@reddoorla/maintenance 0.86.0 → 0.87.0

package/dist/{forms-notify-target-75U6OU7L.js → forms-notify-target-2EAWCWBW.js}

@@ -4,19 +4,19 @@ import {
 import "./chunk-BNM5POSJ.js";
 import "./chunk-SNSTJLQW.js";
 import "./chunk-5ML7FMBD.js";
-import "./chunk-DJZWYIPP.js";
 import {
   openBase,
   readAirtableConfig
 } from "./chunk-HN6I2XWI.js";
-import "./chunk-2OP4JKIQ.js";
+import "./chunk-DJZWYIPP.js";
 import {
   canonicalizeStatus,
   listWebsites,
   siteSlug,
   toAirtableStatus,
   updateSiteField
-} from "./chunk-LDWZSLSU.js";
+} from "./chunk-7NYN2P6I.js";
+import "./chunk-2OP4JKIQ.js";
 import "./chunk-6VAL7XJT.js";
 
 // src/recipes/forms-notify-target.ts
@@ -72,6 +72,7 @@ async function formsNotifyTarget(deps) {
   }
   const cell = deps.set === "on" ? toAirtableStatus(VERIFY_STATUS) : restoreCell(restoreRaw);
   await updateSiteField(base, row.id, STATUS_COLUMN, cell);
+  await deps.siteMirror?.site(row.id, { [STATUS_COLUMN]: cell });
   const after = findSite(await listWebsites(base), deps.site);
   if (!after) {
     throw Object.assign(new Error(`${row.name} vanished from Websites during the flip.`), {
@@ -142,7 +143,9 @@ async function runFormsNotifyTargetCommand(site, opts) {
     return { output: `--set must be 'on' or 'off' (got '${opts.set}')`, code: 2 };
   }
   try {
+    const { makeSiteMirror } = await import("./site-mirror-NIREX5ME.js");
     const result = await formsNotifyTarget({
+      siteMirror: await makeSiteMirror(),
       site: site.trim(),
       ...set ? { set } : {},
       ...opts.restore ? { restore: opts.restore } : {}
@@ -160,4 +163,4 @@ export {
   formatNotifyTarget,
   runFormsNotifyTargetCommand
 };
-//# sourceMappingURL=forms-notify-target-75U6OU7L.js.map
+//# sourceMappingURL=forms-notify-target-2EAWCWBW.js.map

