@reddoorla/maintenance 0.55.0 → 0.56.0

package/dist/cli/commands/audit.js

@@ -1,2328 +1,29 @@
-var __defProp = Object.defineProperty;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
-};
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-
-// src/util/url.ts
-function isHttpUrl(s) {
-  let parsed;
-  try {
-    parsed = new URL(s);
-  } catch {
-    return false;
-  }
-  return parsed.protocol === "http:" || parsed.protocol === "https:";
-}
-var init_url = __esm({
-  "src/util/url.ts"() {
-    "use strict";
-  }
-});
-
-// src/util/credentials.ts
-import { readFileSync } from "fs";
-import { homedir } from "os";
-import { join as join7 } from "path";
-function defaultCredentialsPath() {
-  const base = process.env.XDG_CONFIG_HOME ?? join7(homedir(), ".config");
-  return join7(base, "reddoor-maint", "credentials.env");
-}
-var init_credentials = __esm({
-  "src/util/credentials.ts"() {
-    "use strict";
-  }
-});
-
-// src/reports/airtable/throttle.ts
-function createMinIntervalThrottle(opts) {
-  const { minIntervalMs, now, delay } = opts;
-  return function wrap(fn) {
-    let chain = Promise.resolve();
-    let last = Number.NEGATIVE_INFINITY;
-    return (...args) => {
-      chain = chain.then(async () => {
-        const wait = minIntervalMs - (now() - last);
-        if (wait > 0) await delay(wait);
-        last = now();
-        fn(...args);
-      }).catch(() => {
-      });
-    };
-  };
-}
-function applyThrottle(base, opts) {
-  const real = base._base?.runAction;
-  if (typeof real !== "function") return base;
-  const wrap = createMinIntervalThrottle(opts);
-  const throttled = wrap(real.bind(base._base));
-  base._base.runAction = throttled;
-  base.runAction = throttled;
-  return base;
-}
-var init_throttle = __esm({
-  "src/reports/airtable/throttle.ts"() {
-    "use strict";
-  }
-});
-
-// src/reports/airtable/client.ts
-var client_exports = {};
-__export(client_exports, {
-  openBase: () => openBase,
-  readAirtableConfig: () => readAirtableConfig
-});
-import Airtable from "airtable";
-function missing(name) {
-  return Object.assign(
-    new Error(
-      `${name} not set. Export it in your shell or put it in ${defaultCredentialsPath()} as ${name}=...`
-    ),
-    { exitCode: 2 }
-  );
-}
-function readAirtableConfig() {
-  const apiKey = process.env.AIRTABLE_PAT;
-  const baseId = process.env.AIRTABLE_BASE_ID;
-  if (!apiKey) throw missing("AIRTABLE_PAT");
-  if (!baseId) throw missing("AIRTABLE_BASE_ID");
-  return { apiKey, baseId };
-}
-function openBase(cfg) {
-  const base = new Airtable({ apiKey: cfg.apiKey }).base(cfg.baseId);
-  return applyThrottle(base, {
-    minIntervalMs: MIN_REQUEST_INTERVAL_MS,
-    now: () => Date.now(),
-    delay: (ms) => new Promise((resolve3) => setTimeout(resolve3, ms))
-  });
-}
-var MIN_REQUEST_INTERVAL_MS;
-var init_client = __esm({
-  "src/reports/airtable/client.ts"() {
-    "use strict";
-    init_credentials();
-    init_throttle();
-    MIN_REQUEST_INTERVAL_MS = 220;
-  }
-});
-
-// src/reports/airtable/websites.ts
-var websites_exports = {};
-__export(websites_exports, {
-  ACTIVE_STATUSES: () => ACTIVE_STATUSES,
-  SEVERITY_RANK: () => SEVERITY_RANK,
-  WEBSITES_TABLE: () => WEBSITES_TABLE,
-  getWebsiteBySlug: () => getWebsiteBySlug,
-  isDashboardVisible: () => isDashboardVisible,
-  listWebsites: () => listWebsites,
-  mapRow: () => mapRow,
-  normalizeSecurityAdvisory: () => normalizeSecurityAdvisory,
-  parseNotifyRouting: () => parseNotifyRouting,
-  parseSecurityAdvisories: () => parseSecurityAdvisories,
-  siteSlug: () => siteSlug,
-  updateA11yCounts: () => updateA11yCounts,
-  updateAnalyticsHealth: () => updateAnalyticsHealth,
-  updateAuditFields: () => updateAuditFields,
-  updateDepsCounts: () => updateDepsCounts,
-  updateGitHubSignals: () => updateGitHubSignals,
-  updateLaunched: () => updateLaunched,
-  updateScores: () => updateScores,
-  updateSecurityCounts: () => updateSecurityCounts
-});
-function siteSlug(name) {
-  return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
-}
-function trimToNull(raw) {
-  if (typeof raw !== "string") return null;
-  const trimmed = raw.trim();
-  return trimmed.length > 0 ? trimmed : null;
-}
-function parseNotifyRouting(raw) {
-  if (typeof raw !== "string") return null;
-  const trimmed = raw.trim();
-  if (!trimmed) return null;
-  let parsed;
-  try {
-    parsed = JSON.parse(trimmed);
-  } catch {
-    return null;
-  }
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
-  const o = parsed;
-  if (typeof o.field !== "string" || !o.field.trim()) return null;
-  if (!o.routes || typeof o.routes !== "object" || Array.isArray(o.routes)) return null;
-  const routing = {
-    field: o.field,
-    routes: o.routes
-  };
-  if (o.default !== void 0) routing.default = o.default;
-  if (Array.isArray(o.cc)) routing.cc = o.cc.filter((x) => typeof x === "string");
-  return routing;
-}
-function isDashboardVisible(site) {
-  return site.status !== null && ACTIVE_STATUSES.has(site.status);
-}
-function toFrequency(raw) {
-  return typeof raw === "string" && FREQUENCIES.includes(raw) ? raw : "None";
-}
-function mapRow(rec) {
-  const f = rec.fields;
-  const attachments = f["Header image"] ?? [];
-  const header = attachments[0] ?? null;
-  return {
-    id: rec.id,
-    name: String(f["Name"] ?? ""),
-    url: String(f["url"] ?? ""),
-    status: f["Status"] ?? null,
-    pointOfContact: f["point of contact"] ?? null,
-    maintenanceFreq: toFrequency(f["maintenence freq"]),
-    testingFreq: toFrequency(f["testing freq"]),
-    maintenanceDay: f["maintenance day"] ?? null,
-    testingDay: f["testing day"] ?? null,
-    ga4PropertyId: f["GA4 property ID"] ?? null,
-    searchQuery: f["Search query"] ?? null,
-    searchConsoleProperty: f["Search Console property"] ?? null,
-    analyticsSoftFailAt: f["Analytics soft-fail at"] ?? null,
-    gitRepo: f["Git repo"] ?? null,
-    reportRecipientsTo: f["Report recipients (To)"] ?? null,
-    reportRecipientsCc: f["Report recipients (CC)"] ?? null,
-    headerImage: header,
-    pScore: f["pScore"] ?? null,
-    rScore: f["rScore"] ?? null,
-    bpScore: f["bpScore"] ?? null,
-    seoScore: f["seoScore"] ?? null,
-    lastLighthouseAuditAt: f["Last lighthouse audit at"] ?? null,
-    a11yViolations: f["A11y Violations"] ?? null,
-    depsDrifted: f["Deps Drifted"] ?? null,
-    depsMajorBehind: f["Deps Major Behind"] ?? null,
-    depsOutdated: f["Deps Outdated"] ?? null,
-    securityVulnsCritical: f["Security Vulns Critical"] ?? null,
-    securityVulnsHigh: f["Security Vulns High"] ?? null,
-    securityVulnsModerate: f["Security Vulns Moderate"] ?? null,
-    securityVulnsLow: f["Security Vulns Low"] ?? null,
-    lastSecurityAuditAt: f["Last security audit at"] ?? null,
-    securityAdvisories: parseSecurityAdvisories(f["Security advisories"]),
-    certDaysRemaining: f["Cert days remaining"] ?? null,
-    domainCheckedAt: f["Domain checked at"] ?? null,
-    crossbrowserOk: typeof f["Crossbrowser OK"] === "boolean" ? f["Crossbrowser OK"] : null,
-    mobileOk: typeof f["Mobile OK"] === "boolean" ? f["Mobile OK"] : null,
-    linksOk: typeof f["Links OK"] === "boolean" ? f["Links OK"] : null,
-    brokenLinks: typeof f["Broken links"] === "number" ? f["Broken links"] : null,
-    browserCheckedAt: f["Browser checked at"] ?? null,
-    copyIntro: trimToNull(f["Copy \u2014 Intro"]),
-    copyContact: trimToNull(f["Copy \u2014 Contact"]),
-    copyFooter: trimToNull(f["Copy \u2014 Footer"]),
-    launchedAt: f["Launched at"] ?? null,
-    newsletterWebhook: trimToNull(f["Newsletter Webhook"]),
-    notifyRouting: parseNotifyRouting(f["Notify Routing"]),
-    mailchimpApiKey: trimToNull(f["Mailchimp API Key"]),
-    mailchimpAudienceId: trimToNull(f["Mailchimp Audience ID"]),
-    renovateFailingCis: f["Renovate Failing CIs"] ?? null,
-    defaultBranchCi: f["Default Branch CI"] ?? null,
-    lastCommitAt: f["Last Commit At"] ?? null,
-    githubSignalsAt: f["GitHub Signals At"] ?? null
-  };
-}
-async function listWebsites(base) {
-  const out = [];
-  await base(WEBSITES_TABLE).select({ pageSize: 100 }).eachPage((records, fetchNextPage) => {
-    for (const rec of records) out.push(mapRow({ id: rec.id, fields: rec.fields }));
-    fetchNextPage();
-  });
-  return out;
-}
-async function getWebsiteBySlug(base, slug) {
-  if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(slug)) return null;
-  const formula = `REGEX_REPLACE(REGEX_REPLACE(LOWER({Name}),"[^a-z0-9]+","-"),"^-|-$","")=${JSON.stringify(
-    slug
-  )}`;
-  const rows = [];
-  await base(WEBSITES_TABLE).select({ filterByFormula: formula, maxRecords: 1 }).eachPage((records, fetchNextPage) => {
-    for (const rec of records) rows.push(mapRow({ id: rec.id, fields: rec.fields }));
-    fetchNextPage();
-  });
-  return rows.find((w) => siteSlug(w.name) === slug) ?? null;
-}
-function scoreFields(scores) {
-  return {
-    pScore: scores.performance,
-    rScore: scores.accessibility,
-    bpScore: scores.bestPractices,
-    seoScore: scores.seo,
-    "Last lighthouse audit at": (/* @__PURE__ */ new Date()).toISOString()
-  };
-}
-function a11yFields(counts) {
-  return { "A11y Violations": counts.violations };
-}
-function depsFields(counts) {
-  const fields = {
-    "Deps Drifted": counts.drifted,
-    "Deps Major Behind": counts.majorBehind
-  };
-  if (counts.outdated !== null) {
-    fields["Deps Outdated"] = counts.outdated;
-  }
-  return fields;
-}
-function normalizeSecurityAdvisory(raw) {
-  if (!raw || typeof raw !== "object") return null;
-  const e = raw;
-  const module = typeof e["module"] === "string" ? e["module"] : null;
-  const severity = e["severity"];
-  if (module === null) return null;
-  if (severity !== "low" && severity !== "moderate" && severity !== "high" && severity !== "critical")
-    return null;
-  const cves = Array.isArray(e["cves"]) ? e["cves"].filter((c) => typeof c === "string") : [];
-  return {
-    module,
-    severity,
-    title: typeof e["title"] === "string" ? e["title"] : "",
-    cves,
-    url: typeof e["url"] === "string" ? e["url"] : null
-  };
-}
-function parseSecurityAdvisories(raw) {
-  if (typeof raw !== "string" || raw.trim() === "") return null;
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    return null;
-  }
-  if (!Array.isArray(parsed)) return null;
-  return parsed.map(normalizeSecurityAdvisory).filter((a) => a !== null);
-}
-function securityAdvisoryFields(advisories) {
-  const capped = [...advisories].sort((a, b) => SEVERITY_RANK[a.severity] - SEVERITY_RANK[b.severity]).slice(0, MAX_PERSISTED_ADVISORIES);
-  return { "Security advisories": JSON.stringify(capped) };
-}
-function securityFields(counts) {
-  return {
-    "Security Vulns Critical": counts.critical,
-    "Security Vulns High": counts.high,
-    "Security Vulns Moderate": counts.moderate,
-    "Security Vulns Low": counts.low,
-    // Stamp freshness alongside the counts so the Security Updates auto-tick can require a recent
-    // audit (a clean count from months ago must not silently keep ticking the box).
