@reddoorla/maintenance 0.81.0 → 0.83.0

package/dist/report-LV7NY5W3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/alerts/analytics-health.ts","../src/cli/commands/report.ts"],"sourcesContent":["import { escapeHtml } from \"../util/html.js\";\n\n/**\n * The GA/Search enrichment outcome of one `report --due` draft run, aggregated\n * across the sites it drafted. `softFailedSites` is how many drafted sites had GA\n * OR Search enrichment ERROR (not \"not configured\" — that's a legitimate skip);\n * `configuredSites` is how many drafted sites had analytics configured at all\n * (the subject is set AND the site has a GA4 property or a search query). The ratio\n * is what distinguishes a fleet-wide subject outage from a single transient blip.\n */\nexport type AnalyticsRunHealth = {\n  softFailedSites: number;\n  configuredSites: number;\n};\n\nexport type AnalyticsAlert = { fire: boolean; reason: string };\n\n/** A lone failure never alerts — that's a per-site config issue, not the shared-\n *  subject SPOF. Two-plus AND a majority of configured sites is the fleet signature. */\nconst MIN_FAILED_SITES = 2;\n\n/**\n * Decide whether a draft run's GA/Search soft-failures look FLEET-WIDE — i.e. the\n * one impersonated subject (`GA_SUBJECT`) lost access — rather than one site's\n * transient blip. PURE. Fires when at least {@link MIN_FAILED_SITES} configured\n * sites failed AND they are a majority (≥ half) of the analytics-configured sites\n * this run. With <2 configured sites it can't distinguish a SPOF from a one-off, so\n * it never fires (at fleet scale there are always many configured sites).\n */\nexport function assessAnalyticsAlert(h: AnalyticsRunHealth): AnalyticsAlert {\n  const { softFailedSites, configuredSites } = h;\n  const fire =\n    configuredSites >= 2 &&\n    softFailedSites >= MIN_FAILED_SITES &&\n    softFailedSites * 2 >= configuredSites;\n  const reason = fire\n    ? `${softFailedSites} of ${configuredSites} analytics-configured sites had GA/Search enrichment fail this run — the shared GA_SUBJECT likely lost access (an offboarded user, revoked property access, or a botched role-account cutover). Reports were drafted with BLANK analytics.`\n    : \"\";\n  return { fire, reason };\n}\n\n/**\n * Compose the operator alert email for a fleet-wide analytics failure. PURE — the\n * caller (the `report --due` cron) sends it best-effort via Resend only when\n * {@link assessAnalyticsAlert} fires. `dashboardUrl` is the fleet homepage link.\n */\nexport function composeAnalyticsAlertEmail(\n  h: AnalyticsRunHealth,\n  dashboardUrl: string,\n): { subject: string; html: string } {\n  const subject = `⚠ Fleet analytics enrichment failing — ${h.softFailedSites}/${h.configuredSites} sites`;\n  const { reason } = assessAnalyticsAlert(h);\n  const html = `<p><strong>${escapeHtml(reason)}</strong></p>\n<p>This usually means the Google Workspace user the service account impersonates can no longer read the GA4 / Search Console properties. Reports still send — but with blank analytics — until the subject is restored.</p>\n<p>Next step: follow the GA/Search subject runbook (<code>docs/runbooks/ga-search-role-account-cutover.md</code>) to restore or move the subject, then re-run <code>reddoor-maint report --due</code> and confirm the warning clears.</p>\n<p><a href=\"${escapeHtml(dashboardUrl)}\">Open the fleet dashboard →</a></p>`;\n  return { subject, html };\n}\n","import { openBase, readAirtableConfig, type AirtableBase } from \"../../reports/airtable/client.js\";\nimport {\n  listWebsites,\n  siteSlug,\n  updateNextDueDates,\n  type WebsiteRow,\n} from \"../../reports/airtable/websites.js\";\nimport { listAllReports, type ReportRow } from \"../../reports/airtable/reports.js\";\nimport { findDueReports, nextDueDate, reportPeriodKey } from \"../../reports/due.js\";\nimport { draftReportForSite } from \"../../reports/draft.js\";\nimport { reportTier } from \"../../reports/queue.js\";\nimport { readGaConfig } from \"../../reports/ga/config.js\";\nimport {\n  assessAnalyticsAlert,\n  composeAnalyticsAlertEmail,\n  type AnalyticsRunHealth,\n} from \"../../alerts/analytics-health.js\";\nimport type { ReportType } from \"../../reports/types.js\";\n\nexport type ReportCommandOptions = {\n  due?: boolean;\n  preview?: boolean;\n  enrich?: boolean;\n  sendReady?: boolean;\n  digest?: boolean;\n  type?: string;\n  cwd?: string;\n};\n\n/**\n * Summary line for a drafted report, reflecting the single-queue outcome. `queued === false`\n * means a higher-or-equal-tier report was already pending for the site, so this draft was\n * created but deliberately left OUT of the approve queue. A non-empty `supersededIds` means it\n * un-queued that many lower-tier drafts. `null` is the previewOnly path (no Airtable queue).\n */\nfunction draftLine(\n  reportId: string | undefined,\n  queued: boolean | null,\n  supersededIds: string[],\n  verb = \"drafted\",\n): string {\n  const id = reportId ?? \"(unknown)\";\n  if (queued === false) {\n    return `• ${verb} but NOT queued: ${id} — a higher-or-equal-tier report is already pending approval`;\n  }\n  const sup =\n    supersededIds.length > 0\n      ? ` (superseded ${supersededIds.length} lower-tier draft${supersededIds.length > 1 ? \"s\" : \"\"})`\n      : \"\";\n  return `✓ ${verb}: ${id}${sup}`;\n}\n\n/**\n * Parse the single-site `--type` flag. Only Maintenance and Testing are draftable\n * this way — Launch has the `launch <site>` command and Announcement has\n * `announce <site>`, each with its own purpose-built flow. Case-insensitive;\n * defaults to Maintenance (the historical single-site behaviour). Throws an\n * exitCode-2 usage error on anything else. PURE.\n */\nexport function parseSingleSiteReportType(raw: string | undefined): ReportType {\n  if (raw === undefined || raw.trim() === \"\") return \"Maintenance\";\n  const norm = raw.trim().toLowerCase();\n  if (norm === \"maintenance\") return \"Maintenance\";\n  if (norm === \"testing\") return \"Testing\";\n  const hint =\n    norm === \"launch\"\n      ? \" — use the `launch <site>` command\"\n      : norm === \"announcement\"\n        ? \" — use the `announce <site>` command\"\n        : \"\";\n  throw Object.assign(\n    new Error(`--type must be Maintenance or Testing (got ${JSON.stringify(raw)})${hint}`),\n    { exitCode: 2 },\n  );\n}\n\n/** Dashboard origin for digest /s/<slug> links. DASHBOARD_BASE_URL overrides the\n *  production default; the trailing slash (if any) is trimmed by runDigest. */\nfunction dashboardBaseUrl(): string {\n  return process.env.DASHBOARD_BASE_URL?.trim() || \"https://reddoor-maintenance.netlify.app\";\n}\n\nexport async function runReportCommand(\n  slug: string | undefined,\n  opts: ReportCommandOptions,\n): Promise<{ output: string; code: number }> {\n  if (opts.digest) {\n    const { runDigest } = await import(\"../../reports/digest.js\");\n    return runDigest({ baseUrl: dashboardBaseUrl() });\n  }\n\n  if (opts.sendReady) {\n    const { sendApprovedReports } = await import(\"../../reports/send/orchestrate.js\");\n    return sendApprovedReports();\n  }\n\n  if (opts.due) {\n    return runDueDraft();\n  }\n\n  if (slug) {\n    // Validate the type BEFORE any Airtable access so a bad --type fails fast (and\n    // without needing credentials).\n    const reportType = parseSingleSiteReportType(opts.type);\n    return runSingleSiteDraft(slug, {\n      previewOnly: Boolean(opts.preview),\n      enrich: Boolean(opts.enrich),\n      reportType,\n    });\n  }\n\n  throw Object.assign(\n    new Error(\n      \"Usage: reddoor-maint report [<slug>] [--type <Maintenance|Testing>] [--due] [--preview] [--enrich] [--send-ready] [--digest]\",\n    ),\n    {\n      exitCode: 2,\n    },\n  );\n}\n\nasync function runDueDraft(): Promise<{ output: string; code: number }> {\n  const base = openBase(readAirtableConfig());\n  const result = await draftDueReports(base, new Date());\n  await alertOnFleetAnalyticsFailure(result.health);\n  return { output: result.output, code: result.code };\n}\n\n/** Best-effort: when a draft run's GA/Search soft-failures look FLEET-WIDE (the shared\n *  GA_SUBJECT lost access — see assessAnalyticsAlert), email the operator one alert.\n *  NEVER throws — a Resend or config hiccup must not fail the nightly draft cron; the\n *  per-site `⚠ GA skipped` warnings + the run-output line still carry the signal. The\n *  daily idempotency key dedupes multiple runs in one day (Resend dedupes 24h). */\nasync function alertOnFleetAnalyticsFailure(health: AnalyticsRunHealth): Promise<void> {\n  if (!assessAnalyticsAlert(health).fire) return;\n  try {\n    const to = process.env.OPERATOR_EMAIL?.trim() || \"info@reddoorla.com\";\n    const { subject, html } = composeAnalyticsAlertEmail(health, dashboardBaseUrl());\n    const { defaultResendClient } = await import(\"../../reports/send/resend.js\");\n    await defaultResendClient().send({\n      from: \"Reddoor Reports <reports@reddoorla.com>\",\n      to: [to],\n      subject,\n      html,\n      idempotencyKey: `analytics-alert-${new Date().toISOString().slice(0, 10)}`,\n    });\n    console.warn(`⚠ ${subject} — operator alerted (${to})`);\n  } catch (e) {\n    console.warn(`⚠ analytics-failure alert send failed: ${(e as Error).message}`);\n  }\n}\n\n/**\n * Write each site's code-computed next-maintenance / next-testing date back to Airtable\n * (date-only, or null when there's no schedule), so the \"next\" dates shown there derive\n * from the SAME `nextDueDate` the scheduler uses — replacing the old Airtable formula +\n * automation. Best-effort and per-site isolated: a missing `Next … at` column or one bad\n * row warns and is skipped, never aborting the nightly draft run.\n */\nasync function writeNextDueDates(\n  base: AirtableBase,\n  websites: WebsiteRow[],\n  reports: ReportRow[],\n  today: Date,\n): Promise<void> {\n  const ymd = (d: Date | null): string | null => (d ? d.toISOString().slice(0, 10) : null);\n  for (const site of websites) {\n    try {\n      await updateNextDueDates(base, site.id, {\n        maintenanceAt: ymd(nextDueDate(site, reports, \"Maintenance\", today)),\n        testingAt: ymd(nextDueDate(site, reports, \"Testing\", today)),\n      });\n    } catch (e) {\n      console.warn(`⚠ next-due write skipped for ${site.name}: ${(e as Error).message}`);\n    }\n  }\n}\n\nexport async function draftDueReports(\n  base: AirtableBase,\n  today: Date,\n): Promise<{ output: string; code: number; health: AnalyticsRunHealth }> {\n  const websites = await listWebsites(base);\n  // ONE unfiltered fetch for the whole fleet. Per-site queries can't be pushed to\n  // Airtable anyway (linked-record fields aren't formula-filterable by record id),\n  // and findDueReports + the period guard below match on siteId in memory.\n  const reports = await listAllReports(base);\n\n  // Refresh every site's code-owned next-due dates first, so they stay current even on\n  // a run where nothing is due (the early return below).\n  await writeNextDueDates(base, websites, reports, today);\n\n  const due = findDueReports(websites, reports, today);\n\n  // GA/Search enrichment is configured globally (the impersonation subject) AND\n  // per-site (a GA4 property or a search query). `gaConfigured` is the global half;\n  // the per-site half is checked as each draft runs, to build the fleet-wide\n  // analytics-failure alert's denominator (see alertOnFleetAnalyticsFailure).\n  const gaConfigured = readGaConfig() !== null;\n  // Truthy (not `!== null`) to mirror fetchGaUsers/fetchSearch's own gate exactly\n  // (`!siteRow.ga4PropertyId`), so an empty-string cell counts as not-configured in\n  // BOTH places and can't inflate the alert denominator.\n  const isAnalyticsConfigured = (s: WebsiteRow): boolean =>\n    gaConfigured && Boolean(s.ga4PropertyId || s.searchQuery);\n\n  if (due.length === 0) {\n    return {\n      output: \"No reports due.\",\n      code: 0,\n      health: { softFailedSites: 0, configuredSites: 0 },\n    };\n  }\n\n  const lines: string[] = [];\n  let softFailedSites = 0;\n  let searchDefaultMisses = 0;\n  let searchPropertiesMissing = 0;\n  let gaConfiguredSites = 0;\n  let skipped = 0;\n  for (const item of due) {\n    // Idempotency: a re-run must not re-draft a (site, type) already drafted this\n    // recurrence. The dueDate's YYYY-MM is the stable per-cycle key. Match against the\n    // reports we already fetched — no extra query on the hot path.\n    const period = reportPeriodKey(item.dueDate);\n    const existing = reports.find(\n      (r) => r.siteId === item.site.id && r.reportType === item.reportType && r.period === period,\n    );\n\n    // A row already exists for THIS period. Two cases:\n    //   - Draft ready → truly done, skip (the idempotent re-run path).\n    //   - NOT ready → a crash between createDraft and setDraftReady wedged it: the\n    //     row exists (so we never re-draft) yet it's never sendable (listSendable\n    //     needs Draft ready). COMPLETE it in place instead of skipping forever —\n    //     re-render → re-upload the HTML → flip Draft ready on the EXISTING row.\n    if (existing) {\n      if (existing.draftReady) {\n        skipped++;\n        lines.push(`• skipped (already drafted ${period}): ${item.site.name} ${item.reportType}`);\n        continue;\n      }\n      // A not-ready row is normally a crash between createDraft and setDraftReady — re-complete\n      // it in place. BUT queueDraft also clears Draft ready on rows it supersedes/blocks, and\n      // those must NOT be re-completed: doing so would re-render and APPEND a duplicate HTML\n      // attachment every nightly run, only to be re-blocked. Distinguish the two: if a\n      // higher-or-equal-tier report is still pending for this site, this row was intentionally\n      // un-queued (not crashed) — skip it until the blocker is sent/approved or the month rolls.\n      const blockedByPending = reports.some(\n        (r) =>\n          r.siteId === item.site.id &&\n          r.id !== existing.id &&\n          r.sentAt === null &&\n          r.draftReady &&\n          reportTier(r.reportType) >= reportTier(item.reportType),\n      );\n      if (blockedByPending) {\n        skipped++;\n        lines.push(\n          `• skipped (superseded — a higher-or-equal-tier report is pending): ${item.site.name} ${item.reportType}`,\n        );\n        continue;\n      }\n      try {\n        const result = await draftReportForSite(base, item.site, item.reportType, {\n          period,\n          completeRowId: existing.id,\n          existingRow: existing,\n        });\n        existing.draftReady = result.queued === true;\n        lines.push(\n          draftLine(\n            result.reportRow?.reportId ?? existing.reportId,\n            result.queued,\n            result.supersededIds,\n            \"completed half-made draft\",\n          ),\n        );\n        if (isAnalyticsConfigured(item.site)) gaConfiguredSites++;\n        if (result.softFailures.length > 0) softFailedSites++;\n        if (result.searchDefaultMissed) searchDefaultMisses++;\n        if (result.searchPropertyMissing) searchPropertiesMissing++;\n      } catch (e) {\n        lines.push(`✗ failed: ${item.site.name} ${item.reportType} — ${(e as Error).message}`);\n      }\n      continue;\n    }\n\n    // Pile-up guard: don't accrue a fresh new-period draft every recurrence for a\n    // site nobody ever approves. The period key follows the DUE month, so each\n    // recurrence wants a new (later-period) draft — but if a PRIOR draft is still\n    // pending approval, a new one just stacks. Skip creating the new one while an\n    // earlier-period draft for this (site, type) sits ready-but-unsent.\n    //\n    // `r.draftReady` is load-bearing: a draft a higher tier SUPERSEDED has\n    // draftReady=false and never gets a Sent at, so without this clause it would\n    // match (sentAt null + earlier period) and block EVERY future draft for the\n    // site forever. Pending-approval means draftReady=true AND sentAt=null.\n    const pendingEarlier = reports.find(\n      (r) =>\n        r.siteId === item.site.id &&\n        r.reportType === item.reportType &&\n        r.draftReady &&\n        r.sentAt === null &&\n        r.period !== null &&\n        r.period < period,\n    );\n    if (pendingEarlier) {\n      skipped++;\n      lines.push(\n        `• skipped: ${item.site.name} ${item.reportType} already has an unsent ${pendingEarlier.period} draft pending approval`,\n      );\n      continue;\n    }\n\n    try {\n      // Pass the SAME key the guard searches by, so the stamped Period always\n      // matches a future run's reportPeriodKey(dueDate) — even if this run lags\n      // into a later month than the dueDate.\n      const result = await draftReportForSite(base, item.site, item.reportType, { period });\n      lines.push(draftLine(result.reportRow?.reportId, result.queued, result.supersededIds));\n      // Keep the in-memory snapshot current so the guard's `.some()` check on the\n      // NEXT iteration of this same run catches a row we JUST created — rather than\n      // relying on findDueReports never emitting two items for the same (site, type).\n      if (result.reportRow) reports.push(result.reportRow);\n      // Count sites (not individual GA/Search failures) so a fleet-wide enrichment\n      // outage is one obvious line at the bottom, not 200 buried console.warns.\n      if (isAnalyticsConfigured(item.site)) gaConfiguredSites++;\n      if (result.softFailures.length > 0) softFailedSites++;\n      if (result.searchDefaultMissed) searchDefaultMisses++;\n      if (result.searchPropertyMissing) searchPropertiesMissing++;\n    } catch (e) {\n      lines.push(`✗ failed: ${item.site.name} ${item.reportType} — ${(e as Error).message}`);\n    }\n  }\n  if (skipped > 0) {\n    lines.push(`• ${skipped} already drafted or pending this period`);\n  }\n  if (softFailedSites > 0) {\n    lines.push(\n      `⚠ ${softFailedSites} site${softFailedSites === 1 ? \"\" : \"s\"} had GA/Search enrichment fail — drafted with blank analytics; check the logs above`,\n    );\n  }\n  if (searchDefaultMisses > 0) {\n    lines.push(\n      `⚑ ${searchDefaultMisses} site${searchDefaultMisses === 1 ? \"\" : \"s\"} returned no Search Console data for their name — set an explicit \"Search query\" in Airtable to track brand presence.`,\n    );\n  }\n  if (searchPropertiesMissing > 0) {\n    lines.push(\n      `⚑ ${searchPropertiesMissing} site${searchPropertiesMissing === 1 ? \"\" : \"s\"} matched NO Search Console property — verify the domain property exists and the service account has access (a \"Search query\" change cannot fix this).`,\n    );\n  }\n  return {\n    output: lines.join(\"\\n\"),\n    code: lines.some((l) => l.startsWith(\"✗\")) ? 1 : 0,\n    health: { softFailedSites, configuredSites: gaConfiguredSites },\n  };\n}\n\nasync function runSingleSiteDraft(\n  slug: string,\n  opts: { previewOnly: boolean; enrich: boolean; reportType: ReportType },\n): Promise<{ output: string; code: number }> {\n  const base = openBase(readAirtableConfig());\n  const websites = await listWebsites(base);\n  const site = websites.find((w) => siteSlug(w.name) === slug);\n  if (!site) {\n    throw Object.assign(new Error(`No Websites row matched slug \"${slug}\"`), { exitCode: 2 });\n  }\n  const result = await draftReportForSite(opts.previewOnly ? null : base, site, opts.reportType, {\n    previewOnly: opts.previewOnly,\n    // Only forced on. Left undefined, draftReportForSite keeps its default\n    // (enrich iff there is a base), so the real drafting path is untouched.\n    ...(opts.enrich ? { enrich: true } : {}),\n  });\n  if (opts.previewOnly) {\n    return { output: `Preview written to ${result.htmlPath}`, code: 0 };\n  }\n  return {\n    output: draftLine(\n      result.reportRow?.reportId,\n      result.queued,\n      result.supersededIds,\n      \"Draft created\",\n    ),\n    code: 0,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmBA,IAAM,mBAAmB;AAUlB,SAAS,qBAAqB,GAAuC;AAC1E,QAAM,EAAE,iBAAiB,gBAAgB,IAAI;AAC7C,QAAM,OACJ,mBAAmB,KACnB,mBAAmB,oBACnB,kBAAkB,KAAK;AACzB,QAAM,SAAS,OACX,GAAG,eAAe,OAAO,eAAe,oPACxC;AACJ,SAAO,EAAE,MAAM,OAAO;AACxB;AAOO,SAAS,2BACd,GACA,cACmC;AACnC,QAAM,UAAU,oDAA0C,EAAE,eAAe,IAAI,EAAE,eAAe;AAChG,QAAM,EAAE,OAAO,IAAI,qBAAqB,CAAC;AACzC,QAAM,OAAO,cAAc,WAAW,MAAM,CAAC;AAAA;AAAA;AAAA,cAGjC,WAAW,YAAY,CAAC;AACpC,SAAO,EAAE,SAAS,KAAK;AACzB;;;ACtBA,SAAS,UACP,UACA,QACA,eACA,OAAO,WACC;AACR,QAAM,KAAK,YAAY;AACvB,MAAI,WAAW,OAAO;AACpB,WAAO,UAAK,IAAI,oBAAoB,EAAE;AAAA,EACxC;AACA,QAAM,MACJ,cAAc,SAAS,IACnB,gBAAgB,cAAc,MAAM,oBAAoB,cAAc,SAAS,IAAI,MAAM,EAAE,MAC3F;AACN,SAAO,UAAK,IAAI,KAAK,EAAE,GAAG,GAAG;AAC/B;AASO,SAAS,0BAA0B,KAAqC;AAC7E,MAAI,QAAQ,UAAa,IAAI,KAAK,MAAM,GAAI,QAAO;AACnD,QAAM,OAAO,IAAI,KAAK,EAAE,YAAY;AACpC,MAAI,SAAS,cAAe,QAAO;AACnC,MAAI,SAAS,UAAW,QAAO;AAC/B,QAAM,OACJ,SAAS,WACL,4CACA,SAAS,iBACP,8CACA;AACR,QAAM,OAAO;AAAA,IACX,IAAI,MAAM,8CAA8C,KAAK,UAAU,GAAG,CAAC,IAAI,IAAI,EAAE;AAAA,IACrF,EAAE,UAAU,EAAE;AAAA,EAChB;AACF;AAIA,SAAS,mBAA2B;AAClC,SAAO,QAAQ,IAAI,oBAAoB,KAAK,KAAK;AACnD;AAEA,eAAsB,iBACpB,MACA,MAC2C;AAC3C,MAAI,KAAK,QAAQ;AACf,UAAM,EAAE,UAAU,IAAI,MAAM,OAAO,sBAAyB;AAC5D,WAAO,UAAU,EAAE,SAAS,iBAAiB,EAAE,CAAC;AAAA,EAClD;AAEA,MAAI,KAAK,WAAW;AAClB,UAAM,EAAE,oBAAoB,IAAI,MAAM,OAAO,2BAAmC;AAChF,WAAO,oBAAoB;AAAA,EAC7B;AAEA,MAAI,KAAK,KAAK;AACZ,WAAO,YAAY;AAAA,EACrB;AAEA,MAAI,MAAM;AAGR,UAAM,aAAa,0BAA0B,KAAK,IAAI;AACtD,WAAO,mBAAmB,MAAM;AAAA,MAC9B,aAAa,QAAQ,KAAK,OAAO;AAAA,MACjC,QAAQ,QAAQ,KAAK,MAAM;AAAA,MAC3B;AAAA,IACF,CAAC;AAAA,EACH;AAEA,QAAM,OAAO;AAAA,IACX,IAAI;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,UAAU;AAAA,IACZ;AAAA,EACF;AACF;AAEA,eAAe,cAAyD;AACtE,QAAM,OAAO,SAAS,mBAAmB,CAAC;AAC1C,QAAM,SAAS,MAAM,gBAAgB,MAAM,oBAAI,KAAK,CAAC;AACrD,QAAM,6BAA6B,OAAO,MAAM;AAChD,SAAO,EAAE,QAAQ,OAAO,QAAQ,MAAM,OAAO,KAAK;AACpD;AAOA,eAAe,6BAA6B,QAA2C;AACrF,MAAI,CAAC,qBAAqB,MAAM,EAAE,KAAM;AACxC,MAAI;AACF,UAAM,KAAK,QAAQ,IAAI,gBAAgB,KAAK,KAAK;AACjD,UAAM,EAAE,SAAS,KAAK,IAAI,2BAA2B,QAAQ,iBAAiB,CAAC;AAC/E,UAAM,EAAE,oBAAoB,IAAI,MAAM,OAAO,sBAA8B;AAC3E,UAAM,oBAAoB,EAAE,KAAK;AAAA,MAC/B,MAAM;AAAA,MACN,IAAI,CAAC,EAAE;AAAA,MACP;AAAA,MACA;AAAA,MACA,gBAAgB,oBAAmB,oBAAI,KAAK,GAAE,YAAY,EAAE,MAAM,GAAG,EAAE,CAAC;AAAA,IAC1E,CAAC;AACD,YAAQ,KAAK,UAAK,OAAO,6BAAwB,EAAE,GAAG;AAAA,EACxD,SAAS,GAAG;AACV,YAAQ,KAAK,+CAA2C,EAAY,OAAO,EAAE;AAAA,EAC/E;AACF;AASA,eAAe,kBACb,MACA,UACA,SACA,OACe;AACf,QAAM,MAAM,CAAC,MAAmC,IAAI,EAAE,YAAY,EAAE,MAAM,GAAG,EAAE,IAAI;AACnF,aAAW,QAAQ,UAAU;AAC3B,QAAI;AACF,YAAM,mBAAmB,MAAM,KAAK,IAAI;AAAA,QACtC,eAAe,IAAI,YAAY,MAAM,SAAS,eAAe,KAAK,CAAC;AAAA,QACnE,WAAW,IAAI,YAAY,MAAM,SAAS,WAAW,KAAK,CAAC;AAAA,MAC7D,CAAC;AAAA,IACH,SAAS,GAAG;AACV,cAAQ,KAAK,qCAAgC,KAAK,IAAI,KAAM,EAAY,OAAO,EAAE;AAAA,IACnF;AAAA,EACF;AACF;AAEA,eAAsB,gBACpB,MACA,OACuE;AACvE,QAAM,WAAW,MAAM,aAAa,IAAI;AAIxC,QAAM,UAAU,MAAM,eAAe,IAAI;AAIzC,QAAM,kBAAkB,MAAM,UAAU,SAAS,KAAK;AAEtD,QAAM,MAAM,eAAe,UAAU,SAAS,KAAK;AAMnD,QAAM,eAAe,aAAa,MAAM;AAIxC,QAAM,wBAAwB,CAAC,MAC7B,gBAAgB,QAAQ,EAAE,iBAAiB,EAAE,WAAW;AAE1D,MAAI,IAAI,WAAW,GAAG;AACpB,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ,EAAE,iBAAiB,GAAG,iBAAiB,EAAE;AAAA,IACnD;AAAA,EACF;AAEA,QAAM,QAAkB,CAAC;AACzB,MAAI,kBAAkB;AACtB,MAAI,sBAAsB;AAC1B,MAAI,0BAA0B;AAC9B,MAAI,oBAAoB;AACxB,MAAI,UAAU;AACd,aAAW,QAAQ,KAAK;AAItB,UAAM,SAAS,gBAAgB,KAAK,OAAO;AAC3C,UAAM,WAAW,QAAQ;AAAA,MACvB,CAAC,MAAM,EAAE,WAAW,KAAK,KAAK,MAAM,EAAE,eAAe,KAAK,cAAc,EAAE,WAAW;AAAA,IACvF;AAQA,QAAI,UAAU;AACZ,UAAI,SAAS,YAAY;AACvB;AACA,cAAM,KAAK,mCAA8B,MAAM,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,UAAU,EAAE;AACxF;AAAA,MACF;AAOA,YAAM,mBAAmB,QAAQ;AAAA,QAC/B,CAAC,MACC,EAAE,WAAW,KAAK,KAAK,MACvB,EAAE,OAAO,SAAS,MAClB,EAAE,WAAW,QACb,EAAE,cACF,WAAW,EAAE,UAAU,KAAK,WAAW,KAAK,UAAU;AAAA,MAC1D;AACA,UAAI,kBAAkB;AACpB;AACA,cAAM;AAAA,UACJ,gFAAsE,KAAK,KAAK,IAAI,IAAI,KAAK,UAAU;AAAA,QACzG;AACA;AAAA,MACF;AACA,UAAI;AACF,cAAM,SAAS,MAAM,mBAAmB,MAAM,KAAK,MAAM,KAAK,YAAY;AAAA,UACxE;AAAA,UACA,eAAe,SAAS;AAAA,UACxB,aAAa;AAAA,QACf,CAAC;AACD,iBAAS,aAAa,OAAO,WAAW;AACxC,cAAM;AAAA,UACJ;AAAA,YACE,OAAO,WAAW,YAAY,SAAS;AAAA,YACvC,OAAO;AAAA,YACP,OAAO;AAAA,YACP;AAAA,UACF;AAAA,QACF;AACA,YAAI,sBAAsB,KAAK,IAAI,EAAG;AACtC,YAAI,OAAO,aAAa,SAAS,EAAG;AACpC,YAAI,OAAO,oBAAqB;AAChC,YAAI,OAAO,sBAAuB;AAAA,MACpC,SAAS,GAAG;AACV,cAAM,KAAK,kBAAa,KAAK,KAAK,IAAI,IAAI,KAAK,UAAU,WAAO,EAAY,OAAO,EAAE;AAAA,MACvF;AACA;AAAA,IACF;AAYA,UAAM,iBAAiB,QAAQ;AAAA,MAC7B,CAAC,MACC,EAAE,WAAW,KAAK,KAAK,MACvB,EAAE,eAAe,KAAK,cACtB,EAAE,cACF,EAAE,WAAW,QACb,EAAE,WAAW,QACb,EAAE,SAAS;AAAA,IACf;AACA,QAAI,gBAAgB;AAClB;AACA,YAAM;AAAA,QACJ,mBAAc,KAAK,KAAK,IAAI,IAAI,KAAK,UAAU,0BAA0B,eAAe,MAAM;AAAA,MAChG;AACA;AAAA,IACF;AAEA,QAAI;AAIF,YAAM,SAAS,MAAM,mBAAmB,MAAM,KAAK,MAAM,KAAK,YAAY,EAAE,OAAO,CAAC;AACpF,YAAM,KAAK,UAAU,OAAO,WAAW,UAAU,OAAO,QAAQ,OAAO,aAAa,CAAC;AAIrF,UAAI,OAAO,UAAW,SAAQ,KAAK,OAAO,SAAS;AAGnD,UAAI,sBAAsB,KAAK,IAAI,EAAG;AACtC,UAAI,OAAO,aAAa,SAAS,EAAG;AACpC,UAAI,OAAO,oBAAqB;AAChC,UAAI,OAAO,sBAAuB;AAAA,IACpC,SAAS,GAAG;AACV,YAAM,KAAK,kBAAa,KAAK,KAAK,IAAI,IAAI,KAAK,UAAU,WAAO,EAAY,OAAO,EAAE;AAAA,IACvF;AAAA,EACF;AACA,MAAI,UAAU,GAAG;AACf,UAAM,KAAK,UAAK,OAAO,yCAAyC;AAAA,EAClE;AACA,MAAI,kBAAkB,GAAG;AACvB,UAAM;AAAA,MACJ,UAAK,eAAe,QAAQ,oBAAoB,IAAI,KAAK,GAAG;AAAA,IAC9D;AAAA,EACF;AACA,MAAI,sBAAsB,GAAG;AAC3B,UAAM;AAAA,MACJ,UAAK,mBAAmB,QAAQ,wBAAwB,IAAI,KAAK,GAAG;AAAA,IACtE;AAAA,EACF;AACA,MAAI,0BAA0B,GAAG;AAC/B,UAAM;AAAA,MACJ,UAAK,uBAAuB,QAAQ,4BAA4B,IAAI,KAAK,GAAG;AAAA,IAC9E;AAAA,EACF;AACA,SAAO;AAAA,IACL,QAAQ,MAAM,KAAK,IAAI;AAAA,IACvB,MAAM,MAAM,KAAK,CAAC,MAAM,EAAE,WAAW,QAAG,CAAC,IAAI,IAAI;AAAA,IACjD,QAAQ,EAAE,iBAAiB,iBAAiB,kBAAkB;AAAA,EAChE;AACF;AAEA,eAAe,mBACb,MACA,MAC2C;AAC3C,QAAM,OAAO,SAAS,mBAAmB,CAAC;AAC1C,QAAM,WAAW,MAAM,aAAa,IAAI;AACxC,QAAM,OAAO,SAAS,KAAK,CAAC,MAAM,SAAS,EAAE,IAAI,MAAM,IAAI;AAC3D,MAAI,CAAC,MAAM;AACT,UAAM,OAAO,OAAO,IAAI,MAAM,iCAAiC,IAAI,GAAG,GAAG,EAAE,UAAU,EAAE,CAAC;AAAA,EAC1F;AACA,QAAM,SAAS,MAAM,mBAAmB,KAAK,cAAc,OAAO,MAAM,MAAM,KAAK,YAAY;AAAA,IAC7F,aAAa,KAAK;AAAA;AAAA;AAAA,IAGlB,GAAI,KAAK,SAAS,EAAE,QAAQ,KAAK,IAAI,CAAC;AAAA,EACxC,CAAC;AACD,MAAI,KAAK,aAAa;AACpB,WAAO,EAAE,QAAQ,sBAAsB,OAAO,QAAQ,IAAI,MAAM,EAAE;AAAA,EACpE;AACA,SAAO;AAAA,IACL,QAAQ;AAAA,MACN,OAAO,WAAW;AAAA,MAClB,OAAO;AAAA,MACP,OAAO;AAAA,MACP;AAAA,IACF;AAAA,IACA,MAAM;AAAA,EACR;AACF;","names":[]}

