@reddoorla/maintenance 0.85.2 → 0.86.0

package/dist/{webflow-624FEBFD.js → webflow-IRKOIT7S.js}

@@ -1,9 +1,9 @@
-import {
-  runMigration
-} from "./chunk-6DOFNDXU.js";
 import {
   assetRef
 } from "./chunk-UWJZXL2D.js";
+import {
+  runMigration
+} from "./chunk-6DOFNDXU.js";
 
 // src/cli/commands/webflow.ts
 import { mkdir, readFile, writeFile } from "fs/promises";
@@ -545,4 +545,4 @@ async function runWebflowCommand(action, target, opts = {}) {
 export {
   runWebflowCommand
 };
-//# sourceMappingURL=webflow-624FEBFD.js.map
+//# sourceMappingURL=webflow-IRKOIT7S.js.map

package/dist/webhook-VOGOW3W6.js

@@ -0,0 +1,38 @@
+import {
+  isPublicHttpsUrl
+} from "./chunk-EVBCK2KC.js";
+
+// src/forms/webhook.ts
+function buildNewsletterWebhookBody(submission, site) {
+  return {
+    email: submission.email,
+    name: submission.name,
+    formType: submission.formType,
+    site: site.name,
+    sourceUrl: submission.sourceUrl,
+    utm: submission.utm,
+    submittedAt: submission.submittedAt
+  };
+}
+async function forwardNewsletterToWebhook(url, submission, site, fetchImpl = fetch) {
+  if (!isPublicHttpsUrl(url)) {
+    console.error(`[newsletter-webhook] refusing non-public/non-https url for site=${site.name}`);
+    return { ok: false, status: 0 };
+  }
+  try {
+    const res = await fetchImpl(url, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify(buildNewsletterWebhookBody(submission, site))
+    });
+    return { ok: res.ok, status: res.status };
+  } catch (err) {
+    console.error(`[newsletter-webhook] forward failed for site=${site.name}: ${String(err)}`);
+    return { ok: false, status: 0 };
+  }
+}
+export {
+  buildNewsletterWebhookBody,
+  forwardNewsletterToWebhook
+};
+//# sourceMappingURL=webhook-VOGOW3W6.js.map

package/dist/webhook-VOGOW3W6.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/forms/webhook.ts"],"sourcesContent":["import type { SubmissionRow } from \"../reports/submission-row.js\";\nimport type { WebsiteRow } from \"../reports/airtable/websites.js\";\nimport { isPublicHttpsUrl } from \"../util/url.js\";\n\nexport type WebhookForwardResult = { ok: boolean; status: number };\n\n/** The JSON body POSTed to a site's newsletter webhook (e.g. a Zapier Catch\n *  Hook). Lean, newsletter-relevant fields; the Zap maps them downstream. */\nexport function buildNewsletterWebhookBody(\n  submission: SubmissionRow,\n  site: WebsiteRow,\n): Record<string, unknown> {\n  return {\n    email: submission.email,\n    name: submission.name,\n    formType: submission.formType,\n    site: site.name,\n    sourceUrl: submission.sourceUrl,\n    utm: submission.utm,\n    submittedAt: submission.submittedAt,\n  };\n}\n\n/**\n * POST a newsletter submission to a site-configured webhook. NEVER throws — a\n * disallowed URL, non-2xx response, or network error returns `{ ok: false }` so\n * the caller treats it as a swallowed side-effect. Only PUBLIC https URLs are\n * allowed (the URL is operator-set in Airtable, but this is a server-side egress\n * — so an internal/loopback/private host is refused as an SSRF guard).\n */\nexport async function forwardNewsletterToWebhook(\n  url: string,\n  submission: SubmissionRow,\n  site: WebsiteRow,\n  fetchImpl: typeof fetch = fetch,\n): Promise<WebhookForwardResult> {\n  if (!isPublicHttpsUrl(url)) {\n    console.error(`[newsletter-webhook] refusing non-public/non-https url for site=${site.name}`);\n    return { ok: false, status: 0 };\n  }\n  try {\n    const res = await fetchImpl(url, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/json\" },\n      body: JSON.stringify(buildNewsletterWebhookBody(submission, site)),\n    });\n    return { ok: res.ok, status: res.status };\n  } catch (err) {\n    console.error(`[newsletter-webhook] forward failed for site=${site.name}: ${String(err)}`);\n    return { ok: false, status: 0 };\n  }\n}\n"],"mappings":";;;;;AAQO,SAAS,2BACd,YACA,MACyB;AACzB,SAAO;AAAA,IACL,OAAO,WAAW;AAAA,IAClB,MAAM,WAAW;AAAA,IACjB,UAAU,WAAW;AAAA,IACrB,MAAM,KAAK;AAAA,IACX,WAAW,WAAW;AAAA,IACtB,KAAK,WAAW;AAAA,IAChB,aAAa,WAAW;AAAA,EAC1B;AACF;AASA,eAAsB,2BACpB,KACA,YACA,MACA,YAA0B,OACK;AAC/B,MAAI,CAAC,iBAAiB,GAAG,GAAG;AAC1B,YAAQ,MAAM,mEAAmE,KAAK,IAAI,EAAE;AAC5F,WAAO,EAAE,IAAI,OAAO,QAAQ,EAAE;AAAA,EAChC;AACA,MAAI;AACF,UAAM,MAAM,MAAM,UAAU,KAAK;AAAA,MAC/B,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,2BAA2B,YAAY,IAAI,CAAC;AAAA,IACnE,CAAC;AACD,WAAO,EAAE,IAAI,IAAI,IAAI,QAAQ,IAAI,OAAO;AAAA,EAC1C,SAAS,KAAK;AACZ,YAAQ,MAAM,gDAAgD,KAAK,IAAI,KAAK,OAAO,GAAG,CAAC,EAAE;AACzF,WAAO,EAAE,IAAI,OAAO,QAAQ,EAAE;AAAA,EAChC;AACF;","names":[]}

package/dist/{websites-SADZR4XQ.js → websites-SXWTP72S.js}

@@ -17,8 +17,10 @@ import {
   parseNotifyRouting,
   parseSecurityAdvisories,
   siteSlug,
+  toFrequency,
   toPrismicModelsVerdict,
   toVerdict,
+  trimToNull,
   updateA11yCounts,
   updateAnalyticsHealth,
   updateAuditFields,
@@ -31,7 +33,7 @@ import {
   updateScores,
   updateSecurityCounts,
   updateSiteField
-} from "./chunk-577HCGZO.js";
+} from "./chunk-LDWZSLSU.js";
 export {
   ACTIVE_STATUSES,
   ARCHIVED_STATUSES,
@@ -51,8 +53,10 @@ export {
   parseNotifyRouting,
   parseSecurityAdvisories,
   siteSlug,
+  toFrequency,
   toPrismicModelsVerdict,
   toVerdict,
+  trimToNull,
   updateA11yCounts,
   updateAnalyticsHealth,
   updateAuditFields,
@@ -66,4 +70,4 @@ export {
   updateSecurityCounts,
   updateSiteField
 };
-//# sourceMappingURL=websites-SADZR4XQ.js.map
+//# sourceMappingURL=websites-SXWTP72S.js.map

package/dist/websites-SXWTP72S.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/{write-audits-to-airtable-7PH75YWY.js → write-audits-to-airtable-MBEILLPU.js}

@@ -2,13 +2,13 @@ import {
   formatFleetWriteSummary,
   writeAuditsToAirtable,
   writeFleetAuditsToAirtable
-} from "./chunk-3YXDSCM6.js";
-import "./chunk-PBWDDDQH.js";
+} from "./chunk-PPE5KZJK.js";
+import "./chunk-KTH5ZODA.js";
 import "./chunk-5L3FPQIJ.js";
-import "./chunk-577HCGZO.js";
+import "./chunk-LDWZSLSU.js";
 export {
   formatFleetWriteSummary,
   writeAuditsToAirtable,
   writeFleetAuditsToAirtable
 };
-//# sourceMappingURL=write-audits-to-airtable-7PH75YWY.js.map
+//# sourceMappingURL=write-audits-to-airtable-MBEILLPU.js.map

package/dist/write-audits-to-airtable-MBEILLPU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reddoorla/maintenance",
-  "version": "0.85.2",
+  "version": "0.86.0",
   "description": "Canonical maintenance configs, audits, and recipes for the reddoor stack.",
   "type": "module",
   "license": "MIT",
@@ -78,6 +78,7 @@
     }
   },
   "devDependencies": {
+    "@anthropic-ai/sdk": "^0.120.0",
     "@changesets/cli": "^2.31.0",
     "@google-analytics/data": "^7.0.0",
     "@lhci/cli": "^0.15.1",
@@ -100,7 +101,8 @@
     "tsup": "^8.3.0",
     "tsx": "^4.19.0",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.8"
+    "vitest": "^4.1.8",
+    "zod": "^4.4.3"
   },
   "scripts": {
     "build": "tsup",
@@ -109,6 +111,7 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
+    "test:time-travel": "REDDOOR_TIME_TRAVEL_DAYS=${REDDOOR_TIME_TRAVEL_DAYS:-90} vitest run",
     "pretest:dist": "pnpm run build",
     "test:dist": "node scripts/smoke-dist.mjs",
     "lint": "eslint . && prettier --check .",

package/dist/airtable-HRKSA7V4.js

@@ -1,9 +0,0 @@
-import {
-  fromAirtableBase
-} from "./chunk-NWB4O5EY.js";
-import "./chunk-U5SZ4FOP.js";
-import "./chunk-577HCGZO.js";
-export {
-  fromAirtableBase
-};
-//# sourceMappingURL=airtable-HRKSA7V4.js.map

