@reddoorla/maintenance 0.95.1 → 0.97.0

package/dist/chunk-RQJFGK3A.js

@@ -0,0 +1,51 @@
+// src/fleet/site-id.ts
+var ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+var MAX_TIME = 2 ** 48 - 1;
+function encodeUlid(timeMs, random) {
+  if (!Number.isInteger(timeMs) || timeMs < 0 || timeMs > MAX_TIME) {
+    throw new Error(`encodeUlid: time ${timeMs} is not a 48-bit millisecond timestamp`);
+  }
+  if (random.length !== 10) {
+    throw new Error(`encodeUlid: needs exactly 10 random bytes, got ${random.length}`);
+  }
+  let time = "";
+  let t = timeMs;
+  for (let i = 0; i < 10; i++) {
+    time = ALPHABET[t % 32] + time;
+    t = Math.floor(t / 32);
+  }
+  let rand = "";
+  let buffer = 0;
+  let bits = 0;
+  for (const byte of random) {
+    buffer = buffer << 8 | byte;
+    bits += 8;
+    while (bits >= 5) {
+      bits -= 5;
+      rand += ALPHABET[buffer >> bits & 31];
+    }
+    buffer &= (1 << bits) - 1;
+  }
+  return time + rand;
+}
+function mintSiteId(now = Date.now()) {
+  const random = new Uint8Array(10);
+  globalThis.crypto.getRandomValues(random);
+  return `site_${encodeUlid(now, random)}`;
+}
+function isAirtableRecordId(id) {
+  return id.length > 3 && id.startsWith("rec");
+}
+function skipsAirtableShadow(writer, id) {
+  if (isAirtableRecordId(id)) return false;
+  console.log(`AIRTABLE_SHADOW skipped=non-rec-id writer=${writer} id=${id}`);
+  return true;
+}
+
+export {
+  encodeUlid,
+  mintSiteId,
+  isAirtableRecordId,
+  skipsAirtableShadow
+};
+//# sourceMappingURL=chunk-RQJFGK3A.js.map

package/dist/chunk-RQJFGK3A.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/fleet/site-id.ts"],"sourcesContent":["/**\n * Site ids after Airtable (#646 step 3, operator decision 2026-09-17).\n *\n * Two shapes coexist PERMANENTLY:\n *\n *   - `rec…`          every site that existed before the Turso-native creator. The\n *                     Airtable record id became the Turso primary key at import\n *                     (design D1), and it is never rewritten: `submissions.site_id`,\n *                     `reports.site_id`, `fleet_events`, `spam_screenouts`,\n *                     `digest_state` keys and event ids all hold it by convention.\n *   - `site_<ULID>`   every site created since, minted here.\n *\n * Neither is the external handle. The stored unique `sites.slug` is — URLs,\n * `/api/forms/:slug` and deployed sites all use it — so the id is free to be\n * whatever sorts and stays unique.\n *\n * ## Why a local ULID and not a dependency\n *\n * Nothing in the dependency tree implements ULID (checked 2026-09-17: the only\n * id-ish package is a transitive `nanoid`, which is not time-sortable and is not\n * ours to import). The encoding is 30 lines of arithmetic over a spec that has\n * not changed since 2016, this package is published to fleet sites, and adding a\n * runtime dependency for it would cost every consumer an install. The random\n * half comes from `globalThis.crypto` (Web Crypto, present in Node 20+ and in\n * Netlify functions), so the module needs no `node:` import either.\n *\n * Not monotonic within a millisecond: two ids minted in the same ms order by\n * their random half. Sites are created by hand, one command at a time; nothing\n * needs a strict order finer than the millisecond.\n */\n\n/** Crockford base32, the ULID alphabet (no I, L, O, U). */\nconst ALPHABET = \"0123456789ABCDEFGHJKMNPQRSTVWXYZ\";\nconst MAX_TIME = 2 ** 48 - 1;\n\n/**\n * Encode a ULID from a millisecond timestamp and 10 random bytes: 10 chars of\n * big-endian time, then 16 chars of the 80 random bits. Pure, so tests can pin it.\n */\nexport function encodeUlid(timeMs: number, random: Uint8Array): string {\n  if (!Number.isInteger(timeMs) || timeMs < 0 || timeMs > MAX_TIME) {\n    throw new Error(`encodeUlid: time ${timeMs} is not a 48-bit millisecond timestamp`);\n  }\n  if (random.length !== 10) {\n    throw new Error(`encodeUlid: needs exactly 10 random bytes, got ${random.length}`);\n  }\n  let time = \"\";\n  let t = timeMs;\n  for (let i = 0; i < 10; i++) {\n    time = ALPHABET[t % 32]! + time;\n    t = Math.floor(t / 32);\n  }\n  // 80 bits → 16 five-bit groups. Accumulate MSB-first; the buffer never holds\n  // more than 12 bits, so plain numbers stay exact.\n  let rand = \"\";\n  let buffer = 0;\n  let bits = 0;\n  for (const byte of random) {\n    buffer = (buffer << 8) | byte;\n    bits += 8;\n    while (bits >= 5) {\n      bits -= 5;\n      rand += ALPHABET[(buffer >> bits) & 31]!;\n    }\n    buffer &= (1 << bits) - 1;\n  }\n  return time + rand;\n}\n\n/** Mint a new site id: `site_<ULID>`. */\nexport function mintSiteId(now: number = Date.now()): string {\n  const random = new Uint8Array(10);\n  globalThis.crypto.getRandomValues(random);\n  return `site_${encodeUlid(now, random)}`;\n}\n\n/** A `rec…` id — the only shape Airtable can address. Deliberately a PREFIX test,\n *  the decision's own wording (\"skip non-`rec` ids\"): real Airtable ids are\n *  `rec` + 14 alphanumerics, but the suite's fixtures use readable ones like\n *  `rec_site_acme`, and in production the only other shape that exists is\n *  `site_<ULID>`, which this rejects either way. */\nexport function isAirtableRecordId(id: string): boolean {\n  return id.length > 3 && id.startsWith(\"rec\");\n}\n\n/** A site id minted by {@link mintSiteId}. */\nexport function isMintedSiteId(id: string): boolean {\n  return /^site_[0-9A-HJKMNP-TV-Z]{26}$/.test(id);\n}\n\n/**\n * The one decision every Airtable SHADOW writer makes before touching Airtable:\n * is this a record Airtable could possibly hold? A `site_` id never is — the site\n * was created in Turso and Airtable has never heard of it — so the write is\n * skipped ON PURPOSE rather than sent to 404.\n *\n * Returns `true` when the caller must skip, after logging exactly one stable,\n * greppable line:\n *\n *     AIRTABLE_SHADOW skipped=non-rec-id writer=<name> id=<id>\n *\n * Logged rather than silent because a skip is a decision someone may need to\n * audit: \"why does Airtable not have this site's scores\" should be one grep away.\n * Lives outside `src/reports/airtable/` so the Turso-native creator can use it\n * without importing the layer Phase 6 deletes.\n */\nexport function skipsAirtableShadow(writer: string, id: string): boolean {\n  if (isAirtableRecordId(id)) return false;\n  console.log(`AIRTABLE_SHADOW skipped=non-rec-id writer=${writer} id=${id}`);\n  return true;\n}\n"],"mappings":";AAgCA,IAAM,WAAW;AACjB,IAAM,WAAW,KAAK,KAAK;AAMpB,SAAS,WAAW,QAAgB,QAA4B;AACrE,MAAI,CAAC,OAAO,UAAU,MAAM,KAAK,SAAS,KAAK,SAAS,UAAU;AAChE,UAAM,IAAI,MAAM,oBAAoB,MAAM,wCAAwC;AAAA,EACpF;AACA,MAAI,OAAO,WAAW,IAAI;AACxB,UAAM,IAAI,MAAM,kDAAkD,OAAO,MAAM,EAAE;AAAA,EACnF;AACA,MAAI,OAAO;AACX,MAAI,IAAI;AACR,WAAS,IAAI,GAAG,IAAI,IAAI,KAAK;AAC3B,WAAO,SAAS,IAAI,EAAE,IAAK;AAC3B,QAAI,KAAK,MAAM,IAAI,EAAE;AAAA,EACvB;AAGA,MAAI,OAAO;AACX,MAAI,SAAS;AACb,MAAI,OAAO;AACX,aAAW,QAAQ,QAAQ;AACzB,aAAU,UAAU,IAAK;AACzB,YAAQ;AACR,WAAO,QAAQ,GAAG;AAChB,cAAQ;AACR,cAAQ,SAAU,UAAU,OAAQ,EAAE;AAAA,IACxC;AACA,eAAW,KAAK,QAAQ;AAAA,EAC1B;AACA,SAAO,OAAO;AAChB;AAGO,SAAS,WAAW,MAAc,KAAK,IAAI,GAAW;AAC3D,QAAM,SAAS,IAAI,WAAW,EAAE;AAChC,aAAW,OAAO,gBAAgB,MAAM;AACxC,SAAO,QAAQ,WAAW,KAAK,MAAM,CAAC;AACxC;AAOO,SAAS,mBAAmB,IAAqB;AACtD,SAAO,GAAG,SAAS,KAAK,GAAG,WAAW,KAAK;AAC7C;AAuBO,SAAS,oBAAoB,QAAgB,IAAqB;AACvE,MAAI,mBAAmB,EAAE,EAAG,QAAO;AACnC,UAAQ,IAAI,6CAA6C,MAAM,OAAO,EAAE,EAAE;AAC1E,SAAO;AACT;","names":[]}

package/dist/{chunk-3Z6X3BHU.js → chunk-TC4GANMX.js}

@@ -1,87 +1,25 @@
+import {
+  SEVERITY_RANK,
+  canonicalizeStatus,
+  parseNotifyRouting,
+  parseSecurityAdvisories,
+  siteSlug,
+  toFrequency,
+  toPrismicModelsVerdict,
+  toVerdict,
+  trimToNull
+} from "./chunk-ICSRWW5Q.js";
+import {
+  skipsAirtableShadow
+} from "./chunk-RQJFGK3A.js";
+
 // src/reports/airtable/site-status.ts
-var CANONICAL_STATUSES = [
-  "building",
-  "launching",
-  "maintained",
-  "hosted-only",
-  "external",
-  "archived"
-];
-var CANONICAL_SET = new Set(CANONICAL_STATUSES);
-function canonicalizeStatus(raw) {
-  if (typeof raw !== "string") return null;
-  return raw;
-}
 function toAirtableStatus(s) {
   return s;
 }
 
 // src/reports/airtable/websites.ts
 var WEBSITES_TABLE = "Websites";
-function siteSlug(name) {
-  return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
-}
-function trimToNull(raw) {
-  if (typeof raw !== "string") return null;
-  const trimmed = raw.trim();
-  return trimmed.length > 0 ? trimmed : null;
-}
-function parseNotifyRouting(raw) {
-  if (typeof raw !== "string") return null;
-  const trimmed = raw.trim();
