@reddoorla/maintenance 0.85.2 → 0.86.0

package/dist/{health-endpoint-242WG2OJ.js → health-endpoint-WJC2UMYS.js}

@@ -5,20 +5,20 @@ import {
   appendSkipNotice,
   fleetWorkdir,
   prepareFleetSites
-} from "./chunk-ZMIPG6TR.js";
+} from "./chunk-TVL5MVUF.js";
 import {
   resolveSites
-} from "./chunk-7J53SUT6.js";
+} from "./chunk-P2FE5AI6.js";
 import {
   healthEndpoint
-} from "./chunk-R6FPFMOS.js";
+} from "./chunk-BQRFQSGY.js";
 import "./chunk-R53VL3RI.js";
-import "./chunk-ZTPPCHDB.js";
-import "./chunk-FDIFTIXC.js";
-import "./chunk-4DHQCN5H.js";
-import "./chunk-XXTZBPUY.js";
+import "./chunk-3G25KIWW.js";
+import "./chunk-6TWWY7ZU.js";
+import "./chunk-EVBCK2KC.js";
 import "./chunk-XTK5VIQB.js";
-import "./chunk-U5SZ4FOP.js";
+import "./chunk-LBYOLBW7.js";
+import "./chunk-XXTZBPUY.js";
 
 // src/cli/commands/health-endpoint.ts
 import { resolve } from "path";
@@ -51,4 +51,4 @@ async function runHealthEndpointCommand(site, opts) {
 export {
   runHealthEndpointCommand
 };
-//# sourceMappingURL=health-endpoint-242WG2OJ.js.map
+//# sourceMappingURL=health-endpoint-WJC2UMYS.js.map

package/dist/health-mirror-4B2L7T2Y.js

@@ -0,0 +1,75 @@
+import {
+  healthColumnFor,
+  scheduleColumnFor
+} from "./chunk-ITIOFN7A.js";
+import "./chunk-ACBRLLFT.js";
+import {
+  MAINTENANCE_CHECKLIST,
+  TESTING_CHECKLIST
+} from "./chunk-VAD43MOR.js";
+import {
+  openDb,
+  readDbConfig
+} from "./chunk-JHGHLKFS.js";
+import "./chunk-3SF7D4DY.js";
+import "./chunk-LDWZSLSU.js";
+import "./chunk-6VAL7XJT.js";
+
+// src/db/fleet-state.ts
+async function mirrorHealthFields(db, siteId, fields) {
+  const patch = {};
+  for (const [field, value] of Object.entries(fields)) {
+    const m = healthColumnFor(field);
+    if (!m)
+      throw new Error(`mirrorHealthFields: importer claims no site_health column for '${field}'`);
+    patch[m.col] = m.coerce(value);
+  }
+  if (Object.keys(patch).length === 0) return true;
+  const res = await db.updateTable("site_health").set(patch).where("site_id", "=", siteId).executeTakeFirst();
+  return res.numUpdatedRows > 0n;
+}
+async function mirrorScheduleFields(db, siteId, fields, computedAt) {
+  const patch = {};
+  for (const [field, value] of Object.entries(fields)) {
+    const m = scheduleColumnFor(field);
+    if (!m)
+      throw new Error(
+        `mirrorScheduleFields: importer claims no site_schedule column for '${field}'`
+      );
+    patch[m.col] = m.coerce(value);
+  }
+  if (Object.keys(patch).length === 0) return true;
+  patch.computed_at = computedAt;
+  const res = await db.updateTable("site_schedule").set(patch).where("site_id", "=", siteId).executeTakeFirst();
+  return res.numUpdatedRows > 0n;
+}
+var CHECKLIST_FIELD_BY_KEY = new Map(
+  [...MAINTENANCE_CHECKLIST, ...TESTING_CHECKLIST].map((i) => [i.key, i.field])
+);
+
+// src/audits/health-mirror.ts
+async function makeHealthMirrorBestEffort(open = () => openDb(readDbConfig())) {
+  let db;
+  try {
+    db = await open();
+  } catch (e) {
+    console.error(`[health-mirror] mirroring disabled: no libSQL (${String(e)})`);
+    return null;
+  }
+  return (siteId, fields) => mirrorHealthFields(db, siteId, fields);
+}
+async function makeScheduleMirrorBestEffort(open = () => openDb(readDbConfig())) {
+  let db;
+  try {
+    db = await open();
+  } catch (e) {
+    console.error(`[schedule-mirror] mirroring disabled: no libSQL (${String(e)})`);
+    return null;
+  }
+  return (siteId, fields, computedAt) => mirrorScheduleFields(db, siteId, fields, computedAt);
+}
+export {
+  makeHealthMirrorBestEffort,
+  makeScheduleMirrorBestEffort
+};
+//# sourceMappingURL=health-mirror-4B2L7T2Y.js.map

