@reddoorla/maintenance 0.85.2 → 0.87.0

package/dist/chunk-C6CLRKPV.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/inventory/airtable.ts"],"sourcesContent":["import type { Site, InventoryProvider } from \"../types.js\";\nimport type { AirtableBase } from \"../reports/airtable/client.js\";\nimport {\n  listWebsites,\n  siteSlug,\n  ACTIVE_STATUSES,\n  isPreLaunch,\n} from \"../reports/airtable/websites.js\";\nimport { isHttpUrl } from \"../util/url.js\";\n\nexport type AirtableInventoryOptions = {\n  /**\n   * Local workdir to compute each site's path as `{workdir}/{slug}`.\n   * Defaults to REDDOOR_FLEET_WORKDIR env var if not provided.\n   * Airtable doesn't store local checkout paths, so this is required.\n   */\n  workdir?: string;\n};\n\n/**\n * Read sites from the Airtable Websites table as an InventoryProvider.\n * Each row becomes one Site; `path` is computed as `{workdir}/{slug}`.\n * Only LIVE `maintenance` sites that have a `url` are included — pre-launch\n * stages (\"launching\" / \"building\", via isPreLaunch) are excluded so a\n * not-yet-live site is never audited as production (its deploy/domain/uptime/CMS\n * audits would fail against nothing and red its Airtable row) nor swept by other\n * `--fleet airtable` ops; it re-enters the fleet when a Launch report flips its\n * Status to \"maintained\". The production URL is exposed as `Site.deployedUrl` so\n * the lighthouse audit can run against it with no checkout. `repoUrl` is\n * intentionally NOT set from `url` — a clone source must come from `gitRepo`\n * (`owner/repo`), never the production URL.\n */\nexport function fromAirtableBase(\n  base: AirtableBase,\n  opts: AirtableInventoryOptions = {},\n): InventoryProvider {\n  return async (): Promise<Site[]> => {\n    const workdir = opts.workdir ?? process.env.REDDOOR_FLEET_WORKDIR;\n    if (!workdir) {\n      throw new Error(\n        \"fromAirtableBase requires `workdir` option or REDDOOR_FLEET_WORKDIR env (sites need a local path)\",\n      );\n    }\n    const websites = await listWebsites(base);\n    return websites\n      .filter(\n        (w) =>\n          w.status !== null &&\n          ACTIVE_STATUSES.has(w.status) &&\n          !isPreLaunch(w.status) &&\n          w.url.length > 0,\n      )\n      .flatMap((w) => {\n        const slug = siteSlug(w.name);\n        // An empty slug (a Name with no slug-able characters) can't form a stable\n        // path and — fatally — can't be matched back to its Websites row on\n        // write-back: every empty-slug site would collapse under the \"\" key and\n        // mis-write or fail. Skip it loudly rather than silently mis-map it.\n        if (slug.length === 0) {\n          console.warn(\n            `[inventory] skipping \"${w.name}\" (row ${w.id}): Name has no slug-able characters (empty slug)`,\n          );\n          return [];\n        }\n        const site: Site = {\n          path: `${workdir}/${slug}`,\n          name: slug,\n          meta: { airtableRowId: w.id, displayName: w.name },\n        };\n        // Scheme-allowlist the Airtable `url` before exposing it as the\n        // deployed-audit target (it's handed straight to Chrome/lhci). A\n        // `file://`/`gopher://`/internal-host value would be a local-file read\n        // or SSRF — skip the deployed audit for that site rather than trust it.\n        if (isHttpUrl(w.url)) {\n          site.deployedUrl = w.url;\n        } else {\n          console.warn(\n            `[inventory] skipping deployed audit for \"${w.name}\": url is not http(s): ${JSON.stringify(w.url)}`,\n          );\n        }\n        if (w.gitRepo) site.gitRepo = w.gitRepo;\n        // Expose the Netlify site id (operator-set identity column) so the\n        // netlify-deploy audit can query the API with no checkout. Absent → that\n        // audit skips for this site. Not derived from the URL.\n        if (w.netlifyId) site.netlifyId = w.netlifyId;\n        return [site];\n      });\n  };\n}\n"],"mappings":";;;;;;;;;;;AAgCO,SAAS,iBACd,MACA,OAAiC,CAAC,GACf;AACnB,SAAO,YAA6B;AAClC,UAAM,UAAU,KAAK,WAAW,QAAQ,IAAI;AAC5C,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,WAAW,MAAM,aAAa,IAAI;AACxC,WAAO,SACJ;AAAA,MACC,CAAC,MACC,EAAE,WAAW,QACb,gBAAgB,IAAI,EAAE,MAAM,KAC5B,CAAC,YAAY,EAAE,MAAM,KACrB,EAAE,IAAI,SAAS;AAAA,IACnB,EACC,QAAQ,CAAC,MAAM;AACd,YAAM,OAAO,SAAS,EAAE,IAAI;AAK5B,UAAI,KAAK,WAAW,GAAG;AACrB,gBAAQ;AAAA,UACN,yBAAyB,EAAE,IAAI,UAAU,EAAE,EAAE;AAAA,QAC/C;AACA,eAAO,CAAC;AAAA,MACV;AACA,YAAM,OAAa;AAAA,QACjB,MAAM,GAAG,OAAO,IAAI,IAAI;AAAA,QACxB,MAAM;AAAA,QACN,MAAM,EAAE,eAAe,EAAE,IAAI,aAAa,EAAE,KAAK;AAAA,MACnD;AAKA,UAAI,UAAU,EAAE,GAAG,GAAG;AACpB,aAAK,cAAc,EAAE;AAAA,MACvB,OAAO;AACL,gBAAQ;AAAA,UACN,4CAA4C,EAAE,IAAI,0BAA0B,KAAK,UAAU,EAAE,GAAG,CAAC;AAAA,QACnG;AAAA,MACF;AACA,UAAI,EAAE,QAAS,MAAK,UAAU,EAAE;AAIhC,UAAI,EAAE,UAAW,MAAK,YAAY,EAAE;AACpC,aAAO,CAAC,IAAI;AAAA,IACd,CAAC;AAAA,EACL;AACF;","names":[]}

package/dist/{chunk-7J53SUT6.js → chunk-CROKUHJB.js}

@@ -1,10 +1,10 @@
 import {
   fromJsonFile,
   localPath
-} from "./chunk-FDIFTIXC.js";
+} from "./chunk-6TWWY7ZU.js";
 import {
   isHttpUrl
-} from "./chunk-U5SZ4FOP.js";
+} from "./chunk-EVBCK2KC.js";
 
 // src/cli/fleet/resolve-sites.ts
 import { pathToFileURL } from "url";
@@ -30,7 +30,7 @@ async function resolveSites(input) {
   }
   if (input.fleet === "airtable") {
     const { openBase, readAirtableConfig } = await import("./client-EPVO3FEH.js");
-    const { fromAirtableBase } = await import("./airtable-HRKSA7V4.js");
+    const { fromAirtableBase } = await import("./airtable-ZBUPQJSC.js");
     const base = openBase(readAirtableConfig());
     const provider = fromAirtableBase(base, input.workdir ? { workdir: input.workdir } : {});
     return provider();
@@ -61,4 +61,4 @@ async function resolveSites(input) {
 export {
   resolveSites
 };
-//# sourceMappingURL=chunk-7J53SUT6.js.map
+//# sourceMappingURL=chunk-CROKUHJB.js.map

package/dist/chunk-DEWJMMG3.js

@@ -0,0 +1,274 @@
+import {
+  ANALYZE_SKIPPED,
+  PROBES_SKIPPED
+} from "./chunk-HSI6Q7MI.js";
+import {
+  escapeHtml,
+  safeUrl
+} from "./chunk-DJZWYIPP.js";
+import {
+  hostnameOf
+} from "./chunk-EVBCK2KC.js";
+
+// src/prospect/render.ts
+var RED = "#d71920";
+var IMPACT_ORDER = { high: 0, medium: 1, low: 2 };
+var KIND_LABEL = {
+  branded: "Branded \u2014 asked about the business by name",
+  category: "Category \u2014 the questions a buyer would actually type",
+  competitor: "Competitor \u2014 head-to-head comparisons"
+};
+var KIND_ORDER = ["category", "branded", "competitor"];
+var AI_AGENT_LABELS = {
+  GPTBot: "ChatGPT",
+  "OAI-SearchBot": "ChatGPT's search results",
+  ClaudeBot: "Claude",
+  PerplexityBot: "Perplexity",
+  "Google-Extended": "Gemini and Google's AI Overviews",
+  CCBot: "Common Crawl, used to train many AI models"
+};
+function describeAgent(agent) {
+  const label = AI_AGENT_LABELS[agent];
+  return label ? `${agent} (feeds ${label})` : agent;
+}
+var STAGE_FAILED_MESSAGE = "we could not complete this part of the analysis";
+var STYLES = `
+  :root { color-scheme: light; }
+  * { box-sizing: border-box; }
+  body { margin: 0; background: #faf8f5; color: #1a1a1a;
+    font: 16px/1.6 -apple-system, BlinkMacSystemFont, "Segoe UI", Helvetica, Arial, sans-serif; }
+  .wrap { max-width: 860px; margin: 0 auto; padding: 48px 24px 80px; }
+  h1, h2, h3 { font-family: Besley, Georgia, "Times New Roman", serif; font-weight: 600; line-height: 1.2; }
+  h1 { font-size: 40px; margin: 0 0 8px; }
+  h2 { font-size: 26px; margin: 48px 0 12px; border-top: 2px solid #e6e1da; padding-top: 24px; }
+  h3 { font-size: 18px; margin: 24px 0 8px; }
+  .lede { color: #57544f; margin: 0 0 8px; }
