@reddoorla/maintenance 0.55.0 → 0.56.0

package/dist/renovate-dispatch-ZGLXNPEK.js

@@ -0,0 +1,97 @@
+import {
+  makeGitHub
+} from "./chunk-DIVB6ZF7.js";
+import "./chunk-HVOOCK6L.js";
+import {
+  isDashboardVisible,
+  listWebsites
+} from "./chunk-CLVTVDOU.js";
+import {
+  openBase,
+  readAirtableConfig
+} from "./chunk-HN6I2XWI.js";
+import "./chunk-6VAL7XJT.js";
+
+// src/github/renovate-dispatch.ts
+var RENOVATE_WORKFLOW_FILE = "renovate.yml";
+function isRenovatePrBranch(headRef) {
+  return headRef.startsWith("renovate/");
+}
+function selectRenovateTargets(sites) {
+  const targets = [];
+  for (const s of sites) {
+    if (!isDashboardVisible(s)) continue;
+    const repo = s.gitRepo?.trim();
+    if (!repo) continue;
+    const critical = s.securityVulnsCritical ?? 0;
+    const high = s.securityVulnsHigh ?? 0;
+    if (critical + high <= 0) continue;
+    targets.push({ repo, siteName: s.name, critical, high });
+  }
+  return targets;
+}
+async function dispatchRenovateAcross(targets, deps) {
+  const dispatched = [];
+  const skipped = [];
+  const failed = [];
+  for (const t of targets) {
+    try {
+      if (await deps.hasOpenRenovatePr(t.repo)) {
+        skipped.push(t.repo);
+        continue;
+      }
+      const ref = await deps.defaultBranch(t.repo);
+      await deps.dispatch(t.repo, RENOVATE_WORKFLOW_FILE, ref);
+      dispatched.push(t.repo);
+    } catch (e) {
+      failed.push({ repo: t.repo, error: e instanceof Error ? e.message : String(e) });
+    }
+  }
+  return { dispatched, skipped, failed };
+}
+function formatRenovateDispatchSummary(result) {
+  return `RENOVATE_DISPATCH_SUMMARY dispatched=${result.dispatched.length} skipped=${result.skipped.length} failed=${result.failed.length}`;
+}
+
+// src/cli/commands/renovate-dispatch.ts
+async function runRenovateDispatchCommand(opts) {
+  if (!opts.fleet) {
+    return { output: "renovate-dispatch currently supports only --fleet", code: 2 };
+  }
+  const token = process.env.RENOVATE_TOKEN?.trim() || process.env.GH_TOKEN?.trim();
+  if (!token) {
+    return {
+      output: "renovate-dispatch skipped: no RENOVATE_TOKEN/GH_TOKEN (fleet dispatch) configured.",
+      code: 0
+    };
+  }
+  const base = openBase(readAirtableConfig());
+  const websites = await listWebsites(base);
+  const targets = selectRenovateTargets(websites);
+  if (targets.length === 0) {
+    return {
+      output: `${formatRenovateDispatchSummary({ dispatched: [], skipped: [], failed: [] })}
+No active repo-backed sites with critical/high vulnerabilities \u2014 nothing to dispatch.`,
+      code: 0
+    };
+  }
+  const gh = makeGitHub({ token });
+  const result = await dispatchRenovateAcross(targets, {
+    hasOpenRenovatePr: async (repo) => (await gh.openPullRequests(repo)).some((pr) => isRenovatePrBranch(pr.headRef)),
+    defaultBranch: (repo) => gh.defaultBranch(repo),
+    dispatch: (repo, workflow, ref) => gh.dispatchWorkflow(repo, workflow, ref)
+  });
+  const failedRepos = new Set(result.failed.map((f) => f.repo));
+  const skippedRepos = new Set(result.skipped);
+  const lines = targets.map((t) => {
+    const status = failedRepos.has(t.repo) ? "FAILED                       " : skippedRepos.has(t.repo) ? "skipped (open Renovate PR)   " : "dispatched                   ";
+    return `${status} ${t.repo} (critical=${t.critical} high=${t.high}) \u2014 ${t.siteName}`;
+  });
+  for (const f of result.failed) lines.push(`  \u21B3 ${f.repo}: ${f.error}`);
+  lines.push(formatRenovateDispatchSummary(result));
+  return { output: lines.join("\n"), code: 0 };
+}
+export {
+  runRenovateDispatchCommand
+};
+//# sourceMappingURL=renovate-dispatch-ZGLXNPEK.js.map

package/dist/renovate-dispatch-ZGLXNPEK.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/github/renovate-dispatch.ts","../src/cli/commands/renovate-dispatch.ts"],"sourcesContent":["import { isDashboardVisible, type WebsiteRow } from \"../reports/airtable/websites.js\";\n\n/**\n * On-demand Renovate trigger for fleet sites.\n *\n * The nightly security sweep (`fleet-security.yml`) writes each active site's\n * vulnerability counts to Airtable. This module turns that into action: for the\n * sites the sweep just flagged with *actionable* (critical or high) vulns, it\n * dispatches that repo's `renovate.yml` `workflow_dispatch` so Renovate runs off\n * its weekly schedule. Renovate's OSV vulnerability alerts bypass the schedule,\n * so the remediation PR opens immediately (then auto-merges per the shared\n * preset). Moderate/low vulns are left to the normal weekly cadence — not urgent\n * enough to dispatch + churn CI nightly.\n */\n\n/** The per-repo workflow file the fleet uses for its self-hosted Renovate run. */\nexport const RENOVATE_WORKFLOW_FILE = \"renovate.yml\";\n\n/** A PR head-branch belongs to Renovate if it carries the default `renovate/`\n *  branch prefix (the fleet preset doesn't override `branchPrefix`). Used to\n *  detect \"remediation already in flight\" so a dispatch isn't re-fired. */\nexport function isRenovatePrBranch(headRef: string): boolean {\n  return headRef.startsWith(\"renovate/\");\n}\n\n/** A site selected for an on-demand Renovate run, with the reason (vuln counts). */\nexport type RenovateDispatchTarget = {\n  repo: string; // owner/repo, from the Websites \"Git repo\" field\n  siteName: string;\n  critical: number;\n  high: number;\n};\n\n/**\n * Pick the active, repo-backed sites whose latest security sweep found a\n * critical or high vulnerability. A `null` vuln count is treated as zero (a site\n * that was never swept, or had its counts cleared, is not dispatched). Inactive\n * sites and sites without a `Git repo` are excluded — there's nothing to kick.\n *\n * Counts are only guaranteed fresh for sites the sweep actually audited (active +\n * URL present); a site whose write-back failed/was skipped this run is selected on\n * its last-known counts. That's safe — a stale-high false dispatch is an idempotent\n * Renovate no-op, and the open-PR skip in `dispatchRenovateAcross` avoids re-firing\n * when remediation is already in flight.\n */\nexport function selectRenovateTargets(sites: WebsiteRow[]): RenovateDispatchTarget[] {\n  const targets: RenovateDispatchTarget[] = [];\n  for (const s of sites) {\n    if (!isDashboardVisible(s)) continue; // active (maintenance / launch period) only\n    const repo = s.gitRepo?.trim();\n    if (!repo) continue; // repo-backed only — the dispatch target is its renovate.yml\n    const critical = s.securityVulnsCritical ?? 0;\n    const high = s.securityVulnsHigh ?? 0;\n    if (critical + high <= 0) continue; // actionable (critical/high) vulns only\n    targets.push({ repo, siteName: s.name, critical, high });\n  }\n  return targets;\n}\n\n/** Injected GitHub operations — real ones come from `makeGitHub`, fakes from tests. */\nexport type RenovateDispatchDeps = {\n  /** True iff the repo already has an open Renovate PR (remediation in flight). */\n  hasOpenRenovatePr: (repo: string) => Promise<boolean>;\n  defaultBranch: (repo: string) => Promise<string>;\n  dispatch: (repo: string, workflow: string, ref: string) => Promise<void>;\n};\n\nexport type RenovateDispatchResult = {\n  dispatched: string[];\n  /** Repos skipped because a Renovate PR is already open — no point re-firing. */\n  skipped: string[];\n  failed: { repo: string; error: string }[];\n};\n\n/**\n * Dispatch `renovate.yml` for each target on its default branch.