@reddoorla/maintenance 0.96.0 → 0.98.0

package/dist/launch-XTDMC6LD.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/cli/commands/launch.ts","../src/recipes/launch.ts"],"sourcesContent":["import { resolve } from \"node:path\";\nimport { launch, type LaunchResult, type LaunchStepResult } from \"../../recipes/launch.js\";\nimport { resolveSites } from \"../fleet/resolve-sites.js\";\n\nexport type LaunchCommandOptions = {\n  cwd?: string;\n};\n\nexport function formatStep(name: string, r: LaunchStepResult): string {\n  if (r.kind === \"error\") return `${name.padEnd(20)} error: ${r.message}`;\n  if (r.kind === \"audit\") {\n    const s = r.scores;\n    return `${name.padEnd(20)} audited (P=${s.performance} A=${s.accessibility} BP=${s.bestPractices} SEO=${s.seo})`;\n  }\n  if (r.kind === \"draft\") {\n    return `${name.padEnd(20)} drafted ${r.report.reportId}`;\n  }\n  if (r.kind === \"probe\") return `${name.padEnd(20)} ok — ${r.message}`;\n  const rec = r.result;\n  if (rec.status === \"noop\") return `${name.padEnd(20)} noop${rec.notes ? ` — ${rec.notes}` : \"\"}`;\n  if (rec.status === \"failed\")\n    return `${name.padEnd(20)} failed${rec.notes ? ` — ${rec.notes}` : \"\"}`;\n  return `${name.padEnd(20)} applied (${rec.commits.length} commit${rec.commits.length === 1 ? \"\" : \"s\"})${rec.notes ? ` — ${rec.notes}` : \"\"}`;\n}\n\nfunction formatResult(r: LaunchResult): string {\n  const header = `[${r.site}] launch — ${r.complete ? \"drafted (awaiting approval)\" : \"STOPPED\"}`;\n  const body = r.steps.map((s) => formatStep(s.name, s.result)).join(\"\\n\");\n  return `${header}\\n${body}`;\n}\n\n/**\n * `launch <site>` — single-site only. Bootstrap (Renovate + protection), first-audit\n * the site, and DRAFT its launch email into the M3 approve queue. Never sends;\n * the operator approves the draft and the next send run delivers the go-live\n * email (flipping Status → maintenance + stamping Launched at).\n */\nexport async function runLaunchCommand(\n  site: string,\n  opts: LaunchCommandOptions,\n): Promise<{ output: string; code: number }> {\n  const cwd = opts.cwd ? resolve(opts.cwd) : process.cwd();\n  const sites = await resolveSites({ site, cwd });\n  const target = sites[0];\n  if (!target) {\n    return { output: `No site resolved for \"${site}\".`, code: 1 };\n  }\n\n  // #539 Phase 5: create-side Turso dual-write, wired at the composition root\n  // (see runAnnounceCommand for why it is not defaulted inside the recipe).\n  const { makeReportMirror } = await import(\"../../reports/report-mirror.js\");\n  const { makeSiteMirror } = await import(\"../../db/site-mirror.js\");\n  const result = await launch(target, {\n    reportMirror: await makeReportMirror(),\n    siteMirror: await makeSiteMirror(),\n  });\n  return { output: formatResult(result), code: result.complete ? 0 : 1 };\n}\n","import { existsSync } from \"node:fs\";\nimport { readFile, readdir } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport type { AuditResult, RecipeResult, Site } from \"../types.js\";\nimport { siteLabel } from \"../util/site.js\";\nimport { selfUpdating } from \"./self-updating/index.js\";\nimport { HARNESS_JSON_RELATIVE, UNGUARDED_TWIN_TELL } from \"./match-harness/template.js\";\nimport { runAudits } from \"../audits/index.js\";\nimport { hasRealScores, lighthouseScoresFromResult } from \"../audits/lighthouse-airtable.js\";\nimport { writeAuditsToAirtable } from \"../audits/write-audits-to-airtable.js\";\nimport { openBase, readAirtableConfig } from \"../reports/airtable/client.js\";\nimport type { AirtableBase } from \"../reports/airtable/client.js\";\nimport { listWebsites, siteSlug } from \"../reports/airtable/websites.js\";\nimport type { WebsiteRow } from \"../reports/airtable/websites.js\";\nimport {\n  createDraft,\n  findReportByPeriod,\n  updateReportScores,\n} from \"../reports/airtable/reports.js\";\nimport type { ReportRow } from \"../reports/airtable/reports.js\";\nimport type { ReportMirror } from \"../reports/report-mirror.js\";\nimport type { SiteMirror } from \"../db/site-mirror.js\";\nimport { queueDraft } from \"../reports/queue.js\";\nimport { uploadAttachment } from \"../reports/airtable/attachments.js\";\nimport { renderReportHtml } from \"../reports/render.js\";\nimport { resolveCopy } from \"../reports/copy.js\";\nimport type { LighthouseScores } from \"../reports/types.js\";\n\nexport type LaunchStepResult =\n  | { kind: \"recipe\"; result: RecipeResult }\n  | { kind: \"audit\"; results: AuditResult[]; scores: LighthouseScores }\n  | { kind: \"draft\"; report: ReportRow }\n  | { kind: \"probe\"; message: string }\n  | { kind: \"error\"; message: string };\n\nexport type LaunchResult = {\n  site: string;\n  steps: Array<{ name: string; result: LaunchStepResult }>;\n  /** True if every step ran (bootstrap + audit + draft); false if a step\n   * errored or a recipe `failed` short-circuited the chain. */\n  complete: boolean;\n};\n\nexport type LaunchDeps = {\n  /** Bootstrap step (Renovate + protection; ci.yml comes from the starter). Defaults to the real `selfUpdating`. */\n  bootstrap?: (site: Site) => Promise<RecipeResult>;\n  /** Audit step. Defaults to the real `runAudits`. */\n  audit?: (site: Site) => Promise<AuditResult[]>;\n  /** Airtable handle. Defaults to opening the live base from credentials. */\n  base?: AirtableBase;\n  /** #539 Phase 5: Turso write-through for everything this recipe writes — the\n   *  Launch row (or a re-run's refreshed scores), the rendered body, and the\n   *  queue flag. Wired at the CLI composition root, never defaulted here — the\n   *  unit suite calls `launch` with a fake base and must not open a real\n   *  libSQL handle. */\n  reportMirror?: ReportMirror;\n  /** #539 Phase 5: the Websites-row twin — launch writes the site's FIRST audit\n   *  results and (on send) its launched status. Injected at the CLI root. */\n  siteMirror?: SiteMirror;\n  /** HTTP probe for `dev-guard`. Defaults to global fetch. INJECTED in tests:\n   *  the suite stubs `global.fetch` for the Airtable attachment upload and that\n   *  stub answers 200 to everything — which is precisely the state this step\n   *  exists to fail on. */\n  probe?: (url: string) => Promise<{ status: number; body: string }>;\n};\n\n/** The site's OWN 404. `src/routes/+error.svelte` renders `<h1>{page.status}</h1>`,\n *  so a real SvelteKit 404 from this app carries an `<h1>404</h1>`; a parked\n *  domain, a CDN 404 and a dead host do not. \"The route is gone\" and \"the site\n *  is gone\" must not look the same to this gate. */\nconst SITE_404_MARKER = /<h1[^>]*>\\s*404\\s*<\\/h1>/i;\n\n/** The UNGUARDED twin's OWN refusal. `src/routes/dev/match/[uid]/+page.server.ts`\n *  404s for any uid absent from its assembly map — and that message renders\n *  through the very same `+error.svelte` the guard's 404 uses, so it carries an\n *  `<h1>404</h1>` too. On a site whose uid set lacks \"home\", a LIVE twin and a\n *  guarded one are byte-indistinguishable to SITE_404_MARKER, and the check\n *  could never fail. Verified on disk: beachfront-dentistry's copy of that route\n *  imports `$app/environment` zero times.\n *\n *  The contract is the MACHINE tell `UNGUARDED_TWIN_TELL`, imported from the\n *  template that installs the route rather than re-typed here: the installed\n *  twin puts it ahead of its human-readable message. Matching the prose was\n *  the defect of #719 — reword the message (\"no document for\", \"unknown uid\")\n *  and the guard silently stopped denying, i.e. failed OPEN with fixtures\n *  public. The two prose wordings are STILL accepted, on purpose and for now:\n *  beachfront-dentistry's on-disk twin predates the tell and says \"no matching\n *  assembly for\", and any site installed before the tell says \"no assembly\n *  for\". Drop the prose alternates once beachfront's twin has been\n *  re-installed from the harness; until then they only ever widen the deny.\n *\n *  This is a DENY clause and only ever a deny — it can refuse a green, never\n *  grant one. Widening it can only ever refuse a launch that would otherwise\n *  have proceeded, so widening is always the safe direction here. */\nexport const UNGUARDED_TWIN_MARKER = new RegExp(\n  `${UNGUARDED_TWIN_TELL.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\")}|no (matching )?assembly for`,\n  \"i\",\n);\n\nconst MATCH_ROUTE_DIR = \"src/routes/dev/match\";\n\n/** Positive evidence that `sitePath` is a SvelteKit checkout at all. Without it,\n *  the absence of MATCH_ROUTE_DIR is evidence of nothing: a path never cloned, a\n *  stale clone, a mistyped site name and the wrong working directory all produce\n *  exactly the same `false`, and `resolveSites` builds the path with\n *  `localPath(resolve(cwd, site))` and no existence check of its own. This is\n *  the filesystem twin of the `/health` control on the deployed gate — an absent\n *  error must never be allowed to grant a green. */\nconst CHECKOUT_MARKER = \"src/routes\";\n\n/** Tokens after which a `/` opens a REGEX literal rather than a division. This\n *  is the usual JS ambiguity, answered by lookback at the last significant\n *  character — a scanner's answer, not a parser's.\n *\n *  `)` is deliberately NOT here. `if (x) /re/.test(y)` is legal and is read as\n *  division, which costs nothing (the `/` is copied through unchanged, exactly\n *  as before this function existed) and keeps `(a + b) / 2` right, which is far\n *  commoner in that position. That is the residual: a regex literal opening\n *  directly after `)` AND containing a quote falls back to the old behaviour and\n *  therefore DENIES. Deny is the safe direction here — see `carriesGuard`. */\nconst REGEX_PRECEDERS = /[(,=:[!&|?{};+\\-*%~^<>]/;\nconst REGEX_KEYWORDS = new Set([\n  \"return\",\n  \"typeof\",\n  \"case\",\n  \"in\",\n  \"of\",\n  \"new\",\n  \"delete\",\n  \"void\",\n  \"instanceof\",\n  \"do\",\n  \"else\",\n  \"yield\",\n  \"await\",\n]);\n\nfunction opensRegex(prevChar: string, prevWord: string): boolean {\n  if (prevChar === \"\") return true;\n  if (REGEX_PRECEDERS.test(prevChar)) return true;\n  return REGEX_KEYWORDS.has(prevWord);\n}\n\n/** The last significant character emitted so far, and the identifier ending at\n *  it. Both scanners look back over their own OUTPUT, which is why masking is\n *  safe to interleave: masked bodies are spaces and the delimiters survive, so\n *  the structural lookback reads the same either way. */\nfunction lookback(out: string): { char: string; word: string } {\n  let i = out.length - 1;\n  while (i >= 0 && /\\s/.test(out[i]!)) i--;\n  if (i < 0) return { char: \"\", word: \"\" };\n  let j = i;\n  while (j >= 0 && /[A-Za-z0-9_$]/.test(out[j]!)) j--;\n  return { char: out[i]!, word: out.slice(j + 1, i + 1) };\n}\n\n/** Index of a regex literal's CLOSING `/`, or -1 if `source[at]` does not in\n *  fact open one. `[...]` character classes are tracked because a `/` inside one\n *  does not close the literal (`/[a-z/]/`). A newline or an unterminated run\n *  means this was never a regex, and the caller then treats the `/` as an\n *  ordinary character — the behaviour that predates regex-awareness. */\nfunction regexLiteralEnd(source: string, at: number): number {\n  let inClass = false;\n  for (let i = at + 1; i < source.length; i++) {\n    const c = source[i]!;\n    if (c === \"\\\\\") {\n      i++;\n      continue;\n    }\n    if (c === \"\\n\") return -1;\n    if (inClass) {\n      if (c === \"]\") inClass = false;\n      continue;\n    }\n    if (c === \"[\") {\n      inClass = true;\n      continue;\n    }\n    if (c === \"/\") return i;\n  }\n  return -1;\n}\n\n/** Strip line and block comments, so the COMMON commented-out guard cannot\n *  satisfy the match — an import left in place above `// if (!dev) error(404);`\n *  is the likeliest real-world state, and it used to pass. String and template\n *  literals are skipped so a `//` inside a URL is not read as a comment.\n *\n *  Regex literals are recognised (#726). Without that, a quote character inside\n *  one — `/[a-z0-9']+/` — opened a string that never closed, and everything to\n *  the next matching quote was preserved as if it were string content. On a\n *  CORRECTLY guarded file that swallowed the live `if (!dev) error(404)` and the\n *  twin read as unguarded, so a launch was blocked on a site that was fine. The\n *  literal is now copied through verbatim, which is what a comment stripper\n *  should do with one. */\nfunction stripComments(source: string): string {\n  let out = \"\";\n  for (let i = 0; i < source.length;) {\n    const ch = source[i]!;\n    const next = source[i + 1];\n    if (ch === \"/\" && next === \"/\") {\n      while (i < source.length && source[i] !== \"\\n\") i++;\n      continue;\n    }\n    if (ch === \"/\" && next === \"*\") {\n      i += 2;\n      while (i < source.length && !(source[i] === \"*\" && source[i + 1] === \"/\")) i++;\n      i += 2;\n      continue;\n    }\n    if (ch === \"/\") {\n      const { char, word } = lookback(out);\n      if (opensRegex(char, word)) {\n        const end = regexLiteralEnd(source, i);\n        if (end !== -1) {\n          out += source.slice(i, end + 1);\n          i = end + 1;\n          continue;\n        }\n      }\n    }\n    if (ch === '\"' || ch === \"'\" || ch === \"`\") {\n      out += ch;\n      i++;\n      while (i < source.length) {\n        if (source[i] === \"\\\\\") {\n          out += source.slice(i, i + 2);\n          i += 2;\n          continue;\n        }\n        out += source[i]!;\n        i++;\n        if (source[i - 1] === ch) break;\n      }\n      continue;\n    }\n    out += ch;\n    i++;\n  }\n  return out;\n}\n\n/** Blank the CONTENTS of string and template literals, keeping the quote\n *  characters, the newlines and the overall length. Only the guard scan uses\n *  this — never the `$app/environment` check, whose whole subject is an import\n *  specifier and therefore is itself a string literal.\n *\n *  It exists because `if (!dev) console.warn(\"this should throw error(404)\")`\n *  read as a refusal. Masking can only ever REMOVE candidate refusal tokens, so\n *  it can only ever deny.\n *  Regex BODIES are masked too, for the same reason and with the same effect: a\n *  regex is data, so `if (!dev) RE = /throw/` must not be read as a refusal. It\n *  was, before #726. */\nfunction maskLiterals(code: string): string {\n  let out = \"\";\n  for (let i = 0; i < code.length;) {\n    const ch = code[i]!;\n    if (ch === \"/\") {\n      const { char, word } = lookback(out);\n      if (opensRegex(char, word)) {\n        const end = regexLiteralEnd(code, i);\n        if (end !== -1) {\n          // Delimiters and length kept, body blanked — exactly the string rule.\n          out += \"/\" + \" \".repeat(end - i - 1) + \"/\";\n          i = end + 1;\n          continue;\n        }\n      }\n    }\n    if (ch !== '\"' && ch !== \"'\" && ch !== \"`\") {\n      out += ch;\n      i++;\n      continue;\n    }\n    out += ch;\n    i++;\n    while (i < code.length) {\n      const c = code[i]!;\n      if (c === \"\\\\\") {\n        out += \"  \";\n        i += 2;\n        continue;\n      }\n      i++;\n      if (c === ch) {\n        out += c;\n        break;\n      }\n      out += c === \"\\n\" ? \"\\n\" : \" \";\n    }\n  }\n  return out;\n}\n\n/** The statement or block the `if (...)