@reddoorla/maintenance 0.95.1 → 0.97.0

package/dist/launch-7N3X2MXB.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli/commands/launch.ts","../src/recipes/launch.ts"],"sourcesContent":["import { resolve } from \"node:path\";\nimport { launch, type LaunchResult, type LaunchStepResult } from \"../../recipes/launch.js\";\nimport { resolveSites } from \"../fleet/resolve-sites.js\";\n\nexport type LaunchCommandOptions = {\n  cwd?: string;\n};\n\nexport function formatStep(name: string, r: LaunchStepResult): string {\n  if (r.kind === \"error\") return `${name.padEnd(20)} error: ${r.message}`;\n  if (r.kind === \"audit\") {\n    const s = r.scores;\n    return `${name.padEnd(20)} audited (P=${s.performance} A=${s.accessibility} BP=${s.bestPractices} SEO=${s.seo})`;\n  }\n  if (r.kind === \"draft\") {\n    return `${name.padEnd(20)} drafted ${r.report.reportId}`;\n  }\n  if (r.kind === \"probe\") return `${name.padEnd(20)} ok — ${r.message}`;\n  const rec = r.result;\n  if (rec.status === \"noop\") return `${name.padEnd(20)} noop${rec.notes ? ` — ${rec.notes}` : \"\"}`;\n  if (rec.status === \"failed\")\n    return `${name.padEnd(20)} failed${rec.notes ? ` — ${rec.notes}` : \"\"}`;\n  return `${name.padEnd(20)} applied (${rec.commits.length} commit${rec.commits.length === 1 ? \"\" : \"s\"})${rec.notes ? ` — ${rec.notes}` : \"\"}`;\n}\n\nfunction formatResult(r: LaunchResult): string {\n  const header = `[${r.site}] launch — ${r.complete ? \"drafted (awaiting approval)\" : \"STOPPED\"}`;\n  const body = r.steps.map((s) => formatStep(s.name, s.result)).join(\"\\n\");\n  return `${header}\\n${body}`;\n}\n\n/**\n * `launch <site>` — single-site only. Bootstrap (Renovate + protection), first-audit\n * the site, and DRAFT its launch email into the M3 approve queue. Never sends;\n * the operator approves the draft and the next send run delivers the go-live\n * email (flipping Status → maintenance + stamping Launched at).\n */\nexport async function runLaunchCommand(\n  site: string,\n  opts: LaunchCommandOptions,\n): Promise<{ output: string; code: number }> {\n  const cwd = opts.cwd ? resolve(opts.cwd) : process.cwd();\n  const sites = await resolveSites({ site, cwd });\n  const target = sites[0];\n  if (!target) {\n    return { output: `No site resolved for \"${site}\".`, code: 1 };\n  }\n\n  // #539 Phase 5: create-side Turso dual-write, wired at the composition root\n  // (see runAnnounceCommand for why it is not defaulted inside the recipe).\n  const { makeReportMirror } = await import(\"../../reports/report-mirror.js\");\n  const { makeSiteMirror } = await import(\"../../db/site-mirror.js\");\n  // #646 step 4: the fleet roster comes from Turso — an Airtable roster cannot\n  // see a `site_<ULID>` site, so launching one failed at \"no site row matched\".\n  const { readFleetRoster } = await import(\"../../fleet/roster.js\");\n  const result = await launch(target, {\n    roster: () => readFleetRoster(),\n    reportMirror: await makeReportMirror(),\n    siteMirror: await makeSiteMirror(),\n  });\n  return { output: formatResult(result), code: result.complete ? 0 : 1 };\n}\n","import { existsSync } from \"node:fs\";\nimport { readFile, readdir } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport type { AuditResult, RecipeResult, Site } from \"../types.js\";\nimport { siteLabel } from \"../util/site.js\";\nimport { selfUpdating } from \"./self-updating/index.js\";\nimport { HARNESS_JSON_RELATIVE, UNGUARDED_TWIN_TELL } from \"./match-harness/template.js\";\nimport { runAudits } from \"../audits/index.js\";\nimport { hasRealScores, lighthouseScoresFromResult } from \"../audits/lighthouse-airtable.js\";\nimport { writeAuditsToAirtable } from \"../audits/write-audits-to-airtable.js\";\nimport { openBase, readAirtableConfig } from \"../reports/airtable/client.js\";\nimport type { AirtableBase } from \"../reports/airtable/client.js\";\nimport { siteSlug } from \"../reports/airtable/websites.js\";\nimport type { WebsiteRow } from \"../reports/airtable/websites.js\";\nimport { updateReportScores } from \"../reports/airtable/reports.js\";\nimport { createReportDraft, findReportForPeriod } from \"../reports/create-report.js\";\nimport type { DraftInput } from \"../reports/draft-fields.js\";\nimport type { ReportRow } from \"../reports/airtable/reports.js\";\nimport type { ReportMirror } from \"../reports/report-mirror.js\";\nimport type { SiteMirror } from \"../db/site-mirror.js\";\nimport { queueDraft } from \"../reports/queue.js\";\nimport { uploadAttachment } from \"../reports/airtable/attachments.js\";\nimport { renderReportHtml } from \"../reports/render.js\";\nimport { resolveCopy } from \"../reports/copy.js\";\nimport type { LighthouseScores } from \"../reports/types.js\";\n\nexport type LaunchStepResult =\n  | { kind: \"recipe\"; result: RecipeResult }\n  | { kind: \"audit\"; results: AuditResult[]; scores: LighthouseScores }\n  | { kind: \"draft\"; report: ReportRow }\n  | { kind: \"probe\"; message: string }\n  | { kind: \"error\"; message: string };\n\nexport type LaunchResult = {\n  site: string;\n  steps: Array<{ name: string; result: LaunchStepResult }>;\n  /** True if every step ran (bootstrap + audit + draft); false if a step\n   * errored or a recipe `failed` short-circuited the chain. */\n  complete: boolean;\n};\n\nexport type LaunchDeps = {\n  /** Bootstrap step (Renovate + protection; ci.yml comes from the starter). Defaults to the real `selfUpdating`. */\n  bootstrap?: (site: Site) => Promise<RecipeResult>;\n  /** Audit step. Defaults to the real `runAudits`. */\n  audit?: (site: Site) => Promise<AuditResult[]>;\n  /** Airtable handle. Defaults to opening the live base from credentials. */\n  base?: AirtableBase;\n  /** Every site in the fleet, read from TURSO (#646 step 4) — the Airtable\n   *  roster this replaces could not see a `site_<ULID>` site, so launching one\n   *  failed at \"no Websites row matched\". Required, not defaulted: the unit\n   *  suite calls `launch` with a fake base and must not open a real libSQL\n   *  handle. The CLI composition root wires `readFleetRoster`. */\n  roster: () => Promise<WebsiteRow[]>;\n  /** #539 Phase 5, and since #646 step 4 the store that MINTS and holds the\n   *  Launch row: the row itself (or a re-run's refreshed scores), the rendered\n   *  body, and the queue flag. Required for the same reason `roster` is. */\n  reportMirror: ReportMirror;\n  /** #539 Phase 5: the Websites-row twin — launch writes the site's FIRST audit\n   *  results and (on send) its launched status. Injected at the CLI root. */\n  siteMirror?: SiteMirror;\n  /** HTTP probe for `dev-guard`. Defaults to global fetch. INJECTED in tests:\n   *  the suite stubs `global.fetch` for the Airtable attachment upload and that\n   *  stub answers 200 to everything — which is precisely the state this step\n   *  exists to fail on. */\n  probe?: (url: string) => Promise<{ status: number; body: string }>;\n};\n\n/** The site's OWN 404. `src/routes/+error.svelte` renders `<h1>{page.status}</h1>`,\n *  so a real SvelteKit 404 from this app carries an `<h1>404</h1>`; a parked\n *  domain, a CDN 404 and a dead host do not. \"The route is gone\" and \"the site\n *  is gone\" must not look the same to this gate. */\nconst SITE_404_MARKER = /<h1[^>]*>\\s*404\\s*<\\/h1>/i;\n\n/** The UNGUARDED twin's OWN refusal. `src/routes/dev/match/[uid]/+page.server.ts`\n *  404s for any uid absent from its assembly map — and that message renders\n *  through the very same `+error.svelte` the guard's 404 uses, so it carries an\n *  `<h1>404</h1>` too. On a site whose uid set lacks \"home\", a LIVE twin and a\n *  guarded one are byte-indistinguishable to SITE_404_MARKER, and the check\n *  could never fail. Verified on disk: beachfront-dentistry's copy of that route\n *  imports `$app/environment` zero times.\n *\n *  The contract is the MACHINE tell `UNGUARDED_TWIN_TELL`, imported from the\n *  template that installs the route rather than re-typed here: the installed\n *  twin puts it ahead of its human-readable message. Matching the prose was\n *  the defect of #719 — reword the message (\"no document for\", \"unknown uid\")\n *  and the guard silently stopped denying, i.e. failed OPEN with fixtures\n *  public. The two prose wordings are STILL accepted, on purpose and for now:\n *  beachfront-dentistry's on-disk twin predates the tell and says \"no matching\n *  assembly for\", and any site installed before the tell says \"no assembly\n *  for\". Drop the prose alternates once beachfront's twin has been\n *  re-installed from the harness; until then they only ever widen the deny.