-  if (!trimmed) return null;
-  let parsed;
-  try {
-    parsed = JSON.parse(trimmed);
-  } catch {
-    return null;
-  }
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
-  const o = parsed;
-  if (typeof o.field !== "string" || !o.field.trim()) return null;
-  if (!o.routes || typeof o.routes !== "object" || Array.isArray(o.routes)) return null;
-  const routing = {
-    field: o.field,
-    routes: o.routes
-  };
-  if (o.default !== void 0) routing.default = o.default;
-  if (Array.isArray(o.cc)) routing.cc = o.cc.filter((x) => typeof x === "string");
-  return routing;
-}
-var ACTIVE_STATUSES = /* @__PURE__ */ new Set(["maintained", "launching"]);
-function isDashboardVisible(site) {
-  return site.status !== null && ACTIVE_STATUSES.has(site.status);
-}
-var PRE_LAUNCH_STATUSES = /* @__PURE__ */ new Set(["building", "launching"]);
-function isPreLaunch(status) {
-  return status !== null && PRE_LAUNCH_STATUSES.has(status);
-}
-var KNOWN_STATUSES = new Set(CANONICAL_STATUSES);
-var ARCHIVED_STATUSES = /* @__PURE__ */ new Set(["archived"]);
-function isArchivedStatus(status) {
-  return status !== null && ARCHIVED_STATUSES.has(status);
-}
-function isUnrecognizedStatus(status) {
-  return status !== null && !KNOWN_STATUSES.has(status);
-}
-var FREQUENCIES = ["None", "Monthly", "Quarterly", "Yearly"];
-function toFrequency(raw, context) {
-  if (typeof raw !== "string") return "None";
-  const trimmed = raw.trim();
-  if (FREQUENCIES.includes(trimmed)) return trimmed;
-  if (trimmed !== "") {
-    console.warn(
-      `\u26A0 ${context}: unrecognized frequency '${raw}' \u2014 treating as None (not scheduling); fix the Airtable value`
-    );
-  }
-  return "None";
-}
-function toVerdict(raw) {
-  return raw === "pass" || raw === "fail" ? raw : null;
-}
-function toPrismicModelsVerdict(raw) {
-  return raw === "pass" || raw === "fail" || raw === "unknown" ? raw : null;
-}
 function mapRow(rec) {
   const f = rec.fields;
   const name = String(f["Name"] ?? "");
@@ -224,51 +162,7 @@ function depsFields(counts) {
   }
   return fields;
 }
-var SEVERITY_RANK = {
-  critical: 0,
-  high: 1,
-  moderate: 2,
-  low: 3
-};
 var MAX_PERSISTED_ADVISORIES = 25;
-function normalizeSecurityAdvisory(raw) {
-  if (!raw || typeof raw !== "object") return null;
-  const e = raw;
-  const module = typeof e["module"] === "string" ? e["module"] : null;
-  const severity = e["severity"];
-  if (module === null) return null;
-  if (severity !== "low" && severity !== "moderate" && severity !== "high" && severity !== "critical")
-    return null;
-  const cves = Array.isArray(e["cves"]) ? e["cves"].filter((c) => typeof c === "string") : [];
-  const scope = e["scope"] === "runtime" || e["scope"] === "development" ? e["scope"] : void 0;
-  const relationship = e["relationship"] === "direct" || e["relationship"] === "transitive" ? e["relationship"] : void 0;
-  return {
-    module,
-    severity,
-    title: typeof e["title"] === "string" ? e["title"] : "",
-    cves,
-    url: typeof e["url"] === "string" ? e["url"] : null,
-    ...scope ? { scope } : {},
-    ...relationship ? { relationship } : {}
-  };
-}
-function allActionableVulnsTransitive(advisories) {
-  if (!advisories) return false;
-  const actionable = advisories.filter((a) => a.severity === "critical" || a.severity === "high");
-  if (actionable.length === 0) return false;
-  return actionable.every((a) => a.relationship === "transitive");
-}
-function parseSecurityAdvisories(raw) {
-  if (typeof raw !== "string" || raw.trim() === "") return null;
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    return null;
-  }
-  if (!Array.isArray(parsed)) return null;
-  return parsed.map(normalizeSecurityAdvisory).filter((a) => a !== null);
-}
 function securityAdvisoryFields(advisories) {
   const capped = [...advisories].sort((a, b) => SEVERITY_RANK[a.severity] - SEVERITY_RANK[b.severity]).slice(0, MAX_PERSISTED_ADVISORIES);
   return { "Security advisories": JSON.stringify(capped) };
@@ -342,25 +236,37 @@ function formE2eFields(r) {
   return fields;
 }
 async function updateScores(base, recordId, scores) {
+  if (skipsAirtableShadow("updateScores", recordId)) return;
   await base(WEBSITES_TABLE).update([{ id: recordId, fields: scoreFields(scores) }]);
 }
-async function updateAnalyticsHealth(base, recordId, at) {
+function analyticsHealthFields(at) {
   const fields = { "Analytics soft-fail at": at };
-  await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);
+  return fields;
+}
+async function updateAnalyticsHealth(base, recordId, at) {
+  const fields = analyticsHealthFields(at);
+  if (!skipsAirtableShadow("updateAnalyticsHealth", recordId)) {
+    await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);
+  }
   return fields;
 }
 async function updateA11yCounts(base, recordId, counts) {
+  if (skipsAirtableShadow("updateA11yCounts", recordId)) return;
   await base(WEBSITES_TABLE).update([{ id: recordId, fields: a11yFields(counts) }]);
 }
 async function updateDepsCounts(base, recordId, counts) {
+  if (skipsAirtableShadow("updateDepsCounts", recordId)) return;
   await base(WEBSITES_TABLE).update([{ id: recordId, fields: depsFields(counts) }]);
 }
 async function updateSecurityCounts(base, recordId, counts) {
+  if (skipsAirtableShadow("updateSecurityCounts", recordId)) return;
   await base(WEBSITES_TABLE).update([{ id: recordId, fields: securityFields(counts) }]);
 }
 async function updateAutoFixAttempts(base, recordId, attempts) {
   const fields = { "Security Auto-Fix Attempts": attempts };
-  await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);
+  if (!skipsAirtableShadow("updateAutoFixAttempts", recordId)) {
+    await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);
+  }
   return fields;
 }
 async function updateNextDueDates(base, recordId, dates) {
@@ -368,12 +274,19 @@ async function updateNextDueDates(base, recordId, dates) {
     "Next maintenance at": dates.maintenanceAt,
     "Next testing at": dates.testingAt
   };
-  await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);
+  if (!skipsAirtableShadow("updateNextDueDates", recordId)) {
+    await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);
+  }
   return fields;
 }
 async function updateSiteField(base, recordId, column, value) {
+  if (skipsAirtableShadow("updateSiteField", recordId)) return;
   await base(WEBSITES_TABLE).update([{ id: recordId, fields: { [column]: value } }]);
 }
+async function updateSiteFields(base, recordId, fields) {
+  if (skipsAirtableShadow("updateSiteFields", recordId)) return;
+  await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);
+}
 async function updateAuditFields(base, recordId, audits) {
   const fields = {};
   if (audits.scores) Object.assign(fields, scoreFields(audits.scores));
@@ -388,7 +301,9 @@ async function updateAuditFields(base, recordId, audits) {
   if (audits.functionHealth) Object.assign(fields, functionHealthFields(audits.functionHealth));
   if (audits.smoke) Object.assign(fields, smokeFields(audits.smoke));
   if (audits.formE2e) Object.assign(fields, formE2eFields(audits.formE2e));
-  await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);
+  if (!skipsAirtableShadow("updateAuditFields", recordId)) {
+    await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);
+  }
   return fields;
 }
 async function updateGitHubSignals(base, recordId, signals) {
@@ -400,7 +315,9 @@ async function updateGitHubSignals(base, recordId, signals) {
   if (signals.lastCommitAt !== null) {
     fields["Last Commit At"] = signals.lastCommitAt;
   }
-  await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);
+  if (!skipsAirtableShadow("updateGitHubSignals", recordId)) {
+    await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);
+  }
   return fields;
 }
 var MAX_PRISMIC_DETAIL_CHARS = 5e4;
@@ -419,42 +336,27 @@ async function updatePrismicModels(base, recordId, models) {
     "Prismic Models Checked At": models.checkedAt,
     "Prismic Models Drift": models.detail === null ? null : truncatePrismicDetail(models.detail)
   };
-  await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);
+  if (!skipsAirtableShadow("updatePrismicModels", recordId)) {
+    await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);
+  }
   return fields;
 }
 async function updateLaunched(base, recordId, at) {
   const fields = { Status: toAirtableStatus("maintained"), "Launched at": at };
-  await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);
+  if (!skipsAirtableShadow("updateLaunched", recordId)) {