` ending at `from` actually governs: a\n *  braced block, or the single statement up to its terminating `;` — or, under\n *  ASI, the end of its line. Bracket depth is tracked so\n *  `error(404, {\\n  message: \"…\"\\n});` is ONE statement rather than three\n *  fragments. Expects `code` to be comment-stripped and literal-masked, so every\n *  bracket it sees is a real one. */\nfunction consequentAt(code: string, from: number): string {\n  let i = from;\n  while (i < code.length && /\\s/.test(code[i]!)) i++;\n  const start = i;\n  if (code[i] === \"{\") {\n    let depth = 0;\n    for (; i < code.length; i++) {\n      if (code[i] === \"{\") depth++;\n      else if (code[i] === \"}\" && --depth === 0) return code.slice(start, i + 1);\n    }\n    return code.slice(start);\n  }\n  let depth = 0;\n  for (; i < code.length; i++) {\n    const ch = code[i]!;\n    if (ch === \"(\" || ch === \"[\" || ch === \"{\") depth++;\n    else if (ch === \")\" || ch === \"]\" || ch === \"}\") {\n      if (depth === 0) return code.slice(start, i);\n      depth--;\n    } else if (depth === 0 && (ch === \";\" || ch === \"\\n\")) return code.slice(start, i);\n  }\n  return code.slice(start);\n}\n\n/** An actual refusal: SvelteKit's `error(404, …)`, or any `throw`. */\nconst REFUSAL = /\\berror\\s*\\(\\s*404|\\bthrow\\b/;\n\n/** A guard is `$app/environment` + an `if (!dev)` **whose own branch refuses**.\n *\n *  The three conditions used to be ANDed across the WHOLE file, with nothing\n *  tying the refusal to the `if`. Two shapes passed that should not have: a\n *  warn-only `if (!dev)` alongside the route's own unrelated `throw` (the exact\n *  half-fix this comment used to claim was closed), and a refusal occurring only\n *  inside a string. Reading the guard's consequent, on literal-masked source, is\n *  strictly narrower than the old whole-file grep — every input it rejects, the\n *  old predicate also had to reject on `$app/environment` or `if (!dev)`, or was\n *  a false pass. It can therefore only deny, never grant.\n *\n *  It is a contract with plan BC's `ROUTE_SERVER` template, which BC installs\n *  and this pre-flight must accept; tests/recipes/launch.test.ts lifts that\n *  template out of the plan and runs this predicate over it rather than\n *  restating the pattern. */\nfunction carriesGuard(source: string): boolean {\n  const code = stripComments(source);\n  if (!code.includes(\"$app/environment\")) return false;\n  const masked = maskLiterals(code);\n  const guards = /if\\s*\\(\\s*!\\s*dev\\s*\\)/g;\n  for (let m = guards.exec(masked); m; m = guards.exec(masked)) {\n    if (REFUSAL.test(consequentAt(masked, m.index + m[0].length))) return true;\n  }\n  return false;\n}\n\nconst DEV_ROUTE_DIR = \"src/routes/dev\";\n\n/** Every SvelteKit route file at or below `relDir`, site-root-relative. The\n *  gates used to read a FIXED list of three paths, which is why a `+server.ts`\n *  endpoint and a `/dev/match/frozen` sibling were inspected by neither of them\n *  (#723). What exists under the twin is a question for the filesystem, not for\n *  a constant. */\nasync function routeFilesUnder(sitePath: string, relDir: string): Promise<string[]> {\n  let entries;\n  try {\n    entries = await readdir(join(sitePath, relDir), { withFileTypes: true });\n  } catch {\n    return [];\n  }\n  const out: string[] = [];\n  for (const e of entries) {\n    const rel = `${relDir}/${e.name}`;\n    if (e.isDirectory()) out.push(...(await routeFilesUnder(sitePath, rel)));\n    else if (e.name.startsWith(\"+\")) out.push(rel);\n  }\n  return out;\n}\n\n/** `carriesGuard` for one file, memoised — a layout is asked about once per page\n *  directory below it. An unreadable file is not a guard. */\nasync function guardAt(\n  sitePath: string,\n  rel: string,\n  cache: Map<string, boolean>,\n): Promise<boolean> {\n  const hit = cache.get(rel);\n  if (hit !== undefined) return hit;\n  let ok: boolean;\n  try {\n    ok = carriesGuard(await readFile(join(sitePath, rel), \"utf-8\"));\n  } catch {\n    ok = false;\n  }\n  cache.set(rel, ok);\n  return ok;\n}\n\n/** The nearest guarded `+layout.server.ts` at or above `dir`, up to and\n *  including `src/routes/dev`, or null.\n *\n *  `src/routes/dev/+layout.server.ts` is the STRONGEST placement and the\n *  fleet-wide class-fix for \"dev routes ship in production\" (#717): one `load`\n *  doing `if (!dev) error(404)` runs for every `/dev/*` page, `/dev/match/[uid]`\n *  included. An earlier version read only inside `/dev/match` and so reported\n *  such a site as \"the matching twin would ship\" — untrue, and it penalised the\n *  better fix. It also contradicted the deployed half of this feature, which was\n *  deliberately redesigned to survive that class-fix: see the `/health` comment\n *  at the dev-guard step for why the 200 control moved off `/dev/a11y-fixtures`.\n *\n *  Layouts cover PAGES only. A `+server.ts` endpoint runs no layout `load` at\n *  all, which is why `matchingDisposition` checks endpoints separately and never\n *  lets a layout vouch for one (#723). */\nasync function coveringLayout(\n  sitePath: string,\n  dir: string,\n  cache: Map<string, boolean>,\n): Promise<string | null> {\n  let d = dir;\n  for (;;) {\n    const rel = `${d}/+layout.server.ts`;\n    if (await guardAt(sitePath, rel, cache)) return rel;\n    if (d === DEV_ROUTE_DIR) return null;\n    const up = d.slice(0, d.lastIndexOf(\"/\"));\n    if (up.length < DEV_ROUTE_DIR.length) return null;\n    d = up;\n  }\n}\n\n/**\n * Pre-flight: a checkout that still carries the matching twin must carry the\n * dev guard the `match-harness` recipe installs with it. Nothing is deleted at\n * launch — the harness stays for the next round — so the guard is the whole\n * mechanism keeping `/dev/match/*` off the production build.\n *\n * Filesystem only, and it runs BEFORE any GitHub write: a site that will fail\n * the deployed check should not first acquire branch protection and an audit.\n *\n * Liveness first. `src/routes` has to be there before a missing\n * `src/routes/dev/match` may be read as \"this site has no twin\" — otherwise the\n * pass is granted by an absence, and four separate operator errors produce that\n * same absence. See CHECKOUT_MARKER.\n */\nexport async function matchingDisposition(\n  sitePath: string,\n): Promise<{ ok: boolean; message: string }> {\n  if (!existsSync(join(sitePath, CHECKOUT_MARKER))) {\n    return {\n      ok: false,\n      message: `${sitePath} has no ${CHECKOUT_MARKER} — this is not a SvelteKit checkout (never cloned, a stale clone, a mistyped site name, or the wrong working directory), so the twin's disposition cannot be established`,\n    };\n  }\n  if (!existsSync(join(sitePath, MATCH_ROUTE_DIR))) {\n    return {\n      ok: true,\n      message: `no ${MATCH_ROUTE_DIR} in this checkout (${CHECKOUT_MARKER} is present, so the absence is a real one)`,\n    };\n  }\n  const files = await routeFilesUnder(sitePath, MATCH_ROUTE_DIR);\n  if (files.length === 0) {\n    return {\n      ok: false,\n      message: `${MATCH_ROUTE_DIR} exists but carries no route files (+page/+server/+layout) — the twin's disposition cannot be established`,\n    };\n  }\n\n  const cache = new Map<string, boolean>();\n  const unguarded: string[] = [];\n  const covers: string[] = [];\n\n  // Endpoints FIRST, and never covered by a layout: SvelteKit layout `load` does\n  // not run for `+server.ts`, so the #717 class-fix at src/routes/dev that\n  // legitimately covers every page leaves an endpoint fully live (#723).\n  for (const ep of files.filter((f) => f.endsWith(\"/+server.ts\"))) {\n    if (await guardAt(sitePath, ep, cache)) covers.push(ep);\n    else\n      unguarded.push(\n        `${ep} (a \\`+server.ts\\` endpoint — layout \\`load\\` does not run for it, so it needs its own guard)`,\n      );\n  }\n\n  // Then every directory holding a page, each covered by its own guarded\n  // +page.server.ts or by a +layout.server.ts at or above it.\n  const pageDirs = [\n    ...new Set(\n      files\n        .filter((f) => /\\/\\+page\\.(server\\.ts|ts|svelte)$/.test(f))\n        .map((f) => f.slice(0, f.lastIndexOf(\"/\"))),\n    ),\n  ];\n  for (const dir of pageDirs) {\n    const layout = await coveringLayout(sitePath, dir, cache);\n    if (layout) {\n      covers.push(layout);\n      continue;\n    }\n    const own = `${dir}/+page.server.ts`;\n    if (await guardAt(sitePath, own, cache)) {\n      covers.push(own);\n      continue;\n    }\n    unguarded.push(`${dir}/ (no guarded +page.server.ts and no covering +layout.server.ts)`);\n  }\n\n  if (unguarded.length > 0) {\n    return {\n      ok: false,\n      message: `${MATCH_ROUTE_DIR} is not fully guarded — ${unguarded.join(\"; \")} — an \\`if (!dev)\\` guard on \\`$app/environment\\` whose own branch refuses (\\`error(404\\` or \\`throw\\`) is required, once comments are stripped and string and regex contents masked; the matching twin would ship`,\n    };\n  }\n  // Deliberately NOT \"the twin is guarded in production\". This function reads\n  // source text on disk; it cannot observe the deployed build, and a field that\n  // can only see configuration must not be named after the thing it cannot see.\n  // The deployed behaviour is the `dev-guard` step's job.\n  return {\n    ok: true,\n    message: `every route under ${MATCH_ROUTE_DIR} is covered by dev guard source — ${[...new Set(covers)].join(\", \")} (source text only; the deployed build is checked at the dev-guard step)`,\n  };\n}\n\n/** The uids whose `/dev/match` twin must be proved dead, read from the harness's\n *  OWN page table — the file `match-harness` installs and every gate already\n *  reads — so the gate and the harness cannot disagree about which pages exist.\n *  Probing a hardcoded \"home\" left every sibling uid unprobed (#723).\n *\n *  A page whose `uid` is null has no twin (harness.mjs says so) and is skipped.\n *  An absent or unparseable harness.json falls back to \"home\": not every\n *  launched site carries the harness, so a missing file must not become a\n *  refusal — and must not yield an EMPTY list either, which would prove nothing\n *  while looking like a pass. */\nasync function twinUids(sitePath: string): Promise<string[]> {\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(await readFile(join(sitePath, HARNESS_JSON_RELATIVE), \"utf-8\"));\n  } catch {\n    return [\"home\"];\n  }\n  const pages = (parsed as { pages?: Record<string, { uid?: unknown } | null> })?.pages;\n  if (!pages || typeof pages !== \"object\") return [\"home\"];\n  const uids = Object.values(pages)\n    .map((p) => p?.uid)\n    .filter((u): u is string => typeof u === \"string\" && u.length > 0);\n  return uids.length > 0 ? [...new Set(uids)] : [\"home\"];\n}\n\n/** Undici's defaults are 300s headers + 300s body, and the body timeout is an\n *  INACTIVITY timer — so a trickling origin can hold this open for ~10 minutes,\n *  AFTER the GitHub writes and a full Lighthouse audit have already run.\n *\n *  15s is NOT the house number, and this comment used to imply it was by citing\n *  `audits/function-health.ts`, which is 10s. The 15s call sites are\n *  `audits/netlify-deploy.ts`, `github/gh-rest.ts`, `prismic/models/remote.ts`\n *  and the inline ones in `prospect/pipeline.ts` and `prospect/http-probes.ts`;\n *  `audits/function-health.ts`, `audits/form-e2e.ts`, `audits/browser.ts` and\n *  `prospect/dns.ts` are 10s, `prospect/ownership.ts` 12s, `prospect/crawl.ts`\n *  20s. Each is set for its own workload — see the note on PRISMIC_TIMEOUT_MS.\n *  15s here is a bound on a two-request pre-send check, not a convention.\n *\n *  An abort rejects, and dev-guard treats a rejection as a refusal, which is the\n *  correct reading: an origin that will not answer has proved nothing. */\nconst PROBE_TIMEOUT_MS = 15_000;\n\nconst defaultProbe = async (url: string): Promise<{ status: number; body: string }> => {\n  const res = await fetch(url, {\n    redirect: \"follow\",\n    signal: AbortSignal.timeout(PROBE_TIMEOUT_MS),\n  });\n  return { status: res.status, body: await res.text() };\n};\n\n/**\n * Launch a site: bootstrap → first-audit → DRAFT a launch email. The M3\n * approve loop is what actually sends; `launch` never sends — it stops at a\n * dashboard-queued draft (`reportType: \"Launch\"`) carrying the just-audited\n * Lighthouse scores, so `sendOne`'s `report.lighthouse` guard passes.\n *\n * EXECUTION order, stopping on the first error or `failed` recipe:\n *   0. matchingDisposition — filesystem pre-flight, BEFORE any GitHub write.\n *   1. selfUpdating — Renovate + protection (platform auto-merge OFF; ci.yml is the starter's).\n *   2. audit — the Lighthouse scores that feed the draft are collected here.\n *   3. the Websites-row lookup, which supplies the url the next step probes.\n *  3b. dev-guard — the same twin, checked against the DEPLOYED url. It sits\n *      BETWEEN collecting the scores and writing them, so a site that fails it\n *      has been audited but leaves its Websites row untouched.\n *   4. writeAuditsToAirtable — the `audit --write-airtable` writer.\n *   5. createDraft — reportType \"Launch\", today's period, the audited scores.\n *\n * The REPORTED chain is deliberately not that order. The `audit` step is only\n * pushed once its write succeeds (:261), so the emitted steps read\n * `matching-disposition -> self-updating -> dev-guard -> audit -> draft`, which\n * is what the CLI prints and what tests/recipes/launch.test.ts asserts. Do not\n * renumber either list to match the other: one says when work happens, the\n * other says what has been proved. Only step 0 precedes a GitHub write —\n * dev-guard cannot, because it needs the row from step 3 to know the url.\n */\nexport async function launch(site: Site, deps: LaunchDeps = {}): Promise<LaunchResult> {\n  const label = siteLabel(site);\n  const bootstrap = deps.bootstrap ?? selfUpdating;\n  const audit = deps.audit ?? runAudits;\n  const base = deps.base ?? openBase(readAirtableConfig());\n  const probe = deps.probe ?? defaultProbe;\n\n  const steps: Array<{ name: string; result: LaunchStepResult }> = [];\n  const stop = (): LaunchResult => ({ site: label, steps, complete: false });\n\n  // 0. Matching disposition — filesystem, before any GitHub write.\n  const disposition = await matchingDisposition(site.path);\n  steps.push({\n    name: \"matching-disposition\",\n    result: disposition.ok\n      ? { kind: \"probe\", message: disposition.message }\n      : { kind: \"error\", message: disposition.message },\n  });\n  if (!disposition.ok) return stop();\n\n  // 1. Bootstrap.\n  let recipe: RecipeResult;\n  try {\n    recipe = await bootstrap(site);\n  } catch (err) {\n    steps.push({ name: \"self-updating\", result: errorOf(err) });\n    return stop();\n  }\n  steps.push({ name: \"self-updating\", result: { kind: \"recipe\", result: recipe } });\n  if (recipe.status === \"failed\") return stop();\n\n  // 2. Audit + write scores back to Airtable.