@reddoorla/maintenance 0.85.1 → 0.86.0

package/dist/cli/commands/audit.js

@@ -5,34 +5,37 @@ import {
   fleetWorkdir,
   formatSkippedNotice,
   prepareFleetSites
-} from "../../chunk-ZMIPG6TR.js";
+} from "../../chunk-TVL5MVUF.js";
 import {
   resolveSites
-} from "../../chunk-7J53SUT6.js";
+} from "../../chunk-P2FE5AI6.js";
 import {
   ALL_AUDIT_NAMES,
   runOneAudit
-} from "../../chunk-QRDB4NLB.js";
+} from "../../chunk-2ZPT7GLV.js";
 import "../../chunk-LKGVSM2O.js";
 import "../../chunk-GASBX52O.js";
-import "../../chunk-VRWUL4TR.js";
+import "../../chunk-XHHMM5HX.js";
+import "../../chunk-6TWWY7ZU.js";
 import {
   recordFleetEventsBestEffort
-} from "../../chunk-QG6OSL4M.js";
-import "../../chunk-DC5H7KEQ.js";
-import "../../chunk-4SOCPK7A.js";
-import "../../chunk-FDIFTIXC.js";
-import "../../chunk-4DHQCN5H.js";
+} from "../../chunk-XUGSZP7Z.js";
+import {
+  isHttpUrl
+} from "../../chunk-EVBCK2KC.js";
+import "../../chunk-JHGHLKFS.js";
+import "../../chunk-3SF7D4DY.js";
 import "../../chunk-A3WDWNN5.js";
 import "../../chunk-2OP4JKIQ.js";
-import "../../chunk-XXTZBPUY.js";
 import "../../chunk-XTK5VIQB.js";
-import {
-  isHttpUrl
-} from "../../chunk-U5SZ4FOP.js";
+import "../../chunk-2NQUCS7O.js";
+import "../../chunk-UDRHAQT7.js";
+import "../../chunk-PTDMVGKL.js";
+import "../../chunk-LBYOLBW7.js";
+import "../../chunk-XXTZBPUY.js";
 import "../../chunk-6VAL7XJT.js";
 import "../../chunk-NMAWXBJA.js";
-import "../../chunk-N4MOEF32.js";
+import "../../chunk-C6B4RHXR.js";
 
 // src/cli/commands/audit.ts
 import { resolve } from "path";
@@ -232,29 +235,25 @@ async function runAuditCommand(site, opts) {
   if (skipNotice && !opts.json) output += `
 
 ${skipNotice}`;
+  if (opts.fleet !== void 0 && which.includes("smoke") && !opts.json) {
+    const { formatUnmeasuredSmokeSummary } = await import("../../smoke-B2GQOSIZ.js");
+    output += `
+
+${formatUnmeasuredSmokeSummary(results)}`;
+  }
   let writeBackFailed = false;
   if (opts.writeAirtable !== void 0) {
     const { openBase, readAirtableConfig } = await import("../../client-EPVO3FEH.js");
-    const { listWebsites } = await import("../../websites-SADZR4XQ.js");
+    const { listWebsites } = await import("../../websites-SXWTP72S.js");
     if (opts.fleet !== void 0) {
-      const { writeFleetAuditsToAirtable, formatFleetWriteSummary } = await import("../../write-audits-to-airtable-7PH75YWY.js");
-      const base = openBase(readAirtableConfig());
-      const websites = await listWebsites(base);
-      const fleetWrite = await writeFleetAuditsToAirtable({ base, websites, results });
-      if (fleetWrite.failed.length > 0) writeBackFailed = true;
-      const sweep = which.includes("security") ? "security" : "lighthouse";
-      const now = /* @__PURE__ */ new Date();
-      const auditEvents = fleetWrite.written.flatMap((w) => w.events ?? []);
-      await recordFleetEventsBestEffort(
-        [...auditEvents, fleetSweptEvent(sweep, fleetWrite.written.length, now.toISOString())],
-        now
-      );
+      const wb = await runFleetWriteBack({ results, which });
+      if (wb.anyFailed) writeBackFailed = true;
       if (!opts.json) output += `
 
-${formatFleetWriteSummary(fleetWrite)}`;
+${wb.summary}`;
     } else {
-      const { resolveSlugFromCwd } = await import("../../lighthouse-airtable-BIPM26SZ.js");
-      const { writeAuditsToAirtable } = await import("../../write-audits-to-airtable-7PH75YWY.js");
+      const { resolveSlugFromCwd } = await import("../../lighthouse-airtable-LBVIYYP5.js");
+      const { writeAuditsToAirtable } = await import("../../write-audits-to-airtable-MBEILLPU.js");
       const slug = typeof opts.writeAirtable === "string" && opts.writeAirtable.length > 0 ? opts.writeAirtable : await resolveSlugFromCwd(cwd);
       let writeSummary = null;
       await new Listr(
@@ -288,12 +287,45 @@ ${notice}`;
   );
   return { output, code };
 }
+async function runFleetWriteBack(args) {
+  const { results, which, deps = {} } = args;
+  const { writeFleetAuditsToAirtable, formatFleetWriteSummary } = await import("../../write-audits-to-airtable-MBEILLPU.js");
+  let base;
+  if (deps.openBase) {
+    base = deps.openBase();
+  } else {
+    const { openBase, readAirtableConfig } = await import("../../client-EPVO3FEH.js");
+    base = openBase(readAirtableConfig());
+  }
+  const { listWebsites } = await import("../../websites-SXWTP72S.js");
+  const websites = await listWebsites(base);
+  const makeMirror = deps.makeMirror ?? (async () => {
+    const { makeHealthMirrorBestEffort } = await import("../../health-mirror-4B2L7T2Y.js");
+    return makeHealthMirrorBestEffort();
+  });
+  const mirror = await makeMirror();
+  const fleetWrite = await writeFleetAuditsToAirtable({
+    base,
+    websites,
+    results,
+    ...mirror ? { mirror } : {}
+  });
+  const sweep = which.includes("security") ? "security" : "lighthouse";
+  const now = /* @__PURE__ */ new Date();
+  const auditEvents = fleetWrite.written.flatMap((w) => w.events ?? []);
+  await (deps.recordEvents ?? recordFleetEventsBestEffort)(
+    [...auditEvents, fleetSweptEvent(sweep, fleetWrite.written.length, now.toISOString())],
+    now
+  );
+  return { summary: formatFleetWriteSummary(fleetWrite), anyFailed: fleetWrite.failed.length > 0 };
+}
 export {
   applyDeployedUrl,
   auditExitCode,
   auditNeedsCheckout,
   deployedUrlNotice,
   parseConcurrency,
-  runAuditCommand
+  runAuditCommand,
+  runFleetWriteBack
 };
 //# sourceMappingURL=audit.js.map

