@reddoorla/maintenance 0.87.0 → 0.88.3

package/dist/airtable-QG5ICI3Y.js

@@ -0,0 +1,9 @@
+import {
+  fromAirtableBase
+} from "./chunk-PR343K7F.js";
+import "./chunk-7NYN2P6I.js";
+import "./chunk-RARREDQE.js";
+export {
+  fromAirtableBase
+};
+//# sourceMappingURL=airtable-QG5ICI3Y.js.map

package/dist/{announce-I2Z4JN3I.js → announce-GKD5YJNB.js}

@@ -1,12 +1,12 @@
 import {
   scoresFromRow
-} from "./chunk-HEWSRXYV.js";
+} from "./chunk-ULHPALI5.js";
 import {
   fetchGaUsers,
   fetchSearch,
   readGaConfig,
   refreshHeaderImage
-} from "./chunk-BBUSGEES.js";
+} from "./chunk-J3WEZGIN.js";
 import {
   queueDraft
 } from "./chunk-YFAXOD7Z.js";
@@ -26,19 +26,19 @@ import {
 import {
   defaultReportSubject
 } from "./chunk-GECESMVS.js";
+import "./chunk-5UINJNAJ.js";
 import {
   announcementSiteExtras,
   renderReportHtml,
   resolveCopy
-} from "./chunk-MT2JINSS.js";
-import "./chunk-DJZWYIPP.js";
-import "./chunk-5UINJNAJ.js";
+} from "./chunk-KJGKZLCT.js";
+import "./chunk-BGTYPVLT.js";
 import {
   listWebsites,
   siteSlug,
   updateAnalyticsHealth
 } from "./chunk-7NYN2P6I.js";
-import "./chunk-EVBCK2KC.js";
+import "./chunk-RARREDQE.js";
 import "./chunk-6VAL7XJT.js";
 
 // src/recipes/announce.ts
@@ -203,8 +203,8 @@ function formatAnnounceResult(result) {
   return result.results.map(formatSiteResult).join("\n");
 }
 async function runAnnounceCommand(site, _opts) {
-  const { makeReportMirror } = await import("./report-mirror-4MNORYQ4.js");
-  const { makeSiteMirror } = await import("./site-mirror-NIREX5ME.js");
+  const { makeReportMirror } = await import("./report-mirror-AAK3MXHY.js");
+  const { makeSiteMirror } = await import("./site-mirror-Q763PLGG.js");
   const reportMirror = await makeReportMirror();
   const siteMirror = await makeSiteMirror();
   const result = await announce({ ...site ? { site } : {}, reportMirror, siteMirror });
@@ -215,4 +215,4 @@ export {
   formatAnnounceResult,
   runAnnounceCommand
 };
-//# sourceMappingURL=announce-I2Z4JN3I.js.map
+//# sourceMappingURL=announce-GKD5YJNB.js.map

package/dist/{blux-ZGDSHI3U.js → blux-EATHOHKK.js}

@@ -1,7 +1,3 @@
-import {
-  assetRef,
-  richText
-} from "./chunk-UWJZXL2D.js";
 import {
   FROZEN_PAGE_TYPE,
   extractMapConfig,
@@ -12,6 +8,10 @@ import {
   CDN_HOSTS,
   collectAssetUrls
 } from "./chunk-SL24DCGC.js";
+import {
+  assetRef,
+  richText
+} from "./chunk-UWJZXL2D.js";
 
 // src/cli/commands/blux.ts
 import { readFile, writeFile, mkdir } from "fs/promises";
@@ -4767,4 +4767,4 @@ ${lines.join("\n")}`,
 export {
   runBluxCommand
 };
-//# sourceMappingURL=blux-ZGDSHI3U.js.map
+//# sourceMappingURL=blux-EATHOHKK.js.map

package/dist/{bump-deps-CGVELRLK.js → bump-deps-KGH5UYSF.js}

@@ -8,13 +8,13 @@ import {
 } from "./chunk-TVL5MVUF.js";
 import {
   resolveSites
-} from "./chunk-CROKUHJB.js";
+} from "./chunk-Q47DU255.js";
 import {
   bumpDeps
 } from "./chunk-2NJQLSEU.js";
 import "./chunk-3G25KIWW.js";
-import "./chunk-6TWWY7ZU.js";
-import "./chunk-EVBCK2KC.js";
+import "./chunk-Z3JXLULD.js";
+import "./chunk-RARREDQE.js";
 import "./chunk-XTK5VIQB.js";
 import "./chunk-LBYOLBW7.js";
 import "./chunk-XXTZBPUY.js";
@@ -57,4 +57,4 @@ async function runBumpDepsCommand(site, opts) {
 export {
   runBumpDepsCommand
 };
-//# sourceMappingURL=bump-deps-CGVELRLK.js.map
+//# sourceMappingURL=bump-deps-KGH5UYSF.js.map

package/dist/{chunk-SDDPUAWH.js → chunk-6I6L3CMX.js}

@@ -5,7 +5,7 @@ import {
 import {
   isProbablyEmail,
   parseAddresses
-} from "./chunk-NDWYJLRF.js";
+} from "./chunk-DGZWFI2G.js";
 import {
   listAllReports
 } from "./chunk-F3JWOPTG.js";
@@ -341,4 +341,4 @@ export {
   preflight,
   approveBlockers
 };
-//# sourceMappingURL=chunk-SDDPUAWH.js.map
+//# sourceMappingURL=chunk-6I6L3CMX.js.map

package/dist/{chunk-NXNPDCF3.js → chunk-6UCVWYDA.js}

@@ -1,3 +1,6 @@
+import {
+  TURSO_IS_AUTHORITATIVE
+} from "./chunk-RUPPWAD6.js";
 import {
   hasRealScores,
   lighthouseScoresFromResult
@@ -278,6 +281,12 @@ async function writeAuditsToAirtable(args) {
   }
   return { siteName: target.name, writes, events, siteId: target.id, fields };
 }
+function fleetWriteFailed(result, strict = TURSO_IS_AUTHORITATIVE) {
+  if (result.failed.length > 0) return true;
+  if (!strict) return false;
+  if (result.mirrored === void 0) return true;
+  return (result.mirrorFailed ?? 0) > 0 || (result.mirrorMissed ?? 0) > 0;
+}
 function formatFleetWriteSummary(result) {
   const wrote = result.written.length;
   const failed = result.failed.length;
@@ -330,7 +339,8 @@ async function writeFleetAuditsToAirtable(args) {
 
 export {
   writeAuditsToAirtable,
+  fleetWriteFailed,
   formatFleetWriteSummary,
   writeFleetAuditsToAirtable
 };
-//# sourceMappingURL=chunk-NXNPDCF3.js.map
+//# sourceMappingURL=chunk-6UCVWYDA.js.map

