@reddoorla/maintenance 0.60.1 → 0.62.0

package/dist/chunk-5L3FPQIJ.js

@@ -0,0 +1,92 @@
+// src/audits/fleet-event-detectors.ts
+function ymd(iso) {
+  return iso.slice(0, 10);
+}
+function cleanRenovateTitle(title) {
+  let t = title.trim();
+  t = t.replace(/^[a-z]+(\([^)]*\))?:\s*/i, "");
+  t = t.replace(/^update dependency\s+/i, "");
+  t = t.replace(/^update\s+/i, "");
+  t = t.replace(/^pin dependencies?\s+/i, "");
+  t = t.replace(/\s+to\s+v?/i, "\u2192");
+  return t.trim();
+}
+function detectAuditEvents(prev, audits, at) {
+  const events = [];
+  if (audits.security) {
+    const prevCH = (prev.securityVulnsCritical ?? 0) + (prev.securityVulnsHigh ?? 0);
+    const newCH = audits.security.critical + audits.security.high;
+    if (prevCH > 0 && newCH === 0) {
+      events.push({
+        id: `vuln_cleared:${prev.id}:${ymd(at)}`,
+        ts: at,
+        type: "vuln_cleared",
+        siteId: prev.id,
+        siteName: prev.name,
+        summary: `cleared ${prevCH} critical/high vuln${prevCH === 1 ? "" : "s"}`,
+        data: { from: prevCH }
+      });
+    }
+  }
+  if (audits.domain) {
+    const prevDays = prev.certDaysRemaining;
+    const newDays = audits.domain.certDaysRemaining;
+    if (prevDays !== null && prevDays < 30 && newDays !== null && newDays > 60) {
+      events.push({
+        id: `cert_renewed:${prev.id}:${ymd(at)}`,
+        ts: at,
+        type: "cert_renewed",
+        siteId: prev.id,
+        siteName: prev.name,
+        summary: `TLS cert renewed (${newDays}d remaining)`,
+        data: { days: newDays }
+      });
+    }
+  }
+  return events;
+}
+function detectSignalEvents(prev, row, mergedPRs, at) {
+  const events = [];
+  for (const pr of mergedPRs) {
+    events.push({
+      id: `pr_automerged:${row.repo}#${pr.number}`,
+      ts: pr.mergedAt,
+      type: "pr_automerged",
+      siteId: prev.id,
+      siteName: prev.name,
+      summary: `auto-merged ${cleanRenovateTitle(pr.title)}`,
+      data: { url: pr.url, repo: row.repo, number: pr.number }
+    });
+  }
+  if (prev.defaultBranchCi === "failing" && row.ciState === "passing") {
+    events.push({
+      id: `ci_recovered:${prev.id}:${ymd(at)}`,
+      ts: at,
+      type: "ci_recovered",
+      siteId: prev.id,
+      siteName: prev.name,
+      summary: "CI recovered (default branch green)",
+      data: null
+    });
+  }
+  return events;
+}
+function fleetSweptEvent(sweep, count, at) {
+  const verb = sweep === "security" ? "security-swept" : sweep === "github-signals" ? "signals-swept" : "re-audited";
+  return {
+    id: `fleet_swept:${sweep}:${ymd(at)}`,
+    ts: at,
+    type: "fleet_swept",
+    siteId: null,
+    siteName: null,
+    summary: `${verb} ${count} site${count === 1 ? "" : "s"}`,
+    data: { sweep, count }
+  };
+}
+
+export {
+  detectAuditEvents,
+  detectSignalEvents,
+  fleetSweptEvent
+};
+//# sourceMappingURL=chunk-5L3FPQIJ.js.map

package/dist/chunk-5L3FPQIJ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/audits/fleet-event-detectors.ts"],"sourcesContent":["import type { WebsiteRow, SecurityCounts, DomainResult } from \"../reports/airtable/websites.js\";\nimport type { GitHubSignalsRow } from \"./github-signals.js\";\nimport type { FleetEvent } from \"../db/fleet-events.js\";\n\n/** YYYY-MM-DD slice of an ISO timestamp, for per-site-per-day deterministic ids. */\nfunction ymd(iso: string): string {\n  return iso.slice(0, 10);\n}\n\n/** Compact a verbose Renovate PR title to \"<pkg>→<version> [tags]\".\n *  \"chore(deps): update dependency vite to v7.3.5 [security]\" → \"vite→7.3.5 [security]\".\n *  A grouped/no-version title (\"update all non-major dependencies\") is left readable. */\nexport function cleanRenovateTitle(title: string): string {\n  let t = title.trim();\n  t = t.replace(/^[a-z]+(\\([^)]*\\))?:\\s*/i, \"\"); // strip \"chore(deps): \"\n  t = t.replace(/^update dependency\\s+/i, \"\");\n  t = t.replace(/^update\\s+/i, \"\");\n  t = t.replace(/^pin dependencies?\\s+/i, \"\");\n  t = t.replace(/\\s+to\\s+v?/i, \"→\"); // \" to v7.3.5\" → \"→7.3.5\"\n  return t.trim();\n}\n\n/** vuln_cleared (critical+high >0 → 0) and cert_renewed (<30 → >60) from a single\n *  site's prior WebsiteRow vs the freshly-audited values. PURE. A null prior count\n *  reads as 0 (vuln) or \"not a renewal\" (cert) — both fire only on a real transition. */\nexport function detectAuditEvents(\n  prev: WebsiteRow,\n  audits: { security?: SecurityCounts; domain?: DomainResult },\n  at: string,\n): FleetEvent[] {\n  const events: FleetEvent[] = [];\n\n  if (audits.security) {\n    const prevCH = (prev.securityVulnsCritical ?? 0) + (prev.securityVulnsHigh ?? 0);\n    const newCH = audits.security.critical + audits.security.high;\n    if (prevCH > 0 && newCH === 0) {\n      events.push({\n        id: `vuln_cleared:${prev.id}:${ymd(at)}`,\n        ts: at,\n        type: \"vuln_cleared\",\n        siteId: prev.id,\n        siteName: prev.name,\n        summary: `cleared ${prevCH} critical/high vuln${prevCH === 1 ? \"\" : \"s\"}`,\n        data: { from: prevCH },\n      });\n    }\n  }\n\n  if (audits.domain) {\n    const prevDays = prev.certDaysRemaining;\n    const newDays = audits.domain.certDaysRemaining;\n    // Null prior = never measured / unresolved → first measurement, not a renewal.\n    if (prevDays !== null && prevDays < 30 && newDays !== null && newDays > 60) {\n      events.push({\n        id: `cert_renewed:${prev.id}:${ymd(at)}`,\n        ts: at,\n        type: \"cert_renewed\",\n        siteId: prev.id,\n        siteName: prev.name,\n        summary: `TLS cert renewed (${newDays}d remaining)`,\n        data: { days: newDays },\n      });\n    }\n  }\n\n  return events;\n}\n\n/** pr_automerged (one per merged Renovate PR) + ci_recovered (failing → passing)\n *  from a site's prior WebsiteRow, its fresh signals row, and the merged-PR list\n *  found since the watermark. PURE. */\nexport function detectSignalEvents(\n  prev: WebsiteRow,\n  row: GitHubSignalsRow,\n  mergedPRs: Array<{ number: number; title: string; url: string; mergedAt: string }>,\n  at: string,\n): FleetEvent[] {\n  const events: FleetEvent[] = [];\n\n  for (const pr of mergedPRs) {\n    events.push({\n      id: `pr_automerged:${row.repo}#${pr.number}`,\n      ts: pr.mergedAt,\n      type: \"pr_automerged\",\n      siteId: prev.id,\n      siteName: prev.name,\n      summary: `auto-merged ${cleanRenovateTitle(pr.title)}`,\n      data: { url: pr.url, repo: row.repo, number: pr.number },\n    });\n  }\n\n  if (prev.defaultBranchCi === \"failing\" && row.ciState === \"passing\") {\n    events.push({\n      id: `ci_recovered:${prev.id}:${ymd(at)}`,\n      ts: at,\n      type: \"ci_recovered\",\n      siteId: prev.id,\n      siteName: prev.name,\n      summary: \"CI recovered (default branch green)\",\n      data: null,\n    });\n  }\n\n  return events;\n}\n\n/** A fleet-wide rollup event: one per sweep per day. */\nexport function fleetSweptEvent(\n  sweep: \"lighthouse\" | \"security\" | \"github-signals\",\n  count: number,\n  at: string,\n): FleetEvent {\n  const verb =\n    sweep === \"security\"\n      ? \"security-swept\"\n      : sweep === \"github-signals\"\n        ? \"signals-swept\"\n        : \"re-audited\";\n  return {\n    id: `fleet_swept:${sweep}:${ymd(at)}`,\n    ts: at,\n    type: \"fleet_swept\",\n    siteId: null,\n    siteName: null,\n    summary: `${verb} ${count} site${count === 1 ? \"\" : \"s\"}`,\n    data: { sweep, count },\n  };\n}\n"],"mappings":";AAKA,SAAS,IAAI,KAAqB;AAChC,SAAO,IAAI,MAAM,GAAG,EAAE;AACxB;AAKO,SAAS,mBAAmB,OAAuB;AACxD,MAAI,IAAI,MAAM,KAAK;AACnB,MAAI,EAAE,QAAQ,4BAA4B,EAAE;AAC5C,MAAI,EAAE,QAAQ,0BAA0B,EAAE;AAC1C,MAAI,EAAE,QAAQ,eAAe,EAAE;AAC/B,MAAI,EAAE,QAAQ,0BAA0B,EAAE;AAC1C,MAAI,EAAE,QAAQ,eAAe,QAAG;AAChC,SAAO,EAAE,KAAK;AAChB;AAKO,SAAS,kBACd,MACA,QACA,IACc;AACd,QAAM,SAAuB,CAAC;AAE9B,MAAI,OAAO,UAAU;AACnB,UAAM,UAAU,KAAK,yBAAyB,MAAM,KAAK,qBAAqB;AAC9E,UAAM,QAAQ,OAAO,SAAS,WAAW,OAAO,SAAS;AACzD,QAAI,SAAS,KAAK,UAAU,GAAG;AAC7B,aAAO,KAAK;AAAA,QACV,IAAI,gBAAgB,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;AAAA,QACtC,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,QAAQ,KAAK;AAAA,QACb,UAAU,KAAK;AAAA,QACf,SAAS,WAAW,MAAM,sBAAsB,WAAW,IAAI,KAAK,GAAG;AAAA,QACvE,MAAM,EAAE,MAAM,OAAO;AAAA,MACvB,CAAC;AAAA,IACH;AAAA,EACF;AAEA,MAAI,OAAO,QAAQ;AACjB,UAAM,WAAW,KAAK;AACtB,UAAM,UAAU,OAAO,OAAO;AAE9B,QAAI,aAAa,QAAQ,WAAW,MAAM,YAAY,QAAQ,UAAU,IAAI;AAC1E,aAAO,KAAK;AAAA,QACV,IAAI,gBAAgB,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;AAAA,QACtC,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,QAAQ,KAAK;AAAA,QACb,UAAU,KAAK;AAAA,QACf,SAAS,qBAAqB,OAAO;AAAA,QACrC,MAAM,EAAE,MAAM,QAAQ;AAAA,MACxB,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AAKO,SAAS,mBACd,MACA,KACA,WACA,IACc;AACd,QAAM,SAAuB,CAAC;AAE9B,aAAW,MAAM,WAAW;AAC1B,WAAO,KAAK;AAAA,MACV,IAAI,iBAAiB,IAAI,IAAI,IAAI,GAAG,MAAM;AAAA,MAC1C,IAAI,GAAG;AAAA,MACP,MAAM;AAAA,MACN,QAAQ,KAAK;AAAA,MACb,UAAU,KAAK;AAAA,MACf,SAAS,eAAe,mBAAmB,GAAG,KAAK,CAAC;AAAA,MACpD,MAAM,EAAE,KAAK,GAAG,KAAK,MAAM,IAAI,MAAM,QAAQ,GAAG,OAAO;AAAA,IACzD,CAAC;AAAA,EACH;AAEA,MAAI,KAAK,oBAAoB,aAAa,IAAI,YAAY,WAAW;AACnE,WAAO,KAAK;AAAA,MACV,IAAI,gBAAgB,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;AAAA,MACtC,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,QAAQ,KAAK;AAAA,MACb,UAAU,KAAK;AAAA,MACf,SAAS;AAAA,MACT,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AAEA,SAAO;AACT;AAGO,SAAS,gBACd,OACA,OACA,IACY;AACZ,QAAM,OACJ,UAAU,aACN,mBACA,UAAU,mBACR,kBACA;AACR,SAAO;AAAA,IACL,IAAI,eAAe,KAAK,IAAI,IAAI,EAAE,CAAC;AAAA,IACnC,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,SAAS,GAAG,IAAI,IAAI,KAAK,QAAQ,UAAU,IAAI,KAAK,GAAG;AAAA,IACvD,MAAM,EAAE,OAAO,MAAM;AAAA,EACvB;AACF;","names":[]}

package/dist/{client-JA6QLEDW.js → chunk-6ZKM7OIJ.js}

@@ -1,6 +1,6 @@
 import {
   runMigrations
-} from "./chunk-HG5DTFNF.js";
+} from "./chunk-XKKTK6WA.js";
 import {
   defaultCredentialsPath
 } from "./chunk-6VAL7XJT.js";
@@ -41,8 +41,9 @@ async function openDb(cfg) {
   await ensureMigrated(cfg.url, client);
   return new Kysely({ dialect: new LibsqlDialect({ client }) });
 }
+
 export {
-  openDb,
-  readDbConfig
+  readDbConfig,
+  openDb
 };
-//# sourceMappingURL=client-JA6QLEDW.js.map
+//# sourceMappingURL=chunk-6ZKM7OIJ.js.map

package/dist/{chunk-KC4HU7BC.js → chunk-76VIUWR3.js}

@@ -1,24 +1,27 @@
-import {
-  isIdempotencyConflict
-} from "./chunk-OGGRFBL4.js";
 import {
   announcementSiteExtras,
   fetchAttachmentBytes,
   loadBundledImages,
   renderReportHtml,
   resolveCopy
-} from "./chunk-BWLUNY7L.js";
+} from "./chunk-2T3HZ3DB.js";
+import {
+  isIdempotencyConflict
+} from "./chunk-OGGRFBL4.js";
 import {
   checklistFor,
   isChecklistComplete,
   listSendableReports,
   stampSent
 } from "./chunk-OCS7SZUZ.js";
+import {
+  recordFleetEventsBestEffort
+} from "./chunk-L5F664ZA.js";
 import {
