@reddoorla/maintenance 0.85.2 → 0.86.0

package/dist/cli/bin.js

@@ -111,7 +111,7 @@ cli.command("sync-configs [site]", "Sync canonical configs into a site.").option
   'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../sync-configs-CJXUX6MD.js")).runSyncConfigsCommand(site, opts),
+    async () => (await import("../sync-configs-3SE6PSCO.js")).runSyncConfigsCommand(site, opts),
     opts
   )
 );
@@ -120,7 +120,7 @@ cli.command("bump-deps [site]", "Bump dependencies.").option("--group <group>",
   'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../bump-deps-SWJB6H5V.js")).runBumpDepsCommand(site, opts),
+    async () => (await import("../bump-deps-EC74CPLS.js")).runBumpDepsCommand(site, opts),
     opts
   )
 );
@@ -129,7 +129,7 @@ cli.command(
   "Bootstrap a repo to keep itself updated (Renovate + protection; platform auto-merge off; ci.yml is the starter's, not managed here)."
 ).option("--dry", "List what would be enabled without writing or opening PRs").option("--fleet <inventory>", 'Inventory file (.json or .mjs/.js), or "airtable"').option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../self-updating-PPQVV6UA.js")).runSelfUpdatingCommand(site, opts),
+    async () => (await import("../self-updating-6DWI2Z56.js")).runSelfUpdatingCommand(site, opts),
     opts
   )
 );
@@ -138,7 +138,7 @@ cli.command(
   "Add the Prismic model delivery workflow to a site via PR (one PR per repo; never pushes to main)."
 ).option("--dry", "List the sites that would be offered the workflow, without opening any PR").option("--fleet <inventory>", 'Inventory file (.json or .mjs/.js), or "airtable"').option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../prismic-ci-UTQ6LRR3.js")).runPrismicCiCommand(site, opts),
+    async () => (await import("../prismic-ci-3RHOZUUT.js")).runPrismicCiCommand(site, opts),
     opts
   )
 );
@@ -153,7 +153,7 @@ cli.command(
   "Write the report to this file (the CI workflow posts it as a PR comment)"
 ).action(
   async (site, opts) => runOrExit(
-    async () => (await import("../prismic-models-PVES6R5V.js")).runPrismicModelsCommand(site, opts),
+    async () => (await import("../prismic-models-QBGUT2Q3.js")).runPrismicModelsCommand(site, opts),
     opts
   )
 );
@@ -162,7 +162,7 @@ cli.command("upgrade <upgrade> [site]", "Run a named upgrade recipe (svelte-4-to
   'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (upgrade, site, opts) => runOrExit(
-    async () => (await import("../upgrade-WLX27UPC.js")).runUpgradeCommand(upgrade, site, opts),
+    async () => (await import("../upgrade-WBRQ62FX.js")).runUpgradeCommand(upgrade, site, opts),
     opts
   )
 );
@@ -174,7 +174,7 @@ cli.command(
   'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../convert-to-pnpm-AT52NWZB.js")).runConvertToPnpmCommand(site, opts),
+    async () => (await import("../convert-to-pnpm-6L6P74WR.js")).runConvertToPnpmCommand(site, opts),
     opts
   )
 );
@@ -183,7 +183,7 @@ cli.command("svelte-codemods [site]", "Apply Svelte 5 gotcha codemods to an alre
   'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../svelte-codemods-ZOBDHIES.js")).runSvelteCodemodsCommand(site, opts),
+    async () => (await import("../svelte-codemods-25J2FO22.js")).runSvelteCodemodsCommand(site, opts),
     opts
   )
 );
@@ -195,7 +195,7 @@ cli.command(
   'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../health-endpoint-242WG2OJ.js")).runHealthEndpointCommand(site, opts),
+    async () => (await import("../health-endpoint-WJC2UMYS.js")).runHealthEndpointCommand(site, opts),
     opts
   )
 );
@@ -207,7 +207,7 @@ cli.command(
   'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../smoke-suite-TMCSOYRK.js")).runSmokeSuiteCommand(site, opts),
+    async () => (await import("../smoke-suite-VYY2LXM2.js")).runSmokeSuiteCommand(site, opts),
     opts
   )
 );
@@ -219,7 +219,7 @@ cli.command(
   'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../onboard-53CITIM7.js")).runOnboardCommand(site, opts),
+    async () => (await import("../onboard-GK4PHPNI.js")).runOnboardCommand(site, opts),
     opts
   )
 );
@@ -230,20 +230,20 @@ cli.command(
   "--fleet <inventory>",
   'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
-  async (site, opts) => runOrExit(async () => (await import("../init-JN26NTWF.js")).runInitCommand(site, opts), opts)
+  async (site, opts) => runOrExit(async () => (await import("../init-NJEOEO7I.js")).runInitCommand(site, opts), opts)
 );
 cli.command(
   "launch <site>",
   "Bootstrap + first-audit a site, then draft its launch email for approval."
 ).action(
   async (site, opts) => runOrExit(
-    async () => (await import("../launch-JA7Z4CIM.js")).runLaunchCommand(site, opts),
+    async () => (await import("../launch-XNAX427U.js")).runLaunchCommand(site, opts),
     opts
   )
 );
 cli.command("header-image [site]", "Generate a site's report header image from its live homepage.").option("--all", "Every live site with no Header image yet (backfill)").option("--force", "With --all, regenerate sites that already have one").option("--write-airtable", "Upload to the Websites row instead of writing a local file").option("--out-dir <path>", "Directory for local output (default: reports/)").option("--settle-ms <ms>", "Override the post-load settle delay for slow/animated homepages").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../header-image-T7XD37JL.js")).runHeaderImageCommand(site, opts),
+    async () => (await import("../header-image-AWLLQA4L.js")).runHeaderImageCommand(site, opts),
     opts
   )
 );
@@ -252,7 +252,7 @@ cli.command(
   "Draft the monthly-report announcement email for maintenance sites (all, or one) for approval."
 ).action(
   async (site, opts) => runOrExit(
-    async () => (await import("../announce-GIAYN67S.js")).runAnnounceCommand(site, opts),
+    async () => (await import("../announce-MXTUQ6C7.js")).runAnnounceCommand(site, opts),
     opts
   )
 );
@@ -261,7 +261,7 @@ cli.command(
   "Show who a form submission would email, and optionally flip the pre-launch guard (read-back confirmed)."
 ).option("--set <on|off>", "Flip the guard: on = route to operator, off = restore.").option("--restore <status>", "Status to restore with --set off. Required; never inferred.").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../forms-notify-target-TWN4EH6K.js")).runFormsNotifyTargetCommand(
+    async () => (await import("../forms-notify-target-75U6OU7L.js")).runFormsNotifyTargetCommand(
       site,
       opts
     ),
@@ -273,7 +273,7 @@ cli.command(
   "Operator self-tests. kind=email: preview a report email for a site (or --all) to yourself."
 ).option("--type <type>", "Report type: announcement (default) | maintenance | testing | launch").option("--to <addr>", "Recipient(s), comma-separated. Default: OPERATOR_EMAIL.").option("--all", "Send a preview for every maintenance site (to --to/operator).").option("--dry-run", "Render only; write reports/<slug>/selftest-<type>.html; do not send.").action(
   async (kind, site, opts) => runOrExit(
-    async () => (await import("../selftest-CQ6NOX52.js")).runSelftestCommand(kind, site, opts),
+    async () => (await import("../selftest-RC36MTKP.js")).runSelftestCommand(kind, site, opts),
     opts
   )
 );
@@ -285,13 +285,31 @@ cli.command(
   "Fleet mode: announcement\u2192maintenance sites; maintenance/testing\u2192all schedulable sites."
 ).action(
   async (site, opts) => runOrExit(
-    async () => (await import("../preflight-3XPDUHFJ.js")).runPreflightCommand(site, opts),
+    async () => (await import("../preflight-6WBNU2GZ.js")).runPreflightCommand(site, opts),
     opts
   )
 );
 cli.command("ensure-site <slug>", "Create/verify the Airtable Websites row for a new site.").option("--name <display name>", "Human Name for the row (client-facing copy uses it verbatim).").option("--url <url>", "Deployed URL (e.g. the Netlify site URL).").option("--contact <email>", "point of contact \u2014 the client address reports resolve to.").option("--git-repo <owner/repo>", "GitHub identity. Default on create: reddoorla/<slug>.").action(
   async (slug, opts) => runOrExit(
-    async () => (await import("../ensure-site-S25MDDHW.js")).runEnsureSiteCommand(slug, opts),
+    async () => (await import("../ensure-site-DFTB7MN3.js")).runEnsureSiteCommand(slug, opts),
+    opts
+  )
+);
+cli.command(
+  "prospect-audit <url>",
+  "AEO/SEO audit an external prospect's site and publish the report."
+).option(
+  "--business <name>",
+  "The prospect's business name (defaults to what the model reads off the site)."
+).option(
+  "--competitors <list>",
+  "Comma-separated competitor domains to add comparison probes for."
+).option("--no-probes", "Skip the live AI-visibility probes (tier 3).").option("--out <file>", "Also write the rendered report to this file.").option("--json", "Print the raw result JSON instead of the report summary.").option(
+  "--email",
+  "Email the internal sheet (scores, what wasn't measured, top fixes, the link) to PROSPECT_AUDIT_RECIPIENTS."
+).action(
+  async (url, opts) => runOrExit(
+    async () => (await import("../prospect-audit-IUNCJ2LV.js")).runProspectAuditCommand(url, opts),
     opts
   )
 );
@@ -309,7 +327,7 @@ cli.command("report [site]", "Draft or send maintenance/testing reports.").optio
   "Email the operator one daily digest of reports ready for approval (skips when empty)."
 ).action(
   async (site, opts) => runOrExit(
-    async () => (await import("../report-6CKSWJNG.js")).runReportCommand(site, opts),
+    async () => (await import("../report-4EVNDHOZ.js")).runReportCommand(site, opts),
     opts
   )
 );
@@ -318,7 +336,7 @@ cli.command(
   "Sweep the fleet for GitHub signals (Renovate-failing/CI/last-commit) and write Airtable."
 ).option("--fleet", "Run across every site in the Airtable inventory.").option("--write-airtable", "Write each site's signals back to its Websites row.").action(
   async (opts) => runOrExit(
-    async () => (await import("../github-signals-G4ILZAJ6.js")).runGitHubSignalsCommand({
+    async () => (await import("../github-signals-IJUPGCUX.js")).runGitHubSignalsCommand({
       fleet: opts.fleet,
       writeAirtable: opts.writeAirtable
     }),
@@ -330,7 +348,7 @@ cli.command(
   "Verify every public org repo carries a sound branch ruleset (empty bypass, PR-required)."
 ).option("--org <org>", "GitHub org to sweep (enumerated from the API, never a hand list).").action(
   async (opts) => runOrExit(
-    async () => (await import("../protection-audit-64PLLBLI.js")).runProtectionAuditCommand({
+    async () => (await import("../protection-audit-SJO53MEQ.js")).runProtectionAuditCommand({
       org: opts.org
     }),
     opts
@@ -338,9 +356,9 @@ cli.command(
 );
 cli.command(
   "db <action>",
-  "Migrate / backfill / reconcile the libSQL store (migrate | backfill | reconcile)."
-).action(
-  async (action, opts) => runOrExit(async () => (await import("../db-JSIZYT23.js")).runDbCommand(action, opts), opts)
+  "Operate the libSQL store (migrate | replay-deadletters | import-airtable | parity | sync | backfill-header-images | dump | verify-dump)."
+).option("--file <path>", "verify-dump: the dump file to load into a scratch engine").action(
+  async (action, opts) => runOrExit(async () => (await import("../db-B35OGV3G.js")).runDbCommand(action, opts), opts)
 );
 cli.command(
   "submissions <action>",
@@ -350,7 +368,7 @@ cli.command(
   "Write the re-buckets: status \u2192 spam_auto, spam_score/spam_reason replaced with the new verdict + 'retro-rescore' marker."
 ).action(
   async (action, opts) => runOrExit(
-    async () => (await import("../submissions-GJ6ITBRH.js")).runSubmissionsCommand(action, opts),
+    async () => (await import("../submissions-Q7DRFOCD.js")).runSubmissionsCommand(action, opts),
     opts
   )
 );
@@ -359,7 +377,7 @@ cli.command(
   "Trigger Renovate on fleet sites the security sweep flagged with critical/high vulns."
