@reddoorla/maintenance 0.85.2 → 0.86.0

package/dist/chunk-ITIOFN7A.js

@@ -0,0 +1,396 @@
+import {
+  MAINTENANCE_CHECKLIST,
+  TESTING_CHECKLIST
+} from "./chunk-VAD43MOR.js";
+import {
+  siteSlug
+} from "./chunk-LDWZSLSU.js";
+
+// src/db/import-airtable.ts
+var EXCLUDED_WEBSITE_FIELDS = /* @__PURE__ */ new Set([
+  // Dropped under D4's rule (empty everywhere + unreferenced), verified 2026-08-23.
+  "site host username",
+  "site host password",
+  "launch day",
+  "contract link",
+  // Plaintext credentials — operator ruling 2026-08-23: these live on ONLY in
+  // the frozen Airtable base. A new store does not inherit plaintext creds.
+  "DNS username",
+  "DNS password",
+  "cms username",
+  "cms password",
+  // Link columns: Turso joins by rec id (D1); the links carry no extra data.
+  "Reports",
+  "Submissions",
+  "Spam Screenouts",
+  // Regenerated into sites.header_image as a BLOB by the header-image CLI (D5);
+  // the Airtable attachment (an expiring signed URL) is never migrated.
+  "Header image"
+]);
+var s = (v) => {
+  if (v === void 0 || v === null) return null;
+  if (typeof v === "string") return v.trim() === "" ? null : v;
+  return String(v);
+};
+var n = (v) => typeof v === "number" ? v : null;
+var b01 = (v) => v === true ? 1 : 0;
+var b01n = (v) => typeof v === "boolean" ? v ? 1 : 0 : null;
+var json = (v) => v === void 0 ? null : JSON.stringify(v);
+var SITE_FIELDS = {
+  Name: "name",
+  url: "url",
+  Status: "status",
+  "point of contact": "point_of_contact",
+  "maintenence freq": "maintenance_freq",
+  // Airtable's misspelling dies at this boundary
+  "testing freq": "testing_freq",
+  "maintenance day": "maintenance_day",
+  "testing day": "testing_day",
+  "GA4 property ID": "ga4_property_id",
+  "Search query": "search_query",
+  "Search Console property": "search_console_property",
+  "Git repo": "git_repo",
+  "Netlify ID": "netlify_id",
+  "Report recipients (To)": "report_recipients_to",
+  "Report recipients (CC)": "report_recipients_cc",
+  "Copy \u2014 Intro": "copy_intro",
+  "Copy \u2014 Contact": "copy_contact",
+  "Copy \u2014 Footer": "copy_footer",
+  "Newsletter Webhook": "newsletter_webhook",
+  "Mailchimp API Key": "mailchimp_api_key",
+  "Mailchimp Audience ID": "mailchimp_audience_id",
+  "Notify Routing": "notify_routing",
+  "Prismic Ack Until": "prismic_ack_until",
+  "Launched at": "launched_at"
+};
+var HEALTH_FIELDS = {
+  pScore: "p_score",
+  rScore: "r_score",
+  bpScore: "bp_score",
+  seoScore: "seo_score",
+  "Last lighthouse audit at": "lighthouse_at",
+  "A11y Violations": "a11y_violations",
+  "Deps Drifted": "deps_drifted",
+  "Deps Major Behind": "deps_major_behind",
+  "Deps Outdated": "deps_outdated",
+  "Deps Major Outdated": "deps_major_outdated",
+  "Security Vulns Critical": "vulns_critical",
+  "Security Vulns High": "vulns_high",
+  "Security Vulns Moderate": "vulns_moderate",
+  "Security Vulns Low": "vulns_low",
+  "Last security audit at": "security_audit_at",
+  "Security advisories": "security_advisories",
+  "Security Auto-Fix Attempts": "auto_fix_attempts",
+  "Analytics soft-fail at": "analytics_soft_fail_at",
+  "Cert days remaining": "cert_days_remaining",
+  "Domain checked at": "domain_checked_at",
+  "Deploy status": "deploy_status",
+  "Last deploy at": "last_deploy_at",
+  "Deploy log URL": "deploy_log_url",
+  "Deploy checked at": "deploy_checked_at",
+  "Function health": "function_health",
+  "CMS Reachable": "cms_reachable",
+  "Turnstile widget": "turnstile_widget",
+  "Function health checked at": "function_health_checked_at",
+  "Broken links": "broken_links",
+  "Browser checked at": "browser_checked_at",
+  "Uptime Reachable": "uptime_reachable",
+  "Titles & Meta OK": "titles_meta_ok",
+  "Smoke OK": "smoke_ok",
+  "Last Smoke At": "last_smoke_at",
+  "Form E2E OK": "form_e2e_ok",
+  "Form E2E checked at": "form_e2e_checked_at",
+  "Renovate Failing CIs": "renovate_failing_cis",
+  "Default Branch CI": "default_branch_ci",
+  "Last Commit At": "last_commit_at",
+  "GitHub Signals At": "github_signals_at",
+  "Prismic Models": "prismic_models",
+  "Prismic Models Checked At": "prismic_models_checked_at",
+  "Prismic Models Drift": "prismic_models_drift"
+};
+var HEALTH_NUMERIC = /* @__PURE__ */ new Set([
+  "p_score",
+  "r_score",
+  "bp_score",
+  "seo_score",
+  "a11y_violations",
+  "deps_drifted",
+  "deps_major_behind",
+  "deps_outdated",
+  "deps_major_outdated",
+  "vulns_critical",
+  "vulns_high",
+  "vulns_moderate",
+  "vulns_low",
+  "auto_fix_attempts",
+  "cert_days_remaining",
+  "broken_links",
+  "renovate_failing_cis"
+]);
+var HEALTH_BOOLEAN = {
+  "Crossbrowser OK": "crossbrowser_ok",
+  "Mobile OK": "mobile_ok",
+  "Links OK": "links_ok"
+};
+var SCHEDULE_FIELDS = {
+  "Next maintenance at": "next_maintenance_at",
+  "Next testing at": "next_testing_at"
+};
+function healthColumnFor(field) {
+  const direct = HEALTH_FIELDS[field];
+  if (direct) return { col: direct, coerce: HEALTH_NUMERIC.has(direct) ? n : s };
+  const bool = HEALTH_BOOLEAN[field];
+  if (bool) return { col: bool, coerce: b01n };
+  return null;
+}
+function scheduleColumnFor(field) {
+  const col = SCHEDULE_FIELDS[field];
+  return col ? { col, coerce: s } : null;
+}
+function mapWebsiteRecord(rec, computedAt) {
+  const f = rec.fields;
+  const name = s(f["Name"]);
+  if (!name) throw new Error(`Websites ${rec.id}: blank Name \u2014 cannot derive a slug`);
+  const slug = siteSlug(name);
+  if (!slug) throw new Error(`Websites ${rec.id}: Name "${name}" yields an empty slug`);
+  const awcRaw = f["Accepted Watch Conditions"];
+  const awc = Array.isArray(awcRaw) ? awcRaw.filter((x) => typeof x === "string").map((x) => x.trim()).filter(Boolean) : typeof awcRaw === "string" ? awcRaw.split(/[\n,]/).map((x) => x.trim()).filter(Boolean) : [];
+  const site = {
+    id: rec.id,
+    slug,
+    name,
+    url: null,
+    status: null,
+    point_of_contact: null,
+    maintenance_freq: null,
+    testing_freq: null,
+    maintenance_day: null,
+    testing_day: null,
+    ga4_property_id: null,
+    search_query: null,
+    search_console_property: null,
+    git_repo: null,
+    netlify_id: null,
+    report_recipients_to: null,
+    report_recipients_cc: null,
+    copy_intro: null,
+    copy_contact: null,
+    copy_footer: null,
+    newsletter_webhook: null,
+    mailchimp_api_key: null,
+    mailchimp_audience_id: null,
+    notify_routing: null,
+    require_turnstile: b01(f["Require Turnstile"]),
+    accepted_watch_conditions: awc.length > 0 ? JSON.stringify(awc) : null,
+    prismic_ack_until: null,
+    launched_at: null,
+    legacy: null
+  };
+  for (const [field, col] of Object.entries(SITE_FIELDS)) {
+    if (col === "name") continue;
+    site[col] = s(f[field]);
+  }
+  const health = { site_id: rec.id };
+  for (const field of [...Object.keys(HEALTH_FIELDS), ...Object.keys(HEALTH_BOOLEAN)]) {
+    const m = healthColumnFor(field);
+    if (m) health[m.col] = m.coerce(f[field]);
+  }
+  const schedule = {
+    site_id: rec.id,
+    next_maintenance_at: s(f["Next maintenance at"]),
+    next_testing_at: s(f["Next testing at"]),
+    computed_at: computedAt
+  };
+  const claimed = /* @__PURE__ */ new Set([
+    "Name",
+    "Require Turnstile",
+    "Accepted Watch Conditions",
+    ...Object.keys(SITE_FIELDS),
+    ...Object.keys(HEALTH_FIELDS),
+    ...Object.keys(HEALTH_BOOLEAN),
+    ...Object.keys(SCHEDULE_FIELDS)
+  ]);
+  const legacy = {};
+  for (const [field, value] of Object.entries(f)) {
+    if (claimed.has(field) || EXCLUDED_WEBSITE_FIELDS.has(field)) continue;
+    legacy[field] = value;
+  }
+  site.legacy = Object.keys(legacy).length > 0 ? JSON.stringify(legacy) : null;
+  return { site, health, schedule };
+}
+var CHECKLIST_BY_FIELD = [
+  ...MAINTENANCE_CHECKLIST,
+  ...TESTING_CHECKLIST
+].map((i) => ({ field: i.field, key: i.key }));
+function mapReportRecord(rec, renderedHtml) {
+  const f = rec.fields;
+  const linkSites = f["Site"] ?? [];
+  const checklist = {};
+  for (const { field, key } of CHECKLIST_BY_FIELD) checklist[key] = Boolean(f[field]);
+  return {
+    id: rec.id,
+    site_id: linkSites[0] ?? null,
+    report_id: s(f["Report ID"]),
+    report_type: s(f["Report type"]),
+    period: s(f["Period"]),
+    period_start: s(f["Period start"]),
+    period_end: s(f["Period end"]),
+    completed_on: s(f["Completed on"]),
+    lighthouse_performance: n(f["Lighthouse \u2014 Performance"]),
+    lighthouse_accessibility: n(f["Lighthouse \u2014 Accessibility"]),
+    lighthouse_best_practices: n(f["Lighthouse \u2014 Best Practices"]),
+    lighthouse_seo: n(f["Lighthouse \u2014 SEO"]),
+    ga_users_current: n(f["GA users (period)"]),
+    ga_users_previous: n(f["GA users (prev period)"]),
+    search_found_page1: b01n(f["Search found page 1"]),
+    search_position: n(f["Search position"]),
+    last_tested_date: s(f["Last tested date"]),
+    commentary: s(f["Commentary"]),
+    subject_override: s(f["Subject override"]),
+    draft_ready: b01(f["Draft ready"]),
+    approved_to_send: b01(f["Approved to send"]),
+    approved_at: s(f["Approved At"]),
+    approved_by: s(f["Approved By"]),
+    send_override: b01(f["Send override"]),
+    override_reason: s(f["Override reason"]),
+    override_by: s(f["Override by"]),
+    override_at: s(f["Override at"]),
+    sent_at: s(f["Sent at"]),
+    delivery_status: s(f["Delivery status"]) ?? "pending",
+    resend_message_id: s(f["Resend message ID"]),
+    checklist: JSON.stringify(checklist),
+    // The Airtable cell is a long-text field, so the API hands us a STRING of
+    // JSON — store it verbatim. json() here would double-encode it, and
+    // parseAutoEvidence on the read side would then parse to a string and
+    // yield null (evidence silently lost). The non-string branch only exists
+    // for defensive completeness.
