@reddoorla/maintenance 0.69.0 → 0.72.0

package/dist/{chunk-RINXPU3H.js → chunk-KLVMJYZZ.js}

@@ -2,7 +2,7 @@ import {
   isPendingApproval,
   listReportsForSite,
   setDraftReady
-} from "./chunk-6JFOAPW4.js";
+} from "./chunk-JCITWZQR.js";
 
 // src/reports/queue.ts
 var REPORT_TIER = {
@@ -35,4 +35,4 @@ export {
   reportTier,
   queueDraft
 };
-//# sourceMappingURL=chunk-RINXPU3H.js.map
+//# sourceMappingURL=chunk-KLVMJYZZ.js.map

package/dist/chunk-KRDLHAKK.js

@@ -0,0 +1,17 @@
+// src/recipes/_prettier.ts
+var PRETTIER_FLAG_NOTE = "could not prettier-format written files (prettier unavailable?) \u2014 verify CI formatting";
+async function formatWithPrettier(spawn, cwd, relPaths) {
+  if (relPaths.length === 0) return true;
+  try {
+    const res = await spawn("pnpm", ["exec", "prettier", "--write", ...relPaths], { cwd });
+    return res.code === 0;
+  } catch {
+    return false;
+  }
+}
+
+export {
+  PRETTIER_FLAG_NOTE,
+  formatWithPrettier
+};
+//# sourceMappingURL=chunk-KRDLHAKK.js.map

package/dist/chunk-KRDLHAKK.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/recipes/_prettier.ts"],"sourcesContent":["import type { SpawnFn } from \"../audits/util/spawn.js\";\n\n/** Flag note recipes surface when best-effort formatting couldn't run, so the\n * operator knows to eyeball CI's format check for that site. */\nexport const PRETTIER_FLAG_NOTE =\n  \"could not prettier-format written files (prettier unavailable?) — verify CI formatting\";\n\n/**\n * Format recipe-written files with the SITE's own prettier\n * (`pnpm exec prettier --write`), so they match that site's config — quote\n * style, tabs vs spaces, and printWidth all vary across the fleet, and a single\n * hardcoded template style reds the CI format check on the sites that differ.\n *\n * Best-effort by contract: returns `false` (never throws) when prettier isn't\n * installed or exits non-zero, so a recipe can commit the file unformatted and\n * flag it rather than fail the whole rollout. Files in the site's\n * `.prettierignore` are skipped by prettier itself. Returns `true` immediately\n * (no spawn) when `relPaths` is empty, so a recipe that wrote nothing this run\n * doesn't shell out.\n *\n * Only pass paths the recipe actually wrote/changed — never operator files it\n * left untouched, which must not be reformatted.\n */\nexport async function formatWithPrettier(\n  spawn: SpawnFn,\n  cwd: string,\n  relPaths: readonly string[],\n): Promise<boolean> {\n  if (relPaths.length === 0) return true;\n  try {\n    const res = await spawn(\"pnpm\", [\"exec\", \"prettier\", \"--write\", ...relPaths], { cwd });\n    return res.code === 0;\n  } catch {\n    return false;\n  }\n}\n"],"mappings":";AAIO,IAAM,qBACX;AAkBF,eAAsB,mBACpB,OACA,KACA,UACkB;AAClB,MAAI,SAAS,WAAW,EAAG,QAAO;AAClC,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,QAAQ,CAAC,QAAQ,YAAY,WAAW,GAAG,QAAQ,GAAG,EAAE,IAAI,CAAC;AACrF,WAAO,IAAI,SAAS;AAAA,EACtB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/{chunk-AESJBEM7.js → chunk-KRHPS3R4.js}

@@ -1,9 +1,9 @@
 import {
   approveBlockers
-} from "./chunk-E2GKKUEX.js";
+} from "./chunk-KLB2OLPW.js";
 import {
   siteSlug
-} from "./chunk-C3PDS623.js";
+} from "./chunk-BWKK2ZXS.js";
 
