@reddoorla/maintenance 0.83.0 → 0.85.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reddoorla/maintenance",
-  "version": "0.83.0",
+  "version": "0.85.0",
   "description": "Canonical maintenance configs, audits, and recipes for the reddoor stack.",
   "type": "module",
   "license": "MIT",

package/dist/airtable-5ZPU3MT4.js

@@ -1,9 +0,0 @@
-import {
-  fromAirtableBase
-} from "./chunk-2WN4SNBQ.js";
-import "./chunk-U5SZ4FOP.js";
-import "./chunk-CLWNAMUX.js";
-export {
-  fromAirtableBase
-};
-//# sourceMappingURL=airtable-5ZPU3MT4.js.map

package/dist/chunk-CLWNAMUX.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/reports/airtable/websites.ts"],"sourcesContent":["import type { FieldSet } from \"airtable\";\nimport type { AirtableBase } from \"./client.js\";\nimport type { LighthouseScores, LighthouseScoreWriteback } from \"../types.js\";\n\nexport const WEBSITES_TABLE = \"Websites\";\n\nexport type Frequency = \"None\" | \"Monthly\" | \"Quarterly\" | \"Yearly\";\n\nexport type Status =\n  | \"in development\"\n  | \"launch period\"\n  | \"maintenance\"\n  | \"hosting\"\n  | \"probably not our problem\"\n  | \"deprecated\"\n  | \"legacy\";\n\n/**\n * Per-site notification routing. When present on a `maintenance` site, the form\n * notification is addressed by the value of a submission field (`field`, read from\n * `extraFields`) — e.g. route a contact form's `interest` to a different recipient\n * per option, always CC-ing a shared address. Absent (`null`) → the site keeps the\n * default single-POC behavior. Recipients live HERE (server-side Airtable config),\n * never supplied by the submitting site, so the ingest can't be turned into an open\n * relay.\n */\nexport type NotifyRouting = {\n  /** The `extraFields` key whose value selects a route, e.g. \"interest\". */\n  field: string;\n  /** Field-value → recipient address(es). */\n  routes: Record<string, string | string[]>;\n  /** Recipient(s) when the value matches no route. */\n  default?: string | string[];\n  /** Address(es) CC'd on every routed (maintenance) send. */\n  cc?: string[];\n};\n\nexport type WebsiteRow = {\n  id: string;\n  name: string;\n  url: string;\n  status: Status | null;\n  pointOfContact: string | null;\n  maintenanceFreq: Frequency;\n  testingFreq: Frequency;\n  /** The literal Airtable cell values behind the coerced frequencies. `toFrequency`\n   *  trims whitespace (\"Monthly \" reads as Monthly), then maps any still-unrecognized\n   *  value (\"Quaterly\") to \"None\" with a LOUD console.warn so nothing bogus reaches a\n   *  client email and the drop is never invisible. Preflight validates THESE to surface\n   *  the same failure as a structured finding. Null = blank cell. */\n  maintenanceFreqRaw: string | null;\n  testingFreqRaw: string | null;\n  /** Last manually-recorded maintenance day (used as fallback when no Reports row exists). */\n  maintenanceDay: string | null;\n  testingDay: string | null;\n  ga4PropertyId: string | null;\n  /** Operator-supplied query for the Google search-presence check (e.g. the business name).\n   *  Null = no query set → the check is skipped for this site. */\n  searchQuery: string | null;\n  /** Explicit Search Console property for this site (`sc-domain:...` or `https://.../`).\n   *  Null = auto-resolve from the SA's visible properties by host. */\n  searchConsoleProperty: string | null;\n  /** ISO timestamp of the last draft run where THIS site's GA/Search enrichment\n   *  ERRORED (vs a legitimate \"not configured\" skip). Set by drafting on a soft-fail,\n   *  cleared (null) on a clean enrichment, so the per-site analytics-failure signal\n   *  self-heals. Null when the operator-added `Analytics soft-fail at` column is absent. */\n  analyticsSoftFailAt: string | null;\n  /** GitHub repo identity as `owner/repo`. Null = no git wiring → self-update ops skip\n   *  (or, for local runs, fall back to the checkout's origin remote). */\n  gitRepo: string | null;\n  reportRecipientsTo: string | null;\n  reportRecipientsCc: string | null;\n  acceptedWatchConditions: string[];\n  /** First attachment in the Header image field (Airtable's signed URL — fetch before expiry). */\n  headerImage: { url: string; filename: string; type: string } | null;\n  /** Lighthouse \"current state\" snapshot, kept fresh by `audit lighthouse --write-airtable`. */\n  pScore: number | null;\n  rScore: number | null;\n  bpScore: number | null;\n  seoScore: number | null;\n  /** ISO timestamp set by `audit lighthouse --write-airtable` when scores were last refreshed. */\n  lastLighthouseAuditAt: string | null;\n  /** Last-known counts from non-lighthouse audits, written by\n   *  `audit --write-airtable`. `null` = never audited (or this audit\n   *  type was skipped on the last run). 0 = audited, clean. */\n  a11yViolations: number | null;\n  /** Declared-range drift vs the Reddoor baseline (what package.json asks for). */\n  depsDrifted: number | null;\n  depsMajorBehind: number | null;\n  /** Real installed-version drift: deps behind the registry's latest, from the\n   *  committed lockfile (`pnpm outdated`). Null = not determined this run. */\n  depsOutdated: number | null;\n  /** Of {@link depsOutdated}, how many are a *major* version behind the\n   *  registry's latest — the \"majors available on npm\" signal, distinct from the\n   *  baseline-drift {@link depsMajorBehind}. Null = not determined this run. */\n  depsMajorOutdated: number | null;\n  securityVulnsCritical: number | null;\n  securityVulnsHigh: number | null;\n  securityVulnsModerate: number | null;\n  securityVulnsLow: number | null;\n  /** Count of consecutive nightly Renovate auto-fix dispatches for the CURRENT\n   *  critical/high vuln episode that have NOT yet cleared it. Owned by\n   *  `renovate-dispatch`: +1 per real dispatch, reset to 0 when vulns clear.\n   *  Null = field absent / never dispatched → reads as 0. At/above\n   *  AUTO_FIX_EXHAUSTED_CYCLES the vuln renders as \"auto-fix failed\". */\n  securityAutoFixAttempts: number | null;\n  /** ISO timestamp the security audit last ran — gates freshness of the Security Updates auto-tick\n   *  (clean counts only auto-tick when recent). */\n  lastSecurityAuditAt: string | null;\n  /** The known advisories behind the counts (severity-sorted, capped), so the dashboard can show\n   *  WHICH packages are vulnerable, not just the totals. null = never audited / unparseable;\n   *  empty array = audited clean. Written alongside the counts by the security audit. */\n  securityAdvisories: SecurityAdvisory[] | null;\n  /** Domain/DNS/SSL probe (the `domain` audit). `certDaysRemaining` is days until the TLS cert\n   *  expires (null = unresolved or no usable cert); `domainCheckedAt` is when it last ran. */\n  certDaysRemaining: number | null;\n  domainCheckedAt: string | null;\n  /** Netlify site id — the IDENTITY the `netlify-deploy` audit needs to query the\n   *  Netlify API. Read-only input (operator-set in Airtable); null = not on Netlify\n   *  (or not wired) → that audit skips. Never derived from the URL. */\n  netlifyId: string | null;\n  /** Latest PRODUCTION deploy health (the `netlify-deploy` audit). `deployStatus` is\n   *  Netlify's deploy state lower-cased (`ready`/`error`/`building`/…), null = none / not\n   *  checked; `lastDeployAt` is when it deployed; `deployLogUrl` links to the deploy/log. */\n  deployStatus: string | null;\n  lastDeployAt: string | null;\n  deployLogUrl: string | null;\n  /** When the `netlify-deploy` audit last RAN (freshness stamp for `deployStatus`). The audit\n   *  already writes \"Deploy checked at\"; this read-back is the Plan-2 fix so `deployEvidence`\n   *  (Plan 4) can gate on check time — NOT on `lastDeployAt`, which is deploy time, not check time. */\n  deployCheckedAt: string | null;\n  /** Function-health verdict (the `function-health` audit): the deployed `/health` function\n   *  answered `ok:true` (pass) or `ok:false` (fail). Single-select `pass`/`fail`; null = never ran\n   *  / unreachable (→ Plan 4 maps to unknown/amber). Kept SEPARATE from `deployStatus` so\n   *  `isFailedDeployStatus` keeps meaning \"the build failed\". */\n  functionHealth: \"pass\" | \"fail\" | null;\n  /** CMS reachability (server-side), derived from the same `/health` body's `details.prismic ===\n   *  \"ok\"`. Single-select `pass`/`fail`; null = never ran. No per-site Prismic token or identity\n   *  column is ever built — this rides `/health`. */\n  cmsReachable: \"pass\" | \"fail\" | null;\n  /** From the same `/health` body's `forms.turnstile` boolean: does the deployed site report\n   *  the Turnstile widget configured (`PUBLIC_TURNSTILE_SITE_KEY` set)? Single-select\n   *  `pass`/`fail`; null = never ran / older site package whose `/health` has no `forms`\n   *  block. Freshness gated by `functionHealthCheckedAt`. Powers the cockpit Require-Turnstile\n   *  guardrail: a site with `requireTurnstile` ON but no widget silently buckets 100% of its\n   *  real leads (and form-e2e can't see it — testMode bypasses the gate). */\n  turnstileWidget: \"pass\" | \"fail\" | null;\n  /** When the `function-health` audit last ran — the freshness gate for `functionHealth`,\n   *  `cmsReachable`, and `turnstileWidget`. Null = never ran. */\n  functionHealthCheckedAt: string | null;\n  /** Deployed-URL browser probe (the `browser` audit): cross-engine render OK, mobile render OK,\n   *  internal-links OK + broken count, and when it last ran (one timestamp gates all three). */\n  crossbrowserOk: boolean | null;\n  mobileOk: boolean | null;\n  linksOk: boolean | null;\n  brokenLinks: number | null;\n  browserCheckedAt: string | null;\n  /** Uptime-reachable verdict (browser audit): every sampled route returned 2xx/3xx. Single-select\n   *  `pass`/`fail`; null = never ran. Point-in-time. Freshness-gated by `browserCheckedAt`. */\n  reachableOk: \"pass\" | \"fail\" | null;\n  /** Titles & meta verdict (browser audit, chromium): every sampled route has a non-empty `<title>`\n   *  ≤ 70 chars + a non-empty meta description, and no duplicate titles across the sample.\n   *  Single-select `pass`/`fail`; null = never ran. Freshness-gated by `browserCheckedAt`. */\n  titleMetaOk: \"pass\" | \"fail\" | null;\n  /** Per-site copy overrides (M6a). Blank → null → the DEFAULT_COPY value. */\n  copyIntro: string | null;\n  copyContact: string | null;\n  copyFooter: string | null;\n  /** Go-live timestamp, stamped when a Launch report sends (M6b). Null = not yet launched. */\n  launchedAt: string | null;\n  /** Optional per-site webhook (e.g. Zapier Catch Hook). When set, the ingest\n   *  POSTs newsletter-formType submissions here (best-effort). Blank → null. */\n  newsletterWebhook: string | null;\n  /** Per-site Mailchimp (newsletter). Both must be set for the direct add;\n   *  blank → skipped. The API key is `key-dc` format; dc is derived from it. */\n  mailchimpApiKey: string | null;\n  mailchimpAudienceId: string | null;\n  /** Per-site Cloudflare Turnstile gate (Airtable checkbox). When true, a submission\n   *  whose Turnstile token verifies as \"fail\" (forged) OR \"absent\" (secret configured\n   *  centrally but NO token forwarded — the direct-POST-bot signature) is escalated to\n   *  auto-spam regardless of content score. A present-but-expired token stays\n   *  \"unverifiable\" and neutral (a real browser DID render the widget — fail-open).\n   *  ROLLOUT PRECONDITION: only enable on a site whose DEPLOYED package forwards\n   *  `_meta.turnstileToken` from EVERY form (widget rendered + `cf-turnstile-response`\n   *  posted; check the site's `/health` → forms.turnstile:true). A site that never\n   *  forwards tokens would silently bucket 100% of its real leads — and the form-e2e\n   *  probe cannot catch that state (testMode bypasses the gate). */\n  requireTurnstile: boolean;\n  /** GitHub-signals sweep (slice 2a), written nightly by `github-signals --fleet`. */\n  renovateFailingCis: number | null;\n  defaultBranchCi: string | null; // \"passing\" | \"failing\" | \"pending\" | \"none\"\n  lastCommitAt: string | null;\n  githubSignalsAt: string | null;\n  /** Per-site smoke-suite verdict (the `smoke` audit runs `pnpm test:smoke`).\n   *  Single-select pass/fail; null = never ran. `lastSmokeAt` gates freshness. */\n  smokeOk: \"pass\" | \"fail\" | null;\n  lastSmokeAt: string | null;\n  /** Synthetic form end-to-end verdict (the `form-e2e` audit submits the real prod\n   *  contact form in test-mode). Single-select pass/fail; null = never ran OR (with\n   *  a fresh `formE2eCheckedAt`) no contact form → n/a. `formE2eCheckedAt` gates\n   *  freshness AND encodes the n/a-vs-never-ran distinction. */\n  formE2eOk: \"pass\" | \"fail\" | null;\n  formE2eCheckedAt: string | null;\n  /**\n   * Nightly Prismic model drift sweep (`prismic-models --fleet --write-airtable`).\n   *\n   * FOUR-VALUED, unlike every other verdict column in this table, and the extra\n   * state is the point:\n   *\n   *   - `pass`    — the repo and its Prismic repository were compared and agree.\n   *   - `fail`    — they were compared and DIVERGE (a model to create/update, or\n   *                 one that exists only in Prismic). A finding for a human.\n   *   - `unknown` — THE CHECK ITSELF FAILED. Unreadable checkout, broken config,\n   *                 missing/expired token, unreadable remote. Nothing at all was\n   *                 established about this site's models.