npm - @reddoorla/maintenance - Versions diffs - 0.75.1 → 0.78.0 - Mend

@reddoorla/maintenance 0.75.1 → 0.78.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (157) hide show

package/dist/chunk-6SZBNALD.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"sources":["../src/reports/ga/config.ts","../src/reports/draft.ts","../src/reports/auto-tick.ts","../src/reports/ga/client.ts","../src/reports/ga/failover.ts","../src/reports/search/client.ts"],"sourcesContent":["import { dirname, join } from \"node:path\";\nimport { defaultCredentialsPath } from \"../../util/credentials.js\";\n\nexport type GaConfig = {\n /** Workspace users the service account impersonates (domain-wide delegation), in\n * failover order — the first subject that authenticates wins. */\n subjects: string[];\n /** Absolute path to the service-account JSON key file. */\n keyPath: string;\n};\n\n/**\n * Read GA configuration from the environment (credentials.env is already loaded into\n * process.env by the CLI entrypoint). Returns null when `GA_SUBJECT` is unset/blank — the\n * signal that GA enrichment is simply not configured, so drafting skips it silently.\n *\n * `GA_SUBJECT` is a comma-separated list of impersonation subjects tried in order\n * (e.g. `reports@reddoorla.com,person@reddoorla.com`), so losing one Workspace account\n * degrades to a logged failover instead of blanking the whole fleet's analytics; a single\n * address remains the degenerate one-element case. Entries are trimmed, empties dropped.\n *\n * `GA_SA_KEY_PATH` is optional; it defaults to `ga-service-account.json` alongside the\n * credentials file (e.g. ~/.config/reddoor-maint/), keeping the key out of the repo.\n */\nexport function readGaConfig(): GaConfig | null {\n const subjects = (process.env.GA_SUBJECT ?? \"\")\n .split(\",\")\n .map((s) => s.trim())\n .filter(Boolean);\n if (subjects.length === 0) return null;\n const keyPath =\n process.env.GA_SA_KEY_PATH?.trim() ||\n join(dirname(defaultCredentialsPath()), \"ga-service-account.json\");\n return { subjects, keyPath };\n}\n","import { mkdir, writeFile } from \"node:fs/promises\";\nimport { dirname } from \"node:path\";\nimport type { ReportType, LighthouseScores } from \"./types.js\";\nimport { renderReportHtml } from \"./render.js\";\nimport { siteSlug, updateAnalyticsHealth } from \"./airtable/websites.js\";\nimport { resolveCopy } from \"./copy.js\";\nimport type { WebsiteRow } from \"./airtable/websites.js\";\nimport type { ReportRow } from \"./airtable/reports.js\";\nimport { createDraft, listReportsForSite } from \"./airtable/reports.js\";\nimport { queueDraft } from \"./queue.js\";\nimport { autoTickChecklist } from \"./auto-tick.js\";\nimport { uploadAttachment } from \"./airtable/attachments.js\";\nimport type { AirtableBase } from \"./airtable/client.js\";\nimport { readGaConfig } from \"./ga/config.js\";\nimport { fetchPeriodUsers } from \"./ga/client.js\";\nimport { fetchSearchPresence } from \"./search/client.js\";\nimport type { SearchPresence } from \"./search/client.js\";\nimport { generateHeaderImage } from \"./header-image/index.js\";\nimport type { GeneratedHeaderImage } from \"./header-image/index.js\";\n\nexport type RefreshHeaderDeps = {\n generate?: (input: { url: string; slug?: string }) => Promise<GeneratedHeaderImage>;\n upload?: (\n recordId: string,\n field: string,\n bytes: Uint8Array,\n filename: string,\n contentType: string,\n ) => Promise<void>;\n};\n\n/**\n * Regenerate a site's Header image from its live homepage so the report ships a\n * current screenshot rather than one frozen whenever the image was last made by\n * hand. Sonder alone runs 16 reports a year, so a static header goes visibly\n * stale.\n *\n * BEST-EFFORT BY DESIGN — returns false and never throws. A capture or upload\n * failure must not fail the draft: the stored image is still perfectly usable,\n * and the operator reviews the rendered preview before approving the send.\n */\nexport async function refreshHeaderImage(\n site: WebsiteRow,\n deps: RefreshHeaderDeps = {},\n): Promise<boolean> {\n if (!site.url) return false;\n const generate = deps.generate ?? generateHeaderImage;\n const upload = deps.upload ?? uploadAttachment;\n try {\n const gen = await generate({ url: site.url, slug: siteSlug(site.name) });\n await upload(site.id, \"Header image\", gen.bytes, gen.filename, gen.contentType);\n return true;\n } catch (err) {\n console.warn(\n `⚠ header-image refresh skipped for ${site.name}: ${\n err instanceof Error ? err.message : String(err)\n } — keeping the stored image`,\n );\n return false;\n }\n}\n\nexport type DraftOptions = {\n /** Where to write the local preview HTML when `previewOnly`. Defaults to `reports/<slug>/draft.html`. */\n previewPath?: string;\n /** If true: render locally only, never touch Airtable. */\n previewOnly?: boolean;\n /** UTC \"YYYY-MM\" recurrence key; falls back to periodEnd's month when omitted. */\n period?: string;\n /** Airtable record id of an EXISTING (not-ready) row to COMPLETE in place rather\n * than creating a new one. When set, we skip createDraft and only re-render →\n * upload the HTML attachment → flip Draft ready on this row. Used by the --due\n * re-draft path to finish a draft whose createDraft succeeded but whose\n * setDraftReady never ran (a crash mid-sequence wedged the period). */\n completeRowId?: string;\n /** The mapped ReportRow being completed, returned as `reportRow` from the\n * complete path so callers keep the same shape they get on the create path. */\n existingRow?: ReportRow;\n /** Injected deps for the draft-time header refresh, or `false` to skip it\n * entirely. Tests set `false` (or a stub) so a unit suite never launches a\n * browser or resolves DNS. Production leaves it unset and gets the real thing. */\n refreshHeader?: RefreshHeaderDeps | false;\n};\n\n/** An enrichment fetch that *errored* (not one that was legitimately skipped\n * because it isn't configured / the site lacks the inputs). Surfaced so a\n * fleet-wide GA/Search outage is visible in a `--due` batch summary instead of\n * hiding behind one easily-missed console.warn per site. */\nexport type SoftFailure = \"ga\" | \"search\";\n\nexport type DraftResult = {\n /** null when previewOnly. */\n reportRow: ReportRow | null;\n /** Path to the local preview file (only set when previewOnly). */\n htmlPath: string | null;\n /** Always present — the rendered HTML string. */\n html: string;\n /** Enrichment fetches that errored for this site (empty on success or skip). */\n softFailures: SoftFailure[];\n /** True when search enrichment fell back to the site name (no explicit `Search query`)\n * AND that default matched nothing in Search Console — the signal that this site needs\n * a hand-tuned brand query. Distinct from a soft-failure/outage: the fetch succeeded, it\n * just found no data for the name. Requires a property to have RESOLVED — a site with no\n * Search Console property at all raises `searchPropertyMissing` instead (a query change\n * can't fix that, and prescribing one would silence the real problem). */\n searchDefaultMissed: boolean;\n /** True when NO Search Console property matched the site for any subject — a\n * missing/unverified property or lost service-account access. Fires for BOTH explicit\n * and name-default queries (unlike `searchDefaultMissed`), because no query can succeed\n * without a property. Distinct from a soft-failure: the API worked, the property list\n * just contained nothing for this site. */\n searchPropertyMissing: boolean;\n /** Whether the draft was placed in the approve queue. False when a higher-or-equal-tier\n * report is already queued for the site (single-queue rule); null on the previewOnly path. */\n queued: boolean | null;\n /** Ids of lower-tier queued reports this draft superseded (un-queued). */\n supersededIds: string[];\n};\n\nfunction scoresFromWebsite(siteRow: WebsiteRow): LighthouseScores {\n const { pScore, rScore, bpScore, seoScore } = siteRow;\n if (pScore === null || rScore === null || bpScore === null || seoScore === null) {\n throw new Error(\n `Site '${siteRow.name}' is missing one or more Lighthouse scores on the Websites row (pScore, rScore, bpScore, seoScore). ` +\n `Run 'reddoor-maint audit lighthouse' from the site's checkout and paste the four numbers into Airtable, then retry.`,\n );\n }\n return { performance: pScore, accessibility: rScore, bestPractices: bpScore, seo: seoScore };\n}\n\nfunction daysAgo(today: Date, n: number): Date {\n // UTC accessors to stay TZ-consistent with `due.ts` (and avoid landing\n // Airtable's `Period start` on a different calendar day than the operator\n // expects on late-night runs near a month boundary). See morning brief\n // 2026-05-29 (M1) for context.\n const out = new Date(today);\n out.setUTCDate(out.getUTCDate() - n);\n return out;\n}\n\n/**\n * Render and create an Airtable draft for one site.\n *\n * No idempotency guard here — the recurrence guard lives in draftDueReports\n * (cli/commands/report.ts), keyed on reportPeriodKey(dueDate). The manual\n * single-site path intentionally always drafts (an operator asking for a draft\n * gets one). findReportByPeriod (airtable/reports.ts) is the real-Airtable\n * point lookup available to dashboard/digest callers that need the same\n * idempotency guarantee outside the CLI batch loop.\n */\nexport async function draftReportForSite(\n base: AirtableBase | null,\n siteRow: WebsiteRow,\n reportType: ReportType,\n options: DraftOptions = {},\n): Promise<DraftResult> {\n const scores = scoresFromWebsite(siteRow);\n\n const today = new Date();\n const slug = siteSlug(siteRow.name);\n\n const periodStart =\n base !== null ? await derivePeriodStart(base, siteRow, reportType, today) : daysAgo(today, 30);\n\n const periodEnd = today;\n const completedOn = today;\n // \"Last Tested\" on the Maintenance email is the REAL timestamp of the most recent automated\n // Lighthouse audit — stamped live on the Websites row (`Last lighthouse audit at`) by\n // `audit lighthouse --write-airtable` every time the scores refresh. It is deliberately NOT\n // the `testing day` field: that's the recurrence anchor consumed by due.ts and is hand-set, so\n // it goes stale. Reading the audit timestamp keeps the date current with no manual upkeep.\n const lastTestedDate =\n reportType === \"Maintenance\" && siteRow.lastLighthouseAuditAt\n ? new Date(siteRow.lastLighthouseAuditAt)\n : null;\n\n // GA enrichment (real path only). Soft-fail: any GA problem leaves the numbers null so\n // the draft still proceeds (operator fills them manually) — GA is an enhancement, not a\n // gate. Rendered with the fetched numbers so the review HTML matches the Airtable fields.\n // An *error* (vs a legitimate not-configured skip) is recorded in softFailures so the\n // caller can surface a fleet-wide outage in the batch summary.\n const gaResult =\n base !== null ? await fetchGaUsers(siteRow, periodStart, periodEnd) : NO_ENRICHMENT;\n const searchResult =\n base !== null\n ? await fetchSearch(siteRow, periodStart, periodEnd)\n : // No-IO render path: nothing was attempted, so this is not an environment gap\n // (`notConfigured` would wrongly tell the operator to go wire a secret).\n {\n ...NO_ENRICHMENT,\n defaultQueryMissed: false,\n propertyMissing: false,\n notConfigured: false,\n };\n const gaUsers = gaResult.value;\n const search = searchResult.value;\n const softFailures: SoftFailure[] = [\n ...(gaResult.softFailed ? ([\"ga\"] as const) : []),\n ...(searchResult.softFailed ? ([\"search\"] as const) : []),\n ];\n\n // Header-image refresh (real path only). Regenerated BEFORE the render so the\n // preview the operator approves carries the same screenshot the client will\n // receive — the send reads this attachment off the Websites row. Gated on\n // `base !== null` exactly like the GA/Search enrichment above: the no-IO render\n // path (base === null, used for pure rendering and tests) must not launch a\n // browser or write to production Airtable. `refreshHeader: false` is the second\n // gate, for suites that DO pass a fake base and would otherwise pay a real\n // chromium launch per case. Production leaves it unset and gets the real\n // refresh. Best-effort — see refreshHeaderImage.\n if (base !== null && options.refreshHeader !== false) {\n await refreshHeaderImage(siteRow, options.refreshHeader ?? {});\n }\n\n const cidName = `${slug}-header`;\n const { html } = await renderReportHtml({\n siteName: siteRow.name,\n siteUrl: siteRow.url,\n reportType,\n completedOn,\n lighthouse: scores,\n gaUsersCurrent: gaUsers?.current,\n gaUsersPrevious: gaUsers?.previous,\n searchPosition: search?.foundOnPage1 ? (search.position ?? undefined) : undefined,\n lastTestedDate,\n commentary: null,\n copy: resolveCopy(siteRow),\n headerImageCid: cidName,\n });\n\n if (options.previewOnly) {\n const path = options.previewPath ?? `reports/${slug}/draft.html`;\n await mkdir(dirname(path), { recursive: true });\n await writeFile(path, html, \"utf-8\");\n return {\n reportRow: null,\n htmlPath: path,\n html,\n softFailures,\n searchDefaultMissed: searchResult.defaultQueryMissed,\n searchPropertyMissing: searchResult.propertyMissing,\n queued: null,\n supersededIds: [],\n };\n }\n\n if (base === null) throw new Error(\"base required when previewOnly=false\");\n\n // Record this site's GA/Search enrichment health for the per-site analytics-failure\n // signal (cockpit/digest). Only when analytics is configured for THIS site — set the\n // timestamp on a soft-fail, clear it (null) on a clean enrichment so the signal\n // self-heals. Best-effort: the `Analytics soft-fail at` column is operator-added, so\n // until it exists the write throws UNKNOWN_FIELD_NAME — which must NOT break drafting.\n if (readGaConfig() !== null && Boolean(siteRow.ga4PropertyId || siteRow.searchQuery)) {\n try {\n await updateAnalyticsHealth(\n base,\n siteRow.id,\n softFailures.length > 0 ? today.toISOString() : null,\n );\n } catch (e) {\n console.warn(`⚠ analytics-health write skipped for ${siteRow.name}: ${(e as Error).message}`);\n }\n }\n\n // \"Finish an existing row\" path (the --due re-draft wedge fix). When the caller\n // hands us a row that was created but never made Draft-ready — a crash between\n // createDraft and setDraftReady leaves exactly this — we DON'T createDraft again\n // (that would duplicate the period). We re-attach the rendered HTML and queue the\n // EXISTING row, completing the half-made draft in place. The row's other fields\n // (scores, period, dates) were already written at create time; the only pieces a\n // crash drops are the attachment + the ready flag.\n if (options.completeRowId) {\n await uploadDraftHtml(options.completeRowId, slug, periodEnd, html);\n const outcome = await queueDraft(base, {\n id: options.completeRowId,\n siteId: siteRow.id,\n reportType,\n });\n return {\n reportRow: options.existingRow ?? null,\n htmlPath: null,\n html,\n softFailures,\n searchDefaultMissed: searchResult.defaultQueryMissed,\n searchPropertyMissing: searchResult.propertyMissing,\n queued: outcome.queued,\n supersededIds: outcome.supersededIds,\n };\n }\n\n // Auto-tick the checklist boxes the system can prove (Phase 1: Google Indexed via the\n // inline search signal). Fail-safe lives in autoTickChecklist: only `pass` entries are ticked;\n // the evidence snapshot drives the dashboard's green/amber badges. The operator's approve gate\n // and per-box override are unchanged.