package/dist/forms-notify-target-2EAWCWBW.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/recipes/forms-notify-target.ts","../src/cli/commands/forms-notify-target.ts"],"sourcesContent":["import { openBase, readAirtableConfig } from \"../reports/airtable/client.js\";\nimport type { AirtableBase } from \"../reports/airtable/client.js\";\nimport type { SiteMirror } from \"../db/site-mirror.js\";\nimport {\n  listWebsites,\n  siteSlug,\n  updateSiteField,\n  type Status,\n  type WebsiteRow,\n} from \"../reports/airtable/websites.js\";\nimport { canonicalizeStatus, toAirtableStatus } from \"../reports/airtable/site-status.js\";\nimport { describeNotifyTarget, type NotifyTarget } from \"../forms/notify.js\";\n\n/** The Airtable column the pre-launch guard actually lives in. */\nexport const STATUS_COLUMN = \"Status\";\n\n/** The two ends of the verify flip. Deliberately the ONLY transition this\n *  performs: a site in any other status is already guarded (or is deliberately\n *  something else, like \"hosted-only\"), and silently rewriting that would be the\n *  same class of unseen change as the incident. */\nexport const LIVE_STATUS: Status = \"maintained\";\nexport const VERIFY_STATUS: Status = \"launching\";\n\nexport type FormsNotifyTargetDeps = {\n  base?: AirtableBase;\n  /** Site slug or the Airtable Websites NAME (both accepted). */\n  site: string;\n  /** `on` routes notifications to the operator; `off` restores. Omit to read. */\n  set?: \"on\" | \"off\";\n  /** Status to restore with `--set off`. Required, never inferred. */\n  restore?: string;\n  /** #539 Phase 5: Turso write-through for the Status cell this flips. Injected\n   *  at the CLI root, never defaulted — the unit suite calls this with a fake\n   *  base and must not open a real libSQL handle. */\n  siteMirror?: SiteMirror;\n};\n\nexport type FormsNotifyTargetResult = {\n  site: string;\n  status: Status | null;\n  target: NotifyTarget;\n  /** Present only when a flip was attempted. `confirmed` is the whole point:\n   *  it comes from RE-READING the row, not from the write call returning. */\n  flip?: { from: Status | null; to: Status; confirmed: boolean };\n};\n\n/**\n * The exact Airtable cell to write for an operator-supplied `--restore` value:\n * the operator's own string, verbatim.\n *\n * This is the ONE non-revertible surface in the #539 Phase 4 stage-1 rename —\n * every other change is code, and `git revert` undoes code. It cannot undo a\n * rewritten Airtable cell. So the rule here is stricter than everywhere else:\n * substitute only when the substitution is provably lossless, i.e. when\n * canonicalizing and mapping back ROUND-TRIPS to the operator's own string.\n *\n * That condition is, today, never false in a way that changes the answer — which\n * is the point. `toAirtableStatus(canonicalizeStatus(raw))` either equals `raw`\n * (so writing it is writing `raw`) or it does not (so we must write `raw`). The\n * function therefore reduces to \"write raw\", and it is written this way so the\n * reduction is visible rather than assumed. The case that made it matter:\n * `--restore legacy` canonicalizes to `archived`, which maps back to\n * \"deprecated\" — a different, real, operator-visible Airtable option that nobody\n * asked for. `hosting` → `hosted-only` → \"hosting\" round-trips and is safe.\n *\n * Airtable, not this module, is the authority on which option strings the\n * \"Status\" single-select accepts. Writing verbatim delegates to it: a typo is\n * rejected loudly at the API, exactly as it was before the rename.\n */\nexport function restoreCell(raw: string): string {\n  const canonical = canonicalizeStatus(raw);\n  if (canonical === null) return raw;\n  const roundTripped = toAirtableStatus(canonical);\n  return roundTripped === raw ? roundTripped : raw;\n}\n\nfunction findSite(rows: WebsiteRow[], site: string): WebsiteRow | undefined {\n  const wanted = site.trim().toLowerCase();\n  return rows.find(\n    (r) => siteSlug(r.name) === siteSlug(site) || r.name.trim().toLowerCase() === wanted,\n  );\n}\n\n/**\n * Answer \"who would a form submission on this site email?\" — and optionally\n * flip the pre-launch guard, confirming the flip by reading it back.\n *\n * The guard is a single Airtable `Status` cell. Nothing between \"I intended to\n * flip it\" and \"the client received a test lead\" reported the current state, so\n * on 2026-08-03 a flip that never landed sent a real client a test submission.\n * The fix is not a better intention, it is feedback: this reads the row back\n * after every write and refuses to call the flip confirmed on anything less.\n */\nexport async function formsNotifyTarget(\n  deps: FormsNotifyTargetDeps,\n): Promise<FormsNotifyTargetResult> {\n  const base = deps.base ?? openBase(readAirtableConfig());\n  const rows = await listWebsites(base);\n  const row = findSite(rows, deps.site);\n  if (!row) {\n    // The Websites NAME is not the repo slug (\"Sonder\", not \"gallerysonder\"),\n    // and that mismatch has cost time before — so name the near misses rather\n    // than making the operator go read Airtable to find the spelling.\n    const needle = siteSlug(deps.site);\n    const near = rows\n      .map((r) => r.name)\n      .filter((n) => siteSlug(n).includes(needle) || needle.includes(siteSlug(n)));\n    throw Object.assign(\n      new Error(\n        `No Websites row matches '${deps.site}'. The Websites NAME is not always the repo ` +\n          `slug (Sonder, not gallerysonder).` +\n          (near.length > 0 ? ` Did you mean: ${near.join(\", \")}?` : \"\"),\n      ),\n      { exitCode: 2 },\n    );\n  }\n\n  if (!deps.set) {\n    return { site: row.name, status: row.status, target: describeNotifyTarget(row) };\n  }\n\n  // `--restore` is operator free text. It is canonicalized for what this command\n  // REPORTS (`flip.to`, and the predicates downstream), but NEVER for what it\n  // WRITES — see `restoreCell` below.\n  const restoreRaw = deps.restore?.trim();\n  const to = deps.set === \"on\" ? VERIFY_STATUS : (canonicalizeStatus(restoreRaw) ?? undefined);\n  if (deps.set === \"off\" && !to) {\n    throw Object.assign(\n      new Error(\n        `--set off needs --restore <status>: the status to return to is never inferred. ` +\n          `Guessing \"${LIVE_STATUS}\" for a site that was \"hosted-only\" or \"archived\" would start ` +\n          `sending real client notifications — the inverse of the failure this command exists ` +\n          `to prevent.`,\n      ),\n      { exitCode: 2 },\n    );\n  }\n  // Only ever flip a LIVE site into verify mode. A site already outside\n  // \"maintained\" is guarded already, and rewriting its status would destroy a\n  // real value nobody asked us to touch.\n  if (deps.set === \"on\" && row.status !== LIVE_STATUS) {\n    throw Object.assign(\n      new Error(\n        `${row.name} is \"${row.status ?? \"blank\"}\", not \"${LIVE_STATUS}\" — notifications ` +\n          `already go to the operator only, so there is nothing to flip. Leaving the status ` +\n          `untouched.`,\n      ),\n      { exitCode: 2 },\n    );\n  }\n\n  // `--set on` writes a status this MODULE owns (VERIFY_STATUS), so mapping it to\n  // the current Airtable vocabulary is correct. `--set off` writes the operator's\n  // own string — see restoreCell.\n  const cell = deps.set === \"on\" ? toAirtableStatus(VERIFY_STATUS) : restoreCell(restoreRaw!);\n  await updateSiteField(base, row.id, STATUS_COLUMN, cell);\n  // Mirror the same cell. The console reads Status from Turso, so without this a\n  // site flipped into verify mode still reads as live for up to an hour — on the\n  // one surface an operator would check to confirm the flip.\n  await deps.siteMirror?.site(row.id, { [STATUS_COLUMN]: cell });\n\n  // Read it back. The write returning is NOT evidence the field changed.\n  const after = findSite(await listWebsites(base), deps.site);\n  if (!after) {\n    throw Object.assign(new Error(`${row.name} vanished from Websites during the flip.