   listWebsites,
   siteSlug,
   updateLaunched
-} from "./chunk-L4ULXHIN.js";
+} from "./chunk-BLD6AYJO.js";
 import {
   openBase,
   readAirtableConfig
@@ -86,6 +89,12 @@ var MONTHS = [
 function monthYear(d) {
   return `${MONTHS[d.getUTCMonth()]} ${d.getUTCFullYear()}`;
 }
+function windowDays(start, end) {
+  if (!start || !end) return void 0;
+  const ms = new Date(end).getTime() - new Date(start).getTime();
+  if (!Number.isFinite(ms) || ms <= 0) return void 0;
+  return Math.round(ms / (24 * 60 * 60 * 1e3));
+}
 function toInlineAttachment(a) {
   return {
     filename: a.filename,
@@ -117,6 +126,20 @@ async function sendApprovedReports(options = {}) {
         try {
           await updateLaunched(base, site.id, (/* @__PURE__ */ new Date()).toISOString());
           lines.push(`  \u21B3 launched: ${site.name} flipped to maintenance`);
+          await recordFleetEventsBestEffort(
+            [
+              {
+                id: `site_launched:${site.id}`,
+                ts: (/* @__PURE__ */ new Date()).toISOString(),
+                type: "site_launched",
+                siteId: site.id,
+                siteName: site.name,
+                summary: "launched \u2014 now in maintenance",
+                data: null
+              }
+            ],
+            /* @__PURE__ */ new Date()
+          );
         } catch (e) {
           lines.push(`  \u26A0 launch flip failed for ${site.name}: ${e.message}`);
         }
@@ -174,6 +197,7 @@ async function sendOne(client, base, site, report) {
   const bundled = await loadBundledImages();
   const slug = siteSlug(site.name);
   const cidName = `${slug}-header`;
+  const gaPeriodDays = report.reportType === "Announcement" ? 30 : windowDays(report.periodStart, report.periodEnd);
   const { html } = await renderReportHtml({
     siteName: site.name,
     siteUrl: site.url,
@@ -182,6 +206,7 @@ async function sendOne(client, base, site, report) {
     lighthouse: report.lighthouse,
     gaUsersCurrent: report.gaUsersCurrent ?? void 0,
     gaUsersPrevious: report.gaUsersPrevious ?? void 0,
+    gaPeriodDays,
     searchPosition: report.searchFoundPage1 && report.searchPosition !== null ? report.searchPosition : void 0,
     lastTestedDate: report.lastTestedDate ? new Date(report.lastTestedDate) : null,
     commentary: report.commentary,
@@ -276,4 +301,4 @@ export {
   parseAddresses,
   isProbablyEmail
 };
-//# sourceMappingURL=chunk-KC4HU7BC.js.map
+//# sourceMappingURL=chunk-76VIUWR3.js.map

package/dist/chunk-76VIUWR3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/reports/maintenance-email/header-image.ts","../src/reports/send/orchestrate.ts"],"sourcesContent":["import sharp from \"sharp\";\n\nexport type PreparedHeaderImage = {\n  /** Resized JPEG bytes to attach inline (CID) in place of the Airtable original. */\n  bytes: Uint8Array;\n  /** Always \"image/jpeg\" — we re-encode for predictable size and a flat white background. */\n  contentType: string;\n  /** CSS display width in px (≤ requested, never wider than the source has pixels for). */\n  displayWidth: number;\n  /** CSS display height in px, source aspect ratio preserved (no distortion). */\n  displayHeight: number;\n  /** Dominant-color hex (e.g. \"#cfc3a8\"), used as the loading/blocked placeholder box. */\n  placeholderColor: string;\n};\n\nexport type PrepareHeaderImageOptions = {\n  /** Intended CSS display width. The email body is 600px, so that's the default. */\n  displayWidth?: number;\n};\n\nconst DEFAULT_DISPLAY_WIDTH = 600;\n/** Encode the source at 2× display width so it stays crisp on retina screens. */\nconst RETINA_SCALE = 2;\n/** Quality is for *resized* pixels — at 1200px the texture/text read as sharp; bytes are tiny. */\nconst JPEG_QUALITY = 82;\n\nfunction channelToHex(value: number): string {\n  return Math.max(0, Math.min(255, Math.round(value)))\n    .toString(16)\n    .padStart(2, \"0\");\n}\n\n/**\n * Downscale an oversized header image for email: 2× the display width (retina) at most,\n * never upscaled, re-encoded as JPEG on a flat white background. Also reports the display\n * dimensions (so the template can reserve the box and stop reflow) and a dominant color\n * (so the reserved box shows a matched placeholder while the image loads).\n *\n * Root cause this addresses: Airtable headers can be multi-MB / 2400px+ while the email\n * renders them at ~600px — shipping ~16× more pixels than the display can use.\n */\nexport async function prepareHeaderImage(\n  bytes: Uint8Array,\n  options: PrepareHeaderImageOptions = {},\n): Promise<PreparedHeaderImage> {\n  const requestedDisplayWidth = options.displayWidth ?? DEFAULT_DISPLAY_WIDTH;\n  const input = Buffer.from(bytes);\n\n  const meta = await sharp(input).metadata();\n  const origWidth = meta.width;\n  const origHeight = meta.height;\n  if (!origWidth || !origHeight) {\n    throw new Error(\"prepareHeaderImage: could not read source image dimensions\");\n  }\n\n  // Never claim a wider display than the source can fill at 1×.\n  const displayWidth = Math.min(requestedDisplayWidth, origWidth);\n  const displayHeight = Math.round((displayWidth * origHeight) / origWidth);\n\n  // Encode at 2× display for retina, but never enlarge a smaller original.\n  const targetSourceWidth = Math.min(origWidth, displayWidth * RETINA_SCALE);\n\n  const out = await sharp(input)\n    .resize({ width: targetSourceWidth, withoutEnlargement: true })\n    .flatten({ background: \"#ffffff\" })\n    .jpeg({ quality: JPEG_QUALITY })\n    .toBuffer();\n\n  const { dominant } = await sharp(out).stats();\n  const placeholderColor = `#${channelToHex(dominant.r)}${channelToHex(dominant.g)}${channelToHex(dominant.b)}`;\n\n  return {\n    bytes: new Uint8Array(out),\n    contentType: \"image/jpeg\",\n    displayWidth,\n    displayHeight,\n    placeholderColor,\n  };\n}\n","import { openBase, readAirtableConfig } from \"../airtable/client.js\";\nimport { listSendableReports, stampSent } from \"../airtable/reports.js\";\nimport { listWebsites, siteSlug, updateLaunched } from \"../airtable/websites.js\";\nimport type { WebsiteRow } from \"../airtable/websites.js\";\nimport type { ReportRow } from \"../airtable/reports.js\";\nimport { fetchAttachmentBytes } from \"../airtable/attachments.js\";\nimport { renderReportHtml } from \"../render.js\";\nimport { resolveCopy } from \"../copy.js\";\nimport { announcementSiteExtras } from \"../announcement-email/template.js\";\nimport { loadBundledImages } from \"../maintenance-email/assets/index.js\";\nimport { prepareHeaderImage } from \"../maintenance-email/header-image.js\";\nimport { defaultResendClient, type ResendClient, type ResendSendInput } from \"./resend.js\";\nimport { isIdempotencyConflict } from \"./idempotency.js\";\nimport { checklistFor, isChecklistComplete } from \"../checklist.js\";\nimport { recordFleetEventsBestEffort } from \"../../audits/fleet-events-writer.js\";\n\nconst FROM_ADDRESS = \"Reddoor Reports <reports@reddoorla.com>\";\nconst REPLY_TO = \"info@reddoorla.com\";\n\n/** Operations inbox CC'd on every outgoing report so there's always an internal\n *  copy on file alongside the client recipients. */\nexport const GLOBAL_REPORT_CC = \"info@reddoorla.com\";\n\n/**\n * Append {@link GLOBAL_REPORT_CC} to a site's per-site CC list. The per-site CC is\n * passed through unchanged (preserving prior behavior); the global address is added\n * only when it isn't already present in the CC or To lists (case-insensitive), so a\n * report is never double-addressed to the ops inbox. Returns the final CC list (may\n * be empty if the global address is already the sole To recipient — the caller omits\n * an empty CC).\n */\nexport function withGlobalCc(perSiteCc: string[] | null, to: string[]): string[] {\n  const cc = [...(perSiteCc ?? [])];\n  const present = new Set([...cc, ...to].map((a) => a.toLowerCase()));\n  if (!present.has(GLOBAL_REPORT_CC.toLowerCase())) cc.push(GLOBAL_REPORT_CC);\n  return cc;\n}\n\nconst MONTHS = [\n  \"January\",\n  \"February\",\n  \"March\",\n  \"April\",\n  \"May\",\n  \"June\",\n  \"July\",\n  \"August\",\n  \"September\",\n  \"October\",\n  \"November\",\n  \"December\",\n];\n\n/** \"May 2026\" — UTC month/year, consistent with the rest of the reports pipeline's dates. */\nfunction monthYear(d: Date): string {\n  return `${MONTHS[d.getUTCMonth()]} ${d.getUTCFullYear()}`;\n}\n\n/** Whole days spanned by an ISO period window, or undefined when either bound is missing or the\n *  span isn't positive. Drives the analytics trend's \"vs the previous N days\" label. */\nfunction windowDays(start: string | null, end: string | null): number | undefined {\n  if (!start || !end) return undefined;\n  const ms = new Date(end).getTime() - new Date(start).getTime();\n  if (!Number.isFinite(ms) || ms <= 0) return undefined;\n  return Math.round(ms / (24 * 60 * 60 * 1000));\n}\n\ntype InlineAttachment = NonNullable<ResendSendInput[\"attachments\"]>[number];\n\n/** Build a Resend inline (CID-referenced) attachment from raw bytes — the header\n *  image and both bundled images share this exact shape. */\nfunction toInlineAttachment(a: {\n  bytes: Uint8Array;\n  filename: string;\n  contentType: string;\n  cid: string;\n}): InlineAttachment {\n  return {\n    filename: a.filename,\n    content: Buffer.from(a.bytes).toString(\"base64\"),\n    contentType: a.contentType,\n    inlineContentId: a.cid,\n  };\n}\n\nexport type OrchestrateOptions = {\n  resend?: ResendClient;\n};\n\nexport async function sendApprovedReports(\n  options: OrchestrateOptions = {},\n): Promise<{ output: string; code: number }> {\n  const base = openBase(readAirtableConfig());\n  const client = options.resend ?? defaultResendClient();\n\n  const sendable = await listSendableReports(base);\n  if (sendable.length === 0) return { output: \"No reports ready to send.\", code: 0 };\n\n  const websites = await listWebsites(base);\n  const sites = new Map(websites.map((w) => [w.id, w]));\n\n  const lines: string[] = [];\n  let anyFailed = false;\n  for (const report of sendable) {\n    const site = sites.get(report.siteId);\n    if (!site) {\n      lines.push(`✗ ${report.reportId} — Site row not found for id=${report.siteId}`);\n      anyFailed = true;\n      continue;\n    }\n    try {\n      const messageId = await sendOne(client, base, site, report);\n      lines.push(`✓ sent: ${report.reportId} (${messageId})`);\n      if (report.reportType === \"Launch\") {\n        try {\n          await updateLaunched(base, site.id, new Date().toISOString());\n          lines.push(`  ↳ launched: ${site.name} flipped to maintenance`);\n          await recordFleetEventsBestEffort(\n            [\n              {\n                id: `site_launched:${site.id}`,\n                ts: new Date().toISOString(),\n                type: \"site_launched\",\n                siteId: site.id,\n                siteName: site.name,\n                summary: \"launched — now in maintenance\",\n                data: null,\n              },\n            ],\n            new Date(),\n          );\n        } catch (e) {\n          lines.push(`  ⚠ launch flip failed for ${site.name}: ${(e as Error).message}`);\n        }\n      }\n    } catch (e) {\n      lines.push(`✗ ${report.reportId} — ${(e as Error).message}`);\n      anyFailed = true;\n    }\n  }\n  return { output: lines.join(\"\\n\"), code: anyFailed ? 