@reddoorla/maintenance 0.85.2 → 0.86.0

package/dist/chunk-MGR2H7F4.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/reports/ga/config.ts","../src/reports/draft.ts","../src/reports/auto-tick.ts","../src/reports/ga/client.ts","../src/reports/ga/failover.ts","../src/reports/search/client.ts"],"sourcesContent":["import { dirname, join } from \"node:path\";\nimport { defaultCredentialsPath } from \"../../util/credentials.js\";\n\nexport type GaConfig = {\n  /** Workspace users the service account impersonates (domain-wide delegation), in\n   *  failover order — the first subject that authenticates wins. */\n  subjects: string[];\n  /** Absolute path to the service-account JSON key file. */\n  keyPath: string;\n};\n\n/**\n * Read GA configuration from the environment (credentials.env is already loaded into\n * process.env by the CLI entrypoint). Returns null when `GA_SUBJECT` is unset/blank — the\n * signal that GA enrichment is simply not configured, so drafting skips it silently.\n *\n * `GA_SUBJECT` is a comma-separated list of impersonation subjects tried in order\n * (e.g. `reports@reddoorla.com,person@reddoorla.com`), so losing one Workspace account\n * degrades to a logged failover instead of blanking the whole fleet's analytics; a single\n * address remains the degenerate one-element case. Entries are trimmed, empties dropped.\n *\n * `GA_SA_KEY_PATH` is optional; it defaults to `ga-service-account.json` alongside the\n * credentials file (e.g. ~/.config/reddoor-maint/), keeping the key out of the repo.\n */\nexport function readGaConfig(): GaConfig | null {\n  const subjects = (process.env.GA_SUBJECT ?? \"\")\n    .split(\",\")\n    .map((s) => s.trim())\n    .filter(Boolean);\n  if (subjects.length === 0) return null;\n  const keyPath =\n    process.env.GA_SA_KEY_PATH?.trim() ||\n    join(dirname(defaultCredentialsPath()), \"ga-service-account.json\");\n  return { subjects, keyPath };\n}\n","import { mkdir, writeFile } from \"node:fs/promises\";\nimport { dirname } from \"node:path\";\nimport type { ReportType, LighthouseScores } from \"./types.js\";\nimport { renderReportHtml } from \"./render.js\";\nimport { siteSlug, updateAnalyticsHealth } from \"./airtable/websites.js\";\nimport { resolveCopy } from \"./copy.js\";\nimport type { WebsiteRow } from \"./airtable/websites.js\";\nimport type { ReportRow } from \"./airtable/reports.js\";\nimport { createDraft, listReportsForSite } from \"./airtable/reports.js\";\nimport { queueDraft } from \"./queue.js\";\nimport { autoTickChecklist } from \"./auto-tick.js\";\nimport { uploadAttachment } from \"./airtable/attachments.js\";\nimport type { AirtableBase } from \"./airtable/client.js\";\nimport { readGaConfig } from \"./ga/config.js\";\nimport { fetchPeriodUsers } from \"./ga/client.js\";\nimport { fetchSearchPresence } from \"./search/client.js\";\nimport type { SearchPresence } from \"./search/client.js\";\nimport { generateHeaderImage } from \"./header-image/index.js\";\nimport type { GeneratedHeaderImage } from \"./header-image/index.js\";\n\nexport type RefreshHeaderDeps = {\n  generate?: (input: { url: string; slug?: string }) => Promise<GeneratedHeaderImage>;\n  upload?: (\n    recordId: string,\n    field: string,\n    bytes: Uint8Array,\n    filename: string,\n    contentType: string,\n  ) => Promise<void>;\n};\n\n/**\n * Regenerate a site's Header image from its live homepage so the report ships a\n * current screenshot rather than one frozen whenever the image was last made by\n * hand. Sonder alone runs 16 reports a year, so a static header goes visibly\n * stale.\n *\n * BEST-EFFORT BY DESIGN — returns false and never throws. A capture or upload\n * failure must not fail the draft: the stored image is still perfectly usable,\n * and the operator reviews the rendered preview before approving the send.\n */\nexport async function refreshHeaderImage(\n  site: WebsiteRow,\n  deps: RefreshHeaderDeps = {},\n): Promise<boolean> {\n  if (!site.url) return false;\n  const generate = deps.generate ?? generateHeaderImage;\n  const upload = deps.upload ?? uploadAttachment;\n  try {\n    const gen = await generate({ url: site.url, slug: siteSlug(site.name) });\n    await upload(site.id, \"Header image\", gen.bytes, gen.filename, gen.contentType);\n    return true;\n  } catch (err) {\n    console.warn(\n      `⚠ header-image refresh skipped for ${site.name}: ${\n        err instanceof Error ? err.message : String(err)\n      } — keeping the stored image`,\n    );\n    return false;\n  }\n}\n\nexport type DraftOptions = {\n  /** Where to write the local preview HTML when `previewOnly`. Defaults to `reports/<slug>/draft.html`. */\n  previewPath?: string;\n  /** If true: render locally only, never touch Airtable. */\n  previewOnly?: boolean;\n  /** Whether to run the GA / Search Console enrichment fetches. Defaults to\n   *  `base !== null`, i.e. the real drafting path enriches and a preview does not.\n   *\n   *  This exists because `base === null` was carrying two unrelated meanings —\n   *  \"never write to Airtable\" AND \"perform no IO at all\" — and only the first is\n   *  what `previewOnly` actually asks for. Enrichment reads Google; it writes\n   *  nothing, so there is no reason a preview cannot do it on request. Conflating\n   *  the two made the preview path structurally incapable of ever producing an\n   *  ANALYTICS section, which in turn made a CI job built to prove the GA secrets\n   *  fail 100% of the time and report it as a credential outage (2026-08-12). Set\n   *  this true to render a preview that exercises the credentials for real. */\n  enrich?: boolean;\n  /** UTC \"YYYY-MM\" recurrence key; falls back to periodEnd's month when omitted. */\n  period?: string;\n  /** Airtable record id of an EXISTING (not-ready) row to COMPLETE in place rather\n   *  than creating a new one. When set, we skip createDraft and only re-render →\n   *  upload the HTML attachment → flip Draft ready on this row. Used by the --due\n   *  re-draft path to finish a draft whose createDraft succeeded but whose\n   *  setDraftReady never ran (a crash mid-sequence wedged the period). */\n  completeRowId?: string;\n  /** The mapped ReportRow being completed, returned as `reportRow` from the\n   *  complete path so callers keep the same shape they get on the create path. */\n  existingRow?: ReportRow;\n  /** Injected deps for the draft-time header refresh, or `false` to skip it\n   *  entirely. Tests set `false` (or a stub) so a unit suite never launches a\n   *  browser or resolves DNS. Production leaves it unset and gets the real thing. */\n  refreshHeader?: RefreshHeaderDeps | false;\n};\n\n/** An enrichment fetch that *errored* (not one that was legitimately skipped\n *  because it isn't configured / the site lacks the inputs). Surfaced so a\n *  fleet-wide GA/Search outage is visible in a `--due` batch summary instead of\n *  hiding behind one easily-missed console.warn per site. */\nexport type SoftFailure = \"ga\" | \"search\";\n\nexport type DraftResult = {\n  /** null when previewOnly. */\n  reportRow: ReportRow | null;\n  /** Path to the local preview file (only set when previewOnly). */\n  htmlPath: string | null;\n  /** Always present — the rendered HTML string. */\n  html: string;\n  /** Enrichment fetches that errored for this site (empty on success or skip). */\n  softFailures: SoftFailure[];\n  /** True when search enrichment fell back to the site name (no explicit `Search query`)\n   *  AND that default matched nothing in Search Console — the signal that this site needs\n   *  a hand-tuned brand query. Distinct from a soft-failure/outage: the fetch succeeded, it\n   *  just found no data for the name. Requires a property to have RESOLVED — a site with no\n   *  Search Console property at all raises `searchPropertyMissing` instead (a query change\n   *  can't fix that, and prescribing one would silence the real problem). */\n  searchDefaultMissed: boolean;\n  /** True when NO Search Console property matched the site for any subject — a\n   *  missing/unverified property or lost service-account access. Fires for BOTH explicit\n   *  and name-default queries (unlike `searchDefaultMissed`), because no query can succeed\n   *  without a property. Distinct from a soft-failure: the API worked, the property list\n   *  just contained nothing for this site. */\n  searchPropertyMissing: boolean;\n  /** Whether the draft was placed in the approve queue. False when a higher-or-equal-tier\n   *  report is already queued for the site (single-queue rule); null on the previewOnly path. */\n  queued: boolean | null;\n  /** Ids of lower-tier queued reports this draft superseded (un-queued). */\n  supersededIds: string[];\n};\n\nfunction scoresFromWebsite(siteRow: WebsiteRow): LighthouseScores {\n  const { pScore, rScore, bpScore, seoScore } = siteRow;\n  if (pScore === null || rScore === null || bpScore === null || seoScore === null) {\n    throw new Error(\n      `Site '${siteRow.name}' is missing one or more Lighthouse scores on the Websites row (pScore, rScore, bpScore, seoScore). ` +\n        `Run 'reddoor-maint audit lighthouse' from the site's checkout and paste the four numbers into Airtable, then retry.`,\n    );\n  }\n  return { performance: pScore, accessibility: rScore, bestPractices: bpScore, seo: seoScore };\n}\n\nfunction daysAgo(today: Date, n: number): Date {\n  // UTC accessors to stay TZ-consistent with `due.ts` (and avoid landing\n  // Airtable's `Period start` on a different calendar day than the operator\n  // expects on late-night runs near a month boundary). See morning brief\n  // 2026-05-29 (M1) for context.\n  const out = new Date(today);\n  out.setUTCDate(out.getUTCDate() - n);\n  return out;\n}\n\n/**\n * Render and create an Airtable draft for one site.\n *\n * No idempotency guard here — the recurrence guard lives in draftDueReports\n * (cli/commands/report.ts), keyed on reportPeriodKey(dueDate).  The manual\n * single-site path intentionally always drafts (an operator asking for a draft\n * gets one).  findReportByPeriod (airtable/reports.ts) is the real-Airtable\n * point lookup available to dashboard/digest callers that need the same\n * idempotency guarantee outside the CLI batch loop.\n */\nexport async function draftReportForSite(\n  base: AirtableBase | null,\n  siteRow: WebsiteRow,\n  reportType: ReportType,\n  options: DraftOptions = {},\n): Promise<DraftResult> {\n  const scores = scoresFromWebsite(siteRow);\n\n  const today = new Date();\n  const slug = siteSlug(siteRow.name);\n\n  const periodStart =\n    base !== null ? await derivePeriodStart(base, siteRow, reportType, today) : daysAgo(today, 30);\n\n  const periodEnd = today;\n  const completedOn = today;\n  // \"Last Tested\" on the Maintenance email is the REAL timestamp of the most recent automated\n  // Lighthouse audit — stamped live on the Websites row (`Last lighthouse audit at`) by\n  // `audit lighthouse --write-airtable` every time the scores refresh. It is deliberately NOT\n  // the `testing day` field: that's the recurrence anchor consumed by due.ts and is hand-set, so\n  // it goes stale. Reading the audit timestamp keeps the date current with no manual upkeep.\n  const lastTestedDate =\n    reportType === \"Maintenance\" && siteRow.lastLighthouseAuditAt\n      ? new Date(siteRow.lastLighthouseAuditAt)\n      : null;\n\n  // GA enrichment. Soft-fail: any GA problem leaves the numbers null so\n  // the draft still proceeds (operator fills them manually) — GA is an enhancement, not a\n  // gate. Rendered with the fetched numbers so the review HTML matches the Airtable fields.\n  // An *error* (vs a legitimate not-configured skip) is recorded in softFailures so the\n  // caller can surface a fleet-wide outage in the batch summary.\n  // Enrichment is gated on `enrich`, NOT on `base`: reading Google and writing to\n  // Airtable are independent, and only the write is what previewOnly forbids.\n  const shouldEnrich = options.enrich ?? base !== null;\n  const gaResult = shouldEnrich\n    ? await fetchGaUsers(siteRow, periodStart, periodEnd)\n    : NO_ENRICHMENT;\n  const searchResult = shouldEnrich\n    ? await fetchSearch(siteRow, periodStart, periodEnd)\n    : // No-IO render path: nothing was attempted, so this is not an environment gap\n      // (`notConfigured` would wrongly tell the operator to go wire a secret).\n      {\n        ...NO_ENRICHMENT,\n        defaultQueryMissed: false,\n        propertyMissing: false,\n        notConfigured: false,\n      };\n  const gaUsers = gaResult.value;\n  const search = searchResult.value;\n  const softFailures: SoftFailure[] = [\n    ...(gaResult.softFailed ? ([\"ga\"] as const) : []),\n    ...(searchResult.softFailed ? ([\"search\"] as const) : []),\n  ];\n\n  // Header-image refresh (real path only). Regenerated BEFORE the render so the\n  // preview the operator approves carries the same screenshot the client will\n  // receive — the send reads this attachment off the Websites row. Gated on\n  // `base !== null` exactly like the GA/Search enrichment above: the no-IO render\n  // path (base === null, used for pure rendering and tests) must not launch a\n  // browser or write to production Airtable. `refreshHeader: false` is the second\n  // gate, for suites that DO pass a fake base and would otherwise pay a real\n  // chromium launch per case. Production leaves it unset and gets the real\n  // refresh. Best-effort — see refreshHeaderImage.\n  if (base !== null && options.refreshHeader !== false) {\n    await refreshHeaderImage(siteRow, options.refreshHeader ?? {});\n  }\n\n  const cidName = `${slug}-header`;\n  const { html } = await renderReportHtml({\n    siteName: siteRow.name,\n    siteUrl: siteRow.url,\n    reportType,\n    completedOn,\n    lighthouse: scores,\n    gaUsersCurrent: gaUsers?.current,\n    gaUsersPrevious: gaUsers?.previous,\n    searchPosition: search?.foundOnPage1 ? (search.position ?? undefined) : undefined,\n    lastTestedDate,\n    commentary: null,\n    copy: resolveCopy(siteRow),\n    headerImageCid: cidName,\n  });\n\n  if (options.previewOnly) {\n    const path = options.previewPath ?? `reports/${slug}/draft.html`;\n    await mkdir(dirname(path), { recursive: true });\n    await writeFile(path, html, \"utf-8\");\n    return {\n      reportRow: null,\n      htmlPath: path,\n      html,\n      softFailures,\n      searchDefaultMissed: searchResult.defaultQueryMissed,\n      searchPropertyMissing: searchResult.propertyMissing,\n      queued: null,\n      supersededIds: [],\n    };\n  }\n\n  if (base === null) throw new Error(\"base required when previewOnly=false\");\n\n  // Record this site's GA/Search enrichment health for the per-site analytics-failure\n  // signal (cockpit/digest). Only when analytics is configured for THIS site — set the\n  // timestamp on a soft-fail, clear it (null) on a clean enrichment so the signal\n  // self-heals. Best-effort: the `Analytics soft-fail at` column is operator-added, so\n  // until it exists the write throws UNKNOWN_FIELD_NAME — which must NOT break drafting.\n  if (readGaConfig() !== null && Boolean(siteRow.ga4PropertyId || siteRow.searchQuery)) {\n    try {\n      await updateAnalyticsHealth(\n        base,\n        siteRow.id,\n        softFailures.length > 0 ? today.toISOString() : null,\n      );\n    } catch (e) {\n      console.warn(`⚠ analytics-health write skipped for ${siteRow.name}: ${(e as Error).message}`);\n    }\n  }\n\n  // \"Finish an existing row\" path (the --due re-draft wedge fix). When the caller\n  // hands us a row that was created but never made Draft-ready — a crash between\n  // createDraft and setDraftReady leaves exactly this — we DON'T createDraft again\n  // (that would duplicate the period). We re-attach the rendered HTML and queue the\n  // EXISTING row, completing the half-made draft in place. The row's other fields\n  // (scores, period, dates) were already written at create time; the only pieces a\n  // crash drops are the attachment + the ready flag.\n  if (options.completeRowId) {\n    await uploadDraftHtml(options.completeRowId, slug, periodEnd, html);\n    const outcome = await queueDraft(base, {\n      id: options.completeRowId,\n      siteId: siteRow.id,\n      reportType,\n    });\n    return {\n      reportRow: options.existingRow ?? null,\n      htmlPath: null,\n      html,\n      softFailures,\n      searchDefaultMissed: searchResult.defaultQueryMissed,\n      searchPropertyMissing: searchResult.propertyMissing,\n      queued: outcome.queued,\n      supersededIds: outcome.supersededIds,\n    };\n  }\n\n  // Auto-tick the checklist boxes the system can prove (Phase 1: Google Indexed via the\n  // inline search signal). Fail-safe lives in autoTickChecklist: only `pass` entries are ticked;\n  // the evidence snapshot drives the dashboard's green/amber badges. The operator's approve gate\n  // and per-box override are unchanged.\n  const evidence = autoTickChecklist(siteRow, reportType, completedOn, { search: searchResult });\n  const checklistTicks = [...evidence.entries()]\n    .filter(([, e]) => e.result === \"pass\")\n    .map(([field]) => field);\n  const autoEvidence = Object.fromEntries(evidence);\n\n  const reportId = `${siteRow.name} — ${reportType} — ${periodEnd.toISOString().slice(0, 10)}`;\n  const created = await createDraft(base, {\n    reportId,\n    siteId: siteRow.id,\n    reportType,\n    period: options.period ?? periodEnd.toISOString().slice(0, 7),\n    periodStart,\n    periodEnd,\n    completedOn,\n    lighthouse: scores,\n    lastTestedDate,\n    ...(gaUsers ? { gaUsersCurrent: gaUsers.current, gaUsersPrevious: gaUsers.previous } : {}),\n    ...(search ? { searchFoundPage1: search.foundOnPage1 } : {}),\n    ...(search?.foundOnPage1 && search.position !== null\n      ? { searchPosition: search.position }\n      : {}),\n    checklistTicks,\n    autoEvidence,\n  });\n\n  await uploadDraftHtml(created.id, slug, periodEnd, html);\n  const outcome = await queueDraft(base, {\n    id: created.id,\n    siteId: siteRow.id,\n    reportType,\n  });\n\n  return {\n    reportRow: created,\n    htmlPath: null,\n    html,\n    softFailures,\n    searchDefaultMissed: searchResult.defaultQueryMissed,\n    searchPropertyMissing: searchResult.propertyMissing,\n    queued: outcome.queued,\n    supersededIds: outcome.supersededIds,\n  };\n}\n\n/** Attach the rendered HTML to a Reports row. Queueing (Draft ready + the single-queue\n *  reconciliation) is handled separately by queueDraft so both the create path and the\n *  \"complete a half-made row\" path share the identical, re-runnable upload step. */\nasync function uploadDraftHtml(\n  rowId: string,\n  slug: string,\n  periodEnd: Date,\n  html: string,\n): Promise<void> {\n  const htmlFilename = `${slug}-${periodEnd.toISOString().slice(0, 10)}.html`;\n  await uploadAttachment(rowId, \"Rendered HTML\", html, htmlFilename, \"text/html\");\n}\n\n/** Result of an enrichment fetch: the value (null if unavailable) plus whether\n *  it errored (`softFailed`) as opposed to being legitimately not-configured. */\ntype Enrichment<T> = { value: T | null; softFailed: boolean };\n/** A not-configured / skipped enrichment — null value, not a soft-failure. */\nconst NO_ENRICHMENT: Enrichment<never> = { value: null, softFailed: false };\n\n/**\n * Fetch GA \"Users\" for the period, soft-failing to null. Returns a null value (no enrichment)\n * when GA isn't configured (`GA_SUBJECT` unset) or the site has no GA4 property ID — those are\n * legitimate skips, `softFailed: false`. When the GA API errors it logs a one-line warning and\n * returns `softFailed: true`. Never throws, so a GA problem can never block a draft; the\n * operator can always enter the numbers by hand.\n */\nexport async function fetchGaUsers(\n  siteRow: WebsiteRow,\n  periodStart: Date,\n  periodEnd: Date,\n): Promise<Enrichment<{ current: number; previous: number }>> {\n  const cfg = readGaConfig();\n  if (!cfg || !siteRow.ga4PropertyId) return NO_ENRICHMENT;\n  try {\n    const value = await fetchPeriodUsers(\n      { propertyId: siteRow.ga4PropertyId, subjects: cfg.subjects, keyPath: cfg.keyPath },\n      periodStart,\n      periodEnd,\n    );\n    return { value, softFailed: false };\n  } catch (e) {\n    console.warn(`⚠ GA skipped for ${siteRow.name}: ${(e as Error).message}`);\n    return { value: null, softFailed: true };\n  }\n}\n\n/** A search enrichment, plus the two distinct miss flags (see `fetchSearch` /\n *  `DraftResult.searchDefaultMissed` / `DraftResult.searchPropertyMissing`) and the\n *  environment-gap flag `notConfigured`. */\ntype SearchEnrichment = Enrichment<SearchPresence> & {\n  defaultQueryMissed: boolean;\n  propertyMissing: boolean;\n  /** True when the site IS analytics-enrolled but this environment has no GA/SC\n   *  credentials (`GA_SUBJECT` unset) — so the check could not run at all. Distinct\n   *  from the un-enrolled skip (nothing to measure) and from a soft-fail (the API\n   *  errored). See {@link fetchSearch}. */\n  notConfigured: boolean;\n};\n\n/**\n * Fetch the site's Google search presence for the period, soft-failing to null. Runs whenever\n * GA/SA is configured (`readGaConfig()` non-null — search shares the SA credentials) AND the\n * site is analytics-enrolled (has a `ga4PropertyId` OR an explicit `searchQuery`); otherwise a\n * legitimate skip (null value, `softFailed: false`). The brand query defaults to the site NAME\n * when no explicit `searchQuery` is set (whitespace-only counts as unset) — so brand presence is\n * tracked automatically, and the operator only hand-tunes the handful of sites the name misses.\n *\n * `propertyMissing` is true when NO Search Console property matched the site for any subject\n * (missing/unverified property or lost SA access) — flagged for BOTH explicit and name-default\n * queries, because no query can fix a missing property. Pre-split, this case was folded into\n * `defaultQueryMissed`, whose \"set an explicit Search query\" remedy would permanently SILENCE\n * it (an explicit query that finds nothing is by design never flagged).\n *\n * `defaultQueryMissed` is true ONLY when a property resolved, the site-name default was used,\n * AND Search Console returned no data for it (`position === null`) — the signal to set an\n * explicit `Search query`. It is false for an explicit query (even one that finds nothing —\n * that's a valid measurement), a default that does find a position, the not-enrolled skip,\n * and the errored soft-fail path.\n *\n * `notConfigured` splits the old single skip in two. An un-enrolled site is a true skip —\n * there is nothing to measure, and the checklist row stays manual. But an ENROLLED site in an\n * environment with no credentials is an environment gap: the check was supposed to run and\n * couldn't. Collapsing the two made a credential-less run (exactly what the daily-reports\n * workflow was) indistinguishable from \"this site opted out\", so the Google Indexed row\n * silently vanished from every drafted report instead of saying why.\n *\n * When the Search Console API errors it logs a one-line warning and returns `softFailed: true`.\n * Never throws, so a search problem can never block a draft.\n */\nexport async function fetchSearch(\n  siteRow: WebsiteRow,\n  periodStart: Date,\n  periodEnd: Date,\n): Promise<SearchEnrichment> {\n  const cfg = readGaConfig();\n  const enrolled = Boolean(siteRow.ga4PropertyId || siteRow.searchQuery);\n  if (!cfg || !enrolled) {\n    const notConfigured = enrolled && !cfg;\n    if (notConfigured) {\n      console.warn(\n        `⚑ Search: no GA/Search Console credentials in this environment (GA_SUBJECT unset) — the Google Indexed check could not run for ${siteRow.name}.`,\n      );\n    }\n    return { ...NO_ENRICHMENT, defaultQueryMissed: false, propertyMissing: false, notConfigured };\n  }\n  const explicit = siteRow.searchQuery?.trim();\n  const query = explicit || siteRow.name;\n  const usedDefault = !explicit;\n  try {\n    const value = await fetchSearchPresence(\n      {\n        keyPath: cfg.keyPath,\n        subjects: cfg.subjects,\n        property: siteRow.searchConsoleProperty ?? undefined,\n        host: siteRow.url,\n        query,\n      },\n      periodStart,\n      periodEnd,\n    );\n    const propertyMissing = !value.propertyFound;\n    if (propertyMissing) {\n      console.warn(\n        `⚑ Search: no Search Console property matched ${siteRow.url} for ${siteRow.name} — verify the domain property exists and the service account has access. (A \"Search query\" change cannot fix this.)`,\n      );\n    }\n    const defaultQueryMissed = value.propertyFound && usedDefault && value.position === null;\n    if (defaultQueryMissed) {\n      console.warn(\n        `⚑ Search: site-name default \"${query}\" found no Search Console data for ${siteRow.name} — set an explicit \"Search query\" in Airtable to track brand presence.`,\n      );\n    }\n    return { value, softFailed: false, defaultQueryMissed, propertyMissing, notConfigured: false };\n  } catch (e) {\n    console.warn(`⚠ Search presence skipped for ${siteRow.name}: ${(e as Error).message}`);\n    return {\n      value: null,\n      softFailed: true,\n      defaultQueryMissed: false,\n      propertyMissing: false,\n      notConfigured: false,\n    };\n  }\n}\n\nasync function derivePeriodStart(\n  base: AirtableBase,\n  siteRow: WebsiteRow,\n  reportType: ReportType,\n  today: Date,\n): Promise<Date> {\n  const prior = await listReportsForSite(base, siteRow.id);\n  const sameType = prior\n    .filter((r) => r.reportType === reportType && r.periodEnd)\n    .map((r) => r.periodEnd!)\n    .sort();\n  const latest = sameType[sameType.length - 1];\n  if (!latest) return daysAgo(today, 30);\n  // Half-open periods. The prior report's GA/Search windows are inclusive of its\n  // periodEnd, so starting this report on the *same* day double-counts that\n  // boundary day across two consecutive reports (and inflates the headline Users\n  // count). Start the next day instead. UTC to stay TZ-consistent with daysAgo.\n  const start = new Date(latest);\n  start.setUTCDate(start.getUTCDate() + 1);\n  return start;\n}\n","import type { ReportType } from \"./types.js\";\nimport type { WebsiteRow } from \"./airtable/websites.js\";\nimport type { SearchPresence } from \"./search/client.js\";\nimport { checklistFor, gatingFields } from \"./checklist.js\";\nimport { isNetlifyAppUrl } from \"../util/url.js\";\n\n/** A persisted audit signal is only trusted within this window — a stale \"pass\" degrades to\n *  \"unknown\" (no tick). Matches the github-signals staleness convention (~3 days). */\nconst STALE_DAYS = 3;\nconst MS_PER_DAY = 24 * 60 * 60 * 1000;\n\n/** True when `checkedAt` is a valid timestamp within STALE_DAYS of `now`. */\nfunction isFresh(checkedAt: string | null, now: Date): boolean {\n  if (!checkedAt) return false;\n  const t = new Date(checkedAt).getTime();\n  if (Number.isNaN(t)) return false;\n  return now.getTime() - t <= STALE_DAYS * MS_PER_DAY;\n}\n\n/** Cert-expiry buffer: a cert must have MORE than this many days left to pass (renew window).\n *  Exactly 14 days does NOT pass — matches the spec's strict \">14 days\" and the domain audit's\n *  own `> 14` pass status, so the two thresholds can't drift. */\nconst CERT_MIN_DAYS = 14;\n\n/** A single auto-check outcome. `pass` + fresh ⇒ the caller ticks the box. */\nexport type EvidenceResult = \"pass\" | \"fail\" | \"unknown\" | \"n/a\";\nexport type EvidenceRecord = { result: EvidenceResult; checkedAt: string | null; note: string };\n\n/**\n * Inline signals fetched during the draft. Phase 1 carries Search Console only; Phase 2/3 read\n * the remaining signals (security, domain, browser) off the Websites row passed as `site`.\n */\nexport type AutoTickSignals = {\n  search: {\n    value: SearchPresence | null;\n    softFailed: boolean;\n    /** The site is analytics-enrolled but this environment has no GA/Search Console\n     *  credentials, so the check could not run. Kept distinct from the un-enrolled skip\n     *  (`value: null`, this false) so the evidence can name the environment gap instead\n     *  of disappearing. */\n    notConfigured: boolean;\n  };\n};\n\n/**\n * Decide, per checklist item for this report type, an evidence record. PURE. The fail-safe\n * invariant lives here: a box is only tickable when `result === \"pass\"`. Google Indexed is an\n * inline signal (fetched at draft), so its evidence is inherently fresh (`checkedAt = now`).\n *\n * The semantic inversion: every GATING item for this report type gets a status even with no\n * signal — a never-measured gating item resolves to `unknown` (which blocks the send gate), not\n * an omission the caller could read as \"manual/OK\". Only non-gating (advisory) items keep the old\n * omit-when-absent behavior, so an unconfigured advisory check stays silently manual.\n */\nexport function autoTickChecklist(\n  site: WebsiteRow,\n  reportType: ReportType,\n  now: Date,\n  signals: AutoTickSignals,\n): Map<string, EvidenceRecord> {\n  const out = new Map<string, EvidenceRecord>();\n  const gating = new Set(gatingFields(reportType));\n\n  for (const item of checklistFor(reportType)) {\n    let ev: EvidenceRecord | null;\n    switch (item.field) {\n      case \"Maint: Google Indexed\":\n        ev = googleEvidence(now, signals.search);\n        break;\n      case \"Maint: Deploy & Function Health\":\n        ev = deployEvidence(site, now);\n        break;\n      case \"Maint: CMS Checked\":\n        ev = cmsEvidence(site, now);\n        break;\n      case \"Maint: Domain, DNS & SSL\":\n        ev = domainEvidence(site, now);\n        break;\n      case \"Maint: Security Updates\":\n        ev = securityEvidence(site, now);\n        break;\n      case \"Maint: Uptime Checked\":\n        ev = uptimeEvidence(site, now);\n        break;\n      case \"Test: Desktop Browsers\":\n        ev = browserEvidence(\n          site.crossbrowserOk,\n          site,\n          now,\n          \"Desktop renders cleanly\",\n          \"render errors\",\n        );\n        break;\n      case \"Test: Mobile Browsers\":\n        ev = browserEvidence(site.mobileOk, site, now, \"Mobile renders cleanly\", \"overflow/errors\");\n        break;\n      case \"Test: Page Titles & Meta\":\n        ev = titlesEvidence(site, now);\n        break;\n      case \"Test: Links & Navigation\": {\n        const broken = site.brokenLinks;\n        const failNote = broken && broken > 0 ? `${broken} broken link(s)` : \"broken links / nav\";\n        ev = browserEvidence(site.linksOk, site, now, \"All internal links resolve\", failNote);\n        break;\n      }\n      case \"Test: Form Functionality\":\n        ev = formsEvidence(site, now);\n        break;\n      case \"Test: Interactions & Animations\":\n        ev = interactionsEvidence(site, now);\n        break;\n      case \"Test: Verified After Updates\":\n        ev = updatesEvidence(site, now);\n        break;\n      default:\n        ev = null;\n    }\n    // The semantic inversion: a GATING item with no fresh signal must still carry a status —\n    // `unknown` (blocks) — so an unwired/absent signal can never leave the gate silently\n    // passable. Advisory items (e.g. Google Indexed on a Maintenance report) keep the old\n    // omit-when-absent behavior.\n    if (ev === null && gating.has(item.field)) {\n      ev = { result: \"unknown\", checkedAt: null, note: \"Not yet measured\" };\n    }\n    if (ev !== null) out.set(item.field, ev);\n  }\n\n  return out;\n}\n\n/** One browser-audit verdict (Desktop/Mobile/Links) → evidence, gated on `Browser checked at`\n *  freshness. null verdict (never run) → omit (manual); stale → unknown; true → pass; false →\n *  fail (with the failure note). The verdict itself was computed by the audit (summarizeBrowser). */\nfunction browserEvidence(\n  ok: boolean | null,\n  site: WebsiteRow,\n  now: Date,\n  passNote: string,\n  failNote: string,\n): EvidenceRecord | null {\n  if (ok === null || !site.browserCheckedAt) return null;\n  const at = site.browserCheckedAt;\n  if (!isFresh(at, now)) {\n    return { result: \"unknown\", checkedAt: at, note: \"Browser check is stale (>3d)\" };\n  }\n  return ok\n    ? { result: \"pass\", checkedAt: at, note: passNote }\n    : { result: \"fail\", checkedAt: at, note: failNote };\n}\n\n/**\n * Security Updates evidence from the persisted `security` audit. Omits (→ manual) when the audit\n * never ran (counts null / no timestamp); stale → unknown; 0 critical AND 0 high → pass; any\n * critical/high → fail (with the count). Honest scope: \"no known critical/high advisories in the\n * declared dependencies as of the last audit\" — moderate/low are advisory, not gating, and this\n * does not prove the fix is deployed.\n */\nfunction securityEvidence(site: WebsiteRow, now: Date): EvidenceRecord | null {\n  const crit = site.securityVulnsCritical;\n  const high = site.securityVulnsHigh;\n  if (crit === null || high === null || !site.lastSecurityAuditAt) return null;\n  const at = site.lastSecurityAuditAt;\n  if (!isFresh(at, now)) {\n    return { result: \"unknown\", checkedAt: at, note: \"Security audit is stale (>3d)\" };\n  }\n  if (crit === 0 && high === 0) {\n    return { result: \"pass\", checkedAt: at, note: \"No known critical/high vulnerabilities\" };\n  }\n  return { result: \"fail\", checkedAt: at, note: `${crit} critical / ${high} high vuln(s)` };\n}\n\n/**\n * Search Console → Google Indexed evidence. A soft-fail (the API errored) and an unwired\n * environment (`notConfigured`) are both `unknown`, but they carry DIFFERENT notes — an\n * operator staring at an amber pill has to be able to tell \"Google was unreachable this run\"\n * from \"this deployment has no Search Console credentials\", because only the second one is\n * fixed by wiring a secret. An un-enrolled site (`value: null`, not configured, not failed)\n * emits nothing so the box stays manual.\n *\n * Page-1 is `pass` (with the position in the note); off page 1 is `fail`.\n */\nfunction googleEvidence(now: Date, search: AutoTickSignals[\"search\"]): EvidenceRecord | null {\n  const at = now.toISOString();\n  if (search.softFailed) {\n    return { result: \"unknown\", checkedAt: at, note: \"Search Console unavailable this run\" };\n  }\n  if (search.notConfigured) {\n    return {\n      result: \"unknown\",\n      checkedAt: at,\n      note: \"Search Console not configured in the environment that drafted this report\",\n    };\n  }\n  if (search.value === null) return null;\n  if (search.value.foundOnPage1) {\n    const pos = search.value.position;\n    return {\n      result: \"pass\",\n      checkedAt: at,\n      note: `Page 1 on Google${pos !== null ? ` (#${pos})` : \"\"}`,\n    };\n  }\n  const pos = search.value.position;\n  return {\n    result: \"fail\",\n    checkedAt: at,\n    note: `Not on page 1${pos !== null ? ` (avg #${pos})` : \"\"}`,\n  };\n}\n\n/**\n * Domain/DNS/SSL evidence from the persisted `domain` audit. Omits (→ manual) when there's no\n * custom domain to verify (`*.netlify.app`) or the audit never ran. A `pass` requires a fresh\n * check that resolved with a cert comfortably before expiry; stale → unknown; resolved-but-no-cert\n * or near/past expiry → fail. The honest scope is resolve + valid cert — NOT registrar expiry,\n * www↔apex redirect, or MX.\n */\nfunction domainEvidence(site: WebsiteRow, now: Date): EvidenceRecord | null {\n  // No custom domain to verify — the no-domain watch signal covers `*.netlify.app` elsewhere.\n  if (!site.url || isNetlifyAppUrl(site.url)) return null;\n  if (!site.domainCheckedAt) return null; // never probed → leave manual\n  const at = site.domainCheckedAt;\n  if (!isFresh(site.domainCheckedAt, now)) {\n    return { result: \"unknown\", checkedAt: at, note: \"Domain check is stale (>3d)\" };\n  }\n  const days = site.certDaysRemaining;\n  if (days === null) {\n    return { result: \"fail\", checkedAt: at, note: \"Did not resolve, or no valid TLS cert\" };\n  }\n  if (days <= CERT_MIN_DAYS) {\n    return { result: \"fail\", checkedAt: at, note: `TLS cert expires in ${days}d` };\n  }\n  return { result: \"pass\", checkedAt: at, note: `Custom domain, valid cert (${days}d left)` };\n}\n\n/**\n * Deploy & Function Health: the Netlify build is `ready` AND the deployed function responds\n * healthy. Two freshness stamps must both be fresh (deploy check + function-health check). Never\n * measured → null (omit → the gating dispatch coerces to unknown); either stale → unknown; both\n * fresh + ready + fn pass → pass; otherwise fail.\n */\nfunction deployEvidence(site: WebsiteRow, now: Date): EvidenceRecord | null {\n  if (!site.deployCheckedAt && !site.functionHealthCheckedAt) return null;\n  if (!isFresh(site.deployCheckedAt, now) || !isFresh(site.functionHealthCheckedAt, now)) {\n    return {\n      result: \"unknown\",\n      checkedAt: site.functionHealthCheckedAt ?? site.deployCheckedAt,\n      note: \"Deploy/function-health check is stale (>3d)\",\n    };\n  }\n  const ready = site.deployStatus === \"ready\";\n  const fnOk = site.functionHealth === \"pass\";\n  if (ready && fnOk) {\n    return {\n      result: \"pass\",\n      checkedAt: site.functionHealthCheckedAt,\n      note: \"Netlify build ready + functions respond\",\n    };\n  }\n  const why =\n    !ready && !fnOk\n      ? \"build not ready + functions unhealthy\"\n      : !ready\n        ? \"build not ready\"\n        : \"functions unhealthy\";\n  return {\n    result: \"fail\",\n    checkedAt: site.functionHealthCheckedAt,\n    note: `Deploy/function-health failing — ${why}`,\n  };\n}\n\n/**\n * CMS Checked: the server-side `/health` Prismic probe reported reachable. Freshness rides the\n * function-health check stamp (one `/health` fetch feeds both Deploy and CMS). Never measured →\n * null; stale → unknown; pass/fail mirror the stored verdict; a fresh stamp with no verdict →\n * unknown.\n */\nfunction cmsEvidence(site: WebsiteRow, now: Date): EvidenceRecord | null {\n  if (!site.functionHealthCheckedAt) return null;\n  const at = site.functionHealthCheckedAt;\n  if (!isFresh(at, now)) {\n    return { result: \"unknown\", checkedAt: at, note: \"CMS check is stale (>3d)\" };\n  }\n  if (site.cmsReachable === \"pass\") {\n    return { result: \"pass\", checkedAt: at, note: \"Prismic reachable (server-side)\" };\n  }\n  if (site.cmsReachable === \"fail\") {\n    return { result: \"fail\", checkedAt: at, note: \"Prismic unreachable (server-side)\" };\n  }\n  return { result: \"unknown\", checkedAt: at, note: \"CMS reachability not reported\" };\n}\n\n/**\n * Uptime Checked: every sampled route returned 2xx/3xx on the browser audit (point-in-time).\n * Freshness rides the shared `browserCheckedAt`. Never ran → null; stale → unknown.\n */\nfunction uptimeEvidence(site: WebsiteRow, now: Date): EvidenceRecord | null {\n  if (site.reachableOk === null || !site.browserCheckedAt) return null;\n  const at = site.browserCheckedAt;\n  if (!isFresh(at, now)) {\n    return { result: \"unknown\", checkedAt: at, note: \"Uptime check is stale (>3d)\" };\n  }\n  return site.reachableOk === \"pass\"\n    ? { result: \"pass\", checkedAt: at, note: \"All sampled routes reachable (point-in-time)\" }\n    : { result: \"fail\", checkedAt: at, note: \"One or more sampled routes did not respond 2xx/3xx\" };\n}\n\n/**\n * Page Titles & Meta: every sampled route had a non-empty title + meta description with no\n * duplicate titles (browser audit, chromium). Freshness rides `browserCheckedAt`.\n */\nfunction titlesEvidence(site: WebsiteRow, now: Date): EvidenceRecord | null {\n  if (site.titleMetaOk === null || !site.browserCheckedAt) return null;\n  const at = site.browserCheckedAt;\n  if (!isFresh(at, now)) {\n    return { result: \"unknown\", checkedAt: at, note: \"Titles/meta check is stale (>3d)\" };\n  }\n  return site.titleMetaOk === \"pass\"\n    ? { result: \"pass\", checkedAt: at, note: \"Titles + meta present\" }\n    : {\n        result: \"fail\",\n        checkedAt: at,\n        note: \"Missing/duplicate title or missing meta description\",\n      };\n}\n\n/**\n * Form Functionality: a synthetic prod submission succeeded (form-e2e audit). `n/a` when the audit\n * ran (checked-at stamp set) but the site has no contact form (verdict cleared to null). Never ran\n * (no stamp) → null; stale → unknown.\n */\nfunction formsEvidence(site: WebsiteRow, now: Date): EvidenceRecord | null {\n  if (!site.formE2eCheckedAt) return null;\n  const at = site.formE2eCheckedAt;\n  if (!isFresh(at, now)) {\n    return { result: \"unknown\", checkedAt: at, note: \"Form E2E check is stale (>3d)\" };\n  }\n  if (site.formE2eOk === \"pass\") {\n    return { result: \"pass\", checkedAt: at, note: \"Synthetic submission succeeded\" };\n  }\n  if (site.formE2eOk === \"fail\") {\n    return { result: \"fail\", checkedAt: at, note: \"Synthetic submission failed\" };\n  }\n  return { result: \"n/a\", checkedAt: at, note: \"No contact form on this site\" };\n}\n\n/**\n * Interactions & Animations: the per-site smoke suite is green. Freshness rides `lastSmokeAt`.