 ).option("--fleet", "Run across every active, repo-backed site in the Airtable inventory.").action(
   async (opts) => runOrExit(
-    async () => (await import("../renovate-dispatch-ICJGSFCE.js")).runRenovateDispatchCommand({
+    async () => (await import("../renovate-dispatch-QJY75ODR.js")).runRenovateDispatchCommand({
       fleet: opts.fleet
     }),
     opts
@@ -397,7 +415,7 @@ cli.command(
   "Output directory for capture (default: webflow-out) / docs (default: dirname of the ir.json)"
 ).action(
   async (action, target, opts) => runOrExit(
-    async () => (await import("../webflow-624FEBFD.js")).runWebflowCommand(action, target, opts),
+    async () => (await import("../webflow-IRKOIT7S.js")).runWebflowCommand(action, target, opts),
     opts
   )
 );

package/dist/cli/bin.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/cli/bin.ts","../../src/cli/version.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { dirname } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport { cac } from \"cac\";\nimport type { AuditName, RecipeName } from \"../types.js\";\nimport { loadCredentialsIntoEnv } from \"../util/credentials.js\";\nimport { resolvePackageVersion } from \"./version.js\";\n\n// Command modules are loaded LAZILY (dynamic `import()` inside each `.action()`),\n// never eagerly at the top. An eager `import { runReportCommand } from\n// \"./commands/report.js\"` would pull EVERY command's transitive dependency chain\n// into the CLI's startup graph — report/announce/launch drag in mjml + resend +\n// @google-analytics/data, `db` drags in the libSQL/kysely stack, etc. Those heavy\n// packages are `devDependencies` (this repo's CLI/functions/audits use them); a\n// consuming fleet site installs @reddoorla/maintenance only for `./forms` +\n// `./configs/*` and runs just `reddoor-maint audit --only a11y` in CI. Lazy\n// loading keeps that path (and `--help`/`--version`) free of the report/db\n// chains, so those packages never land in a consumer's node_modules. The\n// smoke-dist gate asserts bin.js's STATIC import closure stays free of them.\n\n// Load credentials from ~/.config/reddoor-maint/credentials.env before any\n// command runs, so AIRTABLE_PAT/AIRTABLE_BASE_ID/RESEND_API_KEY/etc. are\n// available from any cwd. Shell-exported env vars still win. Silent on\n// missing file — commands that need the credentials will fail with their\n// own clear error.\nloadCredentialsIntoEnv();\n\nconst here = dirname(fileURLToPath(import.meta.url));\nconst version = resolvePackageVersion(here);\n\nconst AUDIT_DESCRIPTIONS: Record<AuditName, string> = {\n  deps: \"Diff site package.json against the bundled baseline version map.\",\n  lighthouse: \"Run @lhci/cli autorun using the canonical lighthouserc.\",\n  a11y: \"Playwright + axe against the canonical a11y routes.\",\n  security:\n    \"GitHub Dependabot alerts (prod+dev) for repo-backed sites; falls back to pnpm/npm audit (prod-deps) with no repo/token.\",\n  lint: \"ESLint + Prettier using the canonical configs.\",\n  domain: \"DNS resolve + TLS cert expiry against the deployed URL (checkout-free).\",\n  browser:\n    \"Playwright across desktop engines + mobile devices + link-check against the deployed URL (checkout-free).\",\n  \"netlify-deploy\":\n    \"Latest production deploy health via the Netlify API by site id (checkout-free; needs NETLIFY_PAT).\",\n  \"function-health\":\n    \"GET {deployedUrl}/health and read its ok/prismic/forms status (checkout-free).\",\n  smoke: \"Run the site's own `pnpm test:smoke` suite in its checkout (clone-based).\",\n  \"form-e2e\":\n    \"Submit the real production contact form in test-mode against the deployed URL (checkout-free).\",\n};\n\nconst RECIPE_DESCRIPTIONS: Record<RecipeName, string> = {\n  \"sync-configs\": \"Overwrite a site's canonical configs to match @reddoorla/maintenance.\",\n  \"bump-deps\": \"Bump dependencies and commit the lockfile change.\",\n  \"svelte-4-to-5\": \"Run the 7-commit Svelte 4 → 5 upgrade recipe.\",\n  \"svelte-codemods\":\n    \"Apply Svelte 5 gotcha codemods to an already-migrated site (state_referenced_locally, etc.).\",\n  \"convert-to-pnpm\": \"Convert an npm/yarn site to pnpm (lockfile, packageManager, scripts).\",\n  onboard: \"Install @reddoorla/maintenance + audit deps on a site (preferred first step).\",\n  \"a11y-fixtures-page\":\n    \"Write src/routes/dev/a11y-fixtures/+page.svelte (stub for lhci + axe targets).\",\n  \"health-endpoint\":\n    \"Write src/routes/health/+server.ts (function-health probe for the report gate).\",\n  \"smoke-suite\": \"Add the smoke suite (test:smoke + playwright config + /health smoke routes).\",\n  \"self-updating\":\n    \"Bootstrap Renovate + repo protection (writes renovate configs via PR, wires ruleset, disables platform auto-merge; ci.yml comes from the starter and is deliberately not managed).\",\n  \"prismic-ci\":\n    \"Add the Prismic model delivery workflow to a site via PR (dry delta comment on PRs, push to Prismic on merge to main).\",\n  init: \"Run the full onboarding chain (convert-to-pnpm → onboard → sync-configs → svelte-codemods → a11y-fixtures-page → health-endpoint → smoke-suite → audit).\",\n};\n\n/** Run a command thunk and surface its result, falling back to a clean error\n * message on throw. Wraps the ~10-line try/catch every `.action()` used to\n * duplicate. `verbose` flips between full stack and message-only.\n *\n * On success it sets `process.exitCode` and RETURNS rather than calling\n * `process.exit()` right after `console.log()`. `process.exit()` does not wait\n * for stdout to flush when stdout is a pipe, so a large `--json` payload piped\n * to another process would get truncated mid-write. Setting `exitCode` and\n * returning lets Node drain stdout and exit naturally with the right code. A\n * non-zero `code` still yields a non-zero process exit.\n *\n * The error path keeps `process.exit()` — error messages are small (one line),\n * always go to stderr, and exiting immediately is the desired fail-fast. */\nexport async function runOrExit(\n  fn: () => Promise<{ output: string; code: number }>,\n  opts: { verbose?: boolean },\n): Promise<void> {\n  try {\n    const { output, code } = await fn();\n    console.log(output);\n    process.exitCode = code;\n    return;\n  } catch (err) {\n    const e = err as { exitCode?: number; message?: string; stack?: string };\n    console.error(opts.verbose ? (e.stack ?? e.message) : (e.message ?? String(err)));\n    process.exit(e.exitCode ?? 1);\n  }\n}\n\nconst cli = cac(\"reddoor-maint\");\n\ncli.option(\"--cwd <path>\", \"Override working directory (default: process.cwd())\");\ncli.option(\"--verbose\", \"Verbose output (full stack on errors)\");\n\ncli.command(\"list-audits\", \"Print the available audits.\").action(() => {\n  for (const [name, desc] of Object.entries(AUDIT_DESCRIPTIONS)) {\n    console.log(`${name.padEnd(12)} ${desc}`);\n  }\n});\n\ncli.command(\"list-recipes\", \"Print the available recipes.\").action(() => {\n  for (const [name, desc] of Object.entries(RECIPE_DESCRIPTIONS)) {\n    console.log(`${name.padEnd(16)} ${desc}`);\n  }\n});\n\ncli\n  .command(\"audit [site]\", \"Run audits against a site (default: cwd).\")\n  .option(\"--only <names>\", \"Comma-separated audit names (e.g. deps,lighthouse)\")\n  .option(\"--json\", \"Machine-readable JSON output\")\n  .option(\n    \"--fleet <inventory>\",\n    'Inventory file (.json or .mjs/.js), or \"airtable\" to read from Websites table',\n  )\n  .option(\"--workdir <path>\", \"Clone target for fleet mode (default ~/.reddoor-maint/sites)\")\n  .option(\n    \"--write-airtable [slug]\",\n    \"After lighthouse runs, write pScore/rScore/bpScore/seoScore + timestamp to the matching Websites row. Slug defaults to cwd's package.json#name.\",\n  )\n  .option(\"--fail-on-violations\", \"Exit non-zero if any a11y violations are found (for CI gates)\")\n  .option(\n    \"--url <url>\",\n    \"Audit this deployed URL with lighthouse (no dev server); single-site. Pair with --only lighthouse — other audits still use the local checkout.\",\n  )\n  .option(\n    \"--concurrency <n>\",\n    \"Max sites to audit in parallel in --fleet mode (default: all at once). Use 1 for sequential (CI).\",\n  )\n  .action(\n    async (\n      site,\n      opts: {\n        only?: string;\n        json?: boolean;\n        fleet?: string;\n        workdir?: string;\n        cwd?: string;\n        verbose?: boolean;\n        writeAirtable?: string | boolean;\n        failOnViolations?: boolean;\n        url?: string;\n        concurrency?: string;\n      },\n    ) =>\n      runOrExit(\n        async () => (await import(\"./commands/audit.js\")).runAuditCommand(site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\"sync-configs [site]\", \"Sync canonical configs into a site.\")\n  .option(\"--only <names>\", \"Comma-separated config names (e.g. eslint,prettier)\")\n  .option(\"--dry\", \"Print diff without writing\")\n  .option(\n    \"--fleet <inventory>\",\n    'Inventory file (.json or .mjs/.js), or \"airtable\" to read from Websites table',\n  )\n  .option(\"--workdir <path>\", \"Clone target for fleet mode (default ~/.reddoor-maint/sites)\")\n  .action(\n    async (\n      site,\n      opts: {\n        only?: string;\n        dry?: boolean;\n        fleet?: string;\n        workdir?: string;\n        cwd?: string;\n        verbose?: boolean;\n      },\n    ) =>\n      runOrExit(\n        async () => (await import(\"./commands/sync-configs.js\")).runSyncConfigsCommand(site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\"bump-deps [site]\", \"Bump dependencies.\")\n  .option(\"--group <group>\", \"patch | minor | major\", { default: \"minor\" })\n  .option(\n    \"--fleet <inventory>\",\n    'Inventory file (.json or .mjs/.js), or \"airtable\" to read from Websites table',\n  )\n  .option(\"--workdir <path>\", \"Clone target for fleet mode (default ~/.reddoor-maint/sites)\")\n  .action(\n    async (\n      site,\n      opts: {\n        group?: string;\n        fleet?: string;\n        workdir?: string;\n        cwd?: string;\n        verbose?: boolean;\n      },\n    ) =>\n      runOrExit(\n        async () => (await import(\"./commands/bump-deps.js\")).runBumpDepsCommand(site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\n    \"self-updating [site]\",\n    \"Bootstrap a repo to keep itself updated (Renovate + protection; platform auto-merge off; ci.yml is the starter's, not managed here).\",\n  )\n  .option(\"--dry\", \"List what would be enabled without writing or opening PRs\")\n  .option(\"--fleet <inventory>\", 'Inventory file (.json or .mjs/.js), or \"airtable\"')\n  .option(\"--workdir <path>\", \"Clone target for fleet mode (default ~/.reddoor-maint/sites)\")\n  .action(\n    async (\n      site,\n      opts: {\n        dry?: boolean;\n        fleet?: string;\n        workdir?: string;\n        cwd?: string;\n        verbose?: boolean;\n      },\n    ) =>\n      runOrExit(\n        async () =>\n          (await import(\"./commands/self-updating.js\")).runSelfUpdatingCommand(site, opts),\n        opts,\n      ),\n  );\n\n// Fleet-wide, this opens ONE PULL REQUEST PER REPOSITORY and never pushes to a\n// client's main. `--dry` exists because that is the only way to see the blast\n// radius before firing it. Both directions of the flag ↔ option link are pinned\n// by tests/cli/prismic-ci-command.test.ts.\ncli\n  .command(\n    \"prismic-ci [site]\",\n    \"Add the Prismic model delivery workflow to a site via PR (one PR per repo; never pushes to main).\",\n  )\n  .option(\"--dry\", \"List the sites that would be offered the workflow, without opening any PR\")\n  .option(\"--fleet <inventory>\", 'Inventory file (.json or .mjs/.js), or \"airtable\"')\n  .option(\"--workdir <path>\", \"Clone target for fleet mode (default ~/.reddoor-maint/sites)\")\n  .action(\n    async (\n      site,\n      opts: {\n        dry?: boolean;\n        fleet?: string;\n        workdir?: string;\n        cwd?: string;\n        verbose?: boolean;\n      },\n    ) =>\n      runOrExit(\n        async () => (await import(\"./commands/prismic-ci.js\")).runPrismicCiCommand(site, opts),\n        opts,\n      ),\n  );\n\n// EVERY flag below must be one the command actually reads, and every option the\n// command reads must appear below. cac rejects an unknown option outright, so a\n// missing line here is a hard error in whatever workflow types the flag; a line\n// here with no handler is the silent no-op — it parses, it lands in `opts`, and\n// nothing ever looks at it. Both directions are pinned by\n// tests/cli/prismic-models-registration.test.ts, the second one at the type level\n// against `PrismicModelsCommandOptions`.