@reddoorla/maintenance 0.85.1 → 0.86.0

package/dist/index.d.ts

@@ -1,8 +1,9 @@
 import { a as AuditResult, S as Site, A as AuditName, b as RecipeResult, R as RecipeName, I as InventoryProvider } from './types-OIQZ5hWN.js';
 export { C as ConfigName } from './types-OIQZ5hWN.js';
-import * as airtable_lib_airtable_base_js from 'airtable/lib/airtable_base.js';
+import { A as AirtableBase, a as FleetEventType } from './fleet-events-cF2Om88w.js';
 import { F as FormType } from './types-RXY-vY-5.js';
 export { SyncConfigsOptions, syncConfigs } from './recipes/sync-configs.js';
+import 'airtable/lib/airtable_base.js';
 
 type SpawnResult = {
     code: number;
@@ -119,7 +120,15 @@ type FormSubmitOutcome = {
     formPresent: true;
     success: boolean;
     detail?: string;
+    /** Click → success banner VISIBLE. A user-experience number: it includes the
+     *  browser's own render of the banner, which no server budget governs. */
     elapsedMs?: number;
+    /** Click → the action's POST response arrives. This is the span the site's
+     *  `INGEST_TIMEOUT_MS` abort budget actually governs (it wraps the
+     *  site→central fetch, which is nested inside this POST), so it — not
+     *  `elapsedMs` — is what the budget check must compare against. Undefined
+     *  when no POST was observed. */
+    postElapsedMs?: number;
 } | {
     testModeUndeclared: true;
 };
@@ -388,13 +397,6 @@ declare function localPath(path: string, opts?: LocalPathOptions): InventoryProv
 
 declare function fromJsonFile(path: string): InventoryProvider;
 
-type AirtableConfig = {
-    apiKey: string;
-    baseId: string;
-};
-type AirtableBase = ReturnType<typeof openBase>;
-declare function openBase(cfg: AirtableConfig): airtable_lib_airtable_base_js.AirtableBase;
-
 type AirtableInventoryOptions = {
     /**
      * Local workdir to compute each site's path as `{workdir}/{slug}`.
@@ -407,21 +409,105 @@ type AirtableInventoryOptions = {
  * Read sites from the Airtable Websites table as an InventoryProvider.
  * Each row becomes one Site; `path` is computed as `{workdir}/{slug}`.
  * Only LIVE `maintenance` sites that have a `url` are included — pre-launch
- * stages ("launch period" / "in development", via isPreLaunch) are excluded so a
+ * stages ("launching" / "building", via isPreLaunch) are excluded so a
  * not-yet-live site is never audited as production (its deploy/domain/uptime/CMS
  * audits would fail against nothing and red its Airtable row) nor swept by other
  * `--fleet airtable` ops; it re-enters the fleet when a Launch report flips its
- * Status to "maintenance". The production URL is exposed as `Site.deployedUrl` so
+ * Status to "maintained". The production URL is exposed as `Site.deployedUrl` so
  * the lighthouse audit can run against it with no checkout. `repoUrl` is
  * intentionally NOT set from `url` — a clone source must come from `gitRepo`
  * (`owner/repo`), never the production URL.
  */
 declare function fromAirtableBase(base: AirtableBase, opts?: AirtableInventoryOptions): InventoryProvider;
 