\n * Never ran → null; stale → unknown.\n */\nfunction interactionsEvidence(site: WebsiteRow, now: Date): EvidenceRecord | null {\n  if (site.smokeOk === null || !site.lastSmokeAt) return null;\n  const at = site.lastSmokeAt;\n  if (!isFresh(at, now)) {\n    return { result: \"unknown\", checkedAt: at, note: \"Smoke suite is stale (>3d)\" };\n  }\n  return site.smokeOk === \"pass\"\n    ? { result: \"pass\", checkedAt: at, note: \"Smoke suite green\" }\n    : { result: \"fail\", checkedAt: at, note: \"Smoke suite red\" };\n}\n\n/**\n * Tested After Updates: default-branch CI is green on the latest commit (github-signals). A repo\n * with no CI (`defaultBranchCi === \"none\"`) is `n/a`. Never swept (null / no stamp) → null; stale\n * → unknown; passing → pass; failing → fail; pending → unknown.\n */\nfunction updatesEvidence(site: WebsiteRow, now: Date): EvidenceRecord | null {\n  if (site.defaultBranchCi === null || !site.githubSignalsAt) return null;\n  const at = site.githubSignalsAt;\n  if (site.defaultBranchCi === \"none\") {\n    return { result: \"n/a\", checkedAt: at, note: \"Repository has no CI\" };\n  }\n  if (!isFresh(at, now)) {\n    return { result: \"unknown\", checkedAt: at, note: \"CI signal is stale (>3d)\" };\n  }\n  if (site.defaultBranchCi === \"passing\") {\n    return { result: \"pass\", checkedAt: at, note: \"Default-branch CI green on latest commit\" };\n  }\n  if (site.defaultBranchCi === \"failing\") {\n    return { result: \"fail\", checkedAt: at, note: \"Default-branch CI is failing\" };\n  }\n  return { result: \"unknown\", checkedAt: at, note: \"Default-branch CI is pending\" };\n}\n","import { readFileSync } from \"node:fs\";\nimport { JWT } from \"google-auth-library\";\nimport { BetaAnalyticsDataClient } from \"@google-analytics/data\";\nimport { withSubjectFailover } from \"./failover.js\";\n\nconst ANALYTICS_READONLY = \"https://www.googleapis.com/auth/analytics.readonly\";\nconst MS_PER_DAY = 86_400_000;\n\nexport type GaQuery = {\n  /** GA4 numeric property ID (e.g. \"471880366\"). */\n  propertyId: string;\n  /** Workspace users to impersonate via domain-wide delegation, tried in order\n   *  (auth-failure failover — see `withSubjectFailover`). */\n  subjects: string[];\n  /** Path to the service-account JSON key. */\n  keyPath: string;\n};\n\n/** UTC YYYY-MM-DD — matches the rest of the reports pipeline's date handling. */\nfunction ymd(d: Date): string {\n  return d.toISOString().slice(0, 10);\n}\n\n/**\n * Fetch GA4 `activeUsers` (\"Users\") for a report period and the equal-length window\n * immediately before it, via a domain-wide-delegation service account impersonating each\n * of `subjects` in order until one authenticates. Throws on any non-auth API error, or\n * once every subject has failed auth — the caller (draftReportForSite) soft-fails.\n *\n * Previous window: same length as the current period, ending the day before `periodStart`.\n */\nexport async function fetchPeriodUsers(\n  query: GaQuery,\n  periodStart: Date,\n  periodEnd: Date,\n): Promise<{ current: number; previous: number }> {\n  const key = JSON.parse(readFileSync(query.keyPath, \"utf8\")) as {\n    client_email: string;\n    private_key: string;\n  };\n\n  const lengthDays = Math.round((periodEnd.getTime() - periodStart.getTime()) / MS_PER_DAY);\n  const prevEnd = new Date(periodStart.getTime() - MS_PER_DAY);\n  const prevStart = new Date(prevEnd.getTime() - lengthDays * MS_PER_DAY);\n  const property = `properties/${query.propertyId}`;\n\n  return withSubjectFailover(query.subjects, \"GA\", async (subject) => {\n    const authClient = new JWT({\n      email: key.client_email,\n      key: key.private_key,\n      scopes: [ANALYTICS_READONLY],\n      subject,\n    });\n    const client = new BetaAnalyticsDataClient({ authClient });\n\n    const run = async (start: Date, end: Date): Promise<number> => {\n      const [resp] = await client.runReport({\n        property,\n        dateRanges: [{ startDate: ymd(start), endDate: ymd(end) }],\n        metrics: [{ name: \"activeUsers\" }],\n      });\n      const raw = resp.rows?.[0]?.metricValues?.[0]?.value ?? \"0\";\n      const n = Number.parseInt(raw, 10);\n      return Number.isFinite(n) ? n : 0;\n    };\n\n    const current = await run(periodStart, periodEnd);\n    const previous = await run(prevStart, prevEnd);\n    return { current, previous };\n  });\n}\n","/**\n * Impersonation-subject failover, shared by the GA Data client and the Search Console\n * client (both impersonate the same `GA_SUBJECT` list via domain-wide delegation).\n *\n * The point: one personal Workspace account backing every site's analytics is a fleet-wide\n * SPOF — if it's offboarded/suspended or loses property access, all analytics soft-fail to\n * blank at once. With `GA_SUBJECT` as an ordered list, an auth failure on one subject falls\n * through to the next, and a *partial* outage (primary dying, backup carrying) is surfaced\n * as a greppable `subject failover` warning before it becomes a total one.\n */\n\nconst AUTH_HTTP_STATUS = new Set([401, 403]);\n/** gRPC PERMISSION_DENIED (7) / UNAUTHENTICATED (16) — how the GA Data API surfaces auth. */\nconst AUTH_GRPC_CODES = new Set([7, 16]);\n/** Message shapes across the three auth surfaces: gRPC code names (GA Data), OAuth token\n *  exchange (`invalid_grant` = suspended/deleted subject, `unauthorized_client` = DWD scope\n *  missing), and plain HTTP 401/403 texts (Search Console via gaxios). */\nconst AUTH_MESSAGE =\n  /permission[_ ]denied|unauthenticated|unauthorized|invalid_grant|access[_ ]denied|forbidden|insufficient permission|status code 40[13]/i;\n\ntype ErrorShape = {\n  code?: number | string;\n  status?: number | string;\n  response?: { status?: number; data?: { error?: { errors?: Array<{ reason?: string }> } } };\n  /** Explicit opt-in marker for errors that aren't auth-shaped per se but mean \"this\n   *  subject can't do the job, try the next one\" (see the search client's empty\n   *  sites.list case — that API hides inaccessible properties instead of 403ing). */\n  failoverToNextSubject?: boolean;\n};\n\n/** Google surfaces per-user throughput caps as HTTP 403 with one of these `reason`s — a\n *  transient rate-limit, NOT a lost grant. Distinguished so the failover warning doesn't\n *  send operators to the offboarding runbook over a quota blip. */\nconst QUOTA_REASONS = new Set([\n  \"userratelimitexceeded\",\n  \"ratelimitexceeded\",\n  \"quotaexceeded\",\n  \"dailylimitexceeded\",\n]);\nconst QUOTA_MESSAGE = /quota exceeded|rate limit exceeded|user rate limit/i;\n\n/** True when an error looks like THIS subject's auth/authorization failed — the only\n *  condition worth retrying under a different subject. Network/5xx/bad-input errors\n *  would fail identically for every subject, so they propagate immediately. */\nexport function isAuthShapedError(e: unknown): boolean {\n  const err = e as ErrorShape | null | undefined;\n  if (err?.failoverToNextSubject === true) return true;\n  if ([err?.status, err?.response?.status].some((s) => AUTH_HTTP_STATUS.has(Number(s))))\n    return true;\n  if (AUTH_HTTP_STATUS.has(Number(err?.code)) || AUTH_GRPC_CODES.has(Number(err?.code)))\n    return true;\n  const msg = e instanceof Error ? e.message : String(e);\n  return AUTH_MESSAGE.test(msg);\n}\n\n/** A soft \"this subject can't see the resource, try the next one\" marker (the search\n *  client's empty sites.list case) — NOT a genuine failure. It must never dominate a real\n *  auth error when deciding what to throw after all subjects are exhausted. */\nfunction isFailoverSentinel(e: unknown): boolean {\n  return (e as ErrorShape | null | undefined)?.failoverToNextSubject === true;\n}\n\n/** True when a 403 is a transient per-user quota/rate-limit, not an access loss. A\n *  structured `reason` is authoritative (so a real `forbidden` 403 whose message happens to\n *  mention a limit is NOT quota); otherwise fall back to the message. Still auth-shaped for\n *  failover purposes — this only softens the warning wording, never the control flow. */\nexport function isQuotaShapedError(e: unknown): boolean {\n  const err = e as ErrorShape | null | undefined;\n  if (err?.failoverToNextSubject === true) return false;\n  const reasons = err?.response?.data?.error?.errors;\n  if (Array.isArray(reasons) && reasons.length > 0) {\n    return reasons.some((r) => r?.reason != null && QUOTA_REASONS.has(r.reason.toLowerCase()));\n  }\n  const msg = e instanceof Error ? e.message : String(e);\n  return QUOTA_MESSAGE.test(msg);\n}\n\n/**\n * Run `attempt` with each subject in order until one succeeds. Auth-shaped failures fall\n * through to the next subject; anything else throws immediately. When all subjects fail,\n * the LAST error is thrown — callers keep their existing catch-and-soft-fail behavior.\n * When an earlier subject failed but a later one succeeded, emit ONE console.warn so a\n * dying primary is visible in the cron log before it becomes a total outage.\n */\nexport async function withSubjectFailover<T>(\n  subjects: readonly string[],\n  label: string,\n  attempt: (subject: string) => Promise<T>,\n): Promise<T> {\n  if (subjects.length === 0) throw new Error(`${label}: no impersonation subjects configured`);\n  const failed: string[] = [];\n  // Track a genuine auth failure separately from a soft sentinel. If ANY subject failed for\n  // real, that error must be what we throw — never a later subject's \"no resource here\"\n  // sentinel. Otherwise [real-auth-failure, empty-result] would surface as a clean sentinel\n  // and the caller would record it as verified data instead of soft-failing (the exact\n  // masking the analytics-health alarm exists to catch).\n  let lastRealError: unknown;\n  let lastSentinel: unknown;\n  // Stays true only while every failure so far is a transient quota/rate-limit — a lost\n  // grant or a sentinel flips it, escalating the warning from \"transient\" to the runbook.\n  let allQuota = true;\n  for (const subject of subjects) {\n    try {\n      const result = await attempt(subject);\n      if (failed.length > 0) {\n        console.warn(\n          allQuota\n            ? `⚠ ${label} subject failover: ${failed.join(\"; \")} — succeeded via ${subject} ` +\n                `(transient quota/rate-limit, not an access loss).`\n            : `⚠ ${label} subject failover: ${failed.join(\"; \")} — succeeded via ${subject}. ` +\n                `Restore the failing subject's access or drop it from GA_SUBJECT ` +\n                `(docs/runbooks/ga-search-role-account-cutover.md).`,\n        );\n      }\n      return result;\n    } catch (e) {\n      if (!isAuthShapedError(e)) throw e;\n      failed.push(`${subject} (${e instanceof Error ? e.message : String(e)})`);\n      if (isFailoverSentinel(e)) {\n        lastSentinel = e;\n        allQuota = false;\n      } else {\n        lastRealError = e;\n        if (!isQuotaShapedError(e)) allQuota = false;\n      }\n    }\n  }\n  // A real auth failure dominates a sentinel regardless of subject order; only when EVERY\n  // subject merely returned the soft sentinel do we throw it (the search client turns that\n  // into a legitimate not-found).\n  throw lastRealError ?? lastSentinel;\n}\n","import { readFileSync } from \"node:fs\";\nimport { JWT } from \"google-auth-library\";\nimport { withSubjectFailover } from \"../ga/failover.js\";\n\nconst WEBMASTERS_READONLY = \"https://www.googleapis.com/auth/webmasters.readonly\";\nconst SC_BASE = \"https://searchconsole.googleapis.com/webmasters/v3\";\n/** Average-position threshold for \"on page 1\" (10 organic results per page). */\nconst PAGE_1_MAX_POSITION = 10;\n/** Rows to pull for the brand `contains` match. searchAnalytics has no orderBy and returns\n *  rows clicks-desc, so the exact-query row survives into the response only if it isn't paged\n *  out beyond this cap. Sized with wide headroom — a brand has a handful of phrasing variants,\n *  far below 100 — so the exact query (and every variant) is in practice always present. */\nexport const BRAND_QUERY_ROW_LIMIT = 100;\n\nexport type SearchPresenceQuery = {\n  /** Path to the service-account JSON key (same one GA uses). */\n  keyPath: string;\n  /** Workspace users to impersonate via domain-wide delegation, tried in order\n   *  (auth-failure failover — see `withSubjectFailover`). */\n  subjects: string[];\n  /** Explicit Search Console property (`sc-domain:...` or `https://.../`). Overrides auto-resolution. */\n  property?: string | undefined;\n  /** Site host, used to auto-resolve the property from `sites.list` when `property` is absent. */\n  host: string;\n  /** Operator-supplied brand hint (e.g. the business name). Matched as a case-insensitive\n   *  SUBSTRING (`contains`) of the actual user query — NOT a hard exact string — so it tolerates\n   *  phrasing (\"red door creative\" vs \"…creative la\"). An exact-query match is preferred when\n   *  present; otherwise the most-searched matching query wins. */\n  query: string;\n};\n\nexport type SearchPresence = {\n  /** True when the average position for the query is on page 1 (<= 10). */\n  foundOnPage1: boolean;\n  /** Rounded average position, or null when not found / no data. */\n  position: number | null;\n  /** True when a Search Console property was actually resolved for the site (even if the\n   *  query then found no data). False ONLY when every subject resolved ZERO matching\n   *  properties — a missing/unverified property or lost SA access. Callers must\n   *  distinguish these: \"property exists, query missed\" is fixable with a better query;\n   *  \"no property at all\" is not, and prescribing a query change would silence the real\n   *  problem forever (an explicit query that returns nothing is by design never flagged). */\n  propertyFound: boolean;\n};\n\ntype SiteEntry = { siteUrl: string };\n\n/** Reduce any property string or URL to a bare host: no `sc-domain:`, scheme, `www.`, path, lowercased. */\nexport function bareHost(s: string): string {\n  return s\n    .trim()\n    .replace(/^sc-domain:/i, \"\")\n    .replace(/^https?:\\/\\//i, \"\")\n    .split(\"/\")[0]!\n    .replace(/^www\\./i, \"\")\n    .toLowerCase();\n}\n\n/**\n * All Search Console properties matching `host`, ordered for query fallback: Domain\n * (`sc-domain:`) forms first (broadest coverage), then URL-prefix forms. A site can be verified\n * as both; a freshly-created Domain property has no backfilled history, so its data can be empty\n * even while a long-lived URL-prefix property has data — hence we return every match and let the\n * caller try them in order until one returns data. Empty list = nothing matches.\n */\nexport function resolvePropertyCandidates(entries: SiteEntry[], host: string): string[] {\n  const target = bareHost(host);\n  const matches = entries.filter((e) => bareHost(e.siteUrl) === target).map((e) => e.siteUrl);\n  const domains = matches.filter((s) => s.toLowerCase().startsWith(\"sc-domain:\"));\n  const prefixes = matches.filter((s) => !s.toLowerCase().startsWith(\"sc-domain:\"));\n  return [...domains, ...prefixes];\n}\n\n/** UTC YYYY-MM-DD — matches the rest of the reports pipeline. */\nfunction ymd(d: Date): string {\n  return d.toISOString().slice(0, 10);\n}\n\n/**\n * From the queries matching the brand substring, pick the one the brand is actually FOUND\n * by most — the highest-impression row — and return its average position; tie-break on the\n * better (lower) position. Returns undefined when no row carries a numeric position. This is\n * what makes the reported \"brand search\" position robust to phrasing: with a `contains`\n * filter several variants can match, and we report the position of the variant real users\n * search most, not whichever the operator happened to type. Rows missing `impressions` count\n * as 0 (keeps a single-row, impression-less response — e.g. a test fixture — working). PURE.\n */\nexport function pickBrandQuery(\n  rows: Array<{ position?: number; impressions?: number }>,\n): number | undefined {\n  let best: { position: number; impressions: number } | undefined;\n  for (const r of rows) {\n    if (typeof r.position !== \"number\") continue;\n    const impressions = r.impressions ?? 0;\n    if (\n      best === undefined ||\n      impressions > best.impressions ||\n      (impressions === best.impressions && r.position < best.position)\n    ) {\n      best = { position: r.position, impressions };\n    }\n  }\n  return best?.position;\n}\n\n/**\n * The brand's reported position from the `contains`-matched rows, preferring an EXACT match.\n * When a returned row's query equals the operator's configured string (case-insensitive), its\n * position is used verbatim — a precisely-configured brand query is honored, with no chance a\n * longer higher-impression variant (\"…reviews\", \"…near me\") hijacks the number. Otherwise we\n * fall back to the most-searched matching query (`pickBrandQuery`). Operates only on the rows\n * actually returned: a string `contains` itself, so the exact query is among the `contains`\n * results whenever it has data AND isn't paged out beyond `BRAND_QUERY_ROW_LIMIT` (sized so a\n * brand's handful of phrasing variants always fit; if it ever were paged out, the most-searched\n * fallback still returns a valid brand position). Returns undefined when no row carries a\n * numeric position. PURE.\n */\nexport function selectBrandPosition(\n  rows: Array<{ keys?: string[]; position?: number; impressions?: number }>,\n  exactQuery: string,\n): number | undefined {\n  const want = exactQuery.toLowerCase();\n  const exact = rows.find(\n    (r) => typeof r.position === \"number\" && (r.keys?.[0] ?? \"\").toLowerCase() === want,\n  );\n  if (exact) return exact.position;\n  return pickBrandQuery(rows);\n}\n\n/** Per-subject \"this subject resolved NO matching Search Console property\". sites.list only\n *  returns properties the impersonated user can access — a subject that lost access sees an\n *  empty list with no auth error at all — so this opts into subject failover explicitly.\n *  When EVERY subject resolves empty, `fetchSearchPresence` restores the pre-failover\n *  behavior: a plain not-found result, not a throw. */\nclass NoPropertyForSubjectError extends Error {\n  readonly failoverToNextSubject = true;\n  constructor(subject: string, host: string) {\n    super(`no Search Console property matching ${host} is visible to ${subject}`);\n  }\n}\n\n/**\n * Query Google Search Console for the brand's average position on the site over the report\n * period, via a domain-wide-delegation service account impersonating each of `subjects` in\n * order until one authenticates. `query` is a case-insensitive SUBSTRING (`contains`) hint;\n * among the matching user queries we report the position of the exact-match query when\n * present, else the most-searched one (see `selectBrandPosition`) — so it doesn't depend on\n * the operator typing the exact search string, yet honors one verbatim when they do. Uses\n * `property` verbatim when given (operator's choice is final — no fallback); otherwise\n * auto-discovers all matching properties via `sites.list` and tries them in order (Domain\n * first) until one returns data. Throws on any non-auth API error, or once every subject\n * has failed auth — the caller (draftReportForSite) soft-fails.\n */\nexport async function fetchSearchPresence(\n  q: SearchPresenceQuery,\n  periodStart: Date,\n  periodEnd: Date,\n): Promise<SearchPresence> {\n  const key = JSON.parse(readFileSync(q.keyPath, \"utf8\")) as {\n    client_email: string;\n    private_key: string;\n  };\n\n  try {\n    return await withSubjectFailover(q.subjects, \"Search Console\", async (subject) => {\n      const jwt = new JWT({\n        email: key.client_email,\n        key: key.private_key,\n        scopes: [WEBMASTERS_READONLY],\n        subject,\n      });\n\n      const explicit = q.property?.trim();\n      let candidates: string[];\n      if (explicit) {\n        candidates = [explicit];\n      } else {\n        const list = await jwt.request<{ siteEntry?: SiteEntry[] }>({\n          url: `${SC_BASE}/sites`,\n          method: \"GET\",\n        });\n        candidates = resolvePropertyCandidates(list.data.siteEntry ?? [], q.host);\n        if (candidates.length === 0) throw new NoPropertyForSubjectError(subject, q.host);\n      }\n\n      for (const property of candidates) {\n        const res = await jwt.request<{\n          rows?: Array<{ keys?: string[]; position?: number; impressions?: number }>;\n        }>({\n          url: `${SC_BASE}/sites/${encodeURIComponent(property)}/searchAnalytics/query`,\n          method: \"POST\",\n          data: {\n            startDate: ymd(periodStart),\n            endDate: ymd(periodEnd),\n            dimensions: [\"query\"],\n            dimensionFilterGroups: [\n              {\n                filters: [\n                  { dimension: \"query\", operator: \"contains\", expression: q.query.toLowerCase() },\n                ],\n              },\n            ],\n            rowLimit: BRAND_QUERY_ROW_LIMIT,\n          },\n        });\n        const pos = selectBrandPosition(res.data.rows ?? [], q.query.toLowerCase());\n        if (typeof pos === \"number\") {\n          // Search Console can average below 1; floor to 1 so the template never\n          // renders a nonsensical \"#0\" (positions are 1-indexed).\n          return {\n            foundOnPage1: pos <= PAGE_1_MAX_POSITION,\n            position: Math.max(1, Math.round(pos)),\n            propertyFound: true,\n          };\n        }\n      }\n      // A property WAS resolved (or operator-pinned); the query just found no rows.\n      return { foundOnPage1: false, position: null, propertyFound: true };\n    });\n  } catch (e) {\n    // Every subject resolved zero matching properties — same legitimate \"no property\"\n    // outcome as before failover existed, NOT an analytics soft-failure. Marked\n    // propertyFound:false so the draft layer can flag the ACTUAL problem (missing\n    // property / lost SA access) instead of blaming the query.\n    if (e instanceof NoPropertyForSubjectError)\n      return { foundOnPage1: false, position: null, propertyFound: false };\n    throw e;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS,YAAY;AAwBvB,SAAS,eAAgC;AAC9C,QAAM,YAAY,QAAQ,IAAI,cAAc,IACzC,MAAM,GAAG,EACT,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,OAAO;AACjB,MAAI,SAAS,WAAW,EAAG,QAAO;AAClC,QAAM,UACJ,QAAQ,IAAI,gBAAgB,KAAK,KACjC,KAAK,QAAQ,uBAAuB,CAAC,GAAG,yBAAyB;AACnE,SAAO,EAAE,UAAU,QAAQ;AAC7B;;;AClCA,SAAS,OAAO,iBAAiB;AACjC,SAAS,WAAAA,gBAAe;;;ACOxB,IAAM,aAAa;AACnB,IAAM,aAAa,KAAK,KAAK,KAAK;AAGlC,SAAS,QAAQ,WAA0B,KAAoB;AAC7D,MAAI,CAAC,UAAW,QAAO;AACvB,QAAM,IAAI,IAAI,KAAK,SAAS,EAAE,QAAQ;AACtC,MAAI,OAAO,MAAM,CAAC,EAAG,QAAO;AAC5B,SAAO,IAAI,QAAQ,IAAI,KAAK,aAAa;AAC3C;AAKA,IAAM,gBAAgB;AAgCf,SAAS,kBACd,MACA,YACA,KACA,SAC6B;AAC7B,QAAM,MAAM,oBAAI,IAA4B;AAC5C,QAAM,SAAS,IAAI,IAAI,aAAa,UAAU,CAAC;AAE/C,aAAW,QAAQ,aAAa,UAAU,GAAG;AAC3C,QAAI;AACJ,YAAQ,KAAK,OAAO;AAAA,MAClB,KAAK;AACH,aAAK,eAAe,KAAK,QAAQ,MAAM;AACvC;AAAA,MACF,KAAK;AACH,aAAK,eAAe,MAAM,GAAG;AAC7B;AAAA,MACF,KAAK;AACH,aAAK,YAAY,MAAM,GAAG;AAC1B;AAAA,MACF,KAAK;AACH,aAAK,eAAe,MAAM,GAAG;AAC7B;AAAA,MACF,KAAK;AACH,aAAK,iBAAiB,MAAM,GAAG;AAC/B;AAAA,MACF,KAAK;AACH,aAAK,eAAe,MAAM,GAAG;AAC7B;AAAA,MACF,KAAK;AACH,aAAK;AAAA,UACH,KAAK;AAAA,UACL;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QACF;AACA;AAAA,MACF,KAAK;AACH,aAAK,gBAAgB,KAAK,UAAU,MAAM,KAAK,0BAA0B,iBAAiB;AAC1F;AAAA,MACF,KAAK;AACH,aAAK,eAAe,MAAM,GAAG;AAC7B;AAAA,MACF,KAAK,4BAA4B;AAC/B,cAAM,SAAS,KAAK;AACpB,cAAM,WAAW,UAAU,SAAS,IAAI,GAAG,MAAM,oBAAoB;AACrE,aAAK,gBAAgB,KAAK,SAAS,MAAM,KAAK,8BAA8B,QAAQ;AACpF;AAAA,MACF;AAAA,MACA,KAAK;AACH,aAAK,cAAc,MAAM,GAAG;AAC5B;AAAA,MACF,KAAK;AACH,aAAK,qBAAqB,MAAM,GAAG;AACnC;AAAA,MACF,KAAK;AACH,aAAK,gBAAgB,MAAM,GAAG;AAC9B;AAAA,MACF;AACE,aAAK;AAAA,IACT;AAKA,QAAI,OAAO,QAAQ,OAAO,IAAI,KAAK,KAAK,GAAG;AACzC,WAAK,EAAE,QAAQ,WAAW,WAAW,MAAM,MAAM,mBAAmB;AAAA,IACtE;AACA,QAAI,OAAO,KAAM,KAAI,IAAI,KAAK,OAAO,EAAE;AAAA,EACzC;AAEA,SAAO;AACT;AAKA,SAAS,gBACP,IACA,MACA,KACA,UACA,UACuB;AACvB,MAAI,OAAO,QAAQ,CAAC,KAAK,iBAAkB,QAAO;AAClD,QAAM,KAAK,KAAK;AAChB,MAAI,CAAC,QAAQ,IAAI,GAAG,GAAG;AACrB,WAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,+BAA+B;AAAA,EAClF;AACA,SAAO,KACH,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,SAAS,IAChD,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,SAAS;AACtD;AASA,SAAS,iBAAiB,MAAkB,KAAkC;AAC5E,QAAM,OAAO,KAAK;AAClB,QAAM,OAAO,KAAK;AAClB,MAAI,SAAS,QAAQ,SAAS,QAAQ,CAAC,KAAK,oBAAqB,QAAO;AACxE,QAAM,KAAK,KAAK;AAChB,MAAI,CAAC,QAAQ,IAAI,GAAG,GAAG;AACrB,WAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,gCAAgC;AAAA,EACnF;AACA,MAAI,SAAS,KAAK,SAAS,GAAG;AAC5B,WAAO,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,yCAAyC;AAAA,EACzF;AACA,SAAO,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,GAAG,IAAI,eAAe,IAAI,gBAAgB;AAC1F;AAYA,SAAS,eAAe,KAAW,QAA0D;AAC3F,QAAM,KAAK,IAAI,YAAY;AAC3B,MAAI,OAAO,YAAY;AACrB,WAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,sCAAsC;AAAA,EACzF;AACA,MAAI,OAAO,eAAe;AACxB,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,WAAW;AAAA,MACX,MAAM;AAAA,IACR;AAAA,EACF;AACA,MAAI,OAAO,UAAU,KAAM,QAAO;AAClC,MAAI,OAAO,MAAM,cAAc;AAC7B,UAAMC,OAAM,OAAO,MAAM;AACzB,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,WAAW;AAAA,MACX,MAAM,mBAAmBA,SAAQ,OAAO,MAAMA,IAAG,MAAM,EAAE;AAAA,IAC3D;AAAA,EACF;AACA,QAAM,MAAM,OAAO,MAAM;AACzB,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,WAAW;AAAA,IACX,MAAM,gBAAgB,QAAQ,OAAO,UAAU,GAAG,MAAM,EAAE;AAAA,EAC5D;AACF;AASA,SAAS,eAAe,MAAkB,KAAkC;AAE1E,MAAI,CAAC,KAAK,OAAO,gBAAgB,KAAK,GAAG,EAAG,QAAO;AACnD,MAAI,CAAC,KAAK,gBAAiB,QAAO;AAClC,QAAM,KAAK,KAAK;AAChB,MAAI,CAAC,QAAQ,KAAK,iBAAiB,GAAG,GAAG;AACvC,WAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,8BAA8B;AAAA,EACjF;AACA,QAAM,OAAO,KAAK;AAClB,MAAI,SAAS,MAAM;AACjB,WAAO,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,wCAAwC;AAAA,EACxF;AACA,MAAI,QAAQ,eAAe;AACzB,WAAO,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,uBAAuB,IAAI,IAAI;AAAA,EAC/E;AACA,SAAO,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,8BAA8B,IAAI,UAAU;AAC5F;AAQA,SAAS,eAAe,MAAkB,KAAkC;AAC1E,MAAI,CAAC,KAAK,mBAAmB,CAAC,KAAK,wBAAyB,QAAO;AACnE,MAAI,CAAC,QAAQ,KAAK,iBAAiB,GAAG,KAAK,CAAC,QAAQ,KAAK,yBAAyB,GAAG,GAAG;AACtF,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,WAAW,KAAK,2BAA2B,KAAK;AAAA,MAChD,MAAM;AAAA,IACR;AAAA,EACF;AACA,QAAM,QAAQ,KAAK,iBAAiB;AACpC,QAAM,OAAO,KAAK,mBAAmB;AACrC,MAAI,SAAS,MAAM;AACjB,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,WAAW,KAAK;AAAA,MAChB,MAAM;AAAA,IACR;AAAA,EACF;AACA,QAAM,MACJ,CAAC,SAAS,CAAC,OACP,0CACA,CAAC,QACC,oBACA;AACR,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,WAAW,KAAK;AAAA,IAChB,MAAM,yCAAoC,GAAG;AAAA,EAC/C;AACF;AAQA,SAAS,YAAY,MAAkB,KAAkC;AACvE,MAAI,CAAC,KAAK,wBAAyB,QAAO;AAC1C,QAAM,KAAK,KAAK;AAChB,MAAI,CAAC,QAAQ,IAAI,GAAG,GAAG;AACrB,WAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,2BAA2B;AAAA,EAC9E;AACA,MAAI,KAAK,iBAAiB,QAAQ;AAChC,WAAO,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,kCAAkC;AAAA,EAClF;AACA,MAAI,KAAK,iBAAiB,QAAQ;AAChC,WAAO,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,oCAAoC;AAAA,EACpF;AACA,SAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,gCAAgC;AACnF;AAMA,SAAS,eAAe,MAAkB,KAAkC;AAC1E,MAAI,KAAK,gBAAgB,QAAQ,CAAC,KAAK,iBAAkB,QAAO;AAChE,QAAM,KAAK,KAAK;AAChB,MAAI,CAAC,QAAQ,IAAI,GAAG,GAAG;AACrB,WAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,8BAA8B;AAAA,EACjF;AACA,SAAO,KAAK,gBAAgB,SACxB,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,+CAA+C,IACtF,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,qDAAqD;AAClG;AAMA,SAAS,eAAe,MAAkB,KAAkC;AAC1E,MAAI,KAAK,gBAAgB,QAAQ,CAAC,KAAK,iBAAkB,QAAO;AAChE,QAAM,KAAK,KAAK;AAChB,MAAI,CAAC,QAAQ,IAAI,GAAG,GAAG;AACrB,WAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,mCAAmC;AAAA,EACtF;AACA,SAAO,KAAK,gBAAgB,SACxB,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,wBAAwB,IAC/D;AAAA,IACE,QAAQ;AAAA,IACR,WAAW;AAAA,IACX,MAAM;AAAA,EACR;AACN;AAOA,SAAS,cAAc,MAAkB,KAAkC;AACzE,MAAI,CAAC,KAAK,iBAAkB,QAAO;AACnC,QAAM,KAAK,KAAK;AAChB,MAAI,CAAC,QAAQ,IAAI,GAAG,GAAG;AACrB,WAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,gCAAgC;AAAA,EACnF;AACA,MAAI,KAAK,cAAc,QAAQ;AAC7B,WAAO,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,iCAAiC;AAAA,EACjF;AACA,MAAI,KAAK,cAAc,QAAQ;AAC7B,WAAO,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,8BAA8B;AAAA,EAC9E;AACA,SAAO,EAAE,QAAQ,OAAO,WAAW,IAAI,MAAM,+BAA+B;AAC9E;AAMA,SAAS,qBAAqB,MAAkB,KAAkC;AAChF,MAAI,KAAK,YAAY,QAAQ,CAAC,KAAK,YAAa,QAAO;AACvD,QAAM,KAAK,KAAK;AAChB,MAAI,CAAC,QAAQ,IAAI,GAAG,GAAG;AACrB,WAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,6BAA6B;AAAA,EAChF;AACA,SAAO,KAAK,YAAY,SACpB,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,oBAAoB,IAC3D,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,kBAAkB;AAC/D;AAOA,SAAS,gBAAgB,MAAkB,KAAkC;AAC3E,MAAI,KAAK,oBAAoB,QAAQ,CAAC,KAAK,gBAAiB,QAAO;AACnE,QAAM,KAAK,KAAK;AAChB,MAAI,KAAK,oBAAoB,QAAQ;AACnC,WAAO,EAAE,QAAQ,OAAO,WAAW,IAAI,MAAM,uBAAuB;AAAA,EACtE;AACA,MAAI,CAAC,QAAQ,IAAI,GAAG,GAAG;AACrB,WAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,2BAA2B;AAAA,EAC9E;AACA,MAAI,KAAK,oBAAoB,WAAW;AACtC,WAAO,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,2CAA2C;AAAA,EAC3F;AACA,MAAI,KAAK,oBAAoB,WAAW;AACtC,WAAO,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,+BAA+B;AAAA,EAC/E;AACA,SAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,+BAA+B;AAClF;;;AC/XA,SAAS,oBAAoB;AAC7B,SAAS,WAAW;AACpB,SAAS,+BAA+B;;;ACSxC,IAAM,mBAAmB,oBAAI,IAAI,CAAC,KAAK,GAAG,CAAC;AAE3C,IAAM,kBAAkB,oBAAI,IAAI,CAAC,GAAG,EAAE,CAAC;AAIvC,IAAM,eACJ;AAeF,IAAM,gBAAgB,oBAAI,IAAI;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AACD,IAAM,gBAAgB;AAKf,SAAS,kBAAkB,GAAqB;AACrD,QAAM,MAAM;AACZ,MAAI,KAAK,0BAA0B,KAAM,QAAO;AAChD,MAAI,CAAC,KAAK,QAAQ,KAAK,UAAU,MAAM,EAAE,KAAK,CAAC,MAAM,iBAAiB,IAAI,OAAO,CAAC,CAAC,CAAC;AAClF,WAAO;AACT,MAAI,iBAAiB,IAAI,OAAO,KAAK,IAAI,CAAC,KAAK,gBAAgB,IAAI,OAAO,KAAK,IAAI,CAAC;AAClF,WAAO;AACT,QAAM,MAAM,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC;AACrD,SAAO,aAAa,KAAK,GAAG;AAC9B;AAKA,SAAS,mBAAmB,GAAqB;AAC/C,SAAQ,GAAqC,0BAA0B;AACzE;AAMO,SAAS,mBAAmB,GAAqB;AACtD,QAAM,MAAM;AACZ,MAAI,KAAK,0BAA0B,KAAM,QAAO;AAChD,QAAM,UAAU,KAAK,UAAU,MAAM,OAAO;AAC5C,MAAI,MAAM,QAAQ,OAAO,KAAK,QAAQ,SAAS,GAAG;AAChD,WAAO,QAAQ,KAAK,CAAC,MAAM,GAAG,UAAU,QAAQ,cAAc,IAAI,EAAE,OAAO,YAAY,CAAC,CAAC;AAAA,EAC3F;AACA,QAAM,MAAM,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC;AACrD,SAAO,cAAc,KAAK,GAAG;AAC/B;AASA,eAAsB,oBACpB,UACA,OACA,SACY;AACZ,MAAI,SAAS,WAAW,EAAG,OAAM,IAAI,MAAM,GAAG,KAAK,wCAAwC;AAC3F,QAAM,SAAmB,CAAC;AAM1B,MAAI;AACJ,MAAI;AAGJ,MAAI,WAAW;AACf,aAAW,WAAW,UAAU;AAC9B,QAAI;AACF,YAAM,SAAS,MAAM,QAAQ,OAAO;AACpC,UAAI,OAAO,SAAS,GAAG;AACrB,gBAAQ;AAAA,UACN,WACI,UAAK,KAAK,sBAAsB,OAAO,KAAK,IAAI,CAAC,yBAAoB,OAAO,uDAE5E,UAAK,KAAK,sBAAsB,OAAO,KAAK,IAAI,CAAC,yBAAoB,OAAO;AAAA,QAGlF;AAAA,MACF;AACA,aAAO;AAAA,IACT,SAAS,GAAG;AACV,UAAI,CAAC,kBAAkB,CAAC,EAAG,OAAM;AACjC,aAAO,KAAK,GAAG,OAAO,KAAK,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,CAAC,GAAG;AACxE,UAAI,mBAAmB,CAAC,GAAG;AACzB,uBAAe;AACf,mBAAW;AAAA,MACb,OAAO;AACL,wBAAgB;AAChB,YAAI,CAAC,mBAAmB,CAAC,EAAG,YAAW;AAAA,MACzC;AAAA,IACF;AAAA,EACF;AAIA,QAAM,iBAAiB;AACzB;;;AD9HA,IAAM,qBAAqB;AAC3B,IAAMC,cAAa;AAanB,SAAS,IAAI,GAAiB;AAC5B,SAAO,EAAE,YAAY,EAAE,MAAM,GAAG,EAAE;AACpC;AAUA,eAAsB,iBACpB,OACA,aACA,WACgD;AAChD,QAAM,MAAM,KAAK,MAAM,aAAa,MAAM,SAAS,MAAM,CAAC;AAK1D,QAAM,aAAa,KAAK,OAAO,UAAU,QAAQ,IAAI,YAAY,QAAQ,KAAKA,WAAU;AACxF,QAAM,UAAU,IAAI,KAAK,YAAY,QAAQ,IAAIA,WAAU;AAC3D,QAAM,YAAY,IAAI,KAAK,QAAQ,QAAQ,IAAI,aAAaA,WAAU;AACtE,QAAM,WAAW,cAAc,MAAM,UAAU;AAE/C,SAAO,oBAAoB,MAAM,UAAU,MAAM,OAAO,YAAY;AAClE,UAAM,aAAa,IAAI,IAAI;AAAA,MACzB,OAAO,IAAI;AAAA,MACX,KAAK,IAAI;AAAA,MACT,QAAQ,CAAC,kBAAkB;AAAA,MAC3B;AAAA,IACF,CAAC;AACD,UAAM,SAAS,IAAI,wBAAwB,EAAE,WAAW,CAAC;AAEzD,UAAM,MAAM,OAAO,OAAa,QAA+B;AAC7D,YAAM,CAAC,IAAI,IAAI,MAAM,OAAO,UAAU;AAAA,QACpC;AAAA,QACA,YAAY,CAAC,EAAE,WAAW,IAAI,KAAK,GAAG,SAAS,IAAI,GAAG,EAAE,CAAC;AAAA,QACzD,SAAS,CAAC,EAAE,MAAM,cAAc,CAAC;AAAA,MACnC,CAAC;AACD,YAAM,MAAM,KAAK,OAAO,CAAC,GAAG,eAAe,CAAC,GAAG,SAAS;AACxD,YAAM,IAAI,OAAO,SAAS,KAAK,EAAE;AACjC,aAAO,OAAO,SAAS,CAAC,IAAI,IAAI;AAAA,IAClC;AAEA,UAAM,UAAU,MAAM,IAAI,aAAa,SAAS;AAChD,UAAM,WAAW,MAAM,IAAI,WAAW,OAAO;AAC7C,WAAO,EAAE,SAAS,SAAS;AAAA,EAC7B,CAAC;AACH;;;AEtEA,SAAS,gBAAAC,qBAAoB;AAC7B,SAAS,OAAAC,YAAW;AAGpB,IAAM,sBAAsB;AAC5B,IAAM,UAAU;AAEhB,IAAM,sBAAsB;AAKrB,IAAM,wBAAwB;AAoC9B,SAAS,SAAS,GAAmB;AAC1C,SAAO,EACJ,KAAK,EACL,QAAQ,gBAAgB,EAAE,EAC1B,QAAQ,iBAAiB,EAAE,EAC3B,MAAM,GAAG,EAAE,CAAC,EACZ,QAAQ,WAAW,EAAE,EACrB,YAAY;AACjB;AASO,SAAS,0BAA0B,SAAsB,MAAwB;AACtF,QAAM,SAAS,SAAS,IAAI;AAC5B,QAAM,UAAU,QAAQ,OAAO,CAAC,MAAM,SAAS,EAAE,OAAO,MAAM,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO;AAC1F,QAAM,UAAU,QAAQ,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,WAAW,YAAY,CAAC;AAC9E,QAAM,WAAW,QAAQ,OAAO,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,WAAW,YAAY,CAAC;AAChF,SAAO,CAAC,GAAG,SAAS,GAAG,QAAQ;AACjC;AAGA,SAASC,KAAI,GAAiB;AAC5B,SAAO,EAAE,YAAY,EAAE,MAAM,GAAG,EAAE;AACpC;AAWO,SAAS,eACd,MACoB;AACpB,MAAI;AACJ,aAAW,KAAK,MAAM;AACpB,QAAI,OAAO,EAAE,aAAa,SAAU;AACpC,UAAM,cAAc,EAAE,eAAe;AACrC,QACE,SAAS,UACT,cAAc,KAAK,eAClB,gBAAgB,KAAK,eAAe,EAAE,WAAW,KAAK,UACvD;AACA,aAAO,EAAE,UAAU,EAAE,UAAU,YAAY;AAAA,IAC7C;AAAA,EACF;AACA,SAAO,MAAM;AACf;AAcO,SAAS,oBACd,MACA,YACoB;AACpB,QAAM,OAAO,WAAW,YAAY;AACpC,QAAM,QAAQ,KAAK;AAAA,IACjB,CAAC,MAAM,OAAO,EAAE,aAAa,aAAa,EAAE,OAAO,CAAC,KAAK,IAAI,YAAY,MAAM;AAAA,EACjF;AACA,MAAI,MAAO,QAAO,MAAM;AACxB,SAAO,eAAe,IAAI;AAC5B;AAOA,IAAM,4BAAN,cAAwC,MAAM;AAAA,EACnC,wBAAwB;AAAA,EACjC,YAAY,SAAiB,MAAc;AACzC,UAAM,uCAAuC,IAAI,kBAAkB,OAAO,EAAE;AAAA,EAC9E;AACF;AAcA,eAAsB,oBACpB,GACA,aACA,WACyB;AACzB,QAAM,MAAM,KAAK,MAAMC,cAAa,EAAE,SAAS,MAAM,CAAC;AAKtD,MAAI;AACF,WAAO,MAAM,oBAAoB,EAAE,UAAU,kBAAkB,OAAO,YAAY;AAChF,YAAM,MAAM,IAAIC,KAAI;AAAA,QAClB,OAAO,IAAI;AAAA,QACX,KAAK,IAAI;AAAA,QACT,QAAQ,CAAC,mBAAmB;AAAA,QAC5B;AAAA,MACF,CAAC;AAED,YAAM,WAAW,EAAE,UAAU,KAAK;AAClC,UAAI;AACJ,UAAI,UAAU;AACZ,qBAAa,CAAC,QAAQ;AAAA,MACxB,OAAO;AACL,cAAM,OAAO,MAAM,IAAI,QAAqC;AAAA,UAC1D,KAAK,GAAG,OAAO;AAAA,UACf,QAAQ;AAAA,QACV,CAAC;AACD,qBAAa,0BAA0B,KAAK,KAAK,aAAa,CAAC,GAAG,EAAE,IAAI;AACxE,YAAI,WAAW,WAAW,EAAG,OAAM,IAAI,0BAA0B,SAAS,EAAE,IAAI;AAAA,MAClF;AAEA,iBAAW,YAAY,YAAY;AACjC,cAAM,MAAM,MAAM,IAAI,QAEnB;AAAA,UACD,KAAK,GAAG,OAAO,UAAU,mBAAmB,QAAQ,CAAC;AAAA,UACrD,QAAQ;AAAA,UACR,MAAM;AAAA,YACJ,WAAWF,KAAI,WAAW;AAAA,YAC1B,SAASA,KAAI,SAAS;AAAA,YACtB,YAAY,CAAC,OAAO;AAAA,YACpB,uBAAuB;AAAA,cACrB;AAAA,gBACE,SAAS;AAAA,kBACP,EAAE,WAAW,SAAS,UAAU,YAAY,YAAY,EAAE,MAAM,YAAY,EAAE;AAAA,gBAChF;AAAA,cACF;AAAA,YACF;AAAA,YACA,UAAU;AAAA,UACZ;AAAA,QACF,CAAC;AACD,cAAM,MAAM,oBAAoB,IAAI,KAAK,QAAQ,CAAC,GAAG,EAAE,MAAM,YAAY,CAAC;AAC1E,YAAI,OAAO,QAAQ,UAAU;AAG3B,iBAAO;AAAA,YACL,cAAc,OAAO;AAAA,YACrB,UAAU,KAAK,IAAI,GAAG,KAAK,MAAM,GAAG,CAAC;AAAA,YACrC,eAAe;AAAA,UACjB;AAAA,QACF;AAAA,MACF;AAEA,aAAO,EAAE,cAAc,OAAO,UAAU,MAAM,eAAe,KAAK;AAAA,IACpE,CAAC;AAAA,EACH,SAAS,GAAG;AAKV,QAAI,aAAa;AACf,aAAO,EAAE,cAAc,OAAO,UAAU,MAAM,eAAe,MAAM;AACrE,UAAM;AAAA,EACR;AACF;;;AJ3LA,eAAsB,mBACpB,MACA,OAA0B,CAAC,GACT;AAClB,MAAI,CAAC,KAAK,IAAK,QAAO;AACtB,QAAM,WAAW,KAAK,YAAY;AAClC,QAAM,SAAS,KAAK,UAAU;AAC9B,MAAI;AACF,UAAM,MAAM,MAAM,SAAS,EAAE,KAAK,KAAK,KAAK,MAAM,SAAS,KAAK,IAAI,EAAE,CAAC;AACvE,UAAM,OAAO,KAAK,IAAI,gBAAgB,IAAI,OAAO,IAAI,UAAU,IAAI,WAAW;AAC9E,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,YAAQ;AAAA,MACN,2CAAsC,KAAK,IAAI,KAC7C,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CACjD;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;AAuEA,SAAS,kBAAkB,SAAuC;AAChE,QAAM,EAAE,QAAQ,QAAQ,SAAS,SAAS,IAAI;AAC9C,MAAI,WAAW,QAAQ,WAAW,QAAQ,YAAY,QAAQ,aAAa,MAAM;AAC/E,UAAM,IAAI;AAAA,MACR,SAAS,QAAQ,IAAI;AAAA,IAEvB;AAAA,EACF;AACA,SAAO,EAAE,aAAa,QAAQ,eAAe,QAAQ,eAAe,SAAS,KAAK,SAAS;AAC7F;AAEA,SAAS,QAAQ,OAAa,GAAiB;AAK7C,QAAM,MAAM,IAAI,KAAK,KAAK;AAC1B,MAAI,WAAW,IAAI,WAAW,IAAI,CAAC;AACnC,SAAO;AACT;AAYA,eAAsB,mBACpB,MACA,SACA,YACA,UAAwB,CAAC,GACH;AACtB,QAAM,SAAS,kBAAkB,OAAO;AAExC,QAAM,QAAQ,oBAAI,KAAK;AACvB,QAAM,OAAO,SAAS,QAAQ,IAAI;AAElC,QAAM,cACJ,SAAS,OAAO,MAAM,kBAAkB,MAAM,SAAS,YAAY,KAAK,IAAI,QAAQ,OAAO,EAAE;AAE/F,QAAM,YAAY;AAClB,QAAM,cAAc;AAMpB,QAAM,iBACJ,eAAe,iBAAiB,QAAQ,wBACpC,IAAI,KAAK,QAAQ,qBAAqB,IACtC;AASN,QAAM,eAAe,QAAQ,UAAU,SAAS;AAChD,QAAM,WAAW,eACb,MAAM,aAAa,SAAS,aAAa,SAAS,IAClD;AACJ,QAAM,eAAe,eACjB,MAAM,YAAY,SAAS,aAAa,SAAS;AAAA;AAAA;AAAA,IAGjD;AAAA,MACE,GAAG;AAAA,MACH,oBAAoB;AAAA,MACpB,iBAAiB;AAAA,MACjB,eAAe;AAAA,IACjB;AAAA;AACJ,QAAM,UAAU,SAAS;AACzB,QAAM,SAAS,aAAa;AAC5B,QAAM,eAA8B;AAAA,IAClC,GAAI,SAAS,aAAc,CAAC,IAAI,IAAc,CAAC;AAAA,IAC/C,GAAI,aAAa,aAAc,CAAC,QAAQ,IAAc,CAAC;AAAA,EACzD;AAWA,MAAI,SAAS,QAAQ,QAAQ,kBAAkB,OAAO;AACpD,UAAM,mBAAmB,SAAS,QAAQ,iBAAiB,CAAC,CAAC;AAAA,EAC/D;AAEA,QAAM,UAAU,GAAG,IAAI;AACvB,QAAM,EAAE,KAAK,IAAI,MAAM,iBAAiB;AAAA,IACtC,UAAU,QAAQ;AAAA,IAClB,SAAS,QAAQ;AAAA,IACjB;AAAA,IACA;AAAA,IACA,YAAY;AAAA,IACZ,gBAAgB,SAAS;AAAA,IACzB,iBAAiB,SAAS;AAAA,IAC1B,gBAAgB,QAAQ,eAAgB,OAAO,YAAY,SAAa;AAAA,IACxE;AAAA,IACA,YAAY;AAAA,IACZ,MAAM,YAAY,OAAO;AAAA,IACzB,gBAAgB;AAAA,EAClB,CAAC;AAED,MAAI,QAAQ,aAAa;AACvB,UAAM,OAAO,QAAQ,eAAe,WAAW,IAAI;AACnD,UAAM,MAAMG,SAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AAC9C,UAAM,UAAU,MAAM,MAAM,OAAO;AACnC,WAAO;AAAA,MACL,WAAW;AAAA,MACX,UAAU;AAAA,MACV;AAAA,MACA;AAAA,MACA,qBAAqB,aAAa;AAAA,MAClC,uBAAuB,aAAa;AAAA,MACpC,QAAQ;AAAA,MACR,eAAe,CAAC;AAAA,IAClB;AAAA,EACF;AAEA,MAAI,SAAS,KAAM,OAAM,IAAI,MAAM,sCAAsC;AAOzE,MAAI,aAAa,MAAM,QAAQ,QAAQ,QAAQ,iBAAiB,QAAQ,WAAW,GAAG;AACpF,QAAI;AACF,YAAM;AAAA,QACJ;AAAA,QACA,QAAQ;AAAA,QACR,aAAa,SAAS,IAAI,MAAM,YAAY,IAAI;AAAA,MAClD;AAAA,IACF,SAAS,GAAG;AACV,cAAQ,KAAK,6CAAwC,QAAQ,IAAI,KAAM,EAAY,OAAO,EAAE;AAAA,IAC9F;AAAA,EACF;AASA,MAAI,QAAQ,eAAe;AACzB,UAAM,gBAAgB,QAAQ,eAAe,MAAM,WAAW,IAAI;AAClE,UAAMC,WAAU,MAAM,WAAW,MAAM;AAAA,MACrC,IAAI,QAAQ;AAAA,MACZ,QAAQ,QAAQ;AAAA,MAChB;AAAA,IACF,CAAC;AACD,WAAO;AAAA,MACL,WAAW,QAAQ,eAAe;AAAA,MAClC,UAAU;AAAA,MACV;AAAA,MACA;AAAA,MACA,qBAAqB,aAAa;AAAA,MAClC,uBAAuB,aAAa;AAAA,MACpC,QAAQA,SAAQ;AAAA,MAChB,eAAeA,SAAQ;AAAA,IACzB;AAAA,EACF;AAMA,QAAM,WAAW,kBAAkB,SAAS,YAAY,aAAa,EAAE,QAAQ,aAAa,CAAC;AAC7F,QAAM,iBAAiB,CAAC,GAAG,SAAS,QAAQ,CAAC,EAC1C,OAAO,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,MAAM,EACrC,IAAI,CAAC,CAAC,KAAK,MAAM,KAAK;AACzB,QAAM,eAAe,OAAO,YAAY,QAAQ;AAEhD,QAAM,WAAW,GAAG,QAAQ,IAAI,WAAM,UAAU,WAAM,UAAU,YAAY,EAAE,MAAM,GAAG,EAAE,CAAC;AAC1F,QAAM,UAAU,MAAM,YAAY,MAAM;AAAA,IACtC;AAAA,IACA,QAAQ,QAAQ;AAAA,IAChB;AAAA,IACA,QAAQ,QAAQ,UAAU,UAAU,YAAY,EAAE,MAAM,GAAG,CAAC;AAAA,IAC5D;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY;AAAA,IACZ;AAAA,IACA,GAAI,UAAU,EAAE,gBAAgB,QAAQ,SAAS,iBAAiB,QAAQ,SAAS,IAAI,CAAC;AAAA,IACxF,GAAI,SAAS,EAAE,kBAAkB,OAAO,aAAa,IAAI,CAAC;AAAA,IAC1D,GAAI,QAAQ,gBAAgB,OAAO,aAAa,OAC5C,EAAE,gBAAgB,OAAO,SAAS,IAClC,CAAC;AAAA,IACL;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,gBAAgB,QAAQ,IAAI,MAAM,WAAW,IAAI;AACvD,QAAM,UAAU,MAAM,WAAW,MAAM;AAAA,IACrC,IAAI,QAAQ;AAAA,IACZ,QAAQ,QAAQ;AAAA,IAChB;AAAA,EACF,CAAC;AAED,SAAO;AAAA,IACL,WAAW;AAAA,IACX,UAAU;AAAA,IACV;AAAA,IACA;AAAA,IACA,qBAAqB,aAAa;AAAA,IAClC,uBAAuB,aAAa;AAAA,IACpC,QAAQ,QAAQ;AAAA,IAChB,eAAe,QAAQ;AAAA,EACzB;AACF;AAKA,eAAe,gBACb,OACA,MACA,WACA,MACe;AACf,QAAM,eAAe,GAAG,IAAI,IAAI,UAAU,YAAY,EAAE,MAAM,GAAG,EAAE,CAAC;AACpE,QAAM,iBAAiB,OAAO,iBAAiB,MAAM,cAAc,WAAW;AAChF;AAMA,IAAM,gBAAmC,EAAE,OAAO,MAAM,YAAY,MAAM;AAS1E,eAAsB,aACpB,SACA,aACA,WAC4D;AAC5D,QAAM,MAAM,aAAa;AACzB,MAAI,CAAC,OAAO,CAAC,QAAQ,cAAe,QAAO;AAC3C,MAAI;AACF,UAAM,QAAQ,MAAM;AAAA,MAClB,EAAE,YAAY,QAAQ,eAAe,UAAU,IAAI,UAAU,SAAS,IAAI,QAAQ;AAAA,MAClF;AAAA,MACA;AAAA,IACF;AACA,WAAO,EAAE,OAAO,YAAY,MAAM;AAAA,EACpC,SAAS,GAAG;AACV,YAAQ,KAAK,yBAAoB,QAAQ,IAAI,KAAM,EAAY,OAAO,EAAE;AACxE,WAAO,EAAE,OAAO,MAAM,YAAY,KAAK;AAAA,EACzC;AACF;AA6CA,eAAsB,YACpB,SACA,aACA,WAC2B;AAC3B,QAAM,MAAM,aAAa;AACzB,QAAM,WAAW,QAAQ,QAAQ,iBAAiB,QAAQ,WAAW;AACrE,MAAI,CAAC,OAAO,CAAC,UAAU;AACrB,UAAM,gBAAgB,YAAY,CAAC;AACnC,QAAI,eAAe;AACjB,cAAQ;AAAA,QACN,4IAAkI,QAAQ,IAAI;AAAA,MAChJ;AAAA,IACF;AACA,WAAO,EAAE,GAAG,eAAe,oBAAoB,OAAO,iBAAiB,OAAO,cAAc;AAAA,EAC9F;AACA,QAAM,WAAW,QAAQ,aAAa,KAAK;AAC3C,QAAM,QAAQ,YAAY,QAAQ;AAClC,QAAM,cAAc,CAAC;AACrB,MAAI;AACF,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,QACE,SAAS,IAAI;AAAA,QACb,UAAU,IAAI;AAAA,QACd,UAAU,QAAQ,yBAAyB;AAAA,QAC3C,MAAM,QAAQ;AAAA,QACd;AAAA,MACF;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,UAAM,kBAAkB,CAAC,MAAM;AAC/B,QAAI,iBAAiB;AACnB,cAAQ;AAAA,QACN,qDAAgD,QAAQ,GAAG,QAAQ,QAAQ,IAAI;AAAA,MACjF;AAAA,IACF;AACA,UAAM,qBAAqB,MAAM,iBAAiB,eAAe,MAAM,aAAa;AACpF,QAAI,oBAAoB;AACtB,cAAQ;AAAA,QACN,qCAAgC,KAAK,sCAAsC,QAAQ,IAAI;AAAA,MACzF;AAAA,IACF;AACA,WAAO,EAAE,OAAO,YAAY,OAAO,oBAAoB,iBAAiB,eAAe,MAAM;AAAA,EAC/F,SAAS,GAAG;AACV,YAAQ,KAAK,sCAAiC,QAAQ,IAAI,KAAM,EAAY,OAAO,EAAE;AACrF,WAAO;AAAA,MACL,OAAO;AAAA,MACP,YAAY;AAAA,MACZ,oBAAoB;AAAA,MACpB,iBAAiB;AAAA,MACjB,eAAe;AAAA,IACjB;AAAA,EACF;AACF;AAEA,eAAe,kBACb,MACA,SACA,YACA,OACe;AACf,QAAM,QAAQ,MAAM,mBAAmB,MAAM,QAAQ,EAAE;AACvD,QAAM,WAAW,MACd,OAAO,CAAC,MAAM,EAAE,eAAe,cAAc,EAAE,SAAS,EACxD,IAAI,CAAC,MAAM,EAAE,SAAU,EACvB,KAAK;AACR,QAAM,SAAS,SAAS,SAAS,SAAS,CAAC;AAC3C,MAAI,CAAC,OAAQ,QAAO,QAAQ,OAAO,EAAE;AAKrC,QAAM,QAAQ,IAAI,KAAK,MAAM;AAC7B,QAAM,WAAW,MAAM,WAAW,IAAI,CAAC;AACvC,SAAO;AACT;","names":["dirname","pos","MS_PER_DAY","readFileSync","JWT","ymd","readFileSync","JWT","dirname","outcome"]}