\ncli\n  .command(\n    \"prismic-models [site]\",\n    \"Compare a site's Prismic models against its repo (dry by default).\",\n  )\n  .option(\n    \"--apply\",\n    \"Push local models to Prismic. Never deletes — remote-only models are reported.\",\n  )\n  .option(\"--pull\", \"Write remote-only models into the repo (single-site; review + PR the result).\")\n  .option(\"--tokens\", \"Print the per-site write-token doctor: which env var, present?, reads?\")\n  .option(\"--fleet <inventory>\", 'Inventory file (.json or .mjs/.js), or \"airtable\". Read-only.')\n  .option(\"--workdir <path>\", \"Clone target for fleet mode (default ~/.reddoor-maint/sites)\")\n  .option(\"--write-airtable\", \"Fleet mode: persist each site's verdict to its Websites row\")\n  .option(\n    \"--comment-file <path>\",\n    \"Write the report to this file (the CI workflow posts it as a PR comment)\",\n  )\n  .action(\n    async (\n      site,\n      opts: {\n        apply?: boolean;\n        pull?: boolean;\n        tokens?: boolean;\n        fleet?: string;\n        workdir?: string;\n        writeAirtable?: boolean;\n        commentFile?: string;\n        cwd?: string;\n        verbose?: boolean;\n      },\n    ) =>\n      runOrExit(\n        async () =>\n          (await import(\"./commands/prismic-models.js\")).runPrismicModelsCommand(site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\"upgrade <upgrade> [site]\", \"Run a named upgrade recipe (svelte-4-to-5).\")\n  .example(\"reddoor-maint upgrade svelte-4-to-5 ./my-site\")\n  .option(\n    \"--fleet <inventory>\",\n    'Inventory file (.json or .mjs/.js), or \"airtable\" to read from Websites table',\n  )\n  .option(\"--workdir <path>\", \"Clone target for fleet mode (default ~/.reddoor-maint/sites)\")\n  .action(\n    async (\n      upgrade: string,\n      site: string | undefined,\n      opts: { fleet?: string; workdir?: string; cwd?: string; verbose?: boolean },\n    ) =>\n      runOrExit(\n        async () => (await import(\"./commands/upgrade.js\")).runUpgradeCommand(upgrade, site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\n    \"convert-to-pnpm [site]\",\n    \"Convert an npm/yarn site to pnpm (lockfile, packageManager, scripts).\",\n  )\n  .option(\n    \"--fleet <inventory>\",\n    'Inventory file (.json or .mjs/.js), or \"airtable\" to read from Websites table',\n  )\n  .option(\"--workdir <path>\", \"Clone target for fleet mode (default ~/.reddoor-maint/sites)\")\n  .action(\n    async (site, opts: { fleet?: string; workdir?: string; cwd?: string; verbose?: boolean }) =>\n      runOrExit(\n        async () =>\n          (await import(\"./commands/convert-to-pnpm.js\")).runConvertToPnpmCommand(site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\"svelte-codemods [site]\", \"Apply Svelte 5 gotcha codemods to an already-migrated site.\")\n  .option(\n    \"--fleet <inventory>\",\n    'Inventory file (.json or .mjs/.js), or \"airtable\" to read from Websites table',\n  )\n  .option(\"--workdir <path>\", \"Clone target for fleet mode (default ~/.reddoor-maint/sites)\")\n  .action(\n    async (site, opts: { fleet?: string; workdir?: string; cwd?: string; verbose?: boolean }) =>\n      runOrExit(\n        async () =>\n          (await import(\"./commands/svelte-codemods.js\")).runSvelteCodemodsCommand(site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\n    \"health-endpoint [site]\",\n    \"Write src/routes/health/+server.ts (function-health probe for the report gate).\",\n  )\n  .option(\n    \"--fleet <inventory>\",\n    'Inventory file (.json or .mjs/.js), or \"airtable\" to read from Websites table',\n  )\n  .option(\"--workdir <path>\", \"Clone target for fleet mode (default ~/.reddoor-maint/sites)\")\n  .action(\n    async (site, opts: { fleet?: string; workdir?: string; cwd?: string; verbose?: boolean }) =>\n      runOrExit(\n        async () =>\n          (await import(\"./commands/health-endpoint.js\")).runHealthEndpointCommand(site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\n    \"smoke-suite [site]\",\n    \"Add the smoke suite (test:smoke + playwright config + /health smoke routes).\",\n  )\n  .option(\n    \"--fleet <inventory>\",\n    'Inventory file (.json or .mjs/.js), or \"airtable\" to read from Websites table',\n  )\n  .option(\"--workdir <path>\", \"Clone target for fleet mode (default ~/.reddoor-maint/sites)\")\n  .action(\n    async (site, opts: { fleet?: string; workdir?: string; cwd?: string; verbose?: boolean }) =>\n      runOrExit(\n        async () => (await import(\"./commands/smoke-suite.js\")).runSmokeSuiteCommand(site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\n    \"onboard [site]\",\n    \"Install @reddoorla/maintenance + audit deps on a site (run after convert-to-pnpm).\",\n  )\n  .option(\"--audits <names>\", \"Comma-separated audit subset: lighthouse,a11y (default: both)\")\n  .option(\n    \"--fleet <inventory>\",\n    'Inventory file (.json or .mjs/.js), or \"airtable\" to read from Websites table',\n  )\n  .option(\"--workdir <path>\", \"Clone target for fleet mode (default ~/.reddoor-maint/sites)\")\n  .action(\n    async (\n      site,\n      opts: {\n        audits?: string;\n        fleet?: string;\n        workdir?: string;\n        cwd?: string;\n        verbose?: boolean;\n      },\n    ) =>\n      runOrExit(\n        async () => (await import(\"./commands/onboard.js\")).runOnboardCommand(site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\n    \"init [site]\",\n    \"One-shot guided onboarding: convert-to-pnpm → onboard → sync-configs → svelte-codemods → a11y-fixtures-page → health-endpoint → smoke-suite → audit.\",\n  )\n  .option(\n    \"--fleet <inventory>\",\n    'Inventory file (.json or .mjs/.js), or \"airtable\" to read from Websites table',\n  )\n  .option(\"--workdir <path>\", \"Clone target for fleet mode (default ~/.reddoor-maint/sites)\")\n  .action(\n    async (site, opts: { fleet?: string; workdir?: string; cwd?: string; verbose?: boolean }) =>\n      runOrExit(async () => (await import(\"./commands/init.js\")).runInitCommand(site, opts), opts),\n  );\n\ncli\n  .command(\n    \"launch <site>\",\n    \"Bootstrap + first-audit a site, then draft its launch email for approval.\",\n  )\n  .action(async (site: string, opts: { cwd?: string; verbose?: boolean }) =>\n    runOrExit(\n      async () => (await import(\"./commands/launch.js\")).runLaunchCommand(site, opts),\n      opts,\n    ),\n  );\n\ncli\n  .command(\"header-image [site]\", \"Generate a site's report header image from its live homepage.\")\n  .option(\"--all\", \"Every live site with no Header image yet (backfill)\")\n  .option(\"--force\", \"With --all, regenerate sites that already have one\")\n  .option(\"--write-airtable\", \"Upload to the Websites row instead of writing a local file\")\n  .option(\"--out-dir <path>\", \"Directory for local output (default: reports/)\")\n  .option(\"--settle-ms <ms>\", \"Override the post-load settle delay for slow/animated homepages\")\n  .action(\n    async (\n      site: string | undefined,\n      opts: {\n        all?: boolean;\n        force?: boolean;\n        writeAirtable?: boolean;\n        outDir?: string;\n        settleMs?: string;\n        cwd?: string;\n        verbose?: boolean;\n      },\n    ) =>\n      runOrExit(\n        async () => (await import(\"./commands/header-image.js\")).runHeaderImageCommand(site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\n    \"announce [site]\",\n    \"Draft the monthly-report announcement email for maintenance sites (all, or one) for approval.\",\n  )\n  .action(async (site: string | undefined, opts: { cwd?: string; verbose?: boolean }) =>\n    runOrExit(\n      async () => (await import(\"./commands/announce.js\")).runAnnounceCommand(site, opts),\n      opts,\n    ),\n  );\n\ncli\n  .command(\n    \"forms-notify-target [site]\",\n    \"Show who a form submission would email, and optionally flip the pre-launch guard (read-back confirmed).\",\n  )\n  .option(\"--set <on|off>\", \"Flip the guard: on = route to operator, off = restore.\")\n  .option(\"--restore <status>\", \"Status to restore with --set off. Required; never inferred.\")\n  .action(\n    async (\n      site: string | undefined,\n      opts: { set?: string; restore?: string; cwd?: string; verbose?: boolean },\n    ) =>\n      runOrExit(\n        async () =>\n          (await import(\"./commands/forms-notify-target.js\")).runFormsNotifyTargetCommand(\n            site,\n            opts,\n          ),\n        opts,\n      ),\n  );\n\ncli\n  .command(\n    \"selftest <kind> [site]\",\n    \"Operator self-tests. kind=email: preview a report email for a site (or --all) to yourself.\",\n  )\n  .option(\"--type <type>\", \"Report type: announcement (default) | maintenance | testing | launch\")\n  .option(\"--to <addr>\", \"Recipient(s), comma-separated. Default: OPERATOR_EMAIL.\")\n  .option(\"--all\", \"Send a preview for every maintenance site (to --to/operator).\")\n  .option(\"--dry-run\", \"Render only; write reports/<slug>/selftest-<type>.html; do not send.\")\n  .action(\n    async (\n      kind: string,\n      site: string | undefined,\n      opts: {\n        type?: string;\n        to?: string;\n        all?: boolean;\n        dryRun?: boolean;\n        cwd?: string;\n        verbose?: boolean;\n      },\n    ) =>\n      runOrExit(\n        async () => (await import(\"./commands/selftest.js\")).runSelftestCommand(kind, site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\n    \"preflight [site]\",\n    \"Read-only pre-send checks: recipients, header image, pending drafts, schedule hygiene.\",\n  )\n  .option(\"--type <type>\", \"Report type: announcement (default) | maintenance | testing\")\n  .option(\n    \"--all\",\n    \"Fleet mode: announcement→maintenance sites; maintenance/testing→all schedulable sites.\",\n  )\n  .action(\n    async (\n      site: string | undefined,\n      opts: { type?: string; all?: boolean; cwd?: string; verbose?: boolean },\n    ) =>\n      runOrExit(\n        async () => (await import(\"./commands/preflight.js\")).runPreflightCommand(site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\"ensure-site <slug>\", \"Create/verify the Airtable Websites row for a new site.\")\n  .option(\"--name <display name>\", \"Human Name for the row (client-facing copy uses it verbatim).\")\n  .option(\"--url <url>\", \"Deployed URL (e.g. the Netlify site URL).\")\n  .option(\"--contact <email>\", \"point of contact — the client address reports resolve to.\")\n  .option(\"--git-repo <owner/repo>\", \"GitHub identity. Default on create: reddoorla/<slug>.\")\n  .action(\n    async (\n      slug: string,\n      opts: {\n        name?: string;\n        url?: string;\n        contact?: string;\n        gitRepo?: string;\n        cwd?: string;\n        verbose?: boolean;\n      },\n    ) =>\n      runOrExit(\n        async () => (await import(\"./commands/ensure-site.js\")).runEnsureSiteCommand(slug, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\"report [site]\", \"Draft or send maintenance/testing reports.\")\n  .option(\"--due\", \"Scan all Websites and draft overdue reports.\")\n  .option(\"--type <type>\", \"Single-site draft report type: Maintenance (default) or Testing.\")\n  .option(\n    \"--preview\",\n    \"Single-site dry run; writes reports/<slug>/draft.html, never touches Airtable.\",\n  )\n  .option(\n    \"--enrich\",\n    \"With --preview: also fetch GA + Search Console, so the render exercises those credentials for real. Still writes nothing.\",\n  )\n  .option(\n    \"--send-ready\",\n    \"Send all Reports with Draft ready=true AND Approved to send=true AND Sent at IS NULL.