@reddoorla/maintenance 0.85.2 → 0.87.0

package/dist/{renovate-dispatch-ICJGSFCE.js.map → renovate-dispatch-6GQWTRKX.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/github/renovate-dispatch.ts","../src/cli/commands/renovate-dispatch.ts"],"sourcesContent":["import {\n  allActionableVulnsTransitive,\n  isDashboardVisible,\n  type WebsiteRow,\n} from \"../reports/airtable/websites.js\";\nimport { isRenovatePR } from \"../alerts/renovate.js\";\nimport type { PullRequestSummary } from \"./gh.js\";\n\n/**\n * On-demand Renovate trigger for fleet sites.\n *\n * The nightly security sweep (`fleet-security.yml`) writes each active site's\n * vulnerability counts to Airtable. This module turns that into action: for the\n * sites the sweep just flagged with *actionable* (critical or high) vulns, it\n * dispatches that repo's `renovate.yml` `workflow_dispatch` so Renovate runs off\n * its twice-daily schedule. Renovate's OSV vulnerability alerts bypass the\n * schedule, so the remediation PR opens immediately — and because GitHub's\n * platform auto-merge is disabled fleet-wide, Renovate merges it from inside that\n * same run (or a later scheduled one) per the shared preset, which is what keeps\n * the preset's \"majors are never auto-merged\" rule authoritative. Moderate/low\n * vulns are left to the normal schedule — not urgent enough to dispatch + churn\n * CI nightly.\n */\n\n/** The per-repo workflow file the fleet uses for its self-hosted Renovate run. */\nexport const RENOVATE_WORKFLOW_FILE = \"renovate.yml\";\n\n/**\n * Does the repo have a HEALTHY open Renovate PR — one that is NOT conflicting?\n *\n * A healthy PR means remediation is genuinely in flight (moving toward merge), so\n * re-dispatching would just churn CI — skip it. A CONFLICTING Renovate PR is STUCK\n * (its branch fell behind the base after another PR merged the same lockfile), so\n * it does NOT count as healthy: re-dispatching triggers Renovate to rebase it.\n * `UNKNOWN` mergeability (GitHub still computing it) is treated as healthy — don't\n * churn on uncertainty. Reuses {@link isRenovatePR} for the branch-prefix check.\n */\nexport function hasHealthyRenovatePr(prs: PullRequestSummary[]): boolean {\n  return prs.some((pr) => isRenovatePR(pr) && pr.mergeable !== \"CONFLICTING\");\n}\n\n/** A site selected for an on-demand Renovate run, with the reason (vuln counts). */\nexport type RenovateDispatchTarget = {\n  repo: string; // owner/repo, from the Websites \"Git repo\" field\n  siteName: string;\n  critical: number;\n  high: number;\n};\n\n/**\n * Pick the active, repo-backed sites whose latest security sweep found a\n * critical or high vulnerability. A `null` vuln count is treated as zero (a site\n * that was never swept, or had its counts cleared, is not dispatched). Inactive\n * sites and sites without a `Git repo` are excluded — there's nothing to kick.\n *\n * Counts are only guaranteed fresh for sites the sweep actually audited (active +\n * URL present); a site whose write-back failed/was skipped this run is selected on\n * its last-known counts. That's safe — a stale-high false dispatch is an idempotent\n * Renovate no-op, and the open-PR skip in `dispatchRenovateAcross` avoids re-firing\n * when remediation is already in flight.\n */\nexport function selectRenovateTargets(sites: WebsiteRow[]): RenovateDispatchTarget[] {\n  const targets: RenovateDispatchTarget[] = [];\n  for (const s of sites) {\n    if (!isDashboardVisible(s)) continue; // active (maintenance / launch period) only\n    const repo = s.gitRepo?.trim();\n    if (!repo) continue; // repo-backed only — the dispatch target is its renovate.yml\n    const critical = s.securityVulnsCritical ?? 0;\n    const high = s.securityVulnsHigh ?? 0;\n    if (critical + high <= 0) continue; // actionable (critical/high) vulns only\n    targets.push({ repo, siteName: s.name, critical, high });\n  }\n  return targets;\n}\n\n/** Injected GitHub operations — real ones come from `makeGitHub`, fakes from tests. */\nexport type RenovateDispatchDeps = {\n  /** True iff the repo has a HEALTHY (non-conflicting) open Renovate PR —\n   *  remediation in flight, so don't re-dispatch. A conflicting/stuck PR returns\n   *  false so the dispatch goes through and Renovate rebases it. */\n  hasHealthyOpenRenovatePr: (repo: string) => Promise<boolean>;\n  defaultBranch: (repo: string) => Promise<string>;\n  dispatch: (repo: string, workflow: string, ref: string) => Promise<void>;\n};\n\nexport type RenovateDispatchResult = {\n  dispatched: string[];\n  /** Repos skipped because a Renovate PR is already open — no point re-firing. */\n  skipped: string[];\n  failed: { repo: string; error: string }[];\n};\n\n/**\n * Dispatch `renovate.yml` for each target on its default branch.\n *\n * Skips a repo with a HEALTHY (non-conflicting) open Renovate PR — remediation is\n * in flight, so re-dispatching would just churn CI (keeps a persistent vuln from\n * re-firing every nightly run while its fix PR waits, e.g. a human-gated major\n * bump). A repo whose open Renovate PR is CONFLICTING/stuck is NOT skipped:\n * dispatching triggers Renovate to rebase it. Best-effort and isolated: a repo\n * that lacks `renovate.yml`, or whose\n * dispatch/PR-check is refused (the token's `actions:write` scope), is recorded in\n * `failed` and the rest still run. Never throws — the caller (a follow-up step on\n * the security sweep) must not be able to fail the sweep over a dispatch hiccup.\n */\nexport async function dispatchRenovateAcross(\n  targets: RenovateDispatchTarget[],\n  deps: RenovateDispatchDeps,\n): Promise<RenovateDispatchResult> {\n  const dispatched: string[] = [];\n  const skipped: string[] = [];\n  const failed: { repo: string; error: string }[] = [];\n  for (const t of targets) {\n    try {\n      if (await deps.hasHealthyOpenRenovatePr(t.repo)) {\n        skipped.push(t.repo);\n        continue;\n      }\n      const ref = await deps.defaultBranch(t.repo);\n      await deps.dispatch(t.repo, RENOVATE_WORKFLOW_FILE, ref);\n      dispatched.push(t.repo);\n    } catch (e) {\n      failed.push({ repo: t.repo, error: e instanceof Error ? e.message : String(e) });\n    }\n  }\n  return { dispatched, skipped, failed };\n}\n\n/** Machine-readable counts line the workflow greps to annotate partial failures. */\nexport function formatRenovateDispatchSummary(result: RenovateDispatchResult): string {\n  return `RENOVATE_DISPATCH_SUMMARY dispatched=${result.dispatched.length} skipped=${result.skipped.length} failed=${result.failed.length}`;\n}\n\n/**\n * Plan the per-site auto-fix-attempt counter writes from a dispatch result. PURE.\n * For each site:\n *   - vulns now 0 (or never counted)       → reset to 0   (episode resolved)\n *   - else dispatched this run             → attempts + 1 (a fresh failed-so-far attempt)\n *   - else (skipped / failed / untouched)  → unchanged\n * The RESET applies fleet-wide — regardless of Status or Git repo — so a site\n * archived or un-repo'd after its episode can't carry a stale counter into its\n * next vuln (Alamo sat at 7 from a long-closed episode). A null vuln count\n * (never-audited) reads as zero, consistent with the existing null-as-zero\n * semantics, so a lingering counter on such a row also clears. The INCREMENT\n * keeps its active + repo-backed filters (only those sites are dispatched).\n * Returns only the rows whose value CHANGES (a steady fleet writes nothing —\n * a 0→0 site emits no write). A skipped repo (healthy Renovate PR in flight) is\n * NOT a failed attempt — a fix is genuinely moving toward merge — so its counter\n * holds. A dispatched site whose critical/high advisories are ALL proven\n * TRANSITIVE also holds: Renovate has no direct-dep bump to open, so the run is a\n * known green no-op waiting on the weekly lockfile window, not a failed fix\n * attempt (Sonder rode 5 such no-ops to a false \"auto-fix failed\", 2026-08-10).\n * Missing/unknown relationship data keeps the increment — never mute on absence.\n */\nexport function computeAutoFixAttemptUpdates(\n  sites: WebsiteRow[],\n  result: RenovateDispatchResult,\n): { id: string; attempts: number }[] {\n  const dispatched = new Set(result.dispatched);\n  const updates: { id: string; attempts: number }[] = [];\n  for (const s of sites) {\n    const current = s.securityAutoFixAttempts ?? 0;\n    const vulns = (s.securityVulnsCritical ?? 0) + (s.securityVulnsHigh ?? 0);\n    if (vulns === 0) {\n      // Episode resolved (or never confirmed): reset REGARDLESS of status/repo —\n      // a site archived or un-repo'd after its episode must not carry a stale\n      // counter into its next vuln (Alamo sat at 7 from a long-closed episode).\n      if (current !== 0) updates.push({ id: s.id, attempts: 0 });\n      continue;\n    }\n    if (!isDashboardVisible(s)) continue; // increments stay active-only\n    const repo = s.gitRepo?.trim();\n    if (!repo) continue; // …and repo-backed-only\n    if (!dispatched.has(repo)) continue;\n    // Transitive-only episode: the dispatch can't produce a fix PR (no direct dep\n    // to bump) — don't count the no-op as a failed attempt.\n    if (allActionableVulnsTransitive(s.securityAdvisories)) continue;\n    updates.push({ id: s.id, attempts: current + 1 });\n  }\n  return updates;\n}\n\n/**\n * Apply the planned counter updates with an injected writer, BEST-EFFORT: a writer\n * that throws (e.g. the Airtable field not yet created, or a transient error) is\n * counted in `failed` and never propagates — the security sweep must not fail over\n * counter bookkeeping. Returns the applied/failed tallies for the summary line.\n */\nexport async function applyAutoFixAttemptUpdates(\n  updates: { id: string; attempts: number }[],\n  write: (id: string, attempts: number) => Promise<void>,\n): Promise<{ written: number; failed: number }> {\n  let written = 0;\n  let failed = 0;\n  for (const u of updates) {\n    try {\n      await write(u.id, u.attempts);\n      written++;\n    } catch {\n      failed++;\n    }\n  }\n  return { written, failed };\n}\n\n/** Machine-readable counts line the workflow can grep, mirroring RENOVATE_DISPATCH_SUMMARY. */\nexport function formatAutoFixAttemptsSummary(tally: { written: number; failed: number }): string {\n  return `AUTO_FIX_ATTEMPTS_SUMMARY written=${tally.written} failed=${tally.failed}`;\n}\n","import { openBase, readAirtableConfig, type AirtableBase } from \"../../reports/airtable/client.js\";\nimport { listWebsites, updateAutoFixAttempts } from \"../../reports/airtable/websites.js\";\nimport { makeGitHub } from \"../../github/gh.js\";\nimport {\n  selectRenovateTargets,\n  dispatchRenovateAcross,\n  formatRenovateDispatchSummary,\n  hasHealthyRenovatePr,\n  computeAutoFixAttemptUpdates,\n  applyAutoFixAttemptUpdates,\n  formatAutoFixAttemptsSummary,\n  type RenovateDispatchResult,\n} from \"../../github/renovate-dispatch.js\";\n\n/**\n * `renovate-dispatch --fleet`: read the Websites table, pick the active,\n * repo-backed sites the latest security sweep flagged with critical/high vulns,\n * and fire each one's `renovate.yml` `workflow_dispatch` so Renovate's OSV\n * vulnerability alerts open the remediation PR now (instead of waiting for the\n * weekly schedule). Designed to run as a best-effort follow-up step on\n * `fleet-security.yml` AFTER the sweep has written fresh counts to Airtable.\n *\n * Always exits 0: a missing token is a clean skip; a partial dispatch failure\n * (a repo without `renovate.yml`, or a token lacking `actions:write`) is reported\n * in the summary for the workflow to annotate, never failing the security sweep.\n */\nexport async function runRenovateDispatchCommand(opts: {\n  fleet?: boolean | undefined;\n  /** Inject a pre-opened Airtable base (tests). Defaults to env config. */\n  base?: AirtableBase;\n}): Promise<{ output: string; code: number }> {\n  if (!opts.fleet) {\n    return { output: \"renovate-dispatch currently supports only --fleet\", code: 2 };\n  }\n  const token = process.env.RENOVATE_TOKEN?.trim() || process.env.GH_TOKEN?.trim();\n  if (!token) {\n    return {\n      output: \"renovate-dispatch skipped: no RENOVATE_TOKEN/GH_TOKEN (fleet dispatch) configured.\",\n      code: 0,\n    };\n  }\n\n  const base = opts.base ?? openBase(readAirtableConfig());\n  const websites = await listWebsites(base);\n  const targets = selectRenovateTargets(websites);\n\n  const lines: string[] = [];\n  let result: RenovateDispatchResult = { dispatched: [], skipped: [], failed: [] };\n  if (targets.length === 0) {\n    lines.push(\n      \"No active repo-backed sites with critical/high vulnerabilities — nothing to dispatch.\",\n    );\n  } else {\n    const gh = makeGitHub({ token });\n    result = await dispatchRenovateAcross(targets, {\n      hasHealthyOpenRenovatePr: async (repo) =>\n        hasHealthyRenovatePr(await gh.openPullRequests(repo)),\n      defaultBranch: (repo) => gh.defaultBranch(repo),\n      dispatch: (repo, workflow, ref) => gh.dispatchWorkflow(repo, workflow, ref),\n    });\n\n    const failedRepos = new Set(result.failed.map((f) => f.repo));\n    const skippedRepos = new Set(result.skipped);\n    for (const t of targets) {\n      const status = failedRepos.has(t.repo)\n        ? \"FAILED                       \"\n        : skippedRepos.has(t.repo)\n          ? \"skipped (open Renovate PR)   \"\n          : \"dispatched                   \";\n      lines.push(`${status} ${t.repo} (critical=${t.critical} high=${t.high}) — ${t.siteName}`);\n    }\n    for (const f of result.failed) lines.push(`  ↳ ${f.repo}: ${f.error}`);\n  }\n\n  // Counter bookkeeping runs on EVERY fleet run — the reset-on-clean branch was\n  // previously unreachable behind the zero-targets early return, so a fully-clean\n  // fleet never cleared stale counters (Alamo stuck at 7, 2026-07). Best-effort:\n  // a failed write is tallied, never thrown. Uses the full `websites` list so\n  // 0-vuln sites reset.