 // src/alerts/digest-collectors.ts
 function dashboardUrl(baseUrl, siteName) {
@@ -248,4 +248,4 @@ export {
   readDigestState,
   writeDigestState
 };
-//# sourceMappingURL=chunk-AESJBEM7.js.map
+//# sourceMappingURL=chunk-KRHPS3R4.js.map

package/dist/{chunk-LYCKN7ZR.js → chunk-LJPCMXR7.js}

@@ -5,6 +5,8 @@ var a11yRoutes = [
   { path: "/dev/animate-in", name: "animate-in demo" }
 ];
 var smokeRoutes = [{ path: "/", name: "home" }];
+var smokePort = process.env.REDDOOR_SMOKE_PORT;
+var port = smokePort || "5173";
 var playwrightA11yConfig = defineConfig({
   testDir: "tests",
   testMatch: /.*\.spec\.ts$/,
@@ -13,7 +15,7 @@ var playwrightA11yConfig = defineConfig({
   retries: process.env.CI ? 2 : 0,
   reporter: process.env.CI ? "github" : "list",
   use: {
-    baseURL: "http://localhost:5173",
+    baseURL: `http://localhost:${port}`,
     trace: "on-first-retry"
   },
   projects: [
@@ -24,8 +26,10 @@ var playwrightA11yConfig = defineConfig({
   ],
   webServer: {
     // Portable across pnpm and npm sites — pnpm respects `npm run` too.
-    command: "npm run vite:dev",
-    url: "http://localhost:5173/dev/a11y-fixtures",
+    // `--strictPort` only when a port was explicitly allocated: fail loudly
+    // rather than let vite drift to a free port the baseURL doesn't point at.
+    command: smokePort ? `npm run vite:dev -- --port ${smokePort} --strictPort` : "npm run vite:dev",
+    url: `http://localhost:${port}/dev/a11y-fixtures`,
     reuseExistingServer: !process.env.CI,
     timeout: 12e4
   }
@@ -35,7 +39,6 @@ var playwright_a11y_default = playwrightA11yConfig;
 export {
   a11yRoutes,
   smokeRoutes,
-  playwrightA11yConfig,
   playwright_a11y_default
 };
-//# sourceMappingURL=chunk-LYCKN7ZR.js.map
+//# sourceMappingURL=chunk-LJPCMXR7.js.map