\n   *   - `null`    — no verdict to hold: the sweep has never run for this site, or\n   *                 it ran and found no Prismic config at all (a repo that simply\n   *                 is not a Prismic site). `prismicModelsCheckedAt` separates\n   *                 those two — fresh timestamp, blank verdict = \"checked, and\n   *                 there is nothing here to check\".\n   *\n   * `unknown` exists because the alternatives are both wrong in the dangerous\n   * direction. Writing `pass` for a site nobody could read is a green tick over\n   * an outage; writing NOTHING (the obvious \"leave the last known value alone\")\n   * leaves yesterday's `pass` standing for a site that has been failing every\n   * night since — and nothing ages a stale `pass` out, because the digest's\n   * freshness gate only ever examines failures. Both make \"I could not read this\n   * site\" indistinguishable from \"this site is fine\", in the record the cockpit\n   * and the digest read.\n   *\n   * OPERATOR PRECONDITION: `Prismic Models` is a single select whose options are\n   * `pass`, `fail`, `unknown`. Until the three columns exist the sweep's writes\n   * fail with UNKNOWN_FIELD_NAME and are collected as soft failures — the feature\n   * ships dark rather than reddening the nightly.\n   */\n  prismicModels: PrismicModelsVerdict | null;\n  /** When the sweep last ran for this site — written on EVERY outcome, including\n   *  `unknown` and blank, so the age of the row is the age of the answer. */\n  prismicModelsCheckedAt: string | null;\n  /** What the sweep found, verbatim: the drift report for a `fail`, the reason\n   *  nothing could be established for an `unknown`, the skip reason for a blank,\n   *  and null for a `pass` (which clears yesterday's finding). */\n  prismicModelsDrift: string | null;\n  notifyRouting: NotifyRouting | null;\n};\n\nexport function siteSlug(name: string): string {\n  return name\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, \"-\")\n    .replace(/^-|-$/g, \"\");\n}\n\n/** Blank-trim-to-null: a non-string or whitespace-only value becomes null,\n *  otherwise the trimmed string. */\nfunction trimToNull(raw: unknown): string | null {\n  if (typeof raw !== \"string\") return null;\n  const trimmed = raw.trim();\n  return trimmed.length > 0 ? trimmed : null;\n}\n\n/**\n * Parse the Websites `Notify Routing` JSON into a NotifyRouting, defensively: a\n * non-string, blank, malformed-JSON, or wrong-shape value yields null (the site\n * then keeps default single-POC routing) — never throws. Mirrors the pipeline's\n * \"a bad Airtable string degrades quietly\" rule.\n */\nexport function parseNotifyRouting(raw: unknown): NotifyRouting | null {\n  if (typeof raw !== \"string\") return null;\n  const trimmed = raw.trim();\n  if (!trimmed) return null;\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(trimmed);\n  } catch {\n    return null;\n  }\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) return null;\n  const o = parsed as Record<string, unknown>;\n  if (typeof o.field !== \"string\" || !o.field.trim()) return null;\n  if (!o.routes || typeof o.routes !== \"object\" || Array.isArray(o.routes)) return null;\n  const routing: NotifyRouting = {\n    field: o.field,\n    routes: o.routes as Record<string, string | string[]>,\n  };\n  if (o.default !== undefined) routing.default = o.default as string | string[];\n  if (Array.isArray(o.cc)) routing.cc = o.cc.filter((x): x is string => typeof x === \"string\");\n  return routing;\n}\n\n/**\n * Active sites: actively-maintained or pre-launch. Single source of truth for\n * \"is this a live site\" — the operator cockpit shows these, and the fleet\n * audit/report path runs against these. A `null` status (not-yet-active) is\n * deliberately excluded.\n */\nexport const ACTIVE_STATUSES: ReadonlySet<Status> = new Set<Status>([\n  \"maintenance\",\n  \"launch period\",\n]);\n\nexport function isDashboardVisible(site: WebsiteRow): boolean {\n  return site.status !== null && ACTIVE_STATUSES.has(site.status);\n}\n\n/**\n * Pre-launch lifecycle stages: the site is being built/prepared, NOT yet live. A\n * Launch report (recipes/launch.ts) flips Status → \"maintenance\" at go-live\n * (updateLaunched), so \"maintenance\" is the true live state. Pre-launch sites must\n * not be audited as production (their deploy/domain/uptime/CMS audits fail because\n * nothing is live yet) nor scheduled recurring Maintenance/Testing reports.\n */\nexport const PRE_LAUNCH_STATUSES: ReadonlySet<Status> = new Set<Status>([\n  \"in development\",\n  \"launch period\",\n]);\n\nexport function isPreLaunch(status: Status | null): boolean {\n  return status !== null && PRE_LAUNCH_STATUSES.has(status);\n}\n\n/** Every Status value the code recognizes. Typed ReadonlySet<string> so a\n *  blind-cast typo'd cell can be probed without a cast. */\nexport const KNOWN_STATUSES: ReadonlySet<string> = new Set<Status>([\n  \"in development\",\n  \"launch period\",\n  \"maintenance\",\n  \"hosting\",\n  \"probably not our problem\",\n  \"deprecated\",\n  \"legacy\",\n]);\n\n/** Terminal, out-of-fleet lifecycle states: kept in Airtable for the record,\n *  excluded from every fleet op (sweeps, reports, audits, cockpit tiers) exactly\n *  as before, but surfaced on the cockpit as an archived lane so a row can never\n *  silently vanish. */\nexport const ARCHIVED_STATUSES: ReadonlySet<Status> = new Set<Status>([\"legacy\", \"deprecated\"]);\n\nexport function isArchivedStatus(status: Status | null): boolean {\n  return status !== null && ARCHIVED_STATUSES.has(status);\n}\n\n/** True when the Status cell holds a value outside the code's union (typo /\n *  renamed option / stray whitespace). mapRow deliberately does NOT null these —\n *  due.ts/preflight.ts treat a null status as eligible-by-default, so nulling a\n *  typo would ACTIVATE the row. The cockpit surfaces these as watch rows instead. */\nexport function isUnrecognizedStatus(status: Status | null): boolean {\n  return status !== null && !KNOWN_STATUSES.has(status);\n}\n\nconst FREQUENCIES: readonly Frequency[] = [\"None\", \"Monthly\", \"Quarterly\", \"Yearly\"];\n\n/** Coerce an Airtable single-select value to a known Frequency at the read boundary.\n *  Whitespace is trimmed first, so an operator's trailing-space option (\"Quarterly \")\n *  still schedules instead of silently unscheduling the site. Any other non-empty,\n *  unrecognized value — a renamed / typo'd option — warns LOUDLY and falls back to\n *  \"None\" (its section is simply omitted) rather than flowing a bogus string downstream,\n *  which the announcement would otherwise render as \"We do this undefined.\" into a\n *  client email. Blank/undefined is a silent \"None\": no schedule is intentional. */\nfunction toFrequency(raw: unknown, context: string): Frequency {\n  if (typeof raw !== \"string\") return \"None\";\n  const trimmed = raw.trim();\n  if ((FREQUENCIES as readonly string[]).includes(trimmed)) return trimmed as Frequency;\n  if (trimmed !== \"\") {\n    console.warn(\n      `⚠ ${context}: unrecognized frequency '${raw}' — treating as None (not scheduling); fix the Airtable value`,\n    );\n  }\n  return \"None\";\n}\n\n/** Coerce an Airtable tri-state single-select verdict cell (`pass`/`fail`/blank) to\n *  `\"pass\" | \"fail\" | null`. Any value other than the literal strings \"pass\"/\"fail\" — blank,\n *  an unrecognized option, a typo, wrong type — reads as null (\"never ran\"), never guessed. The\n *  ONE shared reader for every verdict column of this shape: `Function health`, `CMS Reachable`,\n *  `Uptime Reachable`, `Titles & Meta OK` (Plan 2), and reused (not redeclared) by Plan 3's\n *  `Smoke OK` / `Form E2E OK` read-backs. */\nexport function toVerdict(raw: unknown): \"pass\" | \"fail\" | null {\n  return raw === \"pass\" || raw === \"fail\" ? raw : null;\n}\n\n/** The `Prismic Models` cell — see {@link WebsiteRow.prismicModels} for why it\n *  carries a third state that no other verdict column in this table has. */\nexport type PrismicModelsVerdict = \"pass\" | \"fail\" | \"unknown\";\n\n/**\n * Read the `Prismic Models` cell. Deliberately NOT {@link toVerdict}.\n *\n * `toVerdict` maps anything that is not literally `pass`/`fail` to null — which\n * for this column would read `unknown` (\"the check ran and failed\") back as null\n * (\"the check never ran\"), silently, on the way to the cockpit. That is the\n * pipeline's governing failure (\"I could not read X\" wearing the face of \"X does\n * not exist\") reintroduced by a shared helper that predates the third state.\n *\n * Everything else — blank, a typo, an option somebody added by hand, the wrong\n * type — still reads as null. A verdict is never guessed.\n */\nexport function toPrismicModelsVerdict(raw: unknown): PrismicModelsVerdict | null {\n  return raw === \"pass\" || raw === \"fail\" || raw === \"unknown\" ? raw : null;\n}\n\n// NOTE: every `f[\"...\"]` key below is a load-bearing magic string that must match\n// the live Airtable \"Websites\" column name EXACTLY — including the legacy\n// misspelling `\"maintenence freq\"`, the mixed-case `\"GA4 property ID\"`, and the\n// lowercase `\"url\"` / `\"point of contact\"`. A column rename in Airtable silently\n// returns undefined here (→ null), which degrades quietly (GA skipped, recipients\n// empty) with no error. If you rename a column, change it here too.\nexport function mapRow(rec: { id: string; fields: Record<string, unknown> }): WebsiteRow {\n  const f = rec.fields;\n  const name = String(f[\"Name\"] ?? \"\");\n  const attachments =\n    (f[\"Header image\"] as Array<{ url: string; filename: string; type: string }> | undefined) ?? [];\n  const header = attachments[0] ?? null;\n  return {\n    id: rec.id,\n    name,\n    url: String(f[\"url\"] ?? \"\"),\n    status: (f[\"Status\"] as Status | undefined) ?? null,\n    pointOfContact: (f[\"point of contact\"] as string | undefined) ?? null,\n    maintenanceFreq: toFrequency(f[\"maintenence freq\"], `${name} maintenance`),\n    testingFreq: toFrequency(f[\"testing freq\"], `${name} testing`),\n    maintenanceFreqRaw: (f[\"maintenence freq\"] as string | undefined) ?? null,\n    testingFreqRaw: (f[\"testing freq\"] as string | undefined) ?? null,\n    maintenanceDay: (f[\"maintenance day\"] as string | undefined) ?? null,\n    testingDay: (f[\"testing day\"] as string | undefined) ?? null,\n    ga4PropertyId: (f[\"GA4 property ID\"] as string | undefined) ?? null,\n    searchQuery: (f[\"Search query\"] as string | undefined) ?? null,\n    searchConsoleProperty: (f[\"Search Console property\"] as string | undefined) ?? null,\n    analyticsSoftFailAt: (f[\"Analytics soft-fail at\"] as string | undefined) ?? null,\n    gitRepo: (f[\"Git repo\"] as string | undefined) ?? null,\n    reportRecipientsTo: (f[\"Report recipients (To)\"] as string | undefined) ?? null,\n    reportRecipientsCc: (f[\"Report recipients (CC)\"] as string | undefined) ?? null,\n    // Tolerate BOTH the current Multiple-Select array shape AND a delimited long-text\n    // string (comma/newline separated), so the field can migrate to a plain text column\n    // with no code change here. Trim + drop empties either way. The array branch also\n    // validates ELEMENT types: a collaborator/attachment-shaped field passes\n    // Array.isArray with OBJECT elements, and an unchecked cast would make assignTier's\n    // `.trim()` throw — one misconfigured row must not 500 the whole cockpit build.