@reddoorla/maintenance 0.79.0 → 0.80.0

package/dist/{init-Y5O33BUL.js → init-RYKQFSZI.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-4BHNP6Y2.js";
 import {
   init
-} from "./chunk-FAQIMC26.js";
+} from "./chunk-TEOENEJH.js";
 import "./chunk-MGJ72BA4.js";
 import "./chunk-LS6QPANO.js";
 import "./chunk-J7SZQUCW.js";
@@ -20,9 +20,9 @@ import "./chunk-Q276MZ7E.js";
 import "./chunk-73UFRZKY.js";
 import "./chunk-ZTPPCHDB.js";
 import "./chunk-OTGB6YQO.js";
-import "./chunk-3LWKIKZ2.js";
+import "./chunk-JMAFXEQE.js";
 import "./chunk-GASBX52O.js";
-import "./chunk-VSHC4HOI.js";
+import "./chunk-YAMRVXOD.js";
 import "./chunk-LKGVSM2O.js";
 import "./chunk-FDIFTIXC.js";
 import "./chunk-HVOOCK6L.js";
@@ -33,8 +33,8 @@ import {
 } from "./chunk-XXTZBPUY.js";
 import "./chunk-XTK5VIQB.js";
 import "./chunk-U5SZ4FOP.js";
-import "./chunk-EYODPUHV.js";
-import "./chunk-LJPCMXR7.js";
+import "./chunk-NMAWXBJA.js";
+import "./chunk-N4MOEF32.js";
 
 // src/cli/commands/init.ts
 import { resolve } from "path";
@@ -107,4 +107,4 @@ async function runInitCommand(site, opts) {
 export {
   runInitCommand
 };
-//# sourceMappingURL=init-Y5O33BUL.js.map
+//# sourceMappingURL=init-RYKQFSZI.js.map

package/dist/{launch-3SYLX263.js → launch-EGKYS3BD.js}

@@ -1,6 +1,6 @@
 import {
   selfUpdating
-} from "./chunk-QMXQUL5Z.js";
+} from "./chunk-7ADQL5Y3.js";
 import "./chunk-MNDIED4M.js";
 import {
   writeAuditsToAirtable
@@ -15,23 +15,24 @@ import {
 } from "./chunk-4BHNP6Y2.js";
 import {
   queueDraft
-} from "./chunk-SEQA7MC3.js";
+} from "./chunk-62VF32IC.js";
 import {
   createDraft,
   findReportByPeriod,
   renderReportHtml,
   resolveCopy,
   updateReportScores
-} from "./chunk-MNE374CZ.js";
+} from "./chunk-6QRLRT3P.js";
 import {
   uploadAttachment
 } from "./chunk-MPBXOJ3N.js";
+import "./chunk-SEEA6RXF.js";
 import "./chunk-73UFRZKY.js";
 import {
   runAudits
-} from "./chunk-3LWKIKZ2.js";
+} from "./chunk-JMAFXEQE.js";
 import "./chunk-GASBX52O.js";
-import "./chunk-VSHC4HOI.js";
+import "./chunk-YAMRVXOD.js";
 import "./chunk-LKGVSM2O.js";
 import "./chunk-FDIFTIXC.js";
 import "./chunk-HVOOCK6L.js";
@@ -51,8 +52,8 @@ import {
   readAirtableConfig
 } from "./chunk-HN6I2XWI.js";
 import "./chunk-6VAL7XJT.js";
-import "./chunk-EYODPUHV.js";
-import "./chunk-LJPCMXR7.js";
+import "./chunk-NMAWXBJA.js";
+import "./chunk-N4MOEF32.js";
 
 // src/cli/commands/launch.ts
 import { resolve } from "path";
@@ -215,4 +216,4 @@ async function runLaunchCommand(site, opts) {
 export {
   runLaunchCommand
 };
-//# sourceMappingURL=launch-3SYLX263.js.map
+//# sourceMappingURL=launch-EGKYS3BD.js.map

