@reddoorla/maintenance 0.85.1 → 0.86.0

package/dist/{github-signals-G4ILZAJ6.js → github-signals-IJUPGCUX.js}

@@ -3,30 +3,30 @@ import {
 } from "./chunk-PZQ3WED2.js";
 import {
   formatFleetWriteSummary
-} from "./chunk-3YXDSCM6.js";
-import "./chunk-PBWDDDQH.js";
+} from "./chunk-PPE5KZJK.js";
+import "./chunk-KTH5ZODA.js";
 import {
   detectSignalEvents,
   fleetSweptEvent
 } from "./chunk-5L3FPQIJ.js";
+import {
+  openBase,
+  readAirtableConfig
+} from "./chunk-HN6I2XWI.js";
 import {
   makeGitHub
-} from "./chunk-VRWUL4TR.js";
+} from "./chunk-XHHMM5HX.js";
 import {
   recordFleetEventsBestEffort
-} from "./chunk-QG6OSL4M.js";
-import "./chunk-DC5H7KEQ.js";
-import "./chunk-4SOCPK7A.js";
-import "./chunk-4DHQCN5H.js";
+} from "./chunk-XUGSZP7Z.js";
+import "./chunk-JHGHLKFS.js";
+import "./chunk-3SF7D4DY.js";
+import "./chunk-LBYOLBW7.js";
 import {
   listWebsites,
   siteSlug,
   updateGitHubSignals
-} from "./chunk-577HCGZO.js";
-import {
-  openBase,
-  readAirtableConfig
-} from "./chunk-HN6I2XWI.js";
+} from "./chunk-LDWZSLSU.js";
 import "./chunk-6VAL7XJT.js";
 
 // src/audits/github-signals.ts
@@ -59,7 +59,7 @@ async function collectGitHubSignals(sites, deps, onSkip = () => {
 function githubSignalsExitCode(written, failed) {
   return failed > written ? 1 : 0;
 }
-async function runGitHubSignalsCommand(opts) {
+async function runGitHubSignalsCommand(opts, deps = {}) {
   if (!opts.fleet || !opts.writeAirtable) {
     return { output: "github-signals currently supports only --fleet --write-airtable", code: 2 };
   }
@@ -70,9 +70,9 @@ async function runGitHubSignalsCommand(opts) {
       code: 0
     };
   }
-  const base = openBase(readAirtableConfig());
+  const base = deps.openBase ? deps.openBase() : openBase(readAirtableConfig());
   const websites = await listWebsites(base);
-  const gh = makeGitHub({ token });
+  const gh = deps.makeGh ? deps.makeGh(token) : makeGitHub({ token });
   const sites = websites.map((w) => ({
     path: "",
     name: w.name,
@@ -89,7 +89,16 @@ async function runGitHubSignalsCommand(opts) {
     ({ repo }) => skipped.push(repo)
   );
   const sweptAt = (/* @__PURE__ */ new Date()).toISOString();
-  const result = { written: [], failed: [] };
+  const makeMirror = deps.makeMirror ?? (async () => {
+    const { makeHealthMirrorBestEffort } = await import("./health-mirror-4B2L7T2Y.js");
+    return makeHealthMirrorBestEffort();
+  });
+  const mirror = await makeMirror();
+  const result = {
+    written: [],
+    failed: [],
+    ...mirror ? { mirrored: 0, mirrorFailed: 0, mirrorMissed: 0 } : {}
+  };
   const byRepo = new Map(websites.filter((w) => w.gitRepo).map((w) => [w.gitRepo, w]));
   const events = [];
   const sweptMs = Date.parse(sweptAt);
@@ -101,12 +110,24 @@ async function runGitHubSignalsCommand(opts) {
       continue;
     }
     try {
-      await updateGitHubSignals(base, target.id, {
+      const ghFields = await updateGitHubSignals(base, target.id, {
         renovateFailingCis: row.renovateFailingCis,
         ciState: row.ciState,
         lastCommitAt: row.lastCommitAt,
         sweptAt
       });
+      if (mirror) {
+        try {
+          if (await mirror(target.id, ghFields)) {
+            result.mirrored = (result.mirrored ?? 0) + 1;
+          } else {
+            result.mirrorMissed = (result.mirrorMissed ?? 0) + 1;
+          }
+        } catch (e) {
+          result.mirrorFailed = (result.mirrorFailed ?? 0) + 1;
+          console.error(`[health-mirror] ${target.name}: ${e.message}`);
+        }
+      }
       result.written.push({
         siteName: target.name,
         writes: [{ audit: "github-signals", counts: row }]
@@ -124,7 +145,7 @@ async function runGitHubSignalsCommand(opts) {
   }
   for (const repo of skipped) result.failed.push({ slug: repo, error: "probe failed (skipped)" });
   events.push(fleetSweptEvent("github-signals", result.written.length, sweptAt));
-  await recordFleetEventsBestEffort(events, /* @__PURE__ */ new Date());
+  await (deps.recordEvents ?? recordFleetEventsBestEffort)(events, /* @__PURE__ */ new Date());
   return {
     output: formatFleetWriteSummary(result),
     code: githubSignalsExitCode(result.written.length, result.failed.length)
@@ -134,4 +155,4 @@ export {
   githubSignalsExitCode,
   runGitHubSignalsCommand
 };
-//# sourceMappingURL=github-signals-G4ILZAJ6.js.map
+//# sourceMappingURL=github-signals-IJUPGCUX.js.map