-    "Last security audit at": (/* @__PURE__ */ new Date()).toISOString()
-  };
-}
-function domainFields(result) {
-  const fields = { "Domain checked at": result.checkedAt };
-  fields["Cert days remaining"] = result.certDaysRemaining;
-  return fields;
-}
-function browserFields(r) {
-  return {
-    "Crossbrowser OK": r.desktopOk,
-    "Mobile OK": r.mobileOk,
-    "Links OK": r.linksOk,
-    "Broken links": r.brokenLinks,
-    "Browser checked at": r.checkedAt
-  };
-}
-async function updateScores(base, recordId, scores) {
-  await base(WEBSITES_TABLE).update([{ id: recordId, fields: scoreFields(scores) }]);
-}
-async function updateAnalyticsHealth(base, recordId, at) {
-  const fields = { "Analytics soft-fail at": at };
-  await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);
-}
-async function updateA11yCounts(base, recordId, counts) {
-  await base(WEBSITES_TABLE).update([{ id: recordId, fields: a11yFields(counts) }]);
-}
-async function updateDepsCounts(base, recordId, counts) {
-  await base(WEBSITES_TABLE).update([{ id: recordId, fields: depsFields(counts) }]);
-}
-async function updateSecurityCounts(base, recordId, counts) {
-  await base(WEBSITES_TABLE).update([{ id: recordId, fields: securityFields(counts) }]);
-}
-async function updateAuditFields(base, recordId, audits) {
-  const fields = {};
-  if (audits.scores) Object.assign(fields, scoreFields(audits.scores));
-  if (audits.a11y) Object.assign(fields, a11yFields(audits.a11y));
-  if (audits.deps) Object.assign(fields, depsFields(audits.deps));
-  if (audits.security) Object.assign(fields, securityFields(audits.security));
-  if (audits.securityAdvisories)
-    Object.assign(fields, securityAdvisoryFields(audits.securityAdvisories));
-  if (audits.domain) Object.assign(fields, domainFields(audits.domain));
-  if (audits.browser) Object.assign(fields, browserFields(audits.browser));
-  await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);
-  return fields;
-}
-async function updateGitHubSignals(base, recordId, signals) {
-  const fields = {
-    "Renovate Failing CIs": signals.renovateFailingCis,
-    "Default Branch CI": signals.ciState,
-    "GitHub Signals At": signals.sweptAt
-  };
-  if (signals.lastCommitAt !== null) {
-    fields["Last Commit At"] = signals.lastCommitAt;
-  }
-  await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);
-}
-async function updateLaunched(base, recordId, at) {
-  const fields = { Status: "maintenance", "Launched at": at };
-  await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);
-}
-var WEBSITES_TABLE, ACTIVE_STATUSES, FREQUENCIES, SEVERITY_RANK, MAX_PERSISTED_ADVISORIES;
-var init_websites = __esm({
-  "src/reports/airtable/websites.ts"() {
-    "use strict";
-    WEBSITES_TABLE = "Websites";
-    ACTIVE_STATUSES = /* @__PURE__ */ new Set([
-      "maintenance",
-      "launch period"
-    ]);
-    FREQUENCIES = ["None", "Monthly", "Quarterly", "Yearly"];
-    SEVERITY_RANK = {
-      critical: 0,
-      high: 1,
-      moderate: 2,
-      low: 3
-    };
-    MAX_PERSISTED_ADVISORIES = 25;
-  }
-});
-
-// src/inventory/airtable.ts
-var airtable_exports = {};
-__export(airtable_exports, {
-  fromAirtableBase: () => fromAirtableBase
-});
-function fromAirtableBase(base, opts = {}) {
-  return async () => {
-    const workdir = opts.workdir ?? process.env.REDDOOR_FLEET_WORKDIR;
-    if (!workdir) {
-      throw new Error(
-        "fromAirtableBase requires `workdir` option or REDDOOR_FLEET_WORKDIR env (sites need a local path)"
-      );
-    }
-    const websites = await listWebsites(base);
-    return websites.filter((w) => w.status !== null && ACTIVE_STATUSES.has(w.status) && w.url.length > 0).flatMap((w) => {
-      const slug = siteSlug(w.name);
-      if (slug.length === 0) {
-        console.warn(
-          `[inventory] skipping "${w.name}" (row ${w.id}): Name has no slug-able characters (empty slug)`
-        );
-        return [];
-      }
-      const site = {
-        path: `${workdir}/${slug}`,
-        name: slug,
-        meta: { airtableRowId: w.id, displayName: w.name }
-      };
-      if (isHttpUrl(w.url)) {
-        site.deployedUrl = w.url;
-      } else {
-        console.warn(
-          `[inventory] skipping deployed audit for "${w.name}": url is not http(s): ${JSON.stringify(w.url)}`
-        );
-      }
-      if (w.gitRepo) site.gitRepo = w.gitRepo;
-      return [site];
-    });
-  };
-}
-var init_airtable = __esm({
-  "src/inventory/airtable.ts"() {
-    "use strict";
-    init_websites();
-    init_url();
-  }
-});
-
-// src/audits/lighthouse-airtable.ts
-var lighthouse_airtable_exports = {};
-__export(lighthouse_airtable_exports, {
-  hasRealScores: () => hasRealScores,
-  lighthouseScoresFromResult: () => lighthouseScoresFromResult,
-  resolveSlugFromCwd: () => resolveSlugFromCwd
-});
-import { readFile as readFile7 } from "fs/promises";
-import { join as join10 } from "path";
-function hasRealScores(result) {
-  if (result.audit !== "lighthouse") return false;
-  const details = result.details ?? {};
-  const summary = details.summary ?? {};
-  return LIGHTHOUSE_CATEGORIES.some(
-    (k) => typeof summary[k] === "number" && !Number.isNaN(summary[k])
-  );
-}
-function lighthouseScoresFromResult(result) {
-  if (result.audit !== "lighthouse") {
-    throw new Error(`Expected a 'lighthouse' AuditResult, got '${result.audit}'`);
-  }
-  const details = result.details ?? {};
-  const summary = details.summary ?? {};
-  const toPct = (n) => typeof n === "number" && !Number.isNaN(n) ? Math.round(n * 100) : 0;
-  return {
-    performance: toPct(summary["performance"]),
-    accessibility: toPct(summary["accessibility"]),
-    bestPractices: toPct(summary["best-practices"]),
-    seo: toPct(summary["seo"])
-  };
-}
-async function resolveSlugFromCwd(cwd) {
-  try {
-    const pkgPath = join10(cwd, "package.json");
-    const raw = await readFile7(pkgPath, "utf-8");
-    const pkg = JSON.parse(raw);
-    if (!pkg.name) throw new Error("package.json has no 'name' field");
-    return siteSlug(pkg.name);
-  } catch (e) {
-    throw new Error(
-      `Could not derive site slug from ${cwd}/package.json: ${e.message}. Pass --write-airtable=<slug> explicitly.`,
-      { cause: e }
-    );
-  }
-}
-var LIGHTHOUSE_CATEGORIES;
-var init_lighthouse_airtable = __esm({
-  "src/audits/lighthouse-airtable.ts"() {
-    "use strict";
-    init_websites();
-    LIGHTHOUSE_CATEGORIES = ["performance", "accessibility", "best-practices", "seo"];
-  }
-});
-
-// src/audits/a11y-airtable.ts
-function hasA11yCounts(result) {
-  if (result.audit !== "a11y") return false;
-  const details = result.details;
-  return typeof details?.totalViolations === "number";
-}
-function a11yCountsFromResult(result) {
-  if (result.audit !== "a11y") {
-    throw new Error(`Expected an 'a11y' AuditResult, got '${result.audit}'`);
-  }
-  const details = result.details;
-  return { violations: details?.totalViolations ?? 0 };
-}
-var init_a11y_airtable = __esm({
-  "src/audits/a11y-airtable.ts"() {
-    "use strict";
-  }
-});
-
-// src/audits/deps-airtable.ts
-function hasDepsCounts(result) {
-  if (result.audit !== "deps") return false;
-  const d = result.details;
-  return Array.isArray(d?.entries);
-}
-function depsCountsFromResult(result) {
-  if (result.audit !== "deps") {
-    throw new Error(`Expected a 'deps' AuditResult, got '${result.audit}'`);
-  }
-  const details = result.details ?? {};
-  const entries = details.entries ?? [];
-  const drifted = entries.filter((e) => e.drift !== "same").length;
-  const majorBehind = entries.filter((e) => e.drift === "major").length;
-  const outdated = details.outdated?.outdated ?? null;
-  return { drifted, majorBehind, outdated };
-}
-var init_deps_airtable = __esm({
-  "src/audits/deps-airtable.ts"() {
-    "use strict";
-  }
-});
-
-// src/audits/security-airtable.ts
-function hasSecurityCounts(result) {
-  if (result.audit !== "security") return false;
-  const details = result.details;
-  return !!details && typeof details.counts === "object";
-}
-function securityCountsFromResult(result) {
-  if (result.audit !== "security") {
-    throw new Error(`Expected a 'security' AuditResult, got '${result.audit}'`);
-  }
-  const details = result.details;
-  const c = details?.counts ?? { low: 0, moderate: 0, high: 0, critical: 0 };
-  return { critical: c.critical, high: c.high, moderate: c.moderate, low: c.low };
-}
-function advisoriesFromResult(result) {
-  if (result.audit !== "security") {
-    throw new Error(`Expected a 'security' AuditResult, got '${result.audit}'`);
-  }
-  const details = result.details;
-  const raw = details?.advisories;
-  if (!Array.isArray(raw)) return [];
-  return raw.map(normalizeSecurityAdvisory).filter((a) => a !== null);
-}
-var init_security_airtable = __esm({
-  "src/audits/security-airtable.ts"() {
-    "use strict";
-    init_websites();
-  }
-});
-
-// src/audits/domain-airtable.ts
-function hasDomainResult(result) {
-  if (result.audit !== "domain") return false;
-  const d = result.details;
-  return !!d && typeof d.checkedAt === "string";
-}
-function domainResultFromAudit(result) {
-  if (result.audit !== "domain") {
-    throw new Error(`Expected a 'domain' AuditResult, got '${result.audit}'`);
-  }
-  const d = result.details;
-  return {
-    certDaysRemaining: typeof d?.certDaysRemaining === "number" ? d.certDaysRemaining : null,
-    checkedAt: typeof d?.checkedAt === "string" ? d.checkedAt : (/* @__PURE__ */ new Date()).toISOString()
-  };
-}
-var init_domain_airtable = __esm({
-  "src/audits/domain-airtable.ts"() {
-    "use strict";
-  }
-});
-
-// src/audits/browser-airtable.ts
-function hasBrowserResult(result) {
-  if (result.audit !== "browser") return false;
-  const d = result.details;
-  return !!d && typeof d.checkedAt === "string";
-}
-function browserFieldsFromAudit(result) {
-  if (result.audit !== "browser") {
-    throw new Error(`Expected a 'browser' AuditResult, got '${result.audit}'`);
-  }
-  const d = result.details;
-  return {
-    desktopOk: d?.desktopOk === true,
-    mobileOk: d?.mobileOk === true,
-    linksOk: d?.linksOk === true,
-    brokenLinks: typeof d?.brokenLinks === "number" ? d.brokenLinks : 0,
-    checkedAt: typeof d?.checkedAt === "string" ? d.checkedAt : (/* @__PURE__ */ new Date()).toISOString()
-  };
-}
-var init_browser_airtable = __esm({
-  "src/audits/browser-airtable.ts"() {
-    "use strict";
-  }
