@reddoorla/maintenance 0.95.1 → 0.97.0

package/dist/{chunk-2NQUCS7O.js.map → chunk-BIYQN7FH.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/audits/lighthouse.ts","../src/audits/util/site-config.ts"],"sourcesContent":["import { readFile, writeFile, mkdtemp, rm, readdir } from \"node:fs/promises\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport type { AuditResult, Site } from \"../types.js\";\nimport { siteLabel } from \"../util/site.js\";\nimport { lighthouseConfig } from \"../configs/lighthouse.js\";\nimport { defaultSpawn } from \"./util/spawn.js\";\nimport type { SpawnFn, SpawnResult } from \"./util/spawn.js\";\nimport type { AuditContext } from \"./util/inject.js\";\nimport { readSiteConfig } from \"./util/site-config.js\";\nimport { findFreePort, withFreePort } from \"../util/free-port.js\";\n\ntype ManifestEntry = {\n  url: string;\n  summary: Record<string, number>;\n  htmlPath?: string;\n  jsonPath?: string;\n};\n\ntype AssertionResult = {\n  name: string;\n  actual: number;\n  expected: number;\n  operator: string;\n  passed: boolean;\n  level: \"warn\" | \"error\";\n  auditProperty?: string;\n  auditId?: string;\n};\n\ntype NormalizedLhciResult = {\n  summary: Record<string, number>;\n  assertionsFailed: number;\n  assertions: Array<{ category: string; level: \"warn\" | \"error\"; message: string }>;\n};\n\nasync function readJsonMaybe<T>(path: string): Promise<T | null> {\n  try {\n    const raw = await readFile(path, \"utf-8\");\n    return JSON.parse(raw) as T;\n  } catch {\n    return null;\n  }\n}\n\ntype LhrFile = {\n  requestedUrl: string;\n  finalUrl?: string;\n  categories: Record<string, { score: number | null }>;\n};\n\n/**\n * Build manifest-equivalent entries by scanning the `.lighthouseci/` dir\n * for `lhr-*.json` files written by `lhci collect`. We used to read\n * `manifest.json` directly, but lhci 0.15+ no longer writes it — the\n * audit would silently return \"no manifest written\" against a perfectly\n * healthy run. Reproduced on caltex 2026-05-28 (0.10.5 dogfood).\n */\nasync function readLhrEntries(resultsDir: string): Promise<ManifestEntry[]> {\n  const files = await readdir(resultsDir).catch(() => [] as string[]);\n  const entries: ManifestEntry[] = [];\n  for (const f of files) {\n    if (!f.startsWith(\"lhr-\") || !f.endsWith(\".json\")) continue;\n    const lhr = await readJsonMaybe<LhrFile>(join(resultsDir, f));\n    if (!lhr || !lhr.categories) continue;\n    const summary: Record<string, number> = {};\n    for (const [k, v] of Object.entries(lhr.categories)) {\n      if (typeof v?.score === \"number\") summary[k] = v.score;\n    }\n    entries.push({ url: lhr.requestedUrl, summary });\n  }\n  return entries;\n}\n\nfunction averageSummaries(entries: ManifestEntry[]): Record<string, number> {\n  if (entries.length === 0) return {};\n  const sums: Record<string, number> = {};\n  const counts: Record<string, number> = {};\n  for (const e of entries) {\n    for (const [k, v] of Object.entries(e.summary ?? {})) {\n      if (typeof v !== \"number\") continue;\n      sums[k] = (sums[k] ?? 0) + v;\n      counts[k] = (counts[k] ?? 0) + 1;\n    }\n  }\n  const out: Record<string, number> = {};\n  for (const k of Object.keys(sums)) {\n    const total = sums[k] ?? 0;\n    const count = counts[k] ?? 1;\n    out[k] = total / count;\n  }\n  return out;\n}\n\nfunction categoryFromAssertion(a: AssertionResult): string {\n  // `name` looks like \"categories:accessibility\" or \"audits:uses-http2\".\n  const colonIdx = a.name.indexOf(\":\");\n  return colonIdx >= 0 ? a.name.slice(colonIdx + 1) : a.name;\n}\n\nfunction messageForAssertion(a: AssertionResult): string {\n  // `a.actual` is parsed from external lhci/Lighthouse JSON; a malformed or\n  // missing value (not a number) would make `.toFixed` throw and crash the whole\n  // audit. Guard it and fall back to a readable string instead.\n  const actual = typeof a.actual === \"number\" ? a.actual.toFixed(2) : \"n/a\";\n  return `${a.name} ${a.operator} ${a.expected} (actual: ${actual})`;\n}\n\n/** Shared tail: scan `.lighthouseci/` for lhr-*.json + assertion-results.json and\n *  build the AuditResult. Identical for the checkout and deployed paths. */\nasync function parseLhciResults(\n  resultsDir: string,\n  label: string,\n  raw: SpawnResult,\n): Promise<AuditResult> {\n  const manifest = await readLhrEntries(resultsDir);\n\n  if (manifest.length === 0) {\n    return {\n      audit: \"lighthouse\",\n      site: label,\n      status: \"fail\",\n      summary: `lighthouse: no lhr-*.json written (exit ${raw.code})${\n        raw.stderr ? ` — ${raw.stderr.slice(0, 200)}` : \"\"\n      }`,\n    };\n  }\n\n  const assertionResults =\n    (await readJsonMaybe<AssertionResult[]>(join(resultsDir, \"assertion-results.json\"))) ?? [];\n\n  const failed = assertionResults.filter((a) => !a.passed);\n  const assertions = failed.map((a) => ({\n    category: categoryFromAssertion(a),\n    level: a.level,\n    message: messageForAssertion(a),\n  }));\n\n  const anyError = assertions.some((a) => a.level === \"error\");\n  const anyWarn = assertions.some((a) => a.level === \"warn\");\n  const status: AuditResult[\"status\"] = anyError ? \"fail\" : anyWarn ? \"warn\" : \"pass\";\n\n  const normalized: NormalizedLhciResult = {\n    summary: averageSummaries(manifest),\n    assertionsFailed: failed.length,\n    assertions,\n  };\n\n  const summary =\n    status === \"pass\"\n      ? \"lighthouse: all categories passing\"\n      : `lighthouse: ${failed.length} assertion(s) failed`;\n\n  return { audit: \"lighthouse\", site: label, status, summary, details: normalized };\n}\n\n/** Checkout mode (unchanged behavior): boot the site's vite dev server on a\n *  pinned free port and audit the local fixtures/override URL. */\nasync function checkoutLighthouse(spawn: SpawnFn, site: Site, label: string): Promise<AuditResult> {\n  const siteCfg = await readSiteConfig(site.path);\n  // Allocate a free port + force vite to `--strictPort` so the spawned dev\n  // server either binds the port we picked or fails loudly (caltex 2026-05-28\n  // zombie-vite incident).\n  const port = await findFreePort();\n  const baseUrl = siteCfg.lighthouseUrl ?? lighthouseConfig.ci.collect.url[0];\n  const resolvedConfig = {\n    ...lighthouseConfig,\n    ci: {\n      ...lighthouseConfig.ci,\n      collect: {\n        ...lighthouseConfig.ci.collect,\n        url: [withFreePort(baseUrl, port)],\n        startServerCommand: `npm run vite:dev -- --port ${port} --strictPort`,\n      },\n    },\n  };\n\n  const configDir = await mkdtemp(join(tmpdir(), \"reddoor-lhci-\"));\n  const configPath = join(configDir, \"lighthouserc.json\");\n  await writeFile(configPath, JSON.stringify(resolvedConfig), \"utf-8\");\n\n  const resultsDir = join(site.path, \".lighthouseci\");\n  await rm(resultsDir, { recursive: true, force: true });\n\n  let raw: SpawnResult;\n  try {\n    raw = await spawn(\"npx\", [\"--yes\", \"@lhci/cli\", \"autorun\", `--config=${configPath}`], {\n      cwd: site.path,\n      timeoutMs: 5 * 60_000,\n    });\n  } catch (err) {\n    await rm(configDir, { recursive: true, force: true });\n    const e = err as NodeJS.ErrnoException;\n    if (e.code === \"ENOENT\" || /ENOENT/.test(String(err))) {\n      return {\n        audit: \"lighthouse\",\n        site: label,\n        status: \"skip\",\n        summary: \"npx/@lhci/cli not available\",\n      };\n    }\n    throw err;\n  }\n  await rm(configDir, { recursive: true, force: true });\n\n  return parseLhciResults(resultsDir, label, raw);\n}\n\n/** Deployed mode: audit a production URL directly — no checkout, no dev server.\n *  Runs in a throwaway tmp cwd; uploads to the filesystem so fleet runs never\n *  push 200 public reports to temporary-public-storage. */\nasync function deployedLighthouse(\n  spawn: SpawnFn,\n  deployedUrl: string,\n  label: string,\n): Promise<AuditResult> {\n  const workDir = await mkdtemp(join(tmpdir(), \"reddoor-lh-deployed-\"));\n  const resolvedConfig = {\n    ci: {\n      // Deliberately NOT spread from lighthouseConfig.ci.collect: deployed mode\n      // must omit startServerCommand and the dev-server settings entirely.\n      collect: {\n        url: [deployedUrl],\n        // 3 runs to damp Lighthouse's run-to-run variance; parseLhciResults\n        // averages the lhr files. (Median is a tracked future refinement.)\n        numberOfRuns: 3,\n        // Use devtools (applied) throttling instead of the desktop preset's\n        // default `simulate` (Lantern). Lantern estimates LCP from the\n        // dependency graph and can't model an LCP element revealed by a\n        // JS-load opacity fade (e.g. gallerysonder's GridImage): on a fast\n        // observed load it finds no LCP node and throws NO_LCP, nulling the\n        // perf score, which the cockpit then coerces to a misleading 0.\n        // devtools reads the real LCP paint event from the throttled trace\n        // instead. Trade-off: slightly noisier run-to-run, damped by the\n        // numberOfRuns:3 average above.\n        settings: { preset: \"desktop\", throttlingMethod: \"devtools\", skipAudits: [\"uses-http2\"] },\n      },\n      assert: lighthouseConfig.ci.assert,\n      upload: { target: \"filesystem\", outputDir: join(workDir, \"lhci-report\") },\n    },\n  };\n\n  const configPath = join(workDir, \"lighthouserc.json\");\n  await writeFile(configPath, JSON.stringify(resolvedConfig), \"utf-8\");\n\n  const resultsDir = join(workDir, \".lighthouseci\");\n\n  let raw: SpawnResult;\n  try {\n    raw = await spawn(\"npx\", [\"--yes\", \"@lhci/cli\", \"autorun\", `--config=${configPath}`], {\n      cwd: workDir,\n      // 3 serial cold runs of a slow deployed site (lhci's own maxWaitForLoad\n      // ~45-60s each) + first-use Chrome download can plausibly exceed 3 min →\n      // SIGTERM → no lhr-*.json → spurious \"no scores\". Match the 5-min budget\n      // the checkout path already gives (erp-industrials nightly flake,\n      // morning-brief 2026-06-10 MEDIUM-F).\n      timeoutMs: 5 * 60_000,\n    });\n  } catch (err) {\n    await rm(workDir, { recursive: true, force: true });\n    const e = err as NodeJS.ErrnoException;\n    if (e.code === \"ENOENT\" || /ENOENT/.test(String(err))) {\n      return {\n        audit: \"lighthouse\",\n        site: label,\n        status: \"skip\",\n        summary: \"npx/@lhci/cli not available\",\n      };\n    }\n    throw err;\n  }\n\n  try {\n    return await parseLhciResults(resultsDir, label, raw);\n  } finally {\n    await rm(workDir, { recursive: true, force: true });\n  }\n}\n\nexport async function lighthouseAudit(ctx: AuditContext): Promise<AuditResult> {\n  const spawn = ctx.spawn ?? defaultSpawn;\n  const site = ctx.site;\n  const label = siteLabel(site);\n\n  return site.deployedUrl\n    ? deployedLighthouse(spawn, site.deployedUrl, label)\n    : checkoutLighthouse(spawn, site, label);\n}\n","import { readFile } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\nexport type SiteConfig = {\n  /** Override URL the lighthouse audit hits. Sites without the default\n   * `/dev/a11y-fixtures` dev route set this to their homepage. */\n  lighthouseUrl?: string;\n  /**\n   * Real site routes the a11y audit should axe-scan, IN ADDITION to the two\n   * synthetic fixture pages it always covers. Opt-in per site and absent by\n   * default: the audit runs with `--fail-on-violations` in the shared CI\n   * workflow, and most of the fleet carries pre-existing a11y debt, so scanning\n   * real routes everywhere at once would red every repo. A site adopts this once\n   * its routes are clean. Omitted (never `[]`) when unset or unusable.\n   */\n  a11yRoutes?: string[];\n};\n\n/**\n * Read per-site overrides from `package.json#reddoor`. Returns `{}` on any\n * failure (missing file, malformed JSON, missing key, wrong type) so every\n * caller can safely fall back to its built-in default. Never throws.\n */\nexport async function readSiteConfig(sitePath: string): Promise<SiteConfig> {\n  let raw: string;\n  try {\n    raw = await readFile(join(sitePath, \"package.json\"), \"utf-8\");\n  } catch {\n    return {};\n  }\n  let pkg: unknown;\n  try {\n    pkg = JSON.parse(raw);\n  } catch {\n    return {};\n  }\n  if (!pkg || typeof pkg !== \"object\") return {};\n  const cfg = (pkg as { reddoor?: unknown }).reddoor;\n  if (!cfg || typeof cfg !== \"object\") return {};\n\n  const out: SiteConfig = {};\n  const url = (cfg as { lighthouseUrl?: unknown }).lighthouseUrl;\n  if (typeof url === \"string\" && url.length > 0) {\n    out.lighthouseUrl = url;\n  }\n  const routes = (cfg as { a11yRoutes?: unknown }).a11yRoutes;\n  if (Array.isArray(routes)) {\n    // Junk entries are dropped rather than passed through — a `null` in the list\n    // would become `page.goto(null)` inside the generated spec and fail the whole\n    // audit for a typo. An all-junk list leaves the key omitted, so the caller's\n    // \"no routes configured\" branch is the same shape as \"key absent\".\n    const clean = routes\n      .filter((r): r is string => typeof r === \"string\")\n      .map((r) => r.trim())\n      .filter((r) => r.length > 0);\n    if (clean.length > 0) out.a11yRoutes = clean;\n  }\n  return out;\n}\n"],"mappings":";;;;;;;;;;;;;;;AAAA,SAAS,YAAAA,WAAU,WAAW,SAAS,IAAI,eAAe;AAC1D,SAAS,cAAc;AACvB,SAAS,QAAAC,aAAY;;;ACFrB,SAAS,gBAAgB;AACzB,SAAS,YAAY;AAsBrB,eAAsB,eAAe,UAAuC;AAC1E,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,SAAS,KAAK,UAAU,cAAc,GAAG,OAAO;AAAA,EAC9D,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACA,MAAI;AACJ,MAAI;AACF,UAAM,KAAK,MAAM,GAAG;AAAA,EACtB,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACA,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO,CAAC;AAC7C,QAAM,MAAO,IAA8B;AAC3C,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO,CAAC;AAE7C,QAAM,MAAkB,CAAC;AACzB,QAAM,MAAO,IAAoC;AACjD,MAAI,OAAO,QAAQ,YAAY,IAAI,SAAS,GAAG;AAC7C,QAAI,gBAAgB;AAAA,EACtB;AACA,QAAM,SAAU,IAAiC;AACjD,MAAI,MAAM,QAAQ,MAAM,GAAG;AAKzB,UAAM,QAAQ,OACX,OAAO,CAAC,MAAmB,OAAO,MAAM,QAAQ,EAChD,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC;AAC7B,QAAI,MAAM,SAAS,EAAG,KAAI,aAAa;AAAA,EACzC;AACA,SAAO;AACT;;;ADtBA,eAAe,cAAiB,MAAiC;AAC/D,MAAI;AACF,UAAM,MAAM,MAAMC,UAAS,MAAM,OAAO;AACxC,WAAO,KAAK,MAAM,GAAG;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAeA,eAAe,eAAe,YAA8C;AAC1E,QAAM,QAAQ,MAAM,QAAQ,UAAU,EAAE,MAAM,MAAM,CAAC,CAAa;AAClE,QAAM,UAA2B,CAAC;AAClC,aAAW,KAAK,OAAO;AACrB,QAAI,CAAC,EAAE,WAAW,MAAM,KAAK,CAAC,EAAE,SAAS,OAAO,EAAG;AACnD,UAAM,MAAM,MAAM,cAAuBC,MAAK,YAAY,CAAC,CAAC;AAC5D,QAAI,CAAC,OAAO,CAAC,IAAI,WAAY;AAC7B,UAAM,UAAkC,CAAC;AACzC,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,IAAI,UAAU,GAAG;AACnD,UAAI,OAAO,GAAG,UAAU,SAAU,SAAQ,CAAC,IAAI,EAAE;AAAA,IACnD;AACA,YAAQ,KAAK,EAAE,KAAK,IAAI,cAAc,QAAQ,CAAC;AAAA,EACjD;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,SAAkD;AAC1E,MAAI,QAAQ,WAAW,EAAG,QAAO,CAAC;AAClC,QAAM,OAA+B,CAAC;AACtC,QAAM,SAAiC,CAAC;AACxC,aAAW,KAAK,SAAS;AACvB,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,EAAE,WAAW,CAAC,CAAC,GAAG;AACpD,UAAI,OAAO,MAAM,SAAU;AAC3B,WAAK,CAAC,KAAK,KAAK,CAAC,KAAK,KAAK;AAC3B,aAAO,CAAC,KAAK,OAAO,CAAC,KAAK,KAAK;AAAA,IACjC;AAAA,EACF;AACA,QAAM,MAA8B,CAAC;AACrC,aAAW,KAAK,OAAO,KAAK,IAAI,GAAG;AACjC,UAAM,QAAQ,KAAK,CAAC,KAAK;AACzB,UAAM,QAAQ,OAAO,CAAC,KAAK;AAC3B,QAAI,CAAC,IAAI,QAAQ;AAAA,EACnB;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,GAA4B;AAEzD,QAAM,WAAW,EAAE,KAAK,QAAQ,GAAG;AACnC,SAAO,YAAY,IAAI,EAAE,KAAK,MAAM,WAAW,CAAC,IAAI,EAAE;AACxD;AAEA,SAAS,oBAAoB,GAA4B;AAIvD,QAAM,SAAS,OAAO,EAAE,WAAW,WAAW,EAAE,OAAO,QAAQ,CAAC,IAAI;AACpE,SAAO,GAAG,EAAE,IAAI,IAAI,EAAE,QAAQ,IAAI,EAAE,QAAQ,aAAa,MAAM;AACjE;AAIA,eAAe,iBACb,YACA,OACA,KACsB;AACtB,QAAM,WAAW,MAAM,eAAe,UAAU;AAEhD,MAAI,SAAS,WAAW,GAAG;AACzB,WAAO;AAAA,MACL,OAAO;AAAA,MACP,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,SAAS,2CAA2C,IAAI,IAAI,IAC1D,IAAI,SAAS,WAAM,IAAI,OAAO,MAAM,GAAG,GAAG,CAAC,KAAK,EAClD;AAAA,IACF;AAAA,EACF;AAEA,QAAM,mBACH,MAAM,cAAiCA,MAAK,YAAY,wBAAwB,CAAC,KAAM,CAAC;AAE3F,QAAM,SAAS,iBAAiB,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM;AACvD,QAAM,aAAa,OAAO,IAAI,CAAC,OAAO;AAAA,IACpC,UAAU,sBAAsB,CAAC;AAAA,IACjC,OAAO,EAAE;AAAA,IACT,SAAS,oBAAoB,CAAC;AAAA,EAChC,EAAE;AAEF,QAAM,WAAW,WAAW,KAAK,CAAC,MAAM,EAAE,UAAU,OAAO;AAC3D,QAAM,UAAU,WAAW,KAAK,CAAC,MAAM,EAAE,UAAU,MAAM;AACzD,QAAM,SAAgC,WAAW,SAAS,UAAU,SAAS;AAE7E,QAAM,aAAmC;AAAA,IACvC,SAAS,iBAAiB,QAAQ;AAAA,IAClC,kBAAkB,OAAO;AAAA,IACzB;AAAA,EACF;AAEA,QAAM,UACJ,WAAW,SACP,uCACA,eAAe,OAAO,MAAM;AAElC,SAAO,EAAE,OAAO,cAAc,MAAM,OAAO,QAAQ,SAAS,SAAS,WAAW;AAClF;AAIA,eAAe,mBAAmB,OAAgB,MAAY,OAAqC;AACjG,QAAM,UAAU,MAAM,eAAe,KAAK,IAAI;AAI9C,QAAM,OAAO,MAAM,aAAa;AAChC,QAAM,UAAU,QAAQ,iBAAiB,iBAAiB,GAAG,QAAQ,IAAI,CAAC;AAC1E,QAAM,iBAAiB;AAAA,IACrB,GAAG;AAAA,IACH,IAAI;AAAA,MACF,GAAG,iBAAiB;AAAA,MACpB,SAAS;AAAA,QACP,GAAG,iBAAiB,GAAG;AAAA,QACvB,KAAK,CAAC,aAAa,SAAS,IAAI,CAAC;AAAA,QACjC,oBAAoB,8BAA8B,IAAI;AAAA,MACxD;AAAA,IACF;AAAA,EACF;AAEA,QAAM,YAAY,MAAM,QAAQA,MAAK,OAAO,GAAG,eAAe,CAAC;AAC/D,QAAM,aAAaA,MAAK,WAAW,mBAAmB;AACtD,QAAM,UAAU,YAAY,KAAK,UAAU,cAAc,GAAG,OAAO;AAEnE,QAAM,aAAaA,MAAK,KAAK,MAAM,eAAe;AAClD,QAAM,GAAG,YAAY,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAErD,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,MAAM,OAAO,CAAC,SAAS,aAAa,WAAW,YAAY,UAAU,EAAE,GAAG;AAAA,MACpF,KAAK,KAAK;AAAA,MACV,WAAW,IAAI;AAAA,IACjB,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,GAAG,WAAW,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AACpD,UAAM,IAAI;AACV,QAAI,EAAE,SAAS,YAAY,SAAS,KAAK,OAAO,GAAG,CAAC,GAAG;AACrD,aAAO;AAAA,QACL,OAAO;AAAA,QACP,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,SAAS;AAAA,MACX;AAAA,IACF;AACA,UAAM;AAAA,EACR;AACA,QAAM,GAAG,WAAW,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAEpD,SAAO,iBAAiB,YAAY,OAAO,GAAG;AAChD;AAKA,eAAe,mBACb,OACA,aACA,OACsB;AACtB,QAAM,UAAU,MAAM,QAAQA,MAAK,OAAO,GAAG,sBAAsB,CAAC;AACpE,QAAM,iBAAiB;AAAA,IACrB,IAAI;AAAA;AAAA;AAAA,MAGF,SAAS;AAAA,QACP,KAAK,CAAC,WAAW;AAAA;AAAA;AAAA,QAGjB,cAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAUd,UAAU,EAAE,QAAQ,WAAW,kBAAkB,YAAY,YAAY,CAAC,YAAY,EAAE;AAAA,MAC1F;AAAA,MACA,QAAQ,iBAAiB,GAAG;AAAA,MAC5B,QAAQ,EAAE,QAAQ,cAAc,WAAWA,MAAK,SAAS,aAAa,EAAE;AAAA,IAC1E;AAAA,EACF;AAEA,QAAM,aAAaA,MAAK,SAAS,mBAAmB;AACpD,QAAM,UAAU,YAAY,KAAK,UAAU,cAAc,GAAG,OAAO;AAEnE,QAAM,aAAaA,MAAK,SAAS,eAAe;AAEhD,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,MAAM,OAAO,CAAC,SAAS,aAAa,WAAW,YAAY,UAAU,EAAE,GAAG;AAAA,MACpF,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAML,WAAW,IAAI;AAAA,IACjB,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,GAAG,SAAS,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAClD,UAAM,IAAI;AACV,QAAI,EAAE,SAAS,YAAY,SAAS,KAAK,OAAO,GAAG,CAAC,GAAG;AACrD,aAAO;AAAA,QACL,OAAO;AAAA,QACP,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,SAAS;AAAA,MACX;AAAA,IACF;AACA,UAAM;AAAA,EACR;AAEA,MAAI;AACF,WAAO,MAAM,iBAAiB,YAAY,OAAO,GAAG;AAAA,EACtD,UAAE;AACA,UAAM,GAAG,SAAS,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EACpD;AACF;AAEA,eAAsB,gBAAgB,KAAyC;AAC7E,QAAM,QAAQ,IAAI,SAAS;AAC3B,QAAM,OAAO,IAAI;AACjB,QAAM,QAAQ,UAAU,IAAI;AAE5B,SAAO,KAAK,cACR,mBAAmB,OAAO,KAAK,aAAa,KAAK,IACjD,mBAAmB,OAAO,MAAM,KAAK;AAC3C;","names":["readFile","join","readFile","join"]}