package/dist/{self-updating-WJEHPASK.js → self-updating-4Q65OVXY.js}

@@ -1,6 +1,6 @@
 import {
   selfUpdating
-} from "./chunk-7ADQL5Y3.js";
+} from "./chunk-THEFTZ7F.js";
 import "./chunk-MNDIED4M.js";
 import {
   runRecipeOverSites
@@ -9,15 +9,15 @@ import {
   appendSkipNotice,
   fleetWorkdir,
   prepareFleetSites
-} from "./chunk-4NAOR44V.js";
+} from "./chunk-ZMIPG6TR.js";
 import {
   resolveSites
-} from "./chunk-4BHNP6Y2.js";
+} from "./chunk-MQUOUVQP.js";
 import "./chunk-73UFRZKY.js";
 import "./chunk-GASBX52O.js";
-import "./chunk-YAMRVXOD.js";
+import "./chunk-VRWUL4TR.js";
 import "./chunk-FDIFTIXC.js";
-import "./chunk-HVOOCK6L.js";
+import "./chunk-4DHQCN5H.js";
 import "./chunk-XXTZBPUY.js";
 import "./chunk-XTK5VIQB.js";
 import "./chunk-U5SZ4FOP.js";
@@ -62,4 +62,4 @@ async function runSelfUpdatingCommand(site, opts) {
 export {
   runSelfUpdatingCommand
 };
-//# sourceMappingURL=self-updating-WJEHPASK.js.map
+//# sourceMappingURL=self-updating-4Q65OVXY.js.map

package/dist/{selftest-ZJDB4JQB.js → selftest-K5XZKVTE.js}

@@ -1,19 +1,19 @@
 import {
   buildReportDataForSite,
   scoresFromRow
-} from "./chunk-AKRUYPLU.js";
-import "./chunk-6M2IXJ3E.js";
-import "./chunk-62VF32IC.js";
-import "./chunk-37S6L6G4.js";
+} from "./chunk-KV7DIRRO.js";
 import {
   ELIGIBLE_STATUSES
 } from "./chunk-D4FVAIEJ.js";
+import "./chunk-JVWJJ36K.js";
+import "./chunk-62VF32IC.js";
+import "./chunk-37S6L6G4.js";
 import {
   isProbablyEmail,
   parseAddresses,
   prepareHeaderImage,
   renderReportEmail
-} from "./chunk-42A4H6SF.js";
+} from "./chunk-PBCGXXG6.js";
 import "./chunk-GECESMVS.js";
 import "./chunk-6QRLRT3P.js";
 import {
@@ -30,7 +30,7 @@ import "./chunk-U5SZ4FOP.js";
 import {
   listWebsites,
   siteSlug
-} from "./chunk-GXVX4HUH.js";
+} from "./chunk-CLWNAMUX.js";
 import {
   openBase,
   readAirtableConfig
@@ -162,4 +162,4 @@ async function runSelftestCommand(kind, site, opts) {
 export {
   runSelftestCommand
 };
-//# sourceMappingURL=selftest-ZJDB4JQB.js.map
+//# sourceMappingURL=selftest-K5XZKVTE.js.map

