@reddoorla/maintenance 0.95.1 → 0.97.0

package/dist/submissions-JDZP35JM.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/db/submissions.ts"],"sourcesContent":["import { sql } from \"kysely\";\nimport type { Selectable, SqlBool } from \"kysely\";\nimport type { Db } from \"./client.js\";\nimport type { SubmissionsTable } from \"./schema.js\";\nimport {\n  type SubmissionRow,\n  type SubmissionInput,\n  type BounceDetail,\n  toFormType,\n  toStatus,\n  toNotifyStatus,\n} from \"../reports/submission-row.js\";\nimport type { FormType, SubmissionStatus } from \"../reports/submission-row.js\";\nimport { SIGNUP_FORM_TYPES } from \"../forms/types.js\";\n\nexport type SubmissionFilter = {\n  siteId?: string;\n  formType?: FormType;\n  status?: SubmissionStatus;\n  /** LIKE %q% across name/email/message/phone, case-insensitive */\n  search?: string;\n  /** submitted_at >= from (ISO string) */\n  from?: string;\n  /** submitted_at <= to (ISO string) */\n  to?: string;\n  /** exact spam_reason token (comma-boundary match; a stored \":N\" count suffix on\n   *  the token still matches) */\n  reason?: string;\n};\n\n/** Map a raw DB row to the canonical SubmissionRow, narrowing the enum columns\n *  with the SAME validators the Airtable mapRow uses — SQLite stores TEXT, so a\n *  bad stored value must still be defended against. */\nfunction rowFromDb(r: Selectable<SubmissionsTable>): SubmissionRow {\n  return {\n    id: r.id,\n    submissionId: r.submission_id,\n    siteId: r.site_id,\n    formType: toFormType(r.form_type),\n    name: r.name,\n    email: r.email,\n    phone: r.phone,\n    message: r.message,\n    extraFields: r.extra_fields,\n    sourceUrl: r.source_url,\n    utm: r.utm,\n    submittedAt: r.submitted_at,\n    status: toStatus(r.status),\n    notifyStatus: toNotifyStatus(r.notify_status),\n    resendMessageId: r.resend_message_id,\n    spamScore: typeof r.spam_score === \"number\" ? r.spam_score : null,\n    spamReason: r.spam_reason,\n    fanoutStatus: r.fanout_status,\n    bounceType: r.bounce_type,\n    bounceSubType: r.bounce_subtype,\n    bounceMessage: r.bounce_message,\n    bounceAckAt: r.bounce_ack_at,\n  };\n}\n\n/** Opaque, collision-free id. crypto is a Node 20 global — no new dep. */\nexport function newSubmissionId(): string {\n  return `sub_${crypto.randomUUID()}`;\n}\n\nexport async function getSubmissionById(db: Db, id: string): Promise<SubmissionRow | null> {\n  const r = await db.selectFrom(\"submissions\").selectAll().where(\"id\", \"=\", id).executeTakeFirst();\n  return r ? rowFromDb(r) : null;\n}\n\nexport async function createSubmission(db: Db, input: SubmissionInput): Promise<SubmissionRow> {\n  const id = newSubmissionId();\n  const extra =\n    input.extraFields !== undefined && Object.keys(input.extraFields).length > 0\n      ? JSON.stringify(input.extraFields)\n      : null;\n  await db\n    .insertInto(\"submissions\")\n    .values({\n      id,\n      // Display number: MAX+1 in a single statement. libSQL is single-writer, so\n      // writes serialize and this is race-free.\n      submission_id: sql<number>`(SELECT COALESCE(MAX(submission_id), 0) + 1 FROM submissions)`,\n      site_id: input.siteId,\n      form_type: input.formType,\n      name: input.name,\n      email: input.email,\n      phone: input.phone ?? null,\n      message: input.message ?? null,\n      extra_fields: extra,\n      source_url: input.sourceUrl ?? null,\n      utm: input.utm ?? null,\n      submitted_at: input.submittedAt.toISOString(),\n      status: input.status ?? \"new\",\n      notify_status: \"skipped\",\n      resend_message_id: null,\n      spam_score: input.spamScore ?? null,\n      spam_reason: input.spamReason ?? null,\n      // Always null at insert: the fan-out runs after the row exists (stampFanout).\n      fanout_status: null,\n      // Always null at insert too: a bounce is reported by a webhook minutes\n      // later, and the ack is an operator gesture after that (#783).\n      bounce_type: null,\n      bounce_subtype: null,\n      bounce_message: null,\n      bounce_ack_at: null,\n    })\n    .execute();\n  const created = await getSubmissionById(db, id);\n  if (!created) throw new Error(\"createSubmission: row vanished after insert\");\n  return created;\n}\n\nimport type { NotifyStatus } from \"../reports/submission-row.js\";\n\nexport async function listNewSubmissions(db: Db, max = 200): Promise<SubmissionRow[]> {\n  // Bound the fetch (matches listSubmissionsForSite's default): the cockpit loads this whole\n  // array on every render. Unbounded, it deserializes every unread submission fleet-wide. The\n  // badge count therefore caps at `max` — acceptable, since >200 unread fleet-wide is itself a\n  // triage emergency, and the /submissions page is the unbounded, filterable view.\n  const rows = await db\n    .selectFrom(\"submissions\")\n    .selectAll()\n    .where(\"status\", \"=\", \"new\")\n    .orderBy(\"submitted_at\", \"desc\")\n    .limit(max)\n    .execute();\n  return rows.map(rowFromDb);\n}\n\n/** Same signature shape as the Airtable version (takes `{ id, name }`) so the\n *  composition-root swap is import-only — but here we filter by id directly, with\n *  no linked-field/primary-field workaround and no JS-confirm pass. */\nexport async function listSubmissionsForSite(\n  db: Db,\n  site: { id: string; name: string },\n  max = 200,\n): Promise<SubmissionRow[]> {\n  const rows = await db\n    .selectFrom(\"submissions\")\n    .selectAll()\n    .where(\"site_id\", \"=\", site.id)\n    .orderBy(\"submitted_at\", \"desc\")\n    .limit(max)\n    .execute();\n  return rows.map(rowFromDb);\n}\n\nexport async function setSubmissionStatusRow(\n  db: Db,\n  id: string,\n  status: SubmissionStatus,\n): Promise<void> {\n  await db.updateTable(\"submissions\").set({ status }).where(\"id\", \"=\", id).execute();\n}\n\nexport async function stampNotified(\n  db: Db,\n  id: string,\n  status: NotifyStatus,\n  messageId: string | null,\n): Promise<void> {\n  const patch =\n    messageId !== null\n      ? { notify_status: status, resend_message_id: messageId }\n      : { notify_status: status };\n  await db.updateTable(\"submissions\").set(patch).where(\"id\", \"=\", id).execute();\n}\n\n/** Record the newsletter fan-out outcome on a row (comma-joined destination tokens,\n *  see ingest.ts). REPLACES any previous value — the fan-out runs once per submission,\n *  so the last write is the whole truth; unlike markSubmissionsSpamRetro there is no\n *  earlier trail worth appending to. No status guard: this is provenance about what\n *  the pipeline did, not a triage decision, so it stays accurate even for a row the\n *  operator has already read or archived. */\nexport async function stampFanout(db: Db, id: string, fanoutStatus: string): Promise<void> {\n  await db\n    .updateTable(\"submissions\")\n    .set({ fanout_status: fanoutStatus })\n    .where(\"id\", \"=\", id)\n    .execute();\n}\n\n// NOTE: listSubmissionsFiltered and countSubmissionsFiltered share identical filter\n// logic via applySubmissionFilter — always update both through that helper.\nfunction applySubmissionFilter<O>(\n  qb: import(\"kysely\").SelectQueryBuilder<import(\"./schema.js\").Database, \"submissions\", O>,\n  f: SubmissionFilter,\n) {\n  let q = qb;\n  if (f.siteId !== undefined) q = q.where(\"site_id\", \"=\", f.siteId);\n  if (f.formType !== undefined) q = q.where(\"form_type\", \"=\", f.formType);\n  if (f.status !== undefined) q = q.where(\"status\", \"=\", f.status);\n  if (f.from !== undefined) q = q.where(\"submitted_at\", \">=\", f.from);\n  if (f.to !== undefined) q = q.where(\"submitted_at\", \"<=\", f.to);\n  if (f.search !== undefined && f.search.trim() !== \"\") {\n    // Escape LIKE metacharacters so a user's literal `%`/`_` (or the escape char `\\`) match\n    // literally rather than as wildcards: searching `john_doe` must not also hit `johnXdoe`,\n    // and a bare `%` must not match everything. `\\` is escaped first (it's the ESCAPE char).\n    // Parameterized regardless (no injection) — this is a correctness fix. Uses sql`` because\n    // kysely's `like` operator can't attach an ESCAPE clause.\n    const term = f.search\n      .trim()\n      .toLowerCase()\n      .replace(/[\\\\%_]/g, \"\\\\$&\");\n    const like = `%${term}%`;\n    q = q.where((eb) =>\n      eb.or([\n        sql<SqlBool>`lower(${eb.ref(\"name\")}) like ${like} escape '\\\\'`,\n        sql<SqlBool>`lower(${eb.ref(\"email\")}) like ${like} escape '\\\\'`,\n        sql<SqlBool>`lower(${eb.ref(\"message\")}) like ${like} escape '\\\\'`,\n        sql<SqlBool>`lower(${eb.ref(\"phone\")}) like ${like} escape '\\\\'`,\n      ]),\n    );\n  }\n  if (f.reason !== undefined && f.reason.trim() !== \"\") {\n    // spam_reason is a comma-joined token list (ingest.ts joins \",\"; retro appends\n    // \",<reason>\"). Comma-boundary match so \"links\" never matches \"backlinks\" and\n    // \"turnstile-required-absent\" never matches \"-failed\"; the second branch accepts\n    // a per-token count suffix (\"keywords:4\" matches reason=keywords). LIKE\n    // metacharacters escaped exactly like the search branch. lower() both sides is\n    // safe: tokens are ASCII classifier codes.\n    const token = f.reason\n      .trim()\n      .toLowerCase()\n      .replace(/[\\\\%_]/g, \"\\\\$&\");\n    q = q.where((eb) =>\n      eb.or([\n        sql<SqlBool>`',' || lower(${eb.ref(\"spam_reason\")}) || ',' like ${`%,${token},%`} escape '\\\\'`,\n        sql<SqlBool>`',' || lower(${eb.ref(\"spam_reason\")}) || ',' like ${`%,${token}:%`} escape '\\\\'`,\n      ]),\n    );\n  }\n  return q;\n}\n\nexport async function listSubmissionsFiltered(\n  db: Db,\n  filter: SubmissionFilter,\n  opts: { limit: number; offset: number },\n): Promise<SubmissionRow[]> {\n  const base = db.selectFrom(\"submissions\").selectAll();\n  const rows = await applySubmissionFilter(base, filter)\n    .orderBy(\"submitted_at\", \"desc\")\n    .limit(opts.limit)\n    .offset(opts.offset)\n    .execute();\n  return rows.map(rowFromDb);\n}\n\nexport async function countSubmissionsFiltered(db: Db, filter: SubmissionFilter): Promise<number> {\n  const base = db.selectFrom(\"submissions\").select((eb) => eb.fn.countAll<number>().as(\"n\"));\n  const res = await applySubmissionFilter(base, filter).executeTakeFirstOrThrow();\n  return Number(res.n);\n}\n\n/** Fleet-wide count of auto-filtered spam (`status = 'spam_auto'`) submitted on/after\n *  `sinceDate` (ISO). Powers the cockpit \"N auto-filtered this week — review\" affordance;\n *  the caller picks the window (like `listScreenOutsSince`), keeping this query pure. */\nexport async function countAutoSpamSince(db: Db, sinceDate: string): Promise<number> {\n  const res = await db\n    .selectFrom(\"submissions\")\n    .select((eb) => eb.fn.countAll<number>().as(\"n\"))\n    .where(\"status\", \"=\", \"spam_auto\")\n    .where(\"submitted_at\", \">=\", sinceDate)\n    .executeTakeFirstOrThrow();\n  return Number(res.n);\n}\n\nexport type SiteSubmissionCounts = { leads: number; signups: number; spamAuto: number };\n\n/** Per-site submission counts on/after `sinceIso` (full ISO timestamp) for the\n *  digest telemetry line. Grouped one-query: leads/signups = rows NOT auto- or\n *  operator-bucketed as spam (status NOT IN ('spam_auto','spam')) split by\n *  isLeadFormType; spamAuto = status='spam_auto'. Keyed by Websites record id. */\nexport async function countSubmissionsSinceBySite(\n  db: Db,\n  sinceIso: string,\n): Promise<Map<string, SiteSubmissionCounts>> {\n  const signupList = sql.join(SIGNUP_FORM_TYPES.map((t) => sql`${t}`));\n  const rows = await db\n    .selectFrom(\"submissions\")\n    .select([\n      \"site_id\",\n      sql<number>`sum(case when status not in ('spam_auto','spam') and form_type not in (${signupList}) then 1 else 0 end)`.as(\n        \"leads_n\",\n      ),\n      sql<number>`sum(case when status not in ('spam_auto','spam') and form_type in (${signupList}) then 1 else 0 end)`.as(\n        \"signups_n\",\n      ),\n      sql<number>`sum(case when status = 'spam_auto' then 1 else 0 end)`.as(\"spam_auto_n\"),\n    ])\n    .where(\"submitted_at\", \">=\", sinceIso)\n    .groupBy(\"site_id\")\n    .execute();\n  return new Map(\n    rows.map((r) => [\n      r.site_id,\n      {\n        leads: Number(r.leads_n) || 0,\n        signups: Number(r.signups_n) || 0,\n        spamAuto: Number(r.spam_auto_n) || 0,\n      },\n    ]),\n  );\n}\n\n/** A normalized body shorter than this never triggers the exact-duplicate signal —\n *  short/boilerplate lines (a newsletter \"subscribe\", \"hi\") legitimately repeat\n *  across real people. */\nexport const MIN_DUP_BODY_LEN = 40;\n\n/** Both token sets must be at least this large before the Jaccard tier can fire —\n *  two short genuine messages (\"what are your hours?\" variants) share most of their\n *  few tokens and would otherwise collide. */\nexport const MIN_SIMILAR_TOKENS = 25;\n\n/** Jaccard similarity (token sets) at or above this marks a near-duplicate. 