package/dist/cli/commands/audit.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/cli/commands/audit.ts"],"sourcesContent":["import { resolve } from \"node:path\";\nimport { Listr } from \"listr2\";\nimport { runOneAudit, ALL_AUDIT_NAMES } from \"../../audits/index.js\";\nimport type { AuditName, AuditResult, Site } from \"../../types.js\";\nimport { resolveSites } from \"../fleet/resolve-sites.js\";\nimport {\n  prepareFleetSites,\n  formatSkippedNotice,\n  type SkippedSite,\n} from \"../fleet/prepare-sites.js\";\nimport { isHttpUrl } from \"../../util/url.js\";\nimport { fleetWorkdir } from \"../../util/fleet-workdir.js\";\nimport { recordFleetEventsBestEffort } from \"../../audits/fleet-events-writer.js\";\nimport { fleetSweptEvent } from \"../../audits/fleet-event-detectors.js\";\n\nexport type AuditCommandOptions = {\n  only?: string;\n  json?: boolean;\n  fleet?: string;\n  workdir?: string;\n  cwd?: string;\n  /**\n   * After running, push the lighthouse scores to the matching Websites row\n   * in Airtable. `true` (no value) = derive slug from cwd/package.json#name;\n   * string = explicit slug (e.g. \"med-solutions-of-texas\").\n   */\n  writeAirtable?: string | boolean;\n  /** Exit non-zero if any a11y violations are found (overrides warn). For CI gates. */\n  failOnViolations?: boolean;\n  /** Audit this deployed URL directly (lighthouse only; single-site). */\n  url?: string;\n  /** Max sites to audit in parallel (fleet mode). Unset = all at once;\n   *  `1` = sequential (used by the nightly CI workflow). */\n  concurrency?: string;\n};\n\nfunction parseOnly(value: string | undefined): AuditName[] | undefined {\n  if (!value) return undefined;\n  const names = value.split(\",\").map((s) => s.trim());\n  for (const n of names) {\n    if (!ALL_AUDIT_NAMES.includes(n as AuditName)) {\n      throw Object.assign(new Error(`unknown audit in --only: ${n}`), { exitCode: 2 });\n    }\n  }\n  return names as AuditName[];\n}\n\nfunction formatTable(results: AuditResult[]): string {\n  return results\n    .map((r) => `${r.audit.padEnd(12)} ${r.status.padEnd(5)} ${r.site}\\n  ${r.summary}`)\n    .join(\"\\n\");\n}\n\nexport function auditExitCode(results: AuditResult[], failOnViolations: boolean): number {\n  if (results.some((r) => r.status === \"fail\")) return 1;\n  if (failOnViolations) {\n    const a11yViolations = results\n      .filter((r) => r.audit === \"a11y\")\n      .reduce(\n        (n, r) =>\n          n + ((r.details as { totalViolations?: number } | undefined)?.totalViolations ?? 0),\n        0,\n      );\n    if (a11yViolations > 0) return 1;\n  }\n  return 0;\n}\n\nfunction formatDuration(ms: number): string {\n  if (ms < 1_000) return `${ms}ms`;\n  const totalSeconds = Math.round(ms / 1_000);\n  if (totalSeconds < 60) return `${totalSeconds}s`;\n  const m = Math.floor(totalSeconds / 60);\n  const s = totalSeconds % 60;\n  return `${m}m${s.toString().padStart(2, \"0\")}s`;\n}\n\ntype Renderer = \"default\" | \"silent\";\n\n/** Parse the `--concurrency <n>` flag into a Listr `concurrent` value. Unset →\n *  `true` (all sites in parallel, the interactive default). A positive integer\n *  bounds how many sites audit at once — `--concurrency 1` runs sequentially,\n *  which is what the nightly CI workflow uses so ~10 deployed-Lighthouse runs\n *  don't saturate a 2-core runner (one flaked locally at full parallelism). */\nexport function parseConcurrency(value: string | undefined): boolean | number {\n  if (value === undefined) return true;\n  const n = Number(value);\n  if (!Number.isInteger(n) || n < 1) {\n    throw Object.assign(new Error(`--concurrency must be a positive integer, got \"${value}\"`), {\n      exitCode: 2,\n    });\n  }\n  return n;\n}\n\n/** Build the audit-progress task list. Single-site → each audit is a sibling\n *  task. Fleet → each site is a task whose `output` shows X/N audits done as\n *  they complete (audits-per-site still run in parallel). Results are pushed\n *  into the shared `results` array; tasks throw on `fail` status so listr2\n *  paints them red, but `exitOnError: false` keeps other tasks running. */\nfunction buildAuditTasks(\n  sites: Site[],\n  which: AuditName[],\n  results: AuditResult[],\n  renderer: Renderer,\n  concurrency: boolean | number,\n) {\n  const singleSite = sites.length === 1;\n\n  if (singleSite) {\n    const site = sites[0]!;\n    return new Listr(\n      which.map((name) => ({\n        title: name,\n        task: async (_ctx, task) => {\n          const start = Date.now();\n          const result = await runOneAudit(site, name);\n          results.push(result);\n          const elapsed = formatDuration(Date.now() - start);\n          task.title = `${name}: ${result.summary} (${elapsed})`;\n          if (result.status === \"fail\") throw new Error(result.summary);\n        },\n      })),\n      { concurrent: true, exitOnError: false, renderer },\n    );\n  }\n\n  return new Listr(\n    sites.map((site) => {\n      const label = site.name || site.path; // `||`: empty slug must fall back to path, not blank\n      return {\n        title: label,\n        task: async (_ctx, task) => {\n          const start = Date.now();\n          let done = 0;\n          task.output = `0/${which.length} audits`;\n          const settled = await Promise.all(\n            which.map(async (name) => {\n              const r = await runOneAudit(site, name);\n              results.push(r);\n              done += 1;\n              task.output = `${done}/${which.length} audits`;\n              return r;\n            }),\n          );\n          const elapsed = formatDuration(Date.now() - start);\n          const failed = settled.filter((r) => r.status === \"fail\").length;\n          const warned = settled.filter((r) => r.status === \"warn\").length;\n          const note =\n            failed > 0\n              ? `${failed} failed`\n              : warned > 0\n                ? `${warned} warning${warned === 1 ? \"\" : \"s\"}`\n                : \"all green\";\n          task.title = `${label}: ${note} (${elapsed})`;\n          if (failed > 0) throw new Error(`${label}: ${failed} audit(s) failed`);\n        },\n      };\n    }),\n    { concurrent: concurrency, exitOnError: false, renderer },\n  );\n}\n\ntype WriteSummary = Awaited<\n  ReturnType<typeof import(\"../../audits/write-audits-to-airtable.js\").writeAuditsToAirtable>\n>;\n\nfunction formatWriteSummary(summary: WriteSummary): string {\n  const lines = summary.writes.map((w) => {\n    if (w.audit === \"lighthouse\") {\n      const s = w.counts as {\n        performance: number;\n        accessibility: number;\n        bestPractices: number;\n        seo: number;\n      };\n      return `  lighthouse: P=${s.performance} A=${s.accessibility} BP=${s.bestPractices} SEO=${s.seo}`;\n    }\n    if (w.audit === \"a11y\") {\n      return `  a11y: ${(w.counts as { violations: number }).violations} violations`;\n    }\n    if (w.audit === \"deps\") {\n      const c = w.counts as { drifted: number; majorBehind: number };\n      return `  deps: ${c.drifted} drifted (${c.majorBehind} major)`;\n    }\n    const c = w.counts as { critical: number; high: number; moderate: number; low: number };\n    return `  security: ${c.critical}C/${c.high}H/${c.moderate}M/${c.low}L`;\n  });\n  return `→ wrote to Websites[${summary.siteName}]:\\n${lines.join(\"\\n\")}`;\n}\n\n/** Listr renderer choice. `--json` → silent so stdout stays clean for piping.\n *  Otherwise listr's `default` renderer auto-falls back to `simple` in\n *  non-TTY contexts (CI, log capture, our own integration tests). */\nfunction rendererFor(json: boolean | undefined): Renderer {\n  return json ? \"silent\" : \"default\";\n}\n\n/** When `--url` is set but audits other than lighthouse also ran (those use the\n *  local checkout, not the deployed URL), return a one-line operator notice;\n *  null when there's nothing to warn about. Keeps the mixed-provenance result\n *  table from silently confusing the operator. */\nexport function deployedUrlNotice(\n  which: AuditName[],\n  url: string | undefined,\n  cwd: string,\n): string | null {\n  if (url === undefined) return null;\n  const others = which.filter((n) => n !== \"lighthouse\");\n  if (others.length === 0) return null;\n  return `note: --url only affects lighthouse; ${others.join(\", \")} ran against the local checkout at ${cwd}`;\n}\n\n/** Audits that need no repo checkout — they probe an external resource. lighthouse hits the\n *  live URL; domain probes DNS/TLS of the URL's host; browser drives the deployed URL;\n *  netlify-deploy queries the Netlify API by site id; function-health fetches the deployed\n *  `/health` endpoint. */\nconst CHECKOUT_FREE_AUDITS: ReadonlySet<AuditName> = new Set<AuditName>([\n  \"lighthouse\",\n  \"domain\",\n  \"browser\",\n  \"netlify-deploy\",\n  \"function-health\",\n  \"form-e2e\",\n]);\n\n/** Audits whose checkout-free run is keyed off `site.netlifyId` (the Netlify API) rather than\n *  the deployed URL. Everything else in CHECKOUT_FREE_AUDITS reads `site.deployedUrl`. */\nconst NETLIFY_ID_AUDITS: ReadonlySet<AuditName> = new Set<AuditName>([\"netlify-deploy\"]);\n\n/** A fleet site needs a local checkout unless every requested audit is checkout-free AND the site\n *  has the external resource each one runs against (`deployedUrl` for lighthouse/domain/browser,\n *  `netlifyId` for netlify-deploy). */\nexport function auditNeedsCheckout(site: Site, which: AuditName[]): boolean {\n  const deployedCapable = which.every((n) => {\n    if (!CHECKOUT_FREE_AUDITS.has(n)) return false;\n    return NETLIFY_ID_AUDITS.has(n) ? site.netlifyId !== undefined : site.deployedUrl !== undefined;\n  });\n  return !deployedCapable;\n}\n\n/** Apply a single-site `--url` to the resolved sites. Returns the input\n *  untouched when no url is given; otherwise requires exactly one site and\n *  stamps `deployedUrl` on it so the lighthouse audit takes its deployed path.\n *  The `--url`+`--fleet` combination is rejected earlier in `runAuditCommand`;\n *  this length guard also covers any future multi-site single-run resolver. */\nexport function applyDeployedUrl(sites: Site[], url: string | undefined): Site[] {\n  if (url === undefined) return sites;\n  if (sites.length !== 1) {\n    throw Object.assign(\n      new Error(`--url expects exactly one site, but ${sites.length} resolved.`),\n      { exitCode: 2 },\n    );\n  }\n  // Scheme-allowlist: the URL is handed straight to Chrome/lhci, so only\n  // http(s) is safe (a file:///gopher:// value would be a local-file read /\n  // SSRF). Same predicate the inventory paths use.\n  if (!isHttpUrl(url)) {\n    throw Object.assign(new Error(`--url must be an http(s) URL (got: ${JSON.stringify(url)})`), {\n      exitCode: 2,\n    });\n  }\n  return [{ ...sites[0]!, deployedUrl: url }];\n}\n\nexport async function runAuditCommand(\n  site: string | undefined,\n  opts: AuditCommandOptions,\n): Promise<{ output: string; code: number }> {\n  const which = parseOnly(opts.only) ?? ALL_AUDIT_NAMES;\n  const cwd = opts.cwd ? resolve(opts.cwd) : process.cwd();\n\n  // A literal --write-airtable=<slug> is single-site (the slug names one row).\n  // Boolean --write-airtable + --fleet is fine: each site's slug comes from the\n  // inventory, so there's no cwd-derived-slug ambiguity.\n  if (typeof opts.writeAirtable === \"string\" && opts.fleet !== undefined) {\n    throw Object.assign(\n      new Error(\n        \"--write-airtable=<slug> is single-site; with --fleet each site's slug comes from the inventory. Use --write-airtable (no slug) + --fleet.\",\n      ),\n      { exitCode: 2 },\n    );\n  }\n\n  if (opts.url !== undefined && opts.fleet !== undefined) {\n    throw Object.assign(\n      new Error(\n        \"--url is single-site only and cannot be combined with --fleet. Audit a single site instead.\",\n      ),\n      { exitCode: 2 },\n    );\n  }\n\n  let sites = await resolveSites({\n    ...(site !== undefined ? { site } : {}),\n    ...(opts.fleet !== undefined ? { fleet: opts.fleet } : {}),\n    ...(opts.workdir !== undefined ? { workdir: opts.workdir } : {}),\n    cwd,\n  });\n\n  sites = applyDeployedUrl(sites, opts.url);\n\n  let skippedPrep: SkippedSite[] = [];\n  if (opts.fleet) {\n    const workdir = opts.workdir ?? fleetWorkdir();\n    const prep = await prepareFleetSites(sites, {\n      workdir,\n      needsCheckout: (s) => auditNeedsCheckout(s, which),\n    });\n    sites = prep.prepared;\n    skippedPrep = prep.skipped;\n  }\n\n  const results: AuditResult[] = [];\n  const renderer = rendererFor(opts.json);\n  await buildAuditTasks(sites, which, results, renderer, parseConcurrency(opts.concurrency)).run();\n\n  let output = opts.json ? JSON.stringify(results, null, 2) : formatTable(results);\n\n  // Surface any site that couldn't be prepared (no auditable target, clone\n  // failure) — visibly, but without reding the run. One misconfigured inventory\n  // row is an operator fix, not an outage; the other sites still audited and\n  // wrote back. \"No silent caps\": a dropped site is never invisible.