+  .scores { display: grid; grid-template-columns: repeat(auto-fit, minmax(160px, 1fr)); gap: 12px; margin: 32px 0; }
+  .score { background: #fff; border: 1px solid #e6e1da; border-radius: 8px; padding: 16px; }
+  .score .n { font-family: Besley, Georgia, serif; font-size: 38px; line-height: 1; color: ${RED}; }
+  .score .n.na { font-size: 18px; color: #8a857e; }
+  .score .l { font-size: 13px; letter-spacing: .08em; text-transform: uppercase; color: #57544f; margin-top: 8px; }
+  .score .hint { font-size: 12px; color: #8a857e; margin-top: 4px; }
+  .card { background: #fff; border: 1px solid #e6e1da; border-radius: 8px; padding: 16px; margin: 12px 0; }
+  .q { font-weight: 600; }
+  .tag { display: inline-block; font-size: 12px; letter-spacing: .06em; text-transform: uppercase;
+    border-radius: 999px; padding: 2px 10px; border: 1px solid currentColor; }
+  .yes { color: #14663c; } .partial { color: #8a6d00; } .no { color: ${RED}; }
+  ul { padding-left: 20px; } li { margin: 6px 0; }
+  .muted { color: #8a857e; }
+  .cta { margin-top: 56px; background: ${RED}; color: #fff; border-radius: 8px; padding: 24px 28px; }
+  .cta h2 { border: 0; padding: 0; margin: 0 0 8px; color: #fff; }
+  .cta a { color: #fff; }
+  table { width: 100%; border-collapse: collapse; margin-top: 8px; }
+  td, th { text-align: left; padding: 6px 8px; border-bottom: 1px solid #eee; vertical-align: top; }
+  @media print {
+    body { background: #fff; }
+    .card, .score, .cta { break-inside: avoid; }
+    /* Browsers default "print background graphics" OFF, which drops the red
+       .cta background but keeps its white text \u2014 the only ask in the report
+       would otherwise print white-on-white and vanish. Fall back to dark
+       text on no background with a visible border instead of relying on the
+       background for contrast. */
+    .cta { background: none; color: #1a1a1a; border: 2px solid ${RED}; }
+    .cta h2, .cta a { color: #1a1a1a; }
+  }
+`;
+function scoreCard(label, value, hint) {
+  const n = value === null ? `<div class="n na">Not measured</div>` : `<div class="n">${value}</div>`;
+  const hintHtml = hint ? `<div class="hint">${escapeHtml(hint)}</div>` : "";
+  return `<div class="score">${n}<div class="l">${escapeHtml(label)}</div>${hintHtml}</div>`;
+}
+function stageBody(stage, body) {
+  return stage.ok ? body(stage.data) : notMeasuredNote();
+}
+function notMeasuredNote() {
+  return `<p class="muted">Not measured \u2014 ${STAGE_FAILED_MESSAGE}.</p>`;
+}
+function skippableStageNote(error, skipConstant, skipMessage) {
+  if (error === skipConstant) {
+    return `<p class="muted">${escapeHtml(skipMessage)}</p>`;
+  }
+  return notMeasuredNote();
+}
+function formatIsoDate(iso) {
+  const d = new Date(iso);
+  if (Number.isNaN(d.getTime())) return iso;
+  return d.toLocaleDateString("en-US", {
+    year: "numeric",
+    month: "long",
+    day: "numeric",
+    timeZone: "UTC"
+  });
+}
+function buildProbesSection(p, businessNameUsed) {
+  const byKind = /* @__PURE__ */ new Map();
+  for (const a of p.answers) {
+    const bucket = byKind.get(a.kind) ?? [];
+    bucket.push(a);
+    byKind.set(a.kind, bucket);
+  }
+  const recognition = p.brandedRecognized ? "<p>When the engines were asked about the business by name, they recognized it.</p>" : businessNameUsed ? "<p>When the engines were asked about the business by name, they did not recognize it \u2014 a real citation of the site never showed up, even with the name handed to them.</p>" : "<p>The engines did not recognize the business \u2014 there was no business name available to ask them with, so this reflects a harder starting point than a named query would.</p>";
+  const categoryCaveat = byKind.has("category") ? "" : `<p class="muted"><strong>No buyer-question (category) query was tested here</strong> \u2014 only name-recognition. An engine echoing back a name it was just given says nothing about whether a buyer who had never heard of the business would be shown it; treat the line above as a floor, not a visibility signal.</p>`;
+  const groups = KIND_ORDER.filter((k) => byKind.has(k)).map((kind) => {
+    const answers = byKind.get(kind) ?? [];
+    const cards = answers.map(
+      (a) => `<div class="card">
+          <div class="q">${escapeHtml(a.engine)} \xB7 \u201C${escapeHtml(a.query)}\u201D</div>
+          <p class="muted">Asked ${escapeHtml(formatIsoDate(a.askedAt))}</p>
+          <p>${escapeHtml(a.snippet)}${a.truncated ? "\u2026" : ""}</p>
+          <p class="muted">${a.domainCited || a.brandMentioned ? "You were named in this answer." : "You were not named in this answer."}${a.citedDomains.length ? ` Cited: ${escapeHtml(a.citedDomains.join(", "))}` : ""}</p>
+        </div>`
+    ).join("");
+    return `<h3>${escapeHtml(KIND_LABEL[kind])}</h3>${cards}`;
+  }).join("");
+  const competitors = p.competitorsSeen.length ? `<h3>Who the engines cited instead</h3><ul>${p.competitorsSeen.map((c) => `<li>${escapeHtml(c.domain)} \u2014 ${c.count} time${c.count === 1 ? "" : "s"}</li>`).join("")}</ul>` : "";
+  return recognition + categoryCaveat + groups + competitors;
+}
+function buildFindabilitySection(c) {
+  const accessBlock = !c.crawlerAccessMeasured ? `<p class="muted">Crawler access: not measured \u2014 ${STAGE_FAILED_MESSAGE}.</p>` : c.crawlerAccess.blockedAi.length ? `<p><strong>Blocked AI crawlers:</strong> ${escapeHtml(
+    c.crawlerAccess.blockedAi.map(describeAgent).join(", ")
+  )}</p>` : `<p>Every AI crawler we checked can reach the site.</p>`;
+  const classical = c.crawlerAccessMeasured && c.crawlerAccess.blockedClassical.length ? `<p><strong>Blocked search crawlers:</strong> ${escapeHtml(
+    c.crawlerAccess.blockedClassical.join(", ")
+  )}</p>` : "";
+  const sitemapLine = c.sitemapMeasured ? `<li>sitemap.xml: ${c.sitemapPresent ? "present" : "missing"}</li>` : `<li>sitemap.xml: not measured \u2014 ${STAGE_FAILED_MESSAGE}.</li>`;
+  const llmsLine = c.llmsTxtMeasured ? `<li>llms.txt: ${c.llmsTxtPresent ? "present" : "missing"}</li>` : `<li>llms.txt: not measured \u2014 ${STAGE_FAILED_MESSAGE}.</li>`;
+  return `${accessBlock}${classical}
+    <ul>
+      ${sitemapLine}
+      ${llmsLine}
+      <li>Pages missing a meta description: ${c.meta.missingDescription} of ${c.meta.pageCount}</li>
+      <li>Pages missing a canonical URL: ${c.meta.missingCanonical} of ${c.meta.pageCount}</li>
+      <li>Pages missing share images/titles: ${c.meta.missingSocial} of ${c.meta.pageCount}</li>
+      <li>Security headers missing: ${c.securityHeaders.missing.length ? escapeHtml(c.securityHeaders.missing.join(", ")) : "none"}</li>
+      ${c.meta.pagesWithoutExtract > 0 ? `<li><strong>${c.meta.pagesWithoutExtract}</strong> additional page${c.meta.pagesWithoutExtract === 1 ? "" : "s"} produced no readable content at all and ${c.meta.pagesWithoutExtract === 1 ? "is" : "are"} not counted in the ${c.meta.pageCount} pages above.</li>` : ""}
+    </ul>`;
+}
+function buildLighthouseBlock(lh) {
+  return lh.ok ? `<p class="muted">Lighthouse \u2014 performance ${lh.data.performance ?? "not measured"},
+       SEO ${lh.data.seo ?? "not measured"}, accessibility ${lh.data.accessibility ?? "not measured"}.</p>` : `<p class="muted">Lighthouse not measured \u2014 ${STAGE_FAILED_MESSAGE}.</p>`;
+}
+function buildReadabilitySection(c) {
+  const jsLine = c.jsDependence.avgMissing === null ? `<p class="muted">JavaScript-dependence: not measured \u2014 no page produced a comparable raw/rendered pair.</p>` : `<p><strong>${Math.round(c.jsDependence.avgMissing * 100)}%</strong> of the words a visitor reads only appear after JavaScript runs.
