@stravica-ai/digital-operator-pa 0.1.0

package/dist/engineering-pa-cli/src/smoke/runner.mjs

@@ -0,0 +1,191 @@
+// runner.mjs — external-effects chokepoint for the smoke tool.
+//
+// Everything that touches the outside world (spawning processes, copying
+// files, HTTP requests) lives in this module. Commands and checks depend
+// on this module; nothing else spawns or fetches.
+//
+// All helpers return plain Promises resolving to structured results —
+// they never throw for caller-recoverable outcomes (non-zero exits,
+// HTTP errors, missing files). They throw only for programmer errors
+// (bad arguments, missing binaries that the host platform lacks).
+
+import { spawn } from 'node:child_process';
+import { mkdtemp, cp, rm, access, stat } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { constants as fsConstants } from 'node:fs';
+
+/**
+ * Spawn a process without a shell. Returns { code, signal, stdout, stderr }.
+ * Never rejects for non-zero exits — callers must inspect `code`.
+ *
+ * @param {string} command
+ * @param {string[]} args
+ * @param {object} [opts]   { cwd, env, timeoutMs, stdin }
+ */
+export function spawnProcess(command, args = [], opts = {}) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, {
+      cwd: opts.cwd,
+      env: opts.env ?? process.env,
+      shell: false,
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
+
+    let stdout = '';
+    let stderr = '';
+    let timedOut = false;
+
+    child.stdout.on('data', (chunk) => { stdout += chunk.toString('utf8'); });
+    child.stderr.on('data', (chunk) => { stderr += chunk.toString('utf8'); });
+
+    const timer = opts.timeoutMs
+      ? setTimeout(() => { timedOut = true; child.kill('SIGTERM'); }, opts.timeoutMs)
+      : null;
+
+    child.on('error', (err) => {
+      if (timer) clearTimeout(timer);
+      reject(err);
+    });
+
+    child.on('close', (code, signal) => {
+      if (timer) clearTimeout(timer);
+      resolve({ code, signal, stdout, stderr, timedOut });
+    });
+
+    if (opts.stdin != null) {
+      child.stdin.write(opts.stdin);
+    }
+    child.stdin.end();
+  });
+}
+
+/**
+ * Launch a long-running process and return the ChildProcess handle.
+ * The caller is responsible for killing it.
+ */
+export function launchProcess(command, args = [], opts = {}) {
+  return spawn(command, args, {
+    cwd: opts.cwd,
+    env: opts.env ?? process.env,
+    shell: false,
+    stdio: opts.stdio ?? ['ignore', 'ignore', 'ignore'],
+    detached: false,
+  });
+}
+
+/**
+ * Kill a child process and await exit. Safe to call on an already-exited child.
+ */
+export async function killProcess(child) {
+  if (!child || child.exitCode != null || child.signalCode != null) return;
+  child.kill('SIGTERM');
+  await new Promise((resolve) => {
+    const timer = setTimeout(() => { try { child.kill('SIGKILL'); } catch {} resolve(); }, 2000);
+    child.once('close', () => { clearTimeout(timer); resolve(); });
+  });
+}
+
+/**
+ * Create a temp directory with a stable prefix. Returns the absolute path.
+ */
+export async function makeTempDir(prefix = 'dave-smoke-') {
+  return mkdtemp(join(tmpdir(), prefix));
+}
+
+/**
+ * Remove a directory recursively. Never rejects for missing paths.
+ */
+export async function removeDir(dir) {
+  if (!dir) return;
+  await rm(dir, { recursive: true, force: true });
+}
+
+/**
+ * Copy a directory tree from src to dest, excluding a fixed set of top-level
+ * names. Matches the behaviour of `rsync -a --exclude=.git --exclude=node_modules`.
+ */
+export async function copyTree(src, dest, excludes = ['.git', 'node_modules']) {
+  const excludeSet = new Set(excludes);
+  await cp(src, dest, {
+    recursive: true,
+    dereference: false,
+    preserveTimestamps: true,
+    filter: (source) => {
+      // Only filter at the top level — once inside an included dir, copy
+      // everything. This matches rsync --exclude='.git' semantics where
+      // only top-level matches are excluded (our exclusion list is
+      // ".git" and "node_modules", both only meaningful at the root).