+    checklist_auto_evidence: typeof f["Checklist auto-evidence"] === "string" ? s(f["Checklist auto-evidence"]) : json(f["Checklist auto-evidence"] ?? void 0),
+    rendered_html: renderedHtml
+  };
+}
+function renderedHtmlUrl(rec) {
+  const atts = rec.fields["Rendered HTML"];
+  const url = atts?.[0]?.url;
+  return typeof url === "string" && url.length > 0 ? url : null;
+}
+var REAP_FLOOR = 5;
+var REAP_FRACTION = 0.1;
+function reapAllowance(stored) {
+  return Math.max(REAP_FLOOR, Math.ceil(stored * REAP_FRACTION));
+}
+function formatReapSummary(reaped) {
+  const lines = [];
+  for (const id of reaped.sites) {
+    lines.push(`\u2702 reaped sites ${id} (+ its health/schedule rows) \u2014 no longer in Airtable`);
+  }
+  for (const id of reaped.reports) {
+    lines.push(`\u2702 reaped reports ${id} \u2014 no longer in Airtable`);
+  }
+  for (const reason of reaped.refusals) lines.push(`\u26A0 ${reason}`);
+  lines.push(
+    `FLEET_REAP sites=${reaped.sites.length} reports=${reaped.reports.length} refused=${reaped.refusals.length}`
+  );
+  return lines;
+}
+function reapRefusal(table, incoming, stored, toReap) {
+  if (incoming === 0 && stored > 0) {
+    return `${table}: REFUSED to reap \u2014 Airtable returned 0 rows while ${stored} are stored; that is a failed read, not an empty fleet. Nothing deleted.`;
+  }
+  const allowed = reapAllowance(stored);
+  if (toReap > allowed) {
+    return `${table}: REFUSED to reap \u2014 ${toReap} rows are missing from Airtable, over the ${allowed}-row allowance for ${stored} stored. Nothing deleted; re-run, and if the deletions are real, remove them in smaller batches.`;
+  }
+  return null;
+}
+async function importFleetState(db, io, opts = {}) {
+  const computedAt = io.now().toISOString();
+  const websites = await io.listWebsiteRecords();
+  const mapped = websites.map((r) => mapWebsiteRecord(r, computedAt));
+  const slugOwner = /* @__PURE__ */ new Map();
+  for (const m of mapped) {
+    const prior = slugOwner.get(m.site.slug);
+    if (prior)
+      throw new Error(`slug collision: ${prior} and ${m.site.id} both map to '${m.site.slug}'`);
+    slugOwner.set(m.site.slug, m.site.id);
+  }
+  for (const { site, health, schedule } of mapped) {
+    await db.insertInto("sites").values(site).onConflict((oc) => oc.column("id").doUpdateSet(site)).execute();
+    await db.insertInto("site_health").values(health).onConflict((oc) => oc.column("site_id").doUpdateSet(health)).execute();
+    await db.insertInto("site_schedule").values(schedule).onConflict((oc) => oc.column("site_id").doUpdateSet(schedule)).execute();
+  }
+  const reports = await io.listReportRecords();
+  const alreadyStored = opts.reportHtml === "when-missing" ? new Set(
+    (await db.selectFrom("reports").select("id").where("rendered_html", "is not", null).execute()).map((r) => r.id)
+  ) : null;
+  const misses = [];
+  let fetched = 0;
+  let skipped = 0;
+  for (const rec of reports) {
+    const url = renderedHtmlUrl(rec);
+    const skip = url !== null && alreadyStored !== null && alreadyStored.has(rec.id);
+    if (skip) skipped++;
+    const html = url && !skip ? await io.fetchAttachment(url) : null;
+    if (url && !skip && html === null) misses.push(rec.id);
+    if (html !== null) fetched++;
+    const row = mapReportRecord(rec, html);
+    const { rendered_html: _rh, ...rowSansHtml } = row;
+    void _rh;
+    await db.insertInto("reports").values(row).onConflict((oc) => oc.column("id").doUpdateSet(html !== null ? row : rowSansHtml)).execute();
+  }
+  const reaped = { sites: [], reports: [], refusals: [] };
+  const liveSiteIds = new Set(mapped.map((m) => m.site.id));
+  const storedSites = (await db.selectFrom("sites").select("id").execute()).map(
+    (r) => String(r.id)
+  );
+  const staleSites = storedSites.filter((id) => !liveSiteIds.has(id)).sort();
+  const siteRefusal = reapRefusal("sites", websites.length, storedSites.length, staleSites.length);
+  if (siteRefusal) reaped.refusals.push(siteRefusal);
+  else if (staleSites.length > 0) {
+    await db.deleteFrom("site_health").where("site_id", "in", staleSites).execute();
+    await db.deleteFrom("site_schedule").where("site_id", "in", staleSites).execute();
+    await db.deleteFrom("sites").where("id", "in", staleSites).execute();
+    reaped.sites = staleSites;
+  }
+  const liveReportIds = new Set(reports.map((r) => r.id));
+  const storedReports = (await db.selectFrom("reports").select("id").execute()).map(
+    (r) => String(r.id)
+  );
+  const staleReports = storedReports.filter((id) => !liveReportIds.has(id)).sort();
+  const reportRefusal = reapRefusal(
+    "reports",
+    reports.length,
+    storedReports.length,
+    staleReports.length
+  );
+  if (reportRefusal) reaped.refusals.push(reportRefusal);
+  else if (staleReports.length > 0) {
+    await db.deleteFrom("reports").where("id", "in", staleReports).execute();
+    reaped.reports = staleReports;
+  }
+  return {
+    sites: mapped.length,
+    reports: reports.length,
+    renderedHtmlMisses: misses,
+    renderedHtmlFetched: fetched,
+    renderedHtmlSkipped: skipped,
+    reaped
+  };
+}
+
+export {
+  EXCLUDED_WEBSITE_FIELDS,
+  SITE_FIELDS,
+  HEALTH_FIELDS,
+  HEALTH_BOOLEAN,
+  SCHEDULE_FIELDS,
+  healthColumnFor,
+  scheduleColumnFor,
+  mapWebsiteRecord,
+  mapReportRecord,
+  renderedHtmlUrl,
+  reapAllowance,
+  formatReapSummary,
+  reapRefusal,
+  importFleetState
+};
+//# sourceMappingURL=chunk-ITIOFN7A.js.map

package/dist/chunk-ITIOFN7A.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/db/import-airtable.ts"],"sourcesContent":["import type { Db } from \"./client.js\";\nimport type { SitesTable, SiteHealthTable, SiteScheduleTable, ReportsTable } from \"./schema.js\";\nimport { siteSlug } from \"../reports/airtable/websites.js\";\nimport { MAINTENANCE_CHECKLIST, TESTING_CHECKLIST } from \"../reports/checklist.js\";\n\n/** One raw Airtable record: id + the fields object exactly as the API returns it\n *  (empty cells are ABSENT, not null — the API omits them). */\nexport type RawRecord = { id: string; fields: Record<string, unknown> };\n\n/**\n * Phase 1.3 of #539: map raw Airtable records into the 0007 fleet-state tables,\n * and upsert them idempotently.\n *\n * The mapping here is the SINGLE source of truth for Airtable-column →\n * Turso-column: the parity harness (`db parity`) imports these same functions,\n * so \"what the importer writes\" and \"what parity expects\" cannot drift apart.\n *\n * Values are stored RAW (the cell as Airtable returns it, stringified where the\n * column is TEXT). Coercion — `toFrequency`, `toVerdict`, recipient splitting —\n * stays in the READ layer, exactly as `mapRow` does it today, so the store\n * never bakes in a lossy interpretation. The two exceptions are shapes, not\n * meanings: `Accepted Watch Conditions` normalizes to a JSON array (mapRow\n * accepts array or delimited string; the new store keeps one shape), and the\n * report checklist re-keys from Airtable column names to the stable keys in\n * src/reports/checklist.ts.\n */\n\n/** Websites columns that must NEVER reach Turso, and why. Everything else that\n *  is populated but unmapped lands in `sites.legacy` (JSON, keyed by original\n *  column name) so no data is silently dropped. */\nexport const EXCLUDED_WEBSITE_FIELDS: ReadonlySet<string> = new Set([\n  // Dropped under D4's rule (empty everywhere + unreferenced), verified 2026-08-23.