package/dist/chunk-MPBXOJ3N.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/reports/airtable/attachments.ts"],"sourcesContent":["/** Cheap HTML sniff: an Airtable signed-URL \"200\" that is really a login/error page\n *  starts with `<!doctype html`, `<html`, or `<head` after an optional UTF-8 BOM /\n *  leading whitespace. We only need to catch the common error-page case, not parse\n *  HTML. */\nfunction looksLikeHtml(bytes: Uint8Array): boolean {\n  // Inspect the first ~64 bytes as ASCII (1 byte → 1 char; enough for a doctype /\n  // opening tag). Skip a leading UTF-8 BOM (bytes EF BB BF) by index, then strip any\n  // leading ASCII whitespace, and match the common HTML openers case-insensitively.\n  const start = bytes[0] === 0xef && bytes[1] === 0xbb && bytes[2] === 0xbf ? 3 : 0;\n  const head = Buffer.from(bytes.slice(start, start + 64))\n    .toString(\"ascii\")\n    .replace(/^[\\s]+/, \"\")\n    .toLowerCase();\n  return head.startsWith(\"<!doctype html\") || head.startsWith(\"<html\") || head.startsWith(\"<head\");\n}\n\nexport async function fetchAttachmentBytes(\n  url: string,\n): Promise<{ bytes: Uint8Array; contentType: string }> {\n  const res = await fetch(url);\n  if (!res.ok) {\n    throw new Error(\n      `Failed to fetch Airtable attachment ${res.status} ${res.statusText} (url=${url})`,\n    );\n  }\n  const contentType = res.headers.get(\"content-type\") ?? \"application/octet-stream\";\n  const ab = await res.arrayBuffer();\n  const bytes = new Uint8Array(ab);\n  // Sanity-gate the body: a 200 that is actually an HTML error/login page (expired\n  // signed URL, auth wall) would otherwise be attached as the \"image\" and ship a\n  // broken header. Accept an explicit image/* content-type; otherwise reject anything\n  // that sniffs as HTML — so the send fails loudly rather than emailing a broken image.\n  const isImageType = contentType.toLowerCase().startsWith(\"image/\");\n  if (!isImageType && looksLikeHtml(bytes)) {\n    throw new Error(\n      `Airtable attachment did not return image data (content-type=\"${contentType}\", ` +\n        `body looks like an HTML page — the signed URL may have expired) (url=${url})`,\n    );\n  }\n  return { bytes, contentType };\n}\n\n/**\n * Upload bytes (or a string) as an attachment to a specific record + field.\n * Uses Airtable's content.airtable.com upload endpoint (base64 body) because\n * the standard SDK only accepts public URLs for attachments, and we don't\n * host the generated content anywhere public.\n *\n * Docs: https://airtable.com/developers/web/api/upload-attachment\n *\n * Requires AIRTABLE_PAT + AIRTABLE_BASE_ID in env (same as the rest of the\n * reports module). The fieldName is URL-encoded for the request path.\n */\nexport async function uploadAttachment(\n  recordId: string,\n  fieldName: string,\n  body: Uint8Array | string,\n  filename: string,\n  contentType: string,\n): Promise<void> {\n  const apiKey = process.env.AIRTABLE_PAT;\n  const baseId = process.env.AIRTABLE_BASE_ID;\n  if (!apiKey || !baseId) {\n    throw new Error(\"AIRTABLE_PAT and AIRTABLE_BASE_ID must be set\");\n  }\n  const base64 =\n    typeof body === \"string\"\n      ? Buffer.from(body, \"utf-8\").toString(\"base64\")\n      : Buffer.from(body).toString(\"base64\");\n  const payload = { contentType, file: base64, filename };\n  const url = `https://content.airtable.com/v0/${baseId}/${recordId}/${encodeURIComponent(fieldName)}/uploadAttachment`;\n  const res = await fetch(url, {\n    method: \"POST\",\n    headers: {\n      Authorization: `Bearer ${apiKey}`,\n      \"Content-Type\": \"application/json\",\n    },\n    body: JSON.stringify(payload),\n  });\n  if (!res.ok) {\n    throw new Error(`Airtable upload failed: ${res.status} ${res.statusText} ${await res.text()}`);\n  }\n}\n"],"mappings":";AAIA,SAAS,cAAc,OAA4B;AAIjD,QAAM,QAAQ,MAAM,CAAC,MAAM,OAAQ,MAAM,CAAC,MAAM,OAAQ,MAAM,CAAC,MAAM,MAAO,IAAI;AAChF,QAAM,OAAO,OAAO,KAAK,MAAM,MAAM,OAAO,QAAQ,EAAE,CAAC,EACpD,SAAS,OAAO,EAChB,QAAQ,UAAU,EAAE,EACpB,YAAY;AACf,SAAO,KAAK,WAAW,gBAAgB,KAAK,KAAK,WAAW,OAAO,KAAK,KAAK,WAAW,OAAO;AACjG;AAEA,eAAsB,qBACpB,KACqD;AACrD,QAAM,MAAM,MAAM,MAAM,GAAG;AAC3B,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,IAAI;AAAA,MACR,uCAAuC,IAAI,MAAM,IAAI,IAAI,UAAU,SAAS,GAAG;AAAA,IACjF;AAAA,EACF;AACA,QAAM,cAAc,IAAI,QAAQ,IAAI,cAAc,KAAK;AACvD,QAAM,KAAK,MAAM,IAAI,YAAY;AACjC,QAAM,QAAQ,IAAI,WAAW,EAAE;AAK/B,QAAM,cAAc,YAAY,YAAY,EAAE,WAAW,QAAQ;AACjE,MAAI,CAAC,eAAe,cAAc,KAAK,GAAG;AACxC,UAAM,IAAI;AAAA,MACR,gEAAgE,WAAW,gFACD,GAAG;AAAA,IAC/E;AAAA,EACF;AACA,SAAO,EAAE,OAAO,YAAY;AAC9B;AAaA,eAAsB,iBACpB,UACA,WACA,MACA,UACA,aACe;AACf,QAAM,SAAS,QAAQ,IAAI;AAC3B,QAAM,SAAS,QAAQ,IAAI;AAC3B,MAAI,CAAC,UAAU,CAAC,QAAQ;AACtB,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AACA,QAAM,SACJ,OAAO,SAAS,WACZ,OAAO,KAAK,MAAM,OAAO,EAAE,SAAS,QAAQ,IAC5C,OAAO,KAAK,IAAI,EAAE,SAAS,QAAQ;AACzC,QAAM,UAAU,EAAE,aAAa,MAAM,QAAQ,SAAS;AACtD,QAAM,MAAM,mCAAmC,MAAM,IAAI,QAAQ,IAAI,mBAAmB,SAAS,CAAC;AAClG,QAAM,MAAM,MAAM,MAAM,KAAK;AAAA,IAC3B,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,eAAe,UAAU,MAAM;AAAA,MAC/B,gBAAgB;AAAA,IAClB;AAAA,IACA,MAAM,KAAK,UAAU,OAAO;AAAA,EAC9B,CAAC;AACD,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,IAAI,MAAM,2BAA2B,IAAI,MAAM,IAAI,IAAI,UAAU,IAAI,MAAM,IAAI,KAAK,CAAC,EAAE;AAAA,EAC/F;AACF;","names":[]}