\n  const skipNotice = formatSkippedNotice(skippedPrep);\n  if (skipNotice && !opts.json) output += `\\n\\n${skipNotice}`;\n\n  // Did any site fail to write back to Airtable? The fleet writer collects\n  // per-site failures instead of throwing, so without this the command would\n  // exit 0 while rows silently failed to persist — automation keying on `$?`\n  // would see a clean run. (The single-site writer throws on failure, so it's\n  // already non-zero via the propagated error.)\n  let writeBackFailed = false;\n  if (opts.writeAirtable !== undefined) {\n    const { openBase, readAirtableConfig } = await import(\"../../reports/airtable/client.js\");\n    const { listWebsites } = await import(\"../../reports/airtable/websites.js\");\n\n    if (opts.fleet !== undefined) {\n      const { writeFleetAuditsToAirtable, formatFleetWriteSummary } =\n        await import(\"../../audits/write-audits-to-airtable.js\");\n      const base = openBase(readAirtableConfig());\n      const websites = await listWebsites(base);\n      const fleetWrite = await writeFleetAuditsToAirtable({ base, websites, results });\n      if (fleetWrite.failed.length > 0) writeBackFailed = true;\n      // Record fleet-activity events (vuln_cleared / cert_renewed rode along on each\n      // WriteSummary) plus a per-sweep rollup. Best-effort: a missing Turso cred no-ops.\n      const sweep = which.includes(\"security\") ? \"security\" : \"lighthouse\";\n      const now = new Date();\n      const auditEvents = fleetWrite.written.flatMap((w) => w.events ?? []);\n      await recordFleetEventsBestEffort(\n        [...auditEvents, fleetSweptEvent(sweep, fleetWrite.written.length, now.toISOString())],\n        now,\n      );\n      // Gate on !json: the write-summary is human text; appending it after the\n      // results array would corrupt `--json` output (the other notices already\n      // guard this way). The write itself still happens regardless of --json.\n      if (!opts.json) output += `\\n\\n${formatFleetWriteSummary(fleetWrite)}`;\n    } else {\n      const { resolveSlugFromCwd } = await import(\"../../audits/lighthouse-airtable.js\");\n      const { writeAuditsToAirtable } = await import(\"../../audits/write-audits-to-airtable.js\");\n      const slug =\n        typeof opts.writeAirtable === \"string\" && opts.writeAirtable.length > 0\n          ? opts.writeAirtable\n          : await resolveSlugFromCwd(cwd);\n      let writeSummary: WriteSummary | null = null;\n      await new Listr(\n        [\n          {\n            title: `Write to Airtable[${slug}]`,\n            task: async (_ctx, task) => {\n              const base = openBase(readAirtableConfig());\n              task.output = \"loading Websites…\";\n              const websites = await listWebsites(base);\n              task.output = \"writing scores…\";\n              writeSummary = await writeAuditsToAirtable({ base, websites, slug, results });\n              task.title = `Wrote to Websites[${writeSummary.siteName}] (${writeSummary.writes.length} audit type${writeSummary.writes.length === 1 ? \"\" : \"s\"})`;\n            },\n          },\n        ],\n        { renderer },\n      ).run();\n      if (writeSummary && !opts.json) output += `\\n\\n${formatWriteSummary(writeSummary)}`;\n    }\n  }\n\n  const notice = deployedUrlNotice(which, opts.url, cwd);\n  if (notice && !opts.json) output += `\\n\\n${notice}`;\n\n  const code = Math.max(\n    auditExitCode(results, opts.failOnViolations === true),\n    writeBackFailed ? 1 : 0,\n  );\n  return { output, code };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,eAAe;AACxB,SAAS,aAAa;AAmCtB,SAAS,UAAU,OAAoD;AACrE,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,QAAQ,MAAM,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC;AAClD,aAAW,KAAK,OAAO;AACrB,QAAI,CAAC,gBAAgB,SAAS,CAAc,GAAG;AAC7C,YAAM,OAAO,OAAO,IAAI,MAAM,4BAA4B,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;AAAA,IACjF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,YAAY,SAAgC;AACnD,SAAO,QACJ,IAAI,CAAC,MAAM,GAAG,EAAE,MAAM,OAAO,EAAE,CAAC,IAAI,EAAE,OAAO,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI;AAAA,IAAO,EAAE,OAAO,EAAE,EAClF,KAAK,IAAI;AACd;AAEO,SAAS,cAAc,SAAwB,kBAAmC;AACvF,MAAI,QAAQ,KAAK,CAAC,MAAM,EAAE,WAAW,MAAM,EAAG,QAAO;AACrD,MAAI,kBAAkB;AACpB,UAAM,iBAAiB,QACpB,OAAO,CAAC,MAAM,EAAE,UAAU,MAAM,EAChC;AAAA,MACC,CAAC,GAAG,MACF,KAAM,EAAE,SAAsD,mBAAmB;AAAA,MACnF;AAAA,IACF;AACF,QAAI,iBAAiB,EAAG,QAAO;AAAA,EACjC;AACA,SAAO;AACT;AAEA,SAAS,eAAe,IAAoB;AAC1C,MAAI,KAAK,IAAO,QAAO,GAAG,EAAE;AAC5B,QAAM,eAAe,KAAK,MAAM,KAAK,GAAK;AAC1C,MAAI,eAAe,GAAI,QAAO,GAAG,YAAY;AAC7C,QAAM,IAAI,KAAK,MAAM,eAAe,EAAE;AACtC,QAAM,IAAI,eAAe;AACzB,SAAO,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,GAAG,GAAG,CAAC;AAC9C;AASO,SAAS,iBAAiB,OAA6C;AAC5E,MAAI,UAAU,OAAW,QAAO;AAChC,QAAM,IAAI,OAAO,KAAK;AACtB,MAAI,CAAC,OAAO,UAAU,CAAC,KAAK,IAAI,GAAG;AACjC,UAAM,OAAO,OAAO,IAAI,MAAM,kDAAkD,KAAK,GAAG,GAAG;AAAA,MACzF,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAOA,SAAS,gBACP,OACA,OACA,SACA,UACA,aACA;AACA,QAAM,aAAa,MAAM,WAAW;AAEpC,MAAI,YAAY;AACd,UAAM,OAAO,MAAM,CAAC;AACpB,WAAO,IAAI;AAAA,MACT,MAAM,IAAI,CAAC,UAAU;AAAA,QACnB,OAAO;AAAA,QACP,MAAM,OAAO,MAAM,SAAS;AAC1B,gBAAM,QAAQ,KAAK,IAAI;AACvB,gBAAM,SAAS,MAAM,YAAY,MAAM,IAAI;AAC3C,kBAAQ,KAAK,MAAM;AACnB,gBAAM,UAAU,eAAe,KAAK,IAAI,IAAI,KAAK;AACjD,eAAK,QAAQ,GAAG,IAAI,KAAK,OAAO,OAAO,KAAK,OAAO;AACnD,cAAI,OAAO,WAAW,OAAQ,OAAM,IAAI,MAAM,OAAO,OAAO;AAAA,QAC9D;AAAA,MACF,EAAE;AAAA,MACF,EAAE,YAAY,MAAM,aAAa,OAAO,SAAS;AAAA,IACnD;AAAA,EACF;AAEA,SAAO,IAAI;AAAA,IACT,MAAM,IAAI,CAAC,SAAS;AAClB,YAAM,QAAQ,KAAK,QAAQ,KAAK;AAChC,aAAO;AAAA,QACL,OAAO;AAAA,QACP,MAAM,OAAO,MAAM,SAAS;AAC1B,gBAAM,QAAQ,KAAK,IAAI;AACvB,cAAI,OAAO;AACX,eAAK,SAAS,KAAK,MAAM,MAAM;AAC/B,gBAAM,UAAU,MAAM,QAAQ;AAAA,YAC5B,MAAM,IAAI,OAAO,SAAS;AACxB,oBAAM,IAAI,MAAM,YAAY,MAAM,IAAI;AACtC,sBAAQ,KAAK,CAAC;AACd,sBAAQ;AACR,mBAAK,SAAS,GAAG,IAAI,IAAI,MAAM,MAAM;AACrC,qBAAO;AAAA,YACT,CAAC;AAAA,UACH;AACA,gBAAM,UAAU,eAAe,KAAK,IAAI,IAAI,KAAK;AACjD,gBAAM,SAAS,QAAQ,OAAO,CAAC,MAAM,EAAE,WAAW,MAAM,EAAE;AAC1D,gBAAM,SAAS,QAAQ,OAAO,CAAC,MAAM,EAAE,WAAW,MAAM,EAAE;AAC1D,gBAAM,OACJ,SAAS,IACL,GAAG,MAAM,YACT,SAAS,IACP,GAAG,MAAM,WAAW,WAAW,IAAI,KAAK,GAAG,KAC3C;AACR,eAAK,QAAQ,GAAG,KAAK,KAAK,IAAI,KAAK,OAAO;AAC1C,cAAI,SAAS,EAAG,OAAM,IAAI,MAAM,GAAG,KAAK,KAAK,MAAM,kBAAkB;AAAA,QACvE;AAAA,MACF;AAAA,IACF,CAAC;AAAA,IACD,EAAE,YAAY,aAAa,aAAa,OAAO,SAAS;AAAA,EAC1D;AACF;AAMA,SAAS,mBAAmB,SAA+B;AACzD,QAAM,QAAQ,QAAQ,OAAO,IAAI,CAAC,MAAM;AACtC,QAAI,EAAE,UAAU,cAAc;AAC5B,YAAM,IAAI,EAAE;AAMZ,aAAO,mBAAmB,EAAE,WAAW,MAAM,EAAE,aAAa,OAAO,EAAE,aAAa,QAAQ,EAAE,GAAG;AAAA,IACjG;AACA,QAAI,EAAE,UAAU,QAAQ;AACtB,aAAO,WAAY,EAAE,OAAkC,UAAU;AAAA,IACnE;AACA,QAAI,EAAE,UAAU,QAAQ;AACtB,YAAMA,KAAI,EAAE;AACZ,aAAO,WAAWA,GAAE,OAAO,aAAaA,GAAE,WAAW;AAAA,IACvD;AACA,UAAM,IAAI,EAAE;AACZ,WAAO,eAAe,EAAE,QAAQ,KAAK,EAAE,IAAI,KAAK,EAAE,QAAQ,KAAK,EAAE,GAAG;AAAA,EACtE,CAAC;AACD,SAAO,4BAAuB,QAAQ,QAAQ;AAAA,EAAO,MAAM,KAAK,IAAI,CAAC;AACvE;AAKA,SAAS,YAAY,MAAqC;AACxD,SAAO,OAAO,WAAW;AAC3B;AAMO,SAAS,kBACd,OACA,KACA,KACe;AACf,MAAI,QAAQ,OAAW,QAAO;AAC9B,QAAM,SAAS,MAAM,OAAO,CAAC,MAAM,MAAM,YAAY;AACrD,MAAI,OAAO,WAAW,EAAG,QAAO;AAChC,SAAO,wCAAwC,OAAO,KAAK,IAAI,CAAC,sCAAsC,GAAG;AAC3G;AAMA,IAAM,uBAA+C,oBAAI,IAAe;AAAA,EACtE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAID,IAAM,oBAA4C,oBAAI,IAAe,CAAC,gBAAgB,CAAC;AAKhF,SAAS,mBAAmB,MAAY,OAA6B;AAC1E,QAAM,kBAAkB,MAAM,MAAM,CAAC,MAAM;AACzC,QAAI,CAAC,qBAAqB,IAAI,CAAC,EAAG,QAAO;AACzC,WAAO,kBAAkB,IAAI,CAAC,IAAI,KAAK,cAAc,SAAY,KAAK,gBAAgB;AAAA,EACxF,CAAC;AACD,SAAO,CAAC;AACV;AAOO,SAAS,iBAAiB,OAAe,KAAiC;AAC/E,MAAI,QAAQ,OAAW,QAAO;AAC9B,MAAI,MAAM,WAAW,GAAG;AACtB,UAAM,OAAO;AAAA,MACX,IAAI,MAAM,uCAAuC,MAAM,MAAM,YAAY;AAAA,MACzE,EAAE,UAAU,EAAE;AAAA,IAChB;AAAA,EACF;AAIA,MAAI,CAAC,UAAU,GAAG,GAAG;AACnB,UAAM,OAAO,OAAO,IAAI,MAAM,sCAAsC,KAAK,UAAU,GAAG,CAAC,GAAG,GAAG;AAAA,MAC3F,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AACA,SAAO,CAAC,EAAE,GAAG,MAAM,CAAC,GAAI,aAAa,IAAI,CAAC;AAC5C;AAEA,eAAsB,gBACpB,MACA,MAC2C;AAC3C,QAAM,QAAQ,UAAU,KAAK,IAAI,KAAK;AACtC,QAAM,MAAM,KAAK,MAAM,QAAQ,KAAK,GAAG,IAAI,QAAQ,IAAI;AAKvD,MAAI,OAAO,KAAK,kBAAkB,YAAY,KAAK,UAAU,QAAW;AACtE,UAAM,OAAO;AAAA,MACX,IAAI;AAAA,QACF;AAAA,MACF;AAAA,MACA,EAAE,UAAU,EAAE;AAAA,IAChB;AAAA,EACF;AAEA,MAAI,KAAK,QAAQ,UAAa,KAAK,UAAU,QAAW;AACtD,UAAM,OAAO;AAAA,MACX,IAAI;AAAA,QACF;AAAA,MACF;AAAA,MACA,EAAE,UAAU,EAAE;AAAA,IAChB;AAAA,EACF;AAEA,MAAI,QAAQ,MAAM,aAAa;AAAA,IAC7B,GAAI,SAAS,SAAY,EAAE,KAAK,IAAI,CAAC;AAAA,IACrC,GAAI,KAAK,UAAU,SAAY,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAAA,IACxD,GAAI,KAAK,YAAY,SAAY,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,IAC9D;AAAA,EACF,CAAC;AAED,UAAQ,iBAAiB,OAAO,KAAK,GAAG;AAExC,MAAI,cAA6B,CAAC;AAClC,MAAI,KAAK,OAAO;AACd,UAAM,UAAU,KAAK,WAAW,aAAa;AAC7C,UAAM,OAAO,MAAM,kBAAkB,OAAO;AAAA,MAC1C;AAAA,MACA,eAAe,CAAC,MAAM,mBAAmB,GAAG,KAAK;AAAA,IACnD,CAAC;AACD,YAAQ,KAAK;AACb,kBAAc,KAAK;AAAA,EACrB;AAEA,QAAM,UAAyB,CAAC;AAChC,QAAM,WAAW,YAAY,KAAK,IAAI;AACtC,QAAM,gBAAgB,OAAO,OAAO,SAAS,UAAU,iBAAiB,KAAK,WAAW,CAAC,EAAE,IAAI;AAE/F,MAAI,SAAS,KAAK,OAAO,KAAK,UAAU,SAAS,MAAM,CAAC,IAAI,YAAY,OAAO;AAM/E,QAAM,aAAa,oBAAoB,WAAW;AAClD,MAAI,cAAc,CAAC,KAAK,KAAM,WAAU;AAAA;AAAA,EAAO,UAAU;AAOzD,MAAI,kBAAkB;AACtB,MAAI,KAAK,kBAAkB,QAAW;AACpC,UAAM,EAAE,UAAU,mBAAmB,IAAI,MAAM,OAAO,0BAAkC;AACxF,UAAM,EAAE,aAAa,IAAI,MAAM,OAAO,4BAAoC;AAE1E,QAAI,KAAK,UAAU,QAAW;AAC5B,YAAM,EAAE,4BAA4B,wBAAwB,IAC1D,MAAM,OAAO,4CAA0C;AACzD,YAAM,OAAO,SAAS,mBAAmB,CAAC;AAC1C,YAAM,WAAW,MAAM,aAAa,IAAI;AACxC,YAAM,aAAa,MAAM,2BAA2B,EAAE,MAAM,UAAU,QAAQ,CAAC;AAC/E,UAAI,WAAW,OAAO,SAAS,EAAG,mBAAkB;AAGpD,YAAM,QAAQ,MAAM,SAAS,UAAU,IAAI,aAAa;AACxD,YAAM,MAAM,oBAAI,KAAK;AACrB,YAAM,cAAc,WAAW,QAAQ,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AACpE,YAAM;AAAA,QACJ,CAAC,GAAG,aAAa,gBAAgB,OAAO,WAAW,QAAQ,QAAQ,IAAI,YAAY,CAAC,CAAC;AAAA,QACrF;AAAA,MACF;AAIA,UAAI,CAAC,KAAK,KAAM,WAAU;AAAA;AAAA,EAAO,wBAAwB,UAAU,CAAC;AAAA,IACtE,OAAO;AACL,YAAM,EAAE,mBAAmB,IAAI,MAAM,OAAO,uCAAqC;AACjF,YAAM,EAAE,sBAAsB,IAAI,MAAM,OAAO,4CAA0C;AACzF,YAAM,OACJ,OAAO,KAAK,kBAAkB,YAAY,KAAK,cAAc,SAAS,IAClE,KAAK,gBACL,MAAM,mBAAmB,GAAG;AAClC,UAAI,eAAoC;AACxC,YAAM,IAAI;AAAA,QACR;AAAA,UACE;AAAA,YACE,OAAO,qBAAqB,IAAI;AAAA,YAChC,MAAM,OAAO,MAAM,SAAS;AAC1B,oBAAM,OAAO,SAAS,mBAAmB,CAAC;AAC1C,mBAAK,SAAS;AACd,oBAAM,WAAW,MAAM,aAAa,IAAI;AACxC,mBAAK,SAAS;AACd,6BAAe,MAAM,sBAAsB,EAAE,MAAM,UAAU,MAAM,QAAQ,CAAC;AAC5E,mBAAK,QAAQ,qBAAqB,aAAa,QAAQ,MAAM,aAAa,OAAO,MAAM,cAAc,aAAa,OAAO,WAAW,IAAI,KAAK,GAAG;AAAA,YAClJ;AAAA,UACF;AAAA,QACF;AAAA,QACA,EAAE,SAAS;AAAA,MACb,EAAE,IAAI;AACN,UAAI,gBAAgB,CAAC,KAAK,KAAM,WAAU;AAAA;AAAA,EAAO,mBAAmB,YAAY,CAAC;AAAA,IACnF;AAAA,EACF;AAEA,QAAM,SAAS,kBAAkB,OAAO,KAAK,KAAK,GAAG;AACrD,MAAI,UAAU,CAAC,KAAK,KAAM,WAAU;AAAA;AAAA,EAAO,MAAM;AAEjD,QAAM,OAAO,KAAK;AAAA,IAChB,cAAc,SAAS,KAAK,qBAAqB,IAAI;AAAA,IACrD,kBAAkB,IAAI;AAAA,EACxB;AACA,SAAO,EAAE,QAAQ,KAAK;AACxB;","names":["c"]}
