@reddoorla/maintenance 0.79.0 → 0.80.0

package/dist/{selftest-PJFABZDM.js.map → selftest-ZJDB4JQB.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/recipes/selftest-email.ts","../src/cli/commands/selftest.ts"],"sourcesContent":["import { mkdir, writeFile } from \"node:fs/promises\";\nimport { dirname } from \"node:path\";\nimport { openBase, readAirtableConfig } from \"../reports/airtable/client.js\";\nimport type { AirtableBase } from \"../reports/airtable/client.js\";\nimport { listWebsites, siteSlug } from \"../reports/airtable/websites.js\";\nimport { ELIGIBLE_STATUSES } from \"../reports/due.js\";\nimport type { WebsiteRow } from \"../reports/airtable/websites.js\";\nimport { fetchAttachmentBytes } from \"../reports/airtable/attachments.js\";\nimport { prepareHeaderImage } from \"../reports/maintenance-email/header-image.js\";\nimport { buildReportDataForSite, scoresFromRow } from \"../reports/report-data.js\";\nimport { renderReportEmail } from \"../reports/send/render-email.js\";\nimport { defaultResendClient, type ResendClient } from \"../reports/send/resend.js\";\nimport { parseAddresses, isProbablyEmail } from \"../reports/send/orchestrate.js\";\nimport type { ReportType } from \"../reports/types.js\";\n\nconst FROM_ADDRESS = \"Reddoor Reports <reports@reddoorla.com>\";\nconst REPLY_TO = \"info@reddoorla.com\";\n\nexport type SelftestEmailDeps = {\n  /** Airtable handle (read-only here). Defaults to the live base from credentials. */\n  base?: AirtableBase;\n  /** Resend client. Defaults to the real client. */\n  resend?: ResendClient;\n  /** Single-site slug. Mutually exclusive with `all`. */\n  site?: string;\n  /** All `maintenance` sites (one email each). Mutually exclusive with `site`. */\n  all?: boolean;\n  /** Report type to preview. Default \"Announcement\". */\n  type?: ReportType;\n  /** Raw `--to` (comma- or newline-separated). Default: OPERATOR_EMAIL → info@reddoorla.com. */\n  to?: string;\n  /** Render only; write reports/<slug>/selftest-<type>.html, never send. */\n  dryRun?: boolean;\n  /** Single timestamp driving the window + completedOn. */\n  now?: Date;\n};\n\nexport type SelftestEmailSiteResult =\n  | { site: string; status: \"sent\" | \"dry-run\"; subject: string; recipients: string[] }\n  | { site: string; status: \"skipped\"; reason: string }\n  | { site: string; status: \"error\"; message: string };\n\nexport type SelftestEmailResult = { results: SelftestEmailSiteResult[] };\n\n/** Resolve the recipient list: explicit `--to` (validated) else the operator default. */\nfunction resolveRecipients(to: string | undefined): string[] {\n  const operator = process.env.OPERATOR_EMAIL?.trim() || \"info@reddoorla.com\";\n  const parsed = to ? parseAddresses(to) : null;\n  const list = parsed ?? [operator];\n  for (const addr of list) {\n    if (!isProbablyEmail(addr)) {\n      throw Object.assign(new Error(`--to has a malformed address: ${addr}`), { exitCode: 2 });\n    }\n  }\n  return list;\n}\n\n/**\n * Send (or dry-render) a single report email per target site to the operator/`--to`, with NO\n * Airtable side effects (no draft, queue, or stamp). Mirrors the production render+send via the\n * shared `renderReportEmail` seam, so the preview matches a real send. One bad site never aborts\n * `--all` (per-site try/catch). Sites missing stored scores or a header image are skipped.\n */\nexport async function selftestEmail(deps: SelftestEmailDeps): Promise<SelftestEmailResult> {\n  const base = deps.base ?? openBase(readAirtableConfig());\n  const resend = deps.resend ?? defaultResendClient();\n  const type: ReportType = deps.type ?? \"Announcement\";\n  const now = deps.now ?? new Date();\n  const recipients = resolveRecipients(deps.to);\n\n  const websites = await listWebsites(base);\n  let targets: WebsiteRow[];\n  if (deps.all) {\n    // The report-eligible set (maintenance + hosting), not a hard-coded \"maintenance\" —\n    // the latter silently excluded hosting sites and implied a type↔status coupling that\n    // doesn't exist (the requested --type drives the rendered template; single-site mode\n    // applies no status filter at all).\n    targets = websites.filter((w) => w.status !== null && ELIGIBLE_STATUSES.has(w.status));\n  } else if (deps.site) {\n    const wanted = siteSlug(deps.site);\n    targets = websites.filter((w) => siteSlug(w.name) === wanted);\n  } else {\n    throw Object.assign(new Error(\"Provide a site slug or --all\"), { exitCode: 2 });\n  }\n\n  const results: SelftestEmailSiteResult[] = [];\n  for (const w of targets) {\n    try {\n      const scores = scoresFromRow(w);\n      if (!scores) {\n        results.push({ site: w.name, status: \"skipped\", reason: \"missing Lighthouse scores\" });\n        continue;\n      }\n      if (!w.headerImage) {\n        results.push({ site: w.name, status: \"skipped\", reason: \"no Header image\" });\n        continue;\n      }\n      const original = await fetchAttachmentBytes(w.headerImage.url);\n      const header = await prepareHeaderImage(original.bytes);\n      const slug = siteSlug(w.name);\n      const reportData = await buildReportDataForSite(w, type, now, { scores, header });\n      const { html, attachments, subject } = await renderReportEmail(reportData, {\n        header,\n        cidName: `${slug}-header`,\n      });\n\n      if (deps.dryRun) {\n        const path = `reports/${slug}/selftest-${type.toLowerCase()}.html`;\n        await mkdir(dirname(path), { recursive: true });\n        await writeFile(path, html, \"utf-8\");\n        results.push({ site: w.name, status: \"dry-run\", subject, recipients });\n        continue;\n      }\n\n      await resend.send({\n        from: FROM_ADDRESS,\n        to: recipients,\n        replyTo: REPLY_TO,\n        subject,\n        html,\n        attachments,\n      });\n      results.push({ site: w.name, status: \"sent\", subject, recipients });\n    } catch (err) {\n      results.push({\n        site: w.name,\n        status: \"error\",\n        message: err instanceof Error ? err.message : String(err),\n      });\n    }\n  }\n\n  return { results };\n}\n","import { selftestEmail, type SelftestEmailSiteResult } from \"../../recipes/selftest-email.js\";\nimport type { ReportType } from \"../../reports/types.js\";\n\nexport type SelftestCommandOptions = {\n  type?: string;\n  to?: string;\n  all?: boolean;\n  dryRun?: boolean;\n  cwd?: string;\n};\n\nconst TYPES: Record<string, ReportType> = {\n  announcement: \"Announcement\",\n  maintenance: \"Maintenance\",\n  testing: \"Testing\",\n  launch: \"Launch\",\n};\n\nfunction formatResult(r: SelftestEmailSiteResult): string {\n  if (r.status === \"skipped\") return `[${r.site}] skipped — ${r.reason}`;\n  if (r.status === \"error\") return `[${r.site}] error: ${r.message}`;\n  return `[${r.site}] ${r.status} — \"${r.subject}\" → ${r.recipients.join(\", \")}`;\n}\n\n/**\n * `selftest <kind> [site]` — operator self-tests. The only kind today is `email`: preview a\n * report email for one site (or `--all` maintenance sites) to the operator/`--to`, with no\n * Airtable side effects. Validates kind/type and the site-xor-all rule before doing any work.\n */\nexport async function runSelftestCommand(\n  kind: string,\n  site: string | undefined,\n  opts: SelftestCommandOptions,\n): Promise<{ output: string; code: number }> {\n  if (kind !== \"email\") {\n    return { output: `Unknown selftest kind '${kind}'. Supported: email`, code: 2 };\n  }\n  if (Boolean(site) === Boolean(opts.all)) {\n    return { output: \"Provide exactly one of <site> or --all.\", code: 2 };\n  }\n  const typeKey = (opts.type ?? \"announcement\").toLowerCase();\n  const type = TYPES[typeKey];\n  if (!type) {\n    return {\n      output: `Unknown --type '${opts.type}'. Supported: ${Object.keys(TYPES).join(\", \")}`,\n      code: 2,\n    };\n  }\n\n  try {\n    const { results } = await selftestEmail({\n      ...(site ? { site } : {}),\n      ...(opts.all ? { all: true } : {}),\n      type,\n      ...(opts.to ? { to: opts.to } : {}),\n      ...(opts.dryRun ? { dryRun: true } : {}),\n    });\n    const output =\n      results.length === 0 ? \"No matching sites.\" : results.map(formatResult).join(\"\\n\");\n    const code = results.some((r) => r.status === \"error\") ? 1 : 0;\n    return { output, code };\n  } catch (err) {\n    const e = err as { message?: string; exitCode?: number };\n    return { output: e.message ?? String(err), code: e.exitCode ?? 1 };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,OAAO,iBAAiB;AACjC,SAAS,eAAe;AAcxB,IAAM,eAAe;AACrB,IAAM,WAAW;AA6BjB,SAAS,kBAAkB,IAAkC;AAC3D,QAAM,WAAW,QAAQ,IAAI,gBAAgB,KAAK,KAAK;AACvD,QAAM,SAAS,KAAK,eAAe,EAAE,IAAI;AACzC,QAAM,OAAO,UAAU,CAAC,QAAQ;AAChC,aAAW,QAAQ,MAAM;AACvB,QAAI,CAAC,gBAAgB,IAAI,GAAG;AAC1B,YAAM,OAAO,OAAO,IAAI,MAAM,iCAAiC,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;AAAA,IACzF;AAAA,EACF;AACA,SAAO;AACT;AAQA,eAAsB,cAAc,MAAuD;AACzF,QAAM,OAAO,KAAK,QAAQ,SAAS,mBAAmB,CAAC;AACvD,QAAM,SAAS,KAAK,UAAU,oBAAoB;AAClD,QAAM,OAAmB,KAAK,QAAQ;AACtC,QAAM,MAAM,KAAK,OAAO,oBAAI,KAAK;AACjC,QAAM,aAAa,kBAAkB,KAAK,EAAE;AAE5C,QAAM,WAAW,MAAM,aAAa,IAAI;AACxC,MAAI;AACJ,MAAI,KAAK,KAAK;AAKZ,cAAU,SAAS,OAAO,CAAC,MAAM,EAAE,WAAW,QAAQ,kBAAkB,IAAI,EAAE,MAAM,CAAC;AAAA,EACvF,WAAW,KAAK,MAAM;AACpB,UAAM,SAAS,SAAS,KAAK,IAAI;AACjC,cAAU,SAAS,OAAO,CAAC,MAAM,SAAS,EAAE,IAAI,MAAM,MAAM;AAAA,EAC9D,OAAO;AACL,UAAM,OAAO,OAAO,IAAI,MAAM,8BAA8B,GAAG,EAAE,UAAU,EAAE,CAAC;AAAA,EAChF;AAEA,QAAM,UAAqC,CAAC;AAC5C,aAAW,KAAK,SAAS;AACvB,QAAI;AACF,YAAM,SAAS,cAAc,CAAC;AAC9B,UAAI,CAAC,QAAQ;AACX,gBAAQ,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,WAAW,QAAQ,4BAA4B,CAAC;AACrF;AAAA,MACF;AACA,UAAI,CAAC,EAAE,aAAa;AAClB,gBAAQ,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,WAAW,QAAQ,kBAAkB,CAAC;AAC3E;AAAA,MACF;AACA,YAAM,WAAW,MAAM,qBAAqB,EAAE,YAAY,GAAG;AAC7D,YAAM,SAAS,MAAM,mBAAmB,SAAS,KAAK;AACtD,YAAM,OAAO,SAAS,EAAE,IAAI;AAC5B,YAAM,aAAa,MAAM,uBAAuB,GAAG,MAAM,KAAK,EAAE,QAAQ,OAAO,CAAC;AAChF,YAAM,EAAE,MAAM,aAAa,QAAQ,IAAI,MAAM,kBAAkB,YAAY;AAAA,QACzE;AAAA,QACA,SAAS,GAAG,IAAI;AAAA,MAClB,CAAC;AAED,UAAI,KAAK,QAAQ;AACf,cAAM,OAAO,WAAW,IAAI,aAAa,KAAK,YAAY,CAAC;AAC3D,cAAM,MAAM,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AAC9C,cAAM,UAAU,MAAM,MAAM,OAAO;AACnC,gBAAQ,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,WAAW,SAAS,WAAW,CAAC;AACrE;AAAA,MACF;AAEA,YAAM,OAAO,KAAK;AAAA,QAChB,MAAM;AAAA,QACN,IAAI;AAAA,QACJ,SAAS;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD,cAAQ,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,QAAQ,SAAS,WAAW,CAAC;AAAA,IACpE,SAAS,KAAK;AACZ,cAAQ,KAAK;AAAA,QACX,MAAM,EAAE;AAAA,QACR,QAAQ;AAAA,QACR,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MAC1D,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO,EAAE,QAAQ;AACnB;;;AC1HA,IAAM,QAAoC;AAAA,EACxC,cAAc;AAAA,EACd,aAAa;AAAA,EACb,SAAS;AAAA,EACT,QAAQ;AACV;AAEA,SAAS,aAAa,GAAoC;AACxD,MAAI,EAAE,WAAW,UAAW,QAAO,IAAI,EAAE,IAAI,oBAAe,EAAE,MAAM;AACpE,MAAI,EAAE,WAAW,QAAS,QAAO,IAAI,EAAE,IAAI,YAAY,EAAE,OAAO;AAChE,SAAO,IAAI,EAAE,IAAI,KAAK,EAAE,MAAM,YAAO,EAAE,OAAO,YAAO,EAAE,WAAW,KAAK,IAAI,CAAC;AAC9E;AAOA,eAAsB,mBACpB,MACA,MACA,MAC2C;AAC3C,MAAI,SAAS,SAAS;AACpB,WAAO,EAAE,QAAQ,0BAA0B,IAAI,uBAAuB,MAAM,EAAE;AAAA,EAChF;AACA,MAAI,QAAQ,IAAI,MAAM,QAAQ,KAAK,GAAG,GAAG;AACvC,WAAO,EAAE,QAAQ,2CAA2C,MAAM,EAAE;AAAA,EACtE;AACA,QAAM,WAAW,KAAK,QAAQ,gBAAgB,YAAY;AAC1D,QAAM,OAAO,MAAM,OAAO;AAC1B,MAAI,CAAC,MAAM;AACT,WAAO;AAAA,MACL,QAAQ,mBAAmB,KAAK,IAAI,iBAAiB,OAAO,KAAK,KAAK,EAAE,KAAK,IAAI,CAAC;AAAA,MAClF,MAAM;AAAA,IACR;AAAA,EACF;AAEA,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,MAAM,cAAc;AAAA,MACtC,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,MACvB,GAAI,KAAK,MAAM,EAAE,KAAK,KAAK,IAAI,CAAC;AAAA,MAChC;AAAA,MACA,GAAI,KAAK,KAAK,EAAE,IAAI,KAAK,GAAG,IAAI,CAAC;AAAA,MACjC,GAAI,KAAK,SAAS,EAAE,QAAQ,KAAK,IAAI,CAAC;AAAA,IACxC,CAAC;AACD,UAAM,SACJ,QAAQ,WAAW,IAAI,uBAAuB,QAAQ,IAAI,YAAY,EAAE,KAAK,IAAI;AACnF,UAAM,OAAO,QAAQ,KAAK,CAAC,MAAM,EAAE,WAAW,OAAO,IAAI,IAAI;AAC7D,WAAO,EAAE,QAAQ,KAAK;AAAA,EACxB,SAAS,KAAK;AACZ,UAAM,IAAI;AACV,WAAO,EAAE,QAAQ,EAAE,WAAW,OAAO,GAAG,GAAG,MAAM,EAAE,YAAY,EAAE;AAAA,EACnE;AACF;","names":[]}
+{"version":3,"sources":["../src/recipes/selftest-email.ts","../src/cli/commands/selftest.ts"],"sourcesContent":["import { mkdir, writeFile } from \"node:fs/promises\";\nimport { dirname } from \"node:path\";\nimport { openBase, readAirtableConfig } from \"../reports/airtable/client.js\";\nimport type { AirtableBase } from \"../reports/airtable/client.js\";\nimport { listWebsites, siteSlug } from \"../reports/airtable/websites.js\";\nimport { ELIGIBLE_STATUSES } from \"../reports/due.js\";\nimport type { WebsiteRow } from \"../reports/airtable/websites.js\";\nimport { fetchAttachmentBytes } from \"../reports/airtable/attachments.js\";\nimport { prepareHeaderImage } from \"../reports/maintenance-email/header-image.js\";\nimport { buildReportDataForSite, scoresFromRow } from \"../reports/report-data.js\";\nimport { renderReportEmail } from \"../reports/send/render-email.js\";\nimport { defaultResendClient, type ResendClient } from \"../reports/send/resend.js\";\nimport { parseAddresses, isProbablyEmail } from \"../reports/send/orchestrate.js\";\nimport type { ReportType } from \"../reports/types.js\";\n\nconst FROM_ADDRESS = \"Reddoor Reports <reports@reddoorla.com>\";\nconst REPLY_TO = \"info@reddoorla.com\";\n\nexport type SelftestEmailDeps = {\n  /** Airtable handle (read-only here). Defaults to the live base from credentials. */\n  base?: AirtableBase;\n  /** Resend client. Defaults to the real client. */\n  resend?: ResendClient;\n  /** Single-site slug. Mutually exclusive with `all`. */\n  site?: string;\n  /** All `maintenance` sites (one email each). Mutually exclusive with `site`. */\n  all?: boolean;\n  /** Report type to preview. Default \"Announcement\". */\n  type?: ReportType;\n  /** Raw `--to` (comma- or newline-separated). Default: OPERATOR_EMAIL → info@reddoorla.com. */\n  to?: string;\n  /** Render only; write reports/<slug>/selftest-<type>.html, never send. */\n  dryRun?: boolean;\n  /** Single timestamp driving the window + completedOn. */\n  now?: Date;\n};\n\nexport type SelftestEmailSiteResult =\n  | { site: string; status: \"sent\" | \"dry-run\"; subject: string; recipients: string[] }\n  | { site: string; status: \"skipped\"; reason: string }\n  | { site: string; status: \"error\"; message: string };\n\nexport type SelftestEmailResult = { results: SelftestEmailSiteResult[] };\n\n/** Resolve the recipient list: explicit `--to` (validated) else the operator default. */\nfunction resolveRecipients(to: string | undefined): string[] {\n  const operator = process.env.OPERATOR_EMAIL?.trim() || \"info@reddoorla.com\";\n  const parsed = to ? parseAddresses(to) : null;\n  const list = parsed ?? [operator];\n  for (const addr of list) {\n    if (!isProbablyEmail(addr)) {\n      throw Object.assign(new Error(`--to has a malformed address: ${addr}`), { exitCode: 2 });\n    }\n  }\n  return list;\n}\n\n/**\n * Send (or dry-render) a single report email per target site to the operator/`--to`, with NO\n * Airtable side effects (no draft, queue, or stamp). Mirrors the production render+send via the\n * shared `renderReportEmail` seam, so the preview matches a real send. One bad site never aborts\n * `--all` (per-site try/catch). Sites missing stored scores or a header image are skipped.\n */\nexport async function selftestEmail(deps: SelftestEmailDeps): Promise<SelftestEmailResult> {\n  const base = deps.base ?? openBase(readAirtableConfig());\n  const resend = deps.resend ?? defaultResendClient();\n  const type: ReportType = deps.type ?? \"Announcement\";\n  const now = deps.now ?? new Date();\n  const recipients = resolveRecipients(deps.to);\n\n  const websites = await listWebsites(base);\n  let targets: WebsiteRow[];\n  if (deps.all) {\n    // The report-eligible set (maintenance + hosting), not a hard-coded \"maintenance\" —\n    // the latter silently excluded hosting sites and implied a type↔status coupling that\n    // doesn't exist (the requested --type drives the rendered template; single-site mode\n    // applies no status filter at all).\n    targets = websites.filter((w) => w.status !== null && ELIGIBLE_STATUSES.has(w.status));\n  } else if (deps.site) {\n    const wanted = siteSlug(deps.site);\n    targets = websites.filter((w) => siteSlug(w.name) === wanted);\n  } else {\n    throw Object.assign(new Error(\"Provide a site slug or --all\"), { exitCode: 2 });\n  }\n\n  const results: SelftestEmailSiteResult[] = [];\n  for (const w of targets) {\n    try {\n      const scores = scoresFromRow(w);\n      if (!scores) {\n        results.push({ site: w.name, status: \"skipped\", reason: \"missing Lighthouse scores\" });\n        continue;\n      }\n      if (!w.headerImage) {\n        results.push({ site: w.name, status: \"skipped\", reason: \"no Header image\" });\n        continue;\n      }\n      const original = await fetchAttachmentBytes(w.headerImage.url);\n      const header = await prepareHeaderImage(original.bytes);\n      const slug = siteSlug(w.name);\n      const reportData = await buildReportDataForSite(w, type, now, { scores, header });\n      const { html, attachments, subject } = await renderReportEmail(reportData, {\n        header,\n        cidName: `${slug}-header`,\n      });\n\n      if (deps.dryRun) {\n        const path = `reports/${slug}/selftest-${type.toLowerCase()}.html`;\n        await mkdir(dirname(path), { recursive: true });\n        await writeFile(path, html, \"utf-8\");\n        results.push({ site: w.name, status: \"dry-run\", subject, recipients });\n        continue;\n      }\n\n      await resend.send({\n        from: FROM_ADDRESS,\n        to: recipients,\n        replyTo: REPLY_TO,\n        subject,\n        html,\n        attachments,\n      });\n      results.push({ site: w.name, status: \"sent\", subject, recipients });\n    } catch (err) {\n      results.push({\n        site: w.name,\n        status: \"error\",\n        message: err instanceof Error ? err.message : String(err),\n      });\n    }\n  }\n\n  return { results };\n}\n","import { selftestEmail, type SelftestEmailSiteResult } from \"../../recipes/selftest-email.js\";\nimport type { ReportType } from \"../../reports/types.js\";\n\nexport type SelftestCommandOptions = {\n  type?: string;\n  to?: string;\n  all?: boolean;\n  dryRun?: boolean;\n  cwd?: string;\n};\n\nconst TYPES: Record<string, ReportType> = {\n  announcement: \"Announcement\",\n  maintenance: \"Maintenance\",\n  testing: \"Testing\",\n  launch: \"Launch\",\n};\n\nfunction formatResult(r: SelftestEmailSiteResult): string {\n  if (r.status === \"skipped\") return `[${r.site}] skipped — ${r.reason}`;\n  if (r.status === \"error\") return `[${r.site}] error: ${r.message}`;\n  return `[${r.site}] ${r.status} — \"${r.subject}\" → ${r.recipients.join(\", \")}`;\n}\n\n/**\n * `selftest <kind> [site]` — operator self-tests. The only kind today is `email`: preview a\n * report email for one site (or `--all` maintenance sites) to the operator/`--to`, with no\n * Airtable side effects. Validates kind/type and the site-xor-all rule before doing any work.\n */\nexport async function runSelftestCommand(\n  kind: string,\n  site: string | undefined,\n  opts: SelftestCommandOptions,\n): Promise<{ output: string; code: number }> {\n  if (kind !== \"email\") {\n    return { output: `Unknown selftest kind '${kind}'. Supported: email`, code: 2 };\n  }\n  if (Boolean(site) === Boolean(opts.all)) {\n    return { output: \"Provide exactly one of <site> or --all.\", code: 2 };\n  }\n  const typeKey = (opts.type ?? \"announcement\").toLowerCase();\n  const type = TYPES[typeKey];\n  if (!type) {\n    return {\n      output: `Unknown --type '${opts.type}'. Supported: ${Object.keys(TYPES).join(\", \")}`,\n      code: 2,\n    };\n  }\n\n  try {\n    const { results } = await selftestEmail({\n      ...(site ? { site } : {}),\n      ...(opts.all ? { all: true } : {}),\n      type,\n      ...(opts.to ? { to: opts.to } : {}),\n      ...(opts.dryRun ? { dryRun: true } : {}),\n    });\n    const output =\n      results.length === 0 ? \"No matching sites.\" : results.map(formatResult).join(\"\\n\");\n    const code = results.some((r) => r.status === \"error\") ? 1 : 0;\n    return { output, code };\n  } catch (err) {\n    const e = err as { message?: string; exitCode?: number };\n    return { output: e.message ?? String(err), code: e.exitCode ?? 1 };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,OAAO,iBAAiB;AACjC,SAAS,eAAe;AAcxB,IAAM,eAAe;AACrB,IAAM,WAAW;AA6BjB,SAAS,kBAAkB,IAAkC;AAC3D,QAAM,WAAW,QAAQ,IAAI,gBAAgB,KAAK,KAAK;AACvD,QAAM,SAAS,KAAK,eAAe,EAAE,IAAI;AACzC,QAAM,OAAO,UAAU,CAAC,QAAQ;AAChC,aAAW,QAAQ,MAAM;AACvB,QAAI,CAAC,gBAAgB,IAAI,GAAG;AAC1B,YAAM,OAAO,OAAO,IAAI,MAAM,iCAAiC,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;AAAA,IACzF;AAAA,EACF;AACA,SAAO;AACT;AAQA,eAAsB,cAAc,MAAuD;AACzF,QAAM,OAAO,KAAK,QAAQ,SAAS,mBAAmB,CAAC;AACvD,QAAM,SAAS,KAAK,UAAU,oBAAoB;AAClD,QAAM,OAAmB,KAAK,QAAQ;AACtC,QAAM,MAAM,KAAK,OAAO,oBAAI,KAAK;AACjC,QAAM,aAAa,kBAAkB,KAAK,EAAE;AAE5C,QAAM,WAAW,MAAM,aAAa,IAAI;AACxC,MAAI;AACJ,MAAI,KAAK,KAAK;AAKZ,cAAU,SAAS,OAAO,CAAC,MAAM,EAAE,WAAW,QAAQ,kBAAkB,IAAI,EAAE,MAAM,CAAC;AAAA,EACvF,WAAW,KAAK,MAAM;AACpB,UAAM,SAAS,SAAS,KAAK,IAAI;AACjC,cAAU,SAAS,OAAO,CAAC,MAAM,SAAS,EAAE,IAAI,MAAM,MAAM;AAAA,EAC9D,OAAO;AACL,UAAM,OAAO,OAAO,IAAI,MAAM,8BAA8B,GAAG,EAAE,UAAU,EAAE,CAAC;AAAA,EAChF;AAEA,QAAM,UAAqC,CAAC;AAC5C,aAAW,KAAK,SAAS;AACvB,QAAI;AACF,YAAM,SAAS,cAAc,CAAC;AAC9B,UAAI,CAAC,QAAQ;AACX,gBAAQ,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,WAAW,QAAQ,4BAA4B,CAAC;AACrF;AAAA,MACF;AACA,UAAI,CAAC,EAAE,aAAa;AAClB,gBAAQ,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,WAAW,QAAQ,kBAAkB,CAAC;AAC3E;AAAA,MACF;AACA,YAAM,WAAW,MAAM,qBAAqB,EAAE,YAAY,GAAG;AAC7D,YAAM,SAAS,MAAM,mBAAmB,SAAS,KAAK;AACtD,YAAM,OAAO,SAAS,EAAE,IAAI;AAC5B,YAAM,aAAa,MAAM,uBAAuB,GAAG,MAAM,KAAK,EAAE,QAAQ,OAAO,CAAC;AAChF,YAAM,EAAE,MAAM,aAAa,QAAQ,IAAI,MAAM,kBAAkB,YAAY;AAAA,QACzE;AAAA,QACA,SAAS,GAAG,IAAI;AAAA,MAClB,CAAC;AAED,UAAI,KAAK,QAAQ;AACf,cAAM,OAAO,WAAW,IAAI,aAAa,KAAK,YAAY,CAAC;AAC3D,cAAM,MAAM,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AAC9C,cAAM,UAAU,MAAM,MAAM,OAAO;AACnC,gBAAQ,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,WAAW,SAAS,WAAW,CAAC;AACrE;AAAA,MACF;AAEA,YAAM,OAAO,KAAK;AAAA,QAChB,MAAM;AAAA,QACN,IAAI;AAAA,QACJ,SAAS;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD,cAAQ,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,QAAQ,SAAS,WAAW,CAAC;AAAA,IACpE,SAAS,KAAK;AACZ,cAAQ,KAAK;AAAA,QACX,MAAM,EAAE;AAAA,QACR,QAAQ;AAAA,QACR,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MAC1D,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO,EAAE,QAAQ;AACnB;;;AC1HA,IAAM,QAAoC;AAAA,EACxC,cAAc;AAAA,EACd,aAAa;AAAA,EACb,SAAS;AAAA,EACT,QAAQ;AACV;AAEA,SAAS,aAAa,GAAoC;AACxD,MAAI,EAAE,WAAW,UAAW,QAAO,IAAI,EAAE,IAAI,oBAAe,EAAE,MAAM;AACpE,MAAI,EAAE,WAAW,QAAS,QAAO,IAAI,EAAE,IAAI,YAAY,EAAE,OAAO;AAChE,SAAO,IAAI,EAAE,IAAI,KAAK,EAAE,MAAM,YAAO,EAAE,OAAO,YAAO,EAAE,WAAW,KAAK,IAAI,CAAC;AAC9E;AAOA,eAAsB,mBACpB,MACA,MACA,MAC2C;AAC3C,MAAI,SAAS,SAAS;AACpB,WAAO,EAAE,QAAQ,0BAA0B,IAAI,uBAAuB,MAAM,EAAE;AAAA,EAChF;AACA,MAAI,QAAQ,IAAI,MAAM,QAAQ,KAAK,GAAG,GAAG;AACvC,WAAO,EAAE,QAAQ,2CAA2C,MAAM,EAAE;AAAA,EACtE;AACA,QAAM,WAAW,KAAK,QAAQ,gBAAgB,YAAY;AAC1D,QAAM,OAAO,MAAM,OAAO;AAC1B,MAAI,CAAC,MAAM;AACT,WAAO;AAAA,MACL,QAAQ,mBAAmB,KAAK,IAAI,iBAAiB,OAAO,KAAK,KAAK,EAAE,KAAK,IAAI,CAAC;AAAA,MAClF,MAAM;AAAA,IACR;AAAA,EACF;AAEA,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,MAAM,cAAc;AAAA,MACtC,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,MACvB,GAAI,KAAK,MAAM,EAAE,KAAK,KAAK,IAAI,CAAC;AAAA,MAChC;AAAA,MACA,GAAI,KAAK,KAAK,EAAE,IAAI,KAAK,GAAG,IAAI,CAAC;AAAA,MACjC,GAAI,KAAK,SAAS,EAAE,QAAQ,KAAK,IAAI,CAAC;AAAA,IACxC,CAAC;AACD,UAAM,SACJ,QAAQ,WAAW,IAAI,uBAAuB,QAAQ,IAAI,YAAY,EAAE,KAAK,IAAI;AACnF,UAAM,OAAO,QAAQ,KAAK,CAAC,MAAM,EAAE,WAAW,OAAO,IAAI,IAAI;AAC7D,WAAO,EAAE,QAAQ,KAAK;AAAA,EACxB,SAAS,KAAK;AACZ,UAAM,IAAI;AACV,WAAO,EAAE,QAAQ,EAAE,WAAW,OAAO,GAAG,GAAG,MAAM,EAAE,YAAY,EAAE;AAAA,EACnE;AACF;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reddoorla/maintenance",
-  "version": "0.79.0",
+  "version": "0.80.0",
   "description": "Canonical maintenance configs, audits, and recipes for the reddoor stack.",
   "type": "module",
   "license": "MIT",

package/dist/chunk-EYODPUHV.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/configs/lighthouse.ts"],"sourcesContent":["export const lighthouseConfig = {\n  ci: {\n    collect: {\n      url: [\"http://localhost:5173/dev/a11y-fixtures\"],\n      // `npm run vite:dev` works on both pnpm and npm sites — pnpm respects\n      // the `run` form too. Keeps this config portable across the fleet\n      // while sites transition to pnpm.\n      startServerCommand: \"npm run vite:dev\",\n      startServerReadyPattern: \"ready in\",\n      startServerReadyTimeout: 120_000,\n      numberOfRuns: 1,\n      settings: {\n        preset: \"desktop\",\n        skipAudits: [\"uses-http2\"],\n      },\n    },\n    assert: {\n      assertions: {\n        \"categories:accessibility\": [\"error\", { minScore: 0.95 }],\n        \"categories:best-practices\": [\"error\", { minScore: 0.9 }],\n        \"categories:seo\": [\"error\", { minScore: 0.9 }],\n        \"categories:performance\": [\"warn\", { minScore: 0.7 }],\n      },\n    },\n    upload: {\n      target: \"temporary-public-storage\",\n    },\n  },\n} as const;\n\nexport default lighthouseConfig;\n"],"mappings":";AAAO,IAAM,mBAAmB;AAAA,EAC9B,IAAI;AAAA,IACF,SAAS;AAAA,MACP,KAAK,CAAC,yCAAyC;AAAA;AAAA;AAAA;AAAA,MAI/C,oBAAoB;AAAA,MACpB,yBAAyB;AAAA,MACzB,yBAAyB;AAAA,MACzB,cAAc;AAAA,MACd,UAAU;AAAA,QACR,QAAQ;AAAA,QACR,YAAY,CAAC,YAAY;AAAA,MAC3B;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,YAAY;AAAA,QACV,4BAA4B,CAAC,SAAS,EAAE,UAAU,KAAK,CAAC;AAAA,QACxD,6BAA6B,CAAC,SAAS,EAAE,UAAU,IAAI,CAAC;AAAA,QACxD,kBAAkB,CAAC,SAAS,EAAE,UAAU,IAAI,CAAC;AAAA,QAC7C,0BAA0B,CAAC,QAAQ,EAAE,UAAU,IAAI,CAAC;AAAA,MACtD;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,QAAQ;AAAA,IACV;AAAA,EACF;AACF;AAEA,IAAO,qBAAQ;","names":[]}

package/dist/chunk-LJPCMXR7.js

@@ -1,44 +0,0 @@
-// src/configs/playwright-a11y.ts
-import { defineConfig, devices } from "@playwright/test";
-var a11yRoutes = [
-  { path: "/dev/a11y-fixtures", name: "a11y fixtures" },
-  { path: "/dev/animate-in", name: "animate-in demo" }
-];
-var smokeRoutes = [{ path: "/", name: "home" }];
-var smokePort = process.env.REDDOOR_SMOKE_PORT;
-var port = smokePort || "5173";
-var playwrightA11yConfig = defineConfig({
-  testDir: "tests",
-  testMatch: /.*\.spec\.ts$/,
-  fullyParallel: true,
-  forbidOnly: !!process.env.CI,
-  retries: process.env.CI ? 2 : 0,
-  reporter: process.env.CI ? "github" : "list",
-  use: {
-    baseURL: `http://localhost:${port}`,
-    trace: "on-first-retry"
-  },
-  projects: [
-    {
-      name: "chromium",
-      use: { ...devices["Desktop Chrome"] }
-    }
-  ],
-  webServer: {
-    // Portable across pnpm and npm sites — pnpm respects `npm run` too.