\n *\n * Skips a repo that already has an open Renovate PR: remediation is in flight, so\n * re-dispatching would just churn CI (this is what keeps a persistent vuln from\n * re-firing every nightly run while its fix PR waits — e.g. a human-gated major\n * bump). Best-effort and isolated: a repo that lacks `renovate.yml`, or whose\n * dispatch/PR-check is refused (the token's `actions:write` scope), is recorded in\n * `failed` and the rest still run. Never throws — the caller (a follow-up step on\n * the security sweep) must not be able to fail the sweep over a dispatch hiccup.\n */\nexport async function dispatchRenovateAcross(\n  targets: RenovateDispatchTarget[],\n  deps: RenovateDispatchDeps,\n): Promise<RenovateDispatchResult> {\n  const dispatched: string[] = [];\n  const skipped: string[] = [];\n  const failed: { repo: string; error: string }[] = [];\n  for (const t of targets) {\n    try {\n      if (await deps.hasOpenRenovatePr(t.repo)) {\n        skipped.push(t.repo);\n        continue;\n      }\n      const ref = await deps.defaultBranch(t.repo);\n      await deps.dispatch(t.repo, RENOVATE_WORKFLOW_FILE, ref);\n      dispatched.push(t.repo);\n    } catch (e) {\n      failed.push({ repo: t.repo, error: e instanceof Error ? e.message : String(e) });\n    }\n  }\n  return { dispatched, skipped, failed };\n}\n\n/** Machine-readable counts line the workflow greps to annotate partial failures. */\nexport function formatRenovateDispatchSummary(result: RenovateDispatchResult): string {\n  return `RENOVATE_DISPATCH_SUMMARY dispatched=${result.dispatched.length} skipped=${result.skipped.length} failed=${result.failed.length}`;\n}\n","import { openBase, readAirtableConfig } from \"../../reports/airtable/client.js\";\nimport { listWebsites } from \"../../reports/airtable/websites.js\";\nimport { makeGitHub } from \"../../github/gh.js\";\nimport {\n  selectRenovateTargets,\n  dispatchRenovateAcross,\n  formatRenovateDispatchSummary,\n  isRenovatePrBranch,\n} from \"../../github/renovate-dispatch.js\";\n\n/**\n * `renovate-dispatch --fleet`: read the Websites table, pick the active,\n * repo-backed sites the latest security sweep flagged with critical/high vulns,\n * and fire each one's `renovate.yml` `workflow_dispatch` so Renovate's OSV\n * vulnerability alerts open the remediation PR now (instead of waiting for the\n * weekly schedule). Designed to run as a best-effort follow-up step on\n * `fleet-security.yml` AFTER the sweep has written fresh counts to Airtable.\n *\n * Always exits 0: a missing token is a clean skip; a partial dispatch failure\n * (a repo without `renovate.yml`, or a token lacking `actions:write`) is reported\n * in the summary for the workflow to annotate, never failing the security sweep.\n */\nexport async function runRenovateDispatchCommand(opts: {\n  fleet?: boolean | undefined;\n}): Promise<{ output: string; code: number }> {\n  if (!opts.fleet) {\n    return { output: \"renovate-dispatch currently supports only --fleet\", code: 2 };\n  }\n  const token = process.env.RENOVATE_TOKEN?.trim() || process.env.GH_TOKEN?.trim();\n  if (!token) {\n    return {\n      output: \"renovate-dispatch skipped: no RENOVATE_TOKEN/GH_TOKEN (fleet dispatch) configured.\",\n      code: 0,\n    };\n  }\n\n  const base = openBase(readAirtableConfig());\n  const websites = await listWebsites(base);\n  const targets = selectRenovateTargets(websites);\n\n  if (targets.length === 0) {\n    return {\n      output:\n        `${formatRenovateDispatchSummary({ dispatched: [], skipped: [], failed: [] })}\\n` +\n        \"No active repo-backed sites with critical/high vulnerabilities — nothing to dispatch.\",\n      code: 0,\n    };\n  }\n\n  const gh = makeGitHub({ token });\n  const result = await dispatchRenovateAcross(targets, {\n    hasOpenRenovatePr: async (repo) =>\n      (await gh.openPullRequests(repo)).some((pr) => isRenovatePrBranch(pr.headRef)),\n    defaultBranch: (repo) => gh.defaultBranch(repo),\n    dispatch: (repo, workflow, ref) => gh.dispatchWorkflow(repo, workflow, ref),\n  });\n\n  const failedRepos = new Set(result.failed.map((f) => f.repo));\n  const skippedRepos = new Set(result.skipped);\n  const lines = targets.map((t) => {\n    const status = failedRepos.has(t.repo)\n      ? \"FAILED                       \"\n      : skippedRepos.has(t.repo)\n        ? \"skipped (open Renovate PR)   \"\n        : \"dispatched                   \";\n    return `${status} ${t.repo} (critical=${t.critical} high=${t.high}) — ${t.siteName}`;\n  });\n  for (const f of result.failed) lines.push(`  ↳ ${f.repo}: ${f.error}`);\n  lines.push(formatRenovateDispatchSummary(result));\n\n  return { output: lines.join(\"\\n\"), code: 0 };\n}\n"],"mappings":";;;;;;;;;;;;;;;AAgBO,IAAM,yBAAyB;AAK/B,SAAS,mBAAmB,SAA0B;AAC3D,SAAO,QAAQ,WAAW,WAAW;AACvC;AAsBO,SAAS,sBAAsB,OAA+C;AACnF,QAAM,UAAoC,CAAC;AAC3C,aAAW,KAAK,OAAO;AACrB,QAAI,CAAC,mBAAmB,CAAC,EAAG;AAC5B,UAAM,OAAO,EAAE,SAAS,KAAK;AAC7B,QAAI,CAAC,KAAM;AACX,UAAM,WAAW,EAAE,yBAAyB;AAC5C,UAAM,OAAO,EAAE,qBAAqB;AACpC,QAAI,WAAW,QAAQ,EAAG;AAC1B,YAAQ,KAAK,EAAE,MAAM,UAAU,EAAE,MAAM,UAAU,KAAK,CAAC;AAAA,EACzD;AACA,SAAO;AACT;AA4BA,eAAsB,uBACpB,SACA,MACiC;AACjC,QAAM,aAAuB,CAAC;AAC9B,QAAM,UAAoB,CAAC;AAC3B,QAAM,SAA4C,CAAC;AACnD,aAAW,KAAK,SAAS;AACvB,QAAI;AACF,UAAI,MAAM,KAAK,kBAAkB,EAAE,IAAI,GAAG;AACxC,gBAAQ,KAAK,EAAE,IAAI;AACnB;AAAA,MACF;AACA,YAAM,MAAM,MAAM,KAAK,cAAc,EAAE,IAAI;AAC3C,YAAM,KAAK,SAAS,EAAE,MAAM,wBAAwB,GAAG;AACvD,iBAAW,KAAK,EAAE,IAAI;AAAA,IACxB,SAAS,GAAG;AACV,aAAO,KAAK,EAAE,MAAM,EAAE,MAAM,OAAO,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,EAAE,CAAC;AAAA,IACjF;AAAA,EACF;AACA,SAAO,EAAE,YAAY,SAAS,OAAO;AACvC;AAGO,SAAS,8BAA8B,QAAwC;AACpF,SAAO,wCAAwC,OAAO,WAAW,MAAM,YAAY,OAAO,QAAQ,MAAM,WAAW,OAAO,OAAO,MAAM;AACzI;;;ACzFA,eAAsB,2BAA2B,MAEH;AAC5C,MAAI,CAAC,KAAK,OAAO;AACf,WAAO,EAAE,QAAQ,qDAAqD,MAAM,EAAE;AAAA,EAChF;AACA,QAAM,QAAQ,QAAQ,IAAI,gBAAgB,KAAK,KAAK,QAAQ,IAAI,UAAU,KAAK;AAC/E,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,MAAM;AAAA,IACR;AAAA,EACF;AAEA,QAAM,OAAO,SAAS,mBAAmB,CAAC;AAC1C,QAAM,WAAW,MAAM,aAAa,IAAI;AACxC,QAAM,UAAU,sBAAsB,QAAQ;AAE9C,MAAI,QAAQ,WAAW,GAAG;AACxB,WAAO;AAAA,MACL,QACE,GAAG,8BAA8B,EAAE,YAAY,CAAC,GAAG,SAAS,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;AAAA;AAAA,MAE/E,MAAM;AAAA,IACR;AAAA,EACF;AAEA,QAAM,KAAK,WAAW,EAAE,MAAM,CAAC;AAC/B,QAAM,SAAS,MAAM,uBAAuB,SAAS;AAAA,IACnD,mBAAmB,OAAO,UACvB,MAAM,GAAG,iBAAiB,IAAI,GAAG,KAAK,CAAC,OAAO,mBAAmB,GAAG,OAAO,CAAC;AAAA,IAC/E,eAAe,CAAC,SAAS,GAAG,cAAc,IAAI;AAAA,IAC9C,UAAU,CAAC,MAAM,UAAU,QAAQ,GAAG,iBAAiB,MAAM,UAAU,GAAG;AAAA,EAC5E,CAAC;AAED,QAAM,cAAc,IAAI,IAAI,OAAO,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC;AAC5D,QAAM,eAAe,IAAI,IAAI,OAAO,OAAO;AAC3C,QAAM,QAAQ,QAAQ,IAAI,CAAC,MAAM;AAC/B,UAAM,SAAS,YAAY,IAAI,EAAE,IAAI,IACjC,kCACA,aAAa,IAAI,EAAE,IAAI,IACrB,kCACA;AACN,WAAO,GAAG,MAAM,IAAI,EAAE,IAAI,cAAc,EAAE,QAAQ,SAAS,EAAE,IAAI,YAAO,EAAE,QAAQ;AAAA,EACpF,CAAC;AACD,aAAW,KAAK,OAAO,OAAQ,OAAM,KAAK,YAAO,EAAE,IAAI,KAAK,EAAE,KAAK,EAAE;AACrE,QAAM,KAAK,8BAA8B,MAAM,CAAC;AAEhD,SAAO,EAAE,QAAQ,MAAM,KAAK,IAAI,GAAG,MAAM,EAAE;AAC7C;","names":[]}