\n *\n *  This is a DENY clause and only ever a deny — it can refuse a green, never\n *  grant one. Widening it can only ever refuse a launch that would otherwise\n *  have proceeded, so widening is always the safe direction here. */\nexport const UNGUARDED_TWIN_MARKER = new RegExp(\n  `${UNGUARDED_TWIN_TELL.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\")}|no (matching )?assembly for`,\n  \"i\",\n);\n\nconst MATCH_ROUTE_DIR = \"src/routes/dev/match\";\n\n/** Positive evidence that `sitePath` is a SvelteKit checkout at all. Without it,\n *  the absence of MATCH_ROUTE_DIR is evidence of nothing: a path never cloned, a\n *  stale clone, a mistyped site name and the wrong working directory all produce\n *  exactly the same `false`, and `resolveSites` builds the path with\n *  `localPath(resolve(cwd, site))` and no existence check of its own. This is\n *  the filesystem twin of the `/health` control on the deployed gate — an absent\n *  error must never be allowed to grant a green. */\nconst CHECKOUT_MARKER = \"src/routes\";\n\n/** Tokens after which a `/` opens a REGEX literal rather than a division. This\n *  is the usual JS ambiguity, answered by lookback at the last significant\n *  character — a scanner's answer, not a parser's.\n *\n *  `)` is deliberately NOT here. `if (x) /re/.test(y)` is legal and is read as\n *  division, which costs nothing (the `/` is copied through unchanged, exactly\n *  as before this function existed) and keeps `(a + b) / 2` right, which is far\n *  commoner in that position. That is the residual: a regex literal opening\n *  directly after `)` AND containing a quote falls back to the old behaviour and\n *  therefore DENIES. Deny is the safe direction here — see `carriesGuard`. */\nconst REGEX_PRECEDERS = /[(,=:[!&|?{};+\\-*%~^<>]/;\nconst REGEX_KEYWORDS = new Set([\n  \"return\",\n  \"typeof\",\n  \"case\",\n  \"in\",\n  \"of\",\n  \"new\",\n  \"delete\",\n  \"void\",\n  \"instanceof\",\n  \"do\",\n  \"else\",\n  \"yield\",\n  \"await\",\n]);\n\nfunction opensRegex(prevChar: string, prevWord: string): boolean {\n  if (prevChar === \"\") return true;\n  if (REGEX_PRECEDERS.test(prevChar)) return true;\n  return REGEX_KEYWORDS.has(prevWord);\n}\n\n/** The last significant character emitted so far, and the identifier ending at\n *  it. Both scanners look back over their own OUTPUT, which is why masking is\n *  safe to interleave: masked bodies are spaces and the delimiters survive, so\n *  the structural lookback reads the same either way. */\nfunction lookback(out: string): { char: string; word: string } {\n  let i = out.length - 1;\n  while (i >= 0 && /\\s/.test(out[i]!)) i--;\n  if (i < 0) return { char: \"\", word: \"\" };\n  let j = i;\n  while (j >= 0 && /[A-Za-z0-9_$]/.test(out[j]!)) j--;\n  return { char: out[i]!, word: out.slice(j + 1, i + 1) };\n}\n\n/** Index of a regex literal's CLOSING `/`, or -1 if `source[at]` does not in\n *  fact open one. `[...]` character classes are tracked because a `/` inside one\n *  does not close the literal (`/[a-z/]/`). A newline or an unterminated run\n *  means this was never a regex, and the caller then treats the `/` as an\n *  ordinary character — the behaviour that predates regex-awareness. */\nfunction regexLiteralEnd(source: string, at: number): number {\n  let inClass = false;\n  for (let i = at + 1; i < source.length; i++) {\n    const c = source[i]!;\n    if (c === \"\\\\\") {\n      i++;\n      continue;\n    }\n    if (c === \"\\n\") return -1;\n    if (inClass) {\n      if (c === \"]\") inClass = false;\n      continue;\n    }\n    if (c === \"[\") {\n      inClass = true;\n      continue;\n    }\n    if (c === \"/\") return i;\n  }\n  return -1;\n}\n\n/** Strip line and block comments, so the COMMON commented-out guard cannot\n *  satisfy the match — an import left in place above `// if (!dev) error(404);`\n *  is the likeliest real-world state, and it used to pass. String and template\n *  literals are skipped so a `//` inside a URL is not read as a comment.\n *\n *  Regex literals are recognised (#726). Without that, a quote character inside\n *  one — `/[a-z0-9']+/` — opened a string that never closed, and everything to\n *  the next matching quote was preserved as if it were string content. On a\n *  CORRECTLY guarded file that swallowed the live `if (!dev) error(404)` and the\n *  twin read as unguarded, so a launch was blocked on a site that was fine. The\n *  literal is now copied through verbatim, which is what a comment stripper\n *  should do with one. */\nfunction stripComments(source: string): string {\n  let out = \"\";\n  for (let i = 0; i < source.length;) {\n    const ch = source[i]!;\n    const next = source[i + 1];\n    if (ch === \"/\" && next === \"/\") {\n      while (i < source.length && source[i] !== \"\\n\") i++;\n      continue;\n    }\n    if (ch === \"/\" && next === \"*\") {\n      i += 2;\n      while (i < source.length && !(source[i] === \"*\" && source[i + 1] === \"/\")) i++;\n      i += 2;\n      continue;\n    }\n    if (ch === \"/\") {\n      const { char, word } = lookback(out);\n      if (opensRegex(char, word)) {\n        const end = regexLiteralEnd(source, i);\n        if (end !== -1) {\n          out += source.slice(i, end + 1);\n          i = end + 1;\n          continue;\n        }\n      }\n    }\n    if (ch === '\"' || ch === \"'\" || ch === \"`\") {\n      out += ch;\n      i++;\n      while (i < source.length) {\n        if (source[i] === \"\\\\\") {\n          out += source.slice(i, i + 2);\n          i += 2;\n          continue;\n        }\n        out += source[i]!;\n        i++;\n        if (source[i - 1] === ch) break;\n      }\n      continue;\n    }\n    out += ch;\n    i++;\n  }\n  return out;\n}\n\n/** Blank the CONTENTS of string and template literals, keeping the quote\n *  characters, the newlines and the overall length. Only the guard scan uses\n *  this — never the `$app/environment` check, whose whole subject is an import\n *  specifier and therefore is itself a string literal.\n *\n *  It exists because `if (!dev) console.warn(\"this should throw error(404)\")`\n *  read as a refusal. Masking can only ever REMOVE candidate refusal tokens, so\n *  it can only ever deny.\n *  Regex BODIES are masked too, for the same reason and with the same effect: a\n *  regex is data, so `if (!dev) RE = /throw/` must not be read as a refusal. It\n *  was, before #726. */\nfunction maskLiterals(code: string): string {\n  let out = \"\";\n  for (let i = 0; i < code.length;) {\n    const ch = code[i]!;\n    if (ch === \"/\") {\n      const { char, word } = lookback(out);\n      if (opensRegex(char, word)) {\n        const end = regexLiteralEnd(code, i);\n        if (end !== -1) {\n          // Delimiters and length kept, body blanked — exactly the string rule.\n          out += \"/\" + \" \".repeat(end - i - 1) + \"/\";\n          i = end + 1;\n          continue;\n        }\n      }\n    }\n    if (ch !== '\"' && ch !== \"'\" && ch !== \"`\") {\n      out += ch;\n      i++;\n      continue;\n    }\n    out += ch;\n    i++;\n    while (i < code.length) {\n      const c = code[i]!;\n      if (c === \"\\\\\") {\n        out += \"  \";\n        i += 2;\n        continue;\n      }\n      i++;\n      if (c === ch) {\n        out += c;\n        break;\n      }\n      out += c === \"\\n\" ? \"\\n\" : \" \";\n    }\n  }\n  return out;\n}\n\n/** The statement or block the `if (...)` ending at `from` actually governs: a\n *  braced block, or the single statement up to its terminating `;` — or, under\n *  ASI, the end of its line. Bracket depth is tracked so\n *  `error(404, {\\n  message: \"…\"\\n});` is ONE statement rather than three\n *  fragments. Expects `code` to be comment-stripped and literal-masked, so every\n *  bracket it sees is a real one. */\nfunction consequentAt(code: string, from: number): string {\n  let i = from;\n  while (i < code.length && /\\s/.test(code[i]!)) i++;\n  const start = i;\n  if (code[i] === \"{\") {\n    let depth = 0;\n    for (; i < code.length; i++) {\n      if (code[i] === \"{\") depth++;\n      else if (code[i] === \"}\" && --depth === 0) return code.slice(start, i + 1);\n    }\n    return code.slice(start);\n  }\n  let depth = 0;\n  for (; i < code.length; i++) {\n    const ch = code[i]!;\n    if (ch === \"(\" || ch === \"[\" || ch === \"{\") depth++;\n    else if (ch === \")\" || ch === \"]\" || ch === \"}\") {\n      if (depth === 0) return code.slice(start, i);\n      depth--;\n    } else if (depth === 0 && (ch === \";\" || ch === \"\\n\")) return code.slice(start, i);\n  }\n  return code.slice(start);\n}\n\n/** An actual refusal: SvelteKit's `error(404, …)`, or any `throw`. */\nconst REFUSAL = /\\berror\\s*\\(\\s*404|\\bthrow\\b/;\n\n/** A guard is `$app/environment` + an `if (!dev)` **whose own branch refuses**.