\n  let results: AuditResult[];\n  try {\n    results = await audit(site);\n  } catch (err) {\n    steps.push({ name: \"audit\", result: errorOf(err) });\n    return stop();\n  }\n  const lhResult = results.find((r) => r.audit === \"lighthouse\");\n  if (!lhResult || !hasRealScores(lhResult)) {\n    steps.push({\n      name: \"audit\",\n      result: { kind: \"error\", message: \"lighthouse audit produced no real scores\" },\n    });\n    return stop();\n  }\n  // The launch announcement renders a numeric score per category; a metric that\n  // errored this run (now null from lighthouseScoresFromResult) keeps the prior\n  // 0 behavior here rather than propagating null into the launch-email path. The\n  // Airtable write path (write-audits-to-airtable) keeps the null → shows \"—\".\n  const rawScores = lighthouseScoresFromResult(lhResult);\n  const scores: LighthouseScores = {\n    performance: rawScores.performance ?? 0,\n    accessibility: rawScores.accessibility ?? 0,\n    bestPractices: rawScores.bestPractices ?? 0,\n    seo: rawScores.seo ?? 0,\n  };\n\n  const websites = await listWebsites(base);\n  const target = websites.find((w) => siteSlug(w.name) === siteSlug(label));\n  if (!target) {\n    steps.push({\n      name: \"audit\",\n      result: { kind: \"error\", message: `no Websites row matched site \"${label}\"` },\n    });\n    return stop();\n  }\n\n  // 2b. The dev guard, on the DEPLOYED build. Two halves, both required:\n  //     /dev/match/home must 404 WITH this site's own error page, and /health\n  //     must answer 200. Without the second, a dead host, a wrong url and a\n  //     parked domain all \"pass\" the first — an absent error granting a green,\n  //     which is the one shape this fleet does not allow. Reading the deployed\n  //     url makes this a production-build check by construction; no local build\n  //     can substitute.\n  //\n  //     The control is /health, NOT a /dev/* route. It used to be\n  //     /dev/a11y-fixtures, which made this gate require an unguarded dev page\n  //     to be publicly reachable in production — so the obvious class-fix for\n  //     \"dev routes ship in production\" (one src/routes/dev/+layout.server.ts\n  //     doing `if (!dev) error(404)`) would have taken the control down with it\n  //     and failed every correctly-guarded site. /health is a real production\n  //     endpoint shipped by the starter and present in all 23 starter-derived\n  //     repos, each declaring `prerender = false` — so a 200 from it is still a\n  //     live render/function path, not a static file served by the CDN.\n  const origin = target.url.replace(/\\/+$/, \"\");\n  const uids = await twinUids(site.path);\n  const twins: Array<{ uid: string; res: { status: number; body: string } }> = [];\n  let control: { status: number; body: string };\n  try {\n    for (const uid of uids) twins.push({ uid, res: await probe(`${origin}/dev/match/${uid}`) });\n    control = await probe(`${origin}/health`);\n  } catch (err) {\n    steps.push({ name: \"dev-guard\", result: errorOf(err) });\n    return stop();\n  }\n  if (control.status !== 200) {\n    steps.push({\n      name: \"dev-guard\",\n      result: {\n        kind: \"error\",\n        message: `${origin}/health answered ${control.status}, not 200 — the twin's 404 proves nothing (host down, wrong url, or the site's /health function is not deploying, in which case the function-health audit is failing too)`,\n      },\n    });\n    return stop();\n  }\n  for (const { uid, res } of twins) {\n    const unguardedTell = res.body.match(UNGUARDED_TWIN_MARKER);\n    if (unguardedTell) {\n      steps.push({\n        name: \"dev-guard\",\n        result: {\n          kind: \"error\",\n          message: `${origin}/dev/match/${uid} answered ${res.status} carrying the twin route's OWN \"${unguardedTell[0]}\" message — the twin is LIVE and merely has no assembly for the uid \"${uid}\". That is not evidence of a dev guard.`,\n        },\n      });\n      return stop();\n    }\n    if (res.status !== 404 || !SITE_404_MARKER.test(res.body)) {\n      steps.push({\n        name: \"dev-guard\",\n        result: {\n          kind: \"error\",\n          message:\n            res.status === 404\n              ? `${origin}/dev/match/${uid} 404s, but not with this site's own error page — cannot tell the guard from a dead route`\n              : `${origin}/dev/match/${uid} answered ${res.status} — the matching twin is live in production`,\n        },\n      });\n      return stop();\n    }\n  }\n  steps.push({\n    name: \"dev-guard\",\n    result: {\n      kind: \"probe\",\n      message: `${uids.map((u) => `${origin}/dev/match/${u}`).join(\", \")} 404 (site error page), /health 200`,\n    },\n  });\n\n  try {\n    const auditWrite = await writeAuditsToAirtable({\n      base,\n      websites,\n      slug: siteSlug(target.name),\n      results,\n    });\n    // #539 Phase 5: mirror the first-audit write-back. Launch is the ONE path\n    // that writes a brand-new site's health, so without this its row reads empty\n    // in the console until the next hourly sync.\n    if (auditWrite.siteId && auditWrite.fields) {\n      await deps.siteMirror?.health(auditWrite.siteId, auditWrite.fields);\n    }\n  } catch (err) {\n    steps.push({ name: \"audit\", result: errorOf(err) });\n    return stop();\n  }\n  steps.push({ name: \"audit\", result: { kind: \"audit\", results, scores } });\n\n  // 3. Draft the launch email (reuses draft.ts's reportId/period scheme). DRAFTS\n  //    ONLY — the M3 approve loop sends it and flips Status on send.\n  const today = new Date();\n  const period = today.toISOString().slice(0, 7);\n  const slug = siteSlug(target.name);\n\n  let report: ReportRow;\n  try {\n    // Re-run dedupe: reuse an existing Launch row for this (site, period) instead\n    // of stacking a second draft. findReportByPeriod is the same idempotency\n    // lookup draft.ts documents (dashboard/digest point lookup).\n    const existing = await findReportByPeriod(base, target.id, \"Launch\", period);\n    if (existing) {\n      // Reuse path: the row was created on a prior run with THAT run's scores. This\n      // re-run just produced fresh audit scores AND will re-render the preview from\n      // them — so refresh the row's Lighthouse cells (+ Completed on) to match,\n      // otherwise the sent email (which reads the row) ships stale scores. The\n      // create path already writes fresh scores via createDraft.\n      await updateReportScores(base, existing.id, scores, today);\n      // Mirror the same refresh — see the announce reuse path for why.\n      await deps.reportMirror?.patch(existing.id, {\n        lighthouse_performance: scores.performance,\n        lighthouse_accessibility: scores.accessibility,\n        lighthouse_best_practices: scores.bestPractices,\n        lighthouse_seo: scores.seo,\n        completed_on: today.toISOString().slice(0, 10),\n      });\n      report = existing;\n    } else {\n      report = await createDraft(\n        base,\n        draftInputFor(target, scores, today, period),\n        deps.reportMirror?.created,\n      );\n    }\n  } catch (err) {\n    steps.push({ name: \"draft\", result: errorOf(err) });\n    return stop();\n  }\n\n  // Mirror draft.ts:135-154 — render → upload \"Rendered HTML\" preview → flip\n  // Draft ready. Without setDraftReady the draft never enters the approve queue\n  // (every pending-approval gate requires draftReady true), so it can never be\n  // approved or sent. The upload is a review convenience; the ready flag is the\n  // critical step.\n  try {\n    const { html } = await renderReportHtml({\n      siteName: target.name,\n      siteUrl: target.url,\n      reportType: \"Launch\",\n      completedOn: today,\n      lighthouse: scores,\n      lastTestedDate: null,\n      commentary: null,\n      copy: resolveCopy(target),\n      headerImageCid: `${slug}-header`,\n    });\n    // A preview-upload hiccup must NOT fail the launch — log and continue.\n    try {\n      await uploadAttachment(\n        report.id,\n        \"Rendered HTML\",\n        html,\n        `${slug}-${today.toISOString().slice(0, 10)}.html`,\n        \"text/html\",\n      );\n      // The console preview reads the body from Turso, not the attachment.\n      await deps.reportMirror?.body(report.id, html);\n    } catch (uploadErr) {\n      console.warn(\n        `⚠ Launch preview upload skipped for ${target.name}: ${\n          uploadErr instanceof Error ? uploadErr.message : String(uploadErr)\n        }`,\n      );\n    }\n    // Critical: NOT wrapped — a failure here must surface as a failed launch. queueDraft\n    // supersedes any lower-tier (Maintenance/Testing) drafts queued for this site; a Launch is\n    // top tier so it only stands down if another Launch/Announcement is already queued.\n    await queueDraft(\n      base,\n      { id: report.id, siteId: target.id, reportType: \"Launch\" },\n      deps.reportMirror,\n    );\n  } catch (err) {\n    steps.push({ name: \"draft\", result: errorOf(err) });\n    return stop();\n  }\n\n  steps.push({ name: \"draft\", result: { kind: \"draft\", report } });\n\n  return { site: label, steps, complete: true };\n}\n\n/** Build the Launch `DraftInput`. reportId/period mirror `draftReportForSite`\n *  (draft.ts) — do not invent a new id scheme. `today`/`period` are threaded in\n *  from `launch()` so a single timestamp drives the render, the draft, the\n *  dedupe lookup, and the preview filename. Launch reports have no period window\n *  and no prior maintenance test, so periodStart/periodEnd/completedOn all\n *  collapse to \"today\" and `lastTestedDate` is null. */\nfunction draftInputFor(\n  target: WebsiteRow,\n  scores: LighthouseScores,\n  today: Date,\n  period: string,\n): Parameters<typeof createDraft>[1] {\n  const reportType = \"Launch\" as const;\n  const reportId = `${target.name} — ${reportType} — ${today.toISOString().slice(0, 10)}`;\n  return {\n    reportId,\n    siteId: target.id,\n    reportType,\n    period,\n    periodStart: today,\n    periodEnd: today,\n    completedOn: today,\n    lighthouse: scores,\n    lastTestedDate: null,\n  };\n}\n\nfunction errorOf(err: unknown): LaunchStepResult {\n  return { kind: \"error\", message: err instanceof Error ? err.message : String(err) };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,eAAe;;;ACAxB,SAAS,kBAAkB;AAC3B,SAAS,UAAU,eAAe;AAClC,SAAS,YAAY;AAoErB,IAAM,kBAAkB;AAwBjB,IAAM,wBAAwB,IAAI;AAAA,EACvC,GAAG,oBAAoB,QAAQ,uBAAuB,MAAM,CAAC;AAAA,EAC7D;AACF;AAEA,IAAM,kBAAkB;AASxB,IAAM,kBAAkB;AAYxB,IAAM,kBAAkB;AACxB,IAAM,iBAAiB,oBAAI,IAAI;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,SAAS,WAAW,UAAkB,UAA2B;AAC/D,MAAI,aAAa,GAAI,QAAO;AAC5B,MAAI,gBAAgB,KAAK,QAAQ,EAAG,QAAO;AAC3C,SAAO,eAAe,IAAI,QAAQ;AACpC;AAMA,SAAS,SAAS,KAA6C;AAC7D,MAAI,IAAI,IAAI,SAAS;AACrB,SAAO,KAAK,KAAK,KAAK,KAAK,IAAI,CAAC,CAAE,EAAG;AACrC,MAAI,IAAI,EAAG,QAAO,EAAE,MAAM,IAAI,MAAM,GAAG;AACvC,MAAI,IAAI;AACR,SAAO,KAAK,KAAK,gBAAgB,KAAK,IAAI,CAAC,CAAE,EAAG;AAChD,SAAO,EAAE,MAAM,IAAI,CAAC,GAAI,MAAM,IAAI,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;AACxD;AAOA,SAAS,gBAAgB,QAAgB,IAAoB;AAC3D,MAAI,UAAU;AACd,WAAS,IAAI,KAAK,GAAG,IAAI,OAAO,QAAQ,KAAK;AAC3C,UAAM,IAAI,OAAO,CAAC;AAClB,QAAI,MAAM,MAAM;AACd;AACA;AAAA,IACF;AACA,QAAI,MAAM,KAAM,QAAO;AACvB,QAAI,SAAS;AACX,UAAI,MAAM,IAAK,WAAU;AACzB;AAAA,IACF;AACA,QAAI,MAAM,KAAK;AACb,gBAAU;AACV;AAAA,IACF;AACA,QAAI,MAAM,IAAK,QAAO;AAAA,EACxB;AACA,SAAO;AACT;AAcA,SAAS,cAAc,QAAwB;AAC7C,MAAI,MAAM;AACV,WAAS,IAAI,GAAG,IAAI,OAAO,UAAS;AAClC,UAAM,KAAK,OAAO,CAAC;AACnB,UAAM,OAAO,OAAO,IAAI,CAAC;AACzB,QAAI,OAAO,OAAO,SAAS,KAAK;AAC9B,aAAO,IAAI,OAAO,UAAU,OAAO,CAAC,MAAM,KAAM;AAChD;AAAA,IACF;AACA,QAAI,OAAO,OAAO,SAAS,KAAK;AAC9B,WAAK;AACL,aAAO,IAAI,OAAO,UAAU,EAAE,OAAO,CAAC,MAAM,OAAO,OAAO,IAAI,CAAC,MAAM,KAAM;AAC3E,WAAK;AACL;AAAA,IACF;AACA,QAAI,OAAO,KAAK;AACd,YAAM,EAAE,MAAM,KAAK,IAAI,SAAS,GAAG;AACnC,UAAI,WAAW,MAAM,IAAI,GAAG;AAC1B,cAAM,MAAM,gBAAgB,QAAQ,CAAC;AACrC,YAAI,QAAQ,IAAI;AACd,iBAAO,OAAO,MAAM,GAAG,MAAM,CAAC;AAC9B,cAAI,MAAM;AACV;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,OAAO,OAAO,OAAO,OAAO,KAAK;AAC1C,aAAO;AACP;AACA,aAAO,IAAI,OAAO,QAAQ;AACxB,YAAI,OAAO,CAAC,MAAM,MAAM;AACtB,iBAAO,OAAO,MAAM,GAAG,IAAI,CAAC;AAC5B,eAAK;AACL;AAAA,QACF;AACA,eAAO,OAAO,CAAC;AACf;AACA,YAAI,OAAO,IAAI,CAAC,MAAM,GAAI;AAAA,MAC5B;AACA;AAAA,IACF;AACA,WAAO;AACP;AAAA,EACF;AACA,SAAO;AACT;AAaA,SAAS,aAAa,MAAsB;AAC1C,MAAI,MAAM;AACV,WAAS,IAAI,GAAG,IAAI,KAAK,UAAS;AAChC,UAAM,KAAK,KAAK,CAAC;AACjB,QAAI,OAAO,KAAK;AACd,YAAM,EAAE,MAAM,KAAK,IAAI,SAAS,GAAG;AACnC,UAAI,WAAW,MAAM,IAAI,GAAG;AAC1B,cAAM,MAAM,gBAAgB,MAAM,CAAC;AACnC,YAAI,QAAQ,IAAI;AAEd,iBAAO,MAAM,IAAI,OAAO,MAAM,IAAI,CAAC,IAAI;AACvC,cAAI,MAAM;AACV;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,OAAO,OAAO,OAAO,OAAO,KAAK;AAC1C,aAAO;AACP;AACA;AAAA,IACF;AACA,WAAO;AACP;AACA,WAAO,IAAI,KAAK,QAAQ;AACtB,YAAM,IAAI,KAAK,CAAC;AAChB,UAAI,MAAM,MAAM;AACd,eAAO;AACP,aAAK;AACL;AAAA,MACF;AACA;AACA,UAAI,MAAM,IAAI;AACZ,eAAO;AACP;AAAA,MACF;AACA,aAAO,MAAM,OAAO,OAAO;AAAA,IAC7B;AAAA,EACF;AACA,SAAO;AACT;AAQA,SAAS,aAAa,MAAc,MAAsB;AACxD,MAAI,IAAI;AACR,SAAO,IAAI,KAAK,UAAU,KAAK,KAAK,KAAK,CAAC,CAAE,EAAG;AAC/C,QAAM,QAAQ;AACd,MAAI,KAAK,CAAC,MAAM,KAAK;AACnB,QAAIA,SAAQ;AACZ,WAAO,IAAI,KAAK,QAAQ,KAAK;AAC3B,UAAI,KAAK,CAAC,MAAM,IAAK,CAAAA;AAAA,eACZ,KAAK,CAAC,MAAM,OAAO,EAAEA,WAAU,EAAG,QAAO,KAAK,MAAM,OAAO,IAAI,CAAC;AAAA,IAC3E;AACA,WAAO,KAAK,MAAM,KAAK;AAAA,EACzB;AACA,MAAI,QAAQ;AACZ,SAAO,IAAI,KAAK,QAAQ,KAAK;AAC3B,UAAM,KAAK,KAAK,CAAC;AACjB,QAAI,OAAO,OAAO,OAAO,OAAO,OAAO,IAAK;AAAA,aACnC,OAAO,OAAO,OAAO,OAAO,OAAO,KAAK;AAC/C,UAAI,UAAU,EAAG,QAAO,KAAK,MAAM,OAAO,CAAC;AAC3C;AAAA,IACF,WAAW,UAAU,MAAM,OAAO,OAAO,OAAO,MAAO,QAAO,KAAK,MAAM,OAAO,CAAC;AAAA,EACnF;AACA,SAAO,KAAK,MAAM,KAAK;AACzB;AAGA,IAAM,UAAU;AAiBhB,SAAS,aAAa,QAAyB;AAC7C,QAAM,OAAO,cAAc,MAAM;AACjC,MAAI,CAAC,KAAK,SAAS,kBAAkB,EAAG,QAAO;AAC/C,QAAM,SAAS,aAAa,IAAI;AAChC,QAAM,SAAS;AACf,WAAS,IAAI,OAAO,KAAK,MAAM,GAAG,GAAG,IAAI,OAAO,KAAK,MAAM,GAAG;AAC5D,QAAI,QAAQ,KAAK,aAAa,QAAQ,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,CAAC,EAAG,QAAO;AAAA,EACxE;AACA,SAAO;AACT;AAEA,IAAM,gBAAgB;AAOtB,eAAe,gBAAgB,UAAkB,QAAmC;AAClF,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,QAAQ,KAAK,UAAU,MAAM,GAAG,EAAE,eAAe,KAAK,CAAC;AAAA,EACzE,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACA,QAAM,MAAgB,CAAC;AACvB,aAAW,KAAK,SAAS;AACvB,UAAM,MAAM,GAAG,MAAM,IAAI,EAAE,IAAI;AAC/B,QAAI,EAAE,YAAY,EAAG,KAAI,KAAK,GAAI,MAAM,gBAAgB,UAAU,GAAG,CAAE;AAAA,aAC9D,EAAE,KAAK,WAAW,GAAG,EAAG,KAAI,KAAK,GAAG;AAAA,EAC/C;AACA,SAAO;AACT;AAIA,eAAe,QACb,UACA,KACA,OACkB;AAClB,QAAM,MAAM,MAAM,IAAI,GAAG;AACzB,MAAI,QAAQ,OAAW,QAAO;AAC9B,MAAI;AACJ,MAAI;AACF,SAAK,aAAa,MAAM,SAAS,KAAK,UAAU,GAAG,GAAG,OAAO,CAAC;AAAA,EAChE,QAAQ;AACN,SAAK;AAAA,EACP;AACA,QAAM,IAAI,KAAK,EAAE;AACjB,SAAO;AACT;AAiBA,eAAe,eACb,UACA,KACA,OACwB;AACxB,MAAI,IAAI;AACR,aAAS;AACP,UAAM,MAAM,GAAG,CAAC;AAChB,QAAI,MAAM,QAAQ,UAAU,KAAK,KAAK,EAAG,QAAO;AAChD,QAAI,MAAM,cAAe,QAAO;AAChC,UAAM,KAAK,EAAE,MAAM,GAAG,EAAE,YAAY,GAAG,CAAC;AACxC,QAAI,GAAG,SAAS,cAAc,OAAQ,QAAO;AAC7C,QAAI;AAAA,EACN;AACF;AAgBA,eAAsB,oBACpB,UAC2C;AAC3C,MAAI,CAAC,WAAW,KAAK,UAAU,eAAe,CAAC,GAAG;AAChD,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,SAAS,GAAG,QAAQ,WAAW,eAAe;AAAA,IAChD;AAAA,EACF;AACA,MAAI,CAAC,WAAW,KAAK,UAAU,eAAe,CAAC,GAAG;AAChD,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,SAAS,MAAM,eAAe,sBAAsB,eAAe;AAAA,IACrE;AAAA,EACF;AACA,QAAM,QAAQ,MAAM,gBAAgB,UAAU,eAAe;AAC7D,MAAI,MAAM,WAAW,GAAG;AACtB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,SAAS,GAAG,eAAe;AAAA,IAC7B;AAAA,EACF;AAEA,QAAM,QAAQ,oBAAI,IAAqB;AACvC,QAAM,YAAsB,CAAC;AAC7B,QAAM,SAAmB,CAAC;AAK1B,aAAW,MAAM,MAAM,OAAO,CAAC,MAAM,EAAE,SAAS,aAAa,CAAC,GAAG;AAC/D,QAAI,MAAM,QAAQ,UAAU,IAAI,KAAK,EAAG,QAAO,KAAK,EAAE;AAAA;AAEpD,gBAAU;AAAA,QACR,GAAG,EAAE;AAAA,MACP;AAAA,EACJ;AAIA,QAAM,WAAW;AAAA,IACf,GAAG,IAAI;AAAA,MACL,MACG,OAAO,CAAC,MAAM,oCAAoC,KAAK,CAAC,CAAC,EACzD,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,EAAE,YAAY,GAAG,CAAC,CAAC;AAAA,IAC9C;AAAA,EACF;AACA,aAAW,OAAO,UAAU;AAC1B,UAAM,SAAS,MAAM,eAAe,UAAU,KAAK,KAAK;AACxD,QAAI,QAAQ;AACV,aAAO,KAAK,MAAM;AAClB;AAAA,IACF;AACA,UAAM,MAAM,GAAG,GAAG;AAClB,QAAI,MAAM,QAAQ,UAAU,KAAK,KAAK,GAAG;AACvC,aAAO,KAAK,GAAG;AACf;AAAA,IACF;AACA,cAAU,KAAK,GAAG,GAAG,kEAAkE;AAAA,EACzF;AAEA,MAAI,UAAU,SAAS,GAAG;AACxB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,SAAS,GAAG,eAAe,gCAA2B,UAAU,KAAK,IAAI,CAAC;AAAA,IAC5E;AAAA,EACF;AAKA,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,SAAS,qBAAqB,eAAe,0CAAqC,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI,CAAC;AAAA,EACnH;AACF;AAYA,eAAe,SAAS,UAAqC;AAC3D,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,MAAM,SAAS,KAAK,UAAU,qBAAqB,GAAG,OAAO,CAAC;AAAA,EACpF,QAAQ;AACN,WAAO,CAAC,MAAM;AAAA,EAChB;AACA,QAAM,QAAS,QAAiE;AAChF,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO,CAAC,MAAM;AACvD,QAAM,OAAO,OAAO,OAAO,KAAK,EAC7B,IAAI,CAAC,MAAM,GAAG,GAAG,EACjB,OAAO,CAAC,MAAmB,OAAO,MAAM,YAAY,EAAE,SAAS,CAAC;AACnE,SAAO,KAAK,SAAS,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM;AACvD;AAiBA,IAAM,mBAAmB;AAEzB,IAAM,eAAe,OAAO,QAA2D;AACrF,QAAM,MAAM,MAAM,MAAM,KAAK;AAAA,IAC3B,UAAU;AAAA,IACV,QAAQ,YAAY,QAAQ,gBAAgB;AAAA,EAC9C,CAAC;AACD,SAAO,EAAE,QAAQ,IAAI,QAAQ,MAAM,MAAM,IAAI,KAAK,EAAE;AACtD;AA2BA,eAAsB,OAAO,MAAY,OAAmB,CAAC,GAA0B;AACrF,QAAM,QAAQ,UAAU,IAAI;AAC5B,QAAM,YAAY,KAAK,aAAa;AACpC,QAAM,QAAQ,KAAK,SAAS;AAC5B,QAAM,OAAO,KAAK,QAAQ,SAAS,mBAAmB,CAAC;AACvD,QAAM,QAAQ,KAAK,SAAS;AAE5B,QAAM,QAA2D,CAAC;AAClE,QAAM,OAAO,OAAqB,EAAE,MAAM,OAAO,OAAO,UAAU,MAAM;AAGxE,QAAM,cAAc,MAAM,oBAAoB,KAAK,IAAI;AACvD,QAAM,KAAK;AAAA,IACT,MAAM;AAAA,IACN,QAAQ,YAAY,KAChB,EAAE,MAAM,SAAS,SAAS,YAAY,QAAQ,IAC9C,EAAE,MAAM,SAAS,SAAS,YAAY,QAAQ;AAAA,EACpD,CAAC;AACD,MAAI,CAAC,YAAY,GAAI,QAAO,KAAK;AAGjC,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,UAAU,IAAI;AAAA,EAC/B,SAAS,KAAK;AACZ,UAAM,KAAK,EAAE,MAAM,iBAAiB,QAAQ,QAAQ,GAAG,EAAE,CAAC;AAC1D,WAAO,KAAK;AAAA,EACd;AACA,QAAM,KAAK,EAAE,MAAM,iBAAiB,QAAQ,EAAE,MAAM,UAAU,QAAQ,OAAO,EAAE,CAAC;AAChF,MAAI,OAAO,WAAW,SAAU,QAAO,KAAK;AAG5C,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,MAAM,IAAI;AAAA,EAC5B,SAAS,KAAK;AACZ,UAAM,KAAK,EAAE,MAAM,SAAS,QAAQ,QAAQ,GAAG,EAAE,CAAC;AAClD,WAAO,KAAK;AAAA,EACd;AACA,QAAM,WAAW,QAAQ,KAAK,CAAC,MAAM,EAAE,UAAU,YAAY;AAC7D,MAAI,CAAC,YAAY,CAAC,cAAc,QAAQ,GAAG;AACzC,UAAM,KAAK;AAAA,MACT,MAAM;AAAA,MACN,QAAQ,EAAE,MAAM,SAAS,SAAS,2CAA2C;AAAA,IAC/E,CAAC;AACD,WAAO,KAAK;AAAA,EACd;AAKA,QAAM,YAAY,2BAA2B,QAAQ;AACrD,QAAM,SAA2B;AAAA,IAC/B,aAAa,UAAU,eAAe;AAAA,IACtC,eAAe,UAAU,iBAAiB;AAAA,IAC1C,eAAe,UAAU,iBAAiB;AAAA,IAC1C,KAAK,UAAU,OAAO;AAAA,EACxB;AAEA,QAAM,WAAW,MAAM,aAAa,IAAI;AACxC,QAAM,SAAS,SAAS,KAAK,CAAC,MAAM,SAAS,EAAE,IAAI,MAAM,SAAS,KAAK,CAAC;AACxE,MAAI,CAAC,QAAQ;AACX,UAAM,KAAK;AAAA,MACT,MAAM;AAAA,MACN,QAAQ,EAAE,MAAM,SAAS,SAAS,iCAAiC,KAAK,IAAI;AAAA,IAC9E,CAAC;AACD,WAAO,KAAK;AAAA,EACd;AAmBA,QAAM,SAAS,OAAO,IAAI,QAAQ,QAAQ,EAAE;AAC5C,QAAM,OAAO,MAAM,SAAS,KAAK,IAAI;AACrC,QAAM,QAAuE,CAAC;AAC9E,MAAI;AACJ,MAAI;AACF,eAAW,OAAO,KAAM,OAAM,KAAK,EAAE,KAAK,KAAK,MAAM,MAAM,GAAG,MAAM,cAAc,GAAG,EAAE,EAAE,CAAC;AAC1F,cAAU,MAAM,MAAM,GAAG,MAAM,SAAS;AAAA,EAC1C,SAAS,KAAK;AACZ,UAAM,KAAK,EAAE,MAAM,aAAa,QAAQ,QAAQ,GAAG,EAAE,CAAC;AACtD,WAAO,KAAK;AAAA,EACd;AACA,MAAI,QAAQ,WAAW,KAAK;AAC1B,UAAM,KAAK;AAAA,MACT,MAAM;AAAA,MACN,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,SAAS,GAAG,MAAM,oBAAoB,QAAQ,MAAM;AAAA,MACtD;AAAA,IACF,CAAC;AACD,WAAO,KAAK;AAAA,EACd;AACA,aAAW,EAAE,KAAK,IAAI,KAAK,OAAO;AAChC,UAAM,gBAAgB,IAAI,KAAK,MAAM,qBAAqB;AAC1D,QAAI,eAAe;AACjB,YAAM,KAAK;AAAA,QACT,MAAM;AAAA,QACN,QAAQ;AAAA,UACN,MAAM;AAAA,UACN,SAAS,GAAG,MAAM,cAAc,GAAG,aAAa,IAAI,MAAM,mCAAmC,cAAc,CAAC,CAAC,6EAAwE,GAAG;AAAA,QAC1L;AAAA,MACF,CAAC;AACD,aAAO,KAAK;AAAA,IACd;AACA,QAAI,IAAI,WAAW,OAAO,CAAC,gBAAgB,KAAK,IAAI,IAAI,GAAG;AACzD,YAAM,KAAK;AAAA,QACT,MAAM;AAAA,QACN,QAAQ;AAAA,UACN,MAAM;AAAA,UACN,SACE,IAAI,WAAW,MACX,GAAG,MAAM,cAAc,GAAG,kGAC1B,GAAG,MAAM,cAAc,GAAG,aAAa,IAAI,MAAM;AAAA,QACzD;AAAA,MACF,CAAC;AACD,aAAO,KAAK;AAAA,IACd;AAAA,EACF;AACA,QAAM,KAAK;AAAA,IACT,MAAM;AAAA,IACN,QAAQ;AAAA,MACN,MAAM;AAAA,MACN,SAAS,GAAG,KAAK,IAAI,CAAC,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,KAAK,IAAI,CAAC;AAAA,IACpE;AAAA,EACF,CAAC;AAED,MAAI;AACF,UAAM,aAAa,MAAM,sBAAsB;AAAA,MAC7C;AAAA,MACA;AAAA,MACA,MAAM,SAAS,OAAO,IAAI;AAAA,MAC1B;AAAA,IACF,CAAC;AAID,QAAI,WAAW,UAAU,WAAW,QAAQ;AAC1C,YAAM,KAAK,YAAY,OAAO,WAAW,QAAQ,WAAW,MAAM;AAAA,IACpE;AAAA,EACF,SAAS,KAAK;AACZ,UAAM,KAAK,EAAE,MAAM,SAAS,QAAQ,QAAQ,GAAG,EAAE,CAAC;AAClD,WAAO,KAAK;AAAA,EACd;AACA,QAAM,KAAK,EAAE,MAAM,SAAS,QAAQ,EAAE,MAAM,SAAS,SAAS,OAAO,EAAE,CAAC;AAIxE,QAAM,QAAQ,oBAAI,KAAK;AACvB,QAAM,SAAS,MAAM,YAAY,EAAE,MAAM,GAAG,CAAC;AAC7C,QAAM,OAAO,SAAS,OAAO,IAAI;AAEjC,MAAI;AACJ,MAAI;AAIF,UAAM,WAAW,MAAM,mBAAmB,MAAM,OAAO,IAAI,UAAU,MAAM;AAC3E,QAAI,UAAU;AAMZ,YAAM,mBAAmB,MAAM,SAAS,IAAI,QAAQ,KAAK;AAEzD,YAAM,KAAK,cAAc,MAAM,SAAS,IAAI;AAAA,QAC1C,wBAAwB,OAAO;AAAA,QAC/B,0BAA0B,OAAO;AAAA,QACjC,2BAA2B,OAAO;AAAA,QAClC,gBAAgB,OAAO;AAAA,QACvB,cAAc,MAAM,YAAY,EAAE,MAAM,GAAG,EAAE;AAAA,MAC/C,CAAC;AACD,eAAS;AAAA,IACX,OAAO;AACL,eAAS,MAAM;AAAA,QACb;AAAA,QACA,cAAc,QAAQ,QAAQ,OAAO,MAAM;AAAA,QAC3C,KAAK,cAAc;AAAA,MACrB;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AACZ,UAAM,KAAK,EAAE,MAAM,SAAS,QAAQ,QAAQ,GAAG,EAAE,CAAC;AAClD,WAAO,KAAK;AAAA,EACd;AAOA,MAAI;AACF,UAAM,EAAE,KAAK,IAAI,MAAM,iBAAiB;AAAA,MACtC,UAAU,OAAO;AAAA,MACjB,SAAS,OAAO;AAAA,MAChB,YAAY;AAAA,MACZ,aAAa;AAAA,MACb,YAAY;AAAA,MACZ,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,MAAM,YAAY,MAAM;AAAA,MACxB,gBAAgB,GAAG,IAAI;AAAA,IACzB,CAAC;AAED,QAAI;AACF,YAAM;AAAA,QACJ,OAAO;AAAA,QACP;AAAA,QACA;AAAA,QACA,GAAG,IAAI,IAAI,MAAM,YAAY,EAAE,MAAM,GAAG,EAAE,CAAC;AAAA,QAC3C;AAAA,MACF;AAEA,YAAM,KAAK,cAAc,KAAK,OAAO,IAAI,IAAI;AAAA,IAC/C,SAAS,WAAW;AAClB,cAAQ;AAAA,QACN,4CAAuC,OAAO,IAAI,KAChD,qBAAqB,QAAQ,UAAU,UAAU,OAAO,SAAS,CACnE;AAAA,MACF;AAAA,IACF;AAIA,UAAM;AAAA,MACJ;AAAA,MACA,EAAE,IAAI,OAAO,IAAI,QAAQ,OAAO,IAAI,YAAY,SAAS;AAAA,MACzD,KAAK;AAAA,IACP;AAAA,EACF,SAAS,KAAK;AACZ,UAAM,KAAK,EAAE,MAAM,SAAS,QAAQ,QAAQ,GAAG,EAAE,CAAC;AAClD,WAAO,KAAK;AAAA,EACd;AAEA,QAAM,KAAK,EAAE,MAAM,SAAS,QAAQ,EAAE,MAAM,SAAS,OAAO,EAAE,CAAC;AAE/D,SAAO,EAAE,MAAM,OAAO,OAAO,UAAU,KAAK;AAC9C;AAQA,SAAS,cACP,QACA,QACA,OACA,QACmC;AACnC,QAAM,aAAa;AACnB,QAAM,WAAW,GAAG,OAAO,IAAI,WAAM,UAAU,WAAM,MAAM,YAAY,EAAE,MAAM,GAAG,EAAE,CAAC;AACrF,SAAO;AAAA,IACL;AAAA,IACA,QAAQ,OAAO;AAAA,IACf;AAAA,IACA;AAAA,IACA,aAAa;AAAA,IACb,WAAW;AAAA,IACX,aAAa;AAAA,IACb,YAAY;AAAA,IACZ,gBAAgB;AAAA,EAClB;AACF;AAEA,SAAS,QAAQ,KAAgC;AAC/C,SAAO,EAAE,MAAM,SAAS,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,EAAE;AACpF;;;ADl2BO,SAAS,WAAW,MAAc,GAA6B;AACpE,MAAI,EAAE,SAAS,QAAS,QAAO,GAAG,KAAK,OAAO,EAAE,CAAC,WAAW,EAAE,OAAO;AACrE,MAAI,EAAE,SAAS,SAAS;AACtB,UAAM,IAAI,EAAE;AACZ,WAAO,GAAG,KAAK,OAAO,EAAE,CAAC,eAAe,EAAE,WAAW,MAAM,EAAE,aAAa,OAAO,EAAE,aAAa,QAAQ,EAAE,GAAG;AAAA,EAC/G;AACA,MAAI,EAAE,SAAS,SAAS;AACtB,WAAO,GAAG,KAAK,OAAO,EAAE,CAAC,YAAY,EAAE,OAAO,QAAQ;AAAA,EACxD;AACA,MAAI,EAAE,SAAS,QAAS,QAAO,GAAG,KAAK,OAAO,EAAE,CAAC,cAAS,EAAE,OAAO;AACnE,QAAM,MAAM,EAAE;AACd,MAAI,IAAI,WAAW,OAAQ,QAAO,GAAG,KAAK,OAAO,EAAE,CAAC,QAAQ,IAAI,QAAQ,WAAM,IAAI,KAAK,KAAK,EAAE;AAC9F,MAAI,IAAI,WAAW;AACjB,WAAO,GAAG,KAAK,OAAO,EAAE,CAAC,UAAU,IAAI,QAAQ,WAAM,IAAI,KAAK,KAAK,EAAE;AACvE,SAAO,GAAG,KAAK,OAAO,EAAE,CAAC,aAAa,IAAI,QAAQ,MAAM,UAAU,IAAI,QAAQ,WAAW,IAAI,KAAK,GAAG,IAAI,IAAI,QAAQ,WAAM,IAAI,KAAK,KAAK,EAAE;AAC7I;AAEA,SAAS,aAAa,GAAyB;AAC7C,QAAM,SAAS,IAAI,EAAE,IAAI,mBAAc,EAAE,WAAW,gCAAgC,SAAS;AAC7F,QAAM,OAAO,EAAE,MAAM,IAAI,CAAC,MAAM,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,KAAK,IAAI;AACvE,SAAO,GAAG,MAAM;AAAA,EAAK,IAAI;AAC3B;AAQA,eAAsB,iBACpB,MACA,MAC2C;AAC3C,QAAM,MAAM,KAAK,MAAM,QAAQ,KAAK,GAAG,IAAI,QAAQ,IAAI;AACvD,QAAM,QAAQ,MAAM,aAAa,EAAE,MAAM,IAAI,CAAC;AAC9C,QAAM,SAAS,MAAM,CAAC;AACtB,MAAI,CAAC,QAAQ;AACX,WAAO,EAAE,QAAQ,yBAAyB,IAAI,MAAM,MAAM,EAAE;AAAA,EAC9D;AAIA,QAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,6BAAgC;AAC1E,QAAM,EAAE,eAAe,IAAI,MAAM,OAAO,2BAAyB;AACjE,QAAM,SAAS,MAAM,OAAO,QAAQ;AAAA,IAClC,cAAc,MAAM,iBAAiB;AAAA,IACrC,YAAY,MAAM,eAAe;AAAA,EACnC,CAAC;AACD,SAAO,EAAE,QAAQ,aAAa,MAAM,GAAG,MAAM,OAAO,WAAW,IAAI,EAAE;AACvE;","names":["depth"]}

package/dist/lighthouse-airtable-3NOFB42B.js

@@ -1,12 +0,0 @@
-import {
-  hasRealScores,
-  lighthouseScoresFromResult,
-  resolveSlugFromCwd
-} from "./chunk-37B4LVB3.js";
-import "./chunk-KN52PM63.js";
-export {
-  hasRealScores,
-  lighthouseScoresFromResult,
-  resolveSlugFromCwd
-};
-//# sourceMappingURL=lighthouse-airtable-3NOFB42B.js.map

package/dist/match-harness-OW45CB5H.js

@@ -1,77 +0,0 @@
-import {
-  runRecipeOverSites
-} from "./chunk-VPJ7N6P7.js";
-import {
-  appendSkipNotice,
-  fleetWorkdir,
-  prepareFleetSites
-} from "./chunk-SHGIDTYF.js";
-import {
-  resolveSites
-} from "./chunk-H445EH33.js";
-import {
-  matchHarness
-} from "./chunk-IHHAYXKY.js";
-import "./chunk-Y6FCXRIC.js";
-import "./chunk-5CJVUPJU.js";
-import "./chunk-SQ4FSNYL.js";
-import "./chunk-Z3JXLULD.js";
-import "./chunk-LBYOLBW7.js";
-import "./chunk-RARREDQE.js";
-import "./chunk-XXTZBPUY.js";
-import "./chunk-EASYCD6F.js";
-
-// src/cli/commands/match-harness.ts
-import { resolve } from "path";
-function formatResult(r) {
-  if (r.status === "noop") return `[${r.site}] noop: ${r.notes ?? ""}`;
-  if (r.status === "failed") return `[${r.site}] failed: ${r.notes ?? ""}`;
-  return `[${r.site}] applied: ${r.commits.length} commit(s)
-${r.notes ?? ""}`;
-}
-async function runMatchHarnessCommand(site, opts) {
-  const cwd = opts.cwd ? resolve(opts.cwd) : process.cwd();
-  let sites = await resolveSites({
-    ...site !== void 0 ? { site } : {},
-    ...opts.fleet !== void 0 ? { fleet: opts.fleet } : {},
-    ...opts.workdir !== void 0 ? { workdir: opts.workdir } : {},
-    cwd
-  });
-  if (sites.length === 0) {
-    return {
-      output: `the inventory resolved NO SITES, so the matching harness was installed nowhere. This is not an installed fleet \u2014 check the inventory (an Airtable view filter, an empty JSON file, a dynamic inventory returning []). Do NOT read this exit as a rollout.`,
-      code: 1
-    };
-  }
-  let skipped = [];
-  if (opts.fleet) {
-    const workdir = opts.workdir ?? fleetWorkdir();
-    const prep = await prepareFleetSites(sites, { workdir });
-    sites = prep.prepared;
-    skipped = prep.skipped;
-  }
-  const rawMatrix = opts.matrix === void 0 ? void 0 : String(opts.matrix);
-  const matrix = rawMatrix === void 0 ? void 0 : rawMatrix.split(",").map((v) => Number(v.trim()));
-  if (matrix !== void 0 && matrix.some((v) => !Number.isFinite(v) || v <= 0)) {
-    return {
-      output: `match-harness: --matrix "${rawMatrix}" is not a list of viewports`,
-      code: 1
-    };
-  }
-  const results = await runRecipeOverSites(
-    "match-harness",
-    sites,
-    (s) => matchHarness(s, {
-      ref: opts.ref ?? "",
-      ...opts.cand !== void 0 ? { cand: opts.cand } : {},
-      ...matrix !== void 0 ? { matrix } : {}
-    })
-  );
-  const output = results.map(formatResult).join("\n");
-  const code = results.some((r) => r.status === "failed") ? 1 : 0;
-  return { output: appendSkipNotice(output, skipped), code };
-}
-export {
-  runMatchHarnessCommand
-};
-//# sourceMappingURL=match-harness-OW45CB5H.js.map

package/dist/match-harness-OW45CB5H.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/cli/commands/match-harness.ts"],"sourcesContent":["import { resolve } from \"node:path\";\nimport { matchHarness } from \"../../recipes/match-harness/index.js\";\nimport type { RecipeResult } from \"../../types.js\";\nimport { resolveSites } from \"../fleet/resolve-sites.js\";\nimport { prepareFleetSites, appendSkipNotice, type SkippedSite } from \"../fleet/prepare-sites.js\";\nimport { runRecipeOverSites } from \"../fleet/run-recipe-over-sites.js\";\nimport { fleetWorkdir } from \"../../util/fleet-workdir.js\";\n\nexport type MatchHarnessCommandOptions = {\n  ref?: string;\n  cand?: string;\n  /** cac type-coerces a numeric option value, so this arrives as a NUMBER for\n   *  `--matrix 1440` and a string only when it contains a comma or a letter. */\n  matrix?: string | number;\n  fleet?: string;\n  workdir?: string;\n  cwd?: string;\n};\n\nfunction formatResult(r: RecipeResult): string {\n  if (r.status === \"noop\") return `[${r.site}] noop: ${r.notes ?? \"\"}`;\n  if (r.status === \"failed\") return `[${r.site}] failed: ${r.notes ?? \"\"}`;\n  return `[${r.site}] applied: ${r.commits.length} commit(s)\\n${r.notes ?? \"\"}`;\n}\n\nexport async function runMatchHarnessCommand(\n  site: string | undefined,\n  opts: MatchHarnessCommandOptions,\n): Promise<{ output: string; code: number }> {\n  const cwd = opts.cwd ? resolve(opts.cwd) : process.cwd();\n\n  let sites = await resolveSites({\n    ...(site !== undefined ? { site } : {}),\n    ...(opts.fleet !== undefined ? { fleet: opts.fleet } : {}),\n    ...(opts.workdir !== undefined ? { workdir: opts.workdir } : {}),\n    cwd,\n  });\n\n  // NOTHING RESOLVED IS NOT AN INSTALLED FLEET — the same refusal\n  // `prismic-ci` opens with, for the same reason. `runRecipeOverSites` over an\n  // empty list joins zero rows into the empty string and this command returned\n  // it with code 0: a blank line and a success exit, which is indistinguishable\n  // from \"every site already had the harness\". Measured on this branch before\n  // the fix, `match-harness --ref … --fleet <inventory naming nobody>` printed\n  // one empty line and exited 0.\n  //\n  // An Airtable view filter, an empty JSON file, or a dynamic inventory\n  // returning [] all produce exactly that, and none of them is a run.\n  if (sites.length === 0) {\n    return {\n      output:\n        `the inventory resolved NO SITES, so the matching harness was installed nowhere.` +\n        ` This is not an installed fleet — check the inventory (an Airtable view filter, an` +\n        ` empty JSON file, a dynamic inventory returning []). Do NOT read this exit as a` +\n        ` rollout.`,\n      code: 1,\n    };\n  }\n\n  let skipped: SkippedSite[] = [];\n  if (opts.fleet) {\n    const workdir = opts.workdir ?? fleetWorkdir();\n    const prep = await prepareFleetSites(sites, { workdir });\n    sites = prep.prepared;\n    skipped = prep.skipped;\n  }\n\n  // A bad --matrix must not silently become [NaN]: the matrix is the gate's\n  // denominator, and a NaN viewport would produce a score nobody could read.\n  //\n  // Two things force the shape below. cac COERCES a numeric option value, so\n  // `--matrix 1440` arrives as the number 1440 (`.split` would throw) and\n  // `--matrix 0` as the number 0 — which is FALSY, so a truthiness test drops it\n  // and the recipe silently applies the default [1440,834,390] and exits 0. So:\n  // normalise to a string, and branch on PRESENCE, never on truthiness.