+    Most AI crawlers do not run JavaScript, so that share of your site is invisible to them.</p>`;
+  return `${jsLine}
+    <ul>
+      <li>Structured data found: ${c.schema.typesFound.length ? escapeHtml(c.schema.typesFound.join(", ")) : "none"}</li>
+      <li>Expected structured data missing: ${c.schema.missingExpected.length ? escapeHtml(c.schema.missingExpected.join(", ")) : "none"}</li>
+      <li>Pages without a top-level heading: ${c.headings.pagesWithoutH1} of ${c.meta.pageCount}</li>
+      ${c.meta.pagesWithoutExtract > 0 ? `<li><strong>${c.meta.pagesWithoutExtract}</strong> page${c.meta.pagesWithoutExtract === 1 ? "" : "s"} produced no extract at all \u2014 excluded from every figure above, not counted as readable or unreadable.</li>` : ""}
+    </ul>`;
+}
+function buildAnswersSection(a) {
+  const rows = a.buyerQuestions.map((q) => {
+    const answered = escapeHtml(q.answered);
+    const evidenceText = q.evidence ? escapeHtml(q.evidence) : null;
+    const evidenceHref = q.evidence && q.page ? safeUrl(q.page) : null;
+    const evidenceCell = evidenceText === null ? '<span class="muted">no passage on the site</span>' : evidenceHref && evidenceHref !== "#" ? `<a href="${escapeHtml(evidenceHref)}" target="_blank" rel="noopener noreferrer">${evidenceText}</a>` : evidenceText;
+    return `<tr>
+          <td>${escapeHtml(q.question)}</td>
+          <td><span class="tag ${answered}">${answered}</span></td>
+          <td>${evidenceCell}</td>
+        </tr>`;
+  }).join("");
+  return `<p>${escapeHtml(a.narrative.answers)}</p>
+    <table><tr><th>What buyers ask</th><th>Answered</th><th>Evidence</th></tr>${rows}</table>`;
+}
+function renderProspectReport(result) {
+  const host = hostnameOf(result.url);
+  const name = result.businessName && result.businessName.trim() ? result.businessName : host;
+  const date = formatIsoDate(result.generatedAt);
+  const findabilitySection = stageBody(result.checks, buildFindabilitySection);
+  const lighthouseBlock = buildLighthouseBlock(result.lighthouse);
+  const readabilitySection = stageBody(result.checks, buildReadabilitySection);
+  const businessNameUsed = Boolean(result.businessName && result.businessName.trim());
+  const fixes = result.analyze.ok ? (() => {
+    const sorted = [...result.analyze.data.fixes].sort(
+      (x, y) => IMPACT_ORDER[x.impact] - IMPACT_ORDER[y.impact]
+    );
+    if (sorted.length === 0) {
+      return `<p>Nothing here reads as urgent \u2014 the essentials are already in place.
+          Reddoor can still help push this further: tightening structured data, monitoring
+          how the answer engines describe you, and keeping pace as they change.</p>`;
+    }
+    return `<ol>${sorted.map((f) => {
+      const impact = escapeHtml(f.impact);
+      const effort = escapeHtml(f.effort);
+      return `<li><strong>${escapeHtml(f.title)}</strong> \u2014 ${escapeHtml(f.why)}
+          <span class="muted">(${impact} impact, ${effort} effort)</span></li>`;
+    }).join("")}</ol>`;
+  })() : skippableStageNote(
+    result.analyze.error,
+    ANALYZE_SKIPPED,
+    "Skipped \u2014 the checks stage failed, so there was nothing to build fixes from."
+  );
+  const probesSectionFinal = result.probes.ok ? buildProbesSection(result.probes.data, businessNameUsed) : skippableStageNote(
+    result.probes.error,
+    PROBES_SKIPPED,
+    "This audit did not run the AI-visibility probes."
+  );
+  const answersSectionFinal = result.analyze.ok ? buildAnswersSection(result.analyze.data) : skippableStageNote(
+    result.analyze.error,
+    ANALYZE_SKIPPED,
+    "Skipped \u2014 the checks stage failed, so there were no buyer questions to check."
+  );
+  const description = result.analyze.ok ? result.analyze.data.business : null;
+  const narrative = result.analyze.ok ? `<p class="lede">${escapeHtml(description ?? "")}</p>
+       <p class="lede">${escapeHtml(result.analyze.data.narrative.findability)}
+       ${escapeHtml(result.analyze.data.narrative.readability)}</p>` : "";
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<meta name="robots" content="noindex" />
+<title>Can AI find ${escapeHtml(name)}? \u2014 Reddoor audit</title>
+<link rel="preconnect" href="https://fonts.googleapis.com" />
+<link href="https://fonts.googleapis.com/css2?family=Besley:wght@400;600&display=swap" rel="stylesheet" />
+<style>${STYLES}</style>
+</head>
+<body>
+<div class="wrap">
+  <h1>Can AI and Google actually find ${escapeHtml(name)}?</h1>
+  <p class="lede"><a href="${escapeHtml(safeUrl(result.url))}" target="_blank" rel="noopener noreferrer">${escapeHtml(result.url)}</a> \xB7 audited ${escapeHtml(date)} by Reddoor Creative</p>
+  ${narrative}
+
+  <p class="muted">Each score below runs 0\u2013100 \u2014 read it as a score, not a percentage.</p>
+  <div class="scores">
+    ${scoreCard("Findability", result.scores.findability, "How easily AI and search crawlers can find and reach your site \u2014 crawl rules, sitemap, key metadata")}
+    ${scoreCard("Readability", result.scores.readability, "How much of your site's content those crawlers can actually read once they're in \u2014 most don't run JavaScript")}
+    ${scoreCard("Answers", result.scores.answers, "How many buyer questions your site's own content answers \u2014 separate from what the AI engines say back")}
+    ${scoreCard("AI Visibility", result.scores.aiVisibility, "Based on buyer questions \u2014 not questions that name the business directly")}
+  </div>
+
+  <h2>What the AI engines said about you</h2>
+  ${probesSectionFinal}
+
+  <h2>What the crawlers can reach</h2>
+  ${findabilitySection}
+  ${lighthouseBlock}
+
+  <h2>What the crawlers can read</h2>
+  ${readabilitySection}
+
+  <h2>The questions your buyers ask</h2>
+  ${answersSectionFinal}
+
+  <h2>What to fix first</h2>
+  ${fixes}
+
+  <div class="cta">
+    <h2>Want this fixed?</h2>
+    <p>Reddoor Creative rebuilds sites so answer engines can read, quote and recommend them.
+    Reply to the email this link came from, or start at
+    <a href="https://reddoorla.com/">reddoorla.com</a>.</p>
+  </div>
+</div>
+</body>
+</html>`;
+}
+
+export {
+  renderProspectReport
+};
+//# sourceMappingURL=chunk-DEWJMMG3.js.map

package/dist/chunk-DEWJMMG3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/prospect/render.ts"],"sourcesContent":["import { escapeHtml, safeUrl } from \"../util/html.js\";\nimport { hostnameOf } from \"../util/url.js\";\nimport { ANALYZE_SKIPPED, PROBES_SKIPPED } from \"./pipeline.js\";\nimport type {\n  AnalyzeResult,\n  ChecksResult,\n  Fix,\n  LighthouseScores,\n  ProbeAnswer,\n  ProbesResult,\n  ProspectAuditResult,\n  StageResult,\n} from \"./types.js\";\n\nconst RED = \"#d71920\";\nconst IMPACT_ORDER: Record<Fix[\"impact\"], number> = { high: 0, medium: 1, low: 2 };\nconst KIND_LABEL: Record<ProbeAnswer[\"kind\"], string> = {\n  branded: \"Branded — asked about the business by name\",\n  category: \"Category — the questions a buyer would actually type\",\n  competitor: \"Competitor — head-to-head comparisons\",\n};\nconst KIND_ORDER: ProbeAnswer[\"kind\"][] = [\"category\", \"branded\", \"competitor\"];\n\n/** Terse product mapping so a recipient who has never seen a crawler's raw\n *  user-agent string can place it — factual labelling, not a voice change. */\nconst AI_AGENT_LABELS: Record<string, string> = {\n  GPTBot: \"ChatGPT\",\n  \"OAI-SearchBot\": \"ChatGPT's search results\",\n  ClaudeBot: \"Claude\",\n  PerplexityBot: \"Perplexity\",\n  \"Google-Extended\": \"Gemini and Google's AI Overviews\",\n  CCBot: \"Common Crawl, used to train many AI models\",\n};\n\nfunction describeAgent(agent: string): string {\n  const label = AI_AGENT_LABELS[agent];\n  return