package/dist/chunk-6UCVWYDA.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/audits/a11y-airtable.ts","../src/audits/deps-airtable.ts","../src/audits/security-airtable.ts","../src/audits/domain-airtable.ts","../src/audits/browser-airtable.ts","../src/audits/netlify-deploy-airtable.ts","../src/audits/function-health-airtable.ts","../src/audits/smoke-airtable.ts","../src/audits/form-e2e-airtable.ts","../src/audits/write-audits-to-airtable.ts"],"sourcesContent":["import type { AuditResult } from \"../types.js\";\n\ntype A11yDetails = {\n  totalViolations: number;\n  byImpact: Partial<Record<\"minor\" | \"moderate\" | \"serious\" | \"critical\", number>>;\n};\n\n/** True when an a11y AuditResult carries real counts worth persisting.\n *  Mirrors the `hasRealScores` policy on lighthouse: write whenever real\n *  data exists, regardless of status (a \"warn\" or \"fail\" with concrete\n *  violation counts is exactly what the dashboard needs to track). */\nexport function hasA11yCounts(result: AuditResult): boolean {\n  if (result.audit !== \"a11y\") return false;\n  const details = result.details as A11yDetails | undefined;\n  return typeof details?.totalViolations === \"number\";\n}\n\nexport function a11yCountsFromResult(result: AuditResult): { violations: number } {\n  if (result.audit !== \"a11y\") {\n    throw new Error(`Expected an 'a11y' AuditResult, got '${result.audit}'`);\n  }\n  const details = result.details as A11yDetails | undefined;\n  return { violations: details?.totalViolations ?? 0 };\n}\n","import type { AuditResult } from \"../types.js\";\nimport type { DepsDetails, DepsDriftEntry } from \"./deps.js\";\n\n/** True when a deps AuditResult carries the structured details (an entries\n *  array, per {@link DepsDetails}). */\nexport function hasDepsCounts(result: AuditResult): boolean {\n  if (result.audit !== \"deps\") return false;\n  const d = result.details as Partial<DepsDetails> | undefined;\n  return Array.isArray(d?.entries);\n}\n\nexport function depsCountsFromResult(result: AuditResult): {\n  drifted: number;\n  majorBehind: number;\n  outdated: number | null;\n  majorOutdated: number | null;\n} {\n  if (result.audit !== \"deps\") {\n    throw new Error(`Expected a 'deps' AuditResult, got '${result.audit}'`);\n  }\n  const details = (result.details ?? {}) as Partial<DepsDetails>;\n  const entries = (details.entries ?? []) as DepsDriftEntry[];\n  // \"drifted\" = drift !== \"same\", which intentionally includes \"newer\" (ahead of\n  // baseline) — parity with the deps audit summary text.\n  const drifted = entries.filter((e) => e.drift !== \"same\").length;\n  const majorBehind = entries.filter((e) => e.drift === \"major\").length;\n  // The real installed-version drift, distinct from declared-range drift. Null\n  // when the audit couldn't determine it (no/stale lockfile) — kept null (not 0)\n  // so the dashboard shows \"—\" rather than a misleading \"clean\".\n  const outdated = details.outdated?.outdated ?? null;\n  // How many of those outdated installs are a *major* behind the registry's\n  // latest — surfaced separately from the total so the cockpit can show\n  // \"N major\" available, distinct from the baseline-drift \"major\" count. Shares\n  // the outdated signal's null-when-undetermined semantics.\n  const majorOutdated = details.outdated?.major ?? null;\n  return { drifted, majorBehind, outdated, majorOutdated };\n}\n","import type { AuditResult } from \"../types.js\";\nimport { normalizeSecurityAdvisory, type SecurityAdvisory } from \"../reports/airtable/websites.js\";\n\ntype SecurityDetails = {\n  counts: { low: number; moderate: number; high: number; critical: number };\n  advisories?: unknown;\n};\n\n/** True when a security AuditResult carries a counts object. Skipped runs\n *  (no pnpm + no npm) have no details and return false. */\nexport function hasSecurityCounts(result: AuditResult): boolean {\n  if (result.audit !== \"security\") return false;\n  const details = result.details as SecurityDetails | undefined;\n  return !!details && typeof details.counts === \"object\";\n}\n\nexport function securityCountsFromResult(result: AuditResult): {\n  critical: number;\n  high: number;\n  moderate: number;\n  low: number;\n} {\n  if (result.audit !== \"security\") {\n    throw new Error(`Expected a 'security' AuditResult, got '${result.audit}'`);\n  }\n  const details = result.details as SecurityDetails | undefined;\n  const c = details?.counts ?? { low: 0, moderate: 0, high: 0, critical: 0 };\n  return { critical: c.critical, high: c.high, moderate: c.moderate, low: c.low };\n}\n\n/** The known advisories behind the counts, normalized for persistence. Empty when the\n *  run was clean or carried no advisory detail (npm/pnpm sometimes omit it). Malformed\n *  entries are dropped via the shared `normalizeSecurityAdvisory`. */\nexport function advisoriesFromResult(result: AuditResult): SecurityAdvisory[] {\n  if (result.audit !== \"security\") {\n    throw new Error(`Expected a 'security' AuditResult, got '${result.audit}'`);\n  }\n  const details = result.details as SecurityDetails | undefined;\n  const raw = details?.advisories;\n  if (!Array.isArray(raw)) return [];\n  return raw.map(normalizeSecurityAdvisory).filter((a): a is SecurityAdvisory => a !== null);\n}\n","import type { AuditResult } from \"../types.js\";\nimport type { DomainResult } from \"../reports/airtable/websites.js\";\n\ntype DomainDetails = { resolved: boolean; certDaysRemaining: number | null; checkedAt: string };\n\n/** True when an AuditResult is a `domain` audit carrying a usable details payload (i.e. it\n *  actually ran — a \"skip\" for a site with no deployed URL has no details). */\nexport function hasDomainResult(result: AuditResult): boolean {\n  if (result.audit !== \"domain\") return false;\n  const d = result.details as DomainDetails | undefined;\n  return !!d && typeof d.checkedAt === \"string\";\n}\n\n/** Extract the Airtable-writable domain result (cert days + checked-at) from a `domain` audit. */\nexport function domainResultFromAudit(result: AuditResult): DomainResult {\n  if (result.audit !== \"domain\") {\n    throw new Error(`Expected a 'domain' AuditResult, got '${result.audit}'`);\n  }\n  const d = result.details as DomainDetails | undefined;\n  return {\n    certDaysRemaining: typeof d?.certDaysRemaining === \"number\" ? d.certDaysRemaining : null,\n    checkedAt: typeof d?.checkedAt === \"string\" ? d.checkedAt : new Date().toISOString(),\n  };\n}\n","import type { AuditResult } from \"../types.js\";\nimport type { BrowserAuditFields } from \"../reports/airtable/websites.js\";\n\ntype BrowserDetails = {\n  desktopOk: boolean;\n  mobileOk: boolean;\n  linksOk: boolean;\n  reachableOk: boolean;\n  titleMetaOk: boolean;\n  brokenLinks: number;\n  checkedAt: string;\n};\n\n/** True when an AuditResult is a `browser` audit that actually ran (has a details payload — a\n *  \"skip\" for a site with no deployed URL has none). */\nexport function hasBrowserResult(result: AuditResult): boolean {\n  if (result.audit !== \"browser\") return false;\n  const d = result.details as BrowserDetails | undefined;\n  return !!d && typeof d.checkedAt === \"string\";\n}\n\n/** Extract the Airtable-writable browser verdicts from a `browser` audit. */\nexport function browserFieldsFromAudit(result: AuditResult): BrowserAuditFields {\n  if (result.audit !