\",\n  )\n  .option(\n    \"--digest\",\n    \"Email the operator one daily digest of reports ready for approval (skips when empty).\",\n  )\n  .action(\n    async (\n      site,\n      opts: {\n        due?: boolean;\n        type?: string;\n        preview?: boolean;\n        enrich?: boolean;\n        sendReady?: boolean;\n        digest?: boolean;\n        cwd?: string;\n        verbose?: boolean;\n      },\n    ) =>\n      runOrExit(\n        async () => (await import(\"./commands/report.js\")).runReportCommand(site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\n    \"github-signals\",\n    \"Sweep the fleet for GitHub signals (Renovate-failing/CI/last-commit) and write Airtable.\",\n  )\n  .option(\"--fleet\", \"Run across every site in the Airtable inventory.\")\n  .option(\"--write-airtable\", \"Write each site's signals back to its Websites row.\")\n  .action(\n    async (opts: { fleet?: boolean; writeAirtable?: boolean; cwd?: string; verbose?: boolean }) =>\n      runOrExit(\n        async () =>\n          (await import(\"./commands/github-signals.js\")).runGitHubSignalsCommand({\n            fleet: opts.fleet,\n            writeAirtable: opts.writeAirtable,\n          }),\n        opts,\n      ),\n  );\n\ncli\n  .command(\n    \"protection-audit\",\n    \"Verify every public org repo carries a sound branch ruleset (empty bypass, PR-required).\",\n  )\n  .option(\"--org <org>\", \"GitHub org to sweep (enumerated from the API, never a hand list).\")\n  .action(async (opts: { org?: string; cwd?: string; verbose?: boolean }) =>\n    runOrExit(\n      async () =>\n        (await import(\"./commands/protection-audit.js\")).runProtectionAuditCommand({\n          org: opts.org,\n        }),\n      opts,\n    ),\n  );\n\ncli\n  .command(\n    \"db <action>\",\n    \"Migrate / backfill / reconcile the libSQL store (migrate | backfill | reconcile).\",\n  )\n  .action(async (action: string, opts: { cwd?: string; verbose?: boolean }) =>\n    runOrExit(async () => (await import(\"./commands/db.js\")).runDbCommand(action, opts), opts),\n  );\n\ncli\n  .command(\n    \"submissions <action>\",\n    \"Operate on stored form submissions. rescore: re-run the CURRENT spam classifier over the status='new' backlog (dry-run by default; only 'new' rows are ever touched).\",\n  )\n  .option(\"--dry-run\", \"Print the would-be re-buckets without writing (the default).\")\n  .option(\n    \"--apply\",\n    \"Write the re-buckets: status → spam_auto, spam_score/spam_reason replaced with the new verdict + 'retro-rescore' marker.\",\n  )\n  .action(\n    async (\n      action: string,\n      opts: { dryRun?: boolean; apply?: boolean; cwd?: string; verbose?: boolean },\n    ) =>\n      runOrExit(\n        async () => (await import(\"./commands/submissions.js\")).runSubmissionsCommand(action, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\n    \"renovate-dispatch\",\n    \"Trigger Renovate on fleet sites the security sweep flagged with critical/high vulns.\",\n  )\n  .option(\"--fleet\", \"Run across every active, repo-backed site in the Airtable inventory.\")\n  .action(async (opts: { fleet?: boolean; cwd?: string; verbose?: boolean }) =>\n    runOrExit(\n      async () =>\n        (await import(\"./commands/renovate-dispatch.js\")).runRenovateDispatchCommand({\n          fleet: opts.fleet,\n        }),\n      opts,\n    ),\n  );\n\ncli\n  .command(\n    \"blux <action> [dir]\",\n    \"Blux conversion pipeline. emit: export dir → migration plan + custom types + theme + review manifest. migrate: emitted plan → live Prismic (needs PRISMIC_REPOSITORY_NAME + PRISMIC_WRITE_TOKEN). validate: content coverage of a rendered site against the export answer key. grid: parse rendered index.html → grid-tree.json (layout tree). convert: parse+classify index.html + assemble IR → migration-plan.json + blux-presentation.json + theme.css (+ map-config.json), offline. catalog: parse each page + classify every band to a blux_section → migration-plan.json only (no sidecar), offline.\",\n  )\n  .option(\n    \"--out <dir>\",\n    \"Output directory for emit/grid/convert/catalog (default: <exportDir>/blux-out)\",\n  )\n  .option(\"--converted-base <url>\", \"Converted-site base URL for the review manifest\")\n  .option(\"--blux-base <url>\", \"Original Blux site base URL (default: https://<site.json domain>)\")\n  .option(\n    \"--probe\",\n    \"Reconstruct + HEAD-probe CDN URLs for used assets the HTML scrape missed (network)\",\n  )\n  .option(\n    \"--against <target>\",\n    \"validate: rendered HTML of the converted site — a file path or http(s) URL\",\n  )\n  .option(\n    \"--site <slug>\",\n    \"freeze/migrate-frozen: site slug naming <slug>.slots.json (default: slugified dir name)\",\n  )\n  .option(\n    \"--extra-slots <path>\",\n    \"freeze: JSON declaring slots the template has no token for (video poster, a panel rebuilt from a baked image). Keys must start with 'x.'\",\n  )\n  .action(\n    async (\n      action: string,\n      dir: string | undefined,\n      opts: {\n        out?: string;\n        convertedBase?: string;\n        bluxBase?: string;\n        probe?: boolean;\n        against?: string;\n        site?: string;\n        extraSlots?: string;\n        cwd?: string;\n        verbose?: boolean;\n      },\n    ) =>\n      runOrExit(\n        async () => (await import(\"./commands/blux.js\")).runBluxCommand(action, dir, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\n    \"webflow <action> [target]\",\n    \"Webflow import pipeline. capture: live-crawl a base url → <out>/ir.json, progress on stderr. docs: convert a saved ir.json → docs.json + assets.json (offline). migrate: push a capture dir's docs.json + assets.json to Prismic via the shared runner (needs PRISMIC_REPOSITORY_NAME + PRISMIC_WRITE_TOKEN).\",\n  )\n  .option(\n    \"--out <dir>\",\n    \"Output directory for capture (default: webflow-out) / docs (default: dirname of the ir.json)\",\n  )\n  .action(\n    async (\n      action: string,\n      target: string | undefined,\n      opts: { out?: string; cwd?: string; verbose?: boolean },\n    ) =>\n      runOrExit(\n        async () => (await import(\"./commands/webflow.js\")).runWebflowCommand(action, target, opts),\n        opts,\n      ),\n  );\n\ncli.help();\ncli.version(version);\n\n// A typo'd / unrecognized subcommand (e.g. `reddoor-maint auditt`) otherwise\n// falls through cac with no matched command and exits 0 — a cron/CI typo would\n// \"succeed\" silently. cac emits `command:*` at the end of parse() exactly when\n// a positional arg was given but matched no command (a bare `reddoor-maint`,\n// `--help`, and `--version` do NOT trigger it: they have no leading positional\n// or are handled before this fires). Turn that into a clear stderr error +\n// non-zero exit. process.argv[2] is the first positional, i.e. the bad command.\ncli.on(\"command:*\", () => {\n  const unknown = cli.args[0] ?? process.argv[2] ?? \"\";\n  console.error(\n    `error: unknown command '${unknown}'. Run 'reddoor-maint --help' to see available commands.`,\n  );\n  process.exit(1);\n});\n\ncli.parse();\n","import { readFileSync, existsSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\n\n/**\n * Read the @reddoorla/maintenance package version, given the directory of a\n * file that lives inside the package. Walks UP looking for the first\n * `package.json` whose `name` matches. Defensive against bundling-layout\n * changes — the older \"two levels up\" assumption held for `dist/cli/bin.js`\n * but would silently mis-read (or return \"unknown\") if tsup ever moved bin\n * to a different depth. Same walk-up pattern as the self-version helper.\n *\n * Returns \"unknown\" when no matching package.json is reachable (Yarn PnP\n * setups stash manifests inside .zip caches; the readFileSync there fails\n * before any name check).\n */\nexport function resolvePackageVersion(fromDir: string): string {\n  try {\n    let dir = fromDir;\n    while (true) {\n      const candidate = join(dir, \"package.json\");\n      if (existsSync(candidate)) {\n        const raw = readFileSync(candidate, \"utf-8\");\n        const pkg = JSON.parse(raw) as { name?: string; version?: string };\n        if (pkg.name === \"@reddoorla/maintenance\") {\n          return pkg.version ?? \"unknown\";\n        }\n      }\n      const parent = dirname(dir);\n      if (parent === dir) return \"unknown\";\n      dir = parent;\n    }\n  } catch {\n    return \"unknown\";\n  }\n}\n"],"mappings":";;;;;;AACA,SAAS,WAAAA,gBAAe;AACxB,SAAS,qBAAqB;AAC9B,SAAS,WAAW;;;ACHpB,SAAS,cAAc,kBAAkB;AACzC,SAAS,SAAS,YAAY;AAcvB,SAAS,sBAAsB,SAAyB;AAC7D,MAAI;AACF,QAAI,MAAM;AACV,WAAO,MAAM;AACX,YAAM,YAAY,KAAK,KAAK,cAAc;AAC1C,UAAI,WAAW,SAAS,GAAG;AACzB,cAAM,MAAM,aAAa,WAAW,OAAO;AAC3C,cAAM,MAAM,KAAK,MAAM,GAAG;AAC1B,YAAI,IAAI,SAAS,0BAA0B;AACzC,iBAAO,IAAI,WAAW;AAAA,QACxB;AAAA,MACF;AACA,YAAM,SAAS,QAAQ,GAAG;AAC1B,UAAI,WAAW,IAAK,QAAO;AAC3B,YAAM;AAAA,IACR;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ADTA,uBAAuB;AAEvB,IAAM,OAAOC,SAAQ,cAAc,YAAY,GAAG,CAAC;AACnD,IAAM,UAAU,sBAAsB,IAAI;AAE1C,IAAM,qBAAgD;AAAA,EACpD,MAAM;AAAA,EACN,YAAY;AAAA,EACZ,MAAM;AAAA,EACN,UACE;AAAA,EACF,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,SACE;AAAA,EACF,kBACE;AAAA,EACF,mBACE;AAAA,EACF,OAAO;AAAA,EACP,YACE;AACJ;AAEA,IAAM,sBAAkD;AAAA,EACtD,gBAAgB;AAAA,EAChB,aAAa;AAAA,EACb,iBAAiB;AAAA,EACjB,mBACE;AAAA,EACF,mBAAmB;AAAA,EACnB,SAAS;AAAA,EACT,sBACE;AAAA,EACF,mBACE;AAAA,EACF,eAAe;AAAA,EACf,iBACE;AAAA,EACF,cACE;AAAA,EACF,MAAM;AACR;AAeA,eAAsB,UACpB,IACA,MACe;AACf,MAAI;AACF,UAAM,EAAE,QAAQ,KAAK,IAAI,MAAM,GAAG;AAClC,YAAQ,IAAI,MAAM;AAClB,YAAQ,WAAW;AACnB;AAAA,EACF,SAAS,KAAK;AACZ,UAAM,IAAI;AACV,YAAQ,MAAM,KAAK,UAAW,EAAE,SAAS,EAAE,UAAY,EAAE,WAAW,OAAO,GAAG,CAAE;AAChF,YAAQ,KAAK,EAAE,YAAY,CAAC;AAAA,EAC9B;AACF;AAEA,IAAM,MAAM,IAAI,eAAe;AAE/B,IAAI,OAAO,gBAAgB,qDAAqD;AAChF,IAAI,OAAO,aAAa,uCAAuC;AAE/D,IAAI,QAAQ,eAAe,6BAA6B,EAAE,OAAO,MAAM;AACrE,aAAW,CAAC,MAAM,IAAI,KAAK,OAAO,QAAQ,kBAAkB,GAAG;AAC7D,YAAQ,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC,IAAI,IAAI,EAAE;AAAA,EAC1C;AACF,CAAC;AAED,IAAI,QAAQ,gBAAgB,8BAA8B,EAAE,OAAO,MAAM;AACvE,aAAW,CAAC,MAAM,IAAI,KAAK,OAAO,QAAQ,mBAAmB,GAAG;AAC9D,YAAQ,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC,IAAI,IAAI,EAAE;AAAA,EAC1C;AACF,CAAC;AAED,IACG,QAAQ,gBAAgB,2CAA2C,EACnE,OAAO,kBAAkB,oDAAoD,EAC7E,OAAO,UAAU,8BAA8B,EAC/C;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,oBAAoB,8DAA8D,EACzF;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,wBAAwB,+DAA+D,EAC9F;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC,OACE,MACA,SAaA;AAAA,IACE,aAAa,MAAM,OAAO,qBAAqB,GAAG,gBAAgB,MAAM,IAAI;AAAA,IAC5E;AAAA,EACF;AACJ;AAEF,IACG,QAAQ,uBAAuB,qCAAqC,EACpE,OAAO,kBAAkB,qDAAqD,EAC9E,OAAO,SAAS,4BAA4B,EAC5C;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,oBAAoB,8DAA8D,EACzF;AAAA,EACC,OACE,MACA,SASA;AAAA,IACE,aAAa,MAAM,OAAO,6BAA4B,GAAG,sBAAsB,MAAM,IAAI;AAAA,IACzF;AAAA,EACF;AACJ;AAEF,IACG,QAAQ,oBAAoB,oBAAoB,EAChD,OAAO,mBAAmB,yBAAyB,EAAE,SAAS,QAAQ,CAAC,EACvE;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,oBAAoB,8DAA8D,EACzF;AAAA,EACC,OACE,MACA,SAQA;AAAA,IACE,aAAa,MAAM,OAAO,0BAAyB,GAAG,mBAAmB,MAAM,IAAI;AAAA,IACnF;AAAA,EACF;AACJ;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,SAAS,2DAA2D,EAC3E,OAAO,uBAAuB,mDAAmD,EACjF,OAAO,oBAAoB,8DAA8D,EACzF;AAAA,EACC,OACE,MACA,SAQA;AAAA,IACE,aACG,MAAM,OAAO,8BAA6B,GAAG,uBAAuB,MAAM,IAAI;AAAA,IACjF;AAAA,EACF;AACJ;AAMF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,SAAS,2EAA2E,EAC3F,OAAO,uBAAuB,mDAAmD,EACjF,OAAO,oBAAoB,8DAA8D,EACzF;AAAA,EACC,OACE,MACA,SAQA;AAAA,IACE,aAAa,MAAM,OAAO,2BAA0B,GAAG,oBAAoB,MAAM,IAAI;AAAA,IACrF;AAAA,EACF;AACJ;AASF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,UAAU,+EAA+E,EAChG,OAAO,YAAY,wEAAwE,EAC3F,OAAO,uBAAuB,+DAA+D,EAC7F,OAAO,oBAAoB,8DAA8D,EACzF,OAAO,oBAAoB,6DAA6D,EACxF;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC,OACE,MACA,SAYA;AAAA,IACE,aACG,MAAM,OAAO,+BAA8B,GAAG,wBAAwB,MAAM,IAAI;AAAA,IACnF;AAAA,EACF;AACJ;AAEF,IACG,QAAQ,4BAA4B,6CAA6C,EACjF,QAAQ,+CAA+C,EACvD;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,oBAAoB,8DAA8D,EACzF;AAAA,EACC,OACE,SACA,MACA,SAEA;AAAA,IACE,aAAa,MAAM,OAAO