+/**
+ * The site-status vocabulary — ONE module owns it (#539 Phase 4).
+ *
+ * The fleet's lifecycle names were inherited from an Airtable single-select
+ * written by hand years ago ("probably not our problem"). The operator approved
+ * a canonical vocabulary, and the migration is now COMPLETE in both stores:
+ * Airtable's "Status" single-select carries exactly the six canonical options
+ * and nothing else. This module no longer knows the old names at all.
+ *
+ * The retired mapping, kept as the record of what was merged into what:
+ *
+ *   old (retired 2026-08-25)    new (canonical)
+ *   ─────────────────────────   ───────────────
+ *   in development              building
+ *   launch period               launching
+ *   maintenance                 maintained
+ *   hosting                     hosted-only
+ *   probably not our problem    external
+ *   legacy                    ┐
+ *   deprecated                ┴ archived        ← approved MERGE, many-to-one
+ *
+ * `legacy` and `deprecated` were already treated identically by every PREDICATE
+ * (ARCHIVED_STATUSES held both), so collapsing them changes no *selection* — no
+ * fleet op gains or loses a site. It is NOT true that collapsing them changes
+ * nothing at all, and one surface proved it: the cockpit's Archived lane LABELS
+ * each row with its Status cell, and canonicalizing there rendered all 12 live
+ * archived rows as "archived". That lane now labels from `statusRaw`, which is
+ * exactly why `WebsiteRow.statusRaw` exists. The rule this leaves behind:
+ * canonical values decide BEHAVIOUR; anything DISPLAYING a Status cell, or
+ * writing one back, uses the raw cell.
+ *
+ * The merge had NO clean reverse map while both vocabularies coexisted, which
+ * is why `toAirtableStatus` had to pick one archived name deliberately. With the
+ * old names retired there is nothing left to pick between, and no code path
+ * feeds operator-supplied text through it anyway (see
+ * `src/recipes/forms-notify-target.ts`, which writes `--restore` verbatim).
+ *
+ * THE SHAPE OF THE TRANSITION (three stages):
+ *
+ *   stage 1 (DONE)  code speaks the NEW vocabulary internally; reads canonicalize
+ *                   at the two Airtable/Turso seams; writes still emit the OLD
+ *                   Airtable option names. Airtable untouched. No SELECTION
+ *                   change — every predicate picks exactly the sites it picked
+ *                   before (pinned row-by-row in tests/reports/airtable/
+ *                   site-status.test.ts). Displayed labels come from `statusRaw`.
+ *   stage 2 (DONE)  the Airtable "Status" single-select gained the 6 new options
+ *                   and all 44 cells were migrated (verified live: maintained=13,
+ *                   archived=12, external=9, building=6, hosted-only=2,
+ *                   launching=2 — zero old values, zero unrecognized), `db sync`
+ *                   ran clean (mismatches=0), and AIRTABLE_USES_NEW_VOCABULARY
+ *                   flipped to true. Writers now emit canonical names verbatim.
+ *                   The alias map STAYS: the 7 old options still exist in the
+ *                   field, so a human can still pick one in the Airtable UI.
+ *   stage 3 (DONE)  the operator deleted the 7 old options from the Airtable
+ *                   "Status" field on 2026-08-25, which is what made this safe:
+ *                   the gate was always "no old value CAN BE ENTERED", not
+ *                   merely "none is stored". Verified against the live base
+ *                   before any code changed — the field carries exactly the six
+ *                   canonical choices, byte-exact, and all 44 cells still hold a
+ *                   canonical value with ZERO blanks (deleting a single-select
+ *                   option CLEARS the cells using it, so "no cell was blanked"
+ *                   was checked, not assumed). AIRTABLE_STATUS_ALIASES,
+ *                   AIRTABLE_OLD_NAMES and AIRTABLE_USES_NEW_VOCABULARY are
+ *                   gone; both functions reduce to the identity.
+ *
+ * WHAT CHANGED IN BEHAVIOUR AT STAGE 3, and it is the only thing that did: an
+ * old name is no longer translated. `canonicalizeStatus("maintenance")` used to
+ * yield `maintained`; it now yields `"maintenance"` verbatim, which
+ * `isUnrecognizedStatus` flags and the cockpit surfaces as a watch row. That is
+ * intended. The option cannot be selected any more, so a stored old value would
+ * mean something went wrong — a restored backup, a scripted write, an API
+ * caller with a stale constant — and the fleet should say so rather than absorb
+ * it into a status nobody chose.
+ *
+ * Canonicalization happens on READ, never at rest: `src/db/import-airtable.ts`
+ * still stores the raw Airtable cell verbatim in `sites.status`, so the hourly
+ * parity check keeps comparing raw-to-raw and the importer stays honest to its
+ * source. Both readers — `mapRow` (Airtable) and `rowFromJoined` (Turso) — run
+ * the raw value through `canonicalizeStatus`, which is what keeps the #558
+ * reader-equivalence instrument green.
+ */
+/** The canonical site lifecycle vocabulary. */
+type Status = "building" | "launching" | "maintained" | "hosted-only" | "external" | "archived";
+
 type Frequency = "None" | "Monthly" | "Quarterly" | "Yearly";
-type Status = "in development" | "launch period" | "maintenance" | "hosting" | "probably not our problem" | "deprecated" | "legacy";
+
 /**
- * Per-site notification routing. When present on a `maintenance` site, the form
+ * Per-site notification routing. When present on a `maintained` site, the form
  * notification is addressed by the value of a submission field (`field`, read from
  * `extraFields`) — e.g. route a contact form's `interest` to a different recipient
  * per option, always CC-ing a shared address. Absent (`null`) → the site keeps the
@@ -443,7 +529,17 @@ type WebsiteRow = {
     id: string;
     name: string;
     url: string;
+    /** Canonical lifecycle status (see ./site-status.ts). Canonicalized at the read
+     *  boundary, so an old-vocabulary Airtable cell and a new one read identically.
+     *  A present-but-unrecognized cell survives VERBATIM (blind-cast) rather than
+     *  becoming null — `isUnrecognizedStatus` flags it, and null would make
+     *  due.ts/preflight.ts treat the row as eligible-by-default. */
     status: Status | null;
+    /** The literal Airtable Status cell behind `status` — same pattern as
+     *  `maintenanceFreqRaw`. The dashboard status editor round-trips THIS, so its
+     *  dropdown offers and preselects the values Airtable actually holds while the
+     *  two vocabularies coexist. Null = blank cell. */
+    statusRaw: string | null;
     pointOfContact: string | null;
     maintenanceFreq: Frequency;
     testingFreq: Frequency;
@@ -670,6 +766,18 @@ type WebsiteRow = {
      */
     prismicAckUntil: string | null;
     notifyRouting: NotifyRouting | null;
+    /** The RAW `Notify Routing` cell, verbatim. Same reason `statusRaw` exists: the
+     *  dashboard editor round-trips this JSON, and re-serializing the PARSED object
+     *  would drop any key the parser ignores and reformat what the operator typed —
+     *  a silent rewrite of a cell they only opened to look at. */
+    notifyRoutingRaw: string | null;
+    /** Read-back of the code-owned next-due dates (date-only, written by the
+     *  nightly `writeNextDueDates`). These exist so the writer can DIFF the
+     *  freshly-computed dates against what the row already holds and skip the
+     *  ~31 no-op writes a night the fleet was paying for (#539 Phase 3). Null =
+     *  cell blank or the operator-added `Next … at` column absent. */
+    nextMaintenanceAt: string | null;
+    nextTestingAt: string | null;
 };
 /** The `Prismic Models` cell — see {@link WebsiteRow.prismicModels} for why it
  *  carries a third state that no other verdict column in this table has. */
@@ -884,7 +992,9 @@ type RefreshHeaderDeps = {
         url: string;
         slug?: string;
     }) => Promise<GeneratedHeaderImage>;
-    upload?: (recordId: string, field: string, bytes: Uint8Array, filename: string, contentType: string) => Promise<void>;
+    upload?: (recordId: string, field: string, bytes: Uint8Array, filename: string, contentType: string, opts?: {
+        replaceIn?: string;
+    }) => Promise<void>;
 };
 type DraftOptions = {
     /** Where to write the local preview HTML when `previewOnly`. Defaults to `reports/<slug>/draft.html`. */
@@ -1145,8 +1255,6 @@ type AttentionItem = {
     autoFixExhausted?: boolean;
 };
 