== \"browser\") {\n    throw new Error(`Expected a 'browser' AuditResult, got '${result.audit}'`);\n  }\n  const d = result.details as BrowserDetails | undefined;\n  return {\n    desktopOk: d?.desktopOk === true,\n    mobileOk: d?.mobileOk === true,\n    linksOk: d?.linksOk === true,\n    reachableOk: d?.reachableOk === true,\n    titleMetaOk: d?.titleMetaOk === true,\n    brokenLinks: typeof d?.brokenLinks === \"number\" ? d.brokenLinks : 0,\n    checkedAt: typeof d?.checkedAt === \"string\" ? d.checkedAt : new Date().toISOString(),\n  };\n}\n","import type { AuditResult } from \"../types.js\";\nimport type { NetlifyDeployResult } from \"../reports/airtable/websites.js\";\n\ntype NetlifyDeployDetails = {\n  state: string | null;\n  deployedAt: string | null;\n  logUrl: string | null;\n  checkedAt: string;\n};\n\n/** True when an AuditResult is a `netlify-deploy` audit carrying a usable details\n *  payload (i.e. it actually ran — a \"skip\" for a site with no Netlify id / no\n *  token has no details). */\nexport function hasNetlifyDeployResult(result: AuditResult): boolean {\n  if (result.audit !== \"netlify-deploy\") return false;\n  const d = result.details as NetlifyDeployDetails | undefined;\n  return !!d && typeof d.checkedAt === \"string\";\n}\n\n/** Extract the Airtable-writable deploy result (state + deployedAt + logUrl +\n *  checkedAt) from a `netlify-deploy` audit. */\nexport function netlifyDeployResultFromAudit(result: AuditResult): NetlifyDeployResult {\n  if (result.audit !== \"netlify-deploy\") {\n    throw new Error(`Expected a 'netlify-deploy' AuditResult, got '${result.audit}'`);\n  }\n  const d = result.details as NetlifyDeployDetails | undefined;\n  return {\n    state: typeof d?.state === \"string\" ? d.state : null,\n    deployedAt: typeof d?.deployedAt === \"string\" ? d.deployedAt : null,\n    logUrl: typeof d?.logUrl === \"string\" ? d.logUrl : null,\n    checkedAt: typeof d?.checkedAt === \"string\" ? d.checkedAt : new Date().toISOString(),\n  };\n}\n","import type { AuditResult } from \"../types.js\";\nimport type { FunctionHealthResult } from \"../reports/airtable/websites.js\";\n\ntype FunctionHealthDetails = {\n  ok: boolean;\n  prismic: \"ok\" | \"error\" | \"skipped\" | null;\n  forms: unknown;\n  checkedAt: string;\n};\n\n/** True when an AuditResult is a `function-health` audit carrying a usable details payload (i.e. it\n *  actually ran — a self-skip for an unreachable / non-JSON `/health`, or a site with no deployed\n *  URL, has no details, so the writer preserves the prior verdict). */\nexport function hasFunctionHealthResult(result: AuditResult): boolean {\n  if (result.audit !== \"function-health\") return false;\n  const d = result.details as FunctionHealthDetails | undefined;\n  return !!d && typeof d.checkedAt === \"string\";\n}\n\n/** Extract the Airtable-writable function-health verdicts. `functionHealth` from `ok`; `cmsReachable`\n *  from the same body's `prismic` sub-status (R2.2): `\"ok\"` → `\"pass\"`, `\"error\"` → `\"fail\"`, and\n *  anything else (`\"skipped\"` — a placeholder repo, or a raw `null` from a \"deployed but erroring\"\n *  body / an unrecognized value) → `null` — the CMS probe never actually ran, so it must not red CMS\n *  reachability for a site that simply hasn't wired Prismic yet. Only `functionHealth` keys off\n *  `ok`. */\nexport function functionHealthResultFromAudit(result: AuditResult): FunctionHealthResult {\n  if (result.audit !== \"function-health\") {\n    throw new Error(`Expected a 'function-health' AuditResult, got '${result.audit}'`);\n  }\n  const d = result.details as FunctionHealthDetails | undefined;\n  const cmsReachable: \"pass\" | \"fail\" | null =\n    d?.prismic === \"ok\" ? \"pass\" : d?.prismic === \"error\" ? \"fail\" : null;\n  // `forms` is untyped on the details payload (unknown) — validate defensively. A boolean\n  // `turnstile` inside an object → concrete verdict; anything else (null forms from an older\n  // site package or a \"deployed but erroring\" body, a malformed shape) → null: the widget\n  // state is simply unknown this run, never a fail. Powers the Require-Turnstile guardrail.\n  const formsRaw = d?.forms;\n  const turnstileFlag =\n    formsRaw && typeof formsRaw === \"object\"\n      ? (formsRaw as Record<string, unknown>)[\"turnstile\"]\n      : undefined;\n  const turnstileWidget: \"pass\" | \"fail\" | null =\n    typeof turnstileFlag === \"boolean\" ? (turnstileFlag ? \"pass\" : \"fail\") : null;\n  return {\n    functionHealth: d?.ok === true ? \"pass\" : \"fail\",\n    cmsReachable,\n    turnstileWidget,\n    checkedAt: typeof d?.checkedAt === \"string\" ? d.checkedAt : new Date().toISOString(),\n  };\n}\n","import type { AuditResult } from \"../types.js\";\nimport type { SmokeResult } from \"../reports/airtable/websites.js\";\n\ntype SmokeDetails = { ok: \"pass\" | \"fail\"; checkedAt: string };\n\n/** True when an AuditResult is a `smoke` audit that actually ran (has details with\n *  a checkedAt — a \"skip\" for a missing `pnpm`/`test:smoke` script has none, so the\n *  writer preserves the prior verdict). */\nexport function hasSmokeResult(result: AuditResult): boolean {\n  if (result.audit !== \"smoke\") return false;\n  const d = result.details as SmokeDetails | undefined;\n  return !!d && typeof d.checkedAt === \"string\";\n}\n\n/** Extract the Airtable-writable smoke verdict (pass/fail + checked-at). */\nexport function smokeResultFromAudit(result: AuditResult): SmokeResult {\n  if (result.audit !== \"smoke\") {\n    throw new Error(`Expected a 'smoke' AuditResult, got '${result.audit}'`);\n  }\n  const d = result.details as SmokeDetails | undefined;\n  return {\n    ok: d?.ok === \"fail\" ? \"fail\" : \"pass\",\n    checkedAt: typeof d?.checkedAt === \"string\" ? d.checkedAt : new Date().toISOString(),\n  };\n}\n","import type { AuditResult } from \"../types.js\";\nimport type { FormE2eResult } from \"../reports/airtable/websites.js\";\n\ntype FormE2eDetails = { ok: \"pass\" | \"fail\" | null; formPresent: boolean; checkedAt: string };\n\n/** True when an AuditResult is a `form-e2e` audit that actually RAN (has details\n *  with a checkedAt). Both a real verdict AND the no-form n/a case carry a checkedAt,\n *  so both persist; only a no-deployed-URL skip (no details) is preserved-prior. */\nexport function hasFormE2eResult(result: AuditResult): boolean {\n  if (result.audit !== \"form-e2e\") return false;\n  const d = result.details as FormE2eDetails | undefined;\n  return !!d && typeof d.checkedAt === \"string\";\n}\n\n/** Extract the Airtable-writable form-e2e verdict (pass/fail/null + checked-at). */\nexport function formE2eResultFromAudit(result: AuditResult): FormE2eResult {\n  if (result.audit !== \"form-e2e\") {\n    throw new Error(`Expected a 'form-e2e' AuditResult, got '${result.audit}'`);\n  }\n  const d = result.details as FormE2eDetails | undefined;\n  const ok = d?.ok === \"pass\" ? \"pass\" : d?.ok === \"fail\" ? \"fail\" : null;\n  return {\n    ok,\n    checkedAt: typeof d?.checkedAt === \"string\" ? d.checkedAt : new Date().toISOString(),\n  };\n}\n","import type { FieldSet } from \"airtable\";\nimport type { AuditResult } from \"../types.js\";\nimport type { AirtableBase } from \"../reports/airtable/client.js\";\nimport type { HealthMirror } from \"./health-mirror.js\";\nimport { TURSO_IS_AUTHORITATIVE } from \"../db/freeze.js\";\nimport { type WebsiteRow, siteSlug, updateAuditFields } from \"../reports/airtable/websites.js\";\nimport type {\n  A11yCounts,\n  DepsCounts,\n  SecurityCounts,\n  SecurityAdvisory,\n  DomainResult,\n  BrowserAuditFields,\n  NetlifyDeployResult,\n  FunctionHealthResult,\n  SmokeResult,\n  FormE2eResult,\n} from \"../reports/airtable/websites.js\";\nimport type { LighthouseScoreWriteback } from \"../reports/types.js\";\nimport { hasRealScores, lighthouseScoresFromResult } from \"./lighthouse-airtable.js\";\nimport { hasA11yCounts, a11yCountsFromResult } from \"./a11y-airtable.js\";\nimport { hasDepsCounts, depsCountsFromResult } from \"./deps-airtable.js\";\nimport {\n  hasSecurityCounts,\n  securityCountsFromResult,\n  advisoriesFromResult,\n} from \"./security-airtable.js\";\nimport { hasDomainResult, domainResultFromAudit } from \"./domain-airtable.js\";\nimport { hasBrowserResult, browserFieldsFromAudit } from \"./browser-airtable.js\";\nimport { hasNetlifyDeployResult, netlifyDeployResultFromAudit } from \"./netlify-deploy-airtable.js\";\nimport {\n  hasFunctionHealthResult,\n  functionHealthResultFromAudit,\n} from \"./function-health-airtable.js\";\nimport { hasSmokeResult, smokeResultFromAudit } from \"./smoke-airtable.js\";\nimport { hasFormE2eResult, formE2eResultFromAudit } from \"./form-e2e-airtable.js\";\nimport { detectAuditEvents } from \"./fleet-event-detectors.js\";\nimport type { FleetEvent } from \"../db/fleet-events.js\";\n\ntype WriteSummary = {\n  siteName: string;\n  writes: Array<{\n    audit:\n      | \"lighthouse\"\n      | \"a11y\"\n      | \"deps\"\n      | \"security\"\n      | \"github-signals\"\n      | \"domain\"\n      | \"browser\"\n      | \"netlify-deploy\"\n      | \"function-health\"\n      | \"smoke\"\n      | \"form-e2e\"\n      // Not an audit: the nightly Prismic model sweep reuses this result shape so\n      // its write-back reports through the same `FLEET_WRITE_SUMMARY` line every\n      // other fleet writer emits, rather than inventing a second contract for CI\n      // to grep.