@reddoorla/maintenance 0.87.0 → 0.88.2

package/dist/prospect-audit-JMBRVXSG.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli/commands/prospect-audit.ts","../src/prospect/report-url.ts"],"sourcesContent":["import { mkdir, writeFile } from \"node:fs/promises\";\nimport { resolve } from \"node:path\";\nimport { hostnameOf, isHttpUrl, isPrivateOrLoopbackHost } from \"../../util/url.js\";\nimport { reportUrl, reportPrintUrl } from \"../../prospect/report-url.js\";\nimport type { ProspectAuditStatus } from \"../../db/prospect-audits.js\";\nimport type { PipelineDeps, StageName } from \"../../prospect/pipeline.js\";\nimport type { ProspectAuditResult } from \"../../prospect/types.js\";\nimport type { SendAuditEmailResult } from \"../../prospect/email.js\";\n\nexport type ProspectAuditCliOptions = {\n  business?: string;\n  /** Comma-separated competitor domains. */\n  competitors?: string;\n  /** cac sets this false for `--no-probes`. */\n  probes?: boolean;\n  out?: string;\n  json?: boolean;\n  /**\n   * Email the internal sheet (scores, what wasn't measured and why, top\n   * fixes, and the shareable link) to `PROSPECT_AUDIT_RECIPIENTS`, once the\n   * report is rendered and the `--out`/Turso delivery attempts finish. A\n   * missing/empty recipients var, or a Resend failure, is a warning — never a\n   * crash — because by the time this runs the audit is already delivered (or\n   * recovered) by the code above it.\n   */\n  email?: boolean;\n  /** Test seam: injected pipeline deps. Never set from the CLI. */\n  deps?: PipelineDeps;\n};\n\ntype RecoveryWrite = { htmlPath: string; jsonPath: string };\n\nfunction fail(message: string): { output: string; code: number } {\n  return { output: message, code: 2 };\n}\n\nfunction errorMessage(err: unknown): string {\n  return err instanceof Error ? err.message : String(err);\n}\n\nfunction scoreLine(label: string, value: number | null): string {\n  return `${label.padEnd(14)} ${value === null ? \"not measured\" : String(value).padStart(3)}`;\n}\n\n/** Item 3: the `status` column exists to answer, without deserializing the\n *  whole result_json, whether this was a clean run or a degraded one. crawl\n *  is excluded — it's the one fatal stage (see pipeline.ts), so by the time a\n *  ProspectAuditResult exists it was always ok. Every other stage's\n *  StageResult already collapses \"failed\" and \"deliberately skipped\"\n *  (--no-probes, the checks→analyze cascade) into the same `ok: false` — both\n *  mean the report has a \"not measured\" section, so both count as partial\n *  here too. */\nfunction auditStatus(result: ProspectAuditResult): ProspectAuditStatus {\n  const allStagesOk =\n    result.checks.ok && result.lighthouse.ok && result.analyze.ok && result.probes.ok;\n  return allStagesOk ? \"complete\" : \"partial\";\n}\n\n/** Filesystem-safe, never empty. Collapses anything outside [a-z0-9.-] to a\n *  single dash so a hostname becomes a sane filename fragment. */\nfunction slugify(s: string): string {\n  const slug = s\n    .toLowerCase()\n    .replace(/[^a-z0-9.-]+/g, \"-\")\n    .replace(/^-+|-+$/g, \"\");\n  return slug || \"prospect\";\n}\n\n/**\n * Last-resort write when NEITHER `--out` nor the database persist made it —\n * the one situation a paid, already-run audit must never end in silently. Lands\n * in `reports/`, mirroring header-image.ts's own convention for CLI-written\n * artifacts (mkdir -p, resolved against cwd), rather than a bare file dropped\n * into whatever directory the operator happened to be standing in when they\n * ran the command — often unrelated to this repo at all in fleet-tool usage.\n */\nasync function writeRecoveryFiles(\n  result: ProspectAuditResult,\n  html: string,\n): Promise<RecoveryWrite> {\n  const dir = resolve(\"reports\");\n  await mkdir(dir, { recursive: true });\n  const stamp = new Date().toISOString().replace(/[:.]/g, \"-\");\n  const base = `prospect-audit-${slugify(hostnameOf(result.url))}-${stamp}`;\n  const htmlPath = resolve(dir, `${base}.html`);\n  const jsonPath = resolve(dir, `${base}.json`);\n  await writeFile(htmlPath, html, \"utf-8\");\n  await writeFile(jsonPath, JSON.stringify(result, null, 2), \"utf-8\");\n  return { htmlPath, jsonPath };\n}\n\nfunction summarize(\n  result: ProspectAuditResult,\n  link: string | null,\n  file: string | null,\n  warnings: string[],\n  recovery: RecoveryWrite | null,\n  email: SendAuditEmailResult | null,\n): string {\n  const lines = [\n    `Prospect audit — ${result.businessName ?? result.url}`,\n    \"\",\n    scoreLine(\"Findability\", result.scores.findability),\n    scoreLine(\"Readability\", result.scores.readability),\n    scoreLine(\"Answers\", result.scores.answers),\n    scoreLine(\"AI Visibility\", result.scores.aiVisibility),\n  ];\n  for (const [name, stage] of [\n    [\"checks\", result.checks],\n    [\"lighthouse\", result.lighthouse],\n    [\"analyze\", result.analyze],\n    [\"probes\", result.probes],\n  ] as const) {\n    if (!stage.ok) lines.push(`  ! ${name} not measured — ${stage.error}`);\n  }\n  if (file) lines.push(\"\", `Report written to ${file}`);\n  if (link) lines.push(\"\", `Shareable link: ${link}`);\n  if (email?.sent) {\n    lines.push(\"\", `Emailed to ${email.recipients.join(\", \")} (${email.messageId})`);\n  }\n  for (const w of warnings) lines.push(\"\", `! ${w}`);\n  if (recovery) {\n    lines.push(\n      \"\",\n      \"Neither --out nor the database took this report — wrote a recovery copy instead:\",\n      `  ${recovery.htmlPath}`,\n      `  ${recovery.jsonPath}`,\n    );\n  }\n  return lines.join(\"\\n\");\n}\n\n/**\n * Run one prospect audit end to end. Progress goes to stderr so `--json` stdout\n * stays pipeable. Persistence needs Turso; without it `--out` is mandatory,\n * because an audit nobody can read afterwards is just a bill.\n *\n * By the time `runProspectAudit` resolves, the money is already spent — only\n * the crawl is fatal, every other stage degrades rather than throwing. So the\n * `--out` write and the database persist below are each wrapped in their own\n * try/catch and attempted independently: a bad `--out` path must not cost a\n * working Turso persist (or vice versa), and if BOTH fail — or persist fails\n * with no `--out` given at all — a recovery copy goes to `reports/` rather\n * than the run ending with nothing anywhere. `--json` only changes the SHAPE\n * of stdout; it still runs the same `--out`/persist/recovery logic beneath it.\n */\nexport async function runProspectAuditCommand(\n  url: string,\n  opts: ProspectAuditCliOptions,\n): Promise<{ output: string; code: number }> {\n  if (!isHttpUrl(url)) {\n    return fail(`\"${url}\" is not a URL. Pass the full address, e.g. https://example.com`);\n  }\n  // #612 review: this validated only the SHAPE. The sole private-address guard\n  // was in `triggerProspectAudit` — one layer at the far end of the chain — so\n  // anyone running the CLI directly, or any future second caller, had none.\n  // `crawlSite` now refuses too; this keeps the refusal a clean message instead\n  // of a thrown crawl error.\n  if (isPrivateOrLoopbackHost(new URL(url).hostname)) {\n    return fail(`\"${url}\" is a private or loopback address — refusing to audit it.`);\n  }\n  const canPersist = Boolean(process.env.TURSO_DATABASE_URL);\n  if (!canPersist && !opts.out) {\n    return fail(\n      \"No TURSO_DATABASE_URL, so the report cannot be saved or shared. Re-run with --out <file>, or set the Turso credentials.\",\n    );\n  }\n\n  const { runProspectAudit } = await import(\"../../prospect/pipeline.js\");\n  const onStage = (name: StageName, status: \"start\" | \"ok\" | \"fail\", detail?: string): void => {\n    if (status === \"start\") console.error(`… ${name}`);\n    else if (status === \"ok\") console.error(`✓ ${name}`);\n    else console.error(`! ${name} — ${detail ?? \"failed\"}`);\n  };\n\n  const business = opts.business?.trim();\n  const result = await runProspectAudit(\n    url,\n    {\n      ...(business ? { business } : {}),\n      ...(opts.competitors\n        ? {\n            competitors: opts.competitors\n              .split(\",\")\n              .map((c) => c.trim())\n              .filter(Boolean),\n          }\n        : {}),\n      ...(opts.probes === false ? { probes: false } : {}),\n    },\n    { ...(opts.deps ?? {}), onStage },\n  );\n\n  const { renderProspectReport } = await import(\"../../prospect/render.js\");\n  const html = renderProspectReport(result);\n\n  const warnings: string[] = [];\n\n  let file: string | null = null;\n  if (opts.out) {\n    try {\n      await writeFile(opts.out, html, \"utf-8\");\n      file = opts.out;\n    } catch (err) {\n      warnings.push(`Could not write --out (${opts.out}): ${errorMessage(err)}`);\n    }\n  }\n\n  let link: string | null = null;\n  let token: string | null = null;\n  let auditId: string | null = null;\n  if (canPersist) {\n    try {\n      const { openDb, readDbConfig } = await import(\"../../db/client.js\");\n      const { createProspectAudit } = await import(\"../../db/prospect-audits.js\");\n      const db = await openDb(readDbConfig());\n      const created = await createProspectAudit(db, {\n        url: result.url,\n        // Map at the boundary: ProspectAuditResult.businessName is the field\n        // name (Item 2 — it's a resolved NAME, not a description); the\n        // `prospect_audits.business` column keeps its existing name, since\n        // renaming a column needs its own migration for no benefit here.