+    await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);
+  }
   return fields;
 }
 
 export {
-  CANONICAL_STATUSES,
-  canonicalizeStatus,
   toAirtableStatus,
   WEBSITES_TABLE,
-  siteSlug,
-  trimToNull,
-  parseNotifyRouting,
-  ACTIVE_STATUSES,
-  isDashboardVisible,
-  PRE_LAUNCH_STATUSES,
-  isPreLaunch,
-  KNOWN_STATUSES,
-  ARCHIVED_STATUSES,
-  isArchivedStatus,
-  isUnrecognizedStatus,
-  toFrequency,
-  toVerdict,
-  toPrismicModelsVerdict,
   mapRow,
   listWebsites,
   getWebsiteBySlug,
-  SEVERITY_RANK,
-  normalizeSecurityAdvisory,
-  allActionableVulnsTransitive,
-  parseSecurityAdvisories,
   updateScores,
+  analyticsHealthFields,
   updateAnalyticsHealth,
   updateA11yCounts,
   updateDepsCounts,
@@ -462,9 +364,10 @@ export {
   updateAutoFixAttempts,
   updateNextDueDates,
   updateSiteField,
+  updateSiteFields,
   updateAuditFields,
   updateGitHubSignals,
   updatePrismicModels,
   updateLaunched
 };
-//# sourceMappingURL=chunk-3Z6X3BHU.js.map
+//# sourceMappingURL=chunk-TC4GANMX.js.map

package/dist/chunk-TC4GANMX.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/reports/airtable/site-status.ts","../src/reports/airtable/websites.ts"],"sourcesContent":["/**\n * The Airtable WRITE seam for the site-status vocabulary.\n *\n * The vocabulary itself — `Status`, `CANONICAL_STATUSES`, `canonicalizeStatus`,\n * `isCanonicalStatus` — moved to `src/fleet/site-status.ts` in #539 Phase 6 step 1\n * (#646): `canonicalizeStatus` runs on every Turso lead read, so it cannot live in\n * the directory Phase 6 deletes. It is re-exported here so existing Airtable-layer\n * imports keep resolving unchanged; only `toAirtableStatus`, which exists solely\n * to write an Airtable cell, stays behind and goes with the layer.\n */\nimport type { Status } from \"../../fleet/site-status.js\";\n\nexport {\n  CANONICAL_STATUSES,\n  canonicalizeStatus,\n  isCanonicalStatus,\n  type Status,\n} from \"../../fleet/site-status.js\";\n\n/**\n * The string to WRITE into the Airtable \"Status\" cell for a canonical status.\n * Every writer of a CODE-OWNED status routes through here.\n *\n * Since stage 3 this is the identity: Airtable's single-select carries exactly\n * the six canonical options, so the canonical name IS the option name. It is\n * kept as a named seam rather than inlined because it is the one place a future\n * divergence between the code's vocabulary and Airtable's would be expressed,\n * and because every writer already routes through it — inlining would scatter\n * that decision across `ensureSite`, `updateLaunched`, `forms-notify-target`\n * and the dashboard status save.\n *\n * The stage-1/2 hazard it used to carry is GONE: while a many-to-one map\n * existed, `toAirtableStatus(canonicalizeStatus(x))` was not the identity —\n * feeding it \"legacy\" yielded \"deprecated\", silently writing an option the\n * operator never asked for. Both functions are now the identity, so that trap\n * no longer exists. `forms-notify-target --restore` still writes operator text\n * verbatim (`restoreCell`) rather than routing through here, which remains the\n * right shape: operator free text is not a canonical status.\n */\nexport function toAirtableStatus(s: Status): string {\n  return s;\n}\n","import type { FieldSet } from \"airtable\";\nimport type { AirtableBase } from \"./client.js\";\nimport type { LighthouseScores, LighthouseScoreWriteback } from \"../types.js\";\nimport { canonicalizeStatus, toAirtableStatus } from \"./site-status.js\";\nimport { skipsAirtableShadow } from \"../../fleet/site-id.js\";\nimport {\n  siteSlug,\n  trimToNull,\n  parseNotifyRouting,\n  toFrequency,\n  toVerdict,\n  toPrismicModelsVerdict,\n  SEVERITY_RANK,\n  parseSecurityAdvisories,\n  type WebsiteRow,\n  type PrismicModelsVerdict,\n  type SecurityAdvisory,\n} from \"../../fleet/site-row.js\";\n\n// The site-row model and its pure coercers live in src/fleet/site-row.ts since\n// #539 Phase 6 step 1 (#646) — they run on Turso reads too. Re-exported so every\n// existing import from this module resolves unchanged.\nexport {\n  siteSlug,\n  trimToNull,\n  parseNotifyRouting,\n  ACTIVE_STATUSES,\n  isDashboardVisible,\n  PRE_LAUNCH_STATUSES,\n  isPreLaunch,\n  KNOWN_STATUSES,\n  ARCHIVED_STATUSES,\n  isArchivedStatus,\n  isUnrecognizedStatus,\n  toFrequency,\n  toVerdict,\n  toPrismicModelsVerdict,\n  SEVERITY_RANK,\n  normalizeSecurityAdvisory,\n  allActionableVulnsTransitive,\n  parseSecurityAdvisories,\n  type Frequency,\n  type Status,\n  type NotifyRouting,\n  type WebsiteRow,\n  type PrismicModelsVerdict,\n  type Severity,\n  type SecurityAdvisory,\n} from \"../../fleet/site-row.js\";\n\nexport const WEBSITES_TABLE = \"Websites\";\n\n// NOTE: every `f[\"...\"]` key below is a load-bearing magic string that must match\n// the live Airtable \"Websites\" column name EXACTLY — including the legacy\n// misspelling `\"maintenence freq\"`, the mixed-case `\"GA4 property ID\"`, and the\n// lowercase `\"url\"` / `\"point of contact\"`. A column rename in Airtable silently\n// returns undefined here (→ null), which degrades quietly (GA skipped, recipients\n// empty) with no error. If you rename a column, change it here too.\nexport function mapRow(rec: { id: string; fields: Record<string, unknown> }): WebsiteRow {\n  const f = rec.fields;\n  const name = String(f[\"Name\"] ?? \"\");\n  const attachments =\n    (f[\"Header image\"] as Array<{ url: string; filename: string; type: string }> | undefined) ?? [];\n  // LAST, not first: Airtable's uploadAttachment APPENDS, so the newest file is the\n  // tail. Reading [0] served the OLDEST forever whenever a field held more than one —\n  // which is how a pre-clean-plate header reached a live announcement (#574/#577).\n  // The prune keeps these fields at a single entry, so this is normally the same\n  // element; preferring the tail means a field that stacks again still serves the\n  // CURRENT header instead of silently reverting to the first one ever uploaded.\n  const header = attachments.at(-1) ?? null;\n  return {\n    id: rec.id,\n    name,\n    url: String(f[\"url\"] ?? \"\"),\n    status: canonicalizeStatus(f[\"Status\"]),\n    statusRaw: (f[\"Status\"] as string | undefined) ?? null,\n    pointOfContact: (f[\"point of contact\"] as string | undefined) ?? null,\n    maintenanceFreq: toFrequency(f[\"maintenence freq\"], `${name} maintenance`),\n    testingFreq: toFrequency(f[\"testing freq\"], `${name} testing`),\n    maintenanceFreqRaw: (f[\"maintenence freq\"] as string | undefined) ?? null,\n    testingFreqRaw: (f[\"testing freq\"] as string | undefined) ?? null,\n    maintenanceDay: (f[\"maintenance day\"] as string | undefined) ?? null,\n    testingDay: (f[\"testing day\"] as string | undefined) ?? null,\n    ga4PropertyId: (f[\"GA4 property ID\"] as string | undefined) ?? null,\n    searchQuery: (f[\"Search query\"] as string | undefined) ?? null,\n    searchConsoleProperty: (f[\"Search Console property\"] as string | undefined) ?? null,\n    analyticsSoftFailAt: (f[\"Analytics soft-fail at\"] as string | undefined) ?? null,\n    gitRepo: (f[\"Git repo\"] as string | undefined) ?? null,\n    reportRecipientsTo: (f[\"Report recipients (To)\"] as string | undefined) ?? null,\n    reportRecipientsCc: (f[\"Report recipients (CC)\"] as string | undefined) ?? null,\n    // Tolerate BOTH the current Multiple-Select array shape AND a delimited long-text\n    // string (comma/newline separated), so the field can migrate to a plain text column\n    // with no code change here. Trim + drop empties either way. The array branch also\n    // validates ELEMENT types: a collaborator/attachment-shaped field passes\n    // Array.isArray with OBJECT elements, and an unchecked cast would make assignTier's\n    // `.trim()` throw — one misconfigured row must not 500 the whole cockpit build.