\n const evidence = autoTickChecklist(siteRow, reportType, completedOn, { search: searchResult });\n const checklistTicks = [...evidence.entries()]\n .filter(([, e]) => e.result === \"pass\")\n .map(([field]) => field);\n const autoEvidence = Object.fromEntries(evidence);\n\n const reportId = `${siteRow.name} — ${reportType} — ${periodEnd.toISOString().slice(0, 10)}`;\n const created = await createDraft(base, {\n reportId,\n siteId: siteRow.id,\n reportType,\n period: options.period ?? periodEnd.toISOString().slice(0, 7),\n periodStart,\n periodEnd,\n completedOn,\n lighthouse: scores,\n lastTestedDate,\n ...(gaUsers ? { gaUsersCurrent: gaUsers.current, gaUsersPrevious: gaUsers.previous } : {}),\n ...(search ? { searchFoundPage1: search.foundOnPage1 } : {}),\n ...(search?.foundOnPage1 && search.position !== null\n ? { searchPosition: search.position }\n : {}),\n checklistTicks,\n autoEvidence,\n });\n\n await uploadDraftHtml(created.id, slug, periodEnd, html);\n const outcome = await queueDraft(base, {\n id: created.id,\n siteId: siteRow.id,\n reportType,\n });\n\n return {\n reportRow: created,\n htmlPath: null,\n html,\n softFailures,\n searchDefaultMissed: searchResult.defaultQueryMissed,\n searchPropertyMissing: searchResult.propertyMissing,\n queued: outcome.queued,\n supersededIds: outcome.supersededIds,\n };\n}\n\n/** Attach the rendered HTML to a Reports row. Queueing (Draft ready + the single-queue\n * reconciliation) is handled separately by queueDraft so both the create path and the\n * \"complete a half-made row\" path share the identical, re-runnable upload step. */\nasync function uploadDraftHtml(\n rowId: string,\n slug: string,\n periodEnd: Date,\n html: string,\n): Promise<void> {\n const htmlFilename = `${slug}-${periodEnd.toISOString().slice(0, 10)}.html`;\n await uploadAttachment(rowId, \"Rendered HTML\", html, htmlFilename, \"text/html\");\n}\n\n/** Result of an enrichment fetch: the value (null if unavailable) plus whether\n * it errored (`softFailed`) as opposed to being legitimately not-configured. */\ntype Enrichment<T> = { value: T | null; softFailed: boolean };\n/** A not-configured / skipped enrichment — null value, not a soft-failure. */\nconst NO_ENRICHMENT: Enrichment<never> = { value: null, softFailed: false };\n\n/**\n * Fetch GA \"Users\" for the period, soft-failing to null. Returns a null value (no enrichment)\n * when GA isn't configured (`GA_SUBJECT` unset) or the site has no GA4 property ID — those are\n * legitimate skips, `softFailed: false`. When the GA API errors it logs a one-line warning and\n * returns `softFailed: true`. Never throws, so a GA problem can never block a draft; the\n * operator can always enter the numbers by hand.\n */\nexport async function fetchGaUsers(\n siteRow: WebsiteRow,\n periodStart: Date,\n periodEnd: Date,\n): Promise<Enrichment<{ current: number; previous: number }>> {\n const cfg = readGaConfig();\n if (!cfg || !siteRow.ga4PropertyId) return NO_ENRICHMENT;\n try {\n const value = await fetchPeriodUsers(\n { propertyId: siteRow.ga4PropertyId, subjects: cfg.subjects, keyPath: cfg.keyPath },\n periodStart,\n periodEnd,\n );\n return { value, softFailed: false };\n } catch (e) {\n console.warn(`⚠ GA skipped for ${siteRow.name}: ${(e as Error).message}`);\n return { value: null, softFailed: true };\n }\n}\n\n/** A search enrichment, plus the two distinct miss flags (see `fetchSearch` /\n * `DraftResult.searchDefaultMissed` / `DraftResult.searchPropertyMissing`) and the\n * environment-gap flag `notConfigured`. */\ntype SearchEnrichment = Enrichment<SearchPresence> & {\n defaultQueryMissed: boolean;\n propertyMissing: boolean;\n /** True when the site IS analytics-enrolled but this environment has no GA/SC\n * credentials (`GA_SUBJECT` unset) — so the check could not run at all. Distinct\n * from the un-enrolled skip (nothing to measure) and from a soft-fail (the API\n * errored). See {@link fetchSearch}. */\n notConfigured: boolean;\n};\n\n/**\n * Fetch the site's Google search presence for the period, soft-failing to null. Runs whenever\n * GA/SA is configured (`readGaConfig()` non-null — search shares the SA credentials) AND the\n * site is analytics-enrolled (has a `ga4PropertyId` OR an explicit `searchQuery`); otherwise a\n * legitimate skip (null value, `softFailed: false`). The brand query defaults to the site NAME\n * when no explicit `searchQuery` is set (whitespace-only counts as unset) — so brand presence is\n * tracked automatically, and the operator only hand-tunes the handful of sites the name misses.\n *\n * `propertyMissing` is true when NO Search Console property matched the site for any subject\n * (missing/unverified property or lost SA access) — flagged for BOTH explicit and name-default\n * queries, because no query can fix a missing property. Pre-split, this case was folded into\n * `defaultQueryMissed`, whose \"set an explicit Search query\" remedy would permanently SILENCE\n * it (an explicit query that finds nothing is by design never flagged).\n *\n * `defaultQueryMissed` is true ONLY when a property resolved, the site-name default was used,\n * AND Search Console returned no data for it (`position === null`) — the signal to set an\n * explicit `Search query`. It is false for an explicit query (even one that finds nothing —\n * that's a valid measurement), a default that does find a position, the not-enrolled skip,\n * and the errored soft-fail path.\n *\n * `notConfigured` splits the old single skip in two. An un-enrolled site is a true skip —\n * there is nothing to measure, and the checklist row stays manual. But an ENROLLED site in an\n * environment with no credentials is an environment gap: the check was supposed to run and\n * couldn't. Collapsing the two made a credential-less run (exactly what the daily-reports\n * workflow was) indistinguishable from \"this site opted out\", so the Google Indexed row\n * silently vanished from every drafted report instead of saying why.\n *\n * When the Search Console API errors it logs a one-line warning and returns `softFailed: true`.\n * Never throws, so a search problem can never block a draft.\n */\nexport async function fetchSearch(\n siteRow: WebsiteRow,\n periodStart: Date,\n periodEnd: Date,\n): Promise<SearchEnrichment> {\n const cfg = readGaConfig();\n const enrolled = Boolean(siteRow.ga4PropertyId || siteRow.searchQuery);\n if (!cfg || !enrolled) {\n const notConfigured = enrolled && !cfg;\n if (notConfigured) {\n console.warn(\n `⚑ Search: no GA/Search Console credentials in this environment (GA_SUBJECT unset) — the Google Indexed check could not run for ${siteRow.name}.`,\n );\n }\n return { ...NO_ENRICHMENT, defaultQueryMissed: false, propertyMissing: false, notConfigured };\n }\n const explicit = siteRow.searchQuery?.trim();\n const query = explicit || siteRow.name;\n const usedDefault = !explicit;\n try {\n const value = await fetchSearchPresence(\n {\n keyPath: cfg.keyPath,\n subjects: cfg.subjects,\n property: siteRow.searchConsoleProperty ?? undefined,\n host: siteRow.url,\n query,\n },\n periodStart,\n periodEnd,\n );\n const propertyMissing = !value.propertyFound;\n if (propertyMissing) {\n console.warn(\n `⚑ Search: no Search Console property matched ${siteRow.url} for ${siteRow.name} — verify the domain property exists and the service account has access. (A \"Search query\" change cannot fix this.)`,\n );\n }\n const defaultQueryMissed = value.propertyFound && usedDefault && value.position === null;\n if (defaultQueryMissed) {\n console.warn(\n `⚑ Search: site-name default \"${query}\" found no Search Console data for ${siteRow.name} — set an explicit \"Search query\" in Airtable to track brand presence.`,\n );\n }\n return { value, softFailed: false, defaultQueryMissed, propertyMissing, notConfigured: false };\n } catch (e) {\n console.warn(`⚠ Search presence skipped for ${siteRow.name}: ${(e as Error).message}`);\n return {\n value: null,\n softFailed: true,\n defaultQueryMissed: false,\n propertyMissing: false,\n notConfigured: false,\n };\n }\n}\n\nasync function derivePeriodStart(\n base: AirtableBase,\n siteRow: WebsiteRow,\n reportType: ReportType,\n today: Date,\n): Promise<Date> {\n const prior = await listReportsForSite(base, siteRow.id);\n const sameType = prior\n .filter((r) => r.reportType === reportType && r.periodEnd)\n .map((r) => r.periodEnd!)\n .sort();\n const latest = sameType[sameType.length - 1];\n if (!latest) return daysAgo(today, 30);\n // Half-open periods. The prior report's GA/Search windows are inclusive of its\n // periodEnd, so starting this report on the *same* day double-counts that\n // boundary day across two consecutive reports (and inflates the headline Users\n // count). Start the next day instead. UTC to stay TZ-consistent with daysAgo.\n const start = new Date(latest);\n start.setUTCDate(start.getUTCDate() + 1);\n return start;\n}\n","import type { ReportType } from \"./types.js\";\nimport type { WebsiteRow } from \"./airtable/websites.js\";\nimport type { SearchPresence } from \"./search/client.js\";\nimport { checklistFor, gatingFields } from \"./checklist.js\";\nimport { isNetlifyAppUrl } from \"../util/url.js\";\n\n/** A persisted audit signal is only trusted within this window — a stale \"pass\" degrades to\n * \"unknown\" (no tick). Matches the github-signals staleness convention (~3 days). */\nconst STALE_DAYS = 3;\nconst MS_PER_DAY = 24 * 60 * 60 * 1000;\n\n/** True when `checkedAt` is a valid timestamp within STALE_DAYS of `now`. */\nfunction isFresh(checkedAt: string | null, now: Date): boolean {\n if (!checkedAt) return false;\n const t = new Date(checkedAt).getTime();\n if (Number.isNaN(t)) return false;\n return now.getTime() - t <= STALE_DAYS * MS_PER_DAY;\n}\n\n/** Cert-expiry buffer: a cert must have MORE than this many days left to pass (renew window).\n * Exactly 14 days does NOT pass — matches the spec's strict \">14 days\" and the domain audit's\n * own `> 14` pass status, so the two thresholds can't drift. */\nconst CERT_MIN_DAYS = 14;\n\n/** A single auto-check outcome. `pass` + fresh ⇒ the caller ticks the box. */\nexport type EvidenceResult = \"pass\" | \"fail\" | \"unknown\" | \"n/a\";\nexport type EvidenceRecord = { result: EvidenceResult; checkedAt: string | null; note: string };\n\n/**\n * Inline signals fetched during the draft. Phase 1 carries Search Console only; Phase 2/3 read\n * the remaining signals (security, domain, browser) off the Websites row passed as `site`.\n */\nexport type AutoTickSignals = {\n search: {\n value: SearchPresence | null;\n softFailed: boolean;\n /** The site is analytics-enrolled but this environment has no GA/Search Console\n * credentials, so the check could not run. Kept distinct from the un-enrolled skip\n * (`value: null`, this false) so the evidence can name the environment gap instead\n * of disappearing. */\n notConfigured: boolean;\n };\n};\n\n/**\n * Decide, per checklist item for this report type, an evidence record. PURE. The fail-safe\n * invariant lives here: a box is only tickable when `result === \"pass\"`. Google Indexed is an\n * inline signal (fetched at draft), so its evidence is inherently fresh (`checkedAt = now`).\n *\n * The semantic inversion: every GATING item for this report type gets a status even with no\n * signal — a never-measured gating item resolves to `unknown` (which blocks the send gate), not\n * an omission the caller could read as \"manual/OK\". Only non-gating (advisory) items keep the old\n * omit-when-absent behavior, so an unconfigured advisory check stays silently manual.\n */\nexport function autoTickChecklist(\n site: WebsiteRow,\n reportType: ReportType,\n now: Date,\n signals: AutoTickSignals,\n): Map<string, EvidenceRecord> {\n const out = new Map<string, EvidenceRecord>();\n const gating = new Set(gatingFields(reportType));\n\n for (const item of checklistFor(reportType)) {\n let ev: EvidenceRecord | null;\n switch (item.field) {\n case \"Maint: Google Indexed\":\n ev = googleEvidence(now, signals.search);\n break;\n case \"Maint: Deploy & Function Health\":\n ev = deployEvidence(site, now);\n break;\n case \"Maint: CMS Checked\":\n ev = cmsEvidence(site, now);\n break;\n case \"Maint: Domain, DNS & SSL\":\n ev = domainEvidence(site, now);\n break;\n case \"Maint: Security Updates\":\n ev = securityEvidence(site, now);\n break;\n case \"Maint: Uptime Checked\":\n ev = uptimeEvidence(site, now);\n break;\n case \"Test: Desktop Browsers\":\n ev = browserEvidence(\n site.crossbrowserOk,\n site,\n now,\n \"Desktop renders cleanly\",\n \"render errors\",\n );\n break;\n case \"Test: Mobile Browsers\":\n ev = browserEvidence(site.mobileOk, site, now, \"Mobile renders cleanly\", \"overflow/errors\");\n break;\n case \"Test: Page Titles & Meta\":\n ev = titlesEvidence(site, now);\n break;\n case \"Test: Links & Navigation\": {\n const broken = site.brokenLinks;\n const failNote = broken && broken > 0 ? `${broken} broken link(s)` : \"broken links / nav\";\n ev = browserEvidence(site.linksOk, site, now, \"All internal links resolve\", failNote);\n break;\n }\n case \"Test: Form Functionality\":\n ev = formsEvidence(site, now);\n break;\n case \"Test: Interactions & Animations\":\n ev = interactionsEvidence(site, now);\n break;\n case \"Test: Verified After Updates\":\n ev = updatesEvidence(site, now);\n break;\n default:\n ev = null;\n }\n // The semantic inversion: a GATING item with no fresh signal must still carry a status —\n // `unknown` (blocks) — so an unwired/absent signal can never leave the gate silently\n // passable. Advisory items (e.g. Google Indexed on a Maintenance report) keep the old\n // omit-when-absent behavior.\n if (ev === null && gating.has(item.field)) {\n ev = { result: \"unknown\", checkedAt: null, note: \"Not yet measured\" };\n }\n if (ev !== null) out.set(item.field, ev);\n }\n\n return out;\n}\n\n/** One browser-audit verdict (Desktop/Mobile/Links) → evidence, gated on `Browser checked at`\n * freshness. null verdict (never run) → omit (manual); stale → unknown; true → pass; false →\n * fail (with the failure note). The verdict itself was computed by the audit (summarizeBrowser). */\nfunction browserEvidence(\n ok: boolean | null,\n site: WebsiteRow,\n now: Date,\n passNote: string,\n failNote: string,\n): EvidenceRecord | null {\n if (ok === null || !site.browserCheckedAt) return null;\n const at = site.browserCheckedAt;\n if (!isFresh(at, now)) {\n return { result: \"unknown\", checkedAt: at, note: \"Browser check is stale (>3d)\" };\n }\n return ok\n ? { result: \"pass\", checkedAt: at, note: passNote }\n : { result: \"fail\", checkedAt: at, note: failNote };\n}\n\n/**\n * Security Updates evidence from the persisted `security` audit. Omits (→ manual) when the audit\n * never ran (counts null / no timestamp); stale → unknown; 0 critical AND 0 high → pass; any\n * critical/high → fail (with the count). Honest scope: \"no known critical/high advisories in the\n * declared dependencies as of the last audit\" — moderate/low are advisory, not gating, and this\n * does not prove the fix is deployed.\n */\nfunction securityEvidence(site: WebsiteRow, now: Date): EvidenceRecord | null {\n const crit = site.securityVulnsCritical;\n const high = site.securityVulnsHigh;\n if (crit === null || high === null || !site.lastSecurityAuditAt) return null;\n const at = site.lastSecurityAuditAt;\n if (!isFresh(at, now)) {\n return { result: \"unknown\", checkedAt: at, note: \"Security audit is stale (>3d)\" };\n }\n if (crit === 0 && high === 0) {\n return { result: \"pass\", checkedAt: at, note: \"No known critical/high vulnerabilities\" };\n }\n return { result: \"fail\", checkedAt: at, note: `${crit} critical / ${high} high vuln(s)` };\n}\n\n/**\n * Search Console → Google Indexed evidence. A soft-fail (the API errored) and an unwired\n * environment (`notConfigured`) are both `unknown`, but they carry DIFFERENT notes — an\n * operator staring at an amber pill has to be able to tell \"Google was unreachable this run\"\n * from \"this deployment has no Search Console credentials\", because only the second one is\n * fixed by wiring a secret. An un-enrolled site (`value: null`, not configured, not failed)\n * emits nothing so the box stays manual.