\n    acceptedWatchConditions: Array.isArray(f[\"Accepted Watch Conditions\"])\n      ? (f[\"Accepted Watch Conditions\"] as unknown[])\n          .filter((x): x is string => typeof x === \"string\")\n          .map((s) => s.trim())\n          .filter(Boolean)\n      : typeof f[\"Accepted Watch Conditions\"] === \"string\"\n        ? (f[\"Accepted Watch Conditions\"] as string)\n            .split(/[\\n,]/)\n            .map((s) => s.trim())\n            .filter(Boolean)\n        : [],\n    headerImage: header,\n    pScore: (f[\"pScore\"] as number | undefined) ?? null,\n    rScore: (f[\"rScore\"] as number | undefined) ?? null,\n    bpScore: (f[\"bpScore\"] as number | undefined) ?? null,\n    seoScore: (f[\"seoScore\"] as number | undefined) ?? null,\n    lastLighthouseAuditAt: (f[\"Last lighthouse audit at\"] as string | undefined) ?? null,\n    a11yViolations: (f[\"A11y Violations\"] as number | undefined) ?? null,\n    depsDrifted: (f[\"Deps Drifted\"] as number | undefined) ?? null,\n    depsMajorBehind: (f[\"Deps Major Behind\"] as number | undefined) ?? null,\n    depsOutdated: (f[\"Deps Outdated\"] as number | undefined) ?? null,\n    depsMajorOutdated: (f[\"Deps Major Outdated\"] as number | undefined) ?? null,\n    securityVulnsCritical: (f[\"Security Vulns Critical\"] as number | undefined) ?? null,\n    securityVulnsHigh: (f[\"Security Vulns High\"] as number | undefined) ?? null,\n    securityVulnsModerate: (f[\"Security Vulns Moderate\"] as number | undefined) ?? null,\n    securityVulnsLow: (f[\"Security Vulns Low\"] as number | undefined) ?? null,\n    securityAutoFixAttempts: (f[\"Security Auto-Fix Attempts\"] as number | undefined) ?? null,\n    lastSecurityAuditAt: (f[\"Last security audit at\"] as string | undefined) ?? null,\n    securityAdvisories: parseSecurityAdvisories(f[\"Security advisories\"]),\n    certDaysRemaining: (f[\"Cert days remaining\"] as number | undefined) ?? null,\n    domainCheckedAt: (f[\"Domain checked at\"] as string | undefined) ?? null,\n    netlifyId: trimToNull(f[\"Netlify ID\"]),\n    deployStatus: (f[\"Deploy status\"] as string | undefined) ?? null,\n    lastDeployAt: (f[\"Last deploy at\"] as string | undefined) ?? null,\n    deployLogUrl: (f[\"Deploy log URL\"] as string | undefined) ?? null,\n    deployCheckedAt: (f[\"Deploy checked at\"] as string | undefined) ?? null,\n    functionHealth: toVerdict(f[\"Function health\"]),\n    cmsReachable: toVerdict(f[\"CMS Reachable\"]),\n    turnstileWidget: toVerdict(f[\"Turnstile widget\"]),\n    functionHealthCheckedAt: (f[\"Function health checked at\"] as string | undefined) ?? null,\n    crossbrowserOk:\n      typeof f[\"Crossbrowser OK\"] === \"boolean\" ? (f[\"Crossbrowser OK\"] as boolean) : null,\n    mobileOk: typeof f[\"Mobile OK\"] === \"boolean\" ? (f[\"Mobile OK\"] as boolean) : null,\n    linksOk: typeof f[\"Links OK\"] === \"boolean\" ? (f[\"Links OK\"] as boolean) : null,\n    brokenLinks: typeof f[\"Broken links\"] === \"number\" ? (f[\"Broken links\"] as number) : null,\n    browserCheckedAt: (f[\"Browser checked at\"] as string | undefined) ?? null,\n    reachableOk: toVerdict(f[\"Uptime Reachable\"]),\n    titleMetaOk: toVerdict(f[\"Titles & Meta OK\"]),\n    copyIntro: trimToNull(f[\"Copy — Intro\"]),\n    copyContact: trimToNull(f[\"Copy — Contact\"]),\n    copyFooter: trimToNull(f[\"Copy — Footer\"]),\n    launchedAt: (f[\"Launched at\"] as string | undefined) ?? null,\n    newsletterWebhook: trimToNull(f[\"Newsletter Webhook\"]),\n    notifyRouting: parseNotifyRouting(f[\"Notify Routing\"]),\n    mailchimpApiKey: trimToNull(f[\"Mailchimp API Key\"]),\n    mailchimpAudienceId: trimToNull(f[\"Mailchimp Audience ID\"]),\n    // Boolean guard like crossbrowserOk, but defaults FALSE (not null) when absent: an\n    // unset/unknown column must read as \"not required\" so the feature ships dark.\n    requireTurnstile:\n      typeof f[\"Require Turnstile\"] === \"boolean\" ? (f[\"Require Turnstile\"] as boolean) : false,\n    renovateFailingCis: (f[\"Renovate Failing CIs\"] as number | undefined) ?? null,\n    defaultBranchCi: (f[\"Default Branch CI\"] as string | undefined) ?? null,\n    lastCommitAt: (f[\"Last Commit At\"] as string | undefined) ?? null,\n    githubSignalsAt: (f[\"GitHub Signals At\"] as string | undefined) ?? null,\n    smokeOk: toVerdict(f[\"Smoke OK\"]),\n    lastSmokeAt: (f[\"Last Smoke At\"] as string | undefined) ?? null,\n    formE2eOk: toVerdict(f[\"Form E2E OK\"]),\n    formE2eCheckedAt: (f[\"Form E2E checked at\"] as string | undefined) ?? null,\n    prismicModels: toPrismicModelsVerdict(f[\"Prismic Models\"]),\n    prismicModelsCheckedAt: (f[\"Prismic Models Checked At\"] as string | undefined) ?? null,\n    prismicModelsDrift: (f[\"Prismic Models Drift\"] as string | undefined) ?? null,\n  };\n}\n\nexport async function listWebsites(base: AirtableBase): Promise<WebsiteRow[]> {\n  const out: WebsiteRow[] = [];\n  await base(WEBSITES_TABLE)\n    .select({ pageSize: 100 })\n    .eachPage((records, fetchNextPage) => {\n      for (const rec of records) out.push(mapRow({ id: rec.id, fields: rec.fields }));\n      fetchNextPage();\n    });\n  return out;\n}\n\nexport async function getWebsiteBySlug(\n  base: AirtableBase,\n  slug: string,\n): Promise<WebsiteRow | null> {\n  // Slugs are siteSlug() output: [a-z0-9] segments joined by single hyphens.\n  // Reject anything else — it can't match a real row, and it keeps URL-supplied\n  // input out of the filter formula below (formula-injection guard).\n  if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(slug)) return null;\n\n  // Narrow the fetch to the slug-matching row server-side instead of paging the\n  // whole table per request (MEDIUM-H). The formula replicates siteSlug() on\n  // {Name} — lowercase → non-alnum runs to \"-\" → strip leading/trailing \"-\" —\n  // verified against the live base. maxRecords caps it (slug collisions keep the\n  // prior first-match-wins behavior).\n  const formula = `REGEX_REPLACE(REGEX_REPLACE(LOWER({Name}),\"[^a-z0-9]+\",\"-\"),\"^-|-$\",\"\")=${JSON.stringify(\n    slug,\n  )}`;\n  const rows: WebsiteRow[] = [];\n  await base(WEBSITES_TABLE)\n    .select({ filterByFormula: formula, maxRecords: 1 })\n    .eachPage((records, fetchNextPage) => {\n      for (const rec of records) rows.push(mapRow({ id: rec.id, fields: rec.fields }));\n      fetchNextPage();\n    });\n  // Confirm the match in JS too: keeps the function correct if the formula and\n  // siteSlug() ever drift, and under test fakes that don't evaluate the formula.\n  return rows.find((w) => siteSlug(w.name) === slug) ?? null;\n}\n\n// ── audit-field builders ─────────────────────────────────────────────────────\n// One source of truth for the column-name → value mappings of each audit type.\n// The per-audit `updateXxxCounts` writers delegate to these (for their other\n// callers), and `updateAuditFields` merges whichever are present into ONE write —\n// so the field-name magic strings live in exactly one place.\n\nexport type A11yCounts = { violations: number };\nexport type DepsCounts = {\n  drifted: number;\n  majorBehind: number;\n  outdated: number | null;\n  majorOutdated: number | null;\n};\nexport type SecurityCounts = { critical: number; high: number; moderate: number; low: number };\nexport type Severity = \"low\" | \"moderate\" | \"high\" | \"critical\";\n/** One known vulnerability behind the security counts, as persisted/rendered. */\nexport type SecurityAdvisory = {\n  module: string;\n  severity: Severity;\n  title: string;\n  cves: string[];\n  url: string | null;\n  /** GitHub Dependabot dependency scope (\"runtime\" | \"development\"), when known. Lets the\n   *  dashboard flag build-time-only (\"development\") vulns. Omitted for advisories from the\n   *  lockfile `pnpm audit` fallback, which carries no per-package graph scope. */\n  scope?: \"runtime\" | \"development\";\n  /** GitHub Dependabot dependency-graph relationship, when known. \"transitive\" means no\n   *  direct-dep bump can fix it — Renovate's vuln alerts have no fix vehicle until the weekly\n   *  lockfile-maintenance window. Omitted when GitHub reports \"unknown\" or for the\n   *  `pnpm audit` fallback. Drives {@link allActionableVulnsTransitive}. */\n  relationship?: \"direct\" | \"transitive\";\n};\nexport type DomainResult = { certDaysRemaining: number | null; checkedAt: string };\nexport type NetlifyDeployResult = {\n  /** Netlify deploy state lower-cased (`ready`/`error`/`building`/…), null = none. */\n  state: string | null;\n  /** When the latest production deploy was published/created (ISO), null = unknown. */\n  deployedAt: string | null;\n  /** Link to the deploy / its build log, null = unknown. */\n  logUrl: string | null;\n  /** When the audit last ran. */\n  checkedAt: string;\n};\nexport type BrowserAuditFields = {\n  desktopOk: boolean;\n  mobileOk: boolean;\n  linksOk: boolean;\n  reachableOk: boolean;\n  titleMetaOk: boolean;\n  brokenLinks: number;\n  checkedAt: string;\n};\nexport type FunctionHealthResult = {\n  /** `pass` when `/health` answered `ok:true`, else `fail`. Never null — the audit only produces a\n   *  result when it ran (a self-skip carries no details, so this extractor isn't reached). */\n  functionHealth: \"pass\" | \"fail\";\n  /** From the same body's `prismic` sub-status (R2.2): `\"ok\"` → `\"pass\"`, `\"error\"` → `\"fail\"`.\n   *  Anything else (`\"skipped\"` — a placeholder repo with no live Prismic — or a raw `null`, e.g.\n   *  the synthetic \"deployed but erroring\" body) → `null`: the CMS probe never actually ran, so it\n   *  must NOT red CMS reachability for a site that simply hasn't wired Prismic yet. */\n  cmsReachable: \"pass\" | \"fail\" | null;\n  /** From the same body's `forms.turnstile` boolean: `true` → `\"pass\"`, `false` → `\"fail\"`.\n   *  A missing/null `forms` block (older site package, or the synthetic \"deployed but\n   *  erroring\" body) → `null` — the widget state is simply unknown, not a failure. */\n  turnstileWidget: \"pass\" | \"fail\" | null;\n  /** When the audit ran (freshness stamp for all three verdicts). */\n  checkedAt: string;\n};\n\nexport type SmokeResult = { ok: \"pass\" | \"fail\"; checkedAt: string };\n\n/** `ok` null clears the single-select cell (n/a — no contact form); a fresh\n *  `checkedAt` still stamps the row so Plan 4 reads null+fresh as n/a. */\nexport type FormE2eResult = { ok: \"pass\" | \"fail\" | null; checkedAt: string };\n\nfunction scoreFields(scores: LighthouseScoreWriteback): FieldSet {\n  // A null score CLEARS the cell (→ dashboard \"—\"), distinguishing a metric that\n  // errored this run (e.g. NO_LCP → null performance) from a real low score. This\n  // intentionally overwrites a prior value: a run that couldn't measure the metric\n  // shouldn't keep showing a stale number. Writing null to clear mirrors\n  // updateAnalyticsHealth; the `as FieldSet` cast is needed because airtable's\n  // FieldSet type omits null.\n  const fields: Record<string, number | string | null> = {\n    pScore: scores.performance,\n    rScore: scores.accessibility,\n    bpScore: scores.bestPractices,\n    seoScore: scores.seo,\n    \"Last lighthouse audit at\": new Date().toISOString(),\n  };\n  return fields as FieldSet;\n}\n\nfunction a11yFields(counts: A11yCounts): FieldSet {\n  return { \"A11y Violations\": counts.violations };\n}\n\nfunction depsFields(counts: DepsCounts): FieldSet {\n  const fields: FieldSet = {\n    \"Deps Drifted\": counts.drifted,\n    \"Deps Major Behind\": counts.majorBehind,\n  };\n  // Only write the outdated count when it was determined — a null (no/stale\n  // lockfile this run) must not clobber a previously-good value.\n  if (counts.outdated !== null) {\n    fields[\"Deps Outdated\"] = counts.outdated;\n  }\n  // Same null-guard for the registry-major breakdown (same source signal).\n  if (counts.majorOutdated !== null) {\n    fields[\"Deps Major Outdated\"] = counts.majorOutdated;\n  }\n  return fields;\n}\n\n/** Critical first → low last; the persist cap and the dashboard list both lean on this. */\nexport const SEVERITY_RANK: Record<Severity, number> = {\n  critical: 0,\n  high: 1,\n  moderate: 2,\n  low: 3,\n};\n/** Cap persisted advisories so the JSON field can't blow up on a badly-neglected site. */\nconst MAX_PERSISTED_ADVISORIES = 25;\n\n/** Coerce one untrusted value into a SecurityAdvisory, or null if it isn't shaped like one.\n *  Shared by the read path (`parseSecurityAdvisories`) and the write path so both validate\n *  identically. A missing module or unrecognized severity drops the entry entirely. */\nexport function normalizeSecurityAdvisory(raw: unknown): SecurityAdvisory | null {\n  if (!raw || typeof raw !== \"object\") return null;\n  const e = raw as Record<string, unknown>;\n  const module = typeof e[\"module\"] === \"string\" ? (e[\"module\"] as string) : null;\n  const severity = e[\"severity\"];\n  if (module === null) return null;\n  if (\n    severity !== \"low\" &&\n    severity !== \"moderate\" &&\n    severity !== \"high\" &&\n    severity !== \"critical\"\n  )\n    return null;\n  const cves = Array.isArray(e[\"cves\"])\n    ? (e[\"cves\"] as unknown[]).filter((c): c is string => typeof c === \"string\")\n    : [];\n  const scope =\n    e[\"scope\"] === \"runtime\" || e[\"scope\"] === \"development\"\n      ? (e[\"scope\"] as \"runtime\" | \"development\")\n      : undefined;\n  const relationship =\n    e[\"relationship\"] === \"direct\" || e[\"relationship\"] === \"transitive\"\n      ? (e[\"relationship\"] as \"direct\" | \"transitive\")\n      : undefined;\n  return {\n    module,\n    severity,\n    title: typeof e[\"title\"] === \"string\" ? (e[\"title\"] as string) : \"\",\n    cves,\n    url: typeof e[\"url\"] === \"string\" ? (e[\"url\"] as string) : null,\n    ...(scope ? { scope } : {}),\n    ...(relationship ? { relationship } : {}),\n  };\n}\n\n/**\n * True iff the persisted advisory detail proves EVERY actionable (critical/high) vuln is a\n * TRANSITIVE dependency — i.e. Renovate's vulnerability alerts have no direct-dep bump to\n * open, and the fix rides the weekly lockfile-maintenance window instead. Deliberately\n * conservative: `null` detail (never audited / `pnpm audit` fallback), an advisory missing\n * its `relationship` (unknown / pre-existing JSON), or a counts-vs-detail mismatch (no\n * critical/high advisory in the list) all return false — missing data must never mute the\n * auto-fix-failed escalation. Consumed by the attempts counter (don't count a known no-op\n * dispatch as a failed fix attempt) and the digest (say \"transitive-only\", not\n * \"auto-fix failed\"). The persist cap keeps advisories sorted critical-first, so\n * critical/high entries are never the ones capped away.\n */\nexport function allActionableVulnsTransitive(advisories: SecurityAdvisory[] | null): boolean {\n  if (!advisories) return false;\n  const actionable = advisories.filter((a) => a.severity === \"critical\" || a.severity === \"high\");\n  if (actionable.length === 0) return false;\n  return actionable.every((a) => a.relationship === \"transitive\");\n}\n\n/** Parse the `Security advisories` JSON cell. null when absent/blank/unparseable/not-an-array\n *  (treated as \"never audited\"); a valid array (possibly empty = audited clean) otherwise. */\nexport function parseSecurityAdvisories(raw: unknown): SecurityAdvisory[] | null {\n  if (typeof raw !