0.9 is\n *  deliberately strict: a template spray with one substituted greeting/target still\n *  clears it, while two independently-written enquiries about the same business\n *  never do. */\nexport const SIMILARITY_THRESHOLD = 0.9;\n\n/** Fold a message body down to its template skeleton. Full-Unicode lowercase first\n *  (JS `toLowerCase()` — SQLite's `lower()` is ASCII-only, which is why this whole\n *  comparison lives in JS, folding BOTH sides identically so byte-identical Cyrillic\n *  copies keep matching), then strip everything a spray substitutes per target —\n *  URLs, emails, bare domains, digit runs — and collapse whitespace. Over-stripping\n *  is safe: it happens symmetrically on both sides. */\nfunction normalizeBody(body: string): string {\n  return body\n    .toLowerCase()\n    .replace(/https?:\\/\\/\\S+/gu, \" \") // full URLs\n    .replace(/www\\.\\S+/gu, \" \") // scheme-less www. links\n    .replace(/\\S+@\\S+/gu, \" \") // email addresses\n    .replace(/\\b[a-z0-9-]+(\\.[a-z0-9-]+)+\\b/gu, \" \") // bare domain tokens (word.tld)\n    .replace(/\\d+/gu, \" \") // digit runs (phone numbers, prices, years)\n    .replace(/\\s+/gu, \" \")\n    .trim();\n}\n\n/** Letter-only token set of a normalized body (punctuation/symbols are separators). */\nfunction tokenSet(normalized: string): Set<string> {\n  return new Set(normalized.split(/[^\\p{L}]+/u).filter((t) => t.length > 0));\n}\n\nfunction jaccard(a: Set<string>, b: Set<string>): number {\n  let intersection = 0;\n  for (const t of a) if (b.has(t)) intersection++;\n  const union = a.size + b.size - intersection;\n  return union === 0 ? 0 : intersection / union;\n}\n\n/** Fleet-wide duplicate/near-duplicate lookup for the spray spam signal — the same\n *  pitch blasted across sites shows up as identical OR near-identical bodies (the\n *  live dog-harness spray differed ONLY in greeting; SEO sprays substitute the\n *  target domain per site — exact match alone missed both). Scans rows submitted\n *  on/after `sinceDate` and compares in JS (see normalizeBody for why not SQL):\n *  - `exact`: normalized equality, only when the normalized incoming body is at\n *    least MIN_DUP_BODY_LEN chars.\n *  - `similar`: token-set Jaccard >= SIMILARITY_THRESHOLD, only when BOTH sets have\n *    at least MIN_SIMILAR_TOKENS tokens. A row matched as exact never re-appears here.\n *  Returned statuses let the caller retro-bucket still-'new' prior copies. The 2000-row\n *  LIMIT is a safety bound only — current volume is ~130/month, so a 30-day window is\n *  always a full scan. */\n/** One matched prior row from the duplicate scan. Carries siteId + email so the\n *  ingest caller can exempt a GENUINE same-sender resubmission on the same site\n *  (a real visitor double-submitting / resending after silence) — only cross-site\n *  or different-sender copies are spray evidence. */\nexport type DuplicateMatch = { id: string; status: string; siteId: string; email: string };\n\nexport async function findRecentDuplicateSubmissions(\n  db: Db,\n  message: string,\n  sinceDate: string,\n): Promise<{\n  exact: DuplicateMatch[];\n  similar: DuplicateMatch[];\n}> {\n  const incoming = normalizeBody(message);\n  const incomingTokens = tokenSet(incoming);\n  const exactEligible = incoming.length >= MIN_DUP_BODY_LEN;\n  const similarEligible = incomingTokens.size >= MIN_SIMILAR_TOKENS;\n  // Too short for either tier — skip the scan entirely (nothing could match).\n  if (!exactEligible && !similarEligible) return { exact: [], similar: [] };\n\n  const rows = await db\n    .selectFrom(\"submissions\")\n    .select([\"id\", \"status\", \"message\", \"site_id\", \"email\"])\n    .where(\"message\", \"is not\", null)\n    .where(\"submitted_at\", \">=\", sinceDate)\n    .orderBy(\"submitted_at\", \"desc\")\n    .limit(2000)\n    .execute();\n\n  const exact: DuplicateMatch[] = [];\n  const similar: DuplicateMatch[] = [];\n  for (const row of rows) {\n    const stored = normalizeBody(row.message ?? \"\");\n    const match: DuplicateMatch = {\n      id: row.id,\n      status: row.status,\n      siteId: row.site_id,\n      email: row.email,\n    };\n    if (exactEligible && stored === incoming) {\n      exact.push(match);\n      continue; // an exact match must not also appear in similar\n    }\n    if (!similarEligible) continue;\n    const storedTokens = tokenSet(stored);\n    if (storedTokens.size < MIN_SIMILAR_TOKENS) continue;\n    if (jaccard(incomingTokens, storedTokens) >= SIMILARITY_THRESHOLD) {\n      similar.push(match);\n    }\n  }\n  return { exact, similar };\n}\n\n/** Recent non-newsletter submissions from `email` (case/whitespace-folded), on/after\n *  `sinceDate` (ISO). Powers the cross-site repeat-sender signal: the fleet's sites\n *  are UNRELATED businesses, so the same address writing to 2+ of them inside a month\n *  is a solicitation tell — the caller compares siteIds (same-site repeats are genuine\n *  follow-ups). Newsletter rows are excluded: one person subscribing on two sites is\n *  legitimate. Both sides fold in SQL (same-side folding, see the normalizeBody note). */\nexport async function listRecentSubmissionsForEmail(\n  db: Db,\n  email: string,\n  sinceDate: string,\n): Promise<Array<{ id: string; siteId: string; status: string }>> {\n  if (email.trim() === \"\") return [];\n  const rows = await db\n    .selectFrom(\"submissions\")\n    .select([\"id\", \"site_id\", \"status\"])\n    .where(\"form_type\", \"!=\", \"newsletter\")\n    .where(\"submitted_at\", \">=\", sinceDate)\n    .where((eb) => sql<SqlBool>`lower(trim(${eb.ref(\"email\")})) = lower(trim(${email}))`)\n    .execute();\n  return rows.map((r) => ({ id: r.id, siteId: r.site_id, status: r.status }));\n}\n\n/** Retroactively re-bucket prior spray copies once a later copy identifies the spray\n *  (the FIRST copy is always delivered by design — only a repeat reveals it). Appends\n *  `retroReason` to any existing spam_reason so the original classifier trail survives.\n *  The `status = 'new'` guard is load-bearing: rows the operator already read/replied/\n *  archived/marked are NEVER touched — this only cleans the unread queue. */\nexport async function markSubmissionsSpamRetro(\n  db: Db,\n  ids: string[],\n  retroReason: string,\n): Promise<void> {\n  if (ids.length === 0) return;\n  await db\n    .updateTable(\"submissions\")\n    .set({\n      status: \"spam_auto\",\n      spam_reason: sql<string>`CASE WHEN spam_reason IS NULL OR spam_reason = '' THEN ${retroReason} ELSE spam_reason || ',' || ${retroReason} END`,\n    })\n    .where(\"id\", \"in\", ids)\n    .where(\"status\", \"=\", \"new\")\n    .execute();\n}\n\n/** spam_reason strings for EVERY row matching `filter` (not just one page). Powers the\n *  /submissions per-reason facet line, which must tally the WHOLE filtered bucket — the\n *  rollout runbook directs the operator to judge the canary from it, and a page-scoped\n *  tally under the full-bucket total silently misread once the bucket passed one page.\n *  Capped (default 2000) as a safety bound far above any real bucket. */\nexport async function listSpamReasonsFiltered(\n  db: Db,\n  filter: SubmissionFilter,\n  cap = 2000,\n): Promise<string[]> {\n  const base = db.selectFrom(\"submissions\").select([\"spam_reason\"]);\n  const rows = await applySubmissionFilter(base, filter)\n    .where(\"spam_reason\", \"is not\", null)\n    .limit(cap)\n    .execute();\n  return rows.map((r) => r.spam_reason).filter((r): r is string => r !== null && r !== \"\");\n}\n\n/** Insert a SubmissionRow verbatim, preserving its id, display number, and status.\n *  ON CONFLICT(id) DO NOTHING makes the whole backfill re-runnable. */\nexport async function backfillSubmission(db: Db, row: SubmissionRow): Promise<void> {\n  await db\n    .insertInto(\"submissions\")\n    .values({\n      id: row.id,\n      submission_id: row.submissionId,\n      site_id: row.siteId,\n      form_type: row.formType,\n      name: row.name,\n      email: row.email,\n      phone: row.phone,\n      message: row.message,\n      extra_fields: row.extraFields,\n      source_url: row.sourceUrl,\n      utm: row.utm,\n      submitted_at: row.submittedAt,\n      status: row.status,\n      notify_status: row.notifyStatus,\n      resend_message_id: row.resendMessageId,\n      spam_score: row.spamScore ?? null,\n      spam_reason: row.spamReason ?? null,\n      fanout_status: row.fanoutStatus ?? null,\n      bounce_type: row.bounceType ?? null,\n      bounce_subtype: row.bounceSubType ?? null,\n      bounce_message: row.bounceMessage ?? null,\n      bounce_ack_at: row.bounceAckAt ?? null,\n    })\n    .onConflict((oc) => oc.column(\"id\").doNothing())\n    .execute();\n}\n\n/** Re-score write for the `submissions rescore` CLI (2026-07-16): flip ONE still-'new'\n *  row to spam_auto with the CURRENT classifier's verdict. Unlike markSubmissionsSpamRetro\n *  (which appends to the old trail), this REPLACES spam_score/spam_reason — the point of a\n *  re-score is that today's verdict supersedes the stale ingest-time one; the caller bakes\n *  its provenance marker (retro-rescore) into `reason`. The status='new' guard is\n *  load-bearing: rows the operator already read/replied/archived/marked are NEVER\n *  re-bucketed. Returns true when the row was written (false = no longer 'new'). */\nexport async function rescoreSubmissionSpam(\n  db: Db,\n  id: string,\n  score: number,\n  reason: string,\n): Promise<boolean> {\n  const res = await db\n    .updateTable(\"submissions\")\n    .set({ status: \"spam_auto\", spam_score: score, spam_reason: reason })\n    .where(\"id\", \"=\", id)\n    .where(\"status\", \"=\", \"new\")\n    .executeTakeFirst();\n  return Number(res.numUpdatedRows) > 0;\n}\n\n/** Bulk triage for the /submissions page (2026-07-16): flip EVERY still-'new' row\n *  matching `filter` to 'read', server-side, so a 100-row backlog is one click instead\n *  of 100. Reuses applySubmissionFilter (via an id-subquery — kysely's update builder\n *  can't take the select-only helper directly) so the POST flips exactly the bucket the\n *  GET rendered. The outer status='new' guard is load-bearing: spam/archived/read rows\n *  are never touched even when the filter matches them (bulk-\"reading\" a spam_auto row\n *  would resurrect it into the per-site strip). Returns the number of rows flipped. */\nexport async function markFilteredAsRead(db: Db, filter: SubmissionFilter): Promise<number> {\n  const res = await db\n    .updateTable(\"submissions\")\n    .set({ status: \"read\" })\n    .where(\"status\", \"=\", \"new\")\n    .where(\"id\", \"in\", (eb) =>\n      applySubmissionFilter(eb.selectFrom(\"submissions\").select(\"id\"), filter),\n    )\n    .executeTakeFirst();\n  return Number(res.numUpdatedRows);\n}\n\n/** Flip a submission's notify_status to 'bounced' by its Resend message id — the\n *  resend-webhook's mapping from a bounce/complaint event back onto the lead whose\n *  notification it was (2026-07-16, the Espada failure mode: 'sent' only means Resend\n *  ACCEPTED the email). Returns whether any row matched, so the webhook can tell a\n *  submission notification apart from a report email (unknown id → false → the report\n *  path handles it). Idempotent: a svix replay re-writes the same terminal value. In\n *  practice only 'sent' rows can match — stampNotified stamps the message id and the\n *  'sent' status together, and failed/skipped rows carry no id. */\nexport async function markNotifyBouncedByMessageId(\n  db: Db,\n  messageId: string,\n  /** Resend's `data.bounce`, parsed (#783). Null for a complaint, which carries\n   *  no bounce object, and for any payload whose shape we did not recognize.\n   *\n   *  A null detail deliberately does NOT clear a classification already stored:\n   *  a svix replay of the same event, or a later complaint on a message that\n   *  already bounced, must not erase the diagnosis the first delivery carried. */\n  detail: BounceDetail | null = null,\n): Promise<boolean> {\n  if (messageId === \"\") return false;\n  const res = await db\n    .updateTable(\"submissions\")\n    .set(\n      detail === null\n        ? { notify_status: \"bounced\" }\n        : {\n            notify_status: \"bounced\",\n            bounce_type: detail.type,\n            bounce_subtype: detail.subType,\n            bounce_message: detail.message,\n          },\n    )\n    .where(\"resend_message_id\", \"=\", messageId)\n    .executeTakeFirst();\n  if (Number(res.numUpdatedRows) > 0) return true;\n  // A replayed webhook must still report \"this was a submission\" (200, stop svix\n  // retrying) even though the terminal value is already written — matched-but-\n  // unchanged rows still count in numUpdatedRows on SQLite, but don't rely on it.\n  const existing = await db\n    .selectFrom(\"submissions\")\n    .select(\"id\")\n    .where(\"resend_message_id\", \"=\", messageId)\n    .executeTakeFirst();\n  return existing !== undefined;\n}\n\n/** Acknowledge ONE bounced notification as \"not a dead address\" (#783).