-    // `--strictPort` only when a port was explicitly allocated: fail loudly
-    // rather than let vite drift to a free port the baseURL doesn't point at.
-    command: smokePort ? `npm run vite:dev -- --port ${smokePort} --strictPort` : "npm run vite:dev",
-    url: `http://localhost:${port}/dev/a11y-fixtures`,
-    reuseExistingServer: !process.env.CI,
-    timeout: 12e4
-  }
-});
-var playwright_a11y_default = playwrightA11yConfig;
-
-export {
-  a11yRoutes,
-  smokeRoutes,
-  playwright_a11y_default
-};
-//# sourceMappingURL=chunk-LJPCMXR7.js.map

package/dist/chunk-MNE374CZ.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/reports/copy.ts","../src/reports/maintenance-email/assets/index.ts","../src/util/html.ts","../src/reports/email-sections.ts","../src/reports/maintenance-email/template.ts","../src/reports/announcement-email/template.ts","../src/reports/render.ts","../src/reports/launch-email/template.ts","../src/reports/checklist.ts","../src/reports/airtable/reports.ts"],"sourcesContent":["import type { WebsiteRow } from \"./airtable/websites.js\";\n\nexport type ResolvedCopy = {\n  maintenanceIntro: string;\n  maintenanceChecks: string[]; // 6; index 3 is the Google row's no-position default\n  testingIntro: string;\n  testingChecklist: string[]; // 7\n  notesHeader: string;\n  seoCta: string;\n  contact: string[]; // closing invitation lines\n  footerOrg: string;\n  footerAddress: string[];\n  launchHeading: string;\n  launchBody: string;\n  launchSetupItems: string[];\n  announceHeading: string;\n  announceBody: string;\n  announceImprovementResend: string;\n  announceImprovementSvelte5: string;\n  /** The cadence lead-in, ending at the em dash. Rendered followed by `announceCadenceNote`\n   *  in italics. */\n  announceCadence: string;\n  /** The reassurance tail, rendered italic after `announceCadence`. */\n  announceCadenceNote: string;\n  announceOpenDoor: string;\n};\n\nexport const DEFAULT_COPY: ResolvedCopy = {\n  maintenanceIntro:\n    \"Includes checking the hosting, DNS, Content Management System (CMS, if applicable), search indexing and security of the site for major flaws and updating as necessary.\",\n  maintenanceChecks: [\n    \"Deploy & Function Health\",\n    \"CMS Checked\",\n    \"Domain, DNS & SSL\",\n    \"Google Indexed\",\n    \"Security Updates\",\n    \"Uptime Checked\",\n  ],\n  testingIntro:\n    \"Testing includes checks similar to those at launch: testing on common browsers and operating systems, at different screen sizes, and checking every function, and updating all packages for performance rather than just those needed for security.\",\n  testingChecklist: [\n    \"Desktop Browsers\",\n    \"Mobile Browsers\",\n    \"Page Titles & Meta\",\n    \"Links & Navigation\",\n    \"Form Functionality\",\n    \"Interactions & Animations\",\n    \"Tested After Updates\",\n  ],\n  notesHeader: \"NOTES\",\n  seoCta: \"Contact us if you are interested in more in-depth data or have questions about SEO.\",\n  contact: [\"Just hit reply.\", \"We're here to help in any way we can.\"],\n  footerOrg: \"Reddoor Creative, LLC\",\n  footerAddress: [\"29027 Dapper Dan\", \"Fair Oaks Ranch, TX 78015\"],\n  launchHeading: \"LAUNCHED\",\n  launchBody:\n    \"Your site is live. We've set it up on the Reddoor stack with hosting, security, and automatic maintenance so it stays fast and healthy. Here's what's in place:\",\n  launchSetupItems: [\n    \"Hosting, DNS, and SSL configured\",\n    \"Continuous integration + automatic dependency updates\",\n    \"Analytics and uptime monitoring\",\n  ],\n  announceHeading: \"YOUR ONGOING SITE CARE\",\n  announceBody:\n    \"We've completed a full test of your site and set it up for ongoing care to keep it fast, secure, and healthy. Here's what you can expect from us going forward:\",\n  announceImprovementResend:\n    \"Your contact forms now deliver straight to your inbox through reliable infrastructure, so no inquiry slips through the cracks.\",\n  announceImprovementSvelte5:\n    \"We've modernized your site to the latest framework — it's faster, more secure, and built to last.\",\n  announceCadence: \"After each one we'll send you a short report like this —\",\n  announceCadenceNote: \"there's nothing you need to do.\",\n  announceOpenDoor:\n    \"And if you'd ever like to expand the scope, add features, or freshen anything up, just let us know.\",\n};\n\n/** Trim an override to null when blank (mirrors the trim-to-null handling). */\nfunction override(v: string | null): string | null {\n  if (typeof v !== \"string\") return null;\n  const t = v.trim();\n  return t.length > 0 ? t : null;\n}\n\n/**\n * Resolve a site's effective copy: DEFAULT_COPY with the three per-site narrative\n * overrides applied. Only maintenanceIntro/contact/footer are per-site (M6a §2);\n * everything else is the shared default. PURE.\n */\n/** Split an operator override into lines: tolerate CRLF, drop blank lines (a stray\n *  blank in the Airtable cell shouldn't render an empty address row). */\nfunction splitLines(s: string): string[] {\n  return s.split(/\\r?\\n/).filter((l) => l.trim().length > 0);\n}\n\nexport function resolveCopy(site: WebsiteRow): ResolvedCopy {\n  const intro = override(site.copyIntro);\n  const contact = override(site.copyContact);\n  const footer = override(site.copyFooter);\n  const footerLines = footer ? splitLines(footer) : null;\n  return {\n    ...DEFAULT_COPY,\n    maintenanceIntro: intro ?? DEFAULT_COPY.maintenanceIntro,\n    contact: contact ? splitLines(contact) : DEFAULT_COPY.contact,\n    footerOrg: footerLines?.[0] ?? DEFAULT_COPY.footerOrg,\n    footerAddress: footerLines ? footerLines.slice(1) : DEFAULT_COPY.footerAddress,\n  };\n}\n","import { readFile } from \"node:fs/promises\";\nimport { existsSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\n\nexport const CHECK_CID = \"rd-check-png\";\nexport const BLURRED_CID = \"rd-blurred-tests-jpg\";\n\nexport type BundledImage = {\n  bytes: Uint8Array;\n  contentType: string;\n  cid: string;\n  filename: string;\n};\n\n// Walk up from the current module's URL looking for the assets dir in either\n// the dev layout (src/reports/maintenance-email/assets/) or the published\n// layout (dist/reports/maintenance-email/assets/). REQUIRED because tsup\n// inlines this module into dist/cli/bin.js — so `import.meta.url`-based\n// sibling resolution looks in dist/cli/ for the PNGs and fails with ENOENT.\n// Regression that shipped in 0.10.0–0.10.1; tests passed in dev because\n// vitest evaluates the source file where import.meta.url is already correct.\nlet cachedAssetsDir: string | null = null;\nfunction resolveAssetsDir(): string {\n  if (cachedAssetsDir) return cachedAssetsDir;\n  let dir = dirname(fileURLToPath(import.meta.url));\n  while (true) {\n    // Source layout preferred — single source of truth in the workspace\n    // and the only one present in dev/test environments.\n    const srcCandidate = join(dir, \"src\", \"reports\", \"maintenance-email\", \"assets\", \"check.png\");\n    if (existsSync(srcCandidate)) {\n      cachedAssetsDir = dirname(srcCandidate);\n      return cachedAssetsDir;\n    }\n    // Published layout — only `dist/` ships per package.json#files, so\n    // consumers fall through to here.\n    const distCandidate = join(dir, \"dist\", \"reports\", \"maintenance-email\", \"assets\", \"check.png\");\n    if (existsSync(distCandidate)) {\n      cachedAssetsDir = dirname(distCandidate);\n      return cachedAssetsDir;\n    }\n    const parent = dirname(dir);\n    if (parent === dir) {\n      throw new Error(\n        `loadBundledImages: could not locate maintenance-email assets dir by walking up from ${fileURLToPath(import.meta.url)}. Checked both src/ and dist/ layouts.`,\n      );\n    }\n    dir = parent;\n  }\n}\n\n/**\n * Read the bundled image bytes from disk. Both Maintenance and Testing\n * variants reference `check.png`; only the Maintenance variant references\n * `blurredTests.jpg`.\n */\nexport async function loadBundledImages(): Promise<{\n  check: BundledImage;\n  blurred: BundledImage;\n}> {\n  const assetsDir = resolveAssetsDir();\n  const [check, blurred] = await Promise.all([\n    readFile(join(assetsDir, \"check.png\")),\n    readFile(join(assetsDir, \"blurredTests.jpg\")),\n  ]);\n  return {\n    check: {\n      bytes: new Uint8Array(check),\n      contentType: \"image/png\",\n      cid: CHECK_CID,\n      filename: \"check.png\",\n    },\n    blurred: {\n      bytes: new Uint8Array(blurred),\n      contentType: \"image/jpeg\",\n      cid: BLURRED_CID,\n      filename: \"blurredTests.jpg\",\n    },\n  };\n}\n","/**\n * Shared HTML/XML escape. One implementation behind the dashboard renderers\n * (`src/dashboard/render.ts`, `fleet-render.ts`), the daily digest\n * (`src/reports/digest.ts`), and the MJML email templates\n * (`src/reports/*-email/template.ts`).\n *\n * The set is the strict-XML set (`& < > \" '`), which is exactly what MJML's\n * `validationLevel: \"strict\"` parser needs and a superset of what plain HTML text\n * interpolation needs — so the SAME function serves both sinks. Site names\n * (e.g. \"Brown & Co\"), URLs, and operator commentary must not break the markup or\n * inject. The MJML templates re-export this as `escapeXml` for their callers.\n */\nexport function escapeHtml(s: string): string {\n  return s\n    .replace(/&/g, \"&amp;\")\n    .replace(/</g, \"&lt;\")\n    .replace(/>/g, \"&gt;\")\n    .replace(/\"/g, \"&quot;\")\n    .replace(/'/g, \"&#39;\");\n}\n\n/** Allow only http(s) URLs in an href context; everything else collapses to \"#\". */\nexport function safeUrl(raw: string): string {\n  try {\n    const u = new URL(raw);\n    if (u.protocol === \"http:\" || u.protocol === \"https:\") return raw;\n  } catch {\n    // fall through\n  }\n  return \"#\";\n}\n","import { escapeHtml } from \"../util/html.js\";\nimport { CHECK_CID } from \"./maintenance-email/assets/index.js\";\nimport type { ReportData } from \"./types.js\";\n\n/**\n * Shared MJML section builders for the report family of emails (maintenance/testing report,\n * announcement). Centralizing them here guarantees the announcement renders the SAME polished\n * components as the monthly report — the checklist rows, the full Lighthouse block, and the\n * analytics block — so the two can't drift in design. PURE string builders; no I/O.\n *\n * Escaping: callers pass already-trusted copy for fixed labels, but any site/operator string\n * (check labels, trailing notes) is escaped here via `escapeXml`.\n */\nexport const escapeXml = escapeHtml;\n\n// Brand palette shared across the report-email family (maintenance/testing,\n// launch, announcement) so a template can't drift onto hand-typed literals.\nexport const RED = \"#C00\";\nexport const GREY = \"#757575\";\nconst BORDER = \"#CCCCCC\";\nconst TREND_UP = \"#2E7D32\"; // positive green — growth reads as good\nconst TREND_NEUTRAL = GREY; // muted grey — dips/flat aren't failures (brand red is reserved)\n\n// The report's bundled green check (cid:rd-check-png), attached inline by orchestrate.ts at\n// send time. Standalone previews (no attachments) show the image's alt instead.\nconst CHECK_PNG = `cid:${CHECK_CID}`;\n\n/** Thousands-grouped user/visitor count. */\nexport function fmtUsers(n: number): string {\n  return n.toLocaleString(\"en-US\");\n}\n\n/**\n * A checklist \"table\": one ruled row per label, the label on the left and the green check\n * right-aligned, matching the monthly report. `background` tints the band (white for the\n * maintenance list, #F4F4F4 for the testing list); `lastPaddingBottom` is the trailing gap\n * under the final row. Labels are escaped. PURE.\n */\nexport function checklistRowsSection(\n  rows: string[],\n  opts: { background: string; lastPaddingBottom: string },\n): string {\n  return rows\n    .map((label, i) => {\n      const isLast = i === rows.length - 1;\n      const border = isLast ? \"\" : ` border-bottom=\"solid ${BORDER} 1px\"`;\n      const lastPad = isLast ? ` padding-bottom=\"${opts.lastPaddingBottom}\"` : \"\";\n      return `\n    <mj-section background-color=\"${opts.background}\" padding=\"0px\"${lastPad}>\n      <mj-group>\n        <mj-column padding-left=\"0px\" width=\"90%\"${border}>\n          <mj-text height=\"25px\" padding-left=\"0px\" color=\"${GREY}\" padding-top=\"20px\" padding-bottom=\"7.5px\" font-size=\"16px\">${escapeXml(label)}</mj-text>\n        </mj-column>\n        <mj-column width=\"10%\"${border} padding-top=\"15px\">\n          <mj-image align=\"right\" padding-right=\"0px\" width=\"20px\" height=\"20px\" padding-top=\"2.5px\" padding-bottom=\"15px\" src=\"${CHECK_PNG}\" />\n        </mj-column>\n      </mj-group>\n    </mj-section>`;\n    })\n    .join(\"\");\n}\n\n/** The four Lighthouse scores with their client-facing labels and acceptable/ideal bands.\n *  Ideal always tops at 100 (the metric's ceiling). */\nconst LIGHTHOUSE_ROWS: ReadonlyArray<{\n  label: string;\n  key: keyof ReportData[\"lighthouse\"];\n  range: string;\n}> = [\n  { label: \"Performance\", key: \"performance\", range: \"Acceptable 50–89 // Ideal 90–100\" },\n  { label: \"Readability (A11y)\", key: \"accessibility\", range: \"Acceptable 80–99 // Ideal 100\" },\n  { label: \"Best Practices\", key: \"bestPractices\", range: \"Acceptable 60–79 // Ideal 80–100\" },\n  { label: \"Site Structure\", key: \"seo\", range: \"Acceptable 50–89 // Ideal 90–100\" },\n];\n\n/**\n * The full \"LIGHTHOUSE SCORES*\" block: each score as a big red number under its label with the\n * acceptable/ideal band beneath, ruled between scores, closed by the explanatory footnote.\n * `background` tints the section (default #F4F4F4, matching the report). When `pad` is given the\n * band's top/bottom padding moves to the section (symmetric bands for the announcement); omitting\n * it keeps the report's original inner paddings. PURE.\n */\nexport function lighthouseScoresSection(\n  lighthouse: ReportData[\"lighthouse\"],\n  opts: { background?: string; pad?: string } = {},\n): string {\n  const background = opts.background ?? \"#F4F4F4\";\n  const sectionPad = opts.pad ? ` padding-top=\"${opts.pad}\" padding-bottom=\"${opts.pad}\"` : \"\";\n  const labelTop = opts.pad ?? \"55px\";\n  const footnoteBottom = opts.pad ? \"0px\" : \"36px\";\n  const rows = LIGHTHOUSE_ROWS.map(\n    ({ label, key, range }, i) => `\n        <mj-text color=\"${RED}\" font-size=\"20px\" font-weight=\"300\" padding-top=\"25px\">${label}</mj-text>\n        <mj-text color=\"${RED}\" font-size=\"44px\" font-weight=\"400\" padding-top=\"0px\">${lighthouse[key]}</mj-text>\n        <mj-text color=\"${GREY}\" font-family=\"helvetica, sans-serif\" font-size=\"12px\" font-weight=\"300\" padding-top=\"0px\" padding-bottom=\"36px\">${range}</mj-text>${\n          i < LIGHTHOUSE_ROWS.length - 1\n            ? `\n        <mj-divider border-width=\"1px\" border-style=\"solid\" border-color=\"${BORDER}\" padding=\"0\" />`\n            : \"\"\n        }`,\n  ).join(\"\");\n  return `\n    <mj-section background-color=\"${background}\"${sectionPad}>\n      <mj-column>\n        <mj-text color=\"${RED}\" font-size=\"20px\" font-weight=\"700\" padding-top=\"${labelTop}\">LIGHTHOUSE SCORES*</mj-text>${rows}\n        <mj-text color=\"${GREY}\" font-family=\"helvetica, sans-serif\" font-size=\"12px\" font-weight=\"300\" padding-top=\"24px\" padding-bottom=\"${footnoteBottom}\" line-height=\"20px\">*A Lighthouse score is a numerical measure provided by <a href=\"https://developer.chrome.com/docs/lighthouse/overview\" style=\"color:${RED}; text-decoration:underline;\">Google's Lighthouse tool</a>, which evaluates various aspects of a web page's quality.</mj-text>\n      </mj-column>\n    </mj-section>`;\n}\n\n/** The line under \"{N} Users\": a directional trend vs the previous period when both numbers\n *  are real, else a graceful fallback. `undefined` = GA unavailable (distinct from a real 0).\n *  Up = green; down/flat = muted grey (a traffic dip isn't a failure). PURE. */\nexport function analyticsTrendLine(\n  cur: number | undefined,\n  prev: number | undefined,\n  periodDays?: number,\n): string {\n  // The prior window the trend compares against: a concrete \"the previous N days\" when the\n  // caller knows the window length, else the generic \"last period\" (keeps the label honest for\n  // callers — and tests — that don't supply it).\n  const priorLabel =\n    periodDays && periodDays > 0 ? `the previous ${periodDays} days` : \"last period\";\n  if (cur === undefined || prev === undefined) {\n    return trendLine(TREND_NEUTRAL, `Last Period: ${prev !== undefined ? fmtUsers(prev) : \"—\"}`);\n  }\n  if (prev === 0) {\n    return cur > 0\n      ? trendLine(TREND_UP, \"▲ New this period (0 last period)\")\n      : trendLine(TREND_NEUTRAL, \"Last Period: 0\");\n  }\n  const pct = Math.round(((cur - prev) / prev) * 100);\n  const range = `(${fmtUsers(prev)} → ${fmtUsers(cur)})`;\n  if (pct > 0) return trendLine(TREND_UP, `▲ ${pct}% vs ${priorLabel} ${range}`);\n  if (pct < 0) return trendLine(TREND_NEUTRAL, `▼ ${Math.abs(pct)}% vs ${priorLabel} ${range}`);\n  return trendLine(TREND_NEUTRAL, `No change vs ${priorLabel} (${fmtUsers(prev)})`);\n}\n\n/** A 16px coloured line (the trend, and the announcement's search line). */\nfunction trendLine(color: string, text: string): string {\n  return `<mj-text color=\"${color}\" font-family=\"helvetica, sans-serif\" font-size=\"16px\" font-weight=\"300\" line-height=\"24px\">${text}</mj-text>`;\n}\n\n/** A 12px muted footnote line (the SEO call-to-action / Lighthouse note style). */\nfunction footnoteLine(text: string): string {\n  return `<mj-text color=\"${GREY}\" font-family=\"helvetica, sans-serif\" font-size=\"12px\" font-weight=\"300\" padding-top=\"24px\" padding-bottom=\"36px\" line-height=\"20px\">${text}</mj-text>`;\n}\n\n/** True when the analytics block has at least one real datum to show — a GA user count or a body\n *  line (e.g. the announcement's page-1 search callout). The static SEO call-to-action footnote\n *  alone does NOT qualify: a block with no data is hidden rather than rendered empty. PURE. */\nexport function hasAnalyticsData(opts: {\n  current?: number | undefined;\n  bodyLines?: string[];\n}): boolean {\n  return opts.current !== undefined || (opts.bodyLines?.length ?? 0) > 0;\n}\n\n/**\n * The \"ANALYTICS\" block: a big red user count, the trend line, then any 16px `bodyLines`\n * (e.g. the announcement's Google-position line) and 12px muted `footnoteLines` (e.g. the\n * report's SEO call-to-action). Callers pass already-escaped line text. PURE.\n *\n * Returns \"\" when there's no data ({@link hasAnalyticsData} false) — an empty \"— Users\" block\n * reads as broken, so the section (and its data-contextual SEO footnote) is omitted. When a body\n * line exists but no GA count (a GA-less site still ranking on page 1), the user count + trend\n * are suppressed and only the body shows under the label.\n */\nexport function analyticsSection(opts: {\n  current?: number | undefined;\n  previous?: number | undefined;\n  /** Length in days of the current window; drives the trend's \"vs the previous N days\" label. */\n  periodDays?: number | undefined;\n  background: string;\n  bodyLines?: string[];\n  footnoteLines?: string[];\n  pad?: string;\n}): string {\n  if (!hasAnalyticsData(opts)) return \"\";\n  const body = (opts.bodyLines ?? []).map((l) => trendLine(TREND_NEUTRAL, l)).join(\"\\n        \");\n  const footnotes = (opts.footnoteLines ?? []).map(footnoteLine).join(\"\\n        \");\n  const sectionPad = opts.pad ? ` padding-top=\"${opts.pad}\" padding-bottom=\"${opts.pad}\"` : \"\";\n  const labelTop = opts.pad ?? \"75px\";\n  const usersBlock =\n    opts.current !== undefined\n      ? `\n        <mj-text color=\"${RED}\" font-size=\"44px\" font-weight=\"400\">${fmtUsers(opts.current)} Users</mj-text>\n        ${analyticsTrendLine(opts.current, opts.previous, opts.periodDays)}`\n      : \"\";\n  return `\n    <mj-section background-color=\"${opts.background}\"${sectionPad}>\n      <mj-column>\n        <mj-text color=\"${RED}\" font-size=\"20px\" font-weight=\"700\" padding-top=\"${labelTop}\">ANALYTICS</mj-text>${usersBlock}\n        ${body}\n        ${footnotes}\n      </mj-column>\n    </mj-section>`;\n}\n","import type { ReportData } from \"../types.js\";\nimport { DEFAULT_COPY, type ResolvedCopy } from \"../copy.js\";\nimport { BLURRED_CID } from \"./assets/index.js\";\nimport {\n  checklistRowsSection,\n  lighthouseScoresSection,\n  analyticsSection,\n  RED,\n  GREY,\n} from \"../email-sections.js\";\nimport { escapeHtml } from \"../../util/html.js\";\nimport { isHttpUrl } from \"../../util/url.js\";\n\n/**\n * Escape operator/site-controlled strings before interpolating into the MJML markup.