@reddoorla/maintenance 0.75.1 → 0.78.0

package/dist/{chunk-IDBMYDVH.js.map → chunk-FVVGDIGX.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/reports/send/render-email.ts","../src/reports/maintenance-email/header-image.ts","../src/reports/send/idempotency.ts","../src/reports/send/orchestrate.ts"],"sourcesContent":["import { renderReportHtml } from \"../render.js\";\nimport { loadBundledImages } from \"../maintenance-email/assets/index.js\";\nimport { defaultReportSubject } from \"../subject.js\";\nimport type { ReportData } from \"../types.js\";\nimport type { ResendSendInput } from \"./resend.js\";\n\n/** A single Resend inline attachment (CID-referenced). */\nexport type InlineAttachment = NonNullable<ResendSendInput[\"attachments\"]>[number];\n\n/** The downscaled header image + display metadata produced by `prepareHeaderImage`. */\nexport type PreparedHeader = {\n  bytes: Uint8Array;\n  contentType: string;\n  displayWidth: number;\n  displayHeight: number;\n  placeholderColor: string;\n};\n\nexport type RenderedReportEmail = {\n  html: string;\n  attachments: InlineAttachment[];\n  subject: string;\n};\n\n/** Build a Resend inline (CID-referenced) attachment from raw bytes — the header image and both\n *  bundled images share this exact shape. */\nfunction toInlineAttachment(a: {\n  bytes: Uint8Array;\n  filename: string;\n  contentType: string;\n  cid: string;\n}): InlineAttachment {\n  return {\n    filename: a.filename,\n    content: Buffer.from(a.bytes).toString(\"base64\"),\n    contentType: a.contentType,\n    inlineContentId: a.cid,\n  };\n}\n\n/**\n * Render a report email from fully-assembled `ReportData`: produce the HTML, the gated inline\n * attachments, and the subject. The per-site header attaches always; the two bundled images\n * (`rd-check-png`, `rd-blurred-tests-jpg`) attach only when their cid actually appears in the\n * rendered HTML (a dangling inline part shows as a stray download in some clients). The subject\n * is `subjectOverride` when given, else `defaultReportSubject`. Shared by the production send path\n * (`sendOne`) and the `selftest` command so the rendered email, attachments, and subject can't\n * drift between them. The only I/O is `loadBundledImages` (a disk read of two bundled images).\n */\nexport async function renderReportEmail(\n  reportData: ReportData,\n  ctx: { header: PreparedHeader; cidName: string; subjectOverride?: string | undefined },\n): Promise<RenderedReportEmail> {\n  const { html } = await renderReportHtml(reportData);\n  const bundled = await loadBundledImages();\n  const attachments: InlineAttachment[] = [\n    toInlineAttachment({\n      bytes: ctx.header.bytes,\n      filename: `${ctx.cidName}.jpg`,\n      contentType: ctx.header.contentType,\n      cid: ctx.cidName,\n    }),\n  ];\n  for (const img of [bundled.check, bundled.blurred]) {\n    if (html.includes(`cid:${img.cid}`)) {\n      attachments.push(\n        toInlineAttachment({\n          bytes: img.bytes,\n          filename: img.filename,\n          contentType: img.contentType,\n          cid: img.cid,\n        }),\n      );\n    }\n  }\n  const subject =\n    ctx.subjectOverride ??\n    defaultReportSubject({\n      name: reportData.siteName,\n      url: reportData.siteUrl,\n      type: reportData.reportType,\n      date: reportData.completedOn,\n    });\n  return { html, attachments, subject };\n}\n","import sharp from \"sharp\";\n\nexport type PreparedHeaderImage = {\n  /** Resized JPEG bytes to attach inline (CID) in place of the Airtable original. */\n  bytes: Uint8Array;\n  /** Always \"image/jpeg\" — we re-encode for predictable size and a flat white background. */\n  contentType: string;\n  /** CSS display width in px (≤ requested, never wider than the source has pixels for). */\n  displayWidth: number;\n  /** CSS display height in px, source aspect ratio preserved (no distortion). */\n  displayHeight: number;\n  /** Dominant-color hex (e.g. \"#cfc3a8\"), used as the loading/blocked placeholder box. */\n  placeholderColor: string;\n};\n\nexport type PrepareHeaderImageOptions = {\n  /** Intended CSS display width. The email body is 600px, so that's the default. */\n  displayWidth?: number;\n};\n\nconst DEFAULT_DISPLAY_WIDTH = 600;\n/** Encode the source at 2× display width so it stays crisp on retina screens. */\nconst RETINA_SCALE = 2;\n/** Quality is for *resized* pixels — at 1200px the texture/text read as sharp; bytes are tiny. */\nconst JPEG_QUALITY = 82;\n\nfunction channelToHex(value: number): string {\n  return Math.max(0, Math.min(255, Math.round(value)))\n    .toString(16)\n    .padStart(2, \"0\");\n}\n\n/**\n * Downscale an oversized header image for email: 2× the display width (retina) at most,\n * never upscaled, re-encoded as JPEG on a flat white background. Also reports the display\n * dimensions (so the template can reserve the box and stop reflow) and a dominant color\n * (so the reserved box shows a matched placeholder while the image loads).\n *\n * Root cause this addresses: Airtable headers can be multi-MB / 2400px+ while the email\n * renders them at ~600px — shipping ~16× more pixels than the display can use.\n */\nexport async function prepareHeaderImage(\n  bytes: Uint8Array,\n  options: PrepareHeaderImageOptions = {},\n): Promise<PreparedHeaderImage> {\n  const requestedDisplayWidth = options.displayWidth ?? DEFAULT_DISPLAY_WIDTH;\n  const input = Buffer.from(bytes);\n\n  const meta = await sharp(input).metadata();\n  const origWidth = meta.width;\n  const origHeight = meta.height;\n  if (!origWidth || !origHeight) {\n    throw new Error(\"prepareHeaderImage: could not read source image dimensions\");\n  }\n\n  // Never claim a wider display than the source can fill at 1×.\n  const displayWidth = Math.min(requestedDisplayWidth, origWidth);\n  const displayHeight = Math.round((displayWidth * origHeight) / origWidth);\n\n  // Encode at 2× display for retina, but never enlarge a smaller original.\n  const targetSourceWidth = Math.min(origWidth, displayWidth * RETINA_SCALE);\n\n  const out = await sharp(input)\n    .resize({ width: targetSourceWidth, withoutEnlargement: true })\n    .flatten({ background: \"#ffffff\" })\n    .jpeg({ quality: JPEG_QUALITY })\n    .toBuffer();\n\n  const { dominant } = await sharp(out).stats();\n  const placeholderColor = `#${channelToHex(dominant.r)}${channelToHex(dominant.g)}${channelToHex(dominant.b)}`;\n\n  return {\n    bytes: new Uint8Array(out),\n    contentType: \"image/jpeg\",\n    displayWidth,\n    displayHeight,\n    placeholderColor,\n  };\n}\n","/**\n * True when a thrown send error is Resend's same-key + DIFFERENT-body 409\n * (`invalid_idempotent_request`). The ResendClient (send/resend.ts) discards the\n * status/name and only surfaces the message string, so we match defensively on the\n * stable message substring \"idempotency key has been used\" (case-insensitive); a\n * `name`/`statusCode` of 409/`invalid_idempotent_request` is also accepted if a\n * future client happens to preserve it. A same-key + SAME-body re-send is deduped\n * by Resend (returns the original id) and never reaches here.\n *\n * Shared by both send surfaces that key into Resend's idempotency window:\n * `runDigest` (digest.ts, `digest-<date>` key) and `sendOne` (orchestrate.ts,\n * `report:<id>` key). Both treat a 409 as \"the email already went out under this\n * key on a prior run\" — a no-op for the digest, an already-done success for sendOne.\n */\nexport function isIdempotencyConflict(err: unknown): boolean {\n  const message = err instanceof Error ? err.message : String(err);\n  if (/idempotency key has been used/i.test(message)) return true;\n  const e = err as { name?: unknown; statusCode?: unknown };\n  if (e.name === \"invalid_idempotent_request\") return true;\n  if (e.statusCode === 409) return true;\n  return false;\n}\n","import { openBase, readAirtableConfig } from \"../airtable/client.js\";\nimport { listSendableReports, stampSent } from \"../airtable/reports.js\";\nimport { listWebsites, siteSlug, updateLaunched } from \"../airtable/websites.js\";\nimport type { WebsiteRow } from \"../airtable/websites.js\";\nimport type { ReportRow } from \"../airtable/reports.js\";\nimport { fetchAttachmentBytes } from \"../airtable/attachments.js\";\nimport { resolveCopy } from \"../copy.js\";\nimport { announcementSiteExtras } from \"../announcement-email/template.js\";\nimport { renderReportEmail } from \"./render-email.js\";\nimport type { ReportData } from \"../types.js\";\nimport { prepareHeaderImage } from \"../maintenance-email/header-image.js\";\nimport { defaultResendClient, type ResendClient } from \"./resend.js\";\nimport { isIdempotencyConflict } from \"./idempotency.js\";\nimport { gatingHealth, isHealthGateClear, isSendOverridden } from \"../checklist.js\";\nimport { recordFleetEventsBestEffort } from \"../../audits/fleet-events-writer.js\";\n\nconst FROM_ADDRESS = \"Reddoor Reports <reports@reddoorla.com>\";\nconst REPLY_TO = \"info@reddoorla.com\";\n\n/** Operations inbox CC'd on every outgoing report so there's always an internal\n *  copy on file alongside the client recipients. */\nexport const GLOBAL_REPORT_CC = \"info@reddoorla.com\";\n\n/**\n * Append {@link GLOBAL_REPORT_CC} to a site's per-site CC list. The per-site CC is\n * passed through unchanged (preserving prior behavior); the global address is added\n * only when it isn't already present in the CC or To lists (case-insensitive), so a\n * report is never double-addressed to the ops inbox. Returns the final CC list (may\n * be empty if the global address is already the sole To recipient — the caller omits\n * an empty CC).\n */\nexport function withGlobalCc(perSiteCc: string[] | null, to: string[]): string[] {\n  const cc = [...(perSiteCc ?? [])];\n  const present = new Set([...cc, ...to].map((a) => a.toLowerCase()));\n  if (!present.has(GLOBAL_REPORT_CC.toLowerCase())) cc.push(GLOBAL_REPORT_CC);\n  return cc;\n}\n\n/** Whole days spanned by an ISO period window, or undefined when either bound is missing or the\n *  span isn't positive. Drives the analytics trend's \"vs the previous N days\" label. */\nfunction windowDays(start: string | null, end: string | null): number | undefined {\n  if (!start || !end) return undefined;\n  const ms = new Date(end).getTime() - new Date(start).getTime();\n  if (!Number.isFinite(ms) || ms <= 0) return undefined;\n  return Math.round(ms / (24 * 60 * 60 * 1000));\n}\n\nexport type OrchestrateOptions = {\n  resend?: ResendClient;\n};\n\nexport async function sendApprovedReports(\n  options: OrchestrateOptions = {},\n): Promise<{ output: string; code: number }> {\n  const base = openBase(readAirtableConfig());\n  const client = options.resend ?? defaultResendClient();\n\n  const sendable = await listSendableReports(base);\n  if (sendable.length === 0) return { output: \"No reports ready to send.\", code: 0 };\n\n  const websites = await listWebsites(base);\n  const sites = new Map(websites.map((w) => [w.id, w]));\n\n  const lines: string[] = [];\n  let anyFailed = false;\n  for (const report of sendable) {\n    const site = sites.get(report.siteId);\n    if (!site) {\n      lines.push(`✗ ${report.reportId} — Site row not found for id=${report.siteId}`);\n      anyFailed = true;\n      continue;\n    }\n    try {\n      const messageId = await sendOne(client, base, site, report);\n      lines.push(`✓ sent: ${report.reportId} (${messageId})`);\n      if (report.sendOverride) {\n        const failing = gatingHealth({\n          reportType: report.reportType,\n          autoEvidence: report.autoEvidence ?? {},\n        })\n          .filter((h) => h.status !== \"pass\" && h.status !== \"n/a\")\n          .map((h) => h.field);\n        await recordFleetEventsBestEffort(\n          [\n            {\n              id: `report_sent_with_override:${report.id}`,\n              ts: new Date().toISOString(),\n              type: \"report_sent_with_override\",\n              siteId: site.id,\n              siteName: site.name,\n              summary: `sent with override — ${report.overrideReason ?? \"\"}`,\n              data: { reportId: report.reportId, reason: report.overrideReason, failing },\n            },\n          ],\n          new Date(),\n        );\n      }\n      if (report.reportType === \"Launch\") {\n        try {\n          await updateLaunched(base, site.id, new Date().toISOString());\n          lines.push(`  ↳ launched: ${site.name} flipped to maintenance`);\n          await recordFleetEventsBestEffort(\n            [\n              {\n                id: `site_launched:${site.id}`,\n                ts: new Date().toISOString(),\n                type: \"site_launched\",\n                siteId: site.id,\n                siteName: site.name,\n                summary: \"launched — now in maintenance\",\n                data: null,\n              },\n            ],\n            new Date(),\n          );\n        } catch (e) {\n          lines.push(`  ⚠ launch flip failed for ${site.name}: ${(e as Error).message}`);\n        }\n      }\n    } catch (e) {\n      lines.push(`✗ ${report.reportId} — ${(e as Error).message}`);\n      anyFailed = true;\n    }\n  }\n  return { output: lines.join(\"\\n\"), code: anyFailed ? 1 : 0 };\n}\n\nasync function sendOne(\n  client: ResendClient,\n  base: ReturnType<typeof openBase>,\n  site: WebsiteRow,\n  report: ReportRow,\n): Promise<string> {\n  // Hard health gate: a Maintenance/Testing report whose gating evidence isn't all pass/n/a must\n  // never go out — even if \"Approved to send\" was set directly in Airtable. Throw so the row is\n  // skipped and `Sent at` stays null (at-least-once retry preserved). Launch/Announcement have no\n  // gating fields → vacuously clear. A logged send-anyway override (Phase 10) bypasses the gate.\n  const gateReport = { reportType: report.reportType, autoEvidence: report.autoEvidence ?? {} };\n  if (!isHealthGateClear(gateReport) && !isSendOverridden(report)) {\n    const failing = gatingHealth(gateReport)\n      .filter((h) => h.status !== \"pass\" && h.status !== \"n/a\")\n      .map((h) => {\n        const note = report.autoEvidence?.[h.field]?.note;\n        return `${h.field} (${h.status}${note ? `: ${note}` : \"\"})`;\n      })\n      .join(\"; \");\n    throw new Error(`Report ${report.reportId} health gate not clear — ${failing}`);\n  }\n  if (!site.headerImage) {\n    throw new Error(`Site '${site.name}' has no Header image set on the Websites row`);\n  }\n  if (!report.lighthouse) {\n    throw new Error(\n      `Report ${report.reportId} has no Lighthouse scores — all four cells ` +\n        `(Lighthouse — Performance / Accessibility / Best Practices / SEO) must be numeric ` +\n        `on the Reports row; one non-numeric or blank cell nulls all four`,\n    );\n  }\n\n  // Resolve + validate recipients BEFORE the expensive work (header fetch + sharp\n  // downscale + full MJML render). A misconfigured-recipients site is a guaranteed\n  // failure, so fail fast here rather than after burning that work. Same checks +\n  // messages as before — only the position moved.