@reddoorla/maintenance 0.69.0 → 0.71.0

package/dist/{chunk-C3PDS623.js → chunk-YWRQEDB3.js}

@@ -37,10 +37,20 @@ var ACTIVE_STATUSES = /* @__PURE__ */ new Set([
 function isDashboardVisible(site) {
   return site.status !== null && ACTIVE_STATUSES.has(site.status);
 }
+var PRE_LAUNCH_STATUSES = /* @__PURE__ */ new Set([
+  "in development",
+  "launch period"
+]);
+function isPreLaunch(status) {
+  return status !== null && PRE_LAUNCH_STATUSES.has(status);
+}
 var FREQUENCIES = ["None", "Monthly", "Quarterly", "Yearly"];
 function toFrequency(raw) {
   return typeof raw === "string" && FREQUENCIES.includes(raw) ? raw : "None";
 }
+function toVerdict(raw) {
+  return raw === "pass" || raw === "fail" ? raw : null;
+}
 function mapRow(rec) {
   const f = rec.fields;
   const attachments = f["Header image"] ?? [];
@@ -89,11 +99,17 @@ function mapRow(rec) {
     deployStatus: f["Deploy status"] ?? null,
     lastDeployAt: f["Last deploy at"] ?? null,
     deployLogUrl: f["Deploy log URL"] ?? null,
+    deployCheckedAt: f["Deploy checked at"] ?? null,
+    functionHealth: toVerdict(f["Function health"]),
+    cmsReachable: toVerdict(f["CMS Reachable"]),
+    functionHealthCheckedAt: f["Function health checked at"] ?? null,
     crossbrowserOk: typeof f["Crossbrowser OK"] === "boolean" ? f["Crossbrowser OK"] : null,
     mobileOk: typeof f["Mobile OK"] === "boolean" ? f["Mobile OK"] : null,
     linksOk: typeof f["Links OK"] === "boolean" ? f["Links OK"] : null,
     brokenLinks: typeof f["Broken links"] === "number" ? f["Broken links"] : null,
     browserCheckedAt: f["Browser checked at"] ?? null,
+    reachableOk: toVerdict(f["Uptime Reachable"]),
+    titleMetaOk: toVerdict(f["Titles & Meta OK"]),
     copyIntro: trimToNull(f["Copy \u2014 Intro"]),
     copyContact: trimToNull(f["Copy \u2014 Contact"]),
     copyFooter: trimToNull(f["Copy \u2014 Footer"]),
@@ -108,7 +124,11 @@ function mapRow(rec) {
     renovateFailingCis: f["Renovate Failing CIs"] ?? null,
     defaultBranchCi: f["Default Branch CI"] ?? null,
     lastCommitAt: f["Last Commit At"] ?? null,
-    githubSignalsAt: f["GitHub Signals At"] ?? null
+    githubSignalsAt: f["GitHub Signals At"] ?? null,
+    smokeOk: toVerdict(f["Smoke OK"]),
+    lastSmokeAt: f["Last Smoke At"] ?? null,
+    formE2eOk: toVerdict(f["Form E2E OK"]),
+    formE2eCheckedAt: f["Form E2E checked at"] ?? null
   };
 }
 async function listWebsites(base) {
@@ -229,8 +249,32 @@ function browserFields(r) {
     "Mobile OK": r.mobileOk,
     "Links OK": r.linksOk,
     "Broken links": r.brokenLinks,
-    "Browser checked at": r.checkedAt
+    "Browser checked at": r.checkedAt,
+    // NEW tri-state single-select verdicts (empty = never ran). The browser audit only produces a
+    // BrowserAuditFields when it actually ran (hasBrowserResult guards on checkedAt), so each verdict
+    // is always a concrete boolean here — serialize true→"pass", false→"fail". The existing boolean
+    // columns above are deliberately NOT retrofitted (out of scope).
+    "Uptime Reachable": r.reachableOk ? "pass" : "fail",
+    "Titles & Meta OK": r.titleMetaOk ? "pass" : "fail"
+  };
+}
+function functionHealthFields(r) {
+  const fields = {
+    "Function health": r.functionHealth,
+    "CMS Reachable": r.cmsReachable,
+    "Function health checked at": r.checkedAt
   };
+  return fields;
+}
+function smokeFields(r) {
+  return { "Smoke OK": r.ok, "Last Smoke At": r.checkedAt };
+}
+function formE2eFields(r) {
+  const fields = {
+    "Form E2E OK": r.ok,
+    "Form E2E checked at": r.checkedAt
+  };
+  return fields;
 }
 async function updateScores(base, recordId, scores) {
   await base(WEBSITES_TABLE).update([{ id: recordId, fields: scoreFields(scores) }]);
@@ -274,6 +318,9 @@ async function updateAuditFields(base, recordId, audits) {
   if (audits.domain) Object.assign(fields, domainFields(audits.domain));
   if (audits.browser) Object.assign(fields, browserFields(audits.browser));
   if (audits.netlifyDeploy) Object.assign(fields, netlifyDeployFields(audits.netlifyDeploy));
+  if (audits.functionHealth) Object.assign(fields, functionHealthFields(audits.functionHealth));
+  if (audits.smoke) Object.assign(fields, smokeFields(audits.smoke));
+  if (audits.formE2e) Object.assign(fields, formE2eFields(audits.formE2e));
   await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);
   return fields;
 }
@@ -299,6 +346,9 @@ export {
   parseNotifyRouting,
   ACTIVE_STATUSES,
   isDashboardVisible,
+  PRE_LAUNCH_STATUSES,
+  isPreLaunch,
+  toVerdict,
   mapRow,
   listWebsites,
   getWebsiteBySlug,
@@ -317,4 +367,4 @@ export {
   updateGitHubSignals,
   updateLaunched
 };
-//# sourceMappingURL=chunk-C3PDS623.js.map
+//# sourceMappingURL=chunk-YWRQEDB3.js.map

package/dist/chunk-YWRQEDB3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/reports/airtable/websites.ts"],"sourcesContent":["import type { FieldSet } from \"airtable\";\nimport type { AirtableBase } from \"./client.js\";\nimport type { LighthouseScores, LighthouseScoreWriteback } from \"../types.js\";\n\nexport const WEBSITES_TABLE = \"Websites\";\n\nexport type Frequency = \"None\" | \"Monthly\" | \"Quarterly\" | \"Yearly\";\n\nexport type Status =\n  | \"in development\"\n  | \"launch period\"\n  | \"maintenance\"\n  | \"hosting\"\n  | \"probably not our problem\"\n  | \"deprecated\";\n\n/**\n * Per-site notification routing. When present on a `maintenance` site, the form\n * notification is addressed by the value of a submission field (`field`, read from\n * `extraFields`) — e.g. route a contact form's `interest` to a different recipient\n * per option, always CC-ing a shared address. Absent (`null`) → the site keeps the\n * default single-POC behavior. Recipients live HERE (server-side Airtable config),\n * never supplied by the submitting site, so the ingest can't be turned into an open\n * relay.\n */\nexport type NotifyRouting = {\n  /** The `extraFields` key whose value selects a route, e.g. \"interest\". */\n  field: string;\n  /** Field-value → recipient address(es). */\n  routes: Record<string, string | string[]>;\n  /** Recipient(s) when the value matches no route. */\n  default?: string | string[];\n  /** Address(es) CC'd on every routed (maintenance) send. */\n  cc?: string[];\n};\n\nexport type WebsiteRow = {\n  id: string;\n  name: string;\n  url: string;\n  status: Status | null;\n  pointOfContact: string | null;\n  maintenanceFreq: Frequency;\n  testingFreq: Frequency;\n  /** The literal Airtable cell values behind the coerced frequencies. `toFrequency`\n   *  maps any unrecognized value (\"Quaterly\", \"Monthly \") to \"None\" so nothing bogus\n   *  reaches a client email — which also makes typos invisible downstream. Preflight\n   *  validates THESE to make that failure mode loud. Null = blank cell. */\n  maintenanceFreqRaw: string | null;\n  testingFreqRaw: string | null;\n  /** Last manually-recorded maintenance day (used as fallback when no Reports row exists). */\n  maintenanceDay: string | null;\n  testingDay: string | null;\n  ga4PropertyId: string | null;\n  /** Operator-supplied query for the Google search-presence check (e.g. the business name).\n   *  Null = no query set → the check is skipped for this site. */\n  searchQuery: string | null;\n  /** Explicit Search Console property for this site (`sc-domain:...` or `https://.../`).\n   *  Null = auto-resolve from the SA's visible properties by host. */\n  searchConsoleProperty: string | null;\n  /** ISO timestamp of the last draft run where THIS site's GA/Search enrichment\n   *  ERRORED (vs a legitimate \"not configured\" skip). Set by drafting on a soft-fail,\n   *  cleared (null) on a clean enrichment, so the per-site analytics-failure signal\n   *  self-heals. Null when the operator-added `Analytics soft-fail at` column is absent. */\n  analyticsSoftFailAt: string | null;\n  /** GitHub repo identity as `owner/repo`. Null = no git wiring → self-update ops skip\n   *  (or, for local runs, fall back to the checkout's origin remote). */\n  gitRepo: string | null;\n  reportRecipientsTo: string | null;\n  reportRecipientsCc: string | null;\n  acceptedWatchConditions: string[];\n  /** First attachment in the Header image field (Airtable's signed URL — fetch before expiry). */\n  headerImage: { url: string; filename: string; type: string } | null;\n  /** Lighthouse \"current state\" snapshot, kept fresh by `audit lighthouse --write-airtable`. */\n  pScore: number | null;\n  rScore: number | null;\n  bpScore: number | null;\n  seoScore: number | null;\n  /** ISO timestamp set by `audit lighthouse --write-airtable` when scores were last refreshed. */\n  lastLighthouseAuditAt: string | null;\n  /** Last-known counts from non-lighthouse audits, written by\n   *  `audit --write-airtable`. `null` = never audited (or this audit\n   *  type was skipped on the last run). 0 = audited, clean. */\n  a11yViolations: number | null;\n  /** Declared-range drift vs the Reddoor baseline (what package.json asks for). */\n  depsDrifted: number | null;\n  depsMajorBehind: number | null;\n  /** Real installed-version drift: deps behind the registry's latest, from the\n   *  committed lockfile (`pnpm outdated`). Null = not determined this run. */\n  depsOutdated: number | null;\n  /** Of {@link depsOutdated}, how many are a *major* version behind the\n   *  registry's latest — the \"majors available on npm\" signal, distinct from the\n   *  baseline-drift {@link depsMajorBehind}. Null = not determined this run. */\n  depsMajorOutdated: number | null;\n  securityVulnsCritical: number | null;\n  securityVulnsHigh: number | null;\n  securityVulnsModerate: number | null;\n  securityVulnsLow: number | null;\n  /** Count of consecutive nightly Renovate auto-fix dispatches for the CURRENT\n   *  critical/high vuln episode that have NOT yet cleared it. Owned by\n   *  `renovate-dispatch`: +1 per real dispatch, reset to 0 when vulns clear.\n   *  Null = field absent / never dispatched → reads as 0. At/above\n   *  AUTO_FIX_EXHAUSTED_CYCLES the vuln renders as \"auto-fix failed\". */\n  securityAutoFixAttempts: number | null;\n  /** ISO timestamp the security audit last ran — gates freshness of the Security Updates auto-tick\n   *  (clean counts only auto-tick when recent). */\n  lastSecurityAuditAt: string | null;\n  /** The known advisories behind the counts (severity-sorted, capped), so the dashboard can show\n   *  WHICH packages are vulnerable, not just the totals. null = never audited / unparseable;\n   *  empty array = audited clean. Written alongside the counts by the security audit. */\n  securityAdvisories: SecurityAdvisory[] | null;\n  /** Domain/DNS/SSL probe (the `domain` audit). `certDaysRemaining` is days until the TLS cert\n   *  expires (null = unresolved or no usable cert); `domainCheckedAt` is when it last ran. */\n  certDaysRemaining: number | null;\n  domainCheckedAt: string | null;\n  /** Netlify site id — the IDENTITY the `netlify-deploy` audit needs to query the\n   *  Netlify API. Read-only input (operator-set in Airtable); null = not on Netlify\n   *  (or not wired) → that audit skips. Never derived from the URL. */\n  netlifyId: string | null;\n  /** Latest PRODUCTION deploy health (the `netlify-deploy` audit). `deployStatus` is\n   *  Netlify's deploy state lower-cased (`ready`/`error`/`building`/…), null = none / not\n   *  checked; `lastDeployAt` is when it deployed; `deployLogUrl` links to the deploy/log. */\n  deployStatus: string | null;\n  lastDeployAt: string | null;\n  deployLogUrl: string | null;\n  /** When the `netlify-deploy` audit last RAN (freshness stamp for `deployStatus`). The audit\n   *  already writes \"Deploy checked at\"; this read-back is the Plan-2 fix so `deployEvidence`\n   *  (Plan 4) can gate on check time — NOT on `lastDeployAt`, which is deploy time, not check time. */\n  deployCheckedAt: string | null;\n  /** Function-health verdict (the `function-health` audit): the deployed `/health` function\n   *  answered `ok:true` (pass) or `ok:false` (fail). Single-select `pass`/`fail`; null = never ran\n   *  / unreachable (→ Plan 4 maps to unknown/amber). Kept SEPARATE from `deployStatus` so\n   *  `isFailedDeployStatus` keeps meaning \"the build failed\". */\n  functionHealth: \"pass\" | \"fail\" | null;\n  /** CMS reachability (server-side), derived from the same `/health` body's `details.prismic ===\n   *  \"ok\"`. Single-select `pass`/`fail`; null = never ran. No per-site Prismic token or identity\n   *  column is ever built — this rides `/health`. */\n  cmsReachable: \"pass\" | \"fail\" | null;\n  /** When the `function-health` audit last ran — the freshness gate for BOTH `functionHealth` and\n   *  `cmsReachable`. Null = never ran. */\n  functionHealthCheckedAt: string | null;\n  /** Deployed-URL browser probe (the `browser` audit): cross-engine render OK, mobile render OK,\n   *  internal-links OK + broken count, and when it last ran (one timestamp gates all three). */\n  crossbrowserOk: boolean | null;\n  mobileOk: boolean | null;\n  linksOk: boolean | null;\n  brokenLinks: number | null;\n  browserCheckedAt: string | null;\n  /** Uptime-reachable verdict (browser audit): every sampled route returned 2xx/3xx. Single-select\n   *  `pass`/`fail`; null = never ran. Point-in-time. Freshness-gated by `browserCheckedAt`. */\n  reachableOk: \"pass\" | \"fail\" | null;\n  /** Titles & meta verdict (browser audit, chromium): every sampled route has a non-empty `<title>`\n   *  ≤ 70 chars + a non-empty meta description, and no duplicate titles across the sample.\n   *  Single-select `pass`/`fail`; null = never ran. Freshness-gated by `browserCheckedAt`. */\n  titleMetaOk: \"pass\" | \"fail\" | null;\n  /** Per-site copy overrides (M6a). Blank → null → the DEFAULT_COPY value. */\n  copyIntro: string | null;\n  copyContact: string | null;\n  copyFooter: string | null;\n  /** Go-live timestamp, stamped when a Launch report sends (M6b). Null = not yet launched. */\n  launchedAt: string | null;\n  /** Optional per-site webhook (e.g. Zapier Catch Hook). When set, the ingest\n   *  POSTs newsletter-formType submissions here (best-effort). Blank → null. */\n  newsletterWebhook: string | null;\n  /** Per-site Mailchimp (newsletter). Both must be set for the direct add;\n   *  blank → skipped. The API key is `key-dc` format; dc is derived from it. */\n  mailchimpApiKey: string | null;\n  mailchimpAudienceId: string | null;\n  /** Per-site Cloudflare Turnstile gate. When true, a submission whose Turnstile\n   *  token verifies as \"fail\" is escalated to auto-spam regardless of content score\n   *  (an absent/unverifiable token stays neutral — fail-open). Airtable checkbox. */\n  requireTurnstile: boolean;\n  /** GitHub-signals sweep (slice 2a), written nightly by `github-signals --fleet`. */\n  renovateFailingCis: number | null;\n  defaultBranchCi: string | null; // \"passing\" | \"failing\" | \"pending\" | \"none\"\n  lastCommitAt: string | null;\n  githubSignalsAt: string | null;\n  /** Per-site smoke-suite verdict (the `smoke` audit runs `pnpm test:smoke`).