package/dist/chunk-NWB4O5EY.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/inventory/airtable.ts"],"sourcesContent":["import type { Site, InventoryProvider } from \"../types.js\";\nimport type { AirtableBase } from \"../reports/airtable/client.js\";\nimport {\n  listWebsites,\n  siteSlug,\n  ACTIVE_STATUSES,\n  isPreLaunch,\n} from \"../reports/airtable/websites.js\";\nimport { isHttpUrl } from \"../util/url.js\";\n\nexport type AirtableInventoryOptions = {\n  /**\n   * Local workdir to compute each site's path as `{workdir}/{slug}`.\n   * Defaults to REDDOOR_FLEET_WORKDIR env var if not provided.\n   * Airtable doesn't store local checkout paths, so this is required.\n   */\n  workdir?: string;\n};\n\n/**\n * Read sites from the Airtable Websites table as an InventoryProvider.\n * Each row becomes one Site; `path` is computed as `{workdir}/{slug}`.\n * Only LIVE `maintenance` sites that have a `url` are included — pre-launch\n * stages (\"launch period\" / \"in development\", via isPreLaunch) are excluded so a\n * not-yet-live site is never audited as production (its deploy/domain/uptime/CMS\n * audits would fail against nothing and red its Airtable row) nor swept by other\n * `--fleet airtable` ops; it re-enters the fleet when a Launch report flips its\n * Status to \"maintenance\". The production URL is exposed as `Site.deployedUrl` so\n * the lighthouse audit can run against it with no checkout. `repoUrl` is\n * intentionally NOT set from `url` — a clone source must come from `gitRepo`\n * (`owner/repo`), never the production URL.\n */\nexport function fromAirtableBase(\n  base: AirtableBase,\n  opts: AirtableInventoryOptions = {},\n): InventoryProvider {\n  return async (): Promise<Site[]> => {\n    const workdir = opts.workdir ?? process.env.REDDOOR_FLEET_WORKDIR;\n    if (!workdir) {\n      throw new Error(\n        \"fromAirtableBase requires `workdir` option or REDDOOR_FLEET_WORKDIR env (sites need a local path)\",\n      );\n    }\n    const websites = await listWebsites(base);\n    return websites\n      .filter(\n        (w) =>\n          w.status !== null &&\n          ACTIVE_STATUSES.has(w.status) &&\n          !isPreLaunch(w.status) &&\n          w.url.length > 0,\n      )\n      .flatMap((w) => {\n        const slug = siteSlug(w.name);\n        // An empty slug (a Name with no slug-able characters) can't form a stable\n        // path and — fatally — can't be matched back to its Websites row on\n        // write-back: every empty-slug site would collapse under the \"\" key and\n        // mis-write or fail. Skip it loudly rather than silently mis-map it.\n        if (slug.length === 0) {\n          console.warn(\n            `[inventory] skipping \"${w.name}\" (row ${w.id}): Name has no slug-able characters (empty slug)`,\n          );\n          return [];\n        }\n        const site: Site = {\n          path: `${workdir}/${slug}`,\n          name: slug,\n          meta: { airtableRowId: w.id, displayName: w.name },\n        };\n        // Scheme-allowlist the Airtable `url` before exposing it as the\n        // deployed-audit target (it's handed straight to Chrome/lhci). A\n        // `file://`/`gopher://`/internal-host value would be a local-file read\n        // or SSRF — skip the deployed audit for that site rather than trust it.\n        if (isHttpUrl(w.url)) {\n          site.deployedUrl = w.url;\n        } else {\n          console.warn(\n            `[inventory] skipping deployed audit for \"${w.name}\": url is not http(s): ${JSON.stringify(w.url)}`,\n          );\n        }\n        if (w.gitRepo) site.gitRepo = w.gitRepo;\n        // Expose the Netlify site id (operator-set identity column) so the\n        // netlify-deploy audit can query the API with no checkout. Absent → that\n        // audit skips for this site. Not derived from the URL.\n        if (w.netlifyId) site.netlifyId = w.netlifyId;\n        return [site];\n      });\n  };\n}\n"],"mappings":";;;;;;;;;;;AAgCO,SAAS,iBACd,MACA,OAAiC,CAAC,GACf;AACnB,SAAO,YAA6B;AAClC,UAAM,UAAU,KAAK,WAAW,QAAQ,IAAI;AAC5C,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,WAAW,MAAM,aAAa,IAAI;AACxC,WAAO,SACJ;AAAA,MACC,CAAC,MACC,EAAE,WAAW,QACb,gBAAgB,IAAI,EAAE,MAAM,KAC5B,CAAC,YAAY,EAAE,MAAM,KACrB,EAAE,IAAI,SAAS;AAAA,IACnB,EACC,QAAQ,CAAC,MAAM;AACd,YAAM,OAAO,SAAS,EAAE,IAAI;AAK5B,UAAI,KAAK,WAAW,GAAG;AACrB,gBAAQ;AAAA,UACN,yBAAyB,EAAE,IAAI,UAAU,EAAE,EAAE;AAAA,QAC/C;AACA,eAAO,CAAC;AAAA,MACV;AACA,YAAM,OAAa;AAAA,QACjB,MAAM,GAAG,OAAO,IAAI,IAAI;AAAA,QACxB,MAAM;AAAA,QACN,MAAM,EAAE,eAAe,EAAE,IAAI,aAAa,EAAE,KAAK;AAAA,MACnD;AAKA,UAAI,UAAU,EAAE,GAAG,GAAG;AACpB,aAAK,cAAc,EAAE;AAAA,MACvB,OAAO;AACL,gBAAQ;AAAA,UACN,4CAA4C,EAAE,IAAI,0BAA0B,KAAK,UAAU,EAAE,GAAG,CAAC;AAAA,QACnG;AAAA,MACF;AACA,UAAI,EAAE,QAAS,MAAK,UAAU,EAAE;AAIhC,UAAI,EAAE,UAAW,MAAK,YAAY,EAAE;AACpC,aAAO,CAAC,IAAI;AAAA,IACd,CAAC;AAAA,EACL;AACF;","names":[]}