`), {\n      exitCode: 1,\n    });\n  }\n  return {\n    site: after.name,\n    status: after.status,\n    target: describeNotifyTarget(after),\n    // `confirmed` compares the RAW cell against the exact string written, not\n    // canonical-to-canonical. Canonical equality is too weak to be a read-back\n    // guard here: `legacy` and `deprecated` are the same canonical status, so a\n    // cell holding either would confirm a flip to the other. Comparing raw is the\n    // only comparison that can actually catch \"the cell is not what I sent\". The\n    // canonical check rides along so a reader that stopped canonicalizing is\n    // caught too.\n    flip: {\n      from: row.status,\n      to: to!,\n      confirmed: after.statusRaw === cell && after.status === to,\n    },\n  };\n}\n","import {\n  formsNotifyTarget,\n  LIVE_STATUS,\n  VERIFY_STATUS,\n  type FormsNotifyTargetResult,\n} from \"../../recipes/forms-notify-target.js\";\n\nexport type FormsNotifyTargetCommandOptions = {\n  set?: string;\n  restore?: string;\n  cwd?: string;\n};\n\nconst AUDIENCE_LABEL = {\n  client: \"THE CLIENT\",\n  operator: \"OPERATOR ONLY\",\n  nobody: \"NOBODY\",\n} as const;\n\n/** The line that decides whether it is safe to test-submit. Deliberately the\n *  loudest thing on screen: the incident happened because the answer was\n *  invisible, not because it was subtle. */\nexport function formatNotifyTarget(r: FormsNotifyTargetResult): string {\n  const lines: string[] = [];\n  if (r.flip) {\n    const arrow = `${r.flip.from ?? \"blank\"} → ${r.flip.to}`;\n    lines.push(\n      r.flip.confirmed\n        ? `${r.site}  Status: ${arrow}  ✓ confirmed by read-back`\n        : `${r.site}  Status: ${arrow}  ✗ NOT CONFIRMED — the row still reads \"${r.status ?? \"blank\"}\". Nothing was verified; do not test-submit.`,\n    );\n  } else {\n    lines.push(`${r.site}  Status: ${r.status ?? \"blank\"}`);\n  }\n\n  lines.push(`A submission right now would notify: ${AUDIENCE_LABEL[r.target.audience]}`);\n  if (r.target.to.length > 0) lines.push(`  to: ${r.target.to.join(\", \")}`);\n  if (r.target.cc.length > 0) lines.push(`  cc: ${r.target.cc.join(\", \")}`);\n  lines.push(`  ${r.target.reason}`);\n\n  if (r.target.audience === \"client\") {\n    lines.push(\n      \"\",\n      `⚠️  A test submission WILL email the client, and email cannot be recalled.`,\n      `   Route it to yourself first:  reddoor forms-notify-target ${r.site} --set on`,\n    );\n  }\n  if (r.flip?.confirmed && r.flip.to === VERIFY_STATUS) {\n    lines.push(\n      \"\",\n      `Safe to test. When you are done, restore it:`,\n      `  reddoor forms-notify-target ${r.site} --set off --restore ${r.flip.from ?? LIVE_STATUS}`,\n    );\n  }\n  return lines.join(\"\\n\");\n}\n\n/**\n * `forms-notify-target <site>` — show who a form submission would email, and\n * optionally flip the pre-launch guard with a read-back confirmation.\n *\n * Read-only by default: answering the question must never be riskier than not\n * asking it.\n */\nexport async function runFormsNotifyTargetCommand(\n  site: string | undefined,\n  opts: FormsNotifyTargetCommandOptions,\n): Promise<{ output: string; code: number }> {\n  if (!site?.trim()) {\n    return { output: \"forms-notify-target requires <site> (slug or Airtable name)\", code: 2 };\n  }\n  const set = opts.set?.trim().toLowerCase();\n  if (set !== undefined && set !== \"on\" && set !== \"off\") {\n    return { output: `--set must be 'on' or 'off' (got '${opts.set}')`, code: 2 };\n  }\n  try {\n    // #539 Phase 5: the flip writes Status on the Websites row; mirror it so the\n    // console (which reads Turso) shows the new routing immediately.\n    const { makeSiteMirror } = await import(\"../../db/site-mirror.js\");\n    const result = await formsNotifyTarget({\n      siteMirror: await makeSiteMirror(),\n      site: site.trim(),\n      ...(set ? { set: set as \"on\" | \"off\" } : {}),\n      ...(opts.restore ? { restore: opts.restore } : {}),\n    });\n    // An unconfirmed flip must not exit 0: a script (or a person skimming) that\n    // reads exit status would otherwise take \"I flipped it\" on faith, which is\n    // exactly the assumption that sent a client a test lead.\n    return {\n      output: formatNotifyTarget(result),\n      code: result.flip && !result.flip.confirmed ? 1 : 0,\n    };\n  } catch (err) {\n    const e = err as { message?: string; exitCode?: number };\n    return { output: e.message ?? String(err), code: e.exitCode ?? 1 };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAcO,IAAM,gBAAgB;AAMtB,IAAM,cAAsB;AAC5B,IAAM,gBAAwB;AAgD9B,SAAS,YAAY,KAAqB;AAC/C,QAAM,YAAY,mBAAmB,GAAG;AACxC,MAAI,cAAc,KAAM,QAAO;AAC/B,QAAM,eAAe,iBAAiB,SAAS;AAC/C,SAAO,iBAAiB,MAAM,eAAe;AAC/C;AAEA,SAAS,SAAS,MAAoB,MAAsC;AAC1E,QAAM,SAAS,KAAK,KAAK,EAAE,YAAY;AACvC,SAAO,KAAK;AAAA,IACV,CAAC,MAAM,SAAS,EAAE,IAAI,MAAM,SAAS,IAAI,KAAK,EAAE,KAAK,KAAK,EAAE,YAAY,MAAM;AAAA,EAChF;AACF;AAYA,eAAsB,kBACpB,MACkC;AAClC,QAAM,OAAO,KAAK,QAAQ,SAAS,mBAAmB,CAAC;AACvD,QAAM,OAAO,MAAM,aAAa,IAAI;AACpC,QAAM,MAAM,SAAS,MAAM,KAAK,IAAI;AACpC,MAAI,CAAC,KAAK;AAIR,UAAM,SAAS,SAAS,KAAK,IAAI;AACjC,UAAM,OAAO,KACV,IAAI,CAAC,MAAM,EAAE,IAAI,EACjB,OAAO,CAAC,MAAM,SAAS,CAAC,EAAE,SAAS,MAAM,KAAK,OAAO,SAAS,SAAS,CAAC,CAAC,CAAC;AAC7E,UAAM,OAAO;AAAA,MACX,IAAI;AAAA,QACF,4BAA4B,KAAK,IAAI,mFAElC,KAAK,SAAS,IAAI,kBAAkB,KAAK,KAAK,IAAI,CAAC,MAAM;AAAA,MAC9D;AAAA,MACA,EAAE,UAAU,EAAE;AAAA,IAChB;AAAA,EACF;AAEA,MAAI,CAAC,KAAK,KAAK;AACb,WAAO,EAAE,MAAM,IAAI,MAAM,QAAQ,IAAI,QAAQ,QAAQ,qBAAqB,GAAG,EAAE;AAAA,EACjF;AAKA,QAAM,aAAa,KAAK,SAAS,KAAK;AACtC,QAAM,KAAK,KAAK,QAAQ,OAAO,gBAAiB,mBAAmB,UAAU,KAAK;AAClF,MAAI,KAAK,QAAQ,SAAS,CAAC,IAAI;AAC7B,UAAM,OAAO;AAAA,MACX,IAAI;AAAA,QACF,4FACe,WAAW;AAAA,MAG5B;AAAA,MACA,EAAE,UAAU,EAAE;AAAA,IAChB;AAAA,EACF;AAIA,MAAI,KAAK,QAAQ,QAAQ,IAAI,WAAW,aAAa;AACnD,UAAM,OAAO;AAAA,MACX,IAAI;AAAA,QACF,GAAG,IAAI,IAAI,QAAQ,IAAI,UAAU,OAAO,WAAW,WAAW;AAAA,MAGhE;AAAA,MACA,EAAE,UAAU,EAAE;AAAA,IAChB;AAAA,EACF;AAKA,QAAM,OAAO,KAAK,QAAQ,OAAO,iBAAiB,aAAa,IAAI,YAAY,UAAW;AAC1F,QAAM,gBAAgB,MAAM,IAAI,IAAI,eAAe,IAAI;AAIvD,QAAM,KAAK,YAAY,KAAK,IAAI,IAAI,EAAE,CAAC,aAAa,GAAG,KAAK,CAAC;AAG7D,QAAM,QAAQ,SAAS,MAAM,aAAa,IAAI,GAAG,KAAK,IAAI;AAC1D,MAAI,CAAC,OAAO;AACV,UAAM,OAAO,OAAO,IAAI,MAAM,GAAG,IAAI,IAAI,0CAA0C,GAAG;AAAA,MACpF,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AACA,SAAO;AAAA,IACL,MAAM,MAAM;AAAA,IACZ,QAAQ,MAAM;AAAA,IACd,QAAQ,qBAAqB,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQlC,MAAM;AAAA,MACJ,MAAM,IAAI;AAAA,MACV;AAAA,MACA,WAAW,MAAM,cAAc,QAAQ,MAAM,WAAW;AAAA,IAC1D;AAAA,EACF;AACF;;;AC5KA,IAAM,iBAAiB;AAAA,EACrB,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,QAAQ;AACV;AAKO,SAAS,mBAAmB,GAAoC;AACrE,QAAM,QAAkB,CAAC;AACzB,MAAI,EAAE,MAAM;AACV,UAAM,QAAQ,GAAG,EAAE,KAAK,QAAQ,OAAO,WAAM,EAAE,KAAK,EAAE;AACtD,UAAM;AAAA,MACJ,EAAE,KAAK,YACH,GAAG,EAAE,IAAI,aAAa,KAAK,oCAC3B,GAAG,EAAE,IAAI,aAAa,KAAK,sDAA4C,EAAE,UAAU,OAAO;AAAA,IAChG;AAAA,EACF,OAAO;AACL,UAAM,KAAK,GAAG,EAAE,IAAI,aAAa,EAAE,UAAU,OAAO,EAAE;AAAA,EACxD;AAEA,QAAM,KAAK,wCAAwC,eAAe,EAAE,OAAO,QAAQ,CAAC,EAAE;AACtF,MAAI,EAAE,OAAO,GAAG,SAAS,EAAG,OAAM,KAAK,SAAS,EAAE,OAAO,GAAG,KAAK,IAAI,CAAC,EAAE;AACxE,MAAI,EAAE,OAAO,GAAG,SAAS,EAAG,OAAM,KAAK,SAAS,EAAE,OAAO,GAAG,KAAK,IAAI,CAAC,EAAE;AACxE,QAAM,KAAK,KAAK,EAAE,OAAO,MAAM,EAAE;AAEjC,MAAI,EAAE,OAAO,aAAa,UAAU;AAClC,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA,+DAA+D,EAAE,IAAI;AAAA,IACvE;AAAA,EACF;AACA,MAAI,EAAE,MAAM,aAAa,EAAE,KAAK,OAAO,eAAe;AACpD,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA,iCAAiC,EAAE,IAAI,wBAAwB,EAAE,KAAK,QAAQ,WAAW;AAAA,IAC3F;AAAA,EACF;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;AASA,eAAsB,4BACpB,MACA,MAC2C;AAC3C,MAAI,CAAC,MAAM,KAAK,GAAG;AACjB,WAAO,EAAE,QAAQ,+DAA+D,MAAM,EAAE;AAAA,EAC1F;AACA,QAAM,MAAM,KAAK,KAAK,KAAK,EAAE,YAAY;AACzC,MAAI,QAAQ,UAAa,QAAQ,QAAQ,QAAQ,OAAO;AACtD,WAAO,EAAE,QAAQ,qCAAqC,KAAK,GAAG,MAAM,MAAM,EAAE;AAAA,EAC9E;AACA,MAAI;AAGF,UAAM,EAAE,eAAe,IAAI,MAAM,OAAO,2BAAyB;AACjE,UAAM,SAAS,MAAM,kBAAkB;AAAA,MACrC,YAAY,MAAM,eAAe;AAAA,MACjC,MAAM,KAAK,KAAK;AAAA,MAChB,GAAI,MAAM,EAAE,IAAyB,IAAI,CAAC;AAAA,MAC1C,GAAI,KAAK,UAAU,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,IAClD,CAAC;AAID,WAAO;AAAA,MACL,QAAQ,mBAAmB,MAAM;AAAA,MACjC,MAAM,OAAO,QAAQ,CAAC,OAAO,KAAK,YAAY,IAAI;AAAA,IACpD;AAAA,EACF,SAAS,KAAK;AACZ,UAAM,IAAI;AACV,WAAO,EAAE,QAAQ,EAAE,WAAW,OAAO,GAAG,GAAG,MAAM,EAAE,YAAY,EAAE;AAAA,EACnE;AACF;","names":[]}