+      const rel = source.slice(src.length).replace(/^[\\/]+/, '');
+      if (rel === '') return true;
+      const firstSegment = rel.split(/[\\/]/)[0];
+      return !excludeSet.has(firstSegment);
+    },
+  });
+}
+
+/**
+ * Check that a path exists. Returns true/false.
+ */
+export async function pathExists(p) {
+  try {
+    await access(p, fsConstants.F_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Check that a path exists and is executable.
+ */
+export async function pathExecutable(p) {
+  try {
+    await access(p, fsConstants.F_OK | fsConstants.X_OK);
+    const s = await stat(p);
+    return s.isFile();
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Perform an HTTP GET. Returns { status, body }. Never rejects for HTTP
+ * errors — callers inspect status. Rejects only for network/DNS/abort.
+ *
+ * Uses the global `fetch` available in Node 20+.
+ */
+export async function httpGet(url, opts = {}) {
+  const controller = new AbortController();
+  const timer = opts.timeoutMs
+    ? setTimeout(() => controller.abort(), opts.timeoutMs)
+    : null;
+  try {
+    const res = await fetch(url, { signal: controller.signal });
+    const body = await res.text();
+    return { status: res.status, body };
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+
+/**
+ * Poll until an HTTP endpoint becomes reachable or the attempt budget
+ * is exhausted. Returns true on success.
+ */
+export async function waitForHttp(url, { attempts = 20, intervalMs = 500, timeoutMs = 1000 } = {}) {
+  for (let i = 0; i < attempts; i++) {
+    try {
+      const res = await httpGet(url, { timeoutMs });
+      if (res.status >= 200 && res.status < 500) return true;
+    } catch {
+      // swallow — connection refused / reset during boot is expected
+    }
+    await sleep(intervalMs);
+  }
+  return false;
+}
+
+export function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}

package/dist/engineering-pa-cli/src/staging-alias/cli.mjs

@@ -0,0 +1,91 @@
+// staging-alias — verb router for `pa staging-alias <verb>`.
+//
+// Pattern: a tiny "router worker" bound as a Custom Domain on
+// `staging.<site>` proxies to the desired preview-URL on workers.dev.
+// Cloudflare Workers Custom Domains cannot be pointed at a specific
+// version, and Preview URLs cannot run on a non-workers.dev subdomain
+// (CF docs, confirmed 2026-05-21), so the router-worker indirection is
+// the cleanest available pattern.
+//
+// The CLI enforces the multi-CF-account safety drill (read /accounts/{id}
+// and assert `result.name` matches the per-site expected name) before
+// any write. Aborts loudly on mismatch.
+//
+// Exit codes (engineering-pa-core/docs/standards/tooling.md §6):
+//   0 ok | 1 usage error | 2 operational failure | 3 transport/IO failure
+
+import { runSet } from './commands/set.mjs';
+import { runUnset } from './commands/unset.mjs';
+import { runStatus } from './commands/status.mjs';
+import { runList } from './commands/list.mjs';
+
+const HELP = `pa staging-alias — canonical staging.<site> alias for CF-hosted sites
+
+Usage:
+  pa staging-alias set --site <hostname> --branch <branch> [--version <id>]
+      Wire staging.<hostname> to the source worker's latest preview
+      version (or the explicit --version). Idempotent — re-runs flip
+      the alias to a new branch's preview cleanly.
+
+  pa staging-alias unset --site <hostname> [--keep-worker]
+      Remove the staging.<hostname> binding and delete the router worker.
+      --keep-worker leaves the router script in place (binding still
+      removed).
+
+  pa staging-alias status --site <hostname>
+      Show current target (router worker, STAGING_TARGET, custom-domain
+      binding) for one site. JSON on stdout.
+
+  pa staging-alias list
+      Across every registered site, the current staging target. JSON
+      array on stdout.
+
+  pa staging-alias -h, --help
+      Show this help.
+
+How it works:
+  staging.<hostname>  --CF Custom Domain-->  <site>-staging worker
+                                              \\__ proxies STAGING_TARGET
+                                                  (the workers.dev preview URL)
+
+Multi-account safety:
+  Every write runs the 6-step CF-account drill. Vault keys are picked from
+  a per-site lookup table; the CLI then reads /accounts/{id} and aborts
+  unless result.name matches the site's expected account name.