+{"version":3,"sources":["../../../src/cli/commands/audit.ts"],"sourcesContent":["import { resolve } from \"node:path\";\nimport { Listr } from \"listr2\";\nimport { runOneAudit, ALL_AUDIT_NAMES } from \"../../audits/index.js\";\nimport type { AuditName, AuditResult, Site } from \"../../types.js\";\nimport { resolveSites } from \"../fleet/resolve-sites.js\";\nimport {\n  prepareFleetSites,\n  formatSkippedNotice,\n  type SkippedSite,\n} from \"../fleet/prepare-sites.js\";\nimport { isHttpUrl } from \"../../util/url.js\";\nimport { fleetWorkdir } from \"../../util/fleet-workdir.js\";\nimport { recordFleetEventsBestEffort } from \"../../audits/fleet-events-writer.js\";\nimport { fleetSweptEvent } from \"../../audits/fleet-event-detectors.js\";\nimport type { AirtableBase } from \"../../reports/airtable/client.js\";\nimport type { HealthMirror } from \"../../audits/health-mirror.js\";\nimport type { FleetEvent } from \"../../db/fleet-events.js\";\n\nexport type AuditCommandOptions = {\n  only?: string;\n  json?: boolean;\n  fleet?: string;\n  workdir?: string;\n  cwd?: string;\n  /**\n   * After running, push the lighthouse scores to the matching Websites row\n   * in Airtable. `true` (no value) = derive slug from cwd/package.json#name;\n   * string = explicit slug (e.g. \"med-solutions-of-texas\").\n   */\n  writeAirtable?: string | boolean;\n  /** Exit non-zero if any a11y violations are found (overrides warn). For CI gates. */\n  failOnViolations?: boolean;\n  /** Audit this deployed URL directly (lighthouse only; single-site). */\n  url?: string;\n  /** Max sites to audit in parallel (fleet mode). Unset = all at once;\n   *  `1` = sequential (used by the nightly CI workflow). */\n  concurrency?: string;\n};\n\nfunction parseOnly(value: string | undefined): AuditName[] | undefined {\n  if (!value) return undefined;\n  const names = value.split(\",\").map((s) => s.trim());\n  for (const n of names) {\n    if (!ALL_AUDIT_NAMES.includes(n as AuditName)) {\n      throw Object.assign(new Error(`unknown audit in --only: ${n}`), { exitCode: 2 });\n    }\n  }\n  return names as AuditName[];\n}\n\nfunction formatTable(results: AuditResult[]): string {\n  return results\n    .map((r) => `${r.audit.padEnd(12)} ${r.status.padEnd(5)} ${r.site}\\n  ${r.summary}`)\n    .join(\"\\n\");\n}\n\nexport function auditExitCode(results: AuditResult[], failOnViolations: boolean): number {\n  if (results.some((r) => r.status === \"fail\")) return 1;\n  if (failOnViolations) {\n    const a11yViolations = results\n      .filter((r) => r.audit === \"a11y\")\n      .reduce(\n        (n, r) =>\n          n + ((r.details as { totalViolations?: number } | undefined)?.totalViolations ?? 0),\n        0,\n      );\n    if (a11yViolations > 0) return 1;\n  }\n  return 0;\n}\n\nfunction formatDuration(ms: number): string {\n  if (ms < 1_000) return `${ms}ms`;\n  const totalSeconds = Math.round(ms / 1_000);\n  if (totalSeconds < 60) return `${totalSeconds}s`;\n  const m = Math.floor(totalSeconds / 60);\n  const s = totalSeconds % 60;\n  return `${m}m${s.toString().padStart(2, \"0\")}s`;\n}\n\ntype Renderer = \"default\" | \"silent\";\n\n/** Parse the `--concurrency <n>` flag into a Listr `concurrent` value. Unset →\n *  `true` (all sites in parallel, the interactive default). A positive integer\n *  bounds how many sites audit at once — `--concurrency 1` runs sequentially,\n *  which is what the nightly CI workflow uses so ~10 deployed-Lighthouse runs\n *  don't saturate a 2-core runner (one flaked locally at full parallelism). */\nexport function parseConcurrency(value: string | undefined): boolean | number {\n  if (value === undefined) return true;\n  const n = Number(value);\n  if (!Number.isInteger(n) || n < 1) {\n    throw Object.assign(new Error(`--concurrency must be a positive integer, got \"${value}\"`), {\n      exitCode: 2,\n    });\n  }\n  return n;\n}\n\n/** Build the audit-progress task list. Single-site → each audit is a sibling\n *  task. Fleet → each site is a task whose `output` shows X/N audits done as\n *  they complete (audits-per-site still run in parallel). Results are pushed\n *  into the shared `results` array; tasks throw on `fail` status so listr2\n *  paints them red, but `exitOnError: false` keeps other tasks running. */\nfunction buildAuditTasks(\n  sites: Site[],\n  which: AuditName[],\n  results: AuditResult[],\n  renderer: Renderer,\n  concurrency: boolean | number,\n) {\n  const singleSite = sites.length === 1;\n\n  if (singleSite) {\n    const site = sites[0]!;\n    return new Listr(\n      which.map((name) => ({\n        title: name,\n        task: async (_ctx, task) => {\n          const start = Date.now();\n          const result = await runOneAudit(site, name);\n          results.push(result);\n          const elapsed = formatDuration(Date.now() - start);\n          task.title = `${name}: ${result.summary} (${elapsed})`;\n          if (result.status === \"fail\") throw new Error(result.summary);\n        },\n      })),\n      { concurrent: true, exitOnError: false, renderer },\n    );\n  }\n\n  return new Listr(\n    sites.map((site) => {\n      const label = site.name || site.path; // `||`: empty slug must fall back to path, not blank\n      return {\n        title: label,\n        task: async (_ctx, task) => {\n          const start = Date.now();\n          let done = 0;\n          task.output = `0/${which.length} audits`;\n          const settled = await Promise.all(\n            which.map(async (name) => {\n              const r = await runOneAudit(site, name);\n              results.push(r);\n              done += 1;\n              task.output = `${done}/${which.length} audits`;\n              return r;\n            }),\n          );\n          const elapsed = formatDuration(Date.now() - start);\n          const failed = settled.filter((r) => r.status === \"fail\").length;\n          const warned = settled.filter((r) => r.status === \"warn\").length;\n          const note =\n            failed > 0\n              ? `${failed} failed`\n              : warned > 0\n                ? `${warned} warning${warned === 1 ? \"\" : \"s\"}`\n                : \"all green\";\n          task.title = `${label}: ${note} (${elapsed})`;\n          if (failed > 0) throw new Error(`${label}: ${failed} audit(s) failed`);\n        },\n      };\n    }),\n    { concurrent: concurrency, exitOnError: false, renderer },\n  );\n}\n\ntype WriteSummary = Awaited<\n  ReturnType<typeof import(\"../../audits/write-audits-to-airtable.js\").writeAuditsToAirtable>\n>;\n\nfunction formatWriteSummary(summary: WriteSummary): string {\n  const lines = summary.writes.map((w) => {\n    if (w.audit === \"lighthouse\") {\n      const s = w.counts as {\n        performance: number;\n        accessibility: number;\n        bestPractices: number;\n        seo: number;\n      };\n      return `  lighthouse: P=${s.performance} A=${s.accessibility} BP=${s.bestPractices} SEO=${s.seo}`;\n    }\n    if (w.audit === \"a11y\") {\n      return `  a11y: ${(w.counts as { violations: number }).violations} violations`;\n    }\n    if (w.audit === \"deps\") {\n      const c = w.counts as { drifted: number; majorBehind: number };\n      return `  deps: ${c.drifted} drifted (${c.majorBehind} major)`;\n    }\n    const c = w.counts as { critical: number; high: number; moderate: number; low: number };\n    return `  security: ${c.critical}C/${c.high}H/${c.moderate}M/${c.low}L`;\n  });\n  return `→ wrote to Websites[${summary.siteName}]:\\n${lines.join(\"\\n\")}`;\n}\n\n/** Listr renderer choice. `--json` → silent so stdout stays clean for piping.\n *  Otherwise listr's `default` renderer auto-falls back to `simple` in\n *  non-TTY contexts (CI, log capture, our own integration tests). */\nfunction rendererFor(json: boolean | undefined): Renderer {\n  return json ? \"silent\" : \"default\";\n}\n\n/** When `--url` is set but audits other than lighthouse also ran (those use the\n *  local checkout, not the deployed URL), return a one-line operator notice;\n *  null when there's nothing to warn about. Keeps the mixed-provenance result\n *  table from silently confusing the operator. */\nexport function deployedUrlNotice(\n  which: AuditName[],\n  url: string | undefined,\n  cwd: string,\n): string | null {\n  if (url === undefined) return null;\n  const others = which.filter((n) => n !== \"lighthouse\");\n  if (others.length === 0) return null;\n  return `note: --url only affects lighthouse; ${others.join(\", \")} ran against the local checkout at ${cwd}`;\n}\n\n/** Audits that need no repo checkout — they probe an external resource. lighthouse hits the\n *  live URL; domain probes DNS/TLS of the URL's host; browser drives the deployed URL;\n *  netlify-deploy queries the Netlify API by site id; function-health fetches the deployed\n *  `/health` endpoint. */\nconst CHECKOUT_FREE_AUDITS: ReadonlySet<AuditName> = new Set<AuditName>([\n  \"lighthouse\",\n  \"domain\",\n  \"browser\",\n  \"netlify-deploy\",\n  \"function-health\",\n  \"form-e2e\",\n]);\n\n/** Audits whose checkout-free run is keyed off `site.netlifyId` (the Netlify API) rather than\n *  the deployed URL. Everything else in CHECKOUT_FREE_AUDITS reads `site.deployedUrl`. */\nconst NETLIFY_ID_AUDITS: ReadonlySet<AuditName> = new Set<AuditName>([\"netlify-deploy\"]);\n\n/** A fleet site needs a local checkout unless every requested audit is checkout-free AND the site\n *  has the external resource each one runs against (`deployedUrl` for lighthouse/domain/browser,\n *  `netlifyId` for netlify-deploy). */\nexport function auditNeedsCheckout(site: Site, which: AuditName[]): boolean {\n  const deployedCapable = which.every((n) => {\n    if (!CHECKOUT_FREE_AUDITS.has(n)) return false;\n    return NETLIFY_ID_AUDITS.has(n) ? site.netlifyId !== undefined : site.deployedUrl !== undefined;\n  });\n  return !deployedCapable;\n}\n\n/** Apply a single-site `--url` to the resolved sites. Returns the input\n *  untouched when no url is given; otherwise requires exactly one site and\n *  stamps `deployedUrl` on it so the lighthouse audit takes its deployed path.\n *  The `--url`+`--fleet` combination is rejected earlier in `runAuditCommand`;\n *  this length guard also covers any future multi-site single-run resolver. */\nexport function applyDeployedUrl(sites: Site[], url: string | undefined): Site[] {\n  if (url === undefined) return sites;\n  if (sites.length !== 1) {\n    throw Object.assign(\n      new Error(`--url expects exactly one site, but ${sites.length} resolved.`),\n      { exitCode: 2 },\n    );\n  }\n  // Scheme-allowlist: the URL is handed straight to Chrome/lhci, so only\n  // http(s) is safe (a file:///gopher:// value would be a local-file read /\n  // SSRF). Same predicate the inventory paths use.\n  if (!isHttpUrl(url)) {\n    throw Object.assign(new Error(`--url must be an http(s) URL (got: ${JSON.stringify(url)})`), {\n      exitCode: 2,\n    });\n  }\n  return [{ ...sites[0]!, deployedUrl: url }];\n}\n\nexport async function runAuditCommand(\n  site: string | undefined,\n  opts: AuditCommandOptions,\n): Promise<{ output: string; code: number }> {\n  const which = parseOnly(opts.only) ?? ALL_AUDIT_NAMES;\n  const cwd = opts.cwd ? resolve(opts.cwd) : process.cwd();\n\n  // A literal --write-airtable=<slug> is single-site (the slug names one row).\n  // Boolean --write-airtable + --fleet is fine: each site's slug comes from the\n  // inventory, so there's no cwd-derived-slug ambiguity.\n  if (typeof opts.writeAirtable === \"string\" && opts.fleet !== undefined) {\n    throw Object.assign(\n      new Error(\n        \"--write-airtable=<slug> is single-site; with --fleet each site's slug comes from the inventory. Use --write-airtable (no slug) + --fleet.\",\n      ),\n      { exitCode: 2 },\n    );\n  }\n\n  if (opts.url !== undefined && opts.fleet !== undefined) {\n    throw Object.assign(\n      new Error(\n        \"--url is single-site only and cannot be combined with --fleet. Audit a single site instead.\",\n      ),\n      { exitCode: 2 },\n    );\n  }\n\n  let sites = await resolveSites({\n    ...(site !== undefined ? { site } : {}),\n    ...(opts.fleet !== undefined ? { fleet: opts.fleet } : {}),\n    ...(opts.workdir !== undefined ? { workdir: opts.workdir } : {}),\n    cwd,\n  });\n\n  sites = applyDeployedUrl(sites, opts.url);\n\n  let skippedPrep: SkippedSite[] = [];\n  if (opts.fleet) {\n    const workdir = opts.workdir ?? fleetWorkdir();\n    const prep = await prepareFleetSites(sites, {\n      workdir,\n      needsCheckout: (s) => auditNeedsCheckout(s, which),\n    });\n    sites = prep.prepared;\n    skippedPrep = prep.skipped;\n  }\n\n  const results: AuditResult[] = [];\n  const renderer = rendererFor(opts.json);\n  await buildAuditTasks(sites, which, results, renderer, parseConcurrency(opts.concurrency)).run();\n\n  let output = opts.json ? JSON.stringify(results, null, 2) : formatTable(results);\n\n  // Surface any site that couldn't be prepared (no auditable target, clone\n  // failure) — visibly, but without reding the run. One misconfigured inventory\n  // row is an operator fix, not an outage; the other sites still audited and\n  // wrote back. \"No silent caps\": a dropped site is never invisible.\n  const skipNotice = formatSkippedNotice(skippedPrep);\n  if (skipNotice && !opts.json) output += `\\n\\n${skipNotice}`;\n\n  // \"Did every site actually get measured?\" — emitted for any fleet sweep that ran\n  // `smoke`, independent of --write-airtable, because it is a statement about the\n  // RUN, not about persistence. Deliberately not folded into FLEET_WRITE_SUMMARY:\n  // an unmeasured site still writes (it just writes nothing new), so the write gate\n  // counts it as a success. That gap is exactly what hid four nights of timeouts.\n  if (opts.fleet !== undefined && which.includes(\"smoke\") && !opts.json) {\n    const { formatUnmeasuredSmokeSummary } = await import(\"../../audits/smoke.js\");\n    output += `\\n\\n${formatUnmeasuredSmokeSummary(results)}`;\n  }\n\n  // Did any site fail to write back to Airtable? The fleet writer collects\n  // per-site failures instead of throwing, so without this the command would\n  // exit 0 while rows silently failed to persist — automation keying on `$?`\n  // would see a clean run. (The single-site writer throws on failure, so it's\n  // already non-zero via the propagated error.)