package/dist/github-signals-IJUPGCUX.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/audits/github-signals.ts","../src/cli/commands/github-signals.ts"],"sourcesContent":["import type { Site } from \"../types.js\";\nimport type { CiState, PullRequestSummary } from \"../github/gh.js\";\nimport { isFailingRenovatePR } from \"../alerts/renovate.js\";\n\n/** One swept row, ready for the Airtable writer (slug-keyed by `site`). */\nexport type GitHubSignalsRow = {\n  site: string; // the site name/slug the writer matches on\n  repo: string; // owner/repo\n  renovateFailingCis: number;\n  ciState: CiState;\n  lastCommitAt: string | null;\n};\n\n/** Injected GitHub reads (so the sweep is pure + testable). */\nexport type GitHubSignalsDeps = {\n  openPullRequests: (repo: string) => Promise<PullRequestSummary[]>;\n  defaultBranchStatus: (repo: string) => Promise<{ ciState: CiState; lastCommitAt: string | null }>;\n};\n\n/** Per repo-backed site: count its failing Renovate PRs + read its default-branch\n *  status. Sites without `gitRepo` are skipped (not errors). A repo whose probe\n *  throws is reported via `onSkip` and produces no row — one GitHub hiccup never\n *  sinks the sweep. PURE over `deps`. */\nexport async function collectGitHubSignals(\n  sites: Site[],\n  deps: GitHubSignalsDeps,\n  onSkip: (s: { repo: string }) => void = () => {},\n): Promise<GitHubSignalsRow[]> {\n  const rows: GitHubSignalsRow[] = [];\n  for (const s of sites) {\n    const repo = s.gitRepo;\n    if (!repo) continue;\n    const name = s.name;\n    if (!name) continue;\n    try {\n      const prs = await deps.openPullRequests(repo);\n      const status = await deps.defaultBranchStatus(repo);\n      rows.push({\n        site: name,\n        repo,\n        renovateFailingCis: prs.filter(isFailingRenovatePR).length,\n        ciState: status.ciState,\n        lastCommitAt: status.lastCommitAt,\n      });\n    } catch {\n      onSkip({ repo });\n    }\n  }\n  return rows;\n}\n","import { openBase, readAirtableConfig, type AirtableBase } from \"../../reports/airtable/client.js\";\nimport { listWebsites, siteSlug, updateGitHubSignals } from \"../../reports/airtable/websites.js\";\nimport type { Site } from \"../../types.js\";\nimport { collectGitHubSignals } from \"../../audits/github-signals.js\";\nimport { makeGitHub, type GitHub } from \"../../github/gh.js\";\nimport {\n  formatFleetWriteSummary,\n  type FleetWriteResult,\n} from \"../../audits/write-audits-to-airtable.js\";\nimport { detectSignalEvents, fleetSweptEvent } from \"../../audits/fleet-event-detectors.js\";\nimport { recordFleetEventsBestEffort } from \"../../audits/fleet-events-writer.js\";\nimport type { FleetEvent } from \"../../db/fleet-events.js\";\nimport type { HealthMirror } from \"../../audits/health-mirror.js\";\n\n/** The slice of the GitHub client this sweep actually probes. */\ntype GhProbes = Pick<\n  GitHub,\n  \"openPullRequests\" | \"defaultBranchStatus\" | \"mergedRenovatePullRequests\"\n>;\n\n/** Injectable wiring for {@link runGitHubSignalsCommand}. Every default is the\n *  real fleet path; tests override to reach the per-row write+mirror loop —\n *  the hand-rolled `makeHealthMirrorBestEffort()` call made that loop\n *  untestable (no test could prove a mirror throw stays out of `failed`, that\n *  the counters increment the right way round, or that the mirror sees the\n *  same payload Airtable got). Same seam shape as\n *  `writeFleetAuditsToAirtable`'s `mirror` argument. */\nexport type GitHubSignalsDeps = {\n  /** Airtable base (default: real creds via readAirtableConfig). */\n  openBase: () => AirtableBase;\n  /** GitHub probe client for the fleet token (default: makeGitHub). */\n  makeGh: (token: string) => GhProbes;\n  /** Turso mirror factory (default: makeHealthMirrorBestEffort — null without\n   *  libSQL creds, leaving the Airtable sweep byte-for-byte unchanged). */\n  makeMirror: () => Promise<HealthMirror | null>;\n  /** Fleet-activity recorder (default: recordFleetEventsBestEffort). */\n  recordEvents: (events: FleetEvent[], now: Date) => Promise<void>;\n};\n\n/** Exit code for a fleet github-signals run. Exit 1 when failures are the\n *  MAJORITY of the fleet (`failed > written`), not only on a total wipeout —\n *  a run where 11/12 repos failed but 1 wrote should still signal an outage.\n *  All-success or a minority of flakes (e.g. 1/12 failed) stays exit 0. The\n *  no-token clean-skip returns 0 separately (before any probe runs). */\nexport function githubSignalsExitCode(written: number, failed: number): number {\n  return failed > written ? 1 : 0;\n}\n\n/** `github-signals --fleet --write-airtable`: sweep every repo-backed site for its\n *  Renovate-failing count + default-branch CI state + last-commit date, write each\n *  row serially (Airtable ~5 req/sec), and emit FLEET_WRITE_SUMMARY for CI. A\n *  missing fleet token is a clean skip (local runs), not a failure. */\nexport async function runGitHubSignalsCommand(\n  opts: {\n    fleet?: boolean | undefined;\n    writeAirtable?: boolean | undefined;\n  },\n  deps: Partial<GitHubSignalsDeps> = {},\n): Promise<{ output: string; code: number }> {\n  if (!opts.fleet || !opts.writeAirtable) {\n    return { output: \"github-signals currently supports only --fleet --write-airtable\", code: 2 };\n  }\n  const token = process.env.RENOVATE_TOKEN?.trim() || process.env.GH_TOKEN?.trim();\n  if (!token) {\n    return {\n      output: \"github-signals skipped: no RENOVATE_TOKEN/GH_TOKEN (fleet read) configured.\",\n      code: 0,\n    };\n  }\n  const base = deps.openBase ? deps.openBase() : openBase(readAirtableConfig());\n  const websites = await listWebsites(base);\n  const gh: GhProbes = deps.makeGh ? deps.makeGh(token) : makeGitHub({ token });\n  const sites: Site[] = websites.map((w) => ({\n    path: \"\",\n    name: w.name,\n    meta: {},\n    ...(w.gitRepo ? { gitRepo: w.gitRepo } : {}),\n  }));\n\n  const skipped: string[] = [];\n  const rows = await collectGitHubSignals(\n    sites,\n    {\n      openPullRequests: (r) => gh.openPullRequests(r),\n      defaultBranchStatus: (r) => gh.defaultBranchStatus(r),\n    },\n    ({ repo }) => skipped.push(repo),\n  );\n\n  const sweptAt = new Date().toISOString();\n  // Phase 3 dual-write (#539): mirror each row's written FieldSet into\n  // site_health. Null when libSQL creds are absent — the Airtable sweep\n  // proceeds exactly as before. (Dynamic import so the no-mirror path never\n  // loads the db client.)\n  const makeMirror =\n    deps.makeMirror ??\n    (async () => {\n      const { makeHealthMirrorBestEffort } = await import(\"../../audits/health-mirror.js\");\n      return makeHealthMirrorBestEffort();\n    });\n  const mirror = await makeMirror();\n  const result: FleetWriteResult = {\n    written: [],\n    failed: [],\n    ...(mirror ? { mirrored: 0, mirrorFailed: 0, mirrorMissed: 0 } : {}),\n  };\n  const byRepo = new Map(websites.filter((w) => w.gitRepo).map((w) => [w.gitRepo, w]));\n  const events: FleetEvent[] = [];\n  const sweptMs = Date.parse(sweptAt);\n  const since24h = new Date(sweptMs - 24 * 60 * 60 * 1000).toISOString();\n  // Serial: Airtable's ~5 req/sec limit (matches writeFleetAuditsToAirtable).\n  for (const row of rows) {\n    const target = byRepo.get(row.repo);\n    if (!target) {\n      result.failed.push({ slug: siteSlug(row.site), error: \"no Websites row matched\" });\n      continue;\n    }\n    try {\n      const ghFields = await updateGitHubSignals(base, target.id, {\n        renovateFailingCis: row.renovateFailingCis,\n        ciState: row.ciState,\n        lastCommitAt: row.lastCommitAt,\n        sweptAt,\n      });\n      if (mirror) {\n        // Count, never throw: a Turso blip must not move an Airtable-written\n        // row into `failed` (that would red the sweep via githubSignalsExitCode\n        // on a fleet-wide mirror outage). A 0-row match (site not yet imported)\n        // is a miss, not a mirror — see FleetWriteResult.mirrorMissed.\n        try {\n          if (await mirror(target.id, ghFields)) {\n            result.mirrored = (result.mirrored ?? 0) + 1;\n          } else {\n            result.mirrorMissed = (result.mirrorMissed ?? 0) + 1;\n          }\n        } catch (e) {\n          result.mirrorFailed = (result.mirrorFailed ?? 0) + 1;\n          console.error(`[health-mirror] ${target.name}: ${(e as Error).message}`);\n        }\n      }\n      result.written.push({\n        siteName: target.name,\n        writes: [{ audit: \"github-signals\", counts: row }],\n      });\n      // Fleet-activity events for this repo: merged Renovate PRs since the last sweep\n      // (watermark = the row's prior GitHub Signals At, else a 24h fallback) + a\n      // CI-recovered transition. A PR-fetch hiccup drops only this repo's PR events.\n      const since = target.githubSignalsAt ?? since24h;\n      let merged: Awaited<ReturnType<typeof gh.mergedRenovatePullRequests>> = [];\n      try {\n        merged = await gh.mergedRenovatePullRequests(row.repo, since);\n      } catch {\n        // PR list unavailable this run — skip pr_automerged for this repo, keep ci_recovered\n      }\n      events.push(...detectSignalEvents(target, row, merged, sweptAt));\n    } catch (e) {\n      result.failed.push({ slug: siteSlug(row.site), error: (e as Error).message });\n    }\n  }\n  for (const repo of skipped) result.failed.push({ slug: repo, error: \"probe failed (skipped)\" });\n\n  events.push(fleetSweptEvent(\"github-signals\", result.written.length, sweptAt));\n  await (deps.recordEvents ?? recordFleetEventsBestEffort)(events, new Date());\n\n  // Exit non-zero when failures are the MAJORITY of the fleet, not only on a\n  // total wipeout. A run where 11/12 repos failed but 1 wrote used to return 0,\n  // masking a large outage. The nightly cron step is `continue-on-error`, so a\n  // non-zero here is an operator-visibility signal, not a red build.\n  return {\n    output: formatFleetWriteSummary(result),\n    code: githubSignalsExitCode(result.written.length, result.failed.length),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuBA,eAAsB,qBACpB,OACA,MACA,SAAwC,MAAM;AAAC,GAClB;AAC7B,QAAM,OAA2B,CAAC;AAClC,aAAW,KAAK,OAAO;AACrB,UAAM,OAAO,EAAE;AACf,QAAI,CAAC,KAAM;AACX,UAAM,OAAO,EAAE;AACf,QAAI,CAAC,KAAM;AACX,QAAI;AACF,YAAM,MAAM,MAAM,KAAK,iBAAiB,IAAI;AAC5C,YAAM,SAAS,MAAM,KAAK,oBAAoB,IAAI;AAClD,WAAK,KAAK;AAAA,QACR,MAAM;AAAA,QACN;AAAA,QACA,oBAAoB,IAAI,OAAO,mBAAmB,EAAE;AAAA,QACpD,SAAS,OAAO;AAAA,QAChB,cAAc,OAAO;AAAA,MACvB,CAAC;AAAA,IACH,QAAQ;AACN,aAAO,EAAE,KAAK,CAAC;AAAA,IACjB;AAAA,EACF;AACA,SAAO;AACT;;;ACLO,SAAS,sBAAsB,SAAiB,QAAwB;AAC7E,SAAO,SAAS,UAAU,IAAI;AAChC;AAMA,eAAsB,wBACpB,MAIA,OAAmC,CAAC,GACO;AAC3C,MAAI,CAAC,KAAK,SAAS,CAAC,KAAK,eAAe;AACtC,WAAO,EAAE,QAAQ,mEAAmE,MAAM,EAAE;AAAA,EAC9F;AACA,QAAM,QAAQ,QAAQ,IAAI,gBAAgB,KAAK,KAAK,QAAQ,IAAI,UAAU,KAAK;AAC/E,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,MAAM;AAAA,IACR;AAAA,EACF;AACA,QAAM,OAAO,KAAK,WAAW,KAAK,SAAS,IAAI,SAAS,mBAAmB,CAAC;AAC5E,QAAM,WAAW,MAAM,aAAa,IAAI;AACxC,QAAM,KAAe,KAAK,SAAS,KAAK,OAAO,KAAK,IAAI,WAAW,EAAE,MAAM,CAAC;AAC5E,QAAM,QAAgB,SAAS,IAAI,CAAC,OAAO;AAAA,IACzC,MAAM;AAAA,IACN,MAAM,EAAE;AAAA,IACR,MAAM,CAAC;AAAA,IACP,GAAI,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5C,EAAE;AAEF,QAAM,UAAoB,CAAC;AAC3B,QAAM,OAAO,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,MACE,kBAAkB,CAAC,MAAM,GAAG,iBAAiB,CAAC;AAAA,MAC9C,qBAAqB,CAAC,MAAM,GAAG,oBAAoB,CAAC;AAAA,IACtD;AAAA,IACA,CAAC,EAAE,KAAK,MAAM,QAAQ,KAAK,IAAI;AAAA,EACjC;AAEA,QAAM,WAAU,oBAAI,KAAK,GAAE,YAAY;AAKvC,QAAM,aACJ,KAAK,eACJ,YAAY;AACX,UAAM,EAAE,2BAA2B,IAAI,MAAM,OAAO,6BAA+B;AACnF,WAAO,2BAA2B;AAAA,EACpC;AACF,QAAM,SAAS,MAAM,WAAW;AAChC,QAAM,SAA2B;AAAA,IAC/B,SAAS,CAAC;AAAA,IACV,QAAQ,CAAC;AAAA,IACT,GAAI,SAAS,EAAE,UAAU,GAAG,cAAc,GAAG,cAAc,EAAE,IAAI,CAAC;AAAA,EACpE;AACA,QAAM,SAAS,IAAI,IAAI,SAAS,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;AACnF,QAAM,SAAuB,CAAC;AAC9B,QAAM,UAAU,KAAK,MAAM,OAAO;AAClC,QAAM,WAAW,IAAI,KAAK,UAAU,KAAK,KAAK,KAAK,GAAI,EAAE,YAAY;AAErE,aAAW,OAAO,MAAM;AACtB,UAAM,SAAS,OAAO,IAAI,IAAI,IAAI;AAClC,QAAI,CAAC,QAAQ;AACX,aAAO,OAAO,KAAK,EAAE,MAAM,SAAS,IAAI,IAAI,GAAG,OAAO,0BAA0B,CAAC;AACjF;AAAA,IACF;AACA,QAAI;AACF,YAAM,WAAW,MAAM,oBAAoB,MAAM,OAAO,IAAI;AAAA,QAC1D,oBAAoB,IAAI;AAAA,QACxB,SAAS,IAAI;AAAA,QACb,cAAc,IAAI;AAAA,QAClB;AAAA,MACF,CAAC;AACD,UAAI,QAAQ;AAKV,YAAI;AACF,cAAI,MAAM,OAAO,OAAO,IAAI,QAAQ,GAAG;AACrC,mBAAO,YAAY,OAAO,YAAY,KAAK;AAAA,UAC7C,OAAO;AACL,mBAAO,gBAAgB,OAAO,gBAAgB,KAAK;AAAA,UACrD;AAAA,QACF,SAAS,GAAG;AACV,iBAAO,gBAAgB,OAAO,gBAAgB,KAAK;AACnD,kBAAQ,MAAM,mBAAmB,OAAO,IAAI,KAAM,EAAY,OAAO,EAAE;AAAA,QACzE;AAAA,MACF;AACA,aAAO,QAAQ,KAAK;AAAA,QAClB,UAAU,OAAO;AAAA,QACjB,QAAQ,CAAC,EAAE,OAAO,kBAAkB,QAAQ,IAAI,CAAC;AAAA,MACnD,CAAC;AAID,YAAM,QAAQ,OAAO,mBAAmB;AACxC,UAAI,SAAoE,CAAC;AACzE,UAAI;AACF,iBAAS,MAAM,GAAG,2BAA2B,IAAI,MAAM,KAAK;AAAA,MAC9D,QAAQ;AAAA,MAER;AACA,aAAO,KAAK,GAAG,mBAAmB,QAAQ,KAAK,QAAQ,OAAO,CAAC;AAAA,IACjE,SAAS,GAAG;AACV,aAAO,OAAO,KAAK,EAAE,MAAM,SAAS,IAAI,IAAI,GAAG,OAAQ,EAAY,QAAQ,CAAC;AAAA,IAC9E;AAAA,EACF;AACA,aAAW,QAAQ,QAAS,QAAO,OAAO,KAAK,EAAE,MAAM,MAAM,OAAO,yBAAyB,CAAC;AAE9F,SAAO,KAAK,gBAAgB,kBAAkB,OAAO,QAAQ,QAAQ,OAAO,CAAC;AAC7E,SAAO,KAAK,gBAAgB,6BAA6B,QAAQ,oBAAI,KAAK,CAAC;AAM3E,SAAO;AAAA,IACL,QAAQ,wBAAwB,MAAM;AAAA,IACtC,MAAM,sBAAsB,OAAO,QAAQ,QAAQ,OAAO,OAAO,MAAM;AAAA,EACzE;AACF;","names":[]}