+
+Registered sites: stravica.ai, cliveelliott.net, besafetraining.co.uk.
+Add a fourth via src/staging-alias/sites.mjs (one entry).
+`;
+
+export async function run(argv, overrides = {}) {
+  const verb = argv[0];
+  const rest = argv.slice(1);
+  if (!verb || verb === '--help' || verb === '-h' || verb === 'help') {
+    process.stdout.write(HELP);
+    return verb ? 0 : 1;
+  }
+  switch (verb) {
+    case 'set':    return runSet(rest, overrides);
+    case 'unset':  return runUnset(rest, overrides);
+    case 'status': return runStatus(rest, overrides);
+    case 'list':   return runList(rest, overrides);
+    default: {
+      process.stderr.write(`[pa staging-alias] unknown verb: ${verb}\n`);
+      process.stderr.write(HELP);
+      return 1;
+    }
+  }
+}
+
+export async function main(argv, overrides = {}) {
+  try {
+    const code = await run(argv, overrides);
+    return code ?? 0;
+  } catch (err) {
+    const code = err && typeof err.exitCode === 'number' ? err.exitCode : 2;
+    if (!err || err.exitCode == null) {
+      process.stderr.write(`pa staging-alias: ${err && err.message ? err.message : err}\n`);
+    }
+    return code;
+  }
+}

package/dist/engineering-pa-cli/src/staging-alias/cloudflare.mjs

@@ -0,0 +1,380 @@
+// cloudflare.mjs — Cloudflare API helpers for staging-alias.
+//
+// Builds on the lower-level `cfFetch` from src/gsc/cloudflare.mjs. The
+// added surface here is the set of operations the staging-alias CLI
+// performs:
+//
+//   - verifyAccount(creds, expectedName)        — the safety drill
+//   - listWorkerVersions(creds, worker)         — to pick "latest" for --branch
+//   - resolveZoneId(creds, zoneName)            — re-exported from gsc helpers
+//   - listWorkerDomains(creds, worker)          — for status + idempotency
+//   - bindWorkerCustomDomain(creds, …)          — bind hostname → router worker
+//   - unbindWorkerCustomDomain(creds, domainId) — remove the binding
+//   - uploadRouterWorker(creds, name, target)   — push the router worker w/ env
+//   - workerScriptExists(creds, name)           — for idempotent ensure
+//   - resolveAccountSubdomain(creds)            — for the workers.dev URL
+//
+// The router worker is a tiny proxy. Its source is built into this module
+// (no separate file to ship) so the CLI is self-contained.
+
+import { cfFetch, resolveZoneId } from '../gsc/cloudflare.mjs';
+
+export { cfFetch, resolveZoneId };
+
+/**
+ * Read /accounts/{account_id} and assert the display name matches.
+ * Throws with exitCode=2 on mismatch — this is the load-bearing safety
+ * drill per `feedback_cf_multi_account_discipline.md`.
+ *
+ * Returns the verified account object so the caller can echo it.
+ *
+ * @param {{token: string, accountId: string}} creds
+ * @param {string} expectedName
+ * @param {Function} [fetchImpl]
+ */
+export async function verifyAccount(creds, expectedName, fetchImpl) {
+  const body = await cfFetch(
+    creds.token,
+    `/accounts/${creds.accountId}`,
+    {},
+    fetchImpl,
+  );
+  const actual = body && body.result && body.result.name;
+  if (!actual) {
+    throw Object.assign(
+      new Error(`CF /accounts/${creds.accountId} returned no result.name (got ${JSON.stringify(body).slice(0, 200)})`),
+      { exitCode: 2 },
+    );
+  }
+  if (actual !== expectedName) {
+    throw Object.assign(
+      new Error(
+        `CF account-name mismatch — refusing to write.\n` +
+        `  account_id     : ${creds.accountId}\n` +
+        `  expected name  : ${expectedName}\n` +
+        `  actual name    : ${actual}\n` +
+        `Check that the vault keys you loaded match the site you are operating on ` +
+        `(see operator/knowledge/systems/web-properties/).`,
+      ),
+      { exitCode: 2 },
+    );
+  }
+  return { id: body.result.id, name: actual };
+}
+
+/**
+ * Read the account-level workers.dev subdomain (e.g. `barry-ab9`). Used to
+ * build the preview-URL the router worker proxies to.