\n  const rawMatrix = opts.matrix === undefined ? undefined : String(opts.matrix);\n  const matrix =\n    rawMatrix === undefined ? undefined : rawMatrix.split(\",\").map((v) => Number(v.trim()));\n  if (matrix !== undefined && matrix.some((v) => !Number.isFinite(v) || v <= 0)) {\n    return {\n      output: `match-harness: --matrix \"${rawMatrix}\" is not a list of viewports`,\n      code: 1,\n    };\n  }\n\n  const results = await runRecipeOverSites(\"match-harness\", sites, (s) =>\n    matchHarness(s, {\n      ref: opts.ref ?? \"\",\n      ...(opts.cand !== undefined ? { cand: opts.cand } : {}),\n      ...(matrix !== undefined ? { matrix } : {}),\n    }),\n  );\n\n  const output = results.map(formatResult).join(\"\\n\");\n  const code = results.some((r) => r.status === \"failed\") ? 1 : 0;\n  return { output: appendSkipNotice(output, skipped), code };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,eAAe;AAmBxB,SAAS,aAAa,GAAyB;AAC7C,MAAI,EAAE,WAAW,OAAQ,QAAO,IAAI,EAAE,IAAI,WAAW,EAAE,SAAS,EAAE;AAClE,MAAI,EAAE,WAAW,SAAU,QAAO,IAAI,EAAE,IAAI,aAAa,EAAE,SAAS,EAAE;AACtE,SAAO,IAAI,EAAE,IAAI,cAAc,EAAE,QAAQ,MAAM;AAAA,EAAe,EAAE,SAAS,EAAE;AAC7E;AAEA,eAAsB,uBACpB,MACA,MAC2C;AAC3C,QAAM,MAAM,KAAK,MAAM,QAAQ,KAAK,GAAG,IAAI,QAAQ,IAAI;AAEvD,MAAI,QAAQ,MAAM,aAAa;AAAA,IAC7B,GAAI,SAAS,SAAY,EAAE,KAAK,IAAI,CAAC;AAAA,IACrC,GAAI,KAAK,UAAU,SAAY,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAAA,IACxD,GAAI,KAAK,YAAY,SAAY,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,IAC9D;AAAA,EACF,CAAC;AAYD,MAAI,MAAM,WAAW,GAAG;AACtB,WAAO;AAAA,MACL,QACE;AAAA,MAIF,MAAM;AAAA,IACR;AAAA,EACF;AAEA,MAAI,UAAyB,CAAC;AAC9B,MAAI,KAAK,OAAO;AACd,UAAM,UAAU,KAAK,WAAW,aAAa;AAC7C,UAAM,OAAO,MAAM,kBAAkB,OAAO,EAAE,QAAQ,CAAC;AACvD,YAAQ,KAAK;AACb,cAAU,KAAK;AAAA,EACjB;AAUA,QAAM,YAAY,KAAK,WAAW,SAAY,SAAY,OAAO,KAAK,MAAM;AAC5E,QAAM,SACJ,cAAc,SAAY,SAAY,UAAU,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,OAAO,EAAE,KAAK,CAAC,CAAC;AACxF,MAAI,WAAW,UAAa,OAAO,KAAK,CAAC,MAAM,CAAC,OAAO,SAAS,CAAC,KAAK,KAAK,CAAC,GAAG;AAC7E,WAAO;AAAA,MACL,QAAQ,4BAA4B,SAAS;AAAA,MAC7C,MAAM;AAAA,IACR;AAAA,EACF;AAEA,QAAM,UAAU,MAAM;AAAA,IAAmB;AAAA,IAAiB;AAAA,IAAO,CAAC,MAChE,aAAa,GAAG;AAAA,MACd,KAAK,KAAK,OAAO;AAAA,MACjB,GAAI,KAAK,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,MACrD,GAAI,WAAW,SAAY,EAAE,OAAO,IAAI,CAAC;AAAA,IAC3C,CAAC;AAAA,EACH;AAEA,QAAM,SAAS,QAAQ,IAAI,YAAY,EAAE,KAAK,IAAI;AAClD,QAAM,OAAO,QAAQ,KAAK,CAAC,MAAM,EAAE,WAAW,QAAQ,IAAI,IAAI;AAC9D,SAAO,EAAE,QAAQ,iBAAiB,QAAQ,OAAO,GAAG,KAAK;AAC3D;","names":[]}

package/dist/migrate-NE3DUMTM.js

@@ -1,7 +0,0 @@
-import {
-  runMigrations
-} from "./chunk-T76MA2FH.js";
-export {
-  runMigrations
-};
-//# sourceMappingURL=migrate-NE3DUMTM.js.map

package/dist/parity-AEKYSLN6.js

@@ -1,14 +0,0 @@
-import {
-  checkFleetParity,
-  formatParityResult
-} from "./chunk-D3CTOCUR.js";
-import "./chunk-GEUC5VGM.js";
-import "./chunk-UIITN37J.js";
-import "./chunk-F3JWOPTG.js";
-import "./chunk-VAD43MOR.js";
-import "./chunk-KN52PM63.js";
-export {
-  checkFleetParity,
-  formatParityResult
-};
-//# sourceMappingURL=parity-AEKYSLN6.js.map

package/dist/preflight-POZZI3GN.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/cli/commands/preflight.ts"],"sourcesContent":["import {\n  preflight,\n  type PreflightSiteResult,\n  type PreflightFinding,\n} from \"../../reports/preflight.js\";\nimport type { ReportType } from \"../../reports/types.js\";\n\nexport type PreflightCommandOptions = {\n  type?: string;\n  all?: boolean;\n  cwd?: string;\n};\n\nconst TYPES: Record<string, ReportType> = {\n  announcement: \"Announcement\",\n  maintenance: \"Maintenance\",\n  testing: \"Testing\",\n};\n\nconst MARK: Record<PreflightFinding[\"level\"], string> = { fail: \"✗\", warn: \"⚠\", info: \"ℹ\" };\n\nfunction formatSite(r: PreflightSiteResult): string {\n  if (r.findings.length === 0) return `[${r.site}] ✓ clean`;\n  return r.findings.map((f) => `[${r.site}] ${MARK[f.level]} ${f.check}: ${f.message}`).join(\"\\n\");\n}\n\n/**\n * `preflight [site]` — read-only pre-send checks over the live Airtable rows: everything\n * that would make a report send fail, reach the wrong inbox, or surprise the operator.\n * Exit 0 = safe (warnings allowed, printed), 1 = at least one hard failure, 2 = bad args.\n */\nexport async function runPreflightCommand(\n  site: string | undefined,\n  opts: PreflightCommandOptions,\n): Promise<{ output: string; code: number }> {\n  if (Boolean(site) === Boolean(opts.all)) {\n    return { output: \"Provide exactly one of <site> or --all.\", code: 2 };\n  }\n  const typeKey = (opts.type ?? \"announcement\").toLowerCase();\n  const type = TYPES[typeKey];\n  if (!type) {\n    return {\n      output: `Unknown --type '${opts.type}'. Supported: ${Object.keys(TYPES).join(\", \")}`,\n      code: 2,\n    };\n  }\n\n  try {\n    const { results, fleet } = await preflight({\n      ...(site ? { site } : {}),\n      ...(opts.all ? { all: true } : {}),\n      type,\n    });\n    if (results.length === 0) return { output: \"No matching sites.\", code: 1 };\n\n    const lines = results.map(formatSite);\n    for (const f of fleet) lines.push(`[fleet] ${MARK[f.level]} ${f.check}: ${f.message}`);\n\n    const all = [...results.flatMap((r) => r.findings), ...fleet];\n    const fails = all.filter((f) => f.level === \"fail\").length;\n    const warns = all.filter((f) => f.level === \"warn\").length;\n    lines.push(\n      `Preflight: ${results.length} site(s) — ${fails} fail, ${warns} warn. ${\n        fails > 0 ? \"NOT safe to send.\" : \"Safe to send (review warnings).\"\n      }`,\n    );\n    return { output: lines.join(\"\\n\"), code: fails > 0 ? 1 : 0 };\n  } catch (err) {\n    const e = err as { message?: string; exitCode?: number };\n    return { output: e.message ?? String(err), code: e.exitCode ?? 1 };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAaA,IAAM,QAAoC;AAAA,EACxC,cAAc;AAAA,EACd,aAAa;AAAA,EACb,SAAS;AACX;AAEA,IAAM,OAAkD,EAAE,MAAM,UAAK,MAAM,UAAK,MAAM,SAAI;AAE1F,SAAS,WAAW,GAAgC;AAClD,MAAI,EAAE,SAAS,WAAW,EAAG,QAAO,IAAI,EAAE,IAAI;AAC9C,SAAO,EAAE,SAAS,IAAI,CAAC,MAAM,IAAI,EAAE,IAAI,KAAK,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,OAAO,EAAE,EAAE,KAAK,IAAI;AACjG;AAOA,eAAsB,oBACpB,MACA,MAC2C;AAC3C,MAAI,QAAQ,IAAI,MAAM,QAAQ,KAAK,GAAG,GAAG;AACvC,WAAO,EAAE,QAAQ,2CAA2C,MAAM,EAAE;AAAA,EACtE;AACA,QAAM,WAAW,KAAK,QAAQ,gBAAgB,YAAY;AAC1D,QAAM,OAAO,MAAM,OAAO;AAC1B,MAAI,CAAC,MAAM;AACT,WAAO;AAAA,MACL,QAAQ,mBAAmB,KAAK,IAAI,iBAAiB,OAAO,KAAK,KAAK,EAAE,KAAK,IAAI,CAAC;AAAA,MAClF,MAAM;AAAA,IACR;AAAA,EACF;AAEA,MAAI;AACF,UAAM,EAAE,SAAS,MAAM,IAAI,MAAM,UAAU;AAAA,MACzC,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,MACvB,GAAI,KAAK,MAAM,EAAE,KAAK,KAAK,IAAI,CAAC;AAAA,MAChC;AAAA,IACF,CAAC;AACD,QAAI,QAAQ,WAAW,EAAG,QAAO,EAAE,QAAQ,sBAAsB,MAAM,EAAE;AAEzE,UAAM,QAAQ,QAAQ,IAAI,UAAU;AACpC,eAAW,KAAK,MAAO,OAAM,KAAK,WAAW,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,OAAO,EAAE;AAErF,UAAM,MAAM,CAAC,GAAG,QAAQ,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,GAAG,KAAK;AAC5D,UAAM,QAAQ,IAAI,OAAO,CAAC,MAAM,EAAE,UAAU,MAAM,EAAE;AACpD,UAAM,QAAQ,IAAI,OAAO,CAAC,MAAM,EAAE,UAAU,MAAM,EAAE;AACpD,UAAM;AAAA,MACJ,cAAc,QAAQ,MAAM,mBAAc,KAAK,UAAU,KAAK,UAC5D,QAAQ,IAAI,sBAAsB,iCACpC;AAAA,IACF;AACA,WAAO,EAAE,QAAQ,MAAM,KAAK,IAAI,GAAG,MAAM,QAAQ,IAAI,IAAI,EAAE;AAAA,EAC7D,SAAS,KAAK;AACZ,UAAM,IAAI;AACV,WAAO,EAAE,QAAQ,EAAE,WAAW,OAAO,GAAG,GAAG,MAAM,EAAE,YAAY,EAAE;AAAA,EACnE;AACF;","names":[]}

package/dist/prismic-ci-AHY5ULJR.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/cli/commands/prismic-ci.ts","../src/recipes/prismic-ci/index.ts","../src/recipes/prismic-ci/template.ts","../src/recipes/prismic-ci/cli-version.ts"],"sourcesContent":["// The fleet face of the `prismic-ci` recipe: land the Prismic model delivery\n// workflow across the fleet, as ONE PULL REQUEST PER REPOSITORY.\n//\n// The blast radius is fifteen live client repositories, and the failure this\n// file is written against is not a bad PR — the recipe's gates handle that, and\n// nothing here can push to a client's main. It is the QUIET one: a run that\n// touched nothing and exited 0, read as a finished rollout. Three facts only the\n// fleet layer can get wrong produce it, and each has a refusal below:\n//\n//   - an inventory that resolved NOBODY prints \"0 applied, 0 noop, 0 failed.\"\n//     and exits 0, which is indistinguishable from a fleet with nothing left to\n//     do. The Airtable inventory is view-filtered; one filter change empties it\n//     with no error anywhere.\n//   - a site that could not be PREPARED is isolated into `skipped` by\n//     `prepareFleetSites` (correctly — one bad row must not abort the fleet) and\n//     then disappears from a summary built out of `prepared` alone. It gets a\n//     `failed` ROW, because the count is the only thing a machine reads.\n//   - a checkout holding `.git` and nothing else answers \"not a Prismic site\" to\n//     every read inside it, so the site noops out of the rollout for good — a\n//     fleet workdir reuses any non-empty directory forever. Guarded BEFORE the\n//     recipe runs: a tree nobody established is not a tree to branch from.\n//\n// SEQUENTIAL, one site at a time, like every other fleet recipe command — see\n// `runRecipeOverSites`. Each site does git work in its own checkout plus a\n// handful of GitHub calls; there is no Airtable write on this path (so the\n// fleet's ≤4.5 req/s throttle does not apply) and nothing parallelism would buy\n// except a burst of writes against fifteen repositories at once.\nimport { readdir } from \"node:fs/promises\";\nimport { resolve } from \"node:path\";\nimport { prismicCi } from \"../../recipes/prismic-ci/index.js\";\nimport {\n  REUSABLE_WORKFLOW_PIN,\n  isPinResolved,\n  type ReusableWorkflowPin,\n} from \"../../recipes/prismic-ci/template.js\";\nimport type { RecipeResult, Site } from \"../../types.js\";\nimport { fleetWorkdir } from \"../../util/fleet-workdir.js\";\nimport { siteLabel } from \"../../util/site.js\";\nimport { noWorkingTreeFailure } from \"../../util/working-tree.js\";\nimport { appendSkipNotice, prepareFleetSites, type SkippedSite } from \"../fleet/prepare-sites.js\";\nimport { resolveSites } from \"../fleet/resolve-sites.js\";\nimport { runRecipeOverSites } from \"../fleet/run-recipe-over-sites.js\";\n\nexport type PrismicCiCommandOptions = {\n  fleet?: string;\n  workdir?: string;\n  dry?: boolean;\n  cwd?: string;\n};\n\n/** Injected only by tests, so the fleet layer's aggregation — counts, exit code,\n *  refusals — is exercised without git, GitHub or a network. Production runs the\n *  real recipe. */\nexport type PrismicCiCommandDeps = {\n  runRecipe?: (site: Site) => Promise<RecipeResult>;\n  /**\n   * Which `reddoorla/.github` commit this run would pin. Injected only by tests;\n   * production uses the shipped {@link REUSABLE_WORKFLOW_PIN}.\n   *\n   * It is injectable because the unresolved-pin refusal is a SAFETY behaviour\n   * that must be tested in both directions at all times, and a test that reads\n   * the shipped constant can only ever exercise whichever direction the constant\n   * currently happens to be in. Two tests here did exactly that, and the release\n   * that resolved the pin turned them from \"the refusal works\" into a red suite\n   * with the refusal itself no longer covered by anything.\n   */\n  pin?: ReusableWorkflowPin;\n};\n\nconst messageOf = (err: unknown): string => (err instanceof Error ? err.message : String(err));\n\nconst failedRow = (site: string, notes: string): RecipeResult => ({\n  recipe: \"prismic-ci\",\n  site,\n  status: \"failed\",\n  commits: [],\n  notes,\n});\n\n/**\n * One line per site plus a counts summary — the shape every fleet rollout\n * prints, so a sweep over fifteen repos is scannable.\n *\n * The banner above the counts is not decoration. A rollout in which every site\n * failed prints fifteen `[site] failed:` lines and then an arithmetic exercise;\n * the one fact an operator needs from that run — NOT ONE repository got the\n * workflow — has to be stated. It is keyed on \"sites were attempted and none was\n * applied\", not on \"nothing was applied\": a fleet that is already fully\n * delivered applies nothing every time it runs, and a banner that shouts at that\n * run is a banner nobody reads at the run above.\n */\nexport function formatPrismicCiResults(results: RecipeResult[]): string {\n  const lines = results.map((r) => `[${r.site}] ${r.status}: ${r.notes ?? \"\"}`.trimEnd());\n  const n = (s: RecipeResult[\"status\"]) => results.filter((r) => r.status === s).length;\n  const failed = n(\"failed\");\n  lines.push(\"\");\n  if (failed > 0 && n(\"applied\") === 0) {\n    lines.push(\n      `⛔ NO SITE GOT THE DELIVERY WORKFLOW. ${failed} of ${results.length} site(s) failed and` +\n        ` not one pull request was opened, so no site's model changes reach Prismic on merge.` +\n        ` Do NOT read this run as a rollout.`,\n    );\n    lines.push(\"\");\n  }\n  lines.push(`${n(\"applied\")} applied, ${n(\"noop\")} noop, ${failed} failed.`);\n  return lines.join(\"\\n\");\n}\n\n/**\n * Is there a checkout here at all, or the named reason there is not?\n *\n * Runs BEFORE the recipe, for both the reason in {@link noWorkingTreeFailure}\n * and one this command adds: the recipe's next steps create a branch, write a\n * file and commit it. A directory nobody managed to check out is not a tree to\n * do that in, and the answer the recipe would otherwise reach — \"not a Prismic\n * site\" — is the one answer that quietly removes the site from the rollout.\n *\n * A `readdir` that THROWS is its own failure and never the skip: a path that\n * does not exist, or one this process cannot read, is not a repo without\n * Prismic in it.\n */\nasync function checkoutFailure(repoRoot: string): Promise<string | null> {\n  let entries: string[];\n  try {\n    entries = await readdir(repoRoot);\n  } catch (e) {\n    return `cannot read this checkout at ${repoRoot}: ${messageOf(e)}`;\n  }\n  return noWorkingTreeFailure(\n    repoRoot,\n    entries,\n    \"No delivery workflow was proposed for it and no pull request was opened\",\n  );\n}\n\n/**\n * Roll the delivery workflow out to one site or to the fleet.\n *\n * `resolveSites` is allowed to THROW (a positional site alongside `--fleet`, an\n * unsupported inventory extension, an Airtable read that failed). Those are \"the\n * fleet itself could not be established\", which has no per-site row to live in\n * and must not be reported as a rollout across zero sites; `bin.ts` prints the\n * message and exits with the error's own `exitCode`.\n */\nexport async function runPrismicCiCommand(\n  site: string | undefined,\n  opts: PrismicCiCommandOptions,\n  deps: PrismicCiCommandDeps = {},\n): Promise<{ output: string; code: number }> {\n  const cwd = opts.cwd ? resolve(opts.cwd) : process.cwd();\n  let sites = await resolveSites({\n    ...(site !== undefined ? { site } : {}),\n    ...(opts.fleet !== undefined ? { fleet: opts.fleet } : {}),\n    // Passed through because `--fleet airtable` derives each site's path from\n    // it; without it the keyword inventory would resolve paths under a different\n    // workdir than the one this run then prepares and commits in.