\n    acceptedWatchConditions: Array.isArray(f[\"Accepted Watch Conditions\"])\n      ? (f[\"Accepted Watch Conditions\"] as unknown[])\n          .filter((x): x is string => typeof x === \"string\")\n          .map((s) => s.trim())\n          .filter(Boolean)\n      : typeof f[\"Accepted Watch Conditions\"] === \"string\"\n        ? (f[\"Accepted Watch Conditions\"] as string)\n            .split(/[\\n,]/)\n            .map((s) => s.trim())\n            .filter(Boolean)\n        : [],\n    headerImage: header,\n    pScore: (f[\"pScore\"] as number | undefined) ?? null,\n    rScore: (f[\"rScore\"] as number | undefined) ?? null,\n    bpScore: (f[\"bpScore\"] as number | undefined) ?? null,\n    seoScore: (f[\"seoScore\"] as number | undefined) ?? null,\n    lastLighthouseAuditAt: (f[\"Last lighthouse audit at\"] as string | undefined) ?? null,\n    a11yViolations: (f[\"A11y Violations\"] as number | undefined) ?? null,\n    depsDrifted: (f[\"Deps Drifted\"] as number | undefined) ?? null,\n    depsMajorBehind: (f[\"Deps Major Behind\"] as number | undefined) ?? null,\n    depsOutdated: (f[\"Deps Outdated\"] as number | undefined) ?? null,\n    depsMajorOutdated: (f[\"Deps Major Outdated\"] as number | undefined) ?? null,\n    securityVulnsCritical: (f[\"Security Vulns Critical\"] as number | undefined) ?? null,\n    securityVulnsHigh: (f[\"Security Vulns High\"] as number | undefined) ?? null,\n    securityVulnsModerate: (f[\"Security Vulns Moderate\"] as number | undefined) ?? null,\n    securityVulnsLow: (f[\"Security Vulns Low\"] as number | undefined) ?? null,\n    securityAutoFixAttempts: (f[\"Security Auto-Fix Attempts\"] as number | undefined) ?? null,\n    lastSecurityAuditAt: (f[\"Last security audit at\"] as string | undefined) ?? null,\n    securityAdvisories: parseSecurityAdvisories(f[\"Security advisories\"]),\n    certDaysRemaining: (f[\"Cert days remaining\"] as number | undefined) ?? null,\n    domainCheckedAt: (f[\"Domain checked at\"] as string | undefined) ?? null,\n    netlifyId: trimToNull(f[\"Netlify ID\"]),\n    deployStatus: (f[\"Deploy status\"] as string | undefined) ?? null,\n    lastDeployAt: (f[\"Last deploy at\"] as string | undefined) ?? null,\n    deployLogUrl: (f[\"Deploy log URL\"] as string | undefined) ?? null,\n    deployCheckedAt: (f[\"Deploy checked at\"] as string | undefined) ?? null,\n    functionHealth: toVerdict(f[\"Function health\"]),\n    cmsReachable: toVerdict(f[\"CMS Reachable\"]),\n    turnstileWidget: toVerdict(f[\"Turnstile widget\"]),\n    functionHealthCheckedAt: (f[\"Function health checked at\"] as string | undefined) ?? null,\n    crossbrowserOk:\n      typeof f[\"Crossbrowser OK\"] === \"boolean\" ? (f[\"Crossbrowser OK\"] as boolean) : null,\n    mobileOk: typeof f[\"Mobile OK\"] === \"boolean\" ? (f[\"Mobile OK\"] as boolean) : null,\n    linksOk: typeof f[\"Links OK\"] === \"boolean\" ? (f[\"Links OK\"] as boolean) : null,\n    brokenLinks: typeof f[\"Broken links\"] === \"number\" ? (f[\"Broken links\"] as number) : null,\n    browserCheckedAt: (f[\"Browser checked at\"] as string | undefined) ?? null,\n    reachableOk: toVerdict(f[\"Uptime Reachable\"]),\n    titleMetaOk: toVerdict(f[\"Titles & Meta OK\"]),\n    copyIntro: trimToNull(f[\"Copy — Intro\"]),\n    copyContact: trimToNull(f[\"Copy — Contact\"]),\n    copyFooter: trimToNull(f[\"Copy — Footer\"]),\n    launchedAt: (f[\"Launched at\"] as string | undefined) ?? null,\n    newsletterWebhook: trimToNull(f[\"Newsletter Webhook\"]),\n    notifyRouting: parseNotifyRouting(f[\"Notify Routing\"]),\n    notifyRoutingRaw: trimToNull(f[\"Notify Routing\"]),\n    mailchimpApiKey: trimToNull(f[\"Mailchimp API Key\"]),\n    mailchimpAudienceId: trimToNull(f[\"Mailchimp Audience ID\"]),\n    // Boolean guard like crossbrowserOk, but defaults FALSE (not null) when absent: an\n    // unset/unknown column must read as \"not required\" so the feature ships dark.\n    requireTurnstile:\n      typeof f[\"Require Turnstile\"] === \"boolean\" ? (f[\"Require Turnstile\"] as boolean) : false,\n    renovateFailingCis: (f[\"Renovate Failing CIs\"] as number | undefined) ?? null,\n    defaultBranchCi: (f[\"Default Branch CI\"] as string | undefined) ?? null,\n    lastCommitAt: (f[\"Last Commit At\"] as string | undefined) ?? null,\n    githubSignalsAt: (f[\"GitHub Signals At\"] as string | undefined) ?? null,\n    smokeOk: toVerdict(f[\"Smoke OK\"]),\n    lastSmokeAt: (f[\"Last Smoke At\"] as string | undefined) ?? null,\n    formE2eOk: toVerdict(f[\"Form E2E OK\"]),\n    formE2eCheckedAt: (f[\"Form E2E checked at\"] as string | undefined) ?? null,\n    prismicModels: toPrismicModelsVerdict(f[\"Prismic Models\"]),\n    prismicModelsCheckedAt: (f[\"Prismic Models Checked At\"] as string | undefined) ?? null,\n    prismicModelsDrift: (f[\"Prismic Models Drift\"] as string | undefined) ?? null,\n    prismicAckUntil: (f[\"Prismic Ack Until\"] as string | undefined) ?? null,\n    nextMaintenanceAt: (f[\"Next maintenance at\"] as string | undefined) ?? null,\n    nextTestingAt: (f[\"Next testing at\"] as string | undefined) ?? null,\n  };\n}\n\nexport async function listWebsites(base: AirtableBase): Promise<WebsiteRow[]> {\n  const out: WebsiteRow[] = [];\n  await base(WEBSITES_TABLE)\n    .select({ pageSize: 100 })\n    .eachPage((records, fetchNextPage) => {\n      for (const rec of records) out.push(mapRow({ id: rec.id, fields: rec.fields }));\n      fetchNextPage();\n    });\n  return out;\n}\n\nexport async function getWebsiteBySlug(\n  base: AirtableBase,\n  slug: string,\n): Promise<WebsiteRow | null> {\n  // Slugs are siteSlug() output: [a-z0-9] segments joined by single hyphens.\n  // Reject anything else — it can't match a real row, and it keeps URL-supplied\n  // input out of the filter formula below (formula-injection guard).\n  if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(slug)) return null;\n\n  // Narrow the fetch to the slug-matching row server-side instead of paging the\n  // whole table per request (MEDIUM-H). The formula replicates siteSlug() on\n  // {Name} — lowercase → non-alnum runs to \"-\" → strip leading/trailing \"-\" —\n  // verified against the live base. maxRecords caps it (slug collisions keep the\n  // prior first-match-wins behavior).\n  const formula = `REGEX_REPLACE(REGEX_REPLACE(LOWER({Name}),\"[^a-z0-9]+\",\"-\"),\"^-|-$\",\"\")=${JSON.stringify(\n    slug,\n  )}`;\n  const rows: WebsiteRow[] = [];\n  await base(WEBSITES_TABLE)\n    .select({ filterByFormula: formula, maxRecords: 1 })\n    .eachPage((records, fetchNextPage) => {\n      for (const rec of records) rows.push(mapRow({ id: rec.id, fields: rec.fields }));\n      fetchNextPage();\n    });\n  // Confirm the match in JS too: keeps the function correct if the formula and\n  // siteSlug() ever drift, and under test fakes that don't evaluate the formula.\n  return rows.find((w) => siteSlug(w.name) === slug) ?? null;\n}\n\n// ── audit-field builders ─────────────────────────────────────────────────────\n// One source of truth for the column-name → value mappings of each audit type.\n// The per-audit `updateXxxCounts` writers delegate to these (for their other\n// callers), and `updateAuditFields` merges whichever are present into ONE write —\n// so the field-name magic strings live in exactly one place.\n\nexport type A11yCounts = { violations: number };\nexport type DepsCounts = {\n  drifted: number;\n  majorBehind: number;\n  outdated: number | null;\n  majorOutdated: number | null;\n};\nexport type SecurityCounts = { critical: number; high: number; moderate: number; low: number };\nexport type DomainResult = { certDaysRemaining: number | null; checkedAt: string };\nexport type NetlifyDeployResult = {\n  /** Netlify deploy state lower-cased (`ready`/`error`/`building`/…), null = none. */\n  state: string | null;\n  /** When the latest production deploy was published/created (ISO), null = unknown. */\n  deployedAt: string | null;\n  /** Link to the deploy / its build log, null = unknown. */\n  logUrl: string | null;\n  /** When the audit last ran. */\n  checkedAt: string;\n};\nexport type BrowserAuditFields = {\n  desktopOk: boolean;\n  mobileOk: boolean;\n  linksOk: boolean;\n  reachableOk: boolean;\n  titleMetaOk: boolean;\n  brokenLinks: number;\n  checkedAt: string;\n};\nexport type FunctionHealthResult = {\n  /** `pass` when `/health` answered `ok:true`, else `fail`. Never null — the audit only produces a\n   *  result when it ran (a self-skip carries no details, so this extractor isn't reached). */\n  functionHealth: \"pass\" | \"fail\";\n  /** From the same body's `prismic` sub-status (R2.2): `\"ok\"` → `\"pass\"`, `\"error\"` → `\"fail\"`.\n   *  Anything else (`\"skipped\"` — a placeholder repo with no live Prismic — or a raw `null`, e.g.\n   *  the synthetic \"deployed but erroring\" body) → `null`: the CMS probe never actually ran, so it\n   *  must NOT red CMS reachability for a site that simply hasn't wired Prismic yet. */\n  cmsReachable: \"pass\" | \"fail\" | null;\n  /** From the same body's `forms.turnstile` boolean: `true` → `\"pass\"`, `false` → `\"fail\"`.