\n *\n * Page-1 is `pass` (with the position in the note); off page 1 is `fail`.\n */\nfunction googleEvidence(now: Date, search: AutoTickSignals[\"search\"]): EvidenceRecord | null {\n const at = now.toISOString();\n if (search.softFailed) {\n return { result: \"unknown\", checkedAt: at, note: \"Search Console unavailable this run\" };\n }\n if (search.notConfigured) {\n return {\n result: \"unknown\",\n checkedAt: at,\n note: \"Search Console not configured in the environment that drafted this report\",\n };\n }\n if (search.value === null) return null;\n if (search.value.foundOnPage1) {\n const pos = search.value.position;\n return {\n result: \"pass\",\n checkedAt: at,\n note: `Page 1 on Google${pos !== null ? ` (#${pos})` : \"\"}`,\n };\n }\n const pos = search.value.position;\n return {\n result: \"fail\",\n checkedAt: at,\n note: `Not on page 1${pos !== null ? ` (avg #${pos})` : \"\"}`,\n };\n}\n\n/**\n * Domain/DNS/SSL evidence from the persisted `domain` audit. Omits (→ manual) when there's no\n * custom domain to verify (`*.netlify.app`) or the audit never ran. A `pass` requires a fresh\n * check that resolved with a cert comfortably before expiry; stale → unknown; resolved-but-no-cert\n * or near/past expiry → fail. The honest scope is resolve + valid cert — NOT registrar expiry,\n * www↔apex redirect, or MX.\n */\nfunction domainEvidence(site: WebsiteRow, now: Date): EvidenceRecord | null {\n // No custom domain to verify — the no-domain watch signal covers `*.netlify.app` elsewhere.\n if (!site.url || isNetlifyAppUrl(site.url)) return null;\n if (!site.domainCheckedAt) return null; // never probed → leave manual\n const at = site.domainCheckedAt;\n if (!isFresh(site.domainCheckedAt, now)) {\n return { result: \"unknown\", checkedAt: at, note: \"Domain check is stale (>3d)\" };\n }\n const days = site.certDaysRemaining;\n if (days === null) {\n return { result: \"fail\", checkedAt: at, note: \"Did not resolve, or no valid TLS cert\" };\n }\n if (days <= CERT_MIN_DAYS) {\n return { result: \"fail\", checkedAt: at, note: `TLS cert expires in ${days}d` };\n }\n return { result: \"pass\", checkedAt: at, note: `Custom domain, valid cert (${days}d left)` };\n}\n\n/**\n * Deploy & Function Health: the Netlify build is `ready` AND the deployed function responds\n * healthy. Two freshness stamps must both be fresh (deploy check + function-health check). Never\n * measured → null (omit → the gating dispatch coerces to unknown); either stale → unknown; both\n * fresh + ready + fn pass → pass; otherwise fail.\n */\nfunction deployEvidence(site: WebsiteRow, now: Date): EvidenceRecord | null {\n if (!site.deployCheckedAt && !site.functionHealthCheckedAt) return null;\n if (!isFresh(site.deployCheckedAt, now) || !isFresh(site.functionHealthCheckedAt, now)) {\n return {\n result: \"unknown\",\n checkedAt: site.functionHealthCheckedAt ?? site.deployCheckedAt,\n note: \"Deploy/function-health check is stale (>3d)\",\n };\n }\n const ready = site.deployStatus === \"ready\";\n const fnOk = site.functionHealth === \"pass\";\n if (ready && fnOk) {\n return {\n result: \"pass\",\n checkedAt: site.functionHealthCheckedAt,\n note: \"Netlify build ready + functions respond\",\n };\n }\n const why =\n !ready && !fnOk\n ? \"build not ready + functions unhealthy\"\n : !ready\n ? \"build not ready\"\n : \"functions unhealthy\";\n return {\n result: \"fail\",\n checkedAt: site.functionHealthCheckedAt,\n note: `Deploy/function-health failing — ${why}`,\n };\n}\n\n/**\n * CMS Checked: the server-side `/health` Prismic probe reported reachable. Freshness rides the\n * function-health check stamp (one `/health` fetch feeds both Deploy and CMS). Never measured →\n * null; stale → unknown; pass/fail mirror the stored verdict; a fresh stamp with no verdict →\n * unknown.\n */\nfunction cmsEvidence(site: WebsiteRow, now: Date): EvidenceRecord | null {\n if (!site.functionHealthCheckedAt) return null;\n const at = site.functionHealthCheckedAt;\n if (!isFresh(at, now)) {\n return { result: \"unknown\", checkedAt: at, note: \"CMS check is stale (>3d)\" };\n }\n if (site.cmsReachable === \"pass\") {\n return { result: \"pass\", checkedAt: at, note: \"Prismic reachable (server-side)\" };\n }\n if (site.cmsReachable === \"fail\") {\n return { result: \"fail\", checkedAt: at, note: \"Prismic unreachable (server-side)\" };\n }\n return { result: \"unknown\", checkedAt: at, note: \"CMS reachability not reported\" };\n}\n\n/**\n * Uptime Checked: every sampled route returned 2xx/3xx on the browser audit (point-in-time).\n * Freshness rides the shared `browserCheckedAt`. Never ran → null; stale → unknown.\n */\nfunction uptimeEvidence(site: WebsiteRow, now: Date): EvidenceRecord | null {\n if (site.reachableOk === null || !site.browserCheckedAt) return null;\n const at = site.browserCheckedAt;\n if (!isFresh(at, now)) {\n return { result: \"unknown\", checkedAt: at, note: \"Uptime check is stale (>3d)\" };\n }\n return site.reachableOk === \"pass\"\n ? { result: \"pass\", checkedAt: at, note: \"All sampled routes reachable (point-in-time)\" }\n : { result: \"fail\", checkedAt: at, note: \"One or more sampled routes did not respond 2xx/3xx\" };\n}\n\n/**\n * Page Titles & Meta: every sampled route had a non-empty title + meta description with no\n * duplicate titles (browser audit, chromium). Freshness rides `browserCheckedAt`.\n */\nfunction titlesEvidence(site: WebsiteRow, now: Date): EvidenceRecord | null {\n if (site.titleMetaOk === null || !site.browserCheckedAt) return null;\n const at = site.browserCheckedAt;\n if (!isFresh(at, now)) {\n return { result: \"unknown\", checkedAt: at, note: \"Titles/meta check is stale (>3d)\" };\n }\n return site.titleMetaOk === \"pass\"\n ? { result: \"pass\", checkedAt: at, note: \"Titles + meta present\" }\n : {\n result: \"fail\",\n checkedAt: at,\n note: \"Missing/duplicate title or missing meta description\",\n };\n}\n\n/**\n * Form Functionality: a synthetic prod submission succeeded (form-e2e audit). `n/a` when the audit\n * ran (checked-at stamp set) but the site has no contact form (verdict cleared to null). Never ran\n * (no stamp) → null; stale → unknown.\n */\nfunction formsEvidence(site: WebsiteRow, now: Date): EvidenceRecord | null {\n if (!site.formE2eCheckedAt) return null;\n const at = site.formE2eCheckedAt;\n if (!isFresh(at, now)) {\n return { result: \"unknown\", checkedAt: at, note: \"Form E2E check is stale (>3d)\" };\n }\n if (site.formE2eOk === \"pass\") {\n return { result: \"pass\", checkedAt: at, note: \"Synthetic submission succeeded\" };\n }\n if (site.formE2eOk === \"fail\") {\n return { result: \"fail\", checkedAt: at, note: \"Synthetic submission failed\" };\n }\n return { result: \"n/a\", checkedAt: at, note: \"No contact form on this site\" };\n}\n\n/**\n * Interactions & Animations: the per-site smoke suite is green. Freshness rides `lastSmokeAt`.\n * Never ran → null; stale → unknown.\n */\nfunction interactionsEvidence(site: WebsiteRow, now: Date): EvidenceRecord | null {\n if (site.smokeOk === null || !site.lastSmokeAt) return null;\n const at = site.lastSmokeAt;\n if (!isFresh(at, now)) {\n return { result: \"unknown\", checkedAt: at, note: \"Smoke suite is stale (>3d)\" };\n }\n return site.smokeOk === \"pass\"\n ? { result: \"pass\", checkedAt: at, note: \"Smoke suite green\" }\n : { result: \"fail\", checkedAt: at, note: \"Smoke suite red\" };\n}\n\n/**\n * Tested After Updates: default-branch CI is green on the latest commit (github-signals). A repo\n * with no CI (`defaultBranchCi === \"none\"`) is `n/a`. Never swept (null / no stamp) → null; stale\n * → unknown; passing → pass; failing → fail; pending → unknown.\n */\nfunction updatesEvidence(site: WebsiteRow, now: Date): EvidenceRecord | null {\n if (site.defaultBranchCi === null || !site.githubSignalsAt) return null;\n const at = site.githubSignalsAt;\n if (site.defaultBranchCi === \"none\") {\n return { result: \"n/a\", checkedAt: at, note: \"Repository has no CI\" };\n }\n if (!isFresh(at, now)) {\n return { result: \"unknown\", checkedAt: at, note: \"CI signal is stale (>3d)\" };\n }\n if (site.defaultBranchCi === \"passing\") {\n return { result: \"pass\", checkedAt: at, note: \"Default-branch CI green on latest commit\" };\n }\n if (site.defaultBranchCi === \"failing\") {\n return { result: \"fail\", checkedAt: at, note: \"Default-branch CI is failing\" };\n }\n return { result: \"unknown\", checkedAt: at, note: \"Default-branch CI is pending\" };\n}\n","import { readFileSync } from \"node:fs\";\nimport { JWT } from \"google-auth-library\";\nimport { BetaAnalyticsDataClient } from \"@google-analytics/data\";\nimport { withSubjectFailover } from \"./failover.js\";\n\nconst ANALYTICS_READONLY = \"https://www.googleapis.com/auth/analytics.readonly\";\nconst MS_PER_DAY = 86_400_000;\n\nexport type GaQuery = {\n /** GA4 numeric property ID (e.g. \"471880366\"). */\n propertyId: string;\n /** Workspace users to impersonate via domain-wide delegation, tried in order\n * (auth-failure failover — see `withSubjectFailover`). */\n subjects: string[];\n /** Path to the service-account JSON key. */\n keyPath: string;\n};\n\n/** UTC YYYY-MM-DD — matches the rest of the reports pipeline's date handling. */\nfunction ymd(d: Date): string {\n return d.toISOString().slice(0, 10);\n}\n\n/**\n * Fetch GA4 `activeUsers` (\"Users\") for a report period and the equal-length window\n * immediately before it, via a domain-wide-delegation service account impersonating each\n * of `subjects` in order until one authenticates. Throws on any non-auth API error, or\n * once every subject has failed auth — the caller (draftReportForSite) soft-fails.\n *\n * Previous window: same length as the current period, ending the day before `periodStart`.\n */\nexport async function fetchPeriodUsers(\n query: GaQuery,\n periodStart: Date,\n periodEnd: Date,\n): Promise<{ current: number; previous: number }> {\n const key = JSON.parse(readFileSync(query.keyPath, \"utf8\")) as {\n client_email: string;\n private_key: string;\n };\n\n const lengthDays = Math.round((periodEnd.getTime() - periodStart.getTime()) / MS_PER_DAY);\n const prevEnd = new Date(periodStart.getTime() - MS_PER_DAY);\n const prevStart = new Date(prevEnd.getTime() - lengthDays * MS_PER_DAY);\n const property = `properties/${query.propertyId}`;\n\n return withSubjectFailover(query.subjects, \"GA\", async (subject) => {\n const authClient = new JWT({\n email: key.client_email,\n key: key.private_key,\n scopes: [ANALYTICS_READONLY],\n subject,\n });\n const client = new BetaAnalyticsDataClient({ authClient });\n\n const run = async (start: Date, end: Date): Promise<number> => {\n const [resp] = await client.runReport({\n property,\n dateRanges: [{ startDate: ymd(start), endDate: ymd(end) }],\n metrics: [{ name: \"activeUsers\" }],\n });\n const raw = resp.rows?.[0]?.metricValues?.[0]?.value ?? \"0\";\n const n = Number.parseInt(raw, 10);\n return Number.isFinite(n) ? n : 0;\n };\n\n const current = await run(periodStart, periodEnd);\n const previous = await run(prevStart, prevEnd);\n return { current, previous };\n });\n}\n","/**\n * Impersonation-subject failover, shared by the GA Data client and the Search Console\n * client (both impersonate the same `GA_SUBJECT` list via domain-wide delegation).\n *\n * The point: one personal Workspace account backing every site's analytics is a fleet-wide\n * SPOF — if it's offboarded/suspended or loses property access, all analytics soft-fail to\n * blank at once. With `GA_SUBJECT` as an ordered list, an auth failure on one subject falls\n * through to the next, and a *partial* outage (primary dying, backup carrying) is surfaced\n * as a greppable `subject failover` warning before it becomes a total one.\n */\n\nconst AUTH_HTTP_STATUS = new Set([401, 403]);\n/** gRPC PERMISSION_DENIED (7) / UNAUTHENTICATED (16) — how the GA Data API surfaces auth. */\nconst AUTH_GRPC_CODES = new Set([7, 16]);\n/** Message shapes across the three auth surfaces: gRPC code names (GA Data), OAuth token\n * exchange (`invalid_grant` = suspended/deleted subject, `unauthorized_client` = DWD scope\n * missing), and plain HTTP 401/403 texts (Search Console via gaxios). */\nconst AUTH_MESSAGE =\n /permission[_ ]denied|unauthenticated|unauthorized|invalid_grant|access[_ ]denied|forbidden|insufficient permission|status code 40[13]/i;\n\ntype ErrorShape = {\n code?: number | string;\n status?: number | string;\n response?: { status?: number; data?: { error?: { errors?: Array<{ reason?: string }> } } };\n /** Explicit opt-in marker for errors that aren't auth-shaped per se but mean \"this\n * subject can't do the job, try the next one\" (see the search client's empty\n * sites.list case — that API hides inaccessible properties instead of 403ing). */\n failoverToNextSubject?: boolean;\n};\n\n/** Google surfaces per-user throughput caps as HTTP 403 with one of these `reason`s — a\n * transient rate-limit, NOT a lost grant. Distinguished so the failover warning doesn't\n * send operators to the offboarding runbook over a quota blip. */\nconst QUOTA_REASONS = new Set([\n \"userratelimitexceeded\",\n \"ratelimitexceeded\",\n \"quotaexceeded\",\n \"dailylimitexceeded\",\n]);\nconst QUOTA_MESSAGE = /quota exceeded|rate limit exceeded|user rate limit/i;\n\n/** True when an error looks like THIS subject's auth/authorization failed — the only\n * condition worth retrying under a different subject. Network/5xx/bad-input errors\n * would fail identically for every subject, so they propagate immediately. */\nexport function isAuthShapedError(e: unknown): boolean {\n const err = e as ErrorShape | null | undefined;\n if (err?.failoverToNextSubject === true) return true;\n if ([err?.status, err?.response?.status].some((s) => AUTH_HTTP_STATUS.has(Number(s))))\n return true;\n if (AUTH_HTTP_STATUS.has(Number(err?.code)) || AUTH_GRPC_CODES.has(Number(err?.code)))\n return true;\n const msg = e instanceof Error ? e.message : String(e);\n return AUTH_MESSAGE.test(msg);\n}\n\n/** A soft \"this subject can't see the resource, try the next one\" marker (the search\n * client's empty sites.list case) — NOT a genuine failure. It must never dominate a real\n * auth error when deciding what to throw after all subjects are exhausted. */\nfunction isFailoverSentinel(e: unknown): boolean {\n return (e as ErrorShape | null | undefined)?.failoverToNextSubject === true;\n}\n\n/** True when a 403 is a transient per-user quota/rate-limit, not an access loss. A\n * structured `reason` is authoritative (so a real `forbidden` 403 whose message happens to\n * mention a limit is NOT quota); otherwise fall back to the message. Still auth-shaped for\n * failover purposes — this only softens the warning wording, never the control flow. */\nexport function isQuotaShapedError(e: unknown): boolean {\n const err = e as ErrorShape | null | undefined;\n if (err?.failoverToNextSubject === true) return false;\n const reasons = err?.response?.data?.error?.errors;\n if (Array.isArray(reasons) && reasons.length > 0) {\n return reasons.some((r) => r?.reason != null && QUOTA_REASONS.has(r.reason.toLowerCase()));\n }\n const msg = e instanceof Error ? e.message : String(e);\n return QUOTA_MESSAGE.test(msg);\n}\n\n/**\n * Run `attempt` with each subject in order until one succeeds. Auth-shaped failures fall\n * through to the next subject; anything else throws immediately. When all subjects fail,\n * the LAST error is thrown — callers keep their existing catch-and-soft-fail behavior.