package/dist/chunk-LJPCMXR7.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/configs/playwright-a11y.ts"],"sourcesContent":["import { defineConfig, devices, type PlaywrightTestConfig } from \"@playwright/test\";\n\nexport type A11yRoute = { path: string; name: string };\n\nexport const a11yRoutes: A11yRoute[] = [\n  { path: \"/dev/a11y-fixtures\", name: \"a11y fixtures\" },\n  { path: \"/dev/animate-in\", name: \"animate-in demo\" },\n];\n\n// Routes smoke-loaded for client-side (hydration) errors only — NOT axe-scanned.\n// Catches the class of bug where build + SSR succeed but client hydration throws\n// and blanks the page (data-dynamiq 2026-06-09: a Svelte 4->5 `run()` referenced\n// a `$state` declared after it → TDZ ReferenceError on hydrate). `/` is the one\n// route every site has; real routes carry a11y debt we don't gate on here, so we\n// assert only that they don't crash on hydrate.\nexport const smokeRoutes: A11yRoute[] = [{ path: \"/\", name: \"home\" }];\n\n// R1.1 (health-gate): the central `smoke` audit (src/audits/smoke.ts) allocates\n// a free port and passes it as REDDOOR_SMOKE_PORT so a zombie vite already\n// squatting the default 5173 can't silently hijack the run and green a stale\n// build. The per-site R1.1 config template honors it, but sites whose\n// playwright.config.ts merely re-exports this shared base (pre-R1.1 adopters\n// the smoke-suite recipe flags-but-never-rewrites) would otherwise ignore it —\n// so honor it here too and every re-exporter inherits the port binding on its\n// next package bump. Unset (local `pnpm test:smoke`) → the fixed 5173.\nconst smokePort = process.env.REDDOOR_SMOKE_PORT;\nconst port = smokePort || \"5173\";\n\n// NOTE: default export only — sites consume this as `import base from\n// \"@reddoorla/maintenance/configs/playwright-a11y\"` (or re-export the default).\n// The old `playwrightA11yConfig` named alias had zero importers and was removed.\nconst playwrightA11yConfig: PlaywrightTestConfig = defineConfig({\n  testDir: \"tests\",\n  testMatch: /.*\\.spec\\.ts$/,\n  fullyParallel: true,\n  forbidOnly: !!process.env.CI,\n  retries: process.env.CI ? 2 : 0,\n  reporter: process.env.CI ? \"github\" : \"list\",\n  use: {\n    baseURL: `http://localhost:${port}`,\n    trace: \"on-first-retry\",\n  },\n  projects: [\n    {\n      name: \"chromium\",\n      use: { ...devices[\"Desktop Chrome\"] },\n    },\n  ],\n  webServer: {\n    // Portable across pnpm and npm sites — pnpm respects `npm run` too.