@reddoorla/maintenance 0.55.0 → 0.57.0

package/dist/chunk-4PY4I5OR.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/audits/deps.ts","../src/audits/deps-outdated.ts","../src/audits/lint.ts","../src/audits/security.ts","../src/audits/lighthouse.ts","../src/audits/util/site-config.ts","../src/util/free-port.ts","../src/audits/a11y.ts","../src/audits/domain.ts","../src/audits/route-discovery.ts","../src/audits/browser.ts","../src/audits/index.ts"],"sourcesContent":["import { readFile } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport type { AuditResult } from \"../types.js\";\nimport { siteLabel } from \"../util/site.js\";\nimport { baselineVersions } from \"../configs/baseline-versions.js\";\nimport type { AuditContext } from \"./util/inject.js\";\nimport { defaultSpawn } from \"./util/spawn.js\";\nimport { scanOutdated, type OutdatedCounts } from \"./deps-outdated.js\";\n\nexport type Drift = \"same\" | \"patch\" | \"minor\" | \"major\" | \"newer\";\n\nexport type DepsDriftEntry = {\n  pkg: string;\n  baseline: string;\n  actual: string;\n  drift: Drift;\n};\n\n/** The deps audit reports TWO signals:\n *  - `entries`: declared-range drift vs the canonical baseline (what the\n *    package.json *asks for*, caret-stripped) — the long-standing signal.\n *  - `outdated`: real installed-version drift vs the registry's latest, from\n *    the committed lockfile (null when it can't be determined). Added so the\n *    \"Deps Drifted\" dashboard number stops being the only — and misleading —\n *    deps signal. */\nexport type DepsDetails = {\n  entries: DepsDriftEntry[];\n  outdated: OutdatedCounts | null;\n};\n\nfunction stripCaret(range: string): string {\n  return range.replace(/^[\\^~]/, \"\");\n}\n\n/** A spec we can drift-compare against a semver baseline: a plain version or\n *  caret/tilde range like \"5.55.10\", \"^5.55.10\", \"~5.0.0\". Excludes \"*\",\n *  \"latest\", \"workspace:*\", \"npm:\"-aliases, and git/URL/file specs — those used\n *  to parse to NaN and produce bogus drift, so they're skipped instead. */\nfunction isComparableRange(spec: string): boolean {\n  return /^[\\^~]?\\d/.test(spec.trim());\n}\n\nfunction parseSemver(v: string): [number, number, number] {\n  const cleaned = stripCaret(v).split(\"-\")[0] ?? \"0.0.0\";\n  const parts = cleaned.split(\".\").map((n) => Number.parseInt(n, 10));\n  return [parts[0] ?? 0, parts[1] ?? 0, parts[2] ?? 0];\n}\n\nfunction compareSemver(actual: string, baseline: string): Drift {\n  const [aMajor, aMinor, aPatch] = parseSemver(actual);\n  const [bMajor, bMinor, bPatch] = parseSemver(baseline);\n  if (aMajor > bMajor) return \"newer\";\n  if (aMajor < bMajor) return \"major\";\n  if (aMinor > bMinor) return \"newer\";\n  if (aMinor < bMinor) return \"minor\";\n  if (aPatch > bPatch) return \"newer\";\n  if (aPatch < bPatch) return \"patch\";\n  return \"same\";\n}\n\nexport async function depsAudit(ctx: AuditContext): Promise<AuditResult> {\n  const pkgPath = join(ctx.site.path, \"package.json\");\n  let pkgRaw: string;\n  try {\n    pkgRaw = await readFile(pkgPath, \"utf-8\");\n  } catch (err) {\n    return {\n      audit: \"deps\",\n      site: siteLabel(ctx.site),\n      status: \"skip\",\n      summary: `no package.json at ${pkgPath}`,\n      details: { error: String(err) },\n    };\n  }\n\n  let pkg: { dependencies?: Record<string, string>; devDependencies?: Record<string, string> };\n  try {\n    pkg = JSON.parse(pkgRaw) as {\n      dependencies?: Record<string, string>;\n      devDependencies?: Record<string, string>;\n    };\n  } catch (err) {\n    return {\n      audit: \"deps\",\n      site: siteLabel(ctx.site),\n      status: \"fail\",\n      summary: `package.json is not valid JSON: ${(err as Error).message}`,\n      details: { error: String(err) },\n    };\n  }\n  const installed: Record<string, string> = {\n    ...(pkg.dependencies ?? {}),\n    ...(pkg.devDependencies ?? {}),\n  };\n\n  const entries: DepsDriftEntry[] = [];\n  for (const [name, baseline] of Object.entries(baselineVersions)) {\n    const actual = installed[name];\n    if (!actual) continue;\n    // Skip non-semver specs (\"*\", \"workspace:*\", \"npm:\"-aliases, git/URL): they\n    // can't be drift-compared and used to yield NaN-driven bogus drift (LOW-3).\n    if (!isComparableRange(actual)) continue;\n    entries.push({\n      pkg: name,\n      baseline,\n      actual,\n      drift: compareSemver(actual, baseline),\n    });\n  }\n\n  const anyMajor = entries.some((d) => d.drift === \"major\");\n  const anyMinor = entries.some((d) => d.drift === \"minor\");\n  const anyNewer = entries.some((d) => d.drift === \"newer\");\n\n  // Status stays driven by the declared-range baseline drift (unchanged\n  // behavior). The outdated count is an independent, informational signal.\n  const status: AuditResult[\"status\"] = anyMajor ? \"fail\" : anyMinor || anyNewer ? \"warn\" : \"pass\";\n\n  const driftSummary =\n    status === \"pass\"\n      ? `all ${entries.length} tracked deps in line with baseline`\n      : status === \"warn\"\n        ? `${entries.filter((d) => d.drift !== \"same\").length} of ${entries.length} tracked deps drifted`\n        : `${entries.filter((d) => d.drift === \"major\").length} deps lagging by a major version`;\n\n  const outdated = await scanOutdated(ctx.site.path, ctx.spawn ?? defaultSpawn);\n  const summary = outdated\n    ? `${driftSummary}; ${outdated.outdated} outdated install(s) (${outdated.major} major)`\n    : driftSummary;\n\n  return {\n    audit: \"deps\",\n    site: siteLabel(ctx.site),\n    status,\n    summary,\n    details: { entries, outdated } satisfies DepsDetails,\n  };\n}\n","import { stat } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport type { SpawnFn } from \"./util/spawn.js\";\n\n/** Real installed-version drift, distinct from the declared-range \"drift\" the\n *  deps audit computes against the baseline: how many dependencies are behind\n *  the registry's latest, per the committed lockfile. */\nexport type OutdatedCounts = { outdated: number; major: number };\n\nasync function exists(path: string): Promise<boolean> {\n  try {\n    await stat(path);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nfunction majorOf(version: string): number {\n  const head = version.replace(/^[\\^~]/, \"\").split(\".\")[0] ?? \"0\";\n  const n = Number.parseInt(head, 10);\n  return Number.isNaN(n) ? 0 : n;\n}\n\n/**\n * Count outdated dependencies for a site, using its committed lockfile as the\n * source of truth for \"what's installed/deployed\". Returns `null` (skip — the\n * caller degrades gracefully) when it can't determine this:\n *  - no `pnpm-lock.yaml` (not a pnpm site, or never installed)\n *  - the lockfile is stale vs package.json (`--frozen-lockfile` install fails)\n *  - `pnpm outdated` output isn't parseable\n *\n * `pnpm outdated` exits non-zero precisely WHEN there are outdated packages, so\n * its exit code is ignored and only its JSON is parsed. `--frozen-lockfile`\n * never mutates the lockfile, so this stays read-only with respect to the repo.\n */\nexport async function scanOutdated(\n  sitePath: string,\n  spawn: SpawnFn,\n): Promise<OutdatedCounts | null> {\n  if (!(await exists(join(sitePath, \"pnpm-lock.yaml\")))) return null;\n\n  // Everything below is best-effort: a thrown spawn (timeout, `pnpm` not on\n  // PATH, spawn error) must degrade to a skip (null), NOT bubble up and flip the\n  // whole deps audit to a hard fail — the declared-range drift is independent of\n  // pnpm and must still report. (Mirrors securityAudit's try/catch.)\n  try {\n    // Materialize node_modules from the lockfile, but only when it's missing —\n    // an already-installed checkout skips the cold install. `--frozen-lockfile`\n    // never rewrites the lockfile (read-only wrt the repo) and fails fast on a\n    // lockfile out of sync with package.json → skip.\n    if (!(await exists(join(sitePath, \"node_modules\")))) {\n      const install = await spawn(\"pnpm\", [\"install\", \"--frozen-lockfile\"], {\n        cwd: sitePath,\n        timeoutMs: 180_000,\n      });\n      if (install.code !== 0) return null;\n    }\n\n    // `pnpm outdated` exits non-zero precisely WHEN there are outdated packages,\n    // so its exit code is ignored and only its JSON is parsed.\n    const res = await spawn(\"pnpm\", [\"outdated\", \"--json\"], {\n      cwd: sitePath,\n      timeoutMs: 60_000,\n    });\n    const parsed = JSON.parse(res.stdout || \"{}\") as Record<\n      string,\n      { current?: string; latest?: string }\n    >;\n    const entries = Object.values(parsed);\n    return {\n      outdated: entries.length,\n      major: entries.filter((e) => e.current && e.latest && majorOf(e.latest) > majorOf(e.current))\n        .length,\n    };\n  } catch {\n    return null;\n  }\n}\n","import { existsSync } from \"node:fs\";\nimport { readFile } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport { ESLint } from \"eslint\";\nimport { check as prettierCheck, resolveConfig as prettierResolveConfig } from \"prettier\";\nimport { glob } from \"tinyglobby\";\nimport type { AuditResult } from \"../types.js\";\nimport { siteLabel } from \"../util/site.js\";\nimport type { AuditContext } from \"./util/inject.js\";\n\nconst TARGET_GLOBS = [\"**/*.{ts,js,svelte}\"];\nconst IGNORE = [\"node_modules/**\", \"dist/**\", \".svelte-kit/**\", \"build/**\", \".netlify/**\"];\n\nasync function listFiles(cwd: string): Promise<string[]> {\n  return glob(TARGET_GLOBS, { cwd, ignore: IGNORE, absolute: false });\n}\n\nexport async function lintAudit(ctx: AuditContext): Promise<AuditResult> {\n  const { site } = ctx;\n  const configPath = join(site.path, \"eslint.config.js\");\n\n  if (!existsSync(configPath)) {\n    return {\n      audit: \"lint\",\n      site: siteLabel(site),\n      status: \"skip\",\n      summary: \"no eslint config at site root\",\n    };\n  }\n\n  const eslint = new ESLint({\n    cwd: site.path,\n    overrideConfigFile: configPath,\n    errorOnUnmatchedPattern: false,\n  });\n\n  const relFiles = await listFiles(site.path);\n\n  // Pass relative paths to ESLint; its cwd is already site.path. Avoids\n  // dereferencing symlinks on pnpm workspaces.\n  const eslintResults = await eslint.lintFiles(relFiles);\n  const eslintErrors = eslintResults.reduce((n, r) => n + r.errorCount, 0);\n  const eslintWarnings = eslintResults.reduce((n, r) => n + r.warningCount, 0);\n\n  const prettierUnformatted: string[] = [];\n  for (const rel of relFiles) {\n    const absForResolve = join(site.path, rel);\n    const source = await readFile(absForResolve, \"utf-8\");\n    const options = (await prettierResolveConfig(absForResolve)) ?? {};\n    const ok = await prettierCheck(source, { ...options, filepath: absForResolve });\n    if (!ok) prettierUnformatted.push(rel);\n  }\n\n  const status: AuditResult[\"status\"] =\n    eslintErrors > 0 || prettierUnformatted.length > 0\n      ? \"fail\"\n      : eslintWarnings > 0\n        ? \"warn\"\n        : \"pass\";\n\n  const summary =\n    status === \"pass\"\n      ? `lint clean across ${relFiles.length} files`\n      : `${eslintErrors} eslint errors, ${eslintWarnings} warnings, ${prettierUnformatted.length} unformatted`;\n\n  return {\n    audit: \"lint\",\n    site: siteLabel(site),\n    status,\n    summary,\n    details: {\n      eslintErrors,\n      eslintWarnings,\n      prettierUnformatted,\n      files: relFiles.length,\n    },\n  };\n}\n","import type { AuditResult } from \"../types.js\";\nimport { siteLabel } from \"../util/site.js\";\nimport { defaultSpawn, type SpawnResult } from \"./util/spawn.js\";\nimport type { AuditContext } from \"./util/inject.js\";\n\ntype Severity = \"low\" | \"moderate\" | \"high\" | \"critical\";\n\ntype Counts = { low: number; moderate: number; high: number; critical: number };\n\ntype AdvisoryEntry = {\n  module: string;\n  severity: Severity;\n  title: string;\n  cves?: string[];\n  url?: string;\n};\n\n// pnpm audit output (npm-compat with extra advisories map keyed by ID).\ntype PnpmAuditJson = {\n  metadata?: { vulnerabilities?: Partial<Counts> };\n  advisories?: Record<\n    string,\n    {\n      id?: number;\n      title?: string;\n      module_name?: string;\n      severity?: string;\n      cves?: string[];\n      url?: string;\n    }\n  >;\n};\n\n// npm v7+ shape (vulnerabilities keyed by package name).\ntype NpmAuditJson = {\n  metadata?: { vulnerabilities?: Partial<Counts> };\n  vulnerabilities?: Record<\n    string,\n    {\n      name?: string;\n      severity?: string;\n      via?: unknown;\n      url?: string;\n    }\n  >;\n};\n\nfunction classify(v: Counts) {\n  if (v.critical > 0 || v.high > 0) return \"fail\" as const;\n  if (v.moderate > 0 || v.low > 0) return \"warn\" as const;\n  return \"pass\" as const;\n}\n\nfunction normalizeSeverity(s: unknown): Severity {\n  if (s === \"low\" || s === \"moderate\" || s === \"high\" || s === \"critical\") return s;\n  // npm/pnpm sometimes emit \"info\" for informational advisories. Map down\n  // rather than defaulting to \"moderate\" (which would inflate severity).\n  return \"low\";\n}\n\nfunction extractAdvisoriesFromPnpm(parsed: PnpmAuditJson): AdvisoryEntry[] {\n  const out: AdvisoryEntry[] = [];\n  for (const a of Object.values(parsed.advisories ?? {})) {\n    if (!a) continue;\n    out.push({\n      module: a.module_name ?? \"unknown\",\n      severity: normalizeSeverity(a.severity),\n      title: a.title ?? \"(no title)\",\n      ...(a.cves ? { cves: a.cves } : {}),\n      ...(a.url ? { url: a.url } : {}),\n    });\n  }\n  return out;\n}\n\n/** Walk an npm v7+ `via` chain to find the root entry whose `via` array\n * contains a real advisory object (rather than another package name string).\n * Returns the package name at the root and the advisory detail. */\nfunction resolveNpmAdvisoryRoot(\n  startName: string,\n  vulnerabilities: NonNullable<NpmAuditJson[\"vulnerabilities\"]>,\n): { rootName: string; detail?: { title?: string; url?: string } } {\n  const seen = new Set<string>();\n  let current = startName;\n  while (!seen.has(current)) {\n    seen.add(current);\n    const entry = vulnerabilities[current];\n    if (!entry || !Array.isArray(entry.via)) return { rootName: current };\n\n    const detailed = entry.via.find(\n      (e): e is { title?: string; url?: string } => typeof e === \"object\" && e !== null,\n    );\n    if (detailed) return { rootName: current, detail: detailed };\n\n    const next = entry.via.find((e): e is string => typeof e === \"string\");\n    if (!next || next === current) return { rootName: current };\n    current = next;\n  }\n  return { rootName: current };\n}\n\nfunction extractAdvisoriesFromNpm(parsed: NpmAuditJson): AdvisoryEntry[] {\n  const vulnerabilities = parsed.vulnerabilities ?? {};\n  const roots = new Map<string, AdvisoryEntry>();\n\n  for (const [name, v] of Object.entries(vulnerabilities)) {\n    if (!v) continue;\n    const { rootName, detail } = resolveNpmAdvisoryRoot(name, vulnerabilities);\n    if (roots.has(rootName)) continue; // already surfaced via another transitive entry\n\n    const rootEntry = vulnerabilities[rootName];\n    const severity = normalizeSeverity(rootEntry?.severity ?? v.severity);\n    const title = detail?.title ?? rootName;\n    const url = detail?.url;\n\n    roots.set(rootName, {\n      module: rootEntry?.name ?? rootName,\n      severity,\n      title,\n      ...(url ? { url } : {}),\n    });\n  }\n\n  return [...roots.values()];\n}\n\ntype ToolResult =\n  | { kind: \"missing\" }\n  | { kind: \"error\"; reason: string }\n  | { kind: \"ok\"; parsed: PnpmAuditJson & NpmAuditJson };\n\nasync function runAuditTool(\n  spawn: (cmd: string, args: readonly string[], opts?: { cwd?: string }) => Promise<SpawnResult>,\n  cmd: string,\n  args: readonly string[],\n  cwd: string,\n): Promise<ToolResult> {\n  let raw: SpawnResult;\n  try {\n    raw = await spawn(cmd, args, { cwd });\n  } catch (err) {\n    const e = err as NodeJS.ErrnoException;\n    if (e.code === \"ENOENT\" || /ENOENT/.test(String(err))) return { kind: \"missing\" };\n    return { kind: \"error\", reason: `spawn failed: ${String(err).slice(0, 200)}` };\n  }\n\n  // 0 = clean, 1 = vulns found. Anything else is a real error.\n  if (raw.code !