package/dist/report-SD3CNBOQ.js

@@ -0,0 +1,240 @@
+import {
+  findDueReports,
+  reportPeriodKey
+} from "./chunk-WVRPOXKH.js";
+import {
+  draftReportForSite,
+  readGaConfig
+} from "./chunk-W3G7XFBZ.js";
+import {
+  reportTier
+} from "./chunk-6LIWDIXU.js";
+import "./chunk-BWLUNY7L.js";
+import {
+  escapeHtml,
+  listAllReports
+} from "./chunk-OCS7SZUZ.js";
+import "./chunk-U5SZ4FOP.js";
+import {
+  listWebsites,
+  siteSlug
+} from "./chunk-CLVTVDOU.js";
+import {
+  openBase,
+  readAirtableConfig
+} from "./chunk-HN6I2XWI.js";
+import "./chunk-6VAL7XJT.js";
+
+// src/alerts/analytics-health.ts
+var MIN_FAILED_SITES = 2;
+function assessAnalyticsAlert(h) {
+  const { softFailedSites, configuredSites } = h;
+  const fire = configuredSites >= 2 && softFailedSites >= MIN_FAILED_SITES && softFailedSites * 2 >= configuredSites;
+  const reason = fire ? `${softFailedSites} of ${configuredSites} analytics-configured sites had GA/Search enrichment fail this run \u2014 the shared GA_SUBJECT likely lost access (an offboarded user, revoked property access, or a botched role-account cutover). Reports were drafted with BLANK analytics.` : "";
+  return { fire, reason };
+}
+function composeAnalyticsAlertEmail(h, dashboardUrl) {
+  const subject = `\u26A0 Fleet analytics enrichment failing \u2014 ${h.softFailedSites}/${h.configuredSites} sites`;
+  const { reason } = assessAnalyticsAlert(h);
+  const html = `<p><strong>${escapeHtml(reason)}</strong></p>
+<p>This usually means the Google Workspace user the service account impersonates can no longer read the GA4 / Search Console properties. Reports still send \u2014 but with blank analytics \u2014 until the subject is restored.</p>
+<p>Next step: follow the GA/Search subject runbook (<code>docs/runbooks/ga-search-role-account-cutover.md</code>) to restore or move the subject, then re-run <code>reddoor-maint report --due</code> and confirm the warning clears.</p>
+<p><a href="${escapeHtml(dashboardUrl)}">Open the fleet dashboard \u2192</a></p>`;
+  return { subject, html };
+}
+
+// src/cli/commands/report.ts
+function draftLine(reportId, queued, supersededIds, verb = "drafted") {
+  const id = reportId ?? "(unknown)";
+  if (queued === false) {
+    return `\u2022 ${verb} but NOT queued: ${id} \u2014 a higher-or-equal-tier report is already pending approval`;
+  }
+  const sup = supersededIds.length > 0 ? ` (superseded ${supersededIds.length} lower-tier draft${supersededIds.length > 1 ? "s" : ""})` : "";
+  return `\u2713 ${verb}: ${id}${sup}`;
+}
+function parseSingleSiteReportType(raw) {
+  if (raw === void 0 || raw.trim() === "") return "Maintenance";
+  const norm = raw.trim().toLowerCase();
+  if (norm === "maintenance") return "Maintenance";
+  if (norm === "testing") return "Testing";
+  const hint = norm === "launch" ? " \u2014 use the `launch <site>` command" : norm === "announcement" ? " \u2014 use the `announce <site>` command" : "";
+  throw Object.assign(
+    new Error(`--type must be Maintenance or Testing (got ${JSON.stringify(raw)})${hint}`),
+    { exitCode: 2 }
+  );
+}
+function dashboardBaseUrl() {
+  return process.env.DASHBOARD_BASE_URL?.trim() || "https://reddoor-maintenance.netlify.app";
+}
+async function runReportCommand(slug, opts) {
+  if (opts.digest) {
+    const { runDigest } = await import("./digest-YTO73BEO.js");
+    return runDigest({ baseUrl: dashboardBaseUrl() });
+  }
+  if (opts.sendReady) {
+    const { sendApprovedReports } = await import("./orchestrate-RMSBHLQK.js");
+    return sendApprovedReports();
+  }
+  if (opts.due) {
+    return runDueDraft();
+  }
+  if (slug) {
+    const reportType = parseSingleSiteReportType(opts.type);
+    return runSingleSiteDraft(slug, { previewOnly: Boolean(opts.preview), reportType });
+  }
+  throw Object.assign(
+    new Error(
+      "Usage: reddoor-maint report [<slug>] [--type <Maintenance|Testing>] [--due] [--preview] [--send-ready] [--digest]"
+    ),
+    {
+      exitCode: 2
+    }
+  );
+}
+async function runDueDraft() {
+  const base = openBase(readAirtableConfig());
+  const result = await draftDueReports(base, /* @__PURE__ */ new Date());
+  await alertOnFleetAnalyticsFailure(result.health);
+  return { output: result.output, code: result.code };
+}
+async function alertOnFleetAnalyticsFailure(health) {
+  if (!assessAnalyticsAlert(health).fire) return;
+  try {
+    const to = process.env.OPERATOR_EMAIL?.trim() || "info@reddoorla.com";
+    const { subject, html } = composeAnalyticsAlertEmail(health, dashboardBaseUrl());
+    const { defaultResendClient } = await import("./resend-G2BJMAQV.js");
+    await defaultResendClient().send({
+      from: "Reddoor Reports <reports@reddoorla.com>",
+      to: [to],
+      subject,
+      html,
+      idempotencyKey: `analytics-alert-${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}`
+    });
+    console.warn(`\u26A0 ${subject} \u2014 operator alerted (${to})`);
+  } catch (e) {
+    console.warn(`\u26A0 analytics-failure alert send failed: ${e.message}`);
+  }
+}
+async function draftDueReports(base, today) {
+  const websites = await listWebsites(base);
+  const reports = await listAllReports(base);
+  const due = findDueReports(websites, reports, today);
+  const gaConfigured = readGaConfig() !== null;
+  const isAnalyticsConfigured = (s) => gaConfigured && Boolean(s.ga4PropertyId || s.searchQuery);
+  if (due.length === 0) {
+    return {
+      output: "No reports due.",
+      code: 0,
+      health: { softFailedSites: 0, configuredSites: 0 }
+    };
+  }
+  const lines = [];
+  let softFailedSites = 0;
+  let gaConfiguredSites = 0;
+  let skipped = 0;
+  for (const item of due) {
+    const period = reportPeriodKey(item.dueDate);
+    const existing = reports.find(
+      (r) => r.siteId === item.site.id && r.reportType === item.reportType && r.period === period
+    );
+    if (existing) {
+      if (existing.draftReady) {
+        skipped++;
+        lines.push(`\u2022 skipped (already drafted ${period}): ${item.site.name} ${item.reportType}`);
+        continue;
+      }
+      const blockedByPending = reports.some(
+        (r) => r.siteId === item.site.id && r.id !== existing.id && r.sentAt === null && r.draftReady && reportTier(r.reportType) >= reportTier(item.reportType)
+      );
+      if (blockedByPending) {
+        skipped++;
+        lines.push(
+          `\u2022 skipped (superseded \u2014 a higher-or-equal-tier report is pending): ${item.site.name} ${item.reportType}`
+        );
+        continue;
+      }
+      try {
+        const result = await draftReportForSite(base, item.site, item.reportType, {
+          period,
+          completeRowId: existing.id,
+          existingRow: existing
+        });