\n    ...(opts.workdir !== undefined ? { workdir: opts.workdir } : {}),\n    cwd,\n  });\n\n  // NOTHING RESOLVED IS NOT A DELIVERED FLEET — the refusal `runFleetSweep` and\n  // the token doctor both open with, for the same reason: the summary below\n  // would print \"0 applied, 0 noop, 0 failed.\" over no rows at all and exit 0,\n  // which is exactly what a finished rollout looks like.\n  if (sites.length === 0) {\n    return {\n      output:\n        `the inventory resolved NO SITES, so no site was offered the delivery workflow.` +\n        ` This is not a delivered fleet — check the inventory (an Airtable view filter, an` +\n        ` empty JSON file, a dynamic inventory returning []). Do NOT read this exit as a` +\n        ` rollout.`,\n      code: 1,\n    };\n  }\n\n  let skipped: SkippedSite[] = [];\n  if (opts.fleet) {\n    const prep = await prepareFleetSites(sites, { workdir: opts.workdir ?? fleetWorkdir() });\n    sites = prep.prepared;\n    skipped = prep.skipped;\n  }\n\n  // THE PIN, checked here as well as in the recipe — not a second copy of the\n  // gate but the same exported predicate on the same pin, asked at the one point\n  // the recipe cannot answer for: a `--dry` run never reaches the recipe at all,\n  // and a preview that promised fifteen pull requests the real run would refuse\n  // is a preview of something that cannot happen.\n  //\n  // ONE pin object serves both this preview and the recipe below, so the preview\n  // can never be answering about a different pin than the run it previews.\n  const pin = deps.pin ?? REUSABLE_WORKFLOW_PIN;\n  const pinUnresolved = !isPinResolved(pin)\n    ? `⛔ the reusable-workflow pin is unresolved (${pin.sha}) — every site` +\n      ` below would be REFUSED, not delivered. Publish and tag the workflow in` +\n      ` reddoorla/.github, then set REUSABLE_WORKFLOW_PIN.`\n    : \"\";\n\n  if (opts.dry) {\n    const lines = sites.map(\n      (s) =>\n        `[${siteLabel(s)}] would be offered the delivery workflow (no gate was evaluated:` +\n        ` the secret, default-branch and already-delivered checks run only on a real run)`,\n    );\n    return {\n      output: appendSkipNotice(\n        [pinUnresolved, lines.join(\"\\n\")].filter((s) => s !== \"\").join(\"\\n\\n\"),\n        skipped,\n      ),\n      code: pinUnresolved === \"\" ? 0 : 1,\n    };\n  }\n\n  const run = deps.runRecipe ?? ((s: Site) => prismicCi(s, { pin }));\n  const results = await runRecipeOverSites(\"prismic-ci\", sites, async (s) => {\n    const failure = await checkoutFailure(s.path);\n    return failure ? failedRow(siteLabel(s), failure) : run(s);\n  });\n\n  // A SITE THAT COULD NOT BE PREPARED IS A SITE THAT DID NOT GET THE WORKFLOW,\n  // and it gets a row. `prepareFleetSites` isolates the clone failure into\n  // `skipped`, which is right and is also exactly how a site disappears: a\n  // summary walking `prepared` alone counts a fleet-wide clone outage — an\n  // expired App token, GitHub down, a full disk — as \"0 applied, 0 failed\",\n  // exit 0. The notice below stays; the row is what makes the site countable.\n  for (const s of skipped) {\n    results.push(\n      failedRow(\n        s.site,\n        `could not prepare this checkout: ${s.reason}. No delivery workflow was proposed` +\n          ` for it — this is NOT \"this site already has one\".`,\n      ),\n    );\n  }\n\n  return {\n    output: appendSkipNotice(formatPrismicCiResults(results), skipped),\n    code: results.some((r) => r.status === \"failed\") ? 1 : 0,\n  };\n}\n","import { mkdir, readFile, writeFile } from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\nimport { defaultSpawn, type SpawnFn } from \"../../audits/util/spawn.js\";\nimport { readGitHubConfig } from \"../../github/config.js\";\nimport { makeGitHub, type GitHub } from \"../../github/gh.js\";\nimport { readPrismicConfig } from \"../../prismic/models/index.js\";\nimport type { RecipeResult, Site } from \"../../types.js\";\nimport {\n  branchName,\n  checkoutBranch,\n  commit as gitCommit,\n  createBranch,\n  currentBranch,\n  deleteBranch,\n  getRemoteUrl,\n  isWorkingTreeClean,\n  push as gitPush,\n  resolveOwnerRepo,\n  sameOwnerRepo,\n} from \"../../util/git.js\";\nimport { siteLabel } from \"../../util/site.js\";\nimport { formatWithPrettier, resolveTargetPrettier, PRETTIER_FLAG_NOTE } from \"../_prettier.js\";\nimport { refusedByGit, undoRefusedWrites, RESTORED_NOTE } from \"../_head-guard.js\";\nimport {\n  APPLY_BRANCH,\n  PRISMIC_CI_WORKFLOW,\n  REUSABLE_WORKFLOW_PIN,\n  SECRET,\n  WORKFLOW_PATH,\n  isPinResolved,\n  prismicCiWorkflow,\n  type ReusableWorkflowPin,\n} from \"./template.js\";\nimport { MIN_CLI_VERSION, atLeast, readLockedCliVersion } from \"./cli-version.js\";\n\n/** Head-branch prefix of every PR this recipe opens. `branchName(\"prismic-ci\")`\n *  produces `maint/prismic-ci-<timestamp>`, and the re-run guard matches on this\n *  prefix — the same idiom as `findOpenSelfUpdatingPR`. */\nconst BRANCH_PREFIX = \"maint/prismic-ci-\";\n\n/** How long the target's prettier gets. Also what makes the fleet's default\n *  spawn detach the child, so the kill reaches prettier and not just a wrapper.\n *  Matches the pull-down path's budget in `src/prismic/models/write.ts`. */\nconst PRETTIER_TIMEOUT_MS = 60_000;\n\n/** Just the GitHub surface this recipe touches, so a test fake is five methods\n *  rather than thirty. `makeGitHub()` satisfies it structurally. */\nexport type PrismicCiGitHub = Pick<\n  GitHub,\n  \"defaultBranch\" | \"secretExists\" | \"fileContentsOnBranch\" | \"openPullRequest\" | \"openPullRequests\"\n>;\n\nexport type PrismicCiDeps = {\n  github?: PrismicCiGitHub;\n  pushBranch?: (cwd: string, branch: string) => Promise<void>;\n  spawn?: SpawnFn;\n  /** Resolve the TARGET repo's own prettier. Injected so a test can assert the\n   *  absolute-path spawn without a populated `node_modules`. */\n  resolvePrettier?: (repoRoot: string) => Promise<string | null>;\n  /** Which `reddoorla/.github` commit the written workflow pins. Injected only\n   *  by tests; production uses the shipped pin. */\n  pin?: ReusableWorkflowPin;\n};\n\nconst resultOf = (\n  site: Site,\n  status: RecipeResult[\"status\"],\n  notes: string,\n  commits: string[] = [],\n): RecipeResult => ({\n  recipe: \"prismic-ci\",\n  site: siteLabel(site),\n  status,\n  commits,\n  notes,\n});\n\nconst messageOf = (err: unknown): string => (err instanceof Error ? err.message : String(err));\n\n/** Same normalization as `self-updating`'s config comparison: CRLF and a stray\n *  trailing newline are not drift, and treating them as drift opens a needless\n *  PR on every run. Any real content difference still differs. */\nfunction sameWorkflow(current: string, canonical: string): boolean {\n  const norm = (s: string) => s.replace(/\\r\\n/g, \"\\n\").replace(/\\s+$/, \"\");\n  return norm(current) === norm(canonical);\n}\n\n/**\n * Land the Prismic model delivery workflow in one repo, as a pull request.\n *\n * Everything before the first mutation is a gate, and the gates exist because\n * this recipe's output is the only path in the project that writes to a live\n * client's Prismic repository. Two of them are worth naming:\n *\n *  - THE SECRET. A workflow whose `PRISMIC_WRITE_TOKEN` does not exist yet goes\n *    red on the repo's first model PR. Landing 15 of those turns a rollout into\n *    15 red repos, so a definitively-absent secret FAILS the site rather than\n *    nooping it: \"this site was skipped and a human must act\" is not the same\n *    report as \"this site was already done\", and a rollout summary where those\n *    two look alike is how a site silently never gets model delivery. A secret\n *    whose existence could not be DETERMINED fails too, with different wording —\n *    they are different facts and the operator's next move differs.\n *\n *  - THE DEFAULT BRANCH. The reusable workflow's apply job hard-codes\n *    `refs/heads/main`. On a repo whose default branch is anything else, every\n *    model PR would merge green and never reach Prismic. Refuse instead.\n *\n * Nothing here can delete a model: the workflow it installs calls a module that\n * exports no delete path.\n */\nexport async function prismicCi(site: Site, deps: PrismicCiDeps = {}): Promise<RecipeResult> {\n  // 1. Repo identity — from Airtable's 'Git repo' or, on a positional run, the\n  //    checkout's origin. `failed`, not `noop`: a rollout that silently skips a site\n  //    is the failure this whole recipe is guarding against one level up. The\n  //    strict shape check runs BEFORE the first `gh` call, so a typo'd or\n  //    attacker-controlled value can never be interpolated into an API path.\n  let repo: string | null;\n  try {\n    repo = await resolveOwnerRepo(site);\n  } catch (err) {\n    // A malformed identity aborts before any `gh` write — surfaced as a recipe\n    // failure rather than being interpolated into an API path.\n    return resultOf(site, \"failed\", `could not resolve the repo identity: ${messageOf(err)}`);\n  }\n  if (!repo) {\n    return resultOf(\n      site,\n      \"failed\",\n      \"could not determine a GitHub repo for this site — set Airtable 'Git repo', or give \" +\n        \"the checkout an origin remote whose URL is a GitHub owner/repo\",\n    );\n  }\n\n  // 1b. The two identities must agree (#713). `gitPush` goes to the CHECKOUT's\n  //     origin; `openPullRequest` goes to `repo`, which Airtable's 'Git repo'\n  //     wins when set. When they name different repositories the branch lands\n  //     in one and the PR is filed in the other with a head that does not\n  //     exist there — a 422, but only AFTER a real push into a client repo,\n  //     which the `finally` restore below does not undo. A stale cell after a\n  //     rename, a fork as origin, a row copy-pasted from another client: all\n  //     operator-data problems, so refuse before the first write rather than\n  //     guess which side is right. A checkout with NO origin is left alone —\n  //     the push itself will fail there, before anything reaches GitHub.\n  if (site.gitRepo) {\n    let originUrl: string | null;\n    try {\n      originUrl = await getRemoteUrl(site.path);\n    } catch {\n      originUrl = null;\n    }\n    if (originUrl !== null && !sameOwnerRepo(repo, originUrl)) {\n      return resultOf(\n        site,\n        \"failed\",\n        `'Git repo' ${repo} does not match the checkout's origin ${originUrl} — refusing to ` +\n          \"push into one repo and open the PR in another; fix the Airtable cell or the remote\",\n      );\n    }\n  }\n\n  // 2. Is this a Prismic site? `readPrismicConfig` returns null for \"no Prismic\n  //    here\" and THROWS for a present-but-unreadable config — the distinction is\n  //    the point, so the throw becomes `failed` rather than being caught into\n  //    the skip branch.\n  let isPrismic: boolean;\n  try {\n    isPrismic = (await readPrismicConfig(site.path)) !== null;\n  } catch (err) {\n    return resultOf(site, \"failed\", `could not read the Prismic config: ${messageOf(err)}`);\n  }\n  if (!isPrismic) return resultOf(site, \"noop\", \"not a Prismic site (no repositoryName) — skipped\");\n\n  // 3. The pin. Checked before any network call: while it is unresolved NOTHING\n  //    can roll out, and 15 pointless API round-trips are not worth spending to\n  //    find that out per site.\n  const pin = deps.pin ?? REUSABLE_WORKFLOW_PIN;\n  if (!isPinResolved(pin)) {\n    return resultOf(\n      site,\n      \"failed\",\n      `reusable-workflow pin is unresolved (${pin.sha}) — publish + tag the workflow in ` +\n        `reddoorla/.github and set REUSABLE_WORKFLOW_PIN before rolling out`,\n    );\n  }\n  const workflow = pin === REUSABLE_WORKFLOW_PIN ? PRISMIC_CI_WORKFLOW : prismicCiWorkflow(pin);\n\n  // 3b. THE BINARY THAT WILL ACTUALLY RUN. The reusable workflow does not\n  //     install this CLI — it runs `pnpm install --frozen-lockfile` and then the\n  //     site's OWN installed bin, so the version that executes is whatever this\n  //     repo's lockfile pins. Installing the caller next to a binary with no\n  //     `prismic-models` command yields a workflow that fails on the first model\n  //     PR, in a client repo, with an error naming an unknown command rather\n  //     than a rollout that ran too early.\n  //\n  //     Local and cheap, so it sits with the pin gate ahead of the first network\n  //     call. And it is a REFUSAL on \"could not establish\", not a pass: the\n  //     asymmetry is deliberate, because the cost of waiting is a re-run and the\n  //     cost of being wrong is broken CI on someone else's repository.\n  const locked = await readLockedCliVersion(site.path);\n  if (!locked.ok) {\n    return resultOf(\n      site,\n      \"failed\",\n      `cannot establish which @reddoorla/maintenance version this repo's CI would run ` +\n        `(${locked.reason}) — refusing to install a workflow that may not run`,\n    );\n  }\n  if (!atLeast(locked.version, MIN_CLI_VERSION)) {\n    return resultOf(\n      site,\n      \"failed\",\n      `this repo's lockfile pins @reddoorla/maintenance ${locked.version}, which has no ` +\n        `\\`prismic-models\\` command (first shipped in ${MIN_CLI_VERSION}) — bump the dependency ` +\n        `and commit the lockfile first, or the workflow fails on its first model PR`,\n    );\n  }\n\n  const ghConfig = readGitHubConfig();\n  if (!deps.github && !ghConfig) return resultOf(site, \"failed\", \"GITHUB_TOKEN not set\");\n  const gh = deps.github ?? makeGitHub({ token: ghConfig!.token });\n  const spawn = deps.spawn ?? defaultSpawn;\n\n  // 4. The secret. Absent and unreadable are separate answers with separate\n  //    wording; neither proceeds.\n  let hasSecret: boolean;\n  try {\n    hasSecret = await gh.secretExists(repo, SECRET);\n  } catch (err) {\n    return resultOf(\n      site,\n      \"failed\",\n      `could not determine whether ${repo} has the ${SECRET} secret (${messageOf(err)}) — ` +\n        `refusing to install a workflow that may have no token`,\n    );\n  }\n  if (!hasSecret) {\n    return resultOf(\n      site,\n      \"failed\",\n      `${repo} has no ${SECRET} Actions secret — the workflow reds the repo on its first ` +\n        `model PR without it. Mint one, then: gh secret set ${SECRET} --repo ${repo}`,\n    );\n  }\n\n  // 5. The default branch. NOT `.catch(() => \"main\")`: \"I could not read the\n  //    default branch\" and \"the default branch is main\" are opposite facts, and\n  //    guessing the second targets a PR (and an apply gate) at a branch nobody\n  //    confirmed.\n  let base: string;\n  try {\n    base = await gh.defaultBranch(repo);\n  } catch (err) {\n    return resultOf(\n      site,\n      \"failed\",\n      `could not read the default branch of ${repo}: ${messageOf(err)}`,\n    );\n  }\n  if (base !