-type FleetEventType = "pr_automerged" | "vuln_cleared" | "ci_recovered" | "site_launched" | "fleet_swept" | "cert_renewed" | "report_sent_with_override";
-
 type Tier = "attention" | "watch" | "healthy" | "pre-launch";
 type SiteCard = {
     site: WebsiteRow;
@@ -1191,7 +1299,7 @@ type CockpitSummary = {
     attention: number;
     watch: number;
     healthy: number;
-    /** Count of pre-live "launch period" sites still muted as expected pre-launch
+    /** Count of pre-live "launching" sites still muted as expected pre-launch
      *  conditions. A piercing alarm (piercesPreLaunchMute) re-tiers such a site to
      *  attention, so it counts there instead — muted never means "hidden if broken". */
     preLaunch: number;
@@ -1221,7 +1329,15 @@ type RecentEntry = {
     ts: string;
 };
 /** A Websites row surfaced OUTSIDE the fleet cards: archived (legacy/deprecated)
- *  or holding an unrecognized Status cell. `status` is the raw cell value. */
+ *  or holding an unrecognized Status cell.
+ *
+ *  `status` is the RAW Airtable cell, not the canonical status (#539 Phase 4).
+ *  These two lanes exist to mirror what Airtable holds so a row can never
+ *  silently vanish, and both of them survive on the distinction the canonical
+ *  vocabulary erases: `legacy` and `deprecated` both canonicalize to `archived`,
+ *  so labelling the lane canonically would render 12 live rows identically and
+ *  disagree with the cell the operator is looking at. Everything else about
+ *  these rows — which lane they land in — is decided canonically. */
 type OffFleetSiteEntry = {
     name: string;
     slug: string;
@@ -1268,7 +1384,7 @@ type SiteAlarmContext = {
  * fetches data, then hands it here. Easier to unit-test, easier to render
  * a static preview from CLI later.
  */
-declare function renderSiteDashboardHtml(site: WebsiteRow, reports: ReportRow[], submissions?: SubmissionRow[], spamTotals?: ScreenOutTotals | null, now?: Date, alarm?: SiteAlarmContext | null): string;
+declare function renderSiteDashboardHtml(site: WebsiteRow, reports: ReportRow[], submissions?: SubmissionRow[], spamTotals?: ScreenOutTotals | null, now?: Date, alarm?: SiteAlarmContext | null, operatorEmail?: string | null): string;
 
 /**
  * Render the fleet cockpit as a single HTML document. Pure function: no Airtable
@@ -1277,7 +1393,7 @@ declare function renderSiteDashboardHtml(site: WebsiteRow, reports: ReportRow[],
  * and hands it here. Renders the doc shell + verdict bar + the per-site Needs-you
  * feed + the collapsed Fleet browse panel (one flat, filterable card grid).
  */
-declare function renderCockpitHtml(model: CockpitModel): string;
+declare function renderCockpitHtml(model: CockpitModel, operatorEmail?: string | null): string;
 
 /**
  * Verify an `Authorization: Basic <base64>` header against the configured
@@ -1300,7 +1416,45 @@ declare function renderCockpitHtml(model: CockpitModel): string;
  */
 declare function verifyBasicAuth(authHeader: string | null | undefined, expectedPassword: string | null): boolean;
 