== 0 && raw.code !== 1) {\n    return {\n      kind: \"error\",\n      reason: `exit ${raw.code}${raw.stderr ? `: ${raw.stderr.slice(0, 150)}` : \"\"}`,\n    };\n  }\n\n  let parsed: PnpmAuditJson & NpmAuditJson;\n  try {\n    parsed = JSON.parse(raw.stdout || \"{}\") as PnpmAuditJson & NpmAuditJson;\n  } catch (err) {\n    return { kind: \"error\", reason: `unparseable JSON: ${String(err).slice(0, 100)}` };\n  }\n\n  // pnpm error envelope: { error: { code, message } }. npm sometimes emits\n  // a top-level error too. Either means the audit didn't actually run.\n  const errEnvelope = (parsed as unknown as { error?: { code?: string } }).error;\n  if (errEnvelope && typeof errEnvelope === \"object\") {\n    return { kind: \"error\", reason: errEnvelope.code ?? \"error envelope returned\" };\n  }\n\n  // Without metadata.vulnerabilities there are no counts to report and we\n  // can't trust the result. An empty `{}` is just as suspect as a missing\n  // key — counts default to 0 and we'd silently report \"pass\". Treat both\n  // as a tool failure so the caller can fall through to the other audit.\n  const vulnsMeta = parsed.metadata?.vulnerabilities;\n  if (!vulnsMeta || Object.keys(vulnsMeta).length === 0) {\n    return { kind: \"error\", reason: \"no metadata.vulnerabilities in output\" };\n  }\n\n  return { kind: \"ok\", parsed };\n}\n\nexport async function securityAudit(ctx: AuditContext): Promise<AuditResult> {\n  const spawn = ctx.spawn ?? defaultSpawn;\n  const site = ctx.site;\n  const label = siteLabel(site);\n\n  let used: \"pnpm audit\" | \"npm audit\" = \"pnpm audit\";\n  let result = await runAuditTool(spawn, \"pnpm\", [\"audit\", \"--json\", \"--prod\"], site.path);\n\n  // Fall through to npm if pnpm is missing OR pnpm couldn't actually\n  // audit the project (e.g., no pnpm-lock.yaml). Previously we only fell\n  // through on ENOENT, which meant npm-using sites silently reported \"pass\"\n  // because pnpm returned an error envelope with no metadata.\n  if (result.kind !== \"ok\") {\n    const pnpmReason = result.kind === \"missing\" ? \"not installed\" : result.reason;\n    const npmResult = await runAuditTool(\n      spawn,\n      \"npm\",\n      [\"audit\", \"--json\", \"--omit=dev\"],\n      site.path,\n    );\n    if (npmResult.kind === \"ok\") {\n      result = npmResult;\n      used = \"npm audit\";\n    } else {\n      const npmReason = npmResult.kind === \"missing\" ? \"not installed\" : npmResult.reason;\n      return {\n        audit: \"security\",\n        site: label,\n        status: \"skip\",\n        summary: `cannot run audit — pnpm: ${pnpmReason}; npm: ${npmReason}`,\n      };\n    }\n  }\n\n  const parsed = result.parsed;\n\n  const counts: Counts = {\n    low: parsed.metadata?.vulnerabilities?.low ?? 0,\n    moderate: parsed.metadata?.vulnerabilities?.moderate ?? 0,\n    high: parsed.metadata?.vulnerabilities?.high ?? 0,\n    critical: parsed.metadata?.vulnerabilities?.critical ?? 0,\n  };\n\n  const advisories =\n    used === \"pnpm audit\" ? extractAdvisoriesFromPnpm(parsed) : extractAdvisoriesFromNpm(parsed);\n\n  const status = classify(counts);\n  const total = counts.low + counts.moderate + counts.high + counts.critical;\n  const summary =\n    status === \"pass\"\n      ? `${used}: 0 vulnerabilities`\n      : `${used}: ${total} vulnerabilities (${counts.critical}C/${counts.high}H/${counts.moderate}M/${counts.low}L)`;\n\n  return {\n    audit: \"security\",\n    site: label,\n    status,\n    summary,\n    details: { counts, advisories },\n  };\n}\n","import { readFile, writeFile, mkdtemp, rm, readdir } from \"node:fs/promises\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport type { AuditResult, Site } from \"../types.js\";\nimport { siteLabel } from \"../util/site.js\";\nimport { lighthouseConfig } from \"../configs/lighthouse.js\";\nimport { defaultSpawn } from \"./util/spawn.js\";\nimport type { SpawnFn, SpawnResult } from \"./util/spawn.js\";\nimport type { AuditContext } from \"./util/inject.js\";\nimport { readSiteConfig } from \"./util/site-config.js\";\nimport { findFreePort, withFreePort } from \"../util/free-port.js\";\n\ntype ManifestEntry = {\n  url: string;\n  summary: Record<string, number>;\n  htmlPath?: string;\n  jsonPath?: string;\n};\n\ntype AssertionResult = {\n  name: string;\n  actual: number;\n  expected: number;\n  operator: string;\n  passed: boolean;\n  level: \"warn\" | \"error\";\n  auditProperty?: string;\n  auditId?: string;\n};\n\ntype NormalizedLhciResult = {\n  summary: Record<string, number>;\n  assertionsFailed: number;\n  assertions: Array<{ category: string; level: \"warn\" | \"error\"; message: string }>;\n};\n\nasync function readJsonMaybe<T>(path: string): Promise<T | null> {\n  try {\n    const raw = await readFile(path, \"utf-8\");\n    return JSON.parse(raw) as T;\n  } catch {\n    return null;\n  }\n}\n\ntype LhrFile = {\n  requestedUrl: string;\n  finalUrl?: string;\n  categories: Record<string, { score: number | null }>;\n};\n\n/**\n * Build manifest-equivalent entries by scanning the `.lighthouseci/` dir\n * for `lhr-*.json` files written by `lhci collect`. We used to read\n * `manifest.json` directly, but lhci 0.15+ no longer writes it — the\n * audit would silently return \"no manifest written\" against a perfectly\n * healthy run. Reproduced on caltex 2026-05-28 (0.10.5 dogfood).\n */\nasync function readLhrEntries(resultsDir: string): Promise<ManifestEntry[]> {\n  const files = await readdir(resultsDir).catch(() => [] as string[]);\n  const entries: ManifestEntry[] = [];\n  for (const f of files) {\n    if (!f.startsWith(\"lhr-\") || !f.endsWith(\".json\")) continue;\n    const lhr = await readJsonMaybe<LhrFile>(join(resultsDir, f));\n    if (!lhr || !lhr.categories) continue;\n    const summary: Record<string, number> = {};\n    for (const [k, v] of Object.entries(lhr.categories)) {\n      if (typeof v?.score === \"number\") summary[k] = v.score;\n    }\n    entries.push({ url: lhr.requestedUrl, summary });\n  }\n  return entries;\n}\n\nfunction averageSummaries(entries: ManifestEntry[]): Record<string, number> {\n  if (entries.length === 0) return {};\n  const sums: Record<string, number> = {};\n  const counts: Record<string, number> = {};\n  for (const e of entries) {\n    for (const [k, v] of Object.entries(e.summary ?? {})) {\n      if (typeof v !== \"number\") continue;\n      sums[k] = (sums[k] ?? 0) + v;\n      counts[k] = (counts[k] ?? 0) + 1;\n    }\n  }\n  const out: Record<string, number> = {};\n  for (const k of Object.keys(sums)) {\n    const total = sums[k] ?? 0;\n    const count = counts[k] ?? 1;\n    out[k] = total / count;\n  }\n  return out;\n}\n\nfunction categoryFromAssertion(a: AssertionResult): string {\n  // `name` looks like \"categories:accessibility\" or \"audits:uses-http2\".\n  const colonIdx = a.name.indexOf(\":\");\n  return colonIdx >= 0 ? a.name.slice(colonIdx + 1) : a.name;\n}\n\nfunction messageForAssertion(a: AssertionResult): string {\n  // `a.actual` is parsed from external lhci/Lighthouse JSON; a malformed or\n  // missing value (not a number) would make `.toFixed` throw and crash the whole\n  // audit. Guard it and fall back to a readable string instead.\n  const actual = typeof a.actual === \"number\" ? a.actual.toFixed(2) : \"n/a\";\n  return `${a.name} ${a.operator} ${a.expected} (actual: ${actual})`;\n}\n\n/** Shared tail: scan `.lighthouseci/` for lhr-*.json + assertion-results.json and\n *  build the AuditResult. Identical for the checkout and deployed paths. */\nasync function parseLhciResults(\n  resultsDir: string,\n  label: string,\n  raw: SpawnResult,\n): Promise<AuditResult> {\n  const manifest = await readLhrEntries(resultsDir);\n\n  if (manifest.length === 0) {\n    return {\n      audit: \"lighthouse\",\n      site: label,\n      status: \"fail\",\n      summary: `lighthouse: no lhr-*.json written (exit ${raw.code})${\n        raw.stderr ? ` — ${raw.stderr.slice(0, 200)}` : \"\"\n      }`,\n    };\n  }\n\n  const assertionResults =\n    (await readJsonMaybe<AssertionResult[]>(join(resultsDir, \"assertion-results.json\"))) ?? [];\n\n  const failed = assertionResults.filter((a) => !a.passed);\n  const assertions = failed.map((a) => ({\n    category: categoryFromAssertion(a),\n    level: a.level,\n    message: messageForAssertion(a),\n  }));\n\n  const anyError = assertions.some((a) => a.level === \"error\");\n  const anyWarn = assertions.some((a) => a.level === \"warn\");\n  const status: AuditResult[\"status\"] = anyError ? \"fail\" : anyWarn ? \"warn\" : \"pass\";\n\n  const normalized: NormalizedLhciResult = {\n    summary: averageSummaries(manifest),\n    assertionsFailed: failed.length,\n    assertions,\n  };\n\n  const summary =\n    status === \"pass\"\n      ? \"lighthouse: all categories passing\"\n      : `lighthouse: ${failed.length} assertion(s) failed`;\n\n  return { audit: \"lighthouse\", site: label, status, summary, details: normalized };\n}\n\n/** Checkout mode (unchanged behavior): boot the site's vite dev server on a\n *  pinned free port and audit the local fixtures/override URL. */\nasync function checkoutLighthouse(spawn: SpawnFn, site: Site, label: string): Promise<AuditResult> {\n  const siteCfg = await readSiteConfig(site.path);\n  // Allocate a free port + force vite to `--strictPort` so the spawned dev\n  // server either binds the port we picked or fails loudly (caltex 2026-05-28\n  // zombie-vite incident).\n  const port = await findFreePort();\n  const baseUrl = siteCfg.lighthouseUrl ?? lighthouseConfig.ci.collect.url[0];\n  const resolvedConfig = {\n    ...lighthouseConfig,\n    ci: {\n      ...lighthouseConfig.ci,\n      collect: {\n        ...lighthouseConfig.ci.collect,\n        url: [withFreePort(baseUrl, port)],\n        startServerCommand: `npm run vite:dev -- --port ${port} --strictPort`,\n      },\n    },\n  };\n\n  const configDir = await mkdtemp(join(tmpdir(), \"reddoor-lhci-\"));\n  const configPath = join(configDir, \"lighthouserc.json\");\n  await writeFile(configPath, JSON.stringify(resolvedConfig), \"utf-8\");\n\n  const resultsDir = join(site.path, \".lighthouseci\");\n  await rm(resultsDir, { recursive: true, force: true });\n\n  let raw: SpawnResult;\n  try {\n    raw = await spawn(\"npx\", [\"--yes\", \"@lhci/cli\", \"autorun\", `--config=${configPath}`], {\n      cwd: site.path,\n      timeoutMs: 5 * 60_000,\n    });\n  } catch (err) {\n    await rm(configDir, { recursive: true, force: true });\n    const e = err as NodeJS.ErrnoException;\n    if (e.code === \"ENOENT\" || /ENOENT/.test(String(err))) {\n      return {\n        audit: \"lighthouse\",\n        site: label,\n        status: \"skip\",\n        summary: \"npx/@lhci/cli not available\",\n      };\n    }\n    throw err;\n  }\n  await rm(configDir, { recursive: true, force: true });\n\n  return parseLhciResults(resultsDir, label, raw);\n}\n\n/** Deployed mode: audit a production URL directly — no checkout, no dev server.\n *  Runs in a throwaway tmp cwd; uploads to the filesystem so fleet runs never\n *  push 200 public reports to temporary-public-storage. */\nasync function deployedLighthouse(\n  spawn: SpawnFn,\n  deployedUrl: string,\n  label: string,\n): Promise<AuditResult> {\n  const workDir = await mkdtemp(join(tmpdir(), \"reddoor-lh-deployed-\"));\n  const resolvedConfig = {\n    ci: {\n      // Deliberately NOT spread from lighthouseConfig.ci.collect: deployed mode\n      // must omit startServerCommand and the dev-server settings entirely.\n      collect: {\n        url: [deployedUrl],\n        // 3 runs to damp Lighthouse's run-to-run variance; parseLhciResults\n        // averages the lhr files. (Median is a tracked future refinement.)\n        numberOfRuns: 3,\n        settings: { preset: \"desktop\", skipAudits: [\"uses-http2\"] },\n      },\n      assert: lighthouseConfig.ci.assert,\n      upload: { target: \"filesystem\", outputDir: join(workDir, \"lhci-report\") },\n    },\n  };\n\n  const configPath = join(workDir, \"lighthouserc.json\");\n  await writeFile(configPath, JSON.stringify(resolvedConfig), \"utf-8\");\n\n  const resultsDir = join(workDir, \".lighthouseci\");\n\n  let raw: SpawnResult;\n  try {\n    raw = await spawn(\"npx\", [\"--yes\", \"@lhci/cli\", \"autorun\", `--config=${configPath}`], {\n      cwd: workDir,\n      // 3 serial cold runs of a slow deployed site (lhci's own maxWaitForLoad\n      // ~45-60s each) + first-use Chrome download can plausibly exceed 3 min →\n      // SIGTERM → no lhr-*.json → spurious \"no scores\". Match the 5-min budget\n      // the checkout path already gives (erp-industrials nightly flake,\n      // morning-brief 2026-06-10 MEDIUM-F).\n      timeoutMs: 5 * 60_000,\n    });\n  } catch (err) {\n    await rm(workDir, { recursive: true, force: true });\n    const e = err as NodeJS.ErrnoException;\n    if (e.code === \"ENOENT\" || /ENOENT/.test(String(err))) {\n      return {\n        audit: \"lighthouse\",\n        site: label,\n        status: \"skip\",\n        summary: \"npx/@lhci/cli not available\",\n      };\n    }\n    throw err;\n  }\n\n  try {\n    return await parseLhciResults(resultsDir, label, raw);\n  } finally {\n    await rm(workDir, { recursive: true, force: true });\n  }\n}\n\nexport async function lighthouseAudit(ctx: AuditContext): Promise<AuditResult> {\n  const spawn = ctx.spawn ?? defaultSpawn;\n  const site = ctx.site;\n  const label = siteLabel(site);\n\n  return site.deployedUrl\n    ? deployedLighthouse(spawn, site.deployedUrl, label)\n    : checkoutLighthouse(spawn, site, label);\n}\n","import { readFile } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\nexport type SiteConfig = {\n  /** Override URL the lighthouse audit hits. Sites without the default\n   * `/dev/a11y-fixtures` dev route set this to their homepage. */\n  lighthouseUrl?: string;\n};\n\n/**\n * Read per-site overrides from `package.json#reddoor`. Returns `{}` on any\n * failure (missing file, malformed JSON, missing key, wrong type) so every\n * caller can safely fall back to its built-in default. Never throws.\n */\nexport async function readSiteConfig(sitePath: string): Promise<SiteConfig> {\n  let raw: string;\n  try {\n    raw = await readFile(join(sitePath, \"package.json\"), \"utf-8\");\n  } catch {\n    return {};\n  }\n  let pkg: unknown;\n  try {\n    pkg = JSON.parse(raw);\n  } catch {\n    return {};\n  }\n  if (!pkg || typeof pkg !== \"object\") return {};\n  const cfg = (pkg as { reddoor?: unknown }).reddoor;\n  if (!cfg || typeof cfg !== \"object\") return {};\n\n  const out: SiteConfig = {};\n  const url = (cfg as { lighthouseUrl?: unknown }).lighthouseUrl;\n  if (typeof url === \"string\" && url.length > 0) {\n    out.lighthouseUrl = url;\n  }\n  return out;\n}\n","import { createServer } from \"node:net\";\n\n/**\n * Bind an ephemeral TCP port, capture it, release it, and return it. Used\n * by the lighthouse and a11y audits to pick a port the audit's own dev\n * server will then bind via `--strictPort`.\n *\n * Why: vite's default behavior on a busy port is to bump to the next free\n * one (5173 → 5174 → …). When zombie vite processes (or any squatter) are\n * already on 5173, the audit's spawned vite lands on a higher port, but\n * the audit tooling (lhci, playwright) still probes 5173 — hits the\n * zombie — gets stale 404s — fails with \"no manifest written\" / \"no\n * results written (exit 1)\". Reproduced on caltex 2026-05-28 with 10\n * orphaned vite processes accumulated across this repo, the reports repo,\n * and caltex itself. Allocating a free port up front + `--strictPort`\n * makes the audit immune to port collisions.\n *\n * TOCTOU note: the small window between close() and the spawned vite\n * binding is theoretically racy, but in practice we run one audit at a\n * time and the OS keeps the port free for re-use. If vite still fails to\n * bind under `--strictPort`, the audit fails loudly — that's the correct\n * outcome (vs. silently auditing the wrong server).