\n  \"site host username\",\n  \"site host password\",\n  \"launch day\",\n  \"contract link\",\n  // Plaintext credentials — operator ruling 2026-08-23: these live on ONLY in\n  // the frozen Airtable base. A new store does not inherit plaintext creds.\n  \"DNS username\",\n  \"DNS password\",\n  \"cms username\",\n  \"cms password\",\n  // Link columns: Turso joins by rec id (D1); the links carry no extra data.\n  \"Reports\",\n  \"Submissions\",\n  \"Spam Screenouts\",\n  // Regenerated into sites.header_image as a BLOB by the header-image CLI (D5);\n  // the Airtable attachment (an expiring signed URL) is never migrated.\n  \"Header image\",\n]);\n\nconst s = (v: unknown): string | null => {\n  if (v === undefined || v === null) return null;\n  if (typeof v === \"string\") return v.trim() === \"\" ? null : v;\n  return String(v);\n};\nconst n = (v: unknown): number | null => (typeof v === \"number\" ? v : null);\nconst b01 = (v: unknown): number => (v === true ? 1 : 0);\nconst b01n = (v: unknown): number | null => (typeof v === \"boolean\" ? (v ? 1 : 0) : null);\nconst json = (v: unknown): string | null => (v === undefined ? null : JSON.stringify(v));\n\n/** Direct field→column map for `sites` (operator-owned config). Exported for\n *  the site-details write-through (fleet-state.mirrorSiteField), so the editor\n *  and the importer share ONE Airtable-column → sites-column truth. */\nexport const SITE_FIELDS: Record<string, keyof SitesTable> = {\n  Name: \"name\",\n  url: \"url\",\n  Status: \"status\",\n  \"point of contact\": \"point_of_contact\",\n  \"maintenence freq\": \"maintenance_freq\", // Airtable's misspelling dies at this boundary\n  \"testing freq\": \"testing_freq\",\n  \"maintenance day\": \"maintenance_day\",\n  \"testing day\": \"testing_day\",\n  \"GA4 property ID\": \"ga4_property_id\",\n  \"Search query\": \"search_query\",\n  \"Search Console property\": \"search_console_property\",\n  \"Git repo\": \"git_repo\",\n  \"Netlify ID\": \"netlify_id\",\n  \"Report recipients (To)\": \"report_recipients_to\",\n  \"Report recipients (CC)\": \"report_recipients_cc\",\n  \"Copy — Intro\": \"copy_intro\",\n  \"Copy — Contact\": \"copy_contact\",\n  \"Copy — Footer\": \"copy_footer\",\n  \"Newsletter Webhook\": \"newsletter_webhook\",\n  \"Mailchimp API Key\": \"mailchimp_api_key\",\n  \"Mailchimp Audience ID\": \"mailchimp_audience_id\",\n  \"Notify Routing\": \"notify_routing\",\n  \"Prismic Ack Until\": \"prismic_ack_until\",\n  \"Launched at\": \"launched_at\",\n};\n\n/** Direct field→column map for `site_health` (nightly-cron-owned). Exported for\n *  the Phase 3 writer mirrors (fleet-state.mirrorHealthFields) and their\n *  lockstep tests, so the nightly writers and the importer share ONE\n *  Airtable-column → site_health-column truth. */\nexport const HEALTH_FIELDS: Record<string, keyof SiteHealthTable> = {\n  pScore: \"p_score\",\n  rScore: \"r_score\",\n  bpScore: \"bp_score\",\n  seoScore: \"seo_score\",\n  \"Last lighthouse audit at\": \"lighthouse_at\",\n  \"A11y Violations\": \"a11y_violations\",\n  \"Deps Drifted\": \"deps_drifted\",\n  \"Deps Major Behind\": \"deps_major_behind\",\n  \"Deps Outdated\": \"deps_outdated\",\n  \"Deps Major Outdated\": \"deps_major_outdated\",\n  \"Security Vulns Critical\": \"vulns_critical\",\n  \"Security Vulns High\": \"vulns_high\",\n  \"Security Vulns Moderate\": \"vulns_moderate\",\n  \"Security Vulns Low\": \"vulns_low\",\n  \"Last security audit at\": \"security_audit_at\",\n  \"Security advisories\": \"security_advisories\",\n  \"Security Auto-Fix Attempts\": \"auto_fix_attempts\",\n  \"Analytics soft-fail at\": \"analytics_soft_fail_at\",\n  \"Cert days remaining\": \"cert_days_remaining\",\n  \"Domain checked at\": \"domain_checked_at\",\n  \"Deploy status\": \"deploy_status\",\n  \"Last deploy at\": \"last_deploy_at\",\n  \"Deploy log URL\": \"deploy_log_url\",\n  \"Deploy checked at\": \"deploy_checked_at\",\n  \"Function health\": \"function_health\",\n  \"CMS Reachable\": \"cms_reachable\",\n  \"Turnstile widget\": \"turnstile_widget\",\n  \"Function health checked at\": \"function_health_checked_at\",\n  \"Broken links\": \"broken_links\",\n  \"Browser checked at\": \"browser_checked_at\",\n  \"Uptime Reachable\": \"uptime_reachable\",\n  \"Titles & Meta OK\": \"titles_meta_ok\",\n  \"Smoke OK\": \"smoke_ok\",\n  \"Last Smoke At\": \"last_smoke_at\",\n  \"Form E2E OK\": \"form_e2e_ok\",\n  \"Form E2E checked at\": \"form_e2e_checked_at\",\n  \"Renovate Failing CIs\": \"renovate_failing_cis\",\n  \"Default Branch CI\": \"default_branch_ci\",\n  \"Last Commit At\": \"last_commit_at\",\n  \"GitHub Signals At\": \"github_signals_at\",\n  \"Prismic Models\": \"prismic_models\",\n  \"Prismic Models Checked At\": \"prismic_models_checked_at\",\n  \"Prismic Models Drift\": \"prismic_models_drift\",\n};\n\n/** Numeric health columns (everything else in HEALTH_FIELDS stores as text). */\nconst HEALTH_NUMERIC: ReadonlySet<keyof SiteHealthTable> = new Set([\n  \"p_score\",\n  \"r_score\",\n  \"bp_score\",\n  \"seo_score\",\n  \"a11y_violations\",\n  \"deps_drifted\",\n  \"deps_major_behind\",\n  \"deps_outdated\",\n  \"deps_major_outdated\",\n  \"vulns_critical\",\n  \"vulns_high\",\n  \"vulns_moderate\",\n  \"vulns_low\",\n  \"auto_fix_attempts\",\n  \"cert_days_remaining\",\n  \"broken_links\",\n  \"renovate_failing_cis\",\n]);\n\n/** Boolean-checkbox health columns (Airtable true/absent → 1/0/null). */\nexport const HEALTH_BOOLEAN: Record<string, keyof SiteHealthTable> = {\n  \"Crossbrowser OK\": \"crossbrowser_ok\",\n  \"Mobile OK\": \"mobile_ok\",\n  \"Links OK\": \"links_ok\",\n};\n\n/** Fields consumed by the schedule table. */\nexport const SCHEDULE_FIELDS: Record<string, keyof SiteScheduleTable> = {\n  \"Next maintenance at\": \"next_maintenance_at\",\n  \"Next testing at\": \"next_testing_at\",\n};\n\n/** Resolve one Airtable health field to its site_health column AND the exact\n *  coercion the importer applies to it. The ONE shared path between\n *  mapWebsiteRecord (full-row import) and fleet-state.mirrorHealthFields\n *  (partial write-through): a coercion that exists twice will eventually\n *  disagree, and the hourly import silently papers over the loser. Returns\n *  null for a field no health column claims. */\nexport function healthColumnFor(\n  field: string,\n): { col: keyof SiteHealthTable; coerce: (v: unknown) => string | number | null } | null {\n  const direct = HEALTH_FIELDS[field];\n  if (direct) return { col: direct, coerce: HEALTH_NUMERIC.has(direct) ? n : s };\n  const bool = HEALTH_BOOLEAN[field];\n  if (bool) return { col: bool, coerce: b01n };\n  return null;\n}\n\n/** The schedule twin of {@link healthColumnFor} (both columns store as text). */\nexport function scheduleColumnFor(\n  field: string,\n): { col: keyof SiteScheduleTable; coerce: (v: unknown) => string | null } | null {\n  const col = SCHEDULE_FIELDS[field];\n  return col ? { col, coerce: s } : null;\n}\n\nexport type MappedWebsite = {\n  site: Omit<\n    SitesTable,\n    \"header_image\" | \"header_image_filename\" | \"header_image_type\" | \"header_image_generated_at\"\n  >;\n  health: SiteHealthTable;\n  schedule: SiteScheduleTable;\n};\n\n/** Map one raw Websites record into its three-table shape. Pure. */\nexport function mapWebsiteRecord(rec: RawRecord, computedAt: string): MappedWebsite {\n  const f = rec.fields;\n  const name = s(f[\"Name\"]);\n  if (!name) throw new Error(`Websites ${rec.id}: blank Name — cannot derive a slug`);\n  const slug = siteSlug(name);\n  if (!slug) throw new Error(`Websites ${rec.id}: Name \"${name}\" yields an empty slug`);\n\n  // Accepted Watch Conditions: array or delimited string in Airtable → one\n  // canonical JSON array here (same trimming mapRow applies at read time).