label ? `${agent} (feeds ${label})` : agent;\n}\n\n/** Every genuine stage failure collapses to this one phrase — the real error\n *  (status codes, retry counts, timeouts — operator vocabulary) stays in the\n *  persisted JSON and CLI output for operators, but never reaches a stranger\n *  who would read it as broken software rather than a diagnostic. */\nconst STAGE_FAILED_MESSAGE = \"we could not complete this part of the analysis\";\n\nconst STYLES = `\n  :root { color-scheme: light; }\n  * { box-sizing: border-box; }\n  body { margin: 0; background: #faf8f5; color: #1a1a1a;\n    font: 16px/1.6 -apple-system, BlinkMacSystemFont, \"Segoe UI\", Helvetica, Arial, sans-serif; }\n  .wrap { max-width: 860px; margin: 0 auto; padding: 48px 24px 80px; }\n  h1, h2, h3 { font-family: Besley, Georgia, \"Times New Roman\", serif; font-weight: 600; line-height: 1.2; }\n  h1 { font-size: 40px; margin: 0 0 8px; }\n  h2 { font-size: 26px; margin: 48px 0 12px; border-top: 2px solid #e6e1da; padding-top: 24px; }\n  h3 { font-size: 18px; margin: 24px 0 8px; }\n  .lede { color: #57544f; margin: 0 0 8px; }\n  .scores { display: grid; grid-template-columns: repeat(auto-fit, minmax(160px, 1fr)); gap: 12px; margin: 32px 0; }\n  .score { background: #fff; border: 1px solid #e6e1da; border-radius: 8px; padding: 16px; }\n  .score .n { font-family: Besley, Georgia, serif; font-size: 38px; line-height: 1; color: ${RED}; }\n  .score .n.na { font-size: 18px; color: #8a857e; }\n  .score .l { font-size: 13px; letter-spacing: .08em; text-transform: uppercase; color: #57544f; margin-top: 8px; }\n  .score .hint { font-size: 12px; color: #8a857e; margin-top: 4px; }\n  .card { background: #fff; border: 1px solid #e6e1da; border-radius: 8px; padding: 16px; margin: 12px 0; }\n  .q { font-weight: 600; }\n  .tag { display: inline-block; font-size: 12px; letter-spacing: .06em; text-transform: uppercase;\n    border-radius: 999px; padding: 2px 10px; border: 1px solid currentColor; }\n  .yes { color: #14663c; } .partial { color: #8a6d00; } .no { color: ${RED}; }\n  ul { padding-left: 20px; } li { margin: 6px 0; }\n  .muted { color: #8a857e; }\n  .cta { margin-top: 56px; background: ${RED}; color: #fff; border-radius: 8px; padding: 24px 28px; }\n  .cta h2 { border: 0; padding: 0; margin: 0 0 8px; color: #fff; }\n  .cta a { color: #fff; }\n  table { width: 100%; border-collapse: collapse; margin-top: 8px; }\n  td, th { text-align: left; padding: 6px 8px; border-bottom: 1px solid #eee; vertical-align: top; }\n  @media print {\n    body { background: #fff; }\n    .card, .score, .cta { break-inside: avoid; }\n    /* Browsers default \"print background graphics\" OFF, which drops the red\n       .cta background but keeps its white text — the only ask in the report\n       would otherwise print white-on-white and vanish. Fall back to dark\n       text on no background with a visible border instead of relying on the\n       background for contrast. */\n    .cta { background: none; color: #1a1a1a; border: 2px solid ${RED}; }\n    .cta h2, .cta a { color: #1a1a1a; }\n  }\n`;\n\nfunction scoreCard(label: string, value: number | null, hint?: string): string {\n  const n =\n    value === null ? `<div class=\"n na\">Not measured</div>` : `<div class=\"n\">${value}</div>`;\n  const hintHtml = hint ? `<div class=\"hint\">${escapeHtml(hint)}</div>` : \"\";\n  return `<div class=\"score\">${n}<div class=\"l\">${escapeHtml(label)}</div>${hintHtml}</div>`;\n}\n\n/** Body for a stage that succeeded, or a uniform \"Not measured\" note when it didn't. */\nfunction stageBody<T>(stage: StageResult<T>, body: (data: T) => string): string {\n  return stage.ok ? body(stage.data) : notMeasuredNote();\n}\n\n/** The stage's real error is deliberately not a parameter here — see\n *  STAGE_FAILED_MESSAGE above. Every genuine failure reads the same\n *  client-safe way, regardless of what actually broke. */\nfunction notMeasuredNote(): string {\n  return `<p class=\"muted\">Not measured — ${STAGE_FAILED_MESSAGE}.</p>`;\n}\n\n/** A stage a human deliberately turned off (--no-probes, or analyze skipped\n *  because checks failed upstream) must read as \"you asked us to skip this\" —\n *  never as \"we tried and could not\", which is what a bare \"Not measured —\n *  {error}\" would otherwise imply. Compares against the pipeline's exported\n *  constants rather than a retyped string literal. */\nfunction skippableStageNote(error: string, skipConstant: string, skipMessage: string): string {\n  if (error === skipConstant) {\n    return `<p class=\"muted\">${escapeHtml(skipMessage)}</p>`;\n  }\n  return notMeasuredNote();\n}\n\n/** `new Date(iso).toLocaleDateString()` never throws on a bad timestamp — it\n *  silently returns \"Invalid Date\" — so a try/catch here is dead code. Guard\n *  on getTime() instead, and fall back to the raw ISO string so a corrupt\n *  timestamp is at least visibly a timestamp rather than the literal words\n *  \"Invalid Date\". */\nfunction formatIsoDate(iso: string): string {\n  const d = new Date(iso);\n  if (Number.isNaN(d.getTime())) return iso;\n  return d.toLocaleDateString(\"en-US\", {\n    year: \"numeric\",\n    month: \"long\",\n    day: \"numeric\",\n    timeZone: \"UTC\",\n  });\n}\n\n/** The probes section leads the report, so a branded-only run (analyze\n *  failed upstream and supplied no buyer questions, or every category query\n *  itself failed) must not let the branded recognition line read as a\n *  positive discoverability finding on its own — an engine echoing a name\n *  it was just handed proves nothing about whether a buyer who never named\n *  the business would find it. */\n/** `businessNameUsed` is whether a real business name was ever resolved and\n *  handed to any engine (ProspectAuditResult.businessName, the same value\n *  the pipeline actually queried with) — never the raw ProbesResult, which\n *  has no way to say \"no name was available\". Without this gate, \"even with\n *  the name handed to them\" is a false claim whenever businessName was empty. */\nfunction buildProbesSection(p: ProbesResult, businessNameUsed: boolean): string {\n  const byKind = new Map<ProbeAnswer[\"kind\"], ProbeAnswer[]>();\n  for (const a of p.answers) {\n    const bucket = byKind.get(a.kind) ?? [];\n    bucket.push(a);\n    byKind.set(a.kind, bucket);\n  }\n\n  const recognition = p.brandedRecognized\n    ? \"<p>When the engines were asked about the business by name, they recognized it.</p>\"\n    : businessNameUsed\n      ? \"<p>When the engines were asked about the business by name, they did not recognize it — a real citation of the site never showed up, even with the name handed to them.</p>\"\n      : \"<p>The engines did not recognize the business — there was no business name available to ask them with, so this reflects a harder starting point than a named query would.</p>\";\n\n  const categoryCaveat = byKind.has(\"category\")\n    ? \"\"\n    : `<p class=\"muted\"><strong>No buyer-question (category) query was tested here</strong> — only name-recognition. An engine echoing back a name it was just given says nothing about whether a buyer who had never heard of the business would be shown it; treat the line above as a floor, not a visibility signal.</p>`;\n\n  const groups = KIND_ORDER.filter((k) => byKind.has(k))\n    .map((kind) => {\n      const answers = byKind.get(kind) ?? [];\n      const cards = answers\n        .map(\n          (a) => `<div class=\"card\">\n          <div class=\"q\">${escapeHtml(a.engine)} · “${escapeHtml(a.query)}”</div>\n          <p class=\"muted\">Asked ${escapeHtml(formatIsoDate(a.askedAt))}</p>\n          <p>${escapeHtml(a.snippet)}${a.truncated ? \"…\" : \"\"}</p>\n          <p class=\"muted\">${\n            a.domainCited || a.brandMentioned\n              ? \"You were named in this answer.