@reddoorla/maintenance 0.96.0 → 0.98.0

package/dist/fleet-events-CkOZpMVC.d.ts

@@ -0,0 +1,435 @@
+import * as airtable_lib_airtable_base_js from 'airtable/lib/airtable_base.js';
+
+type AirtableConfig = {
+    apiKey: string;
+    baseId: string;
+};
+type AirtableBase = ReturnType<typeof openBase>;
+declare function openBase(cfg: AirtableConfig): airtable_lib_airtable_base_js.AirtableBase;
+
+/**
+ * The site-status vocabulary — ONE module owns it (#539 Phase 4).
+ *
+ * It lived at `src/reports/airtable/site-status.ts` until #539 Phase 6 step 1
+ * (#646) moved it here: `canonicalizeStatus` runs on every Turso lead read, so
+ * it cannot sit in the directory Phase 6 deletes. The Airtable write seam
+ * `toAirtableStatus`, discussed below, stayed behind in that file, which also
+ * re-exports everything here.
+ *
+ * The fleet's lifecycle names were inherited from an Airtable single-select
+ * written by hand years ago ("probably not our problem"). The operator approved
+ * a canonical vocabulary, and the migration is now COMPLETE in both stores:
+ * Airtable's "Status" single-select carries exactly the six canonical options
+ * and nothing else. This module no longer knows the old names at all.
+ *
+ * The retired mapping, kept as the record of what was merged into what:
+ *
+ *   old (retired 2026-08-25)    new (canonical)
+ *   ─────────────────────────   ───────────────
+ *   in development              building
+ *   launch period               launching
+ *   maintenance                 maintained
+ *   hosting                     hosted-only
+ *   probably not our problem    external
+ *   legacy                    ┐
+ *   deprecated                ┴ archived        ← approved MERGE, many-to-one
+ *
+ * `legacy` and `deprecated` were already treated identically by every PREDICATE
+ * (ARCHIVED_STATUSES held both), so collapsing them changes no *selection* — no
+ * fleet op gains or loses a site. It is NOT true that collapsing them changes
+ * nothing at all, and one surface proved it: the cockpit's Archived lane LABELS
+ * each row with its Status cell, and canonicalizing there rendered all 12 live
+ * archived rows as "archived". That lane now labels from `statusRaw`, which is
+ * exactly why `WebsiteRow.statusRaw` exists. The rule this leaves behind:
+ * canonical values decide BEHAVIOUR; anything DISPLAYING a Status cell, or
+ * writing one back, uses the raw cell.
+ *
+ * The merge had NO clean reverse map while both vocabularies coexisted, which
+ * is why `toAirtableStatus` had to pick one archived name deliberately. With the
+ * old names retired there is nothing left to pick between, and no code path
+ * feeds operator-supplied text through it anyway (see
+ * `src/recipes/forms-notify-target.ts`, which writes `--restore` verbatim).
+ *
+ * THE SHAPE OF THE TRANSITION (three stages):
+ *
+ *   stage 1 (DONE)  code speaks the NEW vocabulary internally; reads canonicalize
+ *                   at the two Airtable/Turso seams; writes still emit the OLD
+ *                   Airtable option names. Airtable untouched. No SELECTION
+ *                   change — every predicate picks exactly the sites it picked
+ *                   before (pinned row-by-row in tests/reports/airtable/
+ *                   site-status.test.ts). Displayed labels come from `statusRaw`.
+ *   stage 2 (DONE)  the Airtable "Status" single-select gained the 6 new options
+ *                   and all 44 cells were migrated (verified live: maintained=13,
+ *                   archived=12, external=9, building=6, hosted-only=2,
+ *                   launching=2 — zero old values, zero unrecognized), `db sync`
+ *                   ran clean (mismatches=0), and AIRTABLE_USES_NEW_VOCABULARY
+ *                   flipped to true. Writers now emit canonical names verbatim.
+ *                   The alias map STAYS: the 7 old options still exist in the
+ *                   field, so a human can still pick one in the Airtable UI.
+ *   stage 3 (DONE)  the operator deleted the 7 old options from the Airtable
+ *                   "Status" field on 2026-08-25, which is what made this safe:
+ *                   the gate was always "no old value CAN BE ENTERED", not
+ *                   merely "none is stored". Verified against the live base
+ *                   before any code changed — the field carries exactly the six
+ *                   canonical choices, byte-exact, and all 44 cells still hold a
+ *                   canonical value with ZERO blanks (deleting a single-select
+ *                   option CLEARS the cells using it, so "no cell was blanked"
+ *                   was checked, not assumed). AIRTABLE_STATUS_ALIASES,
+ *                   AIRTABLE_OLD_NAMES and AIRTABLE_USES_NEW_VOCABULARY are
+ *                   gone; both functions reduce to the identity.
+ *
+ * WHAT CHANGED IN BEHAVIOUR AT STAGE 3, and it is the only thing that did: an
+ * old name is no longer translated. `canonicalizeStatus("maintenance")` used to
+ * yield `maintained`; it now yields `"maintenance"` verbatim, which
+ * `isUnrecognizedStatus` flags and the cockpit surfaces as a watch row. That is
+ * intended. The option cannot be selected any more, so a stored old value would
+ * mean something went wrong — a restored backup, a scripted write, an API
+ * caller with a stale constant — and the fleet should say so rather than absorb
+ * it into a status nobody chose.
+ *
+ * Canonicalization happens on READ, never at rest: `src/db/import-airtable.ts`
+ * still stores the raw Airtable cell verbatim in `sites.status`, so the hourly
+ * parity check keeps comparing raw-to-raw and the importer stays honest to its
+ * source. Both readers — `mapRow` (Airtable) and `rowFromJoined` (Turso) — run
+ * the raw value through `canonicalizeStatus`, which is what keeps the #558
+ * reader-equivalence instrument green.
+ */
+/** The canonical site lifecycle vocabulary. */
+type Status = "building" | "launching" | "maintained" | "hosted-only" | "external" | "archived";
+
+/**
+ * The fleet's site-row model and its pure, vendor-neutral coercers.
+ *
+ * `WebsiteRow` is what BOTH readers return — `mapRow` over an Airtable record
+ * (`src/reports/airtable/websites.ts`) and `rowFromJoined` over Turso
+ * (`src/db/fleet-state.ts`) — and the coercers below are the ONE truth each of
+ * them applies to a raw cell/column. They lived in the Airtable module until
+ * #539 Phase 6 step 1 (#646) moved them here: they run on every Turso lead read,
+ * so they could not stay in the directory Phase 6 deletes. Nothing here touches
+ * a store; the doc comments still name Airtable columns because that is where
+ * each value was first defined, and the Turso columns carry the same raw values.
+ *
+ * `src/reports/airtable/websites.ts` re-exports every name, so existing imports
+ * resolve unchanged.