\n   *  Single-select pass/fail; null = never ran. `lastSmokeAt` gates freshness. */\n  smokeOk: \"pass\" | \"fail\" | null;\n  lastSmokeAt: string | null;\n  /** Synthetic form end-to-end verdict (the `form-e2e` audit submits the real prod\n   *  contact form in test-mode). Single-select pass/fail; null = never ran OR (with\n   *  a fresh `formE2eCheckedAt`) no contact form → n/a. `formE2eCheckedAt` gates\n   *  freshness AND encodes the n/a-vs-never-ran distinction. */\n  formE2eOk: \"pass\" | \"fail\" | null;\n  formE2eCheckedAt: string | null;\n  notifyRouting: NotifyRouting | null;\n};\n\nexport function siteSlug(name: string): string {\n  return name\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, \"-\")\n    .replace(/^-|-$/g, \"\");\n}\n\n/** Blank-trim-to-null: a non-string or whitespace-only value becomes null,\n *  otherwise the trimmed string. */\nfunction trimToNull(raw: unknown): string | null {\n  if (typeof raw !== \"string\") return null;\n  const trimmed = raw.trim();\n  return trimmed.length > 0 ? trimmed : null;\n}\n\n/**\n * Parse the Websites `Notify Routing` JSON into a NotifyRouting, defensively: a\n * non-string, blank, malformed-JSON, or wrong-shape value yields null (the site\n * then keeps default single-POC routing) — never throws. Mirrors the pipeline's\n * \"a bad Airtable string degrades quietly\" rule.\n */\nexport function parseNotifyRouting(raw: unknown): NotifyRouting | null {\n  if (typeof raw !== \"string\") return null;\n  const trimmed = raw.trim();\n  if (!trimmed) return null;\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(trimmed);\n  } catch {\n    return null;\n  }\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) return null;\n  const o = parsed as Record<string, unknown>;\n  if (typeof o.field !== \"string\" || !o.field.trim()) return null;\n  if (!o.routes || typeof o.routes !== \"object\" || Array.isArray(o.routes)) return null;\n  const routing: NotifyRouting = {\n    field: o.field,\n    routes: o.routes as Record<string, string | string[]>,\n  };\n  if (o.default !== undefined) routing.default = o.default as string | string[];\n  if (Array.isArray(o.cc)) routing.cc = o.cc.filter((x): x is string => typeof x === \"string\");\n  return routing;\n}\n\n/**\n * Active sites: actively-maintained or pre-launch. Single source of truth for\n * \"is this a live site\" — the operator cockpit shows these, and the fleet\n * audit/report path runs against these. A `null` status (not-yet-active) is\n * deliberately excluded.\n */\nexport const ACTIVE_STATUSES: ReadonlySet<Status> = new Set<Status>([\n  \"maintenance\",\n  \"launch period\",\n]);\n\nexport function isDashboardVisible(site: WebsiteRow): boolean {\n  return site.status !== null && ACTIVE_STATUSES.has(site.status);\n}\n\n/**\n * Pre-launch lifecycle stages: the site is being built/prepared, NOT yet live. A\n * Launch report (recipes/launch.ts) flips Status → \"maintenance\" at go-live\n * (updateLaunched), so \"maintenance\" is the true live state. Pre-launch sites must\n * not be audited as production (their deploy/domain/uptime/CMS audits fail because\n * nothing is live yet) nor scheduled recurring Maintenance/Testing reports.\n */\nexport const PRE_LAUNCH_STATUSES: ReadonlySet<Status> = new Set<Status>([\n  \"in development\",\n  \"launch period\",\n]);\n\nexport function isPreLaunch(status: Status | null): boolean {\n  return status !== null && PRE_LAUNCH_STATUSES.has(status);\n}\n\nconst FREQUENCIES: readonly Frequency[] = [\"None\", \"Monthly\", \"Quarterly\", \"Yearly\"];\n\n/** Coerce an Airtable single-select value to a known Frequency. An unrecognized value — a\n *  renamed / typo'd / whitespace option — falls back to \"None\" (its section is simply omitted)\n *  rather than flowing a bogus string downstream, which the announcement would otherwise render\n *  as \"We do this undefined.\" into a client email. */\nfunction toFrequency(raw: unknown): Frequency {\n  return typeof raw === \"string\" && (FREQUENCIES as readonly string[]).includes(raw)\n    ? (raw as Frequency)\n    : \"None\";\n}\n\n/** Coerce an Airtable tri-state single-select verdict cell (`pass`/`fail`/blank) to\n *  `\"pass\" | \"fail\" | null`. Any value other than the literal strings \"pass\"/\"fail\" — blank,\n *  an unrecognized option, a typo, wrong type — reads as null (\"never ran\"), never guessed. The\n *  ONE shared reader for every verdict column of this shape: `Function health`, `CMS Reachable`,\n *  `Uptime Reachable`, `Titles & Meta OK` (Plan 2), and reused (not redeclared) by Plan 3's\n *  `Smoke OK` / `Form E2E OK` read-backs. */\nexport function toVerdict(raw: unknown): \"pass\" | \"fail\" | null {\n  return raw === \"pass\" || raw === \"fail\" ? raw : null;\n}\n\n// NOTE: every `f[\"...\"]` key below is a load-bearing magic string that must match\n// the live Airtable \"Websites\" column name EXACTLY — including the legacy\n// misspelling `\"maintenence freq\"`, the mixed-case `\"GA4 property ID\"`, and the\n// lowercase `\"url\"` / `\"point of contact\"`. A column rename in Airtable silently\n// returns undefined here (→ null), which degrades quietly (GA skipped, recipients\n// empty) with no error. If you rename a column, change it here too.\nexport function mapRow(rec: { id: string; fields: Record<string, unknown> }): WebsiteRow {\n  const f = rec.fields;\n  const attachments =\n    (f[\"Header image\"] as Array<{ url: string; filename: string; type: string }> | undefined) ?? [];\n  const header = attachments[0] ?? null;\n  return {\n    id: rec.id,\n    name: String(f[\"Name\"] ?? \"\"),\n    url: String(f[\"url\"] ?? \"\"),\n    status: (f[\"Status\"] as Status | undefined) ?? null,\n    pointOfContact: (f[\"point of contact\"] as string | undefined) ?? null,\n    maintenanceFreq: toFrequency(f[\"maintenence freq\"]),\n    testingFreq: toFrequency(f[\"testing freq\"]),\n    maintenanceFreqRaw: (f[\"maintenence freq\"] as string | undefined) ?? null,\n    testingFreqRaw: (f[\"testing freq\"] as string | undefined) ?? null,\n    maintenanceDay: (f[\"maintenance day\"] as string | undefined) ?? null,\n    testingDay: (f[\"testing day\"] as string | undefined) ?? null,\n    ga4PropertyId: (f[\"GA4 property ID\"] as string | undefined) ?? null,\n    searchQuery: (f[\"Search query\"] as string | undefined) ?? null,\n    searchConsoleProperty: (f[\"Search Console property\"] as string | undefined) ?? null,\n    analyticsSoftFailAt: (f[\"Analytics soft-fail at\"] as string | undefined) ?? null,\n    gitRepo: (f[\"Git repo\"] as string | undefined) ?? null,\n    reportRecipientsTo: (f[\"Report recipients (To)\"] as string | undefined) ?? null,\n    reportRecipientsCc: (f[\"Report recipients (CC)\"] as string | undefined) ?? null,\n    acceptedWatchConditions: Array.isArray(f[\"Accepted Watch Conditions\"])\n      ? (f[\"Accepted Watch Conditions\"] as string[])\n      : [],\n    headerImage: header,\n    pScore: (f[\"pScore\"] as number | undefined) ?? null,\n    rScore: (f[\"rScore\"] as number | undefined) ?? null,\n    bpScore: (f[\"bpScore\"] as number | undefined) ?? null,\n    seoScore: (f[\"seoScore\"] as number | undefined) ?? null,\n    lastLighthouseAuditAt: (f[\"Last lighthouse audit at\"] as string | undefined) ?? null,\n    a11yViolations: (f[\"A11y Violations\"] as number | undefined) ?? null,\n    depsDrifted: (f[\"Deps Drifted\"] as number | undefined) ?? null,\n    depsMajorBehind: (f[\"Deps Major Behind\"] as number | undefined) ?? null,\n    depsOutdated: (f[\"Deps Outdated\"] as number | undefined) ?? null,\n    depsMajorOutdated: (f[\"Deps Major Outdated\"] as number | undefined) ?? null,\n    securityVulnsCritical: (f[\"Security Vulns Critical\"] as number | undefined) ?? null,\n    securityVulnsHigh: (f[\"Security Vulns High\"] as number | undefined) ?? null,\n    securityVulnsModerate: (f[\"Security Vulns Moderate\"] as number | undefined) ?? null,\n    securityVulnsLow: (f[\"Security Vulns Low\"] as number | undefined) ?? null,\n    securityAutoFixAttempts: (f[\"Security Auto-Fix Attempts\"] as number | undefined) ?? null,\n    lastSecurityAuditAt: (f[\"Last security audit at\"] as string | undefined) ?? null,\n    securityAdvisories: parseSecurityAdvisories(f[\"Security advisories\"]),\n    certDaysRemaining: (f[\"Cert days remaining\"] as number | undefined) ?? null,\n    domainCheckedAt: (f[\"Domain checked at\"] as string | undefined) ?? null,\n    netlifyId: trimToNull(f[\"Netlify ID\"]),\n    deployStatus: (f[\"Deploy status\"] as string | undefined) ?? null,\n    lastDeployAt: (f[\"Last deploy at\"] as string | undefined) ?? null,\n    deployLogUrl: (f[\"Deploy log URL\"] as string | undefined) ?? null,\n    deployCheckedAt: (f[\"Deploy checked at\"] as string | undefined) ?? null,\n    functionHealth: toVerdict(f[\"Function health\"]),\n    cmsReachable: toVerdict(f[\"CMS Reachable\"]),\n    functionHealthCheckedAt: (f[\"Function health checked at\"] as string | undefined) ?? null,\n    crossbrowserOk:\n      typeof f[\"Crossbrowser OK\"] === \"boolean\" ? (f[\"Crossbrowser OK\"] as boolean) : null,\n    mobileOk: typeof f[\"Mobile OK\"] === \"boolean\" ? (f[\"Mobile OK\"] as boolean) : null,\n    linksOk: typeof f[\"Links OK\"] === \"boolean\" ? (f[\"Links OK\"] as boolean) : null,\n    brokenLinks: typeof f[\"Broken links\"] === \"number\" ? (f[\"Broken links\"] as number) : null,\n    browserCheckedAt: (f[\"Browser checked at\"] as string | undefined) ?? null,\n    reachableOk: toVerdict(f[\"Uptime Reachable\"]),\n    titleMetaOk: toVerdict(f[\"Titles & Meta OK\"]),\n    copyIntro: trimToNull(f[\"Copy — Intro\"]),\n    copyContact: trimToNull(f[\"Copy — Contact\"]),\n    copyFooter: trimToNull(f[\"Copy — Footer\"]),\n    launchedAt: (f[\"Launched at\"] as string | undefined) ?? null,\n    newsletterWebhook: trimToNull(f[\"Newsletter Webhook\"]),\n    notifyRouting: parseNotifyRouting(f[\"Notify Routing\"]),\n    mailchimpApiKey: trimToNull(f[\"Mailchimp API Key\"]),\n    mailchimpAudienceId: trimToNull(f[\"Mailchimp Audience ID\"]),\n    // Boolean guard like crossbrowserOk, but defaults FALSE (not null) when absent: an\n    // unset/unknown column must read as \"not required\" so the feature ships dark.\n    requireTurnstile:\n      typeof f[\"Require Turnstile\"] === \"boolean\" ? (f[\"Require Turnstile\"] as boolean) : false,\n    renovateFailingCis: (f[\"Renovate Failing CIs\"] as number | undefined) ?? null,\n    defaultBranchCi: (f[\"Default Branch CI\"] as string | undefined) ?? null,\n    lastCommitAt: (f[\"Last Commit At\"] as string | undefined) ?? null,\n    githubSignalsAt: (f[\"GitHub Signals At\"] as string | undefined) ?? null,\n    smokeOk: toVerdict(f[\"Smoke OK\"]),\n    lastSmokeAt: (f[\"Last Smoke At\"] as string | undefined) ?? null,\n    formE2eOk: toVerdict(f[\"Form E2E OK\"]),\n    formE2eCheckedAt: (f[\"Form E2E checked at\"] as string | undefined) ?? null,\n  };\n}\n\nexport async function listWebsites(base: AirtableBase): Promise<WebsiteRow[]> {\n  const out: WebsiteRow[] = [];\n  await base(WEBSITES_TABLE)\n    .select({ pageSize: 100 })\n    .eachPage((records, fetchNextPage) => {\n      for (const rec of records) out.push(mapRow({ id: rec.id, fields: rec.fields }));\n      fetchNextPage();\n    });\n  return out;\n}\n\nexport async function getWebsiteBySlug(\n  base: AirtableBase,\n  slug: string,\n): Promise<WebsiteRow | null> {\n  // Slugs are siteSlug() output: [a-z0-9] segments joined by single hyphens.\n  // Reject anything else — it can't match a real row, and it keeps URL-supplied\n  // input out of the filter formula below (formula-injection guard).\n  if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(slug)) return null;\n\n  // Narrow the fetch to the slug-matching row server-side instead of paging the\n  // whole table per request (MEDIUM-H). The formula replicates siteSlug() on\n  // {Name} — lowercase → non-alnum runs to \"-\" → strip leading/trailing \"-\" —\n  // verified against the live base. maxRecords caps it (slug collisions keep the\n  // prior first-match-wins behavior).\n  const formula = `REGEX_REPLACE(REGEX_REPLACE(LOWER({Name}),\"[^a-z0-9]+\",\"-\"),\"^-|-$\",\"\")=${JSON.stringify(\n    slug,\n  )}`;\n  const rows: WebsiteRow[] = [];\n  await base(WEBSITES_TABLE)\n    .select({ filterByFormula: formula, maxRecords: 1 })\n    .eachPage((records, fetchNextPage) => {\n      for (const rec of records) rows.push(mapRow({ id: rec.id, fields: rec.fields }));\n      fetchNextPage();\n    });\n  // Confirm the match in JS too: keeps the function correct if the formula and\n  // siteSlug() ever drift, and under test fakes that don't evaluate the formula.\n  return rows.find((w) => siteSlug(w.name) === slug) ?? null;\n}\n\n// ── audit-field builders ─────────────────────────────────────────────────────\n// One source of truth for the column-name → value mappings of each audit type.\n// The per-audit `updateXxxCounts` writers delegate to these (for their other\n// callers), and `updateAuditFields` merges whichever are present into ONE write —\n// so the field-name magic strings live in exactly one place.\n\nexport type A11yCounts = { violations: number };\nexport type DepsCounts = {\n  drifted: number;\n  majorBehind: number;\n  outdated: number | null;\n  majorOutdated: number | null;\n};\nexport type SecurityCounts = { critical: number; high: number; moderate: number; low: number };\nexport type Severity = \"low\" | \"moderate\" | \"high\" | \"critical\";\n/** One known vulnerability behind the security counts, as persisted/rendered. */\nexport type SecurityAdvisory = {\n  module: string;\n  severity: Severity;\n  title: string;\n  cves: string[];\n  url: string | null;\n  /** GitHub Dependabot dependency scope (\"runtime\" | \"development\"), when known. Lets the\n   *  dashboard flag build-time-only (\"development\") vulns. Omitted for advisories from the\n   *  lockfile `pnpm audit` fallback, which carries no per-package graph scope. */\n  scope?: \"runtime\" | \"development\";\n};\nexport type DomainResult = { certDaysRemaining: number | null; checkedAt: string };\nexport type NetlifyDeployResult = {\n  /** Netlify deploy state lower-cased (`ready`/`error`/`building`/…), null = none. */\n  state: string | null;\n  /** When the latest production deploy was published/created (ISO), null = unknown. */\n  deployedAt: string | null;\n  /** Link to the deploy / its build log, null = unknown. */\n  logUrl: string | null;\n  /** When the audit last ran. */\n  checkedAt: string;\n};\nexport type BrowserAuditFields = {\n  desktopOk: boolean;\n  mobileOk: boolean;\n  linksOk: boolean;\n  reachableOk: boolean;\n  titleMetaOk: boolean;\n  brokenLinks: number;\n  checkedAt: string;\n};\nexport type FunctionHealthResult = {\n  /** `pass` when `/health` answered `ok:true`, else `fail`. Never null — the audit only produces a\n   *  result when it ran (a self-skip carries no details, so this extractor isn't reached). */\n  functionHealth: \"pass\" | \"fail\";\n  /** From the same body's `prismic` sub-status (R2.2): `\"ok\"` → `\"pass\"`, `\"error\"` → `\"fail\"`.\n   *  Anything else (`\"skipped\"` — a placeholder repo with no live Prismic — or a raw `null`, e.g.