\n  const attemptUpdates = computeAutoFixAttemptUpdates(websites, result);\n  const attemptTally = await applyAutoFixAttemptUpdates(attemptUpdates, (id, attempts) =>\n    updateAutoFixAttempts(base, id, attempts),\n  );\n\n  lines.push(formatRenovateDispatchSummary(result));\n  lines.push(formatAutoFixAttemptsSummary(attemptTally));\n\n  return { output: lines.join(\"\\n\"), code: 0 };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAyBO,IAAM,yBAAyB;AAY/B,SAAS,qBAAqB,KAAoC;AACvE,SAAO,IAAI,KAAK,CAAC,OAAO,aAAa,EAAE,KAAK,GAAG,cAAc,aAAa;AAC5E;AAsBO,SAAS,sBAAsB,OAA+C;AACnF,QAAM,UAAoC,CAAC;AAC3C,aAAW,KAAK,OAAO;AACrB,QAAI,CAAC,mBAAmB,CAAC,EAAG;AAC5B,UAAM,OAAO,EAAE,SAAS,KAAK;AAC7B,QAAI,CAAC,KAAM;AACX,UAAM,WAAW,EAAE,yBAAyB;AAC5C,UAAM,OAAO,EAAE,qBAAqB;AACpC,QAAI,WAAW,QAAQ,EAAG;AAC1B,YAAQ,KAAK,EAAE,MAAM,UAAU,EAAE,MAAM,UAAU,KAAK,CAAC;AAAA,EACzD;AACA,SAAO;AACT;AAgCA,eAAsB,uBACpB,SACA,MACiC;AACjC,QAAM,aAAuB,CAAC;AAC9B,QAAM,UAAoB,CAAC;AAC3B,QAAM,SAA4C,CAAC;AACnD,aAAW,KAAK,SAAS;AACvB,QAAI;AACF,UAAI,MAAM,KAAK,yBAAyB,EAAE,IAAI,GAAG;AAC/C,gBAAQ,KAAK,EAAE,IAAI;AACnB;AAAA,MACF;AACA,YAAM,MAAM,MAAM,KAAK,cAAc,EAAE,IAAI;AAC3C,YAAM,KAAK,SAAS,EAAE,MAAM,wBAAwB,GAAG;AACvD,iBAAW,KAAK,EAAE,IAAI;AAAA,IACxB,SAAS,GAAG;AACV,aAAO,KAAK,EAAE,MAAM,EAAE,MAAM,OAAO,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,EAAE,CAAC;AAAA,IACjF;AAAA,EACF;AACA,SAAO,EAAE,YAAY,SAAS,OAAO;AACvC;AAGO,SAAS,8BAA8B,QAAwC;AACpF,SAAO,wCAAwC,OAAO,WAAW,MAAM,YAAY,OAAO,QAAQ,MAAM,WAAW,OAAO,OAAO,MAAM;AACzI;AAuBO,SAAS,6BACd,OACA,QACoC;AACpC,QAAM,aAAa,IAAI,IAAI,OAAO,UAAU;AAC5C,QAAM,UAA8C,CAAC;AACrD,aAAW,KAAK,OAAO;AACrB,UAAM,UAAU,EAAE,2BAA2B;AAC7C,UAAM,SAAS,EAAE,yBAAyB,MAAM,EAAE,qBAAqB;AACvE,QAAI,UAAU,GAAG;AAIf,UAAI,YAAY,EAAG,SAAQ,KAAK,EAAE,IAAI,EAAE,IAAI,UAAU,EAAE,CAAC;AACzD;AAAA,IACF;AACA,QAAI,CAAC,mBAAmB,CAAC,EAAG;AAC5B,UAAM,OAAO,EAAE,SAAS,KAAK;AAC7B,QAAI,CAAC,KAAM;AACX,QAAI,CAAC,WAAW,IAAI,IAAI,EAAG;AAG3B,QAAI,6BAA6B,EAAE,kBAAkB,EAAG;AACxD,YAAQ,KAAK,EAAE,IAAI,EAAE,IAAI,UAAU,UAAU,EAAE,CAAC;AAAA,EAClD;AACA,SAAO;AACT;AAQA,eAAsB,2BACpB,SACA,OAC8C;AAC9C,MAAI,UAAU;AACd,MAAI,SAAS;AACb,aAAW,KAAK,SAAS;AACvB,QAAI;AACF,YAAM,MAAM,EAAE,IAAI,EAAE,QAAQ;AAC5B;AAAA,IACF,QAAQ;AACN;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,SAAS,OAAO;AAC3B;AAGO,SAAS,6BAA6B,OAAoD;AAC/F,SAAO,qCAAqC,MAAM,OAAO,WAAW,MAAM,MAAM;AAClF;;;ACtLA,eAAsB,2BAA2B,MAIH;AAC5C,MAAI,CAAC,KAAK,OAAO;AACf,WAAO,EAAE,QAAQ,qDAAqD,MAAM,EAAE;AAAA,EAChF;AACA,QAAM,QAAQ,QAAQ,IAAI,gBAAgB,KAAK,KAAK,QAAQ,IAAI,UAAU,KAAK;AAC/E,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,MAAM;AAAA,IACR;AAAA,EACF;AAEA,QAAM,OAAO,KAAK,QAAQ,SAAS,mBAAmB,CAAC;AACvD,QAAM,WAAW,MAAM,aAAa,IAAI;AACxC,QAAM,UAAU,sBAAsB,QAAQ;AAE9C,QAAM,QAAkB,CAAC;AACzB,MAAI,SAAiC,EAAE,YAAY,CAAC,GAAG,SAAS,CAAC,GAAG,QAAQ,CAAC,EAAE;AAC/E,MAAI,QAAQ,WAAW,GAAG;AACxB,UAAM;AAAA,MACJ;AAAA,IACF;AAAA,EACF,OAAO;AACL,UAAM,KAAK,WAAW,EAAE,MAAM,CAAC;AAC/B,aAAS,MAAM,uBAAuB,SAAS;AAAA,MAC7C,0BAA0B,OAAO,SAC/B,qBAAqB,MAAM,GAAG,iBAAiB,IAAI,CAAC;AAAA,MACtD,eAAe,CAAC,SAAS,GAAG,cAAc,IAAI;AAAA,MAC9C,UAAU,CAAC,MAAM,UAAU,QAAQ,GAAG,iBAAiB,MAAM,UAAU,GAAG;AAAA,IAC5E,CAAC;AAED,UAAM,cAAc,IAAI,IAAI,OAAO,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC;AAC5D,UAAM,eAAe,IAAI,IAAI,OAAO,OAAO;AAC3C,eAAW,KAAK,SAAS;AACvB,YAAM,SAAS,YAAY,IAAI,EAAE,IAAI,IACjC,kCACA,aAAa,IAAI,EAAE,IAAI,IACrB,kCACA;AACN,YAAM,KAAK,GAAG,MAAM,IAAI,EAAE,IAAI,cAAc,EAAE,QAAQ,SAAS,EAAE,IAAI,YAAO,EAAE,QAAQ,EAAE;AAAA,IAC1F;AACA,eAAW,KAAK,OAAO,OAAQ,OAAM,KAAK,YAAO,EAAE,IAAI,KAAK,EAAE,KAAK,EAAE;AAAA,EACvE;AAOA,QAAM,iBAAiB,6BAA6B,UAAU,MAAM;AACpE,QAAM,eAAe,MAAM;AAAA,IAA2B;AAAA,IAAgB,CAAC,IAAI,aACzE,sBAAsB,MAAM,IAAI,QAAQ;AAAA,EAC1C;AAEA,QAAM,KAAK,8BAA8B,MAAM,CAAC;AAChD,QAAM,KAAK,6BAA6B,YAAY,CAAC;AAErD,SAAO,EAAE,QAAQ,MAAM,KAAK,IAAI,GAAG,MAAM,EAAE;AAC7C;","names":[]}
+{"version":3,"sources":["../src/github/renovate-dispatch.ts","../src/cli/commands/renovate-dispatch.ts"],"sourcesContent":["import {\n  allActionableVulnsTransitive,\n  isDashboardVisible,\n  type WebsiteRow,\n} from \"../reports/airtable/websites.js\";\nimport { isRenovatePR } from \"../alerts/renovate.js\";\nimport type { PullRequestSummary } from \"./gh.js\";\n\n/**\n * On-demand Renovate trigger for fleet sites.\n *\n * The nightly security sweep (`fleet-security.yml`) writes each active site's\n * vulnerability counts to Airtable. This module turns that into action: for the\n * sites the sweep just flagged with *actionable* (critical or high) vulns, it\n * dispatches that repo's `renovate.yml` `workflow_dispatch` so Renovate runs off\n * its twice-daily schedule. Renovate's OSV vulnerability alerts bypass the\n * schedule, so the remediation PR opens immediately — and because GitHub's\n * platform auto-merge is disabled fleet-wide, Renovate merges it from inside that\n * same run (or a later scheduled one) per the shared preset, which is what keeps\n * the preset's \"majors are never auto-merged\" rule authoritative. Moderate/low\n * vulns are left to the normal schedule — not urgent enough to dispatch + churn\n * CI nightly.\n */\n\n/** The per-repo workflow file the fleet uses for its self-hosted Renovate run. */\nexport const RENOVATE_WORKFLOW_FILE = \"renovate.yml\";\n\n/**\n * Does the repo have a HEALTHY open Renovate PR — one that is NOT conflicting?\n *\n * A healthy PR means remediation is genuinely in flight (moving toward merge), so\n * re-dispatching would just churn CI — skip it. A CONFLICTING Renovate PR is STUCK\n * (its branch fell behind the base after another PR merged the same lockfile), so\n * it does NOT count as healthy: re-dispatching triggers Renovate to rebase it.\n * `UNKNOWN` mergeability (GitHub still computing it) is treated as healthy — don't\n * churn on uncertainty. Reuses {@link isRenovatePR} for the branch-prefix check.\n */\nexport function hasHealthyRenovatePr(prs: PullRequestSummary[]): boolean {\n  return prs.some((pr) => isRenovatePR(pr) && pr.mergeable !== \"CONFLICTING\");\n}\n\n/** A site selected for an on-demand Renovate run, with the reason (vuln counts). */\nexport type RenovateDispatchTarget = {\n  repo: string; // owner/repo, from the Websites \"Git repo\" field\n  siteName: string;\n  critical: number;\n  high: number;\n};\n\n/**\n * Pick the active, repo-backed sites whose latest security sweep found a\n * critical or high vulnerability. A `null` vuln count is treated as zero (a site\n * that was never swept, or had its counts cleared, is not dispatched). Inactive\n * sites and sites without a `Git repo` are excluded — there's nothing to kick.\n *\n * Counts are only guaranteed fresh for sites the sweep actually audited (active +\n * URL present); a site whose write-back failed/was skipped this run is selected on\n * its last-known counts. That's safe — a stale-high false dispatch is an idempotent\n * Renovate no-op, and the open-PR skip in `dispatchRenovateAcross` avoids re-firing\n * when remediation is already in flight.\n */\nexport function selectRenovateTargets(sites: WebsiteRow[]): RenovateDispatchTarget[] {\n  const targets: RenovateDispatchTarget[] = [];\n  for (const s of sites) {\n    if (!isDashboardVisible(s)) continue; // active (maintenance / launch period) only\n    const repo = s.gitRepo?.trim();\n    if (!repo) continue; // repo-backed only — the dispatch target is its renovate.yml\n    const critical = s.securityVulnsCritical ?? 0;\n    const high = s.securityVulnsHigh ?? 0;\n    if (critical + high <= 0) continue; // actionable (critical/high) vulns only\n    targets.push({ repo, siteName: s.name, critical, high });\n  }\n  return targets;\n}\n\n/** Injected GitHub operations — real ones come from `makeGitHub`, fakes from tests. */\nexport type RenovateDispatchDeps = {\n  /** True iff the repo has a HEALTHY (non-conflicting) open Renovate PR —\n   *  remediation in flight, so don't re-dispatch. A conflicting/stuck PR returns\n   *  false so the dispatch goes through and Renovate rebases it. */\n  hasHealthyOpenRenovatePr: (repo: string) => Promise<boolean>;\n  defaultBranch: (repo: string) => Promise<string>;\n  dispatch: (repo: string, workflow: string, ref: string) => Promise<void>;\n};\n\nexport type RenovateDispatchResult = {\n  dispatched: string[];\n  /** Repos skipped because a Renovate PR is already open — no point re-firing. */\n  skipped: string[];\n  failed: { repo: string; error: string }[];\n};\n\n/**\n * Dispatch `renovate.yml` for each target on its default branch.\n *\n * Skips a repo with a HEALTHY (non-conflicting) open Renovate PR — remediation is\n * in flight, so re-dispatching would just churn CI (keeps a persistent vuln from\n * re-firing every nightly run while its fix PR waits, e.g. a human-gated major\n * bump). A repo whose open Renovate PR is CONFLICTING/stuck is NOT skipped:\n * dispatching triggers Renovate to rebase it. Best-effort and isolated: a repo\n * that lacks `renovate.yml`, or whose\n * dispatch/PR-check is refused (the token's `actions:write` scope), is recorded in\n * `failed` and the rest still run. Never throws — the caller (a follow-up step on\n * the security sweep) must not be able to fail the sweep over a dispatch hiccup.\n */\nexport async function dispatchRenovateAcross(\n  targets: RenovateDispatchTarget[],\n  deps: RenovateDispatchDeps,\n): Promise<RenovateDispatchResult> {\n  const dispatched: string[] = [];\n  const skipped: string[] = [];\n  const failed: { repo: string; error: string }[] = [];\n  for (const t of targets) {\n    try {\n      if (await deps.hasHealthyOpenRenovatePr(t.repo)) {\n        skipped.push(t.repo);\n        continue;\n      }\n      const ref = await deps.defaultBranch(t.repo);\n      await deps.dispatch(t.repo, RENOVATE_WORKFLOW_FILE, ref);\n      dispatched.push(t.repo);\n    } catch (e) {\n      failed.push({ repo: t.repo, error: e instanceof Error ? e.message : String(e) });\n    }\n  }\n  return { dispatched, skipped, failed };\n}\n\n/** Machine-readable counts line the workflow greps to annotate partial failures. */\nexport function formatRenovateDispatchSummary(result: RenovateDispatchResult): string {\n  return `RENOVATE_DISPATCH_SUMMARY dispatched=${result.dispatched.length} skipped=${result.skipped.length} failed=${result.failed.length}`;\n}\n\n/**\n * Plan the per-site auto-fix-attempt counter writes from a dispatch result. PURE.\n * For each site:\n *   - vulns now 0 (or never counted)       → reset to 0   (episode resolved)\n *   - else dispatched this run             → attempts + 1 (a fresh failed-so-far attempt)\n *   - else (skipped / failed / untouched)  → unchanged\n * The RESET applies fleet-wide — regardless of Status or Git repo — so a site\n * archived or un-repo'd after its episode can't carry a stale counter into its\n * next vuln (Alamo sat at 7 from a long-closed episode). A null vuln count\n * (never-audited) reads as zero, consistent with the existing null-as-zero\n * semantics, so a lingering counter on such a row also clears. The INCREMENT\n * keeps its active + repo-backed filters (only those sites are dispatched).\n * Returns only the rows whose value CHANGES (a steady fleet writes nothing —\n * a 0→0 site emits no write). A skipped repo (healthy Renovate PR in flight) is\n * NOT a failed attempt — a fix is genuinely moving toward merge — so its counter\n * holds. A dispatched site whose critical/high advisories are ALL proven\n * TRANSITIVE also holds: Renovate has no direct-dep bump to open, so the run is a\n * known green no-op waiting on the weekly lockfile window, not a failed fix\n * attempt (Sonder rode 5 such no-ops to a false \"auto-fix failed\", 2026-08-10).\n * Missing/unknown relationship data keeps the increment — never mute on absence.\n */\nexport function computeAutoFixAttemptUpdates(\n  sites: WebsiteRow[],\n  result: RenovateDispatchResult,\n): { id: string; attempts: number }[] {\n  const dispatched = new Set(result.dispatched);\n  const updates: { id: string; attempts: number }[] = [];\n  for (const s of sites) {\n    const current = s.securityAutoFixAttempts ?? 0;\n    const vulns = (s.securityVulnsCritical ?? 0) + (s.securityVulnsHigh ?? 0);\n    if (vulns === 0) {\n      // Episode resolved (or never confirmed): reset REGARDLESS of status/repo —\n      // a site archived or un-repo'd after its episode must not carry a stale\n      // counter into its next vuln (Alamo sat at 7 from a long-closed episode).\n      if (current !== 0) updates.push({ id: s.id, attempts: 0 });\n      continue;\n    }\n    if (!isDashboardVisible(s)) continue; // increments stay active-only\n    const repo = s.gitRepo?.trim();\n    if (!repo) continue; // …and repo-backed-only\n    if (!dispatched.has(repo)) continue;\n    // Transitive-only episode: the dispatch can't produce a fix PR (no direct dep\n    // to bump) — don't count the no-op as a failed attempt.\n    if (allActionableVulnsTransitive(s.securityAdvisories)) continue;\n    updates.push({ id: s.id, attempts: current + 1 });\n  }\n  return updates;\n}\n\n/**\n * Apply the planned counter updates with an injected writer, BEST-EFFORT: a writer\n * that throws (e.g. the Airtable field not yet created, or a transient error) is\n * counted in `failed` and never propagates — the security sweep must not fail over\n * counter bookkeeping. Returns the applied/failed tallies for the summary line.