\n      | \"prismic-models\";\n    counts: object;\n  }>;\n  /** Fleet-activity events detected from this site's prior row vs the fresh audits.\n   *  Optional: only the fleet path records them; the single-site path ignores them. */\n  events?: FleetEvent[];\n  /** The Websites rec id + the merged FieldSet actually written — what the\n   *  Phase 3 Turso mirror consumes, so mirror and Airtable write share ONE\n   *  payload. Populated by writeAuditsToAirtable; other WriteSummary\n   *  producers (prismic-models, github-signals) don't carry them. */\n  siteId?: string;\n  fields?: FieldSet;\n};\n\n/** Orchestrates the per-audit Airtable writes for `audit --write-airtable`.\n *  Extracted from the CLI command so it can be unit-tested with a fake base\n *  and so adding new audit types is a one-line addition here rather than\n *  growing the CLI handler.\n *\n *  Throws (with .exitCode set) on the failure modes the CLI surfaces today:\n *   - 2: --only ran without lighthouse, or no Websites row matched the slug\n *   - 1: lighthouse ran but produced no real scores (infrastructure failure).\n *        The a11y/deps/security writes still complete FIRST — a Lighthouse\n *        miss flags the site without discarding its other audit data.\n *\n *  Precedence note: the Websites-row lookup (exitCode 2) is checked BEFORE the\n *  no-scores gate (exitCode 1), so the rare no-row + no-scores combo surfaces\n *  as exitCode 2. */\nexport async function writeAuditsToAirtable(args: {\n  base: AirtableBase;\n  websites: WebsiteRow[];\n  slug: string;\n  results: AuditResult[];\n}): Promise<WriteSummary> {\n  const { base, websites, slug, results } = args;\n\n  // Lighthouse is OPTIONAL. The checkout-free `--only lighthouse,domain,browser` nightly includes\n  // it, but a standalone `--only security` (checkout-ful) sweep legitimately has none. We write\n  // whatever audits produced values; only the lighthouse-MISS flag below is lighthouse-specific\n  // (so a real Lighthouse infra failure still reds the run without discarding other audit data).\n  const lhResult = results.find((r) => r.audit === \"lighthouse\");\n  const target = websites.find((w) => siteSlug(w.name) === slug);\n  if (!target) {\n    throw Object.assign(new Error(`No Websites row matched slug \"${slug}\"`), { exitCode: 2 });\n  }\n\n  const writes: WriteSummary[\"writes\"] = [];\n  const audits: {\n    scores?: LighthouseScoreWriteback;\n    a11y?: A11yCounts;\n    deps?: DepsCounts;\n    security?: SecurityCounts;\n    securityAdvisories?: SecurityAdvisory[];\n    domain?: DomainResult;\n    browser?: BrowserAuditFields;\n    netlifyDeploy?: NetlifyDeployResult;\n    functionHealth?: FunctionHealthResult;\n    smoke?: SmokeResult;\n    formE2e?: FormE2eResult;\n  } = {};\n\n  // Collect every audit that produced real values into ONE merged input, then do a\n  // SINGLE atomic Airtable update (was: up to four sequential updates on the same\n  // row — a mid-sequence failure left it half-written yet reported fully failed, at\n  // 4× the request volume). Lighthouse is the most timeout-prone audit: a Lighthouse\n  // miss must NOT discard the site's valid a11y/deps/security results (morning-brief\n  // 2026-06-10 MEDIUM-E). So include Lighthouse scores only when real, include the\n  // other audits whenever present, write all of them in one update, then — if\n  // Lighthouse missed — throw AFTER that atomic write so the site is still flagged\n  // (exitCode 1 / collected in FleetWriteResult.failed) without losing its other data.\n  const lhHasScores = lhResult ? hasRealScores(lhResult) : false;\n  if (lhResult && lhHasScores) {\n    const scores = lighthouseScoresFromResult(lhResult);\n    audits.scores = scores;\n    writes.push({ audit: \"lighthouse\", counts: scores });\n  }\n\n  const a11y = results.find((r) => r.audit === \"a11y\");\n  if (a11y && hasA11yCounts(a11y)) {\n    const counts = a11yCountsFromResult(a11y);\n    audits.a11y = counts;\n    writes.push({ audit: \"a11y\", counts });\n  }\n\n  const deps = results.find((r) => r.audit === \"deps\");\n  if (deps && hasDepsCounts(deps)) {\n    const counts = depsCountsFromResult(deps);\n    audits.deps = counts;\n    writes.push({ audit: \"deps\", counts });\n  }\n\n  const sec = results.find((r) => r.audit === \"security\");\n  if (sec && hasSecurityCounts(sec)) {\n    const counts = securityCountsFromResult(sec);\n    audits.security = counts;\n    // Persist the advisory list alongside the counts so the dashboard can show which packages\n    // are vulnerable. An empty array (clean run) clears any stale list.\n    audits.securityAdvisories = advisoriesFromResult(sec);\n    writes.push({ audit: \"security\", counts });\n  }\n\n  const dom = results.find((r) => r.audit === \"domain\");\n  if (dom && hasDomainResult(dom)) {\n    const result = domainResultFromAudit(dom);\n    audits.domain = result;\n    writes.push({ audit: \"domain\", counts: result });\n  }\n\n  const browser = results.find((r) => r.audit === \"browser\");\n  if (browser && hasBrowserResult(browser)) {\n    const fields = browserFieldsFromAudit(browser);\n    audits.browser = fields;\n    writes.push({ audit: \"browser\", counts: fields });\n  }\n\n  const netlifyDeploy = results.find((r) => r.audit === \"netlify-deploy\");\n  if (netlifyDeploy && hasNetlifyDeployResult(netlifyDeploy)) {\n    const result = netlifyDeployResultFromAudit(netlifyDeploy);\n    audits.netlifyDeploy = result;\n    writes.push({ audit: \"netlify-deploy\", counts: result });\n  }\n\n  const functionHealth = results.find((r) => r.audit === \"function-health\");\n  if (functionHealth && hasFunctionHealthResult(functionHealth)) {\n    const result = functionHealthResultFromAudit(functionHealth);\n    audits.functionHealth = result;\n    writes.push({ audit: \"function-health\", counts: result });\n  }\n\n  const smoke = results.find((r) => r.audit === \"smoke\");\n  if (smoke && hasSmokeResult(smoke)) {\n    const result = smokeResultFromAudit(smoke);\n    audits.smoke = result;\n    writes.push({ audit: \"smoke\", counts: result });\n  }\n\n  const formE2e = results.find((r) => r.audit === \"form-e2e\");\n  if (formE2e && hasFormE2eResult(formE2e)) {\n    const result = formE2eResultFromAudit(formE2e);\n    audits.formE2e = result;\n    writes.push({ audit: \"form-e2e\", counts: result });\n  }\n\n  // One atomic write of everything that ran. Skip the call only if there is nothing\n  // to write at all (no real scores AND no other audit produced values) — an empty\n  // update is a wasted request.\n  let fields: FieldSet = {};\n  if (Object.keys(audits).length > 0) {\n    fields = await updateAuditFields(base, target.id, audits);\n  }\n\n  // Detect fleet-activity transitions from the prior row (`target`, loaded before this\n  // write) vs the fresh audits. Computed here where both are in hand; recorded by the\n  // caller (fleet path) — single-site callers simply ignore `events`.