,wBAAuB,GAAG,kBAAkB,SAAS,MAAM,IAAI;AAAA,IACzF;AAAA,EACF;AACJ;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,oBAAoB,8DAA8D,EACzF;AAAA,EACC,OAAO,MAAM,SACX;AAAA,IACE,aACG,MAAM,OAAO,gCAA+B,GAAG,wBAAwB,MAAM,IAAI;AAAA,IACpF;AAAA,EACF;AACJ;AAEF,IACG,QAAQ,0BAA0B,6DAA6D,EAC/F;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,oBAAoB,8DAA8D,EACzF;AAAA,EACC,OAAO,MAAM,SACX;AAAA,IACE,aACG,MAAM,OAAO,gCAA+B,GAAG,yBAAyB,MAAM,IAAI;AAAA,IACrF;AAAA,EACF;AACJ;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,oBAAoB,8DAA8D,EACzF;AAAA,EACC,OAAO,MAAM,SACX;AAAA,IACE,aACG,MAAM,OAAO,gCAA+B,GAAG,yBAAyB,MAAM,IAAI;AAAA,IACrF;AAAA,EACF;AACJ;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,oBAAoB,8DAA8D,EACzF;AAAA,EACC,OAAO,MAAM,SACX;AAAA,IACE,aAAa,MAAM,OAAO,4BAA2B,GAAG,qBAAqB,MAAM,IAAI;AAAA,IACvF;AAAA,EACF;AACJ;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,oBAAoB,+DAA+D,EAC1F;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,oBAAoB,8DAA8D,EACzF;AAAA,EACC,OACE,MACA,SAQA;AAAA,IACE,aAAa,MAAM,OAAO,wBAAuB,GAAG,kBAAkB,MAAM,IAAI;AAAA,IAChF;AAAA,EACF;AACJ;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,oBAAoB,8DAA8D,EACzF;AAAA,EACC,OAAO,MAAM,SACX,UAAU,aAAa,MAAM,OAAO,qBAAoB,GAAG,eAAe,MAAM,IAAI,GAAG,IAAI;AAC/F;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EAAO,OAAO,MAAc,SAC3B;AAAA,IACE,aAAa,MAAM,OAAO,uBAAsB,GAAG,iBAAiB,MAAM,IAAI;AAAA,IAC9E;AAAA,EACF;AACF;AAEF,IACG,QAAQ,uBAAuB,+DAA+D,EAC9F,OAAO,SAAS,qDAAqD,EACrE,OAAO,WAAW,oDAAoD,EACtE,OAAO,oBAAoB,4DAA4D,EACvF,OAAO,oBAAoB,gDAAgD,EAC3E,OAAO,oBAAoB,iEAAiE,EAC5F;AAAA,EACC,OACE,MACA,SAUA;AAAA,IACE,aAAa,MAAM,OAAO,6BAA4B,GAAG,sBAAsB,MAAM,IAAI;AAAA,IACzF;AAAA,EACF;AACJ;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EAAO,OAAO,MAA0B,SACvC;AAAA,IACE,aAAa,MAAM,OAAO,yBAAwB,GAAG,mBAAmB,MAAM,IAAI;AAAA,IAClF;AAAA,EACF;AACF;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,kBAAkB,wDAAwD,EACjF,OAAO,sBAAsB,6DAA6D,EAC1F;AAAA,EACC,OACE,MACA,SAEA;AAAA,IACE,aACG,MAAM,OAAO,oCAAmC,GAAG;AAAA,MAClD;AAAA,MACA;AAAA,IACF;AAAA,IACF;AAAA,EACF;AACJ;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,iBAAiB,sEAAsE,EAC9F,OAAO,eAAe,yDAAyD,EAC/E,OAAO,SAAS,+DAA+D,EAC/E,OAAO,aAAa,sEAAsE,EAC1F;AAAA,EACC,OACE,MACA,MACA,SASA;AAAA,IACE,aAAa,MAAM,OAAO,yBAAwB,GAAG,mBAAmB,MAAM,MAAM,IAAI;AAAA,IACxF;AAAA,EACF;AACJ;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,iBAAiB,6DAA6D,EACrF;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC,OACE,MACA,SAEA;AAAA,IACE,aAAa,MAAM,OAAO,0BAAyB,GAAG,oBAAoB,MAAM,IAAI;AAAA,IACpF;AAAA,EACF;AACJ;AAEF,IACG,QAAQ,sBAAsB,yDAAyD,EACvF,OAAO,yBAAyB,+DAA+D,EAC/F,OAAO,eAAe,2CAA2C,EACjE,OAAO,qBAAqB,gEAA2D,EACvF,OAAO,2BAA2B,uDAAuD,EACzF;AAAA,EACC,OACE,MACA,SASA;AAAA,IACE,aAAa,MAAM,OAAO,4BAA2B,GAAG,qBAAqB,MAAM,IAAI;AAAA,IACvF;AAAA,EACF;AACJ;AAEF,IACG,QAAQ,iBAAiB,4CAA4C,EACrE,OAAO,SAAS,8CAA8C,EAC9D,OAAO,iBAAiB,kEAAkE,EAC1F;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC,OACE,MACA,SAWA;AAAA,IACE,aAAa,MAAM,OAAO,uBAAsB,GAAG,iBAAiB,MAAM,IAAI;AAAA,IAC9E;AAAA,EACF;AACJ;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,WAAW,kDAAkD,EACpE,OAAO,oBAAoB,qDAAqD,EAChF;AAAA,EACC,OAAO,SACL;AAAA,IACE,aACG,MAAM,OAAO,+BAA8B,GAAG,wBAAwB;AAAA,MACrE,OAAO,KAAK;AAAA,MACZ,eAAe,KAAK;AAAA,IACtB,CAAC;AAAA,IACH;AAAA,EACF;AACJ;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,eAAe,mEAAmE,EACzF;AAAA,EAAO,OAAO,SACb;AAAA,IACE,aACG,MAAM,OAAO,iCAAgC,GAAG,0BAA0B;AAAA,MACzE,KAAK,KAAK;AAAA,IACZ,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EAAO,OAAO,QAAgB,SAC7B,UAAU,aAAa,MAAM,OAAO,mBAAkB,GAAG,aAAa,QAAQ,IAAI,GAAG,IAAI;AAC3F;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,aAAa,8DAA8D,EAClF;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC,OACE,QACA,SAEA;AAAA,IACE,aAAa,MAAM,OAAO,4BAA2B,GAAG,sBAAsB,QAAQ,IAAI;AAAA,IAC1F;AAAA,EACF;AACJ;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,WAAW,sEAAsE,EACxF;AAAA,EAAO,OAAO,SACb;AAAA,IACE,aACG,MAAM,OAAO,kCAAiC,GAAG,2BAA2B;AAAA,MAC3E,OAAO,KAAK;AAAA,IACd,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,0BAA0B,iDAAiD,EAClF,OAAO,qBAAqB,mEAAmE,EAC/F;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC,OACE,QACA,KACA,SAYA;AAAA,IACE,aAAa,MAAM,OAAO,qBAAoB,GAAG,eAAe,QAAQ,KAAK,IAAI;AAAA,IACjF;AAAA,EACF;AACJ;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC,OACE,QACA,QACA,SAEA;AAAA,IACE,aAAa,MAAM,OAAO,wBAAuB,GAAG,kBAAkB,QAAQ,QAAQ,IAAI;AAAA,IAC1F;AAAA,EACF;AACJ;AAEF,IAAI,KAAK;AACT,IAAI,QAAQ,OAAO;AASnB,IAAI,GAAG,aAAa,MAAM;AACxB,QAAM,UAAU,IAAI,KAAK,CAAC,KAAK,QAAQ,KAAK,CAAC,KAAK;AAClD,UAAQ;AAAA,IACN,2BAA2B,OAAO;AAAA,EACpC;AACA,UAAQ,KAAK,CAAC;AAChB,CAAC;AAED,IAAI,MAAM;","names":["dirname","dirname"]}
+{"version":3,"sources":["../../src/cli/bin.ts","../../src/cli/version.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { dirname } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport { cac } from \"cac\";\nimport type { AuditName, RecipeName } from \"../types.js\";\nimport { loadCredentialsIntoEnv } from \"../util/credentials.js\";\nimport { resolvePackageVersion } from \"./version.js\";\n\n// Command modules are loaded LAZILY (dynamic `import()` inside each `.action()`),\n// never eagerly at the top. An eager `import { runReportCommand } from\n// \"./commands/report.js\"` would pull EVERY command's transitive dependency chain\n// into the CLI's startup graph — report/announce/launch drag in mjml + resend +\n// @google-analytics/data, `db` drags in the libSQL/kysely stack, etc. Those heavy\n// packages are `devDependencies` (this repo's CLI/functions/audits use them); a\n// consuming fleet site installs @reddoorla/maintenance only for `./forms` +\n// `./configs/*` and runs just `reddoor-maint audit --only a11y` in CI. Lazy\n// loading keeps that path (and `--help`/`--version`) free of the report/db\n// chains, so those packages never land in a consumer's node_modules. The\n// smoke-dist gate asserts bin.js's STATIC import closure stays free of them.\n\n// Load credentials from ~/.config/reddoor-maint/credentials.env before any\n// command runs, so AIRTABLE_PAT/AIRTABLE_BASE_ID/RESEND_API_KEY/etc. are\n// available from any cwd. Shell-exported env vars still win. Silent on\n// missing file — commands that need the credentials will fail with their\n// own clear error.\nloadCredentialsIntoEnv();\n\nconst here = dirname(fileURLToPath(import.meta.url));\nconst version = resolvePackageVersion(here);\n\nconst AUDIT_DESCRIPTIONS: Record<AuditName, string> = {\n  deps: \"Diff site package.json against the bundled baseline version map.\",\n  lighthouse: \"Run @lhci/cli autorun using the canonical lighthouserc.\",\n  a11y: \"Playwright + axe against the canonical a11y routes.\",\n  security:\n    \"GitHub Dependabot alerts (prod+dev) for repo-backed sites; falls back to pnpm/npm audit (prod-deps) with no repo/token.\",\n  lint: \"ESLint + Prettier using the canonical configs.\",\n  domain: \"DNS resolve + TLS cert expiry against the deployed URL (checkout-free).\",\n  browser:\n    \"Playwright across desktop engines + mobile devices + link-check against the deployed URL (checkout-free).\",\n  \"netlify-deploy\":\n    \"Latest production deploy health via the Netlify API by site id (checkout-free; needs NETLIFY_PAT).\",\n  \"function-health\":\n    \"GET {deployedUrl}/health and read its ok/prismic/forms status (checkout-free).\",\n  smoke: \"Run the site's own `pnpm test:smoke` suite in its checkout (clone-based).\",\n  \"form-e2e\":\n    \"Submit the real production contact form in test-mode against the deployed URL (checkout-free).\",\n};\n\nconst RECIPE_DESCRIPTIONS: Record<RecipeName, string> = {\n  \"sync-configs\": \"Overwrite a site's canonical configs to match @reddoorla/maintenance.\",\n  \"bump-deps\": \"Bump dependencies and commit the lockfile change.\",\n  \"svelte-4-to-5\": \"Run the 7-commit Svelte 4 → 5 upgrade recipe.\",\n  \"svelte-codemods\":\n    \"Apply Svelte 5 gotcha codemods to an already-migrated site (state_referenced_locally, etc.).\",\n  \"convert-to-pnpm\": \"Convert an npm/yarn site to pnpm (lockfile, packageManager, scripts).\",\n  onboard: \"Install @reddoorla/maintenance + audit deps on a site (preferred first step).\",\n  \"a11y-fixtures-page\":\n    \"Write src/routes/dev/a11y-fixtures/+page.svelte (stub for lhci + axe targets).\",\n  \"health-endpoint\":\n    \"Write src/routes/health/+server.ts (function-health probe for the report gate).\",\n  \"smoke-suite\": \"Add the smoke suite (test:smoke + playwright config + /health smoke routes).\",\n  \"self-updating\":\n    \"Bootstrap Renovate + repo protection (writes renovate configs via PR, wires ruleset, disables platform auto-merge; ci.yml comes from the starter and is deliberately not managed).\",\n  \"prismic-ci\":\n    \"Add the Prismic model delivery workflow to a site via PR (dry delta comment on PRs, push to Prismic on merge to main).\",\n  init: \"Run the full onboarding chain (convert-to-pnpm → onboard → sync-configs → svelte-codemods → a11y-fixtures-page → health-endpoint → smoke-suite → audit).\",\n};\n\n/** Run a command thunk and surface its result, falling back to a clean error\n * message on throw. Wraps the ~10-line try/catch every `.action()` used to\n * duplicate. `verbose` flips between full stack and message-only.\n *\n * On success it sets `process.exitCode` and RETURNS rather than calling\n * `process.exit()` right after `console.log()`. `process.exit()` does not wait\n * for stdout to flush when stdout is a pipe, so a large `--json` payload piped\n * to another process would get truncated mid-write. Setting `exitCode` and\n * returning lets Node drain stdout and exit naturally with the right code. A\n * non-zero `code` still yields a non-zero process exit.\n *\n * The error path keeps `process.exit()` — error messages are small (one line),\n * always go to stderr, and exiting immediately is the desired fail-fast. */\nexport async function runOrExit(\n  fn: () => Promise<{ output: string; code: number }>,\n  opts: { verbose?: boolean },\n): Promise<void> {\n  try {\n    const { output, code } = await fn();\n    console.log(output);\n    process.exitCode = code;\n    return;\n  } catch (err) {\n    const e = err as { exitCode?: number; message?: string; stack?: string };\n    console.error(opts.verbose ? (e.stack ?? e.message) : (e.message ?? String(err)));\n    process.exit(e.exitCode ?? 1);\n  }\n}\n\nconst cli = cac(\"reddoor-maint\");\n\ncli.option(\"--cwd <path>\", \"Override working directory (default: process.cwd())\");\ncli.option(\"--verbose\", \"Verbose output (full stack on errors)\");\n\ncli.command(\"list-audits\", \"Print the available audits.\").action(() => {\n  for (const [name, desc] of Object.entries(AUDIT_DESCRIPTIONS)) {\n    console.log(`${name.padEnd(12)} ${desc}`);\n  }\n});\n\ncli.command(\"list-recipes\", \"Print the available recipes.\").action(() => {\n  for (const [name, desc] of Object.entries(RECIPE_DESCRIPTIONS)) {\n    console.log(`${name.padEnd(16)} ${desc}`);\n  }\n});\n\ncli\n  .command(\"audit [site]\", \"Run audits against a site (default: cwd).\")\n  .option(\"--only <names>\", \"Comma-separated audit names (e.g. deps,lighthouse)\")\n  .option(\"--json\", \"Machine-readable JSON output\")\n  .option(\n    \"--fleet <inventory>\",\n    'Inventory file (.json or .mjs/.js), or \"airtable\" to read from Websites table',\n  )\n  .option(\"--workdir <path>\", \"Clone target for fleet mode (default ~/.reddoor-maint/sites)\")\n  .option(\n    \"--write-airtable [slug]\",\n    \"After lighthouse runs, write pScore/rScore/bpScore/seoScore + timestamp to the matching Websites row. Slug defaults to cwd's package.json#name.\",\n  )\n  .option(\"--fail-on-violations\", \"Exit non-zero if any a11y violations are found (for CI gates)\")\n  .option(\n    \"--url <url>\",\n    \"Audit this deployed URL with lighthouse (no dev server); single-site. Pair with --only lighthouse — other audits still use the local checkout.\",\n  )\n  .option(\n    \"--concurrency <n>\",\n    \"Max sites to audit in parallel in --fleet mode (default: all at once). Use 1 for sequential (CI).