\n *\n *  The row keeps its bounce record — status, type, sub-type and the receiving\n *  server's message all stay — and simply stops counting toward the alarm. That\n *  is the difference from the production workaround this replaces, which flipped\n *  `bounced` back to `sent` by id and destroyed the evidence along with the\n *  alarm.\n *\n *  Guarded on `notify_status = 'bounced'` (there is nothing to acknowledge on a\n *  healthy row) and on `bounce_ack_at IS NULL`, which makes it idempotent and\n *  keeps the FIRST acknowledgement's timestamp — the honest one, since that is\n *  when the operator actually looked. Returns whether this call was the one that\n *  wrote. A PERMANENT bounce is deliberately still ackable: the ack means \"I\n *  have looked at this\", not \"this was a false alarm\", and refusing it would\n *  leave no way to close the case after genuinely fixing the mailbox. */\nexport async function ackNotifyBounce(db: Db, id: string, now: Date): Promise<boolean> {\n  const res = await db\n    .updateTable(\"submissions\")\n    .set({ bounce_ack_at: now.toISOString() })\n    .where(\"id\", \"=\", id)\n    .where(\"notify_status\", \"=\", \"bounced\")\n    .where(\"bounce_ack_at\", \"is\", null)\n    .executeTakeFirst();\n  return Number(res.numUpdatedRows) > 0;\n}\n\n/** Per-site bounce counts, split by whether the payload said the ADDRESS is bad. */\nexport type NotifyBounceCounts = {\n  /** Unacknowledged bounced notifications in the window. */\n  total: number;\n  /** How many of those Resend classified `Permanent` (#783). Counted ONLY where\n   *  the payload actually said so: a null classification — every row written\n   *  before migration 0018, and every complaint — counts toward `total` and\n   *  never toward this. Reading null as permanent would keep accusing the\n   *  address on exactly the rows that caused the false alarm. */\n  permanent: number;\n};\n\n/** Per-site counts of bounced lead notifications on/after `sinceDate` (ISO), keyed by\n *  the Websites record id (`site_id`). Powers the notify-bounce attention collector —\n *  the caller picks the window (like `countAutoSpamSince`), keeping this query pure.\n *  Windowed on `submitted_at`: the bounce lands minutes after the submission, and\n *  submissions carry no bounce timestamp column (append-only schema, 2026-07-16).\n *\n *  Acknowledged rows are excluded outright (#783), which is what lets a diagnosed\n *  false alarm clear the same day instead of aging out over fourteen. A site whose\n *  every bounce is acked drops out of the map entirely, exactly like a site that\n *  never bounced — both are \"nothing to raise\". */\nexport async function countNotifyBouncedBySite(\n  db: Db,\n  sinceDate: string,\n): Promise<Map<string, NotifyBounceCounts>> {\n  const rows = await db\n    .selectFrom(\"submissions\")\n    .select([\n      \"site_id\",\n      (eb) => eb.fn.countAll<number>().as(\"n\"),\n      // lower() is ASCII-only in SQLite, which is all this needs: the value is a\n      // Resend enum (\"Permanent\"/\"Transient\"/\"Undetermined\"). Matching it\n      // case-insensitively here keeps the SQL agreeing with isPermanentBounce.\n      sql<number>`sum(case when lower(bounce_type) = 'permanent' then 1 else 0 end)`.as(\n        \"permanent_n\",\n      ),\n    ])\n    .where(\"notify_status\", \"=\", \"bounced\")\n    .where(\"submitted_at\", \">=\", sinceDate)\n    .where(\"bounce_ack_at\", \"is\", null)\n    .groupBy(\"site_id\")\n    .execute();\n  return new Map(\n    rows.map((r) => [\n      r.site_id,\n      { total: Number(r.n) || 0, permanent: Number(r.permanent_n) || 0 },\n    ]),\n  );\n}\n"],"mappings":";;;;;;;;;;AAAA,SAAS,WAAW;AAiCpB,SAAS,UAAU,GAAgD;AACjE,SAAO;AAAA,IACL,IAAI,EAAE;AAAA,IACN,cAAc,EAAE;AAAA,IAChB,QAAQ,EAAE;AAAA,IACV,UAAU,WAAW,EAAE,SAAS;AAAA,IAChC,MAAM,EAAE;AAAA,IACR,OAAO,EAAE;AAAA,IACT,OAAO,EAAE;AAAA,IACT,SAAS,EAAE;AAAA,IACX,aAAa,EAAE;AAAA,IACf,WAAW,EAAE;AAAA,IACb,KAAK,EAAE;AAAA,IACP,aAAa,EAAE;AAAA,IACf,QAAQ,SAAS,EAAE,MAAM;AAAA,IACzB,cAAc,eAAe,EAAE,aAAa;AAAA,IAC5C,iBAAiB,EAAE;AAAA,IACnB,WAAW,OAAO,EAAE,eAAe,WAAW,EAAE,aAAa;AAAA,IAC7D,YAAY,EAAE;AAAA,IACd,cAAc,EAAE;AAAA,IAChB,YAAY,EAAE;AAAA,IACd,eAAe,EAAE;AAAA,IACjB,eAAe,EAAE;AAAA,IACjB,aAAa,EAAE;AAAA,EACjB;AACF;AAGO,SAAS,kBAA0B;AACxC,SAAO,OAAO,OAAO,WAAW,CAAC;AACnC;AAEA,eAAsB,kBAAkB,IAAQ,IAA2C;AACzF,QAAM,IAAI,MAAM,GAAG,WAAW,aAAa,EAAE,UAAU,EAAE,MAAM,MAAM,KAAK,EAAE,EAAE,iBAAiB;AAC/F,SAAO,IAAI,UAAU,CAAC,IAAI;AAC5B;AAEA,eAAsB,iBAAiB,IAAQ,OAAgD;AAC7F,QAAM,KAAK,gBAAgB;AAC3B,QAAM,QACJ,MAAM,gBAAgB,UAAa,OAAO,KAAK,MAAM,WAAW,EAAE,SAAS,IACvE,KAAK,UAAU,MAAM,WAAW,IAChC;AACN,QAAM,GACH,WAAW,aAAa,EACxB,OAAO;AAAA,IACN;AAAA;AAAA;AAAA,IAGA,eAAe;AAAA,IACf,SAAS,MAAM;AAAA,IACf,WAAW,MAAM;AAAA,IACjB,MAAM,MAAM;AAAA,IACZ,OAAO,MAAM;AAAA,IACb,OAAO,MAAM,SAAS;AAAA,IACtB,SAAS,MAAM,WAAW;AAAA,IAC1B,cAAc;AAAA,IACd,YAAY,MAAM,aAAa;AAAA,IAC/B,KAAK,MAAM,OAAO;AAAA,IAClB,cAAc,MAAM,YAAY,YAAY;AAAA,IAC5C,QAAQ,MAAM,UAAU;AAAA,IACxB,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,YAAY,MAAM,aAAa;AAAA,IAC/B,aAAa,MAAM,cAAc;AAAA;AAAA,IAEjC,eAAe;AAAA;AAAA;AAAA,IAGf,aAAa;AAAA,IACb,gBAAgB;AAAA,IAChB,gBAAgB;AAAA,IAChB,eAAe;AAAA,EACjB,CAAC,EACA,QAAQ;AACX,QAAM,UAAU,MAAM,kBAAkB,IAAI,EAAE;AAC9C,MAAI,CAAC,QAAS,OAAM,IAAI,MAAM,6CAA6C;AAC3E,SAAO;AACT;AAIA,eAAsB,mBAAmB,IAAQ,MAAM,KAA+B;AAKpF,QAAM,OAAO,MAAM,GAChB,WAAW,aAAa,EACxB,UAAU,EACV,MAAM,UAAU,KAAK,KAAK,EAC1B,QAAQ,gBAAgB,MAAM,EAC9B,MAAM,GAAG,EACT,QAAQ;AACX,SAAO,KAAK,IAAI,SAAS;AAC3B;AAKA,eAAsB,uBACpB,IACA,MACA,MAAM,KACoB;AAC1B,QAAM,OAAO,MAAM,GAChB,WAAW,aAAa,EACxB,UAAU,EACV,MAAM,WAAW,KAAK,KAAK,EAAE,EAC7B,QAAQ,gBAAgB,MAAM,EAC9B,MAAM,GAAG,EACT,QAAQ;AACX,SAAO,KAAK,IAAI,SAAS;AAC3B;AAEA,eAAsB,uBACpB,IACA,IACA,QACe;AACf,QAAM,GAAG,YAAY,aAAa,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,MAAM,MAAM,KAAK,EAAE,EAAE,QAAQ;AACnF;AAEA,eAAsB,cACpB,IACA,IACA,QACA,WACe;AACf,QAAM,QACJ,cAAc,OACV,EAAE,eAAe,QAAQ,mBAAmB,UAAU,IACtD,EAAE,eAAe,OAAO;AAC9B,QAAM,GAAG,YAAY,aAAa,EAAE,IAAI,KAAK,EAAE,MAAM,MAAM,KAAK,EAAE,EAAE,QAAQ;AAC9E;AAQA,eAAsB,YAAY,IAAQ,IAAY,cAAqC;AACzF,QAAM,GACH,YAAY,aAAa,EACzB,IAAI,EAAE,eAAe,aAAa,CAAC,EACnC,MAAM,MAAM,KAAK,EAAE,EACnB,QAAQ;AACb;AAIA,SAAS,sBACP,IACA,GACA;AACA,MAAI,IAAI;AACR,MAAI,EAAE,WAAW,OAAW,KAAI,EAAE,MAAM,WAAW,KAAK,EAAE,MAAM;AAChE,MAAI,EAAE,aAAa,OAAW,KAAI,EAAE,MAAM,aAAa,KAAK,EAAE,QAAQ;AACtE,MAAI,EAAE,WAAW,OAAW,KAAI,EAAE,MAAM,UAAU,KAAK,EAAE,MAAM;AAC/D,MAAI,EAAE,SAAS,OAAW,KAAI,EAAE,MAAM,gBAAgB,MAAM,EAAE,IAAI;AAClE,MAAI,EAAE,OAAO,OAAW,KAAI,EAAE,MAAM,gBAAgB,MAAM,EAAE,EAAE;AAC9D,MAAI,EAAE,WAAW,UAAa,EAAE,OAAO,KAAK,MAAM,IAAI;AAMpD,UAAM,OAAO,EAAE,OACZ,KAAK,EACL,YAAY,EACZ,QAAQ,WAAW,MAAM;AAC5B,UAAM,OAAO,IAAI,IAAI;AACrB,QAAI,EAAE;AAAA,MAAM,CAAC,OACX,GAAG,GAAG;AAAA,QACJ,YAAqB,GAAG,IAAI,MAAM,CAAC,UAAU,IAAI;AAAA,QACjD,YAAqB,GAAG,IAAI,OAAO,CAAC,UAAU,IAAI;AAAA,QAClD,YAAqB,GAAG,IAAI,SAAS,CAAC,UAAU,IAAI;AAAA,QACpD,YAAqB,GAAG,IAAI,OAAO,CAAC,UAAU,IAAI;AAAA,MACpD,CAAC;AAAA,IACH;AAAA,EACF;AACA,MAAI,EAAE,WAAW,UAAa,EAAE,OAAO,KAAK,MAAM,IAAI;AAOpD,UAAM,QAAQ,EAAE,OACb,KAAK,EACL,YAAY,EACZ,QAAQ,WAAW,MAAM;AAC5B,QAAI,EAAE;AAAA,MAAM,CAAC,OACX,GAAG,GAAG;AAAA,QACJ,mBAA4B,GAAG,IAAI,aAAa,CAAC,iBAAiB,KAAK,KAAK,IAAI;AAAA,QAChF,mBAA4B,GAAG,IAAI,aAAa,CAAC,iBAAiB,KAAK,KAAK,IAAI;AAAA,MAClF,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAsB,wBACpB,IACA,QACA,MAC0B;AAC1B,QAAM,OAAO,GAAG,WAAW,aAAa,EAAE,UAAU;AACpD,QAAM,OAAO,MAAM,sBAAsB,MAAM,MAAM,EAClD,QAAQ,gBAAgB,MAAM,EAC9B,MAAM,KAAK,KAAK,EAChB,OAAO,KAAK,MAAM,EAClB,QAAQ;AACX,SAAO,KAAK,IAAI,SAAS;AAC3B;AAEA,eAAsB,yBAAyB,IAAQ,QAA2C;AAChG,QAAM,OAAO,GAAG,WAAW,aAAa,EAAE,OAAO,CAAC,OAAO,GAAG,GAAG,SAAiB,EAAE,GAAG,GAAG,CAAC;AACzF,QAAM,MAAM,MAAM,sBAAsB,MAAM,MAAM,EAAE,wBAAwB;AAC9E,SAAO,OAAO,IAAI,CAAC;AACrB;AAKA,eAAsB,mBAAmB,IAAQ,WAAoC;AACnF,QAAM,MAAM,MAAM,GACf,WAAW,aAAa,EACxB,OAAO,CAAC,OAAO,GAAG,GAAG,SAAiB,EAAE,GAAG,GAAG,CAAC,EAC/C,MAAM,UAAU,KAAK,WAAW,EAChC,MAAM,gBAAgB,MAAM,SAAS,EACrC,wBAAwB;AAC3B,SAAO,OAAO,IAAI,CAAC;AACrB;AAQA,eAAsB,4BACpB,IACA,UAC4C;AAC5C,QAAM,aAAa,IAAI,KAAK,kBAAkB,IAAI,CAAC,MAAM,MAAM,CAAC,EAAE,CAAC;AACnE,QAAM,OAAO,MAAM,GAChB,WAAW,aAAa,EACxB,OAAO;AAAA,IACN;AAAA,IACA,6EAAqF,UAAU,uBAAuB;AAAA,MACpH;AAAA,IACF;AAAA,IACA,yEAAiF,UAAU,uBAAuB;AAAA,MAChH;AAAA,IACF;AAAA,IACA,2DAAmE,GAAG,aAAa;AAAA,EACrF,CAAC,EACA,MAAM,gBAAgB,MAAM,QAAQ,EACpC,QAAQ,SAAS,EACjB,QAAQ;AACX,SAAO,IAAI;AAAA,IACT,KAAK,IAAI,CAAC,MAAM;AAAA,MACd,EAAE;AAAA,MACF;AAAA,QACE,OAAO,OAAO,EAAE,OAAO,KAAK;AAAA,QAC5B,SAAS,OAAO,EAAE,SAAS,KAAK;AAAA,QAChC,UAAU,OAAO,EAAE,WAAW,KAAK;AAAA,MACrC;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAKO,IAAM,mBAAmB;AAKzB,IAAM,qBAAqB;AAM3B,IAAM,uBAAuB;AAQpC,SAAS,cAAc,MAAsB;AAC3C,SAAO,KACJ,YAAY,EACZ,QAAQ,oBAAoB,GAAG,EAC/B,QAAQ,cAAc,GAAG,EACzB,QAAQ,aAAa,GAAG,EACxB,QAAQ,mCAAmC,GAAG,EAC9C,QAAQ,SAAS,GAAG,EACpB,QAAQ,SAAS,GAAG,EACpB,KAAK;AACV;AAGA,SAAS,SAAS,YAAiC;AACjD,SAAO,IAAI,IAAI,WAAW,MAAM,YAAY,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAC3E;AAEA,SAAS,QAAQ,GAAgB,GAAwB;AACvD,MAAI,eAAe;AACnB,aAAW,KAAK,EAAG,KAAI,EAAE,IAAI,CAAC,EAAG;AACjC,QAAM,QAAQ,EAAE,OAAO,EAAE,OAAO;AAChC,SAAO,UAAU,IAAI,IAAI,eAAe;AAC1C;AAoBA,eAAsB,+BACpB,IACA,SACA,WAIC;AACD,QAAM,WAAW,cAAc,OAAO;AACtC,QAAM,iBAAiB,SAAS,QAAQ;AACxC,QAAM,gBAAgB,SAAS,UAAU;AACzC,QAAM,kBAAkB,eAAe,QAAQ;AAE/C,MAAI,CAAC,iBAAiB,CAAC,gBAAiB,QAAO,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,EAAE;AAExE,QAAM,OAAO,MAAM,GAChB,WAAW,aAAa,EACxB,OAAO,CAAC,MAAM,UAAU,WAAW,WAAW,OAAO,CAAC,EACtD,MAAM,WAAW,UAAU,IAAI,EAC/B,MAAM,gBAAgB,MAAM,SAAS,EACrC,QAAQ,gBAAgB,MAAM,EAC9B,MAAM,GAAI,EACV,QAAQ;AAEX,QAAM,QAA0B,CAAC;AACjC,QAAM,UAA4B,CAAC;AACnC,aAAW,OAAO,MAAM;AACtB,UAAM,SAAS,cAAc,IAAI,WAAW,EAAE;AAC9C,UAAM,QAAwB;AAAA,MAC5B,IAAI,IAAI;AAAA,MACR,QAAQ,IAAI;AAAA,MACZ,QAAQ,IAAI;AAAA,MACZ,OAAO,IAAI;AAAA,IACb;AACA,QAAI,iBAAiB,WAAW,UAAU;AACxC,YAAM,KAAK,KAAK;AAChB;AAAA,IACF;AACA,QAAI,CAAC,gBAAiB;AACtB,UAAM,eAAe,SAAS,MAAM;AACpC,QAAI,aAAa,OAAO,mBAAoB;AAC5C,QAAI,QAAQ,gBAAgB,YAAY,KAAK,sBAAsB;AACjE,cAAQ,KAAK,KAAK;AAAA,IACpB;AAAA,EACF;AACA,SAAO,EAAE,OAAO,QAAQ;AAC1B;AAQA,eAAsB,8BACpB,IACA,OACA,WACgE;AAChE,MAAI,MAAM,KAAK,MAAM,GAAI,QAAO,CAAC;AACjC,QAAM,OAAO,MAAM,GAChB,WAAW,aAAa,EACxB,OAAO,CAAC,MAAM,WAAW,QAAQ,CAAC,EAClC,MAAM,aAAa,MAAM,YAAY,EACrC,MAAM,gBAAgB,MAAM,SAAS,EACrC,MAAM,CAAC,OAAO,iBAA0B,GAAG,IAAI,OAAO,CAAC,mBAAmB,KAAK,IAAI,EACnF,QAAQ;AACX,SAAO,KAAK,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,QAAQ,EAAE,SAAS,QAAQ,EAAE,OAAO,EAAE;AAC5E;AAOA,eAAsB,yBACpB,IACA,KACA,aACe;AACf,MAAI,IAAI,WAAW,EAAG;AACtB,QAAM,GACH,YAAY,aAAa,EACzB,IAAI;AAAA,IACH,QAAQ;AAAA,IACR,aAAa,6DAAqE,WAAW,+BAA+B,WAAW;AAAA,EACzI,CAAC,EACA,MAAM,MAAM,MAAM,GAAG,EACrB,MAAM,UAAU,KAAK,KAAK,EAC1B,QAAQ;AACb;AAOA,eAAsB,wBACpB,IACA,QACA,MAAM,KACa;AACnB,QAAM,OAAO,GAAG,WAAW,aAAa,EAAE,OAAO,CAAC,aAAa,CAAC;AAChE,QAAM,OAAO,MAAM,sBAAsB,MAAM,MAAM,EAClD,MAAM,eAAe,UAAU,IAAI,EACnC,MAAM,GAAG,EACT,QAAQ;AACX,SAAO,KAAK,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,MAAmB,MAAM,QAAQ,MAAM,EAAE;AACzF;AAIA,eAAsB,mBAAmB,IAAQ,KAAmC;AAClF,QAAM,GACH,WAAW,aAAa,EACxB,OAAO;AAAA,IACN,IAAI,IAAI;AAAA,IACR,eAAe,IAAI;AAAA,IACnB,SAAS,IAAI;AAAA,IACb,WAAW,IAAI;AAAA,IACf,MAAM,IAAI;AAAA,IACV,OAAO,IAAI;AAAA,IACX,OAAO,IAAI;AAAA,IACX,SAAS,IAAI;AAAA,IACb,cAAc,IAAI;AAAA,IAClB,YAAY,IAAI;AAAA,IAChB,KAAK,IAAI;AAAA,IACT,cAAc,IAAI;AAAA,IAClB,QAAQ,IAAI;AAAA,IACZ,eAAe,IAAI;AAAA,IACnB,mBAAmB,IAAI;AAAA,IACvB,YAAY,IAAI,aAAa;AAAA,IAC7B,aAAa,IAAI,cAAc;AAAA,IAC/B,eAAe,IAAI,gBAAgB;AAAA,IACnC,aAAa,IAAI,cAAc;AAAA,IAC/B,gBAAgB,IAAI,iBAAiB;AAAA,IACrC,gBAAgB,IAAI,iBAAiB;AAAA,IACrC,eAAe,IAAI,eAAe;AAAA,EACpC,CAAC,EACA,WAAW,CAAC,OAAO,GAAG,OAAO,IAAI,EAAE,UAAU,CAAC,EAC9C,QAAQ;AACb;AASA,eAAsB,sBACpB,IACA,IACA,OACA,QACkB;AAClB,QAAM,MAAM,MAAM,GACf,YAAY,aAAa,EACzB,IAAI,EAAE,QAAQ,aAAa,YAAY,OAAO,aAAa,OAAO,CAAC,EACnE,MAAM,MAAM,KAAK,EAAE,EACnB,MAAM,UAAU,KAAK,KAAK,EAC1B,iBAAiB;AACpB,SAAO,OAAO,IAAI,cAAc,IAAI;AACtC;AASA,eAAsB,mBAAmB,IAAQ,QAA2C;AAC1F,QAAM,MAAM,MAAM,GACf,YAAY,aAAa,EACzB,IAAI,EAAE,QAAQ,OAAO,CAAC,EACtB,MAAM,UAAU,KAAK,KAAK,EAC1B;AAAA,IAAM;AAAA,IAAM;AAAA,IAAM,CAAC,OAClB,sBAAsB,GAAG,WAAW,aAAa,EAAE,OAAO,IAAI,GAAG,MAAM;AAAA,EACzE,EACC,iBAAiB;AACpB,SAAO,OAAO,IAAI,cAAc;AAClC;AAUA,eAAsB,6BACpB,IACA,WAOA,SAA8B,MACZ;AAClB,MAAI,cAAc,GAAI,QAAO;AAC7B,QAAM,MAAM,MAAM,GACf,YAAY,aAAa,EACzB;AAAA,IACC,WAAW,OACP,EAAE,eAAe,UAAU,IAC3B;AAAA,MACE,eAAe;AAAA,MACf,aAAa,OAAO;AAAA,MACpB,gBAAgB,OAAO;AAAA,MACvB,gBAAgB,OAAO;AAAA,IACzB;AAAA,EACN,EACC,MAAM,qBAAqB,KAAK,SAAS,EACzC,iBAAiB;AACpB,MAAI,OAAO,IAAI,cAAc,IAAI,EAAG,QAAO;AAI3C,QAAM,WAAW,MAAM,GACpB,WAAW,aAAa,EACxB,OAAO,IAAI,EACX,MAAM,qBAAqB,KAAK,SAAS,EACzC,iBAAiB;AACpB,SAAO,aAAa;AACtB;AAiBA,eAAsB,gBAAgB,IAAQ,IAAY,KAA6B;AACrF,QAAM,MAAM,MAAM,GACf,YAAY,aAAa,EACzB,IAAI,EAAE,eAAe,IAAI,YAAY,EAAE,CAAC,EACxC,MAAM,MAAM,KAAK,EAAE,EACnB,MAAM,iBAAiB,KAAK,SAAS,EACrC,MAAM,iBAAiB,MAAM,IAAI,EACjC,iBAAiB;AACpB,SAAO,OAAO,IAAI,cAAc,IAAI;AACtC;AAwBA,eAAsB,yBACpB,IACA,WAC0C;AAC1C,QAAM,OAAO,MAAM,GAChB,WAAW,aAAa,EACxB,OAAO;AAAA,IACN;AAAA,IACA,CAAC,OAAO,GAAG,GAAG,SAAiB,EAAE,GAAG,GAAG;AAAA;AAAA;AAAA;AAAA,IAIvC,uEAA+E;AAAA,MAC7E;AAAA,IACF;AAAA,EACF,CAAC,EACA,MAAM,iBAAiB,KAAK,SAAS,EACrC,MAAM,gBAAgB,MAAM,SAAS,EACrC,MAAM,iBAAiB,MAAM,IAAI,EACjC,QAAQ,SAAS,EACjB,QAAQ;AACX,SAAO,IAAI;AAAA,IACT,KAAK,IAAI,CAAC,MAAM;AAAA,MACd,EAAE;AAAA,MACF,EAAE,OAAO,OAAO,EAAE,CAAC,KAAK,GAAG,WAAW,OAAO,EAAE,WAAW,KAAK,EAAE;AAAA,IACnE,CAAC;AAAA,EACH;AACF;","names":[]}