\n        business: result.businessName,\n        status: auditStatus(result),\n        resultJson: JSON.stringify(result),\n      });\n      auditId = created.id;\n      token = created.token;\n      link = reportUrl(token);\n    } catch (err) {\n      warnings.push(`Could not save to the database: ${errorMessage(err)}`);\n    }\n  }\n\n  const delivered = file !== null || link !== null;\n  const recovery = delivered ? null : await writeRecoveryFiles(result, html);\n  const code = delivered ? 0 : 1;\n\n  // The audit is already delivered (or recovered) above — an email failure\n  // must never take that away. Same independent try/catch shape as the\n  // --out write and the Turso persist: record a warning, keep going, never\n  // touch `code`. Dynamically imported for the same reason db/client.js and\n  // prospect/render.js are above: it reaches `resend` (a devDependency) and\n  // must stay out of bin.js's static import graph (see bin.ts's\n  // central-dep-blocker comment).\n  // The PDF leave-behind, printed from the website's print route — a document\n  // designed for paper, not the interactive report with its evidence folded\n  // away behind disclosures.\n  //\n  // Best-effort by design. Every other stage in this pipeline degrades rather\n  // than throwing, and an attachment is not worth losing a delivered report\n  // over: if this fails the email still goes, with the link, and a warning says\n  // the PDF is missing. It also needs a token — with no persisted report there\n  // is no page to print.\n  let pdf: Buffer | null = null;\n  if (opts.email && token) {\n    try {\n      const { renderReportPdf } = await import(\"../../prospect/pdf.js\");\n      pdf = await renderReportPdf(reportPrintUrl(token));\n    } catch (err) {\n      warnings.push(`Could not attach the PDF: ${errorMessage(err)}`);\n    }\n  }\n\n  let email: SendAuditEmailResult | null = null;\n  if (opts.email) {\n    try {\n      const { sendAuditEmail, parseProspectAuditRecipients } =\n        await import(\"../../prospect/email.js\");\n      const recipients = parseProspectAuditRecipients(process.env.PROSPECT_AUDIT_RECIPIENTS);\n      email = await sendAuditEmail(result, { link, recipients, auditId, pdf });\n      if (!email.sent) {\n        warnings.push(`Could not email the audit sheet: ${email.reason}`);\n      }\n    } catch (err) {\n      warnings.push(`Could not email the audit sheet: ${errorMessage(err)}`);\n    }\n  }\n\n  if (opts.json) {\n    return {\n      output: JSON.stringify(\n        { result, out: file, link, token, recovery, warnings, email },\n        null,\n        2,\n      ),\n      code,\n    };\n  }\n\n  return { output: summarize(result, link, file, warnings, recovery, email), code };\n}\n","/** Where the prospect-facing report lives now: a real, branded route on the\n *  marketing site rather than generated HTML on the ops app's domain. */\nexport const DEFAULT_REPORT_BASE_URL = \"https://reddoorla.com\";\n\n/**\n * Resolve the public report origin.\n *\n * Deliberately its own variable rather than reusing `DASHBOARD_BASE_URL`. That\n * one addresses operators and points at the ops app; this one addresses a\n * prospect and points at reddoorla.com. They are different audiences on\n * different domains, and sharing a variable would mean one of them silently\n * moving the day the other is repointed.\n */\nexport function resolveReportBaseUrl(raw: string | undefined): string {\n  return (raw?.trim() || DEFAULT_REPORT_BASE_URL).replace(/\\/$/, \"\");\n}\n\n/** The link a prospect opens. */\nexport function reportUrl(token: string, raw = process.env.REPORT_BASE_URL): string {\n  return `${resolveReportBaseUrl(raw)}/audit/${token}`;\n}\n\n/** The print-designed variant, which the runner renders to a PDF. Same token,\n *  same guards — a separate document, not a stylesheet over the page. */\nexport function reportPrintUrl(token: string, raw = process.env.REPORT_BASE_URL): string {\n  return `${reportUrl(token, raw)}/print`;\n}\n"],"mappings":";;;;;;;AAAA,SAAS,OAAO,iBAAiB;AACjC,SAAS,eAAe;;;ACCjB,IAAM,0BAA0B;AAWhC,SAAS,qBAAqB,KAAiC;AACpE,UAAQ,KAAK,KAAK,KAAK,yBAAyB,QAAQ,OAAO,EAAE;AACnE;AAGO,SAAS,UAAU,OAAe,MAAM,QAAQ,IAAI,iBAAyB;AAClF,SAAO,GAAG,qBAAqB,GAAG,CAAC,UAAU,KAAK;AACpD;AAIO,SAAS,eAAe,OAAe,MAAM,QAAQ,IAAI,iBAAyB;AACvF,SAAO,GAAG,UAAU,OAAO,GAAG,CAAC;AACjC;;;ADMA,SAAS,KAAK,SAAmD;AAC/D,SAAO,EAAE,QAAQ,SAAS,MAAM,EAAE;AACpC;AAEA,SAAS,aAAa,KAAsB;AAC1C,SAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AACxD;AAEA,SAAS,UAAU,OAAe,OAA8B;AAC9D,SAAO,GAAG,MAAM,OAAO,EAAE,CAAC,IAAI,UAAU,OAAO,iBAAiB,OAAO,KAAK,EAAE,SAAS,CAAC,CAAC;AAC3F;AAUA,SAAS,YAAY,QAAkD;AACrE,QAAM,cACJ,OAAO,OAAO,MAAM,OAAO,WAAW,MAAM,OAAO,QAAQ,MAAM,OAAO,OAAO;AACjF,SAAO,cAAc,aAAa;AACpC;AAIA,SAAS,QAAQ,GAAmB;AAClC,QAAM,OAAO,EACV,YAAY,EACZ,QAAQ,iBAAiB,GAAG,EAC5B,QAAQ,YAAY,EAAE;AACzB,SAAO,QAAQ;AACjB;AAUA,eAAe,mBACb,QACA,MACwB;AACxB,QAAM,MAAM,QAAQ,SAAS;AAC7B,QAAM,MAAM,KAAK,EAAE,WAAW,KAAK,CAAC;AACpC,QAAM,SAAQ,oBAAI,KAAK,GAAE,YAAY,EAAE,QAAQ,SAAS,GAAG;AAC3D,QAAM,OAAO,kBAAkB,QAAQ,WAAW,OAAO,GAAG,CAAC,CAAC,IAAI,KAAK;AACvE,QAAM,WAAW,QAAQ,KAAK,GAAG,IAAI,OAAO;AAC5C,QAAM,WAAW,QAAQ,KAAK,GAAG,IAAI,OAAO;AAC5C,QAAM,UAAU,UAAU,MAAM,OAAO;AACvC,QAAM,UAAU,UAAU,KAAK,UAAU,QAAQ,MAAM,CAAC,GAAG,OAAO;AAClE,SAAO,EAAE,UAAU,SAAS;AAC9B;AAEA,SAAS,UACP,QACA,MACA,MACA,UACA,UACA,OACQ;AACR,QAAM,QAAQ;AAAA,IACZ,yBAAoB,OAAO,gBAAgB,OAAO,GAAG;AAAA,IACrD;AAAA,IACA,UAAU,eAAe,OAAO,OAAO,WAAW;AAAA,IAClD,UAAU,eAAe,OAAO,OAAO,WAAW;AAAA,IAClD,UAAU,WAAW,OAAO,OAAO,OAAO;AAAA,IAC1C,UAAU,iBAAiB,OAAO,OAAO,YAAY;AAAA,EACvD;AACA,aAAW,CAAC,MAAM,KAAK,KAAK;AAAA,IAC1B,CAAC,UAAU,OAAO,MAAM;AAAA,IACxB,CAAC,cAAc,OAAO,UAAU;AAAA,IAChC,CAAC,WAAW,OAAO,OAAO;AAAA,IAC1B,CAAC,UAAU,OAAO,MAAM;AAAA,EAC1B,GAAY;AACV,QAAI,CAAC,MAAM,GAAI,OAAM,KAAK,OAAO,IAAI,wBAAmB,MAAM,KAAK,EAAE;AAAA,EACvE;AACA,MAAI,KAAM,OAAM,KAAK,IAAI,qBAAqB,IAAI,EAAE;AACpD,MAAI,KAAM,OAAM,KAAK,IAAI,mBAAmB,IAAI,EAAE;AAClD,MAAI,OAAO,MAAM;AACf,UAAM,KAAK,IAAI,cAAc,MAAM,WAAW,KAAK,IAAI,CAAC,KAAK,MAAM,SAAS,GAAG;AAAA,EACjF;AACA,aAAW,KAAK,SAAU,OAAM,KAAK,IAAI,KAAK,CAAC,EAAE;AACjD,MAAI,UAAU;AACZ,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA,KAAK,SAAS,QAAQ;AAAA,MACtB,KAAK,SAAS,QAAQ;AAAA,IACxB;AAAA,EACF;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;AAgBA,eAAsB,wBACpB,KACA,MAC2C;AAC3C,MAAI,CAAC,UAAU,GAAG,GAAG;AACnB,WAAO,KAAK,IAAI,GAAG,iEAAiE;AAAA,EACtF;AAMA,MAAI,wBAAwB,IAAI,IAAI,GAAG,EAAE,QAAQ,GAAG;AAClD,WAAO,KAAK,IAAI,GAAG,iEAA4D;AAAA,EACjF;AACA,QAAM,aAAa,QAAQ,QAAQ,IAAI,kBAAkB;AACzD,MAAI,CAAC,cAAc,CAAC,KAAK,KAAK;AAC5B,WAAO;AAAA,MACL;AAAA,IACF;AAAA,EACF;AAEA,QAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,wBAA4B;AACtE,QAAM,UAAU,CAAC,MAAiB,QAAiC,WAA0B;AAC3F,QAAI,WAAW,QAAS,SAAQ,MAAM,UAAK,IAAI,EAAE;AAAA,aACxC,WAAW,KAAM,SAAQ,MAAM,UAAK,IAAI,EAAE;AAAA,QAC9C,SAAQ,MAAM,KAAK,IAAI,WAAM,UAAU,QAAQ,EAAE;AAAA,EACxD;AAEA,QAAM,WAAW,KAAK,UAAU,KAAK;AACrC,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA;AAAA,MACE,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,MAC/B,GAAI,KAAK,cACL;AAAA,QACE,aAAa,KAAK,YACf,MAAM,GAAG,EACT,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,OAAO;AAAA,MACnB,IACA,CAAC;AAAA,MACL,GAAI,KAAK,WAAW,QAAQ,EAAE,QAAQ,MAAM,IAAI,CAAC;AAAA,IACnD;AAAA,IACA,EAAE,GAAI,KAAK,QAAQ,CAAC,GAAI,QAAQ;AAAA,EAClC;AAEA,QAAM,EAAE,qBAAqB,IAAI,MAAM,OAAO,sBAA0B;AACxE,QAAM,OAAO,qBAAqB,MAAM;AAExC,QAAM,WAAqB,CAAC;AAE5B,MAAI,OAAsB;AAC1B,MAAI,KAAK,KAAK;AACZ,QAAI;AACF,YAAM,UAAU,KAAK,KAAK,MAAM,OAAO;AACvC,aAAO,KAAK;AAAA,IACd,SAAS,KAAK;AACZ,eAAS,KAAK,0BAA0B,KAAK,GAAG,MAAM,aAAa,GAAG,CAAC,EAAE;AAAA,IAC3E;AAAA,EACF;AAEA,MAAI,OAAsB;AAC1B,MAAI,QAAuB;AAC3B,MAAI,UAAyB;AAC7B,MAAI,YAAY;AACd,QAAI;AACF,YAAM,EAAE,QAAQ,aAAa,IAAI,MAAM,OAAO,sBAAoB;AAClE,YAAM,EAAE,oBAAoB,IAAI,MAAM,OAAO,+BAA6B;AAC1E,YAAM,KAAK,MAAM,OAAO,aAAa,CAAC;AACtC,YAAM,UAAU,MAAM,oBAAoB,IAAI;AAAA,QAC5C,KAAK,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA,QAKZ,UAAU,OAAO;AAAA,QACjB,QAAQ,YAAY,MAAM;AAAA,QAC1B,YAAY,KAAK,UAAU,MAAM;AAAA,MACnC,CAAC;AACD,gBAAU,QAAQ;AAClB,cAAQ,QAAQ;AAChB,aAAO,UAAU,KAAK;AAAA,IACxB,SAAS,KAAK;AACZ,eAAS,KAAK,mCAAmC,aAAa,GAAG,CAAC,EAAE;AAAA,IACtE;AAAA,EACF;AAEA,QAAM,YAAY,SAAS,QAAQ,SAAS;AAC5C,QAAM,WAAW,YAAY,OAAO,MAAM,mBAAmB,QAAQ,IAAI;AACzE,QAAM,OAAO,YAAY,IAAI;AAkB7B,MAAI,MAAqB;AACzB,MAAI,KAAK,SAAS,OAAO;AACvB,QAAI;AACF,YAAM,EAAE,gBAAgB,IAAI,MAAM,OAAO,mBAAuB;AAChE,YAAM,MAAM,gBAAgB,eAAe,KAAK,CAAC;AAAA,IACnD,SAAS,KAAK;AACZ,eAAS,KAAK,6BAA6B,aAAa,GAAG,CAAC,EAAE;AAAA,IAChE;AAAA,EACF;AAEA,MAAI,QAAqC;AACzC,MAAI,KAAK,OAAO;AACd,QAAI;AACF,YAAM,EAAE,gBAAgB,6BAA6B,IACnD,MAAM,OAAO,qBAAyB;AACxC,YAAM,aAAa,6BAA6B,QAAQ,IAAI,yBAAyB;AACrF,cAAQ,MAAM,eAAe,QAAQ,EAAE,MAAM,YAAY,SAAS,IAAI,CAAC;AACvE,UAAI,CAAC,MAAM,MAAM;AACf,iBAAS,KAAK,oCAAoC,MAAM,MAAM,EAAE;AAAA,MAClE;AAAA,IACF,SAAS,KAAK;AACZ,eAAS,KAAK,oCAAoC,aAAa,GAAG,CAAC,EAAE;AAAA,IACvE;AAAA,EACF;AAEA,MAAI,KAAK,MAAM;AACb,WAAO;AAAA,MACL,QAAQ,KAAK;AAAA,QACX,EAAE,QAAQ,KAAK,MAAM,MAAM,OAAO,UAAU,UAAU,MAAM;AAAA,QAC5D;AAAA,QACA;AAAA,MACF;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,QAAQ,UAAU,QAAQ,MAAM,MAAM,UAAU,UAAU,KAAK,GAAG,KAAK;AAClF;","names":[]}