package/dist/{header-image-T7XD37JL.js → header-image-AWLLQA4L.js}

@@ -1,18 +1,18 @@
 import {
   generateHeaderImage
-} from "./chunk-37S6L6G4.js";
+} from "./chunk-5UINJNAJ.js";
 import {
   uploadAttachment
-} from "./chunk-MPBXOJ3N.js";
-import {
-  ACTIVE_STATUSES,
-  listWebsites,
-  siteSlug
-} from "./chunk-577HCGZO.js";
+} from "./chunk-Z7AXYKQB.js";
 import {
   openBase,
   readAirtableConfig
 } from "./chunk-HN6I2XWI.js";
+import {
+  ACTIVE_STATUSES,
+  listWebsites,
+  siteSlug
+} from "./chunk-LDWZSLSU.js";
 import "./chunk-6VAL7XJT.js";
 
 // src/cli/commands/header-image.ts
@@ -57,9 +57,25 @@ async function generateForTargets(targets, opts, generate = generateHeaderImage)
         ...settleMs === void 0 ? {} : { settleMs }
       });
       if (opts.writeAirtable) {
-        await uploadAttachment(row.id, "Header image", gen.bytes, gen.filename, gen.contentType);
+        await uploadAttachment(row.id, "Header image", gen.bytes, gen.filename, gen.contentType, {
+          replaceIn: "Websites"
+        });
+        let stored = "";
+        if (opts.storeDb) {
+          try {
+            await opts.storeDb(row.id, {
+              bytes: gen.bytes,
+              filename: gen.filename,
+              contentType: gen.contentType,
+              generatedAt: (/* @__PURE__ */ new Date()).toISOString()
+            });
+            stored = " + turso";
+          } catch (err) {
+            stored = ` (\u26A0 turso store FAILED: ${err instanceof Error ? err.message : String(err)})`;
+          }
+        }
         lines.push(
-          `\u2714 ${row.name} \u2014 uploaded ${gen.filename} (${(gen.bytes.byteLength / 1024 / 1024).toFixed(2)} MB)`
+          `\u2714 ${row.name} \u2014 uploaded ${gen.filename} (${(gen.bytes.byteLength / 1024 / 1024).toFixed(2)} MB)${stored}`
         );
       } else {
         const path = resolve(outDir, gen.filename);
@@ -84,7 +100,14 @@ async function runHeaderImageCommand(site, opts) {
       code: 1
     };
   }
-  return generateForTargets(targets, opts);
+  let withStore = opts;
+  if (opts.writeAirtable && !opts.storeDb && process.env.TURSO_DATABASE_URL) {
+    const { openDb, readDbConfig } = await import("./client-AUE3XUPO.js");
+    const { storeHeaderImage } = await import("./header-images-335L2AKB.js");
+    const db = await openDb(readDbConfig());
+    withStore = { ...opts, storeDb: (id, img) => storeHeaderImage(db, id, img) };
+  }
+  return generateForTargets(targets, withStore);
 }
 export {
   generateForTargets,
@@ -92,4 +115,4 @@ export {
   resolveTargets,
   runHeaderImageCommand
 };
-//# sourceMappingURL=header-image-T7XD37JL.js.map
+//# sourceMappingURL=header-image-AWLLQA4L.js.map