\n  const events = detectAuditEvents(\n    target,\n    {\n      ...(audits.security !== undefined ? { security: audits.security } : {}),\n      ...(audits.domain !== undefined ? { domain: audits.domain } : {}),\n    },\n    new Date().toISOString(),\n  );\n\n  // Lighthouse-miss flag: only when lighthouse WAS requested (in results) but produced no scores —\n  // an infra failure worth reding the run, AFTER persisting the other audits. A sweep that never\n  // ran lighthouse (e.g. `--only security`) skips this entirely.\n  if (lhResult && !lhHasScores) {\n    // Enumerate what WAS persisted so the failure (surfaced to the single-site\n    // CLI operator via console.error) reads as a partial write, not a total one.\n    const persisted = writes.map((w) => w.audit);\n    throw Object.assign(\n      new Error(\n        `Lighthouse audit produced no scores; ${\n          persisted.length ? `wrote ${persisted.join(\"/\")} but refused Lighthouse` : \"wrote nothing\"\n        }. Summary: ${lhResult.summary}`,\n      ),\n      { exitCode: 1 },\n    );\n  }\n\n  return { siteName: target.name, writes, events, siteId: target.id, fields };\n}\n\nexport type FleetWriteResult = {\n  written: WriteSummary[];\n  failed: Array<{ slug: string; error: string }>;\n  /** Turso write-through counts (#539 Phase 3 dual-write). Present ONLY when a\n   *  mirror was wired — absent means mirroring was not attempted (no libSQL\n   *  creds), which must stay distinguishable from `mirrored=0` (a wired mirror\n   *  that landed nothing = the fleet-wide outage alarm). */\n  mirrored?: number;\n  mirrorFailed?: number;\n  /** Mirror UPDATEs that matched no site_health row (site created in Airtable\n   *  after the last hourly import). Not a failure — the row converges on the\n   *  next sync — but not mirrored either: counted apart so `mirrored=` stays\n   *  an honest Phase 5 cutover signal instead of overcounting by the no-row\n   *  sites. */\n  mirrorMissed?: number;\n};\n\n/** Render the fleet write-back outcome for the CLI/CI. Beyond the human-readable\n *  lines, it emits a single deterministic, machine-parseable line —\n *  `FLEET_WRITE_SUMMARY wrote=N failed=M total=T` — that the nightly workflow\n *  greps to decide pass/fail. Keying CI on this line (not the prose, and not a\n *  \"wrote ≥ 1\" heuristic) lets the gate tolerate a single known flake while\n *  still reding on a total or mass write-back failure. */\n/** Did this sweep fail, for exit-code purposes (#612)?\n *\n *  Pre-freeze, only an Airtable write failure counts. Mirror failures and missed\n *  rows are real but survivable: the hourly import converges them, and going red\n *  over a transient the system already handles would train the alarm to be\n *  ignored.\n *\n *  Post-freeze there is no import to converge anything, so all three become\n *  fatal — including an ABSENT mirror, which is the worst of the three and the\n *  easiest to misread as success: no counters at all means no libSQL creds,\n *  which means the sweep wrote nothing to the only store there is.\n *\n *  Note what this deliberately does NOT change: `writeFleetAuditsToAirtable`\n *  still catches per-site mirror failures rather than throwing. One bad site\n *  must not abort a 44-site sweep. This gates the RUN, not the loop. */\nexport function fleetWriteFailed(\n  result: FleetWriteResult,\n  strict: boolean = TURSO_IS_AUTHORITATIVE,\n): boolean {\n  if (result.failed.length > 0) return true;\n  if (!strict) return false;\n  if (result.mirrored === undefined) return true; // no mirror was wired at all\n  return (result.mirrorFailed ?? 0) > 0 || (result.mirrorMissed ?? 0) > 0;\n}\n\nexport function formatFleetWriteSummary(result: FleetWriteResult): string {\n  const wrote = result.written.length;\n  const failed = result.failed.length;\n  const total = wrote + failed;\n  let out = `→ wrote ${wrote} site(s) to Airtable`;\n  if (failed > 0) {\n    out += `\\n⚠ ${failed} site(s) not written: ${result.failed\n      .map((f) => `${f.slug} (${f.error})`)\n      .join(\"; \")}`;\n  }\n  out += `\\nFLEET_WRITE_SUMMARY wrote=${wrote} failed=${failed} total=${total}`;\n  // Mirror counts APPEND so the fleet workflows' `grep -oE \"FLEET_WRITE_SUMMARY\n  // wrote=... total=[0-9]+\"` extraction still matches its prefix untouched.\n  if (result.mirrored !== undefined) {\n    out += ` mirrored=${result.mirrored} mirror_failed=${result.mirrorFailed ?? 0}`;\n    out += ` mirror_missed=${result.mirrorMissed ?? 0}`;\n  }\n  return out;\n}\n\n/** Write each site's pooled audit results back to its own Websites row,\n *  best-effort. Results are grouped by `result.site` (the slug the fleet\n *  inventory stamped as Site.name). A per-site failure (no scores, no matching\n *  row) is collected — not thrown — so one bad site never aborts the batch. */\nexport async function writeFleetAuditsToAirtable(args: {\n  base: AirtableBase;\n  websites: WebsiteRow[];\n  results: AuditResult[];\n  /** Optional Turso write-through (#539 Phase 3 dual-write). Each site's\n   *  just-written FieldSet mirrors into site_health right after its Airtable\n   *  write; a mirror failure is counted, never thrown — Airtable stays\n   *  authoritative and the hourly sync converges what the mirror missed.\n   *  (The lighthouse-miss partial write lands in `failed` and is deliberately\n   *  NOT mirrored — same convergence path.) */\n  mirror?: HealthMirror;\n}): Promise<FleetWriteResult> {\n  const { base, websites, results, mirror } = args;\n\n  const bySlug = new Map<string, AuditResult[]>();\n  for (const r of results) {\n    const arr = bySlug.get(r.site) ?? [];\n    arr.push(r);\n    bySlug.set(r.site, arr);\n  }\n\n  const written: WriteSummary[] = [];\n  const failed: FleetWriteResult[\"failed\"] = [];\n  let mirrored = 0;\n  let mirrorFailed = 0;\n  let mirrorMissed = 0;\n  // Serial on purpose: even at one (now atomic) update call per site, Airtable's\n  // ~5 req/sec limit means a Promise.all fan-out across the fleet would burst and\n  // trip 429s (silently filed as failures). Below a few dozen sites, serial trades\n  // wall-clock for safety. (morning-brief 2026-06-09 MEDIUM-3.) Add a bounded pool\n  // when the fleet grows.\n  for (const [slug, siteResults] of bySlug) {\n    try {\n      const summary = await writeAuditsToAirtable({ base, websites, slug, results: siteResults });\n      written.push(summary);\n      if (mirror && summary.siteId && summary.fields && Object.keys(summary.fields).length > 0) {\n        try {\n          if (await mirror(summary.siteId, summary.fields)) mirrored++;\n          else mirrorMissed++;\n        } catch (e) {\n          mirrorFailed++;\n          console.error(`[health-mirror] ${slug}: ${(e as Error).message}`);\n        }\n      }\n    } catch (e) {\n      failed.push({ slug, error: (e as Error).message });\n    }\n  }\n  return { written, failed, ...