\n */\nexport async function applyAutoFixAttemptUpdates(\n  updates: { id: string; attempts: number }[],\n  write: (id: string, attempts: number) => Promise<void>,\n): Promise<{ written: number; failed: number }> {\n  let written = 0;\n  let failed = 0;\n  for (const u of updates) {\n    try {\n      await write(u.id, u.attempts);\n      written++;\n    } catch {\n      failed++;\n    }\n  }\n  return { written, failed };\n}\n\n/** Machine-readable counts line the workflow can grep, mirroring RENOVATE_DISPATCH_SUMMARY. */\nexport function formatAutoFixAttemptsSummary(tally: { written: number; failed: number }): string {\n  return `AUTO_FIX_ATTEMPTS_SUMMARY written=${tally.written} failed=${tally.failed}`;\n}\n","import { openBase, readAirtableConfig, type AirtableBase } from \"../../reports/airtable/client.js\";\nimport type { SiteMirror } from \"../../db/site-mirror.js\";\nimport { listWebsites, updateAutoFixAttempts } from \"../../reports/airtable/websites.js\";\nimport { makeGitHub } from \"../../github/gh.js\";\nimport {\n  selectRenovateTargets,\n  dispatchRenovateAcross,\n  formatRenovateDispatchSummary,\n  hasHealthyRenovatePr,\n  computeAutoFixAttemptUpdates,\n  applyAutoFixAttemptUpdates,\n  formatAutoFixAttemptsSummary,\n  type RenovateDispatchResult,\n} from \"../../github/renovate-dispatch.js\";\n\n/**\n * `renovate-dispatch --fleet`: read the Websites table, pick the active,\n * repo-backed sites the latest security sweep flagged with critical/high vulns,\n * and fire each one's `renovate.yml` `workflow_dispatch` so Renovate's OSV\n * vulnerability alerts open the remediation PR now (instead of waiting for the\n * weekly schedule). Designed to run as a best-effort follow-up step on\n * `fleet-security.yml` AFTER the sweep has written fresh counts to Airtable.\n *\n * Always exits 0: a missing token is a clean skip; a partial dispatch failure\n * (a repo without `renovate.yml`, or a token lacking `actions:write`) is reported\n * in the summary for the workflow to annotate, never failing the security sweep.\n */\nexport async function runRenovateDispatchCommand(opts: {\n  fleet?: boolean | undefined;\n  /** Inject a pre-opened Airtable base (tests). Defaults to env config. */\n  base?: AirtableBase;\n  /** #539 Phase 5: Turso write-through for the auto-fix counter. Injected from\n   *  bin.ts rather than defaulted here — this function is called directly by\n   *  tests, and a default would open a real libSQL handle inside the suite. */\n  siteMirror?: SiteMirror;\n}): Promise<{ output: string; code: number }> {\n  if (!opts.fleet) {\n    return { output: \"renovate-dispatch currently supports only --fleet\", code: 2 };\n  }\n  const token = process.env.RENOVATE_TOKEN?.trim() || process.env.GH_TOKEN?.trim();\n  if (!token) {\n    return {\n      output: \"renovate-dispatch skipped: no RENOVATE_TOKEN/GH_TOKEN (fleet dispatch) configured.\",\n      code: 0,\n    };\n  }\n\n  const base = opts.base ?? openBase(readAirtableConfig());\n  const websites = await listWebsites(base);\n  const targets = selectRenovateTargets(websites);\n\n  const lines: string[] = [];\n  let result: RenovateDispatchResult = { dispatched: [], skipped: [], failed: [] };\n  if (targets.length === 0) {\n    lines.push(\n      \"No active repo-backed sites with critical/high vulnerabilities — nothing to dispatch.\",\n    );\n  } else {\n    const gh = makeGitHub({ token });\n    result = await dispatchRenovateAcross(targets, {\n      hasHealthyOpenRenovatePr: async (repo) =>\n        hasHealthyRenovatePr(await gh.openPullRequests(repo)),\n      defaultBranch: (repo) => gh.defaultBranch(repo),\n      dispatch: (repo, workflow, ref) => gh.dispatchWorkflow(repo, workflow, ref),\n    });\n\n    const failedRepos = new Set(result.failed.map((f) => f.repo));\n    const skippedRepos = new Set(result.skipped);\n    for (const t of targets) {\n      const status = failedRepos.has(t.repo)\n        ? \"FAILED                       \"\n        : skippedRepos.has(t.repo)\n          ? \"skipped (open Renovate PR)   \"\n          : \"dispatched                   \";\n      lines.push(`${status} ${t.repo} (critical=${t.critical} high=${t.high}) — ${t.siteName}`);\n    }\n    for (const f of result.failed) lines.push(`  ↳ ${f.repo}: ${f.error}`);\n  }\n\n  // Counter bookkeeping runs on EVERY fleet run — the reset-on-clean branch was\n  // previously unreachable behind the zero-targets early return, so a fully-clean\n  // fleet never cleared stale counters (Alamo stuck at 7, 2026-07). Best-effort:\n  // a failed write is tallied, never thrown. Uses the full `websites` list so\n  // 0-vuln sites reset.\n  const attemptUpdates = computeAutoFixAttemptUpdates(websites, result);\n  const attemptTally = await applyAutoFixAttemptUpdates(attemptUpdates, async (id, attempts) => {\n    const fields = await updateAutoFixAttempts(base, id, attempts);\n    await opts.siteMirror?.health(id, fields);\n  });\n\n  lines.push(formatRenovateDispatchSummary(result));\n  lines.push(formatAutoFixAttemptsSummary(attemptTally));\n\n  return { output: lines.join(\"\\n\"), code: 0 };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAyBO,IAAM,yBAAyB;AAY/B,SAAS,qBAAqB,KAAoC;AACvE,SAAO,IAAI,KAAK,CAAC,OAAO,aAAa,EAAE,KAAK,GAAG,cAAc,aAAa;AAC5E;AAsBO,SAAS,sBAAsB,OAA+C;AACnF,QAAM,UAAoC,CAAC;AAC3C,aAAW,KAAK,OAAO;AACrB,QAAI,CAAC,mBAAmB,CAAC,EAAG;AAC5B,UAAM,OAAO,EAAE,SAAS,KAAK;AAC7B,QAAI,CAAC,KAAM;AACX,UAAM,WAAW,EAAE,yBAAyB;AAC5C,UAAM,OAAO,EAAE,qBAAqB;AACpC,QAAI,WAAW,QAAQ,EAAG;AAC1B,YAAQ,KAAK,EAAE,MAAM,UAAU,EAAE,MAAM,UAAU,KAAK,CAAC;AAAA,EACzD;AACA,SAAO;AACT;AAgCA,eAAsB,uBACpB,SACA,MACiC;AACjC,QAAM,aAAuB,CAAC;AAC9B,QAAM,UAAoB,CAAC;AAC3B,QAAM,SAA4C,CAAC;AACnD,aAAW,KAAK,SAAS;AACvB,QAAI;AACF,UAAI,MAAM,KAAK,yBAAyB,EAAE,IAAI,GAAG;AAC/C,gBAAQ,KAAK,EAAE,IAAI;AACnB;AAAA,MACF;AACA,YAAM,MAAM,MAAM,KAAK,cAAc,EAAE,IAAI;AAC3C,YAAM,KAAK,SAAS,EAAE,MAAM,wBAAwB,GAAG;AACvD,iBAAW,KAAK,EAAE,IAAI;AAAA,IACxB,SAAS,GAAG;AACV,aAAO,KAAK,EAAE,MAAM,EAAE,MAAM,OAAO,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,EAAE,CAAC;AAAA,IACjF;AAAA,EACF;AACA,SAAO,EAAE,YAAY,SAAS,OAAO;AACvC;AAGO,SAAS,8BAA8B,QAAwC;AACpF,SAAO,wCAAwC,OAAO,WAAW,MAAM,YAAY,OAAO,QAAQ,MAAM,WAAW,OAAO,OAAO,MAAM;AACzI;AAuBO,SAAS,6BACd,OACA,QACoC;AACpC,QAAM,aAAa,IAAI,IAAI,OAAO,UAAU;AAC5C,QAAM,UAA8C,CAAC;AACrD,aAAW,KAAK,OAAO;AACrB,UAAM,UAAU,EAAE,2BAA2B;AAC7C,UAAM,SAAS,EAAE,yBAAyB,MAAM,EAAE,qBAAqB;AACvE,QAAI,UAAU,GAAG;AAIf,UAAI,YAAY,EAAG,SAAQ,KAAK,EAAE,IAAI,EAAE,IAAI,UAAU,EAAE,CAAC;AACzD;AAAA,IACF;AACA,QAAI,CAAC,mBAAmB,CAAC,EAAG;AAC5B,UAAM,OAAO,EAAE,SAAS,KAAK;AAC7B,QAAI,CAAC,KAAM;AACX,QAAI,CAAC,WAAW,IAAI,IAAI,EAAG;AAG3B,QAAI,6BAA6B,EAAE,kBAAkB,EAAG;AACxD,YAAQ,KAAK,EAAE,IAAI,EAAE,IAAI,UAAU,UAAU,EAAE,CAAC;AAAA,EAClD;AACA,SAAO;AACT;AAQA,eAAsB,2BACpB,SACA,OAC8C;AAC9C,MAAI,UAAU;AACd,MAAI,SAAS;AACb,aAAW,KAAK,SAAS;AACvB,QAAI;AACF,YAAM,MAAM,EAAE,IAAI,EAAE,QAAQ;AAC5B;AAAA,IACF,QAAQ;AACN;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,SAAS,OAAO;AAC3B;AAGO,SAAS,6BAA6B,OAAoD;AAC/F,SAAO,qCAAqC,MAAM,OAAO,WAAW,MAAM,MAAM;AAClF;;;ACrLA,eAAsB,2BAA2B,MAQH;AAC5C,MAAI,CAAC,KAAK,OAAO;AACf,WAAO,EAAE,QAAQ,qDAAqD,MAAM,EAAE;AAAA,EAChF;AACA,QAAM,QAAQ,QAAQ,IAAI,gBAAgB,KAAK,KAAK,QAAQ,IAAI,UAAU,KAAK;AAC/E,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,MAAM;AAAA,IACR;AAAA,EACF;AAEA,QAAM,OAAO,KAAK,QAAQ,SAAS,mBAAmB,CAAC;AACvD,QAAM,WAAW,MAAM,aAAa,IAAI;AACxC,QAAM,UAAU,sBAAsB,QAAQ;AAE9C,QAAM,QAAkB,CAAC;AACzB,MAAI,SAAiC,EAAE,YAAY,CAAC,GAAG,SAAS,CAAC,GAAG,QAAQ,CAAC,EAAE;AAC/E,MAAI,QAAQ,WAAW,GAAG;AACxB,UAAM;AAAA,MACJ;AAAA,IACF;AAAA,EACF,OAAO;AACL,UAAM,KAAK,WAAW,EAAE,MAAM,CAAC;AAC/B,aAAS,MAAM,uBAAuB,SAAS;AAAA,MAC7C,0BAA0B,OAAO,SAC/B,qBAAqB,MAAM,GAAG,iBAAiB,IAAI,CAAC;AAAA,MACtD,eAAe,CAAC,SAAS,GAAG,cAAc,IAAI;AAAA,MAC9C,UAAU,CAAC,MAAM,UAAU,QAAQ,GAAG,iBAAiB,MAAM,UAAU,GAAG;AAAA,IAC5E,CAAC;AAED,UAAM,cAAc,IAAI,IAAI,OAAO,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC;AAC5D,UAAM,eAAe,IAAI,IAAI,OAAO,OAAO;AAC3C,eAAW,KAAK,SAAS;AACvB,YAAM,SAAS,YAAY,IAAI,EAAE,IAAI,IACjC,kCACA,aAAa,IAAI,EAAE,IAAI,IACrB,kCACA;AACN,YAAM,KAAK,GAAG,MAAM,IAAI,EAAE,IAAI,cAAc,EAAE,QAAQ,SAAS,EAAE,IAAI,YAAO,EAAE,QAAQ,EAAE;AAAA,IAC1F;AACA,eAAW,KAAK,OAAO,OAAQ,OAAM,KAAK,YAAO,EAAE,IAAI,KAAK,EAAE,KAAK,EAAE;AAAA,EACvE;AAOA,QAAM,iBAAiB,6BAA6B,UAAU,MAAM;AACpE,QAAM,eAAe,MAAM,2BAA2B,gBAAgB,OAAO,IAAI,aAAa;AAC5F,UAAM,SAAS,MAAM,sBAAsB,MAAM,IAAI,QAAQ;AAC7D,UAAM,KAAK,YAAY,OAAO,IAAI,MAAM;AAAA,EAC1C,CAAC;AAED,QAAM,KAAK,8BAA8B,MAAM,CAAC;AAChD,QAAM,KAAK,6BAA6B,YAAY,CAAC;AAErD,SAAO,EAAE,QAAQ,MAAM,KAAK,IAAI,GAAG,MAAM,EAAE;AAC7C;","names":[]}

package/dist/replay-C2LXMJZP.js

@@ -0,0 +1,66 @@
+import {
+  ingestSubmission
+} from "./chunk-BNM5POSJ.js";
+import "./chunk-SNSTJLQW.js";
+import "./chunk-2OP4JKIQ.js";
+
+// src/db/deadletter.ts
+async function listUnreplayedDeadLetters(db) {
+  const rows = await db.selectFrom("submission_deadletter").select(["id", "site_slug", "payload", "turnstile", "error", "received_at"]).where("replayed_at", "is", null).orderBy("received_at", "asc").execute();
+  return rows.map((r) => ({
+    id: r.id,
+    siteSlug: r.site_slug,
+    payload: JSON.parse(r.payload),
+    turnstile: JSON.parse(r.turnstile),
+    error: r.error,
+    receivedAt: r.received_at
+  }));
+}
+async function markDeadLetterReplayed(db, id, outcome, submissionId, now) {
+  await db.updateTable("submission_deadletter").set({
+    replayed_at: now.toISOString(),
+    replay_outcome: outcome,
+    replay_submission_id: submissionId
+  }).where("id", "=", id).execute();
+}
+
+// src/forms/replay.ts
+async function replayDeadLetters(db, deps) {
+  const rows = await listUnreplayedDeadLetters(db);
+  const result = { replayed: [], stillFailing: [] };
+  for (const row of rows) {
+    const outcome = await replayOne(db, deps, row);
+    if (outcome.terminal) {
+      result.replayed.push({
+        id: row.id,
+        outcome: outcome.outcome,
+        submissionId: outcome.submissionId
+      });
+    } else {
+      result.stillFailing.push({ id: row.id, error: outcome.error });
+    }
+  }
+  return result;
+}
+async function replayOne(db, deps, row) {
+  const { deadLetter: _stripped, ...safeDeps } = deps;
+  void _stripped;
+  let res;
+  try {
+    res = await ingestSubmission(safeDeps, row.siteSlug, row.payload, row.turnstile);
+  } catch (err) {
+    return { terminal: false, error: String(err) };
+  }
+  const now = deps.now();
+  if (res.status === "accepted") {
+    await markDeadLetterReplayed(db, row.id, "accepted", res.submissionId, now);
+    return { terminal: true, outcome: "accepted", submissionId: res.submissionId };
+  }
+  const outcome = res.status === "rejected" ? `rejected:${res.reason}` : "unknown-site";
+  await markDeadLetterReplayed(db, row.id, outcome, null, now);
+  return { terminal: true, outcome, submissionId: null };
+}
+export {
+  replayDeadLetters
+};
+//# sourceMappingURL=replay-C2LXMJZP.js.map

package/dist/replay-C2LXMJZP.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/db/deadletter.ts","../src/forms/replay.ts"],"sourcesContent":["import type { Db } from \"./client.js\";\nimport type { TurnstileVerification } from \"../forms/turnstile.js\";\n\n/** One captured-but-unresolved lead: the site lookup threw before the normal\n *  pipeline could run (Phase 0 of #539 — persist before enrich). */\nexport type DeadLetterRow = {\n  id: string;\n  siteSlug: string;\n  /** The raw wire payload, exactly as the handler received it. */\n  payload: unknown;\n  /** The Turnstile verification computed at receipt — tokens expire in 300s,\n   *  so replay reuses this answer rather than re-verifying. */\n  turnstile: TurnstileVerification;\n  error: string;\n  receivedAt: string;\n};\n\nexport type DeadLetterInput = {\n  siteSlug: string;\n  payload: unknown;\n  turnstile: TurnstileVerification;\n  error: string;\n  receivedAt: Date;\n};\n\n/** Opaque, collision-free id (mirrors newSubmissionId). */\nexport function newDeadLetterId(): string {\n  return `dl_${crypto.randomUUID()}`;\n}\n\n/** Persist a lead the normal pipeline could not place. This is the LAST writer\n *  on the ingest path — if it throws too, both stores are down and the caller's\n *  502 is honest. */\nexport async function createDeadLetter(db: Db, input: DeadLetterInput): Promise<{ id: string }> {\n  const id = newDeadLetterId();\n  await db\n    .insertInto(\"submission_deadletter\")\n    .values({\n      id,\n      site_slug: input.siteSlug,\n      payload: JSON.stringify(input.payload),\n      turnstile: JSON.stringify(input.turnstile),\n      error: input.error,\n      received_at: input.receivedAt.toISOString(),\n      replayed_at: null,\n      replay_outcome: null,\n      replay_submission_id: null,\n    })\n    .execute();\n  return { id };\n}\n\n/** Rows not yet replayed, oldest first — replay preserves arrival order so the\n *  duplicate/velocity signals see submissions in the order they happened. */\nexport async function listUnreplayedDeadLetters(db: Db): Promise<DeadLetterRow[]> {\n  const rows = await db\n    .selectFrom(\"submission_deadletter\")\n    .select([\"id\", \"site_slug\", \"payload\", \"turnstile\", \"error\", \"received_at\"])\n    .where(\"replayed_at\", \"is\", null)\n    .orderBy(\"received_at\", \"asc\")\n    .execute();\n  return rows.map((r) => ({\n    id: r.id,\n    siteSlug: r.site_slug,\n    payload: JSON.parse(r.payload) as unknown,\n    turnstile: JSON.parse(r.turnstile) as TurnstileVerification,\n    error: r.error,\n    receivedAt: r.received_at,\n  }));\n}\n\n/** Mark a row's replay TERMINAL — it will never be picked up again. Only call\n *  for outcomes that re-running cannot improve (accepted, rejected,\n *  unknown-site). A replay whose lookup threw again is left untouched so the\n *  next run retries it. */\nexport async function markDeadLetterReplayed(\n  db: Db,\n  id: string,\n  outcome: string,\n  submissionId: string | null,\n  now: Date,\n): Promise<void> {\n  await db\n    .updateTable(\"submission_deadletter\")\n    .set({\n      replayed_at: now.toISOString(),\n      replay_outcome: outcome,\n      replay_submission_id: submissionId,\n    })\n    .where(\"id\", \"=\", id)\n    .execute();\n}\n","import type { Db } from \"../db/client.js\";\nimport {\n  listUnreplayedDeadLetters,\n  markDeadLetterReplayed,\n  type DeadLetterRow,\n} from \"../db/deadletter.js\";\nimport { ingestSubmission, type IngestDeps } from \"./ingest.js\";\n\nexport type ReplayResult = {\n  /** Terminal outcomes this run: the row will never be picked up again. */\n  replayed: Array<{ id: string; outcome: string; submissionId: string | null }>;\n  /** Rows whose lookup threw AGAIN — left unreplayed for the next run. */\n  stillFailing: Array<{ id: string; error: string }>;\n};\n\n/**\n * Run every unreplayed dead-letter back through `ingestSubmission` — the SAME\n * pipeline a live submission takes, so a replayed lead gets real spam\n * classification, notify, and fan-out, not a bespoke re-implementation.