1 : 0 };\n}\n\nasync function sendOne(\n  client: ResendClient,\n  base: ReturnType<typeof openBase>,\n  site: WebsiteRow,\n  report: ReportRow,\n): Promise<string> {\n  // Hard checklist gate: a Maintenance/Testing report whose operator checklist isn't\n  // fully checked must never go out — even if \"Approved to send\" was ticked directly in\n  // Airtable, bypassing the dashboard's approve gate. Throw so the report is skipped and\n  // `Sent at` stays null (at-least-once retry preserved), exactly like the other sendOne\n  // guards. Launch/Announcement have an empty checklist → vacuously complete, never gated.\n  if (!isChecklistComplete(report)) {\n    const items = checklistFor(report.reportType);\n    const done = items.filter((i) => report.checklist[i.field] === true).length;\n    throw new Error(\n      `Report ${report.reportId} checklist incomplete — ${done}/${items.length} items checked`,\n    );\n  }\n  if (!site.headerImage) {\n    throw new Error(`Site '${site.name}' has no Header image set on the Websites row`);\n  }\n  if (!report.lighthouse) {\n    throw new Error(\n      `Report ${report.reportId} has no Lighthouse scores — all four cells ` +\n        `(Lighthouse — Performance / Accessibility / Best Practices / SEO) must be numeric ` +\n        `on the Reports row; one non-numeric or blank cell nulls all four`,\n    );\n  }\n\n  // Resolve + validate recipients BEFORE the expensive work (header fetch + sharp\n  // downscale + full MJML render). A misconfigured-recipients site is a guaranteed\n  // failure, so fail fast here rather than after burning that work. Same checks +\n  // messages as before — only the position moved.\n  const explicitTo = parseAddresses(site.reportRecipientsTo);\n  // Run pointOfContact through the parser too — operators sometimes paste\n  // \"a@x, b@y\" into that single-line field.\n  const fallbackTo = parseAddresses(site.pointOfContact);\n  const to = explicitTo ?? fallbackTo ?? [];\n  if (to.length === 0) {\n    throw new Error(\n      `Site '${site.name}' has no recipients (Report recipients (To) AND point of contact are both empty)`,\n    );\n  }\n  for (const addr of to) {\n    if (!isProbablyEmail(addr)) {\n      throw new Error(\n        `Site '${site.name}' recipient is malformed: ${addr} — use a bare address only ` +\n          `(no \\`Name <addr>\\` display-name syntax); fix Report recipients (To) or point of contact in Airtable`,\n      );\n    }\n  }\n  const cc = parseAddresses(site.reportRecipientsCc);\n  if (cc) {\n    for (const addr of cc) {\n      if (!isProbablyEmail(addr)) {\n        throw new Error(\n          `Site '${site.name}' CC is malformed: ${addr} — fix Report recipients (CC) in Airtable`,\n        );\n      }\n    }\n  }\n\n  const original = await fetchAttachmentBytes(site.headerImage.url);\n  // Downscale the (often multi-MB / 2400px+) Airtable header to email display size, and get\n  // back display dims + a placeholder color so the template can reserve the box.\n  const header = await prepareHeaderImage(original.bytes);\n  const bundled = await loadBundledImages();\n\n  const slug = siteSlug(site.name);\n  const cidName = `${slug}-header`;\n  // GA window length (days) for the analytics trend's \"vs the previous N days\" label.\n  // Announcements report on a fixed 30-day window — the announce recipe collapses the stored\n  // period to `now`, so it can't be derived from the row; every other report derives it from\n  // the stored period window.\n  const gaPeriodDays =\n    report.reportType === \"Announcement\" ? 30 : windowDays(report.periodStart, report.periodEnd);\n  const { html } = await renderReportHtml({\n    siteName: site.name,\n    siteUrl: site.url,\n    reportType: report.reportType,\n    completedOn: report.completedOn ? new Date(report.completedOn) : new Date(),\n    lighthouse: report.lighthouse,\n    gaUsersCurrent: report.gaUsersCurrent ?? undefined,\n    gaUsersPrevious: report.gaUsersPrevious ?? undefined,\n    gaPeriodDays,\n    searchPosition:\n      report.searchFoundPage1 && report.searchPosition !== null ? report.searchPosition : undefined,\n    lastTestedDate: report.lastTestedDate ? new Date(report.lastTestedDate) : null,\n    commentary: report.commentary,\n    copy: resolveCopy(site),\n    headerImageCid: cidName,\n    headerWidth: header.displayWidth,\n    headerHeight: header.displayHeight,\n    headerBgColor: header.placeholderColor,\n    // Announcement-only: re-derive cadence + improvements from the site row so the SENT email\n    // keeps its cadence copy + improvement callouts. Without this the send-time re-render drops\n    // them entirely (they're not stored on the Reports row). Ignored by the other templates.\n    ...(report.reportType === \"Announcement\" ? announcementSiteExtras(site) : {}),\n  });\n\n  const reportDate = report.completedOn ? new Date(report.completedOn) : new Date();\n  const subject =\n    report.subjectOverride ?? `${site.name} — ${monthYear(reportDate)} ${report.reportType} Report`;\n\n  // Inline attachments: the per-site header (every template renders it) plus only the bundled\n  // images the rendered HTML actually references. The green check (cid:rd-check-png) appears in\n  // every report's checklist/score rows EXCEPT Launch; the blurred-tests image\n  // (cid:rd-blurred-tests-jpg) appears ONLY in the Maintenance email. Attaching a bundled image\n  // the template doesn't reference leaves a dangling inline part that some mail clients surface as\n  // a stray downloadable attachment — so gate each on its cid actually appearing in `html`. This\n  // self-corrects if a template's image usage changes; there's no per-report-type list to keep in\n  // sync. Self-contained inline (no external CDN, no image-blocked broken icons in webmail).\n  const attachments: InlineAttachment[] = [\n    toInlineAttachment({\n      bytes: header.bytes,\n      filename: `${cidName}.jpg`,\n      contentType: header.contentType,\n      cid: cidName,\n    }),\n  ];\n  for (const img of [bundled.check, bundled.blurred]) {\n    if (html.includes(`cid:${img.cid}`)) {\n      attachments.push(\n        toInlineAttachment({\n          bytes: img.bytes,\n          filename: img.filename,\n          contentType: img.contentType,\n          cid: img.cid,\n        }),\n      );\n    }\n  }\n\n  const payload: Parameters<ResendClient[\"send\"]>[0] = {\n    from: FROM_ADDRESS,\n    to,\n    replyTo: REPLY_TO,\n    subject,\n    html,\n    attachments,\n    // Stable across retries of the same row — if Airtable stamping fails after a\n    // successful Resend, the next --send-ready replays with the same key and\n    // Resend returns the original message id rather than sending a duplicate.\n    idempotencyKey: `report:${report.id}`,\n  };\n  // Always CC the ops inbox (info@reddoorla.com), in addition to any per-site CC.\n  const finalCc = withGlobalCc(cc, to);\n  if (finalCc.length > 0) payload.cc = finalCc;\n\n  let result: Awaited<ReturnType<ResendClient[\"send\"]>>;\n  try {\n    result = await client.send(payload);\n  } catch (err) {\n    // The send path is at-least-once: client.send succeeds → stampSent writes\n    // `Sent at` (the ONLY thing that removes the row from listSendableReports). If\n    // stampSent threw on a PRIOR run (an Airtable blip), `Sent at` stayed null and\n    // the row replays here. By replay time the rendered body has usually changed\n    // (operator Commentary edit, `report --due` rewrote scores, or the header\n    // re-encodes non-deterministically), so Resend rejects the same-key\n    // (`report:<id>`) / different-body re-send with a 409 (`invalid_idempotent_request`).\n    //\n    // That 409 means the email ALREADY WENT OUT under this key on the prior run.\n    // Do NOT re-throw and do NOT re-send (re-throwing leaves the row unstamped, and\n    // after the 24h key TTL a SECOND real email would go out). Instead stamp the row\n    // so it stops replaying, then return success so the caller runs the Launch flip —\n    // which self-heals a launch that sent-but-never-flipped on the prior run.\n    //\n    // Any OTHER error (real network/Resend failure) re-throws, exactly as before, so\n    // a genuine failure still fails loudly and the row replays next run.\n    if (isIdempotencyConflict(err)) {\n      // Stamp `Sent at` ONLY — the original send's messageId is unrecoverable on\n      // the 409 path, so we leave `Resend message ID` null rather than writing a\n      // sentinel that would masquerade as a real id and orphan webhook lookups.\n      // Still return the sentinel string so the caller logs the already-sent path\n      // and runs the Launch flip.\n      await stampSent(base, report.id, new Date(), null);\n      console.log(`↻ already sent (idempotency conflict), stamped: ${report.reportId}`);\n      return \"idempotent-conflict\";\n    }\n    throw err;\n  }\n  await stampSent(base, report.id, new Date(), result.messageId);\n  return result.messageId;\n}\n\n/**\n * Split a comma/newline-separated address field into a clean array.\n * Lowercases (case-insensitive dedupe) and removes empty entries. Returns\n * null if nothing survives. Does NOT understand `Display Name <email>` —\n * operators should put a bare address in the Airtable field, or use multiple\n * lines if needing multiple recipients.\n */\nexport function parseAddresses(field: string | null): string[] | null {\n  if (!field) return null;\n  const seen = new Set<string>();\n  const list: string[] = [];\n  for (const raw of field.split(/[,\\n]/)) {\n    const trimmed = raw.trim().toLowerCase();\n    if (!trimmed) continue;\n    if (seen.has(trimmed)) continue;\n    seen.add(trimmed);\n    list.push(trimmed);\n  }\n  return list.length > 0 ? list : null;\n}\n\n/**\n * Cheap email shape check — must contain exactly one @, with non-empty\n * local and domain parts and at least one dot in the domain. We're not\n * trying to be a full RFC validator; we're trying to catch operator\n * mistakes like \"ops at acme dot com\" or a missing @ before they 422\n * at Resend.\n */\nexport function isProbablyEmail(s: string): boolean {\n  const at = s.indexOf(\"@\");\n  if (at < 1 || at !== s.lastIndexOf(\"@\")) return false;\n  const local = s.slice(0, at);\n  const domain = s.slice(at + 1);\n  if (!local || !domain) return false;\n  if (!domain.includes(\".