\n * When an earlier subject failed but a later one succeeded, emit ONE console.warn so a\n * dying primary is visible in the cron log before it becomes a total outage.\n */\nexport async function withSubjectFailover<T>(\n subjects: readonly string[],\n label: string,\n attempt: (subject: string) => Promise<T>,\n): Promise<T> {\n if (subjects.length === 0) throw new Error(`${label}: no impersonation subjects configured`);\n const failed: string[] = [];\n // Track a genuine auth failure separately from a soft sentinel. If ANY subject failed for\n // real, that error must be what we throw — never a later subject's \"no resource here\"\n // sentinel. Otherwise [real-auth-failure, empty-result] would surface as a clean sentinel\n // and the caller would record it as verified data instead of soft-failing (the exact\n // masking the analytics-health alarm exists to catch).\n let lastRealError: unknown;\n let lastSentinel: unknown;\n // Stays true only while every failure so far is a transient quota/rate-limit — a lost\n // grant or a sentinel flips it, escalating the warning from \"transient\" to the runbook.\n let allQuota = true;\n for (const subject of subjects) {\n try {\n const result = await attempt(subject);\n if (failed.length > 0) {\n console.warn(\n allQuota\n ? `⚠ ${label} subject failover: ${failed.join(\"; \")} — succeeded via ${subject} ` +\n `(transient quota/rate-limit, not an access loss).`\n : `⚠ ${label} subject failover: ${failed.join(\"; \")} — succeeded via ${subject}. ` +\n `Restore the failing subject's access or drop it from GA_SUBJECT ` +\n `(docs/runbooks/ga-search-role-account-cutover.md).`,\n );\n }\n return result;\n } catch (e) {\n if (!isAuthShapedError(e)) throw e;\n failed.push(`${subject} (${e instanceof Error ? e.message : String(e)})`);\n if (isFailoverSentinel(e)) {\n lastSentinel = e;\n allQuota = false;\n } else {\n lastRealError = e;\n if (!isQuotaShapedError(e)) allQuota = false;\n }\n }\n }\n // A real auth failure dominates a sentinel regardless of subject order; only when EVERY\n // subject merely returned the soft sentinel do we throw it (the search client turns that\n // into a legitimate not-found).\n throw lastRealError ?? lastSentinel;\n}\n","import { readFileSync } from \"node:fs\";\nimport { JWT } from \"google-auth-library\";\nimport { withSubjectFailover } from \"../ga/failover.js\";\n\nconst WEBMASTERS_READONLY = \"https://www.googleapis.com/auth/webmasters.readonly\";\nconst SC_BASE = \"https://searchconsole.googleapis.com/webmasters/v3\";\n/** Average-position threshold for \"on page 1\" (10 organic results per page). */\nconst PAGE_1_MAX_POSITION = 10;\n/** Rows to pull for the brand `contains` match. searchAnalytics has no orderBy and returns\n * rows clicks-desc, so the exact-query row survives into the response only if it isn't paged\n * out beyond this cap. Sized with wide headroom — a brand has a handful of phrasing variants,\n * far below 100 — so the exact query (and every variant) is in practice always present. */\nexport const BRAND_QUERY_ROW_LIMIT = 100;\n\nexport type SearchPresenceQuery = {\n /** Path to the service-account JSON key (same one GA uses). */\n keyPath: string;\n /** Workspace users to impersonate via domain-wide delegation, tried in order\n * (auth-failure failover — see `withSubjectFailover`). */\n subjects: string[];\n /** Explicit Search Console property (`sc-domain:...` or `https://.../`). Overrides auto-resolution. */\n property?: string | undefined;\n /** Site host, used to auto-resolve the property from `sites.list` when `property` is absent. */\n host: string;\n /** Operator-supplied brand hint (e.g. the business name). Matched as a case-insensitive\n * SUBSTRING (`contains`) of the actual user query — NOT a hard exact string — so it tolerates\n * phrasing (\"red door creative\" vs \"…creative la\"). An exact-query match is preferred when\n * present; otherwise the most-searched matching query wins. */\n query: string;\n};\n\nexport type SearchPresence = {\n /** True when the average position for the query is on page 1 (<= 10). */\n foundOnPage1: boolean;\n /** Rounded average position, or null when not found / no data. */\n position: number | null;\n /** True when a Search Console property was actually resolved for the site (even if the\n * query then found no data). False ONLY when every subject resolved ZERO matching\n * properties — a missing/unverified property or lost SA access. Callers must\n * distinguish these: \"property exists, query missed\" is fixable with a better query;\n * \"no property at all\" is not, and prescribing a query change would silence the real\n * problem forever (an explicit query that returns nothing is by design never flagged). */\n propertyFound: boolean;\n};\n\ntype SiteEntry = { siteUrl: string };\n\n/** Reduce any property string or URL to a bare host: no `sc-domain:`, scheme, `www.`, path, lowercased. */\nexport function bareHost(s: string): string {\n return s\n .trim()\n .replace(/^sc-domain:/i, \"\")\n .replace(/^https?:\\/\\//i, \"\")\n .split(\"/\")[0]!\n .replace(/^www\\./i, \"\")\n .toLowerCase();\n}\n\n/**\n * All Search Console properties matching `host`, ordered for query fallback: Domain\n * (`sc-domain:`) forms first (broadest coverage), then URL-prefix forms. A site can be verified\n * as both; a freshly-created Domain property has no backfilled history, so its data can be empty\n * even while a long-lived URL-prefix property has data — hence we return every match and let the\n * caller try them in order until one returns data. Empty list = nothing matches.\n */\nexport function resolvePropertyCandidates(entries: SiteEntry[], host: string): string[] {\n const target = bareHost(host);\n const matches = entries.filter((e) => bareHost(e.siteUrl) === target).map((e) => e.siteUrl);\n const domains = matches.filter((s) => s.toLowerCase().startsWith(\"sc-domain:\"));\n const prefixes = matches.filter((s) => !s.toLowerCase().startsWith(\"sc-domain:\"));\n return [...domains, ...prefixes];\n}\n\n/** UTC YYYY-MM-DD — matches the rest of the reports pipeline. */\nfunction ymd(d: Date): string {\n return d.toISOString().slice(0, 10);\n}\n\n/**\n * From the queries matching the brand substring, pick the one the brand is actually FOUND\n * by most — the highest-impression row — and return its average position; tie-break on the\n * better (lower) position. Returns undefined when no row carries a numeric position. This is\n * what makes the reported \"brand search\" position robust to phrasing: with a `contains`\n * filter several variants can match, and we report the position of the variant real users\n * search most, not whichever the operator happened to type. Rows missing `impressions` count\n * as 0 (keeps a single-row, impression-less response — e.g. a test fixture — working). PURE.\n */\nexport function pickBrandQuery(\n rows: Array<{ position?: number; impressions?: number }>,\n): number | undefined {\n let best: { position: number; impressions: number } | undefined;\n for (const r of rows) {\n if (typeof r.position !== \"number\") continue;\n const impressions = r.impressions ?? 0;\n if (\n best === undefined ||\n impressions > best.impressions ||\n (impressions === best.impressions && r.position < best.position)\n ) {\n best = { position: r.position, impressions };\n }\n }\n return best?.position;\n}\n\n/**\n * The brand's reported position from the `contains`-matched rows, preferring an EXACT match.\n * When a returned row's query equals the operator's configured string (case-insensitive), its\n * position is used verbatim — a precisely-configured brand query is honored, with no chance a\n * longer higher-impression variant (\"…reviews\", \"…near me\") hijacks the number. Otherwise we\n * fall back to the most-searched matching query (`pickBrandQuery`). Operates only on the rows\n * actually returned: a string `contains` itself, so the exact query is among the `contains`\n * results whenever it has data AND isn't paged out beyond `BRAND_QUERY_ROW_LIMIT` (sized so a\n * brand's handful of phrasing variants always fit; if it ever were paged out, the most-searched\n * fallback still returns a valid brand position). Returns undefined when no row carries a\n * numeric position. PURE.\n */\nexport function selectBrandPosition(\n rows: Array<{ keys?: string[]; position?: number; impressions?: number }>,\n exactQuery: string,\n): number | undefined {\n const want = exactQuery.toLowerCase();\n const exact = rows.find(\n (r) => typeof r.position === \"number\" && (r.keys?.[0] ?? \"\").toLowerCase() === want,\n );\n if (exact) return exact.position;\n return pickBrandQuery(rows);\n}\n\n/** Per-subject \"this subject resolved NO matching Search Console property\". sites.list only\n * returns properties the impersonated user can access — a subject that lost access sees an\n * empty list with no auth error at all — so this opts into subject failover explicitly.\n * When EVERY subject resolves empty, `fetchSearchPresence` restores the pre-failover\n * behavior: a plain not-found result, not a throw. */\nclass NoPropertyForSubjectError extends Error {\n readonly failoverToNextSubject = true;\n constructor(subject: string, host: string) {\n super(`no Search Console property matching ${host} is visible to ${subject}`);\n }\n}\n\n/**\n * Query Google Search Console for the brand's average position on the site over the report\n * period, via a domain-wide-delegation service account impersonating each of `subjects` in\n * order until one authenticates. `query` is a case-insensitive SUBSTRING (`contains`) hint;\n * among the matching user queries we report the position of the exact-match query when\n * present, else the most-searched one (see `selectBrandPosition`) — so it doesn't depend on\n * the operator typing the exact search string, yet honors one verbatim when they do. Uses\n * `property` verbatim when given (operator's choice is final — no fallback); otherwise\n * auto-discovers all matching properties via `sites.list` and tries them in order (Domain\n * first) until one returns data. Throws on any non-auth API error, or once every subject\n * has failed auth — the caller (draftReportForSite) soft-fails.\n */\nexport async function fetchSearchPresence(\n q: SearchPresenceQuery,\n periodStart: Date,\n periodEnd: Date,\n): Promise<SearchPresence> {\n const key = JSON.parse(readFileSync(q.keyPath, \"utf8\")) as {\n client_email: string;\n private_key: string;\n };\n\n try {\n return await withSubjectFailover(q.subjects, \"Search Console\", async (subject) => {\n const jwt = new JWT({\n email: key.client_email,\n key: key.private_key,\n scopes: [WEBMASTERS_READONLY],\n subject,\n });\n\n const explicit = q.property?.trim();\n let candidates: string[];\n if (explicit) {\n candidates = [explicit];\n } else {\n const list = await jwt.request<{ siteEntry?: SiteEntry[] }>({\n url: `${SC_BASE}/sites`,\n method: \"GET\",\n });\n candidates = resolvePropertyCandidates(list.data.siteEntry ?? [], q.host);\n if (candidates.length === 0) throw new NoPropertyForSubjectError(subject, q.host);\n }\n\n for (const property of candidates) {\n const res = await jwt.request<{\n rows?: Array<{ keys?: string[]; position?: number; impressions?: number }>;\n }>({\n url: `${SC_BASE}/sites/${encodeURIComponent(property)}/searchAnalytics/query`,\n method: \"POST\",\n data: {\n startDate: ymd(periodStart),\n endDate: ymd(periodEnd),\n dimensions: [\"query\"],\n dimensionFilterGroups: [\n {\n filters: [\n { dimension: \"query\", operator: \"contains\", expression: q.query.toLowerCase() },\n ],\n },\n ],\n rowLimit: BRAND_QUERY_ROW_LIMIT,\n },\n });\n const pos = selectBrandPosition(res.data.rows ?? [], q.query.toLowerCase());\n if (typeof pos === \"number\") {\n // Search Console can average below 1; floor to 1 so the template never\n // renders a nonsensical \"#0\" (positions are 1-indexed).\n return {\n foundOnPage1: pos <= PAGE_1_MAX_POSITION,\n position: Math.max(1, Math.round(pos)),\n propertyFound: true,\n };\n }\n }\n // A property WAS resolved (or operator-pinned); the query just found no rows.\n return { foundOnPage1: false, position: null, propertyFound: true };\n });\n } catch (e) {\n // Every subject resolved zero matching properties — same legitimate \"no property\"\n // outcome as before failover existed, NOT an analytics soft-failure. Marked\n // propertyFound:false so the draft layer can flag the ACTUAL problem (missing\n // property / lost SA access) instead of blaming the query.\n if (e instanceof NoPropertyForSubjectError)\n return { foundOnPage1: false, position: null, propertyFound: false };\n throw e;\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS,YAAY;AAwBvB,SAAS,eAAgC;AAC9C,QAAM,YAAY,QAAQ,IAAI,cAAc,IACzC,MAAM,GAAG,EACT,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,OAAO;AACjB,MAAI,SAAS,WAAW,EAAG,QAAO;AAClC,QAAM,UACJ,QAAQ,IAAI,gBAAgB,KAAK,KACjC,KAAK,QAAQ,uBAAuB,CAAC,GAAG,yBAAyB;AACnE,SAAO,EAAE,UAAU,QAAQ;AAC7B;;;AClCA,SAAS,OAAO,iBAAiB;AACjC,SAAS,WAAAA,gBAAe;;;ACOxB,IAAM,aAAa;AACnB,IAAM,aAAa,KAAK,KAAK,KAAK;AAGlC,SAAS,QAAQ,WAA0B,KAAoB;AAC7D,MAAI,CAAC,UAAW,QAAO;AACvB,QAAM,IAAI,IAAI,KAAK,SAAS,EAAE,QAAQ;AACtC,MAAI,OAAO,MAAM,CAAC,EAAG,QAAO;AAC5B,SAAO,IAAI,QAAQ,IAAI,KAAK,aAAa;AAC3C;AAKA,IAAM,gBAAgB;AAgCf,SAAS,kBACd,MACA,YACA,KACA,SAC6B;AAC7B,QAAM,MAAM,oBAAI,IAA4B;AAC5C,QAAM,SAAS,IAAI,IAAI,aAAa,UAAU,CAAC;AAE/C,aAAW,QAAQ,aAAa,UAAU,GAAG;AAC3C,QAAI;AACJ,YAAQ,KAAK,OAAO;AAAA,MAClB,KAAK;AACH,aAAK,eAAe,KAAK,QAAQ,MAAM;AACvC;AAAA,MACF,KAAK;AACH,aAAK,eAAe,MAAM,GAAG;AAC7B;AAAA,MACF,KAAK;AACH,aAAK,YAAY,MAAM,GAAG;AAC1B;AAAA,MACF,KAAK;AACH,aAAK,eAAe,MAAM,GAAG;AAC7B;AAAA,MACF,KAAK;AACH,aAAK,iBAAiB,MAAM,GAAG;AAC/B;AAAA,MACF,KAAK;AACH,aAAK,eAAe,MAAM,GAAG;AAC7B;AAAA,MACF,KAAK;AACH,aAAK;AAAA,UACH,KAAK;AAAA,UACL;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QACF;AACA;AAAA,MACF,KAAK;AACH,aAAK,gBAAgB,KAAK,UAAU,MAAM,KAAK,0BAA0B,iBAAiB;AAC1F;AAAA,MACF,KAAK;AACH,aAAK,eAAe,MAAM,GAAG;AAC7B;AAAA,MACF,KAAK,4BAA4B;AAC/B,cAAM,SAAS,KAAK;AACpB,cAAM,WAAW,UAAU,SAAS,IAAI,GAAG,MAAM,oBAAoB;AACrE,aAAK,gBAAgB,KAAK,SAAS,MAAM,KAAK,8BAA8B,QAAQ;AACpF;AAAA,MACF;AAAA,MACA,KAAK;AACH,aAAK,cAAc,MAAM,GAAG;AAC5B;AAAA,MACF,KAAK;AACH,aAAK,qBAAqB,MAAM,GAAG;AACnC;AAAA,MACF,KAAK;AACH,aAAK,gBAAgB,MAAM,GAAG;AAC9B;AAAA,MACF;AACE,aAAK;AAAA,IACT;AAKA,QAAI,OAAO,QAAQ,OAAO,IAAI,KAAK,KAAK,GAAG;AACzC,WAAK,EAAE,QAAQ,WAAW,WAAW,MAAM,MAAM,mBAAmB;AAAA,IACtE;AACA,QAAI,OAAO,KAAM,KAAI,IAAI,KAAK,OAAO,EAAE;AAAA,EACzC;AAEA,SAAO;AACT;AAKA,SAAS,gBACP,IACA,MACA,KACA,UACA,UACuB;AACvB,MAAI,OAAO,QAAQ,CAAC,KAAK,iBAAkB,QAAO;AAClD,QAAM,KAAK,KAAK;AAChB,MAAI,CAAC,QAAQ,IAAI,GAAG,GAAG;AACrB,WAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,+BAA+B;AAAA,EAClF;AACA,SAAO,KACH,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,SAAS,IAChD,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,SAAS;AACtD;AASA,SAAS,iBAAiB,MAAkB,KAAkC;AAC5E,QAAM,OAAO,KAAK;AAClB,QAAM,OAAO,KAAK;AAClB,MAAI,SAAS,QAAQ,SAAS,QAAQ,CAAC,KAAK,oBAAqB,QAAO;AACxE,QAAM,KAAK,KAAK;AAChB,MAAI,CAAC,QAAQ,IAAI,GAAG,GAAG;AACrB,WAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,gCAAgC;AAAA,EACnF;AACA,MAAI,SAAS,KAAK,SAAS,GAAG;AAC5B,WAAO,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,yCAAyC;AAAA,EACzF;AACA,SAAO,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,GAAG,IAAI,eAAe,IAAI,gBAAgB;AAC1F;AAYA,SAAS,eAAe,KAAW,QAA0D;AAC3F,QAAM,KAAK,IAAI,YAAY;AAC3B,MAAI,OAAO,YAAY;AACrB,WAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,sCAAsC;AAAA,EACzF;AACA,MAAI,OAAO,eAAe;AACxB,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,WAAW;AAAA,MACX,MAAM;AAAA,IACR;AAAA,EACF;AACA,MAAI,OAAO,UAAU,KAAM,QAAO;AAClC,MAAI,OAAO,MAAM,cAAc;AAC7B,UAAMC,OAAM