\n */\nexport async function findFreePort(): Promise<number> {\n  return new Promise((resolve, reject) => {\n    const server = createServer();\n    server.unref();\n    server.on(\"error\", reject);\n    server.listen(0, \"127.0.0.1\", () => {\n      const addr = server.address();\n      if (typeof addr === \"object\" && addr) {\n        const port = addr.port;\n        server.close(() => resolve(port));\n      } else {\n        server.close();\n        reject(new Error(\"findFreePort: could not determine assigned port from socket\"));\n      }\n    });\n  });\n}\n\n/**\n * Swap the port (and force `localhost` host) on a URL so it points at the\n * audit's freshly-allocated dev server. Preserves the path + any query.\n * Used to rewrite the lighthouse `url` so lhci probes the correct port.\n */\nexport function withFreePort(url: string, port: number): string {\n  const u = new URL(url);\n  u.hostname = \"localhost\";\n  u.port = String(port);\n  return u.toString();\n}\n","import { readFile, writeFile, mkdtemp, rm } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport type { AuditResult } from \"../types.js\";\nimport { siteLabel } from \"../util/site.js\";\nimport { a11yRoutes, smokeRoutes } from \"../configs/playwright-a11y.js\";\nimport { defaultSpawn } from \"./util/spawn.js\";\nimport type { AuditContext } from \"./util/inject.js\";\nimport { findFreePort } from \"../util/free-port.js\";\n\ntype Impact = \"minor\" | \"moderate\" | \"serious\" | \"critical\";\n\ntype AxeViolation = {\n  id: string;\n  impact: Impact;\n  route: string;\n  help?: string;\n  helpUrl?: string;\n  nodes?: Array<{ html?: string; target?: string[] }>;\n};\n\ntype NormalizedA11y = {\n  totalViolations: number;\n  byImpact: Partial<Record<Impact, number>>;\n  violations: AxeViolation[];\n};\n\nconst RESULTS_REL = \".reddoor-a11y/results.json\";\n\nasync function readJsonMaybe<T>(path: string): Promise<T | null> {\n  try {\n    const raw = await readFile(path, \"utf-8\");\n    return JSON.parse(raw) as T;\n  } catch {\n    return null;\n  }\n}\n\n// The audit-controlled playwright config. We synthesize it (rather than\n// rely on the site's playwright.config.ts) so we can pin the dev server\n// port + force `--strictPort` — same fix as the lighthouse audit, same\n// reason (zombie vite processes squatting on 5173 would otherwise eat\n// the audit's request and return stale 404s).\nfunction buildPlaywrightConfig(port: number, sitePath: string): string {\n  return `import { defineConfig } from \"@playwright/test\";\n\nexport default defineConfig({\n  testDir: \".\",\n  testMatch: /.*\\\\.spec\\\\.ts$/,\n  fullyParallel: true,\n  forbidOnly: !!process.env.CI,\n  retries: process.env.CI ? 2 : 0,\n  reporter: process.env.CI ? \"github\" : \"list\",\n  use: {\n    baseURL: \"http://localhost:${port}\",\n    trace: \"on-first-retry\",\n  },\n  webServer: {\n    // --strictPort: refuse to bump to a different port if ours is taken,\n    //   so the audit fails loudly instead of probing a zombie.\n    // reuseExistingServer:false: never reuse — we control the lifecycle.\n    // cwd: playwright's default webServer.cwd is the config file's\n    //   directory. Our config lives in /tmp so without this override,\n    //   \"npm run vite:dev\" tries to read /tmp/.../package.json and\n    //   ENOENTs before vite ever starts. Caltex 2026-05-28 (0.10.5).\n    command: \"npm run vite:dev -- --port ${port} --strictPort\",\n    url: \"http://localhost:${port}/dev/a11y-fixtures\",\n    cwd: ${JSON.stringify(sitePath)},\n    reuseExistingServer: false,\n    timeout: 120_000,\n  },\n});\n`;\n}\n\n// The spec the audit writes runs all configured routes through axe in a single\n// test (so worker isolation doesn't fragment the collected violations) and\n// writes the structured result to <cwd>/.reddoor-a11y/results.json before\n// asserting. That way, the audit can read real axe details even when the\n// expect(...).toEqual([]) assertion fails.\nfunction buildSpec(): string {\n  return `import { test, expect } from \"@playwright/test\";\nimport AxeBuilder from \"@axe-core/playwright\";\nimport { mkdir, writeFile } from \"node:fs/promises\";\nimport { dirname } from \"node:path\";\n\nconst pages = ${JSON.stringify(a11yRoutes)};\nconst smokePages = ${JSON.stringify(smokeRoutes)};\nconst OUTPUT = process.env.REDDOOR_A11Y_OUTPUT;\n\n// Playwright's default per-test timeout is 30s. We loop through every\n// configured route in a single test, so the budget needs to scale.\ntest.setTimeout(5 * 60_000);\n\ntest(\"a11y + hydration across configured routes\", async ({ page }) => {\n  const violations = [];\n\n  // Capture uncaught client-side exceptions across every route we visit. A page\n  // that builds + SSRs cleanly can still throw on hydrate and blank itself\n  // (data-dynamiq: a Svelte 4->5 run() referenced a $state declared after it) --\n  // axe never sees that, so we listen for it directly and tag the route in scope.\n  let currentRoute = \"\";\n  page.on(\"pageerror\", (err) => {\n    violations.push({\n      id: \"client-error\",\n      impact: \"critical\",\n      route: currentRoute,\n      help: String(err && err.message ? err.message : err),\n    });\n  });\n\n  for (const { path, name } of pages) {\n    currentRoute = name;\n    await page.goto(path);\n    // Snap CSS transitions/animations to their resting state before axe runs.\n    // AnimateIn-style fixtures transition opacity 0->1; sampling mid-transition\n    // makes axe compute color-contrast against semi-transparent text, yielding a\n    // flaky \"serious\" color-contrast violation (~1/3 of runs on /dev/animate-in).\n    // Disabling transitions/animations forces the final, rendered state\n    // deterministically -- which is also what users (and prefers-reduced-motion\n    // users) actually see, so it's the correct thing to assert.\n    await page.addStyleTag({\n      content: \"*,*::before,*::after{transition:none!important;animation:none!important;}\",\n    });\n    const results = await new AxeBuilder({ page })\n      .withTags([\"wcag2a\",\"wcag2aa\",\"wcag21a\",\"wcag21aa\",\"wcag22aa\"])\n      .analyze();\n    for (const v of results.violations) {\n      violations.push({\n        id: v.id,\n        impact: v.impact ?? \"moderate\",\n        route: name,\n        help: v.help,\n        helpUrl: v.helpUrl,\n        nodes: v.nodes.map((n) => ({ html: n.html, target: n.target })),\n      });\n    }\n  }\n\n  // Hydration smoke check: load real routes (the homepage) and fail on any\n  // uncaught client-side error. No axe here -- real routes carry pre-existing\n  // a11y debt we don't gate on; we only assert they don't crash on hydrate.\n  // HTTP/SSR errors don't fire 'pageerror', so a data-less CI homepage that\n  // renders empty-but-valid won't false-fail -- only a real client crash does.\n  for (const { path, name } of smokePages) {\n    currentRoute = name;\n    await page.goto(path);\n    // Let hydration + first effects run so a TDZ/ReferenceError surfaces.\n    await page.waitForTimeout(2000);\n  }\n\n  const byImpact = {};\n  for (const v of violations) {\n    byImpact[v.impact] = (byImpact[v.impact] ?? 0) + 1;\n  }\n  if (OUTPUT) {\n    await mkdir(dirname(OUTPUT), { recursive: true });\n    await writeFile(\n      OUTPUT,\n      JSON.stringify({ totalViolations: violations.length, byImpact, violations }, null, 2),\n    );\n  }\n  expect(violations).toEqual([]);\n});\n`;\n}\n\nexport async function a11yAudit(ctx: AuditContext): Promise<AuditResult> {\n  const spawn = ctx.spawn ?? defaultSpawn;\n  const site = ctx.site;\n  const label = siteLabel(site);\n\n  // specDir lives INSIDE site.path (not /tmp) so the spec's\n  // `import AxeBuilder from \"@axe-core/playwright\"` resolves via Node's\n  // walk-up — the site's node_modules is the nearest one. A spec written\n  // to /tmp ENOENTs at module resolution before any test runs. Caltex\n  // 2026-05-28 (0.10.6 dogfood), third layer of the same class as the\n  // webServer.cwd bug.\n  const specDir = await mkdtemp(join(site.path, \".reddoor-a11y-spec-\"));\n  // Everything past mkdtemp is wrapped so the transient specDir is removed on\n  // EVERY catchable exit — success, skip-return, or any throw (a failed\n  // writeFile/findFreePort used to orphan it). A timeout-SIGKILL of the parent\n  // can't be caught here; `.reddoor-a11y-spec-*/` is fleet-gitignored as the\n  // backstop for that. (2026-06-10 MEDIUM-D; recurred from 06-05 M3.)\n  try {\n    const specPath = join(specDir, \"a11y.spec.ts\");\n    await writeFile(specPath, buildSpec(), \"utf-8\");\n\n    const port = await findFreePort();\n    const configPath = join(specDir, \"playwright.config.ts\");\n    await writeFile(configPath, buildPlaywrightConfig(port, site.path), \"utf-8\");\n\n    const resultsPath = join(site.path, RESULTS_REL);\n    // Clear stale artifacts so a failed spawn never reports old data.\n    await rm(join(site.path, \".reddoor-a11y\"), { recursive: true, force: true });\n\n    let raw;\n    try {\n      raw = await spawn(\n        \"npx\",\n        [\"--yes\", \"playwright\", \"test\", `--config=${configPath}`, \"--reporter=line\", specPath],\n        {\n          cwd: site.path,\n          env: { ...process.env, REDDOOR_A11Y_OUTPUT: resultsPath },\n          // playwright on a cold tree downloads Chrome, boots the site's dev\n          // server, and runs axe over every configured route. The shared 30 s\n          // default in runAudits is fine for deps/lint/security but starves\n          // playwright (mirrors the lighthouse fix shipped earlier).\n          timeoutMs: 5 * 60_000,\n        },\n      );\n    } catch (err) {\n      const e = err as NodeJS.ErrnoException;\n      if (e.code === \"ENOENT\" || /ENOENT/.test(String(err))) {\n        return {\n          audit: \"a11y\",\n          site: label,\n          status: \"skip\",\n          summary: \"npx/playwright not available\",\n        };\n      }\n      throw err;\n    }\n\n    const artifact = await readJsonMaybe<NormalizedA11y>(resultsPath);\n\n    if (!artifact) {\n      return {\n        audit: \"a11y\",\n        site: label,\n        status: \"fail\",\n        summary: `a11y: no results written (exit ${raw.code})${\n          raw.stderr ? ` — ${raw.stderr.slice(0, 200)}` : \"\"\n        }`,\n      };\n    }\n\n    const hasSerious =\n      (artifact.byImpact.serious ?? 0) > 0 || (artifact.byImpact.critical ?? 0) > 0;\n    const hasAny = artifact.totalViolations > 0;\n\n    const status: AuditResult[\"status\"] = hasSerious ? \"fail\" : hasAny ? \"warn\" : \"pass\";\n    const summary =\n      status === \"pass\"\n        ? `a11y: 0 violations across ${a11yRoutes.length} routes (+${smokeRoutes.length} hydration smoke)`\n        : `a11y: ${artifact.totalViolations} violations`;\n\n    return {\n      audit: \"a11y\",\n      site: label,\n      status,\n      summary,\n      details: artifact,\n    };\n  } finally {\n    await rm(specDir, { recursive: true, force: true });\n  }\n}\n","import { promises as dnsPromises } from \"node:dns\";\nimport tls from \"node:tls\";\nimport type { AuditResult } from \"../types.js\";\nimport type { AuditContext } from \"./util/inject.js\";\nimport { siteLabel } from \"../util/site.js\";\n\n/** Result of probing a site's domain: did DNS resolve, and how many days until the TLS cert\n *  expires (null when unresolved or no usable cert). The auto-tick verdict is recomputed from\n *  the persisted fields — this is just the raw signal. */\nexport type DomainCheck = {\n  resolved: boolean;\n  certDaysRemaining: number | null;\n};\n\n/** Injected IO so the check is unit-testable without real DNS/TLS. `lookup` throws when the host\n *  doesn't resolve; `certValidTo` returns the cert's notAfter date, or null when there's none. */\nexport type DomainDeps = {\n  lookup: (host: string) => Promise<void>;\n  certValidTo: (host: string) => Promise<Date | null>;\n  now: Date;\n};\n\nconst MS_PER_DAY = 24 * 60 * 60 * 1000;\n\n/**\n * Probe one URL's domain: resolve DNS, then read the TLS certificate expiry. PURE given its deps.\n * Any failure degrades safely — an unresolvable host or a missing/unreadable cert yields\n * `certDaysRemaining: null` (which the auto-tick rule treats as \"not provable\", never a pass).\n */\nexport async function checkDomain(url: string, deps: DomainDeps): Promise<DomainCheck> {\n  let host: string;\n  try {\n    host = new URL(url).hostname;\n  } catch {\n    return { resolved: false, certDaysRemaining: null };\n  }\n  try {\n    await deps.lookup(host);\n  } catch {\n    return { resolved: false, certDaysRemaining: null };\n  }\n  let validTo: Date | null;\n  try {\n    validTo = await deps.certValidTo(host);\n  } catch {\n    validTo = null;\n  }\n  if (!validTo || Number.isNaN(validTo.getTime()))\n    return { resolved: true, certDaysRemaining: null };\n  return {\n    resolved: true,\n    certDaysRemaining: Math.floor((validTo.getTime() - deps.now.getTime()) / MS_PER_DAY),\n  };\n}\n\n/** Real DNS + TLS. `certValidTo` opens a TLS socket (SNI = host), reads the peer cert's\n *  `valid_to`, and closes immediately — no HTTP request. */\nexport function defaultDomainDeps(now: Date): DomainDeps {\n  return {\n    lookup: async (host) => {\n      await dnsPromises.lookup(host);\n    },\n    certValidTo: (host) =>\n      new Promise<Date | null>((resolvePromise) => {\n        // `rejectUnauthorized: true` is what makes this check HONEST and the green box truthful:\n        // the secureConnect callback only fires on a trusted, host-matching (SNI), unexpired\n        // chain — an expired / self-signed / untrusted-CA / SAN-mismatched cert fires \"error\"\n        // → null → fail. The whole \"valid cert\" claim depends on this. NEVER set it false.\n        // `socket.authorized` is asserted belt-and-suspenders before trusting `valid_to`.\n        const socket = tls.connect(\n          { host, port: 443, servername: host, timeout: 10_000, rejectUnauthorized: true },\n          () => {\n            const cert = socket.authorized ? socket.getPeerCertificate() : null;\n            socket.end();\n            const validTo = cert && cert.valid_to ? new Date(cert.valid_to) : null;\n            resolvePromise(validTo);\n          },\n        );\n        socket.on(\"error\", () => resolvePromise(null));\n        socket.on(\"timeout\", () => {\n          socket.destroy();\n          resolvePromise(null);\n        });\n      }),\n    now,\n  };\n}\n\n/**\n * Audit a site's domain (DNS + TLS) against its deployed URL. Checkout-free — needs only\n * `site.deployedUrl`. Skips a site with no deployed URL. Writes `certDaysRemaining` + a checked-at\n * timestamp via the Airtable layer; the auto-tick rule decides pass/fail from those.\n */\nexport async function domainAudit(ctx: AuditContext): Promise<AuditResult> {\n  const { site } = ctx;\n  const label = siteLabel(site);\n  if (!site.deployedUrl) {\n    return { audit: \"domain\", site: label, status: \"skip\", summary: \"no deployed URL\" };\n  }\n  const now = ctx.now ?? new Date();\n  const deps = ctx.domainDeps ?? defaultDomainDeps(now);\n  const check = await checkDomain(site.deployedUrl, deps);\n  const checkedAt = now.toISOString();\n  const status: AuditResult[\"status\"] =\n    check.resolved && check.certDaysRemaining !== null && check.certDaysRemaining > 14\n      ? \"pass\"\n      : \"warn\";\n  const summary = !check.resolved\n    ? \"did not resolve\"\n    : check.certDaysRemaining === null\n      ? \"resolved, no usable TLS cert\"\n      : `resolved, cert ${check.certDaysRemaining}d remaining`;\n  return {\n    audit: \"domain\",\n    site: label,\n    status,\n    summary,\n    details: { resolved: check.resolved, certDaysRemaining: check.certDaysRemaining, checkedAt },\n  };\n}\n","/**\n * Route discovery for the deployed-URL browser audit. Pulls the site's sitemap, then samples a\n * REPRESENTATIVE set of paths — bucketed by path family (first segment) and sampled round-robin —\n * so every page *type* is covered, including the dynamic CMS-generated templates (Prismic\n * `[uid]`/`[slug]` detail pages: blog posts, projects, portfolio items) where broken\n * images / overflowing galleries / dead links hide. Taking the first N sitemap entries would skew\n * to top-level static pages and miss them. Pure functions + one fetch-injected entry point.