@reddoorla/maintenance 0.6.7 → 0.7.0

package/dist/index.js

@@ -841,6 +841,65 @@ async function commit(cwd, message) {
   return sha.trim();
 }
 
+// src/recipes/_with-recipe.ts
+async function withRecipe(body) {
+  const label = siteLabel(body.site);
+  if (body.checkTreeFirst && !await isWorkingTreeClean(body.site.path)) {
+    throw new Error(`refusing to run: working tree is not clean at ${body.site.path}`);
+  }
+  const planned = await body.plan();
+  if (planned.kind === "noop") {
+    return {
+      recipe: body.name,
+      site: label,
+      status: "noop",
+      commits: [],
+      ...planned.notes ? { notes: planned.notes } : {}
+    };
+  }
+  if (planned.kind === "failed") {
+    return {
+      recipe: body.name,
+      site: label,
+      status: "failed",
+      commits: [],
+      notes: planned.notes
+    };
+  }
+  if (!body.checkTreeFirst && !await isWorkingTreeClean(body.site.path)) {
+    throw new Error(`refusing to run: working tree is not clean at ${body.site.path}`);
+  }
+  const branch = branchName(body.name);
+  await createBranch(body.site.path, branch);
+  const shas = [];
+  const result = await body.apply(planned.plan, {
+    cwd: body.site.path,
+    branch,
+    commit: async (msg) => {
+      const sha = await commit(body.site.path, msg);
+      if (sha) shas.push(sha);
+      return sha;
+    }
+  });
+  if (result.kind === "failed") {
+    return {
+      recipe: body.name,
+      site: label,
+      status: "failed",
+      commits: shas,
+      notes: result.notes
+    };
+  }
+  const notes = result.notes ? `${result.notes}; branch: ${branch}` : `branch: ${branch}`;
+  return {
+    recipe: body.name,
+    site: label,
+    status: shas.length > 0 ? "applied" : "noop",
+    commits: shas,
+    notes
+  };
+}
+
 // src/recipes/sync-configs.ts
 var GITIGNORE_CONFIG = "gitignore";
 async function readMaybe(path) {
@@ -873,48 +932,33 @@ async function applyGitignore(cwd, plan) {
   }
 }
 async function syncConfigs(site, opts = {}) {
-  const label = siteLabel(site);
   const requested = opts.which ?? ALL_TEMPLATES.map((t) => t.config).concat(GITIGNORE_CONFIG);
   const templateNames = requested.filter((c) => c !== GITIGNORE_CONFIG);
   const templates = templatesByName(templateNames);
   const includeGitignore = requested.includes(GITIGNORE_CONFIG);
-  const templateDiffs = await planTemplateDiffs(site.path, templates);
-  const gitignorePlan = includeGitignore ? await planGitignore(site.path) : { kind: "noop" };
-  if (templateDiffs.length === 0 && gitignorePlan.kind === "noop") {
-    return {
-      recipe: "sync-configs",
-      site: label,
-      status: "noop",
-      commits: [],
-      notes: "all targeted configs already match"
-    };
-  }
-  if (!await isWorkingTreeClean(site.path)) {
-    throw new Error(`refusing to run: working tree is not clean at ${site.path}`);
-  }
-  const branch = branchName("sync-configs");
-  await createBranch(site.path, branch);
-  const shas = [];
-  for (const t of templateDiffs) {
-    await writeFile3(join5(site.path, t.path), t.contents, "utf-8");
-    const sha = await commit(
-      site.path,
-      `chore: sync ${t.config} config from @reddoorla/maintenance`
-    );
-    if (sha) shas.push(sha);
-  }
-  if (gitignorePlan.kind === "apply") {
-    await applyGitignore(site.path, gitignorePlan);
-    const sha = await commit(site.path, `chore: sync gitignore from @reddoorla/maintenance`);
-    if (sha) shas.push(sha);
-  }
-  return {
-    recipe: "sync-configs",
-    site: label,
-    status: "applied",
-    commits: shas,
-    notes: `branch: ${branch}`
-  };
+  return withRecipe({
+    name: "sync-configs",
+    site,
+    plan: async () => {
+      const templateDiffs = await planTemplateDiffs(site.path, templates);
+      const gitignorePlan = includeGitignore ? await planGitignore(site.path) : { kind: "noop" };
+      if (templateDiffs.length === 0 && gitignorePlan.kind === "noop") {
+        return { kind: "noop", notes: "all targeted configs already match" };
+      }
+      return { kind: "apply", plan: { templateDiffs, gitignorePlan } };
+    },
+    apply: async ({ templateDiffs, gitignorePlan }, { commit: commit2 }) => {
+      for (const t of templateDiffs) {
+        await writeFile3(join5(site.path, t.path), t.contents, "utf-8");
+        await commit2(`chore: sync ${t.config} config from @reddoorla/maintenance`);
+      }
+      if (gitignorePlan.kind === "apply") {
+        await applyGitignore(site.path, gitignorePlan);
+        await commit2(`chore: sync gitignore from @reddoorla/maintenance`);
+      }
+      return { kind: "ok" };
+    }
+  });
 }
 
 // src/recipes/bump-deps.ts
@@ -938,62 +982,51 @@ function upFlagsForGroup(group) {
   return [];
 }
 async function bumpDeps(site, opts = {}) {
-  const label = siteLabel(site);
   const group = opts.group ?? "minor";
   const spawn2 = opts.spawn ?? defaultSpawn;
-  const hasPnpmLock = await exists(join6(site.path, "pnpm-lock.yaml"));
-  if (!hasPnpmLock) {
-    const hasNpmLock = await exists(join6(site.path, "package-lock.json"));
-    const hasYarnLock = await exists(join6(site.path, "yarn.lock"));
-    if (hasNpmLock || hasYarnLock) {
-      const competing = hasNpmLock ? "package-lock.json" : "yarn.lock";
-      return {
-        recipe: "bump-deps",
-        site: label,
-        status: "failed",
-        commits: [],
-        notes: `site has ${competing} but no pnpm-lock.yaml \u2014 run convert-to-pnpm first`
-      };
+  return withRecipe({
+    name: "bump-deps",
+    site,
+    // pnpm install (in plan) mutates the lockfile, so the clean-tree check
+    // MUST happen first — otherwise a desynced-lockfile resync would silently
+    // land on top of whatever else was in the tree.