\n * MJML parses as XML with `validationLevel: \"strict\"`. Under mjml@4.18 a raw `&`, `<`,\n * or `>` does NOT throw — it passes straight through into the rendered output, so an\n * unescaped value (e.g. a site name \"Brown & Co\", a URL, or commentary) silently\n * injects HTML/markup into the email. A raw `\"` inside an ATTRIBUTE value (e.g. the\n * image `href`/`alt`) is the one that throws — it terminates the attribute and trips a\n * parse error that blocks the send. So we escape for two reasons: prevent\n * HTML/markup injection in text, and prevent the attribute-quote parse error. Apply\n * to every interpolation of siteName / siteUrl / commentary / copy.\n *\n * This IS `src/util/html.ts`'s `escapeHtml` (the strict-XML set is identical),\n * re-exported under the name the email templates import (the launch template imports\n * `escapeXml` from here).\n */\nexport const escapeXml = escapeHtml;\n\n// Bundled images: shipped in dist/ via tsup onSuccess copy, attached inline via\n// CID by orchestrate.ts at send time. No external CDN dependency. (The green check\n// image lives in the shared email-sections checklist component.)\nconst BLURRED_TESTS = `cid:${BLURRED_CID}`;\n\nexport function fmtDate(d: Date | null): string {\n  // Guard BOTH null AND an Invalid Date — `new Date(\"not-a-date\")` (a malformed\n  // Airtable date string) is a truthy Date whose getUTC* accessors all return\n  // NaN, which would render \"NaN.NaN.NaN\" into a real client email. `!d` alone\n  // misses it; `Number.isNaN(d.getTime())` catches it.\n  if (!d || Number.isNaN(d.getTime())) return \"\";\n  // Airtable date fields are wall-clock YYYY-MM-DD strings parsed as UTC midnight.\n  // Use UTC accessors so the rendered date matches what the operator entered.\n  // US format: MM.DD.YYYY (Reddoor is Texas-based, clients are US).\n  const mm = String(d.getUTCMonth() + 1).padStart(2, \"0\");\n  const dd = String(d.getUTCDate()).padStart(2, \"0\");\n  const yyyy = d.getUTCFullYear();\n  return `${mm}.${dd}.${yyyy}`;\n}\n\nfunction maintenanceChecksSection(copy: ResolvedCopy, searchPosition?: number): string {\n  // The Google row shows the live search position when available, else the plain label.\n  const googleLabel =\n    searchPosition !== undefined\n      ? `Page 1 Google Result (#${searchPosition})`\n      : (copy.maintenanceChecks[3] ?? \"\");\n  const rows = copy.maintenanceChecks.map((label, i) => (i === 3 ? googleLabel : label));\n  return checklistRowsSection(rows, { background: \"white\", lastPaddingBottom: \"36px\" });\n}\n\nfunction testingChecklistSection(copy: ResolvedCopy): string {\n  return checklistRowsSection(copy.testingChecklist, {\n    background: \"#F4F4F4\",\n    lastPaddingBottom: \"60px\",\n  });\n}\n\nfunction maintenanceTestingPlaceholder(): string {\n  return `\n    <mj-section background-color=\"#F4F4F4\">\n      <mj-column>\n        <mj-image href=\"mailto:info@reddoorla.com\" src=\"${BLURRED_TESTS}\" />\n      </mj-column>\n    </mj-section>`;\n}\n\nfunction testingIntroSection(copy: ResolvedCopy): string {\n  return `\n    <mj-section background-color=\"#F4F4F4\">\n      <mj-column>\n        <mj-text color=\"${RED}\" font-size=\"20px\" font-weight=\"700\" padding-top=\"75px\">TESTING</mj-text>\n        <mj-text color=\"${GREY}\" font-family=\"helvetica, sans-serif\" font-size=\"16px\" font-weight=\"300\" line-height=\"24px\">${escapeXml(copy.testingIntro)}</mj-text>\n      </mj-column>\n    </mj-section>`;\n}\n\nfunction commentarySection(text: string, copy: ResolvedCopy): string {\n  return `\n    <mj-section background-color=\"white\">\n      <mj-column>\n        <mj-text color=\"${RED}\" font-size=\"20px\" font-weight=\"700\" padding-top=\"55px\">${escapeXml(copy.notesHeader)}</mj-text>\n        <mj-text color=\"${GREY}\" font-family=\"helvetica, sans-serif\" font-size=\"16px\" font-weight=\"300\" line-height=\"24px\">${escapeXml(text).replace(/\\r\\n?|\\n/g, \"<br/>\")}</mj-text>\n      </mj-column>\n    </mj-section>`;\n}\n\nfunction hasHeaderDims(\n  data: ReportData,\n): data is ReportData & { headerWidth: number; headerHeight: number; headerBgColor: string } {\n  return Boolean(data.headerWidth && data.headerHeight && data.headerBgColor);\n}\n\nexport function headerImageTag(data: ReportData): string {\n  const src = `cid:${data.headerImageCid}`;\n  const alt = `${escapeXml(data.siteName)} maintenance report`;\n  // escapeXml only escapes markup chars — it does NOT neutralize a dangerous URL\n  // scheme. A `javascript:`/`data:` siteUrl would survive escaping and become a live\n  // header href. Gate on isHttpUrl (the same http(s) allowlist the audit path uses)\n  // and DROP a non-http(s) href entirely (fall back to \"#\") rather than linking it.\n  const href = isHttpUrl(data.siteUrl) ? escapeXml(data.siteUrl) : \"#\";\n  // Reserve the box and show a matched placeholder while the image loads / if blocked.\n  // Critically, we do NOT set an mj-image `height` — MJML would emit `height:<px>` while\n  // keeping `width:100%`, locking the height while the width scales and distorting the\n  // image at any rendered width != the design width (mobile, narrow panes). Instead the\n  // image stays `height:auto` (proportional) and the box is reserved via `aspect-ratio`\n  // in the head <mj-style> below (see headerStyleBlock). `container-background-color` is\n  // the placeholder; the bare fallback (no dims, e.g. local preview) keeps today's behavior.\n  if (hasHeaderDims(data)) {\n    return `<mj-image href=\"${href}\" src=\"${src}\" alt=\"${alt}\" width=\"${data.headerWidth}px\" css-class=\"rd-header\" container-background-color=\"${data.headerBgColor}\" />`;\n  }\n  return `<mj-image href=\"${href}\" src=\"${src}\" alt=\"${alt}\" />`;\n}\n\nexport function headerStyleBlock(data: ReportData): string {\n  if (!hasHeaderDims(data)) return \"\";\n  // Reserve the header's vertical space by aspect ratio so it scales proportionally with\n  // its fluid (width:100%) width — no fixed pixel height, so it never squishes.\n  // `height:auto !important` defends against any client honoring MJML's inline height.\n  return `<mj-style>.rd-header img { height: auto !important; aspect-ratio: ${data.headerWidth} / ${data.headerHeight}; }</mj-style>`;\n}\n\nexport function buildMjml(data: ReportData): string {\n  const copy = data.copy ?? DEFAULT_COPY;\n  const isTesting = data.reportType === \"Testing\";\n  const previewText = `Checked up on ${escapeXml(data.siteName)}`;\n\n  return `<mjml>\n  <mj-head>\n    <mj-attributes>\n      <mj-text font-family=\"helvetica, sans-serif\" padding-left=\"5px\" padding-right=\"5px\" />\n      <mj-section padding-left=\"11%\" padding-right=\"11%\"/>\n      <mj-image padding=\"0px\" />\n    </mj-attributes>\n    <mj-preview>${previewText}</mj-preview>\n    ${headerStyleBlock(data)}\n  </mj-head>\n  <mj-body background-color=\"white\">\n    <mj-section background-color=\"#F4F4F4\" padding-top=\"0px\" padding-bottom=\"0px\" padding-left=\"0px\" padding-right=\"0px\">\n      <mj-column>\n        ${headerImageTag(data)}\n      </mj-column>\n    </mj-section>\n    <mj-section background-color=\"white\">\n      <mj-column>\n        <mj-text color=\"${RED}\" font-size=\"20px\" font-weight=\"700\" padding-top=\"75px\">COMPLETED ON</mj-text>\n        <mj-text color=\"${RED}\" font-size=\"44px\" font-weight=\"400\">${fmtDate(data.completedOn)}</mj-text>\n        <mj-text color=\"${RED}\" font-size=\"20px\" font-weight=\"700\" padding-top=\"75px\">MAINTENANCE CHECKS</mj-text>\n        <mj-text color=\"${GREY}\" font-family=\"helvetica, sans-serif\" font-size=\"16px\" font-weight=\"300\" line-height=\"24px\">${escapeXml(copy.maintenanceIntro)}</mj-text>\n      </mj-column>\n    </mj-section>\n    ${maintenanceChecksSection(copy, data.searchPosition)}\n    ${lighthouseScoresSection(data.lighthouse)}\n    ${analyticsSection({\n      current: data.gaUsersCurrent,\n      previous: data.gaUsersPrevious,\n      periodDays: data.gaPeriodDays,\n      background: \"white\",\n      footnoteLines: [escapeXml(copy.seoCta)],\n    })}\n    ${isTesting ? testingIntroSection(copy) + testingChecklistSection(copy) : maintenanceTestingPlaceholder()}\n    ${data.commentary ? commentarySection(data.commentary, copy) : \"\"}\n    <mj-section background-color=\"white\">\n      <mj-column padding-top=\"36px\">\n        <mj-text color=\"${RED}\" font-family=\"helvetica, sans-serif\" font-size=\"24px\" font-weight=\"700\" padding-top=\"36px\" line-height=\"36px\">Any questions, concerns or requests?</mj-text>\n        ${copy.contact\n          .map((line, i) => {\n            // First line (\"Just hit reply.\") renders as a red bold heading, matching the\n            // \"Any questions, concerns or requests?\" title above it; later lines are grey\n            // (matching the launch/announcement templates); the last line keeps its\n            // closing padding.\n            const isLast = i === copy.contact.length - 1;\n            const emphasis =\n              i === 0\n                ? `color=\"${RED}\" font-family=\"helvetica, sans-serif\" font-size=\"24px\" font-weight=\"700\"`\n                : `color=\"${GREY}\" font-family=\"helvetica, sans-serif\" font-size=\"24px\" font-weight=\"300\"`;\n            return isLast\n              ? `<mj-text ${emphasis} padding-top=\"0px\" line-height=\"30px\" padding-bottom=\"36px\">${escapeXml(line)}</mj-text>`\n              : `<mj-text ${emphasis} line-height=\"30px\">${escapeXml(line)}</mj-text>`;\n          })\n          .join(\"\\n        \")}\n        <mj-divider border-width=\"1px\" border-style=\"solid\" border-color=\"#CCCCCC\" padding=\"0\" />\n        <mj-text color=\"${GREY}\" font-family=\"helvetica, sans-serif\" font-size=\"12px\" font-weight=\"300\" padding-top=\"24px\" line-height=\"20px\" font-style=\"italic\">Copyright ${new Date().getUTCFullYear()} ${escapeXml(copy.footerOrg)}. All rights reserved.</mj-text>\n        <mj-text color=\"${GREY}\" font-family=\"helvetica, sans-serif\" font-size=\"12px\" font-weight=\"700\" line-height=\"16px\" padding-top=\"0\" padding-bottom=\"0px\">Our mailing address is:</mj-text>\n        ${[copy.footerOrg, ...copy.footerAddress]\n          .map(\n            (line) =>\n              `<mj-text color=\"${GREY}\" font-family=\"helvetica, sans-serif\" font-size=\"12px\" font-weight=\"300\" line-height=\"16px\" padding-top=\"0\" padding-bottom=\"0px\">${escapeXml(line)}</mj-text>`,\n          )\n          .join(\"\\n        \")}\n      </mj-column>\n    </mj-section>\n  </mj-body>\n</mjml>`;\n}\n","import type { ReportData, ReportFrequency } from \"../types.js\";\nimport type { WebsiteRow } from \"../airtable/websites.js\";\nimport { DEFAULT_COPY, type ResolvedCopy } from \"../copy.js\";\nimport { escapeXml, headerImageTag, headerStyleBlock } from \"../maintenance-email/template.js\";\nimport {\n  checklistRowsSection,\n  lighthouseScoresSection,\n  analyticsSection,\n  hasAnalyticsData,\n} from \"../email-sections.js\";\n\n/** Frequency → client-facing phrase. \"None\" is never rendered (the line is omitted). */\nconst FREQ_PHRASE: Record<Exclude<ReportFrequency, \"None\">, string> = {\n  Monthly: \"every month\",\n  Quarterly: \"every quarter\",\n  Yearly: \"every year\",\n};\n\nconst RED = \"#C00\";\nconst GREY = \"#757575\";\n\n// Equal top/bottom padding for every alternating-background band, applied at the mj-section\n// level so each colored band has symmetric breathing room. (Starting baseline — easy to tune.)\nconst SECTION_PAD = \"40px\";\n\n/** A red all-caps section label. Top spacing comes from the section padding, so this is flush. */\nfunction sectionLabel(text: string): string {\n  return `<mj-text color=\"${RED}\" font-size=\"20px\" font-weight=\"700\" padding-top=\"0px\">${escapeXml(text)}</mj-text>`;\n}\n\n/** A grey 16px body paragraph whose caller passes already-escaped HTML, so partial inline markup\n *  (e.g. the cadence line's italic <em>…</em> tail) survives. */\nfunction bodyLineHtml(html: string, paddingTop = \"8px\"): string {\n  return `<mj-text color=\"${GREY}\" font-family=\"helvetica, sans-serif\" font-size=\"16px\" font-weight=\"300\" line-height=\"24px\" padding-top=\"${paddingTop}\">${html}</mj-text>`;\n}\n\n/** A grey 16px body paragraph, matching the report's section intros. Escapes `text`. */\nfunction bodyLine(text: string, paddingTop = \"8px\"): string {\n  return bodyLineHtml(escapeXml(text), paddingTop);\n}\n\n/** The go-forward cadence sentence as HTML: the lead-in followed by its reassurance tail in\n *  italics (\"…short report like this — <em>there's nothing you need to do.</em>\"). Both escaped. */\nfunction cadenceHtml(copy: ResolvedCopy): string {\n  return `${escapeXml(copy.announceCadence)} <em>${escapeXml(copy.announceCadenceNote)}</em>`;\n}\n\n/**\n * The announcement-only ReportData extras derived from the Websites row: the go-forward\n * cadence and the default-on improvement callouts. Used by BOTH the draft (announce recipe)\n * and the send-time re-render (orchestrate) so the sent email matches the reviewed preview —\n * `renderReportHtml` in the send path otherwise omits these, dropping the cadence + improvements.\n */\nexport function announcementSiteExtras(\n  site: WebsiteRow,\n): Pick<ReportData, \"cadence\" | \"improvements\"> {\n  return {\n    cadence: { maintenance: site.maintenanceFreq, testing: site.testingFreq },\n    improvements: { resendForms: true, svelte5: true },\n  };\n}\n\n/**\n * One-time onboarding announcement, built from the SAME components as the monthly report so it\n * reads as a testing report with extra explanation: header · intro (\"your ongoing care\") ·\n * MAINTENANCE CHECKS · TESTING (each: intro with the cadence baked into the copy + the report's\n * checklist rows) · LIGHTHOUSE SCORES · ANALYTICS (users + trend + the Google-position line) ·\n * RECENT IMPROVEMENTS (conditional; closes with the open-door invitation). Reuses the M6a copy\n * layer (contact/footer honor per-site overrides). No pricing. A pace set to None omits its\n * checklist section. Every band carries equal top/bottom padding (SECTION_PAD).\n */\nexport function buildAnnouncementMjml(data: ReportData): string {\n  const copy = data.copy ?? DEFAULT_COPY;\n  const previewText = \"Your monthly report from Reddoor\";\n  const cad = data.cadence;\n\n  const hasMaint = Boolean(cad && cad.maintenance !== \"None\");\n  const hasTesting = Boolean(cad && cad.testing !== \"None\");\n  const improvementItems: string[] = [];\n  if (data.improvements?.resendForms) improvementItems.push(copy.announceImprovementResend);\n  if (data.improvements?.svelte5) improvementItems.push(copy.announceImprovementSvelte5);\n  const hasImpr = improvementItems.length > 0;\n\n  // ANALYTICS renders only with real data — a GA user count or a page-1 search callout (the latter\n  // keeps the block alive for a GA-less site that still ranks). Computed up here so the band\n  // counter below can SKIP its background slot when analytics is hidden; otherwise a consumed-but-\n  // invisible slot would push the next band to the wrong color and two same-color bands would abut.\n  const analyticsBodyLines =\n    data.searchPosition !== undefined\n      ? [`Page 1 Google result (#${data.searchPosition}) for your brand search`]\n      : [];\n  const hasAnalytics = hasAnalyticsData({\n    current: data.gaUsersCurrent,\n    bodyLines: analyticsBodyLines,\n  });\n\n  // Alternating band backgrounds assigned in render order, so the white/#F4F4F4 pattern holds\n  // no matter which optional sections (maintenance / testing / improvements) actually render —\n  // a counter that only advances for bands that appear avoids two same-colored bands abutting.\n  const BANDS = [\"white\", \"#F4F4F4\"] as const;\n  let bandN = 0;\n  const nextBg = (): string => BANDS[bandN++ % 2]!;\n  const introBg = nextBg();\n  const maintBg = hasMaint ? nextBg() : \"\";\n  const testBg = hasTesting ? nextBg() : \"\";\n  const lighthouseBg = nextBg();\n  const analyticsBg = hasAnalytics ? nextBg() : \"\";\n  const improvementsBg = hasImpr ? nextBg() : \"\";\n  const contactBg = nextBg();\n\n  // MAINTENANCE CHECKS (first) — intro with the maintenance cadence baked into the copy, then the\n  // report's checklist rows. The report-frequency reassurance (announceCadence) trails the LAST\n  // check block, so it sits here only when there's no testing block after it. Omitted when None.\n  const maintenanceSection =\n    cad && cad.maintenance !== \"None\"\n      ? `\n    <mj-section background-color=\"${maintBg}\" padding-top=\"${SECTION_PAD}\" padding-bottom=\"0px\">\n      <mj-column>\n        ${sectionLabel(\"MAINTENANCE CHECKS\")}\n        ${bodyLineHtml(`${escapeXml(`${copy.maintenanceIntro} We do this ${FREQ_PHRASE[cad.maintenance]}.`)}${cad.testing === \"None\" ? ` ${cadenceHtml(copy)}` : \"\"}`)}\n      </mj-column>\n    </mj-section>${checklistRowsSection(copy.maintenanceChecks, {\n      background: maintBg,\n      lastPaddingBottom: SECTION_PAD,\n    })}`\n      : \"\";\n\n  // TESTING (second) — intro with the testing cadence + the report-frequency note baked in, then\n  // the report's checklist rows. Omitted when None.\n  const testingSection =\n    cad && cad.testing !== \"None\"\n      ? `\n    <mj-section background-color=\"${testBg}\" padding-top=\"${SECTION_PAD}\" padding-bottom=\"0px\">\n      <mj-column>\n        ${sectionLabel(\"TESTING\")}\n        ${bodyLineHtml(`${escapeXml(`${copy.testingIntro} We run a full test ${FREQ_PHRASE[cad.testing]}.`)} ${cadenceHtml(copy)}`)}\n      </mj-column>\n    </mj-section>${checklistRowsSection(copy.testingChecklist, {\n      background: testBg,\n      lastPaddingBottom: SECTION_PAD,\n    })}`\n      : \"\";\n\n  // ANALYTICS — the report's big user count + trend, plus the Google search-position line. Hidden\n  // entirely when there's no traffic or search data (hasAnalytics false), so it never shows empty.\n  const analytics = hasAnalytics\n    ? analyticsSection({\n        current: data.gaUsersCurrent,\n        previous: data.gaUsersPrevious,\n        periodDays: data.gaPeriodDays,\n        background: analyticsBg,\n        pad: SECTION_PAD,\n        bodyLines: analyticsBodyLines,\n      })\n    : \"\";\n\n  // RECENT IMPROVEMENTS — the toggled callouts, closed by the open-door invitation. Omitted\n  // entirely when there are no improvements (the open-door rides along with this block).\n  const improvementsSection = hasImpr\n    ? `\n    <mj-section background-color=\"${improvementsBg}\" padding-top=\"${SECTION_PAD}\" padding-bottom=\"${SECTION_PAD}\">\n      <mj-column>\n        ${sectionLabel(\"RECENT IMPROVEMENTS\")}\n        ${improvementItems.map((item) => bodyLine(item)).join(\"\\n        \")}\n        ${bodyLine(copy.announceOpenDoor, \"16px\")}\n      </mj-column>\n    </mj-section>`\n    : \"\";\n\n  // First contact line (\"Just hit reply.\") renders as a red bold heading, matching the\n  // \"Questions, concerns or requests?\" title above it; any following lines (e.g. \"We're\n  // here to help in any way we can.\") render in muted grey.\n  const contactRows = copy.contact\n    .map((line, i) =>\n      i === 0\n        ? `\n      <mj-text color=\"${RED}\" font-family=\"helvetica, sans-serif\" font-size=\"24px\" font-weight=\"700\" line-height=\"30px\">${escapeXml(line)}</mj-text>`\n        : `\n      <mj-text color=\"${GREY}\" font-family=\"helvetica, sans-serif\" font-size=\"24px\" font-weight=\"300\" line-height=\"30px\">${escapeXml(line)}</mj-text>`,\n    )\n    .join(\"\");\n  const footerAddressRows = copy.footerAddress\n    .map(\n      (line) => `\n      <mj-text color=\"${GREY}\" font-family=\"helvetica, sans-serif\" font-size=\"12px\" font-weight=\"300\" line-height=\"16px\" padding-top=\"0\" padding-bottom=\"0px\">${escapeXml(line)}</mj-text>`,\n    )\n    .join(\"\");\n\n  return `<mjml>\n  <mj-head>\n    <mj-attributes>\n      <mj-text font-family=\"helvetica, sans-serif\" padding-left=\"5px\" padding-right=\"5px\" />\n      <mj-section padding-left=\"11%\" padding-right=\"11%\"/>\n      <mj-image padding=\"0px\" />\n    </mj-attributes>\n    <mj-preview>${escapeXml(previewText)}</mj-preview>\n    ${headerStyleBlock(data)}\n  </mj-head>\n  <mj-body background-color=\"white\">\n    <mj-section background-color=\"#F4F4F4\" padding-top=\"0px\" padding-bottom=\"0px\" padding-left=\"0px\" padding-right=\"0px\">\n      <mj-column>${headerImageTag(data)}</mj-column>\n    </mj-section>\n    <mj-section background-color=\"${introBg}\" padding-top=\"${SECTION_PAD}\" padding-bottom=\"${SECTION_PAD}\">\n      <mj-column>\n        ${sectionLabel(copy.announceHeading)}\n        <mj-text color=\"${GREY}\" font-family=\"helvetica, sans-serif\" font-size=\"16px\" font-weight=\"300\" line-height=\"24px\" padding-top=\"20px\">Prepared for ${escapeXml(data.siteName)}</mj-text>\n        ${bodyLine(copy.announceBody)}\n      </mj-column>\n    </mj-section>\n    ${maintenanceSection}\n    ${testingSection}\n    ${lighthouseScoresSection(data.lighthouse, { background: lighthouseBg, pad: SECTION_PAD })}\n    ${analytics}\n    ${improvementsSection}\n    <mj-section background-color=\"${contactBg}\" padding-top=\"${SECTION_PAD}\" padding-bottom=\"${SECTION_PAD}\">\n      <mj-column>\n        <mj-text color=\"${RED}\" font-family=\"helvetica, sans-serif\" font-size=\"24px\" font-weight=\"700\" padding-top=\"0px\" line-height=\"36px\">Questions, concerns or requests?