\"\n              : \"You were not named in this answer.\"\n          }${a.citedDomains.length ? ` Cited: ${escapeHtml(a.citedDomains.join(\", \"))}` : \"\"}</p>\n        </div>`,\n        )\n        .join(\"\");\n      return `<h3>${escapeHtml(KIND_LABEL[kind])}</h3>${cards}`;\n    })\n    .join(\"\");\n\n  const competitors = p.competitorsSeen.length\n    ? `<h3>Who the engines cited instead</h3><ul>${p.competitorsSeen\n        .map((c) => `<li>${escapeHtml(c.domain)} — ${c.count} time${c.count === 1 ? \"\" : \"s\"}</li>`)\n        .join(\"\")}</ul>`\n    : \"\";\n\n  return recognition + categoryCaveat + groups + competitors;\n}\n\n/** crawlerAccessMeasured is false only when the robots.txt fetch itself\n *  failed, so the blocked/allowed lists are empty out of ignorance, not\n *  because we confirmed access. Saying \"every crawler can reach the site\" in\n *  that case would manufacture a finding from our own missing data.\n *  sitemapMeasured/llmsTxtMeasured get the same treatment as\n *  crawlerAccessMeasured: a failed fetch reads as \"not measured\", never as a\n *  confirmed \"missing\" — that's a claim about the prospect's site we haven't\n *  earned. Item 1: none of the three \"not measured\" lines below take the raw\n *  fetch error as input anymore — status codes and transport vocabulary\n *  (\"503 Service Unavailable\", \"ETIMEDOUT\") are operator vocabulary, same as\n *  a stage failure (see STAGE_FAILED_MESSAGE); the real error still lives in\n *  the persisted JSON and CLI output, never in this client-facing page. */\nfunction buildFindabilitySection(c: ChecksResult): string {\n  const accessBlock = !c.crawlerAccessMeasured\n    ? `<p class=\"muted\">Crawler access: not measured — ${STAGE_FAILED_MESSAGE}.</p>`\n    : c.crawlerAccess.blockedAi.length\n      ? `<p><strong>Blocked AI crawlers:</strong> ${escapeHtml(\n          c.crawlerAccess.blockedAi.map(describeAgent).join(\", \"),\n        )}</p>`\n      : `<p>Every AI crawler we checked can reach the site.</p>`;\n  const classical =\n    c.crawlerAccessMeasured && c.crawlerAccess.blockedClassical.length\n      ? `<p><strong>Blocked search crawlers:</strong> ${escapeHtml(\n          c.crawlerAccess.blockedClassical.join(\", \"),\n        )}</p>`\n      : \"\";\n  const sitemapLine = c.sitemapMeasured\n    ? `<li>sitemap.xml: ${c.sitemapPresent ? \"present\" : \"missing\"}</li>`\n    : `<li>sitemap.xml: not measured — ${STAGE_FAILED_MESSAGE}.</li>`;\n  const llmsLine = c.llmsTxtMeasured\n    ? `<li>llms.txt: ${c.llmsTxtPresent ? \"present\" : \"missing\"}</li>`\n    : `<li>llms.txt: not measured — ${STAGE_FAILED_MESSAGE}.</li>`;\n  return `${accessBlock}${classical}\n    <ul>\n      ${sitemapLine}\n      ${llmsLine}\n      <li>Pages missing a meta description: ${c.meta.missingDescription} of ${c.meta.pageCount}</li>\n      <li>Pages missing a canonical URL: ${c.meta.missingCanonical} of ${c.meta.pageCount}</li>\n      <li>Pages missing share images/titles: ${c.meta.missingSocial} of ${c.meta.pageCount}</li>\n      <li>Security headers missing: ${\n        c.securityHeaders.missing.length ? escapeHtml(c.securityHeaders.missing.join(\", \")) : \"none\"\n      }</li>\n      ${\n        c.meta.pagesWithoutExtract > 0\n          ? `<li><strong>${c.meta.pagesWithoutExtract}</strong> additional page${\n              c.meta.pagesWithoutExtract === 1 ? \"\" : \"s\"\n            } produced no readable content at all and ${\n              c.meta.pagesWithoutExtract === 1 ? \"is\" : \"are\"\n            } not counted in the ${c.meta.pageCount} pages above.</li>`\n          : \"\"\n      }\n    </ul>`;\n}\n\n/** Lighthouse runs as its own independent pipeline stage (see pipeline.ts) —\n *  it does not depend on `checks` succeeding. Rendering it off `result.checks`\n *  would throw away real, measured performance/SEO/accessibility numbers\n *  whenever an unrelated stage failed, so this reads `result.lighthouse`\n *  directly and is rendered unconditionally, not nested inside the checks\n *  degrade path. */\nfunction buildLighthouseBlock(lh: StageResult<LighthouseScores>): string {\n  return lh.ok\n    ? `<p class=\"muted\">Lighthouse — performance ${lh.data.performance ?? \"not measured\"},\n       SEO ${lh.data.seo ?? \"not measured\"}, accessibility ${lh.data.accessibility ?? \"not measured\"}.</p>`\n    : `<p class=\"muted\">Lighthouse not measured — ${STAGE_FAILED_MESSAGE}.</p>`;\n}\n\nfunction buildReadabilitySection(c: ChecksResult): string {\n  const jsLine =\n    c.jsDependence.avgMissing === null\n      ? `<p class=\"muted\">JavaScript-dependence: not measured — no page produced a comparable raw/rendered pair.</p>`\n      : `<p><strong>${Math.round(c.jsDependence.avgMissing * 100)}%</strong> of the words a visitor reads only appear after JavaScript runs.\n    Most AI crawlers do not run JavaScript, so that share of your site is invisible to them.</p>`;\n  return `${jsLine}\n    <ul>\n      <li>Structured data found: ${c.schema.typesFound.length ? escapeHtml(c.schema.typesFound.join(\", \")) : \"none\"}</li>\n      <li>Expected structured data missing: ${\n        c.schema.missingExpected.length ? escapeHtml(c.schema.missingExpected.join(\", \")) : \"none\"\n      }</li>\n      <li>Pages without a top-level heading: ${c.headings.pagesWithoutH1} of ${c.meta.pageCount}</li>\n      ${\n        c.meta.pagesWithoutExtract > 0\n          ? `<li><strong>${c.meta.pagesWithoutExtract}</strong> page${\n              c.meta.pagesWithoutExtract === 1 ? \"\" : \"s\"\n            } produced no extract at all — excluded from every figure above, not counted as readable or unreadable.</li>`\n          : \"\"\n      }\n    </ul>`;\n}\n\n/** The report's whole premise is claims the recipient can go check — so the\n *  one quoted passage of evidence links to the page it came from (via\n *  safeUrl; a null/non-http page renders as plain escaped text, no dead\n *  \"#\" anchor). `answered`/`impact`/`effort` are escaped even though a zod\n *  enum constrains them upstream — the renderer should not depend on\n *  another file staying in sync to stay safe. */\nfunction buildAnswersSection(a: AnalyzeResult): string {\n  const rows = a.buyerQuestions\n    .map((q) => {\n      const answered = escapeHtml(q.answered);\n      const evidenceText = q.evidence ? escapeHtml(q.evidence) : null;\n      const evidenceHref = q.evidence && q.page ? safeUrl(q.page) : null;\n      const evidenceCell =\n        evidenceText === null\n          ? '<span class=\"muted\">no passage on the site</span>'\n          : evidenceHref && evidenceHref !== \"#\"\n            ? `<a href=\"${escapeHtml(evidenceHref)}\" target=\"_blank\" rel=\"noopener noreferrer\">${evidenceText}</a>`\n            : evidenceText;\n      return `<tr>\n          <td>${escapeHtml(q.question)}</td>\n          <td><span class=\"tag ${answered}\">${answered}</span></td>\n          <td>${evidenceCell}</td>\n        </tr>`;\n    })\n    .join(\"\");\n  return `<p>${escapeHtml(a.narrative.answers)}</p>\n    <table><tr><th>What buyers ask</th><th>Answered</th><th>Evidence</th></tr>${rows}</table>`;\n}\n\nexport function renderProspectReport(result: ProspectAuditResult): string {\n  const host = hostnameOf(result.url);\n  // `businessName` is the searchable NAME (possibly \"\"), never the\n  // description. An empty/missing name is itself a finding — fall back to\n  // the hostname rather than printing nothing, or worse, printing \"\" as if\n  // it were a verified fact about the business.