+ */
+
+type Frequency = "None" | "Monthly" | "Quarterly" | "Yearly";
+
+/**
+ * Per-site notification routing. When present on a `maintained` site, the form
+ * notification is addressed by the value of a submission field (`field`, read from
+ * `extraFields`) — e.g. route a contact form's `interest` to a different recipient
+ * per option, always CC-ing a shared address. Absent (`null`) → the site keeps the
+ * default single-POC behavior. Recipients live HERE (server-side Airtable config),
+ * never supplied by the submitting site, so the ingest can't be turned into an open
+ * relay.
+ */
+type NotifyRouting = {
+    /** The `extraFields` key whose value selects a route, e.g. "interest". */
+    field: string;
+    /** Field-value → recipient address(es). */
+    routes: Record<string, string | string[]>;
+    /** Recipient(s) when the value matches no route. */
+    default?: string | string[];
+    /** Address(es) CC'd on every routed (maintenance) send. */
+    cc?: string[];
+};
+type WebsiteRow = {
+    id: string;
+    name: string;
+    url: string;
+    /** Canonical lifecycle status (see ./site-status.ts). Canonicalized at the read
+     *  boundary, so an old-vocabulary Airtable cell and a new one read identically.
+     *  A present-but-unrecognized cell survives VERBATIM (blind-cast) rather than
+     *  becoming null — `isUnrecognizedStatus` flags it, and null would make
+     *  due.ts/preflight.ts treat the row as eligible-by-default. */
+    status: Status | null;
+    /** The literal Airtable Status cell behind `status` — same pattern as
+     *  `maintenanceFreqRaw`. The dashboard status editor round-trips THIS, so its
+     *  dropdown offers and preselects the values Airtable actually holds while the
+     *  two vocabularies coexist. Null = blank cell. */
+    statusRaw: string | null;
+    pointOfContact: string | null;
+    maintenanceFreq: Frequency;
+    testingFreq: Frequency;
+    /** The literal Airtable cell values behind the coerced frequencies. `toFrequency`
+     *  trims whitespace ("Monthly " reads as Monthly), then maps any still-unrecognized
+     *  value ("Quaterly") to "None" with a LOUD console.warn so nothing bogus reaches a
+     *  client email and the drop is never invisible. Preflight validates THESE to surface
+     *  the same failure as a structured finding. Null = blank cell. */
+    maintenanceFreqRaw: string | null;
+    testingFreqRaw: string | null;
+    /** Last manually-recorded maintenance day (used as fallback when no Reports row exists). */
+    maintenanceDay: string | null;
+    testingDay: string | null;
+    ga4PropertyId: string | null;
+    /** Operator-supplied query for the Google search-presence check (e.g. the business name).
+     *  Null = no query set → the check is skipped for this site. */
+    searchQuery: string | null;
+    /** Explicit Search Console property for this site (`sc-domain:...` or `https://.../`).
+     *  Null = auto-resolve from the SA's visible properties by host. */
+    searchConsoleProperty: string | null;
+    /** ISO timestamp of the last draft run where THIS site's GA/Search enrichment
+     *  ERRORED (vs a legitimate "not configured" skip). Set by drafting on a soft-fail,
+     *  cleared (null) on a clean enrichment, so the per-site analytics-failure signal
+     *  self-heals. Null when the operator-added `Analytics soft-fail at` column is absent. */
+    analyticsSoftFailAt: string | null;
+    /** GitHub repo identity as `owner/repo`. Null = no git wiring → self-update ops skip
+     *  (or, for local runs, fall back to the checkout's origin remote). */
+    gitRepo: string | null;
+    reportRecipientsTo: string | null;
+    reportRecipientsCc: string | null;
+    acceptedWatchConditions: string[];
+    /** First attachment in the Header image field (Airtable's signed URL — fetch before expiry). */
+    headerImage: {
+        url: string;
+        filename: string;
+        type: string;
+    } | null;
+    /** Lighthouse "current state" snapshot, kept fresh by `audit lighthouse --write-back`. */
+    pScore: number | null;
+    rScore: number | null;
+    bpScore: number | null;
+    seoScore: number | null;
+    /** ISO timestamp set by `audit lighthouse --write-back` when scores were last refreshed. */
+    lastLighthouseAuditAt: string | null;
+    /** Last-known counts from non-lighthouse audits, written by
+     *  `audit --write-back`. `null` = never audited (or this audit
+     *  type was skipped on the last run). 0 = audited, clean. */
+    a11yViolations: number | null;
+    /** Declared-range drift vs the Reddoor baseline (what package.json asks for). */
+    depsDrifted: number | null;
+    depsMajorBehind: number | null;
+    /** Real installed-version drift: deps behind the registry's latest, from the
+     *  committed lockfile (`pnpm outdated`). Null = not determined this run. */
+    depsOutdated: number | null;
+    /** Of {@link depsOutdated}, how many are a *major* version behind the
+     *  registry's latest — the "majors available on npm" signal, distinct from the
+     *  baseline-drift {@link depsMajorBehind}. Null = not determined this run. */
+    depsMajorOutdated: number | null;
+    securityVulnsCritical: number | null;
+    securityVulnsHigh: number | null;
+    securityVulnsModerate: number | null;
+    securityVulnsLow: number | null;
+    /** Count of consecutive nightly Renovate auto-fix dispatches for the CURRENT
+     *  critical/high vuln episode that have NOT yet cleared it. Owned by
+     *  `renovate-dispatch`: +1 per real dispatch, reset to 0 when vulns clear.