package/dist/{github-signals-IJUPGCUX.js → github-signals-E2WPYTBK.js}

@@ -3,8 +3,8 @@ import {
 } from "./chunk-PZQ3WED2.js";
 import {
   formatFleetWriteSummary
-} from "./chunk-PPE5KZJK.js";
-import "./chunk-KTH5ZODA.js";
+} from "./chunk-NXNPDCF3.js";
+import "./chunk-7BZUOZPU.js";
 import {
   detectSignalEvents,
   fleetSweptEvent
@@ -13,6 +13,11 @@ import {
   openBase,
   readAirtableConfig
 } from "./chunk-HN6I2XWI.js";
+import {
+  listWebsites,
+  siteSlug,
+  updateGitHubSignals
+} from "./chunk-7NYN2P6I.js";
 import {
   makeGitHub
 } from "./chunk-XHHMM5HX.js";
@@ -22,11 +27,6 @@ import {
 import "./chunk-JHGHLKFS.js";
 import "./chunk-3SF7D4DY.js";
 import "./chunk-LBYOLBW7.js";
-import {
-  listWebsites,
-  siteSlug,
-  updateGitHubSignals
-} from "./chunk-LDWZSLSU.js";
 import "./chunk-6VAL7XJT.js";
 
 // src/audits/github-signals.ts
@@ -90,7 +90,7 @@ async function runGitHubSignalsCommand(opts, deps = {}) {
   );
   const sweptAt = (/* @__PURE__ */ new Date()).toISOString();
   const makeMirror = deps.makeMirror ?? (async () => {
-    const { makeHealthMirrorBestEffort } = await import("./health-mirror-4B2L7T2Y.js");
+    const { makeHealthMirrorBestEffort } = await import("./health-mirror-L5JBEJVA.js");
     return makeHealthMirrorBestEffort();
   });
   const mirror = await makeMirror();
@@ -155,4 +155,4 @@ export {
   githubSignalsExitCode,
   runGitHubSignalsCommand
 };
-//# sourceMappingURL=github-signals-IJUPGCUX.js.map
+//# sourceMappingURL=github-signals-E2WPYTBK.js.map

package/dist/{header-image-AWLLQA4L.js → header-image-6IC53W27.js}

@@ -1,18 +1,18 @@
-import {
-  generateHeaderImage
-} from "./chunk-5UINJNAJ.js";
 import {
   uploadAttachment
-} from "./chunk-Z7AXYKQB.js";
+} from "./chunk-IY6256GK.js";
 import {
   openBase,
   readAirtableConfig
 } from "./chunk-HN6I2XWI.js";
+import {
+  generateHeaderImage
+} from "./chunk-5UINJNAJ.js";
 import {
   ACTIVE_STATUSES,
   listWebsites,
   siteSlug
-} from "./chunk-LDWZSLSU.js";
+} from "./chunk-7NYN2P6I.js";
 import "./chunk-6VAL7XJT.js";
 
 // src/cli/commands/header-image.ts
@@ -103,7 +103,7 @@ async function runHeaderImageCommand(site, opts) {
   let withStore = opts;
   if (opts.writeAirtable && !opts.storeDb && process.env.TURSO_DATABASE_URL) {
     const { openDb, readDbConfig } = await import("./client-AUE3XUPO.js");
-    const { storeHeaderImage } = await import("./header-images-335L2AKB.js");
+    const { storeHeaderImage } = await import("./header-images-SQBCE5OD.js");
     const db = await openDb(readDbConfig());
     withStore = { ...opts, storeDb: (id, img) => storeHeaderImage(db, id, img) };
   }
@@ -115,4 +115,4 @@ export {
   resolveTargets,
   runHeaderImageCommand
 };
-//# sourceMappingURL=header-image-AWLLQA4L.js.map
+//# sourceMappingURL=header-image-6IC53W27.js.map