\")) return false;\n  if (/\\s/.test(s)) return false;\n  return true;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,WAAW;AAoBlB,IAAM,wBAAwB;AAE9B,IAAM,eAAe;AAErB,IAAM,eAAe;AAErB,SAAS,aAAa,OAAuB;AAC3C,SAAO,KAAK,IAAI,GAAG,KAAK,IAAI,KAAK,KAAK,MAAM,KAAK,CAAC,CAAC,EAChD,SAAS,EAAE,EACX,SAAS,GAAG,GAAG;AACpB;AAWA,eAAsB,mBACpB,OACA,UAAqC,CAAC,GACR;AAC9B,QAAM,wBAAwB,QAAQ,gBAAgB;AACtD,QAAM,QAAQ,OAAO,KAAK,KAAK;AAE/B,QAAM,OAAO,MAAM,MAAM,KAAK,EAAE,SAAS;AACzC,QAAM,YAAY,KAAK;AACvB,QAAM,aAAa,KAAK;AACxB,MAAI,CAAC,aAAa,CAAC,YAAY;AAC7B,UAAM,IAAI,MAAM,4DAA4D;AAAA,EAC9E;AAGA,QAAM,eAAe,KAAK,IAAI,uBAAuB,SAAS;AAC9D,QAAM,gBAAgB,KAAK,MAAO,eAAe,aAAc,SAAS;AAGxE,QAAM,oBAAoB,KAAK,IAAI,WAAW,eAAe,YAAY;AAEzE,QAAM,MAAM,MAAM,MAAM,KAAK,EAC1B,OAAO,EAAE,OAAO,mBAAmB,oBAAoB,KAAK,CAAC,EAC7D,QAAQ,EAAE,YAAY,UAAU,CAAC,EACjC,KAAK,EAAE,SAAS,aAAa,CAAC,EAC9B,SAAS;AAEZ,QAAM,EAAE,SAAS,IAAI,MAAM,MAAM,GAAG,EAAE,MAAM;AAC5C,QAAM,mBAAmB,IAAI,aAAa,SAAS,CAAC,CAAC,GAAG,aAAa,SAAS,CAAC,CAAC,GAAG,aAAa,SAAS,CAAC,CAAC;AAE3G,SAAO;AAAA,IACL,OAAO,IAAI,WAAW,GAAG;AAAA,IACzB,aAAa;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;;;AC9DA,IAAM,eAAe;AACrB,IAAM,WAAW;AAIV,IAAM,mBAAmB;AAUzB,SAAS,aAAa,WAA4B,IAAwB;AAC/E,QAAM,KAAK,CAAC,GAAI,aAAa,CAAC,CAAE;AAChC,QAAM,UAAU,IAAI,IAAI,CAAC,GAAG,IAAI,GAAG,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;AAClE,MAAI,CAAC,QAAQ,IAAI,iBAAiB,YAAY,CAAC,EAAG,IAAG,KAAK,gBAAgB;AAC1E,SAAO;AACT;AAEA,IAAM,SAAS;AAAA,EACb;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGA,SAAS,UAAU,GAAiB;AAClC,SAAO,GAAG,OAAO,EAAE,YAAY,CAAC,CAAC,IAAI,EAAE,eAAe,CAAC;AACzD;AAIA,SAAS,WAAW,OAAsB,KAAwC;AAChF,MAAI,CAAC,SAAS,CAAC,IAAK,QAAO;AAC3B,QAAM,KAAK,IAAI,KAAK,GAAG,EAAE,QAAQ,IAAI,IAAI,KAAK,KAAK,EAAE,QAAQ;AAC7D,MAAI,CAAC,OAAO,SAAS,EAAE,KAAK,MAAM,EAAG,QAAO;AAC5C,SAAO,KAAK,MAAM,MAAM,KAAK,KAAK,KAAK,IAAK;AAC9C;AAMA,SAAS,mBAAmB,GAKP;AACnB,SAAO;AAAA,IACL,UAAU,EAAE;AAAA,IACZ,SAAS,OAAO,KAAK,EAAE,KAAK,EAAE,SAAS,QAAQ;AAAA,IAC/C,aAAa,EAAE;AAAA,IACf,iBAAiB,EAAE;AAAA,EACrB;AACF;AAMA,eAAsB,oBACpB,UAA8B,CAAC,GACY;AAC3C,QAAM,OAAO,SAAS,mBAAmB,CAAC;AAC1C,QAAM,SAAS,QAAQ,UAAU,oBAAoB;AAErD,QAAM,WAAW,MAAM,oBAAoB,IAAI;AAC/C,MAAI,SAAS,WAAW,EAAG,QAAO,EAAE,QAAQ,6BAA6B,MAAM,EAAE;AAEjF,QAAM,WAAW,MAAM,aAAa,IAAI;AACxC,QAAM,QAAQ,IAAI,IAAI,SAAS,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AAEpD,QAAM,QAAkB,CAAC;AACzB,MAAI,YAAY;AAChB,aAAW,UAAU,UAAU;AAC7B,UAAM,OAAO,MAAM,IAAI,OAAO,MAAM;AACpC,QAAI,CAAC,MAAM;AACT,YAAM,KAAK,UAAK,OAAO,QAAQ,qCAAgC,OAAO,MAAM,EAAE;AAC9E,kBAAY;AACZ;AAAA,IACF;AACA,QAAI;AACF,YAAM,YAAY,MAAM,QAAQ,QAAQ,MAAM,MAAM,MAAM;AAC1D,YAAM,KAAK,gBAAW,OAAO,QAAQ,KAAK,SAAS,GAAG;AACtD,UAAI,OAAO,eAAe,UAAU;AAClC,YAAI;AACF,gBAAM,eAAe,MAAM,KAAK,KAAI,oBAAI,KAAK,GAAE,YAAY,CAAC;AAC5D,gBAAM,KAAK,sBAAiB,KAAK,IAAI,yBAAyB;AAC9D,gBAAM;AAAA,YACJ;AAAA,cACE;AAAA,gBACE,IAAI,iBAAiB,KAAK,EAAE;AAAA,gBAC5B,KAAI,oBAAI,KAAK,GAAE,YAAY;AAAA,gBAC3B,MAAM;AAAA,gBACN,QAAQ,KAAK;AAAA,gBACb,UAAU,KAAK;AAAA,gBACf,SAAS;AAAA,gBACT,MAAM;AAAA,cACR;AAAA,YACF;AAAA,YACA,oBAAI,KAAK;AAAA,UACX;AAAA,QACF,SAAS,GAAG;AACV,gBAAM,KAAK,mCAA8B,KAAK,IAAI,KAAM,EAAY,OAAO,EAAE;AAAA,QAC/E;AAAA,MACF;AAAA,IACF,SAAS,GAAG;AACV,YAAM,KAAK,UAAK,OAAO,QAAQ,WAAO,EAAY,OAAO,EAAE;AAC3D,kBAAY;AAAA,IACd;AAAA,EACF;AACA,SAAO,EAAE,QAAQ,MAAM,KAAK,IAAI,GAAG,MAAM,YAAY,IAAI,EAAE;AAC7D;AAEA,eAAe,QACb,QACA,MACA,MACA,QACiB;AAMjB,MAAI,CAAC,oBAAoB,MAAM,GAAG;AAChC,UAAM,QAAQ,aAAa,OAAO,UAAU;AAC5C,UAAM,OAAO,MAAM,OAAO,CAAC,MAAM,OAAO,UAAU,EAAE,KAAK,MAAM,IAAI,EAAE;AACrE,UAAM,IAAI;AAAA,MACR,UAAU,OAAO,QAAQ,gCAA2B,IAAI,IAAI,MAAM,MAAM;AAAA,IAC1E;AAAA,EACF;AACA,MAAI,CAAC,KAAK,aAAa;AACrB,UAAM,IAAI,MAAM,SAAS,KAAK,IAAI,+CAA+C;AAAA,EACnF;AACA,MAAI,CAAC,OAAO,YAAY;AACtB,UAAM,IAAI;AAAA,MACR,UAAU,OAAO,QAAQ;AAAA,IAG3B;AAAA,EACF;AAMA,QAAM,aAAa,eAAe,KAAK,kBAAkB;AAGzD,QAAM,aAAa,eAAe,KAAK,cAAc;AACrD,QAAM,KAAK,cAAc,cAAc,CAAC;AACxC,MAAI,GAAG,WAAW,GAAG;AACnB,UAAM,IAAI;AAAA,MACR,SAAS,KAAK,IAAI;AAAA,IACpB;AAAA,EACF;AACA,aAAW,QAAQ,IAAI;AACrB,QAAI,CAAC,gBAAgB,IAAI,GAAG;AAC1B,YAAM,IAAI;AAAA,QACR,SAAS,KAAK,IAAI,6BAA6B,IAAI;AAAA,MAErD;AAAA,IACF;AAAA,EACF;AACA,QAAM,KAAK,eAAe,KAAK,kBAAkB;AACjD,MAAI,IAAI;AACN,eAAW,QAAQ,IAAI;AACrB,UAAI,CAAC,gBAAgB,IAAI,GAAG;AAC1B,cAAM,IAAI;AAAA,UACR,SAAS,KAAK,IAAI,sBAAsB,IAAI;AAAA,QAC9C;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,WAAW,MAAM,qBAAqB,KAAK,YAAY,GAAG;AAGhE,QAAM,SAAS,MAAM,mBAAmB,SAAS,KAAK;AACtD,QAAM,UAAU,MAAM,kBAAkB;AAExC,QAAM,OAAO,SAAS,KAAK,IAAI;AAC/B,QAAM,UAAU,GAAG,IAAI;AAKvB,QAAM,eACJ,OAAO,eAAe,iBAAiB,KAAK,WAAW,OAAO,aAAa,OAAO,SAAS;AAC7F,QAAM,EAAE,KAAK,IAAI,MAAM,iBAAiB;AAAA,IACtC,UAAU,KAAK;AAAA,IACf,SAAS,KAAK;AAAA,IACd,YAAY,OAAO;AAAA,IACnB,aAAa,OAAO,cAAc,IAAI,KAAK,OAAO,WAAW,IAAI,oBAAI,KAAK;AAAA,IAC1E,YAAY,OAAO;AAAA,IACnB,gBAAgB,OAAO,kBAAkB;AAAA,IACzC,iBAAiB,OAAO,mBAAmB;AAAA,IAC3C;AAAA,IACA,gBACE,OAAO,oBAAoB,OAAO,mBAAmB,OAAO,OAAO,iBAAiB;AAAA,IACtF,gBAAgB,OAAO,iBAAiB,IAAI,KAAK,OAAO,cAAc,IAAI;AAAA,IAC1E,YAAY,OAAO;AAAA,IACnB,MAAM,YAAY,IAAI;AAAA,IACtB,gBAAgB;AAAA,IAChB,aAAa,OAAO;AAAA,IACpB,cAAc,OAAO;AAAA,IACrB,eAAe,OAAO;AAAA;AAAA;AAAA;AAAA,IAItB,GAAI,OAAO,eAAe,iBAAiB,uBAAuB,IAAI,IAAI,CAAC;AAAA,EAC7E,CAAC;AAED,QAAM,aAAa,OAAO,cAAc,IAAI,KAAK,OAAO,WAAW,IAAI,oBAAI,KAAK;AAChF,QAAM,UACJ,OAAO,mBAAmB,GAAG,KAAK,IAAI,WAAM,UAAU,UAAU,CAAC,IAAI,OAAO,UAAU;AAUxF,QAAM,cAAkC;AAAA,IACtC,mBAAmB;AAAA,MACjB,OAAO,OAAO;AAAA,MACd,UAAU,GAAG,OAAO;AAAA,MACpB,aAAa,OAAO;AAAA,MACpB,KAAK;AAAA,IACP,CAAC;AAAA,EACH;AACA,aAAW,OAAO,CAAC,QAAQ,OAAO,QAAQ,OAAO,GAAG;AAClD,QAAI,KAAK,SAAS,OAAO,IAAI,GAAG,EAAE,GAAG;AACnC,kBAAY;AAAA,QACV,mBAAmB;AAAA,UACjB,OAAO,IAAI;AAAA,UACX,UAAU,IAAI;AAAA,UACd,aAAa,IAAI;AAAA,UACjB,KAAK,IAAI;AAAA,QACX,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAA+C;AAAA,IACnD,MAAM;AAAA,IACN;AAAA,IACA,SAAS;AAAA,IACT;AAAA,IACA;AAAA,IACA;AAAA;AAAA;AAAA;AAAA,IAIA,gBAAgB,UAAU,OAAO,EAAE;AAAA,EACrC;AAEA,QAAM,UAAU,aAAa,IAAI,EAAE;AACnC,MAAI,QAAQ,SAAS,EAAG,SAAQ,KAAK;AAErC,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,OAAO,KAAK,OAAO;AAAA,EACpC,SAAS,KAAK;AAiBZ,QAAI,sBAAsB,GAAG,GAAG;AAM9B,YAAM,UAAU,MAAM,OAAO,IAAI,oBAAI,KAAK,GAAG,IAAI;AACjD,cAAQ,IAAI,wDAAmD,OAAO,QAAQ,EAAE;AAChF,aAAO;AAAA,IACT;AACA,UAAM;AAAA,EACR;AACA,QAAM,UAAU,MAAM,OAAO,IAAI,oBAAI,KAAK,GAAG,OAAO,SAAS;AAC7D,SAAO,OAAO;AAChB;AASO,SAAS,eAAe,OAAuC;AACpE,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,OAAiB,CAAC;AACxB,aAAW,OAAO,MAAM,MAAM,OAAO,GAAG;AACtC,UAAM,UAAU,IAAI,KAAK,EAAE,YAAY;AACvC,QAAI,CAAC,QAAS;AACd,QAAI,KAAK,IAAI,OAAO,EAAG;AACvB,SAAK,IAAI,OAAO;AAChB,SAAK,KAAK,OAAO;AAAA,EACnB;AACA,SAAO,KAAK,SAAS,IAAI,OAAO;AAClC;AASO,SAAS,gBAAgB,GAAoB;AAClD,QAAM,KAAK,EAAE,QAAQ,GAAG;AACxB,MAAI,KAAK,KAAK,OAAO,EAAE,YAAY,GAAG,EAAG,QAAO;AAChD,QAAM,QAAQ,EAAE,MAAM,GAAG,EAAE;AAC3B,QAAM,SAAS,EAAE,MAAM,KAAK,CAAC;AAC7B,MAAI,CAAC,SAAS,CAAC,OAAQ,QAAO;AAC9B,MAAI,CAAC,OAAO,SAAS,GAAG,EAAG,QAAO;AAClC,MAAI,KAAK,KAAK,CAAC,EAAG,QAAO;AACzB,SAAO;AACT;","names":[]}

package/dist/{chunk-L4ULXHIN.js → chunk-BLD6AYJO.js}

@@ -81,6 +81,10 @@ function mapRow(rec) {
     securityAdvisories: parseSecurityAdvisories(f["Security advisories"]),
     certDaysRemaining: f["Cert days remaining"] ?? null,
     domainCheckedAt: f["Domain checked at"] ?? null,
+    netlifyId: trimToNull(f["Netlify ID"]),
+    deployStatus: f["Deploy status"] ?? null,
+    lastDeployAt: f["Last deploy at"] ?? null,
+    deployLogUrl: f["Deploy log URL"] ?? null,
     crossbrowserOk: typeof f["Crossbrowser OK"] === "boolean" ? f["Crossbrowser OK"] : null,
     mobileOk: typeof f["Mobile OK"] === "boolean" ? f["Mobile OK"] : null,
     linksOk: typeof f["Links OK"] === "boolean" ? f["Links OK"] : null,
@@ -198,6 +202,15 @@ function domainFields(result) {
   fields["Cert days remaining"] = result.certDaysRemaining;
   return fields;
 }
+function netlifyDeployFields(result) {
+  const fields = {
+    "Deploy status": result.state,
+    "Last deploy at": result.deployedAt,
+    "Deploy log URL": result.logUrl,
+    "Deploy checked at": result.checkedAt
+  };
+  return fields;
+}
 function browserFields(r) {
   return {
     "Crossbrowser OK": r.desktopOk,
@@ -241,6 +254,7 @@ async function updateAuditFields(base, recordId, audits) {
     Object.assign(fields, securityAdvisoryFields(audits.securityAdvisories));
   if (audits.domain) Object.assign(fields, domainFields(audits.domain));
   if (audits.browser) Object.assign(fields, browserFields(audits.browser));
+  if (audits.netlifyDeploy) Object.assign(fields, netlifyDeployFields(audits.netlifyDeploy));
   await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);
   return fields;
 }
@@ -283,4 +297,4 @@ export {
   updateGitHubSignals,
   updateLaunched
 };
-//# sourceMappingURL=chunk-L4ULXHIN.js.map
+//# sourceMappingURL=chunk-BLD6AYJO.js.map

package/dist/chunk-BLD6AYJO.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/reports/airtable/websites.ts"],"sourcesContent":["import type { FieldSet } from \"airtable\";\nimport type { AirtableBase } from \"./client.js\";\nimport type { LighthouseScores, LighthouseScoreWriteback } from \"../types.js\";\n\nexport const WEBSITES_TABLE = \"Websites\";\n\nexport type Frequency = \"None\" | \"Monthly\" | \"Quarterly\" | \"Yearly\";\n\nexport type Status =\n  | \"in development\"\n  | \"launch period\"\n  | \"maintenance\"\n  | \"hosting\"\n  | \"probably not our problem\"\n  | \"deprecated\";\n\n/**\n * Per-site notification routing. When present on a `maintenance` site, the form\n * notification is addressed by the value of a submission field (`field`, read from\n * `extraFields`) — e.g. route a contact form's `interest` to a different recipient\n * per option, always CC-ing a shared address. Absent (`null`) → the site keeps the\n * default single-POC behavior. Recipients live HERE (server-side Airtable config),\n * never supplied by the submitting site, so the ingest can't be turned into an open\n * relay.\n */\nexport type NotifyRouting = {\n  /** The `extraFields` key whose value selects a route, e.g. \"interest\". */\n  field: string;\n  /** Field-value → recipient address(es). */\n  routes: Record<string, string | string[]>;\n  /** Recipient(s) when the value matches no route. */\n  default?: string | string[];\n  /** Address(es) CC'd on every routed (maintenance) send. */\n  cc?: string[];\n};\n\nexport type WebsiteRow = {\n  id: string;\n  name: string;\n  url: string;\n  status: Status | null;\n  pointOfContact: string | null;\n  maintenanceFreq: Frequency;\n  testingFreq: Frequency;\n  /** Last manually-recorded maintenance day (used as fallback when no Reports row exists). */\n  maintenanceDay: string | null;\n  testingDay: string | null;\n  ga4PropertyId: string | null;\n  /** Operator-supplied query for the Google search-presence check (e.g. the business name).\n   *  Null = no query set → the check is skipped for this site. */\n  searchQuery: string | null;\n  /** Explicit Search Console property for this site (`sc-domain:...` or `https://.../`).