package/dist/render-VX72AESY.js

@@ -0,0 +1,10 @@
+import {
+  renderProspectReport
+} from "./chunk-A2UNJIKH.js";
+import "./chunk-7TMWBXX7.js";
+import "./chunk-BGTYPVLT.js";
+import "./chunk-RARREDQE.js";
+export {
+  renderProspectReport
+};
+//# sourceMappingURL=render-VX72AESY.js.map

package/dist/{render-from-row-BWSOIYDS.js → render-from-row-DOYJDO2L.js}

@@ -2,16 +2,16 @@ import {
   renderReportFromRow,
   requireLighthouse,
   windowDays
-} from "./chunk-ZGBEIWSC.js";
+} from "./chunk-XP5WM2LV.js";
 import "./chunk-GECESMVS.js";
-import "./chunk-MT2JINSS.js";
-import "./chunk-DJZWYIPP.js";
 import "./chunk-5UINJNAJ.js";
+import "./chunk-KJGKZLCT.js";
+import "./chunk-BGTYPVLT.js";
 import "./chunk-7NYN2P6I.js";
-import "./chunk-EVBCK2KC.js";
+import "./chunk-RARREDQE.js";
 export {
   renderReportFromRow,
   requireLighthouse,
   windowDays
 };
-//# sourceMappingURL=render-from-row-BWSOIYDS.js.map
+//# sourceMappingURL=render-from-row-DOYJDO2L.js.map

package/dist/{replay-C2LXMJZP.js → replay-4S6ENYCH.js}

@@ -1,7 +1,7 @@
 import {
   ingestSubmission
-} from "./chunk-BNM5POSJ.js";
-import "./chunk-SNSTJLQW.js";
+} from "./chunk-JRHIFA5R.js";
+import "./chunk-NO74DXDP.js";
 import "./chunk-2OP4JKIQ.js";
 
 // src/db/deadletter.ts
@@ -63,4 +63,4 @@ async function replayOne(db, deps, row) {
 export {
   replayDeadLetters
 };
-//# sourceMappingURL=replay-C2LXMJZP.js.map
+//# sourceMappingURL=replay-4S6ENYCH.js.map

package/dist/{report-R3E3Y7HR.js → report-TALY5P3L.js}

@@ -4,7 +4,7 @@ import {
 import {
   draftReportForSite,
   readGaConfig
-} from "./chunk-BBUSGEES.js";
+} from "./chunk-J3WEZGIN.js";
 import {
   findDueReports,
   nextDueDate,
@@ -22,17 +22,17 @@ import {
   openBase,
   readAirtableConfig
 } from "./chunk-HN6I2XWI.js";
-import "./chunk-MT2JINSS.js";
+import "./chunk-5UINJNAJ.js";
+import "./chunk-KJGKZLCT.js";
 import {
   escapeHtml
-} from "./chunk-DJZWYIPP.js";
-import "./chunk-5UINJNAJ.js";
+} from "./chunk-BGTYPVLT.js";
 import {
   listWebsites,
   siteSlug,
   updateNextDueDates
 } from "./chunk-7NYN2P6I.js";
-import "./chunk-EVBCK2KC.js";
+import "./chunk-RARREDQE.js";
 import "./chunk-6VAL7XJT.js";
 
 // src/alerts/analytics-health.ts
@@ -78,19 +78,19 @@ function dashboardBaseUrl() {
 }
 async function runReportCommand(slug, opts) {
   if (opts.digest) {
-    const { runDigest } = await import("./digest-FW6QMZZJ.js");
+    const { runDigest } = await import("./digest-2JEAEJK6.js");
     return runDigest({ baseUrl: dashboardBaseUrl() });
   }
   if (opts.sendReady) {
-    const { sendApprovedReports } = await import("./orchestrate-YLWQ6KK2.js");
-    const { makeSiteMirror } = await import("./site-mirror-NIREX5ME.js");
+    const { sendApprovedReports } = await import("./orchestrate-JNKCWU5K.js");
+    const { makeSiteMirror } = await import("./site-mirror-Q763PLGG.js");
     return sendApprovedReports({ siteMirror: await makeSiteMirror() });
   }
   if (opts.rerender) {
     const { rerenderReport, formatRerenderResult } = await import("./rerender-3FM6DNRH.js");
-    const { renderReportFromRow } = await import("./render-from-row-BWSOIYDS.js");
-    const { openDb, readDbConfig } = await import("./client-AUE3XUPO.js");
-    const { getReportById, getSiteById, storeRenderedHtml } = await import("./fleet-state-7TJ2GYT2.js");
+    const { renderReportFromRow } = await import("./render-from-row-DOYJDO2L.js");
+    const { openDb, readDbConfig } = await import("./client-JYKPVCJX.js");
+    const { getReportById, getSiteById, storeRenderedHtml } = await import("./fleet-state-R5LU7IC3.js");
     const { loadHeaderImage } = await import("./header-images-SQBCE5OD.js");
     const { fetchAttachmentBytes } = await import("./attachments-NLZIJ5NU.js");
     const db = await openDb(readDbConfig());
@@ -129,9 +129,9 @@ async function runReportCommand(slug, opts) {
 }
 async function runDueDraft() {
   const base = openBase(readAirtableConfig());
-  const { makeScheduleMirrorBestEffort } = await import("./health-mirror-L5JBEJVA.js");
-  const { makeReportMirror } = await import("./report-mirror-4MNORYQ4.js");
-  const { makeSiteMirror } = await import("./site-mirror-NIREX5ME.js");
+  const { makeScheduleMirrorBestEffort } = await import("./health-mirror-GCDN7BJL.js");
+  const { makeReportMirror } = await import("./report-mirror-AAK3MXHY.js");
+  const { makeSiteMirror } = await import("./site-mirror-Q763PLGG.js");
   const result = await draftDueReports(
     base,
     /* @__PURE__ */ new Date(),
@@ -321,8 +321,8 @@ async function runSingleSiteDraft(slug, opts) {
   if (!site) {
     throw Object.assign(new Error(`No Websites row matched slug "${slug}"`), { exitCode: 2 });
   }
-  const reportMirror = opts.previewOnly ? null : await (await import("./report-mirror-4MNORYQ4.js")).makeReportMirror();
-  const siteMirror = opts.previewOnly ? null : await (await import("./site-mirror-NIREX5ME.js")).makeSiteMirror();
+  const reportMirror = opts.previewOnly ? null : await (await import("./report-mirror-AAK3MXHY.js")).makeReportMirror();
+  const siteMirror = opts.previewOnly ? null : await (await import("./site-mirror-Q763PLGG.js")).makeSiteMirror();
   const result = await draftReportForSite(opts.previewOnly ? null : base, site, opts.reportType, {
     previewOnly: opts.previewOnly,
     // Only forced on. Left undefined, draftReportForSite keeps its default
@@ -350,4 +350,4 @@ export {
   runReportCommand,
   writeNextDueDates
 };
-//# sourceMappingURL=report-R3E3Y7HR.js.map
+//# sourceMappingURL=report-TALY5P3L.js.map