+{"version":3,"sources":["../src/audits/lighthouse.ts","../src/audits/util/site-config.ts"],"sourcesContent":["import { readFile, writeFile, mkdtemp, rm, readdir } from \"node:fs/promises\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport type { AuditResult, Site } from \"../types.js\";\nimport { siteLabel } from \"../util/site.js\";\nimport { lighthouseConfig } from \"../configs/lighthouse.js\";\nimport { defaultSpawn } from \"./util/spawn.js\";\nimport type { SpawnFn, SpawnResult } from \"./util/spawn.js\";\nimport type { AuditContext } from \"./util/inject.js\";\nimport { readSiteConfig } from \"./util/site-config.js\";\nimport { findFreePort, withFreePort } from \"../util/free-port.js\";\n\ntype ManifestEntry = {\n  url: string;\n  summary: Record<string, number>;\n  htmlPath?: string;\n  jsonPath?: string;\n};\n\ntype AssertionResult = {\n  name: string;\n  actual: number;\n  expected: number;\n  operator: string;\n  passed: boolean;\n  level: \"warn\" | \"error\";\n  auditProperty?: string;\n  auditId?: string;\n};\n\ntype NormalizedLhciResult = {\n  summary: Record<string, number>;\n  assertionsFailed: number;\n  assertions: Array<{ category: string; level: \"warn\" | \"error\"; message: string }>;\n};\n\nasync function readJsonMaybe<T>(path: string): Promise<T | null> {\n  try {\n    const raw = await readFile(path, \"utf-8\");\n    return JSON.parse(raw) as T;\n  } catch {\n    return null;\n  }\n}\n\ntype LhrFile = {\n  requestedUrl: string;\n  finalUrl?: string;\n  categories: Record<string, { score: number | null }>;\n};\n\n/**\n * Build manifest-equivalent entries by scanning the `.lighthouseci/` dir\n * for `lhr-*.json` files written by `lhci collect`. We used to read\n * `manifest.json` directly, but lhci 0.15+ no longer writes it — the\n * audit would silently return \"no manifest written\" against a perfectly\n * healthy run. Reproduced on caltex 2026-05-28 (0.10.5 dogfood).\n */\nasync function readLhrEntries(resultsDir: string): Promise<ManifestEntry[]> {\n  const files = await readdir(resultsDir).catch(() => [] as string[]);\n  const entries: ManifestEntry[] = [];\n  for (const f of files) {\n    if (!f.startsWith(\"lhr-\") || !f.endsWith(\".json\")) continue;\n    const lhr = await readJsonMaybe<LhrFile>(join(resultsDir, f));\n    if (!lhr || !lhr.categories) continue;\n    const summary: Record<string, number> = {};\n    for (const [k, v] of Object.entries(lhr.categories)) {\n      if (typeof v?.score === \"number\") summary[k] = v.score;\n    }\n    entries.push({ url: lhr.requestedUrl, summary });\n  }\n  return entries;\n}\n\nfunction averageSummaries(entries: ManifestEntry[]): Record<string, number> {\n  if (entries.length === 0) return {};\n  const sums: Record<string, number> = {};\n  const counts: Record<string, number> = {};\n  for (const e of entries) {\n    for (const [k, v] of Object.entries(e.summary ?? {})) {\n      if (typeof v !== \"number\") continue;\n      sums[k] = (sums[k] ?? 0) + v;\n      counts[k] = (counts[k] ?? 0) + 1;\n    }\n  }\n  const out: Record<string, number> = {};\n  for (const k of Object.keys(sums)) {\n    const total = sums[k] ?? 0;\n    const count = counts[k] ?? 1;\n    out[k] = total / count;\n  }\n  return out;\n}\n\nfunction categoryFromAssertion(a: AssertionResult): string {\n  // `name` looks like \"categories:accessibility\" or \"audits:uses-http2\".\n  const colonIdx = a.name.indexOf(\":\");\n  return colonIdx >= 0 ? a.name.slice(colonIdx + 1) : a.name;\n}\n\nfunction messageForAssertion(a: AssertionResult): string {\n  // `a.actual` is parsed from external lhci/Lighthouse JSON; a malformed or\n  // missing value (not a number) would make `.toFixed` throw and crash the whole\n  // audit. Guard it and fall back to a readable string instead.\n  const actual = typeof a.actual === \"number\" ? a.actual.toFixed(2) : \"n/a\";\n  return `${a.name} ${a.operator} ${a.expected} (actual: ${actual})`;\n}\n\n/** Shared tail: scan `.lighthouseci/` for lhr-*.json + assertion-results.json and\n *  build the AuditResult. Identical for the checkout and deployed paths. */\nasync function parseLhciResults(\n  resultsDir: string,\n  label: string,\n  raw: SpawnResult,\n): Promise<AuditResult> {\n  const manifest = await readLhrEntries(resultsDir);\n\n  if (manifest.length === 0) {\n    return {\n      audit: \"lighthouse\",\n      site: label,\n      status: \"fail\",\n      summary: `lighthouse: no lhr-*.json written (exit ${raw.code})${\n        raw.stderr ? ` — ${raw.stderr.slice(0, 200)}` : \"\"\n      }`,\n    };\n  }\n\n  const assertionResults =\n    (await readJsonMaybe<AssertionResult[]>(join(resultsDir, \"assertion-results.json\"))) ?? [];\n\n  const failed = assertionResults.filter((a) => !a.passed);\n  const assertions = failed.map((a) => ({\n    category: categoryFromAssertion(a),\n    level: a.level,\n    message: messageForAssertion(a),\n  }));\n\n  const anyError = assertions.some((a) => a.level === \"error\");\n  const anyWarn = assertions.some((a) => a.level === \"warn\");\n  const status: AuditResult[\"status\"] = anyError ? \"fail\" : anyWarn ? \"warn\" : \"pass\";\n\n  const normalized: NormalizedLhciResult = {\n    summary: averageSummaries(manifest),\n    assertionsFailed: failed.length,\n    assertions,\n  };\n\n  const summary =\n    status === \"pass\"\n      ? \"lighthouse: all categories passing\"\n      : `lighthouse: ${failed.length} assertion(s) failed`;\n\n  return { audit: \"lighthouse\", site: label, status, summary, details: normalized };\n}\n\n/** Checkout mode (unchanged behavior): boot the site's vite dev server on a\n *  pinned free port and audit the local fixtures/override URL. */\nasync function checkoutLighthouse(spawn: SpawnFn, site: Site, label: string): Promise<AuditResult> {\n  const siteCfg = await readSiteConfig(site.path);\n  // Allocate a free port + force vite to `--strictPort` so the spawned dev\n  // server either binds the port we picked or fails loudly (caltex 2026-05-28\n  // zombie-vite incident).\n  const port = await findFreePort();\n  const baseUrl = siteCfg.lighthouseUrl ?? lighthouseConfig.ci.collect.url[0];\n  const resolvedConfig = {\n    ...lighthouseConfig,\n    ci: {\n      ...lighthouseConfig.ci,\n      collect: {\n        ...lighthouseConfig.ci.collect,\n        url: [withFreePort(baseUrl, port)],\n        startServerCommand: `npm run vite:dev -- --port ${port} --strictPort`,\n      },\n    },\n  };\n\n  const configDir = await mkdtemp(join(tmpdir(), \"reddoor-lhci-\"));\n  const configPath = join(configDir, \"lighthouserc.json\");\n  await writeFile(configPath, JSON.stringify(resolvedConfig), \"utf-8\");\n\n  const resultsDir = join(site.path, \".lighthouseci\");\n  await rm(resultsDir, { recursive: true, force: true });\n\n  let raw: SpawnResult;\n  try {\n    raw = await spawn(\"npx\", [\"--yes\", \"@lhci/cli\", \"autorun\", `--config=${configPath}`], {\n      cwd: site.path,\n      timeoutMs: 5 * 60_000,\n    });\n  } catch (err) {\n    await rm(configDir, { recursive: true, force: true });\n    const e = err as NodeJS.ErrnoException;\n    if (e.code === \"ENOENT\" || /ENOENT/.test(String(err))) {\n      return {\n        audit: \"lighthouse\",\n        site: label,\n        status: \"skip\",\n        summary: \"npx/@lhci/cli not available\",\n      };\n    }\n    throw err;\n  }\n  await rm(configDir, { recursive: true, force: true });\n\n  return parseLhciResults(resultsDir, label, raw);\n}\n\n/** Deployed mode: audit a production URL directly — no checkout, no dev server.\n *  Runs in a throwaway tmp cwd; uploads to the filesystem so fleet runs never\n *  push 200 public reports to temporary-public-storage. */\nasync function deployedLighthouse(\n  spawn: SpawnFn,\n  deployedUrl: string,\n  label: string,\n): Promise<AuditResult> {\n  const workDir = await mkdtemp(join(tmpdir(), \"reddoor-lh-deployed-\"));\n  const resolvedConfig = {\n    ci: {\n      // Deliberately NOT spread from lighthouseConfig.ci.collect: deployed mode\n      // must omit startServerCommand and the dev-server settings entirely.\n      collect: {\n        url: [deployedUrl],\n        // 3 runs to damp Lighthouse's run-to-run variance; parseLhciResults\n        // averages the lhr files. (Median is a tracked future refinement.)\n        numberOfRuns: 3,\n        // Use devtools (applied) throttling instead of the desktop preset's\n        // default `simulate` (Lantern). Lantern estimates LCP from the\n        // dependency graph and can't model an LCP element revealed by a\n        // JS-load opacity fade (e.g. gallerysonder's GridImage): on a fast\n        // observed load it finds no LCP node and throws NO_LCP, nulling the\n        // perf score, which the cockpit then coerces to a misleading 0.\n        // devtools reads the real LCP paint event from the throttled trace\n        // instead. Trade-off: slightly noisier run-to-run, damped by the\n        // numberOfRuns:3 average above.\n        settings: { preset: \"desktop\", throttlingMethod: \"devtools\", skipAudits: [\"uses-http2\"] },\n      },\n      assert: lighthouseConfig.ci.assert,\n      upload: { target: \"filesystem\", outputDir: join(workDir, \"lhci-report\") },\n    },\n  };\n\n  const configPath = join(workDir, \"lighthouserc.json\");\n  await writeFile(configPath, JSON.stringify(resolvedConfig), \"utf-8\");\n\n  const resultsDir = join(workDir, \".lighthouseci\");\n\n  let raw: SpawnResult;\n  try {\n    raw = await spawn(\"npx\", [\"--yes\", \"@lhci/cli\", \"autorun\", `--config=${configPath}`], {\n      cwd: workDir,\n      // 3 serial cold runs of a slow deployed site (lhci's own maxWaitForLoad\n      // ~45-60s each) + first-use Chrome download can plausibly exceed 3 min →\n      // SIGTERM → no lhr-*.json → spurious \"no scores\". Match the 5-min budget\n      // the checkout path already gives (erp-industrials nightly flake,\n      // morning-brief 2026-06-10 MEDIUM-F).\n      timeoutMs: 5 * 60_000,\n    });\n  } catch (err) {\n    await rm(workDir, { recursive: true, force: true });\n    const e = err as NodeJS.ErrnoException;\n    if (e.code === \"ENOENT\" || /ENOENT/.test(String(err))) {\n      return {\n        audit: \"lighthouse\",\n        site: label,\n        status: \"skip\",\n        summary: \"npx/@lhci/cli not available\",\n      };\n    }\n    throw err;\n  }\n\n  try {\n    return await parseLhciResults(resultsDir, label, raw);\n  } finally {\n    await rm(workDir, { recursive: true, force: true });\n  }\n}\n\nexport async function lighthouseAudit(ctx: AuditContext): Promise<AuditResult> {\n  const spawn = ctx.spawn ?? defaultSpawn;\n  const site = ctx.site;\n  const label = siteLabel(site);\n\n  return site.deployedUrl\n    ? deployedLighthouse(spawn, site.deployedUrl, label)\n    : checkoutLighthouse(spawn, site, label);\n}\n","import { readFile } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\nexport type SiteConfig = {\n  /** Override URL the lighthouse audit hits. Sites without the default\n   * `/dev/a11y-fixtures` dev route set this to their homepage. */\n  lighthouseUrl?: string;\n  /**\n   * Real site routes the a11y audit should axe-scan, IN ADDITION to the two\n   * synthetic fixture pages it always covers. Opt-in per site and absent by\n   * default: the audit runs with `--fail-on-violations` in the shared CI\n   * workflow, and most of the fleet carries pre-existing a11y debt, so scanning\n   * real routes everywhere at once would red every repo. A site adopts this once\n   * its routes are clean. Omitted (never `[]`) when unset or unusable.\n   */\n  a11yRoutes?: string[];\n  /**\n   * Which server the browser gates run against: `\"dev\"` (the default — `vite\n   * dev`) or `\"preview\"` (a real `vite build`, served by `vite preview`).\n   *\n   * Both gates measured the dev server, so the production bundle was built in\n   * CI and then never opened by a browser — and dev does not merely fail to\n   * reproduce some defects, it hides them. Module graph, code splitting,\n   * minification and asset hashing are most of what \"hydration works\" means,\n   * and a stylesheet can even be fetched under a different CSP directive in\n   * each (#700).\n   *\n   * Opt-in, because a preview costs a `pnpm build` per run and because the\n   * `/dev/*` fixture routes the axe scan targets are not guaranteed to survive\n   * one — a site that flipped this without checking would trade a working gate\n   * for one reporting every fixture as a missing route. Omitted (never\n   * defaulted here) so each caller states its own default.\n   *\n   * Requires a `preview` script in the site's package.json; the starter has one.\n   */\n  gateServer?: \"dev\" | \"preview\";\n};\n\n/**\n * Read per-site overrides from `package.json#reddoor`. Returns `{}` on any\n * failure (missing file, malformed JSON, missing key, wrong type) so every\n * caller can safely fall back to its built-in default. Never throws.\n */\nexport async function readSiteConfig(sitePath: string): Promise<SiteConfig> {\n  let raw: string;\n  try {\n    raw = await readFile(join(sitePath, \"package.json\"), \"utf-8\");\n  } catch {\n    return {};\n  }\n  let pkg: unknown;\n  try {\n    pkg = JSON.parse(raw);\n  } catch {\n    return {};\n  }\n  if (!pkg || typeof pkg !== \"object\") return {};\n  const cfg = (pkg as { reddoor?: unknown }).reddoor;\n  if (!cfg || typeof cfg !== \"object\") return {};\n\n  const out: SiteConfig = {};\n  const url = (cfg as { lighthouseUrl?: unknown }).lighthouseUrl;\n  if (typeof url === \"string\" && url.length > 0) {\n    out.lighthouseUrl = url;\n  }\n  const routes = (cfg as { a11yRoutes?: unknown }).a11yRoutes;\n  if (Array.isArray(routes)) {\n    // Junk entries are dropped rather than passed through — a `null` in the list\n    // would become `page.goto(null)` inside the generated spec and fail the whole\n    // audit for a typo. An all-junk list leaves the key omitted, so the caller's\n    // \"no routes configured\" branch is the same shape as \"key absent\".\n    const clean = routes\n      .filter((r): r is string => typeof r === \"string\")\n      .map((r) => r.trim())\n      .filter((r) => r.length > 0);\n    if (clean.length > 0) out.a11yRoutes = clean;\n  }\n  // Anything but the two known values reads as absent. This string reaches a\n  // shell as part of a `webServer.command`, so a typo must fall back to the\n  // default rather than be forwarded — `\"prod\"` would become `npm run prod`.\n  const gate = (cfg as { gateServer?: unknown }).gateServer;\n  if (gate === \"dev\" || gate === \"preview\") out.gateServer = gate;\n\n  return out;\n}\n"],"mappings":";;;;;;;;;;;;;;;AAAA,SAAS,YAAAA,WAAU,WAAW,SAAS,IAAI,eAAe;AAC1D,SAAS,cAAc;AACvB,SAAS,QAAAC,aAAY;;;ACFrB,SAAS,gBAAgB;AACzB,SAAS,YAAY;AA0CrB,eAAsB,eAAe,UAAuC;AAC1E,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,SAAS,KAAK,UAAU,cAAc,GAAG,OAAO;AAAA,EAC9D,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACA,MAAI;AACJ,MAAI;AACF,UAAM,KAAK,MAAM,GAAG;AAAA,EACtB,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACA,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO,CAAC;AAC7C,QAAM,MAAO,IAA8B;AAC3C,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO,CAAC;AAE7C,QAAM,MAAkB,CAAC;AACzB,QAAM,MAAO,IAAoC;AACjD,MAAI,OAAO,QAAQ,YAAY,IAAI,SAAS,GAAG;AAC7C,QAAI,gBAAgB;AAAA,EACtB;AACA,QAAM,SAAU,IAAiC;AACjD,MAAI,MAAM,QAAQ,MAAM,GAAG;AAKzB,UAAM,QAAQ,OACX,OAAO,CAAC,MAAmB,OAAO,MAAM,QAAQ,EAChD,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC;AAC7B,QAAI,MAAM,SAAS,EAAG,KAAI,aAAa;AAAA,EACzC;AAIA,QAAM,OAAQ,IAAiC;AAC/C,MAAI,SAAS,SAAS,SAAS,UAAW,KAAI,aAAa;AAE3D,SAAO;AACT;;;ADhDA,eAAe,cAAiB,MAAiC;AAC/D,MAAI;AACF,UAAM,MAAM,MAAMC,UAAS,MAAM,OAAO;AACxC,WAAO,KAAK,MAAM,GAAG;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAeA,eAAe,eAAe,YAA8C;AAC1E,QAAM,QAAQ,MAAM,QAAQ,UAAU,EAAE,MAAM,MAAM,CAAC,CAAa;AAClE,QAAM,UAA2B,CAAC;AAClC,aAAW,KAAK,OAAO;AACrB,QAAI,CAAC,EAAE,WAAW,MAAM,KAAK,CAAC,EAAE,SAAS,OAAO,EAAG;AACnD,UAAM,MAAM,MAAM,cAAuBC,MAAK,YAAY,CAAC,CAAC;AAC5D,QAAI,CAAC,OAAO,CAAC,IAAI,WAAY;AAC7B,UAAM,UAAkC,CAAC;AACzC,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,IAAI,UAAU,GAAG;AACnD,UAAI,OAAO,GAAG,UAAU,SAAU,SAAQ,CAAC,IAAI,EAAE;AAAA,IACnD;AACA,YAAQ,KAAK,EAAE,KAAK,IAAI,cAAc,QAAQ,CAAC;AAAA,EACjD;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,SAAkD;AAC1E,MAAI,QAAQ,WAAW,EAAG,QAAO,CAAC;AAClC,QAAM,OAA+B,CAAC;AACtC,QAAM,SAAiC,CAAC;AACxC,aAAW,KAAK,SAAS;AACvB,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,EAAE,WAAW,CAAC,CAAC,GAAG;AACpD,UAAI,OAAO,MAAM,SAAU;AAC3B,WAAK,CAAC,KAAK,KAAK,CAAC,KAAK,KAAK;AAC3B,aAAO,CAAC,KAAK,OAAO,CAAC,KAAK,KAAK;AAAA,IACjC;AAAA,EACF;AACA,QAAM,MAA8B,CAAC;AACrC,aAAW,KAAK,OAAO,KAAK,IAAI,GAAG;AACjC,UAAM,QAAQ,KAAK,CAAC,KAAK;AACzB,UAAM,QAAQ,OAAO,CAAC,KAAK;AAC3B,QAAI,CAAC,IAAI,QAAQ;AAAA,EACnB;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,GAA4B;AAEzD,QAAM,WAAW,EAAE,KAAK,QAAQ,GAAG;AACnC,SAAO,YAAY,IAAI,EAAE,KAAK,MAAM,WAAW,CAAC,IAAI,EAAE;AACxD;AAEA,SAAS,oBAAoB,GAA4B;AAIvD,QAAM,SAAS,OAAO,EAAE,WAAW,WAAW,EAAE,OAAO,QAAQ,CAAC,IAAI;AACpE,SAAO,GAAG,EAAE,IAAI,IAAI,EAAE,QAAQ,IAAI,EAAE,QAAQ,aAAa,MAAM;AACjE;AAIA,eAAe,iBACb,YACA,OACA,KACsB;AACtB,QAAM,WAAW,MAAM,eAAe,UAAU;AAEhD,MAAI,SAAS,WAAW,GAAG;AACzB,WAAO;AAAA,MACL,OAAO;AAAA,MACP,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,SAAS,2CAA2C,IAAI,IAAI,IAC1D,IAAI,SAAS,WAAM,IAAI,OAAO,MAAM,GAAG,GAAG,CAAC,KAAK,EAClD;AAAA,IACF;AAAA,EACF;AAEA,QAAM,mBACH,MAAM,cAAiCA,MAAK,YAAY,wBAAwB,CAAC,KAAM,CAAC;AAE3F,QAAM,SAAS,iBAAiB,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM;AACvD,QAAM,aAAa,OAAO,IAAI,CAAC,OAAO;AAAA,IACpC,UAAU,sBAAsB,CAAC;AAAA,IACjC,OAAO,EAAE;AAAA,IACT,SAAS,oBAAoB,CAAC;AAAA,EAChC,EAAE;AAEF,QAAM,WAAW,WAAW,KAAK,CAAC,MAAM,EAAE,UAAU,OAAO;AAC3D,QAAM,UAAU,WAAW,KAAK,CAAC,MAAM,EAAE,UAAU,MAAM;AACzD,QAAM,SAAgC,WAAW,SAAS,UAAU,SAAS;AAE7E,QAAM,aAAmC;AAAA,IACvC,SAAS,iBAAiB,QAAQ;AAAA,IAClC,kBAAkB,OAAO;AAAA,IACzB;AAAA,EACF;AAEA,QAAM,UACJ,WAAW,SACP,uCACA,eAAe,OAAO,MAAM;AAElC,SAAO,EAAE,OAAO,cAAc,MAAM,OAAO,QAAQ,SAAS,SAAS,WAAW;AAClF;AAIA,eAAe,mBAAmB,OAAgB,MAAY,OAAqC;AACjG,QAAM,UAAU,MAAM,eAAe,KAAK,IAAI;AAI9C,QAAM,OAAO,MAAM,aAAa;AAChC,QAAM,UAAU,QAAQ,iBAAiB,iBAAiB,GAAG,QAAQ,IAAI,CAAC;AAC1E,QAAM,iBAAiB;AAAA,IACrB,GAAG;AAAA,IACH,IAAI;AAAA,MACF,GAAG,iBAAiB;AAAA,MACpB,SAAS;AAAA,QACP,GAAG,iBAAiB,GAAG;AAAA,QACvB,KAAK,CAAC,aAAa,SAAS,IAAI,CAAC;AAAA,QACjC,oBAAoB,8BAA8B,IAAI;AAAA,MACxD;AAAA,IACF;AAAA,EACF;AAEA,QAAM,YAAY,MAAM,QAAQA,MAAK,OAAO,GAAG,eAAe,CAAC;AAC/D,QAAM,aAAaA,MAAK,WAAW,mBAAmB;AACtD,QAAM,UAAU,YAAY,KAAK,UAAU,cAAc,GAAG,OAAO;AAEnE,QAAM,aAAaA,MAAK,KAAK,MAAM,eAAe;AAClD,QAAM,GAAG,YAAY,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAErD,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,MAAM,OAAO,CAAC,SAAS,aAAa,WAAW,YAAY,UAAU,EAAE,GAAG;AAAA,MACpF,KAAK,KAAK;AAAA,MACV,WAAW,IAAI;AAAA,IACjB,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,GAAG,WAAW,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AACpD,UAAM,IAAI;AACV,QAAI,EAAE,SAAS,YAAY,SAAS,KAAK,OAAO,GAAG,CAAC,GAAG;AACrD,aAAO;AAAA,QACL,OAAO;AAAA,QACP,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,SAAS;AAAA,MACX;AAAA,IACF;AACA,UAAM;AAAA,EACR;AACA,QAAM,GAAG,WAAW,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAEpD,SAAO,iBAAiB,YAAY,OAAO,GAAG;AAChD;AAKA,eAAe,mBACb,OACA,aACA,OACsB;AACtB,QAAM,UAAU,MAAM,QAAQA,MAAK,OAAO,GAAG,sBAAsB,CAAC;AACpE,QAAM,iBAAiB;AAAA,IACrB,IAAI;AAAA;AAAA;AAAA,MAGF,SAAS;AAAA,QACP,KAAK,CAAC,WAAW;AAAA;AAAA;AAAA,QAGjB,cAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAUd,UAAU,EAAE,QAAQ,WAAW,kBAAkB,YAAY,YAAY,CAAC,YAAY,EAAE;AAAA,MAC1F;AAAA,MACA,QAAQ,iBAAiB,GAAG;AAAA,MAC5B,QAAQ,EAAE,QAAQ,cAAc,WAAWA,MAAK,SAAS,aAAa,EAAE;AAAA,IAC1E;AAAA,EACF;AAEA,QAAM,aAAaA,MAAK,SAAS,mBAAmB;AACpD,QAAM,UAAU,YAAY,KAAK,UAAU,cAAc,GAAG,OAAO;AAEnE,QAAM,aAAaA,MAAK,SAAS,eAAe;AAEhD,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,MAAM,OAAO,CAAC,SAAS,aAAa,WAAW,YAAY,UAAU,EAAE,GAAG;AAAA,MACpF,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAML,WAAW,IAAI;AAAA,IACjB,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,GAAG,SAAS,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAClD,UAAM,IAAI;AACV,QAAI,EAAE,SAAS,YAAY,SAAS,KAAK,OAAO,GAAG,CAAC,GAAG;AACrD,aAAO;AAAA,QACL,OAAO;AAAA,QACP,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,SAAS;AAAA,MACX;AAAA,IACF;AACA,UAAM;AAAA,EACR;AAEA,MAAI;AACF,WAAO,MAAM,iBAAiB,YAAY,OAAO,GAAG;AAAA,EACtD,UAAE;AACA,UAAM,GAAG,SAAS,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EACpD;AACF;AAEA,eAAsB,gBAAgB,KAAyC;AAC7E,QAAM,QAAQ,IAAI,SAAS;AAC3B,QAAM,OAAO,IAAI;AACjB,QAAM,QAAQ,UAAU,IAAI;AAE5B,SAAO,KAAK,cACR,mBAAmB,OAAO,KAAK,aAAa,KAAK,IACjD,mBAAmB,OAAO,MAAM,KAAK;AAC3C;","names":["readFile","join","readFile","join"]}

package/dist/{chunk-YLYXW5PH.js → chunk-CXICCLNM.js}

@@ -1,5 +1,7 @@
 // src/configs/playwright-a11y.ts
 import { execFileSync } from "child_process";
+import { readFileSync } from "fs";
+import { join } from "path";
 import { defineConfig, devices } from "@playwright/test";
 var a11yRoutes = [
   { path: "/dev/a11y-fixtures", name: "a11y fixtures" },
@@ -29,6 +31,22 @@ function resolvePort() {
   return allocated;
 }
 var port = resolvePort();
+function readGateServer(root) {
+  try {
+    const pkg = JSON.parse(readFileSync(join(root, "package.json"), "utf-8"));
+    const value = pkg?.reddoor?.gateServer;
+    return value === "preview" || value === "dev" ? value : "dev";
+  } catch {
+    return "dev";
+  }
+}
+function resolveGateServer() {
+  const fromEnv = process.env.REDDOOR_GATE_SERVER;
+  if (fromEnv === "preview" || fromEnv === "dev") return fromEnv;
+  return readGateServer(process.cwd());
+}
+var gateServer = resolveGateServer();
+var previewing = gateServer === "preview";
 var playwrightA11yConfig = defineConfig({
   testDir: "tests",
   testMatch: /.*\.spec\.ts$/,
@@ -78,8 +96,15 @@ var playwrightA11yConfig = defineConfig({
     // --strictPort now only bites if the allocated port is taken in the window
     // between releasing and binding it, which is exactly the case worth failing
     // on.