+     *  Null = field absent / never dispatched → reads as 0. At/above
+     *  AUTO_FIX_EXHAUSTED_CYCLES the vuln renders as "auto-fix failed". */
+    securityAutoFixAttempts: number | null;
+    /** ISO timestamp the security audit last ran — gates freshness of the Security Updates auto-tick
+     *  (clean counts only auto-tick when recent). */
+    lastSecurityAuditAt: string | null;
+    /** The known advisories behind the counts (severity-sorted, capped), so the dashboard can show
+     *  WHICH packages are vulnerable, not just the totals. null = never audited / unparseable;
+     *  empty array = audited clean. Written alongside the counts by the security audit. */
+    securityAdvisories: SecurityAdvisory[] | null;
+    /** Domain/DNS/SSL probe (the `domain` audit). `certDaysRemaining` is days until the TLS cert
+     *  expires (null = unresolved or no usable cert); `domainCheckedAt` is when it last ran. */
+    certDaysRemaining: number | null;
+    domainCheckedAt: string | null;
+    /** Netlify site id — the IDENTITY the `netlify-deploy` audit needs to query the
+     *  Netlify API. Read-only input (operator-set in Airtable); null = not on Netlify
+     *  (or not wired) → that audit skips. Never derived from the URL. */
+    netlifyId: string | null;
+    /** Latest PRODUCTION deploy health (the `netlify-deploy` audit). `deployStatus` is
+     *  Netlify's deploy state lower-cased (`ready`/`error`/`building`/…), null = none / not
+     *  checked; `lastDeployAt` is when it deployed; `deployLogUrl` links to the deploy/log. */
+    deployStatus: string | null;
+    lastDeployAt: string | null;
+    deployLogUrl: string | null;
+    /** When the `netlify-deploy` audit last RAN (freshness stamp for `deployStatus`). The audit
+     *  already writes "Deploy checked at"; this read-back is the Plan-2 fix so `deployEvidence`
+     *  (Plan 4) can gate on check time — NOT on `lastDeployAt`, which is deploy time, not check time. */
+    deployCheckedAt: string | null;
+    /** Function-health verdict (the `function-health` audit): the deployed `/health` function
+     *  answered `ok:true` (pass) or `ok:false` (fail). Single-select `pass`/`fail`; null = never ran
+     *  / unreachable (→ Plan 4 maps to unknown/amber). Kept SEPARATE from `deployStatus` so
+     *  `isFailedDeployStatus` keeps meaning "the build failed". */
+    functionHealth: "pass" | "fail" | null;
+    /** CMS reachability (server-side), derived from the same `/health` body's `details.prismic ===
+     *  "ok"`. Single-select `pass`/`fail`; null = never ran. No per-site Prismic token or identity
+     *  column is ever built — this rides `/health`. */
+    cmsReachable: "pass" | "fail" | null;
+    /** Does the deployed site's Turnstile widget actually work? Single-select `pass`/`fail`;
+     *  null = **unverified**, which is the normal state — see below. Freshness gated by
+     *  `formE2eCheckedAt`, the clock of the audit that writes it. Powers the cockpit Require-Turnstile guardrail: a site with
+     *  `requireTurnstile` ON but no working widget silently buckets 100% of its real leads.
+     *
+     *  One of the two `"fail"` arms is derived from `/health` (the other is a browser seeing
+     *  110200 on the live hostname), whose `forms.turnstile` is a truthiness check
+     *  on `PUBLIC_TURNSTILE_SITE_KEY` that never contacts Cloudflare (see
+     *  audits/function-health-airtable.ts for the incident). No key IS proof the widget can't
+     *  work; a key is NOT proof that it can — a sitekey whose widget is full at Cloudflare's
+     *  10-hostname cap sets the var and still mints no token. So a `"pass"` here has to be
+     *  earned by a real browser rendering the real widget (form-e2e), and until it is, null
+     *  keeps the site in the cockpit's amber "can't verify" watch rather than claiming health
+     *  nobody measured. */
+    turnstileWidget: "pass" | "fail" | null;
+    /** When the `function-health` audit last ran — the freshness gate for `functionHealth`,
+     *  `cmsReachable`, and `turnstileWidget`. Null = never ran. */
+    functionHealthCheckedAt: string | null;
+    /** Deployed-URL browser probe (the `browser` audit): cross-engine render OK, mobile render OK,
+     *  internal-links OK + broken count, and when it last ran (one timestamp gates all three). */
+    crossbrowserOk: boolean | null;
+    mobileOk: boolean | null;
+    linksOk: boolean | null;
+    brokenLinks: number | null;
+    browserCheckedAt: string | null;
+    /** Uptime-reachable verdict (browser audit): every sampled route returned 2xx/3xx. Single-select
+     *  `pass`/`fail`; null = never ran. Point-in-time. Freshness-gated by `browserCheckedAt`. */
+    reachableOk: "pass" | "fail" | null;
+    /** Titles & meta verdict (browser audit, chromium): every sampled route has a non-empty `<title>`
+     *  ≤ 70 chars + a non-empty meta description, and no duplicate titles across the sample.
+     *  Single-select `pass`/`fail`; null = never ran. Freshness-gated by `browserCheckedAt`. */
+    titleMetaOk: "pass" | "fail" | null;
+    /** Per-site copy overrides (M6a). Blank → null → the DEFAULT_COPY value. */
+    copyIntro: string | null;
+    copyContact: string | null;
+    copyFooter: string | null;
+    /** Go-live timestamp, stamped when a Launch report sends (M6b). Null = not yet launched. */
+    launchedAt: string | null;
+    /** Optional per-site webhook (e.g. Zapier Catch Hook). When set, the ingest
+     *  POSTs newsletter-formType submissions here (best-effort). Blank → null. */
+    newsletterWebhook: string | null;
+    /** Per-site Mailchimp (newsletter). Both must be set for the direct add;
+     *  blank → skipped. The API key is `key-dc` format; dc is derived from it. */
+    mailchimpApiKey: string | null;
+    mailchimpAudienceId: string | null;
+    /** Per-site Cloudflare Turnstile gate (Airtable checkbox). When true, a submission
+     *  whose Turnstile token verifies as "fail" (forged) OR "absent" (secret configured
+     *  centrally but NO token forwarded — the direct-POST-bot signature) is escalated to
+     *  auto-spam regardless of content score. A present-but-expired token stays
+     *  "unverifiable" and neutral (a real browser DID render the widget — fail-open).
+     *  ROLLOUT PRECONDITION: only enable on a site whose DEPLOYED package forwards
+     *  `_meta.turnstileToken` from EVERY form (widget rendered + `cf-turnstile-response`
+     *  posted; check the site's `/health` → forms.turnstile:true). A site that never
+     *  forwards tokens would silently bucket 100% of its real leads — and the form-e2e
+     *  probe cannot catch that state (testMode bypasses the gate). */
+    requireTurnstile: boolean;
+    /** GitHub-signals sweep (slice 2a), written nightly by `github-signals --fleet`. */
+    renovateFailingCis: number | null;
+    defaultBranchCi: string | null;
+    lastCommitAt: string | null;
+    githubSignalsAt: string | null;
+    /** Per-site smoke-suite verdict (the `smoke` audit runs `pnpm test:smoke`).
+     *  Single-select pass/fail; null = never ran. `lastSmokeAt` gates freshness. */
+    smokeOk: "pass" | "fail" | null;
+    lastSmokeAt: string | null;
+    /** Synthetic form end-to-end verdict (the `form-e2e` audit submits the real prod
+     *  contact form in test-mode). Single-select pass/fail; null = never ran OR (with
+     *  a fresh `formE2eCheckedAt`) no contact form → n/a. `formE2eCheckedAt` gates
+     *  freshness AND encodes the n/a-vs-never-ran distinction. */
+    formE2eOk: "pass" | "fail" | null;
+    formE2eCheckedAt: string | null;
+    /**
+     * Nightly Prismic model drift sweep (`prismic-models --fleet --write-back`).
+     *
+     * FOUR-VALUED, unlike every other verdict column in this table, and the extra
+     * state is the point:
+     *
+     *   - `pass`    — the repo and its Prismic repository were compared and agree.
+     *   - `fail`    — they were compared and DIVERGE (a model to create/update, or
+     *                 one that exists only in Prismic). A finding for a human.
+     *   - `unknown` — THE CHECK ITSELF FAILED. Unreadable checkout, broken config,
+     *                 missing/expired token, unreadable remote. Nothing at all was
+     *                 established about this site's models.