package/dist/announce-GIAYN67S.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/recipes/announce.ts","../src/cli/commands/announce.ts"],"sourcesContent":["import { openBase, readAirtableConfig } from \"../reports/airtable/client.js\";\nimport type { AirtableBase } from \"../reports/airtable/client.js\";\nimport { listWebsites, siteSlug, updateAnalyticsHealth } from \"../reports/airtable/websites.js\";\nimport type { WebsiteRow } from \"../reports/airtable/websites.js\";\nimport { readGaConfig } from \"../reports/ga/config.js\";\nimport {\n  createDraft,\n  findReportByPeriod,\n  updateReportScores,\n  type ReportEnrichment,\n} from \"../reports/airtable/reports.js\";\nimport { queueDraft } from \"../reports/queue.js\";\nimport { uploadAttachment } from \"../reports/airtable/attachments.js\";\nimport { renderReportHtml } from \"../reports/render.js\";\nimport { resolveCopy } from \"../reports/copy.js\";\nimport { fetchGaUsers, fetchSearch } from \"../reports/draft.js\";\nimport { announcementSiteExtras } from \"../reports/announcement-email/template.js\";\nimport type { LighthouseScores } from \"../reports/types.js\";\nimport { defaultReportSubject } from \"../reports/subject.js\";\nimport { scoresFromRow } from \"../reports/report-data.js\";\n\nexport type AnnounceSiteResult =\n  | {\n      site: string;\n      status: \"drafted\" | \"reused\";\n      reportId: string;\n      recipientMissing: boolean;\n      /** False when a higher-or-equal-tier report was already queued (single-queue rule). */\n      queued: boolean;\n    }\n  | { site: string; status: \"skipped-no-scores\" }\n  | { site: string; status: \"error\"; message: string };\n\nexport type AnnounceResult = { results: AnnounceSiteResult[] };\n\n/** The traffic/search lookback window (days) the announcement reports on. The trend compares it\n *  against the equal-length prior window, and the email labels it \"vs the previous N days\". */\nconst GA_WINDOW_DAYS = 30;\n\nexport type AnnounceDeps = {\n  /** Airtable handle. Defaults to opening the live base from credentials. */\n  base?: AirtableBase;\n  /** When set, restrict to the single site whose slug matches. Default: all maintenance sites. */\n  site?: string;\n  /** Single timestamp driving the period key, render, draft, and preview filename. */\n  now?: Date;\n};\n\n/**\n * Draft the monthly-report ANNOUNCEMENT email for every `maintenance` site (or one,\n * via `deps.site`). Airtable-driven and fleet-wide: unlike `launch`, it runs no audits\n * and takes no `Site`/inventory object — it reads the Lighthouse scores already stored\n * on each Websites row. DRAFTS ONLY; the M3 approve loop sends.\n *\n * One bad site must never abort the run: each site is wrapped in its own try/catch that\n * records an `error` result and continues.\n */\nexport async function announce(deps?: AnnounceDeps): Promise<AnnounceResult> {\n  const base = deps?.base ?? openBase(readAirtableConfig());\n  const now = deps?.now ?? new Date();\n\n  const websites = await listWebsites(base);\n  let targets = websites.filter((w) => w.status === \"maintenance\");\n  if (deps?.site) {\n    const wanted = siteSlug(deps.site);\n    targets = targets.filter((w) => siteSlug(w.name) === wanted);\n  }\n\n  const period = now.toISOString().slice(0, 7);\n  const results: AnnounceSiteResult[] = [];\n\n  for (const w of targets) {\n    try {\n      const scores = scoresFromRow(w);\n      if (scores === null) {\n        results.push({ site: w.name, status: \"skipped-no-scores\" });\n        continue;\n      }\n\n      // Traffic + search snapshot over a ~30-day window ending now (fetchPeriodUsers derives\n      // the equal-length previous window for the trend). Reuses the report pipeline's\n      // soft-failing enrichment: GA/search unconfigured or an API error leaves the numbers\n      // null and the email simply omits the traffic section — it never blocks the draft.\n      const periodEnd = now;\n      const periodStart = new Date(now.getTime() - GA_WINDOW_DAYS * 24 * 60 * 60 * 1000);\n      const gaResult = await fetchGaUsers(w, periodStart, periodEnd);\n      const searchResult = await fetchSearch(w, periodStart, periodEnd);\n      const gaUsers = gaResult.value;\n      const search = searchResult.value;\n      const enrichment: ReportEnrichment = {\n        ...(gaUsers ? { gaUsersCurrent: gaUsers.current, gaUsersPrevious: gaUsers.previous } : {}),\n        ...(search ? { searchFoundPage1: search.foundOnPage1 } : {}),\n        ...(search?.foundOnPage1 && search.position !== null\n          ? { searchPosition: search.position }\n          : {}),\n      };\n\n      // Record this site's GA/Search enrichment health for the per-site analytics-failure\n      // signal (cockpit/digest) — exactly as the `--due` draft path does. Without this, an\n      // announcement-time GA outage hides the traffic block with NO operator signal (it reads\n      // identically to \"site has no GA configured\"). Set the timestamp on a soft-fail, clear\n      // it on a clean enrichment so the signal self-heals. Best-effort: the column is\n      // operator-added, so until it exists the write throws — which must not break the draft.\n      if (readGaConfig() !== null && Boolean(w.ga4PropertyId || w.searchQuery)) {\n        try {\n          await updateAnalyticsHealth(\n            base,\n            w.id,\n            gaResult.softFailed || searchResult.softFailed ? now.toISOString() : null,\n          );\n        } catch (e) {\n          console.warn(`⚠ analytics-health write skipped for ${w.name}: ${(e as Error).message}`);\n        }\n      }\n\n      // Dedupe: reuse an existing Announcement row for this (site, period) rather than\n      // stacking a second draft. The reuse path refreshes the stored scores + traffic/search\n      // (and Completed on) so the eventually-sent email — which reads the row — isn't stale.\n      // The create path writes them via createDraft.\n      let report;\n      let statusKind: \"drafted\" | \"reused\";\n      const existing = await findReportByPeriod(base, w.id, \"Announcement\", period);\n      if (existing) {\n        await updateReportScores(base, existing.id, scores, now, enrichment);\n        report = existing;\n        statusKind = \"reused\";\n      } else {\n        report = await createDraft(base, draftInputFor(w, scores, now, period, enrichment));\n        statusKind = \"drafted\";\n      }\n\n      const slug = siteSlug(w.name);\n      const { html } = await renderReportHtml({\n        siteName: w.name,\n        siteUrl: w.url,\n        reportType: \"Announcement\",\n        completedOn: now,\n        lighthouse: scores,\n        gaUsersCurrent: gaUsers?.current,\n        gaUsersPrevious: gaUsers?.previous,\n        gaPeriodDays: GA_WINDOW_DAYS,\n        searchPosition: search?.foundOnPage1 ? (search.position ?? undefined) : undefined,\n        lastTestedDate: null,\n        commentary: null,\n        copy: resolveCopy(w),\n        headerImageCid: `${slug}-header`,\n        // cadence (the client's go-forward pace, \"None\" omitted) + default-on improvement\n        // callouts. Shared with the send re-render via announcementSiteExtras so the sent\n        // email matches this reviewed preview.\n        ...announcementSiteExtras(w),\n      });\n\n      // A preview-upload hiccup must NOT fail the site — log and continue.\n      try {\n        await uploadAttachment(\n          report.id,\n          \"Rendered HTML\",\n          html,\n          `${slug}-${now.toISOString().slice(0, 10)}.html`,\n          \"text/html\",\n        );\n      } catch (uploadErr) {\n        console.warn(\n          `⚠ Announcement preview upload skipped for ${w.name}: ${\n            uploadErr instanceof Error ? uploadErr.message : String(uploadErr)\n          }`,\n        );\n      }\n\n      // Critical: NOT wrapped — without queueing, the draft never enters the approve queue,\n      // so a failure here must surface as an error result for the site. queueDraft also\n      // supersedes any lower-tier (Maintenance/Testing) drafts queued for this site, and\n      // stands down if an equal-or-higher report is already queued (single-queue rule).\n      const queue = await queueDraft(base, {\n        id: report.id,\n        siteId: w.id,\n        reportType: \"Announcement\",\n      });\n\n      const recipientMissing = !(w.reportRecipientsTo && w.reportRecipientsTo.trim());\n      results.push({\n        site: w.name,\n        status: statusKind,\n        reportId: report.id,\n        recipientMissing,\n        queued: queue.queued,\n      });\n    } catch (err) {\n      results.push({\n        site: w.name,\n        status: \"error\",\n        message: err instanceof Error ? err.message : String(err),\n      });\n    }\n  }\n\n  return { results };\n}\n\n/** Build the Announcement `DraftInput`. Announcements have no period window and no prior\n *  maintenance test, so periodStart/periodEnd/completedOn all collapse to `now` and\n *  `lastTestedDate` is null. The subject override gives the email a purpose-built line. */\nfunction draftInputFor(\n  w: WebsiteRow,\n  scores: LighthouseScores,\n  now: Date,\n  period: string,\n  enrichment: ReportEnrichment,\n): Parameters<typeof createDraft>[1] {\n  return {\n    reportId: `${w.name} — Announcement — ${now.toISOString().slice(0, 10)}`,\n    siteId: w.id,\n    reportType: \"Announcement\",\n    period,\n    periodStart: now,\n    periodEnd: now,\n    completedOn: now,\n    lighthouse: scores,\n    lastTestedDate: null,\n    subjectOverride: defaultReportSubject({\n      name: w.name,\n      url: w.url,\n      type: \"Announcement\",\n      date: now,\n    }),\n    ...enrichment,\n  };\n}\n","import { announce, type AnnounceResult, type AnnounceSiteResult } from \"../../recipes/announce.js\";\n\nexport type AnnounceCommandOptions = {\n  cwd?: string;\n};\n\nfunction formatSiteResult(r: AnnounceSiteResult): string {\n  if (r.status === \"skipped-no-scores\") return `[${r.site}] skipped-no-scores`;\n  if (r.status === \"error\") return `[${r.site}] error: ${r.message}`;\n  const note = r.recipientMissing ? \" ⚠ recipient missing\" : \"\";\n  return `[${r.site}] ${r.status}${note}`;\n}\n\nexport function formatAnnounceResult(result: AnnounceResult): string {\n  if (result.results.length === 0) return \"No maintenance sites to announce.\";\n  return result.results.map(formatSiteResult).join(\"\\n\");\n}\n\n/**\n * `announce [site]` — Airtable-driven and fleet-wide. Draft the monthly-report\n * announcement email for every `maintenance` site (or one, when `site` is given) into\n * the M3 approve queue. Never sends; the operator approves each draft and the next send\n * run delivers it. Reads the Lighthouse scores already stored on each Websites row —\n * no audits are run.\n */\nexport async function runAnnounceCommand(\n  site: string | undefined,\n  _opts: AnnounceCommandOptions,\n): Promise<{ output: string; code: number }> {\n  const result = await announce(site ? { site } : {});\n  const hadError = result.results.some((r) => r.status === \"error\");\n  return { output: formatAnnounceResult(result), code: hadError ? 1 : 0 };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCA,IAAM,iBAAiB;AAoBvB,eAAsB,SAAS,MAA8C;AAC3E,QAAM,OAAO,MAAM,QAAQ,SAAS,mBAAmB,CAAC;AACxD,QAAM,MAAM,MAAM,OAAO,oBAAI,KAAK;AAElC,QAAM,WAAW,MAAM,aAAa,IAAI;AACxC,MAAI,UAAU,SAAS,OAAO,CAAC,MAAM,EAAE,WAAW,aAAa;AAC/D,MAAI,MAAM,MAAM;AACd,UAAM,SAAS,SAAS,KAAK,IAAI;AACjC,cAAU,QAAQ,OAAO,CAAC,MAAM,SAAS,EAAE,IAAI,MAAM,MAAM;AAAA,EAC7D;AAEA,QAAM,SAAS,IAAI,YAAY,EAAE,MAAM,GAAG,CAAC;AAC3C,QAAM,UAAgC,CAAC;AAEvC,aAAW,KAAK,SAAS;AACvB,QAAI;AACF,YAAM,SAAS,cAAc,CAAC;AAC9B,UAAI,WAAW,MAAM;AACnB,gBAAQ,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,oBAAoB,CAAC;AAC1D;AAAA,MACF;AAMA,YAAM,YAAY;AAClB,YAAM,cAAc,IAAI,KAAK,IAAI,QAAQ,IAAI,iBAAiB,KAAK,KAAK,KAAK,GAAI;AACjF,YAAM,WAAW,MAAM,aAAa,GAAG,aAAa,SAAS;AAC7D,YAAM,eAAe,MAAM,YAAY,GAAG,aAAa,SAAS;AAChE,YAAM,UAAU,SAAS;AACzB,YAAM,SAAS,aAAa;AAC5B,YAAM,aAA+B;AAAA,QACnC,GAAI,UAAU,EAAE,gBAAgB,QAAQ,SAAS,iBAAiB,QAAQ,SAAS,IAAI,CAAC;AAAA,QACxF,GAAI,SAAS,EAAE,kBAAkB,OAAO,aAAa,IAAI,CAAC;AAAA,QAC1D,GAAI,QAAQ,gBAAgB,OAAO,aAAa,OAC5C,EAAE,gBAAgB,OAAO,SAAS,IAClC,CAAC;AAAA,MACP;AAQA,UAAI,aAAa,MAAM,QAAQ,QAAQ,EAAE,iBAAiB,EAAE,WAAW,GAAG;AACxE,YAAI;AACF,gBAAM;AAAA,YACJ;AAAA,YACA,EAAE;AAAA,YACF,SAAS,cAAc,aAAa,aAAa,IAAI,YAAY,IAAI;AAAA,UACvE;AAAA,QACF,SAAS,GAAG;AACV,kBAAQ,KAAK,6CAAwC,EAAE,IAAI,KAAM,EAAY,OAAO,EAAE;AAAA,QACxF;AAAA,MACF;AAMA,UAAI;AACJ,UAAI;AACJ,YAAM,WAAW,MAAM,mBAAmB,MAAM,EAAE,IAAI,gBAAgB,MAAM;AAC5E,UAAI,UAAU;AACZ,cAAM,mBAAmB,MAAM,SAAS,IAAI,QAAQ,KAAK,UAAU;AACnE,iBAAS;AACT,qBAAa;AAAA,MACf,OAAO;AACL,iBAAS,MAAM,YAAY,MAAM,cAAc,GAAG,QAAQ,KAAK,QAAQ,UAAU,CAAC;AAClF,qBAAa;AAAA,MACf;AAEA,YAAM,OAAO,SAAS,EAAE,IAAI;AAC5B,YAAM,EAAE,KAAK,IAAI,MAAM,iBAAiB;AAAA,QACtC,UAAU,EAAE;AAAA,QACZ,SAAS,EAAE;AAAA,QACX,YAAY;AAAA,QACZ,aAAa;AAAA,QACb,YAAY;AAAA,QACZ,gBAAgB,SAAS;AAAA,QACzB,iBAAiB,SAAS;AAAA,QAC1B,cAAc;AAAA,QACd,gBAAgB,QAAQ,eAAgB,OAAO,YAAY,SAAa;AAAA,QACxE,gBAAgB;AAAA,QAChB,YAAY;AAAA,QACZ,MAAM,YAAY,CAAC;AAAA,QACnB,gBAAgB,GAAG,IAAI;AAAA;AAAA;AAAA;AAAA,QAIvB,GAAG,uBAAuB,CAAC;AAAA,MAC7B,CAAC;AAGD,UAAI;AACF,cAAM;AAAA,UACJ,OAAO;AAAA,UACP;AAAA,UACA;AAAA,UACA,GAAG,IAAI,IAAI,IAAI,YAAY,EAAE,MAAM,GAAG,EAAE,CAAC;AAAA,UACzC;AAAA,QACF;AAAA,MACF,SAAS,WAAW;AAClB,gBAAQ;AAAA,UACN,kDAA6C,EAAE,IAAI,KACjD,qBAAqB,QAAQ,UAAU,UAAU,OAAO,SAAS,CACnE;AAAA,QACF;AAAA,MACF;AAMA,YAAM,QAAQ,MAAM,WAAW,MAAM;AAAA,QACnC,IAAI,OAAO;AAAA,QACX,QAAQ,EAAE;AAAA,QACV,YAAY;AAAA,MACd,CAAC;AAED,YAAM,mBAAmB,EAAE,EAAE,sBAAsB,EAAE,mBAAmB,KAAK;AAC7E,cAAQ,KAAK;AAAA,QACX,MAAM,EAAE;AAAA,QACR,QAAQ;AAAA,QACR,UAAU,OAAO;AAAA,QACjB;AAAA,QACA,QAAQ,MAAM;AAAA,MAChB,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,cAAQ,KAAK;AAAA,QACX,MAAM,EAAE;AAAA,QACR,QAAQ;AAAA,QACR,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MAC1D,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO,EAAE,QAAQ;AACnB;AAKA,SAAS,cACP,GACA,QACA,KACA,QACA,YACmC;AACnC,SAAO;AAAA,IACL,UAAU,GAAG,EAAE,IAAI,+BAAqB,IAAI,YAAY,EAAE,MAAM,GAAG,EAAE,CAAC;AAAA,IACtE,QAAQ,EAAE;AAAA,IACV,YAAY;AAAA,IACZ;AAAA,IACA,aAAa;AAAA,IACb,WAAW;AAAA,IACX,aAAa;AAAA,IACb,YAAY;AAAA,IACZ,gBAAgB;AAAA,IAChB,iBAAiB,qBAAqB;AAAA,MACpC,MAAM,EAAE;AAAA,MACR,KAAK,EAAE;AAAA,MACP,MAAM;AAAA,MACN,MAAM;AAAA,IACR,CAAC;AAAA,IACD,GAAG;AAAA,EACL;AACF;;;AC7NA,SAAS,iBAAiB,GAA+B;AACvD,MAAI,EAAE,WAAW,oBAAqB,QAAO,IAAI,EAAE,IAAI;AACvD,MAAI,EAAE,WAAW,QAAS,QAAO,IAAI,EAAE,IAAI,YAAY,EAAE,OAAO;AAChE,QAAM,OAAO,EAAE,mBAAmB,8BAAyB;AAC3D,SAAO,IAAI,EAAE,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI;AACvC;AAEO,SAAS,qBAAqB,QAAgC;AACnE,MAAI,OAAO,QAAQ,WAAW,EAAG,QAAO;AACxC,SAAO,OAAO,QAAQ,IAAI,gBAAgB,EAAE,KAAK,IAAI;AACvD;AASA,eAAsB,mBACpB,MACA,OAC2C;AAC3C,QAAM,SAAS,MAAM,SAAS,OAAO,EAAE,KAAK,IAAI,CAAC,CAAC;AAClD,QAAM,WAAW,OAAO,QAAQ,KAAK,CAAC,MAAM,EAAE,WAAW,OAAO;AAChE,SAAO,EAAE,QAAQ,qBAAqB,MAAM,GAAG,MAAM,WAAW,IAAI,EAAE;AACxE;","names":[]}