\n   *  the synthetic \"deployed but erroring\" body) → `null`: the CMS probe never actually ran, so it\n   *  must NOT red CMS reachability for a site that simply hasn't wired Prismic yet. */\n  cmsReachable: \"pass\" | \"fail\" | null;\n  /** When the audit ran (freshness stamp for both verdicts). */\n  checkedAt: string;\n};\n\nexport type SmokeResult = { ok: \"pass\" | \"fail\"; checkedAt: string };\n\n/** `ok` null clears the single-select cell (n/a — no contact form); a fresh\n *  `checkedAt` still stamps the row so Plan 4 reads null+fresh as n/a. */\nexport type FormE2eResult = { ok: \"pass\" | \"fail\" | null; checkedAt: string };\n\nfunction scoreFields(scores: LighthouseScoreWriteback): FieldSet {\n  // A null score CLEARS the cell (→ dashboard \"—\"), distinguishing a metric that\n  // errored this run (e.g. NO_LCP → null performance) from a real low score. This\n  // intentionally overwrites a prior value: a run that couldn't measure the metric\n  // shouldn't keep showing a stale number. Writing null to clear mirrors\n  // updateAnalyticsHealth; the `as FieldSet` cast is needed because airtable's\n  // FieldSet type omits null.\n  const fields: Record<string, number | string | null> = {\n    pScore: scores.performance,\n    rScore: scores.accessibility,\n    bpScore: scores.bestPractices,\n    seoScore: scores.seo,\n    \"Last lighthouse audit at\": new Date().toISOString(),\n  };\n  return fields as FieldSet;\n}\n\nfunction a11yFields(counts: A11yCounts): FieldSet {\n  return { \"A11y Violations\": counts.violations };\n}\n\nfunction depsFields(counts: DepsCounts): FieldSet {\n  const fields: FieldSet = {\n    \"Deps Drifted\": counts.drifted,\n    \"Deps Major Behind\": counts.majorBehind,\n  };\n  // Only write the outdated count when it was determined — a null (no/stale\n  // lockfile this run) must not clobber a previously-good value.\n  if (counts.outdated !== null) {\n    fields[\"Deps Outdated\"] = counts.outdated;\n  }\n  // Same null-guard for the registry-major breakdown (same source signal).\n  if (counts.majorOutdated !== null) {\n    fields[\"Deps Major Outdated\"] = counts.majorOutdated;\n  }\n  return fields;\n}\n\n/** Critical first → low last; the persist cap and the dashboard list both lean on this. */\nexport const SEVERITY_RANK: Record<Severity, number> = {\n  critical: 0,\n  high: 1,\n  moderate: 2,\n  low: 3,\n};\n/** Cap persisted advisories so the JSON field can't blow up on a badly-neglected site. */\nconst MAX_PERSISTED_ADVISORIES = 25;\n\n/** Coerce one untrusted value into a SecurityAdvisory, or null if it isn't shaped like one.\n *  Shared by the read path (`parseSecurityAdvisories`) and the write path so both validate\n *  identically. A missing module or unrecognized severity drops the entry entirely. */\nexport function normalizeSecurityAdvisory(raw: unknown): SecurityAdvisory | null {\n  if (!raw || typeof raw !== \"object\") return null;\n  const e = raw as Record<string, unknown>;\n  const module = typeof e[\"module\"] === \"string\" ? (e[\"module\"] as string) : null;\n  const severity = e[\"severity\"];\n  if (module === null) return null;\n  if (\n    severity !== \"low\" &&\n    severity !== \"moderate\" &&\n    severity !== \"high\" &&\n    severity !== \"critical\"\n  )\n    return null;\n  const cves = Array.isArray(e[\"cves\"])\n    ? (e[\"cves\"] as unknown[]).filter((c): c is string => typeof c === \"string\")\n    : [];\n  const scope =\n    e[\"scope\"] === \"runtime\" || e[\"scope\"] === \"development\"\n      ? (e[\"scope\"] as \"runtime\" | \"development\")\n      : undefined;\n  return {\n    module,\n    severity,\n    title: typeof e[\"title\"] === \"string\" ? (e[\"title\"] as string) : \"\",\n    cves,\n    url: typeof e[\"url\"] === \"string\" ? (e[\"url\"] as string) : null,\n    ...(scope ? { scope } : {}),\n  };\n}\n\n/** Parse the `Security advisories` JSON cell. null when absent/blank/unparseable/not-an-array\n *  (treated as \"never audited\"); a valid array (possibly empty = audited clean) otherwise. */\nexport function parseSecurityAdvisories(raw: unknown): SecurityAdvisory[] | null {\n  if (typeof raw !== \"string\" || raw.trim() === \"\") return null;\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch {\n    return null;\n  }\n  if (!Array.isArray(parsed)) return null;\n  return parsed.map(normalizeSecurityAdvisory).filter((a): a is SecurityAdvisory => a !== null);\n}\n\nfunction securityAdvisoryFields(advisories: SecurityAdvisory[]): FieldSet {\n  const capped = [...advisories]\n    .sort((a, b) => SEVERITY_RANK[a.severity] - SEVERITY_RANK[b.severity])\n    .slice(0, MAX_PERSISTED_ADVISORIES);\n  // Always write — an empty array (\"[]\") clears a stale list when a once-vulnerable site goes clean.\n  return { \"Security advisories\": JSON.stringify(capped) };\n}\n\nfunction securityFields(counts: SecurityCounts): FieldSet {\n  return {\n    \"Security Vulns Critical\": counts.critical,\n    \"Security Vulns High\": counts.high,\n    \"Security Vulns Moderate\": counts.moderate,\n    \"Security Vulns Low\": counts.low,\n    // Stamp freshness alongside the counts so the Security Updates auto-tick can require a recent\n    // audit (a clean count from months ago must not silently keep ticking the box).\n    \"Last security audit at\": new Date().toISOString(),\n  };\n}\n\nfunction domainFields(result: DomainResult): FieldSet {\n  const fields: FieldSet = { \"Domain checked at\": result.checkedAt };\n  // Write the cert days UNCONDITIONALLY: a null (unresolved / no usable cert) must CLEAR any\n  // previously-good value. Leaving a stale number in place — next to a freshly-stamped \"Domain\n  // checked at\" — false-passes the Domain/DNS/SSL auto-tick (domainEvidence reads the stale\n  // non-null value as a current pass) for a site that's actually down. null clears the cell in\n  // Airtable; FieldSet's type doesn't model null, hence the cast through a widened record.\n  (fields as Record<string, number | null>)[\"Cert days remaining\"] = result.certDaysRemaining;\n  return fields;\n}\n\nfunction netlifyDeployFields(result: NetlifyDeployResult): FieldSet {\n  // Write all three deploy fields UNCONDITIONALLY (null clears the cell): a null state /\n  // deployedAt / logUrl this run means \"couldn't read it\" and must not leave a STALE value\n  // sitting next to a fresh \"Deploy checked at\" — the dashboard would otherwise render a green\n  // \"ready\" badge for a site whose latest deploy actually errored. FieldSet's type doesn't model\n  // null, hence the cast through a widened record (same approach as domainFields).\n  const fields: Record<string, string | null> = {\n    \"Deploy status\": result.state,\n    \"Last deploy at\": result.deployedAt,\n    \"Deploy log URL\": result.logUrl,\n    \"Deploy checked at\": result.checkedAt,\n  };\n  return fields as FieldSet;\n}\n\nfunction browserFields(r: BrowserAuditFields): FieldSet {\n  return {\n    \"Crossbrowser OK\": r.desktopOk,\n    \"Mobile OK\": r.mobileOk,\n    \"Links OK\": r.linksOk,\n    \"Broken links\": r.brokenLinks,\n    \"Browser checked at\": r.checkedAt,\n    // NEW tri-state single-select verdicts (empty = never ran). The browser audit only produces a\n    // BrowserAuditFields when it actually ran (hasBrowserResult guards on checkedAt), so each verdict\n    // is always a concrete boolean here — serialize true→\"pass\", false→\"fail\". The existing boolean\n    // columns above are deliberately NOT retrofitted (out of scope).\n    \"Uptime Reachable\": r.reachableOk ? \"pass\" : \"fail\",\n    \"Titles & Meta OK\": r.titleMetaOk ? \"pass\" : \"fail\",\n  };\n}\n\nfunction functionHealthFields(r: FunctionHealthResult): FieldSet {\n  // \"CMS Reachable\" is written UNCONDITIONALLY (null clears the cell): the audit only supplies a\n  // result when it ran, but `cmsReachable` itself can legitimately be null this run (R2.2 — the CMS\n  // probe never actually happened, e.g. a placeholder repo with no live Prismic). Clearing rather\n  // than leaving a stale pass/fail sitting next to a freshly-stamped checked-at is what keeps a\n  // placeholder site from showing a stale CMS verdict. FieldSet's type doesn't model null, hence the\n  // cast through a widened record (same approach as domainFields/netlifyDeployFields).\n  // \"Function health\" is never null — the audit only writes when it ran, so it's always a concrete\n  // pass/fail. Written SEPARATELY from \"Deploy status\" so the Netlify build state keeps its own\n  // meaning.\n  const fields: Record<string, string | null> = {\n    \"Function health\": r.functionHealth,\n    \"CMS Reachable\": r.cmsReachable,\n    \"Function health checked at\": r.checkedAt,\n  };\n  return fields as FieldSet;\n}\n\nfunction smokeFields(r: SmokeResult): FieldSet {\n  // The verdict is stored as the literal single-select option (\"pass\"/\"fail\"), so\n  // no boolean→string coercion is needed. A skip never reaches here (it produces no\n  // SmokeResult), so this column is only ever written with a concrete verdict.\n  return { \"Smoke OK\": r.ok, \"Last Smoke At\": r.checkedAt };\n}\n\nfunction formE2eFields(r: FormE2eResult): FieldSet {\n  // `ok` is already the single-select value (\"pass\"/\"fail\") or null. Writing null\n  // CLEARS the cell (→ n/a, distinguished from \"never ran\" by the fresh checked-at\n  // stamped alongside). FieldSet's type omits null, hence the widened-record cast\n  // (same approach as domainFields / netlifyDeployFields).\n  const fields: Record<string, string | null> = {\n    \"Form E2E OK\": r.ok,\n    \"Form E2E checked at\": r.checkedAt,\n  };\n  return fields as FieldSet;\n}\n\n/**\n * Write the four Lighthouse scores + a refreshed-at timestamp onto a Websites row.\n * Called by `audit lighthouse --write-airtable` after a successful audit run, so\n * the operator never has to paste numbers manually before drafting a report.\n */\nexport async function updateScores(\n  base: AirtableBase,\n  recordId: string,\n  scores: LighthouseScores,\n): Promise<void> {\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields: scoreFields(scores) }]);\n}\n\n/**\n * Record (or clear) the per-site GA/Search enrichment health on the `Analytics\n * soft-fail at` column. `at` is an ISO timestamp when the site's last draft had a\n * GA/Search soft-failure, or `null` to clear it after a clean enrichment. The\n * caller (drafting) swallows errors: this column is operator-added, so until it\n * exists Airtable throws UNKNOWN_FIELD_NAME — which must not break a draft.\n */\nexport async function updateAnalyticsHealth(\n  base: AirtableBase,\n  recordId: string,\n  at: string | null,\n): Promise<void> {\n  const fields: Record<string, string | null> = { \"Analytics soft-fail at\": at };\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields: fields as FieldSet }]);\n}\n\n/** Persist a11y violation count. */\nexport async function updateA11yCounts(\n  base: AirtableBase,\n  recordId: string,\n  counts: A11yCounts,\n): Promise<void> {\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields: a11yFields(counts) }]);\n}\n\n/** Persist deps drift counts (declared-range drift + real outdated installs). */\nexport async function updateDepsCounts(\n  base: AirtableBase,\n  recordId: string,\n  counts: DepsCounts,\n): Promise<void> {\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields: depsFields(counts) }]);\n}\n\n/** Persist security vulnerability counts by severity. */\nexport async function updateSecurityCounts(\n  base: AirtableBase,\n  recordId: string,\n  counts: SecurityCounts,\n): Promise<void> {\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields: securityFields(counts) }]);\n}\n\n/** Persist a site's auto-fix attempt counter. Its own one-field writer so the\n *  nightly Renovate dispatch can update it without touching the audit's counts. */\nexport async function updateAutoFixAttempts(\n  base: AirtableBase,\n  recordId: string,\n  attempts: number,\n): Promise<void> {\n  await base(WEBSITES_TABLE).update([\n    { id: recordId, fields: { \"Security Auto-Fix Attempts\": attempts } },\n  ]);\n}\n\n/**\n * Persist the code-computed next-due dates (date-only `YYYY-MM-DD`, or `null` to\n * clear) for the maintenance + testing schedules. Owned by the nightly `--due` sweep\n * so the \"next\" dates shown in Airtable come from the SAME logic as the scheduler\n * (`nextDueDate`) — no Airtable-side formula or automation. Best-effort at the call\n * site: the `Next … at` columns are operator-added, so until they exist Airtable\n * throws UNKNOWN_FIELD_NAME, which must not break the nightly draft run.\n */\nexport async function updateNextDueDates(\n  base: AirtableBase,\n  recordId: string,\n  dates: { maintenanceAt: string | null; testingAt: string | null },\n): Promise<void> {\n  const fields: Record<string, string | null> = {\n    \"Next maintenance at\": dates.maintenanceAt,\n    \"Next testing at\": dates.testingAt,\n  };\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields: fields as FieldSet }]);\n}\n\n/** Generic single-field writer for the dashboard site-details editor. The caller\n *  (setSiteDetail) restricts `column` to the EDITABLE_SITE_FIELDS allowlist, so this\n *  never writes an arbitrary column from request input. */\nexport async function updateSiteField(\n  base: AirtableBase,\n  recordId: string,\n  column: string,\n  value: string,\n): Promise<void> {\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields: { [column]: value } }]);\n}\n\n/**\n * Persist all of a single audit run's results to one Websites row in ONE atomic\n * `update()` — instead of up to four sequential updates on the same id (which left\n * a row half-written on a mid-sequence failure and quadrupled the request volume).\n * Pass only the audit slices that produced real values; each present slice is merged\n * via the SAME field mappings the per-audit writers use. Omit a slice (or pass\n * undefined) to leave those columns untouched. Returns the merged FieldSet so the\n * caller can enumerate what was written.\n */\nexport async function updateAuditFields(\n  base: AirtableBase,\n  recordId: string,\n  audits: {\n    scores?: LighthouseScoreWriteback;\n    a11y?: A11yCounts;\n    deps?: DepsCounts;\n    security?: SecurityCounts;\n    securityAdvisories?: SecurityAdvisory[];\n    domain?: DomainResult;\n    browser?: BrowserAuditFields;\n    netlifyDeploy?: NetlifyDeployResult;\n    functionHealth?: FunctionHealthResult;\n    smoke?: SmokeResult;\n    formE2e?: FormE2eResult;\n  },\n): Promise<FieldSet> {\n  const fields: FieldSet = {};\n  if (audits.scores) Object.assign(fields, scoreFields(audits.scores));\n  if (audits.a11y) Object.assign(fields, a11yFields(audits.a11y));\n  if (audits.deps) Object.assign(fields, depsFields(audits.deps));\n  if (audits.security) Object.assign(fields, securityFields(audits.security));\n  // Separate slice (not folded into `security`) so the advisory list and the counts can be\n  // written independently, but in practice the security audit supplies both together.\n  if (audits.securityAdvisories)\n    Object.assign(fields, securityAdvisoryFields(audits.securityAdvisories));\n  if (audits.domain) Object.assign(fields, domainFields(audits.domain));\n  if (audits.browser) Object.assign(fields, browserFields(audits.browser));\n  if (audits.netlifyDeploy) Object.assign(fields, netlifyDeployFields(audits.netlifyDeploy));\n  if (audits.functionHealth) Object.assign(fields, functionHealthFields(audits.functionHealth));\n  if (audits.smoke) Object.assign(fields, smokeFields(audits.smoke));\n  if (audits.formE2e) Object.assign(fields, formE2eFields(audits.formE2e));\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);\n  return fields;\n}\n\n/** Persist the GitHub-signals sweep onto a Websites row (slice 2a). A null\n *  `lastCommitAt` is OMITTED so a not-determined-this-run value never clobbers a\n *  previously-good timestamp (mirrors updateDepsCounts' outdated handling). */\nexport async function updateGitHubSignals(\n  base: AirtableBase,\n  recordId: string,\n  signals: {\n    renovateFailingCis: number;\n    ciState: string;\n    lastCommitAt: string | null;\n    sweptAt: string;\n  },\n): Promise<void> {\n  const fields: FieldSet = {\n    \"Renovate Failing CIs\": signals.renovateFailingCis,\n    \"Default Branch CI\": signals.ciState,\n    \"GitHub Signals At\": signals.sweptAt,\n  };\n  if (signals.lastCommitAt !