</mj-text>\n        ${contactRows}\n        <mj-divider border-width=\"1px\" border-style=\"solid\" border-color=\"#CCCCCC\" padding=\"0\" />\n        <mj-text color=\"${GREY}\" font-family=\"helvetica, sans-serif\" font-size=\"12px\" font-weight=\"300\" padding-top=\"24px\" line-height=\"20px\" font-style=\"italic\">Copyright ${new Date().getUTCFullYear()} ${escapeXml(copy.footerOrg)}. All rights reserved.</mj-text>\n        <mj-text color=\"${GREY}\" font-family=\"helvetica, sans-serif\" font-size=\"12px\" font-weight=\"700\" line-height=\"16px\" padding-top=\"0\" padding-bottom=\"0px\">Our mailing address is:</mj-text>\n        <mj-text color=\"${GREY}\" font-family=\"helvetica, sans-serif\" font-size=\"12px\" font-weight=\"300\" line-height=\"16px\" padding-top=\"0\" padding-bottom=\"0px\">${escapeXml(copy.footerOrg)}</mj-text>\n        ${footerAddressRows}\n      </mj-column>\n    </mj-section>\n  </mj-body>\n</mjml>`;\n}\n","import mjml2html from \"mjml\";\nimport type { ReportData } from \"./types.js\";\nimport { buildMjml } from \"./maintenance-email/template.js\";\nimport { buildLaunchMjml } from \"./launch-email/template.js\";\nimport { buildAnnouncementMjml } from \"./announcement-email/template.js\";\n\nexport type RenderResult = {\n  html: string;\n  warnings: Array<{ line: number; message: string }>;\n};\n\nexport async function renderReportHtml(data: ReportData): Promise<RenderResult> {\n  const mjml =\n    data.reportType === \"Launch\"\n      ? buildLaunchMjml(data)\n      : data.reportType === \"Announcement\"\n        ? buildAnnouncementMjml(data)\n        : buildMjml(data);\n  const out = await mjml2html(mjml, { validationLevel: \"strict\" });\n  return { html: out.html, warnings: out.errors ?? [] };\n}\n","import type { ReportData } from \"../types.js\";\nimport { DEFAULT_COPY } from \"../copy.js\";\nimport {\n  escapeXml,\n  fmtDate,\n  headerImageTag,\n  headerStyleBlock,\n} from \"../maintenance-email/template.js\";\n\nconst RED = \"#C00\";\nconst GREY = \"#757575\";\n\n/** Purpose-built go-live email: header · LAUNCHED + date · message · what-we-set-up\n *  · contact · footer. Reuses the M6a copy layer (contact/footer honor per-site\n *  overrides). No maintenance checklist / Lighthouse / analytics. */\nexport function buildLaunchMjml(data: ReportData): string {\n  const copy = data.copy ?? DEFAULT_COPY;\n  const previewText = `${escapeXml(data.siteName)} is live`;\n  // All copy — launchHeading/launchBody/launchSetupItems included — is escaped\n  // (spec §3.3: all copy escaped). It keeps strict MJML from choking on a stray\n  // `&`/`<` if the default copy ever gains one, matching contact/footer below.\n  const setupRows = copy.launchSetupItems\n    .map(\n      (item) => `\n      <mj-text color=\"${GREY}\" font-family=\"helvetica, sans-serif\" font-size=\"16px\" font-weight=\"300\" line-height=\"24px\" padding-top=\"4px\" padding-bottom=\"4px\">• ${escapeXml(item)}</mj-text>`,\n    )\n    .join(\"\");\n  // First contact line (\"Just hit reply.\") renders as a red bold heading, matching the\n  // \"Any questions, concerns or requests?\" title above it; following lines stay default.\n  const contactRows = copy.contact\n    .map((line, i) =>\n      i === 0\n        ? `\n      <mj-text color=\"${RED}\" font-family=\"helvetica, sans-serif\" font-size=\"24px\" font-weight=\"700\" line-height=\"30px\">${escapeXml(line)}</mj-text>`\n        : `\n      <mj-text font-family=\"helvetica, sans-serif\" font-size=\"24px\" font-weight=\"300\" line-height=\"30px\">${escapeXml(line)}</mj-text>`,\n    )\n    .join(\"\");\n  const footerAddressRows = copy.footerAddress\n    .map(\n      (line) => `\n      <mj-text color=\"${GREY}\" font-family=\"helvetica, sans-serif\" font-size=\"12px\" font-weight=\"300\" line-height=\"16px\" padding-top=\"0\" padding-bottom=\"0px\">${escapeXml(line)}</mj-text>`,\n    )\n    .join(\"\");\n\n  return `<mjml>\n  <mj-head>\n    <mj-attributes>\n      <mj-text font-family=\"helvetica, sans-serif\" padding-left=\"5px\" padding-right=\"5px\" />\n      <mj-section padding-left=\"11%\" padding-right=\"11%\"/>\n      <mj-image padding=\"0px\" />\n    </mj-attributes>\n    <mj-preview>${previewText}</mj-preview>\n    ${headerStyleBlock(data)}\n  </mj-head>\n  <mj-body background-color=\"white\">\n    <mj-section background-color=\"#F4F4F4\" padding-top=\"0px\" padding-bottom=\"0px\" padding-left=\"0px\" padding-right=\"0px\">\n      <mj-column>${headerImageTag(data)}</mj-column>\n    </mj-section>\n    <mj-section background-color=\"white\">\n      <mj-column>\n        <mj-text color=\"${RED}\" font-size=\"20px\" font-weight=\"700\" padding-top=\"75px\">${escapeXml(copy.launchHeading)}</mj-text>\n        <mj-text color=\"${RED}\" font-size=\"44px\" font-weight=\"400\">${fmtDate(data.completedOn)}</mj-text>\n        <mj-text color=\"${GREY}\" font-family=\"helvetica, sans-serif\" font-size=\"16px\" font-weight=\"300\" line-height=\"24px\" padding-top=\"20px\">${escapeXml(copy.launchBody)}</mj-text>\n        ${setupRows}\n      </mj-column>\n    </mj-section>\n    <mj-section background-color=\"white\">\n      <mj-column padding-top=\"36px\">\n        <mj-text color=\"${RED}\" font-family=\"helvetica, sans-serif\" font-size=\"24px\" font-weight=\"700\" padding-top=\"36px\" line-height=\"36px\">Any questions, concerns or requests?</mj-text>\n        ${contactRows}\n        <mj-divider border-width=\"1px\" border-style=\"solid\" border-color=\"#CCCCCC\" padding=\"0\" />\n        <mj-text color=\"${GREY}\" font-family=\"helvetica, sans-serif\" font-size=\"12px\" font-weight=\"300\" padding-top=\"24px\" line-height=\"20px\" font-style=\"italic\">Copyright ${new Date().getUTCFullYear()} ${escapeXml(copy.footerOrg)}. All rights reserved.</mj-text>\n        <mj-text color=\"${GREY}\" font-family=\"helvetica, sans-serif\" font-size=\"12px\" font-weight=\"700\" line-height=\"16px\" padding-top=\"0\" padding-bottom=\"0px\">Our mailing address is:</mj-text>\n        <mj-text color=\"${GREY}\" font-family=\"helvetica, sans-serif\" font-size=\"12px\" font-weight=\"300\" line-height=\"16px\" padding-top=\"0\" padding-bottom=\"0px\">${escapeXml(copy.footerOrg)}</mj-text>\n        ${footerAddressRows}\n      </mj-column>\n    </mj-section>\n  </mj-body>\n</mjml>`;\n}\n","import type { ReportType } from \"./types.js\";\nimport type { EvidenceResult, EvidenceRecord } from \"./auto-tick.js\";\n\n/**\n * One operator checklist item: a stable `key`, its display `label` (which mirrors\n * the client email's checklist line — kept in sync by a test against DEFAULT_COPY),\n * and the exact Airtable checkbox column `field` it reads/writes.\n */\nexport type ChecklistItem = { key: string; label: string; field: string };\n\n/**\n * The 6 Maintenance-report items. `label`s mirror DEFAULT_COPY.maintenanceChecks\n * (same order — \"Google Indexed\" MUST stay at index 3; the email template special-cases\n * that row to inject the live search position).\n */\nexport const MAINTENANCE_CHECKLIST: ChecklistItem[] = [\n  { key: \"deploy\", label: \"Deploy & Function Health\", field: \"Maint: Deploy & Function Health\" },\n  { key: \"cms\", label: \"CMS Checked\", field: \"Maint: CMS Checked\" },\n  { key: \"domain\", label: \"Domain, DNS & SSL\", field: \"Maint: Domain, DNS & SSL\" },\n  { key: \"google\", label: \"Google Indexed\", field: \"Maint: Google Indexed\" },\n  { key: \"security\", label: \"Security Updates\", field: \"Maint: Security Updates\" },\n  { key: \"uptime\", label: \"Uptime Checked\", field: \"Maint: Uptime Checked\" },\n];\n\n/** The 7 Testing-report items. `label`s mirror DEFAULT_COPY.testingChecklist. */\nexport const TESTING_CHECKLIST: ChecklistItem[] = [\n  { key: \"desktop\", label: \"Desktop Browsers\", field: \"Test: Desktop Browsers\" },\n  { key: \"mobile\", label: \"Mobile Browsers\", field: \"Test: Mobile Browsers\" },\n  { key: \"titles\", label: \"Page Titles & Meta\", field: \"Test: Page Titles & Meta\" },\n  { key: \"links\", label: \"Links & Navigation\", field: \"Test: Links & Navigation\" },\n  { key: \"forms\", label: \"Form Functionality\", field: \"Test: Form Functionality\" },\n  {\n    key: \"interactions\",\n    label: \"Interactions & Animations\",\n    field: \"Test: Interactions & Animations\",\n  },\n  // `field` keeps its original Airtable column name (\"…Verified After Updates\") even though\n  // the client-facing label is now \"Tested After Updates\" — the column holds operator data,\n  // so renaming the label is display-only and avoids a live-base column migration.\n  { key: \"updates\", label: \"Tested After Updates\", field: \"Test: Verified After Updates\" },\n];\n\n/** All 13 Airtable checkbox column names. mapRow reads exactly these into the row's checklist. */\nexport const ALL_CHECKLIST_FIELDS: string[] = [...MAINTENANCE_CHECKLIST, ...TESTING_CHECKLIST].map(\n  (i) => i.field,\n);\n\n/**\n * The checklist that gates a report of the given type, in the order the email renders it.\n * Maintenance gates on its 6 items. A Testing pass also performs the maintenance checks —\n * and the Testing email shows BOTH lists — so a Testing report gates on all 13\n * (maintenance first, then testing). Launch/Announcement have no checklist (the gate is\n * vacuously satisfied). PURE.\n */\nexport function checklistFor(type: ReportType): ChecklistItem[] {\n  if (type === \"Maintenance\") return MAINTENANCE_CHECKLIST;\n  if (type === \"Testing\") return [...MAINTENANCE_CHECKLIST, ...TESTING_CHECKLIST];\n  return [];\n}\n\n/** The maintenance items whose HEALTH gates a Maintenance send. Google Indexed is advisory\n *  (reported, never blocks) so it is excluded. */\nconst MAINTENANCE_GATING_FIELDS: string[] = [\n  \"Maint: Deploy & Function Health\",\n  \"Maint: CMS Checked\",\n  \"Maint: Domain, DNS & SSL\",\n  \"Maint: Security Updates\",\n  \"Maint: Uptime Checked\",\n];\n\n/**\n * The checklist fields whose health gates a send of this report type. Maintenance gates\n * availability/integrity only (Google Indexed is advisory); Testing holds the full bar (all 13,\n * including Google Indexed); Launch/Announcement are ungated. PURE.\n */\nexport function gatingFields(type: ReportType): string[] {\n  if (type === \"Maintenance\") return MAINTENANCE_GATING_FIELDS;\n  if (type === \"Testing\") return checklistFor(\"Testing\").map((i) => i.field);\n  return [];\n}\n\n/**\n * The health gate: clear iff EVERY gating field's evidence result is `pass` or `n/a`. A `fail`,\n * an `unknown`, or an ABSENT record all block — the semantic inversion (no fresh signal → cannot\n * confirm health → don't send). Launch/Announcement have no gating fields → vacuously clear. PURE.\n */\nexport function isHealthGateClear(report: {\n  reportType: ReportType;\n  autoEvidence: Record<string, EvidenceRecord>;\n}): boolean {\n  return gatingFields(report.reportType).every((field) => {\n    const r = report.autoEvidence[field]?.result;\n    return r === \"pass\" || r === \"n/a\";\n  });\n}\n\n/** Per-gating-field status for by-name blocker messaging (send log, dashboard). An absent record\n *  surfaces as `unknown`. PURE. */\nexport function gatingHealth(report: {\n  reportType: ReportType;\n  autoEvidence: Record<string, EvidenceRecord>;\n}): { field: string; status: EvidenceResult }[] {\n  return gatingFields(report.reportType).map((field) => ({\n    field,\n    status: report.autoEvidence[field]?.result ?? \"unknown\",\n  }));\n}\n\n/**\n * True when a logged send-anyway override is active AND carries a non-empty reason. The effective\n * send gate is `isHealthGateClear(report) || isSendOverridden(report)`. PURE — takes the minimal\n * structural shape so it can be evaluated over a ReportRow or a synthetic \"about to override\" copy.\n */\nexport function isSendOverridden(report: {\n  sendOverride: boolean;\n  overrideReason: string | null;\n}): boolean {\n  return report.sendOverride && (report.overrideReason ?? \"\").trim() !== \"\";\n}\n","import type { FieldSet, Records } from \"airtable\";\nimport type { AirtableBase } from \"./client.js\";\nimport type { ReportType, LighthouseScores } from \"../types.js\";\nimport { ALL_CHECKLIST_FIELDS } from \"../checklist.js\";\nimport type { EvidenceRecord } from \"../auto-tick.js\";\n\nexport const REPORTS_TABLE = \"Reports\";\n\nconst REPORT_TYPES: readonly ReportType[] = [\"Maintenance\", \"Testing\", \"Launch\", \"Announcement\"];\n\n/** Coerce the Airtable `Report type` (a single-select string) to a known\n *  ReportType. A bare `as ReportType` cast is a compile-time lie: if the\n *  single-select gains an unexpected option, the bad value flows to render.ts,\n *  where `reportType === \"Launch\"` silently falls through to the Maintenance\n *  template. Validate at the boundary; warn + default to \"Maintenance\" so an\n *  unknown type is VISIBLE in the logs rather than silently mis-templated. */\nexport function toReportType(raw: string | undefined): ReportType {\n  if (raw && (REPORT_TYPES as readonly string[]).includes(raw)) return raw as ReportType;\n  if (raw)\n    console.warn(`[reports] unknown Report type ${JSON.stringify(raw)} — treating as Maintenance`);\n  return \"Maintenance\";\n}\n\nexport type DeliveryStatus = \"pending\" | \"delivered\" | \"bounced\" | \"complained\";\n\nexport type ReportRow = {\n  id: string;\n  reportId: string;\n  siteId: string;\n  reportType: ReportType;\n  /** UTC `YYYY-MM` recurrence key (idempotency for search-before-create). Null on legacy rows. */\n  period: string | null;\n  periodStart: string | null;\n  periodEnd: string | null;\n  completedOn: string | null;\n  lighthouse: LighthouseScores | null;\n  gaUsersCurrent: number | null;\n  gaUsersPrevious: number | null;\n  searchFoundPage1: boolean | null;\n  searchPosition: number | null;\n  lastTestedDate: string | null;\n  commentary: string | null;\n  subjectOverride: string | null;\n  draftReady: boolean;\n  approvedToSend: boolean;\n  sentAt: string | null;\n  approvedAt: string | null;\n  approvedBy: string | null;\n  deliveryStatus: DeliveryStatus;\n  renderedHtmlAttachment: { url: string; filename: string } | null;\n  /** Read out of the Resend response and stored in a hidden field; needed for webhook reconciliation. */\n  resendMessageId: string | null;\n  /** The 12 operator-checklist checkboxes, keyed by their Airtable column name (ALL_CHECKLIST_FIELDS);\n   *  missing/false cells read false. Maintenance/Testing reports gate approve+send on the relevant\n   *  subset (see src/reports/checklist.ts). */\n  checklist: Record<string, boolean>;\n  /** Snapshot of the auto-tick evidence at draft time, keyed by checklist field → evidence\n   *  record. Null when the report predates auto-tick or carried no auto-checked items. This is the\n   *  health gate's source of truth: `isHealthGateClear`/`gatingHealth` (src/reports/checklist.ts)\n   *  read these evidence records, NOT the checklist booleans — and also drive the dashboard badges. */\n  autoEvidence: Record<string, EvidenceRecord> | null;\n  /** Logged send-anyway override (Phase 10). When `sendOverride` is true AND `overrideReason` is\n   *  non-empty, the health gate is bypassed for THIS report; `overrideBy`/`overrideAt` are the\n   *  audit trail (parallel to approvedBy/approvedAt). Missing cells read false/null. */\n  sendOverride: boolean;\n  overrideReason: string | null;\n  overrideBy: string | null;\n  overrideAt: string | null;\n};\n\n/**\n * The \"Ready for your yes\" gate: Draft ready ∧ ¬Approved to send ∧ Sent at BLANK.\n * The single source of truth for \"pending the operator's approval\" — `listPendingApproval`,\n * `runDigest`'s ready-list, the per-site dashboard, and the fleet cockpit all key off this\n * one predicate so the surfaces can't drift.\n */\nexport function isPendingApproval(r: ReportRow): boolean {\n  return r.draftReady && !r.approvedToSend && r.sentAt === null;\n}\n\nfunction mapRow(rec: { id: string; fields: Record<string, unknown> }): ReportRow {\n  const f = rec.fields;\n  const linkSites = (f[\"Site\"] as string[] | undefined) ?? [];\n  const html =\n    ((f[\"Rendered HTML\"] as Array<{ url: string; filename: string }> | undefined) ?? [])[0] ?? null;\n  return {\n    id: rec.id,\n    reportId: String(f[\"Report ID\"] ?? \"\"),\n    siteId: linkSites[0] ?? \"\",\n    reportType: toReportType(f[\"Report type\"] as string | undefined),\n    period: (f[\"Period\"] as string | undefined) ?? null,\n    periodStart: (f[\"Period start\"] as string | undefined) ?? null,\n    periodEnd: (f[\"Period end\"] as string | undefined) ?? null,\n    completedOn: (f[\"Completed on\"] as string | undefined) ?? null,\n    lighthouse: lighthouseFromFields(f),\n    gaUsersCurrent: (f[\"GA users (period)\"] as number | undefined) ?? null,\n    gaUsersPrevious: (f[\"GA users (prev period)\"] as number | undefined) ?? null,\n    searchFoundPage1:\n      typeof f[\"Search found page 1\"] === \"boolean\" ? (f[\"Search found page 1\"] as boolean) : null,\n    searchPosition: (f[\"Search position\"] as number | undefined) ?? null,\n    lastTestedDate: (f[\"Last tested date\"] as string | undefined) ?? null,\n    commentary: (f[\"Commentary\"] as string | undefined) ?? null,\n    subjectOverride: (f[\"Subject override\"] as string | undefined) ?? null,\n    draftReady: Boolean(f[\"Draft ready\"]),\n    approvedToSend: Boolean(f[\"Approved to send\"]),\n    sentAt: (f[\"Sent at\"] as string | undefined) ?? null,\n    approvedAt: (f[\"Approved At\"] as string | undefined) ?? null,\n    approvedBy: (f[\"Approved By\"] as string | undefined) ?? null,\n    deliveryStatus: ((f[\"Delivery status\"] as string | undefined) ?? \"pending\") as DeliveryStatus,\n    renderedHtmlAttachment: html,\n    resendMessageId: (f[\"Resend message ID\"] as string | undefined) ?? null,\n    checklist: Object.fromEntries(ALL_CHECKLIST_FIELDS.map((name) => [name, Boolean(f[name])])),\n    autoEvidence: parseAutoEvidence(f[\"Checklist auto-evidence\"]),\n    sendOverride: Boolean(f[\"Send override\"]),\n    overrideReason: (f[\"Override reason\"] as string | undefined) ?? null,\n    overrideBy: (f[\"Override by\"] as string | undefined) ?? null,\n    overrideAt: (f[\"Override at\"] as string | undefined) ?? null,\n  };\n}\n\n/**\n * Parse the `Checklist auto-evidence` JSON field → a field→EvidenceRecord map, or null when\n * absent/malformed. Permissive on inner shape (it's display-only — a bad blob just yields null,\n * never throws), mirroring `parseNotifyRouting`.\n */\nexport function parseAutoEvidence(raw: unknown): Record<string, EvidenceRecord> | null {\n  if (typeof raw !== \"string\" || !raw.trim()) return null;\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch {\n    return null;\n  }\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) return null;\n  // Validate each entry's inner shape (it drives display) — drop any record whose `result` isn't\n  // one of the four literals, and coerce `note`/`checkedAt` to safe types. A garbage blob yields\n  // null rather than a record that would render \"auto: undefined\" on the dashboard.\n  const out: Record<string, EvidenceRecord> = {};\n  for (const [field, v] of Object.entries(parsed as Record<string, unknown>)) {\n    if (!v || typeof v !== \"object\") continue;\n    const o = v as Record<string, unknown>;\n    if (o.result !== \"pass\" && o.result !== \"fail\" && o.result !== \"unknown\" && o.result !== \"n/a\")\n      continue;\n    out[field] = {\n      result: o.result,\n      checkedAt: typeof o.checkedAt === \"string\" ? o.checkedAt : null,\n      note: typeof o.note === \"string\" ? o.note : \"\",\n    };\n  }\n  return Object.keys(out).length > 0 ? out : null;\n}\n\nfunction lighthouseFromFields(f: Record<string, unknown>): LighthouseScores | null {\n  const p = f[\"Lighthouse — Performance\"];\n  const a = f[\"Lighthouse — Accessibility\"];\n  const b = f[\"Lighthouse — Best Practices\"];\n  const s = f[\"Lighthouse — SEO\"];\n  if (\n    typeof p !== \"number\" ||\n    typeof a !== \"number\" ||\n    typeof b !== \"number\" ||\n    typeof s !== \"number\"\n  )\n    return null;\n  return { performance: p, accessibility: a, bestPractices: b, seo: s };\n}\n\n/** The GA + Search-presence fields a draft can carry, written to the Reports row.