+ */
+export async function resolveAccountSubdomain(creds, fetchImpl) {
+  const body = await cfFetch(
+    creds.token,
+    `/accounts/${creds.accountId}/workers/subdomain`,
+    {},
+    fetchImpl,
+  );
+  const subdomain = body && body.result && body.result.subdomain;
+  if (!subdomain) {
+    throw Object.assign(
+      new Error('CF account has no workers.dev subdomain. Enable it in the dashboard.'),
+      { exitCode: 2 },
+    );
+  }
+  return subdomain;
+}
+
+/**
+ * List Worker versions for `worker`, newest-first. Returns the parsed
+ * result.items array (limited by CF default page size).
+ *
+ * Throws with exitCode=1 when the worker doesn't exist.
+ */
+export async function listWorkerVersions(creds, worker, fetchImpl) {
+  try {
+    const body = await cfFetch(
+      creds.token,
+      `/accounts/${creds.accountId}/workers/scripts/${encodeURIComponent(worker)}/versions`,
+      {},
+      fetchImpl,
+    );
+    return (body.result && body.result.items) || [];
+  } catch (e) {
+    if (e.status === 404) {
+      throw Object.assign(
+        new Error(`Worker "${worker}" not found in account ${creds.accountId}.`),
+        { exitCode: 1 },
+      );
+    }
+    throw e;
+  }
+}
+
+/**
+ * Return the version-id prefix used to build the workers.dev preview URL.
+ * CF documents the preview URL as `<version-id-prefix>-<worker>.<subdomain>.workers.dev`
+ * with the prefix being the first 8 chars of the full UUID, OR (more
+ * recently) the first hyphen-separated segment. We use the first 8 chars,
+ * which matches both formats since UUIDs begin with 8 hex chars.
+ */
+export function versionPreviewPrefix(versionId) {
+  const s = String(versionId || '');
+  // UUID first segment is 8 hex chars.
+  const m = s.match(/^[0-9a-f]{8}/i);
+  if (!m) {
+    throw Object.assign(
+      new Error(`version_id "${s}" is not a valid UUID prefix`),
+      { exitCode: 1 },
+    );
+  }
+  return m[0];
+}
+
+/**
+ * Build the workers.dev preview URL for a (version, worker, subdomain) trio.
+ *   https://<prefix>-<worker>.<subdomain>.workers.dev
+ */
+export function previewHostname(versionId, worker, subdomain) {
+  const prefix = versionPreviewPrefix(versionId);
+  return `${prefix}-${worker}.${subdomain}.workers.dev`;
+}
+
+/**
+ * List Worker domains (Custom Domains bound to the script). Returns the
+ * result array, possibly empty.
+ */
+export async function listWorkerDomains(creds, worker, fetchImpl) {
+  const q = new URLSearchParams({ service: worker });
+  const body = await cfFetch(
+    creds.token,
+    `/accounts/${creds.accountId}/workers/domains?${q.toString()}`,
+    {},
+    fetchImpl,
+  );
+  return body.result || [];
+}
+
+/**
+ * Find a Worker domain binding by hostname (case-insensitive). Returns
+ * the binding object or null. Used for idempotency.
+ */
+export async function findWorkerDomain(creds, hostname, fetchImpl) {
+  const target = String(hostname || '').toLowerCase();
+  const body = await cfFetch(
+    creds.token,
+    `/accounts/${creds.accountId}/workers/domains`,
+    {},
+    fetchImpl,
+  );
+  const list = body.result || [];
+  return list.find((d) => String(d.hostname || '').toLowerCase() === target) || null;
+}
+
+/**
+ * Bind a hostname to a Worker as a Custom Domain. Idempotent: if the
+ * binding already exists pointing at the same worker, returns
+ * { action: 'unchanged', record }.
+ */
+export async function bindWorkerCustomDomain(creds, hostname, worker, zoneId, fetchImpl) {
+  const existing = await findWorkerDomain(creds, hostname, fetchImpl);
+  if (existing) {
+    if (existing.service === worker) {
+      return { action: 'unchanged', record: existing };
+    }
+    // Different worker — rebinding is a delete + create rather than
+    // an update; the CF API does not expose a PATCH on this resource.