package/dist/chunk-SEEA6RXF.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/util/html.ts"],"sourcesContent":["/**\n * Shared HTML/XML escape. One implementation behind the dashboard renderers\n * (`src/dashboard/render.ts`, `fleet-render.ts`), the daily digest\n * (`src/reports/digest.ts`), and the MJML email templates\n * (`src/reports/*-email/template.ts`).\n *\n * The set is the strict-XML set (`& < > \" '`), which is exactly what MJML's\n * `validationLevel: \"strict\"` parser needs and a superset of what plain HTML text\n * interpolation needs — so the SAME function serves both sinks. Site names\n * (e.g. \"Brown & Co\"), URLs, and operator commentary must not break the markup or\n * inject. The MJML templates re-export this as `escapeXml` for their callers.\n */\nexport function escapeHtml(s: string): string {\n  return s\n    .replace(/&/g, \"&amp;\")\n    .replace(/</g, \"&lt;\")\n    .replace(/>/g, \"&gt;\")\n    .replace(/\"/g, \"&quot;\")\n    .replace(/'/g, \"&#39;\");\n}\n\n/** Allow only http(s) URLs in an href context; everything else collapses to \"#\". */\nexport function safeUrl(raw: string): string {\n  try {\n    const u = new URL(raw);\n    if (u.protocol === \"http:\" || u.protocol === \"https:\") return raw;\n  } catch {\n    // fall through\n  }\n  return \"#\";\n}\n"],"mappings":";AAYO,SAAS,WAAW,GAAmB;AAC5C,SAAO,EACJ,QAAQ,MAAM,OAAO,EACrB,QAAQ,MAAM,MAAM,EACpB,QAAQ,MAAM,MAAM,EACpB,QAAQ,MAAM,QAAQ,EACtB,QAAQ,MAAM,OAAO;AAC1B;AAGO,SAAS,QAAQ,KAAqB;AAC3C,MAAI;AACF,UAAM,IAAI,IAAI,IAAI,GAAG;AACrB,QAAI,EAAE,aAAa,WAAW,EAAE,aAAa,SAAU,QAAO;AAAA,EAChE,QAAQ;AAAA,EAER;AACA,SAAO;AACT;","names":[]}

package/dist/chunk-U5SZ4FOP.js

@@ -1,26 +0,0 @@
-// src/util/url.ts
-function isHttpUrl(s) {
-  let parsed;
-  try {
-    parsed = new URL(s);
-  } catch {
-    return false;
-  }
-  return parsed.protocol === "http:" || parsed.protocol === "https:";
-}
-function isNetlifyAppUrl(s) {
-  let parsed;
-  try {
-    parsed = new URL(s);
-  } catch {
-    return false;
-  }
-  const host = parsed.hostname.toLowerCase();
-  return host === "netlify.app" || host.endsWith(".netlify.app");
-}
-
-export {
-  isHttpUrl,
-  isNetlifyAppUrl
-};
-//# sourceMappingURL=chunk-U5SZ4FOP.js.map

package/dist/chunk-U5SZ4FOP.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/util/url.ts"],"sourcesContent":["/**\n * True when `s` parses as an absolute URL whose scheme is `http:` or `https:`.\n *\n * The single allowlist gate for any value we hand to Chrome/Lighthouse. A\n * deployed-audit URL flows in from Airtable's `url` column (or a JSON\n * inventory's `deployedUrl`), so a `file://`/`gopher://`/`data:` value — or a\n * value pointing at an internal host — would otherwise become a local-file read\n * or SSRF when lhci drives a headless browser at it. Restricting to http(s)\n * keeps the audit to the real, network-reachable site.\n */\nexport function isHttpUrl(s: string): boolean {\n  let parsed: URL;\n  try {\n    parsed = new URL(s);\n  } catch {\n    return false;\n  }\n  return parsed.protocol === \"http:\" || parsed.protocol === \"https:\";\n}\n\n/**\n * True when `s` is a URL served from Netlify's default `*.netlify.app` host —\n * i.e. the site has no custom domain. Matches the apex `netlify.app` and any\n * subdomain of it (including deploy-preview hosts like `branch--site.netlify.app`),\n * but is not fooled by a look-alike such as `foo.netlify.app.evil.com` (the host\n * must END at `.netlify.app`). An unparseable/empty value is not a match.\n */\nexport function isNetlifyAppUrl(s: string): boolean {\n  let parsed: URL;\n  try {\n    parsed = new URL(s);\n  } catch {\n    return false;\n  }\n  const host = parsed.hostname.toLowerCase();\n  return host === \"netlify.app\" || host.endsWith(\".netlify.app\");\n}\n\n/**\n * True when `s` is an `https:` URL whose host is NOT an obviously-internal target\n * (loopback / private / link-local / unique-local / CGNAT). The newsletter\n * webhook URL is operator-set in Airtable but fires server-side, so this blocks\n * the SSRF vector of pointing it at `127.0.0.1` / `10.x` / `169.254.x` / `::1`.\n *\n * Best-effort by host literal — it does NOT resolve DNS, so a hostname that\n * resolves to a private IP is not caught. Defense-in-depth, not a complete SSRF\n * guard (the response is never returned to the caller either, so it's a log\n * oracle at most).\n */\nexport function isPublicHttpsUrl(s: string): boolean {\n  let parsed: URL;\n  try {\n    parsed = new URL(s);\n  } catch {\n    return false;\n  }\n  if (parsed.protocol !== \"https:\") return false;\n  let host = parsed.hostname.toLowerCase();\n  if (host === \"localhost\" || host.endsWith(\".localhost\")) return false;\n  // Strip IPv6 brackets (`[::1]` → `::1`).\n  if (host.startsWith(\"[\") && host.endsWith(\"]\")) host = host.slice(1, -1);\n  if (host.includes(\":\")) {\n    // IPv6 literal: block loopback (::1), unspecified (::), link-local (fe80::/10),\n    // and unique-local (fc00::/7).\n    if (host === \"::1\" || host === \"::\") return false;\n    if (/^fe[89ab]/.test(host)) return false;\n    if (/^f[cd]/.test(host)) return false;\n    // IPv4-mapped (`::ffff:a.b.c.d`, normalized by URL to `::ffff:aabb:ccdd`) and\n    // NAT64 (`64:ff9b::/96`) embed a v4 address the dotted-quad block below never\n    // sees — refuse both wholesale (no legitimate webhook target uses these forms).\n    if (host.startsWith(\"::ffff:\") || host.startsWith(\"64:ff9b:\")) return false;\n    return true;\n  }\n  // IPv4 dotted-quad: block the private/loopback/link-local/CGNAT ranges.\n  if (/^\\d{1,3}(\\.\\d{1,3}){3}$/.test(host)) {\n    const [a, b] = host.split(\".\").map(Number);\n    if (a === 0 || a === 10 || a === 127) return false;\n    if (a === 169 && b === 254) return false; // link-local\n    if (a === 172 && b !== undefined && b >= 16 && b <= 31) return false; // 172.16/12\n    if (a === 192 && b === 168) return false; // 192.168/16\n    if (a === 100 && b !== undefined && b >= 64 && b <= 127) return false; // CGNAT 100.64/10\n    return true;\n  }\n  // A registered hostname (not a literal IP) — accept; DNS isn't resolved here.\n  return true;\n}\n"],"mappings":";AAUO,SAAS,UAAU,GAAoB;AAC5C,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,CAAC;AAAA,EACpB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAO,OAAO,aAAa,WAAW,OAAO,aAAa;AAC5D;AASO,SAAS,gBAAgB,GAAoB;AAClD,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,CAAC;AAAA,EACpB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,OAAO,OAAO,SAAS,YAAY;AACzC,SAAO,SAAS,iBAAiB,KAAK,SAAS,cAAc;AAC/D;","names":[]}

package/dist/client-X5WUJWDE.js

@@ -1,11 +0,0 @@
-import {
-  openDb,
-  readDbConfig
-} from "./chunk-DC5H7KEQ.js";
-import "./chunk-4SOCPK7A.js";
-import "./chunk-6VAL7XJT.js";
-export {
-  openDb,
-  readDbConfig
-};
-//# sourceMappingURL=client-X5WUJWDE.js.map

package/dist/db-JSIZYT23.js

@@ -1,23 +0,0 @@
-// src/cli/commands/db.ts
-async function runDbCommand(action, opts) {
-  if (action === "migrate") {
-    const { readDbConfig } = await import("./client-X5WUJWDE.js");
-    const cfg = opts.url ? { url: opts.url } : readDbConfig();
-    const { runMigrations } = await import("./migrate-LJUFGXQZ.js");
-    const { createClient } = await import("@libsql/client");
-    const client = createClient(cfg.url === ":memory:" ? { url: ":memory:" } : cfg);
-    const ran = await runMigrations(client);
-    return {
-      output: ran.length ? `Applied migrations: ${ran.join(", ")}` : "Already up to date.",
-      code: 0
-    };
-  }
-  return {
-    output: `unknown db action '${action}'. Use: migrate.`,
-    code: 1
-  };
-}
-export {
-  runDbCommand
-};
-//# sourceMappingURL=db-JSIZYT23.js.map

package/dist/db-JSIZYT23.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/cli/commands/db.ts"],"sourcesContent":["export type DbCommandOptions = {\n  /** Override the libSQL url (tests use \":memory:\"); otherwise read from env. */\n  url?: string;\n  cwd?: string;\n  verbose?: boolean;\n};\n\n/** `db <action>` — migrate. The db layer is imported dynamically so a non-db\n *  CLI invocation (and `--help`) never loads @libsql/client. Config is resolved\n *  inside each branch so an unknown action returns without needing any Turso env. */\nexport async function runDbCommand(\n  action: string,\n  opts: DbCommandOptions,\n): Promise<{ output: string; code: number }> {\n  if (action === \"migrate\") {\n    const { readDbConfig } = await import(\"../../db/client.js\");\n    const cfg = opts.url ? { url: opts.url } : readDbConfig();\n    const { runMigrations } = await import(\"../../db/migrate.js\");\n    const { createClient } = await import(\"@libsql/client\");\n    const client = createClient(cfg.url === \":memory:\" ? { url: \":memory:\" } : cfg);\n    const ran = await runMigrations(client);\n    return {\n      output: ran.length ? `Applied migrations: ${ran.join(\", \")}` : \"Already up to date.\",\n      code: 0,\n    };\n  }\n\n  return {\n    output: `unknown db action '${action}'. Use: migrate.`,\n    code: 1,\n  };\n}\n"],"mappings":";AAUA,eAAsB,aACpB,QACA,MAC2C;AAC3C,MAAI,WAAW,WAAW;AACxB,UAAM,EAAE,aAAa,IAAI,MAAM,OAAO,sBAAoB;AAC1D,UAAM,MAAM,KAAK,MAAM,EAAE,KAAK,KAAK,IAAI,IAAI,aAAa;AACxD,UAAM,EAAE,cAAc,IAAI,MAAM,OAAO,uBAAqB;AAC5D,UAAM,EAAE,aAAa,IAAI,MAAM,OAAO,gBAAgB;AACtD,UAAM,SAAS,aAAa,IAAI,QAAQ,aAAa,EAAE,KAAK,WAAW,IAAI,GAAG;AAC9E,UAAM,MAAM,MAAM,cAAc,MAAM;AACtC,WAAO;AAAA,MACL,QAAQ,IAAI,SAAS,uBAAuB,IAAI,KAAK,IAAI,CAAC,KAAK;AAAA,MAC/D,MAAM;AAAA,IACR;AAAA,EACF;AAEA,SAAO;AAAA,IACL,QAAQ,sBAAsB,MAAM;AAAA,IACpC,MAAM;AAAA,EACR;AACF;","names":[]}

package/dist/ensure-site-S25MDDHW.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/reports/airtable/ensure-site.ts","../src/cli/commands/ensure-site.ts"],"sourcesContent":["import type { FieldSet, Records } from \"airtable\";\nimport type { AirtableBase } from \"./client.js\";\nimport { WEBSITES_TABLE, listWebsites, siteSlug } from \"./websites.js\";\n\nexport type EnsureSiteInput = {\n  /** Canonical slug — matches by siteSlug(Name); the Name on create when no displayName given. */\n  slug: string;\n  /** Human display name written to Name on create. Name is consumed VERBATIM in\n   *  client-facing copy (forms auto-reply intro, report subjects), so a bare\n   *  machine slug there reads as \"Thanks for reaching out to acme-co.\" Must\n   *  slugify to the same slug or the row wouldn't be found on re-run. */\n  displayName?: string;\n  url?: string;\n  pointOfContact?: string;\n  /** owner/repo. Default on create: `reddoorla/<slug>`. */\n  gitRepo?: string;\n};\n\nexport type EnsureSiteResult = {\n  status: \"created\" | \"exists\";\n  siteId: string;\n  /** Airtable column names written on the exists path (create path writes all). */\n  updatedFields: string[];\n  /** Inputs that DIFFERED from an existing non-blank cell and were left\n   *  untouched (fill-blanks-only) — surfaced so a resumed bootstrap with a\n   *  corrected value doesn't silently discard it. */\n  skippedMismatches: string[];\n};\n\n/** Column-name map (load-bearing magic strings — see websites.ts's mapRow header). */\nconst COLS = {\n  url: \"url\",\n  pointOfContact: \"point of contact\",\n  gitRepo: \"Git repo\",\n} as const;\n\n/**\n * Find-or-create the Websites row for a slug so a new site exists in the fleet\n * inventory (audits, form-ingest slug resolution, reports) from day one.\n *\n * Fill-blanks-only on the exists path: this command runs from a bootstrap skill\n * that may be re-run to resume — it must never clobber operator-edited cells.\n * Frequencies are deliberately NOT set (launch flips the lifecycle); Status is\n * only written on create (\"in development\").\n */\nexport async function ensureSite(\n  base: AirtableBase,\n  input: EnsureSiteInput,\n): Promise<EnsureSiteResult> {\n  const slug = siteSlug(input.slug);\n  if (!slug) throw new Error(`ensure-site: '${input.slug}' does not slugify to a usable slug`);\n  if (input.displayName && siteSlug(input.displayName) !== slug)\n    throw new Error(\n      `ensure-site: display name '${input.displayName}' slugifies to '${siteSlug(input.displayName)}', not '${slug}' — the row would not be found on re-run`,\n    );\n\n  const existing = (await listWebsites(base)).find((w) => siteSlug(w.name) === slug);\n\n  if (!existing) {\n    const fields: FieldSet = {\n      Name: input.displayName ?? slug,\n      Status: \"in development\",\n      [COLS.gitRepo]: input.gitRepo ?? `reddoorla/${slug}`,\n    };\n    if (input.url) fields[COLS.url] = input.url;\n    if (input.pointOfContact) fields[COLS.pointOfContact] = input.pointOfContact;\n    const created = (await base(WEBSITES_TABLE).create([{ fields }])) as Records<FieldSet>;\n    return {\n      status: \"created\",\n      siteId: created[0]!.id,\n      updatedFields: [],\n      skippedMismatches: [],\n    };\n  }\n\n  const updates: FieldSet = {};\n  const skippedMismatches: string[] = [];\n  const blank = (v: unknown) => v === null || v === undefined || v === \"\";\n  const consider = (column: string, provided: string | undefined, current: unknown) => {\n    if (!provided) return;\n    if (blank(current)) updates[column] = provided;\n    else if (current !== provided) skippedMismatches.push(column);\n  };\n  consider(COLS.url, input.url, existing.url || null);\n  consider(COLS.pointOfContact, input.pointOfContact, existing.pointOfContact);\n  consider(COLS.gitRepo, input.gitRepo, existing.gitRepo);\n\n  const updatedFields = Object.keys(updates);\n  if (updatedFields.length > 0) {\n    await base(WEBSITES_TABLE).update([{ id: existing.id, fields: updates }]);\n  }\n  return { status: \"exists\", siteId: existing.id, updatedFields, skippedMismatches };\n}\n","import { openBase, readAirtableConfig } from \"../../reports/airtable/client.js\";\nimport { ensureSite } from \"../../reports/airtable/ensure-site.js\";\n\nexport type EnsureSiteCommandOptions = {\n  name?: string;\n  url?: string;\n  contact?: string;\n  gitRepo?: string;\n  cwd?: string;\n};\n\n/**\n * `ensure-site <slug>` — create/verify the fleet-inventory row for a new site.\n * Day-one step of the /new-site bootstrap skill. Fill-blanks-only; safe to re-run.\n */\nexport async function runEnsureSiteCommand(\n  slug: string | undefined,\n  opts: EnsureSiteCommandOptions,\n): Promise<{ output: string; code: number }> {\n  if (!slug) return { output: \"Provide a <slug> (e.g. `ensure-site roalson`).\", code: 2 };\n  try {\n    const base = openBase(readAirtableConfig());\n    const result = await ensureSite(base, {\n      slug,\n      ...(opts.name ? { displayName: opts.name } : {}),\n      ...(opts.url ? { url: opts.url } : {}),\n      ...(opts.contact ? { pointOfContact: opts.contact } : {}),\n      ...(opts.gitRepo ? { gitRepo: opts.gitRepo } : {}),\n    });\n    const filled =\n      result.updatedFields.length > 0\n        ? ` — filled blank field(s): ${result.updatedFields.join(\", \")}`\n        : \"\";\n    const skipped =\n      result.skippedMismatches.length > 0\n        ? ` — differs from existing, left untouched (edit in Airtable): ${result.skippedMismatches.join(\", \")}`\n        : \"\";\n    const nameNote =\n      result.status === \"created\" && !opts.name\n        ? ` — Name set to \"${slug}\"; retitle in Airtable before forms/announce go live (or re-create with --name)`\n        : \"\";\n    return {\n      output: `[${slug}] ${result.status} (${result.siteId})${filled}${skipped}${nameNote}`,\n      code: 0,\n    };\n  } catch (err) {\n    const e = err as { message?: string; exitCode?: number };\n    return { output: e.message ?? String(err), code: e.exitCode ?? 1 };\n  }\n}\n"],"mappings":";;;;;;;;;;;;AA8BA,IAAM,OAAO;AAAA,EACX,KAAK;AAAA,EACL,gBAAgB;AAAA,EAChB,SAAS;AACX;AAWA,eAAsB,WACpB,MACA,OAC2B;AAC3B,QAAM,OAAO,SAAS,MAAM,IAAI;AAChC,MAAI,CAAC,KAAM,OAAM,IAAI,MAAM,iBAAiB,MAAM,IAAI,qCAAqC;AAC3F,MAAI,MAAM,eAAe,SAAS,MAAM,WAAW,MAAM;AACvD,UAAM,IAAI;AAAA,MACR,8BAA8B,MAAM,WAAW,mBAAmB,SAAS,MAAM,WAAW,CAAC,WAAW,IAAI;AAAA,IAC9G;AAEF,QAAM,YAAY,MAAM,aAAa,IAAI,GAAG,KAAK,CAAC,MAAM,SAAS,EAAE,IAAI,MAAM,IAAI;AAEjF,MAAI,CAAC,UAAU;AACb,UAAM,SAAmB;AAAA,MACvB,MAAM,MAAM,eAAe;AAAA,MAC3B,QAAQ;AAAA,MACR,CAAC,KAAK,OAAO,GAAG,MAAM,WAAW,aAAa,IAAI;AAAA,IACpD;AACA,QAAI,MAAM,IAAK,QAAO,KAAK,GAAG,IAAI,MAAM;AACxC,QAAI,MAAM,eAAgB,QAAO,KAAK,cAAc,IAAI,MAAM;AAC9D,UAAM,UAAW,MAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;AAC/D,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ,QAAQ,CAAC,EAAG;AAAA,MACpB,eAAe,CAAC;AAAA,MAChB,mBAAmB,CAAC;AAAA,IACtB;AAAA,EACF;AAEA,QAAM,UAAoB,CAAC;AAC3B,QAAM,oBAA8B,CAAC;AACrC,QAAM,QAAQ,CAAC,MAAe,MAAM,QAAQ,MAAM,UAAa,MAAM;AACrE,QAAM,WAAW,CAAC,QAAgB,UAA8B,YAAqB;AACnF,QAAI,CAAC,SAAU;AACf,QAAI,MAAM,OAAO,EAAG,SAAQ,MAAM,IAAI;AAAA,aAC7B,YAAY,SAAU,mBAAkB,KAAK,MAAM;AAAA,EAC9D;AACA,WAAS,KAAK,KAAK,MAAM,KAAK,SAAS,OAAO,IAAI;AAClD,WAAS,KAAK,gBAAgB,MAAM,gBAAgB,SAAS,cAAc;AAC3E,WAAS,KAAK,SAAS,MAAM,SAAS,SAAS,OAAO;AAEtD,QAAM,gBAAgB,OAAO,KAAK,OAAO;AACzC,MAAI,cAAc,SAAS,GAAG;AAC5B,UAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,SAAS,IAAI,QAAQ,QAAQ,CAAC,CAAC;AAAA,EAC1E;AACA,SAAO,EAAE,QAAQ,UAAU,QAAQ,SAAS,IAAI,eAAe,kBAAkB;AACnF;;;AC7EA,eAAsB,qBACpB,MACA,MAC2C;AAC3C,MAAI,CAAC,KAAM,QAAO,EAAE,QAAQ,kDAAkD,MAAM,EAAE;AACtF,MAAI;AACF,UAAM,OAAO,SAAS,mBAAmB,CAAC;AAC1C,UAAM,SAAS,MAAM,WAAW,MAAM;AAAA,MACpC;AAAA,MACA,GAAI,KAAK,OAAO,EAAE,aAAa,KAAK,KAAK,IAAI,CAAC;AAAA,MAC9C,GAAI,KAAK,MAAM,EAAE,KAAK,KAAK,IAAI,IAAI,CAAC;AAAA,MACpC,GAAI,KAAK,UAAU,EAAE,gBAAgB,KAAK,QAAQ,IAAI,CAAC;AAAA,MACvD,GAAI,KAAK,UAAU,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,IAClD,CAAC;AACD,UAAM,SACJ,OAAO,cAAc,SAAS,IAC1B,kCAA6B,OAAO,cAAc,KAAK,IAAI,CAAC,KAC5D;AACN,UAAM,UACJ,OAAO,kBAAkB,SAAS,IAC9B,qEAAgE,OAAO,kBAAkB,KAAK,IAAI,CAAC,KACnG;AACN,UAAM,WACJ,OAAO,WAAW,aAAa,CAAC,KAAK,OACjC,wBAAmB,IAAI,oFACvB;AACN,WAAO;AAAA,MACL,QAAQ,IAAI,IAAI,KAAK,OAAO,MAAM,KAAK,OAAO,MAAM,IAAI,MAAM,GAAG,OAAO,GAAG,QAAQ;AAAA,MACnF,MAAM;AAAA,IACR;AAAA,EACF,SAAS,KAAK;AACZ,UAAM,IAAI;AACV,WAAO,EAAE,QAAQ,EAAE,WAAW,OAAO,GAAG,GAAG,MAAM,EAAE,YAAY,EAAE;AAAA,EACnE;AACF;","names":[]}