\n  let writeBackFailed = false;\n  if (opts.writeAirtable !== undefined) {\n    const { openBase, readAirtableConfig } = await import(\"../../reports/airtable/client.js\");\n    const { listWebsites } = await import(\"../../reports/airtable/websites.js\");\n\n    if (opts.fleet !== undefined) {\n      const wb = await runFleetWriteBack({ results, which });\n      if (wb.anyFailed) writeBackFailed = true;\n      // Gate on !json: the write-summary is human text; appending it after the\n      // results array would corrupt `--json` output (the other notices already\n      // guard this way). The write itself still happens regardless of --json.\n      if (!opts.json) output += `\\n\\n${wb.summary}`;\n    } else {\n      const { resolveSlugFromCwd } = await import(\"../../audits/lighthouse-airtable.js\");\n      const { writeAuditsToAirtable } = await import(\"../../audits/write-audits-to-airtable.js\");\n      const slug =\n        typeof opts.writeAirtable === \"string\" && opts.writeAirtable.length > 0\n          ? opts.writeAirtable\n          : await resolveSlugFromCwd(cwd);\n      let writeSummary: WriteSummary | null = null;\n      await new Listr(\n        [\n          {\n            title: `Write to Airtable[${slug}]`,\n            task: async (_ctx, task) => {\n              const base = openBase(readAirtableConfig());\n              task.output = \"loading Websites…\";\n              const websites = await listWebsites(base);\n              task.output = \"writing scores…\";\n              writeSummary = await writeAuditsToAirtable({ base, websites, slug, results });\n              task.title = `Wrote to Websites[${writeSummary.siteName}] (${writeSummary.writes.length} audit type${writeSummary.writes.length === 1 ? \"\" : \"s\"})`;\n            },\n          },\n        ],\n        { renderer },\n      ).run();\n      if (writeSummary && !opts.json) output += `\\n\\n${formatWriteSummary(writeSummary)}`;\n    }\n  }\n\n  const notice = deployedUrlNotice(which, opts.url, cwd);\n  if (notice && !opts.json) output += `\\n\\n${notice}`;\n\n  const code = Math.max(\n    auditExitCode(results, opts.failOnViolations === true),\n    writeBackFailed ? 1 : 0,\n  );\n  return { output, code };\n}\n\n/** The fleet `--write-airtable` step: write every site's audits back to its\n *  Websites row, dual-write each just-written FieldSet into Turso (#539\n *  Phase 3), and record fleet-activity events. Extracted from runAuditCommand\n *  so the mirror WIRING itself is pinned by test — the mutation this seam\n *  kills is dropping the `...(mirror ? { mirror } : {})` pass-through, which\n *  would silently stop all five nightly sweeps from mirroring while every\n *  sweep stayed green (adversarial review of #566, finding 6). Deps default\n *  to the real fleet wiring; dynamic imports keep the no-write paths from\n *  loading Airtable/db clients. */\nexport async function runFleetWriteBack(args: {\n  results: AuditResult[];\n  which: AuditName[];\n  deps?: {\n    openBase?: () => AirtableBase;\n    makeMirror?: () => Promise<HealthMirror | null>;\n    recordEvents?: (events: FleetEvent[], now: Date) => Promise<void>;\n  };\n}): Promise<{ summary: string; anyFailed: boolean }> {\n  const { results, which, deps = {} } = args;\n  const { writeFleetAuditsToAirtable, formatFleetWriteSummary } =\n    await import(\"../../audits/write-audits-to-airtable.js\");\n  let base: AirtableBase;\n  if (deps.openBase) {\n    base = deps.openBase();\n  } else {\n    const { openBase, readAirtableConfig } = await import(\"../../reports/airtable/client.js\");\n    base = openBase(readAirtableConfig());\n  }\n  const { listWebsites } = await import(\"../../reports/airtable/websites.js\");\n  const websites = await listWebsites(base);\n  // Phase 3 dual-write (#539): mirror each site's written FieldSet into\n  // site_health. Null when libSQL creds are absent — Airtable write-back\n  // proceeds exactly as before.\n  const makeMirror =\n    deps.makeMirror ??\n    (async () => {\n      const { makeHealthMirrorBestEffort } = await import(\"../../audits/health-mirror.js\");\n      return makeHealthMirrorBestEffort();\n    });\n  const mirror = await makeMirror();\n  const fleetWrite = await writeFleetAuditsToAirtable({\n    base,\n    websites,\n    results,\n    ...(mirror ? { mirror } : {}),\n  });\n  // Record fleet-activity events (vuln_cleared / cert_renewed rode along on each\n  // WriteSummary) plus a per-sweep rollup. Best-effort: a missing Turso cred no-ops.\n  const sweep = which.includes(\"security\") ? \"security\" : \"lighthouse\";\n  const now = new Date();\n  const auditEvents = fleetWrite.written.flatMap((w) => w.events ?? []);\n  await (deps.recordEvents ?? recordFleetEventsBestEffort)(\n    [...auditEvents, fleetSweptEvent(sweep, fleetWrite.written.length, now.toISOString())],\n    now,\n  );\n  return { summary: formatFleetWriteSummary(fleetWrite), anyFailed: fleetWrite.failed.length > 0 };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,eAAe;AACxB,SAAS,aAAa;AAsCtB,SAAS,UAAU,OAAoD;AACrE,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,QAAQ,MAAM,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC;AAClD,aAAW,KAAK,OAAO;AACrB,QAAI,CAAC,gBAAgB,SAAS,CAAc,GAAG;AAC7C,YAAM,OAAO,OAAO,IAAI,MAAM,4BAA4B,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;AAAA,IACjF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,YAAY,SAAgC;AACnD,SAAO,QACJ,IAAI,CAAC,MAAM,GAAG,EAAE,MAAM,OAAO,EAAE,CAAC,IAAI,EAAE,OAAO,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI;AAAA,IAAO,EAAE,OAAO,EAAE,EAClF,KAAK,IAAI;AACd;AAEO,SAAS,cAAc,SAAwB,kBAAmC;AACvF,MAAI,QAAQ,KAAK,CAAC,MAAM,EAAE,WAAW,MAAM,EAAG,QAAO;AACrD,MAAI,kBAAkB;AACpB,UAAM,iBAAiB,QACpB,OAAO,CAAC,MAAM,EAAE,UAAU,MAAM,EAChC;AAAA,MACC,CAAC,GAAG,MACF,KAAM,EAAE,SAAsD,mBAAmB;AAAA,MACnF;AAAA,IACF;AACF,QAAI,iBAAiB,EAAG,QAAO;AAAA,EACjC;AACA,SAAO;AACT;AAEA,SAAS,eAAe,IAAoB;AAC1C,MAAI,KAAK,IAAO,QAAO,GAAG,EAAE;AAC5B,QAAM,eAAe,KAAK,MAAM,KAAK,GAAK;AAC1C,MAAI,eAAe,GAAI,QAAO,GAAG,YAAY;AAC7C,QAAM,IAAI,KAAK,MAAM,eAAe,EAAE;AACtC,QAAM,IAAI,eAAe;AACzB,SAAO,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,GAAG,GAAG,CAAC;AAC9C;AASO,SAAS,iBAAiB,OAA6C;AAC5E,MAAI,UAAU,OAAW,QAAO;AAChC,QAAM,IAAI,OAAO,KAAK;AACtB,MAAI,CAAC,OAAO,UAAU,CAAC,KAAK,IAAI,GAAG;AACjC,UAAM,OAAO,OAAO,IAAI,MAAM,kDAAkD,KAAK,GAAG,GAAG;AAAA,MACzF,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAOA,SAAS,gBACP,OACA,OACA,SACA,UACA,aACA;AACA,QAAM,aAAa,MAAM,WAAW;AAEpC,MAAI,YAAY;AACd,UAAM,OAAO,MAAM,CAAC;AACpB,WAAO,IAAI;AAAA,MACT,MAAM,IAAI,CAAC,UAAU;AAAA,QACnB,OAAO;AAAA,QACP,MAAM,OAAO,MAAM,SAAS;AAC1B,gBAAM,QAAQ,KAAK,IAAI;AACvB,gBAAM,SAAS,MAAM,YAAY,MAAM,IAAI;AAC3C,kBAAQ,KAAK,MAAM;AACnB,gBAAM,UAAU,eAAe,KAAK,IAAI,IAAI,KAAK;AACjD,eAAK,QAAQ,GAAG,IAAI,KAAK,OAAO,OAAO,KAAK,OAAO;AACnD,cAAI,OAAO,WAAW,OAAQ,OAAM,IAAI,MAAM,OAAO,OAAO;AAAA,QAC9D;AAAA,MACF,EAAE;AAAA,MACF,EAAE,YAAY,MAAM,aAAa,OAAO,SAAS;AAAA,IACnD;AAAA,EACF;AAEA,SAAO,IAAI;AAAA,IACT,MAAM,IAAI,CAAC,SAAS;AAClB,YAAM,QAAQ,KAAK,QAAQ,KAAK;AAChC,aAAO;AAAA,QACL,OAAO;AAAA,QACP,MAAM,OAAO,MAAM,SAAS;AAC1B,gBAAM,QAAQ,KAAK,IAAI;AACvB,cAAI,OAAO;AACX,eAAK,SAAS,KAAK,MAAM,MAAM;AAC/B,gBAAM,UAAU,MAAM,QAAQ;AAAA,YAC5B,MAAM,IAAI,OAAO,SAAS;AACxB,oBAAM,IAAI,MAAM,YAAY,MAAM,IAAI;AACtC,sBAAQ,KAAK,CAAC;AACd,sBAAQ;AACR,mBAAK,SAAS,GAAG,IAAI,IAAI,MAAM,MAAM;AACrC,qBAAO;AAAA,YACT,CAAC;AAAA,UACH;AACA,gBAAM,UAAU,eAAe,KAAK,IAAI,IAAI,KAAK;AACjD,gBAAM,SAAS,QAAQ,OAAO,CAAC,MAAM,EAAE,WAAW,MAAM,EAAE;AAC1D,gBAAM,SAAS,QAAQ,OAAO,CAAC,MAAM,EAAE,WAAW,MAAM,EAAE;AAC1D,gBAAM,OACJ,SAAS,IACL,GAAG,MAAM,YACT,SAAS,IACP,GAAG,MAAM,WAAW,WAAW,IAAI,KAAK,GAAG,KAC3C;AACR,eAAK,QAAQ,GAAG,KAAK,KAAK,IAAI,KAAK,OAAO;AAC1C,cAAI,SAAS,EAAG,OAAM,IAAI,MAAM,GAAG,KAAK,KAAK,MAAM,kBAAkB;AAAA,QACvE;AAAA,MACF;AAAA,IACF,CAAC;AAAA,IACD,EAAE,YAAY,aAAa,aAAa,OAAO,SAAS;AAAA,EAC1D;AACF;AAMA,SAAS,mBAAmB,SAA+B;AACzD,QAAM,QAAQ,QAAQ,OAAO,IAAI,CAAC,MAAM;AACtC,QAAI,EAAE,UAAU,cAAc;AAC5B,YAAM,IAAI,EAAE;AAMZ,aAAO,mBAAmB,EAAE,WAAW,MAAM,EAAE,aAAa,OAAO,EAAE,aAAa,QAAQ,EAAE,GAAG;AAAA,IACjG;AACA,QAAI,EAAE,UAAU,QAAQ;AACtB,aAAO,WAAY,EAAE,OAAkC,UAAU;AAAA,IACnE;AACA,QAAI,EAAE,UAAU,QAAQ;AACtB,YAAMA,KAAI,EAAE;AACZ,aAAO,WAAWA,GAAE,OAAO,aAAaA,GAAE,WAAW;AAAA,IACvD;AACA,UAAM,IAAI,EAAE;AACZ,WAAO,eAAe,EAAE,QAAQ,KAAK,EAAE,IAAI,KAAK,EAAE,QAAQ,KAAK,EAAE,GAAG;AAAA,EACtE,CAAC;AACD,SAAO,4BAAuB,QAAQ,QAAQ;AAAA,EAAO,MAAM,KAAK,IAAI,CAAC;AACvE;AAKA,SAAS,YAAY,MAAqC;AACxD,SAAO,OAAO,WAAW;AAC3B;AAMO,SAAS,kBACd,OACA,KACA,KACe;AACf,MAAI,QAAQ,OAAW,QAAO;AAC9B,QAAM,SAAS,MAAM,OAAO,CAAC,MAAM,MAAM,YAAY;AACrD,MAAI,OAAO,WAAW,EAAG,QAAO;AAChC,SAAO,wCAAwC,OAAO,KAAK,IAAI,CAAC,sCAAsC,GAAG;AAC3G;AAMA,IAAM,uBAA+C,oBAAI,IAAe;AAAA,EACtE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAID,IAAM,oBAA4C,oBAAI,IAAe,CAAC,gBAAgB,CAAC;AAKhF,SAAS,mBAAmB,MAAY,OAA6B;AAC1E,QAAM,kBAAkB,MAAM,MAAM,CAAC,MAAM;AACzC,QAAI,CAAC,qBAAqB,IAAI,CAAC,EAAG,QAAO;AACzC,WAAO,kBAAkB,IAAI,CAAC,IAAI,KAAK,cAAc,SAAY,KAAK,gBAAgB;AAAA,EACxF,CAAC;AACD,SAAO,CAAC;AACV;AAOO,SAAS,iBAAiB,OAAe,KAAiC;AAC/E,MAAI,QAAQ,OAAW,QAAO;AAC9B,MAAI,MAAM,WAAW,GAAG;AACtB,UAAM,OAAO;AAAA,MACX,IAAI,MAAM,uCAAuC,MAAM,MAAM,YAAY;AAAA,MACzE,EAAE,UAAU,EAAE;AAAA,IAChB;AAAA,EACF;AAIA,MAAI,CAAC,UAAU,GAAG,GAAG;AACnB,UAAM,OAAO,OAAO,IAAI,MAAM,sCAAsC,KAAK,UAAU,GAAG,CAAC,GAAG,GAAG;AAAA,MAC3F,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AACA,SAAO,CAAC,EAAE,GAAG,MAAM,CAAC,GAAI,aAAa,IAAI,CAAC;AAC5C;AAEA,eAAsB,gBACpB,MACA,MAC2C;AAC3C,QAAM,QAAQ,UAAU,KAAK,IAAI,KAAK;AACtC,QAAM,MAAM,KAAK,MAAM,QAAQ,KAAK,GAAG,IAAI,QAAQ,IAAI;AAKvD,MAAI,OAAO,KAAK,kBAAkB,YAAY,KAAK,UAAU,QAAW;AACtE,UAAM,OAAO;AAAA,MACX,IAAI;AAAA,QACF;AAAA,MACF;AAAA,MACA,EAAE,UAAU,EAAE;AAAA,IAChB;AAAA,EACF;AAEA,MAAI,KAAK,QAAQ,UAAa,KAAK,UAAU,QAAW;AACtD,UAAM,OAAO;AAAA,MACX,IAAI;AAAA,QACF;AAAA,MACF;AAAA,MACA,EAAE,UAAU,EAAE;AAAA,IAChB;AAAA,EACF;AAEA,MAAI,QAAQ,MAAM,aAAa;AAAA,IAC7B,GAAI,SAAS,SAAY,EAAE,KAAK,IAAI,CAAC;AAAA,IACrC,GAAI,KAAK,UAAU,SAAY,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAAA,IACxD,GAAI,KAAK,YAAY,SAAY,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,IAC9D;AAAA,EACF,CAAC;AAED,UAAQ,iBAAiB,OAAO,KAAK,GAAG;AAExC,MAAI,cAA6B,CAAC;AAClC,MAAI,KAAK,OAAO;AACd,UAAM,UAAU,KAAK,WAAW,aAAa;AAC7C,UAAM,OAAO,MAAM,kBAAkB,OAAO;AAAA,MAC1C;AAAA,MACA,eAAe,CAAC,MAAM,mBAAmB,GAAG,KAAK;AAAA,IACnD,CAAC;AACD,YAAQ,KAAK;AACb,kBAAc,KAAK;AAAA,EACrB;AAEA,QAAM,UAAyB,CAAC;AAChC,QAAM,WAAW,YAAY,KAAK,IAAI;AACtC,QAAM,gBAAgB,OAAO,OAAO,SAAS,UAAU,iBAAiB,KAAK,WAAW,CAAC,EAAE,IAAI;AAE/F,MAAI,SAAS,KAAK,OAAO,KAAK,UAAU,SAAS,MAAM,CAAC,IAAI,YAAY,OAAO;AAM/E,QAAM,aAAa,oBAAoB,WAAW;AAClD,MAAI,cAAc,CAAC,KAAK,KAAM,WAAU;AAAA;AAAA,EAAO,UAAU;AAOzD,MAAI,KAAK,UAAU,UAAa,MAAM,SAAS,OAAO,KAAK,CAAC,KAAK,MAAM;AACrE,UAAM,EAAE,6BAA6B,IAAI,MAAM,OAAO,yBAAuB;AAC7E,cAAU;AAAA;AAAA,EAAO,6BAA6B,OAAO,CAAC;AAAA,EACxD;AAOA,MAAI,kBAAkB;AACtB,MAAI,KAAK,kBAAkB,QAAW;AACpC,UAAM,EAAE,UAAU,mBAAmB,IAAI,MAAM,OAAO,0BAAkC;AACxF,UAAM,EAAE,aAAa,IAAI,MAAM,OAAO,4BAAoC;AAE1E,QAAI,KAAK,UAAU,QAAW;AAC5B,YAAM,KAAK,MAAM,kBAAkB,EAAE,SAAS,MAAM,CAAC;AACrD,UAAI,GAAG,UAAW,mBAAkB;AAIpC,UAAI,CAAC,KAAK,KAAM,WAAU;AAAA;AAAA,EAAO,GAAG,OAAO;AAAA,IAC7C,OAAO;AACL,YAAM,EAAE,mBAAmB,IAAI,MAAM,OAAO,uCAAqC;AACjF,YAAM,EAAE,sBAAsB,IAAI,MAAM,OAAO,4CAA0C;AACzF,YAAM,OACJ,OAAO,KAAK,kBAAkB,YAAY,KAAK,cAAc,SAAS,IAClE,KAAK,gBACL,MAAM,mBAAmB,GAAG;AAClC,UAAI,eAAoC;AACxC,YAAM,IAAI;AAAA,QACR;AAAA,UACE;AAAA,YACE,OAAO,qBAAqB,IAAI;AAAA,YAChC,MAAM,OAAO,MAAM,SAAS;AAC1B,oBAAM,OAAO,SAAS,mBAAmB,CAAC;AAC1C,mBAAK,SAAS;AACd,oBAAM,WAAW,MAAM,aAAa,IAAI;AACxC,mBAAK,SAAS;AACd,6BAAe,MAAM,sBAAsB,EAAE,MAAM,UAAU,MAAM,QAAQ,CAAC;AAC5E,mBAAK,QAAQ,qBAAqB,aAAa,QAAQ,MAAM,aAAa,OAAO,MAAM,cAAc,aAAa,OAAO,WAAW,IAAI,KAAK,GAAG;AAAA,YAClJ;AAAA,UACF;AAAA,QACF;AAAA,QACA,EAAE,SAAS;AAAA,MACb,EAAE,IAAI;AACN,UAAI,gBAAgB,CAAC,KAAK,KAAM,WAAU;AAAA;AAAA,EAAO,mBAAmB,YAAY,CAAC;AAAA,IACnF;AAAA,EACF;AAEA,QAAM,SAAS,kBAAkB,OAAO,KAAK,KAAK,GAAG;AACrD,MAAI,UAAU,CAAC,KAAK,KAAM,WAAU;AAAA;AAAA,EAAO,MAAM;AAEjD,QAAM,OAAO,KAAK;AAAA,IAChB,cAAc,SAAS,KAAK,qBAAqB,IAAI;AAAA,IACrD,kBAAkB,IAAI;AAAA,EACxB;AACA,SAAO,EAAE,QAAQ,KAAK;AACxB;AAWA,eAAsB,kBAAkB,MAQa;AACnD,QAAM,EAAE,SAAS,OAAO,OAAO,CAAC,EAAE,IAAI;AACtC,QAAM,EAAE,4BAA4B,wBAAwB,IAC1D,MAAM,OAAO,4CAA0C;AACzD,MAAI;AACJ,MAAI,KAAK,UAAU;AACjB,WAAO,KAAK,SAAS;AAAA,EACvB,OAAO;AACL,UAAM,EAAE,UAAU,mBAAmB,IAAI,MAAM,OAAO,0BAAkC;AACxF,WAAO,SAAS,mBAAmB,CAAC;AAAA,EACtC;AACA,QAAM,EAAE,aAAa,IAAI,MAAM,OAAO,4BAAoC;AAC1E,QAAM,WAAW,MAAM,aAAa,IAAI;AAIxC,QAAM,aACJ,KAAK,eACJ,YAAY;AACX,UAAM,EAAE,2BAA2B,IAAI,MAAM,OAAO,iCAA+B;AACnF,WAAO,2BAA2B;AAAA,EACpC;AACF,QAAM,SAAS,MAAM,WAAW;AAChC,QAAM,aAAa,MAAM,2BAA2B;AAAA,IAClD;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,EAC7B,CAAC;AAGD,QAAM,QAAQ,MAAM,SAAS,UAAU,IAAI,aAAa;AACxD,QAAM,MAAM,oBAAI,KAAK;AACrB,QAAM,cAAc,WAAW,QAAQ,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AACpE,SAAO,KAAK,gBAAgB;AAAA,IAC1B,CAAC,GAAG,aAAa,gBAAgB,OAAO,WAAW,QAAQ,QAAQ,IAAI,YAAY,CAAC,CAAC;AAAA,IACrF;AAAA,EACF;AACA,SAAO,EAAE,SAAS,wBAAwB,UAAU,GAAG,WAAW,WAAW,OAAO,SAAS,EAAE;AACjG;","names":["c"]}