-    command: `npm run vite:dev -- --port ${port} --strictPort`,
-    url: `http://localhost:${port}/dev/a11y-fixtures`,
+    //
+    // gateServer (#700): `preview` builds the site and serves the real bundle
+    // instead. The probe URL moves with it, and that move is the whole trap
+    // this had to avoid — `/dev/a11y-fixtures` is a dev fixture route with no
+    // guarantee of surviving a production build, so a flip that kept probing it
+    // would hang for the full webServer timeout on every opted-in site and
+    // report it as the site's failure. `/` is the one route every site serves.
+    command: previewing ? `npm run build && npm run preview -- --port ${port} --strictPort` : `npm run vite:dev -- --port ${port} --strictPort`,
+    url: previewing ? `http://localhost:${port}/` : `http://localhost:${port}/dev/a11y-fixtures`,
     // NEVER reuse (#524). This used to be `!process.env.CI`, so local runs
     // reused whatever answered the probe URL. The probe only asks "does this
     // respond?" — never "is this serving the code I am about to test?" — so a
@@ -95,7 +120,11 @@ var playwrightA11yConfig = defineConfig({
     // Because the port above is allocated rather than fixed, your own dev
     // server on 5173 keeps running untouched.
     reuseExistingServer: false,
-    timeout: 12e4
+    // A vite boot is ~10-20s, so 120s covered it with room. A production build
+    // with prerendering is minutes, and the budget has to cover build + serve
+    // or the run dies on "Timed out waiting ... from config.webServer" while
+    // the build was still working.
+    timeout: previewing ? 5 * 6e4 : 12e4
   }
 });
 var playwright_a11y_default = playwrightA11yConfig;
@@ -103,6 +132,7 @@ var playwright_a11y_default = playwrightA11yConfig;
 export {
   a11yRoutes,
   smokeRoutes,
+  readGateServer,
   playwright_a11y_default
 };
-//# sourceMappingURL=chunk-YLYXW5PH.js.map
+//# sourceMappingURL=chunk-CXICCLNM.js.map

package/dist/chunk-CXICCLNM.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/configs/playwright-a11y.ts"],"sourcesContent":["import { execFileSync } from \"node:child_process\";\nimport { readFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { defineConfig, devices, type PlaywrightTestConfig } from \"@playwright/test\";\n\nexport type A11yRoute = { path: string; name: string };\n\nexport const a11yRoutes: A11yRoute[] = [\n  { path: \"/dev/a11y-fixtures\", name: \"a11y fixtures\" },\n  { path: \"/dev/animate-in\", name: \"animate-in demo\" },\n];\n\n// Routes smoke-loaded for client-side (hydration) errors only — NOT axe-scanned.\n// Catches the class of bug where build + SSR succeed but client hydration throws\n// and blanks the page (data-dynamiq 2026-06-09: a Svelte 4->5 `run()` referenced\n// a `$state` declared after it → TDZ ReferenceError on hydrate). `/` is the one\n// route every site has; real routes carry a11y debt we don't gate on here, so we\n// assert only that they don't crash on hydrate.\nexport const smokeRoutes: A11yRoute[] = [{ path: \"/\", name: \"home\" }];\n\n// R1.1 (health-gate): the central `smoke` audit (src/audits/smoke.ts) allocates\n// a free port and passes it as REDDOOR_SMOKE_PORT so a zombie vite already\n// squatting the default 5173 can't silently hijack the run and green a stale\n// build. The per-site R1.1 config template honors it, but sites whose\n// playwright.config.ts merely re-exports this shared base (pre-R1.1 adopters\n// the smoke-suite recipe flags-but-never-rewrites) would otherwise ignore it —\n// so honor it here too and every re-exporter inherits the port binding on its\n// next package bump. Unset (local `pnpm test:smoke`) → the fixed 5173.\nconst smokePort = process.env.REDDOOR_SMOKE_PORT;\n\n/**\n * Allocate a free port SYNCHRONOUSLY, for the local path where nothing handed\n * us one. Same trick as src/util/free-port.ts (bind :0, read the assigned port,\n * release it) — but that is async, and this value is needed at module scope\n * while Playwright is still building the config object.\n *\n * It cannot be an async default export instead: sites consume this base by\n * SPREADING it (`{ ...base, use: { ...base.use } }` — see the smoke-suite\n * recipe template). Spreading a Promise yields none of its properties, so the\n * site would get a silently empty config — the exact false-green this whole\n * change exists to remove. The export must stay a plain object.\n *\n * A subprocess is the cost of that constraint: ~30-50ms, once per Playwright\n * run. On any failure we return null and the caller falls back to 5173, which\n * (with reuseExistingServer now false) degrades to a loud \"port already in use\"\n * rather than a silent wrong-server run.\n */\nfunction allocateFreePortSync(): string | null {\n  try {\n    const out = execFileSync(\n      process.execPath,\n      [\n        \"-e\",\n        'const s=require(\"node:net\").createServer();s.on(\"error\",()=>process.exit(1));' +\n          's.listen(0,\"127.0.0.1\",()=>{const p=s.address().port;s.close(()=>process.stdout.write(String(p)))});',\n      ],\n      { encoding: \"utf8\", timeout: 5_000, stdio: [\"ignore\", \"pipe\", \"ignore\"] },\n    ).trim();\n    return /^\\d+$/.test(out) ? out : null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Resolve the port this run binds to, ONCE per run rather than once per\n * evaluation of this file.\n *\n * REDDOOR_SMOKE_PORT (the central audit already allocated one) wins; otherwise\n * this run allocates its own. The old fallback was the fixed 5173 — the same\n * port a dev server sits on, which is what let `reuseExistingServer` silently\n * hijack local runs (#524).\n *\n * The allocation is pinned back into the environment, and that is the whole\n * point. Playwright re-evaluates the config file in EVERY worker process, not\n * just the main one. Allocating per evaluation gave each worker a different\n * port: the main process started the dev server on one, every worker aimed\n * `baseURL` at another, and the run died with ERR_CONNECTION_REFUSED against a\n * handful of ports nothing was ever serving. Workers are forked and inherit\n * this environment, so writing it back makes every later evaluation agree.\n *\n * It broke on the site suites and not on `audit --only a11y`, which writes its\n * own config and never reads this file — so nothing here caught it.\n */\nfunction resolvePort(): string {\n  if (smokePort) return smokePort;\n  const allocated = allocateFreePortSync() || \"5173\";\n  process.env.REDDOOR_SMOKE_PORT = allocated;\n  return allocated;\n}\n\nconst port = resolvePort();\n\nexport type GateServer = \"dev\" | \"preview\";\n\n/**\n * Which server this run puts under test, read from the site's own\n * `package.json#reddoor.gateServer`. Unknown values, a missing key, a missing\n * or malformed package.json all read as `\"dev\"` — this is evaluated in every\n * Playwright worker process at config load, so it must never throw, and the\n * value is interpolated into a shell command, so an unrecognized one must never\n * be forwarded (`\"prod\"` would run `npm run prod`).\n */\nexport function readGateServer(root: string): GateServer {\n  try {\n    const pkg = JSON.parse(readFileSync(join(root, \"package.json\"), \"utf-8\")) as {\n      reddoor?: { gateServer?: unknown };\n    };\n    const value = pkg?.reddoor?.gateServer;\n    return value === \"preview\" || value === \"dev\" ? value : \"dev\";\n  } catch {\n    return \"dev\";\n  }\n}\n\n/**\n * REDDOOR_GATE_SERVER overrides the package.json key, so a one-off CI run can\n * exercise the built bundle without a commit — the same shape as\n * REDDOOR_SMOKE_PORT above. `process.cwd()` is the site root: Playwright is\n * invoked from there both by `pnpm test:smoke` and by the central smoke audit.\n */\nfunction resolveGateServer(): GateServer {\n  const fromEnv = process.env.REDDOOR_GATE_SERVER;\n  if (fromEnv === \"preview\" || fromEnv === \"dev\") return fromEnv;\n  return readGateServer(process.cwd());\n}\n\nconst gateServer = resolveGateServer();\nconst previewing = gateServer === \"preview\";\n\n// NOTE: default export only — sites consume this as `import base from\n// \"@reddoorla/maintenance/configs/playwright-a11y\"` (or re-export the default).\n// The old `playwrightA11yConfig` named alias had zero importers and was removed.\nconst playwrightA11yConfig: PlaywrightTestConfig = defineConfig({\n  testDir: \"tests\",\n  testMatch: /.*\\.spec\\.ts$/,\n  fullyParallel: true,\n  forbidOnly: !!process.env.CI,\n  retries: process.env.CI ? 2 : 0,\n  reporter: process.env.CI ? \"github\" : \"list\",\n  use: {\n    baseURL: `http://localhost:${port}`,\n    trace: \"on-first-retry\",\n    // Emulate reduced motion fleet-wide: scrollIntoView lands instantly rather\n    // than animating, so Playwright's actionability checks don't flake under\n    // parallel load, and view transitions fall back to instant. Pairs with the\n    // prefers-reduced-motion gate on scroll-behavior in every site's app.css.\n    //\n    // It MUST sit under `contextOptions` — `reducedMotion` is a\n    // BrowserContextOptions member, not a top-level test option. reddoor-starter\n    // carried it at the top level of `use` from 2026-06 until 2026-09-01, where\n    // Playwright silently ignored it (unknown keys are dropped at runtime) and\n    // `pnpm check` never flagged it because svelte-check does not typecheck\n    // playwright.config.ts. The emulation was inert that whole time.\n    contextOptions: { reducedMotion: \"reduce\" as const },\n  },\n  projects: [\n    {\n      name: \"chromium\",\n      use: { ...devices[\"Desktop Chrome\"] },\n    },\n  ],\n  webServer: {\n    // Portable across pnpm and npm sites — pnpm respects `npm run` too.\n    //\n    // `--port ... --strictPort` in BOTH cases. It used to be applied only when\n    // REDDOOR_SMOKE_PORT allocated one, on the reasoning that we should \"fail\n    // loudly rather than let vite drift to a free port the baseURL doesn't\n    // point at\" — but that argument covers the unset case just as well. 5173 is\n    // equally a fixed port that `baseURL` and the readiness probe below are\n    // pinned to, and vite left to itself drifts off it whenever something else\n    // holds it.\n    //\n    // The symptom that exposed this: a non-vite process on 5173 sends vite to\n    // 5174 while the probe keeps polling 5173, so the run dies on\n    // \"Timed out waiting 120000ms from config.webServer\" — 120 seconds of\n    // nothing, naming neither the port nor the squatter. With --strictPort it\n    // is an immediate \"Port 5173 is already in use\".\n    //\n    // --strictPort now only bites if the allocated port is taken in the window\n    // between releasing and binding it, which is exactly the case worth failing\n    // on.\n    //\n    // gateServer (#700): `preview` builds the site and serves the real bundle\n    // instead. The probe URL moves with it, and that move is the whole trap\n    // this had to avoid — `/dev/a11y-fixtures` is a dev fixture route with no\n    // guarantee of surviving a production build, so a flip that kept probing it\n    // would hang for the full webServer timeout on every opted-in site and\n    // report it as the site's failure. `/` is the one route every site serves.\n    command: previewing\n      ? `npm run build && npm run preview -- --port ${port} --strictPort`\n      : `npm run vite:dev -- --port ${port} --strictPort`,\n    url: previewing ? `http://localhost:${port}/` : `http://localhost:${port}/dev/a11y-fixtures`,\n    // NEVER reuse (#524). This used to be `!process.env.CI`, so local runs\n    // reused whatever answered the probe URL. The probe only asks \"does this\n    // respond?\" — never \"is this serving the code I am about to test?\" — so a\n    // dev server left open, or one whose tree changed under it after a\n    // checkout, silently became the system under test. That fails in both\n    // directions: a false red blamed on the code (beachfront 2026-08-12, where\n    // it was investigated as a macOS-vs-Linux difference and written up as one\n    // before being caught), and a false green where a passing suite ran against\n    // an old build. CI already had it false, and that asymmetry is precisely\n    // what made the failure read as a platform bug.\n    //\n    // The cost is a fresh vite boot per run (~10-20s against a ~2min suite).\n    // Because the port above is allocated rather than fixed, your own dev\n    // server on 5173 keeps running untouched.\n    reuseExistingServer: false,\n    // A vite boot is ~10-20s, so 120s covered it with room. A production build\n    // with prerendering is minutes, and the budget has to cover build + serve\n    // or the run dies on \"Timed out waiting ... from config.webServer\" while\n    // the build was still working.\n    timeout: previewing ? 5 * 60_000 : 120_000,\n  },\n});\n\nexport default playwrightA11yConfig;\n"],"mappings":";AAAA,SAAS,oBAAoB;AAC7B,SAAS,oBAAoB;AAC7B,SAAS,YAAY;AACrB,SAAS,cAAc,eAA0C;AAI1D,IAAM,aAA0B;AAAA,EACrC,EAAE,MAAM,sBAAsB,MAAM,gBAAgB;AAAA,EACpD,EAAE,MAAM,mBAAmB,MAAM,kBAAkB;AACrD;AAQO,IAAM,cAA2B,CAAC,EAAE,MAAM,KAAK,MAAM,OAAO,CAAC;AAUpE,IAAM,YAAY,QAAQ,IAAI;AAmB9B,SAAS,uBAAsC;AAC7C,MAAI;AACF,UAAM,MAAM;AAAA,MACV,QAAQ;AAAA,MACR;AAAA,QACE;AAAA,QACA;AAAA,MAEF;AAAA,MACA,EAAE,UAAU,QAAQ,SAAS,KAAO,OAAO,CAAC,UAAU,QAAQ,QAAQ,EAAE;AAAA,IAC1E,EAAE,KAAK;AACP,WAAO,QAAQ,KAAK,GAAG,IAAI,MAAM;AAAA,EACnC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAsBA,SAAS,cAAsB;AAC7B,MAAI,UAAW,QAAO;AACtB,QAAM,YAAY,qBAAqB,KAAK;AAC5C,UAAQ,IAAI,qBAAqB;AACjC,SAAO;AACT;AAEA,IAAM,OAAO,YAAY;AAYlB,SAAS,eAAe,MAA0B;AACvD,MAAI;AACF,UAAM,MAAM,KAAK,MAAM,aAAa,KAAK,MAAM,cAAc,GAAG,OAAO,CAAC;AAGxE,UAAM,QAAQ,KAAK,SAAS;AAC5B,WAAO,UAAU,aAAa,UAAU,QAAQ,QAAQ;AAAA,EAC1D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAQA,SAAS,oBAAgC;AACvC,QAAM,UAAU,QAAQ,IAAI;AAC5B,MAAI,YAAY,aAAa,YAAY,MAAO,QAAO;AACvD,SAAO,eAAe,QAAQ,IAAI,CAAC;AACrC;AAEA,IAAM,aAAa,kBAAkB;AACrC,IAAM,aAAa,eAAe;AAKlC,IAAM,uBAA6C,aAAa;AAAA,EAC9D,SAAS;AAAA,EACT,WAAW;AAAA,EACX,eAAe;AAAA,EACf,YAAY,CAAC,CAAC,QAAQ,IAAI;AAAA,EAC1B,SAAS,QAAQ,IAAI,KAAK,IAAI;AAAA,EAC9B,UAAU,QAAQ,IAAI,KAAK,WAAW;AAAA,EACtC,KAAK;AAAA,IACH,SAAS,oBAAoB,IAAI;AAAA,IACjC,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAYP,gBAAgB,EAAE,eAAe,SAAkB;AAAA,EACrD;AAAA,EACA,UAAU;AAAA,IACR;AAAA,MACE,MAAM;AAAA,MACN,KAAK,EAAE,GAAG,QAAQ,gBAAgB,EAAE;AAAA,IACtC;AAAA,EACF;AAAA,EACA,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IA2BT,SAAS,aACL,8CAA8C,IAAI,kBAClD,8BAA8B,IAAI;AAAA,IACtC,KAAK,aAAa,oBAAoB,IAAI,MAAM,oBAAoB,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAexE,qBAAqB;AAAA;AAAA;AAAA;AAAA;AAAA,IAKrB,SAAS,aAAa,IAAI,MAAS;AAAA,EACrC;AACF,CAAC;AAED,IAAO,0BAAQ;","names":[]}

package/dist/{chunk-BYGPUUCT.js → chunk-DRNZVORX.js}

@@ -1,29 +1,31 @@
 import {
+  createReportDraft,
   queueDraft
-} from "./chunk-YFAXOD7Z.js";
-import {
-  createDraft,
-  listReportsForSite
-} from "./chunk-F3JWOPTG.js";
+} from "./chunk-UPE6D4AT.js";
 import {
   checklistFor,
   gatingFields
 } from "./chunk-VAD43MOR.js";
 import {
   uploadAttachment
-} from "./chunk-IY6256GK.js";
+} from "./chunk-YJBSB4LP.js";
 import {
   renderReportHtml,
   resolveCopy
 } from "./chunk-KJGKZLCT.js";
 import {
   generateHeaderImage
-} from "./chunk-5UINJNAJ.js";
+} from "./chunk-LZMAG73U.js";
 import {
-  siteSlug,
+  analyticsHealthFields,
   updateAnalyticsHealth
-} from "./chunk-3Z6X3BHU.js";
+} from "./chunk-TC4GANMX.js";
+import {
+  siteSlug
+} from "./chunk-ICSRWW5Q.js";
 import {
+  hostnameOf,
+  isHttpUrl,
   isNetlifyAppUrl
 } from "./chunk-RARREDQE.js";
 import {
@@ -353,6 +355,13 @@ async function withSubjectFailover(subjects, label, attempt) {
 // src/reports/ga/client.ts
 var ANALYTICS_READONLY = "https://www.googleapis.com/auth/analytics.readonly";
 var MS_PER_DAY2 = 864e5;
+function measuredHostnames(siteUrl) {
+  if (!isHttpUrl(siteUrl)) return [];
+  const host = hostnameOf(siteUrl).toLowerCase();
+  if (!host.includes(".")) return [];
+  const apex = host.startsWith("www.") ? host.slice(4) : host;
+  return [apex, `www.${apex}`];
+}
 function ymd(d) {
   return d.toISOString().slice(0, 10);
 }
@@ -374,7 +383,18 @@ async function fetchPeriodUsers(query, periodStart, periodEnd) {
       const [resp] = await client.runReport({
         property,
         dateRanges: [{ startDate: ymd(start), endDate: ymd(end) }],
-        metrics: [{ name: "activeUsers" }]
+        metrics: [{ name: "activeUsers" }],
+        // Only the site's own hosts. Omitted entirely when we have no usable
+        // hostname, so the number degrades to the old unfiltered one instead
+        // of to zero.
