {\n      reportRow: options.existingRow ?? null,\n      htmlPath: null,\n      html,\n      softFailures,\n      queued: outcome.queued,\n      supersededIds: outcome.supersededIds,\n    };\n  }\n\n  // Auto-tick the checklist boxes the system can prove (Phase 1: Google Indexed via the\n  // inline search signal). Fail-safe lives in autoTickChecklist: only `pass` entries are ticked;\n  // the evidence snapshot drives the dashboard's green/amber badges. The operator's approve gate\n  // and per-box override are unchanged.\n  const evidence = autoTickChecklist(siteRow, reportType, completedOn, { search: searchResult });\n  const checklistTicks = [...evidence.entries()]\n    .filter(([, e]) => e.result === \"pass\")\n    .map(([field]) => field);\n  const autoEvidence = Object.fromEntries(evidence);\n\n  const reportId = `${siteRow.name} — ${reportType} — ${periodEnd.toISOString().slice(0, 10)}`;\n  const created = await createDraft(base, {\n    reportId,\n    siteId: siteRow.id,\n    reportType,\n    period: options.period ?? periodEnd.toISOString().slice(0, 7),\n    periodStart,\n    periodEnd,\n    completedOn,\n    lighthouse: scores,\n    lastTestedDate,\n    ...(gaUsers ? { gaUsersCurrent: gaUsers.current, gaUsersPrevious: gaUsers.previous } : {}),\n    ...(search ? { searchFoundPage1: search.foundOnPage1 } : {}),\n    ...(search?.foundOnPage1 && search.position !== null\n      ? { searchPosition: search.position }\n      : {}),\n    checklistTicks,\n    autoEvidence,\n  });\n\n  await uploadDraftHtml(created.id, slug, periodEnd, html);\n  const outcome = await queueDraft(base, {\n    id: created.id,\n    siteId: siteRow.id,\n    reportType,\n  });\n\n  return {\n    reportRow: created,\n    htmlPath: null,\n    html,\n    softFailures,\n    queued: outcome.queued,\n    supersededIds: outcome.supersededIds,\n  };\n}\n\n/** Attach the rendered HTML to a Reports row. Queueing (Draft ready + the single-queue\n *  reconciliation) is handled separately by queueDraft so both the create path and the\n *  \"complete a half-made row\" path share the identical, re-runnable upload step. */\nasync function uploadDraftHtml(\n  rowId: string,\n  slug: string,\n  periodEnd: Date,\n  html: string,\n): Promise<void> {\n  const htmlFilename = `${slug}-${periodEnd.toISOString().slice(0, 10)}.html`;\n  await uploadAttachment(rowId, \"Rendered HTML\", html, htmlFilename, \"text/html\");\n}\n\n/** Result of an enrichment fetch: the value (null if unavailable) plus whether\n *  it errored (`softFailed`) as opposed to being legitimately not-configured. */\ntype Enrichment<T> = { value: T | null; softFailed: boolean };\n/** A not-configured / skipped enrichment — null value, not a soft-failure. */\nconst NO_ENRICHMENT: Enrichment<never> = { value: null, softFailed: false };\n\n/**\n * Fetch GA \"Users\" for the period, soft-failing to null. Returns a null value (no enrichment)\n * when GA isn't configured (`GA_SUBJECT` unset) or the site has no GA4 property ID — those are\n * legitimate skips, `softFailed: false`. When the GA API errors it logs a one-line warning and\n * returns `softFailed: true`. Never throws, so a GA problem can never block a draft; the\n * operator can always enter the numbers by hand.\n */\nexport async function fetchGaUsers(\n  siteRow: WebsiteRow,\n  periodStart: Date,\n  periodEnd: Date,\n): Promise<Enrichment<{ current: number; previous: number }>> {\n  const cfg = readGaConfig();\n  if (!cfg || !siteRow.ga4PropertyId) return NO_ENRICHMENT;\n  try {\n    const value = await fetchPeriodUsers(\n      { propertyId: siteRow.ga4PropertyId, subject: cfg.subject, keyPath: cfg.keyPath },\n      periodStart,\n      periodEnd,\n    );\n    return { value, softFailed: false };\n  } catch (e) {\n    console.warn(`⚠ GA skipped for ${siteRow.name}: ${(e as Error).message}`);\n    return { value: null, softFailed: true };\n  }\n}\n\n/**\n * Fetch the site's Google search presence for the period, soft-failing to null. Returns a null\n * value when GA/SA isn't configured (`readGaConfig()` null — search shares the SA credentials)\n * or the site has no `searchQuery` (legitimate skips, `softFailed: false`). When the Search\n * Console API errors it logs a one-line warning and returns `softFailed: true`. Never throws,\n * so a search problem can never block a draft.\n */\nexport async function fetchSearch(\n  siteRow: WebsiteRow,\n  periodStart: Date,\n  periodEnd: Date,\n): Promise<Enrichment<SearchPresence>> {\n  const cfg = readGaConfig();\n  if (!cfg || !siteRow.searchQuery) return NO_ENRICHMENT;\n  try {\n    const value = await fetchSearchPresence(\n      {\n        keyPath: cfg.keyPath,\n        subject: cfg.subject,\n        property: siteRow.searchConsoleProperty ?? undefined,\n        host: siteRow.url,\n        query: siteRow.searchQuery,\n      },\n      periodStart,\n      periodEnd,\n    );\n    return { value, softFailed: false };\n  } catch (e) {\n    console.warn(`⚠ Search presence skipped for ${siteRow.name}: ${(e as Error).message}`);\n    return { value: null, softFailed: true };\n  }\n}\n\nasync function derivePeriodStart(\n  base: AirtableBase,\n  siteRow: WebsiteRow,\n  reportType: ReportType,\n  today: Date,\n): Promise<Date> {\n  const prior = await listReportsForSite(base, siteRow.id);\n  const sameType = prior\n    .filter((r) => r.reportType === reportType && r.periodEnd)\n    .map((r) => r.periodEnd!)