package/dist/{launch-3SYLX263.js.map → launch-EGKYS3BD.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/cli/commands/launch.ts","../src/recipes/launch.ts"],"sourcesContent":["import { resolve } from \"node:path\";\nimport { launch, type LaunchResult, type LaunchStepResult } from \"../../recipes/launch.js\";\nimport { resolveSites } from \"../fleet/resolve-sites.js\";\n\nexport type LaunchCommandOptions = {\n  cwd?: string;\n};\n\nfunction formatStep(name: string, r: LaunchStepResult): string {\n  if (r.kind === \"error\") return `${name.padEnd(20)} error: ${r.message}`;\n  if (r.kind === \"audit\") {\n    const s = r.scores;\n    return `${name.padEnd(20)} audited (P=${s.performance} A=${s.accessibility} BP=${s.bestPractices} SEO=${s.seo})`;\n  }\n  if (r.kind === \"draft\") {\n    return `${name.padEnd(20)} drafted ${r.report.reportId}`;\n  }\n  const rec = r.result;\n  if (rec.status === \"noop\") return `${name.padEnd(20)} noop${rec.notes ? ` — ${rec.notes}` : \"\"}`;\n  if (rec.status === \"failed\")\n    return `${name.padEnd(20)} failed${rec.notes ? ` — ${rec.notes}` : \"\"}`;\n  return `${name.padEnd(20)} applied (${rec.commits.length} commit${rec.commits.length === 1 ? \"\" : \"s\"})${rec.notes ? ` — ${rec.notes}` : \"\"}`;\n}\n\nfunction formatResult(r: LaunchResult): string {\n  const header = `[${r.site}] launch — ${r.complete ? \"drafted (awaiting approval)\" : \"STOPPED\"}`;\n  const body = r.steps.map((s) => formatStep(s.name, s.result)).join(\"\\n\");\n  return `${header}\\n${body}`;\n}\n\n/**\n * `launch <site>` — single-site only. Bootstrap (Renovate + protection), first-audit\n * the site, and DRAFT its launch email into the M3 approve queue. Never sends;\n * the operator approves the draft and the next send run delivers the go-live\n * email (flipping Status → maintenance + stamping Launched at).\n */\nexport async function runLaunchCommand(\n  site: string,\n  opts: LaunchCommandOptions,\n): Promise<{ output: string; code: number }> {\n  const cwd = opts.cwd ? resolve(opts.cwd) : process.cwd();\n  const sites = await resolveSites({ site, cwd });\n  const target = sites[0];\n  if (!target) {\n    return { output: `No site resolved for \"${site}\".`, code: 1 };\n  }\n\n  const result = await launch(target);\n  return { output: formatResult(result), code: result.complete ? 0 : 1 };\n}\n","import type { AuditResult, RecipeResult, Site } from \"../types.js\";\nimport { siteLabel } from \"../util/site.js\";\nimport { selfUpdating } from \"./self-updating/index.js\";\nimport { runAudits } from \"../audits/index.js\";\nimport { hasRealScores, lighthouseScoresFromResult } from \"../audits/lighthouse-airtable.js\";\nimport { writeAuditsToAirtable } from \"../audits/write-audits-to-airtable.js\";\nimport { openBase, readAirtableConfig } from \"../reports/airtable/client.js\";\nimport type { AirtableBase } from \"../reports/airtable/client.js\";\nimport { listWebsites, siteSlug } from \"../reports/airtable/websites.js\";\nimport type { WebsiteRow } from \"../reports/airtable/websites.js\";\nimport {\n  createDraft,\n  findReportByPeriod,\n  updateReportScores,\n} from \"../reports/airtable/reports.js\";\nimport type { ReportRow } from \"../reports/airtable/reports.js\";\nimport { queueDraft } from \"../reports/queue.js\";\nimport { uploadAttachment } from \"../reports/airtable/attachments.js\";\nimport { renderReportHtml } from \"../reports/render.js\";\nimport { resolveCopy } from \"../reports/copy.js\";\nimport type { LighthouseScores } from \"../reports/types.js\";\n\nexport type LaunchStepResult =\n  | { kind: \"recipe\"; result: RecipeResult }\n  | { kind: \"audit\"; results: AuditResult[]; scores: LighthouseScores }\n  | { kind: \"draft\"; report: ReportRow }\n  | { kind: \"error\"; message: string };\n\nexport type LaunchResult = {\n  site: string;\n  steps: Array<{ name: string; result: LaunchStepResult }>;\n  /** True if every step ran (bootstrap + audit + draft); false if a step\n   * errored or a recipe `failed` short-circuited the chain. */\n  complete: boolean;\n};\n\nexport type LaunchDeps = {\n  /** Bootstrap step (Renovate + protection; ci.yml comes from the starter). Defaults to the real `selfUpdating`. */\n  bootstrap?: (site: Site) => Promise<RecipeResult>;\n  /** Audit step. Defaults to the real `runAudits`. */\n  audit?: (site: Site) => Promise<AuditResult[]>;\n  /** Airtable handle. Defaults to opening the live base from credentials. */\n  base?: AirtableBase;\n};\n\n/**\n * Launch a site: bootstrap → first-audit → DRAFT a launch email. The M3\n * approve loop is what actually sends; `launch` never sends — it stops at a\n * dashboard-queued draft (`reportType: \"Launch\"`) carrying the just-audited\n * Lighthouse scores, so `sendOne`'s `report.lighthouse` guard passes.\n *\n * Step-chain (mirrors `init`), stopping on the first error or `failed` recipe:\n *   1. selfUpdating — Renovate + protection (platform auto-merge OFF; ci.yml is the starter's).\n *   2. runAudits + write the scores to the site's Websites row (reuses the\n *      `audit --write-airtable` writer); the Lighthouse scores feed the draft.\n *   3. createDraft — reportType \"Launch\", today's period, the audited scores.\n */\nexport async function launch(site: Site, deps: LaunchDeps = {}): Promise<LaunchResult> {\n  const label = siteLabel(site);\n  const bootstrap = deps.bootstrap ?? selfUpdating;\n  const audit = deps.audit ?? runAudits;\n  const base = deps.base ?? openBase(readAirtableConfig());\n\n  const steps: Array<{ name: string; result: LaunchStepResult }> = [];\n  const stop = (): LaunchResult => ({ site: label, steps, complete: false });\n\n  // 1. Bootstrap.\n  let recipe: RecipeResult;\n  try {\n    recipe = await bootstrap(site);\n  } catch (err) {\n    steps.push({ name: \"self-updating\", result: errorOf(err) });\n    return stop();\n  }\n  steps.push({ name: \"self-updating\", result: { kind: \"recipe\", result: recipe } });\n  if (recipe.status === \"failed\") return stop();\n\n  // 2. Audit + write scores back to Airtable.\n  let results: AuditResult[];\n  try {\n    results = await audit(site);\n  } catch (err) {\n    steps.push({ name: \"audit\", result: errorOf(err) });\n    return stop();\n  }\n  const lhResult = results.find((r) => r.audit === \"lighthouse\");\n  if (!lhResult || !hasRealScores(lhResult)) {\n    steps.push({\n      name: \"audit\",\n      result: { kind: \"error\", message: \"lighthouse audit produced no real scores\" },\n    });\n    return stop();\n  }\n  // The launch announcement renders a numeric score per category; a metric that\n  // errored this run (now null from lighthouseScoresFromResult) keeps the prior\n  // 0 behavior here rather than propagating null into the launch-email path. The\n  // Airtable write path (write-audits-to-airtable) keeps the null → shows \"—\".\n  const rawScores = lighthouseScoresFromResult(lhResult);\n  const scores: LighthouseScores = {\n    performance: rawScores.performance ?? 0,\n    accessibility: rawScores.accessibility ?? 0,\n    bestPractices: rawScores.bestPractices ?? 0,\n    seo: rawScores.seo ?? 0,\n  };\n\n  const websites = await listWebsites(base);\n  const target = websites.find((w) => siteSlug(w.name) === siteSlug(label));\n  if (!target) {\n    steps.push({\n      name: \"audit\",\n      result: { kind: \"error\", message: `no Websites row matched site \"${label}\"` },\n    });\n    return stop();\n  }\n  try {\n    await writeAuditsToAirtable({ base, websites, slug: siteSlug(target.name), results });\n  } catch (err) {\n    steps.push({ name: \"audit\", result: errorOf(err) });\n    return stop();\n  }\n  steps.push({ name: \"audit\", result: { kind: \"audit\", results, scores } });\n\n  // 3. Draft the launch email (reuses draft.ts's reportId/period scheme). DRAFTS\n  //    ONLY — the M3 approve loop sends it and flips Status on send.\n  const today = new Date();\n  const period = today.toISOString().slice(0, 7);\n  const slug = siteSlug(target.name);\n\n  let report: ReportRow;\n  try {\n    // Re-run dedupe: reuse an existing Launch row for this (site, period) instead\n    // of stacking a second draft. findReportByPeriod is the same idempotency\n    // lookup draft.ts documents (dashboard/digest point lookup).\n    const existing = await findReportByPeriod(base, target.id, \"Launch\", period);\n    if (existing) {\n      // Reuse path: the row was created on a prior run with THAT run's scores. This\n      // re-run just produced fresh audit scores AND will re-render the preview from\n      // them — so refresh the row's Lighthouse cells (+ Completed on) to match,\n      // otherwise the sent email (which reads the row) ships stale scores. The\n      // create path already writes fresh scores via createDraft.\n      await updateReportScores(base, existing.id, scores, today);\n      report = existing;\n    } else {\n      report = await createDraft(base, draftInputFor(target, scores, today, period));\n    }\n  } catch (err) {\n    steps.push({ name: \"draft\", result: errorOf(err) });\n    return stop();\n  }\n\n  // Mirror draft.ts:135-154 — render → upload \"Rendered HTML\" preview → flip\n  // Draft ready. Without setDraftReady the draft never enters the approve queue\n  // (every pending-approval gate requires draftReady true), so it can never be\n  // approved or sent. The upload is a review convenience; the ready flag is the\n  // critical step.\n  try {\n    const { html } = await renderReportHtml({\n      siteName: target.name,\n      siteUrl: target.url,\n      reportType: \"Launch\",\n      completedOn: today,\n      lighthouse: scores,\n      lastTestedDate: null,\n      commentary: null,\n      copy: resolveCopy(target),\n      headerImageCid: `${slug}-header`,\n    });\n    // A preview-upload hiccup must NOT fail the launch — log and continue.\n    try {\n      await uploadAttachment(\n        report.id,\n        \"Rendered HTML\",\n        html,\n        `${slug}-${today.toISOString().slice(0, 10)}.html`,\n        \"text/html\",\n      );\n    } catch (uploadErr) {\n      console.warn(\n        `⚠ Launch preview upload skipped for ${target.name}: ${\n          uploadErr instanceof Error ? uploadErr.message : String(uploadErr)\n        }`,\n      );\n    }\n    // Critical: NOT wrapped — a failure here must surface as a failed launch. queueDraft\n    // supersedes any lower-tier (Maintenance/Testing) drafts queued for this site; a Launch is\n    // top tier so it only stands down if another Launch/Announcement is already queued.\n    await queueDraft(base, { id: report.id, siteId: target.id, reportType: \"Launch\" });\n  } catch (err) {\n    steps.push({ name: \"draft\", result: errorOf(err) });\n    return stop();\n  }\n\n  steps.push({ name: \"draft\", result: { kind: \"draft\", report } });\n\n  return { site: label, steps, complete: true };\n}\n\n/** Build the Launch `DraftInput`. reportId/period mirror `draftReportForSite`\n *  (draft.ts) — do not invent a new id scheme. `today`/`period` are threaded in\n *  from `launch()` so a single timestamp drives the render, the draft, the\n *  dedupe lookup, and the preview filename. Launch reports have no period window\n *  and no prior maintenance test, so periodStart/periodEnd/completedOn all\n *  collapse to \"today\" and `lastTestedDate` is null. */\nfunction draftInputFor(\n  target: WebsiteRow,\n  scores: LighthouseScores,\n  today: Date,\n  period: string,\n): Parameters<typeof createDraft>[1] {\n  const reportType = \"Launch\" as const;\n  const reportId = `${target.name} — ${reportType} — ${today.toISOString().slice(0, 10)}`;\n  return {\n    reportId,\n    siteId: target.id,\n    reportType,\n    period,\n    periodStart: today,\n    periodEnd: today,\n    completedOn: today,\n    lighthouse: scores,\n    lastTestedDate: null,\n  };\n}\n\nfunction errorOf(err: unknown): LaunchStepResult {\n  return { kind: \"error\", message: err instanceof Error ? err.message : String(err) };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,eAAe;;;ACyDxB,eAAsB,OAAO,MAAY,OAAmB,CAAC,GAA0B;AACrF,QAAM,QAAQ,UAAU,IAAI;AAC5B,QAAM,YAAY,KAAK,aAAa;AACpC,QAAM,QAAQ,KAAK,SAAS;AAC5B,QAAM,OAAO,KAAK,QAAQ,SAAS,mBAAmB,CAAC;AAEvD,QAAM,QAA2D,CAAC;AAClE,QAAM,OAAO,OAAqB,EAAE,MAAM,OAAO,OAAO,UAAU,MAAM;AAGxE,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,UAAU,IAAI;AAAA,EAC/B,SAAS,KAAK;AACZ,UAAM,KAAK,EAAE,MAAM,iBAAiB,QAAQ,QAAQ,GAAG,EAAE,CAAC;AAC1D,WAAO,KAAK;AAAA,EACd;AACA,QAAM,KAAK,EAAE,MAAM,iBAAiB,QAAQ,EAAE,MAAM,UAAU,QAAQ,OAAO,EAAE,CAAC;AAChF,MAAI,OAAO,WAAW,SAAU,QAAO,KAAK;AAG5C,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,MAAM,IAAI;AAAA,EAC5B,SAAS,KAAK;AACZ,UAAM,KAAK,EAAE,MAAM,SAAS,QAAQ,QAAQ,GAAG,EAAE,CAAC;AAClD,WAAO,KAAK;AAAA,EACd;AACA,QAAM,WAAW,QAAQ,KAAK,CAAC,MAAM,EAAE,UAAU,YAAY;AAC7D,MAAI,CAAC,YAAY,CAAC,cAAc,QAAQ,GAAG;AACzC,UAAM,KAAK;AAAA,MACT,MAAM;AAAA,MACN,QAAQ,EAAE,MAAM,SAAS,SAAS,2CAA2C;AAAA,IAC/E,CAAC;AACD,WAAO,KAAK;AAAA,EACd;AAKA,QAAM,YAAY,2BAA2B,QAAQ;AACrD,QAAM,SAA2B;AAAA,IAC/B,aAAa,UAAU,eAAe;AAAA,IACtC,eAAe,UAAU,iBAAiB;AAAA,IAC1C,eAAe,UAAU,iBAAiB;AAAA,IAC1C,KAAK,UAAU,OAAO;AAAA,EACxB;AAEA,QAAM,WAAW,MAAM,aAAa,IAAI;AACxC,QAAM,SAAS,SAAS,KAAK,CAAC,MAAM,SAAS,EAAE,IAAI,MAAM,SAAS,KAAK,CAAC;AACxE,MAAI,CAAC,QAAQ;AACX,UAAM,KAAK;AAAA,MACT,MAAM;AAAA,MACN,QAAQ,EAAE,MAAM,SAAS,SAAS,iCAAiC,KAAK,IAAI;AAAA,IAC9E,CAAC;AACD,WAAO,KAAK;AAAA,EACd;AACA,MAAI;AACF,UAAM,sBAAsB,EAAE,MAAM,UAAU,MAAM,SAAS,OAAO,IAAI,GAAG,QAAQ,CAAC;AAAA,EACtF,SAAS,KAAK;AACZ,UAAM,KAAK,EAAE,MAAM,SAAS,QAAQ,QAAQ,GAAG,EAAE,CAAC;AAClD,WAAO,KAAK;AAAA,EACd;AACA,QAAM,KAAK,EAAE,MAAM,SAAS,QAAQ,EAAE,MAAM,SAAS,SAAS,OAAO,EAAE,CAAC;AAIxE,QAAM,QAAQ,oBAAI,KAAK;AACvB,QAAM,SAAS,MAAM,YAAY,EAAE,MAAM,GAAG,CAAC;AAC7C,QAAM,OAAO,SAAS,OAAO,IAAI;AAEjC,MAAI;AACJ,MAAI;AAIF,UAAM,WAAW,MAAM,mBAAmB,MAAM,OAAO,IAAI,UAAU,MAAM;AAC3E,QAAI,UAAU;AAMZ,YAAM,mBAAmB,MAAM,SAAS,IAAI,QAAQ,KAAK;AACzD,eAAS;AAAA,IACX,OAAO;AACL,eAAS,MAAM,YAAY,MAAM,cAAc,QAAQ,QAAQ,OAAO,MAAM,CAAC;AAAA,IAC/E;AAAA,EACF,SAAS,KAAK;AACZ,UAAM,KAAK,EAAE,MAAM,SAAS,QAAQ,QAAQ,GAAG,EAAE,CAAC;AAClD,WAAO,KAAK;AAAA,EACd;AAOA,MAAI;AACF,UAAM,EAAE,KAAK,IAAI,MAAM,iBAAiB;AAAA,MACtC,UAAU,OAAO;AAAA,MACjB,SAAS,OAAO;AAAA,MAChB,YAAY;AAAA,MACZ,aAAa;AAAA,MACb,YAAY;AAAA,MACZ,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,MAAM,YAAY,MAAM;AAAA,MACxB,gBAAgB,GAAG,IAAI;AAAA,IACzB,CAAC;AAED,QAAI;AACF,YAAM;AAAA,QACJ,OAAO;AAAA,QACP;AAAA,QACA;AAAA,QACA,GAAG,IAAI,IAAI,MAAM,YAAY,EAAE,MAAM,GAAG,EAAE,CAAC;AAAA,QAC3C;AAAA,MACF;AAAA,IACF,SAAS,WAAW;AAClB,cAAQ;AAAA,QACN,4CAAuC,OAAO,IAAI,KAChD,qBAAqB,QAAQ,UAAU,UAAU,OAAO,SAAS,CACnE;AAAA,MACF;AAAA,IACF;AAIA,UAAM,WAAW,MAAM,EAAE,IAAI,OAAO,IAAI,QAAQ,OAAO,IAAI,YAAY,SAAS,CAAC;AAAA,EACnF,SAAS,KAAK;AACZ,UAAM,KAAK,EAAE,MAAM,SAAS,QAAQ,QAAQ,GAAG,EAAE,CAAC;AAClD,WAAO,KAAK;AAAA,EACd;AAEA,QAAM,KAAK,EAAE,MAAM,SAAS,QAAQ,EAAE,MAAM,SAAS,OAAO,EAAE,CAAC;AAE/D,SAAO,EAAE,MAAM,OAAO,OAAO,UAAU,KAAK;AAC9C;AAQA,SAAS,cACP,QACA,QACA,OACA,QACmC;AACnC,QAAM,aAAa;AACnB,QAAM,WAAW,GAAG,OAAO,IAAI,WAAM,UAAU,WAAM,MAAM,YAAY,EAAE,MAAM,GAAG,EAAE,CAAC;AACrF,SAAO;AAAA,IACL;AAAA,IACA,QAAQ,OAAO;AAAA,IACf;AAAA,IACA;AAAA,IACA,aAAa;AAAA,IACb,WAAW;AAAA,IACX,aAAa;AAAA,IACb,YAAY;AAAA,IACZ,gBAAgB;AAAA,EAClB;AACF;AAEA,SAAS,QAAQ,KAAgC;AAC/C,SAAO,EAAE,MAAM,SAAS,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,EAAE;AACpF;;;AD1NA,SAAS,WAAW,MAAc,GAA6B;AAC7D,MAAI,EAAE,SAAS,QAAS,QAAO,GAAG,KAAK,OAAO,EAAE,CAAC,WAAW,EAAE,OAAO;AACrE,MAAI,EAAE,SAAS,SAAS;AACtB,UAAM,IAAI,EAAE;AACZ,WAAO,GAAG,KAAK,OAAO,EAAE,CAAC,eAAe,EAAE,WAAW,MAAM,EAAE,aAAa,OAAO,EAAE,aAAa,QAAQ,EAAE,GAAG;AAAA,EAC/G;AACA,MAAI,EAAE,SAAS,SAAS;AACtB,WAAO,GAAG,KAAK,OAAO,EAAE,CAAC,YAAY,EAAE,OAAO,QAAQ;AAAA,EACxD;AACA,QAAM,MAAM,EAAE;AACd,MAAI,IAAI,WAAW,OAAQ,QAAO,GAAG,KAAK,OAAO,EAAE,CAAC,QAAQ,IAAI,QAAQ,WAAM,IAAI,KAAK,KAAK,EAAE;AAC9F,MAAI,IAAI,WAAW;AACjB,WAAO,GAAG,KAAK,OAAO,EAAE,CAAC,UAAU,IAAI,QAAQ,WAAM,IAAI,KAAK,KAAK,EAAE;AACvE,SAAO,GAAG,KAAK,OAAO,EAAE,CAAC,aAAa,IAAI,QAAQ,MAAM,UAAU,IAAI,QAAQ,WAAW,IAAI,KAAK,GAAG,IAAI,IAAI,QAAQ,WAAM,IAAI,KAAK,KAAK,EAAE;AAC7I;AAEA,SAAS,aAAa,GAAyB;AAC7C,QAAM,SAAS,IAAI,EAAE,IAAI,mBAAc,EAAE,WAAW,gCAAgC,SAAS;AAC7F,QAAM,OAAO,EAAE,MAAM,IAAI,CAAC,MAAM,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,KAAK,IAAI;AACvE,SAAO,GAAG,MAAM;AAAA,EAAK,IAAI;AAC3B;AAQA,eAAsB,iBACpB,MACA,MAC2C;AAC3C,QAAM,MAAM,KAAK,MAAM,QAAQ,KAAK,GAAG,IAAI,QAAQ,IAAI;AACvD,QAAM,QAAQ,MAAM,aAAa,EAAE,MAAM,IAAI,CAAC;AAC9C,QAAM,SAAS,MAAM,CAAC;AACtB,MAAI,CAAC,QAAQ;AACX,WAAO,EAAE,QAAQ,yBAAyB,IAAI,MAAM,MAAM,EAAE;AAAA,EAC9D;AAEA,QAAM,SAAS,MAAM,OAAO,MAAM;AAClC,SAAO,EAAE,QAAQ,aAAa,MAAM,GAAG,MAAM,OAAO,WAAW,IAAI,EAAE;AACvE;","names":[]}
+{"version":3,"sources":["../src/cli/commands/launch.ts","../src/recipes/launch.ts"],"sourcesContent":["import { resolve } from \"node:path\";\nimport { launch, type LaunchResult, type LaunchStepResult } from \"../../recipes/launch.js\";\nimport { resolveSites } from \"../fleet/resolve-sites.js\";\n\nexport type LaunchCommandOptions = {\n  cwd?: string;\n};\n\nfunction formatStep(name: string, r: LaunchStepResult): string {\n  if (r.kind === \"error\") return `${name.padEnd(20)} error: ${r.message}`;\n  if (r.kind === \"audit\") {\n    const s = r.scores;\n    return `${name.padEnd(20)} audited (P=${s.performance} A=${s.accessibility} BP=${s.bestPractices} SEO=${s.seo})`;\n  }\n  if (r.kind === \"draft\") {\n    return `${name.padEnd(20)} drafted ${r.report.reportId}`;\n  }\n  const rec = r.result;\n  if (rec.status === \"noop\") return `${name.padEnd(20)} noop${rec.notes ? ` — ${rec.notes}` : \"\"}`;\n  if (rec.status === \"failed\")\n    return `${name.padEnd(20)} failed${rec.notes ? ` — ${rec.notes}` : \"\"}`;\n  return `${name.padEnd(20)} applied (${rec.commits.length} commit${rec.commits.length === 1 ? \"\" : \"s\"})${rec.notes ? ` — ${rec.notes}` : \"\"}`;\n}\n\nfunction formatResult(r: LaunchResult): string {\n  const header = `[${r.site}] launch — ${r.complete ? \"drafted (awaiting approval)\" : \"STOPPED\"}`;\n  const body = r.steps.map((s) => formatStep(s.name, s.result)).join(\"\\n\");\n  return `${header}\\n${body}`;\n}\n\n/**\n * `launch <site>` — single-site only. Bootstrap (Renovate + protection), first-audit\n * the site, and DRAFT its launch email into the M3 approve queue. Never sends;\n * the operator approves the draft and the next send run delivers the go-live\n * email (flipping Status → maintenance + stamping Launched at).\n */\nexport async function runLaunchCommand(\n  site: string,\n  opts: LaunchCommandOptions,\n): Promise<{ output: string; code: number }> {\n  const cwd = opts.cwd ? resolve(opts.cwd) : process.cwd();\n  const sites = await resolveSites({ site, cwd });\n  const target = sites[0];\n  if (!target) {\n    return { output: `No site resolved for \"${site}\".`, code: 1 };\n  }\n\n  const result = await launch(target);\n  return { output: formatResult(result), code: result.complete ? 0 : 1 };\n}\n","import type { AuditResult, RecipeResult, Site } from \"../types.js\";\nimport { siteLabel } from \"../util/site.js\";\nimport { selfUpdating } from \"./self-updating/index.js\";\nimport { runAudits } from \"../audits/index.js\";\nimport { hasRealScores, lighthouseScoresFromResult } from \"../audits/lighthouse-airtable.js\";\nimport { writeAuditsToAirtable } from \"../audits/write-audits-to-airtable.js\";\nimport { openBase, readAirtableConfig } from \"../reports/airtable/client.js\";\nimport type { AirtableBase } from \"../reports/airtable/client.js\";\nimport { listWebsites, siteSlug } from \"../reports/airtable/websites.js\";\nimport type { WebsiteRow } from \"../reports/airtable/websites.js\";\nimport {\n  createDraft,\n  findReportByPeriod,\n  updateReportScores,\n} from \"../reports/airtable/reports.js\";\nimport type { ReportRow } from \"../reports/airtable/reports.js\";\nimport { queueDraft } from \"../reports/queue.js\";\nimport { uploadAttachment } from \"../reports/airtable/attachments.js\";\nimport { renderReportHtml } from \"../reports/render.js\";\nimport { resolveCopy } from \"../reports/copy.js\";\nimport type { LighthouseScores } from \"../reports/types.js\";\n\nexport type LaunchStepResult =\n  | { kind: \"recipe\"; result: RecipeResult }\n  | { kind: \"audit\"; results: AuditResult[]; scores: LighthouseScores }\n  | { kind: \"draft\"; report: ReportRow }\n  | { kind: \"error\"; message: string };\n\nexport type LaunchResult = {\n  site: string;\n  steps: Array<{ name: string; result: LaunchStepResult }>;\n  /** True if every step ran (bootstrap + audit + draft); false if a step\n   * errored or a recipe `failed` short-circuited the chain. */\n  complete: boolean;\n};\n\nexport type LaunchDeps = {\n  /** Bootstrap step (Renovate + protection; ci.yml comes from the starter). Defaults to the real `selfUpdating`. */\n  bootstrap?: (site: Site) => Promise<RecipeResult>;\n  /** Audit step. Defaults to the real `runAudits`. */\n  audit?: (site: Site) => Promise<AuditResult[]>;\n  /** Airtable handle. Defaults to opening the live base from credentials. */\n  base?: AirtableBase;\n};\n\n/**\n * Launch a site: bootstrap → first-audit → DRAFT a launch email. The M3\n * approve loop is what actually sends; `launch` never sends — it stops at a\n * dashboard-queued draft (`reportType: \"Launch\"`) carrying the just-audited\n * Lighthouse scores, so `sendOne`'s `report.lighthouse` guard passes.\n *\n * Step-chain (mirrors `init`), stopping on the first error or `failed` recipe:\n *   1. selfUpdating — Renovate + protection (platform auto-merge OFF; ci.yml is the starter's).\n *   2. runAudits + write the scores to the site's Websites row (reuses the\n *      `audit --write-airtable` writer); the Lighthouse scores feed the draft.\n *   3. createDraft — reportType \"Launch\", today's period, the audited scores.\n */\nexport async function launch(site: Site, deps: LaunchDeps = {}): Promise<LaunchResult> {\n  const label = siteLabel(site);\n  const bootstrap = deps.bootstrap ?? selfUpdating;\n  const audit = deps.audit ?? runAudits;\n  const base = deps.base ?? openBase(readAirtableConfig());\n\n  const steps: Array<{ name: string; result: LaunchStepResult }> = [];\n  const stop = (): LaunchResult => ({ site: label, steps, complete: false });\n\n  // 1. Bootstrap.\n  let recipe: RecipeResult;\n  try {\n    recipe = await bootstrap(site);\n  } catch (err) {\n    steps.push({ name: \"self-updating\", result: errorOf(err) });\n    return stop();\n  }\n  steps.push({ name: \"self-updating\", result: { kind: \"recipe\", result: recipe } });\n  if (recipe.status === \"failed\") return stop();\n\n  // 2. Audit + write scores back to Airtable.\n  let results: AuditResult[];\n  try {\n    results = await audit(site);\n  } catch (err) {\n    steps.push({ name: \"audit\", result: errorOf(err) });\n    return stop();\n  }\n  const lhResult = results.find((r) => r.audit === \"lighthouse\");\n  if (!lhResult || !hasRealScores(lhResult)) {\n    steps.push({\n      name: \"audit\",\n      result: { kind: \"error\", message: \"lighthouse audit produced no real scores\" },\n    });\n    return stop();\n  }\n  // The launch announcement renders a numeric score per category; a metric that\n  // errored this run (now null from lighthouseScoresFromResult) keeps the prior\n  // 0 behavior here rather than propagating null into the launch-email path. The\n  // Airtable write path (write-audits-to-airtable) keeps the null → shows \"—\".\n  const rawScores = lighthouseScoresFromResult(lhResult);\n  const scores: LighthouseScores = {\n    performance: rawScores.performance ?? 0,\n    accessibility: rawScores.accessibility ?? 0,\n    bestPractices: rawScores.bestPractices ?? 0,\n    seo: rawScores.seo ?? 0,\n  };\n\n  const websites = await listWebsites(base);\n  const target = websites.find((w) => siteSlug(w.name) === siteSlug(label));\n  if (!target) {\n    steps.push({\n      name: \"audit\",\n      result: { kind: \"error\", message: `no Websites row matched site \"${label}\"` },\n    });\n    return stop();\n  }\n  try {\n    await writeAuditsToAirtable({ base, websites, slug: siteSlug(target.name), results });\n  } catch (err) {\n    steps.push({ name: \"audit\", result: errorOf(err) });\n    return stop();\n  }\n  steps.push({ name: \"audit\", result: { kind: \"audit\", results, scores } });\n\n  // 3. Draft the launch email (reuses draft.ts's reportId/period scheme). DRAFTS\n  //    ONLY — the M3 approve loop sends it and flips Status on send.\n  const today = new Date();\n  const period = today.toISOString().slice(0, 7);\n  const slug = siteSlug(target.name);\n\n  let report: ReportRow;\n  try {\n    // Re-run dedupe: reuse an existing Launch row for this (site, period) instead\n    // of stacking a second draft. findReportByPeriod is the same idempotency\n    // lookup draft.ts documents (dashboard/digest point lookup).\n    const existing = await findReportByPeriod(base, target.id, \"Launch\", period);\n    if (existing) {\n      // Reuse path: the row was created on a prior run with THAT run's scores. This\n      // re-run just produced fresh audit scores AND will re-render the preview from\n      // them — so refresh the row's Lighthouse cells (+ Completed on) to match,\n      // otherwise the sent email (which reads the row) ships stale scores. The\n      // create path already writes fresh scores via createDraft.\n      await updateReportScores(base, existing.id, scores, today);\n      report = existing;\n    } else {\n      report = await createDraft(base, draftInputFor(target, scores, today, period));\n    }\n  } catch (err) {\n    steps.push({ name: \"draft\", result: errorOf(err) });\n    return stop();\n  }\n\n  // Mirror draft.ts:135-154 — render → upload \"Rendered HTML\" preview → flip\n  // Draft ready. Without setDraftReady the draft never enters the approve queue\n  // (every pending-approval gate requires draftReady true), so it can never be\n  // approved or sent. The upload is a review convenience; the ready flag is the\n  // critical step.\n  try {\n    const { html } = await renderReportHtml({\n      siteName: target.name,\n      siteUrl: target.url,\n      reportType: \"Launch\",\n      completedOn: today,\n      lighthouse: scores,\n      lastTestedDate: null,\n      commentary: null,\n      copy: resolveCopy(target),\n      headerImageCid: `${slug}-header`,\n    });\n    // A preview-upload hiccup must NOT fail the launch — log and continue.\n    try {\n      await uploadAttachment(\n        report.id,\n        \"Rendered HTML\",\n        html,\n        `${slug}-${today.toISOString().slice(0, 10)}.html`,\n        \"text/html\",\n      );\n    } catch (uploadErr) {\n      console.warn(\n        `⚠ Launch preview upload skipped for ${target.name}: ${\n          uploadErr instanceof Error ? uploadErr.message : String(uploadErr)\n        }`,\n      );\n    }\n    // Critical: NOT wrapped — a failure here must surface as a failed launch. queueDraft\n    // supersedes any lower-tier (Maintenance/Testing) drafts queued for this site; a Launch is\n    // top tier so it only stands down if another Launch/Announcement is already queued.\n    await queueDraft(base, { id: report.id, siteId: target.id, reportType: \"Launch\" });\n  } catch (err) {\n    steps.push({ name: \"draft\", result: errorOf(err) });\n    return stop();\n  }\n\n  steps.push({ name: \"draft\", result: { kind: \"draft\", report } });\n\n  return { site: label, steps, complete: true };\n}\n\n/** Build the Launch `DraftInput`. reportId/period mirror `draftReportForSite`\n *  (draft.ts) — do not invent a new id scheme. `today`/`period` are threaded in\n *  from `launch()` so a single timestamp drives the render, the draft, the\n *  dedupe lookup, and the preview filename. Launch reports have no period window\n *  and no prior maintenance test, so periodStart/periodEnd/completedOn all\n *  collapse to \"today\" and `lastTestedDate` is null. */\nfunction draftInputFor(\n  target: WebsiteRow,\n  scores: LighthouseScores,\n  today: Date,\n  period: string,\n): Parameters<typeof createDraft>[1] {\n  const reportType = \"Launch\" as const;\n  const reportId = `${target.name} — ${reportType} — ${today.toISOString().slice(0, 10)}`;\n  return {\n    reportId,\n    siteId: target.id,\n    reportType,\n    period,\n    periodStart: today,\n    periodEnd: today,\n    completedOn: today,\n    lighthouse: scores,\n    lastTestedDate: null,\n  };\n}\n\nfunction errorOf(err: unknown): LaunchStepResult {\n  return { kind: \"error\", message: err instanceof Error ? err.message : String(err) };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,eAAe;;;ACyDxB,eAAsB,OAAO,MAAY,OAAmB,CAAC,GAA0B;AACrF,QAAM,QAAQ,UAAU,IAAI;AAC5B,QAAM,YAAY,KAAK,aAAa;AACpC,QAAM,QAAQ,KAAK,SAAS;AAC5B,QAAM,OAAO,KAAK,QAAQ,SAAS,mBAAmB,CAAC;AAEvD,QAAM,QAA2D,CAAC;AAClE,QAAM,OAAO,OAAqB,EAAE,MAAM,OAAO,OAAO,UAAU,MAAM;AAGxE,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,UAAU,IAAI;AAAA,EAC/B,SAAS,KAAK;AACZ,UAAM,KAAK,EAAE,MAAM,iBAAiB,QAAQ,QAAQ,GAAG,EAAE,CAAC;AAC1D,WAAO,KAAK;AAAA,EACd;AACA,QAAM,KAAK,EAAE,MAAM,iBAAiB,QAAQ,EAAE,MAAM,UAAU,QAAQ,OAAO,EAAE,CAAC;AAChF,MAAI,OAAO,WAAW,SAAU,QAAO,KAAK;AAG5C,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,MAAM,IAAI;AAAA,EAC5B,SAAS,KAAK;AACZ,UAAM,KAAK,EAAE,MAAM,SAAS,QAAQ,QAAQ,GAAG,EAAE,CAAC;AAClD,WAAO,KAAK;AAAA,EACd;AACA,QAAM,WAAW,QAAQ,KAAK,CAAC,MAAM,EAAE,UAAU,YAAY;AAC7D,MAAI,CAAC,YAAY,CAAC,cAAc,QAAQ,GAAG;AACzC,UAAM,KAAK;AAAA,MACT,MAAM;AAAA,MACN,QAAQ,EAAE,MAAM,SAAS,SAAS,2CAA2C;AAAA,IAC/E,CAAC;AACD,WAAO,KAAK;AAAA,EACd;AAKA,QAAM,YAAY,2BAA2B,QAAQ;AACrD,QAAM,SAA2B;AAAA,IAC/B,aAAa,UAAU,eAAe;AAAA,IACtC,eAAe,UAAU,iBAAiB;AAAA,IAC1C,eAAe,UAAU,iBAAiB;AAAA,IAC1C,KAAK,UAAU,OAAO;AAAA,EACxB;AAEA,QAAM,WAAW,MAAM,aAAa,IAAI;AACxC,QAAM,SAAS,SAAS,KAAK,CAAC,MAAM,SAAS,EAAE,IAAI,MAAM,SAAS,KAAK,CAAC;AACxE,MAAI,CAAC,QAAQ;AACX,UAAM,KAAK;AAAA,MACT,MAAM;AAAA,MACN,QAAQ,EAAE,MAAM,SAAS,SAAS,iCAAiC,KAAK,IAAI;AAAA,IAC9E,CAAC;AACD,WAAO,KAAK;AAAA,EACd;AACA,MAAI;AACF,UAAM,sBAAsB,EAAE,MAAM,UAAU,MAAM,SAAS,OAAO,IAAI,GAAG,QAAQ,CAAC;AAAA,EACtF,SAAS,KAAK;AACZ,UAAM,KAAK,EAAE,MAAM,SAAS,QAAQ,QAAQ,GAAG,EAAE,CAAC;AAClD,WAAO,KAAK;AAAA,EACd;AACA,QAAM,KAAK,EAAE,MAAM,SAAS,QAAQ,EAAE,MAAM,SAAS,SAAS,OAAO,EAAE,CAAC;AAIxE,QAAM,QAAQ,oBAAI,KAAK;AACvB,QAAM,SAAS,MAAM,YAAY,EAAE,MAAM,GAAG,CAAC;AAC7C,QAAM,OAAO,SAAS,OAAO,IAAI;AAEjC,MAAI;AACJ,MAAI;AAIF,UAAM,WAAW,MAAM,mBAAmB,MAAM,OAAO,IAAI,UAAU,MAAM;AAC3E,QAAI,UAAU;AAMZ,YAAM,mBAAmB,MAAM,SAAS,IAAI,QAAQ,KAAK;AACzD,eAAS;AAAA,IACX,OAAO;AACL,eAAS,MAAM,YAAY,MAAM,cAAc,QAAQ,QAAQ,OAAO,MAAM,CAAC;AAAA,IAC/E;AAAA,EACF,SAAS,KAAK;AACZ,UAAM,KAAK,EAAE,MAAM,SAAS,QAAQ,QAAQ,GAAG,EAAE,CAAC;AAClD,WAAO,KAAK;AAAA,EACd;AAOA,MAAI;AACF,UAAM,EAAE,KAAK,IAAI,MAAM,iBAAiB;AAAA,MACtC,UAAU,OAAO;AAAA,MACjB,SAAS,OAAO;AAAA,MAChB,YAAY;AAAA,MACZ,aAAa;AAAA,MACb,YAAY;AAAA,MACZ,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,MAAM,YAAY,MAAM;AAAA,MACxB,gBAAgB,GAAG,IAAI;AAAA,IACzB,CAAC;AAED,QAAI;AACF,YAAM;AAAA,QACJ,OAAO;AAAA,QACP;AAAA,QACA;AAAA,QACA,GAAG,IAAI,IAAI,MAAM,YAAY,EAAE,MAAM,GAAG,EAAE,CAAC;AAAA,QAC3C;AAAA,MACF;AAAA,IACF,SAAS,WAAW;AAClB,cAAQ;AAAA,QACN,4CAAuC,OAAO,IAAI,KAChD,qBAAqB,QAAQ,UAAU,UAAU,OAAO,SAAS,CACnE;AAAA,MACF;AAAA,IACF;AAIA,UAAM,WAAW,MAAM,EAAE,IAAI,OAAO,IAAI,QAAQ,OAAO,IAAI,YAAY,SAAS,CAAC;AAAA,EACnF,SAAS,KAAK;AACZ,UAAM,KAAK,EAAE,MAAM,SAAS,QAAQ,QAAQ,GAAG,EAAE,CAAC;AAClD,WAAO,KAAK;AAAA,EACd;AAEA,QAAM,KAAK,EAAE,MAAM,SAAS,QAAQ,EAAE,MAAM,SAAS,OAAO,EAAE,CAAC;AAE/D,SAAO,EAAE,MAAM,OAAO,OAAO,UAAU,KAAK;AAC9C;AAQA,SAAS,cACP,QACA,QACA,OACA,QACmC;AACnC,QAAM,aAAa;AACnB,QAAM,WAAW,GAAG,OAAO,IAAI,WAAM,UAAU,WAAM,MAAM,YAAY,EAAE,MAAM,GAAG,EAAE,CAAC;AACrF,SAAO;AAAA,IACL;AAAA,IACA,QAAQ,OAAO;AAAA,IACf;AAAA,IACA;AAAA,IACA,aAAa;AAAA,IACb,WAAW;AAAA,IACX,aAAa;AAAA,IACb,YAAY;AAAA,IACZ,gBAAgB;AAAA,EAClB;AACF;AAEA,SAAS,QAAQ,KAAgC;AAC/C,SAAO,EAAE,MAAM,SAAS,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,EAAE;AACpF;;;AD1NA,SAAS,WAAW,MAAc,GAA6B;AAC7D,MAAI,EAAE,SAAS,QAAS,QAAO,GAAG,KAAK,OAAO,EAAE,CAAC,WAAW,EAAE,OAAO;AACrE,MAAI,EAAE,SAAS,SAAS;AACtB,UAAM,IAAI,EAAE;AACZ,WAAO,GAAG,KAAK,OAAO,EAAE,CAAC,eAAe,EAAE,WAAW,MAAM,EAAE,aAAa,OAAO,EAAE,aAAa,QAAQ,EAAE,GAAG;AAAA,EAC/G;AACA,MAAI,EAAE,SAAS,SAAS;AACtB,WAAO,GAAG,KAAK,OAAO,EAAE,CAAC,YAAY,EAAE,OAAO,QAAQ;AAAA,EACxD;AACA,QAAM,MAAM,EAAE;AACd,MAAI,IAAI,WAAW,OAAQ,QAAO,GAAG,KAAK,OAAO,EAAE,CAAC,QAAQ,IAAI,QAAQ,WAAM,IAAI,KAAK,KAAK,EAAE;AAC9F,MAAI,IAAI,WAAW;AACjB,WAAO,GAAG,KAAK,OAAO,EAAE,CAAC,UAAU,IAAI,QAAQ,WAAM,IAAI,KAAK,KAAK,EAAE;AACvE,SAAO,GAAG,KAAK,OAAO,EAAE,CAAC,aAAa,IAAI,QAAQ,MAAM,UAAU,IAAI,QAAQ,WAAW,IAAI,KAAK,GAAG,IAAI,IAAI,QAAQ,WAAM,IAAI,KAAK,KAAK,EAAE;AAC7I;AAEA,SAAS,aAAa,GAAyB;AAC7C,QAAM,SAAS,IAAI,EAAE,IAAI,mBAAc,EAAE,WAAW,gCAAgC,SAAS;AAC7F,QAAM,OAAO,EAAE,MAAM,IAAI,CAAC,MAAM,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,KAAK,IAAI;AACvE,SAAO,GAAG,MAAM;AAAA,EAAK,IAAI;AAC3B;AAQA,eAAsB,iBACpB,MACA,MAC2C;AAC3C,QAAM,MAAM,KAAK,MAAM,QAAQ,KAAK,GAAG,IAAI,QAAQ,IAAI;AACvD,QAAM,QAAQ,MAAM,aAAa,EAAE,MAAM,IAAI,CAAC;AAC9C,QAAM,SAAS,MAAM,CAAC;AACtB,MAAI,CAAC,QAAQ;AACX,WAAO,EAAE,QAAQ,yBAAyB,IAAI,MAAM,MAAM,EAAE;AAAA,EAC9D;AAEA,QAAM,SAAS,MAAM,OAAO,MAAM;AAClC,SAAO,EAAE,QAAQ,aAAa,MAAM,GAAG,MAAM,OAAO,WAAW,IAAI,EAAE;AACvE;","names":[]}