\n */\n\nexport type DiscoverDeps = {\n  /** Fetch a URL, returning its text body, or null on any non-2xx / network error. */\n  fetchText: (url: string) => Promise<string | null>;\n};\n\nexport type DiscoveredRoutes = {\n  /** Absolute URLs (rebuilt on the deployed origin), always including the homepage. */\n  routes: string[];\n  source: \"sitemap\" | \"homepage-links\" | \"root-only\";\n  /** Path-family → count, for the evidence note (\"/, /work ×4, /blog ×4\"). */\n  familyCounts: Record<string, number>;\n};\n\nconst DEFAULT_CAP = 15;\n\n/** Extract `<loc>` URLs from sitemap XML. Tolerant of namespaces/whitespace; ignores junk. */\nexport function parseSitemapUrls(xml: string): string[] {\n  const out: string[] = [];\n  const re = /<loc>\\s*([^<\\s]+)\\s*<\\/loc>/gi;\n  let m: RegExpExecArray | null;\n  while ((m = re.exec(xml)) !== null) {\n    const url = m[1];\n    if (url) out.push(url.trim());\n  }\n  return out;\n}\n\n/** Same-origin `<a href>` paths from an HTML body (homepage fallback). Returns root-relative\n *  pathnames; off-origin / anchor / mailto / tel links are dropped. */\nexport function parseHtmlLinks(html: string, baseUrl: string): string[] {\n  const out = new Set<string>();\n  const re = /<a\\b[^>]*\\bhref\\s*=\\s*[\"']([^\"']+)[\"']/gi;\n  let m: RegExpExecArray | null;\n  while ((m = re.exec(html)) !== null) {\n    const href = m[1];\n    if (!href || href.startsWith(\"#\") || /^(mailto:|tel:|javascript:)/i.test(href)) continue;\n    try {\n      const u = new URL(href, baseUrl);\n      if (u.origin !== new URL(baseUrl).origin) continue;\n      out.add(u.pathname);\n    } catch {\n      /* skip unparseable */\n    }\n  }\n  return [...out];\n}\n\n/** First non-empty path segment (\"/\" → \"\", \"/work/x\" → \"work\"). The \"family\" we bucket by. */\nfunction family(pathname: string): string {\n  return pathname.split(\"/\").filter(Boolean)[0] ?? \"\";\n}\n\n/**\n * Sample a representative set of PATHNAMES from a list of URLs/paths. Always includes \"/\". Buckets\n * the rest by path family and takes them round-robin (one per family per pass), so every family\n * is represented before any family gets a second page — guaranteeing CMS templates aren't skipped.\n * Caps the total. PURE.\n */\nexport function sampleRoutePaths(urlsOrPaths: string[], cap: number = DEFAULT_CAP): string[] {\n  const seen = new Set<string>([\"/\"]);\n  const buckets = new Map<string, string[]>();\n  for (const raw of urlsOrPaths) {\n    let pathname: string;\n    try {\n      pathname = raw.startsWith(\"/\")\n        ? new URL(raw, \"https://x.invalid\").pathname\n        : new URL(raw).pathname;\n    } catch {\n      continue;\n    }\n    if (pathname === \"/\") continue; // root already guaranteed\n    if (seen.has(pathname)) continue;\n    seen.add(pathname);\n    const fam = family(pathname);\n    const arr = buckets.get(fam) ?? [];\n    arr.push(pathname);\n    buckets.set(fam, arr);\n  }\n  const result = [\"/\"];\n  const families = [...buckets.values()];\n  let guard = 0;\n  while (result.length < cap && families.some((f) => f.length > 0) && guard++ < 10_000) {\n    for (const fam of families) {\n      if (result.length >= cap) break;\n      const next = fam.shift();\n      if (next) result.push(next);\n    }\n  }\n  return result;\n}\n\n/** Per-family counts of a sampled path list, for the evidence note. */\nexport function familyCountsOf(paths: string[]): Record<string, number> {\n  const counts: Record<string, number> = {};\n  for (const p of paths) {\n    const key = p === \"/\" ? \"/\" : `/${family(p)}`;\n    counts[key] = (counts[key] ?? 0) + 1;\n  }\n  return counts;\n}\n\n/**\n * Discover a representative route set for `deployedUrl`. Tries `<origin>/sitemap.xml` first\n * (family-sampled); falls back to the homepage's same-origin links; worst case the homepage only.\n * Returns absolute URLs rebuilt on the deployed origin.\n */\nexport async function discoverRoutes(\n  deployedUrl: string,\n  deps: DiscoverDeps,\n  cap: number = DEFAULT_CAP,\n): Promise<DiscoveredRoutes> {\n  const origin = new URL(deployedUrl).origin;\n  const abs = (paths: string[]) => paths.map((p) => new URL(p, origin).href);\n\n  const sitemapXml = await deps.fetchText(new URL(\"/sitemap.xml\", origin).href);\n  if (sitemapXml) {\n    const urls = parseSitemapUrls(sitemapXml);\n    if (urls.length > 0) {\n      const paths = sampleRoutePaths(urls, cap);\n      return { routes: abs(paths), source: \"sitemap\", familyCounts: familyCountsOf(paths) };\n    }\n  }\n\n  const homeHtml = await deps.fetchText(origin);\n  if (homeHtml) {\n    const links = parseHtmlLinks(homeHtml, origin);\n    if (links.length > 0) {\n      const paths = sampleRoutePaths(links, cap);\n      return { routes: abs(paths), source: \"homepage-links\", familyCounts: familyCountsOf(paths) };\n    }\n  }\n\n  return { routes: [new URL(\"/\", origin).href], source: \"root-only\", familyCounts: { \"/\": 1 } };\n}\n","import type { AuditResult } from \"../types.js\";\nimport type { AuditContext } from \"./util/inject.js\";\nimport { siteLabel } from \"../util/site.js\";\nimport {\n  discoverRoutes,\n  familyCountsOf,\n  type DiscoverDeps,\n  type DiscoveredRoutes,\n} from \"./route-discovery.js\";\n\n/** One route probed across desktop engines + mobile devices, plus the internal links found on it. */\nexport type RouteResult = {\n  url: string;\n  /** Per desktop engine (chromium/firefox/webkit): loaded with no JS error + a visible main landmark. */\n  desktop: Array<{ engine: string; ok: boolean }>;\n  /** Per mobile device: loaded with no JS error and no horizontal overflow. */\n  mobile: Array<{ device: string; ok: boolean }>;\n  /** Same-origin links discovered on the page (absolute URLs), for the Links check. */\n  links: string[];\n};\n\nexport type LinkResult = { url: string; status: number | null };\n\n/** Injected browser IO. The real impl drives Playwright; tests pass a fake. */\nexport type BrowserRunner = {\n  probe: (urls: string[]) => Promise<RouteResult[]>;\n  checkLinks: (urls: string[]) => Promise<LinkResult[]>;\n  close?: () => Promise<void>;\n};\n\nexport type BrowserSummary = {\n  desktopOk: boolean;\n  mobileOk: boolean;\n  linksOk: boolean;\n  brokenLinks: number;\n  routesChecked: number;\n  note: string;\n};\n\n/** A link status counts as broken when it didn't return a 2xx/3xx (null = unreachable). */\nfunction isBroken(status: number | null): boolean {\n  return status === null || status >= 400;\n}\n\n/**\n * Reduce raw per-route observations to the three checklist verdicts. PURE.\n * - desktopOk: EVERY route loaded cleanly in EVERY desktop engine.\n * - mobileOk: EVERY route loaded cleanly (no overflow / error) on EVERY mobile device.\n * - linksOk: NO internal link is broken.\n * Empty observations (a probe that produced nothing) → not ok (fail-safe: prove, don't assume).\n */\nexport function summarizeBrowser(\n  routes: RouteResult[],\n  links: LinkResult[],\n  familyCounts: Record<string, number>,\n): BrowserSummary {\n  const desktopChecks = routes.flatMap((r) => r.desktop);\n  const mobileChecks = routes.flatMap((r) => r.mobile);\n  // Per-route completeness: EVERY route must carry observations AND every observation must be ok.\n  // (Guarding only the flattened array would excuse a route that produced no observations at all —\n  // a false green.) A route with an empty desktop[]/mobile[] (never rendered) → not ok.\n  const desktopOk =\n    routes.length > 0 && routes.every((r) => r.desktop.length > 0 && r.desktop.every((d) => d.ok));\n  const mobileOk =\n    routes.length > 0 && routes.every((r) => r.mobile.length > 0 && r.mobile.every((m) => m.ok));\n  const brokenLinks = links.filter((l) => isBroken(l.status)).length;\n  // linksOk requires links to have ACTUALLY been checked — zero links checked is \"not proven\",\n  // never a pass (e.g. a JS-rendered page whose hrefs weren't in the DOM, or a chromium evaluate\n  // that threw → []). Otherwise the box would assert \"all links resolve\" having checked nothing.\n  const linksOk = links.length > 0 && brokenLinks === 0;\n\n  const engines = [...new Set(desktopChecks.map((d) => d.engine))];\n  const devices = [...new Set(mobileChecks.map((m) => m.device))];\n  const families = Object.entries(familyCounts)\n    .map(([f, n]) => (f === \"/\" ? \"/\" : `${f} ×${n}`))\n    .join(\", \");\n  const note =\n    `${routes.length} routes (${families}); ` +\n    `desktop ${engines.join(\"/\") || \"—\"}; mobile ${devices.join(\"/\") || \"—\"}; ` +\n    `${links.length} links, ${brokenLinks} broken`;\n\n  return { desktopOk, mobileOk, linksOk, brokenLinks, routesChecked: routes.length, note };\n}\n\n/**\n * Deployed-URL browser audit: discovers a representative route set (incl. CMS templates), probes\n * each across desktop engines + mobile devices, and checks internal links — all against the LIVE\n * url (checkout-free). Skips a site with no deployed URL. Produces ONE AuditResult whose details\n * carry the three verdicts (Crossbrowser / Mobile / Links); the Airtable layer fans them out and\n * the auto-tick rule gates each on freshness.\n */\nexport async function browserAudit(ctx: AuditContext): Promise<AuditResult> {\n  const { site } = ctx;\n  const label = siteLabel(site);\n  if (!site.deployedUrl) {\n    return { audit: \"browser\", site: label, status: \"skip\", summary: \"no deployed URL\" };\n  }\n  const now = ctx.now ?? new Date();\n  const discoverDeps = ctx.discoverDeps ?? defaultDiscoverDeps();\n  const runner = ctx.browserRunner ?? (await defaultBrowserRunner());\n  try {\n    const discovered: DiscoveredRoutes = await discoverRoutes(site.deployedUrl, discoverDeps);\n    const routeResults = await runner.probe(discovered.routes);\n    const internalLinks = [...new Set(routeResults.flatMap((r) => r.links))];\n    const linkResults = await runner.checkLinks(internalLinks);\n    const summary = summarizeBrowser(\n      routeResults,\n      linkResults,\n      discovered.familyCounts ?? familyCountsOf(discovered.routes),\n    );\n    const status: AuditResult[\"status\"] =\n      summary.desktopOk && summary.mobileOk && summary.linksOk ? \"pass\" : \"warn\";\n    return {\n      audit: \"browser\",\n      site: label,\n      status,\n      summary: summary.note,\n      details: { ...summary, checkedAt: now.toISOString() },\n    };\n  } finally {\n    await runner.close?.();\n  }\n}\n\n/** Bound the plain fetch()es (route-discovery GET + link HEAD/GET) so a host that hangs\n *  WITHOUT erroring can't stall the sequential fleet audit indefinitely. Playwright's\n *  page.goto already has PAGE_TIMEOUT_MS; these fetches had no ceiling. On abort the existing\n *  catch path treats it exactly like a network error (→ null), so a slow host degrades, never throws. */\nconst FETCH_TIMEOUT_MS = 10_000;\n\n/** Real route-discovery fetch: GET text, null on any non-2xx / error / timeout. */\nexport function defaultDiscoverDeps(): DiscoverDeps {\n  return {\n    fetchText: async (url) => {\n      try {\n        const res = await fetch(url, {\n          redirect: \"follow\",\n          signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),\n        });\n        if (!res.ok) return null;\n        return await res.text();\n      } catch {\n        return null;\n      }\n    },\n  };\n}\n\nconst DESKTOP_VIEWPORT = { width: 1366, height: 900 };\nconst PAGE_TIMEOUT_MS = 30_000;\n\n/**\n * Real Playwright runner. Launches chromium/firefox/webkit (desktop) + mobile-emulated chromium &\n * webkit, probes each route, and HEAD/GET-checks internal links. Every failure degrades to a\n * `false`/`null` (never throws past the audit), so a flaky run yields a non-pass (→ the box stays\n * manual) rather than a false green. Imported lazily so unit tests (which inject a fake runner)\n * never load Playwright.\n */\nexport async function defaultBrowserRunner(): Promise<BrowserRunner> {\n  const { chromium, firefox, webkit, devices } = await import(\"@playwright/test\");\n  const desktopEngines = [\n    { engine: \"chromium\", type: chromium },\n    { engine: \"firefox\", type: firefox },\n    { engine: \"webkit\", type: webkit },\n  ];\n  const mobileTargets = [\n    { device: \"Pixel 7\", descriptor: devices[\"Pixel 7\"] },\n    { device: \"iPhone 14\", descriptor: devices[\"iPhone 14\"] },\n  ];\n\n  return {\n    async probe(urls) {\n      const results: RouteResult[] = [];\n      const browsers = await Promise.all(desktopEngines.map((e) => e.type.launch()));\n      const mobileBrowsers = await Promise.all(mobileTargets.map(() => chromium.launch()));\n      try {\n        for (const url of urls) {\n          const desktop: RouteResult[\"desktop\"] = [];\n          const linkSet = new Set<string>();\n          for (let i = 0; i < desktopEngines.length; i++) {\n            const engine = desktopEngines[i]!.engine;\n            const browser = browsers[i]!;\n            const ctx = await browser.newContext({ viewport: DESKTOP_VIEWPORT });\n            const page = await ctx.newPage();\n            const errors: string[] = [];\n            page.on(\"pageerror\", (e) => errors.push(String(e)));\n            let ok = false;\n            try {\n              const resp = await page.goto(url, {\n                waitUntil: \"domcontentloaded\",\n                timeout: PAGE_TIMEOUT_MS,\n              });\n              const hasMain = await page\n                .locator(\"main, [role=main]\")\n                .first()\n                .isVisible()\n                .catch(() => false);\n              ok = !!resp && resp.ok() && errors.length === 0 && hasMain;\n              if (engine === \"chromium\") {\n                // Link discovery runs on chromium only (cost). Links coverage therefore depends on\n                // chromium loading this route + the evaluate succeeding; if it yields nothing, the\n                // Links verdict is \"not proven\" (links.length===0 ⇒ linksOk false), never a pass.\n                // String-form evaluate so the browser-context code isn't type-checked against the\n                // Node lib (no DOM globals in this project's tsconfig). Returns absolute hrefs.\n                const hrefs = (await page\n                  .evaluate(\"Array.from(document.querySelectorAll('a[href]')).map((a) => a.href)\")\n                  .catch(() => [])) as string[];\n                const origin = new URL(url).origin;\n                for (const h of hrefs) {\n                  try {\n                    if (new URL(h).origin === origin) linkSet.add(new URL(h).href);\n                  } catch {\n                    /* skip */\n                  }\n                }\n              }\n            } catch {\n              ok = false;\n            } finally {\n              await ctx.close().catch(() => {});\n            }\n            desktop.push({ engine, ok });\n          }\n\n          const mobile: RouteResult[\"mobile\"] = [];\n          for (let i = 0; i < mobileTargets.length; i++) {\n            const { device, descriptor } = mobileTargets[i]!;\n            const browser = mobileBrowsers[i]!;\n            const ctx = await browser.newContext({ ...descriptor });\n            const page = await ctx.newPage();\n            const errors: string[] = [];\n            page.on(\"pageerror\", (e) => errors.push(String(e)));\n            let ok = false;\n            try {\n              const resp = await page.goto(url, {\n                waitUntil: \"domcontentloaded\",\n                timeout: PAGE_TIMEOUT_MS,\n              });\n              const overflow = (await page\n                .evaluate(\"document.documentElement.scrollWidth > window.innerWidth + 2\")\n                .catch(() => true)) as boolean;\n              ok = !!resp && resp.ok() && errors.length === 0 && !overflow;\n            } catch {\n              ok = false;\n            } finally {\n              await ctx.close().catch(() => {});\n            }\n            mobile.push({ device, ok });\n          }\n\n          results.push({ url, desktop, mobile, links: [...linkSet] });\n        }\n      } finally {\n        await Promise.all([...browsers, ...mobileBrowsers].map((b) => b.close().catch(() => {})));\n      }\n      return results;\n    },\n\n    async checkLinks(urls) {\n      const out: LinkResult[] = [];\n      for (const url of urls) {\n        let status: number | null;\n        try {\n          let res = await fetch(url, {\n            method: \"HEAD\",\n            redirect: \"follow\",\n            signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),\n          });\n          // Some servers reject HEAD (405/501) — retry GET before declaring it broken.