+    checkTreeFirst: true,
+    plan: async () => {
+      const hasPnpmLock = await exists(join6(site.path, "pnpm-lock.yaml"));
+      if (!hasPnpmLock) {
+        const hasNpmLock = await exists(join6(site.path, "package-lock.json"));
+        const hasYarnLock = await exists(join6(site.path, "yarn.lock"));
+        if (hasNpmLock || hasYarnLock) {
+          const competing = hasNpmLock ? "package-lock.json" : "yarn.lock";
+          return {
+            kind: "failed",
+            notes: `site has ${competing} but no pnpm-lock.yaml \u2014 run convert-to-pnpm first`
+          };
+        }
+      }
+      await spawn2("pnpm", ["install"], { cwd: site.path, streaming: true });
+      const outdated = await spawn2(
+        "pnpm",
+        ["outdated", "--json", ...outdatedFlagsForGroup(group)],
+        { cwd: site.path }
+      );
+      let parsed;
+      try {
+        parsed = JSON.parse(outdated.stdout || "{}");
+      } catch {
+        parsed = {};
+      }
+      if (Object.keys(parsed).length === 0) {
+        return { kind: "noop", notes: `pnpm outdated reported nothing for group=${group}` };
+      }
+      return { kind: "apply", plan: { group } };
+    },
+    apply: async ({ group: g }, { commit: commit2, cwd }) => {
+      await spawn2("pnpm", ["up", ...upFlagsForGroup(g)], { cwd, streaming: true });
+      await commit2(`chore(deps): bump dependencies (${g})`);
+      return { kind: "ok" };
     }
-  }
-  if (!await isWorkingTreeClean(site.path)) {
-    throw new Error(`refusing to run: working tree is not clean at ${site.path}`);
-  }
-  await spawn2("pnpm", ["install"], { cwd: site.path, streaming: true });
-  const outdated = await spawn2("pnpm", ["outdated", "--json", ...outdatedFlagsForGroup(group)], {
-    cwd: site.path
   });
-  let parsed;
-  try {
-    parsed = JSON.parse(outdated.stdout || "{}");
-  } catch {
-    parsed = {};
-  }
-  const nothingToDo = Object.keys(parsed).length === 0;
-  if (nothingToDo) {
-    return {
-      recipe: "bump-deps",
-      site: label,
-      status: "noop",
-      commits: [],
-      notes: `pnpm outdated reported nothing for group=${group}`
-    };
-  }
-  const branch = branchName("bump-deps");
-  await createBranch(site.path, branch);
-  await spawn2("pnpm", ["up", ...upFlagsForGroup(group)], {
-    cwd: site.path,
-    streaming: true
-  });
-  const sha = await commit(site.path, `chore(deps): bump dependencies (${group})`);
-  const shas = sha ? [sha] : [];
-  return {
-    recipe: "bump-deps",
-    site: label,
-    status: shas.length > 0 ? "applied" : "noop",
-    commits: shas,
-    notes: `branch: ${branch}`
-  };
 }
 
 // src/recipes/svelte-5/index.ts
@@ -1573,108 +1606,73 @@ async function alreadyOnSvelte5(cwd) {
   }
 }
 async function upgradeSvelte4to5(site, opts = {}) {
-  const label = siteLabel(site);
   const spawn2 = opts.spawn ?? defaultSpawn;
-  if (await alreadyOnSvelte5(site.path)) {
-    return {
-      recipe: "svelte-4-to-5",
-      site: label,
-      status: "noop",
-      commits: [],
-      notes: "site already declares svelte ^5.x"
-    };
-  }
-  if (!await isWorkingTreeClean(site.path)) {
-    throw new Error(`refusing to run: working tree is not clean at ${site.path}`);
-  }
-  const branch = branchName("svelte-4-to-5");
-  await createBranch(site.path, branch);
-  const shas = [];
-  const bumped = await bumpToSvelte5Versions(site.path);
-  if (bumped) {
-    const sha = await commit(site.path, "chore(svelte5): bump svelte/kit/vite/vite-plugin-svelte");
-    if (sha) shas.push(sha);
-  }
-  const configChanged = await migrateSvelteConfig(site.path);
-  if (configChanged) {
-    const sha = await commit(
-      site.path,
-      "refactor(svelte5): migrate svelte.config.js (drop vitePreprocess)"
-    );
-    if (sha) shas.push(sha);
-  }
-  const migrate = await runSvelteMigrate(site.path, spawn2);
-  if (migrate.ran) {
-    const sha = await commit(site.path, "refactor(svelte5): run official svelte-migrate codemod");
-    if (sha) shas.push(sha);
-  }
-  const tw = await upgradeTailwind(site.path, spawn2);
-  if (tw.ran) {
-    const sha = await commit(site.path, "chore(svelte5): tailwindcss 3 \u2192 4 upgrade");
-    if (sha) shas.push(sha);
-  }
-  const codemods = await applyGotchaCodemods(site.path);
-  if (codemods.filesChanged > 0) {
-    const sha = await commit(
-      site.path,
-      `refactor(svelte5): apply gotcha codemods (${codemods.filesChanged} files)`
-    );
-    if (sha) shas.push(sha);
-  }
-  await verifyMigration(site.path, spawn2);
-  const verifySha = await commit(site.path, "chore(svelte5): pnpm install + check");
-  if (verifySha) shas.push(verifySha);
-  await writeMigrationSummary({
-    cwd: site.path,
-    filesChangedByCodemods: codemods.filesChanged,
-    svelteMigrateRan: migrate.ran,
-    tailwindUpgraded: tw.ran
+  return withRecipe({
+    name: "svelte-4-to-5",
+    site,
+    plan: async () => {
+      if (await alreadyOnSvelte5(site.path)) {
+        return { kind: "noop", notes: "site already declares svelte ^5.x" };
+      }
+      return { kind: "apply", plan: true };
+    },
+    apply: async (_plan, { commit: commit2, cwd }) => {
+      const bumped = await bumpToSvelte5Versions(cwd);
+      if (bumped) {
+        await commit2("chore(svelte5): bump svelte/kit/vite/vite-plugin-svelte");
+      }
+      const configChanged = await migrateSvelteConfig(cwd);
+      if (configChanged) {
+        await commit2("refactor(svelte5): migrate svelte.config.js (drop vitePreprocess)");
+      }
+      const migrate = await runSvelteMigrate(cwd, spawn2);
+      if (migrate.ran) {
+        await commit2("refactor(svelte5): run official svelte-migrate codemod");
+      }
+      const tw = await upgradeTailwind(cwd, spawn2);
+      if (tw.ran) {
+        await commit2("chore(svelte5): tailwindcss 3 \u2192 4 upgrade");
+      }
+      const codemods = await applyGotchaCodemods(cwd);
+      if (codemods.filesChanged > 0) {
+        await commit2(`refactor(svelte5): apply gotcha codemods (${codemods.filesChanged} files)`);
+      }
+      await verifyMigration(cwd, spawn2);
+      await commit2("chore(svelte5): pnpm install + check");
+      await writeMigrationSummary({
+        cwd,
+        filesChangedByCodemods: codemods.filesChanged,
+        svelteMigrateRan: migrate.ran,
+        tailwindUpgraded: tw.ran
+      });
+      await commit2("docs(svelte5): add MIGRATION_SVELTE_5.md summary");
+      return { kind: "ok" };
+    }
   });
-  const summarySha = await commit(site.path, "docs(svelte5): add MIGRATION_SVELTE_5.md summary");