-});
-
-// src/audits/write-audits-to-airtable.ts
-var write_audits_to_airtable_exports = {};
-__export(write_audits_to_airtable_exports, {
-  formatFleetWriteSummary: () => formatFleetWriteSummary,
-  writeAuditsToAirtable: () => writeAuditsToAirtable,
-  writeFleetAuditsToAirtable: () => writeFleetAuditsToAirtable
-});
-async function writeAuditsToAirtable(args) {
-  const { base, websites, slug, results } = args;
-  const lhResult = results.find((r) => r.audit === "lighthouse");
-  const target = websites.find((w) => siteSlug(w.name) === slug);
-  if (!target) {
-    throw Object.assign(new Error(`No Websites row matched slug "${slug}"`), { exitCode: 2 });
-  }
-  const writes = [];
-  const audits = {};
-  const lhHasScores = lhResult ? hasRealScores(lhResult) : false;
-  if (lhResult && lhHasScores) {
-    const scores = lighthouseScoresFromResult(lhResult);
-    audits.scores = scores;
-    writes.push({ audit: "lighthouse", counts: scores });
-  }
-  const a11y = results.find((r) => r.audit === "a11y");
-  if (a11y && hasA11yCounts(a11y)) {
-    const counts = a11yCountsFromResult(a11y);
-    audits.a11y = counts;
-    writes.push({ audit: "a11y", counts });
-  }
-  const deps = results.find((r) => r.audit === "deps");
-  if (deps && hasDepsCounts(deps)) {
-    const counts = depsCountsFromResult(deps);
-    audits.deps = counts;
-    writes.push({ audit: "deps", counts });
-  }
-  const sec = results.find((r) => r.audit === "security");
-  if (sec && hasSecurityCounts(sec)) {
-    const counts = securityCountsFromResult(sec);
-    audits.security = counts;
-    audits.securityAdvisories = advisoriesFromResult(sec);
-    writes.push({ audit: "security", counts });
-  }
-  const dom = results.find((r) => r.audit === "domain");
-  if (dom && hasDomainResult(dom)) {
-    const result = domainResultFromAudit(dom);
-    audits.domain = result;
-    writes.push({ audit: "domain", counts: result });
-  }
-  const browser = results.find((r) => r.audit === "browser");
-  if (browser && hasBrowserResult(browser)) {
-    const fields = browserFieldsFromAudit(browser);
-    audits.browser = fields;
-    writes.push({ audit: "browser", counts: fields });
-  }
-  if (Object.keys(audits).length > 0) {
-    await updateAuditFields(base, target.id, audits);
-  }
-  if (lhResult && !lhHasScores) {
-    const persisted = writes.map((w) => w.audit);
-    throw Object.assign(
-      new Error(
-        `Lighthouse audit produced no scores; ${persisted.length ? `wrote ${persisted.join("/")} but refused Lighthouse` : "wrote nothing"}. Summary: ${lhResult.summary}`
-      ),
-      { exitCode: 1 }
-    );
-  }
-  return { siteName: target.name, writes };
-}
-function formatFleetWriteSummary(result) {
-  const wrote = result.written.length;
-  const failed = result.failed.length;
-  const total = wrote + failed;
-  let out = `\u2192 wrote ${wrote} site(s) to Airtable`;
-  if (failed > 0) {
-    out += `
-\u26A0 ${failed} site(s) not written: ${result.failed.map((f) => `${f.slug} (${f.error})`).join("; ")}`;
-  }
-  out += `
-FLEET_WRITE_SUMMARY wrote=${wrote} failed=${failed} total=${total}`;
-  return out;
-}
-async function writeFleetAuditsToAirtable(args) {
-  const { base, websites, results } = args;
-  const bySlug = /* @__PURE__ */ new Map();
-  for (const r of results) {
-    const arr = bySlug.get(r.site) ?? [];
-    arr.push(r);
-    bySlug.set(r.site, arr);
-  }
-  const written = [];
-  const failed = [];
-  for (const [slug, siteResults] of bySlug) {
-    try {
-      written.push(await writeAuditsToAirtable({ base, websites, slug, results: siteResults }));
-    } catch (e) {
-      failed.push({ slug, error: e.message });
-    }
-  }
-  return { written, failed };
-}
-var init_write_audits_to_airtable = __esm({
-  "src/audits/write-audits-to-airtable.ts"() {
-    "use strict";
-    init_websites();
-    init_lighthouse_airtable();
-    init_a11y_airtable();
-    init_deps_airtable();
-    init_security_airtable();
-    init_domain_airtable();
-    init_browser_airtable();
-  }
-});
+import {
+  fleetWorkdir,
+  formatSkippedNotice,
+  prepareFleetSites
+} from "../../chunk-4NAOR44V.js";
+import {
+  resolveSites
+} from "../../chunk-J3OPWFZE.js";
+import {
+  ALL_AUDIT_NAMES,
+  runOneAudit
+} from "../../chunk-4PY4I5OR.js";
+import "../../chunk-LKGVSM2O.js";
+import "../../chunk-FDIFTIXC.js";
+import "../../chunk-HVOOCK6L.js";
+import "../../chunk-XXTZBPUY.js";
+import "../../chunk-XTK5VIQB.js";
+import {
+  isHttpUrl
+} from "../../chunk-U5SZ4FOP.js";
+import "../../chunk-EYODPUHV.js";
+import "../../chunk-LYCKN7ZR.js";
 
 // src/cli/commands/audit.ts
-import { resolve as resolve2 } from "path";
+import { resolve } from "path";
 import { Listr } from "listr2";
-
-// src/audits/util/spawn.ts
-import { spawn } from "child_process";
-import { StringDecoder } from "string_decoder";
-var TRUNCATION_MARKER = "\n\u2026[output truncated]";
-function makeSpawn(internals = {}) {
-  const spawnImpl = internals.spawnImpl ?? spawn;
-  const killImpl = internals.killImpl ?? ((pid, sig) => process.kill(pid, sig));
-  const killGraceMs = internals.killGraceMs ?? 5e3;
-  const maxOutputBytes = internals.maxOutputBytes ?? 10 * 1024 * 1024;
-  return (cmd, args, opts = {}) => new Promise((resolve3, reject) => {
-    const streaming = opts.streaming === true;
-    const child = spawnImpl(cmd, [...args], {
-      cwd: opts.cwd,
-      env: opts.env ?? process.env,
-      stdio: streaming ? ["ignore", "inherit", "inherit"] : ["ignore", "pipe", "pipe"],
-      // Detach ONLY when a timeout can fire: the child then leads its own
-      // process group, so the timeout can kill the WHOLE tree (vite, and
-      // Chromium under lhci/playwright) via process.kill(-pid), not just the
-      // npx/pnpm wrapper. Without it, killing the wrapper orphaned the
-      // grandchildren — a zombie vite squatting its port, Chrome left running.
-      // We do NOT detach timeout-less streaming calls (pnpm install/up):
-      // detaching gains nothing there (no timeout → no group-kill) and would
-      // break terminal Ctrl-C, which only reaches the foreground group — i.e.
-      // it would re-orphan the very children this guards. We never unref() the
-      // child since we still await it.
-      detached: opts.timeoutMs !== void 0
-    });
-    const cap = (acc, chunk) => {
-      if (acc.length >= maxOutputBytes) return acc;
-      const next = acc + chunk;
-      return next.length > maxOutputBytes ? next.slice(0, maxOutputBytes) + TRUNCATION_MARKER : next;
-    };
-    let stdout = "";
-    let stderr = "";
-    const outDecoder = new StringDecoder("utf-8");
-    const errDecoder = new StringDecoder("utf-8");
-    if (!streaming) {
-      child.stdout?.on(
-        "data",
-        (chunk) => stdout = cap(stdout, outDecoder.write(chunk))
-      );
-      child.stderr?.on(
-        "data",
-        (chunk) => stderr = cap(stderr, errDecoder.write(chunk))
-      );
-    }
-    const killGroup = (sig) => {
-      if (child.pid === void 0) return;
-      try {
-        killImpl(-child.pid, sig);
-      } catch {
-      }
-    };
-    let killTimer;
-    const timer = opts.timeoutMs ? setTimeout(() => {
-      killGroup("SIGTERM");
-      killTimer = setTimeout(() => killGroup("SIGKILL"), killGraceMs);
-      killTimer.unref();
-      reject(new Error(`spawn timeout after ${opts.timeoutMs}ms: ${cmd}`));
-    }, opts.timeoutMs) : void 0;
-    const clearTimers = () => {
-      if (timer) clearTimeout(timer);
-      if (killTimer) clearTimeout(killTimer);
-    };
-    child.on("error", (err) => {
-      clearTimers();
-      reject(err);
-    });
-    child.on("close", (code) => {
-      clearTimers();
-      if (!streaming) {
-        stdout = cap(stdout, outDecoder.end());
-        stderr = cap(stderr, errDecoder.end());
-      }
-      resolve3({ code: code ?? -1, stdout, stderr });
-    });
-  });
-}
-var defaultSpawn = makeSpawn();
-
-// src/audits/deps.ts
-import { readFile } from "fs/promises";
-import { join as join2 } from "path";
-
-// src/util/site.ts
-function siteLabel(site) {
-  return site.name || site.path;
-}
-
-// src/configs/baseline-versions.ts
-var baselineVersions = {
-  // SvelteKit core
-  svelte: "^5.55.10",
-  "@sveltejs/kit": "^2.61.1",
-  "@sveltejs/adapter-netlify": "^6.0.4",
-  "@sveltejs/adapter-auto": "^7.0.1",
-  "@sveltejs/vite-plugin-svelte": "^7.1.2",
-  "svelte-check": "^4.4.8",
-  // Build tooling
-  vite: "^8.0.14",
-  vitest: "^4.1.7",
-  typescript: "^6.0.3",
-  // Tailwind 4
-  tailwindcss: "^4.3.0",
-  "@tailwindcss/vite": "^4.3.0",
-  // Prismic
-  "@prismicio/client": "^7.21.8",
-  "@prismicio/svelte": "^2.2.1",
-  "@slicemachine/adapter-sveltekit": "^0.3.96",
-  "slice-machine-ui": "^2.21.3",
-  // Test tooling
-  "@playwright/test": "^1.60.0",
-  "@axe-core/playwright": "^4.11.3",
-  "@lhci/cli": "^0.15.1",
-  // Lint
-  eslint: "^10.4.0",
-  "eslint-plugin-svelte": "^3.18.0",
-  "eslint-config-prettier": "^10.1.8",
-  prettier: "^3.8.3",
-  "prettier-plugin-svelte": "^4.0.1",
-  "typescript-eslint": "^8.60.0",
-  "@eslint/js": "^10.0.1",
-  globals: "^17.6.0",
-  // Misc
-  "@lucide/svelte": "^1.17.0",
-  "@zerodevx/svelte-img": "^2.1.2"
-};
-
-// src/audits/deps-outdated.ts
-import { stat } from "fs/promises";
-import { join } from "path";
-async function exists(path) {
-  try {
-    await stat(path);
-    return true;
-  } catch {
-    return false;
-  }
-}
-function majorOf(version) {
-  const head = version.replace(/^[\^~]/, "").split(".")[0] ?? "0";
-  const n = Number.parseInt(head, 10);
-  return Number.isNaN(n) ? 0 : n;
-}
-async function scanOutdated(sitePath, spawn2) {
-  if (!await exists(join(sitePath, "pnpm-lock.yaml"))) return null;
-  try {
-    if (!await exists(join(sitePath, "node_modules"))) {
-      const install = await spawn2("pnpm", ["install", "--frozen-lockfile"], {
-        cwd: sitePath,
-        timeoutMs: 18e4
-      });
-      if (install.code !== 0) return null;
-    }
-    const res = await spawn2("pnpm", ["outdated", "--json"], {
-      cwd: sitePath,
-      timeoutMs: 6e4
-    });
-    const parsed = JSON.parse(res.stdout || "{}");
-    const entries = Object.values(parsed);
-    return {
-      outdated: entries.length,
-      major: entries.filter((e) => e.current && e.latest && majorOf(e.latest) > majorOf(e.current)).length
-    };
-  } catch {
-    return null;
-  }
-}
-
-// src/audits/deps.ts
-function stripCaret(range) {