+        ...query.hostnames.length > 0 ? {
+          dimensionFilter: {
+            filter: {
+              fieldName: "hostName",
+              inListFilter: { values: query.hostnames }
+            }
+          }
+        } : {}
       });
       const raw = resp.rows?.[0]?.metricValues?.[0]?.value ?? "0";
       const n = Number.parseInt(raw, 10);
@@ -523,9 +543,15 @@ function daysAgo(today, n) {
 }
 async function draftReportForSite(base, siteRow, reportType, options = {}) {
   const scores = scoresFromWebsite(siteRow);
+  const store = options.previewOnly ? null : options.reportMirror ?? null;
+  if (!options.previewOnly && !store) {
+    throw new Error(
+      "draftReportForSite: a reportMirror is required when previewOnly=false \u2014 Turso owns the report row since #646 step 4, and the caller (a CLI command or recipe) wires it at its composition root"
+    );
+  }
   const today = /* @__PURE__ */ new Date();
   const slug = siteSlug(siteRow.name);
-  const periodStart = base !== null ? await derivePeriodStart(base, siteRow, reportType, today) : daysAgo(today, 30);
+  const periodStart = store ? await derivePeriodStart(store, siteRow, reportType, today) : daysAgo(today, 30);
   const periodEnd = today;
   const completedOn = today;
   const lastTestedDate = reportType === "Maintenance" && siteRow.lastLighthouseAuditAt ? new Date(siteRow.lastLighthouseAuditAt) : null;
@@ -582,23 +608,29 @@ async function draftReportForSite(base, siteRow, reportType, options = {}) {
   }
   if (base === null) throw new Error("base required when previewOnly=false");
   if (readGaConfig() !== null && Boolean(siteRow.ga4PropertyId || siteRow.searchQuery)) {
+    const at = softFailures.length > 0 ? today.toISOString() : null;
+    const fields = analyticsHealthFields(at);
     try {
-      const fields = await updateAnalyticsHealth(
-        base,
-        siteRow.id,
-        softFailures.length > 0 ? today.toISOString() : null
-      );
       await options.siteMirror?.health(siteRow.id, fields);
     } catch (e) {
-      console.warn(`\u26A0 analytics-health write skipped for ${siteRow.name}: ${e.message}`);
+      console.warn(
+        `\u26A0 analytics-health Turso mirror failed for ${siteRow.name}: ${e.message}`
+      );
+    }
+    try {
+      await updateAnalyticsHealth(base, siteRow.id, at);
+    } catch (e) {
+      console.warn(
+        `\u26A0 analytics-health Airtable shadow write skipped for ${siteRow.name}: ${e.message}`
+      );
     }
   }
   if (options.completeRowId) {
-    await uploadDraftHtml(options.completeRowId, slug, periodEnd, html, options.reportMirror);
+    await uploadDraftHtml(options.completeRowId, slug, periodEnd, html, store);
     const outcome2 = await queueDraft(
       base,
       { id: options.completeRowId, siteId: siteRow.id, reportType },
-      options.reportMirror
+      store
     );
     return {
       reportRow: options.existingRow ?? null,
@@ -615,8 +647,7 @@ async function draftReportForSite(base, siteRow, reportType, options = {}) {
   const checklistTicks = [...evidence.entries()].filter(([, e]) => e.result === "pass").map(([field]) => field);
   const autoEvidence = Object.fromEntries(evidence);
   const reportId = `${siteRow.name} \u2014 ${reportType} \u2014 ${periodEnd.toISOString().slice(0, 10)}`;
-  const created = await createDraft(
-    base,
+  const created = await createReportDraft(
     {
       reportId,
       siteId: siteRow.id,
@@ -633,13 +664,13 @@ async function draftReportForSite(base, siteRow, reportType, options = {}) {
       checklistTicks,
       autoEvidence
     },
-    options.reportMirror?.created
+    { create: store.create }
   );
-  await uploadDraftHtml(created.id, slug, periodEnd, html, options.reportMirror);
+  await uploadDraftHtml(created.id, slug, periodEnd, html, store);
   const outcome = await queueDraft(
     base,
     { id: created.id, siteId: siteRow.id, reportType },
-    options.reportMirror
+    store
   );
   return {
     reportRow: created,
@@ -652,10 +683,10 @@ async function draftReportForSite(base, siteRow, reportType, options = {}) {
     supersededIds: outcome.supersededIds
   };
 }
-async function uploadDraftHtml(rowId, slug, periodEnd, html, mirror) {
+async function uploadDraftHtml(rowId, slug, periodEnd, html, store) {
   const htmlFilename = `${slug}-${periodEnd.toISOString().slice(0, 10)}.html`;
   await uploadAttachment(rowId, "Rendered HTML", html, htmlFilename, "text/html");
-  await mirror?.body(rowId, html);
+  await store.body(rowId, html);
 }
 var NO_ENRICHMENT = { value: null, softFailed: false };
 async function fetchGaUsers(siteRow, periodStart, periodEnd) {
@@ -663,7 +694,12 @@ async function fetchGaUsers(siteRow, periodStart, periodEnd) {
   if (!cfg || !siteRow.ga4PropertyId) return NO_ENRICHMENT;
   try {
     const value = await fetchPeriodUsers(
-      { propertyId: siteRow.ga4PropertyId, subjects: cfg.subjects, keyPath: cfg.keyPath },
+      {
+        propertyId: siteRow.ga4PropertyId,
+        subjects: cfg.subjects,
+        keyPath: cfg.keyPath,
+        hostnames: measuredHostnames(siteRow.url)
+      },
       periodStart,
       periodEnd
     );
@@ -724,8 +760,8 @@ async function fetchSearch(siteRow, periodStart, periodEnd) {
     };
   }
 }
-async function derivePeriodStart(base, siteRow, reportType, today) {
-  const prior = await listReportsForSite(base, siteRow.id);
+async function derivePeriodStart(store, siteRow, reportType, today) {
+  const prior = await store.forSite(siteRow.id);
   const sameType = prior.filter((r) => r.reportType === reportType && r.periodEnd).map((r) => r.periodEnd).sort();
   const latest = sameType[sameType.length - 1];
   if (!latest) return daysAgo(today, 30);
@@ -741,4 +777,4 @@ export {
   fetchGaUsers,
   fetchSearch
 };
-//# sourceMappingURL=chunk-BYGPUUCT.js.map
+//# sourceMappingURL=chunk-DRNZVORX.js.map

package/dist/chunk-DRNZVORX.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/reports/ga/config.ts","../src/reports/draft.ts","../src/reports/auto-tick.ts","../src/reports/ga/client.ts","../src/reports/ga/failover.ts","../src/reports/search/client.ts"],"sourcesContent":["import { dirname, join } from \"node:path\";\nimport { defaultCredentialsPath } from \"../../util/credentials.js\";\n\nexport type GaConfig = {\n  /** Workspace users the service account impersonates (domain-wide delegation), in\n   *  failover order — the first subject that authenticates wins. */\n  subjects: string[];\n  /** Absolute path to the service-account JSON key file. */\n  keyPath: string;\n};\n\n/**\n * Read GA configuration from the environment (credentials.env is already loaded into\n * process.env by the CLI entrypoint). Returns null when `GA_SUBJECT` is unset/blank — the\n * signal that GA enrichment is simply not configured, so drafting skips it silently.\n *\n * `GA_SUBJECT` is a comma-separated list of impersonation subjects tried in order\n * (e.g. `reports@reddoorla.com,person@reddoorla.com`), so losing one Workspace account\n * degrades to a logged failover instead of blanking the whole fleet's analytics; a single\n * address remains the degenerate one-element case. Entries are trimmed, empties dropped.\n *\n * `GA_SA_KEY_PATH` is optional; it defaults to `ga-service-account.json` alongside the\n * credentials file (e.g. ~/.config/reddoor-maint/), keeping the key out of the repo.\n */\nexport function readGaConfig(): GaConfig | null {\n  const subjects = (process.env.GA_SUBJECT ?? \"\")\n    .split(\",\")\n    .map((s) => s.trim())\n    .filter(Boolean);\n  if (subjects.length === 0) return null;\n  const keyPath =\n    process.env.GA_SA_KEY_PATH?.trim() ||\n    join(dirname(defaultCredentialsPath()), \"ga-service-account.json\");\n  return { subjects, keyPath };\n}\n","import { mkdir, writeFile } from \"node:fs/promises\";\nimport { dirname } from \"node:path\";\nimport type { ReportType, LighthouseScores } from \"./types.js\";\nimport { renderReportHtml } from \"./render.js\";\nimport { analyticsHealthFields, siteSlug, updateAnalyticsHealth } from \"./airtable/websites.js\";\nimport { resolveCopy } from \"./copy.js\";\nimport type { WebsiteRow } from \"./airtable/websites.js\";\nimport type { ReportRow } from \"./airtable/reports.js\";\nimport { createReportDraft } from \"./create-report.js\";\nimport type { ReportMirror } from \"./report-mirror.js\";\nimport type { SiteMirror } from \"../db/site-mirror.js\";\nimport { queueDraft } from \"./queue.js\";\nimport { autoTickChecklist } from \"./auto-tick.js\";\nimport { uploadAttachment } from \"./airtable/attachments.js\";\nimport type { AirtableBase } from \"./airtable/client.js\";\nimport { readGaConfig } from \"./ga/config.js\";\nimport { fetchPeriodUsers, measuredHostnames } from \"./ga/client.js\";\nimport { fetchSearchPresence } from \"./search/client.js\";\nimport type { SearchPresence } from \"./search/client.js\";\nimport { generateHeaderImage } from \"./header-image/index.js\";\nimport type { GeneratedHeaderImage } from \"./header-image/index.js\";\n\nexport type RefreshHeaderDeps = {\n  generate?: (input: { url: string; slug?: string }) => Promise<GeneratedHeaderImage>;\n  upload?: (\n    recordId: string,\n    field: string,\n    bytes: Uint8Array,\n    filename: string,\n    contentType: string,\n    opts?: { replaceIn?: string },\n  ) => Promise<void>;\n};\n\n/**\n * Regenerate a site's Header image from its live homepage so the report ships a\n * current screenshot rather than one frozen whenever the image was last made by\n * hand. Sonder alone runs 16 reports a year, so a static header goes visibly\n * stale.\n *\n * BEST-EFFORT BY DESIGN — returns false and never throws. A capture or upload\n * failure must not fail the draft: the stored image is still perfectly usable,\n * and the operator reviews the rendered preview before approving the send.\n */\nexport async function refreshHeaderImage(\n  site: WebsiteRow,\n  deps: RefreshHeaderDeps = {},\n): Promise<boolean> {\n  if (!site.url) return false;\n  const generate = deps.generate ?? generateHeaderImage;\n  const upload = deps.upload ?? uploadAttachment;\n  try {\n    const gen = await generate({ url: site.url, slug: siteSlug(site.name) });\n    await upload(site.id, \"Header image\", gen.bytes, gen.filename, gen.contentType, {\n      replaceIn: \"Websites\",\n    });\n    return true;\n  } catch (err) {\n    console.warn(\n      `⚠ header-image refresh skipped for ${site.name}: ${\n        err instanceof Error ? err.message : String(err)\n      } — keeping the stored image`,\n    );\n    return false;\n  }\n}\n\nexport type DraftOptions = {\n  /** Where to write the local preview HTML when `previewOnly`. Defaults to `reports/<slug>/draft.html`. */\n  previewPath?: string;\n  /** If true: render locally only, never touch Airtable. */\n  previewOnly?: boolean;\n  /** Whether to run the GA / Search Console enrichment fetches. Defaults to\n   *  `base !== null`, i.e. the real drafting path enriches and a preview does not.\n   *\n   *  This exists because `base === null` was carrying two unrelated meanings —\n   *  \"never write to Airtable\" AND \"perform no IO at all\" — and only the first is\n   *  what `previewOnly` actually asks for. Enrichment reads Google; it writes\n   *  nothing, so there is no reason a preview cannot do it on request. Conflating\n   *  the two made the preview path structurally incapable of ever producing an\n   *  ANALYTICS section, which in turn made a CI job built to prove the GA secrets\n   *  fail 100% of the time and report it as a credential outage (2026-08-12). Set\n   *  this true to render a preview that exercises the credentials for real. */\n  enrich?: boolean;\n  /** UTC \"YYYY-MM\" recurrence key; falls back to periodEnd's month when omitted. */\n  period?: string;\n  /** Airtable record id of an EXISTING (not-ready) row to COMPLETE in place rather\n   *  than creating a new one. When set, we skip createDraft and only re-render →\n   *  upload the HTML attachment → flip Draft ready on this row. Used by the --due\n   *  re-draft path to finish a draft whose createDraft succeeded but whose\n   *  setDraftReady never ran (a crash mid-sequence wedged the period). */\n  completeRowId?: string;\n  /** The mapped ReportRow being completed, returned as `reportRow` from the\n   *  complete path so callers keep the same shape they get on the create path. */\n  existingRow?: ReportRow;\n  /** Injected deps for the draft-time header refresh, or `false` to skip it\n   *  entirely. Tests set `false` (or a stub) so a unit suite never launches a\n   *  browser or resolves DNS. Production leaves it unset and gets the real thing. */\n  refreshHeader?: RefreshHeaderDeps | false;\n  /** #539 Phase 5: Turso write-through for everything this function writes to\n   *  Airtable — the created row, the rendered body, and the queue flag — so a\n   *  fresh draft is fully readable in the Turso-backed console immediately\n   *  instead of after the next hourly sync.\n   *\n   *  Deliberately NOT defaulted here. Defaulting would open a real libSQL handle\n   *  from inside `draftReportForSite`, which every unit test calls — and on a\n   *  machine with TURSO_* exported that means a test suite writing rows into\n   *  production. The wiring lives at the composition roots (cli/commands/report.ts,\n   *  recipes) where it is pinned by test, the same division `runFleetWriteBack`\n   *  uses for the health mirror. */\n  reportMirror?: ReportMirror;\n  /** #539 Phase 5: the Websites-row twin of `reportMirror`. Drafting stamps\n   *  `Analytics soft-fail at` on the SITE row, which is a different Turso table\n   *  and a different mirror. Injected for the same reason — see reportMirror. */\n  siteMirror?: SiteMirror;\n};\n\n/** An enrichment fetch that *errored* (not one that was legitimately skipped\n *  because it isn't configured / the site lacks the inputs). Surfaced so a\n *  fleet-wide GA/Search outage is visible in a `--due` batch summary instead of\n *  hiding behind one easily-missed console.warn per site. */\nexport type SoftFailure = \"ga\" | \"search\";\n\nexport type DraftResult = {\n  /** null when previewOnly. */\n  reportRow: ReportRow | null;\n  /** Path to the local preview file (only set when previewOnly). */\n  htmlPath: string | null;\n  /** Always present — the rendered HTML string. */\n  html: string;\n  /** Enrichment fetches that errored for this site (empty on success or skip). */\n  softFailures: SoftFailure[];\n  /** True when search enrichment fell back to the site name (no explicit `Search query`)\n   *  AND that default matched nothing in Search Console — the signal that this site needs\n   *  a hand-tuned brand query. Distinct from a soft-failure/outage: the fetch succeeded, it\n   *  just found no data for the name. Requires a property to have RESOLVED — a site with no\n   *  Search Console property at all raises `searchPropertyMissing` instead (a query change\n   *  can't fix that, and prescribing one would silence the real problem). */\n  searchDefaultMissed: boolean;\n  /** True when NO Search Console property matched the site for any subject — a\n   *  missing/unverified property or lost service-account access. Fires for BOTH explicit\n   *  and name-default queries (unlike `searchDefaultMissed`), because no query can succeed\n   *  without a property. Distinct from a soft-failure: the API worked, the property list\n   *  just contained nothing for this site. */\n  searchPropertyMissing: boolean;\n  /** Whether the draft was placed in the approve queue. False when a higher-or-equal-tier\n   *  report is already queued for the site (single-queue rule); null on the previewOnly path. */\n  queued: boolean | null;\n  /** Ids of lower-tier queued reports this draft superseded (un-queued). */\n  supersededIds: string[];\n};\n\nfunction scoresFromWebsite(siteRow: WebsiteRow): LighthouseScores {\n  const { pScore, rScore, bpScore, seoScore } = siteRow;\n  if (pScore === null || rScore === null || bpScore === null || seoScore === null) {\n    throw new Error(\n      `Site '${siteRow.name}' is missing one or more Lighthouse scores on the Websites row (pScore, rScore, bpScore, seoScore). ` +\n        `Run 'reddoor-maint audit lighthouse' from the site's checkout and paste the four numbers into Airtable, then retry.`,\n    );\n  }\n  return { performance: pScore, accessibility: rScore, bestPractices: bpScore, seo: seoScore };\n}\n\nfunction daysAgo(today: Date, n: number): Date {\n  // UTC accessors to stay TZ-consistent with `due.ts` (and avoid landing\n  // Airtable's `Period start` on a different calendar day than the operator\n  // expects on late-night runs near a month boundary). See morning brief\n  // 2026-05-29 (M1) for context.\n  const out = new Date(today);\n  out.setUTCDate(out.getUTCDate() - n);\n  return out;\n}\n\n/**\n * Render and create an Airtable draft for one site.\n *\n * No idempotency guard here — the recurrence guard lives in draftDueReports\n * (cli/commands/report.ts), keyed on reportPeriodKey(dueDate).  The manual\n * single-site path intentionally always drafts (an operator asking for a draft\n * gets one).  findReportByPeriod (airtable/reports.ts) is the real-Airtable\n * point lookup available to dashboard/digest callers that need the same\n * idempotency guarantee outside the CLI batch loop.\n */\nexport async function draftReportForSite(\n  base: AirtableBase | null,\n  siteRow: WebsiteRow,\n  reportType: ReportType,\n  options: DraftOptions = {},\n): Promise<DraftResult> {\n  const scores = scoresFromWebsite(siteRow);\n\n  // #646 step 4: Turso mints the report id and owns the row, so the report writer\n  // is required on every path that creates or completes one — it is also what the\n  // period derivation below reads through. Checked FIRST so a missing dependency\n  // fails before a GA fetch and a full render, not after.\n  const store = options.previewOnly ? null : (options.reportMirror ?? null);\n  if (!options.previewOnly && !store) {\n    throw new Error(\n      \"draftReportForSite: a reportMirror is required when previewOnly=false — \" +\n        \"Turso owns the report row since #646 step 4, and the caller (a CLI command or \" +\n        \"recipe) wires it at its composition root\",\n    );\n  }\n\n  const today = new Date();\n  const slug = siteSlug(siteRow.name);\n\n  const periodStart = store\n    ? await derivePeriodStart(store, siteRow, reportType, today)\n    : daysAgo(today, 30);\n\n  const periodEnd = today;\n  const completedOn = today;\n  // \"Last Tested\" on the Maintenance email is the REAL timestamp of the most recent automated\n  // Lighthouse audit — stamped live on the Websites row (`Last lighthouse audit at`) by\n  // `audit lighthouse --write-back` every time the scores refresh. It is deliberately NOT\n  // the `testing day` field: that's the recurrence anchor consumed by due.ts and is hand-set, so\n  // it goes stale. Reading the audit timestamp keeps the date current with no manual upkeep.