\n    .sort();\n  const latest = sameType[sameType.length - 1];\n  if (!latest) return daysAgo(today, 30);\n  // Half-open periods. The prior report's GA/Search windows are inclusive of its\n  // periodEnd, so starting this report on the *same* day double-counts that\n  // boundary day across two consecutive reports (and inflates the headline Users\n  // count). Start the next day instead. UTC to stay TZ-consistent with daysAgo.\n  const start = new Date(latest);\n  start.setUTCDate(start.getUTCDate() + 1);\n  return start;\n}\n","import type { ReportType } from \"./types.js\";\nimport type { WebsiteRow } from \"./airtable/websites.js\";\nimport type { SearchPresence } from \"./search/client.js\";\nimport { checklistFor } from \"./checklist.js\";\nimport { isNetlifyAppUrl } from \"../util/url.js\";\n\n/** A persisted audit signal is only trusted within this window — a stale \"pass\" degrades to\n *  \"unknown\" (no tick). Matches the github-signals staleness convention (~3 days). */\nconst STALE_DAYS = 3;\nconst MS_PER_DAY = 24 * 60 * 60 * 1000;\n\n/** True when `checkedAt` is a valid timestamp within STALE_DAYS of `now`. */\nfunction isFresh(checkedAt: string | null, now: Date): boolean {\n  if (!checkedAt) return false;\n  const t = new Date(checkedAt).getTime();\n  if (Number.isNaN(t)) return false;\n  return now.getTime() - t <= STALE_DAYS * MS_PER_DAY;\n}\n\n/** Cert-expiry buffer: a cert must have MORE than this many days left to pass (renew window).\n *  Exactly 14 days does NOT pass — matches the spec's strict \">14 days\" and the domain audit's\n *  own `> 14` pass status, so the two thresholds can't drift. */\nconst CERT_MIN_DAYS = 14;\n\n/** A single auto-check outcome. `pass` + fresh ⇒ the caller ticks the box. */\nexport type EvidenceResult = \"pass\" | \"fail\" | \"unknown\";\nexport type EvidenceRecord = { result: EvidenceResult; checkedAt: string | null; note: string };\n\n/**\n * Inline signals fetched during the draft. Phase 1 carries Search Console only; Phase 2/3 read\n * the remaining signals (security, domain, browser) off the Websites row passed as `site`.\n */\nexport type AutoTickSignals = {\n  search: { value: SearchPresence | null; softFailed: boolean };\n};\n\n/**\n * Decide, per checklist item for this report type, an evidence record — ONLY for items that\n * currently have a signal. Items with no signal are omitted, so the caller leaves them manual.\n * PURE. The fail-safe invariant lives here: a box is only tickable when `result === \"pass\"`.\n * Google Indexed is an inline signal (fetched at draft), so its evidence is inherently fresh\n * (`checkedAt = now`).\n */\nexport function autoTickChecklist(\n  site: WebsiteRow,\n  reportType: ReportType,\n  now: Date,\n  signals: AutoTickSignals,\n): Map<string, EvidenceRecord> {\n  const out = new Map<string, EvidenceRecord>();\n  const fields = new Set(checklistFor(reportType).map((i) => i.field));\n\n  // Google Indexed — Search Console (inline, always fresh).\n  if (fields.has(\"Maint: Google Indexed\")) {\n    const g = googleEvidence(now, signals.search);\n    if (g) out.set(\"Maint: Google Indexed\", g);\n  }\n\n  // Security Updates — the nightly `security` audit's persisted vuln counts.\n  if (fields.has(\"Maint: Security Updates\")) {\n    const s = securityEvidence(site, now);\n    if (s) out.set(\"Maint: Security Updates\", s);\n  }\n\n  // Domain, DNS & SSL — the nightly `domain` audit's persisted cert/resolve signal.\n  if (fields.has(\"Maint: Domain, DNS & SSL\")) {\n    const d = domainEvidence(site, now);\n    if (d) out.set(\"Maint: Domain, DNS & SSL\", d);\n  }\n\n  // Desktop / Mobile / Links — the nightly `browser` audit's persisted verdicts (one timestamp\n  // gates all three). Each is a stored boolean computed by the audit (multi-engine/route);\n  // here we add freshness + omit-when-absent.\n  if (fields.has(\"Test: Desktop Browsers\")) {\n    const e = browserEvidence(\n      site.crossbrowserOk,\n      site,\n      now,\n      \"Desktop renders cleanly\",\n      \"render errors\",\n    );\n    if (e) out.set(\"Test: Desktop Browsers\", e);\n  }\n  if (fields.has(\"Test: Mobile Browsers\")) {\n    const e = browserEvidence(\n      site.mobileOk,\n      site,\n      now,\n      \"Mobile renders cleanly\",\n      \"overflow/errors\",\n    );\n    if (e) out.set(\"Test: Mobile Browsers\", e);\n  }\n  if (fields.has(\"Test: Links & Navigation\")) {\n    const broken = site.brokenLinks;\n    const failNote = broken && broken > 0 ? `${broken} broken link(s)` : \"broken links / nav\";\n    const e = browserEvidence(site.linksOk, site, now, \"All internal links resolve\", failNote);\n    if (e) out.set(\"Test: Links & Navigation\", e);\n  }\n\n  return out;\n}\n\n/** One browser-audit verdict (Desktop/Mobile/Links) → evidence, gated on `Browser checked at`\n *  freshness. null verdict (never run) → omit (manual); stale → unknown; true → pass; false →\n *  fail (with the failure note). The verdict itself was computed by the audit (summarizeBrowser). */\nfunction browserEvidence(\n  ok: boolean | null,\n  site: WebsiteRow,\n  now: Date,\n  passNote: string,\n  failNote: string,\n): EvidenceRecord | null {\n  if (ok === null || !site.browserCheckedAt) return null;\n  const at = site.browserCheckedAt;\n  if (!isFresh(at, now)) {\n    return { result: \"unknown\", checkedAt: at, note: \"Browser check is stale (>3d)\" };\n  }\n  return ok\n    ? { result: \"pass\", checkedAt: at, note: passNote }\n    : { result: \"fail\", checkedAt: at, note: failNote };\n}\n\n/**\n * Security Updates evidence from the persisted `security` audit. Omits (→ manual) when the audit\n * never ran (counts null / no timestamp); stale → unknown; 0 critical AND 0 high → pass; any\n * critical/high → fail (with the count). Honest scope: \"no known critical/high advisories in the\n * declared dependencies as of the last audit\" — moderate/low are advisory, not gating, and this\n * does not prove the fix is deployed.