\",\n  )\n  .action(\n    async (\n      site,\n      opts: {\n        only?: string;\n        json?: boolean;\n        fleet?: string;\n        workdir?: string;\n        cwd?: string;\n        verbose?: boolean;\n        writeAirtable?: string | boolean;\n        failOnViolations?: boolean;\n        url?: string;\n        concurrency?: string;\n      },\n    ) =>\n      runOrExit(\n        async () => (await import(\"./commands/audit.js\")).runAuditCommand(site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\"sync-configs [site]\", \"Sync canonical configs into a site.\")\n  .option(\"--only <names>\", \"Comma-separated config names (e.g. eslint,prettier)\")\n  .option(\"--dry\", \"Print diff without writing\")\n  .option(\n    \"--fleet <inventory>\",\n    'Inventory file (.json or .mjs/.js), or \"airtable\" to read from Websites table',\n  )\n  .option(\"--workdir <path>\", \"Clone target for fleet mode (default ~/.reddoor-maint/sites)\")\n  .action(\n    async (\n      site,\n      opts: {\n        only?: string;\n        dry?: boolean;\n        fleet?: string;\n        workdir?: string;\n        cwd?: string;\n        verbose?: boolean;\n      },\n    ) =>\n      runOrExit(\n        async () => (await import(\"./commands/sync-configs.js\")).runSyncConfigsCommand(site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\"bump-deps [site]\", \"Bump dependencies.\")\n  .option(\"--group <group>\", \"patch | minor | major\", { default: \"minor\" })\n  .option(\n    \"--fleet <inventory>\",\n    'Inventory file (.json or .mjs/.js), or \"airtable\" to read from Websites table',\n  )\n  .option(\"--workdir <path>\", \"Clone target for fleet mode (default ~/.reddoor-maint/sites)\")\n  .action(\n    async (\n      site,\n      opts: {\n        group?: string;\n        fleet?: string;\n        workdir?: string;\n        cwd?: string;\n        verbose?: boolean;\n      },\n    ) =>\n      runOrExit(\n        async () => (await import(\"./commands/bump-deps.js\")).runBumpDepsCommand(site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\n    \"self-updating [site]\",\n    \"Bootstrap a repo to keep itself updated (Renovate + protection; platform auto-merge off; ci.yml is the starter's, not managed here).\",\n  )\n  .option(\"--dry\", \"List what would be enabled without writing or opening PRs\")\n  .option(\"--fleet <inventory>\", 'Inventory file (.json or .mjs/.js), or \"airtable\"')\n  .option(\"--workdir <path>\", \"Clone target for fleet mode (default ~/.reddoor-maint/sites)\")\n  .action(\n    async (\n      site,\n      opts: {\n        dry?: boolean;\n        fleet?: string;\n        workdir?: string;\n        cwd?: string;\n        verbose?: boolean;\n      },\n    ) =>\n      runOrExit(\n        async () =>\n          (await import(\"./commands/self-updating.js\")).runSelfUpdatingCommand(site, opts),\n        opts,\n      ),\n  );\n\n// Fleet-wide, this opens ONE PULL REQUEST PER REPOSITORY and never pushes to a\n// client's main. `--dry` exists because that is the only way to see the blast\n// radius before firing it. Both directions of the flag ↔ option link are pinned\n// by tests/cli/prismic-ci-command.test.ts.\ncli\n  .command(\n    \"prismic-ci [site]\",\n    \"Add the Prismic model delivery workflow to a site via PR (one PR per repo; never pushes to main).\",\n  )\n  .option(\"--dry\", \"List the sites that would be offered the workflow, without opening any PR\")\n  .option(\"--fleet <inventory>\", 'Inventory file (.json or .mjs/.js), or \"airtable\"')\n  .option(\"--workdir <path>\", \"Clone target for fleet mode (default ~/.reddoor-maint/sites)\")\n  .action(\n    async (\n      site,\n      opts: {\n        dry?: boolean;\n        fleet?: string;\n        workdir?: string;\n        cwd?: string;\n        verbose?: boolean;\n      },\n    ) =>\n      runOrExit(\n        async () => (await import(\"./commands/prismic-ci.js\")).runPrismicCiCommand(site, opts),\n        opts,\n      ),\n  );\n\n// EVERY flag below must be one the command actually reads, and every option the\n// command reads must appear below. cac rejects an unknown option outright, so a\n// missing line here is a hard error in whatever workflow types the flag; a line\n// here with no handler is the silent no-op — it parses, it lands in `opts`, and\n// nothing ever looks at it. Both directions are pinned by\n// tests/cli/prismic-models-registration.test.ts, the second one at the type level\n// against `PrismicModelsCommandOptions`.\ncli\n  .command(\n    \"prismic-models [site]\",\n    \"Compare a site's Prismic models against its repo (dry by default).\",\n  )\n  .option(\n    \"--apply\",\n    \"Push local models to Prismic. Never deletes — remote-only models are reported.\",\n  )\n  .option(\"--pull\", \"Write remote-only models into the repo (single-site; review + PR the result).\")\n  .option(\"--tokens\", \"Print the per-site write-token doctor: which env var, present?, reads?\")\n  .option(\"--fleet <inventory>\", 'Inventory file (.json or .mjs/.js), or \"airtable\". Read-only.')\n  .option(\"--workdir <path>\", \"Clone target for fleet mode (default ~/.reddoor-maint/sites)\")\n  .option(\"--write-airtable\", \"Fleet mode: persist each site's verdict to its Websites row\")\n  .option(\n    \"--comment-file <path>\",\n    \"Write the report to this file (the CI workflow posts it as a PR comment)\",\n  )\n  .action(\n    async (\n      site,\n      opts: {\n        apply?: boolean;\n        pull?: boolean;\n        tokens?: boolean;\n        fleet?: string;\n        workdir?: string;\n        writeAirtable?: boolean;\n        commentFile?: string;\n        cwd?: string;\n        verbose?: boolean;\n      },\n    ) =>\n      runOrExit(\n        async () =>\n          (await import(\"./commands/prismic-models.js\")).runPrismicModelsCommand(site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\"upgrade <upgrade> [site]\", \"Run a named upgrade recipe (svelte-4-to-5).\")\n  .example(\"reddoor-maint upgrade svelte-4-to-5 ./my-site\")\n  .option(\n    \"--fleet <inventory>\",\n    'Inventory file (.json or .mjs/.js), or \"airtable\" to read from Websites table',\n  )\n  .option(\"--workdir <path>\", \"Clone target for fleet mode (default ~/.reddoor-maint/sites)\")\n  .action(\n    async (\n      upgrade: string,\n      site: string | undefined,\n      opts: { fleet?: string; workdir?: string; cwd?: string; verbose?: boolean },\n    ) =>\n      runOrExit(\n        async () => (await import(\"./commands/upgrade.js\")).runUpgradeCommand(upgrade, site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\n    \"convert-to-pnpm [site]\",\n    \"Convert an npm/yarn site to pnpm (lockfile, packageManager, scripts).\",\n  )\n  .option(\n    \"--fleet <inventory>\",\n    'Inventory file (.json or .mjs/.js), or \"airtable\" to read from Websites table',\n  )\n  .option(\"--workdir <path>\", \"Clone target for fleet mode (default ~/.reddoor-maint/sites)\")\n  .action(\n    async (site, opts: { fleet?: string; workdir?: string; cwd?: string; verbose?: boolean }) =>\n      runOrExit(\n        async () =>\n          (await import(\"./commands/convert-to-pnpm.js\")).runConvertToPnpmCommand(site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\"svelte-codemods [site]\", \"Apply Svelte 5 gotcha codemods to an already-migrated site.\")\n  .option(\n    \"--fleet <inventory>\",\n    'Inventory file (.json or .mjs/.js), or \"airtable\" to read from Websites table',\n  )\n  .option(\"--workdir <path>\", \"Clone target for fleet mode (default ~/.reddoor-maint/sites)\")\n  .action(\n    async (site, opts: { fleet?: string; workdir?: string; cwd?: string; verbose?: boolean }) =>\n      runOrExit(\n        async () =>\n          (await import(\"./commands/svelte-codemods.js\")).runSvelteCodemodsCommand(site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\n    \"health-endpoint [site]\",\n    \"Write src/routes/health/+server.ts (function-health probe for the report gate).\",\n  )\n  .option(\n    \"--fleet <inventory>\",\n    'Inventory file (.json or .mjs/.js), or \"airtable\" to read from Websites table',\n  )\n  .option(\"--workdir <path>\", \"Clone target for fleet mode (default ~/.reddoor-maint/sites)\")\n  .action(\n    async (site, opts: { fleet?: string; workdir?: string; cwd?: string; verbose?: boolean }) =>\n      runOrExit(\n        async () =>\n          (await import(\"./commands/health-endpoint.js\")).runHealthEndpointCommand(site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\n    \"smoke-suite [site]\",\n    \"Add the smoke suite (test:smoke + playwright config + /health smoke routes).\",\n  )\n  .option(\n    \"--fleet <inventory>\",\n    'Inventory file (.json or .mjs/.js), or \"airtable\" to read from Websites table',\n  )\n  .option(\"--workdir <path>\", \"Clone target for fleet mode (default ~/.reddoor-maint/sites)\")\n  .action(\n    async (site, opts: { fleet?: string; workdir?: string; cwd?: string; verbose?: boolean }) =>\n      runOrExit(\n        async () => (await import(\"./commands/smoke-suite.js\")).runSmokeSuiteCommand(site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\n    \"onboard [site]\",\n    \"Install @reddoorla/maintenance + audit deps on a site (run after convert-to-pnpm).\",\n  )\n  .option(\"--audits <names>\", \"Comma-separated audit subset: lighthouse,a11y (default: both)\")\n  .option(\n    \"--fleet <inventory>\",\n    'Inventory file (.json or .mjs/.js), or \"airtable\" to read from Websites table',\n  )\n  .option(\"--workdir <path>\", \"Clone target for fleet mode (default ~/.reddoor-maint/sites)\")\n  .action(\n    async (\n      site,\n      opts: {\n        audits?: string;\n        fleet?: string;\n        workdir?: string;\n        cwd?: string;\n        verbose?: boolean;\n      },\n    ) =>\n      runOrExit(\n        async () => (await import(\"./commands/onboard.js\")).runOnboardCommand(site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\n    \"init [site]\",\n    \"One-shot guided onboarding: convert-to-pnpm → onboard → sync-configs → svelte-codemods → a11y-fixtures-page → health-endpoint → smoke-suite → audit.\",\n  )\n  .option(\n    \"--fleet <inventory>\",\n    'Inventory file (.json or .mjs/.js), or \"airtable\" to read from Websites table',\n  )\n  .option(\"--workdir <path>\", \"Clone target for fleet mode (default ~/.reddoor-maint/sites)\")\n  .action(\n    async (site, opts: { fleet?: string; workdir?: string; cwd?: string; verbose?: boolean }) =>\n      runOrExit(async () => (await import(\"./commands/init.js\")).runInitCommand(site, opts), opts),\n  );\n\ncli\n  .command(\n    \"launch <site>\",\n    \"Bootstrap + first-audit a site, then draft its launch email for approval.\",\n  )\n  .action(async (site: string, opts: { cwd?: string; verbose?: boolean }) =>\n    runOrExit(\n      async () => (await import(\"./commands/launch.js\")).runLaunchCommand(site, opts),\n      opts,\n    ),\n  );\n\ncli\n  .command(\"header-image [site]\", \"Generate a site's report header image from its live homepage.\")\n  .option(\"--all\", \"Every live site with no Header image yet (backfill)\")\n  .option(\"--force\", \"With --all, regenerate sites that already have one\")\n  .option(\"--write-airtable\", \"Upload to the Websites row instead of writing a local file\")\n  .option(\"--out-dir <path>\", \"Directory for local output (default: reports/)\")\n  .option(\"--settle-ms <ms>\", \"Override the post-load settle delay for slow/animated homepages\")\n  .action(\n    async (\n      site: string | undefined,\n      opts: {\n        all?: boolean;\n        force?: boolean;\n        writeAirtable?: boolean;\n        outDir?: string;\n        settleMs?: string;\n        cwd?: string;\n        verbose?: boolean;\n      },\n    ) =>\n      runOrExit(\n        async () => (await import(\"./commands/header-image.js\")).runHeaderImageCommand(site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\n    \"announce [site]\",\n    \"Draft the monthly-report announcement email for maintenance sites (all, or one) for approval.\",\n  )\n  .action(async (site: string | undefined, opts: { cwd?: string; verbose?: boolean }) =>\n    runOrExit(\n      async () => (await import(\"./commands/announce.js\")).runAnnounceCommand(site, opts),\n      opts,\n    ),\n  );\n\ncli\n  .command(\n    \"forms-notify-target [site]\",\n    \"Show who a form submission would email, and optionally flip the pre-launch guard (read-back confirmed).