-  return range.replace(/^[\^~]/, "");
-}
-function isComparableRange(spec) {
-  return /^[\^~]?\d/.test(spec.trim());
-}
-function parseSemver(v) {
-  const cleaned = stripCaret(v).split("-")[0] ?? "0.0.0";
-  const parts = cleaned.split(".").map((n) => Number.parseInt(n, 10));
-  return [parts[0] ?? 0, parts[1] ?? 0, parts[2] ?? 0];
-}
-function compareSemver(actual, baseline) {
-  const [aMajor, aMinor, aPatch] = parseSemver(actual);
-  const [bMajor, bMinor, bPatch] = parseSemver(baseline);
-  if (aMajor > bMajor) return "newer";
-  if (aMajor < bMajor) return "major";
-  if (aMinor > bMinor) return "newer";
-  if (aMinor < bMinor) return "minor";
-  if (aPatch > bPatch) return "newer";
-  if (aPatch < bPatch) return "patch";
-  return "same";
-}
-async function depsAudit(ctx) {
-  const pkgPath = join2(ctx.site.path, "package.json");
-  let pkgRaw;
-  try {
-    pkgRaw = await readFile(pkgPath, "utf-8");
-  } catch (err) {
-    return {
-      audit: "deps",
-      site: siteLabel(ctx.site),
-      status: "skip",
-      summary: `no package.json at ${pkgPath}`,
-      details: { error: String(err) }
-    };
-  }
-  let pkg;
-  try {
-    pkg = JSON.parse(pkgRaw);
-  } catch (err) {
-    return {
-      audit: "deps",
-      site: siteLabel(ctx.site),
-      status: "fail",
-      summary: `package.json is not valid JSON: ${err.message}`,
-      details: { error: String(err) }
-    };
-  }
-  const installed = {
-    ...pkg.dependencies ?? {},
-    ...pkg.devDependencies ?? {}
-  };
-  const entries = [];
-  for (const [name, baseline] of Object.entries(baselineVersions)) {
-    const actual = installed[name];
-    if (!actual) continue;
-    if (!isComparableRange(actual)) continue;
-    entries.push({
-      pkg: name,
-      baseline,
-      actual,
-      drift: compareSemver(actual, baseline)
-    });
-  }
-  const anyMajor = entries.some((d) => d.drift === "major");
-  const anyMinor = entries.some((d) => d.drift === "minor");
-  const anyNewer = entries.some((d) => d.drift === "newer");
-  const status = anyMajor ? "fail" : anyMinor || anyNewer ? "warn" : "pass";
-  const driftSummary = status === "pass" ? `all ${entries.length} tracked deps in line with baseline` : status === "warn" ? `${entries.filter((d) => d.drift !== "same").length} of ${entries.length} tracked deps drifted` : `${entries.filter((d) => d.drift === "major").length} deps lagging by a major version`;
-  const outdated = await scanOutdated(ctx.site.path, ctx.spawn ?? defaultSpawn);
-  const summary = outdated ? `${driftSummary}; ${outdated.outdated} outdated install(s) (${outdated.major} major)` : driftSummary;
-  return {
-    audit: "deps",
-    site: siteLabel(ctx.site),
-    status,
-    summary,
-    details: { entries, outdated }
-  };
-}
-
-// src/audits/lint.ts
-import { existsSync } from "fs";
-import { readFile as readFile2 } from "fs/promises";
-import { join as join3 } from "path";
-import { ESLint } from "eslint";
-import { check as prettierCheck, resolveConfig as prettierResolveConfig } from "prettier";
-import { glob } from "tinyglobby";
-var TARGET_GLOBS = ["**/*.{ts,js,svelte}"];
-var IGNORE = ["node_modules/**", "dist/**", ".svelte-kit/**", "build/**", ".netlify/**"];
-async function listFiles(cwd) {
-  return glob(TARGET_GLOBS, { cwd, ignore: IGNORE, absolute: false });
-}
-async function lintAudit(ctx) {
-  const { site } = ctx;
-  const configPath = join3(site.path, "eslint.config.js");
-  if (!existsSync(configPath)) {
-    return {
-      audit: "lint",
-      site: siteLabel(site),
-      status: "skip",
-      summary: "no eslint config at site root"
-    };
-  }
-  const eslint = new ESLint({
-    cwd: site.path,
-    overrideConfigFile: configPath,
-    errorOnUnmatchedPattern: false
-  });
-  const relFiles = await listFiles(site.path);
-  const eslintResults = await eslint.lintFiles(relFiles);
-  const eslintErrors = eslintResults.reduce((n, r) => n + r.errorCount, 0);
-  const eslintWarnings = eslintResults.reduce((n, r) => n + r.warningCount, 0);
-  const prettierUnformatted = [];
-  for (const rel of relFiles) {
-    const absForResolve = join3(site.path, rel);
-    const source = await readFile2(absForResolve, "utf-8");
-    const options = await prettierResolveConfig(absForResolve) ?? {};
-    const ok = await prettierCheck(source, { ...options, filepath: absForResolve });
-    if (!ok) prettierUnformatted.push(rel);
-  }
-  const status = eslintErrors > 0 || prettierUnformatted.length > 0 ? "fail" : eslintWarnings > 0 ? "warn" : "pass";
-  const summary = status === "pass" ? `lint clean across ${relFiles.length} files` : `${eslintErrors} eslint errors, ${eslintWarnings} warnings, ${prettierUnformatted.length} unformatted`;
-  return {
-    audit: "lint",
-    site: siteLabel(site),
-    status,
-    summary,
-    details: {
-      eslintErrors,
-      eslintWarnings,
-      prettierUnformatted,
-      files: relFiles.length
-    }
-  };
-}
-
-// src/audits/security.ts
-function classify(v) {
-  if (v.critical > 0 || v.high > 0) return "fail";
-  if (v.moderate > 0 || v.low > 0) return "warn";
-  return "pass";
-}
-function normalizeSeverity(s) {
-  if (s === "low" || s === "moderate" || s === "high" || s === "critical") return s;
-  return "low";
-}
-function extractAdvisoriesFromPnpm(parsed) {
-  const out = [];
-  for (const a of Object.values(parsed.advisories ?? {})) {
-    if (!a) continue;
-    out.push({
-      module: a.module_name ?? "unknown",
-      severity: normalizeSeverity(a.severity),
-      title: a.title ?? "(no title)",
-      ...a.cves ? { cves: a.cves } : {},
-      ...a.url ? { url: a.url } : {}
-    });
-  }
-  return out;
-}
-function resolveNpmAdvisoryRoot(startName, vulnerabilities) {
-  const seen = /* @__PURE__ */ new Set();
-  let current = startName;
-  while (!seen.has(current)) {
-    seen.add(current);
-    const entry = vulnerabilities[current];
-    if (!entry || !Array.isArray(entry.via)) return { rootName: current };
-    const detailed = entry.via.find(
-      (e) => typeof e === "object" && e !== null
-    );
-    if (detailed) return { rootName: current, detail: detailed };
-    const next = entry.via.find((e) => typeof e === "string");
-    if (!next || next === current) return { rootName: current };
-    current = next;
-  }
-  return { rootName: current };
-}
-function extractAdvisoriesFromNpm(parsed) {
-  const vulnerabilities = parsed.vulnerabilities ?? {};
-  const roots = /* @__PURE__ */ new Map();
-  for (const [name, v] of Object.entries(vulnerabilities)) {
-    if (!v) continue;
-    const { rootName, detail } = resolveNpmAdvisoryRoot(name, vulnerabilities);
-    if (roots.has(rootName)) continue;
-    const rootEntry = vulnerabilities[rootName];
-    const severity = normalizeSeverity(rootEntry?.severity ?? v.severity);
-    const title = detail?.title ?? rootName;
-    const url = detail?.url;
-    roots.set(rootName, {
-      module: rootEntry?.name ?? rootName,
-      severity,
-      title,
-      ...url ? { url } : {}
-    });
-  }
-  return [...roots.values()];
-}
-async function runAuditTool(spawn2, cmd, args, cwd) {
-  let raw;
-  try {
-    raw = await spawn2(cmd, args, { cwd });
-  } catch (err) {
-    const e = err;
-    if (e.code === "ENOENT" || /ENOENT/.test(String(err))) return { kind: "missing" };
-    return { kind: "error", reason: `spawn failed: ${String(err).slice(0, 200)}` };
-  }
-  if (raw.code !== 0 && raw.code !== 1) {
-    return {
-      kind: "error",
-      reason: `exit ${raw.code}${raw.stderr ? `: ${raw.stderr.slice(0, 150)}` : ""}`
-    };
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw.stdout || "{}");
-  } catch (err) {
-    return { kind: "error", reason: `unparseable JSON: ${String(err).slice(0, 100)}` };
-  }
-  const errEnvelope = parsed.error;
-  if (errEnvelope && typeof errEnvelope === "object") {
-    return { kind: "error", reason: errEnvelope.code ?? "error envelope returned" };
-  }
-  const vulnsMeta = parsed.metadata?.vulnerabilities;
-  if (!vulnsMeta || Object.keys(vulnsMeta).length === 0) {
-    return { kind: "error", reason: "no metadata.vulnerabilities in output" };
-  }
-  return { kind: "ok", parsed };
-}
-async function securityAudit(ctx) {
-  const spawn2 = ctx.spawn ?? defaultSpawn;
-  const site = ctx.site;
-  const label = siteLabel(site);
-  let used = "pnpm audit";
-  let result = await runAuditTool(spawn2, "pnpm", ["audit", "--json", "--prod"], site.path);
-  if (result.kind !== "ok") {
-    const pnpmReason = result.kind === "missing" ? "not installed" : result.reason;
-    const npmResult = await runAuditTool(
-      spawn2,
-      "npm",
-      ["audit", "--json", "--omit=dev"],
-      site.path
-    );
-    if (npmResult.kind === "ok") {
-      result = npmResult;
-      used = "npm audit";
-    } else {
-      const npmReason = npmResult.kind === "missing" ? "not installed" : npmResult.reason;
-      return {
-        audit: "security",
-        site: label,
-        status: "skip",
-        summary: `cannot run audit \u2014 pnpm: ${pnpmReason}; npm: ${npmReason}`
-      };
-    }
-  }
-  const parsed = result.parsed;
-  const counts = {
-    low: parsed.metadata?.vulnerabilities?.low ?? 0,
-    moderate: parsed.metadata?.vulnerabilities?.moderate ?? 0,
-    high: parsed.metadata?.vulnerabilities?.high ?? 0,
-    critical: parsed.metadata?.vulnerabilities?.critical ?? 0
-  };
-  const advisories = used === "pnpm audit" ? extractAdvisoriesFromPnpm(parsed) : extractAdvisoriesFromNpm(parsed);
-  const status = classify(counts);
-  const total = counts.low + counts.moderate + counts.high + counts.critical;
-  const summary = status === "pass" ? `${used}: 0 vulnerabilities` : `${used}: ${total} vulnerabilities (${counts.critical}C/${counts.high}H/${counts.moderate}M/${counts.low}L)`;
-  return {
-    audit: "security",
-    site: label,
-    status,
-    summary,
-    details: { counts, advisories }
-  };
-}
-
-// src/audits/lighthouse.ts
-import { readFile as readFile4, writeFile, mkdtemp, rm, readdir } from "fs/promises";
-import { tmpdir } from "os";
-import { join as join5 } from "path";
-
-// src/configs/lighthouse.ts
-var lighthouseConfig = {
-  ci: {
-    collect: {
-      url: ["http://localhost:5173/dev/a11y-fixtures"],
-      // `npm run vite:dev` works on both pnpm and npm sites — pnpm respects
-      // the `run` form too. Keeps this config portable across the fleet
-      // while sites transition to pnpm.