,OAAO,MAAM;AACzB,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,WAAW;AAAA,MACX,MAAM,mBAAmBA,SAAQ,OAAO,MAAMA,IAAG,MAAM,EAAE;AAAA,IAC3D;AAAA,EACF;AACA,QAAM,MAAM,OAAO,MAAM;AACzB,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,WAAW;AAAA,IACX,MAAM,gBAAgB,QAAQ,OAAO,UAAU,GAAG,MAAM,EAAE;AAAA,EAC5D;AACF;AASA,SAAS,eAAe,MAAkB,KAAkC;AAE1E,MAAI,CAAC,KAAK,OAAO,gBAAgB,KAAK,GAAG,EAAG,QAAO;AACnD,MAAI,CAAC,KAAK,gBAAiB,QAAO;AAClC,QAAM,KAAK,KAAK;AAChB,MAAI,CAAC,QAAQ,KAAK,iBAAiB,GAAG,GAAG;AACvC,WAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,8BAA8B;AAAA,EACjF;AACA,QAAM,OAAO,KAAK;AAClB,MAAI,SAAS,MAAM;AACjB,WAAO,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,wCAAwC;AAAA,EACxF;AACA,MAAI,QAAQ,eAAe;AACzB,WAAO,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,uBAAuB,IAAI,IAAI;AAAA,EAC/E;AACA,SAAO,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,8BAA8B,IAAI,UAAU;AAC5F;AAQA,SAAS,eAAe,MAAkB,KAAkC;AAC1E,MAAI,CAAC,KAAK,mBAAmB,CAAC,KAAK,wBAAyB,QAAO;AACnE,MAAI,CAAC,QAAQ,KAAK,iBAAiB,GAAG,KAAK,CAAC,QAAQ,KAAK,yBAAyB,GAAG,GAAG;AACtF,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,WAAW,KAAK,2BAA2B,KAAK;AAAA,MAChD,MAAM;AAAA,IACR;AAAA,EACF;AACA,QAAM,QAAQ,KAAK,iBAAiB;AACpC,QAAM,OAAO,KAAK,mBAAmB;AACrC,MAAI,SAAS,MAAM;AACjB,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,WAAW,KAAK;AAAA,MAChB,MAAM;AAAA,IACR;AAAA,EACF;AACA,QAAM,MACJ,CAAC,SAAS,CAAC,OACP,0CACA,CAAC,QACC,oBACA;AACR,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,WAAW,KAAK;AAAA,IAChB,MAAM,yCAAoC,GAAG;AAAA,EAC/C;AACF;AAQA,SAAS,YAAY,MAAkB,KAAkC;AACvE,MAAI,CAAC,KAAK,wBAAyB,QAAO;AAC1C,QAAM,KAAK,KAAK;AAChB,MAAI,CAAC,QAAQ,IAAI,GAAG,GAAG;AACrB,WAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,2BAA2B;AAAA,EAC9E;AACA,MAAI,KAAK,iBAAiB,QAAQ;AAChC,WAAO,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,kCAAkC;AAAA,EAClF;AACA,MAAI,KAAK,iBAAiB,QAAQ;AAChC,WAAO,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,oCAAoC;AAAA,EACpF;AACA,SAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,gCAAgC;AACnF;AAMA,SAAS,eAAe,MAAkB,KAAkC;AAC1E,MAAI,KAAK,gBAAgB,QAAQ,CAAC,KAAK,iBAAkB,QAAO;AAChE,QAAM,KAAK,KAAK;AAChB,MAAI,CAAC,QAAQ,IAAI,GAAG,GAAG;AACrB,WAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,8BAA8B;AAAA,EACjF;AACA,SAAO,KAAK,gBAAgB,SACxB,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,+CAA+C,IACtF,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,qDAAqD;AAClG;AAMA,SAAS,eAAe,MAAkB,KAAkC;AAC1E,MAAI,KAAK,gBAAgB,QAAQ,CAAC,KAAK,iBAAkB,QAAO;AAChE,QAAM,KAAK,KAAK;AAChB,MAAI,CAAC,QAAQ,IAAI,GAAG,GAAG;AACrB,WAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,mCAAmC;AAAA,EACtF;AACA,SAAO,KAAK,gBAAgB,SACxB,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,wBAAwB,IAC/D;AAAA,IACE,QAAQ;AAAA,IACR,WAAW;AAAA,IACX,MAAM;AAAA,EACR;AACN;AAOA,SAAS,cAAc,MAAkB,KAAkC;AACzE,MAAI,CAAC,KAAK,iBAAkB,QAAO;AACnC,QAAM,KAAK,KAAK;AAChB,MAAI,CAAC,QAAQ,IAAI,GAAG,GAAG;AACrB,WAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,gCAAgC;AAAA,EACnF;AACA,MAAI,KAAK,cAAc,QAAQ;AAC7B,WAAO,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,iCAAiC;AAAA,EACjF;AACA,MAAI,KAAK,cAAc,QAAQ;AAC7B,WAAO,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,8BAA8B;AAAA,EAC9E;AACA,SAAO,EAAE,QAAQ,OAAO,WAAW,IAAI,MAAM,+BAA+B;AAC9E;AAMA,SAAS,qBAAqB,MAAkB,KAAkC;AAChF,MAAI,KAAK,YAAY,QAAQ,CAAC,KAAK,YAAa,QAAO;AACvD,QAAM,KAAK,KAAK;AAChB,MAAI,CAAC,QAAQ,IAAI,GAAG,GAAG;AACrB,WAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,6BAA6B;AAAA,EAChF;AACA,SAAO,KAAK,YAAY,SACpB,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,oBAAoB,IAC3D,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,kBAAkB;AAC/D;AAOA,SAAS,gBAAgB,MAAkB,KAAkC;AAC3E,MAAI,KAAK,oBAAoB,QAAQ,CAAC,KAAK,gBAAiB,QAAO;AACnE,QAAM,KAAK,KAAK;AAChB,MAAI,KAAK,oBAAoB,QAAQ;AACnC,WAAO,EAAE,QAAQ,OAAO,WAAW,IAAI,MAAM,uBAAuB;AAAA,EACtE;AACA,MAAI,CAAC,QAAQ,IAAI,GAAG,GAAG;AACrB,WAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,2BAA2B;AAAA,EAC9E;AACA,MAAI,KAAK,oBAAoB,WAAW;AACtC,WAAO,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,2CAA2C;AAAA,EAC3F;AACA,MAAI,KAAK,oBAAoB,WAAW;AACtC,WAAO,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,+BAA+B;AAAA,EAC/E;AACA,SAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,+BAA+B;AAClF;;;AC/XA,SAAS,oBAAoB;AAC7B,SAAS,WAAW;AACpB,SAAS,+BAA+B;;;ACSxC,IAAM,mBAAmB,oBAAI,IAAI,CAAC,KAAK,GAAG,CAAC;AAE3C,IAAM,kBAAkB,oBAAI,IAAI,CAAC,GAAG,EAAE,CAAC;AAIvC,IAAM,eACJ;AAeF,IAAM,gBAAgB,oBAAI,IAAI;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AACD,IAAM,gBAAgB;AAKf,SAAS,kBAAkB,GAAqB;AACrD,QAAM,MAAM;AACZ,MAAI,KAAK,0BAA0B,KAAM,QAAO;AAChD,MAAI,CAAC,KAAK,QAAQ,KAAK,UAAU,MAAM,EAAE,KAAK,CAAC,MAAM,iBAAiB,IAAI,OAAO,CAAC,CAAC,CAAC;AAClF,WAAO;AACT,MAAI,iBAAiB,IAAI,OAAO,KAAK,IAAI,CAAC,KAAK,gBAAgB,IAAI,OAAO,KAAK,IAAI,CAAC;AAClF,WAAO;AACT,QAAM,MAAM,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC;AACrD,SAAO,aAAa,KAAK,GAAG;AAC9B;AAKA,SAAS,mBAAmB,GAAqB;AAC/C,SAAQ,GAAqC,0BAA0B;AACzE;AAMO,SAAS,mBAAmB,GAAqB;AACtD,QAAM,MAAM;AACZ,MAAI,KAAK,0BAA0B,KAAM,QAAO;AAChD,QAAM,UAAU,KAAK,UAAU,MAAM,OAAO;AAC5C,MAAI,MAAM,QAAQ,OAAO,KAAK,QAAQ,SAAS,GAAG;AAChD,WAAO,QAAQ,KAAK,CAAC,MAAM,GAAG,UAAU,QAAQ,cAAc,IAAI,EAAE,OAAO,YAAY,CAAC,CAAC;AAAA,EAC3F;AACA,QAAM,MAAM,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC;AACrD,SAAO,cAAc,KAAK,GAAG;AAC/B;AASA,eAAsB,oBACpB,UACA,OACA,SACY;AACZ,MAAI,SAAS,WAAW,EAAG,OAAM,IAAI,MAAM,GAAG,KAAK,wCAAwC;AAC3F,QAAM,SAAmB,CAAC;AAM1B,MAAI;AACJ,MAAI;AAGJ,MAAI,WAAW;AACf,aAAW,WAAW,UAAU;AAC9B,QAAI;AACF,YAAM,SAAS,MAAM,QAAQ,OAAO;AACpC,UAAI,OAAO,SAAS,GAAG;AACrB,gBAAQ;AAAA,UACN,WACI,UAAK,KAAK,sBAAsB,OAAO,KAAK,IAAI,CAAC,yBAAoB,OAAO,uDAE5E,UAAK,KAAK,sBAAsB,OAAO,KAAK,IAAI,CAAC,yBAAoB,OAAO;AAAA,QAGlF;AAAA,MACF;AACA,aAAO;AAAA,IACT,SAAS,GAAG;AACV,UAAI,CAAC,kBAAkB,CAAC,EAAG,OAAM;AACjC,aAAO,KAAK,GAAG,OAAO,KAAK,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,CAAC,GAAG;AACxE,UAAI,mBAAmB,CAAC,GAAG;AACzB,uBAAe;AACf,mBAAW;AAAA,MACb,OAAO;AACL,wBAAgB;AAChB,YAAI,CAAC,mBAAmB,CAAC,EAAG,YAAW;AAAA,MACzC;AAAA,IACF;AAAA,EACF;AAIA,QAAM,iBAAiB;AACzB;;;AD9HA,IAAM,qBAAqB;AAC3B,IAAMC,cAAa;AAanB,SAAS,IAAI,GAAiB;AAC5B,SAAO,EAAE,YAAY,EAAE,MAAM,GAAG,EAAE;AACpC;AAUA,eAAsB,iBACpB,OACA,aACA,WACgD;AAChD,QAAM,MAAM,KAAK,MAAM,aAAa,MAAM,SAAS,MAAM,CAAC;AAK1D,QAAM,aAAa,KAAK,OAAO,UAAU,QAAQ,IAAI,YAAY,QAAQ,KAAKA,WAAU;AACxF,QAAM,UAAU,IAAI,KAAK,YAAY,QAAQ,IAAIA,WAAU;AAC3D,QAAM,YAAY,IAAI,KAAK,QAAQ,QAAQ,IAAI,aAAaA,WAAU;AACtE,QAAM,WAAW,cAAc,MAAM,UAAU;AAE/C,SAAO,oBAAoB,MAAM,UAAU,MAAM,OAAO,YAAY;AAClE,UAAM,aAAa,IAAI,IAAI;AAAA,MACzB,OAAO,IAAI;AAAA,MACX,KAAK,IAAI;AAAA,MACT,QAAQ,CAAC,kBAAkB;AAAA,MAC3B;AAAA,IACF,CAAC;AACD,UAAM,SAAS,IAAI,wBAAwB,EAAE,WAAW,CAAC;AAEzD,UAAM,MAAM,OAAO,OAAa,QAA+B;AAC7D,YAAM,CAAC,IAAI,IAAI,MAAM,OAAO,UAAU;AAAA,QACpC;AAAA,QACA,YAAY,CAAC,EAAE,WAAW,IAAI,KAAK,GAAG,SAAS,IAAI,GAAG,EAAE,CAAC;AAAA,QACzD,SAAS,CAAC,EAAE,MAAM,cAAc,CAAC;AAAA,MACnC,CAAC;AACD,YAAM,MAAM,KAAK,OAAO,CAAC,GAAG,eAAe,CAAC,GAAG,SAAS;AACxD,YAAM,IAAI,OAAO,SAAS,KAAK,EAAE;AACjC,aAAO,OAAO,SAAS,CAAC,IAAI,IAAI;AAAA,IAClC;AAEA,UAAM,UAAU,MAAM,IAAI,aAAa,SAAS;AAChD,UAAM,WAAW,MAAM,IAAI,WAAW,OAAO;AAC7C,WAAO,EAAE,SAAS,SAAS;AAAA,EAC7B,CAAC;AACH;;;AEtEA,SAAS,gBAAAC,qBAAoB;AAC7B,SAAS,OAAAC,YAAW;AAGpB,IAAM,sBAAsB;AAC5B,IAAM,UAAU;AAEhB,IAAM,sBAAsB;AAKrB,IAAM,wBAAwB;AAoC9B,SAAS,SAAS,GAAmB;AAC1C,SAAO,EACJ,KAAK,EACL,QAAQ,gBAAgB,EAAE,EAC1B,QAAQ,iBAAiB,EAAE,EAC3B,MAAM,GAAG,EAAE,CAAC,EACZ,QAAQ,WAAW,EAAE,EACrB,YAAY;AACjB;AASO,SAAS,0BAA0B,SAAsB,MAAwB;AACtF,QAAM,SAAS,SAAS,IAAI;AAC5B,QAAM,UAAU,QAAQ,OAAO,CAAC,MAAM,SAAS,EAAE,OAAO,MAAM,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO;AAC1F,QAAM,UAAU,QAAQ,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,WAAW,YAAY,CAAC;AAC9E,QAAM,WAAW,QAAQ,OAAO,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,WAAW,YAAY,CAAC;AAChF,SAAO,CAAC,GAAG,SAAS,GAAG,QAAQ;AACjC;AAGA,SAASC,KAAI,GAAiB;AAC5B,SAAO,EAAE,YAAY,EAAE,MAAM,GAAG,EAAE;AACpC;AAWO,SAAS,eACd,MACoB;AACpB,MAAI;AACJ,aAAW,KAAK,MAAM;AACpB,QAAI,OAAO,EAAE,aAAa,SAAU;AACpC,UAAM,cAAc,EAAE,eAAe;AACrC,QACE,SAAS,UACT,cAAc,KAAK,eAClB,gBAAgB,KAAK,eAAe,EAAE,WAAW,KAAK,UACvD;AACA,aAAO,EAAE,UAAU,EAAE,UAAU,YAAY;AAAA,IAC7C;AAAA,EACF;AACA,SAAO,MAAM;AACf;AAcO,SAAS,oBACd,MACA,YACoB;AACpB,QAAM,OAAO,WAAW,YAAY;AACpC,QAAM,QAAQ,KAAK;AAAA,IACjB,CAAC,MAAM,OAAO,EAAE,aAAa,aAAa,EAAE,OAAO,CAAC,KAAK,IAAI,YAAY,MAAM;AAAA,EACjF;AACA,MAAI,MAAO,QAAO,MAAM;AACxB,SAAO,eAAe,IAAI;AAC5B;AAOA,IAAM,4BAAN,cAAwC,MAAM;AAAA,EACnC,wBAAwB;AAAA,EACjC,YAAY,SAAiB,MAAc;AACzC,UAAM,uCAAuC,IAAI,kBAAkB,OAAO,EAAE;AAAA,EAC9E;AACF;AAcA,eAAsB,oBACpB,GACA,aACA,WACyB;AACzB,QAAM,MAAM,KAAK,MAAMC,cAAa,EAAE,SAAS,MAAM,CAAC;AAKtD,MAAI;AACF,WAAO,MAAM,oBAAoB,EAAE,UAAU,kBAAkB,OAAO,YAAY;AAChF,YAAM,MAAM,IAAIC,KAAI;AAAA,QAClB,OAAO,IAAI;AAAA,QACX,KAAK,IAAI;AAAA,QACT,QAAQ,CAAC,mBAAmB;AAAA,QAC5B;AAAA,MACF,CAAC;AAED,YAAM,WAAW,EAAE,UAAU,KAAK;AAClC,UAAI;AACJ,UAAI,UAAU;AACZ,qBAAa,CAAC,QAAQ;AAAA,MACxB,OAAO;AACL,cAAM,OAAO,MAAM,IAAI,QAAqC;AAAA,UAC1D,KAAK,GAAG,OAAO;AAAA,UACf,QAAQ;AAAA,QACV,CAAC;AACD,qBAAa,0BAA0B,KAAK,KAAK,aAAa,CAAC,GAAG,EAAE,IAAI;AACxE,YAAI,WAAW,WAAW,EAAG,OAAM,IAAI,0BAA0B,SAAS,EAAE,IAAI;AAAA,MAClF;AAEA,iBAAW,YAAY,YAAY;AACjC,cAAM,MAAM,MAAM,IAAI,QAEnB;AAAA,UACD,KAAK,GAAG,OAAO,UAAU,mBAAmB,QAAQ,CAAC;AAAA,UACrD,QAAQ;AAAA,UACR,MAAM;AAAA,YACJ,WAAWF,KAAI,WAAW;AAAA,YAC1B,SAASA,KAAI,SAAS;AAAA,YACtB,YAAY,CAAC,OAAO;AAAA,YACpB,uBAAuB;AAAA,cACrB;AAAA,gBACE,SAAS;AAAA,kBACP,EAAE,WAAW,SAAS,UAAU,YAAY,YAAY,EAAE,MAAM,YAAY,EAAE;AAAA,gBAChF;AAAA,cACF;AAAA,YACF;AAAA,YACA,UAAU;AAAA,UACZ;AAAA,QACF,CAAC;AACD,cAAM,MAAM,oBAAoB,IAAI,KAAK,QAAQ,CAAC,GAAG,EAAE,MAAM,YAAY,CAAC;AAC1E,YAAI,OAAO,QAAQ,UAAU;AAG3B,iBAAO;AAAA,YACL,cAAc,OAAO;AAAA,YACrB,UAAU,KAAK,IAAI,GAAG,KAAK,MAAM,GAAG,CAAC;AAAA,YACrC,eAAe;AAAA,UACjB;AAAA,QACF;AAAA,MACF;AAEA,aAAO,EAAE,cAAc,OAAO,UAAU,MAAM,eAAe,KAAK;AAAA,IACpE,CAAC;AAAA,EACH,SAAS,GAAG;AAKV,QAAI,aAAa;AACf,aAAO,EAAE,cAAc,OAAO,UAAU,MAAM,eAAe,MAAM;AACrE,UAAM;AAAA,EACR;AACF;;;AJ3LA,eAAsB,mBACpB,MACA,OAA0B,CAAC,GACT;AAClB,MAAI,CAAC,KAAK,IAAK,QAAO;AACtB,QAAM,WAAW,KAAK,YAAY;AAClC,QAAM,SAAS,KAAK,UAAU;AAC9B,MAAI;AACF,UAAM,MAAM,MAAM,SAAS,EAAE,KAAK,KAAK,KAAK,MAAM,SAAS,KAAK,IAAI,EAAE,CAAC;AACvE,UAAM,OAAO,KAAK,IAAI,gBAAgB,IAAI,OAAO,IAAI,UAAU,IAAI,WAAW;AAC9E,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,YAAQ;AAAA,MACN,2CAAsC,KAAK,IAAI,KAC7C,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CACjD;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;AA2DA,SAAS,kBAAkB,SAAuC;AAChE,QAAM,EAAE,QAAQ,QAAQ,SAAS,SAAS,IAAI;AAC9C,MAAI,WAAW,QAAQ,WAAW,QAAQ,YAAY,QAAQ,aAAa,MAAM;AAC/E,UAAM,IAAI;AAAA,MACR,SAAS,QAAQ,IAAI;AAAA,IAEvB;AAAA,EACF;AACA,SAAO,EAAE,aAAa,QAAQ,eAAe,QAAQ,eAAe,SAAS,KAAK,SAAS;AAC7F;AAEA,SAAS,QAAQ,OAAa,GAAiB;AAK7C,QAAM,MAAM,IAAI,KAAK,KAAK;AAC1B,MAAI,WAAW,IAAI,WAAW,IAAI,CAAC;AACnC,SAAO;AACT;AAYA,eAAsB,mBACpB,MACA,SACA,YACA,UAAwB,CAAC,GACH;AACtB,QAAM,SAAS,kBAAkB,OAAO;AAExC,QAAM,QAAQ,oBAAI,KAAK;AACvB,QAAM,OAAO,SAAS,QAAQ,IAAI;AAElC,QAAM,cACJ,SAAS,OAAO,MAAM,kBAAkB,MAAM,SAAS,YAAY,KAAK,IAAI,QAAQ,OAAO,EAAE;AAE/F,QAAM,YAAY;AAClB,QAAM,cAAc;AAMpB,QAAM,iBACJ,eAAe,iBAAiB,QAAQ,wBACpC,IAAI,KAAK,QAAQ,qBAAqB,IACtC;AAON,QAAM,WACJ,SAAS,OAAO,MAAM,aAAa,SAAS,aAAa,SAAS,IAAI;AACxE,QAAM,eACJ,SAAS,OACL,MAAM,YAAY,SAAS,aAAa,SAAS;AAAA;AAAA;AAAA,IAGjD;AAAA,MACE,GAAG;AAAA,MACH,oBAAoB;AAAA,MACpB,iBAAiB;AAAA,MACjB,eAAe;AAAA,IACjB;AAAA;AACN,QAAM,UAAU,SAAS;AACzB,QAAM,SAAS,aAAa;AAC5B,QAAM,eAA8B;AAAA,IAClC,GAAI,SAAS,aAAc,CAAC,IAAI,IAAc,CAAC;AAAA,IAC/C,GAAI,aAAa,aAAc,CAAC,QAAQ,IAAc,CAAC;AAAA,EACzD;AAWA,MAAI,SAAS,QAAQ,QAAQ,kBAAkB,OAAO;AACpD,UAAM,mBAAmB,SAAS,QAAQ,iBAAiB,CAAC,CAAC;AAAA,EAC/D;AAEA,QAAM,UAAU,GAAG,IAAI;AACvB,QAAM,EAAE,KAAK,IAAI,MAAM,iBAAiB;AAAA,IACtC,UAAU,QAAQ;AAAA,IAClB,SAAS,QAAQ;AAAA,IACjB;AAAA,IACA;AAAA,IACA,YAAY;AAAA,IACZ,gBAAgB,SAAS;AAAA,IACzB,iBAAiB,SAAS;AAAA,IAC1B,gBAAgB,QAAQ,eAAgB,OAAO,YAAY,SAAa;AAAA,IACxE;AAAA,IACA,YAAY;AAAA,IACZ,MAAM,YAAY,OAAO;AAAA,IACzB,gBAAgB;AAAA,EAClB,CAAC;AAED,MAAI,QAAQ,aAAa;AACvB,UAAM,OAAO,QAAQ,eAAe,WAAW,IAAI;AACnD,UAAM,MAAMG,SAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AAC9C,UAAM,UAAU,MAAM,MAAM,OAAO;AACnC,WAAO;AAAA,MACL,WAAW;AAAA,MACX,UAAU;AAAA,MACV;AAAA,MACA;AAAA,MACA,qBAAqB,aAAa;AAAA,MAClC,uBAAuB,aAAa;AAAA,MACpC,QAAQ;AAAA,MACR,eAAe,CAAC;AAAA,IAClB;AAAA,EACF;AAEA,MAAI,SAAS,KAAM,OAAM,IAAI,MAAM,sCAAsC;AAOzE,MAAI,aAAa,MAAM,QAAQ,QAAQ,QAAQ,iBAAiB,QAAQ,WAAW,GAAG;AACpF,QAAI;AACF,YAAM;AAAA,QACJ;AAAA,QACA,QAAQ;AAAA,QACR,aAAa,SAAS,IAAI,MAAM,YAAY,IAAI;AAAA,MAClD;AAAA,IACF,SAAS,GAAG;AACV,cAAQ,KAAK,6CAAwC,QAAQ,IAAI,KAAM,EAAY,OAAO,EAAE;AAAA,IAC9F;AAAA,EACF;AASA,MAAI,QAAQ,eAAe;AACzB,UAAM,gBAAgB,QAAQ,eAAe,MAAM,WAAW,IAAI;AAClE,UAAMC,WAAU,MAAM,WAAW,MAAM;AAAA,MACrC,IAAI,QAAQ;AAAA,MACZ,QAAQ,QAAQ;AAAA,MAChB;AAAA,IACF,CAAC;AACD,WAAO;AAAA,MACL,WAAW,QAAQ,eAAe;AAAA,MAClC,UAAU;AAAA,MACV;AAAA,MACA;AAAA,MACA,qBAAqB,aAAa;AAAA,MAClC,uBAAuB,aAAa;AAAA,MACpC,QAAQA,SAAQ;AAAA,MAChB,eAAeA,SAAQ;AAAA,IACzB;AAAA,EACF;AAMA,QAAM,WAAW,kBAAkB,SAAS,YAAY,aAAa,EAAE,QAAQ,aAAa,CAAC;AAC7F,QAAM,iBAAiB,CAAC,GAAG,SAAS,QAAQ,CAAC,EAC1C,OAAO,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,MAAM,EACrC,IAAI,CAAC,CAAC,KAAK,MAAM,KAAK;AACzB,QAAM,eAAe,OAAO,YAAY,QAAQ;AAEhD,QAAM,WAAW,GAAG,QAAQ,IAAI,WAAM,UAAU,WAAM,UAAU,YAAY,EAAE,MAAM,GAAG,EAAE,CAAC;AAC1F,QAAM,UAAU,MAAM,YAAY,MAAM;AAAA,IACtC;AAAA,IACA,QAAQ,QAAQ;AAAA,IAChB;AAAA,IACA,QAAQ,QAAQ,UAAU,UAAU,YAAY,EAAE,MAAM,GAAG,CAAC;AAAA,IAC5D;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY;AAAA,IACZ;AAAA,IACA,GAAI,UAAU,EAAE,gBAAgB,QAAQ,SAAS,iBAAiB,QAAQ,SAAS,IAAI,CAAC;AAAA,IACxF,GAAI,SAAS,EAAE,kBAAkB,OAAO,aAAa,IAAI,CAAC;AAAA,IAC1D,GAAI,QAAQ,gBAAgB,OAAO,aAAa,OAC5C,EAAE,gBAAgB,OAAO,SAAS,IAClC,CAAC;AAAA,IACL;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,gBAAgB,QAAQ,IAAI,MAAM,WAAW,IAAI;AACvD,QAAM,UAAU,MAAM,WAAW,MAAM;AAAA,IACrC,IAAI,QAAQ;AAAA,IACZ,QAAQ,QAAQ;AAAA,IAChB;AAAA,EACF,CAAC;AAED,SAAO;AAAA,IACL,WAAW;AAAA,IACX,UAAU;AAAA,IACV;AAAA,IACA;AAAA,IACA,qBAAqB,aAAa;AAAA,IAClC,uBAAuB,aAAa;AAAA,IACpC,QAAQ,QAAQ;AAAA,IAChB,eAAe,QAAQ;AAAA,EACzB;AACF;AAKA,eAAe,gBACb,OACA,MACA,WACA,MACe;AACf,QAAM,eAAe,GAAG,IAAI,IAAI,UAAU,YAAY,EAAE,MAAM,GAAG,EAAE,CAAC;AACpE,QAAM,iBAAiB,OAAO,iBAAiB,MAAM,cAAc,WAAW;AAChF;AAMA,IAAM,gBAAmC,EAAE,OAAO,MAAM,YAAY,MAAM;AAS1E,eAAsB,aACpB,SACA,aACA,WAC4D;AAC5D,QAAM,MAAM,aAAa;AACzB,MAAI,CAAC,OAAO,CAAC,QAAQ,cAAe,QAAO;AAC3C,MAAI;AACF,UAAM,QAAQ,MAAM;AAAA,MAClB,EAAE,YAAY,QAAQ,eAAe,UAAU,IAAI,UAAU,SAAS,IAAI,QAAQ;AAAA,MAClF;AAAA,MACA;AAAA,IACF;AACA,WAAO,EAAE,OAAO,YAAY,MAAM;AAAA,EACpC,SAAS,GAAG;AACV,YAAQ,KAAK,yBAAoB,QAAQ,IAAI,KAAM,EAAY,OAAO,EAAE;AACxE,WAAO,EAAE,OAAO,MAAM,YAAY,KAAK;AAAA,EACzC;AACF;AA6CA,eAAsB,YACpB,SACA,aACA,WAC2B;AAC3B,QAAM,MAAM,aAAa;AACzB,QAAM,WAAW,QAAQ,QAAQ,iBAAiB,QAAQ,WAAW;AACrE,MAAI,CAAC,OAAO,CAAC,UAAU;AACrB,UAAM,gBAAgB,YAAY,CAAC;AACnC,QAAI,eAAe;AACjB,cAAQ;AAAA,QACN,4IAAkI,QAAQ,IAAI;AAAA,MAChJ;AAAA,IACF;AACA,WAAO,EAAE,GAAG,eAAe,oBAAoB,OAAO,iBAAiB,OAAO,cAAc;AAAA,EAC9F;AACA,QAAM,WAAW,QAAQ,aAAa,KAAK;AAC3C,QAAM,QAAQ,YAAY,QAAQ;AAClC,QAAM,cAAc,CAAC;AACrB,MAAI;AACF,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,QACE,SAAS,IAAI;AAAA,QACb,UAAU,IAAI;AAAA,QACd,UAAU,QAAQ,yBAAyB;AAAA,QAC3C,MAAM,QAAQ;AAAA,QACd;AAAA,MACF;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,UAAM,kBAAkB,CAAC,MAAM;AAC/B,QAAI,iBAAiB;AACnB,cAAQ;AAAA,QACN,qDAAgD,QAAQ,GAAG,QAAQ,QAAQ,IAAI;AAAA,MACjF;AAAA,IACF;AACA,UAAM,qBAAqB,MAAM,iBAAiB,eAAe,MAAM,aAAa;AACpF,QAAI,oBAAoB;AACtB,cAAQ;AAAA,QACN,qCAAgC,KAAK,sCAAsC,QAAQ,IAAI;AAAA,MACzF;AAAA,IACF;AACA,WAAO,EAAE,OAAO,YAAY,OAAO,oBAAoB,iBAAiB,eAAe,MAAM;AAAA,EAC/F,SAAS,GAAG;AACV,YAAQ,KAAK,sCAAiC,QAAQ,IAAI,KAAM,EAAY,OAAO,EAAE;AACrF,WAAO;AAAA,MACL,OAAO;AAAA,MACP,YAAY;AAAA,MACZ,oBAAoB;AAAA,MACpB,iBAAiB;AAAA,MACjB,eAAe;AAAA,IACjB;AAAA,EACF;AACF;AAEA,eAAe,kBACb,MACA,SACA,YACA,OACe;AACf,QAAM,QAAQ,MAAM,mBAAmB,MAAM,QAAQ,EAAE;AACvD,QAAM,WAAW,MACd,OAAO,CAAC,MAAM,EAAE,eAAe,cAAc,EAAE,SAAS,EACxD,IAAI,CAAC,MAAM,EAAE,SAAU,EACvB,KAAK;AACR,QAAM,SAAS,SAAS,SAAS,SAAS,CAAC;AAC3C,MAAI,CAAC,OAAQ,QAAO,QAAQ,OAAO,EAAE;AAKrC,QAAM,QAAQ,IAAI,KAAK,MAAM;AAC7B,QAAM,WAAW,MAAM,WAAW,IAAI,CAAC;AACvC,SAAO;AACT;","names":["dirname","pos","MS_PER_DAY","readFileSync","JWT","ymd","readFileSync","JWT","dirname","outcome"]}