\n *\n *  The three conditions used to be ANDed across the WHOLE file, with nothing\n *  tying the refusal to the `if`. Two shapes passed that should not have: a\n *  warn-only `if (!dev)` alongside the route's own unrelated `throw` (the exact\n *  half-fix this comment used to claim was closed), and a refusal occurring only\n *  inside a string. Reading the guard's consequent, on literal-masked source, is\n *  strictly narrower than the old whole-file grep — every input it rejects, the\n *  old predicate also had to reject on `$app/environment` or `if (!dev)`, or was\n *  a false pass. It can therefore only deny, never grant.\n *\n *  It is a contract with plan BC's `ROUTE_SERVER` template, which BC installs\n *  and this pre-flight must accept; tests/recipes/launch.test.ts lifts that\n *  template out of the plan and runs this predicate over it rather than\n *  restating the pattern. */\nfunction carriesGuard(source: string): boolean {\n  const code = stripComments(source);\n  if (!code.includes(\"$app/environment\")) return false;\n  const masked = maskLiterals(code);\n  const guards = /if\\s*\\(\\s*!\\s*dev\\s*\\)/g;\n  for (let m = guards.exec(masked); m; m = guards.exec(masked)) {\n    if (REFUSAL.test(consequentAt(masked, m.index + m[0].length))) return true;\n  }\n  return false;\n}\n\nconst DEV_ROUTE_DIR = \"src/routes/dev\";\n\n/** Every SvelteKit route file at or below `relDir`, site-root-relative. The\n *  gates used to read a FIXED list of three paths, which is why a `+server.ts`\n *  endpoint and a `/dev/match/frozen` sibling were inspected by neither of them\n *  (#723). What exists under the twin is a question for the filesystem, not for\n *  a constant. */\nasync function routeFilesUnder(sitePath: string, relDir: string): Promise<string[]> {\n  let entries;\n  try {\n    entries = await readdir(join(sitePath, relDir), { withFileTypes: true });\n  } catch {\n    return [];\n  }\n  const out: string[] = [];\n  for (const e of entries) {\n    const rel = `${relDir}/${e.name}`;\n    if (e.isDirectory()) out.push(...(await routeFilesUnder(sitePath, rel)));\n    else if (e.name.startsWith(\"+\")) out.push(rel);\n  }\n  return out;\n}\n\n/** `carriesGuard` for one file, memoised — a layout is asked about once per page\n *  directory below it. An unreadable file is not a guard. */\nasync function guardAt(\n  sitePath: string,\n  rel: string,\n  cache: Map<string, boolean>,\n): Promise<boolean> {\n  const hit = cache.get(rel);\n  if (hit !== undefined) return hit;\n  let ok: boolean;\n  try {\n    ok = carriesGuard(await readFile(join(sitePath, rel), \"utf-8\"));\n  } catch {\n    ok = false;\n  }\n  cache.set(rel, ok);\n  return ok;\n}\n\n/** The nearest guarded `+layout.server.ts` at or above `dir`, up to and\n *  including `src/routes/dev`, or null.\n *\n *  `src/routes/dev/+layout.server.ts` is the STRONGEST placement and the\n *  fleet-wide class-fix for \"dev routes ship in production\" (#717): one `load`\n *  doing `if (!dev) error(404)` runs for every `/dev/*` page, `/dev/match/[uid]`\n *  included. An earlier version read only inside `/dev/match` and so reported\n *  such a site as \"the matching twin would ship\" — untrue, and it penalised the\n *  better fix. It also contradicted the deployed half of this feature, which was\n *  deliberately redesigned to survive that class-fix: see the `/health` comment\n *  at the dev-guard step for why the 200 control moved off `/dev/a11y-fixtures`.\n *\n *  Layouts cover PAGES only. A `+server.ts` endpoint runs no layout `load` at\n *  all, which is why `matchingDisposition` checks endpoints separately and never\n *  lets a layout vouch for one (#723). */\nasync function coveringLayout(\n  sitePath: string,\n  dir: string,\n  cache: Map<string, boolean>,\n): Promise<string | null> {\n  let d = dir;\n  for (;;) {\n    const rel = `${d}/+layout.server.ts`;\n    if (await guardAt(sitePath, rel, cache)) return rel;\n    if (d === DEV_ROUTE_DIR) return null;\n    const up = d.slice(0, d.lastIndexOf(\"/\"));\n    if (up.length < DEV_ROUTE_DIR.length) return null;\n    d = up;\n  }\n}\n\n/**\n * Pre-flight: a checkout that still carries the matching twin must carry the\n * dev guard the `match-harness` recipe installs with it. Nothing is deleted at\n * launch — the harness stays for the next round — so the guard is the whole\n * mechanism keeping `/dev/match/*` off the production build.\n *\n * Filesystem only, and it runs BEFORE any GitHub write: a site that will fail\n * the deployed check should not first acquire branch protection and an audit.\n *\n * Liveness first. `src/routes` has to be there before a missing\n * `src/routes/dev/match` may be read as \"this site has no twin\" — otherwise the\n * pass is granted by an absence, and four separate operator errors produce that\n * same absence. See CHECKOUT_MARKER.\n */\nexport async function matchingDisposition(\n  sitePath: string,\n): Promise<{ ok: boolean; message: string }> {\n  if (!existsSync(join(sitePath, CHECKOUT_MARKER))) {\n    return {\n      ok: false,\n      message: `${sitePath} has no ${CHECKOUT_MARKER} — this is not a SvelteKit checkout (never cloned, a stale clone, a mistyped site name, or the wrong working directory), so the twin's disposition cannot be established`,\n    };\n  }\n  if (!existsSync(join(sitePath, MATCH_ROUTE_DIR))) {\n    return {\n      ok: true,\n      message: `no ${MATCH_ROUTE_DIR} in this checkout (${CHECKOUT_MARKER} is present, so the absence is a real one)`,\n    };\n  }\n  const files = await routeFilesUnder(sitePath, MATCH_ROUTE_DIR);\n  if (files.length === 0) {\n    return {\n      ok: false,\n      message: `${MATCH_ROUTE_DIR} exists but carries no route files (+page/+server/+layout) — the twin's disposition cannot be established`,\n    };\n  }\n\n  const cache = new Map<string, boolean>();\n  const unguarded: string[] = [];\n  const covers: string[] = [];\n\n  // Endpoints FIRST, and never covered by a layout: SvelteKit layout `load` does\n  // not run for `+server.ts`, so the #717 class-fix at src/routes/dev that\n  // legitimately covers every page leaves an endpoint fully live (#723).\n  for (const ep of files.filter((f) => f.endsWith(\"/+server.ts\"))) {\n    if (await guardAt(sitePath, ep, cache)) covers.push(ep);\n    else\n      unguarded.push(\n        `${ep} (a \\`+server.ts\\` endpoint — layout \\`load\\` does not run for it, so it needs its own guard)`,\n      );\n  }\n\n  // Then every directory holding a page, each covered by its own guarded\n  // +page.server.ts or by a +layout.server.ts at or above it.\n  const pageDirs = [\n    ...new Set(\n      files\n        .filter((f) => /\\/\\+page\\.(server\\.ts|ts|svelte)$/.test(f))\n        .map((f) => f.slice(0, f.lastIndexOf(\"/\"))),\n    ),\n  ];\n  for (const dir of pageDirs) {\n    const layout = await coveringLayout(sitePath, dir, cache);\n    if (layout) {\n      covers.push(layout);\n      continue;\n    }\n    const own = `${dir}/+page.server.ts`;\n    if (await guardAt(sitePath, own, cache)) {\n      covers.push(own);\n      continue;\n    }\n    unguarded.push(`${dir}/ (no guarded +page.server.ts and no covering +layout.server.ts)`);\n  }\n\n  if (unguarded.length > 0) {\n    return {\n      ok: false,\n      message: `${MATCH_ROUTE_DIR} is not fully guarded — ${unguarded.join(\"; \")} — an \\`if (!dev)\\` guard on \\`$app/environment\\` whose own branch refuses (\\`error(404\\` or \\`throw\\`) is required, once comments are stripped and string and regex contents masked; the matching twin would ship`,\n    };\n  }\n  // Deliberately NOT \"the twin is guarded in production\". This function reads\n  // source text on disk; it cannot observe the deployed build, and a field that\n  // can only see configuration must not be named after the thing it cannot see.\n  // The deployed behaviour is the `dev-guard` step's job.\n  return {\n    ok: true,\n    message: `every route under ${MATCH_ROUTE_DIR} is covered by dev guard source — ${[...new Set(covers)].join(\", \")} (source text only; the deployed build is checked at the dev-guard step)`,\n  };\n}\n\n/** The uids whose `/dev/match` twin must be proved dead, read from the harness's\n *  OWN page table — the file `match-harness` installs and every gate already\n *  reads — so the gate and the harness cannot disagree about which pages exist.\n *  Probing a hardcoded \"home\" left every sibling uid unprobed (#723).\n *\n *  A page whose `uid` is null has no twin (harness.mjs says so) and is skipped.