\n  const name = result.businessName && result.businessName.trim() ? result.businessName : host;\n  const date = formatIsoDate(result.generatedAt);\n\n  const findabilitySection = stageBody(result.checks, buildFindabilitySection);\n  const lighthouseBlock = buildLighthouseBlock(result.lighthouse);\n  const readabilitySection = stageBody(result.checks, buildReadabilitySection);\n\n  // A real business name was resolved and handed to the engines only when\n  // `result.businessName` is non-empty — the same value the pipeline\n  // actually queried with (see pipeline.ts). Used to gate the probes\n  // section's \"even with the name handed to them\" phrasing (Fix 6).\n  const businessNameUsed = Boolean(result.businessName && result.businessName.trim());\n\n  const fixes = result.analyze.ok\n    ? (() => {\n        const sorted = [...result.analyze.data.fixes].sort(\n          (x, y) => IMPACT_ORDER[x.impact] - IMPACT_ORDER[y.impact],\n        );\n        if (sorted.length === 0) {\n          // A genuinely well-optimized site: a bare empty list reads as a\n          // rendering bug, not a compliment. Say so directly, and keep this\n          // section as a pitch — it's the one the salesperson is sending\n          // the report to make.\n          return `<p>Nothing here reads as urgent — the essentials are already in place.\n          Reddoor can still help push this further: tightening structured data, monitoring\n          how the answer engines describe you, and keeping pace as they change.</p>`;\n        }\n        return `<ol>${sorted\n          .map((f) => {\n            const impact = escapeHtml(f.impact);\n            const effort = escapeHtml(f.effort);\n            return `<li><strong>${escapeHtml(f.title)}</strong> — ${escapeHtml(f.why)}\n          <span class=\"muted\">(${impact} impact, ${effort} effort)</span></li>`;\n          })\n          .join(\"\")}</ol>`;\n      })()\n    : skippableStageNote(\n        result.analyze.error,\n        ANALYZE_SKIPPED,\n        \"Skipped — the checks stage failed, so there was nothing to build fixes from.\",\n      );\n\n  const probesSectionFinal = result.probes.ok\n    ? buildProbesSection(result.probes.data, businessNameUsed)\n    : skippableStageNote(\n        result.probes.error,\n        PROBES_SKIPPED,\n        \"This audit did not run the AI-visibility probes.\",\n      );\n\n  const answersSectionFinal = result.analyze.ok\n    ? buildAnswersSection(result.analyze.data)\n    : skippableStageNote(\n        result.analyze.error,\n        ANALYZE_SKIPPED,\n        \"Skipped — the checks stage failed, so there were no buyer questions to check.\",\n      );\n\n  const description = result.analyze.ok ? result.analyze.data.business : null;\n  const narrative = result.analyze.ok\n    ? `<p class=\"lede\">${escapeHtml(description ?? \"\")}</p>\n       <p class=\"lede\">${escapeHtml(result.analyze.data.narrative.findability)}\n       ${escapeHtml(result.analyze.data.narrative.readability)}</p>`\n    : \"\";\n\n  return `<!doctype html>\n<html lang=\"en\">\n<head>\n<meta charset=\"utf-8\" />\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />\n<meta name=\"robots\" content=\"noindex\" />\n<title>Can AI find ${escapeHtml(name)}? — Reddoor audit</title>\n<link rel=\"preconnect\" href=\"https://fonts.googleapis.com\" />\n<link href=\"https://fonts.googleapis.com/css2?family=Besley:wght@400;600&display=swap\" rel=\"stylesheet\" />\n<style>${STYLES}</style>\n</head>\n<body>\n<div class=\"wrap\">\n  <h1>Can AI and Google actually find ${escapeHtml(name)}?</h1>\n  <p class=\"lede\"><a href=\"${escapeHtml(safeUrl(result.url))}\" target=\"_blank\" rel=\"noopener noreferrer\">${escapeHtml(result.url)}</a> · audited ${escapeHtml(date)} by Reddoor Creative</p>\n  ${narrative}\n\n  <p class=\"muted\">Each score below runs 0–100 — read it as a score, not a percentage.</p>\n  <div class=\"scores\">\n    ${scoreCard(\"Findability\", result.scores.findability, \"How easily AI and search crawlers can find and reach your site — crawl rules, sitemap, key metadata\")}\n    ${scoreCard(\"Readability\", result.scores.readability, \"How much of your site's content those crawlers can actually read once they're in — most don't run JavaScript\")}\n    ${scoreCard(\"Answers\", result.scores.answers, \"How many buyer questions your site's own content answers — separate from what the AI engines say back\")}\n    ${scoreCard(\"AI Visibility\", result.scores.aiVisibility, \"Based on buyer questions — not questions that name the business directly\")}\n  </div>\n\n  <h2>What the AI engines said about you</h2>\n  ${probesSectionFinal}\n\n  <h2>What the crawlers can reach</h2>\n  ${findabilitySection}\n  ${lighthouseBlock}\n\n  <h2>What the crawlers can read</h2>\n  ${readabilitySection}\n\n  <h2>The questions your buyers ask</h2>\n  ${answersSectionFinal}\n\n  <h2>What to fix first</h2>\n  ${fixes}\n\n  <div class=\"cta\">\n    <h2>Want this fixed?</h2>\n    <p>Reddoor Creative rebuilds sites so answer engines can read, quote and recommend them.\n    Reply to the email this link came from, or start at\n    <a href=\"https://reddoorla.com/\">reddoorla.com</a>.</p>\n  </div>\n</div>\n</body>\n</html>`;\n}\n"],"mappings":";;;;;;;;;;;;;AAcA,IAAM,MAAM;AACZ,IAAM,eAA8C,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,EAAE;AACjF,IAAM,aAAkD;AAAA,EACtD,SAAS;AAAA,EACT,UAAU;AAAA,EACV,YAAY;AACd;AACA,IAAM,aAAoC,CAAC,YAAY,WAAW,YAAY;AAI9E,IAAM,kBAA0C;AAAA,EAC9C,QAAQ;AAAA,EACR,iBAAiB;AAAA,EACjB,WAAW;AAAA,EACX,eAAe;AAAA,EACf,mBAAmB;AAAA,EACnB,OAAO;AACT;AAEA,SAAS,cAAc,OAAuB;AAC5C,QAAM,QAAQ,gBAAgB,KAAK;AACnC,SAAO,QAAQ,GAAG,KAAK,WAAW,KAAK,MAAM;AAC/C;AAMA,IAAM,uBAAuB;AAE7B,IAAM,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,6FAa8E,GAAG;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,uEAQzB,GAAG;AAAA;AAAA;AAAA,yCAGjC,GAAG;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iEAaqB,GAAG;AAAA;AAAA;AAAA;AAKpE,SAAS,UAAU,OAAe,OAAsB,MAAuB;AAC7E,QAAM,IACJ,UAAU,OAAO,yCAAyC,kBAAkB,KAAK;AACnF,QAAM,WAAW,OAAO,qBAAqB,WAAW,IAAI,CAAC,WAAW;AACxE,SAAO,sBAAsB,CAAC,kBAAkB,WAAW,KAAK,CAAC,SAAS,QAAQ;AACpF;AAGA,SAAS,UAAa,OAAuB,MAAmC;AAC9E,SAAO,MAAM,KAAK,KAAK,MAAM,IAAI,IAAI,gBAAgB;AACvD;AAKA,SAAS,kBAA0B;AACjC,SAAO,wCAAmC,oBAAoB;AAChE;AAOA,SAAS,mBAAmB,OAAe,cAAsB,aAA6B;AAC5F,MAAI,UAAU,cAAc;AAC1B,WAAO,oBAAoB,WAAW,WAAW,CAAC;AAAA,EACpD;AACA,SAAO,gBAAgB;AACzB;AAOA,SAAS,cAAc,KAAqB;AAC1C,QAAM,IAAI,IAAI,KAAK,GAAG;AACtB,MAAI,OAAO,MAAM,EAAE,QAAQ,CAAC,EAAG,QAAO;AACtC,SAAO,EAAE,mBAAmB,SAAS;AAAA,IACnC,MAAM;AAAA,IACN,OAAO;AAAA,IACP,KAAK;AAAA,IACL,UAAU;AAAA,EACZ,CAAC;AACH;AAaA,SAAS,mBAAmB,GAAiB,kBAAmC;AAC9E,QAAM,SAAS,oBAAI,IAAwC;AAC3D,aAAW,KAAK,EAAE,SAAS;AACzB,UAAM,SAAS,OAAO,IAAI,EAAE,IAAI,KAAK,CAAC;AACtC,WAAO,KAAK,CAAC;AACb,WAAO,IAAI,EAAE,MAAM,MAAM;AAAA,EAC3B;AAEA,QAAM,cAAc,EAAE,oBAClB,uFACA,mBACE,oLACA;AAEN,QAAM,iBAAiB,OAAO,IAAI,UAAU,IACxC,KACA;AAEJ,QAAM,SAAS,WAAW,OAAO,CAAC,MAAM,OAAO,IAAI,CAAC,CAAC,EAClD,IAAI,CAAC,SAAS;AACb,UAAM,UAAU,OAAO,IAAI,IAAI,KAAK,CAAC;AACrC,UAAM,QAAQ,QACX;AAAA,MACC,CAAC,MAAM;AAAA,2BACU,WAAW,EAAE,MAAM,CAAC,eAAO,WAAW,EAAE,KAAK,CAAC;AAAA,mCACtC,WAAW,cAAc,EAAE,OAAO,CAAC,CAAC;AAAA,eACxD,WAAW,EAAE,OAAO,CAAC,GAAG,EAAE,YAAY,WAAM,EAAE;AAAA,6BAEjD,EAAE,eAAe,EAAE,iBACf,mCACA,oCACN,GAAG,EAAE,aAAa,SAAS,WAAW,WAAW,EAAE,aAAa,KAAK,IAAI,CAAC,CAAC,KAAK,EAAE;AAAA;AAAA,IAEpF,EACC,KAAK,EAAE;AACV,WAAO,OAAO,WAAW,WAAW,IAAI,CAAC,CAAC,QAAQ,KAAK;AAAA,EACzD,CAAC,EACA,KAAK,EAAE;AAEV,QAAM,cAAc,EAAE,gBAAgB,SAClC,6CAA6C,EAAE,gBAC5C,IAAI,CAAC,MAAM,OAAO,WAAW,EAAE,MAAM,CAAC,WAAM,EAAE,KAAK,QAAQ,EAAE,UAAU,IAAI,KAAK,GAAG,OAAO,EAC1F,KAAK,EAAE,CAAC,UACX;AAEJ,SAAO,cAAc,iBAAiB,SAAS;AACjD;AAcA,SAAS,wBAAwB,GAAyB;AACxD,QAAM,cAAc,CAAC,EAAE,wBACnB,wDAAmD,oBAAoB,UACvE,EAAE,cAAc,UAAU,SACxB,4CAA4C;AAAA,IAC1C,EAAE,cAAc,UAAU,IAAI,aAAa,EAAE,KAAK,IAAI;AAAA,EACxD,CAAC,SACD;AACN,QAAM,YACJ,EAAE,yBAAyB,EAAE,cAAc,iBAAiB,SACxD,gDAAgD;AAAA,IAC9C,EAAE,cAAc,iBAAiB,KAAK,IAAI;AAAA,EAC5C,CAAC,SACD;AACN,QAAM,cAAc,EAAE,kBAClB,oBAAoB,EAAE,iBAAiB,YAAY,SAAS,UAC5D,wCAAmC,oBAAoB;AAC3D,QAAM,WAAW,EAAE,kBACf,iBAAiB,EAAE,iBAAiB,YAAY,SAAS,UACzD,qCAAgC,oBAAoB;AACxD,SAAO,GAAG,WAAW,GAAG,SAAS;AAAA;AAAA,QAE3B,WAAW;AAAA,QACX,QAAQ;AAAA,8CAC8B,EAAE,KAAK,kBAAkB,OAAO,EAAE,KAAK,SAAS;AAAA,2CACnD,EAAE,KAAK,gBAAgB,OAAO,EAAE,KAAK,SAAS;AAAA,+CAC1C,EAAE,KAAK,aAAa,OAAO,EAAE,KAAK,SAAS;AAAA,sCAElF,EAAE,gBAAgB,QAAQ,SAAS,WAAW,EAAE,gBAAgB,QAAQ,KAAK,IAAI,CAAC,IAAI,MACxF;AAAA,QAEE,EAAE,KAAK,sBAAsB,IACzB,eAAe,EAAE,KAAK,mBAAmB,4BACvC,EAAE,KAAK,wBAAwB,IAAI,KAAK,GAC1C,4CACE,EAAE,KAAK,wBAAwB,IAAI,OAAO,KAC5C,uBAAuB,EAAE,KAAK,SAAS,uBACvC,EACN;AAAA;AAEN;AAQA,SAAS,qBAAqB,IAA2C;AACvE,SAAO,GAAG,KACN,kDAA6C,GAAG,KAAK,eAAe,cAAc;AAAA,aAC3E,GAAG,KAAK,OAAO,cAAc,mBAAmB,GAAG,KAAK,iBAAiB,cAAc,UAC9F,mDAA8C,oBAAoB;AACxE;AAEA,SAAS,wBAAwB,GAAyB;AACxD,QAAM,SACJ,EAAE,aAAa,eAAe,OAC1B,qHACA,cAAc,KAAK,MAAM,EAAE,aAAa,aAAa,GAAG,CAAC;AAAA;AAE/D,SAAO,GAAG,MAAM;AAAA;AAAA,mCAEiB,EAAE,OAAO,WAAW,SAAS,WAAW,EAAE,OAAO,WAAW,KAAK,IAAI,CAAC,IAAI,MAAM;AAAA,8CAE3G,EAAE,OAAO,gBAAgB,SAAS,WAAW,EAAE,OAAO,gBAAgB,KAAK,IAAI,CAAC,IAAI,MACtF;AAAA,+CACyC,EAAE,SAAS,cAAc,OAAO,EAAE,KAAK,SAAS;AAAA,QAEvF,EAAE,KAAK,sBAAsB,IACzB,eAAe,EAAE,KAAK,mBAAmB,iBACvC,EAAE,KAAK,wBAAwB,IAAI,KAAK,GAC1C,qHACA,EACN;AAAA;AAEN;AAQA,SAAS,oBAAoB,GAA0B;AACrD,QAAM,OAAO,EAAE,eACZ,IAAI,CAAC,MAAM;AACV,UAAM,WAAW,WAAW,EAAE,QAAQ;AACtC,UAAM,eAAe,EAAE,WAAW,WAAW,EAAE,QAAQ,IAAI;AAC3D,UAAM,eAAe,EAAE,YAAY,EAAE,OAAO,QAAQ,EAAE,IAAI,IAAI;AAC9D,UAAM,eACJ,iBAAiB,OACb,sDACA,gBAAgB,iBAAiB,MAC/B,YAAY,WAAW,YAAY,CAAC,+CAA+C,YAAY,SAC/F;AACR,WAAO;AAAA,gBACG,WAAW,EAAE,QAAQ,CAAC;AAAA,iCACL,QAAQ,KAAK,QAAQ;AAAA,gBACtC,YAAY;AAAA;AAAA,EAExB,CAAC,EACA,KAAK,EAAE;AACV,SAAO,MAAM,WAAW,EAAE,UAAU,OAAO,CAAC;AAAA,gFACkC,IAAI;AACpF;AAEO,SAAS,qBAAqB,QAAqC;AACxE,QAAM,OAAO,WAAW,OAAO,GAAG;AAKlC,QAAM,OAAO,OAAO,gBAAgB,OAAO,aAAa,KAAK,IAAI,OAAO,eAAe;AACvF,QAAM,OAAO,cAAc,OAAO,WAAW;AAE7C,QAAM,qBAAqB,UAAU,OAAO,QAAQ,uBAAuB;AAC3E,QAAM,kBAAkB,qBAAqB,OAAO,UAAU;AAC9D,QAAM,qBAAqB,UAAU,OAAO,QAAQ,uBAAuB;AAM3E,QAAM,mBAAmB,QAAQ,OAAO,gBAAgB,OAAO,aAAa,KAAK,CAAC;AAElF,QAAM,QAAQ,OAAO,QAAQ,MACxB,MAAM;AACL,UAAM,SAAS,CAAC,GAAG,OAAO,QAAQ,KAAK,KAAK,EAAE;AAAA,MAC5C,CAAC,GAAG,MAAM,aAAa,EAAE,MAAM,IAAI,aAAa,EAAE,MAAM;AAAA,IAC1D;AACA,QAAI,OAAO,WAAW,GAAG;AAKvB,aAAO;AAAA;AAAA;AAAA,IAGT;AACA,WAAO,OAAO,OACX,IAAI,CAAC,MAAM;AACV,YAAM,SAAS,WAAW,EAAE,MAAM;AAClC,YAAM,SAAS,WAAW,EAAE,MAAM;AAClC,aAAO,eAAe,WAAW,EAAE,KAAK,CAAC,oBAAe,WAAW,EAAE,GAAG,CAAC;AAAA,iCACpD,MAAM,YAAY,MAAM;AAAA,IAC/C,CAAC,EACA,KAAK,EAAE,CAAC;AAAA,EACb,GAAG,IACH;AAAA,IACE,OAAO,QAAQ;AAAA,IACf;AAAA,IACA;AAAA,EACF;AAEJ,QAAM,qBAAqB,OAAO,OAAO,KACrC,mBAAmB,OAAO,OAAO,MAAM,gBAAgB,IACvD;AAAA,IACE,OAAO,OAAO;AAAA,IACd;AAAA,IACA;AAAA,EACF;AAEJ,QAAM,sBAAsB,OAAO,QAAQ,KACvC,oBAAoB,OAAO,QAAQ,IAAI,IACvC;AAAA,IACE,OAAO,QAAQ;AAAA,IACf;AAAA,IACA;AAAA,EACF;AAEJ,QAAM,cAAc,OAAO,QAAQ,KAAK,OAAO,QAAQ,KAAK,WAAW;AACvE,QAAM,YAAY,OAAO,QAAQ,KAC7B,mBAAmB,WAAW,eAAe,EAAE,CAAC;AAAA,yBAC7B,WAAW,OAAO,QAAQ,KAAK,UAAU,WAAW,CAAC;AAAA,SACrE,WAAW,OAAO,QAAQ,KAAK,UAAU,WAAW,CAAC,SACxD;AAEJ,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,qBAMY,WAAW,IAAI,CAAC;AAAA;AAAA;AAAA,SAG5B,MAAM;AAAA;AAAA;AAAA;AAAA,wCAIyB,WAAW,IAAI,CAAC;AAAA,6BAC3B,WAAW,QAAQ,OAAO,GAAG,CAAC,CAAC,+CAA+C,WAAW,OAAO,GAAG,CAAC,qBAAkB,WAAW,IAAI,CAAC;AAAA,IAC/J,SAAS;AAAA;AAAA;AAAA;AAAA,MAIP,UAAU,eAAe,OAAO,OAAO,aAAa,0GAAqG,CAAC;AAAA,MAC1J,UAAU,eAAe,OAAO,OAAO,aAAa,mHAA8G,CAAC;AAAA,MACnK,UAAU,WAAW,OAAO,OAAO,SAAS,4GAAuG,CAAC;AAAA,MACpJ,UAAU,iBAAiB,OAAO,OAAO,cAAc,+EAA0E,CAAC;AAAA;AAAA;AAAA;AAAA,IAIpI,kBAAkB;AAAA;AAAA;AAAA,IAGlB,kBAAkB;AAAA,IAClB,eAAe;AAAA;AAAA;AAAA,IAGf,kBAAkB;AAAA;AAAA;AAAA,IAGlB,mBAAmB;AAAA;AAAA;AAAA,IAGnB,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAWT;","names":[]}

package/dist/{chunk-SEEA6RXF.js → chunk-DJZWYIPP.js}

@@ -5,7 +5,7 @@ function escapeHtml(s) {
 function safeUrl(raw) {
   try {
     const u = new URL(raw);
-    if (u.protocol === "http:" || u.protocol === "https:") return raw;
+    if (u.protocol === "http:" || u.protocol === "https:") return u.href;
   } catch {
   }
   return "#";
@@ -15,4 +15,4 @@ export {
   escapeHtml,
   safeUrl
 };
-//# sourceMappingURL=chunk-SEEA6RXF.js.map
+//# sourceMappingURL=chunk-DJZWYIPP.js.map

package/dist/chunk-DJZWYIPP.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/util/html.ts"],"sourcesContent":["/**\n * Shared HTML/XML escape. One implementation behind the dashboard renderers\n * (`src/dashboard/render.ts`, `fleet-render.ts`), the daily digest\n * (`src/reports/digest.ts`), and the MJML email templates\n * (`src/reports/*-email/template.ts`).\n *\n * The set is the strict-XML set (`& < > \" '`), which is exactly what MJML's\n * `validationLevel: \"strict\"` parser needs and a superset of what plain HTML text\n * interpolation needs — so the SAME function serves both sinks. Site names\n * (e.g. \"Brown & Co\"), URLs, and operator commentary must not break the markup or\n * inject. The MJML templates re-export this as `escapeXml` for their callers.\n */\nexport function escapeHtml(s: string): string {\n  return s\n    .replace(/&/g, \"&amp;\")\n    .replace(/</g, \"&lt;\")\n    .replace(/>/g, \"&gt;\")\n    .replace(/\"/g, \"&quot;\")\n    .replace(/'/g, \"&#39;\");\n}\n\n/** Allow only http(s) URLs in an href context; everything else collapses to \"#\".\n *\n * Returns the PARSED, percent-encoded `u.href` — never the caller's raw string.\n * `new URL()` only validates the scheme; it does not sanitize the rest of the\n * string, so a well-formed https URL carrying a quote-breakout payload\n * (`https://x.example/\"><script>...`) parses fine and, if handed back\n * verbatim, produces a live injection wherever a caller interpolates the\n * result into an href without a further escapeHtml pass. Returning `u.href`\n * closes that gap: the URL parser itself percent-encodes `\"`, `<`, `>`, etc.\n * in the path/query. This also normalizes a bare-origin URL to carry a\n * trailing slash (`https://x.example` → `https://x.example/`) — a caller\n * that additionally wraps the result in escapeHtml (the majority pattern in\n * this repo) sees no behavior change beyond that encoding. */\nexport function safeUrl(raw: string): string {\n  try {\n    const u = new URL(raw);\n    if (u.protocol === \"http:\" || u.protocol === \"https:\") return u.href;\n  } catch {\n    // fall through\n  }\n  return \"#\";\n}\n"],"mappings":";AAYO,SAAS,WAAW,GAAmB;AAC5C,SAAO,EACJ,QAAQ,MAAM,OAAO,EACrB,QAAQ,MAAM,MAAM,EACpB,QAAQ,MAAM,MAAM,EACpB,QAAQ,MAAM,QAAQ,EACtB,QAAQ,MAAM,OAAO;AAC1B;AAeO,SAAS,QAAQ,KAAqB;AAC3C,MAAI;AACF,UAAM,IAAI,IAAI,IAAI,GAAG;AACrB,QAAI,EAAE,aAAa,WAAW,EAAE,aAAa,SAAU,QAAO,EAAE;AAAA,EAClE,QAAQ;AAAA,EAER;AACA,SAAO;AACT;","names":[]}

package/dist/chunk-EVBCK2KC.js

@@ -0,0 +1,68 @@
+// src/util/url.ts
+function isHttpUrl(s) {
+  let parsed;
+  try {
+    parsed = new URL(s);
+  } catch {
+    return false;
+  }
+  return parsed.protocol === "http:" || parsed.protocol === "https:";
+}
+function hostnameOf(s) {
+  try {
+    return new URL(s).hostname;
+  } catch {
+    return s;
+  }
+}
+function isNetlifyAppUrl(s) {
+  let parsed;
+  try {
+    parsed = new URL(s);
+  } catch {
+    return false;
+  }
+  const host = parsed.hostname.toLowerCase();
+  return host === "netlify.app" || host.endsWith(".netlify.app");
+}
+function isPrivateOrLoopbackHost(hostname) {
+  let host = hostname.toLowerCase();
+  if (host === "localhost" || host.endsWith(".localhost")) return true;
+  if (host.startsWith("[") && host.endsWith("]")) host = host.slice(1, -1);
+  if (host.includes(":")) {
+    if (host === "::1" || host === "::") return true;
+    if (/^fe[89ab]/.test(host)) return true;
+    if (/^f[cd]/.test(host)) return true;