\n  const explicitTo = parseAddresses(site.reportRecipientsTo);\n  // Run pointOfContact through the parser too — operators sometimes paste\n  // \"a@x, b@y\" into that single-line field.\n  const fallbackTo = parseAddresses(site.pointOfContact);\n  const to = explicitTo ?? fallbackTo ?? [];\n  if (to.length === 0) {\n    throw new Error(\n      `Site '${site.name}' has no recipients (Report recipients (To) AND point of contact are both empty)`,\n    );\n  }\n  for (const addr of to) {\n    if (!isProbablyEmail(addr)) {\n      throw new Error(\n        `Site '${site.name}' recipient is malformed: ${addr} — use a bare address only ` +\n          `(no \\`Name <addr>\\` display-name syntax); fix Report recipients (To) or point of contact in Airtable`,\n      );\n    }\n  }\n  const cc = parseAddresses(site.reportRecipientsCc);\n  if (cc) {\n    for (const addr of cc) {\n      if (!isProbablyEmail(addr)) {\n        throw new Error(\n          `Site '${site.name}' CC is malformed: ${addr} — fix Report recipients (CC) in Airtable`,\n        );\n      }\n    }\n  }\n\n  const original = await fetchAttachmentBytes(site.headerImage.url);\n  // Downscale the (often multi-MB / 2400px+) Airtable header to email display size, and get\n  // back display dims + a placeholder color so the template can reserve the box.\n  const header = await prepareHeaderImage(original.bytes);\n\n  const slug = siteSlug(site.name);\n  const cidName = `${slug}-header`;\n  const gaPeriodDays =\n    report.reportType === \"Announcement\" ? 30 : windowDays(report.periodStart, report.periodEnd);\n  const reportData: ReportData = {\n    siteName: site.name,\n    siteUrl: site.url,\n    reportType: report.reportType,\n    completedOn: report.completedOn ? new Date(report.completedOn) : new Date(),\n    lighthouse: report.lighthouse,\n    gaUsersCurrent: report.gaUsersCurrent ?? undefined,\n    gaUsersPrevious: report.gaUsersPrevious ?? undefined,\n    gaPeriodDays,\n    searchPosition:\n      report.searchFoundPage1 && report.searchPosition !== null ? report.searchPosition : undefined,\n    lastTestedDate: report.lastTestedDate ? new Date(report.lastTestedDate) : null,\n    commentary: report.commentary,\n    copy: resolveCopy(site),\n    headerImageCid: cidName,\n    headerWidth: header.displayWidth,\n    headerHeight: header.displayHeight,\n    headerBgColor: header.placeholderColor,\n    // Announcement-only: re-derive cadence + improvements from the site row so the SENT email\n    // keeps its cadence copy + improvement callouts (not stored on the Reports row).\n    ...(report.reportType === \"Announcement\" ? announcementSiteExtras(site) : {}),\n  };\n  const { html, attachments, subject } = await renderReportEmail(reportData, {\n    header,\n    cidName,\n    subjectOverride: report.subjectOverride ?? undefined,\n  });\n\n  const payload: Parameters<ResendClient[\"send\"]>[0] = {\n    from: FROM_ADDRESS,\n    to,\n    replyTo: REPLY_TO,\n    subject,\n    html,\n    attachments,\n    // Stable across retries of the same row — if Airtable stamping fails after a\n    // successful Resend, the next --send-ready replays with the same key and\n    // Resend returns the original message id rather than sending a duplicate.\n    idempotencyKey: `report:${report.id}`,\n  };\n  // Always CC the ops inbox (info@reddoorla.com), in addition to any per-site CC.\n  const finalCc = withGlobalCc(cc, to);\n  if (finalCc.length > 0) payload.cc = finalCc;\n\n  let result: Awaited<ReturnType<ResendClient[\"send\"]>>;\n  try {\n    result = await client.send(payload);\n  } catch (err) {\n    // The send path is at-least-once: client.send succeeds → stampSent writes\n    // `Sent at` (the ONLY thing that removes the row from listSendableReports). If\n    // stampSent threw on a PRIOR run (an Airtable blip), `Sent at` stayed null and\n    // the row replays here. By replay time the rendered body has usually changed\n    // (operator Commentary edit, `report --due` rewrote scores, or the header\n    // re-encodes non-deterministically), so Resend rejects the same-key\n    // (`report:<id>`) / different-body re-send with a 409 (`invalid_idempotent_request`).\n    //\n    // That 409 means the email ALREADY WENT OUT under this key on the prior run.\n    // Do NOT re-throw and do NOT re-send (re-throwing leaves the row unstamped, and\n    // after the 24h key TTL a SECOND real email would go out). Instead stamp the row\n    // so it stops replaying, then return success so the caller runs the Launch flip —\n    // which self-heals a launch that sent-but-never-flipped on the prior run.\n    //\n    // Any OTHER error (real network/Resend failure) re-throws, exactly as before, so\n    // a genuine failure still fails loudly and the row replays next run.\n    if (isIdempotencyConflict(err)) {\n      // Stamp `Sent at` ONLY — the original send's messageId is unrecoverable on\n      // the 409 path, so we leave `Resend message ID` null rather than writing a\n      // sentinel that would masquerade as a real id and orphan webhook lookups.\n      // Still return the sentinel string so the caller logs the already-sent path\n      // and runs the Launch flip.\n      await stampSent(base, report.id, new Date(), null);\n      console.log(`↻ already sent (idempotency conflict), stamped: ${report.reportId}`);\n      return \"idempotent-conflict\";\n    }\n    throw err;\n  }\n  await stampSent(base, report.id, new Date(), result.messageId);\n  return result.messageId;\n}\n\n/**\n * Split a comma/newline-separated address field into a clean array.\n * Lowercases (case-insensitive dedupe) and removes empty entries. Returns\n * null if nothing survives. Does NOT understand `Display Name <email>` —\n * operators should put a bare address in the Airtable field, or use multiple\n * lines if needing multiple recipients.\n */\nexport function parseAddresses(field: string | null): string[] | null {\n  if (!field) return null;\n  const seen = new Set<string>();\n  const list: string[] = [];\n  for (const raw of field.split(/[,\\n]/)) {\n    const trimmed = raw.trim().toLowerCase();\n    if (!trimmed) continue;\n    if (seen.has(trimmed)) continue;\n    seen.add(trimmed);\n    list.push(trimmed);\n  }\n  return list.length > 0 ? list : null;\n}\n\n/**\n * Cheap email shape check — must contain exactly one @, with non-empty\n * local and domain parts and at least one dot in the domain. We're not\n * trying to be a full RFC validator; we're trying to catch operator\n * mistakes like \"ops at acme dot com\" or a missing @ before they 422\n * at Resend.\n */\nexport function isProbablyEmail(s: string): boolean {\n  const at = s.indexOf(\"@\");\n  if (at < 1 || at !== s.lastIndexOf(\"@\")) return false;\n  const local = s.slice(0, at);\n  const domain = s.slice(at + 1);\n  if (!local || !domain) return false;\n  if (!domain.includes(\".\")) return false;\n  if (/\\s/.test(s)) return false;\n  return true;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0BA,SAAS,mBAAmB,GAKP;AACnB,SAAO;AAAA,IACL,UAAU,EAAE;AAAA,IACZ,SAAS,OAAO,KAAK,EAAE,KAAK,EAAE,SAAS,QAAQ;AAAA,IAC/C,aAAa,EAAE;AAAA,IACf,iBAAiB,EAAE;AAAA,EACrB;AACF;AAWA,eAAsB,kBACpB,YACA,KAC8B;AAC9B,QAAM,EAAE,KAAK,IAAI,MAAM,iBAAiB,UAAU;AAClD,QAAM,UAAU,MAAM,kBAAkB;AACxC,QAAM,cAAkC;AAAA,IACtC,mBAAmB;AAAA,MACjB,OAAO,IAAI,OAAO;AAAA,MAClB,UAAU,GAAG,IAAI,OAAO;AAAA,MACxB,aAAa,IAAI,OAAO;AAAA,MACxB,KAAK,IAAI;AAAA,IACX,CAAC;AAAA,EACH;AACA,aAAW,OAAO,CAAC,QAAQ,OAAO,QAAQ,OAAO,GAAG;AAClD,QAAI,KAAK,SAAS,OAAO,IAAI,GAAG,EAAE,GAAG;AACnC,kBAAY;AAAA,QACV,mBAAmB;AAAA,UACjB,OAAO,IAAI;AAAA,UACX,UAAU,IAAI;AAAA,UACd,aAAa,IAAI;AAAA,UACjB,KAAK,IAAI;AAAA,QACX,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AACA,QAAM,UACJ,IAAI,mBACJ,qBAAqB;AAAA,IACnB,MAAM,WAAW;AAAA,IACjB,KAAK,WAAW;AAAA,IAChB,MAAM,WAAW;AAAA,IACjB,MAAM,WAAW;AAAA,EACnB,CAAC;AACH,SAAO,EAAE,MAAM,aAAa,QAAQ;AACtC;;;ACpFA,OAAO,WAAW;AAoBlB,IAAM,wBAAwB;AAE9B,IAAM,eAAe;AAErB,IAAM,eAAe;AAErB,SAAS,aAAa,OAAuB;AAC3C,SAAO,KAAK,IAAI,GAAG,KAAK,IAAI,KAAK,KAAK,MAAM,KAAK,CAAC,CAAC,EAChD,SAAS,EAAE,EACX,SAAS,GAAG,GAAG;AACpB;AAWA,eAAsB,mBACpB,OACA,UAAqC,CAAC,GACR;AAC9B,QAAM,wBAAwB,QAAQ,gBAAgB;AACtD,QAAM,QAAQ,OAAO,KAAK,KAAK;AAE/B,QAAM,OAAO,MAAM,MAAM,KAAK,EAAE,SAAS;AACzC,QAAM,YAAY,KAAK;AACvB,QAAM,aAAa,KAAK;AACxB,MAAI,CAAC,aAAa,CAAC,YAAY;AAC7B,UAAM,IAAI,MAAM,4DAA4D;AAAA,EAC9E;AAGA,QAAM,eAAe,KAAK,IAAI,uBAAuB,SAAS;AAC9D,QAAM,gBAAgB,KAAK,MAAO,eAAe,aAAc,SAAS;AAGxE,QAAM,oBAAoB,KAAK,IAAI,WAAW,eAAe,YAAY;AAEzE,QAAM,MAAM,MAAM,MAAM,KAAK,EAC1B,OAAO,EAAE,OAAO,mBAAmB,oBAAoB,KAAK,CAAC,EAC7D,QAAQ,EAAE,YAAY,UAAU,CAAC,EACjC,KAAK,EAAE,SAAS,aAAa,CAAC,EAC9B,SAAS;AAEZ,QAAM,EAAE,SAAS,IAAI,MAAM,MAAM,GAAG,EAAE,MAAM;AAC5C,QAAM,mBAAmB,IAAI,aAAa,SAAS,CAAC,CAAC,GAAG,aAAa,SAAS,CAAC,CAAC,GAAG,aAAa,SAAS,CAAC,CAAC;AAE3G,SAAO;AAAA,IACL,OAAO,IAAI,WAAW,GAAG;AAAA,IACzB,aAAa;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;;;AChEO,SAAS,sBAAsB,KAAuB;AAC3D,QAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,MAAI,iCAAiC,KAAK,OAAO,EAAG,QAAO;AAC3D,QAAM,IAAI;AACV,MAAI,EAAE,SAAS,6BAA8B,QAAO;AACpD,MAAI,EAAE,eAAe,IAAK,QAAO;AACjC,SAAO;AACT;;;ACLA,IAAM,eAAe;AACrB,IAAM,WAAW;AAIV,IAAM,mBAAmB;AAUzB,SAAS,aAAa,WAA4B,IAAwB;AAC/E,QAAM,KAAK,CAAC,GAAI,aAAa,CAAC,CAAE;AAChC,QAAM,UAAU,IAAI,IAAI,CAAC,GAAG,IAAI,GAAG,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;AAClE,MAAI,CAAC,QAAQ,IAAI,iBAAiB,YAAY,CAAC,EAAG,IAAG,KAAK,gBAAgB;AAC1E,SAAO;AACT;AAIA,SAAS,WAAW,OAAsB,KAAwC;AAChF,MAAI,CAAC,SAAS,CAAC,IAAK,QAAO;AAC3B,QAAM,KAAK,IAAI,KAAK,GAAG,EAAE,QAAQ,IAAI,IAAI,KAAK,KAAK,EAAE,QAAQ;AAC7D,MAAI,CAAC,OAAO,SAAS,EAAE,KAAK,MAAM,EAAG,QAAO;AAC5C,SAAO,KAAK,MAAM,MAAM,KAAK,KAAK,KAAK,IAAK;AAC9C;AAMA,eAAsB,oBACpB,UAA8B,CAAC,GACY;AAC3C,QAAM,OAAO,SAAS,mBAAmB,CAAC;AAC1C,QAAM,SAAS,QAAQ,UAAU,oBAAoB;AAErD,QAAM,WAAW,MAAM,oBAAoB,IAAI;AAC/C,MAAI,SAAS,WAAW,EAAG,QAAO,EAAE,QAAQ,6BAA6B,MAAM,EAAE;AAEjF,QAAM,WAAW,MAAM,aAAa,IAAI;AACxC,QAAM,QAAQ,IAAI,IAAI,SAAS,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AAEpD,QAAM,QAAkB,CAAC;AACzB,MAAI,YAAY;AAChB,aAAW,UAAU,UAAU;AAC7B,UAAM,OAAO,MAAM,IAAI,OAAO,MAAM;AACpC,QAAI,CAAC,MAAM;AACT,YAAM,KAAK,UAAK,OAAO,QAAQ,qCAAgC,OAAO,MAAM,EAAE;AAC9E,kBAAY;AACZ;AAAA,IACF;AACA,QAAI;AACF,YAAM,YAAY,MAAM,QAAQ,QAAQ,MAAM,MAAM,MAAM;AAC1D,YAAM,KAAK,gBAAW,OAAO,QAAQ,KAAK,SAAS,GAAG;AACtD,UAAI,OAAO,cAAc;AACvB,cAAM,UAAU,aAAa;AAAA,UAC3B,YAAY,OAAO;AAAA,UACnB,cAAc,OAAO,gBAAgB,CAAC;AAAA,QACxC,CAAC,EACE,OAAO,CAAC,MAAM,EAAE,WAAW,UAAU,EAAE,WAAW,KAAK,EACvD,IAAI,CAAC,MAAM,EAAE,KAAK;AACrB,cAAM;AAAA,UACJ;AAAA,YACE;AAAA,cACE,IAAI,6BAA6B,OAAO,EAAE;AAAA,cAC1C,KAAI,oBAAI,KAAK,GAAE,YAAY;AAAA,cAC3B,MAAM;AAAA,cACN,QAAQ,KAAK;AAAA,cACb,UAAU,KAAK;AAAA,cACf,SAAS,6BAAwB,OAAO,kBAAkB,EAAE;AAAA,cAC5D,MAAM,EAAE,UAAU,OAAO,UAAU,QAAQ,OAAO,gBAAgB,QAAQ;AAAA,YAC5E;AAAA,UACF;AAAA,UACA,oBAAI,KAAK;AAAA,QACX;AAAA,MACF;AACA,UAAI,OAAO,eAAe,UAAU;AAClC,YAAI;AACF,gBAAM,eAAe,MAAM,KAAK,KAAI,oBAAI,KAAK,GAAE,YAAY,CAAC;AAC5D,gBAAM,KAAK,sBAAiB,KAAK,IAAI,yBAAyB;AAC9D,gBAAM;AAAA,YACJ;AAAA,cACE;AAAA,gBACE,IAAI,iBAAiB,KAAK,EAAE;AAAA,gBAC5B,KAAI,oBAAI,KAAK,GAAE,YAAY;AAAA,gBAC3B,MAAM;AAAA,gBACN,QAAQ,KAAK;AAAA,gBACb,UAAU,KAAK;AAAA,gBACf,SAAS;AAAA,gBACT,MAAM;AAAA,cACR;AAAA,YACF;AAAA,YACA,oBAAI,KAAK;AAAA,UACX;AAAA,QACF,SAAS,GAAG;AACV,gBAAM,KAAK,mCAA8B,KAAK,IAAI,KAAM,EAAY,OAAO,EAAE;AAAA,QAC/E;AAAA,MACF;AAAA,IACF,SAAS,GAAG;AACV,YAAM,KAAK,UAAK,OAAO,QAAQ,WAAO,EAAY,OAAO,EAAE;AAC3D,kBAAY;AAAA,IACd;AAAA,EACF;AACA,SAAO,EAAE,QAAQ,MAAM,KAAK,IAAI,GAAG,MAAM,YAAY,IAAI,EAAE;AAC7D;AAEA,eAAe,QACb,QACA,MACA,MACA,QACiB;AAKjB,QAAM,aAAa,EAAE,YAAY,OAAO,YAAY,cAAc,OAAO,gBAAgB,CAAC,EAAE;AAC5F,MAAI,CAAC,kBAAkB,UAAU,KAAK,CAAC,iBAAiB,MAAM,GAAG;AAC/D,UAAM,UAAU,aAAa,UAAU,EACpC,OAAO,CAAC,MAAM,EAAE,WAAW,UAAU,EAAE,WAAW,KAAK,EACvD,IAAI,CAAC,MAAM;AACV,YAAM,OAAO,OAAO,eAAe,EAAE,KAAK,GAAG;AAC7C,aAAO,GAAG,EAAE,KAAK,KAAK,EAAE,MAAM,GAAG,OAAO,KAAK,IAAI,KAAK,EAAE;AAAA,IAC1D,CAAC,EACA,KAAK,IAAI;AACZ,UAAM,IAAI,MAAM,UAAU,OAAO,QAAQ,iCAA4B,OAAO,EAAE;AAAA,EAChF;AACA,MAAI,CAAC,KAAK,aAAa;AACrB,UAAM,IAAI,MAAM,SAAS,KAAK,IAAI,+CAA+C;AAAA,EACnF;AACA,MAAI,CAAC,OAAO,YAAY;AACtB,UAAM,IAAI;AAAA,MACR,UAAU,OAAO,QAAQ;AAAA,IAG3B;AAAA,EACF;AAMA,QAAM,aAAa,eAAe,KAAK,kBAAkB;AAGzD,QAAM,aAAa,eAAe,KAAK,cAAc;AACrD,QAAM,KAAK,cAAc,cAAc,CAAC;AACxC,MAAI,GAAG,WAAW,GAAG;AACnB,UAAM,IAAI;AAAA,MACR,SAAS,KAAK,IAAI;AAAA,IACpB;AAAA,EACF;AACA,aAAW,QAAQ,IAAI;AACrB,QAAI,CAAC,gBAAgB,IAAI,GAAG;AAC1B,YAAM,IAAI;AAAA,QACR,SAAS,KAAK,IAAI,6BAA6B,IAAI;AAAA,MAErD;AAAA,IACF;AAAA,EACF;AACA,QAAM,KAAK,eAAe,KAAK,kBAAkB;AACjD,MAAI,IAAI;AACN,eAAW,QAAQ,IAAI;AACrB,UAAI,CAAC,gBAAgB,IAAI,GAAG;AAC1B,cAAM,IAAI;AAAA,UACR,SAAS,KAAK,IAAI,sBAAsB,IAAI;AAAA,QAC9C;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,WAAW,MAAM,qBAAqB,KAAK,YAAY,GAAG;AAGhE,QAAM,SAAS,MAAM,mBAAmB,SAAS,KAAK;AAEtD,QAAM,OAAO,SAAS,KAAK,IAAI;AAC/B,QAAM,UAAU,GAAG,IAAI;AACvB,QAAM,eACJ,OAAO,eAAe,iBAAiB,KAAK,WAAW,OAAO,aAAa,OAAO,SAAS;AAC7F,QAAM,aAAyB;AAAA,IAC7B,UAAU,KAAK;AAAA,IACf,SAAS,KAAK;AAAA,IACd,YAAY,OAAO;AAAA,IACnB,aAAa,OAAO,cAAc,IAAI,KAAK,OAAO,WAAW,IAAI,oBAAI,KAAK;AAAA,IAC1E,YAAY,OAAO;AAAA,IACnB,gBAAgB,OAAO,kBAAkB;AAAA,IACzC,iBAAiB,OAAO,mBAAmB;AAAA,IAC3C;AAAA,IACA,gBACE,OAAO,oBAAoB,OAAO,mBAAmB,OAAO,OAAO,iBAAiB;AAAA,IACtF,gBAAgB,OAAO,iBAAiB,IAAI,KAAK,OAAO,cAAc,IAAI;AAAA,IAC1E,YAAY,OAAO;AAAA,IACnB,MAAM,YAAY,IAAI;AAAA,IACtB,gBAAgB;AAAA,IAChB,aAAa,OAAO;AAAA,IACpB,cAAc,OAAO;AAAA,IACrB,eAAe,OAAO;AAAA;AAAA;AAAA,IAGtB,GAAI,OAAO,eAAe,iBAAiB,uBAAuB,IAAI,IAAI,CAAC;AAAA,EAC7E;AACA,QAAM,EAAE,MAAM,aAAa,QAAQ,IAAI,MAAM,kBAAkB,YAAY;AAAA,IACzE;AAAA,IACA;AAAA,IACA,iBAAiB,OAAO,mBAAmB;AAAA,EAC7C,CAAC;AAED,QAAM,UAA+C;AAAA,IACnD,MAAM;AAAA,IACN;AAAA,IACA,SAAS;AAAA,IACT;AAAA,IACA;AAAA,IACA;AAAA;AAAA;AAAA;AAAA,IAIA,gBAAgB,UAAU,OAAO,EAAE;AAAA,EACrC;AAEA,QAAM,UAAU,aAAa,IAAI,EAAE;AACnC,MAAI,QAAQ,SAAS,EAAG,SAAQ,KAAK;AAErC,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,OAAO,KAAK,OAAO;AAAA,EACpC,SAAS,KAAK;AAiBZ,QAAI,sBAAsB,GAAG,GAAG;AAM9B,YAAM,UAAU,MAAM,OAAO,IAAI,oBAAI,KAAK,GAAG,IAAI;AACjD,cAAQ,IAAI,wDAAmD,OAAO,QAAQ,EAAE;AAChF,aAAO;AAAA,IACT;AACA,UAAM;AAAA,EACR;AACA,QAAM,UAAU,MAAM,OAAO,IAAI,oBAAI,KAAK,GAAG,OAAO,SAAS;AAC7D,SAAO,OAAO;AAChB;AASO,SAAS,eAAe,OAAuC;AACpE,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,OAAiB,CAAC;AACxB,aAAW,OAAO,MAAM,MAAM,OAAO,GAAG;AACtC,UAAM,UAAU,IAAI,KAAK,EAAE,YAAY;AACvC,QAAI,CAAC,QAAS;AACd,QAAI,KAAK,IAAI,OAAO,EAAG;AACvB,SAAK,IAAI,OAAO;AAChB,SAAK,KAAK,OAAO;AAAA,EACnB;AACA,SAAO,KAAK,SAAS,IAAI,OAAO;AAClC;AASO,SAAS,gBAAgB,GAAoB;AAClD,QAAM,KAAK,EAAE,QAAQ,GAAG;AACxB,MAAI,KAAK,KAAK,OAAO,EAAE,YAAY,GAAG,EAAG,QAAO;AAChD,QAAM,QAAQ,EAAE,MAAM,GAAG,EAAE;AAC3B,QAAM,SAAS,EAAE,MAAM,KAAK,CAAC;AAC7B,MAAI,CAAC,SAAS,CAAC,OAAQ,QAAO;AAC9B,MAAI,CAAC,OAAO,SAAS,GAAG,EAAG,QAAO;AAClC,MAAI,KAAK,KAAK,CAAC,EAAG,QAAO;AACzB,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../src/reports/send/render-email.ts","../src/reports/maintenance-email/header-image.ts","../src/reports/send/idempotency.ts","../src/reports/send/orchestrate.ts"],"sourcesContent":["import { renderReportHtml } from \"../render.js\";\nimport { loadBundledImages } from \"../maintenance-email/assets/index.js\";\nimport { defaultReportSubject } from \"../subject.js\";\nimport type { ReportData } from \"../types.js\";\nimport type { ResendSendInput } from \"./resend.js\";\n\n/** A single Resend inline attachment (CID-referenced). */\nexport type InlineAttachment = NonNullable<ResendSendInput[\"attachments\"]>[number];\n\n/** The downscaled header image + display metadata produced by `prepareHeaderImage`. */\nexport type PreparedHeader = {\n  bytes: Uint8Array;\n  contentType: string;\n  displayWidth: number;\n  displayHeight: number;\n  placeholderColor: string;\n};\n\nexport type RenderedReportEmail = {\n  html: string;\n  attachments: InlineAttachment[];\n  subject: string;\n};\n\n/** Build a Resend inline (CID-referenced) attachment from raw bytes — the header image and both\n *  bundled images share this exact shape. */\nfunction toInlineAttachment(a: {\n  bytes: Uint8Array;\n  filename: string;\n  contentType: string;\n  cid: string;\n}): InlineAttachment {\n  return {\n    filename: a.filename,\n    content: Buffer.from(a.bytes).toString(\"base64\"),\n    contentType: a.contentType,\n    inlineContentId: a.cid,\n  };\n}\n\n/**\n * Render a report email from fully-assembled `ReportData`: produce the HTML, the gated inline\n * attachments, and the subject. The per-site header attaches always; the two bundled images\n * (`rd-check-png`, `rd-blurred-tests-jpg`) attach only when their cid actually appears in the\n * rendered HTML (a dangling inline part shows as a stray download in some clients). The subject\n * is `subjectOverride` when given, else `defaultReportSubject`. Shared by the production send path\n * (`sendOne`) and the `selftest` command so the rendered email, attachments, and subject can't\n * drift between them. The only I/O is `loadBundledImages` (a disk read of two bundled images).