+     *   - `null`    — no verdict to hold: the sweep has never run for this site, or
+     *                 it ran and found no Prismic config at all (a repo that simply
+     *                 is not a Prismic site). `prismicModelsCheckedAt` separates
+     *                 those two — fresh timestamp, blank verdict = "checked, and
+     *                 there is nothing here to check".
+     *
+     * `unknown` exists because the alternatives are both wrong in the dangerous
+     * direction. Writing `pass` for a site nobody could read is a green tick over
+     * an outage; writing NOTHING (the obvious "leave the last known value alone")
+     * leaves yesterday's `pass` standing for a site that has been failing every
+     * night since — and nothing ages a stale `pass` out, because the digest's
+     * freshness gate only ever examines failures. Both make "I could not read this
+     * site" indistinguishable from "this site is fine", in the record the cockpit
+     * and the digest read.
+     *
+     * OPERATOR PRECONDITION: `Prismic Models` is a single select whose options are
+     * `pass`, `fail`, `unknown`. Until the three columns exist the sweep's writes
+     * fail with UNKNOWN_FIELD_NAME and are collected as soft failures — the feature
+     * ships dark rather than reddening the nightly.
+     */
+    prismicModels: PrismicModelsVerdict | null;
+    /** When the sweep last ran for this site — written on EVERY outcome, including
+     *  `unknown` and blank, so the age of the row is the age of the answer. */
+    prismicModelsCheckedAt: string | null;
+    /** What the sweep found, verbatim: the drift report for a `fail`, the reason
+     *  nothing could be established for an `unknown`, the skip reason for a blank,
+     *  and null for a `pass` (which clears yesterday's finding). */
+    prismicModelsDrift: string | null;
+    /**
+     * An expiry the operator sets to accept a KNOWN, EXPECTED `fail` — most often
+     * "I am modelling in Prismic on a branch that has not landed, so Prismic is
+     * legitimately ahead of `main`". While this timestamp is in the future the
+     * drift item is not raised.
+     *
+     * It expires on purpose, and nothing renews it automatically. A permanent ack
+     * would reproduce this column's own failure mode one step later: once the
+     * branch lands, the same acked cell would swallow real drift and "nobody is
+     * looking at this" would render as "this is fine". An expiry means the worst
+     * case is a silence that ends by itself.
+     *
+     * Narrow by construction — it mutes only `fail`, the finding the operator
+     * actually reviewed. `unknown` (the check could not run) and a verdict too old
+     * to be current are never muted by it; see `collectPrismicDriftAlerts`.
+     *
+     * OPERATOR PRECONDITION: `Prismic Ack Until` is a dateTime column. Until it
+     * exists this reads null and nothing is acked, which is the safe direction.
+     */
+    prismicAckUntil: string | null;
+    notifyRouting: NotifyRouting | null;
+    /** The RAW `Notify Routing` cell, verbatim. Same reason `statusRaw` exists: the
+     *  dashboard editor round-trips this JSON, and re-serializing the PARSED object
+     *  would drop any key the parser ignores and reformat what the operator typed —
+     *  a silent rewrite of a cell they only opened to look at. */
+    notifyRoutingRaw: string | null;
+    /** Read-back of the code-owned next-due dates (date-only, written by the
+     *  nightly `writeNextDueDates`). These exist so the writer can DIFF the
+     *  freshly-computed dates against what the row already holds and skip the
+     *  ~31 no-op writes a night the fleet was paying for (#539 Phase 3). Null =
+     *  cell blank or the operator-added `Next … at` column absent. */
+    nextMaintenanceAt: string | null;
+    nextTestingAt: string | null;
+};
+/** The `Prismic Models` cell — see {@link WebsiteRow.prismicModels} for why it
+ *  carries a third state that no other verdict column in this table has. */
+type PrismicModelsVerdict = "pass" | "fail" | "unknown";
+type Severity = "low" | "moderate" | "high" | "critical";
+/** One known vulnerability behind the security counts, as persisted/rendered. */
+type SecurityAdvisory = {
+    module: string;
+    severity: Severity;
+    title: string;
+    cves: string[];
+    url: string | null;
+    /** GitHub Dependabot dependency scope ("runtime" | "development"), when known. Lets the
+     *  dashboard flag build-time-only ("development") vulns. Omitted for advisories from the
+     *  lockfile `pnpm audit` fallback, which carries no per-package graph scope. */
+    scope?: "runtime" | "development";
+    /** GitHub Dependabot dependency-graph relationship, when known. "transitive" means no
+     *  direct-dep bump can fix it — Renovate's vuln alerts have no fix vehicle until the weekly
+     *  lockfile-maintenance window. Omitted when GitHub reports "unknown" or for the
+     *  `pnpm audit` fallback. Drives {@link allActionableVulnsTransitive}. */
+    relationship?: "direct" | "transitive";
+};
+
+type FleetEventType = "pr_automerged" | "vuln_cleared" | "ci_recovered" | "site_launched" | "fleet_swept" | "cert_renewed" | "report_sent_with_override";
+/** One recorded fleet activity event. `id` is deterministic (see the detectors)
+ *  so re-runs INSERT OR IGNORE without duplicating. `siteId`/`siteName` are null
+ *  for fleet-wide rollups; `data` is optional structured detail (e.g. the PR url). */
+type FleetEvent = {
+    id: string;
+    ts: string;
+    type: FleetEventType;
+    siteId: string | null;
+    siteName: string | null;