\n *\n * Each row replays with the Turnstile verification computed at receipt (tokens\n * expire in 300s; re-verifying is impossible by design, see deadletter.ts).\n *\n * `deps` must NOT wire `deadLetter`: a lookup that throws during replay would\n * otherwise dead-letter the SAME lead a second time while the original row stays\n * unreplayed — every retry would mint a duplicate. Enforced here by stripping the\n * key rather than trusting the caller. A thrown lookup leaves the row untouched\n * for the next run; every RESOLVED outcome (accepted, rejected, unknown-site) is\n * terminal — re-running cannot improve on an answer the store actually gave.\n *\n * Oldest-first (listUnreplayedDeadLetters orders by received_at) so the\n * duplicate/velocity spam signals see submissions in arrival order.\n */\nexport async function replayDeadLetters(\n  db: Db,\n  deps: Omit<IngestDeps, \"deadLetter\">,\n): Promise<ReplayResult> {\n  const rows = await listUnreplayedDeadLetters(db);\n  const result: ReplayResult = { replayed: [], stillFailing: [] };\n\n  for (const row of rows) {\n    const outcome = await replayOne(db, deps, row);\n    if (outcome.terminal) {\n      result.replayed.push({\n        id: row.id,\n        outcome: outcome.outcome,\n        submissionId: outcome.submissionId,\n      });\n    } else {\n      result.stillFailing.push({ id: row.id, error: outcome.error });\n    }\n  }\n  return result;\n}\n\nasync function replayOne(\n  db: Db,\n  deps: Omit<IngestDeps, \"deadLetter\">,\n  row: DeadLetterRow,\n): Promise<\n  | { terminal: true; outcome: string; submissionId: string | null }\n  | { terminal: false; error: string }\n> {\n  // Strip deadLetter defensively even though the type forbids it — a structurally\n  // wider object passed through `as` must not re-arm the duplicate loop.\n  const { deadLetter: _stripped, ...safeDeps } = deps as IngestDeps;\n  void _stripped;\n  let res;\n  try {\n    res = await ingestSubmission(safeDeps, row.siteSlug, row.payload, row.turnstile);\n  } catch (err) {\n    return { terminal: false, error: String(err) };\n  }\n  const now = deps.now();\n  if (res.status === \"accepted\") {\n    await markDeadLetterReplayed(db, row.id, \"accepted\", res.submissionId, now);\n    return { terminal: true, outcome: \"accepted\", submissionId: res.submissionId };\n  }\n  const outcome = res.status === \"rejected\" ? `rejected:${res.reason}` : \"unknown-site\";\n  await markDeadLetterReplayed(db, row.id, outcome, null, now);\n  return { terminal: true, outcome, submissionId: null };\n}\n"],"mappings":";;;;;;;AAsDA,eAAsB,0BAA0B,IAAkC;AAChF,QAAM,OAAO,MAAM,GAChB,WAAW,uBAAuB,EAClC,OAAO,CAAC,MAAM,aAAa,WAAW,aAAa,SAAS,aAAa,CAAC,EAC1E,MAAM,eAAe,MAAM,IAAI,EAC/B,QAAQ,eAAe,KAAK,EAC5B,QAAQ;AACX,SAAO,KAAK,IAAI,CAAC,OAAO;AAAA,IACtB,IAAI,EAAE;AAAA,IACN,UAAU,EAAE;AAAA,IACZ,SAAS,KAAK,MAAM,EAAE,OAAO;AAAA,IAC7B,WAAW,KAAK,MAAM,EAAE,SAAS;AAAA,IACjC,OAAO,EAAE;AAAA,IACT,YAAY,EAAE;AAAA,EAChB,EAAE;AACJ;AAMA,eAAsB,uBACpB,IACA,IACA,SACA,cACA,KACe;AACf,QAAM,GACH,YAAY,uBAAuB,EACnC,IAAI;AAAA,IACH,aAAa,IAAI,YAAY;AAAA,IAC7B,gBAAgB;AAAA,IAChB,sBAAsB;AAAA,EACxB,CAAC,EACA,MAAM,MAAM,KAAK,EAAE,EACnB,QAAQ;AACb;;;AC1DA,eAAsB,kBACpB,IACA,MACuB;AACvB,QAAM,OAAO,MAAM,0BAA0B,EAAE;AAC/C,QAAM,SAAuB,EAAE,UAAU,CAAC,GAAG,cAAc,CAAC,EAAE;AAE9D,aAAW,OAAO,MAAM;AACtB,UAAM,UAAU,MAAM,UAAU,IAAI,MAAM,GAAG;AAC7C,QAAI,QAAQ,UAAU;AACpB,aAAO,SAAS,KAAK;AAAA,QACnB,IAAI,IAAI;AAAA,QACR,SAAS,QAAQ;AAAA,QACjB,cAAc,QAAQ;AAAA,MACxB,CAAC;AAAA,IACH,OAAO;AACL,aAAO,aAAa,KAAK,EAAE,IAAI,IAAI,IAAI,OAAO,QAAQ,MAAM,CAAC;AAAA,IAC/D;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAe,UACb,IACA,MACA,KAIA;AAGA,QAAM,EAAE,YAAY,WAAW,GAAG,SAAS,IAAI;AAC/C,OAAK;AACL,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,iBAAiB,UAAU,IAAI,UAAU,IAAI,SAAS,IAAI,SAAS;AAAA,EACjF,SAAS,KAAK;AACZ,WAAO,EAAE,UAAU,OAAO,OAAO,OAAO,GAAG,EAAE;AAAA,EAC/C;AACA,QAAM,MAAM,KAAK,IAAI;AACrB,MAAI,IAAI,WAAW,YAAY;AAC7B,UAAM,uBAAuB,IAAI,IAAI,IAAI,YAAY,IAAI,cAAc,GAAG;AAC1E,WAAO,EAAE,UAAU,MAAM,SAAS,YAAY,cAAc,IAAI,aAAa;AAAA,EAC/E;AACA,QAAM,UAAU,IAAI,WAAW,aAAa,YAAY,IAAI,MAAM,KAAK;AACvE,QAAM,uBAAuB,IAAI,IAAI,IAAI,SAAS,MAAM,GAAG;AAC3D,SAAO,EAAE,UAAU,MAAM,SAAS,cAAc,KAAK;AACvD;","names":[]}

package/dist/{report-6CKSWJNG.js → report-R3E3Y7HR.js}

@@ -1,36 +1,38 @@
 import {
   operatorEmail
 } from "./chunk-5ML7FMBD.js";
+import {
+  draftReportForSite,
+  readGaConfig
+} from "./chunk-BBUSGEES.js";
 import {
   findDueReports,
   nextDueDate,
   reportPeriodKey
-} from "./chunk-D4FVAIEJ.js";
-import {
-  draftReportForSite,
-  readGaConfig
-} from "./chunk-MGR2H7F4.js";
+} from "./chunk-PZR4EBPY.js";
 import {
   reportTier
-} from "./chunk-62VF32IC.js";
-import "./chunk-37S6L6G4.js";
+} from "./chunk-YFAXOD7Z.js";
 import {
   listAllReports
-} from "./chunk-6QRLRT3P.js";
-import "./chunk-MPBXOJ3N.js";
+} from "./chunk-F3JWOPTG.js";
+import "./chunk-VAD43MOR.js";
+import "./chunk-IY6256GK.js";
+import {
+  openBase,
+  readAirtableConfig
+} from "./chunk-HN6I2XWI.js";
+import "./chunk-MT2JINSS.js";
 import {
   escapeHtml
-} from "./chunk-SEEA6RXF.js";
-import "./chunk-U5SZ4FOP.js";
+} from "./chunk-DJZWYIPP.js";
+import "./chunk-5UINJNAJ.js";
 import {
   listWebsites,
   siteSlug,
   updateNextDueDates
-} from "./chunk-577HCGZO.js";
-import {
-  openBase,
-  readAirtableConfig
-} from "./chunk-HN6I2XWI.js";
+} from "./chunk-7NYN2P6I.js";
+import "./chunk-EVBCK2KC.js";
 import "./chunk-6VAL7XJT.js";
 
 // src/alerts/analytics-health.ts
@@ -76,12 +78,34 @@ function dashboardBaseUrl() {
 }
 async function runReportCommand(slug, opts) {
   if (opts.digest) {
-    const { runDigest } = await import("./digest-UVHYZUYE.js");
+    const { runDigest } = await import("./digest-FW6QMZZJ.js");
     return runDigest({ baseUrl: dashboardBaseUrl() });
   }
   if (opts.sendReady) {
-    const { sendApprovedReports } = await import("./orchestrate-KDNXZQX7.js");
-    return sendApprovedReports();
+    const { sendApprovedReports } = await import("./orchestrate-YLWQ6KK2.js");
+    const { makeSiteMirror } = await import("./site-mirror-NIREX5ME.js");
+    return sendApprovedReports({ siteMirror: await makeSiteMirror() });
+  }
+  if (opts.rerender) {
+    const { rerenderReport, formatRerenderResult } = await import("./rerender-3FM6DNRH.js");
+    const { renderReportFromRow } = await import("./render-from-row-BWSOIYDS.js");
+    const { openDb, readDbConfig } = await import("./client-AUE3XUPO.js");
+    const { getReportById, getSiteById, storeRenderedHtml } = await import("./fleet-state-7TJ2GYT2.js");
+    const { loadHeaderImage } = await import("./header-images-SQBCE5OD.js");
+    const { fetchAttachmentBytes } = await import("./attachments-NLZIJ5NU.js");
+    const db = await openDb(readDbConfig());
+    const result = await rerenderReport(
+      {
+        getReport: (id) => getReportById(db, id),
+        getSite: (id) => getSiteById(db, id),
+        loadHeaderPlate: async (id) => (await loadHeaderImage(db, id))?.bytes ?? null,
+        fetchAirtableHeader: async (url) => (await fetchAttachmentBytes(url)).bytes,
+        render: (site, report, plate) => renderReportFromRow(site, report, plate),
+        store: (id, html) => storeRenderedHtml(db, id, html)
+      },
+      opts.rerender
+    );
+    return { output: formatRerenderResult(result), code: result.status === "rendered" ? 0 : 1 };
   }
   if (opts.due) {
     return runDueDraft();
@@ -105,7 +129,16 @@ async function runReportCommand(slug, opts) {
 }
 async function runDueDraft() {
   const base = openBase(readAirtableConfig());
-  const result = await draftDueReports(base, /* @__PURE__ */ new Date());
+  const { makeScheduleMirrorBestEffort } = await import("./health-mirror-L5JBEJVA.js");
+  const { makeReportMirror } = await import("./report-mirror-4MNORYQ4.js");
+  const { makeSiteMirror } = await import("./site-mirror-NIREX5ME.js");
+  const result = await draftDueReports(
+    base,
+    /* @__PURE__ */ new Date(),
+    await makeScheduleMirrorBestEffort(),
+    await makeReportMirror(),
+    await makeSiteMirror()
+  );
   await alertOnFleetAnalyticsFailure(result.health);
   return { output: result.output, code: result.code };
 }
@@ -127,23 +160,49 @@ async function alertOnFleetAnalyticsFailure(health) {
     console.warn(`\u26A0 analytics-failure alert send failed: ${e.message}`);
   }
 }
-async function writeNextDueDates(base, websites, reports, today) {
+async function writeNextDueDates(base, websites, reports, today, scheduleMirror = null) {
   const ymd = (d) => d ? d.toISOString().slice(0, 10) : null;
+  let wrote = 0;
+  let skipped = 0;
+  let failed = 0;
+  let mirrored = 0;
+  let mirrorFailed = 0;
+  let mirrorMissed = 0;
   for (const site of websites) {
     try {
-      await updateNextDueDates(base, site.id, {
-        maintenanceAt: ymd(nextDueDate(site, reports, "Maintenance", today)),
-        testingAt: ymd(nextDueDate(site, reports, "Testing", today))
-      });
+      const maintenanceAt = ymd(nextDueDate(site, reports, "Maintenance", today));
+      const testingAt = ymd(nextDueDate(site, reports, "Testing", today));
+      if (maintenanceAt === site.nextMaintenanceAt && testingAt === site.nextTestingAt) {
+        skipped++;
+        continue;
+      }
+      const fields = await updateNextDueDates(base, site.id, { maintenanceAt, testingAt });
+      wrote++;
+      if (scheduleMirror) {
+        try {
+          if (await scheduleMirror(site.id, fields, today.toISOString())) mirrored++;
+          else mirrorMissed++;
+        } catch (e) {
+          mirrorFailed++;
+          console.warn(`\u26A0 [schedule-mirror] ${site.name}: ${e.message}`);
+        }
+      }
     } catch (e) {
+      failed++;
       console.warn(`\u26A0 next-due write skipped for ${site.name}: ${e.message}`);
     }
   }
+  const mirrorNote = scheduleMirror ? ` mirrored=${mirrored} mirror_failed=${mirrorFailed} mirror_missed=${mirrorMissed}` : " mirror=absent";
+  console.log(`NEXT_DUE_WRITE wrote=${wrote} skipped=${skipped} failed=${failed}${mirrorNote}`);
 }
-async function draftDueReports(base, today) {
+async function draftDueReports(base, today, scheduleMirror = null, reportMirror, siteMirror) {
+  const mirrorOpt = {
+    ...reportMirror ? { reportMirror } : {},
+    ...siteMirror ? { siteMirror } : {}
+  };
   const websites = await listWebsites(base);
   const reports = await listAllReports(base);
-  await writeNextDueDates(base, websites, reports, today);
+  await writeNextDueDates(base, websites, reports, today, scheduleMirror);
   const due = findDueReports(websites, reports, today);
   const gaConfigured = readGaConfig() !== null;
   const isAnalyticsConfigured = (s) => gaConfigured && Boolean(s.ga4PropertyId || s.searchQuery);
@@ -185,7 +244,8 @@ async function draftDueReports(base, today) {
         const result = await draftReportForSite(base, item.site, item.reportType, {
           period,
           completeRowId: existing.id,
-          existingRow: existing
+          existingRow: existing,
+          ...mirrorOpt
         });
         existing.draftReady = result.queued === true;
         lines.push(
@@ -216,7 +276,10 @@ async function draftDueReports(base, today) {
       continue;
     }
     try {
-      const result = await draftReportForSite(base, item.site, item.reportType, { period });
+      const result = await draftReportForSite(base, item.site, item.reportType, {
+        period,
+        ...mirrorOpt
+      });
       lines.push(draftLine(result.reportRow?.reportId, result.queued, result.supersededIds));
       if (result.reportRow) reports.push(result.reportRow);
       if (isAnalyticsConfigured(item.site)) gaConfiguredSites++;
@@ -258,11 +321,15 @@ async function runSingleSiteDraft(slug, opts) {
   if (!site) {
     throw Object.assign(new Error(`No Websites row matched slug "${slug}"`), { exitCode: 2 });
   }
+  const reportMirror = opts.previewOnly ? null : await (await import("./report-mirror-4MNORYQ4.js")).makeReportMirror();
+  const siteMirror = opts.previewOnly ? null : await (await import("./site-mirror-NIREX5ME.js")).makeSiteMirror();
   const result = await draftReportForSite(opts.previewOnly ? null : base, site, opts.reportType, {
     previewOnly: opts.previewOnly,
     // Only forced on. Left undefined, draftReportForSite keeps its default
     // (enrich iff there is a base), so the real drafting path is untouched.