package/dist/{header-images-335L2AKB.js → header-images-SQBCE5OD.js}

@@ -7,6 +7,25 @@ async function storeHeaderImage(db, siteId, image) {
     header_image_generated_at: image.generatedAt
   }).where("id", "=", siteId).execute();
 }
+async function loadHeaderImage(db, siteId) {
+  const row = await db.selectFrom("sites").select([
+    "header_image",
+    "header_image_filename",
+    "header_image_type",
+    "header_image_generated_at"
+  ]).where("id", "=", siteId).executeTakeFirst();
+  if (!row) return null;
+  const raw = row.header_image;
+  if (raw === null || raw === void 0) return null;
+  const bytes = new Uint8Array(raw);
+  if (bytes.length === 0) return null;
+  return {
+    bytes,
+    filename: row.header_image_filename ?? "header-image",
+    contentType: row.header_image_type ?? "application/octet-stream",
+    generatedAt: row.header_image_generated_at ?? null
+  };
+}
 function headerImageAttachment(rec) {
   const atts = rec.fields["Header image"];
   const a = atts?.at(-1);
@@ -63,6 +82,7 @@ export {
   backfillHeaderImages,
   formatBackfillResult,
   headerImageAttachment,
+  loadHeaderImage,
   storeHeaderImage
 };
-//# sourceMappingURL=header-images-335L2AKB.js.map
+//# sourceMappingURL=header-images-SQBCE5OD.js.map

package/dist/header-images-SQBCE5OD.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/db/header-images.ts"],"sourcesContent":["/** Header images move to Turso (#539, design D5 completed).\n *\n *  Since Phase 1 the schema has reserved `sites.header_image*` as the image's\n *  home — the importer deliberately never touches those columns — but nothing\n *  wrote them, so the read layer's `headerImage` was null fleet-wide and both\n *  cockpit preflight and approve-report stayed pinned to the Airtable reader.\n *  Two writers and one reader close that:\n *\n *  - `storeHeaderImage` — the shared write, used by the header-image CLI's\n *    dual-write (Airtable upload + Turso store, until Phase 5 freezes Airtable)\n *    and by the backfill.\n *  - `loadHeaderImage` — the reader. Until it existed the bytes went in and could\n *    not come out, so every consumer still fetched Airtable's signed URL.\n *  - `backfillHeaderImages` — one-shot: copy every site's CURRENT Airtable\n *    attachment into Turso. Idempotent — a site whose BLOB is already\n *    populated is skipped, so re-runs never clobber a freshly generated image\n *    with a stale Airtable copy. Emits its machine line on EVERY run.\n */\nimport type { Db } from \"./client.js\";\nimport type { RawRecord } from \"./import-airtable.js\";\n\nexport type StoredHeaderImage = {\n  bytes: Uint8Array;\n  filename: string;\n  contentType: string;\n  /** The generator's stamp; null for a backfilled copy (a backfill is not a\n   *  generation — the column keeps meaning \"when the generator made it\"). */\n  generatedAt: string | null;\n};\n\nexport async function storeHeaderImage(\n  db: Db,\n  siteId: string,\n  image: StoredHeaderImage,\n): Promise<void> {\n  await db\n    .updateTable(\"sites\")\n    .set({\n      header_image: image.bytes,\n      header_image_filename: image.filename,\n      header_image_type: image.contentType,\n      header_image_generated_at: image.generatedAt,\n    })\n    .where(\"id\", \"=\", siteId)\n    .execute();\n}\n\n/**\n * Read one site's stored header image back.\n *\n * A SEPARATE query from the site read, deliberately. `getSiteBySlug` excludes\n * the BLOB on purpose — it is 0.6–0.8 MB per site in production, so a selectAll\n * would haul megabytes into every dashboard GET and every form ingest — which\n * means reading the bytes has to be an explicit, per-site act rather than a\n * field that arrives for free.\n *\n * Null when the site has no image, when the id is unknown, and when the\n * metadata is present but the BLOB is not: handing a consumer an empty buffer\n * with a filename would render a report with a broken header instead of failing\n * loudly with \"no header image\".\n */\nexport async function loadHeaderImage(db: Db, siteId: string): Promise<StoredHeaderImage | null> {\n  const row = await db\n    .selectFrom(\"sites\")\n    .select([\n      \"header_image\",\n      \"header_image_filename\",\n      \"header_image_type\",\n      \"header_image_generated_at\",\n    ])\n    .where(\"id\", \"=\", siteId)\n    .executeTakeFirst();\n  if (!row) return null;\n  // Normalize BEFORE measuring. libSQL can hand the BLOB back as an ArrayBuffer\n  // rather than a Uint8Array, and an ArrayBuffer has `byteLength`, not `length` —\n  // so a naive `bytes.length === 0` compares `undefined` to 0, passes, and lets a\n  // zero-length image through as if it were real. Mutation-testing the null check\n  // is what exposed that; the guard did not do what its own name said.\n  const raw = row.header_image;\n  if (raw === null || raw === undefined) return null;\n  // `raw` is a Uint8Array on some drivers and an ArrayBuffer on others; the\n  // Uint8Array constructor accepts either, but the two do not share a TS type.\n  const bytes = new Uint8Array(raw as unknown as ArrayBufferLike);\n  if (bytes.length === 0) return null;\n\n  return {\n    bytes,\n    filename: row.header_image_filename ?? \"header-image\",\n    contentType: row.header_image_type ?? \"application/octet-stream\",\n    generatedAt: row.header_image_generated_at ?? null,\n  };\n}\n\ntype Attachment = { url: string; filename: string; type: string };\n\n/** NEWEST \"Header image\" attachment of a raw Websites record, or null.\n *\n *  The tail, not the head: Airtable's uploadAttachment APPENDS, so a field that ever\n *  held more than one file served its OLDEST image from `[0]` forever — see the note\n *  in `reports/airtable/websites.ts` and #574/#577. Kept in step with that reader so\n *  the Turso mirror and the send path can never disagree about which file is current. */\nexport function headerImageAttachment(rec: RawRecord): Attachment | null {\n  const atts = rec.fields[\"Header image\"] as Array<Partial<Attachment>> | undefined;\n  const a = atts?.at(-1);\n  return a && typeof a.url === \"string\" && a.url.length > 0\n    ? {\n        url: a.url,\n        filename: typeof a.filename === \"string\" ? a.filename : \"header-image\",\n        type: typeof a.type === \"string\" ? a.type : \"application/octet-stream\",\n      }\n    : null;\n}\n\nexport type BackfillIo = {\n  listWebsiteRecords: () => Promise<RawRecord[]>;\n  /** Fetch attachment bytes; null on failure (named in the summary, not fatal). */\n  fetchBytes: (url: string) => Promise<Uint8Array | null>;\n};\n\nexport type BackfillResult = {\n  stored: number;\n  /** Sites whose BLOB was already populated — never overwritten. */\n  skipped: number;\n  /** Sites with no Airtable attachment at all. */\n  absent: number;\n  /** Record ids whose attachment fetch failed — named, never silent. */\n  failed: string[];\n};\n\nexport async function backfillHeaderImages(db: Db, io: BackfillIo): Promise<BackfillResult> {\n  const records = await io.listWebsiteRecords();\n  const populated = new Set(\n    (await db.selectFrom(\"sites\").select(\"id\").where(\"header_image\", \"is not\", null).execute()).map(\n      (r) => r.id,\n    ),\n  );\n  const result: BackfillResult = { stored: 0, skipped: 0, absent: 0, failed: [] };\n  for (const rec of records) {\n    const att = headerImageAttachment(rec);\n    if (!att) {\n      result.absent++;\n      continue;\n    }\n    if (populated.has(rec.id)) {\n      result.skipped++;\n      continue;\n    }\n    const bytes = await io.fetchBytes(att.url);\n    if (bytes === null) {\n      result.failed.push(rec.id);\n      continue;\n    }\n    await storeHeaderImage(db, rec.id, {\n      bytes,\n      filename: att.filename,\n      contentType: att.type,\n      generatedAt: null,\n    });\n    result.stored++;\n  }\n  return result;\n}\n\n/** Human lines + the machine line, emitted on every run (count=0 included). */\nexport function formatBackfillResult(r: BackfillResult): string {\n  const lines: string[] = [];\n  if (r.failed.length > 0) {\n    lines.push(`⚠ ${r.failed.length} attachment fetch(es) failed: ${r.failed.join(\", \")}`);\n  }\n  lines.push(\n    `HEADER_IMAGE_BACKFILL stored=${r.stored} skipped=${r.skipped} absent=${r.absent} failed=${r.failed.length}`,\n  );\n  return lines.join(\"\\n\");\n}\n"],"mappings":";AA8BA,eAAsB,iBACpB,IACA,QACA,OACe;AACf,QAAM,GACH,YAAY,OAAO,EACnB,IAAI;AAAA,IACH,cAAc,MAAM;AAAA,IACpB,uBAAuB,MAAM;AAAA,IAC7B,mBAAmB,MAAM;AAAA,IACzB,2BAA2B,MAAM;AAAA,EACnC,CAAC,EACA,MAAM,MAAM,KAAK,MAAM,EACvB,QAAQ;AACb;AAgBA,eAAsB,gBAAgB,IAAQ,QAAmD;AAC/F,QAAM,MAAM,MAAM,GACf,WAAW,OAAO,EAClB,OAAO;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC,EACA,MAAM,MAAM,KAAK,MAAM,EACvB,iBAAiB;AACpB,MAAI,CAAC,IAAK,QAAO;AAMjB,QAAM,MAAM,IAAI;AAChB,MAAI,QAAQ,QAAQ,QAAQ,OAAW,QAAO;AAG9C,QAAM,QAAQ,IAAI,WAAW,GAAiC;AAC9D,MAAI,MAAM,WAAW,EAAG,QAAO;AAE/B,SAAO;AAAA,IACL;AAAA,IACA,UAAU,IAAI,yBAAyB;AAAA,IACvC,aAAa,IAAI,qBAAqB;AAAA,IACtC,aAAa,IAAI,6BAA6B;AAAA,EAChD;AACF;AAUO,SAAS,sBAAsB,KAAmC;AACvE,QAAM,OAAO,IAAI,OAAO,cAAc;AACtC,QAAM,IAAI,MAAM,GAAG,EAAE;AACrB,SAAO,KAAK,OAAO,EAAE,QAAQ,YAAY,EAAE,IAAI,SAAS,IACpD;AAAA,IACE,KAAK,EAAE;AAAA,IACP,UAAU,OAAO,EAAE,aAAa,WAAW,EAAE,WAAW;AAAA,IACxD,MAAM,OAAO,EAAE,SAAS,WAAW,EAAE,OAAO;AAAA,EAC9C,IACA;AACN;AAkBA,eAAsB,qBAAqB,IAAQ,IAAyC;AAC1F,QAAM,UAAU,MAAM,GAAG,mBAAmB;AAC5C,QAAM,YAAY,IAAI;AAAA,KACnB,MAAM,GAAG,WAAW,OAAO,EAAE,OAAO,IAAI,EAAE,MAAM,gBAAgB,UAAU,IAAI,EAAE,QAAQ,GAAG;AAAA,MAC1F,CAAC,MAAM,EAAE;AAAA,IACX;AAAA,EACF;AACA,QAAM,SAAyB,EAAE,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC,EAAE;AAC9E,aAAW,OAAO,SAAS;AACzB,UAAM,MAAM,sBAAsB,GAAG;AACrC,QAAI,CAAC,KAAK;AACR,aAAO;AACP;AAAA,IACF;AACA,QAAI,UAAU,IAAI,IAAI,EAAE,GAAG;AACzB,aAAO;AACP;AAAA,IACF;AACA,UAAM,QAAQ,MAAM,GAAG,WAAW,IAAI,GAAG;AACzC,QAAI,UAAU,MAAM;AAClB,aAAO,OAAO,KAAK,IAAI,EAAE;AACzB;AAAA,IACF;AACA,UAAM,iBAAiB,IAAI,IAAI,IAAI;AAAA,MACjC;AAAA,MACA,UAAU,IAAI;AAAA,MACd,aAAa,IAAI;AAAA,MACjB,aAAa;AAAA,IACf,CAAC;AACD,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAGO,SAAS,qBAAqB,GAA2B;AAC9D,QAAM,QAAkB,CAAC;AACzB,MAAI,EAAE,OAAO,SAAS,GAAG;AACvB,UAAM,KAAK,UAAK,EAAE,OAAO,MAAM,iCAAiC,EAAE,OAAO,KAAK,IAAI,CAAC,EAAE;AAAA,EACvF;AACA,QAAM;AAAA,IACJ,gCAAgC,EAAE,MAAM,YAAY,EAAE,OAAO,WAAW,EAAE,MAAM,WAAW,EAAE,OAAO,MAAM;AAAA,EAC5G;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;","names":[]}