\n    // `--strictPort` only when a port was explicitly allocated: fail loudly\n    // rather than let vite drift to a free port the baseURL doesn't point at.\n    command: smokePort\n      ? `npm run vite:dev -- --port ${smokePort} --strictPort`\n      : \"npm run vite:dev\",\n    url: `http://localhost:${port}/dev/a11y-fixtures`,\n    reuseExistingServer: !process.env.CI,\n    timeout: 120_000,\n  },\n});\n\nexport default playwrightA11yConfig;\n"],"mappings":";AAAA,SAAS,cAAc,eAA0C;AAI1D,IAAM,aAA0B;AAAA,EACrC,EAAE,MAAM,sBAAsB,MAAM,gBAAgB;AAAA,EACpD,EAAE,MAAM,mBAAmB,MAAM,kBAAkB;AACrD;AAQO,IAAM,cAA2B,CAAC,EAAE,MAAM,KAAK,MAAM,OAAO,CAAC;AAUpE,IAAM,YAAY,QAAQ,IAAI;AAC9B,IAAM,OAAO,aAAa;AAK1B,IAAM,uBAA6C,aAAa;AAAA,EAC9D,SAAS;AAAA,EACT,WAAW;AAAA,EACX,eAAe;AAAA,EACf,YAAY,CAAC,CAAC,QAAQ,IAAI;AAAA,EAC1B,SAAS,QAAQ,IAAI,KAAK,IAAI;AAAA,EAC9B,UAAU,QAAQ,IAAI,KAAK,WAAW;AAAA,EACtC,KAAK;AAAA,IACH,SAAS,oBAAoB,IAAI;AAAA,IACjC,OAAO;AAAA,EACT;AAAA,EACA,UAAU;AAAA,IACR;AAAA,MACE,MAAM;AAAA,MACN,KAAK,EAAE,GAAG,QAAQ,gBAAgB,EAAE;AAAA,IACtC;AAAA,EACF;AAAA,EACA,WAAW;AAAA;AAAA;AAAA;AAAA,IAIT,SAAS,YACL,8BAA8B,SAAS,kBACvC;AAAA,IACJ,KAAK,oBAAoB,IAAI;AAAA,IAC7B,qBAAqB,CAAC,QAAQ,IAAI;AAAA,IAClC,SAAS;AAAA,EACX;AACF,CAAC;AAED,IAAO,0BAAQ;","names":[]}

package/dist/{chunk-O6G4HHMF.js → chunk-NRISG4XD.js}

@@ -1,21 +1,22 @@
 import {
   queueDraft
-} from "./chunk-RINXPU3H.js";
+} from "./chunk-KLVMJYZZ.js";
 import {
   checklistFor,
   createDraft,
+  gatingFields,
   listReportsForSite,
   renderReportHtml,
   resolveCopy,
   uploadAttachment
-} from "./chunk-6JFOAPW4.js";
+} from "./chunk-JCITWZQR.js";
 import {
   isNetlifyAppUrl
 } from "./chunk-U5SZ4FOP.js";
 import {
   siteSlug,
   updateAnalyticsHealth
-} from "./chunk-C3PDS623.js";
+} from "./chunk-BWKK2ZXS.js";
 import {
   defaultCredentialsPath
 } from "./chunk-6VAL7XJT.js";
@@ -23,10 +24,10 @@ import {
 // src/reports/ga/config.ts
 import { dirname, join } from "path";
 function readGaConfig() {
-  const subject = process.env.GA_SUBJECT?.trim();
-  if (!subject) return null;
+  const subjects = (process.env.GA_SUBJECT ?? "").split(",").map((s) => s.trim()).filter(Boolean);
+  if (subjects.length === 0) return null;
   const keyPath = process.env.GA_SA_KEY_PATH?.trim() || join(dirname(defaultCredentialsPath()), "ga-service-account.json");
-  return { subject, keyPath };
+  return { subjects, keyPath };
 }
 