package/dist/health-mirror-4B2L7T2Y.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/db/fleet-state.ts","../src/audits/health-mirror.ts"],"sourcesContent":["/** Phase 2 of the Airtable → Turso migration (#539): the fleet-state READ layer.\n *\n *  Returns the exact `WebsiteRow` shape the Airtable module returns, so every\n *  repoint is an import-only swap at a composition root — the same trick\n *  listSubmissionsForSite used for the hybrid-db cutover. The raw values live\n *  in `sites`/`site_health`/`site_schedule` (written by the importer / hourly\n *  sync); coercion to `WebsiteRow` happens HERE, reusing the Airtable module's\n *  own exported coercers (`toVerdict`, `toFrequency`, `parseNotifyRouting`,\n *  `parseSecurityAdvisories`, `trimToNull`) so there is one truth for each.\n *\n *  The equivalence instrument (tests/db/fleet-state.test.ts) pins this module\n *  to `mapRow` field-by-field: for a fixture record, `mapRow(rec)` must deep-\n *  equal the row read back through here after an import. A new WebsiteRow\n *  field fails that test until this module carries it.\n *\n *  `headerImage` is the ONE deliberate exception (design D5): Airtable stopped\n *  being its source — the bytes belong in `sites.header_image*`. Nothing\n *  writes those columns yet (verified empty across all 44 prod rows,\n *  2026-08-24), so this reads null fleet-wide today, and approve-report — the\n *  only request-path consumer — stays on the Airtable reader until the\n *  header-image writer moves in Phase 3. The `url` is \"\" because the bytes\n *  live in the row itself, not behind a signed URL.\n */\nimport type { Selectable, Updateable } from \"kysely\";\nimport type { Db } from \"./client.js\";\nimport type { ReportsTable, SiteHealthTable, SiteScheduleTable } from \"./schema.js\";\nimport { SITE_FIELDS, healthColumnFor, scheduleColumnFor } from \"./import-airtable.js\";\nimport {\n  toReportType,\n  parseAutoEvidence,\n  type ReportRow,\n  type DeliveryStatus,\n} from \"../reports/airtable/reports.js\";\nimport { MAINTENANCE_CHECKLIST, TESTING_CHECKLIST } from \"../reports/checklist.js\";\nimport type { WebsiteRow } from \"../reports/airtable/websites.js\";\nimport { canonicalizeStatus } from \"../reports/airtable/site-status.js\";\nimport {\n  parseNotifyRouting,\n  parseSecurityAdvisories,\n  toFrequency,\n  toPrismicModelsVerdict,\n  toVerdict,\n  trimToNull,\n} from \"../reports/airtable/websites.js\";\n\ntype JoinedRow = Record<string, unknown>;\n\nconst str = (v: unknown): string | null => (typeof v === \"string\" ? v : null);\nconst num = (v: unknown): number | null => (typeof v === \"number\" ? v : null);\n/** Stored 1/0/null (importer's b01n) → boolean | null. */\nconst bool = (v: unknown): boolean | null => (typeof v === \"number\" ? v !== 0 : null);\n\n/** Stored JSON array (importer-normalized) → the trimmed string[] mapRow yields. */\nfunction parseAwc(raw: unknown): string[] {\n  if (typeof raw !== \"string\" || raw.trim() === \"\") return [];\n  try {\n    const parsed: unknown = JSON.parse(raw);\n    if (!Array.isArray(parsed)) return [];\n    return parsed\n      .filter((x): x is string => typeof x === \"string\")\n      .map((s) => s.trim())\n      .filter(Boolean);\n  } catch {\n    return [];\n  }\n}\n\nfunction rowFromJoined(r: JoinedRow): WebsiteRow {\n  const name = String(r.name ?? \"\");\n  const headerFilename = str(r.header_image_filename);\n  const headerType = str(r.header_image_type);\n  return {\n    id: String(r.id),\n    name,\n    url: str(r.url) ?? \"\",\n    // `sites.status` holds the RAW Airtable cell (the importer stores it verbatim\n    // so the hourly parity check compares raw-to-raw). Canonicalizing HERE — the\n    // twin of mapRow's seam — is what keeps the #558 equivalence instrument green.\n    status: canonicalizeStatus(r.status),\n    statusRaw: str(r.status),\n    pointOfContact: str(r.point_of_contact),\n    maintenanceFreq: toFrequency(r.maintenance_freq, `${name} maintenance`),\n    testingFreq: toFrequency(r.testing_freq, `${name} testing`),\n    maintenanceFreqRaw: str(r.maintenance_freq),\n    testingFreqRaw: str(r.testing_freq),\n    maintenanceDay: str(r.maintenance_day),\n    testingDay: str(r.testing_day),\n    ga4PropertyId: str(r.ga4_property_id),\n    searchQuery: str(r.search_query),\n    searchConsoleProperty: str(r.search_console_property),\n    analyticsSoftFailAt: str(r.analytics_soft_fail_at),\n    gitRepo: str(r.git_repo),\n    reportRecipientsTo: str(r.report_recipients_to),\n    reportRecipientsCc: str(r.report_recipients_cc),\n    acceptedWatchConditions: parseAwc(r.accepted_watch_conditions),\n    headerImage:\n      headerFilename !== null && headerType !== null\n        ? { url: \"\", filename: headerFilename, type: headerType }\n        : null,\n    pScore: num(r.p_score),\n    rScore: num(r.r_score),\n    bpScore: num(r.bp_score),\n    seoScore: num(r.seo_score),\n    lastLighthouseAuditAt: str(r.lighthouse_at),\n    a11yViolations: num(r.a11y_violations),\n    depsDrifted: num(r.deps_drifted),\n    depsMajorBehind: num(r.deps_major_behind),\n    depsOutdated: num(r.deps_outdated),\n    depsMajorOutdated: num(r.deps_major_outdated),\n    securityVulnsCritical: num(r.vulns_critical),\n    securityVulnsHigh: num(r.vulns_high),\n    securityVulnsModerate: num(r.vulns_moderate),\n    securityVulnsLow: num(r.vulns_low),\n    securityAutoFixAttempts: num(r.auto_fix_attempts),\n    lastSecurityAuditAt: str(r.security_audit_at),\n    securityAdvisories: parseSecurityAdvisories(r.security_advisories),\n    certDaysRemaining: num(r.cert_days_remaining),\n    domainCheckedAt: str(r.domain_checked_at),\n    netlifyId: trimToNull(r.netlify_id),\n    deployStatus: str(r.deploy_status),\n    lastDeployAt: str(r.last_deploy_at),\n    deployLogUrl: str(r.deploy_log_url),\n    deployCheckedAt: str(r.deploy_checked_at),\n    functionHealth: toVerdict(r.function_health),\n    cmsReachable: toVerdict(r.cms_reachable),\n    turnstileWidget: toVerdict(r.turnstile_widget),\n    functionHealthCheckedAt: str(r.function_health_checked_at),\n    crossbrowserOk: bool(r.crossbrowser_ok),\n    mobileOk: bool(r.mobile_ok),\n    linksOk: bool(r.links_ok),\n    brokenLinks: num(r.broken_links),\n    browserCheckedAt: str(r.browser_checked_at),\n    reachableOk: toVerdict(r.uptime_reachable),\n    titleMetaOk: toVerdict(r.titles_meta_ok),\n    copyIntro: trimToNull(r.copy_intro),\n    copyContact: trimToNull(r.copy_contact),\n    copyFooter: trimToNull(r.copy_footer),\n    launchedAt: str(r.launched_at),\n    newsletterWebhook: trimToNull(r.newsletter_webhook),\n    notifyRouting: parseNotifyRouting(r.notify_routing),\n    notifyRoutingRaw: trimToNull(r.notify_routing),\n    mailchimpApiKey: trimToNull(r.mailchimp_api_key),\n    mailchimpAudienceId: trimToNull(r.mailchimp_audience_id),\n    requireTurnstile: typeof r.require_turnstile === \"number\" ? r.require_turnstile !== 0 : false,\n    renovateFailingCis: num(r.renovate_failing_cis),\n    defaultBranchCi: str(r.default_branch_ci),\n    lastCommitAt: str(r.last_commit_at),\n    githubSignalsAt: str(r.github_signals_at),\n    smokeOk: toVerdict(r.smoke_ok),\n    lastSmokeAt: str(r.last_smoke_at),\n    formE2eOk: toVerdict(r.form_e2e_ok),\n    formE2eCheckedAt: str(r.form_e2e_checked_at),\n    prismicModels: toPrismicModelsVerdict(r.prismic_models),\n    prismicModelsCheckedAt: str(r.prismic_models_checked_at),\n    prismicModelsDrift: str(r.prismic_models_drift),\n    prismicAckUntil: str(r.prismic_ack_until),\n    nextMaintenanceAt: str(r.next_maintenance_at),\n    nextTestingAt: str(r.next_testing_at),\n  };\n}\n\n/** Every sites column EXCEPT the header-image BLOB. Since the 2026-08-24\n *  backfill, header_image holds 0.7–3.5 MB JPEGs — a selectAll would haul\n *  megabytes into every site lookup (per LEAD on the ingest path, ×44 on the\n *  fleet list) and Turso bills the bytes. WebsiteRow only needs the metadata\n *  columns; the bytes have their own dedicated readers when a consumer wants\n *  them. Kept in lockstep with SitesTable by the blob-exclusion test. */\nconst SITE_COLUMNS = [\n  \"sites.id\",\n  \"sites.slug\",\n  \"sites.name\",\n  \"sites.url\",\n  \"sites.status\",\n  \"sites.point_of_contact\",\n  \"sites.maintenance_freq\",\n  \"sites.testing_freq\",\n  \"sites.maintenance_day\",\n  \"sites.testing_day\",\n  \"sites.ga4_property_id\",\n  \"sites.search_query\",\n  \"sites.search_console_property\",\n  \"sites.git_repo\",\n  \"sites.netlify_id\",\n  \"sites.report_recipients_to\",\n  \"sites.report_recipients_cc\",\n  \"sites.copy_intro\",\n  \"sites.copy_contact\",\n  \"sites.copy_footer\",\n  \"sites.newsletter_webhook\",\n  \"sites.mailchimp_api_key\",\n  \"sites.mailchimp_audience_id\",\n  \"sites.notify_routing\",\n  \"sites.require_turnstile\",\n  \"sites.accepted_watch_conditions\",\n  \"sites.prismic_ack_until\",\n  \"sites.launched_at\",\n  \"sites.header_image_filename\",\n  \"sites.header_image_type\",\n  \"sites.header_image_generated_at\",\n  \"sites.legacy\",\n] as const;\n\n/** The three-table join every read composes from. site_health/site_schedule\n *  rows are upserted alongside sites by the importer, but LEFT JOIN anyway —\n *  a site row must never vanish from a surface because a health row is absent. */\nfunction joined(db: Db) {\n  return db\n    .selectFrom(\"sites\")\n    .leftJoin(\"site_health\", \"site_health.site_id\", \"sites.id\")\n    .leftJoin(\"site_schedule\", \"site_schedule.site_id\", \"sites.id\")\n    .select(SITE_COLUMNS)\n    .selectAll([\"site_health\", \"site_schedule\"]);\n}\n\n/** Write-through for the site-detail editor (Phase 2): after the Airtable\n *  write (still the Phase 2 source of truth), mirror the same cell into\n *  `sites` so a Turso-reading page renders the edit immediately instead of\n *  waiting for the next hourly sync. The column mapping is the IMPORTER's own\n *  map — one truth — and the value gets the importer's empty-clears-to-null\n *  semantics. Throws on a column the importer doesn't claim (the lockstep\n *  test makes that unreachable for the editor's allowlist); the caller treats\n *  a mirror failure as non-fatal — the hourly sync converges it.\n *\n *  Deliberately NOT applicable to `Require Turnstile` or other non-text\n *  columns: every editor field is plain text today, and the lockstep test\n *  pins that assumption. */\nexport async function mirrorSiteField(\n  db: Db,\n  siteId: string,\n  airtableColumn: string,\n  value: string,\n): Promise<void> {\n  const col = SITE_FIELDS[airtableColumn];\n  if (!col)\n    throw new Error(`mirrorSiteField: importer claims no sites column for '${airtableColumn}'`);\n  const stored = value.trim() === \"\" ? null : value;\n  await db\n    .updateTable(\"sites\")\n    .set({ [col]: stored })\n    .where(\"id\", \"=\", siteId)\n    .execute();\n}\n\n/** Write-through mirror for the nightly health writers (#539 Phase 3). Takes\n *  the EXACT FieldSet just written to Airtable (updateAuditFields /\n *  updateGitHubSignals return it), so the mirror can never carry a different\n *  payload than the Airtable write it shadows. Resolution + coercion come from\n *  the importer's healthColumnFor — one truth; an Airtable column no\n *  site_health column claims throws (same contract as mirrorSiteField).\n *  Partial by design: absent fields stay untouched, matching\n *  updateGitHubSignals' deliberate omission of a null lastCommitAt. Returns\n *  whether a site_health row matched: a site the hourly sync hasn't imported\n *  yet updates 0 rows → false, so the caller can count it honestly\n *  (mirror_missed) instead of claiming it mirrored — it still converges on the\n *  next sync, like every mirror. An empty FieldSet runs no SQL and returns\n *  true: nothing to mirror is not a miss. */\nexport async function mirrorHealthFields(\n  db: Db,\n  siteId: string,\n  fields: Record<string, unknown>,\n): Promise<boolean> {\n  // Per-column value types (number vs text) are guaranteed by healthColumnFor's\n  // coercion — the numeric/text split lives there, once — so the patch builds\n  // untyped and casts at the .set() boundary (the importer's own idiom).\n  const patch: Record<string, string | number | null> = {};\n  for (const [field, value] of Object.entries(fields)) {\n    const m = healthColumnFor(field);\n    if (!m)\n      throw new Error(`mirrorHealthFields: importer claims no site_health column for '${field}'`);\n    patch[m.col] = m.coerce(value);\n  }\n  if (Object.keys(patch).length === 0) return true;\n  const res = await db\n    .updateTable(\"site_health\")\n    .set(patch as Updateable<SiteHealthTable>)\n    .where(\"site_id\", \"=\", siteId)\n    .executeTakeFirst();\n  // kysely/libSQL reports numUpdatedRows as a BigInt — compare in BigInt.\n  return res.numUpdatedRows > 0n;\n}\n\n/** The site_schedule twin of {@link mirrorHealthFields}, for the nightly\n *  next-due write-back. `computedAt` stamps when THIS computation ran — the\n *  hourly sync overwrites it with its own import stamp, same as every mirrored\n *  value. Empty fields → full no-op (no lone computed_at stamp for a write\n *  that carried nothing). Same return contract as mirrorHealthFields: false\n *  when the UPDATE matched no site_schedule row (site not yet imported), true\n *  otherwise — including the empty-fields no-op. */\nexport async function mirrorScheduleFields(\n  db: Db,\n  siteId: string,\n  fields: Record<string, unknown>,\n  computedAt: string,\n): Promise<boolean> {\n  const patch: Record<string, string | null> = {};\n  for (const [field, value] of Object.entries(fields)) {\n    const m = scheduleColumnFor(field);\n    if (!m)\n      throw new Error(\n        `mirrorScheduleFields: importer claims no site_schedule column for '${field}'`,\n      );\n    patch[m.col] = m.coerce(value);\n  }\n  if (Object.keys(patch).length === 0) return true;\n  patch.computed_at = computedAt;\n  const res = await db\n    .updateTable(\"site_schedule\")\n    .set(patch as Updateable<SiteScheduleTable>)\n    .where(\"site_id\", \"=\", siteId)\n    .executeTakeFirst();\n  return res.numUpdatedRows > 0n;\n}\n\n/** Same contract as the Airtable getWebsiteBySlug: slug is siteSlug(Name),\n *  precomputed into the UNIQUE sites.slug column at import time. */\nexport async function getSiteBySlug(db: Db, slug: string): Promise<WebsiteRow | null> {\n  const r = await joined(db).where(\"sites.slug\", \"=\", slug).executeTakeFirst();\n  return r ? rowFromJoined(r as JoinedRow) : null;\n}\n\n/** By Airtable rec id (the PK) — approve-report's lookup shape. */\nexport async function getSiteById(db: Db, id: string): Promise<WebsiteRow | null> {\n  const r = await joined(db).where(\"sites.id\", \"=\", id).executeTakeFirst();\n  return r ? rowFromJoined(r as JoinedRow) : null;\n}\n\n/** Same contract as the Airtable listWebsites: every site, one row each.\n *  Name-ordered for determinism (Airtable returned table order; no consumer\n *  is order-sensitive — the cockpit groups and sorts itself). */\nexport async function listSites(db: Db): Promise<WebsiteRow[]> {\n  const rows = await joined(db).orderBy(\"sites.name\").execute();\n  return rows.map((r) => rowFromJoined(r as JoinedRow));\n}\n\n// ————————————————————————— reports —————————————————————————\n\n/** stable checklist key → Airtable column name. The importer stores stable keys\n *  (mapReportRecord); `ReportRow.checklist` exposes Airtable column names — one\n *  derived map, built from the checklist definitions themselves. */\nconst CHECKLIST_FIELD_BY_KEY: ReadonlyMap<string, string> = new Map(\n  [...MAINTENANCE_CHECKLIST, ...TESTING_CHECKLIST].map((i) => [i.key, i.field]),\n);\n\nfunction checklistFromStored(raw: string | null): Record<string, boolean> {\n  let stored: Record<string, unknown> = {};\n  if (typeof raw === \"string\" && raw.trim() !== \"\") {\n    try {\n      const parsed: unknown = JSON.parse(raw);\n      if (parsed && typeof parsed === \"object\" && !Array.isArray(parsed))\n        stored = parsed as Record<string, unknown>;\n    } catch {\n      // fall through to all-false — a bad blob must not throw the page\n    }\n  }\n  const out: Record<string, boolean> = {};\n  for (const [key, field] of CHECKLIST_FIELD_BY_KEY) out[field] = Boolean(stored[key]);\n  return out;\n}\n\nfunction reportRowFromDb(r: Selectable<ReportsTable>): ReportRow {\n  const p = r.lighthouse_performance;\n  const a = r.lighthouse_accessibility;\n  const b = r.lighthouse_best_practices;\n  const seo = r.lighthouse_seo;\n  const lighthouse =\n    typeof p === \"number\" &&\n    typeof a === \"number\" &&\n    typeof b === \"number\" &&\n    typeof seo === \"number\"\n      ? { performance: p, accessibility: a, bestPractices: b, seo }\n      : null;\n  return {\n    id: r.id,\n    reportId: r.report_id ?? \"\",\n    siteId: r.site_id ?? \"\",\n    reportType: toReportType(r.report_type ?? undefined),\n    period: r.period,\n    periodStart: r.period_start,\n    periodEnd: r.period_end,\n    completedOn: r.completed_on,\n    lighthouse,\n    gaUsersCurrent: r.ga_users_current,\n    gaUsersPrevious: r.ga_users_previous,\n    searchFoundPage1: bool(r.search_found_page1),\n    searchPosition: r.search_position,\n    lastTestedDate: r.last_tested_date,\n    commentary: r.commentary,\n    subjectOverride: r.subject_override,\n    draftReady: r.draft_ready !