\n   *  Null = auto-resolve from the SA's visible properties by host. */\n  searchConsoleProperty: string | null;\n  /** ISO timestamp of the last draft run where THIS site's GA/Search enrichment\n   *  ERRORED (vs a legitimate \"not configured\" skip). Set by drafting on a soft-fail,\n   *  cleared (null) on a clean enrichment, so the per-site analytics-failure signal\n   *  self-heals. Null when the operator-added `Analytics soft-fail at` column is absent. */\n  analyticsSoftFailAt: string | null;\n  /** GitHub repo identity as `owner/repo`. Null = no git wiring → self-update ops skip\n   *  (or, for local runs, fall back to the checkout's origin remote). */\n  gitRepo: string | null;\n  reportRecipientsTo: string | null;\n  reportRecipientsCc: string | null;\n  /** First attachment in the Header image field (Airtable's signed URL — fetch before expiry). */\n  headerImage: { url: string; filename: string; type: string } | null;\n  /** Lighthouse \"current state\" snapshot, kept fresh by `audit lighthouse --write-airtable`. */\n  pScore: number | null;\n  rScore: number | null;\n  bpScore: number | null;\n  seoScore: number | null;\n  /** ISO timestamp set by `audit lighthouse --write-airtable` when scores were last refreshed. */\n  lastLighthouseAuditAt: string | null;\n  /** Last-known counts from non-lighthouse audits, written by\n   *  `audit --write-airtable`. `null` = never audited (or this audit\n   *  type was skipped on the last run). 0 = audited, clean. */\n  a11yViolations: number | null;\n  /** Declared-range drift vs the Reddoor baseline (what package.json asks for). */\n  depsDrifted: number | null;\n  depsMajorBehind: number | null;\n  /** Real installed-version drift: deps behind the registry's latest, from the\n   *  committed lockfile (`pnpm outdated`). Null = not determined this run. */\n  depsOutdated: number | null;\n  securityVulnsCritical: number | null;\n  securityVulnsHigh: number | null;\n  securityVulnsModerate: number | null;\n  securityVulnsLow: number | null;\n  /** Count of consecutive nightly Renovate auto-fix dispatches for the CURRENT\n   *  critical/high vuln episode that have NOT yet cleared it. Owned by\n   *  `renovate-dispatch`: +1 per real dispatch, reset to 0 when vulns clear.\n   *  Null = field absent / never dispatched → reads as 0. At/above\n   *  AUTO_FIX_EXHAUSTED_CYCLES the vuln renders as \"auto-fix failed\". */\n  securityAutoFixAttempts: number | null;\n  /** ISO timestamp the security audit last ran — gates freshness of the Security Updates auto-tick\n   *  (clean counts only auto-tick when recent). */\n  lastSecurityAuditAt: string | null;\n  /** The known advisories behind the counts (severity-sorted, capped), so the dashboard can show\n   *  WHICH packages are vulnerable, not just the totals. null = never audited / unparseable;\n   *  empty array = audited clean. Written alongside the counts by the security audit. */\n  securityAdvisories: SecurityAdvisory[] | null;\n  /** Domain/DNS/SSL probe (the `domain` audit). `certDaysRemaining` is days until the TLS cert\n   *  expires (null = unresolved or no usable cert); `domainCheckedAt` is when it last ran. */\n  certDaysRemaining: number | null;\n  domainCheckedAt: string | null;\n  /** Netlify site id — the IDENTITY the `netlify-deploy` audit needs to query the\n   *  Netlify API. Read-only input (operator-set in Airtable); null = not on Netlify\n   *  (or not wired) → that audit skips. Never derived from the URL. */\n  netlifyId: string | null;\n  /** Latest PRODUCTION deploy health (the `netlify-deploy` audit). `deployStatus` is\n   *  Netlify's deploy state lower-cased (`ready`/`error`/`building`/…), null = none / not\n   *  checked; `lastDeployAt` is when it deployed; `deployLogUrl` links to the deploy/log. */\n  deployStatus: string | null;\n  lastDeployAt: string | null;\n  deployLogUrl: string | null;\n  /** Deployed-URL browser probe (the `browser` audit): cross-engine render OK, mobile render OK,\n   *  internal-links OK + broken count, and when it last ran (one timestamp gates all three). */\n  crossbrowserOk: boolean | null;\n  mobileOk: boolean | null;\n  linksOk: boolean | null;\n  brokenLinks: number | null;\n  browserCheckedAt: string | null;\n  /** Per-site copy overrides (M6a). Blank → null → the DEFAULT_COPY value. */\n  copyIntro: string | null;\n  copyContact: string | null;\n  copyFooter: string | null;\n  /** Go-live timestamp, stamped when a Launch report sends (M6b). Null = not yet launched. */\n  launchedAt: string | null;\n  /** Optional per-site webhook (e.g. Zapier Catch Hook). When set, the ingest\n   *  POSTs newsletter-formType submissions here (best-effort). Blank → null. */\n  newsletterWebhook: string | null;\n  /** Per-site Mailchimp (newsletter). Both must be set for the direct add;\n   *  blank → skipped. The API key is `key-dc` format; dc is derived from it. */\n  mailchimpApiKey: string | null;\n  mailchimpAudienceId: string | null;\n  /** GitHub-signals sweep (slice 2a), written nightly by `github-signals --fleet`. */\n  renovateFailingCis: number | null;\n  defaultBranchCi: string | null; // \"passing\" | \"failing\" | \"pending\" | \"none\"\n  lastCommitAt: string | null;\n  githubSignalsAt: string | null;\n  notifyRouting: NotifyRouting | null;\n};\n\nexport function siteSlug(name: string): string {\n  return name\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, \"-\")\n    .replace(/^-|-$/g, \"\");\n}\n\n/** Blank-trim-to-null: a non-string or whitespace-only value becomes null,\n *  otherwise the trimmed string. */\nfunction trimToNull(raw: unknown): string | null {\n  if (typeof raw !== \"string\") return null;\n  const trimmed = raw.trim();\n  return trimmed.length > 0 ? trimmed : null;\n}\n\n/**\n * Parse the Websites `Notify Routing` JSON into a NotifyRouting, defensively: a\n * non-string, blank, malformed-JSON, or wrong-shape value yields null (the site\n * then keeps default single-POC routing) — never throws. Mirrors the pipeline's\n * \"a bad Airtable string degrades quietly\" rule.\n */\nexport function parseNotifyRouting(raw: unknown): NotifyRouting | null {\n  if (typeof raw !== \"string\") return null;\n  const trimmed = raw.trim();\n  if (!trimmed) return null;\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(trimmed);\n  } catch {\n    return null;\n  }\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) return null;\n  const o = parsed as Record<string, unknown>;\n  if (typeof o.field !== \"string\" || !o.field.trim()) return null;\n  if (!o.routes || typeof o.routes !== \"object\" || Array.isArray(o.routes)) return null;\n  const routing: NotifyRouting = {\n    field: o.field,\n    routes: o.routes as Record<string, string | string[]>,\n  };\n  if (o.default !== undefined) routing.default = o.default as string | string[];\n  if (Array.isArray(o.cc)) routing.cc = o.cc.filter((x): x is string => typeof x === \"string\");\n  return routing;\n}\n\n/**\n * Active sites: actively-maintained or pre-launch. Single source of truth for\n * \"is this a live site\" — the operator cockpit shows these, and the fleet\n * audit/report path runs against these. A `null` status (not-yet-active) is\n * deliberately excluded.\n */\nexport const ACTIVE_STATUSES: ReadonlySet<Status> = new Set<Status>([\n  \"maintenance\",\n  \"launch period\",\n]);\n\nexport function isDashboardVisible(site: WebsiteRow): boolean {\n  return site.status !== null && ACTIVE_STATUSES.has(site.status);\n}\n\nconst FREQUENCIES: readonly Frequency[] = [\"None\", \"Monthly\", \"Quarterly\", \"Yearly\"];\n\n/** Coerce an Airtable single-select value to a known Frequency. An unrecognized value — a\n *  renamed / typo'd / whitespace option — falls back to \"None\" (its section is simply omitted)\n *  rather than flowing a bogus string downstream, which the announcement would otherwise render\n *  as \"We do this undefined.\" into a client email. */\nfunction toFrequency(raw: unknown): Frequency {\n  return typeof raw === \"string\" && (FREQUENCIES as readonly string[]).includes(raw)\n    ? (raw as Frequency)\n    : \"None\";\n}\n\n// NOTE: every `f[\"...\"]` key below is a load-bearing magic string that must match\n// the live Airtable \"Websites\" column name EXACTLY — including the legacy\n// misspelling `\"maintenence freq\"`, the mixed-case `\"GA4 property ID\"`, and the\n// lowercase `\"url\"` / `\"point of contact\"`. A column rename in Airtable silently\n// returns undefined here (→ null), which degrades quietly (GA skipped, recipients\n// empty) with no error. If you rename a column, change it here too.\nexport function mapRow(rec: { id: string; fields: Record<string, unknown> }): WebsiteRow {\n  const f = rec.fields;\n  const attachments =\n    (f[\"Header image\"] as Array<{ url: string; filename: string; type: string }> | undefined) ?? [];\n  const header = attachments[0] ?? null;\n  return {\n    id: rec.id,\n    name: String(f[\"Name\"] ?? \"\"),\n    url: String(f[\"url\"] ?? \"\"),\n    status: (f[\"Status\"] as Status | undefined) ?? null,\n    pointOfContact: (f[\"point of contact\"] as string | undefined) ?? null,\n    maintenanceFreq: toFrequency(f[\"maintenence freq\"]),\n    testingFreq: toFrequency(f[\"testing freq\"]),\n    maintenanceDay: (f[\"maintenance day\"] as string | undefined) ?? null,\n    testingDay: (f[\"testing day\"] as string | undefined) ?? null,\n    ga4PropertyId: (f[\"GA4 property ID\"] as string | undefined) ?? null,\n    searchQuery: (f[\"Search query\"] as string | undefined) ?? null,\n    searchConsoleProperty: (f[\"Search Console property\"] as string | undefined) ?? null,\n    analyticsSoftFailAt: (f[\"Analytics soft-fail at\"] as string | undefined) ?? null,\n    gitRepo: (f[\"Git repo\"] as string | undefined) ?? null,\n    reportRecipientsTo: (f[\"Report recipients (To)\"] as string | undefined) ?? null,\n    reportRecipientsCc: (f[\"Report recipients (CC)\"] as string | undefined) ?? null,\n    headerImage: header,\n    pScore: (f[\"pScore\"] as number | undefined) ?? null,\n    rScore: (f[\"rScore\"] as number | undefined) ?? null,\n    bpScore: (f[\"bpScore\"] as number | undefined) ?? null,\n    seoScore: (f[\"seoScore\"] as number | undefined) ?? null,\n    lastLighthouseAuditAt: (f[\"Last lighthouse audit at\"] as string | undefined) ?? null,\n    a11yViolations: (f[\"A11y Violations\"] as number | undefined) ?? null,\n    depsDrifted: (f[\"Deps Drifted\"] as number | undefined) ?? null,\n    depsMajorBehind: (f[\"Deps Major Behind\"] as number | undefined) ?? null,\n    depsOutdated: (f[\"Deps Outdated\"] as number | undefined) ?? null,\n    securityVulnsCritical: (f[\"Security Vulns Critical\"] as number | undefined) ?? null,\n    securityVulnsHigh: (f[\"Security Vulns High\"] as number | undefined) ?? null,\n    securityVulnsModerate: (f[\"Security Vulns Moderate\"] as number | undefined) ?? null,\n    securityVulnsLow: (f[\"Security Vulns Low\"] as number | undefined) ?? null,\n    