== null) {\n    fields[\"Last Commit At\"] = signals.lastCommitAt;\n  }\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);\n}\n\n/** Mark a site launched: flip Status → maintenance + stamp Launched at (M6b).\n *  The first code that writes Status. Called after a Launch report sends. */\nexport async function updateLaunched(\n  base: AirtableBase,\n  recordId: string,\n  at: string,\n): Promise<void> {\n  const fields: FieldSet = { Status: \"maintenance\", \"Launched at\": at };\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);\n}\n"],"mappings":";AAIO,IAAM,iBAAiB;AA0LvB,SAAS,SAAS,MAAsB;AAC7C,SAAO,KACJ,YAAY,EACZ,QAAQ,eAAe,GAAG,EAC1B,QAAQ,UAAU,EAAE;AACzB;AAIA,SAAS,WAAW,KAA6B;AAC/C,MAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,QAAM,UAAU,IAAI,KAAK;AACzB,SAAO,QAAQ,SAAS,IAAI,UAAU;AACxC;AAQO,SAAS,mBAAmB,KAAoC;AACrE,MAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,QAAM,UAAU,IAAI,KAAK;AACzB,MAAI,CAAC,QAAS,QAAO;AACrB,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,OAAO;AAAA,EAC7B,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,EAAG,QAAO;AAC3E,QAAM,IAAI;AACV,MAAI,OAAO,EAAE,UAAU,YAAY,CAAC,EAAE,MAAM,KAAK,EAAG,QAAO;AAC3D,MAAI,CAAC,EAAE,UAAU,OAAO,EAAE,WAAW,YAAY,MAAM,QAAQ,EAAE,MAAM,EAAG,QAAO;AACjF,QAAM,UAAyB;AAAA,IAC7B,OAAO,EAAE;AAAA,IACT,QAAQ,EAAE;AAAA,EACZ;AACA,MAAI,EAAE,YAAY,OAAW,SAAQ,UAAU,EAAE;AACjD,MAAI,MAAM,QAAQ,EAAE,EAAE,EAAG,SAAQ,KAAK,EAAE,GAAG,OAAO,CAAC,MAAmB,OAAO,MAAM,QAAQ;AAC3F,SAAO;AACT;AAQO,IAAM,kBAAuC,oBAAI,IAAY;AAAA,EAClE;AAAA,EACA;AACF,CAAC;AAEM,SAAS,mBAAmB,MAA2B;AAC5D,SAAO,KAAK,WAAW,QAAQ,gBAAgB,IAAI,KAAK,MAAM;AAChE;AASO,IAAM,sBAA2C,oBAAI,IAAY;AAAA,EACtE;AAAA,EACA;AACF,CAAC;AAEM,SAAS,YAAY,QAAgC;AAC1D,SAAO,WAAW,QAAQ,oBAAoB,IAAI,MAAM;AAC1D;AAEA,IAAM,cAAoC,CAAC,QAAQ,WAAW,aAAa,QAAQ;AAMnF,SAAS,YAAY,KAAyB;AAC5C,SAAO,OAAO,QAAQ,YAAa,YAAkC,SAAS,GAAG,IAC5E,MACD;AACN;AAQO,SAAS,UAAU,KAAsC;AAC9D,SAAO,QAAQ,UAAU,QAAQ,SAAS,MAAM;AAClD;AAQO,SAAS,OAAO,KAAkE;AACvF,QAAM,IAAI,IAAI;AACd,QAAM,cACH,EAAE,cAAc,KAA4E,CAAC;AAChG,QAAM,SAAS,YAAY,CAAC,KAAK;AACjC,SAAO;AAAA,IACL,IAAI,IAAI;AAAA,IACR,MAAM,OAAO,EAAE,MAAM,KAAK,EAAE;AAAA,IAC5B,KAAK,OAAO,EAAE,KAAK,KAAK,EAAE;AAAA,IAC1B,QAAS,EAAE,QAAQ,KAA4B;AAAA,IAC/C,gBAAiB,EAAE,kBAAkB,KAA4B;AAAA,IACjE,iBAAiB,YAAY,EAAE,kBAAkB,CAAC;AAAA,IAClD,aAAa,YAAY,EAAE,cAAc,CAAC;AAAA,IAC1C,oBAAqB,EAAE,kBAAkB,KAA4B;AAAA,IACrE,gBAAiB,EAAE,cAAc,KAA4B;AAAA,IAC7D,gBAAiB,EAAE,iBAAiB,KAA4B;AAAA,IAChE,YAAa,EAAE,aAAa,KAA4B;AAAA,IACxD,eAAgB,EAAE,iBAAiB,KAA4B;AAAA,IAC/D,aAAc,EAAE,cAAc,KAA4B;AAAA,IAC1D,uBAAwB,EAAE,yBAAyB,KAA4B;AAAA,IAC/E,qBAAsB,EAAE,wBAAwB,KAA4B;AAAA,IAC5E,SAAU,EAAE,UAAU,KAA4B;AAAA,IAClD,oBAAqB,EAAE,wBAAwB,KAA4B;AAAA,IAC3E,oBAAqB,EAAE,wBAAwB,KAA4B;AAAA,IAC3E,yBAAyB,MAAM,QAAQ,EAAE,2BAA2B,CAAC,IAChE,EAAE,2BAA2B,IAC9B,CAAC;AAAA,IACL,aAAa;AAAA,IACb,QAAS,EAAE,QAAQ,KAA4B;AAAA,IAC/C,QAAS,EAAE,QAAQ,KAA4B;AAAA,IAC/C,SAAU,EAAE,SAAS,KAA4B;AAAA,IACjD,UAAW,EAAE,UAAU,KAA4B;AAAA,IACnD,uBAAwB,EAAE,0BAA0B,KAA4B;AAAA,IAChF,gBAAiB,EAAE,iBAAiB,KAA4B;AAAA,IAChE,aAAc,EAAE,cAAc,KAA4B;AAAA,IAC1D,iBAAkB,EAAE,mBAAmB,KAA4B;AAAA,IACnE,cAAe,EAAE,eAAe,KAA4B;AAAA,IAC5D,mBAAoB,EAAE,qBAAqB,KAA4B;AAAA,IACvE,uBAAwB,EAAE,yBAAyB,KAA4B;AAAA,IAC/E,mBAAoB,EAAE,qBAAqB,KAA4B;AAAA,IACvE,uBAAwB,EAAE,yBAAyB,KAA4B;AAAA,IAC/E,kBAAmB,EAAE,oBAAoB,KAA4B;AAAA,IACrE,yBAA0B,EAAE,4BAA4B,KAA4B;AAAA,IACpF,qBAAsB,EAAE,wBAAwB,KAA4B;AAAA,IAC5E,oBAAoB,wBAAwB,EAAE,qBAAqB,CAAC;AAAA,IACpE,mBAAoB,EAAE,qBAAqB,KAA4B;AAAA,IACvE,iBAAkB,EAAE,mBAAmB,KAA4B;AAAA,IACnE,WAAW,WAAW,EAAE,YAAY,CAAC;AAAA,IACrC,cAAe,EAAE,eAAe,KAA4B;AAAA,IAC5D,cAAe,EAAE,gBAAgB,KAA4B;AAAA,IAC7D,cAAe,EAAE,gBAAgB,KAA4B;AAAA,IAC7D,iBAAkB,EAAE,mBAAmB,KAA4B;AAAA,IACnE,gBAAgB,UAAU,EAAE,iBAAiB,CAAC;AAAA,IAC9C,cAAc,UAAU,EAAE,eAAe,CAAC;AAAA,IAC1C,yBAA0B,EAAE,4BAA4B,KAA4B;AAAA,IACpF,gBACE,OAAO,EAAE,iBAAiB,MAAM,YAAa,EAAE,iBAAiB,IAAgB;AAAA,IAClF,UAAU,OAAO,EAAE,WAAW,MAAM,YAAa,EAAE,WAAW,IAAgB;AAAA,IAC9E,SAAS,OAAO,EAAE,UAAU,MAAM,YAAa,EAAE,UAAU,IAAgB;AAAA,IAC3E,aAAa,OAAO,EAAE,cAAc,MAAM,WAAY,EAAE,cAAc,IAAe;AAAA,IACrF,kBAAmB,EAAE,oBAAoB,KAA4B;AAAA,IACrE,aAAa,UAAU,EAAE,kBAAkB,CAAC;AAAA,IAC5C,aAAa,UAAU,EAAE,kBAAkB,CAAC;AAAA,IAC5C,WAAW,WAAW,EAAE,mBAAc,CAAC;AAAA,IACvC,aAAa,WAAW,EAAE,qBAAgB,CAAC;AAAA,IAC3C,YAAY,WAAW,EAAE,oBAAe,CAAC;AAAA,IACzC,YAAa,EAAE,aAAa,KAA4B;AAAA,IACxD,mBAAmB,WAAW,EAAE,oBAAoB,CAAC;AAAA,IACrD,eAAe,mBAAmB,EAAE,gBAAgB,CAAC;AAAA,IACrD,iBAAiB,WAAW,EAAE,mBAAmB,CAAC;AAAA,IAClD,qBAAqB,WAAW,EAAE,uBAAuB,CAAC;AAAA;AAAA;AAAA,IAG1D,kBACE,OAAO,EAAE,mBAAmB,MAAM,YAAa,EAAE,mBAAmB,IAAgB;AAAA,IACtF,oBAAqB,EAAE,sBAAsB,KAA4B;AAAA,IACzE,iBAAkB,EAAE,mBAAmB,KAA4B;AAAA,IACnE,cAAe,EAAE,gBAAgB,KAA4B;AAAA,IAC7D,iBAAkB,EAAE,mBAAmB,KAA4B;AAAA,IACnE,SAAS,UAAU,EAAE,UAAU,CAAC;AAAA,IAChC,aAAc,EAAE,eAAe,KAA4B;AAAA,IAC3D,WAAW,UAAU,EAAE,aAAa,CAAC;AAAA,IACrC,kBAAmB,EAAE,qBAAqB,KAA4B;AAAA,EACxE;AACF;AAEA,eAAsB,aAAa,MAA2C;AAC5E,QAAM,MAAoB,CAAC;AAC3B,QAAM,KAAK,cAAc,EACtB,OAAO,EAAE,UAAU,IAAI,CAAC,EACxB,SAAS,CAAC,SAAS,kBAAkB;AACpC,eAAW,OAAO,QAAS,KAAI,KAAK,OAAO,EAAE,IAAI,IAAI,IAAI,QAAQ,IAAI,OAAO,CAAC,CAAC;AAC9E,kBAAc;AAAA,EAChB,CAAC;AACH,SAAO;AACT;AAEA,eAAsB,iBACpB,MACA,MAC4B;AAI5B,MAAI,CAAC,6BAA6B,KAAK,IAAI,EAAG,QAAO;AAOrD,QAAM,UAAU,2EAA2E,KAAK;AAAA,IAC9F;AAAA,EACF,CAAC;AACD,QAAM,OAAqB,CAAC;AAC5B,QAAM,KAAK,cAAc,EACtB,OAAO,EAAE,iBAAiB,SAAS,YAAY,EAAE,CAAC,EAClD,SAAS,CAAC,SAAS,kBAAkB;AACpC,eAAW,OAAO,QAAS,MAAK,KAAK,OAAO,EAAE,IAAI,IAAI,IAAI,QAAQ,IAAI,OAAO,CAAC,CAAC;AAC/E,kBAAc;AAAA,EAChB,CAAC;AAGH,SAAO,KAAK,KAAK,CAAC,MAAM,SAAS,EAAE,IAAI,MAAM,IAAI,KAAK;AACxD;AAoEA,SAAS,YAAY,QAA4C;AAO/D,QAAM,SAAiD;AAAA,IACrD,QAAQ,OAAO;AAAA,IACf,QAAQ,OAAO;AAAA,IACf,SAAS,OAAO;AAAA,IAChB,UAAU,OAAO;AAAA,IACjB,6BAA4B,oBAAI,KAAK,GAAE,YAAY;AAAA,EACrD;AACA,SAAO;AACT;AAEA,SAAS,WAAW,QAA8B;AAChD,SAAO,EAAE,mBAAmB,OAAO,WAAW;AAChD;AAEA,SAAS,WAAW,QAA8B;AAChD,QAAM,SAAmB;AAAA,IACvB,gBAAgB,OAAO;AAAA,IACvB,qBAAqB,OAAO;AAAA,EAC9B;AAGA,MAAI,OAAO,aAAa,MAAM;AAC5B,WAAO,eAAe,IAAI,OAAO;AAAA,EACnC;AAEA,MAAI,OAAO,kBAAkB,MAAM;AACjC,WAAO,qBAAqB,IAAI,OAAO;AAAA,EACzC;AACA,SAAO;AACT;AAGO,IAAM,gBAA0C;AAAA,EACrD,UAAU;AAAA,EACV,MAAM;AAAA,EACN,UAAU;AAAA,EACV,KAAK;AACP;AAEA,IAAM,2BAA2B;AAK1B,SAAS,0BAA0B,KAAuC;AAC/E,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO;AAC5C,QAAM,IAAI;AACV,QAAM,SAAS,OAAO,EAAE,QAAQ,MAAM,WAAY,EAAE,QAAQ,IAAe;AAC3E,QAAM,WAAW,EAAE,UAAU;AAC7B,MAAI,WAAW,KAAM,QAAO;AAC5B,MACE,aAAa,SACb,aAAa,cACb,aAAa,UACb,aAAa;AAEb,WAAO;AACT,QAAM,OAAO,MAAM,QAAQ,EAAE,MAAM,CAAC,IAC/B,EAAE,MAAM,EAAgB,OAAO,CAAC,MAAmB,OAAO,MAAM,QAAQ,IACzE,CAAC;AACL,QAAM,QACJ,EAAE,OAAO,MAAM,aAAa,EAAE,OAAO,MAAM,gBACtC,EAAE,OAAO,IACV;AACN,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,OAAO,OAAO,EAAE,OAAO,MAAM,WAAY,EAAE,OAAO,IAAe;AAAA,IACjE;AAAA,IACA,KAAK,OAAO,EAAE,KAAK,MAAM,WAAY,EAAE,KAAK,IAAe;AAAA,IAC3D,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;AAAA,EAC3B;AACF;AAIO,SAAS,wBAAwB,KAAyC;AAC/E,MAAI,OAAO,QAAQ,YAAY,IAAI,KAAK,MAAM,GAAI,QAAO;AACzD,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,CAAC,MAAM,QAAQ,MAAM,EAAG,QAAO;AACnC,SAAO,OAAO,IAAI,yBAAyB,EAAE,OAAO,CAAC,MAA6B,MAAM,IAAI;AAC9F;AAEA,SAAS,uBAAuB,YAA0C;AACxE,QAAM,SAAS,CAAC,GAAG,UAAU,EAC1B,KAAK,CAAC,GAAG,MAAM,cAAc,EAAE,QAAQ,IAAI,cAAc,EAAE,QAAQ,CAAC,EACpE,MAAM,GAAG,wBAAwB;AAEpC,SAAO,EAAE,uBAAuB,KAAK,UAAU,MAAM,EAAE;AACzD;AAEA,SAAS,eAAe,QAAkC;AACxD,SAAO;AAAA,IACL,2BAA2B,OAAO;AAAA,IAClC,uBAAuB,OAAO;AAAA,IAC9B,2BAA2B,OAAO;AAAA,IAClC,sBAAsB,OAAO;AAAA;AAAA;AAAA,IAG7B,2BAA0B,oBAAI,KAAK,GAAE,YAAY;AAAA,EACnD;AACF;AAEA,SAAS,aAAa,QAAgC;AACpD,QAAM,SAAmB,EAAE,qBAAqB,OAAO,UAAU;AAMjE,EAAC,OAAyC,qBAAqB,IAAI,OAAO;AAC1E,SAAO;AACT;AAEA,SAAS,oBAAoB,QAAuC;AAMlE,QAAM,SAAwC;AAAA,IAC5C,iBAAiB,OAAO;AAAA,IACxB,kBAAkB,OAAO;AAAA,IACzB,kBAAkB,OAAO;AAAA,IACzB,qBAAqB,OAAO;AAAA,EAC9B;AACA,SAAO;AACT;AAEA,SAAS,cAAc,GAAiC;AACtD,SAAO;AAAA,IACL,mBAAmB,EAAE;AAAA,IACrB,aAAa,EAAE;AAAA,IACf,YAAY,EAAE;AAAA,IACd,gBAAgB,EAAE;AAAA,IAClB,sBAAsB,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA,IAKxB,oBAAoB,EAAE,cAAc,SAAS;AAAA,IAC7C,oBAAoB,EAAE,cAAc,SAAS;AAAA,EAC/C;AACF;AAEA,SAAS,qBAAqB,GAAmC;AAU/D,QAAM,SAAwC;AAAA,IAC5C,mBAAmB,EAAE;AAAA,IACrB,iBAAiB,EAAE;AAAA,IACnB,8BAA8B,EAAE;AAAA,EAClC;AACA,SAAO;AACT;AAEA,SAAS,YAAY,GAA0B;AAI7C,SAAO,EAAE,YAAY,EAAE,IAAI,iBAAiB,EAAE,UAAU;AAC1D;AAEA,SAAS,cAAc,GAA4B;AAKjD,QAAM,SAAwC;AAAA,IAC5C,eAAe,EAAE;AAAA,IACjB,uBAAuB,EAAE;AAAA,EAC3B;AACA,SAAO;AACT;AAOA,eAAsB,aACpB,MACA,UACA,QACe;AACf,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,QAAQ,YAAY,MAAM,EAAE,CAAC,CAAC;AACnF;AASA,eAAsB,sBACpB,MACA,UACA,IACe;AACf,QAAM,SAAwC,EAAE,0BAA0B,GAAG;AAC7E,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,OAA2B,CAAC,CAAC;AAClF;AAGA,eAAsB,iBACpB,MACA,UACA,QACe;AACf,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,QAAQ,WAAW,MAAM,EAAE,CAAC,CAAC;AAClF;AAGA,eAAsB,iBACpB,MACA,UACA,QACe;AACf,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,QAAQ,WAAW,MAAM,EAAE,CAAC,CAAC;AAClF;AAGA,eAAsB,qBACpB,MACA,UACA,QACe;AACf,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,QAAQ,eAAe,MAAM,EAAE,CAAC,CAAC;AACtF;AAIA,eAAsB,sBACpB,MACA,UACA,UACe;AACf,QAAM,KAAK,cAAc,EAAE,OAAO;AAAA,IAChC,EAAE,IAAI,UAAU,QAAQ,EAAE,8BAA8B,SAAS,EAAE;AAAA,EACrE,CAAC;AACH;AAUA,eAAsB,mBACpB,MACA,UACA,OACe;AACf,QAAM,SAAwC;AAAA,IAC5C,uBAAuB,MAAM;AAAA,IAC7B,mBAAmB,MAAM;AAAA,EAC3B;AACA,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,OAA2B,CAAC,CAAC;AAClF;AAKA,eAAsB,gBACpB,MACA,UACA,QACA,OACe;AACf,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,QAAQ,EAAE,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;AACnF;AAWA,eAAsB,kBACpB,MACA,UACA,QAamB;AACnB,QAAM,SAAmB,CAAC;AAC1B,MAAI,OAAO,OAAQ,QAAO,OAAO,QAAQ,YAAY,OAAO,MAAM,CAAC;AACnE,MAAI,OAAO,KAAM,QAAO,OAAO,QAAQ,WAAW,OAAO,IAAI,CAAC;AAC9D,MAAI,OAAO,KAAM,QAAO,OAAO,QAAQ,WAAW,OAAO,IAAI,CAAC;AAC9D,MAAI,OAAO,SAAU,QAAO,OAAO,QAAQ,eAAe,OAAO,QAAQ,CAAC;AAG1E,MAAI,OAAO;AACT,WAAO,OAAO,QAAQ,uBAAuB,OAAO,kBAAkB,CAAC;AACzE,MAAI,OAAO,OAAQ,QAAO,OAAO,QAAQ,aAAa,OAAO,MAAM,CAAC;AACpE,MAAI,OAAO,QAAS,QAAO,OAAO,QAAQ,cAAc,OAAO,OAAO,CAAC;AACvE,MAAI,OAAO,cAAe,QAAO,OAAO,QAAQ,oBAAoB,OAAO,aAAa,CAAC;AACzF,MAAI,OAAO,eAAgB,QAAO,OAAO,QAAQ,qBAAqB,OAAO,cAAc,CAAC;AAC5F,MAAI,OAAO,MAAO,QAAO,OAAO,QAAQ,YAAY,OAAO,KAAK,CAAC;AACjE,MAAI,OAAO,QAAS,QAAO,OAAO,QAAQ,cAAc,OAAO,OAAO,CAAC;AACvE,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,OAAO,CAAC,CAAC;AAC5D,SAAO;AACT;AAKA,eAAsB,oBACpB,MACA,UACA,SAMe;AACf,QAAM,SAAmB;AAAA,IACvB,wBAAwB,QAAQ;AAAA,IAChC,qBAAqB,QAAQ;AAAA,IAC7B,qBAAqB,QAAQ;AAAA,EAC/B;AACA,MAAI,QAAQ,iBAAiB,MAAM;AACjC,WAAO,gBAAgB,IAAI,QAAQ;AAAA,EACrC;AACA,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,OAAO,CAAC,CAAC;AAC9D;AAIA,eAAsB,eACpB,MACA,UACA,IACe;AACf,QAAM,SAAmB,EAAE,QAAQ,eAAe,eAAe,GAAG;AACpE,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,OAAO,CAAC,CAAC;AAC9D;","names":[]}

package/dist/cli/bin.js

@@ -44,7 +44,10 @@ var AUDIT_DESCRIPTIONS = {
   lint: "ESLint + Prettier using the canonical configs.",
   domain: "DNS resolve + TLS cert expiry against the deployed URL (checkout-free).",
   browser: "Playwright across desktop engines + mobile devices + link-check against the deployed URL (checkout-free).",
-  "netlify-deploy": "Latest production deploy health via the Netlify API by site id (checkout-free; needs NETLIFY_PAT)."
+  "netlify-deploy": "Latest production deploy health via the Netlify API by site id (checkout-free; needs NETLIFY_PAT).",
+  "function-health": "GET {deployedUrl}/health and read its ok/prismic/forms status (checkout-free).",
+  smoke: "Run the site's own `pnpm test:smoke` suite in its checkout (clone-based).",
+  "form-e2e": "Submit the real production contact form in test-mode against the deployed URL (checkout-free)."
 };
 var RECIPE_DESCRIPTIONS = {
   "sync-configs": "Overwrite a site's canonical configs to match @reddoorla/maintenance.",
@@ -54,8 +57,10 @@ var RECIPE_DESCRIPTIONS = {
   "convert-to-pnpm": "Convert an npm/yarn site to pnpm (lockfile, packageManager, scripts).",
   onboard: "Install @reddoorla/maintenance + audit deps on a site (preferred first step).",
   "a11y-fixtures-page": "Write src/routes/dev/a11y-fixtures/+page.svelte (stub for lhci + axe targets).",
+  "health-endpoint": "Write src/routes/health/+server.ts (function-health probe for the report gate).",
+  "smoke-suite": "Add the smoke suite (test:smoke + playwright config + /health smoke routes).",
   "self-updating": "Bootstrap CI + Renovate + auto-merge per repo (writes workflows, opens PR, sets RENOVATE_TOKEN).",
-  init: "Run the full onboarding chain (convert-to-pnpm \u2192 onboard \u2192 sync-configs \u2192 svelte-codemods \u2192 a11y-fixtures-page \u2192 audit)."
+  init: "Run the full onboarding chain (convert-to-pnpm \u2192 onboard \u2192 sync-configs \u2192 svelte-codemods \u2192 a11y-fixtures-page \u2192 health-endpoint \u2192 smoke-suite \u2192 audit)."
 };
 async function runOrExit(fn, opts) {
   try {
@@ -105,7 +110,7 @@ cli.command("sync-configs [site]", "Sync canonical configs into a site.").option
   'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../sync-configs-TIBO6DUJ.js")).runSyncConfigsCommand(site, opts),
+    async () => (await import("../sync-configs-CQNOTJ2B.js")).runSyncConfigsCommand(site, opts),
     opts
   )
 );
@@ -114,7 +119,7 @@ cli.command("bump-deps [site]", "Bump dependencies.").option("--group <group>",
   'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../bump-deps-QNM3H4GI.js")).runBumpDepsCommand(site, opts),
+    async () => (await import("../bump-deps-K3JMLMBB.js")).runBumpDepsCommand(site, opts),
     opts
   )
 );
@@ -123,7 +128,7 @@ cli.command(
   "Bootstrap a repo to keep itself updated (CI + Renovate + auto-merge)."
 ).option("--dry", "List what would be enabled without writing or opening PRs").option("--fleet <inventory>", 'Inventory file (.json or .mjs/.js), or "airtable"').option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../self-updating-JTTFOJ7Q.js")).runSelfUpdatingCommand(site, opts),
+    async () => (await import("../self-updating-GSH427XP.js")).runSelfUpdatingCommand(site, opts),
     opts
   )
 );
@@ -132,7 +137,7 @@ cli.command("upgrade <upgrade> [site]", "Run a named upgrade recipe (svelte-4-to
   'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (upgrade, site, opts) => runOrExit(
-    async () => (await import("../upgrade-TPTE26FG.js")).runUpgradeCommand(upgrade, site, opts),
+    async () => (await import("../upgrade-RTAJZD56.js")).runUpgradeCommand(upgrade, site, opts),
     opts
   )
 );
@@ -144,7 +149,7 @@ cli.command(
   'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../convert-to-pnpm-XH7NYRVK.js")).runConvertToPnpmCommand(site, opts),
+    async () => (await import("../convert-to-pnpm-6F4RAFEJ.js")).runConvertToPnpmCommand(site, opts),
     opts
   )
 );
@@ -153,7 +158,31 @@ cli.command("svelte-codemods [site]", "Apply Svelte 5 gotcha codemods to an alre
   'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../svelte-codemods-KJLNH6FQ.js")).runSvelteCodemodsCommand(site, opts),
+    async () => (await import("../svelte-codemods-GYZZX742.js")).runSvelteCodemodsCommand(site, opts),
+    opts
+  )
+);
+cli.command(
+  "health-endpoint [site]",
+  "Write src/routes/health/+server.ts (function-health probe for the report gate)."