\n */\nfunction securityEvidence(site: WebsiteRow, now: Date): EvidenceRecord | null {\n  const crit = site.securityVulnsCritical;\n  const high = site.securityVulnsHigh;\n  if (crit === null || high === null || !site.lastSecurityAuditAt) return null;\n  const at = site.lastSecurityAuditAt;\n  if (!isFresh(at, now)) {\n    return { result: \"unknown\", checkedAt: at, note: \"Security audit is stale (>3d)\" };\n  }\n  if (crit === 0 && high === 0) {\n    return { result: \"pass\", checkedAt: at, note: \"No known critical/high vulnerabilities\" };\n  }\n  return { result: \"fail\", checkedAt: at, note: `${crit} critical / ${high} high vuln(s)` };\n}\n\n/** Search Console → Google Indexed evidence. `null` (not configured) emits nothing so the box\n *  stays manual; a soft-fail is `unknown`; page-1 is `pass` (with the position in the note). */\nfunction googleEvidence(now: Date, search: AutoTickSignals[\"search\"]): EvidenceRecord | null {\n  const at = now.toISOString();\n  if (search.softFailed) {\n    return { result: \"unknown\", checkedAt: at, note: \"Search Console unavailable this run\" };\n  }\n  if (search.value === null) return null;\n  if (search.value.foundOnPage1) {\n    const pos = search.value.position;\n    return {\n      result: \"pass\",\n      checkedAt: at,\n      note: `Page 1 on Google${pos !== null ? ` (#${pos})` : \"\"}`,\n    };\n  }\n  const pos = search.value.position;\n  return {\n    result: \"fail\",\n    checkedAt: at,\n    note: `Not on page 1${pos !== null ? ` (avg #${pos})` : \"\"}`,\n  };\n}\n\n/**\n * Domain/DNS/SSL evidence from the persisted `domain` audit. Omits (→ manual) when there's no\n * custom domain to verify (`*.netlify.app`) or the audit never ran. A `pass` requires a fresh\n * check that resolved with a cert comfortably before expiry; stale → unknown; resolved-but-no-cert\n * or near/past expiry → fail. The honest scope is resolve + valid cert — NOT registrar expiry,\n * www↔apex redirect, or MX.\n */\nfunction domainEvidence(site: WebsiteRow, now: Date): EvidenceRecord | null {\n  // No custom domain to verify — the no-domain watch signal covers `*.netlify.app` elsewhere.\n  if (!site.url || isNetlifyAppUrl(site.url)) return null;\n  if (!site.domainCheckedAt) return null; // never probed → leave manual\n  const at = site.domainCheckedAt;\n  if (!isFresh(site.domainCheckedAt, now)) {\n    return { result: \"unknown\", checkedAt: at, note: \"Domain check is stale (>3d)\" };\n  }\n  const days = site.certDaysRemaining;\n  if (days === null) {\n    return { result: \"fail\", checkedAt: at, note: \"Did not resolve, or no valid TLS cert\" };\n  }\n  if (days <= CERT_MIN_DAYS) {\n    return { result: \"fail\", checkedAt: at, note: `TLS cert expires in ${days}d` };\n  }\n  return { result: \"pass\", checkedAt: at, note: `Custom domain, valid cert (${days}d left)` };\n}\n","import { readFileSync } from \"node:fs\";\nimport { JWT } from \"google-auth-library\";\nimport { BetaAnalyticsDataClient } from \"@google-analytics/data\";\n\nconst ANALYTICS_READONLY = \"https://www.googleapis.com/auth/analytics.readonly\";\nconst MS_PER_DAY = 86_400_000;\n\nexport type GaQuery = {\n  /** GA4 numeric property ID (e.g. \"471880366\"). */\n  propertyId: string;\n  /** Workspace user to impersonate via domain-wide delegation. */\n  subject: string;\n  /** Path to the service-account JSON key. */\n  keyPath: string;\n};\n\n/** UTC YYYY-MM-DD — matches the rest of the reports pipeline's date handling. */\nfunction ymd(d: Date): string {\n  return d.toISOString().slice(0, 10);\n}\n\n/**\n * Fetch GA4 `activeUsers` (\"Users\") for a report period and the equal-length window\n * immediately before it, via a domain-wide-delegation service account that impersonates\n * `subject`. Throws on any auth/API error — the caller (draftReportForSite) soft-fails.\n *\n * Previous window: same length as the current period, ending the day before `periodStart`.\n */\nexport async function fetchPeriodUsers(\n  query: GaQuery,\n  periodStart: Date,\n  periodEnd: Date,\n): Promise<{ current: number; previous: number }> {\n  const key = JSON.parse(readFileSync(query.keyPath, \"utf8\")) as {\n    client_email: string;\n    private_key: string;\n  };\n  const authClient = new JWT({\n    email: key.client_email,\n    key: key.private_key,\n    scopes: [ANALYTICS_READONLY],\n    subject: query.subject,\n  });\n  const client = new BetaAnalyticsDataClient({ authClient });\n\n  const lengthDays = Math.round((periodEnd.getTime() - periodStart.getTime()) / MS_PER_DAY);\n  const prevEnd = new Date(periodStart.getTime() - MS_PER_DAY);\n  const prevStart = new Date(prevEnd.getTime() - lengthDays * MS_PER_DAY);\n\n  const property = `properties/${query.propertyId}`;\n  const run = async (start: Date, end: Date): Promise<number> => {\n    const [resp] = await client.runReport({\n      property,\n      dateRanges: [{ startDate: ymd(start), endDate: ymd(end) }],\n      metrics: [{ name: \"activeUsers\" }],\n    });\n    const raw = resp.rows?.