\n   *  A missing/null `forms` block (older site package, or the synthetic \"deployed but\n   *  erroring\" body) → `null` — the widget state is simply unknown, not a failure. */\n  turnstileWidget: \"pass\" | \"fail\" | null;\n  /** When the audit ran (freshness stamp for all three verdicts). */\n  checkedAt: string;\n};\n\nexport type SmokeResult = { ok: \"pass\" | \"fail\"; checkedAt: string };\n\n/** `ok` null clears the single-select cell (n/a — no contact form); a fresh\n *  `checkedAt` still stamps the row so Plan 4 reads null+fresh as n/a. */\nexport type FormE2eResult = {\n  /** Absent = no FORM verdict this run; the column and its stamp are left alone. */\n  ok?: \"pass\" | \"fail\" | null;\n  checkedAt: string;\n  /** The `Turnstile widget` verdict, owned by this audit since #689 — see\n   *  `formE2eFields`. Absent = no opinion this run (preserve); null = looked and\n   *  could not tell (clear). */\n  turnstileWidget?: \"pass\" | \"fail\" | null;\n};\n\nfunction scoreFields(scores: LighthouseScoreWriteback): FieldSet {\n  // A null score CLEARS the cell (→ dashboard \"—\"), distinguishing a metric that\n  // errored this run (e.g. NO_LCP → null performance) from a real low score. This\n  // intentionally overwrites a prior value: a run that couldn't measure the metric\n  // shouldn't keep showing a stale number. Writing null to clear mirrors\n  // updateAnalyticsHealth; the `as FieldSet` cast is needed because airtable's\n  // FieldSet type omits null.\n  const fields: Record<string, number | string | null> = {\n    pScore: scores.performance,\n    rScore: scores.accessibility,\n    bpScore: scores.bestPractices,\n    seoScore: scores.seo,\n    \"Last lighthouse audit at\": new Date().toISOString(),\n  };\n  return fields as FieldSet;\n}\n\nfunction a11yFields(counts: A11yCounts): FieldSet {\n  return { \"A11y Violations\": counts.violations };\n}\n\nfunction depsFields(counts: DepsCounts): FieldSet {\n  const fields: FieldSet = {\n    \"Deps Drifted\": counts.drifted,\n    \"Deps Major Behind\": counts.majorBehind,\n  };\n  // Only write the outdated count when it was determined — a null (no/stale\n  // lockfile this run) must not clobber a previously-good value.\n  if (counts.outdated !== null) {\n    fields[\"Deps Outdated\"] = counts.outdated;\n  }\n  // Same null-guard for the registry-major breakdown (same source signal).\n  if (counts.majorOutdated !== null) {\n    fields[\"Deps Major Outdated\"] = counts.majorOutdated;\n  }\n  return fields;\n}\n\n/** Cap persisted advisories so the JSON field can't blow up on a badly-neglected site. */\nconst MAX_PERSISTED_ADVISORIES = 25;\n\nfunction securityAdvisoryFields(advisories: SecurityAdvisory[]): FieldSet {\n  const capped = [...advisories]\n    .sort((a, b) => SEVERITY_RANK[a.severity] - SEVERITY_RANK[b.severity])\n    .slice(0, MAX_PERSISTED_ADVISORIES);\n  // Always write — an empty array (\"[]\") clears a stale list when a once-vulnerable site goes clean.\n  return { \"Security advisories\": JSON.stringify(capped) };\n}\n\nfunction securityFields(counts: SecurityCounts): FieldSet {\n  return {\n    \"Security Vulns Critical\": counts.critical,\n    \"Security Vulns High\": counts.high,\n    \"Security Vulns Moderate\": counts.moderate,\n    \"Security Vulns Low\": counts.low,\n    // Stamp freshness alongside the counts so the Security Updates auto-tick can require a recent\n    // audit (a clean count from months ago must not silently keep ticking the box).\n    \"Last security audit at\": new Date().toISOString(),\n  };\n}\n\nfunction domainFields(result: DomainResult): FieldSet {\n  const fields: FieldSet = { \"Domain checked at\": result.checkedAt };\n  // Write the cert days UNCONDITIONALLY: a null (unresolved / no usable cert) must CLEAR any\n  // previously-good value. Leaving a stale number in place — next to a freshly-stamped \"Domain\n  // checked at\" — false-passes the Domain/DNS/SSL auto-tick (domainEvidence reads the stale\n  // non-null value as a current pass) for a site that's actually down. null clears the cell in\n  // Airtable; FieldSet's type doesn't model null, hence the cast through a widened record.\n  (fields as Record<string, number | null>)[\"Cert days remaining\"] = result.certDaysRemaining;\n  return fields;\n}\n\nfunction netlifyDeployFields(result: NetlifyDeployResult): FieldSet {\n  // Write all three deploy fields UNCONDITIONALLY (null clears the cell): a null state /\n  // deployedAt / logUrl this run means \"couldn't read it\" and must not leave a STALE value\n  // sitting next to a fresh \"Deploy checked at\" — the dashboard would otherwise render a green\n  // \"ready\" badge for a site whose latest deploy actually errored. FieldSet's type doesn't model\n  // null, hence the cast through a widened record (same approach as domainFields).\n  const fields: Record<string, string | null> = {\n    \"Deploy status\": result.state,\n    \"Last deploy at\": result.deployedAt,\n    \"Deploy log URL\": result.logUrl,\n    \"Deploy checked at\": result.checkedAt,\n  };\n  return fields as FieldSet;\n}\n\nfunction browserFields(r: BrowserAuditFields): FieldSet {\n  return {\n    \"Crossbrowser OK\": r.desktopOk,\n    \"Mobile OK\": r.mobileOk,\n    \"Links OK\": r.linksOk,\n    \"Broken links\": r.brokenLinks,\n    \"Browser checked at\": r.checkedAt,\n    // NEW tri-state single-select verdicts (empty = never ran). The browser audit only produces a\n    // BrowserAuditFields when it actually ran (hasBrowserResult guards on checkedAt), so each verdict\n    // is always a concrete boolean here — serialize true→\"pass\", false→\"fail\". The existing boolean\n    // columns above are deliberately NOT retrofitted (out of scope).\n    \"Uptime Reachable\": r.reachableOk ? \"pass\" : \"fail\",\n    \"Titles & Meta OK\": r.titleMetaOk ? \"pass\" : \"fail\",\n  };\n}\n\nfunction functionHealthFields(r: FunctionHealthResult): FieldSet {\n  // \"CMS Reachable\" is written UNCONDITIONALLY (null clears the cell): the audit only supplies a\n  // result when it ran, but `cmsReachable` itself can legitimately be null this run (R2.2 — the CMS\n  // probe never actually happened, e.g. a placeholder repo with no live Prismic). Clearing rather\n  // than leaving a stale pass/fail sitting next to a freshly-stamped checked-at is what keeps a\n  // placeholder site from showing a stale CMS verdict. FieldSet's type doesn't model null, hence the\n  // cast through a widened record (same approach as domainFields/netlifyDeployFields).\n  // \"Function health\" is never null — the audit only writes when it ran, so it's always a concrete\n  // pass/fail. Written SEPARATELY from \"Deploy status\" so the Netlify build state keeps its own\n  // meaning.\n  const fields: Record<string, string | null> = {\n    \"Function health\": r.functionHealth,\n    \"CMS Reachable\": r.cmsReachable,\n    // \"Turnstile widget\" is NOT written here any more. /health only knows whether\n    // PUBLIC_TURNSTILE_SITE_KEY is a non-empty string — it never contacts\n    // Cloudflare — so this audit cannot tell a working widget from one whose\n    // hostname is not on the allowlist (#689). The column is owned by `form-e2e`,\n    // which drives a real browser at the real widget and can. Writing it from\n    // both would also be unreachable by the red alarm: this sweep runs at 08:00,\n    // the digest reads at 09:23, form-e2e writes at 10:15 — a browser verdict\n    // would be cleared by this null every morning before the alarm ever saw it.\n    \"Function health checked at\": r.checkedAt,\n  };\n  return fields as FieldSet;\n}\n\nfunction smokeFields(r: SmokeResult): FieldSet {\n  // The verdict is stored as the literal single-select option (\"pass\"/\"fail\"), so\n  // no boolean→string coercion is needed. A skip never reaches here (it produces no\n  // SmokeResult), so this column is only ever written with a concrete verdict.\n  return { \"Smoke OK\": r.ok, \"Last Smoke At\": r.checkedAt };\n}\n\nfunction formE2eFields(r: FormE2eResult): FieldSet {\n  // `ok` is already the single-select value (\"pass\"/\"fail\") or null. Writing null\n  // CLEARS the cell (→ n/a, distinguished from \"never ran\" by the fresh checked-at\n  // stamped alongside). FieldSet's type omits null, hence the widened-record cast\n  // (same approach as domainFields / netlifyDeployFields).\n  const fields: Record<string, string | null> = {};\n  // The FORM verdict and its stamp move together, and only when this run produced\n  // one. A run with no form verdict (the testMode-undeclared skip) writes neither,\n  // which preserves both — refreshing the stamp while preserving a stale verdict\n  // would present months-old evidence as fresh to auto-tick's `formsEvidence`.\n  if (r.ok !