\n          if (res.status === 405 || res.status === 501) {\n            res = await fetch(url, {\n              method: \"GET\",\n              redirect: \"follow\",\n              signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),\n            });\n          }\n          status = res.status;\n        } catch {\n          status = null;\n        }\n        out.push({ url, status });\n      }\n      return out;\n    },\n  };\n}\n","import type { AuditName, AuditResult, Site } from \"../types.js\";\nimport type { AuditContext } from \"./util/inject.js\";\nimport { defaultSpawn } from \"./util/spawn.js\";\nimport type { SpawnFn } from \"./util/spawn.js\";\nimport { depsAudit } from \"./deps.js\";\nimport { lintAudit } from \"./lint.js\";\nimport { securityAudit } from \"./security.js\";\nimport { lighthouseAudit } from \"./lighthouse.js\";\nimport { a11yAudit } from \"./a11y.js\";\nimport { domainAudit } from \"./domain.js\";\nimport { browserAudit } from \"./browser.js\";\n\nconst REGISTRY: Record<AuditName, (ctx: AuditContext) => Promise<AuditResult>> = {\n  deps: depsAudit,\n  lint: lintAudit,\n  security: securityAudit,\n  lighthouse: lighthouseAudit,\n  a11y: a11yAudit,\n  domain: domainAudit,\n  browser: browserAudit,\n};\n\nexport const ALL_AUDIT_NAMES = Object.keys(REGISTRY) as AuditName[];\n\n/** Default per-audit spawn timeout when running via runAudits (30 s). */\nconst DEFAULT_AUDIT_TIMEOUT_MS = 30_000;\n\nfunction timedSpawn(timeoutMs: number): SpawnFn {\n  return (cmd, args, opts = {}) =>\n    defaultSpawn(cmd, args, { ...opts, timeoutMs: opts.timeoutMs ?? timeoutMs });\n}\n\n/** Single-audit runner with the same error-to-result conversion that\n *  `runAudits` applies. Exposed so the CLI can wrap each audit in its\n *  own progress task (listr2) and surface per-audit completion timing,\n *  while keeping audit implementations UI-free. */\nexport async function runOneAudit(site: Site, name: AuditName): Promise<AuditResult> {\n  if (!(name in REGISTRY)) throw new Error(`unknown audit: ${name}`);\n  const spawn = timedSpawn(DEFAULT_AUDIT_TIMEOUT_MS);\n  // `||` not `??`: an empty-string slug (Airtable Name with no slug-able chars)\n  // must fall back to the path, not render a blank `AuditResult.site` that would\n  // then collapse fleet write-back grouping under the \"\" key.\n  const label = site.name || site.path;\n  try {\n    return await REGISTRY[name]({ site, spawn });\n  } catch (err) {\n    return {\n      audit: name,\n      site: label,\n      status: \"fail\",\n      summary: `${name}: unexpected error — ${String(err)}`,\n    };\n  }\n}\n\nexport async function runAudits(site: Site, which?: AuditName[]): Promise<AuditResult[]> {\n  const names = which ?? ALL_AUDIT_NAMES;\n  for (const n of names) {\n    if (!(n in REGISTRY)) throw new Error(`unknown audit: ${n}`);\n  }\n  return Promise.all(names.map((n) => runOneAudit(site, n)));\n}\n\nexport async function runAuditsAcross(sites: Site[], which?: AuditName[]): Promise<AuditResult[]> {\n  const all = await Promise.all(sites.map((s) => runAudits(s, which)));\n  return all.flat();\n}\n\nexport { depsAudit, lintAudit, securityAudit, lighthouseAudit, a11yAudit };\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA,SAAS,gBAAgB;AACzB,SAAS,QAAAA,aAAY;;;ACDrB,SAAS,YAAY;AACrB,SAAS,YAAY;AAQrB,eAAe,OAAO,MAAgC;AACpD,MAAI;AACF,UAAM,KAAK,IAAI;AACf,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,QAAQ,SAAyB;AACxC,QAAM,OAAO,QAAQ,QAAQ,UAAU,EAAE,EAAE,MAAM,GAAG,EAAE,CAAC,KAAK;AAC5D,QAAM,IAAI,OAAO,SAAS,MAAM,EAAE;AAClC,SAAO,OAAO,MAAM,CAAC,IAAI,IAAI;AAC/B;AAcA,eAAsB,aACpB,UACA,OACgC;AAChC,MAAI,CAAE,MAAM,OAAO,KAAK,UAAU,gBAAgB,CAAC,EAAI,QAAO;AAM9D,MAAI;AAKF,QAAI,CAAE,MAAM,OAAO,KAAK,UAAU,cAAc,CAAC,GAAI;AACnD,YAAM,UAAU,MAAM,MAAM,QAAQ,CAAC,WAAW,mBAAmB,GAAG;AAAA,QACpE,KAAK;AAAA,QACL,WAAW;AAAA,MACb,CAAC;AACD,UAAI,QAAQ,SAAS,EAAG,QAAO;AAAA,IACjC;AAIA,UAAM,MAAM,MAAM,MAAM,QAAQ,CAAC,YAAY,QAAQ,GAAG;AAAA,MACtD,KAAK;AAAA,MACL,WAAW;AAAA,IACb,CAAC;AACD,UAAM,SAAS,KAAK,MAAM,IAAI,UAAU,IAAI;AAI5C,UAAM,UAAU,OAAO,OAAO,MAAM;AACpC,WAAO;AAAA,MACL,UAAU,QAAQ;AAAA,MAClB,OAAO,QAAQ,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,QAAQ,EAAE,MAAM,IAAI,QAAQ,EAAE,OAAO,CAAC,EACzF;AAAA,IACL;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ADhDA,SAAS,WAAW,OAAuB;AACzC,SAAO,MAAM,QAAQ,UAAU,EAAE;AACnC;AAMA,SAAS,kBAAkB,MAAuB;AAChD,SAAO,YAAY,KAAK,KAAK,KAAK,CAAC;AACrC;AAEA,SAAS,YAAY,GAAqC;AACxD,QAAM,UAAU,WAAW,CAAC,EAAE,MAAM,GAAG,EAAE,CAAC,KAAK;AAC/C,QAAM,QAAQ,QAAQ,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,OAAO,SAAS,GAAG,EAAE,CAAC;AAClE,SAAO,CAAC,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;AACrD;AAEA,SAAS,cAAc,QAAgB,UAAyB;AAC9D,QAAM,CAAC,QAAQ,QAAQ,MAAM,IAAI,YAAY,MAAM;AACnD,QAAM,CAAC,QAAQ,QAAQ,MAAM,IAAI,YAAY,QAAQ;AACrD,MAAI,SAAS,OAAQ,QAAO;AAC5B,MAAI,SAAS,OAAQ,QAAO;AAC5B,MAAI,SAAS,OAAQ,QAAO;AAC5B,MAAI,SAAS,OAAQ,QAAO;AAC5B,MAAI,SAAS,OAAQ,QAAO;AAC5B,MAAI,SAAS,OAAQ,QAAO;AAC5B,SAAO;AACT;AAEA,eAAsB,UAAU,KAAyC;AACvE,QAAM,UAAUC,MAAK,IAAI,KAAK,MAAM,cAAc;AAClD,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,SAAS,SAAS,OAAO;AAAA,EAC1C,SAAS,KAAK;AACZ,WAAO;AAAA,MACL,OAAO;AAAA,MACP,MAAM,UAAU,IAAI,IAAI;AAAA,MACxB,QAAQ;AAAA,MACR,SAAS,sBAAsB,OAAO;AAAA,MACtC,SAAS,EAAE,OAAO,OAAO,GAAG,EAAE;AAAA,IAChC;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,UAAM,KAAK,MAAM,MAAM;AAAA,EAIzB,SAAS,KAAK;AACZ,WAAO;AAAA,MACL,OAAO;AAAA,MACP,MAAM,UAAU,IAAI,IAAI;AAAA,MACxB,QAAQ;AAAA,MACR,SAAS,mCAAoC,IAAc,OAAO;AAAA,MAClE,SAAS,EAAE,OAAO,OAAO,GAAG,EAAE;AAAA,IAChC;AAAA,EACF;AACA,QAAM,YAAoC;AAAA,IACxC,GAAI,IAAI,gBAAgB,CAAC;AAAA,IACzB,GAAI,IAAI,mBAAmB,CAAC;AAAA,EAC9B;AAEA,QAAM,UAA4B,CAAC;AACnC,aAAW,CAAC,MAAM,QAAQ,KAAK,OAAO,QAAQ,gBAAgB,GAAG;AAC/D,UAAM,SAAS,UAAU,IAAI;AAC7B,QAAI,CAAC,OAAQ;AAGb,QAAI,CAAC,kBAAkB,MAAM,EAAG;AAChC,YAAQ,KAAK;AAAA,MACX,KAAK;AAAA,MACL;AAAA,MACA;AAAA,MACA,OAAO,cAAc,QAAQ,QAAQ;AAAA,IACvC,CAAC;AAAA,EACH;AAEA,QAAM,WAAW,QAAQ,KAAK,CAAC,MAAM,EAAE,UAAU,OAAO;AACxD,QAAM,WAAW,QAAQ,KAAK,CAAC,MAAM,EAAE,UAAU,OAAO;AACxD,QAAM,WAAW,QAAQ,KAAK,CAAC,MAAM,EAAE,UAAU,OAAO;AAIxD,QAAM,SAAgC,WAAW,SAAS,YAAY,WAAW,SAAS;AAE1F,QAAM,eACJ,WAAW,SACP,OAAO,QAAQ,MAAM,wCACrB,WAAW,SACT,GAAG,QAAQ,OAAO,CAAC,MAAM,EAAE,UAAU,MAAM,EAAE,MAAM,OAAO,QAAQ,MAAM,0BACxE,GAAG,QAAQ,OAAO,CAAC,MAAM,EAAE,UAAU,OAAO,EAAE,MAAM;AAE5D,QAAM,WAAW,MAAM,aAAa,IAAI,KAAK,MAAM,IAAI,SAAS,YAAY;AAC5E,QAAM,UAAU,WACZ,GAAG,YAAY,KAAK,SAAS,QAAQ,yBAAyB,SAAS,KAAK,YAC5E;AAEJ,SAAO;AAAA,IACL,OAAO;AAAA,IACP,MAAM,UAAU,IAAI,IAAI;AAAA,IACxB;AAAA,IACA;AAAA,IACA,SAAS,EAAE,SAAS,SAAS;AAAA,EAC/B;AACF;;;AEzIA,SAAS,kBAAkB;AAC3B,SAAS,YAAAC,iBAAgB;AACzB,SAAS,QAAAC,aAAY;AACrB,SAAS,cAAc;AACvB,SAAS,SAAS,eAAe,iBAAiB,6BAA6B;AAC/E,SAAS,YAAY;AAKrB,IAAM,eAAe,CAAC,qBAAqB;AAC3C,IAAM,SAAS,CAAC,mBAAmB,WAAW,kBAAkB,YAAY,aAAa;AAEzF,eAAe,UAAU,KAAgC;AACvD,SAAO,KAAK,cAAc,EAAE,KAAK,QAAQ,QAAQ,UAAU,MAAM,CAAC;AACpE;AAEA,eAAsB,UAAU,KAAyC;AACvE,QAAM,EAAE,KAAK,IAAI;AACjB,QAAM,aAAaC,MAAK,KAAK,MAAM,kBAAkB;AAErD,MAAI,CAAC,WAAW,UAAU,GAAG;AAC3B,WAAO;AAAA,MACL,OAAO;AAAA,MACP,MAAM,UAAU,IAAI;AAAA,MACpB,QAAQ;AAAA,MACR,SAAS;AAAA,IACX;AAAA,EACF;AAEA,QAAM,SAAS,IAAI,OAAO;AAAA,IACxB,KAAK,KAAK;AAAA,IACV,oBAAoB;AAAA,IACpB,yBAAyB;AAAA,EAC3B,CAAC;AAED,QAAM,WAAW,MAAM,UAAU,KAAK,IAAI;AAI1C,QAAM,gBAAgB,MAAM,OAAO,UAAU,QAAQ;AACrD,QAAM,eAAe,cAAc,OAAO,CAAC,GAAG,MAAM,IAAI,EAAE,YAAY,CAAC;AACvE,QAAM,iBAAiB,cAAc,OAAO,CAAC,GAAG,MAAM,IAAI,EAAE,cAAc,CAAC;AAE3E,QAAM,sBAAgC,CAAC;AACvC,aAAW,OAAO,UAAU;AAC1B,UAAM,gBAAgBA,MAAK,KAAK,MAAM,GAAG;AACzC,UAAM,SAAS,MAAMC,UAAS,eAAe,OAAO;AACpD,UAAM,UAAW,MAAM,sBAAsB,aAAa,KAAM,CAAC;AACjE,UAAM,KAAK,MAAM,cAAc,QAAQ,EAAE,GAAG,SAAS,UAAU,cAAc,CAAC;AAC9E,QAAI,CAAC,GAAI,qBAAoB,KAAK,GAAG;AAAA,EACvC;AAEA,QAAM,SACJ,eAAe,KAAK,oBAAoB,SAAS,IAC7C,SACA,iBAAiB,IACf,SACA;AAER,QAAM,UACJ,WAAW,SACP,qBAAqB,SAAS,MAAM,WACpC,GAAG,YAAY,mBAAmB,cAAc,cAAc,oBAAoB,MAAM;AAE9F,SAAO;AAAA,IACL,OAAO;AAAA,IACP,MAAM,UAAU,IAAI;AAAA,IACpB;AAAA,IACA;AAAA,IACA,SAAS;AAAA,MACP;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,SAAS;AAAA,IAClB;AAAA,EACF;AACF;;;AC9BA,SAAS,SAAS,GAAW;AAC3B,MAAI,EAAE,WAAW,KAAK,EAAE,OAAO,EAAG,QAAO;AACzC,MAAI,EAAE,WAAW,KAAK,EAAE,MAAM,EAAG,QAAO;AACxC,SAAO;AACT;AAEA,SAAS,kBAAkB,GAAsB;AAC/C,MAAI,MAAM,SAAS,MAAM,cAAc,MAAM,UAAU,MAAM,WAAY,QAAO;AAGhF,SAAO;AACT;AAEA,SAAS,0BAA0B,QAAwC;AACzE,QAAM,MAAuB,CAAC;AAC9B,aAAW,KAAK,OAAO,OAAO,OAAO,cAAc,CAAC,CAAC,GAAG;AACtD,QAAI,CAAC,EAAG;AACR,QAAI,KAAK;AAAA,MACP,QAAQ,EAAE,eAAe;AAAA,MACzB,UAAU,kBAAkB,EAAE,QAAQ;AAAA,MACtC,OAAO,EAAE,SAAS;AAAA,MAClB,GAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;AAAA,MACjC,GAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC;AAAA,IAChC,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAKA,SAAS,uBACP,WACA,iBACiE;AACjE,QAAM,OAAO,oBAAI,IAAY;AAC7B,MAAI,UAAU;AACd,SAAO,CAAC,KAAK,IAAI,OAAO,GAAG;AACzB,SAAK,IAAI,OAAO;AAChB,UAAM,QAAQ,gBAAgB,OAAO;AACrC,QAAI,CAAC,SAAS,CAAC,MAAM,QAAQ,MAAM,GAAG,EAAG,QAAO,EAAE,UAAU,QAAQ;AAEpE,UAAM,WAAW,MAAM,IAAI;AAAA,MACzB,CAAC,MAA6C,OAAO,MAAM,YAAY,MAAM;AAAA,IAC/E;AACA,QAAI,SAAU,QAAO,EAAE,UAAU,SAAS,QAAQ,SAAS;AAE3D,UAAM,OAAO,MAAM,IAAI,KAAK,CAAC,MAAmB,OAAO,MAAM,QAAQ;AACrE,QAAI,CAAC,QAAQ,SAAS,QAAS,QAAO,EAAE,UAAU,QAAQ;AAC1D,cAAU;AAAA,EACZ;AACA,SAAO,EAAE,UAAU,QAAQ;AAC7B;AAEA,SAAS,yBAAyB,QAAuC;AACvE,QAAM,kBAAkB,OAAO,mBAAmB,CAAC;AACnD,QAAM,QAAQ,oBAAI,IAA2B;AAE7C,aAAW,CAAC,MAAM,CAAC,KAAK,OAAO,QAAQ,eAAe,GAAG;AACvD,QAAI,CAAC,EAAG;AACR,UAAM,EAAE,UAAU,OAAO,IAAI,uBAAuB,MAAM,eAAe;AACzE,QAAI,MAAM,IAAI,QAAQ,EAAG;AAEzB,UAAM,YAAY,gBAAgB,QAAQ;AAC1C,UAAM,WAAW,kBAAkB,WAAW,YAAY,EAAE,QAAQ;AACpE,UAAM,QAAQ,QAAQ,SAAS;AAC/B,UAAM,MAAM,QAAQ;AAEpB,UAAM,IAAI,UAAU;AAAA,MAClB,QAAQ,WAAW,QAAQ;AAAA,MAC3B;AAAA,MACA;AAAA,MACA,GAAI,MAAM,EAAE,IAAI,IAAI,CAAC;AAAA,IACvB,CAAC;AAAA,EACH;AAEA,SAAO,CAAC,GAAG,MAAM,OAAO,CAAC;AAC3B;AAOA,eAAe,aACb,OACA,KACA,MACA,KACqB;AACrB,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,MAAM,KAAK,MAAM,EAAE,IAAI,CAAC;AAAA,EACtC,SAAS,KAAK;AACZ,UAAM,IAAI;AACV,QAAI,EAAE,SAAS,YAAY,SAAS,KAAK,OAAO,GAAG,CAAC,EAAG,QAAO,EAAE,MAAM,UAAU;AAChF,WAAO,EAAE,MAAM,SAAS,QAAQ,iBAAiB,OAAO,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC,GAAG;AAAA,EAC/E;AAGA,MAAI,IAAI,SAAS,KAAK,IAAI,SAAS,GAAG;AACpC,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ,QAAQ,IAAI,IAAI,GAAG,IAAI,SAAS,KAAK,IAAI,OAAO,MAAM,GAAG,GAAG,CAAC,KAAK,EAAE;AAAA,IAC9E;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,IAAI,UAAU,IAAI;AAAA,EACxC,SAAS,KAAK;AACZ,WAAO,EAAE,MAAM,SAAS,QAAQ,qBAAqB,OAAO,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC,GAAG;AAAA,EACnF;AAIA,QAAM,cAAe,OAAoD;AACzE,MAAI,eAAe,OAAO,gBAAgB,UAAU;AAClD,WAAO,EAAE,MAAM,SAAS,QAAQ,YAAY,QAAQ,0BAA0B;AAAA,EAChF;AAMA,QAAM,YAAY,OAAO,UAAU;AACnC,MAAI,CAAC,aAAa,OAAO,KAAK,SAAS,EAAE,WAAW,GAAG;AACrD,WAAO,EAAE,MAAM,SAAS,QAAQ,wCAAwC;AAAA,EAC1E;AAEA,SAAO,EAAE,MAAM,MAAM,OAAO;AAC9B;AAEA,eAAsB,cAAc,KAAyC;AAC3E,QAAM,QAAQ,IAAI,SAAS;AAC3B,QAAM,OAAO,IAAI;AACjB,QAAM,QAAQ,UAAU,IAAI;AAE5B,MAAI,OAAmC;AACvC,MAAI,SAAS,MAAM,aAAa,OAAO,QAAQ,CAAC,SAAS,UAAU,QAAQ,GAAG,KAAK,IAAI;AAMvF,MAAI,OAAO,SAAS,MAAM;AACxB,UAAM,aAAa,OAAO,SAAS,YAAY,kBAAkB,OAAO;AACxE,UAAM,YAAY,MAAM;AAAA,MACtB;AAAA,MACA;AAAA,MACA,CAAC,SAAS,UAAU,YAAY;AAAA,MAChC,KAAK;AAAA,IACP;AACA,QAAI,UAAU,SAAS,MAAM;AAC3B,eAAS;AACT,aAAO;AAAA,IACT,OAAO;AACL,YAAM,YAAY,UAAU,SAAS,YAAY,kBAAkB,UAAU;AAC7E,aAAO;AAAA,QACL,OAAO;AAAA,QACP,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,SAAS,iCAA4B,UAAU,UAAU,SAAS;AAAA,MACpE;AAAA,IACF;AAAA,EACF;AAEA,QAAM,SAAS,OAAO;AAEtB,QAAM,SAAiB;AAAA,IACrB,KAAK,OAAO,UAAU,iBAAiB,OAAO;AAAA,IAC9C,UAAU,OAAO,UAAU,iBAAiB,YAAY;AAAA,IACxD,MAAM,OAAO,UAAU,iBAAiB,QAAQ;AAAA,IAChD,UAAU,OAAO,UAAU,iBAAiB,YAAY;AAAA,EAC1D;AAEA,QAAM,aACJ,SAAS,eAAe,0BAA0B,MAAM,IAAI,yBAAyB,MAAM;AAE7F,QAAM,SAAS,SAAS,MAAM;AAC9B,QAAM,QAAQ,OAAO,MAAM,OAAO,WAAW,OAAO,OAAO,OAAO;AAClE,QAAM,UACJ,WAAW,SACP,GAAG,IAAI,wBACP,GAAG,IAAI,KAAK,KAAK,qBAAqB,OAAO,QAAQ,KAAK,OAAO,IAAI,KAAK,OAAO,QAAQ,KAAK,OAAO,GAAG;AAE9G,SAAO;AAAA,IACL,OAAO;AAAA,IACP,MAAM;AAAA,IACN;AAAA,IACA;AAAA,IACA,SAAS,EAAE,QAAQ,WAAW;AAAA,EAChC;AACF;;;AChPA,SAAS,YAAAC,WAAU,WAAW,SAAS,IAAI,eAAe;AAC1D,SAAS,cAAc;AACvB,SAAS,QAAAC,aAAY;;;ACFrB,SAAS,YAAAC,iBAAgB;AACzB,SAAS,QAAAC,aAAY;AAarB,eAAsB,eAAe,UAAuC;AAC1E,MAAI;AACJ,MAAI;AACF,UAAM,MAAMD,UAASC,MAAK,UAAU,cAAc,GAAG,OAAO;AAAA,EAC9D,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACA,MAAI;AACJ,MAAI;AACF,UAAM,KAAK,MAAM,GAAG;AAAA,EACtB,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACA,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO,CAAC;AAC7C,QAAM,MAAO,IAA8B;AAC3C,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO,CAAC;AAE7C,QAAM,MAAkB,CAAC;AACzB,QAAM,MAAO,IAAoC;AACjD,MAAI,OAAO,QAAQ,YAAY,IAAI,SAAS,GAAG;AAC7C,QAAI,gBAAgB;AAAA,EACtB;AACA,SAAO;AACT;;;ACrCA,SAAS,oBAAoB;AAuB7B,eAAsB,eAAgC;AACpD,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAM,SAAS,aAAa;AAC5B,WAAO,MAAM;AACb,WAAO,GAAG,SAAS,MAAM;AACzB,WAAO,OAAO,GAAG,aAAa,MAAM;AAClC,YAAM,OAAO,OAAO,QAAQ;AAC5B,UAAI,OAAO,SAAS,YAAY,MAAM;AACpC,cAAM,OAAO,KAAK;AAClB,eAAO,MAAM,MAAM,QAAQ,IAAI,CAAC;AAAA,MAClC,OAAO;AACL,eAAO,MAAM;AACb,eAAO,IAAI,MAAM,6DAA6D,CAAC;AAAA,MACjF;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AACH;AAOO,SAAS,aAAa,KAAa,MAAsB;AAC9D,QAAM,IAAI,IAAI,IAAI,GAAG;AACrB,IAAE,WAAW;AACb,IAAE,OAAO,OAAO,IAAI;AACpB,SAAO,EAAE,SAAS;AACpB;;;AFfA,eAAe,cAAiB,MAAiC;AAC/D,MAAI;AACF,UAAM,MAAM,MAAMC,UAAS,MAAM,OAAO;AACxC,WAAO,KAAK,MAAM,GAAG;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAeA,eAAe,eAAe,YAA8C;AAC1E,QAAM,QAAQ,MAAM,QAAQ,UAAU,EAAE,MAAM,MAAM,CAAC,CAAa;AAClE,QAAM,UAA2B,CAAC;AAClC,aAAW,KAAK,OAAO;AACrB,QAAI,CAAC,EAAE,WAAW,MAAM,KAAK,CAAC,EAAE,SAAS,OAAO,EAAG;AACnD,UAAM,MAAM,MAAM,cAAuBC,MAAK,YAAY,CAAC,CAAC;AAC5D,QAAI,CAAC,OAAO,CAAC,IAAI,WAAY;AAC7B,UAAM,UAAkC,CAAC;AACzC,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,IAAI,UAAU,GAAG;AACnD,UAAI,OAAO,GAAG,UAAU,SAAU,SAAQ,CAAC,IAAI,EAAE;AAAA,IACnD;AACA,YAAQ,KAAK,EAAE,KAAK,IAAI,cAAc,QAAQ,CAAC;AAAA,EACjD;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,SAAkD;AAC1E,MAAI,QAAQ,WAAW,EAAG,QAAO,CAAC;AAClC,QAAM,OAA+B,CAAC;AACtC,QAAM,SAAiC,CAAC;AACxC,aAAW,KAAK,SAAS;AACvB,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,EAAE,WAAW,CAAC,CAAC,GAAG;AACpD,UAAI,OAAO,MAAM,SAAU;AAC3B,WAAK,CAAC,KAAK,KAAK,CAAC,KAAK,KAAK;AAC3B,aAAO,CAAC,KAAK,OAAO,CAAC,KAAK,KAAK;AAAA,IACjC;AAAA,EACF;AACA,QAAM,MAA8B,CAAC;AACrC,aAAW,KAAK,OAAO,KAAK,IAAI,GAAG;AACjC,UAAM,QAAQ,KAAK,CAAC,KAAK;AACzB,UAAM,QAAQ,OAAO,CAAC,KAAK;AAC3B,QAAI,CAAC,IAAI,QAAQ;AAAA,EACnB;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,GAA4B;AAEzD,QAAM,WAAW,EAAE,KAAK,QAAQ,GAAG;AACnC,SAAO,YAAY,IAAI,EAAE,KAAK,MAAM,WAAW,CAAC,IAAI,EAAE;AACxD;AAEA,SAAS,oBAAoB,GAA4B;AAIvD,QAAM,SAAS,OAAO,EAAE,WAAW,WAAW,EAAE,OAAO,QAAQ,CAAC,IAAI;AACpE,SAAO,GAAG,EAAE,IAAI,IAAI,EAAE,QAAQ,IAAI,EAAE,QAAQ,aAAa,MAAM;AACjE;AAIA,eAAe,iBACb,YACA,OACA,KACsB;AACtB,QAAM,WAAW,MAAM,eAAe,UAAU;AAEhD,MAAI,SAAS,WAAW,GAAG;AACzB,WAAO;AAAA,MACL,OAAO;AAAA,MACP,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,SAAS,2CAA2C,IAAI,IAAI,IAC1D,IAAI,SAAS,WAAM,IAAI,OAAO,MAAM,GAAG,GAAG,CAAC,KAAK,EAClD;AAAA,IACF;AAAA,EACF;AAEA,QAAM,mBACH,MAAM,cAAiCA,MAAK,YAAY,wBAAwB,CAAC,KAAM,CAAC;AAE3F,QAAM,SAAS,iBAAiB,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM;AACvD,QAAM,aAAa,OAAO,IAAI,CAAC,OAAO;AAAA,IACpC,UAAU,sBAAsB,CAAC;AAAA,IACjC,OAAO,EAAE;AAAA,IACT,SAAS,oBAAoB,CAAC;AAAA,EAChC,EAAE;AAEF,QAAM,WAAW,WAAW,KAAK,CAAC,MAAM,EAAE,UAAU,OAAO;AAC3D,QAAM,UAAU,WAAW,KAAK,CAAC,MAAM,EAAE,UAAU,MAAM;AACzD,QAAM,SAAgC,WAAW,SAAS,UAAU,SAAS;AAE7E,QAAM,aAAmC;AAAA,IACvC,SAAS,iBAAiB,QAAQ;AAAA,IAClC,kBAAkB,OAAO;AAAA,IACzB;AAAA,EACF;AAEA,QAAM,UACJ,WAAW,SACP,uCACA,eAAe,OAAO,MAAM;AAElC,SAAO,EAAE,OAAO,cAAc,MAAM,OAAO,QAAQ,SAAS,SAAS,WAAW;AAClF;AAIA,eAAe,mBAAmB,OAAgB,MAAY,OAAqC;AACjG,QAAM,UAAU,MAAM,eAAe,KAAK,IAAI;AAI9C,QAAM,OAAO,MAAM,aAAa;AAChC,QAAM,UAAU,QAAQ,iBAAiB,iBAAiB,GAAG,QAAQ,IAAI,CAAC;AAC1E,QAAM,iBAAiB;AAAA,IACrB,GAAG;AAAA,IACH,IAAI;AAAA,MACF,GAAG,iBAAiB;AAAA,MACpB,SAAS;AAAA,QACP,GAAG,iBAAiB,GAAG;AAAA,QACvB,KAAK,CAAC,aAAa,SAAS,IAAI,CAAC;AAAA,QACjC,oBAAoB,8BAA8B,IAAI;AAAA,MACxD;AAAA,IACF;AAAA,EACF;AAEA,QAAM,YAAY,MAAM,QAAQA,MAAK,OAAO,GAAG,eAAe,CAAC;AAC/D,QAAM,aAAaA,MAAK,WAAW,mBAAmB;AACtD,QAAM,UAAU,YAAY,KAAK,UAAU,cAAc,GAAG,OAAO;AAEnE,QAAM,aAAaA,MAAK,KAAK,MAAM,eAAe;AAClD,QAAM,GAAG,YAAY,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAErD,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,MAAM,OAAO,CAAC,SAAS,aAAa,WAAW,YAAY,UAAU,EAAE,GAAG;AAAA,