package/dist/{orchestrate-QOQXOJLI.js → orchestrate-NY6L4Q7Q.js}

@@ -4,10 +4,11 @@ import {
   parseAddresses,
   sendApprovedReports,
   withGlobalCc
-} from "./chunk-FVVGDIGX.js";
+} from "./chunk-42A4H6SF.js";
 import "./chunk-GECESMVS.js";
-import "./chunk-MNE374CZ.js";
+import "./chunk-6QRLRT3P.js";
 import "./chunk-MPBXOJ3N.js";
+import "./chunk-SEEA6RXF.js";
 import "./chunk-WEKL2HYJ.js";
 import "./chunk-QG6OSL4M.js";
 import "./chunk-DC5H7KEQ.js";
@@ -23,4 +24,4 @@ export {
   sendApprovedReports,
   withGlobalCc
 };
-//# sourceMappingURL=orchestrate-QOQXOJLI.js.map
+//# sourceMappingURL=orchestrate-NY6L4Q7Q.js.map

package/dist/{preflight-2PWVVIRR.js → preflight-SRDQS7Y6.js}

@@ -1,11 +1,12 @@
 import {
   preflight
-} from "./chunk-YIQ7IWE3.js";
+} from "./chunk-R5KAXGSP.js";
 import "./chunk-D4FVAIEJ.js";
-import "./chunk-FVVGDIGX.js";
+import "./chunk-42A4H6SF.js";
 import "./chunk-GECESMVS.js";
-import "./chunk-MNE374CZ.js";
+import "./chunk-6QRLRT3P.js";
 import "./chunk-MPBXOJ3N.js";
+import "./chunk-SEEA6RXF.js";
 import "./chunk-WEKL2HYJ.js";
 import "./chunk-QG6OSL4M.js";
 import "./chunk-DC5H7KEQ.js";
@@ -62,4 +63,4 @@ async function runPreflightCommand(site, opts) {
 export {
   runPreflightCommand
 };
-//# sourceMappingURL=preflight-2PWVVIRR.js.map
+//# sourceMappingURL=preflight-SRDQS7Y6.js.map

package/dist/{preflight-2PWVVIRR.js.map → preflight-SRDQS7Y6.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/cli/commands/preflight.ts"],"sourcesContent":["import {\n  preflight,\n  type PreflightSiteResult,\n  type PreflightFinding,\n} from \"../../reports/preflight.js\";\nimport type { ReportType } from \"../../reports/types.js\";\n\nexport type PreflightCommandOptions = {\n  type?: string;\n  all?: boolean;\n  cwd?: string;\n};\n\nconst TYPES: Record<string, ReportType> = {\n  announcement: \"Announcement\",\n  maintenance: \"Maintenance\",\n  testing: \"Testing\",\n};\n\nconst MARK: Record<PreflightFinding[\"level\"], string> = { fail: \"✗\", warn: \"⚠\", info: \"ℹ\" };\n\nfunction formatSite(r: PreflightSiteResult): string {\n  if (r.findings.length === 0) return `[${r.site}] ✓ clean`;\n  return r.findings.map((f) => `[${r.site}] ${MARK[f.level]} ${f.check}: ${f.message}`).join(\"\\n\");\n}\n\n/**\n * `preflight [site]` — read-only pre-send checks over the live Airtable rows: everything\n * that would make a report send fail, reach the wrong inbox, or surprise the operator.\n * Exit 0 = safe (warnings allowed, printed), 1 = at least one hard failure, 2 = bad args.\n */\nexport async function runPreflightCommand(\n  site: string | undefined,\n  opts: PreflightCommandOptions,\n): Promise<{ output: string; code: number }> {\n  if (Boolean(site) === Boolean(opts.all)) {\n    return { output: \"Provide exactly one of <site> or --all.\", code: 2 };\n  }\n  const typeKey = (opts.type ?? \"announcement\").toLowerCase();\n  const type = TYPES[typeKey];\n  if (!type) {\n    return {\n      output: `Unknown --type '${opts.type}'. Supported: ${Object.keys(TYPES).join(\", \")}`,\n      code: 2,\n    };\n  }\n\n  try {\n    const { results, fleet } = await preflight({\n      ...(site ? { site } : {}),\n      ...(opts.all ? { all: true } : {}),\n      type,\n    });\n    if (results.length === 0) return { output: \"No matching sites.\", code: 1 };\n\n    const lines = results.map(formatSite);\n    for (const f of fleet) lines.push(`[fleet] ${MARK[f.level]} ${f.check}: ${f.message}`);\n\n    const all = [...results.flatMap((r) => r.findings), ...fleet];\n    const fails = all.filter((f) => f.level === \"fail\").length;\n    const warns = all.filter((f) => f.level === \"warn\").length;\n    lines.push(\n      `Preflight: ${results.length} site(s) — ${fails} fail, ${warns} warn. ${\n        fails > 0 ? \"NOT safe to send.\" : \"Safe to send (review warnings).\"\n      }`,\n    );\n    return { output: lines.join(\"\\n\"), code: fails > 0 ? 1 : 0 };\n  } catch (err) {\n    const e = err as { message?: string; exitCode?: number };\n    return { output: e.message ?? String(err), code: e.exitCode ?? 1 };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAaA,IAAM,QAAoC;AAAA,EACxC,cAAc;AAAA,EACd,aAAa;AAAA,EACb,SAAS;AACX;AAEA,IAAM,OAAkD,EAAE,MAAM,UAAK,MAAM,UAAK,MAAM,SAAI;AAE1F,SAAS,WAAW,GAAgC;AAClD,MAAI,EAAE,SAAS,WAAW,EAAG,QAAO,IAAI,EAAE,IAAI;AAC9C,SAAO,EAAE,SAAS,IAAI,CAAC,MAAM,IAAI,EAAE,IAAI,KAAK,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,OAAO,EAAE,EAAE,KAAK,IAAI;AACjG;AAOA,eAAsB,oBACpB,MACA,MAC2C;AAC3C,MAAI,QAAQ,IAAI,MAAM,QAAQ,KAAK,GAAG,GAAG;AACvC,WAAO,EAAE,QAAQ,2CAA2C,MAAM,EAAE;AAAA,EACtE;AACA,QAAM,WAAW,KAAK,QAAQ,gBAAgB,YAAY;AAC1D,QAAM,OAAO,MAAM,OAAO;AAC1B,MAAI,CAAC,MAAM;AACT,WAAO;AAAA,MACL,QAAQ,mBAAmB,KAAK,IAAI,iBAAiB,OAAO,KAAK,KAAK,EAAE,KAAK,IAAI,CAAC;AAAA,MAClF,MAAM;AAAA,IACR;AAAA,EACF;AAEA,MAAI;AACF,UAAM,EAAE,SAAS,MAAM,IAAI,MAAM,UAAU;AAAA,MACzC,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,MACvB,GAAI,KAAK,MAAM,EAAE,KAAK,KAAK,IAAI,CAAC;AAAA,MAChC;AAAA,IACF,CAAC;AACD,QAAI,QAAQ,WAAW,EAAG,QAAO,EAAE,QAAQ,sBAAsB,MAAM,EAAE;AAEzE,UAAM,QAAQ,QAAQ,IAAI,UAAU;AACpC,eAAW,KAAK,MAAO,OAAM,KAAK,WAAW,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,OAAO,EAAE;AAErF,UAAM,MAAM,CAAC,GAAG,QAAQ,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,GAAG,KAAK;AAC5D,UAAM,QAAQ,IAAI,OAAO,CAAC,MAAM,EAAE,UAAU,MAAM,EAAE;AACpD,UAAM,QAAQ,IAAI,OAAO,CAAC,MAAM,EAAE,UAAU,MAAM,EAAE;AACpD,UAAM;AAAA,MACJ,cAAc,QAAQ,MAAM,mBAAc,KAAK,UAAU,KAAK,UAC5D,QAAQ,IAAI,sBAAsB,iCACpC;AAAA,IACF;AACA,WAAO,EAAE,QAAQ,MAAM,KAAK,IAAI,GAAG,MAAM,QAAQ,IAAI,IAAI,EAAE;AAAA,EAC7D,SAAS,KAAK;AACZ,UAAM,IAAI;AACV,WAAO,EAAE,QAAQ,EAAE,WAAW,OAAO,GAAG,GAAG,MAAM,EAAE,YAAY,EAAE;AAAA,EACnE;AACF;","names":[]}
+{"version":3,"sources":["../src/cli/commands/preflight.ts"],"sourcesContent":["import {\n  preflight,\n  type PreflightSiteResult,\n  type PreflightFinding,\n} from \"../../reports/preflight.js\";\nimport type { ReportType } from \"../../reports/types.js\";\n\nexport type PreflightCommandOptions = {\n  type?: string;\n  all?: boolean;\n  cwd?: string;\n};\n\nconst TYPES: Record<string, ReportType> = {\n  announcement: \"Announcement\",\n  maintenance: \"Maintenance\",\n  testing: \"Testing\",\n};\n\nconst MARK: Record<PreflightFinding[\"level\"], string> = { fail: \"✗\", warn: \"⚠\", info: \"ℹ\" };\n\nfunction formatSite(r: PreflightSiteResult): string {\n  if (r.findings.length === 0) return `[${r.site}] ✓ clean`;\n  return r.findings.map((f) => `[${r.site}] ${MARK[f.level]} ${f.check}: ${f.message}`).join(\"\\n\");\n}\n\n/**\n * `preflight [site]` — read-only pre-send checks over the live Airtable rows: everything\n * that would make a report send fail, reach the wrong inbox, or surprise the operator.\n * Exit 0 = safe (warnings allowed, printed), 1 = at least one hard failure, 2 = bad args.\n */\nexport async function runPreflightCommand(\n  site: string | undefined,\n  opts: PreflightCommandOptions,\n): Promise<{ output: string; code: number }> {\n  if (Boolean(site) === Boolean(opts.all)) {\n    return { output: \"Provide exactly one of <site> or --all.\", code: 2 };\n  }\n  const typeKey = (opts.type ?? \"announcement\").toLowerCase();\n  const type = TYPES[typeKey];\n  if (!type) {\n    return {\n      output: `Unknown --type '${opts.type}'. Supported: ${Object.keys(TYPES).join(\", \")}`,\n      code: 2,\n    };\n  }\n\n  try {\n    const { results, fleet } = await preflight({\n      ...(site ? { site } : {}),\n      ...(opts.all ? { all: true } : {}),\n      type,\n    });\n    if (results.length === 0) return { output: \"No matching sites.\", code: 1 };\n\n    const lines = results.map(formatSite);\n    for (const f of fleet) lines.push(`[fleet] ${MARK[f.level]} ${f.check}: ${f.message}`);\n\n    const all = [...results.flatMap((r) => r.findings), ...fleet];\n    const fails = all.filter((f) => f.level === \"fail\").length;\n    const warns = all.filter((f) => f.level === \"warn\").length;\n    lines.push(\n      `Preflight: ${results.length} site(s) — ${fails} fail, ${warns} warn. ${\n        fails > 0 ? \"NOT safe to send.\" : \"Safe to send (review warnings).\"\n      }`,\n    );\n    return { output: lines.join(\"\\n\"), code: fails > 0 ? 1 : 0 };\n  } catch (err) {\n    const e = err as { message?: string; exitCode?: number };\n    return { output: e.message ?? String(err), code: e.exitCode ?? 1 };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAaA,IAAM,QAAoC;AAAA,EACxC,cAAc;AAAA,EACd,aAAa;AAAA,EACb,SAAS;AACX;AAEA,IAAM,OAAkD,EAAE,MAAM,UAAK,MAAM,UAAK,MAAM,SAAI;AAE1F,SAAS,WAAW,GAAgC;AAClD,MAAI,EAAE,SAAS,WAAW,EAAG,QAAO,IAAI,EAAE,IAAI;AAC9C,SAAO,EAAE,SAAS,IAAI,CAAC,MAAM,IAAI,EAAE,IAAI,KAAK,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,OAAO,EAAE,EAAE,KAAK,IAAI;AACjG;AAOA,eAAsB,oBACpB,MACA,MAC2C;AAC3C,MAAI,QAAQ,IAAI,MAAM,QAAQ,KAAK,GAAG,GAAG;AACvC,WAAO,EAAE,QAAQ,2CAA2C,MAAM,EAAE;AAAA,EACtE;AACA,QAAM,WAAW,KAAK,QAAQ,gBAAgB,YAAY;AAC1D,QAAM,OAAO,MAAM,OAAO;AAC1B,MAAI,CAAC,MAAM;AACT,WAAO;AAAA,MACL,QAAQ,mBAAmB,KAAK,IAAI,iBAAiB,OAAO,KAAK,KAAK,EAAE,KAAK,IAAI,CAAC;AAAA,MAClF,MAAM;AAAA,IACR;AAAA,EACF;AAEA,MAAI;AACF,UAAM,EAAE,SAAS,MAAM,IAAI,MAAM,UAAU;AAAA,MACzC,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,MACvB,GAAI,KAAK,MAAM,EAAE,KAAK,KAAK,IAAI,CAAC;AAAA,MAChC;AAAA,IACF,CAAC;AACD,QAAI,QAAQ,WAAW,EAAG,QAAO,EAAE,QAAQ,sBAAsB,MAAM,EAAE;AAEzE,UAAM,QAAQ,QAAQ,IAAI,UAAU;AACpC,eAAW,KAAK,MAAO,OAAM,KAAK,WAAW,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,OAAO,EAAE;AAErF,UAAM,MAAM,CAAC,GAAG,QAAQ,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,GAAG,KAAK;AAC5D,UAAM,QAAQ,IAAI,OAAO,CAAC,MAAM,EAAE,UAAU,MAAM,EAAE;AACpD,UAAM,QAAQ,IAAI,OAAO,CAAC,MAAM,EAAE,UAAU,MAAM,EAAE;AACpD,UAAM;AAAA,MACJ,cAAc,QAAQ,MAAM,mBAAc,KAAK,UAAU,KAAK,UAC5D,QAAQ,IAAI,sBAAsB,iCACpC;AAAA,IACF;AACA,WAAO,EAAE,QAAQ,MAAM,KAAK,IAAI,GAAG,MAAM,QAAQ,IAAI,IAAI,EAAE;AAAA,EAC7D,SAAS,KAAK;AACZ,UAAM,IAAI;AACV,WAAO,EAAE,QAAQ,EAAE,WAAW,OAAO,GAAG,GAAG,MAAM,EAAE,YAAY,EAAE;AAAA,EACnE;AACF;","names":[]}

package/dist/{protection-audit-X3BHT2MB.js → protection-audit-2UR45SOC.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-MNDIED4M.js";
 import {
   makeGitHub
-} from "./chunk-VSHC4HOI.js";
+} from "./chunk-YAMRVXOD.js";
 import "./chunk-HVOOCK6L.js";
 