[0]?.metricValues?.[0]?.value ?? \"0\";\n    const n = Number.parseInt(raw, 10);\n    return Number.isFinite(n) ? n : 0;\n  };\n\n  const current = await run(periodStart, periodEnd);\n  const previous = await run(prevStart, prevEnd);\n  return { current, previous };\n}\n","import { readFileSync } from \"node:fs\";\nimport { JWT } from \"google-auth-library\";\n\nconst WEBMASTERS_READONLY = \"https://www.googleapis.com/auth/webmasters.readonly\";\nconst SC_BASE = \"https://searchconsole.googleapis.com/webmasters/v3\";\n/** Average-position threshold for \"on page 1\" (10 organic results per page). */\nconst PAGE_1_MAX_POSITION = 10;\n/** Rows to pull for the brand `contains` match. searchAnalytics has no orderBy and returns\n *  rows clicks-desc, so the exact-query row survives into the response only if it isn't paged\n *  out beyond this cap. Sized with wide headroom — a brand has a handful of phrasing variants,\n *  far below 100 — so the exact query (and every variant) is in practice always present. */\nexport const BRAND_QUERY_ROW_LIMIT = 100;\n\nexport type SearchPresenceQuery = {\n  /** Path to the service-account JSON key (same one GA uses). */\n  keyPath: string;\n  /** Workspace user to impersonate via domain-wide delegation. */\n  subject: string;\n  /** Explicit Search Console property (`sc-domain:...` or `https://.../`). Overrides auto-resolution. */\n  property?: string | undefined;\n  /** Site host, used to auto-resolve the property from `sites.list` when `property` is absent. */\n  host: string;\n  /** Operator-supplied brand hint (e.g. the business name). Matched as a case-insensitive\n   *  SUBSTRING (`contains`) of the actual user query — NOT a hard exact string — so it tolerates\n   *  phrasing (\"red door creative\" vs \"…creative la\"). An exact-query match is preferred when\n   *  present; otherwise the most-searched matching query wins. */\n  query: string;\n};\n\nexport type SearchPresence = {\n  /** True when the average position for the query is on page 1 (<= 10). */\n  foundOnPage1: boolean;\n  /** Rounded average position, or null when not found / no data. */\n  position: number | null;\n};\n\ntype SiteEntry = { siteUrl: string };\n\n/** Reduce any property string or URL to a bare host: no `sc-domain:`, scheme, `www.`, path, lowercased. */\nexport function bareHost(s: string): string {\n  return s\n    .trim()\n    .replace(/^sc-domain:/i, \"\")\n    .replace(/^https?:\\/\\//i, \"\")\n    .split(\"/\")[0]!\n    .replace(/^www\\./i, \"\")\n    .toLowerCase();\n}\n\n/**\n * All Search Console properties matching `host`, ordered for query fallback: Domain\n * (`sc-domain:`) forms first (broadest coverage), then URL-prefix forms. A site can be verified\n * as both; a freshly-created Domain property has no backfilled history, so its data can be empty\n * even while a long-lived URL-prefix property has data — hence we return every match and let the\n * caller try them in order until one returns data. Empty list = nothing matches.\n */\nexport function resolvePropertyCandidates(entries: SiteEntry[], host: string): string[] {\n  const target = bareHost(host);\n  const matches = entries.filter((e) => bareHost(e.siteUrl) === target).map((e) => e.siteUrl);\n  const domains = matches.filter((s) => s.toLowerCase().startsWith(\"sc-domain:\"));\n  const prefixes = matches.filter((s) => !s.toLowerCase().startsWith(\"sc-domain:\"));\n  return [...domains, ...prefixes];\n}\n\n/** UTC YYYY-MM-DD — matches the rest of the reports pipeline. */\nfunction ymd(d: Date): string {\n  return d.toISOString().slice(0, 10);\n}\n\n/**\n * From the queries matching the brand substring, pick the one the brand is actually FOUND\n * by most — the highest-impression row — and return its average position; tie-break on the\n * better (lower) position. Returns undefined when no row carries a numeric position. This is\n * what makes the reported \"brand search\" position robust to phrasing: with a `contains`\n * filter several variants can match, and we report the position of the variant real users\n * search most, not whichever the operator happened to type. Rows missing `impressions` count\n * as 0 (keeps a single-row, impression-less response — e.g. a test fixture — working). PURE.\n */\nexport function pickBrandQuery(\n  rows: Array<{ position?: number; impressions?: number }>,\n): number | undefined {\n  let best: { position: number; impressions: number } | undefined;\n  for (const r of rows) {\n    if (typeof r.position !== \"number\") continue;\n    const impressions = r.impressions ?? 0;\n    if (\n      best === undefined ||\n      impressions > best.impressions ||\n      (impressions === best.impressions && r.position < best.position)\n    ) {\n      best = { position: r.position, impressions };\n    }\n  }\n  return best?.position;\n}\n\n/**\n * The brand's reported position from the `contains`-matched rows, preferring an EXACT match.\n * When a returned row's query equals the operator's configured string (case-insensitive), its\n * position is used verbatim — a precisely-configured brand query is honored, with no chance a\n * longer higher-impression variant (\"…reviews\", \"…near me\") hijacks the number. Otherwise we\n * fall back to the most-searched matching query (`pickBrandQuery`). Operates only on the rows\n * actually returned: a string `contains` itself, so the exact query is among the `contains`\n * results whenever it has data AND isn't paged out beyond `BRAND_QUERY_ROW_LIMIT` (sized so a\n * brand's handful of phrasing variants always fit; if it ever were paged out, the most-searched\n * fallback still returns a valid brand position). Returns undefined when no row carries a\n * numeric position. PURE.