+        existing.draftReady = result.queued === true;
+        lines.push(
+          draftLine(
+            result.reportRow?.reportId ?? existing.reportId,
+            result.queued,
+            result.supersededIds,
+            "completed half-made draft"
+          )
+        );
+        if (isAnalyticsConfigured(item.site)) gaConfiguredSites++;
+        if (result.softFailures.length > 0) softFailedSites++;
+      } catch (e) {
+        lines.push(`\u2717 failed: ${item.site.name} ${item.reportType} \u2014 ${e.message}`);
+      }
+      continue;
+    }
+    const pendingEarlier = reports.find(
+      (r) => r.siteId === item.site.id && r.reportType === item.reportType && r.draftReady && r.sentAt === null && r.period !== null && r.period < period
+    );
+    if (pendingEarlier) {
+      skipped++;
+      lines.push(
+        `\u2022 skipped: ${item.site.name} ${item.reportType} already has an unsent ${pendingEarlier.period} draft pending approval`
+      );
+      continue;
+    }
+    try {
+      const result = await draftReportForSite(base, item.site, item.reportType, { period });
+      lines.push(draftLine(result.reportRow?.reportId, result.queued, result.supersededIds));
+      if (result.reportRow) reports.push(result.reportRow);
+      if (isAnalyticsConfigured(item.site)) gaConfiguredSites++;
+      if (result.softFailures.length > 0) softFailedSites++;
+    } catch (e) {
+      lines.push(`\u2717 failed: ${item.site.name} ${item.reportType} \u2014 ${e.message}`);
+    }
+  }
+  if (skipped > 0) {
+    lines.push(`\u2022 ${skipped} already drafted or pending this period`);
+  }
+  if (softFailedSites > 0) {
+    lines.push(
+      `\u26A0 ${softFailedSites} site${softFailedSites === 1 ? "" : "s"} had GA/Search enrichment fail \u2014 drafted with blank analytics; check the logs above`
+    );
+  }
+  return {
+    output: lines.join("\n"),
+    code: lines.some((l) => l.startsWith("\u2717")) ? 1 : 0,
+    health: { softFailedSites, configuredSites: gaConfiguredSites }
+  };
+}
+async function runSingleSiteDraft(slug, opts) {
+  const base = openBase(readAirtableConfig());
+  const websites = await listWebsites(base);
+  const site = websites.find((w) => siteSlug(w.name) === slug);
+  if (!site) {
+    throw Object.assign(new Error(`No Websites row matched slug "${slug}"`), { exitCode: 2 });
+  }
+  const result = await draftReportForSite(opts.previewOnly ? null : base, site, opts.reportType, {
+    previewOnly: opts.previewOnly
+  });
+  if (opts.previewOnly) {
+    return { output: `Preview written to ${result.htmlPath}`, code: 0 };
+  }
+  return {
+    output: draftLine(
+      result.reportRow?.reportId,
+      result.queued,
+      result.supersededIds,
+      "Draft created"
+    ),
+    code: 0
+  };
+}
+export {
+  draftDueReports,
+  parseSingleSiteReportType,
+  runReportCommand
+};
+//# sourceMappingURL=report-SD3CNBOQ.js.map

package/dist/report-SD3CNBOQ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/alerts/analytics-health.ts","../src/cli/commands/report.ts"],"sourcesContent":["import { escapeHtml } from \"../util/html.js\";\n\n/**\n * The GA/Search enrichment outcome of one `report --due` draft run, aggregated\n * across the sites it drafted. `softFailedSites` is how many drafted sites had GA\n * OR Search enrichment ERROR (not \"not configured\" — that's a legitimate skip);\n * `configuredSites` is how many drafted sites had analytics configured at all\n * (the subject is set AND the site has a GA4 property or a search query). The ratio\n * is what distinguishes a fleet-wide subject outage from a single transient blip.\n */\nexport type AnalyticsRunHealth = {\n  softFailedSites: number;\n  configuredSites: number;\n};\n\nexport type AnalyticsAlert = { fire: boolean; reason: string };\n\n/** A lone failure never alerts — that's a per-site config issue, not the shared-\n *  subject SPOF. Two-plus AND a majority of configured sites is the fleet signature. */\nconst MIN_FAILED_SITES = 2;\n\n/**\n * Decide whether a draft run's GA/Search soft-failures look FLEET-WIDE — i.e. the\n * one impersonated subject (`GA_SUBJECT`) lost access — rather than one site's\n * transient blip. PURE. Fires when at least {@link MIN_FAILED_SITES} configured\n * sites failed AND they are a majority (≥ half) of the analytics-configured sites\n * this run. With <2 configured sites it can't distinguish a SPOF from a one-off, so\n * it never fires (at fleet scale there are always many configured sites).\n */\nexport function assessAnalyticsAlert(h: AnalyticsRunHealth): AnalyticsAlert {\n  const { softFailedSites, configuredSites } = h;\n  const fire =\n    configuredSites >= 2 &&\n    softFailedSites >= MIN_FAILED_SITES &&\n    softFailedSites * 2 >= configuredSites;\n  const reason = fire\n    ? `${softFailedSites} of ${configuredSites} analytics-configured sites had GA/Search enrichment fail this run — the shared GA_SUBJECT likely lost access (an offboarded user, revoked property access, or a botched role-account cutover). Reports were drafted with BLANK analytics.`\n    : \"\";\n  return { fire, reason };\n}\n\n/**\n * Compose the operator alert email for a fleet-wide analytics failure. PURE — the\n * caller (the `report --due` cron) sends it best-effort via Resend only when\n * {@link assessAnalyticsAlert} fires. `dashboardUrl` is the fleet homepage link.\n */\nexport function composeAnalyticsAlertEmail(\n  h: AnalyticsRunHealth,\n  dashboardUrl: string,\n): { subject: string; html: string } {\n  const subject = `⚠ Fleet analytics enrichment failing — ${h.softFailedSites}/${h.configuredSites} sites`;\n  const { reason } = assessAnalyticsAlert(h);\n  const html = `<p><strong>${escapeHtml(reason)}</strong></p>\n<p>This usually means the Google Workspace user the service account impersonates can no longer read the GA4 / Search Console properties. Reports still send — but with blank analytics — until the subject is restored.</p>\n<p>Next step: follow the GA/Search subject runbook (<code>docs/runbooks/ga-search-role-account-cutover.md</code>) to restore or move the subject, then re-run <code>reddoor-maint report --due</code> and confirm the warning clears.</p>\n<p><a href=\"${escapeHtml(dashboardUrl)}\">Open the fleet dashboard →</a></p>`;\n  return { subject, html };\n}\n","import { openBase, readAirtableConfig, type AirtableBase } from \"../../reports/airtable/client.js\";\nimport { listWebsites, siteSlug, type WebsiteRow } from \"../../reports/airtable/websites.js\";\nimport { listAllReports } from \"../../reports/airtable/reports.js\";\nimport { findDueReports, reportPeriodKey } from \"../../reports/due.js\";\nimport { draftReportForSite } from \"../../reports/draft.js\";\nimport { reportTier } from \"../../reports/queue.js\";\nimport { readGaConfig } from \"../../reports/ga/config.js\";\nimport {\n  assessAnalyticsAlert,\n  composeAnalyticsAlertEmail,\n  type AnalyticsRunHealth,\n} from \"../../alerts/analytics-health.js\";\nimport type { ReportType } from \"../../reports/types.js\";\n\nexport type ReportCommandOptions = {\n  due?: boolean;\n  preview?: boolean;\n  sendReady?: boolean;\n  digest?: boolean;\n  type?: string;\n  cwd?: string;\n};\n\n/**\n * Summary line for a drafted report, reflecting the single-queue outcome. `queued === false`\n * means a higher-or-equal-tier report was already pending for the site, so this draft was\n * created but deliberately left OUT of the approve queue. A non-empty `supersededIds` means it\n * un-queued that many lower-tier drafts. `null` is the previewOnly path (no Airtable queue).