 // src/audits/protection-coverage.ts
@@ -50,6 +50,31 @@ function renovateGaps(health, now) {
     return [`renovate last succeeded ${Math.floor(days)}d ago (cron is twice daily)`];
   return [];
 }
+function renovateBlockedGaps(blocked) {
+  const orphaned = blocked.filter((b) => b.orphaned);
+  if (orphaned.length === 0) return [];
+  return [
+    `renovate is BLOCKED on ${orphaned.length} branch(es) \u2014 ${orphaned.map((b) => b.branch).join(", ")} \u2014 it runs and succeeds but refuses to update them, so every dependency grouped there is frozen. Usual cause: the branch tip was authored by a retired bot identity, which reads to Renovate as a human edit. Fix: confirm the tip author is a bot, then delete the branch and let Renovate recreate it (\`gh api -X DELETE repos/<repo>/git/refs/heads/<branch>\`).`
+  ];
+}
+function dashboardVocabularyGaps(dash) {
+  if (!dash.present || dash.unknownSections.length === 0) return [];
+  return [
+    `renovate dashboard has ${dash.unknownSections.length} section(s) this audit does not recognise \u2014 ${dash.unknownSections.join(", ")}. Nothing is necessarily wrong with the repo, but the blocked-branch check reads Renovate's own headings, so drift there means it can no longer be trusted. Fix: reconcile KNOWN_DASHBOARD_SECTIONS in src/github/gh.ts against Renovate's dependency-dashboard.ts.`
+  ];
+}
+var BLOCKED_STALE_DAYS = 5;
+async function resolveBlockedBranches(repo, dash, deps, now) {
+  if (!dash.present) return [];
+  const states = [];
+  for (const branch of dash.blockedBranches) {
+    const tip = await deps.branchTip(repo, branch);
+    if (!tip) continue;
+    const ageDays = (now.getTime() - new Date(tip.committedAt).getTime()) / 864e5;
+    states.push({ branch, orphaned: tip.authorIsMachine || ageDays > BLOCKED_STALE_DAYS });
+  }
+  return states;
+}
 async function collectProtectionCoverage(org, deps, now = /* @__PURE__ */ new Date(), accepted = ACCEPTED_GAPS) {
   const rows = [];
   for (const r of await deps.listOrgRepos(org)) {
@@ -87,6 +112,9 @@ async function collectProtectionCoverage(org, deps, now = /* @__PURE__ */ new Da
       }
       gaps.push(...secretScanningGaps(r));
       gaps.push(...renovateGaps(await deps.workflowHealth(repo, RENOVATE_WORKFLOW_FILE), now));
+      const dash = await deps.dependencyDashboard(repo);
+      gaps.push(...dashboardVocabularyGaps(dash));
+      gaps.push(...renovateBlockedGaps(await resolveBlockedBranches(repo, dash, deps, now)));
       const { live, accepted: acked } = partitionAcceptedGaps(repo, gaps, now, accepted);
       if (live.length > 0) {
         rows.push({ repo, status: "gap", detail: [...live, ...acked].join(" | ") });
@@ -137,4 +165,4 @@ export {
   protectionAuditExitCode,
   runProtectionAuditCommand
 };
-//# sourceMappingURL=protection-audit-X3BHT2MB.js.map
+//# sourceMappingURL=protection-audit-2UR45SOC.js.map

package/dist/protection-audit-2UR45SOC.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/audits/protection-coverage.ts","../src/cli/commands/protection-audit.ts"],"sourcesContent":["import { rulesetGaps, type ExistingRuleset } from \"../github/rulesets.js\";\nimport type { BranchTip, DependencyDashboard, WorkflowHealth } from \"../github/gh.js\";\n\n/**\n * Org-wide protection-coverage sweep (spec:\n * docs/superpowers/specs/2026-08-02-ruleset-self-healing-design.md).\n *\n * The `self-updating` recipe HEALS fleet sites, but it runs only when someone\n * runs it, and only over Airtable-listed sites — which is exactly how the\n * `.github` repo (no Airtable row) sat with zero protection until 2026-08-01.\n * This sweep is the layer that would have caught that on its own: it\n * enumerates the org FROM THE GITHUB API — never a hand-typed or\n * Airtable-scoped list, both of which have already produced false \"all\n * clear\"s — and judges every public repo's protection by SHAPE, not by name,\n * so a differently-named but sound ruleset (reddoor-maintenance's \"Main\n * Protection\") counts.\n *\n * Since 2026-08-02 the same sweep also verifies three more posture surfaces\n * per public repo, because each regresses silently and none has any other\n * watcher:\n *  - secret scanning + push protection stay ENABLED (a repo transferred in,\n *    or an org-default flip, arrives with them off);\n *  - the renovate workflow is registered, active, and has actually RUN\n *    recently. GitHub auto-disables schedules after 60 quiet days, and\n *    schedule triggers in template-cloned files may never register at all —\n *    either way a fully-quiet repo stops receiving updates with zero signal\n *    (the 2026-08-02 sweep found two never-run and two 5-days-stale repos on\n *    its first pass);\n *  - renovate is not only alive but ALLOWED TO ACT — a workflow can run green\n *    forever while Renovate has quietly stopped managing a branch, which froze\n *    updates on nine repos for a week in August 2026 (see\n *    renovateBlockedGaps). Liveness cannot see this; only the outcome can.\n */\nexport type ProtectionCoverageRow = {\n  repo: string; // owner/repo\n  status: \"covered\" | \"gap\" | \"skipped\";\n  /** Human-readable: covering ruleset + whether it gates on CI, the specific\n   *  gaps, or why the repo was skipped. */\n  detail: string;\n};\n\n/** The reads the sweep needs — a subset of the GitHub factory, injected so the\n *  sweep is pure + testable (same pattern as collectGitHubSignals). */\nexport type ProtectionCoverageDeps = {\n  listOrgRepos: (org: string) => Promise<\n    Array<{\n      name: string;\n      visibility: string;\n      archived: boolean;\n      secretScanning: string;\n      pushProtection: string;\n    }>\n  >;\n  listRepoRulesets: (repo: string) => Promise<Array<{ id: number; name: string }>>;\n  getRuleset: (repo: string, id: number) => Promise<ExistingRuleset>;\n  workflowHealth: (repo: string, filename: string) => Promise<WorkflowHealth>;\n  dependencyDashboard: (repo: string) => Promise<DependencyDashboard>;\n  branchTip: (repo: string, branch: string) => Promise<BranchTip | null>;\n};\n\nexport const RENOVATE_WORKFLOW_FILE = \"renovate.yml\";\n\n/** Cron is twice daily, so 3 days without a SUCCESSFUL run = 6+ consecutive\n *  missed-or-failing runs — dead scheduling, dead credential, or broken\n *  config, never jitter. (Success, not run-existence: a revoked App key still\n *  creates a fresh failing run every tick.) */\nexport const RENOVATE_STALE_AFTER_DAYS = 3;\n\n/**\n * Operator-accepted gaps — the protection-audit analogue of the cockpit's\n * accepted-Watch acks: a KNOWN condition pending a real decision must not\n * comment the tracking issue every night, or the channel is tuned out by the\n * time a genuinely new gap lands in it. Constraints that keep this honest:\n * every entry is PR-reviewed, names ONE repo + ONE surface (never a blanket\n * mute), states the pending decision, and EXPIRES — past `until` the gap\n * returns on its own, so an acceptance can never quietly become permanent.\n */\nexport type AcceptedGap = {\n  repo: string; // owner/repo\n  /** Matched as a prefix of the gap detail line — surface-scoped, so an\n   *  accepted renovate gap never swallows a ruleset or secret-scanning gap. */\n  detailPrefix: string;\n  reason: string;\n  until: string; // ISO date; exclusive — the gap is live again ON this date\n};\n\n// Currently EMPTY — the only two entries (no-renovate on reddoor-maintenance\n// and .github, pending an operator supply-chain call) were retired 2026-08-02\n// when the operator approved planting Renovate on both. Add entries only for\n// a named pending decision, never as a mute.\nexport const ACCEPTED_GAPS: AcceptedGap[] = [];\n\n/** Split gaps into live vs accepted-for-now. Acceptance is per-surface (detail\n *  prefix) and expires: an entry past `until` accepts nothing. */\nexport function partitionAcceptedGaps(\n  repo: string,\n  gaps: string[],\n  now: Date,\n  accepted: AcceptedGap[] = ACCEPTED_GAPS,\n): { live: string[]; accepted: string[] } {\n  const live: string[] = [];\n  const acceptedOut: string[] = [];\n  for (const gap of gaps) {\n    const match = accepted.find(\n      (a) => a.repo === repo && gap.startsWith(a.detailPrefix) && now < new Date(a.until),\n    );\n    if (match) acceptedOut.push(`${gap} [accepted until ${match.until}: ${match.reason}]`);\n    else live.push(gap);\n  }\n  return { live, accepted: acceptedOut };\n}\n\n/** Public repos only — secret scanning is plan-gated off on private Free\n *  repos, and those are skipped before this is consulted. \"unavailable\" means\n *  the listing couldn't read security_and_analysis (token lacks admin read),\n *  which must read as unverified, not as fine. */\nexport function secretScanningGaps(repo: {\n  secretScanning: string;\n  pushProtection: string;\n}): string[] {\n  const gaps: string[] = [];\n  if (repo.secretScanning !== \"enabled\")\n    gaps.push(`secret scanning ${repo.secretScanning} (fleet floor is enabled)`);\n  if (repo.pushProtection !== \"enabled\")\n    gaps.push(`push protection ${repo.pushProtection} (fleet floor is enabled)`);\n  return gaps;\n}\n\n/** Renovate liveness verdict — judged on the last SUCCESSFUL run. The cron IS\n *  the merge cadence (platform auto-merge is off fleet-wide), so a workflow\n *  that isn't succeeding means the repo silently stops updating — the exact\n *  class the 2026-07-26 incident review called \"zero-run blindness\". */\nexport function renovateGaps(health: WorkflowHealth, now: Date): string[] {\n  if (!health.present) return [\"no renovate workflow (dependency updates never run here)\"];\n  if (health.state !== \"active\")\n    return [\n      // A disabled workflow REJECTS workflow_dispatch (HTTP 403) — it must be\n      // re-enabled first; \"just dispatch it\" is a dead-end runbook line here.\n      `renovate workflow is ${health.state} (re-enable it: \\`gh workflow enable renovate.yml -R <repo>\\`, then dispatch once)`,\n    ];\n  if (health.lastSuccessAt === null)\n    return [\n      \"renovate workflow has never succeeded (dispatch it once; if this gap returns, the schedule never registered — push a commit touching the workflow file)\",\n    ];\n  const succeededAt = Date.parse(health.lastSuccessAt);\n  if (Number.isNaN(succeededAt))\n    return [`renovate last-success timestamp unreadable: ${health.lastSuccessAt}`];\n  const days = (now.getTime() - succeededAt) / 86_400_000;\n  if (days > RENOVATE_STALE_AFTER_DAYS)\n    return [`renovate last succeeded ${Math.floor(days)}d ago (cron is twice daily)`];\n  return [];\n}\n\n/**\n * Renovate EFFECTIVENESS, which is a different question from liveness.\n *\n * `renovateGaps` above asks \"did the workflow run and succeed?\" — and on\n * 2026-08-03 nine repos answered YES to that while shipping zero updates for a\n * week. The `reddoor-renovate` App migration (2026-08-02) left each repo\n * holding a `renovate/all-minor-patch` branch whose tip was authored by the\n * OLD `renovate-bot` PAT identity. Renovate compares that author to its own,\n * concludes a human edited the branch, files it under \"PR Edited (Blocked) —\n * Renovate will no longer make changes\", and never touches it again. Every run\n * kept succeeding; `@reddoorla/maintenance`, `@sveltejs/kit`, `vite`,\n * `@playwright/test` and `node` were all frozen behind it; CI stayed green and\n * nothing anywhere raised a hand.\n *\n * A liveness probe structurally cannot see this: the workflow is doing its job\n * perfectly, it is simply forbidden to act. So this reads the outcome Renovate\n * itself publishes — the one place it admits to having given up.\n *\n * Absent dashboard is NOT a gap: `dependencyDashboard` is a config a repo may\n * legitimately disable, and the liveness probe already owns the dead-Renovate\n * case.\n *\n * Nor is every blocked branch a gap — see resolveBlockedBranches, which is\n * where the orphan/in-flight distinction is made. Both exclusions serve the\n * same property: this surface reports only what it can stand behind, which is\n * what decides whether an alarm channel still gets read a month from now.\n */\nexport function renovateBlockedGaps(blocked: BlockedBranchState[]): string[] {\n  const orphaned = blocked.filter((b) => b.orphaned);\n  if (orphaned.length === 0) return [];\n  return [\n    `renovate is BLOCKED on ${orphaned.length} branch(es) — ` +\n      `${orphaned.map((b) => b.branch).join(\", \")} — it runs and succeeds but refuses to ` +\n      `update them, so every dependency grouped there is frozen. Usual cause: the branch ` +\n      `tip was authored by a retired bot identity, which reads to Renovate as a human ` +\n      `edit. Fix: confirm the tip author is a bot, then delete the branch and let ` +\n      `Renovate recreate it (\\`gh api -X DELETE repos/<repo>/git/refs/heads/<branch>\\`).`,\n  ];\n}\n\n/**\n * A dashboard whose section vocabulary we do not share. Reported separately\n * from blocked branches because it is a different claim: not \"Renovate is\n * stuck\" but \"this audit can no longer tell whether Renovate is stuck.\" The\n * blocked heading was renamed once already (Edited/Blocked -> PR Edited\n * (Blocked) in Renovate 43), and the fleet inherits its Renovate major from\n * whatever renovatebot/github-action bakes in — so the next rename arrives via\n * an ordinary dependency PR that Renovate merges in-run, with nobody reading\n * dashboard wording. Without this, that rename would flip every repo to\n * covered on the same night and the surface would go permanently blind.\n */\nexport function dashboardVocabularyGaps(dash: DependencyDashboard): string[] {\n  if (!dash.present || dash.unknownSections.length === 0) return [];\n  return [\n    `renovate dashboard has ${dash.unknownSections.length} section(s) this audit does ` +\n      `not recognise — ${dash.unknownSections.join(\", \")}. Nothing is necessarily wrong ` +\n      `with the repo, but the blocked-branch check reads Renovate's own headings, so ` +\n      `drift there means it can no longer be trusted. Fix: reconcile ` +\n      `KNOWN_DASHBOARD_SECTIONS in src/github/gh.ts against Renovate's ` +\n      `dependency-dashboard.ts.`,\n  ];\n}\n\n/** How long a human-owned blocked branch may sit before it stops reading as\n *  in-flight work. Sized to clear a weekend plus slack: the fleet's own\n *  human-edited Renovate PRs merge in minutes, while the branches that froze\n *  nine repos sat for a week. */\nexport const BLOCKED_STALE_DAYS = 5;\n\nexport type BlockedBranchState = { branch: string; orphaned: boolean };\n\n/**\n * Decide which blocked branches are actually a posture problem.\n *\n * `PR Edited (Blocked)` is not by itself a fault — it is also Renovate's\n * designed way of saying \"a human owns this branch now\", and pushing a commit\n * onto an open Renovate PR is routine fleet practice (16 such PRs across 14\n * repos on a single day). Alarming on those would fire the nightly issue for\n * perfectly healthy in-flight work, and would attach a remediation that says\n * to delete the branch — i.e. the human's commits.\n *\n * A branch counts as ORPHANED, and therefore a gap, when either:\n *   - its tip was authored by a machine, so no human owns it and nothing will\n *     ever clear it on its own; or\n *   - it has sat untouched past BLOCKED_STALE_DAYS, whoever authored it —\n *     because Renovate updates a branch it is managing, so tip age IS time\n *     spent frozen.\n *\n * The authorship test is the fast path and the staleness test is the backstop:\n * if machine-identity detection ever drifts, detection degrades to slower, not\n * to blind. A branch that no longer exists is not a gap — that is a dashboard\n * Renovate has not rewritten yet.\n */\nexport async function resolveBlockedBranches(\n  repo: string,\n  dash: DependencyDashboard,\n  deps: Pick<ProtectionCoverageDeps, \"branchTip\">,\n  now: Date,\n): Promise<BlockedBranchState[]> {\n  if (!dash.present) return [];\n  const states: BlockedBranchState[] = [];\n  for (const branch of dash.blockedBranches) {\n    const tip = await deps.branchTip(repo, branch);\n    if (!tip) continue;\n    const ageDays = (now.getTime() - new Date(tip.committedAt).getTime()) / 86_400_000;\n    states.push({ branch, orphaned: tip.authorIsMachine || ageDays > BLOCKED_STALE_DAYS });\n  }\n  return states;\n}\n\n/**\n * One row per org repo. Coverage = SOME repo-sourced ruleset with zero\n * stage-1 gaps (active, empty bypass, default branch covered, deletion +\n * non_fast_forward + pull_request) AND secret scanning enabled AND a live\n * renovate workflow. Whether a covering ruleset also gates on CI is reported\n * as detail, not judged: each repo's required context differs (and\n * reddoor-maintenance deliberately has none pending release-path review), so\n * the CI-gate invariant belongs to the per-site heal, which has the evidence\n * to require the RIGHT context safely.\n *\n * Private/archived repos are skipped (rulesets on private repos need a paid\n * plan; archived repos are read-only). A repo whose probe THROWS is a `gap`,\n * not a skip — \"couldn't verify\" reading as \"fine\" is the silent-green\n * failure mode this sweep exists to kill, and the tracking issue auto-closes\n * on the next clean pass, so a transient API blip costs one issue-comment.\n */\nexport async function collectProtectionCoverage(\n  org: string,\n  deps: ProtectionCoverageDeps,\n  now: Date = new Date(),\n  accepted: AcceptedGap[] = ACCEPTED_GAPS,\n): Promise<ProtectionCoverageRow[]> {\n  const rows: ProtectionCoverageRow[] = [];\n  for (const r of await deps.listOrgRepos(org)) {\n    const repo = `${org}/${r.name}`;\n    if (r.archived || r.visibility !== \"public\") {\n      rows.push({\n        repo,\n        status: \"skipped\",\n        detail: r.archived ? \"archived\" : `${r.visibility} (rulesets need a paid plan)`,\n      });\n      continue;\n    }\n    try {\n      const gaps: string[] = [];\n      let coveredDetail = \"\";\n      const rulesets = await deps.listRepoRulesets(repo);\n      if (rulesets.length === 0) {\n        gaps.push(\"no repo rulesets at all\");\n      } else {\n        const judged = await Promise.all(\n          rulesets.map(async (rs) => {\n            const full = await deps.getRuleset(repo, rs.id);\n            return { name: rs.name, full, gaps: rulesetGaps(full, null) };\n          }),\n        );\n        const covering = judged.find((j) => j.gaps.length === 0);\n        if (covering) {\n          const ciGated = (covering.full.rules ?? []).some(\n            (rule) => rule.type === \"required_status_checks\",\n          );\n          coveredDetail = `\"${covering.name}\"${ciGated ? \"\" : \" — NO CI gate (refs rules only)\"}`;\n        } else {\n          gaps.push(judged.map((j) => `\"${j.name}\": ${j.gaps.join(\"; \")}`).join(\" | \"));\n        }\n      }\n      gaps.push(...secretScanningGaps(r));\n      gaps.push(...renovateGaps(await deps.workflowHealth(repo, RENOVATE_WORKFLOW_FILE), now));\n      const dash = await deps.dependencyDashboard(repo);\n      gaps.push(...dashboardVocabularyGaps(dash));\n      gaps.push(...renovateBlockedGaps(await resolveBlockedBranches(repo, dash, deps, now)));\n      const { live, accepted: acked } = partitionAcceptedGaps(repo, gaps, now, accepted);\n      if (live.length > 0) {\n        // Accepted annotations still ride along for context, but only LIVE\n        // gaps make the row a gap (and thus the sweep exit 1).\n        rows.push({ repo, status: \"gap\", detail: [...live, ...acked].join(\" | \") });\n      } else if (acked.length > 0) {\n        // Judged, found wanting, deliberately acked — reported as skipped\n        // (visible every night with the reason + expiry), never as covered.\n        rows.push({ repo, status: \"skipped\", detail: acked.join(\" | \") });\n      } else {\n        rows.push({ repo, status: \"covered\", detail: coveredDetail });\n      }\n    } catch (e) {\n      rows.push({\n        repo,\n        status: \"gap\",\n        detail: `probe failed: ${e instanceof Error ? e.message : String(e)}`,\n      });\n    }\n  }\n  return rows;\n}\n","import {\n  collectProtectionCoverage,\n  type ProtectionCoverageDeps,\n} from \"../../audits/protection-coverage.js\";\nimport { makeGitHub } from \"../../github/gh.js\";\n\n/** Exit 1 on ANY gap: unlike the fleet write sweeps (majority-rule), a single\n *  unprotected public repo is a real hole, not a flake to tolerate. */\nexport function protectionAuditExitCode(gaps: number): number {\n  return gaps > 0 ? 1 : 0;\n}\n\n/** `protection-audit --org <org>`: verify every public repo in the org carries\n *  a sound branch ruleset, live secret scanning + push protection, and a\n *  renovate workflow that actually runs (see collectProtectionCoverage for the\n *  verdicts). Emits one line per repo + a machine-readable PROTECTION_AUDIT\n *  summary the nightly workflow gates its tracking issue on. A missing fleet\n *  token is a clean skip (local runs), matching github-signals. */\nexport async function runProtectionAuditCommand(\n  opts: { org?: string | undefined },\n  // Injected in tests; defaults to the real gh-CLI-backed factory.\n  depsOverride?: ProtectionCoverageDeps,\n): Promise<{ output: string; code: number }> {\n  const org = opts.org?.trim();\n  if (!org) {\n    return { output: \"protection-audit requires --org <org>\", code: 2 };\n  }\n  const token = process.env.RENOVATE_TOKEN?.trim() || process.env.GH_TOKEN?.trim();\n  if (!depsOverride && !token) {\n    return {\n      output: \"protection-audit skipped: no RENOVATE_TOKEN/GH_TOKEN (fleet read) configured.\",\n      code: 0,\n    };\n  }\n  const deps = depsOverride ?? makeGitHub({ token: token! });\n\n  const rows = await collectProtectionCoverage(org, deps);\n  const gaps = rows.filter((r) => r.status === \"gap\");\n  const covered = rows.filter((r) => r.status === \"covered\");\n  const skipped = rows.filter((r) => r.status === \"skipped\");\n\n  const lines = rows.map((r) => `${r.status.toUpperCase().padEnd(7)} ${r.repo} — ${r.detail}`);\n  lines.push(\n    `PROTECTION_AUDIT gaps=${gaps.length} covered=${covered.length} skipped=${skipped.length} total=${rows.length}`,\n  );\n  return { output: lines.join(\"\\n\"), code: protectionAuditExitCode(gaps.length) };\n}\n"],"mappings":";;;;;;;;;AA4DO,IAAM,yBAAyB;AAM/B,IAAM,4BAA4B;AAwBlC,IAAM,gBAA+B,CAAC;AAItC,SAAS,sBACd,MACA,MACA,KACA,WAA0B,eACc;AACxC,QAAM,OAAiB,CAAC;AACxB,QAAM,cAAwB,CAAC;AAC/B,aAAW,OAAO,MAAM;AACtB,UAAM,QAAQ,SAAS;AAAA,MACrB,CAAC,MAAM,EAAE,SAAS,QAAQ,IAAI,WAAW,EAAE,YAAY,KAAK,MAAM,IAAI,KAAK,EAAE,KAAK;AAAA,IACpF;AACA,QAAI,MAAO,aAAY,KAAK,GAAG,GAAG,oBAAoB,MAAM,KAAK,KAAK,MAAM,MAAM,GAAG;AAAA,QAChF,MAAK,KAAK,GAAG;AAAA,EACpB;AACA,SAAO,EAAE,MAAM,UAAU,YAAY;AACvC;AAMO,SAAS,mBAAmB,MAGtB;AACX,QAAM,OAAiB,CAAC;AACxB,MAAI,KAAK,mBAAmB;AAC1B,SAAK,KAAK,mBAAmB,KAAK,cAAc,2BAA2B;AAC7E,MAAI,KAAK,mBAAmB;AAC1B,SAAK,KAAK,mBAAmB,KAAK,cAAc,2BAA2B;AAC7E,SAAO;AACT;AAMO,SAAS,aAAa,QAAwB,KAAqB;AACxE,MAAI,CAAC,OAAO,QAAS,QAAO,CAAC,0DAA0D;AACvF,MAAI,OAAO,UAAU;AACnB,WAAO;AAAA;AAAA;AAAA,MAGL,wBAAwB,OAAO,KAAK;AAAA,IACtC;AACF,MAAI,OAAO,kBAAkB;AAC3B,WAAO;AAAA,MACL;AAAA,IACF;AACF,QAAM,cAAc,KAAK,MAAM,OAAO,aAAa;AACnD,MAAI,OAAO,MAAM,WAAW;AAC1B,WAAO,CAAC,+CAA+C,OAAO,aAAa,EAAE;AAC/E,QAAM,QAAQ,IAAI,QAAQ,IAAI,eAAe;AAC7C,MAAI,OAAO;AACT,WAAO,CAAC,2BAA2B,KAAK,MAAM,IAAI,CAAC,6BAA6B;AAClF,SAAO,CAAC;AACV;AA6BO,SAAS,oBAAoB,SAAyC;AAC3E,QAAM,WAAW,QAAQ,OAAO,CAAC,MAAM,EAAE,QAAQ;AACjD,MAAI,SAAS,WAAW,EAAG,QAAO,CAAC;AACnC,SAAO;AAAA,IACL,0BAA0B,SAAS,MAAM,sBACpC,SAAS,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;AAAA,EAK/C;AACF;AAaO,SAAS,wBAAwB,MAAqC;AAC3E,MAAI,CAAC,KAAK,WAAW,KAAK,gBAAgB,WAAW,EAAG,QAAO,CAAC;AAChE,SAAO;AAAA,IACL,0BAA0B,KAAK,gBAAgB,MAAM,oDAChC,KAAK,gBAAgB,KAAK,IAAI,CAAC;AAAA,EAKtD;AACF;AAMO,IAAM,qBAAqB;AA0BlC,eAAsB,uBACpB,MACA,MACA,MACA,KAC+B;AAC/B,MAAI,CAAC,KAAK,QAAS,QAAO,CAAC;AAC3B,QAAM,SAA+B,CAAC;AACtC,aAAW,UAAU,KAAK,iBAAiB;AACzC,UAAM,MAAM,MAAM,KAAK,UAAU,MAAM,MAAM;AAC7C,QAAI,CAAC,IAAK;AACV,UAAM,WAAW,IAAI,QAAQ,IAAI,IAAI,KAAK,IAAI,WAAW,EAAE,QAAQ,KAAK;AACxE,WAAO,KAAK,EAAE,QAAQ,UAAU,IAAI,mBAAmB,UAAU,mBAAmB,CAAC;AAAA,EACvF;AACA,SAAO;AACT;AAkBA,eAAsB,0BACpB,KACA,MACA,MAAY,oBAAI,KAAK,GACrB,WAA0B,eACQ;AAClC,QAAM,OAAgC,CAAC;AACvC,aAAW,KAAK,MAAM,KAAK,aAAa,GAAG,GAAG;AAC5C,UAAM,OAAO,GAAG,GAAG,IAAI,EAAE,IAAI;AAC7B,QAAI,EAAE,YAAY,EAAE,eAAe,UAAU;AAC3C,WAAK,KAAK;AAAA,QACR;AAAA,QACA,QAAQ;AAAA,QACR,QAAQ,EAAE,WAAW,aAAa,GAAG,EAAE,UAAU;AAAA,MACnD,CAAC;AACD;AAAA,IACF;AACA,QAAI;AACF,YAAM,OAAiB,CAAC;AACxB,UAAI,gBAAgB;AACpB,YAAM,WAAW,MAAM,KAAK,iBAAiB,IAAI;AACjD,UAAI,SAAS,WAAW,GAAG;AACzB,aAAK,KAAK,yBAAyB;AAAA,MACrC,OAAO;AACL,cAAM,SAAS,MAAM,QAAQ;AAAA,UAC3B,SAAS,IAAI,OAAO,OAAO;AACzB,kBAAM,OAAO,MAAM,KAAK,WAAW,MAAM,GAAG,EAAE;AAC9C,mBAAO,EAAE,MAAM,GAAG,MAAM,MAAM,MAAM,YAAY,MAAM,IAAI,EAAE;AAAA,UAC9D,CAAC;AAAA,QACH;AACA,cAAM,WAAW,OAAO,KAAK,CAAC,MAAM,EAAE,KAAK,WAAW,CAAC;AACvD,YAAI,UAAU;AACZ,gBAAM,WAAW,SAAS,KAAK,SAAS,CAAC,GAAG;AAAA,YAC1C,CAAC,SAAS,KAAK,SAAS;AAAA,UAC1B;AACA,0BAAgB,IAAI,SAAS,IAAI,IAAI,UAAU,KAAK,sCAAiC;AAAA,QACvF,OAAO;AACL,eAAK,KAAK,OAAO,IAAI,CAAC,MAAM,IAAI,EAAE,IAAI,MAAM,EAAE,KAAK,KAAK,IAAI,CAAC,EAAE,EAAE,KAAK,KAAK,CAAC;AAAA,QAC9E;AAAA,MACF;AACA,WAAK,KAAK,GAAG,mBAAmB,CAAC,CAAC;AAClC,WAAK,KAAK,GAAG,aAAa,MAAM,KAAK,eAAe,MAAM,sBAAsB,GAAG,GAAG,CAAC;AACvF,YAAM,OAAO,MAAM,KAAK,oBAAoB,IAAI;AAChD,WAAK,KAAK,GAAG,wBAAwB,IAAI,CAAC;AAC1C,WAAK,KAAK,GAAG,oBAAoB,MAAM,uBAAuB,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC;AACrF,YAAM,EAAE,MAAM,UAAU,MAAM,IAAI,sBAAsB,MAAM,MAAM,KAAK,QAAQ;AACjF,UAAI,KAAK,SAAS,GAAG;AAGnB,aAAK,KAAK,EAAE,MAAM,QAAQ,OAAO,QAAQ,CAAC,GAAG,MAAM,GAAG,KAAK,EAAE,KAAK,KAAK,EAAE,CAAC;AAAA,MAC5E,WAAW,MAAM,SAAS,GAAG;AAG3B,aAAK,KAAK,EAAE,MAAM,QAAQ,WAAW,QAAQ,MAAM,KAAK,KAAK,EAAE,CAAC;AAAA,MAClE,OAAO;AACL,aAAK,KAAK,EAAE,MAAM,QAAQ,WAAW,QAAQ,cAAc,CAAC;AAAA,MAC9D;AAAA,IACF,SAAS,GAAG;AACV,WAAK,KAAK;AAAA,QACR;AAAA,QACA,QAAQ;AAAA,QACR,QAAQ,iBAAiB,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,CAAC;AAAA,MACrE,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO;AACT;;;ACjVO,SAAS,wBAAwB,MAAsB;AAC5D,SAAO,OAAO,IAAI,IAAI;AACxB;AAQA,eAAsB,0BACpB,MAEA,cAC2C;AAC3C,QAAM,MAAM,KAAK,KAAK,KAAK;AAC3B,MAAI,CAAC,KAAK;AACR,WAAO,EAAE,QAAQ,yCAAyC,MAAM,EAAE;AAAA,EACpE;AACA,QAAM,QAAQ,QAAQ,IAAI,gBAAgB,KAAK,KAAK,QAAQ,IAAI,UAAU,KAAK;AAC/E,MAAI,CAAC,gBAAgB,CAAC,OAAO;AAC3B,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,MAAM;AAAA,IACR;AAAA,EACF;AACA,QAAM,OAAO,gBAAgB,WAAW,EAAE,MAAc,CAAC;AAEzD,QAAM,OAAO,MAAM,0BAA0B,KAAK,IAAI;AACtD,QAAM,OAAO,KAAK,OAAO,CAAC,MAAM,EAAE,WAAW,KAAK;AAClD,QAAM,UAAU,KAAK,OAAO,CAAC,MAAM,EAAE,WAAW,SAAS;AACzD,QAAM,UAAU,KAAK,OAAO,CAAC,MAAM,EAAE,WAAW,SAAS;AAEzD,QAAM,QAAQ,KAAK,IAAI,CAAC,MAAM,GAAG,EAAE,OAAO,YAAY,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI,WAAM,EAAE,MAAM,EAAE;AAC3F,QAAM;AAAA,IACJ,yBAAyB,KAAK,MAAM,YAAY,QAAQ,MAAM,YAAY,QAAQ,MAAM,UAAU,KAAK,MAAM;AAAA,EAC/G;AACA,SAAO,EAAE,QAAQ,MAAM,KAAK,IAAI,GAAG,MAAM,wBAAwB,KAAK,MAAM,EAAE;AAChF;","names":[]}