+    summary: string;
+    data: unknown | null;
+};
+
+export type { AirtableBase as A, FleetEvent as F, WebsiteRow as W, FleetEventType as a };

package/dist/{fleet-state-GJWGKTLD.js → fleet-state-RJROYXKO.js}

@@ -1,11 +1,15 @@
 import {
   REPORT_LIST_COLUMNS,
+  findReportByMessageId,
   getReportById,
   getReportHtml,
   getSiteById,
   getSiteBySlug,
+  insertReportRow,
+  insertSiteRows,
   listAllReports,
   listReportsForSite,
+  listSendableReports,
   listSites,
   mirrorHealthFields,
   mirrorReportInsert,
@@ -15,20 +19,25 @@ import {
   mirrorSiteFields,
   mirrorSiteInsert,
   siteRowExists,
-  storeRenderedHtml
-} from "./chunk-GEUC5VGM.js";
-import "./chunk-UIITN37J.js";
-import "./chunk-F3JWOPTG.js";
+  storeRenderedHtml,
+  updateSiteIdentity
+} from "./chunk-BINFZQ2T.js";
+import "./chunk-LF2TJN4X.js";
+import "./chunk-ASLDCWBF.js";
 import "./chunk-VAD43MOR.js";
-import "./chunk-KN52PM63.js";
+import "./chunk-ICSRWW5Q.js";
 export {
   REPORT_LIST_COLUMNS,
+  findReportByMessageId,
   getReportById,
   getReportHtml,
   getSiteById,
   getSiteBySlug,
+  insertReportRow,
+  insertSiteRows,
   listAllReports,
   listReportsForSite,
+  listSendableReports,
   listSites,
   mirrorHealthFields,
   mirrorReportInsert,
@@ -38,6 +47,7 @@ export {
   mirrorSiteFields,
   mirrorSiteInsert,
   siteRowExists,
-  storeRenderedHtml
+  storeRenderedHtml,
+  updateSiteIdentity
 };
-//# sourceMappingURL=fleet-state-GJWGKTLD.js.map
+//# sourceMappingURL=fleet-state-RJROYXKO.js.map

package/dist/{forms-notify-target-4NPLX2UG.js → forms-notify-target-DK5R326N.js}

@@ -2,8 +2,8 @@ import {
   describeNotifyTarget
 } from "./chunk-PXRN2MER.js";
 import "./chunk-Z7FDJ35L.js";
-import "./chunk-5ML7FMBD.js";
 import "./chunk-NO74DXDP.js";
+import "./chunk-5ML7FMBD.js";
 import "./chunk-I7NHLVVI.js";
 import {
   openBase,
@@ -11,12 +11,14 @@ import {
 } from "./chunk-HN6I2XWI.js";
 import "./chunk-BGTYPVLT.js";
 import {
-  canonicalizeStatus,
-  listWebsites,
-  siteSlug,
   toAirtableStatus,
   updateSiteField
-} from "./chunk-KN52PM63.js";
+} from "./chunk-TC4GANMX.js";
+import {
+  canonicalizeStatus,
+  siteSlug
+} from "./chunk-ICSRWW5Q.js";
+import "./chunk-RQJFGK3A.js";
 import "./chunk-2OP4JKIQ.js";
 import "./chunk-6VAL7XJT.js";
 
@@ -38,14 +40,14 @@ function findSite(rows, site) {
 }
 async function formsNotifyTarget(deps) {
   const base = deps.base ?? openBase(readAirtableConfig());
-  const rows = await listWebsites(base);
+  const rows = await deps.roster();
   const row = findSite(rows, deps.site);
   if (!row) {
     const needle = siteSlug(deps.site);
     const near = rows.map((r) => r.name).filter((n) => siteSlug(n).includes(needle) || needle.includes(siteSlug(n)));
     throw Object.assign(
       new Error(
-        `No Websites row matches '${deps.site}'. The Websites NAME is not always the repo slug (Sonder, not gallerysonder).` + (near.length > 0 ? ` Did you mean: ${near.join(", ")}?` : "")
+        `No site matches '${deps.site}'. The stored NAME is not always the repo slug (Sonder, not gallerysonder).` + (near.length > 0 ? ` Did you mean: ${near.join(", ")}?` : "")
       ),
       { exitCode: 2 }
     );
@@ -73,10 +75,10 @@ async function formsNotifyTarget(deps) {
   }
   const cell = deps.set === "on" ? toAirtableStatus(VERIFY_STATUS) : restoreCell(restoreRaw);
   await updateSiteField(base, row.id, STATUS_COLUMN, cell);
-  await deps.siteMirror?.site(row.id, { [STATUS_COLUMN]: cell });
-  const after = findSite(await listWebsites(base), deps.site);
+  await deps.siteMirror.site(row.id, { [STATUS_COLUMN]: cell });
+  const after = findSite(await deps.roster(), deps.site);
   if (!after) {
-    throw Object.assign(new Error(`${row.name} vanished from Websites during the flip.`), {
+    throw Object.assign(new Error(`${row.name} vanished from the fleet during the flip.`), {
       exitCode: 1
     });
   }
@@ -137,15 +139,17 @@ function formatNotifyTarget(r) {
 }
 async function runFormsNotifyTargetCommand(site, opts) {
   if (!site?.trim()) {
-    return { output: "forms-notify-target requires <site> (slug or Airtable name)", code: 2 };
+    return { output: "forms-notify-target requires <site> (slug or site name)", code: 2 };
   }
   const set = opts.set?.trim().toLowerCase();
   if (set !== void 0 && set !== "on" && set !== "off") {
     return { output: `--set must be 'on' or 'off' (got '${opts.set}')`, code: 2 };
   }
   try {
-    const { makeSiteMirror } = await import("./site-mirror-H2FYMN55.js");
+    const { makeSiteMirror } = await import("./site-mirror-TKTDWYP3.js");
+    const { readFleetRoster } = await import("./roster-EJ3ILR52.js");
     const result = await formsNotifyTarget({
+      roster: () => readFleetRoster(),
       siteMirror: await makeSiteMirror(),
       site: site.trim(),
       ...set ? { set } : {},
@@ -164,4 +168,4 @@ export {
   formatNotifyTarget,
   runFormsNotifyTargetCommand
 };
-//# sourceMappingURL=forms-notify-target-4NPLX2UG.js.map
+//# sourceMappingURL=forms-notify-target-DK5R326N.js.map