\n */\nfunction draftLine(\n  reportId: string | undefined,\n  queued: boolean | null,\n  supersededIds: string[],\n  verb = \"drafted\",\n): string {\n  const id = reportId ?? \"(unknown)\";\n  if (queued === false) {\n    return `• ${verb} but NOT queued: ${id} — a higher-or-equal-tier report is already pending approval`;\n  }\n  const sup =\n    supersededIds.length > 0\n      ? ` (superseded ${supersededIds.length} lower-tier draft${supersededIds.length > 1 ? \"s\" : \"\"})`\n      : \"\";\n  return `✓ ${verb}: ${id}${sup}`;\n}\n\n/**\n * Parse the single-site `--type` flag. Only Maintenance and Testing are draftable\n * this way — Launch has the `launch <site>` command and Announcement has\n * `announce <site>`, each with its own purpose-built flow. Case-insensitive;\n * defaults to Maintenance (the historical single-site behaviour). Throws an\n * exitCode-2 usage error on anything else. PURE.\n */\nexport function parseSingleSiteReportType(raw: string | undefined): ReportType {\n  if (raw === undefined || raw.trim() === \"\") return \"Maintenance\";\n  const norm = raw.trim().toLowerCase();\n  if (norm === \"maintenance\") return \"Maintenance\";\n  if (norm === \"testing\") return \"Testing\";\n  const hint =\n    norm === \"launch\"\n      ? \" — use the `launch <site>` command\"\n      : norm === \"announcement\"\n        ? \" — use the `announce <site>` command\"\n        : \"\";\n  throw Object.assign(\n    new Error(`--type must be Maintenance or Testing (got ${JSON.stringify(raw)})${hint}`),\n    { exitCode: 2 },\n  );\n}\n\n/** Dashboard origin for digest /s/<slug> links. DASHBOARD_BASE_URL overrides the\n *  production default; the trailing slash (if any) is trimmed by runDigest. */\nfunction dashboardBaseUrl(): string {\n  return process.env.DASHBOARD_BASE_URL?.trim() || \"https://reddoor-maintenance.netlify.app\";\n}\n\nexport async function runReportCommand(\n  slug: string | undefined,\n  opts: ReportCommandOptions,\n): Promise<{ output: string; code: number }> {\n  if (opts.digest) {\n    const { runDigest } = await import(\"../../reports/digest.js\");\n    return runDigest({ baseUrl: dashboardBaseUrl() });\n  }\n\n  if (opts.sendReady) {\n    const { sendApprovedReports } = await import(\"../../reports/send/orchestrate.js\");\n    return sendApprovedReports();\n  }\n\n  if (opts.due) {\n    return runDueDraft();\n  }\n\n  if (slug) {\n    // Validate the type BEFORE any Airtable access so a bad --type fails fast (and\n    // without needing credentials).\n    const reportType = parseSingleSiteReportType(opts.type);\n    return runSingleSiteDraft(slug, { previewOnly: Boolean(opts.preview), reportType });\n  }\n\n  throw Object.assign(\n    new Error(\n      \"Usage: reddoor-maint report [<slug>] [--type <Maintenance|Testing>] [--due] [--preview] [--send-ready] [--digest]\",\n    ),\n    {\n      exitCode: 2,\n    },\n  );\n}\n\nasync function runDueDraft(): Promise<{ output: string; code: number }> {\n  const base = openBase(readAirtableConfig());\n  const result = await draftDueReports(base, new Date());\n  await alertOnFleetAnalyticsFailure(result.health);\n  return { output: result.output, code: result.code };\n}\n\n/** Best-effort: when a draft run's GA/Search soft-failures look FLEET-WIDE (the shared\n *  GA_SUBJECT lost access — see assessAnalyticsAlert), email the operator one alert.\n *  NEVER throws — a Resend or config hiccup must not fail the nightly draft cron; the\n *  per-site `⚠ GA skipped` warnings + the run-output line still carry the signal. The\n *  daily idempotency key dedupes multiple runs in one day (Resend dedupes 24h). */\nasync function alertOnFleetAnalyticsFailure(health: AnalyticsRunHealth): Promise<void> {\n  if (!assessAnalyticsAlert(health).fire) return;\n  try {\n    const to = process.env.OPERATOR_EMAIL?.trim() || \"info@reddoorla.com\";\n    const { subject, html } = composeAnalyticsAlertEmail(health, dashboardBaseUrl());\n    const { defaultResendClient } = await import(\"../../reports/send/resend.js\");\n    await defaultResendClient().send({\n      from: \"Reddoor Reports <reports@reddoorla.com>\",\n      to: [to],\n      subject,\n      html,\n      idempotencyKey: `analytics-alert-${new Date().toISOString().slice(0, 10)}`,\n    });\n    console.warn(`⚠ ${subject} — operator alerted (${to})`);\n  } catch (e) {\n    console.warn(`⚠ analytics-failure alert send failed: ${(e as Error).message}`);\n  }\n}\n\nexport async function draftDueReports(\n  base: AirtableBase,\n  today: Date,\n): Promise<{ output: string; code: number; health: AnalyticsRunHealth }> {\n  const websites = await listWebsites(base);\n  // ONE unfiltered fetch for the whole fleet. Per-site queries can't be pushed to\n  // Airtable anyway (linked-record fields aren't formula-filterable by record id),\n  // and findDueReports + the period guard below match on siteId in memory.\n  const reports = await listAllReports(base);\n  const due = findDueReports(websites, reports, today);\n\n  // GA/Search enrichment is configured globally (the impersonation subject) AND\n  // per-site (a GA4 property or a search query). `gaConfigured` is the global half;\n  // the per-site half is checked as each draft runs, to build the fleet-wide\n  // analytics-failure alert's denominator (see alertOnFleetAnalyticsFailure).\n  const gaConfigured = readGaConfig() !== null;\n  // Truthy (not `!== null`) to mirror fetchGaUsers/fetchSearch's own gate exactly\n  // (`!siteRow.ga4PropertyId`), so an empty-string cell counts as not-configured in\n  // BOTH places and can't inflate the alert denominator.\n  const isAnalyticsConfigured = (s: WebsiteRow): boolean =>\n    gaConfigured && Boolean(s.ga4PropertyId || s.searchQuery);\n\n  if (due.length === 0) {\n    return {\n      output: \"No reports due.\",\n      code: 0,\n      health: { softFailedSites: 0, configuredSites: 0 },\n    };\n  }\n\n  const lines: string[] = [];\n  let softFailedSites = 0;\n  let gaConfiguredSites = 0;\n  let skipped = 0;\n  for (const item of due) {\n    // Idempotency: a re-run must not re-draft a (site, type) already drafted this\n    // recurrence. The dueDate's YYYY-MM is the stable per-cycle key. Match against the\n    // reports we already fetched — no extra query on the hot path.\n    const period = reportPeriodKey(item.dueDate);\n    const existing = reports.find(\n      (r) => r.siteId === item.site.id && r.reportType === item.reportType && r.period === period,\n    );\n\n    // A row already exists for THIS period. Two cases:\n    //   - Draft ready → truly done, skip (the idempotent re-run path).