MACpF,KAAK,KAAK;AAAA,MACV,WAAW,IAAI;AAAA,IACjB,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,GAAG,WAAW,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AACpD,UAAM,IAAI;AACV,QAAI,EAAE,SAAS,YAAY,SAAS,KAAK,OAAO,GAAG,CAAC,GAAG;AACrD,aAAO;AAAA,QACL,OAAO;AAAA,QACP,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,SAAS;AAAA,MACX;AAAA,IACF;AACA,UAAM;AAAA,EACR;AACA,QAAM,GAAG,WAAW,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAEpD,SAAO,iBAAiB,YAAY,OAAO,GAAG;AAChD;AAKA,eAAe,mBACb,OACA,aACA,OACsB;AACtB,QAAM,UAAU,MAAM,QAAQA,MAAK,OAAO,GAAG,sBAAsB,CAAC;AACpE,QAAM,iBAAiB;AAAA,IACrB,IAAI;AAAA;AAAA;AAAA,MAGF,SAAS;AAAA,QACP,KAAK,CAAC,WAAW;AAAA;AAAA;AAAA,QAGjB,cAAc;AAAA,QACd,UAAU,EAAE,QAAQ,WAAW,YAAY,CAAC,YAAY,EAAE;AAAA,MAC5D;AAAA,MACA,QAAQ,iBAAiB,GAAG;AAAA,MAC5B,QAAQ,EAAE,QAAQ,cAAc,WAAWA,MAAK,SAAS,aAAa,EAAE;AAAA,IAC1E;AAAA,EACF;AAEA,QAAM,aAAaA,MAAK,SAAS,mBAAmB;AACpD,QAAM,UAAU,YAAY,KAAK,UAAU,cAAc,GAAG,OAAO;AAEnE,QAAM,aAAaA,MAAK,SAAS,eAAe;AAEhD,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,MAAM,OAAO,CAAC,SAAS,aAAa,WAAW,YAAY,UAAU,EAAE,GAAG;AAAA,MACpF,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAML,WAAW,IAAI;AAAA,IACjB,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,GAAG,SAAS,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAClD,UAAM,IAAI;AACV,QAAI,EAAE,SAAS,YAAY,SAAS,KAAK,OAAO,GAAG,CAAC,GAAG;AACrD,aAAO;AAAA,QACL,OAAO;AAAA,QACP,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,SAAS;AAAA,MACX;AAAA,IACF;AACA,UAAM;AAAA,EACR;AAEA,MAAI;AACF,WAAO,MAAM,iBAAiB,YAAY,OAAO,GAAG;AAAA,EACtD,UAAE;AACA,UAAM,GAAG,SAAS,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EACpD;AACF;AAEA,eAAsB,gBAAgB,KAAyC;AAC7E,QAAM,QAAQ,IAAI,SAAS;AAC3B,QAAM,OAAO,IAAI;AACjB,QAAM,QAAQ,UAAU,IAAI;AAE5B,SAAO,KAAK,cACR,mBAAmB,OAAO,KAAK,aAAa,KAAK,IACjD,mBAAmB,OAAO,MAAM,KAAK;AAC3C;;;AGtRA,SAAS,YAAAC,WAAU,aAAAC,YAAW,WAAAC,UAAS,MAAAC,WAAU;AACjD,SAAS,QAAAC,aAAY;AAyBrB,IAAM,cAAc;AAEpB,eAAeC,eAAiB,MAAiC;AAC/D,MAAI;AACF,UAAM,MAAM,MAAMC,UAAS,MAAM,OAAO;AACxC,WAAO,KAAK,MAAM,GAAG;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAOA,SAAS,sBAAsB,MAAc,UAA0B;AACrE,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iCAUwB,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,2CAWM,IAAI;AAAA,6BAClB,IAAI;AAAA,WACtB,KAAK,UAAU,QAAQ,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAMnC;AAOA,SAAS,YAAoB;AAC3B,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA,gBAKO,KAAK,UAAU,UAAU,CAAC;AAAA,qBACrB,KAAK,UAAU,WAAW,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA8EhD;AAEA,eAAsB,UAAU,KAAyC;AACvE,QAAM,QAAQ,IAAI,SAAS;AAC3B,QAAM,OAAO,IAAI;AACjB,QAAM,QAAQ,UAAU,IAAI;AAQ5B,QAAM,UAAU,MAAMC,SAAQC,MAAK,KAAK,MAAM,qBAAqB,CAAC;AAMpE,MAAI;AACF,UAAM,WAAWA,MAAK,SAAS,cAAc;AAC7C,UAAMC,WAAU,UAAU,UAAU,GAAG,OAAO;AAE9C,UAAM,OAAO,MAAM,aAAa;AAChC,UAAM,aAAaD,MAAK,SAAS,sBAAsB;AACvD,UAAMC,WAAU,YAAY,sBAAsB,MAAM,KAAK,IAAI,GAAG,OAAO;AAE3E,UAAM,cAAcD,MAAK,KAAK,MAAM,WAAW;AAE/C,UAAME,IAAGF,MAAK,KAAK,MAAM,eAAe,GAAG,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAE3E,QAAI;AACJ,QAAI;AACF,YAAM,MAAM;AAAA,QACV;AAAA,QACA,CAAC,SAAS,cAAc,QAAQ,YAAY,UAAU,IAAI,mBAAmB,QAAQ;AAAA,QACrF;AAAA,UACE,KAAK,KAAK;AAAA,UACV,KAAK,EAAE,GAAG,QAAQ,KAAK,qBAAqB,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA,UAKxD,WAAW,IAAI;AAAA,QACjB;AAAA,MACF;AAAA,IACF,SAAS,KAAK;AACZ,YAAM,IAAI;AACV,UAAI,EAAE,SAAS,YAAY,SAAS,KAAK,OAAO,GAAG,CAAC,GAAG;AACrD,eAAO;AAAA,UACL,OAAO;AAAA,UACP,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,SAAS;AAAA,QACX;AAAA,MACF;AACA,YAAM;AAAA,IACR;AAEA,UAAM,WAAW,MAAMH,eAA8B,WAAW;AAEhE,QAAI,CAAC,UAAU;AACb,aAAO;AAAA,QACL,OAAO;AAAA,QACP,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,SAAS,kCAAkC,IAAI,IAAI,IACjD,IAAI,SAAS,WAAM,IAAI,OAAO,MAAM,GAAG,GAAG,CAAC,KAAK,EAClD;AAAA,MACF;AAAA,IACF;AAEA,UAAM,cACH,SAAS,SAAS,WAAW,KAAK,MAAM,SAAS,SAAS,YAAY,KAAK;AAC9E,UAAM,SAAS,SAAS,kBAAkB;AAE1C,UAAM,SAAgC,aAAa,SAAS,SAAS,SAAS;AAC9E,UAAM,UACJ,WAAW,SACP,6BAA6B,WAAW,MAAM,aAAa,YAAY,MAAM,sBAC7E,SAAS,SAAS,eAAe;AAEvC,WAAO;AAAA,MACL,OAAO;AAAA,MACP,MAAM;AAAA,MACN;AAAA,MACA;AAAA,MACA,SAAS;AAAA,IACX;AAAA,EACF,UAAE;AACA,UAAMK,IAAG,SAAS,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EACpD;AACF;;;AChQA,SAAS,YAAY,mBAAmB;AACxC,OAAO,SAAS;AAqBhB,IAAM,aAAa,KAAK,KAAK,KAAK;AAOlC,eAAsB,YAAY,KAAa,MAAwC;AACrF,MAAI;AACJ,MAAI;AACF,WAAO,IAAI,IAAI,GAAG,EAAE;AAAA,EACtB,QAAQ;AACN,WAAO,EAAE,UAAU,OAAO,mBAAmB,KAAK;AAAA,EACpD;AACA,MAAI;AACF,UAAM,KAAK,OAAO,IAAI;AAAA,EACxB,QAAQ;AACN,WAAO,EAAE,UAAU,OAAO,mBAAmB,KAAK;AAAA,EACpD;AACA,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,KAAK,YAAY,IAAI;AAAA,EACvC,QAAQ;AACN,cAAU;AAAA,EACZ;AACA,MAAI,CAAC,WAAW,OAAO,MAAM,QAAQ,QAAQ,CAAC;AAC5C,WAAO,EAAE,UAAU,MAAM,mBAAmB,KAAK;AACnD,SAAO;AAAA,IACL,UAAU;AAAA,IACV,mBAAmB,KAAK,OAAO,QAAQ,QAAQ,IAAI,KAAK,IAAI,QAAQ,KAAK,UAAU;AAAA,EACrF;AACF;AAIO,SAAS,kBAAkB,KAAuB;AACvD,SAAO;AAAA,IACL,QAAQ,OAAO,SAAS;AACtB,YAAM,YAAY,OAAO,IAAI;AAAA,IAC/B;AAAA,IACA,aAAa,CAAC,SACZ,IAAI,QAAqB,CAAC,mBAAmB;AAM3C,YAAM,SAAS,IAAI;AAAA,QACjB,EAAE,MAAM,MAAM,KAAK,YAAY,MAAM,SAAS,KAAQ,oBAAoB,KAAK;AAAA,QAC/E,MAAM;AACJ,gBAAM,OAAO,OAAO,aAAa,OAAO,mBAAmB,IAAI;AAC/D,iBAAO,IAAI;AACX,gBAAM,UAAU,QAAQ,KAAK,WAAW,IAAI,KAAK,KAAK,QAAQ,IAAI;AAClE,yBAAe,OAAO;AAAA,QACxB;AAAA,MACF;AACA,aAAO,GAAG,SAAS,MAAM,eAAe,IAAI,CAAC;AAC7C,aAAO,GAAG,WAAW,MAAM;AACzB,eAAO,QAAQ;AACf,uBAAe,IAAI;AAAA,MACrB,CAAC;AAAA,IACH,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAOA,eAAsB,YAAY,KAAyC;AACzE,QAAM,EAAE,KAAK,IAAI;AACjB,QAAM,QAAQ,UAAU,IAAI;AAC5B,MAAI,CAAC,KAAK,aAAa;AACrB,WAAO,EAAE,OAAO,UAAU,MAAM,OAAO,QAAQ,QAAQ,SAAS,kBAAkB;AAAA,EACpF;AACA,QAAM,MAAM,IAAI,OAAO,oBAAI,KAAK;AAChC,QAAM,OAAO,IAAI,cAAc,kBAAkB,GAAG;AACpD,QAAM,QAAQ,MAAM,YAAY,KAAK,aAAa,IAAI;AACtD,QAAM,YAAY,IAAI,YAAY;AAClC,QAAM,SACJ,MAAM,YAAY,MAAM,sBAAsB,QAAQ,MAAM,oBAAoB,KAC5E,SACA;AACN,QAAM,UAAU,CAAC,MAAM,WACnB,oBACA,MAAM,sBAAsB,OAC1B,iCACA,kBAAkB,MAAM,iBAAiB;AAC/C,SAAO;AAAA,IACL,OAAO;AAAA,IACP,MAAM;AAAA,IACN;AAAA,IACA;AAAA,IACA,SAAS,EAAE,UAAU,MAAM,UAAU,mBAAmB,MAAM,mBAAmB,UAAU;AAAA,EAC7F;AACF;;;ACjGA,IAAM,cAAc;AAGb,SAAS,iBAAiB,KAAuB;AACtD,QAAM,MAAgB,CAAC;AACvB,QAAM,KAAK;AACX,MAAI;AACJ,UAAQ,IAAI,GAAG,KAAK,GAAG,OAAO,MAAM;AAClC,UAAM,MAAM,EAAE,CAAC;AACf,QAAI,IAAK,KAAI,KAAK,IAAI,KAAK,CAAC;AAAA,EAC9B;AACA,SAAO;AACT;AAIO,SAAS,eAAe,MAAc,SAA2B;AACtE,QAAM,MAAM,oBAAI,IAAY;AAC5B,QAAM,KAAK;AACX,MAAI;AACJ,UAAQ,IAAI,GAAG,KAAK,IAAI,OAAO,MAAM;AACnC,UAAM,OAAO,EAAE,CAAC;AAChB,QAAI,CAAC,QAAQ,KAAK,WAAW,GAAG,KAAK,+BAA+B,KAAK,IAAI,EAAG;AAChF,QAAI;AACF,YAAM,IAAI,IAAI,IAAI,MAAM,OAAO;AAC/B,UAAI,EAAE,WAAW,IAAI,IAAI,OAAO,EAAE,OAAQ;AAC1C,UAAI,IAAI,EAAE,QAAQ;AAAA,IACpB,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO,CAAC,GAAG,GAAG;AAChB;AAGA,SAAS,OAAO,UAA0B;AACxC,SAAO,SAAS,MAAM,GAAG,EAAE,OAAO,OAAO,EAAE,CAAC,KAAK;AACnD;AAQO,SAAS,iBAAiB,aAAuB,MAAc,aAAuB;AAC3F,QAAM,OAAO,oBAAI,IAAY,CAAC,GAAG,CAAC;AAClC,QAAM,UAAU,oBAAI,IAAsB;AAC1C,aAAW,OAAO,aAAa;AAC7B,QAAI;AACJ,QAAI;AACF,iBAAW,IAAI,WAAW,GAAG,IACzB,IAAI,IAAI,KAAK,mBAAmB,EAAE,WAClC,IAAI,IAAI,GAAG,EAAE;AAAA,IACnB,QAAQ;AACN;AAAA,IACF;AACA,QAAI,aAAa,IAAK;AACtB,QAAI,KAAK,IAAI,QAAQ,EAAG;AACxB,SAAK,IAAI,QAAQ;AACjB,UAAM,MAAM,OAAO,QAAQ;AAC3B,UAAM,MAAM,QAAQ,IAAI,GAAG,KAAK,CAAC;AACjC,QAAI,KAAK,QAAQ;AACjB,YAAQ,IAAI,KAAK,GAAG;AAAA,EACtB;AACA,QAAM,SAAS,CAAC,GAAG;AACnB,QAAM,WAAW,CAAC,GAAG,QAAQ,OAAO,CAAC;AACrC,MAAI,QAAQ;AACZ,SAAO,OAAO,SAAS,OAAO,SAAS,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,KAAK,UAAU,KAAQ;AACpF,eAAW,OAAO,UAAU;AAC1B,UAAI,OAAO,UAAU,IAAK;AAC1B,YAAM,OAAO,IAAI,MAAM;AACvB,UAAI,KAAM,QAAO,KAAK,IAAI;AAAA,IAC5B;AAAA,EACF;AACA,SAAO;AACT;AAGO,SAAS,eAAe,OAAyC;AACtE,QAAM,SAAiC,CAAC;AACxC,aAAW,KAAK,OAAO;AACrB,UAAM,MAAM,MAAM,MAAM,MAAM,IAAI,OAAO,CAAC,CAAC;AAC3C,WAAO,GAAG,KAAK,OAAO,GAAG,KAAK,KAAK;AAAA,EACrC;AACA,SAAO;AACT;AAOA,eAAsB,eACpB,aACA,MACA,MAAc,aACa;AAC3B,QAAM,SAAS,IAAI,IAAI,WAAW,EAAE;AACpC,QAAM,MAAM,CAAC,UAAoB,MAAM,IAAI,CAAC,MAAM,IAAI,IAAI,GAAG,MAAM,EAAE,IAAI;AAEzE,QAAM,aAAa,MAAM,KAAK,UAAU,IAAI,IAAI,gBAAgB,MAAM,EAAE,IAAI;AAC5E,MAAI,YAAY;AACd,UAAM,OAAO,iBAAiB,UAAU;AACxC,QAAI,KAAK,SAAS,GAAG;AACnB,YAAM,QAAQ,iBAAiB,MAAM,GAAG;AACxC,aAAO,EAAE,QAAQ,IAAI,KAAK,GAAG,QAAQ,WAAW,cAAc,eAAe,KAAK,EAAE;AAAA,IACtF;AAAA,EACF;AAEA,QAAM,WAAW,MAAM,KAAK,UAAU,MAAM;AAC5C,MAAI,UAAU;AACZ,UAAM,QAAQ,eAAe,UAAU,MAAM;AAC7C,QAAI,MAAM,SAAS,GAAG;AACpB,YAAM,QAAQ,iBAAiB,OAAO,GAAG;AACzC,aAAO,EAAE,QAAQ,IAAI,KAAK,GAAG,QAAQ,kBAAkB,cAAc,eAAe,KAAK,EAAE;AAAA,IAC7F;AAAA,EACF;AAEA,SAAO,EAAE,QAAQ,CAAC,IAAI,IAAI,KAAK,MAAM,EAAE,IAAI,GAAG,QAAQ,aAAa,cAAc,EAAE,KAAK,EAAE,EAAE;AAC9F;;;ACtGA,SAAS,SAAS,QAAgC;AAChD,SAAO,WAAW,QAAQ,UAAU;AACtC;AASO,SAAS,iBACd,QACA,OACA,cACgB;AAChB,QAAM,gBAAgB,OAAO,QAAQ,CAAC,MAAM,EAAE,OAAO;AACrD,QAAM,eAAe,OAAO,QAAQ,CAAC,MAAM,EAAE,MAAM;AAInD,QAAM,YACJ,OAAO,SAAS,KAAK,OAAO,MAAM,CAAC,MAAM,EAAE,QAAQ,SAAS,KAAK,EAAE,QAAQ,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;AAC/F,QAAM,WACJ,OAAO,SAAS,KAAK,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,SAAS,KAAK,EAAE,OAAO,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;AAC7F,QAAM,cAAc,MAAM,OAAO,CAAC,MAAM,SAAS,EAAE,MAAM,CAAC,EAAE;AAI5D,QAAM,UAAU,MAAM,SAAS,KAAK,gBAAgB;AAEpD,QAAM,UAAU,CAAC,GAAG,IAAI,IAAI,cAAc,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAC/D,QAAM,UAAU,CAAC,GAAG,IAAI,IAAI,aAAa,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAC9D,QAAM,WAAW,OAAO,QAAQ,YAAY,EACzC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAO,MAAM,MAAM,MAAM,GAAG,CAAC,QAAK,CAAC,EAAG,EAChD,KAAK,IAAI;AACZ,QAAM,OACJ,GAAG,OAAO,MAAM,YAAY,QAAQ,cACzB,QAAQ,KAAK,GAAG,KAAK,QAAG,YAAY,QAAQ,KAAK,GAAG,KAAK,QAAG,KACpE,MAAM,MAAM,WAAW,WAAW;AAEvC,SAAO,EAAE,WAAW,UAAU,SAAS,aAAa,eAAe,OAAO,QAAQ,KAAK;AACzF;AASA,eAAsB,aAAa,KAAyC;AAC1E,QAAM,EAAE,KAAK,IAAI;AACjB,QAAM,QAAQ,UAAU,IAAI;AAC5B,MAAI,CAAC,KAAK,aAAa;AACrB,WAAO,EAAE,OAAO,WAAW,MAAM,OAAO,QAAQ,QAAQ,SAAS,kBAAkB;AAAA,EACrF;AACA,QAAM,MAAM,IAAI,OAAO,oBAAI,KAAK;AAChC,QAAM,eAAe,IAAI,gBAAgB,oBAAoB;AAC7D,QAAM,SAAS,IAAI,iBAAkB,MAAM,qBAAqB;AAChE,MAAI;AACF,UAAM,aAA+B,MAAM,eAAe,KAAK,aAAa,YAAY;AACxF,UAAM,eAAe,MAAM,OAAO,MAAM,WAAW,MAAM;AACzD,UAAM,gBAAgB,CAAC,GAAG,IAAI,IAAI,aAAa,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AACvE,UAAM,cAAc,MAAM,OAAO,WAAW,aAAa;AACzD,UAAM,UAAU;AAAA,MACd;AAAA,MACA;AAAA,MACA,WAAW,gBAAgB,eAAe,WAAW,MAAM;AAAA,IAC7D;AACA,UAAM,SACJ,QAAQ,aAAa,QAAQ,YAAY,QAAQ,UAAU,SAAS;AACtE,WAAO;AAAA,MACL,OAAO;AAAA,MACP,MAAM;AAAA,MACN;AAAA,MACA,SAAS,QAAQ;AAAA,MACjB,SAAS,EAAE,GAAG,SAAS,WAAW,IAAI,YAAY,EAAE;AAAA,IACtD;AAAA,EACF,UAAE;AACA,UAAM,OAAO,QAAQ;AAAA,EACvB;AACF;AAMA,IAAM,mBAAmB;AAGlB,SAAS,sBAAoC;AAClD,SAAO;AAAA,IACL,WAAW,OAAO,QAAQ;AACxB,UAAI;AACF,cAAM,MAAM,MAAM,MAAM,KAAK;AAAA,UAC3B,UAAU;AAAA,UACV,QAAQ,YAAY,QAAQ,gBAAgB;AAAA,QAC9C,CAAC;AACD,YAAI,CAAC,IAAI,GAAI,QAAO;AACpB,eAAO,MAAM,IAAI,KAAK;AAAA,MACxB,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAM,mBAAmB,EAAE,OAAO,MAAM,QAAQ,IAAI;AACpD,IAAM,kBAAkB;AASxB,eAAsB,uBAA+C;AACnE,QAAM,EAAE,UAAU,SAAS,QAAQ,QAAQ,IAAI,MAAM,OAAO,kBAAkB;AAC9E,QAAM,iBAAiB;AAAA,IACrB,EAAE,QAAQ,YAAY,MAAM,SAAS;AAAA,IACrC,EAAE,QAAQ,WAAW,MAAM,QAAQ;AAAA,IACnC,EAAE,QAAQ,UAAU,MAAM,OAAO;AAAA,EACnC;AACA,QAAM,gBAAgB;AAAA,IACpB,EAAE,QAAQ,WAAW,YAAY,QAAQ,SAAS,EAAE;AAAA,IACpD,EAAE,QAAQ,aAAa,YAAY,QAAQ,WAAW,EAAE;AAAA,EAC1D;AAEA,SAAO;AAAA,IACL,MAAM,MAAM,MAAM;AAChB,YAAM,UAAyB,CAAC;AAChC,YAAM,WAAW,MAAM,QAAQ,IAAI,eAAe,IAAI,CAAC,MAAM,EAAE,KAAK,OAAO,CAAC,CAAC;AAC7E,YAAM,iBAAiB,MAAM,QAAQ,IAAI,cAAc,IAAI,MAAM,SAAS,OAAO,CAAC,CAAC;AACnF,UAAI;AACF,mBAAW,OAAO,MAAM;AACtB,gBAAM,UAAkC,CAAC;AACzC,gBAAM,UAAU,oBAAI,IAAY;AAChC,mBAAS,IAAI,GAAG,IAAI,eAAe,QAAQ,KAAK;AAC9C,kBAAM,SAAS,eAAe,CAAC,EAAG;AAClC,kBAAM,UAAU,SAAS,CAAC;AAC1B,kBAAM,MAAM,MAAM,QAAQ,WAAW,EAAE,UAAU,iBAAiB,CAAC;AACnE,kBAAM,OAAO,MAAM,IAAI,QAAQ;AAC/B,kBAAM,SAAmB,CAAC;AAC1B,iBAAK,GAAG,aAAa,CAAC,MAAM,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC;AAClD,gBAAI,KAAK;AACT,gBAAI;AACF,oBAAM,OAAO,MAAM,KAAK,KAAK,KAAK;AAAA,gBAChC,WAAW;AAAA,gBACX,SAAS;AAAA,cACX,CAAC;AACD,oBAAM,UAAU,MAAM,KACnB,QAAQ,mBAAmB,EAC3B,MAAM,EACN,UAAU,EACV,MAAM,MAAM,KAAK;AACpB,mBAAK,CAAC,CAAC,QAAQ,KAAK,GAAG,KAAK,OAAO,WAAW,KAAK;AACnD,kBAAI,WAAW,YAAY;AAMzB,sBAAM,QAAS,MAAM,KAClB,SAAS,qEAAqE,EAC9E,MAAM,MAAM,CAAC,CAAC;AACjB,sBAAM,SAAS,IAAI,IAAI,GAAG,EAAE;AAC5B,2BAAW,KAAK,OAAO;AACrB,sBAAI;AACF,wBAAI,IAAI,IAAI,CAAC,EAAE,WAAW,OAAQ,SAAQ,IAAI,IAAI,IAAI,CAAC,EAAE,IAAI;AAAA,kBAC/D,QAAQ;AAAA,kBAER;AAAA,gBACF;AAAA,cACF;AAAA,YACF,QAAQ;AACN,mBAAK;AAAA,YACP,UAAE;AACA,oBAAM,IAAI,MAAM,EAAE,MAAM,MAAM;AAAA,cAAC,CAAC;AAAA,YAClC;AACA,oBAAQ,KAAK,EAAE,QAAQ,GAAG,CAAC;AAAA,UAC7B;AAEA,gBAAM,SAAgC,CAAC;AACvC,mBAAS,IAAI,GAAG,IAAI,cAAc,QAAQ,KAAK;AAC7C,kBAAM,EAAE,QAAQ,WAAW,IAAI,cAAc,CAAC;AAC9C,kBAAM,UAAU,eAAe,CAAC;AAChC,kBAAM,MAAM,MAAM,QAAQ,WAAW,EAAE,GAAG,WAAW,CAAC;AACtD,kBAAM,OAAO,MAAM,IAAI,QAAQ;AAC/B,kBAAM,SAAmB,CAAC;AAC1B,iBAAK,GAAG,aAAa,CAAC,MAAM,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC;AAClD,gBAAI,KAAK;AACT,gBAAI;AACF,oBAAM,OAAO,MAAM,KAAK,KAAK,KAAK;AAAA,gBAChC,WAAW;AAAA,gBACX,SAAS;AAAA,cACX,CAAC;AACD,oBAAM,WAAY,MAAM,KACrB,SAAS,8DAA8D,EACvE,MAAM,MAAM,IAAI;AACnB,mBAAK,CAAC,CAAC,QAAQ,KAAK,GAAG,KAAK,OAAO,WAAW,KAAK,CAAC;AAAA,YACtD,QAAQ;AACN,mBAAK;AAAA,YACP,UAAE;AACA,oBAAM,IAAI,MAAM,EAAE,MAAM,MAAM;AAAA,cAAC,CAAC;AAAA,YAClC;AACA,mBAAO,KAAK,EAAE,QAAQ,GAAG,CAAC;AAAA,UAC5B;AAEA,kBAAQ,KAAK,EAAE,KAAK,SAAS,QAAQ,OAAO,CAAC,GAAG,OAAO,EAAE,CAAC;AAAA,QAC5D;AAAA,MACF,UAAE;AACA,cAAM,QAAQ,IAAI,CAAC,GAAG,UAAU,GAAG,cAAc,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,MAAM;AAAA,QAAC,CAAC,CAAC,CAAC;AAAA,MAC1F;AACA,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,WAAW,MAAM;AACrB,YAAM,MAAoB,CAAC;AAC3B,iBAAW,OAAO,MAAM;AACtB,YAAI;AACJ,YAAI;AACF,cAAI,MAAM,MAAM,MAAM,KAAK;AAAA,YACzB,QAAQ;AAAA,YACR,UAAU;AAAA,YACV,QAAQ,YAAY,QAAQ,gBAAgB;AAAA,UAC9C,CAAC;AAED,cAAI,IAAI,WAAW,OAAO,IAAI,WAAW,KAAK;AAC5C,kBAAM,MAAM,MAAM,KAAK;AAAA,cACrB,QAAQ;AAAA,cACR,UAAU;AAAA,cACV,QAAQ,YAAY,QAAQ,gBAAgB;AAAA,YAC9C,CAAC;AAAA,UACH;AACA,mBAAS,IAAI;AAAA,QACf,QAAQ;AACN,mBAAS;AAAA,QACX;AACA,YAAI,KAAK,EAAE,KAAK,OAAO,CAAC;AAAA,MAC1B;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;ACjRA,IAAM,WAA2E;AAAA,EAC/E,MAAM;AAAA,EACN,MAAM;AAAA,EACN,UAAU;AAAA,EACV,YAAY;AAAA,EACZ,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,SAAS;AACX;AAEO,IAAM,kBAAkB,OAAO,KAAK,QAAQ;AAGnD,IAAM,2BAA2B;AAEjC,SAAS,WAAW,WAA4B;AAC9C,SAAO,CAAC,KAAK,MAAM,OAAO,CAAC,MACzB,aAAa,KAAK,MAAM,EAAE,GAAG,MAAM,WAAW,KAAK,aAAa,UAAU,CAAC;AAC/E;AAMA,eAAsB,YAAY,MAAY,MAAuC;AACnF,MAAI,EAAE,QAAQ,UAAW,OAAM,IAAI,MAAM,kBAAkB,IAAI,EAAE;AACjE,QAAM,QAAQ,WAAW,wBAAwB;AAIjD,QAAM,QAAQ,KAAK,QAAQ,KAAK;AAChC,MAAI;AACF,WAAO,MAAM,SAAS,IAAI,EAAE,EAAE,MAAM,MAAM,CAAC;AAAA,EAC7C,SAAS,KAAK;AACZ,WAAO;AAAA,MACL,OAAO;AAAA,MACP,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,SAAS,GAAG,IAAI,6BAAwB,OAAO,GAAG,CAAC;AAAA,IACrD;AAAA,EACF;AACF;AAEA,eAAsB,UAAU,MAAY,OAA6C;AACvF,QAAM,QAAQ,SAAS;AACvB,aAAW,KAAK,OAAO;AACrB,QAAI,EAAE,KAAK,UAAW,OAAM,IAAI,MAAM,kBAAkB,CAAC,EAAE;AAAA,EAC7D;AACA,SAAO,QAAQ,IAAI,MAAM,IAAI,CAAC,MAAM,YAAY,MAAM,CAAC,CAAC,CAAC;AAC3D;AAEA,eAAsB,gBAAgB,OAAe,OAA6C;AAChG,QAAM,MAAM,MAAM,QAAQ,IAAI,MAAM,IAAI,CAAC,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC;AACnE,SAAO,IAAI,KAAK;AAClB;","names":["join","join","readFile","join","join","readFile","readFile","join","readFile","join","readFile","join","readFile","writeFile","mkdtemp","rm","join","readJsonMaybe","readFile","mkdtemp","join","writeFile","rm"]}

package/dist/chunk-5L2QXUTU.js

@@ -0,0 +1,279 @@
+import {
+  isIdempotencyConflict
+} from "./chunk-OGGRFBL4.js";
+import {
+  announcementSiteExtras,
+  fetchAttachmentBytes,
+  loadBundledImages,
+  renderReportHtml,
+  resolveCopy
+} from "./chunk-BWLUNY7L.js";
+import {
+  checklistFor,
+  isChecklistComplete,
+  listSendableReports,
+  stampSent
+} from "./chunk-OCS7SZUZ.js";
+import {
+  listWebsites,
+  siteSlug,
+  updateLaunched
+} from "./chunk-CLVTVDOU.js";
+import {
+  openBase,
+  readAirtableConfig
+} from "./chunk-HN6I2XWI.js";
+import {
+  defaultResendClient
+} from "./chunk-WEKL2HYJ.js";
+
+// src/reports/maintenance-email/header-image.ts
+import sharp from "sharp";
+var DEFAULT_DISPLAY_WIDTH = 600;
+var RETINA_SCALE = 2;
+var JPEG_QUALITY = 82;
+function channelToHex(value) {
+  return Math.max(0, Math.min(255, Math.round(value))).toString(16).padStart(2, "0");
+}
+async function prepareHeaderImage(bytes, options = {}) {
+  const requestedDisplayWidth = options.displayWidth ?? DEFAULT_DISPLAY_WIDTH;
+  const input = Buffer.from(bytes);
+  const meta = await sharp(input).metadata();
+  const origWidth = meta.width;
+  const origHeight = meta.height;
+  if (!origWidth || !origHeight) {
+    throw new Error("prepareHeaderImage: could not read source image dimensions");
+  }