== 0,\n    approvedToSend: r.approved_to_send !== 0,\n    sentAt: r.sent_at,\n    approvedAt: r.approved_at,\n    approvedBy: r.approved_by,\n    deliveryStatus: (r.delivery_status ?? \"pending\") as DeliveryStatus,\n    // The body lives IN the row (rendered_html) — the link points at the\n    // dashboard's own preview route instead of an EXPIRING Airtable signed URL.\n    // Strictly better for the operator: the old link 404'd once the URL aged out.\n    renderedHtmlAttachment:\n      r.rendered_html !== null\n        ? { url: `/api/reports/${r.id}/preview`, filename: `${r.report_id ?? r.id}.html` }\n        : null,\n    resendMessageId: r.resend_message_id,\n    checklist: checklistFromStored(r.checklist),\n    autoEvidence: parseAutoEvidence(r.checklist_auto_evidence),\n    sendOverride: r.send_override !== 0,\n    overrideReason: r.override_reason,\n    overrideBy: r.override_by,\n    overrideAt: r.override_at,\n  };\n}\n\n/** Same contract as the Airtable listAllReports. Newest-period-first (Airtable\n *  returned manual table order; every consumer filters/sorts itself). */\nexport async function listAllReports(db: Db): Promise<ReportRow[]> {\n  const rows = await db\n    .selectFrom(\"reports\")\n    .selectAll()\n    .orderBy(\"period_start\", \"desc\")\n    .orderBy(\"id\")\n    .execute();\n  return rows.map(reportRowFromDb);\n}\n\n/** Same contract as the Airtable listReportsForSite — served by idx_reports_site. */\nexport async function listReportsForSite(db: Db, siteId: string): Promise<ReportRow[]> {\n  const rows = await db\n    .selectFrom(\"reports\")\n    .selectAll()\n    .where(\"site_id\", \"=\", siteId)\n    .orderBy(\"period_start\", \"desc\")\n    .orderBy(\"id\")\n    .execute();\n  return rows.map(reportRowFromDb);\n}\n\n/** Columns the REQUEST-PATH report writers mirror after their Airtable write\n *  (same pattern as mirrorSiteField): the approve/override flow and the\n *  resend-webhook's delivery status. Send-path columns (sent_at,\n *  resend_message_id, rendered_html) are deliberately absent — the send is a\n *  CLI batch whose writes reach Turso via the hourly sync until Phase 3. */\nexport type ReportMirrorPatch = Partial<\n  Pick<\n    ReportsTable,\n    | \"approved_to_send\"\n    | \"approved_at\"\n    | \"approved_by\"\n    | \"send_override\"\n    | \"override_reason\"\n    | \"override_by\"\n    | \"override_at\"\n    | \"delivery_status\"\n  >\n>;\n\n/** Mirror an Airtable report write into Turso so the page re-render after an\n *  approve/override/bounce shows the new state immediately instead of after\n *  the next hourly sync. Callers treat a failure as non-fatal (the sync\n *  converges it); an empty patch is a no-op, never invalid SQL. */\nexport async function mirrorReportPatch(\n  db: Db,\n  reportId: string,\n  patch: ReportMirrorPatch,\n): Promise<void> {\n  if (Object.keys(patch).length === 0) return;\n  await db.updateTable(\"reports\").set(patch).where(\"id\", \"=\", reportId).execute();\n}\n\n/** By rec id (the PK) — approve-report's read. */\nexport async function getReportById(db: Db, id: string): Promise<ReportRow | null> {\n  const r = await db.selectFrom(\"reports\").selectAll().where(\"id\", \"=\", id).executeTakeFirst();\n  return r ? reportRowFromDb(r) : null;\n}\n\n/** The preview route's read: the stored rendered body, or null when the report\n *  has none (imported while its signed URL was expired, or predates rendering). */\nexport async function getReportHtml(\n  db: Db,\n  id: string,\n): Promise<{ html: string; reportId: string | null } | null> {\n  const r = await db\n    .selectFrom(\"reports\")\n    .select([\"rendered_html\", \"report_id\"])\n    .where(\"id\", \"=\", id)\n    .executeTakeFirst();\n  if (!r || r.rendered_html === null) return null;\n  return { html: r.rendered_html, reportId: r.report_id };\n}\n","import { openDb, readDbConfig, type Db } from \"../db/client.js\";\nimport { mirrorHealthFields, mirrorScheduleFields } from \"../db/fleet-state.js\";\n\n/** One site's just-written Airtable FieldSet, mirrored into site_health.\n *  Resolves true when a site_health row matched; false when the UPDATE touched\n *  0 rows (site created in Airtable after the last hourly import) — callers\n *  count that as mirror_missed, never as mirrored. */\nexport type HealthMirror = (siteId: string, fields: Record<string, unknown>) => Promise<boolean>;\n\n/** The site_schedule twin, for the nightly next-due write-back. Same\n *  matched-row contract as {@link HealthMirror}: false = 0-row UPDATE →\n *  mirror_missed. */\nexport type ScheduleMirror = (\n  siteId: string,\n  fields: Record<string, unknown>,\n  computedAt: string,\n) => Promise<boolean>;\n\n/** Build the Turso write-through for the nightly writers (#539 Phase 3\n *  dual-write), or null when libSQL creds are absent — mirroring NOT attempted\n *  is a different outcome than mirroring failed, and the caller's summary line\n *  reports mirror counts only when a mirror existed. Same contract as\n *  recordFleetEventsBestEffort: the mirror must never fail the sweep that\n *  produced the data (per-site failures are the caller's to count; Airtable\n *  stays authoritative and the hourly sync converges whatever the mirror\n *  missed). `open` is injectable for tests. */\nexport async function makeHealthMirrorBestEffort(\n  open: () => Promise<Db> = () => openDb(readDbConfig()),\n): Promise<HealthMirror | null> {\n  let db: Db;\n  try {\n    db = await open();\n  } catch (e) {\n    console.error(`[health-mirror] mirroring disabled: no libSQL (${String(e)})`);\n    return null;\n  }\n  return (siteId, fields) => mirrorHealthFields(db, siteId, fields);\n}\n\n/** {@link makeHealthMirrorBestEffort}'s schedule twin — same null-without-creds\n *  contract, for `writeNextDueDates`' site_schedule write-through. */\nexport async function makeScheduleMirrorBestEffort(\n  open: () => Promise<Db> = () => openDb(readDbConfig()),\n): Promise<ScheduleMirror | null> {\n  let db: Db;\n  try {\n    db = await open();\n  } catch (e) {\n    console.error(`[schedule-mirror] mirroring disabled: no libSQL (${String(e)})`);\n    return null;\n  }\n  return (siteId, fields, computedAt) => mirrorScheduleFields(db, siteId, fields, computedAt);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAgQA,eAAsB,mBACpB,IACA,QACA,QACkB;AAIlB,QAAM,QAAgD,CAAC;AACvD,aAAW,CAAC,OAAO,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACnD,UAAM,IAAI,gBAAgB,KAAK;AAC/B,QAAI,CAAC;AACH,YAAM,IAAI,MAAM,kEAAkE,KAAK,GAAG;AAC5F,UAAM,EAAE,GAAG,IAAI,EAAE,OAAO,KAAK;AAAA,EAC/B;AACA,MAAI,OAAO,KAAK,KAAK,EAAE,WAAW,EAAG,QAAO;AAC5C,QAAM,MAAM,MAAM,GACf,YAAY,aAAa,EACzB,IAAI,KAAoC,EACxC,MAAM,WAAW,KAAK,MAAM,EAC5B,iBAAiB;AAEpB,SAAO,IAAI,iBAAiB;AAC9B;AASA,eAAsB,qBACpB,IACA,QACA,QACA,YACkB;AAClB,QAAM,QAAuC,CAAC;AAC9C,aAAW,CAAC,OAAO,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACnD,UAAM,IAAI,kBAAkB,KAAK;AACjC,QAAI,CAAC;AACH,YAAM,IAAI;AAAA,QACR,sEAAsE,KAAK;AAAA,MAC7E;AACF,UAAM,EAAE,GAAG,IAAI,EAAE,OAAO,KAAK;AAAA,EAC/B;AACA,MAAI,OAAO,KAAK,KAAK,EAAE,WAAW,EAAG,QAAO;AAC5C,QAAM,cAAc;AACpB,QAAM,MAAM,MAAM,GACf,YAAY,eAAe,EAC3B,IAAI,KAAsC,EAC1C,MAAM,WAAW,KAAK,MAAM,EAC5B,iBAAiB;AACpB,SAAO,IAAI,iBAAiB;AAC9B;AA4BA,IAAM,yBAAsD,IAAI;AAAA,EAC9D,CAAC,GAAG,uBAAuB,GAAG,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC;AAC9E;;;AC3TA,eAAsB,2BACpB,OAA0B,MAAM,OAAO,aAAa,CAAC,GACvB;AAC9B,MAAI;AACJ,MAAI;AACF,SAAK,MAAM,KAAK;AAAA,EAClB,SAAS,GAAG;AACV,YAAQ,MAAM,kDAAkD,OAAO,CAAC,CAAC,GAAG;AAC5E,WAAO;AAAA,EACT;AACA,SAAO,CAAC,QAAQ,WAAW,mBAAmB,IAAI,QAAQ,MAAM;AAClE;AAIA,eAAsB,6BACpB,OAA0B,MAAM,OAAO,aAAa,CAAC,GACrB;AAChC,MAAI;AACJ,MAAI;AACF,SAAK,MAAM,KAAK;AAAA,EAClB,SAAS,GAAG;AACV,YAAQ,MAAM,oDAAoD,OAAO,CAAC,CAAC,GAAG;AAC9E,WAAO;AAAA,EACT;AACA,SAAO,CAAC,QAAQ,QAAQ,eAAe,qBAAqB,IAAI,QAAQ,QAAQ,UAAU;AAC5F;","names":[]}