package/dist/{svelte-codemods-WSV2FGNG.js → svelte-codemods-VOLOKKFI.js}

@@ -5,20 +5,20 @@ import {
   appendSkipNotice,
   fleetWorkdir,
   prepareFleetSites
-} from "./chunk-LM2NHRCJ.js";
+} from "./chunk-DYTYPKFN.js";
 import {
   resolveSites
-} from "./chunk-Z2K4JPQ3.js";
+} from "./chunk-FP6HOW6J.js";
 import {
   svelteCodemods
-} from "./chunk-2LYOAB2E.js";
+} from "./chunk-HSMN35LU.js";
 import "./chunk-J7SZQUCW.js";
-import "./chunk-ZQV7UQNE.js";
+import "./chunk-LUF52EIY.js";
 import "./chunk-Z3JXLULD.js";
 import "./chunk-LBYOLBW7.js";
 import "./chunk-RARREDQE.js";
 import "./chunk-XXTZBPUY.js";
-import "./chunk-AVEQUR44.js";
+import "./chunk-WMF5S2MB.js";
 
 // src/cli/commands/svelte-codemods.ts
 import { resolve } from "path";
@@ -51,4 +51,4 @@ async function runSvelteCodemodsCommand(site, opts) {
 export {
   runSvelteCodemodsCommand
 };
-//# sourceMappingURL=svelte-codemods-WSV2FGNG.js.map
+//# sourceMappingURL=svelte-codemods-VOLOKKFI.js.map

package/dist/{sync-K3PKHVLH.js → sync-F4USL4K5.js}

@@ -1,15 +1,15 @@
 import {
   checkFleetParity,
   formatParityResult
-} from "./chunk-KZRR4NFG.js";
-import "./chunk-WVNDEYXL.js";
+} from "./chunk-TVZ6QCOE.js";
+import "./chunk-BINFZQ2T.js";
 import {
   formatReapSummary,
   importFleetState
-} from "./chunk-6R56OKJZ.js";
-import "./chunk-F3JWOPTG.js";
+} from "./chunk-LF2TJN4X.js";
+import "./chunk-ASLDCWBF.js";
 import "./chunk-VAD43MOR.js";
-import "./chunk-3Z6X3BHU.js";
+import "./chunk-ICSRWW5Q.js";
 
 // src/db/sync.ts
 async function syncFleetState(db, io) {
@@ -43,4 +43,4 @@ export {
   formatSyncResult,
   syncFleetState
 };
-//# sourceMappingURL=sync-K3PKHVLH.js.map
+//# sourceMappingURL=sync-F4USL4K5.js.map

package/dist/{sync-configs-RRIHNLIJ.js → sync-configs-OXSWKVZ2.js}

@@ -5,10 +5,10 @@ import {
   appendSkipNotice,
   fleetWorkdir,
   prepareFleetSites
-} from "./chunk-LM2NHRCJ.js";
+} from "./chunk-DYTYPKFN.js";
 import {
   resolveSites
-} from "./chunk-Z2K4JPQ3.js";
+} from "./chunk-FP6HOW6J.js";
 import {
   ALL_CONFIG_NAMES,
   CANONICAL_GITIGNORE_ENTRIES,
@@ -16,17 +16,17 @@ import {
   mergeGitignore,
   planTemplateDiffs,
   syncConfigs
-} from "./chunk-FUWFLAWQ.js";
-import "./chunk-ZQV7UQNE.js";
+} from "./chunk-3RLDX3Q2.js";
 import {
   ALL_TEMPLATES,
   templatesByName
 } from "./chunk-SLFG7Y76.js";
+import "./chunk-LUF52EIY.js";
 import "./chunk-Z3JXLULD.js";
 import "./chunk-LBYOLBW7.js";
 import "./chunk-RARREDQE.js";
 import "./chunk-XXTZBPUY.js";
-import "./chunk-AVEQUR44.js";
+import "./chunk-WMF5S2MB.js";
 
 // src/cli/commands/sync-configs.ts
 import { readFile } from "fs/promises";
@@ -107,4 +107,4 @@ async function runSyncConfigsCommand(site, opts) {
 export {
   runSyncConfigsCommand
 };
-//# sourceMappingURL=sync-configs-RRIHNLIJ.js.map
+//# sourceMappingURL=sync-configs-OXSWKVZ2.js.map

package/dist/turso-KQKBBQCK.js

@@ -0,0 +1,24 @@
+import {
+  requireFleetWorkdir,
+  selectFleetSites
+} from "./chunk-VQMAAQ5M.js";
+import "./chunk-ICSRWW5Q.js";
+import "./chunk-RARREDQE.js";
+
+// src/inventory/turso.ts
+function fromTursoDb(open, opts = {}) {
+  return async () => {
+    const workdir = requireFleetWorkdir(opts.workdir, "fromTursoDb");
+    const { listSites } = await import("./fleet-state-RJROYXKO.js");
+    const db = await open();
+    try {
+      return selectFleetSites(await listSites(db), workdir);
+    } finally {
+      await db.destroy();
+    }
+  };
+}
+export {
+  fromTursoDb
+};
+//# sourceMappingURL=turso-KQKBBQCK.js.map

package/dist/turso-KQKBBQCK.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/inventory/turso.ts"],"sourcesContent":["import type { Site, InventoryProvider } from \"../types.js\";\nimport type { Db } from \"../db/client.js\";\nimport { selectFleetSites, requireFleetWorkdir } from \"./select.js\";\n\nexport type TursoInventoryOptions = {\n  /** Local workdir to compute each site's path as `{workdir}/{slug}`. Defaults to\n   *  REDDOOR_FLEET_WORKDIR. The database holds no checkout paths, so one is required. */\n  workdir?: string;\n};\n\n/**\n * The fleet roster, read from Turso (#646 step 4) — what `--fleet turso` (and its\n * deprecated alias `--fleet airtable`) resolves through.\n *\n * Why this exists: since step 3 a site created by `ensure-site` gets a\n * `site_<ULID>` id and NO Airtable record, so an Airtable-backed roster can never\n * see it. Turso holds every site, `rec…` and `site_…` alike.\n *\n * Same selection as the Airtable provider by construction (`selectFleetSites`),\n * and the same rows by proof (`tests/inventory/selection-parity.test.ts`).\n *\n * `open` is a factory rather than a handle so the provider owns the connection it\n * opened and closes it once the roster is read — a sweep holds no Turso client\n * for its whole run. The fleet-state reader is imported lazily: `kysely` and the\n * libSQL client are devDependencies, and nothing that merely imports the\n * inventory module should pull them in.\n */\nexport function fromTursoDb(\n  open: () => Promise<Db>,\n  opts: TursoInventoryOptions = {},\n): InventoryProvider {\n  return async (): Promise<Site[]> => {\n    const workdir = requireFleetWorkdir(opts.workdir, \"fromTursoDb\");\n    const { listSites } = await import(\"../db/fleet-state.js\");\n    const db = await open();\n    try {\n      return selectFleetSites(await listSites(db), workdir);\n    } finally {\n      await db.destroy();\n    }\n  };\n}\n"],"mappings":";;;;;;;;AA2BO,SAAS,YACd,MACA,OAA8B,CAAC,GACZ;AACnB,SAAO,YAA6B;AAClC,UAAM,UAAU,oBAAoB,KAAK,SAAS,aAAa;AAC/D,UAAM,EAAE,UAAU,IAAI,MAAM,OAAO,2BAAsB;AACzD,UAAM,KAAK,MAAM,KAAK;AACtB,QAAI;AACF,aAAO,iBAAiB,MAAM,UAAU,EAAE,GAAG,OAAO;AAAA,IACtD,UAAE;AACA,YAAM,GAAG,QAAQ;AAAA,IACnB;AAAA,EACF;AACF;","names":[]}

package/dist/{upgrade-VTD6V4HS.js → upgrade-EVAL3JTO.js}

@@ -5,21 +5,21 @@ import {
   appendSkipNotice,
   fleetWorkdir,
   prepareFleetSites
-} from "./chunk-LM2NHRCJ.js";
+} from "./chunk-DYTYPKFN.js";
 import {
   resolveSites
-} from "./chunk-Z2K4JPQ3.js";
+} from "./chunk-FP6HOW6J.js";
 import {
   upgradeSvelte4to5
-} from "./chunk-BCKEP5S6.js";
+} from "./chunk-JHJNNJLG.js";
 import "./chunk-J7SZQUCW.js";
-import "./chunk-ZQV7UQNE.js";
+import "./chunk-LUF52EIY.js";
 import "./chunk-OTGB6YQO.js";
 import "./chunk-Z3JXLULD.js";
 import "./chunk-LBYOLBW7.js";
 import "./chunk-RARREDQE.js";
 import "./chunk-XXTZBPUY.js";
-import "./chunk-AVEQUR44.js";
+import "./chunk-WMF5S2MB.js";
 