\n  const awcRaw = f[\"Accepted Watch Conditions\"];\n  const awc = Array.isArray(awcRaw)\n    ? awcRaw\n        .filter((x): x is string => typeof x === \"string\")\n        .map((x) => x.trim())\n        .filter(Boolean)\n    : typeof awcRaw === \"string\"\n      ? awcRaw\n          .split(/[\\n,]/)\n          .map((x) => x.trim())\n          .filter(Boolean)\n      : [];\n\n  const site: MappedWebsite[\"site\"] = {\n    id: rec.id,\n    slug,\n    name,\n    url: null,\n    status: null,\n    point_of_contact: null,\n    maintenance_freq: null,\n    testing_freq: null,\n    maintenance_day: null,\n    testing_day: null,\n    ga4_property_id: null,\n    search_query: null,\n    search_console_property: null,\n    git_repo: null,\n    netlify_id: null,\n    report_recipients_to: null,\n    report_recipients_cc: null,\n    copy_intro: null,\n    copy_contact: null,\n    copy_footer: null,\n    newsletter_webhook: null,\n    mailchimp_api_key: null,\n    mailchimp_audience_id: null,\n    notify_routing: null,\n    require_turnstile: b01(f[\"Require Turnstile\"]),\n    accepted_watch_conditions: awc.length > 0 ? JSON.stringify(awc) : null,\n    prismic_ack_until: null,\n    launched_at: null,\n    legacy: null,\n  };\n  for (const [field, col] of Object.entries(SITE_FIELDS)) {\n    if (col === \"name\") continue; // handled above (validated)\n    (site as unknown as Record<string, unknown>)[col] = s(f[field]);\n  }\n\n  const health = { site_id: rec.id } as SiteHealthTable;\n  // Through healthColumnFor — the SAME resolution+coercion the Phase 3 writer\n  // mirrors use, so import and write-through cannot drift apart.\n  for (const field of [...Object.keys(HEALTH_FIELDS), ...Object.keys(HEALTH_BOOLEAN)]) {\n    const m = healthColumnFor(field);\n    if (m) (health as unknown as Record<string, unknown>)[m.col] = m.coerce(f[field]);\n  }\n\n  const schedule: SiteScheduleTable = {\n    site_id: rec.id,\n    next_maintenance_at: s(f[\"Next maintenance at\"]),\n    next_testing_at: s(f[\"Next testing at\"]),\n    computed_at: computedAt,\n  };\n\n  // Everything populated that no table claims and no exclusion bans → legacy.\n  const claimed = new Set<string>([\n    \"Name\",\n    \"Require Turnstile\",\n    \"Accepted Watch Conditions\",\n    ...Object.keys(SITE_FIELDS),\n    ...Object.keys(HEALTH_FIELDS),\n    ...Object.keys(HEALTH_BOOLEAN),\n    ...Object.keys(SCHEDULE_FIELDS),\n  ]);\n  const legacy: Record<string, unknown> = {};\n  for (const [field, value] of Object.entries(f)) {\n    if (claimed.has(field) || EXCLUDED_WEBSITE_FIELDS.has(field)) continue;\n    legacy[field] = value;\n  }\n  site.legacy = Object.keys(legacy).length > 0 ? JSON.stringify(legacy) : null;\n\n  return { site, health, schedule };\n}\n\n/** Stable-key checklist mapping (Airtable column name → key). */\nconst CHECKLIST_BY_FIELD: ReadonlyArray<{ field: string; key: string }> = [\n  ...MAINTENANCE_CHECKLIST,\n  ...TESTING_CHECKLIST,\n].map((i) => ({ field: i.field, key: i.key }));\n\n/** Map one raw Reports record. `renderedHtml` is fetched by the caller (the\n *  attachment URL is an expiring signed URL — see the design's Attachments\n *  section); pass null when the record has no attachment or the fetch failed. */\nexport function mapReportRecord(rec: RawRecord, renderedHtml: string | null): ReportsTable {\n  const f = rec.fields;\n  const linkSites = (f[\"Site\"] as string[] | undefined) ?? [];\n  const checklist: Record<string, boolean> = {};\n  for (const { field, key } of CHECKLIST_BY_FIELD) checklist[key] = Boolean(f[field]);\n\n  return {\n    id: rec.id,\n    site_id: linkSites[0] ?? null,\n    report_id: s(f[\"Report ID\"]),\n    report_type: s(f[\"Report type\"]),\n    period: s(f[\"Period\"]),\n    period_start: s(f[\"Period start\"]),\n    period_end: s(f[\"Period end\"]),\n    completed_on: s(f[\"Completed on\"]),\n    lighthouse_performance: n(f[\"Lighthouse — Performance\"]),\n    lighthouse_accessibility: n(f[\"Lighthouse — Accessibility\"]),\n    lighthouse_best_practices: n(f[\"Lighthouse — Best Practices\"]),\n    lighthouse_seo: n(f[\"Lighthouse — SEO\"]),\n    ga_users_current: n(f[\"GA users (period)\"]),\n    ga_users_previous: n(f[\"GA users (prev period)\"]),\n    search_found_page1: b01n(f[\"Search found page 1\"]),\n    search_position: n(f[\"Search position\"]),\n    last_tested_date: s(f[\"Last tested date\"]),\n    commentary: s(f[\"Commentary\"]),\n    subject_override: s(f[\"Subject override\"]),\n    draft_ready: b01(f[\"Draft ready\"]),\n    approved_to_send: b01(f[\"Approved to send\"]),\n    approved_at: s(f[\"Approved At\"]),\n    approved_by: s(f[\"Approved By\"]),\n    send_override: b01(f[\"Send override\"]),\n    override_reason: s(f[\"Override reason\"]),\n    override_by: s(f[\"Override by\"]),\n    override_at: s(f[\"Override at\"]),\n    sent_at: s(f[\"Sent at\"]),\n    delivery_status: s(f[\"Delivery status\"]) ?? \"pending\",\n    resend_message_id: s(f[\"Resend message ID\"]),\n    checklist: JSON.stringify(checklist),\n    // The Airtable cell is a long-text field, so the API hands us a STRING of\n    // JSON — store it verbatim. json() here would double-encode it, and\n    // parseAutoEvidence on the read side would then parse to a string and\n    // yield null (evidence silently lost). The non-string branch only exists\n    // for defensive completeness.\n    checklist_auto_evidence:\n      typeof f[\"Checklist auto-evidence\"] === \"string\"\n        ? s(f[\"Checklist auto-evidence\"])\n        : json(f[\"Checklist auto-evidence\"] ?? undefined),\n    rendered_html: renderedHtml,\n  };\n}\n\n/** First Rendered HTML attachment's signed URL, or null. Exposed so the CLI can\n *  fetch it and tests can assert which URL would be fetched. */\nexport function renderedHtmlUrl(rec: RawRecord): string | null {\n  const atts = rec.fields[\"Rendered HTML\"] as Array<{ url?: string }> | undefined;\n  const url = atts?.[0]?.url;\n  return typeof url === \"string\" && url.length > 0 ? url : null;\n}\n\n/** What the import removed because Airtable no longer has the record — and what\n *  it declined to remove. `refusals` is non-empty only when the incoming read\n *  looked untrustworthy; in that case NOTHING was deleted for that table. */\nexport type ReapSummary = {\n  sites: string[];\n  reports: string[];\n  refusals: string[];\n};\n\n/** Reaping is the only destructive thing the importer does, and it acts on the\n *  absence of evidence — so it is only ever as trustworthy as the read that\n *  motivated it. A short read (a truncated page, a partial outage) is\n *  indistinguishable from mass deletion by looking at the rows alone, so the\n *  allowance is deliberately shaped like an operator tidying up rather than\n *  like a bad page: at most 10% of what is stored, with a floor of 5 so a small\n *  table stays workable. Over that, refuse the whole table and let parity red\n *  the run — a wedged-red sync is recoverable, an emptied Turso is not. */\nconst REAP_FLOOR = 5;\nconst REAP_FRACTION = 0.1;\n\nexport function reapAllowance(stored: number): number {\n  return Math.max(REAP_FLOOR, Math.ceil(stored * REAP_FRACTION));\n}\n\n/** Human lines plus the FLEET_REAP machine line, emitted on EVERY pass (nothing\n *  reaped