securityAutoFixAttempts: (f[\"Security Auto-Fix Attempts\"] as number | undefined) ?? null,\n    lastSecurityAuditAt: (f[\"Last security audit at\"] as string | undefined) ?? null,\n    securityAdvisories: parseSecurityAdvisories(f[\"Security advisories\"]),\n    certDaysRemaining: (f[\"Cert days remaining\"] as number | undefined) ?? null,\n    domainCheckedAt: (f[\"Domain checked at\"] as string | undefined) ?? null,\n    netlifyId: trimToNull(f[\"Netlify ID\"]),\n    deployStatus: (f[\"Deploy status\"] as string | undefined) ?? null,\n    lastDeployAt: (f[\"Last deploy at\"] as string | undefined) ?? null,\n    deployLogUrl: (f[\"Deploy log URL\"] as string | undefined) ?? null,\n    crossbrowserOk:\n      typeof f[\"Crossbrowser OK\"] === \"boolean\" ? (f[\"Crossbrowser OK\"] as boolean) : null,\n    mobileOk: typeof f[\"Mobile OK\"] === \"boolean\" ? (f[\"Mobile OK\"] as boolean) : null,\n    linksOk: typeof f[\"Links OK\"] === \"boolean\" ? (f[\"Links OK\"] as boolean) : null,\n    brokenLinks: typeof f[\"Broken links\"] === \"number\" ? (f[\"Broken links\"] as number) : null,\n    browserCheckedAt: (f[\"Browser checked at\"] as string | undefined) ?? null,\n    copyIntro: trimToNull(f[\"Copy — Intro\"]),\n    copyContact: trimToNull(f[\"Copy — Contact\"]),\n    copyFooter: trimToNull(f[\"Copy — Footer\"]),\n    launchedAt: (f[\"Launched at\"] as string | undefined) ?? null,\n    newsletterWebhook: trimToNull(f[\"Newsletter Webhook\"]),\n    notifyRouting: parseNotifyRouting(f[\"Notify Routing\"]),\n    mailchimpApiKey: trimToNull(f[\"Mailchimp API Key\"]),\n    mailchimpAudienceId: trimToNull(f[\"Mailchimp Audience ID\"]),\n    renovateFailingCis: (f[\"Renovate Failing CIs\"] as number | undefined) ?? null,\n    defaultBranchCi: (f[\"Default Branch CI\"] as string | undefined) ?? null,\n    lastCommitAt: (f[\"Last Commit At\"] as string | undefined) ?? null,\n    githubSignalsAt: (f[\"GitHub Signals At\"] as string | undefined) ?? null,\n  };\n}\n\nexport async function listWebsites(base: AirtableBase): Promise<WebsiteRow[]> {\n  const out: WebsiteRow[] = [];\n  await base(WEBSITES_TABLE)\n    .select({ pageSize: 100 })\n    .eachPage((records, fetchNextPage) => {\n      for (const rec of records) out.push(mapRow({ id: rec.id, fields: rec.fields }));\n      fetchNextPage();\n    });\n  return out;\n}\n\nexport async function getWebsiteBySlug(\n  base: AirtableBase,\n  slug: string,\n): Promise<WebsiteRow | null> {\n  // Slugs are siteSlug() output: [a-z0-9] segments joined by single hyphens.\n  // Reject anything else — it can't match a real row, and it keeps URL-supplied\n  // input out of the filter formula below (formula-injection guard).\n  if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(slug)) return null;\n\n  // Narrow the fetch to the slug-matching row server-side instead of paging the\n  // whole table per request (MEDIUM-H). The formula replicates siteSlug() on\n  // {Name} — lowercase → non-alnum runs to \"-\" → strip leading/trailing \"-\" —\n  // verified against the live base. maxRecords caps it (slug collisions keep the\n  // prior first-match-wins behavior).\n  const formula = `REGEX_REPLACE(REGEX_REPLACE(LOWER({Name}),\"[^a-z0-9]+\",\"-\"),\"^-|-$\",\"\")=${JSON.stringify(\n    slug,\n  )}`;\n  const rows: WebsiteRow[] = [];\n  await base(WEBSITES_TABLE)\n    .select({ filterByFormula: formula, maxRecords: 1 })\n    .eachPage((records, fetchNextPage) => {\n      for (const rec of records) rows.push(mapRow({ id: rec.id, fields: rec.fields }));\n      fetchNextPage();\n    });\n  // Confirm the match in JS too: keeps the function correct if the formula and\n  // siteSlug() ever drift, and under test fakes that don't evaluate the formula.\n  return rows.find((w) => siteSlug(w.name) === slug) ?? null;\n}\n\n// ── audit-field builders ─────────────────────────────────────────────────────\n// One source of truth for the column-name → value mappings of each audit type.\n// The per-audit `updateXxxCounts` writers delegate to these (for their other\n// callers), and `updateAuditFields` merges whichever are present into ONE write —\n// so the field-name magic strings live in exactly one place.\n\nexport type A11yCounts = { violations: number };\nexport type DepsCounts = { drifted: number; majorBehind: number; outdated: number | null };\nexport type SecurityCounts = { critical: number; high: number; moderate: number; low: number };\nexport type Severity = \"low\" | \"moderate\" | \"high\" | \"critical\";\n/** One known vulnerability behind the security counts, as persisted/rendered. */\nexport type SecurityAdvisory = {\n  module: string;\n  severity: Severity;\n  title: string;\n  cves: string[];\n  url: string | null;\n};\nexport type DomainResult = { certDaysRemaining: number | null; checkedAt: string };\nexport type NetlifyDeployResult = {\n  /** Netlify deploy state lower-cased (`ready`/`error`/`building`/…), null = none. */\n  state: string | null;\n  /** When the latest production deploy was published/created (ISO), null = unknown. */\n  deployedAt: string | null;\n  /** Link to the deploy / its build log, null = unknown. */\n  logUrl: string | null;\n  /** When the audit last ran. */\n  checkedAt: string;\n};\nexport type BrowserAuditFields = {\n  desktopOk: boolean;\n  mobileOk: boolean;\n  linksOk: boolean;\n  brokenLinks: number;\n  checkedAt: string;\n};\n\nfunction scoreFields(scores: LighthouseScoreWriteback): FieldSet {\n  // A null score CLEARS the cell (→ dashboard \"—\"), distinguishing a metric that\n  // errored this run (e.g. NO_LCP → null performance) from a real low score. This\n  // intentionally overwrites a prior value: a run that couldn't measure the metric\n  // shouldn't keep showing a stale number. Writing null to clear mirrors\n  // updateAnalyticsHealth; the `as FieldSet` cast is needed because airtable's\n  // FieldSet type omits null.\n  const fields: Record<string, number | string | null> = {\n    pScore: scores.performance,\n    rScore: scores.accessibility,\n    bpScore: scores.bestPractices,\n    seoScore: scores.seo,\n    \"Last lighthouse audit at\": new Date().toISOString(),\n  };\n  return fields as FieldSet;\n}\n\nfunction a11yFields(counts: A11yCounts): FieldSet {\n  return { \"A11y Violations\": counts.violations };\n}\n\nfunction depsFields(counts: DepsCounts): FieldSet {\n  const fields: FieldSet = {\n    \"Deps Drifted\": counts.drifted,\n    \"Deps Major Behind\": counts.majorBehind,\n  };\n  // Only write the outdated count when it was determined — a null (no/stale\n  // lockfile this run) must not clobber a previously-good value.\n  if (counts.outdated !== null) {\n    fields[\"Deps Outdated\"] = counts.outdated;\n  }\n  return fields;\n}\n\n/** Critical first → low last; the persist cap and the dashboard list both lean on this. */\nexport const SEVERITY_RANK: Record<Severity, number> = {\n  critical: 0,\n  high: 1,\n  moderate: 2,\n  low: 3,\n};\n/** Cap persisted advisories so the JSON field can't blow up on a badly-neglected site. */\nconst MAX_PERSISTED_ADVISORIES = 25;\n\n/** Coerce one untrusted value into a SecurityAdvisory, or null if it isn't shaped like one.\n *  Shared by the read path (`parseSecurityAdvisories`) and the write path so both validate\n *  identically. A missing module or unrecognized severity drops the entry entirely. */\nexport function normalizeSecurityAdvisory(raw: unknown): SecurityAdvisory | null {\n  if (!raw || typeof raw !== \"object\") return null;\n  const e = raw as Record<string, unknown>;\n  const module = typeof e[\"module\"] === \"string\" ? (e[\"module\"] as string) : null;\n  const severity = e[\"severity\"];\n  if (module === null) return null;\n  if (\n    severity !== \"low\" &&\n    severity !== \"moderate\" &&\n    severity !== \"high\" &&\n    severity !== \"critical\"\n  )\n    return null;\n  const cves = Array.isArray(e[\"cves\"])\n    ? (e[\"cves\"] as unknown[]).filter((c): c is string => typeof c === \"string\")\n    : [];\n  return {\n    module,\n    severity,\n    title: typeof e[\"title\"] === \"string\" ? (e[\"title\"] as string) : \"\",\n    cves,\n    url: typeof e[\"url\"] === \"string\" ? (e[\"url\"] as string) : null,\n  };\n}\n\n/** Parse the `Security advisories` JSON cell. null when absent/blank/unparseable/not-an-array\n *  (treated as \"never audited\"); a valid array (possibly empty = audited clean) otherwise. */\nexport function parseSecurityAdvisories(raw: unknown): SecurityAdvisory[] | null {\n  if (typeof raw !== \"string\" || raw.trim() === \"\") return null;\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch {\n    return null;\n  }\n  if (!Array.isArray(parsed)) return null;\n  return parsed.map(normalizeSecurityAdvisory).filter((a): a is SecurityAdvisory => a !== null);\n}\n\nfunction securityAdvisoryFields(advisories: SecurityAdvisory[]): FieldSet {\n  const capped = [...advisories]\n    .sort((a, b) => SEVERITY_RANK[a.severity] - SEVERITY_RANK[b.severity])\n    .slice(0, MAX_PERSISTED_ADVISORIES);\n  // Always write — an empty array (\"[]\") clears a stale list when a once-vulnerable site goes clean.\n  return { \"Security advisories\": JSON.stringify(capped) };\n}\n\nfunction securityFields(counts: SecurityCounts): FieldSet {\n  return {\n    \"Security Vulns Critical\": counts.critical,\n    \"Security Vulns High\": counts.high,\n    \"Security Vulns Moderate\": counts.moderate,\n    \"Security Vulns Low\": counts.low,\n    // Stamp freshness alongside the counts so the Security Updates auto-tick can require a recent\n    // audit (a clean count from months ago must not silently keep ticking the box).\n    \"Last security audit at\": new Date().toISOString(),\n  };\n}\n\nfunction domainFields(result: DomainResult): FieldSet {\n  const fields: FieldSet = { \"Domain checked at\": result.checkedAt };\n  // Write the cert days UNCONDITIONALLY: a null (unresolved / no usable cert) must CLEAR any\n  // previously-good value. Leaving a stale number in place — next to a freshly-stamped \"Domain\n  // checked at\" — false-passes the Domain/DNS/SSL auto-tick (domainEvidence reads the stale\n  // non-null value as a current pass) for a site that's actually down. null clears the cell in\n  // Airtable; FieldSet's type doesn't model null, hence the cast through a widened record.\n  (fields as Record<string, number | null>)[\"Cert days remaining\"] = result.certDaysRemaining;\n  return fields;\n}\n\nfunction netlifyDeployFields(result: NetlifyDeployResult): FieldSet {\n  // Write all three deploy fields UNCONDITIONALLY (null clears the cell): a null state /\n  // deployedAt / logUrl this run means \"couldn't read it\" and must not leave a STALE value\n  // sitting next to a fresh \"Deploy checked at\" — the dashboard would otherwise render a green\n  // \"ready\" badge for a site whose latest deploy actually errored. FieldSet's type doesn't model\n  // null, hence the cast through a widened record (same approach as domainFields).