+    await cfFetch(
+      creds.token,
+      `/accounts/${creds.accountId}/workers/domains/${existing.id}`,
+      { method: 'DELETE' },
+      fetchImpl,
+    );
+  }
+  const body = await cfFetch(
+    creds.token,
+    `/accounts/${creds.accountId}/workers/domains`,
+    {
+      method: 'PUT',
+      body: JSON.stringify({
+        environment: 'production',
+        hostname,
+        service: worker,
+        zone_id: zoneId,
+      }),
+    },
+    fetchImpl,
+  );
+  return { action: existing ? 'rebound' : 'created', record: body.result };
+}
+
+/**
+ * Remove a Worker Custom Domain binding by hostname. Idempotent — no-op
+ * when nothing is bound.
+ */
+export async function unbindWorkerCustomDomain(creds, hostname, fetchImpl) {
+  const existing = await findWorkerDomain(creds, hostname, fetchImpl);
+  if (!existing) return { action: 'unchanged' };
+  await cfFetch(
+    creds.token,
+    `/accounts/${creds.accountId}/workers/domains/${existing.id}`,
+    { method: 'DELETE' },
+    fetchImpl,
+  );
+  return { action: 'deleted', record: existing };
+}
+
+/**
+ * Check whether a Worker script exists in the account.
+ */
+export async function workerScriptExists(creds, worker, fetchImpl) {
+  try {
+    await cfFetch(
+      creds.token,
+      `/accounts/${creds.accountId}/workers/scripts/${encodeURIComponent(worker)}`,
+      {},
+      fetchImpl,
+    );
+    return true;
+  } catch (e) {
+    if (e.status === 404) return false;
+    throw e;
+  }
+}
+
+/**
+ * Router-worker source. Reads `STAGING_TARGET` from env (set per-version
+ * via the script binding) and proxies the incoming request through.
+ *
+ * Two important details:
+ *   1. We preserve the request method, headers, body, and pathname/query
+ *      so the staging hostname is fully transparent.
+ *   2. We strip the `Host:` header on the outgoing fetch so the upstream
+ *      Worker sees its own hostname (and the assets handler picks the
+ *      right file). The fetch API does this implicitly when we change
+ *      the URL host, but we set it explicitly for clarity.
+ */
+export const ROUTER_SOURCE = String.raw`// staging-router — proxies staging.<site> -> STAGING_TARGET workers.dev URL.
+// Generated by @stravica-ai/engineering-pa-cli (pa staging-alias).
+export default {
+  async fetch(request, env, ctx) {
+    const target = env && env.STAGING_TARGET;
+    if (!target) {
+      return new Response('staging-router: STAGING_TARGET not configured', { status: 503 });
+    }
+    const inUrl = new URL(request.url);
+    const outUrl = new URL(inUrl.pathname + inUrl.search, 'https://' + target);
+    const init = {
+      method: request.method,
+      headers: new Headers(request.headers),
+      redirect: 'manual',
+    };
+    init.headers.delete('host');
+    if (!/^(GET|HEAD)$/i.test(request.method)) {
+      init.body = request.body;
+    }
+    const upstream = await fetch(outUrl.toString(), init);
+    return new Response(upstream.body, {
+      status: upstream.status,
+      statusText: upstream.statusText,
+      headers: upstream.headers,
+    });
+  },
+};
+`;
+
+/**
+ * Upload the router worker with `STAGING_TARGET` bound to the given target
+ * hostname. Uses the modules-format multipart upload.
+ *
+ * `compatibility_date` defaults to 2026-05-21 — the day this CLI was
+ * written. Workers Builds normally pins a date; we pin ours so the
+ * router behaves consistently regardless of when it was first deployed.
+ *
+ * Returns { etag, deployedTarget }.