\n *  An absent or unparseable harness.json falls back to \"home\": not every\n *  launched site carries the harness, so a missing file must not become a\n *  refusal — and must not yield an EMPTY list either, which would prove nothing\n *  while looking like a pass. */\nasync function twinUids(sitePath: string): Promise<string[]> {\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(await readFile(join(sitePath, HARNESS_JSON_RELATIVE), \"utf-8\"));\n  } catch {\n    return [\"home\"];\n  }\n  const pages = (parsed as { pages?: Record<string, { uid?: unknown } | null> })?.pages;\n  if (!pages || typeof pages !== \"object\") return [\"home\"];\n  const uids = Object.values(pages)\n    .map((p) => p?.uid)\n    .filter((u): u is string => typeof u === \"string\" && u.length > 0);\n  return uids.length > 0 ? [...new Set(uids)] : [\"home\"];\n}\n\n/** Undici's defaults are 300s headers + 300s body, and the body timeout is an\n *  INACTIVITY timer — so a trickling origin can hold this open for ~10 minutes,\n *  AFTER the GitHub writes and a full Lighthouse audit have already run.\n *\n *  15s is NOT the house number, and this comment used to imply it was by citing\n *  `audits/function-health.ts`, which is 10s. The 15s call sites are\n *  `audits/netlify-deploy.ts`, `github/gh-rest.ts`, `prismic/models/remote.ts`\n *  and the inline ones in `prospect/pipeline.ts` and `prospect/http-probes.ts`;\n *  `audits/function-health.ts`, `audits/form-e2e.ts`, `audits/browser.ts` and\n *  `prospect/dns.ts` are 10s, `prospect/ownership.ts` 12s, `prospect/crawl.ts`\n *  20s. Each is set for its own workload — see the note on PRISMIC_TIMEOUT_MS.\n *  15s here is a bound on a two-request pre-send check, not a convention.\n *\n *  An abort rejects, and dev-guard treats a rejection as a refusal, which is the\n *  correct reading: an origin that will not answer has proved nothing. */\nconst PROBE_TIMEOUT_MS = 15_000;\n\nconst defaultProbe = async (url: string): Promise<{ status: number; body: string }> => {\n  const res = await fetch(url, {\n    redirect: \"follow\",\n    signal: AbortSignal.timeout(PROBE_TIMEOUT_MS),\n  });\n  return { status: res.status, body: await res.text() };\n};\n\n/**\n * Launch a site: bootstrap → first-audit → DRAFT a launch email. The M3\n * approve loop is what actually sends; `launch` never sends — it stops at a\n * dashboard-queued draft (`reportType: \"Launch\"`) carrying the just-audited\n * Lighthouse scores, so `sendOne`'s `report.lighthouse` guard passes.\n *\n * EXECUTION order, stopping on the first error or `failed` recipe:\n *   0. matchingDisposition — filesystem pre-flight, BEFORE any GitHub write.\n *   1. selfUpdating — Renovate + protection (platform auto-merge OFF; ci.yml is the starter's).\n *   2. audit — the Lighthouse scores that feed the draft are collected here.\n *   3. the Websites-row lookup, which supplies the url the next step probes.\n *  3b. dev-guard — the same twin, checked against the DEPLOYED url. It sits\n *      BETWEEN collecting the scores and writing them, so a site that fails it\n *      has been audited but leaves its Websites row untouched.\n *   4. writeAuditsToAirtable — the `audit --write-back` writer.\n *   5. createDraft — reportType \"Launch\", today's period, the audited scores.\n *\n * The REPORTED chain is deliberately not that order. The `audit` step is only\n * pushed once its write succeeds (:261), so the emitted steps read\n * `matching-disposition -> self-updating -> dev-guard -> audit -> draft`, which\n * is what the CLI prints and what tests/recipes/launch.test.ts asserts. Do not\n * renumber either list to match the other: one says when work happens, the\n * other says what has been proved. Only step 0 precedes a GitHub write —\n * dev-guard cannot, because it needs the row from step 3 to know the url.\n */\nexport async function launch(site: Site, deps: LaunchDeps): Promise<LaunchResult> {\n  const label = siteLabel(site);\n  const bootstrap = deps.bootstrap ?? selfUpdating;\n  const audit = deps.audit ?? runAudits;\n  const base = deps.base ?? openBase(readAirtableConfig());\n  const probe = deps.probe ?? defaultProbe;\n\n  const steps: Array<{ name: string; result: LaunchStepResult }> = [];\n  const stop = (): LaunchResult => ({ site: label, steps, complete: false });\n\n  // 0. Matching disposition — filesystem, before any GitHub write.\n  const disposition = await matchingDisposition(site.path);\n  steps.push({\n    name: \"matching-disposition\",\n    result: disposition.ok\n      ? { kind: \"probe\", message: disposition.message }\n      : { kind: \"error\", message: disposition.message },\n  });\n  if (!disposition.ok) return stop();\n\n  // 1. Bootstrap.\n  let recipe: RecipeResult;\n  try {\n    recipe = await bootstrap(site);\n  } catch (err) {\n    steps.push({ name: \"self-updating\", result: errorOf(err) });\n    return stop();\n  }\n  steps.push({ name: \"self-updating\", result: { kind: \"recipe\", result: recipe } });\n  if (recipe.status === \"failed\") return stop();\n\n  // 2. Audit + write scores back to Airtable.\n  let results: AuditResult[];\n  try {\n    results = await audit(site);\n  } catch (err) {\n    steps.push({ name: \"audit\", result: errorOf(err) });\n    return stop();\n  }\n  const lhResult = results.find((r) => r.audit === \"lighthouse\");\n  if (!lhResult || !hasRealScores(lhResult)) {\n    steps.push({\n      name: \"audit\",\n      result: { kind: \"error\", message: \"lighthouse audit produced no real scores\" },\n    });\n    return stop();\n  }\n  // The launch announcement renders a numeric score per category; a metric that\n  // errored this run (now null from lighthouseScoresFromResult) keeps the prior\n  // 0 behavior here rather than propagating null into the launch-email path. The\n  // Airtable write path (write-audits-to-airtable) keeps the null → shows \"—\".\n  const rawScores = lighthouseScoresFromResult(lhResult);\n  const scores: LighthouseScores = {\n    performance: rawScores.performance ?? 0,\n    accessibility: rawScores.accessibility ?? 0,\n    bestPractices: rawScores.bestPractices ?? 0,\n    seo: rawScores.seo ?? 0,\n  };\n\n  const websites = await deps.roster();\n  const target = websites.find((w) => siteSlug(w.name) === siteSlug(label));\n  if (!target) {\n    steps.push({\n      name: \"audit\",\n      result: { kind: \"error\", message: `no site row matched site \"${label}\"` },\n    });\n    return stop();\n  }\n\n  // 2b. The dev guard, on the DEPLOYED build. Two halves, both required:\n  //     /dev/match/home must 404 WITH this site's own error page, and /health\n  //     must answer 200. Without the second, a dead host, a wrong url and a\n  //     parked domain all \"pass\" the first — an absent error granting a green,\n  //     which is the one shape this fleet does not allow. Reading the deployed\n  //     url makes this a production-build check by construction; no local build\n  //     can substitute.\n  //\n  //     The control is /health, NOT a /dev/* route. It used to be\n  //     /dev/a11y-fixtures, which made this gate require an unguarded dev page\n  //     to be publicly reachable in production — so the obvious class-fix for\n  //     \"dev routes ship in production\" (one src/routes/dev/+layout.server.ts\n  //     doing `if (!dev) error(404)`) would have taken the control down with it\n  //     and failed every correctly-guarded site. /health is a real production\n  //     endpoint shipped by the starter and present in all 23 starter-derived\n  //     repos, each declaring `prerender = false` — so a 200 from it is still a\n  //     live render/function path, not a static file served by the CDN.\n  const origin = target.url.replace(/\\/+$/, \"\");\n  const uids = await twinUids(site.path);\n  const twins: Array<{ uid: string; res: { status: number; body: string } }> = [];\n  let control: { status: number; body: string };\n  try {\n    for (const uid of uids) twins.push({ uid, res: await probe(`${origin}/dev/match/${uid}`) });\n    control = await probe(`${origin}/health`);\n  } catch (err) {\n    steps.push({ name: \"dev-guard\", result: errorOf(err) });\n    return stop();\n  }\n  if (control.status !== 200) {\n    steps.push({\n      name: \"dev-guard\",\n      result: {\n        kind: \"error\",\n        message: `${origin}/health answered ${control.status}, not 200 — the twin's 404 proves nothing (host down, wrong url, or the site's /health function is not deploying, in which case the function-health audit is failing too)`,\n      },\n    });\n    return stop();\n  }\n  for (const { uid, res } of twins) {\n    const unguardedTell = res.body.match(UNGUARDED_TWIN_MARKER);\n    if (unguardedTell) {\n      steps.push({\n        name: \"dev-guard\",\n        result: {\n          kind: \"error\",\n          message: `${origin}/dev/match/${uid} answered ${res.status} carrying the twin route's OWN \"${unguardedTell[0]}\" message — the twin is LIVE and merely has no assembly for the uid \"${uid}\". That is not evidence of a dev guard.