-      startServerCommand: "npm run vite:dev",
-      startServerReadyPattern: "ready in",
-      startServerReadyTimeout: 12e4,
-      numberOfRuns: 1,
-      settings: {
-        preset: "desktop",
-        skipAudits: ["uses-http2"]
-      }
-    },
-    assert: {
-      assertions: {
-        "categories:accessibility": ["error", { minScore: 0.95 }],
-        "categories:best-practices": ["error", { minScore: 0.9 }],
-        "categories:seo": ["error", { minScore: 0.9 }],
-        "categories:performance": ["warn", { minScore: 0.7 }]
-      }
-    },
-    upload: {
-      target: "temporary-public-storage"
-    }
-  }
-};
-
-// src/audits/util/site-config.ts
-import { readFile as readFile3 } from "fs/promises";
-import { join as join4 } from "path";
-async function readSiteConfig(sitePath) {
-  let raw;
-  try {
-    raw = await readFile3(join4(sitePath, "package.json"), "utf-8");
-  } catch {
-    return {};
-  }
-  let pkg;
-  try {
-    pkg = JSON.parse(raw);
-  } catch {
-    return {};
-  }
-  if (!pkg || typeof pkg !== "object") return {};
-  const cfg = pkg.reddoor;
-  if (!cfg || typeof cfg !== "object") return {};
-  const out = {};
-  const url = cfg.lighthouseUrl;
-  if (typeof url === "string" && url.length > 0) {
-    out.lighthouseUrl = url;
-  }
-  return out;
-}
-
-// src/util/free-port.ts
-import { createServer } from "net";
-async function findFreePort() {
-  return new Promise((resolve3, reject) => {
-    const server = createServer();
-    server.unref();
-    server.on("error", reject);
-    server.listen(0, "127.0.0.1", () => {
-      const addr = server.address();
-      if (typeof addr === "object" && addr) {
-        const port = addr.port;
-        server.close(() => resolve3(port));
-      } else {
-        server.close();
-        reject(new Error("findFreePort: could not determine assigned port from socket"));
-      }
-    });
-  });
-}
-function withFreePort(url, port) {
-  const u = new URL(url);
-  u.hostname = "localhost";
-  u.port = String(port);
-  return u.toString();
-}
-
-// src/audits/lighthouse.ts
-async function readJsonMaybe(path) {
-  try {
-    const raw = await readFile4(path, "utf-8");
-    return JSON.parse(raw);
-  } catch {
-    return null;
-  }
-}
-async function readLhrEntries(resultsDir) {
-  const files = await readdir(resultsDir).catch(() => []);
-  const entries = [];
-  for (const f of files) {
-    if (!f.startsWith("lhr-") || !f.endsWith(".json")) continue;
-    const lhr = await readJsonMaybe(join5(resultsDir, f));
-    if (!lhr || !lhr.categories) continue;
-    const summary = {};
-    for (const [k, v] of Object.entries(lhr.categories)) {
-      if (typeof v?.score === "number") summary[k] = v.score;
-    }
-    entries.push({ url: lhr.requestedUrl, summary });
-  }
-  return entries;
-}
-function averageSummaries(entries) {
-  if (entries.length === 0) return {};
-  const sums = {};
-  const counts = {};
-  for (const e of entries) {
-    for (const [k, v] of Object.entries(e.summary ?? {})) {
-      if (typeof v !== "number") continue;
-      sums[k] = (sums[k] ?? 0) + v;
-      counts[k] = (counts[k] ?? 0) + 1;
-    }
-  }
-  const out = {};
-  for (const k of Object.keys(sums)) {
-    const total = sums[k] ?? 0;
-    const count = counts[k] ?? 1;
-    out[k] = total / count;
-  }
-  return out;
-}
-function categoryFromAssertion(a) {
-  const colonIdx = a.name.indexOf(":");
-  return colonIdx >= 0 ? a.name.slice(colonIdx + 1) : a.name;
-}
-function messageForAssertion(a) {
-  const actual = typeof a.actual === "number" ? a.actual.toFixed(2) : "n/a";
-  return `${a.name} ${a.operator} ${a.expected} (actual: ${actual})`;
-}
-async function parseLhciResults(resultsDir, label, raw) {
-  const manifest = await readLhrEntries(resultsDir);
-  if (manifest.length === 0) {
-    return {
-      audit: "lighthouse",
-      site: label,
-      status: "fail",
-      summary: `lighthouse: no lhr-*.json written (exit ${raw.code})${raw.stderr ? ` \u2014 ${raw.stderr.slice(0, 200)}` : ""}`
-    };
-  }
-  const assertionResults = await readJsonMaybe(join5(resultsDir, "assertion-results.json")) ?? [];
-  const failed = assertionResults.filter((a) => !a.passed);
-  const assertions = failed.map((a) => ({
-    category: categoryFromAssertion(a),
-    level: a.level,
-    message: messageForAssertion(a)
-  }));
-  const anyError = assertions.some((a) => a.level === "error");
-  const anyWarn = assertions.some((a) => a.level === "warn");
-  const status = anyError ? "fail" : anyWarn ? "warn" : "pass";
-  const normalized = {
-    summary: averageSummaries(manifest),
-    assertionsFailed: failed.length,
-    assertions
-  };
-  const summary = status === "pass" ? "lighthouse: all categories passing" : `lighthouse: ${failed.length} assertion(s) failed`;
-  return { audit: "lighthouse", site: label, status, summary, details: normalized };
-}
-async function checkoutLighthouse(spawn2, site, label) {
-  const siteCfg = await readSiteConfig(site.path);
-  const port = await findFreePort();
-  const baseUrl = siteCfg.lighthouseUrl ?? lighthouseConfig.ci.collect.url[0];
-  const resolvedConfig = {
-    ...lighthouseConfig,
-    ci: {
-      ...lighthouseConfig.ci,
-      collect: {
-        ...lighthouseConfig.ci.collect,
-        url: [withFreePort(baseUrl, port)],
-        startServerCommand: `npm run vite:dev -- --port ${port} --strictPort`
-      }
-    }
-  };
-  const configDir = await mkdtemp(join5(tmpdir(), "reddoor-lhci-"));
-  const configPath = join5(configDir, "lighthouserc.json");
-  await writeFile(configPath, JSON.stringify(resolvedConfig), "utf-8");
-  const resultsDir = join5(site.path, ".lighthouseci");
-  await rm(resultsDir, { recursive: true, force: true });
-  let raw;
-  try {
-    raw = await spawn2("npx", ["--yes", "@lhci/cli", "autorun", `--config=${configPath}`], {
-      cwd: site.path,
-      timeoutMs: 5 * 6e4
-    });
-  } catch (err) {
-    await rm(configDir, { recursive: true, force: true });
-    const e = err;
-    if (e.code === "ENOENT" || /ENOENT/.test(String(err))) {
-      return {
-        audit: "lighthouse",
-        site: label,
-        status: "skip",
-        summary: "npx/@lhci/cli not available"
-      };
-    }
-    throw err;
-  }
-  await rm(configDir, { recursive: true, force: true });
-  return parseLhciResults(resultsDir, label, raw);
-}
-async function deployedLighthouse(spawn2, deployedUrl, label) {
-  const workDir = await mkdtemp(join5(tmpdir(), "reddoor-lh-deployed-"));
-  const resolvedConfig = {
-    ci: {
-      // Deliberately NOT spread from lighthouseConfig.ci.collect: deployed mode
-      // must omit startServerCommand and the dev-server settings entirely.
-      collect: {
-        url: [deployedUrl],
-        // 3 runs to damp Lighthouse's run-to-run variance; parseLhciResults
-        // averages the lhr files. (Median is a tracked future refinement.)
-        numberOfRuns: 3,
-        settings: { preset: "desktop", skipAudits: ["uses-http2"] }
-      },
-      assert: lighthouseConfig.ci.assert,
-      upload: { target: "filesystem", outputDir: join5(workDir, "lhci-report") }
-    }
-  };
-  const configPath = join5(workDir, "lighthouserc.json");
-  await writeFile(configPath, JSON.stringify(resolvedConfig), "utf-8");
-  const resultsDir = join5(workDir, ".lighthouseci");
-  let raw;
-  try {
-    raw = await spawn2("npx", ["--yes", "@lhci/cli", "autorun", `--config=${configPath}`], {
-      cwd: workDir,
-      // 3 serial cold runs of a slow deployed site (lhci's own maxWaitForLoad
-      // ~45-60s each) + first-use Chrome download can plausibly exceed 3 min →
-      // SIGTERM → no lhr-*.json → spurious "no scores". Match the 5-min budget
-      // the checkout path already gives (erp-industrials nightly flake,
-      // morning-brief 2026-06-10 MEDIUM-F).
-      timeoutMs: 5 * 6e4
-    });
-  } catch (err) {
-    await rm(workDir, { recursive: true, force: true });
-    const e = err;
-    if (e.code === "ENOENT" || /ENOENT/.test(String(err))) {
-      return {
-        audit: "lighthouse",
-        site: label,
-        status: "skip",
-        summary: "npx/@lhci/cli not available"
-      };
-    }
-    throw err;
-  }
-  try {
-    return await parseLhciResults(resultsDir, label, raw);
-  } finally {
-    await rm(workDir, { recursive: true, force: true });
-  }
-}
-async function lighthouseAudit(ctx) {
-  const spawn2 = ctx.spawn ?? defaultSpawn;
-  const site = ctx.site;
-  const label = siteLabel(site);
-  return site.deployedUrl ? deployedLighthouse(spawn2, site.deployedUrl, label) : checkoutLighthouse(spawn2, site, label);
-}
-
-// src/audits/a11y.ts
-import { readFile as readFile5, writeFile as writeFile2, mkdtemp as mkdtemp2, rm as rm2 } from "fs/promises";
-import { join as join6 } from "path";
-
-// src/configs/playwright-a11y.ts
-import { defineConfig, devices } from "@playwright/test";
-var a11yRoutes = [
-  { path: "/dev/a11y-fixtures", name: "a11y fixtures" },
-  { path: "/dev/animate-in", name: "animate-in demo" }
-];
-var smokeRoutes = [{ path: "/", name: "home" }];
-var playwrightA11yConfig = defineConfig({
-  testDir: "tests",
-  testMatch: /.*\.spec\.ts$/,
-  fullyParallel: true,
-  forbidOnly: !!process.env.CI,
-  retries: process.env.CI ? 2 : 0,
-  reporter: process.env.CI ? "github" : "list",
-  use: {
-    baseURL: "http://localhost:5173",
-    trace: "on-first-retry"
-  },
-  projects: [
-    {
-      name: "chromium",
-      use: { ...devices["Desktop Chrome"] }
-    }
-  ],
-  webServer: {
-    // Portable across pnpm and npm sites — pnpm respects `npm run` too.
-    command: "npm run vite:dev",
-    url: "http://localhost:5173/dev/a11y-fixtures",
-    reuseExistingServer: !process.env.CI,
-    timeout: 12e4
-  }
-});
-
-// src/audits/a11y.ts
-var RESULTS_REL = ".reddoor-a11y/results.json";
-async function readJsonMaybe2(path) {
-  try {
-    const raw = await readFile5(path, "utf-8");
-    return JSON.parse(raw);
-  } catch {
-    return null;
-  }
-}
-function buildPlaywrightConfig(port, sitePath) {
-  return `import { defineConfig } from "@playwright/test";
-
-export default defineConfig({
-  testDir: ".",
-  testMatch: /.*\\.spec\\.ts$/,
-  fullyParallel: true,
-  forbidOnly: !!process.env.CI,
-  retries: process.env.CI ? 2 : 0,
-  reporter: process.env.CI ? "github" : "list",
-  use: {
-    baseURL: "http://localhost:${port}",
-    trace: "on-first-retry",
-  },
-  webServer: {
-    // --strictPort: refuse to bump to a different port if ours is taken,
-    //   so the audit fails loudly instead of probing a zombie.
-    // reuseExistingServer:false: never reuse \u2014 we control the lifecycle.
-    // cwd: playwright's default webServer.cwd is the config file's
-    //   directory. Our config lives in /tmp so without this override,
-    //   "npm run vite:dev" tries to read /tmp/.../package.json and
-    //   ENOENTs before vite ever starts. Caltex 2026-05-28 (0.10.5).