package/dist/chunk-37S6L6G4.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/reports/header-image/assets/index.ts","../src/reports/header-image/index.ts","../src/reports/header-image/capture.ts","../src/reports/header-image/compose.ts","../src/reports/header-image/geometry.ts"],"sourcesContent":["import { readFile } from \"node:fs/promises\";\nimport { existsSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\n\nconst PLATE = \"plate.png\";\n\n// Walk up from this module's URL looking for the assets dir in either the dev\n// layout (src/reports/header-image/assets/) or the published layout\n// (dist/reports/header-image/assets/). REQUIRED because tsup inlines this module\n// into dist/cli/bin.js — so import.meta.url-based sibling resolution looks in\n// dist/cli/ and fails with ENOENT. This exact bug shipped in 0.10.0-0.10.1 for\n// the maintenance-email assets; tests passed in dev because vitest evaluates the\n// source file, where import.meta.url is already correct. Only `pnpm test:dist`\n// catches a regression here.\nlet cachedAssetsDir: string | null = null;\nfunction resolveAssetsDir(): string {\n  if (cachedAssetsDir) return cachedAssetsDir;\n  let dir = dirname(fileURLToPath(import.meta.url));\n  for (;;) {\n    for (const layout of [\"src\", \"dist\"]) {\n      const candidate = join(dir, layout, \"reports\", \"header-image\", \"assets\", PLATE);\n      if (existsSync(candidate)) {\n        cachedAssetsDir = dirname(candidate);\n        return cachedAssetsDir;\n      }\n    }\n    const parent = dirname(dir);\n    if (parent === dir) {\n      throw new Error(\n        `loadPlate: could not locate the header-image assets dir by walking up from ${fileURLToPath(import.meta.url)}. Checked both src/ and dist/ layouts.`,\n      );\n    }\n    dir = parent;\n  }\n}\n\n/** Read the bundled 2400x3200 plate. */\nexport async function loadPlate(): Promise<Uint8Array> {\n  return new Uint8Array(await readFile(join(resolveAssetsDir(), PLATE)));\n}\n","import sharp from \"sharp\";\nimport { captureHomepage, type Shooter } from \"./capture.js\";\nimport { composeHeaderImage } from \"./compose.js\";\nimport { loadPlate } from \"./assets/index.js\";\n\nexport type GenerateInput = {\n  /** The site's production URL. */\n  url: string;\n  /** Airtable site slug; drives the attachment filename. */\n  slug?: string;\n  /** Injected browser IO (tests). */\n  shooter?: Shooter;\n  /** Per-site settle override for animation-heavy or consent-gated homepages. */\n  settleMs?: number;\n};\n\nexport type GeneratedHeaderImage = {\n  bytes: Uint8Array;\n  /** The domain as printed on the plate. */\n  domain: string;\n  filename: string;\n  contentType: \"image/jpeg\";\n};\n\n/** Strip scheme, leading www and any path — the plate prints a bare domain. */\nexport function domainFromUrl(url: string): string {\n  return new URL(url).hostname.replace(/^www\\./, \"\");\n}\n\n/**\n * A capture is \"blank\" when it is almost entirely near-white — a consent gate,\n * a failed render (blank canvas), or a shot fired before first paint. The\n * operator reviews the rendered email before sending, so this is a backstop\n * rather than the only gate; its job is to stop an obviously broken shot from\n * replacing a good stored header.\n *\n * Uniformity alone is NOT the signal: a homepage with a large solid-colour\n * hero (any brand colour) is legitimately uniform but not blank. Only\n * near-white uniformity is flagged, since every real failure mode here\n * (consent overlay, unrendered canvas, pre-paint flash) lands on a white\n * background.\n */\nasync function assertNotBlank(shot: Uint8Array): Promise<void> {\n  const { data, info } = await sharp(Buffer.from(shot))\n    .resize(64, 40, { fit: \"fill\" })\n    .removeAlpha()\n    .raw()\n    .toBuffer({ resolveWithObject: true });\n  const total = info.width * info.height;\n  const at = (i: number): number => data[i] ?? 0;\n\n  let sumR = 0;\n  let sumG = 0;\n  let sumB = 0;\n  for (let i = 0; i < data.length; i += info.channels) {\n    sumR += at(i);\n    sumG += at(i + 1);\n    sumB += at(i + 2);\n  }\n  const meanR = sumR / total;\n  const meanG = sumG / total;\n  const meanB = sumB / total;\n\n  let near = 0;\n  for (let i = 0; i < data.length; i += info.channels) {\n    if (\n      Math.abs(at(i) - meanR) < 8 &&\n      Math.abs(at(i + 1) - meanG) < 8 &&\n      Math.abs(at(i + 2) - meanB) < 8\n    ) {\n      near++;\n    }\n  }\n\n  const uniform = near / total > 0.95;\n  const nearWhite = meanR > 240 && meanG > 240 && meanB > 240;\n  if (uniform && nearWhite) {\n    throw new Error(\n      \"header-image: capture looks blank (near-white, >95% one colour) — keeping the existing header\",\n    );\n  }\n}\n\n/** Capture a site's homepage and composite its header image. */\nexport async function generateHeaderImage(input: GenerateInput): Promise<GeneratedHeaderImage> {\n  const screenshot = await captureHomepage(input.url, {\n    ...(input.shooter !== undefined ? { shooter: input.shooter } : {}),\n    ...(input.settleMs !== undefined ? { settleMs: input.settleMs } : {}),\n  });\n  await assertNotBlank(screenshot);\n\n  const domain = domainFromUrl(input.url);\n  const bytes = await composeHeaderImage({\n    plate: await loadPlate(),\n    screenshot,\n    domain,\n  });\n  const base = input.slug ?? domain.split(\".\")[0];\n  return { bytes, domain, filename: `${base}Header.jpg`, contentType: \"image/jpeg\" };\n}\n","/** Viewport matching the plate's MacBook screen aspect (16:10), so the crop in\n *  compose.ts is a no-op for a well-behaved homepage. */\nconst VIEWPORT = { width: 1600, height: 1000 } as const;\n/** 2x so the 1349px-wide screen rect is fed real pixels, not upscaled ones. */\nconst DEVICE_SCALE_FACTOR = 2;\n/** Entrance animations and webfonts settle before the shutter. Measured against\n *  live fleet sites; overridable per site because consent gates and long\n *  animations vary. */\nconst DEFAULT_SETTLE_MS = 2500;\n/** Budget for the `load` milestone — the navigation we actually gate on.\n *\n *  Do NOT put `waitUntil: \"networkidle\"` back on the `goto`. Measured across all\n *  14 live fleet sites (30s timeout): `load` succeeded on 14/14 in 346–1205ms,\n *  while `networkidle` NEVER fired on 4 of them (ERP Industrials, Vineyard,\n *  Revogen, 1836dig) — chat widgets, analytics polling and websockets hold the\n *  connection open forever, so `goto` threw and those sites could never get a\n *  header image at all. */\nconst NAV_TIMEOUT_MS = 60_000;\n/** Best-effort extra wait for network idle, applied *after* `load` and with its\n *  rejection swallowed. The 10 sites that do settle still get the benefit; the 4\n *  that never will just proceed. 3s is sized from the measurement above: the\n *  slowest site that does reach idle took 4078ms from `goto` start, and by the\n *  time this runs the `load` milestone (~0.3–1.2s) has already passed, so 3s\n *  covers the real remaining settle time without stalling the never-idle sites. */\nconst IDLE_BUDGET_MS = 3_000;\n\nexport type ShootOptions = {\n  url: string;\n  width: number;\n  height: number;\n  deviceScaleFactor: number;\n  settleMs: number;\n};\n\n/** Injected browser IO. The real impl drives Playwright; tests pass a fake. */\nexport type Shooter = {\n  shoot: (opts: ShootOptions) => Promise<Uint8Array>;\n};\n\nexport type CaptureOptions = {\n  shooter?: Shooter;\n  settleMs?: number;\n};\n\n/**\n * Screenshot a site's homepage for the header image.\n *\n * Viewport-only, never `fullPage`: the plate shows a laptop screen, not a\n * scroll. Failures propagate — a caller must be able to keep the site's existing\n * header rather than overwrite it with a broken shot.\n */\nexport async function captureHomepage(\n  url: string,\n  options: CaptureOptions = {},\n): Promise<Uint8Array> {\n  const shooter = options.shooter ?? (await defaultShooter());\n  return shooter.shoot({\n    url,\n    width: VIEWPORT.width,\n    height: VIEWPORT.height,\n    deviceScaleFactor: DEVICE_SCALE_FACTOR,\n    settleMs: options.settleMs ?? DEFAULT_SETTLE_MS,\n  });\n}\n\n/** Real Playwright shooter. Lazily imported so unit tests never load it and the\n *  static import graph stays central-dep-free for `test:dist`. */\nexport async function defaultShooter(): Promise<Shooter> {\n  const { chromium } = await import(\"@playwright/test\");\n  return {\n    async shoot(opts) {\n      const browser = await chromium.launch();\n      try {\n        const page = await browser.newPage({\n          viewport: { width: opts.width, height: opts.height },\n          deviceScaleFactor: opts.deviceScaleFactor,\n        });\n        await page.goto(opts.url, { waitUntil: \"load\", timeout: NAV_TIMEOUT_MS });\n        // Best-effort only — a site that never idles must still be captured.\n        await page.waitForLoadState(\"networkidle\", { timeout: IDLE_BUDGET_MS }).catch(() => {});\n        await page.evaluate(\"document.fonts && document.fonts.ready\");\n        await page.waitForTimeout(opts.settleMs);\n        const buf = await page.screenshot({ type: \"png\" });\n        return new Uint8Array(buf);\n      } finally {\n        await browser.close();\n      }\n    },\n  };\n}\n","import sharp from \"sharp\";\nimport type { OverlayOptions } from \"sharp\";\nimport { CANVAS, SCREEN, DOMAIN, PAPER } from \"./geometry.js\";\n\nexport type ComposeInput = {\n  /** The bundled 2400x3200 plate. */\n  plate: Uint8Array;\n  /** A homepage screenshot, any size. Cropped to fill the screen rect. */\n  screenshot: Uint8Array;\n  /** The site's public domain, drawn bottom-left (e.g. \"gallerysonder.com\"). */\n  domain: string;\n};\n\n/** JPEG quality. The hand-made headers are ~2.4MB; 88 lands near 0.7MB with no\n *  visible difference at the 600px the email actually renders. */\nconst JPEG_QUALITY = 88;\n\n/** Escape the five XML metacharacters. The domain is interpolated into an SVG,\n *  and a bare `&` yields invalid XML that sharp rejects outright. */\nfunction escapeXml(s: string): string {\n  return s\n    .replace(/&/g, \"&amp;\")\n    .replace(/</g, \"&lt;\")\n    .replace(/>/g, \"&gt;\")\n    .replace(/\"/g, \"&quot;\")\n    .replace(/'/g, \"&apos;\");\n}\n\n/**\n * The domain line as a transparent SVG overlay the size of the full canvas, so\n * it can be composited at 0,0 and positioned by its own coordinates.\n *\n * ⚠️ FONT AVAILABILITY IS ENVIRONMENT-DEPENDENT. sharp renders SVG through\n * librsvg + fontconfig, so the family below resolves against INSTALLED fonts.\n * On macOS it resolves to real Helvetica Neue, which reproduces the hand-made\n * reference exactly (verified: ink box dx=0 dy=0 dw=0 dh=0). A stock\n * ubuntu-latest runner has none of Helvetica Neue / Helvetica / Arial, so it\n * falls through to `sans-serif` — typically DejaVu Sans, which is wider and\n * would render a visibly different domain line.\n *\n * This matters because report drafting (which regenerates the header) runs on\n * ubuntu-latest in `.github/workflows/daily-reports.yml`. That workflow now\n * installs `fonts-urw-base35`, which provides Nimbus Sans — metrically\n * equivalent to Helvetica and third in the stack below — so a CI-generated\n * header's domain line matches a locally-generated one. Any OTHER environment\n * that runs this code still needs a Helvetica-metric font installed.\n */\nfunction domainSvg(domain: string): Buffer {\n  return Buffer.from(\n    `<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"${CANVAS.width}\" height=\"${CANVAS.height}\">\n       <text x=\"${DOMAIN.x}\" y=\"${DOMAIN.baseline}\"\n             font-family=\"Helvetica Neue, Helvetica, Nimbus Sans, Arial, sans-serif\"\n             font-size=\"${DOMAIN.size}\" font-weight=\"${DOMAIN.weight}\"\n             fill=\"${DOMAIN.color}\">${escapeXml(domain)}</text>\n     </svg>`,\n    \"utf-8\",\n  );\n}\n\n/**\n * Composite one site's header image: paste its homepage screenshot into the\n * plate's laptop screen and draw its domain underneath.\n *\n * PURE — no browser, no network, no filesystem. Fidelity lives here, so it must\n * be verifiable in a unit test.\n *\n * The screenshot is cropped to FILL the 16:10 screen from the top: a taller\n * homepage loses its fold rather than being squashed, which would be obvious\n * and wrong. `flatten` guards against a transparent source punching a hole in\n * the plate.\n */\nexport async function composeHeaderImage(input: ComposeInput): Promise<Uint8Array> {\n  const screen = await sharp(Buffer.from(input.screenshot))\n    .resize(SCREEN.w, SCREEN.h, { fit: \"cover\", position: \"top\" })\n    .flatten({ background: PAPER })\n    .toBuffer();\n\n  const layers: OverlayOptions[] = [{ input: screen, left: SCREEN.x, top: SCREEN.y }];\n  if (input.domain.trim().length > 0) {\n    layers.push({ input: domainSvg(input.domain), left: 0, top: 0 });\n  }\n\n  const out = await sharp(Buffer.from(input.plate))\n    .composite(layers)\n    .jpeg({ quality: JPEG_QUALITY })\n    .toBuffer();\n  return new Uint8Array(out);\n}\n","// Measured off the real plate, not guessed.\n//\n// SCREEN is the hole INSIDE the laptop bezel. It is derived from the bezel —\n// a perfectly flat black frame (luminance 0.0) — because that is\n// content-independent. Deriving it from content instead (diffing two headers for\n// pixels that vary) yields x=282 y=1856 w=1394 h=871, which is WRONG: that rect\n// spans the laptop's outer panel, covering the bezel on three sides while\n// falling ~29px short at the bottom, so the plate's baked-in screenshot shows\n// as a strip under every site's content.\n//\n// Cross-checked: the photo-to-flat-black transition at the bottom of the plate\n// lands at y=2756, exactly SCREEN.y + SCREEN.h - 1.\n//\n// Re-measure only if the Figma template changes — and if you do, find the bezel.\n\n/** The plate's pixel dimensions — Figma frame 600x800 exported at 4x. */\nexport const CANVAS = { width: 2400, height: 3200 } as const;\n\n/** The MacBook Pro screen the site screenshot is pasted into — the area inside\n *  the bezel, so the bezel stays visible around the content exactly as it does\n *  in the hand-made headers. Aspect 1.5983 (16:10 to within 0.1%). */\nexport const SCREEN = { x: 302, y: 1913, w: 1349, h: 844 } as const;\n\n/** The per-site domain line, bottom left.\n *\n *  Solved against the hand-made reference rather than guessed: rendering\n *  \"gallerysonder.com\" with these values reproduces Sonder's original ink box\n *  (x=283 y=2963 w=645 h=74) EXACTLY — dx=0 dy=0 dw=0 dh=0. A sweep over sizes\n *  62-88 at weights 300/400 has a single exact solution at size 80 / weight 400.\n *\n *  `baseline` is the text baseline in canvas pixels; the ink box sits above it\n *  by the cap height and below by the descender. */\nexport const DOMAIN = {\n  x: 280,\n  baseline: 3020,\n  size: 80,\n  weight: 400,\n  color: \"#747474\",\n} as const;\n\n/** Flat paper tone, used as the compositing background so a transparent or\n *  short source can never punch a hole in the plate. */\nexport const PAPER = \"#fcfcfc\" as const;\n"],"mappings":";AAAA,SAAS,gBAAgB;AACzB,SAAS,kBAAkB;AAC3B,SAAS,SAAS,YAAY;AAC9B,SAAS,qBAAqB;AAE9B,IAAM,QAAQ;AAUd,IAAI,kBAAiC;AACrC,SAAS,mBAA2B;AAClC,MAAI,gBAAiB,QAAO;AAC5B,MAAI,MAAM,QAAQ,cAAc,YAAY,GAAG,CAAC;AAChD,aAAS;AACP,eAAW,UAAU,CAAC,OAAO,MAAM,GAAG;AACpC,YAAM,YAAY,KAAK,KAAK,QAAQ,WAAW,gBAAgB,UAAU,KAAK;AAC9E,UAAI,WAAW,SAAS,GAAG;AACzB,0BAAkB,QAAQ,SAAS;AACnC,eAAO;AAAA,MACT;AAAA,IACF;AACA,UAAM,SAAS,QAAQ,GAAG;AAC1B,QAAI,WAAW,KAAK;AAClB,YAAM,IAAI;AAAA,QACR,8EAA8E,cAAc,YAAY,GAAG,CAAC;AAAA,MAC9G;AAAA,IACF;AACA,UAAM;AAAA,EACR;AACF;AAGA,eAAsB,YAAiC;AACrD,SAAO,IAAI,WAAW,MAAM,SAAS,KAAK,iBAAiB,GAAG,KAAK,CAAC,CAAC;AACvE;;;ACxCA,OAAOA,YAAW;;;ACElB,IAAM,WAAW,EAAE,OAAO,MAAM,QAAQ,IAAK;AAE7C,IAAM,sBAAsB;AAI5B,IAAM,oBAAoB;AAS1B,IAAM,iBAAiB;AAOvB,IAAM,iBAAiB;AA2BvB,eAAsB,gBACpB,KACA,UAA0B,CAAC,GACN;AACrB,QAAM,UAAU,QAAQ,WAAY,MAAM,eAAe;AACzD,SAAO,QAAQ,MAAM;AAAA,IACnB;AAAA,IACA,OAAO,SAAS;AAAA,IAChB,QAAQ,SAAS;AAAA,IACjB,mBAAmB;AAAA,IACnB,UAAU,QAAQ,YAAY;AAAA,EAChC,CAAC;AACH;AAIA,eAAsB,iBAAmC;AACvD,QAAM,EAAE,SAAS,IAAI,MAAM,OAAO,kBAAkB;AACpD,SAAO;AAAA,IACL,MAAM,MAAM,MAAM;AAChB,YAAM,UAAU,MAAM,SAAS,OAAO;AACtC,UAAI;AACF,cAAM,OAAO,MAAM,QAAQ,QAAQ;AAAA,UACjC,UAAU,EAAE,OAAO,KAAK,OAAO,QAAQ,KAAK,OAAO;AAAA,UACnD,mBAAmB,KAAK;AAAA,QAC1B,CAAC;AACD,cAAM,KAAK,KAAK,KAAK,KAAK,EAAE,WAAW,QAAQ,SAAS,eAAe,CAAC;AAExE,cAAM,KAAK,iBAAiB,eAAe,EAAE,SAAS,eAAe,CAAC,EAAE,MAAM,MAAM;AAAA,QAAC,CAAC;AACtF,cAAM,KAAK,SAAS,wCAAwC;AAC5D,cAAM,KAAK,eAAe,KAAK,QAAQ;AACvC,cAAM,MAAM,MAAM,KAAK,WAAW,EAAE,MAAM,MAAM,CAAC;AACjD,eAAO,IAAI,WAAW,GAAG;AAAA,MAC3B,UAAE;AACA,cAAM,QAAQ,MAAM;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AACF;;;ACzFA,OAAO,WAAW;;;ACgBX,IAAM,SAAS,EAAE,OAAO,MAAM,QAAQ,KAAK;AAK3C,IAAM,SAAS,EAAE,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI;AAWlD,IAAM,SAAS;AAAA,EACpB,GAAG;AAAA,EACH,UAAU;AAAA,EACV,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,OAAO;AACT;AAIO,IAAM,QAAQ;;;AD3BrB,IAAM,eAAe;AAIrB,SAAS,UAAU,GAAmB;AACpC,SAAO,EACJ,QAAQ,MAAM,OAAO,EACrB,QAAQ,MAAM,MAAM,EACpB,QAAQ,MAAM,MAAM,EACpB,QAAQ,MAAM,QAAQ,EACtB,QAAQ,MAAM,QAAQ;AAC3B;AAqBA,SAAS,UAAU,QAAwB;AACzC,SAAO,OAAO;AAAA,IACZ,kDAAkD,OAAO,KAAK,aAAa,OAAO,MAAM;AAAA,kBAC1E,OAAO,CAAC,QAAQ,OAAO,QAAQ;AAAA;AAAA,0BAEvB,OAAO,IAAI,kBAAkB,OAAO,MAAM;AAAA,qBAC/C,OAAO,KAAK,KAAK,UAAU,MAAM,CAAC;AAAA;AAAA,IAEnD;AAAA,EACF;AACF;AAcA,eAAsB,mBAAmB,OAA0C;AACjF,QAAM,SAAS,MAAM,MAAM,OAAO,KAAK,MAAM,UAAU,CAAC,EACrD,OAAO,OAAO,GAAG,OAAO,GAAG,EAAE,KAAK,SAAS,UAAU,MAAM,CAAC,EAC5D,QAAQ,EAAE,YAAY,MAAM,CAAC,EAC7B,SAAS;AAEZ,QAAM,SAA2B,CAAC,EAAE,OAAO,QAAQ,MAAM,OAAO,GAAG,KAAK,OAAO,EAAE,CAAC;AAClF,MAAI,MAAM,OAAO,KAAK,EAAE,SAAS,GAAG;AAClC,WAAO,KAAK,EAAE,OAAO,UAAU,MAAM,MAAM,GAAG,MAAM,GAAG,KAAK,EAAE,CAAC;AAAA,EACjE;AAEA,QAAM,MAAM,MAAM,MAAM,OAAO,KAAK,MAAM,KAAK,CAAC,EAC7C,UAAU,MAAM,EAChB,KAAK,EAAE,SAAS,aAAa,CAAC,EAC9B,SAAS;AACZ,SAAO,IAAI,WAAW,GAAG;AAC3B;;;AF9DO,SAAS,cAAc,KAAqB;AACjD,SAAO,IAAI,IAAI,GAAG,EAAE,SAAS,QAAQ,UAAU,EAAE;AACnD;AAeA,eAAe,eAAe,MAAiC;AAC7D,QAAM,EAAE,MAAM,KAAK,IAAI,MAAMC,OAAM,OAAO,KAAK,IAAI,CAAC,EACjD,OAAO,IAAI,IAAI,EAAE,KAAK,OAAO,CAAC,EAC9B,YAAY,EACZ,IAAI,EACJ,SAAS,EAAE,mBAAmB,KAAK,CAAC;AACvC,QAAM,QAAQ,KAAK,QAAQ,KAAK;AAChC,QAAM,KAAK,CAAC,MAAsB,KAAK,CAAC,KAAK;AAE7C,MAAI,OAAO;AACX,MAAI,OAAO;AACX,MAAI,OAAO;AACX,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK,KAAK,UAAU;AACnD,YAAQ,GAAG,CAAC;AACZ,YAAQ,GAAG,IAAI,CAAC;AAChB,YAAQ,GAAG,IAAI,CAAC;AAAA,EAClB;AACA,QAAM,QAAQ,OAAO;AACrB,QAAM,QAAQ,OAAO;AACrB,QAAM,QAAQ,OAAO;AAErB,MAAI,OAAO;AACX,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK,KAAK,UAAU;AACnD,QACE,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,KAC1B,KAAK,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,IAAI,KAC9B,KAAK,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,IAAI,GAC9B;AACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAAU,OAAO,QAAQ;AAC/B,QAAM,YAAY,QAAQ,OAAO,QAAQ,OAAO,QAAQ;AACxD,MAAI,WAAW,WAAW;AACxB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAGA,eAAsB,oBAAoB,OAAqD;AAC7F,QAAM,aAAa,MAAM,gBAAgB,MAAM,KAAK;AAAA,IAClD,GAAI,MAAM,YAAY,SAAY,EAAE,SAAS,MAAM,QAAQ,IAAI,CAAC;AAAA,IAChE,GAAI,MAAM,aAAa,SAAY,EAAE,UAAU,MAAM,SAAS,IAAI,CAAC;AAAA,EACrE,CAAC;AACD,QAAM,eAAe,UAAU;AAE/B,QAAM,SAAS,cAAc,MAAM,GAAG;AACtC,QAAM,QAAQ,MAAM,mBAAmB;AAAA,IACrC,OAAO,MAAM,UAAU;AAAA,IACvB;AAAA,IACA;AAAA,EACF,CAAC;AACD,QAAM,OAAO,MAAM,QAAQ,OAAO,MAAM,GAAG,EAAE,CAAC;AAC9C,SAAO,EAAE,OAAO,QAAQ,UAAU,GAAG,IAAI,cAAc,aAAa,aAAa;AACnF;","names":["sharp","sharp"]}