== \"string\" || raw.trim() === \"\") return null;\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch {\n    return null;\n  }\n  if (!Array.isArray(parsed)) return null;\n  return parsed.map(normalizeSecurityAdvisory).filter((a): a is SecurityAdvisory => a !== null);\n}\n\nfunction securityAdvisoryFields(advisories: SecurityAdvisory[]): FieldSet {\n  const capped = [...advisories]\n    .sort((a, b) => SEVERITY_RANK[a.severity] - SEVERITY_RANK[b.severity])\n    .slice(0, MAX_PERSISTED_ADVISORIES);\n  // Always write — an empty array (\"[]\") clears a stale list when a once-vulnerable site goes clean.\n  return { \"Security advisories\": JSON.stringify(capped) };\n}\n\nfunction securityFields(counts: SecurityCounts): FieldSet {\n  return {\n    \"Security Vulns Critical\": counts.critical,\n    \"Security Vulns High\": counts.high,\n    \"Security Vulns Moderate\": counts.moderate,\n    \"Security Vulns Low\": counts.low,\n    // Stamp freshness alongside the counts so the Security Updates auto-tick can require a recent\n    // audit (a clean count from months ago must not silently keep ticking the box).\n    \"Last security audit at\": new Date().toISOString(),\n  };\n}\n\nfunction domainFields(result: DomainResult): FieldSet {\n  const fields: FieldSet = { \"Domain checked at\": result.checkedAt };\n  // Write the cert days UNCONDITIONALLY: a null (unresolved / no usable cert) must CLEAR any\n  // previously-good value. Leaving a stale number in place — next to a freshly-stamped \"Domain\n  // checked at\" — false-passes the Domain/DNS/SSL auto-tick (domainEvidence reads the stale\n  // non-null value as a current pass) for a site that's actually down. null clears the cell in\n  // Airtable; FieldSet's type doesn't model null, hence the cast through a widened record.\n  (fields as Record<string, number | null>)[\"Cert days remaining\"] = result.certDaysRemaining;\n  return fields;\n}\n\nfunction netlifyDeployFields(result: NetlifyDeployResult): FieldSet {\n  // Write all three deploy fields UNCONDITIONALLY (null clears the cell): a null state /\n  // deployedAt / logUrl this run means \"couldn't read it\" and must not leave a STALE value\n  // sitting next to a fresh \"Deploy checked at\" — the dashboard would otherwise render a green\n  // \"ready\" badge for a site whose latest deploy actually errored. FieldSet's type doesn't model\n  // null, hence the cast through a widened record (same approach as domainFields).\n  const fields: Record<string, string | null> = {\n    \"Deploy status\": result.state,\n    \"Last deploy at\": result.deployedAt,\n    \"Deploy log URL\": result.logUrl,\n    \"Deploy checked at\": result.checkedAt,\n  };\n  return fields as FieldSet;\n}\n\nfunction browserFields(r: BrowserAuditFields): FieldSet {\n  return {\n    \"Crossbrowser OK\": r.desktopOk,\n    \"Mobile OK\": r.mobileOk,\n    \"Links OK\": r.linksOk,\n    \"Broken links\": r.brokenLinks,\n    \"Browser checked at\": r.checkedAt,\n    // NEW tri-state single-select verdicts (empty = never ran). The browser audit only produces a\n    // BrowserAuditFields when it actually ran (hasBrowserResult guards on checkedAt), so each verdict\n    // is always a concrete boolean here — serialize true→\"pass\", false→\"fail\". The existing boolean\n    // columns above are deliberately NOT retrofitted (out of scope).\n    \"Uptime Reachable\": r.reachableOk ? \"pass\" : \"fail\",\n    \"Titles & Meta OK\": r.titleMetaOk ? \"pass\" : \"fail\",\n  };\n}\n\nfunction functionHealthFields(r: FunctionHealthResult): FieldSet {\n  // \"CMS Reachable\" is written UNCONDITIONALLY (null clears the cell): the audit only supplies a\n  // result when it ran, but `cmsReachable` itself can legitimately be null this run (R2.2 — the CMS\n  // probe never actually happened, e.g. a placeholder repo with no live Prismic). Clearing rather\n  // than leaving a stale pass/fail sitting next to a freshly-stamped checked-at is what keeps a\n  // placeholder site from showing a stale CMS verdict. FieldSet's type doesn't model null, hence the\n  // cast through a widened record (same approach as domainFields/netlifyDeployFields).\n  // \"Function health\" is never null — the audit only writes when it ran, so it's always a concrete\n  // pass/fail. Written SEPARATELY from \"Deploy status\" so the Netlify build state keeps its own\n  // meaning.\n  const fields: Record<string, string | null> = {\n    \"Function health\": r.functionHealth,\n    \"CMS Reachable\": r.cmsReachable,\n    // Same null-clears semantics as \"CMS Reachable\": a body without a forms block means the\n    // widget state is unknown THIS run — clearing beats a stale verdict next to a fresh stamp.\n    \"Turnstile widget\": r.turnstileWidget,\n    \"Function health checked at\": r.checkedAt,\n  };\n  return fields as FieldSet;\n}\n\nfunction smokeFields(r: SmokeResult): FieldSet {\n  // The verdict is stored as the literal single-select option (\"pass\"/\"fail\"), so\n  // no boolean→string coercion is needed. A skip never reaches here (it produces no\n  // SmokeResult), so this column is only ever written with a concrete verdict.\n  return { \"Smoke OK\": r.ok, \"Last Smoke At\": r.checkedAt };\n}\n\nfunction formE2eFields(r: FormE2eResult): FieldSet {\n  // `ok` is already the single-select value (\"pass\"/\"fail\") or null. Writing null\n  // CLEARS the cell (→ n/a, distinguished from \"never ran\" by the fresh checked-at\n  // stamped alongside). FieldSet's type omits null, hence the widened-record cast\n  // (same approach as domainFields / netlifyDeployFields).\n  const fields: Record<string, string | null> = {\n    \"Form E2E OK\": r.ok,\n    \"Form E2E checked at\": r.checkedAt,\n  };\n  return fields as FieldSet;\n}\n\n/**\n * Write the four Lighthouse scores + a refreshed-at timestamp onto a Websites row.\n * Called by `audit lighthouse --write-airtable` after a successful audit run, so\n * the operator never has to paste numbers manually before drafting a report.\n */\nexport async function updateScores(\n  base: AirtableBase,\n  recordId: string,\n  scores: LighthouseScores,\n): Promise<void> {\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields: scoreFields(scores) }]);\n}\n\n/**\n * Record (or clear) the per-site GA/Search enrichment health on the `Analytics\n * soft-fail at` column. `at` is an ISO timestamp when the site's last draft had a\n * GA/Search soft-failure, or `null` to clear it after a clean enrichment. The\n * caller (drafting) swallows errors: this column is operator-added, so until it\n * exists Airtable throws UNKNOWN_FIELD_NAME — which must not break a draft.\n */\nexport async function updateAnalyticsHealth(\n  base: AirtableBase,\n  recordId: string,\n  at: string | null,\n): Promise<void> {\n  const fields: Record<string, string | null> = { \"Analytics soft-fail at\": at };\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields: fields as FieldSet }]);\n}\n\n/** Persist a11y violation count. */\nexport async function updateA11yCounts(\n  base: AirtableBase,\n  recordId: string,\n  counts: A11yCounts,\n): Promise<void> {\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields: a11yFields(counts) }]);\n}\n\n/** Persist deps drift counts (declared-range drift + real outdated installs). */\nexport async function updateDepsCounts(\n  base: AirtableBase,\n  recordId: string,\n  counts: DepsCounts,\n): Promise<void> {\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields: depsFields(counts) }]);\n}\n\n/** Persist security vulnerability counts by severity. */\nexport async function updateSecurityCounts(\n  base: AirtableBase,\n  recordId: string,\n  counts: SecurityCounts,\n): Promise<void> {\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields: securityFields(counts) }]);\n}\n\n/** Persist a site's auto-fix attempt counter. Its own one-field writer so the\n *  nightly Renovate dispatch can update it without touching the audit's counts. */\nexport async function updateAutoFixAttempts(\n  base: AirtableBase,\n  recordId: string,\n  attempts: number,\n): Promise<void> {\n  await base(WEBSITES_TABLE).update([\n    { id: recordId, fields: { \"Security Auto-Fix Attempts\": attempts } },\n  ]);\n}\n\n/**\n * Persist the code-computed next-due dates (date-only `YYYY-MM-DD`, or `null` to\n * clear) for the maintenance + testing schedules. Owned by the nightly `--due` sweep\n * so the \"next\" dates shown in Airtable come from the SAME logic as the scheduler\n * (`nextDueDate`) — no Airtable-side formula or automation. Best-effort at the call\n * site: the `Next … at` columns are operator-added, so until they exist Airtable\n * throws UNKNOWN_FIELD_NAME, which must not break the nightly draft run.\n */\nexport async function updateNextDueDates(\n  base: AirtableBase,\n  recordId: string,\n  dates: { maintenanceAt: string | null; testingAt: string | null },\n): Promise<void> {\n  const fields: Record<string, string | null> = {\n    \"Next maintenance at\": dates.maintenanceAt,\n    \"Next testing at\": dates.testingAt,\n  };\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields: fields as FieldSet }]);\n}\n\n/** Generic single-field writer for the dashboard site-details editor. The caller\n *  (setSiteDetail) restricts `column` to the EDITABLE_SITE_FIELDS allowlist, so this\n *  never writes an arbitrary column from request input. */\nexport async function updateSiteField(\n  base: AirtableBase,\n  recordId: string,\n  column: string,\n  value: string,\n): Promise<void> {\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields: { [column]: value } }]);\n}\n\n/**\n * Persist all of a single audit run's results to one Websites row in ONE atomic\n * `update()` — instead of up to four sequential updates on the same id (which left\n * a row half-written on a mid-sequence failure and quadrupled the request volume).\n * Pass only the audit slices that produced real values; each present slice is merged\n * via the SAME field mappings the per-audit writers use. Omit a slice (or pass\n * undefined) to leave those columns untouched. Returns the merged FieldSet so the\n * caller can enumerate what was written.\n */\nexport async function updateAuditFields(\n  base: AirtableBase,\n  recordId: string,\n  audits: {\n    scores?: LighthouseScoreWriteback;\n    a11y?: A11yCounts;\n    deps?: DepsCounts;\n    security?: SecurityCounts;\n    securityAdvisories?: SecurityAdvisory[];\n    domain?: DomainResult;\n    browser?: BrowserAuditFields;\n    netlifyDeploy?: NetlifyDeployResult;\n    functionHealth?: FunctionHealthResult;\n    smoke?: SmokeResult;\n    formE2e?: FormE2eResult;\n  },\n): Promise<FieldSet> {\n  const fields: FieldSet = {};\n  if (audits.scores) Object.assign(fields, scoreFields(audits.scores));\n  if (audits.a11y) Object.assign(fields, a11yFields(audits.a11y));\n  if (audits.deps) Object.assign(fields, depsFields(audits.deps));\n  if (audits.security) Object.assign(fields, securityFields(audits.security));\n  // Separate slice (not folded into `security`) so the advisory list and the counts can be\n  // written independently, but in practice the security audit supplies both together.\n  if (audits.securityAdvisories)\n    Object.assign(fields, securityAdvisoryFields(audits.securityAdvisories));\n  if (audits.domain) Object.assign(fields, domainFields(audits.domain));\n  if (audits.browser) Object.assign(fields, browserFields(audits.browser));\n  if (audits.netlifyDeploy) Object.assign(fields, netlifyDeployFields(audits.netlifyDeploy));\n  if (audits.functionHealth) Object.assign(fields, functionHealthFields(audits.functionHealth));\n  if (audits.smoke) Object.assign(fields, smokeFields(audits.smoke));\n  if (audits.formE2e) Object.assign(fields, formE2eFields(audits.formE2e));\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);\n  return fields;\n}\n\n/** Persist the GitHub-signals sweep onto a Websites row (slice 2a). A null\n *  `lastCommitAt` is OMITTED so a not-determined-this-run value never clobbers a\n *  previously-good timestamp (mirrors updateDepsCounts' outdated handling). */\nexport async function updateGitHubSignals(\n  base: AirtableBase,\n  recordId: string,\n  signals: {\n    renovateFailingCis: number;\n    ciState: string;\n    lastCommitAt: string | null;\n    sweptAt: string;\n  },\n): Promise<void> {\n  const fields: FieldSet = {\n    \"Renovate Failing CIs\": signals.renovateFailingCis,\n    \"Default Branch CI\": signals.ciState,\n    \"GitHub Signals At\": signals.sweptAt,\n  };\n  if (signals.lastCommitAt !== null) {\n    fields[\"Last Commit At\"] = signals.lastCommitAt;\n  }\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);\n}\n\n/** One site's Prismic model verdict, as the sweep hands it to the record.