-  if (summarySha) shas.push(summarySha);
-  return {
-    recipe: "svelte-4-to-5",
-    site: label,
-    status: shas.length > 0 ? "applied" : "noop",
-    commits: shas,
-    notes: `branch: ${branch}`
-  };
 }
 
 // src/recipes/svelte-codemods.ts
 import { writeFile as writeFile8 } from "fs/promises";
 import { join as join13 } from "path";
 async function svelteCodemods(site) {
-  const label = siteLabel(site);
-  const changes = await planGotchaCodemods(site.path);
-  if (changes.length === 0) {
-    return {
-      recipe: "svelte-codemods",
-      site: label,
-      status: "noop",
-      commits: [],
-      notes: "no codemod targets matched"
-    };
-  }
-  if (!await isWorkingTreeClean(site.path)) {
-    throw new Error(`refusing to run: working tree is not clean at ${site.path}`);
-  }
-  const branch = branchName("svelte-codemods");
-  await createBranch(site.path, branch);
-  for (const c of changes) {
-    await writeFile8(join13(site.path, c.rel), c.after, "utf-8");
-  }
-  const sha = await commit(
-    site.path,
-    `refactor(svelte5): apply codemods (${changes.length} files)`
-  );
-  return {
-    recipe: "svelte-codemods",
-    site: label,
-    status: "applied",
-    commits: sha ? [sha] : [],
-    notes: `branch: ${branch}`
-  };
+  return withRecipe({
+    name: "svelte-codemods",
+    site,
+    plan: async () => {
+      const changes = await planGotchaCodemods(site.path);
+      if (changes.length === 0) {
+        return { kind: "noop", notes: "no codemod targets matched" };
+      }
+      return { kind: "apply", plan: changes };
+    },
+    apply: async (changes, { commit: commit2, cwd }) => {
+      for (const c of changes) {
+        await writeFile8(join13(cwd, c.rel), c.after, "utf-8");
+      }
+      await commit2(`refactor(svelte5): apply codemods (${changes.length} files)`);
+      return { kind: "ok" };
+    }
+  });
 }
 
 // src/recipes/convert-to-pnpm.ts
@@ -1710,80 +1708,55 @@ async function exists2(path) {
   }
 }
 async function convertToPnpm(site, opts = {}) {
-  const label = siteLabel(site);
   const spawn2 = opts.spawn ?? defaultSpawn;
   const pnpmVersion = opts.pnpmVersion ?? DEFAULT_PNPM_VERSION;
   const pnpmLockPath = join14(site.path, "pnpm-lock.yaml");
   const npmLockPath = join14(site.path, "package-lock.json");
   const yarnLockPath = join14(site.path, "yarn.lock");
-  if (await exists2(pnpmLockPath)) {
-    return {
-      recipe: "convert-to-pnpm",
-      site: label,
-      status: "noop",
-      commits: [],
-      notes: "site already has pnpm-lock.yaml"
-    };
-  }
-  const hasNpmLock = await exists2(npmLockPath);
-  const hasYarnLock = await exists2(yarnLockPath);
-  if (!hasNpmLock && !hasYarnLock) {
-    return {
-      recipe: "convert-to-pnpm",
-      site: label,
-      status: "noop",
-      commits: [],
-      notes: "no convertible lockfile (package-lock.json or yarn.lock) at site root"
-    };
-  }
-  if (!await isWorkingTreeClean(site.path)) {
-    throw new Error(`refusing to run: working tree is not clean at ${site.path}`);
-  }
-  const branch = branchName("convert-to-pnpm");
-  await createBranch(site.path, branch);
-  const shas = [];
-  if (hasNpmLock) await rm3(npmLockPath, { force: true });
-  if (hasYarnLock) await rm3(yarnLockPath, { force: true });
-  const sourceLock = hasNpmLock ? "package-lock.json" : "yarn.lock";
-  const lockSha = await commit(site.path, `chore(pnpm): remove ${sourceLock}`);
-  if (lockSha) shas.push(lockSha);
-  const pkgPath = join14(site.path, "package.json");
-  const pkg = await readPackageJson(pkgPath);
-  const next = { ...pkg, packageManager: `pnpm@${pnpmVersion}` };
-  if (pkg.scripts && typeof pkg.scripts === "object") {
-    const { scripts: rewritten, changedCount } = rewriteScriptsForPnpm(
-      pkg.scripts
-    );
-    if (changedCount > 0) {
-      next.scripts = rewritten;
+  return withRecipe({
+    name: "convert-to-pnpm",
+    site,
+    plan: async () => {
+      if (await exists2(pnpmLockPath)) {
+        return { kind: "noop", notes: "site already has pnpm-lock.yaml" };
+      }
+      const hasNpmLock = await exists2(npmLockPath);
+      const hasYarnLock = await exists2(yarnLockPath);
+      if (!hasNpmLock && !hasYarnLock) {
+        return {
+          kind: "noop",
+          notes: "no convertible lockfile (package-lock.json or yarn.lock) at site root"
+        };
+      }
+      return { kind: "apply", plan: { hasNpmLock, hasYarnLock } };
+    },
+    apply: async ({ hasNpmLock, hasYarnLock }, { commit: commit2, cwd }) => {
+      if (hasNpmLock) await rm3(npmLockPath, { force: true });
+      if (hasYarnLock) await rm3(yarnLockPath, { force: true });
+      const sourceLock = hasNpmLock ? "package-lock.json" : "yarn.lock";
+      await commit2(`chore(pnpm): remove ${sourceLock}`);
+      const pkgPath = join14(cwd, "package.json");
+      const pkg = await readPackageJson(pkgPath);
+      const next = { ...pkg, packageManager: `pnpm@${pnpmVersion}` };
+      if (pkg.scripts && typeof pkg.scripts === "object") {
+        const { scripts: rewritten, changedCount } = rewriteScriptsForPnpm(
+          pkg.scripts
+        );
+        if (changedCount > 0) {
+          next.scripts = rewritten;
+        }
+      }
+      await writePackageJson(pkgPath, next);
+      await commit2("chore(pnpm): pin packageManager + rewrite npm scripts");
+      await rm3(join14(cwd, "node_modules"), { recursive: true, force: true });
+      const installResult = await spawn2("pnpm", ["install"], { cwd, streaming: true });
+      if (installResult.code !== 0) {
+        return { kind: "failed", notes: `pnpm install failed (exit ${installResult.code})` };
+      }
+      await commit2("chore(pnpm): add pnpm-lock.yaml");
+      return { kind: "ok" };
     }
-  }
-  await writePackageJson(pkgPath, next);
-  const pkgSha = await commit(site.path, "chore(pnpm): pin packageManager + rewrite npm scripts");
-  if (pkgSha) shas.push(pkgSha);
-  await rm3(join14(site.path, "node_modules"), { recursive: true, force: true });
-  const installResult = await spawn2("pnpm", ["install"], {
-    cwd: site.path,
-    streaming: true
   });
-  if (installResult.code !== 0) {
-    return {
-      recipe: "convert-to-pnpm",
-      site: label,
-      status: "failed",
-      commits: shas,
-      notes: `pnpm install failed (exit ${installResult.code}). branch ${branch} left for inspection.`
-    };
-  }
-  const installSha = await commit(site.path, "chore(pnpm): add pnpm-lock.yaml");
-  if (installSha) shas.push(installSha);
-  return {
-    recipe: "convert-to-pnpm",
-    site: label,