package/dist/chunk-3YXDSCM6.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/audits/a11y-airtable.ts","../src/audits/deps-airtable.ts","../src/audits/security-airtable.ts","../src/audits/domain-airtable.ts","../src/audits/browser-airtable.ts","../src/audits/netlify-deploy-airtable.ts","../src/audits/function-health-airtable.ts","../src/audits/smoke-airtable.ts","../src/audits/form-e2e-airtable.ts","../src/audits/write-audits-to-airtable.ts"],"sourcesContent":["import type { AuditResult } from \"../types.js\";\n\ntype A11yDetails = {\n  totalViolations: number;\n  byImpact: Partial<Record<\"minor\" | \"moderate\" | \"serious\" | \"critical\", number>>;\n};\n\n/** True when an a11y AuditResult carries real counts worth persisting.\n *  Mirrors the `hasRealScores` policy on lighthouse: write whenever real\n *  data exists, regardless of status (a \"warn\" or \"fail\" with concrete\n *  violation counts is exactly what the dashboard needs to track). */\nexport function hasA11yCounts(result: AuditResult): boolean {\n  if (result.audit !== \"a11y\") return false;\n  const details = result.details as A11yDetails | undefined;\n  return typeof details?.totalViolations === \"number\";\n}\n\nexport function a11yCountsFromResult(result: AuditResult): { violations: number } {\n  if (result.audit !== \"a11y\") {\n    throw new Error(`Expected an 'a11y' AuditResult, got '${result.audit}'`);\n  }\n  const details = result.details as A11yDetails | undefined;\n  return { violations: details?.totalViolations ?? 0 };\n}\n","import type { AuditResult } from \"../types.js\";\nimport type { DepsDetails, DepsDriftEntry } from \"./deps.js\";\n\n/** True when a deps AuditResult carries the structured details (an entries\n *  array, per {@link DepsDetails}). */\nexport function hasDepsCounts(result: AuditResult): boolean {\n  if (result.audit !== \"deps\") return false;\n  const d = result.details as Partial<DepsDetails> | undefined;\n  return Array.isArray(d?.entries);\n}\n\nexport function depsCountsFromResult(result: AuditResult): {\n  drifted: number;\n  majorBehind: number;\n  outdated: number | null;\n  majorOutdated: number | null;\n} {\n  if (result.audit !== \"deps\") {\n    throw new Error(`Expected a 'deps' AuditResult, got '${result.audit}'`);\n  }\n  const details = (result.details ?? {}) as Partial<DepsDetails>;\n  const entries = (details.entries ?? []) as DepsDriftEntry[];\n  // \"drifted\" = drift !== \"same\", which intentionally includes \"newer\" (ahead of\n  // baseline) — parity with the deps audit summary text.\n  const drifted = entries.filter((e) => e.drift !== \"same\").length;\n  const majorBehind = entries.filter((e) => e.drift === \"major\").length;\n  // The real installed-version drift, distinct from declared-range drift. Null\n  // when the audit couldn't determine it (no/stale lockfile) — kept null (not 0)\n  // so the dashboard shows \"—\" rather than a misleading \"clean\".\n  const outdated = details.outdated?.outdated ?? null;\n  // How many of those outdated installs are a *major* behind the registry's\n  // latest — surfaced separately from the total so the cockpit can show\n  // \"N major\" available, distinct from the baseline-drift \"major\" count. Shares\n  // the outdated signal's null-when-undetermined semantics.\n  const majorOutdated = details.outdated?.major ?? null;\n  return { drifted, majorBehind, outdated, majorOutdated };\n}\n","import type { AuditResult } from \"../types.js\";\nimport { normalizeSecurityAdvisory, type SecurityAdvisory } from \"../reports/airtable/websites.js\";\n\ntype SecurityDetails = {\n  counts: { low: number; moderate: number; high: number; critical: number };\n  advisories?: unknown;\n};\n\n/** True when a security AuditResult carries a counts object. Skipped runs\n *  (no pnpm + no npm) have no details and return false. */\nexport function hasSecurityCounts(result: AuditResult): boolean {\n  if (result.audit !== \"security\") return false;\n  const details = result.details as SecurityDetails | undefined;\n  return !!details && typeof details.counts === \"object\";\n}\n\nexport function securityCountsFromResult(result: AuditResult): {\n  critical: number;\n  high: number;\n  moderate: number;\n  low: number;\n} {\n  if (result.audit !== \"security\") {\n    throw new Error(`Expected a 'security' AuditResult, got '${result.audit}'`);\n  }\n  const details = result.details as SecurityDetails | undefined;\n  const c = details?.counts ?? { low: 0, moderate: 0, high: 0, critical: 0 };\n  return { critical: c.critical, high: c.high, moderate: c.moderate, low: c.low };\n}\n\n/** The known advisories behind the counts, normalized for persistence. Empty when the\n *  run was clean or carried no advisory detail (npm/pnpm sometimes omit it). Malformed\n *  entries are dropped via the shared `normalizeSecurityAdvisory`. */\nexport function advisoriesFromResult(result: AuditResult): SecurityAdvisory[] {\n  if (result.audit !== \"security\") {\n    throw new Error(`Expected a 'security' AuditResult, got '${result.audit}'`);\n  }\n  const details = result.details as SecurityDetails | undefined;\n  const raw = details?.advisories;\n  if (!Array.isArray(raw)) return [];\n  return raw.map(normalizeSecurityAdvisory).filter((a): a is SecurityAdvisory => a !== null);\n}\n","import type { AuditResult } from \"../types.js\";\nimport type { DomainResult } from \"../reports/airtable/websites.js\";\n\ntype DomainDetails = { resolved: boolean; certDaysRemaining: number | null; checkedAt: string };\n\n/** True when an AuditResult is a `domain` audit carrying a usable details payload (i.e. it\n *  actually ran — a \"skip\" for a site with no deployed URL has no details). */\nexport function hasDomainResult(result: AuditResult): boolean {\n  if (result.audit !== \"domain\") return false;\n  const d = result.details as DomainDetails | undefined;\n  return !!d && typeof d.checkedAt === \"string\";\n}\n\n/** Extract the Airtable-writable domain result (cert days + checked-at) from a `domain` audit. */\nexport function domainResultFromAudit(result: AuditResult): DomainResult {\n  if (result.audit !== \"domain\") {\n    throw new Error(`Expected a 'domain' AuditResult, got '${result.audit}'`);\n  }\n  const d = result.details as DomainDetails | undefined;\n  return {\n    certDaysRemaining: typeof d?.certDaysRemaining === \"number\" ? d.certDaysRemaining : null,\n    checkedAt: typeof d?.checkedAt === \"string\" ? d.checkedAt : new Date().toISOString(),\n  };\n}\n","import type { AuditResult } from \"../types.js\";\nimport type { BrowserAuditFields } from \"../reports/airtable/websites.js\";\n\ntype BrowserDetails = {\n  desktopOk: boolean;\n  mobileOk: boolean;\n  linksOk: boolean;\n  reachableOk: boolean;\n  titleMetaOk: boolean;\n  brokenLinks: number;\n  checkedAt: string;\n};\n\n/** True when an AuditResult is a `browser` audit that actually ran (has a details payload — a\n *  \"skip\" for a site with no deployed URL has none). */\nexport function hasBrowserResult(result: AuditResult): boolean {\n  if (result.audit !== \"browser\") return false;\n  const d = result.details as BrowserDetails | undefined;\n  return !!d && typeof d.checkedAt === \"string\";\n}\n\n/** Extract the Airtable-writable browser verdicts from a `browser` audit. */\nexport function browserFieldsFromAudit(result: AuditResult): BrowserAuditFields {\n  if (result.audit !== \"browser\") {\n    throw new Error(`Expected a 'browser' AuditResult, got '${result.audit}'`);\n  }\n  const d = result.details as BrowserDetails | undefined;\n  return {\n    desktopOk: d?.desktopOk === true,\n    mobileOk: d?.mobileOk === true,\n    linksOk: d?.linksOk === true,\n    reachableOk: d?.reachableOk === true,\n    titleMetaOk: d?.titleMetaOk === true,\n    brokenLinks: typeof d?.brokenLinks === \"number\" ? d.brokenLinks : 0,\n    checkedAt: typeof d?.checkedAt === \"string\" ? d.checkedAt : new Date().toISOString(),\n  };\n}\n","import type { AuditResult } from \"../types.js\";\nimport type { NetlifyDeployResult } from \"../reports/airtable/websites.js\";\n\ntype NetlifyDeployDetails = {\n  state: string | null;\n  deployedAt: string | null;\n  logUrl: string | null;\n  checkedAt: string;\n};\n\n/** True when an AuditResult is a `netlify-deploy` audit carrying a usable details\n *  payload (i.e. it actually ran — a \"skip\" for a site with no Netlify id / no\n *  token has no details). */\nexport function hasNetlifyDeployResult(result: AuditResult): boolean {\n  if (result.audit !== \"netlify-deploy\") return false;\n  const d = result.details as NetlifyDeployDetails | undefined;\n  return !!d && typeof d.checkedAt === \"string\";\n}\n\n/** Extract the Airtable-writable deploy result (state + deployedAt + logUrl +\n *  checkedAt) from a `netlify-deploy` audit. */\nexport function netlifyDeployResultFromAudit(result: AuditResult): NetlifyDeployResult {\n  if (result.audit !== \"netlify-deploy\") {\n    throw new Error(`Expected a 'netlify-deploy' AuditResult, got '${result.audit}'`);\n  }\n  const d = result.details as NetlifyDeployDetails | undefined;\n  return {\n    state: typeof d?.state === \"string\" ? d.state : null,\n    deployedAt: typeof d?.deployedAt === \"string\" ? d.deployedAt : null,\n    logUrl: typeof d?.logUrl === \"string\" ? d.logUrl : null,\n    checkedAt: typeof d?.checkedAt === \"string\" ? d.checkedAt : new Date().toISOString(),\n  };\n}\n","import type { AuditResult } from \"../types.js\";\nimport type { FunctionHealthResult } from \"../reports/airtable/websites.js\";\n\ntype FunctionHealthDetails = {\n  ok: boolean;\n  prismic: \"ok\" | \"error\" | \"skipped\" | null;\n  forms: unknown;\n  checkedAt: string;\n};\n\n/** True when an AuditResult is a `function-health` audit carrying a usable details payload (i.e. it\n *  actually ran — a self-skip for an unreachable / non-JSON `/health`, or a site with no deployed\n *  URL, has no details, so the writer preserves the prior verdict). */\nexport function hasFunctionHealthResult(result: AuditResult): boolean {\n  if (result.audit !== \"function-health\") return false;\n  const d = result.details as FunctionHealthDetails | undefined;\n  return !!d && typeof d.checkedAt === \"string\";\n}\n\n/** Extract the Airtable-writable function-health verdicts. `functionHealth` from `ok`; `cmsReachable`\n *  from the same body's `prismic` sub-status (R2.2): `\"ok\"` → `\"pass\"`, `\"error\"` → `\"fail\"`, and\n *  anything else (`\"skipped\"` — a placeholder repo, or a raw `null` from a \"deployed but erroring\"\n *  body / an unrecognized value) → `null` — the CMS probe never actually ran, so it must not red CMS\n *  reachability for a site that simply hasn't wired Prismic yet. Only `functionHealth` keys off\n *  `ok`. */\nexport function functionHealthResultFromAudit(result: AuditResult): FunctionHealthResult {\n  if (result.audit !== \"function-health\") {\n    throw new Error(`Expected a 'function-health' AuditResult, got '${result.audit}'`);\n  }\n  const d = result.details as FunctionHealthDetails | undefined;\n  const cmsReachable: \"pass\" | \"fail\" | null =\n    d?.prismic === \"ok\" ? \"pass\" : d?.prismic === \"error\" ? \"fail\" : null;\n  // `forms` is untyped on the details payload (unknown) — validate defensively. A boolean\n  // `turnstile` inside an object → concrete verdict; anything else (null forms from an older\n  // site package or a \"deployed but erroring\" body, a malformed shape) → null: the widget\n  // state is simply unknown this run, never a fail. Powers the Require-Turnstile guardrail.