(mirror ? { mirrored, mirrorFailed, mirrorMissed } : {}) };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAWO,SAAS,cAAc,QAA8B;AAC1D,MAAI,OAAO,UAAU,OAAQ,QAAO;AACpC,QAAM,UAAU,OAAO;AACvB,SAAO,OAAO,SAAS,oBAAoB;AAC7C;AAEO,SAAS,qBAAqB,QAA6C;AAChF,MAAI,OAAO,UAAU,QAAQ;AAC3B,UAAM,IAAI,MAAM,wCAAwC,OAAO,KAAK,GAAG;AAAA,EACzE;AACA,QAAM,UAAU,OAAO;AACvB,SAAO,EAAE,YAAY,SAAS,mBAAmB,EAAE;AACrD;;;AClBO,SAAS,cAAc,QAA8B;AAC1D,MAAI,OAAO,UAAU,OAAQ,QAAO;AACpC,QAAM,IAAI,OAAO;AACjB,SAAO,MAAM,QAAQ,GAAG,OAAO;AACjC;AAEO,SAAS,qBAAqB,QAKnC;AACA,MAAI,OAAO,UAAU,QAAQ;AAC3B,UAAM,IAAI,MAAM,uCAAuC,OAAO,KAAK,GAAG;AAAA,EACxE;AACA,QAAM,UAAW,OAAO,WAAW,CAAC;AACpC,QAAM,UAAW,QAAQ,WAAW,CAAC;AAGrC,QAAM,UAAU,QAAQ,OAAO,CAAC,MAAM,EAAE,UAAU,MAAM,EAAE;AAC1D,QAAM,cAAc,QAAQ,OAAO,CAAC,MAAM,EAAE,UAAU,OAAO,EAAE;AAI/D,QAAM,WAAW,QAAQ,UAAU,YAAY;AAK/C,QAAM,gBAAgB,QAAQ,UAAU,SAAS;AACjD,SAAO,EAAE,SAAS,aAAa,UAAU,cAAc;AACzD;;;AC1BO,SAAS,kBAAkB,QAA8B;AAC9D,MAAI,OAAO,UAAU,WAAY,QAAO;AACxC,QAAM,UAAU,OAAO;AACvB,SAAO,CAAC,CAAC,WAAW,OAAO,QAAQ,WAAW;AAChD;AAEO,SAAS,yBAAyB,QAKvC;AACA,MAAI,OAAO,UAAU,YAAY;AAC/B,UAAM,IAAI,MAAM,2CAA2C,OAAO,KAAK,GAAG;AAAA,EAC5E;AACA,QAAM,UAAU,OAAO;AACvB,QAAM,IAAI,SAAS,UAAU,EAAE,KAAK,GAAG,UAAU,GAAG,MAAM,GAAG,UAAU,EAAE;AACzE,SAAO,EAAE,UAAU,EAAE,UAAU,MAAM,EAAE,MAAM,UAAU,EAAE,UAAU,KAAK,EAAE,IAAI;AAChF;AAKO,SAAS,qBAAqB,QAAyC;AAC5E,MAAI,OAAO,UAAU,YAAY;AAC/B,UAAM,IAAI,MAAM,2CAA2C,OAAO,KAAK,GAAG;AAAA,EAC5E;AACA,QAAM,UAAU,OAAO;AACvB,QAAM,MAAM,SAAS;AACrB,MAAI,CAAC,MAAM,QAAQ,GAAG,EAAG,QAAO,CAAC;AACjC,SAAO,IAAI,IAAI,yBAAyB,EAAE,OAAO,CAAC,MAA6B,MAAM,IAAI;AAC3F;;;AClCO,SAAS,gBAAgB,QAA8B;AAC5D,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,IAAI,OAAO;AACjB,SAAO,CAAC,CAAC,KAAK,OAAO,EAAE,cAAc;AACvC;AAGO,SAAS,sBAAsB,QAAmC;AACvE,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,IAAI,MAAM,yCAAyC,OAAO,KAAK,GAAG;AAAA,EAC1E;AACA,QAAM,IAAI,OAAO;AACjB,SAAO;AAAA,IACL,mBAAmB,OAAO,GAAG,sBAAsB,WAAW,EAAE,oBAAoB;AAAA,IACpF,WAAW,OAAO,GAAG,cAAc,WAAW,EAAE,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,EACrF;AACF;;;ACRO,SAAS,iBAAiB,QAA8B;AAC7D,MAAI,OAAO,UAAU,UAAW,QAAO;AACvC,QAAM,IAAI,OAAO;AACjB,SAAO,CAAC,CAAC,KAAK,OAAO,EAAE,cAAc;AACvC;AAGO,SAAS,uBAAuB,QAAyC;AAC9E,MAAI,OAAO,UAAU,WAAW;AAC9B,UAAM,IAAI,MAAM,0CAA0C,OAAO,KAAK,GAAG;AAAA,EAC3E;AACA,QAAM,IAAI,OAAO;AACjB,SAAO;AAAA,IACL,WAAW,GAAG,cAAc;AAAA,IAC5B,UAAU,GAAG,aAAa;AAAA,IAC1B,SAAS,GAAG,YAAY;AAAA,IACxB,aAAa,GAAG,gBAAgB;AAAA,IAChC,aAAa,GAAG,gBAAgB;AAAA,IAChC,aAAa,OAAO,GAAG,gBAAgB,WAAW,EAAE,cAAc;AAAA,IAClE,WAAW,OAAO,GAAG,cAAc,WAAW,EAAE,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,EACrF;AACF;;;ACvBO,SAAS,uBAAuB,QAA8B;AACnE,MAAI,OAAO,UAAU,iBAAkB,QAAO;AAC9C,QAAM,IAAI,OAAO;AACjB,SAAO,CAAC,CAAC,KAAK,OAAO,EAAE,cAAc;AACvC;AAIO,SAAS,6BAA6B,QAA0C;AACrF,MAAI,OAAO,UAAU,kBAAkB;AACrC,UAAM,IAAI,MAAM,iDAAiD,OAAO,KAAK,GAAG;AAAA,EAClF;AACA,QAAM,IAAI,OAAO;AACjB,SAAO;AAAA,IACL,OAAO,OAAO,GAAG,UAAU,WAAW,EAAE,QAAQ;AAAA,IAChD,YAAY,OAAO,GAAG,eAAe,WAAW,EAAE,aAAa;AAAA,IAC/D,QAAQ,OAAO,GAAG,WAAW,WAAW,EAAE,SAAS;AAAA,IACnD,WAAW,OAAO,GAAG,cAAc,WAAW,EAAE,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,EACrF;AACF;;;ACnBO,SAAS,wBAAwB,QAA8B;AACpE,MAAI,OAAO,UAAU,kBAAmB,QAAO;AAC/C,QAAM,IAAI,OAAO;AACjB,SAAO,CAAC,CAAC,KAAK,OAAO,EAAE,cAAc;AACvC;AAQO,SAAS,8BAA8B,QAA2C;AACvF,MAAI,OAAO,UAAU,mBAAmB;AACtC,UAAM,IAAI,MAAM,kDAAkD,OAAO,KAAK,GAAG;AAAA,EACnF;AACA,QAAM,IAAI,OAAO;AACjB,QAAM,eACJ,GAAG,YAAY,OAAO,SAAS,GAAG,YAAY,UAAU,SAAS;AAKnE,QAAM,WAAW,GAAG;AACpB,QAAM,gBACJ,YAAY,OAAO,aAAa,WAC3B,SAAqC,WAAW,IACjD;AACN,QAAM,kBACJ,OAAO,kBAAkB,YAAa,gBAAgB,SAAS,SAAU;AAC3E,SAAO;AAAA,IACL,gBAAgB,GAAG,OAAO,OAAO,SAAS;AAAA,IAC1C;AAAA,IACA;AAAA,IACA,WAAW,OAAO,GAAG,cAAc,WAAW,EAAE,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,EACrF;AACF;;;ACzCO,SAAS,eAAe,QAA8B;AAC3D,MAAI,OAAO,UAAU,QAAS,QAAO;AACrC,QAAM,IAAI,OAAO;AACjB,SAAO,CAAC,CAAC,KAAK,OAAO,EAAE,cAAc;AACvC;AAGO,SAAS,qBAAqB,QAAkC;AACrE,MAAI,OAAO,UAAU,SAAS;AAC5B,UAAM,IAAI,MAAM,wCAAwC,OAAO,KAAK,GAAG;AAAA,EACzE;AACA,QAAM,IAAI,OAAO;AACjB,SAAO;AAAA,IACL,IAAI,GAAG,OAAO,SAAS,SAAS;AAAA,IAChC,WAAW,OAAO,GAAG,cAAc,WAAW,EAAE,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,EACrF;AACF;;;AChBO,SAAS,iBAAiB,QAA8B;AAC7D,MAAI,OAAO,UAAU,WAAY,QAAO;AACxC,QAAM,IAAI,OAAO;AACjB,SAAO,CAAC,CAAC,KAAK,OAAO,EAAE,cAAc;AACvC;AAGO,SAAS,uBAAuB,QAAoC;AACzE,MAAI,OAAO,UAAU,YAAY;AAC/B,UAAM,IAAI,MAAM,2CAA2C,OAAO,KAAK,GAAG;AAAA,EAC5E;AACA,QAAM,IAAI,OAAO;AACjB,QAAM,KAAK,GAAG,OAAO,SAAS,SAAS,GAAG,OAAO,SAAS,SAAS;AACnE,SAAO;AAAA,IACL;AAAA,IACA,WAAW,OAAO,GAAG,cAAc,WAAW,EAAE,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,EACrF;AACF;;;AC6DA,eAAsB,sBAAsB,MAKlB;AACxB,QAAM,EAAE,MAAM,UAAU,MAAM,QAAQ,IAAI;AAM1C,QAAM,WAAW,QAAQ,KAAK,CAAC,MAAM,EAAE,UAAU,YAAY;AAC7D,QAAM,SAAS,SAAS,KAAK,CAAC,MAAM,SAAS,EAAE,IAAI,MAAM,IAAI;AAC7D,MAAI,CAAC,QAAQ;AACX,UAAM,OAAO,OAAO,IAAI,MAAM,iCAAiC,IAAI,GAAG,GAAG,EAAE,UAAU,EAAE,CAAC;AAAA,EAC1F;AAEA,QAAM,SAAiC,CAAC;AACxC,QAAM,SAYF,CAAC;AAWL,QAAM,cAAc,WAAW,cAAc,QAAQ,IAAI;AACzD,MAAI,YAAY,aAAa;AAC3B,UAAM,SAAS,2BAA2B,QAAQ;AAClD,WAAO,SAAS;AAChB,WAAO,KAAK,EAAE,OAAO,cAAc,QAAQ,OAAO,CAAC;AAAA,EACrD;AAEA,QAAM,OAAO,QAAQ,KAAK,CAAC,MAAM,EAAE,UAAU,MAAM;AACnD,MAAI,QAAQ,cAAc,IAAI,GAAG;AAC/B,UAAM,SAAS,qBAAqB,IAAI;AACxC,WAAO,OAAO;AACd,WAAO,KAAK,EAAE,OAAO,QAAQ,OAAO,CAAC;AAAA,EACvC;AAEA,QAAM,OAAO,QAAQ,KAAK,CAAC,MAAM,EAAE,UAAU,MAAM;AACnD,MAAI,QAAQ,cAAc,IAAI,GAAG;AAC/B,UAAM,SAAS,qBAAqB,IAAI;AACxC,WAAO,OAAO;AACd,WAAO,KAAK,EAAE,OAAO,QAAQ,OAAO,CAAC;AAAA,EACvC;AAEA,QAAM,MAAM,QAAQ,KAAK,CAAC,MAAM,EAAE,UAAU,UAAU;AACtD,MAAI,OAAO,kBAAkB,GAAG,GAAG;AACjC,UAAM,SAAS,yBAAyB,GAAG;AAC3C,WAAO,WAAW;AAGlB,WAAO,qBAAqB,qBAAqB,GAAG;AACpD,WAAO,KAAK,EAAE,OAAO,YAAY,OAAO,CAAC;AAAA,EAC3C;AAEA,QAAM,MAAM,QAAQ,KAAK,CAAC,MAAM,EAAE,UAAU,QAAQ;AACpD,MAAI,OAAO,gBAAgB,GAAG,GAAG;AAC/B,UAAM,SAAS,sBAAsB,GAAG;AACxC,WAAO,SAAS;AAChB,WAAO,KAAK,EAAE,OAAO,UAAU,QAAQ,OAAO,CAAC;AAAA,EACjD;AAEA,QAAM,UAAU,QAAQ,KAAK,CAAC,MAAM,EAAE,UAAU,SAAS;AACzD,MAAI,WAAW,iBAAiB,OAAO,GAAG;AACxC,UAAMA,UAAS,uBAAuB,OAAO;AAC7C,WAAO,UAAUA;AACjB,WAAO,KAAK,EAAE,OAAO,WAAW,QAAQA,QAAO,CAAC;AAAA,EAClD;AAEA,QAAM,gBAAgB,QAAQ,KAAK,CAAC,MAAM,EAAE,UAAU,gBAAgB;AACtE,MAAI,iBAAiB,uBAAuB,aAAa,GAAG;AAC1D,UAAM,SAAS,6BAA6B,aAAa;AACzD,WAAO,gBAAgB;AACvB,WAAO,KAAK,EAAE,OAAO,kBAAkB,QAAQ,OAAO,CAAC;AAAA,EACzD;AAEA,QAAM,iBAAiB,QAAQ,KAAK,CAAC,MAAM,EAAE,UAAU,iBAAiB;AACxE,MAAI,kBAAkB,wBAAwB,cAAc,GAAG;AAC7D,UAAM,SAAS,8BAA8B,cAAc;AAC3D,WAAO,iBAAiB;AACxB,WAAO,KAAK,EAAE,OAAO,mBAAmB,QAAQ,OAAO,CAAC;AAAA,EAC1D;AAEA,QAAM,QAAQ,QAAQ,KAAK,CAAC,MAAM,EAAE,UAAU,OAAO;AACrD,MAAI,SAAS,eAAe,KAAK,GAAG;AAClC,UAAM,SAAS,qBAAqB,KAAK;AACzC,WAAO,QAAQ;AACf,WAAO,KAAK,EAAE,OAAO,SAAS,QAAQ,OAAO,CAAC;AAAA,EAChD;AAEA,QAAM,UAAU,QAAQ,KAAK,CAAC,MAAM,EAAE,UAAU,UAAU;AAC1D,MAAI,WAAW,iBAAiB,OAAO,GAAG;AACxC,UAAM,SAAS,uBAAuB,OAAO;AAC7C,WAAO,UAAU;AACjB,WAAO,KAAK,EAAE,OAAO,YAAY,QAAQ,OAAO,CAAC;AAAA,EACnD;AAKA,MAAI,SAAmB,CAAC;AACxB,MAAI,OAAO,KAAK,MAAM,EAAE,SAAS,GAAG;AAClC,aAAS,MAAM,kBAAkB,MAAM,OAAO,IAAI,MAAM;AAAA,EAC1D;AAKA,QAAM,SAAS;AAAA,IACb;AAAA,IACA;AAAA,MACE,GAAI,OAAO,aAAa,SAAY,EAAE,UAAU,OAAO,SAAS,IAAI,CAAC;AAAA,MACrE,GAAI,OAAO,WAAW,SAAY,EAAE,QAAQ,OAAO,OAAO,IAAI,CAAC;AAAA,IACjE;AAAA,KACA,oBAAI,KAAK,GAAE,YAAY;AAAA,EACzB;AAKA,MAAI,YAAY,CAAC,aAAa;AAG5B,UAAM,YAAY,OAAO,IAAI,CAAC,MAAM,EAAE,KAAK;AAC3C,UAAM,OAAO;AAAA,MACX,IAAI;AAAA,QACF,wCACE,UAAU,SAAS,SAAS,UAAU,KAAK,GAAG,CAAC,4BAA4B,eAC7E,cAAc,SAAS,OAAO;AAAA,MAChC;AAAA,MACA,EAAE,UAAU,EAAE;AAAA,IAChB;AAAA,EACF;AAEA,SAAO,EAAE,UAAU,OAAO,MAAM,QAAQ,QAAQ,QAAQ,OAAO,IAAI,OAAO;AAC5E;AAwCO,SAAS,iBACd,QACA,SAAkB,wBACT;AACT,MAAI,OAAO,OAAO,SAAS,EAAG,QAAO;AACrC,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI,OAAO,aAAa,OAAW,QAAO;AAC1C,UAAQ,OAAO,gBAAgB,KAAK,MAAM,OAAO,gBAAgB,KAAK;AACxE;AAEO,SAAS,wBAAwB,QAAkC;AACxE,QAAM,QAAQ,OAAO,QAAQ;AAC7B,QAAM,SAAS,OAAO,OAAO;AAC7B,QAAM,QAAQ,QAAQ;AACtB,MAAI,MAAM,gBAAW,KAAK;AAC1B,MAAI,SAAS,GAAG;AACd,WAAO;AAAA,SAAO,MAAM,yBAAyB,OAAO,OACjD,IAAI,CAAC,MAAM,GAAG,EAAE,IAAI,KAAK,EAAE,KAAK,GAAG,EACnC,KAAK,IAAI,CAAC;AAAA,EACf;AACA,SAAO;AAAA,4BAA+B,KAAK,WAAW,MAAM,UAAU,KAAK;AAG3E,MAAI,OAAO,aAAa,QAAW;AACjC,WAAO,aAAa,OAAO,QAAQ,kBAAkB,OAAO,gBAAgB,CAAC;AAC7E,WAAO,kBAAkB,OAAO,gBAAgB,CAAC;AAAA,EACnD;AACA,SAAO;AACT;AAMA,eAAsB,2BAA2B,MAWnB;AAC5B,QAAM,EAAE,MAAM,UAAU,SAAS,OAAO,IAAI;AAE5C,QAAM,SAAS,oBAAI,IAA2B;AAC9C,aAAW,KAAK,SAAS;AACvB,UAAM,MAAM,OAAO,IAAI,EAAE,IAAI,KAAK,CAAC;AACnC,QAAI,KAAK,CAAC;AACV,WAAO,IAAI,EAAE,MAAM,GAAG;AAAA,EACxB;AAEA,QAAM,UAA0B,CAAC;AACjC,QAAM,SAAqC,CAAC;AAC5C,MAAI,WAAW;AACf,MAAI,eAAe;AACnB,MAAI,eAAe;AAMnB,aAAW,CAAC,MAAM,WAAW,KAAK,QAAQ;AACxC,QAAI;AACF,YAAM,UAAU,MAAM,sBAAsB,EAAE,MAAM,UAAU,MAAM,SAAS,YAAY,CAAC;AAC1F,cAAQ,KAAK,OAAO;AACpB,UAAI,UAAU,QAAQ,UAAU,QAAQ,UAAU,OAAO,KAAK,QAAQ,MAAM,EAAE,SAAS,GAAG;AACxF,YAAI;AACF,cAAI,MAAM,OAAO,QAAQ,QAAQ,QAAQ,MAAM,EAAG;AAAA,cAC7C;AAAA,QACP,SAAS,GAAG;AACV;AACA,kBAAQ,MAAM,mBAAmB,IAAI,KAAM,EAAY,OAAO,EAAE;AAAA,QAClE;AAAA,MACF;AAAA,IACF,SAAS,GAAG;AACV,aAAO,KAAK,EAAE,MAAM,OAAQ,EAAY,QAAQ,CAAC;AAAA,IACnD;AAAA,EACF;AACA,SAAO,EAAE,SAAS,QAAQ,GAAI,SAAS,EAAE,UAAU,cAAc,aAAa,IAAI,CAAC,EAAG;AACxF;","names":["fields"]}