 // src/reports/draft.ts
@@ -45,44 +46,65 @@ function isFresh(checkedAt, now) {
 var CERT_MIN_DAYS = 14;
 function autoTickChecklist(site, reportType, now, signals) {
   const out = /* @__PURE__ */ new Map();
-  const fields = new Set(checklistFor(reportType).map((i) => i.field));
-  if (fields.has("Maint: Google Indexed")) {
-    const g = googleEvidence(now, signals.search);
-    if (g) out.set("Maint: Google Indexed", g);
-  }
-  if (fields.has("Maint: Security Updates")) {
-    const s = securityEvidence(site, now);
-    if (s) out.set("Maint: Security Updates", s);
-  }
-  if (fields.has("Maint: Domain, DNS & SSL")) {
-    const d = domainEvidence(site, now);
-    if (d) out.set("Maint: Domain, DNS & SSL", d);
-  }
-  if (fields.has("Test: Desktop Browsers")) {
-    const e = browserEvidence(
-      site.crossbrowserOk,
-      site,
-      now,
-      "Desktop renders cleanly",
-      "render errors"
-    );
-    if (e) out.set("Test: Desktop Browsers", e);
-  }
-  if (fields.has("Test: Mobile Browsers")) {
-    const e = browserEvidence(
-      site.mobileOk,
-      site,
-      now,
-      "Mobile renders cleanly",
-      "overflow/errors"
-    );
-    if (e) out.set("Test: Mobile Browsers", e);
-  }
-  if (fields.has("Test: Links & Navigation")) {
-    const broken = site.brokenLinks;
-    const failNote = broken && broken > 0 ? `${broken} broken link(s)` : "broken links / nav";
-    const e = browserEvidence(site.linksOk, site, now, "All internal links resolve", failNote);
-    if (e) out.set("Test: Links & Navigation", e);
+  const gating = new Set(gatingFields(reportType));
+  for (const item of checklistFor(reportType)) {
+    let ev;
+    switch (item.field) {
+      case "Maint: Google Indexed":
+        ev = googleEvidence(now, signals.search);
+        break;
+      case "Maint: Deploy & Function Health":
+        ev = deployEvidence(site, now);
+        break;
+      case "Maint: CMS Checked":
+        ev = cmsEvidence(site, now);
+        break;
+      case "Maint: Domain, DNS & SSL":
+        ev = domainEvidence(site, now);
+        break;
+      case "Maint: Security Updates":
+        ev = securityEvidence(site, now);
+        break;
+      case "Maint: Uptime Checked":
+        ev = uptimeEvidence(site, now);
+        break;
+      case "Test: Desktop Browsers":
+        ev = browserEvidence(
+          site.crossbrowserOk,
+          site,
+          now,
+          "Desktop renders cleanly",
+          "render errors"
+        );
+        break;
+      case "Test: Mobile Browsers":
+        ev = browserEvidence(site.mobileOk, site, now, "Mobile renders cleanly", "overflow/errors");
+        break;
+      case "Test: Page Titles & Meta":
+        ev = titlesEvidence(site, now);
+        break;
+      case "Test: Links & Navigation": {
+        const broken = site.brokenLinks;
+        const failNote = broken && broken > 0 ? `${broken} broken link(s)` : "broken links / nav";
+        ev = browserEvidence(site.linksOk, site, now, "All internal links resolve", failNote);
+        break;
+      }
+      case "Test: Form Functionality":
+        ev = formsEvidence(site, now);
+        break;
+      case "Test: Interactions & Animations":
+        ev = interactionsEvidence(site, now);
+        break;
+      case "Test: Verified After Updates":
+        ev = updatesEvidence(site, now);
+        break;
+      default:
+        ev = null;
+    }
+    if (ev === null && gating.has(item.field)) {
+      ev = { result: "unknown", checkedAt: null, note: "Not yet measured" };
+    }
+    if (ev !== null) out.set(item.field, ev);
   }
   return out;
 }
@@ -144,11 +166,175 @@ function domainEvidence(site, now) {
   }
   return { result: "pass", checkedAt: at, note: `Custom domain, valid cert (${days}d left)` };
 }
+function deployEvidence(site, now) {
+  if (!site.deployCheckedAt && !site.functionHealthCheckedAt) return null;
+  if (!isFresh(site.deployCheckedAt, now) || !isFresh(site.functionHealthCheckedAt, now)) {
+    return {
+      result: "unknown",