package/dist/{renovate-dispatch-2VYCEH42.js → renovate-dispatch-7D7FMMJP.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-PZQ3WED2.js";
 import {
   makeGitHub
-} from "./chunk-VSHC4HOI.js";
+} from "./chunk-YAMRVXOD.js";
 import "./chunk-HVOOCK6L.js";
 import {
   isDashboardVisible,
@@ -138,4 +138,4 @@ async function runRenovateDispatchCommand(opts) {
 export {
   runRenovateDispatchCommand
 };
-//# sourceMappingURL=renovate-dispatch-2VYCEH42.js.map
+//# sourceMappingURL=renovate-dispatch-7D7FMMJP.js.map

package/dist/{report-IU4CLJS5.js → report-BGKMN5GU.js}

@@ -1,10 +1,10 @@
 import {
   draftReportForSite,
   readGaConfig
-} from "./chunk-6SZBNALD.js";
+} from "./chunk-6M2IXJ3E.js";
 import {
   reportTier
-} from "./chunk-SEQA7MC3.js";
+} from "./chunk-62VF32IC.js";
 import "./chunk-37S6L6G4.js";
 import {
   findDueReports,
@@ -12,10 +12,12 @@ import {
   reportPeriodKey
 } from "./chunk-D4FVAIEJ.js";
 import {
-  escapeHtml,
   listAllReports
-} from "./chunk-MNE374CZ.js";
+} from "./chunk-6QRLRT3P.js";
 import "./chunk-MPBXOJ3N.js";
+import {
+  escapeHtml
+} from "./chunk-SEEA6RXF.js";
 import "./chunk-U5SZ4FOP.js";
 import {
   listWebsites,
@@ -71,11 +73,11 @@ function dashboardBaseUrl() {
 }
 async function runReportCommand(slug, opts) {
   if (opts.digest) {
-    const { runDigest } = await import("./digest-NQAQI34P.js");
+    const { runDigest } = await import("./digest-N232AYVG.js");
     return runDigest({ baseUrl: dashboardBaseUrl() });
   }
   if (opts.sendReady) {
-    const { sendApprovedReports } = await import("./orchestrate-QOQXOJLI.js");
+    const { sendApprovedReports } = await import("./orchestrate-NY6L4Q7Q.js");
     return sendApprovedReports();
   }
   if (opts.due) {
@@ -270,4 +272,4 @@ export {
   parseSingleSiteReportType,
   runReportCommand
 };
-//# sourceMappingURL=report-IU4CLJS5.js.map
+//# sourceMappingURL=report-BGKMN5GU.js.map