included) — an absent line must read as \"the reap never ran\", never as\n *  \"it ran clean\", the same contract FLEET_PARITY and FLEET_SYNC hold. Shared by\n *  `db sync` and the one-shot `db import-airtable`: both can delete, so a second\n *  hand-rolled copy is how one of them ends up doing it quietly. */\nexport function formatReapSummary(reaped: ReapSummary): string[] {\n  const lines: string[] = [];\n  for (const id of reaped.sites) {\n    lines.push(`✂ reaped sites ${id} (+ its health/schedule rows) — no longer in Airtable`);\n  }\n  for (const id of reaped.reports) {\n    lines.push(`✂ reaped reports ${id} — no longer in Airtable`);\n  }\n  for (const reason of reaped.refusals) lines.push(`⚠ ${reason}`);\n  lines.push(\n    `FLEET_REAP sites=${reaped.sites.length} reports=${reaped.reports.length} ` +\n      `refused=${reaped.refusals.length}`,\n  );\n  return lines;\n}\n\n/** Null when the reap may proceed, else the human reason it was refused. */\nexport function reapRefusal(\n  table: string,\n  incoming: number,\n  stored: number,\n  toReap: number,\n): string | null {\n  if (incoming === 0 && stored > 0) {\n    return `${table}: REFUSED to reap — Airtable returned 0 rows while ${stored} are stored; that is a failed read, not an empty fleet. Nothing deleted.`;\n  }\n  const allowed = reapAllowance(stored);\n  if (toReap > allowed) {\n    return `${table}: REFUSED to reap — ${toReap} rows are missing from Airtable, over the ${allowed}-row allowance for ${stored} stored. Nothing deleted; re-run, and if the deletions are real, remove them in smaller batches.`;\n  }\n  return null;\n}\n\nexport type ImportSummary = {\n  sites: number;\n  reports: number;\n  /** Rows removed (or refused) because their Airtable record is gone. */\n  reaped: ReapSummary;\n  /** Reports whose Rendered HTML attachment could not be fetched (URL expired /\n   *  network) — imported with rendered_html null, named so the run is honest. */\n  renderedHtmlMisses: string[];\n  /** Attachment fetches attempted and succeeded this run. */\n  renderedHtmlFetched: number;\n  /** Fetches skipped because the stored row already carries rendered_html\n   *  (only in reportHtml: \"when-missing\" mode — the hourly sync's mode). */\n  renderedHtmlSkipped: number;\n};\n\nexport type ImportOptions = {\n  /** \"always\" (default): fetch every report's Rendered HTML attachment — the\n   *  one-shot full import's mode. \"when-missing\": fetch only for reports whose\n   *  stored row has no rendered_html yet — the hourly sync's mode, so 24 runs a\n   *  day don't re-download every attachment every hour. Safe for Phase 2:\n   *  nothing reads reports.rendered_html from Turso until the Phase 4 report\n   *  review lands; revisit the staleness story there (a re-rendered report's\n   *  stored HTML goes stale under \"when-missing\"). Parity is unaffected —\n   *  rendered_html is a parity SKIP_COLUMN. */\n  reportHtml?: \"always\" | \"when-missing\";\n};\n\nexport type ImportIo = {\n  listWebsiteRecords: () => Promise<RawRecord[]>;\n  listReportRecords: () => Promise<RawRecord[]>;\n  /** Fetch an attachment body; null on failure (the miss is reported, not fatal). */\n  fetchAttachment: (url: string) => Promise<string | null>;\n  now: () => Date;\n};\n\n/**\n * Import both tables, idempotently: upsert by rec id, so a re-run converges\n * instead of duplicating. On conflict the sites upsert deliberately does NOT\n * touch the header_image* columns — Airtable stopped being their source (D5),\n * so a re-import must never wipe a regenerated image. rendered_html is only\n * overwritten when the fetch succeeded, for the same reason: a re-run with an\n * expired signed URL must not erase a body captured while it was valid.\n */\nexport async function importFleetState(\n  db: Db,\n  io: ImportIo,\n  opts: ImportOptions = {},\n): Promise<ImportSummary> {\n  const computedAt = io.now().toISOString();\n  const websites = await io.listWebsiteRecords();\n\n  const mapped = websites.map((r) => mapWebsiteRecord(r, computedAt));\n  const slugOwner = new Map<string, string>();\n  for (const m of mapped) {\n    const prior = slugOwner.get(m.site.slug);\n    if (prior)\n      throw new Error(`slug collision: ${prior} and ${m.site.id} both map to '${m.site.slug}'`);\n    slugOwner.set(m.site.slug, m.site.id);\n  }\n\n  for (const { site, health, schedule } of mapped) {\n    await db\n      .insertInto(\"sites\")\n      .values(site)\n      .onConflict((oc) => oc.column(\"id\").doUpdateSet(site))\n      .execute();\n    await db\n      .insertInto(\"site_health\")\n      .values(health)\n      .onConflict((oc) => oc.column(\"site_id\").doUpdateSet(health))\n      .execute();\n    await db\n      .insertInto(\"site_schedule\")\n      .values(schedule)\n      .onConflict((oc) => oc.column(\"site_id\").doUpdateSet(schedule))\n      .execute();\n  }\n\n  const reports = await io.listReportRecords();\n  // \"when-missing\": one pre-read of which report rows already hold a body, so\n  // the loop can skip their attachment fetches. A skipped fetch keeps the\n  // stored body (the upsert falls into the rowSansHtml branch) and is counted,\n  // not treated as a miss.\n  const alreadyStored =\n    opts.reportHtml === \"when-missing\"\n      ? new Set(\n          (\n            await db\n              .selectFrom(\"reports\")\n              .select(\"id\")\n              .where(\"rendered_html\", \"is not\", null)\n              .execute()\n          ).map((r) => r.id),\n        )\n      : null;\n  const misses: string[] = [];\n  let fetched = 0;\n  let skipped = 0;\n  for (const rec of reports) {\n    const url = renderedHtmlUrl(rec);\n    const skip = url !== null && alreadyStored !== null && alreadyStored.has(rec.id);\n    if (skip) skipped++;\n    const html = url && !skip ? await io.fetchAttachment(url) : null;\n    if (url && !skip && html === null) misses.push(rec.id);\n    if (html !== null) fetched++;\n    const row = mapReportRecord(rec, html);\n    const { rendered_html: _rh, ...rowSansHtml } = row;\n    void _rh;\n    await db\n      .insertInto(\"reports\")\n      .values(row)\n      .onConflict((oc) => oc.column(\"id\").doUpdateSet(html !== null ? row : rowSansHtml))\n      .execute();\n  }\n\n  const reaped: ReapSummary = { sites: [], reports: [], refusals: [] };\n\n  // Sites first. No foreign keys are declared, so the health and schedule rows\n  // must be removed explicitly — parity only reverse-checks `sites`, so an\n  // orphan left here would linger forever, unnoticed and still readable.