-    ...opts.enrich ? { enrich: true } : {}
+    ...opts.enrich ? { enrich: true } : {},
+    ...reportMirror ? { reportMirror } : {},
+    ...siteMirror ? { siteMirror } : {}
   });
   if (opts.previewOnly) {
     return { output: `Preview written to ${result.htmlPath}`, code: 0 };
@@ -280,6 +347,7 @@ async function runSingleSiteDraft(slug, opts) {
 export {
   draftDueReports,
   parseSingleSiteReportType,
-  runReportCommand
+  runReportCommand,
+  writeNextDueDates
 };
-//# sourceMappingURL=report-6CKSWJNG.js.map
+//# sourceMappingURL=report-R3E3Y7HR.js.map

package/dist/report-R3E3Y7HR.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/alerts/analytics-health.ts","../src/cli/commands/report.ts"],"sourcesContent":["import { escapeHtml } from \"../util/html.js\";\n\n/**\n * The GA/Search enrichment outcome of one `report --due` draft run, aggregated\n * across the sites it drafted. `softFailedSites` is how many drafted sites had GA\n * OR Search enrichment ERROR (not \"not configured\" — that's a legitimate skip);\n * `configuredSites` is how many drafted sites had analytics configured at all\n * (the subject is set AND the site has a GA4 property or a search query). The ratio\n * is what distinguishes a fleet-wide subject outage from a single transient blip.\n */\nexport type AnalyticsRunHealth = {\n  softFailedSites: number;\n  configuredSites: number;\n};\n\nexport type AnalyticsAlert = { fire: boolean; reason: string };\n\n/** A lone failure never alerts — that's a per-site config issue, not the shared-\n *  subject SPOF. Two-plus AND a majority of configured sites is the fleet signature. */\nconst MIN_FAILED_SITES = 2;\n\n/**\n * Decide whether a draft run's GA/Search soft-failures look FLEET-WIDE — i.e. the\n * one impersonated subject (`GA_SUBJECT`) lost access — rather than one site's\n * transient blip. PURE. Fires when at least {@link MIN_FAILED_SITES} configured\n * sites failed AND they are a majority (≥ half) of the analytics-configured sites\n * this run. With <2 configured sites it can't distinguish a SPOF from a one-off, so\n * it never fires (at fleet scale there are always many configured sites).\n */\nexport function assessAnalyticsAlert(h: AnalyticsRunHealth): AnalyticsAlert {\n  const { softFailedSites, configuredSites } = h;\n  const fire =\n    configuredSites >= 2 &&\n    softFailedSites >= MIN_FAILED_SITES &&\n    softFailedSites * 2 >= configuredSites;\n  const reason = fire\n    ? `${softFailedSites} of ${configuredSites} analytics-configured sites had GA/Search enrichment fail this run — the shared GA_SUBJECT likely lost access (an offboarded user, revoked property access, or a botched role-account cutover). Reports were drafted with BLANK analytics.`\n    : \"\";\n  return { fire, reason };\n}\n\n/**\n * Compose the operator alert email for a fleet-wide analytics failure. PURE — the\n * caller (the `report --due` cron) sends it best-effort via Resend only when\n * {@link assessAnalyticsAlert} fires. `dashboardUrl` is the fleet homepage link.\n */\nexport function composeAnalyticsAlertEmail(\n  h: AnalyticsRunHealth,\n  dashboardUrl: string,\n): { subject: string; html: string } {\n  const subject = `⚠ Fleet analytics enrichment failing — ${h.softFailedSites}/${h.configuredSites} sites`;\n  const { reason } = assessAnalyticsAlert(h);\n  const html = `<p><strong>${escapeHtml(reason)}</strong></p>\n<p>This usually means the Google Workspace user the service account impersonates can no longer read the GA4 / Search Console properties. Reports still send — but with blank analytics — until the subject is restored.</p>\n<p>Next step: follow the GA/Search subject runbook (<code>docs/runbooks/ga-search-role-account-cutover.md</code>) to restore or move the subject, then re-run <code>reddoor-maint report --due</code> and confirm the warning clears.</p>\n<p><a href=\"${escapeHtml(dashboardUrl)}\">Open the fleet dashboard →</a></p>`;\n  return { subject, html };\n}\n","import { openBase, readAirtableConfig, type AirtableBase } from \"../../reports/airtable/client.js\";\nimport {\n  listWebsites,\n  siteSlug,\n  updateNextDueDates,\n  type WebsiteRow,\n} from \"../../reports/airtable/websites.js\";\nimport { listAllReports, type ReportRow } from \"../../reports/airtable/reports.js\";\nimport { findDueReports, nextDueDate, reportPeriodKey } from \"../../reports/due.js\";\nimport { draftReportForSite } from \"../../reports/draft.js\";\nimport { reportTier } from \"../../reports/queue.js\";\nimport { readGaConfig } from \"../../reports/ga/config.js\";\nimport {\n  assessAnalyticsAlert,\n  composeAnalyticsAlertEmail,\n  type AnalyticsRunHealth,\n} from \"../../alerts/analytics-health.js\";\nimport type { ReportType } from \"../../reports/types.js\";\nimport type { ScheduleMirror } from \"../../audits/health-mirror.js\";\nimport type { ReportMirror } from \"../../reports/report-mirror.js\";\nimport type { SiteMirror } from \"../../db/site-mirror.js\";\nimport { operatorEmail } from \"../../util/operator.js\";\n\nexport type ReportCommandOptions = {\n  due?: boolean;\n  preview?: boolean;\n  enrich?: boolean;\n  sendReady?: boolean;\n  digest?: boolean;\n  rerender?: string;\n  type?: string;\n  cwd?: string;\n};\n\n/**\n * Summary line for a drafted report, reflecting the single-queue outcome. `queued === false`\n * means a higher-or-equal-tier report was already pending for the site, so this draft was\n * created but deliberately left OUT of the approve queue. A non-empty `supersededIds` means it\n * un-queued that many lower-tier drafts. `null` is the previewOnly path (no Airtable queue).\n */\nfunction draftLine(\n  reportId: string | undefined,\n  queued: boolean | null,\n  supersededIds: string[],\n  verb = \"drafted\",\n): string {\n  const id = reportId ?? \"(unknown)\";\n  if (queued === false) {\n    return `• ${verb} but NOT queued: ${id} — a higher-or-equal-tier report is already pending approval`;\n  }\n  const sup =\n    supersededIds.length > 0\n      ? ` (superseded ${supersededIds.length} lower-tier draft${supersededIds.length > 1 ? \"s\" : \"\"})`\n      : \"\";\n  return `✓ ${verb}: ${id}${sup}`;\n}\n\n/**\n * Parse the single-site `--type` flag. Only Maintenance and Testing are draftable\n * this way — Launch has the `launch <site>` command and Announcement has\n * `announce <site>`, each with its own purpose-built flow. Case-insensitive;\n * defaults to Maintenance (the historical single-site behaviour). Throws an\n * exitCode-2 usage error on anything else. PURE.\n */\nexport function parseSingleSiteReportType(raw: string | undefined): ReportType {\n  if (raw === undefined || raw.trim() === \"\") return \"Maintenance\";\n  const norm = raw.trim().toLowerCase();\n  if (norm === \"maintenance\") return \"Maintenance\";\n  if (norm === \"testing\") return \"Testing\";\n  const hint =\n    norm === \"launch\"\n      ? \" — use the `launch <site>` command\"\n      : norm === \"announcement\"\n        ? \" — use the `announce <site>` command\"\n        : \"\";\n  throw Object.assign(\n    new Error(`--type must be Maintenance or Testing (got ${JSON.stringify(raw)})${hint}`),\n    { exitCode: 2 },\n  );\n}\n\n/** Dashboard origin for digest /s/<slug> links. DASHBOARD_BASE_URL overrides the\n *  production default; the trailing slash (if any) is trimmed by runDigest. */\nfunction dashboardBaseUrl(): string {\n  return process.env.DASHBOARD_BASE_URL?.trim() || \"https://reddoor-maintenance.netlify.app\";\n}\n\nexport async function runReportCommand(\n  slug: string | undefined,\n  opts: ReportCommandOptions,\n): Promise<{ output: string; code: number }> {\n  if (opts.digest) {\n    const { runDigest } = await import(\"../../reports/digest.js\");\n    return runDigest({ baseUrl: dashboardBaseUrl() });\n  }\n\n  if (opts.sendReady) {\n    const { sendApprovedReports } = await import(\"../../reports/send/orchestrate.js\");\n    // #539 Phase 5: a Launch send flips Status + stamps `Launched at` on the\n    // Websites row; without this it reaches Turso only via the hourly sync.\n    const { makeSiteMirror } = await import(\"../../db/site-mirror.js\");\n    return sendApprovedReports({ siteMirror: await makeSiteMirror() });\n  }\n\n  // Refresh ONE unsent report's stored body so the console preview reflects\n  // commentary edited after drafting. Runs here rather than in a Netlify\n  // function because rendering needs sharp — see rerender.ts.\n  if (opts.rerender) {\n    const { rerenderReport, formatRerenderResult } = await import(\"../../reports/send/rerender.js\");\n    const { renderReportFromRow } = await import(\"../../reports/send/render-from-row.js\");\n    const { openDb, readDbConfig } = await import(\"../../db/client.js\");\n    const { getReportById, getSiteById, storeRenderedHtml } =\n      await import(\"../../db/fleet-state.js\");\n    const { loadHeaderImage } = await import(\"../../db/header-images.js\");\n    const { fetchAttachmentBytes } = await import(\"../../reports/airtable/attachments.js\");\n    const db = await openDb(readDbConfig());\n    const result = await rerenderReport(\n      {\n        getReport: (id) => getReportById(db, id),\n        getSite: (id) => getSiteById(db, id),\n        loadHeaderPlate: async (id) => (await loadHeaderImage(db, id))?.bytes ?? null,\n        fetchAirtableHeader: async (url) => (await fetchAttachmentBytes(url)).bytes,\n        render: (site, report, plate) => renderReportFromRow(site, report, plate),\n        store: (id, html) => storeRenderedHtml(db, id, html),\n      },\n      opts.rerender,\n    );\n    // Exit 1 on anything but a render, so a dispatched run that refused is RED\n    // rather than a green run that silently changed nothing.\n    return { output: formatRerenderResult(result), code: result.status === \"rendered\" ? 0 : 1 };\n  }\n\n  if (opts.due) {\n    return runDueDraft();\n  }\n\n  if (slug) {\n    // Validate the type BEFORE any Airtable access so a bad --type fails fast (and\n    // without needing credentials).\n    const reportType = parseSingleSiteReportType(opts.type);\n    return runSingleSiteDraft(slug, {\n      previewOnly: Boolean(opts.preview),\n      enrich: Boolean(opts.enrich),\n      reportType,\n    });\n  }\n\n  throw Object.assign(\n    new Error(\n      \"Usage: reddoor-maint report [<slug>] [--type <Maintenance|Testing>] [--due] [--preview] [--enrich] [--send-ready] [--digest]\",\n    ),\n    {\n      exitCode: 2,\n    },\n  );\n}\n\nasync function runDueDraft(): Promise<{ output: string; code: number }> {\n  const base = openBase(readAirtableConfig());\n  // Phase 3 dual-write (#539): mirror real next-due writes into site_schedule.\n  // Null when libSQL creds are absent — the Airtable path is unchanged.\n  const { makeScheduleMirrorBestEffort } = await import(\"../../audits/health-mirror.js\");\n  // Phase 5 dual-write (#539): mirror this batch's report writes — the created\n  // rows, their bodies, and the queue flags. Unlike the schedule mirror this is\n  // never null — creds-absent is reported on the REPORT_MIRROR line rather than\n  // being indistinguishable from success, the failure mode that hid #585.\n  const { makeReportMirror } = await import(\"../../reports/report-mirror.js\");\n  const { makeSiteMirror } = await import(\"../../db/site-mirror.js\");\n  const result = await draftDueReports(\n    base,\n    new Date(),\n    await makeScheduleMirrorBestEffort(),\n    await makeReportMirror(),\n    await makeSiteMirror(),\n  );\n  await alertOnFleetAnalyticsFailure(result.health);\n  return { output: result.output, code: result.code };\n}\n\n/** Best-effort: when a draft run's GA/Search soft-failures look FLEET-WIDE (the shared\n *  GA_SUBJECT lost access — see assessAnalyticsAlert), email the operator one alert.