package/dist/{chunk-CASCWQQX.js → chunk-73UFRZKY.js} RENAMED Viewed

@@ -60,37 +60,53 @@ export default createSvelteConfig({
 });
 `
 };
-var ci = {
-  config: "ci",
-  path: ".github/workflows/ci.yml",
-  contents: `name: ci
-on:
-  pull_request:
-  push:
-    branches: [main]
-jobs:
-  ci:
-    uses: reddoorla/.github/.github/workflows/ci.yml@78c4da64b675f0f474961f12715f2a4c09d46eb5 # v1.0.0
-`
-};
 var renovateAction = {
   config: "renovate-action",
   path: ".github/workflows/renovate.yml",
   contents: `name: renovate
 on:
   schedule:
-    - cron: "0 7 * * 1"
+    # Twice daily. GitHub's platform auto-merge is disabled fleet-wide, so Renovate
+    # performs its own merges from inside this run \u2014 which means this cron is the
+    # MERGE cadence, not just the PR-creation cadence.
+    - cron: 0 */12 * * *
   workflow_dispatch:
+permissions:
+  contents: read
 jobs:
   renovate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: renovatebot/github-action@v46.1.14
+      # Renovate authenticates as the reddoor-renovate GitHub App (installed
+      # org-wide, "All repositories" \u2014 future repos are auto-covered), NOT as an
+      # operator PAT. Why: the App is a distinct identity, so the audit trail
+      # finally distinguishes bot from human (the 2026-07-26 unreviewed-major
+      # forensics took hours precisely because it couldn't); the credential is
+      # permission-scoped and centrally revocable instead of a fleet-write PAT;
+      # and the installation gets its own API-quota pool instead of sharing the
+      # operator's. The minted token is scoped to THIS repository only
+      # (create-github-app-token's default when owner/repositories are omitted).
+      # RENOVATE_APP_ID / RENOVATE_APP_PRIVATE_KEY are org-level (all-repos
+      # visibility) \u2014 nothing to configure per repo.
+      # Digest-pinned: this workflow mints a repo-write token, so a mutable tag
+      # ref here is a supply-chain hole \u2014 a retagged \`@v3\`/\`@v46\` would run
+      # attacker code with that token. Pin to the commit; Renovate bumps these.
+      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        id: app-token
+        with:
+          app-id: \${{ vars.RENOVATE_APP_ID }}
+          private-key: \${{ secrets.RENOVATE_APP_PRIVATE_KEY }}
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: renovatebot/github-action@1a96852b0384df1837619d04c60b2d10d1f9ff08 # v46.1.21
         with:
-          token: \${{ secrets.RENOVATE_TOKEN }}
+          token: \${{ steps.app-token.outputs.token }}
         env:
           RENOVATE_REPOSITORIES: \${{ github.repository }}
+          # Commit/PR identity = the App's bot user, so gitAuthor matches the
+          # token identity (mismatched authors read as "operator pushed this").
+          # 312185038 = the bot's user id (gh api 'users/reddoor-renovate[bot]' --jq .id).
+          RENOVATE_USERNAME: reddoor-renovate[bot]
+          RENOVATE_GIT_AUTHOR: reddoor-renovate[bot] <312185038+reddoor-renovate[bot]@users.noreply.github.com>
 `
 };
 var renovateConfig = {
@@ -145,7 +161,6 @@ var ALL_TEMPLATES = [
   lighthouse,
   playwrightA11y,
   svelte,
-  ci,
   renovateAction,
   renovateConfig,
   netlify
@@ -158,4 +173,4 @@ export {
   ALL_TEMPLATES,
   templatesByName
 };
-//# sourceMappingURL=chunk-CASCWQQX.js.map
+//# sourceMappingURL=chunk-73UFRZKY.js.map