package/dist/{health-endpoint-WJC2UMYS.js → health-endpoint-RFXL2F4A.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-TVL5MVUF.js";
 import {
   resolveSites
-} from "./chunk-P2FE5AI6.js";
+} from "./chunk-CROKUHJB.js";
 import {
   healthEndpoint
 } from "./chunk-BQRFQSGY.js";
@@ -51,4 +51,4 @@ async function runHealthEndpointCommand(site, opts) {
 export {
   runHealthEndpointCommand
 };
-//# sourceMappingURL=health-endpoint-WJC2UMYS.js.map
+//# sourceMappingURL=health-endpoint-RFXL2F4A.js.map

package/dist/health-mirror-L5JBEJVA.js

@@ -0,0 +1,41 @@
+import {
+  mirrorHealthFields,
+  mirrorScheduleFields
+} from "./chunk-HHMMUR4P.js";
+import "./chunk-P6AORG32.js";
+import "./chunk-F3JWOPTG.js";
+import "./chunk-VAD43MOR.js";
+import "./chunk-7NYN2P6I.js";
+import {
+  openDb,
+  readDbConfig
+} from "./chunk-JHGHLKFS.js";
+import "./chunk-3SF7D4DY.js";
+import "./chunk-6VAL7XJT.js";
+
+// src/audits/health-mirror.ts
+async function makeHealthMirrorBestEffort(open = () => openDb(readDbConfig())) {
+  let db;
+  try {
+    db = await open();
+  } catch (e) {
+    console.error(`[health-mirror] mirroring disabled: no libSQL (${String(e)})`);
+    return null;
+  }
+  return (siteId, fields) => mirrorHealthFields(db, siteId, fields);
+}
+async function makeScheduleMirrorBestEffort(open = () => openDb(readDbConfig())) {
+  let db;
+  try {
+    db = await open();
+  } catch (e) {
+    console.error(`[schedule-mirror] mirroring disabled: no libSQL (${String(e)})`);
+    return null;
+  }
+  return (siteId, fields, computedAt) => mirrorScheduleFields(db, siteId, fields, computedAt);
+}
+export {
+  makeHealthMirrorBestEffort,
+  makeScheduleMirrorBestEffort
+};
+//# sourceMappingURL=health-mirror-L5JBEJVA.js.map