+  const displayWidth = Math.min(requestedDisplayWidth, origWidth);
+  const displayHeight = Math.round(displayWidth * origHeight / origWidth);
+  const targetSourceWidth = Math.min(origWidth, displayWidth * RETINA_SCALE);
+  const out = await sharp(input).resize({ width: targetSourceWidth, withoutEnlargement: true }).flatten({ background: "#ffffff" }).jpeg({ quality: JPEG_QUALITY }).toBuffer();
+  const { dominant } = await sharp(out).stats();
+  const placeholderColor = `#${channelToHex(dominant.r)}${channelToHex(dominant.g)}${channelToHex(dominant.b)}`;
+  return {
+    bytes: new Uint8Array(out),
+    contentType: "image/jpeg",
+    displayWidth,
+    displayHeight,
+    placeholderColor
+  };
+}
+
+// src/reports/send/orchestrate.ts
+var FROM_ADDRESS = "Reddoor Reports <reports@reddoorla.com>";
+var REPLY_TO = "info@reddoorla.com";
+var GLOBAL_REPORT_CC = "info@reddoorla.com";
+function withGlobalCc(perSiteCc, to) {
+  const cc = [...perSiteCc ?? []];
+  const present = new Set([...cc, ...to].map((a) => a.toLowerCase()));
+  if (!present.has(GLOBAL_REPORT_CC.toLowerCase())) cc.push(GLOBAL_REPORT_CC);
+  return cc;
+}
+var MONTHS = [
+  "January",
+  "February",
+  "March",
+  "April",
+  "May",
+  "June",
+  "July",
+  "August",
+  "September",
+  "October",
+  "November",
+  "December"
+];
+function monthYear(d) {
+  return `${MONTHS[d.getUTCMonth()]} ${d.getUTCFullYear()}`;
+}
+function toInlineAttachment(a) {
+  return {
+    filename: a.filename,
+    content: Buffer.from(a.bytes).toString("base64"),
+    contentType: a.contentType,
+    inlineContentId: a.cid
+  };
+}
+async function sendApprovedReports(options = {}) {
+  const base = openBase(readAirtableConfig());
+  const client = options.resend ?? defaultResendClient();
+  const sendable = await listSendableReports(base);
+  if (sendable.length === 0) return { output: "No reports ready to send.", code: 0 };
+  const websites = await listWebsites(base);
+  const sites = new Map(websites.map((w) => [w.id, w]));
+  const lines = [];
+  let anyFailed = false;
+  for (const report of sendable) {
+    const site = sites.get(report.siteId);
+    if (!site) {
+      lines.push(`\u2717 ${report.reportId} \u2014 Site row not found for id=${report.siteId}`);
+      anyFailed = true;
+      continue;
+    }
+    try {
+      const messageId = await sendOne(client, base, site, report);
+      lines.push(`\u2713 sent: ${report.reportId} (${messageId})`);
+      if (report.reportType === "Launch") {
+        try {
+          await updateLaunched(base, site.id, (/* @__PURE__ */ new Date()).toISOString());
+          lines.push(`  \u21B3 launched: ${site.name} flipped to maintenance`);
+        } catch (e) {
+          lines.push(`  \u26A0 launch flip failed for ${site.name}: ${e.message}`);
+        }
+      }
+    } catch (e) {
+      lines.push(`\u2717 ${report.reportId} \u2014 ${e.message}`);
+      anyFailed = true;
+    }
+  }
+  return { output: lines.join("\n"), code: anyFailed ? 1 : 0 };
+}
+async function sendOne(client, base, site, report) {
+  if (!isChecklistComplete(report)) {
+    const items = checklistFor(report.reportType);
+    const done = items.filter((i) => report.checklist[i.field] === true).length;
+    throw new Error(
+      `Report ${report.reportId} checklist incomplete \u2014 ${done}/${items.length} items checked`
+    );
+  }
+  if (!site.headerImage) {
+    throw new Error(`Site '${site.name}' has no Header image set on the Websites row`);
+  }
+  if (!report.lighthouse) {
+    throw new Error(
+      `Report ${report.reportId} has no Lighthouse scores \u2014 all four cells (Lighthouse \u2014 Performance / Accessibility / Best Practices / SEO) must be numeric on the Reports row; one non-numeric or blank cell nulls all four`
+    );
+  }
+  const explicitTo = parseAddresses(site.reportRecipientsTo);
+  const fallbackTo = parseAddresses(site.pointOfContact);
+  const to = explicitTo ?? fallbackTo ?? [];
+  if (to.length === 0) {
+    throw new Error(
+      `Site '${site.name}' has no recipients (Report recipients (To) AND point of contact are both empty)`
+    );
+  }
+  for (const addr of to) {
+    if (!isProbablyEmail(addr)) {
+      throw new Error(
+        `Site '${site.name}' recipient is malformed: ${addr} \u2014 use a bare address only (no \`Name <addr>\` display-name syntax); fix Report recipients (To) or point of contact in Airtable`
+      );
+    }
+  }
+  const cc = parseAddresses(site.reportRecipientsCc);
+  if (cc) {
+    for (const addr of cc) {
+      if (!isProbablyEmail(addr)) {
+        throw new Error(
+          `Site '${site.name}' CC is malformed: ${addr} \u2014 fix Report recipients (CC) in Airtable`
+        );
+      }
+    }
+  }
+  const original = await fetchAttachmentBytes(site.headerImage.url);
+  const header = await prepareHeaderImage(original.bytes);
+  const bundled = await loadBundledImages();
+  const slug = siteSlug(site.name);
+  const cidName = `${slug}-header`;
+  const { html } = await renderReportHtml({
+    siteName: site.name,
+    siteUrl: site.url,
+    reportType: report.reportType,
+    completedOn: report.completedOn ? new Date(report.completedOn) : /* @__PURE__ */ new Date(),
+    lighthouse: report.lighthouse,
+    gaUsersCurrent: report.gaUsersCurrent ?? void 0,
+    gaUsersPrevious: report.gaUsersPrevious ?? void 0,
+    searchPosition: report.searchFoundPage1 && report.searchPosition !== null ? report.searchPosition : void 0,
+    lastTestedDate: report.lastTestedDate ? new Date(report.lastTestedDate) : null,
+    commentary: report.commentary,
+    copy: resolveCopy(site),
+    headerImageCid: cidName,
+    headerWidth: header.displayWidth,
+    headerHeight: header.displayHeight,
+    headerBgColor: header.placeholderColor,
+    // Announcement-only: re-derive cadence + improvements from the site row so the SENT email
+    // keeps its cadence copy + improvement callouts. Without this the send-time re-render drops
+    // them entirely (they're not stored on the Reports row). Ignored by the other templates.
+    ...report.reportType === "Announcement" ? announcementSiteExtras(site) : {}
+  });
+  const reportDate = report.completedOn ? new Date(report.completedOn) : /* @__PURE__ */ new Date();
+  const subject = report.subjectOverride ?? `${site.name} \u2014 ${monthYear(reportDate)} ${report.reportType} Report`;
+  const attachments = [
+    toInlineAttachment({
+      bytes: header.bytes,
+      filename: `${cidName}.jpg`,
+      contentType: header.contentType,
+      cid: cidName
+    })
+  ];
+  for (const img of [bundled.check, bundled.blurred]) {
+    if (html.includes(`cid:${img.cid}`)) {
+      attachments.push(
+        toInlineAttachment({
+          bytes: img.bytes,
+          filename: img.filename,
+          contentType: img.contentType,
+          cid: img.cid
+        })
+      );
+    }
+  }
+  const payload = {
+    from: FROM_ADDRESS,
+    to,
+    replyTo: REPLY_TO,
+    subject,
+    html,
+    attachments,
+    // Stable across retries of the same row — if Airtable stamping fails after a
+    // successful Resend, the next --send-ready replays with the same key and
+    // Resend returns the original message id rather than sending a duplicate.
+    idempotencyKey: `report:${report.id}`
+  };
+  const finalCc = withGlobalCc(cc, to);
+  if (finalCc.length > 0) payload.cc = finalCc;
+  let result;
+  try {
+    result = await client.send(payload);
+  } catch (err) {
+    if (isIdempotencyConflict(err)) {
+      await stampSent(base, report.id, /* @__PURE__ */ new Date(), null);
+      console.log(`\u21BB already sent (idempotency conflict), stamped: ${report.reportId}`);
+      return "idempotent-conflict";
+    }
+    throw err;
+  }
+  await stampSent(base, report.id, /* @__PURE__ */ new Date(), result.messageId);
+  return result.messageId;
+}
+function parseAddresses(field) {
+  if (!field) return null;
+  const seen = /* @__PURE__ */ new Set();
+  const list = [];
+  for (const raw of field.split(/[,\n]/)) {
+    const trimmed = raw.trim().toLowerCase();
+    if (!trimmed) continue;
+    if (seen.has(trimmed)) continue;
+    seen.add(trimmed);
+    list.push(trimmed);
+  }
+  return list.length > 0 ? list : null;
+}
+function isProbablyEmail(s) {
+  const at = s.indexOf("@");
+  if (at < 1 || at !== s.lastIndexOf("@")) return false;
+  const local = s.slice(0, at);
+  const domain = s.slice(at + 1);
+  if (!local || !domain) return false;
+  if (!domain.includes(".")) return false;
+  if (/\s/.test(s)) return false;
+  return true;
+}
+
+export {
+  GLOBAL_REPORT_CC,
+  withGlobalCc,
+  sendApprovedReports,
+  parseAddresses,
+  isProbablyEmail
+};
+//# sourceMappingURL=chunk-5L2QXUTU.js.map

package/dist/chunk-5L2QXUTU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/reports/maintenance-email/header-image.ts","../src/reports/send/orchestrate.ts"],"sourcesContent":["import sharp from \"sharp\";\n\nexport type PreparedHeaderImage = {\n  /** Resized JPEG bytes to attach inline (CID) in place of the Airtable original. */\n  bytes: Uint8Array;\n  /** Always \"image/jpeg\" — we re-encode for predictable size and a flat white background. */\n  contentType: string;\n  /** CSS display width in px (≤ requested, never wider than the source has pixels for). */\n  displayWidth: number;\n  /** CSS display height in px, source aspect ratio preserved (no distortion). */\n  displayHeight: number;\n  /** Dominant-color hex (e.g. \"#cfc3a8\"), used as the loading/blocked placeholder box. */\n  placeholderColor: string;\n};\n\nexport type PrepareHeaderImageOptions = {\n  /** Intended CSS display width. The email body is 600px, so that's the default. */\n  displayWidth?: number;\n};\n\nconst DEFAULT_DISPLAY_WIDTH = 600;\n/** Encode the source at 2× display width so it stays crisp on retina screens. */\nconst RETINA_SCALE = 2;\n/** Quality is for *resized* pixels — at 1200px the texture/text read as sharp; bytes are tiny. */\nconst JPEG_QUALITY = 82;\n\nfunction channelToHex(value: number): string {\n  return Math.max(0, Math.min(255, Math.round(value)))\n    .toString(16)\n    .padStart(2, \"0\");\n}\n\n/**\n * Downscale an oversized header image for email: 2× the display width (retina) at most,\n * never upscaled, re-encoded as JPEG on a flat white background. Also reports the display\n * dimensions (so the template can reserve the box and stop reflow) and a dominant color\n * (so the reserved box shows a matched placeholder while the image loads).\n *\n * Root cause this addresses: Airtable headers can be multi-MB / 2400px+ while the email\n * renders them at ~600px — shipping ~16× more pixels than the display can use.\n */\nexport async function prepareHeaderImage(\n  bytes: Uint8Array,\n  options: PrepareHeaderImageOptions = {},\n): Promise<PreparedHeaderImage> {\n  const requestedDisplayWidth = options.displayWidth ?? DEFAULT_DISPLAY_WIDTH;\n  const input = Buffer.from(bytes);\n\n  const meta = await sharp(input).metadata();\n  const origWidth = meta.width;\n  const origHeight = meta.height;\n  if (!origWidth || !origHeight) {\n    throw new Error(\"prepareHeaderImage: could not read source image dimensions\");\n  }\n\n  // Never claim a wider display than the source can fill at 1×.\n  const displayWidth = Math.min(requestedDisplayWidth, origWidth);\n  const displayHeight = Math.round((displayWidth * origHeight) / origWidth);\n\n  // Encode at 2× display for retina, but never enlarge a smaller original.\n  const targetSourceWidth = Math.min(origWidth, displayWidth * RETINA_SCALE);\n\n  const out = await sharp(input)\n    .resize({ width: targetSourceWidth, withoutEnlargement: true })\n    .flatten({ background: \"#ffffff\" })\n    .jpeg({ quality: JPEG_QUALITY })\n    .toBuffer();\n\n  const { dominant } = await sharp(out).stats();\n  const placeholderColor = `#${channelToHex(dominant.r)}${channelToHex(dominant.g)}${channelToHex(dominant.b)}`;\n\n  return {\n    bytes: new Uint8Array(out),\n    contentType: \"image/jpeg\",\n    displayWidth,\n    displayHeight,\n    placeholderColor,\n  };\n}\n","import { openBase, readAirtableConfig } from \"../airtable/client.js\";\nimport { listSendableReports, stampSent } from \"../airtable/reports.js\";\nimport { listWebsites, siteSlug, updateLaunched } from \"../airtable/websites.js\";\nimport type { WebsiteRow } from \"../airtable/websites.js\";\nimport type { ReportRow } from \"../airtable/reports.js\";\nimport { fetchAttachmentBytes } from \"../airtable/attachments.js\";\nimport { renderReportHtml } from \"../render.js\";\nimport { resolveCopy } from \"../copy.js\";\nimport { announcementSiteExtras } from \"../announcement-email/template.js\";\nimport { loadBundledImages } from \"../maintenance-email/assets/index.js\";\nimport { prepareHeaderImage } from \"../maintenance-email/header-image.js\";\nimport { defaultResendClient, type ResendClient, type ResendSendInput } from \"./resend.js\";\nimport { isIdempotencyConflict } from \"./idempotency.js\";\nimport { checklistFor, isChecklistComplete } from \"../checklist.js\";\n\nconst FROM_ADDRESS = \"Reddoor Reports <reports@reddoorla.com>\";\nconst REPLY_TO = \"info@reddoorla.com\";\n\n/** Operations inbox CC'd on every outgoing report so there's always an internal\n *  copy on file alongside the client recipients. */\nexport const GLOBAL_REPORT_CC = \"info@reddoorla.com\";\n\n/**\n * Append {@link GLOBAL_REPORT_CC} to a site's per-site CC list. The per-site CC is\n * passed through unchanged (preserving prior behavior); the global address is added\n * only when it isn't already present in the CC or To lists (case-insensitive), so a\n * report is never double-addressed to the ops inbox. Returns the final CC list (may\n * be empty if the global address is already the sole To recipient — the caller omits\n * an empty CC).\n */\nexport function withGlobalCc(perSiteCc: string[] | null, to: string[]): string[] {\n  const cc = [...(perSiteCc ?? [])];\n  const present = new Set([...cc, ...to].map((a) => a.toLowerCase()));\n  if (!present.has(GLOBAL_REPORT_CC.toLowerCase())) cc.push(GLOBAL_REPORT_CC);\n  return cc;\n}\n\nconst MONTHS = [\n  \"January\",\n  \"February\",\n  \"March\",\n  \"April\",\n  \"May\",\n  \"June\",\n  \"July\",\n  \"August\",\n  \"September\",\n  \"October\",\n  \"November\",\n  \"December\",\n];\n\n/** \"May 2026\" — UTC month/year, consistent with the rest of the reports pipeline's dates. */\nfunction monthYear(d: Date): string {\n  return `${MONTHS[d.getUTCMonth()]} ${d.getUTCFullYear()}`;\n}\n\ntype InlineAttachment = NonNullable<ResendSendInput[\"attachments\"]>[number];\n\n/** Build a Resend inline (CID-referenced) attachment from raw bytes — the header\n *  image and both bundled images share this exact shape. */\nfunction toInlineAttachment(a: {\n  bytes: Uint8Array;\n  filename: string;\n  contentType: string;\n  cid: string;\n}): InlineAttachment {\n  return {\n    filename: a.filename,\n    content: Buffer.from(a.bytes).toString(\"base64\"),\n    contentType: a.contentType,\n    inlineContentId: a.cid,\n  };\n}\n\nexport type OrchestrateOptions = {\n  resend?: ResendClient;\n};\n\nexport async function sendApprovedReports(\n  options: OrchestrateOptions = {},\n): Promise<{ output: string; code: number }> {\n  const base = openBase(readAirtableConfig());\n  const client = options.resend ?? defaultResendClient();\n\n  const sendable = await listSendableReports(base);\n  if (sendable.length === 0) return { output: \"No reports ready to send.\", code: 0 };\n\n  const websites = await listWebsites(base);\n  const sites = new Map(websites.map((w) => [w.id, w]));\n\n  const lines: string[] = [];\n  let anyFailed = false;\n  for (const report of sendable) {\n    const site = sites.get(report.siteId);\n    if (!site) {\n      lines.push(`✗ ${report.reportId} — Site row not found for id=${report.siteId}`);\n      anyFailed = true;\n      continue;\n    }\n    try {\n      const messageId = await sendOne(client, base, site, report);\n      lines.push(`✓ sent: ${report.reportId} (${messageId})`);\n      if (report.reportType === \"Launch\") {\n        try {\n          await updateLaunched(base, site.id, new Date().toISOString());\n          lines.push(`  ↳ launched: ${site.name} flipped to maintenance`);\n        } catch (e) {\n          lines.push(`  ⚠ launch flip failed for ${site.name}: ${(e as Error).message}`);\n        }\n      }\n    } catch (e) {\n      lines.push(`✗ ${report.reportId} — ${(e as Error).message}`);\n      anyFailed = true;\n    }\n  }\n  return { output: lines.join(\"\\n\"), code: anyFailed ? 