\",\n  )\n  .option(\"--set <on|off>\", \"Flip the guard: on = route to operator, off = restore.\")\n  .option(\"--restore <status>\", \"Status to restore with --set off. Required; never inferred.\")\n  .action(\n    async (\n      site: string | undefined,\n      opts: { set?: string; restore?: string; cwd?: string; verbose?: boolean },\n    ) =>\n      runOrExit(\n        async () =>\n          (await import(\"./commands/forms-notify-target.js\")).runFormsNotifyTargetCommand(\n            site,\n            opts,\n          ),\n        opts,\n      ),\n  );\n\ncli\n  .command(\n    \"selftest <kind> [site]\",\n    \"Operator self-tests. kind=email: preview a report email for a site (or --all) to yourself.\",\n  )\n  .option(\"--type <type>\", \"Report type: announcement (default) | maintenance | testing | launch\")\n  .option(\"--to <addr>\", \"Recipient(s), comma-separated. Default: OPERATOR_EMAIL.\")\n  .option(\"--all\", \"Send a preview for every maintenance site (to --to/operator).\")\n  .option(\"--dry-run\", \"Render only; write reports/<slug>/selftest-<type>.html; do not send.\")\n  .action(\n    async (\n      kind: string,\n      site: string | undefined,\n      opts: {\n        type?: string;\n        to?: string;\n        all?: boolean;\n        dryRun?: boolean;\n        cwd?: string;\n        verbose?: boolean;\n      },\n    ) =>\n      runOrExit(\n        async () => (await import(\"./commands/selftest.js\")).runSelftestCommand(kind, site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\n    \"preflight [site]\",\n    \"Read-only pre-send checks: recipients, header image, pending drafts, schedule hygiene.\",\n  )\n  .option(\"--type <type>\", \"Report type: announcement (default) | maintenance | testing\")\n  .option(\n    \"--all\",\n    \"Fleet mode: announcement→maintenance sites; maintenance/testing→all schedulable sites.\",\n  )\n  .action(\n    async (\n      site: string | undefined,\n      opts: { type?: string; all?: boolean; cwd?: string; verbose?: boolean },\n    ) =>\n      runOrExit(\n        async () => (await import(\"./commands/preflight.js\")).runPreflightCommand(site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\"ensure-site <slug>\", \"Create/verify the Airtable Websites row for a new site.\")\n  .option(\"--name <display name>\", \"Human Name for the row (client-facing copy uses it verbatim).\")\n  .option(\"--url <url>\", \"Deployed URL (e.g. the Netlify site URL).\")\n  .option(\"--contact <email>\", \"point of contact — the client address reports resolve to.\")\n  .option(\"--git-repo <owner/repo>\", \"GitHub identity. Default on create: reddoorla/<slug>.\")\n  .action(\n    async (\n      slug: string,\n      opts: {\n        name?: string;\n        url?: string;\n        contact?: string;\n        gitRepo?: string;\n        cwd?: string;\n        verbose?: boolean;\n      },\n    ) =>\n      runOrExit(\n        async () => (await import(\"./commands/ensure-site.js\")).runEnsureSiteCommand(slug, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\n    \"prospect-audit <url>\",\n    \"AEO/SEO audit an external prospect's site and publish the report.\",\n  )\n  .option(\n    \"--business <name>\",\n    \"The prospect's business name (defaults to what the model reads off the site).\",\n  )\n  .option(\n    \"--competitors <list>\",\n    \"Comma-separated competitor domains to add comparison probes for.\",\n  )\n  .option(\"--no-probes\", \"Skip the live AI-visibility probes (tier 3).\")\n  .option(\"--out <file>\", \"Also write the rendered report to this file.\")\n  .option(\"--json\", \"Print the raw result JSON instead of the report summary.\")\n  .option(\n    \"--email\",\n    \"Email the internal sheet (scores, what wasn't measured, top fixes, the link) to PROSPECT_AUDIT_RECIPIENTS.\",\n  )\n  .action(\n    async (\n      url: string,\n      opts: {\n        business?: string;\n        competitors?: string;\n        probes?: boolean;\n        out?: string;\n        json?: boolean;\n        email?: boolean;\n        cwd?: string;\n        verbose?: boolean;\n      },\n    ) =>\n      runOrExit(\n        async () =>\n          (await import(\"./commands/prospect-audit.js\")).runProspectAuditCommand(url, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\"report [site]\", \"Draft or send maintenance/testing reports.\")\n  .option(\"--due\", \"Scan all Websites and draft overdue reports.\")\n  .option(\"--type <type>\", \"Single-site draft report type: Maintenance (default) or Testing.\")\n  .option(\n    \"--preview\",\n    \"Single-site dry run; writes reports/<slug>/draft.html, never touches Airtable.\",\n  )\n  .option(\n    \"--enrich\",\n    \"With --preview: also fetch GA + Search Console, so the render exercises those credentials for real. Still writes nothing.\",\n  )\n  .option(\n    \"--send-ready\",\n    \"Send all Reports with Draft ready=true AND Approved to send=true AND Sent at IS NULL.\",\n  )\n  .option(\n    \"--digest\",\n    \"Email the operator one daily digest of reports ready for approval (skips when empty).\",\n  )\n  .action(\n    async (\n      site,\n      opts: {\n        due?: boolean;\n        type?: string;\n        preview?: boolean;\n        enrich?: boolean;\n        sendReady?: boolean;\n        digest?: boolean;\n        cwd?: string;\n        verbose?: boolean;\n      },\n    ) =>\n      runOrExit(\n        async () => (await import(\"./commands/report.js\")).runReportCommand(site, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\n    \"github-signals\",\n    \"Sweep the fleet for GitHub signals (Renovate-failing/CI/last-commit) and write Airtable.\",\n  )\n  .option(\"--fleet\", \"Run across every site in the Airtable inventory.\")\n  .option(\"--write-airtable\", \"Write each site's signals back to its Websites row.\")\n  .action(\n    async (opts: { fleet?: boolean; writeAirtable?: boolean; cwd?: string; verbose?: boolean }) =>\n      runOrExit(\n        async () =>\n          (await import(\"./commands/github-signals.js\")).runGitHubSignalsCommand({\n            fleet: opts.fleet,\n            writeAirtable: opts.writeAirtable,\n          }),\n        opts,\n      ),\n  );\n\ncli\n  .command(\n    \"protection-audit\",\n    \"Verify every public org repo carries a sound branch ruleset (empty bypass, PR-required).\",\n  )\n  .option(\"--org <org>\", \"GitHub org to sweep (enumerated from the API, never a hand list).\")\n  .action(async (opts: { org?: string; cwd?: string; verbose?: boolean }) =>\n    runOrExit(\n      async () =>\n        (await import(\"./commands/protection-audit.js\")).runProtectionAuditCommand({\n          org: opts.org,\n        }),\n      opts,\n    ),\n  );\n\ncli\n  .command(\n    \"db <action>\",\n    \"Operate the libSQL store (migrate | replay-deadletters | import-airtable | parity | sync | backfill-header-images | dump | verify-dump).\",\n  )\n  .option(\"--file <path>\", \"verify-dump: the dump file to load into a scratch engine\")\n  .action(async (action: string, opts: { file?: string; cwd?: string; verbose?: boolean }) =>\n    runOrExit(async () => (await import(\"./commands/db.js\")).runDbCommand(action, opts), opts),\n  );\n\ncli\n  .command(\n    \"submissions <action>\",\n    \"Operate on stored form submissions. rescore: re-run the CURRENT spam classifier over the status='new' backlog (dry-run by default; only 'new' rows are ever touched).\",\n  )\n  .option(\"--dry-run\", \"Print the would-be re-buckets without writing (the default).\")\n  .option(\n    \"--apply\",\n    \"Write the re-buckets: status → spam_auto, spam_score/spam_reason replaced with the new verdict + 'retro-rescore' marker.\",\n  )\n  .action(\n    async (\n      action: string,\n      opts: { dryRun?: boolean; apply?: boolean; cwd?: string; verbose?: boolean },\n    ) =>\n      runOrExit(\n        async () => (await import(\"./commands/submissions.js\")).runSubmissionsCommand(action, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\n    \"renovate-dispatch\",\n    \"Trigger Renovate on fleet sites the security sweep flagged with critical/high vulns.\",\n  )\n  .option(\"--fleet\", \"Run across every active, repo-backed site in the Airtable inventory.\")\n  .action(async (opts: { fleet?: boolean; cwd?: string; verbose?: boolean }) =>\n    runOrExit(\n      async () =>\n        (await import(\"./commands/renovate-dispatch.js\")).runRenovateDispatchCommand({\n          fleet: opts.fleet,\n        }),\n      opts,\n    ),\n  );\n\ncli\n  .command(\n    \"blux <action> [dir]\",\n    \"Blux conversion pipeline. emit: export dir → migration plan + custom types + theme + review manifest. migrate: emitted plan → live Prismic (needs PRISMIC_REPOSITORY_NAME + PRISMIC_WRITE_TOKEN). validate: content coverage of a rendered site against the export answer key. grid: parse rendered index.html → grid-tree.json (layout tree). convert: parse+classify index.html + assemble IR → migration-plan.json + blux-presentation.json + theme.css (+ map-config.json), offline. catalog: parse each page + classify every band to a blux_section → migration-plan.json only (no sidecar), offline.\",\n  )\n  .option(\n    \"--out <dir>\",\n    \"Output directory for emit/grid/convert/catalog (default: <exportDir>/blux-out)\",\n  )\n  .option(\"--converted-base <url>\", \"Converted-site base URL for the review manifest\")\n  .option(\"--blux-base <url>\", \"Original Blux site base URL (default: https://<site.json domain>)\")\n  .option(\n    \"--probe\",\n    \"Reconstruct + HEAD-probe CDN URLs for used assets the HTML scrape missed (network)\",\n  )\n  .option(\n    \"--against <target>\",\n    \"validate: rendered HTML of the converted site — a file path or http(s) URL\",\n  )\n  .option(\n    \"--site <slug>\",\n    \"freeze/migrate-frozen: site slug naming <slug>.slots.json (default: slugified dir name)\",\n  )\n  .option(\n    \"--extra-slots <path>\",\n    \"freeze: JSON declaring slots the template has no token for (video poster, a panel rebuilt from a baked image). Keys must start with 'x.'\",\n  )\n  .action(\n    async (\n      action: string,\n      dir: string | undefined,\n      opts: {\n        out?: string;\n        convertedBase?: string;\n        bluxBase?: string;\n        probe?: boolean;\n        against?: string;\n        site?: string;\n        extraSlots?: string;\n        cwd?: string;\n        verbose?: boolean;\n      },\n    ) =>\n      runOrExit(\n        async () => (await import(\"./commands/blux.js\")).runBluxCommand(action, dir, opts),\n        opts,\n      ),\n  );\n\ncli\n  .command(\n    \"webflow <action> [target]\",\n    \"Webflow import pipeline. capture: live-crawl a base url → <out>/ir.json, progress on stderr. docs: convert a saved ir.json → docs.json + assets.json (offline). migrate: push a capture dir's docs.json + assets.json to Prismic via the shared runner (needs PRISMIC_REPOSITORY_NAME + PRISMIC_WRITE_TOKEN).\",\n  )\n  .option(\n    \"--out <dir>\",\n    \"Output directory for capture (default: webflow-out) / docs (default: dirname of the ir.json)\",\n  )\n  .action(\n    async (\n      action: string,\n      target: string | undefined,\n      opts: { out?: string; cwd?: string; verbose?: boolean },\n    ) =>\n      runOrExit(\n        async () => (await import(\"./commands/webflow.js\")).runWebflowCommand(action, target, opts),\n        opts,\n      ),\n  );\n\ncli.help();\ncli.version(version);\n\n// A typo'd / unrecognized subcommand (e.g. `reddoor-maint auditt`) otherwise\n// falls through cac with no matched command and exits 0 — a cron/CI typo would\n// \"succeed\" silently. cac emits `command:*` at the end of parse() exactly when\n// a positional arg was given but matched no command (a bare `reddoor-maint`,\n// `--help`, and `--version` do NOT trigger it: they have no leading positional\n// or are handled before this fires). Turn that into a clear stderr error +\n// non-zero exit. process.argv[2] is the first positional, i.e. the bad command.\ncli.on(\"command:*\", () => {\n  const unknown = cli.args[0] ?? process.argv[2] ?? \"\";\n  console.error(\n    `error: unknown command '${unknown}'. Run 'reddoor-maint --help' to see available commands.