\n */\nexport function selectBrandPosition(\n  rows: Array<{ keys?: string[]; position?: number; impressions?: number }>,\n  exactQuery: string,\n): number | undefined {\n  const want = exactQuery.toLowerCase();\n  const exact = rows.find(\n    (r) => typeof r.position === \"number\" && (r.keys?.[0] ?? \"\").toLowerCase() === want,\n  );\n  if (exact) return exact.position;\n  return pickBrandQuery(rows);\n}\n\n/**\n * Query Google Search Console for the brand's average position on the site over the report\n * period, via a domain-wide-delegation service account impersonating `subject`. `query` is a\n * case-insensitive SUBSTRING (`contains`) hint; among the matching user queries we report the\n * position of the exact-match query when present, else the most-searched one (see\n * `selectBrandPosition`) — so it doesn't depend on the operator typing the exact search string,\n * yet honors one verbatim when they do. Uses `property` verbatim when given (operator's\n * choice is final — no fallback); otherwise auto-discovers all matching properties via\n * `sites.list` and tries them in order (Domain first) until one returns data. Throws on any\n * auth/API error — the caller (draftReportForSite) soft-fails.\n */\nexport async function fetchSearchPresence(\n  q: SearchPresenceQuery,\n  periodStart: Date,\n  periodEnd: Date,\n): Promise<SearchPresence> {\n  const key = JSON.parse(readFileSync(q.keyPath, \"utf8\")) as {\n    client_email: string;\n    private_key: string;\n  };\n  const jwt = new JWT({\n    email: key.client_email,\n    key: key.private_key,\n    scopes: [WEBMASTERS_READONLY],\n    subject: q.subject,\n  });\n\n  const explicit = q.property?.trim();\n  let candidates: string[];\n  if (explicit) {\n    candidates = [explicit];\n  } else {\n    const list = await jwt.request<{ siteEntry?: SiteEntry[] }>({\n      url: `${SC_BASE}/sites`,\n      method: \"GET\",\n    });\n    candidates = resolvePropertyCandidates(list.data.siteEntry ?? [], q.host);\n    if (candidates.length === 0) return { foundOnPage1: false, position: null };\n  }\n\n  for (const property of candidates) {\n    const res = await jwt.request<{\n      rows?: Array<{ keys?: string[]; position?: number; impressions?: number }>;\n    }>({\n      url: `${SC_BASE}/sites/${encodeURIComponent(property)}/searchAnalytics/query`,\n      method: \"POST\",\n      data: {\n        startDate: ymd(periodStart),\n        endDate: ymd(periodEnd),\n        dimensions: [\"query\"],\n        dimensionFilterGroups: [\n          {\n            filters: [\n              { dimension: \"query\", operator: \"contains\", expression: q.query.toLowerCase() },\n            ],\n          },\n        ],\n        rowLimit: BRAND_QUERY_ROW_LIMIT,\n      },\n    });\n    const pos = selectBrandPosition(res.data.rows ?? [], q.query.toLowerCase());\n    if (typeof pos === \"number\") {\n      // Search Console can average below 1; floor to 1 so the template never\n      // renders a nonsensical \"#0\" (positions are 1-indexed).\n      return { foundOnPage1: pos <= PAGE_1_MAX_POSITION, position: Math.max(1, Math.round(pos)) };\n    }\n  }\n  return { foundOnPage1: false, position: null };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS,YAAY;AAkBvB,SAAS,eAAgC;AAC9C,QAAM,UAAU,QAAQ,IAAI,YAAY,KAAK;AAC7C,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,UACJ,QAAQ,IAAI,gBAAgB,KAAK,KACjC,KAAK,QAAQ,uBAAuB,CAAC,GAAG,yBAAyB;AACnE,SAAO,EAAE,SAAS,QAAQ;AAC5B;;;ACzBA,SAAS,OAAO,iBAAiB;AACjC,SAAS,WAAAA,gBAAe;;;ACOxB,IAAM,aAAa;AACnB,IAAM,aAAa,KAAK,KAAK,KAAK;AAGlC,SAAS,QAAQ,WAA0B,KAAoB;AAC7D,MAAI,CAAC,UAAW,QAAO;AACvB,QAAM,IAAI,IAAI,KAAK,SAAS,EAAE,QAAQ;AACtC,MAAI,OAAO,MAAM,CAAC,EAAG,QAAO;AAC5B,SAAO,IAAI,QAAQ,IAAI,KAAK,aAAa;AAC3C;AAKA,IAAM,gBAAgB;AAqBf,SAAS,kBACd,MACA,YACA,KACA,SAC6B;AAC7B,QAAM,MAAM,oBAAI,IAA4B;AAC5C,QAAM,SAAS,IAAI,IAAI,aAAa,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC;AAGnE,MAAI,OAAO,IAAI,uBAAuB,GAAG;AACvC,UAAM,IAAI,eAAe,KAAK,QAAQ,MAAM;AAC5C,QAAI,EAAG,KAAI,IAAI,yBAAyB,CAAC;AAAA,EAC3C;AAGA,MAAI,OAAO,IAAI,yBAAyB,GAAG;AACzC,UAAM,IAAI,iBAAiB,MAAM,GAAG;AACpC,QAAI,EAAG,KAAI,IAAI,2BAA2B,CAAC;AAAA,EAC7C;AAGA,MAAI,OAAO,IAAI,0BAA0B,GAAG;AAC1C,UAAM,IAAI,eAAe,MAAM,GAAG;AAClC,QAAI,EAAG,KAAI,IAAI,4BAA4B,CAAC;AAAA,EAC9C;AAKA,MAAI,OAAO,IAAI,wBAAwB,GAAG;AACxC,UAAM,IAAI;AAAA,MACR,KAAK;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,EAAG,KAAI,IAAI,0BAA0B,CAAC;AAAA,EAC5C;AACA,MAAI,OAAO,IAAI,uBAAuB,GAAG;AACvC,UAAM,IAAI;AAAA,MACR,KAAK;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,EAAG,KAAI,IAAI,yBAAyB,CAAC;AAAA,EAC3C;AACA,MAAI,OAAO,IAAI,0BAA0B,GAAG;AAC1C,UAAM,SAAS,KAAK;AACpB,UAAM,WAAW,UAAU,SAAS,IAAI,GAAG,MAAM,oBAAoB;AACrE,UAAM,IAAI,gBAAgB,KAAK,SAAS,MAAM,KAAK,8BAA8B,QAAQ;AACzF,QAAI,EAAG,KAAI,IAAI,4BAA4B,CAAC;AAAA,EAC9C;AAEA,SAAO;AACT;AAKA,SAAS,gBACP,IACA,MACA,KACA,UACA,UACuB;AACvB,MAAI,OAAO,QAAQ,CAAC,KAAK,iBAAkB,QAAO;AAClD,QAAM,KAAK,KAAK;AAChB,MAAI,CAAC,QAAQ,IAAI,GAAG,GAAG;AACrB,WAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,+BAA+B;AAAA,EAClF;AACA,SAAO,KACH,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,SAAS,IAChD,