\n *  NEVER throws — a Resend or config hiccup must not fail the nightly draft cron; the\n *  per-site `⚠ GA skipped` warnings + the run-output line still carry the signal. The\n *  daily idempotency key dedupes multiple runs in one day (Resend dedupes 24h). */\nasync function alertOnFleetAnalyticsFailure(health: AnalyticsRunHealth): Promise<void> {\n  if (!assessAnalyticsAlert(health).fire) return;\n  try {\n    const to = operatorEmail();\n    const { subject, html } = composeAnalyticsAlertEmail(health, dashboardBaseUrl());\n    const { defaultResendClient } = await import(\"../../reports/send/resend.js\");\n    await defaultResendClient().send({\n      from: \"Reddoor Reports <reports@reddoorla.com>\",\n      to: [to],\n      subject,\n      html,\n      idempotencyKey: `analytics-alert-${new Date().toISOString().slice(0, 10)}`,\n    });\n    console.warn(`⚠ ${subject} — operator alerted (${to})`);\n  } catch (e) {\n    console.warn(`⚠ analytics-failure alert send failed: ${(e as Error).message}`);\n  }\n}\n\n/**\n * Write each site's code-computed next-maintenance / next-testing date back to Airtable\n * (date-only, or null when there's no schedule), so the \"next\" dates shown there derive\n * from the SAME `nextDueDate` the scheduler uses — replacing the old Airtable formula +\n * automation. Best-effort and per-site isolated: a missing `Next … at` column or one bad\n * row warns and is skipped, never aborting the nightly draft run.\n *\n * The diff-guard (#539 Phase 3): a site whose computed dates equal what its row\n * already holds is SKIPPED — before it, every one of the 44 sites got a nightly\n * write while only the handful whose schedule actually moved needed one (a\n * never-maintained site re-wrote null over null forever). This also scopes the\n * write to maintained sites by construction: no schedule → computed null →\n * equal to the stored null → skipped. Each real write dual-writes through\n * `scheduleMirror` into site_schedule (null mirror = Turso creds absent; the\n * hourly sync converges either way). The NEXT_DUE_WRITE line is observability,\n * not a CI gate — nothing greps it yet.\n */\nexport async function writeNextDueDates(\n  base: AirtableBase,\n  websites: WebsiteRow[],\n  reports: ReportRow[],\n  today: Date,\n  scheduleMirror: ScheduleMirror | null = null,\n): Promise<void> {\n  const ymd = (d: Date | null): string | null => (d ? d.toISOString().slice(0, 10) : null);\n  let wrote = 0;\n  let skipped = 0;\n  let failed = 0;\n  let mirrored = 0;\n  let mirrorFailed = 0;\n  let mirrorMissed = 0;\n  for (const site of websites) {\n    // The whole per-site body sits in ONE try — compute included — so a bad\n    // row can only cost its own write, exactly the pre-diff-guard blast radius.\n    try {\n      const maintenanceAt = ymd(nextDueDate(site, reports, \"Maintenance\", today));\n      const testingAt = ymd(nextDueDate(site, reports, \"Testing\", today));\n      if (maintenanceAt === site.nextMaintenanceAt && testingAt === site.nextTestingAt) {\n        skipped++;\n        continue;\n      }\n      const fields = await updateNextDueDates(base, site.id, { maintenanceAt, testingAt });\n      wrote++;\n      if (scheduleMirror) {\n        try {\n          // false = the UPDATE matched no site_schedule row (site created in\n          // Airtable since the last hourly import) — missed, not mirrored.\n          if (await scheduleMirror(site.id, fields, today.toISOString())) mirrored++;\n          else mirrorMissed++;\n        } catch (e) {\n          mirrorFailed++;\n          console.warn(`⚠ [schedule-mirror] ${site.name}: ${(e as Error).message}`);\n        }\n      }\n    } catch (e) {\n      failed++;\n      console.warn(`⚠ next-due write skipped for ${site.name}: ${(e as Error).message}`);\n    }\n  }\n  // failed= keeps a write outage visible: without it wrote+skipped silently\n  // undercounts, and a FULL outage prints wrote=0 skipped=0 — indistinguishable\n  // from an empty fleet.\n  // A null mirror writes nothing and throws nothing, so its only trace used to\n  // be an ABSENT suffix — which reads exactly like a healthy run. `mirror=absent`\n  // states it instead. Counters stay off in that case deliberately: `mirrored=0`\n  // would claim a write that returned nothing, not one that was never attempted.\n  const mirrorNote = scheduleMirror\n    ? ` mirrored=${mirrored} mirror_failed=${mirrorFailed} mirror_missed=${mirrorMissed}`\n    : \" mirror=absent\";\n  console.log(`NEXT_DUE_WRITE wrote=${wrote} skipped=${skipped} failed=${failed}${mirrorNote}`);\n}\n\nexport async function draftDueReports(\n  base: AirtableBase,\n  today: Date,\n  scheduleMirror: ScheduleMirror | null = null,\n  /** #539 Phase 5: Turso write-through for rows this batch CREATES. Forwarded\n   *  to every draftReportForSite call — the nightly batch is the only unattended\n   *  creator of report rows, so a dropped pass-through leaves each new draft\n   *  invisible to the Turso-backed console. */\n  reportMirror?: ReportMirror,\n  /** #539 Phase 5: the Websites-row twin — drafting stamps `Analytics soft-fail\n   *  at` on the SITE row, a different Turso table from the report. */\n  siteMirror?: SiteMirror,\n): Promise<{ output: string; code: number; health: AnalyticsRunHealth }> {\n  const mirrorOpt = {\n    ...(reportMirror ? { reportMirror } : {}),\n    ...(siteMirror ? { siteMirror } : {}),\n  };\n  const websites = await listWebsites(base);\n  // ONE unfiltered fetch for the whole fleet. Per-site queries can't be pushed to\n  // Airtable anyway (linked-record fields aren't formula-filterable by record id),\n  // and findDueReports + the period guard below match on siteId in memory.\n  const reports = await listAllReports(base);\n\n  // Refresh every site's code-owned next-due dates first, so they stay current even on\n  // a run where nothing is due (the early return below).\n  await writeNextDueDates(base, websites, reports, today, scheduleMirror);\n\n  const due = findDueReports(websites, reports, today);\n\n  // GA/Search enrichment is configured globally (the impersonation subject) AND\n  // per-site (a GA4 property or a search query). `gaConfigured` is the global half;\n  // the per-site half is checked as each draft runs, to build the fleet-wide\n  // analytics-failure alert's denominator (see alertOnFleetAnalyticsFailure).\n  const gaConfigured = readGaConfig() !== null;\n  // Truthy (not `!== null`) to mirror fetchGaUsers/fetchSearch's own gate exactly\n  // (`!siteRow.ga4PropertyId`), so an empty-string cell counts as not-configured in\n  // BOTH places and can't inflate the alert denominator.\n  const isAnalyticsConfigured = (s: WebsiteRow): boolean =>\n    gaConfigured && Boolean(s.ga4PropertyId || s.searchQuery);\n\n  if (due.length === 0) {\n    return {\n      output: \"No reports due.\",\n      code: 0,\n      health: { softFailedSites: 0, configuredSites: 0 },\n    };\n  }\n\n  const lines: string[] = [];\n  let softFailedSites = 0;\n  let searchDefaultMisses = 0;\n  let searchPropertiesMissing = 0;\n  let gaConfiguredSites = 0;\n  let skipped = 0;\n  for (const item of due) {\n    // Idempotency: a re-run must not re-draft a (site, type) already drafted this\n    // recurrence. The dueDate's YYYY-MM is the stable per-cycle key. Match against the\n    // reports we already fetched — no extra query on the hot path.\n    const period = reportPeriodKey(item.dueDate);\n    const existing = reports.find(\n      (r) => r.siteId === item.site.id && r.reportType === item.reportType && r.period === period,\n    );\n\n    // A row already exists for THIS period. Two cases:\n    //   - Draft ready → truly done, skip (the idempotent re-run path).\n    //   - NOT ready → a crash between createDraft and setDraftReady wedged it: the\n    //     row exists (so we never re-draft) yet it's never sendable (listSendable\n    //     needs Draft ready). COMPLETE it in place instead of skipping forever —\n    //     re-render → re-upload the HTML → flip Draft ready on the EXISTING row.\n    if (existing) {\n      if (existing.draftReady) {\n        skipped++;\n        lines.push(`• skipped (already drafted ${period}): ${item.site.name} ${item.reportType}`);\n        continue;\n      }\n      // A not-ready row is normally a crash between createDraft and setDraftReady — re-complete\n      // it in place. BUT queueDraft also clears Draft ready on rows it supersedes/blocks, and\n      // those must NOT be re-completed: doing so would re-render and APPEND a duplicate HTML\n      // attachment every nightly run, only to be re-blocked. Distinguish the two: if a\n      // higher-or-equal-tier report is still pending for this site, this row was intentionally\n      // un-queued (not crashed) — skip it until the blocker is sent/approved or the month rolls.\n      const blockedByPending = reports.some(\n        (r) =>\n          r.siteId === item.site.id &&\n          r.id !== existing.id &&\n          r.sentAt === null &&\n          r.draftReady &&\n          reportTier(r.reportType) >= reportTier(item.reportType),\n      );\n      if (blockedByPending) {\n        skipped++;\n        lines.push(\n          `• skipped (superseded — a higher-or-equal-tier report is pending): ${item.site.name} ${item.reportType}`,\n        );\n        continue;\n      }\n      try {\n        const result = await draftReportForSite(base, item.site, item.reportType, {\n          period,\n          completeRowId: existing.id,\n          existingRow: existing,\n          ...mirrorOpt,\n        });\n        existing.draftReady = result.queued === true;\n        lines.push(\n          draftLine(\n            result.reportRow?.reportId ?? existing.reportId,\n            result.queued,\n            result.supersededIds,\n            \"completed half-made draft\",\n          ),\n        );\n        if (isAnalyticsConfigured(item.site)) gaConfiguredSites++;\n        if (result.softFailures.length > 0) softFailedSites++;\n        if (result.searchDefaultMissed) searchDefaultMisses++;\n        if (result.searchPropertyMissing) searchPropertiesMissing++;\n      } catch (e) {\n        lines.push(`✗ failed: ${item.site.name} ${item.reportType} — ${(e as Error).message}`);\n      }\n      continue;\n    }\n\n    // Pile-up guard: don't accrue a fresh new-period draft every recurrence for a\n    // site nobody ever approves. The period key follows the DUE month, so each\n    // recurrence wants a new (later-period) draft — but if a PRIOR draft is still\n    // pending approval, a new one just stacks. Skip creating the new one while an\n    // earlier-period draft for this (site, type) sits ready-but-unsent.\n    //\n    // `r.draftReady` is load-bearing: a draft a higher tier SUPERSEDED has\n    // draftReady=false and never gets a Sent at, so without this clause it would\n    // match (sentAt null + earlier period) and block EVERY future draft for the\n    // site forever. Pending-approval means draftReady=true AND sentAt=null.\n    const pendingEarlier = reports.find(\n      (r) =>\n        r.siteId === item.site.id &&\n        r.reportType === item.reportType &&\n        r.draftReady &&\n        r.sentAt === null &&\n        r.period !== null &&\n        r.period < period,\n    );\n    if (pendingEarlier) {\n      skipped++;\n      lines.push(\n        `• skipped: ${item.site.name} ${item.reportType} already has an unsent ${pendingEarlier.period} draft pending approval`,\n      );\n      continue;\n    }\n\n    try {\n      // Pass the SAME key the guard searches by, so the stamped Period always\n      // matches a future run's reportPeriodKey(dueDate) — even if this run lags\n      // into a later month than the dueDate.\n      const result = await draftReportForSite(base, item.site, item.reportType, {\n        period,\n        ...mirrorOpt,\n      });\n      lines.push(draftLine(result.reportRow?.reportId, result.queued, result.supersededIds));\n      // Keep the in-memory snapshot current so the guard's `.some()` check on the\n      // NEXT iteration of this same run catches a row we JUST created — rather than\n      // relying on findDueReports never emitting two items for the same (site, type).