 // src/cli/commands/upgrade.ts
 import { resolve } from "path";
@@ -60,4 +60,4 @@ async function runUpgradeCommand(upgradeName, site, opts = {}) {
 export {
   runUpgradeCommand
 };
-//# sourceMappingURL=upgrade-VTD6V4HS.js.map
+//# sourceMappingURL=upgrade-EVAL3JTO.js.map

package/dist/util/git.d.ts

@@ -72,26 +72,65 @@ declare function isOwnerRepo(repo: string): boolean;
  * before reusing it. Returns false if either side is unparseable.
  */
 declare function sameOwnerRepo(a: string, b: string): boolean;
-/** Derive `owner/repo` from a git remote URL (https or scp-style). Null if unparseable. */
+/**
+ * Derive `owner/repo` from a GITHUB git remote URL (https, ssh, git:// or
+ * scp-style). `null` when the remote is not a GitHub repository URL: another
+ * host, a traversal segment, a nested or too-short path, a local filesystem
+ * path, anything unparseable.
+ *
+ * PARSED, not pattern-matched (#712). The previous implementation stripped
+ * `^https?://[^/]+/` — throwing the HOST away — and returned the last two path
+ * segments of whatever remained, so each of these yielded a confident,
+ * correctly-shaped GitHub write target for a repository the code was not in:
+ * `https://gitlab.com/acme/site.git` -> `acme/site`;
+ * `https://user@evil.example.com/attacker/target` -> `attacker/target`;
+ * `https://github.com/ok/repo/../../evil/target` -> `evil/target`;
+ * `https://github.com/ok/repo?x=/evil/other` -> `evil/other`;
+ * `/Users/me/Documents/GitHub/reddoor-starter` -> `GitHub/reddoor-starter`.
+ *
+ * A `..` anywhere in the raw remote is REFUSED rather than resolved: `new URL`
+ * (like curl, and so git-over-https) collapses `ok/repo/../../evil/target` to
+ * `/evil/target`, while ssh hands the literal path to the server. The two
+ * transports disagree about which repository the remote names, so neither
+ * answer is proven — and `..` is already inadmissible in an identity this
+ * project accepts (see {@link isOwnerRepo}).
+ */
 declare function parseOwnerRepo(remoteUrl: string): string | null;
 /** `origin` remote URL for a checkout, trimmed. Throws (via git) if there's no origin. */
 declare function getRemoteUrl(cwd: string): Promise<string>;
 /**
- * Resolve the `owner/repo` a recipe will act on. An explicit `site.gitRepo`
- * (Airtable, or a JSON inventory) wins; otherwise derive it from the checkout's
- * `origin`.
+ * Resolve the `owner/repo` a recipe will act on, and PROVE it rather than infer
+ * it. An explicit `site.gitRepo` (Airtable, or a JSON inventory) wins;
+ * otherwise it is derived from the checkout's `origin`.
+ *
+ * Returns `null` for the two states that genuinely mean "nothing is wired
+ * here": `site.path` is not inside a git work tree, and the work tree has no
+ * `origin`. Everything else THROWS, naming both sides, because callers write
+ * repo secrets, branch-protection rulesets and pull requests at this identity
+ * — a wrong one is not cosmetic (#712):
  *
- * Returns `null` when there is nothing to act on (no `gitRepo`, no origin) — a
- * benign "nothing wired" state. THROWS when a value IS present but does not
- * match the strict `owner/repo` shape: callers write repo secrets, branch
- * protection and pull requests at this identity, so a typo'd or
- * attacker-controlled value must be rejected here, before the first `gh` call.
+ *  - a value that is present but is not a clean `owner/repo`;
+ *  - an `origin` that is not a GitHub repository URL. A GitLab or impostor host
+ *    answered with a GitHub write target is the core of this class;
+ *  - a `site.path` that is not the ROOT of its work tree. `git remote get-url`
+ *    walks UP, so a site directory with no clone in it yet — exactly what the
+ *    positional `/new-site` route points at — resolved to whatever repository
+ *    happened to enclose it. Run a recipe against such a directory from under
+ *    the maintenance checkout and the token secret plus a ruleset landed on
+ *    `reddoorla/reddoor-maintenance`. No attacker required; a wrong `cd` was
+ *    enough. The cost is that "run me from a subdirectory" now refuses instead
+ *    of guessing — the refusal names the root, so the fix is one `cd`, or an
+ *    explicit identity;
+ *  - any git failure that is not one of the two benign shapes above. "There is
+ *    no remote" and "git could not run" used to be the same answer to the
+ *    caller, so `selfUpdating` printed "add an origin remote" for a missing
+ *    binary, an unreadable path and a dubious-ownership refusal alike.
  *
  * Extracted from `self-updating`'s private `resolveRepo` because `prismic-ci`
  * read `site.gitRepo` directly and therefore refused every POSITIONAL run with
  * "no Git repo on this site" — `localPath()` (src/inventory/local.ts:11) builds
  * `{ path, name }` and nothing else. A site being bootstrapped is exactly the
- * case that has no Airtable row yet (`--fleet airtable` filters pre-launch
+ * case that is not in the fleet roster yet (`--fleet turso` filters pre-launch
  * statuses), so the positional path is the ONLY one `/new-site` can use.
  */
 declare function resolveOwnerRepo(site: Site): Promise<string | null>;

package/dist/util/git.js

@@ -19,7 +19,7 @@ import {
   resolveOwnerRepo,
   sameOwnerRepo,
   stageAll
-} from "../chunk-AVEQUR44.js";
+} from "../chunk-WMF5S2MB.js";
 export {
   OWNER_REPO_RE,
   branchName,

package/dist/{webflow-IRKOIT7S.js → webflow-624FEBFD.js}

@@ -1,9 +1,9 @@
-import {
-  assetRef
-} from "./chunk-UWJZXL2D.js";
 import {
   runMigration
 } from "./chunk-6DOFNDXU.js";
+import {
+  assetRef
+} from "./chunk-UWJZXL2D.js";
 
 // src/cli/commands/webflow.ts
 import { mkdir, readFile, writeFile } from "fs/promises";
@@ -545,4 +545,4 @@ async function runWebflowCommand(action, target, opts = {}) {
 export {
   runWebflowCommand
 };
-//# sourceMappingURL=webflow-IRKOIT7S.js.map
+//# sourceMappingURL=webflow-624FEBFD.js.map

package/dist/{websites-TB4TCAWM.js → websites-Y6FN2XFD.js}

@@ -1,18 +1,34 @@
+import {
+  WEBSITES_TABLE,
+  analyticsHealthFields,
+  getWebsiteBySlug,
+  listWebsites,
+  mapRow,
+  updateA11yCounts,
+  updateAnalyticsHealth,
+  updateAuditFields,
+  updateAutoFixAttempts,
+  updateDepsCounts,
+  updateGitHubSignals,
+  updateLaunched,
+  updateNextDueDates,
+  updatePrismicModels,
+  updateScores,
+  updateSecurityCounts,
+  updateSiteField,
+  updateSiteFields
+} from "./chunk-TC4GANMX.js";
 import {
   ACTIVE_STATUSES,
   ARCHIVED_STATUSES,
   KNOWN_STATUSES,
   PRE_LAUNCH_STATUSES,
   SEVERITY_RANK,
-  WEBSITES_TABLE,
   allActionableVulnsTransitive,
-  getWebsiteBySlug,
   isArchivedStatus,
   isDashboardVisible,
   isPreLaunch,
   isUnrecognizedStatus,
-  listWebsites,
-  mapRow,
   normalizeSecurityAdvisory,
   parseNotifyRouting,
   parseSecurityAdvisories,
@@ -20,20 +36,9 @@ import {
   toFrequency,
   toPrismicModelsVerdict,
   toVerdict,
-  trimToNull,
-  updateA11yCounts,
-  updateAnalyticsHealth,
-  updateAuditFields,
-  updateAutoFixAttempts,
-  updateDepsCounts,
-  updateGitHubSignals,
-  updateLaunched,
-  updateNextDueDates,
-  updatePrismicModels,
-  updateScores,
-  updateSecurityCounts,
-  updateSiteField
-} from "./chunk-3Z6X3BHU.js";
+  trimToNull
+} from "./chunk-ICSRWW5Q.js";
+import "./chunk-RQJFGK3A.js";
 export {
   ACTIVE_STATUSES,
   ARCHIVED_STATUSES,
@@ -42,6 +47,7 @@ export {
   SEVERITY_RANK,
   WEBSITES_TABLE,
   allActionableVulnsTransitive,
+  analyticsHealthFields,
   getWebsiteBySlug,
   isArchivedStatus,
   isDashboardVisible,
@@ -68,6 +74,7 @@ export {
   updatePrismicModels,
   updateScores,
   updateSecurityCounts,
-  updateSiteField
+  updateSiteField,
+  updateSiteFields
 };
-//# sourceMappingURL=websites-TB4TCAWM.js.map
+//# sourceMappingURL=websites-Y6FN2XFD.js.map

package/dist/{write-audits-to-airtable-53EVXKMU.js → write-audits-to-airtable-TI3JMWSY.js}

@@ -3,15 +3,17 @@ import {
   formatFleetWriteSummary,
   writeAuditsToAirtable,
   writeFleetAuditsToAirtable
-} from "./chunk-5EEMTJMT.js";
-import "./chunk-XN37VTDB.js";
-import "./chunk-SVAAONYB.js";
+} from "./chunk-FHFXJ3EM.js";
+import "./chunk-X56LAKPR.js";
+import "./chunk-WQLNUEZL.js";
 import "./chunk-5L3FPQIJ.js";
-import "./chunk-3Z6X3BHU.js";
+import "./chunk-TC4GANMX.js";
+import "./chunk-ICSRWW5Q.js";
+import "./chunk-RQJFGK3A.js";
 export {
   fleetWriteFailed,
   formatFleetWriteSummary,
   writeAuditsToAirtable,
   writeFleetAuditsToAirtable
 };
-//# sourceMappingURL=write-audits-to-airtable-53EVXKMU.js.map
+//# sourceMappingURL=write-audits-to-airtable-TI3JMWSY.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reddoorla/maintenance",
-  "version": "0.95.1",
+  "version": "0.97.0",
   "description": "Canonical maintenance configs, audits, and recipes for the reddoor stack.",
   "type": "module",
   "license": "MIT",
@@ -117,8 +117,9 @@
     "zod": "^4.4.3"
   },
   "scripts": {
-    "verify": "pnpm typecheck && pnpm lint && pnpm build && pnpm test:coverage && pnpm test:dist",
+    "verify": "pnpm typecheck && pnpm lint && pnpm check:match-harness-snapshots && pnpm build && pnpm test:coverage && pnpm test:dist",
     "build": "tsup",
+    "check:match-harness-snapshots": "node scripts/check-match-harness-snapshots.mjs",
     "dev": "tsup --watch",
     "pretest": "pnpm run build",
     "test": "vitest run",

package/dist/airtable-JGCPS7JH.js

@@ -1,9 +0,0 @@
-import {
-  fromAirtableBase
-} from "./chunk-5GUJ36TL.js";
-import "./chunk-3Z6X3BHU.js";
-import "./chunk-RARREDQE.js";
-export {
-  fromAirtableBase
-};
-//# sourceMappingURL=airtable-JGCPS7JH.js.map