-    command: "npm run vite:dev -- --port ${port} --strictPort",
-    url: "http://localhost:${port}/dev/a11y-fixtures",
-    cwd: ${JSON.stringify(sitePath)},
-    reuseExistingServer: false,
-    timeout: 120_000,
-  },
-});
-`;
-}
-function buildSpec() {
-  return `import { test, expect } from "@playwright/test";
-import AxeBuilder from "@axe-core/playwright";
-import { mkdir, writeFile } from "node:fs/promises";
-import { dirname } from "node:path";
-
-const pages = ${JSON.stringify(a11yRoutes)};
-const smokePages = ${JSON.stringify(smokeRoutes)};
-const OUTPUT = process.env.REDDOOR_A11Y_OUTPUT;
-
-// Playwright's default per-test timeout is 30s. We loop through every
-// configured route in a single test, so the budget needs to scale.
-test.setTimeout(5 * 60_000);
-
-test("a11y + hydration across configured routes", async ({ page }) => {
-  const violations = [];
-
-  // Capture uncaught client-side exceptions across every route we visit. A page
-  // that builds + SSRs cleanly can still throw on hydrate and blank itself
-  // (data-dynamiq: a Svelte 4->5 run() referenced a $state declared after it) --
-  // axe never sees that, so we listen for it directly and tag the route in scope.
-  let currentRoute = "";
-  page.on("pageerror", (err) => {
-    violations.push({
-      id: "client-error",
-      impact: "critical",
-      route: currentRoute,
-      help: String(err && err.message ? err.message : err),
-    });
-  });
-
-  for (const { path, name } of pages) {
-    currentRoute = name;
-    await page.goto(path);
-    // Snap CSS transitions/animations to their resting state before axe runs.
-    // AnimateIn-style fixtures transition opacity 0->1; sampling mid-transition
-    // makes axe compute color-contrast against semi-transparent text, yielding a
-    // flaky "serious" color-contrast violation (~1/3 of runs on /dev/animate-in).
-    // Disabling transitions/animations forces the final, rendered state
-    // deterministically -- which is also what users (and prefers-reduced-motion
-    // users) actually see, so it's the correct thing to assert.
-    await page.addStyleTag({
-      content: "*,*::before,*::after{transition:none!important;animation:none!important;}",
-    });
-    const results = await new AxeBuilder({ page })
-      .withTags(["wcag2a","wcag2aa","wcag21a","wcag21aa","wcag22aa"])
-      .analyze();
-    for (const v of results.violations) {
-      violations.push({
-        id: v.id,
-        impact: v.impact ?? "moderate",
-        route: name,
-        help: v.help,
-        helpUrl: v.helpUrl,
-        nodes: v.nodes.map((n) => ({ html: n.html, target: n.target })),
-      });
-    }
-  }
-
-  // Hydration smoke check: load real routes (the homepage) and fail on any
-  // uncaught client-side error. No axe here -- real routes carry pre-existing
-  // a11y debt we don't gate on; we only assert they don't crash on hydrate.
-  // HTTP/SSR errors don't fire 'pageerror', so a data-less CI homepage that
-  // renders empty-but-valid won't false-fail -- only a real client crash does.
-  for (const { path, name } of smokePages) {
-    currentRoute = name;
-    await page.goto(path);
-    // Let hydration + first effects run so a TDZ/ReferenceError surfaces.
-    await page.waitForTimeout(2000);
-  }
-
-  const byImpact = {};
-  for (const v of violations) {
-    byImpact[v.impact] = (byImpact[v.impact] ?? 0) + 1;
-  }
-  if (OUTPUT) {
-    await mkdir(dirname(OUTPUT), { recursive: true });
-    await writeFile(
-      OUTPUT,
-      JSON.stringify({ totalViolations: violations.length, byImpact, violations }, null, 2),
-    );
-  }
-  expect(violations).toEqual([]);
-});
-`;
-}
-async function a11yAudit(ctx) {
-  const spawn2 = ctx.spawn ?? defaultSpawn;
-  const site = ctx.site;
-  const label = siteLabel(site);
-  const specDir = await mkdtemp2(join6(site.path, ".reddoor-a11y-spec-"));
-  try {
-    const specPath = join6(specDir, "a11y.spec.ts");
-    await writeFile2(specPath, buildSpec(), "utf-8");
-    const port = await findFreePort();
-    const configPath = join6(specDir, "playwright.config.ts");
-    await writeFile2(configPath, buildPlaywrightConfig(port, site.path), "utf-8");
-    const resultsPath = join6(site.path, RESULTS_REL);
-    await rm2(join6(site.path, ".reddoor-a11y"), { recursive: true, force: true });
-    let raw;
-    try {
-      raw = await spawn2(
-        "npx",
-        ["--yes", "playwright", "test", `--config=${configPath}`, "--reporter=line", specPath],
-        {
-          cwd: site.path,
-          env: { ...process.env, REDDOOR_A11Y_OUTPUT: resultsPath },
-          // playwright on a cold tree downloads Chrome, boots the site's dev
-          // server, and runs axe over every configured route. The shared 30 s
-          // default in runAudits is fine for deps/lint/security but starves
-          // playwright (mirrors the lighthouse fix shipped earlier).
-          timeoutMs: 5 * 6e4
-        }
-      );
-    } catch (err) {
-      const e = err;
-      if (e.code === "ENOENT" || /ENOENT/.test(String(err))) {
-        return {
-          audit: "a11y",
-          site: label,
-          status: "skip",
-          summary: "npx/playwright not available"
-        };
-      }
-      throw err;
-    }
-    const artifact = await readJsonMaybe2(resultsPath);
-    if (!artifact) {
-      return {
-        audit: "a11y",
-        site: label,
-        status: "fail",
-        summary: `a11y: no results written (exit ${raw.code})${raw.stderr ? ` \u2014 ${raw.stderr.slice(0, 200)}` : ""}`
-      };
-    }
-    const hasSerious = (artifact.byImpact.serious ?? 0) > 0 || (artifact.byImpact.critical ?? 0) > 0;
-    const hasAny = artifact.totalViolations > 0;
-    const status = hasSerious ? "fail" : hasAny ? "warn" : "pass";
-    const summary = status === "pass" ? `a11y: 0 violations across ${a11yRoutes.length} routes (+${smokeRoutes.length} hydration smoke)` : `a11y: ${artifact.totalViolations} violations`;
-    return {
-      audit: "a11y",
-      site: label,
-      status,
-      summary,
-      details: artifact
-    };
-  } finally {
-    await rm2(specDir, { recursive: true, force: true });
-  }
-}
-
-// src/audits/domain.ts
-import { promises as dnsPromises } from "dns";
-import tls from "tls";
-var MS_PER_DAY = 24 * 60 * 60 * 1e3;
-async function checkDomain(url, deps) {
-  let host;
-  try {
-    host = new URL(url).hostname;
-  } catch {
-    return { resolved: false, certDaysRemaining: null };
-  }
-  try {
-    await deps.lookup(host);
-  } catch {
-    return { resolved: false, certDaysRemaining: null };
-  }
-  let validTo;
-  try {
-    validTo = await deps.certValidTo(host);
-  } catch {
-    validTo = null;
-  }
-  if (!validTo || Number.isNaN(validTo.getTime()))
-    return { resolved: true, certDaysRemaining: null };
-  return {
-    resolved: true,
-    certDaysRemaining: Math.floor((validTo.getTime() - deps.now.getTime()) / MS_PER_DAY)
-  };
-}
-function defaultDomainDeps(now) {
-  return {
-    lookup: async (host) => {
-      await dnsPromises.lookup(host);
-    },
-    certValidTo: (host) => new Promise((resolvePromise) => {
-      const socket = tls.connect(
-        { host, port: 443, servername: host, timeout: 1e4, rejectUnauthorized: true },
-        () => {
-          const cert = socket.authorized ? socket.getPeerCertificate() : null;
-          socket.end();
-          const validTo = cert && cert.valid_to ? new Date(cert.valid_to) : null;
-          resolvePromise(validTo);
-        }
-      );
-      socket.on("error", () => resolvePromise(null));
-      socket.on("timeout", () => {
-        socket.destroy();
-        resolvePromise(null);
-      });
-    }),
-    now
-  };
-}
-async function domainAudit(ctx) {
-  const { site } = ctx;
-  const label = siteLabel(site);
-  if (!site.deployedUrl) {
-    return { audit: "domain", site: label, status: "skip", summary: "no deployed URL" };
-  }
-  const now = ctx.now ?? /* @__PURE__ */ new Date();
-  const deps = ctx.domainDeps ?? defaultDomainDeps(now);
-  const check = await checkDomain(site.deployedUrl, deps);
-  const checkedAt = now.toISOString();
-  const status = check.resolved && check.certDaysRemaining !== null && check.certDaysRemaining > 14 ? "pass" : "warn";
-  const summary = !check.resolved ? "did not resolve" : check.certDaysRemaining === null ? "resolved, no usable TLS cert" : `resolved, cert ${check.certDaysRemaining}d remaining`;
-  return {
-    audit: "domain",
-    site: label,
-    status,
-    summary,
-    details: { resolved: check.resolved, certDaysRemaining: check.certDaysRemaining, checkedAt }
-  };
-}
-
-// src/audits/route-discovery.ts
-var DEFAULT_CAP = 15;
-function parseSitemapUrls(xml) {
-  const out = [];
-  const re = /<loc>\s*([^<\s]+)\s*<\/loc>/gi;
-  let m;
-  while ((m = re.exec(xml)) !== null) {
-    const url = m[1];
-    if (url) out.push(url.trim());
-  }
-  return out;
-}
-function parseHtmlLinks(html, baseUrl) {
-  const out = /* @__PURE__ */ new Set();
-  const re = /<a\b[^>]*\bhref\s*=\s*["']([^"']+)["']/gi;
-  let m;
-  while ((m = re.exec(html)) !== null) {
-    const href = m[1];
-    if (!href || href.startsWith("#") || /^(mailto:|tel:|javascript:)/i.test(href)) continue;
-    try {
-      const u = new URL(href, baseUrl);
-      if (u.origin !== new URL(baseUrl).origin) continue;
-      out.add(u.pathname);
-    } catch {
-    }
-  }
-  return [...out];
-}
-function family(pathname) {
-  return pathname.split("/").filter(Boolean)[0] ?? "";
-}
-function sampleRoutePaths(urlsOrPaths, cap = DEFAULT_CAP) {
-  const seen = /* @__PURE__ */ new Set(["/"]);
-  const buckets = /* @__PURE__ */ new Map();
-  for (const raw of urlsOrPaths) {
-    let pathname;
-    try {
-      pathname = raw.startsWith("/") ? new URL(raw, "https://x.invalid").pathname : new URL(raw).pathname;
-    } catch {
-      continue;
-    }
-    if (pathname === "/") continue;
-    if (seen.has(pathname)) continue;
-    seen.add(pathname);
-    const fam = family(pathname);
-    const arr = buckets.get(fam) ?? [];
-    arr.push(pathname);
-    buckets.set(fam, arr);
-  }
-  const result = ["/"];
-  const families = [...buckets.values()];
-  let guard = 0;
-  while (result.length < cap && families.some((f) => f.length > 0) && guard++ < 1e4) {
-    for (const fam of families) {
-      if (result.length >= cap) break;
-      const next = fam.shift();
-      if (next) result.push(next);
-    }
-  }
-  return result;
-}
-function familyCountsOf(paths) {
-  const counts = {};
-  for (const p of paths) {
-    const key = p === "/" ? "/" : `/${family(p)}`;
-    counts[key] = (counts[key] ?? 0) + 1;
-  }
-  return counts;
-}
-async function discoverRoutes(deployedUrl, deps, cap = DEFAULT_CAP) {
-  const origin = new URL(deployedUrl).origin;
-  const abs = (paths) => paths.map((p) => new URL(p, origin).href);
-  const sitemapXml = await deps.fetchText(new URL("/sitemap.xml", origin).href);
-  if (sitemapXml) {
-    const urls = parseSitemapUrls(sitemapXml);
-    if (urls.length > 0) {
-      const paths = sampleRoutePaths(urls, cap);
-      return { routes: abs(paths), source: "sitemap", familyCounts: familyCountsOf(paths) };