\n  const fields: Record<string, string | null> = {\n    \"Deploy status\": result.state,\n    \"Last deploy at\": result.deployedAt,\n    \"Deploy log URL\": result.logUrl,\n    \"Deploy checked at\": result.checkedAt,\n  };\n  return fields as FieldSet;\n}\n\nfunction browserFields(r: BrowserAuditFields): FieldSet {\n  return {\n    \"Crossbrowser OK\": r.desktopOk,\n    \"Mobile OK\": r.mobileOk,\n    \"Links OK\": r.linksOk,\n    \"Broken links\": r.brokenLinks,\n    \"Browser checked at\": r.checkedAt,\n  };\n}\n\n/**\n * Write the four Lighthouse scores + a refreshed-at timestamp onto a Websites row.\n * Called by `audit lighthouse --write-airtable` after a successful audit run, so\n * the operator never has to paste numbers manually before drafting a report.\n */\nexport async function updateScores(\n  base: AirtableBase,\n  recordId: string,\n  scores: LighthouseScores,\n): Promise<void> {\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields: scoreFields(scores) }]);\n}\n\n/**\n * Record (or clear) the per-site GA/Search enrichment health on the `Analytics\n * soft-fail at` column. `at` is an ISO timestamp when the site's last draft had a\n * GA/Search soft-failure, or `null` to clear it after a clean enrichment. The\n * caller (drafting) swallows errors: this column is operator-added, so until it\n * exists Airtable throws UNKNOWN_FIELD_NAME — which must not break a draft.\n */\nexport async function updateAnalyticsHealth(\n  base: AirtableBase,\n  recordId: string,\n  at: string | null,\n): Promise<void> {\n  const fields: Record<string, string | null> = { \"Analytics soft-fail at\": at };\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields: fields as FieldSet }]);\n}\n\n/** Persist a11y violation count. */\nexport async function updateA11yCounts(\n  base: AirtableBase,\n  recordId: string,\n  counts: A11yCounts,\n): Promise<void> {\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields: a11yFields(counts) }]);\n}\n\n/** Persist deps drift counts (declared-range drift + real outdated installs). */\nexport async function updateDepsCounts(\n  base: AirtableBase,\n  recordId: string,\n  counts: DepsCounts,\n): Promise<void> {\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields: depsFields(counts) }]);\n}\n\n/** Persist security vulnerability counts by severity. */\nexport async function updateSecurityCounts(\n  base: AirtableBase,\n  recordId: string,\n  counts: SecurityCounts,\n): Promise<void> {\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields: securityFields(counts) }]);\n}\n\n/** Persist a site's auto-fix attempt counter. Its own one-field writer so the\n *  nightly Renovate dispatch can update it without touching the audit's counts. */\nexport async function updateAutoFixAttempts(\n  base: AirtableBase,\n  recordId: string,\n  attempts: number,\n): Promise<void> {\n  await base(WEBSITES_TABLE).update([\n    { id: recordId, fields: { \"Security Auto-Fix Attempts\": attempts } },\n  ]);\n}\n\n/** Generic single-field writer for the dashboard site-details editor. The caller\n *  (setSiteDetail) restricts `column` to the EDITABLE_SITE_FIELDS allowlist, so this\n *  never writes an arbitrary column from request input. */\nexport async function updateSiteField(\n  base: AirtableBase,\n  recordId: string,\n  column: string,\n  value: string,\n): Promise<void> {\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields: { [column]: value } }]);\n}\n\n/**\n * Persist all of a single audit run's results to one Websites row in ONE atomic\n * `update()` — instead of up to four sequential updates on the same id (which left\n * a row half-written on a mid-sequence failure and quadrupled the request volume).\n * Pass only the audit slices that produced real values; each present slice is merged\n * via the SAME field mappings the per-audit writers use. Omit a slice (or pass\n * undefined) to leave those columns untouched. Returns the merged FieldSet so the\n * caller can enumerate what was written.\n */\nexport async function updateAuditFields(\n  base: AirtableBase,\n  recordId: string,\n  audits: {\n    scores?: LighthouseScoreWriteback;\n    a11y?: A11yCounts;\n    deps?: DepsCounts;\n    security?: SecurityCounts;\n    securityAdvisories?: SecurityAdvisory[];\n    domain?: DomainResult;\n    browser?: BrowserAuditFields;\n    netlifyDeploy?: NetlifyDeployResult;\n  },\n): Promise<FieldSet> {\n  const fields: FieldSet = {};\n  if (audits.scores) Object.assign(fields, scoreFields(audits.scores));\n  if (audits.a11y) Object.assign(fields, a11yFields(audits.a11y));\n  if (audits.deps) Object.assign(fields, depsFields(audits.deps));\n  if (audits.security) Object.assign(fields, securityFields(audits.security));\n  // Separate slice (not folded into `security`) so the advisory list and the counts can be\n  // written independently, but in practice the security audit supplies both together.\n  if (audits.securityAdvisories)\n    Object.assign(fields, securityAdvisoryFields(audits.securityAdvisories));\n  if (audits.domain) Object.assign(fields, domainFields(audits.domain));\n  if (audits.browser) Object.assign(fields, browserFields(audits.browser));\n  if (audits.netlifyDeploy) Object.assign(fields, netlifyDeployFields(audits.netlifyDeploy));\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);\n  return fields;\n}\n\n/** Persist the GitHub-signals sweep onto a Websites row (slice 2a). A null\n *  `lastCommitAt` is OMITTED so a not-determined-this-run value never clobbers a\n *  previously-good timestamp (mirrors updateDepsCounts' outdated handling). */\nexport async function updateGitHubSignals(\n  base: AirtableBase,\n  recordId: string,\n  signals: {\n    renovateFailingCis: number;\n    ciState: string;\n    lastCommitAt: string | null;\n    sweptAt: string;\n  },\n): Promise<void> {\n  const fields: FieldSet = {\n    \"Renovate Failing CIs\": signals.renovateFailingCis,\n    \"Default Branch CI\": signals.ciState,\n    \"GitHub Signals At\": signals.sweptAt,\n  };\n  if (signals.lastCommitAt !== null) {\n    fields[\"Last Commit At\"] = signals.lastCommitAt;\n  }\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);\n}\n\n/** Mark a site launched: flip Status → maintenance + stamp Launched at (M6b).\n *  The first code that writes Status. Called after a Launch report sends. */\nexport async function updateLaunched(\n  base: AirtableBase,\n  recordId: string,\n  at: string,\n): Promise<void> {\n  const fields: FieldSet = { Status: \"maintenance\", \"Launched at\": at };\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);\n}\n"],"mappings":";AAIO,IAAM,iBAAiB;AA0IvB,SAAS,SAAS,MAAsB;AAC7C,SAAO,KACJ,YAAY,EACZ,QAAQ,eAAe,GAAG,EAC1B,QAAQ,UAAU,EAAE;AACzB;AAIA,SAAS,WAAW,KAA6B;AAC/C,MAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,QAAM,UAAU,IAAI,KAAK;AACzB,SAAO,QAAQ,SAAS,IAAI,UAAU;AACxC;AAQO,SAAS,mBAAmB,KAAoC;AACrE,MAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,QAAM,UAAU,IAAI,KAAK;AACzB,MAAI,CAAC,QAAS,QAAO;AACrB,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,OAAO;AAAA,EAC7B,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,EAAG,QAAO;AAC3E,QAAM,IAAI;AACV,MAAI,OAAO,EAAE,UAAU,YAAY,CAAC,EAAE,MAAM,KAAK,EAAG,QAAO;AAC3D,MAAI,CAAC,EAAE,UAAU,OAAO,EAAE,WAAW,YAAY,MAAM,QAAQ,EAAE,MAAM,EAAG,QAAO;AACjF,QAAM,UAAyB;AAAA,IAC7B,OAAO,EAAE;AAAA,IACT,QAAQ,EAAE;AAAA,EACZ;AACA,MAAI,EAAE,YAAY,OAAW,SAAQ,UAAU,EAAE;AACjD,MAAI,MAAM,QAAQ,EAAE,EAAE,EAAG,SAAQ,KAAK,EAAE,GAAG,OAAO,CAAC,MAAmB,OAAO,MAAM,QAAQ;AAC3F,SAAO;AACT;AAQO,IAAM,kBAAuC,oBAAI,IAAY;AAAA,EAClE;AAAA,EACA;AACF,CAAC;AAEM,SAAS,mBAAmB,MAA2B;AAC5D,SAAO,KAAK,WAAW,QAAQ,gBAAgB,IAAI,KAAK,MAAM;AAChE;AAEA,IAAM,cAAoC,CAAC,QAAQ,WAAW,aAAa,QAAQ;AAMnF,SAAS,YAAY,KAAyB;AAC5C,SAAO,OAAO,QAAQ,YAAa,YAAkC,SAAS,GAAG,IAC5E,MACD;AACN;AAQO,SAAS,OAAO,KAAkE;AACvF,QAAM,IAAI,IAAI;AACd,QAAM,cACH,EAAE,cAAc,KAA4E,CAAC;AAChG,QAAM,SAAS,YAAY,CAAC,KAAK;AACjC,SAAO;AAAA,IACL,IAAI,IAAI;AAAA,IACR,MAAM,OAAO,EAAE,MAAM,KAAK,EAAE;AAAA,IAC5B,KAAK,OAAO,EAAE,KAAK,KAAK,EAAE;AAAA,IAC1B,QAAS,EAAE,QAAQ,KAA4B;AAAA,IAC/C,gBAAiB,EAAE,kBAAkB,KAA4B;AAAA,IACjE,iBAAiB,YAAY,EAAE,kBAAkB,CAAC;AAAA,IAClD,aAAa,YAAY,EAAE,cAAc,CAAC;AAAA,IAC1C,gBAAiB,EAAE,iBAAiB,KAA4B;AAAA,IAChE,YAAa,EAAE,aAAa,KAA4B;AAAA,IACxD,eAAgB,EAAE,iBAAiB,KAA4B;AAAA,IAC/D,aAAc,EAAE,cAAc,KAA4B;AAAA,IAC1D,uBAAwB,EAAE,yBAAyB,KAA4B;AAAA,IAC/E,qBAAsB,EAAE,wBAAwB,KAA4B;AAAA,IAC5E,SAAU,EAAE,UAAU,KAA4B;AAAA,IAClD,oBAAqB,EAAE,wBAAwB,KAA4B;AAAA,IAC3E,oBAAqB,EAAE,wBAAwB,KAA4B;AAAA,IAC3E,aAAa;AAAA,IACb,QAAS,EAAE,QAAQ,KAA4B;AAAA,IAC/C,QAAS,EAAE,QAAQ,KAA4B;AAAA,IAC/C,SAAU,EAAE,SAAS,KAA4B;AAAA,IACjD,UAAW,EAAE,UAAU,KAA4B;AAAA,IACnD,uBAAwB,EAAE,0BAA0B,KAA4B;AAAA,IAChF,gBAAiB,EAAE,iBAAiB,KAA4B;AAAA,IAChE,aAAc,EAAE,cAAc,KAA4B;AAAA,IAC1D,iBAAkB,EAAE,mBAAmB,KAA4B;AAAA,IACnE,cAAe,EAAE,eAAe,KAA4B;AAAA,IAC5D,uBAAwB,EAAE,yBAAyB,KAA4B;AAAA,IAC/E,mBAAoB,EAAE,qBAAqB,KAA4B;AAAA,IACvE,uBAAwB,EAAE,yBAAyB,KAA4B;AAAA,IAC/E,kBAAmB,EAAE,oBAAoB,KAA4B;AAAA,IACrE,yBAA0B,EAAE,4BAA4B,KAA4B;AAAA,IACpF,qBAAsB,EAAE,wBAAwB,KAA4B;AAAA,IAC5E,oBAAoB,wBAAwB,EAAE,qBAAqB,CAAC;AAAA,IACpE,mBAAoB,EAAE,qBAAqB,KAA4B;AAAA,IACvE,iBAAkB,EAAE,mBAAmB,KAA4B;AAAA,IACnE,WAAW,WAAW,EAAE,YAAY,CAAC;AAAA,IACrC,cAAe,EAAE,eAAe,KAA4B;AAAA,IAC5D,cAAe,EAAE,gBAAgB,KAA4B;AAAA,IAC7D,cAAe,EAAE,gBAAgB,KAA4B;AAAA,IAC7D,gBACE,OAAO,EAAE,iBAAiB,MAAM,YAAa,EAAE,iBAAiB,IAAgB;AAAA,IAClF,UAAU,OAAO,EAAE,WAAW,MAAM,YAAa,EAAE,WAAW,IAAgB;AAAA,IAC9E,SAAS,OAAO,EAAE,UAAU,MAAM,YAAa,EAAE,UAAU,IAAgB;AAAA,IAC3E,aAAa,OAAO,EAAE,cAAc,MAAM,WAAY,EAAE,cAAc,IAAe;AAAA,IACrF,kBAAmB,EAAE,oBAAoB,KAA4B;AAAA,IACrE,WAAW,WAAW,EAAE,mBAAc,CAAC;AAAA,IACvC,aAAa,WAAW,EAAE,qBAAgB,CAAC;AAAA,IAC3C,YAAY,WAAW,EAAE,oBAAe,CAAC;AAAA,IACzC,YAAa,EAAE,aAAa,KAA4B;AAAA,IACxD,mBAAmB,WAAW,EAAE,oBAAoB,CAAC;AAAA,IACrD,eAAe,mBAAmB,EAAE,gBAAgB,CAAC;AAAA,IACrD,iBAAiB,WAAW,EAAE,mBAAmB,CAAC;AAAA,IAClD,qBAAqB,WAAW,EAAE,uBAAuB,CAAC;AAAA,IAC1D,oBAAqB,EAAE,sBAAsB,KAA4B;AAAA,IACzE,iBAAkB,EAAE,mBAAmB,KAA4B;AAAA,IACnE,cAAe,EAAE,gBAAgB,KAA4B;AAAA,IAC7D,iBAAkB,EAAE,mBAAmB,KAA4B;AAAA,EACrE;AACF;AAEA,eAAsB,aAAa,MAA2C;AAC5E,QAAM,MAAoB,CAAC;AAC3B,QAAM,KAAK,cAAc,EACtB,OAAO,EAAE,UAAU,IAAI,CAAC,EACxB,SAAS,CAAC,SAAS,kBAAkB;AACpC,eAAW,OAAO,QAAS,KAAI,KAAK,OAAO,EAAE,IAAI,IAAI,IAAI,QAAQ,IAAI,OAAO,CAAC,CAAC;AAC9E,kBAAc;AAAA,EAChB,CAAC;AACH,SAAO;AACT;AAEA,eAAsB,iBACpB,MACA,MAC4B;AAI5B,MAAI,CAAC,6BAA6B,KAAK,IAAI,EAAG,QAAO;AAOrD,QAAM,UAAU,2EAA2E,KAAK;AAAA,IAC9F;AAAA,EACF,CAAC;AACD,QAAM,OAAqB,CAAC;AAC5B,QAAM,KAAK,cAAc,EACtB,OAAO,EAAE,iBAAiB,SAAS,YAAY,EAAE,CAAC,EAClD,SAAS,CAAC,SAAS,kBAAkB;AACpC,eAAW,OAAO,QAAS,MAAK,KAAK,OAAO,EAAE,IAAI,IAAI,IAAI,QAAQ,IAAI,OAAO,CAAC,CAAC;AAC/E,kBAAc;AAAA,EAChB,CAAC;AAGH,SAAO,KAAK,KAAK,CAAC,MAAM,SAAS,EAAE,IAAI,MAAM,IAAI,KAAK;AACxD;AAuCA,SAAS,YAAY,QAA4C;AAO/D,QAAM,SAAiD;AAAA,IACrD,QAAQ,OAAO;AAAA,IACf,QAAQ,OAAO;AAAA,IACf,SAAS,OAAO;AAAA,IAChB,UAAU,OAAO