\n      if (result.reportRow) reports.push(result.reportRow);\n      // Count sites (not individual GA/Search failures) so a fleet-wide enrichment\n      // outage is one obvious line at the bottom, not 200 buried console.warns.\n      if (isAnalyticsConfigured(item.site)) gaConfiguredSites++;\n      if (result.softFailures.length > 0) softFailedSites++;\n      if (result.searchDefaultMissed) searchDefaultMisses++;\n      if (result.searchPropertyMissing) searchPropertiesMissing++;\n    } catch (e) {\n      lines.push(`✗ failed: ${item.site.name} ${item.reportType} — ${(e as Error).message}`);\n    }\n  }\n  if (skipped > 0) {\n    lines.push(`• ${skipped} already drafted or pending this period`);\n  }\n  if (softFailedSites > 0) {\n    lines.push(\n      `⚠ ${softFailedSites} site${softFailedSites === 1 ? \"\" : \"s\"} had GA/Search enrichment fail — drafted with blank analytics; check the logs above`,\n    );\n  }\n  if (searchDefaultMisses > 0) {\n    lines.push(\n      `⚑ ${searchDefaultMisses} site${searchDefaultMisses === 1 ? \"\" : \"s\"} returned no Search Console data for their name — set an explicit \"Search query\" in Airtable to track brand presence.`,\n    );\n  }\n  if (searchPropertiesMissing > 0) {\n    lines.push(\n      `⚑ ${searchPropertiesMissing} site${searchPropertiesMissing === 1 ? \"\" : \"s\"} matched NO Search Console property — verify the domain property exists and the service account has access (a \"Search query\" change cannot fix this).`,\n    );\n  }\n  return {\n    output: lines.join(\"\\n\"),\n    code: lines.some((l) => l.startsWith(\"✗\")) ? 1 : 0,\n    health: { softFailedSites, configuredSites: gaConfiguredSites },\n  };\n}\n\nasync function runSingleSiteDraft(\n  slug: string,\n  opts: { previewOnly: boolean; enrich: boolean; reportType: ReportType },\n): Promise<{ output: string; code: number }> {\n  const base = openBase(readAirtableConfig());\n  const websites = await listWebsites(base);\n  const site = websites.find((w) => siteSlug(w.name) === slug);\n  if (!site) {\n    throw Object.assign(new Error(`No Websites row matched slug \"${slug}\"`), { exitCode: 2 });\n  }\n  // Phase 5 dual-write (#539) — but only on the path that actually creates a\n  // row. A preview writes nothing to Airtable, so opening a libSQL handle for\n  // it would be pure cost (and `report --preview` is the one draft path that\n  // deliberately does no store IO at all).\n  const reportMirror = opts.previewOnly\n    ? null\n    : await (await import(\"../../reports/report-mirror.js\")).makeReportMirror();\n  const siteMirror = opts.previewOnly\n    ? null\n    : await (await import(\"../../db/site-mirror.js\")).makeSiteMirror();\n  const result = await draftReportForSite(opts.previewOnly ? null : base, site, opts.reportType, {\n    previewOnly: opts.previewOnly,\n    // Only forced on. Left undefined, draftReportForSite keeps its default\n    // (enrich iff there is a base), so the real drafting path is untouched.\n    ...(opts.enrich ? { enrich: true } : {}),\n    ...(reportMirror ? { reportMirror } : {}),\n    ...(siteMirror ? { siteMirror } : {}),\n  });\n  if (opts.previewOnly) {\n    return { output: `Preview written to ${result.htmlPath}`, code: 0 };\n  }\n  return {\n    output: draftLine(\n      result.reportRow?.reportId,\n      result.queued,\n      result.supersededIds,\n      \"Draft created\",\n    ),\n    code: 0,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmBA,IAAM,mBAAmB;AAUlB,SAAS,qBAAqB,GAAuC;AAC1E,QAAM,EAAE,iBAAiB,gBAAgB,IAAI;AAC7C,QAAM,OACJ,mBAAmB,KACnB,mBAAmB,oBACnB,kBAAkB,KAAK;AACzB,QAAM,SAAS,OACX,GAAG,eAAe,OAAO,eAAe,oPACxC;AACJ,SAAO,EAAE,MAAM,OAAO;AACxB;AAOO,SAAS,2BACd,GACA,cACmC;AACnC,QAAM,UAAU,oDAA0C,EAAE,eAAe,IAAI,EAAE,eAAe;AAChG,QAAM,EAAE,OAAO,IAAI,qBAAqB,CAAC;AACzC,QAAM,OAAO,cAAc,WAAW,MAAM,CAAC;AAAA;AAAA;AAAA,cAGjC,WAAW,YAAY,CAAC;AACpC,SAAO,EAAE,SAAS,KAAK;AACzB;;;ACjBA,SAAS,UACP,UACA,QACA,eACA,OAAO,WACC;AACR,QAAM,KAAK,YAAY;AACvB,MAAI,WAAW,OAAO;AACpB,WAAO,UAAK,IAAI,oBAAoB,EAAE;AAAA,EACxC;AACA,QAAM,MACJ,cAAc,SAAS,IACnB,gBAAgB,cAAc,MAAM,oBAAoB,cAAc,SAAS,IAAI,MAAM,EAAE,MAC3F;AACN,SAAO,UAAK,IAAI,KAAK,EAAE,GAAG,GAAG;AAC/B;AASO,SAAS,0BAA0B,KAAqC;AAC7E,MAAI,QAAQ,UAAa,IAAI,KAAK,MAAM,GAAI,QAAO;AACnD,QAAM,OAAO,IAAI,KAAK,EAAE,YAAY;AACpC,MAAI,SAAS,cAAe,QAAO;AACnC,MAAI,SAAS,UAAW,QAAO;AAC/B,QAAM,OACJ,SAAS,WACL,4CACA,SAAS,iBACP,8CACA;AACR,QAAM,OAAO;AAAA,IACX,IAAI,MAAM,8CAA8C,KAAK,UAAU,GAAG,CAAC,IAAI,IAAI,EAAE;AAAA,IACrF,EAAE,UAAU,EAAE;AAAA,EAChB;AACF;AAIA,SAAS,mBAA2B;AAClC,SAAO,QAAQ,IAAI,oBAAoB,KAAK,KAAK;AACnD;AAEA,eAAsB,iBACpB,MACA,MAC2C;AAC3C,MAAI,KAAK,QAAQ;AACf,UAAM,EAAE,UAAU,IAAI,MAAM,OAAO,sBAAyB;AAC5D,WAAO,UAAU,EAAE,SAAS,iBAAiB,EAAE,CAAC;AAAA,EAClD;AAEA,MAAI,KAAK,WAAW;AAClB,UAAM,EAAE,oBAAoB,IAAI,MAAM,OAAO,2BAAmC;AAGhF,UAAM,EAAE,eAAe,IAAI,MAAM,OAAO,2BAAyB;AACjE,WAAO,oBAAoB,EAAE,YAAY,MAAM,eAAe,EAAE,CAAC;AAAA,EACnE;AAKA,MAAI,KAAK,UAAU;AACjB,UAAM,EAAE,gBAAgB,qBAAqB,IAAI,MAAM,OAAO,wBAAgC;AAC9F,UAAM,EAAE,oBAAoB,IAAI,MAAM,OAAO,+BAAuC;AACpF,UAAM,EAAE,QAAQ,aAAa,IAAI,MAAM,OAAO,sBAAoB;AAClE,UAAM,EAAE,eAAe,aAAa,kBAAkB,IACpD,MAAM,OAAO,2BAAyB;AACxC,UAAM,EAAE,gBAAgB,IAAI,MAAM,OAAO,6BAA2B;AACpE,UAAM,EAAE,qBAAqB,IAAI,MAAM,OAAO,2BAAuC;AACrF,UAAM,KAAK,MAAM,OAAO,aAAa,CAAC;AACtC,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,QACE,WAAW,CAAC,OAAO,cAAc,IAAI,EAAE;AAAA,QACvC,SAAS,CAAC,OAAO,YAAY,IAAI,EAAE;AAAA,QACnC,iBAAiB,OAAO,QAAQ,MAAM,gBAAgB,IAAI,EAAE,IAAI,SAAS;AAAA,QACzE,qBAAqB,OAAO,SAAS,MAAM,qBAAqB,GAAG,GAAG;AAAA,QACtE,QAAQ,CAAC,MAAM,QAAQ,UAAU,oBAAoB,MAAM,QAAQ,KAAK;AAAA,QACxE,OAAO,CAAC,IAAI,SAAS,kBAAkB,IAAI,IAAI,IAAI;AAAA,MACrD;AAAA,MACA,KAAK;AAAA,IACP;AAGA,WAAO,EAAE,QAAQ,qBAAqB,MAAM,GAAG,MAAM,OAAO,WAAW,aAAa,IAAI,EAAE;AAAA,EAC5F;AAEA,MAAI,KAAK,KAAK;AACZ,WAAO,YAAY;AAAA,EACrB;AAEA,MAAI,MAAM;AAGR,UAAM,aAAa,0BAA0B,KAAK,IAAI;AACtD,WAAO,mBAAmB,MAAM;AAAA,MAC9B,aAAa,QAAQ,KAAK,OAAO;AAAA,MACjC,QAAQ,QAAQ,KAAK,MAAM;AAAA,MAC3B;AAAA,IACF,CAAC;AAAA,EACH;AAEA,QAAM,OAAO;AAAA,IACX,IAAI;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,UAAU;AAAA,IACZ;AAAA,EACF;AACF;AAEA,eAAe,cAAyD;AACtE,QAAM,OAAO,SAAS,mBAAmB,CAAC;AAG1C,QAAM,EAAE,6BAA6B,IAAI,MAAM,OAAO,6BAA+B;AAKrF,QAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,6BAAgC;AAC1E,QAAM,EAAE,eAAe,IAAI,MAAM,OAAO,2BAAyB;AACjE,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA,oBAAI,KAAK;AAAA,IACT,MAAM,6BAA6B;AAAA,IACnC,MAAM,iBAAiB;AAAA,IACvB,MAAM,eAAe;AAAA,EACvB;AACA,QAAM,6BAA6B,OAAO,MAAM;AAChD,SAAO,EAAE,QAAQ,OAAO,QAAQ,MAAM,OAAO,KAAK;AACpD;AAOA,eAAe,6BAA6B,QAA2C;AACrF,MAAI,CAAC,qBAAqB,MAAM,EAAE,KAAM;AACxC,MAAI;AACF,UAAM,KAAK,cAAc;AACzB,UAAM,EAAE,SAAS,KAAK,IAAI,2BAA2B,QAAQ,iBAAiB,CAAC;AAC/E,UAAM,EAAE,oBAAoB,IAAI,MAAM,OAAO,sBAA8B;AAC3E,UAAM,oBAAoB,EAAE,KAAK;AAAA,MAC/B,MAAM;AAAA,MACN,IAAI,CAAC,EAAE;AAAA,MACP;AAAA,MACA;AAAA,MACA,gBAAgB,oBAAmB,oBAAI,KAAK,GAAE,YAAY,EAAE,MAAM,GAAG,EAAE,CAAC;AAAA,IAC1E,CAAC;AACD,YAAQ,KAAK,UAAK,OAAO,6BAAwB,EAAE,GAAG;AAAA,EACxD,SAAS,GAAG;AACV,YAAQ,KAAK,+CAA2C,EAAY,OAAO,EAAE;AAAA,EAC/E;AACF;AAmBA,eAAsB,kBACpB,MACA,UACA,SACA,OACA,iBAAwC,MACzB;AACf,QAAM,MAAM,CAAC,MAAmC,IAAI,EAAE,YAAY,EAAE,MAAM,GAAG,EAAE,IAAI;AACnF,MAAI,QAAQ;AACZ,MAAI,UAAU;AACd,MAAI,SAAS;AACb,MAAI,WAAW;AACf,MAAI,eAAe;AACnB,MAAI,eAAe;AACnB,aAAW,QAAQ,UAAU;AAG3B,QAAI;AACF,YAAM,gBAAgB,IAAI,YAAY,MAAM,SAAS,eAAe,KAAK,CAAC;AAC1E,YAAM,YAAY,IAAI,YAAY,MAAM,SAAS,WAAW,KAAK,CAAC;AAClE,UAAI,kBAAkB,KAAK,qBAAqB,cAAc,KAAK,eAAe;AAChF;AACA;AAAA,MACF;AACA,YAAM,SAAS,MAAM,mBAAmB,MAAM,KAAK,IAAI,EAAE,eAAe,UAAU,CAAC;AACnF;AACA,UAAI,gBAAgB;AAClB,YAAI;AAGF,cAAI,MAAM,eAAe,KAAK,IAAI,QAAQ,MAAM,YAAY,CAAC,EAAG;AAAA,cAC3D;AAAA,QACP,SAAS,GAAG;AACV;AACA,kBAAQ,KAAK,4BAAuB,KAAK,IAAI,KAAM,EAAY,OAAO,EAAE;AAAA,QAC1E;AAAA,MACF;AAAA,IACF,SAAS,GAAG;AACV;AACA,cAAQ,KAAK,qCAAgC,KAAK,IAAI,KAAM,EAAY,OAAO,EAAE;AAAA,IACnF;AAAA,EACF;AAQA,QAAM,aAAa,iBACf,aAAa,QAAQ,kBAAkB,YAAY,kBAAkB,YAAY,KACjF;AACJ,UAAQ,IAAI,wBAAwB,KAAK,YAAY,OAAO,WAAW,MAAM,GAAG,UAAU,EAAE;AAC9F;AAEA,eAAsB,gBACpB,MACA,OACA,iBAAwC,MAKxC,cAGA,YACuE;AACvE,QAAM,YAAY;AAAA,IAChB,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;AAAA,IACvC,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;AAAA,EACrC;AACA,QAAM,WAAW,MAAM,aAAa,IAAI;AAIxC,QAAM,UAAU,MAAM,eAAe,IAAI;AAIzC,QAAM,kBAAkB,MAAM,UAAU,SAAS,OAAO,cAAc;AAEtE,QAAM,MAAM,eAAe,UAAU,SAAS,KAAK;AAMnD,QAAM,eAAe,aAAa,MAAM;AAIxC,QAAM,wBAAwB,CAAC,MAC7B,gBAAgB,QAAQ,EAAE,iBAAiB,EAAE,WAAW;AAE1D,MAAI,IAAI,WAAW,GAAG;AACpB,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ,EAAE,iBAAiB,GAAG,iBAAiB,EAAE;AAAA,IACnD;AAAA,EACF;AAEA,QAAM,QAAkB,CAAC;AACzB,MAAI,kBAAkB;AACtB,MAAI,sBAAsB;AAC1B,MAAI,0BAA0B;AAC9B,MAAI,oBAAoB;AACxB,MAAI,UAAU;AACd,aAAW,QAAQ,KAAK;AAItB,UAAM,SAAS,gBAAgB,KAAK,OAAO;AAC3C,UAAM,WAAW,QAAQ;AAAA,MACvB,CAAC,MAAM,EAAE,WAAW,KAAK,KAAK,MAAM,EAAE,eAAe,KAAK,cAAc,EAAE,WAAW;AAAA,IACvF;AAQA,QAAI,UAAU;AACZ,UAAI,SAAS,YAAY;AACvB;AACA,cAAM,KAAK,mCAA8B,MAAM,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,UAAU,EAAE;AACxF;AAAA,MACF;AAOA,YAAM,mBAAmB,QAAQ;AAAA,QAC/B,CAAC,MACC,EAAE,WAAW,KAAK,KAAK,MACvB,EAAE,OAAO,SAAS,MAClB,EAAE,WAAW,QACb,EAAE,cACF,WAAW,EAAE,UAAU,KAAK,WAAW,KAAK,UAAU;AAAA,MAC1D;AACA,UAAI,kBAAkB;AACpB;AACA,cAAM;AAAA,UACJ,gFAAsE,KAAK,KAAK,IAAI,IAAI,KAAK,UAAU;AAAA,QACzG;AACA;AAAA,MACF;AACA,UAAI;AACF,cAAM,SAAS,MAAM,mBAAmB,MAAM,KAAK,MAAM,KAAK,YAAY;AAAA,UACxE;AAAA,UACA,eAAe,SAAS;AAAA,UACxB,aAAa;AAAA,UACb,GAAG;AAAA,QACL,CAAC;AACD,iBAAS,aAAa,OAAO,WAAW;AACxC,cAAM;AAAA,UACJ;AAAA,YACE,OAAO,WAAW,YAAY,SAAS;AAAA,YACvC,OAAO;AAAA,YACP,OAAO;AAAA,YACP;AAAA,UACF;AAAA,QACF;AACA,YAAI,sBAAsB,KAAK,IAAI,EAAG;AACtC,YAAI,OAAO,aAAa,SAAS,EAAG;AACpC,YAAI,OAAO,oBAAqB;AAChC,YAAI,OAAO,sBAAuB;AAAA,MACpC,SAAS,GAAG;AACV,cAAM,KAAK,kBAAa,KAAK,KAAK,IAAI,IAAI,KAAK,UAAU,WAAO,EAAY,OAAO,EAAE;AAAA,MACvF;AACA;AAAA,IACF;AAYA,UAAM,iBAAiB,QAAQ;AAAA,MAC7B,CAAC,MACC,EAAE,WAAW,KAAK,KAAK,MACvB,EAAE,eAAe,KAAK,cACtB,EAAE,cACF,EAAE,WAAW,QACb,EAAE,WAAW,QACb,EAAE,SAAS;AAAA,IACf;AACA,QAAI,gBAAgB;AAClB;AACA,YAAM;AAAA,QACJ,mBAAc,KAAK,KAAK,IAAI,IAAI,KAAK,UAAU,0BAA0B,eAAe,MAAM;AAAA,MAChG;AACA;AAAA,IACF;AAEA,QAAI;AAIF,YAAM,SAAS,MAAM,mBAAmB,MAAM,KAAK,MAAM,KAAK,YAAY;AAAA,QACxE;AAAA,QACA,GAAG;AAAA,MACL,CAAC;AACD,YAAM,KAAK,UAAU,OAAO,WAAW,UAAU,OAAO,QAAQ,OAAO,aAAa,CAAC;AAIrF,UAAI,OAAO,UAAW,SAAQ,KAAK,OAAO,SAAS;AAGnD,UAAI,sBAAsB,KAAK,IAAI,EAAG;AACtC,UAAI,OAAO,aAAa,SAAS,EAAG;AACpC,UAAI,OAAO,oBAAqB;AAChC,UAAI,OAAO,sBAAuB;AAAA,IACpC,SAAS,GAAG;AACV,YAAM,KAAK,kBAAa,KAAK,KAAK,IAAI,IAAI,KAAK,UAAU,WAAO,EAAY,OAAO,EAAE;AAAA,IACvF;AAAA,EACF;AACA,MAAI,UAAU,GAAG;AACf,UAAM,KAAK,UAAK,OAAO,yCAAyC;AAAA,EAClE;AACA,MAAI,kBAAkB,GAAG;AACvB,UAAM;AAAA,MACJ,UAAK,eAAe,QAAQ,oBAAoB,IAAI,KAAK,GAAG;AAAA,IAC9D;AAAA,EACF;AACA,MAAI,sBAAsB,GAAG;AAC3B,UAAM;AAAA,MACJ,UAAK,mBAAmB,QAAQ,wBAAwB,IAAI,KAAK,GAAG;AAAA,IACtE;AAAA,EACF;AACA,MAAI,0BAA0B,GAAG;AAC/B,UAAM;AAAA,MACJ,UAAK,uBAAuB,QAAQ,4BAA4B,IAAI,KAAK,GAAG;AAAA,IAC9E;AAAA,EACF;AACA,SAAO;AAAA,IACL,QAAQ,MAAM,KAAK,IAAI;AAAA,IACvB,MAAM,MAAM,KAAK,CAAC,MAAM,EAAE,WAAW,QAAG,CAAC,IAAI,IAAI;AAAA,IACjD,QAAQ,EAAE,iBAAiB,iBAAiB,kBAAkB;AAAA,EAChE;AACF;AAEA,eAAe,mBACb,MACA,MAC2C;AAC3C,QAAM,OAAO,SAAS,mBAAmB,CAAC;AAC1C,QAAM,WAAW,MAAM,aAAa,IAAI;AACxC,QAAM,OAAO,SAAS,KAAK,CAAC,MAAM,SAAS,EAAE,IAAI,MAAM,IAAI;AAC3D,MAAI,CAAC,MAAM;AACT,UAAM,OAAO,OAAO,IAAI,MAAM,iCAAiC,IAAI,GAAG,GAAG,EAAE,UAAU,EAAE,CAAC;AAAA,EAC1F;AAKA,QAAM,eAAe,KAAK,cACtB,OACA,OAAO,MAAM,OAAO,6BAAgC,GAAG,iBAAiB;AAC5E,QAAM,aAAa,KAAK,cACpB,OACA,OAAO,MAAM,OAAO,2BAAyB,GAAG,eAAe;AACnE,QAAM,SAAS,MAAM,mBAAmB,KAAK,cAAc,OAAO,MAAM,MAAM,KAAK,YAAY;AAAA,IAC7F,aAAa,KAAK;AAAA;AAAA;AAAA,IAGlB,GAAI,KAAK,SAAS,EAAE,QAAQ,KAAK,IAAI,CAAC;AAAA,IACtC,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;AAAA,IACvC,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;AAAA,EACrC,CAAC;AACD,MAAI,KAAK,aAAa;AACpB,WAAO,EAAE,QAAQ,sBAAsB,OAAO,QAAQ,IAAI,MAAM,EAAE;AAAA,EACpE;AACA,SAAO;AAAA,IACL,QAAQ;AAAA,MACN,OAAO,WAAW;AAAA,MAClB,OAAO;AAAA,MACP,OAAO;AAAA,MACP;AAAA,IACF;AAAA,IACA,MAAM;AAAA,EACR;AACF;","names":[]}

package/dist/report-mirror-4MNORYQ4.js

@@ -0,0 +1,49 @@
+import {
+  mirrorReportInsert,
+  mirrorReportPatch,
+  storeRenderedHtml
+} from "./chunk-HHMMUR4P.js";
+import "./chunk-P6AORG32.js";
+import "./chunk-F3JWOPTG.js";
+import "./chunk-VAD43MOR.js";
+import "./chunk-7NYN2P6I.js";
+import {