-    status: "applied",
-    commits: shas,
-    notes: `branch: ${branch}`
-  };
 }
 
 // src/recipes/onboard.ts
@@ -1840,74 +1813,59 @@ function isDeclared(pkg, name) {
   return Boolean(pkg.dependencies?.[name] ?? pkg.devDependencies?.[name]);
 }
 async function onboard(site, opts = {}) {
-  const label = siteLabel(site);
   const spawn2 = opts.spawn ?? defaultSpawn;
   const audits = opts.audits ?? ["lighthouse", "a11y"];
   const packageVersion = opts.packageVersion ?? selfCaretRange(import.meta.url);
-  if (!await exists3(join16(site.path, "pnpm-lock.yaml"))) {
-    return {
-      recipe: "onboard",
-      site: label,
-      status: "failed",
-      commits: [],
-      notes: "no pnpm-lock.yaml at site root \u2014 run convert-to-pnpm first"
-    };
-  }
-  const pkgPath = join16(site.path, "package.json");
-  const pkg = await readPackageJson(pkgPath);
-  const toAdd = [];
-  if (!isDeclared(pkg, PACKAGE_NAME)) {
-    toAdd.push({ name: PACKAGE_NAME, version: packageVersion });
-  }
-  for (const audit of audits) {
-    for (const dep of AUDIT_DEPS[audit]) {
-      if (!isDeclared(pkg, dep.name)) toAdd.push(dep);
+  return withRecipe({
+    name: "onboard",
+    site,
+    plan: async () => {
+      if (!await exists3(join16(site.path, "pnpm-lock.yaml"))) {
+        return {
+          kind: "failed",
+          notes: "no pnpm-lock.yaml at site root \u2014 run convert-to-pnpm first"
+        };
+      }
+      const pkgPath = join16(site.path, "package.json");
+      const pkg = await readPackageJson(pkgPath);
+      const toAdd = [];
+      if (!isDeclared(pkg, PACKAGE_NAME)) {
+        toAdd.push({ name: PACKAGE_NAME, version: packageVersion });
+      }
+      for (const audit of audits) {
+        for (const dep of AUDIT_DEPS[audit]) {
+          if (!isDeclared(pkg, dep.name)) toAdd.push(dep);
+        }
+      }
+      if (toAdd.length === 0) {
+        return {
+          kind: "noop",
+          notes: `site already has ${PACKAGE_NAME} and audit deps (${audits.join("+")})`
+        };
+      }
+      return { kind: "apply", plan: { pkg, toAdd } };
+    },
+    apply: async ({ pkg, toAdd }, { commit: commit2, cwd }) => {
+      const pkgPath = join16(cwd, "package.json");
+      let next = pkg;
+      for (const dep of toAdd) {
+        next = bumpDep(next, dep.name, dep.version);
+      }
+      await writePackageJson(pkgPath, next);
+      const installResult = await spawn2("pnpm", ["install"], { cwd, streaming: true });
+      if (installResult.code !== 0) {
+        return {
+          kind: "failed",
+          notes: `pnpm install failed (exit ${installResult.code})`
+        };
+      }
+      await commit2(`chore(reddoor): onboard with ${PACKAGE_NAME} ${packageVersion}`);
+      return {
+        kind: "ok",
+        notes: `Added ${toAdd.length} dep(s): ${toAdd.map((d) => d.name).join(", ")}`
+      };
     }
-  }
-  if (toAdd.length === 0) {
-    return {
-      recipe: "onboard",
-      site: label,
-      status: "noop",
-      commits: [],
-      notes: `site already has ${PACKAGE_NAME} and audit deps (${audits.join("+")})`
-    };
-  }
-  if (!await isWorkingTreeClean(site.path)) {
-    throw new Error(`refusing to run: working tree is not clean at ${site.path}`);
-  }
-  const branch = branchName("onboard");
-  await createBranch(site.path, branch);
-  let next = pkg;
-  for (const dep of toAdd) {
-    next = bumpDep(next, dep.name, dep.version);
-  }
-  await writePackageJson(pkgPath, next);
-  const installResult = await spawn2("pnpm", ["install"], {
-    cwd: site.path,
-    streaming: true
   });
-  if (installResult.code !== 0) {
-    return {
-      recipe: "onboard",
-      site: label,
-      status: "failed",
-      commits: [],
-      notes: `pnpm install failed (exit ${installResult.code}). branch ${branch} left for inspection.`
-    };
-  }
-  const sha = await commit(
-    site.path,
-    `chore(reddoor): onboard with ${PACKAGE_NAME} ${packageVersion}`
-  );
-  const shas = sha ? [sha] : [];
-  return {
-    recipe: "onboard",
-    site: label,
-    status: "applied",
-    commits: shas,
-    notes: `branch: ${branch}. Added ${toAdd.length} dep(s): ${toAdd.map((d) => d.name).join(", ")}`
-  };
 }
 
 // src/recipes/index.ts
@@ -1965,6 +1923,638 @@ function fromJsonFile(path) {
     return validate(raw);
   };
 }
+
+// src/reports/draft.ts
+import { mkdir, writeFile as writeFile9 } from "fs/promises";
+import { dirname as dirname2 } from "path";
+
+// src/reports/render.ts
+import mjml2html from "mjml";
+
+// src/reports/maintenance-email/template.ts
+var CHECK_PNG = "https://d3eq0h5l8sxf6t.cloudfront.net/maintenance-email/check.png";
+var BLURRED_TESTS = "https://d3eq0h5l8sxf6t.cloudfront.net/maintenance-email/blurredTests.jpg";
+function fmtDate(d) {
+  if (!d) return "";
+  const mm = String(d.getUTCMonth() + 1).padStart(2, "0");
+  const dd = String(d.getUTCDate()).padStart(2, "0");
+  const yyyy = d.getUTCFullYear();
+  return `${mm}.${dd}.${yyyy}`;
+}
+function fmtUsers(n) {
+  return n.toLocaleString("en-US");
+}
+function maintenanceChecksSection() {
+  const rows = [
+    "Reviewed Logs",
+    "CMS Checked",
+    "DNS Checked",
+    "Google Indexed",
+    "Reviewed Certificate",
+    "Security Updates"
+  ];
+  return rows.map(
+    (label, i) => `
+    <mj-section background-color="white" padding="0px"${i === rows.length - 1 ? ' padding-bottom="36px"' : ""}>
+      <mj-group>
+        <mj-column padding-left="0px" width="90%"${i < rows.length - 1 ? ' border-bottom="solid #CCCCCC 1px"' : ""}>
+          <mj-text height="25px" padding-left="0px" color="#757575" padding-top="20px" padding-bottom="7.5px" font-size="16px">${label}</mj-text>
+        </mj-column>
+        <mj-column width="10%"${i < rows.length - 1 ? ' border-bottom="solid #CCCCCC 1px"' : ""} padding-top="15px">
+          <mj-image align="right" padding-right="0px" width="20px" height="20px" padding-top="2.5px" padding-bottom="15px" src="${CHECK_PNG}" />
+        </mj-column>
+      </mj-group>
+    </mj-section>`
+  ).join("");
+}
+function testingChecklistSection() {
+  const rows = [
+    "Desktop Browsers",
+    "Mobile Browsers",
+    "Package Updates",
+    "Bottlenecks",
+    "Form Functionality",
+    "Animation Functionality"
+  ];
+  return rows.map(
+    (label, i) => `
+    <mj-section background-color="#F4F4F4" padding="0px"${i === rows.length - 1 ? ' padding-bottom="60px"' : ""}>
+      <mj-group>
+        <mj-column width="90%" padding-left="0px"${i < rows.length - 1 ? ' border-bottom="solid #CCCCCC 1px"' : ""}>