\n */\nexport async function renderReportEmail(\n  reportData: ReportData,\n  ctx: { header: PreparedHeader; cidName: string; subjectOverride?: string | undefined },\n): Promise<RenderedReportEmail> {\n  const { html } = await renderReportHtml(reportData);\n  const bundled = await loadBundledImages();\n  const attachments: InlineAttachment[] = [\n    toInlineAttachment({\n      bytes: ctx.header.bytes,\n      filename: `${ctx.cidName}.jpg`,\n      contentType: ctx.header.contentType,\n      cid: ctx.cidName,\n    }),\n  ];\n  for (const img of [bundled.check, bundled.blurred]) {\n    if (html.includes(`cid:${img.cid}`)) {\n      attachments.push(\n        toInlineAttachment({\n          bytes: img.bytes,\n          filename: img.filename,\n          contentType: img.contentType,\n          cid: img.cid,\n        }),\n      );\n    }\n  }\n  const subject =\n    ctx.subjectOverride ??\n    defaultReportSubject({\n      name: reportData.siteName,\n      url: reportData.siteUrl,\n      type: reportData.reportType,\n      date: reportData.completedOn,\n    });\n  return { html, attachments, subject };\n}\n","import sharp from \"sharp\";\n\nexport type PreparedHeaderImage = {\n  /** Resized JPEG bytes to attach inline (CID) in place of the Airtable original. */\n  bytes: Uint8Array;\n  /** Always \"image/jpeg\" — we re-encode for predictable size and a flat white background. */\n  contentType: string;\n  /** CSS display width in px (≤ requested, never wider than the source has pixels for). */\n  displayWidth: number;\n  /** CSS display height in px, source aspect ratio preserved (no distortion). */\n  displayHeight: number;\n  /** Dominant-color hex (e.g. \"#cfc3a8\"), used as the loading/blocked placeholder box. */\n  placeholderColor: string;\n};\n\nexport type PrepareHeaderImageOptions = {\n  /** Intended CSS display width. The email body is 600px, so that's the default. */\n  displayWidth?: number;\n};\n\nconst DEFAULT_DISPLAY_WIDTH = 600;\n/** Encode the source at 2× display width so it stays crisp on retina screens. */\nconst RETINA_SCALE = 2;\n/** Quality is for *resized* pixels — at 1200px the texture/text read as sharp; bytes are tiny. */\nconst JPEG_QUALITY = 82;\n\nfunction channelToHex(value: number): string {\n  return Math.max(0, Math.min(255, Math.round(value)))\n    .toString(16)\n    .padStart(2, \"0\");\n}\n\n/**\n * Downscale an oversized header image for email: 2× the display width (retina) at most,\n * never upscaled, re-encoded as JPEG on a flat white background. Also reports the display\n * dimensions (so the template can reserve the box and stop reflow) and a dominant color\n * (so the reserved box shows a matched placeholder while the image loads).\n *\n * Root cause this addresses: Airtable headers can be multi-MB / 2400px+ while the email\n * renders them at ~600px — shipping ~16× more pixels than the display can use.\n */\nexport async function prepareHeaderImage(\n  bytes: Uint8Array,\n  options: PrepareHeaderImageOptions = {},\n): Promise<PreparedHeaderImage> {\n  const requestedDisplayWidth = options.displayWidth ?? DEFAULT_DISPLAY_WIDTH;\n  const input = Buffer.from(bytes);\n\n  const meta = await sharp(input).metadata();\n  const origWidth = meta.width;\n  const origHeight = meta.height;\n  if (!origWidth || !origHeight) {\n    throw new Error(\"prepareHeaderImage: could not read source image dimensions\");\n  }\n\n  // Never claim a wider display than the source can fill at 1×.\n  const displayWidth = Math.min(requestedDisplayWidth, origWidth);\n  const displayHeight = Math.round((displayWidth * origHeight) / origWidth);\n\n  // Encode at 2× display for retina, but never enlarge a smaller original.\n  const targetSourceWidth = Math.min(origWidth, displayWidth * RETINA_SCALE);\n\n  const out = await sharp(input)\n    .resize({ width: targetSourceWidth, withoutEnlargement: true })\n    .flatten({ background: \"#ffffff\" })\n    .jpeg({ quality: JPEG_QUALITY })\n    .toBuffer();\n\n  const { dominant } = await sharp(out).stats();\n  const placeholderColor = `#${channelToHex(dominant.r)}${channelToHex(dominant.g)}${channelToHex(dominant.b)}`;\n\n  return {\n    bytes: new Uint8Array(out),\n    contentType: \"image/jpeg\",\n    displayWidth,\n    displayHeight,\n    placeholderColor,\n  };\n}\n","/**\n * True when a thrown send error is Resend's same-key + DIFFERENT-body 409\n * (`invalid_idempotent_request`). The ResendClient (send/resend.ts) discards the\n * status/name and only surfaces the message string, so we match defensively on the\n * stable message substring \"idempotency key has been used\" (case-insensitive); a\n * `name`/`statusCode` of 409/`invalid_idempotent_request` is also accepted if a\n * future client happens to preserve it. A same-key + SAME-body re-send is deduped\n * by Resend (returns the original id) and never reaches here.\n *\n * Shared by both send surfaces that key into Resend's idempotency window:\n * `runDigest` (digest.ts, `digest-<date>` key) and `sendOne` (orchestrate.ts,\n * `report:<id>` key). Both treat a 409 as \"the email already went out under this\n * key on a prior run\" — a no-op for the digest, an already-done success for sendOne.\n */\nexport function isIdempotencyConflict(err: unknown): boolean {\n  const message = err instanceof Error ? err.message : String(err);\n  if (/idempotency key has been used/i.test(message)) return true;\n  const e = err as { name?: unknown; statusCode?: unknown };\n  if (e.name === \"invalid_idempotent_request\") return true;\n  if (e.statusCode === 409) return true;\n  return false;\n}\n","import { openBase, readAirtableConfig } from \"../airtable/client.js\";\nimport { listSendableReports, stampSent } from \"../airtable/reports.js\";\nimport { listWebsites, siteSlug, updateLaunched } from \"../airtable/websites.js\";\nimport type { WebsiteRow } from \"../airtable/websites.js\";\nimport type { ReportRow } from \"../airtable/reports.js\";\nimport { fetchAttachmentBytes } from \"../airtable/attachments.js\";\nimport { resolveCopy } from \"../copy.js\";\nimport { announcementSiteExtras } from \"../announcement-email/template.js\";\nimport { renderReportEmail } from \"./render-email.js\";\nimport type { ReportData } from \"../types.js\";\nimport { prepareHeaderImage } from \"../maintenance-email/header-image.js\";\nimport { defaultResendClient, type ResendClient } from \"./resend.js\";\nimport { isIdempotencyConflict } from \"./idempotency.js\";\nimport { gatingHealth, isHealthGateClear, isSendOverridden } from \"../checklist.js\";\nimport { recordFleetEventsBestEffort } from \"../../audits/fleet-events-writer.js\";\n\nconst FROM_ADDRESS = \"Reddoor Reports <reports@reddoorla.com>\";\nconst REPLY_TO = \"info@reddoorla.com\";\n\n/** Operations inbox CC'd on every outgoing report so there's always an internal\n *  copy on file alongside the client recipients. */\nexport const GLOBAL_REPORT_CC = \"info@reddoorla.com\";\n\n/**\n * Append {@link GLOBAL_REPORT_CC} to a site's per-site CC list. The per-site CC is\n * passed through unchanged (preserving prior behavior); the global address is added\n * only when it isn't already present in the CC or To lists (case-insensitive), so a\n * report is never double-addressed to the ops inbox. Returns the final CC list (may\n * be empty if the global address is already the sole To recipient — the caller omits\n * an empty CC).\n */\nexport function withGlobalCc(perSiteCc: string[] | null, to: string[]): string[] {\n  const cc = [...(perSiteCc ?? [])];\n  const present = new Set([...cc, ...to].map((a) => a.toLowerCase()));\n  if (!present.has(GLOBAL_REPORT_CC.toLowerCase())) cc.push(GLOBAL_REPORT_CC);\n  return cc;\n}\n\n/** Whole days spanned by an ISO period window, or undefined when either bound is missing or the\n *  span isn't positive. Drives the analytics trend's \"vs the previous N days\" label. */\nfunction windowDays(start: string | null, end: string | null): number | undefined {\n  if (!start || !end) return undefined;\n  const ms = new Date(end).getTime() - new Date(start).getTime();\n  if (!Number.isFinite(ms) || ms <= 0) return undefined;\n  return Math.round(ms / (24 * 60 * 60 * 1000));\n}\n\nexport type OrchestrateOptions = {\n  resend?: ResendClient;\n};\n\nexport async function sendApprovedReports(\n  options: OrchestrateOptions = {},\n): Promise<{ output: string; code: number }> {\n  const base = openBase(readAirtableConfig());\n  const client = options.resend ?? defaultResendClient();\n\n  const sendable = await listSendableReports(base);\n  if (sendable.length === 0) return { output: \"No reports ready to send.\", code: 0 };\n\n  const websites = await listWebsites(base);\n  const sites = new Map(websites.map((w) => [w.id, w]));\n\n  const lines: string[] = [];\n  let anyFailed = false;\n  for (const report of sendable) {\n    const site = sites.get(report.siteId);\n    if (!site) {\n      lines.push(`✗ ${report.reportId} — Site row not found for id=${report.siteId}`);\n      anyFailed = true;\n      continue;\n    }\n    try {\n      const messageId = await sendOne(client, base, site, report);\n      lines.push(`✓ sent: ${report.reportId} (${messageId})`);\n      if (report.sendOverride) {\n        const failing = gatingHealth({\n          reportType: report.reportType,\n          autoEvidence: report.autoEvidence ?? {},\n        })\n          .filter((h) => h.status !== \"pass\" && h.status !== \"n/a\")\n          .map((h) => h.field);\n        await recordFleetEventsBestEffort(\n          [\n            {\n              id: `report_sent_with_override:${report.id}`,\n              ts: new Date().toISOString(),\n              type: \"report_sent_with_override\",\n              siteId: site.id,\n              siteName: site.name,\n              summary: `sent with override — ${report.overrideReason ?? \"\"}`,\n              data: { reportId: report.reportId, reason: report.overrideReason, failing },\n            },\n          ],\n          new Date(),\n        );\n      }\n      if (report.reportType === \"Launch\") {\n        try {\n          await updateLaunched(base, site.id, new Date().toISOString());\n          lines.push(`  ↳ launched: ${site.name} flipped to maintenance`);\n          await recordFleetEventsBestEffort(\n            [\n              {\n                id: `site_launched:${site.id}`,\n                ts: new Date().toISOString(),\n                type: \"site_launched\",\n                siteId: site.id,\n                siteName: site.name,\n                summary: \"launched — now in maintenance\",\n                data: null,\n              },\n            ],\n            new Date(),\n          );\n        } catch (e) {\n          lines.push(`  ⚠ launch flip failed for ${site.name}: ${(e as Error).message}`);\n        }\n      }\n    } catch (e) {\n      lines.push(`✗ ${report.reportId} — ${(e as Error).message}`);\n      anyFailed = true;\n    }\n  }\n  return { output: lines.join(\"\\n\"), code: anyFailed ? 1 : 0 };\n}\n\nasync function sendOne(\n  client: ResendClient,\n  base: ReturnType<typeof openBase>,\n  site: WebsiteRow,\n  report: ReportRow,\n): Promise<string> {\n  // Hard health gate: a Maintenance/Testing report whose gating evidence isn't all pass/n/a must\n  // never go out — even if \"Approved to send\" was set directly in Airtable. Throw so the row is\n  // skipped and `Sent at` stays null (at-least-once retry preserved). Launch/Announcement have no\n  // gating fields → vacuously clear. A logged send-anyway override (Phase 10) bypasses the gate.\n  const gateReport = { reportType: report.reportType, autoEvidence: report.autoEvidence ?? {} };\n  if (!isHealthGateClear(gateReport) && !isSendOverridden(report)) {\n    const failing = gatingHealth(gateReport)\n      .filter((h) => h.status !== \"pass\" && h.status !== \"n/a\")\n      .map((h) => {\n        const note = report.autoEvidence?.[h.field]?.note;\n        return `${h.field} (${h.status}${note ? `: ${note}` : \"\"})`;\n      })\n      .join(\"; \");\n    throw new Error(`Report ${report.reportId} health gate not clear — ${failing}`);\n  }\n  if (!site.headerImage) {\n    throw new Error(`Site '${site.name}' has no Header image set on the Websites row`);\n  }\n  if (!report.lighthouse) {\n    throw new Error(\n      `Report ${report.reportId} has no Lighthouse scores — all four cells ` +\n        `(Lighthouse — Performance / Accessibility / Best Practices / SEO) must be numeric ` +\n        `on the Reports row; one non-numeric or blank cell nulls all four`,\n    );\n  }\n\n  // Resolve + validate recipients BEFORE the expensive work (header fetch + sharp\n  // downscale + full MJML render). A misconfigured-recipients site is a guaranteed\n  // failure, so fail fast here rather than after burning that work. Same checks +\n  // messages as before — only the position moved.