package/dist/import-airtable-HE43FB4H.js

@@ -0,0 +1,35 @@
+import {
+  EXCLUDED_WEBSITE_FIELDS,
+  HEALTH_BOOLEAN,
+  HEALTH_FIELDS,
+  SCHEDULE_FIELDS,
+  SITE_FIELDS,
+  formatReapSummary,
+  healthColumnFor,
+  importFleetState,
+  mapReportRecord,
+  mapWebsiteRecord,
+  reapAllowance,
+  reapRefusal,
+  renderedHtmlUrl,
+  scheduleColumnFor
+} from "./chunk-ITIOFN7A.js";
+import "./chunk-VAD43MOR.js";
+import "./chunk-LDWZSLSU.js";
+export {
+  EXCLUDED_WEBSITE_FIELDS,
+  HEALTH_BOOLEAN,
+  HEALTH_FIELDS,
+  SCHEDULE_FIELDS,
+  SITE_FIELDS,
+  formatReapSummary,
+  healthColumnFor,
+  importFleetState,
+  mapReportRecord,
+  mapWebsiteRecord,
+  reapAllowance,
+  reapRefusal,
+  renderedHtmlUrl,
+  scheduleColumnFor
+};
+//# sourceMappingURL=import-airtable-HE43FB4H.js.map