`,\n        },\n      });\n      return stop();\n    }\n    if (res.status !== 404 || !SITE_404_MARKER.test(res.body)) {\n      steps.push({\n        name: \"dev-guard\",\n        result: {\n          kind: \"error\",\n          message:\n            res.status === 404\n              ? `${origin}/dev/match/${uid} 404s, but not with this site's own error page — cannot tell the guard from a dead route`\n              : `${origin}/dev/match/${uid} answered ${res.status} — the matching twin is live in production`,\n        },\n      });\n      return stop();\n    }\n  }\n  steps.push({\n    name: \"dev-guard\",\n    result: {\n      kind: \"probe\",\n      message: `${uids.map((u) => `${origin}/dev/match/${u}`).join(\", \")} 404 (site error page), /health 200`,\n    },\n  });\n\n  try {\n    const auditWrite = await writeAuditsToAirtable({\n      base,\n      websites,\n      slug: siteSlug(target.name),\n      results,\n    });\n    // #539 Phase 5: mirror the first-audit write-back. Launch is the ONE path\n    // that writes a brand-new site's health, so without this its row reads empty\n    // in the console until the next hourly sync.\n    if (auditWrite.siteId && auditWrite.fields) {\n      await deps.siteMirror?.health(auditWrite.siteId, auditWrite.fields);\n    }\n  } catch (err) {\n    steps.push({ name: \"audit\", result: errorOf(err) });\n    return stop();\n  }\n  steps.push({ name: \"audit\", result: { kind: \"audit\", results, scores } });\n\n  // 3. Draft the launch email (reuses draft.ts's reportId/period scheme). DRAFTS\n  //    ONLY — the M3 approve loop sends it and flips Status on send.\n  const today = new Date();\n  const period = today.toISOString().slice(0, 7);\n  const slug = siteSlug(target.name);\n\n  let report: ReportRow;\n  try {\n    // Re-run dedupe: reuse an existing Launch row for this (site, period) instead\n    // of stacking a second draft. findReportByPeriod is the same idempotency\n    // lookup draft.ts documents (dashboard/digest point lookup).\n    const existing = await findReportForPeriod(deps.reportMirror, target.id, \"Launch\", period);\n    if (existing) {\n      // Reuse path: the row was created on a prior run with THAT run's scores. This\n      // re-run just produced fresh audit scores AND will re-render the preview from\n      // them — so refresh the row's Lighthouse cells (+ Completed on) to match,\n      // otherwise the sent email (which reads the row) ships stale scores. The\n      // create path already writes fresh scores via createDraft.\n      await updateReportScores(base, existing.id, scores, today);\n      // Mirror the same refresh — see the announce reuse path for why.\n      await deps.reportMirror.patch(existing.id, {\n        lighthouse_performance: scores.performance,\n        lighthouse_accessibility: scores.accessibility,\n        lighthouse_best_practices: scores.bestPractices,\n        lighthouse_seo: scores.seo,\n        completed_on: today.toISOString().slice(0, 10),\n      });\n      report = existing;\n    } else {\n      // #646 step 4: minted and written in Turso (`report_<ULID>`). The Airtable\n      // Reports row this replaces is skipped, not written — see `createReportDraft`.\n      report = await createReportDraft(draftInputFor(target, scores, today, period), {\n        create: deps.reportMirror.create,\n      });\n    }\n  } catch (err) {\n    steps.push({ name: \"draft\", result: errorOf(err) });\n    return stop();\n  }\n\n  // Mirror draft.ts:135-154 — render → upload \"Rendered HTML\" preview → flip\n  // Draft ready. Without setDraftReady the draft never enters the approve queue\n  // (every pending-approval gate requires draftReady true), so it can never be\n  // approved or sent. The upload is a review convenience; the ready flag is the\n  // critical step.\n  try {\n    const { html } = await renderReportHtml({\n      siteName: target.name,\n      siteUrl: target.url,\n      reportType: \"Launch\",\n      completedOn: today,\n      lighthouse: scores,\n      lastTestedDate: null,\n      commentary: null,\n      copy: resolveCopy(target),\n      headerImageCid: `${slug}-header`,\n    });\n    // A preview-upload hiccup must NOT fail the launch — log and continue.\n    try {\n      await uploadAttachment(\n        report.id,\n        \"Rendered HTML\",\n        html,\n        `${slug}-${today.toISOString().slice(0, 10)}.html`,\n        \"text/html\",\n      );\n      // The console preview reads the body from Turso, not the attachment.\n      await deps.reportMirror.body(report.id, html);\n    } catch (uploadErr) {\n      console.warn(\n        `⚠ Launch preview upload skipped for ${target.name}: ${\n          uploadErr instanceof Error ? uploadErr.message : String(uploadErr)\n        }`,\n      );\n    }\n    // Critical: NOT wrapped — a failure here must surface as a failed launch. queueDraft\n    // supersedes any lower-tier (Maintenance/Testing) drafts queued for this site; a Launch is\n    // top tier so it only stands down if another Launch/Announcement is already queued.\n    await queueDraft(\n      base,\n      { id: report.id, siteId: target.id, reportType: \"Launch\" },\n      deps.reportMirror,\n    );\n  } catch (err) {\n    steps.push({ name: \"draft\", result: errorOf(err) });\n    return stop();\n  }\n\n  steps.push({ name: \"draft\", result: { kind: \"draft\", report } });\n\n  return { site: label, steps, complete: true };\n}\n\n/** Build the Launch `DraftInput`. reportId/period mirror `draftReportForSite`\n *  (draft.ts) — do not invent a new id scheme. `today`/`period` are threaded in\n *  from `launch()` so a single timestamp drives the render, the draft, the\n *  dedupe lookup, and the preview filename. Launch reports have no period window\n *  and no prior maintenance test, so periodStart/periodEnd/completedOn all\n *  collapse to \"today\" and `lastTestedDate` is null. */\nfunction draftInputFor(\n  target: WebsiteRow,\n  scores: LighthouseScores,\n  today: Date,\n  period: string,\n): DraftInput {\n  const reportType = \"Launch\" as const;\n  const reportId = `${target.name} — ${reportType} — ${today.toISOString().slice(0, 10)}`;\n  return {\n    reportId,\n    siteId: target.id,\n    reportType,\n    period,\n    periodStart: today,\n    periodEnd: today,\n    completedOn: today,\n    lighthouse: scores,\n    lastTestedDate: null,\n  };\n}\n\nfunction errorOf(err: unknown): LaunchStepResult {\n  return { kind: \"error\", message: err instanceof Error ? err.message : String(err) };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,eAAe;;;ACAxB,SAAS,kBAAkB;AAC3B,SAAS,UAAU,eAAe;AAClC,SAAS,YAAY;AAsErB,IAAM,kBAAkB;AAwBjB,IAAM,wBAAwB,IAAI;AAAA,EACvC,GAAG,oBAAoB,QAAQ,uBAAuB,MAAM,CAAC;AAAA,EAC7D;AACF;AAEA,IAAM,kBAAkB;AASxB,IAAM,kBAAkB;AAYxB,IAAM,kBAAkB;AACxB,IAAM,iBAAiB,oBAAI,IAAI;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,SAAS,WAAW,UAAkB,UAA2B;AAC/D,MAAI,aAAa,GAAI,QAAO;AAC5B,MAAI,gBAAgB,KAAK,QAAQ,EAAG,QAAO;AAC3C,SAAO,eAAe,IAAI,QAAQ;AACpC;AAMA,SAAS,SAAS,KAA6C;AAC7D,MAAI,IAAI,IAAI,SAAS;AACrB,SAAO,KAAK,KAAK,KAAK,KAAK,IAAI,CAAC,CAAE,EAAG;AACrC,MAAI,IAAI,EAAG,QAAO,EAAE,MAAM,IAAI,MAAM,GAAG;AACvC,MAAI,IAAI;AACR,SAAO,KAAK,KAAK,gBAAgB,KAAK,IAAI,CAAC,CAAE,EAAG;AAChD,SAAO,EAAE,MAAM,IAAI,CAAC,GAAI,MAAM,IAAI,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;AACxD;AAOA,SAAS,gBAAgB,QAAgB,IAAoB;AAC3D,MAAI,UAAU;AACd,WAAS,IAAI,KAAK,GAAG,IAAI,OAAO,QAAQ,KAAK;AAC3C,UAAM,IAAI,OAAO,CAAC;AAClB,QAAI,MAAM,MAAM;AACd;AACA;AAAA,IACF;AACA,QAAI,MAAM,KAAM,QAAO;AACvB,QAAI,SAAS;AACX,UAAI,MAAM,IAAK,WAAU;AACzB;AAAA,IACF;AACA,QAAI,MAAM,KAAK;AACb,gBAAU;AACV;AAAA,IACF;AACA,QAAI,MAAM,IAAK,QAAO;AAAA,EACxB;AACA,SAAO;AACT;AAcA,SAAS,cAAc,QAAwB;AAC7C,MAAI,MAAM;AACV,WAAS,IAAI,GAAG,IAAI,OAAO,UAAS;AAClC,UAAM,KAAK,OAAO,CAAC;AACnB,UAAM,OAAO,OAAO,IAAI,CAAC;AACzB,QAAI,OAAO,OAAO,SAAS,KAAK;AAC9B,aAAO,IAAI,OAAO,UAAU,OAAO,CAAC,MAAM,KAAM;AAChD;AAAA,IACF;AACA,QAAI,OAAO,OAAO,SAAS,KAAK;AAC9B,WAAK;AACL,aAAO,IAAI,OAAO,UAAU,EAAE,OAAO,CAAC,MAAM,OAAO,OAAO,IAAI,CAAC,MAAM,KAAM;AAC3E,WAAK;AACL;AAAA,IACF;AACA,QAAI,OAAO,KAAK;AACd,YAAM,EAAE,MAAM,KAAK,IAAI,SAAS,GAAG;AACnC,UAAI,WAAW,MAAM,IAAI,GAAG;AAC1B,cAAM,MAAM,gBAAgB,QAAQ,CAAC;AACrC,YAAI,QAAQ,IAAI;AACd,iBAAO,OAAO,MAAM,GAAG,MAAM,CAAC;AAC9B,cAAI,MAAM;AACV;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,OAAO,OAAO,OAAO,OAAO,KAAK;AAC1C,aAAO;AACP;AACA,aAAO,IAAI,OAAO,QAAQ;AACxB,YAAI,OAAO,CAAC,MAAM,MAAM;AACtB,iBAAO,OAAO,MAAM,GAAG,IAAI,CAAC;AAC5B,eAAK;AACL;AAAA,QACF;AACA,eAAO,OAAO,CAAC;AACf;AACA,YAAI,OAAO,IAAI,CAAC,MAAM,GAAI;AAAA,MAC5B;AACA;AAAA,IACF;AACA,WAAO;AACP;AAAA,EACF;AACA,SAAO;AACT;AAaA,SAAS,aAAa,MAAsB;AAC1C,MAAI,MAAM;AACV,WAAS,IAAI,GAAG,IAAI,KAAK,UAAS;AAChC,UAAM,KAAK,KAAK,CAAC;AACjB,QAAI,OAAO,KAAK;AACd,YAAM,EAAE,MAAM,KAAK,IAAI,SAAS,GAAG;AACnC,UAAI,WAAW,MAAM,IAAI,GAAG;AAC1B,cAAM,MAAM,gBAAgB,MAAM,CAAC;AACnC,YAAI,QAAQ,IAAI;AAEd,iBAAO,MAAM,IAAI,OAAO,MAAM,IAAI,CAAC,IAAI;AACvC,cAAI,MAAM;AACV;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,OAAO,OAAO,OAAO,OAAO,KAAK;AAC1C,aAAO;AACP;AACA;AAAA,IACF;AACA,WAAO;AACP;AACA,WAAO,IAAI,KAAK,QAAQ;AACtB,YAAM,IAAI,KAAK,CAAC;AAChB,UAAI,MAAM,MAAM;AACd,eAAO;AACP,aAAK;AACL;AAAA,MACF;AACA;AACA,UAAI,MAAM,IAAI;AACZ,eAAO;AACP;AAAA,MACF;AACA,aAAO,MAAM,OAAO,OAAO;AAAA,IAC7B;AAAA,EACF;AACA,SAAO;AACT;AAQA,SAAS,aAAa,MAAc,MAAsB;AACxD,MAAI,IAAI;AACR,SAAO,IAAI,KAAK,UAAU,KAAK,KAAK,KAAK,CAAC,CAAE,EAAG;AAC/C,QAAM,QAAQ;AACd,MAAI,KAAK,CAAC,MAAM,KAAK;AACnB,QAAIA,SAAQ;AACZ,WAAO,IAAI,KAAK,QAAQ,KAAK;AAC3B,UAAI,KAAK,CAAC,MAAM,IAAK,CAAAA;AAAA,eACZ,KAAK,CAAC,MAAM,OAAO,EAAEA,WAAU,EAAG,QAAO,KAAK,MAAM,OAAO,IAAI,CAAC;AAAA,IAC3E;AACA,WAAO,KAAK,MAAM,KAAK;AAAA,EACzB;AACA,MAAI,QAAQ;AACZ,SAAO,IAAI,KAAK,QAAQ,KAAK;AAC3B,UAAM,KAAK,KAAK,CAAC;AACjB,QAAI,OAAO,OAAO,OAAO,OAAO,OAAO,IAAK;AAAA,aACnC,OAAO,OAAO,OAAO,OAAO,OAAO,KAAK;AAC/C,UAAI,UAAU,EAAG,QAAO,KAAK,MAAM,OAAO,CAAC;AAC3C;AAAA,IACF,WAAW,UAAU,MAAM,OAAO,OAAO,OAAO,MAAO,QAAO,KAAK,MAAM,OAAO,CAAC;AAAA,EACnF;AACA,SAAO,KAAK,MAAM,KAAK;AACzB;AAGA,IAAM,UAAU;AAiBhB,SAAS,aAAa,QAAyB;AAC7C,QAAM,OAAO,cAAc,MAAM;AACjC,MAAI,CAAC,KAAK,SAAS,kBAAkB,EAAG,QAAO;AAC/C,QAAM,SAAS,aAAa,IAAI;AAChC,QAAM,SAAS;AACf,WAAS,IAAI,OAAO,KAAK,MAAM,GAAG,GAAG,IAAI,OAAO,KAAK,MAAM,GAAG;AAC5D,QAAI,QAAQ,KAAK,aAAa,QAAQ,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,CAAC,EAAG,QAAO;AAAA,EACxE;AACA,SAAO;AACT;AAEA,IAAM,gBAAgB;AAOtB,eAAe,gBAAgB,UAAkB,QAAmC;AAClF,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,QAAQ,KAAK,UAAU,MAAM,GAAG,EAAE,eAAe,KAAK,CAAC;AAAA,EACzE,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACA,QAAM,MAAgB,CAAC;AACvB,aAAW,KAAK,SAAS;AACvB,UAAM,MAAM,GAAG,MAAM,IAAI,EAAE,IAAI;AAC/B,QAAI,EAAE,YAAY,EAAG,KAAI,KAAK,GAAI,MAAM,gBAAgB,UAAU,GAAG,CAAE;AAAA,aAC9D,EAAE,KAAK,WAAW,GAAG,EAAG,KAAI,KAAK,GAAG;AAAA,EAC/C;AACA,SAAO;AACT;AAIA,eAAe,QACb,UACA,KACA,OACkB;AAClB,QAAM,MAAM,MAAM,IAAI,GAAG;AACzB,MAAI,QAAQ,OAAW,QAAO;AAC9B,MAAI;AACJ,MAAI;AACF,SAAK,aAAa,MAAM,SAAS,KAAK,UAAU,GAAG,GAAG,OAAO,CAAC;AAAA,EAChE,QAAQ;AACN,SAAK;AAAA,EACP;AACA,QAAM,IAAI,KAAK,EAAE;AACjB,SAAO;AACT;AAiBA,eAAe,eACb,UACA,KACA,OACwB;AACxB,MAAI,IAAI;AACR,aAAS;AACP,UAAM,MAAM,GAAG,CAAC;AAChB,QAAI,MAAM,QAAQ,UAAU,KAAK,KAAK,EAAG,QAAO;AAChD,QAAI,MAAM,cAAe,QAAO;AAChC,UAAM,KAAK,EAAE,MAAM,GAAG,EAAE,YAAY,GAAG,CAAC;AACxC,QAAI,GAAG,SAAS,cAAc,OAAQ,QAAO;AAC7C,QAAI;AAAA,EACN;AACF;AAgBA,eAAsB,oBACpB,UAC2C;AAC3C,MAAI,CAAC,WAAW,KAAK,UAAU,eAAe,CAAC,GAAG;AAChD,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,SAAS,GAAG,QAAQ,WAAW,eAAe;AAAA,IAChD;AAAA,EACF;AACA,MAAI,CAAC,WAAW,KAAK,UAAU,eAAe,CAAC,GAAG;AAChD,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,SAAS,MAAM,eAAe,sBAAsB,eAAe;AAAA,IACrE;AAAA,EACF;AACA,QAAM,QAAQ,MAAM,gBAAgB,UAAU,eAAe;AAC7D,MAAI,MAAM,WAAW,GAAG;AACtB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,SAAS,GAAG,eAAe;AAAA,IAC7B;AAAA,EACF;AAEA,QAAM,QAAQ,oBAAI,IAAqB;AACvC,QAAM,YAAsB,CAAC;AAC7B,QAAM,SAAmB,CAAC;AAK1B,aAAW,MAAM,MAAM,OAAO,CAAC,MAAM,EAAE,SAAS,aAAa,CAAC,GAAG;AAC/D,QAAI,MAAM,QAAQ,UAAU,IAAI,KAAK,EAAG,QAAO,KAAK,EAAE;AAAA;AAEpD,gBAAU;AAAA,QACR,GAAG,EAAE;AAAA,MACP;AAAA,EACJ;AAIA,QAAM,WAAW;AAAA,IACf,GAAG,IAAI;AAAA,MACL,MACG,OAAO,CAAC,MAAM,oCAAoC,KAAK,CAAC,CAAC,EACzD,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,EAAE,YAAY,GAAG,CAAC,CAAC;AAAA,IAC9C;AAAA,EACF;AACA,aAAW,OAAO,UAAU;AAC1B,UAAM,SAAS,MAAM,eAAe,UAAU,KAAK,KAAK;AACxD,QAAI,QAAQ;AACV,aAAO,KAAK,MAAM;AAClB;AAAA,IACF;AACA,UAAM,MAAM,GAAG,GAAG;AAClB,QAAI,MAAM,QAAQ,UAAU,KAAK,KAAK,GAAG;AACvC,aAAO,KAAK,GAAG;AACf;AAAA,IACF;AACA,cAAU,KAAK,GAAG,GAAG,kEAAkE;AAAA,EACzF;AAEA,MAAI,UAAU,SAAS,GAAG;AACxB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,SAAS,GAAG,eAAe,gCAA2B,UAAU,KAAK,IAAI,CAAC;AAAA,IAC5E;AAAA,EACF;AAKA,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,SAAS,qBAAqB,eAAe,0CAAqC,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI,CAAC;AAAA,EACnH;AACF;AAYA,eAAe,SAAS,UAAqC;AAC3D,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,MAAM,SAAS,KAAK,UAAU,qBAAqB,GAAG,OAAO,CAAC;AAAA,EACpF,QAAQ;AACN,WAAO,CAAC,MAAM;AAAA,EAChB;AACA,QAAM,QAAS,QAAiE;AAChF,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO,CAAC,MAAM;AACvD,QAAM,OAAO,OAAO,OAAO,KAAK,EAC7B,IAAI,CAAC,MAAM,GAAG,GAAG,EACjB,OAAO,CAAC,MAAmB,OAAO,MAAM,YAAY,EAAE,SAAS,CAAC;AACnE,SAAO,KAAK,SAAS,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM;AACvD;AAiBA,IAAM,mBAAmB;AAEzB,IAAM,eAAe,OAAO,QAA2D;AACrF,QAAM,MAAM,MAAM,MAAM,KAAK;AAAA,IAC3B,UAAU;AAAA,IACV,QAAQ,YAAY,QAAQ,gBAAgB;AAAA,EAC9C,CAAC;AACD,SAAO,EAAE,QAAQ,IAAI,QAAQ,MAAM,MAAM,IAAI,KAAK,EAAE;AACtD;AA2BA,eAAsB,OAAO,MAAY,MAAyC;AAChF,QAAM,QAAQ,UAAU,IAAI;AAC5B,QAAM,YAAY,KAAK,aAAa;AACpC,QAAM,QAAQ,KAAK,SAAS;AAC5B,QAAM,OAAO,KAAK,QAAQ,SAAS,mBAAmB,CAAC;AACvD,QAAM,QAAQ,KAAK,SAAS;AAE5B,QAAM,QAA2D,CAAC;AAClE,QAAM,OAAO,OAAqB,EAAE,MAAM,OAAO,OAAO,UAAU,MAAM;AAGxE,QAAM,cAAc,MAAM,oBAAoB,KAAK,IAAI;AACvD,QAAM,KAAK;AAAA,IACT,MAAM;AAAA,IACN,QAAQ,YAAY,KAChB,EAAE,MAAM,SAAS,SAAS,YAAY,QAAQ,IAC9C,EAAE,MAAM,SAAS,SAAS,YAAY,QAAQ;AAAA,EACpD,CAAC;AACD,MAAI,CAAC,YAAY,GAAI,QAAO,KAAK;AAGjC,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,UAAU,IAAI;AAAA,EAC/B,SAAS,KAAK;AACZ,UAAM,KAAK,EAAE,MAAM,iBAAiB,QAAQ,QAAQ,GAAG,EAAE,CAAC;AAC1D,WAAO,KAAK;AAAA,EACd;AACA,QAAM,KAAK,EAAE,MAAM,iBAAiB,QAAQ,EAAE,MAAM,UAAU,QAAQ,OAAO,EAAE,CAAC;AAChF,MAAI,OAAO,WAAW,SAAU,QAAO,KAAK;AAG5C,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,MAAM,IAAI;AAAA,EAC5B,SAAS,KAAK;AACZ,UAAM,KAAK,EAAE,MAAM,SAAS,QAAQ,QAAQ,GAAG,EAAE,CAAC;AAClD,WAAO,KAAK;AAAA,EACd;AACA,QAAM,WAAW,QAAQ,KAAK,CAAC,MAAM,EAAE,UAAU,YAAY;AAC7D,MAAI,CAAC,YAAY,CAAC,cAAc,QAAQ,GAAG;AACzC,UAAM,KAAK;AAAA,MACT,MAAM;AAAA,MACN,QAAQ,EAAE,MAAM,SAAS,SAAS,2CAA2C;AAAA,IAC/E,CAAC;AACD,WAAO,KAAK;AAAA,EACd;AAKA,QAAM,YAAY,2BAA2B,QAAQ;AACrD,QAAM,SAA2B;AAAA,IAC/B,aAAa,UAAU,eAAe;AAAA,IACtC,eAAe,UAAU,iBAAiB;AAAA,IAC1C,eAAe,UAAU,iBAAiB;AAAA,IAC1C,KAAK,UAAU,OAAO;AAAA,EACxB;AAEA,QAAM,WAAW,MAAM,KAAK,OAAO;AACnC,QAAM,SAAS,SAAS,KAAK,CAAC,MAAM,SAAS,EAAE,IAAI,MAAM,SAAS,KAAK,CAAC;AACxE,MAAI,CAAC,QAAQ;AACX,UAAM,KAAK;AAAA,MACT,MAAM;AAAA,MACN,QAAQ,EAAE,MAAM,SAAS,SAAS,6BAA6B,KAAK,IAAI;AAAA,IAC1E,CAAC;AACD,WAAO,KAAK;AAAA,EACd;AAmBA,QAAM,SAAS,OAAO,IAAI,QAAQ,QAAQ,EAAE;AAC5C,QAAM,OAAO,MAAM,SAAS,KAAK,IAAI;AACrC,QAAM,QAAuE,CAAC;AAC9E,MAAI;AACJ,MAAI;AACF,eAAW,OAAO,KAAM,OAAM,KAAK,EAAE,KAAK,KAAK,MAAM,MAAM,GAAG,MAAM,cAAc,GAAG,EAAE,EAAE,CAAC;AAC1F,cAAU,MAAM,MAAM,GAAG,MAAM,SAAS;AAAA,EAC1C,SAAS,KAAK;AACZ,UAAM,KAAK,EAAE,MAAM,aAAa,QAAQ,QAAQ,GAAG,EAAE,CAAC;AACtD,WAAO,KAAK;AAAA,EACd;AACA,MAAI,QAAQ,WAAW,KAAK;AAC1B,UAAM,KAAK;AAAA,MACT,MAAM;AAAA,MACN,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,SAAS,GAAG,MAAM,oBAAoB,QAAQ,MAAM;AAAA,MACtD;AAAA,IACF,CAAC;AACD,WAAO,KAAK;AAAA,EACd;AACA,aAAW,EAAE,KAAK,IAAI,KAAK,OAAO;AAChC,UAAM,gBAAgB,IAAI,KAAK,MAAM,qBAAqB;AAC1D,QAAI,eAAe;AACjB,YAAM,KAAK;AAAA,QACT,MAAM;AAAA,QACN,QAAQ;AAAA,UACN,MAAM;AAAA,UACN,SAAS,GAAG,MAAM,cAAc,GAAG,aAAa,IAAI,MAAM,mCAAmC,cAAc,CAAC,CAAC,6EAAwE,GAAG;AAAA,QAC1L;AAAA,MACF,CAAC;AACD,aAAO,KAAK;AAAA,IACd;AACA,QAAI,IAAI,WAAW,OAAO,CAAC,gBAAgB,KAAK,IAAI,IAAI,GAAG;AACzD,YAAM,KAAK;AAAA,QACT,MAAM;AAAA,QACN,QAAQ;AAAA,UACN,MAAM;AAAA,UACN,SACE,IAAI,WAAW,MACX,GAAG,MAAM,cAAc,GAAG,kGAC1B,GAAG,MAAM,cAAc,GAAG,aAAa,IAAI,MAAM;AAAA,QACzD;AAAA,MACF,CAAC;AACD,aAAO,KAAK;AAAA,IACd;AAAA,EACF;AACA,QAAM,KAAK;AAAA,IACT,MAAM;AAAA,IACN,QAAQ;AAAA,MACN,MAAM;AAAA,MACN,SAAS,GAAG,KAAK,IAAI,CAAC,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,KAAK,IAAI,CAAC;AAAA,IACpE;AAAA,EACF,CAAC;AAED,MAAI;AACF,UAAM,aAAa,MAAM,sBAAsB;AAAA,MAC7C;AAAA,MACA;AAAA,MACA,MAAM,SAAS,OAAO,IAAI;AAAA,MAC1B;AAAA,IACF,CAAC;AAID,QAAI,WAAW,UAAU,WAAW,QAAQ;AAC1C,YAAM,KAAK,YAAY,OAAO,WAAW,QAAQ,WAAW,MAAM;AAAA,IACpE;AAAA,EACF,SAAS,KAAK;AACZ,UAAM,KAAK,EAAE,MAAM,SAAS,QAAQ,QAAQ,GAAG,EAAE,CAAC;AAClD,WAAO,KAAK;AAAA,EACd;AACA,QAAM,KAAK,EAAE,MAAM,SAAS,QAAQ,EAAE,MAAM,SAAS,SAAS,OAAO,EAAE,CAAC;AAIxE,QAAM,QAAQ,oBAAI,KAAK;AACvB,QAAM,SAAS,MAAM,YAAY,EAAE,MAAM,GAAG,CAAC;AAC7C,QAAM,OAAO,SAAS,OAAO,IAAI;AAEjC,MAAI;AACJ,MAAI;AAIF,UAAM,WAAW,MAAM,oBAAoB,KAAK,cAAc,OAAO,IAAI,UAAU,MAAM;AACzF,QAAI,UAAU;AAMZ,YAAM,mBAAmB,MAAM,SAAS,IAAI,QAAQ,KAAK;AAEzD,YAAM,KAAK,aAAa,MAAM,SAAS,IAAI;AAAA,QACzC,wBAAwB,OAAO;AAAA,QAC/B,0BAA0B,OAAO;AAAA,QACjC,2BAA2B,OAAO;AAAA,QAClC,gBAAgB,OAAO;AAAA,QACvB,cAAc,MAAM,YAAY,EAAE,MAAM,GAAG,EAAE;AAAA,MAC/C,CAAC;AACD,eAAS;AAAA,IACX,OAAO;AAGL,eAAS,MAAM,kBAAkB,cAAc,QAAQ,QAAQ,OAAO,MAAM,GAAG;AAAA,QAC7E,QAAQ,KAAK,aAAa;AAAA,MAC5B,CAAC;AAAA,IACH;AAAA,EACF,SAAS,KAAK;AACZ,UAAM,KAAK,EAAE,MAAM,SAAS,QAAQ,QAAQ,GAAG,EAAE,CAAC;AAClD,WAAO,KAAK;AAAA,EACd;AAOA,MAAI;AACF,UAAM,EAAE,KAAK,IAAI,MAAM,iBAAiB;AAAA,MACtC,UAAU,OAAO;AAAA,MACjB,SAAS,OAAO;AAAA,MAChB,YAAY;AAAA,MACZ,aAAa;AAAA,MACb,YAAY;AAAA,MACZ,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,MAAM,YAAY,MAAM;AAAA,MACxB,gBAAgB,GAAG,IAAI;AAAA,IACzB,CAAC;AAED,QAAI;AACF,YAAM;AAAA,QACJ,OAAO;AAAA,QACP;AAAA,QACA;AAAA,QACA,GAAG,IAAI,IAAI,MAAM,YAAY,EAAE,MAAM,GAAG,EAAE,CAAC;AAAA,QAC3C;AAAA,MACF;AAEA,YAAM,KAAK,aAAa,KAAK,OAAO,IAAI,IAAI;AAAA,IAC9C,SAAS,WAAW;AAClB,cAAQ;AAAA,QACN,4CAAuC,OAAO,IAAI,KAChD,qBAAqB,QAAQ,UAAU,UAAU,OAAO,SAAS,CACnE;AAAA,MACF;AAAA,IACF;AAIA,UAAM;AAAA,MACJ;AAAA,MACA,EAAE,IAAI,OAAO,IAAI,QAAQ,OAAO,IAAI,YAAY,SAAS;AAAA,MACzD,KAAK;AAAA,IACP;AAAA,EACF,SAAS,KAAK;AACZ,UAAM,KAAK,EAAE,MAAM,SAAS,QAAQ,QAAQ,GAAG,EAAE,CAAC;AAClD,WAAO,KAAK;AAAA,EACd;AAEA,QAAM,KAAK,EAAE,MAAM,SAAS,QAAQ,EAAE,MAAM,SAAS,OAAO,EAAE,CAAC;AAE/D,SAAO,EAAE,MAAM,OAAO,OAAO,UAAU,KAAK;AAC9C;AAQA,SAAS,cACP,QACA,QACA,OACA,QACY;AACZ,QAAM,aAAa;AACnB,QAAM,WAAW,GAAG,OAAO,IAAI,WAAM,UAAU,WAAM,MAAM,YAAY,EAAE,MAAM,GAAG,EAAE,CAAC;AACrF,SAAO;AAAA,IACL;AAAA,IACA,QAAQ,OAAO;AAAA,IACf;AAAA,IACA;AAAA,IACA,aAAa;AAAA,IACb,WAAW;AAAA,IACX,aAAa;AAAA,IACb,YAAY;AAAA,IACZ,gBAAgB;AAAA,EAClB;AACF;AAEA,SAAS,QAAQ,KAAgC;AAC/C,SAAO,EAAE,MAAM,SAAS,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,EAAE;AACpF;;;ADp2BO,SAAS,WAAW,MAAc,GAA6B;AACpE,MAAI,EAAE,SAAS,QAAS,QAAO,GAAG,KAAK,OAAO,EAAE,CAAC,WAAW,EAAE,OAAO;AACrE,MAAI,EAAE,SAAS,SAAS;AACtB,UAAM,IAAI,EAAE;AACZ,WAAO,GAAG,KAAK,OAAO,EAAE,CAAC,eAAe,EAAE,WAAW,MAAM,EAAE,aAAa,OAAO,EAAE,aAAa,QAAQ,EAAE,GAAG;AAAA,EAC/G;AACA,MAAI,EAAE,SAAS,SAAS;AACtB,WAAO,GAAG,KAAK,OAAO,EAAE,CAAC,YAAY,EAAE,OAAO,QAAQ;AAAA,EACxD;AACA,MAAI,EAAE,SAAS,QAAS,QAAO,GAAG,KAAK,OAAO,EAAE,CAAC,cAAS,EAAE,OAAO;AACnE,QAAM,MAAM,EAAE;AACd,MAAI,IAAI,WAAW,OAAQ,QAAO,GAAG,KAAK,OAAO,EAAE,CAAC,QAAQ,IAAI,QAAQ,WAAM,IAAI,KAAK,KAAK,EAAE;AAC9F,MAAI,IAAI,WAAW;AACjB,WAAO,GAAG,KAAK,OAAO,EAAE,CAAC,UAAU,IAAI,QAAQ,WAAM,IAAI,KAAK,KAAK,EAAE;AACvE,SAAO,GAAG,KAAK,OAAO,EAAE,CAAC,aAAa,IAAI,QAAQ,MAAM,UAAU,IAAI,QAAQ,WAAW,IAAI,KAAK,GAAG,IAAI,IAAI,QAAQ,WAAM,IAAI,KAAK,KAAK,EAAE;AAC7I;AAEA,SAAS,aAAa,GAAyB;AAC7C,QAAM,SAAS,IAAI,EAAE,IAAI,mBAAc,EAAE,WAAW,gCAAgC,SAAS;AAC7F,QAAM,OAAO,EAAE,MAAM,IAAI,CAAC,MAAM,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,KAAK,IAAI;AACvE,SAAO,GAAG,MAAM;AAAA,EAAK,IAAI;AAC3B;AAQA,eAAsB,iBACpB,MACA,MAC2C;AAC3C,QAAM,MAAM,KAAK,MAAM,QAAQ,KAAK,GAAG,IAAI,QAAQ,IAAI;AACvD,QAAM,QAAQ,MAAM,aAAa,EAAE,MAAM,IAAI,CAAC;AAC9C,QAAM,SAAS,MAAM,CAAC;AACtB,MAAI,CAAC,QAAQ;AACX,WAAO,EAAE,QAAQ,yBAAyB,IAAI,MAAM,MAAM,EAAE;AAAA,EAC9D;AAIA,QAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,6BAAgC;AAC1E,QAAM,EAAE,eAAe,IAAI,MAAM,OAAO,2BAAyB;AAGjE,QAAM,EAAE,gBAAgB,IAAI,MAAM,OAAO,sBAAuB;AAChE,QAAM,SAAS,MAAM,OAAO,QAAQ;AAAA,IAClC,QAAQ,MAAM,gBAAgB;AAAA,IAC9B,cAAc,MAAM,iBAAiB;AAAA,IACrC,YAAY,MAAM,eAAe;AAAA,EACnC,CAAC;AACD,SAAO,EAAE,QAAQ,aAAa,MAAM,GAAG,MAAM,OAAO,WAAW,IAAI,EAAE;AACvE;","names":["depth"]}

package/dist/{lighthouse-VHI77PFB.js → lighthouse-52WSPZ5D.js}

@@ -1,6 +1,6 @@
 import {
   lighthouseAudit
-} from "./chunk-2NQUCS7O.js";
+} from "./chunk-BIYQN7FH.js";
 import "./chunk-PTDMVGKL.js";
 import "./chunk-LBYOLBW7.js";
 import "./chunk-XXTZBPUY.js";
@@ -8,4 +8,4 @@ import "./chunk-NMAWXBJA.js";
 export {
   lighthouseAudit
 };
-//# sourceMappingURL=lighthouse-VHI77PFB.js.map
+//# sourceMappingURL=lighthouse-52WSPZ5D.js.map

package/dist/lighthouse-airtable-M45OPVRV.js

@@ -0,0 +1,14 @@
+import {
+  hasRealScores,
+  lighthouseScoresFromResult,
+  resolveSlugFromCwd
+} from "./chunk-X56LAKPR.js";
+import "./chunk-TC4GANMX.js";
+import "./chunk-ICSRWW5Q.js";
+import "./chunk-RQJFGK3A.js";
+export {
+  hasRealScores,
+  lighthouseScoresFromResult,
+  resolveSlugFromCwd
+};
+//# sourceMappingURL=lighthouse-airtable-M45OPVRV.js.map

package/dist/match-harness-GBCDSVPS.js

@@ -0,0 +1,417 @@
+import {
+  CLAUDE_MD_BLOCK,
+  CLAUDE_MD_MARKER,
+  GITIGNORE_BLOCK,
+  GITIGNORE_MARKER,
+  HARNESS_JSON_RELATIVE,
+  MATCH_HARNESS_COUPLED,
+  MATCH_HARNESS_FILES,
+  MATCH_HARNESS_PREVIOUS,
+  PRETTIERIGNORE_BLOCK,
+  PRETTIERIGNORE_MARKER
+} from "./chunk-Y6FCXRIC.js";
+import {
+  runRecipeOverSites
+} from "./chunk-VPJ7N6P7.js";
+import {
+  appendSkipNotice,
+  fleetWorkdir,
+  prepareFleetSites
+} from "./chunk-DYTYPKFN.js";
+import {
+  resolveSites
+} from "./chunk-FP6HOW6J.js";
+import {
+  PRETTIER_FLAG_NOTE,
+  formatWithPrettier,
+  resolveTargetPrettier
+} from "./chunk-5CJVUPJU.js";
+import {
+  withRecipe
+} from "./chunk-LUF52EIY.js";
+import "./chunk-Z3JXLULD.js";
+import {
+  defaultSpawn
+} from "./chunk-LBYOLBW7.js";
+import "./chunk-RARREDQE.js";
+import "./chunk-XXTZBPUY.js";
+import {
+  ignoreRulesFor,
+  pathsMissingFromHead
+} from "./chunk-WMF5S2MB.js";
+
+// src/cli/commands/match-harness.ts
+import { resolve } from "path";
+
+// src/recipes/match-harness/index.ts
+import { mkdir, readFile, rm, rmdir, writeFile } from "fs/promises";
+import { dirname, join } from "path";
+
+// src/recipes/match-harness/previous.ts
+var CLAUDE_MD_BLOCK_0_95_1 = `
+The \`matching-a-page\` skill governs a live-reference rebuild. These five rules
+exist because the skill alone did not hold on the project this harness came
+from \u2014 each one is a drift that actually happened, with the mechanical check
+that now catches it. \`matching/harness.json\` is this site's configuration;
+\`matching/LEDGER.md\` is the dated record of every deviation, floor and mask.
+
+### 1. Source prescribes, rects only verify
+
+Every geometry fix must cite the rule it came from: a line in the captured
+reference stylesheet under \`matching/spec/\`, or the reference's HTML. "The probe
+says the gap is 40px" is not a source. If you cannot name the line you are
+guessing \u2014 go read the stylesheet first.
+
+**Check:** the commit body must name the file:line for each fix.
+**Operator's challenge:** _"which line of the reference stylesheet says that?"_
+
+### 2. Phase 1 before Phase 4
+
+A page gets its section census and per-section spec in \`matching/SPEC.md\` BEFORE
+its geometry is touched. No SPEC section, no geometry round. The census is the
+coverage denominator; skipping it is how a reference's root-font ladder and its
+per-component height ladders get discovered reactively, after the region has
+already failed several rounds.
+
+**Check:** \`matching/gate.sh\` refuses to run a page with no \`SPEC.md\` section.
+**Operator's challenge:** _"show me the SPEC section for that region."_
+
+### 3. Three strikes, then stop
+
+A failing region that has not improved across 3+ gate runs does not get a fourth
+attempt. Present the attempts. Never widen the threshold, add a mask, or
+reclassify it as a floor to make it go away.
+
+**Check:** \`node matching/strikes.mjs <page>\` \u2014 exits 1 while any region is
+stalled, and is the first thing a geometry round runs.
+**Operator's challenge:** _"how many runs has that region been flat?"_
+
+### 4. A gate closes an item, nothing else
+
+No fix is "done" because the code changed. Paste the gate header \u2014 it is
+self-describing, so a nonstandard threshold or an undisclosed mask is visible.
+The threshold and the matrix are whatever \`matching/harness.json\` says, on every
+page, never a subset.
+
+**Operator's challenge:** _"paste the gate header."_
+
+### 5. A commit is a checkpoint, not a stopping point
+
+Do not hand control back between rounds. After committing, run
+\`node matching/next.mjs\`: while it exits 1 there is a named next action, and the
+round continues. Report when the backlog is empty, when a decision is genuinely
+the operator's (three strikes, a novel floor, a threshold change), or when
+asked \u2014 not because a commit felt like a natural place to summarise.
+
+This exists because the failure was habitual, not deliberate: a turn ends when
+user-facing prose gets written, and "I just committed something good" is the
+moment that invites writing it. The gate stops incorrect work; this stops
+premature stopping.
+
+**Pausing:** create \`matching/PAUSED\` holding a note that says what the pause
+means; \`next.mjs\` and \`strikes.mjs\` then exit 0 while it exists. This rule says
+"do not stop while work is named"; it never said "find work to name". An empty
+agenda and a paused one end the round the same way. Deleting the switch is the
+operator's call.
+
+**Check:** \`node matching/next.mjs\` \u2014 exits 1 while any non-floor region fails.
+**Operator's challenge:** _"what does next.mjs say?"_
+
+### Round protocol
+
+1. \`node matching/strikes.mjs <page>\` \u2014 if it exits 1, the stalled regions are
+   the agenda, and stalled ones get escalated rather than re-attempted.
+2. Confirm the page has a \`matching/SPEC.md\` section; write
+   \`matching/spec-sections/<page>.md\` and run \`node matching/build-spec.mjs\` if
+   not.
+3. Fix, each change citing its source line.
+4. \`bash matching/gate.sh <tag> <page>\` \u2014 paste the header.
+5. Append to \`matching/LEDGER.md\` at the moment a deviation, floor or mask is
+   decided, not reconstructed at the end.
+6. \`pnpm verify\`, then commit and push.