\n  const explicitTo = parseAddresses(site.reportRecipientsTo);\n  // Run pointOfContact through the parser too — operators sometimes paste\n  // \"a@x, b@y\" into that single-line field.\n  const fallbackTo = parseAddresses(site.pointOfContact);\n  const to = explicitTo ?? fallbackTo ?? [];\n  if (to.length === 0) {\n    throw new Error(\n      `Site '${site.name}' has no recipients (Report recipients (To) AND point of contact are both empty)`,\n    );\n  }\n  for (const addr of to) {\n    if (!isProbablyEmail(addr)) {\n      throw new Error(\n        `Site '${site.name}' recipient is malformed: ${addr} — use a bare address only ` +\n          `(no \\`Name <addr>\\` display-name syntax); fix Report recipients (To) or point of contact in Airtable`,\n      );\n    }\n  }\n  const cc = parseAddresses(site.reportRecipientsCc);\n  if (cc) {\n    for (const addr of cc) {\n      if (!isProbablyEmail(addr)) {\n        throw new Error(\n          `Site '${site.name}' CC is malformed: ${addr} — fix Report recipients (CC) in Airtable`,\n        );\n      }\n    }\n  }\n\n  const original = await fetchAttachmentBytes(site.headerImage.url);\n  // Downscale the (often multi-MB / 2400px+) Airtable header to email display size, and get\n  // back display dims + a placeholder color so the template can reserve the box.\n  const header = await prepareHeaderImage(original.bytes);\n\n  const slug = siteSlug(site.name);\n  const cidName = `${slug}-header`;\n  const gaPeriodDays =\n    report.reportType === \"Announcement\" ? 30 : windowDays(report.periodStart, report.periodEnd);\n  const reportData: ReportData = {\n    siteName: site.name,\n    siteUrl: site.url,\n    reportType: report.reportType,\n    completedOn: report.completedOn ? new Date(report.completedOn) : new Date(),\n    lighthouse: report.lighthouse,\n    gaUsersCurrent: report.gaUsersCurrent ?? undefined,\n    gaUsersPrevious: report.gaUsersPrevious ?? undefined,\n    gaPeriodDays,\n    searchPosition:\n      report.searchFoundPage1 && report.searchPosition !== null ? report.searchPosition : undefined,\n    lastTestedDate: report.lastTestedDate ? new Date(report.lastTestedDate) : null,\n    commentary: report.commentary,\n    copy: resolveCopy(site),\n    headerImageCid: cidName,\n    headerWidth: header.displayWidth,\n    headerHeight: header.displayHeight,\n    headerBgColor: header.placeholderColor,\n    // Announcement-only: re-derive cadence + improvements from the site row so the SENT email\n    // keeps its cadence copy + improvement callouts (not stored on the Reports row).\n    ...(report.reportType === \"Announcement\" ? announcementSiteExtras(site) : {}),\n  };\n  const { html, attachments, subject } = await renderReportEmail(reportData, {\n    header,\n    cidName,\n    subjectOverride: report.subjectOverride ?? undefined,\n  });\n\n  const payload: Parameters<ResendClient[\"send\"]>[0] = {\n    from: FROM_ADDRESS,\n    to,\n    replyTo: REPLY_TO,\n    subject,\n    html,\n    attachments,\n    // Stable across retries of the same row — if Airtable stamping fails after a\n    // successful Resend, the next --send-ready replays with the same key and\n    // Resend returns the original message id rather than sending a duplicate.\n    idempotencyKey: `report:${report.id}`,\n  };\n  // Always CC the ops inbox (info@reddoorla.com), in addition to any per-site CC.\n  const finalCc = withGlobalCc(cc, to);\n  if (finalCc.length > 0) payload.cc = finalCc;\n\n  let result: Awaited<ReturnType<ResendClient[\"send\"]>>;\n  try {\n    result = await client.send(payload);\n  } catch (err) {\n    // The send path is at-least-once: client.send succeeds → stampSent writes\n    // `Sent at` (the ONLY thing that removes the row from listSendableReports). If\n    // stampSent threw on a PRIOR run (an Airtable blip), `Sent at` stayed null and\n    // the row replays here. By replay time the rendered body has usually changed\n    // (operator Commentary edit, `report --due` rewrote scores, or the header\n    // re-encodes non-deterministically), so Resend rejects the same-key\n    // (`report:<id>`) / different-body re-send with a 409 (`invalid_idempotent_request`).\n    //\n    // That 409 means the email ALREADY WENT OUT under this key on the prior run.\n    // Do NOT re-throw and do NOT re-send (re-throwing leaves the row unstamped, and\n    // after the 24h key TTL a SECOND real email would go out). Instead stamp the row\n    // so it stops replaying, then return success so the caller runs the Launch flip —\n    // which self-heals a launch that sent-but-never-flipped on the prior run.\n    //\n    // Any OTHER error (real network/Resend failure) re-throws, exactly as before, so\n    // a genuine failure still fails loudly and the row replays next run.\n    if (isIdempotencyConflict(err)) {\n      // Stamp `Sent at` ONLY — the original send's messageId is unrecoverable on\n      // the 409 path, so we leave `Resend message ID` null rather than writing a\n      // sentinel that would masquerade as a real id and orphan webhook lookups.\n      // Still return the sentinel string so the caller logs the already-sent path\n      // and runs the Launch flip.\n      await stampSent(base, report.id, new Date(), null);\n      console.log(`↻ already sent (idempotency conflict), stamped: ${report.reportId}`);\n      return \"idempotent-conflict\";\n    }\n    throw err;\n  }\n  await stampSent(base, report.id, new Date(), result.messageId);\n  return result.messageId;\n}\n\n/**\n * Split a comma/newline-separated address field into a clean array.\n * Lowercases (case-insensitive dedupe) and removes empty entries. Returns\n * null if nothing survives. Does NOT understand `Display Name <email>` —\n * operators should put a bare address in the Airtable field, or use multiple\n * lines if needing multiple recipients.\n */\nexport function parseAddresses(field: string | null): string[] | null {\n  if (!field) return null;\n  const seen = new Set<string>();\n  const list: string[] = [];\n  for (const raw of field.split(/[,\\n]/)) {\n    const trimmed = raw.trim().toLowerCase();\n    if (!trimmed) continue;\n    if (seen.has(trimmed)) continue;\n    seen.add(trimmed);\n    list.push(trimmed);\n  }\n  return list.length > 0 ? list : null;\n}\n\n/**\n * Cheap email shape check — must contain exactly one @, with non-empty\n * local and domain parts and at least one dot in the domain. We're not\n * trying to be a full RFC validator; we're trying to catch operator\n * mistakes like \"ops at acme dot com\" or a missing @ before they 422\n * at Resend.\n */\nexport function isProbablyEmail(s: string): boolean {\n  const at = s.indexOf(\"@\");\n  if (at < 1 || at !== s.lastIndexOf(\"@\")) return false;\n  const local = s.slice(0, at);\n  const domain = s.slice(at + 1);\n  if (!local || !domain) return false;\n  if (!domain.includes(\".\")) return false;\n  if (/\\s/.test(s)) return false;\n  return true;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0BA,SAAS,mBAAmB,GAKP;AACnB,SAAO;AAAA,IACL,UAAU,EAAE;AAAA,IACZ,SAAS,OAAO,KAAK,EAAE,KAAK,EAAE,SAAS,QAAQ;AAAA,IAC/C,aAAa,EAAE;AAAA,IACf,iBAAiB,EAAE;AAAA,EACrB;AACF;AAWA,eAAsB,kBACpB,YACA,KAC8B;AAC9B,QAAM,EAAE,KAAK,IAAI,MAAM,iBAAiB,UAAU;AAClD,QAAM,UAAU,MAAM,kBAAkB;AACxC,QAAM,cAAkC;AAAA,IACtC,mBAAmB;AAAA,MACjB,OAAO,IAAI,OAAO;AAAA,MAClB,UAAU,GAAG,IAAI,OAAO;AAAA,MACxB,aAAa,IAAI,OAAO;AAAA,MACxB,KAAK,IAAI;AAAA,IACX,CAAC;AAAA,EACH;AACA,aAAW,OAAO,CAAC,QAAQ,OAAO,QAAQ,OAAO,GAAG;AAClD,QAAI,KAAK,SAAS,OAAO,IAAI,GAAG,EAAE,GAAG;AACnC,kBAAY;AAAA,QACV,mBAAmB;AAAA,UACjB,OAAO,IAAI;AAAA,UACX,UAAU,IAAI;AAAA,UACd,aAAa,IAAI;AAAA,UACjB,KAAK,IAAI;AAAA,QACX,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AACA,QAAM,UACJ,IAAI,mBACJ,qBAAqB;AAAA,IACnB,MAAM,WAAW;AAAA,IACjB,KAAK,WAAW;AAAA,IAChB,MAAM,WAAW;AAAA,IACjB,MAAM,WAAW;AAAA,EACnB,CAAC;AACH,SAAO,EAAE,MAAM,aAAa,QAAQ;AACtC;;;ACpFA,OAAO,WAAW;AAoBlB,IAAM,wBAAwB;AAE9B,IAAM,eAAe;AAErB,IAAM,eAAe;AAErB,SAAS,aAAa,OAAuB;AAC3C,SAAO,KAAK,IAAI,GAAG,KAAK,IAAI,KAAK,KAAK,MAAM,KAAK,CAAC,CAAC,EAChD,SAAS,EAAE,EACX,SAAS,GAAG,GAAG;AACpB;AAWA,eAAsB,mBACpB,OACA,UAAqC,CAAC,GACR;AAC9B,QAAM,wBAAwB,QAAQ,gBAAgB;AACtD,QAAM,QAAQ,OAAO,KAAK,KAAK;AAE/B,QAAM,OAAO,MAAM,MAAM,KAAK,EAAE,SAAS;AACzC,QAAM,YAAY,KAAK;AACvB,QAAM,aAAa,KAAK;AACxB,MAAI,CAAC,aAAa,CAAC,YAAY;AAC7B,UAAM,IAAI,MAAM,4DAA4D;AAAA,EAC9E;AAGA,QAAM,eAAe,KAAK,IAAI,uBAAuB,SAAS;AAC9D,QAAM,gBAAgB,KAAK,MAAO,eAAe,aAAc,SAAS;AAGxE,QAAM,oBAAoB,KAAK,IAAI,WAAW,eAAe,YAAY;AAEzE,QAAM,MAAM,MAAM,MAAM,KAAK,EAC1B,OAAO,EAAE,OAAO,mBAAmB,oBAAoB,KAAK,CAAC,EAC7D,QAAQ,EAAE,YAAY,UAAU,CAAC,EACjC,KAAK,EAAE,SAAS,aAAa,CAAC,EAC9B,SAAS;AAEZ,QAAM,EAAE,SAAS,IAAI,MAAM,MAAM,GAAG,EAAE,MAAM;AAC5C,QAAM,mBAAmB,IAAI,aAAa,SAAS,CAAC,CAAC,GAAG,aAAa,SAAS,CAAC,CAAC,GAAG,aAAa,SAAS,CAAC,CAAC;AAE3G,SAAO;AAAA,IACL,OAAO,IAAI,WAAW,GAAG;AAAA,IACzB,aAAa;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;;;AChEO,SAAS,sBAAsB,KAAuB;AAC3D,QAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,MAAI,iCAAiC,KAAK,OAAO,EAAG,QAAO;AAC3D,QAAM,IAAI;AACV,MAAI,EAAE,SAAS,6BAA8B,QAAO;AACpD,MAAI,EAAE,eAAe,IAAK,QAAO;AACjC,SAAO;AACT;;;ACLA,IAAM,eAAe;AACrB,IAAM,WAAW;AAIV,IAAM,mBAAmB;AAUzB,SAAS,aAAa,WAA4B,IAAwB;AAC/E,QAAM,KAAK,CAAC,GAAI,aAAa,CAAC,CAAE;AAChC,QAAM,UAAU,IAAI,IAAI,CAAC,GAAG,IAAI,GAAG,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;AAClE,MAAI,CAAC,QAAQ,IAAI,iBAAiB,YAAY,CAAC,EAAG,IAAG,KAAK,gBAAgB;AAC1E,SAAO;AACT;AAIA,SAAS,WAAW,OAAsB,KAAwC;AAChF,MAAI,CAAC,SAAS,CAAC,IAAK,QAAO;AAC3B,QAAM,KAAK,IAAI,KAAK,GAAG,EAAE,QAAQ,IAAI,IAAI,KAAK,KAAK,EAAE,QAAQ;AAC7D,MAAI,CAAC,OAAO,SAAS,EAAE,KAAK,MAAM,EAAG,QAAO;AAC5C,SAAO,KAAK,MAAM,MAAM,KAAK,KAAK,KAAK,IAAK;AAC9C;AAMA,eAAsB,oBACpB,UAA8B,CAAC,GACY;AAC3C,QAAM,OAAO,SAAS,mBAAmB,CAAC;AAC1C,QAAM,SAAS,QAAQ,UAAU,oBAAoB;AAErD,QAAM,WAAW,MAAM,oBAAoB,IAAI;AAC/C,MAAI,SAAS,WAAW,EAAG,QAAO,EAAE,QAAQ,6BAA6B,MAAM,EAAE;AAEjF,QAAM,WAAW,MAAM,aAAa,IAAI;AACxC,QAAM,QAAQ,IAAI,IAAI,SAAS,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AAEpD,QAAM,QAAkB,CAAC;AACzB,MAAI,YAAY;AAChB,aAAW,UAAU,UAAU;AAC7B,UAAM,OAAO,MAAM,IAAI,OAAO,MAAM;AACpC,QAAI,CAAC,MAAM;AACT,YAAM,KAAK,UAAK,OAAO,QAAQ,qCAAgC,OAAO,MAAM,EAAE;AAC9E,kBAAY;AACZ;AAAA,IACF;AACA,QAAI;AACF,YAAM,YAAY,MAAM,QAAQ,QAAQ,MAAM,MAAM,MAAM;AAC1D,YAAM,KAAK,gBAAW,OAAO,QAAQ,KAAK,SAAS,GAAG;AACtD,UAAI,OAAO,cAAc;AACvB,cAAM,UAAU,aAAa;AAAA,UAC3B,YAAY,OAAO;AAAA,UACnB,cAAc,OAAO,gBAAgB,CAAC;AAAA,QACxC,CAAC,EACE,OAAO,CAAC,MAAM,EAAE,WAAW,UAAU,EAAE,WAAW,KAAK,EACvD,IAAI,CAAC,MAAM,EAAE,KAAK;AACrB,cAAM;AAAA,UACJ;AAAA,YACE;AAAA,cACE,IAAI,6BAA6B,OAAO,EAAE;AAAA,cAC1C,KAAI,oBAAI,KAAK,GAAE,YAAY;AAAA,cAC3B,MAAM;AAAA,cACN,QAAQ,KAAK;AAAA,cACb,UAAU,KAAK;AAAA,cACf,SAAS,6BAAwB,OAAO,kBAAkB,EAAE;AAAA,cAC5D,MAAM,EAAE,UAAU,OAAO,UAAU,QAAQ,OAAO,gBAAgB,QAAQ;AAAA,YAC5E;AAAA,UACF;AAAA,UACA,oBAAI,KAAK;AAAA,QACX;AAAA,MACF;AACA,UAAI,OAAO,eAAe,UAAU;AAClC,YAAI;AACF,gBAAM,eAAe,MAAM,KAAK,KAAI,oBAAI,KAAK,GAAE,YAAY,CAAC;AAC5D,gBAAM,KAAK,sBAAiB,KAAK,IAAI,yBAAyB;AAC9D,gBAAM;AAAA,YACJ;AAAA,cACE;AAAA,gBACE,IAAI,iBAAiB,KAAK,EAAE;AAAA,gBAC5B,KAAI,oBAAI,KAAK,GAAE,YAAY;AAAA,gBAC3B,MAAM;AAAA,gBACN,QAAQ,KAAK;AAAA,gBACb,UAAU,KAAK;AAAA,gBACf,SAAS;AAAA,gBACT,MAAM;AAAA,cACR;AAAA,YACF;AAAA,YACA,oBAAI,KAAK;AAAA,UACX;AAAA,QACF,SAAS,GAAG;AACV,gBAAM,KAAK,mCAA8B,KAAK,IAAI,KAAM,EAAY,OAAO,EAAE;AAAA,QAC/E;AAAA,MACF;AAAA,IACF,SAAS,GAAG;AACV,YAAM,KAAK,UAAK,OAAO,QAAQ,WAAO,EAAY,OAAO,EAAE;AAC3D,kBAAY;AAAA,IACd;AAAA,EACF;AACA,SAAO,EAAE,QAAQ,MAAM,KAAK,IAAI,GAAG,MAAM,YAAY,IAAI,EAAE;AAC7D;AAEA,eAAe,QACb,QACA,MACA,MACA,QACiB;AAKjB,QAAM,aAAa,EAAE,YAAY,OAAO,YAAY,cAAc,OAAO,gBAAgB,CAAC,EAAE;AAC5F,MAAI,CAAC,kBAAkB,UAAU,KAAK,CAAC,iBAAiB,MAAM,GAAG;AAC/D,UAAM,UAAU,aAAa,UAAU,EACpC,OAAO,CAAC,MAAM,EAAE,WAAW,UAAU,EAAE,WAAW,KAAK,EACvD,IAAI,CAAC,MAAM;AACV,YAAM,OAAO,OAAO,eAAe,EAAE,KAAK,GAAG;AAC7C,aAAO,GAAG,EAAE,KAAK,KAAK,EAAE,MAAM,GAAG,OAAO,KAAK,IAAI,KAAK,EAAE;AAAA,IAC1D,CAAC,EACA,KAAK,IAAI;AACZ,UAAM,IAAI,MAAM,UAAU,OAAO,QAAQ,iCAA4B,OAAO,EAAE;AAAA,EAChF;AACA,MAAI,CAAC,KAAK,aAAa;AACrB,UAAM,IAAI,MAAM,SAAS,KAAK,IAAI,+CAA+C;AAAA,EACnF;AACA,MAAI,CAAC,OAAO,YAAY;AACtB,UAAM,IAAI;AAAA,MACR,UAAU,OAAO,QAAQ;AAAA,IAG3B;AAAA,EACF;AAMA,QAAM,aAAa,eAAe,KAAK,kBAAkB;AAGzD,QAAM,aAAa,eAAe,KAAK,cAAc;AACrD,QAAM,KAAK,cAAc,cAAc,CAAC;AACxC,MAAI,GAAG,WAAW,GAAG;AACnB,UAAM,IAAI;AAAA,MACR,SAAS,KAAK,IAAI;AAAA,IACpB;AAAA,EACF;AACA,aAAW,QAAQ,IAAI;AACrB,QAAI,CAAC,gBAAgB,IAAI,GAAG;AAC1B,YAAM,IAAI;AAAA,QACR,SAAS,KAAK,IAAI,6BAA6B,IAAI;AAAA,MAErD;AAAA,IACF;AAAA,EACF;AACA,QAAM,KAAK,eAAe,KAAK,kBAAkB;AACjD,MAAI,IAAI;AACN,eAAW,QAAQ,IAAI;AACrB,UAAI,CAAC,gBAAgB,IAAI,GAAG;AAC1B,cAAM,IAAI;AAAA,UACR,SAAS,KAAK,IAAI,sBAAsB,IAAI;AAAA,QAC9C;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,WAAW,MAAM,qBAAqB,KAAK,YAAY,GAAG;AAGhE,QAAM,SAAS,MAAM,mBAAmB,SAAS,KAAK;AAEtD,QAAM,OAAO,SAAS,KAAK,IAAI;AAC/B,QAAM,UAAU,GAAG,IAAI;AACvB,QAAM,eACJ,OAAO,eAAe,iBAAiB,KAAK,WAAW,OAAO,aAAa,OAAO,SAAS;AAC7F,QAAM,aAAyB;AAAA,IAC7B,UAAU,KAAK;AAAA,IACf,SAAS,KAAK;AAAA,IACd,YAAY,OAAO;AAAA,IACnB,aAAa,OAAO,cAAc,IAAI,KAAK,OAAO,WAAW,IAAI,oBAAI,KAAK;AAAA,IAC1E,YAAY,OAAO;AAAA,IACnB,gBAAgB,OAAO,kBAAkB;AAAA,IACzC,iBAAiB,OAAO,mBAAmB;AAAA,IAC3C;AAAA,IACA,gBACE,OAAO,oBAAoB,OAAO,mBAAmB,OAAO,OAAO,iBAAiB;AAAA,IACtF,gBAAgB,OAAO,iBAAiB,IAAI,KAAK,OAAO,cAAc,IAAI;AAAA,IAC1E,YAAY,OAAO;AAAA,IACnB,MAAM,YAAY,IAAI;AAAA,IACtB,gBAAgB;AAAA,IAChB,aAAa,OAAO;AAAA,IACpB,cAAc,OAAO;AAAA,IACrB,eAAe,OAAO;AAAA;AAAA;AAAA,IAGtB,GAAI,OAAO,eAAe,iBAAiB,uBAAuB,IAAI,IAAI,CAAC;AAAA,EAC7E;AACA,QAAM,EAAE,MAAM,aAAa,QAAQ,IAAI,MAAM,kBAAkB,YAAY;AAAA,IACzE;AAAA,IACA;AAAA,IACA,iBAAiB,OAAO,mBAAmB;AAAA,EAC7C,CAAC;AAED,QAAM,UAA+C;AAAA,IACnD,MAAM;AAAA,IACN;AAAA,IACA,SAAS;AAAA,IACT;AAAA,IACA;AAAA,IACA;AAAA;AAAA;AAAA;AAAA,IAIA,gBAAgB,UAAU,OAAO,EAAE;AAAA,EACrC;AAEA,QAAM,UAAU,aAAa,IAAI,EAAE;AACnC,MAAI,QAAQ,SAAS,EAAG,SAAQ,KAAK;AAErC,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,OAAO,KAAK,OAAO;AAAA,EACpC,SAAS,KAAK;AAiBZ,QAAI,sBAAsB,GAAG,GAAG;AAM9B,YAAM,UAAU,MAAM,OAAO,IAAI,oBAAI,KAAK,GAAG,IAAI;AACjD,cAAQ,IAAI,wDAAmD,OAAO,QAAQ,EAAE;AAChF,aAAO;AAAA,IACT;AACA,UAAM;AAAA,EACR;AACA,QAAM,UAAU,MAAM,OAAO,IAAI,oBAAI,KAAK,GAAG,OAAO,SAAS;AAC7D,SAAO,OAAO;AAChB;AASO,SAAS,eAAe,OAAuC;AACpE,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,OAAiB,CAAC;AACxB,aAAW,OAAO,MAAM,MAAM,OAAO,GAAG;AACtC,UAAM,UAAU,IAAI,KAAK,EAAE,YAAY;AACvC,QAAI,CAAC,QAAS;AACd,QAAI,KAAK,IAAI,OAAO,EAAG;AACvB,SAAK,IAAI,OAAO;AAChB,SAAK,KAAK,OAAO;AAAA,EACnB;AACA,SAAO,KAAK,SAAS,IAAI,OAAO;AAClC;AASO,SAAS,gBAAgB,GAAoB;AAClD,QAAM,KAAK,EAAE,QAAQ,GAAG;AACxB,MAAI,KAAK,KAAK,OAAO,EAAE,YAAY,GAAG,EAAG,QAAO;AAChD,QAAM,QAAQ,EAAE,MAAM,GAAG,EAAE;AAC3B,QAAM,SAAS,EAAE,MAAM,KAAK,CAAC;AAC7B,MAAI,CAAC,SAAS,CAAC,OAAQ,QAAO;AAC9B,MAAI,CAAC,OAAO,SAAS,GAAG,EAAG,QAAO;AAClC,MAAI,KAAK,KAAK,CAAC,EAAG,QAAO;AACzB,SAAO;AACT;","names":[]}