package/dist/header-image-AWLLQA4L.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli/commands/header-image.ts"],"sourcesContent":["import { mkdir, writeFile } from \"node:fs/promises\";\nimport { resolve } from \"node:path\";\nimport { openBase, readAirtableConfig } from \"../../reports/airtable/client.js\";\nimport { listWebsites, siteSlug, ACTIVE_STATUSES } from \"../../reports/airtable/websites.js\";\nimport type { WebsiteRow } from \"../../reports/airtable/websites.js\";\nimport { uploadAttachment } from \"../../reports/airtable/attachments.js\";\nimport { generateHeaderImage } from \"../../reports/header-image/index.js\";\nimport type { StoredHeaderImage } from \"../../db/header-images.js\";\n\nexport type HeaderImageOptions = {\n  all?: boolean;\n  force?: boolean;\n  writeAirtable?: boolean;\n  outDir?: string;\n  settleMs?: string;\n  /** Injected Turso store for the dual-write (#539, design D5): while Airtable\n   *  is still written (until the Phase 5 freeze), every upload ALSO lands the\n   *  bytes in sites.header_image* so the Turso read layer serves a real image.\n   *  Absent → Airtable-only (a local run without Turso env still works). */\n  storeDb?: (siteId: string, img: StoredHeaderImage) => Promise<void>;\n};\n\n/** Which rows this invocation should act on. Pure, so it is unit-tested. */\nexport function resolveTargets(\n  rows: readonly WebsiteRow[],\n  // `| undefined` spelled out because `exactOptionalPropertyTypes` otherwise\n  // rejects the caller passing through possibly-undefined CLI flags.\n  opts: { site?: string | undefined; all?: boolean | undefined; force?: boolean | undefined },\n): WebsiteRow[] {\n  if (opts.site) {\n    const want = siteSlug(opts.site);\n    return rows.filter((r) => siteSlug(r.name) === want);\n  }\n  if (!opts.all) return [];\n  return rows.filter((r) => {\n    if (!r.url) return false;\n    if (r.status === null || !ACTIVE_STATUSES.has(r.status)) return false;\n    return opts.force ? true : !r.headerImage;\n  });\n}\n\n/** Parse the `--settle-ms <ms>` flag. Unset → undefined (the generator's own\n *  default settle). `Number(\"abc\")` is NaN, which would sail through as a NaN\n *  timeout and silently skip the settle entirely, so anything non-finite or\n *  negative is rejected up front rather than producing a subtly-wrong capture. */\nexport function parseSettleMs(value: string | undefined): number | undefined {\n  if (value === undefined) return undefined;\n  const n = Number(value);\n  if (!Number.isFinite(n) || n < 0) {\n    throw Object.assign(\n      new Error(`--settle-ms must be a non-negative number of milliseconds, got \"${value}\"`),\n      { exitCode: 2 },\n    );\n  }\n  return n;\n}\n\n/** Injected in tests so the file-writing branch can be exercised without\n *  driving a real browser (mirrors `GenerateInput.shooter`). */\ntype Generate = typeof generateHeaderImage;\n\n/**\n * Generate a header image per target row and either upload it to Airtable or\n * write it locally for review. Split out of {@link runHeaderImageCommand} so\n * the local-output path is testable without an Airtable base.\n */\nexport async function generateForTargets(\n  targets: readonly WebsiteRow[],\n  opts: HeaderImageOptions,\n  generate: Generate = generateHeaderImage,\n): Promise<{ output: string; code: number }> {\n  const outDir = resolve(opts.outDir ?? \"reports\");\n  const settleMs = parseSettleMs(opts.settleMs);\n  // `reports/` does not exist on a fresh checkout, so the writeFile() below\n  // would throw ENOENT for the first operator to run the default (local) path.\n  // Create it once, before the loop, rather than per site.\n  if (!opts.writeAirtable) await mkdir(outDir, { recursive: true });\n\n  const lines: string[] = [];\n  let failed = 0;\n\n  for (const row of targets) {\n    try {\n      const gen = await generate({\n        url: row.url,\n        slug: siteSlug(row.name),\n        // `exactOptionalPropertyTypes` rejects an explicit `settleMs: undefined`\n        // against `settleMs?: number`, so omit the key entirely when unset.\n        ...(settleMs === undefined ? {} : { settleMs }),\n      });\n      if (opts.writeAirtable) {\n        // replaceIn: the field must hold exactly the current header — see\n        // uploadAttachment, where appending left readers on a stale [0].\n        await uploadAttachment(row.id, \"Header image\", gen.bytes, gen.filename, gen.contentType, {\n          replaceIn: \"Websites\",\n        });\n        let stored = \"\";\n        if (opts.storeDb) {\n          // Dual-write. A Turso failure must not void the Airtable upload —\n          // but it must be VISIBLE, never a silent divergence.\n          try {\n            await opts.storeDb(row.id, {\n              bytes: gen.bytes,\n              filename: gen.filename,\n              contentType: gen.contentType,\n              generatedAt: new Date().toISOString(),\n            });\n            stored = \" + turso\";\n          } catch (err) {\n            stored = ` (⚠ turso store FAILED: ${err instanceof Error ? err.message : String(err)})`;\n          }\n        }\n        lines.push(\n          `✔ ${row.name} — uploaded ${gen.filename} (${(gen.bytes.byteLength / 1024 / 1024).toFixed(2)} MB)${stored}`,\n        );\n      } else {\n        const path = resolve(outDir, gen.filename);\n        await writeFile(path, gen.bytes);\n        lines.push(`✔ ${row.name} — wrote ${path} (review, then re-run with --write-airtable)`);\n      }\n    } catch (err) {\n      failed++;\n      lines.push(`✖ ${row.name} — ${err instanceof Error ? err.message : String(err)}`);\n    }\n  }\n\n  lines.push(`${targets.length - failed}/${targets.length} generated.`);\n  return { output: lines.join(\"\\n\"), code: failed > 0 ? 1 : 0 };\n}\n\n/**\n * `header-image [site]` — capture a site's live homepage and composite its\n * report header image. Defaults to writing the JPEG locally so the operator can\n * eyeball it; `--write-airtable` uploads it to the Websites row's Header image\n * field. `--all` backfills every live site that has no header image yet.\n */\nexport async function runHeaderImageCommand(\n  site: string | undefined,\n  opts: HeaderImageOptions,\n): Promise<{ output: string; code: number }> {\n  const base = openBase(readAirtableConfig());\n  const rows = await listWebsites(base);\n  const targets = resolveTargets(rows, { site, all: opts.all, force: opts.force });\n  if (targets.length === 0) {\n    return {\n      output: site ? `No site matched \"${site}\".` : \"No sites need a header image.\",\n      code: 1,\n    };\n  }\n  // Wire the Turso dual-write when the env is present; a local run without it\n  // still works Airtable-only (the store is per-site error-isolated above).\n  let withStore = opts;\n  if (opts.writeAirtable && !opts.storeDb && process.env.TURSO_DATABASE_URL) {\n    const { openDb, readDbConfig } = await import(\"../../db/client.js\");\n    const { storeHeaderImage } = await import(\"../../db/header-images.js\");\n    const db = await openDb(readDbConfig());\n    withStore = { ...opts, storeDb: (id, img) => storeHeaderImage(db, id, img) };\n  }\n  return generateForTargets(targets, withStore);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA,SAAS,OAAO,iBAAiB;AACjC,SAAS,eAAe;AAsBjB,SAAS,eACd,MAGA,MACc;AACd,MAAI,KAAK,MAAM;AACb,UAAM,OAAO,SAAS,KAAK,IAAI;AAC/B,WAAO,KAAK,OAAO,CAAC,MAAM,SAAS,EAAE,IAAI,MAAM,IAAI;AAAA,EACrD;AACA,MAAI,CAAC,KAAK,IAAK,QAAO,CAAC;AACvB,SAAO,KAAK,OAAO,CAAC,MAAM;AACxB,QAAI,CAAC,EAAE,IAAK,QAAO;AACnB,QAAI,EAAE,WAAW,QAAQ,CAAC,gBAAgB,IAAI,EAAE,MAAM,EAAG,QAAO;AAChE,WAAO,KAAK,QAAQ,OAAO,CAAC,EAAE;AAAA,EAChC,CAAC;AACH;AAMO,SAAS,cAAc,OAA+C;AAC3E,MAAI,UAAU,OAAW,QAAO;AAChC,QAAM,IAAI,OAAO,KAAK;AACtB,MAAI,CAAC,OAAO,SAAS,CAAC,KAAK,IAAI,GAAG;AAChC,UAAM,OAAO;AAAA,MACX,IAAI,MAAM,mEAAmE,KAAK,GAAG;AAAA,MACrF,EAAE,UAAU,EAAE;AAAA,IAChB;AAAA,EACF;AACA,SAAO;AACT;AAWA,eAAsB,mBACpB,SACA,MACA,WAAqB,qBACsB;AAC3C,QAAM,SAAS,QAAQ,KAAK,UAAU,SAAS;AAC/C,QAAM,WAAW,cAAc,KAAK,QAAQ;AAI5C,MAAI,CAAC,KAAK,cAAe,OAAM,MAAM,QAAQ,EAAE,WAAW,KAAK,CAAC;AAEhE,QAAM,QAAkB,CAAC;AACzB,MAAI,SAAS;AAEb,aAAW,OAAO,SAAS;AACzB,QAAI;AACF,YAAM,MAAM,MAAM,SAAS;AAAA,QACzB,KAAK,IAAI;AAAA,QACT,MAAM,SAAS,IAAI,IAAI;AAAA;AAAA;AAAA,QAGvB,GAAI,aAAa,SAAY,CAAC,IAAI,EAAE,SAAS;AAAA,MAC/C,CAAC;AACD,UAAI,KAAK,eAAe;AAGtB,cAAM,iBAAiB,IAAI,IAAI,gBAAgB,IAAI,OAAO,IAAI,UAAU,IAAI,aAAa;AAAA,UACvF,WAAW;AAAA,QACb,CAAC;AACD,YAAI,SAAS;AACb,YAAI,KAAK,SAAS;AAGhB,cAAI;AACF,kBAAM,KAAK,QAAQ,IAAI,IAAI;AAAA,cACzB,OAAO,IAAI;AAAA,cACX,UAAU,IAAI;AAAA,cACd,aAAa,IAAI;AAAA,cACjB,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,YACtC,CAAC;AACD,qBAAS;AAAA,UACX,SAAS,KAAK;AACZ,qBAAS,gCAA2B,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,UACtF;AAAA,QACF;AACA,cAAM;AAAA,UACJ,UAAK,IAAI,IAAI,oBAAe,IAAI,QAAQ,MAAM,IAAI,MAAM,aAAa,OAAO,MAAM,QAAQ,CAAC,CAAC,OAAO,MAAM;AAAA,QAC3G;AAAA,MACF,OAAO;AACL,cAAM,OAAO,QAAQ,QAAQ,IAAI,QAAQ;AACzC,cAAM,UAAU,MAAM,IAAI,KAAK;AAC/B,cAAM,KAAK,UAAK,IAAI,IAAI,iBAAY,IAAI,8CAA8C;AAAA,MACxF;AAAA,IACF,SAAS,KAAK;AACZ;AACA,YAAM,KAAK,UAAK,IAAI,IAAI,WAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAAA,IAClF;AAAA,EACF;AAEA,QAAM,KAAK,GAAG,QAAQ,SAAS,MAAM,IAAI,QAAQ,MAAM,aAAa;AACpE,SAAO,EAAE,QAAQ,MAAM,KAAK,IAAI,GAAG,MAAM,SAAS,IAAI,IAAI,EAAE;AAC9D;AAQA,eAAsB,sBACpB,MACA,MAC2C;AAC3C,QAAM,OAAO,SAAS,mBAAmB,CAAC;AAC1C,QAAM,OAAO,MAAM,aAAa,IAAI;AACpC,QAAM,UAAU,eAAe,MAAM,EAAE,MAAM,KAAK,KAAK,KAAK,OAAO,KAAK,MAAM,CAAC;AAC/E,MAAI,QAAQ,WAAW,GAAG;AACxB,WAAO;AAAA,MACL,QAAQ,OAAO,oBAAoB,IAAI,OAAO;AAAA,MAC9C,MAAM;AAAA,IACR;AAAA,EACF;AAGA,MAAI,YAAY;AAChB,MAAI,KAAK,iBAAiB,CAAC,KAAK,WAAW,QAAQ,IAAI,oBAAoB;AACzE,UAAM,EAAE,QAAQ,aAAa,IAAI,MAAM,OAAO,sBAAoB;AAClE,UAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,6BAA2B;AACrE,UAAM,KAAK,MAAM,OAAO,aAAa,CAAC;AACtC,gBAAY,EAAE,GAAG,MAAM,SAAS,CAAC,IAAI,QAAQ,iBAAiB,IAAI,IAAI,GAAG,EAAE;AAAA,EAC7E;AACA,SAAO,mBAAmB,SAAS,SAAS;AAC9C;","names":[]}

package/dist/header-images-335L2AKB.js

@@ -0,0 +1,68 @@
+// src/db/header-images.ts
+async function storeHeaderImage(db, siteId, image) {
+  await db.updateTable("sites").set({
+    header_image: image.bytes,
+    header_image_filename: image.filename,
+    header_image_type: image.contentType,
+    header_image_generated_at: image.generatedAt
+  }).where("id", "=", siteId).execute();
+}
+function headerImageAttachment(rec) {
+  const atts = rec.fields["Header image"];
+  const a = atts?.at(-1);
+  return a && typeof a.url === "string" && a.url.length > 0 ? {
+    url: a.url,
+    filename: typeof a.filename === "string" ? a.filename : "header-image",
+    type: typeof a.type === "string" ? a.type : "application/octet-stream"
+  } : null;
+}
+async function backfillHeaderImages(db, io) {
+  const records = await io.listWebsiteRecords();
+  const populated = new Set(
+    (await db.selectFrom("sites").select("id").where("header_image", "is not", null).execute()).map(
+      (r) => r.id
+    )
+  );
+  const result = { stored: 0, skipped: 0, absent: 0, failed: [] };
+  for (const rec of records) {
+    const att = headerImageAttachment(rec);
+    if (!att) {
+      result.absent++;
+      continue;
+    }
+    if (populated.has(rec.id)) {
+      result.skipped++;
+      continue;
+    }
+    const bytes = await io.fetchBytes(att.url);
+    if (bytes === null) {
+      result.failed.push(rec.id);
+      continue;
+    }
+    await storeHeaderImage(db, rec.id, {
+      bytes,
+      filename: att.filename,
+      contentType: att.type,
+      generatedAt: null
+    });
+    result.stored++;
+  }
+  return result;
+}
+function formatBackfillResult(r) {
+  const lines = [];
+  if (r.failed.length > 0) {
+    lines.push(`\u26A0 ${r.failed.length} attachment fetch(es) failed: ${r.failed.join(", ")}`);
+  }
+  lines.push(
+    `HEADER_IMAGE_BACKFILL stored=${r.stored} skipped=${r.skipped} absent=${r.absent} failed=${r.failed.length}`
+  );
+  return lines.join("\n");
+}
+export {
+  backfillHeaderImages,
+  formatBackfillResult,
+  headerImageAttachment,
+  storeHeaderImage
+};
+//# sourceMappingURL=header-images-335L2AKB.js.map