-/** Read the bundled 2400x3200 plate. */
+/** Per-report-type headline overlays, stamped over the CLEAN plate at send time
+ *  (see orchestrate.ts). Types with no entry go out on the clean plate.
+ *
+ *  Source: Figma "Web-Maintenance-Email" (mQ3hy2d9JnOG9ljCzbZS8j) —
+ *  Maintenance is node 158:15, Testing is 153:721 ("maintenance & testing",
+ *  which is what a Testing report actually covers). Export each at 4x; Figma
+ *  crops a text export to its ink box, which is why these are 1328x660 /
+ *  1715x664 rather than the 1840x720 text box.
+ *
+ *  ⚠️ A Figma MCP `download_assets` export arrives FLATTENED — never
+ *  transparent — and it flattens onto WHATEVER SITS BEHIND THE NODE, which is
+ *  not one fixed colour: Maintenance/Testing live inside a white Header frame
+ *  and come back on white, while Announcement/Launch sit on the bare canvas and
+ *  come back on Figma's canvas grey (30,30,30). Stamping either unprocessed
+ *  paints a solid slab over the paper texture — that, not a bad design file, is
+ *  what made the 2026-08-20 Testing asset unusable.
+ *
+ *  Recover the alpha instead of re-exporting by hand: for ink C over backdrop B,
+ *  a = (px - B) / (C - B). DETECT B (the export's most common colour) rather
+ *  than assuming white, and pick the channel with the largest |C - B| — green
+ *  separates the brand red from white by 221 levels but from canvas grey by only
+ *  4, which would quantise the alpha to noise. Verified against the known-good
+ *  Maintenance asset at mean abs alpha diff 0.022, 0.0037% of pixels off by
+ *  more than 8.
+ *
+ *  Editing this copy needs Figma desktop, not the Plugin API: `characters`
+ *  requires loadFontAsync and the MCP font environment carries no Helvetica at
+ *  all, so the licensed Helvetica Neue LT Std can never load there. */
+declare const HEADLINE_FILES: {
+    readonly Maintenance: "headline-maintenance.png";
+    readonly Testing: "headline-testing.png";
+    readonly Announcement: "headline-announcement.png";
+    readonly Launch: "headline-launch.png";
+};
+type HeadlineKind = keyof typeof HEADLINE_FILES;
+/** Read the bundled 2400x3200 CLEAN plate (no headline — the report type's
+ *  headline is stamped at send time, so one stored image serves every type). */
 declare function loadPlate(): Promise<Uint8Array>;
+/** Read a headline overlay (transparent PNG, ink-box cropped). */
+declare function loadHeadline(kind: HeadlineKind): Promise<Uint8Array>;
 
-export { ALL_AUDIT_NAMES, ALL_RECIPE_NAMES, type AirtableInventoryOptions, AuditName, AuditResult, BLURRED_CID, type BumpDepsOptions, type BundledImage, CHECK_CID, type ConvertToPnpmOptions, DEFAULT_INIT_STEPS, type DraftOptions, type DraftResult, type DueItem, type GenerateInput, type GeneratedHeaderImage, type HeaderImage, type InitOptions, type InitResult, type InitStep, type InitStepResult, InventoryProvider, type LighthouseScores, type LocalPathOptions, type OnboardAudit, type OnboardOptions, type OrchestrateOptions, RecipeName, RecipeResult, type RefreshHeaderDeps, type RenderResult, type ReportData, type ReportType, Site, type UpgradeSvelte4to5Options, a11yAudit, a11yFixturesPage, bumpDeps, convertToPnpm, depsAudit, domainFromUrl, draftReportForSite, findDueReports, fromAirtableBase, fromJsonFile, generateHeaderImage, init, isRecipeName, lighthouseAudit, lintAudit, loadBundledImages, loadPlate, localPath, onboard, renderCockpitHtml, renderReportHtml, renderSiteDashboardHtml, runAudits, runAuditsAcross, securityAudit, selfCaretRange, selfPackageVersion, sendApprovedReports, svelteCodemods, upgradeSvelte4to5, verifyBasicAuth };
+export { ALL_AUDIT_NAMES, ALL_RECIPE_NAMES, type AirtableInventoryOptions, AuditName, AuditResult, BLURRED_CID, type BumpDepsOptions, type BundledImage, CHECK_CID, type ConvertToPnpmOptions, DEFAULT_INIT_STEPS, type DraftOptions, type DraftResult, type DueItem, type GenerateInput, type GeneratedHeaderImage, type HeaderImage, type InitOptions, type InitResult, type InitStep, type InitStepResult, InventoryProvider, type LighthouseScores, type LocalPathOptions, type OnboardAudit, type OnboardOptions, type OrchestrateOptions, RecipeName, RecipeResult, type RefreshHeaderDeps, type RenderResult, type ReportData, type ReportType, Site, type UpgradeSvelte4to5Options, a11yAudit, a11yFixturesPage, bumpDeps, convertToPnpm, depsAudit, domainFromUrl, draftReportForSite, findDueReports, fromAirtableBase, fromJsonFile, generateHeaderImage, init, isRecipeName, lighthouseAudit, lintAudit, loadBundledImages, loadHeadline, loadPlate, localPath, onboard, renderCockpitHtml, renderReportHtml, renderSiteDashboardHtml, runAudits, runAuditsAcross, securityAudit, selfCaretRange, selfPackageVersion, sendApprovedReports, svelteCodemods, upgradeSvelte4to5, verifyBasicAuth };