package/dist/{chunk-7MJBTV2R.js → chunk-FX7RAMGC.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-KRDLHAKK.js";
 import {
   withRecipe
-} from "./chunk-XKOZUVK2.js";
+} from "./chunk-ZTPPCHDB.js";
 import {
   defaultSpawn
 } from "./chunk-HVOOCK6L.js";
@@ -142,4 +142,4 @@ async function healthEndpoint(site, deps = { spawn: defaultSpawn }) {
 export {
   healthEndpoint
 };
-//# sourceMappingURL=chunk-7MJBTV2R.js.map
+//# sourceMappingURL=chunk-FX7RAMGC.js.map

package/dist/{chunk-2AUUAJ5X.js → chunk-GWAOX3CU.js}

@@ -1,27 +1,27 @@
 import {
   convertToPnpm
-} from "./chunk-2X322ZES.js";
+} from "./chunk-MGJ72BA4.js";
 import {
   svelteCodemods
-} from "./chunk-BTEBRTW4.js";
+} from "./chunk-LS6QPANO.js";
 import {
   healthEndpoint
-} from "./chunk-7MJBTV2R.js";
+} from "./chunk-FX7RAMGC.js";
 import {
   smokeSuite
-} from "./chunk-PKVZMFEB.js";
+} from "./chunk-K5JZ5KLO.js";
 import {
   onboard
-} from "./chunk-ZYBOT5PM.js";
+} from "./chunk-NT4WIP7I.js";
 import {
   syncConfigs
-} from "./chunk-JNXCDUYB.js";
+} from "./chunk-Q276MZ7E.js";
 import {
   withRecipe
-} from "./chunk-XKOZUVK2.js";
+} from "./chunk-ZTPPCHDB.js";
 import {
   runAudits
-} from "./chunk-TDG5Z5OT.js";
+} from "./chunk-YSPA5AUT.js";
 import {
   siteLabel
 } from "./chunk-XXTZBPUY.js";
@@ -143,4 +143,4 @@ export {
   DEFAULT_INIT_STEPS,
   init
 };
-//# sourceMappingURL=chunk-2AUUAJ5X.js.map
+//# sourceMappingURL=chunk-GWAOX3CU.js.map

package/dist/{chunk-PKVZMFEB.js → chunk-K5JZ5KLO.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-KRDLHAKK.js";
 import {
   withRecipe
-} from "./chunk-XKOZUVK2.js";
+} from "./chunk-ZTPPCHDB.js";
 import {
   defaultSpawn
 } from "./chunk-HVOOCK6L.js";
@@ -312,4 +312,4 @@ async function smokeSuite(site, deps = { spawn: defaultSpawn }) {
 export {
   smokeSuite
 };
-//# sourceMappingURL=chunk-PKVZMFEB.js.map
+//# sourceMappingURL=chunk-K5JZ5KLO.js.map

package/dist/{chunk-6OYICQSJ.js → chunk-KPQXB5CR.js}

@@ -1,6 +1,6 @@
 import {
   approveBlockers
-} from "./chunk-HBFMTM2E.js";
+} from "./chunk-YIQ7IWE3.js";
 import {
   siteSlug
 } from "./chunk-GXVX4HUH.js";
@@ -225,12 +225,13 @@ function diffAttention(items, prior, today) {
   const next = {};
   for (const it of items) {
     const was = prior[it.key];
+    const exhaustedFlip = it.autoFixExhausted === true && was?.exhausted !== true;
     let status;
     let firstFlaggedAt;
     if (!was) {
       status = "new";
       firstFlaggedAt = today;
-    } else if (it.metric > was.metric) {
+    } else if (it.metric > was.metric || exhaustedFlip) {
       status = "worse";
       firstFlaggedAt = was.firstFlaggedAt;
     } else {
@@ -238,7 +239,11 @@ function diffAttention(items, prior, today) {
       firstFlaggedAt = was.firstFlaggedAt;
     }
     tagged.push({ ...it, status });
-    next[it.key] = { metric: it.metric, firstFlaggedAt };
+    next[it.key] = {
+      metric: it.metric,
+      firstFlaggedAt,
+      ...it.autoFixExhausted === true ? { exhausted: true } : {}
+    };
   }
   return { tagged, next };
 }
@@ -292,4 +297,4 @@ export {
   readDigestState,
   writeDigestState
 };
-//# sourceMappingURL=chunk-6OYICQSJ.js.map
+//# sourceMappingURL=chunk-KPQXB5CR.js.map