\n  const liveSiteIds = new Set(mapped.map((m) => m.site.id));\n  const storedSites = (await db.selectFrom(\"sites\").select(\"id\").execute()).map((r) =>\n    String(r.id),\n  );\n  const staleSites = storedSites.filter((id) => !liveSiteIds.has(id)).sort();\n  const siteRefusal = reapRefusal(\"sites\", websites.length, storedSites.length, staleSites.length);\n  if (siteRefusal) reaped.refusals.push(siteRefusal);\n  else if (staleSites.length > 0) {\n    await db.deleteFrom(\"site_health\").where(\"site_id\", \"in\", staleSites).execute();\n    await db.deleteFrom(\"site_schedule\").where(\"site_id\", \"in\", staleSites).execute();\n    await db.deleteFrom(\"sites\").where(\"id\", \"in\", staleSites).execute();\n    reaped.sites = staleSites;\n  }\n\n  const liveReportIds = new Set(reports.map((r) => r.id));\n  const storedReports = (await db.selectFrom(\"reports\").select(\"id\").execute()).map((r) =>\n    String(r.id),\n  );\n  const staleReports = storedReports.filter((id) => !liveReportIds.has(id)).sort();\n  const reportRefusal = reapRefusal(\n    \"reports\",\n    reports.length,\n    storedReports.length,\n    staleReports.length,\n  );\n  if (reportRefusal) reaped.refusals.push(reportRefusal);\n  else if (staleReports.length > 0) {\n    await db.deleteFrom(\"reports\").where(\"id\", \"in\", staleReports).execute();\n    reaped.reports = staleReports;\n  }\n\n  return {\n    sites: mapped.length,\n    reports: reports.length,\n    renderedHtmlMisses: misses,\n    renderedHtmlFetched: fetched,\n    renderedHtmlSkipped: skipped,\n    reaped,\n  };\n}\n"],"mappings":";;;;;;;;;AA8BO,IAAM,0BAA+C,oBAAI,IAAI;AAAA;AAAA,EAElE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AACF,CAAC;AAED,IAAM,IAAI,CAAC,MAA8B;AACvC,MAAI,MAAM,UAAa,MAAM,KAAM,QAAO;AAC1C,MAAI,OAAO,MAAM,SAAU,QAAO,EAAE,KAAK,MAAM,KAAK,OAAO;AAC3D,SAAO,OAAO,CAAC;AACjB;AACA,IAAM,IAAI,CAAC,MAA+B,OAAO,MAAM,WAAW,IAAI;AACtE,IAAM,MAAM,CAAC,MAAwB,MAAM,OAAO,IAAI;AACtD,IAAM,OAAO,CAAC,MAA+B,OAAO,MAAM,YAAa,IAAI,IAAI,IAAK;AACpF,IAAM,OAAO,CAAC,MAA+B,MAAM,SAAY,OAAO,KAAK,UAAU,CAAC;AAK/E,IAAM,cAAgD;AAAA,EAC3D,MAAM;AAAA,EACN,KAAK;AAAA,EACL,QAAQ;AAAA,EACR,oBAAoB;AAAA,EACpB,oBAAoB;AAAA;AAAA,EACpB,gBAAgB;AAAA,EAChB,mBAAmB;AAAA,EACnB,eAAe;AAAA,EACf,mBAAmB;AAAA,EACnB,gBAAgB;AAAA,EAChB,2BAA2B;AAAA,EAC3B,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,0BAA0B;AAAA,EAC1B,0BAA0B;AAAA,EAC1B,qBAAgB;AAAA,EAChB,uBAAkB;AAAA,EAClB,sBAAiB;AAAA,EACjB,sBAAsB;AAAA,EACtB,qBAAqB;AAAA,EACrB,yBAAyB;AAAA,EACzB,kBAAkB;AAAA,EAClB,qBAAqB;AAAA,EACrB,eAAe;AACjB;AAMO,IAAM,gBAAuD;AAAA,EAClE,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,UAAU;AAAA,EACV,4BAA4B;AAAA,EAC5B,mBAAmB;AAAA,EACnB,gBAAgB;AAAA,EAChB,qBAAqB;AAAA,EACrB,iBAAiB;AAAA,EACjB,uBAAuB;AAAA,EACvB,2BAA2B;AAAA,EAC3B,uBAAuB;AAAA,EACvB,2BAA2B;AAAA,EAC3B,sBAAsB;AAAA,EACtB,0BAA0B;AAAA,EAC1B,uBAAuB;AAAA,EACvB,8BAA8B;AAAA,EAC9B,0BAA0B;AAAA,EAC1B,uBAAuB;AAAA,EACvB,qBAAqB;AAAA,EACrB,iBAAiB;AAAA,EACjB,kBAAkB;AAAA,EAClB,kBAAkB;AAAA,EAClB,qBAAqB;AAAA,EACrB,mBAAmB;AAAA,EACnB,iBAAiB;AAAA,EACjB,oBAAoB;AAAA,EACpB,8BAA8B;AAAA,EAC9B,gBAAgB;AAAA,EAChB,sBAAsB;AAAA,EACtB,oBAAoB;AAAA,EACpB,oBAAoB;AAAA,EACpB,YAAY;AAAA,EACZ,iBAAiB;AAAA,EACjB,eAAe;AAAA,EACf,uBAAuB;AAAA,EACvB,wBAAwB;AAAA,EACxB,qBAAqB;AAAA,EACrB,kBAAkB;AAAA,EAClB,qBAAqB;AAAA,EACrB,kBAAkB;AAAA,EAClB,6BAA6B;AAAA,EAC7B,wBAAwB;AAC1B;AAGA,IAAM,iBAAqD,oBAAI,IAAI;AAAA,EACjE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,iBAAwD;AAAA,EACnE,mBAAmB;AAAA,EACnB,aAAa;AAAA,EACb,YAAY;AACd;AAGO,IAAM,kBAA2D;AAAA,EACtE,uBAAuB;AAAA,EACvB,mBAAmB;AACrB;AAQO,SAAS,gBACd,OACuF;AACvF,QAAM,SAAS,cAAc,KAAK;AAClC,MAAI,OAAQ,QAAO,EAAE,KAAK,QAAQ,QAAQ,eAAe,IAAI,MAAM,IAAI,IAAI,EAAE;AAC7E,QAAM,OAAO,eAAe,KAAK;AACjC,MAAI,KAAM,QAAO,EAAE,KAAK,MAAM,QAAQ,KAAK;AAC3C,SAAO;AACT;AAGO,SAAS,kBACd,OACgF;AAChF,QAAM,MAAM,gBAAgB,KAAK;AACjC,SAAO,MAAM,EAAE,KAAK,QAAQ,EAAE,IAAI;AACpC;AAYO,SAAS,iBAAiB,KAAgB,YAAmC;AAClF,QAAM,IAAI,IAAI;AACd,QAAM,OAAO,EAAE,EAAE,MAAM,CAAC;AACxB,MAAI,CAAC,KAAM,OAAM,IAAI,MAAM,YAAY,IAAI,EAAE,0CAAqC;AAClF,QAAM,OAAO,SAAS,IAAI;AAC1B,MAAI,CAAC,KAAM,OAAM,IAAI,MAAM,YAAY,IAAI,EAAE,WAAW,IAAI,wBAAwB;AAIpF,QAAM,SAAS,EAAE,2BAA2B;AAC5C,QAAM,MAAM,MAAM,QAAQ,MAAM,IAC5B,OACG,OAAO,CAAC,MAAmB,OAAO,MAAM,QAAQ,EAChD,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,OAAO,IACjB,OAAO,WAAW,WAChB,OACG,MAAM,OAAO,EACb,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,OAAO,IACjB,CAAC;AAEP,QAAM,OAA8B;AAAA,IAClC,IAAI,IAAI;AAAA,IACR;AAAA,IACA;AAAA,IACA,KAAK;AAAA,IACL,QAAQ;AAAA,IACR,kBAAkB;AAAA,IAClB,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,iBAAiB;AAAA,IACjB,aAAa;AAAA,IACb,iBAAiB;AAAA,IACjB,cAAc;AAAA,IACd,yBAAyB;AAAA,IACzB,UAAU;AAAA,IACV,YAAY;AAAA,IACZ,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,aAAa;AAAA,IACb,oBAAoB;AAAA,IACpB,mBAAmB;AAAA,IACnB,uBAAuB;AAAA,IACvB,gBAAgB;AAAA,IAChB,mBAAmB,IAAI,EAAE,mBAAmB,CAAC;AAAA,IAC7C,2BAA2B,IAAI,SAAS,IAAI,KAAK,UAAU,GAAG,IAAI;AAAA,IAClE,mBAAmB;AAAA,IACnB,aAAa;AAAA,IACb,QAAQ;AAAA,EACV;AACA,aAAW,CAAC,OAAO,GAAG,KAAK,OAAO,QAAQ,WAAW,GAAG;AACtD,QAAI,QAAQ,OAAQ;AACpB,IAAC,KAA4C,GAAG,IAAI,EAAE,EAAE,KAAK,CAAC;AAAA,EAChE;AAEA,QAAM,SAAS,EAAE,SAAS,IAAI,GAAG;AAGjC,aAAW,SAAS,CAAC,GAAG,OAAO,KAAK,aAAa,GAAG,GAAG,OAAO,KAAK,cAAc,CAAC,GAAG;AACnF,UAAM,IAAI,gBAAgB,KAAK;AAC/B,QAAI,EAAG,CAAC,OAA8C,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EAClF;AAEA,QAAM,WAA8B;AAAA,IAClC,SAAS,IAAI;AAAA,IACb,qBAAqB,EAAE,EAAE,qBAAqB,CAAC;AAAA,IAC/C,iBAAiB,EAAE,EAAE,iBAAiB,CAAC;AAAA,IACvC,aAAa;AAAA,EACf;AAGA,QAAM,UAAU,oBAAI,IAAY;AAAA,IAC9B;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG,OAAO,KAAK,WAAW;AAAA,IAC1B,GAAG,OAAO,KAAK,aAAa;AAAA,IAC5B,GAAG,OAAO,KAAK,cAAc;AAAA,IAC7B,GAAG,OAAO,KAAK,eAAe;AAAA,EAChC,CAAC;AACD,QAAM,SAAkC,CAAC;AACzC,aAAW,CAAC,OAAO,KAAK,KAAK,OAAO,QAAQ,CAAC,GAAG;AAC9C,QAAI,QAAQ,IAAI,KAAK,KAAK,wBAAwB,IAAI,KAAK,EAAG;AAC9D,WAAO,KAAK,IAAI;AAAA,EAClB;AACA,OAAK,SAAS,OAAO,KAAK,MAAM,EAAE,SAAS,IAAI,KAAK,UAAU,MAAM,IAAI;AAExE,SAAO,EAAE,MAAM,QAAQ,SAAS;AAClC;AAGA,IAAM,qBAAoE;AAAA,EACxE,GAAG;AAAA,EACH,GAAG;AACL,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,KAAK,EAAE,IAAI,EAAE;AAKtC,SAAS,gBAAgB,KAAgB,cAA2C;AACzF,QAAM,IAAI,IAAI;AACd,QAAM,YAAa,EAAE,MAAM,KAA8B,CAAC;AAC1D,QAAM,YAAqC,CAAC;AAC5C,aAAW,EAAE,OAAO,IAAI,KAAK,mBAAoB,WAAU,GAAG,IAAI,QAAQ,EAAE,KAAK,CAAC;AAElF,SAAO;AAAA,IACL,IAAI,IAAI;AAAA,IACR,SAAS,UAAU,CAAC,KAAK;AAAA,IACzB,WAAW,EAAE,EAAE,WAAW,CAAC;AAAA,IAC3B,aAAa,EAAE,EAAE,aAAa,CAAC;AAAA,IAC/B,QAAQ,EAAE,EAAE,QAAQ,CAAC;AAAA,IACrB,cAAc,EAAE,EAAE,cAAc,CAAC;AAAA,IACjC,YAAY,EAAE,EAAE,YAAY,CAAC;AAAA,IAC7B,cAAc,EAAE,EAAE,cAAc,CAAC;AAAA,IACjC,wBAAwB,EAAE,EAAE,+BAA0B,CAAC;AAAA,IACvD,0BAA0B,EAAE,EAAE,iCAA4B,CAAC;AAAA,IAC3D,2BAA2B,EAAE,EAAE,kCAA6B,CAAC;AAAA,IAC7D,gBAAgB,EAAE,EAAE,uBAAkB,CAAC;AAAA,IACvC,kBAAkB,EAAE,EAAE,mBAAmB,CAAC;AAAA,IAC1C,mBAAmB,EAAE,EAAE,wBAAwB,CAAC;AAAA,IAChD,oBAAoB,KAAK,EAAE,qBAAqB,CAAC;AAAA,IACjD,iBAAiB,EAAE,EAAE,iBAAiB,CAAC;AAAA,IACvC,kBAAkB,EAAE,EAAE,kBAAkB,CAAC;AAAA,IACzC,YAAY,EAAE,EAAE,YAAY,CAAC;AAAA,IAC7B,kBAAkB,EAAE,EAAE,kBAAkB,CAAC;AAAA,IACzC,aAAa,IAAI,EAAE,aAAa,CAAC;AAAA,IACjC,kBAAkB,IAAI,EAAE,kBAAkB,CAAC;AAAA,IAC3C,aAAa,EAAE,EAAE,aAAa,CAAC;AAAA,IAC/B,aAAa,EAAE,EAAE,aAAa,CAAC;AAAA,IAC/B,eAAe,IAAI,EAAE,eAAe,CAAC;AAAA,IACrC,iBAAiB,EAAE,EAAE,iBAAiB,CAAC;AAAA,IACvC,aAAa,EAAE,EAAE,aAAa,CAAC;AAAA,IAC/B,aAAa,EAAE,EAAE,aAAa,CAAC;AAAA,IAC/B,SAAS,EAAE,EAAE,SAAS,CAAC;AAAA,IACvB,iBAAiB,EAAE,EAAE,iBAAiB,CAAC,KAAK;AAAA,IAC5C,mBAAmB,EAAE,EAAE,mBAAmB,CAAC;AAAA,IAC3C,WAAW,KAAK,UAAU,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMnC,yBACE,OAAO,EAAE,yBAAyB,MAAM,WACpC,EAAE,EAAE,yBAAyB,CAAC,IAC9B,KAAK,EAAE,yBAAyB,KAAK,MAAS;AAAA,IACpD,eAAe;AAAA,EACjB;AACF;AAIO,SAAS,gBAAgB,KAA+B;AAC7D,QAAM,OAAO,IAAI,OAAO,eAAe;AACvC,QAAM,MAAM,OAAO,CAAC,GAAG;AACvB,SAAO,OAAO,QAAQ,YAAY,IAAI,SAAS,IAAI,MAAM;AAC3D;AAmBA,IAAM,aAAa;AACnB,IAAM,gBAAgB;AAEf,SAAS,cAAc,QAAwB;AACpD,SAAO,KAAK,IAAI,YAAY,KAAK,KAAK,SAAS,aAAa,CAAC;AAC/D;AAOO,SAAS,kBAAkB,QAA+B;AAC/D,QAAM,QAAkB,CAAC;AACzB,aAAW,MAAM,OAAO,OAAO;AAC7B,UAAM,KAAK,uBAAkB,EAAE,4DAAuD;AAAA,EACxF;AACA,aAAW,MAAM,OAAO,SAAS;AAC/B,UAAM,KAAK,yBAAoB,EAAE,+BAA0B;AAAA,EAC7D;AACA,aAAW,UAAU,OAAO,SAAU,OAAM,KAAK,UAAK,MAAM,EAAE;AAC9D,QAAM;AAAA,IACJ,oBAAoB,OAAO,MAAM,MAAM,YAAY,OAAO,QAAQ,MAAM,YAC3D,OAAO,SAAS,MAAM;AAAA,EACrC;AACA,SAAO;AACT;AAGO,SAAS,YACd,OACA,UACA,QACA,QACe;AACf,MAAI,aAAa,KAAK,SAAS,GAAG;AAChC,WAAO,GAAG,KAAK,2DAAsD,MAAM;AAAA,EAC7E;AACA,QAAM,UAAU,cAAc,MAAM;AACpC,MAAI,SAAS,SAAS;AACpB,WAAO,GAAG,KAAK,4BAAuB,MAAM,6CAA6C,OAAO,sBAAsB,MAAM;AAAA,EAC9H;AACA,SAAO;AACT;AA6CA,eAAsB,iBACpB,IACA,IACA,OAAsB,CAAC,GACC;AACxB,QAAM,aAAa,GAAG,IAAI,EAAE,YAAY;AACxC,QAAM,WAAW,MAAM,GAAG,mBAAmB;AAE7C,QAAM,SAAS,SAAS,IAAI,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAClE,QAAM,YAAY,oBAAI,IAAoB;AAC1C,aAAW,KAAK,QAAQ;AACtB,UAAM,QAAQ,UAAU,IAAI,EAAE,KAAK,IAAI;AACvC,QAAI;AACF,YAAM,IAAI,MAAM,mBAAmB,KAAK,QAAQ,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,IAAI,GAAG;AAC1F,cAAU,IAAI,EAAE,KAAK,MAAM,EAAE,KAAK,EAAE;AAAA,EACtC;AAEA,aAAW,EAAE,MAAM,QAAQ,SAAS,KAAK,QAAQ;AAC/C,UAAM,GACH,WAAW,OAAO,EAClB,OAAO,IAAI,EACX,WAAW,CAAC,OAAO,GAAG,OAAO,IAAI,EAAE,YAAY,IAAI,CAAC,EACpD,QAAQ;AACX,UAAM,GACH,WAAW,aAAa,EACxB,OAAO,MAAM,EACb,WAAW,CAAC,OAAO,GAAG,OAAO,SAAS,EAAE,YAAY,MAAM,CAAC,EAC3D,QAAQ;AACX,UAAM,GACH,WAAW,eAAe,EAC1B,OAAO,QAAQ,EACf,WAAW,CAAC,OAAO,GAAG,OAAO,SAAS,EAAE,YAAY,QAAQ,CAAC,EAC7D,QAAQ;AAAA,EACb;AAEA,QAAM,UAAU,MAAM,GAAG,kBAAkB;AAK3C,QAAM,gBACJ,KAAK,eAAe,iBAChB,IAAI;AAAA,KAEA,MAAM,GACH,WAAW,SAAS,EACpB,OAAO,IAAI,EACX,MAAM,iBAAiB,UAAU,IAAI,EACrC,QAAQ,GACX,IAAI,CAAC,MAAM,EAAE,EAAE;AAAA,EACnB,IACA;AACN,QAAM,SAAmB,CAAC;AAC1B,MAAI,UAAU;AACd,MAAI,UAAU;AACd,aAAW,OAAO,SAAS;AACzB,UAAM,MAAM,gBAAgB,GAAG;AAC/B,UAAM,OAAO,QAAQ,QAAQ,kBAAkB,QAAQ,cAAc,IAAI,IAAI,EAAE;AAC/E,QAAI,KAAM;AACV,UAAM,OAAO,OAAO,CAAC,OAAO,MAAM,GAAG,gBAAgB,GAAG,IAAI;AAC5D,QAAI,OAAO,CAAC,QAAQ,SAAS,KAAM,QAAO,KAAK,IAAI,EAAE;AACrD,QAAI,SAAS,KAAM;AACnB,UAAM,MAAM,gBAAgB,KAAK,IAAI;AACrC,UAAM,EAAE,eAAe,KAAK,GAAG,YAAY,IAAI;AAC/C,SAAK;AACL,UAAM,GACH,WAAW,SAAS,EACpB,OAAO,GAAG,EACV,WAAW,CAAC,OAAO,GAAG,OAAO,IAAI,EAAE,YAAY,SAAS,OAAO,MAAM,WAAW,CAAC,EACjF,QAAQ;AAAA,EACb;AAEA,QAAM,SAAsB,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,GAAG,UAAU,CAAC,EAAE;AAKnE,QAAM,cAAc,IAAI,IAAI,OAAO,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;AACxD,QAAM,eAAe,MAAM,GAAG,WAAW,OAAO,EAAE,OAAO,IAAI,EAAE,QAAQ,GAAG;AAAA,IAAI,CAAC,MAC7E,OAAO,EAAE,EAAE;AAAA,EACb;AACA,QAAM,aAAa,YAAY,OAAO,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,KAAK;AACzE,QAAM,cAAc,YAAY,SAAS,SAAS,QAAQ,YAAY,QAAQ,WAAW,MAAM;AAC/F,MAAI,YAAa,QAAO,SAAS,KAAK,WAAW;AAAA,WACxC,WAAW,SAAS,GAAG;AAC9B,UAAM,GAAG,WAAW,aAAa,EAAE,MAAM,WAAW,MAAM,UAAU,EAAE,QAAQ;AAC9E,UAAM,GAAG,WAAW,eAAe,EAAE,MAAM,WAAW,MAAM,UAAU,EAAE,QAAQ;AAChF,UAAM,GAAG,WAAW,OAAO,EAAE,MAAM,MAAM,MAAM,UAAU,EAAE,QAAQ;AACnE,WAAO,QAAQ;AAAA,EACjB;AAEA,QAAM,gBAAgB,IAAI,IAAI,QAAQ,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;AACtD,QAAM,iBAAiB,MAAM,GAAG,WAAW,SAAS,EAAE,OAAO,IAAI,EAAE,QAAQ,GAAG;AAAA,IAAI,CAAC,MACjF,OAAO,EAAE,EAAE;AAAA,EACb;AACA,QAAM,eAAe,cAAc,OAAO,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,EAAE,KAAK;AAC/E,QAAM,gBAAgB;AAAA,IACpB;AAAA,IACA,QAAQ;AAAA,IACR,cAAc;AAAA,IACd,aAAa;AAAA,EACf;AACA,MAAI,cAAe,QAAO,SAAS,KAAK,aAAa;AAAA,WAC5C,aAAa,SAAS,GAAG;AAChC,UAAM,GAAG,WAAW,SAAS,EAAE,MAAM,MAAM,MAAM,YAAY,EAAE,QAAQ;AACvE,WAAO,UAAU;AAAA,EACnB;AAEA,SAAO;AAAA,IACL,OAAO,OAAO;AAAA,IACd,SAAS,QAAQ;AAAA,IACjB,oBAAoB;AAAA,IACpB,qBAAqB;AAAA,IACrB,qBAAqB;AAAA,IACrB;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-LS6QPANO.js → chunk-IYSEC543.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-J7SZQUCW.js";
 import {
   withRecipe
-} from "./chunk-ZTPPCHDB.js";
+} from "./chunk-3G25KIWW.js";
 
 // src/recipes/svelte-codemods.ts
 import { writeFile } from "fs/promises";
@@ -32,4 +32,4 @@ async function svelteCodemods(site) {
 export {
   svelteCodemods
 };
-//# sourceMappingURL=chunk-LS6QPANO.js.map
+//# sourceMappingURL=chunk-IYSEC543.js.map

package/dist/{chunk-DC5H7KEQ.js → chunk-JHGHLKFS.js}

@@ -1,6 +1,6 @@
 import {
   runMigrations
-} from "./chunk-4SOCPK7A.js";
+} from "./chunk-3SF7D4DY.js";
 import {
   defaultCredentialsPath
 } from "./chunk-6VAL7XJT.js";
@@ -48,4 +48,4 @@ export {
   readDbConfig,
   openDb
 };
-//# sourceMappingURL=chunk-DC5H7KEQ.js.map
+//# sourceMappingURL=chunk-JHGHLKFS.js.map

package/dist/{chunk-PBWDDDQH.js → chunk-KTH5ZODA.js}

@@ -1,6 +1,6 @@
 import {
   siteSlug
-} from "./chunk-577HCGZO.js";
+} from "./chunk-LDWZSLSU.js";
 
 // src/audits/lighthouse-airtable.ts
 import { readFile } from "fs/promises";
@@ -48,4 +48,4 @@ export {
   lighthouseScoresFromResult,
   resolveSlugFromCwd
 };
-//# sourceMappingURL=chunk-PBWDDDQH.js.map
+//# sourceMappingURL=chunk-KTH5ZODA.js.map

package/dist/{chunk-4DHQCN5H.js → chunk-LBYOLBW7.js}

@@ -1,6 +1,20 @@
 // src/audits/util/spawn.ts
 import { spawn } from "child_process";
 import { StringDecoder } from "string_decoder";
+var SpawnTimeoutError = class extends Error {
+  timeoutMs;
+  command;
+  constructor(command, timeoutMs) {
+    super(`spawn timeout after ${timeoutMs}ms: ${command}`);
+    this.name = "SpawnTimeoutError";
+    this.command = command;
+    this.timeoutMs = timeoutMs;
+  }
+};
+function isSpawnTimeout(err) {
+  if (err instanceof SpawnTimeoutError) return true;
+  return err instanceof Error && /^spawn timeout after \d+ms:/.test(err.message);
+}
 var TRUNCATION_MARKER = "\n\u2026[output truncated]";
 function makeSpawn(internals = {}) {
   const spawnImpl = internals.spawnImpl ?? spawn;
@@ -56,7 +70,7 @@ function makeSpawn(internals = {}) {
       killGroup("SIGTERM");
       killTimer = setTimeout(() => killGroup("SIGKILL"), killGraceMs);
       killTimer.unref();
-      reject(new Error(`spawn timeout after ${opts.timeoutMs}ms: ${cmd}`));
+      reject(new SpawnTimeoutError(cmd, opts.timeoutMs));
     }, opts.timeoutMs) : void 0;
     const clearTimers = () => {
       if (timer) clearTimeout(timer);
@@ -79,7 +93,8 @@ function makeSpawn(internals = {}) {
 var defaultSpawn = makeSpawn();
 
 export {
+  isSpawnTimeout,
   makeSpawn,
   defaultSpawn
 };
-//# sourceMappingURL=chunk-4DHQCN5H.js.map
+//# sourceMappingURL=chunk-LBYOLBW7.js.map

package/dist/chunk-LBYOLBW7.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/audits/util/spawn.ts"],"sourcesContent":["import { spawn } from \"node:child_process\";\nimport { StringDecoder } from \"node:string_decoder\";\n\nexport type SpawnResult = { code: number; stdout: string; stderr: string };\n\n/** Rejection raised when `timeoutMs` elapses before the child exits.\n *\n *  Typed rather than a bare `Error` because callers need to tell \"the command ran\n *  and reported a verdict\" apart from \"we ran out of time and never learned one\" —\n *  those mean opposite things to an audit. Conflating them is how a smoke timeout\n *  spent four nights reported as a generic `unexpected error` while Airtable kept\n *  serving the stale prior verdict.\n *\n *  The message is unchanged from the historical string so anything already reading\n *  it keeps working; prefer {@link isSpawnTimeout} over matching the text. */\nexport class SpawnTimeoutError extends Error {\n  readonly timeoutMs: number;\n  readonly command: string;\n  constructor(command: string, timeoutMs: number) {\n    super(`spawn timeout after ${timeoutMs}ms: ${command}`);\n    this.name = \"SpawnTimeoutError\";\n    this.command = command;\n    this.timeoutMs = timeoutMs;\n  }\n}\n\n/** True when a rejection is a spawn timeout.