package/dist/health-mirror-L5JBEJVA.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/audits/health-mirror.ts"],"sourcesContent":["import { openDb, readDbConfig, type Db } from \"../db/client.js\";\nimport { mirrorHealthFields, mirrorScheduleFields } from \"../db/fleet-state.js\";\n\n/** One site's just-written Airtable FieldSet, mirrored into site_health.\n *  Resolves true when a site_health row matched; false when the UPDATE touched\n *  0 rows (site created in Airtable after the last hourly import) — callers\n *  count that as mirror_missed, never as mirrored. */\nexport type HealthMirror = (siteId: string, fields: Record<string, unknown>) => Promise<boolean>;\n\n/** The site_schedule twin, for the nightly next-due write-back. Same\n *  matched-row contract as {@link HealthMirror}: false = 0-row UPDATE →\n *  mirror_missed. */\nexport type ScheduleMirror = (\n  siteId: string,\n  fields: Record<string, unknown>,\n  computedAt: string,\n) => Promise<boolean>;\n\n/** Build the Turso write-through for the nightly writers (#539 Phase 3\n *  dual-write), or null when libSQL creds are absent — mirroring NOT attempted\n *  is a different outcome than mirroring failed, and the caller's summary line\n *  reports mirror counts only when a mirror existed. Same contract as\n *  recordFleetEventsBestEffort: the mirror must never fail the sweep that\n *  produced the data (per-site failures are the caller's to count; Airtable\n *  stays authoritative and the hourly sync converges whatever the mirror\n *  missed). `open` is injectable for tests. */\nexport async function makeHealthMirrorBestEffort(\n  open: () => Promise<Db> = () => openDb(readDbConfig()),\n): Promise<HealthMirror | null> {\n  let db: Db;\n  try {\n    db = await open();\n  } catch (e) {\n    console.error(`[health-mirror] mirroring disabled: no libSQL (${String(e)})`);\n    return null;\n  }\n  return (siteId, fields) => mirrorHealthFields(db, siteId, fields);\n}\n\n/** {@link makeHealthMirrorBestEffort}'s schedule twin — same null-without-creds\n *  contract, for `writeNextDueDates`' site_schedule write-through. */\nexport async function makeScheduleMirrorBestEffort(\n  open: () => Promise<Db> = () => openDb(readDbConfig()),\n): Promise<ScheduleMirror | null> {\n  let db: Db;\n  try {\n    db = await open();\n  } catch (e) {\n    console.error(`[schedule-mirror] mirroring disabled: no libSQL (${String(e)})`);\n    return null;\n  }\n  return (siteId, fields, computedAt) => mirrorScheduleFields(db, siteId, fields, computedAt);\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA0BA,eAAsB,2BACpB,OAA0B,MAAM,OAAO,aAAa,CAAC,GACvB;AAC9B,MAAI;AACJ,MAAI;AACF,SAAK,MAAM,KAAK;AAAA,EAClB,SAAS,GAAG;AACV,YAAQ,MAAM,kDAAkD,OAAO,CAAC,CAAC,GAAG;AAC5E,WAAO;AAAA,EACT;AACA,SAAO,CAAC,QAAQ,WAAW,mBAAmB,IAAI,QAAQ,MAAM;AAClE;AAIA,eAAsB,6BACpB,OAA0B,MAAM,OAAO,aAAa,CAAC,GACrB;AAChC,MAAI;AACJ,MAAI;AACF,SAAK,MAAM,KAAK;AAAA,EAClB,SAAS,GAAG;AACV,YAAQ,MAAM,oDAAoD,OAAO,CAAC,CAAC,GAAG;AAC9E,WAAO;AAAA,EACT;AACA,SAAO,CAAC,QAAQ,QAAQ,eAAe,qBAAqB,IAAI,QAAQ,QAAQ,UAAU;AAC5F;","names":[]}

package/dist/{import-airtable-HE43FB4H.js → import-airtable-OHVY344G.js}

@@ -12,10 +12,11 @@ import {
   reapAllowance,
   reapRefusal,
   renderedHtmlUrl,
-  scheduleColumnFor
-} from "./chunk-ITIOFN7A.js";
+  scheduleColumnFor,
+  siteValueFor
+} from "./chunk-P6AORG32.js";
 import "./chunk-VAD43MOR.js";
-import "./chunk-LDWZSLSU.js";
+import "./chunk-7NYN2P6I.js";
 export {
   EXCLUDED_WEBSITE_FIELDS,
   HEALTH_BOOLEAN,
@@ -30,6 +31,7 @@ export {
   reapAllowance,
   reapRefusal,
   renderedHtmlUrl,
-  scheduleColumnFor
+  scheduleColumnFor,
+  siteValueFor
 };
-//# sourceMappingURL=import-airtable-HE43FB4H.js.map
+//# sourceMappingURL=import-airtable-OHVY344G.js.map