\n  const formsRaw = d?.forms;\n  const turnstileFlag =\n    formsRaw && typeof formsRaw === \"object\"\n      ? (formsRaw as Record<string, unknown>)[\"turnstile\"]\n      : undefined;\n  const turnstileWidget: \"pass\" | \"fail\" | null =\n    typeof turnstileFlag === \"boolean\" ? (turnstileFlag ? \"pass\" : \"fail\") : null;\n  return {\n    functionHealth: d?.ok === true ? \"pass\" : \"fail\",\n    cmsReachable,\n    turnstileWidget,\n    checkedAt: typeof d?.checkedAt === \"string\" ? d.checkedAt : new Date().toISOString(),\n  };\n}\n","import type { AuditResult } from \"../types.js\";\nimport type { SmokeResult } from \"../reports/airtable/websites.js\";\n\ntype SmokeDetails = { ok: \"pass\" | \"fail\"; checkedAt: string };\n\n/** True when an AuditResult is a `smoke` audit that actually ran (has details with\n *  a checkedAt — a \"skip\" for a missing `pnpm`/`test:smoke` script has none, so the\n *  writer preserves the prior verdict). */\nexport function hasSmokeResult(result: AuditResult): boolean {\n  if (result.audit !== \"smoke\") return false;\n  const d = result.details as SmokeDetails | undefined;\n  return !!d && typeof d.checkedAt === \"string\";\n}\n\n/** Extract the Airtable-writable smoke verdict (pass/fail + checked-at). */\nexport function smokeResultFromAudit(result: AuditResult): SmokeResult {\n  if (result.audit !== \"smoke\") {\n    throw new Error(`Expected a 'smoke' AuditResult, got '${result.audit}'`);\n  }\n  const d = result.details as SmokeDetails | undefined;\n  return {\n    ok: d?.ok === \"fail\" ? \"fail\" : \"pass\",\n    checkedAt: typeof d?.checkedAt === \"string\" ? d.checkedAt : new Date().toISOString(),\n  };\n}\n","import type { AuditResult } from \"../types.js\";\nimport type { FormE2eResult } from \"../reports/airtable/websites.js\";\n\ntype FormE2eDetails = { ok: \"pass\" | \"fail\" | null; formPresent: boolean; checkedAt: string };\n\n/** True when an AuditResult is a `form-e2e` audit that actually RAN (has details\n *  with a checkedAt). Both a real verdict AND the no-form n/a case carry a checkedAt,\n *  so both persist; only a no-deployed-URL skip (no details) is preserved-prior. */\nexport function hasFormE2eResult(result: AuditResult): boolean {\n  if (result.audit !== \"form-e2e\") return false;\n  const d = result.details as FormE2eDetails | undefined;\n  return !!d && typeof d.checkedAt === \"string\";\n}\n\n/** Extract the Airtable-writable form-e2e verdict (pass/fail/null + checked-at). */\nexport function formE2eResultFromAudit(result: AuditResult): FormE2eResult {\n  if (result.audit !== \"form-e2e\") {\n    throw new Error(`Expected a 'form-e2e' AuditResult, got '${result.audit}'`);\n  }\n  const d = result.details as FormE2eDetails | undefined;\n  const ok = d?.ok === \"pass\" ? \"pass\" : d?.ok === \"fail\" ? \"fail\" : null;\n  return {\n    ok,\n    checkedAt: typeof d?.checkedAt === \"string\" ? d.checkedAt : new Date().toISOString(),\n  };\n}\n","import type { AuditResult } from \"../types.js\";\nimport type { AirtableBase } from \"../reports/airtable/client.js\";\nimport { type WebsiteRow, siteSlug, updateAuditFields } from \"../reports/airtable/websites.js\";\nimport type {\n  A11yCounts,\n  DepsCounts,\n  SecurityCounts,\n  SecurityAdvisory,\n  DomainResult,\n  BrowserAuditFields,\n  NetlifyDeployResult,\n  FunctionHealthResult,\n  SmokeResult,\n  FormE2eResult,\n} from \"../reports/airtable/websites.js\";\nimport type { LighthouseScoreWriteback } from \"../reports/types.js\";\nimport { hasRealScores, lighthouseScoresFromResult } from \"./lighthouse-airtable.js\";\nimport { hasA11yCounts, a11yCountsFromResult } from \"./a11y-airtable.js\";\nimport { hasDepsCounts, depsCountsFromResult } from \"./deps-airtable.js\";\nimport {\n  hasSecurityCounts,\n  securityCountsFromResult,\n  advisoriesFromResult,\n} from \"./security-airtable.js\";\nimport { hasDomainResult, domainResultFromAudit } from \"./domain-airtable.js\";\nimport { hasBrowserResult, browserFieldsFromAudit } from \"./browser-airtable.js\";\nimport { hasNetlifyDeployResult, netlifyDeployResultFromAudit } from \"./netlify-deploy-airtable.js\";\nimport {\n  hasFunctionHealthResult,\n  functionHealthResultFromAudit,\n} from \"./function-health-airtable.js\";\nimport { hasSmokeResult, smokeResultFromAudit } from \"./smoke-airtable.js\";\nimport { hasFormE2eResult, formE2eResultFromAudit } from \"./form-e2e-airtable.js\";\nimport { detectAuditEvents } from \"./fleet-event-detectors.js\";\nimport type { FleetEvent } from \"../db/fleet-events.js\";\n\ntype WriteSummary = {\n  siteName: string;\n  writes: Array<{\n    audit:\n      | \"lighthouse\"\n      | \"a11y\"\n      | \"deps\"\n      | \"security\"\n      | \"github-signals\"\n      | \"domain\"\n      | \"browser\"\n      | \"netlify-deploy\"\n      | \"function-health\"\n      | \"smoke\"\n      | \"form-e2e\"\n      // Not an audit: the nightly Prismic model sweep reuses this result shape so\n      // its write-back reports through the same `FLEET_WRITE_SUMMARY` line every\n      // other fleet writer emits, rather than inventing a second contract for CI\n      // to grep.\n      | \"prismic-models\";\n    counts: object;\n  }>;\n  /** Fleet-activity events detected from this site's prior row vs the fresh audits.\n   *  Optional: only the fleet path records them; the single-site path ignores them. */\n  events?: FleetEvent[];\n};\n\n/** Orchestrates the per-audit Airtable writes for `audit --write-airtable`.\n *  Extracted from the CLI command so it can be unit-tested with a fake base\n *  and so adding new audit types is a one-line addition here rather than\n *  growing the CLI handler.\n *\n *  Throws (with .exitCode set) on the failure modes the CLI surfaces today:\n *   - 2: --only ran without lighthouse, or no Websites row matched the slug\n *   - 1: lighthouse ran but produced no real scores (infrastructure failure).\n *        The a11y/deps/security writes still complete FIRST — a Lighthouse\n *        miss flags the site without discarding its other audit data.\n *\n *  Precedence note: the Websites-row lookup (exitCode 2) is checked BEFORE the\n *  no-scores gate (exitCode 1), so the rare no-row + no-scores combo surfaces\n *  as exitCode 2. */\nexport async function writeAuditsToAirtable(args: {\n  base: AirtableBase;\n  websites: WebsiteRow[];\n  slug: string;\n  results: AuditResult[];\n}): Promise<WriteSummary> {\n  const { base, websites, slug, results } = args;\n\n  // Lighthouse is OPTIONAL. The checkout-free `--only lighthouse,domain,browser` nightly includes\n  // it, but a standalone `--only security` (checkout-ful) sweep legitimately has none. We write\n  // whatever audits produced values; only the lighthouse-MISS flag below is lighthouse-specific\n  // (so a real Lighthouse infra failure still reds the run without discarding other audit data).\n  const lhResult = results.find((r) => r.audit === \"lighthouse\");\n  const target = websites.find((w) => siteSlug(w.name) === slug);\n  if (!target) {\n    throw Object.assign(new Error(`No Websites row matched slug \"${slug}\"`), { exitCode: 2 });\n  }\n\n  const writes: WriteSummary[\"writes\"] = [];\n  const audits: {\n    scores?: LighthouseScoreWriteback;\n    a11y?: A11yCounts;\n    deps?: DepsCounts;\n    security?: SecurityCounts;\n    securityAdvisories?: SecurityAdvisory[];\n    domain?: DomainResult;\n    browser?: BrowserAuditFields;\n    netlifyDeploy?: NetlifyDeployResult;\n    functionHealth?: FunctionHealthResult;\n    smoke?: SmokeResult;\n    formE2e?: FormE2eResult;\n  } = {};\n\n  // Collect every audit that produced real values into ONE merged input, then do a\n  // SINGLE atomic Airtable update (was: up to four sequential updates on the same\n  // row — a mid-sequence failure left it half-written yet reported fully failed, at\n  // 4× the request volume). Lighthouse is the most timeout-prone audit: a Lighthouse\n  // miss must NOT discard the site's valid a11y/deps/security results (morning-brief\n  // 2026-06-10 MEDIUM-E). So include Lighthouse scores only when real, include the\n  // other audits whenever present, write all of them in one update, then — if\n  // Lighthouse missed — throw AFTER that atomic write so the site is still flagged\n  // (exitCode 1 / collected in FleetWriteResult.failed) without losing its other data.\n  const lhHasScores = lhResult ? hasRealScores(lhResult) : false;\n  if (lhResult && lhHasScores) {\n    const scores = lighthouseScoresFromResult(lhResult);\n    audits.scores = scores;\n    writes.push({ audit: \"lighthouse\", counts: scores });\n  }\n\n  const a11y = results.find((r) => r.audit === \"a11y\");\n  if (a11y && hasA11yCounts(a11y)) {\n    const counts = a11yCountsFromResult(a11y);\n    audits.a11y = counts;\n    writes.push({ audit: \"a11y\", counts });\n  }\n\n  const deps = results.find((r) => r.audit === \"deps\");\n  if (deps && hasDepsCounts(deps)) {\n    const counts = depsCountsFromResult(deps);\n    audits.deps = counts;\n    writes.push({ audit: \"deps\", counts });\n  }\n\n  const sec = results.find((r) => r.audit === \"security\");\n  if (sec && hasSecurityCounts(sec)) {\n    const counts = securityCountsFromResult(sec);\n    audits.security = counts;\n    // Persist the advisory list alongside the counts so the dashboard can show which packages\n    // are vulnerable. An empty array (clean run) clears any stale list.\n    audits.securityAdvisories = advisoriesFromResult(sec);\n    writes.push({ audit: \"security\", counts });\n  }\n\n  const dom = results.find((r) => r.audit === \"domain\");\n  if (dom && hasDomainResult(dom)) {\n    const result = domainResultFromAudit(dom);\n    audits.domain = result;\n    writes.push({ audit: \"domain\", counts: result });\n  }\n\n  const browser = results.find((r) => r.audit === \"browser\");\n  if (browser && hasBrowserResult(browser)) {\n    const fields = browserFieldsFromAudit(browser);\n    audits.browser = fields;\n    writes.push({ audit: \"browser\", counts: fields });\n  }\n\n  const netlifyDeploy = results.find((r) => r.audit === \"netlify-deploy\");\n  if (netlifyDeploy && hasNetlifyDeployResult(netlifyDeploy)) {\n    const result = netlifyDeployResultFromAudit(netlifyDeploy);\n    audits.netlifyDeploy = result;\n    writes.push({ audit: \"netlify-deploy\", counts: result });\n  }\n\n  const functionHealth = results.find((r) => r.audit === \"function-health\");\n  if (functionHealth && hasFunctionHealthResult(functionHealth)) {\n    const result = functionHealthResultFromAudit(functionHealth);\n    audits.functionHealth = result;\n    writes.push({ audit: \"function-health\", counts: result });\n  }\n\n  const smoke = results.find((r) => r.audit === \"smoke\");\n  if (smoke && hasSmokeResult(smoke)) {\n    const result = smokeResultFromAudit(smoke);\n    audits.smoke = result;\n    writes.push({ audit: \"smoke\", counts: result });\n  }\n\n  const formE2e = results.find((r) => r.audit === \"form-e2e\");\n  if (formE2e && hasFormE2eResult(formE2e)) {\n    const result = formE2eResultFromAudit(formE2e);\n    audits.formE2e = result;\n    writes.push({ audit: \"form-e2e\", counts: result });\n  }\n\n  // One atomic write of everything that ran. Skip the call only if there is nothing\n  // to write at all (no real scores AND no other audit produced values) — an empty\n  // update is a wasted request.\n  if (Object.keys(audits).length > 0) {\n    await updateAuditFields(base, target.id, audits);\n  }\n\n  // Detect fleet-activity transitions from the prior row (`target`, loaded before this\n  // write) vs the fresh audits. Computed here where both are in hand; recorded by the\n  // caller (fleet path) — single-site callers simply ignore `events`.