\n  const lastTestedDate =\n    reportType === \"Maintenance\" && siteRow.lastLighthouseAuditAt\n      ? new Date(siteRow.lastLighthouseAuditAt)\n      : null;\n\n  // GA enrichment. Soft-fail: any GA problem leaves the numbers null so\n  // the draft still proceeds (operator fills them manually) — GA is an enhancement, not a\n  // gate. Rendered with the fetched numbers so the review HTML matches the Airtable fields.\n  // An *error* (vs a legitimate not-configured skip) is recorded in softFailures so the\n  // caller can surface a fleet-wide outage in the batch summary.\n  // Enrichment is gated on `enrich`, NOT on `base`: reading Google and writing to\n  // Airtable are independent, and only the write is what previewOnly forbids.\n  const shouldEnrich = options.enrich ?? base !== null;\n  const gaResult = shouldEnrich\n    ? await fetchGaUsers(siteRow, periodStart, periodEnd)\n    : NO_ENRICHMENT;\n  const searchResult = shouldEnrich\n    ? await fetchSearch(siteRow, periodStart, periodEnd)\n    : // No-IO render path: nothing was attempted, so this is not an environment gap\n      // (`notConfigured` would wrongly tell the operator to go wire a secret).\n      {\n        ...NO_ENRICHMENT,\n        defaultQueryMissed: false,\n        propertyMissing: false,\n        notConfigured: false,\n      };\n  const gaUsers = gaResult.value;\n  const search = searchResult.value;\n  const softFailures: SoftFailure[] = [\n    ...(gaResult.softFailed ? ([\"ga\"] as const) : []),\n    ...(searchResult.softFailed ? ([\"search\"] as const) : []),\n  ];\n\n  // Header-image refresh (real path only). Regenerated BEFORE the render so the\n  // preview the operator approves carries the same screenshot the client will\n  // receive — the send reads this attachment off the Websites row. Gated on\n  // `base !== null` exactly like the GA/Search enrichment above: the no-IO render\n  // path (base === null, used for pure rendering and tests) must not launch a\n  // browser or write to production Airtable. `refreshHeader: false` is the second\n  // gate, for suites that DO pass a fake base and would otherwise pay a real\n  // chromium launch per case. Production leaves it unset and gets the real\n  // refresh. Best-effort — see refreshHeaderImage.\n  if (base !== null && options.refreshHeader !== false) {\n    await refreshHeaderImage(siteRow, options.refreshHeader ?? {});\n  }\n\n  const cidName = `${slug}-header`;\n  const { html } = await renderReportHtml({\n    siteName: siteRow.name,\n    siteUrl: siteRow.url,\n    reportType,\n    completedOn,\n    lighthouse: scores,\n    gaUsersCurrent: gaUsers?.current,\n    gaUsersPrevious: gaUsers?.previous,\n    searchPosition: search?.foundOnPage1 ? (search.position ?? undefined) : undefined,\n    lastTestedDate,\n    commentary: null,\n    copy: resolveCopy(siteRow),\n    headerImageCid: cidName,\n  });\n\n  if (options.previewOnly) {\n    const path = options.previewPath ?? `reports/${slug}/draft.html`;\n    await mkdir(dirname(path), { recursive: true });\n    await writeFile(path, html, \"utf-8\");\n    return {\n      reportRow: null,\n      htmlPath: path,\n      html,\n      softFailures,\n      searchDefaultMissed: searchResult.defaultQueryMissed,\n      searchPropertyMissing: searchResult.propertyMissing,\n      queued: null,\n      supersededIds: [],\n    };\n  }\n\n  if (base === null) throw new Error(\"base required when previewOnly=false\");\n\n  // Record this site's GA/Search enrichment health for the per-site analytics-failure\n  // signal (cockpit/digest). Only when analytics is configured for THIS site — set the\n  // timestamp on a soft-fail, clear it (null) on a clean enrichment so the signal\n  // self-heals.\n  //\n  // Turso FIRST, in its own try (#782). The Airtable `Analytics soft-fail at` column\n  // is operator-added and has never existed in the base, so that write throws\n  // UNKNOWN_FIELD_NAME on every real draft — and while the Turso mirror sat after it\n  // inside one try, `site_health.analytics_soft_fail_at` was never written either, so\n  // the digest collector reading it was green on a question it could not fail. Turso\n  // is authoritative; Airtable is the best-effort shadow Phase 6 deletes. Both stay\n  // best-effort here: a stamp is re-derived on every draft, so a lost one costs a\n  // period's signal, not the draft the operator is waiting on — and each failure is\n  // logged naming its store.\n  if (readGaConfig() !== null && Boolean(siteRow.ga4PropertyId || siteRow.searchQuery)) {\n    const at = softFailures.length > 0 ? today.toISOString() : null;\n    // One payload for both stores, so the two writes cannot diverge.\n    const fields = analyticsHealthFields(at);\n    try {\n      await options.siteMirror?.health(siteRow.id, fields);\n    } catch (e) {\n      console.warn(\n        `⚠ analytics-health Turso mirror failed for ${siteRow.name}: ${(e as Error).message}`,\n      );\n    }\n    try {\n      await updateAnalyticsHealth(base, siteRow.id, at);\n    } catch (e) {\n      console.warn(\n        `⚠ analytics-health Airtable shadow write skipped for ${siteRow.name}: ${(e as Error).message}`,\n      );\n    }\n  }\n\n  // \"Finish an existing row\" path (the --due re-draft wedge fix). When the caller\n  // hands us a row that was created but never made Draft-ready — a crash between\n  // createDraft and setDraftReady leaves exactly this — we DON'T createDraft again\n  // (that would duplicate the period). We re-attach the rendered HTML and queue the\n  // EXISTING row, completing the half-made draft in place. The row's other fields\n  // (scores, period, dates) were already written at create time; the only pieces a\n  // crash drops are the attachment + the ready flag.\n  if (options.completeRowId) {\n    await uploadDraftHtml(options.completeRowId, slug, periodEnd, html, store!);\n    const outcome = await queueDraft(\n      base,\n      { id: options.completeRowId, siteId: siteRow.id, reportType },\n      store!,\n    );\n    return {\n      reportRow: options.existingRow ?? null,\n      htmlPath: null,\n      html,\n      softFailures,\n      searchDefaultMissed: searchResult.defaultQueryMissed,\n      searchPropertyMissing: searchResult.propertyMissing,\n      queued: outcome.queued,\n      supersededIds: outcome.supersededIds,\n    };\n  }\n\n  // Auto-tick the checklist boxes the system can prove (Phase 1: Google Indexed via the\n  // inline search signal). Fail-safe lives in autoTickChecklist: only `pass` entries are ticked;\n  // the evidence snapshot drives the dashboard's green/amber badges. The operator's approve gate\n  // and per-box override are unchanged.\n  const evidence = autoTickChecklist(siteRow, reportType, completedOn, { search: searchResult });\n  const checklistTicks = [...evidence.entries()]\n    .filter(([, e]) => e.result === \"pass\")\n    .map(([field]) => field);\n  const autoEvidence = Object.fromEntries(evidence);\n\n  const reportId = `${siteRow.name} — ${reportType} — ${periodEnd.toISOString().slice(0, 10)}`;\n  // #646 step 4: the row is MINTED and written in Turso (`report_<ULID>`), not in\n  // Airtable. A `site_<ULID>` site could not be drafted for at all before this —\n  // Airtable has no Websites record for the `Site` link to point at — and the\n  // Airtable Reports row it used to create is now skipped, not written, for the\n  // reason `createReportDraft` states.\n  const created = await createReportDraft(\n    {\n      reportId,\n      siteId: siteRow.id,\n      reportType,\n      period: options.period ?? periodEnd.toISOString().slice(0, 7),\n      periodStart,\n      periodEnd,\n      completedOn,\n      lighthouse: scores,\n      lastTestedDate,\n      ...(gaUsers ? { gaUsersCurrent: gaUsers.current, gaUsersPrevious: gaUsers.previous } : {}),\n      ...(search ? { searchFoundPage1: search.foundOnPage1 } : {}),\n      ...(search?.foundOnPage1 && search.position !== null\n        ? { searchPosition: search.position }\n        : {}),\n      checklistTicks,\n      autoEvidence,\n    },\n    { create: store!.create },\n  );\n\n  await uploadDraftHtml(created.id, slug, periodEnd, html, store!);\n  const outcome = await queueDraft(\n    base,\n    { id: created.id, siteId: siteRow.id, reportType },\n    store!,\n  );\n\n  return {\n    reportRow: created,\n    htmlPath: null,\n    html,\n    softFailures,\n    searchDefaultMissed: searchResult.defaultQueryMissed,\n    searchPropertyMissing: searchResult.propertyMissing,\n    queued: outcome.queued,\n    supersededIds: outcome.supersededIds,\n  };\n}\n\n/** Attach the rendered HTML to a Reports row. Queueing (Draft ready + the single-queue\n *  reconciliation) is handled separately by queueDraft so both the create path and the\n *  \"complete a half-made row\" path share the identical, re-runnable upload step.\n *\n *  #539 Phase 5: the body is ALSO stored in Turso, because that is where the\n *  console's preview route reads it. Storing the row without the body leaves a\n *  visible draft whose preview answers \"No rendered body stored\" until the next\n *  hourly sync re-downloads this very attachment. */\nasync function uploadDraftHtml(\n  rowId: string,\n  slug: string,\n  periodEnd: Date,\n  html: string,\n  store: ReportMirror,\n): Promise<void> {\n  const htmlFilename = `${slug}-${periodEnd.toISOString().slice(0, 10)}.html`;\n  // Airtable's copy of the body is a shadow: `uploadAttachment` skips a report id\n  // Airtable cannot hold (#646 step 3's writer rule), so a minted report's body\n  // lives only in Turso — which is where the console's preview route reads it.\n  await uploadAttachment(rowId, \"Rendered HTML\", html, htmlFilename, \"text/html\");\n  await store.body(rowId, html);\n}\n\n/** Result of an enrichment fetch: the value (null if unavailable) plus whether\n *  it errored (`softFailed`) as opposed to being legitimately not-configured. */\ntype Enrichment<T> = { value: T | null; softFailed: boolean };\n/** A not-configured / skipped enrichment — null value, not a soft-failure. */\nconst NO_ENRICHMENT: Enrichment<never> = { value: null, softFailed: false };\n\n/**\n * Fetch GA \"Users\" for the period, soft-failing to null. Returns a null value (no enrichment)\n * when GA isn't configured (`GA_SUBJECT` unset) or the site has no GA4 property ID — those are\n * legitimate skips, `softFailed: false`. When the GA API errors it logs a one-line warning and\n * returns `softFailed: true`. Never throws, so a GA problem can never block a draft; the\n * operator can always enter the numbers by hand.\n */\nexport async function fetchGaUsers(\n  siteRow: WebsiteRow,\n  periodStart: Date,\n  periodEnd: Date,\n): Promise<Enrichment<{ current: number; previous: number }>> {\n  const cfg = readGaConfig();\n  if (!cfg || !siteRow.ga4PropertyId) return NO_ENRICHMENT;\n  try {\n    const value = await fetchPeriodUsers(\n      {\n        propertyId: siteRow.ga4PropertyId,\n        subjects: cfg.subjects,\n        keyPath: cfg.keyPath,\n        hostnames: measuredHostnames(siteRow.url),\n      },\n      periodStart,\n      periodEnd,\n    );\n    return { value, softFailed: false };\n  } catch (e) {\n    console.warn(`⚠ GA skipped for ${siteRow.name}: ${(e as Error).message}`);\n    return { value: null, softFailed: true };\n  }\n}\n\n/** A search enrichment, plus the two distinct miss flags (see `fetchSearch` /\n *  `DraftResult.searchDefaultMissed` / `DraftResult.searchPropertyMissing`) and the\n *  environment-gap flag `notConfigured`. */\ntype SearchEnrichment = Enrichment<SearchPresence> & {\n  defaultQueryMissed: boolean;\n  propertyMissing: boolean;\n  /** True when the site IS analytics-enrolled but this environment has no GA/SC\n   *  credentials (`GA_SUBJECT` unset) — so the check could not run at all. Distinct\n   *  from the un-enrolled skip (nothing to measure) and from a soft-fail (the API\n   *  errored). See {@link fetchSearch}. */\n  notConfigured: boolean;\n};\n\n/**\n * Fetch the site's Google search presence for the period, soft-failing to null. Runs whenever\n * GA/SA is configured (`readGaConfig()` non-null — search shares the SA credentials) AND the\n * site is analytics-enrolled (has a `ga4PropertyId` OR an explicit `searchQuery`); otherwise a\n * legitimate skip (null value, `softFailed: false`). The brand query defaults to the site NAME\n * when no explicit `searchQuery` is set (whitespace-only counts as unset) — so brand presence is\n * tracked automatically, and the operator only hand-tunes the handful of sites the name misses.\n *\n * `propertyMissing` is true when NO Search Console property matched the site for any subject\n * (missing/unverified property or lost SA access) — flagged for BOTH explicit and name-default\n * queries, because no query can fix a missing property. Pre-split, this case was folded into\n * `defaultQueryMissed`, whose \"set an explicit Search query\" remedy would permanently SILENCE\n * it (an explicit query that finds nothing is by design never flagged).\n *\n * `defaultQueryMissed` is true ONLY when a property resolved, the site-name default was used,\n * AND Search Console returned no data for it (`position === null`) — the signal to set an\n * explicit `Search query`. It is false for an explicit query (even one that finds nothing —\n * that's a valid measurement), a default that does find a position, the not-enrolled skip,\n * and the errored soft-fail path.\n *\n * `notConfigured` splits the old single skip in two. An un-enrolled site is a true skip —\n * there is nothing to measure, and the checklist row stays manual. But an ENROLLED site in an\n * environment with no credentials is an environment gap: the check was supposed to run and\n * couldn't. Collapsing the two made a credential-less run (exactly what the daily-reports\n * workflow was) indistinguishable from \"this site opted out\", so the Google Indexed row\n * silently vanished from every drafted report instead of saying why.\n *\n * When the Search Console API errors it logs a one-line warning and returns `softFailed: true`.\n * Never throws, so a search problem can never block a draft.\n */\nexport async function fetchSearch(\n  siteRow: WebsiteRow,\n  periodStart: Date,\n  periodEnd: Date,\n): Promise<SearchEnrichment> {\n  const cfg = readGaConfig();\n  const enrolled = Boolean(siteRow.ga4PropertyId || siteRow.searchQuery);\n  if (!cfg || !enrolled) {\n    const notConfigured = enrolled && !cfg;\n    if (notConfigured) {\n      console.warn(\n        `⚑ Search: no GA/Search Console credentials in this environment (GA_SUBJECT unset) — the Google Indexed check could not run for ${siteRow.name}.`,\n      );\n    }\n    return { ...NO_ENRICHMENT, defaultQueryMissed: false, propertyMissing: false, notConfigured };\n  }\n  const explicit = siteRow.searchQuery?.trim();\n  const query = explicit || siteRow.name;\n  const usedDefault = !explicit;\n  try {\n    const value = await fetchSearchPresence(\n      {\n        keyPath: cfg.keyPath,\n        subjects: cfg.subjects,\n        property: siteRow.searchConsoleProperty ?? undefined,\n        host: siteRow.url,\n        query,\n      },\n      periodStart,\n      periodEnd,\n    );\n    const propertyMissing = !value.propertyFound;\n    if (propertyMissing) {\n      console.warn(\n        `⚑ Search: no Search Console property matched ${siteRow.url} for ${siteRow.name} — verify the domain property exists and the service account has access. (A \"Search query\" change cannot fix this.)`,\n      );\n    }\n    const defaultQueryMissed = value.propertyFound && usedDefault && value.position === null;\n    if (defaultQueryMissed) {\n      console.warn(\n        `⚑ Search: site-name default \"${query}\" found no Search Console data for ${siteRow.name} — set an explicit \"Search query\" in Airtable to track brand presence.`,\n      );\n    }\n    return { value, softFailed: false, defaultQueryMissed, propertyMissing, notConfigured: false };\n  } catch (e) {\n    console.warn(`⚠ Search presence skipped for ${siteRow.name}: ${(e as Error).message}`);\n    return {\n      value: null,\n      softFailed: true,\n      defaultQueryMissed: false,\n      propertyMissing: false,\n      notConfigured: false,\n    };\n  }\n}\n\n/** The half-open period's start: the day after this site's last report of the same\n *  type ended, or 30 days ago when it has none.\n *\n *  #646 step 4: read from TURSO (`store.forSite`). The Airtable read it replaces\n *  returned nothing for a `site_<ULID>` site — and \"nothing\" is not an error here,\n *  it is the 30-day fallback, so every report for such a site would have silently\n *  re-measured a window it had already reported on. */\nasync function derivePeriodStart(\n  store: ReportMirror,\n  siteRow: WebsiteRow,\n  reportType: ReportType,\n  today: Date,\n): Promise<Date> {\n  const prior = await store.forSite(siteRow.id);\n  const sameType = prior\n    .filter((r) => r.reportType === reportType && r.periodEnd)\n    .map((r) => r.periodEnd!)\n    .sort();\n  const latest = sameType[sameType.length - 1];\n  if (!latest) return daysAgo(today, 30);\n  // Half-open periods. The prior report's GA/Search windows are inclusive of its\n  // periodEnd, so starting this report on the *same* day double-counts that\n  // boundary day across two consecutive reports (and inflates the headline Users\n  // count). Start the next day instead. UTC to stay TZ-consistent with daysAgo.\n  const start = new Date(latest);\n  start.setUTCDate(start.getUTCDate() + 1);\n  return start;\n}\n","import type { ReportType } from \"./types.js\";\nimport type { WebsiteRow } from \"./airtable/websites.js\";\nimport type { SearchPresence } from \"./search/client.js\";\nimport { checklistFor, gatingFields } from \"./checklist.js\";\nimport { isNetlifyAppUrl } from \"../util/url.js\";\n\n/** A persisted audit signal is only trusted within this window — a stale \"pass\" degrades to\n *  \"unknown\" (no tick). Matches the github-signals staleness convention (~3 days). */\nconst STALE_DAYS = 3;\nconst MS_PER_DAY = 24 * 60 * 60 * 1000;\n\n/** True when `checkedAt` is a valid timestamp within STALE_DAYS of `now`. */\nfunction isFresh(checkedAt: string | null, now: Date): boolean {\n  if (!checkedAt) return false;\n  const t = new Date(checkedAt).getTime();\n  if (Number.isNaN(t)) return false;\n  return now.getTime() - t <= STALE_DAYS * MS_PER_DAY;\n}\n\n/** Cert-expiry buffer: a cert must have MORE than this many days left to pass (renew window).\n *  Exactly 14 days does NOT pass — matches the spec's strict \">14 days\" and the domain audit's\n *  own `> 14` pass status, so the two thresholds can't drift. */\nconst CERT_MIN_DAYS = 14;\n\n/** A single auto-check outcome. `pass` + fresh ⇒ the caller ticks the box. */\nexport type EvidenceResult = \"pass\" | \"fail\" | \"unknown\" | \"n/a\";\nexport type EvidenceRecord = { result: EvidenceResult; checkedAt: string | null; note: string };\n\n/**\n * Inline signals fetched during the draft. Phase 1 carries Search Console only; Phase 2/3 read\n * the remaining signals (security, domain, browser) off the Websites row passed as `site`.