package/dist/index.js

@@ -1,113 +1,125 @@
 import "./chunk-2SLED3NB.js";
-import "./chunk-TP5M2NQB.js";
+import "./chunk-F5KM4LEQ.js";
 import {
-  approveBlockers
-} from "./chunk-LTB6KVJW.js";
-import {
-  DEFAULT_INIT_STEPS,
-  a11yFixturesPage,
-  init
-} from "./chunk-6V7565O2.js";
+  draftReportForSite
+} from "./chunk-BYK66EWO.js";
 import {
-  onboard,
-  selfCaretRange,
-  selfPackageVersion
-} from "./chunk-UYCAF77E.js";
+  approveBlockers
+} from "./chunk-N45M3FDK.js";
 import {
   findDueReports
-} from "./chunk-D4FVAIEJ.js";
-import {
-  draftReportForSite
-} from "./chunk-MGR2H7F4.js";
-import "./chunk-62VF32IC.js";
-import {
-  domainFromUrl,
-  generateHeaderImage,
-  loadPlate
-} from "./chunk-37S6L6G4.js";
+} from "./chunk-PZR4EBPY.js";
 import {
   upgradeSvelte4to5
-} from "./chunk-ICXV25N7.js";
+} from "./chunk-Z3KYFUN6.js";
+import {
+  DEFAULT_INIT_STEPS,
+  a11yFixturesPage,
+  init
+} from "./chunk-ZKXSX4LO.js";
 import {
   convertToPnpm
-} from "./chunk-RJB3QUSP.js";
+} from "./chunk-XIDUYLSR.js";
 import {
   svelteCodemods
-} from "./chunk-LS6QPANO.js";
+} from "./chunk-IYSEC543.js";
 import "./chunk-J7SZQUCW.js";
-import "./chunk-R6FPFMOS.js";
-import "./chunk-R4AB6GCT.js";
+import "./chunk-BQRFQSGY.js";
+import "./chunk-Y53WOQIJ.js";
+import {
+  onboard,
+  selfCaretRange,
+  selfPackageVersion
+} from "./chunk-7RJ2HMMJ.js";
+import "./chunk-ILUNZHYV.js";
+import {
+  bumpDeps
+} from "./chunk-2NJQLSEU.js";
 import "./chunk-R53VL3RI.js";
+import {
+  fromAirtableBase
+} from "./chunk-SLUQ7R6I.js";
 import {
   parseAddresses,
   sendApprovedReports,
   withGlobalCc
-} from "./chunk-COZPL62X.js";
+} from "./chunk-2NDRHXMR.js";
 import "./chunk-GECESMVS.js";
+import {
+  domainFromUrl,
+  generateHeaderImage,
+  loadHeadline,
+  loadPlate
+} from "./chunk-5UINJNAJ.js";
 import {
   BLURRED_CID,
   CHECK_CID,
-  checklistFor,
-  gatingFields,
-  isHealthGateClear,
-  isPendingApproval,
   loadBundledImages,
   renderReportHtml
-} from "./chunk-6QRLRT3P.js";
-import "./chunk-MPBXOJ3N.js";
+} from "./chunk-CQR4LIM7.js";
+import "./chunk-Z7AXYKQB.js";
 import {
   escapeHtml,
   safeUrl
-} from "./chunk-SEEA6RXF.js";
-import "./chunk-WEKL2HYJ.js";
+} from "./chunk-DJZWYIPP.js";
 import {
-  bumpDeps
-} from "./chunk-SDUJIANJ.js";
+  isPendingApproval
+} from "./chunk-ACBRLLFT.js";
+import {
+  checklistFor,
+  gatingFields,
+  isHealthGateClear
+} from "./chunk-VAD43MOR.js";
+import "./chunk-HN6I2XWI.js";
+import "./chunk-WEKL2HYJ.js";
+import "./chunk-NYUYNYQL.js";
 import {
   syncConfigs
-} from "./chunk-Q276MZ7E.js";
+} from "./chunk-3VQWSE3F.js";
+import "./chunk-3G25KIWW.js";
 import "./chunk-73UFRZKY.js";
-import "./chunk-ZTPPCHDB.js";
 import "./chunk-OTGB6YQO.js";
 import {
   ALL_AUDIT_NAMES,
   a11yAudit,
   depsAudit,
-  lighthouseAudit,
   lintAudit,
   runAudits,
   runAuditsAcross,
   securityAudit
-} from "./chunk-QRDB4NLB.js";
+} from "./chunk-2ZPT7GLV.js";
 import "./chunk-LKGVSM2O.js";
 import "./chunk-GASBX52O.js";
-import "./chunk-VRWUL4TR.js";
-import "./chunk-QG6OSL4M.js";
-import "./chunk-DC5H7KEQ.js";
-import "./chunk-4SOCPK7A.js";
+import "./chunk-XHHMM5HX.js";
 import {
   fromJsonFile,
   localPath
-} from "./chunk-FDIFTIXC.js";
-import "./chunk-4DHQCN5H.js";
+} from "./chunk-6TWWY7ZU.js";
+import "./chunk-XUGSZP7Z.js";
+import "./chunk-EVBCK2KC.js";
+import "./chunk-JHGHLKFS.js";
+import "./chunk-3SF7D4DY.js";
 import "./chunk-A3WDWNN5.js";
 import {
   isLeadFormType
 } from "./chunk-2OP4JKIQ.js";
-import "./chunk-XXTZBPUY.js";
 import "./chunk-XTK5VIQB.js";
 import {
-  fromAirtableBase
-} from "./chunk-NWB4O5EY.js";
-import "./chunk-U5SZ4FOP.js";
+  lighthouseAudit
+} from "./chunk-2NQUCS7O.js";
+import "./chunk-UDRHAQT7.js";
+import "./chunk-PTDMVGKL.js";
+import "./chunk-LBYOLBW7.js";
+import "./chunk-XXTZBPUY.js";
 import {
+  CANONICAL_STATUSES,
   SEVERITY_RANK,
-  siteSlug
-} from "./chunk-577HCGZO.js";
-import "./chunk-HN6I2XWI.js";
+  siteSlug,
+  toAirtableStatus
+} from "./chunk-LDWZSLSU.js";
 import "./chunk-6VAL7XJT.js";
 import "./chunk-NMAWXBJA.js";
-import "./chunk-N4MOEF32.js";
+import "./chunk-C6B4RHXR.js";
 