+      checkedAt: site.functionHealthCheckedAt ?? site.deployCheckedAt,
+      note: "Deploy/function-health check is stale (>3d)"
+    };
+  }
+  const ready = site.deployStatus === "ready";
+  const fnOk = site.functionHealth === "pass";
+  if (ready && fnOk) {
+    return {
+      result: "pass",
+      checkedAt: site.functionHealthCheckedAt,
+      note: "Netlify build ready + functions respond"
+    };
+  }
+  const why = !ready && !fnOk ? "build not ready + functions unhealthy" : !ready ? "build not ready" : "functions unhealthy";
+  return {
+    result: "fail",
+    checkedAt: site.functionHealthCheckedAt,
+    note: `Deploy/function-health failing \u2014 ${why}`
+  };
+}
+function cmsEvidence(site, now) {
+  if (!site.functionHealthCheckedAt) return null;
+  const at = site.functionHealthCheckedAt;
+  if (!isFresh(at, now)) {
+    return { result: "unknown", checkedAt: at, note: "CMS check is stale (>3d)" };
+  }
+  if (site.cmsReachable === "pass") {
+    return { result: "pass", checkedAt: at, note: "Prismic reachable (server-side)" };
+  }
+  if (site.cmsReachable === "fail") {
+    return { result: "fail", checkedAt: at, note: "Prismic unreachable (server-side)" };
+  }
+  return { result: "unknown", checkedAt: at, note: "CMS reachability not reported" };
+}
+function uptimeEvidence(site, now) {
+  if (site.reachableOk === null || !site.browserCheckedAt) return null;
+  const at = site.browserCheckedAt;
+  if (!isFresh(at, now)) {
+    return { result: "unknown", checkedAt: at, note: "Uptime check is stale (>3d)" };
+  }
+  return site.reachableOk === "pass" ? { result: "pass", checkedAt: at, note: "All sampled routes reachable (point-in-time)" } : { result: "fail", checkedAt: at, note: "One or more sampled routes did not respond 2xx/3xx" };
+}
+function titlesEvidence(site, now) {
+  if (site.titleMetaOk === null || !site.browserCheckedAt) return null;
+  const at = site.browserCheckedAt;
+  if (!isFresh(at, now)) {
+    return { result: "unknown", checkedAt: at, note: "Titles/meta check is stale (>3d)" };
+  }
+  return site.titleMetaOk === "pass" ? { result: "pass", checkedAt: at, note: "Titles + meta present" } : {
+    result: "fail",
+    checkedAt: at,
+    note: "Missing/duplicate title or missing meta description"
+  };
+}
+function formsEvidence(site, now) {
+  if (!site.formE2eCheckedAt) return null;
+  const at = site.formE2eCheckedAt;
+  if (!isFresh(at, now)) {
+    return { result: "unknown", checkedAt: at, note: "Form E2E check is stale (>3d)" };
+  }
+  if (site.formE2eOk === "pass") {
+    return { result: "pass", checkedAt: at, note: "Synthetic submission succeeded" };
+  }
+  if (site.formE2eOk === "fail") {
+    return { result: "fail", checkedAt: at, note: "Synthetic submission failed" };
+  }
+  return { result: "n/a", checkedAt: at, note: "No contact form on this site" };
+}
+function interactionsEvidence(site, now) {
+  if (site.smokeOk === null || !site.lastSmokeAt) return null;
+  const at = site.lastSmokeAt;
+  if (!isFresh(at, now)) {
+    return { result: "unknown", checkedAt: at, note: "Smoke suite is stale (>3d)" };
+  }
+  return site.smokeOk === "pass" ? { result: "pass", checkedAt: at, note: "Smoke suite green" } : { result: "fail", checkedAt: at, note: "Smoke suite red" };
+}
+function updatesEvidence(site, now) {
+  if (site.defaultBranchCi === null || !site.githubSignalsAt) return null;
+  const at = site.githubSignalsAt;
+  if (site.defaultBranchCi === "none") {
+    return { result: "n/a", checkedAt: at, note: "Repository has no CI" };
+  }
+  if (!isFresh(at, now)) {
+    return { result: "unknown", checkedAt: at, note: "CI signal is stale (>3d)" };
+  }
+  if (site.defaultBranchCi === "passing") {
+    return { result: "pass", checkedAt: at, note: "Default-branch CI green on latest commit" };
+  }
+  if (site.defaultBranchCi === "failing") {
+    return { result: "fail", checkedAt: at, note: "Default-branch CI is failing" };
+  }
+  return { result: "unknown", checkedAt: at, note: "Default-branch CI is pending" };
+}
 