package/dist/chunk-73UFRZKY.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"sources":["../src/recipes/sync-configs/templates.ts"],"sourcesContent":["import type { ConfigName } from \"../../types.js\";\n\nexport type ConfigTemplate = {\n config: ConfigName;\n path: string;\n contents: string;\n};\n\nconst eslint: ConfigTemplate = {\n config: \"eslint\",\n path: \"eslint.config.js\",\n contents: `import { createEslintConfig } from \"@reddoorla/maintenance/configs/eslint\";\nimport svelteConfig from \"./svelte.config.js\";\n\nexport default createEslintConfig({ svelteConfig });\n`,\n};\n\nconst prettier: ConfigTemplate = {\n config: \"prettier\",\n path: \".prettierrc.json\",\n contents: `{\n \"trailingComma\": \"all\",\n \"singleQuote\": false,\n \"printWidth\": 100,\n \"plugins\": [\"prettier-plugin-svelte\"]\n}\n`,\n};\n\nconst prettierIgnore: ConfigTemplate = {\n config: \"prettier-ignore\",\n path: \".prettierignore\",\n contents: `pnpm-lock.yaml\n.svelte-kit/\nbuild/\n.netlify/\ndist/\n`,\n};\n\nconst lighthouse: ConfigTemplate = {\n config: \"lighthouse\",\n path: \"lighthouserc.json\",\n contents: `${JSON.stringify(\n {\n $note:\n \"Generated by @reddoorla/maintenance sync-configs; edit src/configs/lighthouse.ts in the package instead.\",\n extends: \"@reddoorla/maintenance/configs/lighthouse\",\n },\n null,\n 2,\n )}\n`,\n};\n\nconst playwrightA11y: ConfigTemplate = {\n config: \"playwright-a11y\",\n path: \"playwright.config.ts\",\n contents: `export { default } from \"@reddoorla/maintenance/configs/playwright-a11y\";\n`,\n};\n\nconst svelte: ConfigTemplate = {\n config: \"svelte\",\n path: \"svelte.config.js\",\n contents: `import { createSvelteConfig } from \"@reddoorla/maintenance/configs/svelte\";\nimport adapter from \"@sveltejs/adapter-netlify\";\n\n/** @type {import('@sveltejs/kit').Config} */\nexport default createSvelteConfig({\n kit: { adapter: adapter({ edge: false, split: false }) },\n});\n`,\n};\n\n// There is deliberately NO ci.yml template. Every live fleet ci.yml carries\n// per-site values a static template cannot own (`netlify-site:`, plus\n// `permissions:` and `node-version:` inputs) — an exact-match heal against a\n// canonical byte template would strip them fleet-wide in green auto-mergeable\n// PRs (the \"armed clobber\" the 2026-08-02 architecture review flagged; it was\n// this file's `ci` entry). Ownership is split instead: the STARTER clone\n// provides each site's ci.yml shape at bootstrap, and Renovate's\n// github-actions manager bumps the pinned reusable-workflow ref per repo when\n// reddoorla/.github tags a new version. The caller job name `ci` + the\n// reusable workflow's job `ci` produce the check context \"ci / ci\" —\n// REQUIRED_CHECK in src/recipes/self-updating/index.ts depends on that naming.\n\nconst renovateAction: ConfigTemplate = {\n config: \"renovate-action\",\n path: \".github/workflows/renovate.yml\",\n contents: `name: renovate\non:\n schedule:\n # Twice daily. GitHub's platform auto-merge is disabled fleet-wide, so Renovate\n # performs its own merges from inside this run — which means this cron is the\n # MERGE cadence, not just the PR-creation cadence.\n - cron: 0 */12 * * *\n workflow_dispatch:\npermissions:\n contents: read\njobs:\n renovate:\n runs-on: ubuntu-latest\n steps:\n # Renovate authenticates as the reddoor-renovate GitHub App (installed\n # org-wide, \"All repositories\" — future repos are auto-covered), NOT as an\n # operator PAT. Why: the App is a distinct identity, so the audit trail\n # finally distinguishes bot from human (the 2026-07-26 unreviewed-major\n # forensics took hours precisely because it couldn't); the credential is\n # permission-scoped and centrally revocable instead of a fleet-write PAT;\n # and the installation gets its own API-quota pool instead of sharing the\n # operator's. The minted token is scoped to THIS repository only\n # (create-github-app-token's default when owner/repositories are omitted).\n # RENOVATE_APP_ID / RENOVATE_APP_PRIVATE_KEY are org-level (all-repos\n # visibility) — nothing to configure per repo.\n # Digest-pinned: this workflow mints a repo-write token, so a mutable tag\n # ref here is a supply-chain hole — a retagged \\`@v3\\`/\\`@v46\\` would run\n # attacker code with that token. Pin to the commit; Renovate bumps these.\n - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0\n id: app-token\n with:\n app-id: \\${{ vars.RENOVATE_APP_ID }}\n private-key: \\${{ secrets.RENOVATE_APP_PRIVATE_KEY }}\n - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7\n - uses: renovatebot/github-action@1a96852b0384df1837619d04c60b2d10d1f9ff08 # v46.1.21\n with:\n token: \\${{ steps.app-token.outputs.token }}\n env:\n RENOVATE_REPOSITORIES: \\${{ github.repository }}\n # Commit/PR identity = the App's bot user, so gitAuthor matches the\n # token identity (mismatched authors read as \"operator pushed this\").\n # 312185038 = the bot's user id (gh api 'users/reddoor-renovate[bot]' --jq .id).\n RENOVATE_USERNAME: reddoor-renovate[bot]\n RENOVATE_GIT_AUTHOR: reddoor-renovate[bot] <312185038+reddoor-renovate[bot]@users.noreply.github.com>\n`,\n};\n\nconst renovateConfig: ConfigTemplate = {\n config: \"renovate-config\",\n path: \"renovate.json\",\n contents: `{\n \"$schema\": \"https://docs.renovatebot.com/renovate-schema.json\",\n \"extends\": [\"github>reddoorla/.github:renovate-config\"]\n}\n`,\n};\n\nconst netlify: ConfigTemplate = {\n config: \"netlify\",\n path: \"netlify.toml\",\n contents: `[build]\n command = \"pnpm build\"\n publish = \"build/\"\n functions = \"functions/\"\n\n[build.environment]\n NODE_VERSION = \"22\"\n COREPACK_INTEGRITY_KEYS = \"0\"\n\n# Baseline security headers for all responses. CSP is emitted per-response by\n# SvelteKit (see \\`kit.csp\\` in svelte.config.js) so it is intentionally omitted\n# here to avoid conflicting duplicates.\n[[headers]]\n for = \"/*\"\n [headers.values]\n Strict-Transport-Security = \"max-age=63072000; includeSubDomains; preload\"\n X-Content-Type-Options = \"nosniff\"\n X-Frame-Options = \"SAMEORIGIN\"\n Referrer-Policy = \"strict-origin-when-cross-origin\"\n Permissions-Policy = \"camera=(), microphone=(), geolocation=(), interest-cohort=()\"\n Cross-Origin-Opener-Policy = \"same-origin\"\n\n[[headers]]\n for = \"/favicon.png\"\n [headers.values]\n Cache-Control = \"public, max-age=31536000, immutable\"\n\n[[headers]]\n for = \"/_app/immutable/*\"\n [headers.values]\n Cache-Control = \"public, max-age=31536000, immutable\"\n`,\n};\n\nexport const ALL_TEMPLATES: ConfigTemplate[] = [\n eslint,\n prettier,\n prettierIgnore,\n lighthouse,\n playwrightA11y,\n svelte,\n renovateAction,\n renovateConfig,\n netlify,\n];\n\nexport function templatesByName(which: ConfigName[]): ConfigTemplate[] {\n return ALL_TEMPLATES.filter((t) => which.includes(t.config));\n}\n"],"mappings":";AAQA,IAAM,SAAyB;AAAA,EAC7B,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,UAAU;AAAA;AAAA;AAAA;AAAA;AAKZ;AAEA,IAAM,WAA2B;AAAA,EAC/B,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAOZ;AAEA,IAAM,iBAAiC;AAAA,EACrC,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAMZ;AAEA,IAAM,aAA6B;AAAA,EACjC,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,UAAU,GAAG,KAAK;AAAA,IAChB;AAAA,MACE,OACE;AAAA,MACF,SAAS;AAAA,IACX;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAAA;AAEH;AAEA,IAAM,iBAAiC;AAAA,EACrC,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,UAAU;AAAA;AAEZ;AAEA,IAAM,SAAyB;AAAA,EAC7B,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQZ;AAcA,IAAM,iBAAiC;AAAA,EACrC,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA6CZ;AAEA,IAAM,iBAAiC;AAAA,EACrC,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,UAAU;AAAA;AAAA;AAAA;AAAA;AAKZ;AAEA,IAAM,UAA0B;AAAA,EAC9B,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAgCZ;AAEO,IAAM,gBAAkC;AAAA,EAC7C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,SAAS,gBAAgB,OAAuC;AACrE,SAAO,cAAc,OAAO,CAAC,MAAM,MAAM,SAAS,EAAE,MAAM,CAAC;AAC7D;","names":[]}

package/dist/{chunk-D3DQFC32.js → chunk-ATJ6ZA2V.js} RENAMED Viewed

@@ -1,6 +1,6 @@
 import {
   withRecipe
-} from "./chunk-XKOZUVK2.js";
+} from "./chunk-ZTPPCHDB.js";
 import {
   defaultSpawn
 } from "./chunk-HVOOCK6L.js";
@@ -76,4 +76,4 @@ async function bumpDeps(site, opts = {}) {
 export {
   bumpDeps
 };
-//# sourceMappingURL=chunk-D3DQFC32.js.map
+//# sourceMappingURL=chunk-ATJ6ZA2V.js.map

package/dist/{chunk-ZO7WNY57.js → chunk-B5ZUQZFL.js} RENAMED Viewed

@@ -3,7 +3,7 @@ import {
 } from "./chunk-J7SZQUCW.js";
 import {
   withRecipe
-} from "./chunk-XKOZUVK2.js";
+} from "./chunk-ZTPPCHDB.js";
 import {
   bumpDep,
   readPackageJson,
@@ -243,4 +243,4 @@ async function upgradeSvelte4to5(site, opts = {}) {
 export {
   upgradeSvelte4to5
 };
-//# sourceMappingURL=chunk-ZO7WNY57.js.map
+//# sourceMappingURL=chunk-B5ZUQZFL.js.map

package/dist/{chunk-PH3AGF4Z.js → chunk-DC5H7KEQ.js} RENAMED Viewed

@@ -1,6 +1,6 @@
 import {
   runMigrations
-} from "./chunk-HIN3P4ZN.js";
+} from "./chunk-4SOCPK7A.js";
 import {
   defaultCredentialsPath
 } from "./chunk-6VAL7XJT.js";
@@ -48,4 +48,4 @@ export {
   readDbConfig,
   openDb
 };
-//# sourceMappingURL=chunk-PH3AGF4Z.js.map
+//# sourceMappingURL=chunk-DC5H7KEQ.js.map

package/dist/chunk-DRDAEELJ.js ADDED Viewed

@@ -0,0 +1,197 @@
+// src/blux/grid/extract-map.ts
+var SCRIPT_RE = /<script\b[^>]*>([\s\S]*?)<\/script>/g;
+function findScript(html, marker) {
+  for (const m of html.matchAll(SCRIPT_RE)) {
+    const body = m[1];
+    if (body !== void 0 && marker.test(body)) return body;
+  }
+  return null;
+}
+function extractStyles(script) {
+  const at = script.indexOf("styles:[");
+  if (at === -1) return [];
+  const start = at + "styles:".length;
+  let depth = 0;
+  for (let i = start; i < script.length; i++) {
+    const ch = script[i];
+    if (ch === "[") depth++;
+    else if (ch === "]") {
+      depth--;
+      if (depth === 0) {
+        try {
+          const raw = script.slice(start, i + 1);
+          const jsonish = raw.replace(/([{,])\s*([A-Za-z_][A-Za-z0-9_.]*)\s*:/g, '$1"$2":');
+          const parsed = JSON.parse(jsonish);
+          return Array.isArray(parsed) ? parsed : [];
+        } catch {
+          return [];
+        }
+      }
+    }
+  }
+  return [];
+}
+var LAYER_RE = /(\w+)\s*:\s*new google\.maps\.KmlLayer\(\{([^}]*)\}\)/g;
+function extractMapConfig(html) {
+  const init = findScript(html, /function initMap\(\)[\s\S]*new google\.maps\.Map/);
+  if (!init) return null;
+  const mountId = /getElementById\(\s*["']([^"']+)["']\s*\)/.exec(init)?.[1];
+  if (!mountId) return null;
+  const layers = [];
+  let mid;
+  for (const m of init.matchAll(LAYER_RE)) {
+    const name = m[1];
+    const args = m[2];
+    if (!name || args === void 0) continue;
+    const layerMid = /[?&]mid=([^&"']+)/.exec(args)?.[1];
+    const lid = /[?&]lid=([^&"']+)/.exec(args)?.[1];
+    if (!layerMid || !lid) continue;
+    mid ??= layerMid;
+    layers.push({
+      name,
+      lid,
+      initiallyVisible: /\bmap\s*:\s*map\b/.test(args),
+      preserveViewport: /preserveViewport\s*:\s*true/.test(args)
+    });
+  }
+  if (!mid || layers.length === 0) return null;
+  const centerM = /center\s*:\s*\{\s*lat\s*:\s*(-?[\d.]+)\s*,\s*lng\s*:\s*(-?[\d.]+)\s*\}/.exec(
+    init
+  );
+  const zoomM = /zoom\s*:\s*(\d+)/.exec(init);
+  const mountTag = new RegExp(`<[^>]*\\bid=["']${mountId}["'][^>]*>`, "i").exec(html)?.[0] ?? "";
+  const height = /height\s*:\s*([\d.]+(?:px|%|vh|vw|em|rem))/i.exec(mountTag)?.[1];
+  const toggles = extractToggles(html);
+  return {
+    mountId,
+    mid,
+    layers,
+    toggles,
+    styles: extractStyles(init),
+    ...centerM?.[1] && centerM[2] ? { center: { lat: Number(centerM[1]), lng: Number(centerM[2]) } } : {},
+    ...zoomM?.[1] ? { zoom: Number(zoomM[1]) } : {},
+    ...height ? { height } : {},
+    ...toggles.length ? { defaultToggle: 0 } : {}
+  };
+}
+function makeIsMapMount(config) {
+  const marker = `id="${config.mountId}"`;
+  return (node) => node.kind === "raw" && node.html.includes(marker);
+}
+function extractToggles(html) {
+  const labels = [...html.matchAll(/map_icon_text">([^<]*)</g)].map((m) => m[1]).filter((l) => l !== void 0);
+  const click = findScript(html, /clickMap\s*=\s*\{\s*0\s*:/);
+  if (!click || labels.length === 0) return [];
+  const bodyM = /clickMap\s*=\s*(\{[\s\S]*?\}\})\s*;/.exec(click);
+  if (!bodyM?.[1]) return [];
+  const groups = [];
+  for (const g of bodyM[1].matchAll(/(\d+)\s*:\s*function\s*\(onoff\)\s*\{([^}]*)\}/g)) {
+    const idx = Number(g[1]);
+    const body = g[2] ?? "";
+    const layerNames = [
+      ...new Set(
+        [...body.matchAll(/mapLayers\.(\w+)\./g)].map((m) => m[1]).filter((n) => n !== void 0)
+      )
+    ];
+    const label = labels[idx];
+    if (label === void 0) return [];
+    groups[idx] = { label, layers: layerNames, panelIndex: idx };
+  }
+  return groups.length === labels.length && groups.every((g) => g !== void 0) ? groups : [];
+}
+// src/blux/freeze/frozen-page-type.ts
+var FROZEN_PAGE_TYPE = "frozen_page";
+var FROZEN_PAGE_LABEL = "Frozen Page (Blux migration)";
+function frozenPageCustomType() {
+  return {
+    id: FROZEN_PAGE_TYPE,
+    label: FROZEN_PAGE_LABEL,
+    repeatable: true,
+    json: {
+      id: FROZEN_PAGE_TYPE,
+      label: FROZEN_PAGE_LABEL,
+      format: "page",
+      repeatable: true,
+      status: true,
+      json: {
+        Main: {
+          uid: { type: "UID", config: { label: "UID", placeholder: "" } },
+          title: {
+            type: "Text",
+            config: { label: "Title", placeholder: "" }
+          },
+          slots: {
+            type: "Group",
+            config: {
+              label: "Slots",
+              fields: {
+                key: { type: "Text", config: { label: "Key", placeholder: "" } },
+                kind: {
+                  type: "Select",
+                  config: {
+                    label: "Kind",
+                    placeholder: "",
+                    options: ["text", "image"]
+                  }
+                },
+                text: {
+                  type: "StructuredText",
+                  config: {
+                    label: "Text",
+                    placeholder: "",
+                    allowTargetBlank: true,
+                    multi: "paragraph,preformatted,heading1,heading2,heading3,heading4,heading5,heading6,strong,em,hyperlink,image,embed,list-item,o-list-item,rtl"
+                  }
+                },
+                image: {
+                  type: "Image",
+                  config: { label: "Image", constraint: {}, thumbnails: [] }
+                },
+                // Non-image media (video/pdf/etc.) — an Image field rejects a
+                // non-image asset, so those slots carry the Prismic-hosted url
+                // here instead; the render reads image.url ?? media_url.
+                media_url: {
+                  type: "Text",
+                  config: { label: "Media URL", placeholder: "" }
+                }
+              }
+            }
+          }
+        },
+        "SEO & Metadata": {
+          meta_title: {
+            type: "Text",
+            config: {
+              label: "Meta Title",
+              placeholder: "A title of the page used for social media and search engines"
+            }
+          },
+          meta_description: {
+            type: "Text",
+            config: {
+              label: "Meta Description",
+              placeholder: "A brief summary of the page"
+            }
+          },
+          meta_image: {
+            type: "Image",
+            config: {
+              label: "Meta Image",
+              constraint: { width: 2400, height: 1260 },
+              thumbnails: []
+            }
+          }
+        }
+      }
+    }
+  };
+}
+export {
+  extractMapConfig,
+  makeIsMapMount,
+  FROZEN_PAGE_TYPE,
+  frozenPageCustomType
+};
+//# sourceMappingURL=chunk-DRDAEELJ.js.map