+          <mj-text height="25px" padding-left="0px" color="#757575" padding-top="20px" padding-bottom="7.5px" font-size="16px">${label}</mj-text>
+        </mj-column>
+        <mj-column width="10%"${i < rows.length - 1 ? ' border-bottom="solid #CCCCCC 1px"' : ""} padding-top="15px">
+          <mj-image align="right" padding-right="0px" width="20px" height="20px" padding-top="2.5px" padding-bottom="15px" src="${CHECK_PNG}" />
+        </mj-column>
+      </mj-group>
+    </mj-section>`
+  ).join("");
+}
+function maintenanceTestingPlaceholder(lastTested) {
+  return `
+    <mj-section background-color="#F4F4F4">
+      <mj-column>
+        <mj-image href="mailto:info@reddoorla.com" src="${BLURRED_TESTS}" />
+      </mj-column>
+    </mj-section>
+    <mj-section background-color="#F4F4F4" padding-top="0px">
+      <mj-column>
+        <mj-text color="#757575" font-family="helvetica, sans-serif" font-size="16px" font-weight="300" line-height="24px">Last Tested: ${fmtDate(lastTested)}</mj-text>
+      </mj-column>
+    </mj-section>`;
+}
+function testingIntroSection() {
+  return `
+    <mj-section background-color="#F4F4F4">
+      <mj-column>
+        <mj-text color="#C00" font-size="20px" font-weight="700" padding-top="75px">TESTING</mj-text>
+        <mj-text color="#757575" font-family="helvetica, sans-serif" font-size="16px" font-weight="300" line-height="24px">Testing includes checks similar to those at launch: testing on common browsers and operating systems, at different screen sizes, and checking every function, and updating all packages for performance rather than just those needed for security.</mj-text>
+      </mj-column>
+    </mj-section>`;
+}
+function commentarySection(text) {
+  return `
+    <mj-section background-color="white">
+      <mj-column>
+        <mj-text color="#C00" font-size="20px" font-weight="700" padding-top="55px">NOTES</mj-text>
+        <mj-text color="#757575" font-family="helvetica, sans-serif" font-size="16px" font-weight="300" line-height="24px">${text.replace(/\n/g, "<br/>")}</mj-text>
+      </mj-column>
+    </mj-section>`;
+}
+function buildMjml(data) {
+  const isTesting = data.reportType === "Testing";
+  const headerSrc = `cid:${data.headerImageCid}`;
+  const previewText = `Checked up on ${data.siteName}`;
+  return `<mjml>
+  <mj-head>
+    <mj-attributes>
+      <mj-text font-family="helvetica, sans-serif" padding-left="5px" padding-right="5px" />
+      <mj-section padding-left="11%" padding-right="11%"/>
+      <mj-image padding="0px" />
+    </mj-attributes>
+    <mj-preview>${previewText}</mj-preview>
+  </mj-head>
+  <mj-body background-color="white">
+    <mj-section background-color="#F4F4F4" padding-top="0px" padding-bottom="0px" padding-left="0px" padding-right="0px">
+      <mj-column>
+        <mj-image href="${data.siteUrl}" src="${headerSrc}" />
+      </mj-column>
+    </mj-section>
+    <mj-section background-color="white">
+      <mj-column>
+        <mj-text color="#C00" font-size="20px" font-weight="700" padding-top="75px">COMPLETED ON</mj-text>
+        <mj-text color="#C00" font-size="44px" font-weight="400">${fmtDate(data.completedOn)}</mj-text>
+        <mj-text color="#C00" font-size="20px" font-weight="700" padding-top="75px">MAINTENANCE CHECKS</mj-text>
+        <mj-text color="#757575" font-family="helvetica, sans-serif" font-size="16px" font-weight="300" line-height="24px">Includes checking the hosting, DNS, Content Management System (CMS, if applicable), search indexing and security of the site for major flaws and updating as necessary.</mj-text>
+      </mj-column>
+    </mj-section>
+    ${maintenanceChecksSection()}
+    <mj-section background-color="#F4F4F4">
+      <mj-column>
+        <mj-text color="#C00" font-size="20px" font-weight="700" padding-top="55px">LIGHTHOUSE SCORES*</mj-text>
+        <mj-text color="#C00" font-size="20px" font-weight="300" padding-top="25px">Performance</mj-text>
+        <mj-text color="#C00" font-size="44px" font-weight="400" padding-top="0px">${data.lighthouse.performance}</mj-text>
+        <mj-text color="#757575" font-family="helvetica, sans-serif" font-size="12px" font-weight="300" padding-top="0px" padding-bottom="36px">Acceptable 50\u201389 // Ideal 90\u2013100</mj-text>
+        <mj-divider border-width="1px" border-style="solid" border-color="#CCCCCC" padding="0" />
+        <mj-text color="#C00" font-size="20px" font-weight="300" padding-top="25px">Readability</mj-text>
+        <mj-text color="#C00" font-size="44px" font-weight="400" padding-top="0px">${data.lighthouse.accessibility}</mj-text>
+        <mj-text color="#757575" font-family="helvetica, sans-serif" font-size="12px" font-weight="300" padding-top="0px" padding-bottom="36px">Acceptable 80\u201399 // Ideal 100</mj-text>
+        <mj-divider border-width="1px" border-style="solid" border-color="#CCCCCC" padding="0" />
+        <mj-text color="#C00" font-size="20px" font-weight="300" padding-top="25px">Best Practices</mj-text>
+        <mj-text color="#C00" font-size="44px" font-weight="400" padding-top="0px">${data.lighthouse.bestPractices}</mj-text>
+        <mj-text color="#757575" font-family="helvetica, sans-serif" font-size="12px" font-weight="300" padding-top="0px" padding-bottom="36px">Acceptable 60\u201379 // Ideal 80\u201392</mj-text>
+        <mj-divider border-width="1px" border-style="solid" border-color="#CCCCCC" padding="0" />
+        <mj-text color="#C00" font-size="20px" font-weight="300" padding-top="25px">Site Structure</mj-text>
+        <mj-text color="#C00" font-size="44px" font-weight="400" padding-top="0px">${data.lighthouse.seo}</mj-text>
+        <mj-text color="#757575" font-family="helvetica, sans-serif" font-size="12px" font-weight="300" padding-top="0px" padding-bottom="36px">Acceptable 50\u201389 // Ideal 90\u2013100</mj-text>
+        <mj-text color="#757575" font-family="helvetica, sans-serif" font-size="12px" font-weight="300" padding-top="24px" padding-bottom="36px" line-height="20px">*A Lighthouse score is a numerical measure provided by Google's Lighthouse tool, which evaluates various aspects of a web page's quality.</mj-text>
+      </mj-column>
+    </mj-section>
+    <mj-section background-color="white">
+      <mj-column>
+        <mj-text color="#C00" font-size="20px" font-weight="700" padding-top="75px">ANALYTICS</mj-text>
+        <mj-text color="#C00" font-size="44px" font-weight="400">${fmtUsers(data.gaUsersCurrent)} Users</mj-text>
+        <mj-text color="#757575" font-family="helvetica, sans-serif" font-size="16px" font-weight="300" line-height="24px">Last Period: ${fmtUsers(data.gaUsersPrevious)}</mj-text>