package/dist/header-images-335L2AKB.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/db/header-images.ts"],"sourcesContent":["/** Header images move to Turso (#539, design D5 completed).\n *\n *  Since Phase 1 the schema has reserved `sites.header_image*` as the image's\n *  home — the importer deliberately never touches those columns — but nothing\n *  wrote them, so the read layer's `headerImage` was null fleet-wide and both\n *  cockpit preflight and approve-report stayed pinned to the Airtable reader.\n *  Two writers close that:\n *\n *  - `storeHeaderImage` — the shared write, used by the header-image CLI's\n *    dual-write (Airtable upload + Turso store, until Phase 5 freezes Airtable)\n *    and by the backfill.\n *  - `backfillHeaderImages` — one-shot: copy every site's CURRENT Airtable\n *    attachment into Turso. Idempotent — a site whose BLOB is already\n *    populated is skipped, so re-runs never clobber a freshly generated image\n *    with a stale Airtable copy. Emits its machine line on EVERY run.\n */\nimport type { Db } from \"./client.js\";\nimport type { RawRecord } from \"./import-airtable.js\";\n\nexport type StoredHeaderImage = {\n  bytes: Uint8Array;\n  filename: string;\n  contentType: string;\n  /** The generator's stamp; null for a backfilled copy (a backfill is not a\n   *  generation — the column keeps meaning \"when the generator made it\"). */\n  generatedAt: string | null;\n};\n\nexport async function storeHeaderImage(\n  db: Db,\n  siteId: string,\n  image: StoredHeaderImage,\n): Promise<void> {\n  await db\n    .updateTable(\"sites\")\n    .set({\n      header_image: image.bytes,\n      header_image_filename: image.filename,\n      header_image_type: image.contentType,\n      header_image_generated_at: image.generatedAt,\n    })\n    .where(\"id\", \"=\", siteId)\n    .execute();\n}\n\ntype Attachment = { url: string; filename: string; type: string };\n\n/** NEWEST \"Header image\" attachment of a raw Websites record, or null.\n *\n *  The tail, not the head: Airtable's uploadAttachment APPENDS, so a field that ever\n *  held more than one file served its OLDEST image from `[0]` forever — see the note\n *  in `reports/airtable/websites.ts` and #574/#577. Kept in step with that reader so\n *  the Turso mirror and the send path can never disagree about which file is current. */\nexport function headerImageAttachment(rec: RawRecord): Attachment | null {\n  const atts = rec.fields[\"Header image\"] as Array<Partial<Attachment>> | undefined;\n  const a = atts?.at(-1);\n  return a && typeof a.url === \"string\" && a.url.length > 0\n    ? {\n        url: a.url,\n        filename: typeof a.filename === \"string\" ? a.filename : \"header-image\",\n        type: typeof a.type === \"string\" ? a.type : \"application/octet-stream\",\n      }\n    : null;\n}\n\nexport type BackfillIo = {\n  listWebsiteRecords: () => Promise<RawRecord[]>;\n  /** Fetch attachment bytes; null on failure (named in the summary, not fatal). */\n  fetchBytes: (url: string) => Promise<Uint8Array | null>;\n};\n\nexport type BackfillResult = {\n  stored: number;\n  /** Sites whose BLOB was already populated — never overwritten. */\n  skipped: number;\n  /** Sites with no Airtable attachment at all. */\n  absent: number;\n  /** Record ids whose attachment fetch failed — named, never silent. */\n  failed: string[];\n};\n\nexport async function backfillHeaderImages(db: Db, io: BackfillIo): Promise<BackfillResult> {\n  const records = await io.listWebsiteRecords();\n  const populated = new Set(\n    (await db.selectFrom(\"sites\").select(\"id\").where(\"header_image\", \"is not\", null).execute()).map(\n      (r) => r.id,\n    ),\n  );\n  const result: BackfillResult = { stored: 0, skipped: 0, absent: 0, failed: [] };\n  for (const rec of records) {\n    const att = headerImageAttachment(rec);\n    if (!att) {\n      result.absent++;\n      continue;\n    }\n    if (populated.has(rec.id)) {\n      result.skipped++;\n      continue;\n    }\n    const bytes = await io.fetchBytes(att.url);\n    if (bytes === null) {\n      result.failed.push(rec.id);\n      continue;\n    }\n    await storeHeaderImage(db, rec.id, {\n      bytes,\n      filename: att.filename,\n      contentType: att.type,\n      generatedAt: null,\n    });\n    result.stored++;\n  }\n  return result;\n}\n\n/** Human lines + the machine line, emitted on every run (count=0 included). */\nexport function formatBackfillResult(r: BackfillResult): string {\n  const lines: string[] = [];\n  if (r.failed.length > 0) {\n    lines.push(`⚠ ${r.failed.length} attachment fetch(es) failed: ${r.failed.join(\", \")}`);\n  }\n  lines.push(\n    `HEADER_IMAGE_BACKFILL stored=${r.stored} skipped=${r.skipped} absent=${r.absent} failed=${r.failed.length}`,\n  );\n  return lines.join(\"\\n\");\n}\n"],"mappings":";AA4BA,eAAsB,iBACpB,IACA,QACA,OACe;AACf,QAAM,GACH,YAAY,OAAO,EACnB,IAAI;AAAA,IACH,cAAc,MAAM;AAAA,IACpB,uBAAuB,MAAM;AAAA,IAC7B,mBAAmB,MAAM;AAAA,IACzB,2BAA2B,MAAM;AAAA,EACnC,CAAC,EACA,MAAM,MAAM,KAAK,MAAM,EACvB,QAAQ;AACb;AAUO,SAAS,sBAAsB,KAAmC;AACvE,QAAM,OAAO,IAAI,OAAO,cAAc;AACtC,QAAM,IAAI,MAAM,GAAG,EAAE;AACrB,SAAO,KAAK,OAAO,EAAE,QAAQ,YAAY,EAAE,IAAI,SAAS,IACpD;AAAA,IACE,KAAK,EAAE;AAAA,IACP,UAAU,OAAO,EAAE,aAAa,WAAW,EAAE,WAAW;AAAA,IACxD,MAAM,OAAO,EAAE,SAAS,WAAW,EAAE,OAAO;AAAA,EAC9C,IACA;AACN;AAkBA,eAAsB,qBAAqB,IAAQ,IAAyC;AAC1F,QAAM,UAAU,MAAM,GAAG,mBAAmB;AAC5C,QAAM,YAAY,IAAI;AAAA,KACnB,MAAM,GAAG,WAAW,OAAO,EAAE,OAAO,IAAI,EAAE,MAAM,gBAAgB,UAAU,IAAI,EAAE,QAAQ,GAAG;AAAA,MAC1F,CAAC,MAAM,EAAE;AAAA,IACX;AAAA,EACF;AACA,QAAM,SAAyB,EAAE,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC,EAAE;AAC9E,aAAW,OAAO,SAAS;AACzB,UAAM,MAAM,sBAAsB,GAAG;AACrC,QAAI,CAAC,KAAK;AACR,aAAO;AACP;AAAA,IACF;AACA,QAAI,UAAU,IAAI,IAAI,EAAE,GAAG;AACzB,aAAO;AACP;AAAA,IACF;AACA,UAAM,QAAQ,MAAM,GAAG,WAAW,IAAI,GAAG;AACzC,QAAI,UAAU,MAAM;AAClB,aAAO,OAAO,KAAK,IAAI,EAAE;AACzB;AAAA,IACF;AACA,UAAM,iBAAiB,IAAI,IAAI,IAAI;AAAA,MACjC;AAAA,MACA,UAAU,IAAI;AAAA,MACd,aAAa,IAAI;AAAA,MACjB,aAAa;AAAA,IACf,CAAC;AACD,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAGO,SAAS,qBAAqB,GAA2B;AAC9D,QAAM,QAAkB,CAAC;AACzB,MAAI,EAAE,OAAO,SAAS,GAAG;AACvB,UAAM,KAAK,UAAK,EAAE,OAAO,MAAM,iCAAiC,EAAE,OAAO,KAAK,IAAI,CAAC,EAAE;AAAA,EACvF;AACA,QAAM;AAAA,IACJ,gCAAgC,EAAE,MAAM,YAAY,EAAE,OAAO,WAAW,EAAE,MAAM,WAAW,EAAE,OAAO,MAAM;AAAA,EAC5G;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;","names":[]}

package/dist/{health-endpoint-242WG2OJ.js → health-endpoint-WJC2UMYS.js}

@@ -5,20 +5,20 @@ import {
   appendSkipNotice,
   fleetWorkdir,
   prepareFleetSites
-} from "./chunk-ZMIPG6TR.js";
+} from "./chunk-TVL5MVUF.js";
 import {
   resolveSites
-} from "./chunk-7J53SUT6.js";
+} from "./chunk-P2FE5AI6.js";
 import {
   healthEndpoint
-} from "./chunk-R6FPFMOS.js";
+} from "./chunk-BQRFQSGY.js";
 import "./chunk-R53VL3RI.js";
-import "./chunk-ZTPPCHDB.js";
-import "./chunk-FDIFTIXC.js";
-import "./chunk-4DHQCN5H.js";
-import "./chunk-XXTZBPUY.js";
+import "./chunk-3G25KIWW.js";
+import "./chunk-6TWWY7ZU.js";
+import "./chunk-EVBCK2KC.js";
 import "./chunk-XTK5VIQB.js";
-import "./chunk-U5SZ4FOP.js";
+import "./chunk-LBYOLBW7.js";
+import "./chunk-XXTZBPUY.js";
 
 // src/cli/commands/health-endpoint.ts
 import { resolve } from "path";
@@ -51,4 +51,4 @@ async function runHealthEndpointCommand(site, opts) {
 export {
   runHealthEndpointCommand
 };
-//# sourceMappingURL=health-endpoint-242WG2OJ.js.map
+//# sourceMappingURL=health-endpoint-WJC2UMYS.js.map

package/dist/health-mirror-4B2L7T2Y.js

@@ -0,0 +1,75 @@
+import {
+  healthColumnFor,
+  scheduleColumnFor
+} from "./chunk-ITIOFN7A.js";
+import "./chunk-ACBRLLFT.js";
+import {
+  MAINTENANCE_CHECKLIST,
+  TESTING_CHECKLIST
+} from "./chunk-VAD43MOR.js";
+import {
+  openDb,
+  readDbConfig
+} from "./chunk-JHGHLKFS.js";
+import "./chunk-3SF7D4DY.js";
+import "./chunk-LDWZSLSU.js";
+import "./chunk-6VAL7XJT.js";
+
+// src/db/fleet-state.ts
+async function mirrorHealthFields(db, siteId, fields) {
+  const patch = {};
+  for (const [field, value] of Object.entries(fields)) {
+    const m = healthColumnFor(field);
+    if (!m)
+      throw new Error(`mirrorHealthFields: importer claims no site_health column for '${field}'`);
+    patch[m.col] = m.coerce(value);
+  }
+  if (Object.keys(patch).length === 0) return true;
+  const res = await db.updateTable("site_health").set(patch).where("site_id", "=", siteId).executeTakeFirst();
+  return res.numUpdatedRows > 0n;
+}
+async function mirrorScheduleFields(db, siteId, fields, computedAt) {
+  const patch = {};
+  for (const [field, value] of Object.entries(fields)) {
+    const m = scheduleColumnFor(field);
+    if (!m)
+      throw new Error(
+        `mirrorScheduleFields: importer claims no site_schedule column for '${field}'`
+      );
+    patch[m.col] = m.coerce(value);
+  }
+  if (Object.keys(patch).length === 0) return true;
+  patch.computed_at = computedAt;
+  const res = await db.updateTable("site_schedule").set(patch).where("site_id", "=", siteId).executeTakeFirst();
+  return res.numUpdatedRows > 0n;
+}
+var CHECKLIST_FIELD_BY_KEY = new Map(
+  [...MAINTENANCE_CHECKLIST, ...TESTING_CHECKLIST].map((i) => [i.key, i.field])
+);
+
+// src/audits/health-mirror.ts
+async function makeHealthMirrorBestEffort(open = () => openDb(readDbConfig())) {
+  let db;
+  try {
+    db = await open();
+  } catch (e) {
+    console.error(`[health-mirror] mirroring disabled: no libSQL (${String(e)})`);
+    return null;
+  }
+  return (siteId, fields) => mirrorHealthFields(db, siteId, fields);
+}
+async function makeScheduleMirrorBestEffort(open = () => openDb(readDbConfig())) {
+  let db;
+  try {
+    db = await open();
+  } catch (e) {
+    console.error(`[schedule-mirror] mirroring disabled: no libSQL (${String(e)})`);
+    return null;
+  }
+  return (siteId, fields, computedAt) => mirrorScheduleFields(db, siteId, fields, computedAt);
+}
+export {
+  makeHealthMirrorBestEffort,
+  makeScheduleMirrorBestEffort
+};
+//# sourceMappingURL=health-mirror-4B2L7T2Y.js.map