package/dist/{report-mirror-4MNORYQ4.js → report-mirror-AAK3MXHY.js}

@@ -1,8 +1,11 @@
+import {
+  TURSO_IS_AUTHORITATIVE
+} from "./chunk-RUPPWAD6.js";
 import {
   mirrorReportInsert,
   mirrorReportPatch,
   storeRenderedHtml
-} from "./chunk-HHMMUR4P.js";
+} from "./chunk-GQDDWYU2.js";
 import "./chunk-P6AORG32.js";
 import "./chunk-F3JWOPTG.js";
 import "./chunk-VAD43MOR.js";
@@ -10,12 +13,12 @@ import "./chunk-7NYN2P6I.js";
 import {
   openDb,
   readDbConfig
-} from "./chunk-JHGHLKFS.js";
-import "./chunk-3SF7D4DY.js";
+} from "./chunk-WS6NU475.js";
+import "./chunk-MFHS7IQ2.js";
 import "./chunk-6VAL7XJT.js";
 
 // src/reports/report-mirror.ts
-async function makeReportMirror(open = () => openDb(readDbConfig())) {
+async function makeReportMirror(open = () => openDb(readDbConfig()), strict = TURSO_IS_AUTHORITATIVE) {
   let db = null;
   let why = "";
   try {
@@ -23,6 +26,7 @@ async function makeReportMirror(open = () => openDb(readDbConfig())) {
   } catch (e) {
     why = e.message;
   }
+  if (strict && !db) throw new Error(`REPORT_MIRROR unavailable: ${why}`);
   const run = async (reportId, op, work) => {
     if (!db) {
       console.log(`REPORT_MIRROR report=${reportId} op=${op} mirrored=absent reason=${why}`);
@@ -30,12 +34,14 @@ async function makeReportMirror(open = () => openDb(readDbConfig())) {
     }
     try {
       await work(db);
-      console.log(`REPORT_MIRROR report=${reportId} op=${op} mirrored=1`);
     } catch (e) {
       console.log(
         `REPORT_MIRROR report=${reportId} op=${op} mirrored=0 error=${e.message}`
       );
+      if (strict) throw e;
+      return;
     }
+    console.log(`REPORT_MIRROR report=${reportId} op=${op} mirrored=1`);
   };
   return {
     created: (rec) => run(rec.id, "created", (d) => mirrorReportInsert(d, rec)),
@@ -46,4 +52,4 @@ async function makeReportMirror(open = () => openDb(readDbConfig())) {
 export {
   makeReportMirror
 };
-//# sourceMappingURL=report-mirror-4MNORYQ4.js.map
+//# sourceMappingURL=report-mirror-AAK3MXHY.js.map

package/dist/report-mirror-AAK3MXHY.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/reports/report-mirror.ts"],"sourcesContent":["/** #539 Phase 5: the Turso write-through for the Reports write surface.\n *\n *  Before this, the only report mirrors were UPDATEs on the request path\n *  (approve, override, delivery status, commentary). Everything the DRAFTING\n *  path writes — the row itself, the rendered body, the queue flag, a re-run's\n *  refreshed scores — reached Turso only via the hourly sync. Two of those are\n *  visible to the operator today: a fresh draft's row does not exist, and its\n *  preview route answers \"No rendered body stored\" for up to an hour. At the\n *  freeze they stop being windows.\n *\n *  Deliberately UNLIKE `makeHealthMirrorBestEffort`, this never returns null.\n *  #585 is the reason: Phase 3's next-due mirror silently no-opped in production\n *  for weeks because the factory returned null without creds, and a dead\n *  dual-write then looked exactly like a healthy one — the only tell was an\n *  ABSENT log suffix nobody was watching for. Here creds-absent is a state the\n *  mirror REPORTS, so every write emits one REPORT_MIRROR line and an absent\n *  line means the wiring is gone, not that conditions were quiet.\n */\nimport { openDb, readDbConfig, type Db } from \"../db/client.js\";\nimport {\n  mirrorReportInsert,\n  mirrorReportPatch,\n  storeRenderedHtml,\n  type ReportMirrorPatch,\n} from \"../db/fleet-state.js\";\nimport type { CreatedDraftMirror } from \"./airtable/reports.js\";\nimport { TURSO_IS_AUTHORITATIVE } from \"../db/freeze.js\";\n\n/** The three shapes a report write takes. Injected as ONE object rather than\n *  three parameters because they share a db handle and always travel together:\n *  a caller holding `created` but not `body` produces exactly the half-mirrored\n *  state (row present, preview 404) this module exists to prevent. */\nexport type ReportMirror = {\n  /** A row Airtable just CREATED, as Airtable echoed it back. */\n  created: CreatedDraftMirror;\n  /** A freshly rendered body for an existing row. */\n  body: (reportId: string, html: string) => Promise<void>;\n  /** Columns just written to an existing row. */\n  patch: (reportId: string, patch: ReportMirrorPatch) => Promise<void>;\n};\n\n/** Build the drafting-path mirror. Never throws and never returns null:\n *  Airtable is still authoritative through Phase 5, so a mirror problem must\n *  not cost a draft the operator is waiting on — the hourly sync converges\n *  whatever this misses. `open` is injectable for tests. */\nexport async function makeReportMirror(\n  open: () => Promise<Db> = () => openDb(readDbConfig()),\n  /** #612. `true` = Turso is the store that must succeed, so every failure\n   *  throws instead of being logged and swallowed. Defaulted from the shipped\n   *  constant and injected by tests, so both sides stay proven. */\n  strict: boolean = TURSO_IS_AUTHORITATIVE,\n): Promise<ReportMirror> {\n  let db: Db | null = null;\n  let why = \"\";\n  try {\n    db = await open();\n  } catch (e) {\n    why = (e as Error).message;\n  }\n  // Frozen: refuse to hand back a mirror that cannot write — see makeSiteMirror\n  // for why this fails at construction rather than per write.\n  if (strict && !db) throw new Error(`REPORT_MIRROR unavailable: ${why}`);\n\n  const run = async (reportId: string, op: string, work: (db: Db) => Promise<void>) => {\n    if (!db) {\n      console.log(`REPORT_MIRROR report=${reportId} op=${op} mirrored=absent reason=${why}`);\n      return;\n    }\n    try {\n      await work(db);\n    } catch (e) {\n      console.log(\n        `REPORT_MIRROR report=${reportId} op=${op} mirrored=0 error=${(e as Error).message}`,\n      );\n      if (strict) throw e;\n      return;\n    }\n    console.log(`REPORT_MIRROR report=${reportId} op=${op} mirrored=1`);\n  };\n\n  return {\n    created: (rec) => run(rec.id, \"created\", (d) => mirrorReportInsert(d, rec)),\n    body: (reportId, html) => run(reportId, \"body\", (d) => storeRenderedHtml(d, reportId, html)),\n    patch: (reportId, patch) =>\n      run(reportId, \"patch\", (d) => mirrorReportPatch(d, reportId, patch)),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AA6CA,eAAsB,iBACpB,OAA0B,MAAM,OAAO,aAAa,CAAC,GAIrD,SAAkB,wBACK;AACvB,MAAI,KAAgB;AACpB,MAAI,MAAM;AACV,MAAI;AACF,SAAK,MAAM,KAAK;AAAA,EAClB,SAAS,GAAG;AACV,UAAO,EAAY;AAAA,EACrB;AAGA,MAAI,UAAU,CAAC,GAAI,OAAM,IAAI,MAAM,8BAA8B,GAAG,EAAE;AAEtE,QAAM,MAAM,OAAO,UAAkB,IAAY,SAAoC;AACnF,QAAI,CAAC,IAAI;AACP,cAAQ,IAAI,wBAAwB,QAAQ,OAAO,EAAE,2BAA2B,GAAG,EAAE;AACrF;AAAA,IACF;AACA,QAAI;AACF,YAAM,KAAK,EAAE;AAAA,IACf,SAAS,GAAG;AACV,cAAQ;AAAA,QACN,wBAAwB,QAAQ,OAAO,EAAE,qBAAsB,EAAY,OAAO;AAAA,MACpF;AACA,UAAI,OAAQ,OAAM;AAClB;AAAA,IACF;AACA,YAAQ,IAAI,wBAAwB,QAAQ,OAAO,EAAE,aAAa;AAAA,EACpE;AAEA,SAAO;AAAA,IACL,SAAS,CAAC,QAAQ,IAAI,IAAI,IAAI,WAAW,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAAA,IAC1E,MAAM,CAAC,UAAU,SAAS,IAAI,UAAU,QAAQ,CAAC,MAAM,kBAAkB,GAAG,UAAU,IAAI,CAAC;AAAA,IAC3F,OAAO,CAAC,UAAU,UAChB,IAAI,UAAU,SAAS,CAAC,MAAM,kBAAkB,GAAG,UAAU,KAAK,CAAC;AAAA,EACvE;AACF;","names":[]}

package/dist/schema-75PJECAE.js

@@ -0,0 +1,18 @@
+// src/db/schema.ts
+var DATABASE_TABLES = [
+  "submissions",
+  "spam_screenouts",
+  "fleet_events",
+  "_migrations",
+  "submission_deadletter",
+  "sites",
+  "site_health",
+  "site_schedule",
+  "reports",
+  "prospect_audits",
+  "digest_state"
+];
+export {
+  DATABASE_TABLES
+};
+//# sourceMappingURL=schema-75PJECAE.js.map