+        <mj-text color="#757575" font-family="helvetica, sans-serif" font-size="12px" font-weight="300" padding-top="24px" padding-bottom="36px" line-height="20px">Contact us if you are interested in more in-depth data or have questions about SEO.</mj-text>
+      </mj-column>
+    </mj-section>
+    ${isTesting ? testingIntroSection() + testingChecklistSection() : maintenanceTestingPlaceholder(data.lastTestedDate)}
+    ${data.commentary ? commentarySection(data.commentary) : ""}
+    <mj-section background-color="white">
+      <mj-column padding-top="36px">
+        <mj-text color="#C00" font-family="helvetica, sans-serif" font-size="24px" font-weight="700" padding-top="36px" line-height="36px">Any questions, concerns or requests?</mj-text>
+        <mj-text font-family="helvetica, sans-serif" font-size="24px" font-weight="300" line-height="30px">Just hit reply.</mj-text>
+        <mj-text font-family="helvetica, sans-serif" font-size="24px" font-weight="300" padding-top="0px" line-height="30px" padding-bottom="36px">We're here to help in any way we can.</mj-text>
+        <mj-divider border-width="1px" border-style="solid" border-color="#CCCCCC" padding="0" />
+        <mj-text color="#757575" font-family="helvetica, sans-serif" font-size="12px" font-weight="300" padding-top="24px" line-height="20px" font-style="italic">Copyright ${(/* @__PURE__ */ new Date()).getFullYear()} Reddoor Creative, LLC. All rights reserved.</mj-text>
+        <mj-text color="#757575" font-family="helvetica, sans-serif" font-size="12px" font-weight="700" line-height="16px" padding-top="0" padding-bottom="0px">Our mailing address is:</mj-text>
+        <mj-text color="#757575" font-family="helvetica, sans-serif" font-size="12px" font-weight="300" line-height="16px" padding-top="0" padding-bottom="0px">Reddoor Creative, LLC</mj-text>
+        <mj-text color="#757575" font-family="helvetica, sans-serif" font-size="12px" font-weight="300" line-height="16px" padding-top="0" padding-bottom="0px">29027 Dapper Dan</mj-text>
+        <mj-text color="#757575" font-family="helvetica, sans-serif" font-size="12px" font-weight="300" line-height="16px" padding-top="0" padding-bottom="0px">Fair Oaks Ranch, TX 78015</mj-text>
+      </mj-column>
+    </mj-section>
+  </mj-body>
+</mjml>`;
+}
+
+// src/reports/render.ts
+async function renderReportHtml(data) {
+  const mjml = buildMjml(data);
+  const out = await mjml2html(mjml, { validationLevel: "strict" });
+  return { html: out.html, warnings: out.errors ?? [] };
+}
+
+// src/reports/airtable/websites.ts
+var WEBSITES_TABLE = "Websites";
+function siteSlug(name) {
+  return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+}
+function mapRow(rec) {
+  const f = rec.fields;
+  const attachments = f["Header image"] ?? [];
+  const header = attachments[0] ?? null;
+  return {
+    id: rec.id,
+    name: String(f["Name"] ?? ""),
+    url: String(f["url"] ?? ""),
+    pointOfContact: f["point of contact"] ?? null,
+    maintenanceFreq: f["maintenence freq"] ?? "None",
+    testingFreq: f["testing freq"] ?? "None",
+    maintenanceDay: f["maintenance day"] ?? null,
+    testingDay: f["testing day"] ?? null,
+    ga4PropertyId: f["GA4 property ID"] ?? null,
+    reportRecipientsTo: f["Report recipients (To)"] ?? null,
+    reportRecipientsCc: f["Report recipients (CC)"] ?? null,
+    headerImage: header,
+    pScore: f["pScore"] ?? null,
+    rScore: f["rScore"] ?? null,
+    bpScore: f["bpScore"] ?? null,
+    seoScore: f["seoScore"] ?? null
+  };
+}
+async function listWebsites(base) {
+  const out = [];
+  await base(WEBSITES_TABLE).select({ pageSize: 100 }).eachPage((records, fetchNextPage) => {
+    for (const rec of records) out.push(mapRow({ id: rec.id, fields: rec.fields }));
+    fetchNextPage();
+  });
+  return out;
+}
+
+// src/reports/airtable/reports.ts
+var REPORTS_TABLE = "Reports";
+function mapRow2(rec) {
+  const f = rec.fields;
+  const linkSites = f["Site"] ?? [];
+  const html = (f["Rendered HTML"] ?? [])[0] ?? null;
+  return {
+    id: rec.id,
+    reportId: String(f["Report ID"] ?? ""),
+    siteId: linkSites[0] ?? "",
+    reportType: f["Report type"] ?? "Maintenance",
+    periodStart: f["Period start"] ?? null,
+    periodEnd: f["Period end"] ?? null,
+    completedOn: f["Completed on"] ?? null,
+    lighthouse: lighthouseFromFields(f),
+    gaUsersCurrent: f["GA users (period)"] ?? null,
+    gaUsersPrevious: f["GA users (prev period)"] ?? null,
+    lastTestedDate: f["Last tested date"] ?? null,
+    commentary: f["Commentary"] ?? null,
+    subjectOverride: f["Subject override"] ?? null,
+    draftReady: Boolean(f["Draft ready"]),
+    approvedToSend: Boolean(f["Approved to send"]),
+    sentAt: f["Sent at"] ?? null,
+    deliveryStatus: f["Delivery status"] ?? "pending",
+    renderedHtmlAttachment: html,
+    resendMessageId: f["Resend message ID"] ?? null
+  };
+}
+function lighthouseFromFields(f) {
+  const p = f["Lighthouse \u2014 Performance"];
+  const a = f["Lighthouse \u2014 Accessibility"];
+  const b = f["Lighthouse \u2014 Best Practices"];
+  const s = f["Lighthouse \u2014 SEO"];
+  if (typeof p !== "number" || typeof a !== "number" || typeof b !== "number" || typeof s !== "number")
+    return null;
+  return { performance: p, accessibility: a, bestPractices: b, seo: s };
+}
+function ymd(d) {
+  return d.toISOString().slice(0, 10);
+}
+function escapeFormulaString(s) {
+  return s.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+}
+async function createDraft(base, input) {
+  const fields = {
+    "Report ID": input.reportId,
+    Site: [input.siteId],
+    "Report type": input.reportType,
+    "Period start": ymd(input.periodStart),
+    "Period end": ymd(input.periodEnd),
+    "Completed on": ymd(input.completedOn),
+    "Lighthouse \u2014 Performance": input.lighthouse.performance,
+    "Lighthouse \u2014 Accessibility": input.lighthouse.accessibility,
+    "Lighthouse \u2014 Best Practices": input.lighthouse.bestPractices,
+    "Lighthouse \u2014 SEO": input.lighthouse.seo,
+    "Delivery status": "pending"
+  };
+  if (input.lastTestedDate) fields["Last tested date"] = ymd(input.lastTestedDate);
+  const created = await base(REPORTS_TABLE).create([{ fields }]);
+  const rec = created[0];
+  if (!rec) throw new Error("Airtable create returned no records");
+  return mapRow2({ id: rec.id, fields: rec.fields });
+}
+async function setDraftReady(base, recordId, ready) {
+  await base(REPORTS_TABLE).update([{ id: recordId, fields: { "Draft ready": ready } }]);
+}