+  openDb,
+  readDbConfig
+} from "./chunk-JHGHLKFS.js";
+import "./chunk-3SF7D4DY.js";
+import "./chunk-6VAL7XJT.js";
+
+// src/reports/report-mirror.ts
+async function makeReportMirror(open = () => openDb(readDbConfig())) {
+  let db = null;
+  let why = "";
+  try {
+    db = await open();
+  } catch (e) {
+    why = e.message;
+  }
+  const run = async (reportId, op, work) => {
+    if (!db) {
+      console.log(`REPORT_MIRROR report=${reportId} op=${op} mirrored=absent reason=${why}`);
+      return;
+    }
+    try {
+      await work(db);
+      console.log(`REPORT_MIRROR report=${reportId} op=${op} mirrored=1`);
+    } catch (e) {
+      console.log(
+        `REPORT_MIRROR report=${reportId} op=${op} mirrored=0 error=${e.message}`
+      );
+    }
+  };
+  return {
+    created: (rec) => run(rec.id, "created", (d) => mirrorReportInsert(d, rec)),
+    body: (reportId, html) => run(reportId, "body", (d) => storeRenderedHtml(d, reportId, html)),
+    patch: (reportId, patch) => run(reportId, "patch", (d) => mirrorReportPatch(d, reportId, patch))
+  };
+}
+export {
+  makeReportMirror
+};
+//# sourceMappingURL=report-mirror-4MNORYQ4.js.map

package/dist/report-mirror-4MNORYQ4.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/reports/report-mirror.ts"],"sourcesContent":["/** #539 Phase 5: the Turso write-through for the Reports write surface.\n *\n *  Before this, the only report mirrors were UPDATEs on the request path\n *  (approve, override, delivery status, commentary). Everything the DRAFTING\n *  path writes — the row itself, the rendered body, the queue flag, a re-run's\n *  refreshed scores — reached Turso only via the hourly sync. Two of those are\n *  visible to the operator today: a fresh draft's row does not exist, and its\n *  preview route answers \"No rendered body stored\" for up to an hour. At the\n *  freeze they stop being windows.\n *\n *  Deliberately UNLIKE `makeHealthMirrorBestEffort`, this never returns null.\n *  #585 is the reason: Phase 3's next-due mirror silently no-opped in production\n *  for weeks because the factory returned null without creds, and a dead\n *  dual-write then looked exactly like a healthy one — the only tell was an\n *  ABSENT log suffix nobody was watching for. Here creds-absent is a state the\n *  mirror REPORTS, so every write emits one REPORT_MIRROR line and an absent\n *  line means the wiring is gone, not that conditions were quiet.\n */\nimport { openDb, readDbConfig, type Db } from \"../db/client.js\";\nimport {\n  mirrorReportInsert,\n  mirrorReportPatch,\n  storeRenderedHtml,\n  type ReportMirrorPatch,\n} from \"../db/fleet-state.js\";\nimport type { CreatedDraftMirror } from \"./airtable/reports.js\";\n\n/** The three shapes a report write takes. Injected as ONE object rather than\n *  three parameters because they share a db handle and always travel together:\n *  a caller holding `created` but not `body` produces exactly the half-mirrored\n *  state (row present, preview 404) this module exists to prevent. */\nexport type ReportMirror = {\n  /** A row Airtable just CREATED, as Airtable echoed it back. */\n  created: CreatedDraftMirror;\n  /** A freshly rendered body for an existing row. */\n  body: (reportId: string, html: string) => Promise<void>;\n  /** Columns just written to an existing row. */\n  patch: (reportId: string, patch: ReportMirrorPatch) => Promise<void>;\n};\n\n/** Build the drafting-path mirror. Never throws and never returns null:\n *  Airtable is still authoritative through Phase 5, so a mirror problem must\n *  not cost a draft the operator is waiting on — the hourly sync converges\n *  whatever this misses. `open` is injectable for tests. */\nexport async function makeReportMirror(\n  open: () => Promise<Db> = () => openDb(readDbConfig()),\n): Promise<ReportMirror> {\n  let db: Db | null = null;\n  let why = \"\";\n  try {\n    db = await open();\n  } catch (e) {\n    why = (e as Error).message;\n  }\n\n  const run = async (reportId: string, op: string, work: (db: Db) => Promise<void>) => {\n    if (!db) {\n      console.log(`REPORT_MIRROR report=${reportId} op=${op} mirrored=absent reason=${why}`);\n      return;\n    }\n    try {\n      await work(db);\n      console.log(`REPORT_MIRROR report=${reportId} op=${op} mirrored=1`);\n    } catch (e) {\n      console.log(\n        `REPORT_MIRROR report=${reportId} op=${op} mirrored=0 error=${(e as Error).message}`,\n      );\n    }\n  };\n\n  return {\n    created: (rec) => run(rec.id, \"created\", (d) => mirrorReportInsert(d, rec)),\n    body: (reportId, html) => run(reportId, \"body\", (d) => storeRenderedHtml(d, reportId, html)),\n    patch: (reportId, patch) =>\n      run(reportId, \"patch\", (d) => mirrorReportPatch(d, reportId, patch)),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AA4CA,eAAsB,iBACpB,OAA0B,MAAM,OAAO,aAAa,CAAC,GAC9B;AACvB,MAAI,KAAgB;AACpB,MAAI,MAAM;AACV,MAAI;AACF,SAAK,MAAM,KAAK;AAAA,EAClB,SAAS,GAAG;AACV,UAAO,EAAY;AAAA,EACrB;AAEA,QAAM,MAAM,OAAO,UAAkB,IAAY,SAAoC;AACnF,QAAI,CAAC,IAAI;AACP,cAAQ,IAAI,wBAAwB,QAAQ,OAAO,EAAE,2BAA2B,GAAG,EAAE;AACrF;AAAA,IACF;AACA,QAAI;AACF,YAAM,KAAK,EAAE;AACb,cAAQ,IAAI,wBAAwB,QAAQ,OAAO,EAAE,aAAa;AAAA,IACpE,SAAS,GAAG;AACV,cAAQ;AAAA,QACN,wBAAwB,QAAQ,OAAO,EAAE,qBAAsB,EAAY,OAAO;AAAA,MACpF;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,SAAS,CAAC,QAAQ,IAAI,IAAI,IAAI,WAAW,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAAA,IAC1E,MAAM,CAAC,UAAU,SAAS,IAAI,UAAU,QAAQ,CAAC,MAAM,kBAAkB,GAAG,UAAU,IAAI,CAAC;AAAA,IAC3F,OAAO,CAAC,UAAU,UAChB,IAAI,UAAU,SAAS,CAAC,MAAM,kBAAkB,GAAG,UAAU,KAAK,CAAC;AAAA,EACvE;AACF;","names":[]}

package/dist/rerender-3FM6DNRH.js

@@ -0,0 +1,32 @@
+// src/reports/send/rerender.ts
+async function rerenderReport(deps, reportId) {
+  const report = await deps.getReport(reportId);
+  if (!report) return { status: "not-found", reportId };
+  if (report.sentAt !== null) return { status: "already-sent", reportId };
+  const site = await deps.getSite(report.siteId);
+  if (!site) return { status: "not-found", reportId };
+  const stored = await deps.loadHeaderPlate(site.id);
+  let plate;
+  let headerSource;
+  if (stored) {
+    plate = stored;
+    headerSource = "turso";
+  } else if (site.headerImage) {
+    plate = await deps.fetchAirtableHeader(site.headerImage.url);
+    headerSource = "airtable";
+  } else {
+    return { status: "no-header", reportId };
+  }
+  const { html } = await deps.render(site, report, plate);
+  await deps.store(reportId, html);
+  return { status: "rendered", reportId, bytes: html.length, headerSource };
+}
+function formatRerenderResult(r) {
+  const suffix = r.status === "rendered" ? ` bytes=${r.bytes} header=${r.headerSource}` : "";
+  return `REPORT_RERENDER report=${r.reportId} status=${r.status}${suffix}`;
+}
+export {
+  formatRerenderResult,
+  rerenderReport
+};
+//# sourceMappingURL=rerender-3FM6DNRH.js.map

package/dist/rerender-3FM6DNRH.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/reports/send/rerender.ts"],"sourcesContent":["import type { WebsiteRow } from \"../airtable/websites.js\";\nimport type { ReportRow } from \"../airtable/reports.js\";\n\n/**\n * Refresh a report's stored HTML body on demand (#539 Phase 4 report review).\n *\n * The console's preview serves `reports.rendered_html`, which is written once at\n * draft time — so commentary edited afterwards does not appear. This regenerates\n * it through `renderReportFromRow`, the same path `sendOne` uses, so the preview\n * is what the client will actually receive rather than an approximation of it.\n *\n * It runs as a batch job (Actions), not in a Netlify function, and that is a\n * deliberate constraint rather than an accident: rendering needs sharp, a native\n * module no function currently bundles, and the alternative — approximating the\n * header geometry to avoid sharp — trades away exactly the fidelity a preview\n * exists to provide.\n *\n * IO is injected so the decision logic is testable without sharp, Airtable or a\n * database; the CLI binds the real implementations.\n */\nexport type RerenderDeps = {\n  getReport: (reportId: string) => Promise<ReportRow | null>;\n  getSite: (siteId: string) => Promise<WebsiteRow | null>;\n  /** The clean header plate from Turso (design D5), or null when unstored. */\n  loadHeaderPlate: (siteId: string) => Promise<Uint8Array | null>;\n  /** Fallback: the site's Airtable header attachment. */\n  fetchAirtableHeader: (url: string) => Promise<Uint8Array>;\n  render: (\n    site: WebsiteRow,\n    report: ReportRow,\n    headerPlate: Uint8Array,\n  ) => Promise<{ html: string }>;\n  store: (reportId: string, html: string) => Promise<void>;\n};\n\nexport type RerenderResult =\n  | { status: \"rendered\"; reportId: string; bytes: number; headerSource: \"turso\" | \"airtable\" }\n  /** Already sent: its stored body is the record of what the client received. */\n  | { status: \"already-sent\"; reportId: string }\n  | { status: \"no-header\"; reportId: string }\n  | { status: \"not-found\"; reportId: string };\n\nexport async function rerenderReport(\n  deps: RerenderDeps,\n  reportId: string,\n): Promise<RerenderResult> {\n  const report = await deps.getReport(reportId);\n  if (!report) return { status: \"not-found\", reportId };\n\n  // Refuse a sent report BEFORE doing any work. Its stored body is the record of\n  // what the client actually received; regenerating it would overwrite that with\n  // something nobody was sent — and today's row would not even reproduce it,\n  // since commentary and scores have moved on since.\n  if (report.sentAt !== null) return { status: \"already-sent\", reportId };\n\n  const site = await deps.getSite(report.siteId);\n  if (!site) return { status: \"not-found\", reportId };\n\n  // Turso first: the bytes are already local, and the Airtable attachment URL is\n  // signed and expiring, so fetching it when we hold the same image is pure\n  // latency plus a dependency on a URL that may already be dead.\n  const stored = await deps.loadHeaderPlate(site.id);\n  let plate: Uint8Array;\n  let headerSource: \"turso\" | \"airtable\";\n  if (stored) {\n    plate = stored;\n    headerSource = \"turso\";\n  } else if (site.headerImage) {\n    plate = await deps.fetchAirtableHeader(site.headerImage.url);\n    headerSource = \"airtable\";\n  } else {\n    // Named, not rendered around: a report with no header is already blocked at\n    // approve, and a preview that quietly omitted it would disagree with both\n    // the email and that block.\n    return { status: \"no-header\", reportId };\n  }\n\n  const { html } = await deps.render(site, report, plate);\n  await deps.store(reportId, html);\n  return { status: \"rendered\", reportId, bytes: html.length, headerSource };\n}\n\n/** One line per run, machine-greppable, emitted for every outcome — an absent\n *  line means the job never ran, never that it ran and did nothing. */\nexport function formatRerenderResult(r: RerenderResult): string {\n  const suffix = r.status === \"rendered\" ? ` bytes=${r.bytes} header=${r.headerSource}` : \"\";\n  return `REPORT_RERENDER report=${r.reportId} status=${r.status}${suffix}`;\n}\n"],"mappings":";AA0CA,eAAsB,eACpB,MACA,UACyB;AACzB,QAAM,SAAS,MAAM,KAAK,UAAU,QAAQ;AAC5C,MAAI,CAAC,OAAQ,QAAO,EAAE,QAAQ,aAAa,SAAS;AAMpD,MAAI,OAAO,WAAW,KAAM,QAAO,EAAE,QAAQ,gBAAgB,SAAS;AAEtE,QAAM,OAAO,MAAM,KAAK,QAAQ,OAAO,MAAM;AAC7C,MAAI,CAAC,KAAM,QAAO,EAAE,QAAQ,aAAa,SAAS;AAKlD,QAAM,SAAS,MAAM,KAAK,gBAAgB,KAAK,EAAE;AACjD,MAAI;AACJ,MAAI;AACJ,MAAI,QAAQ;AACV,YAAQ;AACR,mBAAe;AAAA,EACjB,WAAW,KAAK,aAAa;AAC3B,YAAQ,MAAM,KAAK,oBAAoB,KAAK,YAAY,GAAG;AAC3D,mBAAe;AAAA,EACjB,OAAO;AAIL,WAAO,EAAE,QAAQ,aAAa,SAAS;AAAA,EACzC;AAEA,QAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO,MAAM,QAAQ,KAAK;AACtD,QAAM,KAAK,MAAM,UAAU,IAAI;AAC/B,SAAO,EAAE,QAAQ,YAAY,UAAU,OAAO,KAAK,QAAQ,aAAa;AAC1E;AAIO,SAAS,qBAAqB,GAA2B;AAC9D,QAAM,SAAS,EAAE,WAAW,aAAa,UAAU,EAAE,KAAK,WAAW,EAAE,YAAY,KAAK;AACxF,SAAO,0BAA0B,EAAE,QAAQ,WAAW,EAAE,MAAM,GAAG,MAAM;AACzE;","names":[]}