+).option(
+  "--fleet <inventory>",
+  'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
+).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
+  async (site, opts) => runOrExit(
+    async () => (await import("../health-endpoint-QXWM6GW2.js")).runHealthEndpointCommand(site, opts),
+    opts
+  )
+);
+cli.command(
+  "smoke-suite [site]",
+  "Add the smoke suite (test:smoke + playwright config + /health smoke routes)."
+).option(
+  "--fleet <inventory>",
+  'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
+).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
+  async (site, opts) => runOrExit(
+    async () => (await import("../smoke-suite-GP3W57JP.js")).runSmokeSuiteCommand(site, opts),
     opts
   )
 );
@@ -165,25 +194,25 @@ cli.command(
   'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../onboard-X6KJ5Z2V.js")).runOnboardCommand(site, opts),
+    async () => (await import("../onboard-TFBL62J3.js")).runOnboardCommand(site, opts),
     opts
   )
 );
 cli.command(
   "init [site]",
-  "One-shot guided onboarding: convert-to-pnpm \u2192 onboard \u2192 sync-configs \u2192 svelte-codemods \u2192 a11y-fixtures-page \u2192 audit."
+  "One-shot guided onboarding: convert-to-pnpm \u2192 onboard \u2192 sync-configs \u2192 svelte-codemods \u2192 a11y-fixtures-page \u2192 health-endpoint \u2192 smoke-suite \u2192 audit."
 ).option(
   "--fleet <inventory>",
   'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
-  async (site, opts) => runOrExit(async () => (await import("../init-UA6D7GKW.js")).runInitCommand(site, opts), opts)
+  async (site, opts) => runOrExit(async () => (await import("../init-KQOIPLVT.js")).runInitCommand(site, opts), opts)
 );
 cli.command(
   "launch <site>",
   "Bootstrap + first-audit a site, then draft its launch email for approval."
 ).action(
   async (site, opts) => runOrExit(
-    async () => (await import("../launch-AENAS2O2.js")).runLaunchCommand(site, opts),
+    async () => (await import("../launch-RX4VI7F2.js")).runLaunchCommand(site, opts),
     opts
   )
 );
@@ -192,7 +221,7 @@ cli.command(
   "Draft the monthly-report announcement email for maintenance sites (all, or one) for approval."
 ).action(
   async (site, opts) => runOrExit(
-    async () => (await import("../announce-72R3LRNT.js")).runAnnounceCommand(site, opts),
+    async () => (await import("../announce-3JE5FKW7.js")).runAnnounceCommand(site, opts),
     opts
   )
 );
@@ -201,7 +230,7 @@ cli.command(
   "Operator self-tests. kind=email: preview a report email for a site (or --all) to yourself."
 ).option("--type <type>", "Report type: announcement (default) | maintenance | testing | launch").option("--to <addr>", "Recipient(s), comma-separated. Default: OPERATOR_EMAIL.").option("--all", "Send a preview for every maintenance site (to --to/operator).").option("--dry-run", "Render only; write reports/<slug>/selftest-<type>.html; do not send.").action(
   async (kind, site, opts) => runOrExit(
-    async () => (await import("../selftest-55OJIWEB.js")).runSelftestCommand(kind, site, opts),
+    async () => (await import("../selftest-KPTL6KC4.js")).runSelftestCommand(kind, site, opts),
     opts
   )
 );
@@ -213,13 +242,13 @@ cli.command(
   "Fleet mode: announcement\u2192maintenance sites; maintenance/testing\u2192all schedulable sites."
 ).action(
   async (site, opts) => runOrExit(
-    async () => (await import("../preflight-D5RQGX4V.js")).runPreflightCommand(site, opts),
+    async () => (await import("../preflight-S3GYME3Q.js")).runPreflightCommand(site, opts),
     opts
   )
 );
 cli.command("ensure-site <slug>", "Create/verify the Airtable Websites row for a new site.").option("--name <display name>", "Human Name for the row (client-facing copy uses it verbatim).").option("--url <url>", "Deployed URL (e.g. the Netlify site URL).").option("--contact <email>", "point of contact \u2014 the client address reports resolve to.").option("--git-repo <owner/repo>", "GitHub identity. Default on create: reddoorla/<slug>.").action(
   async (slug, opts) => runOrExit(
-    async () => (await import("../ensure-site-2PF522VL.js")).runEnsureSiteCommand(slug, opts),
+    async () => (await import("../ensure-site-H5VMBPLF.js")).runEnsureSiteCommand(slug, opts),
     opts
   )
 );
@@ -234,7 +263,7 @@ cli.command("report [site]", "Draft or send maintenance/testing reports.").optio
   "Email the operator one daily digest of reports ready for approval (skips when empty)."
 ).action(
   async (site, opts) => runOrExit(
-    async () => (await import("../report-3FJ224H5.js")).runReportCommand(site, opts),
+    async () => (await import("../report-BLZ67QAQ.js")).runReportCommand(site, opts),
     opts
   )
 );
@@ -243,7 +272,7 @@ cli.command(
   "Sweep the fleet for GitHub signals (Renovate-failing/CI/last-commit) and write Airtable."
 ).option("--fleet", "Run across every site in the Airtable inventory.").option("--write-airtable", "Write each site's signals back to its Websites row.").action(
   async (opts) => runOrExit(
-    async () => (await import("../github-signals-CLQC2IPY.js")).runGitHubSignalsCommand({
+    async () => (await import("../github-signals-SQECQNST.js")).runGitHubSignalsCommand({
       fleet: opts.fleet,
       writeAirtable: opts.writeAirtable
     }),
@@ -261,12 +290,27 @@ cli.command(
   "Trigger Renovate on fleet sites the security sweep flagged with critical/high vulns."
 ).option("--fleet", "Run across every active, repo-backed site in the Airtable inventory.").action(
   async (opts) => runOrExit(
-    async () => (await import("../renovate-dispatch-LG4RJGDY.js")).runRenovateDispatchCommand({
+    async () => (await import("../renovate-dispatch-MZPAWVBL.js")).runRenovateDispatchCommand({
       fleet: opts.fleet
     }),
     opts
   )
 );
+cli.command(
+  "blux <action> [dir]",
+  "Blux conversion pipeline. emit: export dir \u2192 migration plan + custom types + theme + review manifest. migrate: emitted plan \u2192 live Prismic (needs PRISMIC_REPOSITORY_NAME + PRISMIC_WRITE_TOKEN). validate: content coverage of a rendered site against the export answer key. grid: parse rendered index.html \u2192 grid-tree.json (layout tree). convert: parse+classify index.html + assemble IR \u2192 migration-plan.json + blux-presentation.json + theme.css (+ map-config.json), offline."
+).option("--out <dir>", "Output directory for emit/grid/convert (default: <exportDir>/blux-out)").option("--converted-base <url>", "Converted-site base URL for the review manifest").option("--blux-base <url>", "Original Blux site base URL (default: https://<site.json domain>)").option(
+  "--probe",
+  "Reconstruct + HEAD-probe CDN URLs for used assets the HTML scrape missed (network)"
+).option(
+  "--against <target>",
+  "validate: rendered HTML of the converted site \u2014 a file path or http(s) URL"
+).action(
+  async (action, dir, opts) => runOrExit(
+    async () => (await import("../blux-FKZYMKLF.js")).runBluxCommand(action, dir, opts),
+    opts
+  )
+);
 cli.help();
 cli.version(version);
 cli.on("command:*", () => {

package/dist/cli/bin.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/cli/bin.ts","../../src/cli/version.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { dirname } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport { cac } from \"cac\";\nimport type { AuditName, RecipeName } from \"../types.js\";\nimport { loadCredentialsIntoEnv } from \"../util/credentials.js\";\nimport { resolvePackageVersion } from \"./version.js\";\n\n// Command modules are loaded LAZILY (dynamic `import()` inside each `.action()`),\n// never eagerly at the top. An eager `import { runReportCommand } from\n// \"./commands/report.js\"` would pull EVERY command's transitive dependency chain\n// into the CLI's startup graph — report/announce/launch drag in mjml + resend +\n// @google-analytics/data, `db` drags in the libSQL/kysely stack, etc. Those heavy\n// packages are `devDependencies` (this repo's CLI/functions/audits use them); a\n// consuming fleet site installs @reddoorla/maintenance only for `./forms` +\n// `./configs/*` and runs just `reddoor-maint audit --only a11y` in CI. Lazy\n// loading keeps that path (and `--help`/`--version`) free of the report/db\n// chains, so those packages never land in a consumer's node_modules. The\n// smoke-dist gate asserts bin.js's STATIC import closure stays free of them.\n\n// Load credentials from ~/.config/reddoor-maint/credentials.env before any\n// command runs, so AIRTABLE_PAT/AIRTABLE_BASE_ID/RESEND_API_KEY/etc. are\n// available from any cwd. Shell-exported env vars still win. Silent on\n// missing file — commands that need the credentials will fail with their\n// own clear error.\nloadCredentialsIntoEnv();\n\nconst here = dirname(fileURLToPath(import.meta.url));\nconst version = resolvePackageVersion(here);\n\nconst AUDIT_DESCRIPTIONS: Record<AuditName, string> = {\n  deps: \"Diff site package.json against the bundled baseline version map.\",\n  lighthouse: \"Run @lhci/cli autorun using the canonical lighthouserc.\",\n  a11y: \"Playwright + axe against the canonical a11y routes.\",\n  security:\n    \"GitHub Dependabot alerts (prod+dev) for repo-backed sites; falls back to pnpm/npm audit (prod-deps) with no repo/token.\",\n  lint: \"ESLint + Prettier using the canonical configs.\",\n  domain: \"DNS resolve + TLS cert expiry against the deployed URL (checkout-free).\",\n  browser:\n    \"Playwright across desktop engines + mobile devices + link-check against the deployed URL (checkout-free).\",\n  \"netlify-deploy\":\n    \"Latest production deploy health via the Netlify API by site id (checkout-free; needs NETLIFY_PAT).\",\n};\n\nconst RECIPE_DESCRIPTIONS: Record<RecipeName, string> = {\n  \"sync-configs\": \"Overwrite a site's canonical configs to match @reddoorla/maintenance.\",\n  \"bump-deps\": \"Bump dependencies and commit the lockfile change.\",\n  \"svelte-4-to-5\": \"Run the 7-commit Svelte 4 → 5 upgrade recipe.\",\n  \"svelte-codemods\":\n    \"Apply Svelte 5 gotcha codemods to an already-migrated site (state_referenced_locally, etc.).\",\n  \"convert-to-pnpm\": \"Convert an npm/yarn site to pnpm (lockfile, packageManager, scripts).\",\n  onboard: \"Install @reddoorla/maintenance + audit deps on a site (preferred first step).\",\n  \"a11y-fixtures-page\":\n    \"Write src/routes/dev/a11y-fixtures/+page.svelte (stub for lhci + axe targets).\",\n  \"self-updating\":\n    \"Bootstrap CI + Renovate + auto-merge per repo (writes workflows, opens PR, sets RENOVATE_TOKEN).\",\n  init: \"Run the full onboarding chain (convert-to-pnpm → onboard → sync-configs → svelte-codemods → a11y-fixtures-page → audit).\",\n};\n\n/** Run a command thunk and surface its result, falling back to a clean error\n * message on throw. Wraps the ~10-line try/catch every `.action()` used to\n * duplicate. `verbose` flips between full stack and message-only.\n *\n * On success it sets `process.exitCode` and RETURNS rather than calling\n * `process.exit()` right after `console.log()`. `process.exit()` does not wait\n * for stdout to flush when stdout is a pipe, so a large `--json` payload piped\n * to another process would get truncated mid-write. Setting `exitCode` and\n * returning lets Node drain stdout and exit naturally with the right code. A\n * non-zero `code` still yields a non-zero process exit.\n *\n * The error path keeps `process.exit()` — error messages are small (one line),\n * always go to stderr, and exiting immediately is the desired fail-fast. */\nexport async function runOrExit(\n  fn: () => Promise<{ output: string; code: number }>,\n  opts: { verbose?: boolean },\n): Promise<void> {\n  try {\n    const { output, code } = await fn();\n    console.log(output);\n    process.exitCode = code;\n    return;\n  } catch (err) {\n    const e = err as { exitCode?: number; message?: string; stack?: string };\n    console.error(opts.verbose ? (e.stack ?? e.message) : (e.message ?? String(err)));\n    process.exit(e.exitCode ?? 1);\n  }\n}\n\nconst cli = cac(\"reddoor-maint\");\n\ncli.option(\"--cwd <path>\", \"Override working directory (default: process.cwd())\");\ncli.option(\"--verbose\", \"Verbose output (full stack on errors)\");\n\ncli.command(\"list-audits\", \"Print the available audits.\").action(() => {\n  for (const [name, desc] of Object.entries(AUDIT_DESCRIPTIONS)) {\n    console.log(`${name.padEnd(12)} ${desc}`);\n  }\n});\n\ncli.command(\"list-recipes\", \"Print the available recipes.\").action(() => {\n  for (const [name, desc] of Object.entries(RECIPE_DESCRIPTIONS)) {\n    console.log(`${name.padEnd(16)} ${desc}`);\n  }\n});\n\ncli\n  .command(\"audit [site]\", \"Run audits against a site (default: cwd).\")\n  .option(\"--only <names>\", \"Comma-separated audit names (e.g. deps,lighthouse)\")\n  .option(\"--json\", \"Machine-readable JSON output\")\n  .option(\n    \"--fleet <inventory>\",\n    'Inventory file (.json or .mjs/.js), or \"airtable\" to read from Websites table',\n  )\n  .option(\"--workdir <path>\", \"Clone target for fleet mode (default ~/.reddoor-maint/sites)\")\n  .option(\n    \"--write-airtable [slug]\",\n    \"After lighthouse runs, write pScore/rScore/bpScore/seoScore + timestamp to the matching Websites row. Slug defaults to cwd's package.json#name.\",\n  )\n  .option(\"--fail-on-violations\", \"Exit non-zero if any a11y violations are found (for CI gates)\")\n  .option(\n    \"--url <url>\",\n    \"Audit this deployed URL with lighthouse (no dev server); single-site. Pair with --only lighthouse — other audits still use the local checkout.\",\n  )\n  .option(\n    \"--concurrency <n>\",\n    \"Max sites to audit in parallel in --fleet mode (default: all at once). Use 1 for sequential (CI).\",\n  )\n  .action(\n    async (\n      site,\n      opts: {\n        only?: string;\n        json?: boolean;\n        fleet?: string;\n        workdir?: string;\n        cwd?: string;\n        verbose?: boolean;\n        writeAirtable?: string | boolean;\n        failOnViolations?: boolean;\n        url?: string;\n        concurrency?: string;\n      },\n    ) =>\n      runOrExit(\n        async () => (await import(\"./commands/audit.js\")).runAuditCommand(site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\"sync-configs [site]\", \"Sync canonical configs into a site.\")\n  .option(\"--only <names>\", \"Comma-separated config names (e.g. eslint,prettier)\")\n  .option(\"--dry\", \"Print diff without writing\")\n  .option(\n    \"--fleet <inventory>\",\n    'Inventory file (.json or .mjs/.js), or \"airtable\" to read from Websites table',\n  )\n  .option(\"--workdir <path>\", \"Clone target for fleet mode (default ~/.reddoor-maint/sites)\")\n  .action(\n    async (\n      site,\n      opts: {\n        only?: string;\n        dry?: boolean;\n        fleet?: string;\n        workdir?: string;\n        cwd?: string;\n        verbose?: boolean;\n      },\n    ) =>\n      runOrExit(\n        async () => (await import(\"./commands/sync-configs.js\")).runSyncConfigsCommand(site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\"bump-deps [site]\", \"Bump dependencies.\")\n  .option(\"--group <group>\", \"patch | minor | major\", { default: \"minor\" })\n  .option(\n    \"--fleet <inventory>\",\n    'Inventory file (.json or .mjs/.js), or \"airtable\" to read from Websites table',\n  )\n  .option(\"--workdir <path>\", \"Clone target for fleet mode (default ~/.reddoor-maint/sites)\")\n  .action(\n    async (\n      site,\n      opts: {\n        group?: string;\n        fleet?: string;\n        workdir?: string;\n        cwd?: string;\n        verbose?: boolean;\n      },\n    ) =>\n      runOrExit(\n        async () => (await import(\"./commands/bump-deps.js\")).runBumpDepsCommand(site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\n    \"self-updating [site]\",\n    \"Bootstrap a repo to keep itself updated (CI + Renovate + auto-merge).\",\n  )\n  .option(\"--dry\", \"List what would be enabled without writing or opening PRs\")\n  .option(\"--fleet <inventory>\", 'Inventory file (.json or .mjs/.js), or \"airtable\"')\n  .option(\"--workdir <path>\", \"Clone target for fleet mode (default ~/.reddoor-maint/sites)\")\n  .action(\n    async (\n      site,\n      opts: {\n        dry?: boolean;\n        fleet?: string;\n        workdir?: string;\n        cwd?: string;\n        verbose?: boolean;\n      },\n    ) =>\n      runOrExit(\n        async () =>\n          (await import(\"./commands/self-updating.js\")).runSelfUpdatingCommand(site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\"upgrade <upgrade> [site]\", \"Run a named upgrade recipe (svelte-4-to-5).