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,SAAS;AACtD;AASA,SAAS,iBAAiB,MAAkB,KAAkC;AAC5E,QAAM,OAAO,KAAK;AAClB,QAAM,OAAO,KAAK;AAClB,MAAI,SAAS,QAAQ,SAAS,QAAQ,CAAC,KAAK,oBAAqB,QAAO;AACxE,QAAM,KAAK,KAAK;AAChB,MAAI,CAAC,QAAQ,IAAI,GAAG,GAAG;AACrB,WAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,gCAAgC;AAAA,EACnF;AACA,MAAI,SAAS,KAAK,SAAS,GAAG;AAC5B,WAAO,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,yCAAyC;AAAA,EACzF;AACA,SAAO,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,GAAG,IAAI,eAAe,IAAI,gBAAgB;AAC1F;AAIA,SAAS,eAAe,KAAW,QAA0D;AAC3F,QAAM,KAAK,IAAI,YAAY;AAC3B,MAAI,OAAO,YAAY;AACrB,WAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,sCAAsC;AAAA,EACzF;AACA,MAAI,OAAO,UAAU,KAAM,QAAO;AAClC,MAAI,OAAO,MAAM,cAAc;AAC7B,UAAMC,OAAM,OAAO,MAAM;AACzB,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,WAAW;AAAA,MACX,MAAM,mBAAmBA,SAAQ,OAAO,MAAMA,IAAG,MAAM,EAAE;AAAA,IAC3D;AAAA,EACF;AACA,QAAM,MAAM,OAAO,MAAM;AACzB,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,WAAW;AAAA,IACX,MAAM,gBAAgB,QAAQ,OAAO,UAAU,GAAG,MAAM,EAAE;AAAA,EAC5D;AACF;AASA,SAAS,eAAe,MAAkB,KAAkC;AAE1E,MAAI,CAAC,KAAK,OAAO,gBAAgB,KAAK,GAAG,EAAG,QAAO;AACnD,MAAI,CAAC,KAAK,gBAAiB,QAAO;AAClC,QAAM,KAAK,KAAK;AAChB,MAAI,CAAC,QAAQ,KAAK,iBAAiB,GAAG,GAAG;AACvC,WAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,8BAA8B;AAAA,EACjF;AACA,QAAM,OAAO,KAAK;AAClB,MAAI,SAAS,MAAM;AACjB,WAAO,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,wCAAwC;AAAA,EACxF;AACA,MAAI,QAAQ,eAAe;AACzB,WAAO,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,uBAAuB,IAAI,IAAI;AAAA,EAC/E;AACA,SAAO,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,8BAA8B,IAAI,UAAU;AAC5F;;;AC/LA,SAAS,oBAAoB;AAC7B,SAAS,WAAW;AACpB,SAAS,+BAA+B;AAExC,IAAM,qBAAqB;AAC3B,IAAMC,cAAa;AAYnB,SAAS,IAAI,GAAiB;AAC5B,SAAO,EAAE,YAAY,EAAE,MAAM,GAAG,EAAE;AACpC;AASA,eAAsB,iBACpB,OACA,aACA,WACgD;AAChD,QAAM,MAAM,KAAK,MAAM,aAAa,MAAM,SAAS,MAAM,CAAC;AAI1D,QAAM,aAAa,IAAI,IAAI;AAAA,IACzB,OAAO,IAAI;AAAA,IACX,KAAK,IAAI;AAAA,IACT,QAAQ,CAAC,kBAAkB;AAAA,IAC3B,SAAS,MAAM;AAAA,EACjB,CAAC;AACD,QAAM,SAAS,IAAI,wBAAwB,EAAE,WAAW,CAAC;AAEzD,QAAM,aAAa,KAAK,OAAO,UAAU,QAAQ,IAAI,YAAY,QAAQ,KAAKA,WAAU;AACxF,QAAM,UAAU,IAAI,KAAK,YAAY,QAAQ,IAAIA,WAAU;AAC3D,QAAM,YAAY,IAAI,KAAK,QAAQ,QAAQ,IAAI,aAAaA,WAAU;AAEtE,QAAM,WAAW,cAAc,MAAM,UAAU;AAC/C,QAAM,MAAM,OAAO,OAAa,QAA+B;AAC7D,UAAM,CAAC,IAAI,IAAI,MAAM,OAAO,UAAU;AAAA,MACpC;AAAA,MACA,YAAY,CAAC,EAAE,WAAW,IAAI,KAAK,GAAG,SAAS,IAAI,GAAG,EAAE,CAAC;AAAA,MACzD,SAAS,CAAC,EAAE,MAAM,cAAc,CAAC;AAAA,IACnC,CAAC;AACD,UAAM,MAAM,KAAK,OAAO,CAAC,GAAG,eAAe,CAAC,GAAG,SAAS;AACxD,UAAM,IAAI,OAAO,SAAS,KAAK,EAAE;AACjC,WAAO,OAAO,SAAS,CAAC,IAAI,IAAI;AAAA,EAClC;AAEA,QAAM,UAAU,MAAM,IAAI,aAAa,SAAS;AAChD,QAAM,WAAW,MAAM,IAAI,WAAW,OAAO;AAC7C,SAAO,EAAE,SAAS,SAAS;AAC7B;;;AChEA,SAAS,gBAAAC,qBAAoB;AAC7B,SAAS,OAAAC,YAAW;AAEpB,IAAM,sBAAsB;AAC5B,IAAM,UAAU;AAEhB,IAAM,sBAAsB;AAKrB,IAAM,wBAAwB;AA4B9B,SAAS,SAAS,GAAmB;AAC1C,SAAO,EACJ,KAAK,EACL,QAAQ,gBAAgB,EAAE,EAC1B,QAAQ,iBAAiB,EAAE,EAC3B,MAAM,GAAG,EAAE,CAAC,EACZ,QAAQ,WAAW,EAAE,EACrB,YAAY;AACjB;AASO,SAAS,0BAA0B,SAAsB,MAAwB;AACtF,QAAM,SAAS,SAAS,IAAI;AAC5B,QAAM,UAAU,QAAQ,OAAO,CAAC,MAAM,SAAS,EAAE,OAAO,MAAM,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO;AAC1F,QAAM,UAAU,QAAQ,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,WAAW,YAAY,CAAC;AAC9E,QAAM,WAAW,QAAQ,OAAO,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,WAAW,YAAY,CAAC;AAChF,SAAO,CAAC,GAAG,SAAS,GAAG,QAAQ;AACjC;AAGA,SAASC,KAAI,GAAiB;AAC5B,SAAO,EAAE,YAAY,EAAE,MAAM,GAAG,EAAE;AACpC;AAWO,SAAS,eACd,MACoB;AACpB,MAAI;AACJ,aAAW,KAAK,MAAM;AACpB,QAAI,OAAO,EAAE,aAAa,SAAU;AACpC,UAAM,cAAc,EAAE,eAAe;AACrC,QACE,SAAS,UACT,cAAc,KAAK,eAClB,gBAAgB,KAAK,eAAe,EAAE,WAAW,KAAK,UACvD;AACA,aAAO,EAAE,UAAU,EAAE,UAAU,YAAY;AAAA,IAC7C;AAAA,EACF;AACA,SAAO,MAAM;AACf;AAcO,SAAS,oBACd,MACA,YACoB;AACpB,QAAM,OAAO,WAAW,YAAY;AACpC,QAAM,QAAQ,KAAK;AAAA,IACjB,CAAC,MAAM,OAAO,EAAE,aAAa,aAAa,EAAE,OAAO,CAAC,KAAK,IAAI,YAAY,MAAM;AAAA,EACjF;AACA,MAAI,MAAO,QAAO,MAAM;AACxB,SAAO,eAAe,IAAI;AAC5B;AAaA,eAAsB,oBACpB,GACA,aACA,WACyB;AACzB,QAAM,MAAM,KAAK,MAAMF,cAAa,EAAE,SAAS,MAAM,CAAC;AAItD,QAAM,MAAM,IAAIC,KAAI;AAAA,IAClB,OAAO,IAAI;AAAA,IACX,KAAK,IAAI;AAAA,IACT,QAAQ,CAAC,mBAAmB;AAAA,IAC5B,SAAS,EAAE;AAAA,EACb,CAAC;AAED,QAAM,WAAW,EAAE,UAAU,KAAK;AAClC,MAAI;AACJ,MAAI,UAAU;AACZ,iBAAa,CAAC,QAAQ;AAAA,EACxB,OAAO;AACL,UAAM,OAAO,MAAM,IAAI,QAAqC;AAAA,MAC1D,KAAK,GAAG,OAAO;AAAA,MACf,QAAQ;AAAA,IACV,CAAC;AACD,iBAAa,0BAA0B,KAAK,KAAK,aAAa,CAAC,GAAG,EAAE,IAAI;AACxE,QAAI,WAAW,WAAW,EAAG,QAAO,EAAE,cAAc,OAAO,UAAU,KAAK;AAAA,EAC5E;AAEA,aAAW,YAAY,YAAY;AACjC,UAAM,MAAM,MAAM,IAAI,QAEnB;AAAA,MACD,KAAK,GAAG,OAAO,UAAU,mBAAmB,QAAQ,CAAC;AAAA,MACrD,QAAQ;AAAA,MACR,MAAM;AAAA,QACJ,WAAWC,KAAI,WAAW;AAAA,QAC1B,SAASA,KAAI,SAAS;AAAA,QACtB,YAAY,CAAC,OAAO;AAAA,QACpB,uBAAuB;AAAA,UACrB;AAAA,YACE,SAAS;AAAA,cACP,EAAE,WAAW,SAAS,UAAU,YAAY,YAAY,EAAE,MAAM,YAAY,EAAE;AAAA,YAChF;AAAA,UACF;AAAA,QACF;AAAA,QACA,UAAU;AAAA,MACZ;AAAA,IACF,CAAC;AACD,UAAM,MAAM,oBAAoB,IAAI,KAAK,QAAQ,CAAC,GAAG,EAAE,MAAM,YAAY,CAAC;AAC1E,QAAI,OAAO,QAAQ,UAAU;AAG3B,aAAO,EAAE,cAAc,OAAO,qBAAqB,UAAU,KAAK,IAAI,GAAG,KAAK,MAAM,GAAG,CAAC,EAAE;AAAA,IAC5F;AAAA,EACF;AACA,SAAO,EAAE,cAAc,OAAO,UAAU,KAAK;AAC/C;;;AHlIA,SAAS,kBAAkB,SAAuC;AAChE,QAAM,EAAE,QAAQ,QAAQ,SAAS,SAAS,IAAI;AAC9C,MAAI,WAAW,QAAQ,WAAW,QAAQ,YAAY,QAAQ,aAAa,MAAM;AAC/E,UAAM,IAAI;AAAA,MACR,SAAS,QAAQ,IAAI;AAAA,IAEvB;AAAA,EACF;AACA,SAAO,EAAE,aAAa,QAAQ,eAAe,QAAQ,eAAe,SAAS,KAAK,SAAS;AAC7F;AAEA,SAAS,QAAQ,OAAa,GAAiB;AAK7C,QAAM,MAAM,IAAI,KAAK,KAAK;AAC1B,MAAI,WAAW,IAAI,WAAW,IAAI,CAAC;AACnC,SAAO;AACT;AAYA,eAAsB,mBACpB,MACA,SACA,YACA,UAAwB,CAAC,GACH;AACtB,QAAM,SAAS,kBAAkB,OAAO;AAExC,QAAM,QAAQ,oBAAI,KAAK;AACvB,QAAM,OAAO,SAAS,QAAQ,IAAI;AAElC,QAAM,cACJ,SAAS,OAAO,MAAM,kBAAkB,MAAM,SAAS,YAAY,KAAK,IAAI,QAAQ,OAAO,EAAE;AAE/F,QAAM,YAAY;AAClB,QAAM,cAAc;AAMpB,QAAM,iBACJ,eAAe,iBAAiB,QAAQ,wBACpC,IAAI,KAAK,QAAQ,qBAAqB,IACtC;AAON,QAAM,WACJ,SAAS,OAAO,MAAM,aAAa,SAAS,aAAa,SAAS,IAAI;AACxE,QAAM,eACJ,SAAS,OAAO,MAAM,YAAY,SAAS,aAAa,SAAS,IAAI;AACvE,QAAM,UAAU,SAAS;AACzB,QAAM,SAAS,aAAa;AAC5B,QAAM,eAA8B;AAAA,IAClC,GAAI,SAAS,aAAc,CAAC,IAAI,IAAc,CAAC;AAAA,IAC/C,GAAI,aAAa,aAAc,CAAC,QAAQ,IAAc,CAAC;AAAA,EACzD;AAEA,QAAM,UAAU,GAAG,IAAI;AACvB,QAAM,EAAE,KAAK,IAAI,MAAM,iBAAiB;AAAA,IACtC,UAAU,QAAQ;AAAA,IAClB,SAAS,QAAQ;AAAA,IACjB;AAAA,IACA;AAAA,IACA,YAAY;AAAA,IACZ,gBAAgB,SAAS;AAAA,IACzB,iBAAiB,SAAS;AAAA,IAC1B,gBAAgB,QAAQ,eAAgB,OAAO,YAAY,SAAa;AAAA,IACxE;AAAA,IACA,YAAY;AAAA,IACZ,MAAM,YAAY,OAAO;AAAA,IACzB,gBAAgB;AAAA,EAClB,CAAC;AAED,MAAI,QAAQ,aAAa;AACvB,UAAM,OAAO,QAAQ,eAAe,WAAW,IAAI;AACnD,UAAM,MAAMC,SAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AAC9C,UAAM,UAAU,MAAM,MAAM,OAAO;AACnC,WAAO,EAAE,WAAW,MAAM,UAAU,MAAM,MAAM,cAAc,QAAQ,MAAM,eAAe,CAAC,EAAE;AAAA,EAChG;AAEA,MAAI,SAAS,KAAM,OAAM,IAAI,MAAM,sCAAsC;AAOzE,MAAI,aAAa,MAAM,QAAQ,QAAQ,QAAQ,iBAAiB,QAAQ,WAAW,GAAG;AACpF,QAAI;AACF,YAAM;AAAA,QACJ;AAAA,QACA,QAAQ;AAAA,QACR,aAAa,SAAS,IAAI,MAAM,YAAY,IAAI;AAAA,MAClD;AAAA,IACF,SAAS,GAAG;AACV,cAAQ,KAAK,6CAAwC,QAAQ,IAAI,KAAM,EAAY,OAAO,EAAE;AAAA,IAC9F;AAAA,EACF;AASA,MAAI,QAAQ,eAAe;AACzB,UAAM,gBAAgB,QAAQ,eAAe,MAAM,WAAW,IAAI;AAClE,UAAMC,WAAU,MAAM,WAAW,MAAM;AAAA,MACrC,IAAI,QAAQ;AAAA,MACZ,QAAQ,QAAQ;AAAA,MAChB;AAAA,IACF,CAAC;AACD,WAAO;AAAA,MACL,WAAW,QAAQ,eAAe;AAAA,MAClC,UAAU;AAAA,MACV;AAAA,MACA;AAAA,MACA,QAAQA,SAAQ;AAAA,MAChB,eAAeA,SAAQ;AAAA,IACzB;AAAA,EACF;AAMA,QAAM,WAAW,kBAAkB,SAAS,YAAY,aAAa,EAAE,QAAQ,aAAa,CAAC;AAC7F,QAAM,iBAAiB,CAAC,GAAG,SAAS,QAAQ,CAAC,EAC1C,OAAO,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,MAAM,EACrC,IAAI,CAAC,CAAC,KAAK,MAAM,KAAK;AACzB,QAAM,eAAe,OAAO,YAAY,QAAQ;AAEhD,QAAM,WAAW,GAAG,QAAQ,IAAI,WAAM,UAAU,WAAM,UAAU,YAAY,EAAE,MAAM,GAAG,EAAE,CAAC;AAC1F,QAAM,UAAU,MAAM,YAAY,MAAM;AAAA,IACtC;AAAA,IACA,QAAQ,QAAQ;AAAA,IAChB;AAAA,IACA,QAAQ,QAAQ,UAAU,UAAU,YAAY,EAAE,MAAM,GAAG,CAAC;AAAA,IAC5D;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY;AAAA,IACZ;AAAA,IACA,GAAI,UAAU,EAAE,gBAAgB,QAAQ,SAAS,iBAAiB,QAAQ,SAAS,IAAI,CAAC;AAAA,IACxF,GAAI,SAAS,EAAE,kBAAkB,OAAO,aAAa,IAAI,CAAC;AAAA,IAC1D,GAAI,QAAQ,gBAAgB,OAAO,aAAa,OAC5C,EAAE,gBAAgB,OAAO,SAAS,IAClC,CAAC;AAAA,IACL;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,gBAAgB,QAAQ,IAAI,MAAM,WAAW,IAAI;AACvD,QAAM,UAAU,MAAM,WAAW,MAAM;AAAA,IACrC,IAAI,QAAQ;AAAA,IACZ,QAAQ,QAAQ;AAAA,IAChB;AAAA,EACF,CAAC;AAED,SAAO;AAAA,IACL,WAAW;AAAA,IACX,UAAU;AAAA,IACV;AAAA,IACA;AAAA,IACA,QAAQ,QAAQ;AAAA,IAChB,eAAe,QAAQ;AAAA,EACzB;AACF;AAKA,eAAe,gBACb,OACA,MACA,WACA,MACe;AACf,QAAM,eAAe,GAAG,IAAI,IAAI,UAAU,YAAY,EAAE,MAAM,GAAG,EAAE,CAAC;AACpE,QAAM,iBAAiB,OAAO,iBAAiB,MAAM,cAAc,WAAW;AAChF;AAMA,IAAM,gBAAmC,EAAE,OAAO,MAAM,YAAY,MAAM;AAS1E,eAAsB,aACpB,SACA,aACA,WAC4D;AAC5D,QAAM,MAAM,aAAa;AACzB,MAAI,CAAC,OAAO,CAAC,QAAQ,cAAe,QAAO;AAC3C,MAAI;AACF,UAAM,QAAQ,MAAM;AAAA,MAClB,EAAE,YAAY,QAAQ,eAAe,SAAS,IAAI,SAAS,SAAS,IAAI,QAAQ;AAAA,MAChF;AAAA,MACA;AAAA,IACF;AACA,WAAO,EAAE,OAAO,YAAY,MAAM;AAAA,EACpC,SAAS,GAAG;AACV,YAAQ,KAAK,yBAAoB,QAAQ,IAAI,KAAM,EAAY,OAAO,EAAE;AACxE,WAAO,EAAE,OAAO,MAAM,YAAY,KAAK;AAAA,EACzC;AACF;AASA,eAAsB,YACpB,SACA,aACA,WACqC;AACrC,QAAM,MAAM,aAAa;AACzB,MAAI,CAAC,OAAO,CAAC,QAAQ,YAAa,QAAO;AACzC,MAAI;AACF,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,QACE,SAAS,IAAI;AAAA,QACb,SAAS,IAAI;AAAA,QACb,UAAU,QAAQ,yBAAyB;AAAA,QAC3C,MAAM,QAAQ;AAAA,QACd,OAAO,QAAQ;AAAA,MACjB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,WAAO,EAAE,OAAO,YAAY,MAAM;AAAA,EACpC,SAAS,GAAG;AACV,YAAQ,KAAK,sCAAiC,QAAQ,IAAI,KAAM,EAAY,OAAO,EAAE;AACrF,WAAO,EAAE,OAAO,MAAM,YAAY,KAAK;AAAA,EACzC;AACF;AAEA,eAAe,kBACb,MACA,SACA,YACA,OACe;AACf,QAAM,QAAQ,MAAM,mBAAmB,MAAM,QAAQ,EAAE;AACvD,QAAM,WAAW,MACd,OAAO,CAAC,MAAM,EAAE,eAAe,cAAc,EAAE,SAAS,EACxD,IAAI,CAAC,MAAM,EAAE,SAAU,EACvB,KAAK;AACR,QAAM,SAAS,SAAS,SAAS,SAAS,CAAC;AAC3C,MAAI,CAAC,OAAQ,QAAO,QAAQ,OAAO,EAAE;AAKrC,QAAM,QAAQ,IAAI,KAAK,MAAM;AAC7B,QAAM,WAAW,MAAM,WAAW,IAAI,CAAC;AACvC,SAAO;AACT;","names":["dirname","pos","MS_PER_DAY","readFileSync","JWT","ymd","dirname","outcome"]}

package/dist/chunk-WEKL2HYJ.js

@@ -0,0 +1,31 @@
+// src/reports/send/resend.ts
+import { Resend } from "resend";
+function defaultResendClient() {
+  const key = process.env.RESEND_API_KEY;
+  if (!key) throw Object.assign(new Error("RESEND_API_KEY not set"), { exitCode: 2 });
+  const resend = new Resend(key);
+  return {
+    async send(input) {
+      const payload = {
+        from: input.from,
+        to: input.to,
+        subject: input.subject,
+        html: input.html
+      };
+      if (input.cc) payload.cc = input.cc;
+      if (input.replyTo) payload.replyTo = input.replyTo;
+      if (input.attachments) payload.attachments = input.attachments;
+      const options = {};
+      if (input.idempotencyKey) options.idempotencyKey = input.idempotencyKey;
+      const { data, error } = await resend.emails.send(payload, options);
+      if (error) throw new Error(`Resend error: ${error.message}`);
+      if (!data?.id) throw new Error("Resend returned no message id");
+      return { messageId: data.id };
+    }
+  };
+}
+
+export {
+  defaultResendClient
+};
+//# sourceMappingURL=chunk-WEKL2HYJ.js.map