package/dist/schema-75PJECAE.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/db/schema.ts"],"sourcesContent":["// The hand-written shape Kysely types every query from. SQLite stores TEXT/INTEGER\n// only, so these are the column *shapes* — the value domains (form_type, status,\n// notify_status) are still narrowed at read time by the validators in\n// src/reports/submission-row.ts. Keep this in lockstep with src/db/migrations.ts;\n// drift is caught by the in-memory tests in tests/db/, not by codegen.\n\nexport interface SubmissionsTable {\n  id: string;\n  submission_id: number | null;\n  site_id: string;\n  form_type: string;\n  name: string;\n  email: string;\n  phone: string | null;\n  message: string | null;\n  extra_fields: string | null;\n  source_url: string | null;\n  utm: string | null;\n  submitted_at: string | null;\n  status: string;\n  notify_status: string;\n  resend_message_id: string | null;\n  spam_score: number | null;\n  spam_reason: string | null;\n  fanout_status: string | null;\n}\n\nexport interface SpamScreenoutsTable {\n  site_id: string;\n  date: string;\n  honeypot: number;\n  too_fast: number;\n  marked_spam: number;\n}\n\nexport interface FleetEventsTable {\n  id: string;\n  ts: string;\n  type: string;\n  site_id: string | null;\n  site_name: string | null;\n  summary: string;\n  data: string | null;\n  created_at: string;\n}\n\nexport interface MigrationsTable {\n  id: string;\n  applied_at: string;\n}\n\n/** A lead whose site lookup threw mid-ingest (migration 0006). `payload` and\n *  `turnstile` are JSON — the raw wire body and the verification computed at\n *  receipt — exactly what `db replay-deadletters` feeds back through\n *  `ingestSubmission` once the lookup recovers. */\nexport interface SubmissionDeadletterTable {\n  id: string;\n  site_slug: string;\n  payload: string;\n  turnstile: string;\n  error: string;\n  received_at: string;\n  replayed_at: string | null;\n  replay_outcome: string | null;\n  replay_submission_id: string | null;\n}\n\n/** Operator-owned fleet config (migration 0007). PK = Airtable rec id (D1).\n *  `legacy` holds the 33 populated-but-code-unreferenced Airtable columns as a\n *  JSON object keyed by original column name; the plaintext DNS/cms credential\n *  cells never migrate (operator ruling 2026-08-23). */\nexport interface SitesTable {\n  id: string;\n  slug: string;\n  name: string;\n  url: string | null;\n  status: string | null;\n  point_of_contact: string | null;\n  maintenance_freq: string | null;\n  testing_freq: string | null;\n  maintenance_day: string | null;\n  testing_day: string | null;\n  ga4_property_id: string | null;\n  search_query: string | null;\n  search_console_property: string | null;\n  git_repo: string | null;\n  netlify_id: string | null;\n  report_recipients_to: string | null;\n  report_recipients_cc: string | null;\n  copy_intro: string | null;\n  copy_contact: string | null;\n  copy_footer: string | null;\n  newsletter_webhook: string | null;\n  mailchimp_api_key: string | null;\n  mailchimp_audience_id: string | null;\n  notify_routing: string | null;\n  require_turnstile: number;\n  accepted_watch_conditions: string | null;\n  prismic_ack_until: string | null;\n  launched_at: string | null;\n  header_image: Uint8Array | null;\n  header_image_filename: string | null;\n  header_image_type: string | null;\n  header_image_generated_at: string | null;\n  legacy: string | null;\n}\n\n/** Nightly-cron-owned health/telemetry (migration 0007) — one row per site,\n *  written as one batched upsert per sweep family. `analytics_soft_fail_at` is\n *  the \"Analytics soft-fail at\" column code always wrote best-effort but no\n *  operator ever created in Airtable. */\nexport interface SiteHealthTable {\n  site_id: string;\n  p_score: number | null;\n  r_score: number | null;\n  bp_score: number | null;\n  seo_score: number | null;\n  lighthouse_at: string | null;\n  a11y_violations: number | null;\n  deps_drifted: number | null;\n  deps_major_behind: number | null;\n  deps_outdated: number | null;\n  deps_major_outdated: number | null;\n  vulns_critical: number | null;\n  vulns_high: number | null;\n  vulns_moderate: number | null;\n  vulns_low: number | null;\n  security_audit_at: string | null;\n  security_advisories: string | null;\n  auto_fix_attempts: number | null;\n  analytics_soft_fail_at: string | null;\n  cert_days_remaining: number | null;\n  domain_checked_at: string | null;\n  deploy_status: string | null;\n  last_deploy_at: string | null;\n  deploy_log_url: string | null;\n  deploy_checked_at: string | null;\n  function_health: string | null;\n  cms_reachable: string | null;\n  turnstile_widget: string | null;\n  function_health_checked_at: string | null;\n  crossbrowser_ok: number | null;\n  mobile_ok: number | null;\n  links_ok: number | null;\n  broken_links: number | null;\n  browser_checked_at: string | null;\n  uptime_reachable: string | null;\n  titles_meta_ok: string | null;\n  smoke_ok: string | null;\n  last_smoke_at: string | null;\n  form_e2e_ok: string | null;\n  form_e2e_checked_at: string | null;\n  renovate_failing_cis: number | null;\n  default_branch_ci: string | null;\n  last_commit_at: string | null;\n  github_signals_at: string | null;\n  prismic_models: string | null;\n  prismic_models_checked_at: string | null;\n  prismic_models_drift: string | null;\n}\n\n/** Code-derived schedule (migration 0007) — written by updateNextDueDates. */\nexport interface SiteScheduleTable {\n  site_id: string;\n  next_maintenance_at: string | null;\n  next_testing_at: string | null;\n  computed_at: string | null;\n}\n\n/** Report rows (migration 0007). PK = Airtable rec id. `checklist` is JSON\n *  keyed by the STABLE checklist key (src/reports/checklist.ts), not the\n *  Airtable column name; `rendered_html` is the downloaded attachment body. */\nexport interface ReportsTable {\n  id: string;\n  site_id: string | null;\n  report_id: string | null;\n  report_type: string | null;\n  period: string | null;\n  period_start: string | null;\n  period_end: string | null;\n  completed_on: string | null;\n  lighthouse_performance: number | null;\n  lighthouse_accessibility: number | null;\n  lighthouse_best_practices: number | null;\n  lighthouse_seo: number | null;\n  ga_users_current: number | null;\n  ga_users_previous: number | null;\n  search_found_page1: number | null;\n  search_position: number | null;\n  last_tested_date: string | null;\n  commentary: string | null;\n  subject_override: string | null;\n  draft_ready: number;\n  approved_to_send: number;\n  approved_at: string | null;\n  approved_by: string | null;\n  send_override: number;\n  override_reason: string | null;\n  override_by: string | null;\n  override_at: string | null;\n  sent_at: string | null;\n  delivery_status: string | null;\n  resend_message_id: string | null;\n  checklist: string | null;\n  checklist_auto_evidence: string | null;\n  rendered_html: string | null;\n}\n\n/** One prospect-audit run (migration 0009). `token` is the 128-bit unguessable\n *  public handle for GET /r/{token}; `result_json` holds the full\n *  ProspectAuditResult (src/prospect/types.ts). */\nexport interface ProspectAuditsTable {\n  id: string;\n  token: string;\n  url: string;\n  business: string | null;\n  created_at: string;\n  status: string;\n  result_json: string;\n}\n\n/** The digest's prior-run snapshot (migration 0011). One row, `id` = the\n *  constant singleton key; `snapshot` is the whole DigestSnapshot as JSON. */\nexport interface DigestStateTable {\n  id: string;\n  snapshot: string;\n  updated_at: string | null;\n}\n\n/** Every table the app owns, as a RUNTIME value (#612 review).\n *\n *  The `Database` interface below is types-only, so nothing could assert that a\n *  backup actually covered it — `tables=N` was printed by the verifier and never\n *  checked, meaning a table a migration failed to create would ride green\n *  forever. The compile-time check under this list makes forgetting an entry a\n *  build error naming the missing table. */\nexport const DATABASE_TABLES = [\n  \"submissions\",\n  \"spam_screenouts\",\n  \"fleet_events\",\n  \"_migrations\",\n  \"submission_deadletter\",\n  \"sites\",\n  \"site_health\",\n  \"site_schedule\",\n  \"reports\",\n  \"prospect_audits\",\n  \"digest_state\",\n] as const;\n\nexport type DatabaseTable = (typeof DATABASE_TABLES)[number];\n\nexport interface Database {\n  submissions: SubmissionsTable;\n  spam_screenouts: SpamScreenoutsTable;\n  fleet_events: FleetEventsTable;\n  _migrations: MigrationsTable;\n  submission_deadletter: SubmissionDeadletterTable;\n  sites: SitesTable;\n  site_health: SiteHealthTable;\n  site_schedule: SiteScheduleTable;\n  reports: ReportsTable;\n  prospect_audits: ProspectAuditsTable;\n  digest_state: DigestStateTable;\n}\n\n/** Compile-time exhaustiveness: if a table is added to `Database` and not to\n *  `DATABASE_TABLES`, this errors and NAMES it. */\ntype MissingFromDatabaseTables = Exclude<keyof Database, DatabaseTable>;\nconst _everyTableIsListed: MissingFromDatabaseTables extends never\n  ? true\n  : MissingFromDatabaseTables = true;\nvoid _everyTableIsListed;\n"],"mappings":";AA4OO,IAAM,kBAAkB;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;","names":[]}

package/dist/{self-updating-UCIWESAX.js → self-updating-NTCCWJYZ.js}

@@ -12,12 +12,12 @@ import {
 } from "./chunk-TVL5MVUF.js";
 import {
   resolveSites
-} from "./chunk-CROKUHJB.js";
+} from "./chunk-Q47DU255.js";
 import "./chunk-73UFRZKY.js";
 import "./chunk-GASBX52O.js";
 import "./chunk-XHHMM5HX.js";
-import "./chunk-6TWWY7ZU.js";
-import "./chunk-EVBCK2KC.js";
+import "./chunk-Z3JXLULD.js";
+import "./chunk-RARREDQE.js";
 import "./chunk-XTK5VIQB.js";
 import "./chunk-LBYOLBW7.js";
 import "./chunk-XXTZBPUY.js";
@@ -62,4 +62,4 @@ async function runSelfUpdatingCommand(site, opts) {
 export {
   runSelfUpdatingCommand
 };
-//# sourceMappingURL=self-updating-UCIWESAX.js.map
+//# sourceMappingURL=self-updating-NTCCWJYZ.js.map