== APPLY_BRANCH) {\n    return resultOf(\n      site,\n      \"failed\",\n      `default branch of ${repo} is ${base}, not ${APPLY_BRANCH} — the reusable workflow's ` +\n        `apply job guards refs/heads/${APPLY_BRANCH}, so merged model changes would never reach Prismic`,\n    );\n  }\n\n  // 6. Already delivered? Content-compared, not existence-compared, so a\n  //    present-but-STALE workflow (an older pin) is corrected rather than left\n  //    forever.\n  const existing = await gh.fileContentsOnBranch(repo, base, WORKFLOW_PATH);\n  if (existing !== null && sameWorkflow(existing, workflow)) {\n    return resultOf(site, \"noop\", `delivery workflow already current on ${base}`);\n  }\n\n  // 7. Already proposed? Without this, every run before the PR merges opens\n  //    another one. `fileContentsOnBranch` also answers null for a read it could\n  //    not perform (gh exits non-zero on both a 404 and an auth failure), which\n  //    makes this the backstop for that collapse as well.\n  const open = (await gh.openPullRequests(repo)).find((pr) => pr.headRef.startsWith(BRANCH_PREFIX));\n  if (open) {\n    return resultOf(site, \"noop\", `delivery workflow PR already open: ${open.url}`);\n  }\n\n  if (!(await isWorkingTreeClean(site.path))) {\n    return resultOf(site, \"failed\", \"working tree not clean — commit or stash first\");\n  }\n\n  // Capture the operator's branch BEFORE creating ours so the `finally` can put\n  // them back. Best-effort: if we cannot read it we skip the restore rather than\n  // guess at a branch to check out.\n  let original: string | null = null;\n  try {\n    original = await currentBranch(site.path);\n  } catch {\n    // Stays null (detached HEAD, git error) — the restore below is then skipped\n    // rather than aiming a checkout at a branch name we had to invent.\n  }\n  const branch = branchName(\"prismic-ci\");\n  const commits: string[] = [];\n  let pushedOrOpened = false;\n\n  try {\n    await createBranch(site.path, branch);\n    const dest = join(site.path, WORKFLOW_PATH);\n    // What the path held before this run, so a write git then refuses can be put\n    // back exactly as it was (null = the file did not exist).\n    const before = new Map<string, string | null>([\n      [WORKFLOW_PATH, await readFile(dest, \"utf-8\").catch(() => null)],\n    ]);\n    await mkdir(dirname(dest), { recursive: true });\n    await writeFile(dest, workflow, \"utf-8\");\n\n    // Format with the SITE's own prettier, resolved POSITIVELY and run by\n    // absolute path. `pnpm exec prettier` here would run a full `pnpm install`\n    // in the client's repo first (an unrequested mutation of a live client repo\n    // by a rollout that is supposed to add one file), and in a repo without\n    // prettier would then format with the CALLING repo's binary and exit 0.\n    const notes: string[] = [];\n    const bin = await (deps.resolvePrettier ?? resolveTargetPrettier)(site.path);\n    if (bin === null) {\n      notes.push(PRETTIER_FLAG_NOTE);\n    } else if (\n      !(await formatWithPrettier(spawn, site.path, [WORKFLOW_PATH], {\n        bin,\n        timeoutMs: PRETTIER_TIMEOUT_MS,\n      }))\n    ) {\n      notes.push(PRETTIER_FLAG_NOTE);\n    } else if (!sameWorkflow(await readFile(dest, \"utf-8\"), workflow)) {\n      // The site's prettier config disagrees with the template's shape (single\n      // quotes, a different tab width). Harmless for the workflow — but the\n      // step-6 comparison is byte-based, so this site will not recognise its own\n      // delivered workflow as current and will propose it again after each\n      // merge. Say so rather than let it be discovered as a mystery PR.\n      notes.push(\n        \"this site's prettier reformatted the workflow — re-runs will not match it as current\",\n      );\n    }\n\n    const sha = await gitCommit(site.path, \"ci: deliver Prismic model changes from merged PRs\");\n\n    // Did git TAKE the workflow? Here the drop does not even read as a failure:\n    // with the path ignored, `commit()` stages nothing, returns null, and the\n    // branch below reports \"already present and identical in the checkout\" — a\n    // statement about a file that is in no commit at all. Checked BEFORE the\n    // push, so nothing reaches the client repo on a refusal (#741).\n    const refusal = await refusedByGit(site.path, [WORKFLOW_PATH], \"the Prismic delivery workflow\");\n    if (refusal) {\n      await undoRefusedWrites(site.path, before, refusal.missing);\n      return resultOf(site, \"failed\", refusal.notes + RESTORED_NOTE, sha ? [sha] : []);\n    }\n\n    if (!sha) {\n      // Git saw no change: the checkout already holds this exact workflow even\n      // though the default branch does not. Nothing to push and nothing to\n      // review — and pushing a commit-less branch would fail at PR creation.\n      return resultOf(\n        site,\n        \"noop\",\n        `${WORKFLOW_PATH} already present and identical in the checkout`,\n      );\n    }\n    commits.push(sha);\n    pushedOrOpened = true;\n    await (deps.pushBranch ?? gitPush)(site.path, branch);\n    const pr = await gh.openPullRequest(repo, {\n      head: branch,\n      base,\n      title: \"Deliver Prismic model changes from merged PRs\",\n      body:\n        \"Adds the `prismic-models` workflow. On a PR touching `customtypes/**` or \" +\n        \"`src/lib/slices/**/model.json` it comments the model delta and writes nothing; \" +\n        \"on merge to main it pushes those models to Prismic. It can create and update \" +\n        \"models but never delete — a model present only in Prismic is reported, not touched.\",\n    });\n    notes.unshift(`opened PR ${pr.url}`);\n    return resultOf(site, \"applied\", notes.join(\"; \"), commits);\n  } catch (err) {\n    return resultOf(site, \"failed\", messageOf(err), commits);\n  } finally {\n    // Restore the operator's branch on success AND on failure — otherwise a push\n    // error strands the checkout on the recipe branch with an unpushed commit,\n    // and the retry dies at createBranch. Best-effort; never masks the result.\n    if (original !== null && original !== branch) {\n      try {\n        await checkoutBranch(site.path, original);\n        // Nothing was pushed and no PR exists, so the local branch is litter and\n        // a re-run would leave another. Only ever the branch WE created.\n        if (!pushedOrOpened) await deleteBranch(site.path, branch);\n      } catch (err) {\n        console.warn(\n          `warning: could not restore branch ${original} after prismic-ci: ${messageOf(err)}`,\n        );\n      }\n    }\n  }\n}\n","/**\n * The caller workflow every Prismic site gets.\n *\n * Fully generic — no per-site values — because the token is the site's own\n * `PRISMIC_WRITE_TOKEN` secret, the name every site's code already reads.\n * Contrast `ci.yml`, which is deliberately NOT templated anywhere in this\n * package because it carries per-site `netlify-site:` / `node-version:` values\n * a byte template would strip fleet-wide.\n */\n\n/** Where the file lands in a site repo. Also the `gh api .../contents/<path>`\n *  segment, so it must stay traversal-free (`assertUrlSegment` re-checks). */\nexport const WORKFLOW_PATH = \".github/workflows/prismic-models.yml\";\n\n/** The Actions secret the reusable workflow declares as `required: true`, and\n *  the environment variable the CLI reads. Spelled ONCE, here, because the\n *  failure mode of a second spelling is silent: a caller passing a name the\n *  callee never declared supplies nothing, and the callee's required secret\n *  arrives empty at the one step that writes to a live client's Prismic repo. */\nexport const SECRET = \"PRISMIC_WRITE_TOKEN\";\n\n/** The reusable workflow, without a ref. */\nexport const REUSABLE_WORKFLOW = \"reddoorla/.github/.github/workflows/prismic-models.yml\";\n\n/**\n * The ONE branch this delivery path can run its apply job on.\n *\n * Not a preference — the reusable workflow's apply job hard-codes\n * `github.ref == 'refs/heads/main'`. On a repo whose default branch is anything\n * else, a merged model PR would produce a green check and never reach Prismic,\n * which is why the recipe refuses such a repo instead of installing a workflow\n * that silently cannot fire.\n */\nexport const APPLY_BRANCH = \"main\";\n\n/** A commit in `reddoorla/.github`, plus the release tag that commit carries.\n *  Both are written into the workflow: the SHA is what Actions resolves, the tag\n *  is what a human (and Renovate's github-actions manager) reads. */\nexport type ReusableWorkflowPin = { sha: string; tag: string };\n\n/**\n * What the shipped pin says while the reusable workflow has not been published\n * to `reddoorla/.github` and tagged yet (plan Task 25).\n *\n * DELIBERATELY NOT 40 HEX CHARACTERS. A placeholder shaped like a real SHA is\n * indistinguishable from a real one in review, and would install a workflow\n * referencing a commit that does not exist into 15 client repositories — where\n * it fails at workflow-load time, on every model PR, with an error that names\n * neither this file nor the reason. Unresolved must be unmistakable, and\n * {@link isPinResolved} is what the recipe gates on.\n */\nexport const UNRESOLVED_PIN_SHA = \"UNRESOLVED-publish-and-tag-reddoorla-dot-github-first\";\n\n/**\n * The pin the fleet rolls out.\n *\n * RESOLVED 2026-08-14. `reddoorla/.github#30` merged as\n * 558395431ddcb481ecba3dd84b78b38c338cfa03 and that commit was tagged v1.4.0;\n * `gh api repos/reddoorla/.github/commits/v1.4.0 --jq .sha` returns the SHA\n * below. `validate` (the digest-pinning + Renovate-preset check that is the\n * only CI in that repo) passed on the merge commit.\n *\n * TO RE-RESOLVE after a future `reddoorla/.github` release: set `sha` to\n * `gh api repos/reddoorla/.github/commits/<tag> --jq .sha` and `tag` to that\n * tag — then VERIFY PROPAGATION rather than assuming it. Renovate does bump\n * this ref: 17 site repos took v1.2.0 -> v1.3.0 in the weeks after v1.3.0\n * was tagged 2026-07-14, on Renovate's weekly `renovate/all-minor-patch`\n * branches (some of which were already open before the tag, so a PR's\n * creation date can predate the version it ends up bumping). It runs self-hosted here and its author identity has already\n * changed once mid-window (operator PAT, authoring as `tucksravin`, until\n * 2026-08-02; `reddoor-renovate[bot]` since), so no single author filter\n * matches all 17 and `app/renovate` matches none of them. Search the\n * `renovate/*` head branch, not an author; an empty author-filtered search\n * is not evidence. But it proposed neither\n * of the last two tags for `ci.yml`: v1.4.0 (2026-08-14) was never offered,\n * and v1.4.1 (2026-09-01) reached the fleet only because ci.yml was swept BY\n * HAND across 21 repos that day (beachfront-dentistry#36). Treat propagation\n * as three steps to run, not a guarantee: (1) re-resolve this constant,\n * (2) release @reddoorla/maintenance, (3) `reddoor-maint prismic-ci --fleet\n * airtable` — the already-delivered gate content-compares the installed file\n * and opens a corrective PR per stale repo — plus ONE POSITIONAL RUN PER\n * PRE-LAUNCH SITE, which the Airtable inventory excludes\n * (`src/inventory/airtable.ts:50` filters `building`/`launching`).\n */\nexport const REUSABLE_WORKFLOW_PIN: ReusableWorkflowPin = {\n  sha: \"558395431ddcb481ecba3dd84b78b38c338cfa03\",\n  tag: \"v1.4.0\",\n};\n\n/**\n * Is this pin a real commit reference?\n *\n * A full 40-hex SHA and nothing else. Not a tag, not a branch: this repo pins\n * every `uses:` to a commit (see `src/recipes/sync-configs/templates.ts`, whose\n * renovate template spells out why — a retagged `@v3` runs attacker code with\n * whatever token the workflow holds). Do not assume the pin bumps itself:\n * Renovate has proposed this ref in the past but did not for either of the\n * last two tags — see the propagation note on\n * {@link REUSABLE_WORKFLOW_PIN} above.\n */\nexport function isPinResolved(pin: ReusableWorkflowPin): boolean {\n  return /^[0-9a-f]{40}$/.test(pin.sha);\n}\n\n/**\n * Render the caller workflow for a pin.\n *\n * Path-filtered on both triggers: this must not run on every commit, only when\n * a model changes.\n */\nexport function prismicCiWorkflow(pin: ReusableWorkflowPin): string {\n  return `# Delivers this site's Prismic model changes. Managed by @reddoorla/maintenance\n# (\\`reddoor-maint prismic-ci\\`) — change it there and re-run, not here.\n#\n# On a PR touching a model: comment the delta, write nothing.\n# On merge to ${APPLY_BRANCH}: push those models to Prismic. Never delete.\n#\n# THE BRANCH FILTER ON \\`push:\\` IS LOAD-BEARING, not tidiness. The reusable\n# workflow's apply job also guards \\`github.ref == 'refs/heads/${APPLY_BRANCH}'\\`,\n# and its comment calls this the other half of that gate: an unfiltered\n# \\`on: push:\\` fires on every branch AND every tag, so a feature branch's models\n# would reach production with no pull request and therefore no review anywhere in\n# the sequence. Keep both halves.\nname: prismic-models\n\non:\n  # No branch filter here, deliberately: a model PR into any base deserves its\n  # delta comment, and the dry job is INCAPABLE of writing — it never passes\n  # \\`--apply\\`, and it holds no job that does.\n  pull_request:\n    paths:\n      - \"customtypes/**\"\n      - \"src/lib/slices/**/model.json\"\n  push:\n    branches: [${APPLY_BRANCH}]\n    paths:\n      - \"customtypes/**\"\n      - \"src/lib/slices/**/model.json\"\n\njobs:\n  prismic-models:\n    # A called workflow's jobs can only NARROW what the caller granted, so the\n    # PR-comment permission has to be granted here as well as there. Nothing in\n    # either job pushes code, so \\`contents\\` stays read.\n    permissions:\n      contents: read\n      pull-requests: write\n    uses: ${REUSABLE_WORKFLOW}@${pin.sha} # ${pin.tag}\n    secrets:\n      # Spelled exactly as the reusable workflow declares it. A workflow-local\n      # alias would not be a rename — it would be an undeclared secret, and the\n      # required one would arrive empty.\n      ${SECRET}: \\${{ secrets.${SECRET} }}\n`;\n}\n\n/** The workflow as currently shipped. Unusable — and refused by the recipe —\n *  until {@link REUSABLE_WORKFLOW_PIN} is resolved. */\nexport const PRISMIC_CI_WORKFLOW = prismicCiWorkflow(REUSABLE_WORKFLOW_PIN);\n","import { readFile } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\n/**\n * The first published version whose `reddoor-maint` bin carries `prismic-models`.\n *\n * VERIFIED BY INSTALLING IT, not by reading a changelog: `npm i\n * @reddoorla/maintenance@0.83.0` in an empty directory, then `reddoor-maint\n * prismic-models --help`, prints the command's usage. Every earlier published\n * version — 0.82.0 included — exits with \"unknown command\".\n *\n * This matters because the reusable workflow does NOT install the CLI. It runs\n * `pnpm install --frozen-lockfile` and then the site's own installed bin, so the\n * version that executes in a client repo is whatever that repo's lockfile pins.\n * Installing the caller workflow next to an older binary produces a workflow\n * that fails at the first model PR, in a client repo, with an error about an\n * unknown command rather than about a rollout that ran too early.