\n *\n *  Accepts the legacy message shape as well as the class, so an injected test\n *  double or a subprocess wrapper that re-wraps the error still reads as a\n *  timeout rather than silently degrading to \"unexpected error\". */\nexport function isSpawnTimeout(err: unknown): boolean {\n  if (err instanceof SpawnTimeoutError) return true;\n  return err instanceof Error && /^spawn timeout after \\d+ms:/.test(err.message);\n}\n\nexport type SpawnOptions = {\n  cwd?: string;\n  env?: NodeJS.ProcessEnv;\n  timeoutMs?: number;\n  /** When true, the child inherits stdout/stderr so the user sees live\n   * progress (useful for long-running `pnpm up` / `npm install`). The\n   * returned `stdout` and `stderr` will be empty strings in that case. */\n  streaming?: boolean;\n};\n\nexport type SpawnFn = (\n  cmd: string,\n  args: readonly string[],\n  opts?: SpawnOptions,\n) => Promise<SpawnResult>;\n\ntype KillFn = (pid: number, signal: NodeJS.Signals | number) => void;\n\n/** Construction-time knobs, separated from per-call {@link SpawnOptions} mainly\n *  so tests can inject deterministic `spawnImpl`/`killImpl` and a tiny grace. */\nexport type SpawnInternals = {\n  spawnImpl?: typeof spawn;\n  killImpl?: KillFn;\n  /** Delay after SIGTERM before escalating to SIGKILL on a timeout (default 5s). */\n  killGraceMs?: number;\n  /** Cap on captured stdout/stderr length so a runaway child can't OOM the CLI. */\n  maxOutputBytes?: number;\n};\n\nconst TRUNCATION_MARKER = \"\\n…[output truncated]\";\n\nexport function makeSpawn(internals: SpawnInternals = {}): SpawnFn {\n  const spawnImpl = internals.spawnImpl ?? spawn;\n  const killImpl: KillFn = internals.killImpl ?? ((pid, sig) => process.kill(pid, sig));\n  const killGraceMs = internals.killGraceMs ?? 5000;\n  const maxOutputBytes = internals.maxOutputBytes ?? 10 * 1024 * 1024;\n\n  return (cmd, args, opts = {}) =>\n    new Promise((resolve, reject) => {\n      const streaming = opts.streaming === true;\n      const child = spawnImpl(cmd, [...args], {\n        cwd: opts.cwd,\n        env: opts.env ?? process.env,\n        stdio: streaming ? [\"ignore\", \"inherit\", \"inherit\"] : [\"ignore\", \"pipe\", \"pipe\"],\n        // Detach ONLY when a timeout can fire: the child then leads its own\n        // process group, so the timeout can kill the WHOLE tree (vite, and\n        // Chromium under lhci/playwright) via process.kill(-pid), not just the\n        // npx/pnpm wrapper. Without it, killing the wrapper orphaned the\n        // grandchildren — a zombie vite squatting its port, Chrome left running.\n        // We do NOT detach timeout-less streaming calls (pnpm install/up):\n        // detaching gains nothing there (no timeout → no group-kill) and would\n        // break terminal Ctrl-C, which only reaches the foreground group — i.e.\n        // it would re-orphan the very children this guards. We never unref() the\n        // child since we still await it.\n        detached: opts.timeoutMs !== undefined,\n      });\n\n      // Cap appended output so an unbounded stream can't exhaust memory.\n      const cap = (acc: string, chunk: string): string => {\n        if (acc.length >= maxOutputBytes) return acc;\n        const next = acc + chunk;\n        return next.length > maxOutputBytes\n          ? next.slice(0, maxOutputBytes) + TRUNCATION_MARKER\n          : next;\n      };\n\n      let stdout = \"\";\n      let stderr = \"\";\n      // Decode each stream through a StringDecoder so a multibyte UTF-8 char\n      // split across two `data` chunks isn't corrupted: the decoder holds the\n      // partial trailing bytes until the rest arrives, instead of the old\n      // `String(chunk)` which decoded each chunk in isolation (and replaced the\n      // split char with U+FFFD). Flushed via `.end()` on close.\n      const outDecoder = new StringDecoder(\"utf-8\");\n      const errDecoder = new StringDecoder(\"utf-8\");\n      if (!streaming) {\n        child.stdout?.on(\n          \"data\",\n          (chunk: Buffer) => (stdout = cap(stdout, outDecoder.write(chunk))),\n        );\n        child.stderr?.on(\n          \"data\",\n          (chunk: Buffer) => (stderr = cap(stderr, errDecoder.write(chunk))),\n        );\n      }\n\n      /** Signal the child's whole process group; ignore if it's already gone.\n       *  POSIX-only: a negative pid signals the group (the project targets\n       *  macOS/Linux; this is only reached when detached, i.e. on a timeout). */\n      const killGroup = (sig: NodeJS.Signals): void => {\n        if (child.pid === undefined) return;\n        try {\n          killImpl(-child.pid, sig);\n        } catch {\n          // ESRCH: the group already exited between the timeout and the kill.\n        }\n      };\n\n      let killTimer: ReturnType<typeof setTimeout> | undefined;\n      const timer = opts.timeoutMs\n        ? setTimeout(() => {\n            killGroup(\"SIGTERM\");\n            // Escalate if SIGTERM is ignored (a wedged Chrome can swallow it).\n            killTimer = setTimeout(() => killGroup(\"SIGKILL\"), killGraceMs);\n            // Best-effort cleanup AFTER we've already rejected — it must never\n            // hold the CLI open past its real work.\n            killTimer.unref();\n            reject(new SpawnTimeoutError(cmd, opts.timeoutMs as number));\n          }, opts.timeoutMs)\n        : undefined;\n\n      const clearTimers = (): void => {\n        if (timer) clearTimeout(timer);\n        if (killTimer) clearTimeout(killTimer);\n      };\n\n      child.on(\"error\", (err) => {\n        clearTimers();\n        reject(err);\n      });\n      child.on(\"close\", (code) => {\n        clearTimers();\n        if (!streaming) {\n          // Flush any bytes the decoder buffered mid-character (e.g. a truncated\n          // final UTF-8 sequence). `.end()` returns \"\" when nothing is pending.\n          stdout = cap(stdout, outDecoder.end());\n          stderr = cap(stderr, errDecoder.end());\n        }\n        resolve({ code: code ?? -1, stdout, stderr });\n      });\n    });\n}\n\nexport const defaultSpawn: SpawnFn = makeSpawn();\n"],"mappings":";AAAA,SAAS,aAAa;AACtB,SAAS,qBAAqB;AAcvB,IAAM,oBAAN,cAAgC,MAAM;AAAA,EAClC;AAAA,EACA;AAAA,EACT,YAAY,SAAiB,WAAmB;AAC9C,UAAM,uBAAuB,SAAS,OAAO,OAAO,EAAE;AACtD,SAAK,OAAO;AACZ,SAAK,UAAU;AACf,SAAK,YAAY;AAAA,EACnB;AACF;AAOO,SAAS,eAAe,KAAuB;AACpD,MAAI,eAAe,kBAAmB,QAAO;AAC7C,SAAO,eAAe,SAAS,8BAA8B,KAAK,IAAI,OAAO;AAC/E;AA+BA,IAAM,oBAAoB;AAEnB,SAAS,UAAU,YAA4B,CAAC,GAAY;AACjE,QAAM,YAAY,UAAU,aAAa;AACzC,QAAM,WAAmB,UAAU,aAAa,CAAC,KAAK,QAAQ,QAAQ,KAAK,KAAK,GAAG;AACnF,QAAM,cAAc,UAAU,eAAe;AAC7C,QAAM,iBAAiB,UAAU,kBAAkB,KAAK,OAAO;AAE/D,SAAO,CAAC,KAAK,MAAM,OAAO,CAAC,MACzB,IAAI,QAAQ,CAAC,SAAS,WAAW;AAC/B,UAAM,YAAY,KAAK,cAAc;AACrC,UAAM,QAAQ,UAAU,KAAK,CAAC,GAAG,IAAI,GAAG;AAAA,MACtC,KAAK,KAAK;AAAA,MACV,KAAK,KAAK,OAAO,QAAQ;AAAA,MACzB,OAAO,YAAY,CAAC,UAAU,WAAW,SAAS,IAAI,CAAC,UAAU,QAAQ,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAW/E,UAAU,KAAK,cAAc;AAAA,IAC/B,CAAC;AAGD,UAAM,MAAM,CAAC,KAAa,UAA0B;AAClD,UAAI,IAAI,UAAU,eAAgB,QAAO;AACzC,YAAM,OAAO,MAAM;AACnB,aAAO,KAAK,SAAS,iBACjB,KAAK,MAAM,GAAG,cAAc,IAAI,oBAChC;AAAA,IACN;AAEA,QAAI,SAAS;AACb,QAAI,SAAS;AAMb,UAAM,aAAa,IAAI,cAAc,OAAO;AAC5C,UAAM,aAAa,IAAI,cAAc,OAAO;AAC5C,QAAI,CAAC,WAAW;AACd,YAAM,QAAQ;AAAA,QACZ;AAAA,QACA,CAAC,UAAmB,SAAS,IAAI,QAAQ,WAAW,MAAM,KAAK,CAAC;AAAA,MAClE;AACA,YAAM,QAAQ;AAAA,QACZ;AAAA,QACA,CAAC,UAAmB,SAAS,IAAI,QAAQ,WAAW,MAAM,KAAK,CAAC;AAAA,MAClE;AAAA,IACF;AAKA,UAAM,YAAY,CAAC,QAA8B;AAC/C,UAAI,MAAM,QAAQ,OAAW;AAC7B,UAAI;AACF,iBAAS,CAAC,MAAM,KAAK,GAAG;AAAA,MAC1B,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,QAAI;AACJ,UAAM,QAAQ,KAAK,YACf,WAAW,MAAM;AACf,gBAAU,SAAS;AAEnB,kBAAY,WAAW,MAAM,UAAU,SAAS,GAAG,WAAW;AAG9D,gBAAU,MAAM;AAChB,aAAO,IAAI,kBAAkB,KAAK,KAAK,SAAmB,CAAC;AAAA,IAC7D,GAAG,KAAK,SAAS,IACjB;AAEJ,UAAM,cAAc,MAAY;AAC9B,UAAI,MAAO,cAAa,KAAK;AAC7B,UAAI,UAAW,cAAa,SAAS;AAAA,IACvC;AAEA,UAAM,GAAG,SAAS,CAAC,QAAQ;AACzB,kBAAY;AACZ,aAAO,GAAG;AAAA,IACZ,CAAC;AACD,UAAM,GAAG,SAAS,CAAC,SAAS;AAC1B,kBAAY;AACZ,UAAI,CAAC,WAAW;AAGd,iBAAS,IAAI,QAAQ,WAAW,IAAI,CAAC;AACrC,iBAAS,IAAI,QAAQ,WAAW,IAAI,CAAC;AAAA,MACvC;AACA,cAAQ,EAAE,MAAM,QAAQ,IAAI,QAAQ,OAAO,CAAC;AAAA,IAC9C,CAAC;AAAA,EACH,CAAC;AACL;AAEO,IAAM,eAAwB,UAAU;","names":[]}