\n  const events = detectAuditEvents(\n    target,\n    {\n      ...(audits.security !== undefined ? { security: audits.security } : {}),\n      ...(audits.domain !== undefined ? { domain: audits.domain } : {}),\n    },\n    new Date().toISOString(),\n  );\n\n  // Lighthouse-miss flag: only when lighthouse WAS requested (in results) but produced no scores —\n  // an infra failure worth reding the run, AFTER persisting the other audits. A sweep that never\n  // ran lighthouse (e.g. `--only security`) skips this entirely.\n  if (lhResult && !lhHasScores) {\n    // Enumerate what WAS persisted so the failure (surfaced to the single-site\n    // CLI operator via console.error) reads as a partial write, not a total one.\n    const persisted = writes.map((w) => w.audit);\n    throw Object.assign(\n      new Error(\n        `Lighthouse audit produced no scores; ${\n          persisted.length ? `wrote ${persisted.join(\"/\")} but refused Lighthouse` : \"wrote nothing\"\n        }. Summary: ${lhResult.summary}`,\n      ),\n      { exitCode: 1 },\n    );\n  }\n\n  return { siteName: target.name, writes, events };\n}\n\nexport type FleetWriteResult = {\n  written: WriteSummary[];\n  failed: Array<{ slug: string; error: string }>;\n};\n\n/** Render the fleet write-back outcome for the CLI/CI. Beyond the human-readable\n *  lines, it emits a single deterministic, machine-parseable line —\n *  `FLEET_WRITE_SUMMARY wrote=N failed=M total=T` — that the nightly workflow\n *  greps to decide pass/fail. Keying CI on this line (not the prose, and not a\n *  \"wrote ≥ 1\" heuristic) lets the gate tolerate a single known flake while\n *  still reding on a total or mass write-back failure. */\nexport function formatFleetWriteSummary(result: FleetWriteResult): string {\n  const wrote = result.written.length;\n  const failed = result.failed.length;\n  const total = wrote + failed;\n  let out = `→ wrote ${wrote} site(s) to Airtable`;\n  if (failed > 0) {\n    out += `\\n⚠ ${failed} site(s) not written: ${result.failed\n      .map((f) => `${f.slug} (${f.error})`)\n      .join(\"; \")}`;\n  }\n  out += `\\nFLEET_WRITE_SUMMARY wrote=${wrote} failed=${failed} total=${total}`;\n  return out;\n}\n\n/** Write each site's pooled audit results back to its own Websites row,\n *  best-effort. Results are grouped by `result.site` (the slug the fleet\n *  inventory stamped as Site.name). A per-site failure (no scores, no matching\n *  row) is collected — not thrown — so one bad site never aborts the batch. */\nexport async function writeFleetAuditsToAirtable(args: {\n  base: AirtableBase;\n  websites: WebsiteRow[];\n  results: AuditResult[];\n}): Promise<FleetWriteResult> {\n  const { base, websites, results } = args;\n\n  const bySlug = new Map<string, AuditResult[]>();\n  for (const r of results) {\n    const arr = bySlug.get(r.site) ?? [];\n    arr.push(r);\n    bySlug.set(r.site, arr);\n  }\n\n  const written: WriteSummary[] = [];\n  const failed: FleetWriteResult[\"failed\"] = [];\n  // Serial on purpose: even at one (now atomic) update call per site, Airtable's\n  // ~5 req/sec limit means a Promise.all fan-out across the fleet would burst and\n  // trip 429s (silently filed as failures). Below a few dozen sites, serial trades\n  // wall-clock for safety. (morning-brief 2026-06-09 MEDIUM-3.) Add a bounded pool\n  // when the fleet grows.\n  for (const [slug, siteResults] of bySlug) {\n    try {\n      written.push(await writeAuditsToAirtable({ base, websites, slug, results: siteResults }));\n    } catch (e) {\n      failed.push({ slug, error: (e as Error).message });\n    }\n  }\n  return { written, failed };\n}\n"],"mappings":";;;;;;;;;;;;;;AAWO,SAAS,cAAc,QAA8B;AAC1D,MAAI,OAAO,UAAU,OAAQ,QAAO;AACpC,QAAM,UAAU,OAAO;AACvB,SAAO,OAAO,SAAS,oBAAoB;AAC7C;AAEO,SAAS,qBAAqB,QAA6C;AAChF,MAAI,OAAO,UAAU,QAAQ;AAC3B,UAAM,IAAI,MAAM,wCAAwC,OAAO,KAAK,GAAG;AAAA,EACzE;AACA,QAAM,UAAU,OAAO;AACvB,SAAO,EAAE,YAAY,SAAS,mBAAmB,EAAE;AACrD;;;AClBO,SAAS,cAAc,QAA8B;AAC1D,MAAI,OAAO,UAAU,OAAQ,QAAO;AACpC,QAAM,IAAI,OAAO;AACjB,SAAO,MAAM,QAAQ,GAAG,OAAO;AACjC;AAEO,SAAS,qBAAqB,QAKnC;AACA,MAAI,OAAO,UAAU,QAAQ;AAC3B,UAAM,IAAI,MAAM,uCAAuC,OAAO,KAAK,GAAG;AAAA,EACxE;AACA,QAAM,UAAW,OAAO,WAAW,CAAC;AACpC,QAAM,UAAW,QAAQ,WAAW,CAAC;AAGrC,QAAM,UAAU,QAAQ,OAAO,CAAC,MAAM,EAAE,UAAU,MAAM,EAAE;AAC1D,QAAM,cAAc,QAAQ,OAAO,CAAC,MAAM,EAAE,UAAU,OAAO,EAAE;AAI/D,QAAM,WAAW,QAAQ,UAAU,YAAY;AAK/C,QAAM,gBAAgB,QAAQ,UAAU,SAAS;AACjD,SAAO,EAAE,SAAS,aAAa,UAAU,cAAc;AACzD;;;AC1BO,SAAS,kBAAkB,QAA8B;AAC9D,MAAI,OAAO,UAAU,WAAY,QAAO;AACxC,QAAM,UAAU,OAAO;AACvB,SAAO,CAAC,CAAC,WAAW,OAAO,QAAQ,WAAW;AAChD;AAEO,SAAS,yBAAyB,QAKvC;AACA,MAAI,OAAO,UAAU,YAAY;AAC/B,UAAM,IAAI,MAAM,2CAA2C,OAAO,KAAK,GAAG;AAAA,EAC5E;AACA,QAAM,UAAU,OAAO;AACvB,QAAM,IAAI,SAAS,UAAU,EAAE,KAAK,GAAG,UAAU,GAAG,MAAM,GAAG,UAAU,EAAE;AACzE,SAAO,EAAE,UAAU,EAAE,UAAU,MAAM,EAAE,MAAM,UAAU,EAAE,UAAU,KAAK,EAAE,IAAI;AAChF;AAKO,SAAS,qBAAqB,QAAyC;AAC5E,MAAI,OAAO,UAAU,YAAY;AAC/B,UAAM,IAAI,MAAM,2CAA2C,OAAO,KAAK,GAAG;AAAA,EAC5E;AACA,QAAM,UAAU,OAAO;AACvB,QAAM,MAAM,SAAS;AACrB,MAAI,CAAC,MAAM,QAAQ,GAAG,EAAG,QAAO,CAAC;AACjC,SAAO,IAAI,IAAI,yBAAyB,EAAE,OAAO,CAAC,MAA6B,MAAM,IAAI;AAC3F;;;AClCO,SAAS,gBAAgB,QAA8B;AAC5D,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,IAAI,OAAO;AACjB,SAAO,CAAC,CAAC,KAAK,OAAO,EAAE,cAAc;AACvC;AAGO,SAAS,sBAAsB,QAAmC;AACvE,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,IAAI,MAAM,yCAAyC,OAAO,KAAK,GAAG;AAAA,EAC1E;AACA,QAAM,IAAI,OAAO;AACjB,SAAO;AAAA,IACL,mBAAmB,OAAO,GAAG,sBAAsB,WAAW,EAAE,oBAAoB;AAAA,IACpF,WAAW,OAAO,GAAG,cAAc,WAAW,EAAE,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,EACrF;AACF;;;ACRO,SAAS,iBAAiB,QAA8B;AAC7D,MAAI,OAAO,UAAU,UAAW,QAAO;AACvC,QAAM,IAAI,OAAO;AACjB,SAAO,CAAC,CAAC,KAAK,OAAO,EAAE,cAAc;AACvC;AAGO,SAAS,uBAAuB,QAAyC;AAC9E,MAAI,OAAO,UAAU,WAAW;AAC9B,UAAM,IAAI,MAAM,0CAA0C,OAAO,KAAK,GAAG;AAAA,EAC3E;AACA,QAAM,IAAI,OAAO;AACjB,SAAO;AAAA,IACL,WAAW,GAAG,cAAc;AAAA,IAC5B,UAAU,GAAG,aAAa;AAAA,IAC1B,SAAS,GAAG,YAAY;AAAA,IACxB,aAAa,GAAG,gBAAgB;AAAA,IAChC,aAAa,GAAG,gBAAgB;AAAA,IAChC,aAAa,OAAO,GAAG,gBAAgB,WAAW,EAAE,cAAc;AAAA,IAClE,WAAW,OAAO,GAAG,cAAc,WAAW,EAAE,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,EACrF;AACF;;;ACvBO,SAAS,uBAAuB,QAA8B;AACnE,MAAI,OAAO,UAAU,iBAAkB,QAAO;AAC9C,QAAM,IAAI,OAAO;AACjB,SAAO,CAAC,CAAC,KAAK,OAAO,EAAE,cAAc;AACvC;AAIO,SAAS,6BAA6B,QAA0C;AACrF,MAAI,OAAO,UAAU,kBAAkB;AACrC,UAAM,IAAI,MAAM,iDAAiD,OAAO,KAAK,GAAG;AAAA,EAClF;AACA,QAAM,IAAI,OAAO;AACjB,SAAO;AAAA,IACL,OAAO,OAAO,GAAG,UAAU,WAAW,EAAE,QAAQ;AAAA,IAChD,YAAY,OAAO,GAAG,eAAe,WAAW,EAAE,aAAa;AAAA,IAC/D,QAAQ,OAAO,GAAG,WAAW,WAAW,EAAE,SAAS;AAAA,IACnD,WAAW,OAAO,GAAG,cAAc,WAAW,EAAE,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,EACrF;AACF;;;ACnBO,SAAS,wBAAwB,QAA8B;AACpE,MAAI,OAAO,UAAU,kBAAmB,QAAO;AAC/C,QAAM,IAAI,OAAO;AACjB,SAAO,CAAC,CAAC,KAAK,OAAO,EAAE,cAAc;AACvC;AAQO,SAAS,8BAA8B,QAA2C;AACvF,MAAI,OAAO,UAAU,mBAAmB;AACtC,UAAM,IAAI,MAAM,kDAAkD,OAAO,KAAK,GAAG;AAAA,EACnF;AACA,QAAM,IAAI,OAAO;AACjB,QAAM,eACJ,GAAG,YAAY,OAAO,SAAS,GAAG,YAAY,UAAU,SAAS;AAKnE,QAAM,WAAW,GAAG;AACpB,QAAM,gBACJ,YAAY,OAAO,aAAa,WAC3B,SAAqC,WAAW,IACjD;AACN,QAAM,kBACJ,OAAO,kBAAkB,YAAa,gBAAgB,SAAS,SAAU;AAC3E,SAAO;AAAA,IACL,gBAAgB,GAAG,OAAO,OAAO,SAAS;AAAA,IAC1C;AAAA,IACA;AAAA,IACA,WAAW,OAAO,GAAG,cAAc,WAAW,EAAE,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,EACrF;AACF;;;ACzCO,SAAS,eAAe,QAA8B;AAC3D,MAAI,OAAO,UAAU,QAAS,QAAO;AACrC,QAAM,IAAI,OAAO;AACjB,SAAO,CAAC,CAAC,KAAK,OAAO,EAAE,cAAc;AACvC;AAGO,SAAS,qBAAqB,QAAkC;AACrE,MAAI,OAAO,UAAU,SAAS;AAC5B,UAAM,IAAI,MAAM,wCAAwC,OAAO,KAAK,GAAG;AAAA,EACzE;AACA,QAAM,IAAI,OAAO;AACjB,SAAO;AAAA,IACL,IAAI,GAAG,OAAO,SAAS,SAAS;AAAA,IAChC,WAAW,OAAO,GAAG,cAAc,WAAW,EAAE,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,EACrF;AACF;;;AChBO,SAAS,iBAAiB,QAA8B;AAC7D,MAAI,OAAO,UAAU,WAAY,QAAO;AACxC,QAAM,IAAI,OAAO;AACjB,SAAO,CAAC,CAAC,KAAK,OAAO,EAAE,cAAc;AACvC;AAGO,SAAS,uBAAuB,QAAoC;AACzE,MAAI,OAAO,UAAU,YAAY;AAC/B,UAAM,IAAI,MAAM,2CAA2C,OAAO,KAAK,GAAG;AAAA,EAC5E;AACA,QAAM,IAAI,OAAO;AACjB,QAAM,KAAK,GAAG,OAAO,SAAS,SAAS,GAAG,OAAO,SAAS,SAAS;AACnE,SAAO;AAAA,IACL;AAAA,IACA,WAAW,OAAO,GAAG,cAAc,WAAW,EAAE,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,EACrF;AACF;;;ACoDA,eAAsB,sBAAsB,MAKlB;AACxB,QAAM,EAAE,MAAM,UAAU,MAAM,QAAQ,IAAI;AAM1C,QAAM,WAAW,QAAQ,KAAK,CAAC,MAAM,EAAE,UAAU,YAAY;AAC7D,QAAM,SAAS,SAAS,KAAK,CAAC,MAAM,SAAS,EAAE,IAAI,MAAM,IAAI;AAC7D,MAAI,CAAC,QAAQ;AACX,UAAM,OAAO,OAAO,IAAI,MAAM,iCAAiC,IAAI,GAAG,GAAG,EAAE,UAAU,EAAE,CAAC;AAAA,EAC1F;AAEA,QAAM,SAAiC,CAAC;AACxC,QAAM,SAYF,CAAC;AAWL,QAAM,cAAc,WAAW,cAAc,QAAQ,IAAI;AACzD,MAAI,YAAY,aAAa;AAC3B,UAAM,SAAS,2BAA2B,QAAQ;AAClD,WAAO,SAAS;AAChB,WAAO,KAAK,EAAE,OAAO,cAAc,QAAQ,OAAO,CAAC;AAAA,EACrD;AAEA,QAAM,OAAO,QAAQ,KAAK,CAAC,MAAM,EAAE,UAAU,MAAM;AACnD,MAAI,QAAQ,cAAc,IAAI,GAAG;AAC/B,UAAM,SAAS,qBAAqB,IAAI;AACxC,WAAO,OAAO;AACd,WAAO,KAAK,EAAE,OAAO,QAAQ,OAAO,CAAC;AAAA,EACvC;AAEA,QAAM,OAAO,QAAQ,KAAK,CAAC,MAAM,EAAE,UAAU,MAAM;AACnD,MAAI,QAAQ,cAAc,IAAI,GAAG;AAC/B,UAAM,SAAS,qBAAqB,IAAI;AACxC,WAAO,OAAO;AACd,WAAO,KAAK,EAAE,OAAO,QAAQ,OAAO,CAAC;AAAA,EACvC;AAEA,QAAM,MAAM,QAAQ,KAAK,CAAC,MAAM,EAAE,UAAU,UAAU;AACtD,MAAI,OAAO,kBAAkB,GAAG,GAAG;AACjC,UAAM,SAAS,yBAAyB,GAAG;AAC3C,WAAO,WAAW;AAGlB,WAAO,qBAAqB,qBAAqB,GAAG;AACpD,WAAO,KAAK,EAAE,OAAO,YAAY,OAAO,CAAC;AAAA,EAC3C;AAEA,QAAM,MAAM,QAAQ,KAAK,CAAC,MAAM,EAAE,UAAU,QAAQ;AACpD,MAAI,OAAO,gBAAgB,GAAG,GAAG;AAC/B,UAAM,SAAS,sBAAsB,GAAG;AACxC,WAAO,SAAS;AAChB,WAAO,KAAK,EAAE,OAAO,UAAU,QAAQ,OAAO,CAAC;AAAA,EACjD;AAEA,QAAM,UAAU,QAAQ,KAAK,CAAC,MAAM,EAAE,UAAU,SAAS;AACzD,MAAI,WAAW,iBAAiB,OAAO,GAAG;AACxC,UAAM,SAAS,uBAAuB,OAAO;AAC7C,WAAO,UAAU;AACjB,WAAO,KAAK,EAAE,OAAO,WAAW,QAAQ,OAAO,CAAC;AAAA,EAClD;AAEA,QAAM,gBAAgB,QAAQ,KAAK,CAAC,MAAM,EAAE,UAAU,gBAAgB;AACtE,MAAI,iBAAiB,uBAAuB,aAAa,GAAG;AAC1D,UAAM,SAAS,6BAA6B,aAAa;AACzD,WAAO,gBAAgB;AACvB,WAAO,KAAK,EAAE,OAAO,kBAAkB,QAAQ,OAAO,CAAC;AAAA,EACzD;AAEA,QAAM,iBAAiB,QAAQ,KAAK,CAAC,MAAM,EAAE,UAAU,iBAAiB;AACxE,MAAI,kBAAkB,wBAAwB,cAAc,GAAG;AAC7D,UAAM,SAAS,8BAA8B,cAAc;AAC3D,WAAO,iBAAiB;AACxB,WAAO,KAAK,EAAE,OAAO,mBAAmB,QAAQ,OAAO,CAAC;AAAA,EAC1D;AAEA,QAAM,QAAQ,QAAQ,KAAK,CAAC,MAAM,EAAE,UAAU,OAAO;AACrD,MAAI,SAAS,eAAe,KAAK,GAAG;AAClC,UAAM,SAAS,qBAAqB,KAAK;AACzC,WAAO,QAAQ;AACf,WAAO,KAAK,EAAE,OAAO,SAAS,QAAQ,OAAO,CAAC;AAAA,EAChD;AAEA,QAAM,UAAU,QAAQ,KAAK,CAAC,MAAM,EAAE,UAAU,UAAU;AAC1D,MAAI,WAAW,iBAAiB,OAAO,GAAG;AACxC,UAAM,SAAS,uBAAuB,OAAO;AAC7C,WAAO,UAAU;AACjB,WAAO,KAAK,EAAE,OAAO,YAAY,QAAQ,OAAO,CAAC;AAAA,EACnD;AAKA,MAAI,OAAO,KAAK,MAAM,EAAE,SAAS,GAAG;AAClC,UAAM,kBAAkB,MAAM,OAAO,IAAI,MAAM;AAAA,EACjD;AAKA,QAAM,SAAS;AAAA,IACb;AAAA,IACA;AAAA,MACE,GAAI,OAAO,aAAa,SAAY,EAAE,UAAU,OAAO,SAAS,IAAI,CAAC;AAAA,MACrE,GAAI,OAAO,WAAW,SAAY,EAAE,QAAQ,OAAO,OAAO,IAAI,CAAC;AAAA,IACjE;AAAA,KACA,oBAAI,KAAK,GAAE,YAAY;AAAA,EACzB;AAKA,MAAI,YAAY,CAAC,aAAa;AAG5B,UAAM,YAAY,OAAO,IAAI,CAAC,MAAM,EAAE,KAAK;AAC3C,UAAM,OAAO;AAAA,MACX,IAAI;AAAA,QACF,wCACE,UAAU,SAAS,SAAS,UAAU,KAAK,GAAG,CAAC,4BAA4B,eAC7E,cAAc,SAAS,OAAO;AAAA,MAChC;AAAA,MACA,EAAE,UAAU,EAAE;AAAA,IAChB;AAAA,EACF;AAEA,SAAO,EAAE,UAAU,OAAO,MAAM,QAAQ,OAAO;AACjD;AAaO,SAAS,wBAAwB,QAAkC;AACxE,QAAM,QAAQ,OAAO,QAAQ;AAC7B,QAAM,SAAS,OAAO,OAAO;AAC7B,QAAM,QAAQ,QAAQ;AACtB,MAAI,MAAM,gBAAW,KAAK;AAC1B,MAAI,SAAS,GAAG;AACd,WAAO;AAAA,SAAO,MAAM,yBAAyB,OAAO,OACjD,IAAI,CAAC,MAAM,GAAG,EAAE,IAAI,KAAK,EAAE,KAAK,GAAG,EACnC,KAAK,IAAI,CAAC;AAAA,EACf;AACA,SAAO;AAAA,4BAA+B,KAAK,WAAW,MAAM,UAAU,KAAK;AAC3E,SAAO;AACT;AAMA,eAAsB,2BAA2B,MAInB;AAC5B,QAAM,EAAE,MAAM,UAAU,QAAQ,IAAI;AAEpC,QAAM,SAAS,oBAAI,IAA2B;AAC9C,aAAW,KAAK,SAAS;AACvB,UAAM,MAAM,OAAO,IAAI,EAAE,IAAI,KAAK,CAAC;AACnC,QAAI,KAAK,CAAC;AACV,WAAO,IAAI,EAAE,MAAM,GAAG;AAAA,EACxB;AAEA,QAAM,UAA0B,CAAC;AACjC,QAAM,SAAqC,CAAC;AAM5C,aAAW,CAAC,MAAM,WAAW,KAAK,QAAQ;AACxC,QAAI;AACF,cAAQ,KAAK,MAAM,sBAAsB,EAAE,MAAM,UAAU,MAAM,SAAS,YAAY,CAAC,CAAC;AAAA,IAC1F,SAAS,GAAG;AACV,aAAO,KAAK,EAAE,MAAM,OAAQ,EAAY,QAAQ,CAAC;AAAA,IACnD;AAAA,EACF;AACA,SAAO,EAAE,SAAS,OAAO;AAC3B;","names":[]}