 // src/recipes/index.ts
 var ALL_RECIPE_NAMES = [
@@ -128,6 +140,16 @@ function isRecipeName(value) {
   return ALL_RECIPE_NAMES.includes(value);
 }
 
+// src/dashboard/favicon.ts
+var REDDOOR_FAVICON_PNG_BASE64 = "iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAMAAABEpIrGAAAACXBIWXMAAAAnAAAAJwEqCZFPAAAAk1BMVEVHcEzkGTfjGDbjGTfjGTfjGTfjGTfjGDbjGDbjGTfjGTfjGTfkGTfjGTfjGDbjGDbkGTfjGDbjGDbjGTfjGTfjGDbjGTfjGDbjGTfjGDbjGTfjGTfjGDbjGDbjGDbjGDbjGTfjGTbjGDbjGDbjGDbjGDbjGTfjGTfjGTfjGDbjGDbjGTfjGDbjGDbjGTfjGTbkGTfxxbwzAAAALXRSTlMA4DABMOD8cOBwDltwi+bFLMlk54/BDVPk/I61/u2cFaBw9nqO1izBIQE+Becdo6eEAAABBElEQVQ4y91SCVYCMQwt4kxbcEHFfUFFcMGf9P6nM0kXEPEAmtdJs+cnU+f+He2fIIEAYuVgkmvDfTG9Rh+6LoRBUBqE7gi09l9eAeeTrZJoFd5uQWfj4VbPvRqwmj9zfzP6CYpyi48F6HW5A3WuMHsEPsfvO8cSkMPTe+pfRr/MTckdg+4enqL3PkYf/YFIqiiP8VAw6EZkH6QEO0xJLUhmdbY5+TjHkCVohprlcpzlnJw9GlNkrZC16uCmWIaAZItNrT4xV0T2yxrIWoNKy4rdVXOq0MycWp4r43FOMQWciibMYaOHCXKSPhapqTupGFAnwHoVuUUZq7jaSkqDb0/uD9MXqvJMDtU7lL0AAAAASUVORK5CYII=";
+var FAVICON_LINK = `<link rel="icon" type="image/png" href="data:image/png;base64,${REDDOOR_FAVICON_PNG_BASE64}" />`;
+
+// src/dashboard/auth/render.ts
+function renderAuthChrome(email) {
+  if (!email) return "";
+  return `<div style="float:right;font-size:0.8rem;color:#666">${escapeHtml(email)} \xB7 <a href="/auth/logout">sign out</a></div>`;
+}
+
 // src/dashboard/relative-time.ts
 function relativeTimeFromNow(iso, now = /* @__PURE__ */ new Date()) {
   if (!iso) return "\u2014";
@@ -147,10 +169,6 @@ function relativeTimeFromNow(iso, now = /* @__PURE__ */ new Date()) {
   return `${months}mo ago`;
 }
 