 // src/reports/ga/client.ts
 import { readFileSync } from "fs";
 import { JWT } from "google-auth-library";
 import { BetaAnalyticsDataClient } from "@google-analytics/data";
+
+// src/reports/ga/failover.ts
+var AUTH_HTTP_STATUS = /* @__PURE__ */ new Set([401, 403]);
+var AUTH_GRPC_CODES = /* @__PURE__ */ new Set([7, 16]);
+var AUTH_MESSAGE = /permission[_ ]denied|unauthenticated|unauthorized|invalid_grant|access[_ ]denied|forbidden|insufficient permission|status code 40[13]/i;
+var QUOTA_REASONS = /* @__PURE__ */ new Set([
+  "userratelimitexceeded",
+  "ratelimitexceeded",
+  "quotaexceeded",
+  "dailylimitexceeded"
+]);
+var QUOTA_MESSAGE = /quota exceeded|rate limit exceeded|user rate limit/i;
+function isAuthShapedError(e) {
+  const err = e;
+  if (err?.failoverToNextSubject === true) return true;
+  if ([err?.status, err?.response?.status].some((s) => AUTH_HTTP_STATUS.has(Number(s))))
+    return true;
+  if (AUTH_HTTP_STATUS.has(Number(err?.code)) || AUTH_GRPC_CODES.has(Number(err?.code)))
+    return true;
+  const msg = e instanceof Error ? e.message : String(e);
+  return AUTH_MESSAGE.test(msg);
+}
+function isFailoverSentinel(e) {
+  return e?.failoverToNextSubject === true;
+}
+function isQuotaShapedError(e) {
+  const err = e;
+  if (err?.failoverToNextSubject === true) return false;
+  const reasons = err?.response?.data?.error?.errors;
+  if (Array.isArray(reasons) && reasons.length > 0) {
+    return reasons.some((r) => r?.reason != null && QUOTA_REASONS.has(r.reason.toLowerCase()));
+  }
+  const msg = e instanceof Error ? e.message : String(e);
+  return QUOTA_MESSAGE.test(msg);
+}
+async function withSubjectFailover(subjects, label, attempt) {
+  if (subjects.length === 0) throw new Error(`${label}: no impersonation subjects configured`);
+  const failed = [];
+  let lastRealError;
+  let lastSentinel;
+  let allQuota = true;
+  for (const subject of subjects) {
+    try {
+      const result = await attempt(subject);
+      if (failed.length > 0) {
+        console.warn(
+          allQuota ? `\u26A0 ${label} subject failover: ${failed.join("; ")} \u2014 succeeded via ${subject} (transient quota/rate-limit, not an access loss).` : `\u26A0 ${label} subject failover: ${failed.join("; ")} \u2014 succeeded via ${subject}. Restore the failing subject's access or drop it from GA_SUBJECT (docs/runbooks/ga-search-role-account-cutover.md).`
+        );
+      }
+      return result;
+    } catch (e) {
+      if (!isAuthShapedError(e)) throw e;
+      failed.push(`${subject} (${e instanceof Error ? e.message : String(e)})`);
+      if (isFailoverSentinel(e)) {
+        lastSentinel = e;
+        allQuota = false;
+      } else {
+        lastRealError = e;
+        if (!isQuotaShapedError(e)) allQuota = false;
+      }
+    }
+  }
+  throw lastRealError ?? lastSentinel;
+}
+
+// src/reports/ga/client.ts
 var ANALYTICS_READONLY = "https://www.googleapis.com/auth/analytics.readonly";
 var MS_PER_DAY2 = 864e5;
 function ymd(d) {
@@ -156,30 +342,32 @@ function ymd(d) {
 }
 async function fetchPeriodUsers(query, periodStart, periodEnd) {
   const key = JSON.parse(readFileSync(query.keyPath, "utf8"));
-  const authClient = new JWT({
-    email: key.client_email,
-    key: key.private_key,
-    scopes: [ANALYTICS_READONLY],
-    subject: query.subject
-  });
-  const client = new BetaAnalyticsDataClient({ authClient });
   const lengthDays = Math.round((periodEnd.getTime() - periodStart.getTime()) / MS_PER_DAY2);
   const prevEnd = new Date(periodStart.getTime() - MS_PER_DAY2);
   const prevStart = new Date(prevEnd.getTime() - lengthDays * MS_PER_DAY2);
   const property = `properties/${query.propertyId}`;
-  const run = async (start, end) => {
-    const [resp] = await client.runReport({
-      property,
-      dateRanges: [{ startDate: ymd(start), endDate: ymd(end) }],
-      metrics: [{ name: "activeUsers" }]
+  return withSubjectFailover(query.subjects, "GA", async (subject) => {
+    const authClient = new JWT({
+      email: key.client_email,
+      key: key.private_key,
+      scopes: [ANALYTICS_READONLY],
+      subject
     });
-    const raw = resp.rows?.[0]?.metricValues?.[0]?.value ?? "0";
-    const n = Number.parseInt(raw, 10);
-    return Number.isFinite(n) ? n : 0;
-  };
-  const current = await run(periodStart, periodEnd);
-  const previous = await run(prevStart, prevEnd);
-  return { current, previous };
+    const client = new BetaAnalyticsDataClient({ authClient });
+    const run = async (start, end) => {
+      const [resp] = await client.runReport({
+        property,
+        dateRanges: [{ startDate: ymd(start), endDate: ymd(end) }],
+        metrics: [{ name: "activeUsers" }]
+      });
+      const raw = resp.rows?.[0]?.metricValues?.[0]?.value ?? "0";
+      const n = Number.parseInt(raw, 10);
+      return Number.isFinite(n) ? n : 0;
+    };
+    const current = await run(periodStart, periodEnd);
+    const previous = await run(prevStart, prevEnd);
+    return { current, previous };
+  });
 }
 