\n */\nexport type AutoTickSignals = {\n  search: {\n    value: SearchPresence | null;\n    softFailed: boolean;\n    /** The site is analytics-enrolled but this environment has no GA/Search Console\n     *  credentials, so the check could not run. Kept distinct from the un-enrolled skip\n     *  (`value: null`, this false) so the evidence can name the environment gap instead\n     *  of disappearing. */\n    notConfigured: boolean;\n  };\n};\n\n/**\n * Decide, per checklist item for this report type, an evidence record. PURE. The fail-safe\n * invariant lives here: a box is only tickable when `result === \"pass\"`. Google Indexed is an\n * inline signal (fetched at draft), so its evidence is inherently fresh (`checkedAt = now`).\n *\n * The semantic inversion: every GATING item for this report type gets a status even with no\n * signal — a never-measured gating item resolves to `unknown` (which blocks the send gate), not\n * an omission the caller could read as \"manual/OK\". Only non-gating (advisory) items keep the old\n * omit-when-absent behavior, so an unconfigured advisory check stays silently manual.\n */\nexport function autoTickChecklist(\n  site: WebsiteRow,\n  reportType: ReportType,\n  now: Date,\n  signals: AutoTickSignals,\n): Map<string, EvidenceRecord> {\n  const out = new Map<string, EvidenceRecord>();\n  const gating = new Set(gatingFields(reportType));\n\n  for (const item of checklistFor(reportType)) {\n    let ev: EvidenceRecord | null;\n    switch (item.field) {\n      case \"Maint: Google Indexed\":\n        ev = googleEvidence(now, signals.search);\n        break;\n      case \"Maint: Deploy & Function Health\":\n        ev = deployEvidence(site, now);\n        break;\n      case \"Maint: CMS Checked\":\n        ev = cmsEvidence(site, now);\n        break;\n      case \"Maint: Domain, DNS & SSL\":\n        ev = domainEvidence(site, now);\n        break;\n      case \"Maint: Security Updates\":\n        ev = securityEvidence(site, now);\n        break;\n      case \"Maint: Uptime Checked\":\n        ev = uptimeEvidence(site, now);\n        break;\n      case \"Test: Desktop Browsers\":\n        ev = browserEvidence(\n          site.crossbrowserOk,\n          site,\n          now,\n          \"Desktop renders cleanly\",\n          \"render errors\",\n        );\n        break;\n      case \"Test: Mobile Browsers\":\n        ev = browserEvidence(site.mobileOk, site, now, \"Mobile renders cleanly\", \"overflow/errors\");\n        break;\n      case \"Test: Page Titles & Meta\":\n        ev = titlesEvidence(site, now);\n        break;\n      case \"Test: Links & Navigation\": {\n        const broken = site.brokenLinks;\n        const failNote = broken && broken > 0 ? `${broken} broken link(s)` : \"broken links / nav\";\n        ev = browserEvidence(site.linksOk, site, now, \"All internal links resolve\", failNote);\n        break;\n      }\n      case \"Test: Form Functionality\":\n        ev = formsEvidence(site, now);\n        break;\n      case \"Test: Interactions & Animations\":\n        ev = interactionsEvidence(site, now);\n        break;\n      case \"Test: Verified After Updates\":\n        ev = updatesEvidence(site, now);\n        break;\n      default:\n        ev = null;\n    }\n    // The semantic inversion: a GATING item with no fresh signal must still carry a status —\n    // `unknown` (blocks) — so an unwired/absent signal can never leave the gate silently\n    // passable. Advisory items (e.g. Google Indexed on a Maintenance report) keep the old\n    // omit-when-absent behavior.\n    if (ev === null && gating.has(item.field)) {\n      ev = { result: \"unknown\", checkedAt: null, note: \"Not yet measured\" };\n    }\n    if (ev !== null) out.set(item.field, ev);\n  }\n\n  return out;\n}\n\n/** One browser-audit verdict (Desktop/Mobile/Links) → evidence, gated on `Browser checked at`\n *  freshness. null verdict (never run) → omit (manual); stale → unknown; true → pass; false →\n *  fail (with the failure note). The verdict itself was computed by the audit (summarizeBrowser). */\nfunction browserEvidence(\n  ok: boolean | null,\n  site: WebsiteRow,\n  now: Date,\n  passNote: string,\n  failNote: string,\n): EvidenceRecord | null {\n  if (ok === null || !site.browserCheckedAt) return null;\n  const at = site.browserCheckedAt;\n  if (!isFresh(at, now)) {\n    return { result: \"unknown\", checkedAt: at, note: \"Browser check is stale (>3d)\" };\n  }\n  return ok\n    ? { result: \"pass\", checkedAt: at, note: passNote }\n    : { result: \"fail\", checkedAt: at, note: failNote };\n}\n\n/**\n * Security Updates evidence from the persisted `security` audit. Omits (→ manual) when the audit\n * never ran (counts null / no timestamp); stale → unknown; 0 critical AND 0 high → pass; any\n * critical/high → fail (with the count). Honest scope: \"no known critical/high advisories in the\n * declared dependencies as of the last audit\" — moderate/low are advisory, not gating, and this\n * does not prove the fix is deployed.\n */\nfunction securityEvidence(site: WebsiteRow, now: Date): EvidenceRecord | null {\n  const crit = site.securityVulnsCritical;\n  const high = site.securityVulnsHigh;\n  if (crit === null || high === null || !site.lastSecurityAuditAt) return null;\n  const at = site.lastSecurityAuditAt;\n  if (!isFresh(at, now)) {\n    return { result: \"unknown\", checkedAt: at, note: \"Security audit is stale (>3d)\" };\n  }\n  if (crit === 0 && high === 0) {\n    return { result: \"pass\", checkedAt: at, note: \"No known critical/high vulnerabilities\" };\n  }\n  return { result: \"fail\", checkedAt: at, note: `${crit} critical / ${high} high vuln(s)` };\n}\n\n/**\n * Search Console → Google Indexed evidence. A soft-fail (the API errored) and an unwired\n * environment (`notConfigured`) are both `unknown`, but they carry DIFFERENT notes — an\n * operator staring at an amber pill has to be able to tell \"Google was unreachable this run\"\n * from \"this deployment has no Search Console credentials\", because only the second one is\n * fixed by wiring a secret. An un-enrolled site (`value: null`, not configured, not failed)\n * emits nothing so the box stays manual.\n *\n * Page-1 is `pass` (with the position in the note); off page 1 is `fail`.\n */\nfunction googleEvidence(now: Date, search: AutoTickSignals[\"search\"]): EvidenceRecord | null {\n  const at = now.toISOString();\n  if (search.softFailed) {\n    return { result: \"unknown\", checkedAt: at, note: \"Search Console unavailable this run\" };\n  }\n  if (search.notConfigured) {\n    return {\n      result: \"unknown\",\n      checkedAt: at,\n      note: \"Search Console not configured in the environment that drafted this report\",\n    };\n  }\n  if (search.value === null) return null;\n  if (search.value.foundOnPage1) {\n    const pos = search.value.position;\n    return {\n      result: \"pass\",\n      checkedAt: at,\n      note: `Page 1 on Google${pos !== null ? ` (#${pos})` : \"\"}`,\n    };\n  }\n  const pos = search.value.position;\n  return {\n    result: \"fail\",\n    checkedAt: at,\n    note: `Not on page 1${pos !== null ? ` (avg #${pos})` : \"\"}`,\n  };\n}\n\n/**\n * Domain/DNS/SSL evidence from the persisted `domain` audit. Omits (→ manual) when there's no\n * custom domain to verify (`*.netlify.app`) or the audit never ran. A `pass` requires a fresh\n * check that resolved with a cert comfortably before expiry; stale → unknown; resolved-but-no-cert\n * or near/past expiry → fail. The honest scope is resolve + valid cert — NOT registrar expiry,\n * www↔apex redirect, or MX.\n */\nfunction domainEvidence(site: WebsiteRow, now: Date): EvidenceRecord | null {\n  // No custom domain to verify — the no-domain watch signal covers `*.netlify.app` elsewhere.\n  if (!site.url || isNetlifyAppUrl(site.url)) return null;\n  if (!site.domainCheckedAt) return null; // never probed → leave manual\n  const at = site.domainCheckedAt;\n  if (!isFresh(site.domainCheckedAt, now)) {\n    return { result: \"unknown\", checkedAt: at, note: \"Domain check is stale (>3d)\" };\n  }\n  const days = site.certDaysRemaining;\n  if (days === null) {\n    return { result: \"fail\", checkedAt: at, note: \"Did not resolve, or no valid TLS cert\" };\n  }\n  if (days <= CERT_MIN_DAYS) {\n    return { result: \"fail\", checkedAt: at, note: `TLS cert expires in ${days}d` };\n  }\n  return { result: \"pass\", checkedAt: at, note: `Custom domain, valid cert (${days}d left)` };\n}\n\n/**\n * Deploy & Function Health: the Netlify build is `ready` AND the deployed function responds\n * healthy. Two freshness stamps must both be fresh (deploy check + function-health check). Never\n * measured → null (omit → the gating dispatch coerces to unknown); either stale → unknown; both\n * fresh + ready + fn pass → pass; otherwise fail.\n */\nfunction deployEvidence(site: WebsiteRow, now: Date): EvidenceRecord | null {\n  if (!site.deployCheckedAt && !site.functionHealthCheckedAt) return null;\n  if (!isFresh(site.deployCheckedAt, now) || !isFresh(site.functionHealthCheckedAt, now)) {\n    return {\n      result: \"unknown\",\n      checkedAt: site.functionHealthCheckedAt ?? site.deployCheckedAt,\n      note: \"Deploy/function-health check is stale (>3d)\",\n    };\n  }\n  const ready = site.deployStatus === \"ready\";\n  const fnOk = site.functionHealth === \"pass\";\n  if (ready && fnOk) {\n    return {\n      result: \"pass\",\n      checkedAt: site.functionHealthCheckedAt,\n      note: \"Netlify build ready + functions respond\",\n    };\n  }\n  const why =\n    !ready && !fnOk\n      ? \"build not ready + functions unhealthy\"\n      : !ready\n        ? \"build not ready\"\n        : \"functions unhealthy\";\n  return {\n    result: \"fail\",\n    checkedAt: site.functionHealthCheckedAt,\n    note: `Deploy/function-health failing — ${why}`,\n  };\n}\n\n/**\n * CMS Checked: the server-side `/health` Prismic probe reported reachable. Freshness rides the\n * function-health check stamp (one `/health` fetch feeds both Deploy and CMS). Never measured →\n * null; stale → unknown; pass/fail mirror the stored verdict; a fresh stamp with no verdict →\n * unknown.\n */\nfunction cmsEvidence(site: WebsiteRow, now: Date): EvidenceRecord | null {\n  if (!site.functionHealthCheckedAt) return null;\n  const at = site.functionHealthCheckedAt;\n  if (!isFresh(at, now)) {\n    return { result: \"unknown\", checkedAt: at, note: \"CMS check is stale (>3d)\" };\n  }\n  if (site.cmsReachable === \"pass\") {\n    return { result: \"pass\", checkedAt: at, note: \"Prismic reachable (server-side)\" };\n  }\n  if (site.cmsReachable === \"fail\") {\n    return { result: \"fail\", checkedAt: at, note: \"Prismic unreachable (server-side)\" };\n  }\n  return { result: \"unknown\", checkedAt: at, note: \"CMS reachability not reported\" };\n}\n\n/**\n * Uptime Checked: every sampled route returned 2xx/3xx on the browser audit (point-in-time).\n * Freshness rides the shared `browserCheckedAt`. Never ran → null; stale → unknown.\n */\nfunction uptimeEvidence(site: WebsiteRow, now: Date): EvidenceRecord | null {\n  if (site.reachableOk === null || !site.browserCheckedAt) return null;\n  const at = site.browserCheckedAt;\n  if (!isFresh(at, now)) {\n    return { result: \"unknown\", checkedAt: at, note: \"Uptime check is stale (>3d)\" };\n  }\n  return site.reachableOk === \"pass\"\n    ? { result: \"pass\", checkedAt: at, note: \"All sampled routes reachable (point-in-time)\" }\n    : { result: \"fail\", checkedAt: at, note: \"One or more sampled routes did not respond 2xx/3xx\" };\n}\n\n/**\n * Page Titles & Meta: every sampled route had a non-empty title + meta description with no\n * duplicate titles (browser audit, chromium). Freshness rides `browserCheckedAt`.\n */\nfunction titlesEvidence(site: WebsiteRow, now: Date): EvidenceRecord | null {\n  if (site.titleMetaOk === null || !site.browserCheckedAt) return null;\n  const at = site.browserCheckedAt;\n  if (!isFresh(at, now)) {\n    return { result: \"unknown\", checkedAt: at, note: \"Titles/meta check is stale (>3d)\" };\n  }\n  return site.titleMetaOk === \"pass\"\n    ? { result: \"pass\", checkedAt: at, note: \"Titles + meta present\" }\n    : {\n        result: \"fail\",\n        checkedAt: at,\n        note: \"Missing/duplicate title or missing meta description\",\n      };\n}\n\n/**\n * Form Functionality: a synthetic prod submission succeeded (form-e2e audit). `n/a` when the audit\n * ran (checked-at stamp set) but the site has no contact form (verdict cleared to null). Never ran\n * (no stamp) → null; stale → unknown.\n */\nfunction formsEvidence(site: WebsiteRow, now: Date): EvidenceRecord | null {\n  if (!site.formE2eCheckedAt) return null;\n  const at = site.formE2eCheckedAt;\n  if (!isFresh(at, now)) {\n    return { result: \"unknown\", checkedAt: at, note: \"Form E2E check is stale (>3d)\" };\n  }\n  if (site.formE2eOk === \"pass\") {\n    return { result: \"pass\", checkedAt: at, note: \"Synthetic submission succeeded\" };\n  }\n  if (site.formE2eOk === \"fail\") {\n    return { result: \"fail\", checkedAt: at, note: \"Synthetic submission failed\" };\n  }\n  return { result: \"n/a\", checkedAt: at, note: \"No contact form on this site\" };\n}\n\n/**\n * Interactions & Animations: the per-site smoke suite is green. Freshness rides `lastSmokeAt`.\n * Never ran → null; stale → unknown.\n */\nfunction interactionsEvidence(site: WebsiteRow, now: Date): EvidenceRecord | null {\n  if (site.smokeOk === null || !site.lastSmokeAt) return null;\n  const at = site.lastSmokeAt;\n  if (!isFresh(at, now)) {\n    return { result: \"unknown\", checkedAt: at, note: \"Smoke suite is stale (>3d)\" };\n  }\n  return site.smokeOk === \"pass\"\n    ? { result: \"pass\", checkedAt: at, note: \"Smoke suite green\" }\n    : { result: \"fail\", checkedAt: at, note: \"Smoke suite red\" };\n}\n\n/**\n * Tested After Updates: default-branch CI is green on the latest commit (github-signals). A repo\n * with no CI (`defaultBranchCi === \"none\"`) is `n/a`. Never swept (null / no stamp) → null; stale\n * → unknown; passing → pass; failing → fail; pending → unknown.\n */\nfunction updatesEvidence(site: WebsiteRow, now: Date): EvidenceRecord | null {\n  if (site.defaultBranchCi === null || !site.githubSignalsAt) return null;\n  const at = site.githubSignalsAt;\n  if (site.defaultBranchCi === \"none\") {\n    return { result: \"n/a\", checkedAt: at, note: \"Repository has no CI\" };\n  }\n  if (!isFresh(at, now)) {\n    return { result: \"unknown\", checkedAt: at, note: \"CI signal is stale (>3d)\" };\n  }\n  if (site.defaultBranchCi === \"passing\") {\n    return { result: \"pass\", checkedAt: at, note: \"Default-branch CI green on latest commit\" };\n  }\n  if (site.defaultBranchCi === \"failing\") {\n    return { result: \"fail\", checkedAt: at, note: \"Default-branch CI is failing\" };\n  }\n  return { result: \"unknown\", checkedAt: at, note: \"Default-branch CI is pending\" };\n}\n","import { readFileSync } from \"node:fs\";\nimport { JWT } from \"google-auth-library\";\nimport { BetaAnalyticsDataClient } from \"@google-analytics/data\";\nimport { withSubjectFailover } from \"./failover.js\";\nimport { hostnameOf, isHttpUrl } from \"../../util/url.js\";\n\nconst ANALYTICS_READONLY = \"https://www.googleapis.com/auth/analytics.readonly\";\nconst MS_PER_DAY = 86_400_000;\n\nexport type GaQuery = {\n  /** GA4 numeric property ID (e.g. \"471880366\"). */\n  propertyId: string;\n  /** Workspace users to impersonate via domain-wide delegation, tried in order\n   *  (auth-failure failover — see `withSubjectFailover`). */\n  subjects: string[];\n  /** Path to the service-account JSON key. */\n  keyPath: string;\n  /** Hostnames this site's own traffic arrives on. When non-empty the query is\n   *  filtered to them, so `localhost` and Netlify preview hosts are excluded.\n   *  Empty means \"unfiltered\", which is the pre-2026-09 behaviour and the\n   *  deliberate fallback for a site row with no usable URL: a filter matching\n   *  nothing would silently report zero, which is worse than reporting noise. */\n  hostnames: string[];\n};\n\n/**\n * The hostnames a site's own traffic can legitimately arrive on: the URL's\n * host and its www/apex twin.\n *\n * Without this the report counts every environment that serves the same\n * analytics tag. On reddoorla.com for the thirty days to 2026-09-14 that was\n * 15,971 `localhost` users against 87 real ones — the smoke suite, which\n * clicks and scrolls and so trips the tag's interaction gate, once per fresh\n * browser context. The report mailed it as a 510% rise while real traffic had\n * halved.\n *\n * Returns [] for anything that is not an http(s) URL, which the caller treats\n * as \"do not filter\" rather than \"match nothing\".\n */\nexport function measuredHostnames(siteUrl: string): string[] {\n  if (!isHttpUrl(siteUrl)) return [];\n  const host = hostnameOf(siteUrl).toLowerCase();\n  if (!host.includes(\".\")) return [];\n  const apex = host.startsWith(\"www.\") ? host.slice(4) : host;\n  return [apex, `www.${apex}`];\n}\n\n/** UTC YYYY-MM-DD — matches the rest of the reports pipeline's date handling. */\nfunction ymd(d: Date): string {\n  return d.toISOString().slice(0, 10);\n}\n\n/**\n * Fetch GA4 `activeUsers` (\"Users\") for a report period and the equal-length window\n * immediately before it, via a domain-wide-delegation service account impersonating each\n * of `subjects` in order until one authenticates. Throws on any non-auth API error, or\n * once every subject has failed auth — the caller (draftReportForSite) soft-fails.\n *\n * Previous window: same length as the current period, ending the day before `periodStart`.\n */\nexport async function fetchPeriodUsers(\n  query: GaQuery,\n  periodStart: Date,\n  periodEnd: Date,\n): Promise<{ current: number; previous: number }> {\n  const key = JSON.parse(readFileSync(query.keyPath, \"utf8\")) as {\n    client_email: string;\n    private_key: string;\n  };\n\n  const lengthDays = Math.round((periodEnd.getTime() - periodStart.getTime()) / MS_PER_DAY);\n  const prevEnd = new Date(periodStart.getTime() - MS_PER_DAY);\n  const prevStart = new Date(prevEnd.getTime() - lengthDays * MS_PER_DAY);\n  const property = `properties/${query.propertyId}`;\n\n  return withSubjectFailover(query.subjects, \"GA\", async (subject) => {\n    const authClient = new JWT({\n      email: key.client_email,\n      key: key.private_key,\n      scopes: [ANALYTICS_READONLY],\n      subject,\n    });\n    const client = new BetaAnalyticsDataClient({ authClient });\n\n    const run = async (start: Date, end: Date): Promise<number> => {\n      const [resp] = await client.runReport({\n        property,\n        dateRanges: [{ startDate: ymd(start), endDate: ymd(end) }],\n        metrics: [{ name: \"activeUsers\" }],\n        // Only the site's own hosts. Omitted entirely when we have no usable\n        // hostname, so the number degrades to the old unfiltered one instead\n        // of to zero.