package/dist/announce-CLQYX5I4.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/recipes/announce.ts","../src/cli/commands/announce.ts"],"sourcesContent":["import { openBase, readAirtableConfig } from \"../reports/airtable/client.js\";\nimport type { AirtableBase } from \"../reports/airtable/client.js\";\nimport { listWebsites, siteSlug, updateAnalyticsHealth } from \"../reports/airtable/websites.js\";\nimport type { WebsiteRow } from \"../reports/airtable/websites.js\";\nimport { readGaConfig } from \"../reports/ga/config.js\";\nimport {\n  createDraft,\n  findReportByPeriod,\n  updateReportScores,\n  type ReportEnrichment,\n} from \"../reports/airtable/reports.js\";\nimport type { ReportMirror } from \"../reports/report-mirror.js\";\nimport type { SiteMirror } from \"../db/site-mirror.js\";\nimport { queueDraft } from \"../reports/queue.js\";\nimport { uploadAttachment } from \"../reports/airtable/attachments.js\";\nimport { renderReportHtml } from \"../reports/render.js\";\nimport { resolveCopy } from \"../reports/copy.js\";\nimport { fetchGaUsers, fetchSearch, refreshHeaderImage } from \"../reports/draft.js\";\nimport type { RefreshHeaderDeps } from \"../reports/draft.js\";\nimport { announcementSiteExtras } from \"../reports/announcement-email/template.js\";\nimport type { LighthouseScores } from \"../reports/types.js\";\nimport { defaultReportSubject } from \"../reports/subject.js\";\nimport { scoresFromRow } from \"../reports/report-data.js\";\n\nexport type AnnounceSiteResult =\n  | {\n      site: string;\n      status: \"drafted\" | \"reused\";\n      reportId: string;\n      recipientMissing: boolean;\n      /** False when a higher-or-equal-tier report was already queued (single-queue rule). */\n      queued: boolean;\n    }\n  | { site: string; status: \"skipped-no-scores\" }\n  | { site: string; status: \"error\"; message: string };\n\nexport type AnnounceResult = { results: AnnounceSiteResult[] };\n\n/** The traffic/search lookback window (days) the announcement reports on. The trend compares it\n *  against the equal-length prior window, and the email labels it \"vs the previous N days\". */\nconst GA_WINDOW_DAYS = 30;\n\nexport type AnnounceDeps = {\n  /** Airtable handle. Defaults to opening the live base from credentials. */\n  base?: AirtableBase;\n  /** When set, restrict to the single site whose slug matches. Default: all maintenance sites. */\n  site?: string;\n  /** Single timestamp driving the period key, render, draft, and preview filename. */\n  now?: Date;\n  /**\n   * Header-image refresh, matching `draftReportForSite`'s opt-out shape: UNSET means\n   * refresh (the production default), `false` skips it so unit suites don't launch a\n   * browser. Announce previously never refreshed at all, so a site whose stored header\n   * predated a plate change kept announcing with the old one until its next\n   * Maintenance/Testing draft happened to heal it.\n   */\n  refreshHeader?: RefreshHeaderDeps | false;\n  /** #539 Phase 5: Turso write-through for everything this recipe writes — the\n   *  created row (or a reused row's refreshed scores), the rendered body, and\n   *  the queue flag. Not defaulted here — every unit test calls `announce` with\n   *  a fake base, and a default would open a real libSQL handle from inside the\n   *  suite. The CLI composition root wires it. */\n  reportMirror?: ReportMirror;\n  /** #539 Phase 5: the Websites-row twin — announce stamps `Analytics soft-fail\n   *  at` on the SITE row, a different Turso table from the report. */\n  siteMirror?: SiteMirror;\n};\n\n/**\n * Draft the monthly-report ANNOUNCEMENT email for every `maintenance` site (or one,\n * via `deps.site`). Airtable-driven and fleet-wide: unlike `launch`, it runs no audits\n * and takes no `Site`/inventory object — it reads the Lighthouse scores already stored\n * on each Websites row. DRAFTS ONLY; the M3 approve loop sends.\n *\n * One bad site must never abort the run: each site is wrapped in its own try/catch that\n * records an `error` result and continues.\n */\nexport async function announce(deps?: AnnounceDeps): Promise<AnnounceResult> {\n  const base = deps?.base ?? openBase(readAirtableConfig());\n  const now = deps?.now ?? new Date();\n\n  const websites = await listWebsites(base);\n  let targets = websites.filter((w) => w.status === \"maintained\");\n  if (deps?.site) {\n    const wanted = siteSlug(deps.site);\n    targets = targets.filter((w) => siteSlug(w.name) === wanted);\n  }\n\n  const period = now.toISOString().slice(0, 7);\n  const results: AnnounceSiteResult[] = [];\n\n  for (const w of targets) {\n    try {\n      const scores = scoresFromRow(w);\n      if (scores === null) {\n        results.push({ site: w.name, status: \"skipped-no-scores\" });\n        continue;\n      }\n\n      // Refresh BEFORE the render so a queued announcement always has a current header\n      // stored — the send re-reads the attachment, so a stale one here reaches the\n      // client. Best-effort by construction: refreshHeaderImage returns false and never\n      // throws, so a capture failure leaves the stored image and the draft continues.\n      if (deps?.refreshHeader !== false) {\n        await refreshHeaderImage(w, deps?.refreshHeader ?? {});\n      }\n\n      // Traffic + search snapshot over a ~30-day window ending now (fetchPeriodUsers derives\n      // the equal-length previous window for the trend). Reuses the report pipeline's\n      // soft-failing enrichment: GA/search unconfigured or an API error leaves the numbers\n      // null and the email simply omits the traffic section — it never blocks the draft.\n      const periodEnd = now;\n      const periodStart = new Date(now.getTime() - GA_WINDOW_DAYS * 24 * 60 * 60 * 1000);\n      const gaResult = await fetchGaUsers(w, periodStart, periodEnd);\n      const searchResult = await fetchSearch(w, periodStart, periodEnd);\n      const gaUsers = gaResult.value;\n      const search = searchResult.value;\n      const enrichment: ReportEnrichment = {\n        ...(gaUsers ? { gaUsersCurrent: gaUsers.current, gaUsersPrevious: gaUsers.previous } : {}),\n        ...(search ? { searchFoundPage1: search.foundOnPage1 } : {}),\n        ...(search?.foundOnPage1 && search.position !== null\n          ? { searchPosition: search.position }\n          : {}),\n      };\n\n      // Record this site's GA/Search enrichment health for the per-site analytics-failure\n      // signal (cockpit/digest) — exactly as the `--due` draft path does. Without this, an\n      // announcement-time GA outage hides the traffic block with NO operator signal (it reads\n      // identically to \"site has no GA configured\"). Set the timestamp on a soft-fail, clear\n      // it on a clean enrichment so the signal self-heals. Best-effort: the column is\n      // operator-added, so until it exists the write throws — which must not break the draft.\n      if (readGaConfig() !== null && Boolean(w.ga4PropertyId || w.searchQuery)) {\n        try {\n          const fields = await updateAnalyticsHealth(\n            base,\n            w.id,\n            gaResult.softFailed || searchResult.softFailed ? now.toISOString() : null,\n          );\n          // Mirror the EXACT FieldSet Airtable got — see draft.ts.\n          await deps?.siteMirror?.health(w.id, fields);\n        } catch (e) {\n          console.warn(`⚠ analytics-health write skipped for ${w.name}: ${(e as Error).message}`);\n        }\n      }\n\n      // Dedupe: reuse an existing Announcement row for this (site, period) rather than\n      // stacking a second draft. The reuse path refreshes the stored scores + traffic/search\n      // (and Completed on) so the eventually-sent email — which reads the row — isn't stale.\n      // The create path writes them via createDraft.\n      let report;\n      let statusKind: \"drafted\" | \"reused\";\n      const existing = await findReportByPeriod(base, w.id, \"Announcement\", period);\n      if (existing) {\n        await updateReportScores(base, existing.id, scores, now, enrichment);\n        // Mirror the SAME refresh: the reuse path exists so the eventually-sent\n        // email is not stale, and the console reads those numbers too.\n        await deps?.reportMirror?.patch(existing.id, {\n          lighthouse_performance: scores.performance,\n          lighthouse_accessibility: scores.accessibility,\n          lighthouse_best_practices: scores.bestPractices,\n          lighthouse_seo: scores.seo,\n          completed_on: now.toISOString().slice(0, 10),\n          ...(enrichment.gaUsersCurrent !== undefined\n            ? { ga_users_current: enrichment.gaUsersCurrent }\n            : {}),\n          ...(enrichment.gaUsersPrevious !== undefined\n            ? { ga_users_previous: enrichment.gaUsersPrevious }\n            : {}),\n          ...(enrichment.searchFoundPage1 !== undefined\n            ? { search_found_page1: enrichment.searchFoundPage1 ? 1 : 0 }\n            : {}),\n          ...(enrichment.searchPosition !== undefined\n            ? { search_position: enrichment.searchPosition }\n            : {}),\n        });\n        report = existing;\n        statusKind = \"reused\";\n      } else {\n        report = await createDraft(\n          base,\n          draftInputFor(w, scores, now, period, enrichment),\n          deps?.reportMirror?.created,\n        );\n        statusKind = \"drafted\";\n      }\n\n      const slug = siteSlug(w.name);\n      const { html } = await renderReportHtml({\n        siteName: w.name,\n        siteUrl: w.url,\n        reportType: \"Announcement\",\n        completedOn: now,\n        lighthouse: scores,\n        gaUsersCurrent: gaUsers?.current,\n        gaUsersPrevious: gaUsers?.previous,\n        gaPeriodDays: GA_WINDOW_DAYS,\n        searchPosition: search?.foundOnPage1 ? (search.position ?? undefined) : undefined,\n        lastTestedDate: null,\n        commentary: null,\n        copy: resolveCopy(w),\n        headerImageCid: `${slug}-header`,\n        // cadence (the client's go-forward pace, \"None\" omitted) + default-on improvement\n        // callouts. Shared with the send re-render via announcementSiteExtras so the sent\n        // email matches this reviewed preview.\n        ...announcementSiteExtras(w),\n      });\n\n      // A preview-upload hiccup must NOT fail the site — log and continue.\n      try {\n        await uploadAttachment(\n          report.id,\n          \"Rendered HTML\",\n          html,\n          `${slug}-${now.toISOString().slice(0, 10)}.html`,\n          \"text/html\",\n        );\n        // Store the same body in Turso — the console's preview route reads it\n        // there, not from the Airtable attachment (whose URL expires).\n        await deps?.reportMirror?.body(report.id, html);\n      } catch (uploadErr) {\n        console.warn(\n          `⚠ Announcement preview upload skipped for ${w.name}: ${\n            uploadErr instanceof Error ? uploadErr.message : String(uploadErr)\n          }`,\n        );\n      }\n\n      // Critical: NOT wrapped — without queueing, the draft never enters the approve queue,\n      // so a failure here must surface as an error result for the site. queueDraft also\n      // supersedes any lower-tier (Maintenance/Testing) drafts queued for this site, and\n      // stands down if an equal-or-higher report is already queued (single-queue rule).\n      const queue = await queueDraft(\n        base,\n        { id: report.id, siteId: w.id, reportType: \"Announcement\" },\n        deps?.reportMirror,\n      );\n\n      const recipientMissing = !(w.reportRecipientsTo && w.reportRecipientsTo.trim());\n      results.push({\n        site: w.name,\n        status: statusKind,\n        reportId: report.id,\n        recipientMissing,\n        queued: queue.queued,\n      });\n    } catch (err) {\n      results.push({\n        site: w.name,\n        status: \"error\",\n        message: err instanceof Error ? err.message : String(err),\n      });\n    }\n  }\n\n  return { results };\n}\n\n/** Build the Announcement `DraftInput`. Announcements have no period window and no prior\n *  maintenance test, so periodStart/periodEnd/completedOn all collapse to `now` and\n *  `lastTestedDate` is null. The subject override gives the email a purpose-built line. */\nfunction draftInputFor(\n  w: WebsiteRow,\n  scores: LighthouseScores,\n  now: Date,\n  period: string,\n  enrichment: ReportEnrichment,\n): Parameters<typeof createDraft>[1] {\n  return {\n    reportId: `${w.name} — Announcement — ${now.toISOString().slice(0, 10)}`,\n    siteId: w.id,\n    reportType: \"Announcement\",\n    period,\n    periodStart: now,\n    periodEnd: now,\n    completedOn: now,\n    lighthouse: scores,\n    lastTestedDate: null,\n    subjectOverride: defaultReportSubject({\n      name: w.name,\n      url: w.url,\n      type: \"Announcement\",\n      date: now,\n    }),\n    ...enrichment,\n  };\n}\n","import { announce, type AnnounceResult, type AnnounceSiteResult } from \"../../recipes/announce.js\";\n\nexport type AnnounceCommandOptions = {\n  cwd?: string;\n};\n\nfunction formatSiteResult(r: AnnounceSiteResult): string {\n  if (r.status === \"skipped-no-scores\") return `[${r.site}] skipped-no-scores`;\n  if (r.status === \"error\") return `[${r.site}] error: ${r.message}`;\n  const note = r.recipientMissing ? \" ⚠ recipient missing\" : \"\";\n  return `[${r.site}] ${r.status}${note}`;\n}\n\nexport function formatAnnounceResult(result: AnnounceResult): string {\n  if (result.results.length === 0) return \"No maintenance sites to announce.\";\n  return result.results.map(formatSiteResult).join(\"\\n\");\n}\n\n/**\n * `announce [site]` — Airtable-driven and fleet-wide. Draft the monthly-report\n * announcement email for every `maintenance` site (or one, when `site` is given) into\n * the M3 approve queue. Never sends; the operator approves each draft and the next send\n * run delivers it. Reads the Lighthouse scores already stored on each Websites row —\n * no audits are run.\n */\nexport async function runAnnounceCommand(\n  site: string | undefined,\n  _opts: AnnounceCommandOptions,\n): Promise<{ output: string; code: number }> {\n  // #539 Phase 5: the create-side Turso dual-write is wired HERE rather than\n  // inside `announce`, so a unit suite calling the recipe with a fake base can\n  // never open a real libSQL handle (and, with TURSO_* exported locally, write\n  // into production).\n  const { makeReportMirror } = await import(\"../../reports/report-mirror.js\");\n  const { makeSiteMirror } = await import(\"../../db/site-mirror.js\");\n  const reportMirror = await makeReportMirror();\n  const siteMirror = await makeSiteMirror();\n  const result = await announce({ ...(site ? { site } : {}), reportMirror, siteMirror });\n  const hadError = result.results.some((r) => r.status === \"error\");\n  return { output: formatAnnounceResult(result), code: hadError ? 1 : 0 };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,IAAM,iBAAiB;AAqCvB,eAAsB,SAAS,MAA8C;AAC3E,QAAM,OAAO,MAAM,QAAQ,SAAS,mBAAmB,CAAC;AACxD,QAAM,MAAM,MAAM,OAAO,oBAAI,KAAK;AAElC,QAAM,WAAW,MAAM,aAAa,IAAI;AACxC,MAAI,UAAU,SAAS,OAAO,CAAC,MAAM,EAAE,WAAW,YAAY;AAC9D,MAAI,MAAM,MAAM;AACd,UAAM,SAAS,SAAS,KAAK,IAAI;AACjC,cAAU,QAAQ,OAAO,CAAC,MAAM,SAAS,EAAE,IAAI,MAAM,MAAM;AAAA,EAC7D;AAEA,QAAM,SAAS,IAAI,YAAY,EAAE,MAAM,GAAG,CAAC;AAC3C,QAAM,UAAgC,CAAC;AAEvC,aAAW,KAAK,SAAS;AACvB,QAAI;AACF,YAAM,SAAS,cAAc,CAAC;AAC9B,UAAI,WAAW,MAAM;AACnB,gBAAQ,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,oBAAoB,CAAC;AAC1D;AAAA,MACF;AAMA,UAAI,MAAM,kBAAkB,OAAO;AACjC,cAAM,mBAAmB,GAAG,MAAM,iBAAiB,CAAC,CAAC;AAAA,MACvD;AAMA,YAAM,YAAY;AAClB,YAAM,cAAc,IAAI,KAAK,IAAI,QAAQ,IAAI,iBAAiB,KAAK,KAAK,KAAK,GAAI;AACjF,YAAM,WAAW,MAAM,aAAa,GAAG,aAAa,SAAS;AAC7D,YAAM,eAAe,MAAM,YAAY,GAAG,aAAa,SAAS;AAChE,YAAM,UAAU,SAAS;AACzB,YAAM,SAAS,aAAa;AAC5B,YAAM,aAA+B;AAAA,QACnC,GAAI,UAAU,EAAE,gBAAgB,QAAQ,SAAS,iBAAiB,QAAQ,SAAS,IAAI,CAAC;AAAA,QACxF,GAAI,SAAS,EAAE,kBAAkB,OAAO,aAAa,IAAI,CAAC;AAAA,QAC1D,GAAI,QAAQ,gBAAgB,OAAO,aAAa,OAC5C,EAAE,gBAAgB,OAAO,SAAS,IAClC,CAAC;AAAA,MACP;AAQA,UAAI,aAAa,MAAM,QAAQ,QAAQ,EAAE,iBAAiB,EAAE,WAAW,GAAG;AACxE,YAAI;AACF,gBAAM,SAAS,MAAM;AAAA,YACnB;AAAA,YACA,EAAE;AAAA,YACF,SAAS,cAAc,aAAa,aAAa,IAAI,YAAY,IAAI;AAAA,UACvE;AAEA,gBAAM,MAAM,YAAY,OAAO,EAAE,IAAI,MAAM;AAAA,QAC7C,SAAS,GAAG;AACV,kBAAQ,KAAK,6CAAwC,EAAE,IAAI,KAAM,EAAY,OAAO,EAAE;AAAA,QACxF;AAAA,MACF;AAMA,UAAI;AACJ,UAAI;AACJ,YAAM,WAAW,MAAM,mBAAmB,MAAM,EAAE,IAAI,gBAAgB,MAAM;AAC5E,UAAI,UAAU;AACZ,cAAM,mBAAmB,MAAM,SAAS,IAAI,QAAQ,KAAK,UAAU;AAGnE,cAAM,MAAM,cAAc,MAAM,SAAS,IAAI;AAAA,UAC3C,wBAAwB,OAAO;AAAA,UAC/B,0BAA0B,OAAO;AAAA,UACjC,2BAA2B,OAAO;AAAA,UAClC,gBAAgB,OAAO;AAAA,UACvB,cAAc,IAAI,YAAY,EAAE,MAAM,GAAG,EAAE;AAAA,UAC3C,GAAI,WAAW,mBAAmB,SAC9B,EAAE,kBAAkB,WAAW,eAAe,IAC9C,CAAC;AAAA,UACL,GAAI,WAAW,oBAAoB,SAC/B,EAAE,mBAAmB,WAAW,gBAAgB,IAChD,CAAC;AAAA,UACL,GAAI,WAAW,qBAAqB,SAChC,EAAE,oBAAoB,WAAW,mBAAmB,IAAI,EAAE,IAC1D,CAAC;AAAA,UACL,GAAI,WAAW,mBAAmB,SAC9B,EAAE,iBAAiB,WAAW,eAAe,IAC7C,CAAC;AAAA,QACP,CAAC;AACD,iBAAS;AACT,qBAAa;AAAA,MACf,OAAO;AACL,iBAAS,MAAM;AAAA,UACb;AAAA,UACA,cAAc,GAAG,QAAQ,KAAK,QAAQ,UAAU;AAAA,UAChD,MAAM,cAAc;AAAA,QACtB;AACA,qBAAa;AAAA,MACf;AAEA,YAAM,OAAO,SAAS,EAAE,IAAI;AAC5B,YAAM,EAAE,KAAK,IAAI,MAAM,iBAAiB;AAAA,QACtC,UAAU,EAAE;AAAA,QACZ,SAAS,EAAE;AAAA,QACX,YAAY;AAAA,QACZ,aAAa;AAAA,QACb,YAAY;AAAA,QACZ,gBAAgB,SAAS;AAAA,QACzB,iBAAiB,SAAS;AAAA,QAC1B,cAAc;AAAA,QACd,gBAAgB,QAAQ,eAAgB,OAAO,YAAY,SAAa;AAAA,QACxE,gBAAgB;AAAA,QAChB,YAAY;AAAA,QACZ,MAAM,YAAY,CAAC;AAAA,QACnB,gBAAgB,GAAG,IAAI;AAAA;AAAA;AAAA;AAAA,QAIvB,GAAG,uBAAuB,CAAC;AAAA,MAC7B,CAAC;AAGD,UAAI;AACF,cAAM;AAAA,UACJ,OAAO;AAAA,UACP;AAAA,UACA;AAAA,UACA,GAAG,IAAI,IAAI,IAAI,YAAY,EAAE,MAAM,GAAG,EAAE,CAAC;AAAA,UACzC;AAAA,QACF;AAGA,cAAM,MAAM,cAAc,KAAK,OAAO,IAAI,IAAI;AAAA,MAChD,SAAS,WAAW;AAClB,gBAAQ;AAAA,UACN,kDAA6C,EAAE,IAAI,KACjD,qBAAqB,QAAQ,UAAU,UAAU,OAAO,SAAS,CACnE;AAAA,QACF;AAAA,MACF;AAMA,YAAM,QAAQ,MAAM;AAAA,QAClB;AAAA,QACA,EAAE,IAAI,OAAO,IAAI,QAAQ,EAAE,IAAI,YAAY,eAAe;AAAA,QAC1D,MAAM;AAAA,MACR;AAEA,YAAM,mBAAmB,EAAE,EAAE,sBAAsB,EAAE,mBAAmB,KAAK;AAC7E,cAAQ,KAAK;AAAA,QACX,MAAM,EAAE;AAAA,QACR,QAAQ;AAAA,QACR,UAAU,OAAO;AAAA,QACjB;AAAA,QACA,QAAQ,MAAM;AAAA,MAChB,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,cAAQ,KAAK;AAAA,QACX,MAAM,EAAE;AAAA,QACR,QAAQ;AAAA,QACR,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MAC1D,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO,EAAE,QAAQ;AACnB;AAKA,SAAS,cACP,GACA,QACA,KACA,QACA,YACmC;AACnC,SAAO;AAAA,IACL,UAAU,GAAG,EAAE,IAAI,+BAAqB,IAAI,YAAY,EAAE,MAAM,GAAG,EAAE,CAAC;AAAA,IACtE,QAAQ,EAAE;AAAA,IACV,YAAY;AAAA,IACZ;AAAA,IACA,aAAa;AAAA,IACb,WAAW;AAAA,IACX,aAAa;AAAA,IACb,YAAY;AAAA,IACZ,gBAAgB;AAAA,IAChB,iBAAiB,qBAAqB;AAAA,MACpC,MAAM,EAAE;AAAA,MACR,KAAK,EAAE;AAAA,MACP,MAAM;AAAA,MACN,MAAM;AAAA,IACR,CAAC;AAAA,IACD,GAAG;AAAA,EACL;AACF;;;ACvRA,SAAS,iBAAiB,GAA+B;AACvD,MAAI,EAAE,WAAW,oBAAqB,QAAO,IAAI,EAAE,IAAI;AACvD,MAAI,EAAE,WAAW,QAAS,QAAO,IAAI,EAAE,IAAI,YAAY,EAAE,OAAO;AAChE,QAAM,OAAO,EAAE,mBAAmB,8BAAyB;AAC3D,SAAO,IAAI,EAAE,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI;AACvC;AAEO,SAAS,qBAAqB,QAAgC;AACnE,MAAI,OAAO,QAAQ,WAAW,EAAG,QAAO;AACxC,SAAO,OAAO,QAAQ,IAAI,gBAAgB,EAAE,KAAK,IAAI;AACvD;AASA,eAAsB,mBACpB,MACA,OAC2C;AAK3C,QAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,6BAAgC;AAC1E,QAAM,EAAE,eAAe,IAAI,MAAM,OAAO,2BAAyB;AACjE,QAAM,eAAe,MAAM,iBAAiB;AAC5C,QAAM,aAAa,MAAM,eAAe;AACxC,QAAM,SAAS,MAAM,SAAS,EAAE,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC,GAAI,cAAc,WAAW,CAAC;AACrF,QAAM,WAAW,OAAO,QAAQ,KAAK,CAAC,MAAM,EAAE,WAAW,OAAO;AAChE,SAAO,EAAE,QAAQ,qBAAqB,MAAM,GAAG,MAAM,WAAW,IAAI,EAAE;AACxE;","names":[]}