+ */
+export async function uploadRouterWorker(creds, worker, targetHost, fetchImpl, opts = {}) {
+  const compatDate = opts.compatibilityDate || '2026-05-21';
+  const metadata = {
+    main_module: 'worker.mjs',
+    compatibility_date: compatDate,
+    bindings: [
+      { type: 'plain_text', name: 'STAGING_TARGET', text: targetHost },
+    ],
+  };
+  const form = new FormData();
+  form.set('metadata', new Blob([JSON.stringify(metadata)], { type: 'application/json' }));
+  form.set(
+    'worker.mjs',
+    new Blob([ROUTER_SOURCE], { type: 'application/javascript+module' }),
+    'worker.mjs',
+  );
+  const fetchFn = fetchImpl || globalThis.fetch;
+  const url = `https://api.cloudflare.com/client/v4/accounts/${creds.accountId}/workers/scripts/${encodeURIComponent(worker)}`;
+  const res = await fetchFn(url, {
+    method: 'PUT',
+    headers: { Authorization: `Bearer ${creds.token}` },
+    body: form,
+  });
+  const text = await res.text();
+  let body;
+  try { body = text ? JSON.parse(text) : {}; } catch {
+    throw Object.assign(
+      new Error(`CF worker upload: non-JSON response (HTTP ${res.status}): ${text.slice(0, 200)}`),
+      { exitCode: 3 },
+    );
+  }
+  if (!res.ok || body.success === false) {
+    const detail = (body.errors || []).map((e) => `${e.code}: ${e.message}`).join('; ')
+      || `HTTP ${res.status}`;
+    throw Object.assign(
+      new Error(`CF worker upload PUT /workers/scripts/${worker} failed: ${detail}`),
+      { exitCode: 2, status: res.status, body },
+    );
+  }
+  return {
+    etag: body.result && body.result.etag,
+    deployedTarget: targetHost,
+  };
+}
+
+/**
+ * Delete a Worker script entirely. Used by `unset` to clean up the
+ * router worker. Idempotent: 404 is treated as success.
+ */
+export async function deleteWorkerScript(creds, worker, fetchImpl) {
+  try {
+    await cfFetch(
+      creds.token,
+      `/accounts/${creds.accountId}/workers/scripts/${encodeURIComponent(worker)}?force=true`,
+      { method: 'DELETE' },
+      fetchImpl,
+    );
+    return { action: 'deleted' };
+  } catch (e) {
+    if (e.status === 404) return { action: 'unchanged' };
+    throw e;
+  }
+}
+
+/**
+ * Read the current `STAGING_TARGET` binding on the router worker by
+ * fetching its settings. Returns null when the worker doesn't exist
+ * or the binding is absent.
+ */
+export async function readRouterTarget(creds, worker, fetchImpl) {
+  let body;
+  try {
+    body = await cfFetch(
+      creds.token,
+      `/accounts/${creds.accountId}/workers/scripts/${encodeURIComponent(worker)}/settings`,
+      {},
+      fetchImpl,
+    );
+  } catch (e) {
+    if (e.status === 404) return null;
+    throw e;
+  }
+  const bindings = (body.result && body.result.bindings) || [];
+  const target = bindings.find((b) => b && b.name === 'STAGING_TARGET');
+  if (!target) return null;
+  return target.text || target.value || null;
+}

package/dist/engineering-pa-cli/src/staging-alias/commands/list.mjs

@@ -0,0 +1,36 @@
+// list.mjs — `pa staging-alias list`
+//
+// Status across all registered sites. Per-site failures are surfaced as
+// `error` fields on the entry rather than aborting the whole listing.
+
+import { allSites } from '../sites.mjs';
+import { loadCloudflareCreds } from '../../gsc/cloudflare.mjs';
+import { buildStatus } from './status.mjs';
+
+export async function runList(args, overrides = {}) {
+  if (args.length > 0) {
+    process.stderr.write(`[staging-alias list] unexpected arguments: ${args.join(' ')}\n`);
+    return 1;
+  }
+  const out = overrides.stdout || process.stdout;
+  const entries = [];
+
+  for (const site of allSites()) {
+    try {
+      const creds = await loadCloudflareCreds({ ...overrides, account: site.accountKey });
+      const report = await buildStatus(site, creds, overrides.fetchImpl);
+      entries.push(report);
+    } catch (e) {
+      entries.push({
+        site: site.hostname,
+        staging: `staging.${site.hostname}`,
+        accountKey: site.accountKey,
+        error: e.message,
+      });
+    }
+  }
+
+  out.write(JSON.stringify(entries, null, 2) + '\n');
+  // Any per-site error -> exit 2 so CI/operators notice.
+  return entries.some((e) => e.error || e.accountWarning) ? 2 : 0;
+}