\n    //   - NOT ready → a crash between createDraft and setDraftReady wedged it: the\n    //     row exists (so we never re-draft) yet it's never sendable (listSendable\n    //     needs Draft ready). COMPLETE it in place instead of skipping forever —\n    //     re-render → re-upload the HTML → flip Draft ready on the EXISTING row.\n    if (existing) {\n      if (existing.draftReady) {\n        skipped++;\n        lines.push(`• skipped (already drafted ${period}): ${item.site.name} ${item.reportType}`);\n        continue;\n      }\n      // A not-ready row is normally a crash between createDraft and setDraftReady — re-complete\n      // it in place. BUT queueDraft also clears Draft ready on rows it supersedes/blocks, and\n      // those must NOT be re-completed: doing so would re-render and APPEND a duplicate HTML\n      // attachment every nightly run, only to be re-blocked. Distinguish the two: if a\n      // higher-or-equal-tier report is still pending for this site, this row was intentionally\n      // un-queued (not crashed) — skip it until the blocker is sent/approved or the month rolls.\n      const blockedByPending = reports.some(\n        (r) =>\n          r.siteId === item.site.id &&\n          r.id !== existing.id &&\n          r.sentAt === null &&\n          r.draftReady &&\n          reportTier(r.reportType) >= reportTier(item.reportType),\n      );\n      if (blockedByPending) {\n        skipped++;\n        lines.push(\n          `• skipped (superseded — a higher-or-equal-tier report is pending): ${item.site.name} ${item.reportType}`,\n        );\n        continue;\n      }\n      try {\n        const result = await draftReportForSite(base, item.site, item.reportType, {\n          period,\n          completeRowId: existing.id,\n          existingRow: existing,\n        });\n        existing.draftReady = result.queued === true;\n        lines.push(\n          draftLine(\n            result.reportRow?.reportId ?? existing.reportId,\n            result.queued,\n            result.supersededIds,\n            \"completed half-made draft\",\n          ),\n        );\n        if (isAnalyticsConfigured(item.site)) gaConfiguredSites++;\n        if (result.softFailures.length > 0) softFailedSites++;\n      } catch (e) {\n        lines.push(`✗ failed: ${item.site.name} ${item.reportType} — ${(e as Error).message}`);\n      }\n      continue;\n    }\n\n    // Pile-up guard: don't accrue a fresh new-period draft every recurrence for a\n    // site nobody ever approves. The period key follows the DUE month, so each\n    // recurrence wants a new (later-period) draft — but if a PRIOR draft is still\n    // pending approval, a new one just stacks. Skip creating the new one while an\n    // earlier-period draft for this (site, type) sits ready-but-unsent.\n    //\n    // `r.draftReady` is load-bearing: a draft a higher tier SUPERSEDED has\n    // draftReady=false and never gets a Sent at, so without this clause it would\n    // match (sentAt null + earlier period) and block EVERY future draft for the\n    // site forever. Pending-approval means draftReady=true AND sentAt=null.\n    const pendingEarlier = reports.find(\n      (r) =>\n        r.siteId === item.site.id &&\n        r.reportType === item.reportType &&\n        r.draftReady &&\n        r.sentAt === null &&\n        r.period !== null &&\n        r.period < period,\n    );\n    if (pendingEarlier) {\n      skipped++;\n      lines.push(\n        `• skipped: ${item.site.name} ${item.reportType} already has an unsent ${pendingEarlier.period} draft pending approval`,\n      );\n      continue;\n    }\n\n    try {\n      // Pass the SAME key the guard searches by, so the stamped Period always\n      // matches a future run's reportPeriodKey(dueDate) — even if this run lags\n      // into a later month than the dueDate.\n      const result = await draftReportForSite(base, item.site, item.reportType, { period });\n      lines.push(draftLine(result.reportRow?.reportId, result.queued, result.supersededIds));\n      // Keep the in-memory snapshot current so the guard's `.some()` check on the\n      // NEXT iteration of this same run catches a row we JUST created — rather than\n      // relying on findDueReports never emitting two items for the same (site, type).\n      if (result.reportRow) reports.push(result.reportRow);\n      // Count sites (not individual GA/Search failures) so a fleet-wide enrichment\n      // outage is one obvious line at the bottom, not 200 buried console.warns.\n      if (isAnalyticsConfigured(item.site)) gaConfiguredSites++;\n      if (result.softFailures.length > 0) softFailedSites++;\n    } catch (e) {\n      lines.push(`✗ failed: ${item.site.name} ${item.reportType} — ${(e as Error).message}`);\n    }\n  }\n  if (skipped > 0) {\n    lines.push(`• ${skipped} already drafted or pending this period`);\n  }\n  if (softFailedSites > 0) {\n    lines.push(\n      `⚠ ${softFailedSites} site${softFailedSites === 1 ? \"\" : \"s\"} had GA/Search enrichment fail — drafted with blank analytics; check the logs above`,\n    );\n  }\n  return {\n    output: lines.join(\"\\n\"),\n    code: lines.some((l) => l.startsWith(\"✗\")) ? 1 : 0,\n    health: { softFailedSites, configuredSites: gaConfiguredSites },\n  };\n}\n\nasync function runSingleSiteDraft(\n  slug: string,\n  opts: { previewOnly: boolean; reportType: ReportType },\n): Promise<{ output: string; code: number }> {\n  const base = openBase(readAirtableConfig());\n  const websites = await listWebsites(base);\n  const site = websites.find((w) => siteSlug(w.name) === slug);\n  if (!site) {\n    throw Object.assign(new Error(`No Websites row matched slug \"${slug}\"`), { exitCode: 2 });\n  }\n  const result = await draftReportForSite(opts.previewOnly ? null : base, site, opts.reportType, {\n    previewOnly: opts.previewOnly,\n  });\n  if (opts.previewOnly) {\n    return { output: `Preview written to ${result.htmlPath}`, code: 0 };\n  }\n  return {\n    output: draftLine(\n      result.reportRow?.reportId,\n      result.queued,\n      result.supersededIds,\n      \"Draft created\",\n    ),\n    code: 