 // src/reports/search/client.ts
@@ -221,50 +409,66 @@ function selectBrandPosition(rows, exactQuery) {
   if (exact) return exact.position;
   return pickBrandQuery(rows);
 }
+var NoPropertyForSubjectError = class extends Error {
+  failoverToNextSubject = true;
+  constructor(subject, host) {
+    super(`no Search Console property matching ${host} is visible to ${subject}`);
+  }
+};
 async function fetchSearchPresence(q, periodStart, periodEnd) {
   const key = JSON.parse(readFileSync2(q.keyPath, "utf8"));
-  const jwt = new JWT2({
-    email: key.client_email,
-    key: key.private_key,
-    scopes: [WEBMASTERS_READONLY],
-    subject: q.subject
-  });
-  const explicit = q.property?.trim();
-  let candidates;
-  if (explicit) {
-    candidates = [explicit];
-  } else {
-    const list = await jwt.request({
-      url: `${SC_BASE}/sites`,
-      method: "GET"
-    });
-    candidates = resolvePropertyCandidates(list.data.siteEntry ?? [], q.host);
-    if (candidates.length === 0) return { foundOnPage1: false, position: null };
-  }
-  for (const property of candidates) {
-    const res = await jwt.request({
-      url: `${SC_BASE}/sites/${encodeURIComponent(property)}/searchAnalytics/query`,
-      method: "POST",
-      data: {
-        startDate: ymd2(periodStart),
-        endDate: ymd2(periodEnd),
-        dimensions: ["query"],
-        dimensionFilterGroups: [
-          {
-            filters: [
-              { dimension: "query", operator: "contains", expression: q.query.toLowerCase() }
-            ]
+  try {
+    return await withSubjectFailover(q.subjects, "Search Console", async (subject) => {
+      const jwt = new JWT2({
+        email: key.client_email,
+        key: key.private_key,
+        scopes: [WEBMASTERS_READONLY],
+        subject
+      });
+      const explicit = q.property?.trim();
+      let candidates;
+      if (explicit) {
+        candidates = [explicit];
+      } else {
+        const list = await jwt.request({
+          url: `${SC_BASE}/sites`,
+          method: "GET"
+        });
+        candidates = resolvePropertyCandidates(list.data.siteEntry ?? [], q.host);
+        if (candidates.length === 0) throw new NoPropertyForSubjectError(subject, q.host);
+      }
+      for (const property of candidates) {
+        const res = await jwt.request({
+          url: `${SC_BASE}/sites/${encodeURIComponent(property)}/searchAnalytics/query`,
+          method: "POST",
+          data: {
+            startDate: ymd2(periodStart),
+            endDate: ymd2(periodEnd),
+            dimensions: ["query"],
+            dimensionFilterGroups: [
+              {
+                filters: [
+                  { dimension: "query", operator: "contains", expression: q.query.toLowerCase() }
+                ]
+              }
+            ],
+            rowLimit: BRAND_QUERY_ROW_LIMIT
           }
-        ],
-        rowLimit: BRAND_QUERY_ROW_LIMIT
+        });
+        const pos = selectBrandPosition(res.data.rows ?? [], q.query.toLowerCase());
+        if (typeof pos === "number") {
+          return {
+            foundOnPage1: pos <= PAGE_1_MAX_POSITION,
+            position: Math.max(1, Math.round(pos))
+          };
+        }
       }
+      return { foundOnPage1: false, position: null };
     });
-    const pos = selectBrandPosition(res.data.rows ?? [], q.query.toLowerCase());
-    if (typeof pos === "number") {
-      return { foundOnPage1: pos <= PAGE_1_MAX_POSITION, position: Math.max(1, Math.round(pos)) };
-    }
+  } catch (e) {
+    if (e instanceof NoPropertyForSubjectError) return { foundOnPage1: false, position: null };
+    throw e;
   }
-  return { foundOnPage1: false, position: null };
 }
 
 // src/reports/draft.ts
@@ -392,7 +596,7 @@ async function fetchGaUsers(siteRow, periodStart, periodEnd) {
   if (!cfg || !siteRow.ga4PropertyId) return NO_ENRICHMENT;
   try {
     const value = await fetchPeriodUsers(
-      { propertyId: siteRow.ga4PropertyId, subject: cfg.subject, keyPath: cfg.keyPath },
+      { propertyId: siteRow.ga4PropertyId, subjects: cfg.subjects, keyPath: cfg.keyPath },
       periodStart,
       periodEnd
     );
@@ -409,7 +613,7 @@ async function fetchSearch(siteRow, periodStart, periodEnd) {
     const value = await fetchSearchPresence(
       {
         keyPath: cfg.keyPath,
-        subject: cfg.subject,
+        subjects: cfg.subjects,
         property: siteRow.searchConsoleProperty ?? void 0,
         host: siteRow.url,
         query: siteRow.searchQuery
@@ -439,4 +643,4 @@ export {
   fetchGaUsers,
   fetchSearch
 };
-//# sourceMappingURL=chunk-O6G4HHMF.js.map
+//# sourceMappingURL=chunk-NRISG4XD.js.map