package/dist/client-AUE3XUPO.js

@@ -0,0 +1,11 @@
+import {
+  openDb,
+  readDbConfig
+} from "./chunk-JHGHLKFS.js";
+import "./chunk-3SF7D4DY.js";
+import "./chunk-6VAL7XJT.js";
+export {
+  openDb,
+  readDbConfig
+};
+//# sourceMappingURL=client-AUE3XUPO.js.map

package/dist/configs/playwright-a11y.js

@@ -2,7 +2,7 @@ import {
   a11yRoutes,
   playwright_a11y_default,
   smokeRoutes
-} from "../chunk-N4MOEF32.js";
+} from "../chunk-C6B4RHXR.js";
 export {
   a11yRoutes,
   playwright_a11y_default as default,

package/dist/configs/svelte.d.ts

@@ -23,6 +23,35 @@ type CspObject = {
     directives?: CspDirectives;
     [k: string]: unknown;
 };
+/**
+ * SHA-256 of Svelte's SSR event-replay stub, `this.__e=event`.
+ *
+ * Svelte emits `onload`/`onerror="this.__e=event"` on any load/error element
+ * (`<img>`, `<iframe>`, …) that carries a spread attribute or a `use:`
+ * directive — i.e. every `<img {...getImageProps(field)} />` the Prismic
+ * helpers produce. The stub stashes an event that fires BEFORE hydration so the
+ * component can replay it once it is alive.
+ *
+ * Hashes do not apply to inline event handlers unless `'unsafe-hashes'` is
+ * present, so without both of these the browser refuses to run the stub: the
+ * pre-hydration `load`/`error` is silently dropped (anything keyed on it — a
+ * fade-in, a fallback swap — can strand) and a `script-src-attr` violation is
+ * reported per image on every page view, burying real violations and hammering
+ * the report endpoint. Measured on beachfront-dentistry 2026-08-13: 12
+ * violations on `/` alone.
+ *
+ * `'unsafe-hashes'` widens hash matching to event handlers; it does NOT permit
+ * arbitrary inline handlers, so only this exact one-liner is allowed. Pair it
+ * with `'unsafe-inline'` and that guarantee is gone — the test asserts we do
+ * not. The stub itself only assigns the event to a property, so an injected
+ * element carrying identical text achieves nothing.
+ *
+ * Verified in Chrome 2026-08-17 against a page served with this policy: the
+ * handler runs and `img.__e.type === "error"`; under the previous baseline it
+ * did not run at all. Re-derive with:
+ *   node -e 'console.log(require("crypto").createHash("sha256").update("this.__e=event").digest("base64"))'
+ */
+declare const SVELTE_EVENT_REPLAY_HASH = "sha256-7dQwUgLau1NFCCGjfn9FsYptB6ZtWxJin6VohGIu20I=";
 /** reddoor-specific options that get transformed into `kit.*`, not passed through. */
 type ReddoorSvelteOptions = {
     /** Inject the baseline CSP (`true`) or the baseline extended with these fields. */
@@ -65,4 +94,4 @@ declare function createSvelteConfig(siteConfig?: SvelteConfigLike & ReddoorSvelt
     compilerOptions: NonNullable<SvelteConfigLike["compilerOptions"]>;
 };
 
-export { type ReddoorSvelteOptions, type SvelteConfigLike, createSvelteConfig, createSvelteConfig as default };
+export { type ReddoorSvelteOptions, SVELTE_EVENT_REPLAY_HASH, type SvelteConfigLike, createSvelteConfig, createSvelteConfig as default };

package/dist/configs/svelte.js

@@ -18,11 +18,18 @@ var CANONICAL_ALIASES = {
   $assets: "src/lib/assets",
   "$assets/*": "src/lib/assets/*"
 };
+var SVELTE_EVENT_REPLAY_HASH = "sha256-7dQwUgLau1NFCCGjfn9FsYptB6ZtWxJin6VohGIu20I=";
 var BASELINE_CSP = {
   mode: "auto",
   directives: {
     "default-src": ["self"],
-    "script-src": ["self", "https://static.cdn.prismic.io", "https://player.vimeo.com"],
+    "script-src": [
+      "self",
+      "https://static.cdn.prismic.io",
+      "https://player.vimeo.com",
+      "unsafe-hashes",
+      SVELTE_EVENT_REPLAY_HASH
+    ],
     "style-src": ["self", "unsafe-inline"],
     "img-src": ["self", "data:", "https://images.prismic.io", "https://*.prismic.io"],
     "media-src": ["self", "https://*.vimeocdn.com"],
@@ -97,6 +104,7 @@ function createSvelteConfig(siteConfig = {}) {
 }
 var svelte_default = createSvelteConfig;
 export {
+  SVELTE_EVENT_REPLAY_HASH,
   createSvelteConfig,
   svelte_default as default
 };