`,\n  );\n  process.exit(1);\n});\n\ncli.parse();\n","import { readFileSync, existsSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\n\n/**\n * Read the @reddoorla/maintenance package version, given the directory of a\n * file that lives inside the package. Walks UP looking for the first\n * `package.json` whose `name` matches. Defensive against bundling-layout\n * changes — the older \"two levels up\" assumption held for `dist/cli/bin.js`\n * but would silently mis-read (or return \"unknown\") if tsup ever moved bin\n * to a different depth. Same walk-up pattern as the self-version helper.\n *\n * Returns \"unknown\" when no matching package.json is reachable (Yarn PnP\n * setups stash manifests inside .zip caches; the readFileSync there fails\n * before any name check).\n */\nexport function resolvePackageVersion(fromDir: string): string {\n  try {\n    let dir = fromDir;\n    while (true) {\n      const candidate = join(dir, \"package.json\");\n      if (existsSync(candidate)) {\n        const raw = readFileSync(candidate, \"utf-8\");\n        const pkg = JSON.parse(raw) as { name?: string; version?: string };\n        if (pkg.name === \"@reddoorla/maintenance\") {\n          return pkg.version ?? \"unknown\";\n        }\n      }\n      const parent = dirname(dir);\n      if (parent === dir) return \"unknown\";\n      dir = parent;\n    }\n  } catch {\n    return \"unknown\";\n  }\n}\n"],"mappings":";;;;;;AACA,SAAS,WAAAA,gBAAe;AACxB,SAAS,qBAAqB;AAC9B,SAAS,WAAW;;;ACHpB,SAAS,cAAc,kBAAkB;AACzC,SAAS,SAAS,YAAY;AAcvB,SAAS,sBAAsB,SAAyB;AAC7D,MAAI;AACF,QAAI,MAAM;AACV,WAAO,MAAM;AACX,YAAM,YAAY,KAAK,KAAK,cAAc;AAC1C,UAAI,WAAW,SAAS,GAAG;AACzB,cAAM,MAAM,aAAa,WAAW,OAAO;AAC3C,cAAM,MAAM,KAAK,MAAM,GAAG;AAC1B,YAAI,IAAI,SAAS,0BAA0B;AACzC,iBAAO,IAAI,WAAW;AAAA,QACxB;AAAA,MACF;AACA,YAAM,SAAS,QAAQ,GAAG;AAC1B,UAAI,WAAW,IAAK,QAAO;AAC3B,YAAM;AAAA,IACR;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ADTA,uBAAuB;AAEvB,IAAM,OAAOC,SAAQ,cAAc,YAAY,GAAG,CAAC;AACnD,IAAM,UAAU,sBAAsB,IAAI;AAE1C,IAAM,qBAAgD;AAAA,EACpD,MAAM;AAAA,EACN,YAAY;AAAA,EACZ,MAAM;AAAA,EACN,UACE;AAAA,EACF,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,SACE;AAAA,EACF,kBACE;AAAA,EACF,mBACE;AAAA,EACF,OAAO;AAAA,EACP,YACE;AACJ;AAEA,IAAM,sBAAkD;AAAA,EACtD,gBAAgB;AAAA,EAChB,aAAa;AAAA,EACb,iBAAiB;AAAA,EACjB,mBACE;AAAA,EACF,mBAAmB;AAAA,EACnB,SAAS;AAAA,EACT,sBACE;AAAA,EACF,mBACE;AAAA,EACF,eAAe;AAAA,EACf,iBACE;AAAA,EACF,cACE;AAAA,EACF,MAAM;AACR;AAeA,eAAsB,UACpB,IACA,MACe;AACf,MAAI;AACF,UAAM,EAAE,QAAQ,KAAK,IAAI,MAAM,GAAG;AAClC,YAAQ,IAAI,MAAM;AAClB,YAAQ,WAAW;AACnB;AAAA,EACF,SAAS,KAAK;AACZ,UAAM,IAAI;AACV,YAAQ,MAAM,KAAK,UAAW,EAAE,SAAS,EAAE,UAAY,EAAE,WAAW,OAAO,GAAG,CAAE;AAChF,YAAQ,KAAK,EAAE,YAAY,CAAC;AAAA,EAC9B;AACF;AAEA,IAAM,MAAM,IAAI,eAAe;AAE/B,IAAI,OAAO,gBAAgB,qDAAqD;AAChF,IAAI,OAAO,aAAa,uCAAuC;AAE/D,IAAI,QAAQ,eAAe,6BAA6B,EAAE,OAAO,MAAM;AACrE,aAAW,CAAC,MAAM,IAAI,KAAK,OAAO,QAAQ,kBAAkB,GAAG;AAC7D,YAAQ,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC,IAAI,IAAI,EAAE;AAAA,EAC1C;AACF,CAAC;AAED,IAAI,QAAQ,gBAAgB,8BAA8B,EAAE,OAAO,MAAM;AACvE,aAAW,CAAC,MAAM,IAAI,KAAK,OAAO,QAAQ,mBAAmB,GAAG;AAC9D,YAAQ,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC,IAAI,IAAI,EAAE;AAAA,EAC1C;AACF,CAAC;AAED,IACG,QAAQ,gBAAgB,2CAA2C,EACnE,OAAO,kBAAkB,oDAAoD,EAC7E,OAAO,UAAU,8BAA8B,EAC/C;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,oBAAoB,8DAA8D,EACzF;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,wBAAwB,+DAA+D,EAC9F;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC,OACE,MACA,SAaA;AAAA,IACE,aAAa,MAAM,OAAO,qBAAqB,GAAG,gBAAgB,MAAM,IAAI;AAAA,IAC5E;AAAA,EACF;AACJ;AAEF,IACG,QAAQ,uBAAuB,qCAAqC,EACpE,OAAO,kBAAkB,qDAAqD,EAC9E,OAAO,SAAS,4BAA4B,EAC5C;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,oBAAoB,8DAA8D,EACzF;AAAA,EACC,OACE,MACA,SASA;AAAA,IACE,aAAa,MAAM,OAAO,6BAA4B,GAAG,sBAAsB,MAAM,IAAI;AAAA,IACzF;AAAA,EACF;AACJ;AAEF,IACG,QAAQ,oBAAoB,oBAAoB,EAChD,OAAO,mBAAmB,yBAAyB,EAAE,SAAS,QAAQ,CAAC,EACvE;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,oBAAoB,8DAA8D,EACzF;AAAA,EACC,OACE,MACA,SAQA;AAAA,IACE,aAAa,MAAM,OAAO,0BAAyB,GAAG,mBAAmB,MAAM,IAAI;AAAA,IACnF;AAAA,EACF;AACJ;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,SAAS,2DAA2D,EAC3E,OAAO,uBAAuB,mDAAmD,EACjF,OAAO,oBAAoB,8DAA8D,EACzF;AAAA,EACC,OACE,MACA,SAQA;AAAA,IACE,aACG,MAAM,OAAO,8BAA6B,GAAG,uBAAuB,MAAM,IAAI;AAAA,IACjF;AAAA,EACF;AACJ;AAMF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,SAAS,2EAA2E,EAC3F,OAAO,uBAAuB,mDAAmD,EACjF,OAAO,oBAAoB,8DAA8D,EACzF;AAAA,EACC,OACE,MACA,SAQA;AAAA,IACE,aAAa,MAAM,OAAO,2BAA0B,GAAG,oBAAoB,MAAM,IAAI;AAAA,IACrF;AAAA,EACF;AACJ;AASF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,UAAU,+EAA+E,EAChG,OAAO,YAAY,wEAAwE,EAC3F,OAAO,uBAAuB,+DAA+D,EAC7F,OAAO,oBAAoB,8DAA8D,EACzF,OAAO,oBAAoB,6DAA6D,EACxF;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC,OACE,MACA,SAYA;AAAA,IACE,aACG,MAAM,OAAO,+BAA8B,GAAG,wBAAwB,MAAM,IAAI;AAAA,IACnF;AAAA,EACF;AACJ;AAEF,IACG,QAAQ,4BAA4B,6CAA6C,EACjF,QAAQ,+CAA+C,EACvD;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,oBAAoB,8DAA8D,EACzF;AAAA,EACC,OACE,SACA,MACA,SAEA;AAAA,IACE,aAAa,MAAM,OAAO,wBAAuB,GAAG,kBAAkB,SAAS,MAAM,IAAI;AAAA,IACzF;AAAA,EACF;AACJ;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,oBAAoB,8DAA8D,EACzF;AAAA,EACC,OAAO,MAAM,SACX;AAAA,IACE,aACG,MAAM,OAAO,gCAA+B,GAAG,wBAAwB,MAAM,IAAI;AAAA,IACpF;AAAA,EACF;AACJ;AAEF,IACG,QAAQ,0BAA0B,6DAA6D,EAC/F;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,oBAAoB,8DAA8D,EACzF;AAAA,EACC,OAAO,MAAM,SACX;AAAA,IACE,aACG,MAAM,OAAO,gCAA+B,GAAG,yBAAyB,MAAM,IAAI;AAAA,IACrF;AAAA,EACF;AACJ;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,oBAAoB,8DAA8D,EACzF;AAAA,EACC,OAAO,MAAM,SACX;AAAA,IACE,aACG,MAAM,OAAO,gCAA+B,GAAG,yBAAyB,MAAM,IAAI;AAAA,IACrF;AAAA,EACF;AACJ;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,oBAAoB,8DAA8D,EACzF;AAAA,EACC,OAAO,MAAM,SACX;AAAA,IACE,aAAa,MAAM,OAAO,4BAA2B,GAAG,qBAAqB,MAAM,IAAI;AAAA,IACvF;AAAA,EACF;AACJ;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,oBAAoB,+DAA+D,EAC1F;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,oBAAoB,8DAA8D,EACzF;AAAA,EACC,OACE,MACA,SAQA;AAAA,IACE,aAAa,MAAM,OAAO,wBAAuB,GAAG,kBAAkB,MAAM,IAAI;AAAA,IAChF;AAAA,EACF;AACJ;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,oBAAoB,8DAA8D,EACzF;AAAA,EACC,OAAO,MAAM,SACX,UAAU,aAAa,MAAM,OAAO,qBAAoB,GAAG,eAAe,MAAM,IAAI,GAAG,IAAI;AAC/F;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EAAO,OAAO,MAAc,SAC3B;AAAA,IACE,aAAa,MAAM,OAAO,uBAAsB,GAAG,iBAAiB,MAAM,IAAI;AAAA,IAC9E;AAAA,EACF;AACF;AAEF,IACG,QAAQ,uBAAuB,+DAA+D,EAC9F,OAAO,SAAS,qDAAqD,EACrE,OAAO,WAAW,oDAAoD,EACtE,OAAO,oBAAoB,4DAA4D,EACvF,OAAO,oBAAoB,gDAAgD,EAC3E,OAAO,oBAAoB,iEAAiE,EAC5F;AAAA,EACC,OACE,MACA,SAUA;AAAA,IACE,aAAa,MAAM,OAAO,6BAA4B,GAAG,sBAAsB,MAAM,IAAI;AAAA,IACzF;AAAA,EACF;AACJ;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EAAO,OAAO,MAA0B,SACvC;AAAA,IACE,aAAa,MAAM,OAAO,yBAAwB,GAAG,mBAAmB,MAAM,IAAI;AAAA,IAClF;AAAA,EACF;AACF;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,kBAAkB,wDAAwD,EACjF,OAAO,sBAAsB,6DAA6D,EAC1F;AAAA,EACC,OACE,MACA,SAEA;AAAA,IACE,aACG,MAAM,OAAO,oCAAmC,GAAG;AAAA,MAClD;AAAA,MACA;AAAA,IACF;AAAA,IACF;AAAA,EACF;AACJ;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,iBAAiB,sEAAsE,EAC9F,OAAO,eAAe,yDAAyD,EAC/E,OAAO,SAAS,+DAA+D,EAC/E,OAAO,aAAa,sEAAsE,EAC1F;AAAA,EACC,OACE,MACA,MACA,SASA;AAAA,IACE,aAAa,MAAM,OAAO,yBAAwB,GAAG,mBAAmB,MAAM,MAAM,IAAI;AAAA,IACxF;AAAA,EACF;AACJ;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,iBAAiB,6DAA6D,EACrF;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC,OACE,MACA,SAEA;AAAA,IACE,aAAa,MAAM,OAAO,0BAAyB,GAAG,oBAAoB,MAAM,IAAI;AAAA,IACpF;AAAA,EACF;AACJ;AAEF,IACG,QAAQ,sBAAsB,yDAAyD,EACvF,OAAO,yBAAyB,+DAA+D,EAC/F,OAAO,eAAe,2CAA2C,EACjE,OAAO,qBAAqB,gEAA2D,EACvF,OAAO,2BAA2B,uDAAuD,EACzF;AAAA,EACC,OACE,MACA,SASA;AAAA,IACE,aAAa,MAAM,OAAO,4BAA2B,GAAG,qBAAqB,MAAM,IAAI;AAAA,IACvF;AAAA,EACF;AACJ;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,eAAe,8CAA8C,EACpE,OAAO,gBAAgB,8CAA8C,EACrE,OAAO,UAAU,0DAA0D,EAC3E;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC,OACE,KACA,SAWA;AAAA,IACE,aACG,MAAM,OAAO,+BAA8B,GAAG,wBAAwB,KAAK,IAAI;AAAA,IAClF;AAAA,EACF;AACJ;AAEF,IACG,QAAQ,iBAAiB,4CAA4C,EACrE,OAAO,SAAS,8CAA8C,EAC9D,OAAO,iBAAiB,kEAAkE,EAC1F;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC,OACE,MACA,SAWA;AAAA,IACE,aAAa,MAAM,OAAO,uBAAsB,GAAG,iBAAiB,MAAM,IAAI;AAAA,IAC9E;AAAA,EACF;AACJ;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,WAAW,kDAAkD,EACpE,OAAO,oBAAoB,qDAAqD,EAChF;AAAA,EACC,OAAO,SACL;AAAA,IACE,aACG,MAAM,OAAO,+BAA8B,GAAG,wBAAwB;AAAA,MACrE,OAAO,KAAK;AAAA,MACZ,eAAe,KAAK;AAAA,IACtB,CAAC;AAAA,IACH;AAAA,EACF;AACJ;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,eAAe,mEAAmE,EACzF;AAAA,EAAO,OAAO,SACb;AAAA,IACE,aACG,MAAM,OAAO,iCAAgC,GAAG,0BAA0B;AAAA,MACzE,KAAK,KAAK;AAAA,IACZ,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,iBAAiB,0DAA0D,EAClF;AAAA,EAAO,OAAO,QAAgB,SAC7B,UAAU,aAAa,MAAM,OAAO,mBAAkB,GAAG,aAAa,QAAQ,IAAI,GAAG,IAAI;AAC3F;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,aAAa,8DAA8D,EAClF;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC,OACE,QACA,SAEA;AAAA,IACE,aAAa,MAAM,OAAO,4BAA2B,GAAG,sBAAsB,QAAQ,IAAI;AAAA,IAC1F;AAAA,EACF;AACJ;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,WAAW,sEAAsE,EACxF;AAAA,EAAO,OAAO,SACb;AAAA,IACE,aACG,MAAM,OAAO,kCAAiC,GAAG,2BAA2B;AAAA,MAC3E,OAAO,KAAK;AAAA,IACd,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,0BAA0B,iDAAiD,EAClF,OAAO,qBAAqB,mEAAmE,EAC/F;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC,OACE,QACA,KACA,SAYA;AAAA,IACE,aAAa,MAAM,OAAO,qBAAoB,GAAG,eAAe,QAAQ,KAAK,IAAI;AAAA,IACjF;AAAA,EACF;AACJ;AAEF,IACG;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC,OACE,QACA,QACA,SAEA;AAAA,IACE,aAAa,MAAM,OAAO,wBAAuB,GAAG,kBAAkB,QAAQ,QAAQ,IAAI;AAAA,IAC1F;AAAA,EACF;AACJ;AAEF,IAAI,KAAK;AACT,IAAI,QAAQ,OAAO;AASnB,IAAI,GAAG,aAAa,MAAM;AACxB,QAAM,UAAU,IAAI,KAAK,CAAC,KAAK,QAAQ,KAAK,CAAC,KAAK;AAClD,UAAQ;AAAA,IACN,2BAA2B,OAAO;AAAA,EACpC;AACA,UAAQ,KAAK,CAAC;AAChB,CAAC;AAED,IAAI,MAAM;","names":["dirname","dirname"]}

package/dist/cli/commands/audit.d.ts

@@ -1,4 +1,12 @@
 import { S as Site, a as AuditResult, A as AuditName } from '../../types-OIQZ5hWN.js';
+import { A as AirtableBase, F as FleetEvent } from '../../fleet-events-cF2Om88w.js';
+import 'airtable/lib/airtable_base.js';
+
+/** One site's just-written Airtable FieldSet, mirrored into site_health.
+ *  Resolves true when a site_health row matched; false when the UPDATE touched
+ *  0 rows (site created in Airtable after the last hourly import) — callers
+ *  count that as mirror_missed, never as mirrored. */
+type HealthMirror = (siteId: string, fields: Record<string, unknown>) => Promise<boolean>;
 
 type AuditCommandOptions = {
     only?: string;
@@ -46,5 +54,26 @@ declare function runAuditCommand(site: string | undefined, opts: AuditCommandOpt
     output: string;
     code: number;
 }>;
+/** The fleet `--write-airtable` step: write every site's audits back to its
+ *  Websites row, dual-write each just-written FieldSet into Turso (#539
+ *  Phase 3), and record fleet-activity events. Extracted from runAuditCommand
+ *  so the mirror WIRING itself is pinned by test — the mutation this seam
+ *  kills is dropping the `...(mirror ? { mirror } : {})` pass-through, which
+ *  would silently stop all five nightly sweeps from mirroring while every
+ *  sweep stayed green (adversarial review of #566, finding 6). Deps default
+ *  to the real fleet wiring; dynamic imports keep the no-write paths from
+ *  loading Airtable/db clients. */
+declare function runFleetWriteBack(args: {
+    results: AuditResult[];
+    which: AuditName[];
+    deps?: {
+        openBase?: () => AirtableBase;
+        makeMirror?: () => Promise<HealthMirror | null>;
+        recordEvents?: (events: FleetEvent[], now: Date) => Promise<void>;
+    };
+}): Promise<{
+    summary: string;
+    anyFailed: boolean;
+}>;
 
-export { type AuditCommandOptions, applyDeployedUrl, auditExitCode, auditNeedsCheckout, deployedUrlNotice, parseConcurrency, runAuditCommand };
+export { type AuditCommandOptions, applyDeployedUrl, auditExitCode, auditNeedsCheckout, deployedUrlNotice, parseConcurrency, runAuditCommand, runFleetWriteBack };