package/dist/health-mirror-4B2L7T2Y.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/db/fleet-state.ts","../src/audits/health-mirror.ts"],"sourcesContent":["/** Phase 2 of the Airtable → Turso migration (#539): the fleet-state READ layer.\n *\n *  Returns the exact `WebsiteRow` shape the Airtable module returns, so every\n *  repoint is an import-only swap at a composition root — the same trick\n *  listSubmissionsForSite used for the hybrid-db cutover. The raw values live\n *  in `sites`/`site_health`/`site_schedule` (written by the importer / hourly\n *  sync); coercion to `WebsiteRow` happens HERE, reusing the Airtable module's\n *  own exported coercers (`toVerdict`, `toFrequency`, `parseNotifyRouting`,\n *  `parseSecurityAdvisories`, `trimToNull`) so there is one truth for each.\n *\n *  The equivalence instrument (tests/db/fleet-state.test.ts) pins this module\n *  to `mapRow` field-by-field: for a fixture record, `mapRow(rec)` must deep-\n *  equal the row read back through here after an import. A new WebsiteRow\n *  field fails that test until this module carries it.\n *\n *  `headerImage` is the ONE deliberate exception (design D5): Airtable stopped\n *  being its source — the bytes belong in `sites.header_image*`. Nothing\n *  writes those columns yet (verified empty across all 44 prod rows,\n *  2026-08-24), so this reads null fleet-wide today, and approve-report — the\n *  only request-path consumer — stays on the Airtable reader until the\n *  header-image writer moves in Phase 3. The `url` is \"\" because the bytes\n *  live in the row itself, not behind a signed URL.\n */\nimport type { Selectable, Updateable } from \"kysely\";\nimport type { Db } from \"./client.js\";\nimport type { ReportsTable, SiteHealthTable, SiteScheduleTable } from \"./schema.js\";\nimport { SITE_FIELDS, healthColumnFor, scheduleColumnFor } from \"./import-airtable.js\";\nimport {\n  toReportType,\n  parseAutoEvidence,\n  type ReportRow,\n  type DeliveryStatus,\n} from \"../reports/airtable/reports.js\";\nimport { MAINTENANCE_CHECKLIST, TESTING_CHECKLIST } from \"../reports/checklist.js\";\nimport type { WebsiteRow } from \"../reports/airtable/websites.js\";\nimport { canonicalizeStatus } from \"../reports/airtable/site-status.js\";\nimport {\n  parseNotifyRouting,\n  parseSecurityAdvisories,\n  toFrequency,\n  toPrismicModelsVerdict,\n  toVerdict,\n  trimToNull,\n} from \"../reports/airtable/websites.js\";\n\ntype JoinedRow = Record<string, unknown>;\n\nconst str = (v: unknown): string | null => (typeof v === \"string\" ? v : null);\nconst num = (v: unknown): number | null => (typeof v === \"number\" ? v : null);\n/** Stored 1/0/null (importer's b01n) → boolean | null. */\nconst bool = (v: unknown): boolean | null => (typeof v === \"number\" ? v !== 0 : null);\n\n/** Stored JSON array (importer-normalized) → the trimmed string[] mapRow yields. */\nfunction parseAwc(raw: unknown): string[] {\n  if (typeof raw !== \"string\" || raw.trim() === \"\") return [];\n  try {\n    const parsed: unknown = JSON.parse(raw);\n    if (!Array.isArray(parsed)) return [];\n    return parsed\n      .filter((x): x is string => typeof x === \"string\")\n      .map((s) => s.trim())\n      .filter(Boolean);\n  } catch {\n    return [];\n  }\n}\n\nfunction rowFromJoined(r: JoinedRow): WebsiteRow {\n  const name = String(r.name ?? \"\");\n  const headerFilename = str(r.header_image_filename);\n  const headerType = str(r.header_image_type);\n  return {\n    id: String(r.id),\n    name,\n    url: str(r.url) ?? \"\",\n    // `sites.status` holds the RAW Airtable cell (the importer stores it verbatim\n    // so the hourly parity check compares raw-to-raw). Canonicalizing HERE — the\n    // twin of mapRow's seam — is what keeps the #558 equivalence instrument green.\n    status: canonicalizeStatus(r.status),\n    statusRaw: str(r.status),\n    pointOfContact: str(r.point_of_contact),\n    maintenanceFreq: toFrequency(r.maintenance_freq, `${name} maintenance`),\n    testingFreq: toFrequency(r.testing_freq, `${name} testing`),\n    maintenanceFreqRaw: str(r.maintenance_freq),\n    testingFreqRaw: str(r.testing_freq),\n    maintenanceDay: str(r.maintenance_day),\n    testingDay: str(r.testing_day),\n    ga4PropertyId: str(r.ga4_property_id),\n    searchQuery: str(r.search_query),\n    searchConsoleProperty: str(r.search_console_property),\n    analyticsSoftFailAt: str(r.analytics_soft_fail_at),\n    gitRepo: str(r.git_repo),\n    reportRecipientsTo: str(r.report_recipients_to),\n    reportRecipientsCc: str(r.report_recipients_cc),\n    acceptedWatchConditions: parseAwc(r.accepted_watch_conditions),\n    headerImage:\n      headerFilename !== null && headerType !== null\n        ? { url: \"\", filename: headerFilename, type: headerType }\n        : null,\n    pScore: num(r.p_score),\n    rScore: num(r.r_score),\n    bpScore: num(r.bp_score),\n    seoScore: num(r.seo_score),\n    lastLighthouseAuditAt: str(r.lighthouse_at),\n    a11yViolations: num(r.a11y_violations),\n    depsDrifted: num(r.deps_drifted),\n    depsMajorBehind: num(r.deps_major_behind),\n    depsOutdated: num(r.deps_outdated),\n    depsMajorOutdated: num(r.deps_major_outdated),\n    securityVulnsCritical: num(r.vulns_critical),\n    securityVulnsHigh: num(r.vulns_high),\n    securityVulnsModerate: num(r.vulns_moderate),\n    securityVulnsLow: num(r.vulns_low),\n    securityAutoFixAttempts: num(r.auto_fix_attempts),\n    lastSecurityAuditAt: str(r.security_audit_at),\n    securityAdvisories: parseSecurityAdvisories(r.security_advisories),\n    certDaysRemaining: num(r.cert_days_remaining),\n    domainCheckedAt: str(r.domain_checked_at),\n    netlifyId: trimToNull(r.netlify_id),\n    deployStatus: str(r.deploy_status),\n    lastDeployAt: str(r.last_deploy_at),\n    deployLogUrl: str(r.deploy_log_url),\n    deployCheckedAt: str(r.deploy_checked_at),\n    functionHealth: toVerdict(r.function_health),\n    cmsReachable: toVerdict(r.cms_reachable),\n    turnstileWidget: toVerdict(r.turnstile_widget),\n    functionHealthCheckedAt: str(r.function_health_checked_at),\n    crossbrowserOk: bool(r.crossbrowser_ok),\n    mobileOk: bool(r.mobile_ok),\n    linksOk: bool(r.links_ok),\n    brokenLinks: num(r.broken_links),\n    browserCheckedAt: str(r.browser_checked_at),\n    reachableOk: toVerdict(r.uptime_reachable),\n    titleMetaOk: toVerdict(r.titles_meta_ok),\n    copyIntro: trimToNull(r.copy_intro),\n    copyContact: trimToNull(r.copy_contact),\n    copyFooter: trimToNull(r.copy_footer),\n    launchedAt: str(r.launched_at),\n    newsletterWebhook: trimToNull(r.newsletter_webhook),\n    notifyRouting: parseNotifyRouting(r.notify_routing),\n    notifyRoutingRaw: trimToNull(r.notify_routing),\n    mailchimpApiKey: trimToNull(r.mailchimp_api_key),\n    mailchimpAudienceId: trimToNull(r.mailchimp_audience_id),\n    requireTurnstile: typeof r.require_turnstile === \"number\" ? r.require_turnstile !== 0 : false,\n    renovateFailingCis: num(r.renovate_failing_cis),\n    defaultBranchCi: str(r.default_branch_ci),\n    lastCommitAt: str(r.last_commit_at),\n    githubSignalsAt: str(r.github_signals_at),\n    smokeOk: toVerdict(r.smoke_ok),\n    lastSmokeAt: str(r.last_smoke_at),\n    formE2eOk: toVerdict(r.form_e2e_ok),\n    formE2eCheckedAt: str(r.form_e2e_checked_at),\n    prismicModels: toPrismicModelsVerdict(r.prismic_models),\n    prismicModelsCheckedAt: str(r.prismic_models_checked_at),\n    prismicModelsDrift: str(r.prismic_models_drift),\n    prismicAckUntil: str(r.prismic_ack_until),\n    nextMaintenanceAt: str(r.next_maintenance_at),\n    nextTestingAt: str(r.next_testing_at),\n  };\n}\n\n/** Every sites column EXCEPT the header-image BLOB. Since the 2026-08-24\n *  backfill, header_image holds 0.7–3.5 MB JPEGs — a selectAll would haul\n *  megabytes into every site lookup (per LEAD on the ingest path, ×44 on the\n *  fleet list) and Turso bills the bytes. WebsiteRow only needs the metadata\n *  columns; the bytes have their own dedicated readers when a consumer wants\n *  them. Kept in lockstep with SitesTable by the blob-exclusion test. */\nconst SITE_COLUMNS = [\n  \"sites.id\",\n  \"sites.slug\",\n  \"sites.name\",\n  \"sites.url\",\n  \"sites.status\",\n  \"sites.point_of_contact\",\n  \"sites.maintenance_freq\",\n  \"sites.testing_freq\",\n  \"sites.maintenance_day\",\n  \"sites.testing_day\",\n  \"sites.ga4_property_id\",\n  \"sites.search_query\",\n  \"sites.search_console_property\",\n  \"sites.git_repo\",\n  \"sites.netlify_id\",\n  \"sites.report_recipients_to\",\n  \"sites.report_recipients_cc\",\n  \"sites.copy_intro\",\n  \"sites.copy_contact\",\n  \"sites.copy_footer\",\n  \"sites.newsletter_webhook\",\n  \"sites.mailchimp_api_key\",\n  \"sites.mailchimp_audience_id\",\n  \"sites.notify_routing\",\n  \"sites.require_turnstile\",\n  \"sites.accepted_watch_conditions\",\n  \"sites.prismic_ack_until\",\n  \"sites.launched_at\",\n  \"sites.header_image_filename\",\n  \"sites.header_image_type\",\n  \"sites.header_image_generated_at\",\n  \"sites.legacy\",\n] as const;\n\n/** The three-table join every read composes from. site_health/site_schedule\n *  rows are upserted alongside sites by the importer, but LEFT JOIN anyway —\n *  a site row must never vanish from a surface because a health row is absent. */\nfunction joined(db: Db) {\n  return db\n    .selectFrom(\"sites\")\n    .leftJoin(\"site_health\", \"site_health.site_id\", \"sites.id\")\n    .leftJoin(\"site_schedule\", \"site_schedule.site_id\", \"sites.id\")\n    .select(SITE_COLUMNS)\n    .selectAll([\"site_health\", \"site_schedule\"]);\n}\n\n/** Write-through for the site-detail editor (Phase 2): after the Airtable\n *  write (still the Phase 2 source of truth), mirror the same cell into\n *  `sites` so a Turso-reading page renders the edit immediately instead of\n *  waiting for the next hourly sync. The column mapping is the IMPORTER's own\n *  map — one truth — and the value gets the importer's empty-clears-to-null\n *  semantics. Throws on a column the importer doesn't claim (the lockstep\n *  test makes that unreachable for the editor's allowlist); the caller treats\n *  a mirror failure as non-fatal — the hourly sync converges it.\n *\n *  Deliberately NOT applicable to `Require Turnstile` or other non-text\n *  columns: every editor field is plain text today, and the lockstep test\n *  pins that assumption. */\nexport async function mirrorSiteField(\n  db: Db,\n  siteId: string,\n  airtableColumn: string,\n  value: string,\n): Promise<void> {\n  const col = SITE_FIELDS[airtableColumn];\n  if (!col)\n    throw new Error(`mirrorSiteField: importer claims no sites column for '${airtableColumn}'`);\n  const stored = value.trim() === \"\" ? null : value;\n  await db\n    .updateTable(\"sites\")\n    .set({ [col]: stored })\n    .where(\"id\", \"=\", siteId)\n    .execute();\n}\n\n/** Write-through mirror for the nightly health writers (#539 Phase 3). Takes\n *  the EXACT FieldSet just written to Airtable (updateAuditFields /\n *  updateGitHubSignals return it), so the mirror can never carry a different\n *  payload than the Airtable write it shadows. Resolution + coercion come from\n *  the importer's healthColumnFor — one truth; an Airtable column no\n *  site_health column claims throws (same contract as mirrorSiteField).\n *  Partial by design: absent fields stay untouched, matching\n *  updateGitHubSignals' deliberate omission of a null lastCommitAt. Returns\n *  whether a site_health row matched: a site the hourly sync hasn't imported\n *  yet updates 0 rows → false, so the caller can count it honestly\n *  (mirror_missed) instead of claiming it mirrored — it still converges on the\n *  next sync, like every mirror. An empty FieldSet runs no SQL and returns\n *  true: nothing to mirror is not a miss. */\nexport async function mirrorHealthFields(\n  db: Db,\n  siteId: string,\n  fields: Record<string, unknown>,\n): Promise<boolean> {\n  // Per-column value types (number vs text) are guaranteed by healthColumnFor's\n  // coercion — the numeric/text split lives there, once — so the patch builds\n  // untyped and casts at the .set() boundary (the importer's own idiom).\n  const patch: Record<string, string | number | null> = {};\n  for (const [field, value] of Object.entries(fields)) {\n    const m = healthColumnFor(field);\n    if (!m)\n      throw new Error(`mirrorHealthFields: importer claims no site_health column for '${field}'`);\n    patch[m.col] = m.coerce(value);\n  }\n  if (Object.keys(patch).length === 0) return true;\n  const res = await db\n    .updateTable(\"site_health\")\n    .set(patch as Updateable<SiteHealthTable>)\n    .where(\"site_id\", \"=\", siteId)\n    .executeTakeFirst();\n  // kysely/libSQL reports numUpdatedRows as a BigInt — compare in BigInt.