package/dist/{selftest-VGHWPN72.js → selftest-NZTR4SM2.js}

@@ -1,11 +1,11 @@
 import {
   buildReportDataForSite,
   scoresFromRow
-} from "./chunk-HEWSRXYV.js";
+} from "./chunk-ULHPALI5.js";
 import {
   operatorEmail
 } from "./chunk-5ML7FMBD.js";
-import "./chunk-BBUSGEES.js";
+import "./chunk-J3WEZGIN.js";
 import {
   ELIGIBLE_STATUSES
 } from "./chunk-PZR4EBPY.js";
@@ -13,7 +13,7 @@ import "./chunk-YFAXOD7Z.js";
 import {
   isProbablyEmail,
   parseAddresses
-} from "./chunk-NDWYJLRF.js";
+} from "./chunk-DGZWFI2G.js";
 import "./chunk-F3JWOPTG.js";
 import "./chunk-VAD43MOR.js";
 import {
@@ -26,13 +26,13 @@ import {
 import {
   prepareHeaderImage,
   renderReportEmail
-} from "./chunk-ZGBEIWSC.js";
+} from "./chunk-XP5WM2LV.js";
 import "./chunk-GECESMVS.js";
-import "./chunk-MT2JINSS.js";
-import "./chunk-DJZWYIPP.js";
 import {
   applyReportTypeHeadline
 } from "./chunk-5UINJNAJ.js";
+import "./chunk-KJGKZLCT.js";
+import "./chunk-BGTYPVLT.js";
 import {
   listWebsites,
   siteSlug
@@ -40,10 +40,10 @@ import {
 import {
   defaultResendClient
 } from "./chunk-WEKL2HYJ.js";
-import "./chunk-XUGSZP7Z.js";
-import "./chunk-EVBCK2KC.js";
-import "./chunk-JHGHLKFS.js";
-import "./chunk-3SF7D4DY.js";
+import "./chunk-W45FZEGE.js";
+import "./chunk-RARREDQE.js";
+import "./chunk-WS6NU475.js";
+import "./chunk-MFHS7IQ2.js";
 import "./chunk-6VAL7XJT.js";
 
 // src/recipes/selftest-email.ts
@@ -172,4 +172,4 @@ async function runSelftestCommand(kind, site, opts) {
 export {
   runSelftestCommand
 };
-//# sourceMappingURL=selftest-VGHWPN72.js.map
+//# sourceMappingURL=selftest-NZTR4SM2.js.map

package/dist/{site-mirror-NIREX5ME.js → site-mirror-Q763PLGG.js}

@@ -1,8 +1,11 @@
+import {
+  TURSO_IS_AUTHORITATIVE
+} from "./chunk-RUPPWAD6.js";
 import {
   mirrorHealthFields,
   mirrorSiteFields,
   mirrorSiteInsert
-} from "./chunk-HHMMUR4P.js";
+} from "./chunk-GQDDWYU2.js";
 import "./chunk-P6AORG32.js";
 import "./chunk-F3JWOPTG.js";
 import "./chunk-VAD43MOR.js";
@@ -10,12 +13,12 @@ import "./chunk-7NYN2P6I.js";
 import {
   openDb,
   readDbConfig
-} from "./chunk-JHGHLKFS.js";
-import "./chunk-3SF7D4DY.js";
+} from "./chunk-WS6NU475.js";
+import "./chunk-MFHS7IQ2.js";
 import "./chunk-6VAL7XJT.js";
 
 // src/db/site-mirror.ts
-async function makeSiteMirror(open = () => openDb(readDbConfig())) {
+async function makeSiteMirror(open = () => openDb(readDbConfig()), strict = TURSO_IS_AUTHORITATIVE) {
   let db = null;
   let why = "";
   try {
@@ -23,16 +26,23 @@ async function makeSiteMirror(open = () => openDb(readDbConfig())) {
   } catch (e) {
     why = e.message;
   }
+  if (strict && !db) throw new Error(`SITE_MIRROR unavailable: ${why}`);
   const run = async (siteId, op, work) => {
     if (!db) {
       console.log(`SITE_MIRROR site=${siteId} op=${op} mirrored=absent reason=${why}`);
       return;
     }
+    let matched;
     try {
-      const matched = await work(db);
-      console.log(`SITE_MIRROR site=${siteId} op=${op} mirrored=${matched ? "1" : "missed"}`);
+      matched = await work(db);
     } catch (e) {
       console.log(`SITE_MIRROR site=${siteId} op=${op} mirrored=0 error=${e.message}`);
+      if (strict) throw e;
+      return;
+    }
+    console.log(`SITE_MIRROR site=${siteId} op=${op} mirrored=${matched ? "1" : "missed"}`);
+    if (strict && !matched) {
+      throw new Error(`SITE_MIRROR site=${siteId} op=${op}: no such row in Turso`);
     }
   };
   return {
@@ -49,4 +59,4 @@ async function makeSiteMirror(open = () => openDb(readDbConfig())) {
 export {
   makeSiteMirror
 };
-//# sourceMappingURL=site-mirror-NIREX5ME.js.map
+//# sourceMappingURL=site-mirror-Q763PLGG.js.map

package/dist/site-mirror-Q763PLGG.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/db/site-mirror.ts"],"sourcesContent":["/** #539 Phase 5: the Turso write-through for the ONE-OFF Websites writers.\n *\n *  Phase 3 mirrored the nightly sweep — the audit write-back, github-signals and\n *  the next-due dates. It did not touch the writers that run on their own\n *  schedule or on demand: the analytics soft-fail stamp, the Renovate\n *  auto-fix counter, the prismic-models verdict, `updateLaunched`, the\n *  forms notify target, and the SINGLE-SITE audit write-back (only the fleet\n *  path ever passed a mirror). Each of those reached Turso solely via the hourly\n *  sync, which stops existing at the freeze.\n *\n *  It lives in `src/db` rather than a feature folder because its callers span\n *  audits, recipes, CLI commands and the send path — no one feature owns it.\n *\n *  Deliberately UNLIKE `makeHealthMirrorBestEffort`, this never returns null.\n *  #585 is the reason: that factory returned null without creds and the\n *  dual-write silently no-opped in production for weeks, because a dead mirror\n *  and a healthy one produced identical output — the only tell was an ABSENT log\n *  suffix nobody was watching for. Here creds-absent is a state the mirror\n *  REPORTS, so a missing SITE_MIRROR line means the wiring is gone.\n */\nimport { openDb, readDbConfig, type Db } from \"./client.js\";\nimport { mirrorHealthFields, mirrorSiteFields, mirrorSiteInsert } from \"./fleet-state.js\";\nimport { TURSO_IS_AUTHORITATIVE } from \"./freeze.js\";\n\n/** Two ops because the Websites row is split across two Turso tables. Callers\n *  pass the EXACT FieldSet the Airtable writer returned, so the mirror can never\n *  carry a different payload than the write it shadows. */\nexport type SiteMirror = {\n  /** A row Airtable just CREATED, as Airtable echoed it back (`ensure-site`).\n   *  Every other op is an UPDATE, which does nothing for a row that does not\n   *  exist yet — so without this a bootstrapped site is invisible to Turso and\n   *  every mirror the rest of the bootstrap fires reports `mirrored=missed`. */\n  created: (rec: { id: string; fields: Record<string, unknown> }) => Promise<void>;\n  /** Columns that live in `site_health`. */\n  health: (siteId: string, fields: Record<string, unknown>) => Promise<void>;\n  /** Columns that live in `sites`. */\n  site: (siteId: string, fields: Record<string, unknown>) => Promise<void>;\n};\n\n/** Build the one-off writers' mirror. Never throws and never returns null:\n *  Airtable is still authoritative through Phase 5, so a mirror problem must not\n *  cost the write it shadows — the hourly sync converges whatever this misses.\n *  `open` is injectable for tests. */\nexport async function makeSiteMirror(\n  open: () => Promise<Db> = () => openDb(readDbConfig()),\n  /** #612. `true` = Turso is the store that must succeed, so every failure\n   *  throws instead of being logged and swallowed. Defaulted from the shipped\n   *  constant and injected by tests, so both sides stay proven. */\n  strict: boolean = TURSO_IS_AUTHORITATIVE,\n): Promise<SiteMirror> {\n  let db: Db | null = null;\n  let why = \"\";\n  try {\n    db = await open();\n  } catch (e) {\n    why = (e as Error).message;\n  }\n  // Frozen: refuse to hand back a mirror that cannot write. Failing at\n  // CONSTRUCTION rather than per write matters — a caller holding a\n  // working-looking mirror would run its whole batch before anyone noticed that\n  // nothing had persisted.\n  if (strict && !db) throw new Error(`SITE_MIRROR unavailable: ${why}`);\n\n  const run = async (siteId: string, op: string, work: (db: Db) => Promise<boolean>) => {\n    if (!db) {\n      console.log(`SITE_MIRROR site=${siteId} op=${op} mirrored=absent reason=${why}`);\n      return;\n    }\n    // Every path below logs EXACTLY ONE line, then strict adds a throw. Logging\n    // first matters: a frozen run that fails should still leave the same trace\n    // in the run log that an unfrozen one would, not just a stack.\n    let matched: boolean;\n    try {\n      matched = await work(db);\n    } catch (e) {\n      console.log(`SITE_MIRROR site=${siteId} op=${op} mirrored=0 error=${(e as Error).message}`);\n      if (strict) throw e;\n      return;\n    }\n    // `missed` is its own outcome: the UPDATE matched no row. Before the freeze\n    // that means the hourly sync has not imported this site yet — a transient,\n    // and reporting it as mirrored=1 would claim a write that never landed.\n    // After the freeze no importer exists, so an absent row stays absent: it is\n    // a bug, not a wait.\n    console.log(`SITE_MIRROR site=${siteId} op=${op} mirrored=${matched ? \"1\" : \"missed\"}`);\n    if (strict && !matched) {\n      throw new Error(`SITE_MIRROR site=${siteId} op=${op}: no such row in Turso`);\n    }\n  };\n\n  return {\n    // An INSERT always lands, so it reports 1 rather than routing a row count\n    // through `missed` — there was nothing to match in the first place.\n    created: (rec) =>\n      run(rec.id, \"created\", async (d) => {\n        await mirrorSiteInsert(d, rec, new Date().toISOString());\n        return true;\n      }),\n    health: (siteId, fields) => run(siteId, \"health\", (d) => mirrorHealthFields(d, siteId, fields)),\n    site: (siteId, fields) => run(siteId, \"site\", (d) => mirrorSiteFields(d, siteId, fields)),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AA2CA,eAAsB,eACpB,OAA0B,MAAM,OAAO,aAAa,CAAC,GAIrD,SAAkB,wBACG;AACrB,MAAI,KAAgB;AACpB,MAAI,MAAM;AACV,MAAI;AACF,SAAK,MAAM,KAAK;AAAA,EAClB,SAAS,GAAG;AACV,UAAO,EAAY;AAAA,EACrB;AAKA,MAAI,UAAU,CAAC,GAAI,OAAM,IAAI,MAAM,4BAA4B,GAAG,EAAE;AAEpE,QAAM,MAAM,OAAO,QAAgB,IAAY,SAAuC;AACpF,QAAI,CAAC,IAAI;AACP,cAAQ,IAAI,oBAAoB,MAAM,OAAO,EAAE,2BAA2B,GAAG,EAAE;AAC/E;AAAA,IACF;AAIA,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,KAAK,EAAE;AAAA,IACzB,SAAS,GAAG;AACV,cAAQ,IAAI,oBAAoB,MAAM,OAAO,EAAE,qBAAsB,EAAY,OAAO,EAAE;AAC1F,UAAI,OAAQ,OAAM;AAClB;AAAA,IACF;AAMA,YAAQ,IAAI,oBAAoB,MAAM,OAAO,EAAE,aAAa,UAAU,MAAM,QAAQ,EAAE;AACtF,QAAI,UAAU,CAAC,SAAS;AACtB,YAAM,IAAI,MAAM,oBAAoB,MAAM,OAAO,EAAE,wBAAwB;AAAA,IAC7E;AAAA,EACF;AAEA,SAAO;AAAA;AAAA;AAAA,IAGL,SAAS,CAAC,QACR,IAAI,IAAI,IAAI,WAAW,OAAO,MAAM;AAClC,YAAM,iBAAiB,GAAG,MAAK,oBAAI,KAAK,GAAE,YAAY,CAAC;AACvD,aAAO;AAAA,IACT,CAAC;AAAA,IACH,QAAQ,CAAC,QAAQ,WAAW,IAAI,QAAQ,UAAU,CAAC,MAAM,mBAAmB,GAAG,QAAQ,MAAM,CAAC;AAAA,IAC9F,MAAM,CAAC,QAAQ,WAAW,IAAI,QAAQ,QAAQ,CAAC,MAAM,iBAAiB,GAAG,QAAQ,MAAM,CAAC;AAAA,EAC1F;AACF;","names":[]}