package/dist/configs/svelte.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/configs/svelte.ts"],"sourcesContent":["/**\n * Minimal shape we touch — the full type lives in @sveltejs/kit's `Config`.\n * We don't import it directly to avoid a peer dependency for what amounts\n * to a small config helper. Sites get full type-checking from their own\n * `@sveltejs/kit` install when they invoke createSvelteConfig.\n */\ntype WarningFilter = (warning: { code?: string; message?: string }) => boolean;\n\nexport type SvelteConfigLike = {\n  kit?: unknown;\n  preprocess?: unknown;\n  compilerOptions?: {\n    warningFilter?: WarningFilter;\n    [k: string]: unknown;\n  };\n  [k: string]: unknown;\n};\n\n/** Compiler-level warnings the canonical reddoor stack treats as noise. */\nconst SILENCED_WARNING_CODES = new Set<string>([\n  // `<div ... />` shorthand is widely used across reddoor codebases; the\n  // Svelte 5 strictness change for non-void self-closing tags would flood\n  // dev logs with no actionable signal.\n  \"element_invalid_self_closing_tag\",\n]);\n\nfunction isSilenced(warning: { code?: string }): boolean {\n  return warning.code !== undefined && SILENCED_WARNING_CODES.has(warning.code);\n}\n\n/**\n * Canonical `$lib` aliases shared across the reddoor fleet. Injecting these as\n * defaults means a synced site no longer has to redeclare them (and the\n * sync-configs svelte template no longer clobbers them with a thinner config).\n * Sites can override any entry or add their own — see the merge in\n * createSvelteConfig. Override an alias's bare and `/*` forms together: setting\n * only `$components` while leaving the canonical `$components/*` in place would\n * split `import \"$components\"` and `import \"$components/Foo\"` across two roots.\n */\nconst CANONICAL_ALIASES: Record<string, string> = {\n  $components: \"src/lib/components\",\n  \"$components/*\": \"src/lib/components/*\",\n  $utils: \"src/lib/utils\",\n  \"$utils/*\": \"src/lib/utils/*\",\n  $stores: \"src/lib/stores\",\n  \"$stores/*\": \"src/lib/stores/*\",\n  $assets: \"src/lib/assets\",\n  \"$assets/*\": \"src/lib/assets/*\",\n};\n\ntype CspDirectives = Record<string, string[]>;\ntype CspObject = { mode?: string; directives?: CspDirectives; [k: string]: unknown };\n\n/**\n * Baseline CSP for the reddoor stack (Prismic + Vimeo). Opt-in only — a CSP is\n * breakage-prone, so it is never injected unless a site asks via `csp`. Extend\n * per project by passing `csp: { directives: { ... } }`; named directives\n * replace the baseline entry, unnamed ones are kept. SvelteKit adds\n * nonces/hashes for the inline scripts/styles it emits.\n */\nconst BASELINE_CSP = {\n  mode: \"auto\",\n  directives: {\n    \"default-src\": [\"self\"],\n    \"script-src\": [\"self\", \"https://static.cdn.prismic.io\", \"https://player.vimeo.com\"],\n    \"style-src\": [\"self\", \"unsafe-inline\"],\n    \"img-src\": [\"self\", \"data:\", \"https://images.prismic.io\", \"https://*.prismic.io\"],\n    \"media-src\": [\"self\", \"https://*.vimeocdn.com\"],\n    \"frame-src\": [\"self\", \"https://player.vimeo.com\"],\n    \"connect-src\": [\"self\", \"https://*.prismic.io\", \"https://static.cdn.prismic.io\"],\n    \"font-src\": [\"self\", \"data:\"],\n    \"base-uri\": [\"self\"],\n    \"form-action\": [\"self\"],\n    \"frame-ancestors\": [\"self\"],\n    \"report-uri\": [\"/api/csp-report\"],\n  },\n} satisfies CspObject;\n\n/**\n * Copy a directives map and each of its arrays, so the returned config shares\n * no array reference with the module-level BASELINE_CSP (or with a caller's\n * input). Without this, mutating one config's directive array would poison the\n * shared baseline for every later call.\n */\nfunction cloneDirectives(directives: CspDirectives): CspDirectives {\n  return Object.fromEntries(\n    Object.entries(directives).map(([k, v]) => [k, Array.isArray(v) ? [...v] : v]),\n  );\n}\n\n/** Build a `kit.csp` block from the `csp` option, layering over the baseline. */\nfunction buildCsp(option: true | CspObject): CspObject {\n  const baseDirectives = BASELINE_CSP.directives ?? {};\n  if (option === true) {\n    return { mode: BASELINE_CSP.mode, directives: cloneDirectives(baseDirectives) };\n  }\n  const { directives: siteDirectives, ...rest } = option;\n  return {\n    mode: BASELINE_CSP.mode,\n    ...rest, // allow `mode` override, `reportOnly`, etc.\n    directives: cloneDirectives({ ...baseDirectives, ...(siteDirectives ?? {}) }),\n  };\n}\n\ntype PrerenderErrorDetails = {\n  path?: string;\n  status?: number;\n  message?: string;\n  referrer?: string;\n};\n\n/**\n * Prerender error handler for an un-wired placeholder clone: every Prismic-backed\n * route 404s until the clone points at a real repo, so tolerate 404 to let\n * `pnpm build` / Netlify CI pass. Any other status still throws loudly, and a\n * real site never opts in (so its 404s fail the build as they should).\n */\nfunction placeholderHttpErrorHandler({\n  path,\n  status,\n  message,\n  referrer,\n}: PrerenderErrorDetails): void {\n  if (status === 404) return;\n  throw new Error(`${status} ${path}${referrer ? ` (linked from ${referrer})` : \"\"}: ${message}`);\n}\n\n/** reddoor-specific options that get transformed into `kit.*`, not passed through. */\nexport type ReddoorSvelteOptions = {\n  /** Inject the baseline CSP (`true`) or the baseline extended with these fields. */\n  csp?: true | CspObject;\n  /** Tolerate 404s during prerender — for un-wired placeholder clones only. */\n  placeholder?: boolean;\n};\n\n/**\n * Compose a Svelte/Kit config with the reddoor fleet's canonical pieces layered\n * in. Sites pass their site-specific bits (`kit.adapter`, `preprocess`, etc.)\n * and get back a complete config.\n *\n * Always applied:\n *  - the canonical `compilerOptions.warningFilter` (composes with a site's own:\n *    a warning shows only when both filters allow it);\n *  - the canonical `$components/$utils/$stores/$assets` `kit.alias` entries\n *    (a site's own `kit.alias` overrides per key and may add more).\n *\n * Opt-in (NOT applied unless requested, so adoption never silently changes a\n * site's behavior):\n *  - `csp: true` injects the baseline Prismic+Vimeo CSP; `csp: { directives }`\n *    extends it per-directive. A CSP is breakage-prone, so it is opt-in — a site\n *    that wants the starter's CSP parity must pass `csp`. An explicit `kit.csp`\n *    always wins as an escape hatch.\n *  - `placeholder: true` tolerates 404s during prerender (for an un-wired\n *    placeholder clone only) — like `csp`, a site that wants the starter's\n *    prerender-tolerance parity must pass it; the site computes the signal itself.\n *\n * @example\n *   import { createSvelteConfig } from \"@reddoorla/maintenance/configs/svelte\";\n *   import adapter from \"@sveltejs/adapter-netlify\";\n *\n *   export default createSvelteConfig({\n *     kit: { adapter: adapter() },\n *     csp: true,\n *     placeholder: process.env.VITE_PRISMIC_ENVIRONMENT === \"your-prismic-repo-name\",\n *   });\n */\n\nexport function createSvelteConfig(\n  siteConfig: SvelteConfigLike & ReddoorSvelteOptions = {},\n): SvelteConfigLike & {\n  compilerOptions: NonNullable<SvelteConfigLike[\"compilerOptions\"]>;\n} {\n  // Strip the reddoor-only options so they never leak onto the returned config.\n  const { csp, placeholder, ...rest } = siteConfig;\n\n  const siteCompiler = rest.compilerOptions ?? {};\n  const siteFilter = siteCompiler.warningFilter;\n\n  const siteKit = (rest.kit ?? {}) as Record<string, unknown>;\n  const siteAlias = (siteKit.alias ?? {}) as Record<string, string>;\n\n  const kit: Record<string, unknown> = {\n    ...siteKit,\n    // Canonical aliases first, site entries last so a site can override any\n    // single alias or add its own without losing the fleet defaults.\n    alias: { ...CANONICAL_ALIASES, ...siteAlias },\n  };\n\n  // CSP: opt-in. An explicit `kit.csp` always wins as an escape hatch.\n  if (siteKit.csp !== undefined) {\n    kit.csp = siteKit.csp;\n  } else if (csp) {\n    kit.csp = buildCsp(csp);\n  }\n\n  // Prerender placeholder tolerance: opt-in. A site-provided handler wins.\n  if (placeholder) {\n    const sitePrerender = (siteKit.prerender ?? {}) as Record<string, unknown>;\n    kit.prerender = { handleHttpError: placeholderHttpErrorHandler, ...sitePrerender };\n  }\n\n  return {\n    ...rest,\n    kit,\n    compilerOptions: {\n      ...siteCompiler,\n      warningFilter: (warning) => {\n        if (isSilenced(warning)) return false;\n        return siteFilter ? siteFilter(warning) : true;\n      },\n    },\n  };\n}\n\nexport default createSvelteConfig;\n"],"mappings":";AAmBA,IAAM,yBAAyB,oBAAI,IAAY;AAAA;AAAA;AAAA;AAAA,EAI7C;AACF,CAAC;AAED,SAAS,WAAW,SAAqC;AACvD,SAAO,QAAQ,SAAS,UAAa,uBAAuB,IAAI,QAAQ,IAAI;AAC9E;AAWA,IAAM,oBAA4C;AAAA,EAChD,aAAa;AAAA,EACb,iBAAiB;AAAA,EACjB,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS;AAAA,EACT,aAAa;AACf;AAYA,IAAM,eAAe;AAAA,EACnB,MAAM;AAAA,EACN,YAAY;AAAA,IACV,eAAe,CAAC,MAAM;AAAA,IACtB,cAAc,CAAC,QAAQ,iCAAiC,0BAA0B;AAAA,IAClF,aAAa,CAAC,QAAQ,eAAe;AAAA,IACrC,WAAW,CAAC,QAAQ,SAAS,6BAA6B,sBAAsB;AAAA,IAChF,aAAa,CAAC,QAAQ,wBAAwB;AAAA,IAC9C,aAAa,CAAC,QAAQ,0BAA0B;AAAA,IAChD,eAAe,CAAC,QAAQ,wBAAwB,+BAA+B;AAAA,IAC/E,YAAY,CAAC,QAAQ,OAAO;AAAA,IAC5B,YAAY,CAAC,MAAM;AAAA,IACnB,eAAe,CAAC,MAAM;AAAA,IACtB,mBAAmB,CAAC,MAAM;AAAA,IAC1B,cAAc,CAAC,iBAAiB;AAAA,EAClC;AACF;AAQA,SAAS,gBAAgB,YAA0C;AACjE,SAAO,OAAO;AAAA,IACZ,OAAO,QAAQ,UAAU,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAAA,EAC/E;AACF;AAGA,SAAS,SAAS,QAAqC;AACrD,QAAM,iBAAiB,aAAa,cAAc,CAAC;AACnD,MAAI,WAAW,MAAM;AACnB,WAAO,EAAE,MAAM,aAAa,MAAM,YAAY,gBAAgB,cAAc,EAAE;AAAA,EAChF;AACA,QAAM,EAAE,YAAY,gBAAgB,GAAG,KAAK,IAAI;AAChD,SAAO;AAAA,IACL,MAAM,aAAa;AAAA,IACnB,GAAG;AAAA;AAAA,IACH,YAAY,gBAAgB,EAAE,GAAG,gBAAgB,GAAI,kBAAkB,CAAC,EAAG,CAAC;AAAA,EAC9E;AACF;AAeA,SAAS,4BAA4B;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAAgC;AAC9B,MAAI,WAAW,IAAK;AACpB,QAAM,IAAI,MAAM,GAAG,MAAM,IAAI,IAAI,GAAG,WAAW,iBAAiB,QAAQ,MAAM,EAAE,KAAK,OAAO,EAAE;AAChG;AA0CO,SAAS,mBACd,aAAsD,CAAC,GAGvD;AAEA,QAAM,EAAE,KAAK,aAAa,GAAG,KAAK,IAAI;AAEtC,QAAM,eAAe,KAAK,mBAAmB,CAAC;AAC9C,QAAM,aAAa,aAAa;AAEhC,QAAM,UAAW,KAAK,OAAO,CAAC;AAC9B,QAAM,YAAa,QAAQ,SAAS,CAAC;AAErC,QAAM,MAA+B;AAAA,IACnC,GAAG;AAAA;AAAA;AAAA,IAGH,OAAO,EAAE,GAAG,mBAAmB,GAAG,UAAU;AAAA,EAC9C;AAGA,MAAI,QAAQ,QAAQ,QAAW;AAC7B,QAAI,MAAM,QAAQ;AAAA,EACpB,WAAW,KAAK;AACd,QAAI,MAAM,SAAS,GAAG;AAAA,EACxB;AAGA,MAAI,aAAa;AACf,UAAM,gBAAiB,QAAQ,aAAa,CAAC;AAC7C,QAAI,YAAY,EAAE,iBAAiB,6BAA6B,GAAG,cAAc;AAAA,EACnF;AAEA,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA,iBAAiB;AAAA,MACf,GAAG;AAAA,MACH,eAAe,CAAC,YAAY;AAC1B,YAAI,WAAW,OAAO,EAAG,QAAO;AAChC,eAAO,aAAa,WAAW,OAAO,IAAI;AAAA,MAC5C;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAO,iBAAQ;","names":[]}
+{"version":3,"sources":["../../src/configs/svelte.ts"],"sourcesContent":["/**\n * Minimal shape we touch — the full type lives in @sveltejs/kit's `Config`.\n * We don't import it directly to avoid a peer dependency for what amounts\n * to a small config helper. Sites get full type-checking from their own\n * `@sveltejs/kit` install when they invoke createSvelteConfig.\n */\ntype WarningFilter = (warning: { code?: string; message?: string }) => boolean;\n\nexport type SvelteConfigLike = {\n  kit?: unknown;\n  preprocess?: unknown;\n  compilerOptions?: {\n    warningFilter?: WarningFilter;\n    [k: string]: unknown;\n  };\n  [k: string]: unknown;\n};\n\n/** Compiler-level warnings the canonical reddoor stack treats as noise. */\nconst SILENCED_WARNING_CODES = new Set<string>([\n  // `<div ... />` shorthand is widely used across reddoor codebases; the\n  // Svelte 5 strictness change for non-void self-closing tags would flood\n  // dev logs with no actionable signal.\n  \"element_invalid_self_closing_tag\",\n]);\n\nfunction isSilenced(warning: { code?: string }): boolean {\n  return warning.code !== undefined && SILENCED_WARNING_CODES.has(warning.code);\n}\n\n/**\n * Canonical `$lib` aliases shared across the reddoor fleet. Injecting these as\n * defaults means a synced site no longer has to redeclare them (and the\n * sync-configs svelte template no longer clobbers them with a thinner config).\n * Sites can override any entry or add their own — see the merge in\n * createSvelteConfig. Override an alias's bare and `/*` forms together: setting\n * only `$components` while leaving the canonical `$components/*` in place would\n * split `import \"$components\"` and `import \"$components/Foo\"` across two roots.\n */\nconst CANONICAL_ALIASES: Record<string, string> = {\n  $components: \"src/lib/components\",\n  \"$components/*\": \"src/lib/components/*\",\n  $utils: \"src/lib/utils\",\n  \"$utils/*\": \"src/lib/utils/*\",\n  $stores: \"src/lib/stores\",\n  \"$stores/*\": \"src/lib/stores/*\",\n  $assets: \"src/lib/assets\",\n  \"$assets/*\": \"src/lib/assets/*\",\n};\n\ntype CspDirectives = Record<string, string[]>;\ntype CspObject = { mode?: string; directives?: CspDirectives; [k: string]: unknown };\n\n/**\n * SHA-256 of Svelte's SSR event-replay stub, `this.__e=event`.\n *\n * Svelte emits `onload`/`onerror=\"this.__e=event\"` on any load/error element\n * (`<img>`, `<iframe>`, …) that carries a spread attribute or a `use:`\n * directive — i.e. every `<img {...getImageProps(field)} />` the Prismic\n * helpers produce. The stub stashes an event that fires BEFORE hydration so the\n * component can replay it once it is alive.\n *\n * Hashes do not apply to inline event handlers unless `'unsafe-hashes'` is\n * present, so without both of these the browser refuses to run the stub: the\n * pre-hydration `load`/`error` is silently dropped (anything keyed on it — a\n * fade-in, a fallback swap — can strand) and a `script-src-attr` violation is\n * reported per image on every page view, burying real violations and hammering\n * the report endpoint. Measured on beachfront-dentistry 2026-08-13: 12\n * violations on `/` alone.\n *\n * `'unsafe-hashes'` widens hash matching to event handlers; it does NOT permit\n * arbitrary inline handlers, so only this exact one-liner is allowed. Pair it\n * with `'unsafe-inline'` and that guarantee is gone — the test asserts we do\n * not. The stub itself only assigns the event to a property, so an injected\n * element carrying identical text achieves nothing.\n *\n * Verified in Chrome 2026-08-17 against a page served with this policy: the\n * handler runs and `img.__e.type === \"error\"`; under the previous baseline it\n * did not run at all. Re-derive with:\n *   node -e 'console.log(require(\"crypto\").createHash(\"sha256\").update(\"this.__e=event\").digest(\"base64\"))'\n */\nexport const SVELTE_EVENT_REPLAY_HASH = \"sha256-7dQwUgLau1NFCCGjfn9FsYptB6ZtWxJin6VohGIu20I=\";\n\n/**\n * Baseline CSP for the reddoor stack (Prismic + Vimeo). Opt-in only — a CSP is\n * breakage-prone, so it is never injected unless a site asks via `csp`. Extend\n * per project by passing `csp: { directives: { ... } }`; named directives\n * replace the baseline entry, unnamed ones are kept. SvelteKit adds\n * nonces/hashes for the inline scripts/styles it emits.\n *\n * NOTE: a site overriding `script-src` replaces this entry wholesale, so it must\n * carry `'unsafe-hashes'` + SVELTE_EVENT_REPLAY_HASH itself or it reintroduces\n * the violation above.\n */\nconst BASELINE_CSP = {\n  mode: \"auto\",\n  directives: {\n    \"default-src\": [\"self\"],\n    \"script-src\": [\n      \"self\",\n      \"https://static.cdn.prismic.io\",\n      \"https://player.vimeo.com\",\n      \"unsafe-hashes\",\n      SVELTE_EVENT_REPLAY_HASH,\n    ],\n    \"style-src\": [\"self\", \"unsafe-inline\"],\n    \"img-src\": [\"self\", \"data:\", \"https://images.prismic.io\", \"https://*.prismic.io\"],\n    \"media-src\": [\"self\", \"https://*.vimeocdn.com\"],\n    \"frame-src\": [\"self\", \"https://player.vimeo.com\"],\n    \"connect-src\": [\"self\", \"https://*.prismic.io\", \"https://static.cdn.prismic.io\"],\n    \"font-src\": [\"self\", \"data:\"],\n    \"base-uri\": [\"self\"],\n    \"form-action\": [\"self\"],\n    \"frame-ancestors\": [\"self\"],\n    \"report-uri\": [\"/api/csp-report\"],\n  },\n} satisfies CspObject;\n\n/**\n * Copy a directives map and each of its arrays, so the returned config shares\n * no array reference with the module-level BASELINE_CSP (or with a caller's\n * input). Without this, mutating one config's directive array would poison the\n * shared baseline for every later call.\n */\nfunction cloneDirectives(directives: CspDirectives): CspDirectives {\n  return Object.fromEntries(\n    Object.entries(directives).map(([k, v]) => [k, Array.isArray(v) ? [...v] : v]),\n  );\n}\n\n/** Build a `kit.csp` block from the `csp` option, layering over the baseline. */\nfunction buildCsp(option: true | CspObject): CspObject {\n  const baseDirectives = BASELINE_CSP.directives ?? {};\n  if (option === true) {\n    return { mode: BASELINE_CSP.mode, directives: cloneDirectives(baseDirectives) };\n  }\n  const { directives: siteDirectives, ...rest } = option;\n  return {\n    mode: BASELINE_CSP.mode,\n    ...rest, // allow `mode` override, `reportOnly`, etc.\n    directives: cloneDirectives({ ...baseDirectives, ...(siteDirectives ?? {}) }),\n  };\n}\n\ntype PrerenderErrorDetails = {\n  path?: string;\n  status?: number;\n  message?: string;\n  referrer?: string;\n};\n\n/**\n * Prerender error handler for an un-wired placeholder clone: every Prismic-backed\n * route 404s until the clone points at a real repo, so tolerate 404 to let\n * `pnpm build` / Netlify CI pass. Any other status still throws loudly, and a\n * real site never opts in (so its 404s fail the build as they should).\n */\nfunction placeholderHttpErrorHandler({\n  path,\n  status,\n  message,\n  referrer,\n}: PrerenderErrorDetails): void {\n  if (status === 404) return;\n  throw new Error(`${status} ${path}${referrer ? ` (linked from ${referrer})` : \"\"}: ${message}`);\n}\n\n/** reddoor-specific options that get transformed into `kit.*`, not passed through. */\nexport type ReddoorSvelteOptions = {\n  /** Inject the baseline CSP (`true`) or the baseline extended with these fields. */\n  csp?: true | CspObject;\n  /** Tolerate 404s during prerender — for un-wired placeholder clones only. */\n  placeholder?: boolean;\n};\n\n/**\n * Compose a Svelte/Kit config with the reddoor fleet's canonical pieces layered\n * in. Sites pass their site-specific bits (`kit.adapter`, `preprocess`, etc.)\n * and get back a complete config.\n *\n * Always applied:\n *  - the canonical `compilerOptions.warningFilter` (composes with a site's own:\n *    a warning shows only when both filters allow it);\n *  - the canonical `$components/$utils/$stores/$assets` `kit.alias` entries\n *    (a site's own `kit.alias` overrides per key and may add more).\n *\n * Opt-in (NOT applied unless requested, so adoption never silently changes a\n * site's behavior):\n *  - `csp: true` injects the baseline Prismic+Vimeo CSP; `csp: { directives }`\n *    extends it per-directive. A CSP is breakage-prone, so it is opt-in — a site\n *    that wants the starter's CSP parity must pass `csp`. An explicit `kit.csp`\n *    always wins as an escape hatch.\n *  - `placeholder: true` tolerates 404s during prerender (for an un-wired\n *    placeholder clone only) — like `csp`, a site that wants the starter's\n *    prerender-tolerance parity must pass it; the site computes the signal itself.\n *\n * @example\n *   import { createSvelteConfig } from \"@reddoorla/maintenance/configs/svelte\";\n *   import adapter from \"@sveltejs/adapter-netlify\";\n *\n *   export default createSvelteConfig({\n *     kit: { adapter: adapter() },\n *     csp: true,\n *     placeholder: process.env.VITE_PRISMIC_ENVIRONMENT === \"your-prismic-repo-name\",\n *   });\n */\n\nexport function createSvelteConfig(\n  siteConfig: SvelteConfigLike & ReddoorSvelteOptions = {},\n): SvelteConfigLike & {\n  compilerOptions: NonNullable<SvelteConfigLike[\"compilerOptions\"]>;\n} {\n  // Strip the reddoor-only options so they never leak onto the returned config.\n  const { csp, placeholder, ...rest } = siteConfig;\n\n  const siteCompiler = rest.compilerOptions ?? {};\n  const siteFilter = siteCompiler.warningFilter;\n\n  const siteKit = (rest.kit ?? {}) as Record<string, unknown>;\n  const siteAlias = (siteKit.alias ?? {}) as Record<string, string>;\n\n  const kit: Record<string, unknown> = {\n    ...siteKit,\n    // Canonical aliases first, site entries last so a site can override any\n    // single alias or add its own without losing the fleet defaults.\n    alias: { ...CANONICAL_ALIASES, ...siteAlias },\n  };\n\n  // CSP: opt-in. An explicit `kit.csp` always wins as an escape hatch.\n  if (siteKit.csp !== undefined) {\n    kit.csp = siteKit.csp;\n  } else if (csp) {\n    kit.csp = buildCsp(csp);\n  }\n\n  // Prerender placeholder tolerance: opt-in. A site-provided handler wins.\n  if (placeholder) {\n    const sitePrerender = (siteKit.prerender ?? {}) as Record<string, unknown>;\n    kit.prerender = { handleHttpError: placeholderHttpErrorHandler, ...sitePrerender };\n  }\n\n  return {\n    ...rest,\n    kit,\n    compilerOptions: {\n      ...siteCompiler,\n      warningFilter: (warning) => {\n        if (isSilenced(warning)) return false;\n        return siteFilter ? siteFilter(warning) : true;\n      },\n    },\n  };\n}\n\nexport default createSvelteConfig;\n"],"mappings":";AAmBA,IAAM,yBAAyB,oBAAI,IAAY;AAAA;AAAA;AAAA;AAAA,EAI7C;AACF,CAAC;AAED,SAAS,WAAW,SAAqC;AACvD,SAAO,QAAQ,SAAS,UAAa,uBAAuB,IAAI,QAAQ,IAAI;AAC9E;AAWA,IAAM,oBAA4C;AAAA,EAChD,aAAa;AAAA,EACb,iBAAiB;AAAA,EACjB,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS;AAAA,EACT,aAAa;AACf;AAiCO,IAAM,2BAA2B;AAaxC,IAAM,eAAe;AAAA,EACnB,MAAM;AAAA,EACN,YAAY;AAAA,IACV,eAAe,CAAC,MAAM;AAAA,IACtB,cAAc;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,aAAa,CAAC,QAAQ,eAAe;AAAA,IACrC,WAAW,CAAC,QAAQ,SAAS,6BAA6B,sBAAsB;AAAA,IAChF,aAAa,CAAC,QAAQ,wBAAwB;AAAA,IAC9C,aAAa,CAAC,QAAQ,0BAA0B;AAAA,IAChD,eAAe,CAAC,QAAQ,wBAAwB,+BAA+B;AAAA,IAC/E,YAAY,CAAC,QAAQ,OAAO;AAAA,IAC5B,YAAY,CAAC,MAAM;AAAA,IACnB,eAAe,CAAC,MAAM;AAAA,IACtB,mBAAmB,CAAC,MAAM;AAAA,IAC1B,cAAc,CAAC,iBAAiB;AAAA,EAClC;AACF;AAQA,SAAS,gBAAgB,YAA0C;AACjE,SAAO,OAAO;AAAA,IACZ,OAAO,QAAQ,UAAU,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAAA,EAC/E;AACF;AAGA,SAAS,SAAS,QAAqC;AACrD,QAAM,iBAAiB,aAAa,cAAc,CAAC;AACnD,MAAI,WAAW,MAAM;AACnB,WAAO,EAAE,MAAM,aAAa,MAAM,YAAY,gBAAgB,cAAc,EAAE;AAAA,EAChF;AACA,QAAM,EAAE,YAAY,gBAAgB,GAAG,KAAK,IAAI;AAChD,SAAO;AAAA,IACL,MAAM,aAAa;AAAA,IACnB,GAAG;AAAA;AAAA,IACH,YAAY,gBAAgB,EAAE,GAAG,gBAAgB,GAAI,kBAAkB,CAAC,EAAG,CAAC;AAAA,EAC9E;AACF;AAeA,SAAS,4BAA4B;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAAgC;AAC9B,MAAI,WAAW,IAAK;AACpB,QAAM,IAAI,MAAM,GAAG,MAAM,IAAI,IAAI,GAAG,WAAW,iBAAiB,QAAQ,MAAM,EAAE,KAAK,OAAO,EAAE;AAChG;AA0CO,SAAS,mBACd,aAAsD,CAAC,GAGvD;AAEA,QAAM,EAAE,KAAK,aAAa,GAAG,KAAK,IAAI;AAEtC,QAAM,eAAe,KAAK,mBAAmB,CAAC;AAC9C,QAAM,aAAa,aAAa;AAEhC,QAAM,UAAW,KAAK,OAAO,CAAC;AAC9B,QAAM,YAAa,QAAQ,SAAS,CAAC;AAErC,QAAM,MAA+B;AAAA,IACnC,GAAG;AAAA;AAAA;AAAA,IAGH,OAAO,EAAE,GAAG,mBAAmB,GAAG,UAAU;AAAA,EAC9C;AAGA,MAAI,QAAQ,QAAQ,QAAW;AAC7B,QAAI,MAAM,QAAQ;AAAA,EACpB,WAAW,KAAK;AACd,QAAI,MAAM,SAAS,GAAG;AAAA,EACxB;AAGA,MAAI,aAAa;AACf,UAAM,gBAAiB,QAAQ,aAAa,CAAC;AAC7C,QAAI,YAAY,EAAE,iBAAiB,6BAA6B,GAAG,cAAc;AAAA,EACnF;AAEA,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA,iBAAiB;AAAA,MACf,GAAG;AAAA,MACH,eAAe,CAAC,YAAY;AAC1B,YAAI,WAAW,OAAO,EAAG,QAAO;AAChC,eAAO,aAAa,WAAW,OAAO,IAAI;AAAA,MAC5C;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAO,iBAAQ;","names":[]}