\n *\n *  `verdict: null` is a REQUEST TO BLANK the cell, not \"leave it alone\" — see\n *  {@link updatePrismicModels}. There is no way to express \"leave it alone\" here\n *  on purpose. */\nexport type PrismicModelsWriteback = {\n  verdict: PrismicModelsVerdict | null;\n  checkedAt: string;\n  /** The finding, the failure reason, or the skip reason — whichever this\n   *  verdict has. `null` clears the column. */\n  detail: string | null;\n};\n\n/** Airtable's long-text cells hold ~100k characters and the sweep's report runs\n *  long on a badly drifted site (an empty Prismic repository sorts every local\n *  model into `toCreate`, with a line per field). Half the cell is the budget;\n *  the rest is headroom for whatever renders it. */\nconst MAX_PRISMIC_DETAIL_CHARS = 50_000;\n\n/**\n * Shorten a detail that will not fit, and SAY SO — with the original length, so\n * nobody mistakes the remainder for the whole. Same reasoning as the PR comment's\n * truncation notice: a report that was shortened without saying it was shortened\n * is a report that looks complete and is not.\n *\n * The cut is by code unit, so it can land between the halves of an astral\n * character; a lone surrogate is not valid text and can make Airtable reject the\n * write, losing the entire finding to a cosmetic detail.\n */\nfunction truncatePrismicDetail(detail: string): string {\n  if (detail.length <= MAX_PRISMIC_DETAIL_CHARS) return detail;\n  const notice =\n    `\\n…[truncated: this report is ${detail.length} characters and only the first` +\n    ` ${MAX_PRISMIC_DETAIL_CHARS} are kept here. Run \\`reddoor-maint prismic-models\\` in the` +\n    ` site — dry is the default — for the whole thing.]`;\n  let head = detail.slice(0, MAX_PRISMIC_DETAIL_CHARS - notice.length);\n  const last = head.charCodeAt(head.length - 1);\n  if (last >= 0xd800 && last <= 0xdbff) head = head.slice(0, -1);\n  return head + notice;\n}\n\n/**\n * Persist one site's Prismic model verdict.\n *\n * ALL THREE COLUMNS, ALWAYS, in one update — including when the verdict is\n * `unknown` or blank. That is the whole design: the alternative (\"only write a\n * verdict when we have one\") leaves the PREVIOUS verdict standing for a site\n * whose check has since started failing, and a stale `pass` is never aged out by\n * anything — the digest's freshness gate only examines failures. So the record\n * always says what the last run actually established, and `checkedAt` always\n * says when. See {@link WebsiteRow.prismicModels} for the four states.\n *\n * Best-effort AT THE CALL SITE: `Prismic Models*` are operator-added columns, so\n * until they exist Airtable throws UNKNOWN_FIELD_NAME. The nightly sweep must\n * survive that and collect it — same contract as `updateNextDueDates`.\n *\n * Takes a non-null `AirtableBase`, like every other writer here: whether to write\n * at all is the caller's decision, and this repo keeps \"do no writes\" separate\n * from \"do no IO\" one layer up.\n */\nexport async function updatePrismicModels(\n  base: AirtableBase,\n  recordId: string,\n  models: PrismicModelsWriteback,\n): Promise<void> {\n  const fields: Record<string, string | null> = {\n    \"Prismic Models\": models.verdict,\n    \"Prismic Models Checked At\": models.checkedAt,\n    \"Prismic Models Drift\": models.detail === null ? null : truncatePrismicDetail(models.detail),\n  };\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields: fields as FieldSet }]);\n}\n\n/** Mark a site launched: flip Status → maintenance + stamp Launched at (M6b).\n *  The first code that writes Status. Called after a Launch report sends. */\nexport async function updateLaunched(\n  base: AirtableBase,\n  recordId: string,\n  at: string,\n): Promise<void> {\n  const fields: FieldSet = { Status: \"maintenance\", \"Launched at\": at };\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);\n}\n"],"mappings":";AAIO,IAAM,iBAAiB;AAkPvB,SAAS,SAAS,MAAsB;AAC7C,SAAO,KACJ,YAAY,EACZ,QAAQ,eAAe,GAAG,EAC1B,QAAQ,UAAU,EAAE;AACzB;AAIA,SAAS,WAAW,KAA6B;AAC/C,MAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,QAAM,UAAU,IAAI,KAAK;AACzB,SAAO,QAAQ,SAAS,IAAI,UAAU;AACxC;AAQO,SAAS,mBAAmB,KAAoC;AACrE,MAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,QAAM,UAAU,IAAI,KAAK;AACzB,MAAI,CAAC,QAAS,QAAO;AACrB,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,OAAO;AAAA,EAC7B,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,EAAG,QAAO;AAC3E,QAAM,IAAI;AACV,MAAI,OAAO,EAAE,UAAU,YAAY,CAAC,EAAE,MAAM,KAAK,EAAG,QAAO;AAC3D,MAAI,CAAC,EAAE,UAAU,OAAO,EAAE,WAAW,YAAY,MAAM,QAAQ,EAAE,MAAM,EAAG,QAAO;AACjF,QAAM,UAAyB;AAAA,IAC7B,OAAO,EAAE;AAAA,IACT,QAAQ,EAAE;AAAA,EACZ;AACA,MAAI,EAAE,YAAY,OAAW,SAAQ,UAAU,EAAE;AACjD,MAAI,MAAM,QAAQ,EAAE,EAAE,EAAG,SAAQ,KAAK,EAAE,GAAG,OAAO,CAAC,MAAmB,OAAO,MAAM,QAAQ;AAC3F,SAAO;AACT;AAQO,IAAM,kBAAuC,oBAAI,IAAY;AAAA,EAClE;AAAA,EACA;AACF,CAAC;AAEM,SAAS,mBAAmB,MAA2B;AAC5D,SAAO,KAAK,WAAW,QAAQ,gBAAgB,IAAI,KAAK,MAAM;AAChE;AASO,IAAM,sBAA2C,oBAAI,IAAY;AAAA,EACtE;AAAA,EACA;AACF,CAAC;AAEM,SAAS,YAAY,QAAgC;AAC1D,SAAO,WAAW,QAAQ,oBAAoB,IAAI,MAAM;AAC1D;AAIO,IAAM,iBAAsC,oBAAI,IAAY;AAAA,EACjE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAMM,IAAM,oBAAyC,oBAAI,IAAY,CAAC,UAAU,YAAY,CAAC;AAEvF,SAAS,iBAAiB,QAAgC;AAC/D,SAAO,WAAW,QAAQ,kBAAkB,IAAI,MAAM;AACxD;AAMO,SAAS,qBAAqB,QAAgC;AACnE,SAAO,WAAW,QAAQ,CAAC,eAAe,IAAI,MAAM;AACtD;AAEA,IAAM,cAAoC,CAAC,QAAQ,WAAW,aAAa,QAAQ;AASnF,SAAS,YAAY,KAAc,SAA4B;AAC7D,MAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,QAAM,UAAU,IAAI,KAAK;AACzB,MAAK,YAAkC,SAAS,OAAO,EAAG,QAAO;AACjE,MAAI,YAAY,IAAI;AAClB,YAAQ;AAAA,MACN,UAAK,OAAO,6BAA6B,GAAG;AAAA,IAC9C;AAAA,EACF;AACA,SAAO;AACT;AAQO,SAAS,UAAU,KAAsC;AAC9D,SAAO,QAAQ,UAAU,QAAQ,SAAS,MAAM;AAClD;AAkBO,SAAS,uBAAuB,KAA2C;AAChF,SAAO,QAAQ,UAAU,QAAQ,UAAU,QAAQ,YAAY,MAAM;AACvE;AAQO,SAAS,OAAO,KAAkE;AACvF,QAAM,IAAI,IAAI;AACd,QAAM,OAAO,OAAO,EAAE,MAAM,KAAK,EAAE;AACnC,QAAM,cACH,EAAE,cAAc,KAA4E,CAAC;AAChG,QAAM,SAAS,YAAY,CAAC,KAAK;AACjC,SAAO;AAAA,IACL,IAAI,IAAI;AAAA,IACR;AAAA,IACA,KAAK,OAAO,EAAE,KAAK,KAAK,EAAE;AAAA,IAC1B,QAAS,EAAE,QAAQ,KAA4B;AAAA,IAC/C,gBAAiB,EAAE,kBAAkB,KAA4B;AAAA,IACjE,iBAAiB,YAAY,EAAE,kBAAkB,GAAG,GAAG,IAAI,cAAc;AAAA,IACzE,aAAa,YAAY,EAAE,cAAc,GAAG,GAAG,IAAI,UAAU;AAAA,IAC7D,oBAAqB,EAAE,kBAAkB,KAA4B;AAAA,IACrE,gBAAiB,EAAE,cAAc,KAA4B;AAAA,IAC7D,gBAAiB,EAAE,iBAAiB,KAA4B;AAAA,IAChE,YAAa,EAAE,aAAa,KAA4B;AAAA,IACxD,eAAgB,EAAE,iBAAiB,KAA4B;AAAA,IAC/D,aAAc,EAAE,cAAc,KAA4B;AAAA,IAC1D,uBAAwB,EAAE,yBAAyB,KAA4B;AAAA,IAC/E,qBAAsB,EAAE,wBAAwB,KAA4B;AAAA,IAC5E,SAAU,EAAE,UAAU,KAA4B;AAAA,IAClD,oBAAqB,EAAE,wBAAwB,KAA4B;AAAA,IAC3E,oBAAqB,EAAE,wBAAwB,KAA4B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAO3E,yBAAyB,MAAM,QAAQ,EAAE,2BAA2B,CAAC,IAChE,EAAE,2BAA2B,EAC3B,OAAO,CAAC,MAAmB,OAAO,MAAM,QAAQ,EAChD,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,OAAO,IACjB,OAAO,EAAE,2BAA2B,MAAM,WACvC,EAAE,2BAA2B,EAC3B,MAAM,OAAO,EACb,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,OAAO,IACjB,CAAC;AAAA,IACP,aAAa;AAAA,IACb,QAAS,EAAE,QAAQ,KAA4B;AAAA,IAC/C,QAAS,EAAE,QAAQ,KAA4B;AAAA,IAC/C,SAAU,EAAE,SAAS,KAA4B;AAAA,IACjD,UAAW,EAAE,UAAU,KAA4B;AAAA,IACnD,uBAAwB,EAAE,0BAA0B,KAA4B;AAAA,IAChF,gBAAiB,EAAE,iBAAiB,KAA4B;AAAA,IAChE,aAAc,EAAE,cAAc,KAA4B;AAAA,IAC1D,iBAAkB,EAAE,mBAAmB,KAA4B;AAAA,IACnE,cAAe,EAAE,eAAe,KAA4B;AAAA,IAC5D,mBAAoB,EAAE,qBAAqB,KAA4B;AAAA,IACvE,uBAAwB,EAAE,yBAAyB,KAA4B;AAAA,IAC/E,mBAAoB,EAAE,qBAAqB,KAA4B;AAAA,IACvE,uBAAwB,EAAE,yBAAyB,KAA4B;AAAA,IAC/E,kBAAmB,EAAE,oBAAoB,KAA4B;AAAA,IACrE,yBAA0B,EAAE,4BAA4B,KAA4B;AAAA,IACpF,qBAAsB,EAAE,wBAAwB,KAA4B;AAAA,IAC5E,oBAAoB,wBAAwB,EAAE,qBAAqB,CAAC;AAAA,IACpE,mBAAoB,EAAE,qBAAqB,KAA4B;AAAA,IACvE,iBAAkB,EAAE,mBAAmB,KAA4B;AAAA,IACnE,WAAW,WAAW,EAAE,YAAY,CAAC;AAAA,IACrC,cAAe,EAAE,eAAe,KAA4B;AAAA,IAC5D,cAAe,EAAE,gBAAgB,KAA4B;AAAA,IAC7D,cAAe,EAAE,gBAAgB,KAA4B;AAAA,IAC7D,iBAAkB,EAAE,mBAAmB,KAA4B;AAAA,IACnE,gBAAgB,UAAU,EAAE,iBAAiB,CAAC;AAAA,IAC9C,cAAc,UAAU,EAAE,eAAe,CAAC;AAAA,IAC1C,iBAAiB,UAAU,EAAE,kBAAkB,CAAC;AAAA,IAChD,yBAA0B,EAAE,4BAA4B,KAA4B;AAAA,IACpF,gBACE,OAAO,EAAE,iBAAiB,MAAM,YAAa,EAAE,iBAAiB,IAAgB;AAAA,IAClF,UAAU,OAAO,EAAE,WAAW,MAAM,YAAa,EAAE,WAAW,IAAgB;AAAA,IAC9E,SAAS,OAAO,EAAE,UAAU,MAAM,YAAa,EAAE,UAAU,IAAgB;AAAA,IAC3E,aAAa,OAAO,EAAE,cAAc,MAAM,WAAY,EAAE,cAAc,IAAe;AAAA,IACrF,kBAAmB,EAAE,oBAAoB,KAA4B;AAAA,IACrE,aAAa,UAAU,EAAE,kBAAkB,CAAC;AAAA,IAC5C,aAAa,UAAU,EAAE,kBAAkB,CAAC;AAAA,IAC5C,WAAW,WAAW,EAAE,mBAAc,CAAC;AAAA,IACvC,aAAa,WAAW,EAAE,qBAAgB,CAAC;AAAA,IAC3C,YAAY,WAAW,EAAE,oBAAe,CAAC;AAAA,IACzC,YAAa,EAAE,aAAa,KAA4B;AAAA,IACxD,mBAAmB,WAAW,EAAE,oBAAoB,CAAC;AAAA,IACrD,eAAe,mBAAmB,EAAE,gBAAgB,CAAC;AAAA,IACrD,iBAAiB,WAAW,EAAE,mBAAmB,CAAC;AAAA,IAClD,qBAAqB,WAAW,EAAE,uBAAuB,CAAC;AAAA;AAAA;AAAA,IAG1D,kBACE,OAAO,EAAE,mBAAmB,MAAM,YAAa,EAAE,mBAAmB,IAAgB;AAAA,IACtF,oBAAqB,EAAE,sBAAsB,KAA4B;AAAA,IACzE,iBAAkB,EAAE,mBAAmB,KAA4B;AAAA,IACnE,cAAe,EAAE,gBAAgB,KAA4B;AAAA,IAC7D,iBAAkB,EAAE,mBAAmB,KAA4B;AAAA,IACnE,SAAS,UAAU,EAAE,UAAU,CAAC;AAAA,IAChC,aAAc,EAAE,eAAe,KAA4B;AAAA,IAC3D,WAAW,UAAU,EAAE,aAAa,CAAC;AAAA,IACrC,kBAAmB,EAAE,qBAAqB,KAA4B;AAAA,IACtE,eAAe,uBAAuB,EAAE,gBAAgB,CAAC;AAAA,IACzD,wBAAyB,EAAE,2BAA2B,KAA4B;AAAA,IAClF,oBAAqB,EAAE,sBAAsB,KAA4B;AAAA,EAC3E;AACF;AAEA,eAAsB,aAAa,MAA2C;AAC5E,QAAM,MAAoB,CAAC;AAC3B,QAAM,KAAK,cAAc,EACtB,OAAO,EAAE,UAAU,IAAI,CAAC,EACxB,SAAS,CAAC,SAAS,kBAAkB;AACpC,eAAW,OAAO,QAAS,KAAI,KAAK,OAAO,EAAE,IAAI,IAAI,IAAI,QAAQ,IAAI,OAAO,CAAC,CAAC;AAC9E,kBAAc;AAAA,EAChB,CAAC;AACH,SAAO;AACT;AAEA,eAAsB,iBACpB,MACA,MAC4B;AAI5B,MAAI,CAAC,6BAA6B,KAAK,IAAI,EAAG,QAAO;AAOrD,QAAM,UAAU,2EAA2E,KAAK;AAAA,IAC9F;AAAA,EACF,CAAC;AACD,QAAM,OAAqB,CAAC;AAC5B,QAAM,KAAK,cAAc,EACtB,OAAO,EAAE,iBAAiB,SAAS,YAAY,EAAE,CAAC,EAClD,SAAS,CAAC,SAAS,kBAAkB;AACpC,eAAW,OAAO,QAAS,MAAK,KAAK,OAAO,EAAE,IAAI,IAAI,IAAI,QAAQ,IAAI,OAAO,CAAC,CAAC;AAC/E,kBAAc;AAAA,EAChB,CAAC;AAGH,SAAO,KAAK,KAAK,CAAC,MAAM,SAAS,EAAE,IAAI,MAAM,IAAI,KAAK;AACxD;AA6EA,SAAS,YAAY,QAA4C;AAO/D,QAAM,SAAiD;AAAA,IACrD,QAAQ,OAAO;AAAA,IACf,QAAQ,OAAO;AAAA,IACf,SAAS,OAAO;AAAA,IAChB,UAAU,OAAO;AAAA,IACjB,6BAA4B,oBAAI,KAAK,GAAE,YAAY;AAAA,EACrD;AACA,SAAO;AACT;AAEA,SAAS,WAAW,QAA8B;AAChD,SAAO,EAAE,mBAAmB,OAAO,WAAW;AAChD;AAEA,SAAS,WAAW,QAA8B;AAChD,QAAM,SAAmB;AAAA,IACvB,gBAAgB,OAAO;AAAA,IACvB,qBAAqB,OAAO;AAAA,EAC9B;AAGA,MAAI,OAAO,aAAa,MAAM;AAC5B,WAAO,eAAe,IAAI,OAAO;AAAA,EACnC;AAEA,MAAI,OAAO,kBAAkB,MAAM;AACjC,WAAO,qBAAqB,IAAI,OAAO;AAAA,EACzC;AACA,SAAO;AACT;AAGO,IAAM,gBAA0C;AAAA,EACrD,UAAU;AAAA,EACV,MAAM;AAAA,EACN,UAAU;AAAA,EACV,KAAK;AACP;AAEA,IAAM,2BAA2B;AAK1B,SAAS,0BAA0B,KAAuC;AAC/E,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO;AAC5C,QAAM,IAAI;AACV,QAAM,SAAS,OAAO,EAAE,QAAQ,MAAM,WAAY,EAAE,QAAQ,IAAe;AAC3E,QAAM,WAAW,EAAE,UAAU;AAC7B,MAAI,WAAW,KAAM,QAAO;AAC5B,MACE,aAAa,SACb,aAAa,cACb,aAAa,UACb,aAAa;AAEb,WAAO;AACT,QAAM,OAAO,MAAM,QAAQ,EAAE,MAAM,CAAC,IAC/B,EAAE,MAAM,EAAgB,OAAO,CAAC,MAAmB,OAAO,MAAM,QAAQ,IACzE,CAAC;AACL,QAAM,QACJ,EAAE,OAAO,MAAM,aAAa,EAAE,OAAO,MAAM,gBACtC,EAAE,OAAO,IACV;AACN,QAAM,eACJ,EAAE,cAAc,MAAM,YAAY,EAAE,cAAc,MAAM,eACnD,EAAE,cAAc,IACjB;AACN,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,OAAO,OAAO,EAAE,OAAO,MAAM,WAAY,EAAE,OAAO,IAAe;AAAA,IACjE;AAAA,IACA,KAAK,OAAO,EAAE,KAAK,MAAM,WAAY,EAAE,KAAK,IAAe;AAAA,IAC3D,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;AAAA,IACzB,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;AAAA,EACzC;AACF;AAcO,SAAS,6BAA6B,YAAgD;AAC3F,MAAI,CAAC,WAAY,QAAO;AACxB,QAAM,aAAa,WAAW,OAAO,CAAC,MAAM,EAAE,aAAa,cAAc,EAAE,aAAa,MAAM;AAC9F,MAAI,WAAW,WAAW,EAAG,QAAO;AACpC,SAAO,WAAW,MAAM,CAAC,MAAM,EAAE,iBAAiB,YAAY;AAChE;AAIO,SAAS,wBAAwB,KAAyC;AAC/E,MAAI,OAAO,QAAQ,YAAY,IAAI,KAAK,MAAM,GAAI,QAAO;AACzD,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,CAAC,MAAM,QAAQ,MAAM,EAAG,QAAO;AACnC,SAAO,OAAO,IAAI,yBAAyB,EAAE,OAAO,CAAC,MAA6B,MAAM,IAAI;AAC9F;AAEA,SAAS,uBAAuB,YAA0C;AACxE,QAAM,SAAS,CAAC,GAAG,UAAU,EAC1B,KAAK,CAAC,GAAG,MAAM,cAAc,EAAE,QAAQ,IAAI,cAAc,EAAE,QAAQ,CAAC,EACpE,MAAM,GAAG,wBAAwB;AAEpC,SAAO,EAAE,uBAAuB,KAAK,UAAU,MAAM,EAAE;AACzD;AAEA,SAAS,eAAe,QAAkC;AACxD,SAAO;AAAA,IACL,2BAA2B,OAAO;AAAA,IAClC,uBAAuB,OAAO;AAAA,IAC9B,2BAA2B,OAAO;AAAA,IAClC,sBAAsB,OAAO;AAAA;AAAA;AAAA,IAG7B,2BAA0B,oBAAI,KAAK,GAAE,YAAY;AAAA,EACnD;AACF;AAEA,SAAS,aAAa,QAAgC;AACpD,QAAM,SAAmB,EAAE,qBAAqB,OAAO,UAAU;AAMjE,EAAC,OAAyC,qBAAqB,IAAI,OAAO;AAC1E,SAAO;AACT;AAEA,SAAS,oBAAoB,QAAuC;AAMlE,QAAM,SAAwC;AAAA,IAC5C,iBAAiB,OAAO;AAAA,IACxB,kBAAkB,OAAO;AAAA,IACzB,kBAAkB,OAAO;AAAA,IACzB,qBAAqB,OAAO;AAAA,EAC9B;AACA,SAAO;AACT;AAEA,SAAS,cAAc,GAAiC;AACtD,SAAO;AAAA,IACL,mBAAmB,EAAE;AAAA,IACrB,aAAa,EAAE;AAAA,IACf,YAAY,EAAE;AAAA,IACd,gBAAgB,EAAE;AAAA,IAClB,sBAAsB,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA,IAKxB,oBAAoB,EAAE,cAAc,SAAS;AAAA,IAC7C,oBAAoB,EAAE,cAAc,SAAS;AAAA,EAC/C;AACF;AAEA,SAAS,qBAAqB,GAAmC;AAU/D,QAAM,SAAwC;AAAA,IAC5C,mBAAmB,EAAE;AAAA,IACrB,iBAAiB,EAAE;AAAA;AAAA;AAAA,IAGnB,oBAAoB,EAAE;AAAA,IACtB,8BAA8B,EAAE;AAAA,EAClC;AACA,SAAO;AACT;AAEA,SAAS,YAAY,GAA0B;AAI7C,SAAO,EAAE,YAAY,EAAE,IAAI,iBAAiB,EAAE,UAAU;AAC1D;AAEA,SAAS,cAAc,GAA4B;AAKjD,QAAM,SAAwC;AAAA,IAC5C,eAAe,EAAE;AAAA,IACjB,uBAAuB,EAAE;AAAA,EAC3B;AACA,SAAO;AACT;AAOA,eAAsB,aACpB,MACA,UACA,QACe;AACf,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,QAAQ,YAAY,MAAM,EAAE,CAAC,CAAC;AACnF;AASA,eAAsB,sBACpB,MACA,UACA,IACe;AACf,QAAM,SAAwC,EAAE,0BAA0B,GAAG;AAC7E,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,OAA2B,CAAC,CAAC;AAClF;AAGA,eAAsB,iBACpB,MACA,UACA,QACe;AACf,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,QAAQ,WAAW,MAAM,EAAE,CAAC,CAAC;AAClF;AAGA,eAAsB,iBACpB,MACA,UACA,QACe;AACf,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,QAAQ,WAAW,MAAM,EAAE,CAAC,CAAC;AAClF;AAGA,eAAsB,qBACpB,MACA,UACA,QACe;AACf,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,QAAQ,eAAe,MAAM,EAAE,CAAC,CAAC;AACtF;AAIA,eAAsB,sBACpB,MACA,UACA,UACe;AACf,QAAM,KAAK,cAAc,EAAE,OAAO;AAAA,IAChC,EAAE,IAAI,UAAU,QAAQ,EAAE,8BAA8B,SAAS,EAAE;AAAA,EACrE,CAAC;AACH;AAUA,eAAsB,mBACpB,MACA,UACA,OACe;AACf,QAAM,SAAwC;AAAA,IAC5C,uBAAuB,MAAM;AAAA,IAC7B,mBAAmB,MAAM;AAAA,EAC3B;AACA,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,OAA2B,CAAC,CAAC;AAClF;AAKA,eAAsB,gBACpB,MACA,UACA,QACA,OACe;AACf,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,QAAQ,EAAE,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;AACnF;AAWA,eAAsB,kBACpB,MACA,UACA,QAamB;AACnB,QAAM,SAAmB,CAAC;AAC1B,MAAI,OAAO,OAAQ,QAAO,OAAO,QAAQ,YAAY,OAAO,MAAM,CAAC;AACnE,MAAI,OAAO,KAAM,QAAO,OAAO,QAAQ,WAAW,OAAO,IAAI,CAAC;AAC9D,MAAI,OAAO,KAAM,QAAO,OAAO,QAAQ,WAAW,OAAO,IAAI,CAAC;AAC9D,MAAI,OAAO,SAAU,QAAO,OAAO,QAAQ,eAAe,OAAO,QAAQ,CAAC;AAG1E,MAAI,OAAO;AACT,WAAO,OAAO,QAAQ,uBAAuB,OAAO,kBAAkB,CAAC;AACzE,MAAI,OAAO,OAAQ,QAAO,OAAO,QAAQ,aAAa,OAAO,MAAM,CAAC;AACpE,MAAI,OAAO,QAAS,QAAO,OAAO,QAAQ,cAAc,OAAO,OAAO,CAAC;AACvE,MAAI,OAAO,cAAe,QAAO,OAAO,QAAQ,oBAAoB,OAAO,aAAa,CAAC;AACzF,MAAI,OAAO,eAAgB,QAAO,OAAO,QAAQ,qBAAqB,OAAO,cAAc,CAAC;AAC5F,MAAI,OAAO,MAAO,QAAO,OAAO,QAAQ,YAAY,OAAO,KAAK,CAAC;AACjE,MAAI,OAAO,QAAS,QAAO,OAAO,QAAQ,cAAc,OAAO,OAAO,CAAC;AACvE,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,OAAO,CAAC,CAAC;AAC5D,SAAO;AACT;AAKA,eAAsB,oBACpB,MACA,UACA,SAMe;AACf,QAAM,SAAmB;AAAA,IACvB,wBAAwB,QAAQ;AAAA,IAChC,qBAAqB,QAAQ;AAAA,IAC7B,qBAAqB,QAAQ;AAAA,EAC/B;AACA,MAAI,QAAQ,iBAAiB,MAAM;AACjC,WAAO,gBAAgB,IAAI,QAAQ;AAAA,EACrC;AACA,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,OAAO,CAAC,CAAC;AAC9D;AAmBA,IAAM,2BAA2B;AAYjC,SAAS,sBAAsB,QAAwB;AACrD,MAAI,OAAO,UAAU,yBAA0B,QAAO;AACtD,QAAM,SACJ;AAAA,mCAAiC,OAAO,MAAM,kCAC1C,wBAAwB;AAE9B,MAAI,OAAO,OAAO,MAAM,GAAG,2BAA2B,OAAO,MAAM;AACnE,QAAM,OAAO,KAAK,WAAW,KAAK,SAAS,CAAC;AAC5C,MAAI,QAAQ,SAAU,QAAQ,MAAQ,QAAO,KAAK,MAAM,GAAG,EAAE;AAC7D,SAAO,OAAO;AAChB;AAqBA,eAAsB,oBACpB,MACA,UACA,QACe;AACf,QAAM,SAAwC;AAAA,IAC5C,kBAAkB,OAAO;AAAA,IACzB,6BAA6B,OAAO;AAAA,IACpC,wBAAwB,OAAO,WAAW,OAAO,OAAO,sBAAsB,OAAO,MAAM;AAAA,EAC7F;AACA,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,OAA2B,CAAC,CAAC;AAClF;AAIA,eAAsB,eACpB,MACA,UACA,IACe;AACf,QAAM,SAAmB,EAAE,QAAQ,eAAe,eAAe,GAAG;AACpE,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,OAAO,CAAC,CAAC;AAC9D;","names":[]}