package/dist/{report-IU4CLJS5.js.map → report-BGKMN5GU.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/alerts/analytics-health.ts","../src/cli/commands/report.ts"],"sourcesContent":["import { escapeHtml } from \"../util/html.js\";\n\n/**\n * The GA/Search enrichment outcome of one `report --due` draft run, aggregated\n * across the sites it drafted. `softFailedSites` is how many drafted sites had GA\n * OR Search enrichment ERROR (not \"not configured\" — that's a legitimate skip);\n * `configuredSites` is how many drafted sites had analytics configured at all\n * (the subject is set AND the site has a GA4 property or a search query). The ratio\n * is what distinguishes a fleet-wide subject outage from a single transient blip.\n */\nexport type AnalyticsRunHealth = {\n  softFailedSites: number;\n  configuredSites: number;\n};\n\nexport type AnalyticsAlert = { fire: boolean; reason: string };\n\n/** A lone failure never alerts — that's a per-site config issue, not the shared-\n *  subject SPOF. Two-plus AND a majority of configured sites is the fleet signature. */\nconst MIN_FAILED_SITES = 2;\n\n/**\n * Decide whether a draft run's GA/Search soft-failures look FLEET-WIDE — i.e. the\n * one impersonated subject (`GA_SUBJECT`) lost access — rather than one site's\n * transient blip. PURE. Fires when at least {@link MIN_FAILED_SITES} configured\n * sites failed AND they are a majority (≥ half) of the analytics-configured sites\n * this run. With <2 configured sites it can't distinguish a SPOF from a one-off, so\n * it never fires (at fleet scale there are always many configured sites).\n */\nexport function assessAnalyticsAlert(h: AnalyticsRunHealth): AnalyticsAlert {\n  const { softFailedSites, configuredSites } = h;\n  const fire =\n    configuredSites >= 2 &&\n    softFailedSites >= MIN_FAILED_SITES &&\n    softFailedSites * 2 >= configuredSites;\n  const reason = fire\n    ? `${softFailedSites} of ${configuredSites} analytics-configured sites had GA/Search enrichment fail this run — the shared GA_SUBJECT likely lost access (an offboarded user, revoked property access, or a botched role-account cutover). Reports were drafted with BLANK analytics.`\n    : \"\";\n  return { fire, reason };\n}\n\n/**\n * Compose the operator alert email for a fleet-wide analytics failure. PURE — the\n * caller (the `report --due` cron) sends it best-effort via Resend only when\n * {@link assessAnalyticsAlert} fires. `dashboardUrl` is the fleet homepage link.\n */\nexport function composeAnalyticsAlertEmail(\n  h: AnalyticsRunHealth,\n  dashboardUrl: string,\n): { subject: string; html: string } {\n  const subject = `⚠ Fleet analytics enrichment failing — ${h.softFailedSites}/${h.configuredSites} sites`;\n  const { reason } = assessAnalyticsAlert(h);\n  const html = `<p><strong>${escapeHtml(reason)}</strong></p>\n<p>This usually means the Google Workspace user the service account impersonates can no longer read the GA4 / Search Console properties. Reports still send — but with blank analytics — until the subject is restored.</p>\n<p>Next step: follow the GA/Search subject runbook (<code>docs/runbooks/ga-search-role-account-cutover.md</code>) to restore or move the subject, then re-run <code>reddoor-maint report --due</code> and confirm the warning clears.</p>\n<p><a href=\"${escapeHtml(dashboardUrl)}\">Open the fleet dashboard →</a></p>`;\n  return { subject, html };\n}\n","import { openBase, readAirtableConfig, type AirtableBase } from \"../../reports/airtable/client.js\";\nimport {\n  listWebsites,\n  siteSlug,\n  updateNextDueDates,\n  type WebsiteRow,\n} from \"../../reports/airtable/websites.js\";\nimport { listAllReports, type ReportRow } from \"../../reports/airtable/reports.js\";\nimport { findDueReports, nextDueDate, reportPeriodKey } from \"../../reports/due.js\";\nimport { draftReportForSite } from \"../../reports/draft.js\";\nimport { reportTier } from \"../../reports/queue.js\";\nimport { readGaConfig } from \"../../reports/ga/config.js\";\nimport {\n  assessAnalyticsAlert,\n  composeAnalyticsAlertEmail,\n  type AnalyticsRunHealth,\n} from \"../../alerts/analytics-health.js\";\nimport type { ReportType } from \"../../reports/types.js\";\n\nexport type ReportCommandOptions = {\n  due?: boolean;\n  preview?: boolean;\n  sendReady?: boolean;\n  digest?: boolean;\n  type?: string;\n  cwd?: string;\n};\n\n/**\n * Summary line for a drafted report, reflecting the single-queue outcome. `queued === false`\n * means a higher-or-equal-tier report was already pending for the site, so this draft was\n * created but deliberately left OUT of the approve queue. A non-empty `supersededIds` means it\n * un-queued that many lower-tier drafts. `null` is the previewOnly path (no Airtable queue).\n */\nfunction draftLine(\n  reportId: string | undefined,\n  queued: boolean | null,\n  supersededIds: string[],\n  verb = \"drafted\",\n): string {\n  const id = reportId ?? \"(unknown)\";\n  if (queued === false) {\n    return `• ${verb} but NOT queued: ${id} — a higher-or-equal-tier report is already pending approval`;\n  }\n  const sup =\n    supersededIds.length > 0\n      ? ` (superseded ${supersededIds.length} lower-tier draft${supersededIds.length > 1 ? \"s\" : \"\"})`\n      : \"\";\n  return `✓ ${verb}: ${id}${sup}`;\n}\n\n/**\n * Parse the single-site `--type` flag. Only Maintenance and Testing are draftable\n * this way — Launch has the `launch <site>` command and Announcement has\n * `announce <site>`, each with its own purpose-built flow. Case-insensitive;\n * defaults to Maintenance (the historical single-site behaviour). Throws an\n * exitCode-2 usage error on anything else. PURE.\n */\nexport function parseSingleSiteReportType(raw: string | undefined): ReportType {\n  if (raw === undefined || raw.trim() === \"\") return \"Maintenance\";\n  const norm = raw.trim().toLowerCase();\n  if (norm === \"maintenance\") return \"Maintenance\";\n  if (norm === \"testing\") return \"Testing\";\n  const hint =\n    norm === \"launch\"\n      ? \" — use the `launch <site>` command\"\n      : norm === \"announcement\"\n        ? \" — use the `announce <site>` command\"\n        : \"\";\n  throw Object.assign(\n    new Error(`--type must be Maintenance or Testing (got ${JSON.stringify(raw)})${hint}`),\n    { exitCode: 2 },\n  );\n}\n\n/** Dashboard origin for digest /s/<slug> links. DASHBOARD_BASE_URL overrides the\n *  production default; the trailing slash (if any) is trimmed by runDigest. */\nfunction dashboardBaseUrl(): string {\n  return process.env.DASHBOARD_BASE_URL?.trim() || \"https://reddoor-maintenance.netlify.app\";\n}\n\nexport async function runReportCommand(\n  slug: string | undefined,\n  opts: ReportCommandOptions,\n): Promise<{ output: string; code: number }> {\n  if (opts.digest) {\n    const { runDigest } = await import(\"../../reports/digest.js\");\n    return runDigest({ baseUrl: dashboardBaseUrl() });\n  }\n\n  if (opts.sendReady) {\n    const { sendApprovedReports } = await import(\"../../reports/send/orchestrate.js\");\n    return sendApprovedReports();\n  }\n\n  if (opts.due) {\n    return runDueDraft();\n  }\n\n  if (slug) {\n    // Validate the type BEFORE any Airtable access so a bad --type fails fast (and\n    // without needing credentials).\n    const reportType = parseSingleSiteReportType(opts.type);\n    return runSingleSiteDraft(slug, { previewOnly: Boolean(opts.preview), reportType });\n  }\n\n  throw Object.assign(\n    new Error(\n      \"Usage: reddoor-maint report [<slug>] [--type <Maintenance|Testing>] [--due] [--preview] [--send-ready] [--digest]\",\n    ),\n    {\n      exitCode: 2,\n    },\n  );\n}\n\nasync function runDueDraft(): Promise<{ output: string; code: number }> {\n  const base = openBase(readAirtableConfig());\n  const result = await draftDueReports(base, new Date());\n  await alertOnFleetAnalyticsFailure(result.health);\n  return { output: result.output, code: result.code };\n}\n\n/** Best-effort: when a draft run's GA/Search soft-failures look FLEET-WIDE (the shared\n *  GA_SUBJECT lost access — see assessAnalyticsAlert), email the operator one alert.\n *  NEVER throws — a Resend or config hiccup must not fail the nightly draft cron; the\n *  per-site `⚠ GA skipped` warnings + the run-output line still carry the signal. The\n *  daily idempotency key dedupes multiple runs in one day (Resend dedupes 24h). */\nasync function alertOnFleetAnalyticsFailure(health: AnalyticsRunHealth): Promise<void> {\n  if (!assessAnalyticsAlert(health).fire) return;\n  try {\n    const to = process.env.OPERATOR_EMAIL?.trim() || \"info@reddoorla.com\";\n    const { subject, html } = composeAnalyticsAlertEmail(health, dashboardBaseUrl());\n    const { defaultResendClient } = await import(\"../../reports/send/resend.js\");\n    await defaultResendClient().send({\n      from: \"Reddoor Reports <reports@reddoorla.com>\",\n      to: [to],\n      subject,\n      html,\n      idempotencyKey: `analytics-alert-${new Date().toISOString().slice(0, 10)}`,\n    });\n    console.warn(`⚠ ${subject} — operator alerted (${to})`);\n  } catch (e) {\n    console.warn(`⚠ analytics-failure alert send failed: ${(e as Error).message}`);\n  }\n}\n\n/**\n * Write each site's code-computed next-maintenance / next-testing date back to Airtable\n * (date-only, or null when there's no schedule), so the \"next\" dates shown there derive\n * from the SAME `nextDueDate` the scheduler uses — replacing the old Airtable formula +\n * automation. Best-effort and per-site isolated: a missing `Next … at` column or one bad\n * row warns and is skipped, never aborting the nightly draft run.\n */\nasync function writeNextDueDates(\n  base: AirtableBase,\n  websites: WebsiteRow[],\n  reports: ReportRow[],\n  today: Date,\n): Promise<void> {\n  const ymd = (d: Date | null): string | null => (d ? d.toISOString().slice(0, 10) : null);\n  for (const site of websites) {\n    try {\n      await updateNextDueDates(base, site.id, {\n        maintenanceAt: ymd(nextDueDate(site, reports, \"Maintenance\", today)),\n        testingAt: ymd(nextDueDate(site, reports, \"Testing\", today)),\n      });\n    } catch (e) {\n      console.warn(`⚠ next-due write skipped for ${site.name}: ${(e as Error).message}`);\n    }\n  }\n}\n\nexport async function draftDueReports(\n  base: AirtableBase,\n  today: Date,\n): Promise<{ output: string; code: number; health: AnalyticsRunHealth }> {\n  const websites = await listWebsites(base);\n  // ONE unfiltered fetch for the whole fleet. Per-site queries can't be pushed to\n  // Airtable anyway (linked-record fields aren't formula-filterable by record id),\n  // and findDueReports + the period guard below match on siteId in memory.\n  const reports = await listAllReports(base);\n\n  // Refresh every site's code-owned next-due dates first, so they stay current even on\n  // a run where nothing is due (the early return below).\n  await writeNextDueDates(base, websites, reports, today);\n\n  const due = findDueReports(websites, reports, today);\n\n  // GA/Search enrichment is configured globally (the impersonation subject) AND\n  // per-site (a GA4 property or a search query). `gaConfigured` is the global half;\n  // the per-site half is checked as each draft runs, to build the fleet-wide\n  // analytics-failure alert's denominator (see alertOnFleetAnalyticsFailure).\n  const gaConfigured = readGaConfig() !== null;\n  // Truthy (not `!== null`) to mirror fetchGaUsers/fetchSearch's own gate exactly\n  // (`!siteRow.ga4PropertyId`), so an empty-string cell counts as not-configured in\n  // BOTH places and can't inflate the alert denominator.\n  const isAnalyticsConfigured = (s: WebsiteRow): boolean =>\n    gaConfigured && Boolean(s.ga4PropertyId || s.searchQuery);\n\n  if (due.length === 0) {\n    return {\n      output: \"No reports due.\",\n      code: 0,\n      health: { softFailedSites: 0, configuredSites: 0 },\n    };\n  }\n\n  const lines: string[] = [];\n  let softFailedSites = 0;\n  let searchDefaultMisses = 0;\n  let searchPropertiesMissing = 0;\n  let gaConfiguredSites = 0;\n  let skipped = 0;\n  for (const item of due) {\n    // Idempotency: a re-run must not re-draft a (site, type) already drafted this\n    // recurrence. The dueDate's YYYY-MM is the stable per-cycle key. Match against the\n    // reports we already fetched — no extra query on the hot path.\n    const period = reportPeriodKey(item.dueDate);\n    const existing = reports.find(\n      (r) => r.siteId === item.site.id && r.reportType === item.reportType && r.period === period,\n    );\n\n    // A row already exists for THIS period. Two cases:\n    //   - Draft ready → truly done, skip (the idempotent re-run path).\n    //   - NOT ready → a crash between createDraft and setDraftReady wedged it: the\n    //     row exists (so we never re-draft) yet it's never sendable (listSendable\n    //     needs Draft ready). COMPLETE it in place instead of skipping forever —\n    //     re-render → re-upload the HTML → flip Draft ready on the EXISTING row.\n    if (existing) {\n      if (existing.draftReady) {\n        skipped++;\n        lines.push(`• skipped (already drafted ${period}): ${item.site.name} ${item.reportType}`);\n        continue;\n      }\n      // A not-ready row is normally a crash between createDraft and setDraftReady — re-complete\n      // it in place. BUT queueDraft also clears Draft ready on rows it supersedes/blocks, and\n      // those must NOT be re-completed: doing so would re-render and APPEND a duplicate HTML\n      // attachment every nightly run, only to be re-blocked. Distinguish the two: if a\n      // higher-or-equal-tier report is still pending for this site, this row was intentionally\n      // un-queued (not crashed) — skip it until the blocker is sent/approved or the month rolls.\n      const blockedByPending = reports.some(\n        (r) =>\n          r.siteId === item.site.id &&\n          r.id !== existing.id &&\n          r.sentAt === null &&\n          r.draftReady &&\n          reportTier(r.reportType) >= reportTier(item.reportType),\n      );\n      if (blockedByPending) {\n        skipped++;\n        lines.push(\n          `• skipped (superseded — a higher-or-equal-tier report is pending): ${item.site.name} ${item.reportType}`,\n        );\n        continue;\n      }\n      try {\n        const result = await draftReportForSite(base, item.site, item.reportType, {\n          period,\n          completeRowId: existing.id,\n          existingRow: existing,\n        });\n        existing.draftReady = result.queued === true;\n        lines.push(\n          draftLine(\n            result.reportRow?.reportId ?? existing.reportId,\n            result.queued,\n            result.supersededIds,\n            \"completed half-made draft\",\n          ),\n        );\n        if (isAnalyticsConfigured(item.site)) gaConfiguredSites++;\n        if (result.softFailures.length > 0) softFailedSites++;\n        if (result.searchDefaultMissed) searchDefaultMisses++;\n        if (result.searchPropertyMissing) searchPropertiesMissing++;\n      } catch (e) {\n        lines.push(`✗ failed: ${item.site.name} ${item.reportType} — ${(e as Error).message}`);\n      }\n      continue;\n    }\n\n    // Pile-up guard: don't accrue a fresh new-period draft every recurrence for a\n    // site nobody ever approves. The period key follows the DUE month, so each\n    // recurrence wants a new (later-period) draft — but if a PRIOR draft is still\n    // pending approval, a new one just stacks. Skip creating the new one while an\n    // earlier-period draft for this (site, type) sits ready-but-unsent.\n    //\n    // `r.draftReady` is load-bearing: a draft a higher tier SUPERSEDED has\n    // draftReady=false and never gets a Sent at, so without this clause it would\n    // match (sentAt null + earlier period) and block EVERY future draft for the\n    // site forever. Pending-approval means draftReady=true AND sentAt=null.\n    const pendingEarlier = reports.find(\n      (r) =>\n        r.siteId === item.site.id &&\n        r.reportType === item.reportType &&\n        r.draftReady &&\n        r.sentAt === null &&\n        r.period !== null &&\n        r.period < period,\n    );\n    if (pendingEarlier) {\n      skipped++;\n      lines.push(\n        `• skipped: ${item.site.name} ${item.reportType} already has an unsent ${pendingEarlier.period} draft pending approval`,\n      );\n      continue;\n    }\n\n    try {\n      // Pass the SAME key the guard searches by, so the stamped Period always\n      // matches a future run's reportPeriodKey(dueDate) — even if this run lags\n      // into a later month than the dueDate.\n      const result = await draftReportForSite(base, item.site, item.reportType, { period });\n      lines.push(draftLine(result.reportRow?.reportId, result.queued, result.supersededIds));\n      // Keep the in-memory snapshot current so the guard's `.some()` check on the\n      // NEXT iteration of this same run catches a row we JUST created — rather than\n      // relying on findDueReports never emitting two items for the same (site, type).\n      if (result.reportRow) reports.push(result.reportRow);\n      // Count sites (not individual GA/Search failures) so a fleet-wide enrichment\n      // outage is one obvious line at the bottom, not 200 buried console.warns.\n      if (isAnalyticsConfigured(item.site)) gaConfiguredSites++;\n      if (result.softFailures.length > 0) softFailedSites++;\n      if (result.searchDefaultMissed) searchDefaultMisses++;\n      if (result.searchPropertyMissing) searchPropertiesMissing++;\n    } catch (e) {\n      lines.push(`✗ failed: ${item.site.name} ${item.reportType} — ${(e as Error).message}`);\n    }\n  }\n  if (skipped > 0) {\n    lines.push(`• ${skipped} already drafted or pending this period`);\n  }\n  if (softFailedSites > 0) {\n    lines.push(\n      `⚠ ${softFailedSites} site${softFailedSites === 1 ? \"\" : \"s\"} had GA/Search enrichment fail — drafted with blank analytics; check the logs above`,\n    );\n  }\n  if (searchDefaultMisses > 0) {\n    lines.push(\n      `⚑ ${searchDefaultMisses} site${searchDefaultMisses === 1 ? \"\" : \"s\"} returned no Search Console data for their name — set an explicit \"Search query\" in Airtable to track brand presence.`,\n    );\n  }\n  if (searchPropertiesMissing > 0) {\n    lines.push(\n      `⚑ ${searchPropertiesMissing} site${searchPropertiesMissing === 1 ? \"\" : \"s\"} matched NO Search Console property — verify the domain property exists and the service account has access (a \"Search query\" change cannot fix this).`,\n    );\n  }\n  return {\n    output: lines.join(\"\\n\"),\n    code: lines.some((l) => l.startsWith(\"✗\")) ? 1 : 0,\n    health: { softFailedSites, configuredSites: gaConfiguredSites },\n  };\n}\n\nasync function runSingleSiteDraft(\n  slug: string,\n  opts: { previewOnly: boolean; reportType: ReportType },\n): Promise<{ output: string; code: number }> {\n  const base = openBase(readAirtableConfig());\n  const websites = await listWebsites(base);\n  const site = websites.find((w) => siteSlug(w.name) === slug);\n  if (!site) {\n    throw Object.assign(new Error(`No Websites row matched slug \"${slug}\"`), { exitCode: 2 });\n  }\n  const result = await draftReportForSite(opts.previewOnly ? null : base, site, opts.reportType, {\n    previewOnly: opts.previewOnly,\n  });\n  if (opts.previewOnly) {\n    return { output: `Preview written to ${result.htmlPath}`, code: 0 };\n  }\n  return {\n    output: draftLine(\n      result.reportRow?.reportId,\n      result.queued,\n      result.supersededIds,\n      \"Draft created\",\n    ),\n    code: 0,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmBA,IAAM,mBAAmB;AAUlB,SAAS,qBAAqB,GAAuC;AAC1E,QAAM,EAAE,iBAAiB,gBAAgB,IAAI;AAC7C,QAAM,OACJ,mBAAmB,KACnB,mBAAmB,oBACnB,kBAAkB,KAAK;AACzB,QAAM,SAAS,OACX,GAAG,eAAe,OAAO,eAAe,oPACxC;AACJ,SAAO,EAAE,MAAM,OAAO;AACxB;AAOO,SAAS,2BACd,GACA,cACmC;AACnC,QAAM,UAAU,oDAA0C,EAAE,eAAe,IAAI,EAAE,eAAe;AAChG,QAAM,EAAE,OAAO,IAAI,qBAAqB,CAAC;AACzC,QAAM,OAAO,cAAc,WAAW,MAAM,CAAC;AAAA;AAAA;AAAA,cAGjC,WAAW,YAAY,CAAC;AACpC,SAAO,EAAE,SAAS,KAAK;AACzB;;;ACvBA,SAAS,UACP,UACA,QACA,eACA,OAAO,WACC;AACR,QAAM,KAAK,YAAY;AACvB,MAAI,WAAW,OAAO;AACpB,WAAO,UAAK,IAAI,oBAAoB,EAAE;AAAA,EACxC;AACA,QAAM,MACJ,cAAc,SAAS,IACnB,gBAAgB,cAAc,MAAM,oBAAoB,cAAc,SAAS,IAAI,MAAM,EAAE,MAC3F;AACN,SAAO,UAAK,IAAI,KAAK,EAAE,GAAG,GAAG;AAC/B;AASO,SAAS,0BAA0B,KAAqC;AAC7E,MAAI,QAAQ,UAAa,IAAI,KAAK,MAAM,GAAI,QAAO;AACnD,QAAM,OAAO,IAAI,KAAK,EAAE,YAAY;AACpC,MAAI,SAAS,cAAe,QAAO;AACnC,MAAI,SAAS,UAAW,QAAO;AAC/B,QAAM,OACJ,SAAS,WACL,4CACA,SAAS,iBACP,8CACA;AACR,QAAM,OAAO;AAAA,IACX,IAAI,MAAM,8CAA8C,KAAK,UAAU,GAAG,CAAC,IAAI,IAAI,EAAE;AAAA,IACrF,EAAE,UAAU,EAAE;AAAA,EAChB;AACF;AAIA,SAAS,mBAA2B;AAClC,SAAO,QAAQ,IAAI,oBAAoB,KAAK,KAAK;AACnD;AAEA,eAAsB,iBACpB,MACA,MAC2C;AAC3C,MAAI,KAAK,QAAQ;AACf,UAAM,EAAE,UAAU,IAAI,MAAM,OAAO,sBAAyB;AAC5D,WAAO,UAAU,EAAE,SAAS,iBAAiB,EAAE,CAAC;AAAA,EAClD;AAEA,MAAI,KAAK,WAAW;AAClB,UAAM,EAAE,oBAAoB,IAAI,MAAM,OAAO,2BAAmC;AAChF,WAAO,oBAAoB;AAAA,EAC7B;AAEA,MAAI,KAAK,KAAK;AACZ,WAAO,YAAY;AAAA,EACrB;AAEA,MAAI,MAAM;AAGR,UAAM,aAAa,0BAA0B,KAAK,IAAI;AACtD,WAAO,mBAAmB,MAAM,EAAE,aAAa,QAAQ,KAAK,OAAO,GAAG,WAAW,CAAC;AAAA,EACpF;AAEA,QAAM,OAAO;AAAA,IACX,IAAI;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,UAAU;AAAA,IACZ;AAAA,EACF;AACF;AAEA,eAAe,cAAyD;AACtE,QAAM,OAAO,SAAS,mBAAmB,CAAC;AAC1C,QAAM,SAAS,MAAM,gBAAgB,MAAM,oBAAI,KAAK,CAAC;AACrD,QAAM,6BAA6B,OAAO,MAAM;AAChD,SAAO,EAAE,QAAQ,OAAO,QAAQ,MAAM,OAAO,KAAK;AACpD;AAOA,eAAe,6BAA6B,QAA2C;AACrF,MAAI,CAAC,qBAAqB,MAAM,EAAE,KAAM;AACxC,MAAI;AACF,UAAM,KAAK,QAAQ,IAAI,gBAAgB,KAAK,KAAK;AACjD,UAAM,EAAE,SAAS,KAAK,IAAI,2BAA2B,QAAQ,iBAAiB,CAAC;AAC/E,UAAM,EAAE,oBAAoB,IAAI,MAAM,OAAO,sBAA8B;AAC3E,UAAM,oBAAoB,EAAE,KAAK;AAAA,MAC/B,MAAM;AAAA,MACN,IAAI,CAAC,EAAE;AAAA,MACP;AAAA,MACA;AAAA,MACA,gBAAgB,oBAAmB,oBAAI,KAAK,GAAE,YAAY,EAAE,MAAM,GAAG,EAAE,CAAC;AAAA,IAC1E,CAAC;AACD,YAAQ,KAAK,UAAK,OAAO,6BAAwB,EAAE,GAAG;AAAA,EACxD,SAAS,GAAG;AACV,YAAQ,KAAK,+CAA2C,EAAY,OAAO,EAAE;AAAA,EAC/E;AACF;AASA,eAAe,kBACb,MACA,UACA,SACA,OACe;AACf,QAAM,MAAM,CAAC,MAAmC,IAAI,EAAE,YAAY,EAAE,MAAM,GAAG,EAAE,IAAI;AACnF,aAAW,QAAQ,UAAU;AAC3B,QAAI;AACF,YAAM,mBAAmB,MAAM,KAAK,IAAI;AAAA,QACtC,eAAe,IAAI,YAAY,MAAM,SAAS,eAAe,KAAK,CAAC;AAAA,QACnE,WAAW,IAAI,YAAY,MAAM,SAAS,WAAW,KAAK,CAAC;AAAA,MAC7D,CAAC;AAAA,IACH,SAAS,GAAG;AACV,cAAQ,KAAK,qCAAgC,KAAK,IAAI,KAAM,EAAY,OAAO,EAAE;AAAA,IACnF;AAAA,EACF;AACF;AAEA,eAAsB,gBACpB,MACA,OACuE;AACvE,QAAM,WAAW,MAAM,aAAa,IAAI;AAIxC,QAAM,UAAU,MAAM,eAAe,IAAI;AAIzC,QAAM,kBAAkB,MAAM,UAAU,SAAS,KAAK;AAEtD,QAAM,MAAM,eAAe,UAAU,SAAS,KAAK;AAMnD,QAAM,eAAe,aAAa,MAAM;AAIxC,QAAM,wBAAwB,CAAC,MAC7B,gBAAgB,QAAQ,EAAE,iBAAiB,EAAE,WAAW;AAE1D,MAAI,IAAI,WAAW,GAAG;AACpB,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ,EAAE,iBAAiB,GAAG,iBAAiB,EAAE;AAAA,IACnD;AAAA,EACF;AAEA,QAAM,QAAkB,CAAC;AACzB,MAAI,kBAAkB;AACtB,MAAI,sBAAsB;AAC1B,MAAI,0BAA0B;AAC9B,MAAI,oBAAoB;AACxB,MAAI,UAAU;AACd,aAAW,QAAQ,KAAK;AAItB,UAAM,SAAS,gBAAgB,KAAK,OAAO;AAC3C,UAAM,WAAW,QAAQ;AAAA,MACvB,CAAC,MAAM,EAAE,WAAW,KAAK,KAAK,MAAM,EAAE,eAAe,KAAK,cAAc,EAAE,WAAW;AAAA,IACvF;AAQA,QAAI,UAAU;AACZ,UAAI,SAAS,YAAY;AACvB;AACA,cAAM,KAAK,mCAA8B,MAAM,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,UAAU,EAAE;AACxF;AAAA,MACF;AAOA,YAAM,mBAAmB,QAAQ;AAAA,QAC/B,CAAC,MACC,EAAE,WAAW,KAAK,KAAK,MACvB,EAAE,OAAO,SAAS,MAClB,EAAE,WAAW,QACb,EAAE,cACF,WAAW,EAAE,UAAU,KAAK,WAAW,KAAK,UAAU;AAAA,MAC1D;AACA,UAAI,kBAAkB;AACpB;AACA,cAAM;AAAA,UACJ,gFAAsE,KAAK,KAAK,IAAI,IAAI,KAAK,UAAU;AAAA,QACzG;AACA;AAAA,MACF;AACA,UAAI;AACF,cAAM,SAAS,MAAM,mBAAmB,MAAM,KAAK,MAAM,KAAK,YAAY;AAAA,UACxE;AAAA,UACA,eAAe,SAAS;AAAA,UACxB,aAAa;AAAA,QACf,CAAC;AACD,iBAAS,aAAa,OAAO,WAAW;AACxC,cAAM;AAAA,UACJ;AAAA,YACE,OAAO,WAAW,YAAY,SAAS;AAAA,YACvC,OAAO;AAAA,YACP,OAAO;AAAA,YACP;AAAA,UACF;AAAA,QACF;AACA,YAAI,sBAAsB,KAAK,IAAI,EAAG;AACtC,YAAI,OAAO,aAAa,SAAS,EAAG;AACpC,YAAI,OAAO,oBAAqB;AAChC,YAAI,OAAO,sBAAuB;AAAA,MACpC,SAAS,GAAG;AACV,cAAM,KAAK,kBAAa,KAAK,KAAK,IAAI,IAAI,KAAK,UAAU,WAAO,EAAY,OAAO,EAAE;AAAA,MACvF;AACA;AAAA,IACF;AAYA,UAAM,iBAAiB,QAAQ;AAAA,MAC7B,CAAC,MACC,EAAE,WAAW,KAAK,KAAK,MACvB,EAAE,eAAe,KAAK,cACtB,EAAE,cACF,EAAE,WAAW,QACb,EAAE,WAAW,QACb,EAAE,SAAS;AAAA,IACf;AACA,QAAI,gBAAgB;AAClB;AACA,YAAM;AAAA,QACJ,mBAAc,KAAK,KAAK,IAAI,IAAI,KAAK,UAAU,0BAA0B,eAAe,MAAM;AAAA,MAChG;AACA;AAAA,IACF;AAEA,QAAI;AAIF,YAAM,SAAS,MAAM,mBAAmB,MAAM,KAAK,MAAM,KAAK,YAAY,EAAE,OAAO,CAAC;AACpF,YAAM,KAAK,UAAU,OAAO,WAAW,UAAU,OAAO,QAAQ,OAAO,aAAa,CAAC;AAIrF,UAAI,OAAO,UAAW,SAAQ,KAAK,OAAO,SAAS;AAGnD,UAAI,sBAAsB,KAAK,IAAI,EAAG;AACtC,UAAI,OAAO,aAAa,SAAS,EAAG;AACpC,UAAI,OAAO,oBAAqB;AAChC,UAAI,OAAO,sBAAuB;AAAA,IACpC,SAAS,GAAG;AACV,YAAM,KAAK,kBAAa,KAAK,KAAK,IAAI,IAAI,KAAK,UAAU,WAAO,EAAY,OAAO,EAAE;AAAA,IACvF;AAAA,EACF;AACA,MAAI,UAAU,GAAG;AACf,UAAM,KAAK,UAAK,OAAO,yCAAyC;AAAA,EAClE;AACA,MAAI,kBAAkB,GAAG;AACvB,UAAM;AAAA,MACJ,UAAK,eAAe,QAAQ,oBAAoB,IAAI,KAAK,GAAG;AAAA,IAC9D;AAAA,EACF;AACA,MAAI,sBAAsB,GAAG;AAC3B,UAAM;AAAA,MACJ,UAAK,mBAAmB,QAAQ,wBAAwB,IAAI,KAAK,GAAG;AAAA,IACtE;AAAA,EACF;AACA,MAAI,0BAA0B,GAAG;AAC/B,UAAM;AAAA,MACJ,UAAK,uBAAuB,QAAQ,4BAA4B,IAAI,KAAK,GAAG;AAAA,IAC9E;AAAA,EACF;AACA,SAAO;AAAA,IACL,QAAQ,MAAM,KAAK,IAAI;AAAA,IACvB,MAAM,MAAM,KAAK,CAAC,MAAM,EAAE,WAAW,QAAG,CAAC,IAAI,IAAI;AAAA,IACjD,QAAQ,EAAE,iBAAiB,iBAAiB,kBAAkB;AAAA,EAChE;AACF;AAEA,eAAe,mBACb,MACA,MAC2C;AAC3C,QAAM,OAAO,SAAS,mBAAmB,CAAC;AAC1C,QAAM,WAAW,MAAM,aAAa,IAAI;AACxC,QAAM,OAAO,SAAS,KAAK,CAAC,MAAM,SAAS,EAAE,IAAI,MAAM,IAAI;AAC3D,MAAI,CAAC,MAAM;AACT,UAAM,OAAO,OAAO,IAAI,MAAM,iCAAiC,IAAI,GAAG,GAAG,EAAE,UAAU,EAAE,CAAC;AAAA,EAC1F;AACA,QAAM,SAAS,MAAM,mBAAmB,KAAK,cAAc,OAAO,MAAM,MAAM,KAAK,YAAY;AAAA,IAC7F,aAAa,KAAK;AAAA,EACpB,CAAC;AACD,MAAI,KAAK,aAAa;AACpB,WAAO,EAAE,QAAQ,sBAAsB,OAAO,QAAQ,IAAI,MAAM,EAAE;AAAA,EACpE;AACA,SAAO;AAAA,IACL,QAAQ;AAAA,MACN,OAAO,WAAW;AAAA,MAClB,OAAO;AAAA,MACP,OAAO;AAAA,MACP;AAAA,IACF;AAAA,IACA,MAAM;AAAA,EACR;AACF;","names":[]}