package/dist/forms-notify-target-TWN4EH6K.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/forms/ingest.ts","../src/forms/notify.ts","../src/recipes/forms-notify-target.ts","../src/cli/commands/forms-notify-target.ts"],"sourcesContent":["import type { WebsiteRow } from \"../reports/airtable/websites.js\";\nimport type {\n  SubmissionRow,\n  SubmissionInput,\n  NotifyStatus,\n  SubmissionStatus,\n} from \"../reports/submission-row.js\";\nimport { normalizeSubmission, type NormalizedSubmission } from \"./payload.js\";\nimport type { TurnstileOutcome, TurnstileVerification } from \"./turnstile.js\";\nimport { SPAM_THRESHOLD, type SpamVerdict } from \"./spam-classifier.js\";\n\n/** How far back the duplicate-spray AND repeat-sender lookups scan. Sprays arrive in\n *  bursts but bots also re-run for weeks; 30 days catches repeats without an unbounded\n *  table scan. */\nconst DUPLICATE_WINDOW_MS = 30 * 24 * 60 * 60 * 1000;\n\nexport type IngestDeps = {\n  getWebsiteBySlug: (slug: string) => Promise<WebsiteRow | null>;\n  createSubmission: (input: SubmissionInput) => Promise<SubmissionRow>;\n  notify: (\n    site: WebsiteRow,\n    submission: SubmissionRow,\n  ) => Promise<{ status: NotifyStatus; messageId: string | null }>;\n  stampNotified: (id: string, status: NotifyStatus, messageId: string | null) => Promise<void>;\n  now: () => Date;\n  /** Optional spam classifier. When present, its verdict drives the stored\n   *  status/score/reason; absent → every submission scores 0 (fail-open, clean).\n   *  Injected so the classifier stays a pure, transport-agnostic leaf. */\n  classifySpam?: (n: NormalizedSubmission, turnstile: TurnstileOutcome) => SpamVerdict;\n  /** Optional: fleet-wide duplicate/near-duplicate body lookup since `since`. Drives\n   *  the duplicate-spray signal — the same pitch blasted to many sites shows up as\n   *  identical (`exact`) or template-substituted (`similar`, token-set Jaccard) bodies.\n   *  Statuses let the retro re-bucket pick still-'new' prior copies; siteId+email let\n   *  the caller exempt a genuine same-sender resubmission on the same site. Absent →\n   *  the check is skipped (fail-open clean). */\n  findRecentDuplicates?: (\n    message: string,\n    since: Date,\n  ) => Promise<{\n    exact: Array<{ id: string; status: string; siteId: string; email: string }>;\n    similar: Array<{ id: string; status: string; siteId: string; email: string }>;\n  }>;\n  /** Optional: recent non-newsletter submissions from the same email since `since`.\n   *  Drives the cross-site repeat-sender signal — the fleet's sites are unrelated\n   *  businesses, so one address contacting 2+ of them within the window is a\n   *  solicitation tell. Absent → the check is skipped (fail-open clean). */\n  listRecentSubmissionsForEmail?: (\n    email: string,\n    since: Date,\n  ) => Promise<Array<{ id: string; siteId: string; status: string }>>;\n  /** Optional: retroactively re-bucket prior still-'new' rows once a later copy\n   *  identifies a spray (the first copy is delivered by design). Implementations\n   *  must only touch status='new' rows. Best-effort — failures are swallowed. */\n  retroBucket?: (ids: string[], reason: string) => Promise<void>;\n  /** Optional: POST a newsletter submission to the site's configured webhook\n   *  (best-effort). Omitted in tests/handlers that don't need it. */\n  forwardNewsletter?: (\n    webhookUrl: string,\n    submission: SubmissionRow,\n    site: WebsiteRow,\n  ) => Promise<{ ok: boolean; status: number }>;\n  /** Optional: add a newsletter submitter to the site's Mailchimp audience\n   *  (best-effort). Omitted where unused. `tagged:false` reports a member who was\n   *  upserted but could NOT be tagged — recorded separately, see FANOUT below. */\n  addToMailchimp?: (\n    site: WebsiteRow,\n    submission: SubmissionRow,\n  ) => Promise<{ ok: boolean; status: number; tagged?: boolean }>;\n  /** Optional: persist the newsletter fan-out outcome on the row (see FANOUT below).\n   *  Best-effort — failures are swallowed. Absent → the fan-out still runs, just\n   *  unrecorded (older callers and most tests). */\n  stampFanout?: (id: string, fanoutStatus: string) => Promise<void>;\n  /** Optional: run the best-effort tail (notify → stamp → fan-out) AFTER the\n   *  response instead of before it. Production passes Netlify's\n   *  `context.waitUntil`, which keeps the invocation alive until the promise\n   *  settles. Absent → the tail runs inline, exactly as it always did; this is a\n   *  latency change, never a behavioural one.\n   *\n   *  Why it matters: the submitting site waits on this response under an abort\n   *  budget (forms/client.ts `INGEST_TIMEOUT_MS`). Once the row is written the\n   *  lead is captured, so every further second spent on email/webhook providers\n   *  is time in which a captured lead can still be reported to the visitor as a\n   *  failed submission — which is exactly what happened to 1836dig on\n   *  2026-08-03. */\n  defer?: (work: Promise<unknown>) => void;\n};\n\nexport type IngestResult =\n  | { status: \"accepted\"; submissionId: string; notifyStatus: NotifyStatus | \"deferred\" }\n  | { status: \"rejected\"; reason: \"invalid-payload\"; errors: string[] }\n  | { status: \"unknown-site\"; slug: string };\n\nexport type ScreenOutDeps = {\n  getWebsiteBySlug: (slug: string) => Promise<WebsiteRow | null>;\n  recordScreenOut: (siteId: string, reason: \"honeypot\" | \"too-fast\") => Promise<void>;\n};\n\nexport type ScreenOutResult =\n  { status: \"recorded\"; slug: string } | { status: \"unknown-site\"; slug: string };\n\n/** Extract the screen-out reason from a beacon body, or null if it isn't one.\n *  The beacon key is the reserved `_screenOut` (underscore-namespaced like `_meta`,\n *  see payload.ts). The bare `screenOut` key is the DEPRECATED pre-namespacing wire\n *  shape — sites run older package versions for a while, so the central receiver\n *  keeps accepting it. `_screenOut` wins when both are present. */\nexport function parseScreenOut(payload: unknown): \"honeypot\" | \"too-fast\" | null {\n  if (!payload || typeof payload !== \"object\") return null;\n  const body = payload as Record<string, unknown>;\n  const v = \"_screenOut\" in body ? body[\"_screenOut\"] : body[\"screenOut\"];\n  return v === \"honeypot\" || v === \"too-fast\" ? v : null;\n}\n\n/** Resolve the site and record a caught screen-out. Best-effort: a record failure is\n *  the caller's to swallow — a missed count must never error a screened bot. */\nexport async function ingestScreenOut(\n  deps: ScreenOutDeps,\n  slug: string,\n  reason: \"honeypot\" | \"too-fast\",\n): Promise<ScreenOutResult> {\n  const site = await deps.getWebsiteBySlug(slug);\n  if (!site) return { status: \"unknown-site\", slug };\n  await deps.recordScreenOut(site.id, reason);\n  return { status: \"recorded\", slug };\n}\n\n/**\n * Normalize → resolve site → persist → notify → stamp. The order is load-bearing:\n * the row is written BEFORE notify, and notify/stamp failures are swallowed (logged)\n * so a Resend or Airtable-write-back hiccup can never turn an accepted lead into a 502.\n */\nexport async function ingestSubmission(\n  deps: IngestDeps,\n  slug: string,\n  rawPayload: unknown,\n  turnstileInput: TurnstileOutcome | TurnstileVerification = \"unverifiable\",\n): Promise<IngestResult> {\n  // Accept either the full verification (the production handler) or a bare outcome\n  // string (older callers and virtually every test) — a string simply has no solved-\n  // hostname to check. Normalized once so the body has a single shape to reason about.\n  const verification: TurnstileVerification =\n    typeof turnstileInput === \"string\"\n      ? { outcome: turnstileInput, hostname: null }\n      : turnstileInput;\n  const turnstile = verification.outcome;\n  const normalized = normalizeSubmission(rawPayload);\n  if (!normalized.ok) {\n    return { status: \"rejected\", reason: \"invalid-payload\", errors: normalized.errors };\n  }\n  const site = await deps.getWebsiteBySlug(slug);\n  if (!site) return { status: \"unknown-site\", slug };\n\n  // Synthetic end-to-end probe (the `form-e2e` fleet audit). A central-only marker\n  // on the payload routes the submission away from EVERY real sink: no row is\n  // persisted, no spam classification, no operator/autoresponder email, no\n  // newsletter fan-out — and Turnstile enforcement is bypassed (the short-circuit\n  // sits before that check). The marker therefore grants a bot NO benefit: it\n  // reaches no inbox/DB/webhook, so skipping Turnstile costs nothing. This\n  // suppression MUST be central — the submitting site alone cannot stop the real\n  // inbox firing. Validity + site resolution are still enforced above (a junk body\n  // is rejected, an unknown slug is unknown-site), so the marker can't smuggle\n  // anything through. Return accepted+skipped so the probe asserts success.\n  if (isTestMode(rawPayload)) {\n    return { status: \"accepted\", submissionId: \"test-mode\", notifyStatus: \"skipped\" };\n  }\n\n  const n = normalized.value;\n\n  // Fold the content signals + the Turnstile verdict into ONE spam decision.\n  // Absent classifier → treat as clean (fail-open). A throwing classifier is\n  // swallowed the same way — a bug in the heuristic must never turn an\n  // otherwise-good lead into a 500; it just scores clean. On a `requireTurnstile`\n  // site, both an ACTUAL \"fail\" (forged token) AND an \"absent\" token escalate to\n  // auto-spam regardless of score — a real browser that renders the widget ALWAYS\n  // sends a token, so a completely missing one is the direct-POST-bot signature. A\n  // present-but-\"unverifiable\" token (expired/duplicate — a real browser DID render\n  // the widget) stays neutral, as does anything on a site that hasn't opted in.\n  let verdict: SpamVerdict = { score: 0, reasons: [] };\n  if (deps.classifySpam) {\n    try {\n      verdict = deps.classifySpam(n, turnstile);\n    } catch (err) {\n      console.error(`[ingest] classifySpam threw: ${String(err)}`);\n    }\n  }\n  const reasons = [...verdict.reasons];\n  let status: SubmissionStatus = verdict.score >= SPAM_THRESHOLD ? \"spam_auto\" : \"new\";\n  if (site.requireTurnstile && (turnstile === \"fail\" || turnstile === \"absent\")) {\n    status = \"spam_auto\";\n    const reason = turnstile === \"fail\" ? \"turnstile-required-failed\" : \"turnstile-required-absent\";\n    if (!reasons.includes(reason)) reasons.push(reason);\n  } else if (\n    site.requireTurnstile &&\n    turnstile === \"pass\" &&\n    verification.hostname !== null &&\n    !turnstileHostnameAcceptable(verification.hostname, site.url)\n  ) {\n    // Defense-in-depth vs token farming: the token PASSED, but Cloudflare says it was\n    // solved on a host unrelated to this site. Cloudflare domain-binds sitekeys, so\n    // this only trips on a loose widget allowlist — still, a passing token from a\n    // foreign host accompanying a gated site's submission is not a real visitor. A\n    // null hostname (older responses) or an unparseable site.url skips the check\n    // entirely (fail-open); subdomains of the site's host (www., previews) match.\n    status = \"spam_auto\";\n    if (!reasons.includes(\"turnstile-required-hostname\"))\n      reasons.push(\"turnstile-required-hostname\");\n  }\n\n  // Cross-site repeat-sender signal: the fleet's sites are UNRELATED businesses\n  // (art gallery, realtor, home builder…), so the same email writing to 2+ different\n  // sites within the window is a solicitation tell no single-message scan can see.\n  // Same-site repeats alone must NOT trigger — those are genuine follow-ups. The\n  // operator explicitly accepts overblocking here (spam_auto is recoverable). Prior\n  // still-'new' rows on OTHER sites are retro-bucketed too: the first copy of a\n  // spray is delivered by design, so the copy that identifies it also cleans the\n  // queue. The scan runs EVEN WHEN the incoming copy is already spam_auto — after the\n  // classifier began catching whole spray families, an already-bucketed copy was\n  // skipping this scan and the retro cleanup never fired for exactly the sprays it\n  // was built for; escalation/reason still only applies when not already spam.\n  // Best-effort — a lookup failure never blocks a lead.\n  if (n.formType !== \"newsletter\" && deps.listRecentSubmissionsForEmail) {\n    try {\n      const since = new Date(deps.now().getTime() - DUPLICATE_WINDOW_MS);\n      const prior = await deps.listRecentSubmissionsForEmail(n.email, since);\n      const otherSites = prior.filter((p) => p.siteId !== site.id);\n      if (otherSites.length > 0) {\n        if (status !== \"spam_auto\") {\n          status = \"spam_auto\";\n          if (!reasons.includes(\"repeat-sender\")) reasons.push(\"repeat-sender\");\n        }\n        const retroIds = otherSites.filter((p) => p.status === \"new\").map((p) => p.id);\n        if (deps.retroBucket && retroIds.length > 0) {\n          try {\n            await deps.retroBucket(retroIds, \"retro:repeat-sender\");\n          } catch (err) {\n            console.error(`[ingest] retroBucket (repeat-sender) threw: ${String(err)}`);\n          }\n        }\n      }\n    } catch (err) {\n      console.error(`[ingest] listRecentSubmissionsForEmail threw: ${String(err)}`);\n    }\n  }\n\n  // Duplicate/spray signal: the same pitch blasted across the fleet (or repeated) is\n  // a bot tell a lone content scan can't see. An identical body ('exact') OR a\n  // template-substituted near-copy ('similar' — the live dog-harness spray differed\n  // only in greeting; SEO sprays swap the target domain per site) → auto-spam\n  // (recoverable). Prior still-'new' copies are retro-bucketed for the same reason\n  // as above, and the scan runs even when the incoming copy is already spam_auto\n  // (see the repeat-sender note). GENUINE-RESUBMIT EXEMPTION: a match from the SAME\n  // sender on the SAME site is a real visitor double-submitting or resending after\n  // silence, not spray evidence — without this exemption the resend was silently\n  // bucketed AND retro-flipped the delivered original, vanishing an active lead\n  // with no signal. Only cross-site or different-sender copies count. Guarded:\n  // non-newsletter forms with a real body; the db helper ignores short bodies /\n  // small token sets. Best-effort — a lookup failure never blocks a lead.\n  if (n.formType !== \"newsletter\" && n.message !== undefined && deps.findRecentDuplicates) {\n    try {\n      const since = new Date(deps.now().getTime() - DUPLICATE_WINDOW_MS);\n      const dupes = await deps.findRecentDuplicates(n.message, since);\n      const senderEmail = n.email.trim().toLowerCase();\n      const isOwnResend = (m: { siteId: string; email: string }) =>\n        m.siteId === site.id && m.email.trim().toLowerCase() === senderEmail;\n      const exact = dupes.exact.filter((m) => !isOwnResend(m));\n      const similar = dupes.similar.filter((m) => !isOwnResend(m));\n      const reason =\n        exact.length > 0 ? \"duplicate-body\" : similar.length > 0 ? \"similar-body\" : null;\n      if (reason !== null) {\n        if (status !== \"spam_auto\") {\n          status = \"spam_auto\";\n          if (!reasons.includes(reason)) reasons.push(reason);\n        }\n        const retroIds = [...exact, ...similar].filter((m) => m.status === \"new\").map((m) => m.id);\n        if (deps.retroBucket && retroIds.length > 0) {\n          try {\n            await deps.retroBucket(retroIds, \"retro:duplicate-body\");\n          } catch (err) {\n            console.error(`[ingest] retroBucket (duplicate-body) threw: ${String(err)}`);\n          }\n        }\n      }\n    } catch (err) {\n      console.error(`[ingest] findRecentDuplicates threw: ${String(err)}`);\n    }\n  }\n  const spamReason = reasons.length > 0 ? reasons.join(\",\") : null;\n\n  const row = await deps.createSubmission({\n    siteId: site.id,\n    formType: n.formType,\n    name: n.name,\n    email: n.email,\n    extraFields: n.extraFields,\n    status,\n    spamScore: verdict.score,\n    spamReason,\n    // Optional fields spread only when present — exactOptionalPropertyTypes\n    // forbids assigning `undefined` to an optional `phone?: string` etc.\n    ...(n.phone !== undefined ? { phone: n.phone } : {}),\n    ...(n.message !== undefined ? { message: n.message } : {}),\n    ...(n.sourceUrl !== undefined ? { sourceUrl: n.sourceUrl } : {}),\n    ...(n.utm !== undefined ? { utm: n.utm } : {}),\n    submittedAt: deps.now(),\n  });\n\n  // Auto-spam (and operator-marked spam) is captured but silent: no operator\n  // email, no autoresponder, no newsletter fan-out. Skip notify entirely and\n  // record the honest \"skipped\" stamp. notify.ts also nulls both builders for\n  // these statuses (defense in depth), but short-circuiting here means the\n  // injected notify dep is never even invoked for a spam row.\n  const isSpam = row.status === \"spam_auto\" || row.status === \"spam\";\n\n  // ── best-effort tail ───────────────────────────────────────────────────────\n  // notify → stamp → newsletter fan-out. NOTHING below can cost the lead: the\n  // row is already durable, and every step here is swallowed+logged rather than\n  // allowed to turn an accepted lead into a 502. That is precisely why it does\n  // not belong on the visitor's critical path — the submitting site waits on\n  // this response under an abort budget (forms/client.ts INGEST_TIMEOUT_MS), so\n  // Resend latency used to be able to make a captured lead read as a failed\n  // submission in the visitor's browser (1836dig, 2026-08-03).\n  //\n  // `deps.defer` (Netlify's `context.waitUntil` in production) runs the tail\n  // AFTER the response goes out. Absent — every test, and any runtime without\n  // post-response execution — it runs inline exactly as before, so this is a\n  // latency change and never a behavioural one.\n  const runTail = async (): Promise<NotifyStatus> => {\n    let notify: { status: NotifyStatus; messageId: string | null };\n    if (isSpam) {\n      notify = { status: \"skipped\", messageId: null };\n    } else {\n      try {\n        notify = await deps.notify(site, row);\n      } catch (err) {\n        console.error(`[ingest] notify threw: ${String(err)}`);\n        notify = { status: \"failed\", messageId: null };\n      }\n    }\n    try {\n      await deps.stampNotified(row.id, notify.status, notify.messageId);\n    } catch (err) {\n      console.error(`[ingest] stampNotified failed: ${String(err)}`);\n    }\n\n    await runFanout();\n    return notify.status;\n  };\n\n  // Newsletter fan-out: each configured destination fires best-effort and is\n  // swallowed+logged — the lead is already persisted; never turn it into a 502.\n  // Guarded on the row status so a spam signup is never forwarded to a site\n  // webhook or added to a Mailchimp audience.\n  //\n  // FANOUT provenance (2026-07-31): the outcome is ALSO recorded on the row, one\n  // `<destination>:<outcome>` token per attempt, comma-joined in attempt order —\n  // `webhook:ok,mailchimp:401`. Outcome is `ok`, the HTTP status of a non-2xx\n  // (`0` for a network error / misconfiguration, see mailchimp.ts), or `threw`.\n  // `mailchimp-tags:failed` is appended when the member was upserted but the tag\n  // write did not land. Until this existed the results were console.error-only, so\n  // an expired Mailchimp key stopped signups reaching the audience while the row\n  // still read `notify=sent` — healthy-looking, with the failure visible nowhere the\n  // operator ever looks. Nothing attempted → nothing stamped (null stays \"no\n  // destination configured\", NOT \"we tried and lost the answer\"). The stamp is\n  // best-effort like everything else here: a provenance write must never cost a lead.\n  // A const arrow, not a hoisted declaration: `site` is narrowed non-null above,\n  // and that narrowing only survives into a closure created after it. Declared\n  // below runTail (which calls it) but before either call site, so there is no TDZ.\n  const runFanout = async (): Promise<void> => {\n    const fanout: string[] = [];\n    if (n.formType === \"newsletter\" && !isSpam) {\n      if (site.newsletterWebhook && deps.forwardNewsletter) {\n        try {\n          const fwd = await deps.forwardNewsletter(site.newsletterWebhook, row, site);\n          if (!fwd.ok)\n            console.error(`[ingest] newsletter webhook → ${fwd.status} for ${site.name}`);\n          fanout.push(fwd.ok ? \"webhook:ok\" : `webhook:${fwd.status}`);\n        } catch (err) {\n          console.error(`[ingest] newsletter webhook threw: ${String(err)}`);\n          fanout.push(\"webhook:threw\");\n        }\n      }\n      if (site.mailchimpApiKey && site.mailchimpAudienceId && deps.addToMailchimp) {\n        try {\n          const mc = await deps.addToMailchimp(site, row);\n          if (!mc.ok) console.error(`[ingest] mailchimp add → ${mc.status} for ${site.name}`);\n          fanout.push(mc.ok ? \"mailchimp:ok\" : `mailchimp:${mc.status}`);\n          // Only meaningful alongside a successful add — a failed add was never tagged\n          // either, and one token per real problem keeps the row readable.\n          if (mc.ok && mc.tagged === false) {\n            console.error(`[ingest] mailchimp tags not applied for ${site.name}`);\n            fanout.push(\"mailchimp-tags:failed\");\n          }\n        } catch (err) {\n          console.error(`[ingest] mailchimp add threw: ${String(err)}`);\n          fanout.push(\"mailchimp:threw\");\n        }\n      }\n    }\n    if (fanout.length > 0 && deps.stampFanout) {\n      try {\n        await deps.stampFanout(row.id, fanout.join(\",\"));\n      } catch (err) {\n        console.error(`[ingest] stampFanout failed: ${String(err)}`);\n      }\n    }\n  };\n\n  if (deps.defer) {\n    // A rejection escaping here would land as an unhandled rejection in the\n    // platform's post-response context, where nothing is left to catch it — so\n    // the boundary is made unrejectable. Everything inside is already swallowed;\n    // this guards the shape, not a known throw.\n    deps.defer(\n      runTail().catch((err) => {\n        console.error(`[ingest] deferred tail threw: ${String(err)}`);\n      }),\n    );\n    // The lead is durable and the response can go out now. The real notify\n    // outcome lands on the ROW via stampNotified moments later — this field is\n    // only ever read by callers wanting the in-request outcome, which by\n    // definition does not exist once the tail is deferred.\n    return { status: \"accepted\", submissionId: row.id, notifyStatus: \"deferred\" };\n  }\n  return { status: \"accepted\", submissionId: row.id, notifyStatus: await runTail() };\n}\n\n/** True when `a` and `b` are the same host or one is a subdomain of the other\n *  (case-insensitive): `www.reddoorla.com` vs `reddoorla.com` matches both ways.\n *  Exported for tests. PURE. */\nexport function hostsMatch(a: string, b: string): boolean {\n  const ha = a.trim().toLowerCase();\n  const hb = b.trim().toLowerCase();\n  if (ha.length === 0 || hb.length === 0) return false;\n  return ha === hb || ha.endsWith(`.${hb}`) || hb.endsWith(`.${ha}`);\n}\n\n/** Whether a passing token's solved-hostname is acceptable for the site at `siteUrl`.\n *  An unparseable/hostless `siteUrl` returns TRUE — the check self-disables rather\n *  than punishing a possibly-real visitor for an operator data problem (fail-open,\n *  same philosophy as verifyTurnstile). PURE. */\nexport function turnstileHostnameAcceptable(tokenHostname: string, siteUrl: string): boolean {\n  let siteHost: string;\n  try {\n    siteHost = new URL(siteUrl).hostname;\n  } catch {\n    return true;\n  }\n  if (!siteHost) return true;\n  return hostsMatch(tokenHostname, siteHost);\n}\n\n/** True when an untrusted ingest payload carries the synthetic-probe marker\n *  (top-level `testMode: true`). Read from the RAW payload so the branch never\n *  depends on normalization internals; any non-`true` value is ignored (a real\n *  visitor's form never sets it — the starter only forwards it when the submitted\n *  form field `testMode` equals \"true\"). */\nexport function isTestMode(rawPayload: unknown): boolean {\n  if (!rawPayload || typeof rawPayload !== \"object\") return false;\n  return (rawPayload as Record<string, unknown>).testMode === true;\n}\n","import type { WebsiteRow } from \"../reports/airtable/websites.js\";\nimport type { SubmissionRow, NotifyStatus } from \"../reports/submission-row.js\";\nimport type { ResendSendInput } from \"../reports/send/resend.js\";\nimport { hostsMatch } from \"./ingest.js\";\nimport { escapeHtml } from \"../util/html.js\";\nimport { operatorEmail } from \"../util/operator.js\";\n\nconst FORMS_FROM = \"forms@reddoorla.com\";\n// Reply-To only: a client replying to a lead notification should reach the\n// shared inbox. The RECIPIENT fallback is the operator's own — see util/operator.\nconst FALLBACK_REPLY_TO = \"info@reddoorla.com\";\n\n/** Strip characters that would break an RFC 5322 display name. */\nfunction displayName(raw: string): string {\n  return raw.replace(/[\"\\r\\n]/g, \"\").trim() || \"Reddoor\";\n}\n\nfunction pocAddress(site: WebsiteRow): string | null {\n  return site.pointOfContact ?? site.reportRecipientsTo ?? null;\n}\n\n/** Coerce a string|string[] recipient config into a clean, de-duped address list. */\nfunction normalizeRecipients(v: string | string[] | undefined): string[] {\n  const arr = Array.isArray(v) ? v : v ? [v] : [];\n  const seen = new Set<string>();\n  const out: string[] = [];\n  for (const raw of arr) {\n    if (typeof raw !== \"string\") continue;\n    const t = raw.trim();\n    if (t && !seen.has(t)) {\n      seen.add(t);\n      out.push(t);\n    }\n  }\n  return out;\n}\n\nexport type Recipients = { to: string[]; cc: string[] };\n\n/**\n * Where a submission notification goes.\n * - Pre-launch (status !== \"maintenance\"): the operator only — no routing, no CC.\n *   Preserves the verify guard (flip a site to \"launch period\" to route tests to\n *   yourself).\n * - Maintenance + a `Notify Routing` config: address by the routing field's value\n *   (`extraFields[field]`) → its matched route, else the config `default`; CC from\n *   the config. If nothing resolves, fall through to the single POC.\n * - Maintenance, no routing: the single site POC (pointOfContact ?? reportRecipientsTo).\n * Returns null only when nothing resolves — the lead is still persisted; notify skips.\n */\nexport function resolveRecipients(site: WebsiteRow, submission: SubmissionRow): Recipients | null {\n  if (site.status !== \"maintenance\") {\n    return { to: [operatorEmail()], cc: [] };\n  }\n  const routing = site.notifyRouting;\n  if (routing) {\n    const value = parseExtraFields(submission.extraFields)[routing.field];\n    const match = typeof value === \"string\" ? routing.routes[value] : undefined;\n    const to = normalizeRecipients(match ?? routing.default);\n    if (to.length > 0) return { to, cc: normalizeRecipients(routing.cc) };\n    // routing matched nothing → fall through to the POC below\n  }\n  const poc = pocAddress(site);\n  return poc ? { to: [poc], cc: [] } : null;\n}\n\n/** Who a submission to this site would notify, answered WITHOUT sending one. */\nexport type NotifyTarget = {\n  /** `client` means a real point of contact receives it. `operator` means the\n   *  pre-launch guard is holding and only you do. `nobody` means nothing\n   *  resolves — the lead is still stored, but no notification goes out. */\n  audience: \"client\" | \"operator\" | \"nobody\";\n  /** Every address a submission could reach, across ALL routing branches. */\n  to: string[];\n  cc: string[];\n  /** Plain-language reason, naming the field that decided it. */\n  reason: string;\n};\n\n/** A submission that exists only to ask resolveRecipients a question. */\nfunction probeSubmission(extraFields: string | null): SubmissionRow {\n  return {\n    id: \"probe\",\n    submissionId: null,\n    siteId: \"probe\",\n    formType: \"contact\" as SubmissionRow[\"formType\"],\n    name: \"probe\",\n    email: \"probe@example.com\",\n    phone: null,\n    message: null,\n    extraFields,\n    sourceUrl: null,\n    utm: null,\n    submittedAt: null,\n    status: \"new\" as SubmissionRow[\"status\"],\n    notifyStatus: \"pending\" as NotifyStatus,\n    resendMessageId: null,\n  };\n}\n\n/**\n * Resolve who a form submission would notify, for a site, right now.\n *\n * This exists because the pre-launch guard had no feedback. Its whole state is\n * one Airtable `Status` cell nobody is looking at while testing, the site\n * reports nothing about it, and the only way to learn the answer was to submit\n * a form and read the `resend_message_id` afterwards. On 2026-08-03 an intended\n * flip never landed and a real client received a test lead — an email cannot be\n * recalled. A guard whose state you cannot see is a guard you will eventually\n * assume is on.\n *\n * Every address here comes back out of `resolveRecipients` itself rather than\n * from a second reading of the same rules — for a routed site each branch is\n * probed with a synthetic submission and the results unioned. A copy of the\n * routing logic that drifted would be worse than no answer at all, because it\n * would be a confident wrong one.\n */\nexport function describeNotifyTarget(site: WebsiteRow): NotifyTarget {\n  if (site.status !== \"maintenance\") {\n    const guarded = resolveRecipients(site, probeSubmission(null));\n    return {\n      audience: \"operator\",\n      to: guarded?.to ?? [],\n      cc: [],\n      reason: `Status is ${site.status === null ? \"blank\" : `\"${site.status}\"`}, not \"maintenance\" — the pre-launch guard routes every notification to the operator.`,\n    };\n  }\n\n  const routing = site.notifyRouting;\n  if (!routing) {\n    const direct = resolveRecipients(site, probeSubmission(null));\n    if (!direct || direct.to.length === 0) {\n      return {\n        audience: \"nobody\",\n        to: [],\n        cc: [],\n        reason: `Status is \"maintenance\" but the site has no Point of Contact and no Notify Routing — the lead is stored and no notification is sent.`,\n      };\n    }\n    return {\n      audience: \"client\",\n      to: direct.to,\n      cc: direct.cc,\n      reason: `Status is \"maintenance\" — notifications go to the site's Point of Contact.`,\n    };\n  }\n\n  // Probe every declared route value, plus one value that matches none so the\n  // `default` (and the POC fall-through behind it) is covered too.\n  const to = new Set<string>();\n  const cc = new Set<string>();\n  const values = [...Object.keys(routing.routes), \"\u0000no-such-route\"];\n  for (const value of values) {\n    const r = resolveRecipients(site, probeSubmission(JSON.stringify({ [routing.field]: value })));\n    r?.to.forEach((a) => to.add(a));\n    r?.cc.forEach((a) => cc.add(a));\n  }\n  if (to.size === 0) {\n    return {\n      audience: \"nobody\",\n      to: [],\n      cc: [],\n      reason: `Status is \"maintenance\" with Notify Routing on \"${routing.field}\", but no route, default or Point of Contact resolves to an address.`,\n    };\n  }\n  return {\n    audience: \"client\",\n    to: [...to],\n    cc: [...cc],\n    reason: `Status is \"maintenance\" with Notify Routing on \"${routing.field}\" — the recipient depends on that field's value; every address it could reach is listed.`,\n  };\n}\n\n/** Humanize an extraFields key for display: \"appointment_date\" → \"Appointment date\". */\nfunction humanizeKey(k: string): string {\n  const spaced = k.replace(/[_-]+/g, \" \").trim();\n  return spaced ? spaced.charAt(0).toUpperCase() + spaced.slice(1) : k;\n}\n\nfunction formatValue(v: unknown): string {\n  if (v === null || v === undefined) return \"—\";\n  if (typeof v === \"string\") return v;\n  if (typeof v === \"number\" || typeof v === \"boolean\") return String(v);\n  return JSON.stringify(v);\n}\n\n/** Parse the stored `extraFields` JSON into a plain object — bad JSON or a\n *  non-object yields {} (never throws). Shared by the email renderer and routing. */\nfunction parseExtraFields(raw: string | null): Record<string, unknown> {\n  if (!raw) return {};\n  try {\n    const parsed = JSON.parse(raw);\n    if (parsed && typeof parsed === \"object\" && !Array.isArray(parsed)) {\n      return parsed as Record<string, unknown>;\n    }\n  } catch {\n    /* malformed JSON → no fields */\n  }\n  return {};\n}\n\nfunction extraFieldRows(raw: string | null): Array<[string, string]> {\n  return Object.entries(parseExtraFields(raw))\n    .filter(([, v]) => !(typeof v === \"string\" && v.trim() === \"\"))\n    .map(([k, v]) => [humanizeKey(k), formatValue(v)] as [string, string]);\n}\n\nfunction fieldsTable(submission: SubmissionRow): string {\n  const rows: Array<[string, string]> = [\n    [\"Form\", submission.formType],\n    [\"Name\", submission.name || \"—\"],\n    [\"Email\", submission.email || \"—\"],\n  ];\n  if (submission.phone) rows.push([\"Phone\", submission.phone]);\n  // Site-specific context (the artwork an inquiry is about, the event an rsvp is\n  // for, etc.) lives in extraFields — surface it so the recipient sees what the\n  // submitter was looking at, not just their name and email.\n  rows.push(...extraFieldRows(submission.extraFields));\n  if (submission.sourceUrl) rows.push([\"Page\", submission.sourceUrl]);\n  if (submission.utm) rows.push([\"UTM\", submission.utm]);\n  const body = rows\n    .map(([k, v]) => `<tr><td><strong>${escapeHtml(k)}</strong></td><td>${escapeHtml(v)}</td></tr>`)\n    .join(\"\");\n  const message = submission.message\n    ? `<p style=\"white-space:pre-wrap\">${escapeHtml(submission.message)}</p>`\n    : \"\";\n  return `<table>${body}</table>${message}`;\n}\n\n/** POC notification — the primary email; null when the site has no contact address. */\nexport function buildPocNotification(\n  site: WebsiteRow,\n  submission: SubmissionRow,\n): ResendSendInput | null {\n  if (submission.status === \"spam_auto\" || submission.status === \"spam\") return null;\n  const recipients = resolveRecipients(site, submission);\n  if (!recipients || recipients.to.length === 0) return null;\n  const input: ResendSendInput = {\n    from: `${displayName(site.name)} Forms <${FORMS_FROM}>`,\n    to: recipients.to,\n    subject: `New ${submission.formType} from ${site.name}`,\n    html: `<h2>New ${escapeHtml(submission.formType)} submission — ${escapeHtml(\n      site.name,\n    )}</h2>${fieldsTable(submission)}`,\n  };\n  if (recipients.cc.length > 0) input.cc = recipients.cc;\n  // Reply straight to the lead.\n  if (submission.email) input.replyTo = submission.email;\n  return input;\n}\n\n/** Autoresponder to the submitter — null when there's no submitter email. */\nexport function buildAutoresponder(\n  site: WebsiteRow,\n  submission: SubmissionRow,\n): ResendSendInput | null {\n  if (submission.status === \"spam_auto\" || submission.status === \"spam\") return null;\n  if (!submission.email) return null;\n  // A submitter email on the site's OWN domain is never a real lead wanting a\n  // confirmation — it is the spoofed-sender backscatter case (a bot writes the\n  // site's info@ as its email and the \"We got your message\" lands in the\n  // client's inbox). The POC notification still sends; only this email is\n  // suppressed. Unparseable/blank site url → fail open and send, same\n  // philosophy as turnstileHostnameAcceptable.\n  const emailDomain = submission.email.split(\"@\").pop() ?? \"\";\n  let siteHost = \"\";\n  try {\n    siteHost = new URL(site.url).hostname;\n  } catch {\n    /* fail open */\n  }\n  if (siteHost && hostsMatch(emailDomain, siteHost)) return null;\n  const intro = site.copyIntro ?? `Thanks for reaching out to ${site.name}.`;\n  const contact = site.copyContact ?? \"We've received your message and will be in touch soon.\";\n  const footer = site.copyFooter ?? site.name;\n  return {\n    from: `${displayName(site.name)} <${FORMS_FROM}>`,\n    to: [submission.email],\n    replyTo: resolveRecipients(site, submission)?.to[0] ?? FALLBACK_REPLY_TO,\n    subject: \"We got your message\",\n    html: `<p>${escapeHtml(intro)}</p><p>${escapeHtml(contact)}</p><p>${escapeHtml(footer)}</p>`,\n  };\n}\n\nexport type NotifyDeps = {\n  send: (input: ResendSendInput) => Promise<{ messageId: string }>;\n};\n\nexport type NotifyOutcome = { status: NotifyStatus; messageId: string | null };\n\n/**\n * Send the POC notification (primary — drives notifyStatus) then the submitter\n * autoresponder (best-effort — logged, never changes the outcome). The submission\n * is already persisted before this runs, so a Resend outage degrades to\n * notifyStatus=\"failed\", never a lost lead.\n */\nexport async function notifySubmission(\n  deps: NotifyDeps,\n  site: WebsiteRow,\n  submission: SubmissionRow,\n): Promise<NotifyOutcome> {\n  const poc = buildPocNotification(site, submission);\n  let outcome: NotifyOutcome;\n  if (!poc) {\n    outcome = { status: \"skipped\", messageId: null };\n  } else {\n    try {\n      const { messageId } = await deps.send(poc);\n      outcome = { status: \"sent\", messageId };\n    } catch (err) {\n      console.error(`[submissions] POC notification failed: ${String(err)}`);\n      outcome = { status: \"failed\", messageId: null };\n    }\n  }\n  const auto = buildAutoresponder(site, submission);\n  if (auto) {\n    try {\n      await deps.send(auto);\n    } catch (err) {\n      console.error(`[submissions] autoresponder failed: ${String(err)}`);\n    }\n  }\n  return outcome;\n}\n\n/**\n * Build the ingest `notify` dependency from a Resend send fn — or `null` when the\n * Resend client couldn't even be constructed (e.g. `RESEND_API_KEY` unset). A null\n * send marks the notification `failed` WITHOUT attempting it, so a Resend\n * misconfiguration degrades to a captured-but-unemailed lead rather than aborting\n * ingest and losing it. Mirrors the in-flight failure isolation in notifySubmission.\n */\nexport function makeNotify(\n  send: NotifyDeps[\"send\"] | null,\n): (site: WebsiteRow, submission: SubmissionRow) => Promise<NotifyOutcome> {\n  return (site, submission) =>\n    send\n      ? notifySubmission({ send }, site, submission)\n      : Promise.resolve({ status: \"failed\", messageId: null });\n}\n","import { openBase, readAirtableConfig } from \"../reports/airtable/client.js\";\nimport type { AirtableBase } from \"../reports/airtable/client.js\";\nimport {\n  listWebsites,\n  siteSlug,\n  updateSiteField,\n  type Status,\n  type WebsiteRow,\n} from \"../reports/airtable/websites.js\";\nimport { describeNotifyTarget, type NotifyTarget } from \"../forms/notify.js\";\n\n/** The Airtable column the pre-launch guard actually lives in. */\nexport const STATUS_COLUMN = \"Status\";\n\n/** The two ends of the verify flip. Deliberately the ONLY transition this\n *  performs: a site in any other status is already guarded (or is deliberately\n *  something else, like \"hosting\"), and silently rewriting that would be the\n *  same class of unseen change as the incident. */\nexport const LIVE_STATUS: Status = \"maintenance\";\nexport const VERIFY_STATUS: Status = \"launch period\";\n\nexport type FormsNotifyTargetDeps = {\n  base?: AirtableBase;\n  /** Site slug or the Airtable Websites NAME (both accepted). */\n  site: string;\n  /** `on` routes notifications to the operator; `off` restores. Omit to read. */\n  set?: \"on\" | \"off\";\n  /** Status to restore with `--set off`. Required, never inferred. */\n  restore?: string;\n};\n\nexport type FormsNotifyTargetResult = {\n  site: string;\n  status: Status | null;\n  target: NotifyTarget;\n  /** Present only when a flip was attempted. `confirmed` is the whole point:\n   *  it comes from RE-READING the row, not from the write call returning. */\n  flip?: { from: Status | null; to: Status; confirmed: boolean };\n};\n\nfunction findSite(rows: WebsiteRow[], site: string): WebsiteRow | undefined {\n  const wanted = site.trim().toLowerCase();\n  return rows.find(\n    (r) => siteSlug(r.name) === siteSlug(site) || r.name.trim().toLowerCase() === wanted,\n  );\n}\n\n/**\n * Answer \"who would a form submission on this site email?\" — and optionally\n * flip the pre-launch guard, confirming the flip by reading it back.\n *\n * The guard is a single Airtable `Status` cell. Nothing between \"I intended to\n * flip it\" and \"the client received a test lead\" reported the current state, so\n * on 2026-08-03 a flip that never landed sent a real client a test submission.\n * The fix is not a better intention, it is feedback: this reads the row back\n * after every write and refuses to call the flip confirmed on anything less.\n */\nexport async function formsNotifyTarget(\n  deps: FormsNotifyTargetDeps,\n): Promise<FormsNotifyTargetResult> {\n  const base = deps.base ?? openBase(readAirtableConfig());\n  const rows = await listWebsites(base);\n  const row = findSite(rows, deps.site);\n  if (!row) {\n    // The Websites NAME is not the repo slug (\"Sonder\", not \"gallerysonder\"),\n    // and that mismatch has cost time before — so name the near misses rather\n    // than making the operator go read Airtable to find the spelling.\n    const needle = siteSlug(deps.site);\n    const near = rows\n      .map((r) => r.name)\n      .filter((n) => siteSlug(n).includes(needle) || needle.includes(siteSlug(n)));\n    throw Object.assign(\n      new Error(\n        `No Websites row matches '${deps.site}'. The Websites NAME is not always the repo ` +\n          `slug (Sonder, not gallerysonder).` +\n          (near.length > 0 ? ` Did you mean: ${near.join(\", \")}?` : \"\"),\n      ),\n      { exitCode: 2 },\n    );\n  }\n\n  if (!deps.set) {\n    return { site: row.name, status: row.status, target: describeNotifyTarget(row) };\n  }\n\n  const to = deps.set === \"on\" ? VERIFY_STATUS : (deps.restore?.trim() as Status | undefined);\n  if (deps.set === \"off\" && !to) {\n    throw Object.assign(\n      new Error(\n        `--set off needs --restore <status>: the status to return to is never inferred. ` +\n          `Guessing \"${LIVE_STATUS}\" for a site that was \"hosting\" or \"legacy\" would start ` +\n          `sending real client notifications — the inverse of the failure this command exists ` +\n          `to prevent.`,\n      ),\n      { exitCode: 2 },\n    );\n  }\n  // Only ever flip a LIVE site into verify mode. A site already outside\n  // \"maintenance\" is guarded already, and rewriting its status would destroy a\n  // real value nobody asked us to touch.\n  if (deps.set === \"on\" && row.status !== LIVE_STATUS) {\n    throw Object.assign(\n      new Error(\n        `${row.name} is \"${row.status ?? \"blank\"}\", not \"${LIVE_STATUS}\" — notifications ` +\n          `already go to the operator only, so there is nothing to flip. Leaving the status ` +\n          `untouched.`,\n      ),\n      { exitCode: 2 },\n    );\n  }\n\n  await updateSiteField(base, row.id, STATUS_COLUMN, to!);\n\n  // Read it back. The write returning is NOT evidence the field changed.\n  const after = findSite(await listWebsites(base), deps.site);\n  if (!after) {\n    throw Object.assign(new Error(`${row.name} vanished from Websites during the flip.`), {\n      exitCode: 1,\n    });\n  }\n  return {\n    site: after.name,\n    status: after.status,\n    target: describeNotifyTarget(after),\n    flip: { from: row.status, to: to!, confirmed: after.status === to },\n  };\n}\n","import {\n  formsNotifyTarget,\n  LIVE_STATUS,\n  VERIFY_STATUS,\n  type FormsNotifyTargetResult,\n} from \"../../recipes/forms-notify-target.js\";\n\nexport type FormsNotifyTargetCommandOptions = {\n  set?: string;\n  restore?: string;\n  cwd?: string;\n};\n\nconst AUDIENCE_LABEL = {\n  client: \"THE CLIENT\",\n  operator: \"OPERATOR ONLY\",\n  nobody: \"NOBODY\",\n} as const;\n\n/** The line that decides whether it is safe to test-submit. Deliberately the\n *  loudest thing on screen: the incident happened because the answer was\n *  invisible, not because it was subtle. */\nexport function formatNotifyTarget(r: FormsNotifyTargetResult): string {\n  const lines: string[] = [];\n  if (r.flip) {\n    const arrow = `${r.flip.from ?? \"blank\"} → ${r.flip.to}`;\n    lines.push(\n      r.flip.confirmed\n        ? `${r.site}  Status: ${arrow}  ✓ confirmed by read-back`\n        : `${r.site}  Status: ${arrow}  ✗ NOT CONFIRMED — the row still reads \"${r.status ?? \"blank\"}\". Nothing was verified; do not test-submit.`,\n    );\n  } else {\n    lines.push(`${r.site}  Status: ${r.status ?? \"blank\"}`);\n  }\n\n  lines.push(`A submission right now would notify: ${AUDIENCE_LABEL[r.target.audience]}`);\n  if (r.target.to.length > 0) lines.push(`  to: ${r.target.to.join(\", \")}`);\n  if (r.target.cc.length > 0) lines.push(`  cc: ${r.target.cc.join(\", \")}`);\n  lines.push(`  ${r.target.reason}`);\n\n  if (r.target.audience === \"client\") {\n    lines.push(\n      \"\",\n      `⚠️  A test submission WILL email the client, and email cannot be recalled.`,\n      `   Route it to yourself first:  reddoor forms-notify-target ${r.site} --set on`,\n    );\n  }\n  if (r.flip?.confirmed && r.flip.to === VERIFY_STATUS) {\n    lines.push(\n      \"\",\n      `Safe to test. When you are done, restore it:`,\n      `  reddoor forms-notify-target ${r.site} --set off --restore ${r.flip.from ?? LIVE_STATUS}`,\n    );\n  }\n  return lines.join(\"\\n\");\n}\n\n/**\n * `forms-notify-target <site>` — show who a form submission would email, and\n * optionally flip the pre-launch guard with a read-back confirmation.\n *\n * Read-only by default: answering the question must never be riskier than not\n * asking it.\n */\nexport async function runFormsNotifyTargetCommand(\n  site: string | undefined,\n  opts: FormsNotifyTargetCommandOptions,\n): Promise<{ output: string; code: number }> {\n  if (!site?.trim()) {\n    return { output: \"forms-notify-target requires <site> (slug or Airtable name)\", code: 2 };\n  }\n  const set = opts.set?.trim().toLowerCase();\n  if (set !== undefined && set !== \"on\" && set !== \"off\") {\n    return { output: `--set must be 'on' or 'off' (got '${opts.set}')`, code: 2 };\n  }\n  try {\n    const result = await formsNotifyTarget({\n      site: site.trim(),\n      ...(set ? { set: set as \"on\" | \"off\" } : {}),\n      ...(opts.restore ? { restore: opts.restore } : {}),\n    });\n    // An unconfirmed flip must not exit 0: a script (or a person skimming) that\n    // reads exit status would otherwise take \"I flipped it\" on faith, which is\n    // exactly the assumption that sent a client a test lead.\n    return {\n      output: formatNotifyTarget(result),\n      code: result.flip && !result.flip.confirmed ? 1 : 0,\n    };\n  } catch (err) {\n    const e = err as { message?: string; exitCode?: number };\n    return { output: e.message ?? String(err), code: e.exitCode ?? 1 };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAcA,IAAM,sBAAsB,KAAK,KAAK,KAAK,KAAK;;;ACGhD,SAAS,WAAW,MAAiC;AACnD,SAAO,KAAK,kBAAkB,KAAK,sBAAsB;AAC3D;AAGA,SAAS,oBAAoB,GAA4C;AACvE,QAAM,MAAM,MAAM,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC;AAC9C,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,MAAgB,CAAC;AACvB,aAAW,OAAO,KAAK;AACrB,QAAI,OAAO,QAAQ,SAAU;AAC7B,UAAM,IAAI,IAAI,KAAK;AACnB,QAAI,KAAK,CAAC,KAAK,IAAI,CAAC,GAAG;AACrB,WAAK,IAAI,CAAC;AACV,UAAI,KAAK,CAAC;AAAA,IACZ;AAAA,EACF;AACA,SAAO;AACT;AAeO,SAAS,kBAAkB,MAAkB,YAA8C;AAChG,MAAI,KAAK,WAAW,eAAe;AACjC,WAAO,EAAE,IAAI,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,EAAE;AAAA,EACzC;AACA,QAAM,UAAU,KAAK;AACrB,MAAI,SAAS;AACX,UAAM,QAAQ,iBAAiB,WAAW,WAAW,EAAE,QAAQ,KAAK;AACpE,UAAM,QAAQ,OAAO,UAAU,WAAW,QAAQ,OAAO,KAAK,IAAI;AAClE,UAAM,KAAK,oBAAoB,SAAS,QAAQ,OAAO;AACvD,QAAI,GAAG,SAAS,EAAG,QAAO,EAAE,IAAI,IAAI,oBAAoB,QAAQ,EAAE,EAAE;AAAA,EAEtE;AACA,QAAM,MAAM,WAAW,IAAI;AAC3B,SAAO,MAAM,EAAE,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI;AACvC;AAgBA,SAAS,gBAAgB,aAA2C;AAClE,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,cAAc;AAAA,IACd,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA,IACN,OAAO;AAAA,IACP,OAAO;AAAA,IACP,SAAS;AAAA,IACT;AAAA,IACA,WAAW;AAAA,IACX,KAAK;AAAA,IACL,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,cAAc;AAAA,IACd,iBAAiB;AAAA,EACnB;AACF;AAmBO,SAAS,qBAAqB,MAAgC;AACnE,MAAI,KAAK,WAAW,eAAe;AACjC,UAAM,UAAU,kBAAkB,MAAM,gBAAgB,IAAI,CAAC;AAC7D,WAAO;AAAA,MACL,UAAU;AAAA,MACV,IAAI,SAAS,MAAM,CAAC;AAAA,MACpB,IAAI,CAAC;AAAA,MACL,QAAQ,aAAa,KAAK,WAAW,OAAO,UAAU,IAAI,KAAK,MAAM,GAAG;AAAA,IAC1E;AAAA,EACF;AAEA,QAAM,UAAU,KAAK;AACrB,MAAI,CAAC,SAAS;AACZ,UAAM,SAAS,kBAAkB,MAAM,gBAAgB,IAAI,CAAC;AAC5D,QAAI,CAAC,UAAU,OAAO,GAAG,WAAW,GAAG;AACrC,aAAO;AAAA,QACL,UAAU;AAAA,QACV,IAAI,CAAC;AAAA,QACL,IAAI,CAAC;AAAA,QACL,QAAQ;AAAA,MACV;AAAA,IACF;AACA,WAAO;AAAA,MACL,UAAU;AAAA,MACV,IAAI,OAAO;AAAA,MACX,IAAI,OAAO;AAAA,MACX,QAAQ;AAAA,IACV;AAAA,EACF;AAIA,QAAM,KAAK,oBAAI,IAAY;AAC3B,QAAM,KAAK,oBAAI,IAAY;AAC3B,QAAM,SAAS,CAAC,GAAG,OAAO,KAAK,QAAQ,MAAM,GAAG,iBAAgB;AAChE,aAAW,SAAS,QAAQ;AAC1B,UAAM,IAAI,kBAAkB,MAAM,gBAAgB,KAAK,UAAU,EAAE,CAAC,QAAQ,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC;AAC7F,OAAG,GAAG,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAC9B,OAAG,GAAG,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAAA,EAChC;AACA,MAAI,GAAG,SAAS,GAAG;AACjB,WAAO;AAAA,MACL,UAAU;AAAA,MACV,IAAI,CAAC;AAAA,MACL,IAAI,CAAC;AAAA,MACL,QAAQ,mDAAmD,QAAQ,KAAK;AAAA,IAC1E;AAAA,EACF;AACA,SAAO;AAAA,IACL,UAAU;AAAA,IACV,IAAI,CAAC,GAAG,EAAE;AAAA,IACV,IAAI,CAAC,GAAG,EAAE;AAAA,IACV,QAAQ,mDAAmD,QAAQ,KAAK;AAAA,EAC1E;AACF;AAiBA,SAAS,iBAAiB,KAA6C;AACrE,MAAI,CAAC,IAAK,QAAO,CAAC;AAClB,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,QAAI,UAAU,OAAO,WAAW,YAAY,CAAC,MAAM,QAAQ,MAAM,GAAG;AAClE,aAAO;AAAA,IACT;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO,CAAC;AACV;;;AC3LO,IAAM,gBAAgB;AAMtB,IAAM,cAAsB;AAC5B,IAAM,gBAAwB;AAqBrC,SAAS,SAAS,MAAoB,MAAsC;AAC1E,QAAM,SAAS,KAAK,KAAK,EAAE,YAAY;AACvC,SAAO,KAAK;AAAA,IACV,CAAC,MAAM,SAAS,EAAE,IAAI,MAAM,SAAS,IAAI,KAAK,EAAE,KAAK,KAAK,EAAE,YAAY,MAAM;AAAA,EAChF;AACF;AAYA,eAAsB,kBACpB,MACkC;AAClC,QAAM,OAAO,KAAK,QAAQ,SAAS,mBAAmB,CAAC;AACvD,QAAM,OAAO,MAAM,aAAa,IAAI;AACpC,QAAM,MAAM,SAAS,MAAM,KAAK,IAAI;AACpC,MAAI,CAAC,KAAK;AAIR,UAAM,SAAS,SAAS,KAAK,IAAI;AACjC,UAAM,OAAO,KACV,IAAI,CAAC,MAAM,EAAE,IAAI,EACjB,OAAO,CAAC,MAAM,SAAS,CAAC,EAAE,SAAS,MAAM,KAAK,OAAO,SAAS,SAAS,CAAC,CAAC,CAAC;AAC7E,UAAM,OAAO;AAAA,MACX,IAAI;AAAA,QACF,4BAA4B,KAAK,IAAI,mFAElC,KAAK,SAAS,IAAI,kBAAkB,KAAK,KAAK,IAAI,CAAC,MAAM;AAAA,MAC9D;AAAA,MACA,EAAE,UAAU,EAAE;AAAA,IAChB;AAAA,EACF;AAEA,MAAI,CAAC,KAAK,KAAK;AACb,WAAO,EAAE,MAAM,IAAI,MAAM,QAAQ,IAAI,QAAQ,QAAQ,qBAAqB,GAAG,EAAE;AAAA,EACjF;AAEA,QAAM,KAAK,KAAK,QAAQ,OAAO,gBAAiB,KAAK,SAAS,KAAK;AACnE,MAAI,KAAK,QAAQ,SAAS,CAAC,IAAI;AAC7B,UAAM,OAAO;AAAA,MACX,IAAI;AAAA,QACF,4FACe,WAAW;AAAA,MAG5B;AAAA,MACA,EAAE,UAAU,EAAE;AAAA,IAChB;AAAA,EACF;AAIA,MAAI,KAAK,QAAQ,QAAQ,IAAI,WAAW,aAAa;AACnD,UAAM,OAAO;AAAA,MACX,IAAI;AAAA,QACF,GAAG,IAAI,IAAI,QAAQ,IAAI,UAAU,OAAO,WAAW,WAAW;AAAA,MAGhE;AAAA,MACA,EAAE,UAAU,EAAE;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,gBAAgB,MAAM,IAAI,IAAI,eAAe,EAAG;AAGtD,QAAM,QAAQ,SAAS,MAAM,aAAa,IAAI,GAAG,KAAK,IAAI;AAC1D,MAAI,CAAC,OAAO;AACV,UAAM,OAAO,OAAO,IAAI,MAAM,GAAG,IAAI,IAAI,0CAA0C,GAAG;AAAA,MACpF,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AACA,SAAO;AAAA,IACL,MAAM,MAAM;AAAA,IACZ,QAAQ,MAAM;AAAA,IACd,QAAQ,qBAAqB,KAAK;AAAA,IAClC,MAAM,EAAE,MAAM,IAAI,QAAQ,IAAS,WAAW,MAAM,WAAW,GAAG;AAAA,EACpE;AACF;;;ACjHA,IAAM,iBAAiB;AAAA,EACrB,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,QAAQ;AACV;AAKO,SAAS,mBAAmB,GAAoC;AACrE,QAAM,QAAkB,CAAC;AACzB,MAAI,EAAE,MAAM;AACV,UAAM,QAAQ,GAAG,EAAE,KAAK,QAAQ,OAAO,WAAM,EAAE,KAAK,EAAE;AACtD,UAAM;AAAA,MACJ,EAAE,KAAK,YACH,GAAG,EAAE,IAAI,aAAa,KAAK,oCAC3B,GAAG,EAAE,IAAI,aAAa,KAAK,sDAA4C,EAAE,UAAU,OAAO;AAAA,IAChG;AAAA,EACF,OAAO;AACL,UAAM,KAAK,GAAG,EAAE,IAAI,aAAa,EAAE,UAAU,OAAO,EAAE;AAAA,EACxD;AAEA,QAAM,KAAK,wCAAwC,eAAe,EAAE,OAAO,QAAQ,CAAC,EAAE;AACtF,MAAI,EAAE,OAAO,GAAG,SAAS,EAAG,OAAM,KAAK,SAAS,EAAE,OAAO,GAAG,KAAK,IAAI,CAAC,EAAE;AACxE,MAAI,EAAE,OAAO,GAAG,SAAS,EAAG,OAAM,KAAK,SAAS,EAAE,OAAO,GAAG,KAAK,IAAI,CAAC,EAAE;AACxE,QAAM,KAAK,KAAK,EAAE,OAAO,MAAM,EAAE;AAEjC,MAAI,EAAE,OAAO,aAAa,UAAU;AAClC,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA,+DAA+D,EAAE,IAAI;AAAA,IACvE;AAAA,EACF;AACA,MAAI,EAAE,MAAM,aAAa,EAAE,KAAK,OAAO,eAAe;AACpD,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA,iCAAiC,EAAE,IAAI,wBAAwB,EAAE,KAAK,QAAQ,WAAW;AAAA,IAC3F;AAAA,EACF;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;AASA,eAAsB,4BACpB,MACA,MAC2C;AAC3C,MAAI,CAAC,MAAM,KAAK,GAAG;AACjB,WAAO,EAAE,QAAQ,+DAA+D,MAAM,EAAE;AAAA,EAC1F;AACA,QAAM,MAAM,KAAK,KAAK,KAAK,EAAE,YAAY;AACzC,MAAI,QAAQ,UAAa,QAAQ,QAAQ,QAAQ,OAAO;AACtD,WAAO,EAAE,QAAQ,qCAAqC,KAAK,GAAG,MAAM,MAAM,EAAE;AAAA,EAC9E;AACA,MAAI;AACF,UAAM,SAAS,MAAM,kBAAkB;AAAA,MACrC,MAAM,KAAK,KAAK;AAAA,MAChB,GAAI,MAAM,EAAE,IAAyB,IAAI,CAAC;AAAA,MAC1C,GAAI,KAAK,UAAU,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,IAClD,CAAC;AAID,WAAO;AAAA,MACL,QAAQ,mBAAmB,MAAM;AAAA,MACjC,MAAM,OAAO,QAAQ,CAAC,OAAO,KAAK,YAAY,IAAI;AAAA,IACpD;AAAA,EACF,SAAS,KAAK;AACZ,UAAM,IAAI;AACV,WAAO,EAAE,QAAQ,EAAE,WAAW,OAAO,GAAG,GAAG,MAAM,EAAE,YAAY,EAAE;AAAA,EACnE;AACF;","names":[]}