+    if (host.startsWith("::ffff:") || host.startsWith("64:ff9b:")) return true;
+    return false;
+  }
+  if (/^\d{1,3}(\.\d{1,3}){3}$/.test(host)) {
+    const [a, b] = host.split(".").map(Number);
+    if (a === 0 || a === 10 || a === 127) return true;
+    if (a === 169 && b === 254) return true;
+    if (a === 172 && b !== void 0 && b >= 16 && b <= 31) return true;
+    if (a === 192 && b === 168) return true;
+    if (a === 100 && b !== void 0 && b >= 64 && b <= 127) return true;
+    return false;
+  }
+  return false;
+}
+function isPublicHttpsUrl(s) {
+  let parsed;
+  try {
+    parsed = new URL(s);
+  } catch {
+    return false;
+  }
+  if (parsed.protocol !== "https:") return false;
+  return !isPrivateOrLoopbackHost(parsed.hostname);
+}
+
+export {
+  isHttpUrl,
+  hostnameOf,
+  isNetlifyAppUrl,
+  isPrivateOrLoopbackHost,
+  isPublicHttpsUrl
+};
+//# sourceMappingURL=chunk-EVBCK2KC.js.map

package/dist/chunk-EVBCK2KC.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/util/url.ts"],"sourcesContent":["/**\n * True when `s` parses as an absolute URL whose scheme is `http:` or `https:`.\n *\n * The single allowlist gate for any value we hand to Chrome/Lighthouse. A\n * deployed-audit URL flows in from Airtable's `url` column (or a JSON\n * inventory's `deployedUrl`), so a `file://`/`gopher://`/`data:` value — or a\n * value pointing at an internal host — would otherwise become a local-file read\n * or SSRF when lhci drives a headless browser at it. Restricting to http(s)\n * keeps the audit to the real, network-reachable site.\n */\nexport function isHttpUrl(s: string): boolean {\n  let parsed: URL;\n  try {\n    parsed = new URL(s);\n  } catch {\n    return false;\n  }\n  return parsed.protocol === \"http:\" || parsed.protocol === \"https:\";\n}\n\n/**\n * The hostname of `s`, or `s` itself when it doesn't parse as a URL — a\n * human-facing fallback label, never a thrown error. Used anywhere a short\n * site label is wanted and the full URL would be noisy: the prospect-audit\n * CLI's summary line and its report's <h1>/title both fall back to this when\n * no business name was resolved.\n */\nexport function hostnameOf(s: string): string {\n  try {\n    return new URL(s).hostname;\n  } catch {\n    return s;\n  }\n}\n\n/**\n * True when `s` is a URL served from Netlify's default `*.netlify.app` host —\n * i.e. the site has no custom domain. Matches the apex `netlify.app` and any\n * subdomain of it (including deploy-preview hosts like `branch--site.netlify.app`),\n * but is not fooled by a look-alike such as `foo.netlify.app.evil.com` (the host\n * must END at `.netlify.app`). An unparseable/empty value is not a match.\n */\nexport function isNetlifyAppUrl(s: string): boolean {\n  let parsed: URL;\n  try {\n    parsed = new URL(s);\n  } catch {\n    return false;\n  }\n  const host = parsed.hostname.toLowerCase();\n  return host === \"netlify.app\" || host.endsWith(\".netlify.app\");\n}\n\n/**\n * True when `hostname` is a loopback, private, link-local, unique-local, or\n * CGNAT literal address (or the `localhost` name) — the address-literal core\n * that used to live only inside `isPublicHttpsUrl`, pulled out so a caller\n * that legitimately handles non-https schemes (the prospect-audit crawler\n * audits plain http sites too) can still refuse to follow a redirect onto an\n * internal target. Scheme-agnostic on purpose: the caller decides which\n * protocols are acceptable, this only judges the host.\n *\n * Best-effort by literal address — it does NOT resolve DNS, so a hostname\n * that resolves to a private IP is not caught. That is a deliberate,\n * proportionate bound for an operator-run CLI, not a complete SSRF guard.\n */\nexport function isPrivateOrLoopbackHost(hostname: string): boolean {\n  let host = hostname.toLowerCase();\n  if (host === \"localhost\" || host.endsWith(\".localhost\")) return true;\n  // Strip IPv6 brackets (`[::1]` → `::1`).\n  if (host.startsWith(\"[\") && host.endsWith(\"]\")) host = host.slice(1, -1);\n  if (host.includes(\":\")) {\n    // IPv6 literal: block loopback (::1), unspecified (::), link-local (fe80::/10),\n    // and unique-local (fc00::/7).\n    if (host === \"::1\" || host === \"::\") return true;\n    if (/^fe[89ab]/.test(host)) return true;\n    if (/^f[cd]/.test(host)) return true;\n    // IPv4-mapped (`::ffff:a.b.c.d`, normalized by URL to `::ffff:aabb:ccdd`) and\n    // NAT64 (`64:ff9b::/96`) embed a v4 address the dotted-quad block below never\n    // sees — refuse both wholesale (no legitimate target uses these forms).\n    if (host.startsWith(\"::ffff:\") || host.startsWith(\"64:ff9b:\")) return true;\n    return false;\n  }\n  // IPv4 dotted-quad: block the private/loopback/link-local/CGNAT ranges.\n  if (/^\\d{1,3}(\\.\\d{1,3}){3}$/.test(host)) {\n    const [a, b] = host.split(\".\").map(Number);\n    if (a === 0 || a === 10 || a === 127) return true;\n    if (a === 169 && b === 254) return true; // link-local\n    if (a === 172 && b !== undefined && b >= 16 && b <= 31) return true; // 172.16/12\n    if (a === 192 && b === 168) return true; // 192.168/16\n    if (a === 100 && b !== undefined && b >= 64 && b <= 127) return true; // CGNAT 100.64/10\n    return false;\n  }\n  // A registered hostname (not a literal IP) — accept; DNS isn't resolved here.\n  return false;\n}\n\n/**\n * True when `s` is an `https:` URL whose host is NOT an obviously-internal target\n * (loopback / private / link-local / unique-local / CGNAT). The newsletter\n * webhook URL is operator-set in Airtable but fires server-side, so this blocks\n * the SSRF vector of pointing it at `127.0.0.1` / `10.x` / `169.254.x` / `::1`.\n *\n * Best-effort by host literal — it does NOT resolve DNS, so a hostname that\n * resolves to a private IP is not caught. Defense-in-depth, not a complete SSRF\n * guard (the response is never returned to the caller either, so it's a log\n * oracle at most).\n */\nexport function isPublicHttpsUrl(s: string): boolean {\n  let parsed: URL;\n  try {\n    parsed = new URL(s);\n  } catch {\n    return false;\n  }\n  if (parsed.protocol !== \"https:\") return false;\n  return !isPrivateOrLoopbackHost(parsed.hostname);\n}\n"],"mappings":";AAUO,SAAS,UAAU,GAAoB;AAC5C,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,CAAC;AAAA,EACpB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAO,OAAO,aAAa,WAAW,OAAO,aAAa;AAC5D;AASO,SAAS,WAAW,GAAmB;AAC5C,MAAI;AACF,WAAO,IAAI,IAAI,CAAC,EAAE;AAAA,EACpB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AASO,SAAS,gBAAgB,GAAoB;AAClD,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,CAAC;AAAA,EACpB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,OAAO,OAAO,SAAS,YAAY;AACzC,SAAO,SAAS,iBAAiB,KAAK,SAAS,cAAc;AAC/D;AAeO,SAAS,wBAAwB,UAA2B;AACjE,MAAI,OAAO,SAAS,YAAY;AAChC,MAAI,SAAS,eAAe,KAAK,SAAS,YAAY,EAAG,QAAO;AAEhE,MAAI,KAAK,WAAW,GAAG,KAAK,KAAK,SAAS,GAAG,EAAG,QAAO,KAAK,MAAM,GAAG,EAAE;AACvE,MAAI,KAAK,SAAS,GAAG,GAAG;AAGtB,QAAI,SAAS,SAAS,SAAS,KAAM,QAAO;AAC5C,QAAI,YAAY,KAAK,IAAI,EAAG,QAAO;AACnC,QAAI,SAAS,KAAK,IAAI,EAAG,QAAO;AAIhC,QAAI,KAAK,WAAW,SAAS,KAAK,KAAK,WAAW,UAAU,EAAG,QAAO;AACtE,WAAO;AAAA,EACT;AAEA,MAAI,0BAA0B,KAAK,IAAI,GAAG;AACxC,UAAM,CAAC,GAAG,CAAC,IAAI,KAAK,MAAM,GAAG,EAAE,IAAI,MAAM;AACzC,QAAI,MAAM,KAAK,MAAM,MAAM,MAAM,IAAK,QAAO;AAC7C,QAAI,MAAM,OAAO,MAAM,IAAK,QAAO;AACnC,QAAI,MAAM,OAAO,MAAM,UAAa,KAAK,MAAM,KAAK,GAAI,QAAO;AAC/D,QAAI,MAAM,OAAO,MAAM,IAAK,QAAO;AACnC,QAAI,MAAM,OAAO,MAAM,UAAa,KAAK,MAAM,KAAK,IAAK,QAAO;AAChE,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAaO,SAAS,iBAAiB,GAAoB;AACnD,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,CAAC;AAAA,EACpB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,OAAO,aAAa,SAAU,QAAO;AACzC,SAAO,CAAC,wBAAwB,OAAO,QAAQ;AACjD;","names":[]}