package/dist/chunk-4DHQCN5H.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/audits/util/spawn.ts"],"sourcesContent":["import { spawn } from \"node:child_process\";\nimport { StringDecoder } from \"node:string_decoder\";\n\nexport type SpawnResult = { code: number; stdout: string; stderr: string };\n\nexport type SpawnOptions = {\n  cwd?: string;\n  env?: NodeJS.ProcessEnv;\n  timeoutMs?: number;\n  /** When true, the child inherits stdout/stderr so the user sees live\n   * progress (useful for long-running `pnpm up` / `npm install`). The\n   * returned `stdout` and `stderr` will be empty strings in that case. */\n  streaming?: boolean;\n};\n\nexport type SpawnFn = (\n  cmd: string,\n  args: readonly string[],\n  opts?: SpawnOptions,\n) => Promise<SpawnResult>;\n\ntype KillFn = (pid: number, signal: NodeJS.Signals | number) => void;\n\n/** Construction-time knobs, separated from per-call {@link SpawnOptions} mainly\n *  so tests can inject deterministic `spawnImpl`/`killImpl` and a tiny grace. */\nexport type SpawnInternals = {\n  spawnImpl?: typeof spawn;\n  killImpl?: KillFn;\n  /** Delay after SIGTERM before escalating to SIGKILL on a timeout (default 5s). */\n  killGraceMs?: number;\n  /** Cap on captured stdout/stderr length so a runaway child can't OOM the CLI. */\n  maxOutputBytes?: number;\n};\n\nconst TRUNCATION_MARKER = \"\\n…[output truncated]\";\n\nexport function makeSpawn(internals: SpawnInternals = {}): SpawnFn {\n  const spawnImpl = internals.spawnImpl ?? spawn;\n  const killImpl: KillFn = internals.killImpl ?? ((pid, sig) => process.kill(pid, sig));\n  const killGraceMs = internals.killGraceMs ?? 5000;\n  const maxOutputBytes = internals.maxOutputBytes ?? 10 * 1024 * 1024;\n\n  return (cmd, args, opts = {}) =>\n    new Promise((resolve, reject) => {\n      const streaming = opts.streaming === true;\n      const child = spawnImpl(cmd, [...args], {\n        cwd: opts.cwd,\n        env: opts.env ?? process.env,\n        stdio: streaming ? [\"ignore\", \"inherit\", \"inherit\"] : [\"ignore\", \"pipe\", \"pipe\"],\n        // Detach ONLY when a timeout can fire: the child then leads its own\n        // process group, so the timeout can kill the WHOLE tree (vite, and\n        // Chromium under lhci/playwright) via process.kill(-pid), not just the\n        // npx/pnpm wrapper. Without it, killing the wrapper orphaned the\n        // grandchildren — a zombie vite squatting its port, Chrome left running.\n        // We do NOT detach timeout-less streaming calls (pnpm install/up):\n        // detaching gains nothing there (no timeout → no group-kill) and would\n        // break terminal Ctrl-C, which only reaches the foreground group — i.e.\n        // it would re-orphan the very children this guards. We never unref() the\n        // child since we still await it.\n        detached: opts.timeoutMs !== undefined,\n      });\n\n      // Cap appended output so an unbounded stream can't exhaust memory.\n      const cap = (acc: string, chunk: string): string => {\n        if (acc.length >= maxOutputBytes) return acc;\n        const next = acc + chunk;\n        return next.length > maxOutputBytes\n          ? next.slice(0, maxOutputBytes) + TRUNCATION_MARKER\n          : next;\n      };\n\n      let stdout = \"\";\n      let stderr = \"\";\n      // Decode each stream through a StringDecoder so a multibyte UTF-8 char\n      // split across two `data` chunks isn't corrupted: the decoder holds the\n      // partial trailing bytes until the rest arrives, instead of the old\n      // `String(chunk)` which decoded each chunk in isolation (and replaced the\n      // split char with U+FFFD). Flushed via `.end()` on close.\n      const outDecoder = new StringDecoder(\"utf-8\");\n      const errDecoder = new StringDecoder(\"utf-8\");\n      if (!streaming) {\n        child.stdout?.on(\n          \"data\",\n          (chunk: Buffer) => (stdout = cap(stdout, outDecoder.write(chunk))),\n        );\n        child.stderr?.on(\n          \"data\",\n          (chunk: Buffer) => (stderr = cap(stderr, errDecoder.write(chunk))),\n        );\n      }\n\n      /** Signal the child's whole process group; ignore if it's already gone.\n       *  POSIX-only: a negative pid signals the group (the project targets\n       *  macOS/Linux; this is only reached when detached, i.e. on a timeout). */\n      const killGroup = (sig: NodeJS.Signals): void => {\n        if (child.pid === undefined) return;\n        try {\n          killImpl(-child.pid, sig);\n        } catch {\n          // ESRCH: the group already exited between the timeout and the kill.\n        }\n      };\n\n      let killTimer: ReturnType<typeof setTimeout> | undefined;\n      const timer = opts.timeoutMs\n        ? setTimeout(() => {\n            killGroup(\"SIGTERM\");\n            // Escalate if SIGTERM is ignored (a wedged Chrome can swallow it).\n            killTimer = setTimeout(() => killGroup(\"SIGKILL\"), killGraceMs);\n            // Best-effort cleanup AFTER we've already rejected — it must never\n            // hold the CLI open past its real work.\n            killTimer.unref();\n            reject(new Error(`spawn timeout after ${opts.timeoutMs}ms: ${cmd}`));\n          }, opts.timeoutMs)\n        : undefined;\n\n      const clearTimers = (): void => {\n        if (timer) clearTimeout(timer);\n        if (killTimer) clearTimeout(killTimer);\n      };\n\n      child.on(\"error\", (err) => {\n        clearTimers();\n        reject(err);\n      });\n      child.on(\"close\", (code) => {\n        clearTimers();\n        if (!streaming) {\n          // Flush any bytes the decoder buffered mid-character (e.g. a truncated\n          // final UTF-8 sequence). `.end()` returns \"\" when nothing is pending.\n          stdout = cap(stdout, outDecoder.end());\n          stderr = cap(stderr, errDecoder.end());\n        }\n        resolve({ code: code ?? -1, stdout, stderr });\n      });\n    });\n}\n\nexport const defaultSpawn: SpawnFn = makeSpawn();\n"],"mappings":";AAAA,SAAS,aAAa;AACtB,SAAS,qBAAqB;AAiC9B,IAAM,oBAAoB;AAEnB,SAAS,UAAU,YAA4B,CAAC,GAAY;AACjE,QAAM,YAAY,UAAU,aAAa;AACzC,QAAM,WAAmB,UAAU,aAAa,CAAC,KAAK,QAAQ,QAAQ,KAAK,KAAK,GAAG;AACnF,QAAM,cAAc,UAAU,eAAe;AAC7C,QAAM,iBAAiB,UAAU,kBAAkB,KAAK,OAAO;AAE/D,SAAO,CAAC,KAAK,MAAM,OAAO,CAAC,MACzB,IAAI,QAAQ,CAAC,SAAS,WAAW;AAC/B,UAAM,YAAY,KAAK,cAAc;AACrC,UAAM,QAAQ,UAAU,KAAK,CAAC,GAAG,IAAI,GAAG;AAAA,MACtC,KAAK,KAAK;AAAA,MACV,KAAK,KAAK,OAAO,QAAQ;AAAA,MACzB,OAAO,YAAY,CAAC,UAAU,WAAW,SAAS,IAAI,CAAC,UAAU,QAAQ,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAW/E,UAAU,KAAK,cAAc;AAAA,IAC/B,CAAC;AAGD,UAAM,MAAM,CAAC,KAAa,UAA0B;AAClD,UAAI,IAAI,UAAU,eAAgB,QAAO;AACzC,YAAM,OAAO,MAAM;AACnB,aAAO,KAAK,SAAS,iBACjB,KAAK,MAAM,GAAG,cAAc,IAAI,oBAChC;AAAA,IACN;AAEA,QAAI,SAAS;AACb,QAAI,SAAS;AAMb,UAAM,aAAa,IAAI,cAAc,OAAO;AAC5C,UAAM,aAAa,IAAI,cAAc,OAAO;AAC5C,QAAI,CAAC,WAAW;AACd,YAAM,QAAQ;AAAA,QACZ;AAAA,QACA,CAAC,UAAmB,SAAS,IAAI,QAAQ,WAAW,MAAM,KAAK,CAAC;AAAA,MAClE;AACA,YAAM,QAAQ;AAAA,QACZ;AAAA,QACA,CAAC,UAAmB,SAAS,IAAI,QAAQ,WAAW,MAAM,KAAK,CAAC;AAAA,MAClE;AAAA,IACF;AAKA,UAAM,YAAY,CAAC,QAA8B;AAC/C,UAAI,MAAM,QAAQ,OAAW;AAC7B,UAAI;AACF,iBAAS,CAAC,MAAM,KAAK,GAAG;AAAA,MAC1B,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,QAAI;AACJ,UAAM,QAAQ,KAAK,YACf,WAAW,MAAM;AACf,gBAAU,SAAS;AAEnB,kBAAY,WAAW,MAAM,UAAU,SAAS,GAAG,WAAW;AAG9D,gBAAU,MAAM;AAChB,aAAO,IAAI,MAAM,uBAAuB,KAAK,SAAS,OAAO,GAAG,EAAE,CAAC;AAAA,IACrE,GAAG,KAAK,SAAS,IACjB;AAEJ,UAAM,cAAc,MAAY;AAC9B,UAAI,MAAO,cAAa,KAAK;AAC7B,UAAI,UAAW,cAAa,SAAS;AAAA,IACvC;AAEA,UAAM,GAAG,SAAS,CAAC,QAAQ;AACzB,kBAAY;AACZ,aAAO,GAAG;AAAA,IACZ,CAAC;AACD,UAAM,GAAG,SAAS,CAAC,SAAS;AAC1B,kBAAY;AACZ,UAAI,CAAC,WAAW;AAGd,iBAAS,IAAI,QAAQ,WAAW,IAAI,CAAC;AACrC,iBAAS,IAAI,QAAQ,WAAW,IAAI,CAAC;AAAA,MACvC;AACA,cAAQ,EAAE,MAAM,QAAQ,IAAI,QAAQ,OAAO,CAAC;AAAA,IAC9C,CAAC;AAAA,EACH,CAAC;AACL;AAEO,IAAM,eAAwB,UAAU;","names":[]}