package/dist/index.d.ts

@@ -1,8 +1,9 @@
 import { a as AuditResult, S as Site, A as AuditName, b as RecipeResult, R as RecipeName, I as InventoryProvider } from './types-OIQZ5hWN.js';
 export { C as ConfigName } from './types-OIQZ5hWN.js';
-import * as airtable_lib_airtable_base_js from 'airtable/lib/airtable_base.js';
+import { A as AirtableBase, a as FleetEventType } from './fleet-events-cF2Om88w.js';
 import { F as FormType } from './types-RXY-vY-5.js';
 export { SyncConfigsOptions, syncConfigs } from './recipes/sync-configs.js';
+import 'airtable/lib/airtable_base.js';
 
 type SpawnResult = {
     code: number;
@@ -119,7 +120,15 @@ type FormSubmitOutcome = {
     formPresent: true;
     success: boolean;
     detail?: string;
+    /** Click → success banner VISIBLE. A user-experience number: it includes the
+     *  browser's own render of the banner, which no server budget governs. */
     elapsedMs?: number;
+    /** Click → the action's POST response arrives. This is the span the site's
+     *  `INGEST_TIMEOUT_MS` abort budget actually governs (it wraps the
+     *  site→central fetch, which is nested inside this POST), so it — not
+     *  `elapsedMs` — is what the budget check must compare against. Undefined
+     *  when no POST was observed. */
+    postElapsedMs?: number;
 } | {
     testModeUndeclared: true;
 };
@@ -388,13 +397,6 @@ declare function localPath(path: string, opts?: LocalPathOptions): InventoryProv
 
 declare function fromJsonFile(path: string): InventoryProvider;
 
-type AirtableConfig = {
-    apiKey: string;
-    baseId: string;
-};
-type AirtableBase = ReturnType<typeof openBase>;
-declare function openBase(cfg: AirtableConfig): airtable_lib_airtable_base_js.AirtableBase;
-
 type AirtableInventoryOptions = {
     /**
      * Local workdir to compute each site's path as `{workdir}/{slug}`.
@@ -407,21 +409,105 @@ type AirtableInventoryOptions = {
  * Read sites from the Airtable Websites table as an InventoryProvider.
  * Each row becomes one Site; `path` is computed as `{workdir}/{slug}`.
  * Only LIVE `maintenance` sites that have a `url` are included — pre-launch
- * stages ("launch period" / "in development", via isPreLaunch) are excluded so a
+ * stages ("launching" / "building", via isPreLaunch) are excluded so a
  * not-yet-live site is never audited as production (its deploy/domain/uptime/CMS
  * audits would fail against nothing and red its Airtable row) nor swept by other
  * `--fleet airtable` ops; it re-enters the fleet when a Launch report flips its
- * Status to "maintenance". The production URL is exposed as `Site.deployedUrl` so
+ * Status to "maintained". The production URL is exposed as `Site.deployedUrl` so
  * the lighthouse audit can run against it with no checkout. `repoUrl` is
  * intentionally NOT set from `url` — a clone source must come from `gitRepo`
  * (`owner/repo`), never the production URL.
  */
 declare function fromAirtableBase(base: AirtableBase, opts?: AirtableInventoryOptions): InventoryProvider;
 