\n */\nexport const MIN_CLI_VERSION = \"0.83.0\";\n\n/** The dependency whose version decides whether the workflow can run at all. */\nconst PACKAGE = \"@reddoorla/maintenance\";\n\n/**\n * `version >= min`, compared NUMERICALLY, position by position.\n *\n * Not a string comparison, and not `localeCompare`: as strings `\"0.9.0\" >\n * \"0.83.0\"`, so a lexicographic gate waves through a site pinned seventy-four\n * releases before the command existed. That is the single most likely way for\n * this gate to be wrong while looking right.\n *\n * A prerelease (`0.83.0-beta.1`) sorts BELOW the release it precedes, per\n * semver. The fleet publishes no prereleases today; the rule is here so that if\n * one ever appears it is not silently treated as the release.\n */\nexport function atLeast(version: string, min: string): boolean {\n  const parse = (v: string): { nums: number[]; pre: boolean } => {\n    const [core = \"\", ...rest] = v.split(\"-\");\n    return {\n      nums: core.split(\".\").map((n) => Number.parseInt(n, 10) || 0),\n      pre: rest.length > 0,\n    };\n  };\n  const a = parse(version);\n  const b = parse(min);\n  for (let i = 0; i < 3; i++) {\n    const av = a.nums[i] ?? 0;\n    const bv = b.nums[i] ?? 0;\n    if (av !== bv) return av > bv;\n  }\n  // Cores equal: a prerelease of the minimum is below it; anything else is equal.\n  if (a.pre && !b.pre) return false;\n  return true;\n}\n\n/** Either the version pnpm resolved, or WHY that could not be established.\n *  The two are deliberately different shapes: a caller cannot read \"I could not\n *  tell\" as a version by forgetting to check a flag. */\nexport type LockedCliVersion = { ok: true; version: string } | { ok: false; reason: string };\n\n/**\n * The version of {@link PACKAGE} the repo's committed pnpm lockfile resolves.\n *\n * Reads the LOCKFILE, never `package.json`. The declared range is not what\n * executes: espada declares `^0.81.0` and its lockfile resolves 0.69.0, and CI\n * installs `--frozen-lockfile`. A gate reading the range would pass a site whose\n * install is two dozen releases behind it.\n *\n * Parsed with a targeted scan rather than a YAML dependency — this needs one\n * field out of one block, the repo carries no YAML parser, and adding one to\n * read a single `version:` line is not a trade worth making. The scan is\n * deliberately narrow: it reads only `importers:` entries (what is installed),\n * never the `packages:`/`snapshots:` sections, which list every transitively\n * resolvable version and would happily report one nobody installed.\n *\n * Every failure is a NAMED reason, never a version and never a silent default.\n * A gate that cannot tell \"too old\" from \"could not read\" reports one as the\n * other, which is the absent-vs-unreadable collapse this whole feature exists to\n * prevent — arriving here at the last step before writing to a client repo.\n */\nexport async function readLockedCliVersion(repoRoot: string): Promise<LockedCliVersion> {\n  let raw: string;\n  try {\n    raw = await readFile(join(repoRoot, \"pnpm-lock.yaml\"), \"utf-8\");\n  } catch (err) {\n    const code = (err as NodeJS.ErrnoException).code;\n    // ENOENT is the only error meaning \"this repo has no lockfile\". EACCES and\n    // friends mean it is there and unreadable — a different answer, and one that\n    // must not read as \"not a pnpm site\".\n    if (code === \"ENOENT\") {\n      return {\n        ok: false,\n        reason: `no pnpm-lock.yaml in the checkout — cannot tell which ${PACKAGE} version CI would run`,\n      };\n    }\n    return { ok: false, reason: `pnpm-lock.yaml is present but unreadable (${String(err)})` };\n  }\n\n  // Only inside `importers:` — see the note above on packages:/snapshots:.\n  const lines = raw.split(\"\\n\");\n  const importersAt = lines.findIndex((l) => /^importers:\\s*$/.test(l));\n  if (importersAt === -1) {\n    return {\n      ok: false,\n      reason: \"pnpm-lock.yaml has no `importers:` section — unrecognised lockfile shape\",\n    };\n  }\n  const end = lines.findIndex((l, i) => i > importersAt && /^[a-zA-Z]/.test(l));\n  const importers = lines.slice(importersAt + 1, end === -1 ? lines.length : end);\n\n  const found = new Set<string>();\n  for (let i = 0; i < importers.length; i++) {\n    if (!new RegExp(`^\\\\s+'?${PACKAGE.replace(\"/\", \"\\\\/\")}'?:\\\\s*$`).test(importers[i]!)) continue;\n    // The entry's own `version:` sits within the next few lines, alongside\n    // `specifier:`. Bounded so a malformed block cannot walk into the next\n    // dependency and attribute its version to this one.\n    for (let j = i + 1; j < Math.min(i + 4, importers.length); j++) {\n      const m = /^\\s+version:\\s*(\\S+)\\s*$/.exec(importers[j]!);\n      if (!m) continue;\n      // Strip the peer-dependency suffix: real fleet lockfiles run it past 400\n      // characters after the semver.\n      found.add(m[1]!.split(\"(\")[0]!);\n      break;\n    }\n  }\n\n  if (found.size === 0) {\n    return { ok: false, reason: `${PACKAGE} is not a dependency in this repo's lockfile` };\n  }\n  if (found.size > 1) {\n    // Picking one would be a coin flip deciding whether a client repo gets a\n    // workflow its binary cannot run.\n    return {\n      ok: false,\n      reason: `lockfile resolves ${PACKAGE} to more than one version (${[...found].sort().join(\", \")}) — refusing to guess which one CI would run`,\n    };\n  }\n  return { ok: true, version: [...found][0]! };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BA,SAAS,eAAe;AACxB,SAAS,eAAe;;;AC5BxB,SAAS,OAAO,YAAAA,WAAU,iBAAiB;AAC3C,SAAS,SAAS,QAAAC,aAAY;;;ACWvB,IAAM,gBAAgB;AAOtB,IAAM,SAAS;AAGf,IAAM,oBAAoB;AAW1B,IAAM,eAAe;AAmDrB,IAAM,wBAA6C;AAAA,EACxD,KAAK;AAAA,EACL,KAAK;AACP;AAaO,SAAS,cAAc,KAAmC;AAC/D,SAAO,iBAAiB,KAAK,IAAI,GAAG;AACtC;AAQO,SAAS,kBAAkB,KAAkC;AAClE,SAAO;AAAA;AAAA;AAAA;AAAA,gBAIO,YAAY;AAAA;AAAA;AAAA,iEAGqC,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iBAgB5D,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YAajB,iBAAiB,IAAI,IAAI,GAAG,MAAM,IAAI,GAAG;AAAA;AAAA;AAAA;AAAA;AAAA,QAK7C,MAAM,kBAAkB,MAAM;AAAA;AAEtC;AAIO,IAAM,sBAAsB,kBAAkB,qBAAqB;;;AC9J1E,SAAS,gBAAgB;AACzB,SAAS,YAAY;AAiBd,IAAM,kBAAkB;AAG/B,IAAM,UAAU;AAcT,SAAS,QAAQ,SAAiB,KAAsB;AAC7D,QAAM,QAAQ,CAAC,MAAgD;AAC7D,UAAM,CAAC,OAAO,IAAI,GAAG,IAAI,IAAI,EAAE,MAAM,GAAG;AACxC,WAAO;AAAA,MACL,MAAM,KAAK,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,OAAO,SAAS,GAAG,EAAE,KAAK,CAAC;AAAA,MAC5D,KAAK,KAAK,SAAS;AAAA,IACrB;AAAA,EACF;AACA,QAAM,IAAI,MAAM,OAAO;AACvB,QAAM,IAAI,MAAM,GAAG;AACnB,WAAS,IAAI,GAAG,IAAI,GAAG,KAAK;AAC1B,UAAM,KAAK,EAAE,KAAK,CAAC,KAAK;AACxB,UAAM,KAAK,EAAE,KAAK,CAAC,KAAK;AACxB,QAAI,OAAO,GAAI,QAAO,KAAK;AAAA,EAC7B;AAEA,MAAI,EAAE,OAAO,CAAC,EAAE,IAAK,QAAO;AAC5B,SAAO;AACT;AA2BA,eAAsB,qBAAqB,UAA6C;AACtF,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,SAAS,KAAK,UAAU,gBAAgB,GAAG,OAAO;AAAA,EAChE,SAAS,KAAK;AACZ,UAAM,OAAQ,IAA8B;AAI5C,QAAI,SAAS,UAAU;AACrB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ,8DAAyD,OAAO;AAAA,MAC1E;AAAA,IACF;AACA,WAAO,EAAE,IAAI,OAAO,QAAQ,6CAA6C,OAAO,GAAG,CAAC,IAAI;AAAA,EAC1F;AAGA,QAAM,QAAQ,IAAI,MAAM,IAAI;AAC5B,QAAM,cAAc,MAAM,UAAU,CAAC,MAAM,kBAAkB,KAAK,CAAC,CAAC;AACpE,MAAI,gBAAgB,IAAI;AACtB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ;AAAA,IACV;AAAA,EACF;AACA,QAAM,MAAM,MAAM,UAAU,CAAC,GAAG,MAAM,IAAI,eAAe,YAAY,KAAK,CAAC,CAAC;AAC5E,QAAM,YAAY,MAAM,MAAM,cAAc,GAAG,QAAQ,KAAK,MAAM,SAAS,GAAG;AAE9E,QAAM,QAAQ,oBAAI,IAAY;AAC9B,WAAS,IAAI,GAAG,IAAI,UAAU,QAAQ,KAAK;AACzC,QAAI,CAAC,IAAI,OAAO,UAAU,QAAQ,QAAQ,KAAK,KAAK,CAAC,UAAU,EAAE,KAAK,UAAU,CAAC,CAAE,EAAG;AAItF,aAAS,IAAI,IAAI,GAAG,IAAI,KAAK,IAAI,IAAI,GAAG,UAAU,MAAM,GAAG,KAAK;AAC9D,YAAM,IAAI,2BAA2B,KAAK,UAAU,CAAC,CAAE;AACvD,UAAI,CAAC,EAAG;AAGR,YAAM,IAAI,EAAE,CAAC,EAAG,MAAM,GAAG,EAAE,CAAC,CAAE;AAC9B;AAAA,IACF;AAAA,EACF;AAEA,MAAI,MAAM,SAAS,GAAG;AACpB,WAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,OAAO,+CAA+C;AAAA,EACvF;AACA,MAAI,MAAM,OAAO,GAAG;AAGlB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ,qBAAqB,OAAO,8BAA8B,CAAC,GAAG,KAAK,EAAE,KAAK,EAAE,KAAK,IAAI,CAAC;AAAA,IAChG;AAAA,EACF;AACA,SAAO,EAAE,IAAI,MAAM,SAAS,CAAC,GAAG,KAAK,EAAE,CAAC,EAAG;AAC7C;;;AFpGA,IAAM,gBAAgB;AAKtB,IAAM,sBAAsB;AAqB5B,IAAM,WAAW,CACf,MACA,QACA,OACA,UAAoB,CAAC,OACH;AAAA,EAClB,QAAQ;AAAA,EACR,MAAM,UAAU,IAAI;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,YAAY,CAAC,QAA0B,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAK5F,SAAS,aAAa,SAAiB,WAA4B;AACjE,QAAM,OAAO,CAAC,MAAc,EAAE,QAAQ,SAAS,IAAI,EAAE,QAAQ,QAAQ,EAAE;AACvE,SAAO,KAAK,OAAO,MAAM,KAAK,SAAS;AACzC;AAyBA,eAAsB,UAAU,MAAY,OAAsB,CAAC,GAA0B;AAM3F,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,iBAAiB,IAAI;AAAA,EACpC,SAAS,KAAK;AAGZ,WAAO,SAAS,MAAM,UAAU,wCAAwC,UAAU,GAAG,CAAC,EAAE;AAAA,EAC1F;AACA,MAAI,CAAC,MAAM;AACT,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,IAEF;AAAA,EACF;AAYA,MAAI,KAAK,SAAS;AAChB,QAAI;AACJ,QAAI;AACF,kBAAY,MAAM,aAAa,KAAK,IAAI;AAAA,IAC1C,QAAQ;AACN,kBAAY;AAAA,IACd;AACA,QAAI,cAAc,QAAQ,CAAC,cAAc,MAAM,SAAS,GAAG;AACzD,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA,cAAc,IAAI,yCAAyC,SAAS;AAAA,MAEtE;AAAA,IACF;AAAA,EACF;AAMA,MAAI;AACJ,MAAI;AACF,gBAAa,MAAM,kBAAkB,KAAK,IAAI,MAAO;AAAA,EACvD,SAAS,KAAK;AACZ,WAAO,SAAS,MAAM,UAAU,sCAAsC,UAAU,GAAG,CAAC,EAAE;AAAA,EACxF;AACA,MAAI,CAAC,UAAW,QAAO,SAAS,MAAM,QAAQ,uDAAkD;AAKhG,QAAM,MAAM,KAAK,OAAO;AACxB,MAAI,CAAC,cAAc,GAAG,GAAG;AACvB,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,wCAAwC,IAAI,GAAG;AAAA,IAEjD;AAAA,EACF;AACA,QAAM,WAAW,QAAQ,wBAAwB,sBAAsB,kBAAkB,GAAG;AAc5F,QAAM,SAAS,MAAM,qBAAqB,KAAK,IAAI;AACnD,MAAI,CAAC,OAAO,IAAI;AACd,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,mFACM,OAAO,MAAM;AAAA,IACrB;AAAA,EACF;AACA,MAAI,CAAC,QAAQ,OAAO,SAAS,eAAe,GAAG;AAC7C,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,oDAAoD,OAAO,OAAO,+DAChB,eAAe;AAAA,IAEnE;AAAA,EACF;AAEA,QAAM,WAAW,iBAAiB;AAClC,MAAI,CAAC,KAAK,UAAU,CAAC,SAAU,QAAO,SAAS,MAAM,UAAU,sBAAsB;AACrF,QAAM,KAAK,KAAK,UAAU,WAAW,EAAE,OAAO,SAAU,MAAM,CAAC;AAC/D,QAAM,QAAQ,KAAK,SAAS;AAI5B,MAAI;AACJ,MAAI;AACF,gBAAY,MAAM,GAAG,aAAa,MAAM,MAAM;AAAA,EAChD,SAAS,KAAK;AACZ,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,+BAA+B,IAAI,YAAY,MAAM,YAAY,UAAU,GAAG,CAAC;AAAA,IAEjF;AAAA,EACF;AACA,MAAI,CAAC,WAAW;AACd,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,GAAG,IAAI,WAAW,MAAM,qHACgC,MAAM,WAAW,IAAI;AAAA,IAC/E;AAAA,EACF;AAMA,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,GAAG,cAAc,IAAI;AAAA,EACpC,SAAS,KAAK;AACZ,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,wCAAwC,IAAI,KAAK,UAAU,GAAG,CAAC;AAAA,IACjE;AAAA,EACF;AACA,MAAI,SAAS,cAAc;AACzB,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,qBAAqB,IAAI,OAAO,IAAI,SAAS,YAAY,+DACxB,YAAY;AAAA,IAC/C;AAAA,EACF;AAKA,QAAM,WAAW,MAAM,GAAG,qBAAqB,MAAM,MAAM,aAAa;AACxE,MAAI,aAAa,QAAQ,aAAa,UAAU,QAAQ,GAAG;AACzD,WAAO,SAAS,MAAM,QAAQ,wCAAwC,IAAI,EAAE;AAAA,EAC9E;AAMA,QAAM,QAAQ,MAAM,GAAG,iBAAiB,IAAI,GAAG,KAAK,CAAC,OAAO,GAAG,QAAQ,WAAW,aAAa,CAAC;AAChG,MAAI,MAAM;AACR,WAAO,SAAS,MAAM,QAAQ,sCAAsC,KAAK,GAAG,EAAE;AAAA,EAChF;AAEA,MAAI,CAAE,MAAM,mBAAmB,KAAK,IAAI,GAAI;AAC1C,WAAO,SAAS,MAAM,UAAU,qDAAgD;AAAA,EAClF;AAKA,MAAI,WAA0B;AAC9B,MAAI;AACF,eAAW,MAAM,cAAc,KAAK,IAAI;AAAA,EAC1C,QAAQ;AAAA,EAGR;AACA,QAAM,SAAS,WAAW,YAAY;AACtC,QAAM,UAAoB,CAAC;AAC3B,MAAI,iBAAiB;AAErB,MAAI;AACF,UAAM,aAAa,KAAK,MAAM,MAAM;AACpC,UAAM,OAAOC,MAAK,KAAK,MAAM,aAAa;AAG1C,UAAM,SAAS,oBAAI,IAA2B;AAAA,MAC5C,CAAC,eAAe,MAAMC,UAAS,MAAM,OAAO,EAAE,MAAM,MAAM,IAAI,CAAC;AAAA,IACjE,CAAC;AACD,UAAM,MAAM,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AAC9C,UAAM,UAAU,MAAM,UAAU,OAAO;AAOvC,UAAM,QAAkB,CAAC;AACzB,UAAM,MAAM,OAAO,KAAK,mBAAmB,uBAAuB,KAAK,IAAI;AAC3E,QAAI,QAAQ,MAAM;AAChB,YAAM,KAAK,kBAAkB;AAAA,IAC/B,WACE,CAAE,MAAM,mBAAmB,OAAO,KAAK,MAAM,CAAC,aAAa,GAAG;AAAA,MAC5D;AAAA,MACA,WAAW;AAAA,IACb,CAAC,GACD;AACA,YAAM,KAAK,kBAAkB;AAAA,IAC/B,WAAW,CAAC,aAAa,MAAMA,UAAS,MAAM,OAAO,GAAG,QAAQ,GAAG;AAMjE,YAAM;AAAA,QACJ;AAAA,MACF;AAAA,IACF;AAEA,UAAM,MAAM,MAAM,OAAU,KAAK,MAAM,mDAAmD;AAO1F,UAAM,UAAU,MAAM,aAAa,KAAK,MAAM,CAAC,aAAa,GAAG,+BAA+B;AAC9F,QAAI,SAAS;AACX,YAAM,kBAAkB,KAAK,MAAM,QAAQ,QAAQ,OAAO;AAC1D,aAAO,SAAS,MAAM,UAAU,QAAQ,QAAQ,eAAe,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;AAAA,IACjF;AAEA,QAAI,CAAC,KAAK;AAIR,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA,GAAG,aAAa;AAAA,MAClB;AAAA,IACF;AACA,YAAQ,KAAK,GAAG;AAChB,qBAAiB;AACjB,WAAO,KAAK,cAAc,MAAS,KAAK,MAAM,MAAM;AACpD,UAAM,KAAK,MAAM,GAAG,gBAAgB,MAAM;AAAA,MACxC,MAAM;AAAA,MACN;AAAA,MACA,OAAO;AAAA,MACP,MACE;AAAA,IAIJ,CAAC;AACD,UAAM,QAAQ,aAAa,GAAG,GAAG,EAAE;AACnC,WAAO,SAAS,MAAM,WAAW,MAAM,KAAK,IAAI,GAAG,OAAO;AAAA,EAC5D,SAAS,KAAK;AACZ,WAAO,SAAS,MAAM,UAAU,UAAU,GAAG,GAAG,OAAO;AAAA,EACzD,UAAE;AAIA,QAAI,aAAa,QAAQ,aAAa,QAAQ;AAC5C,UAAI;AACF,cAAM,eAAe,KAAK,MAAM,QAAQ;AAGxC,YAAI,CAAC,eAAgB,OAAM,aAAa,KAAK,MAAM,MAAM;AAAA,MAC3D,SAAS,KAAK;AACZ,gBAAQ;AAAA,UACN,qCAAqC,QAAQ,sBAAsB,UAAU,GAAG,CAAC;AAAA,QACnF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;;;ADxUA,IAAMC,aAAY,CAAC,QAA0B,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAE5F,IAAM,YAAY,CAAC,MAAc,WAAiC;AAAA,EAChE,QAAQ;AAAA,EACR;AAAA,EACA,QAAQ;AAAA,EACR,SAAS,CAAC;AAAA,EACV;AACF;AAcO,SAAS,uBAAuB,SAAiC;AACtE,QAAM,QAAQ,QAAQ,IAAI,CAAC,MAAM,IAAI,EAAE,IAAI,KAAK,EAAE,MAAM,KAAK,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC;AACtF,QAAM,IAAI,CAAC,MAA8B,QAAQ,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE;AAC/E,QAAM,SAAS,EAAE,QAAQ;AACzB,QAAM,KAAK,EAAE;AACb,MAAI,SAAS,KAAK,EAAE,SAAS,MAAM,GAAG;AACpC,UAAM;AAAA,MACJ,6CAAwC,MAAM,OAAO,QAAQ,MAAM;AAAA,IAGrE;AACA,UAAM,KAAK,EAAE;AAAA,EACf;AACA,QAAM,KAAK,GAAG,EAAE,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,UAAU,MAAM,UAAU;AAC1E,SAAO,MAAM,KAAK,IAAI;AACxB;AAeA,eAAe,gBAAgB,UAA0C;AACvE,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,QAAQ,QAAQ;AAAA,EAClC,SAAS,GAAG;AACV,WAAO,gCAAgC,QAAQ,KAAKA,WAAU,CAAC,CAAC;AAAA,EAClE;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAWA,eAAsB,oBACpB,MACA,MACA,OAA6B,CAAC,GACa;AAC3C,QAAM,MAAM,KAAK,MAAM,QAAQ,KAAK,GAAG,IAAI,QAAQ,IAAI;AACvD,MAAI,QAAQ,MAAM,aAAa;AAAA,IAC7B,GAAI,SAAS,SAAY,EAAE,KAAK,IAAI,CAAC;AAAA,IACrC,GAAI,KAAK,UAAU,SAAY,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,IAIxD,GAAI,KAAK,YAAY,SAAY,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,IAC9D;AAAA,EACF,CAAC;AAMD,MAAI,MAAM,WAAW,GAAG;AACtB,WAAO;AAAA,MACL,QACE;AAAA,MAIF,MAAM;AAAA,IACR;AAAA,EACF;AAEA,MAAI,UAAyB,CAAC;AAC9B,MAAI,KAAK,OAAO;AACd,UAAM,OAAO,MAAM,kBAAkB,OAAO,EAAE,SAAS,KAAK,WAAW,aAAa,EAAE,CAAC;AACvF,YAAQ,KAAK;AACb,cAAU,KAAK;AAAA,EACjB;AAUA,QAAM,MAAM,KAAK,OAAO;AACxB,QAAM,gBAAgB,CAAC,cAAc,GAAG,IACpC,mDAA8C,IAAI,GAAG,kJAGrD;AAEJ,MAAI,KAAK,KAAK;AACZ,UAAM,QAAQ,MAAM;AAAA,MAClB,CAAC,MACC,IAAI,UAAU,CAAC,CAAC;AAAA,IAEpB;AACA,WAAO;AAAA,MACL,QAAQ;AAAA,QACN,CAAC,eAAe,MAAM,KAAK,IAAI,CAAC,EAAE,OAAO,CAAC,MAAM,MAAM,EAAE,EAAE,KAAK,MAAM;AAAA,QACrE;AAAA,MACF;AAAA,MACA,MAAM,kBAAkB,KAAK,IAAI;AAAA,IACnC;AAAA,EACF;AAEA,QAAM,MAAM,KAAK,cAAc,CAAC,MAAY,UAAU,GAAG,EAAE,IAAI,CAAC;AAChE,QAAM,UAAU,MAAM,mBAAmB,cAAc,OAAO,OAAO,MAAM;AACzE,UAAM,UAAU,MAAM,gBAAgB,EAAE,IAAI;AAC5C,WAAO,UAAU,UAAU,UAAU,CAAC,GAAG,OAAO,IAAI,IAAI,CAAC;AAAA,EAC3D,CAAC;AAQD,aAAW,KAAK,SAAS;AACvB,YAAQ;AAAA,MACN;AAAA,QACE,EAAE;AAAA,QACF,oCAAoC,EAAE,MAAM;AAAA,MAE9C;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,QAAQ,iBAAiB,uBAAuB,OAAO,GAAG,OAAO;AAAA,IACjE,MAAM,QAAQ,KAAK,CAAC,MAAM,EAAE,WAAW,QAAQ,IAAI,IAAI;AAAA,EACzD;AACF;","names":["readFile","join","join","readFile","messageOf"]}