package/dist/chunk-KPQXB5CR.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/alerts/digest-collectors.ts","../src/alerts/digest-state.ts"],"sourcesContent":["// src/alerts/digest-collectors.ts\nimport type { AttentionItem } from \"./attention.js\";\nimport { siteSlug, type WebsiteRow } from \"../reports/airtable/websites.js\";\nimport type { ReportRow } from \"../reports/airtable/reports.js\";\nimport { approveBlockers } from \"../reports/preflight.js\";\n\n/** Build the same `/s/<slug>` dashboard link the M3 ready-section uses, trailing-slash-safe.\n *  An empty Name slugs to \"\" and `/s/` is a dead link — fall back to the fleet homepage,\n *  exactly like the ready-section does. */\nfunction dashboardUrl(baseUrl: string, siteName: string): string {\n  const root = baseUrl.replace(/\\/$/, \"\");\n  const slug = siteSlug(siteName);\n  return slug ? `${root}/s/${slug}` : root;\n}\n\n/**\n * A GitHub-signals sweep older than this (or never run) is no longer trustworthy:\n * a repo whose nightly probe THREW stops being re-swept, so its persisted\n * `Default Branch CI` / `Renovate Failing CIs` freeze at their last value forever\n * — a phantom 🔴 that can never clear. 3 days ≈ 3× the daily sweep interval, so a\n * single missed/flaky run doesn't drop a real signal. The CI/Renovate collectors\n * (only) skip a site whose `githubSignalsAt` is staler than this. Vuln/Lighthouse/\n * delivery signals come from other sweeps and are unaffected.\n */\nconst GITHUB_SIGNALS_STALE_DAYS = 3;\nconst MS_PER_DAY = 24 * 60 * 60 * 1000;\n\n/** True when a site's GitHub-signals sweep is too old (or never ran) to trust the\n *  persisted CI/Renovate fields. A null `githubSignalsAt` (never swept) is stale —\n *  there's no sweep to vouch for the values. A future timestamp (now - swept < 0)\n *  is fresh. `now` is injected so the gate is testable. */\nfunction gitHubSignalsStale(swept: string | null, now: Date): boolean {\n  if (swept === null) return true;\n  const ageMs = now.getTime() - Date.parse(swept);\n  if (!Number.isFinite(ageMs)) return true; // unparseable timestamp → don't trust it\n  return ageMs > GITHUB_SIGNALS_STALE_DAYS * MS_PER_DAY;\n}\n\n/** Renovate auto-fix dispatches for one vuln episode before it's \"exhausted\" (manual fix needed). */\nconst AUTO_FIX_EXHAUSTED_CYCLES = 3;\n\n/**\n * One attention item per site carrying current critical+high vulns (medium/low omitted\n * per the locked threshold). PURE: takes already-fetched Websites rows. `metric` is the\n * critical+high count (so a rising count diffs as WORSE); `severity` is `critical` when\n * any critical exists, else `warning`. Null counts (never audited) read as 0 → skipped.\n * Once `securityAutoFixAttempts` reaches AUTO_FIX_EXHAUSTED_CYCLES the item is flagged\n * `autoFixExhausted` (forced-critical, escalated title) — Renovate tried and couldn't fix it.\n *\n * Emission is UNCONDITIONAL — every surface applies its own policy on top:\n *   - digest email: includes a vuln only when `autoFixExhausted` (the operator hears\n *     about a vuln only after Renovate tried and failed; before that the fleet is\n *     still self-patching) — runDigest filters\n *   - cockpit: non-exhausted vuln → amber Watch; exhausted → hard break (assignTier),\n *     and only an exhausted vuln pierces the pre-launch mute (piercesPreLaunchMute)\n */\nexport function collectVulnAlerts(sites: WebsiteRow[], baseUrl: string): AttentionItem[] {\n  const items: AttentionItem[] = [];\n  for (const s of sites) {\n    const critical = s.securityVulnsCritical ?? 0;\n    const high = s.securityVulnsHigh ?? 0;\n    const metric = critical + high;\n    if (metric <= 0) continue;\n    const attempts = s.securityAutoFixAttempts ?? 0;\n    const exhausted = attempts >= AUTO_FIX_EXHAUSTED_CYCLES;\n    const noun = metric === 1 ? \"vuln\" : \"vulns\";\n    items.push({\n      key: `vuln:${s.id}`,\n      kind: \"vuln\",\n      siteName: s.name,\n      title: exhausted\n        ? `${metric} critical/high ${noun} — auto-fix failed (${attempts}×)`\n        : `${metric} critical/high ${noun}`,\n      url: dashboardUrl(baseUrl, s.name),\n      severity: exhausted || critical > 0 ? \"critical\" : \"warning\",\n      metric,\n      ...(exhausted ? { autoFixExhausted: true } : {}),\n    });\n  }\n  return items;\n}\n\n/** Absolute floor below which a Lighthouse category is \"Needs attention\" (Tucker's call). */\nconst LIGHTHOUSE_FLOOR = 75;\n\n/** The four Lighthouse categories, each mapped to its WebsiteRow score field, URL slug,\n *  and the human label rendered in the digest title. Order is the operator's reading order. */\nconst LIGHTHOUSE_CATEGORIES: ReadonlyArray<{\n  field: \"pScore\" | \"rScore\" | \"bpScore\" | \"seoScore\";\n  slug: string;\n  label: string;\n}> = [\n  { field: \"pScore\", slug: \"performance\", label: \"Performance\" },\n  { field: \"rScore\", slug: \"accessibility\", label: \"Accessibility\" },\n  { field: \"bpScore\", slug: \"best-practices\", label: \"Best Practices\" },\n  { field: \"seoScore\", slug: \"seo\", label: \"SEO\" },\n];\n\n/**\n * One attention item per Lighthouse category below the absolute floor (75) for each site.\n * PURE: takes already-fetched Websites rows. Categories are Performance/Accessibility/\n * Best-Practices/SEO. A null score (never audited) or a score >= 75 is skipped. The\n * `metric` is the DEFICIT (`100 - score`): a lower score → higher metric, so a category\n * that drops further diffs as WORSE and one that first crosses below 75 diffs as NEW —\n * which is how `diffAttention`'s \"WORSE on increase\" rule reads an inverted score. `key`\n * is `lighthouse:<siteId>:<categorySlug>`, so the four categories stay distinct per site.\n */\nexport function collectLighthouseAlerts(sites: WebsiteRow[], baseUrl: string): AttentionItem[] {\n  const items: AttentionItem[] = [];\n  for (const s of sites) {\n    for (const cat of LIGHTHOUSE_CATEGORIES) {\n      const score = s[cat.field];\n      if (score === null || score >= LIGHTHOUSE_FLOOR) continue;\n      items.push({\n        key: `lighthouse:${s.id}:${cat.slug}`,\n        kind: \"lighthouse\",\n        siteName: s.name,\n        title: `Lighthouse ${cat.label} ${score} (below ${LIGHTHOUSE_FLOOR})`,\n        url: dashboardUrl(baseUrl, s.name),\n        severity: \"warning\",\n        metric: 100 - score,\n      });\n    }\n  }\n  return items;\n}\n\n/**\n * One attention item per report whose `deliveryStatus` is a failure (`bounced` or\n * `complained` — `delivered`/`pending` are ignored). PURE: takes already-fetched\n * Reports rows + a record-id→site map. A complaint ranks above a bounce (locked\n * threshold), so `severity` is `critical` for complained / `warning` for bounced.\n * `metric` is 1 (a binary event). Orphans (siteId not in the map) are skipped, as\n * the M3 ready-section does, so the digest never renders a broken link. The diff\n * key is the report RECORD id, so two failures on one site stay distinct.\n */\n/**\n * One attention item per unsent draft whose send is ALREADY known to fail\n * (approveBlockers: recipients / header image / report scores). An APPROVED one\n * is critical — the next 09:23 UTC run will go red on it; a pending one is a\n * warning — approving it just schedules that failure. Keyed `preflight:<reportId>`.\n * PURE; same predicate the approve gate and the dashboard chip use.\n */\nexport function collectPreflightBlocked(\n  reports: ReportRow[],\n  sitesById: Map<string, WebsiteRow>,\n  baseUrl: string,\n): AttentionItem[] {\n  const items: AttentionItem[] = [];\n  for (const r of reports) {\n    if (!r.draftReady || r.sentAt !== null) continue;\n    // The approved state rides the KEY so a pending→approved escalation with\n    // unchanged blockers re-news as a fresh critical instead of diffing\n    // \"standing\" against its old warning self.\n    const state = r.approvedToSend ? \"approved\" : \"pending\";\n    const site = sitesById.get(r.siteId);\n    if (!site) {\n      // A dangling/empty Site link is itself a send blocker (sendApprovedReports\n      // fails with \"Site row not found\") — surface it; the empty-slug\n      // dashboardUrl fallback yields the fleet root, not a broken /s/ link.\n      items.push({\n        key: `preflight:${r.id}:${state}`,\n        kind: \"preflight\",\n        siteName: \"(unlinked site)\",\n        title: r.approvedToSend\n          ? `Approved ${r.reportType} will fail at send — site-not-found`\n          : `${r.reportType} draft can't be approved — site-not-found`,\n        url: dashboardUrl(baseUrl, \"\"),\n        severity: r.approvedToSend ? \"critical\" : \"warning\",\n        metric: 1,\n      });\n      continue;\n    }\n    const fails = approveBlockers(site, r).filter((f) => f.level === \"fail\");\n    if (fails.length === 0) continue;\n    const first = fails[0]!;\n    const more = fails.length > 1 ? ` (+${fails.length - 1} more)` : \"\";\n    items.push({\n      key: `preflight:${r.id}:${state}`,\n      kind: \"preflight\",\n      siteName: site.name,\n      title: r.approvedToSend\n        ? `Approved ${r.reportType} will fail at send — ${first.check}${more}`\n        : `${r.reportType} draft can't be approved — ${first.check}${more}`,\n      url: dashboardUrl(baseUrl, site.name),\n      severity: r.approvedToSend ? \"critical\" : \"warning\",\n      metric: fails.length,\n    });\n  }\n  return items;\n}\n\nexport function collectDeliveryFailures(\n  reports: ReportRow[],\n  sitesById: Map<string, WebsiteRow>,\n  baseUrl: string,\n): AttentionItem[] {\n  const items: AttentionItem[] = [];\n  for (const r of reports) {\n    if (r.deliveryStatus !== \"bounced\" && r.deliveryStatus !== \"complained\") continue;\n    const site = sitesById.get(r.siteId);\n    if (!site) continue; // orphan → skip rather than render a broken link\n    const complained = r.deliveryStatus === \"complained\";\n    items.push({\n      key: `delivery:${r.id}`,\n      kind: \"delivery\",\n      siteName: site.name,\n      title: complained ? \"Spam complaint on a sent report\" : \"A sent report bounced\",\n      url: dashboardUrl(baseUrl, site.name),\n      severity: complained ? \"critical\" : \"warning\",\n      metric: 1,\n    });\n  }\n  return items;\n}\n\n/**\n * One attention item per site carrying failing Renovate PRs, read from the\n * slice-2a-persisted `renovateFailingCis` field (the nightly github-signals sweep\n * populates it). PURE. Keyed `renovate:<siteId>` so the digest and the cockpit\n * share one diff key. `metric` is the count (a rising count diffs WORSE); severity\n * `warning`. Null/0 → skipped. A site whose `githubSignalsAt` is >3 days stale (or\n * null) is ALSO skipped — a repo that stopped being swept must not show a phantom\n * count forever (`now` injected, defaults to wall-clock).\n */\nexport function collectRenovateAlerts(\n  sites: WebsiteRow[],\n  baseUrl: string,\n  now: Date = new Date(),\n): AttentionItem[] {\n  const items: AttentionItem[] = [];\n  for (const s of sites) {\n    if (gitHubSignalsStale(s.githubSignalsAt, now)) continue;\n    const n = s.renovateFailingCis ?? 0;\n    if (n <= 0) continue;\n    items.push({\n      key: `renovate:${s.id}`,\n      kind: \"renovate\",\n      siteName: s.name,\n      title: `${n} Renovate ${n === 1 ? \"PR\" : \"PRs\"} failing CI`,\n      url: dashboardUrl(baseUrl, s.name),\n      severity: \"warning\",\n      metric: n,\n    });\n  }\n  return items;\n}\n\n/**\n * One attention item per site whose persisted default-branch CI rollup is\n * `failing` (slice 2a). PURE. `metric` 1 (binary); severity `warning`. Any other\n * state (passing/pending/none) or null is skipped. A site whose `githubSignalsAt`\n * is >3 days stale (or null) is ALSO skipped — a repo that stopped being swept must\n * not show a phantom 🔴 forever (`now` injected, defaults to wall-clock).\n */\nexport function collectCiAlerts(\n  sites: WebsiteRow[],\n  baseUrl: string,\n  now: Date = new Date(),\n): AttentionItem[] {\n  const items: AttentionItem[] = [];\n  for (const s of sites) {\n    if (gitHubSignalsStale(s.githubSignalsAt, now)) continue;\n    if (s.defaultBranchCi !== \"failing\") continue;\n    items.push({\n      key: `ci:${s.id}`,\n      kind: \"ci\",\n      siteName: s.name,\n      title: \"Default-branch CI failing\",\n      url: dashboardUrl(baseUrl, s.name),\n      severity: \"warning\",\n      metric: 1,\n    });\n  }\n  return items;\n}\n\n/**\n * A soft-fail older than this is no longer a trustworthy CURRENT signal. Drafting\n * self-clears `analyticsSoftFailAt` on the next clean enrichment, so a non-null\n * value normally means \"errored on the most recent draft and hasn't recovered\" —\n * but a site that stopped being drafted (freq→None, deprecated) would otherwise\n * show a phantom forever. 45 days covers a monthly cadence + margin; older drops.\n */\nconst ANALYTICS_SOFT_FAIL_STALE_DAYS = 45;\n\n/**\n * One attention item per site whose last draft's GA/Search enrichment ERRORED, read\n * from the `analyticsSoftFailAt` timestamp (drafting sets it on a soft-fail, clears\n * it on a clean enrichment). PURE. Keyed `analytics:<siteId>` so the digest and the\n * cockpit share one diff key; `metric` 1 (binary), severity `warning`. A null\n * timestamp (clean, or the operator-added `Analytics soft-fail at` column absent) is\n * skipped, as is one staler than {@link ANALYTICS_SOFT_FAIL_STALE_DAYS}. On a\n * FLEET-WIDE subject outage many sites surface this at once — that breadth IS the\n * signal here; the report cron additionally emails a single concise fleet-wide alert\n * (see `assessAnalyticsAlert`). `now` injected, defaults to wall-clock.\n */\n/** A function-health sweep older than this can't confirm the CURRENT widget state.\n *  The sweep is nightly, so 3 days (mirrors GITHUB_SIGNALS_STALE_DAYS) tolerates a\n *  weekend of runner flakes without letting a months-old verdict drive an alarm. */\nconst TURNSTILE_WIDGET_STALE_DAYS = 3;\n\n/**\n * One CRITICAL attention item per site with `Require Turnstile` ON whose deployed\n * `/health` reports the Turnstile widget NOT configured (`turnstileWidget === \"fail\"`,\n * fresh per {@link TURNSTILE_WIDGET_STALE_DAYS}). That combination silently buckets\n * 100% of the site's real leads (token-less submissions escalate to spam_auto with\n * notify skipped) and the form-e2e probe cannot see it — testMode bypasses the gate —\n * so the operator's inbox just goes quiet. PURE. Keyed `turnstile:<siteId>`. Because\n * this is an AttentionItem it rides assignTier's items short-circuit, which sits ABOVE\n * the accepted-watch mute loop — an accept key can never silence it. A null verdict or\n * a stale sweep is NOT alarmed here; assignTier raises those as an acceptable\n * \"can't verify\" watch instead. `now` injected, defaults to wall-clock.\n */\nexport function collectTurnstileGuardrailAlerts(\n  sites: WebsiteRow[],\n  baseUrl: string,\n  now: Date = new Date(),\n): AttentionItem[] {\n  const items: AttentionItem[] = [];\n  for (const s of sites) {\n    if (!s.requireTurnstile || s.turnstileWidget !== \"fail\") continue;\n    const at = s.functionHealthCheckedAt;\n    if (at !== null) {\n      const ageMs = now.getTime() - Date.parse(at);\n      // Parseable and beyond the window → stale, downgraded to assignTier's watch.\n      // Unparseable (NaN) keeps the item — never silently drop a real failure.\n      if (Number.isFinite(ageMs) && ageMs > TURNSTILE_WIDGET_STALE_DAYS * MS_PER_DAY) continue;\n    }\n    items.push({\n      key: `turnstile:${s.id}`,\n      kind: \"turnstile\",\n      siteName: s.name,\n      title:\n        \"Require Turnstile is ON but /health reports no widget — real leads are being auto-bucketed\",\n      url: dashboardUrl(baseUrl, s.name),\n      severity: \"critical\",\n      metric: 1,\n    });\n  }\n  return items;\n}\n\n/** Bounced lead notifications inside the window before a site alarms. One bounce can\n *  be a transient greylist/full-mailbox blip; a repeat says the point-of-contact\n *  address itself is bad (the Espada mode: apm@ bounced 4 of 8 with nothing alarming). */\nexport const NOTIFY_BOUNCE_THRESHOLD = 2;\n\n/** Window (days) the bounce count covers. Two weeks: long enough that a low-volume\n *  site's second bounce still lands in the same window as its first, short enough\n *  that a long-fixed address doesn't alarm forever (bounced rows never self-clear —\n *  the alarm ages out as bounced submissions leave the window). */\nexport const NOTIFY_BOUNCE_WINDOW_DAYS = 14;\n\n/**\n * One CRITICAL attention item per site with >= {@link NOTIFY_BOUNCE_THRESHOLD} bounced\n * lead notifications in the last {@link NOTIFY_BOUNCE_WINDOW_DAYS} days — leads are\n * being captured but silently never reach the client, which is worse than no form at\n * all (notifyStatus \"sent\" only means Resend accepted the email; the resend-webhook\n * flips it to \"bounced\" when Resend later reports the failure, 2026-07-16). PURE:\n * takes the pre-fetched per-site counts (`countNotifyBouncedBySite`, keyed by the\n * Websites record id). Keyed `notify-bounce:<siteId>` so the digest and the cockpit\n * share one diff key; `metric` is the bounce count (a rising count diffs WORSE).\n * A site absent from the map (or below threshold) is skipped, as is a count for a\n * site id not in `sites` (orphan → never render a broken link).\n */\nexport function collectNotifyBounceAlerts(\n  sites: WebsiteRow[],\n  bouncedBySite: ReadonlyMap<string, number>,\n  baseUrl: string,\n): AttentionItem[] {\n  const items: AttentionItem[] = [];\n  for (const s of sites) {\n    const n = bouncedBySite.get(s.id) ?? 0;\n    if (n < NOTIFY_BOUNCE_THRESHOLD) continue;\n    items.push({\n      key: `notify-bounce:${s.id}`,\n      kind: \"notify-bounce\",\n      siteName: s.name,\n      title: `${n} lead notifications bounced (${NOTIFY_BOUNCE_WINDOW_DAYS}d) — check the point-of-contact address`,\n      url: dashboardUrl(baseUrl, s.name),\n      severity: \"critical\",\n      metric: n,\n    });\n  }\n  return items;\n}\n\nexport function collectAnalyticsFailures(\n  sites: WebsiteRow[],\n  baseUrl: string,\n  now: Date = new Date(),\n): AttentionItem[] {\n  const items: AttentionItem[] = [];\n  for (const s of sites) {\n    const at = s.analyticsSoftFailAt;\n    if (at === null) continue;\n    const ageMs = now.getTime() - Date.parse(at);\n    // Unparseable timestamp (NaN) → keep the item (don't silently drop a real failure\n    // on a parse glitch); only a parseable, beyond-window age is skipped as stale.\n    if (Number.isFinite(ageMs) && ageMs > ANALYTICS_SOFT_FAIL_STALE_DAYS * MS_PER_DAY) continue;\n    items.push({\n      key: `analytics:${s.id}`,\n      kind: \"analytics\",\n      siteName: s.name,\n      title: \"GA/Search enrichment failing (analytics blank)\",\n      url: dashboardUrl(baseUrl, s.name),\n      severity: \"warning\",\n      metric: 1,\n    });\n  }\n  return items;\n}\n","// src/alerts/digest-state.ts\nimport type { FieldSet } from \"airtable\";\nimport type { AirtableBase } from \"../reports/airtable/client.js\";\nimport type { AttentionItem } from \"./attention.js\";\n\n/**\n * The persisted prior-run snapshot: stable item `key` → its last metric + the\n * date it was FIRST flagged. Lives as JSON in the single \"Digest State\" Airtable\n * row (the IO that loads/stores it — readDigestState/writeDigestState — is added\n * in component 2). `next` from diffAttention is what gets written back.\n * `exhausted` is carried only for vuln keys whose Renovate auto-fix has been\n * exhausted (absent = not exhausted; older snapshots without the field read the\n * same way).\n */\nexport type DigestSnapshot = Record<\n  string,\n  { metric: number; firstFlaggedAt: string; exhausted?: boolean }\n>;\n\n/**\n * PURE diff — the testable core of the hybrid \"snapshot now, mark what's new\".\n * For each current item vs the prior snapshot:\n *   - key absent from prior            → NEW      (firstFlaggedAt = today)\n *   - present and metric > prior.metric → WORSE    (keep the original firstFlaggedAt)\n *   - present and autoFixExhausted flipped on → WORSE (the count didn't move, but\n *     \"Renovate gave up\" is an escalation — without this the digest's first mention\n *     of a vuln, which is gated on exhaustion, would arrive unbadged)\n *   - otherwise (equal or dropped)      → STANDING (keep the original firstFlaggedAt)\n * `next` contains EXACTLY the current items' keys: resolved keys drop out, so a\n * fixed-then-recurring problem re-news correctly. Neither input is mutated.\n */\nexport function diffAttention(\n  items: AttentionItem[],\n  prior: DigestSnapshot,\n  today: string,\n): { tagged: AttentionItem[]; next: DigestSnapshot } {\n  const tagged: AttentionItem[] = [];\n  const next: DigestSnapshot = {};\n  for (const it of items) {\n    const was = prior[it.key];\n    const exhaustedFlip = it.autoFixExhausted === true && was?.exhausted !== true;\n    let status: AttentionItem[\"status\"];\n    let firstFlaggedAt: string;\n    if (!was) {\n      status = \"new\";\n      firstFlaggedAt = today;\n    } else if (it.metric > was.metric || exhaustedFlip) {\n      status = \"worse\";\n      firstFlaggedAt = was.firstFlaggedAt;\n    } else {\n      status = \"standing\";\n      firstFlaggedAt = was.firstFlaggedAt;\n    }\n    tagged.push({ ...it, status });\n    next[it.key] = {\n      metric: it.metric,\n      firstFlaggedAt,\n      ...(it.autoFixExhausted === true ? { exhausted: true } : {}),\n    };\n  }\n  return { tagged, next };\n}\n\n/** The single-row Airtable table that persists the prior digest snapshot. */\nexport const DIGEST_STATE_TABLE = \"Digest State\";\n\n/**\n * Read the persisted prior snapshot from the \"Digest State\" singleton.\n *\n * Reads the FIRST row of an unfiltered select (the table holds exactly one row;\n * the test fake does not evaluate filterByFormula, so we never rely on one). A\n * read miss (no row) OR a parse error (malformed Snapshot JSON) collapses to `{}`\n * — every key then reads as NEW once, which is safe degradation (never crashes\n * the digest).\n */\nexport async function readDigestState(base: AirtableBase): Promise<DigestSnapshot> {\n  const rows: { id: string; fields: Record<string, unknown> }[] = [];\n  await base(DIGEST_STATE_TABLE)\n    .select({ maxRecords: 1, pageSize: 1 })\n    .eachPage((records, fetchNextPage) => {\n      for (const rec of records) rows.push({ id: rec.id, fields: rec.fields });\n      fetchNextPage();\n    });\n  const first = rows[0];\n  if (!first) return {};\n  const raw = first.fields[\"Snapshot\"];\n  if (typeof raw !== \"string\") return {};\n  try {\n    return JSON.parse(raw) as DigestSnapshot;\n  } catch {\n    return {};\n  }\n}\n\n/**\n * Persist the next snapshot to the \"Digest State\" singleton: get-or-create the\n * one row. If a row exists, UPDATE it (keyed by its record id); otherwise CREATE\n * one. `Snapshot` = JSON.stringify(snap); `Updated At` = the injected ISO\n * timestamp (or now). A caller that catches+logs a write failure keeps the\n * already-sent digest unaffected (next run re-news at worst).\n */\nexport async function writeDigestState(\n  base: AirtableBase,\n  snap: DigestSnapshot,\n  updatedAt: string = new Date().toISOString(),\n): Promise<void> {\n  const rows: { id: string }[] = [];\n  await base(DIGEST_STATE_TABLE)\n    .select({ maxRecords: 1, pageSize: 1 })\n    .eachPage((records, fetchNextPage) => {\n      for (const rec of records) rows.push({ id: rec.id });\n      fetchNextPage();\n    });\n  const fields: FieldSet = {\n    Snapshot: JSON.stringify(snap),\n    \"Updated At\": updatedAt,\n  };\n  const existing = rows[0];\n  if (existing) {\n    await base(DIGEST_STATE_TABLE).update([{ id: existing.id, fields }]);\n  } else {\n    await base(DIGEST_STATE_TABLE).create([{ fields }]);\n  }\n}\n"],"mappings":";;;;;;;;AASA,SAAS,aAAa,SAAiB,UAA0B;AAC/D,QAAM,OAAO,QAAQ,QAAQ,OAAO,EAAE;AACtC,QAAM,OAAO,SAAS,QAAQ;AAC9B,SAAO,OAAO,GAAG,IAAI,MAAM,IAAI,KAAK;AACtC;AAWA,IAAM,4BAA4B;AAClC,IAAM,aAAa,KAAK,KAAK,KAAK;AAMlC,SAAS,mBAAmB,OAAsB,KAAoB;AACpE,MAAI,UAAU,KAAM,QAAO;AAC3B,QAAM,QAAQ,IAAI,QAAQ,IAAI,KAAK,MAAM,KAAK;AAC9C,MAAI,CAAC,OAAO,SAAS,KAAK,EAAG,QAAO;AACpC,SAAO,QAAQ,4BAA4B;AAC7C;AAGA,IAAM,4BAA4B;AAiB3B,SAAS,kBAAkB,OAAqB,SAAkC;AACvF,QAAM,QAAyB,CAAC;AAChC,aAAW,KAAK,OAAO;AACrB,UAAM,WAAW,EAAE,yBAAyB;AAC5C,UAAM,OAAO,EAAE,qBAAqB;AACpC,UAAM,SAAS,WAAW;AAC1B,QAAI,UAAU,EAAG;AACjB,UAAM,WAAW,EAAE,2BAA2B;AAC9C,UAAM,YAAY,YAAY;AAC9B,UAAM,OAAO,WAAW,IAAI,SAAS;AACrC,UAAM,KAAK;AAAA,MACT,KAAK,QAAQ,EAAE,EAAE;AAAA,MACjB,MAAM;AAAA,MACN,UAAU,EAAE;AAAA,MACZ,OAAO,YACH,GAAG,MAAM,kBAAkB,IAAI,4BAAuB,QAAQ,UAC9D,GAAG,MAAM,kBAAkB,IAAI;AAAA,MACnC,KAAK,aAAa,SAAS,EAAE,IAAI;AAAA,MACjC,UAAU,aAAa,WAAW,IAAI,aAAa;AAAA,MACnD;AAAA,MACA,GAAI,YAAY,EAAE,kBAAkB,KAAK,IAAI,CAAC;AAAA,IAChD,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAGA,IAAM,mBAAmB;AAIzB,IAAM,wBAID;AAAA,EACH,EAAE,OAAO,UAAU,MAAM,eAAe,OAAO,cAAc;AAAA,EAC7D,EAAE,OAAO,UAAU,MAAM,iBAAiB,OAAO,gBAAgB;AAAA,EACjE,EAAE,OAAO,WAAW,MAAM,kBAAkB,OAAO,iBAAiB;AAAA,EACpE,EAAE,OAAO,YAAY,MAAM,OAAO,OAAO,MAAM;AACjD;AAWO,SAAS,wBAAwB,OAAqB,SAAkC;AAC7F,QAAM,QAAyB,CAAC;AAChC,aAAW,KAAK,OAAO;AACrB,eAAW,OAAO,uBAAuB;AACvC,YAAM,QAAQ,EAAE,IAAI,KAAK;AACzB,UAAI,UAAU,QAAQ,SAAS,iBAAkB;AACjD,YAAM,KAAK;AAAA,QACT,KAAK,cAAc,EAAE,EAAE,IAAI,IAAI,IAAI;AAAA,QACnC,MAAM;AAAA,QACN,UAAU,EAAE;AAAA,QACZ,OAAO,cAAc,IAAI,KAAK,IAAI,KAAK,WAAW,gBAAgB;AAAA,QAClE,KAAK,aAAa,SAAS,EAAE,IAAI;AAAA,QACjC,UAAU;AAAA,QACV,QAAQ,MAAM;AAAA,MAChB,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO;AACT;AAkBO,SAAS,wBACd,SACA,WACA,SACiB;AACjB,QAAM,QAAyB,CAAC;AAChC,aAAW,KAAK,SAAS;AACvB,QAAI,CAAC,EAAE,cAAc,EAAE,WAAW,KAAM;AAIxC,UAAM,QAAQ,EAAE,iBAAiB,aAAa;AAC9C,UAAM,OAAO,UAAU,IAAI,EAAE,MAAM;AACnC,QAAI,CAAC,MAAM;AAIT,YAAM,KAAK;AAAA,QACT,KAAK,aAAa,EAAE,EAAE,IAAI,KAAK;AAAA,QAC/B,MAAM;AAAA,QACN,UAAU;AAAA,QACV,OAAO,EAAE,iBACL,YAAY,EAAE,UAAU,6CACxB,GAAG,EAAE,UAAU;AAAA,QACnB,KAAK,aAAa,SAAS,EAAE;AAAA,QAC7B,UAAU,EAAE,iBAAiB,aAAa;AAAA,QAC1C,QAAQ;AAAA,MACV,CAAC;AACD;AAAA,IACF;AACA,UAAM,QAAQ,gBAAgB,MAAM,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,MAAM;AACvE,QAAI,MAAM,WAAW,EAAG;AACxB,UAAM,QAAQ,MAAM,CAAC;AACrB,UAAM,OAAO,MAAM,SAAS,IAAI,MAAM,MAAM,SAAS,CAAC,WAAW;AACjE,UAAM,KAAK;AAAA,MACT,KAAK,aAAa,EAAE,EAAE,IAAI,KAAK;AAAA,MAC/B,MAAM;AAAA,MACN,UAAU,KAAK;AAAA,MACf,OAAO,EAAE,iBACL,YAAY,EAAE,UAAU,6BAAwB,MAAM,KAAK,GAAG,IAAI,KAClE,GAAG,EAAE,UAAU,mCAA8B,MAAM,KAAK,GAAG,IAAI;AAAA,MACnE,KAAK,aAAa,SAAS,KAAK,IAAI;AAAA,MACpC,UAAU,EAAE,iBAAiB,aAAa;AAAA,MAC1C,QAAQ,MAAM;AAAA,IAChB,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEO,SAAS,wBACd,SACA,WACA,SACiB;AACjB,QAAM,QAAyB,CAAC;AAChC,aAAW,KAAK,SAAS;AACvB,QAAI,EAAE,mBAAmB,aAAa,EAAE,mBAAmB,aAAc;AACzE,UAAM,OAAO,UAAU,IAAI,EAAE,MAAM;AACnC,QAAI,CAAC,KAAM;AACX,UAAM,aAAa,EAAE,mBAAmB;AACxC,UAAM,KAAK;AAAA,MACT,KAAK,YAAY,EAAE,EAAE;AAAA,MACrB,MAAM;AAAA,MACN,UAAU,KAAK;AAAA,MACf,OAAO,aAAa,oCAAoC;AAAA,MACxD,KAAK,aAAa,SAAS,KAAK,IAAI;AAAA,MACpC,UAAU,aAAa,aAAa;AAAA,MACpC,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAWO,SAAS,sBACd,OACA,SACA,MAAY,oBAAI,KAAK,GACJ;AACjB,QAAM,QAAyB,CAAC;AAChC,aAAW,KAAK,OAAO;AACrB,QAAI,mBAAmB,EAAE,iBAAiB,GAAG,EAAG;AAChD,UAAM,IAAI,EAAE,sBAAsB;AAClC,QAAI,KAAK,EAAG;AACZ,UAAM,KAAK;AAAA,MACT,KAAK,YAAY,EAAE,EAAE;AAAA,MACrB,MAAM;AAAA,MACN,UAAU,EAAE;AAAA,MACZ,OAAO,GAAG,CAAC,aAAa,MAAM,IAAI,OAAO,KAAK;AAAA,MAC9C,KAAK,aAAa,SAAS,EAAE,IAAI;AAAA,MACjC,UAAU;AAAA,MACV,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AACA,SAAO;AACT;AASO,SAAS,gBACd,OACA,SACA,MAAY,oBAAI,KAAK,GACJ;AACjB,QAAM,QAAyB,CAAC;AAChC,aAAW,KAAK,OAAO;AACrB,QAAI,mBAAmB,EAAE,iBAAiB,GAAG,EAAG;AAChD,QAAI,EAAE,oBAAoB,UAAW;AACrC,UAAM,KAAK;AAAA,MACT,KAAK,MAAM,EAAE,EAAE;AAAA,MACf,MAAM;AAAA,MACN,UAAU,EAAE;AAAA,MACZ,OAAO;AAAA,MACP,KAAK,aAAa,SAAS,EAAE,IAAI;AAAA,MACjC,UAAU;AAAA,MACV,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AACA,SAAO;AACT;AASA,IAAM,iCAAiC;AAgBvC,IAAM,8BAA8B;AAc7B,SAAS,gCACd,OACA,SACA,MAAY,oBAAI,KAAK,GACJ;AACjB,QAAM,QAAyB,CAAC;AAChC,aAAW,KAAK,OAAO;AACrB,QAAI,CAAC,EAAE,oBAAoB,EAAE,oBAAoB,OAAQ;AACzD,UAAM,KAAK,EAAE;AACb,QAAI,OAAO,MAAM;AACf,YAAM,QAAQ,IAAI,QAAQ,IAAI,KAAK,MAAM,EAAE;AAG3C,UAAI,OAAO,SAAS,KAAK,KAAK,QAAQ,8BAA8B,WAAY;AAAA,IAClF;AACA,UAAM,KAAK;AAAA,MACT,KAAK,aAAa,EAAE,EAAE;AAAA,MACtB,MAAM;AAAA,MACN,UAAU,EAAE;AAAA,MACZ,OACE;AAAA,MACF,KAAK,aAAa,SAAS,EAAE,IAAI;AAAA,MACjC,UAAU;AAAA,MACV,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAKO,IAAM,0BAA0B;AAMhC,IAAM,4BAA4B;AAclC,SAAS,0BACd,OACA,eACA,SACiB;AACjB,QAAM,QAAyB,CAAC;AAChC,aAAW,KAAK,OAAO;AACrB,UAAM,IAAI,cAAc,IAAI,EAAE,EAAE,KAAK;AACrC,QAAI,IAAI,wBAAyB;AACjC,UAAM,KAAK;AAAA,MACT,KAAK,iBAAiB,EAAE,EAAE;AAAA,MAC1B,MAAM;AAAA,MACN,UAAU,EAAE;AAAA,MACZ,OAAO,GAAG,CAAC,gCAAgC,yBAAyB;AAAA,MACpE,KAAK,aAAa,SAAS,EAAE,IAAI;AAAA,MACjC,UAAU;AAAA,MACV,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEO,SAAS,yBACd,OACA,SACA,MAAY,oBAAI,KAAK,GACJ;AACjB,QAAM,QAAyB,CAAC;AAChC,aAAW,KAAK,OAAO;AACrB,UAAM,KAAK,EAAE;AACb,QAAI,OAAO,KAAM;AACjB,UAAM,QAAQ,IAAI,QAAQ,IAAI,KAAK,MAAM,EAAE;AAG3C,QAAI,OAAO,SAAS,KAAK,KAAK,QAAQ,iCAAiC,WAAY;AACnF,UAAM,KAAK;AAAA,MACT,KAAK,aAAa,EAAE,EAAE;AAAA,MACtB,MAAM;AAAA,MACN,UAAU,EAAE;AAAA,MACZ,OAAO;AAAA,MACP,KAAK,aAAa,SAAS,EAAE,IAAI;AAAA,MACjC,UAAU;AAAA,MACV,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AACA,SAAO;AACT;;;AC7XO,SAAS,cACd,OACA,OACA,OACmD;AACnD,QAAM,SAA0B,CAAC;AACjC,QAAM,OAAuB,CAAC;AAC9B,aAAW,MAAM,OAAO;AACtB,UAAM,MAAM,MAAM,GAAG,GAAG;AACxB,UAAM,gBAAgB,GAAG,qBAAqB,QAAQ,KAAK,cAAc;AACzE,QAAI;AACJ,QAAI;AACJ,QAAI,CAAC,KAAK;AACR,eAAS;AACT,uBAAiB;AAAA,IACnB,WAAW,GAAG,SAAS,IAAI,UAAU,eAAe;AAClD,eAAS;AACT,uBAAiB,IAAI;AAAA,IACvB,OAAO;AACL,eAAS;AACT,uBAAiB,IAAI;AAAA,IACvB;AACA,WAAO,KAAK,EAAE,GAAG,IAAI,OAAO,CAAC;AAC7B,SAAK,GAAG,GAAG,IAAI;AAAA,MACb,QAAQ,GAAG;AAAA,MACX;AAAA,MACA,GAAI,GAAG,qBAAqB,OAAO,EAAE,WAAW,KAAK,IAAI,CAAC;AAAA,IAC5D;AAAA,EACF;AACA,SAAO,EAAE,QAAQ,KAAK;AACxB;AAGO,IAAM,qBAAqB;AAWlC,eAAsB,gBAAgB,MAA6C;AACjF,QAAM,OAA0D,CAAC;AACjE,QAAM,KAAK,kBAAkB,EAC1B,OAAO,EAAE,YAAY,GAAG,UAAU,EAAE,CAAC,EACrC,SAAS,CAAC,SAAS,kBAAkB;AACpC,eAAW,OAAO,QAAS,MAAK,KAAK,EAAE,IAAI,IAAI,IAAI,QAAQ,IAAI,OAAO,CAAC;AACvE,kBAAc;AAAA,EAChB,CAAC;AACH,QAAM,QAAQ,KAAK,CAAC;AACpB,MAAI,CAAC,MAAO,QAAO,CAAC;AACpB,QAAM,MAAM,MAAM,OAAO,UAAU;AACnC,MAAI,OAAO,QAAQ,SAAU,QAAO,CAAC;AACrC,MAAI;AACF,WAAO,KAAK,MAAM,GAAG;AAAA,EACvB,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AASA,eAAsB,iBACpB,MACA,MACA,aAAoB,oBAAI,KAAK,GAAE,YAAY,GAC5B;AACf,QAAM,OAAyB,CAAC;AAChC,QAAM,KAAK,kBAAkB,EAC1B,OAAO,EAAE,YAAY,GAAG,UAAU,EAAE,CAAC,EACrC,SAAS,CAAC,SAAS,kBAAkB;AACpC,eAAW,OAAO,QAAS,MAAK,KAAK,EAAE,IAAI,IAAI,GAAG,CAAC;AACnD,kBAAc;AAAA,EAChB,CAAC;AACH,QAAM,SAAmB;AAAA,IACvB,UAAU,KAAK,UAAU,IAAI;AAAA,IAC7B,cAAc;AAAA,EAChB;AACA,QAAM,WAAW,KAAK,CAAC;AACvB,MAAI,UAAU;AACZ,UAAM,KAAK,kBAAkB,EAAE,OAAO,CAAC,EAAE,IAAI,SAAS,IAAI,OAAO,CAAC,CAAC;AAAA,EACrE,OAAO;AACL,UAAM,KAAK,kBAAkB,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;AAAA,EACpD;AACF;","names":[]}