\n        ...(query.hostnames.length > 0\n          ? {\n              dimensionFilter: {\n                filter: {\n                  fieldName: \"hostName\",\n                  inListFilter: { values: query.hostnames },\n                },\n              },\n            }\n          : {}),\n      });\n      const raw = resp.rows?.[0]?.metricValues?.[0]?.value ?? \"0\";\n      const n = Number.parseInt(raw, 10);\n      return Number.isFinite(n) ? n : 0;\n    };\n\n    const current = await run(periodStart, periodEnd);\n    const previous = await run(prevStart, prevEnd);\n    return { current, previous };\n  });\n}\n","/**\n * Impersonation-subject failover, shared by the GA Data client and the Search Console\n * client (both impersonate the same `GA_SUBJECT` list via domain-wide delegation).\n *\n * The point: one personal Workspace account backing every site's analytics is a fleet-wide\n * SPOF — if it's offboarded/suspended or loses property access, all analytics soft-fail to\n * blank at once. With `GA_SUBJECT` as an ordered list, an auth failure on one subject falls\n * through to the next, and a *partial* outage (primary dying, backup carrying) is surfaced\n * as a greppable `subject failover` warning before it becomes a total one.\n */\n\nconst AUTH_HTTP_STATUS = new Set([401, 403]);\n/** gRPC PERMISSION_DENIED (7) / UNAUTHENTICATED (16) — how the GA Data API surfaces auth. */\nconst AUTH_GRPC_CODES = new Set([7, 16]);\n/** Message shapes across the three auth surfaces: gRPC code names (GA Data), OAuth token\n *  exchange (`invalid_grant` = suspended/deleted subject, `unauthorized_client` = DWD scope\n *  missing), and plain HTTP 401/403 texts (Search Console via gaxios). */\nconst AUTH_MESSAGE =\n  /permission[_ ]denied|unauthenticated|unauthorized|invalid_grant|access[_ ]denied|forbidden|insufficient permission|status code 40[13]/i;\n\ntype ErrorShape = {\n  code?: number | string;\n  status?: number | string;\n  response?: { status?: number; data?: { error?: { errors?: Array<{ reason?: string }> } } };\n  /** Explicit opt-in marker for errors that aren't auth-shaped per se but mean \"this\n   *  subject can't do the job, try the next one\" (see the search client's empty\n   *  sites.list case — that API hides inaccessible properties instead of 403ing). */\n  failoverToNextSubject?: boolean;\n};\n\n/** Google surfaces per-user throughput caps as HTTP 403 with one of these `reason`s — a\n *  transient rate-limit, NOT a lost grant. Distinguished so the failover warning doesn't\n *  send operators to the offboarding runbook over a quota blip. */\nconst QUOTA_REASONS = new Set([\n  \"userratelimitexceeded\",\n  \"ratelimitexceeded\",\n  \"quotaexceeded\",\n  \"dailylimitexceeded\",\n]);\nconst QUOTA_MESSAGE = /quota exceeded|rate limit exceeded|user rate limit/i;\n\n/** True when an error looks like THIS subject's auth/authorization failed — the only\n *  condition worth retrying under a different subject. Network/5xx/bad-input errors\n *  would fail identically for every subject, so they propagate immediately. */\nexport function isAuthShapedError(e: unknown): boolean {\n  const err = e as ErrorShape | null | undefined;\n  if (err?.failoverToNextSubject === true) return true;\n  if ([err?.status, err?.response?.status].some((s) => AUTH_HTTP_STATUS.has(Number(s))))\n    return true;\n  if (AUTH_HTTP_STATUS.has(Number(err?.code)) || AUTH_GRPC_CODES.has(Number(err?.code)))\n    return true;\n  const msg = e instanceof Error ? e.message : String(e);\n  return AUTH_MESSAGE.test(msg);\n}\n\n/** A soft \"this subject can't see the resource, try the next one\" marker (the search\n *  client's empty sites.list case) — NOT a genuine failure. It must never dominate a real\n *  auth error when deciding what to throw after all subjects are exhausted. */\nfunction isFailoverSentinel(e: unknown): boolean {\n  return (e as ErrorShape | null | undefined)?.failoverToNextSubject === true;\n}\n\n/** True when a 403 is a transient per-user quota/rate-limit, not an access loss. A\n *  structured `reason` is authoritative (so a real `forbidden` 403 whose message happens to\n *  mention a limit is NOT quota); otherwise fall back to the message. Still auth-shaped for\n *  failover purposes — this only softens the warning wording, never the control flow. */\nexport function isQuotaShapedError(e: unknown): boolean {\n  const err = e as ErrorShape | null | undefined;\n  if (err?.failoverToNextSubject === true) return false;\n  const reasons = err?.response?.data?.error?.errors;\n  if (Array.isArray(reasons) && reasons.length > 0) {\n    return reasons.some((r) => r?.reason != null && QUOTA_REASONS.has(r.reason.toLowerCase()));\n  }\n  const msg = e instanceof Error ? e.message : String(e);\n  return QUOTA_MESSAGE.test(msg);\n}\n\n/**\n * Run `attempt` with each subject in order until one succeeds. Auth-shaped failures fall\n * through to the next subject; anything else throws immediately. When all subjects fail,\n * the LAST error is thrown — callers keep their existing catch-and-soft-fail behavior.\n * When an earlier subject failed but a later one succeeded, emit ONE console.warn so a\n * dying primary is visible in the cron log before it becomes a total outage.\n */\nexport async function withSubjectFailover<T>(\n  subjects: readonly string[],\n  label: string,\n  attempt: (subject: string) => Promise<T>,\n): Promise<T> {\n  if (subjects.length === 0) throw new Error(`${label}: no impersonation subjects configured`);\n  const failed: string[] = [];\n  // Track a genuine auth failure separately from a soft sentinel. If ANY subject failed for\n  // real, that error must be what we throw — never a later subject's \"no resource here\"\n  // sentinel. Otherwise [real-auth-failure, empty-result] would surface as a clean sentinel\n  // and the caller would record it as verified data instead of soft-failing (the exact\n  // masking the analytics-health alarm exists to catch).\n  let lastRealError: unknown;\n  let lastSentinel: unknown;\n  // Stays true only while every failure so far is a transient quota/rate-limit — a lost\n  // grant or a sentinel flips it, escalating the warning from \"transient\" to the runbook.\n  let allQuota = true;\n  for (const subject of subjects) {\n    try {\n      const result = await attempt(subject);\n      if (failed.length > 0) {\n        console.warn(\n          allQuota\n            ? `⚠ ${label} subject failover: ${failed.join(\"; \")} — succeeded via ${subject} ` +\n                `(transient quota/rate-limit, not an access loss).`\n            : `⚠ ${label} subject failover: ${failed.join(\"; \")} — succeeded via ${subject}. ` +\n                `Restore the failing subject's access or drop it from GA_SUBJECT ` +\n                `(docs/runbooks/ga-search-role-account-cutover.md).`,\n        );\n      }\n      return result;\n    } catch (e) {\n      if (!isAuthShapedError(e)) throw e;\n      failed.push(`${subject} (${e instanceof Error ? e.message : String(e)})`);\n      if (isFailoverSentinel(e)) {\n        lastSentinel = e;\n        allQuota = false;\n      } else {\n        lastRealError = e;\n        if (!isQuotaShapedError(e)) allQuota = false;\n      }\n    }\n  }\n  // A real auth failure dominates a sentinel regardless of subject order; only when EVERY\n  // subject merely returned the soft sentinel do we throw it (the search client turns that\n  // into a legitimate not-found).\n  throw lastRealError ?? lastSentinel;\n}\n","import { readFileSync } from \"node:fs\";\nimport { JWT } from \"google-auth-library\";\nimport { withSubjectFailover } from \"../ga/failover.js\";\n\nconst WEBMASTERS_READONLY = \"https://www.googleapis.com/auth/webmasters.readonly\";\nconst SC_BASE = \"https://searchconsole.googleapis.com/webmasters/v3\";\n/** Average-position threshold for \"on page 1\" (10 organic results per page). */\nconst PAGE_1_MAX_POSITION = 10;\n/** Rows to pull for the brand `contains` match. searchAnalytics has no orderBy and returns\n *  rows clicks-desc, so the exact-query row survives into the response only if it isn't paged\n *  out beyond this cap. Sized with wide headroom — a brand has a handful of phrasing variants,\n *  far below 100 — so the exact query (and every variant) is in practice always present. */\nexport const BRAND_QUERY_ROW_LIMIT = 100;\n\nexport type SearchPresenceQuery = {\n  /** Path to the service-account JSON key (same one GA uses). */\n  keyPath: string;\n  /** Workspace users to impersonate via domain-wide delegation, tried in order\n   *  (auth-failure failover — see `withSubjectFailover`). */\n  subjects: string[];\n  /** Explicit Search Console property (`sc-domain:...` or `https://.../`). Overrides auto-resolution. */\n  property?: string | undefined;\n  /** Site host, used to auto-resolve the property from `sites.list` when `property` is absent. */\n  host: string;\n  /** Operator-supplied brand hint (e.g. the business name). Matched as a case-insensitive\n   *  SUBSTRING (`contains`) of the actual user query — NOT a hard exact string — so it tolerates\n   *  phrasing (\"red door creative\" vs \"…creative la\"). An exact-query match is preferred when\n   *  present; otherwise the most-searched matching query wins. */\n  query: string;\n};\n\nexport type SearchPresence = {\n  /** True when the average position for the query is on page 1 (<= 10). */\n  foundOnPage1: boolean;\n  /** Rounded average position, or null when not found / no data. */\n  position: number | null;\n  /** True when a Search Console property was actually resolved for the site (even if the\n   *  query then found no data). False ONLY when every subject resolved ZERO matching\n   *  properties — a missing/unverified property or lost SA access. Callers must\n   *  distinguish these: \"property exists, query missed\" is fixable with a better query;\n   *  \"no property at all\" is not, and prescribing a query change would silence the real\n   *  problem forever (an explicit query that returns nothing is by design never flagged). */\n  propertyFound: boolean;\n};\n\ntype SiteEntry = { siteUrl: string };\n\n/** Reduce any property string or URL to a bare host: no `sc-domain:`, scheme, `www.`, path, lowercased. */\nexport function bareHost(s: string): string {\n  return s\n    .trim()\n    .replace(/^sc-domain:/i, \"\")\n    .replace(/^https?:\\/\\//i, \"\")\n    .split(\"/\")[0]!\n    .replace(/^www\\./i, \"\")\n    .toLowerCase();\n}\n\n/**\n * All Search Console properties matching `host`, ordered for query fallback: Domain\n * (`sc-domain:`) forms first (broadest coverage), then URL-prefix forms. A site can be verified\n * as both; a freshly-created Domain property has no backfilled history, so its data can be empty\n * even while a long-lived URL-prefix property has data — hence we return every match and let the\n * caller try them in order until one returns data. Empty list = nothing matches.\n */\nexport function resolvePropertyCandidates(entries: SiteEntry[], host: string): string[] {\n  const target = bareHost(host);\n  const matches = entries.filter((e) => bareHost(e.siteUrl) === target).map((e) => e.siteUrl);\n  const domains = matches.filter((s) => s.toLowerCase().startsWith(\"sc-domain:\"));\n  const prefixes = matches.filter((s) => !s.toLowerCase().startsWith(\"sc-domain:\"));\n  return [...domains, ...prefixes];\n}\n\n/** UTC YYYY-MM-DD — matches the rest of the reports pipeline. */\nfunction ymd(d: Date): string {\n  return d.toISOString().slice(0, 10);\n}\n\n/**\n * From the queries matching the brand substring, pick the one the brand is actually FOUND\n * by most — the highest-impression row — and return its average position; tie-break on the\n * better (lower) position. Returns undefined when no row carries a numeric position. This is\n * what makes the reported \"brand search\" position robust to phrasing: with a `contains`\n * filter several variants can match, and we report the position of the variant real users\n * search most, not whichever the operator happened to type. Rows missing `impressions` count\n * as 0 (keeps a single-row, impression-less response — e.g. a test fixture — working). PURE.\n */\nexport function pickBrandQuery(\n  rows: Array<{ position?: number; impressions?: number }>,\n): number | undefined {\n  let best: { position: number; impressions: number } | undefined;\n  for (const r of rows) {\n    if (typeof r.position !== \"number\") continue;\n    const impressions = r.impressions ?? 0;\n    if (\n      best === undefined ||\n      impressions > best.impressions ||\n      (impressions === best.impressions && r.position < best.position)\n    ) {\n      best = { position: r.position, impressions };\n    }\n  }\n  return best?.position;\n}\n\n/**\n * The brand's reported position from the `contains`-matched rows, preferring an EXACT match.\n * When a returned row's query equals the operator's configured string (case-insensitive), its\n * position is used verbatim — a precisely-configured brand query is honored, with no chance a\n * longer higher-impression variant (\"…reviews\", \"…near me\") hijacks the number. Otherwise we\n * fall back to the most-searched matching query (`pickBrandQuery`). Operates only on the rows\n * actually returned: a string `contains` itself, so the exact query is among the `contains`\n * results whenever it has data AND isn't paged out beyond `BRAND_QUERY_ROW_LIMIT` (sized so a\n * brand's handful of phrasing variants always fit; if it ever were paged out, the most-searched\n * fallback still returns a valid brand position). Returns undefined when no row carries a\n * numeric position. PURE.\n */\nexport function selectBrandPosition(\n  rows: Array<{ keys?: string[]; position?: number; impressions?: number }>,\n  exactQuery: string,\n): number | undefined {\n  const want = exactQuery.toLowerCase();\n  const exact = rows.find(\n    (r) => typeof r.position === \"number\" && (r.keys?.[0] ?? \"\").toLowerCase() === want,\n  );\n  if (exact) return exact.position;\n  return pickBrandQuery(rows);\n}\n\n/** Per-subject \"this subject resolved NO matching Search Console property\". sites.list only\n *  returns properties the impersonated user can access — a subject that lost access sees an\n *  empty list with no auth error at all — so this opts into subject failover explicitly.\n *  When EVERY subject resolves empty, `fetchSearchPresence` restores the pre-failover\n *  behavior: a plain not-found result, not a throw. */\nclass NoPropertyForSubjectError extends Error {\n  readonly failoverToNextSubject = true;\n  constructor(subject: string, host: string) {\n    super(`no Search Console property matching ${host} is visible to ${subject}`);\n  }\n}\n\n/**\n * Query Google Search Console for the brand's average position on the site over the report\n * period, via a domain-wide-delegation service account impersonating each of `subjects` in\n * order until one authenticates. `query` is a case-insensitive SUBSTRING (`contains`) hint;\n * among the matching user queries we report the position of the exact-match query when\n * present, else the most-searched one (see `selectBrandPosition`) — so it doesn't depend on\n * the operator typing the exact search string, yet honors one verbatim when they do. Uses\n * `property` verbatim when given (operator's choice is final — no fallback); otherwise\n * auto-discovers all matching properties via `sites.list` and tries them in order (Domain\n * first) until one returns data. Throws on any non-auth API error, or once every subject\n * has failed auth — the caller (draftReportForSite) soft-fails.\n */\nexport async function fetchSearchPresence(\n  q: SearchPresenceQuery,\n  periodStart: Date,\n  periodEnd: Date,\n): Promise<SearchPresence> {\n  const key = JSON.parse(readFileSync(q.keyPath, \"utf8\")) as {\n    client_email: string;\n    private_key: string;\n  };\n\n  try {\n    return await withSubjectFailover(q.subjects, \"Search Console\", async (subject) => {\n      const jwt = new JWT({\n        email: key.client_email,\n        key: key.private_key,\n        scopes: [WEBMASTERS_READONLY],\n        subject,\n      });\n\n      const explicit = q.property?.trim();\n      let candidates: string[];\n      if (explicit) {\n        candidates = [explicit];\n      } else {\n        const list = await jwt.request<{ siteEntry?: SiteEntry[] }>({\n          url: `${SC_BASE}/sites`,\n          method: \"GET\",\n        });\n        candidates = resolvePropertyCandidates(list.data.siteEntry ?? [], q.host);\n        if (candidates.length === 0) throw new NoPropertyForSubjectError(subject, q.host);\n      }\n\n      for (const property of candidates) {\n        const res = await jwt.request<{\n          rows?: Array<{ keys?: string[]; position?: number; impressions?: number }>;\n        }>({\n          url: `${SC_BASE}/sites/${encodeURIComponent(property)}/searchAnalytics/query`,\n          method: \"POST\",\n          data: {\n            startDate: ymd(periodStart),\n            endDate: ymd(periodEnd),\n            dimensions: [\"query\"],\n            dimensionFilterGroups: [\n              {\n                filters: [\n                  { dimension: \"query\", operator: \"contains\", expression: q.query.toLowerCase() },\n                ],\n              },\n            ],\n            rowLimit: BRAND_QUERY_ROW_LIMIT,\n          },\n        });\n        const pos = selectBrandPosition(res.data.rows ?? [], q.query.toLowerCase());\n        if (typeof pos === \"number\") {\n          // Search Console can average below 1; floor to 1 so the template never\n          // renders a nonsensical \"#0\" (positions are 1-indexed).\n          return {\n            foundOnPage1: pos <= PAGE_1_MAX_POSITION,\n            position: Math.max(1, Math.round(pos)),\n            propertyFound: true,\n          };\n        }\n      }\n      // A property WAS resolved (or operator-pinned); the query just found no rows.\n      return { foundOnPage1: false, position: null, propertyFound: true };\n    });\n  } catch (e) {\n    // Every subject resolved zero matching properties — same legitimate \"no property\"\n    // outcome as before failover existed, NOT an analytics soft-failure. Marked\n    // propertyFound:false so the draft layer can flag the ACTUAL problem (missing\n    // property / lost SA access) instead of blaming the query.