+`;
+var MATCH_HARNESS_BLOCK_PREVIOUS = {
+  "CLAUDE.md": [CLAUDE_MD_BLOCK_0_95_1]
+};
+
+// src/recipes/match-harness/index.ts
+var PRETTIER_TIMEOUT_MS = 6e4;
+async function readIfExists(path) {
+  try {
+    return await readFile(path, "utf-8");
+  } catch {
+    return null;
+  }
+}
+function normalize(s) {
+  return s.replace(/\r\n/g, "\n").replace(/[ \t]+$/gm, "").trim();
+}
+function planBlockWrite(existing, marker, endMarker, block, previous) {
+  const region = `${marker}
+${block}
+${endMarker}`;
+  if (existing === null) return { action: "write", content: `${region}
+` };
+  const start = existing.indexOf(marker);
+  if (start === -1) {
+    const base = existing.endsWith("\n") ? existing : `${existing}
+`;
+    return { action: "write", content: `${base}
+${region}
+` };
+  }
+  const head = existing.slice(0, start);
+  const bodyStart = start + marker.length + 1;
+  const endAt = existing.indexOf(endMarker, bodyStart);
+  if (endAt !== -1) {
+    const body = existing.slice(bodyStart, endAt);
+    if (normalize(body) === normalize(block)) return { action: "skip" };
+    if (previous.some((p) => normalize(body) === normalize(p)))
+      return {
+        action: "replace",
+        content: head + region + existing.slice(endAt + endMarker.length)
+      };
+    return { action: "flag" };
+  }
+  for (const candidate of [block, ...previous]) {
+    if (!existing.startsWith(candidate, bodyStart)) continue;
+    const content = `${head}${region}
+${existing.slice(bodyStart + candidate.length)}`;
+    return candidate === block ? { action: "terminate", content } : { action: "replace", content };
+  }
+  return { action: "flag" };
+}
+function commitMessage(installed, upgraded) {
+  const what = "(/dev/match route + matching/ gate scripts)";
+  if (upgraded.length === 0) return `feat: install the matching harness ${what}`;
+  const subject = installed.length > 0 ? `feat: install and upgrade the matching harness ${what}` : `chore: upgrade the matching harness (${upgraded.length} file${upgraded.length === 1 ? "" : "s"} from a previously shipped version)`;
+  const body = [
+    installed.length > 0 ? `installed: ${installed.join(", ")}` : "",
+    `upgraded from a previously shipped version: ${upgraded.join(", ")}`
+  ].filter(Boolean).join("\n");
+  return `${subject}
+
+${body}`;
+}
+function planFileWrite(existing, template, owner, previous) {
+  if (existing === null) return "write";
+  if (normalize(existing) === normalize(template)) return "skip";
+  if (owner === "site") return "skip";
+  if (previous.some((p) => normalize(existing) === normalize(p))) return "replace";
+  return "flag";
+}
+var GITIGNORE_END_MARKER = "# end reddoor-maint match-harness";
+var PRETTIERIGNORE_END_MARKER = "# end reddoor-maint match-harness";
+var CLAUDE_MD_END_MARKER = "<!-- end reddoor-maint match-harness -->";
+var APPENDED_BLOCKS = [
+  [".gitignore", GITIGNORE_MARKER, GITIGNORE_END_MARKER, GITIGNORE_BLOCK],
+  [".prettierignore", PRETTIERIGNORE_MARKER, PRETTIERIGNORE_END_MARKER, PRETTIERIGNORE_BLOCK],
+  ["CLAUDE.md", CLAUDE_MD_MARKER, CLAUDE_MD_END_MARKER, CLAUDE_MD_BLOCK]
+];
+var MATCH_HARNESS_INSTALLED_PATHS = [
+  ...MATCH_HARNESS_FILES.map((f) => f.rel),
+  ...APPENDED_BLOCKS.map(([rel]) => rel)
+];
+async function matchHarness(site, opts, deps = { spawn: defaultSpawn }) {
+  return withRecipe({
+    name: "match-harness",
+    site,
+    plan: async () => {
+      if (!opts.ref || !/^https?:\/\//.test(opts.ref)) {
+        return {
+          kind: "failed",
+          notes: "--ref <url> is required: the harness gates against a live reference, and a harness with no reference can only ever report an absence of errors"
+        };
+      }
+      return {
+        kind: "apply",
+        plan: {
+          ref: opts.ref.replace(/\/$/, ""),
+          cand: opts.cand ?? "http://localhost:5173",
+          matrix: opts.matrix ?? [1440, 834, 390]
+        }
+      };
+    },
+    apply: async (planned, { commit, cwd }) => {
+      const notes = [];
+      const written = [];
+      const installed = [];
+      const upgraded = [];
+      const before = /* @__PURE__ */ new Map();
+      const previousAll = deps.previous ?? MATCH_HARNESS_PREVIOUS;
+      const blockPreviousAll = deps.blockPrevious ?? MATCH_HARNESS_BLOCK_PREVIOUS;
+      const plans = [];
+      for (const f of MATCH_HARNESS_FILES) {
+        const target = join(cwd, f.rel);
+        let template = f.template;
+        if (f.rel === HARNESS_JSON_RELATIVE) {
+          const seed = JSON.parse(template);
+          seed.ref = planned.ref;
+          seed.cand = planned.cand;
+          seed.matrix = planned.matrix;
+          template = JSON.stringify(seed, null, 2) + "\n";
+        }
+        const existing = await readIfExists(target);
+        plans.push({
+          f,
+          template,
+          existing,
+          action: planFileWrite(existing, template, f.owner, previousAll[f.rel] ?? [])
+        });
+      }
+      const coupled = new Set(MATCH_HARNESS_COUPLED);
+      const blockedBy = plans.filter((p) => coupled.has(p.f.rel) && p.action === "flag").map((p) => p.f.rel);
+      const demoted = plans.filter(
+        (p) => coupled.has(p.f.rel) && p.action === "replace" && !blockedBy.includes(p.f.rel)
+      );
+      if (blockedBy.length > 0 && demoted.length > 0) {
+        for (const p of demoted) p.action = "flag";
+        notes.push(
+          `${blockedBy.join(", ")} differs from the shipped template, so the whole coupled set was left alone: ${MATCH_HARNESS_COUPLED.join(", ")} upgrade together. matching/gate.sh calls \`harness.mjs --check-run\` and matching/next.mjs imports from harness.mjs, so upgrading one without the others leaves a harness that cannot run.`
+        );
+      }
+      const demotedRels = new Set(demoted.map((p) => p.f.rel));
+      for (const { f, template, existing, action } of plans) {
+        if (action === "flag") {
+          if (demotedRels.has(f.rel)) continue;
+          notes.push(
+            `${f.rel} differs from the shipped template and was left alone (hand-edited?)`
+          );
+          continue;
+        }
+        if (action === "skip") continue;
+        const target = join(cwd, f.rel);
+        await mkdir(dirname(target), { recursive: true });
+        before.set(f.rel, existing);
+        await writeFile(target, template, "utf-8");
+        written.push(f.rel);
+        (action === "write" ? installed : upgraded).push(f.rel);
+        if (action === "replace") notes.push(`${f.rel} upgraded from a previous version`);
+      }
+      for (const [rel, marker, endMarker, block] of APPENDED_BLOCKS) {
+        const path = join(cwd, rel);
+        const existing = await readIfExists(path);
+        const plan = planBlockWrite(
+          existing,
+          marker,
+          endMarker,
+          block,
+          blockPreviousAll[rel] ?? []
+        );
+        if (plan.action === "skip") continue;
+        if (plan.action === "flag") {
+          notes.push(
+            `${rel} carries a match-harness block that differs from every block this recipe has shipped, and was left alone (hand-edited?)`
+          );
+          continue;
+        }
+        before.set(rel, existing);
+        await writeFile(path, plan.content, "utf-8");
+        written.push(rel);
+        (plan.action === "write" ? installed : upgraded).push(`${rel} (match-harness block)`);
+        if (plan.action === "replace")
+          notes.push(`${rel}'s match-harness block upgraded from a previous version`);
+        if (plan.action === "terminate")
+          notes.push(
+            `${rel}'s match-harness block region was terminated so a future version can update it`
+          );
+      }
+      const siteOwned = new Set(
+        MATCH_HARNESS_FILES.filter((f) => f.owner === "site").map((f) => f.rel)
+      );
+      const toFormat = written.filter((p) => siteOwned.has(p) || p === "CLAUDE.md");
+      if (toFormat.length > 0) {
+        const bin = await (deps.resolvePrettier ?? resolveTargetPrettier)(cwd);
+        if (bin === null) {
+          notes.push(PRETTIER_FLAG_NOTE);
+        } else if (!await formatWithPrettier(deps.spawn, cwd, toFormat, {
+          bin,
+          timeoutMs: PRETTIER_TIMEOUT_MS
+        })) {
+          notes.push(PRETTIER_FLAG_NOTE);
+        }
+      }
+      await commit(commitMessage(installed, upgraded));
+      const missing = await pathsMissingFromHead(cwd, MATCH_HARNESS_INSTALLED_PATHS);
+      if (missing.length > 0) {
+        const rules = await ignoreRulesFor(cwd, missing);
+        const sources = [...new Set(rules.map((r) => r.split("	")[0]))];
+        const explained = new Set(rules.map((r) => r.split("	")[1] ?? ""));
+        const unexplained = missing.filter((p) => !explained.has(p));
+        const removed = [];
+        for (const rel of written.filter((p) => missing.includes(p))) {
+          const prev = before.get(rel);
+          if (prev === void 0) continue;
+          if (prev === null) {
+            await rm(join(cwd, rel), { force: true });
+            removed.push(rel);
+          } else {
+            await writeFile(join(cwd, rel), prev, "utf-8");
+          }
+        }
+        for (const d of [...new Set(removed.map(dirname))].sort((a, b) => b.length - a.length)) {
+          if (d !== ".") await rmdir(join(cwd, d)).catch(() => void 0);
+        }
+        return {
+          kind: "failed",
+          notes: `the harness was NOT installed: ${missing.length} of ${MATCH_HARNESS_INSTALLED_PATHS.length} paths git refused to track, so a fresh clone, CI and the next agent get a harness that does not exist. Absent from the commit: ${missing.join(", ")}. ` + (sources.length > 0 ? `Excluded by ${sources.join(", ")} \u2014 narrow or remove those rules and re-run. ` : "") + (unexplained.length > 0 ? `No ignore rule matched ${unexplained.join(", ")} \u2014 check .git/info/exclude, core.excludesFile, and whether the directory is a nested repository. ` : "") + "Everything this run wrote to those paths has been put back as it was."
+        };
+      }
+      return notes.length > 0 ? { kind: "ok", notes: notes.join("; ") } : { kind: "ok" };
+    }
+  });
+}
+
+// src/cli/commands/match-harness.ts
+function formatResult(r) {
+  if (r.status === "noop") return `[${r.site}] noop: ${r.notes ?? ""}`;
+  if (r.status === "failed") return `[${r.site}] failed: ${r.notes ?? ""}`;
+  return `[${r.site}] applied: ${r.commits.length} commit(s)
+${r.notes ?? ""}`;
+}
+async function runMatchHarnessCommand(site, opts) {
+  const cwd = opts.cwd ? resolve(opts.cwd) : process.cwd();
+  let sites = await resolveSites({
+    ...site !== void 0 ? { site } : {},
+    ...opts.fleet !== void 0 ? { fleet: opts.fleet } : {},
+    ...opts.workdir !== void 0 ? { workdir: opts.workdir } : {},
+    cwd
+  });
+  if (sites.length === 0) {
+    return {
+      output: `the inventory resolved NO SITES, so the matching harness was installed nowhere. This is not an installed fleet \u2014 check the inventory (an Airtable view filter, an empty JSON file, a dynamic inventory returning []). Do NOT read this exit as a rollout.`,
+      code: 1
+    };
+  }
+  let skipped = [];
+  if (opts.fleet) {
+    const workdir = opts.workdir ?? fleetWorkdir();
+    const prep = await prepareFleetSites(sites, { workdir });
+    sites = prep.prepared;
+    skipped = prep.skipped;
+  }
+  const rawMatrix = opts.matrix === void 0 ? void 0 : String(opts.matrix);
+  const matrix = rawMatrix === void 0 ? void 0 : rawMatrix.split(",").map((v) => Number(v.trim()));
+  if (matrix !== void 0 && matrix.some((v) => !Number.isFinite(v) || v <= 0)) {
+    return {
+      output: `match-harness: --matrix "${rawMatrix}" is not a list of viewports`,
+      code: 1
+    };
+  }
+  const results = await runRecipeOverSites(
+    "match-harness",
+    sites,
+    (s) => matchHarness(s, {
+      ref: opts.ref ?? "",
+      ...opts.cand !== void 0 ? { cand: opts.cand } : {},
+      ...matrix !== void 0 ? { matrix } : {}
+    })
+  );
+  const output = results.map(formatResult).join("\n");
+  const code = results.some((r) => r.status === "failed") ? 1 : 0;
+  return { output: appendSkipNotice(output, skipped), code };
+}
+export {
+  runMatchHarnessCommand
+};
+//# sourceMappingURL=match-harness-GBCDSVPS.js.map