\")\n  .example(\"reddoor-maint upgrade svelte-4-to-5 ./my-site\")\n  .option(\n    \"--fleet <inventory>\",\n    'Inventory file (.json or .mjs/.js), or \"airtable\" to read from Websites table',\n  )\n  .option(\"--workdir <path>\", \"Clone target for fleet mode (default ~/.reddoor-maint/sites)\")\n  .action(\n    async (\n      upgrade: string,\n      site: string | undefined,\n      opts: { fleet?: string; workdir?: string; cwd?: string; verbose?: boolean },\n    ) =>\n      runOrExit(\n        async () => (await import(\"./commands/upgrade.js\")).runUpgradeCommand(upgrade, site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\n    \"convert-to-pnpm [site]\",\n    \"Convert an npm/yarn site to pnpm (lockfile, packageManager, scripts).\",\n  )\n  .option(\n    \"--fleet <inventory>\",\n    'Inventory file (.json or .mjs/.js), or \"airtable\" to read from Websites table',\n  )\n  .option(\"--workdir <path>\", \"Clone target for fleet mode (default ~/.reddoor-maint/sites)\")\n  .action(\n    async (site, opts: { fleet?: string; workdir?: string; cwd?: string; verbose?: boolean }) =>\n      runOrExit(\n        async () =>\n          (await import(\"./commands/convert-to-pnpm.js\")).runConvertToPnpmCommand(site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\"svelte-codemods [site]\", \"Apply Svelte 5 gotcha codemods to an already-migrated site.\")\n  .option(\n    \"--fleet <inventory>\",\n    'Inventory file (.json or .mjs/.js), or \"airtable\" to read from Websites table',\n  )\n  .option(\"--workdir <path>\", \"Clone target for fleet mode (default ~/.reddoor-maint/sites)\")\n  .action(\n    async (site, opts: { fleet?: string; workdir?: string; cwd?: string; verbose?: boolean }) =>\n      runOrExit(\n        async () =>\n          (await import(\"./commands/svelte-codemods.js\")).runSvelteCodemodsCommand(site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\n    \"onboard [site]\",\n    \"Install @reddoorla/maintenance + audit deps on a site (run after convert-to-pnpm).\",\n  )\n  .option(\"--audits <names>\", \"Comma-separated audit subset: lighthouse,a11y (default: both)\")\n  .option(\n    \"--fleet <inventory>\",\n    'Inventory file (.json or .mjs/.js), or \"airtable\" to read from Websites table',\n  )\n  .option(\"--workdir <path>\", \"Clone target for fleet mode (default ~/.reddoor-maint/sites)\")\n  .action(\n    async (\n      site,\n      opts: {\n        audits?: string;\n        fleet?: string;\n        workdir?: string;\n        cwd?: string;\n        verbose?: boolean;\n      },\n    ) =>\n      runOrExit(\n        async () => (await import(\"./commands/onboard.js\")).runOnboardCommand(site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\n    \"init [site]\",\n    \"One-shot guided onboarding: convert-to-pnpm → onboard → sync-configs → svelte-codemods → a11y-fixtures-page → audit.\",\n  )\n  .option(\n    \"--fleet <inventory>\",\n    'Inventory file (.json or .mjs/.js), or \"airtable\" to read from Websites table',\n  )\n  .option(\"--workdir <path>\", \"Clone target for fleet mode (default ~/.reddoor-maint/sites)\")\n  .action(\n    async (site, opts: { fleet?: string; workdir?: string; cwd?: string; verbose?: boolean }) =>\n      runOrExit(async () => (await import(\"./commands/init.js\")).runInitCommand(site, opts), opts),\n  );\n\ncli\n  .command(\n    \"launch <site>\",\n    \"Bootstrap + first-audit a site, then draft its launch email for approval.\",\n  )\n  .action(async (site: string, opts: { cwd?: string; verbose?: boolean }) =>\n    runOrExit(\n      async () => (await import(\"./commands/launch.js\")).runLaunchCommand(site, opts),\n      opts,\n    ),\n  );\n\ncli\n  .command(\n    \"announce [site]\",\n    \"Draft the monthly-report announcement email for maintenance sites (all, or one) for approval.\",\n  )\n  .action(async (site: string | undefined, opts: { cwd?: string; verbose?: boolean }) =>\n    runOrExit(\n      async () => (await import(\"./commands/announce.js\")).runAnnounceCommand(site, opts),\n      opts,\n    ),\n  );\n\ncli\n  .command(\n    \"selftest <kind> [site]\",\n    \"Operator self-tests. kind=email: preview a report email for a site (or --all) to yourself.\",\n  )\n  .option(\"--type <type>\", \"Report type: announcement (default) | maintenance | testing | launch\")\n  .option(\"--to <addr>\", \"Recipient(s), comma-separated. Default: OPERATOR_EMAIL.\")\n  .option(\"--all\", \"Send a preview for every maintenance site (to --to/operator).\")\n  .option(\"--dry-run\", \"Render only; write reports/<slug>/selftest-<type>.html; do not send.\")\n  .action(\n    async (\n      kind: string,\n      site: string | undefined,\n      opts: {\n        type?: string;\n        to?: string;\n        all?: boolean;\n        dryRun?: boolean;\n        cwd?: string;\n        verbose?: boolean;\n      },\n    ) =>\n      runOrExit(\n        async () => (await import(\"./commands/selftest.js\")).runSelftestCommand(kind, site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\n    \"preflight [site]\",\n    \"Read-only pre-send checks: recipients, header image, pending drafts, schedule hygiene.\",\n  )\n  .option(\"--type <type>\", \"Report type: announcement (default) | maintenance | testing\")\n  .option(\n    \"--all\",\n    \"Fleet mode: announcement→maintenance sites; maintenance/testing→all schedulable sites.\",\n  )\n  .action(\n    async (\n      site: string | undefined,\n      opts: { type?: string; all?: boolean; cwd?: string; verbose?: boolean },\n    ) =>\n      runOrExit(\n        async () => (await import(\"./commands/preflight.js\")).runPreflightCommand(site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\"ensure-site <slug>\", \"Create/verify the Airtable Websites row for a new site.\")\n  .option(\"--name <display name>\", \"Human Name for the row (client-facing copy uses it verbatim).\")\n  .option(\"--url <url>\", \"Deployed URL (e.g. the Netlify site URL).\")\n  .option(\"--contact <email>\", \"point of contact — the client address reports resolve to.\")\n  .option(\"--git-repo <owner/repo>\", \"GitHub identity. Default on create: reddoorla/<slug>.\")\n  .action(\n    async (\n      slug: string,\n      opts: {\n        name?: string;\n        url?: string;\n        contact?: string;\n        gitRepo?: string;\n        cwd?: string;\n        verbose?: boolean;\n      },\n    ) =>\n      runOrExit(\n        async () => (await import(\"./commands/ensure-site.js\")).runEnsureSiteCommand(slug, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\"report [site]\", \"Draft or send maintenance/testing reports.\")\n  .option(\"--due\", \"Scan all Websites and draft overdue reports.\")\n  .option(\"--type <type>\", \"Single-site draft report type: Maintenance (default) or Testing.\")\n  .option(\n    \"--preview\",\n    \"Single-site dry run; writes reports/<slug>/draft.html, never touches Airtable.\",\n  )\n  .option(\n    \"--send-ready\",\n    \"Send all Reports with Draft ready=true AND Approved to send=true AND Sent at IS NULL.\",\n  )\n  .option(\n    \"--digest\",\n    \"Email the operator one daily digest of reports ready for approval (skips when empty).\",\n  )\n  .action(\n    async (\n      site,\n      opts: {\n        due?: boolean;\n        type?: string;\n        preview?: boolean;\n        sendReady?: boolean;\n        digest?: boolean;\n        cwd?: string;\n        verbose?: boolean;\n      },\n    ) =>\n      runOrExit(\n        async () => (await import(\"./commands/report.js\")).runReportCommand(site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\n    \"github-signals\",\n    \"Sweep the fleet for GitHub signals (Renovate-failing/CI/last-commit) and write Airtable.\",\n  )\n  .option(\"--fleet\", \"Run across every site in the Airtable inventory.\")\n  .option(\"--write-airtable\", \"Write each site's signals back to its Websites row.\")\n  .action(\n    async (opts: { fleet?: boolean; writeAirtable?: boolean; cwd?: string; verbose?: boolean }) =>\n      runOrExit(\n        async () =>\n          (await import(\"./commands/github-signals.js\")).runGitHubSignalsCommand({\n            fleet: opts.fleet,\n            writeAirtable: opts.writeAirtable,\n          }),\n        opts,\n      ),\n  );\n\ncli\n  .command(\n    \"db <action>\",\n    \"Migrate / backfill / reconcile the libSQL store (migrate | backfill | reconcile).\",\n  )\n  .action(async (action: string, opts: { cwd?: string; verbose?: boolean }) =>\n    runOrExit(async () => (await import(\"./commands/db.js\")).runDbCommand(action, opts), opts),\n  );\n\ncli\n  .command(\n    \"renovate-dispatch\",\n    \"Trigger Renovate on fleet sites the security sweep flagged with critical/high vulns.\",\n  )\n  .option(\"--fleet\", \"Run across every active, repo-backed site in the Airtable inventory.\")\n  .action(async (opts: { fleet?: boolean; cwd?: string; verbose?: boolean }) =>\n    runOrExit(\n      async () =>\n        (await import(\"./commands/renovate-dispatch.js\")).runRenovateDispatchCommand({\n          fleet: opts.fleet,\n        }),\n      opts,\n    ),\n  );\n\ncli.help();\ncli.version(version);\n\n// A typo'd / unrecognized subcommand (e.g. `reddoor-maint auditt`) otherwise\n// falls through cac with no matched command and exits 0 — a cron/CI typo would\n// \"succeed\" silently. cac emits `command:*` at the end of parse() exactly when\n// a positional arg was given but matched no command (a bare `reddoor-maint`,\n// `--help`, and `--version` do NOT trigger it: they have no leading positional\n// or are handled before this fires). Turn that into a clear stderr error +\n// non-zero exit. process.argv[2] is the first positional, i.e. the bad command.\ncli.on(\"command:*\", () => {\n  const unknown = cli.args[0] ?? process.argv[2] ?? \"\";\n  console.error(\n    `error: unknown command '${unknown}'. Run 'reddoor-maint --help' to see available commands.`,\n  );\n  process.exit(1);\n});\n\ncli.parse();\n","import { readFileSync, existsSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\n\n/**\n * Read the @reddoorla/maintenance package version, given the directory of a\n * file that lives inside the package. Walks UP looking for the first\n * `package.json` whose `name` matches. Defensive against bundling-layout\n * changes — the older \"two levels up\" assumption held for `dist/cli/bin.js`\n * but would silently mis-read (or return \"unknown\") if tsup ever moved bin\n * to a different depth. Same walk-up pattern as the self-version helper.\n *\n * Returns \"unknown\" when no matching package.json is reachable (Yarn PnP\n * setups stash manifests inside .zip caches; the readFileSync there fails\n * before any name check).\n */\nexport function resolvePackageVersion(fromDir: string): string {\n  try {\n    let dir = fromDir;\n    while (true) {\n      const candidate = join(dir, \"package.json\");\n      if (existsSync(candidate)) {\n        const raw = readFileSync(candidate, \"utf-8\");\n        const pkg = JSON.parse(raw) as { name?: string; version?: string };\n        if (pkg.name === \"@reddoorla/maintenance\") {\n          return pkg.version ?? \"unknown\";\n        }\n      }\n      const parent = dirname(dir);\n      if (parent === dir) return \"unknown\";\n      dir = parent;\n    }\n  } catch {\n    return \"unknown\";\n  }\n}\n"],"mappings":";;;;;;AACA,SAAS,WAAAA,gBAAe;AACxB,SAAS,qBAAqB;AAC9B,SAAS,WAAW;;;ACHpB,SAAS,cAAc,kBAAkB;AACzC,SAAS,SAAS,YAAY;AAcvB,SAAS,sBAAsB,SAAyB;AAC7D,MAAI;AACF,QAAI,MAAM;AACV,WAAO,MAAM;AACX,YAAM,YAAY,KAAK,KAAK,cAAc;AAC1C,UAAI,WAAW,SAAS,GAAG;AACzB,cAAM,MAAM,aAAa,WAAW,OAAO;AAC3C,cAAM,MAAM,KAAK,MAAM,GAAG;AAC1B,YAAI,IAAI,SAAS,0BAA0B;AACzC,iBAAO,IAAI,WAAW;AAAA,QACxB;AAAA,MACF;AACA,YAAM,SAAS,QAAQ,GAAG;AAC1B,UAAI,WAAW,IAAK,QAAO;AAC3B,YAAM;AAAA,IACR;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ADTA,uBAAuB;AAEvB,IAAM,OAAOC,SAAQ,cAAc,YAAY,GAAG,CAAC;AACnD,IAAM,UAAU,sBAAsB,IAAI;AAE1C,IAAM,qBAAgD;AAAA,EACpD,MAAM;AAAA,EACN,YAAY;AAAA,EACZ,MAAM;AAAA,EACN,UACE;AAAA,EACF,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,SACE;AAAA,EACF,kBACE;AACJ;AAEA,IAAM,sBAAkD;AAAA,EACtD,gBAAgB;AAAA,EAChB,aAAa;AAAA,EACb,iBAAiB;AAAA,EACjB,mBACE;AAAA,EACF,mBAAmB;AAAA,EACnB,SAAS;AAAA,EACT,sBACE;AAAA,EACF,iBACE;AAAA,EACF,MAAM;AACR;AAeA,eAAsB,UACpB,IACA,MACe;AACf,MAAI;AACF,UAAM,EAAE,QAAQ,KAAK,IAAI,MAAM,GAAG;AAClC,YAAQ,IAAI,MAAM;AAClB,YAAQ,WAAW;AACnB;AAAA,EACF,SAAS,KAAK;AACZ,UAAM,IAAI;AACV,YAAQ,MAAM,KAAK,UAAW,EAAE,SAAS,EAAE,UAAY,EAAE,WAAW,OAAO,GAAG,CAAE;AAChF,YAAQ,KAAK,EAAE,YAAY,CAAC;AAAA,EAC9B;AACF;AAEA,IAAM,MAAM,IAAI,eAAe;AAE/B,IAAI,OAAO,gBAAgB,qDAAqD;AAChF,IAAI,OAAO,aAAa,uCAAuC;AAE/D,IAAI,QAAQ,eAAe,6BAA6B,EAAE,OAAO,MAAM;AACrE,aAAW,CAAC,MAAM,IAAI,KAAK,OAAO,QAAQ,kBAAkB,GAAG;AAC7D,YAAQ,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC,IAAI,IAAI,EAAE;AAAA,EAC1C;AACF,CAAC;AAED,IAAI,QAAQ,gBAAgB,8BAA8B,EAAE,OAAO,MAAM;AACvE,aAAW,CAAC,MAAM,IAAI,KAAK,OAAO,QAAQ,mBAAmB,GAAG;AAC9D,YAAQ,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC,IAAI,IAAI,EAAE;AAAA,EAC1C;AACF,CAAC;AAED,IACG,QAAQ,gBAAgB,2CAA2C,EACnE,OAAO,kBAAkB,oDAAoD,EAC7E,OAAO,UAAU,8BAA8B,EAC/C;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,oBAAoB,8DAA8D,EACzF;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,wBAAwB,+DAA+D,EAC9F;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC,OACE,MACA,SAaA;AAAA,IACE,aAAa,MAAM,OAAO,qBAAqB,GAAG,gBAAgB,MAAM,IAAI;AAAA,IAC5E;AAAA,EACF;AACJ;AAEF,IACG,QAAQ,uBAAuB,qCAAqC,EACpE,OAAO,kBAAkB,qDAAqD,EAC9E,OAAO,SAAS,4BAA4B,EAC5C;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,oBAAoB,8DAA8D,EACzF;AAAA,EACC,OACE,MACA,SASA;AAAA,IACE,aAAa,MAAM,OAAO,6BAA4B,GAAG,sBAAsB,MAAM,IAAI;AAAA,IACzF;AAAA,EACF;AACJ;AAEF,IACG,QAAQ,oBAAoB,oBAAoB,EAChD,OAAO,mBAAmB,yBAAyB,EAAE,SAAS,QAAQ,CAAC,EACvE;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,oBAAoB,8DAA8D,EACzF;AAAA,EACC,OACE,MACA,SAQA;AAAA,IACE,aAAa,MAAM,OAAO,0BAAyB,GAAG,mBAAmB,MAAM,IAAI;AAAA,IACnF;AAAA,EACF;AACJ;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,SAAS,2DAA2D,EAC3E,OAAO,uBAAuB,mDAAmD,EACjF,OAAO,oBAAoB,8DAA8D,EACzF;AAAA,EACC,OACE,MACA,SAQA;AAAA,IACE,aACG,MAAM,OAAO,8BAA6B,GAAG,uBAAuB,MAAM,IAAI;AAAA,IACjF;AAAA,EACF;AACJ;AAEF,IACG,QAAQ,4BAA4B,6CAA6C,EACjF,QAAQ,+CAA+C,EACvD;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,oBAAoB,8DAA8D,EACzF;AAAA,EACC,OACE,SACA,MACA,SAEA;AAAA,IACE,aAAa,MAAM,OAAO,wBAAuB,GAAG,kBAAkB,SAAS,MAAM,IAAI;AAAA,IACzF;AAAA,EACF;AACJ;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,oBAAoB,8DAA8D,EACzF;AAAA,EACC,OAAO,MAAM,SACX;AAAA,IACE,aACG,MAAM,OAAO,gCAA+B,GAAG,wBAAwB,MAAM,IAAI;AAAA,IACpF;AAAA,EACF;AACJ;AAEF,IACG,QAAQ,0BAA0B,6DAA6D,EAC/F;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,oBAAoB,8DAA8D,EACzF;AAAA,EACC,OAAO,MAAM,SACX;AAAA,IACE,aACG,MAAM,OAAO,gCAA+B,GAAG,yBAAyB,MAAM,IAAI;AAAA,IACrF;AAAA,EACF;AACJ;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,oBAAoB,+DAA+D,EAC1F;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,oBAAoB,8DAA8D,EACzF;AAAA,EACC,OACE,MACA,SAQA;AAAA,IACE,aAAa,MAAM,OAAO,wBAAuB,GAAG,kBAAkB,MAAM,IAAI;AAAA,IAChF;AAAA,EACF;AACJ;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,oBAAoB,8DAA8D,EACzF;AAAA,EACC,OAAO,MAAM,SACX,UAAU,aAAa,MAAM,OAAO,qBAAoB,GAAG,eAAe,MAAM,IAAI,GAAG,IAAI;AAC/F;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EAAO,OAAO,MAAc,SAC3B;AAAA,IACE,aAAa,MAAM,OAAO,uBAAsB,GAAG,iBAAiB,MAAM,IAAI;AAAA,IAC9E;AAAA,EACF;AACF;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EAAO,OAAO,MAA0B,SACvC;AAAA,IACE,aAAa,MAAM,OAAO,yBAAwB,GAAG,mBAAmB,MAAM,IAAI;AAAA,IAClF;AAAA,EACF;AACF;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,iBAAiB,sEAAsE,EAC9F,OAAO,eAAe,yDAAyD,EAC/E,OAAO,SAAS,+DAA+D,EAC/E,OAAO,aAAa,sEAAsE,EAC1F;AAAA,EACC,OACE,MACA,MACA,SASA;AAAA,IACE,aAAa,MAAM,OAAO,yBAAwB,GAAG,mBAAmB,MAAM,MAAM,IAAI;AAAA,IACxF;AAAA,EACF;AACJ;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,iBAAiB,6DAA6D,EACrF;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC,OACE,MACA,SAEA;AAAA,IACE,aAAa,MAAM,OAAO,0BAAyB,GAAG,oBAAoB,MAAM,IAAI;AAAA,IACpF;AAAA,EACF;AACJ;AAEF,IACG,QAAQ,sBAAsB,yDAAyD,EACvF,OAAO,yBAAyB,+DAA+D,EAC/F,OAAO,eAAe,2CAA2C,EACjE,OAAO,qBAAqB,gEAA2D,EACvF,OAAO,2BAA2B,uDAAuD,EACzF;AAAA,EACC,OACE,MACA,SASA;AAAA,IACE,aAAa,MAAM,OAAO,4BAA2B,GAAG,qBAAqB,MAAM,IAAI;AAAA,IACvF;AAAA,EACF;AACJ;AAEF,IACG,QAAQ,iBAAiB,4CAA4C,EACrE,OAAO,SAAS,8CAA8C,EAC9D,OAAO,iBAAiB,kEAAkE,EAC1F;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC,OACE,MACA,SAUA;AAAA,IACE,aAAa,MAAM,OAAO,uBAAsB,GAAG,iBAAiB,MAAM,IAAI;AAAA,IAC9E;AAAA,EACF;AACJ;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,WAAW,kDAAkD,EACpE,OAAO,oBAAoB,qDAAqD,EAChF;AAAA,EACC,OAAO,SACL;AAAA,IACE,aACG,MAAM,OAAO,+BAA8B,GAAG,wBAAwB;AAAA,MACrE,OAAO,KAAK;AAAA,MACZ,eAAe,KAAK;AAAA,IACtB,CAAC;AAAA,IACH;AAAA,EACF;AACJ;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EAAO,OAAO,QAAgB,SAC7B,UAAU,aAAa,MAAM,OAAO,mBAAkB,GAAG,aAAa,QAAQ,IAAI,GAAG,IAAI;AAC3F;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,WAAW,sEAAsE,EACxF;AAAA,EAAO,OAAO,SACb;AAAA,IACE,aACG,MAAM,OAAO,kCAAiC,GAAG,2BAA2B;AAAA,MAC3E,OAAO,KAAK;AAAA,IACd,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEF,IAAI,KAAK;AACT,IAAI,QAAQ,OAAO;AASnB,IAAI,GAAG,aAAa,MAAM;AACxB,QAAM,UAAU,IAAI,KAAK,CAAC,KAAK,QAAQ,KAAK,CAAC,KAAK;AAClD,UAAQ;AAAA,IACN,2BAA2B,OAAO;AAAA,EACpC;AACA,UAAQ,KAAK,CAAC;AAChB,CAAC;AAED,IAAI,MAAM;","names":["dirname","dirname"]}