+{"version":3,"sources":["../src/alerts/analytics-health.ts","../src/cli/commands/report.ts"],"sourcesContent":["import { escapeHtml } from \"../util/html.js\";\n\n/**\n * The GA/Search enrichment outcome of one `report --due` draft run, aggregated\n * across the sites it drafted. `softFailedSites` is how many drafted sites had GA\n * OR Search enrichment ERROR (not \"not configured\" — that's a legitimate skip);\n * `configuredSites` is how many drafted sites had analytics configured at all\n * (the subject is set AND the site has a GA4 property or a search query). The ratio\n * is what distinguishes a fleet-wide subject outage from a single transient blip.\n */\nexport type AnalyticsRunHealth = {\n  softFailedSites: number;\n  configuredSites: number;\n};\n\nexport type AnalyticsAlert = { fire: boolean; reason: string };\n\n/** A lone failure never alerts — that's a per-site config issue, not the shared-\n *  subject SPOF. Two-plus AND a majority of configured sites is the fleet signature. */\nconst MIN_FAILED_SITES = 2;\n\n/**\n * Decide whether a draft run's GA/Search soft-failures look FLEET-WIDE — i.e. the\n * one impersonated subject (`GA_SUBJECT`) lost access — rather than one site's\n * transient blip. PURE. Fires when at least {@link MIN_FAILED_SITES} configured\n * sites failed AND they are a majority (≥ half) of the analytics-configured sites\n * this run. With <2 configured sites it can't distinguish a SPOF from a one-off, so\n * it never fires (at fleet scale there are always many configured sites).\n */\nexport function assessAnalyticsAlert(h: AnalyticsRunHealth): AnalyticsAlert {\n  const { softFailedSites, configuredSites } = h;\n  const fire =\n    configuredSites >= 2 &&\n    softFailedSites >= MIN_FAILED_SITES &&\n    softFailedSites * 2 >= configuredSites;\n  const reason = fire\n    ? `${softFailedSites} of ${configuredSites} analytics-configured sites had GA/Search enrichment fail this run — the shared GA_SUBJECT likely lost access (an offboarded user, revoked property access, or a botched role-account cutover). Reports were drafted with BLANK analytics.`\n    : \"\";\n  return { fire, reason };\n}\n\n/**\n * Compose the operator alert email for a fleet-wide analytics failure. PURE — the\n * caller (the `report --due` cron) sends it best-effort via Resend only when\n * {@link assessAnalyticsAlert} fires. `dashboardUrl` is the fleet homepage link.\n */\nexport function composeAnalyticsAlertEmail(\n  h: AnalyticsRunHealth,\n  dashboardUrl: string,\n): { subject: string; html: string } {\n  const subject = `⚠ Fleet analytics enrichment failing — ${h.softFailedSites}/${h.configuredSites} sites`;\n  const { reason } = assessAnalyticsAlert(h);\n  const html = `<p><strong>${escapeHtml(reason)}</strong></p>\n<p>This usually means the Google Workspace user the service account impersonates can no longer read the GA4 / Search Console properties. Reports still send — but with blank analytics — until the subject is restored.</p>\n<p>Next step: follow the GA/Search subject runbook (<code>docs/runbooks/ga-search-role-account-cutover.md</code>) to restore or move the subject, then re-run <code>reddoor-maint report --due</code> and confirm the warning clears.</p>\n<p><a href=\"${escapeHtml(dashboardUrl)}\">Open the fleet dashboard →</a></p>`;\n  return { subject, html };\n}\n","import { openBase, readAirtableConfig, type AirtableBase } from \"../../reports/airtable/client.js\";\nimport {\n  listWebsites,\n  siteSlug,\n  updateNextDueDates,\n  type WebsiteRow,\n} from \"../../reports/airtable/websites.js\";\nimport { listAllReports, type ReportRow } from \"../../reports/airtable/reports.js\";\nimport { findDueReports, nextDueDate, reportPeriodKey } from \"../../reports/due.js\";\nimport { draftReportForSite } from \"../../reports/draft.js\";\nimport { reportTier } from \"../../reports/queue.js\";\nimport { readGaConfig } from \"../../reports/ga/config.js\";\nimport {\n  assessAnalyticsAlert,\n  composeAnalyticsAlertEmail,\n  type AnalyticsRunHealth,\n} from \"../../alerts/analytics-health.js\";\nimport type { ReportType } from \"../../reports/types.js\";\n\nexport type ReportCommandOptions = {\n  due?: boolean;\n  preview?: boolean;\n  sendReady?: boolean;\n  digest?: boolean;\n  type?: string;\n  cwd?: string;\n};\n\n/**\n * Summary line for a drafted report, reflecting the single-queue outcome. `queued === false`\n * means a higher-or-equal-tier report was already pending for the site, so this draft was\n * created but deliberately left OUT of the approve queue. A non-empty `supersededIds` means it\n * un-queued that many lower-tier drafts. `null` is the previewOnly path (no Airtable queue).\n */\nfunction draftLine(\n  reportId: string | undefined,\n  queued: boolean | null,\n  supersededIds: string[],\n  verb = \"drafted\",\n): string {\n  const id = reportId ?? \"(unknown)\";\n  if (queued === false) {\n    return `• ${verb} but NOT queued: ${id} — a higher-or-equal-tier report is already pending approval`;\n  }\n  const sup =\n    supersededIds.length > 0\n      ? ` (superseded ${supersededIds.length} lower-tier draft${supersededIds.length > 1 ? \"s\" : \"\"})`\n      : \"\";\n  return `✓ ${verb}: ${id}${sup}`;\n}\n\n/**\n * Parse the single-site `--type` flag. Only Maintenance and Testing are draftable\n * this way — Launch has the `launch <site>` command and Announcement has\n * `announce <site>`, each with its own purpose-built flow. Case-insensitive;\n * defaults to Maintenance (the historical single-site behaviour). Throws an\n * exitCode-2 usage error on anything else. PURE.\n */\nexport function parseSingleSiteReportType(raw: string | undefined): ReportType {\n  if (raw === undefined || raw.trim() === \"\") return \"Maintenance\";\n  const norm = raw.trim().toLowerCase();\n  if (norm === \"maintenance\") return \"Maintenance\";\n  if (norm === \"testing\") return \"Testing\";\n  const hint =\n    norm === \"launch\"\n      ? \" — use the `launch <site>` command\"\n      : norm === \"announcement\"\n        ? \" — use the `announce <site>` command\"\n        : \"\";\n  throw Object.assign(\n    new Error(`--type must be Maintenance or Testing (got ${JSON.stringify(raw)})${hint}`),\n    { exitCode: 2 },\n  );\n}\n\n/** Dashboard origin for digest /s/<slug> links. DASHBOARD_BASE_URL overrides the\n *  production default; the trailing slash (if any) is trimmed by runDigest. */\nfunction dashboardBaseUrl(): string {\n  return process.env.DASHBOARD_BASE_URL?.trim() || \"https://reddoor-maintenance.netlify.app\";\n}\n\nexport async function runReportCommand(\n  slug: string | undefined,\n  opts: ReportCommandOptions,\n): Promise<{ output: string; code: number }> {\n  if (opts.digest) {\n    const { runDigest } = await import(\"../../reports/digest.js\");\n    return runDigest({ baseUrl: dashboardBaseUrl() });\n  }\n\n  if (opts.sendReady) {\n    const { sendApprovedReports } = await import(\"../../reports/send/orchestrate.js\");\n    return sendApprovedReports();\n  }\n\n  if (opts.due) {\n    return runDueDraft();\n  }\n\n  if (slug) {\n    // Validate the type BEFORE any Airtable access so a bad --type fails fast (and\n    // without needing credentials).\n    const reportType = parseSingleSiteReportType(opts.type);\n    return runSingleSiteDraft(slug, { previewOnly: Boolean(opts.preview), reportType });\n  }\n\n  throw Object.assign(\n    new Error(\n      \"Usage: reddoor-maint report [<slug>] [--type <Maintenance|Testing>] [--due] [--preview] [--send-ready] [--digest]\",\n    ),\n    {\n      exitCode: 2,\n    },\n  );\n}\n\nasync function runDueDraft(): Promise<{ output: string; code: number }> {\n  const base = openBase(readAirtableConfig());\n  const result = await draftDueReports(base, new Date());\n  await alertOnFleetAnalyticsFailure(result.health);\n  return { output: result.output, code: result.code };\n}\n\n/** Best-effort: when a draft run's GA/Search soft-failures look FLEET-WIDE (the shared\n *  GA_SUBJECT lost access — see assessAnalyticsAlert), email the operator one alert.\n *  NEVER throws — a Resend or config hiccup must not fail the nightly draft cron; the\n *  per-site `⚠ GA skipped` warnings + the run-output line still carry the signal. The\n *  daily idempotency key dedupes multiple runs in one day (Resend dedupes 24h). */\nasync function alertOnFleetAnalyticsFailure(health: AnalyticsRunHealth): Promise<void> {\n  if (!assessAnalyticsAlert(health).fire) return;\n  try {\n    const to = process.env.OPERATOR_EMAIL?.trim() || \"info@reddoorla.com\";\n    const { subject, html } = composeAnalyticsAlertEmail(health, dashboardBaseUrl());\n    const { defaultResendClient } = await import(\"../../reports/send/resend.js\");\n    await defaultResendClient().send({\n      from: \"Reddoor Reports <reports@reddoorla.com>\",\n      to: [to],\n      subject,\n      html,\n      idempotencyKey: `analytics-alert-${new Date().toISOString().slice(0, 10)}`,\n    });\n    console.warn(`⚠ ${subject} — operator alerted (${to})`);\n  } catch (e) {\n    console.warn(`⚠ analytics-failure alert send failed: ${(e as Error).message}`);\n  }\n}\n\n/**\n * Write each site's code-computed next-maintenance / next-testing date back to Airtable\n * (date-only, or null when there's no schedule), so the \"next\" dates shown there derive\n * from the SAME `nextDueDate` the scheduler uses — replacing the old Airtable formula +\n * automation. Best-effort and per-site isolated: a missing `Next … at` column or one bad\n * row warns and is skipped, never aborting the nightly draft run.\n */\nasync function writeNextDueDates(\n  base: AirtableBase,\n  websites: WebsiteRow[],\n  reports: ReportRow[],\n  today: Date,\n): Promise<void> {\n  const ymd = (d: Date | null): string | null => (d ? d.toISOString().slice(0, 10) : null);\n  for (const site of websites) {\n    try {\n      await updateNextDueDates(base, site.id, {\n        maintenanceAt: ymd(nextDueDate(site, reports, \"Maintenance\", today)),\n        testingAt: ymd(nextDueDate(site, reports, \"Testing\", today)),\n      });\n    } catch (e) {\n      console.warn(`⚠ next-due write skipped for ${site.name}: ${(e as Error).message}`);\n    }\n  }\n}\n\nexport async function draftDueReports(\n  base: AirtableBase,\n  today: Date,\n): Promise<{ output: string; code: number; health: AnalyticsRunHealth }> {\n  const websites = await listWebsites(base);\n  // ONE unfiltered fetch for the whole fleet. Per-site queries can't be pushed to\n  // Airtable anyway (linked-record fields aren't formula-filterable by record id),\n  // and findDueReports + the period guard below match on siteId in memory.\n  const reports = await listAllReports(base);\n\n  // Refresh every site's code-owned next-due dates first, so they stay current even on\n  // a run where nothing is due (the early return below).\n  await writeNextDueDates(base, websites, reports, today);\n\n  const due = findDueReports(websites, reports, today);\n\n  // GA/Search enrichment is configured globally (the impersonation subject) AND\n  // per-site (a GA4 property or a search query). `gaConfigured` is the global half;\n  // the per-site half is checked as each draft runs, to build the fleet-wide\n  // analytics-failure alert's denominator (see alertOnFleetAnalyticsFailure).\n  const gaConfigured = readGaConfig() !== null;\n  // Truthy (not `!== null`) to mirror fetchGaUsers/fetchSearch's own gate exactly\n  // (`!siteRow.ga4PropertyId`), so an empty-string cell counts as not-configured in\n  // BOTH places and can't inflate the alert denominator.\n  const isAnalyticsConfigured = (s: WebsiteRow): boolean =>\n    gaConfigured && Boolean(s.ga4PropertyId || s.searchQuery);\n\n  if (due.length === 0) {\n    return {\n      output: \"No reports due.\",\n      code: 0,\n      health: { softFailedSites: 0, configuredSites: 0 },\n    };\n  }\n\n  const lines: string[] = [];\n  let softFailedSites = 0;\n  let searchDefaultMisses = 0;\n  let searchPropertiesMissing = 0;\n  let gaConfiguredSites = 0;\n  let skipped = 0;\n  for (const item of due) {\n    // Idempotency: a re-run must not re-draft a (site, type) already drafted this\n    // recurrence. The dueDate's YYYY-MM is the stable per-cycle key. Match against the\n    // reports we already fetched — no extra query on the hot path.\n    const period = reportPeriodKey(item.dueDate);\n    const existing = reports.find(\n      (r) => r.siteId === item.site.id && r.reportType === item.reportType && r.period === period,\n    );\n\n    // A row already exists for THIS period. Two cases:\n    //   - Draft ready → truly done, skip (the idempotent re-run path).\n    //   - NOT ready → a crash between createDraft and setDraftReady wedged it: the\n    //     row exists (so we never re-draft) yet it's never sendable (listSendable\n    //     needs Draft ready). COMPLETE it in place instead of skipping forever —\n    //     re-render → re-upload the HTML → flip Draft ready on the EXISTING row.\n    if (existing) {\n      if (existing.draftReady) {\n        skipped++;\n        lines.push(`• skipped (already drafted ${period}): ${item.site.name} ${item.reportType}`);\n        continue;\n      }\n      // A not-ready row is normally a crash between createDraft and setDraftReady — re-complete\n      // it in place. BUT queueDraft also clears Draft ready on rows it supersedes/blocks, and\n      // those must NOT be re-completed: doing so would re-render and APPEND a duplicate HTML\n      // attachment every nightly run, only to be re-blocked. Distinguish the two: if a\n      // higher-or-equal-tier report is still pending for this site, this row was intentionally\n      // un-queued (not crashed) — skip it until the blocker is sent/approved or the month rolls.\n      const blockedByPending = reports.some(\n        (r) =>\n          r.siteId === item.site.id &&\n          r.id !== existing.id &&\n          r.sentAt === null &&\n          r.draftReady &&\n          reportTier(r.reportType) >= reportTier(item.reportType),\n      );\n      if (blockedByPending) {\n        skipped++;\n        lines.push(\n          `• skipped (superseded — a higher-or-equal-tier report is pending): ${item.site.name} ${item.reportType}`,\n        );\n        continue;\n      }\n      try {\n        const result = await draftReportForSite(base, item.site, item.reportType, {\n          period,\n          completeRowId: existing.id,\n          existingRow: existing,\n        });\n        existing.draftReady = result.queued === true;\n        lines.push(\n          draftLine(\n            result.reportRow?.reportId ?? existing.reportId,\n            result.queued,\n            result.supersededIds,\n            \"completed half-made draft\",\n          ),\n        );\n        if (isAnalyticsConfigured(item.site)) gaConfiguredSites++;\n        if (result.softFailures.length > 0) softFailedSites++;\n        if (result.searchDefaultMissed) searchDefaultMisses++;\n        if (result.searchPropertyMissing) searchPropertiesMissing++;\n      } catch (e) {\n        lines.push(`✗ failed: ${item.site.name} ${item.reportType} — ${(e as Error).message}`);\n      }\n      continue;\n    }\n\n    // Pile-up guard: don't accrue a fresh new-period draft every recurrence for a\n    // site nobody ever approves. The period key follows the DUE month, so each\n    // recurrence wants a new (later-period) draft — but if a PRIOR draft is still\n    // pending approval, a new one just stacks. Skip creating the new one while an\n    // earlier-period draft for this (site, type) sits ready-but-unsent.\n    //\n    // `r.draftReady` is load-bearing: a draft a higher tier SUPERSEDED has\n    // draftReady=false and never gets a Sent at, so without this clause it would\n    // match (sentAt null + earlier period) and block EVERY future draft for the\n    // site forever. Pending-approval means draftReady=true AND sentAt=null.\n    const pendingEarlier = reports.find(\n      (r) =>\n        r.siteId === item.site.id &&\n        r.reportType === item.reportType &&\n        r.draftReady &&\n        r.sentAt === null &&\n        r.period !== null &&\n        r.period < period,\n    );\n    if (pendingEarlier) {\n      skipped++;\n      lines.push(\n        `• skipped: ${item.site.name} ${item.reportType} already has an unsent ${pendingEarlier.period} draft pending approval`,\n      );\n      continue;\n    }\n\n    try {\n      // Pass the SAME key the guard searches by, so the stamped Period always\n      // matches a future run's reportPeriodKey(dueDate) — even if this run lags\n      // into a later month than the dueDate.\n      const result = await draftReportForSite(base, item.site, item.reportType, { period });\n      lines.push(draftLine(result.reportRow?.reportId, result.queued, result.supersededIds));\n      // Keep the in-memory snapshot current so the guard's `.some()` check on the\n      // NEXT iteration of this same run catches a row we JUST created — rather than\n      // relying on findDueReports never emitting two items for the same (site, type).\n      if (result.reportRow) reports.push(result.reportRow);\n      // Count sites (not individual GA/Search failures) so a fleet-wide enrichment\n      // outage is one obvious line at the bottom, not 200 buried console.warns.\n      if (isAnalyticsConfigured(item.site)) gaConfiguredSites++;\n      if (result.softFailures.length > 0) softFailedSites++;\n      if (result.searchDefaultMissed) searchDefaultMisses++;\n      if (result.searchPropertyMissing) searchPropertiesMissing++;\n    } catch (e) {\n      lines.push(`✗ failed: ${item.site.name} ${item.reportType} — ${(e as Error).message}`);\n    }\n  }\n  if (skipped > 0) {\n    lines.push(`• ${skipped} already drafted or pending this period`);\n  }\n  if (softFailedSites > 0) {\n    lines.push(\n      `⚠ ${softFailedSites} site${softFailedSites === 1 ? \"\" : \"s\"} had GA/Search enrichment fail — drafted with blank analytics; check the logs above`,\n    );\n  }\n  if (searchDefaultMisses > 0) {\n    lines.push(\n      `⚑ ${searchDefaultMisses} site${searchDefaultMisses === 1 ? \"\" : \"s\"} returned no Search Console data for their name — set an explicit \"Search query\" in Airtable to track brand presence.`,\n    );\n  }\n  if (searchPropertiesMissing > 0) {\n    lines.push(\n      `⚑ ${searchPropertiesMissing} site${searchPropertiesMissing === 1 ? \"\" : \"s\"} matched NO Search Console property — verify the domain property exists and the service account has access (a \"Search query\" change cannot fix this).`,\n    );\n  }\n  return {\n    output: lines.join(\"\\n\"),\n    code: lines.some((l) => l.startsWith(\"✗\")) ? 1 : 0,\n    health: { softFailedSites, configuredSites: gaConfiguredSites },\n  };\n}\n\nasync function runSingleSiteDraft(\n  slug: string,\n  opts: { previewOnly: boolean; reportType: ReportType },\n): Promise<{ output: string; code: number }> {\n  const base = openBase(readAirtableConfig());\n  const websites = await listWebsites(base);\n  const site = websites.find((w) => siteSlug(w.name) === slug);\n  if (!site) {\n    throw Object.assign(new Error(`No Websites row matched slug \"${slug}\"`), { exitCode: 2 });\n  }\n  const result = await draftReportForSite(opts.previewOnly ? null : base, site, opts.reportType, {\n    previewOnly: opts.previewOnly,\n  });\n  if (opts.previewOnly) {\n    return { output: `Preview written to ${result.htmlPath}`, code: 0 };\n  }\n  return {\n    output: draftLine(\n      result.reportRow?.reportId,\n      result.queued,\n      result.supersededIds,\n      \"Draft created\",\n    ),\n    code: 0,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmBA,IAAM,mBAAmB;AAUlB,SAAS,qBAAqB,GAAuC;AAC1E,QAAM,EAAE,iBAAiB,gBAAgB,IAAI;AAC7C,QAAM,OACJ,mBAAmB,KACnB,mBAAmB,oBACnB,kBAAkB,KAAK;AACzB,QAAM,SAAS,OACX,GAAG,eAAe,OAAO,eAAe,oPACxC;AACJ,SAAO,EAAE,MAAM,OAAO;AACxB;AAOO,SAAS,2BACd,GACA,cACmC;AACnC,QAAM,UAAU,oDAA0C,EAAE,eAAe,IAAI,EAAE,eAAe;AAChG,QAAM,EAAE,OAAO,IAAI,qBAAqB,CAAC;AACzC,QAAM,OAAO,cAAc,WAAW,MAAM,CAAC;AAAA;AAAA;AAAA,cAGjC,WAAW,YAAY,CAAC;AACpC,SAAO,EAAE,SAAS,KAAK;AACzB;;;ACvBA,SAAS,UACP,UACA,QACA,eACA,OAAO,WACC;AACR,QAAM,KAAK,YAAY;AACvB,MAAI,WAAW,OAAO;AACpB,WAAO,UAAK,IAAI,oBAAoB,EAAE;AAAA,EACxC;AACA,QAAM,MACJ,cAAc,SAAS,IACnB,gBAAgB,cAAc,MAAM,oBAAoB,cAAc,SAAS,IAAI,MAAM,EAAE,MAC3F;AACN,SAAO,UAAK,IAAI,KAAK,EAAE,GAAG,GAAG;AAC/B;AASO,SAAS,0BAA0B,KAAqC;AAC7E,MAAI,QAAQ,UAAa,IAAI,KAAK,MAAM,GAAI,QAAO;AACnD,QAAM,OAAO,IAAI,KAAK,EAAE,YAAY;AACpC,MAAI,SAAS,cAAe,QAAO;AACnC,MAAI,SAAS,UAAW,QAAO;AAC/B,QAAM,OACJ,SAAS,WACL,4CACA,SAAS,iBACP,8CACA;AACR,QAAM,OAAO;AAAA,IACX,IAAI,MAAM,8CAA8C,KAAK,UAAU,GAAG,CAAC,IAAI,IAAI,EAAE;AAAA,IACrF,EAAE,UAAU,EAAE;AAAA,EAChB;AACF;AAIA,SAAS,mBAA2B;AAClC,SAAO,QAAQ,IAAI,oBAAoB,KAAK,KAAK;AACnD;AAEA,eAAsB,iBACpB,MACA,MAC2C;AAC3C,MAAI,KAAK,QAAQ;AACf,UAAM,EAAE,UAAU,IAAI,MAAM,OAAO,sBAAyB;AAC5D,WAAO,UAAU,EAAE,SAAS,iBAAiB,EAAE,CAAC;AAAA,EAClD;AAEA,MAAI,KAAK,WAAW;AAClB,UAAM,EAAE,oBAAoB,IAAI,MAAM,OAAO,2BAAmC;AAChF,WAAO,oBAAoB;AAAA,EAC7B;AAEA,MAAI,KAAK,KAAK;AACZ,WAAO,YAAY;AAAA,EACrB;AAEA,MAAI,MAAM;AAGR,UAAM,aAAa,0BAA0B,KAAK,IAAI;AACtD,WAAO,mBAAmB,MAAM,EAAE,aAAa,QAAQ,KAAK,OAAO,GAAG,WAAW,CAAC;AAAA,EACpF;AAEA,QAAM,OAAO;AAAA,IACX,IAAI;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,UAAU;AAAA,IACZ;AAAA,EACF;AACF;AAEA,eAAe,cAAyD;AACtE,QAAM,OAAO,SAAS,mBAAmB,CAAC;AAC1C,QAAM,SAAS,MAAM,gBAAgB,MAAM,oBAAI,KAAK,CAAC;AACrD,QAAM,6BAA6B,OAAO,MAAM;AAChD,SAAO,EAAE,QAAQ,OAAO,QAAQ,MAAM,OAAO,KAAK;AACpD;AAOA,eAAe,6BAA6B,QAA2C;AACrF,MAAI,CAAC,qBAAqB,MAAM,EAAE,KAAM;AACxC,MAAI;AACF,UAAM,KAAK,QAAQ,IAAI,gBAAgB,KAAK,KAAK;AACjD,UAAM,EAAE,SAAS,KAAK,IAAI,2BAA2B,QAAQ,iBAAiB,CAAC;AAC/E,UAAM,EAAE,oBAAoB,IAAI,MAAM,OAAO,sBAA8B;AAC3E,UAAM,oBAAoB,EAAE,KAAK;AAAA,MAC/B,MAAM;AAAA,MACN,IAAI,CAAC,EAAE;AAAA,MACP;AAAA,MACA;AAAA,MACA,gBAAgB,oBAAmB,oBAAI,KAAK,GAAE,YAAY,EAAE,MAAM,GAAG,EAAE,CAAC;AAAA,IAC1E,CAAC;AACD,YAAQ,KAAK,UAAK,OAAO,6BAAwB,EAAE,GAAG;AAAA,EACxD,SAAS,GAAG;AACV,YAAQ,KAAK,+CAA2C,EAAY,OAAO,EAAE;AAAA,EAC/E;AACF;AASA,eAAe,kBACb,MACA,UACA,SACA,OACe;AACf,QAAM,MAAM,CAAC,MAAmC,IAAI,EAAE,YAAY,EAAE,MAAM,GAAG,EAAE,IAAI;AACnF,aAAW,QAAQ,UAAU;AAC3B,QAAI;AACF,YAAM,mBAAmB,MAAM,KAAK,IAAI;AAAA,QACtC,eAAe,IAAI,YAAY,MAAM,SAAS,eAAe,KAAK,CAAC;AAAA,QACnE,WAAW,IAAI,YAAY,MAAM,SAAS,WAAW,KAAK,CAAC;AAAA,MAC7D,CAAC;AAAA,IACH,SAAS,GAAG;AACV,cAAQ,KAAK,qCAAgC,KAAK,IAAI,KAAM,EAAY,OAAO,EAAE;AAAA,IACnF;AAAA,EACF;AACF;AAEA,eAAsB,gBACpB,MACA,OACuE;AACvE,QAAM,WAAW,MAAM,aAAa,IAAI;AAIxC,QAAM,UAAU,MAAM,eAAe,IAAI;AAIzC,QAAM,kBAAkB,MAAM,UAAU,SAAS,KAAK;AAEtD,QAAM,MAAM,eAAe,UAAU,SAAS,KAAK;AAMnD,QAAM,eAAe,aAAa,MAAM;AAIxC,QAAM,wBAAwB,CAAC,MAC7B,gBAAgB,QAAQ,EAAE,iBAAiB,EAAE,WAAW;AAE1D,MAAI,IAAI,WAAW,GAAG;AACpB,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ,EAAE,iBAAiB,GAAG,iBAAiB,EAAE;AAAA,IACnD;AAAA,EACF;AAEA,QAAM,QAAkB,CAAC;AACzB,MAAI,kBAAkB;AACtB,MAAI,sBAAsB;AAC1B,MAAI,0BAA0B;AAC9B,MAAI,oBAAoB;AACxB,MAAI,UAAU;AACd,aAAW,QAAQ,KAAK;AAItB,UAAM,SAAS,gBAAgB,KAAK,OAAO;AAC3C,UAAM,WAAW,QAAQ;AAAA,MACvB,CAAC,MAAM,EAAE,WAAW,KAAK,KAAK,MAAM,EAAE,eAAe,KAAK,cAAc,EAAE,WAAW;AAAA,IACvF;AAQA,QAAI,UAAU;AACZ,UAAI,SAAS,YAAY;AACvB;AACA,cAAM,KAAK,mCAA8B,MAAM,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,UAAU,EAAE;AACxF;AAAA,MACF;AAOA,YAAM,mBAAmB,QAAQ;AAAA,QAC/B,CAAC,MACC,EAAE,WAAW,KAAK,KAAK,MACvB,EAAE,OAAO,SAAS,MAClB,EAAE,WAAW,QACb,EAAE,cACF,WAAW,EAAE,UAAU,KAAK,WAAW,KAAK,UAAU;AAAA,MAC1D;AACA,UAAI,kBAAkB;AACpB;AACA,cAAM;AAAA,UACJ,gFAAsE,KAAK,KAAK,IAAI,IAAI,KAAK,UAAU;AAAA,QACzG;AACA;AAAA,MACF;AACA,UAAI;AACF,cAAM,SAAS,MAAM,mBAAmB,MAAM,KAAK,MAAM,KAAK,YAAY;AAAA,UACxE;AAAA,UACA,eAAe,SAAS;AAAA,UACxB,aAAa;AAAA,QACf,CAAC;AACD,iBAAS,aAAa,OAAO,WAAW;AACxC,cAAM;AAAA,UACJ;AAAA,YACE,OAAO,WAAW,YAAY,SAAS;AAAA,YACvC,OAAO;AAAA,YACP,OAAO;AAAA,YACP;AAAA,UACF;AAAA,QACF;AACA,YAAI,sBAAsB,KAAK,IAAI,EAAG;AACtC,YAAI,OAAO,aAAa,SAAS,EAAG;AACpC,YAAI,OAAO,oBAAqB;AAChC,YAAI,OAAO,sBAAuB;AAAA,MACpC,SAAS,GAAG;AACV,cAAM,KAAK,kBAAa,KAAK,KAAK,IAAI,IAAI,KAAK,UAAU,WAAO,EAAY,OAAO,EAAE;AAAA,MACvF;AACA;AAAA,IACF;AAYA,UAAM,iBAAiB,QAAQ;AAAA,MAC7B,CAAC,MACC,EAAE,WAAW,KAAK,KAAK,MACvB,EAAE,eAAe,KAAK,cACtB,EAAE,cACF,EAAE,WAAW,QACb,EAAE,WAAW,QACb,EAAE,SAAS;AAAA,IACf;AACA,QAAI,gBAAgB;AAClB;AACA,YAAM;AAAA,QACJ,mBAAc,KAAK,KAAK,IAAI,IAAI,KAAK,UAAU,0BAA0B,eAAe,MAAM;AAAA,MAChG;AACA;AAAA,IACF;AAEA,QAAI;AAIF,YAAM,SAAS,MAAM,mBAAmB,MAAM,KAAK,MAAM,KAAK,YAAY,EAAE,OAAO,CAAC;AACpF,YAAM,KAAK,UAAU,OAAO,WAAW,UAAU,OAAO,QAAQ,OAAO,aAAa,CAAC;AAIrF,UAAI,OAAO,UAAW,SAAQ,KAAK,OAAO,SAAS;AAGnD,UAAI,sBAAsB,KAAK,IAAI,EAAG;AACtC,UAAI,OAAO,aAAa,SAAS,EAAG;AACpC,UAAI,OAAO,oBAAqB;AAChC,UAAI,OAAO,sBAAuB;AAAA,IACpC,SAAS,GAAG;AACV,YAAM,KAAK,kBAAa,KAAK,KAAK,IAAI,IAAI,KAAK,UAAU,WAAO,EAAY,OAAO,EAAE;AAAA,IACvF;AAAA,EACF;AACA,MAAI,UAAU,GAAG;AACf,UAAM,KAAK,UAAK,OAAO,yCAAyC;AAAA,EAClE;AACA,MAAI,kBAAkB,GAAG;AACvB,UAAM;AAAA,MACJ,UAAK,eAAe,QAAQ,oBAAoB,IAAI,KAAK,GAAG;AAAA,IAC9D;AAAA,EACF;AACA,MAAI,sBAAsB,GAAG;AAC3B,UAAM;AAAA,MACJ,UAAK,mBAAmB,QAAQ,wBAAwB,IAAI,KAAK,GAAG;AAAA,IACtE;AAAA,EACF;AACA,MAAI,0BAA0B,GAAG;AAC/B,UAAM;AAAA,MACJ,UAAK,uBAAuB,QAAQ,4BAA4B,IAAI,KAAK,GAAG;AAAA,IAC9E;AAAA,EACF;AACA,SAAO;AAAA,IACL,QAAQ,MAAM,KAAK,IAAI;AAAA,IACvB,MAAM,MAAM,KAAK,CAAC,MAAM,EAAE,WAAW,QAAG,CAAC,IAAI,IAAI;AAAA,IACjD,QAAQ,EAAE,iBAAiB,iBAAiB,kBAAkB;AAAA,EAChE;AACF;AAEA,eAAe,mBACb,MACA,MAC2C;AAC3C,QAAM,OAAO,SAAS,mBAAmB,CAAC;AAC1C,QAAM,WAAW,MAAM,aAAa,IAAI;AACxC,QAAM,OAAO,SAAS,KAAK,CAAC,MAAM,SAAS,EAAE,IAAI,MAAM,IAAI;AAC3D,MAAI,CAAC,MAAM;AACT,UAAM,OAAO,OAAO,IAAI,MAAM,iCAAiC,IAAI,GAAG,GAAG,EAAE,UAAU,EAAE,CAAC;AAAA,EAC1F;AACA,QAAM,SAAS,MAAM,mBAAmB,KAAK,cAAc,OAAO,MAAM,MAAM,KAAK,YAAY;AAAA,IAC7F,aAAa,KAAK;AAAA,EACpB,CAAC;AACD,MAAI,KAAK,aAAa;AACpB,WAAO,EAAE,QAAQ,sBAAsB,OAAO,QAAQ,IAAI,MAAM,EAAE;AAAA,EACpE;AACA,SAAO;AAAA,IACL,QAAQ;AAAA,MACN,OAAO,WAAW;AAAA,MAClB,OAAO;AAAA,MACP,OAAO;AAAA,MACP;AAAA,IACF;AAAA,IACA,MAAM;AAAA,EACR;AACF;","names":[]}