package/dist/attachments-NLZIJ5NU.js

@@ -1,9 +0,0 @@
-import {
-  fetchAttachmentBytes,
-  uploadAttachment
-} from "./chunk-IY6256GK.js";
-export {
-  fetchAttachmentBytes,
-  uploadAttachment
-};
-//# sourceMappingURL=attachments-NLZIJ5NU.js.map

package/dist/chunk-2ZAZ7ETT.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/reports/send/idempotency.ts","../src/reports/send/orchestrate.ts"],"sourcesContent":["/**\n * True when a thrown send error is Resend's same-key + DIFFERENT-body 409\n * (`invalid_idempotent_request`). The ResendClient (send/resend.ts) discards the\n * status/name and only surfaces the message string, so we match defensively on the\n * stable message substring \"idempotency key has been used\" (case-insensitive); a\n * `name`/`statusCode` of 409/`invalid_idempotent_request` is also accepted if a\n * future client happens to preserve it. A same-key + SAME-body re-send is deduped\n * by Resend (returns the original id) and never reaches here.\n *\n * Shared by both send surfaces that key into Resend's idempotency window:\n * `runDigest` (digest.ts, `digest-<date>` key) and `sendOne` (orchestrate.ts,\n * `report:<id>` key). Both treat a 409 as \"the email already went out under this\n * key on a prior run\" — a no-op for the digest, an already-done success for sendOne.\n */\nexport function isIdempotencyConflict(err: unknown): boolean {\n  const message = err instanceof Error ? err.message : String(err);\n  if (/idempotency key has been used/i.test(message)) return true;\n  const e = err as { name?: unknown; statusCode?: unknown };\n  if (e.name === \"invalid_idempotent_request\") return true;\n  if (e.statusCode === 409) return true;\n  return false;\n}\n","import { openBase, readAirtableConfig } from \"../airtable/client.js\";\nimport { listSendableReports, stampSent } from \"../airtable/reports.js\";\nimport { listWebsites, updateLaunched } from \"../airtable/websites.js\";\nimport type { WebsiteRow } from \"../airtable/websites.js\";\nimport type { ReportRow } from \"../airtable/reports.js\";\nimport { fetchAttachmentBytes } from \"../airtable/attachments.js\";\nimport { renderReportFromRow, requireLighthouse } from \"./render-from-row.js\";\nimport { defaultResendClient, type ResendClient } from \"./resend.js\";\nimport { isIdempotencyConflict } from \"./idempotency.js\";\nimport { gatingHealth, isHealthGateClear, isSendOverridden } from \"../checklist.js\";\nimport { recordFleetEventsBestEffort } from \"../../audits/fleet-events-writer.js\";\nimport type { SiteMirror } from \"../../db/site-mirror.js\";\n\nconst FROM_ADDRESS = \"Reddoor Reports <reports@reddoorla.com>\";\nconst REPLY_TO = \"info@reddoorla.com\";\n\n/** Operations inbox CC'd on every outgoing report so there's always an internal\n *  copy on file alongside the client recipients. */\nexport const GLOBAL_REPORT_CC = \"info@reddoorla.com\";\n\n/**\n * Append {@link GLOBAL_REPORT_CC} to a site's per-site CC list. The per-site CC is\n * passed through unchanged (preserving prior behavior); the global address is added\n * only when it isn't already present in the CC or To lists (case-insensitive), so a\n * report is never double-addressed to the ops inbox. Returns the final CC list (may\n * be empty if the global address is already the sole To recipient — the caller omits\n * an empty CC).\n */\nexport function withGlobalCc(perSiteCc: string[] | null, to: string[]): string[] {\n  const cc = [...(perSiteCc ?? [])];\n  const present = new Set([...cc, ...to].map((a) => a.toLowerCase()));\n  if (!present.has(GLOBAL_REPORT_CC.toLowerCase())) cc.push(GLOBAL_REPORT_CC);\n  return cc;\n}\n\nexport type OrchestrateOptions = {\n  resend?: ResendClient;\n  /** #539 Phase 5: Turso write-through for the Websites row a Launch send\n   *  updates. Injected rather than defaulted — this function is called directly\n   *  by tests, and a default would open a real libSQL handle inside the suite. */\n  siteMirror?: SiteMirror;\n  /** #643 (the freeze): Turso write-through for the `Sent at` / `Resend message\n   *  ID` stamp. stampSent is what removes a row from listSendableReports, so\n   *  once it lands there is no replay left to converge a lost mirror — and the\n   *  console's already-sent guards (approve, the commentary lock, re-render)\n   *  read `sent_at` from Turso. Injected like siteMirror; the CLI wires it\n   *  through `mirrorWrite` so the freeze switch owns the error semantics. */\n  reportSentMirror?: (reportId: string, sentAt: Date, messageId: string | null) => Promise<void>;\n};\n\nexport async function sendApprovedReports(\n  options: OrchestrateOptions = {},\n): Promise<{ output: string; code: number }> {\n  const base = openBase(readAirtableConfig());\n  const client = options.resend ?? defaultResendClient();\n\n  const sendable = await listSendableReports(base);\n  if (sendable.length === 0) return { output: \"No reports ready to send.\", code: 0 };\n\n  const websites = await listWebsites(base);\n  const sites = new Map(websites.map((w) => [w.id, w]));\n\n  const lines: string[] = [];\n  let anyFailed = false;\n  for (const report of sendable) {\n    const site = sites.get(report.siteId);\n    if (!site) {\n      lines.push(`✗ ${report.reportId} — Site row not found for id=${report.siteId}`);\n      anyFailed = true;\n      continue;\n    }\n    try {\n      const sent = await sendOne(client, base, site, report);\n      lines.push(`✓ sent: ${report.reportId} (${sent.display})`);\n      // Mirror the stamp into Turso. Caught here rather than thrown so one\n      // report's lost mirror still lets the batch continue AND still runs this\n      // report's Launch flip below — but it reds the run (`anyFailed`), because\n      // post-freeze nothing converges the miss; `db sync --force` is the manual\n      // converge during the rollback window.\n      try {\n        await options.reportSentMirror?.(report.id, sent.sentAt, sent.messageId);\n      } catch (e) {\n        lines.push(`  ✗ sent-stamp mirror failed for ${report.reportId}: ${(e as Error).message}`);\n        anyFailed = true;\n      }\n      if (report.sendOverride) {\n        const failing = gatingHealth({\n          reportType: report.reportType,\n          autoEvidence: report.autoEvidence ?? {},\n        })\n          .filter((h) => h.status !== \"pass\" && h.status !== \"n/a\")\n          .map((h) => h.field);\n        await recordFleetEventsBestEffort(\n          [\n            {\n              id: `report_sent_with_override:${report.id}`,\n              ts: new Date().toISOString(),\n              type: \"report_sent_with_override\",\n              siteId: site.id,\n              siteName: site.name,\n              summary: `sent with override — ${report.overrideReason ?? \"\"}`,\n              data: { reportId: report.reportId, reason: report.overrideReason, failing },\n            },\n          ],\n          new Date(),\n        );\n      }\n      if (report.reportType === \"Launch\") {\n        try {\n          const fields = await updateLaunched(base, site.id, new Date().toISOString());\n          // Status and `Launched at` travel together — mirroring them as two\n          // updates would open a window where Turso says a site is maintained\n          // but never launched.\n          await options.siteMirror?.site(site.id, fields);\n          lines.push(`  ↳ launched: ${site.name} flipped to maintained`);\n          await recordFleetEventsBestEffort(\n            [\n              {\n                id: `site_launched:${site.id}`,\n                ts: new Date().toISOString(),\n                type: \"site_launched\",\n                siteId: site.id,\n                siteName: site.name,\n                summary: \"launched — now in maintenance\",\n                data: null,\n              },\n            ],\n            new Date(),\n          );\n        } catch (e) {\n          // Post-freeze a swallowed flip failure is permanent divergence: Turso\n          // — the store lead routing reads — would keep the site in\n          // launch-period forever (its leads go operator-only). Red the run\n          // instead of shrugging; the email itself already went out.\n          lines.push(`  ⚠ launch flip failed for ${site.name}: ${(e as Error).message}`);\n          anyFailed = true;\n        }\n      }\n    } catch (e) {\n      lines.push(`✗ ${report.reportId} — ${(e as Error).message}`);\n      anyFailed = true;\n    }\n  }\n  return { output: lines.join(\"\\n\"), code: anyFailed ? 1 : 0 };\n}\n\n/** What the caller needs to mirror the stamp: the exact values stampSent wrote\n *  (`messageId` null on the 409 path, where Airtable's field is left untouched\n *  too), plus the display string for the ✓ line. */\ntype SentStamp = { display: string; sentAt: Date; messageId: string | null };\n\nasync function sendOne(\n  client: ResendClient,\n  base: ReturnType<typeof openBase>,\n  site: WebsiteRow,\n  report: ReportRow,\n): Promise<SentStamp> {\n  // Hard health gate: a Maintenance/Testing report whose gating evidence isn't all pass/n/a must\n  // never go out — even if \"Approved to send\" was set directly in Airtable. Throw so the row is\n  // skipped and `Sent at` stays null (at-least-once retry preserved). Launch/Announcement have no\n  // gating fields → vacuously clear. A logged send-anyway override (Phase 10) bypasses the gate.\n  const gateReport = { reportType: report.reportType, autoEvidence: report.autoEvidence ?? {} };\n  if (!isHealthGateClear(gateReport) && !isSendOverridden(report)) {\n    const failing = gatingHealth(gateReport)\n      .filter((h) => h.status !== \"pass\" && h.status !== \"n/a\")\n      .map((h) => {\n        const note = report.autoEvidence?.[h.field]?.note;\n        return `${h.field} (${h.status}${note ? `: ${note}` : \"\"})`;\n      })\n      .join(\"; \");\n    throw new Error(`Report ${report.reportId} health gate not clear — ${failing}`);\n  }\n  if (!site.headerImage) {\n    throw new Error(`Site '${site.name}' has no Header image set on the Websites row`);\n  }\n  // Fail fast, before the header fetch and the sharp downscale. Same rule and\n  // same message the renderer enforces — shared, not restated.\n  requireLighthouse(report);\n\n  // Resolve + validate recipients BEFORE the expensive work (header fetch + sharp\n  // downscale + full MJML render). A misconfigured-recipients site is a guaranteed\n  // failure, so fail fast here rather than after burning that work. Same checks +\n  // messages as before — only the position moved.\n  const explicitTo = parseAddresses(site.reportRecipientsTo);\n  // Run pointOfContact through the parser too — operators sometimes paste\n  // \"a@x, b@y\" into that single-line field.