package/dist/{smoke-suite-SUEJFBYP.js → smoke-suite-J3LL3JZJ.js}

@@ -5,17 +5,17 @@ import {
   appendSkipNotice,
   fleetWorkdir,
   prepareFleetSites
-} from "./chunk-4NAOR44V.js";
+} from "./chunk-ZMIPG6TR.js";
 import {
   resolveSites
-} from "./chunk-4BHNP6Y2.js";
+} from "./chunk-MQUOUVQP.js";
 import {
   smokeSuite
-} from "./chunk-K5JZ5KLO.js";
-import "./chunk-KRDLHAKK.js";
+} from "./chunk-R4AB6GCT.js";
+import "./chunk-R53VL3RI.js";
 import "./chunk-ZTPPCHDB.js";
 import "./chunk-FDIFTIXC.js";
-import "./chunk-HVOOCK6L.js";
+import "./chunk-4DHQCN5H.js";
 import "./chunk-XXTZBPUY.js";
 import "./chunk-XTK5VIQB.js";
 import "./chunk-U5SZ4FOP.js";
@@ -51,4 +51,4 @@ async function runSmokeSuiteCommand(site, opts) {
 export {
   runSmokeSuiteCommand
 };
-//# sourceMappingURL=smoke-suite-SUEJFBYP.js.map
+//# sourceMappingURL=smoke-suite-J3LL3JZJ.js.map

package/dist/{submissions-RAYGOASP.js → submissions-GMBUP4LV.js}

@@ -41,7 +41,7 @@ async function rescoreNewSubmissions(db, opts) {
 async function loadSiteNames() {
   try {
     const { openBase, readAirtableConfig } = await import("./client-EPVO3FEH.js");
-    const { listWebsites } = await import("./websites-U6642XSE.js");
+    const { listWebsites } = await import("./websites-VITQ3WXN.js");
     const sites = await listWebsites(openBase(readAirtableConfig()));
     return new Map(sites.map((s) => [s.id, s.name]));
   } catch (err) {
@@ -119,4 +119,4 @@ export {
   rescoreNewSubmissions,
   runSubmissionsCommand
 };
-//# sourceMappingURL=submissions-RAYGOASP.js.map
+//# sourceMappingURL=submissions-GMBUP4LV.js.map

package/dist/{svelte-codemods-IWO7X3F3.js → svelte-codemods-JTMX4BSX.js}

@@ -5,17 +5,17 @@ import {
   appendSkipNotice,
   fleetWorkdir,
   prepareFleetSites
-} from "./chunk-4NAOR44V.js";
+} from "./chunk-ZMIPG6TR.js";
 import {
   resolveSites
-} from "./chunk-4BHNP6Y2.js";
+} from "./chunk-MQUOUVQP.js";
 import {
   svelteCodemods
 } from "./chunk-LS6QPANO.js";
 import "./chunk-J7SZQUCW.js";
 import "./chunk-ZTPPCHDB.js";
 import "./chunk-FDIFTIXC.js";
-import "./chunk-HVOOCK6L.js";
+import "./chunk-4DHQCN5H.js";
 import "./chunk-XXTZBPUY.js";
 import "./chunk-XTK5VIQB.js";
 import "./chunk-U5SZ4FOP.js";
@@ -51,4 +51,4 @@ async function runSvelteCodemodsCommand(site, opts) {
 export {
   runSvelteCodemodsCommand
 };
-//# sourceMappingURL=svelte-codemods-IWO7X3F3.js.map
+//# sourceMappingURL=svelte-codemods-JTMX4BSX.js.map

package/dist/{sync-configs-7XGHFC6P.js → sync-configs-5DXSL64Q.js}

@@ -5,10 +5,10 @@ import {
   appendSkipNotice,
   fleetWorkdir,
   prepareFleetSites
-} from "./chunk-4NAOR44V.js";
+} from "./chunk-ZMIPG6TR.js";
 import {
   resolveSites
-} from "./chunk-4BHNP6Y2.js";
+} from "./chunk-MQUOUVQP.js";
 import {
   ALL_CONFIG_NAMES,
   CANONICAL_GITIGNORE_ENTRIES,
@@ -22,7 +22,7 @@ import {
 } from "./chunk-73UFRZKY.js";
 import "./chunk-ZTPPCHDB.js";
 import "./chunk-FDIFTIXC.js";
-import "./chunk-HVOOCK6L.js";
+import "./chunk-4DHQCN5H.js";
 import "./chunk-XXTZBPUY.js";
 import "./chunk-XTK5VIQB.js";
 import "./chunk-U5SZ4FOP.js";
@@ -113,4 +113,4 @@ async function runSyncConfigsCommand(site, opts) {
 export {
   runSyncConfigsCommand
 };
-//# sourceMappingURL=sync-configs-7XGHFC6P.js.map
+//# sourceMappingURL=sync-configs-5DXSL64Q.js.map

package/dist/{types-DnEL3NRn.d.ts → types-OIQZ5hWN.d.ts}

@@ -15,7 +15,7 @@ type Site = {
     meta?: Record<string, unknown>;
 };
 type AuditName = "deps" | "lighthouse" | "a11y" | "security" | "lint" | "domain" | "browser" | "netlify-deploy" | "function-health" | "smoke" | "form-e2e";
-type RecipeName = "sync-configs" | "bump-deps" | "svelte-4-to-5" | "svelte-codemods" | "convert-to-pnpm" | "onboard" | "a11y-fixtures-page" | "health-endpoint" | "smoke-suite" | "self-updating" | "init";
+type RecipeName = "sync-configs" | "bump-deps" | "svelte-4-to-5" | "svelte-codemods" | "convert-to-pnpm" | "onboard" | "a11y-fixtures-page" | "health-endpoint" | "smoke-suite" | "self-updating" | "prismic-ci" | "init";
 type ConfigName = "lighthouse" | "eslint" | "prettier" | "prettier-ignore" | "playwright-a11y" | "svelte" | "gitignore" | "renovate-action" | "renovate-config" | "netlify";
 type AuditResult = {
     audit: AuditName;

package/dist/{upgrade-AM4S7JF3.js → upgrade-HCR25P25.js}

@@ -5,18 +5,18 @@ import {
   appendSkipNotice,
   fleetWorkdir,
   prepareFleetSites
-} from "./chunk-4NAOR44V.js";
+} from "./chunk-ZMIPG6TR.js";
 import {
   resolveSites
-} from "./chunk-4BHNP6Y2.js";
+} from "./chunk-MQUOUVQP.js";
 import {
   upgradeSvelte4to5
-} from "./chunk-B5ZUQZFL.js";
+} from "./chunk-ICXV25N7.js";
 import "./chunk-J7SZQUCW.js";
 import "./chunk-ZTPPCHDB.js";
 import "./chunk-OTGB6YQO.js";
 import "./chunk-FDIFTIXC.js";
-import "./chunk-HVOOCK6L.js";
+import "./chunk-4DHQCN5H.js";
 import "./chunk-XXTZBPUY.js";
 import "./chunk-XTK5VIQB.js";
 import "./chunk-U5SZ4FOP.js";
@@ -60,4 +60,4 @@ async function runUpgradeCommand(upgradeName, site, opts = {}) {
 export {
   runUpgradeCommand
 };
-//# sourceMappingURL=upgrade-AM4S7JF3.js.map
+//# sourceMappingURL=upgrade-HCR25P25.js.map

package/dist/{websites-U6642XSE.js → websites-VITQ3WXN.js}

@@ -5,6 +5,7 @@ import {
   PRE_LAUNCH_STATUSES,
   SEVERITY_RANK,
   WEBSITES_TABLE,
+  allActionableVulnsTransitive,
   getWebsiteBySlug,
   isArchivedStatus,
   isDashboardVisible,
@@ -16,6 +17,7 @@ import {
   parseNotifyRouting,
   parseSecurityAdvisories,
   siteSlug,
+  toPrismicModelsVerdict,
   toVerdict,
   updateA11yCounts,
   updateAnalyticsHealth,
@@ -25,10 +27,11 @@ import {
   updateGitHubSignals,
   updateLaunched,
   updateNextDueDates,
+  updatePrismicModels,
   updateScores,
   updateSecurityCounts,
   updateSiteField
-} from "./chunk-GXVX4HUH.js";
+} from "./chunk-CLWNAMUX.js";
 export {
   ACTIVE_STATUSES,
   ARCHIVED_STATUSES,
@@ -36,6 +39,7 @@ export {
   PRE_LAUNCH_STATUSES,
   SEVERITY_RANK,
   WEBSITES_TABLE,
+  allActionableVulnsTransitive,
   getWebsiteBySlug,
   isArchivedStatus,
   isDashboardVisible,
@@ -47,6 +51,7 @@ export {
   parseNotifyRouting,
   parseSecurityAdvisories,
   siteSlug,
+  toPrismicModelsVerdict,
   toVerdict,
   updateA11yCounts,
   updateAnalyticsHealth,
@@ -56,8 +61,9 @@ export {
   updateGitHubSignals,
   updateLaunched,
   updateNextDueDates,
+  updatePrismicModels,
   updateScores,
   updateSecurityCounts,
   updateSiteField
 };
-//# sourceMappingURL=websites-U6642XSE.js.map
+//# sourceMappingURL=websites-VITQ3WXN.js.map

package/dist/{write-audits-to-airtable-22T6D733.js → write-audits-to-airtable-3SOXLKJK.js}

@@ -2,13 +2,13 @@ import {
   formatFleetWriteSummary,
   writeAuditsToAirtable,
   writeFleetAuditsToAirtable
-} from "./chunk-JR67FZVC.js";
-import "./chunk-3PU2QWOJ.js";
+} from "./chunk-XDCRVYFL.js";
+import "./chunk-OQFOMKBP.js";
 import "./chunk-5L3FPQIJ.js";
-import "./chunk-GXVX4HUH.js";
+import "./chunk-CLWNAMUX.js";
 export {
   formatFleetWriteSummary,
   writeAuditsToAirtable,
   writeFleetAuditsToAirtable
 };
-//# sourceMappingURL=write-audits-to-airtable-22T6D733.js.map
+//# sourceMappingURL=write-audits-to-airtable-3SOXLKJK.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reddoorla/maintenance",
-  "version": "0.81.0",
+  "version": "0.83.0",
   "description": "Canonical maintenance configs, audits, and recipes for the reddoor stack.",
   "type": "module",
   "license": "MIT",
@@ -65,7 +65,7 @@
     "listr2": "^10.2.1",
     "node-html-parser": "^9.0.0",
     "prettier": "^3.1.1",
-    "prettier-plugin-svelte": "^3.2.6",
+    "prettier-plugin-svelte": "^4.0.0",
     "tinyglobby": "^0.2.10",
     "typescript-eslint": "^8.59.1"
   },
@@ -79,7 +79,7 @@
   },
   "devDependencies": {
     "@changesets/cli": "^2.31.0",
-    "@google-analytics/data": "^6.1.0",
+    "@google-analytics/data": "^7.0.0",
     "@lhci/cli": "^0.15.1",
     "@libsql/client": "^0.8.1",
     "@libsql/kysely-libsql": "^0.4.1",

package/dist/airtable-6L3JD7FY.js

@@ -1,9 +0,0 @@
-import {
-  fromAirtableBase
-} from "./chunk-SK44IFZN.js";
-import "./chunk-U5SZ4FOP.js";
-import "./chunk-GXVX4HUH.js";
-export {
-  fromAirtableBase
-};
-//# sourceMappingURL=airtable-6L3JD7FY.js.map