package/dist/{chunk-ZBDZTJUO.js → chunk-7FFUBF4I.js}

@@ -1,3 +1,6 @@
+import {
+  REPORT_LIST_COLUMNS
+} from "./chunk-GQDDWYU2.js";
 import {
   mapReportRecord,
   mapWebsiteRecord
@@ -82,7 +85,7 @@ async function checkFleetParity(db, io) {
   }
   const reports = await io.listReportRecords();
   const reportRows = byId(
-    await db.selectFrom("reports").selectAll().execute(),
+    await db.selectFrom("reports").select(REPORT_LIST_COLUMNS).execute(),
     "id"
   );
   for (const rec of reports) {
@@ -126,4 +129,4 @@ export {
   checkFleetParity,
   formatParityResult
 };
-//# sourceMappingURL=chunk-ZBDZTJUO.js.map
+//# sourceMappingURL=chunk-7FFUBF4I.js.map

package/dist/chunk-7FFUBF4I.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/db/parity.ts"],"sourcesContent":["import type { Db } from \"./client.js\";\nimport { mapWebsiteRecord, mapReportRecord, type RawRecord } from \"./import-airtable.js\";\nimport { REPORT_LIST_COLUMNS } from \"./fleet-state.js\";\n\n/**\n * Phase 1.4 of #539: the instrument the cutover depends on. Reads BOTH stores\n * and diffs field-by-field, using the importer's own mapping functions — so\n * \"what parity expects\" is definitionally \"what the importer writes\", and the\n * two cannot drift apart.\n *\n * Per the repo's standing rule, this harness must be shown to PASS GREEN on the\n * pre-cutover state (immediately after an import, when the stores genuinely\n * agree) before any mismatch it reports is treated as a finding. A harness that\n * has only ever failed is not evidence.\n *\n * Deliberately NOT compared:\n * - `site_schedule.computed_at` — an import stamp, different by construction.\n * - `sites.header_image*` — Airtable stopped being the source (design D5).\n * - `reports.rendered_html` — comparing it would re-download every attachment\n *   on every run against URLs that expire; presence is checked at import time\n *   and the body never changes after a send.\n */\n\nexport type ParityMismatch = {\n  table: \"sites\" | \"site_health\" | \"site_schedule\" | \"reports\";\n  id: string;\n  column: string;\n  airtable: string;\n  turso: string;\n};\n\nexport type ParityResult = {\n  compared: Record<\"sites\" | \"site_health\" | \"site_schedule\" | \"reports\", number>;\n  mismatches: ParityMismatch[];\n};\n\nconst SKIP_COLUMNS: ReadonlySet<string> = new Set([\n  \"computed_at\",\n  \"header_image\",\n  \"header_image_filename\",\n  \"header_image_type\",\n  \"header_image_generated_at\",\n  \"rendered_html\",\n]);\n\nconst show = (v: unknown): string => {\n  if (v === null || v === undefined) return \"∅\";\n  const str = typeof v === \"string\" ? v : JSON.stringify(v);\n  return str.length > 80 ? `${str.slice(0, 77)}…` : str;\n};\n\nfunction diffRows(\n  table: ParityMismatch[\"table\"],\n  id: string,\n  expected: Record<string, unknown>,\n  actual: Record<string, unknown> | undefined,\n  out: ParityMismatch[],\n): void {\n  if (!actual) {\n    out.push({ table, id, column: \"(row)\", airtable: \"present\", turso: \"ABSENT\" });\n    return;\n  }\n  for (const [col, want] of Object.entries(expected)) {\n    if (SKIP_COLUMNS.has(col)) continue;\n    const got = actual[col] ?? null;\n    const wantNorm = want ?? null;\n    if (String(wantNorm ?? \"\") !== String(got ?? \"\") && !(wantNorm === null && got === null)) {\n      out.push({ table, id, column: col, airtable: show(wantNorm), turso: show(got) });\n    }\n  }\n}\n\nexport type ParityIo = {\n  listWebsiteRecords: () => Promise<RawRecord[]>;\n  listReportRecords: () => Promise<RawRecord[]>;\n  now: () => Date;\n};\n\nexport async function checkFleetParity(db: Db, io: ParityIo): Promise<ParityResult> {\n  const computedAt = io.now().toISOString();\n  const mismatches: ParityMismatch[] = [];\n\n  const websites = await io.listWebsiteRecords();\n  const mapped = websites.map((r) => mapWebsiteRecord(r, computedAt));\n\n  const [sites, health, schedule] = await Promise.all([\n    db.selectFrom(\"sites\").selectAll().execute(),\n    db.selectFrom(\"site_health\").selectAll().execute(),\n    db.selectFrom(\"site_schedule\").selectAll().execute(),\n  ]);\n  const byId = <T extends { [k: string]: unknown }>(rows: T[], key: string): Map<string, T> =>\n    new Map(rows.map((r) => [String(r[key]), r]));\n  const sitesById = byId(sites as Array<Record<string, unknown>>, \"id\");\n  const healthById = byId(health as Array<Record<string, unknown>>, \"site_id\");\n  const scheduleById = byId(schedule as Array<Record<string, unknown>>, \"site_id\");\n\n  for (const m of mapped) {\n    diffRows(\n      \"sites\",\n      m.site.id,\n      m.site as unknown as Record<string, unknown>,\n      sitesById.get(m.site.id),\n      mismatches,\n    );\n    diffRows(\n      \"site_health\",\n      m.health.site_id,\n      m.health as unknown as Record<string, unknown>,\n      healthById.get(m.health.site_id),\n      mismatches,\n    );\n    diffRows(\n      \"site_schedule\",\n      m.schedule.site_id,\n      m.schedule as unknown as Record<string, unknown>,\n      scheduleById.get(m.schedule.site_id),\n      mismatches,\n    );\n  }\n  // A Turso site Airtable no longer has is as much a divergence as a missing one.\n  const airtableIds = new Set(mapped.map((m) => m.site.id));\n  for (const row of sitesById.keys()) {\n    if (!airtableIds.has(row)) {\n      mismatches.push({\n        table: \"sites\",\n        id: row,\n        column: \"(row)\",\n        airtable: \"ABSENT\",\n        turso: \"present\",\n      });\n    }\n  }\n\n  const reports = await io.listReportRecords();\n  // Every reports column EXCEPT rendered_html, which `SKIP_COLUMNS` discards\n  // anyway — a selectAll pulled all 16 stored bodies (1.17 MB live) across the\n  // wire on every hourly run, 24×/day, purely to throw them away. Same list the\n  // read layer uses, so the lockstep test covers this too.\n  const reportRows = byId(\n    (await db.selectFrom(\"reports\").select(REPORT_LIST_COLUMNS).execute()) as Array<\n      Record<string, unknown>\n    >,\n    \"id\",\n  );\n  for (const rec of reports) {\n    const expected = mapReportRecord(rec, null) as unknown as Record<string, unknown>;\n    diffRows(\"reports\", rec.id, expected, reportRows.get(rec.id), mismatches);\n  }\n  const reportIds = new Set(reports.map((r) => r.id));\n  for (const row of reportRows.keys()) {\n    if (!reportIds.has(row)) {\n      mismatches.push({\n        table: \"reports\",\n        id: row,\n        column: \"(row)\",\n        airtable: \"ABSENT\",\n        turso: \"present\",\n      });\n    }\n  }\n\n  return {\n    compared: {\n      sites: mapped.length,\n      site_health: mapped.length,\n      site_schedule: mapped.length,\n      reports: reports.length,\n    },\n    mismatches,\n  };\n}\n\n/** Render for CLI/CI. Emits the machine-parseable `FLEET_PARITY` line on every\n *  run, count=0 included — an absent line must mean \"the harness never ran\",\n *  never \"it ran clean\" (same contract as FLEET_SMOKE_UNMEASURED, same reason). */\nexport function formatParityResult(r: ParityResult): string {\n  const lines: string[] = [];\n  for (const m of r.mismatches) {\n    lines.push(`✗ ${m.table} ${m.id} ${m.column}: airtable=${m.airtable} turso=${m.turso}`);\n  }\n  lines.push(\n    `FLEET_PARITY sites=${r.compared.sites} health=${r.compared.site_health} ` +\n      `schedule=${r.compared.site_schedule} reports=${r.compared.reports} ` +\n      `mismatches=${r.mismatches.length}`,\n  );\n  return lines.join(\"\\n\");\n}\n"],"mappings":";;;;;;;;;AAoCA,IAAM,eAAoC,oBAAI,IAAI;AAAA,EAChD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,IAAM,OAAO,CAAC,MAAuB;AACnC,MAAI,MAAM,QAAQ,MAAM,OAAW,QAAO;AAC1C,QAAM,MAAM,OAAO,MAAM,WAAW,IAAI,KAAK,UAAU,CAAC;AACxD,SAAO,IAAI,SAAS,KAAK,GAAG,IAAI,MAAM,GAAG,EAAE,CAAC,WAAM;AACpD;AAEA,SAAS,SACP,OACA,IACA,UACA,QACA,KACM;AACN,MAAI,CAAC,QAAQ;AACX,QAAI,KAAK,EAAE,OAAO,IAAI,QAAQ,SAAS,UAAU,WAAW,OAAO,SAAS,CAAC;AAC7E;AAAA,EACF;AACA,aAAW,CAAC,KAAK,IAAI,KAAK,OAAO,QAAQ,QAAQ,GAAG;AAClD,QAAI,aAAa,IAAI,GAAG,EAAG;AAC3B,UAAM,MAAM,OAAO,GAAG,KAAK;AAC3B,UAAM,WAAW,QAAQ;AACzB,QAAI,OAAO,YAAY,EAAE,MAAM,OAAO,OAAO,EAAE,KAAK,EAAE,aAAa,QAAQ,QAAQ,OAAO;AACxF,UAAI,KAAK,EAAE,OAAO,IAAI,QAAQ,KAAK,UAAU,KAAK,QAAQ,GAAG,OAAO,KAAK,GAAG,EAAE,CAAC;AAAA,IACjF;AAAA,EACF;AACF;AAQA,eAAsB,iBAAiB,IAAQ,IAAqC;AAClF,QAAM,aAAa,GAAG,IAAI,EAAE,YAAY;AACxC,QAAM,aAA+B,CAAC;AAEtC,QAAM,WAAW,MAAM,GAAG,mBAAmB;AAC7C,QAAM,SAAS,SAAS,IAAI,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAElE,QAAM,CAAC,OAAO,QAAQ,QAAQ,IAAI,MAAM,QAAQ,IAAI;AAAA,IAClD,GAAG,WAAW,OAAO,EAAE,UAAU,EAAE,QAAQ;AAAA,IAC3C,GAAG,WAAW,aAAa,EAAE,UAAU,EAAE,QAAQ;AAAA,IACjD,GAAG,WAAW,eAAe,EAAE,UAAU,EAAE,QAAQ;AAAA,EACrD,CAAC;AACD,QAAM,OAAO,CAAqC,MAAW,QAC3D,IAAI,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AAC9C,QAAM,YAAY,KAAK,OAAyC,IAAI;AACpE,QAAM,aAAa,KAAK,QAA0C,SAAS;AAC3E,QAAM,eAAe,KAAK,UAA4C,SAAS;AAE/E,aAAW,KAAK,QAAQ;AACtB;AAAA,MACE;AAAA,MACA,EAAE,KAAK;AAAA,MACP,EAAE;AAAA,MACF,UAAU,IAAI,EAAE,KAAK,EAAE;AAAA,MACvB;AAAA,IACF;AACA;AAAA,MACE;AAAA,MACA,EAAE,OAAO;AAAA,MACT,EAAE;AAAA,MACF,WAAW,IAAI,EAAE,OAAO,OAAO;AAAA,MAC/B;AAAA,IACF;AACA;AAAA,MACE;AAAA,MACA,EAAE,SAAS;AAAA,MACX,EAAE;AAAA,MACF,aAAa,IAAI,EAAE,SAAS,OAAO;AAAA,MACnC;AAAA,IACF;AAAA,EACF;AAEA,QAAM,cAAc,IAAI,IAAI,OAAO,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;AACxD,aAAW,OAAO,UAAU,KAAK,GAAG;AAClC,QAAI,CAAC,YAAY,IAAI,GAAG,GAAG;AACzB,iBAAW,KAAK;AAAA,QACd,OAAO;AAAA,QACP,IAAI;AAAA,QACJ,QAAQ;AAAA,QACR,UAAU;AAAA,QACV,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,EACF;AAEA,QAAM,UAAU,MAAM,GAAG,kBAAkB;AAK3C,QAAM,aAAa;AAAA,IAChB,MAAM,GAAG,WAAW,SAAS,EAAE,OAAO,mBAAmB,EAAE,QAAQ;AAAA,IAGpE;AAAA,EACF;AACA,aAAW,OAAO,SAAS;AACzB,UAAM,WAAW,gBAAgB,KAAK,IAAI;AAC1C,aAAS,WAAW,IAAI,IAAI,UAAU,WAAW,IAAI,IAAI,EAAE,GAAG,UAAU;AAAA,EAC1E;AACA,QAAM,YAAY,IAAI,IAAI,QAAQ,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;AAClD,aAAW,OAAO,WAAW,KAAK,GAAG;AACnC,QAAI,CAAC,UAAU,IAAI,GAAG,GAAG;AACvB,iBAAW,KAAK;AAAA,QACd,OAAO;AAAA,QACP,IAAI;AAAA,QACJ,QAAQ;AAAA,QACR,UAAU;AAAA,QACV,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AAAA,IACL,UAAU;AAAA,MACR,OAAO,OAAO;AAAA,MACd,aAAa,OAAO;AAAA,MACpB,eAAe,OAAO;AAAA,MACtB,SAAS,QAAQ;AAAA,IACnB;AAAA,IACA;AAAA,EACF;AACF;AAKO,SAAS,mBAAmB,GAAyB;AAC1D,QAAM,QAAkB,CAAC;AACzB,aAAW,KAAK,EAAE,YAAY;AAC5B,UAAM,KAAK,UAAK,EAAE,KAAK,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,cAAc,EAAE,QAAQ,UAAU,EAAE,KAAK,EAAE;AAAA,EACxF;AACA,QAAM;AAAA,IACJ,sBAAsB,EAAE,SAAS,KAAK,WAAW,EAAE,SAAS,WAAW,aACzD,EAAE,SAAS,aAAa,YAAY,EAAE,SAAS,OAAO,eACpD,EAAE,WAAW,MAAM;AAAA,EACrC;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;","names":[]}

package/dist/{chunk-3JQ2FO3D.js → chunk-B23FFWU4.js}

@@ -29,7 +29,7 @@ import {
 import {
   a11yRoutes,
   smokeRoutes
-} from "./chunk-C6B4RHXR.js";
+} from "./chunk-O3GT46R2.js";
 