package/dist/forms-notify-target-DK5R326N.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/recipes/forms-notify-target.ts","../src/cli/commands/forms-notify-target.ts"],"sourcesContent":["import { openBase, readAirtableConfig } from \"../reports/airtable/client.js\";\nimport type { AirtableBase } from \"../reports/airtable/client.js\";\nimport type { SiteMirror } from \"../db/site-mirror.js\";\nimport {\n  siteSlug,\n  updateSiteField,\n  type Status,\n  type WebsiteRow,\n} from \"../reports/airtable/websites.js\";\nimport { canonicalizeStatus, toAirtableStatus } from \"../reports/airtable/site-status.js\";\nimport { describeNotifyTarget, type NotifyTarget } from \"../forms/notify.js\";\n\n/** The Airtable column the pre-launch guard actually lives in. */\nexport const STATUS_COLUMN = \"Status\";\n\n/** The two ends of the verify flip. Deliberately the ONLY transition this\n *  performs: a site in any other status is already guarded (or is deliberately\n *  something else, like \"hosted-only\"), and silently rewriting that would be the\n *  same class of unseen change as the incident. */\nexport const LIVE_STATUS: Status = \"maintained\";\nexport const VERIFY_STATUS: Status = \"launching\";\n\nexport type FormsNotifyTargetDeps = {\n  base?: AirtableBase;\n  /** Every site in the fleet, read from TURSO (#646 step 4). Required, not\n   *  defaulted: the unit suite drives this with a fake fleet, and a default would\n   *  open a real libSQL handle from inside it. The CLI wires `readFleetRoster`.\n   *\n   *  It is called TWICE on a flip — once to find the site, once to read the cell\n   *  back — and both reads matter: Turso is what `/api/forms/:slug` consults to\n   *  decide who a submission emails (`getSiteBySlug`, #643), so confirming the\n   *  Airtable cell would confirm the wrong store, and an Airtable roster cannot\n   *  see a `site_<ULID>` site at all. */\n  roster: () => Promise<WebsiteRow[]>;\n  /** Site slug or the stored site NAME (both accepted). */\n  site: string;\n  /** `on` routes notifications to the operator; `off` restores. Omit to read. */\n  set?: \"on\" | \"off\";\n  /** Status to restore with `--set off`. Required, never inferred. */\n  restore?: string;\n  /** The Status write itself (#646 step 4): Turso is the store the form ingest\n   *  reads, so this is the write the read-back below confirms — the Airtable\n   *  `updateSiteField` beside it is the shadow, and it skips a `site_` id.\n   *  Required, and injected at the CLI root for the same reason `roster` is. */\n  siteMirror: SiteMirror;\n};\n\nexport type FormsNotifyTargetResult = {\n  site: string;\n  status: Status | null;\n  target: NotifyTarget;\n  /** Present only when a flip was attempted. `confirmed` is the whole point:\n   *  it comes from RE-READING the row, not from the write call returning. */\n  flip?: { from: Status | null; to: Status; confirmed: boolean };\n};\n\n/**\n * The exact Airtable cell to write for an operator-supplied `--restore` value:\n * the operator's own string, verbatim.\n *\n * This is the ONE non-revertible surface in the #539 Phase 4 stage-1 rename —\n * every other change is code, and `git revert` undoes code. It cannot undo a\n * rewritten Airtable cell. So the rule here is stricter than everywhere else:\n * substitute only when the substitution is provably lossless, i.e. when\n * canonicalizing and mapping back ROUND-TRIPS to the operator's own string.\n *\n * That condition is, today, never false in a way that changes the answer — which\n * is the point. `toAirtableStatus(canonicalizeStatus(raw))` either equals `raw`\n * (so writing it is writing `raw`) or it does not (so we must write `raw`). The\n * function therefore reduces to \"write raw\", and it is written this way so the\n * reduction is visible rather than assumed. The case that made it matter:\n * `--restore legacy` canonicalizes to `archived`, which maps back to\n * \"deprecated\" — a different, real, operator-visible Airtable option that nobody\n * asked for. `hosting` → `hosted-only` → \"hosting\" round-trips and is safe.\n *\n * Airtable, not this module, is the authority on which option strings the\n * \"Status\" single-select accepts. Writing verbatim delegates to it: a typo is\n * rejected loudly at the API, exactly as it was before the rename.\n */\nexport function restoreCell(raw: string): string {\n  const canonical = canonicalizeStatus(raw);\n  if (canonical === null) return raw;\n  const roundTripped = toAirtableStatus(canonical);\n  return roundTripped === raw ? roundTripped : raw;\n}\n\nfunction findSite(rows: WebsiteRow[], site: string): WebsiteRow | undefined {\n  const wanted = site.trim().toLowerCase();\n  return rows.find(\n    (r) => siteSlug(r.name) === siteSlug(site) || r.name.trim().toLowerCase() === wanted,\n  );\n}\n\n/**\n * Answer \"who would a form submission on this site email?\" — and optionally\n * flip the pre-launch guard, confirming the flip by reading it back.\n *\n * The guard is a single Airtable `Status` cell. Nothing between \"I intended to\n * flip it\" and \"the client received a test lead\" reported the current state, so\n * on 2026-08-03 a flip that never landed sent a real client a test submission.\n * The fix is not a better intention, it is feedback: this reads the row back\n * after every write and refuses to call the flip confirmed on anything less.\n */\nexport async function formsNotifyTarget(\n  deps: FormsNotifyTargetDeps,\n): Promise<FormsNotifyTargetResult> {\n  const base = deps.base ?? openBase(readAirtableConfig());\n  const rows = await deps.roster();\n  const row = findSite(rows, deps.site);\n  if (!row) {\n    // The Websites NAME is not the repo slug (\"Sonder\", not \"gallerysonder\"),\n    // and that mismatch has cost time before — so name the near misses rather\n    // than making the operator go read Airtable to find the spelling.\n    const needle = siteSlug(deps.site);\n    const near = rows\n      .map((r) => r.name)\n      .filter((n) => siteSlug(n).includes(needle) || needle.includes(siteSlug(n)));\n    throw Object.assign(\n      new Error(\n        `No site matches '${deps.site}'. The stored NAME is not always the repo ` +\n          `slug (Sonder, not gallerysonder).` +\n          (near.length > 0 ? ` Did you mean: ${near.join(\", \")}?