+async function listSendableReports(base) {
+  const out = [];
+  await base(REPORTS_TABLE).select({
+    filterByFormula: "AND({Draft ready} = TRUE(), {Approved to send} = TRUE(), {Sent at} = BLANK())",
+    pageSize: 100
+  }).eachPage((records, fetchNextPage) => {
+    for (const rec of records) out.push(mapRow2({ id: rec.id, fields: rec.fields }));
+    fetchNextPage();
+  });
+  return out;
+}
+async function listReportsForSite(base, siteId) {
+  const safeId = escapeFormulaString(siteId);
+  const out = [];
+  await base(REPORTS_TABLE).select({
+    filterByFormula: `FIND(",${safeId},", "," & ARRAYJOIN({Site}, ",") & ",") > 0`,
+    pageSize: 100
+  }).eachPage((records, fetchNextPage) => {
+    for (const rec of records) out.push(mapRow2({ id: rec.id, fields: rec.fields }));
+    fetchNextPage();
+  });
+  return out;
+}
+async function stampSent(base, recordId, sentAt, messageId) {
+  await base(REPORTS_TABLE).update([
+    {
+      id: recordId,
+      fields: {
+        "Sent at": sentAt.toISOString(),
+        "Resend message ID": messageId
+      }
+    }
+  ]);
+}
+
+// src/reports/draft.ts
+function scoresFromWebsite(siteRow) {
+  const { pScore, rScore, bpScore, seoScore } = siteRow;
+  if (pScore === null || rScore === null || bpScore === null || seoScore === null) {
+    throw new Error(
+      `Site '${siteRow.name}' is missing one or more Lighthouse scores on the Websites row (pScore, rScore, bpScore, seoScore). Run 'reddoor-maint audit lighthouse' from the site's checkout and paste the four numbers into Airtable, then retry.`
+    );
+  }
+  return { performance: pScore, accessibility: rScore, bestPractices: bpScore, seo: seoScore };
+}
+function daysAgo(today, n) {
+  const out = new Date(today);
+  out.setDate(out.getDate() - n);
+  return out;
+}
+async function draftReportForSite(base, siteRow, reportType, options = {}) {
+  const scores = scoresFromWebsite(siteRow);
+  const today = /* @__PURE__ */ new Date();
+  const slug = siteSlug(siteRow.name);
+  const periodStart = base !== null ? await derivePeriodStart(base, siteRow, reportType, today) : daysAgo(today, 30);
+  const periodEnd = today;
+  const completedOn = today;
+  const lastTestedDate = reportType === "Maintenance" && siteRow.testingDay ? new Date(siteRow.testingDay) : null;
+  const cidName = `${slug}-header`;
+  const { html } = await renderReportHtml({
+    siteName: siteRow.name,
+    siteUrl: siteRow.url,
+    reportType,
+    completedOn,
+    lighthouse: scores,
+    gaUsersCurrent: 0,
+    gaUsersPrevious: 0,
+    lastTestedDate,
+    commentary: null,
+    headerImageCid: cidName
+  });
+  if (options.previewOnly) {
+    const path = options.previewPath ?? `reports/${slug}/draft.html`;
+    await mkdir(dirname2(path), { recursive: true });
+    await writeFile9(path, html, "utf-8");
+    return { reportRow: null, htmlPath: path, html };
+  }
+  if (base === null) throw new Error("base required when previewOnly=false");
+  const reportId = `${siteRow.name} \u2014 ${reportType} \u2014 ${periodEnd.toISOString().slice(0, 10)}`;
+  const created = await createDraft(base, {
+    reportId,
+    siteId: siteRow.id,
+    reportType,
+    periodStart,
+    periodEnd,
+    completedOn,
+    lighthouse: scores,
+    lastTestedDate
+  });
+  await uploadHtmlAttachment(created.id, html, slug, periodEnd);
+  await setDraftReady(base, created.id, true);
+  return { reportRow: created, htmlPath: null, html };
+}
+async function derivePeriodStart(base, siteRow, reportType, today) {
+  const prior = await listReportsForSite(base, siteRow.id);
+  const sameType = prior.filter((r) => r.reportType === reportType && r.periodEnd).map((r) => r.periodEnd).sort();
+  const latest = sameType[sameType.length - 1];
+  return latest ? new Date(latest) : daysAgo(today, 30);
+}
+async function uploadHtmlAttachment(recordId, html, slug, periodEnd) {
+  const apiKey = process.env.AIRTABLE_PAT;
+  const baseId = process.env.AIRTABLE_BASE_ID;
+  const filename = `${slug}-${periodEnd.toISOString().slice(0, 10)}.html`;
+  const body = {
+    contentType: "text/html",
+    file: Buffer.from(html, "utf-8").toString("base64"),
+    filename
+  };
+  const url = `https://content.airtable.com/v0/${baseId}/${recordId}/Rendered%20HTML/uploadAttachment`;
+  const res = await fetch(url, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${apiKey}`,
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify(body)
+  });
+  if (!res.ok) {
+    throw new Error(`Airtable upload failed: ${res.status} ${res.statusText} ${await res.text()}`);
+  }
+}
+
+// src/reports/airtable/client.ts
+import Airtable from "airtable";
+function readAirtableConfig() {
+  const apiKey = process.env.AIRTABLE_PAT;
+  const baseId = process.env.AIRTABLE_BASE_ID;
+  if (!apiKey) throw Object.assign(new Error("AIRTABLE_PAT not set"), { exitCode: 2 });
+  if (!baseId) throw Object.assign(new Error("AIRTABLE_BASE_ID not set"), { exitCode: 2 });
+  return { apiKey, baseId };
+}
+function openBase(cfg) {
+  return new Airtable({ apiKey: cfg.apiKey }).base(cfg.baseId);
+}
+
+// src/reports/airtable/attachments.ts
+async function fetchAttachmentBytes(url) {
+  const res = await fetch(url);
+  if (!res.ok) {
+    throw new Error(
+      `Failed to fetch Airtable attachment ${res.status} ${res.statusText} (url=${url})`
+    );
+  }
+  const contentType = res.headers.get("content-type") ?? "application/octet-stream";
+  const ab = await res.arrayBuffer();
+  return { bytes: new Uint8Array(ab), contentType };
+}
+
+// src/reports/send/resend.ts
+import { Resend } from "resend";
+function defaultResendClient() {
+  const key = process.env.RESEND_API_KEY;
+  if (!key) throw Object.assign(new Error("RESEND_API_KEY not set"), { exitCode: 2 });
+  const resend = new Resend(key);
+  return {
+    async send(input) {
+      const payload = {
+        from: input.from,
+        to: input.to,
+        subject: input.subject,
+        html: input.html
+      };
+      if (input.cc) payload.cc = input.cc;
+      if (input.replyTo) payload.replyTo = input.replyTo;
+      if (input.attachments) payload.attachments = input.attachments;
+      const options = {};
+      if (input.idempotencyKey) options.idempotencyKey = input.idempotencyKey;
+      const { data, error } = await resend.emails.send(payload, options);
+      if (error) throw new Error(`Resend error: ${error.message}`);
+      if (!data?.id) throw new Error("Resend returned no message id");
+      return { messageId: data.id };
+    }
+  };
+}
+
+// src/reports/send/orchestrate.ts
+var FROM_ADDRESS = "Reddoor Reports <reports@reddoorla.com>";