-// src/dashboard/favicon.ts
-var REDDOOR_FAVICON_PNG_BASE64 = "iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAMAAABEpIrGAAAACXBIWXMAAAAnAAAAJwEqCZFPAAAAk1BMVEVHcEzkGTfjGDbjGTfjGTfjGTfjGTfjGDbjGDbjGTfjGTfjGTfkGTfjGTfjGDbjGDbkGTfjGDbjGDbjGTfjGTfjGDbjGTfjGDbjGTfjGDbjGTfjGTfjGDbjGDbjGDbjGDbjGTfjGTbjGDbjGDbjGDbjGDbjGTfjGTfjGTfjGDbjGDbjGTfjGDbjGDbjGTfjGTbkGTfxxbwzAAAALXRSTlMA4DABMOD8cOBwDltwi+bFLMlk54/BDVPk/I61/u2cFaBw9nqO1izBIQE+Becdo6eEAAABBElEQVQ4y91SCVYCMQwt4kxbcEHFfUFFcMGf9P6nM0kXEPEAmtdJs+cnU+f+He2fIIEAYuVgkmvDfTG9Rh+6LoRBUBqE7gi09l9eAeeTrZJoFd5uQWfj4VbPvRqwmj9zfzP6CYpyi48F6HW5A3WuMHsEPsfvO8cSkMPTe+pfRr/MTckdg+4enqL3PkYf/YFIqiiP8VAw6EZkH6QEO0xJLUhmdbY5+TjHkCVohprlcpzlnJw9GlNkrZC16uCmWIaAZItNrT4xV0T2yxrIWoNKy4rdVXOq0MycWp4r43FOMQWciibMYaOHCXKSPhapqTupGFAnwHoVuUUZq7jaSkqDb0/uD9MXqvJMDtU7lL0AAAAASUVORK5CYII=";
-var FAVICON_LINK = `<link rel="icon" type="image/png" href="data:image/png;base64,${REDDOOR_FAVICON_PNG_BASE64}" />`;
-
 // src/dashboard/onboarding.ts
 function isNonEmpty(s) {
   return typeof s === "string" && s.trim().length > 0;
@@ -294,14 +312,7 @@ var SUBMISSION_STATUS_SCRIPT = `document.querySelectorAll("button.subm-status").
     });`;
 
 // src/dashboard/site-details.ts
-var SITE_STATUS_OPTIONS = [
-  "in development",
-  "launch period",
-  "maintenance",
-  "hosting",
-  "probably not our problem",
-  "deprecated"
-];
+var SITE_STATUS_OPTIONS = CANONICAL_STATUSES.map(toAirtableStatus);
 var FREQ_OPTIONS = ["None", "Monthly", "Quarterly", "Yearly"];
 