package/dist/{self-updating-ALMUWJNX.js → self-updating-WJEHPASK.js}

@@ -1,6 +1,6 @@
 import {
   selfUpdating
-} from "./chunk-QMXQUL5Z.js";
+} from "./chunk-7ADQL5Y3.js";
 import "./chunk-MNDIED4M.js";
 import {
   runRecipeOverSites
@@ -15,7 +15,7 @@ import {
 } from "./chunk-4BHNP6Y2.js";
 import "./chunk-73UFRZKY.js";
 import "./chunk-GASBX52O.js";
-import "./chunk-VSHC4HOI.js";
+import "./chunk-YAMRVXOD.js";
 import "./chunk-FDIFTIXC.js";
 import "./chunk-HVOOCK6L.js";
 import "./chunk-XXTZBPUY.js";
@@ -62,4 +62,4 @@ async function runSelfUpdatingCommand(site, opts) {
 export {
   runSelfUpdatingCommand
 };
-//# sourceMappingURL=self-updating-ALMUWJNX.js.map
+//# sourceMappingURL=self-updating-WJEHPASK.js.map

package/dist/{selftest-PJFABZDM.js → selftest-ZJDB4JQB.js}

@@ -1,9 +1,9 @@
 import {
   buildReportDataForSite,
   scoresFromRow
-} from "./chunk-QWFHC3VH.js";
-import "./chunk-6SZBNALD.js";
-import "./chunk-SEQA7MC3.js";
+} from "./chunk-AKRUYPLU.js";
+import "./chunk-6M2IXJ3E.js";
+import "./chunk-62VF32IC.js";
 import "./chunk-37S6L6G4.js";
 import {
   ELIGIBLE_STATUSES
@@ -13,12 +13,13 @@ import {
   parseAddresses,
   prepareHeaderImage,
   renderReportEmail
-} from "./chunk-FVVGDIGX.js";
+} from "./chunk-42A4H6SF.js";
 import "./chunk-GECESMVS.js";
-import "./chunk-MNE374CZ.js";
+import "./chunk-6QRLRT3P.js";
 import {
   fetchAttachmentBytes
 } from "./chunk-MPBXOJ3N.js";
+import "./chunk-SEEA6RXF.js";
 import {
   defaultResendClient
 } from "./chunk-WEKL2HYJ.js";
@@ -161,4 +162,4 @@ async function runSelftestCommand(kind, site, opts) {
 export {
   runSelftestCommand
 };
-//# sourceMappingURL=selftest-PJFABZDM.js.map
+//# sourceMappingURL=selftest-ZJDB4JQB.js.map