;AAAA,IACjB,6BAA4B,oBAAI,KAAK,GAAE,YAAY;AAAA,EACrD;AACA,SAAO;AACT;AAEA,SAAS,WAAW,QAA8B;AAChD,SAAO,EAAE,mBAAmB,OAAO,WAAW;AAChD;AAEA,SAAS,WAAW,QAA8B;AAChD,QAAM,SAAmB;AAAA,IACvB,gBAAgB,OAAO;AAAA,IACvB,qBAAqB,OAAO;AAAA,EAC9B;AAGA,MAAI,OAAO,aAAa,MAAM;AAC5B,WAAO,eAAe,IAAI,OAAO;AAAA,EACnC;AACA,SAAO;AACT;AAGO,IAAM,gBAA0C;AAAA,EACrD,UAAU;AAAA,EACV,MAAM;AAAA,EACN,UAAU;AAAA,EACV,KAAK;AACP;AAEA,IAAM,2BAA2B;AAK1B,SAAS,0BAA0B,KAAuC;AAC/E,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO;AAC5C,QAAM,IAAI;AACV,QAAM,SAAS,OAAO,EAAE,QAAQ,MAAM,WAAY,EAAE,QAAQ,IAAe;AAC3E,QAAM,WAAW,EAAE,UAAU;AAC7B,MAAI,WAAW,KAAM,QAAO;AAC5B,MACE,aAAa,SACb,aAAa,cACb,aAAa,UACb,aAAa;AAEb,WAAO;AACT,QAAM,OAAO,MAAM,QAAQ,EAAE,MAAM,CAAC,IAC/B,EAAE,MAAM,EAAgB,OAAO,CAAC,MAAmB,OAAO,MAAM,QAAQ,IACzE,CAAC;AACL,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,OAAO,OAAO,EAAE,OAAO,MAAM,WAAY,EAAE,OAAO,IAAe;AAAA,IACjE;AAAA,IACA,KAAK,OAAO,EAAE,KAAK,MAAM,WAAY,EAAE,KAAK,IAAe;AAAA,EAC7D;AACF;AAIO,SAAS,wBAAwB,KAAyC;AAC/E,MAAI,OAAO,QAAQ,YAAY,IAAI,KAAK,MAAM,GAAI,QAAO;AACzD,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,CAAC,MAAM,QAAQ,MAAM,EAAG,QAAO;AACnC,SAAO,OAAO,IAAI,yBAAyB,EAAE,OAAO,CAAC,MAA6B,MAAM,IAAI;AAC9F;AAEA,SAAS,uBAAuB,YAA0C;AACxE,QAAM,SAAS,CAAC,GAAG,UAAU,EAC1B,KAAK,CAAC,GAAG,MAAM,cAAc,EAAE,QAAQ,IAAI,cAAc,EAAE,QAAQ,CAAC,EACpE,MAAM,GAAG,wBAAwB;AAEpC,SAAO,EAAE,uBAAuB,KAAK,UAAU,MAAM,EAAE;AACzD;AAEA,SAAS,eAAe,QAAkC;AACxD,SAAO;AAAA,IACL,2BAA2B,OAAO;AAAA,IAClC,uBAAuB,OAAO;AAAA,IAC9B,2BAA2B,OAAO;AAAA,IAClC,sBAAsB,OAAO;AAAA;AAAA;AAAA,IAG7B,2BAA0B,oBAAI,KAAK,GAAE,YAAY;AAAA,EACnD;AACF;AAEA,SAAS,aAAa,QAAgC;AACpD,QAAM,SAAmB,EAAE,qBAAqB,OAAO,UAAU;AAMjE,EAAC,OAAyC,qBAAqB,IAAI,OAAO;AAC1E,SAAO;AACT;AAEA,SAAS,oBAAoB,QAAuC;AAMlE,QAAM,SAAwC;AAAA,IAC5C,iBAAiB,OAAO;AAAA,IACxB,kBAAkB,OAAO;AAAA,IACzB,kBAAkB,OAAO;AAAA,IACzB,qBAAqB,OAAO;AAAA,EAC9B;AACA,SAAO;AACT;AAEA,SAAS,cAAc,GAAiC;AACtD,SAAO;AAAA,IACL,mBAAmB,EAAE;AAAA,IACrB,aAAa,EAAE;AAAA,IACf,YAAY,EAAE;AAAA,IACd,gBAAgB,EAAE;AAAA,IAClB,sBAAsB,EAAE;AAAA,EAC1B;AACF;AAOA,eAAsB,aACpB,MACA,UACA,QACe;AACf,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,QAAQ,YAAY,MAAM,EAAE,CAAC,CAAC;AACnF;AASA,eAAsB,sBACpB,MACA,UACA,IACe;AACf,QAAM,SAAwC,EAAE,0BAA0B,GAAG;AAC7E,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,OAA2B,CAAC,CAAC;AAClF;AAGA,eAAsB,iBACpB,MACA,UACA,QACe;AACf,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,QAAQ,WAAW,MAAM,EAAE,CAAC,CAAC;AAClF;AAGA,eAAsB,iBACpB,MACA,UACA,QACe;AACf,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,QAAQ,WAAW,MAAM,EAAE,CAAC,CAAC;AAClF;AAGA,eAAsB,qBACpB,MACA,UACA,QACe;AACf,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,QAAQ,eAAe,MAAM,EAAE,CAAC,CAAC;AACtF;AAIA,eAAsB,sBACpB,MACA,UACA,UACe;AACf,QAAM,KAAK,cAAc,EAAE,OAAO;AAAA,IAChC,EAAE,IAAI,UAAU,QAAQ,EAAE,8BAA8B,SAAS,EAAE;AAAA,EACrE,CAAC;AACH;AAKA,eAAsB,gBACpB,MACA,UACA,QACA,OACe;AACf,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,QAAQ,EAAE,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;AACnF;AAWA,eAAsB,kBACpB,MACA,UACA,QAUmB;AACnB,QAAM,SAAmB,CAAC;AAC1B,MAAI,OAAO,OAAQ,QAAO,OAAO,QAAQ,YAAY,OAAO,MAAM,CAAC;AACnE,MAAI,OAAO,KAAM,QAAO,OAAO,QAAQ,WAAW,OAAO,IAAI,CAAC;AAC9D,MAAI,OAAO,KAAM,QAAO,OAAO,QAAQ,WAAW,OAAO,IAAI,CAAC;AAC9D,MAAI,OAAO,SAAU,QAAO,OAAO,QAAQ,eAAe,OAAO,QAAQ,CAAC;AAG1E,MAAI,OAAO;AACT,WAAO,OAAO,QAAQ,uBAAuB,OAAO,kBAAkB,CAAC;AACzE,MAAI,OAAO,OAAQ,QAAO,OAAO,QAAQ,aAAa,OAAO,MAAM,CAAC;AACpE,MAAI,OAAO,QAAS,QAAO,OAAO,QAAQ,cAAc,OAAO,OAAO,CAAC;AACvE,MAAI,OAAO,cAAe,QAAO,OAAO,QAAQ,oBAAoB,OAAO,aAAa,CAAC;AACzF,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,OAAO,CAAC,CAAC;AAC5D,SAAO;AACT;AAKA,eAAsB,oBACpB,MACA,UACA,SAMe;AACf,QAAM,SAAmB;AAAA,IACvB,wBAAwB,QAAQ;AAAA,IAChC,qBAAqB,QAAQ;AAAA,IAC7B,qBAAqB,QAAQ;AAAA,EAC/B;AACA,MAAI,QAAQ,iBAAiB,MAAM;AACjC,WAAO,gBAAgB,IAAI,QAAQ;AAAA,EACrC;AACA,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,OAAO,CAAC,CAAC;AAC9D;AAIA,eAAsB,eACpB,MACA,UACA,IACe;AACf,QAAM,SAAmB,EAAE,QAAQ,eAAe,eAAe,GAAG;AACpE,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,OAAO,CAAC,CAAC;AAC9D;","names":[]}

package/dist/chunk-BMDBOPN3.js

@@ -0,0 +1,211 @@
+import {
+  siteSlug
+} from "./chunk-BLD6AYJO.js";
+
+// src/alerts/digest-collectors.ts
+function dashboardUrl(baseUrl, siteName) {
+  return `${baseUrl.replace(/\/$/, "")}/s/${siteSlug(siteName)}`;
+}
+var GITHUB_SIGNALS_STALE_DAYS = 3;
+var MS_PER_DAY = 24 * 60 * 60 * 1e3;
+function gitHubSignalsStale(swept, now) {
+  if (swept === null) return true;
+  const ageMs = now.getTime() - Date.parse(swept);
+  if (!Number.isFinite(ageMs)) return true;
+  return ageMs > GITHUB_SIGNALS_STALE_DAYS * MS_PER_DAY;
+}
+var AUTO_FIX_EXHAUSTED_CYCLES = 3;
+function collectVulnAlerts(sites, baseUrl) {
+  const items = [];
+  for (const s of sites) {
+    const critical = s.securityVulnsCritical ?? 0;
+    const high = s.securityVulnsHigh ?? 0;
+    const metric = critical + high;
+    if (metric <= 0) continue;
+    const attempts = s.securityAutoFixAttempts ?? 0;
+    const exhausted = attempts >= AUTO_FIX_EXHAUSTED_CYCLES;
+    const noun = metric === 1 ? "vuln" : "vulns";
+    items.push({
+      key: `vuln:${s.id}`,
+      kind: "vuln",
+      siteName: s.name,
+      title: exhausted ? `${metric} critical/high ${noun} \u2014 auto-fix failed (${attempts}\xD7)` : `${metric} critical/high ${noun}`,
+      url: dashboardUrl(baseUrl, s.name),
+      severity: exhausted || critical > 0 ? "critical" : "warning",
+      metric,
+      ...exhausted ? { autoFixExhausted: true } : {}
+    });
+  }
+  return items;
+}
+var LIGHTHOUSE_FLOOR = 75;
+var LIGHTHOUSE_CATEGORIES = [
+  { field: "pScore", slug: "performance", label: "Performance" },
+  { field: "rScore", slug: "accessibility", label: "Accessibility" },
+  { field: "bpScore", slug: "best-practices", label: "Best Practices" },
+  { field: "seoScore", slug: "seo", label: "SEO" }
+];
+function collectLighthouseAlerts(sites, baseUrl) {
+  const items = [];
+  for (const s of sites) {
+    for (const cat of LIGHTHOUSE_CATEGORIES) {
+      const score = s[cat.field];
+      if (score === null || score >= LIGHTHOUSE_FLOOR) continue;
+      items.push({
+        key: `lighthouse:${s.id}:${cat.slug}`,
+        kind: "lighthouse",
+        siteName: s.name,
+        title: `Lighthouse ${cat.label} ${score} (below ${LIGHTHOUSE_FLOOR})`,
+        url: dashboardUrl(baseUrl, s.name),
+        severity: "warning",
+        metric: 100 - score
+      });
+    }
+  }
+  return items;
+}
+function collectDeliveryFailures(reports, sitesById, baseUrl) {
+  const items = [];
+  for (const r of reports) {
+    if (r.deliveryStatus !== "bounced" && r.deliveryStatus !== "complained") continue;
+    const site = sitesById.get(r.siteId);
+    if (!site) continue;
+    const complained = r.deliveryStatus === "complained";
+    items.push({
+      key: `delivery:${r.id}`,
+      kind: "delivery",
+      siteName: site.name,
+      title: complained ? "Spam complaint on a sent report" : "A sent report bounced",
+      url: dashboardUrl(baseUrl, site.name),
+      severity: complained ? "critical" : "warning",
+      metric: 1
+    });
+  }
+  return items;
+}
+function collectRenovateAlerts(sites, baseUrl, now = /* @__PURE__ */ new Date()) {
+  const items = [];
+  for (const s of sites) {
+    if (gitHubSignalsStale(s.githubSignalsAt, now)) continue;
+    const n = s.renovateFailingCis ?? 0;
+    if (n <= 0) continue;
+    items.push({
+      key: `renovate:${s.id}`,
+      kind: "renovate",
+      siteName: s.name,
+      title: `${n} Renovate ${n === 1 ? "PR" : "PRs"} failing CI`,
+      url: dashboardUrl(baseUrl, s.name),
+      severity: "warning",
+      metric: n
+    });
+  }
+  return items;
+}
+function collectCiAlerts(sites, baseUrl, now = /* @__PURE__ */ new Date()) {
+  const items = [];
+  for (const s of sites) {
+    if (gitHubSignalsStale(s.githubSignalsAt, now)) continue;
+    if (s.defaultBranchCi !== "failing") continue;
+    items.push({
+      key: `ci:${s.id}`,
+      kind: "ci",
+      siteName: s.name,
+      title: "Default-branch CI failing",
+      url: dashboardUrl(baseUrl, s.name),
+      severity: "warning",
+      metric: 1
+    });
+  }
+  return items;
+}
+var ANALYTICS_SOFT_FAIL_STALE_DAYS = 45;
+function collectAnalyticsFailures(sites, baseUrl, now = /* @__PURE__ */ new Date()) {
+  const items = [];
+  for (const s of sites) {
+    const at = s.analyticsSoftFailAt;
+    if (at === null) continue;
+    const ageMs = now.getTime() - Date.parse(at);
+    if (Number.isFinite(ageMs) && ageMs > ANALYTICS_SOFT_FAIL_STALE_DAYS * MS_PER_DAY) continue;
+    items.push({
+      key: `analytics:${s.id}`,
+      kind: "analytics",
+      siteName: s.name,
+      title: "GA/Search enrichment failing (analytics blank)",
+      url: dashboardUrl(baseUrl, s.name),
+      severity: "warning",
+      metric: 1
+    });
+  }
+  return items;
+}
+
+// src/alerts/digest-state.ts
+function diffAttention(items, prior, today) {
+  const tagged = [];
+  const next = {};
+  for (const it of items) {
+    const was = prior[it.key];
+    let status;
+    let firstFlaggedAt;
+    if (!was) {
+      status = "new";
+      firstFlaggedAt = today;
+    } else if (it.metric > was.metric) {
+      status = "worse";
+      firstFlaggedAt = was.firstFlaggedAt;
+    } else {
+      status = "standing";
+      firstFlaggedAt = was.firstFlaggedAt;
+    }
+    tagged.push({ ...it, status });
+    next[it.key] = { metric: it.metric, firstFlaggedAt };
+  }
+  return { tagged, next };
+}
+var DIGEST_STATE_TABLE = "Digest State";
+async function readDigestState(base) {
+  const rows = [];
+  await base(DIGEST_STATE_TABLE).select({ maxRecords: 1, pageSize: 1 }).eachPage((records, fetchNextPage) => {
+    for (const rec of records) rows.push({ id: rec.id, fields: rec.fields });
+    fetchNextPage();
+  });
+  const first = rows[0];
+  if (!first) return {};
+  const raw = first.fields["Snapshot"];
+  if (typeof raw !== "string") return {};
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return {};
+  }
+}
+async function writeDigestState(base, snap, updatedAt = (/* @__PURE__ */ new Date()).toISOString()) {
+  const rows = [];
+  await base(DIGEST_STATE_TABLE).select({ maxRecords: 1, pageSize: 1 }).eachPage((records, fetchNextPage) => {
+    for (const rec of records) rows.push({ id: rec.id });
+    fetchNextPage();
+  });
+  const fields = {
+    Snapshot: JSON.stringify(snap),
+    "Updated At": updatedAt
+  };
+  const existing = rows[0];
+  if (existing) {
+    await base(DIGEST_STATE_TABLE).update([{ id: existing.id, fields }]);
+  } else {
+    await base(DIGEST_STATE_TABLE).create([{ fields }]);
+  }
+}
+
+export {
+  collectVulnAlerts,
+  collectLighthouseAlerts,
+  collectDeliveryFailures,
+  collectRenovateAlerts,
+  collectCiAlerts,
+  collectAnalyticsFailures,
+  diffAttention,
+  readDigestState,
+  writeDigestState
+};
+//# sourceMappingURL=chunk-BMDBOPN3.js.map