+/**
+ * The site-status vocabulary — ONE module owns it (#539 Phase 4).
+ *
+ * The fleet's lifecycle names were inherited from an Airtable single-select
+ * written by hand years ago ("probably not our problem"). The operator approved
+ * a canonical vocabulary, and the migration is now COMPLETE in both stores:
+ * Airtable's "Status" single-select carries exactly the six canonical options
+ * and nothing else. This module no longer knows the old names at all.
+ *
+ * The retired mapping, kept as the record of what was merged into what:
+ *
+ *   old (retired 2026-08-25)    new (canonical)
+ *   ─────────────────────────   ───────────────
+ *   in development              building
+ *   launch period               launching
+ *   maintenance                 maintained
+ *   hosting                     hosted-only
+ *   probably not our problem    external
+ *   legacy                    ┐
+ *   deprecated                ┴ archived        ← approved MERGE, many-to-one
+ *
+ * `legacy` and `deprecated` were already treated identically by every PREDICATE
+ * (ARCHIVED_STATUSES held both), so collapsing them changes no *selection* — no
+ * fleet op gains or loses a site. It is NOT true that collapsing them changes
+ * nothing at all, and one surface proved it: the cockpit's Archived lane LABELS
+ * each row with its Status cell, and canonicalizing there rendered all 12 live
+ * archived rows as "archived". That lane now labels from `statusRaw`, which is
+ * exactly why `WebsiteRow.statusRaw` exists. The rule this leaves behind:
+ * canonical values decide BEHAVIOUR; anything DISPLAYING a Status cell, or
+ * writing one back, uses the raw cell.
+ *
+ * The merge had NO clean reverse map while both vocabularies coexisted, which
+ * is why `toAirtableStatus` had to pick one archived name deliberately. With the
+ * old names retired there is nothing left to pick between, and no code path
+ * feeds operator-supplied text through it anyway (see
+ * `src/recipes/forms-notify-target.ts`, which writes `--restore` verbatim).
+ *
+ * THE SHAPE OF THE TRANSITION (three stages):
+ *
+ *   stage 1 (DONE)  code speaks the NEW vocabulary internally; reads canonicalize
+ *                   at the two Airtable/Turso seams; writes still emit the OLD
+ *                   Airtable option names. Airtable untouched. No SELECTION
+ *                   change — every predicate picks exactly the sites it picked
+ *                   before (pinned row-by-row in tests/reports/airtable/
+ *                   site-status.test.ts). Displayed labels come from `statusRaw`.
+ *   stage 2 (DONE)  the Airtable "Status" single-select gained the 6 new options
+ *                   and all 44 cells were migrated (verified live: maintained=13,
+ *                   archived=12, external=9, building=6, hosted-only=2,
+ *                   launching=2 — zero old values, zero unrecognized), `db sync`
+ *                   ran clean (mismatches=0), and AIRTABLE_USES_NEW_VOCABULARY
+ *                   flipped to true. Writers now emit canonical names verbatim.
+ *                   The alias map STAYS: the 7 old options still exist in the
+ *                   field, so a human can still pick one in the Airtable UI.
+ *   stage 3 (DONE)  the operator deleted the 7 old options from the Airtable
+ *                   "Status" field on 2026-08-25, which is what made this safe:
+ *                   the gate was always "no old value CAN BE ENTERED", not
+ *                   merely "none is stored". Verified against the live base
+ *                   before any code changed — the field carries exactly the six
+ *                   canonical choices, byte-exact, and all 44 cells still hold a
+ *                   canonical value with ZERO blanks (deleting a single-select
+ *                   option CLEARS the cells using it, so "no cell was blanked"
+ *                   was checked, not assumed). AIRTABLE_STATUS_ALIASES,
+ *                   AIRTABLE_OLD_NAMES and AIRTABLE_USES_NEW_VOCABULARY are
+ *                   gone; both functions reduce to the identity.
+ *
+ * WHAT CHANGED IN BEHAVIOUR AT STAGE 3, and it is the only thing that did: an
+ * old name is no longer translated. `canonicalizeStatus("maintenance")` used to
+ * yield `maintained`; it now yields `"maintenance"` verbatim, which
+ * `isUnrecognizedStatus` flags and the cockpit surfaces as a watch row. That is
+ * intended. The option cannot be selected any more, so a stored old value would
+ * mean something went wrong — a restored backup, a scripted write, an API
+ * caller with a stale constant — and the fleet should say so rather than absorb
+ * it into a status nobody chose.
+ *
+ * Canonicalization happens on READ, never at rest: `src/db/import-airtable.ts`
+ * still stores the raw Airtable cell verbatim in `sites.status`, so the hourly
+ * parity check keeps comparing raw-to-raw and the importer stays honest to its
+ * source. Both readers — `mapRow` (Airtable) and `rowFromJoined` (Turso) — run
+ * the raw value through `canonicalizeStatus`, which is what keeps the #558
+ * reader-equivalence instrument green.
+ */
+/** The canonical site lifecycle vocabulary. */
+type Status = "building" | "launching" | "maintained" | "hosted-only" | "external" | "archived";
+
 type Frequency = "None" | "Monthly" | "Quarterly" | "Yearly";
-type Status = "in development" | "launch period" | "maintenance" | "hosting" | "probably not our problem" | "deprecated" | "legacy";
+
 /**
- * Per-site notification routing. When present on a `maintenance` site, the form
+ * Per-site notification routing. When present on a `maintained` site, the form
  * notification is addressed by the value of a submission field (`field`, read from
  * `extraFields`) — e.g. route a contact form's `interest` to a different recipient
  * per option, always CC-ing a shared address. Absent (`null`) → the site keeps the
@@ -443,7 +529,17 @@ type WebsiteRow = {
     id: string;
     name: string;
     url: string;
+    /** Canonical lifecycle status (see ./site-status.ts). Canonicalized at the read
+     *  boundary, so an old-vocabulary Airtable cell and a new one read identically.
+     *  A present-but-unrecognized cell survives VERBATIM (blind-cast) rather than
+     *  becoming null — `isUnrecognizedStatus` flags it, and null would make
+     *  due.ts/preflight.ts treat the row as eligible-by-default. */
     status: Status | null;
+    /** The literal Airtable Status cell behind `status` — same pattern as
+     *  `maintenanceFreqRaw`. The dashboard status editor round-trips THIS, so its
+     *  dropdown offers and preselects the values Airtable actually holds while the
+     *  two vocabularies coexist. Null = blank cell. */
+    statusRaw: string | null;
     pointOfContact: string | null;
     maintenanceFreq: Frequency;
     testingFreq: Frequency;
@@ -670,6 +766,18 @@ type WebsiteRow = {
      */
     prismicAckUntil: string | null;
     notifyRouting: NotifyRouting | null;
+    /** The RAW `Notify Routing` cell, verbatim. Same reason `statusRaw` exists: the
+     *  dashboard editor round-trips this JSON, and re-serializing the PARSED object
+     *  would drop any key the parser ignores and reformat what the operator typed —
+     *  a silent rewrite of a cell they only opened to look at. */
+    notifyRoutingRaw: string | null;
+    /** Read-back of the code-owned next-due dates (date-only, written by the
+     *  nightly `writeNextDueDates`). These exist so the writer can DIFF the
+     *  freshly-computed dates against what the row already holds and skip the
+     *  ~31 no-op writes a night the fleet was paying for (#539 Phase 3). Null =
+     *  cell blank or the operator-added `Next … at` column absent. */
+    nextMaintenanceAt: string | null;
+    nextTestingAt: string | null;
 };
 /** The `Prismic Models` cell — see {@link WebsiteRow.prismicModels} for why it
  *  carries a third state that no other verdict column in this table has. */
@@ -884,7 +992,9 @@ type RefreshHeaderDeps = {
         url: string;
         slug?: string;
     }) => Promise<GeneratedHeaderImage>;
-    upload?: (recordId: string, field: string, bytes: Uint8Array, filename: string, contentType: string) => Promise<void>;
+    upload?: (recordId: string, field: string, bytes: Uint8Array, filename: string, contentType: string, opts?: {
+        replaceIn?: string;
+    }) => Promise<void>;
 };
 type DraftOptions = {
     /** Where to write the local preview HTML when `previewOnly`. Defaults to `reports/<slug>/draft.html`. */
@@ -1145,8 +1255,6 @@ type AttentionItem = {
     autoFixExhausted?: boolean;
 };
 
-type FleetEventType = "pr_automerged" | "vuln_cleared" | "ci_recovered" | "site_launched" | "fleet_swept" | "cert_renewed" | "report_sent_with_override";
-
 type Tier = "attention" | "watch" | "healthy" | "pre-launch";
 type SiteCard = {
     site: WebsiteRow;
@@ -1191,7 +1299,7 @@ type CockpitSummary = {
     attention: number;
     watch: number;
     healthy: number;
-    /** Count of pre-live "launch period" sites still muted as expected pre-launch
+    /** Count of pre-live "launching" sites still muted as expected pre-launch
      *  conditions. A piercing alarm (piercesPreLaunchMute) re-tiers such a site to
      *  attention, so it counts there instead — muted never means "hidden if broken". */
     preLaunch: number;
@@ -1221,7 +1329,15 @@ type RecentEntry = {
     ts: string;
 };
 /** A Websites row surfaced OUTSIDE the fleet cards: archived (legacy/deprecated)
- *  or holding an unrecognized Status cell. `status` is the raw cell value. */
+ *  or holding an unrecognized Status cell.
+ *
+ *  `status` is the RAW Airtable cell, not the canonical status (#539 Phase 4).
+ *  These two lanes exist to mirror what Airtable holds so a row can never
+ *  silently vanish, and both of them survive on the distinction the canonical
+ *  vocabulary erases: `legacy` and `deprecated` both canonicalize to `archived`,
+ *  so labelling the lane canonically would render 12 live rows identically and
+ *  disagree with the cell the operator is looking at. Everything else about
+ *  these rows — which lane they land in — is decided canonically. */
 type OffFleetSiteEntry = {
     name: string;
     slug: string;
@@ -1268,7 +1384,7 @@ type SiteAlarmContext = {
  * fetches data, then hands it here. Easier to unit-test, easier to render
  * a static preview from CLI later.
  */
-declare function renderSiteDashboardHtml(site: WebsiteRow, reports: ReportRow[], submissions?: SubmissionRow[], spamTotals?: ScreenOutTotals | null, now?: Date, alarm?: SiteAlarmContext | null): string;
+declare function renderSiteDashboardHtml(site: WebsiteRow, reports: ReportRow[], submissions?: SubmissionRow[], spamTotals?: ScreenOutTotals | null, now?: Date, alarm?: SiteAlarmContext | null, operatorEmail?: string | null): string;
 