` : \"\"),\n      ),\n      { exitCode: 2 },\n    );\n  }\n\n  if (!deps.set) {\n    return { site: row.name, status: row.status, target: describeNotifyTarget(row) };\n  }\n\n  // `--restore` is operator free text. It is canonicalized for what this command\n  // REPORTS (`flip.to`, and the predicates downstream), but NEVER for what it\n  // WRITES — see `restoreCell` below.\n  const restoreRaw = deps.restore?.trim();\n  const to = deps.set === \"on\" ? VERIFY_STATUS : (canonicalizeStatus(restoreRaw) ?? undefined);\n  if (deps.set === \"off\" && !to) {\n    throw Object.assign(\n      new Error(\n        `--set off needs --restore <status>: the status to return to is never inferred. ` +\n          `Guessing \"${LIVE_STATUS}\" for a site that was \"hosted-only\" or \"archived\" would start ` +\n          `sending real client notifications — the inverse of the failure this command exists ` +\n          `to prevent.`,\n      ),\n      { exitCode: 2 },\n    );\n  }\n  // Only ever flip a LIVE site into verify mode. A site already outside\n  // \"maintained\" is guarded already, and rewriting its status would destroy a\n  // real value nobody asked us to touch.\n  if (deps.set === \"on\" && row.status !== LIVE_STATUS) {\n    throw Object.assign(\n      new Error(\n        `${row.name} is \"${row.status ?? \"blank\"}\", not \"${LIVE_STATUS}\" — notifications ` +\n          `already go to the operator only, so there is nothing to flip. Leaving the status ` +\n          `untouched.`,\n      ),\n      { exitCode: 2 },\n    );\n  }\n\n  // `--set on` writes a status this MODULE owns (VERIFY_STATUS), so mapping it to\n  // the current Airtable vocabulary is correct. `--set off` writes the operator's\n  // own string — see restoreCell.\n  const cell = deps.set === \"on\" ? toAirtableStatus(VERIFY_STATUS) : restoreCell(restoreRaw!);\n  // The Airtable shadow first, still allowed to fail loudly while it is kept\n  // trustworthy; it skips a site id Airtable cannot hold (#646 step 3).\n  await updateSiteField(base, row.id, STATUS_COLUMN, cell);\n  // The write that DECIDES: `/api/forms/:slug` reads this cell from Turso, and\n  // the console reads it there too.\n  await deps.siteMirror.site(row.id, { [STATUS_COLUMN]: cell });\n\n  // Read it back — from Turso, the store just confirmed to be the one that\n  // matters. The write returning is NOT evidence the field changed.\n  const after = findSite(await deps.roster(), deps.site);\n  if (!after) {\n    throw Object.assign(new Error(`${row.name} vanished from the fleet during the flip.`), {\n      exitCode: 1,\n    });\n  }\n  return {\n    site: after.name,\n    status: after.status,\n    target: describeNotifyTarget(after),\n    // `confirmed` compares the RAW cell against the exact string written, not\n    // canonical-to-canonical. Canonical equality is too weak to be a read-back\n    // guard here: `legacy` and `deprecated` are the same canonical status, so a\n    // cell holding either would confirm a flip to the other. Comparing raw is the\n    // only comparison that can actually catch \"the cell is not what I sent\". The\n    // canonical check rides along so a reader that stopped canonicalizing is\n    // caught too.\n    flip: {\n      from: row.status,\n      to: to!,\n      confirmed: after.statusRaw === cell && after.status === to,\n    },\n  };\n}\n","import {\n  formsNotifyTarget,\n  LIVE_STATUS,\n  VERIFY_STATUS,\n  type FormsNotifyTargetResult,\n} from \"../../recipes/forms-notify-target.js\";\n\nexport type FormsNotifyTargetCommandOptions = {\n  set?: string;\n  restore?: string;\n  cwd?: string;\n};\n\nconst AUDIENCE_LABEL = {\n  client: \"THE CLIENT\",\n  operator: \"OPERATOR ONLY\",\n  nobody: \"NOBODY\",\n} as const;\n\n/** The line that decides whether it is safe to test-submit. Deliberately the\n *  loudest thing on screen: the incident happened because the answer was\n *  invisible, not because it was subtle. */\nexport function formatNotifyTarget(r: FormsNotifyTargetResult): string {\n  const lines: string[] = [];\n  if (r.flip) {\n    const arrow = `${r.flip.from ?? \"blank\"} → ${r.flip.to}`;\n    lines.push(\n      r.flip.confirmed\n        ? `${r.site}  Status: ${arrow}  ✓ confirmed by read-back`\n        : `${r.site}  Status: ${arrow}  ✗ NOT CONFIRMED — the row still reads \"${r.status ?? \"blank\"}\". Nothing was verified; do not test-submit.`,\n    );\n  } else {\n    lines.push(`${r.site}  Status: ${r.status ?? \"blank\"}`);\n  }\n\n  lines.push(`A submission right now would notify: ${AUDIENCE_LABEL[r.target.audience]}`);\n  if (r.target.to.length > 0) lines.push(`  to: ${r.target.to.join(\", \")}`);\n  if (r.target.cc.length > 0) lines.push(`  cc: ${r.target.cc.join(\", \")}`);\n  lines.push(`  ${r.target.reason}`);\n\n  if (r.target.audience === \"client\") {\n    lines.push(\n      \"\",\n      `⚠️  A test submission WILL email the client, and email cannot be recalled.`,\n      `   Route it to yourself first:  reddoor forms-notify-target ${r.site} --set on`,\n    );\n  }\n  if (r.flip?.confirmed && r.flip.to === VERIFY_STATUS) {\n    lines.push(\n      \"\",\n      `Safe to test. When you are done, restore it:`,\n      `  reddoor forms-notify-target ${r.site} --set off --restore ${r.flip.from ?? LIVE_STATUS}`,\n    );\n  }\n  return lines.join(\"\\n\");\n}\n\n/**\n * `forms-notify-target <site>` — show who a form submission would email, and\n * optionally flip the pre-launch guard with a read-back confirmation.\n *\n * Read-only by default: answering the question must never be riskier than not\n * asking it.