package/dist/chunk-4SOCPK7A.js

@@ -1,108 +0,0 @@
-// src/db/migrations.ts
-var MIGRATIONS = [
-  {
-    id: "0001_init",
-    sql: `
-      CREATE TABLE IF NOT EXISTS submissions (
-        id TEXT PRIMARY KEY,
-        submission_id INTEGER,
-        site_id TEXT NOT NULL,
-        form_type TEXT NOT NULL,
-        name TEXT NOT NULL,
-        email TEXT NOT NULL,
-        phone TEXT,
-        message TEXT,
-        extra_fields TEXT,
-        source_url TEXT,
-        utm TEXT,
-        submitted_at TEXT,
-        status TEXT NOT NULL DEFAULT 'new',
-        notify_status TEXT NOT NULL DEFAULT 'skipped',
-        resend_message_id TEXT
-      );
-      CREATE INDEX IF NOT EXISTS idx_submissions_site_submitted
-        ON submissions (site_id, submitted_at DESC);
-      CREATE INDEX IF NOT EXISTS idx_submissions_status
-        ON submissions (status);
-      CREATE TABLE IF NOT EXISTS spam_screenouts (
-        site_id TEXT NOT NULL,
-        date TEXT NOT NULL,
-        honeypot INTEGER NOT NULL DEFAULT 0,
-        too_fast INTEGER NOT NULL DEFAULT 0,
-        marked_spam INTEGER NOT NULL DEFAULT 0,
-        PRIMARY KEY (site_id, date)
-      );
-    `
-  },
-  {
-    id: "0002_fleet_events",
-    sql: `
-      CREATE TABLE IF NOT EXISTS fleet_events (
-        id TEXT PRIMARY KEY,
-        ts TEXT NOT NULL,
-        type TEXT NOT NULL,
-        site_id TEXT,
-        site_name TEXT,
-        summary TEXT NOT NULL,
-        data TEXT,
-        created_at TEXT NOT NULL
-      );
-      CREATE INDEX IF NOT EXISTS idx_fleet_events_ts ON fleet_events (ts);
-    `
-  },
-  {
-    id: "0003_add_spam_score",
-    // SQLite `ADD COLUMN` has no `IF NOT EXISTS`, so it is NOT self-idempotent: if the
-    // `_migrations` marker is lost after the column is added (crash between statement
-    // and marker write), a re-run would throw `duplicate column name`. `migrate.ts`
-    // recognizes that error as already-applied and records the marker, keeping the
-    // runner idempotent (see `isAlreadyAppliedError`).
-    sql: `ALTER TABLE submissions ADD COLUMN spam_score REAL;`
-  },
-  {
-    id: "0004_add_spam_reason",
-    sql: `ALTER TABLE submissions ADD COLUMN spam_reason TEXT;`
-  },
-  {
-    // Outcome of the newsletter fan-out (site webhook + Mailchimp). Before this the
-    // results were console.error-only, so a rotated Mailchimp key or an outage would
-    // silently stop signups reaching the audience with no trace anywhere the operator
-    // looks — the row still read `notify=sent`, healthy. Same non-idempotent
-    // ADD COLUMN caveat as 0003.
-    id: "0005_add_fanout_status",
-    sql: `ALTER TABLE submissions ADD COLUMN fanout_status TEXT;`
-  }
-];
-
-// src/db/migrate.ts
-function isAlreadyAppliedError(err) {
-  const message = err instanceof Error ? err.message : String(err);
-  return /duplicate column name/i.test(message);
-}
-async function runMigrations(client) {
-  await client.execute(
-    "CREATE TABLE IF NOT EXISTS _migrations (id TEXT PRIMARY KEY, applied_at TEXT NOT NULL)"
-  );
-  const existing = await client.execute("SELECT id FROM _migrations");
-  const applied = new Set(existing.rows.map((r) => String(r.id)));
-  const ran = [];
-  for (const m of MIGRATIONS) {
-    if (applied.has(m.id)) continue;
-    try {
-      await client.executeMultiple(m.sql);
-    } catch (err) {
-      if (!isAlreadyAppliedError(err)) throw err;
-    }
-    await client.execute({
-      sql: "INSERT INTO _migrations (id, applied_at) VALUES (?, ?)",
-      args: [m.id, (/* @__PURE__ */ new Date()).toISOString()]
-    });
-    ran.push(m.id);
-  }
-  return ran;
-}
-
-export {
-  runMigrations
-};
-//# sourceMappingURL=chunk-4SOCPK7A.js.map

package/dist/chunk-4SOCPK7A.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/db/migrations.ts","../src/db/migrate.ts"],"sourcesContent":["/** Ordered, append-only list of standard-SQL migration scripts. Each runs once,\n *  tracked by `id` in the `_migrations` table (see migrate.ts). Statements use\n *  IF NOT EXISTS so even a partial re-apply is safe. Never edit a shipped script —\n *  add a new one. Every statement in a script MUST be independently idempotent:\n *  `migrate.ts` runs each script via `executeMultiple`, which is NOT transactional,\n *  so a mid-script failure can leave earlier statements applied and the id unrecorded\n *  — a re-run then re-executes the whole script. Standard SQLite SQL only (no\n *  Turso-specific syntax) so the host stays a connection-string swap. */\nexport type Migration = { id: string; sql: string };\n\nexport const MIGRATIONS: Migration[] = [\n  {\n    id: \"0001_init\",\n    sql: `\n      CREATE TABLE IF NOT EXISTS submissions (\n        id TEXT PRIMARY KEY,\n        submission_id INTEGER,\n        site_id TEXT NOT NULL,\n        form_type TEXT NOT NULL,\n        name TEXT NOT NULL,\n        email TEXT NOT NULL,\n        phone TEXT,\n        message TEXT,\n        extra_fields TEXT,\n        source_url TEXT,\n        utm TEXT,\n        submitted_at TEXT,\n        status TEXT NOT NULL DEFAULT 'new',\n        notify_status TEXT NOT NULL DEFAULT 'skipped',\n        resend_message_id TEXT\n      );\n      CREATE INDEX IF NOT EXISTS idx_submissions_site_submitted\n        ON submissions (site_id, submitted_at DESC);\n      CREATE INDEX IF NOT EXISTS idx_submissions_status\n        ON submissions (status);\n      CREATE TABLE IF NOT EXISTS spam_screenouts (\n        site_id TEXT NOT NULL,\n        date TEXT NOT NULL,\n        honeypot INTEGER NOT NULL DEFAULT 0,\n        too_fast INTEGER NOT NULL DEFAULT 0,\n        marked_spam INTEGER NOT NULL DEFAULT 0,\n        PRIMARY KEY (site_id, date)\n      );\n    `,\n  },\n  {\n    id: \"0002_fleet_events\",\n    sql: `\n      CREATE TABLE IF NOT EXISTS fleet_events (\n        id TEXT PRIMARY KEY,\n        ts TEXT NOT NULL,\n        type TEXT NOT NULL,\n        site_id TEXT,\n        site_name TEXT,\n        summary TEXT NOT NULL,\n        data TEXT,\n        created_at TEXT NOT NULL\n      );\n      CREATE INDEX IF NOT EXISTS idx_fleet_events_ts ON fleet_events (ts);\n    `,\n  },\n  {\n    id: \"0003_add_spam_score\",\n    // SQLite `ADD COLUMN` has no `IF NOT EXISTS`, so it is NOT self-idempotent: if the\n    // `_migrations` marker is lost after the column is added (crash between statement\n    // and marker write), a re-run would throw `duplicate column name`. `migrate.ts`\n    // recognizes that error as already-applied and records the marker, keeping the\n    // runner idempotent (see `isAlreadyAppliedError`).\n    sql: `ALTER TABLE submissions ADD COLUMN spam_score REAL;`,\n  },\n  {\n    id: \"0004_add_spam_reason\",\n    sql: `ALTER TABLE submissions ADD COLUMN spam_reason TEXT;`,\n  },\n  {\n    // Outcome of the newsletter fan-out (site webhook + Mailchimp). Before this the\n    // results were console.error-only, so a rotated Mailchimp key or an outage would\n    // silently stop signups reaching the audience with no trace anywhere the operator\n    // looks — the row still read `notify=sent`, healthy. Same non-idempotent\n    // ADD COLUMN caveat as 0003.\n    id: \"0005_add_fanout_status\",\n    sql: `ALTER TABLE submissions ADD COLUMN fanout_status TEXT;`,\n  },\n];\n","import type { Client } from \"@libsql/client\";\nimport { MIGRATIONS } from \"./migrations.js\";\n\n/** True when an error means \"this DDL was already applied\" and re-applying is a\n *  no-op we can safely ignore. `CREATE ... IF NOT EXISTS` never throws, but SQLite\n *  `ALTER TABLE ... ADD COLUMN` has no `IF NOT EXISTS`, so a re-run after a lost\n *  `_migrations` marker throws `duplicate column name: …`. Treating that as\n *  already-applied keeps `runMigrations` idempotent for `ADD COLUMN` migrations —\n *  without it a lost marker would boot-loop `openDb()` on every call. */\nfunction isAlreadyAppliedError(err: unknown): boolean {\n  const message = err instanceof Error ? err.message : String(err);\n  return /duplicate column name/i.test(message);\n}\n\n/** Apply every not-yet-applied migration in order against a raw libSQL client,\n *  tracking applied ids in `_migrations`. Idempotent: ids already present are\n *  skipped, the DDL uses IF NOT EXISTS where it can, and an already-applied\n *  `ADD COLUMN` (recognized by its error) is swallowed so the marker is still\n *  recorded. Returns the ids applied this run. Runs on every openDb() — cheap\n *  (one indexed SELECT) and the gate every fresh Turso database needs before its\n *  first write. */\nexport async function runMigrations(client: Client): Promise<string[]> {\n  await client.execute(\n    \"CREATE TABLE IF NOT EXISTS _migrations (id TEXT PRIMARY KEY, applied_at TEXT NOT NULL)\",\n  );\n  const existing = await client.execute(\"SELECT id FROM _migrations\");\n  const applied = new Set(existing.rows.map((r) => String(r.id)));\n  const ran: string[] = [];\n  for (const m of MIGRATIONS) {\n    if (applied.has(m.id)) continue;\n    try {\n      await client.executeMultiple(m.sql);\n    } catch (err) {\n      // A re-run after a lost marker can re-execute a non-idempotent `ADD COLUMN`;\n      // treat \"already applied\" as success so we still record the marker below and\n      // never boot-loop. Any other error propagates unchanged.\n      if (!isAlreadyAppliedError(err)) throw err;\n    }\n    await client.execute({\n      sql: \"INSERT INTO _migrations (id, applied_at) VALUES (?, ?)\",\n      args: [m.id, new Date().toISOString()],\n    });\n    ran.push(m.id);\n  }\n  return ran;\n}\n"],"mappings":";AAUO,IAAM,aAA0B;AAAA,EACrC;AAAA,IACE,IAAI;AAAA,IACJ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA+BP;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaP;AAAA,EACA;AAAA,IACE,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMJ,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,KAAK;AAAA,EACP;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAME,IAAI;AAAA,IACJ,KAAK;AAAA,EACP;AACF;;;AC1EA,SAAS,sBAAsB,KAAuB;AACpD,QAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,SAAO,yBAAyB,KAAK,OAAO;AAC9C;AASA,eAAsB,cAAc,QAAmC;AACrE,QAAM,OAAO;AAAA,IACX;AAAA,EACF;AACA,QAAM,WAAW,MAAM,OAAO,QAAQ,4BAA4B;AAClE,QAAM,UAAU,IAAI,IAAI,SAAS,KAAK,IAAI,CAAC,MAAM,OAAO,EAAE,EAAE,CAAC,CAAC;AAC9D,QAAM,MAAgB,CAAC;AACvB,aAAW,KAAK,YAAY;AAC1B,QAAI,QAAQ,IAAI,EAAE,EAAE,EAAG;AACvB,QAAI;AACF,YAAM,OAAO,gBAAgB,EAAE,GAAG;AAAA,IACpC,SAAS,KAAK;AAIZ,UAAI,CAAC,sBAAsB,GAAG,EAAG,OAAM;AAAA,IACzC;AACA,UAAM,OAAO,QAAQ;AAAA,MACnB,KAAK;AAAA,MACL,MAAM,CAAC,EAAE,KAAI,oBAAI,KAAK,GAAE,YAAY,CAAC;AAAA,IACvC,CAAC;AACD,QAAI,KAAK,EAAE,EAAE;AAAA,EACf;AACA,SAAO;AACT;","names":[]}