-    }
-  }
-  const homeHtml = await deps.fetchText(origin);
-  if (homeHtml) {
-    const links = parseHtmlLinks(homeHtml, origin);
-    if (links.length > 0) {
-      const paths = sampleRoutePaths(links, cap);
-      return { routes: abs(paths), source: "homepage-links", familyCounts: familyCountsOf(paths) };
-    }
-  }
-  return { routes: [new URL("/", origin).href], source: "root-only", familyCounts: { "/": 1 } };
-}
-
-// src/audits/browser.ts
-function isBroken(status) {
-  return status === null || status >= 400;
-}
-function summarizeBrowser(routes, links, familyCounts) {
-  const desktopChecks = routes.flatMap((r) => r.desktop);
-  const mobileChecks = routes.flatMap((r) => r.mobile);
-  const desktopOk = routes.length > 0 && routes.every((r) => r.desktop.length > 0 && r.desktop.every((d) => d.ok));
-  const mobileOk = routes.length > 0 && routes.every((r) => r.mobile.length > 0 && r.mobile.every((m) => m.ok));
-  const brokenLinks = links.filter((l) => isBroken(l.status)).length;
-  const linksOk = links.length > 0 && brokenLinks === 0;
-  const engines = [...new Set(desktopChecks.map((d) => d.engine))];
-  const devices2 = [...new Set(mobileChecks.map((m) => m.device))];
-  const families = Object.entries(familyCounts).map(([f, n]) => f === "/" ? "/" : `${f} \xD7${n}`).join(", ");
-  const note = `${routes.length} routes (${families}); desktop ${engines.join("/") || "\u2014"}; mobile ${devices2.join("/") || "\u2014"}; ${links.length} links, ${brokenLinks} broken`;
-  return { desktopOk, mobileOk, linksOk, brokenLinks, routesChecked: routes.length, note };
-}
-async function browserAudit(ctx) {
-  const { site } = ctx;
-  const label = siteLabel(site);
-  if (!site.deployedUrl) {
-    return { audit: "browser", site: label, status: "skip", summary: "no deployed URL" };
-  }
-  const now = ctx.now ?? /* @__PURE__ */ new Date();
-  const discoverDeps = ctx.discoverDeps ?? defaultDiscoverDeps();
-  const runner = ctx.browserRunner ?? await defaultBrowserRunner();
-  try {
-    const discovered = await discoverRoutes(site.deployedUrl, discoverDeps);
-    const routeResults = await runner.probe(discovered.routes);
-    const internalLinks = [...new Set(routeResults.flatMap((r) => r.links))];
-    const linkResults = await runner.checkLinks(internalLinks);
-    const summary = summarizeBrowser(
-      routeResults,
-      linkResults,
-      discovered.familyCounts ?? familyCountsOf(discovered.routes)
-    );
-    const status = summary.desktopOk && summary.mobileOk && summary.linksOk ? "pass" : "warn";
-    return {
-      audit: "browser",
-      site: label,
-      status,
-      summary: summary.note,
-      details: { ...summary, checkedAt: now.toISOString() }
-    };
-  } finally {
-    await runner.close?.();
-  }
-}
-var FETCH_TIMEOUT_MS = 1e4;
-function defaultDiscoverDeps() {
-  return {
-    fetchText: async (url) => {
-      try {
-        const res = await fetch(url, {
-          redirect: "follow",
-          signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
-        });
-        if (!res.ok) return null;
-        return await res.text();
-      } catch {
-        return null;
-      }
-    }
-  };
-}
-var DESKTOP_VIEWPORT = { width: 1366, height: 900 };
-var PAGE_TIMEOUT_MS = 3e4;
-async function defaultBrowserRunner() {
-  const { chromium, firefox, webkit, devices: devices2 } = await import("@playwright/test");
-  const desktopEngines = [
-    { engine: "chromium", type: chromium },
-    { engine: "firefox", type: firefox },
-    { engine: "webkit", type: webkit }
-  ];
-  const mobileTargets = [
-    { device: "Pixel 7", descriptor: devices2["Pixel 7"] },
-    { device: "iPhone 14", descriptor: devices2["iPhone 14"] }
-  ];
-  return {
-    async probe(urls) {
-      const results = [];
-      const browsers = await Promise.all(desktopEngines.map((e) => e.type.launch()));
-      const mobileBrowsers = await Promise.all(mobileTargets.map(() => chromium.launch()));
-      try {
-        for (const url of urls) {
-          const desktop = [];
-          const linkSet = /* @__PURE__ */ new Set();
-          for (let i = 0; i < desktopEngines.length; i++) {
-            const engine = desktopEngines[i].engine;
-            const browser = browsers[i];
-            const ctx = await browser.newContext({ viewport: DESKTOP_VIEWPORT });
-            const page = await ctx.newPage();
-            const errors = [];
-            page.on("pageerror", (e) => errors.push(String(e)));
-            let ok = false;
-            try {
-              const resp = await page.goto(url, {
-                waitUntil: "domcontentloaded",
-                timeout: PAGE_TIMEOUT_MS
-              });
-              const hasMain = await page.locator("main, [role=main]").first().isVisible().catch(() => false);
-              ok = !!resp && resp.ok() && errors.length === 0 && hasMain;
-              if (engine === "chromium") {
-                const hrefs = await page.evaluate("Array.from(document.querySelectorAll('a[href]')).map((a) => a.href)").catch(() => []);
-                const origin = new URL(url).origin;
-                for (const h of hrefs) {
-                  try {
-                    if (new URL(h).origin === origin) linkSet.add(new URL(h).href);
-                  } catch {
-                  }
-                }
-              }
-            } catch {
-              ok = false;
-            } finally {
-              await ctx.close().catch(() => {
-              });
-            }
-            desktop.push({ engine, ok });
-          }
-          const mobile = [];
-          for (let i = 0; i < mobileTargets.length; i++) {
-            const { device, descriptor } = mobileTargets[i];
-            const browser = mobileBrowsers[i];
-            const ctx = await browser.newContext({ ...descriptor });
-            const page = await ctx.newPage();
-            const errors = [];
-            page.on("pageerror", (e) => errors.push(String(e)));
-            let ok = false;
-            try {
-              const resp = await page.goto(url, {
-                waitUntil: "domcontentloaded",
-                timeout: PAGE_TIMEOUT_MS
-              });
-              const overflow = await page.evaluate("document.documentElement.scrollWidth > window.innerWidth + 2").catch(() => true);
-              ok = !!resp && resp.ok() && errors.length === 0 && !overflow;
-            } catch {
-              ok = false;
-            } finally {
-              await ctx.close().catch(() => {
-              });
-            }
-            mobile.push({ device, ok });
-          }
-          results.push({ url, desktop, mobile, links: [...linkSet] });
-        }
-      } finally {
-        await Promise.all([...browsers, ...mobileBrowsers].map((b) => b.close().catch(() => {
-        })));
-      }
-      return results;
-    },
-    async checkLinks(urls) {
-      const out = [];
-      for (const url of urls) {
-        let status;
-        try {
-          let res = await fetch(url, {
-            method: "HEAD",
-            redirect: "follow",
-            signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
-          });
-          if (res.status === 405 || res.status === 501) {
-            res = await fetch(url, {
-              method: "GET",
-              redirect: "follow",
-              signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
-            });
-          }
-          status = res.status;
-        } catch {
-          status = null;
-        }
-        out.push({ url, status });
-      }
-      return out;
-    }
-  };
-}
-
-// src/audits/index.ts
-var REGISTRY = {
-  deps: depsAudit,
-  lint: lintAudit,
-  security: securityAudit,
-  lighthouse: lighthouseAudit,
-  a11y: a11yAudit,
-  domain: domainAudit,
-  browser: browserAudit
-};
-var ALL_AUDIT_NAMES = Object.keys(REGISTRY);
-var DEFAULT_AUDIT_TIMEOUT_MS = 3e4;
-function timedSpawn(timeoutMs) {
-  return (cmd, args, opts = {}) => defaultSpawn(cmd, args, { ...opts, timeoutMs: opts.timeoutMs ?? timeoutMs });
-}
-async function runOneAudit(site, name) {
-  if (!(name in REGISTRY)) throw new Error(`unknown audit: ${name}`);
-  const spawn2 = timedSpawn(DEFAULT_AUDIT_TIMEOUT_MS);
-  const label = site.name || site.path;
-  try {
-    return await REGISTRY[name]({ site, spawn: spawn2 });
-  } catch (err) {
-    return {
-      audit: name,
-      site: label,
-      status: "fail",
-      summary: `${name}: unexpected error \u2014 ${String(err)}`
-    };
-  }
-}
-
-// src/cli/fleet/resolve-sites.ts
-import { pathToFileURL } from "url";
-import { resolve, extname } from "path";
-
-// src/inventory/local.ts
-import { basename } from "path";
-function localPath(path, opts = {}) {
-  const site = { path, name: opts.name || basename(path) };
-  return async () => [site];
-}
-
-// src/inventory/json.ts
-init_url();
-import { readFile as readFile6 } from "fs/promises";
-import { isAbsolute } from "path";
-function validate(raw) {
-  if (!Array.isArray(raw)) {
-    throw new Error("inventory JSON must be an array of sites");
-  }
-  return raw.map((entry, i) => {
-    if (!entry || typeof entry !== "object") {
-      throw new Error(`inventory entry ${i} is not an object`);
-    }
-    const e = entry;
-    if (typeof e.path !== "string" || e.path.length === 0) {
-      throw new Error(`inventory entry ${i} is missing required field: path`);
-    }
-    if (!isAbsolute(e.path)) {
-      throw new Error(
-        `inventory entry ${i}: path must be absolute (got "${e.path}"). Relative paths are rejected so cwd at invocation can't change which site is targeted.`
-      );
-    }
-    const site = { path: e.path };
-    if (typeof e.name === "string") site.name = e.name;
-    if (typeof e.repoUrl === "string") site.repoUrl = e.repoUrl;
-    if (typeof e.gitRepo === "string") site.gitRepo = e.gitRepo;
-    if (typeof e.deployedUrl === "string") {
-      if (isHttpUrl(e.deployedUrl)) {
-        site.deployedUrl = e.deployedUrl;
-      } else {
-        console.warn(
-          `[inventory] entry ${i}: ignoring deployedUrl that is not http(s): ${JSON.stringify(e.deployedUrl)}`
-        );
-      }
-    }
-    if (typeof e.meta === "object" && e.meta !== null) {
-      site.meta = e.meta;
-    }
-    return site;
-  });
-}
-function fromJsonFile(path) {
-  return async () => {
-    const text = await readFile6(path, "utf-8");
-    let raw;
-    try {
-      raw = JSON.parse(text);
-    } catch (e) {
-      throw new Error(`could not parse inventory file ${path}: ${e.message}`, {
-        cause: e
-      });
-    }
-    return validate(raw);
-  };
-}
-
-// src/cli/fleet/resolve-sites.ts
-init_url();
-function sanitizeDynamicSites(sites) {
-  return sites.map((s) => {
-    if (s.deployedUrl !== void 0 && !isHttpUrl(s.deployedUrl)) {
-      console.warn(
-        `[inventory] dynamic inventory: ignoring deployedUrl that is not http(s) for ${s.name ?? s.path}: ${JSON.stringify(s.deployedUrl)}`
-      );
-      const copy = { ...s };
-      delete copy.deployedUrl;
-      return copy;
-    }
-    return s;
-  });
-}
-async function resolveSites(input) {
-  if (input.site && input.fleet) {