package/dist/{chunk-BTEBRTW4.js → chunk-LS6QPANO.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-J7SZQUCW.js";
 import {
   withRecipe
-} from "./chunk-XKOZUVK2.js";
+} from "./chunk-ZTPPCHDB.js";
 
 // src/recipes/svelte-codemods.ts
 import { writeFile } from "fs/promises";
@@ -32,4 +32,4 @@ async function svelteCodemods(site) {
 export {
   svelteCodemods
 };
-//# sourceMappingURL=chunk-BTEBRTW4.js.map
+//# sourceMappingURL=chunk-LS6QPANO.js.map

package/dist/{chunk-2X322ZES.js → chunk-MGJ72BA4.js}

@@ -1,6 +1,6 @@
 import {
   withRecipe
-} from "./chunk-XKOZUVK2.js";
+} from "./chunk-ZTPPCHDB.js";
 import {
   readPackageJson,
   writePackageJson
@@ -96,4 +96,4 @@ async function convertToPnpm(site, opts = {}) {
 export {
   convertToPnpm
 };
-//# sourceMappingURL=chunk-2X322ZES.js.map
+//# sourceMappingURL=chunk-MGJ72BA4.js.map

package/dist/chunk-MNDIED4M.js

@@ -0,0 +1,137 @@
+// src/github/rulesets.ts
+var FLEET_RULESET_NAME = "main: reviewed changes only";
+var DEFAULT_PULL_REQUEST_PARAMS = {
+  required_approving_review_count: 0,
+  dismiss_stale_reviews_on_push: false,
+  require_code_owner_review: false,
+  require_last_push_approval: false,
+  required_review_thread_resolution: false,
+  allowed_merge_methods: ["squash", "merge", "rebase"]
+};
+function coversDefaultBranch(include) {
+  return (include ?? []).some((r) => r === "~DEFAULT_BRANCH" || r === "~ALL");
+}
+function statusChecksOf(rule) {
+  const raw = rule?.parameters?.["required_status_checks"];
+  return Array.isArray(raw) ? raw : [];
+}
+function ruleOfType(rules, type) {
+  return (rules ?? []).find((r) => r.type === type);
+}
+function desiredRuleset(requiredCheck) {
+  return {
+    name: FLEET_RULESET_NAME,
+    target: "branch",
+    enforcement: "active",
+    bypass_actors: [],
+    conditions: { ref_name: { include: ["~DEFAULT_BRANCH"], exclude: [] } },
+    rules: [
+      { type: "deletion" },
+      { type: "non_fast_forward" },
+      { type: "pull_request", parameters: { ...DEFAULT_PULL_REQUEST_PARAMS } },
+      ...requiredCheck === null ? [] : [
+        {
+          type: "required_status_checks",
+          parameters: {
+            strict_required_status_checks_policy: true,
+            do_not_enforce_on_create: false,
+            required_status_checks: [{ context: requiredCheck }]
+          }
+        }
+      ]
+    ]
+  };
+}
+function rulesetGaps(existing, requiredCheck) {
+  const gaps = [];
+  if (existing.enforcement !== "active") {
+    gaps.push(`enforcement is ${JSON.stringify(existing.enforcement ?? "unset")}, not "active"`);
+  }
+  const bypass = existing.bypass_actors ?? [];
+  if (bypass.length > 0) {
+    gaps.push(`${bypass.length} bypass actor(s) present (fleet floor is an empty bypass list)`);
+  }
+  if (!coversDefaultBranch(existing.conditions?.ref_name?.include)) {
+    gaps.push("ref conditions do not cover the default branch");
+  }
+  const exclude = existing.conditions?.ref_name?.exclude ?? [];
+  if (exclude.length > 0) {
+    gaps.push(
+      `${exclude.length} ref exclude pattern(s) present (excludes can only weaken; fleet floor is none)`
+    );
+  }
+  for (const type of ["deletion", "non_fast_forward", "pull_request"]) {
+    if (!ruleOfType(existing.rules, type)) gaps.push(`missing ${type} rule`);
+  }
+  if (requiredCheck !== null) {
+    const rsc = ruleOfType(existing.rules, "required_status_checks");
+    if (!rsc) {
+      gaps.push(`missing required_status_checks rule ("${requiredCheck}" is observed on the repo)`);
+    } else {
+      if (!statusChecksOf(rsc).some((c) => c.context === requiredCheck)) {
+        gaps.push(`"${requiredCheck}" not among the required status checks`);
+      }
+      if (rsc.parameters?.["strict_required_status_checks_policy"] !== true) {
+        gaps.push("strict (branch-up-to-date) status-check policy is off");
+      }
+    }
+  }
+  return gaps;
+}
+function healRuleset(existing, requiredCheck) {
+  const rules = (existing.rules ?? []).map((r) => ({
+    type: r.type,
+    ...r.parameters === void 0 ? {} : { parameters: { ...r.parameters } }
+  }));
+  for (const type of ["deletion", "non_fast_forward"]) {
+    if (!ruleOfType(rules, type)) rules.push({ type });
+  }
+  if (!ruleOfType(rules, "pull_request")) {
+    rules.push({ type: "pull_request", parameters: { ...DEFAULT_PULL_REQUEST_PARAMS } });
+  }
+  if (requiredCheck !== null) {
+    const rsc = ruleOfType(rules, "required_status_checks");
+    if (!rsc) {
+      rules.push({
+        type: "required_status_checks",
+        parameters: {
+          strict_required_status_checks_policy: true,
+          do_not_enforce_on_create: false,
+          required_status_checks: [{ context: requiredCheck }]
+        }
+      });
+    } else {
+      const params = rsc.parameters ??= {};
+      const checks = statusChecksOf(rsc);
+      if (!checks.some((c) => c.context === requiredCheck)) {
+        params["required_status_checks"] = [...checks, { context: requiredCheck }];
+      }
+      params["strict_required_status_checks_policy"] = true;
+    }
+  }
+  const include = existing.conditions?.ref_name?.include ?? [];
+  return {
+    name: existing.name,
+    target: "branch",
+    enforcement: "active",
+    bypass_actors: [],
+    conditions: {
+      ref_name: {
+        include: coversDefaultBranch(include) ? [...include] : [...include, "~DEFAULT_BRANCH"],
+        // Excludes are cleared, never preserved: they can only remove
+        // protection, and the pure logic cannot tell a benign pattern from
+        // one that neutralizes the default branch (see rulesetGaps).
+        exclude: []
+      }
+    },
+    rules
+  };
+}
+
+export {
+  FLEET_RULESET_NAME,
+  desiredRuleset,
+  rulesetGaps,
+  healRuleset
+};
+//# sourceMappingURL=chunk-MNDIED4M.js.map