0,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmBA,IAAM,mBAAmB;AAUlB,SAAS,qBAAqB,GAAuC;AAC1E,QAAM,EAAE,iBAAiB,gBAAgB,IAAI;AAC7C,QAAM,OACJ,mBAAmB,KACnB,mBAAmB,oBACnB,kBAAkB,KAAK;AACzB,QAAM,SAAS,OACX,GAAG,eAAe,OAAO,eAAe,oPACxC;AACJ,SAAO,EAAE,MAAM,OAAO;AACxB;AAOO,SAAS,2BACd,GACA,cACmC;AACnC,QAAM,UAAU,oDAA0C,EAAE,eAAe,IAAI,EAAE,eAAe;AAChG,QAAM,EAAE,OAAO,IAAI,qBAAqB,CAAC;AACzC,QAAM,OAAO,cAAc,WAAW,MAAM,CAAC;AAAA;AAAA;AAAA,cAGjC,WAAW,YAAY,CAAC;AACpC,SAAO,EAAE,SAAS,KAAK;AACzB;;;AC5BA,SAAS,UACP,UACA,QACA,eACA,OAAO,WACC;AACR,QAAM,KAAK,YAAY;AACvB,MAAI,WAAW,OAAO;AACpB,WAAO,UAAK,IAAI,oBAAoB,EAAE;AAAA,EACxC;AACA,QAAM,MACJ,cAAc,SAAS,IACnB,gBAAgB,cAAc,MAAM,oBAAoB,cAAc,SAAS,IAAI,MAAM,EAAE,MAC3F;AACN,SAAO,UAAK,IAAI,KAAK,EAAE,GAAG,GAAG;AAC/B;AASO,SAAS,0BAA0B,KAAqC;AAC7E,MAAI,QAAQ,UAAa,IAAI,KAAK,MAAM,GAAI,QAAO;AACnD,QAAM,OAAO,IAAI,KAAK,EAAE,YAAY;AACpC,MAAI,SAAS,cAAe,QAAO;AACnC,MAAI,SAAS,UAAW,QAAO;AAC/B,QAAM,OACJ,SAAS,WACL,4CACA,SAAS,iBACP,8CACA;AACR,QAAM,OAAO;AAAA,IACX,IAAI,MAAM,8CAA8C,KAAK,UAAU,GAAG,CAAC,IAAI,IAAI,EAAE;AAAA,IACrF,EAAE,UAAU,EAAE;AAAA,EAChB;AACF;AAIA,SAAS,mBAA2B;AAClC,SAAO,QAAQ,IAAI,oBAAoB,KAAK,KAAK;AACnD;AAEA,eAAsB,iBACpB,MACA,MAC2C;AAC3C,MAAI,KAAK,QAAQ;AACf,UAAM,EAAE,UAAU,IAAI,MAAM,OAAO,sBAAyB;AAC5D,WAAO,UAAU,EAAE,SAAS,iBAAiB,EAAE,CAAC;AAAA,EAClD;AAEA,MAAI,KAAK,WAAW;AAClB,UAAM,EAAE,oBAAoB,IAAI,MAAM,OAAO,2BAAmC;AAChF,WAAO,oBAAoB;AAAA,EAC7B;AAEA,MAAI,KAAK,KAAK;AACZ,WAAO,YAAY;AAAA,EACrB;AAEA,MAAI,MAAM;AAGR,UAAM,aAAa,0BAA0B,KAAK,IAAI;AACtD,WAAO,mBAAmB,MAAM,EAAE,aAAa,QAAQ,KAAK,OAAO,GAAG,WAAW,CAAC;AAAA,EACpF;AAEA,QAAM,OAAO;AAAA,IACX,IAAI;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,UAAU;AAAA,IACZ;AAAA,EACF;AACF;AAEA,eAAe,cAAyD;AACtE,QAAM,OAAO,SAAS,mBAAmB,CAAC;AAC1C,QAAM,SAAS,MAAM,gBAAgB,MAAM,oBAAI,KAAK,CAAC;AACrD,QAAM,6BAA6B,OAAO,MAAM;AAChD,SAAO,EAAE,QAAQ,OAAO,QAAQ,MAAM,OAAO,KAAK;AACpD;AAOA,eAAe,6BAA6B,QAA2C;AACrF,MAAI,CAAC,qBAAqB,MAAM,EAAE,KAAM;AACxC,MAAI;AACF,UAAM,KAAK,QAAQ,IAAI,gBAAgB,KAAK,KAAK;AACjD,UAAM,EAAE,SAAS,KAAK,IAAI,2BAA2B,QAAQ,iBAAiB,CAAC;AAC/E,UAAM,EAAE,oBAAoB,IAAI,MAAM,OAAO,sBAA8B;AAC3E,UAAM,oBAAoB,EAAE,KAAK;AAAA,MAC/B,MAAM;AAAA,MACN,IAAI,CAAC,EAAE;AAAA,MACP;AAAA,MACA;AAAA,MACA,gBAAgB,oBAAmB,oBAAI,KAAK,GAAE,YAAY,EAAE,MAAM,GAAG,EAAE,CAAC;AAAA,IAC1E,CAAC;AACD,YAAQ,KAAK,UAAK,OAAO,6BAAwB,EAAE,GAAG;AAAA,EACxD,SAAS,GAAG;AACV,YAAQ,KAAK,+CAA2C,EAAY,OAAO,EAAE;AAAA,EAC/E;AACF;AAEA,eAAsB,gBACpB,MACA,OACuE;AACvE,QAAM,WAAW,MAAM,aAAa,IAAI;AAIxC,QAAM,UAAU,MAAM,eAAe,IAAI;AACzC,QAAM,MAAM,eAAe,UAAU,SAAS,KAAK;AAMnD,QAAM,eAAe,aAAa,MAAM;AAIxC,QAAM,wBAAwB,CAAC,MAC7B,gBAAgB,QAAQ,EAAE,iBAAiB,EAAE,WAAW;AAE1D,MAAI,IAAI,WAAW,GAAG;AACpB,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ,EAAE,iBAAiB,GAAG,iBAAiB,EAAE;AAAA,IACnD;AAAA,EACF;AAEA,QAAM,QAAkB,CAAC;AACzB,MAAI,kBAAkB;AACtB,MAAI,oBAAoB;AACxB,MAAI,UAAU;AACd,aAAW,QAAQ,KAAK;AAItB,UAAM,SAAS,gBAAgB,KAAK,OAAO;AAC3C,UAAM,WAAW,QAAQ;AAAA,MACvB,CAAC,MAAM,EAAE,WAAW,KAAK,KAAK,MAAM,EAAE,eAAe,KAAK,cAAc,EAAE,WAAW;AAAA,IACvF;AAQA,QAAI,UAAU;AACZ,UAAI,SAAS,YAAY;AACvB;AACA,cAAM,KAAK,mCAA8B,MAAM,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,UAAU,EAAE;AACxF;AAAA,MACF;AAOA,YAAM,mBAAmB,QAAQ;AAAA,QAC/B,CAAC,MACC,EAAE,WAAW,KAAK,KAAK,MACvB,EAAE,OAAO,SAAS,MAClB,EAAE,WAAW,QACb,EAAE,cACF,WAAW,EAAE,UAAU,KAAK,WAAW,KAAK,UAAU;AAAA,MAC1D;AACA,UAAI,kBAAkB;AACpB;AACA,cAAM;AAAA,UACJ,gFAAsE,KAAK,KAAK,IAAI,IAAI,KAAK,UAAU;AAAA,QACzG;AACA;AAAA,MACF;AACA,UAAI;AACF,cAAM,SAAS,MAAM,mBAAmB,MAAM,KAAK,MAAM,KAAK,YAAY;AAAA,UACxE;AAAA,UACA,eAAe,SAAS;AAAA,UACxB,aAAa;AAAA,QACf,CAAC;AACD,iBAAS,aAAa,OAAO,WAAW;AACxC,cAAM;AAAA,UACJ;AAAA,YACE,OAAO,WAAW,YAAY,SAAS;AAAA,YACvC,OAAO;AAAA,YACP,OAAO;AAAA,YACP;AAAA,UACF;AAAA,QACF;AACA,YAAI,sBAAsB,KAAK,IAAI,EAAG;AACtC,YAAI,OAAO,aAAa,SAAS,EAAG;AAAA,MACtC,SAAS,GAAG;AACV,cAAM,KAAK,kBAAa,KAAK,KAAK,IAAI,IAAI,KAAK,UAAU,WAAO,EAAY,OAAO,EAAE;AAAA,MACvF;AACA;AAAA,IACF;AAYA,UAAM,iBAAiB,QAAQ;AAAA,MAC7B,CAAC,MACC,EAAE,WAAW,KAAK,KAAK,MACvB,EAAE,eAAe,KAAK,cACtB,EAAE,cACF,EAAE,WAAW,QACb,EAAE,WAAW,QACb,EAAE,SAAS;AAAA,IACf;AACA,QAAI,gBAAgB;AAClB;AACA,YAAM;AAAA,QACJ,mBAAc,KAAK,KAAK,IAAI,IAAI,KAAK,UAAU,0BAA0B,eAAe,MAAM;AAAA,MAChG;AACA;AAAA,IACF;AAEA,QAAI;AAIF,YAAM,SAAS,MAAM,mBAAmB,MAAM,KAAK,MAAM,KAAK,YAAY,EAAE,OAAO,CAAC;AACpF,YAAM,KAAK,UAAU,OAAO,WAAW,UAAU,OAAO,QAAQ,OAAO,aAAa,CAAC;AAIrF,UAAI,OAAO,UAAW,SAAQ,KAAK,OAAO,SAAS;AAGnD,UAAI,sBAAsB,KAAK,IAAI,EAAG;AACtC,UAAI,OAAO,aAAa,SAAS,EAAG;AAAA,IACtC,SAAS,GAAG;AACV,YAAM,KAAK,kBAAa,KAAK,KAAK,IAAI,IAAI,KAAK,UAAU,WAAO,EAAY,OAAO,EAAE;AAAA,IACvF;AAAA,EACF;AACA,MAAI,UAAU,GAAG;AACf,UAAM,KAAK,UAAK,OAAO,yCAAyC;AAAA,EAClE;AACA,MAAI,kBAAkB,GAAG;AACvB,UAAM;AAAA,MACJ,UAAK,eAAe,QAAQ,oBAAoB,IAAI,KAAK,GAAG;AAAA,IAC9D;AAAA,EACF;AACA,SAAO;AAAA,IACL,QAAQ,MAAM,KAAK,IAAI;AAAA,IACvB,MAAM,MAAM,KAAK,CAAC,MAAM,EAAE,WAAW,QAAG,CAAC,IAAI,IAAI;AAAA,IACjD,QAAQ,EAAE,iBAAiB,iBAAiB,kBAAkB;AAAA,EAChE;AACF;AAEA,eAAe,mBACb,MACA,MAC2C;AAC3C,QAAM,OAAO,SAAS,mBAAmB,CAAC;AAC1C,QAAM,WAAW,MAAM,aAAa,IAAI;AACxC,QAAM,OAAO,SAAS,KAAK,CAAC,MAAM,SAAS,EAAE,IAAI,MAAM,IAAI;AAC3D,MAAI,CAAC,MAAM;AACT,UAAM,OAAO,OAAO,IAAI,MAAM,iCAAiC,IAAI,GAAG,GAAG,EAAE,UAAU,EAAE,CAAC;AAAA,EAC1F;AACA,QAAM,SAAS,MAAM,mBAAmB,KAAK,cAAc,OAAO,MAAM,MAAM,KAAK,YAAY;AAAA,IAC7F,aAAa,KAAK;AAAA,EACpB,CAAC;AACD,MAAI,KAAK,aAAa;AACpB,WAAO,EAAE,QAAQ,sBAAsB,OAAO,QAAQ,IAAI,MAAM,EAAE;AAAA,EACpE;AACA,SAAO;AAAA,IACL,QAAQ;AAAA,MACN,OAAO,WAAW;AAAA,MAClB,OAAO;AAAA,MACP,OAAO;AAAA,MACP;AAAA,IACF;AAAA,IACA,MAAM;AAAA,EACR;AACF;","names":[]}

package/dist/resend-G2BJMAQV.js

@@ -0,0 +1,7 @@
+import {
+  defaultResendClient
+} from "./chunk-WEKL2HYJ.js";
+export {
+  defaultResendClient
+};
+//# sourceMappingURL=resend-G2BJMAQV.js.map

package/dist/resend-G2BJMAQV.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/self-updating-CIUMOMYI.js

@@ -0,0 +1,61 @@
+import {
+  selfUpdating
+} from "./chunk-PF6BNYGE.js";
+import "./chunk-DIVB6ZF7.js";
+import {
+  appendSkipNotice,
+  fleetWorkdir,
+  prepareFleetSites
+} from "./chunk-4NAOR44V.js";
+import {
+  resolveSites
+} from "./chunk-J3OPWFZE.js";
+import "./chunk-CASCWQQX.js";
+import "./chunk-FDIFTIXC.js";
+import "./chunk-HVOOCK6L.js";
+import "./chunk-XXTZBPUY.js";
+import "./chunk-XTK5VIQB.js";
+import "./chunk-U5SZ4FOP.js";
+
+// src/cli/commands/self-updating.ts
+import { resolve } from "path";
+function formatResult(r) {
+  if (r.status === "noop") return `[${r.site}] noop: ${r.notes ?? "already self-updating"}`;
+  if (r.status === "failed") return `[${r.site}] failed: ${r.notes ?? ""}`;
+  return `[${r.site}] applied
+${r.notes ?? ""}`;
+}
+async function runSelfUpdatingCommand(site, opts) {
+  const cwd = opts.cwd ? resolve(opts.cwd) : process.cwd();
+  let sites = await resolveSites({
+    ...site !== void 0 ? { site } : {},
+    ...opts.fleet !== void 0 ? { fleet: opts.fleet } : {},
+    cwd
+  });
+  let skipped = [];
+  if (opts.fleet) {
+    const workdir = opts.workdir ?? fleetWorkdir();
+    const prep = await prepareFleetSites(sites, { workdir });
+    sites = prep.prepared;
+    skipped = prep.skipped;
+  }
+  if (opts.dry) {
+    return {
+      output: appendSkipNotice(
+        sites.map((s) => `[${s.name || s.path}] would enable self-updating`).join("\n"),
+        skipped
+      ),
+      code: 0
+    };
+  }
+  const results = [];
+  for (const s of sites) results.push(await selfUpdating(s));
+  return {
+    output: appendSkipNotice(results.map(formatResult).join("\n"), skipped),
+    code: results.some((r) => r.status === "failed") ? 1 : 0
+  };
+}
+export {
+  runSelfUpdatingCommand
+};
+//# sourceMappingURL=self-updating-CIUMOMYI.js.map