\n *  `searchFoundPage1` is written whenever the check ran (true or false — false is the\n *  operator-only negative signal); `searchPosition` only when found on page 1. Shared by\n *  the create path (DraftInput) and the reuse path (updateReportScores). */\nexport type ReportEnrichment = {\n  gaUsersCurrent?: number;\n  gaUsersPrevious?: number;\n  searchFoundPage1?: boolean;\n  searchPosition?: number;\n};\n\nexport type DraftInput = {\n  reportId: string;\n  siteId: string;\n  reportType: ReportType;\n  /** UTC `YYYY-MM` recurrence key. Omitted on legacy callers; written only when supplied. */\n  period?: string;\n  periodStart: Date;\n  periodEnd: Date;\n  completedOn: Date;\n  lighthouse: LighthouseScores;\n  lastTestedDate: Date | null;\n  /** GA \"Users\" for the period / previous period. Omitted when GA is not configured\n   *  for the site or the fetch failed — the operator fills the fields manually. */\n  gaUsersCurrent?: number;\n  gaUsersPrevious?: number;\n  /** Search-presence result. `searchFoundPage1` is written whenever the check ran (true or\n   *  false — false is the operator-only negative signal). `searchPosition` only when found. */\n  searchFoundPage1?: boolean;\n  searchPosition?: number;\n  subjectOverride?: string;\n  /** Checklist fields to tick at create time (the auto-tick \"pass\" set). */\n  checklistTicks?: string[];\n  /** Auto-tick evidence snapshot to persist (keyed by checklist field). */\n  autoEvidence?: Record<string, EvidenceRecord>;\n};\n\nfunction ymd(d: Date): string {\n  return d.toISOString().slice(0, 10);\n}\n\n/**\n * Escape a string for safe interpolation into an Airtable filterByFormula.\n * Airtable formulas use SQL-like string literals; we escape backslash and\n * double quote. Used wherever an externally-supplied string flows into a\n * formula (e.g. Resend message ids on the webhook path).\n */\nexport function escapeFormulaString(s: string): string {\n  return s.replace(/\\\\/g, \"\\\\\\\\\").replace(/\"/g, '\\\\\"');\n}\n\nexport async function createDraft(base: AirtableBase, input: DraftInput): Promise<ReportRow> {\n  // Set Delivery status to \"pending\" at creation time, NOT at send time. This\n  // matters for H4: if stampSent wrote \"pending\" after the webhook had already\n  // written \"delivered\" (race), the operator would see a regressed status.\n  const fields: FieldSet = {\n    \"Report ID\": input.reportId,\n    Site: [input.siteId],\n    \"Report type\": input.reportType,\n    \"Period start\": ymd(input.periodStart),\n    \"Period end\": ymd(input.periodEnd),\n    \"Completed on\": ymd(input.completedOn),\n    \"Lighthouse — Performance\": input.lighthouse.performance,\n    \"Lighthouse — Accessibility\": input.lighthouse.accessibility,\n    \"Lighthouse — Best Practices\": input.lighthouse.bestPractices,\n    \"Lighthouse — SEO\": input.lighthouse.seo,\n    \"Delivery status\": \"pending\",\n  };\n  if (input.lastTestedDate) fields[\"Last tested date\"] = ymd(input.lastTestedDate);\n  // GA fields are written only when supplied (GA configured + fetch succeeded). When\n  // omitted the row keeps them blank for manual entry — the pre-GA behavior.\n  if (input.gaUsersCurrent !== undefined) fields[\"GA users (period)\"] = input.gaUsersCurrent;\n  if (input.gaUsersPrevious !== undefined) fields[\"GA users (prev period)\"] = input.gaUsersPrevious;\n  if (input.searchFoundPage1 !== undefined) fields[\"Search found page 1\"] = input.searchFoundPage1;\n  if (input.searchPosition !== undefined) fields[\"Search position\"] = input.searchPosition;\n  if (input.period !== undefined) fields[\"Period\"] = input.period;\n  if (input.subjectOverride !== undefined) fields[\"Subject override\"] = input.subjectOverride;\n  // Auto-ticked checklist boxes + the evidence snapshot. The booleans are the same columns the\n  // operator/dashboard toggle; the JSON is what the health gate reads (isHealthGateClear/gatingHealth)\n  // and also drives the dashboard's green/amber badges.\n  for (const field of input.checklistTicks ?? []) fields[field] = true;\n  if (input.autoEvidence && Object.keys(input.autoEvidence).length > 0) {\n    fields[\"Checklist auto-evidence\"] = JSON.stringify(input.autoEvidence);\n  }\n  const created = (await base(REPORTS_TABLE).create([{ fields }])) as Records<FieldSet>;\n  const rec = created[0];\n  if (!rec) throw new Error(\"Airtable create returned no records\");\n  return mapRow({ id: rec.id, fields: rec.fields });\n}\n\nexport async function setDraftReady(\n  base: AirtableBase,\n  recordId: string,\n  ready: boolean,\n): Promise<void> {\n  await base(REPORTS_TABLE).update([{ id: recordId, fields: { \"Draft ready\": ready } }]);\n}\n\n/**\n * Overwrite the four `Lighthouse — *` score cells (and, when supplied, `Completed\n * on`) on an EXISTING Reports row. The launch re-run path uses this: it reuses the\n * already-created Launch row but must refresh its scores to match the freshly-run\n * audit — otherwise the re-rendered preview shows new scores while the row (and the\n * eventually-sent email, which reads the row) keeps the stale ones. The create path\n * already writes fresh scores via `createDraft`; this is its update-side mirror, using\n * the same exact field names so the two stay in lockstep.\n */\nexport async function updateReportScores(\n  base: AirtableBase,\n  recordId: string,\n  scores: LighthouseScores,\n  completedOn?: Date,\n  enrichment?: ReportEnrichment,\n): Promise<void> {\n  const fields: FieldSet = {\n    \"Lighthouse — Performance\": scores.performance,\n    \"Lighthouse — Accessibility\": scores.accessibility,\n    \"Lighthouse — Best Practices\": scores.bestPractices,\n    \"Lighthouse — SEO\": scores.seo,\n  };\n  if (completedOn) fields[\"Completed on\"] = ymd(completedOn);\n  if (enrichment?.gaUsersCurrent !== undefined)\n    fields[\"GA users (period)\"] = enrichment.gaUsersCurrent;\n  if (enrichment?.gaUsersPrevious !== undefined)\n    fields[\"GA users (prev period)\"] = enrichment.gaUsersPrevious;\n  if (enrichment?.searchFoundPage1 !== undefined)\n    fields[\"Search found page 1\"] = enrichment.searchFoundPage1;\n  if (enrichment?.searchPosition !== undefined)\n    fields[\"Search position\"] = enrichment.searchPosition;\n  await base(REPORTS_TABLE).update([{ id: recordId, fields }]);\n}\n\nexport async function listSendableReports(base: AirtableBase): Promise<ReportRow[]> {\n  const out: ReportRow[] = [];\n  await base(REPORTS_TABLE)\n    .select({\n      filterByFormula:\n        \"AND({Draft ready} = TRUE(), {Approved to send} = TRUE(), {Sent at} = BLANK())\",\n      pageSize: 100,\n    })\n    .eachPage((records, fetchNextPage) => {\n      for (const rec of records) out.push(mapRow({ id: rec.id, fields: rec.fields }));\n      fetchNextPage();\n    });\n  return out;\n}\n\n/**\n * Fetch every Reports row, unfiltered. Site-scoped callers filter the result in\n * memory: the `Site` linked-record field CANNOT be formula-filtered by record id\n * (see findReportByPeriod's doc for why), and the fleet's Reports table is small\n * enough that one paged fetch-all beats N broken-or-per-site queries.\n */\nexport async function listAllReports(base: AirtableBase): Promise<ReportRow[]> {\n  const out: ReportRow[] = [];\n  await base(REPORTS_TABLE)\n    .select({ pageSize: 100 })\n    .eachPage((records, fetchNextPage) => {\n      for (const rec of records) out.push(mapRow({ id: rec.id, fields: rec.fields }));\n      fetchNextPage();\n    });\n  return out;\n}\n\nexport async function listReportsForSite(base: AirtableBase, siteId: string): Promise<ReportRow[]> {\n  // Client-side match on the mapped siteId (mapRow reads the record id from the\n  // REST response, where it IS present) — record ids can't appear in formulas.\n  return (await listAllReports(base)).filter((r) => r.siteId === siteId);\n}\n\n/**\n * Mark a row as sent: write `Sent at` and (when known) `Resend message ID`.\n * Crucially does NOT touch `Delivery status` — that's set to \"pending\" in\n * createDraft and updated by the webhook from there. If we wrote \"pending\" here\n * we could clobber a \"delivered\" that the webhook raced ahead and wrote first (H4).\n *\n * `messageId` may be `null`: the 409 idempotency-conflict path has no recoverable\n * id (the original send's id was lost when the prior run's stamp failed), so it\n * passes null and we write ONLY `Sent at`. Writing a sentinel string like\n * \"idempotent-conflict\" into the id column would masquerade as a real Resend id\n * and silently orphan `findReportByMessageId` lookups; leaving it null is honest —\n * the row still stops replaying (Sent at is set), delivery tracking for that one\n * report is simply degraded (the id is genuinely unknowable on that path).\n */\nexport async function stampSent(\n  base: AirtableBase,\n  recordId: string,\n  sentAt: Date,\n  messageId: string | null,\n): Promise<void> {\n  const fields: Record<string, string> = { \"Sent at\": sentAt.toISOString() };\n  if (messageId !== null) fields[\"Resend message ID\"] = messageId;\n  await base(REPORTS_TABLE).update([\n    {\n      id: recordId,\n      fields,\n    },\n  ]);\n}\n\nexport async function setDeliveryStatus(\n  base: AirtableBase,\n  recordId: string,\n  status: DeliveryStatus,\n): Promise<void> {\n  await base(REPORTS_TABLE).update([{ id: recordId, fields: { \"Delivery status\": status } }]);\n}\n\n/**\n * Stamp the approval on a Reports row: flips `Approved to send` TRUE and records\n * who/when for the audit trail. The caller (approveReport handler) is responsible\n * for idempotency — this is the raw write. Never touches `Sent at`.\n */\nexport async function approveReportRow(\n  base: AirtableBase,\n  recordId: string,\n  approvedAt: Date,\n  approvedBy: string,\n): Promise<void> {\n  await base(REPORTS_TABLE).update([\n    {\n      id: recordId,\n      fields: {\n        \"Approved to send\": true,\n        \"Approved At\": approvedAt.toISOString(),\n        \"Approved By\": approvedBy,\n      },\n    },\n  ]);\n}\n\n/**\n * Stamp a logged send-anyway override on a Reports row: sets `Send override` TRUE, the reason, and\n * who/when — AND flips `Approved to send` TRUE (with the same Approved At/By stamp) so the daily\n * cron delivers the overridden report. Mirrors {@link approveReportRow}; never touches `Sent at`.\n */\nexport async function overrideReportRow(\n  base: AirtableBase,\n  recordId: string,\n  overrideAt: Date,\n  overrideBy: string,\n  reason: string,\n): Promise<void> {\n  const at = overrideAt.toISOString();\n  await base(REPORTS_TABLE).update([\n    {\n      id: recordId,\n      fields: {\n        \"Send override\": true,\n        \"Override reason\": reason,\n        \"Override by\": overrideBy,\n        \"Override at\": at,\n        \"Approved to send\": true,\n        \"Approved At\": at,\n        \"Approved By\": overrideBy,\n      },\n    },\n  ]);\n}\n\n/**\n * True when an `.find` rejection is a GENUINE not-found, not a transient failure.\n * The Airtable SDK stamps `.statusCode` (404) and/or `.error` (\"NOT_FOUND\") on\n * its errors. Anything else (429 rate-limit, 500 outage, bad-PAT 401, network\n * error) must NOT be masked as a 404 — see getReportById.\n */\nfunction isNotFoundError(err: unknown): boolean {\n  if (typeof err !== \"object\" || err === null) return false;\n  const e = err as { statusCode?: unknown; error?: unknown; name?: unknown; message?: unknown };\n  if (e.statusCode === 404) return true;\n  const tag = String(e.error ?? e.name ?? e.message ?? \"\");\n  return tag === \"NOT_FOUND\" || /not found/i.test(tag);\n}\n\n/**\n * Fetch one Reports row by its Airtable record id, or null if it doesn't exist.\n * Only a GENUINE not-found (404 / NOT_FOUND) collapses to null; every other\n * failure (outage, 429, bad PAT, network error) is rethrown so the adapter\n * surfaces a 500 instead of a misleading 404. Swallowing all throws previously\n * turned an Airtable outage into a \"no such report\".\n */\nexport async function getReportById(\n  base: AirtableBase,\n  recordId: string,\n): Promise<ReportRow | null> {\n  try {\n    const rec = await base(REPORTS_TABLE).find(recordId);\n    return mapRow({ id: rec.id, fields: rec.fields as Record<string, unknown> });\n  } catch (err) {\n    if (isNotFoundError(err)) return null;\n    throw err;\n  }\n}\n\nexport async function findReportByMessageId(\n  base: AirtableBase,\n  messageId: string,\n): Promise<ReportRow | null> {\n  const rows: ReportRow[] = [];\n  await base(REPORTS_TABLE)\n    .select({\n      filterByFormula: `{Resend message ID} = \"${escapeFormulaString(messageId)}\"`,\n      maxRecords: 1,\n    })\n    .eachPage((records, fetchNextPage) => {\n      for (const rec of records) rows.push(mapRow({ id: rec.id, fields: rec.fields }));\n      fetchNextPage();\n    });\n  return rows[0] ?? null;\n}\n\n/**\n * Find the Reports row for a `(site, reportType, period)` triple, or null. The\n * idempotency lookup behind search-before-create drafting.\n *\n * The site is matched CLIENT-side, never in the formula: Airtable's formula layer\n * renders linked-record fields ({Site}) as the linked rows' PRIMARY-FIELD NAMES,\n * not record ids, so any formula comparing {Site} or ARRAYJOIN({Site}) against a\n * `recXXX` id matches NOTHING (live-proven against the real base — do not\n * reintroduce that idiom). Record ids exist only in the REST response, where\n * mapRow reads them. So the formula filters on the real scalar fields (Report\n * type + Period — escaped, keeping it injection-safe if their source ever\n * changes), and the first mapped row whose siteId matches wins. The candidate\n * set is at most one row per site for the (type, period), so this stays small.\n */\nexport async function findReportByPeriod(\n  base: AirtableBase,\n  siteId: string,\n  reportType: ReportType,\n  period: string,\n): Promise<ReportRow | null> {\n  const safeType = escapeFormulaString(reportType);\n  const safePeriod = escapeFormulaString(period);\n  const formula = `AND({Report type} = \"${safeType}\", {Period} = \"${safePeriod}\")`;\n  const rows: ReportRow[] = [];\n  await base(REPORTS_TABLE)\n    .select({ filterByFormula: formula, pageSize: 100 })\n    .eachPage((records, fetchNextPage) => {\n      for (const rec of records) rows.push(mapRow({ id: rec.id, fields: rec.fields }));\n      fetchNextPage();\n    });\n  return rows.find((r) => r.siteId === siteId) ?? null;\n}\n"],"mappings":";;;;;AA2BO,IAAM,eAA6B;AAAA,EACxC,kBACE;AAAA,EACF,mBAAmB;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,cACE;AAAA,EACF,kBAAkB;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,aAAa;AAAA,EACb,QAAQ;AAAA,EACR,SAAS,CAAC,mBAAmB,uCAAuC;AAAA,EACpE,WAAW;AAAA,EACX,eAAe,CAAC,oBAAoB,2BAA2B;AAAA,EAC/D,eAAe;AAAA,EACf,YACE;AAAA,EACF,kBAAkB;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,iBAAiB;AAAA,EACjB,cACE;AAAA,EACF,2BACE;AAAA,EACF,4BACE;AAAA,EACF,iBAAiB;AAAA,EACjB,qBAAqB;AAAA,EACrB,kBACE;AACJ;AAGA,SAAS,SAAS,GAAiC;AACjD,MAAI,OAAO,MAAM,SAAU,QAAO;AAClC,QAAM,IAAI,EAAE,KAAK;AACjB,SAAO,EAAE,SAAS,IAAI,IAAI;AAC5B;AASA,SAAS,WAAW,GAAqB;AACvC,SAAO,EAAE,MAAM,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC;AAC3D;AAEO,SAAS,YAAY,MAAgC;AAC1D,QAAM,QAAQ,SAAS,KAAK,SAAS;AACrC,QAAM,UAAU,SAAS,KAAK,WAAW;AACzC,QAAM,SAAS,SAAS,KAAK,UAAU;AACvC,QAAM,cAAc,SAAS,WAAW,MAAM,IAAI;AAClD,SAAO;AAAA,IACL,GAAG;AAAA,IACH,kBAAkB,SAAS,aAAa;AAAA,IACxC,SAAS,UAAU,WAAW,OAAO,IAAI,aAAa;AAAA,IACtD,WAAW,cAAc,CAAC,KAAK,aAAa;AAAA,IAC5C,eAAe,cAAc,YAAY,MAAM,CAAC,IAAI,aAAa;AAAA,EACnE;AACF;;;ACzGA,SAAS,gBAAgB;AACzB,SAAS,kBAAkB;AAC3B,SAAS,SAAS,YAAY;AAC9B,SAAS,qBAAqB;AAEvB,IAAM,YAAY;AAClB,IAAM,cAAc;AAgB3B,IAAI,kBAAiC;AACrC,SAAS,mBAA2B;AAClC,MAAI,gBAAiB,QAAO;AAC5B,MAAI,MAAM,QAAQ,cAAc,YAAY,GAAG,CAAC;AAChD,SAAO,MAAM;AAGX,UAAM,eAAe,KAAK,KAAK,OAAO,WAAW,qBAAqB,UAAU,WAAW;AAC3F,QAAI,WAAW,YAAY,GAAG;AAC5B,wBAAkB,QAAQ,YAAY;AACtC,aAAO;AAAA,IACT;AAGA,UAAM,gBAAgB,KAAK,KAAK,QAAQ,WAAW,qBAAqB,UAAU,WAAW;AAC7F,QAAI,WAAW,aAAa,GAAG;AAC7B,wBAAkB,QAAQ,aAAa;AACvC,aAAO;AAAA,IACT;AACA,UAAM,SAAS,QAAQ,GAAG;AAC1B,QAAI,WAAW,KAAK;AAClB,YAAM,IAAI;AAAA,QACR,uFAAuF,cAAc,YAAY,GAAG,CAAC;AAAA,MACvH;AAAA,IACF;AACA,UAAM;AAAA,EACR;AACF;AAOA,eAAsB,oBAGnB;AACD,QAAM,YAAY,iBAAiB;AACnC,QAAM,CAAC,OAAO,OAAO,IAAI,MAAM,QAAQ,IAAI;AAAA,IACzC,SAAS,KAAK,WAAW,WAAW,CAAC;AAAA,IACrC,SAAS,KAAK,WAAW,kBAAkB,CAAC;AAAA,EAC9C,CAAC;AACD,SAAO;AAAA,IACL,OAAO;AAAA,MACL,OAAO,IAAI,WAAW,KAAK;AAAA,MAC3B,aAAa;AAAA,MACb,KAAK;AAAA,MACL,UAAU;AAAA,IACZ;AAAA,IACA,SAAS;AAAA,MACP,OAAO,IAAI,WAAW,OAAO;AAAA,MAC7B,aAAa;AAAA,MACb,KAAK;AAAA,MACL,UAAU;AAAA,IACZ;AAAA,EACF;AACF;;;ACnEO,SAAS,WAAW,GAAmB;AAC5C,SAAO,EACJ,QAAQ,MAAM,OAAO,EACrB,QAAQ,MAAM,MAAM,EACpB,QAAQ,MAAM,MAAM,EACpB,QAAQ,MAAM,QAAQ,EACtB,QAAQ,MAAM,OAAO;AAC1B;AAGO,SAAS,QAAQ,KAAqB;AAC3C,MAAI;AACF,UAAM,IAAI,IAAI,IAAI,GAAG;AACrB,QAAI,EAAE,aAAa,WAAW,EAAE,aAAa,SAAU,QAAO;AAAA,EAChE,QAAQ;AAAA,EAER;AACA,SAAO;AACT;;;ACjBO,IAAM,YAAY;AAIlB,IAAM,MAAM;AACZ,IAAM,OAAO;AACpB,IAAM,SAAS;AACf,IAAM,WAAW;AACjB,IAAM,gBAAgB;AAItB,IAAM,YAAY,OAAO,SAAS;AAG3B,SAAS,SAAS,GAAmB;AAC1C,SAAO,EAAE,eAAe,OAAO;AACjC;AAQO,SAAS,qBACd,MACA,MACQ;AACR,SAAO,KACJ,IAAI,CAAC,OAAO,MAAM;AACjB,UAAM,SAAS,MAAM,KAAK,SAAS;AACnC,UAAM,SAAS,SAAS,KAAK,yBAAyB,MAAM;AAC5D,UAAM,UAAU,SAAS,oBAAoB,KAAK,iBAAiB,MAAM;AACzE,WAAO;AAAA,oCACuB,KAAK,UAAU,kBAAkB,OAAO;AAAA;AAAA,mDAEzB,MAAM;AAAA,6DACI,IAAI,gEAAgE,UAAU,KAAK,CAAC;AAAA;AAAA,gCAEjH,MAAM;AAAA,kIAC4F,SAAS;AAAA;AAAA;AAAA;AAAA,EAIvI,CAAC,EACA,KAAK,EAAE;AACZ;AAIA,IAAM,kBAID;AAAA,EACH,EAAE,OAAO,eAAe,KAAK,eAAe,OAAO,6CAAmC;AAAA,EACtF,EAAE,OAAO,sBAAsB,KAAK,iBAAiB,OAAO,qCAAgC;AAAA,EAC5F,EAAE,OAAO,kBAAkB,KAAK,iBAAiB,OAAO,6CAAmC;AAAA,EAC3F,EAAE,OAAO,kBAAkB,KAAK,OAAO,OAAO,6CAAmC;AACnF;AASO,SAAS,wBACd,YACA,OAA8C,CAAC,GACvC;AACR,QAAM,aAAa,KAAK,cAAc;AACtC,QAAM,aAAa,KAAK,MAAM,iBAAiB,KAAK,GAAG,qBAAqB,KAAK,GAAG,MAAM;AAC1F,QAAM,WAAW,KAAK,OAAO;AAC7B,QAAM,iBAAiB,KAAK,MAAM,QAAQ;AAC1C,QAAM,OAAO,gBAAgB;AAAA,IAC3B,CAAC,EAAE,OAAO,KAAK,MAAM,GAAG,MAAM;AAAA,0BACR,GAAG,2DAA2D,KAAK;AAAA,0BACnE,GAAG,0DAA0D,WAAW,GAAG,CAAC;AAAA,0BAC5E,IAAI,oHAAoH,KAAK,aAC7I,IAAI,gBAAgB,SAAS,IACzB;AAAA,4EAC8D,MAAM,qBACpE,EACN;AAAA,EACN,EAAE,KAAK,EAAE;AACT,SAAO;AAAA,oCAC2B,UAAU,IAAI,UAAU;AAAA;AAAA,0BAElC,GAAG,qDAAqD,QAAQ,iCAAiC,IAAI;AAAA,0BACrG,IAAI,+GAA+G,cAAc,4JAA4J,GAAG;AAAA;AAAA;AAG1T;AAKO,SAAS,mBACd,KACA,MACA,YACQ;AAIR,QAAM,aACJ,cAAc,aAAa,IAAI,gBAAgB,UAAU,UAAU;AACrE,MAAI,QAAQ,UAAa,SAAS,QAAW;AAC3C,WAAO,UAAU,eAAe,gBAAgB,SAAS,SAAY,SAAS,IAAI,IAAI,QAAG,EAAE;AAAA,EAC7F;AACA,MAAI,SAAS,GAAG;AACd,WAAO,MAAM,IACT,UAAU,UAAU,wCAAmC,IACvD,UAAU,eAAe,gBAAgB;AAAA,EAC/C;AACA,QAAM,MAAM,KAAK,OAAQ,MAAM,QAAQ,OAAQ,GAAG;AAClD,QAAM,QAAQ,IAAI,SAAS,IAAI,CAAC,WAAM,SAAS,GAAG,CAAC;AACnD,MAAI,MAAM,EAAG,QAAO,UAAU,UAAU,UAAK,GAAG,QAAQ,UAAU,IAAI,KAAK,EAAE;AAC7E,MAAI,MAAM,EAAG,QAAO,UAAU,eAAe,UAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,UAAU,IAAI,KAAK,EAAE;AAC5F,SAAO,UAAU,eAAe,gBAAgB,UAAU,KAAK,SAAS,IAAI,CAAC,GAAG;AAClF;AAGA,SAAS,UAAU,OAAe,MAAsB;AACtD,SAAO,mBAAmB,KAAK,+FAA+F,IAAI;AACpI;AAGA,SAAS,aAAa,MAAsB;AAC1C,SAAO,mBAAmB,IAAI,wIAAwI,IAAI;AAC5K;AAKO,SAAS,iBAAiB,MAGrB;AACV,SAAO,KAAK,YAAY,WAAc,KAAK,WAAW,UAAU,KAAK;AACvE;AAYO,SAAS,iBAAiB,MAStB;AACT,MAAI,CAAC,iBAAiB,IAAI,EAAG,QAAO;AACpC,QAAM,QAAQ,KAAK,aAAa,CAAC,GAAG,IAAI,CAAC,MAAM,UAAU,eAAe,CAAC,CAAC,EAAE,KAAK,YAAY;AAC7F,QAAM,aAAa,KAAK,iBAAiB,CAAC,GAAG,IAAI,YAAY,EAAE,KAAK,YAAY;AAChF,QAAM,aAAa,KAAK,MAAM,iBAAiB,KAAK,GAAG,qBAAqB,KAAK,GAAG,MAAM;AAC1F,QAAM,WAAW,KAAK,OAAO;AAC7B,QAAM,aACJ,KAAK,YAAY,SACb;AAAA,0BACkB,GAAG,wCAAwC,SAAS,KAAK,OAAO,CAAC;AAAA,UACjF,mBAAmB,KAAK,SAAS,KAAK,UAAU,KAAK,UAAU,CAAC,KAClE;AACN,SAAO;AAAA,oCAC2B,KAAK,UAAU,IAAI,UAAU;AAAA;AAAA,0BAEvC,GAAG,qDAAqD,QAAQ,wBAAwB,UAAU;AAAA,UAClH,IAAI;AAAA,UACJ,SAAS;AAAA;AAAA;AAGnB;;;ACzKO,IAAMA,aAAY;AAKzB,IAAM,gBAAgB,OAAO,WAAW;AAEjC,SAAS,QAAQ,GAAwB;AAK9C,MAAI,CAAC,KAAK,OAAO,MAAM,EAAE,QAAQ,CAAC,EAAG,QAAO;AAI5C,QAAM,KAAK,OAAO,EAAE,YAAY,IAAI,CAAC,EAAE,SAAS,GAAG,GAAG;AACtD,QAAM,KAAK,OAAO,EAAE,WAAW,CAAC,EAAE,SAAS,GAAG,GAAG;AACjD,QAAM,OAAO,EAAE,eAAe;AAC9B,SAAO,GAAG,EAAE,IAAI,EAAE,IAAI,IAAI;AAC5B;AAEA,SAAS,yBAAyB,MAAoB,gBAAiC;AAErF,QAAM,cACJ,mBAAmB,SACf,0BAA0B,cAAc,MACvC,KAAK,kBAAkB,CAAC,KAAK;AACpC,QAAM,OAAO,KAAK,kBAAkB,IAAI,CAAC,OAAO,MAAO,MAAM,IAAI,cAAc,KAAM;AACrF,SAAO,qBAAqB,MAAM,EAAE,YAAY,SAAS,mBAAmB,OAAO,CAAC;AACtF;AAEA,SAAS,wBAAwB,MAA4B;AAC3D,SAAO,qBAAqB,KAAK,kBAAkB;AAAA,IACjD,YAAY;AAAA,IACZ,mBAAmB;AAAA,EACrB,CAAC;AACH;AAEA,SAAS,gCAAwC;AAC/C,SAAO;AAAA;AAAA;AAAA,0DAGiD,aAAa;AAAA;AAAA;AAGvE;AAEA,SAAS,oBAAoB,MAA4B;AACvD,SAAO;AAAA;AAAA;AAAA,0BAGiB,GAAG;AAAA,0BACH,IAAI,+FAA+FA,WAAU,KAAK,YAAY,CAAC;AAAA;AAAA;AAGzJ;AAEA,SAAS,kBAAkB,MAAc,MAA4B;AACnE,SAAO;AAAA;AAAA;AAAA,0BAGiB,GAAG,2DAA2DA,WAAU,KAAK,WAAW,CAAC;AAAA,0BACzF,IAAI,+FAA+FA,WAAU,IAAI,EAAE,QAAQ,aAAa,OAAO,CAAC;AAAA;AAAA;AAG1K;AAEA,SAAS,cACP,MAC2F;AAC3F,SAAO,QAAQ,KAAK,eAAe,KAAK,gBAAgB,KAAK,aAAa;AAC5E;AAEO,SAAS,eAAe,MAA0B;AACvD,QAAM,MAAM,OAAO,KAAK,cAAc;AACtC,QAAM,MAAM,GAAGA,WAAU,KAAK,QAAQ,CAAC;AAKvC,QAAM,OAAO,UAAU,KAAK,OAAO,IAAIA,WAAU,KAAK,OAAO,IAAI;AAQjE,MAAI,cAAc,IAAI,GAAG;AACvB,WAAO,mBAAmB,IAAI,UAAU,GAAG,UAAU,GAAG,YAAY,KAAK,WAAW,yDAAyD,KAAK,aAAa;AAAA,EACjK;AACA,SAAO,mBAAmB,IAAI,UAAU,GAAG,UAAU,GAAG;AAC1D;AAEO,SAAS,iBAAiB,MAA0B;AACzD,MAAI,CAAC,cAAc,IAAI,EAAG,QAAO;AAIjC,SAAO,qEAAqE,KAAK,WAAW,MAAM,KAAK,YAAY;AACrH;AAEO,SAAS,UAAU,MAA0B;AAClD,QAAM,OAAO,KAAK,QAAQ;AAC1B,QAAM,YAAY,KAAK,eAAe;AACtC,QAAM,cAAc,iBAAiBA,WAAU,KAAK,QAAQ,CAAC;AAE7D,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kBAOS,WAAW;AAAA,MACvB,iBAAiB,