\n  return res.numUpdatedRows > 0n;\n}\n\n/** The site_schedule twin of {@link mirrorHealthFields}, for the nightly\n *  next-due write-back. `computedAt` stamps when THIS computation ran — the\n *  hourly sync overwrites it with its own import stamp, same as every mirrored\n *  value. Empty fields → full no-op (no lone computed_at stamp for a write\n *  that carried nothing). Same return contract as mirrorHealthFields: false\n *  when the UPDATE matched no site_schedule row (site not yet imported), true\n *  otherwise — including the empty-fields no-op. */\nexport async function mirrorScheduleFields(\n  db: Db,\n  siteId: string,\n  fields: Record<string, unknown>,\n  computedAt: string,\n): Promise<boolean> {\n  const patch: Record<string, string | null> = {};\n  for (const [field, value] of Object.entries(fields)) {\n    const m = scheduleColumnFor(field);\n    if (!m)\n      throw new Error(\n        `mirrorScheduleFields: importer claims no site_schedule column for '${field}'`,\n      );\n    patch[m.col] = m.coerce(value);\n  }\n  if (Object.keys(patch).length === 0) return true;\n  patch.computed_at = computedAt;\n  const res = await db\n    .updateTable(\"site_schedule\")\n    .set(patch as Updateable<SiteScheduleTable>)\n    .where(\"site_id\", \"=\", siteId)\n    .executeTakeFirst();\n  return res.numUpdatedRows > 0n;\n}\n\n/** Same contract as the Airtable getWebsiteBySlug: slug is siteSlug(Name),\n *  precomputed into the UNIQUE sites.slug column at import time. */\nexport async function getSiteBySlug(db: Db, slug: string): Promise<WebsiteRow | null> {\n  const r = await joined(db).where(\"sites.slug\", \"=\", slug).executeTakeFirst();\n  return r ? rowFromJoined(r as JoinedRow) : null;\n}\n\n/** By Airtable rec id (the PK) — approve-report's lookup shape. */\nexport async function getSiteById(db: Db, id: string): Promise<WebsiteRow | null> {\n  const r = await joined(db).where(\"sites.id\", \"=\", id).executeTakeFirst();\n  return r ? rowFromJoined(r as JoinedRow) : null;\n}\n\n/** Same contract as the Airtable listWebsites: every site, one row each.\n *  Name-ordered for determinism (Airtable returned table order; no consumer\n *  is order-sensitive — the cockpit groups and sorts itself). */\nexport async function listSites(db: Db): Promise<WebsiteRow[]> {\n  const rows = await joined(db).orderBy(\"sites.name\").execute();\n  return rows.map((r) => rowFromJoined(r as JoinedRow));\n}\n\n// ————————————————————————— reports —————————————————————————\n\n/** stable checklist key → Airtable column name. The importer stores stable keys\n *  (mapReportRecord); `ReportRow.checklist` exposes Airtable column names — one\n *  derived map, built from the checklist definitions themselves. */\nconst CHECKLIST_FIELD_BY_KEY: ReadonlyMap<string, string> = new Map(\n  [...MAINTENANCE_CHECKLIST, ...TESTING_CHECKLIST].map((i) => [i.key, i.field]),\n);\n\nfunction checklistFromStored(raw: string | null): Record<string, boolean> {\n  let stored: Record<string, unknown> = {};\n  if (typeof raw === \"string\" && raw.trim() !== \"\") {\n    try {\n      const parsed: unknown = JSON.parse(raw);\n      if (parsed && typeof parsed === \"object\" && !Array.isArray(parsed))\n        stored = parsed as Record<string, unknown>;\n    } catch {\n      // fall through to all-false — a bad blob must not throw the page\n    }\n  }\n  const out: Record<string, boolean> = {};\n  for (const [key, field] of CHECKLIST_FIELD_BY_KEY) out[field] = Boolean(stored[key]);\n  return out;\n}\n\nfunction reportRowFromDb(r: Selectable<ReportsTable>): ReportRow {\n  const p = r.lighthouse_performance;\n  const a = r.lighthouse_accessibility;\n  const b = r.lighthouse_best_practices;\n  const seo = r.lighthouse_seo;\n  const lighthouse =\n    typeof p === \"number\" &&\n    typeof a === \"number\" &&\n    typeof b === \"number\" &&\n    typeof seo === \"number\"\n      ? { performance: p, accessibility: a, bestPractices: b, seo }\n      : null;\n  return {\n    id: r.id,\n    reportId: r.report_id ?? \"\",\n    siteId: r.site_id ?? \"\",\n    reportType: toReportType(r.report_type ?? undefined),\n    period: r.period,\n    periodStart: r.period_start,\n    periodEnd: r.period_end,\n    completedOn: r.completed_on,\n    lighthouse,\n    gaUsersCurrent: r.ga_users_current,\n    gaUsersPrevious: r.ga_users_previous,\n    searchFoundPage1: bool(r.search_found_page1),\n    searchPosition: r.search_position,\n    lastTestedDate: r.last_tested_date,\n    commentary: r.commentary,\n    subjectOverride: r.subject_override,\n    draftReady: r.draft_ready !== 0,\n    approvedToSend: r.approved_to_send !== 0,\n    sentAt: r.sent_at,\n    approvedAt: r.approved_at,\n    approvedBy: r.approved_by,\n    deliveryStatus: (r.delivery_status ?? \"pending\") as DeliveryStatus,\n    // The body lives IN the row (rendered_html) — the link points at the\n    // dashboard's own preview route instead of an EXPIRING Airtable signed URL.\n    // Strictly better for the operator: the old link 404'd once the URL aged out.\n    renderedHtmlAttachment:\n      r.rendered_html !== null\n        ? { url: `/api/reports/${r.id}/preview`, filename: `${r.report_id ?? r.id}.html` }\n        : null,\n    resendMessageId: r.resend_message_id,\n    checklist: checklistFromStored(r.checklist),\n    autoEvidence: parseAutoEvidence(r.checklist_auto_evidence),\n    sendOverride: r.send_override !== 0,\n    overrideReason: r.override_reason,\n    overrideBy: r.override_by,\n    overrideAt: r.override_at,\n  };\n}\n\n/** Same contract as the Airtable listAllReports. Newest-period-first (Airtable\n *  returned manual table order; every consumer filters/sorts itself). */\nexport async function listAllReports(db: Db): Promise<ReportRow[]> {\n  const rows = await db\n    .selectFrom(\"reports\")\n    .selectAll()\n    .orderBy(\"period_start\", \"desc\")\n    .orderBy(\"id\")\n    .execute();\n  return rows.map(reportRowFromDb);\n}\n\n/** Same contract as the Airtable listReportsForSite — served by idx_reports_site. */\nexport async function listReportsForSite(db: Db, siteId: string): Promise<ReportRow[]> {\n  const rows = await db\n    .selectFrom(\"reports\")\n    .selectAll()\n    .where(\"site_id\", \"=\", siteId)\n    .orderBy(\"period_start\", \"desc\")\n    .orderBy(\"id\")\n    .execute();\n  return rows.map(reportRowFromDb);\n}\n\n/** Columns the REQUEST-PATH report writers mirror after their Airtable write\n *  (same pattern as mirrorSiteField): the approve/override flow and the\n *  resend-webhook's delivery status. Send-path columns (sent_at,\n *  resend_message_id, rendered_html) are deliberately absent — the send is a\n *  CLI batch whose writes reach Turso via the hourly sync until Phase 3. */\nexport type ReportMirrorPatch = Partial<\n  Pick<\n    ReportsTable,\n    | \"approved_to_send\"\n    | \"approved_at\"\n    | \"approved_by\"\n    | \"send_override\"\n    | \"override_reason\"\n    | \"override_by\"\n    | \"override_at\"\n    | \"delivery_status\"\n  >\n>;\n\n/** Mirror an Airtable report write into Turso so the page re-render after an\n *  approve/override/bounce shows the new state immediately instead of after\n *  the next hourly sync. Callers treat a failure as non-fatal (the sync\n *  converges it); an empty patch is a no-op, never invalid SQL. */\nexport async function mirrorReportPatch(\n  db: Db,\n  reportId: string,\n  patch: ReportMirrorPatch,\n): Promise<void> {\n  if (Object.keys(patch).length === 0) return;\n  await db.updateTable(\"reports\").set(patch).where(\"id\", \"=\", reportId).execute();\n}\n\n/** By rec id (the PK) — approve-report's read. */\nexport async function getReportById(db: Db, id: string): Promise<ReportRow | null> {\n  const r = await db.selectFrom(\"reports\").selectAll().where(\"id\", \"=\", id).executeTakeFirst();\n  return r ? reportRowFromDb(r) : null;\n}\n\n/** The preview route's read: the stored rendered body, or null when the report\n *  has none (imported while its signed URL was expired, or predates rendering). */\nexport async function getReportHtml(\n  db: Db,\n  id: string,\n): Promise<{ html: string; reportId: string | null } | null> {\n  const r = await db\n    .selectFrom(\"reports\")\n    .select([\"rendered_html\", \"report_id\"])\n    .where(\"id\", \"=\", id)\n    .executeTakeFirst();\n  if (!r || r.rendered_html === null) return null;\n  return { html: r.rendered_html, reportId: r.report_id };\n}\n","import { openDb, readDbConfig, type Db } from \"../db/client.js\";\nimport { mirrorHealthFields, mirrorScheduleFields } from \"../db/fleet-state.js\";\n\n/** One site's just-written Airtable FieldSet, mirrored into site_health.\n *  Resolves true when a site_health row matched; false when the UPDATE touched\n *  0 rows (site created in Airtable after the last hourly import) — callers\n *  count that as mirror_missed, never as mirrored. */\nexport type HealthMirror = (siteId: string, fields: Record<string, unknown>) => Promise<boolean>;\n\n/** The site_schedule twin, for the nightly next-due write-back. Same\n *  matched-row contract as {@link HealthMirror}: false = 0-row UPDATE →\n *  mirror_missed. */\nexport type ScheduleMirror = (\n  siteId: string,\n  fields: Record<string, unknown>,\n  computedAt: string,\n) => Promise<boolean>;\n\n/** Build the Turso write-through for the nightly writers (#539 Phase 3\n *  dual-write), or null when libSQL creds are absent — mirroring NOT attempted\n *  is a different outcome than mirroring failed, and the caller's summary line\n *  reports mirror counts only when a mirror existed. Same contract as\n *  recordFleetEventsBestEffort: the mirror must never fail the sweep that\n *  produced the data (per-site failures are the caller's to count; Airtable\n *  stays authoritative and the hourly sync converges whatever the mirror\n *  missed). `open` is injectable for tests. */\nexport async function makeHealthMirrorBestEffort(\n  open: () => Promise<Db> = () => openDb(readDbConfig()),\n): Promise<HealthMirror | null> {\n  let db: Db;\n  try {\n    db = await open();\n  } catch (e) {\n    console.error(`[health-mirror] mirroring disabled: no libSQL (${String(e)})`);\n    return null;\n  }\n  return (siteId, fields) => mirrorHealthFields(db, siteId, fields);\n}\n\n/** {@link makeHealthMirrorBestEffort}'s schedule twin — same null-without-creds\n *  contract, for `writeNextDueDates`' site_schedule write-through. */\nexport async function makeScheduleMirrorBestEffort(\n  open: () => Promise<Db> = () => openDb(readDbConfig()),\n): Promise<ScheduleMirror | null> {\n  let db: Db;\n  try {\n    db = await open();\n  } catch (e) {\n    console.error(`[schedule-mirror] mirroring disabled: no libSQL (${String(e)})`);\n    return null;\n  }\n  return (siteId, fields, computedAt) => mirrorScheduleFields(db, siteId, fields, computedAt);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAgQA,eAAsB,mBACpB,IACA,QACA,QACkB;AAIlB,QAAM,QAAgD,CAAC;AACvD,aAAW,CAAC,OAAO,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACnD,UAAM,IAAI,gBAAgB,KAAK;AAC/B,QAAI,CAAC;AACH,YAAM,IAAI,MAAM,kEAAkE,KAAK,GAAG;AAC5F,UAAM,EAAE,GAAG,IAAI,EAAE,OAAO,KAAK;AAAA,EAC/B;AACA,MAAI,OAAO,KAAK,KAAK,EAAE,WAAW,EAAG,QAAO;AAC5C,QAAM,MAAM,MAAM,GACf,YAAY,aAAa,EACzB,IAAI,KAAoC,EACxC,MAAM,WAAW,KAAK,MAAM,EAC5B,iBAAiB;AAEpB,SAAO,IAAI,iBAAiB;AAC9B;AASA,eAAsB,qBACpB,IACA,QACA,QACA,YACkB;AAClB,QAAM,QAAuC,CAAC;AAC9C,aAAW,CAAC,OAAO,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACnD,UAAM,IAAI,kBAAkB,KAAK;AACjC,QAAI,CAAC;AACH,YAAM,IAAI;AAAA,QACR,sEAAsE,KAAK;AAAA,MAC7E;AACF,UAAM,EAAE,GAAG,IAAI,EAAE,OAAO,KAAK;AAAA,EAC/B;AACA,MAAI,OAAO,KAAK,KAAK,EAAE,WAAW,EAAG,QAAO;AAC5C,QAAM,cAAc;AACpB,QAAM,MAAM,MAAM,GACf,YAAY,eAAe,EAC3B,IAAI,KAAsC,EAC1C,MAAM,WAAW,KAAK,MAAM,EAC5B,iBAAiB;AACpB,SAAO,IAAI,iBAAiB;AAC9B;AA4BA,IAAM,yBAAsD,IAAI;AAAA,EAC9D,CAAC,GAAG,uBAAuB,GAAG,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC;AAC9E;;;AC3TA,eAAsB,2BACpB,OAA0B,MAAM,OAAO,aAAa,CAAC,GACvB;AAC9B,MAAI;AACJ,MAAI;AACF,SAAK,MAAM,KAAK;AAAA,EAClB,SAAS,GAAG;AACV,YAAQ,MAAM,kDAAkD,OAAO,CAAC,CAAC,GAAG;AAC5E,WAAO;AAAA,EACT;AACA,SAAO,CAAC,QAAQ,WAAW,mBAAmB,IAAI,QAAQ,MAAM;AAClE;AAIA,eAAsB,6BACpB,OAA0B,MAAM,OAAO,aAAa,CAAC,GACrB;AAChC,MAAI;AACJ,MAAI;AACF,SAAK,MAAM,KAAK;AAAA,EAClB,SAAS,GAAG;AACV,YAAQ,MAAM,oDAAoD,OAAO,CAAC,CAAC,GAAG;AAC9E,WAAO;AAAA,EACT;AACA,SAAO,CAAC,QAAQ,QAAQ,eAAe,qBAAqB,IAAI,QAAQ,QAAQ,UAAU;AAC5F;","names":[]}