package/dist/self-updating-CIUMOMYI.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli/commands/self-updating.ts"],"sourcesContent":["import { resolve } from \"node:path\";\nimport { resolveSites } from \"../fleet/resolve-sites.js\";\nimport { prepareFleetSites, appendSkipNotice, type SkippedSite } from \"../fleet/prepare-sites.js\";\nimport { fleetWorkdir } from \"../../util/fleet-workdir.js\";\nimport { selfUpdating } from \"../../recipes/self-updating/index.js\";\nimport type { RecipeResult } from \"../../types.js\";\n\nexport type SelfUpdatingCommandOptions = {\n  fleet?: string;\n  workdir?: string;\n  dry?: boolean;\n  cwd?: string;\n};\n\nfunction formatResult(r: RecipeResult): string {\n  if (r.status === \"noop\") return `[${r.site}] noop: ${r.notes ?? \"already self-updating\"}`;\n  if (r.status === \"failed\") return `[${r.site}] failed: ${r.notes ?? \"\"}`;\n  return `[${r.site}] applied\\n${r.notes ?? \"\"}`;\n}\n\nexport async function runSelfUpdatingCommand(\n  site: string | undefined,\n  opts: SelfUpdatingCommandOptions,\n): Promise<{ output: string; code: number }> {\n  const cwd = opts.cwd ? resolve(opts.cwd) : process.cwd();\n\n  let sites = await resolveSites({\n    ...(site !== undefined ? { site } : {}),\n    ...(opts.fleet !== undefined ? { fleet: opts.fleet } : {}),\n    cwd,\n  });\n\n  let skipped: SkippedSite[] = [];\n  if (opts.fleet) {\n    const workdir = opts.workdir ?? fleetWorkdir();\n    const prep = await prepareFleetSites(sites, { workdir });\n    sites = prep.prepared;\n    skipped = prep.skipped;\n  }\n\n  if (opts.dry) {\n    return {\n      output: appendSkipNotice(\n        sites.map((s) => `[${s.name || s.path}] would enable self-updating`).join(\"\\n\"),\n        skipped,\n      ),\n      code: 0,\n    };\n  }\n\n  const results: RecipeResult[] = [];\n  for (const s of sites) results.push(await selfUpdating(s));\n\n  return {\n    output: appendSkipNotice(results.map(formatResult).join(\"\\n\"), skipped),\n    code: results.some((r) => r.status === \"failed\") ? 1 : 0,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA,SAAS,eAAe;AAcxB,SAAS,aAAa,GAAyB;AAC7C,MAAI,EAAE,WAAW,OAAQ,QAAO,IAAI,EAAE,IAAI,WAAW,EAAE,SAAS,uBAAuB;AACvF,MAAI,EAAE,WAAW,SAAU,QAAO,IAAI,EAAE,IAAI,aAAa,EAAE,SAAS,EAAE;AACtE,SAAO,IAAI,EAAE,IAAI;AAAA,EAAc,EAAE,SAAS,EAAE;AAC9C;AAEA,eAAsB,uBACpB,MACA,MAC2C;AAC3C,QAAM,MAAM,KAAK,MAAM,QAAQ,KAAK,GAAG,IAAI,QAAQ,IAAI;AAEvD,MAAI,QAAQ,MAAM,aAAa;AAAA,IAC7B,GAAI,SAAS,SAAY,EAAE,KAAK,IAAI,CAAC;AAAA,IACrC,GAAI,KAAK,UAAU,SAAY,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAAA,IACxD;AAAA,EACF,CAAC;AAED,MAAI,UAAyB,CAAC;AAC9B,MAAI,KAAK,OAAO;AACd,UAAM,UAAU,KAAK,WAAW,aAAa;AAC7C,UAAM,OAAO,MAAM,kBAAkB,OAAO,EAAE,QAAQ,CAAC;AACvD,YAAQ,KAAK;AACb,cAAU,KAAK;AAAA,EACjB;AAEA,MAAI,KAAK,KAAK;AACZ,WAAO;AAAA,MACL,QAAQ;AAAA,QACN,MAAM,IAAI,CAAC,MAAM,IAAI,EAAE,QAAQ,EAAE,IAAI,8BAA8B,EAAE,KAAK,IAAI;AAAA,QAC9E;AAAA,MACF;AAAA,MACA,MAAM;AAAA,IACR;AAAA,EACF;AAEA,QAAM,UAA0B,CAAC;AACjC,aAAW,KAAK,MAAO,SAAQ,KAAK,MAAM,aAAa,CAAC,CAAC;AAEzD,SAAO;AAAA,IACL,QAAQ,iBAAiB,QAAQ,IAAI,YAAY,EAAE,KAAK,IAAI,GAAG,OAAO;AAAA,IACtE,MAAM,QAAQ,KAAK,CAAC,MAAM,EAAE,WAAW,QAAQ,IAAI,IAAI;AAAA,EACzD;AACF;","names":[]}

package/dist/svelte-codemods-BYRJAU7I.js

@@ -0,0 +1,51 @@
+import {
+  appendSkipNotice,
+  fleetWorkdir,
+  prepareFleetSites
+} from "./chunk-4NAOR44V.js";
+import {
+  resolveSites
+} from "./chunk-J3OPWFZE.js";
+import {
+  svelteCodemods
+} from "./chunk-FUD4I2ZW.js";
+import "./chunk-OQPMZ6BM.js";
+import "./chunk-XKOZUVK2.js";
+import "./chunk-FDIFTIXC.js";
+import "./chunk-HVOOCK6L.js";
+import "./chunk-XXTZBPUY.js";
+import "./chunk-XTK5VIQB.js";
+import "./chunk-U5SZ4FOP.js";
+
+// src/cli/commands/svelte-codemods.ts
+import { resolve } from "path";
+function formatResult(r) {
+  if (r.status === "noop") return `[${r.site}] noop: ${r.notes ?? ""}`;
+  if (r.status === "failed") return `[${r.site}] failed: ${r.notes ?? ""}`;
+  return `[${r.site}] applied: ${r.commits.length} commit(s)
+${r.notes ?? ""}`;
+}
+async function runSvelteCodemodsCommand(site, opts) {
+  const cwd = opts.cwd ? resolve(opts.cwd) : process.cwd();
+  let sites = await resolveSites({
+    ...site !== void 0 ? { site } : {},
+    ...opts.fleet !== void 0 ? { fleet: opts.fleet } : {},
+    cwd
+  });
+  let skipped = [];
+  if (opts.fleet) {
+    const workdir = opts.workdir ?? fleetWorkdir();
+    const prep = await prepareFleetSites(sites, { workdir });
+    sites = prep.prepared;
+    skipped = prep.skipped;
+  }
+  const results = [];
+  for (const s of sites) results.push(await svelteCodemods(s));
+  const output = results.map(formatResult).join("\n");
+  const code = results.some((r) => r.status === "failed") ? 1 : 0;
+  return { output: appendSkipNotice(output, skipped), code };
+}
+export {
+  runSvelteCodemodsCommand
+};
+//# sourceMappingURL=svelte-codemods-BYRJAU7I.js.map

package/dist/svelte-codemods-BYRJAU7I.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli/commands/svelte-codemods.ts"],"sourcesContent":["import { resolve } from \"node:path\";\nimport { svelteCodemods } from \"../../recipes/svelte-codemods.js\";\nimport type { RecipeResult } from \"../../types.js\";\nimport { resolveSites } from \"../fleet/resolve-sites.js\";\nimport { prepareFleetSites, appendSkipNotice, type SkippedSite } from \"../fleet/prepare-sites.js\";\nimport { fleetWorkdir } from \"../../util/fleet-workdir.js\";\n\nexport type SvelteCodemodsCommandOptions = {\n  fleet?: string;\n  workdir?: string;\n  cwd?: string;\n};\n\nfunction formatResult(r: RecipeResult): string {\n  if (r.status === \"noop\") return `[${r.site}] noop: ${r.notes ?? \"\"}`;\n  if (r.status === \"failed\") return `[${r.site}] failed: ${r.notes ?? \"\"}`;\n  return `[${r.site}] applied: ${r.commits.length} commit(s)\\n${r.notes ?? \"\"}`;\n}\n\nexport async function runSvelteCodemodsCommand(\n  site: string | undefined,\n  opts: SvelteCodemodsCommandOptions,\n): Promise<{ output: string; code: number }> {\n  const cwd = opts.cwd ? resolve(opts.cwd) : process.cwd();\n\n  let sites = await resolveSites({\n    ...(site !== undefined ? { site } : {}),\n    ...(opts.fleet !== undefined ? { fleet: opts.fleet } : {}),\n    cwd,\n  });\n\n  let skipped: SkippedSite[] = [];\n  if (opts.fleet) {\n    const workdir = opts.workdir ?? fleetWorkdir();\n    const prep = await prepareFleetSites(sites, { workdir });\n    sites = prep.prepared;\n    skipped = prep.skipped;\n  }\n\n  const results: RecipeResult[] = [];\n  for (const s of sites) results.push(await svelteCodemods(s));\n\n  const output = results.map(formatResult).join(\"\\n\");\n  const code = results.some((r) => r.status === \"failed\") ? 1 : 0;\n  return { output: appendSkipNotice(output, skipped), code };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA,SAAS,eAAe;AAaxB,SAAS,aAAa,GAAyB;AAC7C,MAAI,EAAE,WAAW,OAAQ,QAAO,IAAI,EAAE,IAAI,WAAW,EAAE,SAAS,EAAE;AAClE,MAAI,EAAE,WAAW,SAAU,QAAO,IAAI,EAAE,IAAI,aAAa,EAAE,SAAS,EAAE;AACtE,SAAO,IAAI,EAAE,IAAI,cAAc,EAAE,QAAQ,MAAM;AAAA,EAAe,EAAE,SAAS,EAAE;AAC7E;AAEA,eAAsB,yBACpB,MACA,MAC2C;AAC3C,QAAM,MAAM,KAAK,MAAM,QAAQ,KAAK,GAAG,IAAI,QAAQ,IAAI;AAEvD,MAAI,QAAQ,MAAM,aAAa;AAAA,IAC7B,GAAI,SAAS,SAAY,EAAE,KAAK,IAAI,CAAC;AAAA,IACrC,GAAI,KAAK,UAAU,SAAY,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAAA,IACxD;AAAA,EACF,CAAC;AAED,MAAI,UAAyB,CAAC;AAC9B,MAAI,KAAK,OAAO;AACd,UAAM,UAAU,KAAK,WAAW,aAAa;AAC7C,UAAM,OAAO,MAAM,kBAAkB,OAAO,EAAE,QAAQ,CAAC;AACvD,YAAQ,KAAK;AACb,cAAU,KAAK;AAAA,EACjB;AAEA,QAAM,UAA0B,CAAC;AACjC,aAAW,KAAK,MAAO,SAAQ,KAAK,MAAM,eAAe,CAAC,CAAC;AAE3D,QAAM,SAAS,QAAQ,IAAI,YAAY,EAAE,KAAK,IAAI;AAClD,QAAM,OAAO,QAAQ,KAAK,CAAC,MAAM,EAAE,WAAW,QAAQ,IAAI,IAAI;AAC9D,SAAO,EAAE,QAAQ,iBAAiB,QAAQ,OAAO,GAAG,KAAK;AAC3D;","names":[]}