package/dist/{smoke-suite-U3UKD3NS.js → smoke-suite-4JFZZYVW.js}

@@ -8,14 +8,14 @@ import {
 } from "./chunk-TVL5MVUF.js";
 import {
   resolveSites
-} from "./chunk-CROKUHJB.js";
+} from "./chunk-Q47DU255.js";
 import {
   smokeSuite
 } from "./chunk-Y53WOQIJ.js";
 import "./chunk-R53VL3RI.js";
 import "./chunk-3G25KIWW.js";
-import "./chunk-6TWWY7ZU.js";
-import "./chunk-EVBCK2KC.js";
+import "./chunk-Z3JXLULD.js";
+import "./chunk-RARREDQE.js";
 import "./chunk-XTK5VIQB.js";
 import "./chunk-LBYOLBW7.js";
 import "./chunk-XXTZBPUY.js";
@@ -51,4 +51,4 @@ async function runSmokeSuiteCommand(site, opts) {
 export {
   runSmokeSuiteCommand
 };
-//# sourceMappingURL=smoke-suite-U3UKD3NS.js.map
+//# sourceMappingURL=smoke-suite-4JFZZYVW.js.map

package/dist/{spam-classifier-XLBFCO7G.js → spam-classifier-T5H4VTP6.js}

@@ -1,15 +1,17 @@
 import {
+  BLOCKED_EMAIL_DOMAINS,
   BUYER_KEYWORDS,
   DISPOSABLE_EMAIL_DOMAINS,
   SPAM_KEYWORDS,
   SPAM_THRESHOLD,
   classifySpam
-} from "./chunk-SNSTJLQW.js";
+} from "./chunk-NO74DXDP.js";
 export {
+  BLOCKED_EMAIL_DOMAINS,
   BUYER_KEYWORDS,
   DISPOSABLE_EMAIL_DOMAINS,
   SPAM_KEYWORDS,
   SPAM_THRESHOLD,
   classifySpam
 };
-//# sourceMappingURL=spam-classifier-XLBFCO7G.js.map
+//# sourceMappingURL=spam-classifier-T5H4VTP6.js.map

package/dist/{submissions-IQEJX6FK.js → submissions-TEHPBSZJ.js}

@@ -11,7 +11,7 @@ function parseExtraFields(raw) {
 }
 async function rescoreNewSubmissions(db, opts) {
   const { listSubmissionsFiltered, rescoreSubmissionSpam } = await import("./submissions-3I3GAQAX.js");
-  const { classifySpam, SPAM_THRESHOLD } = await import("./spam-classifier-XLBFCO7G.js");
+  const { classifySpam, SPAM_THRESHOLD } = await import("./spam-classifier-T5H4VTP6.js");
   const rows = [];
   const PAGE = 500;
   for (let offset = 0; ; offset += PAGE) {
@@ -78,8 +78,8 @@ async function runSubmissionsCommand(action, opts) {
     return { output: "--apply and --dry-run conflict. Pick one.", code: 2 };
   }
   const apply = opts.apply === true;
-  const { openDb, readDbConfig } = await import("./client-AUE3XUPO.js");
-  const { SPAM_THRESHOLD } = await import("./spam-classifier-XLBFCO7G.js");
+  const { openDb, readDbConfig } = await import("./client-JYKPVCJX.js");
+  const { SPAM_THRESHOLD } = await import("./spam-classifier-T5H4VTP6.js");
   const cfg = opts.url ? { url: opts.url } : readDbConfig();
   const db = await openDb(cfg);
   const { scanned, flagged } = await rescoreNewSubmissions(db, { apply });
@@ -119,4 +119,4 @@ export {
   rescoreNewSubmissions,
   runSubmissionsCommand
 };
-//# sourceMappingURL=submissions-IQEJX6FK.js.map
+//# sourceMappingURL=submissions-TEHPBSZJ.js.map

package/dist/{svelte-codemods-GOKXTBHW.js → svelte-codemods-QAPDZC6F.js}

@@ -8,14 +8,14 @@ import {
 } from "./chunk-TVL5MVUF.js";
 import {
   resolveSites
-} from "./chunk-CROKUHJB.js";
+} from "./chunk-Q47DU255.js";
 import {
   svelteCodemods
 } from "./chunk-IYSEC543.js";
 import "./chunk-J7SZQUCW.js";
 import "./chunk-3G25KIWW.js";
-import "./chunk-6TWWY7ZU.js";
-import "./chunk-EVBCK2KC.js";
+import "./chunk-Z3JXLULD.js";
+import "./chunk-RARREDQE.js";
 import "./chunk-XTK5VIQB.js";
 import "./chunk-LBYOLBW7.js";
 import "./chunk-XXTZBPUY.js";
@@ -51,4 +51,4 @@ async function runSvelteCodemodsCommand(site, opts) {
 export {
   runSvelteCodemodsCommand
 };
-//# sourceMappingURL=svelte-codemods-GOKXTBHW.js.map
+//# sourceMappingURL=svelte-codemods-QAPDZC6F.js.map

package/dist/{sync-CTUVXMCK.js → sync-GBFV45WX.js}

@@ -1,11 +1,13 @@
 import {
   checkFleetParity,
   formatParityResult
-} from "./chunk-ZBDZTJUO.js";
+} from "./chunk-7FFUBF4I.js";
+import "./chunk-GQDDWYU2.js";
 import {
   formatReapSummary,
   importFleetState
 } from "./chunk-P6AORG32.js";
+import "./chunk-F3JWOPTG.js";
 import "./chunk-VAD43MOR.js";
 import "./chunk-7NYN2P6I.js";
 
@@ -41,4 +43,4 @@ export {
   formatSyncResult,
   syncFleetState
 };
-//# sourceMappingURL=sync-CTUVXMCK.js.map
+//# sourceMappingURL=sync-GBFV45WX.js.map