-    throw Object.assign(new Error("cannot combine a positional [site] with --fleet"), {
-      exitCode: 2
-    });
-  }
-  if (input.fleet === "airtable") {
-    const { openBase: openBase2, readAirtableConfig: readAirtableConfig2 } = await Promise.resolve().then(() => (init_client(), client_exports));
-    const { fromAirtableBase: fromAirtableBase2 } = await Promise.resolve().then(() => (init_airtable(), airtable_exports));
-    const base = openBase2(readAirtableConfig2());
-    const provider = fromAirtableBase2(base, input.workdir ? { workdir: input.workdir } : {});
-    return provider();
-  }
-  if (input.fleet) {
-    const fleetPath = resolve(input.cwd, input.fleet);
-    const ext = extname(fleetPath).toLowerCase();
-    if (ext === ".json") {
-      return fromJsonFile(fleetPath)();
-    }
-    if (ext === ".js" || ext === ".mjs" || ext === ".cjs") {
-      const mod = await import(pathToFileURL(fleetPath).href);
-      if (!mod.default || typeof mod.default !== "function") {
-        throw Object.assign(new Error(`--fleet ${input.fleet}: default export is not a function`), {
-          exitCode: 2
-        });
-      }
-      return sanitizeDynamicSites(await mod.default());
-    }
-    throw Object.assign(
-      new Error(`--fleet ${input.fleet}: unsupported extension ${ext || "(none)"}`),
-      { exitCode: 2 }
-    );
-  }
-  return localPath(resolve(input.cwd, input.site ?? input.cwd))();
-}
-
-// src/cli/fleet/clone-if-needed.ts
-import { stat as stat2, readdir as readdir2, mkdir } from "fs/promises";
-import { isAbsolute as isAbsolute2, join as join8 } from "path";
-
-// src/util/git.ts
-import { execFile } from "child_process";
-import { promisify } from "util";
-var exec = promisify(execFile);
-var OWNER_REPO_RE = /^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/;
-function isOwnerRepo(repo) {
-  if (repo.includes("..")) return false;
-  return OWNER_REPO_RE.test(repo);
-}
-function sameOwnerRepo(a, b) {
-  const na = isOwnerRepo(a.trim()) ? a.trim() : parseOwnerRepo(a);
-  const nb = isOwnerRepo(b.trim()) ? b.trim() : parseOwnerRepo(b);
-  if (na === null || nb === null) return false;
-  return na.toLowerCase() === nb.toLowerCase();
-}
-function parseOwnerRepo(remoteUrl) {
-  const trimmed = remoteUrl.trim().replace(/\.git$/, "").replace(/\/$/, "");
-  const scp = trimmed.match(/^[A-Za-z0-9._-]+@[A-Za-z0-9._-]+:(.+)$/);
-  const path = scp ? scp[1] : trimmed.replace(/^https?:\/\/[^/]+\//, "");
-  const segments = path.split("/").filter(Boolean);
-  if (segments.length < 2) return null;
-  return `${segments[segments.length - 2]}/${segments[segments.length - 1]}`;
-}
-
-// src/cli/fleet/clone-if-needed.ts
-function deriveNameFromRepoUrl(repoUrl) {
-  const slash = repoUrl.split("/").pop() ?? repoUrl;
-  return slash.replace(/\.git$/, "");
-}
-function assertSafeName(name) {
-  if (name.length === 0) {
-    throw new Error("unsafe site name (empty)");
-  }
-  if (isAbsolute2(name)) {
-    throw new Error(`unsafe site name (absolute path not allowed): ${name}`);
-  }
-  if (name.includes("/") || name.includes("\\")) {
-    throw new Error(`unsafe site name (path separator not allowed): ${name}`);
-  }
-  if (name.split(/[\\/]/).some((seg) => seg === "..")) {
-    throw new Error(`unsafe site name (traversal segment not allowed): ${name}`);
-  }
-}
-function assertSafeRepoUrl(repoUrl) {
-  if (!/^(https?|ssh|git|file):\/\//.test(repoUrl) && !/^[A-Za-z0-9._-]+@[A-Za-z0-9._-]+:/.test(repoUrl)) {
-    throw new Error(
-      `unsafe repoUrl: must start with a scheme (https://, ssh://, git://, file://) or use scp-style "user@host:path" (got: ${JSON.stringify(repoUrl)})`
-    );
-  }
-}
-async function isNonEmptyDir(path) {
-  try {
-    const s = await stat2(path);
-    if (!s.isDirectory()) return false;
-    const entries = await readdir2(path);
-    return entries.length > 0;
-  } catch {
-    return false;
-  }
-}
-function expectedRepoRef(site) {
-  return site.gitRepo ?? site.repoUrl ?? void 0;
-}
-async function assertCheckoutMatches(site, path, spawn2) {
-  const expected = expectedRepoRef(site);
-  if (!expected) return;
-  const r = await spawn2("git", ["-C", path, "remote", "get-url", "origin"], {
-    timeoutMs: 3e4
-  });
-  if (r.code !== 0) return;
-  const origin = r.stdout.trim();
-  if (origin.length === 0) return;
-  if (!sameOwnerRepo(origin, expected)) {
-    throw new Error(
-      `checkout at ${path} is the wrong repo: origin is ${JSON.stringify(origin)} but site expects ${JSON.stringify(expected)} (slug collision?) \u2014 refusing to reuse it`
-    );
-  }
-}
-var GIT_REPO_RE = /^[\w.-]+\/[\w.-]+$/;
-function resolveCloneUrl(site) {
-  if (site.repoUrl) return site.repoUrl;
-  if (!site.gitRepo) return void 0;
-  if (!GIT_REPO_RE.test(site.gitRepo)) {
-    throw new Error(`unsafe gitRepo: expected "owner/repo" (got: ${JSON.stringify(site.gitRepo)})`);
-  }
-  return `https://github.com/${site.gitRepo}.git`;
-}
-async function cloneIfNeeded(site, opts) {
-  const spawn2 = opts.spawn ?? defaultSpawn;
-  if (await isNonEmptyDir(site.path)) {
-    await assertCheckoutMatches(site, site.path, spawn2);
-    return site;
-  }
-  const repoUrl = resolveCloneUrl(site);
-  if (!repoUrl) {
-    throw new Error(
-      `site path does not exist (${site.path}) and no repoUrl or gitRepo is set \u2014 cannot clone`
-    );
-  }
-  const name = site.name || deriveNameFromRepoUrl(repoUrl);
-  assertSafeName(name);
-  assertSafeRepoUrl(repoUrl);
-  const target = join8(opts.workdir, name);
-  await mkdir(opts.workdir, { recursive: true });
-  if (await isNonEmptyDir(target)) {
-    await assertCheckoutMatches(site, target, spawn2);
-    return { ...site, name, path: target };
-  }
-  const result = await spawn2("git", ["clone", "--", repoUrl, target], {
-    cwd: opts.workdir,
-    timeoutMs: 5 * 6e4
-  });
-  if (result.code !== 0) {
-    throw new Error(`git clone failed (code ${result.code}): ${result.stderr}`);
-  }
-  return { ...site, name, path: target };
-}
-
-// src/cli/fleet/prepare-sites.ts
-async function prepareFleetSites(sites, opts) {
-  const clone = opts.clone ?? cloneIfNeeded;
-  const needsCheckout = opts.needsCheckout ?? (() => true);
-  const settled = await Promise.all(
-    sites.map(async (site) => {
-      if (!needsCheckout(site)) return { ok: true, site };
-      try {
-        return { ok: true, site: await clone(site, { workdir: opts.workdir }) };
-      } catch (e) {
-        return { ok: false, site: site.name || site.path, reason: e.message };
-      }
-    })
-  );
-  const prepared = [];
-  const skipped = [];
-  for (const r of settled) {
-    if (r.ok) prepared.push(r.site);
-    else skipped.push({ site: r.site, reason: r.reason });
-  }
-  return { prepared, skipped };
-}
-function formatSkippedNotice(skipped) {
-  if (skipped.length === 0) return null;
-  const detail = skipped.map((s) => `${s.site} (${s.reason})`).join("; ");
-  return `\u26A0 ${skipped.length} site(s) skipped (could not prepare): ${detail}`;
-}
-
-// src/cli/commands/audit.ts
-init_url();
-
-// src/util/fleet-workdir.ts
-import { tmpdir as tmpdir2 } from "os";
-import { join as join9 } from "path";
-function fleetWorkdir() {
-  const home = process.env.HOME?.trim();
-  const base = home ? home : tmpdir2();
-  return join9(base, ".reddoor-maint", "sites");
-}
-
-// src/cli/commands/audit.ts
 function parseOnly(value) {
   if (!value) return void 0;
   const names = value.split(",").map((s) => s.trim());
@@ -2469,7 +170,7 @@ function applyDeployedUrl(sites, url) {
 }
 async function runAuditCommand(site, opts) {
   const which = parseOnly(opts.only) ?? ALL_AUDIT_NAMES;
-  const cwd = opts.cwd ? resolve2(opts.cwd) : process.cwd();
+  const cwd = opts.cwd ? resolve(opts.cwd) : process.cwd();
   if (typeof opts.writeAirtable === "string" && opts.fleet !== void 0) {
     throw Object.assign(
       new Error(
@@ -2513,32 +214,32 @@ async function runAuditCommand(site, opts) {
 ${skipNotice}`;
   let writeBackFailed = false;
   if (opts.writeAirtable !== void 0) {
-    const { openBase: openBase2, readAirtableConfig: readAirtableConfig2 } = await Promise.resolve().then(() => (init_client(), client_exports));
-    const { listWebsites: listWebsites2 } = await Promise.resolve().then(() => (init_websites(), websites_exports));
+    const { openBase, readAirtableConfig } = await import("../../client-EPVO3FEH.js");
+    const { listWebsites } = await import("../../websites-X5DLC2PC.js");
     if (opts.fleet !== void 0) {
-      const { writeFleetAuditsToAirtable: writeFleetAuditsToAirtable2, formatFleetWriteSummary: formatFleetWriteSummary2 } = await Promise.resolve().then(() => (init_write_audits_to_airtable(), write_audits_to_airtable_exports));
-      const base = openBase2(readAirtableConfig2());
-      const websites = await listWebsites2(base);
-      const fleetWrite = await writeFleetAuditsToAirtable2({ base, websites, results });
+      const { writeFleetAuditsToAirtable, formatFleetWriteSummary } = await import("../../write-audits-to-airtable-CE4POBAF.js");
+      const base = openBase(readAirtableConfig());
+      const websites = await listWebsites(base);
+      const fleetWrite = await writeFleetAuditsToAirtable({ base, websites, results });
       if (fleetWrite.failed.length > 0) writeBackFailed = true;
       if (!opts.json) output += `
 
-${formatFleetWriteSummary2(fleetWrite)}`;
+${formatFleetWriteSummary(fleetWrite)}`;
     } else {
-      const { resolveSlugFromCwd: resolveSlugFromCwd2 } = await Promise.resolve().then(() => (init_lighthouse_airtable(), lighthouse_airtable_exports));
-      const { writeAuditsToAirtable: writeAuditsToAirtable2 } = await Promise.resolve().then(() => (init_write_audits_to_airtable(), write_audits_to_airtable_exports));
-      const slug = typeof opts.writeAirtable === "string" && opts.writeAirtable.length > 0 ? opts.writeAirtable : await resolveSlugFromCwd2(cwd);
+      const { resolveSlugFromCwd } = await import("../../lighthouse-airtable-4FKYKFH6.js");
+      const { writeAuditsToAirtable } = await import("../../write-audits-to-airtable-CE4POBAF.js");
+      const slug = typeof opts.writeAirtable === "string" && opts.writeAirtable.length > 0 ? opts.writeAirtable : await resolveSlugFromCwd(cwd);
       let writeSummary = null;
       await new Listr(
         [
           {
             title: `Write to Airtable[${slug}]`,
             task: async (_ctx, task) => {
-              const base = openBase2(readAirtableConfig2());
+              const base = openBase(readAirtableConfig());
               task.output = "loading Websites\u2026";
-              const websites = await listWebsites2(base);
+              const websites = await listWebsites(base);
               task.output = "writing scores\u2026";
-              writeSummary = await writeAuditsToAirtable2({ base, websites, slug, results });
+              writeSummary = await writeAuditsToAirtable({ base, websites, slug, results });
               task.title = `Wrote to Websites[${writeSummary.siteName}] (${writeSummary.writes.length} audit type${writeSummary.writes.length === 1 ? "" : "s"})`;
             }
           }