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKlB,eAAe,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,0BAKJ,GAAG;AAAA,0BACH,GAAG,wCAAwC,QAAQ,KAAK,WAAW,CAAC;AAAA,0BACpE,GAAG;AAAA,0BACH,IAAI,+FAA+FA,WAAU,KAAK,gBAAgB,CAAC;AAAA;AAAA;AAAA,MAGvJ,yBAAyB,MAAM,KAAK,cAAc,CAAC;AAAA,MACnD,wBAAwB,KAAK,UAAU,CAAC;AAAA,MACxC,iBAAiB;AAAA,IACjB,SAAS,KAAK;AAAA,IACd,UAAU,KAAK;AAAA,IACf,YAAY,KAAK;AAAA,IACjB,YAAY;AAAA,IACZ,eAAe,CAACA,WAAU,KAAK,MAAM,CAAC;AAAA,EACxC,CAAC,CAAC;AAAA,MACA,YAAY,oBAAoB,IAAI,IAAI,wBAAwB,IAAI,IAAI,8BAA8B,CAAC;AAAA,MACvG,KAAK,aAAa,kBAAkB,KAAK,YAAY,IAAI,IAAI,EAAE;AAAA;AAAA;AAAA,0BAG3C,GAAG;AAAA,UACnB,KAAK,QACJ,IAAI,CAAC,MAAM,MAAM;AAKhB,UAAM,SAAS,MAAM,KAAK,QAAQ,SAAS;AAC3C,UAAM,WACJ,MAAM,IACF,UAAU,GAAG,6EACb,UAAU,IAAI;AACpB,WAAO,SACH,YAAY,QAAQ,+DAA+DA,WAAU,IAAI,CAAC,eAClG,YAAY,QAAQ,uBAAuBA,WAAU,IAAI,CAAC;AAAA,EAChE,CAAC,EACA,KAAK,YAAY,CAAC;AAAA;AAAA,0BAEH,IAAI,iJAAgJ,oBAAI,KAAK,GAAE,eAAe,CAAC,IAAIA,WAAU,KAAK,SAAS,CAAC;AAAA,0BAC5M,IAAI;AAAA,UACpB,CAAC,KAAK,WAAW,GAAG,KAAK,aAAa,EACrC;AAAA,IACC,CAAC,SACC,mBAAmB,IAAI,oIAAoIA,WAAU,IAAI,CAAC;AAAA,EAC9K,EACC,KAAK,YAAY,CAAC;AAAA;AAAA;AAAA;AAAA;AAK7B;;;AC/LA,IAAM,cAAgE;AAAA,EACpE,SAAS;AAAA,EACT,WAAW;AAAA,EACX,QAAQ;AACV;AAEA,IAAMC,OAAM;AACZ,IAAMC,QAAO;AAIb,IAAM,cAAc;AAGpB,SAAS,aAAa,MAAsB;AAC1C,SAAO,mBAAmBD,IAAG,0DAA0DE,WAAU,IAAI,CAAC;AACxG;AAIA,SAAS,aAAa,MAAc,aAAa,OAAe;AAC9D,SAAO,mBAAmBD,KAAI,4GAA4G,UAAU,KAAK,IAAI;AAC/J;AAGA,SAAS,SAAS,MAAc,aAAa,OAAe;AAC1D,SAAO,aAAaC,WAAU,IAAI,GAAG,UAAU;AACjD;AAIA,SAAS,YAAY,MAA4B;AAC/C,SAAO,GAAGA,WAAU,KAAK,eAAe,CAAC,QAAQA,WAAU,KAAK,mBAAmB,CAAC;AACtF;AAQO,SAAS,uBACd,MAC8C;AAC9C,SAAO;AAAA,IACL,SAAS,EAAE,aAAa,KAAK,iBAAiB,SAAS,KAAK,YAAY;AAAA,IACxE,cAAc,EAAE,aAAa,MAAM,SAAS,KAAK;AAAA,EACnD;AACF;AAWO,SAAS,sBAAsB,MAA0B;AAC9D,QAAM,OAAO,KAAK,QAAQ;AAC1B,QAAM,cAAc;AACpB,QAAM,MAAM,KAAK;AAEjB,QAAM,WAAW,QAAQ,OAAO,IAAI,gBAAgB,MAAM;AAC1D,QAAM,aAAa,QAAQ,OAAO,IAAI,YAAY,MAAM;AACxD,QAAM,mBAA6B,CAAC;AACpC,MAAI,KAAK,cAAc,YAAa,kBAAiB,KAAK,KAAK,yBAAyB;AACxF,MAAI,KAAK,cAAc,QAAS,kBAAiB,KAAK,KAAK,0BAA0B;AACrF,QAAM,UAAU,iBAAiB,SAAS;AAM1C,QAAM,qBACJ,KAAK,mBAAmB,SACpB,CAAC,0BAA0B,KAAK,cAAc,yBAAyB,IACvE,CAAC;AACP,QAAM,eAAe,iBAAiB;AAAA,IACpC,SAAS,KAAK;AAAA,IACd,WAAW;AAAA,EACb,CAAC;AAKD,QAAM,QAAQ,CAAC,SAAS,SAAS;AACjC,MAAI,QAAQ;AACZ,QAAM,SAAS,MAAc,MAAM,UAAU,CAAC;AAC9C,QAAM,UAAU,OAAO;AACvB,QAAM,UAAU,WAAW,OAAO,IAAI;AACtC,QAAM,SAAS,aAAa,OAAO,IAAI;AACvC,QAAM,eAAe,OAAO;AAC5B,QAAM,cAAc,eAAe,OAAO,IAAI;AAC9C,QAAM,iBAAiB,UAAU,OAAO,IAAI;AAC5C,QAAM,YAAY,OAAO;AAKzB,QAAM,qBACJ,OAAO,IAAI,gBAAgB,SACvB;AAAA,oCAC4B,OAAO,kBAAkB,WAAW;AAAA;AAAA,UAE9D,aAAa,oBAAoB,CAAC;AAAA,UAClC,aAAa,GAAGA,WAAU,GAAG,KAAK,gBAAgB,eAAe,YAAY,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,IAAI,YAAY,SAAS,IAAI,YAAY,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;AAAA;AAAA,mBAEnJ,qBAAqB,KAAK,mBAAmB;AAAA,IAC1D,YAAY;AAAA,IACZ,mBAAmB;AAAA,EACrB,CAAC,CAAC,KACE;AAIN,QAAM,iBACJ,OAAO,IAAI,YAAY,SACnB;AAAA,oCAC4B,MAAM,kBAAkB,WAAW;AAAA;AAAA,UAE7D,aAAa,SAAS,CAAC;AAAA,UACvB,aAAa,GAAGA,WAAU,GAAG,KAAK,YAAY,uBAAuB,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC;AAAA;AAAA,mBAEhH,qBAAqB,KAAK,kBAAkB;AAAA,IACzD,YAAY;AAAA,IACZ,mBAAmB;AAAA,EACrB,CAAC,CAAC,KACE;AAIN,QAAM,YAAY,eACd,iBAAiB;AAAA,IACf,SAAS,KAAK;AAAA,IACd,UAAU,KAAK;AAAA,IACf,YAAY,KAAK;AAAA,IACjB,YAAY;AAAA,IACZ,KAAK;AAAA,IACL,WAAW;AAAA,EACb,CAAC,IACD;AAIJ,QAAM,sBAAsB,UACxB;AAAA,oCAC8B,cAAc,kBAAkB,WAAW,qBAAqB,WAAW;AAAA;AAAA,UAErG,aAAa,qBAAqB,CAAC;AAAA,UACnC,iBAAiB,IAAI,CAAC,SAAS,SAAS,IAAI,CAAC,EAAE,KAAK,YAAY,CAAC;AAAA,UACjE,SAAS,KAAK,kBAAkB,MAAM,CAAC;AAAA;AAAA,qBAG3C;AAKJ,QAAM,cAAc,KAAK,QACtB;AAAA,IAAI,CAAC,MAAM,MACV,MAAM,IACF;AAAA,wBACcF,IAAG,+FAA+FE,WAAU,IAAI,CAAC,eAC/H;AAAA,wBACcD,KAAI,+FAA+FC,WAAU,IAAI,CAAC;AAAA,EACtI,EACC,KAAK,EAAE;AACV,QAAM,oBAAoB,KAAK,cAC5B;AAAA,IACC,CAAC,SAAS;AAAA,wBACQD,KAAI,oIAAoIC,WAAU,IAAI,CAAC;AAAA,EAC3K,EACC,KAAK,EAAE;AAEV,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kBAOSA,WAAU,WAAW,CAAC;AAAA,MAClC,iBAAiB,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,mBAIT,eAAe,IAAI,CAAC;AAAA;AAAA,oCAEH,OAAO,kBAAkB,WAAW,qBAAqB,WAAW;AAAA;AAAA,UAE9F,aAAa,KAAK,eAAe,CAAC;AAAA,0BAClBD,KAAI,+HAA+HC,WAAU,KAAK,QAAQ,CAAC;AAAA,UAC3K,SAAS,KAAK,YAAY,CAAC;AAAA;AAAA;AAAA,MAG/B,kBAAkB;AAAA,MAClB,cAAc;AAAA,MACd,wBAAwB,KAAK,YAAY,EAAE,YAAY,cAAc,KAAK,YAAY,CAAC,CAAC;AAAA,MACxF,SAAS;AAAA,MACT,mBAAmB;AAAA,oCACW,SAAS,kBAAkB,WAAW,qBAAqB,WAAW;AAAA;AAAA,0BAEhFF,IAAG;AAAA,UACnB,WAAW;AAAA;AAAA,0BAEKC,KAAI,iJAAgJ,oBAAI,KAAK,GAAE,eAAe,CAAC,IAAIC,WAAU,KAAK,SAAS,CAAC;AAAA,0BAC5MD,KAAI;AAAA,0BACJA,KAAI,oIAAoIC,WAAU,KAAK,SAAS,CAAC;AAAA,UACjL,iBAAiB;AAAA;AAAA;AAAA;AAAA;AAK3B;;;ACnOA,OAAO,eAAe;;;ACStB,IAAMC,OAAM;AACZ,IAAMC,QAAO;AAKN,SAAS,gBAAgB,MAA0B;AACxD,QAAM,OAAO,KAAK,QAAQ;AAC1B,QAAM,cAAc,GAAGC,WAAU,KAAK,QAAQ,CAAC;AAI/C,QAAM,YAAY,KAAK,iBACpB;AAAA,IACC,CAAC,SAAS;AAAA,wBACQD,KAAI,6IAAwIC,WAAU,IAAI,CAAC;AAAA,EAC/K,EACC,KAAK,EAAE;AAGV,QAAM,cAAc,KAAK,QACtB;AAAA,IAAI,CAAC,MAAM,MACV,MAAM,IACF;AAAA,wBACcF,IAAG,+FAA+FE,WAAU,IAAI,CAAC,eAC/H;AAAA,2GACiGA,WAAU,IAAI,CAAC;AAAA,EACtH,EACC,KAAK,EAAE;AACV,QAAM,oBAAoB,KAAK,cAC5B;AAAA,IACC,CAAC,SAAS;AAAA,wBACQD,KAAI,oIAAoIC,WAAU,IAAI,CAAC;AAAA,EAC3K,EACC,KAAK,EAAE;AAEV,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kBAOS,WAAW;AAAA,MACvB,iBAAiB,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,mBAIT,eAAe,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,0BAIbF,IAAG,2DAA2DE,WAAU,KAAK,aAAa,CAAC;AAAA,0BAC3FF,IAAG,wCAAwC,QAAQ,KAAK,WAAW,CAAC;AAAA,0BACpEC,KAAI,kHAAkHC,WAAU,KAAK,UAAU,CAAC;AAAA,UAChK,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,0BAKOF,IAAG;AAAA,UACnB,WAAW;AAAA;AAAA,0BAEKC,KAAI,iJAAgJ,oBAAI,KAAK,GAAE,eAAe,CAAC,IAAIC,WAAU,KAAK,SAAS,CAAC;AAAA,0BAC5MD,KAAI;AAAA,0BACJA,KAAI,oIAAoIC,WAAU,KAAK,SAAS,CAAC;AAAA,UACjL,iBAAiB;AAAA;AAAA;AAAA;AAAA;AAK3B;;;ADrEA,eAAsB,iBAAiB,MAAyC;AAC9E,QAAM,OACJ,KAAK,eAAe,WAChB,gBAAgB,IAAI,IACpB,KAAK,eAAe,iBAClB,sBAAsB,IAAI,IAC1B,UAAU,IAAI;AACtB,QAAM,MAAM,MAAM,UAAU,MAAM,EAAE,iBAAiB,SAAS,CAAC;AAC/D,SAAO,EAAE,MAAM,IAAI,MAAM,UAAU,IAAI,UAAU,CAAC,EAAE;AACtD;;;AELO,IAAM,wBAAyC;AAAA,EACpD,EAAE,KAAK,UAAU,OAAO,4BAA4B,OAAO,kCAAkC;AAAA,EAC7F,EAAE,KAAK,OAAO,OAAO,eAAe,OAAO,qBAAqB;AAAA,EAChE,EAAE,KAAK,UAAU,OAAO,qBAAqB,OAAO,2BAA2B;AAAA,EAC/E,EAAE,KAAK,UAAU,OAAO,kBAAkB,OAAO,wBAAwB;AAAA,EACzE,EAAE,KAAK,YAAY,OAAO,oBAAoB,OAAO,0BAA0B;AAAA,EAC/E,EAAE,KAAK,UAAU,OAAO,kBAAkB,OAAO,wBAAwB;AAC3E;AAGO,IAAM,oBAAqC;AAAA,EAChD,EAAE,KAAK,WAAW,OAAO,oBAAoB,OAAO,yBAAyB;AAAA,EAC7E,EAAE,KAAK,UAAU,OAAO,mBAAmB,OAAO,wBAAwB;AAAA,EAC1E,EAAE,KAAK,UAAU,OAAO,sBAAsB,OAAO,2BAA2B;AAAA,EAChF,EAAE,KAAK,SAAS,OAAO,sBAAsB,OAAO,2BAA2B;AAAA,EAC/E,EAAE,KAAK,SAAS,OAAO,sBAAsB,OAAO,2BAA2B;AAAA,EAC/E;AAAA,IACE,KAAK;AAAA,IACL,OAAO;AAAA,IACP,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAIA,EAAE,KAAK,WAAW,OAAO,wBAAwB,OAAO,+BAA+B;AACzF;AAGO,IAAM,uBAAiC,CAAC,GAAG,uBAAuB,GAAG,iBAAiB,EAAE;AAAA,EAC7F,CAAC,MAAM,EAAE;AACX;AASO,SAAS,aAAa,MAAmC;AAC9D,MAAI,SAAS,cAAe,QAAO;AACnC,MAAI,SAAS,UAAW,QAAO,CAAC,GAAG,uBAAuB,GAAG,iBAAiB;AAC9E,SAAO,CAAC;AACV;AAIA,IAAM,4BAAsC;AAAA,EAC1C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAOO,SAAS,aAAa,MAA4B;AACvD,MAAI,SAAS,cAAe,QAAO;AACnC,MAAI,SAAS,UAAW,QAAO,aAAa,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK;AACzE,SAAO,CAAC;AACV;AAOO,SAAS,kBAAkB,QAGtB;AACV,SAAO,aAAa,OAAO,UAAU,EAAE,MAAM,CAAC,UAAU;AACtD,UAAM,IAAI,OAAO,aAAa,KAAK,GAAG;AACtC,WAAO,MAAM,UAAU,MAAM;AAAA,EAC/B,CAAC;AACH;AAIO,SAAS,aAAa,QAGmB;AAC9C,SAAO,aAAa,OAAO,UAAU,EAAE,IAAI,CAAC,WAAW;AAAA,IACrD;AAAA,IACA,QAAQ,OAAO,aAAa,KAAK,GAAG,UAAU;AAAA,EAChD,EAAE;AACJ;AAOO,SAAS,iBAAiB,QAGrB;AACV,SAAO,OAAO,iBAAiB,OAAO,kBAAkB,IAAI,KAAK,MAAM;AACzE;;;AChHO,IAAM,gBAAgB;AAE7B,IAAM,eAAsC,CAAC,eAAe,WAAW,UAAU,cAAc;AAQxF,SAAS,aAAa,KAAqC;AAChE,MAAI,OAAQ,aAAmC,SAAS,GAAG,EAAG,QAAO;AACrE,MAAI;AACF,YAAQ,KAAK,iCAAiC,KAAK,UAAU,GAAG,CAAC,iCAA4B;AAC/F,SAAO;AACT;AAuDO,SAAS,kBAAkB,GAAuB;AACvD,SAAO,EAAE,cAAc,CAAC,EAAE,kBAAkB,EAAE,WAAW;AAC3D;AAEA,SAAS,OAAO,KAAiE;AAC/E,QAAM,IAAI,IAAI;AACd,QAAM,YAAa,EAAE,MAAM,KAA8B,CAAC;AAC1D,QAAM,QACF,EAAE,eAAe,KAA8D,CAAC,GAAG,CAAC,KAAK;AAC7F,SAAO;AAAA,IACL,IAAI,IAAI;AAAA,IACR,UAAU,OAAO,EAAE,WAAW,KAAK,EAAE;AAAA,IACrC,QAAQ,UAAU,CAAC,KAAK;AAAA,IACxB,YAAY,aAAa,EAAE,aAAa,CAAuB;AAAA,IAC/D,QAAS,EAAE,QAAQ,KAA4B;AAAA,IAC/C,aAAc,EAAE,cAAc,KAA4B;AAAA,IAC1D,WAAY,EAAE,YAAY,KAA4B;AAAA,IACtD,aAAc,EAAE,cAAc,KAA4B;AAAA,IAC1D,YAAY,qBAAqB,CAAC;AAAA,IAClC,gBAAiB,EAAE,mBAAmB,KAA4B;AAAA,IAClE,iBAAkB,EAAE,wBAAwB,KAA4B;AAAA,IACxE,kBACE,OAAO,EAAE,qBAAqB,MAAM,YAAa,EAAE,qBAAqB,IAAgB;AAAA,IAC1F,gBAAiB,EAAE,iBAAiB,KAA4B;AAAA,IAChE,gBAAiB,EAAE,kBAAkB,KAA4B;AAAA,IACjE,YAAa,EAAE,YAAY,KAA4B;AAAA,IACvD,iBAAkB,EAAE,kBAAkB,KAA4B;AAAA,IAClE,YAAY,QAAQ,EAAE,aAAa,CAAC;AAAA,IACpC,gBAAgB,QAAQ,EAAE,kBAAkB,CAAC;AAAA,IAC7C,QAAS,EAAE,SAAS,KAA4B;AAAA,IAChD,YAAa,EAAE,aAAa,KAA4B;AAAA,IACxD,YAAa,EAAE,aAAa,KAA4B;AAAA,IACxD,gBAAkB,EAAE,iBAAiB,KAA4B;AAAA,IACjE,wBAAwB;AAAA,IACxB,iBAAkB,EAAE,mBAAmB,KAA4B;AAAA,IACnE,WAAW,OAAO,YAAY,qBAAqB,IAAI,CAAC,SAAS,CAAC,MAAM,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AAAA,IAC1F,cAAc,kBAAkB,EAAE,yBAAyB,CAAC;AAAA,IAC5D,cAAc,QAAQ,EAAE,eAAe,CAAC;AAAA,IACxC,gBAAiB,EAAE,iBAAiB,KAA4B;AAAA,IAChE,YAAa,EAAE,aAAa,KAA4B;AAAA,IACxD,YAAa,EAAE,aAAa,KAA4B;AAAA,EAC1D;AACF;AAOO,SAAS,kBAAkB,KAAqD;AACrF,MAAI,OAAO,QAAQ,YAAY,CAAC,IAAI,KAAK,EAAG,QAAO;AACnD,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,EAAG,QAAO;AAI3E,QAAM,MAAsC,CAAC;AAC7C,aAAW,CAAC,OAAO,CAAC,KAAK,OAAO,QAAQ,MAAiC,GAAG;AAC1E,QAAI,CAAC,KAAK,OAAO,MAAM,SAAU;AACjC,UAAM,IAAI;AACV,QAAI,EAAE,WAAW,UAAU,EAAE,WAAW,UAAU,EAAE,WAAW,aAAa,EAAE,WAAW;AACvF;AACF,QAAI,KAAK,IAAI;AAAA,MACX,QAAQ,EAAE;AAAA,MACV,WAAW,OAAO,EAAE,cAAc,WAAW,EAAE,YAAY;AAAA,MAC3D,MAAM,OAAO,EAAE,SAAS,WAAW,EAAE,OAAO;AAAA,IAC9C;AAAA,EACF;AACA,SAAO,OAAO,KAAK,GAAG,EAAE,SAAS,IAAI,MAAM;AAC7C;AAEA,SAAS,qBAAqB,GAAqD;AACjF,QAAM,IAAI,EAAE,+BAA0B;AACtC,QAAM,IAAI,EAAE,iCAA4B;AACxC,QAAM,IAAI,EAAE,kCAA6B;AACzC,QAAM,IAAI,EAAE,uBAAkB;AAC9B,MACE,OAAO,MAAM,YACb,OAAO,MAAM,YACb,OAAO,MAAM,YACb,OAAO,MAAM;AAEb,WAAO;AACT,SAAO,EAAE,aAAa,GAAG,eAAe,GAAG,eAAe,GAAG,KAAK,EAAE;AACtE;AAuCA,SAAS,IAAI,GAAiB;AAC5B,SAAO,EAAE,YAAY,EAAE,MAAM,GAAG,EAAE;AACpC;AAQO,SAAS,oBAAoB,GAAmB;AACrD,SAAO,EAAE,QAAQ,OAAO,MAAM,EAAE,QAAQ,MAAM,KAAK;AACrD;AAEA,eAAsB,YAAY,MAAoB,OAAuC;AAI3F,QAAM,SAAmB;AAAA,IACvB,aAAa,MAAM;AAAA,IACnB,MAAM,CAAC,MAAM,MAAM;AAAA,IACnB,eAAe,MAAM;AAAA,IACrB,gBAAgB,IAAI,MAAM,WAAW;AAAA,IACrC,cAAc,IAAI,MAAM,SAAS;AAAA,IACjC,gBAAgB,IAAI,MAAM,WAAW;AAAA,IACrC,iCAA4B,MAAM,WAAW;AAAA,IAC7C,mCAA8B,MAAM,WAAW;AAAA,IAC/C,oCAA+B,MAAM,WAAW;AAAA,IAChD,yBAAoB,MAAM,WAAW;AAAA,IACrC,mBAAmB;AAAA,EACrB;AACA,MAAI,MAAM,eAAgB,QAAO,kBAAkB,IAAI,IAAI,MAAM,cAAc;AAG/E,MAAI,MAAM,mBAAmB,OAAW,QAAO,mBAAmB,IAAI,MAAM;AAC5E,MAAI,MAAM,oBAAoB,OAAW,QAAO,wBAAwB,IAAI,MAAM;AAClF,MAAI,MAAM,qBAAqB,OAAW,QAAO,qBAAqB,IAAI,MAAM;AAChF,MAAI,MAAM,mBAAmB,OAAW,QAAO,iBAAiB,IAAI,MAAM;AAC1E,MAAI,MAAM,WAAW,OAAW,QAAO,QAAQ,IAAI,MAAM;AACzD,MAAI,MAAM,oBAAoB,OAAW,QAAO,kBAAkB,IAAI,MAAM;AAI5E,aAAW,SAAS,MAAM,kBAAkB,CAAC,EAAG,QAAO,KAAK,IAAI;AAChE,MAAI,MAAM,gBAAgB,OAAO,KAAK,MAAM,YAAY,EAAE,SAAS,GAAG;AACpE,WAAO,yBAAyB,IAAI,KAAK,UAAU,MAAM,YAAY;AAAA,EACvE;AACA,QAAM,UAAW,MAAM,KAAK,aAAa,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;AAC9D,QAAM,MAAM,QAAQ,CAAC;AACrB,MAAI,CAAC,IAAK,OAAM,IAAI,MAAM,qCAAqC;AAC/D,SAAO,OAAO,EAAE,IAAI,IAAI,IAAI,QAAQ,IAAI,OAAO,CAAC;AAClD;AAEA,eAAsB,cACpB,MACA,UACA,OACe;AACf,QAAM,KAAK,aAAa,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,QAAQ,EAAE,eAAe,MAAM,EAAE,CAAC,CAAC;AACvF;AAWA,eAAsB,mBACpB,MACA,UACA,QACA,aACA,YACe;AACf,QAAM,SAAmB;AAAA,IACvB,iCAA4B,OAAO;AAAA,IACnC,mCAA8B,OAAO;AAAA,IACrC,oCAA+B,OAAO;AAAA,IACtC,yBAAoB,OAAO;AAAA,EAC7B;AACA,MAAI,YAAa,QAAO,cAAc,IAAI,IAAI,WAAW;AACzD,MAAI,YAAY,mBAAmB;AACjC,WAAO,mBAAmB,IAAI,WAAW;AAC3C,MAAI,YAAY,oBAAoB;AAClC,WAAO,wBAAwB,IAAI,WAAW;AAChD,MAAI,YAAY,qBAAqB;AACnC,WAAO,qBAAqB,IAAI,WAAW;AAC7C,MAAI,YAAY,mBAAmB;AACjC,WAAO,iBAAiB,IAAI,WAAW;AACzC,QAAM,KAAK,aAAa,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,OAAO,CAAC,CAAC;AAC7D;AAEA,eAAsB,oBAAoB,MAA0C;AAClF,QAAM,MAAmB,CAAC;AAC1B,QAAM,KAAK,aAAa,EACrB,OAAO;AAAA,IACN,iBACE;AAAA,IACF,UAAU;AAAA,EACZ,CAAC,EACA,SAAS,CAAC,SAAS,kBAAkB;AACpC,eAAW,OAAO,QAAS,KAAI,KAAK,OAAO,EAAE,IAAI,IAAI,IAAI,QAAQ,IAAI,OAAO,CAAC,CAAC;AAC9E,kBAAc;AAAA,EAChB,CAAC;AACH,SAAO;AACT;AAQA,eAAsB,eAAe,MAA0C;AAC7E,QAAM,MAAmB,CAAC;AAC1B,QAAM,KAAK,aAAa,EACrB,OAAO,EAAE,UAAU,IAAI,CAAC,EACxB,SAAS,CAAC,SAAS,kBAAkB;AACpC,eAAW,OAAO,QAAS,KAAI,KAAK,OAAO,EAAE,IAAI,IAAI,IAAI,QAAQ,IAAI,OAAO,CAAC,CAAC;AAC9E,kBAAc;AAAA,EAChB,CAAC;AACH,SAAO;AACT;AAEA,eAAsB,mBAAmB,MAAoB,QAAsC;AAGjG,UAAQ,MAAM,eAAe,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,WAAW,MAAM;AACvE;AAgBA,eAAsB,UACpB,MACA,UACA,QACA,WACe;AACf,QAAM,SAAiC,EAAE,WAAW,OAAO,YAAY,EAAE;AACzE,MAAI,cAAc,KAAM,QAAO,mBAAmB,IAAI;AACtD,QAAM,KAAK,aAAa,EAAE,OAAO;AAAA,IAC/B;AAAA,MACE,IAAI;AAAA,MACJ;AAAA,IACF;AAAA,EACF,CAAC;AACH;AA+HA,eAAsB,mBACpB,MACA,QACA,YACA,QAC2B;AAC3B,QAAM,WAAW,oBAAoB,UAAU;AAC/C,QAAM,aAAa,oBAAoB,MAAM;AAC7C,QAAM,UAAU,wBAAwB,QAAQ,kBAAkB,UAAU;AAC5E,QAAM,OAAoB,CAAC;AAC3B,QAAM,KAAK,aAAa,EACrB,OAAO,EAAE,iBAAiB,SAAS,UAAU,IAAI,CAAC,EAClD,SAAS,CAAC,SAAS,kBAAkB;AACpC,eAAW,OAAO,QAAS,MAAK,KAAK,OAAO,EAAE,IAAI,IAAI,IAAI,QAAQ,IAAI,OAAO,CAAC,CAAC;AAC/E,kBAAc;AAAA,EAChB,CAAC;AACH,SAAO,KAAK,KAAK,CAAC,MAAM,EAAE,WAAW,MAAM,KAAK;AAClD;","names":["escapeXml","RED","GREY","escapeXml","RED","GREY","escapeXml"]}

package/dist/chunk-VSHC4HOI.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/github/gh.ts"],"sourcesContent":["import { mkdtemp, rm, writeFile } from \"node:fs/promises\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport { defaultSpawn, type SpawnFn } from \"../audits/util/spawn.js\";\nimport type { ExistingRuleset, RulesetPayload } from \"./rulesets.js\";\n\n/** Aggregate CI state of a PR's head commit, normalized from GitHub's rollup. */\nexport type CiState = \"passing\" | \"failing\" | \"pending\" | \"none\";\n\n/** GitHub's computed mergeability of a PR. `UNKNOWN` is transient — GitHub is\n *  still computing it (e.g. right after a push) — so it should be read as \"not\n *  known to conflict\", never as conflicting. */\nexport type PrMergeable = \"MERGEABLE\" | \"CONFLICTING\" | \"UNKNOWN\";\n\n/** A minimal open-PR summary with its head-commit CI rollup state + mergeability. */\nexport type PullRequestSummary = {\n  number: number;\n  title: string;\n  url: string;\n  headRef: string;\n  ciState: CiState;\n  mergeable: PrMergeable;\n};\n\n/**\n * Reject a value before it's interpolated into a `gh api` URL path. The\n * `owner/repo` split methods already validate shape; this is the defense-in-depth\n * guard for the `branch` and file-`path` segments. An unexpected value (`..`, a\n * leading `/`, whitespace, or a URL-structural char like `?#%` or a backslash)\n * could otherwise retarget the endpoint (escape the intended path, smuggle a\n * query string, or traverse). Conservative by design — legit branch names like\n * `maint/self-updating-x` and paths like `.github/workflows/ci.yml` pass.\n *\n * Both branch refs (`maint/self-updating-x`) and file paths\n * (`.github/workflows/ci.yml`) legitimately contain `/`, so a single slash is\n * allowed; what's rejected is `..`, a leading `/`, whitespace, or a\n * URL-structural char (`?`, `#`, `%`, backslash) that could escape or retarget\n * the endpoint.\n */\nexport function assertUrlSegment(kind: \"branch\" | \"path\", value: string): void {\n  const structural = /[\\s?#%\\\\]|\\.\\./;\n  if (value.length === 0 || value.startsWith(\"/\") || structural.test(value)) {\n    throw new Error(\n      `unsafe ${kind} for gh api path (illegal characters or traversal): ${JSON.stringify(value)}`,\n    );\n  }\n}\n\n/** Map GitHub's `statusCheckRollup.state` enum to our normalized CiState. */\nfunction mapRollupState(state: string | null | undefined): CiState {\n  switch (state) {\n    case \"SUCCESS\":\n      return \"passing\";\n    case \"FAILURE\":\n    case \"ERROR\":\n      return \"failing\";\n    case \"PENDING\":\n    case \"EXPECTED\":\n      return \"pending\";\n    default:\n      return \"none\"; // null/undefined = no checks reported\n  }\n}\n\n/** Coerce GitHub's `mergeable` enum to our PrMergeable. Anything unexpected\n *  (including the literal `UNKNOWN` GitHub returns while still computing) maps to\n *  `UNKNOWN` — i.e. \"not known to conflict\". Only an explicit `CONFLICTING` is. */\nfunction mapMergeable(state: string | null | undefined): PrMergeable {\n  return state === \"MERGEABLE\" || state === \"CONFLICTING\" ? state : \"UNKNOWN\";\n}\n\nexport type GitHub = {\n  openPullRequest: (\n    repo: string,\n    pr: { head: string; base: string; title: string; body: string },\n  ) => Promise<{ url: string }>;\n  /** Turn GitHub's platform auto-merge ON for a repo. Retained as the documented\n   *  ROLLBACK path — the fleet drives repos to auto-merge OFF (see\n   *  {@link disableRepoAutoMerge} and `recipes/self-updating`). */\n  enableRepoAutoMerge: (repo: string) => Promise<void>;\n  /** Turn GitHub's platform auto-merge OFF for a repo. This is the fleet default:\n   *  platform auto-merge is a per-PR flag anyone with write access can arm, and it\n   *  merges unattended outside Renovate's `packageRules`. Renovate merges from\n   *  inside its own run instead. */\n  disableRepoAutoMerge: (repo: string) => Promise<void>;\n  protectBranch: (repo: string, branch: string, requiredChecks: string[]) => Promise<void>;\n  setRepoSecret: (repo: string, name: string, value: string) => Promise<void>;\n  repoExists: (repo: string) => Promise<boolean>;\n  defaultBranch: (repo: string) => Promise<string>;\n  filesOnBranch: (repo: string, branch: string, paths: string[]) => Promise<string[]>;\n  /** The raw contents of `path` on `branch`, or null when the file is absent (404).\n   *  Lets a caller detect a present-but-STALE file (content drift), where\n   *  `filesOnBranch` only sees existence. */\n  fileContentsOnBranch: (repo: string, branch: string, path: string) => Promise<string | null>;\n  branchProtectionContexts: (repo: string, branch: string) => Promise<string[]>;\n  secretExists: (repo: string, name: string) => Promise<boolean>;\n  autoMergeEnabled: (repo: string) => Promise<boolean>;\n  findOpenSelfUpdatingPR: (repo: string) => Promise<string | null>;\n  /** All open PRs on a repo with each head commit's normalized CI rollup state. */\n  openPullRequests: (repo: string) => Promise<PullRequestSummary[]>;\n  /** The default branch's latest-commit date + normalized CI rollup, one query. */\n  defaultBranchStatus: (repo: string) => Promise<{ ciState: CiState; lastCommitAt: string | null }>;\n  /** Renovate PRs (head `renovate/*`) merged at/after `sinceIso`. Used to record\n   *  `pr_automerged` fleet events. gh-shell (Actions only). */\n  mergedRenovatePullRequests: (\n    repo: string,\n    sinceIso: string,\n  ) => Promise<Array<{ number: number; title: string; url: string; mergedAt: string }>>;\n  /** Fire a `workflow_dispatch` for `<workflow>` (a filename like `renovate.yml`)\n   *  on `ref`. Requires the token's `actions:write` scope; a 404 (no such\n   *  workflow) or 403 (missing scope) surfaces as a thrown error. */\n  dispatchWorkflow: (repo: string, workflow: string, ref: string) => Promise<void>;\n  /** REPO-sourced rulesets only (`includes_parents=false`): org-level rulesets\n   *  aren't ours to manage (and don't exist on the Free plan). */\n  listRepoRulesets: (repo: string) => Promise<Array<{ id: number; name: string }>>;\n  getRuleset: (repo: string, id: number) => Promise<ExistingRuleset>;\n  createRuleset: (repo: string, payload: RulesetPayload) => Promise<void>;\n  /** The update verb is PUT — `PATCH repos/{repo}/rulesets/{id}` returns 404\n   *  (verified live 2026-08-01), so a PATCH-based update would silently no-op\n   *  on every drifted repo while the recipe reported success. */\n  updateRuleset: (repo: string, id: number, payload: RulesetPayload) => Promise<void>;\n  /** True iff a check-run named `context` exists on `ref`'s HEAD commit. The\n   *  evidence gate for requiring a status check: with an empty bypass list, a\n   *  required context that never fires makes the repo permanently unmergeable\n   *  by everyone — so a context must be OBSERVED before it is required.\n   *  False-negatives (fresh repo, API hiccup) safely degrade to \"don't require\n   *  yet\"; false-positives are impossible (we name-match real runs). */\n  checkContextObserved: (repo: string, ref: string, context: string) => Promise<boolean>;\n  /** \"public\" | \"private\" (| \"internal\" on GHEC). Rulesets on private repos\n   *  need a paid plan, so callers gate on this rather than attempting. */\n  repoVisibility: (repo: string) => Promise<string>;\n  /** Every repo in the org (paginated) — the anti-hand-typed-list enumerator.\n   *  Sweeps driven by a hand-maintained or Airtable-scoped list have already\n   *  produced two false \"all clear\"s; enumerate from the API instead.