== undefined) {\n    fields[\"Form E2E OK\"] = r.ok;\n    fields[\"Form E2E checked at\"] = r.checkedAt;\n  }\n  // The Turnstile verdict rides this audit because it is the only one that opens\n  // a browser on the live form, where the site's REAL widget renders (the probe\n  // never swaps the sitekey). Written only when this run had an opinion: the key\n  // is ABSENT on a run that could not look, which preserves the prior verdict,\n  // and an explicit null is the distinct \"looked, could not tell\" that clears it.\n  if (r.turnstileWidget !== undefined) fields[\"Turnstile widget\"] = r.turnstileWidget;\n  return fields as FieldSet;\n}\n\n// ————————————————————————— Websites writers (the Airtable shadow) —————————————————————————\n//\n// Every writer below addresses a Websites row by SITE id, and every one opens with\n// `skipsAirtableShadow` (#646 step 3). Sites created since the Turso-native\n// `ensure-site` carry `site_<ULID>` ids that Airtable has never held, so a write\n// for one is skipped on purpose — with an `AIRTABLE_SHADOW skipped=non-rec-id` line — instead of\n// 404ing. The FieldSet-returning writers still RETURN their payload when they\n// skip: callers feed it to the authoritative Turso write, which must not depend on\n// the shadow. tests/reports/airtable/shadow-skip-site-ids.test.ts fails for any\n// exported `update*` writer that is not covered.\n\n/**\n * Write the four Lighthouse scores + a refreshed-at timestamp onto a Websites row.\n * Called by `audit lighthouse --write-back` after a successful audit run, so\n * the operator never has to paste numbers manually before drafting a report.\n */\nexport async function updateScores(\n  base: AirtableBase,\n  recordId: string,\n  scores: LighthouseScores,\n): Promise<void> {\n  if (skipsAirtableShadow(\"updateScores\", recordId)) return;\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields: scoreFields(scores) }]);\n}\n\n/** The `Analytics soft-fail at` FieldSet, as a pure function of the stamp (#782).\n *  Drafting mirrors THIS into Turso first — the authoritative store — and only\n *  then shadows it to Airtable, so the two writes carry one payload and the\n *  shadow's field gap cannot cost the real write. `at` is an ISO timestamp when\n *  the site's last draft had a GA/Search soft-failure, `null` after a clean\n *  enrichment (the signal self-heals). */\nexport function analyticsHealthFields(at: string | null): FieldSet {\n  const fields: Record<string, string | null> = { \"Analytics soft-fail at\": at };\n  return fields as FieldSet;\n}\n\n/**\n * Record (or clear) the per-site GA/Search enrichment health on the `Analytics\n * soft-fail at` column. The caller (drafting) swallows errors: this column is\n * operator-added and — checked against the base on 2026-09-15 — has never\n * existed there, so Airtable throws UNKNOWN_FIELD_NAME on every call. That is\n * why drafting writes Turso BEFORE this (#782): Turso is authoritative and the\n * Airtable layer is the shadow Phase 6 (#646) deletes.\n */\nexport async function updateAnalyticsHealth(\n  base: AirtableBase,\n  recordId: string,\n  at: string | null,\n): Promise<FieldSet> {\n  const fields = analyticsHealthFields(at);\n  if (!skipsAirtableShadow(\"updateAnalyticsHealth\", recordId)) {\n    await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);\n  }\n  // Same contract as updateNextDueDates/updateAuditFields: the #539 Turso mirror\n  // consumes the returned FieldSet, so the two writes cannot diverge.\n  return fields;\n}\n\n/** Persist a11y violation count. */\nexport async function updateA11yCounts(\n  base: AirtableBase,\n  recordId: string,\n  counts: A11yCounts,\n): Promise<void> {\n  if (skipsAirtableShadow(\"updateA11yCounts\", recordId)) return;\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields: a11yFields(counts) }]);\n}\n\n/** Persist deps drift counts (declared-range drift + real outdated installs). */\nexport async function updateDepsCounts(\n  base: AirtableBase,\n  recordId: string,\n  counts: DepsCounts,\n): Promise<void> {\n  if (skipsAirtableShadow(\"updateDepsCounts\", recordId)) return;\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields: depsFields(counts) }]);\n}\n\n/** Persist security vulnerability counts by severity. */\nexport async function updateSecurityCounts(\n  base: AirtableBase,\n  recordId: string,\n  counts: SecurityCounts,\n): Promise<void> {\n  if (skipsAirtableShadow(\"updateSecurityCounts\", recordId)) return;\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields: securityFields(counts) }]);\n}\n\n/** Persist a site's auto-fix attempt counter. Its own one-field writer so the\n *  nightly Renovate dispatch can update it without touching the audit's counts. */\nexport async function updateAutoFixAttempts(\n  base: AirtableBase,\n  recordId: string,\n  attempts: number,\n): Promise<FieldSet> {\n  const fields: FieldSet = { \"Security Auto-Fix Attempts\": attempts };\n  if (!skipsAirtableShadow(\"updateAutoFixAttempts\", recordId)) {\n    await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);\n  }\n  // Returned for the #539 Turso mirror — see updateNextDueDates.\n  return fields;\n}\n\n/**\n * Persist the code-computed next-due dates (date-only `YYYY-MM-DD`, or `null` to\n * clear) for the maintenance + testing schedules. Owned by the nightly `--due` sweep\n * so the \"next\" dates shown in Airtable come from the SAME logic as the scheduler\n * (`nextDueDate`) — no Airtable-side formula or automation. Best-effort at the call\n * site: the `Next … at` columns are operator-added, so until they exist Airtable\n * throws UNKNOWN_FIELD_NAME, which must not break the nightly draft run.\n */\nexport async function updateNextDueDates(\n  base: AirtableBase,\n  recordId: string,\n  dates: { maintenanceAt: string | null; testingAt: string | null },\n): Promise<FieldSet> {\n  const fields: Record<string, string | null> = {\n    \"Next maintenance at\": dates.maintenanceAt,\n    \"Next testing at\": dates.testingAt,\n  };\n  if (!skipsAirtableShadow(\"updateNextDueDates\", recordId)) {\n    await base(WEBSITES_TABLE).update([{ id: recordId, fields: fields as FieldSet }]);\n  }\n  // Same contract as updateAuditFields/updateGitHubSignals: the Phase 3 Turso\n  // mirror consumes the returned FieldSet, so the two writes cannot diverge.\n  return fields as FieldSet;\n}\n\n/** The cell shapes the site editor can write. Airtable rejects a string written\n *  to a checkbox or a multi-select, so `Require Turnstile` (boolean) and\n *  `Accepted Watch Conditions` (string[]) travel as themselves rather than being\n *  stringified at the boundary and coerced back later. */\nexport type AirtableCellValue = string | boolean | string[];\n\n/** Generic single-field writer for the dashboard site-details editor. The caller\n *  (setSiteDetail) restricts `column` to the EDITABLE_SITE_FIELDS allowlist, so this\n *  never writes an arbitrary column from request input. */\nexport async function updateSiteField(\n  base: AirtableBase,\n  recordId: string,\n  column: string,\n  value: AirtableCellValue,\n): Promise<void> {\n  if (skipsAirtableShadow(\"updateSiteField\", recordId)) return;\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields: { [column]: value } }]);\n}\n\n/** The multi-column shadow for `ensure-site`'s fill-blanks / `--name` path on a\n *  pre-existing `rec` site (#646 step 3): ONE update, so a resumed bootstrap that\n *  fills `url` and retitles `Name` cannot leave the shadow half-written. Turso is\n *  the store that decides what to write; this only repeats it. */\nexport async function updateSiteFields(\n  base: AirtableBase,\n  recordId: string,\n  fields: Record<string, string>,\n): Promise<void> {\n  if (skipsAirtableShadow(\"updateSiteFields\", recordId)) return;\n  await base(WEBSITES_TABLE).update([{ id: recordId, fields: fields as FieldSet }]);\n}\n\n/**\n * Persist all of a single audit run's results to one Websites row in ONE atomic\n * `update()` — instead of up to four sequential updates on the same id (which left\n * a row half-written on a mid-sequence failure and quadrupled the request volume).\n * Pass only the audit slices that produced real values; each present slice is merged\n * via the SAME field mappings the per-audit writers use. Omit a slice (or pass\n * undefined) to leave those columns untouched. Returns the merged FieldSet so the\n * caller can enumerate what was written.