1 : 0 };\n}\n\nasync function sendOne(\n  client: ResendClient,\n  base: ReturnType<typeof openBase>,\n  site: WebsiteRow,\n  report: ReportRow,\n): Promise<string> {\n  // Hard checklist gate: a Maintenance/Testing report whose operator checklist isn't\n  // fully checked must never go out — even if \"Approved to send\" was ticked directly in\n  // Airtable, bypassing the dashboard's approve gate. Throw so the report is skipped and\n  // `Sent at` stays null (at-least-once retry preserved), exactly like the other sendOne\n  // guards. Launch/Announcement have an empty checklist → vacuously complete, never gated.\n  if (!isChecklistComplete(report)) {\n    const items = checklistFor(report.reportType);\n    const done = items.filter((i) => report.checklist[i.field] === true).length;\n    throw new Error(\n      `Report ${report.reportId} checklist incomplete — ${done}/${items.length} items checked`,\n    );\n  }\n  if (!site.headerImage) {\n    throw new Error(`Site '${site.name}' has no Header image set on the Websites row`);\n  }\n  if (!report.lighthouse) {\n    throw new Error(\n      `Report ${report.reportId} has no Lighthouse scores — all four cells ` +\n        `(Lighthouse — Performance / Accessibility / Best Practices / SEO) must be numeric ` +\n        `on the Reports row; one non-numeric or blank cell nulls all four`,\n    );\n  }\n\n  // Resolve + validate recipients BEFORE the expensive work (header fetch + sharp\n  // downscale + full MJML render). A misconfigured-recipients site is a guaranteed\n  // failure, so fail fast here rather than after burning that work. Same checks +\n  // messages as before — only the position moved.\n  const explicitTo = parseAddresses(site.reportRecipientsTo);\n  // Run pointOfContact through the parser too — operators sometimes paste\n  // \"a@x, b@y\" into that single-line field.\n  const fallbackTo = parseAddresses(site.pointOfContact);\n  const to = explicitTo ?? fallbackTo ?? [];\n  if (to.length === 0) {\n    throw new Error(\n      `Site '${site.name}' has no recipients (Report recipients (To) AND point of contact are both empty)`,\n    );\n  }\n  for (const addr of to) {\n    if (!isProbablyEmail(addr)) {\n      throw new Error(\n        `Site '${site.name}' recipient is malformed: ${addr} — use a bare address only ` +\n          `(no \\`Name <addr>\\` display-name syntax); fix Report recipients (To) or point of contact in Airtable`,\n      );\n    }\n  }\n  const cc = parseAddresses(site.reportRecipientsCc);\n  if (cc) {\n    for (const addr of cc) {\n      if (!isProbablyEmail(addr)) {\n        throw new Error(\n          `Site '${site.name}' CC is malformed: ${addr} — fix Report recipients (CC) in Airtable`,\n        );\n      }\n    }\n  }\n\n  const original = await fetchAttachmentBytes(site.headerImage.url);\n  // Downscale the (often multi-MB / 2400px+) Airtable header to email display size, and get\n  // back display dims + a placeholder color so the template can reserve the box.\n  const header = await prepareHeaderImage(original.bytes);\n  const bundled = await loadBundledImages();\n\n  const slug = siteSlug(site.name);\n  const cidName = `${slug}-header`;\n  const { html } = await renderReportHtml({\n    siteName: site.name,\n    siteUrl: site.url,\n    reportType: report.reportType,\n    completedOn: report.completedOn ? new Date(report.completedOn) : new Date(),\n    lighthouse: report.lighthouse,\n    gaUsersCurrent: report.gaUsersCurrent ?? undefined,\n    gaUsersPrevious: report.gaUsersPrevious ?? undefined,\n    searchPosition:\n      report.searchFoundPage1 && report.searchPosition !== null ? report.searchPosition : undefined,\n    lastTestedDate: report.lastTestedDate ? new Date(report.lastTestedDate) : null,\n    commentary: report.commentary,\n    copy: resolveCopy(site),\n    headerImageCid: cidName,\n    headerWidth: header.displayWidth,\n    headerHeight: header.displayHeight,\n    headerBgColor: header.placeholderColor,\n    // Announcement-only: re-derive cadence + improvements from the site row so the SENT email\n    // keeps its cadence copy + improvement callouts. Without this the send-time re-render drops\n    // them entirely (they're not stored on the Reports row). Ignored by the other templates.\n    ...(report.reportType === \"Announcement\" ? announcementSiteExtras(site) : {}),\n  });\n\n  const reportDate = report.completedOn ? new Date(report.completedOn) : new Date();\n  const subject =\n    report.subjectOverride ?? `${site.name} — ${monthYear(reportDate)} ${report.reportType} Report`;\n\n  // Inline attachments: the per-site header (every template renders it) plus only the bundled\n  // images the rendered HTML actually references. The green check (cid:rd-check-png) appears in\n  // every report's checklist/score rows EXCEPT Launch; the blurred-tests image\n  // (cid:rd-blurred-tests-jpg) appears ONLY in the Maintenance email. Attaching a bundled image\n  // the template doesn't reference leaves a dangling inline part that some mail clients surface as\n  // a stray downloadable attachment — so gate each on its cid actually appearing in `html`. This\n  // self-corrects if a template's image usage changes; there's no per-report-type list to keep in\n  // sync. Self-contained inline (no external CDN, no image-blocked broken icons in webmail).\n  const attachments: InlineAttachment[] = [\n    toInlineAttachment({\n      bytes: header.bytes,\n      filename: `${cidName}.jpg`,\n      contentType: header.contentType,\n      cid: cidName,\n    }),\n  ];\n  for (const img of [bundled.check, bundled.blurred]) {\n    if (html.includes(`cid:${img.cid}`)) {\n      attachments.push(\n        toInlineAttachment({\n          bytes: img.bytes,\n          filename: img.filename,\n          contentType: img.contentType,\n          cid: img.cid,\n        }),\n      );\n    }\n  }\n\n  const payload: Parameters<ResendClient[\"send\"]>[0] = {\n    from: FROM_ADDRESS,\n    to,\n    replyTo: REPLY_TO,\n    subject,\n    html,\n    attachments,\n    // Stable across retries of the same row — if Airtable stamping fails after a\n    // successful Resend, the next --send-ready replays with the same key and\n    // Resend returns the original message id rather than sending a duplicate.\n    idempotencyKey: `report:${report.id}`,\n  };\n  // Always CC the ops inbox (info@reddoorla.com), in addition to any per-site CC.\n  const finalCc = withGlobalCc(cc, to);\n  if (finalCc.length > 0) payload.cc = finalCc;\n\n  let result: Awaited<ReturnType<ResendClient[\"send\"]>>;\n  try {\n    result = await client.send(payload);\n  } catch (err) {\n    // The send path is at-least-once: client.send succeeds → stampSent writes\n    // `Sent at` (the ONLY thing that removes the row from listSendableReports). If\n    // stampSent threw on a PRIOR run (an Airtable blip), `Sent at` stayed null and\n    // the row replays here. By replay time the rendered body has usually changed\n    // (operator Commentary edit, `report --due` rewrote scores, or the header\n    // re-encodes non-deterministically), so Resend rejects the same-key\n    // (`report:<id>`) / different-body re-send with a 409 (`invalid_idempotent_request`).\n    //\n    // That 409 means the email ALREADY WENT OUT under this key on the prior run.\n    // Do NOT re-throw and do NOT re-send (re-throwing leaves the row unstamped, and\n    // after the 24h key TTL a SECOND real email would go out). Instead stamp the row\n    // so it stops replaying, then return success so the caller runs the Launch flip —\n    // which self-heals a launch that sent-but-never-flipped on the prior run.\n    //\n    // Any OTHER error (real network/Resend failure) re-throws, exactly as before, so\n    // a genuine failure still fails loudly and the row replays next run.\n    if (isIdempotencyConflict(err)) {\n      // Stamp `Sent at` ONLY — the original send's messageId is unrecoverable on\n      // the 409 path, so we leave `Resend message ID` null rather than writing a\n      // sentinel that would masquerade as a real id and orphan webhook lookups.\n      // Still return the sentinel string so the caller logs the already-sent path\n      // and runs the Launch flip.\n      await stampSent(base, report.id, new Date(), null);\n      console.log(`↻ already sent (idempotency conflict), stamped: ${report.reportId}`);\n      return \"idempotent-conflict\";\n    }\n    throw err;\n  }\n  await stampSent(base, report.id, new Date(), result.messageId);\n  return result.messageId;\n}\n\n/**\n * Split a comma/newline-separated address field into a clean array.\n * Lowercases (case-insensitive dedupe) and removes empty entries. Returns\n * null if nothing survives. Does NOT understand `Display Name <email>` —\n * operators should put a bare address in the Airtable field, or use multiple\n * lines if needing multiple recipients.\n */\nexport function parseAddresses(field: string | null): string[] | null {\n  if (!field) return null;\n  const seen = new Set<string>();\n  const list: string[] = [];\n  for (const raw of field.split(/[,\\n]/)) {\n    const trimmed = raw.trim().toLowerCase();\n    if (!trimmed) continue;\n    if (seen.has(trimmed)) continue;\n    seen.add(trimmed);\n    list.push(trimmed);\n  }\n  return list.length > 0 ? list : null;\n}\n\n/**\n * Cheap email shape check — must contain exactly one @, with non-empty\n * local and domain parts and at least one dot in the domain. We're not\n * trying to be a full RFC validator; we're trying to catch operator\n * mistakes like \"ops at acme dot com\" or a missing @ before they 422\n * at Resend.\n */\nexport function isProbablyEmail(s: string): boolean {\n  const at = s.indexOf(\"@\");\n  if (at < 1 || at !== s.lastIndexOf(\"@\")) return false;\n  const local = s.slice(0, at);\n  const domain = s.slice(at + 1);\n  if (!local || !domain) return false;\n  if (!domain.includes(\".\")) return false;\n  if (/\\s/.test(s)) return false;\n  return true;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,WAAW;AAoBlB,IAAM,wBAAwB;AAE9B,IAAM,eAAe;AAErB,IAAM,eAAe;AAErB,SAAS,aAAa,OAAuB;AAC3C,SAAO,KAAK,IAAI,GAAG,KAAK,IAAI,KAAK,KAAK,MAAM,KAAK,CAAC,CAAC,EAChD,SAAS,EAAE,EACX,SAAS,GAAG,GAAG;AACpB;AAWA,eAAsB,mBACpB,OACA,UAAqC,CAAC,GACR;AAC9B,QAAM,wBAAwB,QAAQ,gBAAgB;AACtD,QAAM,QAAQ,OAAO,KAAK,KAAK;AAE/B,QAAM,OAAO,MAAM,MAAM,KAAK,EAAE,SAAS;AACzC,QAAM,YAAY,KAAK;AACvB,QAAM,aAAa,KAAK;AACxB,MAAI,CAAC,aAAa,CAAC,YAAY;AAC7B,UAAM,IAAI,MAAM,4DAA4D;AAAA,EAC9E;AAGA,QAAM,eAAe,KAAK,IAAI,uBAAuB,SAAS;AAC9D,QAAM,gBAAgB,KAAK,MAAO,eAAe,aAAc,SAAS;AAGxE,QAAM,oBAAoB,KAAK,IAAI,WAAW,eAAe,YAAY;AAEzE,QAAM,MAAM,MAAM,MAAM,KAAK,EAC1B,OAAO,EAAE,OAAO,mBAAmB,oBAAoB,KAAK,CAAC,EAC7D,QAAQ,EAAE,YAAY,UAAU,CAAC,EACjC,KAAK,EAAE,SAAS,aAAa,CAAC,EAC9B,SAAS;AAEZ,QAAM,EAAE,SAAS,IAAI,MAAM,MAAM,GAAG,EAAE,MAAM;AAC5C,QAAM,mBAAmB,IAAI,aAAa,SAAS,CAAC,CAAC,GAAG,aAAa,SAAS,CAAC,CAAC,GAAG,aAAa,SAAS,CAAC,CAAC;AAE3G,SAAO;AAAA,IACL,OAAO,IAAI,WAAW,GAAG;AAAA,IACzB,aAAa;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;;;AC/DA,IAAM,eAAe;AACrB,IAAM,WAAW;AAIV,IAAM,mBAAmB;AAUzB,SAAS,aAAa,WAA4B,IAAwB;AAC/E,QAAM,KAAK,CAAC,GAAI,aAAa,CAAC,CAAE;AAChC,QAAM,UAAU,IAAI,IAAI,CAAC,GAAG,IAAI,GAAG,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;AAClE,MAAI,CAAC,QAAQ,IAAI,iBAAiB,YAAY,CAAC,EAAG,IAAG,KAAK,gBAAgB;AAC1E,SAAO;AACT;AAEA,IAAM,SAAS;AAAA,EACb;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGA,SAAS,UAAU,GAAiB;AAClC,SAAO,GAAG,OAAO,EAAE,YAAY,CAAC,CAAC,IAAI,EAAE,eAAe,CAAC;AACzD;AAMA,SAAS,mBAAmB,GAKP;AACnB,SAAO;AAAA,IACL,UAAU,EAAE;AAAA,IACZ,SAAS,OAAO,KAAK,EAAE,KAAK,EAAE,SAAS,QAAQ;AAAA,IAC/C,aAAa,EAAE;AAAA,IACf,iBAAiB,EAAE;AAAA,EACrB;AACF;AAMA,eAAsB,oBACpB,UAA8B,CAAC,GACY;AAC3C,QAAM,OAAO,SAAS,mBAAmB,CAAC;AAC1C,QAAM,SAAS,QAAQ,UAAU,oBAAoB;AAErD,QAAM,WAAW,MAAM,oBAAoB,IAAI;AAC/C,MAAI,SAAS,WAAW,EAAG,QAAO,EAAE,QAAQ,6BAA6B,MAAM,EAAE;AAEjF,QAAM,WAAW,MAAM,aAAa,IAAI;AACxC,QAAM,QAAQ,IAAI,IAAI,SAAS,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AAEpD,QAAM,QAAkB,CAAC;AACzB,MAAI,YAAY;AAChB,aAAW,UAAU,UAAU;AAC7B,UAAM,OAAO,MAAM,IAAI,OAAO,MAAM;AACpC,QAAI,CAAC,MAAM;AACT,YAAM,KAAK,UAAK,OAAO,QAAQ,qCAAgC,OAAO,MAAM,EAAE;AAC9E,kBAAY;AACZ;AAAA,IACF;AACA,QAAI;AACF,YAAM,YAAY,MAAM,QAAQ,QAAQ,MAAM,MAAM,MAAM;AAC1D,YAAM,KAAK,gBAAW,OAAO,QAAQ,KAAK,SAAS,GAAG;AACtD,UAAI,OAAO,eAAe,UAAU;AAClC,YAAI;AACF,gBAAM,eAAe,MAAM,KAAK,KAAI,oBAAI,KAAK,GAAE,YAAY,CAAC;AAC5D,gBAAM,KAAK,sBAAiB,KAAK,IAAI,yBAAyB;AAAA,QAChE,SAAS,GAAG;AACV,gBAAM,KAAK,mCAA8B,KAAK,IAAI,KAAM,EAAY,OAAO,EAAE;AAAA,QAC/E;AAAA,MACF;AAAA,IACF,SAAS,GAAG;AACV,YAAM,KAAK,UAAK,OAAO,QAAQ,WAAO,EAAY,OAAO,EAAE;AAC3D,kBAAY;AAAA,IACd;AAAA,EACF;AACA,SAAO,EAAE,QAAQ,MAAM,KAAK,IAAI,GAAG,MAAM,YAAY,IAAI,EAAE;AAC7D;AAEA,eAAe,QACb,QACA,MACA,MACA,QACiB;AAMjB,MAAI,CAAC,oBAAoB,MAAM,GAAG;AAChC,UAAM,QAAQ,aAAa,OAAO,UAAU;AAC5C,UAAM,OAAO,MAAM,OAAO,CAAC,MAAM,OAAO,UAAU,EAAE,KAAK,MAAM,IAAI,EAAE;AACrE,UAAM,IAAI;AAAA,MACR,UAAU,OAAO,QAAQ,gCAA2B,IAAI,IAAI,MAAM,MAAM;AAAA,IAC1E;AAAA,EACF;AACA,MAAI,CAAC,KAAK,aAAa;AACrB,UAAM,IAAI,MAAM,SAAS,KAAK,IAAI,+CAA+C;AAAA,EACnF;AACA,MAAI,CAAC,OAAO,YAAY;AACtB,UAAM,IAAI;AAAA,MACR,UAAU,OAAO,QAAQ;AAAA,IAG3B;AAAA,EACF;AAMA,QAAM,aAAa,eAAe,KAAK,kBAAkB;AAGzD,QAAM,aAAa,eAAe,KAAK,cAAc;AACrD,QAAM,KAAK,cAAc,cAAc,CAAC;AACxC,MAAI,GAAG,WAAW,GAAG;AACnB,UAAM,IAAI;AAAA,MACR,SAAS,KAAK,IAAI;AAAA,IACpB;AAAA,EACF;AACA,aAAW,QAAQ,IAAI;AACrB,QAAI,CAAC,gBAAgB,IAAI,GAAG;AAC1B,YAAM,IAAI;AAAA,QACR,SAAS,KAAK,IAAI,6BAA6B,IAAI;AAAA,MAErD;AAAA,IACF;AAAA,EACF;AACA,QAAM,KAAK,eAAe,KAAK,kBAAkB;AACjD,MAAI,IAAI;AACN,eAAW,QAAQ,IAAI;AACrB,UAAI,CAAC,gBAAgB,IAAI,GAAG;AAC1B,cAAM,IAAI;AAAA,UACR,SAAS,KAAK,IAAI,sBAAsB,IAAI;AAAA,QAC9C;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,WAAW,MAAM,qBAAqB,KAAK,YAAY,GAAG;AAGhE,QAAM,SAAS,MAAM,mBAAmB,SAAS,KAAK;AACtD,QAAM,UAAU,MAAM,kBAAkB;AAExC,QAAM,OAAO,SAAS,KAAK,IAAI;AAC/B,QAAM,UAAU,GAAG,IAAI;AACvB,QAAM,EAAE,KAAK,IAAI,MAAM,iBAAiB;AAAA,IACtC,UAAU,KAAK;AAAA,IACf,SAAS,KAAK;AAAA,IACd,YAAY,OAAO;AAAA,IACnB,aAAa,OAAO,cAAc,IAAI,KAAK,OAAO,WAAW,IAAI,oBAAI,KAAK;AAAA,IAC1E,YAAY,OAAO;AAAA,IACnB,gBAAgB,OAAO,kBAAkB;AAAA,IACzC,iBAAiB,OAAO,mBAAmB;AAAA,IAC3C,gBACE,OAAO,oBAAoB,OAAO,mBAAmB,OAAO,OAAO,iBAAiB;AAAA,IACtF,gBAAgB,OAAO,iBAAiB,IAAI,KAAK,OAAO,cAAc,IAAI;AAAA,IAC1E,YAAY,OAAO;AAAA,IACnB,MAAM,YAAY,IAAI;AAAA,IACtB,gBAAgB;AAAA,IAChB,aAAa,OAAO;AAAA,IACpB,cAAc,OAAO;AAAA,IACrB,eAAe,OAAO;AAAA;AAAA;AAAA;AAAA,IAItB,GAAI,OAAO,eAAe,iBAAiB,uBAAuB,IAAI,IAAI,CAAC;AAAA,EAC7E,CAAC;AAED,QAAM,aAAa,OAAO,cAAc,IAAI,KAAK,OAAO,WAAW,IAAI,oBAAI,KAAK;AAChF,QAAM,UACJ,OAAO,mBAAmB,GAAG,KAAK,IAAI,WAAM,UAAU,UAAU,CAAC,IAAI,OAAO,UAAU;AAUxF,QAAM,cAAkC;AAAA,IACtC,mBAAmB;AAAA,MACjB,OAAO,OAAO;AAAA,MACd,UAAU,GAAG,OAAO;AAAA,MACpB,aAAa,OAAO;AAAA,MACpB,KAAK;AAAA,IACP,CAAC;AAAA,EACH;AACA,aAAW,OAAO,CAAC,QAAQ,OAAO,QAAQ,OAAO,GAAG;AAClD,QAAI,KAAK,SAAS,OAAO,IAAI,GAAG,EAAE,GAAG;AACnC,kBAAY;AAAA,QACV,mBAAmB;AAAA,UACjB,OAAO,IAAI;AAAA,UACX,UAAU,IAAI;AAAA,UACd,aAAa,IAAI;AAAA,UACjB,KAAK,IAAI;AAAA,QACX,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAA+C;AAAA,IACnD,MAAM;AAAA,IACN;AAAA,IACA,SAAS;AAAA,IACT;AAAA,IACA;AAAA,IACA;AAAA;AAAA;AAAA;AAAA,IAIA,gBAAgB,UAAU,OAAO,EAAE;AAAA,EACrC;AAEA,QAAM,UAAU,aAAa,IAAI,EAAE;AACnC,MAAI,QAAQ,SAAS,EAAG,SAAQ,KAAK;AAErC,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,OAAO,KAAK,OAAO;AAAA,EACpC,SAAS,KAAK;AAiBZ,QAAI,sBAAsB,GAAG,GAAG;AAM9B,YAAM,UAAU,MAAM,OAAO,IAAI,oBAAI,KAAK,GAAG,IAAI;AACjD,cAAQ,IAAI,wDAAmD,OAAO,QAAQ,EAAE;AAChF,aAAO;AAAA,IACT;AACA,UAAM;AAAA,EACR;AACA,QAAM,UAAU,MAAM,OAAO,IAAI,oBAAI,KAAK,GAAG,OAAO,SAAS;AAC7D,SAAO,OAAO;AAChB;AASO,SAAS,eAAe,OAAuC;AACpE,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,OAAiB,CAAC;AACxB,aAAW,OAAO,MAAM,MAAM,OAAO,GAAG;AACtC,UAAM,UAAU,IAAI,KAAK,EAAE,YAAY;AACvC,QAAI,CAAC,QAAS;AACd,QAAI,KAAK,IAAI,OAAO,EAAG;AACvB,SAAK,IAAI,OAAO;AAChB,SAAK,KAAK,OAAO;AAAA,EACnB;AACA,SAAO,KAAK,SAAS,IAAI,OAAO;AAClC;AASO,SAAS,gBAAgB,GAAoB;AAClD,QAAM,KAAK,EAAE,QAAQ,GAAG;AACxB,MAAI,KAAK,KAAK,OAAO,EAAE,YAAY,GAAG,EAAG,QAAO;AAChD,QAAM,QAAQ,EAAE,MAAM,GAAG,EAAE;AAC3B,QAAM,SAAS,EAAE,MAAM,KAAK,CAAC;AAC7B,MAAI,CAAC,SAAS,CAAC,OAAQ,QAAO;AAC9B,MAAI,CAAC,OAAO,SAAS,GAAG,EAAG,QAAO;AAClC,MAAI,KAAK,KAAK,CAAC,EAAG,QAAO;AACzB,SAAO;AACT;","names":[]}