package/dist/import-airtable-HE43FB4H.js

@@ -0,0 +1,35 @@
+import {
+  EXCLUDED_WEBSITE_FIELDS,
+  HEALTH_BOOLEAN,
+  HEALTH_FIELDS,
+  SCHEDULE_FIELDS,
+  SITE_FIELDS,
+  formatReapSummary,
+  healthColumnFor,
+  importFleetState,
+  mapReportRecord,
+  mapWebsiteRecord,
+  reapAllowance,
+  reapRefusal,
+  renderedHtmlUrl,
+  scheduleColumnFor
+} from "./chunk-ITIOFN7A.js";
+import "./chunk-VAD43MOR.js";
+import "./chunk-LDWZSLSU.js";
+export {
+  EXCLUDED_WEBSITE_FIELDS,
+  HEALTH_BOOLEAN,
+  HEALTH_FIELDS,
+  SCHEDULE_FIELDS,
+  SITE_FIELDS,
+  formatReapSummary,
+  healthColumnFor,
+  importFleetState,
+  mapReportRecord,
+  mapWebsiteRecord,
+  reapAllowance,
+  reapRefusal,
+  renderedHtmlUrl,
+  scheduleColumnFor
+};
+//# sourceMappingURL=import-airtable-HE43FB4H.js.map