package/dist/chunk-6M2IXJ3E.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/reports/ga/config.ts","../src/reports/draft.ts","../src/reports/auto-tick.ts","../src/reports/ga/client.ts","../src/reports/ga/failover.ts","../src/reports/search/client.ts"],"sourcesContent":["import { dirname, join } from \"node:path\";\nimport { defaultCredentialsPath } from \"../../util/credentials.js\";\n\nexport type GaConfig = {\n  /** Workspace users the service account impersonates (domain-wide delegation), in\n   *  failover order — the first subject that authenticates wins. */\n  subjects: string[];\n  /** Absolute path to the service-account JSON key file. */\n  keyPath: string;\n};\n\n/**\n * Read GA configuration from the environment (credentials.env is already loaded into\n * process.env by the CLI entrypoint). Returns null when `GA_SUBJECT` is unset/blank — the\n * signal that GA enrichment is simply not configured, so drafting skips it silently.\n *\n * `GA_SUBJECT` is a comma-separated list of impersonation subjects tried in order\n * (e.g. `reports@reddoorla.com,person@reddoorla.com`), so losing one Workspace account\n * degrades to a logged failover instead of blanking the whole fleet's analytics; a single\n * address remains the degenerate one-element case. Entries are trimmed, empties dropped.\n *\n * `GA_SA_KEY_PATH` is optional; it defaults to `ga-service-account.json` alongside the\n * credentials file (e.g. ~/.config/reddoor-maint/), keeping the key out of the repo.\n */\nexport function readGaConfig(): GaConfig | null {\n  const subjects = (process.env.GA_SUBJECT ?? \"\")\n    .split(\",\")\n    .map((s) => s.trim())\n    .filter(Boolean);\n  if (subjects.length === 0) return null;\n  const keyPath =\n    process.env.GA_SA_KEY_PATH?.trim() ||\n    join(dirname(defaultCredentialsPath()), \"ga-service-account.json\");\n  return { subjects, keyPath };\n}\n","import { mkdir, writeFile } from \"node:fs/promises\";\nimport { dirname } from \"node:path\";\nimport type { ReportType, LighthouseScores } from \"./types.js\";\nimport { renderReportHtml } from \"./render.js\";\nimport { siteSlug, updateAnalyticsHealth } from \"./airtable/websites.js\";\nimport { resolveCopy } from \"./copy.js\";\nimport type { WebsiteRow } from \"./airtable/websites.js\";\nimport type { ReportRow } from \"./airtable/reports.js\";\nimport { createDraft, listReportsForSite } from \"./airtable/reports.js\";\nimport { queueDraft } from \"./queue.js\";\nimport { autoTickChecklist } from \"./auto-tick.js\";\nimport { uploadAttachment } from \"./airtable/attachments.js\";\nimport type { AirtableBase } from \"./airtable/client.js\";\nimport { readGaConfig } from \"./ga/config.js\";\nimport { fetchPeriodUsers } from \"./ga/client.js\";\nimport { fetchSearchPresence } from \"./search/client.js\";\nimport type { SearchPresence } from \"./search/client.js\";\nimport { generateHeaderImage } from \"./header-image/index.js\";\nimport type { GeneratedHeaderImage } from \"./header-image/index.js\";\n\nexport type RefreshHeaderDeps = {\n  generate?: (input: { url: string; slug?: string }) => Promise<GeneratedHeaderImage>;\n  upload?: (\n    recordId: string,\n    field: string,\n    bytes: Uint8Array,\n    filename: string,\n    contentType: string,\n  ) => Promise<void>;\n};\n\n/**\n * Regenerate a site's Header image from its live homepage so the report ships a\n * current screenshot rather than one frozen whenever the image was last made by\n * hand. Sonder alone runs 16 reports a year, so a static header goes visibly\n * stale.\n *\n * BEST-EFFORT BY DESIGN — returns false and never throws. A capture or upload\n * failure must not fail the draft: the stored image is still perfectly usable,\n * and the operator reviews the rendered preview before approving the send.\n */\nexport async function refreshHeaderImage(\n  site: WebsiteRow,\n  deps: RefreshHeaderDeps = {},\n): Promise<boolean> {\n  if (!site.url) return false;\n  const generate = deps.generate ?? generateHeaderImage;\n  const upload = deps.upload ?? uploadAttachment;\n  try {\n    const gen = await generate({ url: site.url, slug: siteSlug(site.name) });\n    await upload(site.id, \"Header image\", gen.bytes, gen.filename, gen.contentType);\n    return true;\n  } catch (err) {\n    console.warn(\n      `⚠ header-image refresh skipped for ${site.name}: ${\n        err instanceof Error ? err.message : String(err)\n      } — keeping the stored image`,\n    );\n    return false;\n  }\n}\n\nexport type DraftOptions = {\n  /** Where to write the local preview HTML when `previewOnly`. Defaults to `reports/<slug>/draft.html`. */\n  previewPath?: string;\n  /** If true: render locally only, never touch Airtable. */\n  previewOnly?: boolean;\n  /** UTC \"YYYY-MM\" recurrence key; falls back to periodEnd's month when omitted. */\n  period?: string;\n  /** Airtable record id of an EXISTING (not-ready) row to COMPLETE in place rather\n   *  than creating a new one. When set, we skip createDraft and only re-render →\n   *  upload the HTML attachment → flip Draft ready on this row. Used by the --due\n   *  re-draft path to finish a draft whose createDraft succeeded but whose\n   *  setDraftReady never ran (a crash mid-sequence wedged the period). */\n  completeRowId?: string;\n  /** The mapped ReportRow being completed, returned as `reportRow` from the\n   *  complete path so callers keep the same shape they get on the create path. */\n  existingRow?: ReportRow;\n  /** Injected deps for the draft-time header refresh, or `false` to skip it\n   *  entirely. Tests set `false` (or a stub) so a unit suite never launches a\n   *  browser or resolves DNS. Production leaves it unset and gets the real thing. */\n  refreshHeader?: RefreshHeaderDeps | false;\n};\n\n/** An enrichment fetch that *errored* (not one that was legitimately skipped\n *  because it isn't configured / the site lacks the inputs). Surfaced so a\n *  fleet-wide GA/Search outage is visible in a `--due` batch summary instead of\n *  hiding behind one easily-missed console.warn per site. */\nexport type SoftFailure = \"ga\" | \"search\";\n\nexport type DraftResult = {\n  /** null when previewOnly. */\n  reportRow: ReportRow | null;\n  /** Path to the local preview file (only set when previewOnly). */\n  htmlPath: string | null;\n  /** Always present — the rendered HTML string. */\n  html: string;\n  /** Enrichment fetches that errored for this site (empty on success or skip). */\n  softFailures: SoftFailure[];\n  /** True when search enrichment fell back to the site name (no explicit `Search query`)\n   *  AND that default matched nothing in Search Console — the signal that this site needs\n   *  a hand-tuned brand query. Distinct from a soft-failure/outage: the fetch succeeded, it\n   *  just found no data for the name. Requires a property to have RESOLVED — a site with no\n   *  Search Console property at all raises `searchPropertyMissing` instead (a query change\n   *  can't fix that, and prescribing one would silence the real problem). */\n  searchDefaultMissed: boolean;\n  /** True when NO Search Console property matched the site for any subject — a\n   *  missing/unverified property or lost service-account access. Fires for BOTH explicit\n   *  and name-default queries (unlike `searchDefaultMissed`), because no query can succeed\n   *  without a property. Distinct from a soft-failure: the API worked, the property list\n   *  just contained nothing for this site. */\n  searchPropertyMissing: boolean;\n  /** Whether the draft was placed in the approve queue. False when a higher-or-equal-tier\n   *  report is already queued for the site (single-queue rule); null on the previewOnly path. */\n  queued: boolean | null;\n  /** Ids of lower-tier queued reports this draft superseded (un-queued). */\n  supersededIds: string[];\n};\n\nfunction scoresFromWebsite(siteRow: WebsiteRow): LighthouseScores {\n  const { pScore, rScore, bpScore, seoScore } = siteRow;\n  if (pScore === null || rScore === null || bpScore === null || seoScore === null) {\n    throw new Error(\n      `Site '${siteRow.name}' is missing one or more Lighthouse scores on the Websites row (pScore, rScore, bpScore, seoScore). ` +\n        `Run 'reddoor-maint audit lighthouse' from the site's checkout and paste the four numbers into Airtable, then retry.`,\n    );\n  }\n  return { performance: pScore, accessibility: rScore, bestPractices: bpScore, seo: seoScore };\n}\n\nfunction daysAgo(today: Date, n: number): Date {\n  // UTC accessors to stay TZ-consistent with `due.ts` (and avoid landing\n  // Airtable's `Period start` on a different calendar day than the operator\n  // expects on late-night runs near a month boundary). See morning brief\n  // 2026-05-29 (M1) for context.\n  const out = new Date(today);\n  out.setUTCDate(out.getUTCDate() - n);\n  return out;\n}\n\n/**\n * Render and create an Airtable draft for one site.\n *\n * No idempotency guard here — the recurrence guard lives in draftDueReports\n * (cli/commands/report.ts), keyed on reportPeriodKey(dueDate).  The manual\n * single-site path intentionally always drafts (an operator asking for a draft\n * gets one).  findReportByPeriod (airtable/reports.ts) is the real-Airtable\n * point lookup available to dashboard/digest callers that need the same\n * idempotency guarantee outside the CLI batch loop.\n */\nexport async function draftReportForSite(\n  base: AirtableBase | null,\n  siteRow: WebsiteRow,\n  reportType: ReportType,\n  options: DraftOptions = {},\n): Promise<DraftResult> {\n  const scores = scoresFromWebsite(siteRow);\n\n  const today = new Date();\n  const slug = siteSlug(siteRow.name);\n\n  const periodStart =\n    base !== null ? await derivePeriodStart(base, siteRow, reportType, today) : daysAgo(today, 30);\n\n  const periodEnd = today;\n  const completedOn = today;\n  // \"Last Tested\" on the Maintenance email is the REAL timestamp of the most recent automated\n  // Lighthouse audit — stamped live on the Websites row (`Last lighthouse audit at`) by\n  // `audit lighthouse --write-airtable` every time the scores refresh. It is deliberately NOT\n  // the `testing day` field: that's the recurrence anchor consumed by due.ts and is hand-set, so\n  // it goes stale. Reading the audit timestamp keeps the date current with no manual upkeep.\n  const lastTestedDate =\n    reportType === \"Maintenance\" && siteRow.lastLighthouseAuditAt\n      ? new Date(siteRow.lastLighthouseAuditAt)\n      : null;\n\n  // GA enrichment (real path only). Soft-fail: any GA problem leaves the numbers null so\n  // the draft still proceeds (operator fills them manually) — GA is an enhancement, not a\n  // gate. Rendered with the fetched numbers so the review HTML matches the Airtable fields.\n  // An *error* (vs a legitimate not-configured skip) is recorded in softFailures so the\n  // caller can surface a fleet-wide outage in the batch summary.\n  const gaResult =\n    base !== null ? await fetchGaUsers(siteRow, periodStart, periodEnd) : NO_ENRICHMENT;\n  const searchResult =\n    base !== null\n      ? await fetchSearch(siteRow, periodStart, periodEnd)\n      : // No-IO render path: nothing was attempted, so this is not an environment gap\n        // (`notConfigured` would wrongly tell the operator to go wire a secret).\n        {\n          ...NO_ENRICHMENT,\n          defaultQueryMissed: false,\n          propertyMissing: false,\n          notConfigured: false,\n        };\n  const gaUsers = gaResult.value;\n  const search = searchResult.value;\n  const softFailures: SoftFailure[] = [\n    ...(gaResult.softFailed ? ([\"ga\"] as const) : []),\n    ...(searchResult.softFailed ? ([\"search\"] as const) : []),\n  ];\n\n  // Header-image refresh (real path only). Regenerated BEFORE the render so the\n  // preview the operator approves carries the same screenshot the client will\n  // receive — the send reads this attachment off the Websites row. Gated on\n  // `base !== null` exactly like the GA/Search enrichment above: the no-IO render\n  // path (base === null, used for pure rendering and tests) must not launch a\n  // browser or write to production Airtable. `refreshHeader: false` is the second\n  // gate, for suites that DO pass a fake base and would otherwise pay a real\n  // chromium launch per case. Production leaves it unset and gets the real\n  // refresh. Best-effort — see refreshHeaderImage.\n  if (base !== null && options.refreshHeader !== false) {\n    await refreshHeaderImage(siteRow, options.refreshHeader ?? {});\n  }\n\n  const cidName = `${slug}-header`;\n  const { html } = await renderReportHtml({\n    siteName: siteRow.name,\n    siteUrl: siteRow.url,\n    reportType,\n    completedOn,\n    lighthouse: scores,\n    gaUsersCurrent: gaUsers?.current,\n    gaUsersPrevious: gaUsers?.previous,\n    searchPosition: search?.foundOnPage1 ? (search.position ?? undefined) : undefined,\n    lastTestedDate,\n    commentary: null,\n    copy: resolveCopy(siteRow),\n    headerImageCid: cidName,\n  });\n\n  if (options.previewOnly) {\n    const path = options.previewPath ?? `reports/${slug}/draft.html`;\n    await mkdir(dirname(path), { recursive: true });\n    await writeFile(path, html, \"utf-8\");\n    return {\n      reportRow: null,\n      htmlPath: path,\n      html,\n      softFailures,\n      searchDefaultMissed: searchResult.defaultQueryMissed,\n      searchPropertyMissing: searchResult.propertyMissing,\n      queued: null,\n      supersededIds: [],\n    };\n  }\n\n  if (base === null) throw new Error(\"base required when previewOnly=false\");\n\n  // Record this site's GA/Search enrichment health for the per-site analytics-failure\n  // signal (cockpit/digest). Only when analytics is configured for THIS site — set the\n  // timestamp on a soft-fail, clear it (null) on a clean enrichment so the signal\n  // self-heals. Best-effort: the `Analytics soft-fail at` column is operator-added, so\n  // until it exists the write throws UNKNOWN_FIELD_NAME — which must NOT break drafting.\n  if (readGaConfig() !== null && Boolean(siteRow.ga4PropertyId || siteRow.searchQuery)) {\n    try {\n      await updateAnalyticsHealth(\n        base,\n        siteRow.id,\n        softFailures.length > 0 ? today.toISOString() : null,\n      );\n    } catch (e) {\n      console.warn(`⚠ analytics-health write skipped for ${siteRow.name}: ${(e as Error).message}`);\n    }\n  }\n\n  // \"Finish an existing row\" path (the --due re-draft wedge fix). When the caller\n  // hands us a row that was created but never made Draft-ready — a crash between\n  // createDraft and setDraftReady leaves exactly this — we DON'T createDraft again\n  // (that would duplicate the period). We re-attach the rendered HTML and queue the\n  // EXISTING row, completing the half-made draft in place. The row's other fields\n  // (scores, period, dates) were already written at create time; the only pieces a\n  // crash drops are the attachment + the ready flag.\n  if (options.completeRowId) {\n    await uploadDraftHtml(options.completeRowId, slug, periodEnd, html);\n    const outcome = await queueDraft(base, {\n      id: options.completeRowId,\n      siteId: siteRow.id,\n      reportType,\n    });\n    return {\n      reportRow: options.existingRow ?? null,\n      htmlPath: null,\n      html,\n      softFailures,\n      searchDefaultMissed: searchResult.defaultQueryMissed,\n      searchPropertyMissing: searchResult.propertyMissing,\n      queued: outcome.queued,\n      supersededIds: outcome.supersededIds,\n    };\n  }\n\n  // Auto-tick the checklist boxes the system can prove (Phase 1: Google Indexed via the\n  // inline search signal). Fail-safe lives in autoTickChecklist: only `pass` entries are ticked;\n  // the evidence snapshot drives the dashboard's green/amber badges. The operator's approve gate\n  // and per-box override are unchanged.\n  const evidence = autoTickChecklist(siteRow, reportType, completedOn, { search: searchResult });\n  const checklistTicks = [...evidence.entries()]\n    .filter(([, e]) => e.result === \"pass\")\n    .map(([field]) => field);\n  const autoEvidence = Object.fromEntries(evidence);\n\n  const reportId = `${siteRow.name} — ${reportType} — ${periodEnd.toISOString().slice(0, 10)}`;\n  const created = await createDraft(base, {\n    reportId,\n    siteId: siteRow.id,\n    reportType,\n    period: options.period ?? periodEnd.toISOString().slice(0, 7),\n    periodStart,\n    periodEnd,\n    completedOn,\n    lighthouse: scores,\n    lastTestedDate,\n    ...