\n   *  secretScanning/pushProtection come from the same listing (no extra call);\n   *  \"unavailable\" means the token couldn't read security_and_analysis (needs\n   *  admin/security read) — callers must treat that as unverified, not fine. */\n  listOrgRepos: (org: string) => Promise<\n    Array<{\n      name: string;\n      visibility: string;\n      archived: boolean;\n      secretScanning: string;\n      pushProtection: string;\n    }>\n  >;\n  /** Liveness of one workflow file: registered? state? when did it last\n   *  SUCCEED? Success, not mere existence of a run: a dead credential or\n   *  broken config still CREATES a run on every cron tick that fails in\n   *  seconds, keeping created_at perpetually fresh — counting those as alive\n   *  is exactly the silent-stop blindness this probe exists to catch.\n   *  A clean 404 is the answer `{present: false}` — any OTHER failure throws,\n   *  because \"couldn't check\" must never read as \"healthy\" downstream. */\n  workflowHealth: (repo: string, filename: string) => Promise<WorkflowHealth>;\n};\n\nexport type WorkflowHealth =\n  { present: false } | { present: true; state: string; lastSuccessAt: string | null };\n\nexport function makeGitHub(deps: { token: string; spawn?: SpawnFn }): GitHub {\n  const spawn = deps.spawn ?? defaultSpawn;\n  const env = { ...process.env, GH_TOKEN: deps.token };\n\n  async function gh(args: string[]): Promise<string> {\n    const r = await spawn(\"gh\", args, { env, timeoutMs: 60_000 });\n    if (r.code !== 0) throw new Error(`gh ${args[0]} failed (code ${r.code}): ${r.stderr.trim()}`);\n    return r.stdout;\n  }\n\n  /** `gh api` with a JSON request body. Ruleset payloads have nested arrays/\n   *  objects that `-f`/`-F` field flags cannot express, and the spawn wrapper\n   *  has no stdin — so the body rides a private temp file via `--input`. */\n  async function ghJson(method: \"POST\" | \"PUT\", path: string, body: unknown): Promise<string> {\n    const dir = await mkdtemp(join(tmpdir(), \"gh-json-\"));\n    const file = join(dir, \"body.json\");\n    try {\n      await writeFile(file, JSON.stringify(body), \"utf-8\");\n      return await gh([\"api\", \"-X\", method, path, \"--input\", file]);\n    } finally {\n      await rm(dir, { recursive: true, force: true });\n    }\n  }\n\n  return {\n    async openPullRequest(repo, pr) {\n      const out = await gh([\n        \"pr\",\n        \"create\",\n        \"--repo\",\n        repo,\n        \"--head\",\n        pr.head,\n        \"--base\",\n        pr.base,\n        \"--title\",\n        pr.title,\n        \"--body\",\n        pr.body,\n      ]);\n      return { url: out.trim() };\n    },\n    async enableRepoAutoMerge(repo) {\n      await gh([\"api\", \"-X\", \"PATCH\", `repos/${repo}`, \"-F\", \"allow_auto_merge=true\"]);\n    },\n    async disableRepoAutoMerge(repo) {\n      await gh([\"api\", \"-X\", \"PATCH\", `repos/${repo}`, \"-F\", \"allow_auto_merge=false\"]);\n    },\n    async protectBranch(repo, branch, requiredChecks) {\n      assertUrlSegment(\"branch\", branch);\n      const args = [\n        \"api\",\n        \"-X\",\n        \"PUT\",\n        `repos/${repo}/branches/${branch}/protection`,\n        \"-H\",\n        \"Accept: application/vnd.github+json\",\n        \"-F\",\n        \"required_status_checks[strict]=true\",\n        ...requiredChecks.flatMap((c) => [\"-f\", `required_status_checks[contexts][]=${c}`]),\n        \"-F\",\n        \"enforce_admins=true\",\n        \"-F\",\n        \"required_pull_request_reviews=null\",\n        \"-F\",\n        \"restrictions=null\",\n      ];\n      await gh(args);\n    },\n    async setRepoSecret(repo, name, value) {\n      await gh([\"secret\", \"set\", name, \"--repo\", repo, \"--body\", value]);\n    },\n    async repoExists(repo) {\n      const r = await spawn(\"gh\", [\"api\", `repos/${repo}`], { env, timeoutMs: 60_000 });\n      return r.code === 0;\n    },\n    async defaultBranch(repo) {\n      const out = await gh([\"api\", `repos/${repo}`, \"--jq\", \".default_branch\"]);\n      return out.trim();\n    },\n    // filesOnBranch and branchProtectionContexts call `spawn` directly (not the\n    // throwing `gh()` helper) because a 404 is an expected, meaningful answer —\n    // \"file/protection absent\" — not an error. The remaining readers use `gh()`\n    // since a non-200 there is a genuine failure (e.g. missing token scope).\n    async filesOnBranch(repo, branch, paths) {\n      assertUrlSegment(\"branch\", branch);\n      const present: string[] = [];\n      for (const p of paths) {\n        assertUrlSegment(\"path\", p);\n        const r = await spawn(\"gh\", [`api`, `repos/${repo}/contents/${p}?ref=${branch}`], {\n          env,\n          timeoutMs: 60_000,\n        });\n        if (r.code === 0) present.push(p);\n      }\n      return present;\n    },\n    async fileContentsOnBranch(repo, branch, path) {\n      // Same spawn-directly rationale as filesOnBranch: a 404 (file absent) is an\n      // expected answer (null), not an error. The `raw` media type returns the file\n      // bytes verbatim (no base64 envelope) so the result compares directly against a\n      // canonical template.\n      assertUrlSegment(\"branch\", branch);\n      assertUrlSegment(\"path\", path);\n      const r = await spawn(\n        \"gh\",\n        [\n          \"api\",\n          `repos/${repo}/contents/${path}?ref=${branch}`,\n          \"-H\",\n          \"Accept: application/vnd.github.raw\",\n        ],\n        { env, timeoutMs: 60_000 },\n      );\n      if (r.code !== 0) return null; // 404 = file absent on this branch\n      return r.stdout;\n    },\n    async branchProtectionContexts(repo, branch) {\n      assertUrlSegment(\"branch\", branch);\n      const r = await spawn(\n        \"gh\",\n        [\n          \"api\",\n          `repos/${repo}/branches/${branch}/protection`,\n          \"--jq\",\n          \".required_status_checks.contexts[]?\",\n        ],\n        { env, timeoutMs: 60_000 },\n      );\n      if (r.code !== 0) return []; // 404 = no protection configured\n      return r.stdout\n        .split(\"\\n\")\n        .map((l) => l.trim())\n        .filter((l) => l.length > 0);\n    },\n    async secretExists(repo, name) {\n      // per_page=100: the REST default of 30 would false-negative on a repo with >30 secrets,\n      // wrongly reporting an existing secret absent (→ a needless overwrite).\n      const out = await gh([\n        \"api\",\n        `repos/${repo}/actions/secrets?per_page=100`,\n        \"--jq\",\n        \".secrets[].name\",\n      ]);\n      return out\n        .split(\"\\n\")\n        .map((l) => l.trim())\n        .includes(name);\n    },\n    async autoMergeEnabled(repo) {\n      const out = await gh([\"api\", `repos/${repo}`, \"--jq\", \".allow_auto_merge\"]);\n      return out.trim() === \"true\";\n    },\n    async findOpenSelfUpdatingPR(repo) {\n      // per_page=100: with the REST default of 30, a repo with >30 open PRs (plausible under\n      // Renovate) could page past the existing self-updating PR and open a duplicate.\n      const out = await gh([\n        \"api\",\n        `repos/${repo}/pulls?state=open&per_page=100`,\n        \"--jq\",\n        '.[] | select(.head.ref | startswith(\"maint/self-updating-\")) | .html_url',\n      ]);\n      const first = out\n        .split(\"\\n\")\n        .map((l) => l.trim())\n        .find((l) => l.length > 0);\n      return first ?? null;\n    },\n    async openPullRequests(repo) {\n      const [owner, name, ...rest] = repo.split(\"/\");\n      if (!owner || !name || rest.length > 0) {\n        throw new Error(`openPullRequests: expected \"owner/repo\", got \"${repo}\"`);\n      }\n      const query =\n        \"query($owner:String!,$name:String!){repository(owner:$owner,name:$name){\" +\n        \"pullRequests(states:OPEN,first:100,orderBy:{field:CREATED_AT,direction:DESC}){nodes{number title url headRefName mergeable \" +\n        \"commits(last:1){nodes{commit{statusCheckRollup{state}}}}}}}}\";\n      const out = await gh([\n        \"api\",\n        \"graphql\",\n        \"-f\",\n        `query=${query}`,\n        \"-F\",\n        `owner=${owner}`,\n        \"-F\",\n        `name=${name}`,\n      ]);\n      const parsed = JSON.parse(out) as {\n        data?: {\n          repository?: {\n            pullRequests?: {\n              nodes?: Array<{\n                number: number;\n                title: string;\n                url: string;\n                headRefName: string;\n                mergeable?: string;\n                commits?: {\n                  nodes?: Array<{ commit?: { statusCheckRollup?: { state?: string } } }>;\n                };\n              }>;\n            };\n          };\n        };\n      };\n      const nodes = parsed.data?.repository?.pullRequests?.nodes ?? [];\n      return nodes.map((n) => ({\n        number: n.number,\n        title: n.title,\n        url: n.url,\n        headRef: n.headRefName,\n        ciState: mapRollupState(n.commits?.nodes?.[0]?.commit?.statusCheckRollup?.state),\n        mergeable: mapMergeable(n.mergeable),\n      }));\n    },\n    async defaultBranchStatus(repo) {\n      const [owner, name, ...rest] = repo.split(\"/\");\n      if (!owner || !name || rest.length > 0) {\n        throw new Error(`defaultBranchStatus: expected \"owner/repo\", got \"${repo}\"`);\n      }\n      const query =\n        \"query($owner:String!,$name:String!){repository(owner:$owner,name:$name){\" +\n        \"defaultBranchRef{target{... on Commit{committedDate statusCheckRollup{state}}}}}}\";\n      const out = await gh([\n        \"api\",\n        \"graphql\",\n        \"-f\",\n        `query=${query}`,\n        \"-F\",\n        `owner=${owner}`,\n        \"-F\",\n        `name=${name}`,\n      ]);\n      const parsed = JSON.parse(out) as {\n        data?: {\n          repository?: {\n            defaultBranchRef?: {\n              target?: { committedDate?: string; statusCheckRollup?: { state?: string } | null };\n            } | null;\n          };\n        };\n      };\n      const target = parsed.data?.repository?.defaultBranchRef?.target;\n      return {\n        ciState: mapRollupState(target?.statusCheckRollup?.state),\n        lastCommitAt: target?.committedDate ?? null,\n      };\n    },\n    async mergedRenovatePullRequests(repo, sinceIso) {\n      const [owner, name, ...rest] = repo.split(\"/\");\n      if (!owner || !name || rest.length > 0) {\n        throw new Error(`mergedRenovatePullRequests: expected \"owner/repo\", got \"${repo}\"`);\n      }\n      // per_page=50: comfortably covers a week of Renovate merges on one repo. The\n      // list endpoint returns merged_at + head.ref, so the filter is local.\n      const out = await gh([\n        \"api\",\n        `repos/${owner}/${name}/pulls?state=closed&sort=updated&direction=desc&per_page=50`,\n      ]);\n      const arr = JSON.parse(out) as Array<{\n        number: number;\n        title: string;\n        html_url: string;\n        merged_at: string | null;\n        head?: { ref?: string };\n      }>;\n      return arr\n        .filter(\n          (p) =>\n            p.merged_at !== null &&\n            p.merged_at >= sinceIso && // ISO8601 UTC strings sort lexicographically\n            (p.head?.ref ?? \"\").startsWith(\"renovate/\"),\n        )\n        .map((p) => ({\n          number: p.number,\n          title: p.title,\n          url: p.html_url,\n          mergedAt: p.merged_at as string,\n        }));\n    },\n    async dispatchWorkflow(repo, workflow, ref) {\n      const [owner, name, ...rest] = repo.split(\"/\");\n      if (!owner || !name || rest.length > 0) {\n        throw new Error(`dispatchWorkflow: expected \"owner/repo\", got \"${repo}\"`);\n      }\n      // Every segment interpolates into the API path, so guard them all like the\n      // other write methods do (defense in depth). `owner`/`name` are the most\n      // operator-controlled (typed into Airtable's \"Git repo\"); `workflow` is a\n      // constant today; `ref` is repo-sourced. A junk value like `repo?x=1` would\n      // otherwise smuggle a query string past the bare two-part shape check.\n      assertUrlSegment(\"path\", owner);\n      assertUrlSegment(\"path\", name);\n      assertUrlSegment(\"path\", workflow);\n      assertUrlSegment(\"branch\", ref);\n      await gh([\n        \"api\",\n        \"-X\",\n        \"POST\",\n        `repos/${owner}/${name}/actions/workflows/${workflow}/dispatches`,\n        \"-f\",\n        `ref=${ref}`,\n      ]);\n    },\n    async listRepoRulesets(repo) {\n      // includes_parents=false: only rulesets SOURCED on this repo are ours to\n      // heal; an org-level ruleset (paid plans) must never be PUT from here.\n      const out = await gh([\n        \"api\",\n        `repos/${repo}/rulesets?per_page=100&includes_parents=false`,\n        \"--jq\",\n        '.[] | \"\\\\(.id)\\\\t\\\\(.name)\"',\n      ]);\n      return out\n        .split(\"\\n\")\n        .map((l) => l.trim())\n        .filter((l) => l.includes(\"\\t\")) // a tab-less line has no id/name split — never fabricate a NaN row from it\n        .map((l) => {\n          const tab = l.indexOf(\"\\t\");\n          return { id: Number(l.slice(0, tab)), name: l.slice(tab + 1) };\n        })\n        .filter((r) => Number.isSafeInteger(r.id));\n    },\n    async getRuleset(repo, id) {\n      const out = await gh([\"api\", `repos/${repo}/rulesets/${Math.trunc(id)}`]);\n      return JSON.parse(out) as ExistingRuleset;\n    },\n    async createRuleset(repo, payload) {\n      await ghJson(\"POST\", `repos/${repo}/rulesets`, payload);\n    },\n    async updateRuleset(repo, id, payload) {\n      // PUT, not PATCH: PATCH on this endpoint 404s (verified live 2026-08-01),\n      // which a naive implementation would surface as \"update failed\" at best —\n      // or, with a lenient error path, as a silent no-op reported as healed.\n      await ghJson(\"PUT\", `repos/${repo}/rulesets/${Math.trunc(id)}`, payload);\n    },\n    async checkContextObserved(repo, ref, context) {\n      assertUrlSegment(\"branch\", ref);\n      // spawn-direct (not the throwing gh()): a 404/409 — empty repo, no commits\n      // on the ref yet — is an expected answer meaning \"no evidence\", not an\n      // error. Any failure degrades to false, i.e. \"don't require the check\n      // yet\", which is the safe direction (see checkContextObserved's contract).\n      const r = await spawn(\n        \"gh\",\n        [\n          \"api\",\n          `repos/${repo}/commits/${ref}/check-runs?per_page=100`,\n          \"--jq\",\n          \".check_runs[].name\",\n        ],\n        { env, timeoutMs: 60_000 },\n      );\n      if (r.code !== 0) return false;\n      return r.stdout\n        .split(\"\\n\")\n        .map((l) => l.trim())\n        .includes(context);\n    },\n    async repoVisibility(repo) {\n      const out = await gh([\"api\", `repos/${repo}`, \"--jq\", \".visibility\"]);\n      return out.trim();\n    },\n    async listOrgRepos(org) {\n      assertUrlSegment(\"path\", org);\n      // --paginate: the org is >27 repos and the default page of 30 is exactly\n      // the trap that produced the 2026-07-31 false \"queue is empty\".\n      const out = await gh([\n        \"api\",\n        \"--paginate\",\n        `orgs/${org}/repos?per_page=100`,\n        \"--jq\",\n        '.[] | \"\\\\(.name)\\\\t\\\\(.visibility)\\\\t\\\\(.archived)\\\\t\\\\(.security_and_analysis.secret_scanning.status // \"unavailable\")\\\\t\\\\(.security_and_analysis.secret_scanning_push_protection.status // \"unavailable\")\"',\n      ]);\n      return out\n        .split(\"\\n\")\n        .map((l) => l.trim())\n        .filter((l) => l.length > 0)\n        .map((l) => {\n          const [name = \"\", visibility = \"\", archived = \"\", ss = \"\", pp = \"\"] = l.split(\"\\t\");\n          return {\n            name,\n            visibility,\n            archived: archived === \"true\",\n            secretScanning: ss || \"unavailable\",\n            pushProtection: pp || \"unavailable\",\n          };\n        });\n    },\n    async workflowHealth(repo, filename) {\n      // spawn-direct for the workflow GET: 404 (file not registered as a\n      // workflow) is an expected ANSWER, not an error. Everything else throws —\n      // per the contract, an unreadable workflow must surface as unverified.\n      const wf = await spawn(\n        \"gh\",\n        [\"api\", `repos/${repo}/actions/workflows/${filename}`, \"--jq\", \".state\"],\n        { env, timeoutMs: 60_000 },\n      );\n      if (wf.code !== 0) {\n        if (/HTTP 404/.test(wf.stderr)) return { present: false };\n        throw new Error(`workflowHealth(${repo}/${filename}) failed: ${wf.stderr.trim()}`);\n      }\n      // status=success: filter to runs that actually CONCLUDED success. Without\n      // it, a schedule whose every run fails (revoked App key, broken config)\n      // reads as hours-fresh forever while zero updates flow.\n      const runs = await gh([\n        \"api\",\n        `repos/${repo}/actions/workflows/${filename}/runs?status=success&per_page=1`,\n        \"--jq\",\n        '.workflow_runs[0].created_at // \"\"',\n      ]);\n      return { present: true, state: wf.stdout.trim(), lastSuccessAt: runs.trim() || null };\n    },\n  };\n}\n"],"mappings":";;;;;AAAA,SAAS,SAAS,IAAI,iBAAiB;AACvC,SAAS,cAAc;AACvB,SAAS,YAAY;AAqCd,SAAS,iBAAiB,MAAyB,OAAqB;AAC7E,QAAM,aAAa;AACnB,MAAI,MAAM,WAAW,KAAK,MAAM,WAAW,GAAG,KAAK,WAAW,KAAK,KAAK,GAAG;AACzE,UAAM,IAAI;AAAA,MACR,UAAU,IAAI,uDAAuD,KAAK,UAAU,KAAK,CAAC;AAAA,IAC5F;AAAA,EACF;AACF;AAGA,SAAS,eAAe,OAA2C;AACjE,UAAQ,OAAO;AAAA,IACb,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAKA,SAAS,aAAa,OAA+C;AACnE,SAAO,UAAU,eAAe,UAAU,gBAAgB,QAAQ;AACpE;AA0FO,SAAS,WAAW,MAAkD;AAC3E,QAAM,QAAQ,KAAK,SAAS;AAC5B,QAAM,MAAM,EAAE,GAAG,QAAQ,KAAK,UAAU,KAAK,MAAM;AAEnD,iBAAe,GAAG,MAAiC;AACjD,UAAM,IAAI,MAAM,MAAM,MAAM,MAAM,EAAE,KAAK,WAAW,IAAO,CAAC;AAC5D,QAAI,EAAE,SAAS,EAAG,OAAM,IAAI,MAAM,MAAM,KAAK,CAAC,CAAC,iBAAiB,EAAE,IAAI,MAAM,EAAE,OAAO,KAAK,CAAC,EAAE;AAC7F,WAAO,EAAE;AAAA,EACX;AAKA,iBAAe,OAAO,QAAwB,MAAc,MAAgC;AAC1F,UAAM,MAAM,MAAM,QAAQ,KAAK,OAAO,GAAG,UAAU,CAAC;AACpD,UAAM,OAAO,KAAK,KAAK,WAAW;AAClC,QAAI;AACF,YAAM,UAAU,MAAM,KAAK,UAAU,IAAI,GAAG,OAAO;AACnD,aAAO,MAAM,GAAG,CAAC,OAAO,MAAM,QAAQ,MAAM,WAAW,IAAI,CAAC;AAAA,IAC9D,UAAE;AACA,YAAM,GAAG,KAAK,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,IAChD;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,gBAAgB,MAAM,IAAI;AAC9B,YAAM,MAAM,MAAM,GAAG;AAAA,QACnB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,GAAG;AAAA,QACH;AAAA,QACA,GAAG;AAAA,QACH;AAAA,QACA,GAAG;AAAA,QACH;AAAA,QACA,GAAG;AAAA,MACL,CAAC;AACD,aAAO,EAAE,KAAK,IAAI,KAAK,EAAE;AAAA,IAC3B;AAAA,IACA,MAAM,oBAAoB,MAAM;AAC9B,YAAM,GAAG,CAAC,OAAO,MAAM,SAAS,SAAS,IAAI,IAAI,MAAM,uBAAuB,CAAC;AAAA,IACjF;AAAA,IACA,MAAM,qBAAqB,MAAM;AAC/B,YAAM,GAAG,CAAC,OAAO,MAAM,SAAS,SAAS,IAAI,IAAI,MAAM,wBAAwB,CAAC;AAAA,IAClF;AAAA,IACA,MAAM,cAAc,MAAM,QAAQ,gBAAgB;AAChD,uBAAiB,UAAU,MAAM;AACjC,YAAM,OAAO;AAAA,QACX;AAAA,QACA;AAAA,QACA;AAAA,QACA,SAAS,IAAI,aAAa,MAAM;AAAA,QAChC;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,GAAG,eAAe,QAAQ,CAAC,MAAM,CAAC,MAAM,sCAAsC,CAAC,EAAE,CAAC;AAAA,QAClF;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,YAAM,GAAG,IAAI;AAAA,IACf;AAAA,IACA,MAAM,cAAc,MAAM,MAAM,OAAO;AACrC,YAAM,GAAG,CAAC,UAAU,OAAO,MAAM,UAAU,MAAM,UAAU,KAAK,CAAC;AAAA,IACnE;AAAA,IACA,MAAM,WAAW,MAAM;AACrB,YAAM,IAAI,MAAM,MAAM,MAAM,CAAC,OAAO,SAAS,IAAI,EAAE,GAAG,EAAE,KAAK,WAAW,IAAO,CAAC;AAChF,aAAO,EAAE,SAAS;AAAA,IACpB;AAAA,IACA,MAAM,cAAc,MAAM;AACxB,YAAM,MAAM,MAAM,GAAG,CAAC,OAAO,SAAS,IAAI,IAAI,QAAQ,iBAAiB,CAAC;AACxE,aAAO,IAAI,KAAK;AAAA,IAClB;AAAA;AAAA;AAAA;AAAA;AAAA,IAKA,MAAM,cAAc,MAAM,QAAQ,OAAO;AACvC,uBAAiB,UAAU,MAAM;AACjC,YAAM,UAAoB,CAAC;AAC3B,iBAAW,KAAK,OAAO;AACrB,yBAAiB,QAAQ,CAAC;AAC1B,cAAM,IAAI,MAAM,MAAM,MAAM,CAAC,OAAO,SAAS,IAAI,aAAa,CAAC,QAAQ,MAAM,EAAE,GAAG;AAAA,UAChF;AAAA,UACA,WAAW;AAAA,QACb,CAAC;AACD,YAAI,EAAE,SAAS,EAAG,SAAQ,KAAK,CAAC;AAAA,MAClC;AACA,aAAO;AAAA,IACT;AAAA,IACA,MAAM,qBAAqB,MAAM,QAAQ,MAAM;AAK7C,uBAAiB,UAAU,MAAM;AACjC,uBAAiB,QAAQ,IAAI;AAC7B,YAAM,IAAI,MAAM;AAAA,QACd;AAAA,QACA;AAAA,UACE;AAAA,UACA,SAAS,IAAI,aAAa,IAAI,QAAQ,MAAM;AAAA,UAC5C;AAAA,UACA;AAAA,QACF;AAAA,QACA,EAAE,KAAK,WAAW,IAAO;AAAA,MAC3B;AACA,UAAI,EAAE,SAAS,EAAG,QAAO;AACzB,aAAO,EAAE;AAAA,IACX;AAAA,IACA,MAAM,yBAAyB,MAAM,QAAQ;AAC3C,uBAAiB,UAAU,MAAM;AACjC,YAAM,IAAI,MAAM;AAAA,QACd;AAAA,QACA;AAAA,UACE;AAAA,UACA,SAAS,IAAI,aAAa,MAAM;AAAA,UAChC;AAAA,UACA;AAAA,QACF;AAAA,QACA,EAAE,KAAK,WAAW,IAAO;AAAA,MAC3B;AACA,UAAI,EAAE,SAAS,EAAG,QAAO,CAAC;AAC1B,aAAO,EAAE,OACN,MAAM,IAAI,EACV,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC;AAAA,IAC/B;AAAA,IACA,MAAM,aAAa,MAAM,MAAM;AAG7B,YAAM,MAAM,MAAM,GAAG;AAAA,QACnB;AAAA,QACA,SAAS,IAAI;AAAA,QACb;AAAA,QACA;AAAA,MACF,CAAC;AACD,aAAO,IACJ,MAAM,IAAI,EACV,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,SAAS,IAAI;AAAA,IAClB;AAAA,IACA,MAAM,iBAAiB,MAAM;AAC3B,YAAM,MAAM,MAAM,GAAG,CAAC,OAAO,SAAS,IAAI,IAAI,QAAQ,mBAAmB,CAAC;AAC1E,aAAO,IAAI,KAAK,MAAM;AAAA,IACxB;AAAA,IACA,MAAM,uBAAuB,MAAM;AAGjC,YAAM,MAAM,MAAM,GAAG;AAAA,QACnB;AAAA,QACA,SAAS,IAAI;AAAA,QACb;AAAA,QACA;AAAA,MACF,CAAC;AACD,YAAM,QAAQ,IACX,MAAM,IAAI,EACV,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC;AAC3B,aAAO,SAAS;AAAA,IAClB;AAAA,IACA,MAAM,iBAAiB,MAAM;AAC3B,YAAM,CAAC,OAAO,MAAM,GAAG,IAAI,IAAI,