\n  const fallbackTo = parseAddresses(site.pointOfContact);\n  const to = explicitTo ?? fallbackTo ?? [];\n  if (to.length === 0) {\n    throw new Error(\n      `Site '${site.name}' has no recipients (Report recipients (To) AND point of contact are both empty)`,\n    );\n  }\n  for (const addr of to) {\n    if (!isProbablyEmail(addr)) {\n      throw new Error(\n        `Site '${site.name}' recipient is malformed: ${addr} — use a bare address only ` +\n          `(no \\`Name <addr>\\` display-name syntax); fix Report recipients (To) or point of contact in Airtable`,\n      );\n    }\n  }\n  const cc = parseAddresses(site.reportRecipientsCc);\n  if (cc) {\n    for (const addr of cc) {\n      if (!isProbablyEmail(addr)) {\n        throw new Error(\n          `Site '${site.name}' CC is malformed: ${addr} — fix Report recipients (CC) in Airtable`,\n        );\n      }\n    }\n  }\n\n  const original = await fetchAttachmentBytes(site.headerImage.url);\n  // ONE render path, shared with the console's on-demand re-render — so a\n  // preview cannot drift from what the client actually receives. The assembly\n  // that used to live here moved into renderReportFromRow unchanged.\n  const { html, attachments, subject } = await renderReportFromRow(site, report, original.bytes);\n\n  const payload: Parameters<ResendClient[\"send\"]>[0] = {\n    from: FROM_ADDRESS,\n    to,\n    replyTo: REPLY_TO,\n    subject,\n    html,\n    attachments,\n    // Stable across retries of the same row — if Airtable stamping fails after a\n    // successful Resend, the next --send-ready replays with the same key and\n    // Resend returns the original message id rather than sending a duplicate.\n    idempotencyKey: `report:${report.id}`,\n  };\n  // Always CC the ops inbox (info@reddoorla.com), in addition to any per-site CC.\n  const finalCc = withGlobalCc(cc, to);\n  if (finalCc.length > 0) payload.cc = finalCc;\n\n  let result: Awaited<ReturnType<ResendClient[\"send\"]>>;\n  try {\n    result = await client.send(payload);\n  } catch (err) {\n    // The send path is at-least-once: client.send succeeds → stampSent writes\n    // `Sent at` (the ONLY thing that removes the row from listSendableReports). If\n    // stampSent threw on a PRIOR run (an Airtable blip), `Sent at` stayed null and\n    // the row replays here. By replay time the rendered body has usually changed\n    // (operator Commentary edit, `report --due` rewrote scores, or the header\n    // re-encodes non-deterministically), so Resend rejects the same-key\n    // (`report:<id>`) / different-body re-send with a 409 (`invalid_idempotent_request`).\n    //\n    // That 409 means the email ALREADY WENT OUT under this key on the prior run.\n    // Do NOT re-throw and do NOT re-send (re-throwing leaves the row unstamped, and\n    // after the 24h key TTL a SECOND real email would go out). Instead stamp the row\n    // so it stops replaying, then return success so the caller runs the Launch flip —\n    // which self-heals a launch that sent-but-never-flipped on the prior run.\n    //\n    // Any OTHER error (real network/Resend failure) re-throws, exactly as before, so\n    // a genuine failure still fails loudly and the row replays next run.\n    if (isIdempotencyConflict(err)) {\n      // Stamp `Sent at` ONLY — the original send's messageId is unrecoverable on\n      // the 409 path, so we leave `Resend message ID` null rather than writing a\n      // sentinel that would masquerade as a real id and orphan webhook lookups.\n      // Still return the sentinel string so the caller logs the already-sent path\n      // and runs the Launch flip.\n      const when = new Date();\n      await stampSent(base, report.id, when, null);\n      console.log(`↻ already sent (idempotency conflict), stamped: ${report.reportId}`);\n      return { display: \"idempotent-conflict\", sentAt: when, messageId: null };\n    }\n    throw err;\n  }\n  const when = new Date();\n  await stampSent(base, report.id, when, result.messageId);\n  return { display: result.messageId, sentAt: when, messageId: result.messageId };\n}\n\n/**\n * Split a comma/newline-separated address field into a clean array.\n * Lowercases (case-insensitive dedupe) and removes empty entries. Returns\n * null if nothing survives. Does NOT understand `Display Name <email>` —\n * operators should put a bare address in the Airtable field, or use multiple\n * lines if needing multiple recipients.\n */\nexport function parseAddresses(field: string | null): string[] | null {\n  if (!field) return null;\n  const seen = new Set<string>();\n  const list: string[] = [];\n  for (const raw of field.split(/[,\\n]/)) {\n    const trimmed = raw.trim().toLowerCase();\n    if (!trimmed) continue;\n    if (seen.has(trimmed)) continue;\n    seen.add(trimmed);\n    list.push(trimmed);\n  }\n  return list.length > 0 ? list : null;\n}\n\n/**\n * Cheap email shape check — must contain exactly one @, with non-empty\n * local and domain parts and at least one dot in the domain. We're not\n * trying to be a full RFC validator; we're trying to catch operator\n * mistakes like \"ops at acme dot com\" or a missing @ before they 422\n * at Resend.\n */\nexport function isProbablyEmail(s: string): boolean {\n  const at = s.indexOf(\"@\");\n  if (at < 1 || at !== s.lastIndexOf(\"@\")) return false;\n  const local = s.slice(0, at);\n  const domain = s.slice(at + 1);\n  if (!local || !domain) return false;\n  if (!domain.includes(\".\")) return false;\n  if (/\\s/.test(s)) return false;\n  return true;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAcO,SAAS,sBAAsB,KAAuB;AAC3D,QAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,MAAI,iCAAiC,KAAK,OAAO,EAAG,QAAO;AAC3D,QAAM,IAAI;AACV,MAAI,EAAE,SAAS,6BAA8B,QAAO;AACpD,MAAI,EAAE,eAAe,IAAK,QAAO;AACjC,SAAO;AACT;;;ACRA,IAAM,eAAe;AACrB,IAAM,WAAW;AAIV,IAAM,mBAAmB;AAUzB,SAAS,aAAa,WAA4B,IAAwB;AAC/E,QAAM,KAAK,CAAC,GAAI,aAAa,CAAC,CAAE;AAChC,QAAM,UAAU,IAAI,IAAI,CAAC,GAAG,IAAI,GAAG,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;AAClE,MAAI,CAAC,QAAQ,IAAI,iBAAiB,YAAY,CAAC,EAAG,IAAG,KAAK,gBAAgB;AAC1E,SAAO;AACT;AAiBA,eAAsB,oBACpB,UAA8B,CAAC,GACY;AAC3C,QAAM,OAAO,SAAS,mBAAmB,CAAC;AAC1C,QAAM,SAAS,QAAQ,UAAU,oBAAoB;AAErD,QAAM,WAAW,MAAM,oBAAoB,IAAI;AAC/C,MAAI,SAAS,WAAW,EAAG,QAAO,EAAE,QAAQ,6BAA6B,MAAM,EAAE;AAEjF,QAAM,WAAW,MAAM,aAAa,IAAI;AACxC,QAAM,QAAQ,IAAI,IAAI,SAAS,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AAEpD,QAAM,QAAkB,CAAC;AACzB,MAAI,YAAY;AAChB,aAAW,UAAU,UAAU;AAC7B,UAAM,OAAO,MAAM,IAAI,OAAO,MAAM;AACpC,QAAI,CAAC,MAAM;AACT,YAAM,KAAK,UAAK,OAAO,QAAQ,qCAAgC,OAAO,MAAM,EAAE;AAC9E,kBAAY;AACZ;AAAA,IACF;AACA,QAAI;AACF,YAAM,OAAO,MAAM,QAAQ,QAAQ,MAAM,MAAM,MAAM;AACrD,YAAM,KAAK,gBAAW,OAAO,QAAQ,KAAK,KAAK,OAAO,GAAG;AAMzD,UAAI;AACF,cAAM,QAAQ,mBAAmB,OAAO,IAAI,KAAK,QAAQ,KAAK,SAAS;AAAA,MACzE,SAAS,GAAG;AACV,cAAM,KAAK,yCAAoC,OAAO,QAAQ,KAAM,EAAY,OAAO,EAAE;AACzF,oBAAY;AAAA,MACd;AACA,UAAI,OAAO,cAAc;AACvB,cAAM,UAAU,aAAa;AAAA,UAC3B,YAAY,OAAO;AAAA,UACnB,cAAc,OAAO,gBAAgB,CAAC;AAAA,QACxC,CAAC,EACE,OAAO,CAAC,MAAM,EAAE,WAAW,UAAU,EAAE,WAAW,KAAK,EACvD,IAAI,CAAC,MAAM,EAAE,KAAK;AACrB,cAAM;AAAA,UACJ;AAAA,YACE;AAAA,cACE,IAAI,6BAA6B,OAAO,EAAE;AAAA,cAC1C,KAAI,oBAAI,KAAK,GAAE,YAAY;AAAA,cAC3B,MAAM;AAAA,cACN,QAAQ,KAAK;AAAA,cACb,UAAU,KAAK;AAAA,cACf,SAAS,6BAAwB,OAAO,kBAAkB,EAAE;AAAA,cAC5D,MAAM,EAAE,UAAU,OAAO,UAAU,QAAQ,OAAO,gBAAgB,QAAQ;AAAA,YAC5E;AAAA,UACF;AAAA,UACA,oBAAI,KAAK;AAAA,QACX;AAAA,MACF;AACA,UAAI,OAAO,eAAe,UAAU;AAClC,YAAI;AACF,gBAAM,SAAS,MAAM,eAAe,MAAM,KAAK,KAAI,oBAAI,KAAK,GAAE,YAAY,CAAC;AAI3E,gBAAM,QAAQ,YAAY,KAAK,KAAK,IAAI,MAAM;AAC9C,gBAAM,KAAK,sBAAiB,KAAK,IAAI,wBAAwB;AAC7D,gBAAM;AAAA,YACJ;AAAA,cACE;AAAA,gBACE,IAAI,iBAAiB,KAAK,EAAE;AAAA,gBAC5B,KAAI,oBAAI,KAAK,GAAE,YAAY;AAAA,gBAC3B,MAAM;AAAA,gBACN,QAAQ,KAAK;AAAA,gBACb,UAAU,KAAK;AAAA,gBACf,SAAS;AAAA,gBACT,MAAM;AAAA,cACR;AAAA,YACF;AAAA,YACA,oBAAI,KAAK;AAAA,UACX;AAAA,QACF,SAAS,GAAG;AAKV,gBAAM,KAAK,mCAA8B,KAAK,IAAI,KAAM,EAAY,OAAO,EAAE;AAC7E,sBAAY;AAAA,QACd;AAAA,MACF;AAAA,IACF,SAAS,GAAG;AACV,YAAM,KAAK,UAAK,OAAO,QAAQ,WAAO,EAAY,OAAO,EAAE;AAC3D,kBAAY;AAAA,IACd;AAAA,EACF;AACA,SAAO,EAAE,QAAQ,MAAM,KAAK,IAAI,GAAG,MAAM,YAAY,IAAI,EAAE;AAC7D;AAOA,eAAe,QACb,QACA,MACA,MACA,QACoB;AAKpB,QAAM,aAAa,EAAE,YAAY,OAAO,YAAY,cAAc,OAAO,gBAAgB,CAAC,EAAE;AAC5F,MAAI,CAAC,kBAAkB,UAAU,KAAK,CAAC,iBAAiB,MAAM,GAAG;AAC/D,UAAM,UAAU,aAAa,UAAU,EACpC,OAAO,CAAC,MAAM,EAAE,WAAW,UAAU,EAAE,WAAW,KAAK,EACvD,IAAI,CAAC,MAAM;AACV,YAAM,OAAO,OAAO,eAAe,EAAE,KAAK,GAAG;AAC7C,aAAO,GAAG,EAAE,KAAK,KAAK,EAAE,MAAM,GAAG,OAAO,KAAK,IAAI,KAAK,EAAE;AAAA,IAC1D,CAAC,EACA,KAAK,IAAI;AACZ,UAAM,IAAI,MAAM,UAAU,OAAO,QAAQ,iCAA4B,OAAO,EAAE;AAAA,EAChF;AACA,MAAI,CAAC,KAAK,aAAa;AACrB,UAAM,IAAI,MAAM,SAAS,KAAK,IAAI,+CAA+C;AAAA,EACnF;AAGA,oBAAkB,MAAM;AAMxB,QAAM,aAAa,eAAe,KAAK,kBAAkB;AAGzD,QAAM,aAAa,eAAe,KAAK,cAAc;AACrD,QAAM,KAAK,cAAc,cAAc,CAAC;AACxC,MAAI,GAAG,WAAW,GAAG;AACnB,UAAM,IAAI;AAAA,MACR,SAAS,KAAK,IAAI;AAAA,IACpB;AAAA,EACF;AACA,aAAW,QAAQ,IAAI;AACrB,QAAI,CAAC,gBAAgB,IAAI,GAAG;AAC1B,YAAM,IAAI;AAAA,QACR,SAAS,KAAK,IAAI,6BAA6B,IAAI;AAAA,MAErD;AAAA,IACF;AAAA,EACF;AACA,QAAM,KAAK,eAAe,KAAK,kBAAkB;AACjD,MAAI,IAAI;AACN,eAAW,QAAQ,IAAI;AACrB,UAAI,CAAC,gBAAgB,IAAI,GAAG;AAC1B,cAAM,IAAI;AAAA,UACR,SAAS,KAAK,IAAI,sBAAsB,IAAI;AAAA,QAC9C;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,WAAW,MAAM,qBAAqB,KAAK,YAAY,GAAG;AAIhE,QAAM,EAAE,MAAM,aAAa,QAAQ,IAAI,MAAM,oBAAoB,MAAM,QAAQ,SAAS,KAAK;AAE7F,QAAM,UAA+C;AAAA,IACnD,MAAM;AAAA,IACN;AAAA,IACA,SAAS;AAAA,IACT;AAAA,IACA;AAAA,IACA;AAAA;AAAA;AAAA;AAAA,IAIA,gBAAgB,UAAU,OAAO,EAAE;AAAA,EACrC;AAEA,QAAM,UAAU,aAAa,IAAI,EAAE;AACnC,MAAI,QAAQ,SAAS,EAAG,SAAQ,KAAK;AAErC,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,OAAO,KAAK,OAAO;AAAA,EACpC,SAAS,KAAK;AAiBZ,QAAI,sBAAsB,GAAG,GAAG;AAM9B,YAAMA,QAAO,oBAAI,KAAK;AACtB,YAAM,UAAU,MAAM,OAAO,IAAIA,OAAM,IAAI;AAC3C,cAAQ,IAAI,wDAAmD,OAAO,QAAQ,EAAE;AAChF,aAAO,EAAE,SAAS,uBAAuB,QAAQA,OAAM,WAAW,KAAK;AAAA,IACzE;AACA,UAAM;AAAA,EACR;AACA,QAAM,OAAO,oBAAI,KAAK;AACtB,QAAM,UAAU,MAAM,OAAO,IAAI,MAAM,OAAO,SAAS;AACvD,SAAO,EAAE,SAAS,OAAO,WAAW,QAAQ,MAAM,WAAW,OAAO,UAAU;AAChF;AASO,SAAS,eAAe,OAAuC;AACpE,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,OAAiB,CAAC;AACxB,aAAW,OAAO,MAAM,MAAM,OAAO,GAAG;AACtC,UAAM,UAAU,IAAI,KAAK,EAAE,YAAY;AACvC,QAAI,CAAC,QAAS;AACd,QAAI,KAAK,IAAI,OAAO,EAAG;AACvB,SAAK,IAAI,OAAO;AAChB,SAAK,KAAK,OAAO;AAAA,EACnB;AACA,SAAO,KAAK,SAAS,IAAI,OAAO;AAClC;AASO,SAAS,gBAAgB,GAAoB;AAClD,QAAM,KAAK,EAAE,QAAQ,GAAG;AACxB,MAAI,KAAK,KAAK,OAAO,EAAE,YAAY,GAAG,EAAG,QAAO;AAChD,QAAM,QAAQ,EAAE,MAAM,GAAG,EAAE;AAC3B,QAAM,SAAS,EAAE,MAAM,KAAK,CAAC;AAC7B,MAAI,CAAC,SAAS,CAAC,OAAQ,QAAO;AAC9B,MAAI,CAAC,OAAO,SAAS,GAAG,EAAG,QAAO;AAClC,MAAI,KAAK,KAAK,CAAC,EAAG,QAAO;AACzB,SAAO;AACT;","names":["when"]}