+{"version":3,"sources":["../../src/cli/bin.ts","../../src/cli/version.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { dirname } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport { cac } from \"cac\";\nimport type { AuditName, RecipeName } from \"../types.js\";\nimport { loadCredentialsIntoEnv } from \"../util/credentials.js\";\nimport { resolvePackageVersion } from \"./version.js\";\n\n// Command modules are loaded LAZILY (dynamic `import()` inside each `.action()`),\n// never eagerly at the top. An eager `import { runReportCommand } from\n// \"./commands/report.js\"` would pull EVERY command's transitive dependency chain\n// into the CLI's startup graph — report/announce/launch drag in mjml + resend +\n// @google-analytics/data, `db` drags in the libSQL/kysely stack, etc. Those heavy\n// packages are `devDependencies` (this repo's CLI/functions/audits use them); a\n// consuming fleet site installs @reddoorla/maintenance only for `./forms` +\n// `./configs/*` and runs just `reddoor-maint audit --only a11y` in CI. Lazy\n// loading keeps that path (and `--help`/`--version`) free of the report/db\n// chains, so those packages never land in a consumer's node_modules. The\n// smoke-dist gate asserts bin.js's STATIC import closure stays free of them.\n\n// Load credentials from ~/.config/reddoor-maint/credentials.env before any\n// command runs, so AIRTABLE_PAT/AIRTABLE_BASE_ID/RESEND_API_KEY/etc. are\n// available from any cwd. Shell-exported env vars still win. Silent on\n// missing file — commands that need the credentials will fail with their\n// own clear error.\nloadCredentialsIntoEnv();\n\nconst here = dirname(fileURLToPath(import.meta.url));\nconst version = resolvePackageVersion(here);\n\nconst AUDIT_DESCRIPTIONS: Record<AuditName, string> = {\n  deps: \"Diff site package.json against the bundled baseline version map.\",\n  lighthouse: \"Run @lhci/cli autorun using the canonical lighthouserc.\",\n  a11y: \"Playwright + axe against the canonical a11y routes.\",\n  security:\n    \"GitHub Dependabot alerts (prod+dev) for repo-backed sites; falls back to pnpm/npm audit (prod-deps) with no repo/token.\",\n  lint: \"ESLint + Prettier using the canonical configs.\",\n  domain: \"DNS resolve + TLS cert expiry against the deployed URL (checkout-free).\",\n  browser:\n    \"Playwright across desktop engines + mobile devices + link-check against the deployed URL (checkout-free).\",\n  \"netlify-deploy\":\n    \"Latest production deploy health via the Netlify API by site id (checkout-free; needs NETLIFY_PAT).\",\n  \"function-health\":\n    \"GET {deployedUrl}/health and read its ok/prismic/forms status (checkout-free).\",\n  smoke: \"Run the site's own `pnpm test:smoke` suite in its checkout (clone-based).\",\n  \"form-e2e\":\n    \"Submit the real production contact form in test-mode against the deployed URL (checkout-free).\",\n};\n\nconst RECIPE_DESCRIPTIONS: Record<RecipeName, string> = {\n  \"sync-configs\": \"Overwrite a site's canonical configs to match @reddoorla/maintenance.\",\n  \"bump-deps\": \"Bump dependencies and commit the lockfile change.\",\n  \"svelte-4-to-5\": \"Run the 7-commit Svelte 4 → 5 upgrade recipe.\",\n  \"svelte-codemods\":\n    \"Apply Svelte 5 gotcha codemods to an already-migrated site (state_referenced_locally, etc.).\",\n  \"convert-to-pnpm\": \"Convert an npm/yarn site to pnpm (lockfile, packageManager, scripts).\",\n  onboard: \"Install @reddoorla/maintenance + audit deps on a site (preferred first step).\",\n  \"a11y-fixtures-page\":\n    \"Write src/routes/dev/a11y-fixtures/+page.svelte (stub for lhci + axe targets).\",\n  \"health-endpoint\":\n    \"Write src/routes/health/+server.ts (function-health probe for the report gate).\",\n  \"smoke-suite\": \"Add the smoke suite (test:smoke + playwright config + /health smoke routes).\",\n  \"self-updating\":\n    \"Bootstrap CI + Renovate + auto-merge per repo (writes workflows, opens PR, sets RENOVATE_TOKEN).\",\n  init: \"Run the full onboarding chain (convert-to-pnpm → onboard → sync-configs → svelte-codemods → a11y-fixtures-page → health-endpoint → smoke-suite → audit).\",\n};\n\n/** Run a command thunk and surface its result, falling back to a clean error\n * message on throw. Wraps the ~10-line try/catch every `.action()` used to\n * duplicate. `verbose` flips between full stack and message-only.\n *\n * On success it sets `process.exitCode` and RETURNS rather than calling\n * `process.exit()` right after `console.log()`. `process.exit()` does not wait\n * for stdout to flush when stdout is a pipe, so a large `--json` payload piped\n * to another process would get truncated mid-write. Setting `exitCode` and\n * returning lets Node drain stdout and exit naturally with the right code. A\n * non-zero `code` still yields a non-zero process exit.\n *\n * The error path keeps `process.exit()` — error messages are small (one line),\n * always go to stderr, and exiting immediately is the desired fail-fast. */\nexport async function runOrExit(\n  fn: () => Promise<{ output: string; code: number }>,\n  opts: { verbose?: boolean },\n): Promise<void> {\n  try {\n    const { output, code } = await fn();\n    console.log(output);\n    process.exitCode = code;\n    return;\n  } catch (err) {\n    const e = err as { exitCode?: number; message?: string; stack?: string };\n    console.error(opts.verbose ? (e.stack ?? e.message) : (e.message ?? String(err)));\n    process.exit(e.exitCode ?? 1);\n  }\n}\n\nconst cli = cac(\"reddoor-maint\");\n\ncli.option(\"--cwd <path>\", \"Override working directory (default: process.cwd())\");\ncli.option(\"--verbose\", \"Verbose output (full stack on errors)\");\n\ncli.command(\"list-audits\", \"Print the available audits.\").action(() => {\n  for (const [name, desc] of Object.entries(AUDIT_DESCRIPTIONS)) {\n    console.log(`${name.padEnd(12)} ${desc}`);\n  }\n});\n\ncli.command(\"list-recipes\", \"Print the available recipes.\").action(() => {\n  for (const [name, desc] of Object.entries(RECIPE_DESCRIPTIONS)) {\n    console.log(`${name.padEnd(16)} ${desc}`);\n  }\n});\n\ncli\n  .command(\"audit [site]\", \"Run audits against a site (default: cwd).\")\n  .option(\"--only <names>\", \"Comma-separated audit names (e.g. deps,lighthouse)\")\n  .option(\"--json\", \"Machine-readable JSON output\")\n  .option(\n    \"--fleet <inventory>\",\n    'Inventory file (.json or .mjs/.js), or \"airtable\" to read from Websites table',\n  )\n  .option(\"--workdir <path>\", \"Clone target for fleet mode (default ~/.reddoor-maint/sites)\")\n  .option(\n    \"--write-airtable [slug]\",\n    \"After lighthouse runs, write pScore/rScore/bpScore/seoScore + timestamp to the matching Websites row. Slug defaults to cwd's package.json#name.\",\n  )\n  .option(\"--fail-on-violations\", \"Exit non-zero if any a11y violations are found (for CI gates)\")\n  .option(\n    \"--url <url>\",\n    \"Audit this deployed URL with lighthouse (no dev server); single-site. Pair with --only lighthouse — other audits still use the local checkout.\",\n  )\n  .option(\n    \"--concurrency <n>\",\n    \"Max sites to audit in parallel in --fleet mode (default: all at once). Use 1 for sequential (CI).\",\n  )\n  .action(\n    async (\n      site,\n      opts: {\n        only?: string;\n        json?: boolean;\n        fleet?: string;\n        workdir?: string;\n        cwd?: string;\n        verbose?: boolean;\n        writeAirtable?: string | boolean;\n        failOnViolations?: boolean;\n        url?: string;\n        concurrency?: string;\n      },\n    ) =>\n      runOrExit(\n        async () => (await import(\"./commands/audit.js\")).runAuditCommand(site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\"sync-configs [site]\", \"Sync canonical configs into a site.\")\n  .option(\"--only <names>\", \"Comma-separated config names (e.g. eslint,prettier)\")\n  .option(\"--dry\", \"Print diff without writing\")\n  .option(\n    \"--fleet <inventory>\",\n    'Inventory file (.json or .mjs/.js), or \"airtable\" to read from Websites table',\n  )\n  .option(\"--workdir <path>\", \"Clone target for fleet mode (default ~/.reddoor-maint/sites)\")\n  .action(\n    async (\n      site,\n      opts: {\n        only?: string;\n        dry?: boolean;\n        fleet?: string;\n        workdir?: string;\n        cwd?: string;\n        verbose?: boolean;\n      },\n    ) =>\n      runOrExit(\n        async () => (await import(\"./commands/sync-configs.js\")).runSyncConfigsCommand(site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\"bump-deps [site]\", \"Bump dependencies.\")\n  .option(\"--group <group>\", \"patch | minor | major\", { default: \"minor\" })\n  .option(\n    \"--fleet <inventory>\",\n    'Inventory file (.json or .mjs/.js), or \"airtable\" to read from Websites table',\n  )\n  .option(\"--workdir <path>\", \"Clone target for fleet mode (default ~/.reddoor-maint/sites)\")\n  .action(\n    async (\n      site,\n      opts: {\n        group?: string;\n        fleet?: string;\n        workdir?: string;\n        cwd?: string;\n        verbose?: boolean;\n      },\n    ) =>\n      runOrExit(\n        async () => (await import(\"./commands/bump-deps.js\")).runBumpDepsCommand(site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\n    \"self-updating [site]\",\n    \"Bootstrap a repo to keep itself updated (CI + Renovate + auto-merge).\",\n  )\n  .option(\"--dry\", \"List what would be enabled without writing or opening PRs\")\n  .option(\"--fleet <inventory>\", 'Inventory file (.json or .mjs/.js), or \"airtable\"')\n  .option(\"--workdir <path>\", \"Clone target for fleet mode (default ~/.reddoor-maint/sites)\")\n  .action(\n    async (\n      site,\n      opts: {\n        dry?: boolean;\n        fleet?: string;\n        workdir?: string;\n        cwd?: string;\n        verbose?: boolean;\n      },\n    ) =>\n      runOrExit(\n        async () =>\n          (await import(\"./commands/self-updating.js\")).runSelfUpdatingCommand(site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\"upgrade <upgrade> [site]\", \"Run a named upgrade recipe (svelte-4-to-5).\")\n  .example(\"reddoor-maint upgrade svelte-4-to-5 ./my-site\")\n  .option(\n    \"--fleet <inventory>\",\n    'Inventory file (.json or .mjs/.js), or \"airtable\" to read from Websites table',\n  )\n  .option(\"--workdir <path>\", \"Clone target for fleet mode (default ~/.reddoor-maint/sites)\")\n  .action(\n    async (\n      upgrade: string,\n      site: string | undefined,\n      opts: { fleet?: string; workdir?: string; cwd?: string; verbose?: boolean },\n    ) =>\n      runOrExit(\n        async () => (await import(\"./commands/upgrade.js\")).runUpgradeCommand(upgrade, site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\n    \"convert-to-pnpm [site]\",\n    \"Convert an npm/yarn site to pnpm (lockfile, packageManager, scripts).\",\n  )\n  .option(\n    \"--fleet <inventory>\",\n    'Inventory file (.json or .mjs/.js), or \"airtable\" to read from Websites table',\n  )\n  .option(\"--workdir <path>\", \"Clone target for fleet mode (default ~/.reddoor-maint/sites)\")\n  .action(\n    async (site, opts: { fleet?: string; workdir?: string; cwd?: string; verbose?: boolean }) =>\n      runOrExit(\n        async () =>\n          (await import(\"./commands/convert-to-pnpm.js\")).runConvertToPnpmCommand(site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\"svelte-codemods [site]\", \"Apply Svelte 5 gotcha codemods to an already-migrated site.\")\n  .option(\n    \"--fleet <inventory>\",\n    'Inventory file (.json or .mjs/.js), or \"airtable\" to read from Websites table',\n  )\n  .option(\"--workdir <path>\", \"Clone target for fleet mode (default ~/.reddoor-maint/sites)\")\n  .action(\n    async (site, opts: { fleet?: string; workdir?: string; cwd?: string; verbose?: boolean }) =>\n      runOrExit(\n        async () =>\n          (await import(\"./commands/svelte-codemods.js\")).runSvelteCodemodsCommand(site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\n    \"health-endpoint [site]\",\n    \"Write src/routes/health/+server.ts (function-health probe for the report gate).\",\n  )\n  .option(\n    \"--fleet <inventory>\",\n    'Inventory file (.json or .mjs/.js), or \"airtable\" to read from Websites table',\n  )\n  .option(\"--workdir <path>\", \"Clone target for fleet mode (default ~/.reddoor-maint/sites)\")\n  .action(\n    async (site, opts: { fleet?: string; workdir?: string; cwd?: string; verbose?: boolean }) =>\n      runOrExit(\n        async () =>\n          (await import(\"./commands/health-endpoint.js\")).runHealthEndpointCommand(site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\n    \"smoke-suite [site]\",\n    \"Add the smoke suite (test:smoke + playwright config + /health smoke routes).\",\n  )\n  .option(\n    \"--fleet <inventory>\",\n    'Inventory file (.json or .mjs/.js), or \"airtable\" to read from Websites table',\n  )\n  .option(\"--workdir <path>\", \"Clone target for fleet mode (default ~/.reddoor-maint/sites)\")\n  .action(\n    async (site, opts: { fleet?: string; workdir?: string; cwd?: string; verbose?: boolean }) =>\n      runOrExit(\n        async () => (await import(\"./commands/smoke-suite.js\")).runSmokeSuiteCommand(site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\n    \"onboard [site]\",\n    \"Install @reddoorla/maintenance + audit deps on a site (run after convert-to-pnpm).\",\n  )\n  .option(\"--audits <names>\", \"Comma-separated audit subset: lighthouse,a11y (default: both)\")\n  .option(\n    \"--fleet <inventory>\",\n    'Inventory file (.json or .mjs/.js), or \"airtable\" to read from Websites table',\n  )\n  .option(\"--workdir <path>\", \"Clone target for fleet mode (default ~/.reddoor-maint/sites)\")\n  .action(\n    async (\n      site,\n      opts: {\n        audits?: string;\n        fleet?: string;\n        workdir?: string;\n        cwd?: string;\n        verbose?: boolean;\n      },\n    ) =>\n      runOrExit(\n        async () => (await import(\"./commands/onboard.js\")).runOnboardCommand(site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\n    \"init [site]\",\n    \"One-shot guided onboarding: convert-to-pnpm → onboard → sync-configs → svelte-codemods → a11y-fixtures-page → health-endpoint → smoke-suite → audit.\",\n  )\n  .option(\n    \"--fleet <inventory>\",\n    'Inventory file (.json or .mjs/.js), or \"airtable\" to read from Websites table',\n  )\n  .option(\"--workdir <path>\", \"Clone target for fleet mode (default ~/.reddoor-maint/sites)\")\n  .action(\n    async (site, opts: { fleet?: string; workdir?: string; cwd?: string; verbose?: boolean }) =>\n      runOrExit(async () => (await import(\"./commands/init.js\")).runInitCommand(site, opts), opts),\n  );\n\ncli\n  .command(\n    \"launch <site>\",\n    \"Bootstrap + first-audit a site, then draft its launch email for approval.