KAAK,MAAM,GAAG;AAC7C,UAAI,CAAC,SAAS,CAAC,QAAQ,KAAK,SAAS,GAAG;AACtC,cAAM,IAAI,MAAM,iDAAiD,IAAI,GAAG;AAAA,MAC1E;AACA,YAAM,QACJ;AAGF,YAAM,MAAM,MAAM,GAAG;AAAA,QACnB;AAAA,QACA;AAAA,QACA;AAAA,QACA,SAAS,KAAK;AAAA,QACd;AAAA,QACA,SAAS,KAAK;AAAA,QACd;AAAA,QACA,QAAQ,IAAI;AAAA,MACd,CAAC;AACD,YAAM,SAAS,KAAK,MAAM,GAAG;AAkB7B,YAAM,QAAQ,OAAO,MAAM,YAAY,cAAc,SAAS,CAAC;AAC/D,aAAO,MAAM,IAAI,CAAC,OAAO;AAAA,QACvB,QAAQ,EAAE;AAAA,QACV,OAAO,EAAE;AAAA,QACT,KAAK,EAAE;AAAA,QACP,SAAS,EAAE;AAAA,QACX,SAAS,eAAe,EAAE,SAAS,QAAQ,CAAC,GAAG,QAAQ,mBAAmB,KAAK;AAAA,QAC/E,WAAW,aAAa,EAAE,SAAS;AAAA,MACrC,EAAE;AAAA,IACJ;AAAA,IACA,MAAM,oBAAoB,MAAM;AAC9B,YAAM,CAAC,OAAO,MAAM,GAAG,IAAI,IAAI,KAAK,MAAM,GAAG;AAC7C,UAAI,CAAC,SAAS,CAAC,QAAQ,KAAK,SAAS,GAAG;AACtC,cAAM,IAAI,MAAM,oDAAoD,IAAI,GAAG;AAAA,MAC7E;AACA,YAAM,QACJ;AAEF,YAAM,MAAM,MAAM,GAAG;AAAA,QACnB;AAAA,QACA;AAAA,QACA;AAAA,QACA,SAAS,KAAK;AAAA,QACd;AAAA,QACA,SAAS,KAAK;AAAA,QACd;AAAA,QACA,QAAQ,IAAI;AAAA,MACd,CAAC;AACD,YAAM,SAAS,KAAK,MAAM,GAAG;AAS7B,YAAM,SAAS,OAAO,MAAM,YAAY,kBAAkB;AAC1D,aAAO;AAAA,QACL,SAAS,eAAe,QAAQ,mBAAmB,KAAK;AAAA,QACxD,cAAc,QAAQ,iBAAiB;AAAA,MACzC;AAAA,IACF;AAAA,IACA,MAAM,2BAA2B,MAAM,UAAU;AAC/C,YAAM,CAAC,OAAO,MAAM,GAAG,IAAI,IAAI,KAAK,MAAM,GAAG;AAC7C,UAAI,CAAC,SAAS,CAAC,QAAQ,KAAK,SAAS,GAAG;AACtC,cAAM,IAAI,MAAM,2DAA2D,IAAI,GAAG;AAAA,MACpF;AAGA,YAAM,MAAM,MAAM,GAAG;AAAA,QACnB;AAAA,QACA,SAAS,KAAK,IAAI,IAAI;AAAA,MACxB,CAAC;AACD,YAAM,MAAM,KAAK,MAAM,GAAG;AAO1B,aAAO,IACJ;AAAA,QACC,CAAC,MACC,EAAE,cAAc,QAChB,EAAE,aAAa;AAAA,SACd,EAAE,MAAM,OAAO,IAAI,WAAW,WAAW;AAAA,MAC9C,EACC,IAAI,CAAC,OAAO;AAAA,QACX,QAAQ,EAAE;AAAA,QACV,OAAO,EAAE;AAAA,QACT,KAAK,EAAE;AAAA,QACP,UAAU,EAAE;AAAA,MACd,EAAE;AAAA,IACN;AAAA,IACA,MAAM,iBAAiB,MAAM,UAAU,KAAK;AAC1C,YAAM,CAAC,OAAO,MAAM,GAAG,IAAI,IAAI,KAAK,MAAM,GAAG;AAC7C,UAAI,CAAC,SAAS,CAAC,QAAQ,KAAK,SAAS,GAAG;AACtC,cAAM,IAAI,MAAM,iDAAiD,IAAI,GAAG;AAAA,MAC1E;AAMA,uBAAiB,QAAQ,KAAK;AAC9B,uBAAiB,QAAQ,IAAI;AAC7B,uBAAiB,QAAQ,QAAQ;AACjC,uBAAiB,UAAU,GAAG;AAC9B,YAAM,GAAG;AAAA,QACP;AAAA,QACA;AAAA,QACA;AAAA,QACA,SAAS,KAAK,IAAI,IAAI,sBAAsB,QAAQ;AAAA,QACpD;AAAA,QACA,OAAO,GAAG;AAAA,MACZ,CAAC;AAAA,IACH;AAAA,IACA,MAAM,iBAAiB,MAAM;AAG3B,YAAM,MAAM,MAAM,GAAG;AAAA,QACnB;AAAA,QACA,SAAS,IAAI;AAAA,QACb;AAAA,QACA;AAAA,MACF,CAAC;AACD,aAAO,IACJ,MAAM,IAAI,EACV,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,CAAC,MAAM,EAAE,SAAS,GAAI,CAAC,EAC9B,IAAI,CAAC,MAAM;AACV,cAAM,MAAM,EAAE,QAAQ,GAAI;AAC1B,eAAO,EAAE,IAAI,OAAO,EAAE,MAAM,GAAG,GAAG,CAAC,GAAG,MAAM,EAAE,MAAM,MAAM,CAAC,EAAE;AAAA,MAC/D,CAAC,EACA,OAAO,CAAC,MAAM,OAAO,cAAc,EAAE,EAAE,CAAC;AAAA,IAC7C;AAAA,IACA,MAAM,WAAW,MAAM,IAAI;AACzB,YAAM,MAAM,MAAM,GAAG,CAAC,OAAO,SAAS,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC,EAAE,CAAC;AACxE,aAAO,KAAK,MAAM,GAAG;AAAA,IACvB;AAAA,IACA,MAAM,cAAc,MAAM,SAAS;AACjC,YAAM,OAAO,QAAQ,SAAS,IAAI,aAAa,OAAO;AAAA,IACxD;AAAA,IACA,MAAM,cAAc,MAAM,IAAI,SAAS;AAIrC,YAAM,OAAO,OAAO,SAAS,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC,IAAI,OAAO;AAAA,IACzE;AAAA,IACA,MAAM,qBAAqB,MAAM,KAAK,SAAS;AAC7C,uBAAiB,UAAU,GAAG;AAK9B,YAAM,IAAI,MAAM;AAAA,QACd;AAAA,QACA;AAAA,UACE;AAAA,UACA,SAAS,IAAI,YAAY,GAAG;AAAA,UAC5B;AAAA,UACA;AAAA,QACF;AAAA,QACA,EAAE,KAAK,WAAW,IAAO;AAAA,MAC3B;AACA,UAAI,EAAE,SAAS,EAAG,QAAO;AACzB,aAAO,EAAE,OACN,MAAM,IAAI,EACV,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,SAAS,OAAO;AAAA,IACrB;AAAA,IACA,MAAM,eAAe,MAAM;AACzB,YAAM,MAAM,MAAM,GAAG,CAAC,OAAO,SAAS,IAAI,IAAI,QAAQ,aAAa,CAAC;AACpE,aAAO,IAAI,KAAK;AAAA,IAClB;AAAA,IACA,MAAM,aAAa,KAAK;AACtB,uBAAiB,QAAQ,GAAG;AAG5B,YAAM,MAAM,MAAM,GAAG;AAAA,QACnB;AAAA,QACA;AAAA,QACA,QAAQ,GAAG;AAAA,QACX;AAAA,QACA;AAAA,MACF,CAAC;AACD,aAAO,IACJ,MAAM,IAAI,EACV,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,EAC1B,IAAI,CAAC,MAAM;AACV,cAAM,CAAC,OAAO,IAAI,aAAa,IAAI,WAAW,IAAI,KAAK,IAAI,KAAK,EAAE,IAAI,EAAE,MAAM,GAAI;AAClF,eAAO;AAAA,UACL;AAAA,UACA;AAAA,UACA,UAAU,aAAa;AAAA,UACvB,gBAAgB,MAAM;AAAA,UACtB,gBAAgB,MAAM;AAAA,QACxB;AAAA,MACF,CAAC;AAAA,IACL;AAAA,IACA,MAAM,eAAe,MAAM,UAAU;AAInC,YAAM,KAAK,MAAM;AAAA,QACf;AAAA,QACA,CAAC,OAAO,SAAS,IAAI,sBAAsB,QAAQ,IAAI,QAAQ,QAAQ;AAAA,QACvE,EAAE,KAAK,WAAW,IAAO;AAAA,MAC3B;AACA,UAAI,GAAG,SAAS,GAAG;AACjB,YAAI,WAAW,KAAK,GAAG,MAAM,EAAG,QAAO,EAAE,SAAS,MAAM;AACxD,cAAM,IAAI,MAAM,kBAAkB,IAAI,IAAI,QAAQ,aAAa,GAAG,OAAO,KAAK,CAAC,EAAE;AAAA,MACnF;AAIA,YAAM,OAAO,MAAM,GAAG;AAAA,QACpB;AAAA,QACA,SAAS,IAAI,sBAAsB,QAAQ;AAAA,QAC3C;AAAA,QACA;AAAA,MACF,CAAC;AACD,aAAO,EAAE,SAAS,MAAM,OAAO,GAAG,OAAO,KAAK,GAAG,eAAe,KAAK,KAAK,KAAK,KAAK;AAAA,IACtF;AAAA,EACF;AACF;","names":[]}

package/dist/protection-audit-X3BHT2MB.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/audits/protection-coverage.ts","../src/cli/commands/protection-audit.ts"],"sourcesContent":["import { rulesetGaps, type ExistingRuleset } from \"../github/rulesets.js\";\nimport type { WorkflowHealth } from \"../github/gh.js\";\n\n/**\n * Org-wide protection-coverage sweep (spec:\n * docs/superpowers/specs/2026-08-02-ruleset-self-healing-design.md).\n *\n * The `self-updating` recipe HEALS fleet sites, but it runs only when someone\n * runs it, and only over Airtable-listed sites — which is exactly how the\n * `.github` repo (no Airtable row) sat with zero protection until 2026-08-01.\n * This sweep is the layer that would have caught that on its own: it\n * enumerates the org FROM THE GITHUB API — never a hand-typed or\n * Airtable-scoped list, both of which have already produced false \"all\n * clear\"s — and judges every public repo's protection by SHAPE, not by name,\n * so a differently-named but sound ruleset (reddoor-maintenance's \"Main\n * Protection\") counts.\n *\n * Since 2026-08-02 the same sweep also verifies two more posture surfaces per\n * public repo, because both regress silently and neither has any other\n * watcher:\n *  - secret scanning + push protection stay ENABLED (a repo transferred in,\n *    or an org-default flip, arrives with them off);\n *  - the renovate workflow is registered, active, and has actually RUN\n *    recently. GitHub auto-disables schedules after 60 quiet days, and\n *    schedule triggers in template-cloned files may never register at all —\n *    either way a fully-quiet repo stops receiving updates with zero signal\n *    (the 2026-08-02 sweep found two never-run and two 5-days-stale repos on\n *    its first pass).\n */\nexport type ProtectionCoverageRow = {\n  repo: string; // owner/repo\n  status: \"covered\" | \"gap\" | \"skipped\";\n  /** Human-readable: covering ruleset + whether it gates on CI, the specific\n   *  gaps, or why the repo was skipped. */\n  detail: string;\n};\n\n/** The reads the sweep needs — a subset of the GitHub factory, injected so the\n *  sweep is pure + testable (same pattern as collectGitHubSignals). */\nexport type ProtectionCoverageDeps = {\n  listOrgRepos: (org: string) => Promise<\n    Array<{\n      name: string;\n      visibility: string;\n      archived: boolean;\n      secretScanning: string;\n      pushProtection: string;\n    }>\n  >;\n  listRepoRulesets: (repo: string) => Promise<Array<{ id: number; name: string }>>;\n  getRuleset: (repo: string, id: number) => Promise<ExistingRuleset>;\n  workflowHealth: (repo: string, filename: string) => Promise<WorkflowHealth>;\n};\n\nexport const RENOVATE_WORKFLOW_FILE = \"renovate.yml\";\n\n/** Cron is twice daily, so 3 days without a SUCCESSFUL run = 6+ consecutive\n *  missed-or-failing runs — dead scheduling, dead credential, or broken\n *  config, never jitter. (Success, not run-existence: a revoked App key still\n *  creates a fresh failing run every tick.) */\nexport const RENOVATE_STALE_AFTER_DAYS = 3;\n\n/**\n * Operator-accepted gaps — the protection-audit analogue of the cockpit's\n * accepted-Watch acks: a KNOWN condition pending a real decision must not\n * comment the tracking issue every night, or the channel is tuned out by the\n * time a genuinely new gap lands in it. Constraints that keep this honest:\n * every entry is PR-reviewed, names ONE repo + ONE surface (never a blanket\n * mute), states the pending decision, and EXPIRES — past `until` the gap\n * returns on its own, so an acceptance can never quietly become permanent.\n */\nexport type AcceptedGap = {\n  repo: string; // owner/repo\n  /** Matched as a prefix of the gap detail line — surface-scoped, so an\n   *  accepted renovate gap never swallows a ruleset or secret-scanning gap. */\n  detailPrefix: string;\n  reason: string;\n  until: string; // ISO date; exclusive — the gap is live again ON this date\n};\n\n// Currently EMPTY — the only two entries (no-renovate on reddoor-maintenance\n// and .github, pending an operator supply-chain call) were retired 2026-08-02\n// when the operator approved planting Renovate on both. Add entries only for\n// a named pending decision, never as a mute.\nexport const ACCEPTED_GAPS: AcceptedGap[] = [];\n\n/** Split gaps into live vs accepted-for-now. Acceptance is per-surface (detail\n *  prefix) and expires: an entry past `until` accepts nothing. */\nexport function partitionAcceptedGaps(\n  repo: string,\n  gaps: string[],\n  now: Date,\n  accepted: AcceptedGap[] = ACCEPTED_GAPS,\n): { live: string[]; accepted: string[] } {\n  const live: string[] = [];\n  const acceptedOut: string[] = [];\n  for (const gap of gaps) {\n    const match = accepted.find(\n      (a) => a.repo === repo && gap.startsWith(a.detailPrefix) && now < new Date(a.until),\n    );\n    if (match) acceptedOut.push(`${gap} [accepted until ${match.until}: ${match.reason}]`);\n    else live.push(gap);\n  }\n  return { live, accepted: acceptedOut };\n}\n\n/** Public repos only — secret scanning is plan-gated off on private Free\n *  repos, and those are skipped before this is consulted. \"unavailable\" means\n *  the listing couldn't read security_and_analysis (token lacks admin read),\n *  which must read as unverified, not as fine. */\nexport function secretScanningGaps(repo: {\n  secretScanning: string;\n  pushProtection: string;\n}): string[] {\n  const gaps: string[] = [];\n  if (repo.secretScanning !== \"enabled\")\n    gaps.push(`secret scanning ${repo.secretScanning} (fleet floor is enabled)`);\n  if (repo.pushProtection !== \"enabled\")\n    gaps.push(`push protection ${repo.pushProtection} (fleet floor is enabled)`);\n  return gaps;\n}\n\n/** Renovate liveness verdict — judged on the last SUCCESSFUL run. The cron IS\n *  the merge cadence (platform auto-merge is off fleet-wide), so a workflow\n *  that isn't succeeding means the repo silently stops updating — the exact\n *  class the 2026-07-26 incident review called \"zero-run blindness\". */\nexport function renovateGaps(health: WorkflowHealth, now: Date): string[] {\n  if (!health.present) return [\"no renovate workflow (dependency updates never run here)\"];\n  if (health.state !== \"active\")\n    return [\n      // A disabled workflow REJECTS workflow_dispatch (HTTP 403) — it must be\n      // re-enabled first; \"just dispatch it\" is a dead-end runbook line here.\n      `renovate workflow is ${health.state} (re-enable it: \\`gh workflow enable renovate.yml -R <repo>\\`, then dispatch once)`,\n    ];\n  if (health.lastSuccessAt === null)\n    return [\n      \"renovate workflow has never succeeded (dispatch it once; if this gap returns, the schedule never registered — push a commit touching the workflow file)\",\n    ];\n  const succeededAt = Date.parse(health.lastSuccessAt);\n  if (Number.isNaN(succeededAt))\n    return [`renovate last-success timestamp unreadable: ${health.lastSuccessAt}`];\n  const days = (now.getTime() - succeededAt) / 86_400_000;\n  if (days > RENOVATE_STALE_AFTER_DAYS)\n    return [`renovate last succeeded ${Math.floor(days)}d ago (cron is twice daily)`];\n  return [];\n}\n\n/**\n * One row per org repo. Coverage = SOME repo-sourced ruleset with zero\n * stage-1 gaps (active, empty bypass, default branch covered, deletion +\n * non_fast_forward + pull_request) AND secret scanning enabled AND a live\n * renovate workflow. Whether a covering ruleset also gates on CI is reported\n * as detail, not judged: each repo's required context differs (and\n * reddoor-maintenance deliberately has none pending release-path review), so\n * the CI-gate invariant belongs to the per-site heal, which has the evidence\n * to require the RIGHT context safely.\n *\n * Private/archived repos are skipped (rulesets on private repos need a paid\n * plan; archived repos are read-only). A repo whose probe THROWS is a `gap`,\n * not a skip — \"couldn't verify\" reading as \"fine\" is the silent-green\n * failure mode this sweep exists to kill, and the tracking issue auto-closes\n * on the next clean pass, so a transient API blip costs one issue-comment.\n */\nexport async function collectProtectionCoverage(\n  org: string,\n  deps: ProtectionCoverageDeps,\n  now: Date = new Date(),\n  accepted: AcceptedGap[] = ACCEPTED_GAPS,\n): Promise<ProtectionCoverageRow[]> {\n  const rows: ProtectionCoverageRow[] = [];\n  for (const r of await deps.listOrgRepos(org)) {\n    const repo = `${org}/${r.name}`;\n    if (r.archived || r.visibility !== \"public\") {\n      rows.push({\n        repo,\n        status: \"skipped\",\n        detail: r.archived ? \"archived\" : `${r.visibility} (rulesets need a paid plan)`,\n      });\n      continue;\n    }\n    try {\n      const gaps: string[] = [];\n      let coveredDetail = \"\";\n      const rulesets = await deps.listRepoRulesets(repo);\n      if (rulesets.length === 0) {\n        gaps.push(\"no repo rulesets at all\");\n      } else {\n        const judged = await Promise.all(\n          rulesets.map(async (rs) => {\n            const full = await deps.getRuleset(repo, rs.id);\n            return { name: rs.name, full, gaps: rulesetGaps(full, null) };\n          }),\n        );\n        const covering = judged.find((j) => j.gaps.length === 0);\n        if (covering) {\n          const ciGated = (covering.full.rules ?? []).some(\n            (rule) => rule.type === \"required_status_checks\",\n          );\n          coveredDetail = `\"${covering.name}\"${ciGated ? \"\" : \" — NO CI gate (refs rules only)\"}`;\n        } else {\n          gaps.push(judged.map((j) => `\"${j.name}\": ${j.gaps.join(\"; \")}`).join(\" | \"));\n        }\n      }\n      gaps.push(...secretScanningGaps(r));\n      gaps.push(...renovateGaps(await deps.workflowHealth(repo, RENOVATE_WORKFLOW_FILE), now));\n      const { live, accepted: acked } = partitionAcceptedGaps(repo, gaps, now, accepted);\n      if (live.length > 0) {\n        // Accepted annotations still ride along for context, but only LIVE\n        // gaps make the row a gap (and thus the sweep exit 1).\n        rows.push({ repo, status: \"gap\", detail: [...live, ...acked].join(\" | \") });\n      } else if (acked.length > 0) {\n        // Judged, found wanting, deliberately acked — reported as skipped\n        // (visible every night with the reason + expiry), never as covered.\n        rows.push({ repo, status: \"skipped\", detail: acked.join(\" | \") });\n      } else {\n        rows.push({ repo, status: \"covered\", detail: coveredDetail });\n      }\n    } catch (e) {\n      rows.push({\n        repo,\n        status: \"gap\",\n        detail: `probe failed: ${e instanceof Error ? e.message : String(e)}`,\n      });\n    }\n  }\n  return rows;\n}\n","import {\n  collectProtectionCoverage,\n  type ProtectionCoverageDeps,\n} from \"../../audits/protection-coverage.js\";\nimport { makeGitHub } from \"../../github/gh.js\";\n\n/** Exit 1 on ANY gap: unlike the fleet write sweeps (majority-rule), a single\n *  unprotected public repo is a real hole, not a flake to tolerate. */\nexport function protectionAuditExitCode(gaps: number): number {\n  return gaps > 0 ? 1 : 0;\n}\n\n/** `protection-audit --org <org>`: verify every public repo in the org carries\n *  a sound branch ruleset, live secret scanning + push protection, and a\n *  renovate workflow that actually runs (see collectProtectionCoverage for the\n *  verdicts). Emits one line per repo + a machine-readable PROTECTION_AUDIT\n *  summary the nightly workflow gates its tracking issue on. A missing fleet\n *  token is a clean skip (local runs), matching github-signals. */\nexport async function runProtectionAuditCommand(\n  opts: { org?: string | undefined },\n  // Injected in tests; defaults to the real gh-CLI-backed factory.\n  depsOverride?: ProtectionCoverageDeps,\n): Promise<{ output: string; code: number }> {\n  const org = opts.org?.trim();\n  if (!org) {\n    return { output: \"protection-audit requires --org <org>\", code: 2 };\n  }\n  const token = process.env.RENOVATE_TOKEN?.trim() || process.env.GH_TOKEN?.trim();\n  if (!depsOverride && !token) {\n    return {\n      output: \"protection-audit skipped: no RENOVATE_TOKEN/GH_TOKEN (fleet read) configured.\",\n      code: 0,\n    };\n  }\n  const deps = depsOverride ?? makeGitHub({ token: token! });\n\n  const rows = await collectProtectionCoverage(org, deps);\n  const gaps = rows.filter((r) => r.status === \"gap\");\n  const covered = rows.filter((r) => r.status === \"covered\");\n  const skipped = rows.filter((r) => r.status === \"skipped\");\n\n  const lines = rows.map((r) => `${r.status.toUpperCase().padEnd(7)} ${r.repo} — ${r.detail}`);\n  lines.push(\n    `PROTECTION_AUDIT gaps=${gaps.length} covered=${covered.length} skipped=${skipped.length} total=${rows.length}`,\n  );\n  return { output: lines.join(\"\\n\"), code: protectionAuditExitCode(gaps.length) };\n}\n"],"mappings":";;;;;;;;;AAsDO,IAAM,yBAAyB;AAM/B,IAAM,4BAA4B;AAwBlC,IAAM,gBAA+B,CAAC;AAItC,SAAS,sBACd,MACA,MACA,KACA,WAA0B,eACc;AACxC,QAAM,OAAiB,CAAC;AACxB,QAAM,cAAwB,CAAC;AAC/B,aAAW,OAAO,MAAM;AACtB,UAAM,QAAQ,SAAS;AAAA,MACrB,CAAC,MAAM,EAAE,SAAS,QAAQ,IAAI,WAAW,EAAE,YAAY,KAAK,MAAM,IAAI,KAAK,EAAE,KAAK;AAAA,IACpF;AACA,QAAI,MAAO,aAAY,KAAK,GAAG,GAAG,oBAAoB,MAAM,KAAK,KAAK,MAAM,MAAM,GAAG;AAAA,QAChF,MAAK,KAAK,GAAG;AAAA,EACpB;AACA,SAAO,EAAE,MAAM,UAAU,YAAY;AACvC;AAMO,SAAS,mBAAmB,MAGtB;AACX,QAAM,OAAiB,CAAC;AACxB,MAAI,KAAK,mBAAmB;AAC1B,SAAK,KAAK,mBAAmB,KAAK,cAAc,2BAA2B;AAC7E,MAAI,KAAK,mBAAmB;AAC1B,SAAK,KAAK,mBAAmB,KAAK,cAAc,2BAA2B;AAC7E,SAAO;AACT;AAMO,SAAS,aAAa,QAAwB,KAAqB;AACxE,MAAI,CAAC,OAAO,QAAS,QAAO,CAAC,0DAA0D;AACvF,MAAI,OAAO,UAAU;AACnB,WAAO;AAAA;AAAA;AAAA,MAGL,wBAAwB,OAAO,KAAK;AAAA,IACtC;AACF,MAAI,OAAO,kBAAkB;AAC3B,WAAO;AAAA,MACL;AAAA,IACF;AACF,QAAM,cAAc,KAAK,MAAM,OAAO,aAAa;AACnD,MAAI,OAAO,MAAM,WAAW;AAC1B,WAAO,CAAC,+CAA+C,OAAO,aAAa,EAAE;AAC/E,QAAM,QAAQ,IAAI,QAAQ,IAAI,eAAe;AAC7C,MAAI,OAAO;AACT,WAAO,CAAC,2BAA2B,KAAK,MAAM,IAAI,CAAC,6BAA6B;AAClF,SAAO,CAAC;AACV;AAkBA,eAAsB,0BACpB,KACA,MACA,MAAY,oBAAI,KAAK,GACrB,WAA0B,eACQ;AAClC,QAAM,OAAgC,CAAC;AACvC,aAAW,KAAK,MAAM,KAAK,aAAa,GAAG,GAAG;AAC5C,UAAM,OAAO,GAAG,GAAG,IAAI,EAAE,IAAI;AAC7B,QAAI,EAAE,YAAY,EAAE,eAAe,UAAU;AAC3C,WAAK,KAAK;AAAA,QACR;AAAA,QACA,QAAQ;AAAA,QACR,QAAQ,EAAE,WAAW,aAAa,GAAG,EAAE,UAAU;AAAA,MACnD,CAAC;AACD;AAAA,IACF;AACA,QAAI;AACF,YAAM,OAAiB,CAAC;AACxB,UAAI,gBAAgB;AACpB,YAAM,WAAW,MAAM,KAAK,iBAAiB,IAAI;AACjD,UAAI,SAAS,WAAW,GAAG;AACzB,aAAK,KAAK,yBAAyB;AAAA,MACrC,OAAO;AACL,cAAM,SAAS,MAAM,QAAQ;AAAA,UAC3B,SAAS,IAAI,OAAO,OAAO;AACzB,kBAAM,OAAO,MAAM,KAAK,WAAW,MAAM,GAAG,EAAE;AAC9C,mBAAO,EAAE,MAAM,GAAG,MAAM,MAAM,MAAM,YAAY,MAAM,IAAI,EAAE;AAAA,UAC9D,CAAC;AAAA,QACH;AACA,cAAM,WAAW,OAAO,KAAK,CAAC,MAAM,EAAE,KAAK,WAAW,CAAC;AACvD,YAAI,UAAU;AACZ,gBAAM,WAAW,SAAS,KAAK,SAAS,CAAC,GAAG;AAAA,YAC1C,CAAC,SAAS,KAAK,SAAS;AAAA,UAC1B;AACA,0BAAgB,IAAI,SAAS,IAAI,IAAI,UAAU,KAAK,sCAAiC;AAAA,QACvF,OAAO;AACL,eAAK,KAAK,OAAO,IAAI,CAAC,MAAM,IAAI,EAAE,IAAI,MAAM,EAAE,KAAK,KAAK,IAAI,CAAC,EAAE,EAAE,KAAK,KAAK,CAAC;AAAA,QAC9E;AAAA,MACF;AACA,WAAK,KAAK,GAAG,mBAAmB,CAAC,CAAC;AAClC,WAAK,KAAK,GAAG,aAAa,MAAM,KAAK,eAAe,MAAM,sBAAsB,GAAG,GAAG,CAAC;AACvF,YAAM,EAAE,MAAM,UAAU,MAAM,IAAI,sBAAsB,MAAM,MAAM,KAAK,QAAQ;AACjF,UAAI,KAAK,SAAS,GAAG;AAGnB,aAAK,KAAK,EAAE,MAAM,QAAQ,OAAO,QAAQ,CAAC,GAAG,MAAM,GAAG,KAAK,EAAE,KAAK,KAAK,EAAE,CAAC;AAAA,MAC5E,WAAW,MAAM,SAAS,GAAG;AAG3B,aAAK,KAAK,EAAE,MAAM,QAAQ,WAAW,QAAQ,MAAM,KAAK,KAAK,EAAE,CAAC;AAAA,MAClE,OAAO;AACL,aAAK,KAAK,EAAE,MAAM,QAAQ,WAAW,QAAQ,cAAc,CAAC;AAAA,MAC9D;AAAA,IACF,SAAS,GAAG;AACV,WAAK,KAAK;AAAA,QACR;AAAA,QACA,QAAQ;AAAA,QACR,QAAQ,iBAAiB,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,CAAC;AAAA,MACrE,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO;AACT;;;AC1NO,SAAS,wBAAwB,MAAsB;AAC5D,SAAO,OAAO,IAAI,IAAI;AACxB;AAQA,eAAsB,0BACpB,MAEA,cAC2C;AAC3C,QAAM,MAAM,KAAK,KAAK,KAAK;AAC3B,MAAI,CAAC,KAAK;AACR,WAAO,EAAE,QAAQ,yCAAyC,MAAM,EAAE;AAAA,EACpE;AACA,QAAM,QAAQ,QAAQ,IAAI,gBAAgB,KAAK,KAAK,QAAQ,IAAI,UAAU,KAAK;AAC/E,MAAI,CAAC,gBAAgB,CAAC,OAAO;AAC3B,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,MAAM;AAAA,IACR;AAAA,EACF;AACA,QAAM,OAAO,gBAAgB,WAAW,EAAE,MAAc,CAAC;AAEzD,QAAM,OAAO,MAAM,0BAA0B,KAAK,IAAI;AACtD,QAAM,OAAO,KAAK,OAAO,CAAC,MAAM,EAAE,WAAW,KAAK;AAClD,QAAM,UAAU,KAAK,OAAO,CAAC,MAAM,EAAE,WAAW,SAAS;AACzD,QAAM,UAAU,KAAK,OAAO,CAAC,MAAM,EAAE,WAAW,SAAS;AAEzD,QAAM,QAAQ,KAAK,IAAI,CAAC,MAAM,GAAG,EAAE,OAAO,YAAY,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI,WAAM,EAAE,MAAM,EAAE;AAC3F,QAAM;AAAA,IACJ,yBAAyB,KAAK,MAAM,YAAY,QAAQ,MAAM,YAAY,QAAQ,MAAM,UAAU,KAAK,MAAM;AAAA,EAC/G;AACA,SAAO,EAAE,QAAQ,MAAM,KAAK,IAAI,GAAG,MAAM,wBAAwB,KAAK,MAAM,EAAE;AAChF;","names":[]}