\n */\nexport async function runFormsNotifyTargetCommand(\n  site: string | undefined,\n  opts: FormsNotifyTargetCommandOptions,\n): Promise<{ output: string; code: number }> {\n  if (!site?.trim()) {\n    return { output: \"forms-notify-target requires <site> (slug or site name)\", code: 2 };\n  }\n  const set = opts.set?.trim().toLowerCase();\n  if (set !== undefined && set !== \"on\" && set !== \"off\") {\n    return { output: `--set must be 'on' or 'off' (got '${opts.set}')`, code: 2 };\n  }\n  try {\n    // #539 Phase 5: the flip writes Status on the Websites row; mirror it so the\n    // console (which reads Turso) shows the new routing immediately.\n    const { makeSiteMirror } = await import(\"../../db/site-mirror.js\");\n    // #646 step 4: the fleet roster — and the flip's read-back — come from Turso,\n    // which is the store `/api/forms/:slug` reads to decide who a submission\n    // emails, and the only one that can see a `site_<ULID>` site.\n    const { readFleetRoster } = await import(\"../../fleet/roster.js\");\n    const result = await formsNotifyTarget({\n      roster: () => readFleetRoster(),\n      siteMirror: await makeSiteMirror(),\n      site: site.trim(),\n      ...(set ? { set: set as \"on\" | \"off\" } : {}),\n      ...(opts.restore ? { restore: opts.restore } : {}),\n    });\n    // An unconfirmed flip must not exit 0: a script (or a person skimming) that\n    // reads exit status would otherwise take \"I flipped it\" on faith, which is\n    // exactly the assumption that sent a client a test lead.\n    return {\n      output: formatNotifyTarget(result),\n      code: result.flip && !result.flip.confirmed ? 1 : 0,\n    };\n  } catch (err) {\n    const e = err as { message?: string; exitCode?: number };\n    return { output: e.message ?? String(err), code: e.exitCode ?? 1 };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAaO,IAAM,gBAAgB;AAMtB,IAAM,cAAsB;AAC5B,IAAM,gBAAwB;AA2D9B,SAAS,YAAY,KAAqB;AAC/C,QAAM,YAAY,mBAAmB,GAAG;AACxC,MAAI,cAAc,KAAM,QAAO;AAC/B,QAAM,eAAe,iBAAiB,SAAS;AAC/C,SAAO,iBAAiB,MAAM,eAAe;AAC/C;AAEA,SAAS,SAAS,MAAoB,MAAsC;AAC1E,QAAM,SAAS,KAAK,KAAK,EAAE,YAAY;AACvC,SAAO,KAAK;AAAA,IACV,CAAC,MAAM,SAAS,EAAE,IAAI,MAAM,SAAS,IAAI,KAAK,EAAE,KAAK,KAAK,EAAE,YAAY,MAAM;AAAA,EAChF;AACF;AAYA,eAAsB,kBACpB,MACkC;AAClC,QAAM,OAAO,KAAK,QAAQ,SAAS,mBAAmB,CAAC;AACvD,QAAM,OAAO,MAAM,KAAK,OAAO;AAC/B,QAAM,MAAM,SAAS,MAAM,KAAK,IAAI;AACpC,MAAI,CAAC,KAAK;AAIR,UAAM,SAAS,SAAS,KAAK,IAAI;AACjC,UAAM,OAAO,KACV,IAAI,CAAC,MAAM,EAAE,IAAI,EACjB,OAAO,CAAC,MAAM,SAAS,CAAC,EAAE,SAAS,MAAM,KAAK,OAAO,SAAS,SAAS,CAAC,CAAC,CAAC;AAC7E,UAAM,OAAO;AAAA,MACX,IAAI;AAAA,QACF,oBAAoB,KAAK,IAAI,iFAE1B,KAAK,SAAS,IAAI,kBAAkB,KAAK,KAAK,IAAI,CAAC,MAAM;AAAA,MAC9D;AAAA,MACA,EAAE,UAAU,EAAE;AAAA,IAChB;AAAA,EACF;AAEA,MAAI,CAAC,KAAK,KAAK;AACb,WAAO,EAAE,MAAM,IAAI,MAAM,QAAQ,IAAI,QAAQ,QAAQ,qBAAqB,GAAG,EAAE;AAAA,EACjF;AAKA,QAAM,aAAa,KAAK,SAAS,KAAK;AACtC,QAAM,KAAK,KAAK,QAAQ,OAAO,gBAAiB,mBAAmB,UAAU,KAAK;AAClF,MAAI,KAAK,QAAQ,SAAS,CAAC,IAAI;AAC7B,UAAM,OAAO;AAAA,MACX,IAAI;AAAA,QACF,4FACe,WAAW;AAAA,MAG5B;AAAA,MACA,EAAE,UAAU,EAAE;AAAA,IAChB;AAAA,EACF;AAIA,MAAI,KAAK,QAAQ,QAAQ,IAAI,WAAW,aAAa;AACnD,UAAM,OAAO;AAAA,MACX,IAAI;AAAA,QACF,GAAG,IAAI,IAAI,QAAQ,IAAI,UAAU,OAAO,WAAW,WAAW;AAAA,MAGhE;AAAA,MACA,EAAE,UAAU,EAAE;AAAA,IAChB;AAAA,EACF;AAKA,QAAM,OAAO,KAAK,QAAQ,OAAO,iBAAiB,aAAa,IAAI,YAAY,UAAW;AAG1F,QAAM,gBAAgB,MAAM,IAAI,IAAI,eAAe,IAAI;AAGvD,QAAM,KAAK,WAAW,KAAK,IAAI,IAAI,EAAE,CAAC,aAAa,GAAG,KAAK,CAAC;AAI5D,QAAM,QAAQ,SAAS,MAAM,KAAK,OAAO,GAAG,KAAK,IAAI;AACrD,MAAI,CAAC,OAAO;AACV,UAAM,OAAO,OAAO,IAAI,MAAM,GAAG,IAAI,IAAI,2CAA2C,GAAG;AAAA,MACrF,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AACA,SAAO;AAAA,IACL,MAAM,MAAM;AAAA,IACZ,QAAQ,MAAM;AAAA,IACd,QAAQ,qBAAqB,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQlC,MAAM;AAAA,MACJ,MAAM,IAAI;AAAA,MACV;AAAA,MACA,WAAW,MAAM,cAAc,QAAQ,MAAM,WAAW;AAAA,IAC1D;AAAA,EACF;AACF;;;ACxLA,IAAM,iBAAiB;AAAA,EACrB,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,QAAQ;AACV;AAKO,SAAS,mBAAmB,GAAoC;AACrE,QAAM,QAAkB,CAAC;AACzB,MAAI,EAAE,MAAM;AACV,UAAM,QAAQ,GAAG,EAAE,KAAK,QAAQ,OAAO,WAAM,EAAE,KAAK,EAAE;AACtD,UAAM;AAAA,MACJ,EAAE,KAAK,YACH,GAAG,EAAE,IAAI,aAAa,KAAK,oCAC3B,GAAG,EAAE,IAAI,aAAa,KAAK,sDAA4C,EAAE,UAAU,OAAO;AAAA,IAChG;AAAA,EACF,OAAO;AACL,UAAM,KAAK,GAAG,EAAE,IAAI,aAAa,EAAE,UAAU,OAAO,EAAE;AAAA,EACxD;AAEA,QAAM,KAAK,wCAAwC,eAAe,EAAE,OAAO,QAAQ,CAAC,EAAE;AACtF,MAAI,EAAE,OAAO,GAAG,SAAS,EAAG,OAAM,KAAK,SAAS,EAAE,OAAO,GAAG,KAAK,IAAI,CAAC,EAAE;AACxE,MAAI,EAAE,OAAO,GAAG,SAAS,EAAG,OAAM,KAAK,SAAS,EAAE,OAAO,GAAG,KAAK,IAAI,CAAC,EAAE;AACxE,QAAM,KAAK,KAAK,EAAE,OAAO,MAAM,EAAE;AAEjC,MAAI,EAAE,OAAO,aAAa,UAAU;AAClC,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA,+DAA+D,EAAE,IAAI;AAAA,IACvE;AAAA,EACF;AACA,MAAI,EAAE,MAAM,aAAa,EAAE,KAAK,OAAO,eAAe;AACpD,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA,iCAAiC,EAAE,IAAI,wBAAwB,EAAE,KAAK,QAAQ,WAAW;AAAA,IAC3F;AAAA,EACF;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;AASA,eAAsB,4BACpB,MACA,MAC2C;AAC3C,MAAI,CAAC,MAAM,KAAK,GAAG;AACjB,WAAO,EAAE,QAAQ,2DAA2D,MAAM,EAAE;AAAA,EACtF;AACA,QAAM,MAAM,KAAK,KAAK,KAAK,EAAE,YAAY;AACzC,MAAI,QAAQ,UAAa,QAAQ,QAAQ,QAAQ,OAAO;AACtD,WAAO,EAAE,QAAQ,qCAAqC,KAAK,GAAG,MAAM,MAAM,EAAE;AAAA,EAC9E;AACA,MAAI;AAGF,UAAM,EAAE,eAAe,IAAI,MAAM,OAAO,2BAAyB;AAIjE,UAAM,EAAE,gBAAgB,IAAI,MAAM,OAAO,sBAAuB;AAChE,UAAM,SAAS,MAAM,kBAAkB;AAAA,MACrC,QAAQ,MAAM,gBAAgB;AAAA,MAC9B,YAAY,MAAM,eAAe;AAAA,MACjC,MAAM,KAAK,KAAK;AAAA,MAChB,GAAI,MAAM,EAAE,IAAyB,IAAI,CAAC;AAAA,MAC1C,GAAI,KAAK,UAAU,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,IAClD,CAAC;AAID,WAAO;AAAA,MACL,QAAQ,mBAAmB,MAAM;AAAA,MACjC,MAAM,OAAO,QAAQ,CAAC,OAAO,KAAK,YAAY,IAAI;AAAA,IACpD;AAAA,EACF,SAAS,KAAK;AACZ,UAAM,IAAI;AACV,WAAO,EAAE,QAAQ,EAAE,WAAW,OAAO,GAAG,GAAG,MAAM,EAAE,YAAY,EAAE;AAAA,EACnE;AACF;","names":[]}