package/dist/chunk-WEKL2HYJ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/reports/send/resend.ts"],"sourcesContent":["import { Resend } from \"resend\";\n\nexport type ResendSendInput = {\n  from: string;\n  to: string[];\n  cc?: string[];\n  replyTo?: string;\n  subject: string;\n  html: string;\n  attachments?: Array<{\n    filename: string;\n    content: string; // base64\n    contentType?: string;\n    /** Setting this attaches the file as inline; reference it from HTML as `src=\"cid:<id>\"`. */\n    inlineContentId?: string;\n  }>;\n  /**\n   * Stable key forwarded as the `Idempotency-Key` header. Resend dedupes calls\n   * with the same key for 24 hours, returning the original message id. Use a\n   * key that's stable across retries of the same logical send (e.g. the\n   * Reports row id), so a network blip during stamping doesn't cause a\n   * duplicate email to the client.\n   */\n  idempotencyKey?: string;\n};\n\nexport type ResendSendResult = {\n  messageId: string;\n};\n\nexport type ResendClient = {\n  send: (input: ResendSendInput) => Promise<ResendSendResult>;\n};\n\nexport function defaultResendClient(): ResendClient {\n  const key = process.env.RESEND_API_KEY;\n  if (!key) throw Object.assign(new Error(\"RESEND_API_KEY not set\"), { exitCode: 2 });\n  const resend = new Resend(key);\n  return {\n    async send(input) {\n      const payload: Parameters<typeof resend.emails.send>[0] = {\n        from: input.from,\n        to: input.to,\n        subject: input.subject,\n        html: input.html,\n      };\n      if (input.cc) payload.cc = input.cc;\n      if (input.replyTo) payload.replyTo = input.replyTo;\n      if (input.attachments) payload.attachments = input.attachments;\n      const options: Parameters<typeof resend.emails.send>[1] = {};\n      if (input.idempotencyKey) options.idempotencyKey = input.idempotencyKey;\n      const { data, error } = await resend.emails.send(payload, options);\n      if (error) throw new Error(`Resend error: ${error.message}`);\n      if (!data?.id) throw new Error(\"Resend returned no message id\");\n      return { messageId: data.id };\n    },\n  };\n}\n"],"mappings":";AAAA,SAAS,cAAc;AAkChB,SAAS,sBAAoC;AAClD,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,CAAC,IAAK,OAAM,OAAO,OAAO,IAAI,MAAM,wBAAwB,GAAG,EAAE,UAAU,EAAE,CAAC;AAClF,QAAM,SAAS,IAAI,OAAO,GAAG;AAC7B,SAAO;AAAA,IACL,MAAM,KAAK,OAAO;AAChB,YAAM,UAAoD;AAAA,QACxD,MAAM,MAAM;AAAA,QACZ,IAAI,MAAM;AAAA,QACV,SAAS,MAAM;AAAA,QACf,MAAM,MAAM;AAAA,MACd;AACA,UAAI,MAAM,GAAI,SAAQ,KAAK,MAAM;AACjC,UAAI,MAAM,QAAS,SAAQ,UAAU,MAAM;AAC3C,UAAI,MAAM,YAAa,SAAQ,cAAc,MAAM;AACnD,YAAM,UAAoD,CAAC;AAC3D,UAAI,MAAM,eAAgB,SAAQ,iBAAiB,MAAM;AACzD,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,OAAO,KAAK,SAAS,OAAO;AACjE,UAAI,MAAO,OAAM,IAAI,MAAM,iBAAiB,MAAM,OAAO,EAAE;AAC3D,UAAI,CAAC,MAAM,GAAI,OAAM,IAAI,MAAM,+BAA+B;AAC9D,aAAO,EAAE,WAAW,KAAK,GAAG;AAAA,IAC9B;AAAA,EACF;AACF;","names":[]}

package/dist/chunk-WVRPOXKH.js

@@ -0,0 +1,74 @@
+// src/reports/due.ts
+var ELIGIBLE_STATUSES = /* @__PURE__ */ new Set([
+  "in development",
+  "launch period",
+  "maintenance",
+  "hosting"
+]);
+var MONTHS = {
+  Monthly: 1,
+  Quarterly: 3,
+  Yearly: 12
+};
+function addMonths(d, n) {
+  const out = new Date(d);
+  const day = out.getUTCDate();
+  out.setUTCDate(1);
+  out.setUTCMonth(out.getUTCMonth() + n);
+  const lastDayOfTargetMonth = new Date(
+    Date.UTC(out.getUTCFullYear(), out.getUTCMonth() + 1, 0)
+  ).getUTCDate();
+  out.setUTCDate(Math.min(day, lastDayOfTargetMonth));
+  return out;
+}
+function startOfDay(d) {
+  const out = new Date(d);
+  out.setUTCHours(0, 0, 0, 0);
+  return out;
+}
+function lastSentForType(reports, siteId, type) {
+  const candidates = reports.filter((r) => r.siteId === siteId && r.reportType === type && r.sentAt !== null).map((r) => r.sentAt).sort();
+  return candidates[candidates.length - 1] ?? null;
+}
+function findDueReports(websites, reports, today) {
+  const out = [];
+  const todayStart = startOfDay(today);
+  for (const site of websites) {
+    if (site.status !== null && !ELIGIBLE_STATUSES.has(site.status)) continue;
+    for (const type of ["Maintenance", "Testing"]) {
+      const rawFreq = type === "Maintenance" ? site.maintenanceFreq : site.testingFreq;
+      const freq = typeof rawFreq === "string" ? rawFreq.trim() : rawFreq;
+      if (freq === "None" || freq === "") continue;
+      if (!(freq in MONTHS)) {
+        console.warn(
+          `\u26A0 ${site.name}: unrecognized ${type === "Maintenance" ? "maintenance" : "testing"} frequency '${rawFreq}' \u2014 not scheduling; fix the Airtable value`
+        );
+        continue;
+      }
+      const lastSent = lastSentForType(reports, site.id, type);
+      const fallback = type === "Maintenance" ? site.maintenanceDay : site.testingDay;
+      const baseIso = lastSent ?? fallback;
+      if (!baseIso) {
+        out.push({ site, reportType: type, dueDate: todayStart, lastSent });
+        continue;
+      }
+      const dueDate = addMonths(new Date(baseIso), MONTHS[freq]);
+      if (todayStart.getTime() >= startOfDay(dueDate).getTime()) {
+        out.push({ site, reportType: type, dueDate, lastSent });
+      }
+    }
+  }
+  return out;
+}
+function reportPeriodKey(dueDate) {
+  if (Number.isNaN(dueDate.getTime())) throw new TypeError("reportPeriodKey: invalid Date");
+  const year = dueDate.getUTCFullYear();
+  const month = String(dueDate.getUTCMonth() + 1).padStart(2, "0");
+  return `${year}-${month}`;
+}
+
+export {
+  findDueReports,
+  reportPeriodKey
+};
+//# sourceMappingURL=chunk-WVRPOXKH.js.map