package/dist/chunk-DRDAEELJ.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"sources":["../src/blux/grid/extract-map.ts","../src/blux/freeze/frozen-page-type.ts"],"sourcesContent":["// Plan 4 of docs/superpowers/specs/2026-07-08-blux-faithful-grid-slices-design.md:\n// deterministic extraction of the Blux map widget's config from the rendered\n// index.html. The initMap script carries mount/styles/layers; the toggle-chip\n// labels live in the band markup and the group logic in the site's clickMap\n// script. The Google API key lives only in the separate loader URL and is\n// deliberately NOT extracted — render uses VITE_GOOGLE_MAPS_KEY.\n\nimport type { Node } from \"./types.js\";\n\nexport type MapKmlLayer = {\n /** mapLayers key in the source script, e.g. \"Hotels\". */\n name: string;\n lid: string;\n /** Constructed with `map: map` — visible before any toggle. */\n initiallyVisible: boolean;\n /** Absent in source = false = layer fits the viewport to its KML bounds. */\n preserveViewport: boolean;\n};\n\nexport type MapToggleGroup = {\n label: string;\n layers: string[];\n /** The content panel (0-based `cagrid` cell) this chip reveals — chip index\n * `i` shows panel `i`, hiding the others; pairs with `MapConfig.defaultToggle`. */\n panelIndex: number;\n};\n\nexport type MapConfig = {\n mountId: string;\n mid: string;\n layers: MapKmlLayer[];\n toggles: MapToggleGroup[];\n /** Google Maps style rules, verbatim JSON. */\n styles: unknown[];\n center?: { lat: number; lng: number };\n zoom?: number;\n /** The mount div's inline height (e.g. \"600px\"); absent = let the render decide. */\n height?: string;\n /** Which toggle/panel is active on load (source default = the first, 0). Present\n * only when there are toggles. */\n defaultToggle?: number;\n};\n\nconst SCRIPT_RE = /<script\\b[^>]*>([\\s\\S]*?)<\\/script>/g;\n\nfunction findScript(html: string, marker: RegExp): string | null {\n for (const m of html.matchAll(SCRIPT_RE)) {\n const body = m[1];\n if (body !== undefined && marker.test(body)) return body;\n }\n return null;\n}\n\n/** Balanced-bracket slice of the JSON array starting at `styles:[`. */\nfunction extractStyles(script: string): unknown[] {\n const at = script.indexOf(\"styles:[\");\n if (at === -1) return [];\n const start = at + \"styles:\".length;\n let depth = 0;\n for (let i = start; i < script.length; i++) {\n const ch = script[i];\n if (ch === \"[\") depth++;\n else if (ch === \"]\") {\n depth--;\n if (depth === 0) {\n try {\n // The Blux styles literal uses unquoted keys — quote them for JSON.parse.\n const raw = script.slice(start, i + 1);\n const jsonish = raw.replace(/([{,])\\s*([A-Za-z_][A-Za-z0-9_.]*)\\s*:/g, '$1\"$2\":');\n const parsed: unknown = JSON.parse(jsonish);\n return Array.isArray(parsed) ? parsed : [];\n } catch {\n return [];\n }\n }\n }\n }\n return [];\n}\n\nconst LAYER_RE = /(\\w+)\\s*:\\s*new google\\.maps\\.KmlLayer\$\\{([^}]*)\\}\$/g;\n\nexport function extractMapConfig(html: string): MapConfig | null {\n const init = findScript(html, /function initMap\$\$[\\s\\S]*new google\\.maps\\.Map/);\n if (!init) return null;\n\n const mountId = /getElementById\$\\s*[\"']([^\"']+)[\"']\\s*\$/.exec(init)?.[1];\n if (!mountId) return null;\n\n const layers: MapKmlLayer[] = [];\n let mid: string | undefined;\n for (const m of init.matchAll(LAYER_RE)) {\n const name = m[1];\n const args = m[2];\n if (!name || args === undefined) continue;\n const layerMid = /[?&]mid=([^&\"']+)/.exec(args)?.[1];\n const lid = /[?&]lid=([^&\"']+)/.exec(args)?.[1];\n if (!layerMid || !lid) continue;\n mid ??= layerMid;\n layers.push({\n name,\n lid,\n initiallyVisible: /\\bmap\\s*:\\s*map\\b/.test(args),\n preserveViewport: /preserveViewport\\s*:\\s*true/.test(args),\n });\n }\n if (!mid || layers.length === 0) return null;\n\n const centerM = /center\\s*:\\s*\\{\\s*lat\\s*:\\s*(-?[\\d.]+)\\s*,\\s*lng\\s*:\\s*(-?[\\d.]+)\\s*\\}/.exec(\n init,\n );\n const zoomM = /zoom\\s*:\\s*(\\d+)/.exec(init);\n\n // The mount div's own inline height (`<div id=\"burbank_map\" style=\"…height:600px\">`)\n // — it lives on the inner mount, not the section, so section-style capture misses it.\n const mountTag = new RegExp(`<[^>]*\\\\bid=[\"']${mountId}[\"'][^>]*>`, \"i\").exec(html)?.[0] ?? \"\";\n const height = /height\\s*:\\s*([\\d.]+(?:px|%|vh|vw|em|rem))/i.exec(mountTag)?.[1];\n\n const toggles = extractToggles(html);\n\n return {\n mountId,\n mid,\n layers,\n toggles,\n styles: extractStyles(init),\n ...(centerM?.[1] && centerM[2]\n ? { center: { lat: Number(centerM[1]), lng: Number(centerM[2]) } }\n : {}),\n ...(zoomM?.[1] ? { zoom: Number(zoomM[1]) } : {}),\n ...(height ? { height } : {}),\n ...(toggles.length ? { defaultToggle: 0 } : {}),\n };\n}\n\n/** The classifier predicate (plan-2 `ClassifyOptions.isMapMount`): matches the\n * raw node carrying the map mount element. Mounts parse to `raw` nodes; the\n * mount id survives verbatim in the serialized html. */\nexport function makeIsMapMount(config: MapConfig): (node: Node) => boolean {\n const marker = `id=\"${config.mountId}\"`;\n return (node) => node.kind === \"raw\" && node.html.includes(marker);\n}\n\n/** Pairs the band's map_icon chip labels (DOM order) with the clickMap\n * groups (index order). Either side missing → no toggles (map still renders\n * its initially-visible layers). */\nfunction extractToggles(html: string): MapToggleGroup[] {\n const labels = [...html.matchAll(/map_icon_text\">([^<]*)</g)]\n .map((m) => m[1])\n .filter((l): l is string => l !== undefined);\n const click = findScript(html, /clickMap\\s*=\\s*\\{\\s*0\\s*:/);\n if (!click || labels.length === 0) return [];\n const bodyM = /clickMap\\s*=\\s*(\\{[\\s\\S]*?\\}\\})\\s*;/.exec(click);\n if (!bodyM?.[1]) return [];\n const groups: MapToggleGroup[] = [];\n for (const g of bodyM[1].matchAll(/(\\d+)\\s*:\\s*function\\s*\$onoff\$\\s*\\{([^}]*)\\}/g)) {\n const idx = Number(g[1]);\n const body = g[2] ?? \"\";\n const layerNames = [\n ...new Set(\n [...body.matchAll(/mapLayers\\.(\\w+)\\./g)]\n .map((m) => m[1])\n .filter((n): n is string => n !== undefined),\n ),\n ];\n const label = labels[idx];\n if (label === undefined) return [];\n groups[idx] = { label, layers: layerNames, panelIndex: idx };\n }\n // Non-contiguous clickMap indices would leave holes that serialize as null.\n return groups.length === labels.length && groups.every((g) => g !== undefined) ? groups : [];\n}\n","// The migration-owned `frozen_page` custom type. A frozen Blux site keeps the\n// export's own markup as a byte-faithful template (a repo file) and exposes only\n// the editable leaves — text runs and image urls — as Prismic `slots`. `blux\n// migrate-frozen` POSTs one `frozen_page` document per page, so the migration\n// tool must OWN + push the type definition (a cloned starter repo does not ship\n// it — mirrors catalog-page-type.ts). Its `json` is the FULL Prismic Custom\n// Types API definition (id/label/format/status + the tabbed model), so\n// pushCustomTypes can ship it verbatim.\nimport type { PlanCustomType } from \"../emit/plan.js\";\n\nexport const FROZEN_PAGE_TYPE = \"frozen_page\";\nconst FROZEN_PAGE_LABEL = \"Frozen Page (Blux migration)\";\n\n/** The `frozen_page` custom type: a `format:\"page\"` doc holding the editable\n * slots of a frozen Blux page. The Main tab carries uid + title (a plain Text\n * field — the frozen render substitutes it back into the template's <title>)\n * plus the repeatable `slots` group; the \"SEO & Metadata\" tab mirrors the\n * catalog type's meta fields. Each `slots` row is one editable leaf: `key` (the\n * stable document-order slot key the template token carries), `kind` (a Select\n * pinning text|image so the render knows which field to read), `text` (Rich\n * Text — filled for text slots), `image` (Image — filled for image slots).\n * Shipped on EVERY frozen migrate so the migration owns the type it emits. */\nexport function frozenPageCustomType(): PlanCustomType {\n return {\n id: FROZEN_PAGE_TYPE,\n label: FROZEN_PAGE_LABEL,\n repeatable: true,\n json: {\n id: FROZEN_PAGE_TYPE,\n label: FROZEN_PAGE_LABEL,\n format: \"page\",\n repeatable: true,\n status: true,\n json: {\n Main: {\n uid: { type: \"UID\", config: { label: \"UID\", placeholder: \"\" } },\n title: {\n type: \"Text\",\n config: { label: \"Title\", placeholder: \"\" },\n },\n slots: {\n type: \"Group\",\n config: {\n label: \"Slots\",\n fields: {\n key: { type: \"Text\", config: { label: \"Key\", placeholder: \"\" } },\n kind: {\n type: \"Select\",\n config: {\n label: \"Kind\",\n placeholder: \"\",\n options: [\"text\", \"image\"],\n },\n },\n text: {\n type: \"StructuredText\",\n config: {\n label: \"Text\",\n placeholder: \"\",\n allowTargetBlank: true,\n multi:\n \"paragraph,preformatted,heading1,heading2,heading3,heading4,heading5,heading6,strong,em,hyperlink,image,embed,list-item,o-list-item,rtl\",\n },\n },\n image: {\n type: \"Image\",\n config: { label: \"Image\", constraint: {}, thumbnails: [] },\n },\n // Non-image media (video/pdf/etc.) — an Image field rejects a\n // non-image asset, so those slots carry the Prismic-hosted url\n // here instead; the render reads image.url ?? media_url.\n media_url: {\n type: \"Text\",\n config: { label: \"Media URL\", placeholder: \"\" },\n },\n },\n },\n },\n },\n \"SEO & Metadata\": {\n meta_title: {\n type: \"Text\",\n config: {\n label: \"Meta Title\",\n placeholder: \"A title of the page used for social media and search engines\",\n },\n },\n meta_description: {\n type: \"Text\",\n config: {\n label: \"Meta Description\",\n placeholder: \"A brief summary of the page\",\n },\n },\n meta_image: {\n type: \"Image\",\n config: {\n label: \"Meta Image\",\n constraint: { width: 2400, height: 1260 },\n thumbnails: [],\n },\n },\n },\n },\n },\n };\n}\n"],"mappings":";AA2CA,IAAM,YAAY;AAElB,SAAS,WAAW,MAAc,QAA+B;AAC/D,aAAW,KAAK,KAAK,SAAS,SAAS,GAAG;AACxC,UAAM,OAAO,EAAE,CAAC;AAChB,QAAI,SAAS,UAAa,OAAO,KAAK,IAAI,EAAG,QAAO;AAAA,EACtD;AACA,SAAO;AACT;AAGA,SAAS,cAAc,QAA2B;AAChD,QAAM,KAAK,OAAO,QAAQ,UAAU;AACpC,MAAI,OAAO,GAAI,QAAO,CAAC;AACvB,QAAM,QAAQ,KAAK,UAAU;AAC7B,MAAI,QAAQ;AACZ,WAAS,IAAI,OAAO,IAAI,OAAO,QAAQ,KAAK;AAC1C,UAAM,KAAK,OAAO,CAAC;AACnB,QAAI,OAAO,IAAK;AAAA,aACP,OAAO,KAAK;AACnB;AACA,UAAI,UAAU,GAAG;AACf,YAAI;AAEF,gBAAM,MAAM,OAAO,MAAM,OAAO,IAAI,CAAC;AACrC,gBAAM,UAAU,IAAI,QAAQ,2CAA2C,SAAS;AAChF,gBAAM,SAAkB,KAAK,MAAM,OAAO;AAC1C,iBAAO,MAAM,QAAQ,MAAM,IAAI,SAAS,CAAC;AAAA,QAC3C,QAAQ;AACN,iBAAO,CAAC;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO,CAAC;AACV;AAEA,IAAM,WAAW;AAEV,SAAS,iBAAiB,MAAgC;AAC/D,QAAM,OAAO,WAAW,MAAM,kDAAkD;AAChF,MAAI,CAAC,KAAM,QAAO;AAElB,QAAM,UAAU,2CAA2C,KAAK,IAAI,IAAI,CAAC;AACzE,MAAI,CAAC,QAAS,QAAO;AAErB,QAAM,SAAwB,CAAC;AAC/B,MAAI;AACJ,aAAW,KAAK,KAAK,SAAS,QAAQ,GAAG;AACvC,UAAM,OAAO,EAAE,CAAC;AAChB,UAAM,OAAO,EAAE,CAAC;AAChB,QAAI,CAAC,QAAQ,SAAS,OAAW;AACjC,UAAM,WAAW,oBAAoB,KAAK,IAAI,IAAI,CAAC;AACnD,UAAM,MAAM,oBAAoB,KAAK,IAAI,IAAI,CAAC;AAC9C,QAAI,CAAC,YAAY,CAAC,IAAK;AACvB,YAAQ;AACR,WAAO,KAAK;AAAA,MACV;AAAA,MACA;AAAA,MACA,kBAAkB,oBAAoB,KAAK,IAAI;AAAA,MAC/C,kBAAkB,8BAA8B,KAAK,IAAI;AAAA,IAC3D,CAAC;AAAA,EACH;AACA,MAAI,CAAC,OAAO,OAAO,WAAW,EAAG,QAAO;AAExC,QAAM,UAAU,yEAAyE;AAAA,IACvF;AAAA,EACF;AACA,QAAM,QAAQ,mBAAmB,KAAK,IAAI;AAI1C,QAAM,WAAW,IAAI,OAAO,mBAAmB,OAAO,cAAc,GAAG,EAAE,KAAK,IAAI,IAAI,CAAC,KAAK;AAC5F,QAAM,SAAS,8CAA8C,KAAK,QAAQ,IAAI,CAAC;AAE/E,QAAM,UAAU,eAAe,IAAI;AAEnC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ,cAAc,IAAI;AAAA,IAC1B,GAAI,UAAU,CAAC,KAAK,QAAQ,CAAC,IACzB,EAAE,QAAQ,EAAE,KAAK,OAAO,QAAQ,CAAC,CAAC,GAAG,KAAK,OAAO,QAAQ,CAAC,CAAC,EAAE,EAAE,IAC/D,CAAC;AAAA,IACL,GAAI,QAAQ,CAAC,IAAI,EAAE,MAAM,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC;AAAA,IAC/C,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,IAC3B,GAAI,QAAQ,SAAS,EAAE,eAAe,EAAE,IAAI,CAAC;AAAA,EAC/C;AACF;AAKO,SAAS,eAAe,QAA4C;AACzE,QAAM,SAAS,OAAO,OAAO,OAAO;AACpC,SAAO,CAAC,SAAS,KAAK,SAAS,SAAS,KAAK,KAAK,SAAS,MAAM;AACnE;AAKA,SAAS,eAAe,MAAgC;AACtD,QAAM,SAAS,CAAC,GAAG,KAAK,SAAS,0BAA0B,CAAC,EACzD,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,EACf,OAAO,CAAC,MAAmB,MAAM,MAAS;AAC7C,QAAM,QAAQ,WAAW,MAAM,2BAA2B;AAC1D,MAAI,CAAC,SAAS,OAAO,WAAW,EAAG,QAAO,CAAC;AAC3C,QAAM,QAAQ,sCAAsC,KAAK,KAAK;AAC9D,MAAI,CAAC,QAAQ,CAAC,EAAG,QAAO,CAAC;AACzB,QAAM,SAA2B,CAAC;AAClC,aAAW,KAAK,MAAM,CAAC,EAAE,SAAS,iDAAiD,GAAG;AACpF,UAAM,MAAM,OAAO,EAAE,CAAC,CAAC;AACvB,UAAM,OAAO,EAAE,CAAC,KAAK;AACrB,UAAM,aAAa;AAAA,MACjB,GAAG,IAAI;AAAA,QACL,CAAC,GAAG,KAAK,SAAS,qBAAqB,CAAC,EACrC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,EACf,OAAO,CAAC,MAAmB,MAAM,MAAS;AAAA,MAC/C;AAAA,IACF;AACA,UAAM,QAAQ,OAAO,GAAG;AACxB,QAAI,UAAU,OAAW,QAAO,CAAC;AACjC,WAAO,GAAG,IAAI,EAAE,OAAO,QAAQ,YAAY,YAAY,IAAI;AAAA,EAC7D;AAEA,SAAO,OAAO,WAAW,OAAO,UAAU,OAAO,MAAM,CAAC,MAAM,MAAM,MAAS,IAAI,SAAS,CAAC;AAC7F;;;ACjKO,IAAM,mBAAmB;AAChC,IAAM,oBAAoB;AAWnB,SAAS,uBAAuC;AACrD,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,YAAY;AAAA,IACZ,MAAM;AAAA,MACJ,IAAI;AAAA,MACJ,OAAO;AAAA,MACP,QAAQ;AAAA,MACR,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,MAAM;AAAA,QACJ,MAAM;AAAA,UACJ,KAAK,EAAE,MAAM,OAAO,QAAQ,EAAE,OAAO,OAAO,aAAa,GAAG,EAAE;AAAA,UAC9D,OAAO;AAAA,YACL,MAAM;AAAA,YACN,QAAQ,EAAE,OAAO,SAAS,aAAa,GAAG;AAAA,UAC5C;AAAA,UACA,OAAO;AAAA,YACL,MAAM;AAAA,YACN,QAAQ;AAAA,cACN,OAAO;AAAA,cACP,QAAQ;AAAA,gBACN,KAAK,EAAE,MAAM,QAAQ,QAAQ,EAAE,OAAO,OAAO,aAAa,GAAG,EAAE;AAAA,gBAC/D,MAAM;AAAA,kBACJ,MAAM;AAAA,kBACN,QAAQ;AAAA,oBACN,OAAO;AAAA,oBACP,aAAa;AAAA,oBACb,SAAS,CAAC,QAAQ,OAAO;AAAA,kBAC3B;AAAA,gBACF;AAAA,gBACA,MAAM;AAAA,kBACJ,MAAM;AAAA,kBACN,QAAQ;AAAA,oBACN,OAAO;AAAA,oBACP,aAAa;AAAA,oBACb,kBAAkB;AAAA,oBAClB,OACE;AAAA,kBACJ;AAAA,gBACF;AAAA,gBACA,OAAO;AAAA,kBACL,MAAM;AAAA,kBACN,QAAQ,EAAE,OAAO,SAAS,YAAY,CAAC,GAAG,YAAY,CAAC,EAAE;AAAA,gBAC3D;AAAA;AAAA;AAAA;AAAA,gBAIA,WAAW;AAAA,kBACT,MAAM;AAAA,kBACN,QAAQ,EAAE,OAAO,aAAa,aAAa,GAAG;AAAA,gBAChD;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,QACA,kBAAkB;AAAA,UAChB,YAAY;AAAA,YACV,MAAM;AAAA,YACN,QAAQ;AAAA,cACN,OAAO;AAAA,cACP,aAAa;AAAA,YACf;AAAA,UACF;AAAA,UACA,kBAAkB;AAAA,YAChB,MAAM;AAAA,YACN,QAAQ;AAAA,cACN,OAAO;AAAA,cACP,aAAa;AAAA,YACf;AAAA,UACF;AAAA,UACA,YAAY;AAAA,YACV,MAAM;AAAA,YACN,QAAQ;AAAA,cACN,OAAO;AAAA,cACP,YAAY,EAAE,OAAO,MAAM,QAAQ,KAAK;AAAA,cACxC,YAAY,CAAC;AAAA,YACf;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-IDBMYDVH.js → chunk-FVVGDIGX.js} RENAMED Viewed

@@ -3,7 +3,6 @@ import {
 } from "./chunk-GECESMVS.js";
 import {
   announcementSiteExtras,
-  fetchAttachmentBytes,
   gatingHealth,
   isHealthGateClear,
   isSendOverridden,
@@ -12,13 +11,16 @@ import {
   renderReportHtml,
   resolveCopy,
   stampSent
-} from "./chunk-JCITWZQR.js";
+} from "./chunk-MNE374CZ.js";
+import {
+  fetchAttachmentBytes
+} from "./chunk-MPBXOJ3N.js";
 import {
   defaultResendClient
 } from "./chunk-WEKL2HYJ.js";
 import {
   recordFleetEventsBestEffort
-} from "./chunk-GYNRZCM6.js";
+} from "./chunk-QG6OSL4M.js";
 import {
   listWebsites,
   siteSlug,
@@ -331,4 +333,4 @@ export {
   parseAddresses,
   isProbablyEmail
 };
-//# sourceMappingURL=chunk-IDBMYDVH.js.map
+//# sourceMappingURL=chunk-FVVGDIGX.js.map