package/dist/prismic-ci-BH225Q4L.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/cli/commands/prismic-ci.ts","../src/recipes/prismic-ci/index.ts","../src/recipes/prismic-ci/template.ts"],"sourcesContent":["// The fleet face of the `prismic-ci` recipe: land the Prismic model delivery\n// workflow across the fleet, as ONE PULL REQUEST PER REPOSITORY.\n//\n// The blast radius is fifteen live client repositories, and the failure this\n// file is written against is not a bad PR — the recipe's gates handle that, and\n// nothing here can push to a client's main. It is the QUIET one: a run that\n// touched nothing and exited 0, read as a finished rollout. Three facts only the\n// fleet layer can get wrong produce it, and each has a refusal below:\n//\n//   - an inventory that resolved NOBODY prints \"0 applied, 0 noop, 0 failed.\"\n//     and exits 0, which is indistinguishable from a fleet with nothing left to\n//     do. The Airtable inventory is view-filtered; one filter change empties it\n//     with no error anywhere.\n//   - a site that could not be PREPARED is isolated into `skipped` by\n//     `prepareFleetSites` (correctly — one bad row must not abort the fleet) and\n//     then disappears from a summary built out of `prepared` alone. It gets a\n//     `failed` ROW, because the count is the only thing a machine reads.\n//   - a checkout holding `.git` and nothing else answers \"not a Prismic site\" to\n//     every read inside it, so the site noops out of the rollout for good — a\n//     fleet workdir reuses any non-empty directory forever. Guarded BEFORE the\n//     recipe runs: a tree nobody established is not a tree to branch from.\n//\n// SEQUENTIAL, one site at a time, like every other fleet recipe command — see\n// `runRecipeOverSites`. Each site does git work in its own checkout plus a\n// handful of GitHub calls; there is no Airtable write on this path (so the\n// fleet's ≤4.5 req/s throttle does not apply) and nothing parallelism would buy\n// except a burst of writes against fifteen repositories at once.\nimport { readdir } from \"node:fs/promises\";\nimport { resolve } from \"node:path\";\nimport { prismicCi } from \"../../recipes/prismic-ci/index.js\";\nimport {\n  REUSABLE_WORKFLOW_PIN,\n  isPinResolved,\n  type ReusableWorkflowPin,\n} from \"../../recipes/prismic-ci/template.js\";\nimport type { RecipeResult, Site } from \"../../types.js\";\nimport { fleetWorkdir } from \"../../util/fleet-workdir.js\";\nimport { siteLabel } from \"../../util/site.js\";\nimport { noWorkingTreeFailure } from \"../../util/working-tree.js\";\nimport { appendSkipNotice, prepareFleetSites, type SkippedSite } from \"../fleet/prepare-sites.js\";\nimport { resolveSites } from \"../fleet/resolve-sites.js\";\nimport { runRecipeOverSites } from \"../fleet/run-recipe-over-sites.js\";\n\nexport type PrismicCiCommandOptions = {\n  fleet?: string;\n  workdir?: string;\n  dry?: boolean;\n  cwd?: string;\n};\n\n/** Injected only by tests, so the fleet layer's aggregation — counts, exit code,\n *  refusals — is exercised without git, GitHub or a network. Production runs the\n *  real recipe. */\nexport type PrismicCiCommandDeps = {\n  runRecipe?: (site: Site) => Promise<RecipeResult>;\n  /**\n   * Which `reddoorla/.github` commit this run would pin. Injected only by tests;\n   * production uses the shipped {@link REUSABLE_WORKFLOW_PIN}.\n   *\n   * It is injectable because the unresolved-pin refusal is a SAFETY behaviour\n   * that must be tested in both directions at all times, and a test that reads\n   * the shipped constant can only ever exercise whichever direction the constant\n   * currently happens to be in. Two tests here did exactly that, and the release\n   * that resolved the pin turned them from \"the refusal works\" into a red suite\n   * with the refusal itself no longer covered by anything.\n   */\n  pin?: ReusableWorkflowPin;\n};\n\nconst messageOf = (err: unknown): string => (err instanceof Error ? err.message : String(err));\n\nconst failedRow = (site: string, notes: string): RecipeResult => ({\n  recipe: \"prismic-ci\",\n  site,\n  status: \"failed\",\n  commits: [],\n  notes,\n});\n\n/**\n * One line per site plus a counts summary — the shape every fleet rollout\n * prints, so a sweep over fifteen repos is scannable.\n *\n * The banner above the counts is not decoration. A rollout in which every site\n * failed prints fifteen `[site] failed:` lines and then an arithmetic exercise;\n * the one fact an operator needs from that run — NOT ONE repository got the\n * workflow — has to be stated. It is keyed on \"sites were attempted and none was\n * applied\", not on \"nothing was applied\": a fleet that is already fully\n * delivered applies nothing every time it runs, and a banner that shouts at that\n * run is a banner nobody reads at the run above.\n */\nexport function formatPrismicCiResults(results: RecipeResult[]): string {\n  const lines = results.map((r) => `[${r.site}] ${r.status}: ${r.notes ?? \"\"}`.trimEnd());\n  const n = (s: RecipeResult[\"status\"]) => results.filter((r) => r.status === s).length;\n  const failed = n(\"failed\");\n  lines.push(\"\");\n  if (failed > 0 && n(\"applied\") === 0) {\n    lines.push(\n      `⛔ NO SITE GOT THE DELIVERY WORKFLOW. ${failed} of ${results.length} site(s) failed and` +\n        ` not one pull request was opened, so no site's model changes reach Prismic on merge.` +\n        ` Do NOT read this run as a rollout.`,\n    );\n    lines.push(\"\");\n  }\n  lines.push(`${n(\"applied\")} applied, ${n(\"noop\")} noop, ${failed} failed.`);\n  return lines.join(\"\\n\");\n}\n\n/**\n * Is there a checkout here at all, or the named reason there is not?\n *\n * Runs BEFORE the recipe, for both the reason in {@link noWorkingTreeFailure}\n * and one this command adds: the recipe's next steps create a branch, write a\n * file and commit it. A directory nobody managed to check out is not a tree to\n * do that in, and the answer the recipe would otherwise reach — \"not a Prismic\n * site\" — is the one answer that quietly removes the site from the rollout.\n *\n * A `readdir` that THROWS is its own failure and never the skip: a path that\n * does not exist, or one this process cannot read, is not a repo without\n * Prismic in it.\n */\nasync function checkoutFailure(repoRoot: string): Promise<string | null> {\n  let entries: string[];\n  try {\n    entries = await readdir(repoRoot);\n  } catch (e) {\n    return `cannot read this checkout at ${repoRoot}: ${messageOf(e)}`;\n  }\n  return noWorkingTreeFailure(\n    repoRoot,\n    entries,\n    \"No delivery workflow was proposed for it and no pull request was opened\",\n  );\n}\n\n/**\n * Roll the delivery workflow out to one site or to the fleet.\n *\n * `resolveSites` is allowed to THROW (a positional site alongside `--fleet`, an\n * unsupported inventory extension, an Airtable read that failed). Those are \"the\n * fleet itself could not be established\", which has no per-site row to live in\n * and must not be reported as a rollout across zero sites; `bin.ts` prints the\n * message and exits with the error's own `exitCode`.\n */\nexport async function runPrismicCiCommand(\n  site: string | undefined,\n  opts: PrismicCiCommandOptions,\n  deps: PrismicCiCommandDeps = {},\n): Promise<{ output: string; code: number }> {\n  const cwd = opts.cwd ? resolve(opts.cwd) : process.cwd();\n  let sites = await resolveSites({\n    ...(site !== undefined ? { site } : {}),\n    ...(opts.fleet !== undefined ? { fleet: opts.fleet } : {}),\n    // Passed through because `--fleet airtable` derives each site's path from\n    // it; without it the keyword inventory would resolve paths under a different\n    // workdir than the one this run then prepares and commits in.\n    ...(opts.workdir !== undefined ? { workdir: opts.workdir } : {}),\n    cwd,\n  });\n\n  // NOTHING RESOLVED IS NOT A DELIVERED FLEET — the refusal `runFleetSweep` and\n  // the token doctor both open with, for the same reason: the summary below\n  // would print \"0 applied, 0 noop, 0 failed.\" over no rows at all and exit 0,\n  // which is exactly what a finished rollout looks like.\n  if (sites.length === 0) {\n    return {\n      output:\n        `the inventory resolved NO SITES, so no site was offered the delivery workflow.` +\n        ` This is not a delivered fleet — check the inventory (an Airtable view filter, an` +\n        ` empty JSON file, a dynamic inventory returning []). Do NOT read this exit as a` +\n        ` rollout.`,\n      code: 1,\n    };\n  }\n\n  let skipped: SkippedSite[] = [];\n  if (opts.fleet) {\n    const prep = await prepareFleetSites(sites, { workdir: opts.workdir ?? fleetWorkdir() });\n    sites = prep.prepared;\n    skipped = prep.skipped;\n  }\n\n  // THE PIN, checked here as well as in the recipe — not a second copy of the\n  // gate but the same exported predicate on the same pin, asked at the one point\n  // the recipe cannot answer for: a `--dry` run never reaches the recipe at all,\n  // and a preview that promised fifteen pull requests the real run would refuse\n  // is a preview of something that cannot happen.\n  //\n  // ONE pin object serves both this preview and the recipe below, so the preview\n  // can never be answering about a different pin than the run it previews.\n  const pin = deps.pin ?? REUSABLE_WORKFLOW_PIN;\n  const pinUnresolved = !isPinResolved(pin)\n    ? `⛔ the reusable-workflow pin is unresolved (${pin.sha}) — every site` +\n      ` below would be REFUSED, not delivered. Publish and tag the workflow in` +\n      ` reddoorla/.github, then set REUSABLE_WORKFLOW_PIN.`\n    : \"\";\n\n  if (opts.dry) {\n    const lines = sites.map(\n      (s) =>\n        `[${siteLabel(s)}] would be offered the delivery workflow (no gate was evaluated:` +\n        ` the secret, default-branch and already-delivered checks run only on a real run)`,\n    );\n    return {\n      output: appendSkipNotice(\n        [pinUnresolved, lines.join(\"\\n\")].filter((s) => s !== \"\").join(\"\\n\\n\"),\n        skipped,\n      ),\n      code: pinUnresolved === \"\" ? 0 : 1,\n    };\n  }\n\n  const run = deps.runRecipe ?? ((s: Site) => prismicCi(s, { pin }));\n  const results = await runRecipeOverSites(\"prismic-ci\", sites, async (s) => {\n    const failure = await checkoutFailure(s.path);\n    return failure ? failedRow(siteLabel(s), failure) : run(s);\n  });\n\n  // A SITE THAT COULD NOT BE PREPARED IS A SITE THAT DID NOT GET THE WORKFLOW,\n  // and it gets a row. `prepareFleetSites` isolates the clone failure into\n  // `skipped`, which is right and is also exactly how a site disappears: a\n  // summary walking `prepared` alone counts a fleet-wide clone outage — an\n  // expired App token, GitHub down, a full disk — as \"0 applied, 0 failed\",\n  // exit 0. The notice below stays; the row is what makes the site countable.\n  for (const s of skipped) {\n    results.push(\n      failedRow(\n        s.site,\n        `could not prepare this checkout: ${s.reason}. No delivery workflow was proposed` +\n          ` for it — this is NOT \"this site already has one\".`,\n      ),\n    );\n  }\n\n  return {\n    output: appendSkipNotice(formatPrismicCiResults(results), skipped),\n    code: results.some((r) => r.status === \"failed\") ? 