(gaUsers ? { gaUsersCurrent: gaUsers.current, gaUsersPrevious: gaUsers.previous } : {}),\n    ...(search ? { searchFoundPage1: search.foundOnPage1 } : {}),\n    ...(search?.foundOnPage1 && search.position !== null\n      ? { searchPosition: search.position }\n      : {}),\n    checklistTicks,\n    autoEvidence,\n  });\n\n  await uploadDraftHtml(created.id, slug, periodEnd, html);\n  const outcome = await queueDraft(base, {\n    id: created.id,\n    siteId: siteRow.id,\n    reportType,\n  });\n\n  return {\n    reportRow: created,\n    htmlPath: null,\n    html,\n    softFailures,\n    searchDefaultMissed: searchResult.defaultQueryMissed,\n    searchPropertyMissing: searchResult.propertyMissing,\n    queued: outcome.queued,\n    supersededIds: outcome.supersededIds,\n  };\n}\n\n/** Attach the rendered HTML to a Reports row. Queueing (Draft ready + the single-queue\n *  reconciliation) is handled separately by queueDraft so both the create path and the\n *  \"complete a half-made row\" path share the identical, re-runnable upload step. */\nasync function uploadDraftHtml(\n  rowId: string,\n  slug: string,\n  periodEnd: Date,\n  html: string,\n): Promise<void> {\n  const htmlFilename = `${slug}-${periodEnd.toISOString().slice(0, 10)}.html`;\n  await uploadAttachment(rowId, \"Rendered HTML\", html, htmlFilename, \"text/html\");\n}\n\n/** Result of an enrichment fetch: the value (null if unavailable) plus whether\n *  it errored (`softFailed`) as opposed to being legitimately not-configured. */\ntype Enrichment<T> = { value: T | null; softFailed: boolean };\n/** A not-configured / skipped enrichment — null value, not a soft-failure. */\nconst NO_ENRICHMENT: Enrichment<never> = { value: null, softFailed: false };\n\n/**\n * Fetch GA \"Users\" for the period, soft-failing to null. Returns a null value (no enrichment)\n * when GA isn't configured (`GA_SUBJECT` unset) or the site has no GA4 property ID — those are\n * legitimate skips, `softFailed: false`. When the GA API errors it logs a one-line warning and\n * returns `softFailed: true`. Never throws, so a GA problem can never block a draft; the\n * operator can always enter the numbers by hand.\n */\nexport async function fetchGaUsers(\n  siteRow: WebsiteRow,\n  periodStart: Date,\n  periodEnd: Date,\n): Promise<Enrichment<{ current: number; previous: number }>> {\n  const cfg = readGaConfig();\n  if (!cfg || !siteRow.ga4PropertyId) return NO_ENRICHMENT;\n  try {\n    const value = await fetchPeriodUsers(\n      { propertyId: siteRow.ga4PropertyId, subjects: cfg.subjects, keyPath: cfg.keyPath },\n      periodStart,\n      periodEnd,\n    );\n    return { value, softFailed: false };\n  } catch (e) {\n    console.warn(`⚠ GA skipped for ${siteRow.name}: ${(e as Error).message}`);\n    return { value: null, softFailed: true };\n  }\n}\n\n/** A search enrichment, plus the two distinct miss flags (see `fetchSearch` /\n *  `DraftResult.searchDefaultMissed` / `DraftResult.searchPropertyMissing`) and the\n *  environment-gap flag `notConfigured`. */\ntype SearchEnrichment = Enrichment<SearchPresence> & {\n  defaultQueryMissed: boolean;\n  propertyMissing: boolean;\n  /** True when the site IS analytics-enrolled but this environment has no GA/SC\n   *  credentials (`GA_SUBJECT` unset) — so the check could not run at all. Distinct\n   *  from the un-enrolled skip (nothing to measure) and from a soft-fail (the API\n   *  errored). See {@link fetchSearch}. */\n  notConfigured: boolean;\n};\n\n/**\n * Fetch the site's Google search presence for the period, soft-failing to null. Runs whenever\n * GA/SA is configured (`readGaConfig()` non-null — search shares the SA credentials) AND the\n * site is analytics-enrolled (has a `ga4PropertyId` OR an explicit `searchQuery`); otherwise a\n * legitimate skip (null value, `softFailed: false`). The brand query defaults to the site NAME\n * when no explicit `searchQuery` is set (whitespace-only counts as unset) — so brand presence is\n * tracked automatically, and the operator only hand-tunes the handful of sites the name misses.\n *\n * `propertyMissing` is true when NO Search Console property matched the site for any subject\n * (missing/unverified property or lost SA access) — flagged for BOTH explicit and name-default\n * queries, because no query can fix a missing property. Pre-split, this case was folded into\n * `defaultQueryMissed`, whose \"set an explicit Search query\" remedy would permanently SILENCE\n * it (an explicit query that finds nothing is by design never flagged).\n *\n * `defaultQueryMissed` is true ONLY when a property resolved, the site-name default was used,\n * AND Search Console returned no data for it (`position === null`) — the signal to set an\n * explicit `Search query`. It is false for an explicit query (even one that finds nothing —\n * that's a valid measurement), a default that does find a position, the not-enrolled skip,\n * and the errored soft-fail path.\n *\n * `notConfigured` splits the old single skip in two. An un-enrolled site is a true skip —\n * there is nothing to measure, and the checklist row stays manual. But an ENROLLED site in an\n * environment with no credentials is an environment gap: the check was supposed to run and\n * couldn't. Collapsing the two made a credential-less run (exactly what the daily-reports\n * workflow was) indistinguishable from \"this site opted out\", so the Google Indexed row\n * silently vanished from every drafted report instead of saying why.\n *\n * When the Search Console API errors it logs a one-line warning and returns `softFailed: true`.\n * Never throws, so a search problem can never block a draft.\n */\nexport async function fetchSearch(\n  siteRow: WebsiteRow,\n  periodStart: Date,\n  periodEnd: Date,\n): Promise<SearchEnrichment> {\n  const cfg = readGaConfig();\n  const enrolled = Boolean(siteRow.ga4PropertyId || siteRow.searchQuery);\n  if (!cfg || !enrolled) {\n    const notConfigured = enrolled && !cfg;\n    if (notConfigured) {\n      console.warn(\n        `⚑ Search: no GA/Search Console credentials in this environment (GA_SUBJECT unset) — the Google Indexed check could not run for ${siteRow.name}.`,\n      );\n    }\n    return { ...NO_ENRICHMENT, defaultQueryMissed: false, propertyMissing: false, notConfigured };\n  }\n  const explicit = siteRow.searchQuery?.trim();\n  const query = explicit || siteRow.name;\n  const usedDefault = !explicit;\n  try {\n    const value = await fetchSearchPresence(\n      {\n        keyPath: cfg.keyPath,\n        subjects: cfg.subjects,\n        property: siteRow.searchConsoleProperty ?? undefined,\n        host: siteRow.url,\n        query,\n      },\n      periodStart,\n      periodEnd,\n    );\n    const propertyMissing = !value.propertyFound;\n    if (propertyMissing) {\n      console.warn(\n        `⚑ Search: no Search Console property matched ${siteRow.url} for ${siteRow.name} — verify the domain property exists and the service account has access. (A \"Search query\" change cannot fix this.)`,\n      );\n    }\n    const defaultQueryMissed = value.propertyFound && usedDefault && value.position === null;\n    if (defaultQueryMissed) {\n      console.warn(\n        `⚑ Search: site-name default \"${query}\" found no Search Console data for ${siteRow.name} — set an explicit \"Search query\" in Airtable to track brand presence.`,\n      );\n    }\n    return { value, softFailed: false, defaultQueryMissed, propertyMissing, notConfigured: false };\n  } catch (e) {\n    console.warn(`⚠ Search presence skipped for ${siteRow.name}: ${(e as Error).message}`);\n    return {\n      value: null,\n      softFailed: true,\n      defaultQueryMissed: false,\n      propertyMissing: false,\n      notConfigured: false,\n    };\n  }\n}\n\nasync function derivePeriodStart(\n  base: AirtableBase,\n  siteRow: WebsiteRow,\n  reportType: ReportType,\n  today: Date,\n): Promise<Date> {\n  const prior = await listReportsForSite(base, siteRow.id);\n  const sameType = prior\n    .filter((r) => r.reportType === reportType && r.periodEnd)\n    .map((r) => r.periodEnd!)\n    .sort();\n  const latest = sameType[sameType.length - 1];\n  if (!latest) return daysAgo(today, 30);\n  // Half-open periods. The prior report's GA/Search windows are inclusive of its\n  // periodEnd, so starting this report on the *same* day double-counts that\n  // boundary day across two consecutive reports (and inflates the headline Users\n  // count). Start the next day instead. UTC to stay TZ-consistent with daysAgo.\n  const start = new Date(latest);\n  start.setUTCDate(start.getUTCDate() + 1);\n  return start;\n}\n","import type { ReportType } from \"./types.js\";\nimport type { WebsiteRow } from \"./airtable/websites.js\";\nimport type { SearchPresence } from \"./search/client.js\";\nimport { checklistFor, gatingFields } from \"./checklist.js\";\nimport { isNetlifyAppUrl } from \"../util/url.js\";\n\n/** A persisted audit signal is only trusted within this window — a stale \"pass\" degrades to\n *  \"unknown\" (no tick). Matches the github-signals staleness convention (~3 days). */\nconst STALE_DAYS = 3;\nconst MS_PER_DAY = 24 * 60 * 60 * 1000;\n\n/** True when `checkedAt` is a valid timestamp within STALE_DAYS of `now`. */\nfunction isFresh(checkedAt: string | null, now: Date): boolean {\n  if (!checkedAt) return false;\n  const t = new Date(checkedAt).getTime();\n  if (Number.isNaN(t)) return false;\n  return now.getTime() - t <= STALE_DAYS * MS_PER_DAY;\n}\n\n/** Cert-expiry buffer: a cert must have MORE than this many days left to pass (renew window).\n *  Exactly 14 days does NOT pass — matches the spec's strict \">14 days\" and the domain audit's\n *  own `> 14` pass status, so the two thresholds can't drift. */\nconst CERT_MIN_DAYS = 14;\n\n/** A single auto-check outcome. `pass` + fresh ⇒ the caller ticks the box. */\nexport type EvidenceResult = \"pass\" | \"fail\" | \"unknown\" | \"n/a\";\nexport type EvidenceRecord = { result: EvidenceResult; checkedAt: string | null; note: string };\n\n/**\n * Inline signals fetched during the draft. Phase 1 carries Search Console only; Phase 2/3 read\n * the remaining signals (security, domain, browser) off the Websites row passed as `site`.\n */\nexport type AutoTickSignals = {\n  search: {\n    value: SearchPresence | null;\n    softFailed: boolean;\n    /** The site is analytics-enrolled but this environment has no GA/Search Console\n     *  credentials, so the check could not run. Kept distinct from the un-enrolled skip\n     *  (`value: null`, this false) so the evidence can name the environment gap instead\n     *  of disappearing. */\n    notConfigured: boolean;\n  };\n};\n\n/**\n * Decide, per checklist item for this report type, an evidence record. PURE. The fail-safe\n * invariant lives here: a box is only tickable when `result === \"pass\"`. Google Indexed is an\n * inline signal (fetched at draft), so its evidence is inherently fresh (`checkedAt = now`).\n *\n * The semantic inversion: every GATING item for this report type gets a status even with no\n * signal — a never-measured gating item resolves to `unknown` (which blocks the send gate), not\n * an omission the caller could read as \"manual/OK\". Only non-gating (advisory) items keep the old\n * omit-when-absent behavior, so an unconfigured advisory check stays silently manual.\n */\nexport function autoTickChecklist(\n  site: WebsiteRow,\n  reportType: ReportType,\n  now: Date,\n  signals: AutoTickSignals,\n): Map<string, EvidenceRecord> {\n  const out = new Map<string, EvidenceRecord>();\n  const gating = new Set(gatingFields(reportType));\n\n  for (const item of checklistFor(reportType)) {\n    let ev: EvidenceRecord | null;\n    switch (item.field) {\n      case \"Maint: Google Indexed\":\n        ev = googleEvidence(now, signals.search);\n        break;\n      case \"Maint: Deploy & Function Health\":\n        ev = deployEvidence(site, now);\n        break;\n      case \"Maint: CMS Checked\":\n        ev = cmsEvidence(site, now);\n        break;\n      case \"Maint: Domain, DNS & SSL\":\n        ev = domainEvidence(site, now);\n        break;\n      case \"Maint: Security Updates\":\n        ev = securityEvidence(site, now);\n        break;\n      case \"Maint: Uptime Checked\":\n        ev = uptimeEvidence(site, now);\n        break;\n      case \"Test: Desktop Browsers\":\n        ev = browserEvidence(\n          site.crossbrowserOk,\n          site,\n          now,\n          \"Desktop renders cleanly\",\n          \"render errors\",\n        );\n        break;\n      case \"Test: Mobile Browsers\":\n        ev = browserEvidence(site.mobileOk, site, now, \"Mobile renders cleanly\", \"overflow/errors\");\n        break;\n      case \"Test: Page Titles & Meta\":\n        ev = titlesEvidence(site, now);\n        break;\n      case \"Test: Links & Navigation\": {\n        const broken = site.brokenLinks;\n        const failNote = broken && broken > 0 ? `${broken} broken link(s)` : \"broken links / nav\";\n        ev = browserEvidence(site.linksOk, site, now, \"All internal links resolve\", failNote);\n        break;\n      }\n      case \"Test: Form Functionality\":\n        ev = formsEvidence(site, now);\n        break;\n      case \"Test: Interactions & Animations\":\n        ev = interactionsEvidence(site, now);\n        break;\n      case \"Test: Verified After Updates\":\n        ev = updatesEvidence(site, now);\n        break;\n      default:\n        ev = null;\n    }\n    // The semantic inversion: a GATING item with no fresh signal must still carry a status —\n    // `unknown` (blocks) — so an unwired/absent signal can never leave the gate silently\n    // passable. Advisory items (e.g. Google Indexed on a Maintenance report) keep the old\n    // omit-when-absent behavior.\n    if (ev === null && gating.has(item.field)) {\n      ev = { result: \"unknown\", checkedAt: null, note: \"Not yet measured\" };\n    }\n    if (ev !== null) out.set(item.field, ev);\n  }\n\n  return out;\n}\n\n/** One browser-audit verdict (Desktop/Mobile/Links) → evidence, gated on `Browser checked at`\n *  freshness. null verdict (never run) → omit (manual); stale → unknown; true → pass; false →\n *  fail (with the failure note). The verdict itself was computed by the audit (summarizeBrowser). */\nfunction browserEvidence(\n  ok: boolean | null,\n  site: WebsiteRow,\n  now: Date,\n  passNote: string,\n  failNote: string,\n): EvidenceRecord | null {\n  if (ok === null || !site.browserCheckedAt) return null;\n  const at = site.browserCheckedAt;\n  if (!isFresh(at, now)) {\n    return { result: \"unknown\", checkedAt: at, note: \"Browser check is stale (>3d)\" };\n  }\n  return ok\n    ? { result: \"pass\", checkedAt: at, note: passNote }\n    : { result: \"fail\", checkedAt: at, note: failNote };\n}\n\n/**\n * Security Updates evidence from the persisted `security` audit. Omits (→ manual) when the audit\n * never ran (counts null / no timestamp); stale → unknown; 0 critical AND 0 high → pass; any\n * critical/high → fail (with the count). Honest scope: \"no known critical/high advisories in the\n * declared dependencies as of the last audit\" — moderate/low are advisory, not gating, and this\n * does not prove the fix is deployed.\n */\nfunction securityEvidence(site: WebsiteRow, now: Date): EvidenceRecord | null {\n  const crit = site.securityVulnsCritical;\n  const high = site.securityVulnsHigh;\n  if (crit === null || high === null || !site.lastSecurityAuditAt) return null;\n  const at = site.lastSecurityAuditAt;\n  if (!isFresh(at, now)) {\n    return { result: \"unknown\", checkedAt: at, note: \"Security audit is stale (>3d)\" };\n  }\n  if (crit === 0 && high === 0) {\n    return { result: \"pass\", checkedAt: at, note: \"No known critical/high vulnerabilities\" };\n  }\n  return { result: \"fail\", checkedAt: at, note: `${crit} critical / ${high} high vuln(s)` };\n}\n\n/**\n * Search Console → Google Indexed evidence. A soft-fail (the API errored) and an unwired\n * environment (`notConfigured`) are both `unknown`, but they carry DIFFERENT notes — an\n * operator staring at an amber pill has to be able to tell \"Google was unreachable this run\"\n * from \"this deployment has no Search Console credentials\", because only the second one is\n * fixed by wiring a secret. An un-enrolled site (`value: null`, not configured, not failed)\n * emits nothing so the box stays manual.