package/dist/github-signals-G4ILZAJ6.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/audits/github-signals.ts","../src/cli/commands/github-signals.ts"],"sourcesContent":["import type { Site } from \"../types.js\";\nimport type { CiState, PullRequestSummary } from \"../github/gh.js\";\nimport { isFailingRenovatePR } from \"../alerts/renovate.js\";\n\n/** One swept row, ready for the Airtable writer (slug-keyed by `site`). */\nexport type GitHubSignalsRow = {\n  site: string; // the site name/slug the writer matches on\n  repo: string; // owner/repo\n  renovateFailingCis: number;\n  ciState: CiState;\n  lastCommitAt: string | null;\n};\n\n/** Injected GitHub reads (so the sweep is pure + testable). */\nexport type GitHubSignalsDeps = {\n  openPullRequests: (repo: string) => Promise<PullRequestSummary[]>;\n  defaultBranchStatus: (repo: string) => Promise<{ ciState: CiState; lastCommitAt: string | null }>;\n};\n\n/** Per repo-backed site: count its failing Renovate PRs + read its default-branch\n *  status. Sites without `gitRepo` are skipped (not errors). A repo whose probe\n *  throws is reported via `onSkip` and produces no row — one GitHub hiccup never\n *  sinks the sweep. PURE over `deps`. */\nexport async function collectGitHubSignals(\n  sites: Site[],\n  deps: GitHubSignalsDeps,\n  onSkip: (s: { repo: string }) => void = () => {},\n): Promise<GitHubSignalsRow[]> {\n  const rows: GitHubSignalsRow[] = [];\n  for (const s of sites) {\n    const repo = s.gitRepo;\n    if (!repo) continue;\n    const name = s.name;\n    if (!name) continue;\n    try {\n      const prs = await deps.openPullRequests(repo);\n      const status = await deps.defaultBranchStatus(repo);\n      rows.push({\n        site: name,\n        repo,\n        renovateFailingCis: prs.filter(isFailingRenovatePR).length,\n        ciState: status.ciState,\n        lastCommitAt: status.lastCommitAt,\n      });\n    } catch {\n      onSkip({ repo });\n    }\n  }\n  return rows;\n}\n","import { openBase, readAirtableConfig } from \"../../reports/airtable/client.js\";\nimport { listWebsites, siteSlug, updateGitHubSignals } from \"../../reports/airtable/websites.js\";\nimport type { Site } from \"../../types.js\";\nimport { collectGitHubSignals } from \"../../audits/github-signals.js\";\nimport { makeGitHub } from \"../../github/gh.js\";\nimport {\n  formatFleetWriteSummary,\n  type FleetWriteResult,\n} from \"../../audits/write-audits-to-airtable.js\";\nimport { detectSignalEvents, fleetSweptEvent } from \"../../audits/fleet-event-detectors.js\";\nimport { recordFleetEventsBestEffort } from \"../../audits/fleet-events-writer.js\";\nimport type { FleetEvent } from \"../../db/fleet-events.js\";\n\n/** Exit code for a fleet github-signals run. Exit 1 when failures are the\n *  MAJORITY of the fleet (`failed > written`), not only on a total wipeout —\n *  a run where 11/12 repos failed but 1 wrote should still signal an outage.\n *  All-success or a minority of flakes (e.g. 1/12 failed) stays exit 0. The\n *  no-token clean-skip returns 0 separately (before any probe runs). */\nexport function githubSignalsExitCode(written: number, failed: number): number {\n  return failed > written ? 1 : 0;\n}\n\n/** `github-signals --fleet --write-airtable`: sweep every repo-backed site for its\n *  Renovate-failing count + default-branch CI state + last-commit date, write each\n *  row serially (Airtable ~5 req/sec), and emit FLEET_WRITE_SUMMARY for CI. A\n *  missing fleet token is a clean skip (local runs), not a failure. */\nexport async function runGitHubSignalsCommand(opts: {\n  fleet?: boolean | undefined;\n  writeAirtable?: boolean | undefined;\n}): Promise<{ output: string; code: number }> {\n  if (!opts.fleet || !opts.writeAirtable) {\n    return { output: \"github-signals currently supports only --fleet --write-airtable\", code: 2 };\n  }\n  const token = process.env.RENOVATE_TOKEN?.trim() || process.env.GH_TOKEN?.trim();\n  if (!token) {\n    return {\n      output: \"github-signals skipped: no RENOVATE_TOKEN/GH_TOKEN (fleet read) configured.\",\n      code: 0,\n    };\n  }\n  const base = openBase(readAirtableConfig());\n  const websites = await listWebsites(base);\n  const gh = makeGitHub({ token });\n  const sites: Site[] = websites.map((w) => ({\n    path: \"\",\n    name: w.name,\n    meta: {},\n    ...(w.gitRepo ? { gitRepo: w.gitRepo } : {}),\n  }));\n\n  const skipped: string[] = [];\n  const rows = await collectGitHubSignals(\n    sites,\n    {\n      openPullRequests: (r) => gh.openPullRequests(r),\n      defaultBranchStatus: (r) => gh.defaultBranchStatus(r),\n    },\n    ({ repo }) => skipped.push(repo),\n  );\n\n  const sweptAt = new Date().toISOString();\n  const result: FleetWriteResult = { written: [], failed: [] };\n  const byRepo = new Map(websites.filter((w) => w.gitRepo).map((w) => [w.gitRepo, w]));\n  const events: FleetEvent[] = [];\n  const sweptMs = Date.parse(sweptAt);\n  const since24h = new Date(sweptMs - 24 * 60 * 60 * 1000).toISOString();\n  // Serial: Airtable's ~5 req/sec limit (matches writeFleetAuditsToAirtable).\n  for (const row of rows) {\n    const target = byRepo.get(row.repo);\n    if (!target) {\n      result.failed.push({ slug: siteSlug(row.site), error: \"no Websites row matched\" });\n      continue;\n    }\n    try {\n      await updateGitHubSignals(base, target.id, {\n        renovateFailingCis: row.renovateFailingCis,\n        ciState: row.ciState,\n        lastCommitAt: row.lastCommitAt,\n        sweptAt,\n      });\n      result.written.push({\n        siteName: target.name,\n        writes: [{ audit: \"github-signals\", counts: row }],\n      });\n      // Fleet-activity events for this repo: merged Renovate PRs since the last sweep\n      // (watermark = the row's prior GitHub Signals At, else a 24h fallback) + a\n      // CI-recovered transition. A PR-fetch hiccup drops only this repo's PR events.\n      const since = target.githubSignalsAt ?? since24h;\n      let merged: Awaited<ReturnType<typeof gh.mergedRenovatePullRequests>> = [];\n      try {\n        merged = await gh.mergedRenovatePullRequests(row.repo, since);\n      } catch {\n        // PR list unavailable this run — skip pr_automerged for this repo, keep ci_recovered\n      }\n      events.push(...detectSignalEvents(target, row, merged, sweptAt));\n    } catch (e) {\n      result.failed.push({ slug: siteSlug(row.site), error: (e as Error).message });\n    }\n  }\n  for (const repo of skipped) result.failed.push({ slug: repo, error: \"probe failed (skipped)\" });\n\n  events.push(fleetSweptEvent(\"github-signals\", result.written.length, sweptAt));\n  await recordFleetEventsBestEffort(events, new Date());\n\n  // Exit non-zero when failures are the MAJORITY of the fleet, not only on a\n  // total wipeout. A run where 11/12 repos failed but 1 wrote used to return 0,\n  // masking a large outage. The nightly cron step is `continue-on-error`, so a\n  // non-zero here is an operator-visibility signal, not a red build.\n  return {\n    output: formatFleetWriteSummary(result),\n    code: githubSignalsExitCode(result.written.length, result.failed.length),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuBA,eAAsB,qBACpB,OACA,MACA,SAAwC,MAAM;AAAC,GAClB;AAC7B,QAAM,OAA2B,CAAC;AAClC,aAAW,KAAK,OAAO;AACrB,UAAM,OAAO,EAAE;AACf,QAAI,CAAC,KAAM;AACX,UAAM,OAAO,EAAE;AACf,QAAI,CAAC,KAAM;AACX,QAAI;AACF,YAAM,MAAM,MAAM,KAAK,iBAAiB,IAAI;AAC5C,YAAM,SAAS,MAAM,KAAK,oBAAoB,IAAI;AAClD,WAAK,KAAK;AAAA,QACR,MAAM;AAAA,QACN;AAAA,QACA,oBAAoB,IAAI,OAAO,mBAAmB,EAAE;AAAA,QACpD,SAAS,OAAO;AAAA,QAChB,cAAc,OAAO;AAAA,MACvB,CAAC;AAAA,IACH,QAAQ;AACN,aAAO,EAAE,KAAK,CAAC;AAAA,IACjB;AAAA,EACF;AACA,SAAO;AACT;;;AC/BO,SAAS,sBAAsB,SAAiB,QAAwB;AAC7E,SAAO,SAAS,UAAU,IAAI;AAChC;AAMA,eAAsB,wBAAwB,MAGA;AAC5C,MAAI,CAAC,KAAK,SAAS,CAAC,KAAK,eAAe;AACtC,WAAO,EAAE,QAAQ,mEAAmE,MAAM,EAAE;AAAA,EAC9F;AACA,QAAM,QAAQ,QAAQ,IAAI,gBAAgB,KAAK,KAAK,QAAQ,IAAI,UAAU,KAAK;AAC/E,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,MAAM;AAAA,IACR;AAAA,EACF;AACA,QAAM,OAAO,SAAS,mBAAmB,CAAC;AAC1C,QAAM,WAAW,MAAM,aAAa,IAAI;AACxC,QAAM,KAAK,WAAW,EAAE,MAAM,CAAC;AAC/B,QAAM,QAAgB,SAAS,IAAI,CAAC,OAAO;AAAA,IACzC,MAAM;AAAA,IACN,MAAM,EAAE;AAAA,IACR,MAAM,CAAC;AAAA,IACP,GAAI,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5C,EAAE;AAEF,QAAM,UAAoB,CAAC;AAC3B,QAAM,OAAO,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,MACE,kBAAkB,CAAC,MAAM,GAAG,iBAAiB,CAAC;AAAA,MAC9C,qBAAqB,CAAC,MAAM,GAAG,oBAAoB,CAAC;AAAA,IACtD;AAAA,IACA,CAAC,EAAE,KAAK,MAAM,QAAQ,KAAK,IAAI;AAAA,EACjC;AAEA,QAAM,WAAU,oBAAI,KAAK,GAAE,YAAY;AACvC,QAAM,SAA2B,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAC,EAAE;AAC3D,QAAM,SAAS,IAAI,IAAI,SAAS,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;AACnF,QAAM,SAAuB,CAAC;AAC9B,QAAM,UAAU,KAAK,MAAM,OAAO;AAClC,QAAM,WAAW,IAAI,KAAK,UAAU,KAAK,KAAK,KAAK,GAAI,EAAE,YAAY;AAErE,aAAW,OAAO,MAAM;AACtB,UAAM,SAAS,OAAO,IAAI,IAAI,IAAI;AAClC,QAAI,CAAC,QAAQ;AACX,aAAO,OAAO,KAAK,EAAE,MAAM,SAAS,IAAI,IAAI,GAAG,OAAO,0BAA0B,CAAC;AACjF;AAAA,IACF;AACA,QAAI;AACF,YAAM,oBAAoB,MAAM,OAAO,IAAI;AAAA,QACzC,oBAAoB,IAAI;AAAA,QACxB,SAAS,IAAI;AAAA,QACb,cAAc,IAAI;AAAA,QAClB;AAAA,MACF,CAAC;AACD,aAAO,QAAQ,KAAK;AAAA,QAClB,UAAU,OAAO;AAAA,QACjB,QAAQ,CAAC,EAAE,OAAO,kBAAkB,QAAQ,IAAI,CAAC;AAAA,MACnD,CAAC;AAID,YAAM,QAAQ,OAAO,mBAAmB;AACxC,UAAI,SAAoE,CAAC;AACzE,UAAI;AACF,iBAAS,MAAM,GAAG,2BAA2B,IAAI,MAAM,KAAK;AAAA,MAC9D,QAAQ;AAAA,MAER;AACA,aAAO,KAAK,GAAG,mBAAmB,QAAQ,KAAK,QAAQ,OAAO,CAAC;AAAA,IACjE,SAAS,GAAG;AACV,aAAO,OAAO,KAAK,EAAE,MAAM,SAAS,IAAI,IAAI,GAAG,OAAQ,EAAY,QAAQ,CAAC;AAAA,IAC9E;AAAA,EACF;AACA,aAAW,QAAQ,QAAS,QAAO,OAAO,KAAK,EAAE,MAAM,MAAM,OAAO,yBAAyB,CAAC;AAE9F,SAAO,KAAK,gBAAgB,kBAAkB,OAAO,QAAQ,QAAQ,OAAO,CAAC;AAC7E,QAAM,4BAA4B,QAAQ,oBAAI,KAAK,CAAC;AAMpD,SAAO;AAAA,IACL,QAAQ,wBAAwB,MAAM;AAAA,IACtC,MAAM,sBAAsB,OAAO,QAAQ,QAAQ,OAAO,OAAO,MAAM;AAAA,EACzE;AACF;","names":[]}