package/dist/{sync-CTUVXMCK.js.map → sync-GBFV45WX.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/db/sync.ts"],"sourcesContent":["/** Phase 2 backbone of the Airtable → Turso migration (#539): the hourly sync.\n *\n *  In Phase 2 readers move to Turso while writers still write Airtable, so\n *  Turso is only as fresh as the last import. One sync pass = import (with\n *  reportHtml \"when-missing\", so hourly runs don't re-download every report\n *  attachment) followed by the parity check, so every pass both refreshes the\n *  copy and PROVES it converged — the same instrument the whole cutover trusts.\n *\n *  The retry exists for a specific race, not for flakiness: the importer and\n *  the parity check each read Airtable separately, so a write landing between\n *  those two reads makes parity flag rows the import genuinely never saw. One\n *  re-import + re-check converges unless Airtable is being written continuously\n *  — a persistent mismatch after the retry is real drift and must red the run.\n */\nimport type { Db } from \"./client.js\";\nimport {\n  importFleetState,\n  formatReapSummary,\n  type ImportIo,\n  type ImportSummary,\n} from \"./import-airtable.js\";\nimport { checkFleetParity, formatParityResult, type ParityResult } from \"./parity.js\";\n\nexport type SyncResult = {\n  importSummary: ImportSummary;\n  parity: ParityResult;\n  /** True when the first parity check mismatched and the pass re-imported. */\n  retried: boolean;\n};\n\nexport async function syncFleetState(db: Db, io: ImportIo): Promise<SyncResult> {\n  let importSummary = await importFleetState(db, io, { reportHtml: \"when-missing\" });\n  let parity = await checkFleetParity(db, io);\n  let retried = false;\n  if (parity.mismatches.length > 0) {\n    retried = true;\n    importSummary = await importFleetState(db, io, { reportHtml: \"when-missing\" });\n    parity = await checkFleetParity(db, io);\n  }\n  return { importSummary, parity, retried };\n}\n\n/** Human lines plus the machine gate line, emitted on EVERY run (count=0\n *  included) — an absent FLEET_SYNC line means the sync crashed, never that it\n *  was clean. */\nexport function formatSyncResult(r: SyncResult): string {\n  const lines: string[] = [];\n  if (r.importSummary.renderedHtmlMisses.length > 0) {\n    lines.push(\n      `⚠ ${r.importSummary.renderedHtmlMisses.length} report(s) imported WITHOUT Rendered HTML ` +\n        `(fetch failed / URL expired): ${r.importSummary.renderedHtmlMisses.join(\", \")}`,\n    );\n  }\n  // The reap is the only destructive step, so every removal is NAMED and every\n  // refusal is quoted in full. FLEET_REAP rides its own line rather than as new\n  // keys on FLEET_SYNC: the workflow gate greps `^FLEET_SYNC .* mismatches=0$`,\n  // anchored at the end, so extending that line is a contract change waiting to\n  // be got wrong. A separate always-emitted line costs nothing and, like\n  // FLEET_PARITY, means an absent line reads as \"never ran\", not as \"clean\".\n  lines.push(...formatReapSummary(r.importSummary.reaped));\n  if (r.parity.mismatches.length > 0) {\n    lines.push(formatParityResult(r.parity));\n  }\n  lines.push(\n    `FLEET_SYNC sites=${r.importSummary.sites} reports=${r.importSummary.reports} ` +\n      `html_fetched=${r.importSummary.renderedHtmlFetched} ` +\n      `html_skipped=${r.importSummary.renderedHtmlSkipped} ` +\n      `retried=${r.retried ? 1 : 0} mismatches=${r.parity.mismatches.length}`,\n  );\n  return lines.join(\"\\n\");\n}\n"],"mappings":";;;;;;;;;;;;AA8BA,eAAsB,eAAe,IAAQ,IAAmC;AAC9E,MAAI,gBAAgB,MAAM,iBAAiB,IAAI,IAAI,EAAE,YAAY,eAAe,CAAC;AACjF,MAAI,SAAS,MAAM,iBAAiB,IAAI,EAAE;AAC1C,MAAI,UAAU;AACd,MAAI,OAAO,WAAW,SAAS,GAAG;AAChC,cAAU;AACV,oBAAgB,MAAM,iBAAiB,IAAI,IAAI,EAAE,YAAY,eAAe,CAAC;AAC7E,aAAS,MAAM,iBAAiB,IAAI,EAAE;AAAA,EACxC;AACA,SAAO,EAAE,eAAe,QAAQ,QAAQ;AAC1C;AAKO,SAAS,iBAAiB,GAAuB;AACtD,QAAM,QAAkB,CAAC;AACzB,MAAI,EAAE,cAAc,mBAAmB,SAAS,GAAG;AACjD,UAAM;AAAA,MACJ,UAAK,EAAE,cAAc,mBAAmB,MAAM,2EACX,EAAE,cAAc,mBAAmB,KAAK,IAAI,CAAC;AAAA,IAClF;AAAA,EACF;AAOA,QAAM,KAAK,GAAG,kBAAkB,EAAE,cAAc,MAAM,CAAC;AACvD,MAAI,EAAE,OAAO,WAAW,SAAS,GAAG;AAClC,UAAM,KAAK,mBAAmB,EAAE,MAAM,CAAC;AAAA,EACzC;AACA,QAAM;AAAA,IACJ,oBAAoB,EAAE,cAAc,KAAK,YAAY,EAAE,cAAc,OAAO,iBAC1D,EAAE,cAAc,mBAAmB,iBACnC,EAAE,cAAc,mBAAmB,YACxC,EAAE,UAAU,IAAI,CAAC,eAAe,EAAE,OAAO,WAAW,MAAM;AAAA,EACzE;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;","names":[]}
+{"version":3,"sources":["../src/db/sync.ts"],"sourcesContent":["/** Phase 2 backbone of the Airtable → Turso migration (#539): the hourly sync.\n *\n *  In Phase 2 readers move to Turso while writers still write Airtable, so\n *  Turso is only as fresh as the last import. One sync pass = import (with\n *  reportHtml \"when-missing\", so hourly runs don't re-download every report\n *  attachment) followed by the parity check, so every pass both refreshes the\n *  copy and PROVES it converged — the same instrument the whole cutover trusts.\n *\n *  The retry exists for a specific race, not for flakiness: the importer and\n *  the parity check each read Airtable separately, so a write landing between\n *  those two reads makes parity flag rows the import genuinely never saw. One\n *  re-import + re-check converges unless Airtable is being written continuously\n *  — a persistent mismatch after the retry is real drift and must red the run.\n */\nimport type { Db } from \"./client.js\";\nimport {\n  importFleetState,\n  formatReapSummary,\n  type ImportIo,\n  type ImportSummary,\n} from \"./import-airtable.js\";\nimport { checkFleetParity, formatParityResult, type ParityResult } from \"./parity.js\";\n\nexport type SyncResult = {\n  importSummary: ImportSummary;\n  parity: ParityResult;\n  /** True when the first parity check mismatched and the pass re-imported. */\n  retried: boolean;\n};\n\nexport async function syncFleetState(db: Db, io: ImportIo): Promise<SyncResult> {\n  let importSummary = await importFleetState(db, io, { reportHtml: \"when-missing\" });\n  let parity = await checkFleetParity(db, io);\n  let retried = false;\n  if (parity.mismatches.length > 0) {\n    retried = true;\n    importSummary = await importFleetState(db, io, { reportHtml: \"when-missing\" });\n    parity = await checkFleetParity(db, io);\n  }\n  return { importSummary, parity, retried };\n}\n\n/** Human lines plus the machine gate line, emitted on EVERY run (count=0\n *  included) — an absent FLEET_SYNC line means the sync crashed, never that it\n *  was clean. */\nexport function formatSyncResult(r: SyncResult): string {\n  const lines: string[] = [];\n  if (r.importSummary.renderedHtmlMisses.length > 0) {\n    lines.push(\n      `⚠ ${r.importSummary.renderedHtmlMisses.length} report(s) imported WITHOUT Rendered HTML ` +\n        `(fetch failed / URL expired): ${r.importSummary.renderedHtmlMisses.join(\", \")}`,\n    );\n  }\n  // The reap is the only destructive step, so every removal is NAMED and every\n  // refusal is quoted in full. FLEET_REAP rides its own line rather than as new\n  // keys on FLEET_SYNC: the workflow gate greps `^FLEET_SYNC .* mismatches=0$`,\n  // anchored at the end, so extending that line is a contract change waiting to\n  // be got wrong. A separate always-emitted line costs nothing and, like\n  // FLEET_PARITY, means an absent line reads as \"never ran\", not as \"clean\".\n  lines.push(...formatReapSummary(r.importSummary.reaped));\n  if (r.parity.mismatches.length > 0) {\n    lines.push(formatParityResult(r.parity));\n  }\n  lines.push(\n    `FLEET_SYNC sites=${r.importSummary.sites} reports=${r.importSummary.reports} ` +\n      `html_fetched=${r.importSummary.renderedHtmlFetched} ` +\n      `html_skipped=${r.importSummary.renderedHtmlSkipped} ` +\n      `retried=${r.retried ? 1 : 0} mismatches=${r.parity.mismatches.length}`,\n  );\n  return lines.join(\"\\n\");\n}\n"],"mappings":";;;;;;;;;;;;;;AA8BA,eAAsB,eAAe,IAAQ,IAAmC;AAC9E,MAAI,gBAAgB,MAAM,iBAAiB,IAAI,IAAI,EAAE,YAAY,eAAe,CAAC;AACjF,MAAI,SAAS,MAAM,iBAAiB,IAAI,EAAE;AAC1C,MAAI,UAAU;AACd,MAAI,OAAO,WAAW,SAAS,GAAG;AAChC,cAAU;AACV,oBAAgB,MAAM,iBAAiB,IAAI,IAAI,EAAE,YAAY,eAAe,CAAC;AAC7E,aAAS,MAAM,iBAAiB,IAAI,EAAE;AAAA,EACxC;AACA,SAAO,EAAE,eAAe,QAAQ,QAAQ;AAC1C;AAKO,SAAS,iBAAiB,GAAuB;AACtD,QAAM,QAAkB,CAAC;AACzB,MAAI,EAAE,cAAc,mBAAmB,SAAS,GAAG;AACjD,UAAM;AAAA,MACJ,UAAK,EAAE,cAAc,mBAAmB,MAAM,2EACX,EAAE,cAAc,mBAAmB,KAAK,IAAI,CAAC;AAAA,IAClF;AAAA,EACF;AAOA,QAAM,KAAK,GAAG,kBAAkB,EAAE,cAAc,MAAM,CAAC;AACvD,MAAI,EAAE,OAAO,WAAW,SAAS,GAAG;AAClC,UAAM,KAAK,mBAAmB,EAAE,MAAM,CAAC;AAAA,EACzC;AACA,QAAM;AAAA,IACJ,oBAAoB,EAAE,cAAc,KAAK,YAAY,EAAE,cAAc,OAAO,iBAC1D,EAAE,cAAc,mBAAmB,iBACnC,EAAE,cAAc,mBAAmB,YACxC,EAAE,UAAU,IAAI,CAAC,eAAe,EAAE,OAAO,WAAW,MAAM;AAAA,EACzE;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;","names":[]}

package/dist/{sync-configs-SPTLFJCC.js → sync-configs-34JIA6KZ.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-TVL5MVUF.js";
 import {
   resolveSites
-} from "./chunk-CROKUHJB.js";
+} from "./chunk-Q47DU255.js";
 import {
   ALL_CONFIG_NAMES,
   CANONICAL_GITIGNORE_ENTRIES,
@@ -21,8 +21,8 @@ import {
   templatesByName
 } from "./chunk-73UFRZKY.js";
 import "./chunk-3G25KIWW.js";
-import "./chunk-6TWWY7ZU.js";
-import "./chunk-EVBCK2KC.js";
+import "./chunk-Z3JXLULD.js";
+import "./chunk-RARREDQE.js";
 import "./chunk-XTK5VIQB.js";
 import "./chunk-LBYOLBW7.js";
 import "./chunk-XXTZBPUY.js";
@@ -113,4 +113,4 @@ async function runSyncConfigsCommand(site, opts) {
 export {
   runSyncConfigsCommand
 };
-//# sourceMappingURL=sync-configs-SPTLFJCC.js.map
+//# sourceMappingURL=sync-configs-34JIA6KZ.js.map