1 : 0,\n  };\n}\n","import { mkdir, readFile, writeFile } from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\nimport { defaultSpawn, type SpawnFn } from \"../../audits/util/spawn.js\";\nimport { readGitHubConfig } from \"../../github/config.js\";\nimport { makeGitHub, type GitHub } from \"../../github/gh.js\";\nimport { readPrismicConfig } from \"../../prismic/models/index.js\";\nimport type { RecipeResult, Site } from \"../../types.js\";\nimport {\n  branchName,\n  checkoutBranch,\n  commit as gitCommit,\n  createBranch,\n  currentBranch,\n  deleteBranch,\n  isOwnerRepo,\n  isWorkingTreeClean,\n  push as gitPush,\n} from \"../../util/git.js\";\nimport { siteLabel } from \"../../util/site.js\";\nimport { formatWithPrettier, resolveTargetPrettier, PRETTIER_FLAG_NOTE } from \"../_prettier.js\";\nimport {\n  APPLY_BRANCH,\n  PRISMIC_CI_WORKFLOW,\n  REUSABLE_WORKFLOW_PIN,\n  SECRET,\n  WORKFLOW_PATH,\n  isPinResolved,\n  prismicCiWorkflow,\n  type ReusableWorkflowPin,\n} from \"./template.js\";\n\n/** Head-branch prefix of every PR this recipe opens. `branchName(\"prismic-ci\")`\n *  produces `maint/prismic-ci-<timestamp>`, and the re-run guard matches on this\n *  prefix — the same idiom as `findOpenSelfUpdatingPR`. */\nconst BRANCH_PREFIX = \"maint/prismic-ci-\";\n\n/** How long the target's prettier gets. Also what makes the fleet's default\n *  spawn detach the child, so the kill reaches prettier and not just a wrapper.\n *  Matches the pull-down path's budget in `src/prismic/models/write.ts`. */\nconst PRETTIER_TIMEOUT_MS = 60_000;\n\n/** Just the GitHub surface this recipe touches, so a test fake is five methods\n *  rather than thirty. `makeGitHub()` satisfies it structurally. */\nexport type PrismicCiGitHub = Pick<\n  GitHub,\n  \"defaultBranch\" | \"secretExists\" | \"fileContentsOnBranch\" | \"openPullRequest\" | \"openPullRequests\"\n>;\n\nexport type PrismicCiDeps = {\n  github?: PrismicCiGitHub;\n  pushBranch?: (cwd: string, branch: string) => Promise<void>;\n  spawn?: SpawnFn;\n  /** Resolve the TARGET repo's own prettier. Injected so a test can assert the\n   *  absolute-path spawn without a populated `node_modules`. */\n  resolvePrettier?: (repoRoot: string) => Promise<string | null>;\n  /** Which `reddoorla/.github` commit the written workflow pins. Injected only\n   *  by tests; production uses the shipped pin. */\n  pin?: ReusableWorkflowPin;\n};\n\nconst resultOf = (\n  site: Site,\n  status: RecipeResult[\"status\"],\n  notes: string,\n  commits: string[] = [],\n): RecipeResult => ({\n  recipe: \"prismic-ci\",\n  site: siteLabel(site),\n  status,\n  commits,\n  notes,\n});\n\nconst messageOf = (err: unknown): string => (err instanceof Error ? err.message : String(err));\n\n/** Same normalization as `self-updating`'s config comparison: CRLF and a stray\n *  trailing newline are not drift, and treating them as drift opens a needless\n *  PR on every run. Any real content difference still differs. */\nfunction sameWorkflow(current: string, canonical: string): boolean {\n  const norm = (s: string) => s.replace(/\\r\\n/g, \"\\n\").replace(/\\s+$/, \"\");\n  return norm(current) === norm(canonical);\n}\n\n/**\n * Land the Prismic model delivery workflow in one repo, as a pull request.\n *\n * Everything before the first mutation is a gate, and the gates exist because\n * this recipe's output is the only path in the project that writes to a live\n * client's Prismic repository. Two of them are worth naming:\n *\n *  - THE SECRET. A workflow whose `PRISMIC_WRITE_TOKEN` does not exist yet goes\n *    red on the repo's first model PR. Landing 15 of those turns a rollout into\n *    15 red repos, so a definitively-absent secret FAILS the site rather than\n *    nooping it: \"this site was skipped and a human must act\" is not the same\n *    report as \"this site was already done\", and a rollout summary where those\n *    two look alike is how a site silently never gets model delivery. A secret\n *    whose existence could not be DETERMINED fails too, with different wording —\n *    they are different facts and the operator's next move differs.\n *\n *  - THE DEFAULT BRANCH. The reusable workflow's apply job hard-codes\n *    `refs/heads/main`. On a repo whose default branch is anything else, every\n *    model PR would merge green and never reach Prismic. Refuse instead.\n *\n * Nothing here can delete a model: the workflow it installs calls a module that\n * exports no delete path.\n */\nexport async function prismicCi(site: Site, deps: PrismicCiDeps = {}): Promise<RecipeResult> {\n  // 1. Repo identity. `failed`, not `noop`: a rollout that silently skips a site\n  //    is the failure this whole recipe is guarding against one level up. The\n  //    strict shape check runs BEFORE the first `gh` call, so a typo'd or\n  //    attacker-controlled value can never be interpolated into an API path.\n  const repo = site.gitRepo;\n  if (!repo) {\n    return resultOf(site, \"failed\", \"no Git repo on this site (set Airtable 'Git repo')\");\n  }\n  if (!isOwnerRepo(repo)) {\n    return resultOf(\n      site,\n      \"failed\",\n      `refusing to act on malformed repo identity: expected \"owner/repo\", got ${JSON.stringify(repo)}`,\n    );\n  }\n\n  // 2. Is this a Prismic site? `readPrismicConfig` returns null for \"no Prismic\n  //    here\" and THROWS for a present-but-unreadable config — the distinction is\n  //    the point, so the throw becomes `failed` rather than being caught into\n  //    the skip branch.\n  let isPrismic: boolean;\n  try {\n    isPrismic = (await readPrismicConfig(site.path)) !== null;\n  } catch (err) {\n    return resultOf(site, \"failed\", `could not read the Prismic config: ${messageOf(err)}`);\n  }\n  if (!isPrismic) return resultOf(site, \"noop\", \"not a Prismic site (no repositoryName) — skipped\");\n\n  // 3. The pin. Checked before any network call: while it is unresolved NOTHING\n  //    can roll out, and 15 pointless API round-trips are not worth spending to\n  //    find that out per site.\n  const pin = deps.pin ?? REUSABLE_WORKFLOW_PIN;\n  if (!isPinResolved(pin)) {\n    return resultOf(\n      site,\n      \"failed\",\n      `reusable-workflow pin is unresolved (${pin.sha}) — publish + tag the workflow in ` +\n        `reddoorla/.github and set REUSABLE_WORKFLOW_PIN before rolling out`,\n    );\n  }\n  const workflow = pin === REUSABLE_WORKFLOW_PIN ? PRISMIC_CI_WORKFLOW : prismicCiWorkflow(pin);\n\n  const ghConfig = readGitHubConfig();\n  if (!deps.github && !ghConfig) return resultOf(site, \"failed\", \"GITHUB_TOKEN not set\");\n  const gh = deps.github ?? makeGitHub({ token: ghConfig!.token });\n  const spawn = deps.spawn ?? defaultSpawn;\n\n  // 4. The secret. Absent and unreadable are separate answers with separate\n  //    wording; neither proceeds.\n  let hasSecret: boolean;\n  try {\n    hasSecret = await gh.secretExists(repo, SECRET);\n  } catch (err) {\n    return resultOf(\n      site,\n      \"failed\",\n      `could not determine whether ${repo} has the ${SECRET} secret (${messageOf(err)}) — ` +\n        `refusing to install a workflow that may have no token`,\n    );\n  }\n  if (!hasSecret) {\n    return resultOf(\n      site,\n      \"failed\",\n      `${repo} has no ${SECRET} Actions secret — the workflow reds the repo on its first ` +\n        `model PR without it. Mint one, then: gh secret set ${SECRET} --repo ${repo}`,\n    );\n  }\n\n  // 5. The default branch. NOT `.catch(() => \"main\")`: \"I could not read the\n  //    default branch\" and \"the default branch is main\" are opposite facts, and\n  //    guessing the second targets a PR (and an apply gate) at a branch nobody\n  //    confirmed.\n  let base: string;\n  try {\n    base = await gh.defaultBranch(repo);\n  } catch (err) {\n    return resultOf(\n      site,\n      \"failed\",\n      `could not read the default branch of ${repo}: ${messageOf(err)}`,\n    );\n  }\n  if (base !== APPLY_BRANCH) {\n    return resultOf(\n      site,\n      \"failed\",\n      `default branch of ${repo} is ${base}, not ${APPLY_BRANCH} — the reusable workflow's ` +\n        `apply job guards refs/heads/${APPLY_BRANCH}, so merged model changes would never reach Prismic`,\n    );\n  }\n\n  // 6. Already delivered? Content-compared, not existence-compared, so a\n  //    present-but-STALE workflow (an older pin) is corrected rather than left\n  //    forever.\n  const existing = await gh.fileContentsOnBranch(repo, base, WORKFLOW_PATH);\n  if (existing !== null && sameWorkflow(existing, workflow)) {\n    return resultOf(site, \"noop\", `delivery workflow already current on ${base}`);\n  }\n\n  // 7. Already proposed? Without this, every run before the PR merges opens\n  //    another one. `fileContentsOnBranch` also answers null for a read it could\n  //    not perform (gh exits non-zero on both a 404 and an auth failure), which\n  //    makes this the backstop for that collapse as well.\n  const open = (await gh.openPullRequests(repo)).find((pr) => pr.headRef.startsWith(BRANCH_PREFIX));\n  if (open) {\n    return resultOf(site, \"noop\", `delivery workflow PR already open: ${open.url}`);\n  }\n\n  if (!(await isWorkingTreeClean(site.path))) {\n    return resultOf(site, \"failed\", \"working tree not clean — commit or stash first\");\n  }\n\n  // Capture the operator's branch BEFORE creating ours so the `finally` can put\n  // them back. Best-effort: if we cannot read it we skip the restore rather than\n  // guess at a branch to check out.\n  let original: string | null = null;\n  try {\n    original = await currentBranch(site.path);\n  } catch {\n    // Stays null (detached HEAD, git error) — the restore below is then skipped\n    // rather than aiming a checkout at a branch name we had to invent.\n  }\n  const branch = branchName(\"prismic-ci\");\n  const commits: string[] = [];\n  let pushedOrOpened = false;\n\n  try {\n    await createBranch(site.path, branch);\n    const dest = join(site.path, WORKFLOW_PATH);\n    await mkdir(dirname(dest), { recursive: true });\n    await writeFile(dest, workflow, \"utf-8\");\n\n    // Format with the SITE's own prettier, resolved POSITIVELY and run by\n    // absolute path. `pnpm exec prettier` here would run a full `pnpm install`\n    // in the client's repo first (an unrequested mutation of a live client repo\n    // by a rollout that is supposed to add one file), and in a repo without\n    // prettier would then format with the CALLING repo's binary and exit 0.\n    const notes: string[] = [];\n    const bin = await (deps.resolvePrettier ?? resolveTargetPrettier)(site.path);\n    if (bin === null) {\n      notes.push(PRETTIER_FLAG_NOTE);\n    } else if (\n      !(await formatWithPrettier(spawn, site.path, [WORKFLOW_PATH], {\n        bin,\n        timeoutMs: PRETTIER_TIMEOUT_MS,\n      }))\n    ) {\n      notes.push(PRETTIER_FLAG_NOTE);\n    } else if (!sameWorkflow(await readFile(dest, \"utf-8\"), workflow)) {\n      // The site's prettier config disagrees with the template's shape (single\n      // quotes, a different tab width). Harmless for the workflow — but the\n      // step-6 comparison is byte-based, so this site will not recognise its own\n      // delivered workflow as current and will propose it again after each\n      // merge. Say so rather than let it be discovered as a mystery PR.\n      notes.push(\n        \"this site's prettier reformatted the workflow — re-runs will not match it as current\",\n      );\n    }\n\n    const sha = await gitCommit(site.path, \"ci: deliver Prismic model changes from merged PRs\");\n    if (!sha) {\n      // Git saw no change: the checkout already holds this exact workflow even\n      // though the default branch does not. Nothing to push and nothing to\n      // review — and pushing a commit-less branch would fail at PR creation.\n      return resultOf(\n        site,\n        \"noop\",\n        `${WORKFLOW_PATH} already present and identical in the checkout`,\n      );\n    }\n    commits.push(sha);\n    pushedOrOpened = true;\n    await (deps.pushBranch ?? gitPush)(site.path, branch);\n    const pr = await gh.openPullRequest(repo, {\n      head: branch,\n      base,\n      title: \"Deliver Prismic model changes from merged PRs\",\n      body:\n        \"Adds the `prismic-models` workflow. On a PR touching `customtypes/**` or \" +\n        \"`src/lib/slices/**/model.json` it comments the model delta and writes nothing; \" +\n        \"on merge to main it pushes those models to Prismic. It can create and update \" +\n        \"models but never delete — a model present only in Prismic is reported, not touched.\",\n    });\n    notes.unshift(`opened PR ${pr.url}`);\n    return resultOf(site, \"applied\", notes.join(\"; \"), commits);\n  } catch (err) {\n    return resultOf(site, \"failed\", messageOf(err), commits);\n  } finally {\n    // Restore the operator's branch on success AND on failure — otherwise a push\n    // error strands the checkout on the recipe branch with an unpushed commit,\n    // and the retry dies at createBranch. Best-effort; never masks the result.\n    if (original !== null && original !== branch) {\n      try {\n        await checkoutBranch(site.path, original);\n        // Nothing was pushed and no PR exists, so the local branch is litter and\n        // a re-run would leave another. Only ever the branch WE created.\n        if (!pushedOrOpened) await deleteBranch(site.path, branch);\n      } catch (err) {\n        console.warn(\n          `warning: could not restore branch ${original} after prismic-ci: ${messageOf(err)}`,\n        );\n      }\n    }\n  }\n}\n","/**\n * The caller workflow every Prismic site gets.