+var REPLY_TO = "info@reddoorla.com";
+async function sendApprovedReports(options = {}) {
+  const base = openBase(readAirtableConfig());
+  const client = options.resend ?? defaultResendClient();
+  const sendable = await listSendableReports(base);
+  if (sendable.length === 0) return { output: "No reports ready to send.", code: 0 };
+  const websites = await listWebsites(base);
+  const sites = new Map(websites.map((w) => [w.id, w]));
+  const lines = [];
+  let anyFailed = false;
+  for (const report of sendable) {
+    const site = sites.get(report.siteId);
+    if (!site) {
+      lines.push(`\u2717 ${report.reportId} \u2014 Site row not found for id=${report.siteId}`);
+      anyFailed = true;
+      continue;
+    }
+    try {
+      const messageId = await sendOne(client, base, site, report);
+      lines.push(`\u2713 sent: ${report.reportId} (${messageId})`);
+    } catch (e) {
+      lines.push(`\u2717 ${report.reportId} \u2014 ${e.message}`);
+      anyFailed = true;
+    }
+  }
+  return { output: lines.join("\n"), code: anyFailed ? 1 : 0 };
+}
+async function sendOne(client, base, site, report) {
+  if (!site.headerImage) {
+    throw new Error(`Site '${site.name}' has no Header image set on the Websites row`);
+  }
+  if (!report.lighthouse) {
+    throw new Error(`Report ${report.reportId} has no Lighthouse scores`);
+  }
+  const { bytes, contentType } = await fetchAttachmentBytes(site.headerImage.url);
+  const slug = siteSlug(site.name);
+  const cidName = `${slug}-header`;
+  const { html } = await renderReportHtml({
+    siteName: site.name,
+    siteUrl: site.url,
+    reportType: report.reportType,
+    completedOn: report.completedOn ? new Date(report.completedOn) : /* @__PURE__ */ new Date(),
+    lighthouse: report.lighthouse,
+    gaUsersCurrent: report.gaUsersCurrent ?? 0,
+    gaUsersPrevious: report.gaUsersPrevious ?? 0,
+    lastTestedDate: report.lastTestedDate ? new Date(report.lastTestedDate) : null,
+    commentary: report.commentary,
+    headerImageCid: cidName
+  });
+  const subject = report.subjectOverride ?? `${site.name} ${report.reportType} Report`;
+  const explicitTo = parseAddresses(site.reportRecipientsTo);
+  const fallbackTo = parseAddresses(site.pointOfContact);
+  const to = explicitTo ?? fallbackTo ?? [];
+  if (to.length === 0) {
+    throw new Error(
+      `Site '${site.name}' has no recipients (Report recipients (To) AND point of contact are both empty)`
+    );
+  }
+  for (const addr of to) {
+    if (!isProbablyEmail(addr)) {
+      throw new Error(
+        `Site '${site.name}' recipient is malformed: ${addr} \u2014 fix Report recipients (To) or point of contact in Airtable`
+      );
+    }
+  }
+  const cc = parseAddresses(site.reportRecipientsCc);
+  if (cc) {
+    for (const addr of cc) {
+      if (!isProbablyEmail(addr)) {
+        throw new Error(
+          `Site '${site.name}' CC is malformed: ${addr} \u2014 fix Report recipients (CC) in Airtable`
+        );
+      }
+    }
+  }
+  const payload = {
+    from: FROM_ADDRESS,
+    to,
+    replyTo: REPLY_TO,
+    subject,
+    html,
+    attachments: [
+      {
+        filename: site.headerImage.filename,
+        content: Buffer.from(bytes).toString("base64"),
+        contentType,
+        inlineContentId: cidName
+      }
+    ],
+    // Stable across retries of the same row — if Airtable stamping fails after a
+    // successful Resend, the next --send-ready replays with the same key and
+    // Resend returns the original message id rather than sending a duplicate.
+    idempotencyKey: `report:${report.id}`
+  };
+  if (cc) payload.cc = cc;
+  const result = await client.send(payload);
+  await stampSent(base, report.id, /* @__PURE__ */ new Date(), result.messageId);
+  return result.messageId;
+}
+function parseAddresses(field) {
+  if (!field) return null;
+  const seen = /* @__PURE__ */ new Set();
+  const list = [];
+  for (const raw of field.split(/[,\n]/)) {
+    const trimmed = raw.trim().toLowerCase();
+    if (!trimmed) continue;
+    if (seen.has(trimmed)) continue;
+    seen.add(trimmed);
+    list.push(trimmed);
+  }
+  return list.length > 0 ? list : null;
+}
+function isProbablyEmail(s) {
+  const at = s.indexOf("@");
+  if (at < 1 || at !== s.lastIndexOf("@")) return false;
+  const local = s.slice(0, at);
+  const domain = s.slice(at + 1);
+  if (!local || !domain) return false;
+  if (!domain.includes(".")) return false;
+  if (/\s/.test(s)) return false;
+  return true;
+}
+
+// src/reports/due.ts
+var MONTHS = {
+  Monthly: 1,
+  Quarterly: 3,
+  Yearly: 12
+};
+function addMonths(d, n) {
+  const out = new Date(d);
+  const day = out.getUTCDate();
+  out.setUTCDate(1);
+  out.setUTCMonth(out.getUTCMonth() + n);
+  const lastDayOfTargetMonth = new Date(
+    Date.UTC(out.getUTCFullYear(), out.getUTCMonth() + 1, 0)
+  ).getUTCDate();
+  out.setUTCDate(Math.min(day, lastDayOfTargetMonth));
+  return out;
+}
+function startOfDay(d) {
+  const out = new Date(d);
+  out.setUTCHours(0, 0, 0, 0);
+  return out;
+}
+function lastSentForType(reports, siteId, type) {
+  const candidates = reports.filter((r) => r.siteId === siteId && r.reportType === type && r.sentAt !== null).map((r) => r.sentAt).sort();
+  return candidates[candidates.length - 1] ?? null;
+}
+function findDueReports(websites, reports, today) {
+  const out = [];
+  const todayStart = startOfDay(today);
+  for (const site of websites) {
+    for (const type of ["Maintenance", "Testing"]) {
+      const freq = type === "Maintenance" ? site.maintenanceFreq : site.testingFreq;
+      if (freq === "None") continue;
+      const lastSent = lastSentForType(reports, site.id, type);
+      const fallback = type === "Maintenance" ? site.maintenanceDay : site.testingDay;
+      const baseIso = lastSent ?? fallback;
+      if (!baseIso) {
+        out.push({ site, reportType: type, dueDate: todayStart, lastSent });
+        continue;
+      }
+      const dueDate = addMonths(new Date(baseIso), MONTHS[freq]);
+      if (todayStart.getTime() >= startOfDay(dueDate).getTime()) {
+        out.push({ site, reportType: type, dueDate, lastSent });
+      }
+    }
+  }
+  return out;
+}
 export {
   ALL_AUDIT_NAMES,
   ALL_RECIPE_NAMES,
@@ -1972,15 +2562,19 @@ export {
   bumpDeps,
   convertToPnpm,
   depsAudit,
+  draftReportForSite,
+  findDueReports,
   fromJsonFile,
   isRecipeName,
   lighthouseAudit,
   lintAudit,
   localPath,
   onboard,
+  renderReportHtml,
   runAudits,
   runAuditsAcross,
   securityAudit,
+  sendApprovedReports,
   svelteCodemods,
   syncConfigs,
   upgradeSvelte4to5