\",\n  )\n  .action(async (site: string, opts: { cwd?: string; verbose?: boolean }) =>\n    runOrExit(\n      async () => (await import(\"./commands/launch.js\")).runLaunchCommand(site, opts),\n      opts,\n    ),\n  );\n\ncli\n  .command(\n    \"announce [site]\",\n    \"Draft the monthly-report announcement email for maintenance sites (all, or one) for approval.\",\n  )\n  .action(async (site: string | undefined, opts: { cwd?: string; verbose?: boolean }) =>\n    runOrExit(\n      async () => (await import(\"./commands/announce.js\")).runAnnounceCommand(site, opts),\n      opts,\n    ),\n  );\n\ncli\n  .command(\n    \"selftest <kind> [site]\",\n    \"Operator self-tests. kind=email: preview a report email for a site (or --all) to yourself.\",\n  )\n  .option(\"--type <type>\", \"Report type: announcement (default) | maintenance | testing | launch\")\n  .option(\"--to <addr>\", \"Recipient(s), comma-separated. Default: OPERATOR_EMAIL.\")\n  .option(\"--all\", \"Send a preview for every maintenance site (to --to/operator).\")\n  .option(\"--dry-run\", \"Render only; write reports/<slug>/selftest-<type>.html; do not send.\")\n  .action(\n    async (\n      kind: string,\n      site: string | undefined,\n      opts: {\n        type?: string;\n        to?: string;\n        all?: boolean;\n        dryRun?: boolean;\n        cwd?: string;\n        verbose?: boolean;\n      },\n    ) =>\n      runOrExit(\n        async () => (await import(\"./commands/selftest.js\")).runSelftestCommand(kind, site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\n    \"preflight [site]\",\n    \"Read-only pre-send checks: recipients, header image, pending drafts, schedule hygiene.\",\n  )\n  .option(\"--type <type>\", \"Report type: announcement (default) | maintenance | testing\")\n  .option(\n    \"--all\",\n    \"Fleet mode: announcement→maintenance sites; maintenance/testing→all schedulable sites.\",\n  )\n  .action(\n    async (\n      site: string | undefined,\n      opts: { type?: string; all?: boolean; cwd?: string; verbose?: boolean },\n    ) =>\n      runOrExit(\n        async () => (await import(\"./commands/preflight.js\")).runPreflightCommand(site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\"ensure-site <slug>\", \"Create/verify the Airtable Websites row for a new site.\")\n  .option(\"--name <display name>\", \"Human Name for the row (client-facing copy uses it verbatim).\")\n  .option(\"--url <url>\", \"Deployed URL (e.g. the Netlify site URL).\")\n  .option(\"--contact <email>\", \"point of contact — the client address reports resolve to.\")\n  .option(\"--git-repo <owner/repo>\", \"GitHub identity. Default on create: reddoorla/<slug>.\")\n  .action(\n    async (\n      slug: string,\n      opts: {\n        name?: string;\n        url?: string;\n        contact?: string;\n        gitRepo?: string;\n        cwd?: string;\n        verbose?: boolean;\n      },\n    ) =>\n      runOrExit(\n        async () => (await import(\"./commands/ensure-site.js\")).runEnsureSiteCommand(slug, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\"report [site]\", \"Draft or send maintenance/testing reports.\")\n  .option(\"--due\", \"Scan all Websites and draft overdue reports.\")\n  .option(\"--type <type>\", \"Single-site draft report type: Maintenance (default) or Testing.\")\n  .option(\n    \"--preview\",\n    \"Single-site dry run; writes reports/<slug>/draft.html, never touches Airtable.\",\n  )\n  .option(\n    \"--send-ready\",\n    \"Send all Reports with Draft ready=true AND Approved to send=true AND Sent at IS NULL.\",\n  )\n  .option(\n    \"--digest\",\n    \"Email the operator one daily digest of reports ready for approval (skips when empty).\",\n  )\n  .action(\n    async (\n      site,\n      opts: {\n        due?: boolean;\n        type?: string;\n        preview?: boolean;\n        sendReady?: boolean;\n        digest?: boolean;\n        cwd?: string;\n        verbose?: boolean;\n      },\n    ) =>\n      runOrExit(\n        async () => (await import(\"./commands/report.js\")).runReportCommand(site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\n    \"github-signals\",\n    \"Sweep the fleet for GitHub signals (Renovate-failing/CI/last-commit) and write Airtable.\",\n  )\n  .option(\"--fleet\", \"Run across every site in the Airtable inventory.\")\n  .option(\"--write-airtable\", \"Write each site's signals back to its Websites row.\")\n  .action(\n    async (opts: { fleet?: boolean; writeAirtable?: boolean; cwd?: string; verbose?: boolean }) =>\n      runOrExit(\n        async () =>\n          (await import(\"./commands/github-signals.js\")).runGitHubSignalsCommand({\n            fleet: opts.fleet,\n            writeAirtable: opts.writeAirtable,\n          }),\n        opts,\n      ),\n  );\n\ncli\n  .command(\n    \"db <action>\",\n    \"Migrate / backfill / reconcile the libSQL store (migrate | backfill | reconcile).\",\n  )\n  .action(async (action: string, opts: { cwd?: string; verbose?: boolean }) =>\n    runOrExit(async () => (await import(\"./commands/db.js\")).runDbCommand(action, opts), opts),\n  );\n\ncli\n  .command(\n    \"renovate-dispatch\",\n    \"Trigger Renovate on fleet sites the security sweep flagged with critical/high vulns.\",\n  )\n  .option(\"--fleet\", \"Run across every active, repo-backed site in the Airtable inventory.\")\n  .action(async (opts: { fleet?: boolean; cwd?: string; verbose?: boolean }) =>\n    runOrExit(\n      async () =>\n        (await import(\"./commands/renovate-dispatch.js\")).runRenovateDispatchCommand({\n          fleet: opts.fleet,\n        }),\n      opts,\n    ),\n  );\n\ncli\n  .command(\n    \"blux <action> [dir]\",\n    \"Blux conversion pipeline. emit: export dir → migration plan + custom types + theme + review manifest. migrate: emitted plan → live Prismic (needs PRISMIC_REPOSITORY_NAME + PRISMIC_WRITE_TOKEN). validate: content coverage of a rendered site against the export answer key. grid: parse rendered index.html → grid-tree.json (layout tree). convert: parse+classify index.html + assemble IR → migration-plan.json + blux-presentation.json + theme.css (+ map-config.json), offline.\",\n  )\n  .option(\"--out <dir>\", \"Output directory for emit/grid/convert (default: <exportDir>/blux-out)\")\n  .option(\"--converted-base <url>\", \"Converted-site base URL for the review manifest\")\n  .option(\"--blux-base <url>\", \"Original Blux site base URL (default: https://<site.json domain>)\")\n  .option(\n    \"--probe\",\n    \"Reconstruct + HEAD-probe CDN URLs for used assets the HTML scrape missed (network)\",\n  )\n  .option(\n    \"--against <target>\",\n    \"validate: rendered HTML of the converted site — a file path or http(s) URL\",\n  )\n  .action(\n    async (\n      action: string,\n      dir: string | undefined,\n      opts: {\n        out?: string;\n        convertedBase?: string;\n        bluxBase?: string;\n        probe?: boolean;\n        against?: string;\n        cwd?: string;\n        verbose?: boolean;\n      },\n    ) =>\n      runOrExit(\n        async () => (await import(\"./commands/blux.js\")).runBluxCommand(action, dir, opts),\n        opts,\n      ),\n  );\n\ncli.help();\ncli.version(version);\n\n// A typo'd / unrecognized subcommand (e.g. `reddoor-maint auditt`) otherwise\n// falls through cac with no matched command and exits 0 — a cron/CI typo would\n// \"succeed\" silently. cac emits `command:*` at the end of parse() exactly when\n// a positional arg was given but matched no command (a bare `reddoor-maint`,\n// `--help`, and `--version` do NOT trigger it: they have no leading positional\n// or are handled before this fires). Turn that into a clear stderr error +\n// non-zero exit. process.argv[2] is the first positional, i.e. the bad command.\ncli.on(\"command:*\", () => {\n  const unknown = cli.args[0] ?? process.argv[2] ?? \"\";\n  console.error(\n    `error: unknown command '${unknown}'. Run 'reddoor-maint --help' to see available commands.`,\n  );\n  process.exit(1);\n});\n\ncli.parse();\n","import { readFileSync, existsSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\n\n/**\n * Read the @reddoorla/maintenance package version, given the directory of a\n * file that lives inside the package. Walks UP looking for the first\n * `package.json` whose `name` matches. Defensive against bundling-layout\n * changes — the older \"two levels up\" assumption held for `dist/cli/bin.js`\n * but would silently mis-read (or return \"unknown\") if tsup ever moved bin\n * to a different depth. Same walk-up pattern as the self-version helper.\n *\n * Returns \"unknown\" when no matching package.json is reachable (Yarn PnP\n * setups stash manifests inside .zip caches; the readFileSync there fails\n * before any name check).\n */\nexport function resolvePackageVersion(fromDir: string): string {\n  try {\n    let dir = fromDir;\n    while (true) {\n      const candidate = join(dir, \"package.json\");\n      if (existsSync(candidate)) {\n        const raw = readFileSync(candidate, \"utf-8\");\n        const pkg = JSON.parse(raw) as { name?: string; version?: string };\n        if (pkg.name === \"@reddoorla/maintenance\") {\n          return pkg.version ?? \"unknown\";\n        }\n      }\n      const parent = dirname(dir);\n      if (parent === dir) return \"unknown\";\n      dir = parent;\n    }\n  } catch {\n    return \"unknown\";\n  }\n}\n"],"mappings":";;;;;;AACA,SAAS,WAAAA,gBAAe;AACxB,SAAS,qBAAqB;AAC9B,SAAS,WAAW;;;ACHpB,SAAS,cAAc,kBAAkB;AACzC,SAAS,SAAS,YAAY;AAcvB,SAAS,sBAAsB,SAAyB;AAC7D,MAAI;AACF,QAAI,MAAM;AACV,WAAO,MAAM;AACX,YAAM,YAAY,KAAK,KAAK,cAAc;AAC1C,UAAI,WAAW,SAAS,GAAG;AACzB,cAAM,MAAM,aAAa,WAAW,OAAO;AAC3C,cAAM,MAAM,KAAK,MAAM,GAAG;AAC1B,YAAI,IAAI,SAAS,0BAA0B;AACzC,iBAAO,IAAI,WAAW;AAAA,QACxB;AAAA,MACF;AACA,YAAM,SAAS,QAAQ,GAAG;AAC1B,UAAI,WAAW,IAAK,QAAO;AAC3B,YAAM;AAAA,IACR;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ADTA,uBAAuB;AAEvB,IAAM,OAAOC,SAAQ,cAAc,YAAY,GAAG,CAAC;AACnD,IAAM,UAAU,sBAAsB,IAAI;AAE1C,IAAM,qBAAgD;AAAA,EACpD,MAAM;AAAA,EACN,YAAY;AAAA,EACZ,MAAM;AAAA,EACN,UACE;AAAA,EACF,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,SACE;AAAA,EACF,kBACE;AAAA,EACF,mBACE;AAAA,EACF,OAAO;AAAA,EACP,YACE;AACJ;AAEA,IAAM,sBAAkD;AAAA,EACtD,gBAAgB;AAAA,EAChB,aAAa;AAAA,EACb,iBAAiB;AAAA,EACjB,mBACE;AAAA,EACF,mBAAmB;AAAA,EACnB,SAAS;AAAA,EACT,sBACE;AAAA,EACF,mBACE;AAAA,EACF,eAAe;AAAA,EACf,iBACE;AAAA,EACF,MAAM;AACR;AAeA,eAAsB,UACpB,IACA,MACe;AACf,MAAI;AACF,UAAM,EAAE,QAAQ,KAAK,IAAI,MAAM,GAAG;AAClC,YAAQ,IAAI,MAAM;AAClB,YAAQ,WAAW;AACnB;AAAA,EACF,SAAS,KAAK;AACZ,UAAM,IAAI;AACV,YAAQ,MAAM,KAAK,UAAW,EAAE,SAAS,EAAE,UAAY,EAAE,WAAW,OAAO,GAAG,CAAE;AAChF,YAAQ,KAAK,EAAE,YAAY,CAAC;AAAA,EAC9B;AACF;AAEA,IAAM,MAAM,IAAI,eAAe;AAE/B,IAAI,OAAO,gBAAgB,qDAAqD;AAChF,IAAI,OAAO,aAAa,uCAAuC;AAE/D,IAAI,QAAQ,eAAe,6BAA6B,EAAE,OAAO,MAAM;AACrE,aAAW,CAAC,MAAM,IAAI,KAAK,OAAO,QAAQ,kBAAkB,GAAG;AAC7D,YAAQ,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC,IAAI,IAAI,EAAE;AAAA,EAC1C;AACF,CAAC;AAED,IAAI,QAAQ,gBAAgB,8BAA8B,EAAE,OAAO,MAAM;AACvE,aAAW,CAAC,MAAM,IAAI,KAAK,OAAO,QAAQ,mBAAmB,GAAG;AAC9D,YAAQ,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC,IAAI,IAAI,EAAE;AAAA,EAC1C;AACF,CAAC;AAED,IACG,QAAQ,gBAAgB,2CAA2C,EACnE,OAAO,kBAAkB,oDAAoD,EAC7E,OAAO,UAAU,8BAA8B,EAC/C;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,oBAAoB,8DAA8D,EACzF;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,wBAAwB,+DAA+D,EAC9F;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC,OACE,MACA,SAaA;AAAA,IACE,aAAa,MAAM,OAAO,qBAAqB,GAAG,gBAAgB,MAAM,IAAI;AAAA,IAC5E;AAAA,EACF;AACJ;AAEF,IACG,QAAQ,uBAAuB,qCAAqC,EACpE,OAAO,kBAAkB,qDAAqD,EAC9E,OAAO,SAAS,4BAA4B,EAC5C;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,oBAAoB,8DAA8D,EACzF;AAAA,EACC,OACE,MACA,SASA;AAAA,IACE,aAAa,MAAM,OAAO,6BAA4B,GAAG,sBAAsB,MAAM,IAAI;AAAA,IACzF;AAAA,EACF;AACJ;AAEF,IACG,QAAQ,oBAAoB,oBAAoB,EAChD,OAAO,mBAAmB,yBAAyB,EAAE,SAAS,QAAQ,CAAC,EACvE;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,oBAAoB,8DAA8D,EACzF;AAAA,EACC,OACE,MACA,SAQA;AAAA,IACE,aAAa,MAAM,OAAO,0BAAyB,GAAG,mBAAmB,MAAM,IAAI;AAAA,IACnF;AAAA,EACF;AACJ;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,SAAS,2DAA2D,EAC3E,OAAO,uBAAuB,mDAAmD,EACjF,OAAO,oBAAoB,8DAA8D,EACzF;AAAA,EACC,OACE,MACA,SAQA;AAAA,IACE,aACG,MAAM,OAAO,8BAA6B,GAAG,uBAAuB,MAAM,IAAI;AAAA,IACjF;AAAA,EACF;AACJ;AAEF,IACG,QAAQ,4BAA4B,6CAA6C,EACjF,QAAQ,+CAA+C,EACvD;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,oBAAoB,8DAA8D,EACzF;AAAA,EACC,OACE,SACA,MACA,SAEA;AAAA,IACE,aAAa,MAAM,OAAO,wBAAuB,GAAG,kBAAkB,SAAS,MAAM,IAAI;AAAA,IACzF;AAAA,EACF;AACJ;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,oBAAoB,8DAA8D,EACzF;AAAA,EACC,OAAO,MAAM,SACX;AAAA,IACE,aACG,MAAM,OAAO,gCAA+B,GAAG,wBAAwB,MAAM,IAAI;AAAA,IACpF;AAAA,EACF;AACJ;AAEF,IACG,QAAQ,0BAA0B,6DAA6D,EAC/F;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,oBAAoB,8DAA8D,EACzF;AAAA,EACC,OAAO,MAAM,SACX;AAAA,IACE,aACG,MAAM,OAAO,gCAA+B,GAAG,yBAAyB,MAAM,IAAI;AAAA,IACrF;AAAA,EACF;AACJ;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,oBAAoB,8DAA8D,EACzF;AAAA,EACC,OAAO,MAAM,SACX;AAAA,IACE,aACG,MAAM,OAAO,gCAA+B,GAAG,yBAAyB,MAAM,IAAI;AAAA,IACrF;AAAA,EACF;AACJ;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,oBAAoB,8DAA8D,EACzF;AAAA,EACC,OAAO,MAAM,SACX;AAAA,IACE,aAAa,MAAM,OAAO,4BAA2B,GAAG,qBAAqB,MAAM,IAAI;AAAA,IACvF;AAAA,EACF;AACJ;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,oBAAoB,+DAA+D,EAC1F;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,oBAAoB,8DAA8D,EACzF;AAAA,EACC,OACE,MACA,SAQA;AAAA,IACE,aAAa,MAAM,OAAO,wBAAuB,GAAG,kBAAkB,MAAM,IAAI;AAAA,IAChF;AAAA,EACF;AACJ;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,oBAAoB,8DAA8D,EACzF;AAAA,EACC,OAAO,MAAM,SACX,UAAU,aAAa,MAAM,OAAO,qBAAoB,GAAG,eAAe,MAAM,IAAI,GAAG,IAAI;AAC/F;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EAAO,OAAO,MAAc,SAC3B;AAAA,IACE,aAAa,MAAM,OAAO,uBAAsB,GAAG,iBAAiB,MAAM,IAAI;AAAA,IAC9E;AAAA,EACF;AACF;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EAAO,OAAO,MAA0B,SACvC;AAAA,IACE,aAAa,MAAM,OAAO,yBAAwB,GAAG,mBAAmB,MAAM,IAAI;AAAA,IAClF;AAAA,EACF;AACF;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,iBAAiB,sEAAsE,EAC9F,OAAO,eAAe,yDAAyD,EAC/E,OAAO,SAAS,+DAA+D,EAC/E,OAAO,aAAa,sEAAsE,EAC1F;AAAA,EACC,OACE,MACA,MACA,SASA;AAAA,IACE,aAAa,MAAM,OAAO,yBAAwB,GAAG,mBAAmB,MAAM,MAAM,IAAI;AAAA,IACxF;AAAA,EACF;AACJ;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,iBAAiB,6DAA6D,EACrF;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC,OACE,MACA,SAEA;AAAA,IACE,aAAa,MAAM,OAAO,0BAAyB,GAAG,oBAAoB,MAAM,IAAI;AAAA,IACpF;AAAA,EACF;AACJ;AAEF,IACG,QAAQ,sBAAsB,yDAAyD,EACvF,OAAO,yBAAyB,+DAA+D,EAC/F,OAAO,eAAe,2CAA2C,EACjE,OAAO,qBAAqB,gEAA2D,EACvF,OAAO,2BAA2B,uDAAuD,EACzF;AAAA,EACC,OACE,MACA,SASA;AAAA,IACE,aAAa,MAAM,OAAO,4BAA2B,GAAG,qBAAqB,MAAM,IAAI;AAAA,IACvF;AAAA,EACF;AACJ;AAEF,IACG,QAAQ,iBAAiB,4CAA4C,EACrE,OAAO,SAAS,8CAA8C,EAC9D,OAAO,iBAAiB,kEAAkE,EAC1F;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC,OACE,MACA,SAUA;AAAA,IACE,aAAa,MAAM,OAAO,uBAAsB,GAAG,iBAAiB,MAAM,IAAI;AAAA,IAC9E;AAAA,EACF;AACJ;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,WAAW,kDAAkD,EACpE,OAAO,oBAAoB,qDAAqD,EAChF;AAAA,EACC,OAAO,SACL;AAAA,IACE,aACG,MAAM,OAAO,+BAA8B,GAAG,wBAAwB;AAAA,MACrE,OAAO,KAAK;AAAA,MACZ,eAAe,KAAK;AAAA,IACtB,CAAC;AAAA,IACH;AAAA,EACF;AACJ;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EAAO,OAAO,QAAgB,SAC7B,UAAU,aAAa,MAAM,OAAO,mBAAkB,GAAG,aAAa,QAAQ,IAAI,GAAG,IAAI;AAC3F;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,WAAW,sEAAsE,EACxF;AAAA,EAAO,OAAO,SACb;AAAA,IACE,aACG,MAAM,OAAO,kCAAiC,GAAG,2BAA2B;AAAA,MAC3E,OAAO,KAAK;AAAA,IACd,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,eAAe,wEAAwE,EAC9F,OAAO,0BAA0B,iDAAiD,EAClF,OAAO,qBAAqB,mEAAmE,EAC/F;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC,OACE,QACA,KACA,SAUA;AAAA,IACE,aAAa,MAAM,OAAO,qBAAoB,GAAG,eAAe,QAAQ,KAAK,IAAI;AAAA,IACjF;AAAA,EACF;AACJ;AAEF,IAAI,KAAK;AACT,IAAI,QAAQ,OAAO;AASnB,IAAI,GAAG,aAAa,MAAM;AACxB,QAAM,UAAU,IAAI,KAAK,CAAC,KAAK,QAAQ,KAAK,CAAC,KAAK;AAClD,UAAQ;AAAA,IACN,2BAA2B,OAAO;AAAA,EACpC;AACA,UAAQ,KAAK,CAAC;AAChB,CAAC;AAED,IAAI,MAAM;","names":["dirname","dirname"]}

package/dist/cli/commands/audit.d.ts

@@ -1,4 +1,4 @@
-import { S as Site, a as AuditResult, A as AuditName } from '../../types-Dg4mHvyf.js';
+import { S as Site, a as AuditResult, A as AuditName } from '../../types-0jreMCF5.js';
 
 type AuditCommandOptions = {
     only?: string;