\n *\n * Page-1 is `pass` (with the position in the note); off page 1 is `fail`.\n */\nfunction googleEvidence(now: Date, search: AutoTickSignals[\"search\"]): EvidenceRecord | null {\n  const at = now.toISOString();\n  if (search.softFailed) {\n    return { result: \"unknown\", checkedAt: at, note: \"Search Console unavailable this run\" };\n  }\n  if (search.notConfigured) {\n    return {\n      result: \"unknown\",\n      checkedAt: at,\n      note: \"Search Console not configured in the environment that drafted this report\",\n    };\n  }\n  if (search.value === null) return null;\n  if (search.value.foundOnPage1) {\n    const pos = search.value.position;\n    return {\n      result: \"pass\",\n      checkedAt: at,\n      note: `Page 1 on Google${pos !== null ? ` (#${pos})` : \"\"}`,\n    };\n  }\n  const pos = search.value.position;\n  return {\n    result: \"fail\",\n    checkedAt: at,\n    note: `Not on page 1${pos !== null ? ` (avg #${pos})` : \"\"}`,\n  };\n}\n\n/**\n * Domain/DNS/SSL evidence from the persisted `domain` audit. Omits (→ manual) when there's no\n * custom domain to verify (`*.netlify.app`) or the audit never ran. A `pass` requires a fresh\n * check that resolved with a cert comfortably before expiry; stale → unknown; resolved-but-no-cert\n * or near/past expiry → fail. The honest scope is resolve + valid cert — NOT registrar expiry,\n * www↔apex redirect, or MX.\n */\nfunction domainEvidence(site: WebsiteRow, now: Date): EvidenceRecord | null {\n  // No custom domain to verify — the no-domain watch signal covers `*.netlify.app` elsewhere.\n  if (!site.url || isNetlifyAppUrl(site.url)) return null;\n  if (!site.domainCheckedAt) return null; // never probed → leave manual\n  const at = site.domainCheckedAt;\n  if (!isFresh(site.domainCheckedAt, now)) {\n    return { result: \"unknown\", checkedAt: at, note: \"Domain check is stale (>3d)\" };\n  }\n  const days = site.certDaysRemaining;\n  if (days === null) {\n    return { result: \"fail\", checkedAt: at, note: \"Did not resolve, or no valid TLS cert\" };\n  }\n  if (days <= CERT_MIN_DAYS) {\n    return { result: \"fail\", checkedAt: at, note: `TLS cert expires in ${days}d` };\n  }\n  return { result: \"pass\", checkedAt: at, note: `Custom domain, valid cert (${days}d left)` };\n}\n\n/**\n * Deploy & Function Health: the Netlify build is `ready` AND the deployed function responds\n * healthy. Two freshness stamps must both be fresh (deploy check + function-health check). Never\n * measured → null (omit → the gating dispatch coerces to unknown); either stale → unknown; both\n * fresh + ready + fn pass → pass; otherwise fail.\n */\nfunction deployEvidence(site: WebsiteRow, now: Date): EvidenceRecord | null {\n  if (!site.deployCheckedAt && !site.functionHealthCheckedAt) return null;\n  if (!isFresh(site.deployCheckedAt, now) || !isFresh(site.functionHealthCheckedAt, now)) {\n    return {\n      result: \"unknown\",\n      checkedAt: site.functionHealthCheckedAt ?? site.deployCheckedAt,\n      note: \"Deploy/function-health check is stale (>3d)\",\n    };\n  }\n  const ready = site.deployStatus === \"ready\";\n  const fnOk = site.functionHealth === \"pass\";\n  if (ready && fnOk) {\n    return {\n      result: \"pass\",\n      checkedAt: site.functionHealthCheckedAt,\n      note: \"Netlify build ready + functions respond\",\n    };\n  }\n  const why =\n    !ready && !fnOk\n      ? \"build not ready + functions unhealthy\"\n      : !ready\n        ? \"build not ready\"\n        : \"functions unhealthy\";\n  return {\n    result: \"fail\",\n    checkedAt: site.functionHealthCheckedAt,\n    note: `Deploy/function-health failing — ${why}`,\n  };\n}\n\n/**\n * CMS Checked: the server-side `/health` Prismic probe reported reachable. Freshness rides the\n * function-health check stamp (one `/health` fetch feeds both Deploy and CMS). Never measured →\n * null; stale → unknown; pass/fail mirror the stored verdict; a fresh stamp with no verdict →\n * unknown.\n */\nfunction cmsEvidence(site: WebsiteRow, now: Date): EvidenceRecord | null {\n  if (!site.functionHealthCheckedAt) return null;\n  const at = site.functionHealthCheckedAt;\n  if (!isFresh(at, now)) {\n    return { result: \"unknown\", checkedAt: at, note: \"CMS check is stale (>3d)\" };\n  }\n  if (site.cmsReachable === \"pass\") {\n    return { result: \"pass\", checkedAt: at, note: \"Prismic reachable (server-side)\" };\n  }\n  if (site.cmsReachable === \"fail\") {\n    return { result: \"fail\", checkedAt: at, note: \"Prismic unreachable (server-side)\" };\n  }\n  return { result: \"unknown\", checkedAt: at, note: \"CMS reachability not reported\" };\n}\n\n/**\n * Uptime Checked: every sampled route returned 2xx/3xx on the browser audit (point-in-time).\n * Freshness rides the shared `browserCheckedAt`. Never ran → null; stale → unknown.\n */\nfunction uptimeEvidence(site: WebsiteRow, now: Date): EvidenceRecord | null {\n  if (site.reachableOk === null || !site.browserCheckedAt) return null;\n  const at = site.browserCheckedAt;\n  if (!isFresh(at, now)) {\n    return { result: \"unknown\", checkedAt: at, note: \"Uptime check is stale (>3d)\" };\n  }\n  return site.reachableOk === \"pass\"\n    ? { result: \"pass\", checkedAt: at, note: \"All sampled routes reachable (point-in-time)\" }\n    : { result: \"fail\", checkedAt: at, note: \"One or more sampled routes did not respond 2xx/3xx\" };\n}\n\n/**\n * Page Titles & Meta: every sampled route had a non-empty title + meta description with no\n * duplicate titles (browser audit, chromium). Freshness rides `browserCheckedAt`.\n */\nfunction titlesEvidence(site: WebsiteRow, now: Date): EvidenceRecord | null {\n  if (site.titleMetaOk === null || !site.browserCheckedAt) return null;\n  const at = site.browserCheckedAt;\n  if (!isFresh(at, now)) {\n    return { result: \"unknown\", checkedAt: at, note: \"Titles/meta check is stale (>3d)\" };\n  }\n  return site.titleMetaOk === \"pass\"\n    ? { result: \"pass\", checkedAt: at, note: \"Titles + meta present\" }\n    : {\n        result: \"fail\",\n        checkedAt: at,\n        note: \"Missing/duplicate title or missing meta description\",\n      };\n}\n\n/**\n * Form Functionality: a synthetic prod submission succeeded (form-e2e audit). `n/a` when the audit\n * ran (checked-at stamp set) but the site has no contact form (verdict cleared to null). Never ran\n * (no stamp) → null; stale → unknown.\n */\nfunction formsEvidence(site: WebsiteRow, now: Date): EvidenceRecord | null {\n  if (!site.formE2eCheckedAt) return null;\n  const at = site.formE2eCheckedAt;\n  if (!isFresh(at, now)) {\n    return { result: \"unknown\", checkedAt: at, note: \"Form E2E check is stale (>3d)\" };\n  }\n  if (site.formE2eOk === \"pass\") {\n    return { result: \"pass\", checkedAt: at, note: \"Synthetic submission succeeded\" };\n  }\n  if (site.formE2eOk === \"fail\") {\n    return { result: \"fail\", checkedAt: at, note: \"Synthetic submission failed\" };\n  }\n  return { result: \"n/a\", checkedAt: at, note: \"No contact form on this site\" };\n}\n\n/**\n * Interactions & Animations: the per-site smoke suite is green. Freshness rides `lastSmokeAt`.\n * Never ran → null; stale → unknown.\n */\nfunction interactionsEvidence(site: WebsiteRow, now: Date): EvidenceRecord | null {\n  if (site.smokeOk === null || !site.lastSmokeAt) return null;\n  const at = site.lastSmokeAt;\n  if (!isFresh(at, now)) {\n    return { result: \"unknown\", checkedAt: at, note: \"Smoke suite is stale (>3d)\" };\n  }\n  return site.smokeOk === \"pass\"\n    ? { result: \"pass\", checkedAt: at, note: \"Smoke suite green\" }\n    : { result: \"fail\", checkedAt: at, note: \"Smoke suite red\" };\n}\n\n/**\n * Tested After Updates: default-branch CI is green on the latest commit (github-signals). A repo\n * with no CI (`defaultBranchCi === \"none\"`) is `n/a`. Never swept (null / no stamp) → null; stale\n * → unknown; passing → pass; failing → fail; pending → unknown.\n */\nfunction updatesEvidence(site: WebsiteRow, now: Date): EvidenceRecord | null {\n  if (site.defaultBranchCi === null || !site.githubSignalsAt) return null;\n  const at = site.githubSignalsAt;\n  if (site.defaultBranchCi === \"none\") {\n    return { result: \"n/a\", checkedAt: at, note: \"Repository has no CI\" };\n  }\n  if (!isFresh(at, now)) {\n    return { result: \"unknown\", checkedAt: at, note: \"CI signal is stale (>3d)\" };\n  }\n  if (site.defaultBranchCi === \"passing\") {\n    return { result: \"pass\", checkedAt: at, note: \"Default-branch CI green on latest commit\" };\n  }\n  if (site.defaultBranchCi === \"failing\") {\n    return { result: \"fail\", checkedAt: at, note: \"Default-branch CI is failing\" };\n  }\n  return { result: \"unknown\", checkedAt: at, note: \"Default-branch CI is pending\" };\n}\n","import { readFileSync } from \"node:fs\";\nimport { JWT } from \"google-auth-library\";\nimport { BetaAnalyticsDataClient } from \"@google-analytics/data\";\nimport { withSubjectFailover } from \"./failover.js\";\n\nconst ANALYTICS_READONLY = \"https://www.googleapis.com/auth/analytics.readonly\";\nconst MS_PER_DAY = 86_400_000;\n\nexport type GaQuery = {\n  /** GA4 numeric property ID (e.g. \"471880366\"). */\n  propertyId: string;\n  /** Workspace users to impersonate via domain-wide delegation, tried in order\n   *  (auth-failure failover — see `withSubjectFailover`). */\n  subjects: string[];\n  /** Path to the service-account JSON key. */\n  keyPath: string;\n};\n\n/** UTC YYYY-MM-DD — matches the rest of the reports pipeline's date handling. */\nfunction ymd(d: Date): string {\n  return d.toISOString().slice(0, 10);\n}\n\n/**\n * Fetch GA4 `activeUsers` (\"Users\") for a report period and the equal-length window\n * immediately before it, via a domain-wide-delegation service account impersonating each\n * of `subjects` in order until one authenticates. Throws on any non-auth API error, or\n * once every subject has failed auth — the caller (draftReportForSite) soft-fails.\n *\n * Previous window: same length as the current period, ending the day before `periodStart`.\n */\nexport async function fetchPeriodUsers(\n  query: GaQuery,\n  periodStart: Date,\n  periodEnd: Date,\n): Promise<{ current: number; previous: number }> {\n  const key = JSON.parse(readFileSync(query.keyPath, \"utf8\")) as {\n    client_email: string;\n    private_key: string;\n  };\n\n  const lengthDays = Math.round((periodEnd.getTime() - periodStart.getTime()) / MS_PER_DAY);\n  const prevEnd = new Date(periodStart.getTime() - MS_PER_DAY);\n  const prevStart = new Date(prevEnd.getTime() - lengthDays * MS_PER_DAY);\n  const property = `properties/${query.propertyId}`;\n\n  return withSubjectFailover(query.subjects, \"GA\", async (subject) => {\n    const authClient = new JWT({\n      email: key.client_email,\n      key: key.private_key,\n      scopes: [ANALYTICS_READONLY],\n      subject,\n    });\n    const client = new BetaAnalyticsDataClient({ authClient });\n\n    const run = async (start: Date, end: Date): Promise<number> => {\n      const [resp] = await client.runReport({\n        property,\n        dateRanges: [{ startDate: ymd(start), endDate: ymd(end) }],\n        metrics: [{ name: \"activeUsers\" }],\n      });\n      const raw = resp.rows?.[0]?.metricValues?.[0]?.value ?? \"0\";\n      const n = Number.parseInt(raw, 10);\n      return Number.isFinite(n) ? n : 0;\n    };\n\n    const current = await run(periodStart, periodEnd);\n    const previous = await run(prevStart, prevEnd);\n    return { current, previous };\n  });\n}\n","/**\n * Impersonation-subject failover, shared by the GA Data client and the Search Console\n * client (both impersonate the same `GA_SUBJECT` list via domain-wide delegation).\n *\n * The point: one personal Workspace account backing every site's analytics is a fleet-wide\n * SPOF — if it's offboarded/suspended or loses property access, all analytics soft-fail to\n * blank at once. With `GA_SUBJECT` as an ordered list, an auth failure on one subject falls\n * through to the next, and a *partial* outage (primary dying, backup carrying) is surfaced\n * as a greppable `subject failover` warning before it becomes a total one.\n */\n\nconst AUTH_HTTP_STATUS = new Set([401, 403]);\n/** gRPC PERMISSION_DENIED (7) / UNAUTHENTICATED (16) — how the GA Data API surfaces auth. */\nconst AUTH_GRPC_CODES = new Set([7, 16]);\n/** Message shapes across the three auth surfaces: gRPC code names (GA Data), OAuth token\n *  exchange (`invalid_grant` = suspended/deleted subject, `unauthorized_client` = DWD scope\n *  missing), and plain HTTP 401/403 texts (Search Console via gaxios). */\nconst AUTH_MESSAGE =\n  /permission[_ ]denied|unauthenticated|unauthorized|invalid_grant|access[_ ]denied|forbidden|insufficient permission|status code 40[13]/i;\n\ntype ErrorShape = {\n  code?: number | string;\n  status?: number | string;\n  response?: { status?: number; data?: { error?: { errors?: Array<{ reason?: string }> } } };\n  /** Explicit opt-in marker for errors that aren't auth-shaped per se but mean \"this\n   *  subject can't do the job, try the next one\" (see the search client's empty\n   *  sites.list case — that API hides inaccessible properties instead of 403ing). */\n  failoverToNextSubject?: boolean;\n};\n\n/** Google surfaces per-user throughput caps as HTTP 403 with one of these `reason`s — a\n *  transient rate-limit, NOT a lost grant. Distinguished so the failover warning doesn't\n *  send operators to the offboarding runbook over a quota blip. */\nconst QUOTA_REASONS = new Set([\n  \"userratelimitexceeded\",\n  \"ratelimitexceeded\",\n  \"quotaexceeded\",\n  \"dailylimitexceeded\",\n]);\nconst QUOTA_MESSAGE = /quota exceeded|rate limit exceeded|user rate limit/i;\n\n/** True when an error looks like THIS subject's auth/authorization failed — the only\n *  condition worth retrying under a different subject. Network/5xx/bad-input errors\n *  would fail identically for every subject, so they propagate immediately. */\nexport function isAuthShapedError(e: unknown): boolean {\n  const err = e as ErrorShape | null | undefined;\n  if (err?.failoverToNextSubject === true) return true;\n  if ([err?.status, err?.response?.status].some((s) => AUTH_HTTP_STATUS.has(Number(s))))\n    return true;\n  if (AUTH_HTTP_STATUS.has(Number(err?.code)) || AUTH_GRPC_CODES.has(Number(err?.code)))\n    return true;\n  const msg = e instanceof Error ? e.message : String(e);\n  return AUTH_MESSAGE.test(msg);\n}\n\n/** A soft \"this subject can't see the resource, try the next one\" marker (the search\n *  client's empty sites.list case) — NOT a genuine failure. It must never dominate a real\n *  auth error when deciding what to throw after all subjects are exhausted. */\nfunction isFailoverSentinel(e: unknown): boolean {\n  return (e as ErrorShape | null | undefined)?.failoverToNextSubject === true;\n}\n\n/** True when a 403 is a transient per-user quota/rate-limit, not an access loss. A\n *  structured `reason` is authoritative (so a real `forbidden` 403 whose message happens to\n *  mention a limit is NOT quota); otherwise fall back to the message. Still auth-shaped for\n *  failover purposes — this only softens the warning wording, never the control flow. */\nexport function isQuotaShapedError(e: unknown): boolean {\n  const err = e as ErrorShape | null | undefined;\n  if (err?.failoverToNextSubject === true) return false;\n  const reasons = err?.response?.data?.error?.errors;\n  if (Array.isArray(reasons) && reasons.length > 0) {\n    return reasons.some((r) => r?.reason != null && QUOTA_REASONS.has(r.reason.toLowerCase()));\n  }\n  const msg = e instanceof Error ? e.message : String(e);\n  return QUOTA_MESSAGE.test(msg);\n}\n\n/**\n * Run `attempt` with each subject in order until one succeeds. Auth-shaped failures fall\n * through to the next subject; anything else throws immediately. When all subjects fail,\n * the LAST error is thrown — callers keep their existing catch-and-soft-fail behavior.