\n    if (e instanceof NoPropertyForSubjectError)\n      return { foundOnPage1: false, position: null, propertyFound: false };\n    throw e;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS,YAAY;AAwBvB,SAAS,eAAgC;AAC9C,QAAM,YAAY,QAAQ,IAAI,cAAc,IACzC,MAAM,GAAG,EACT,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,OAAO;AACjB,MAAI,SAAS,WAAW,EAAG,QAAO;AAClC,QAAM,UACJ,QAAQ,IAAI,gBAAgB,KAAK,KACjC,KAAK,QAAQ,uBAAuB,CAAC,GAAG,yBAAyB;AACnE,SAAO,EAAE,UAAU,QAAQ;AAC7B;;;AClCA,SAAS,OAAO,iBAAiB;AACjC,SAAS,WAAAA,gBAAe;;;ACOxB,IAAM,aAAa;AACnB,IAAM,aAAa,KAAK,KAAK,KAAK;AAGlC,SAAS,QAAQ,WAA0B,KAAoB;AAC7D,MAAI,CAAC,UAAW,QAAO;AACvB,QAAM,IAAI,IAAI,KAAK,SAAS,EAAE,QAAQ;AACtC,MAAI,OAAO,MAAM,CAAC,EAAG,QAAO;AAC5B,SAAO,IAAI,QAAQ,IAAI,KAAK,aAAa;AAC3C;AAKA,IAAM,gBAAgB;AAgCf,SAAS,kBACd,MACA,YACA,KACA,SAC6B;AAC7B,QAAM,MAAM,oBAAI,IAA4B;AAC5C,QAAM,SAAS,IAAI,IAAI,aAAa,UAAU,CAAC;AAE/C,aAAW,QAAQ,aAAa,UAAU,GAAG;AAC3C,QAAI;AACJ,YAAQ,KAAK,OAAO;AAAA,MAClB,KAAK;AACH,aAAK,eAAe,KAAK,QAAQ,MAAM;AACvC;AAAA,MACF,KAAK;AACH,aAAK,eAAe,MAAM,GAAG;AAC7B;AAAA,MACF,KAAK;AACH,aAAK,YAAY,MAAM,GAAG;AAC1B;AAAA,MACF,KAAK;AACH,aAAK,eAAe,MAAM,GAAG;AAC7B;AAAA,MACF,KAAK;AACH,aAAK,iBAAiB,MAAM,GAAG;AAC/B;AAAA,MACF,KAAK;AACH,aAAK,eAAe,MAAM,GAAG;AAC7B;AAAA,MACF,KAAK;AACH,aAAK;AAAA,UACH,KAAK;AAAA,UACL;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QACF;AACA;AAAA,MACF,KAAK;AACH,aAAK,gBAAgB,KAAK,UAAU,MAAM,KAAK,0BAA0B,iBAAiB;AAC1F;AAAA,MACF,KAAK;AACH,aAAK,eAAe,MAAM,GAAG;AAC7B;AAAA,MACF,KAAK,4BAA4B;AAC/B,cAAM,SAAS,KAAK;AACpB,cAAM,WAAW,UAAU,SAAS,IAAI,GAAG,MAAM,oBAAoB;AACrE,aAAK,gBAAgB,KAAK,SAAS,MAAM,KAAK,8BAA8B,QAAQ;AACpF;AAAA,MACF;AAAA,MACA,KAAK;AACH,aAAK,cAAc,MAAM,GAAG;AAC5B;AAAA,MACF,KAAK;AACH,aAAK,qBAAqB,MAAM,GAAG;AACnC;AAAA,MACF,KAAK;AACH,aAAK,gBAAgB,MAAM,GAAG;AAC9B;AAAA,MACF;AACE,aAAK;AAAA,IACT;AAKA,QAAI,OAAO,QAAQ,OAAO,IAAI,KAAK,KAAK,GAAG;AACzC,WAAK,EAAE,QAAQ,WAAW,WAAW,MAAM,MAAM,mBAAmB;AAAA,IACtE;AACA,QAAI,OAAO,KAAM,KAAI,IAAI,KAAK,OAAO,EAAE;AAAA,EACzC;AAEA,SAAO;AACT;AAKA,SAAS,gBACP,IACA,MACA,KACA,UACA,UACuB;AACvB,MAAI,OAAO,QAAQ,CAAC,KAAK,iBAAkB,QAAO;AAClD,QAAM,KAAK,KAAK;AAChB,MAAI,CAAC,QAAQ,IAAI,GAAG,GAAG;AACrB,WAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,+BAA+B;AAAA,EAClF;AACA,SAAO,KACH,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,SAAS,IAChD,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,SAAS;AACtD;AASA,SAAS,iBAAiB,MAAkB,KAAkC;AAC5E,QAAM,OAAO,KAAK;AAClB,QAAM,OAAO,KAAK;AAClB,MAAI,SAAS,QAAQ,SAAS,QAAQ,CAAC,KAAK,oBAAqB,QAAO;AACxE,QAAM,KAAK,KAAK;AAChB,MAAI,CAAC,QAAQ,IAAI,GAAG,GAAG;AACrB,WAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,gCAAgC;AAAA,EACnF;AACA,MAAI,SAAS,KAAK,SAAS,GAAG;AAC5B,WAAO,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,yCAAyC;AAAA,EACzF;AACA,SAAO,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,GAAG,IAAI,eAAe,IAAI,gBAAgB;AAC1F;AAYA,SAAS,eAAe,KAAW,QAA0D;AAC3F,QAAM,KAAK,IAAI,YAAY;AAC3B,MAAI,OAAO,YAAY;AACrB,WAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,sCAAsC;AAAA,EACzF;AACA,MAAI,OAAO,eAAe;AACxB,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,WAAW;AAAA,MACX,MAAM;AAAA,IACR;AAAA,EACF;AACA,MAAI,OAAO,UAAU,KAAM,QAAO;AAClC,MAAI,OAAO,MAAM,cAAc;AAC7B,UAAMC,OAAM,OAAO,MAAM;AACzB,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,WAAW;AAAA,MACX,MAAM,mBAAmBA,SAAQ,OAAO,MAAMA,IAAG,MAAM,EAAE;AAAA,IAC3D;AAAA,EACF;AACA,QAAM,MAAM,OAAO,MAAM;AACzB,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,WAAW;AAAA,IACX,MAAM,gBAAgB,QAAQ,OAAO,UAAU,GAAG,MAAM,EAAE;AAAA,EAC5D;AACF;AASA,SAAS,eAAe,MAAkB,KAAkC;AAE1E,MAAI,CAAC,KAAK,OAAO,gBAAgB,KAAK,GAAG,EAAG,QAAO;AACnD,MAAI,CAAC,KAAK,gBAAiB,QAAO;AAClC,QAAM,KAAK,KAAK;AAChB,MAAI,CAAC,QAAQ,KAAK,iBAAiB,GAAG,GAAG;AACvC,WAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,8BAA8B;AAAA,EACjF;AACA,QAAM,OAAO,KAAK;AAClB,MAAI,SAAS,MAAM;AACjB,WAAO,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,wCAAwC;AAAA,EACxF;AACA,MAAI,QAAQ,eAAe;AACzB,WAAO,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,uBAAuB,IAAI,IAAI;AAAA,EAC/E;AACA,SAAO,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,8BAA8B,IAAI,UAAU;AAC5F;AAQA,SAAS,eAAe,MAAkB,KAAkC;AAC1E,MAAI,CAAC,KAAK,mBAAmB,CAAC,KAAK,wBAAyB,QAAO;AACnE,MAAI,CAAC,QAAQ,KAAK,iBAAiB,GAAG,KAAK,CAAC,QAAQ,KAAK,yBAAyB,GAAG,GAAG;AACtF,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,WAAW,KAAK,2BAA2B,KAAK;AAAA,MAChD,MAAM;AAAA,IACR;AAAA,EACF;AACA,QAAM,QAAQ,KAAK,iBAAiB;AACpC,QAAM,OAAO,KAAK,mBAAmB;AACrC,MAAI,SAAS,MAAM;AACjB,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,WAAW,KAAK;AAAA,MAChB,MAAM;AAAA,IACR;AAAA,EACF;AACA,QAAM,MACJ,CAAC,SAAS,CAAC,OACP,0CACA,CAAC,QACC,oBACA;AACR,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,WAAW,KAAK;AAAA,IAChB,MAAM,yCAAoC,GAAG;AAAA,EAC/C;AACF;AAQA,SAAS,YAAY,MAAkB,KAAkC;AACvE,MAAI,CAAC,KAAK,wBAAyB,QAAO;AAC1C,QAAM,KAAK,KAAK;AAChB,MAAI,CAAC,QAAQ,IAAI,GAAG,GAAG;AACrB,WAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,2BAA2B;AAAA,EAC9E;AACA,MAAI,KAAK,iBAAiB,QAAQ;AAChC,WAAO,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,kCAAkC;AAAA,EAClF;AACA,MAAI,KAAK,iBAAiB,QAAQ;AAChC,WAAO,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,oCAAoC;AAAA,EACpF;AACA,SAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,gCAAgC;AACnF;AAMA,SAAS,eAAe,MAAkB,KAAkC;AAC1E,MAAI,KAAK,gBAAgB,QAAQ,CAAC,KAAK,iBAAkB,QAAO;AAChE,QAAM,KAAK,KAAK;AAChB,MAAI,CAAC,QAAQ,IAAI,GAAG,GAAG;AACrB,WAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,8BAA8B;AAAA,EACjF;AACA,SAAO,KAAK,gBAAgB,SACxB,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,+CAA+C,IACtF,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,qDAAqD;AAClG;AAMA,SAAS,eAAe,MAAkB,KAAkC;AAC1E,MAAI,KAAK,gBAAgB,QAAQ,CAAC,KAAK,iBAAkB,QAAO;AAChE,QAAM,KAAK,KAAK;AAChB,MAAI,CAAC,QAAQ,IAAI,GAAG,GAAG;AACrB,WAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,mCAAmC;AAAA,EACtF;AACA,SAAO,KAAK,gBAAgB,SACxB,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,wBAAwB,IAC/D;AAAA,IACE,QAAQ;AAAA,IACR,WAAW;AAAA,IACX,MAAM;AAAA,EACR;AACN;AAOA,SAAS,cAAc,MAAkB,KAAkC;AACzE,MAAI,CAAC,KAAK,iBAAkB,QAAO;AACnC,QAAM,KAAK,KAAK;AAChB,MAAI,CAAC,QAAQ,IAAI,GAAG,GAAG;AACrB,WAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,gCAAgC;AAAA,EACnF;AACA,MAAI,KAAK,cAAc,QAAQ;AAC7B,WAAO,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,iCAAiC;AAAA,EACjF;AACA,MAAI,KAAK,cAAc,QAAQ;AAC7B,WAAO,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,8BAA8B;AAAA,EAC9E;AACA,SAAO,EAAE,QAAQ,OAAO,WAAW,IAAI,MAAM,+BAA+B;AAC9E;AAMA,SAAS,qBAAqB,MAAkB,KAAkC;AAChF,MAAI,KAAK,YAAY,QAAQ,CAAC,KAAK,YAAa,QAAO;AACvD,QAAM,KAAK,KAAK;AAChB,MAAI,CAAC,QAAQ,IAAI,GAAG,GAAG;AACrB,WAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,6BAA6B;AAAA,EAChF;AACA,SAAO,KAAK,YAAY,SACpB,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,oBAAoB,IAC3D,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,kBAAkB;AAC/D;AAOA,SAAS,gBAAgB,MAAkB,KAAkC;AAC3E,MAAI,KAAK,oBAAoB,QAAQ,CAAC,KAAK,gBAAiB,QAAO;AACnE,QAAM,KAAK,KAAK;AAChB,MAAI,KAAK,oBAAoB,QAAQ;AACnC,WAAO,EAAE,QAAQ,OAAO,WAAW,IAAI,MAAM,uBAAuB;AAAA,EACtE;AACA,MAAI,CAAC,QAAQ,IAAI,GAAG,GAAG;AACrB,WAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,2BAA2B;AAAA,EAC9E;AACA,MAAI,KAAK,oBAAoB,WAAW;AACtC,WAAO,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,2CAA2C;AAAA,EAC3F;AACA,MAAI,KAAK,oBAAoB,WAAW;AACtC,WAAO,EAAE,QAAQ,QAAQ,WAAW,IAAI,MAAM,+BAA+B;AAAA,EAC/E;AACA,SAAO,EAAE,QAAQ,WAAW,WAAW,IAAI,MAAM,+BAA+B;AAClF;;;AC/XA,SAAS,oBAAoB;AAC7B,SAAS,WAAW;AACpB,SAAS,+BAA+B;;;ACSxC,IAAM,mBAAmB,oBAAI,IAAI,CAAC,KAAK,GAAG,CAAC;AAE3C,IAAM,kBAAkB,oBAAI,IAAI,CAAC,GAAG,EAAE,CAAC;AAIvC,IAAM,eACJ;AAeF,IAAM,gBAAgB,oBAAI,IAAI;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AACD,IAAM,gBAAgB;AAKf,SAAS,kBAAkB,GAAqB;AACrD,QAAM,MAAM;AACZ,MAAI,KAAK,0BAA0B,KAAM,QAAO;AAChD,MAAI,CAAC,KAAK,QAAQ,KAAK,UAAU,MAAM,EAAE,KAAK,CAAC,MAAM,iBAAiB,IAAI,OAAO,CAAC,CAAC,CAAC;AAClF,WAAO;AACT,MAAI,iBAAiB,IAAI,OAAO,KAAK,IAAI,CAAC,KAAK,gBAAgB,IAAI,OAAO,KAAK,IAAI,CAAC;AAClF,WAAO;AACT,QAAM,MAAM,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC;AACrD,SAAO,aAAa,KAAK,GAAG;AAC9B;AAKA,SAAS,mBAAmB,GAAqB;AAC/C,SAAQ,GAAqC,0BAA0B;AACzE;AAMO,SAAS,mBAAmB,GAAqB;AACtD,QAAM,MAAM;AACZ,MAAI,KAAK,0BAA0B,KAAM,QAAO;AAChD,QAAM,UAAU,KAAK,UAAU,MAAM,OAAO;AAC5C,MAAI,MAAM,QAAQ,OAAO,KAAK,QAAQ,SAAS,GAAG;AAChD,WAAO,QAAQ,KAAK,CAAC,MAAM,GAAG,UAAU,QAAQ,cAAc,IAAI,EAAE,OAAO,YAAY,CAAC,CAAC;AAAA,EAC3F;AACA,QAAM,MAAM,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC;AACrD,SAAO,cAAc,KAAK,GAAG;AAC/B;AASA,eAAsB,oBACpB,UACA,OACA,SACY;AACZ,MAAI,SAAS,WAAW,EAAG,OAAM,IAAI,MAAM,GAAG,KAAK,wCAAwC;AAC3F,QAAM,SAAmB,CAAC;AAM1B,MAAI;AACJ,MAAI;AAGJ,MAAI,WAAW;AACf,aAAW,WAAW,UAAU;AAC9B,QAAI;AACF,YAAM,SAAS,MAAM,QAAQ,OAAO;AACpC,UAAI,OAAO,SAAS,GAAG;AACrB,gBAAQ;AAAA,UACN,WACI,UAAK,KAAK,sBAAsB,OAAO,KAAK,IAAI,CAAC,yBAAoB,OAAO,uDAE5E,UAAK,KAAK,sBAAsB,OAAO,KAAK,IAAI,CAAC,yBAAoB,OAAO;AAAA,QAGlF;AAAA,MACF;AACA,aAAO;AAAA,IACT,SAAS,GAAG;AACV,UAAI,CAAC,kBAAkB,CAAC,EAAG,OAAM;AACjC,aAAO,KAAK,GAAG,OAAO,KAAK,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,CAAC,GAAG;AACxE,UAAI,mBAAmB,CAAC,GAAG;AACzB,uBAAe;AACf,mBAAW;AAAA,MACb,OAAO;AACL,wBAAgB;AAChB,YAAI,CAAC,mBAAmB,CAAC,EAAG,YAAW;AAAA,MACzC;AAAA,IACF;AAAA,EACF;AAIA,QAAM,iBAAiB;AACzB;;;AD7HA,IAAM,qBAAqB;AAC3B,IAAMC,cAAa;AAgCZ,SAAS,kBAAkB,SAA2B;AAC3D,MAAI,CAAC,UAAU,OAAO,EAAG,QAAO,CAAC;AACjC,QAAM,OAAO,WAAW,OAAO,EAAE,YAAY;AAC7C,MAAI,CAAC,KAAK,SAAS,GAAG,EAAG,QAAO,CAAC;AACjC,QAAM,OAAO,KAAK,WAAW,MAAM,IAAI,KAAK,MAAM,CAAC,IAAI;AACvD,SAAO,CAAC,MAAM,OAAO,IAAI,EAAE;AAC7B;AAGA,SAAS,IAAI,GAAiB;AAC5B,SAAO,EAAE,YAAY,EAAE,MAAM,GAAG,EAAE;AACpC;AAUA,eAAsB,iBACpB,OACA,aACA,WACgD;AAChD,QAAM,MAAM,KAAK,MAAM,aAAa,MAAM,SAAS,MAAM,CAAC;AAK1D,QAAM,aAAa,KAAK,OAAO,UAAU,QAAQ,IAAI,YAAY,QAAQ,KAAKA,WAAU;AACxF,QAAM,UAAU,IAAI,KAAK,YAAY,QAAQ,IAAIA,WAAU;AAC3D,QAAM,YAAY,IAAI,KAAK,QAAQ,QAAQ,IAAI,aAAaA,WAAU;AACtE,QAAM,WAAW,cAAc,MAAM,UAAU;AAE/C,SAAO,oBAAoB,MAAM,UAAU,MAAM,OAAO,YAAY;AAClE,UAAM,aAAa,IAAI,IAAI;AAAA,MACzB,OAAO,IAAI;AAAA,MACX,KAAK,IAAI;AAAA,MACT,QAAQ,CAAC,kBAAkB;AAAA,MAC3B;AAAA,IACF,CAAC;AACD,UAAM,SAAS,IAAI,wBAAwB,EAAE,WAAW,CAAC;AAEzD,UAAM,MAAM,OAAO,OAAa,QAA+B;AAC7D,YAAM,CAAC,IAAI,IAAI,MAAM,OAAO,UAAU;AAAA,QACpC;AAAA,QACA,YAAY,CAAC,EAAE,WAAW,IAAI,KAAK,GAAG,SAAS,IAAI,GAAG,EAAE,CAAC;AAAA,QACzD,SAAS,CAAC,EAAE,MAAM,cAAc,CAAC;AAAA;AAAA;AAAA;AAAA,QAIjC,GAAI,MAAM,UAAU,SAAS,IACzB;AAAA,UACE,iBAAiB;AAAA,YACf,QAAQ;AAAA,cACN,WAAW;AAAA,cACX,cAAc,EAAE,QAAQ,MAAM,UAAU;AAAA,YAC1C;AAAA,UACF;AAAA,QACF,IACA,CAAC;AAAA,MACP,CAAC;AACD,YAAM,MAAM,KAAK,OAAO,CAAC,GAAG,eAAe,CAAC,GAAG,SAAS;AACxD,YAAM,IAAI,OAAO,SAAS,KAAK,EAAE;AACjC,aAAO,OAAO,SAAS,CAAC,IAAI,IAAI;AAAA,IAClC;AAEA,UAAM,UAAU,MAAM,IAAI,aAAa,SAAS;AAChD,UAAM,WAAW,MAAM,IAAI,WAAW,OAAO;AAC7C,WAAO,EAAE,SAAS,SAAS;AAAA,EAC7B,CAAC;AACH;;;AEhHA,SAAS,gBAAAC,qBAAoB;AAC7B,SAAS,OAAAC,YAAW;AAGpB,IAAM,sBAAsB;AAC5B,IAAM,UAAU;AAEhB,IAAM,sBAAsB;AAKrB,IAAM,wBAAwB;AAoC9B,SAAS,SAAS,GAAmB;AAC1C,SAAO,EACJ,KAAK,EACL,QAAQ,gBAAgB,EAAE,EAC1B,QAAQ,iBAAiB,EAAE,EAC3B,MAAM,GAAG,EAAE,CAAC,EACZ,QAAQ,WAAW,EAAE,EACrB,YAAY;AACjB;AASO,SAAS,0BAA0B,SAAsB,MAAwB;AACtF,QAAM,SAAS,SAAS,IAAI;AAC5B,QAAM,UAAU,QAAQ,OAAO,CAAC,MAAM,SAAS,EAAE,OAAO,MAAM,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO;AAC1F,QAAM,UAAU,QAAQ,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,WAAW,YAAY,CAAC;AAC9E,QAAM,WAAW,QAAQ,OAAO,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,WAAW,YAAY,CAAC;AAChF,SAAO,CAAC,GAAG,SAAS,GAAG,QAAQ;AACjC;AAGA,SAASC,KAAI,GAAiB;AAC5B,SAAO,EAAE,YAAY,EAAE,MAAM,GAAG,EAAE;AACpC;AAWO,SAAS,eACd,MACoB;AACpB,MAAI;AACJ,aAAW,KAAK,MAAM;AACpB,QAAI,OAAO,EAAE,aAAa,SAAU;AACpC,UAAM,cAAc,EAAE,eAAe;AACrC,QACE,SAAS,UACT,cAAc,KAAK,eAClB,gBAAgB,KAAK,eAAe,EAAE,WAAW,KAAK,UACvD;AACA,aAAO,EAAE,UAAU,EAAE,UAAU,YAAY;AAAA,IAC7C;AAAA,EACF;AACA,SAAO,MAAM;AACf;AAcO,SAAS,oBACd,MACA,YACoB;AACpB,QAAM,OAAO,WAAW,YAAY;AACpC,QAAM,QAAQ,KAAK;AAAA,IACjB,CAAC,MAAM,OAAO,EAAE,aAAa,aAAa,EAAE,OAAO,CAAC,KAAK,IAAI,YAAY,MAAM;AAAA,EACjF;AACA,MAAI,MAAO,QAAO,MAAM;AACxB,SAAO,eAAe,IAAI;AAC5B;AAOA,IAAM,4BAAN,cAAwC,MAAM;AAAA,EACnC,wBAAwB;AAAA,EACjC,YAAY,SAAiB,MAAc;AACzC,UAAM,uCAAuC,IAAI,kBAAkB,OAAO,EAAE;AAAA,EAC9E;AACF;AAcA,eAAsB,oBACpB,GACA,aACA,WACyB;AACzB,QAAM,MAAM,KAAK,MAAMC,cAAa,EAAE,SAAS,MAAM,CAAC;AAKtD,MAAI;AACF,WAAO,MAAM,oBAAoB,EAAE,UAAU,kBAAkB,OAAO,YAAY;AAChF,YAAM,MAAM,IAAIC,KAAI;AAAA,QAClB,OAAO,IAAI;AAAA,QACX,KAAK,IAAI;AAAA,QACT,QAAQ,CAAC,mBAAmB;AAAA,QAC5B;AAAA,MACF,CAAC;AAED,YAAM,WAAW,EAAE,UAAU,KAAK;AAClC,UAAI;AACJ,UAAI,UAAU;AACZ,qBAAa,CAAC,QAAQ;AAAA,MACxB,OAAO;AACL,cAAM,OAAO,MAAM,IAAI,QAAqC;AAAA,UAC1D,KAAK,GAAG,OAAO;AAAA,UACf,QAAQ;AAAA,QACV,CAAC;AACD,qBAAa,0BAA0B,KAAK,KAAK,aAAa,CAAC,GAAG,EAAE,IAAI;AACxE,YAAI,WAAW,WAAW,EAAG,OAAM,IAAI,0BAA0B,SAAS,EAAE,IAAI;AAAA,MAClF;AAEA,iBAAW,YAAY,YAAY;AACjC,cAAM,MAAM,MAAM,IAAI,QAEnB;AAAA,UACD,KAAK,GAAG,OAAO,UAAU,mBAAmB,QAAQ,CAAC;AAAA,UACrD,QAAQ;AAAA,UACR,MAAM;AAAA,YACJ,WAAWF,KAAI,WAAW;AAAA,YAC1B,SAASA,KAAI,SAAS;AAAA,YACtB,YAAY,CAAC,OAAO;AAAA,YACpB,uBAAuB;AAAA,cACrB;AAAA,gBACE,SAAS;AAAA,kBACP,EAAE,WAAW,SAAS,UAAU,YAAY,YAAY,EAAE,MAAM,YAAY,EAAE;AAAA,gBAChF;AAAA,cACF;AAAA,YACF;AAAA,YACA,UAAU;AAAA,UACZ;AAAA,QACF,CAAC;AACD,cAAM,MAAM,oBAAoB,IAAI,KAAK,QAAQ,CAAC,GAAG,EAAE,MAAM,YAAY,CAAC;AAC1E,YAAI,OAAO,QAAQ,UAAU;AAG3B,iBAAO;AAAA,YACL,cAAc,OAAO;AAAA,YACrB,UAAU,KAAK,IAAI,GAAG,KAAK,MAAM,GAAG,CAAC;AAAA,YACrC,eAAe;AAAA,UACjB;AAAA,QACF;AAAA,MACF;AAEA,aAAO,EAAE,cAAc,OAAO,UAAU,MAAM,eAAe,KAAK;AAAA,IACpE,CAAC;AAAA,EACH,SAAS,GAAG;AAKV,QAAI,aAAa;AACf,aAAO,EAAE,cAAc,OAAO,UAAU,MAAM,eAAe,MAAM;AACrE,UAAM;AAAA,EACR;AACF;;;AJxLA,eAAsB,mBACpB,MACA,OAA0B,CAAC,GACT;AAClB,MAAI,CAAC,KAAK,IAAK,QAAO;AACtB,QAAM,WAAW,KAAK,YAAY;AAClC,QAAM,SAAS,KAAK,UAAU;AAC9B,MAAI;AACF,UAAM,MAAM,MAAM,SAAS,EAAE,KAAK,KAAK,KAAK,MAAM,SAAS,KAAK,IAAI,EAAE,CAAC;AACvE,UAAM,OAAO,KAAK,IAAI,gBAAgB,IAAI,OAAO,IAAI,UAAU,IAAI,aAAa;AAAA,MAC9E,WAAW;AAAA,IACb,CAAC;AACD,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,YAAQ;AAAA,MACN,2CAAsC,KAAK,IAAI,KAC7C,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CACjD;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;AAuFA,SAAS,kBAAkB,SAAuC;AAChE,QAAM,EAAE,QAAQ,QAAQ,SAAS,SAAS,IAAI;AAC9C,MAAI,WAAW,QAAQ,WAAW,QAAQ,YAAY,QAAQ,aAAa,MAAM;AAC/E,UAAM,IAAI;AAAA,MACR,SAAS,QAAQ,IAAI;AAAA,IAEvB;AAAA,EACF;AACA,SAAO,EAAE,aAAa,QAAQ,eAAe,QAAQ,eAAe,SAAS,KAAK,SAAS;AAC7F;AAEA,SAAS,QAAQ,OAAa,GAAiB;AAK7C,QAAM,MAAM,IAAI,KAAK,KAAK;AAC1B,MAAI,WAAW,IAAI,WAAW,IAAI,CAAC;AACnC,SAAO;AACT;AAYA,eAAsB,mBACpB,MACA,SACA,YACA,UAAwB,CAAC,GACH;AACtB,QAAM,SAAS,kBAAkB,OAAO;AAMxC,QAAM,QAAQ,QAAQ,cAAc,OAAQ,QAAQ,gBAAgB;AACpE,MAAI,CAAC,QAAQ,eAAe,CAAC,OAAO;AAClC,UAAM,IAAI;AAAA,MACR;AAAA,IAGF;AAAA,EACF;AAEA,QAAM,QAAQ,oBAAI,KAAK;AACvB,QAAM,OAAO,SAAS,QAAQ,IAAI;AAElC,QAAM,cAAc,QAChB,MAAM,kBAAkB,OAAO,SAAS,YAAY,KAAK,IACzD,QAAQ,OAAO,EAAE;AAErB,QAAM,YAAY;AAClB,QAAM,cAAc;AAMpB,QAAM,iBACJ,eAAe,iBAAiB,QAAQ,wBACpC,IAAI,KAAK,QAAQ,qBAAqB,IACtC;AASN,QAAM,eAAe,QAAQ,UAAU,SAAS;AAChD,QAAM,WAAW,eACb,MAAM,aAAa,SAAS,aAAa,SAAS,IAClD;AACJ,QAAM,eAAe,eACjB,MAAM,YAAY,SAAS,aAAa,SAAS;AAAA;AAAA;AAAA,IAGjD;AAAA,MACE,GAAG;AAAA,MACH,oBAAoB;AAAA,MACpB,iBAAiB;AAAA,MACjB,eAAe;AAAA,IACjB;AAAA;AACJ,QAAM,UAAU,SAAS;AACzB,QAAM,SAAS,aAAa;AAC5B,QAAM,eAA8B;AAAA,IAClC,GAAI,SAAS,aAAc,CAAC,IAAI,IAAc,CAAC;AAAA,IAC/C,GAAI,aAAa,aAAc,CAAC,QAAQ,IAAc,CAAC;AAAA,EACzD;AAWA,MAAI,SAAS,QAAQ,QAAQ,kBAAkB,OAAO;AACpD,UAAM,mBAAmB,SAAS,QAAQ,iBAAiB,CAAC,CAAC;AAAA,EAC/D;AAEA,QAAM,UAAU,GAAG,IAAI;AACvB,QAAM,EAAE,KAAK,IAAI,MAAM,iBAAiB;AAAA,IACtC,UAAU,QAAQ;AAAA,IAClB,SAAS,QAAQ;AAAA,IACjB;AAAA,IACA;AAAA,IACA,YAAY;AAAA,IACZ,gBAAgB,SAAS;AAAA,IACzB,iBAAiB,SAAS;AAAA,IAC1B,gBAAgB,QAAQ,eAAgB,OAAO,YAAY,SAAa;AAAA,IACxE;AAAA,IACA,YAAY;AAAA,IACZ,MAAM,YAAY,OAAO;AAAA,IACzB,gBAAgB;AAAA,EAClB,CAAC;AAED,MAAI,QAAQ,aAAa;AACvB,UAAM,OAAO,QAAQ,eAAe,WAAW,IAAI;AACnD,UAAM,MAAMG,SAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AAC9C,UAAM,UAAU,MAAM,MAAM,OAAO;AACnC,WAAO;AAAA,MACL,WAAW;AAAA,MACX,UAAU;AAAA,MACV;AAAA,MACA;AAAA,MACA,qBAAqB,aAAa;AAAA,MAClC,uBAAuB,aAAa;AAAA,MACpC,QAAQ;AAAA,MACR,eAAe,CAAC;AAAA,IAClB;AAAA,EACF;AAEA,MAAI,SAAS,KAAM,OAAM,IAAI,MAAM,sCAAsC;AAgBzE,MAAI,aAAa,MAAM,QAAQ,QAAQ,QAAQ,iBAAiB,QAAQ,WAAW,GAAG;AACpF,UAAM,KAAK,aAAa,SAAS,IAAI,MAAM,YAAY,IAAI;AAE3D,UAAM,SAAS,sBAAsB,EAAE;AACvC,QAAI;AACF,YAAM,QAAQ,YAAY,OAAO,QAAQ,IAAI,MAAM;AAAA,IACrD,SAAS,GAAG;AACV,cAAQ;AAAA,QACN,mDAA8C,QAAQ,IAAI,KAAM,EAAY,OAAO;AAAA,MACrF;AAAA,IACF;AACA,QAAI;AACF,YAAM,sBAAsB,MAAM,QAAQ,IAAI,EAAE;AAAA,IAClD,SAAS,GAAG;AACV,cAAQ;AAAA,QACN,6DAAwD,QAAQ,IAAI,KAAM,EAAY,OAAO;AAAA,MAC/F;AAAA,IACF;AAAA,EACF;AASA,MAAI,QAAQ,eAAe;AACzB,UAAM,gBAAgB,QAAQ,eAAe,MAAM,WAAW,MAAM,KAAM;AAC1E,UAAMC,WAAU,MAAM;AAAA,MACpB;AAAA,MACA,EAAE,IAAI,QAAQ,eAAe,QAAQ,QAAQ,IAAI,WAAW;AAAA,MAC5D;AAAA,IACF;AACA,WAAO;AAAA,MACL,WAAW,QAAQ,eAAe;AAAA,MAClC,UAAU;AAAA,MACV;AAAA,MACA;AAAA,MACA,qBAAqB,aAAa;AAAA,MAClC,uBAAuB,aAAa;AAAA,MACpC,QAAQA,SAAQ;AAAA,MAChB,eAAeA,SAAQ;AAAA,IACzB;AAAA,EACF;AAMA,QAAM,WAAW,kBAAkB,SAAS,YAAY,aAAa,EAAE,QAAQ,aAAa,CAAC;AAC7F,QAAM,iBAAiB,CAAC,GAAG,SAAS,QAAQ,CAAC,EAC1C,OAAO,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,MAAM,EACrC,IAAI,CAAC,CAAC,KAAK,MAAM,KAAK;AACzB,QAAM,eAAe,OAAO,YAAY,QAAQ;AAEhD,QAAM,WAAW,GAAG,QAAQ,IAAI,WAAM,UAAU,WAAM,UAAU,YAAY,EAAE,MAAM,GAAG,EAAE,CAAC;AAM1F,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,MACE;AAAA,MACA,QAAQ,QAAQ;AAAA,MAChB;AAAA,MACA,QAAQ,QAAQ,UAAU,UAAU,YAAY,EAAE,MAAM,GAAG,CAAC;AAAA,MAC5D;AAAA,MACA;AAAA,MACA;AAAA,MACA,YAAY;AAAA,MACZ;AAAA,MACA,GAAI,UAAU,EAAE,gBAAgB,QAAQ,SAAS,iBAAiB,QAAQ,SAAS,IAAI,CAAC;AAAA,MACxF,GAAI,SAAS,EAAE,kBAAkB,OAAO,aAAa,IAAI,CAAC;AAAA,MAC1D,GAAI,QAAQ,gBAAgB,OAAO,aAAa,OAC5C,EAAE,gBAAgB,OAAO,SAAS,IAClC,CAAC;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,IACA,EAAE,QAAQ,MAAO,OAAO;AAAA,EAC1B;AAEA,QAAM,gBAAgB,QAAQ,IAAI,MAAM,WAAW,MAAM,KAAM;AAC/D,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA,EAAE,IAAI,QAAQ,IAAI,QAAQ,QAAQ,IAAI,WAAW;AAAA,IACjD;AAAA,EACF;AAEA,SAAO;AAAA,IACL,WAAW;AAAA,IACX,UAAU;AAAA,IACV;AAAA,IACA;AAAA,IACA,qBAAqB,aAAa;AAAA,IAClC,uBAAuB,aAAa;AAAA,IACpC,QAAQ,QAAQ;AAAA,IAChB,eAAe,QAAQ;AAAA,EACzB;AACF;AAUA,eAAe,gBACb,OACA,MACA,WACA,MACA,OACe;AACf,QAAM,eAAe,GAAG,IAAI,IAAI,UAAU,YAAY,EAAE,MAAM,GAAG,EAAE,CAAC;AAIpE,QAAM,iBAAiB,OAAO,iBAAiB,MAAM,cAAc,WAAW;AAC9E,QAAM,MAAM,KAAK,OAAO,IAAI;AAC9B;AAMA,IAAM,gBAAmC,EAAE,OAAO,MAAM,YAAY,MAAM;AAS1E,eAAsB,aACpB,SACA,aACA,WAC4D;AAC5D,QAAM,MAAM,aAAa;AACzB,MAAI,CAAC,OAAO,CAAC,QAAQ,cAAe,QAAO;AAC3C,MAAI;AACF,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,QACE,YAAY,QAAQ;AAAA,QACpB,UAAU,IAAI;AAAA,QACd,SAAS,IAAI;AAAA,QACb,WAAW,kBAAkB,QAAQ,GAAG;AAAA,MAC1C;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,WAAO,EAAE,OAAO,YAAY,MAAM;AAAA,EACpC,SAAS,GAAG;AACV,YAAQ,KAAK,yBAAoB,QAAQ,IAAI,KAAM,EAAY,OAAO,EAAE;AACxE,WAAO,EAAE,OAAO,MAAM,YAAY,KAAK;AAAA,EACzC;AACF;AA6CA,eAAsB,YACpB,SACA,aACA,WAC2B;AAC3B,QAAM,MAAM,aAAa;AACzB,QAAM,WAAW,QAAQ,QAAQ,iBAAiB,QAAQ,WAAW;AACrE,MAAI,CAAC,OAAO,CAAC,UAAU;AACrB,UAAM,gBAAgB,YAAY,CAAC;AACnC,QAAI,eAAe;AACjB,cAAQ;AAAA,QACN,4IAAkI,QAAQ,IAAI;AAAA,MAChJ;AAAA,IACF;AACA,WAAO,EAAE,GAAG,eAAe,oBAAoB,OAAO,iBAAiB,OAAO,cAAc;AAAA,EAC9F;AACA,QAAM,WAAW,QAAQ,aAAa,KAAK;AAC3C,QAAM,QAAQ,YAAY,QAAQ;AAClC,QAAM,cAAc,CAAC;AACrB,MAAI;AACF,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,QACE,SAAS,IAAI;AAAA,QACb,UAAU,IAAI;AAAA,QACd,UAAU,QAAQ,yBAAyB;AAAA,QAC3C,MAAM,QAAQ;AAAA,QACd;AAAA,MACF;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,UAAM,kBAAkB,CAAC,MAAM;AAC/B,QAAI,iBAAiB;AACnB,cAAQ;AAAA,QACN,qDAAgD,QAAQ,GAAG,QAAQ,QAAQ,IAAI;AAAA,MACjF;AAAA,IACF;AACA,UAAM,qBAAqB,MAAM,iBAAiB,eAAe,MAAM,aAAa;AACpF,QAAI,oBAAoB;AACtB,cAAQ;AAAA,QACN,qCAAgC,KAAK,sCAAsC,QAAQ,IAAI;AAAA,MACzF;AAAA,IACF;AACA,WAAO,EAAE,OAAO,YAAY,OAAO,oBAAoB,iBAAiB,eAAe,MAAM;AAAA,EAC/F,SAAS,GAAG;AACV,YAAQ,KAAK,sCAAiC,QAAQ,IAAI,KAAM,EAAY,OAAO,EAAE;AACrF,WAAO;AAAA,MACL,OAAO;AAAA,MACP,YAAY;AAAA,MACZ,oBAAoB;AAAA,MACpB,iBAAiB;AAAA,MACjB,eAAe;AAAA,IACjB;AAAA,EACF;AACF;AASA,eAAe,kBACb,OACA,SACA,YACA,OACe;AACf,QAAM,QAAQ,MAAM,MAAM,QAAQ,QAAQ,EAAE;AAC5C,QAAM,WAAW,MACd,OAAO,CAAC,MAAM,EAAE,eAAe,cAAc,EAAE,SAAS,EACxD,IAAI,CAAC,MAAM,EAAE,SAAU,EACvB,KAAK;AACR,QAAM,SAAS,SAAS,SAAS,SAAS,CAAC;AAC3C,MAAI,CAAC,OAAQ,QAAO,QAAQ,OAAO,EAAE;AAKrC,QAAM,QAAQ,IAAI,KAAK,MAAM;AAC7B,QAAM,WAAW,MAAM,WAAW,IAAI,CAAC;AACvC,SAAO;AACT;","names":["dirname","pos","MS_PER_DAY","readFileSync","JWT","ymd","readFileSync","JWT","dirname","outcome"]}