\n *\n * Fully generic — no per-site values — because the token is the site's own\n * `PRISMIC_WRITE_TOKEN` secret, the name every site's code already reads.\n * Contrast `ci.yml`, which is deliberately NOT templated anywhere in this\n * package because it carries per-site `netlify-site:` / `node-version:` values\n * a byte template would strip fleet-wide.\n */\n\n/** Where the file lands in a site repo. Also the `gh api .../contents/<path>`\n *  segment, so it must stay traversal-free (`assertUrlSegment` re-checks). */\nexport const WORKFLOW_PATH = \".github/workflows/prismic-models.yml\";\n\n/** The Actions secret the reusable workflow declares as `required: true`, and\n *  the environment variable the CLI reads. Spelled ONCE, here, because the\n *  failure mode of a second spelling is silent: a caller passing a name the\n *  callee never declared supplies nothing, and the callee's required secret\n *  arrives empty at the one step that writes to a live client's Prismic repo. */\nexport const SECRET = \"PRISMIC_WRITE_TOKEN\";\n\n/** The reusable workflow, without a ref. */\nexport const REUSABLE_WORKFLOW = \"reddoorla/.github/.github/workflows/prismic-models.yml\";\n\n/**\n * The ONE branch this delivery path can run its apply job on.\n *\n * Not a preference — the reusable workflow's apply job hard-codes\n * `github.ref == 'refs/heads/main'`. On a repo whose default branch is anything\n * else, a merged model PR would produce a green check and never reach Prismic,\n * which is why the recipe refuses such a repo instead of installing a workflow\n * that silently cannot fire.\n */\nexport const APPLY_BRANCH = \"main\";\n\n/** A commit in `reddoorla/.github`, plus the release tag that commit carries.\n *  Both are written into the workflow: the SHA is what Actions resolves, the tag\n *  is what a human (and Renovate's github-actions manager) reads. */\nexport type ReusableWorkflowPin = { sha: string; tag: string };\n\n/**\n * What the shipped pin says while the reusable workflow has not been published\n * to `reddoorla/.github` and tagged yet (plan Task 25).\n *\n * DELIBERATELY NOT 40 HEX CHARACTERS. A placeholder shaped like a real SHA is\n * indistinguishable from a real one in review, and would install a workflow\n * referencing a commit that does not exist into 15 client repositories — where\n * it fails at workflow-load time, on every model PR, with an error that names\n * neither this file nor the reason. Unresolved must be unmistakable, and\n * {@link isPinResolved} is what the recipe gates on.\n */\nexport const UNRESOLVED_PIN_SHA = \"UNRESOLVED-publish-and-tag-reddoorla-dot-github-first\";\n\n/**\n * The pin the fleet rolls out.\n *\n * RESOLVED 2026-08-14. `reddoorla/.github#30` merged as\n * 558395431ddcb481ecba3dd84b78b38c338cfa03 and that commit was tagged v1.4.0;\n * `gh api repos/reddoorla/.github/commits/v1.4.0 --jq .sha` returns the SHA\n * below. `validate` (the digest-pinning + Renovate-preset check that is the\n * only CI in that repo) passed on the merge commit.\n *\n * TO RE-RESOLVE after a future `reddoorla/.github` release: set `sha` to\n * `gh api repos/reddoorla/.github/commits/<tag> --jq .sha` and `tag` to that\n * tag. Nothing else changes. Renovate's github-actions manager bumps the\n * already-installed `uses:` line per site repo; this constant is what NEW\n * rollouts install, so a stale value here is not a broken fleet, only a fleet\n * whose newest members start one version behind.\n */\nexport const REUSABLE_WORKFLOW_PIN: ReusableWorkflowPin = {\n  sha: \"558395431ddcb481ecba3dd84b78b38c338cfa03\",\n  tag: \"v1.4.0\",\n};\n\n/**\n * Is this pin a real commit reference?\n *\n * A full 40-hex SHA and nothing else. Not a tag, not a branch: this repo pins\n * every `uses:` to a commit (see `src/recipes/sync-configs/templates.ts`, whose\n * renovate template spells out why — a retagged `@v3` runs attacker code with\n * whatever token the workflow holds), and Renovate's github-actions manager\n * bumps the pin per repo when `reddoorla/.github` tags a new version.\n */\nexport function isPinResolved(pin: ReusableWorkflowPin): boolean {\n  return /^[0-9a-f]{40}$/.test(pin.sha);\n}\n\n/**\n * Render the caller workflow for a pin.\n *\n * Path-filtered on both triggers: this must not run on every commit, only when\n * a model changes.\n */\nexport function prismicCiWorkflow(pin: ReusableWorkflowPin): string {\n  return `# Delivers this site's Prismic model changes. Managed by @reddoorla/maintenance\n# (\\`reddoor-maint prismic-ci\\`) — change it there and re-run, not here.\n#\n# On a PR touching a model: comment the delta, write nothing.\n# On merge to ${APPLY_BRANCH}: push those models to Prismic. Never delete.\n#\n# THE BRANCH FILTER ON \\`push:\\` IS LOAD-BEARING, not tidiness. The reusable\n# workflow's apply job also guards \\`github.ref == 'refs/heads/${APPLY_BRANCH}'\\`,\n# and its comment calls this the other half of that gate: an unfiltered\n# \\`on: push:\\` fires on every branch AND every tag, so a feature branch's models\n# would reach production with no pull request and therefore no review anywhere in\n# the sequence. Keep both halves.\nname: prismic-models\n\non:\n  # No branch filter here, deliberately: a model PR into any base deserves its\n  # delta comment, and the dry job is INCAPABLE of writing — it never passes\n  # \\`--apply\\`, and it holds no job that does.\n  pull_request:\n    paths:\n      - \"customtypes/**\"\n      - \"src/lib/slices/**/model.json\"\n  push:\n    branches: [${APPLY_BRANCH}]\n    paths:\n      - \"customtypes/**\"\n      - \"src/lib/slices/**/model.json\"\n\njobs:\n  prismic-models:\n    # A called workflow's jobs can only NARROW what the caller granted, so the\n    # PR-comment permission has to be granted here as well as there. Nothing in\n    # either job pushes code, so \\`contents\\` stays read.\n    permissions:\n      contents: read\n      pull-requests: write\n    uses: ${REUSABLE_WORKFLOW}@${pin.sha} # ${pin.tag}\n    secrets:\n      # Spelled exactly as the reusable workflow declares it. A workflow-local\n      # alias would not be a rename — it would be an undeclared secret, and the\n      # required one would arrive empty.\n      ${SECRET}: \\${{ secrets.${SECRET} }}\n`;\n}\n\n/** The workflow as currently shipped. Unusable — and refused by the recipe —\n *  until {@link REUSABLE_WORKFLOW_PIN} is resolved. */\nexport const PRISMIC_CI_WORKFLOW = prismicCiWorkflow(REUSABLE_WORKFLOW_PIN);\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BA,SAAS,eAAe;AACxB,SAAS,eAAe;;;AC5BxB,SAAS,OAAO,UAAU,iBAAiB;AAC3C,SAAS,SAAS,YAAY;;;ACWvB,IAAM,gBAAgB;AAOtB,IAAM,SAAS;AAGf,IAAM,oBAAoB;AAW1B,IAAM,eAAe;AAoCrB,IAAM,wBAA6C;AAAA,EACxD,KAAK;AAAA,EACL,KAAK;AACP;AAWO,SAAS,cAAc,KAAmC;AAC/D,SAAO,iBAAiB,KAAK,IAAI,GAAG;AACtC;AAQO,SAAS,kBAAkB,KAAkC;AAClE,SAAO;AAAA;AAAA;AAAA;AAAA,gBAIO,YAAY;AAAA;AAAA;AAAA,iEAGqC,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iBAgB5D,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YAajB,iBAAiB,IAAI,IAAI,GAAG,MAAM,IAAI,GAAG;AAAA;AAAA;AAAA;AAAA;AAAA,QAK7C,MAAM,kBAAkB,MAAM;AAAA;AAEtC;AAIO,IAAM,sBAAsB,kBAAkB,qBAAqB;;;AD3G1E,IAAM,gBAAgB;AAKtB,IAAM,sBAAsB;AAqB5B,IAAM,WAAW,CACf,MACA,QACA,OACA,UAAoB,CAAC,OACH;AAAA,EAClB,QAAQ;AAAA,EACR,MAAM,UAAU,IAAI;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,YAAY,CAAC,QAA0B,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAK5F,SAAS,aAAa,SAAiB,WAA4B;AACjE,QAAM,OAAO,CAAC,MAAc,EAAE,QAAQ,SAAS,IAAI,EAAE,QAAQ,QAAQ,EAAE;AACvE,SAAO,KAAK,OAAO,MAAM,KAAK,SAAS;AACzC;AAyBA,eAAsB,UAAU,MAAY,OAAsB,CAAC,GAA0B;AAK3F,QAAM,OAAO,KAAK;AAClB,MAAI,CAAC,MAAM;AACT,WAAO,SAAS,MAAM,UAAU,oDAAoD;AAAA,EACtF;AACA,MAAI,CAAC,YAAY,IAAI,GAAG;AACtB,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,0EAA0E,KAAK,UAAU,IAAI,CAAC;AAAA,IAChG;AAAA,EACF;AAMA,MAAI;AACJ,MAAI;AACF,gBAAa,MAAM,kBAAkB,KAAK,IAAI,MAAO;AAAA,EACvD,SAAS,KAAK;AACZ,WAAO,SAAS,MAAM,UAAU,sCAAsC,UAAU,GAAG,CAAC,EAAE;AAAA,EACxF;AACA,MAAI,CAAC,UAAW,QAAO,SAAS,MAAM,QAAQ,uDAAkD;AAKhG,QAAM,MAAM,KAAK,OAAO;AACxB,MAAI,CAAC,cAAc,GAAG,GAAG;AACvB,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,wCAAwC,IAAI,GAAG;AAAA,IAEjD;AAAA,EACF;AACA,QAAM,WAAW,QAAQ,wBAAwB,sBAAsB,kBAAkB,GAAG;AAE5F,QAAM,WAAW,iBAAiB;AAClC,MAAI,CAAC,KAAK,UAAU,CAAC,SAAU,QAAO,SAAS,MAAM,UAAU,sBAAsB;AACrF,QAAM,KAAK,KAAK,UAAU,WAAW,EAAE,OAAO,SAAU,MAAM,CAAC;AAC/D,QAAM,QAAQ,KAAK,SAAS;AAI5B,MAAI;AACJ,MAAI;AACF,gBAAY,MAAM,GAAG,aAAa,MAAM,MAAM;AAAA,EAChD,SAAS,KAAK;AACZ,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,+BAA+B,IAAI,YAAY,MAAM,YAAY,UAAU,GAAG,CAAC;AAAA,IAEjF;AAAA,EACF;AACA,MAAI,CAAC,WAAW;AACd,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,GAAG,IAAI,WAAW,MAAM,qHACgC,MAAM,WAAW,IAAI;AAAA,IAC/E;AAAA,EACF;AAMA,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,GAAG,cAAc,IAAI;AAAA,EACpC,SAAS,KAAK;AACZ,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,wCAAwC,IAAI,KAAK,UAAU,GAAG,CAAC;AAAA,IACjE;AAAA,EACF;AACA,MAAI,SAAS,cAAc;AACzB,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,qBAAqB,IAAI,OAAO,IAAI,SAAS,YAAY,+DACxB,YAAY;AAAA,IAC/C;AAAA,EACF;AAKA,QAAM,WAAW,MAAM,GAAG,qBAAqB,MAAM,MAAM,aAAa;AACxE,MAAI,aAAa,QAAQ,aAAa,UAAU,QAAQ,GAAG;AACzD,WAAO,SAAS,MAAM,QAAQ,wCAAwC,IAAI,EAAE;AAAA,EAC9E;AAMA,QAAM,QAAQ,MAAM,GAAG,iBAAiB,IAAI,GAAG,KAAK,CAAC,OAAO,GAAG,QAAQ,WAAW,aAAa,CAAC;AAChG,MAAI,MAAM;AACR,WAAO,SAAS,MAAM,QAAQ,sCAAsC,KAAK,GAAG,EAAE;AAAA,EAChF;AAEA,MAAI,CAAE,MAAM,mBAAmB,KAAK,IAAI,GAAI;AAC1C,WAAO,SAAS,MAAM,UAAU,qDAAgD;AAAA,EAClF;AAKA,MAAI,WAA0B;AAC9B,MAAI;AACF,eAAW,MAAM,cAAc,KAAK,IAAI;AAAA,EAC1C,QAAQ;AAAA,EAGR;AACA,QAAM,SAAS,WAAW,YAAY;AACtC,QAAM,UAAoB,CAAC;AAC3B,MAAI,iBAAiB;AAErB,MAAI;AACF,UAAM,aAAa,KAAK,MAAM,MAAM;AACpC,UAAM,OAAO,KAAK,KAAK,MAAM,aAAa;AAC1C,UAAM,MAAM,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AAC9C,UAAM,UAAU,MAAM,UAAU,OAAO;AAOvC,UAAM,QAAkB,CAAC;AACzB,UAAM,MAAM,OAAO,KAAK,mBAAmB,uBAAuB,KAAK,IAAI;AAC3E,QAAI,QAAQ,MAAM;AAChB,YAAM,KAAK,kBAAkB;AAAA,IAC/B,WACE,CAAE,MAAM,mBAAmB,OAAO,KAAK,MAAM,CAAC,aAAa,GAAG;AAAA,MAC5D;AAAA,MACA,WAAW;AAAA,IACb,CAAC,GACD;AACA,YAAM,KAAK,kBAAkB;AAAA,IAC/B,WAAW,CAAC,aAAa,MAAM,SAAS,MAAM,OAAO,GAAG,QAAQ,GAAG;AAMjE,YAAM;AAAA,QACJ;AAAA,MACF;AAAA,IACF;AAEA,UAAM,MAAM,MAAM,OAAU,KAAK,MAAM,mDAAmD;AAC1F,QAAI,CAAC,KAAK;AAIR,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA,GAAG,aAAa;AAAA,MAClB;AAAA,IACF;AACA,YAAQ,KAAK,GAAG;AAChB,qBAAiB;AACjB,WAAO,KAAK,cAAc,MAAS,KAAK,MAAM,MAAM;AACpD,UAAM,KAAK,MAAM,GAAG,gBAAgB,MAAM;AAAA,MACxC,MAAM;AAAA,MACN;AAAA,MACA,OAAO;AAAA,MACP,MACE;AAAA,IAIJ,CAAC;AACD,UAAM,QAAQ,aAAa,GAAG,GAAG,EAAE;AACnC,WAAO,SAAS,MAAM,WAAW,MAAM,KAAK,IAAI,GAAG,OAAO;AAAA,EAC5D,SAAS,KAAK;AACZ,WAAO,SAAS,MAAM,UAAU,UAAU,GAAG,GAAG,OAAO;AAAA,EACzD,UAAE;AAIA,QAAI,aAAa,QAAQ,aAAa,QAAQ;AAC5C,UAAI;AACF,cAAM,eAAe,KAAK,MAAM,QAAQ;AAGxC,YAAI,CAAC,eAAgB,OAAM,aAAa,KAAK,MAAM,MAAM;AAAA,MAC3D,SAAS,KAAK;AACZ,gBAAQ;AAAA,UACN,qCAAqC,QAAQ,sBAAsB,UAAU,GAAG,CAAC;AAAA,QACnF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;;;ADnPA,IAAMA,aAAY,CAAC,QAA0B,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAE5F,IAAM,YAAY,CAAC,MAAc,WAAiC;AAAA,EAChE,QAAQ;AAAA,EACR;AAAA,EACA,QAAQ;AAAA,EACR,SAAS,CAAC;AAAA,EACV;AACF;AAcO,SAAS,uBAAuB,SAAiC;AACtE,QAAM,QAAQ,QAAQ,IAAI,CAAC,MAAM,IAAI,EAAE,IAAI,KAAK,EAAE,MAAM,KAAK,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC;AACtF,QAAM,IAAI,CAAC,MAA8B,QAAQ,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE;AAC/E,QAAM,SAAS,EAAE,QAAQ;AACzB,QAAM,KAAK,EAAE;AACb,MAAI,SAAS,KAAK,EAAE,SAAS,MAAM,GAAG;AACpC,UAAM;AAAA,MACJ,6CAAwC,MAAM,OAAO,QAAQ,MAAM;AAAA,IAGrE;AACA,UAAM,KAAK,EAAE;AAAA,EACf;AACA,QAAM,KAAK,GAAG,EAAE,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,UAAU,MAAM,UAAU;AAC1E,SAAO,MAAM,KAAK,IAAI;AACxB;AAeA,eAAe,gBAAgB,UAA0C;AACvE,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,QAAQ,QAAQ;AAAA,EAClC,SAAS,GAAG;AACV,WAAO,gCAAgC,QAAQ,KAAKA,WAAU,CAAC,CAAC;AAAA,EAClE;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAWA,eAAsB,oBACpB,MACA,MACA,OAA6B,CAAC,GACa;AAC3C,QAAM,MAAM,KAAK,MAAM,QAAQ,KAAK,GAAG,IAAI,QAAQ,IAAI;AACvD,MAAI,QAAQ,MAAM,aAAa;AAAA,IAC7B,GAAI,SAAS,SAAY,EAAE,KAAK,IAAI,CAAC;AAAA,IACrC,GAAI,KAAK,UAAU,SAAY,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,IAIxD,GAAI,KAAK,YAAY,SAAY,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,IAC9D;AAAA,EACF,CAAC;AAMD,MAAI,MAAM,WAAW,GAAG;AACtB,WAAO;AAAA,MACL,QACE;AAAA,MAIF,MAAM;AAAA,IACR;AAAA,EACF;AAEA,MAAI,UAAyB,CAAC;AAC9B,MAAI,KAAK,OAAO;AACd,UAAM,OAAO,MAAM,kBAAkB,OAAO,EAAE,SAAS,KAAK,WAAW,aAAa,EAAE,CAAC;AACvF,YAAQ,KAAK;AACb,cAAU,KAAK;AAAA,EACjB;AAUA,QAAM,MAAM,KAAK,OAAO;AACxB,QAAM,gBAAgB,CAAC,cAAc,GAAG,IACpC,mDAA8C,IAAI,GAAG,kJAGrD;AAEJ,MAAI,KAAK,KAAK;AACZ,UAAM,QAAQ,MAAM;AAAA,MAClB,CAAC,MACC,IAAI,UAAU,CAAC,CAAC;AAAA,IAEpB;AACA,WAAO;AAAA,MACL,QAAQ;AAAA,QACN,CAAC,eAAe,MAAM,KAAK,IAAI,CAAC,EAAE,OAAO,CAAC,MAAM,MAAM,EAAE,EAAE,KAAK,MAAM;AAAA,QACrE;AAAA,MACF;AAAA,MACA,MAAM,kBAAkB,KAAK,IAAI;AAAA,IACnC;AAAA,EACF;AAEA,QAAM,MAAM,KAAK,cAAc,CAAC,MAAY,UAAU,GAAG,EAAE,IAAI,CAAC;AAChE,QAAM,UAAU,MAAM,mBAAmB,cAAc,OAAO,OAAO,MAAM;AACzE,UAAM,UAAU,MAAM,gBAAgB,EAAE,IAAI;AAC5C,WAAO,UAAU,UAAU,UAAU,CAAC,GAAG,OAAO,IAAI,IAAI,CAAC;AAAA,EAC3D,CAAC;AAQD,aAAW,KAAK,SAAS;AACvB,YAAQ;AAAA,MACN;AAAA,QACE,EAAE;AAAA,QACF,oCAAoC,EAAE,MAAM;AAAA,MAE9C;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,QAAQ,iBAAiB,uBAAuB,OAAO,GAAG,OAAO;AAAA,IACjE,MAAM,QAAQ,KAAK,CAAC,MAAM,EAAE,WAAW,QAAQ,IAAI,IAAI;AAAA,EACzD;AACF;","names":["messageOf"]}