\n * When an earlier subject failed but a later one succeeded, emit ONE console.warn so a\n * dying primary is visible in the cron log before it becomes a total outage.\n */\nexport async function withSubjectFailover<T>(\n  subjects: readonly string[],\n  label: string,\n  attempt: (subject: string) => Promise<T>,\n): Promise<T> {\n  if (subjects.length === 0) throw new Error(`${label}: no impersonation subjects configured`);\n  const failed: string[] = [];\n  // Track a genuine auth failure separately from a soft sentinel. If ANY subject failed for\n  // real, that error must be what we throw — never a later subject's \"no resource here\"\n  // sentinel. Otherwise [real-auth-failure, empty-result] would surface as a clean sentinel\n  // and the caller would record it as verified data instead of soft-failing (the exact\n  // masking the analytics-health alarm exists to catch).\n  let lastRealError: unknown;\n  let lastSentinel: unknown;\n  // Stays true only while every failure so far is a transient quota/rate-limit — a lost\n  // grant or a sentinel flips it, escalating the warning from \"transient\" to the runbook.\n  let allQuota = true;\n  for (const subject of subjects) {\n    try {\n      const result = await attempt(subject);\n      if (failed.length > 0) {\n        console.warn(\n          allQuota\n            ? `⚠ ${label} subject failover: ${failed.join(\"; \")} — succeeded via ${subject} ` +\n                `(transient quota/rate-limit, not an access loss).`\n            : `⚠ ${label} subject failover: ${failed.join(\"; \")} — succeeded via ${subject}. ` +\n                `Restore the failing subject's access or drop it from GA_SUBJECT ` +\n                `(docs/runbooks/ga-search-role-account-cutover.md).`,\n        );\n      }\n      return result;\n    } catch (e) {\n      if (!isAuthShapedError(e)) throw e;\n      failed.push(`${subject} (${e instanceof Error ? e.message : String(e)})`);\n      if (isFailoverSentinel(e)) {\n        lastSentinel = e;\n        allQuota = false;\n      } else {\n        lastRealError = e;\n        if (!isQuotaShapedError(e)) allQuota = false;\n      }\n    }\n  }\n  // A real auth failure dominates a sentinel regardless of subject order; only when EVERY\n  // subject merely returned the soft sentinel do we throw it (the search client turns that\n  // into a legitimate not-found).\n  throw lastRealError ?? lastSentinel;\n}\n","import { readFileSync } from \"node:fs\";\nimport { JWT } from \"google-auth-library\";\nimport { withSubjectFailover } from \"../ga/failover.js\";\n\nconst WEBMASTERS_READONLY = \"https://www.googleapis.com/auth/webmasters.readonly\";\nconst SC_BASE = \"https://searchconsole.googleapis.com/webmasters/v3\";\n/** Average-position threshold for \"on page 1\" (10 organic results per page). */\nconst PAGE_1_MAX_POSITION = 10;\n/** Rows to pull for the brand `contains` match. searchAnalytics has no orderBy and returns\n *  rows clicks-desc, so the exact-query row survives into the response only if it isn't paged\n *  out beyond this cap. Sized with wide headroom — a brand has a handful of phrasing variants,\n *  far below 100 — so the exact query (and every variant) is in practice always present. */\nexport const BRAND_QUERY_ROW_LIMIT = 100;\n\nexport type SearchPresenceQuery = {\n  /** Path to the service-account JSON key (same one GA uses). */\n  keyPath: string;\n  /** Workspace users to impersonate via domain-wide delegation, tried in order\n   *  (auth-failure failover — see `withSubjectFailover`). */\n  subjects: string[];\n  /** Explicit Search Console property (`sc-domain:...` or `https://.../`). Overrides auto-resolution. */\n  property?: string | undefined;\n  /** Site host, used to auto-resolve the property from `sites.list` when `property` is absent. */\n  host: string;\n  /** Operator-supplied brand hint (e.g. the business name). Matched as a case-insensitive\n   *  SUBSTRING (`contains`) of the actual user query — NOT a hard exact string — so it tolerates\n   *  phrasing (\"red door creative\" vs \"…creative la\"). An exact-query match is preferred when\n   *  present; otherwise the most-searched matching query wins. */\n  query: string;\n};\n\nexport type SearchPresence = {\n  /** True when the average position for the query is on page 1 (<= 10). */\n  foundOnPage1: boolean;\n  /** Rounded average position, or null when not found / no data. */\n  position: number | null;\n  /** True when a Search Console property was actually resolved for the site (even if the\n   *  query then found no data). False ONLY when every subject resolved ZERO matching\n   *  properties — a missing/unverified property or lost SA access. Callers must\n   *  distinguish these: \"property exists, query missed\" is fixable with a better query;\n   *  \"no property at all\" is not, and prescribing a query change would silence the real\n   *  problem forever (an explicit query that returns nothing is by design never flagged). */\n  propertyFound: boolean;\n};\n\ntype SiteEntry = { siteUrl: string };\n\n/** Reduce any property string or URL to a bare host: no `sc-domain:`, scheme, `www.`, path, lowercased. */\nexport function bareHost(s: string): string {\n  return s\n    .trim()\n    .replace(/^sc-domain:/i, \"\")\n    .replace(/^https?:\\/\\//i, \"\")\n    .split(\"/\")[0]!\n    .replace(/^www\\./i, \"\")\n    .toLowerCase();\n}\n\n/**\n * All Search Console properties matching `host`, ordered for query fallback: Domain\n * (`sc-domain:`) forms first (broadest coverage), then URL-prefix forms. A site can be verified\n * as both; a freshly-created Domain property has no backfilled history, so its data can be empty\n * even while a long-lived URL-prefix property has data — hence we return every match and let the\n * caller try them in order until one returns data. Empty list = nothing matches.\n */\nexport function resolvePropertyCandidates(entries: SiteEntry[], host: string): string[] {\n  const target = bareHost(host);\n  const matches = entries.filter((e) => bareHost(e.siteUrl) === target).map((e) => e.siteUrl);\n  const domains = matches.filter((s) => s.toLowerCase().startsWith(\"sc-domain:\"));\n  const prefixes = matches.filter((s) => !s.toLowerCase().startsWith(\"sc-domain:\"));\n  return [...domains, ...prefixes];\n}\n\n/** UTC YYYY-MM-DD — matches the rest of the reports pipeline. */\nfunction ymd(d: Date): string {\n  return d.toISOString().slice(0, 10);\n}\n\n/**\n * From the queries matching the brand substring, pick the one the brand is actually FOUND\n * by most — the highest-impression row — and return its average position; tie-break on the\n * better (lower) position. Returns undefined when no row carries a numeric position. This is\n * what makes the reported \"brand search\" position robust to phrasing: with a `contains`\n * filter several variants can match, and we report the position of the variant real users\n * search most, not whichever the operator happened to type. Rows missing `impressions` count\n * as 0 (keeps a single-row, impression-less response — e.g. a test fixture — working). PURE.\n */\nexport function pickBrandQuery(\n  rows: Array<{ position?: number; impressions?: number }>,\n): number | undefined {\n  let best: { position: number; impressions: number } | undefined;\n  for (const r of rows) {\n    if (typeof r.position !== \"number\") continue;\n    const impressions = r.impressions ?? 0;\n    if (\n      best === undefined ||\n      impressions > best.impressions ||\n      (impressions === best.impressions && r.position < best.position)\n    ) {\n      best = { position: r.position, impressions };\n    }\n  }\n  return best?.position;\n}\n\n/**\n * The brand's reported position from the `contains`-matched rows, preferring an EXACT match.\n * When a returned row's query equals the operator's configured string (case-insensitive), its\n * position is used verbatim — a precisely-configured brand query is honored, with no chance a\n * longer higher-impression variant (\"…reviews\", \"…near me\") hijacks the number. Otherwise we\n * fall back to the most-searched matching query (`pickBrandQuery`). Operates only on the rows\n * actually returned: a string `contains` itself, so the exact query is among the `contains`\n * results whenever it has data AND isn't paged out beyond `BRAND_QUERY_ROW_LIMIT` (sized so a\n * brand's handful of phrasing variants always fit; if it ever were paged out, the most-searched\n * fallback still returns a valid brand position). Returns undefined when no row carries a\n * numeric position. PURE.\n */\nexport function selectBrandPosition(\n  rows: Array<{ keys?: string[]; position?: number; impressions?: number }>,\n  exactQuery: string,\n): number | undefined {\n  const want = exactQuery.toLowerCase();\n  const exact = rows.find(\n    (r) => typeof r.position === \"number\" && (r.keys?.[0] ?? \"\").toLowerCase() === want,\n  );\n  if (exact) return exact.position;\n  return pickBrandQuery(rows);\n}\n\n/** Per-subject \"this subject resolved NO matching Search Console property\". sites.list only\n *  returns properties the impersonated user can access — a subject that lost access sees an\n *  empty list with no auth error at all — so this opts into subject failover explicitly.\n *  When EVERY subject resolves empty, `fetchSearchPresence` restores the pre-failover\n *  behavior: a plain not-found result, not a throw. */\nclass NoPropertyForSubjectError extends Error {\n  readonly failoverToNextSubject = true;\n  constructor(subject: string, host: string) {\n    super(`no Search Console property matching ${host} is visible to ${subject}`);\n  }\n}\n\n/**\n * Query Google Search Console for the brand's average position on the site over the report\n * period, via a domain-wide-delegation service account impersonating each of `subjects` in\n * order until one authenticates. `query` is a case-insensitive SUBSTRING (`contains`) hint;\n * among the matching user queries we report the position of the exact-match query when\n * present, else the most-searched one (see `selectBrandPosition`) — so it doesn't depend on\n * the operator typing the exact search string, yet honors one verbatim when they do. Uses\n * `property` verbatim when given (operator's choice is final — no fallback); otherwise\n * auto-discovers all matching properties via `sites.list` and tries them in order (Domain\n * first) until one returns data. Throws on any non-auth API error, or once every subject\n * has failed auth — the caller (draftReportForSite) soft-fails.\n */\nexport async function fetchSearchPresence(\n  q: SearchPresenceQuery,\n  periodStart: Date,\n  periodEnd: Date,\n): Promise<SearchPresence> {\n  const key = JSON.parse(readFileSync(q.keyPath, \"utf8\")) as {\n    client_email: string;\n    private_key: string;\n  };\n\n  try {\n    return await withSubjectFailover(q.subjects, \"Search Console\", async (subject) => {\n      const jwt = new JWT({\n        email: key.client_email,\n        key: key.private_key,\n        scopes: [WEBMASTERS_READONLY],\n        subject,\n      });\n\n      const explicit = q.property?.trim();\n      let candidates: string[];\n      if (explicit) {\n        candidates = [explicit];\n      } else {\n        const list = await jwt.request<{ siteEntry?: SiteEntry[] }>({\n          url: `${SC_BASE}/sites`,\n          method: \"GET\",\n        });\n        candidates = resolvePropertyCandidates(list.data.siteEntry ?? [], q.host);\n        if (candidates.length === 0) throw new NoPropertyForSubjectError(subject, q.host);\n      }\n\n      for (const property of candidates) {\n        const res = await jwt.request<{\n          rows?: Array<{ keys?: string[]; position?: number; impressions?: number }>;\n        }>({\n          url: `${SC_BASE}/sites/${encodeURIComponent(property)}/searchAnalytics/query`,\n          method: \"POST\",\n          data: {\n            startDate: ymd(periodStart),\n            endDate: ymd(periodEnd),\n            dimensions: [\"query\"],\n            dimensionFilterGroups: [\n              {\n                filters: [\n                  { dimension: \"query\", operator: \"contains\", expression: q.query.toLowerCase() },\n                ],\n              },\n            ],\n            rowLimit: BRAND_QUERY_ROW_LIMIT,\n          },\n        });\n        const pos = selectBrandPosition(res.data.rows ?? [], q.query.toLowerCase());\n        if (typeof pos === \"number\") {\n          // Search Console can average below 1; floor to 1 so the template never\n          // renders a nonsensical \"#0\" (positions are 1-indexed).\n          return {\n            foundOnPage1: pos <= PAGE_1_MAX_POSITION,\n            position: Math.max(1, Math.round(pos)),\n            propertyFound: true,\n          };\n        }\n      }\n      // A property WAS resolved (or operator-pinned); the query just found no rows.\n      return { foundOnPage1: false, position: null, propertyFound: true };\n    });\n  } catch (e) {\n    // Every subject resolved zero matching properties — same legitimate \"no property\"\n    // outcome as before failover existed, NOT an analytics soft-failure. Marked\n    // propertyFound:false so the draft layer can flag the ACTUAL problem (missing\n    // property / lost SA access) instead of blaming the query.\n    if (e instanceof NoPropertyForSubjectError)\n      return { foundOnPage1: false, position: null, propertyFound: false };\n    throw e;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS,YAAY;AAwBvB,SAAS,eAAgC;AAC9C,QAAM,YAAY,QAAQ,IAAI,cAAc,IACzC,MAAM,GAAG,EACT,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,OAAO;AACjB,MAAI,SAAS,WAAW,EAAG,QAAO;AAClC,QAAM,UACJ,QAAQ,IAAI,gBAAgB,KAAK,KACjC,KAAK,QAAQ,uBAAuB,CAAC,GAAG,yBAAyB;AACnE,SAAO,EAAE,UAAU,QAAQ;AAC7B;;;AClCA,SAAS,OAAO,iBAAiB;AACjC,SAAS,WAAAA,gBAAe;;;ACOxB,IAAM,aAAa;AACnB,IAAM,aAAa,KAAK,KAAK,KAAK;AAGlC,SAAS,QAAQ,WAA0B,KAAoB;AAC7D,MAAI,CAAC,UAAW,QAAO;AACvB,QAAM,IAAI,IAAI,KAAK,SAAS,EAAE,QAAQ;AACtC,MAAI,OAAO,MAAM,CAAC,EAAG,QAAO;AAC5B,SAAO,IAAI,QAAQ,IAAI,KAAK,aAAa;AAC3C;AAKA,IAAM,gBAAgB;AAgCf,SAAS,kBACd,MACA,YACA,KACA,SAC6B;AAC7B,QAAM,MAAM,oBAAI,IAA4B;AAC5C,QAAM,SAAS,IAAI,IAAI,aAAa,UAAU,CAAC;AAE/C,aAAW,QAAQ,aAAa,UAAU,GAAG;AAC3C,QAAI;AACJ,YAAQ,KAAK,OAAO;AAAA,MAClB,KAAK;AACH,aAAK,eAAe,KAAK,QAAQ,MAAM;AACvC;AAAA,MACF,KAAK;AACH,aAAK,eAAe,MAAM,GAAG;AAC7B;AAAA,MACF,KAAK;AACH,aAAK,YAAY,MAAM,GAAG;AAC1B;AAAA,MACF,KAAK;AACH,aAAK,eAAe,MAAM,GAAG;AAC7B;AAAA,MACF,KAAK;AACH,aAAK,iBAAiB,MAAM,GAAG;AAC/B;AAAA,MACF,KAAK;AACH,aAAK,eAAe,MAAM,GAAG;AAC7B;AAAA,MACF,KAAK;AACH,aAAK;AAAA,UACH,KAAK;AAAA,UACL;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QACF;AACA;AAAA,MACF,KAAK;AACH,aAAK,gBAAgB,KAAK,UAAU,MAAM,KAAK,0BAA0B,iBAAiB;AAC1F;AAAA,MACF,KAAK;AACH,aAAK,eAAe,MAAM,GAAG;AAC7B;AAAA,MACF,KAAK,4BAA4B;AAC/B,cAAM,SAAS,KAAK;AACpB,cAAM,WAAW,UAAU,SAAS,IAAI,GAAG,MAAM,oBAAoB;AACrE,aAAK,gBAAgB,KAAK,SAAS,MAAM,KAAK,8BAA8B,QAAQ;AACpF;AAAA,MACF;AAAA,MACA,KAAK;AACH,aAAK,cAAc,MAAM,GAAG;AAC5B;AAAA,MACF,KAAK;AACH,aAAK,qBAAqB,MAAM,GAAG;AACnC;AAAA,MACF,KAAK;AACH,aAAK,gBAAgB,MAAM,GAAG;AAC9B;AAAA,MACF;AACE,aAAK;AAAA,IACT;AAKA,QAAI,OAAO,QAAQ,OAAO,IAAI,KAAK,KAAK,GAAG;AACzC,WAAK,EAAE,QAAQ,WAAW,WAAW,MAAM,MAAM,mBAAmB;AAAA,IACtE;AACA,QAAI,OAAO,KAAM,KAAI,IAAI,KAAK,OAAO,EAAE;AAAA,EACzC;AAEA,SAAO;AACT;AAKA,SAAS,gBACP,IACA,MACA,KACA,UACA,UACuB;AACvB,MAAI,OAAO,QAAQ,CAAC,KAAK,iBAAkB,QAAO;AAClD,QAAM,KAAK,KAAK;AAChB,MAAI,CAAC,QAAQ,IAAI,GAAG,GAAG;AACrB,WAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,+BAA+B;AAAA,EAClF;AACA,SAAO,KACH,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,SAAS,IAChD,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,SAAS;AACtD;AASA,SAAS,iBAAiB,MAAkB,KAAkC;AAC5E,QAAM,OAAO,KAAK;AAClB,QAAM,OAAO,KAAK;AAClB,MAAI,SAAS,QAAQ,SAAS,QAAQ,CAAC,KAAK,oBAAqB,QAAO;AACxE,QAAM,KAAK,KAAK;AAChB,MAAI,CAAC,QAAQ,IAAI,GAAG,GAAG;AACrB,WAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,gCAAgC;AAAA,EACnF;AACA,MAAI,SAAS,KAAK,SAAS,GAAG;AAC5B,WAAO,