\n */\nexport async function updateAuditFields(\n  base: AirtableBase,\n  recordId: string,\n  audits: {\n    scores?: LighthouseScoreWriteback;\n    a11y?: A11yCounts;\n    deps?: DepsCounts;\n    security?: SecurityCounts;\n    securityAdvisories?: SecurityAdvisory[];\n    domain?: DomainResult;\n    browser?: BrowserAuditFields;\n    netlifyDeploy?: NetlifyDeployResult;\n    functionHealth?: FunctionHealthResult;\n    smoke?: SmokeResult;\n    formE2e?: FormE2eResult;\n  },\n): Promise<FieldSet> {\n  const fields: FieldSet = {};\n  if (audits.scores) Object.assign(fields, scoreFields(audits.scores));\n  if (audits.a11y) Object.assign(fields, a11yFields(audits.a11y));\n  if (audits.deps) Object.assign(fields, depsFields(audits.deps));\n  if (audits.security) Object.assign(fields, securityFields(audits.security));\n  // Separate slice (not folded into `security`) so the advisory list and the counts can be\n  // written independently, but in practice the security audit supplies both together.\n  if (audits.securityAdvisories)\n    Object.assign(fields, securityAdvisoryFields(audits.securityAdvisories));\n  if (audits.domain) Object.assign(fields, domainFields(audits.domain));\n  if (audits.browser) Object.assign(fields, browserFields(audits.browser));\n  if (audits.netlifyDeploy) Object.assign(fields, netlifyDeployFields(audits.netlifyDeploy));\n  if (audits.functionHealth) Object.assign(fields, functionHealthFields(audits.functionHealth));\n  if (audits.smoke) Object.assign(fields, smokeFields(audits.smoke));\n  if (audits.formE2e) Object.assign(fields, formE2eFields(audits.formE2e));\n  if (!skipsAirtableShadow(\"updateAuditFields\", recordId)) {\n    await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);\n  }\n  return fields;\n}\n\n/** Persist the GitHub-signals sweep onto a Websites row (slice 2a). A null\n *  `lastCommitAt` is OMITTED so a not-determined-this-run value never clobbers a\n *  previously-good timestamp (mirrors updateDepsCounts' outdated handling).\n *  Returns the FieldSet it wrote — the Phase 3 Turso mirror consumes the same\n *  payload, so the two writes cannot diverge (updateAuditFields' contract). */\nexport async function updateGitHubSignals(\n  base: AirtableBase,\n  recordId: string,\n  signals: {\n    renovateFailingCis: number;\n    ciState: string;\n    lastCommitAt: string | null;\n    sweptAt: string;\n  },\n): Promise<FieldSet> {\n  const fields: FieldSet = {\n    \"Renovate Failing CIs\": signals.renovateFailingCis,\n    \"Default Branch CI\": signals.ciState,\n    \"GitHub Signals At\": signals.sweptAt,\n  };\n  if (signals.lastCommitAt !== null) {\n    fields[\"Last Commit At\"] = signals.lastCommitAt;\n  }\n  if (!skipsAirtableShadow(\"updateGitHubSignals\", recordId)) {\n    await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);\n  }\n  return fields;\n}\n\n/** One site's Prismic model verdict, as the sweep hands it to the record.\n *\n *  `verdict: null` is a REQUEST TO BLANK the cell, not \"leave it alone\" — see\n *  {@link updatePrismicModels}. There is no way to express \"leave it alone\" here\n *  on purpose. */\nexport type PrismicModelsWriteback = {\n  verdict: PrismicModelsVerdict | null;\n  checkedAt: string;\n  /** The finding, the failure reason, or the skip reason — whichever this\n   *  verdict has. `null` clears the column. */\n  detail: string | null;\n};\n\n/** Airtable's long-text cells hold ~100k characters and the sweep's report runs\n *  long on a badly drifted site (an empty Prismic repository sorts every local\n *  model into `toCreate`, with a line per field). Half the cell is the budget;\n *  the rest is headroom for whatever renders it. */\nconst MAX_PRISMIC_DETAIL_CHARS = 50_000;\n\n/**\n * Shorten a detail that will not fit, and SAY SO — with the original length, so\n * nobody mistakes the remainder for the whole. Same reasoning as the PR comment's\n * truncation notice: a report that was shortened without saying it was shortened\n * is a report that looks complete and is not.\n *\n * The cut is by code unit, so it can land between the halves of an astral\n * character; a lone surrogate is not valid text and can make Airtable reject the\n * write, losing the entire finding to a cosmetic detail.\n */\nfunction truncatePrismicDetail(detail: string): string {\n  if (detail.length <= MAX_PRISMIC_DETAIL_CHARS) return detail;\n  const notice =\n    `\\n…[truncated: this report is ${detail.length} characters and only the first` +\n    ` ${MAX_PRISMIC_DETAIL_CHARS} are kept here. Run \\`reddoor-maint prismic-models\\` in the` +\n    ` site — dry is the default — for the whole thing.]`;\n  let head = detail.slice(0, MAX_PRISMIC_DETAIL_CHARS - notice.length);\n  const last = head.charCodeAt(head.length - 1);\n  if (last >= 0xd800 && last <= 0xdbff) head = head.slice(0, -1);\n  return head + notice;\n}\n\n/**\n * Persist one site's Prismic model verdict.\n *\n * ALL THREE COLUMNS, ALWAYS, in one update — including when the verdict is\n * `unknown` or blank. That is the whole design: the alternative (\"only write a\n * verdict when we have one\") leaves the PREVIOUS verdict standing for a site\n * whose check has since started failing, and a stale `pass` is never aged out by\n * anything — the digest's freshness gate only examines failures. So the record\n * always says what the last run actually established, and `checkedAt` always\n * says when. See {@link WebsiteRow.prismicModels} for the four states.\n *\n * Best-effort AT THE CALL SITE: `Prismic Models*` are operator-added columns, so\n * until they exist Airtable throws UNKNOWN_FIELD_NAME. The nightly sweep must\n * survive that and collect it — same contract as `updateNextDueDates`.\n *\n * Takes a non-null `AirtableBase`, like every other writer here: whether to write\n * at all is the caller's decision, and this repo keeps \"do no writes\" separate\n * from \"do no IO\" one layer up.\n */\nexport async function updatePrismicModels(\n  base: AirtableBase,\n  recordId: string,\n  models: PrismicModelsWriteback,\n): Promise<FieldSet> {\n  const fields: Record<string, string | null> = {\n    \"Prismic Models\": models.verdict,\n    \"Prismic Models Checked At\": models.checkedAt,\n    \"Prismic Models Drift\": models.detail === null ? null : truncatePrismicDetail(models.detail),\n  };\n  if (!skipsAirtableShadow(\"updatePrismicModels\", recordId)) {\n    await base(WEBSITES_TABLE).update([{ id: recordId, fields: fields as FieldSet }]);\n  }\n  // Returned for the #539 Turso mirror — see updateNextDueDates.\n  return fields as FieldSet;\n}\n\n/** Mark a site launched: flip Status → maintained + stamp Launched at (M6b).\n *  The first code that writes Status. Called after a Launch report sends.\n *  Routed through `toAirtableStatus`, so it still writes Airtable's \"maintenance\"\n *  option until the stage-2 switch flips. */\nexport async function updateLaunched(\n  base: AirtableBase,\n  recordId: string,\n  at: string,\n): Promise<FieldSet> {\n  const fields: FieldSet = { Status: toAirtableStatus(\"maintained\"), \"Launched at\": at };\n  if (!skipsAirtableShadow(\"updateLaunched\", recordId)) {\n    await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);\n  }\n  // Returned for the #539 Turso mirror. BOTH columns travel together on purpose:\n  // mirroring them as two UPDATEs would open a window where Turso says a site is\n  // maintained but never launched.\n  return