package/dist/{convert-to-pnpm-AT52NWZB.js → convert-to-pnpm-6L6P74WR.js}

@@ -5,20 +5,20 @@ import {
   appendSkipNotice,
   fleetWorkdir,
   prepareFleetSites
-} from "./chunk-ZMIPG6TR.js";
+} from "./chunk-TVL5MVUF.js";
 import {
   resolveSites
-} from "./chunk-7J53SUT6.js";
+} from "./chunk-P2FE5AI6.js";
 import {
   convertToPnpm
-} from "./chunk-RJB3QUSP.js";
-import "./chunk-ZTPPCHDB.js";
+} from "./chunk-XIDUYLSR.js";
+import "./chunk-3G25KIWW.js";
 import "./chunk-OTGB6YQO.js";
-import "./chunk-FDIFTIXC.js";
-import "./chunk-4DHQCN5H.js";
-import "./chunk-XXTZBPUY.js";
+import "./chunk-6TWWY7ZU.js";
+import "./chunk-EVBCK2KC.js";
 import "./chunk-XTK5VIQB.js";
-import "./chunk-U5SZ4FOP.js";
+import "./chunk-LBYOLBW7.js";
+import "./chunk-XXTZBPUY.js";
 
 // src/cli/commands/convert-to-pnpm.ts
 import { resolve } from "path";
@@ -51,4 +51,4 @@ async function runConvertToPnpmCommand(site, opts) {
 export {
   runConvertToPnpmCommand
 };
-//# sourceMappingURL=convert-to-pnpm-AT52NWZB.js.map
+//# sourceMappingURL=convert-to-pnpm-6L6P74WR.js.map