 // src/dashboard/render.ts
@@ -476,8 +487,8 @@ function gaUsersCell(r) {
   const current = String(r.gaUsersCurrent);
   if (r.gaUsersPrevious === null) return escapeHtml(current);
   const delta = r.gaUsersCurrent - r.gaUsersPrevious;
-  const sign = delta > 0 ? "+" : "";
-  return `${escapeHtml(current)} <span class="muted">(${escapeHtml(`${sign}${delta}`)})</span>`;
+  const sign2 = delta > 0 ? "+" : "";
+  return `${escapeHtml(current)} <span class="muted">(${escapeHtml(`${sign2}${delta}`)})</span>`;
 }
 function searchCell(r) {
   if (r.searchFoundPage1 && r.searchPosition !== null) {
@@ -575,6 +586,9 @@ function selectRow(label, field, options, current, url) {
 function inputRow(label, field, value, url) {
   return `<div class="detail"><dt><label for="detail-${field}">${escapeHtml(label)}</label></dt><dd><input type="text" id="detail-${field}" data-detail-field="${field}" data-details-url="${url}" value="${escapeHtml(value ?? "")}" />${savedSpan(field)}</dd></div>`;
 }
+function dateRow(label, field, value, url) {
+  return `<div class="detail"><dt><label for="detail-${field}">${escapeHtml(label)}</label></dt><dd><input type="date" id="detail-${field}" data-detail-field="${field}" data-details-url="${url}" value="${escapeHtml(value ?? "")}" />${savedSpan(field)}</dd></div>`;
+}
 function textareaRow(label, field, value, url) {
   return `<div class="detail wide"><dt><label for="detail-${field}">${escapeHtml(label)}</label></dt><dd><textarea id="detail-${field}" data-detail-field="${field}" data-details-url="${url}">${escapeHtml(value ?? "")}</textarea>${savedSpan(field)}</dd></div>`;
 }
@@ -582,7 +596,11 @@ function siteDetailsSection(site) {
   const url = `/api/sites/${escapeHtml(siteSlug(site.name))}/details`;
   const lastCommit = site.lastCommitAt ? `${relativeTimeFromNow(site.lastCommitAt)}` : null;
   const rows = [
-    selectRow("Status", "status", SITE_STATUS_OPTIONS, site.status, url),
+    // `statusRaw`, not `status`: this select's options ARE the Airtable cell
+    // values (see SITE_STATUS_OPTIONS), so it must preselect against the raw cell.
+    // Comparing the canonical value would mis-preselect every site, and would show
+    // a "legacy" site as "deprecated" instead of the placeholder.
+    selectRow("Status", "status", SITE_STATUS_OPTIONS, site.statusRaw, url),
     selectRow("Maintenance cadence", "maintenanceFreq", FREQ_OPTIONS, site.maintenanceFreq, url),
     selectRow("Testing cadence", "testingFreq", FREQ_OPTIONS, site.testingFreq, url),
     inputRow("Report recipients (To)", "reportRecipientsTo", site.reportRecipientsTo, url),
@@ -591,6 +609,18 @@ function siteDetailsSection(site) {
     inputRow("GA4 property", "ga4PropertyId", site.ga4PropertyId, url),
     inputRow("Search query", "searchQuery", site.searchQuery, url),
     inputRow("Git repo", "gitRepo", site.gitRepo, url),
+    // #539 Phase 4 — the fields nothing rendered before. `Mailchimp API Key` is
+    // the one field in that group still absent, and deliberately: it is a live
+    // credential and every row here emits its stored value into the page.
+    inputRow("Netlify ID", "netlifyId", site.netlifyId, url),
+    inputRow("Search Console property", "searchConsoleProperty", site.searchConsoleProperty, url),
+    inputRow("Newsletter webhook", "newsletterWebhook", site.newsletterWebhook, url),
+    inputRow("Mailchimp audience ID", "mailchimpAudienceId", site.mailchimpAudienceId, url),
+    dateRow("Last maintenance day", "maintenanceDay", site.maintenanceDay, url),
+    dateRow("Last testing day", "testingDay", site.testingDay, url),
+    // Raw JSON, and shown as the raw cell rather than the parsed object: what the
+    // operator edits has to be the thing `parseNotifyRouting` will read back.
+    textareaRow("Notify routing (JSON)", "notifyRouting", site.notifyRoutingRaw, url),
     textareaRow("Copy \u2014 Intro", "copyIntro", site.copyIntro, url),
     textareaRow("Copy \u2014 Contact", "copyContact", site.copyContact, url),
     textareaRow("Copy \u2014 Footer", "copyFooter", site.copyFooter, url),
@@ -754,7 +784,7 @@ button.trigger-renovate:disabled { opacity: 0.6; cursor: default; }
 .chip.accepted { background: transparent; border: 1px dashed #bbb; color: #888; }
 @media (prefers-color-scheme: dark) { .chip.accepted { border-color: #444; } .chip.critical { background: #2a0f0d; color: #ff8a80; } }
 `;
-function renderSiteDashboardHtml(site, reports, submissions = [], spamTotals = null, now = /* @__PURE__ */ new Date(), alarm = null) {
+function renderSiteDashboardHtml(site, reports, submissions = [], spamTotals = null, now = /* @__PURE__ */ new Date(), alarm = null, operatorEmail = null) {
   const name = escapeHtml(site.name);
   const urlSafe = safeUrl(site.url);
   const allScoresNull = site.pScore === null && site.rScore === null && site.bpScore === null && site.seoScore === null;
@@ -787,6 +817,7 @@ function renderSiteDashboardHtml(site, reports, submissions = [], spamTotals = n
   <style>${STYLES}${SUBMISSION_STYLES}</style>
 </head>
 <body>
+  ${renderAuthChrome(operatorEmail)}
   <a class="home" href="/">\u2190 Fleet home</a>
   <h1>${name}</h1>
   <div class="meta"><a href="${escapeHtml(urlSafe)}">${escapeHtml(site.url)}</a></div>
@@ -1612,7 +1643,7 @@ var AUDIT_SCRIPT = `<script>
   } catch(e){}
 })();
 </script>`;
-function renderCockpitHtml(model) {
+function renderCockpitHtml(model, operatorEmail = null) {
   const total = model.cards.length;
   const feed = buildNeedsYouFeed(model);
   return `<!doctype html>
@@ -1625,8 +1656,9 @@ function renderCockpitHtml(model) {
   <style>${STYLES2}</style>
 </head>
 <body>
+  ${renderAuthChrome(operatorEmail)}
   <h1>Reddoor fleet cockpit</h1>
-  <div class="meta">${total} site${total === 1 ? "" : "s"} on the Reddoor stack.</div>
+  <div class="meta">${total} site${total === 1 ? "" : "s"} on the Reddoor stack. <a href="/fleet">Fleet table \u2192</a></div>
   ${verdictBar(model, feed)}
   ${renderNeedsYouFeed(feed)}
   ${renderFleetBrowsePanel(model)}
@@ -1659,6 +1691,15 @@ function verifyBasicAuth(authHeader, expectedPassword) {
   if (a.length !== b.length) return false;
   return timingSafeEqual(a, b);
 }
+
+// src/dashboard/auth/signing.ts
+import { createHmac, timingSafeEqual as timingSafeEqual2 } from "crypto";
+
+// src/dashboard/auth/session.ts
+var SESSION_TTL_SECONDS = 30 * 24 * 60 * 60;
+
+// src/dashboard/prospect-audit-trigger.ts
+var PROSPECT_AUDIT_DUPLICATE_WINDOW_MS = 10 * 60 * 1e3;
 export {
   ALL_AUDIT_NAMES,
   ALL_RECIPE_NAMES,
@@ -1681,6 +1722,7 @@ export {
   lighthouseAudit,
   lintAudit,
   loadBundledImages,
+  loadHeadline,
   loadPlate,
   localPath,
   onboard,