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,yCAAyC;AAAA,EACzF;AACA,SAAO,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,GAAG,IAAI,eAAe,IAAI,gBAAgB;AAC1F;AAYA,SAAS,eAAe,KAAW,QAA0D;AAC3F,QAAM,KAAK,IAAI,YAAY;AAC3B,MAAI,OAAO,YAAY;AACrB,WAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,sCAAsC;AAAA,EACzF;AACA,MAAI,OAAO,eAAe;AACxB,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,WAAW;AAAA,MACX,MAAM;AAAA,IACR;AAAA,EACF;AACA,MAAI,OAAO,UAAU,KAAM,QAAO;AAClC,MAAI,OAAO,MAAM,cAAc;AAC7B,UAAMC,OAAM,OAAO,MAAM;AACzB,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,WAAW;AAAA,MACX,MAAM,mBAAmBA,SAAQ,OAAO,MAAMA,IAAG,MAAM,EAAE;AAAA,IAC3D;AAAA,EACF;AACA,QAAM,MAAM,OAAO,MAAM;AACzB,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,WAAW;AAAA,IACX,MAAM,gBAAgB,QAAQ,OAAO,UAAU,GAAG,MAAM,EAAE;AAAA,EAC5D;AACF;AASA,SAAS,eAAe,MAAkB,KAAkC;AAE1E,MAAI,CAAC,KAAK,OAAO,gBAAgB,KAAK,GAAG,EAAG,QAAO;AACnD,MAAI,CAAC,KAAK,gBAAiB,QAAO;AAClC,QAAM,KAAK,KAAK;AAChB,MAAI,CAAC,QAAQ,KAAK,iBAAiB,GAAG,GAAG;AACvC,WAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,8BAA8B;AAAA,EACjF;AACA,QAAM,OAAO,KAAK;AAClB,MAAI,SAAS,MAAM;AACjB,WAAO,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,wCAAwC;AAAA,EACxF;AACA,MAAI,QAAQ,eAAe;AACzB,WAAO,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,uBAAuB,IAAI,IAAI;AAAA,EAC/E;AACA,SAAO,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,8BAA8B,IAAI,UAAU;AAC5F;AAQA,SAAS,eAAe,MAAkB,KAAkC;AAC1E,MAAI,CAAC,KAAK,mBAAmB,CAAC,KAAK,wBAAyB,QAAO;AACnE,MAAI,CAAC,QAAQ,KAAK,iBAAiB,GAAG,KAAK,CAAC,QAAQ,KAAK,yBAAyB,GAAG,GAAG;AACtF,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,WAAW,KAAK,2BAA2B,KAAK;AAAA,MAChD,MAAM;AAAA,IACR;AAAA,EACF;AACA,QAAM,QAAQ,KAAK,iBAAiB;AACpC,QAAM,OAAO,KAAK,mBAAmB;AACrC,MAAI,SAAS,MAAM;AACjB,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,WAAW,KAAK;AAAA,MAChB,MAAM;AAAA,IACR;AAAA,EACF;AACA,QAAM,MACJ,CAAC,SAAS,CAAC,OACP,0CACA,CAAC,QACC,oBACA;AACR,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,WAAW,KAAK;AAAA,IAChB,MAAM,yCAAoC,GAAG;AAAA,EAC/C;AACF;AAQA,SAAS,YAAY,MAAkB,KAAkC;AACvE,MAAI,CAAC,KAAK,wBAAyB,QAAO;AAC1C,QAAM,KAAK,KAAK;AAChB,MAAI,CAAC,QAAQ,IAAI,GAAG,GAAG;AACrB,WAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,2BAA2B;AAAA,EAC9E;AACA,MAAI,KAAK,iBAAiB,QAAQ;AAChC,WAAO,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,kCAAkC;AAAA,EAClF;AACA,MAAI,KAAK,iBAAiB,QAAQ;AAChC,WAAO,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,oCAAoC;AAAA,EACpF;AACA,SAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,gCAAgC;AACnF;AAMA,SAAS,eAAe,MAAkB,KAAkC;AAC1E,MAAI,KAAK,gBAAgB,QAAQ,CAAC,KAAK,iBAAkB,QAAO;AAChE,QAAM,KAAK,KAAK;AAChB,MAAI,CAAC,QAAQ,IAAI,GAAG,GAAG;AACrB,WAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,8BAA8B;AAAA,EACjF;AACA,SAAO,KAAK,gBAAgB,SACxB,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,+CAA+C,IACtF,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,qDAAqD;AAClG;AAMA,SAAS,eAAe,MAAkB,KAAkC;AAC1E,MAAI,KAAK,gBAAgB,QAAQ,CAAC,KAAK,iBAAkB,QAAO;AAChE,QAAM,KAAK,KAAK;AAChB,MAAI,CAAC,QAAQ,IAAI,GAAG,GAAG;AACrB,WAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,mCAAmC;AAAA,EACtF;AACA,SAAO,KAAK,gBAAgB,SACxB,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,wBAAwB,IAC/D;AAAA,IACE,QAAQ;AAAA,IACR,WAAW;AAAA,IACX,MAAM;AAAA,EACR;AACN;AAOA,SAAS,cAAc,MAAkB,KAAkC;AACzE,MAAI,CAAC,KAAK,iBAAkB,QAAO;AACnC,QAAM,KAAK,KAAK;AAChB,MAAI,CAAC,QAAQ,IAAI,GAAG,GAAG;AACrB,WAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,gCAAgC;AAAA,EACnF;AACA,MAAI,KAAK,cAAc,QAAQ;AAC7B,WAAO,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,iCAAiC;AAAA,EACjF;AACA,MAAI,KAAK,cAAc,QAAQ;AAC7B,WAAO,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,8BAA8B;AAAA,EAC9E;AACA,SAAO,EAAE,QAAQ,OAAO,WAAW,IAAI,MAAM,+BAA+B;AAC9E;AAMA,SAAS,qBAAqB,MAAkB,KAAkC;AAChF,MAAI,KAAK,YAAY,QAAQ,CAAC,KAAK,YAAa,QAAO;AACvD,QAAM,KAAK,KAAK;AAChB,MAAI,CAAC,QAAQ,IAAI,GAAG,GAAG;AACrB,WAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,6BAA6B;AAAA,EAChF;AACA,SAAO,KAAK,YAAY,SACpB,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,oBAAoB,IAC3D,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,kBAAkB;AAC/D;AAOA,SAAS,gBAAgB,MAAkB,KAAkC;AAC3E,MAAI,KAAK,oBAAoB,QAAQ,CAAC,KAAK,gBAAiB,QAAO;AACnE,QAAM,KAAK,KAAK;AAChB,MAAI,KAAK,oBAAoB,QAAQ;AACnC,WAAO,EAAE,QAAQ,OAAO,WAAW,IAAI,MAAM,uBAAuB;AAAA,EACtE;AACA,MAAI,CAAC,QAAQ,IAAI,GAAG,GAAG;AACrB,WAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,2BAA2B;AAAA,EAC9E;AACA,MAAI,KAAK,oBAAoB,WAAW;AACtC,WAAO,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,2CAA2C;AAAA,EAC3F;AACA,MAAI,KAAK,oBAAoB,WAAW;AACtC,WAAO,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,+BAA+B;AAAA,EAC/E;AACA,SAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,+BAA+B;AAClF;;;AC/XA,SAAS,oBAAoB;AAC7B,SAAS,WAAW;AACpB,SAAS,+BAA+B;;;ACSxC,IAAM,mBAAmB,oBAAI,IAAI,CAAC,KAAK,GAAG,CAAC;AAE3C,IAAM,kBAAkB,oBAAI,IAAI,CAAC,GAAG,EAAE,CAAC;AAIvC,IAAM,eACJ;AAeF,IAAM,gBAAgB,oBAAI,IAAI;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AACD,IAAM,gBAAgB;AAKf,SAAS,kBAAkB,GAAqB;AACrD,QAAM,MAAM;AACZ,MAAI,KAAK,0BAA0B,KAAM,QAAO;AAChD,MAAI,CAAC,KAAK,QAAQ,KAAK,UAAU,MAAM,EAAE,KAAK,CAAC,MAAM,iBAAiB,IAAI,OAAO,CAAC,CAAC,CAAC;AAClF,WAAO;AACT,MAAI,iBAAiB,IAAI,OAAO,KAAK,IAAI,CAAC,KAAK,gBAAgB,IAAI,OAAO,KAAK,IAAI,CAAC;AAClF,WAAO;AACT,QAAM,MAAM,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC;AACrD,SAAO,aAAa,KAAK,GAAG;AAC9B;AAKA,SAAS,mBAAmB,GAAqB;AAC/C,SAAQ,GAAqC,0BAA0B;AACzE;AAMO,SAAS,mBAAmB,GAAqB;AACtD,QAAM,MAAM;AACZ,MAAI,KAAK,0BAA0B,KAAM,QAAO;AAChD,QAAM,UAAU,KAAK,UAAU,MAAM,OAAO;AAC5C,MAAI,MAAM,QAAQ,OAAO,KAAK,QAAQ,SAAS,GAAG;AAChD,WAAO,QAAQ,KAAK,CAAC,MAAM,GAAG,UAAU,QAAQ,cAAc,IAAI,EAAE,OAAO,YAAY,CAAC,CAAC;AAAA,EAC3F;AACA,QAAM,MAAM,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC;AACrD,SAAO,cAAc,KAAK,GAAG;AAC/B;AASA,eAAsB,oBACpB,UACA,OACA,SACY;AACZ,MAAI,SAAS,WAAW,EAAG,OAAM,IAAI,MAAM,GAAG,KAAK,wCAAwC;AAC3F,QAAM,SAAmB,CAAC;AAM1B,MAAI;AACJ,MAAI;AAGJ,MAAI,WAAW;AACf,aAAW,WAAW,UAAU;AAC9B,QAAI;AACF,YAAM,SAAS,MAAM,QAAQ,OAAO;AACpC,UAAI,OAAO,SAAS,GAAG;AACrB,gBAAQ;AAAA,UACN,WACI,UAAK,KAAK,sBAAsB,OAAO,KAAK,IAAI,CAAC,yBAAoB,OAAO,uDAE5E,UAAK,KAAK,sBAAsB,OAAO,KAAK,IAAI,CAAC,yBAAoB,OAAO;AAAA,QAGlF;AAAA,MACF;AACA,aAAO;AAAA,IACT,SAAS,GAAG;AACV,UAAI,CAAC,kBAAkB,CAAC,EAAG,OAAM;AACjC,aAAO,KAAK,GAAG,OAAO,KAAK,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,CAAC,GAAG;AACxE,UAAI,mBAAmB,CAAC,GAAG;AACzB,uBAAe;AACf,mBAAW;AAAA,MACb,OAAO;AACL,wBAAgB;AAChB,YAAI,CAAC,mBAAmB,CAAC,EAAG,YAAW;AAAA,MACzC;AAAA,IACF;AAAA,EACF;AAIA,QAAM,iBAAiB;AACzB;;;AD9HA,IAAM,qBAAqB;AAC3B,IAAMC,cAAa;AAanB,SAAS,IAAI,GAAiB;AAC5B,SAAO,EAAE,YAAY,EAAE,MAAM,GAAG,EAAE;AACpC;AAUA,eAAsB,iBACpB,OACA,aACA,WACgD;AAChD,QAAM,MAAM,KAAK,MAAM,aAAa,MAAM,SAAS,MAAM,CAAC;AAK1D,QAAM,aAAa,KAAK,OAAO,UAAU,QAAQ,IAAI,YAAY,QAAQ,KAAKA,WAAU;AACxF,QAAM,UAAU,IAAI,KAAK,YAAY,QAAQ,IAAIA,WAAU;AAC3D,QAAM,YAAY,IAAI,KAAK,QAAQ,QAAQ,IAAI,aAAaA,WAAU;AACtE,QAAM,WAAW,cAAc,MAAM,UAAU;AAE/C,SAAO,oBAAoB,MAAM,UAAU,MAAM,OAAO,YAAY;AAClE,UAAM,aAAa,IAAI,IAAI;AAAA,MACzB,OAAO,IAAI;AAAA,MACX,KAAK,IAAI;AAAA,MACT,QAAQ,CAAC,kBAAkB;AAAA,MAC3B;AAAA,IACF,CAAC;AACD,UAAM,SAAS,IAAI,wBAAwB,EAAE,WAAW,CAAC;AAEzD,UAAM,MAAM,OAAO,OAAa,QAA+B;AAC7D,YAAM,CAAC,IAAI,IAAI,MAAM,OAAO,UAAU;AAAA,QACpC;AAAA,QACA,YAAY,CAAC,EAAE,WAAW,IAAI,KAAK,GAAG,SAAS,IAAI,GAAG,EAAE,CAAC;AAAA,QACzD,SAAS,CAAC,EAAE,MAAM,cAAc,CAAC;AAAA,MACnC,CAAC;AACD,YAAM,MAAM,KAAK,OAAO,CAAC,GAAG,eAAe,CAAC,GAAG,SAAS;AACxD,YAAM,IAAI,OAAO,SAAS,KAAK,EAAE;AACjC,aAAO,OAAO,SAAS,CAAC,IAAI,IAAI;AAAA,IAClC;AAEA,UAAM,UAAU,MAAM,IAAI,aAAa,SAAS;AAChD,UAAM,WAAW,MAAM,IAAI,WAAW,OAAO;AAC7C,WAAO,EAAE,SAAS,SAAS;AAAA,EAC7B,CAAC;AACH;;;AEtEA,SAAS,gBAAAC,qBAAoB;AAC7B,SAAS,OAAAC,YAAW;AAGpB,IAAM,sBAAsB;AAC5B,IAAM,UAAU;AAEhB,IAAM,sBAAsB;AAKrB,IAAM,wBAAwB;AAoC9B,SAAS,SAAS,GAAmB;AAC1C,SAAO,EACJ,KAAK,EACL,QAAQ,gBAAgB,EAAE,EAC1B,QAAQ,iBAAiB,EAAE,EAC3B,MAAM,GAAG,EAAE,CAAC,EACZ,QAAQ,WAAW,EAAE,EACrB,YAAY;AACjB;AASO,SAAS,0BAA0B,SAAsB,MAAwB;AACtF,QAAM,SAAS,SAAS,IAAI;AAC5B,QAAM,UAAU,QAAQ,OAAO,CAAC,MAAM,SAAS,EAAE,OAAO,MAAM,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO;AAC1F,QAAM,UAAU,QAAQ,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,WAAW,YAAY,CAAC;AAC9E,QAAM,WAAW,QAAQ,OAAO,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,WAAW,YAAY,CAAC;AAChF,SAAO,CAAC,GAAG,SAAS,GAAG,QAAQ;AACjC;AAGA,SAASC,KAAI,GAAiB;AAC5B,SAAO,EAAE,YAAY,EAAE,MAAM,GAAG,EAAE;AACpC;AAWO,SAAS,eACd,MACoB;AACpB,MAAI;AACJ,aAAW,KAAK,MAAM;AACpB,QAAI,OAAO,EAAE,aAAa,SAAU;AACpC,UAAM,cAAc,EAAE,eAAe;AACrC,QACE,SAAS,UACT,cAAc,KAAK,eAClB,gBAAgB,KAAK,eAAe,EAAE,WAAW,KAAK,UACvD;AACA,aAAO,EAAE,UAAU,EAAE,UAAU,YAAY;AAAA,IAC7C;AAAA,EACF;AACA,SAAO,MAAM;AACf;AAcO,SAAS,oBACd,MACA,YACoB;AACpB,QAAM,OAAO,WAAW,YAAY;AACpC,QAAM,QAAQ,KAAK;AAAA,IACjB,CAAC,MAAM,OAAO,EAAE,aAAa,aAAa,EAAE,OAAO,CAAC,KAAK,IAAI,YAAY,MAAM;AAAA,EACjF;AACA,MAAI,MAAO,QAAO,MAAM;AACxB,SAAO,eAAe,IAAI;AAC5B;AAOA,IAAM,4BAAN,cAAwC,MAAM;AAAA,EACnC,wBAAwB;AAAA,EACjC,YAAY,SAAiB,MAAc;AACzC,UAAM,uCAAuC,IAAI,kBAAkB,OAAO,EAAE;AAAA,EAC9E;AACF;AAcA,eAAsB,oBACpB,GACA,aACA,WACyB;AACzB,QAAM,MAAM,KAAK,MAAMC,cAAa,EAAE,SAAS,MAAM,CAAC;AAKtD,MAAI;AACF,WAAO,MAAM,oBAAoB,EAAE,UAAU,kBAAkB,OAAO,YAAY;AAChF,YAAM,MAAM,IAAIC,KAAI;AAAA,QAClB,OAAO,IAAI;AAAA,QACX,KAAK,IAAI;AAAA,QACT,QAAQ,CAAC,mBAAmB;AAAA,QAC5B;AAAA,MACF,CAAC;AAED,YAAM,WAAW,EAAE,UAAU,KAAK;AAClC,UAAI;AACJ,UAAI,UAAU;AACZ,qBAAa,CAAC,QAAQ;AAAA,MACxB,OAAO;AACL,cAAM,OAAO,MAAM,IAAI,QAAqC;AAAA,UAC1D,KAAK,GAAG,OAAO;AAAA,UACf,QAAQ;AAAA,QACV,CAAC;AACD,qBAAa,0BAA0B,KAAK,KAAK,aAAa,CAAC,GAAG,EAAE,IAAI;AACxE,YAAI,WAAW,WAAW,EAAG,OAAM,IAAI,0BAA0B,SAAS,EAAE,IAAI;AAAA,MAClF;AAEA,iBAAW,YAAY,YAAY;AACjC,cAAM,MAAM,MAAM,IAAI,QAEnB;AAAA,UACD,KAAK,GAAG,OAAO,UAAU,mBAAmB,QAAQ,CAAC;AAAA,UACrD,QAAQ;AAAA,UACR,MAAM;AAAA,YACJ,WAAWF,KAAI,WAAW;AAAA,YAC1B,SAASA,KAAI,SAAS;AAAA,YACtB,YAAY,CAAC,OAAO;AAAA,YACpB,uBAAuB;AAAA,cACrB;AAAA,gBACE,SAAS;AAAA,kBACP,EAAE,WAAW,SAAS,UAAU,YAAY,YAAY,EAAE,MAAM,YAAY,EAAE;AAAA,gBAChF;AAAA,cACF;AAAA,YACF;AAAA,YACA,UAAU;AAAA,UACZ;AAAA,QACF,CAAC;AACD,cAAM,MAAM,oBAAoB,IAAI,KAAK,QAAQ,CAAC,GAAG,EAAE,MAAM,YAAY,CAAC;AAC1E,YAAI,OAAO,QAAQ,UAAU;AAG3B,iBAAO;AAAA,YACL,cAAc,OAAO;AAAA,YACrB,UAAU,KAAK,IAAI,GAAG,KAAK,MAAM,GAAG,CAAC;AAAA,YACrC,eAAe;AAAA,UACjB;AAAA,QACF;AAAA,MACF;AAEA,aAAO,EAAE,cAAc,OAAO,UAAU,MAAM,eAAe,KAAK;AAAA,IACpE,CAAC;AAAA,EACH,SAAS,GAAG;AAKV,QAAI,aAAa;AACf,aAAO,EAAE,cAAc,OAAO,UAAU,MAAM,eAAe,MAAM;AACrE,UAAM;AAAA,EACR;AACF;;;AJ3LA,eAAsB,mBACpB,MACA,OAA0B,CAAC,GACT;AAClB,MAAI,CAAC,KAAK,IAAK,QAAO;AACtB,QAAM,WAAW,KAAK,YAAY;AAClC,QAAM,SAAS,KAAK,UAAU;AAC9B,MAAI;AACF,UAAM,MAAM,MAAM,SAAS,EAAE,KAAK,KAAK,KAAK,MAAM,SAAS,KAAK,IAAI,EAAE,CAAC;AACvE,UAAM,OAAO,KAAK,IAAI,gBAAgB,IAAI,OAAO,IAAI,UAAU,IAAI,WAAW;AAC9E,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,YAAQ;AAAA,MACN,2CAAsC,KAAK,IAAI,KAC7C,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CACjD;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;AA2DA,SAAS,kBAAkB,SAAuC;AAChE,QAAM,EAAE,QAAQ,QAAQ,SAAS,SAAS,IAAI;AAC9C,MAAI,WAAW,QAAQ,WAAW,QAAQ,YAAY,QAAQ,aAAa,MAAM;AAC/E,UAAM,IAAI;AAAA,MACR,SAAS,QAAQ,IAAI;AAAA,IAEvB;AAAA,EACF;AACA,SAAO,EAAE,aAAa,QAAQ,eAAe,QAAQ,eAAe,SAAS,KAAK,SAAS;AAC7F;AAEA,SAAS,QAAQ,OAAa,GAAiB;AAK7C,QAAM,MAAM,IAAI,KAAK,KAAK;AAC1B,MAAI,WAAW,IAAI,WAAW,IAAI,CAAC;AACnC,SAAO;AACT;AAYA,eAAsB,mBACpB,MACA,SACA,YACA,UAAwB,CAAC,GACH;AACtB,QAAM,SAAS,kBAAkB,OAAO;AAExC,QAAM,QAAQ,oBAAI,KAAK;AACvB,QAAM,OAAO,SAAS,QAAQ,IAAI;AAElC,QAAM,cACJ,SAAS,OAAO,MAAM,kBAAkB,MAAM,SAAS,YAAY,KAAK,IAAI,QAAQ,OAAO,EAAE;AAE/F,QAAM,YAAY;AAClB,QAAM,cAAc;AAMpB,QAAM,iBACJ,eAAe,iBAAiB,QAAQ,wBACpC,IAAI,KAAK,QAAQ,qBAAqB,IACtC;AAON,QAAM,WACJ,SAAS,OAAO,MAAM,aAAa,SAAS,aAAa,SAAS,IAAI;AACxE,QAAM,eACJ,SAAS,OACL,MAAM,YAAY,SAAS,aAAa,SAAS;AAAA;AAAA;AAAA,IAGjD;AAAA,MACE,GAAG;AAAA,MACH,oBAAoB;AAAA,MACpB,iBAAiB;AAAA,MACjB,eAAe;AAAA,IACjB;AAAA;AACN,QAAM,UAAU,SAAS;AACzB,QAAM,SAAS,aAAa;AAC5B,QAAM,eAA8B;AAAA,IAClC,GAAI,SAAS,aAAc,CAAC,IAAI,IAAc,CAAC;AAAA,IAC/C,GAAI,aAAa,aAAc,CAAC,QAAQ,IAAc,CAAC;AAAA,EACzD;AAWA,MAAI,SAAS,QAAQ,QAAQ,kBAAkB,OAAO;AACpD,UAAM,mBAAmB,SAAS,QAAQ,iBAAiB,CAAC,CAAC;AAAA,EAC/D;AAEA,QAAM,UAAU,GAAG,IAAI;AACvB,QAAM,EAAE,KAAK,IAAI,MAAM,iBAAiB;AAAA,IACtC,UAAU,QAAQ;AAAA,IAClB,SAAS,QAAQ;AAAA,IACjB;AAAA,IACA;AAAA,IACA,YAAY;AAAA,IACZ,gBAAgB,SAAS;AAAA,IACzB,iBAAiB,SAAS;AAAA,IAC1B,gBAAgB,QAAQ,eAAgB,OAAO,YAAY,SAAa;AAAA,IACxE;AAAA,IACA,YAAY;AAAA,IACZ,MAAM,YAAY,OAAO;AAAA,IACzB,gBAAgB;AAAA,EAClB,CAAC;AAED,MAAI,QAAQ,aAAa;AACvB,UAAM,OAAO,QAAQ,eAAe,WAAW,IAAI;AACnD,UAAM,MAAMG,SAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AAC9C,UAAM,UAAU,MAAM,MAAM,OAAO;AACnC,WAAO;AAAA,MACL,WAAW;AAAA,MACX,UAAU;AAAA,MACV;AAAA,MACA;AAAA,MACA,qBAAqB,aAAa;AAAA,MAClC,uBAAuB,aAAa;AAAA,MACpC,QAAQ;AAAA,MACR,eAAe,CAAC;AAAA,IAClB;AAAA,EACF;AAEA,MAAI,SAAS,KAAM,OAAM,IAAI,MAAM,sCAAsC;AAOzE,MAAI,aAAa,MAAM,QAAQ,QAAQ,QAAQ,iBAAiB,QAAQ,WAAW,GAAG;AACpF,QAAI;AACF,YAAM;AAAA,QACJ;AAAA,QACA,QAAQ;AAAA,QACR,aAAa,SAAS,IAAI,MAAM,YAAY,IAAI;AAAA,MAClD;AAAA,IACF,SAAS,GAAG;AACV,cAAQ,KAAK,6CAAwC,QAAQ,IAAI,KAAM,EAAY,OAAO,EAAE;AAAA,IAC9F;AAAA,EACF;AASA,MAAI,QAAQ,eAAe;AACzB,UAAM,gBAAgB,QAAQ,eAAe,MAAM,WAAW,IAAI;AAClE,UAAMC,WAAU,MAAM,WAAW,MAAM;AAAA,MACrC,IAAI,QAAQ;AAAA,MACZ,QAAQ,QAAQ;AAAA,MAChB;AAAA,IACF,CAAC;AACD,WAAO;AAAA,MACL,WAAW,QAAQ,eAAe;AAAA,MAClC,UAAU;AAAA,MACV;AAAA,MACA;AAAA,MACA,qBAAqB,aAAa;AAAA,MAClC,uBAAuB,aAAa;AAAA,MACpC,QAAQA,SAAQ;AAAA,MAChB,eAAeA,SAAQ;AAAA,IACzB;AAAA,EACF;AAMA,QAAM,WAAW,kBAAkB,SAAS,YAAY,aAAa,EAAE,QAAQ,aAAa,CAAC;AAC7F,QAAM,iBAAiB,CAAC,GAAG,SAAS,QAAQ,CAAC,EAC1C,OAAO,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,MAAM,EACrC,IAAI,CAAC,CAAC,KAAK,MAAM,KAAK;AACzB,QAAM,eAAe,OAAO,YAAY,QAAQ;AAEhD,QAAM,WAAW,GAAG,QAAQ,IAAI,WAAM,UAAU,WAAM,UAAU,YAAY,EAAE,MAAM,GAAG,EAAE,CAAC;AAC1F,QAAM,UAAU,MAAM,YAAY,MAAM;AAAA,IACtC;AAAA,IACA,QAAQ,QAAQ;AAAA,IAChB;AAAA,IACA,QAAQ,QAAQ,UAAU,UAAU,YAAY,EAAE,MAAM,GAAG,CAAC;AAAA,IAC5D;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY;AAAA,IACZ;AAAA,IACA,GAAI,UAAU,EAAE,gBAAgB,QAAQ,SAAS,iBAAiB,QAAQ,SAAS,IAAI,CAAC;AAAA,IACxF,GAAI,SAAS,EAAE,kBAAkB,OAAO,aAAa,IAAI,CAAC;AAAA,IAC1D,GAAI,QAAQ,gBAAgB,OAAO,aAAa,OAC5C,EAAE,gBAAgB,OAAO,SAAS,IAClC,CAAC;AAAA,IACL;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,gBAAgB,QAAQ,IAAI,MAAM,WAAW,IAAI;AACvD,QAAM,UAAU,MAAM,WAAW,MAAM;AAAA,IACrC,IAAI,QAAQ;AAAA,IACZ,QAAQ,QAAQ;AAAA,IAChB;AAAA,EACF,CAAC;AAED,SAAO;AAAA,IACL,WAAW;AAAA,IACX,UAAU;AAAA,IACV;AAAA,IACA;AAAA,IACA,qBAAqB,aAAa;AAAA,IAClC,uBAAuB,aAAa;AAAA,IACpC,QAAQ,QAAQ;AAAA,IAChB,eAAe,QAAQ;AAAA,EACzB;AACF;AAKA,eAAe,gBACb,OACA,MACA,WACA,MACe;AACf,QAAM,eAAe,GAAG,IAAI,IAAI,UAAU,YAAY,EAAE,MAAM,GAAG,EAAE,CAAC;AACpE,QAAM,iBAAiB,OAAO,iBAAiB,MAAM,cAAc,WAAW;AAChF;AAMA,IAAM,gBAAmC,EAAE,OAAO,MAAM,YAAY,MAAM;AAS1E,eAAsB,aACpB,SACA,aACA,WAC4D;AAC5D,QAAM,MAAM,aAAa;AACzB,MAAI,CAAC,OAAO,CAAC,QAAQ,cAAe,QAAO;AAC3C,MAAI;AACF,UAAM,QAAQ,MAAM;AAAA,MAClB,EAAE,YAAY,QAAQ,eAAe,UAAU,IAAI,UAAU,SAAS,IAAI,QAAQ;AAAA,MAClF;AAAA,MACA;AAAA,IACF;AACA,WAAO,EAAE,OAAO,YAAY,MAAM;AAAA,EACpC,SAAS,GAAG;AACV,YAAQ,KAAK,yBAAoB,QAAQ,IAAI,KAAM,EAAY,OAAO,EAAE;AACxE,WAAO,EAAE,OAAO,MAAM,YAAY,KAAK;AAAA,EACzC;AACF;AA6CA,eAAsB,YACpB,SACA,aACA,WAC2B;AAC3B,QAAM,MAAM,aAAa;AACzB,QAAM,WAAW,QAAQ,QAAQ,iBAAiB,QAAQ,WAAW;AACrE,MAAI,CAAC,OAAO,CAAC,UAAU;AACrB,UAAM,gBAAgB,YAAY,CAAC;AACnC,QAAI,eAAe;AACjB,cAAQ;AAAA,QACN,4IAAkI,QAAQ,IAAI;AAAA,MAChJ;AAAA,IACF;AACA,WAAO,EAAE,GAAG,eAAe,oBAAoB,OAAO,iBAAiB,OAAO,cAAc;AAAA,EAC9F;AACA,QAAM,WAAW,QAAQ,aAAa,KAAK;AAC3C,QAAM,QAAQ,YAAY,QAAQ;AAClC,QAAM,cAAc,CAAC;AACrB,MAAI;AACF,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,QACE,SAAS,IAAI;AAAA,QACb,UAAU,IAAI;AAAA,QACd,UAAU,QAAQ,yBAAyB;AAAA,QAC3C,MAAM,QAAQ;AAAA,QACd;AAAA,MACF;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,UAAM,kBAAkB,CAAC,MAAM;AAC/B,QAAI,iBAAiB;AACnB,cAAQ;AAAA,QACN,qDAAgD,QAAQ,GAAG,QAAQ,QAAQ,IAAI;AAAA,MACjF;AAAA,IACF;AACA,UAAM,qBAAqB,MAAM,iBAAiB,eAAe,MAAM,aAAa;AACpF,QAAI,oBAAoB;AACtB,cAAQ;AAAA,QACN,qCAAgC,KAAK,sCAAsC,QAAQ,IAAI;AAAA,MACzF;AAAA,IACF;AACA,WAAO,EAAE,OAAO,YAAY,OAAO,oBAAoB,iBAAiB,eAAe,MAAM;AAAA,EAC/F,SAAS,GAAG;AACV,YAAQ,KAAK,sCAAiC,QAAQ,IAAI,KAAM,EAAY,OAAO,EAAE;AACrF,WAAO;AAAA,MACL,OAAO;AAAA,MACP,YAAY;AAAA,MACZ,oBAAoB;AAAA,MACpB,iBAAiB;AAAA,MACjB,eAAe;AAAA,IACjB;AAAA,EACF;AACF;AAEA,eAAe,kBACb,MACA,SACA,YACA,OACe;AACf,QAAM,QAAQ,MAAM,mBAAmB,MAAM,QAAQ,EAAE;AACvD,QAAM,WAAW,MACd,OAAO,CAAC,MAAM,EAAE,eAAe,cAAc,EAAE,SAAS,EACxD,IAAI,CAAC,MAAM,EAAE,SAAU,EACvB,KAAK;AACR,QAAM,SAAS,SAAS,SAAS,SAAS,CAAC;AAC3C,MAAI,CAAC,OAAQ,QAAO,QAAQ,OAAO,EAAE;AAKrC,QAAM,QAAQ,IAAI,KAAK,MAAM;AAC7B,QAAM,WAAW,MAAM,WAAW,IAAI,CAAC;AACvC,SAAO;AACT;","names":["dirname","pos","MS_PER_DAY","readFileSync","JWT","ymd","readFileSync","JWT","dirname","outcome"]}