fields;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAuCO,SAAS,iBAAiB,GAAmB;AAClD,SAAO;AACT;;;ACSO,IAAM,iBAAiB;AAQvB,SAAS,OAAO,KAAkE;AACvF,QAAM,IAAI,IAAI;AACd,QAAM,OAAO,OAAO,EAAE,MAAM,KAAK,EAAE;AACnC,QAAM,cACH,EAAE,cAAc,KAA4E,CAAC;AAOhG,QAAM,SAAS,YAAY,GAAG,EAAE,KAAK;AACrC,SAAO;AAAA,IACL,IAAI,IAAI;AAAA,IACR;AAAA,IACA,KAAK,OAAO,EAAE,KAAK,KAAK,EAAE;AAAA,IAC1B,QAAQ,mBAAmB,EAAE,QAAQ,CAAC;AAAA,IACtC,WAAY,EAAE,QAAQ,KAA4B;AAAA,IAClD,gBAAiB,EAAE,kBAAkB,KAA4B;AAAA,IACjE,iBAAiB,YAAY,EAAE,kBAAkB,GAAG,GAAG,IAAI,cAAc;AAAA,IACzE,aAAa,YAAY,EAAE,cAAc,GAAG,GAAG,IAAI,UAAU;AAAA,IAC7D,oBAAqB,EAAE,kBAAkB,KAA4B;AAAA,IACrE,gBAAiB,EAAE,cAAc,KAA4B;AAAA,IAC7D,gBAAiB,EAAE,iBAAiB,KAA4B;AAAA,IAChE,YAAa,EAAE,aAAa,KAA4B;AAAA,IACxD,eAAgB,EAAE,iBAAiB,KAA4B;AAAA,IAC/D,aAAc,EAAE,cAAc,KAA4B;AAAA,IAC1D,uBAAwB,EAAE,yBAAyB,KAA4B;AAAA,IAC/E,qBAAsB,EAAE,wBAAwB,KAA4B;AAAA,IAC5E,SAAU,EAAE,UAAU,KAA4B;AAAA,IAClD,oBAAqB,EAAE,wBAAwB,KAA4B;AAAA,IAC3E,oBAAqB,EAAE,wBAAwB,KAA4B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAO3E,yBAAyB,MAAM,QAAQ,EAAE,2BAA2B,CAAC,IAChE,EAAE,2BAA2B,EAC3B,OAAO,CAAC,MAAmB,OAAO,MAAM,QAAQ,EAChD,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,OAAO,IACjB,OAAO,EAAE,2BAA2B,MAAM,WACvC,EAAE,2BAA2B,EAC3B,MAAM,OAAO,EACb,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,OAAO,IACjB,CAAC;AAAA,IACP,aAAa;AAAA,IACb,QAAS,EAAE,QAAQ,KAA4B;AAAA,IAC/C,QAAS,EAAE,QAAQ,KAA4B;AAAA,IAC/C,SAAU,EAAE,SAAS,KAA4B;AAAA,IACjD,UAAW,EAAE,UAAU,KAA4B;AAAA,IACnD,uBAAwB,EAAE,0BAA0B,KAA4B;AAAA,IAChF,gBAAiB,EAAE,iBAAiB,KAA4B;AAAA,IAChE,aAAc,EAAE,cAAc,KAA4B;AAAA,IAC1D,iBAAkB,EAAE,mBAAmB,KAA4B;AAAA,IACnE,cAAe,EAAE,eAAe,KAA4B;AAAA,IAC5D,mBAAoB,EAAE,qBAAqB,KAA4B;AAAA,IACvE,uBAAwB,EAAE,yBAAyB,KAA4B;AAAA,IAC/E,mBAAoB,EAAE,qBAAqB,KAA4B;AAAA,IACvE,uBAAwB,EAAE,yBAAyB,KAA4B;AAAA,IAC/E,kBAAmB,EAAE,oBAAoB,KAA4B;AAAA,IACrE,yBAA0B,EAAE,4BAA4B,KAA4B;AAAA,IACpF,qBAAsB,EAAE,wBAAwB,KAA4B;AAAA,IAC5E,oBAAoB,wBAAwB,EAAE,qBAAqB,CAAC;AAAA,IACpE,mBAAoB,EAAE,qBAAqB,KAA4B;AAAA,IACvE,iBAAkB,EAAE,mBAAmB,KAA4B;AAAA,IACnE,WAAW,WAAW,EAAE,YAAY,CAAC;AAAA,IACrC,cAAe,EAAE,eAAe,KAA4B;AAAA,IAC5D,cAAe,EAAE,gBAAgB,KAA4B;AAAA,IAC7D,cAAe,EAAE,gBAAgB,KAA4B;AAAA,IAC7D,iBAAkB,EAAE,mBAAmB,KAA4B;AAAA,IACnE,gBAAgB,UAAU,EAAE,iBAAiB,CAAC;AAAA,IAC9C,cAAc,UAAU,EAAE,eAAe,CAAC;AAAA,IAC1C,iBAAiB,UAAU,EAAE,kBAAkB,CAAC;AAAA,IAChD,yBAA0B,EAAE,4BAA4B,KAA4B;AAAA,IACpF,gBACE,OAAO,EAAE,iBAAiB,MAAM,YAAa,EAAE,iBAAiB,IAAgB;AAAA,IAClF,UAAU,OAAO,EAAE,WAAW,MAAM,YAAa,EAAE,WAAW,IAAgB;AAAA,IAC9E,SAAS,OAAO,EAAE,UAAU,MAAM,YAAa,EAAE,UAAU,IAAgB;AAAA,IAC3E,aAAa,OAAO,EAAE,cAAc,MAAM,WAAY,EAAE,cAAc,IAAe;AAAA,IACrF,kBAAmB,EAAE,oBAAoB,KAA4B;AAAA,IACrE,aAAa,UAAU,EAAE,kBAAkB,CAAC;AAAA,IAC5C,aAAa,UAAU,EAAE,kBAAkB,CAAC;AAAA,IAC5C,WAAW,WAAW,EAAE,mBAAc,CAAC;AAAA,IACvC,aAAa,WAAW,EAAE,qBAAgB,CAAC;AAAA,IAC3C,YAAY,WAAW,EAAE,oBAAe,CAAC;AAAA,IACzC,YAAa,EAAE,aAAa,KAA4B;AAAA,IACxD,mBAAmB,WAAW,EAAE,oBAAoB,CAAC;AAAA,IACrD,eAAe,mBAAmB,EAAE,gBAAgB,CAAC;AAAA,IACrD,kBAAkB,WAAW,EAAE,gBAAgB,CAAC;AAAA,IAChD,iBAAiB,WAAW,EAAE,mBAAmB,CAAC;AAAA,IAClD,qBAAqB,WAAW,EAAE,uBAAuB,CAAC;AAAA;AAAA;AAAA,IAG1D,kBACE,OAAO,EAAE,mBAAmB,MAAM,YAAa,EAAE,mBAAmB,IAAgB;AAAA,IACtF,oBAAqB,EAAE,sBAAsB,KAA4B;AAAA,IACzE,iBAAkB,EAAE,mBAAmB,KAA4B;AAAA,IACnE,cAAe,EAAE,gBAAgB,KAA4B;AAAA,IAC7D,iBAAkB,EAAE,mBAAmB,KAA4B;AAAA,IACnE,SAAS,UAAU,EAAE,UAAU,CAAC;AAAA,IAChC,aAAc,EAAE,eAAe,KAA4B;AAAA,IAC3D,WAAW,UAAU,EAAE,aAAa,CAAC;AAAA,IACrC,kBAAmB,EAAE,qBAAqB,KAA4B;AAAA,IACtE,eAAe,uBAAuB,EAAE,gBAAgB,CAAC;AAAA,IACzD,wBAAyB,EAAE,2BAA2B,KAA4B;AAAA,IAClF,oBAAqB,EAAE,sBAAsB,KAA4B;AAAA,IACzE,iBAAkB,EAAE,mBAAmB,KAA4B;AAAA,IACnE,mBAAoB,EAAE,qBAAqB,KAA4B;AAAA,IACvE,eAAgB,EAAE,iBAAiB,KAA4B;AAAA,EACjE;AACF;AAEA,eAAsB,aAAa,MAA2C;AAC5E,QAAM,MAAoB,CAAC;AAC3B,QAAM,KAAK,cAAc,EACtB,OAAO,EAAE,UAAU,IAAI,CAAC,EACxB,SAAS,CAAC,SAAS,kBAAkB;AACpC,eAAW,OAAO,QAAS,KAAI,KAAK,OAAO,EAAE,IAAI,IAAI,IAAI,QAAQ,IAAI,OAAO,CAAC,CAAC;AAC9E,kBAAc;AAAA,EAChB,CAAC;AACH,SAAO;AACT;AAEA,eAAsB,iBACpB,MACA,MAC4B;AAI5B,MAAI,CAAC,6BAA6B,KAAK,IAAI,EAAG,QAAO;AAOrD,QAAM,UAAU,2EAA2E,KAAK;AAAA,IAC9F;AAAA,EACF,CAAC;AACD,QAAM,OAAqB,CAAC;AAC5B,QAAM,KAAK,cAAc,EACtB,OAAO,EAAE,iBAAiB,SAAS,YAAY,EAAE,CAAC,EAClD,SAAS,CAAC,SAAS,kBAAkB;AACpC,eAAW,OAAO,QAAS,MAAK,KAAK,OAAO,EAAE,IAAI,IAAI,IAAI,QAAQ,IAAI,OAAO,CAAC,CAAC;AAC/E,kBAAc;AAAA,EAChB,CAAC;AAGH,SAAO,KAAK,KAAK,CAAC,MAAM,SAAS,EAAE,IAAI,MAAM,IAAI,KAAK;AACxD;AAmEA,SAAS,YAAY,QAA4C;AAO/D,QAAM,SAAiD;AAAA,IACrD,QAAQ,OAAO;AAAA,IACf,QAAQ,OAAO;AAAA,IACf,SAAS,OAAO;AAAA,IAChB,UAAU,OAAO;AAAA,IACjB,6BAA4B,oBAAI,KAAK,GAAE,YAAY;AAAA,EACrD;AACA,SAAO;AACT;AAEA,SAAS,WAAW,QAA8B;AAChD,SAAO,EAAE,mBAAmB,OAAO,WAAW;AAChD;AAEA,SAAS,WAAW,QAA8B;AAChD,QAAM,SAAmB;AAAA,IACvB,gBAAgB,OAAO;AAAA,IACvB,qBAAqB,OAAO;AAAA,EAC9B;AAGA,MAAI,OAAO,aAAa,MAAM;AAC5B,WAAO,eAAe,IAAI,OAAO;AAAA,EACnC;AAEA,MAAI,OAAO,kBAAkB,MAAM;AACjC,WAAO,qBAAqB,IAAI,OAAO;AAAA,EACzC;AACA,SAAO;AACT;AAGA,IAAM,2BAA2B;AAEjC,SAAS,uBAAuB,YAA0C;AACxE,QAAM,SAAS,CAAC,GAAG,UAAU,EAC1B,KAAK,CAAC,GAAG,MAAM,cAAc,EAAE,QAAQ,IAAI,cAAc,EAAE,QAAQ,CAAC,EACpE,MAAM,GAAG,wBAAwB;AAEpC,SAAO,EAAE,uBAAuB,KAAK,UAAU,MAAM,EAAE;AACzD;AAEA,SAAS,eAAe,QAAkC;AACxD,SAAO;AAAA,IACL,2BAA2B,OAAO;AAAA,IAClC,uBAAuB,OAAO;AAAA,IAC9B,2BAA2B,OAAO;AAAA,IAClC,sBAAsB,OAAO;AAAA;AAAA;AAAA,IAG7B,2BAA0B,oBAAI,KAAK,GAAE,YAAY;AAAA,EACnD;AACF;AAEA,SAAS,aAAa,QAAgC;AACpD,QAAM,SAAmB,EAAE,qBAAqB,OAAO,UAAU;AAMjE,EAAC,OAAyC,qBAAqB,IAAI,OAAO;AAC1E,SAAO;AACT;AAEA,SAAS,oBAAoB,QAAuC;AAMlE,QAAM,SAAwC;AAAA,IAC5C,iBAAiB,OAAO;AAAA,IACxB,kBAAkB,OAAO;AAAA,IACzB,kBAAkB,OAAO;AAAA,IACzB,qBAAqB,OAAO;AAAA,EAC9B;AACA,SAAO;AACT;AAEA,SAAS,cAAc,GAAiC;AACtD,SAAO;AAAA,IACL,mBAAmB,EAAE;AAAA,IACrB,aAAa,EAAE;AAAA,IACf,YAAY,EAAE;AAAA,IACd,gBAAgB,EAAE;AAAA,IAClB,sBAAsB,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA,IAKxB,oBAAoB,EAAE,cAAc,SAAS;AAAA,IAC7C,oBAAoB,EAAE,cAAc,SAAS;AAAA,EAC/C;AACF;AAEA,SAAS,qBAAqB,GAAmC;AAU/D,QAAM,SAAwC;AAAA,IAC5C,mBAAmB,EAAE;AAAA,IACrB,iBAAiB,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASnB,8BAA8B,EAAE;AAAA,EAClC;AACA,SAAO;AACT;AAEA,SAAS,YAAY,GAA0B;AAI7C,SAAO,EAAE,YAAY,EAAE,IAAI,iBAAiB,EAAE,UAAU;AAC1D;AAEA,SAAS,cAAc,GAA4B;AAKjD,QAAM,SAAwC,CAAC;AAK/C,MAAI,EAAE,OAAO,QAAW;AACtB,WAAO,aAAa,IAAI,EAAE;AAC1B,WAAO,qBAAqB,IAAI,EAAE;AAAA,EACpC;AAMA,MAAI,EAAE,oBAAoB,OAAW,QAAO,kBAAkB,IAAI,EAAE;AACpE,SAAO;AACT;AAkBA,eAAsB,aACpB,MACA,UACA,QACe;AACf,MAAI,oBAAoB,gBAAgB,QAAQ,EAAG;AACnD,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,QAAQ,YAAY,MAAM,EAAE,CAAC,CAAC;AACnF;AAQO,SAAS,sBAAsB,IAA6B;AACjE,QAAM,SAAwC,EAAE,0BAA0B,GAAG;AAC7E,SAAO;AACT;AAUA,eAAsB,sBACpB,MACA,UACA,IACmB;AACnB,QAAM,SAAS,sBAAsB,EAAE;AACvC,MAAI,CAAC,oBAAoB,yBAAyB,QAAQ,GAAG;AAC3D,UAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,OAAO,CAAC,CAAC;AAAA,EAC9D;AAGA,SAAO;AACT;AAGA,eAAsB,iBACpB,MACA,UACA,QACe;AACf,MAAI,oBAAoB,oBAAoB,QAAQ,EAAG;AACvD,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,QAAQ,WAAW,MAAM,EAAE,CAAC,CAAC;AAClF;AAGA,eAAsB,iBACpB,MACA,UACA,QACe;AACf,MAAI,oBAAoB,oBAAoB,QAAQ,EAAG;AACvD,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,QAAQ,WAAW,MAAM,EAAE,CAAC,CAAC;AAClF;AAGA,eAAsB,qBACpB,MACA,UACA,QACe;AACf,MAAI,oBAAoB,wBAAwB,QAAQ,EAAG;AAC3D,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,QAAQ,eAAe,MAAM,EAAE,CAAC,CAAC;AACtF;AAIA,eAAsB,sBACpB,MACA,UACA,UACmB;AACnB,QAAM,SAAmB,EAAE,8BAA8B,SAAS;AAClE,MAAI,CAAC,oBAAoB,yBAAyB,QAAQ,GAAG;AAC3D,UAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,OAAO,CAAC,CAAC;AAAA,EAC9D;AAEA,SAAO;AACT;AAUA,eAAsB,mBACpB,MACA,UACA,OACmB;AACnB,QAAM,SAAwC;AAAA,IAC5C,uBAAuB,MAAM;AAAA,IAC7B,mBAAmB,MAAM;AAAA,EAC3B;AACA,MAAI,CAAC,oBAAoB,sBAAsB,QAAQ,GAAG;AACxD,UAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,OAA2B,CAAC,CAAC;AAAA,EAClF;AAGA,SAAO;AACT;AAWA,eAAsB,gBACpB,MACA,UACA,QACA,OACe;AACf,MAAI,oBAAoB,mBAAmB,QAAQ,EAAG;AACtD,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,QAAQ,EAAE,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;AACnF;AAMA,eAAsB,iBACpB,MACA,UACA,QACe;AACf,MAAI,oBAAoB,oBAAoB,QAAQ,EAAG;AACvD,QAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,OAA2B,CAAC,CAAC;AAClF;AAWA,eAAsB,kBACpB,MACA,UACA,QAamB;AACnB,QAAM,SAAmB,CAAC;AAC1B,MAAI,OAAO,OAAQ,QAAO,OAAO,QAAQ,YAAY,OAAO,MAAM,CAAC;AACnE,MAAI,OAAO,KAAM,QAAO,OAAO,QAAQ,WAAW,OAAO,IAAI,CAAC;AAC9D,MAAI,OAAO,KAAM,QAAO,OAAO,QAAQ,WAAW,OAAO,IAAI,CAAC;AAC9D,MAAI,OAAO,SAAU,QAAO,OAAO,QAAQ,eAAe,OAAO,QAAQ,CAAC;AAG1E,MAAI,OAAO;AACT,WAAO,OAAO,QAAQ,uBAAuB,OAAO,kBAAkB,CAAC;AACzE,MAAI,OAAO,OAAQ,QAAO,OAAO,QAAQ,aAAa,OAAO,MAAM,CAAC;AACpE,MAAI,OAAO,QAAS,QAAO,OAAO,QAAQ,cAAc,OAAO,OAAO,CAAC;AACvE,MAAI,OAAO,cAAe,QAAO,OAAO,QAAQ,oBAAoB,OAAO,aAAa,CAAC;AACzF,MAAI,OAAO,eAAgB,QAAO,OAAO,QAAQ,qBAAqB,OAAO,cAAc,CAAC;AAC5F,MAAI,OAAO,MAAO,QAAO,OAAO,QAAQ,YAAY,OAAO,KAAK,CAAC;AACjE,MAAI,OAAO,QAAS,QAAO,OAAO,QAAQ,cAAc,OAAO,OAAO,CAAC;AACvE,MAAI,CAAC,oBAAoB,qBAAqB,QAAQ,GAAG;AACvD,UAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,OAAO,CAAC,CAAC;AAAA,EAC9D;AACA,SAAO;AACT;AAOA,eAAsB,oBACpB,MACA,UACA,SAMmB;AACnB,QAAM,SAAmB;AAAA,IACvB,wBAAwB,QAAQ;AAAA,IAChC,qBAAqB,QAAQ;AAAA,IAC7B,qBAAqB,QAAQ;AAAA,EAC/B;AACA,MAAI,QAAQ,iBAAiB,MAAM;AACjC,WAAO,gBAAgB,IAAI,QAAQ;AAAA,EACrC;AACA,MAAI,CAAC,oBAAoB,uBAAuB,QAAQ,GAAG;AACzD,UAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,OAAO,CAAC,CAAC;AAAA,EAC9D;AACA,SAAO;AACT;AAmBA,IAAM,2BAA2B;AAYjC,SAAS,sBAAsB,QAAwB;AACrD,MAAI,OAAO,UAAU,yBAA0B,QAAO;AACtD,QAAM,SACJ;AAAA,mCAAiC,OAAO,MAAM,kCAC1C,wBAAwB;AAE9B,MAAI,OAAO,OAAO,MAAM,GAAG,2BAA2B,OAAO,MAAM;AACnE,QAAM,OAAO,KAAK,WAAW,KAAK,SAAS,CAAC;AAC5C,MAAI,QAAQ,SAAU,QAAQ,MAAQ,QAAO,KAAK,MAAM,GAAG,EAAE;AAC7D,SAAO,OAAO;AAChB;AAqBA,eAAsB,oBACpB,MACA,UACA,QACmB;AACnB,QAAM,SAAwC;AAAA,IAC5C,kBAAkB,OAAO;AAAA,IACzB,6BAA6B,OAAO;AAAA,IACpC,wBAAwB,OAAO,WAAW,OAAO,OAAO,sBAAsB,OAAO,MAAM;AAAA,EAC7F;AACA,MAAI,CAAC,oBAAoB,uBAAuB,QAAQ,GAAG;AACzD,UAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,OAA2B,CAAC,CAAC;AAAA,EAClF;AAEA,SAAO;AACT;AAMA,eAAsB,eACpB,MACA,UACA,IACmB;AACnB,QAAM,SAAmB,EAAE,QAAQ,iBAAiB,YAAY,GAAG,eAAe,GAAG;AACrF,MAAI,CAAC,oBAAoB,kBAAkB,QAAQ,GAAG;AACpD,UAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,UAAU,OAAO,CAAC,CAAC;AAAA,EAC9D;AAIA,SAAO;AACT;","names":[]}