 /**
  * Render the fleet cockpit as a single HTML document. Pure function: no Airtable
@@ -1277,7 +1393,7 @@ declare function renderSiteDashboardHtml(site: WebsiteRow, reports: ReportRow[],
  * and hands it here. Renders the doc shell + verdict bar + the per-site Needs-you
  * feed + the collapsed Fleet browse panel (one flat, filterable card grid).
  */
-declare function renderCockpitHtml(model: CockpitModel): string;
+declare function renderCockpitHtml(model: CockpitModel, operatorEmail?: string | null): string;
 
 /**
  * Verify an `Authorization: Basic <base64>` header against the configured
@@ -1300,7 +1416,45 @@ declare function renderCockpitHtml(model: CockpitModel): string;
  */
 declare function verifyBasicAuth(authHeader: string | null | undefined, expectedPassword: string | null): boolean;
 
-/** Read the bundled 2400x3200 plate. */
+/** Per-report-type headline overlays, stamped over the CLEAN plate at send time
+ *  (see orchestrate.ts). Types with no entry go out on the clean plate.
+ *
+ *  Source: Figma "Web-Maintenance-Email" (mQ3hy2d9JnOG9ljCzbZS8j) —
+ *  Maintenance is node 158:15, Testing is 153:721 ("maintenance & testing",
+ *  which is what a Testing report actually covers). Export each at 4x; Figma
+ *  crops a text export to its ink box, which is why these are 1328x660 /
+ *  1715x664 rather than the 1840x720 text box.
+ *
+ *  ⚠️ A Figma MCP `download_assets` export arrives FLATTENED — never
+ *  transparent — and it flattens onto WHATEVER SITS BEHIND THE NODE, which is
+ *  not one fixed colour: Maintenance/Testing live inside a white Header frame
+ *  and come back on white, while Announcement/Launch sit on the bare canvas and
+ *  come back on Figma's canvas grey (30,30,30). Stamping either unprocessed
+ *  paints a solid slab over the paper texture — that, not a bad design file, is
+ *  what made the 2026-08-20 Testing asset unusable.
+ *
+ *  Recover the alpha instead of re-exporting by hand: for ink C over backdrop B,
+ *  a = (px - B) / (C - B). DETECT B (the export's most common colour) rather
+ *  than assuming white, and pick the channel with the largest |C - B| — green
+ *  separates the brand red from white by 221 levels but from canvas grey by only
+ *  4, which would quantise the alpha to noise. Verified against the known-good
+ *  Maintenance asset at mean abs alpha diff 0.022, 0.0037% of pixels off by
+ *  more than 8.
+ *
+ *  Editing this copy needs Figma desktop, not the Plugin API: `characters`
+ *  requires loadFontAsync and the MCP font environment carries no Helvetica at
+ *  all, so the licensed Helvetica Neue LT Std can never load there. */
+declare const HEADLINE_FILES: {
+    readonly Maintenance: "headline-maintenance.png";
+    readonly Testing: "headline-testing.png";
+    readonly Announcement: "headline-announcement.png";
+    readonly Launch: "headline-launch.png";
+};
+type HeadlineKind = keyof typeof HEADLINE_FILES;
+/** Read the bundled 2400x3200 CLEAN plate (no headline — the report type's
+ *  headline is stamped at send time, so one stored image serves every type). */
 declare function loadPlate(): Promise<Uint8Array>;
+/** Read a headline overlay (transparent PNG, ink-box cropped). */
+declare function loadHeadline(kind: HeadlineKind): Promise<Uint8Array>;
 
-export { ALL_AUDIT_NAMES, ALL_RECIPE_NAMES, type AirtableInventoryOptions, AuditName, AuditResult, BLURRED_CID, type BumpDepsOptions, type BundledImage, CHECK_CID, type ConvertToPnpmOptions, DEFAULT_INIT_STEPS, type DraftOptions, type DraftResult, type DueItem, type GenerateInput, type GeneratedHeaderImage, type HeaderImage, type InitOptions, type InitResult, type InitStep, type InitStepResult, InventoryProvider, type LighthouseScores, type LocalPathOptions, type OnboardAudit, type OnboardOptions, type OrchestrateOptions, RecipeName, RecipeResult, type RefreshHeaderDeps, type RenderResult, type ReportData, type ReportType, Site, type UpgradeSvelte4to5Options, a11yAudit, a11yFixturesPage, bumpDeps, convertToPnpm, depsAudit, domainFromUrl, draftReportForSite, findDueReports, fromAirtableBase, fromJsonFile, generateHeaderImage, init, isRecipeName, lighthouseAudit, lintAudit, loadBundledImages, loadPlate, localPath, onboard, renderCockpitHtml, renderReportHtml, renderSiteDashboardHtml, runAudits, runAuditsAcross, securityAudit, selfCaretRange, selfPackageVersion, sendApprovedReports, svelteCodemods, upgradeSvelte4to5, verifyBasicAuth };
+export { ALL_AUDIT_NAMES, ALL_RECIPE_NAMES, type AirtableInventoryOptions, AuditName, AuditResult, BLURRED_CID, type BumpDepsOptions, type BundledImage, CHECK_CID, type ConvertToPnpmOptions, DEFAULT_INIT_STEPS, type DraftOptions, type DraftResult, type DueItem, type GenerateInput, type GeneratedHeaderImage, type HeaderImage, type InitOptions, type InitResult, type InitStep, type InitStepResult, InventoryProvider, type LighthouseScores, type LocalPathOptions, type OnboardAudit, type OnboardOptions, type OrchestrateOptions, RecipeName, RecipeResult, type RefreshHeaderDeps, type RenderResult, type ReportData, type ReportType, Site, type UpgradeSvelte4to5Options, a11yAudit, a11yFixturesPage, bumpDeps, convertToPnpm, depsAudit, domainFromUrl, draftReportForSite, findDueReports, fromAirtableBase, fromJsonFile, generateHeaderImage, init, isRecipeName, lighthouseAudit, lintAudit, loadBundledImages, loadHeadline, loadPlate, localPath, onboard, renderCockpitHtml, renderReportHtml, renderSiteDashboardHtml, runAudits, runAuditsAcross, securityAudit, selfCaretRange, selfPackageVersion, sendApprovedReports, svelteCodemods, upgradeSvelte4to5, verifyBasicAuth };