package/dist/index.d.ts

@@ -952,6 +952,135 @@ type ReportRow = {
     overrideBy: string | null;
     overrideAt: string | null;
 };
+/** Called with the record Airtable echoed back from the create, before it is
+ *  mapped (#539 Phase 5). Structurally typed rather than importing the db
+ *  layer's `RawRecord`, so this module stays the leaf it has always been. */
+type CreatedDraftMirror = (rec: {
+    id: string;
+    fields: Record<string, unknown>;
+}) => Promise<void>;
+
+/** Report rows (migration 0007). PK = Airtable rec id. `checklist` is JSON
+ *  keyed by the STABLE checklist key (src/reports/checklist.ts), not the
+ *  Airtable column name; `rendered_html` is the downloaded attachment body. */
+interface ReportsTable {
+    id: string;
+    site_id: string | null;
+    report_id: string | null;
+    report_type: string | null;
+    period: string | null;
+    period_start: string | null;
+    period_end: string | null;
+    completed_on: string | null;
+    lighthouse_performance: number | null;
+    lighthouse_accessibility: number | null;
+    lighthouse_best_practices: number | null;
+    lighthouse_seo: number | null;
+    ga_users_current: number | null;
+    ga_users_previous: number | null;
+    search_found_page1: number | null;
+    search_position: number | null;
+    last_tested_date: string | null;
+    commentary: string | null;
+    subject_override: string | null;
+    draft_ready: number;
+    approved_to_send: number;
+    approved_at: string | null;
+    approved_by: string | null;
+    send_override: number;
+    override_reason: string | null;
+    override_by: string | null;
+    override_at: string | null;
+    sent_at: string | null;
+    delivery_status: string | null;
+    resend_message_id: string | null;
+    checklist: string | null;
+    checklist_auto_evidence: string | null;
+    rendered_html: string | null;
+}
+
+/** Columns a report writer mirrors after its Airtable write (same pattern as
+ *  mirrorSiteField): the approve/override flow, the resend-webhook's delivery
+ *  status, and — since #539 Phase 5 — the drafting path's queue flag and a
+ *  re-run's refreshed scores.
+ *
+ *  `rendered_html` stays deliberately OUT even though the drafting path now
+ *  writes it: bodies go through `storeRenderedHtml`, so a request handler
+ *  holding a patch cannot accidentally write megabytes of HTML. `sent_at` and
+ *  `resend_message_id` stay out because nothing but the send batch writes them
+ *  and the hourly sync converges those. */
+type ReportMirrorPatch = Partial<Pick<ReportsTable, "approved_to_send" | "approved_at" | "approved_by" | "send_override" | "override_reason" | "override_by" | "override_at" | "delivery_status" | "commentary" | "draft_ready" | "lighthouse_performance" | "lighthouse_accessibility" | "lighthouse_best_practices" | "lighthouse_seo" | "ga_users_current" | "ga_users_previous" | "search_found_page1" | "search_position" | "completed_on">>;
+
+/** #539 Phase 5: the Turso write-through for the Reports write surface.
+ *
+ *  Before this, the only report mirrors were UPDATEs on the request path
+ *  (approve, override, delivery status, commentary). Everything the DRAFTING
+ *  path writes — the row itself, the rendered body, the queue flag, a re-run's
+ *  refreshed scores — reached Turso only via the hourly sync. Two of those are
+ *  visible to the operator today: a fresh draft's row does not exist, and its
+ *  preview route answers "No rendered body stored" for up to an hour. At the
+ *  freeze they stop being windows.
+ *
+ *  Deliberately UNLIKE `makeHealthMirrorBestEffort`, this never returns null.
+ *  #585 is the reason: Phase 3's next-due mirror silently no-opped in production
+ *  for weeks because the factory returned null without creds, and a dead
+ *  dual-write then looked exactly like a healthy one — the only tell was an
+ *  ABSENT log suffix nobody was watching for. Here creds-absent is a state the
+ *  mirror REPORTS, so every write emits one REPORT_MIRROR line and an absent
+ *  line means the wiring is gone, not that conditions were quiet.
+ */
+
+/** The three shapes a report write takes. Injected as ONE object rather than
+ *  three parameters because they share a db handle and always travel together:
+ *  a caller holding `created` but not `body` produces exactly the half-mirrored
+ *  state (row present, preview 404) this module exists to prevent. */
+type ReportMirror = {
+    /** A row Airtable just CREATED, as Airtable echoed it back. */
+    created: CreatedDraftMirror;
+    /** A freshly rendered body for an existing row. */
+    body: (reportId: string, html: string) => Promise<void>;
+    /** Columns just written to an existing row. */
+    patch: (reportId: string, patch: ReportMirrorPatch) => Promise<void>;
+};
+
+/** #539 Phase 5: the Turso write-through for the ONE-OFF Websites writers.
+ *
+ *  Phase 3 mirrored the nightly sweep — the audit write-back, github-signals and
+ *  the next-due dates. It did not touch the writers that run on their own
+ *  schedule or on demand: the analytics soft-fail stamp, the Renovate
+ *  auto-fix counter, the prismic-models verdict, `updateLaunched`, the
+ *  forms notify target, and the SINGLE-SITE audit write-back (only the fleet
+ *  path ever passed a mirror). Each of those reached Turso solely via the hourly
+ *  sync, which stops existing at the freeze.
+ *
+ *  It lives in `src/db` rather than a feature folder because its callers span
+ *  audits, recipes, CLI commands and the send path — no one feature owns it.
+ *
+ *  Deliberately UNLIKE `makeHealthMirrorBestEffort`, this never returns null.
+ *  #585 is the reason: that factory returned null without creds and the
+ *  dual-write silently no-opped in production for weeks, because a dead mirror
+ *  and a healthy one produced identical output — the only tell was an ABSENT log
+ *  suffix nobody was watching for. Here creds-absent is a state the mirror
+ *  REPORTS, so a missing SITE_MIRROR line means the wiring is gone.
+ */
+
+/** Two ops because the Websites row is split across two Turso tables. Callers
+ *  pass the EXACT FieldSet the Airtable writer returned, so the mirror can never
+ *  carry a different payload than the write it shadows. */
+type SiteMirror = {
+    /** A row Airtable just CREATED, as Airtable echoed it back (`ensure-site`).
+     *  Every other op is an UPDATE, which does nothing for a row that does not
+     *  exist yet — so without this a bootstrapped site is invisible to Turso and
+     *  every mirror the rest of the bootstrap fires reports `mirrored=missed`. */
+    created: (rec: {
+        id: string;
+        fields: Record<string, unknown>;
+    }) => Promise<void>;
+    /** Columns that live in `site_health`. */
+    health: (siteId: string, fields: Record<string, unknown>) => Promise<void>;
+    /** Columns that live in `sites`. */
+    site: (siteId: string, fields: Record<string, unknown>) => Promise<void>;
+};
 
 type ShootOptions = {
     url: string;
@@ -1028,6 +1157,22 @@ type DraftOptions = {
      *  entirely. Tests set `false` (or a stub) so a unit suite never launches a
      *  browser or resolves DNS. Production leaves it unset and gets the real thing. */
     refreshHeader?: RefreshHeaderDeps | false;
+    /** #539 Phase 5: Turso write-through for everything this function writes to
+     *  Airtable — the created row, the rendered body, and the queue flag — so a
+     *  fresh draft is fully readable in the Turso-backed console immediately
+     *  instead of after the next hourly sync.
+     *
+     *  Deliberately NOT defaulted here. Defaulting would open a real libSQL handle
+     *  from inside `draftReportForSite`, which every unit test calls — and on a
+     *  machine with TURSO_* exported that means a test suite writing rows into
+     *  production. The wiring lives at the composition roots (cli/commands/report.ts,
+     *  recipes) where it is pinned by test, the same division `runFleetWriteBack`
+     *  uses for the health mirror. */
+    reportMirror?: ReportMirror;
+    /** #539 Phase 5: the Websites-row twin of `reportMirror`. Drafting stamps
+     *  `Analytics soft-fail at` on the SITE row, which is a different Turso table
+     *  and a different mirror. Injected for the same reason — see reportMirror. */
+    siteMirror?: SiteMirror;
 };
 /** An enrichment fetch that *errored* (not one that was legitimately skipped
  *  because it isn't configured / the site lacks the inputs). Surfaced so a
@@ -1106,6 +1251,10 @@ type ResendClient = {
 
 type OrchestrateOptions = {
     resend?: ResendClient;
+    /** #539 Phase 5: Turso write-through for the Websites row a Launch send
+     *  updates. Injected rather than defaulted — this function is called directly
+     *  by tests, and a default would open a real libSQL handle inside the suite. */
+    siteMirror?: SiteMirror;
 };
 declare function sendApprovedReports(options?: OrchestrateOptions): Promise<{
     output: string;