package/dist/header-image-T7XD37JL.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/cli/commands/header-image.ts"],"sourcesContent":["import { mkdir, writeFile } from \"node:fs/promises\";\nimport { resolve } from \"node:path\";\nimport { openBase, readAirtableConfig } from \"../../reports/airtable/client.js\";\nimport { listWebsites, siteSlug, ACTIVE_STATUSES } from \"../../reports/airtable/websites.js\";\nimport type { WebsiteRow } from \"../../reports/airtable/websites.js\";\nimport { uploadAttachment } from \"../../reports/airtable/attachments.js\";\nimport { generateHeaderImage } from \"../../reports/header-image/index.js\";\n\nexport type HeaderImageOptions = {\n  all?: boolean;\n  force?: boolean;\n  writeAirtable?: boolean;\n  outDir?: string;\n  settleMs?: string;\n};\n\n/** Which rows this invocation should act on. Pure, so it is unit-tested. */\nexport function resolveTargets(\n  rows: readonly WebsiteRow[],\n  // `| undefined` spelled out because `exactOptionalPropertyTypes` otherwise\n  // rejects the caller passing through possibly-undefined CLI flags.\n  opts: { site?: string | undefined; all?: boolean | undefined; force?: boolean | undefined },\n): WebsiteRow[] {\n  if (opts.site) {\n    const want = siteSlug(opts.site);\n    return rows.filter((r) => siteSlug(r.name) === want);\n  }\n  if (!opts.all) return [];\n  return rows.filter((r) => {\n    if (!r.url) return false;\n    if (r.status === null || !ACTIVE_STATUSES.has(r.status)) return false;\n    return opts.force ? true : !r.headerImage;\n  });\n}\n\n/** Parse the `--settle-ms <ms>` flag. Unset → undefined (the generator's own\n *  default settle). `Number(\"abc\")` is NaN, which would sail through as a NaN\n *  timeout and silently skip the settle entirely, so anything non-finite or\n *  negative is rejected up front rather than producing a subtly-wrong capture. */\nexport function parseSettleMs(value: string | undefined): number | undefined {\n  if (value === undefined) return undefined;\n  const n = Number(value);\n  if (!Number.isFinite(n) || n < 0) {\n    throw Object.assign(\n      new Error(`--settle-ms must be a non-negative number of milliseconds, got \"${value}\"`),\n      { exitCode: 2 },\n    );\n  }\n  return n;\n}\n\n/** Injected in tests so the file-writing branch can be exercised without\n *  driving a real browser (mirrors `GenerateInput.shooter`). */\ntype Generate = typeof generateHeaderImage;\n\n/**\n * Generate a header image per target row and either upload it to Airtable or\n * write it locally for review. Split out of {@link runHeaderImageCommand} so\n * the local-output path is testable without an Airtable base.\n */\nexport async function generateForTargets(\n  targets: readonly WebsiteRow[],\n  opts: HeaderImageOptions,\n  generate: Generate = generateHeaderImage,\n): Promise<{ output: string; code: number }> {\n  const outDir = resolve(opts.outDir ?? \"reports\");\n  const settleMs = parseSettleMs(opts.settleMs);\n  // `reports/` does not exist on a fresh checkout, so the writeFile() below\n  // would throw ENOENT for the first operator to run the default (local) path.\n  // Create it once, before the loop, rather than per site.\n  if (!opts.writeAirtable) await mkdir(outDir, { recursive: true });\n\n  const lines: string[] = [];\n  let failed = 0;\n\n  for (const row of targets) {\n    try {\n      const gen = await generate({\n        url: row.url,\n        slug: siteSlug(row.name),\n        // `exactOptionalPropertyTypes` rejects an explicit `settleMs: undefined`\n        // against `settleMs?: number`, so omit the key entirely when unset.\n        ...(settleMs === undefined ? {} : { settleMs }),\n      });\n      if (opts.writeAirtable) {\n        await uploadAttachment(row.id, \"Header image\", gen.bytes, gen.filename, gen.contentType);\n        lines.push(\n          `✔ ${row.name} — uploaded ${gen.filename} (${(gen.bytes.byteLength / 1024 / 1024).toFixed(2)} MB)`,\n        );\n      } else {\n        const path = resolve(outDir, gen.filename);\n        await writeFile(path, gen.bytes);\n        lines.push(`✔ ${row.name} — wrote ${path} (review, then re-run with --write-airtable)`);\n      }\n    } catch (err) {\n      failed++;\n      lines.push(`✖ ${row.name} — ${err instanceof Error ? err.message : String(err)}`);\n    }\n  }\n\n  lines.push(`${targets.length - failed}/${targets.length} generated.`);\n  return { output: lines.join(\"\\n\"), code: failed > 0 ? 1 : 0 };\n}\n\n/**\n * `header-image [site]` — capture a site's live homepage and composite its\n * report header image. Defaults to writing the JPEG locally so the operator can\n * eyeball it; `--write-airtable` uploads it to the Websites row's Header image\n * field. `--all` backfills every live site that has no header image yet.\n */\nexport async function runHeaderImageCommand(\n  site: string | undefined,\n  opts: HeaderImageOptions,\n): Promise<{ output: string; code: number }> {\n  const base = openBase(readAirtableConfig());\n  const rows = await listWebsites(base);\n  const targets = resolveTargets(rows, { site, all: opts.all, force: opts.force });\n  if (targets.length === 0) {\n    return {\n      output: site ? `No site matched \"${site}\".` : \"No sites need a header image.\",\n      code: 1,\n    };\n  }\n  return generateForTargets(targets, opts);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA,SAAS,OAAO,iBAAiB;AACjC,SAAS,eAAe;AAgBjB,SAAS,eACd,MAGA,MACc;AACd,MAAI,KAAK,MAAM;AACb,UAAM,OAAO,SAAS,KAAK,IAAI;AAC/B,WAAO,KAAK,OAAO,CAAC,MAAM,SAAS,EAAE,IAAI,MAAM,IAAI;AAAA,EACrD;AACA,MAAI,CAAC,KAAK,IAAK,QAAO,CAAC;AACvB,SAAO,KAAK,OAAO,CAAC,MAAM;AACxB,QAAI,CAAC,EAAE,IAAK,QAAO;AACnB,QAAI,EAAE,WAAW,QAAQ,CAAC,gBAAgB,IAAI,EAAE,MAAM,EAAG,QAAO;AAChE,WAAO,KAAK,QAAQ,OAAO,CAAC,EAAE;AAAA,EAChC,CAAC;AACH;AAMO,SAAS,cAAc,OAA+C;AAC3E,MAAI,UAAU,OAAW,QAAO;AAChC,QAAM,IAAI,OAAO,KAAK;AACtB,MAAI,CAAC,OAAO,SAAS,CAAC,KAAK,IAAI,GAAG;AAChC,UAAM,OAAO;AAAA,MACX,IAAI,MAAM,mEAAmE,KAAK,GAAG;AAAA,MACrF,EAAE,UAAU,EAAE;AAAA,IAChB;AAAA,EACF;AACA,SAAO;AACT;AAWA,eAAsB,mBACpB,SACA,MACA,WAAqB,qBACsB;AAC3C,QAAM,SAAS,QAAQ,KAAK,UAAU,SAAS;AAC/C,QAAM,WAAW,cAAc,KAAK,QAAQ;AAI5C,MAAI,CAAC,KAAK,cAAe,OAAM,MAAM,QAAQ,EAAE,WAAW,KAAK,CAAC;AAEhE,QAAM,QAAkB,CAAC;AACzB,MAAI,SAAS;AAEb,aAAW,OAAO,SAAS;AACzB,QAAI;AACF,YAAM,MAAM,MAAM,SAAS;AAAA,QACzB,KAAK,IAAI;AAAA,QACT,MAAM,SAAS,IAAI,IAAI;AAAA;AAAA;AAAA,QAGvB,GAAI,aAAa,SAAY,CAAC,IAAI,EAAE,SAAS;AAAA,MAC/C,CAAC;AACD,UAAI,KAAK,eAAe;AACtB,cAAM,iBAAiB,IAAI,IAAI,gBAAgB,IAAI,OAAO,IAAI,UAAU,IAAI,WAAW;AACvF,cAAM;AAAA,UACJ,UAAK,IAAI,IAAI,oBAAe,IAAI,QAAQ,MAAM,IAAI,MAAM,aAAa,OAAO,MAAM,QAAQ,CAAC,CAAC;AAAA,QAC9F;AAAA,MACF,OAAO;AACL,cAAM,OAAO,QAAQ,QAAQ,IAAI,QAAQ;AACzC,cAAM,UAAU,MAAM,IAAI,KAAK;AAC/B,cAAM,KAAK,UAAK,IAAI,IAAI,iBAAY,IAAI,8CAA8C;AAAA,MACxF;AAAA,IACF,SAAS,KAAK;AACZ;AACA,YAAM,KAAK,UAAK,IAAI,IAAI,WAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAAA,IAClF;AAAA,EACF;AAEA,QAAM,KAAK,GAAG,QAAQ,SAAS,MAAM,IAAI,QAAQ,MAAM,aAAa;AACpE,SAAO,EAAE,QAAQ,MAAM,KAAK,IAAI,GAAG,MAAM,SAAS,IAAI,IAAI,EAAE;AAC9D;AAQA,eAAsB,sBACpB,MACA,MAC2C;AAC3C,QAAM,OAAO,SAAS,mBAAmB,CAAC;AAC1C,QAAM,OAAO,MAAM,aAAa,IAAI;AACpC,QAAM,UAAU,eAAe,MAAM,EAAE,MAAM,KAAK,KAAK,KAAK,OAAO,KAAK,MAAM,CAAC;AAC/E,MAAI,QAAQ,WAAW,GAAG;AACxB,WAAO;AAAA,MACL,QAAQ,OAAO,oBAAoB,IAAI,OAAO;AAAA,MAC9C,MAAM;AAAA,IACR;AAAA,EACF;AACA,SAAO,mBAAmB,SAAS,IAAI;AACzC;","names":[]}

package/dist/migrate-LJUFGXQZ.js

@@ -1,7 +0,0 @@
-import {
-  runMigrations
-} from "./chunk-4SOCPK7A.js";
-export {
-  runMigrations
-};
-//# sourceMappingURL=migrate-LJUFGXQZ.js.map

package/dist/orchestrate-KDNXZQX7.js

@@ -1,27 +0,0 @@
-import {
-  GLOBAL_REPORT_CC,
-  isProbablyEmail,
-  parseAddresses,
-  sendApprovedReports,
-  withGlobalCc
-} from "./chunk-COZPL62X.js";
-import "./chunk-GECESMVS.js";
-import "./chunk-6QRLRT3P.js";
-import "./chunk-MPBXOJ3N.js";
-import "./chunk-SEEA6RXF.js";
-import "./chunk-WEKL2HYJ.js";
-import "./chunk-QG6OSL4M.js";
-import "./chunk-DC5H7KEQ.js";
-import "./chunk-4SOCPK7A.js";
-import "./chunk-U5SZ4FOP.js";
-import "./chunk-577HCGZO.js";
-import "./chunk-HN6I2XWI.js";
-import "./chunk-6VAL7XJT.js";
-export {
-  GLOBAL_REPORT_CC,
-  isProbablyEmail,
-  parseAddresses,
-  sendApprovedReports,
-  withGlobalCc
-};
-//# sourceMappingURL=orchestrate-KDNXZQX7.js.map