package/dist/chunk-MNDIED4M.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/github/rulesets.ts"],"sourcesContent":["/**\n * The pure invariant core of ruleset self-healing (spec:\n * docs/superpowers/specs/2026-08-02-ruleset-self-healing-design.md).\n *\n * Everything here is pure data-in/data-out so the brick-risk logic — \"when is\n * it safe to require a status check\", \"what does healing preserve\" — is unit\n * tested directly. The API I/O lives in gh.ts as thin wrappers.\n *\n * Why rulesets at all, when `protectBranch` (classic protection) already\n * exists: classic protection's `enforce_admins: false` exempts admins, and on\n * 2026-07-26 that hole let a bulk `gh pr merge --auto` sweep land two\n * unreviewed MAJOR bumps (reddoor-starter#77, reddoor-website#111). A ruleset\n * with an EMPTY bypass list binds everyone, including admins. Classic\n * protection stays in place (union-enforced) — this is the stronger layer on\n * top, and the one the fleet actually relies on.\n */\n\n/** One rule inside a ruleset. Kept structurally loose (`parameters` is an open\n *  record) so a GitHub-added rule type or parameter can never crash the parse —\n *  unknown shapes flow through healing untouched. */\nexport type RulesetRule = {\n  type: string;\n  parameters?: Record<string, unknown>;\n};\n\n/** The subset of a GET /repos/{repo}/rulesets/{id} response the logic reads.\n *  Extra fields (timestamps, node_id, _links, current_user_can_bypass) are\n *  ignored on read and never echoed back on PUT. */\nexport type ExistingRuleset = {\n  id: number;\n  name: string;\n  enforcement?: string;\n  bypass_actors?: unknown[];\n  conditions?: { ref_name?: { include?: string[]; exclude?: string[] } };\n  rules?: RulesetRule[];\n};\n\n/** The payload shape POST/PUT accepts. */\nexport type RulesetPayload = {\n  name: string;\n  target: \"branch\";\n  enforcement: \"active\";\n  bypass_actors: unknown[];\n  conditions: { ref_name: { include: string[]; exclude: string[] } };\n  rules: RulesetRule[];\n};\n\n/** Canonical fleet ruleset name — matches the 22 hand-applied 2026-07-31/08-01. */\nexport const FLEET_RULESET_NAME = \"main: reviewed changes only\";\n\n/** `pull_request` defaults for a CREATED ruleset. 0 approvals is deliberate:\n *  one-member org + GitHub forbids self-approval, so any required approval\n *  deadlocks every PR (operator- and Renovate-authored alike) until the\n *  Renovate App identity exists. On HEAL these are never imposed — existing\n *  parameters are preserved so a hand-hardened repo (e.g.\n *  `required_review_thread_resolution: true`) is not fought back down. */\nconst DEFAULT_PULL_REQUEST_PARAMS: Record<string, unknown> = {\n  required_approving_review_count: 0,\n  dismiss_stale_reviews_on_push: false,\n  require_code_owner_review: false,\n  require_last_push_approval: false,\n  required_review_thread_resolution: false,\n  allowed_merge_methods: [\"squash\", \"merge\", \"rebase\"],\n};\n\n/** The ref-condition tokens that cover the default branch. `~ALL` is a\n *  superset of `~DEFAULT_BRANCH`, so either satisfies the floor. */\nfunction coversDefaultBranch(include: string[] | undefined): boolean {\n  return (include ?? []).some((r) => r === \"~DEFAULT_BRANCH\" || r === \"~ALL\");\n}\n\nfunction statusChecksOf(rule: RulesetRule | undefined): Array<{ context?: string }> {\n  const raw = rule?.parameters?.[\"required_status_checks\"];\n  return Array.isArray(raw) ? (raw as Array<{ context?: string }>) : [];\n}\n\nfunction ruleOfType(rules: RulesetRule[] | undefined, type: string): RulesetRule | undefined {\n  return (rules ?? []).find((r) => r.type === type);\n}\n\n/**\n * The desired payload for a repo with NO existing fleet ruleset.\n *\n * `requiredCheck` is the two-stage gate: pass the context string ONLY when\n * that check-run has been observed on the default branch (see\n * `checkContextObserved` in gh.ts); pass `null` otherwise and the ruleset is\n * created with the refs rules alone. Requiring a context that never fires\n * would make the repo permanently unmergeable by EVERYONE — bypass_actors is\n * empty by design, so there is no admin escape. (`.github` sits at stage 1\n * forever for exactly this reason: its ci.yml is `workflow_call`-only and\n * emits no check runs.)\n */\nexport function desiredRuleset(requiredCheck: string | null): RulesetPayload {\n  return {\n    name: FLEET_RULESET_NAME,\n    target: \"branch\",\n    enforcement: \"active\",\n    bypass_actors: [],\n    conditions: { ref_name: { include: [\"~DEFAULT_BRANCH\"], exclude: [] } },\n    rules: [\n      { type: \"deletion\" },\n      { type: \"non_fast_forward\" },\n      { type: \"pull_request\", parameters: { ...DEFAULT_PULL_REQUEST_PARAMS } },\n      ...(requiredCheck === null\n        ? []\n        : [\n            {\n              type: \"required_status_checks\",\n              parameters: {\n                strict_required_status_checks_policy: true,\n                do_not_enforce_on_create: false,\n                required_status_checks: [{ context: requiredCheck }],\n              },\n            },\n          ]),\n    ],\n  };\n}\n\n/**\n * Human-readable floor violations of an existing ruleset; empty array = the\n * ruleset satisfies the fleet floor and must NOT be touched (the noop path).\n *\n * The floor is deliberately a MINIMUM, not an exact shape: extra rules and\n * stronger `pull_request` parameters are not gaps. The one aggressive check is\n * `bypass_actors` — ANY entry is drift, because an empty bypass list is the\n * entire point of the ruleset layer (it is what binds admins). When the\n * Renovate App identity someday warrants a bypass actor, this is the single\n * place that decision gets encoded.\n *\n * `requiredCheck: null` scopes the floor to stage 1 (refs rules only); a\n * string additionally demands that context among required status checks with\n * strict (up-to-date) policy.\n */\nexport function rulesetGaps(existing: ExistingRuleset, requiredCheck: string | null): string[] {\n  const gaps: string[] = [];\n  if (existing.enforcement !== \"active\") {\n    gaps.push(`enforcement is ${JSON.stringify(existing.enforcement ?? \"unset\")}, not \"active\"`);\n  }\n  const bypass = existing.bypass_actors ?? [];\n  if (bypass.length > 0) {\n    gaps.push(`${bypass.length} bypass actor(s) present (fleet floor is an empty bypass list)`);\n  }\n  if (!coversDefaultBranch(existing.conditions?.ref_name?.include)) {\n    gaps.push(\"ref conditions do not cover the default branch\");\n  }\n  // Exclude patterns can ONLY remove protection (GitHub applies exclude over\n  // include), and the pure floor cannot resolve which patterns match the\n  // default branch — `exclude: [\"refs/heads/main\"]` neutralizes the entire\n  // ruleset while every other check here still passes. It is also the\n  // least-destructive-LOOKING admin edit (\"I'll just exclude main for a\n  // minute\"), i.e. exactly the bypass drift this layer alarms on. The fleet\n  // floor is therefore NO excludes at all.\n  const exclude = existing.conditions?.ref_name?.exclude ?? [];\n  if (exclude.length > 0) {\n    gaps.push(\n      `${exclude.length} ref exclude pattern(s) present (excludes can only weaken; fleet floor is none)`,\n    );\n  }\n  for (const type of [\"deletion\", \"non_fast_forward\", \"pull_request\"]) {\n    if (!ruleOfType(existing.rules, type)) gaps.push(`missing ${type} rule`);\n  }\n  if (requiredCheck !== null) {\n    const rsc = ruleOfType(existing.rules, \"required_status_checks\");\n    if (!rsc) {\n      gaps.push(`missing required_status_checks rule (\"${requiredCheck}\" is observed on the repo)`);\n    } else {\n      if (!statusChecksOf(rsc).some((c) => c.context === requiredCheck)) {\n        gaps.push(`\"${requiredCheck}\" not among the required status checks`);\n      }\n      if (rsc.parameters?.[\"strict_required_status_checks_policy\"] !== true) {\n        gaps.push(\"strict (branch-up-to-date) status-check policy is off\");\n      }\n    }\n  }\n  return gaps;\n}\n\n/**\n * The healed PUT payload for a drifted ruleset: existing content merged TOWARD\n * the floor, never away from it.\n *\n * Preserved verbatim: extra rule types (a hand-added `required_linear_history`\n * survives), existing `pull_request` parameters (hand-hardening survives),\n * other required status-check contexts (union, never replace — the same\n * lesson the classic protectBranch PUT learned), and existing ref INCLUDES\n * beyond the default-branch guarantee (extra includes only strengthen).\n *\n * Healed: enforcement → active, bypass_actors → [], and ref excludes → []\n * (both deliberate exceptions to never-weaken, because both are pure\n * weakenings — a bypass actor or an exclude matching the default branch IS\n * the drift being alarmed on), missing rules added, and — only when\n * `requiredCheck` is non-null — the context unioned in with strict policy\n * forced on.\n */\nexport function healRuleset(\n  existing: ExistingRuleset,\n  requiredCheck: string | null,\n): RulesetPayload {\n  const rules: RulesetRule[] = (existing.rules ?? []).map((r) => ({\n    type: r.type,\n    ...(r.parameters === undefined ? {} : { parameters: { ...r.parameters } }),\n  }));\n  for (const type of [\"deletion\", \"non_fast_forward\"]) {\n    if (!ruleOfType(rules, type)) rules.push({ type });\n  }\n  if (!ruleOfType(rules, \"pull_request\")) {\n    rules.push({ type: \"pull_request\", parameters: { ...DEFAULT_PULL_REQUEST_PARAMS } });\n  }\n  if (requiredCheck !== null) {\n    const rsc = ruleOfType(rules, \"required_status_checks\");\n    if (!rsc) {\n      rules.push({\n        type: \"required_status_checks\",\n        parameters: {\n          strict_required_status_checks_policy: true,\n          do_not_enforce_on_create: false,\n          required_status_checks: [{ context: requiredCheck }],\n        },\n      });\n    } else {\n      const params = (rsc.parameters ??= {});\n      const checks = statusChecksOf(rsc);\n      if (!checks.some((c) => c.context === requiredCheck)) {\n        params[\"required_status_checks\"] = [...checks, { context: requiredCheck }];\n      }\n      params[\"strict_required_status_checks_policy\"] = true;\n    }\n  }\n\n  const include = existing.conditions?.ref_name?.include ?? [];\n  return {\n    name: existing.name,\n    target: \"branch\",\n    enforcement: \"active\",\n    bypass_actors: [],\n    conditions: {\n      ref_name: {\n        include: coversDefaultBranch(include) ? [...include] : [...include, \"~DEFAULT_BRANCH\"],\n        // Excludes are cleared, never preserved: they can only remove\n        // protection, and the pure logic cannot tell a benign pattern from\n        // one that neutralizes the default branch (see rulesetGaps).\n        exclude: [],\n      },\n    },\n    rules,\n  };\n}\n"],"mappings":";AAgDO,IAAM,qBAAqB;AAQlC,IAAM,8BAAuD;AAAA,EAC3D,iCAAiC;AAAA,EACjC,+BAA+B;AAAA,EAC/B,2BAA2B;AAAA,EAC3B,4BAA4B;AAAA,EAC5B,mCAAmC;AAAA,EACnC,uBAAuB,CAAC,UAAU,SAAS,QAAQ;AACrD;AAIA,SAAS,oBAAoB,SAAwC;AACnE,UAAQ,WAAW,CAAC,GAAG,KAAK,CAAC,MAAM,MAAM,qBAAqB,MAAM,MAAM;AAC5E;AAEA,SAAS,eAAe,MAA4D;AAClF,QAAM,MAAM,MAAM,aAAa,wBAAwB;AACvD,SAAO,MAAM,QAAQ,GAAG,IAAK,MAAsC,CAAC;AACtE;AAEA,SAAS,WAAW,OAAkC,MAAuC;AAC3F,UAAQ,SAAS,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,SAAS,IAAI;AAClD;AAcO,SAAS,eAAe,eAA8C;AAC3E,SAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,aAAa;AAAA,IACb,eAAe,CAAC;AAAA,IAChB,YAAY,EAAE,UAAU,EAAE,SAAS,CAAC,iBAAiB,GAAG,SAAS,CAAC,EAAE,EAAE;AAAA,IACtE,OAAO;AAAA,MACL,EAAE,MAAM,WAAW;AAAA,MACnB,EAAE,MAAM,mBAAmB;AAAA,MAC3B,EAAE,MAAM,gBAAgB,YAAY,EAAE,GAAG,4BAA4B,EAAE;AAAA,MACvE,GAAI,kBAAkB,OAClB,CAAC,IACD;AAAA,QACE;AAAA,UACE,MAAM;AAAA,UACN,YAAY;AAAA,YACV,sCAAsC;AAAA,YACtC,0BAA0B;AAAA,YAC1B,wBAAwB,CAAC,EAAE,SAAS,cAAc,CAAC;AAAA,UACrD;AAAA,QACF;AAAA,MACF;AAAA,IACN;AAAA,EACF;AACF;AAiBO,SAAS,YAAY,UAA2B,eAAwC;AAC7F,QAAM,OAAiB,CAAC;AACxB,MAAI,SAAS,gBAAgB,UAAU;AACrC,SAAK,KAAK,kBAAkB,KAAK,UAAU,SAAS,eAAe,OAAO,CAAC,gBAAgB;AAAA,EAC7F;AACA,QAAM,SAAS,SAAS,iBAAiB,CAAC;AAC1C,MAAI,OAAO,SAAS,GAAG;AACrB,SAAK,KAAK,GAAG,OAAO,MAAM,gEAAgE;AAAA,EAC5F;AACA,MAAI,CAAC,oBAAoB,SAAS,YAAY,UAAU,OAAO,GAAG;AAChE,SAAK,KAAK,gDAAgD;AAAA,EAC5D;AAQA,QAAM,UAAU,SAAS,YAAY,UAAU,WAAW,CAAC;AAC3D,MAAI,QAAQ,SAAS,GAAG;AACtB,SAAK;AAAA,MACH,GAAG,QAAQ,MAAM;AAAA,IACnB;AAAA,EACF;AACA,aAAW,QAAQ,CAAC,YAAY,oBAAoB,cAAc,GAAG;AACnE,QAAI,CAAC,WAAW,SAAS,OAAO,IAAI,EAAG,MAAK,KAAK,WAAW,IAAI,OAAO;AAAA,EACzE;AACA,MAAI,kBAAkB,MAAM;AAC1B,UAAM,MAAM,WAAW,SAAS,OAAO,wBAAwB;AAC/D,QAAI,CAAC,KAAK;AACR,WAAK,KAAK,yCAAyC,aAAa,4BAA4B;AAAA,IAC9F,OAAO;AACL,UAAI,CAAC,eAAe,GAAG,EAAE,KAAK,CAAC,MAAM,EAAE,YAAY,aAAa,GAAG;AACjE,aAAK,KAAK,IAAI,aAAa,wCAAwC;AAAA,MACrE;AACA,UAAI,IAAI,aAAa,sCAAsC,MAAM,MAAM;AACrE,aAAK,KAAK,uDAAuD;AAAA,MACnE;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAmBO,SAAS,YACd,UACA,eACgB;AAChB,QAAM,SAAwB,SAAS,SAAS,CAAC,GAAG,IAAI,CAAC,OAAO;AAAA,IAC9D,MAAM,EAAE;AAAA,IACR,GAAI,EAAE,eAAe,SAAY,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,WAAW,EAAE;AAAA,EAC1E,EAAE;AACF,aAAW,QAAQ,CAAC,YAAY,kBAAkB,GAAG;AACnD,QAAI,CAAC,WAAW,OAAO,IAAI,EAAG,OAAM,KAAK,EAAE,KAAK,CAAC;AAAA,EACnD;AACA,MAAI,CAAC,WAAW,OAAO,cAAc,GAAG;AACtC,UAAM,KAAK,EAAE,MAAM,gBAAgB,YAAY,EAAE,GAAG,4BAA4B,EAAE,CAAC;AAAA,EACrF;AACA,MAAI,kBAAkB,MAAM;AAC1B,UAAM,MAAM,WAAW,OAAO,wBAAwB;AACtD,QAAI,CAAC,KAAK;AACR,YAAM,KAAK;AAAA,QACT,MAAM;AAAA,QACN,YAAY;AAAA,UACV,sCAAsC;AAAA,UACtC,0BAA0B;AAAA,UAC1B,wBAAwB,CAAC,EAAE,SAAS,cAAc,CAAC;AAAA,QACrD;AAAA,MACF,CAAC;AAAA,IACH,OAAO;AACL,YAAM,SAAU,IAAI,eAAe,CAAC;AACpC,YAAM,SAAS,eAAe,GAAG;AACjC,UAAI,CAAC,OAAO,KAAK,CAAC,MAAM,EAAE,YAAY,aAAa,GAAG;AACpD,eAAO,wBAAwB,IAAI,CAAC,GAAG,QAAQ,EAAE,SAAS,cAAc,CAAC;AAAA,MAC3E;AACA,aAAO,sCAAsC,IAAI;AAAA,IACnD;AAAA,EACF;AAEA,QAAM,UAAU,SAAS,YAAY,UAAU,WAAW,CAAC;AAC3D,SAAO;AAAA,IACL,MAAM,SAAS;AAAA,IACf,QAAQ;AAAA,IACR,aAAa;AAAA,IACb,eAAe,CAAC;AAAA,IAChB,YAAY;AAAA,MACV,UAAU;AAAA,QACR,SAAS,oBAAoB,OAAO,IAAI,CAAC,GAAG,OAAO,IAAI,CAAC,GAAG,SAAS,iBAAiB;AAAA;AAAA;AAAA;AAAA,QAIrF,SAAS,CAAC;AAAA,MACZ;AAAA,IACF;AAAA,IACA;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-JCITWZQR.js → chunk-MNE374CZ.js}

@@ -797,52 +797,6 @@ async function findReportByPeriod(base, siteId, reportType, period) {
   return rows.find((r) => r.siteId === siteId) ?? null;
 }
 
-// src/reports/airtable/attachments.ts
-function looksLikeHtml(bytes) {
-  const start = bytes[0] === 239 && bytes[1] === 187 && bytes[2] === 191 ? 3 : 0;
-  const head = Buffer.from(bytes.slice(start, start + 64)).toString("ascii").replace(/^[\s]+/, "").toLowerCase();
-  return head.startsWith("<!doctype html") || head.startsWith("<html") || head.startsWith("<head");
-}
-async function fetchAttachmentBytes(url) {
-  const res = await fetch(url);
-  if (!res.ok) {
-    throw new Error(
-      `Failed to fetch Airtable attachment ${res.status} ${res.statusText} (url=${url})`
-    );
-  }
-  const contentType = res.headers.get("content-type") ?? "application/octet-stream";
-  const ab = await res.arrayBuffer();
-  const bytes = new Uint8Array(ab);
-  const isImageType = contentType.toLowerCase().startsWith("image/");
-  if (!isImageType && looksLikeHtml(bytes)) {
-    throw new Error(
-      `Airtable attachment did not return image data (content-type="${contentType}", body looks like an HTML page \u2014 the signed URL may have expired) (url=${url})`
-    );
-  }
-  return { bytes, contentType };
-}
-async function uploadAttachment(recordId, fieldName, body, filename, contentType) {
-  const apiKey = process.env.AIRTABLE_PAT;
-  const baseId = process.env.AIRTABLE_BASE_ID;
-  if (!apiKey || !baseId) {
-    throw new Error("AIRTABLE_PAT and AIRTABLE_BASE_ID must be set");
-  }
-  const base64 = typeof body === "string" ? Buffer.from(body, "utf-8").toString("base64") : Buffer.from(body).toString("base64");
-  const payload = { contentType, file: base64, filename };
-  const url = `https://content.airtable.com/v0/${baseId}/${recordId}/${encodeURIComponent(fieldName)}/uploadAttachment`;
-  const res = await fetch(url, {
-    method: "POST",
-    headers: {
-      Authorization: `Bearer ${apiKey}`,
-      "Content-Type": "application/json"
-    },
-    body: JSON.stringify(payload)
-  });
-  if (!res.ok) {
-    throw new Error(`Airtable upload failed: ${res.status} ${res.statusText} ${await res.text()}`);
-  }
-}
-
 export {
   resolveCopy,
   CHECK_CID,
@@ -865,8 +819,6 @@ export {
   listAllReports,
   listReportsForSite,
   stampSent,
-  findReportByPeriod,
-  fetchAttachmentBytes,
-  uploadAttachment
+  findReportByPeriod
 };
-//# sourceMappingURL=chunk-JCITWZQR.js.map
+//# sourceMappingURL=chunk-MNE374CZ.js.map