 // src/audits/deps.ts
 import { readFile } from "fs/promises";
@@ -1902,4 +1902,4 @@ export {
   runAudits,
   runAuditsAcross
 };
-//# sourceMappingURL=chunk-3JQ2FO3D.js.map
+//# sourceMappingURL=chunk-B23FFWU4.js.map

package/dist/{chunk-DJZWYIPP.js → chunk-BGTYPVLT.js}

@@ -15,4 +15,4 @@ export {
   escapeHtml,
   safeUrl
 };
-//# sourceMappingURL=chunk-DJZWYIPP.js.map
+//# sourceMappingURL=chunk-BGTYPVLT.js.map

package/dist/chunk-BGTYPVLT.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/util/html.ts"],"sourcesContent":["/**\n * Shared HTML/XML escape. One implementation behind the dashboard renderers\n * (`src/dashboard/render.ts`, `fleet-render.ts`), the daily digest\n * (`src/reports/digest.ts`), and the MJML email templates\n * (`src/reports/*-email/template.ts`).\n *\n * The set is the strict-XML set (`& < > \" '`), which is exactly what MJML's\n * `validationLevel: \"strict\"` parser needs and a superset of what plain HTML text\n * interpolation needs — so the SAME function serves both sinks. Site names\n * (e.g. \"Brown & Co\"), URLs, and operator commentary must not break the markup or\n * inject. The MJML templates re-export this as `escapeXml` for their callers.\n */\nexport function escapeHtml(s: string): string {\n  return s\n    .replace(/&/g, \"&amp;\")\n    .replace(/</g, \"&lt;\")\n    .replace(/>/g, \"&gt;\")\n    .replace(/\"/g, \"&quot;\")\n    .replace(/'/g, \"&#39;\");\n}\n\n/**\n * Embed a value inside a `<script>` body as a JavaScript literal.\n *\n * **`escapeHtml` is the wrong tool here and fails in a way that looks like it\n * worked.** A `<script>` element's content is raw text: the HTML parser does not\n * decode entities inside it, so `&quot;` reaching the browser stays the six\n * characters `&quot;` — corrupting the JavaScript rather than escaping it. The\n * house style on these pages is \"escapeHtml everything\", so the first person to\n * interpolate into a script body will reach for it by reflex. This exists so\n * there is a correct thing to reach for instead.\n *\n * `JSON.stringify` produces a valid JS literal (quotes included — do NOT wrap the\n * result in quotes yourself). The extra replacements cover the two sequences JSON\n * does not escape but the HTML tokenizer still acts on inside raw text:\n *  - `</` would end the script element early, so `</script>` in a string closes\n *    the tag and spills the rest of the value into the document as markup;\n *  - `<!--` opens a comment-like state that can swallow the code after it.\n *\n * U+2028/U+2029 are escaped too: they are literal line terminators in JS source\n * and JSON.stringify leaves them raw.\n */\nexport function scriptLiteral(value: unknown): string {\n  return JSON.stringify(value ?? null)\n    .replace(/</g, \"\\\\u003c\")\n    .replace(/>/g, \"\\\\u003e\")\n    .replace(/\\u2028/g, \"\\\\u2028\")\n    .replace(/\\u2029/g, \"\\\\u2029\");\n}\n\n/** Allow only http(s) URLs in an href context; everything else collapses to \"#\".\n *\n * Returns the PARSED, percent-encoded `u.href` — never the caller's raw string.\n * `new URL()` only validates the scheme; it does not sanitize the rest of the\n * string, so a well-formed https URL carrying a quote-breakout payload\n * (`https://x.example/\"><script>...`) parses fine and, if handed back\n * verbatim, produces a live injection wherever a caller interpolates the\n * result into an href without a further escapeHtml pass. Returning `u.href`\n * closes that gap: the URL parser itself percent-encodes `\"`, `<`, `>`, etc.\n * in the path/query. This also normalizes a bare-origin URL to carry a\n * trailing slash (`https://x.example` → `https://x.example/`) — a caller\n * that additionally wraps the result in escapeHtml (the majority pattern in\n * this repo) sees no behavior change beyond that encoding. */\nexport function safeUrl(raw: string): string {\n  try {\n    const u = new URL(raw);\n    if (u.protocol === \"http:\" || u.protocol === \"https:\") return u.href;\n  } catch {\n    // fall through\n  }\n  return \"#\";\n}\n"],"mappings":";AAYO,SAAS,WAAW,GAAmB;AAC5C,SAAO,EACJ,QAAQ,MAAM,OAAO,EACrB,QAAQ,MAAM,MAAM,EACpB,QAAQ,MAAM,MAAM,EACpB,QAAQ,MAAM,QAAQ,EACtB,QAAQ,MAAM,OAAO;AAC1B;AA4CO,SAAS,QAAQ,KAAqB;AAC3C,MAAI;AACF,UAAM,IAAI,IAAI,IAAI,GAAG;AACrB,QAAI,EAAE,aAAa,WAAW,EAAE,aAAa,SAAU,QAAO,EAAE;AAAA,EAClE,QAAQ;AAAA,EAER;AACA,SAAO;AACT;","names":[]}

package/dist/chunk-BRYXFH77.js

@@ -0,0 +1,70 @@
+// src/alerts/digest-state.ts
+function diffAttention(items, prior, today) {
+  const tagged = [];
+  const next = {};
+  for (const it of items) {
+    const was = prior[it.key];
+    const exhaustedFlip = it.autoFixExhausted === true && was?.exhausted !== true;
+    let status;
+    let firstFlaggedAt;
+    if (!was) {
+      status = "new";
+      firstFlaggedAt = today;
+    } else if (it.metric > was.metric || exhaustedFlip) {
+      status = "worse";
+      firstFlaggedAt = was.firstFlaggedAt;
+    } else {
+      status = "standing";
+      firstFlaggedAt = was.firstFlaggedAt;
+    }
+    tagged.push({ ...it, status });
+    next[it.key] = {
+      metric: it.metric,
+      firstFlaggedAt,
+      ...it.autoFixExhausted === true ? { exhausted: true } : {}
+    };
+  }
+  return { tagged, next };
+}
+var DIGEST_STATE_TABLE = "Digest State";
+async function readDigestState(base) {
+  const rows = [];
+  await base(DIGEST_STATE_TABLE).select({ maxRecords: 1, pageSize: 1 }).eachPage((records, fetchNextPage) => {
+    for (const rec of records) rows.push({ id: rec.id, fields: rec.fields });
+    fetchNextPage();
+  });
+  const first = rows[0];
+  if (!first) return {};
+  const raw = first.fields["Snapshot"];
+  if (typeof raw !== "string") return {};
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return {};
+  }
+}
+async function writeDigestState(base, snap, updatedAt = (/* @__PURE__ */ new Date()).toISOString()) {
+  const rows = [];
+  await base(DIGEST_STATE_TABLE).select({ maxRecords: 1, pageSize: 1 }).eachPage((records, fetchNextPage) => {
+    for (const rec of records) rows.push({ id: rec.id });
+    fetchNextPage();
+  });
+  const fields = {
+    Snapshot: JSON.stringify(snap),
+    "Updated At": updatedAt
+  };
+  const existing = rows[0];
+  if (existing) {
+    await base(DIGEST_STATE_TABLE).update([{ id: existing.id, fields }]);
+  } else {
+    await base(DIGEST_STATE_TABLE).create([{ fields }]);
+  }
+}
+
+export {
+  diffAttention,
+  DIGEST_STATE_TABLE,
+  readDigestState,
+  writeDigestState
+};
+//# sourceMappingURL=chunk-BRYXFH77.js.map

package/dist/chunk-BRYXFH77.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/alerts/digest-state.ts"],"sourcesContent":["// src/alerts/digest-state.ts\nimport type { FieldSet } from \"airtable\";\nimport type { AirtableBase } from \"../reports/airtable/client.js\";\nimport type { AttentionItem } from \"./attention.js\";\n\n/**\n * The persisted prior-run snapshot: stable item `key` → its last metric + the\n * date it was FIRST flagged. Lives as JSON in the single \"Digest State\" Airtable\n * row (the IO that loads/stores it — readDigestState/writeDigestState — is added\n * in component 2). `next` from diffAttention is what gets written back.\n * `exhausted` is carried only for vuln keys whose Renovate auto-fix has been\n * exhausted (absent = not exhausted; older snapshots without the field read the\n * same way).\n */\nexport type DigestSnapshot = Record<\n  string,\n  { metric: number; firstFlaggedAt: string; exhausted?: boolean }\n>;\n\n/**\n * PURE diff — the testable core of the hybrid \"snapshot now, mark what's new\".\n * For each current item vs the prior snapshot:\n *   - key absent from prior            → NEW      (firstFlaggedAt = today)\n *   - present and metric > prior.metric → WORSE    (keep the original firstFlaggedAt)\n *   - present and autoFixExhausted flipped on → WORSE (the count didn't move, but\n *     \"Renovate gave up\" is an escalation — without this the digest's first mention\n *     of a vuln, which is gated on exhaustion, would arrive unbadged)\n *   - otherwise (equal or dropped)      → STANDING (keep the original firstFlaggedAt)\n * `next` contains EXACTLY the current items' keys: resolved keys drop out, so a\n * fixed-then-recurring problem re-news correctly. Neither input is mutated.\n */\nexport function diffAttention(\n  items: AttentionItem[],\n  prior: DigestSnapshot,\n  today: string,\n): { tagged: AttentionItem[]; next: DigestSnapshot } {\n  const tagged: AttentionItem[] = [];\n  const next: DigestSnapshot = {};\n  for (const it of items) {\n    const was = prior[it.key];\n    const exhaustedFlip = it.autoFixExhausted === true && was?.exhausted !== true;\n    let status: AttentionItem[\"status\"];\n    let firstFlaggedAt: string;\n    if (!was) {\n      status = \"new\";\n      firstFlaggedAt = today;\n    } else if (it.metric > was.metric || exhaustedFlip) {\n      status = \"worse\";\n      firstFlaggedAt = was.firstFlaggedAt;\n    } else {\n      status = \"standing\";\n      firstFlaggedAt = was.firstFlaggedAt;\n    }\n    tagged.push({ ...it, status });\n    next[it.key] = {\n      metric: it.metric,\n      firstFlaggedAt,\n      ...(it.autoFixExhausted === true ? { exhausted: true } : {}),\n    };\n  }\n  return { tagged, next };\n}\n\n/** The single-row Airtable table that persists the prior digest snapshot. */\nexport const DIGEST_STATE_TABLE = \"Digest State\";\n\n/**\n * Read the persisted prior snapshot from the \"Digest State\" singleton.\n *\n * Reads the FIRST row of an unfiltered select (the table holds exactly one row;\n * the test fake does not evaluate filterByFormula, so we never rely on one). A\n * read miss (no row) OR a parse error (malformed Snapshot JSON) collapses to `{}`\n * — every key then reads as NEW once, which is safe degradation (never crashes\n * the digest).\n */\nexport async function readDigestState(base: AirtableBase): Promise<DigestSnapshot> {\n  const rows: { id: string; fields: Record<string, unknown> }[] = [];\n  await base(DIGEST_STATE_TABLE)\n    .select({ maxRecords: 1, pageSize: 1 })\n    .eachPage((records, fetchNextPage) => {\n      for (const rec of records) rows.push({ id: rec.id, fields: rec.fields });\n      fetchNextPage();\n    });\n  const first = rows[0];\n  if (!first) return {};\n  const raw = first.fields[\"Snapshot\"];\n  if (typeof raw !== \"string\") return {};\n  try {\n    return JSON.parse(raw) as DigestSnapshot;\n  } catch {\n    return {};\n  }\n}\n\n/**\n * Persist the next snapshot to the \"Digest State\" singleton: get-or-create the\n * one row. If a row exists, UPDATE it (keyed by its record id); otherwise CREATE\n * one. `Snapshot` = JSON.stringify(snap); `Updated At` = the injected ISO\n * timestamp (or now). A caller that catches+logs a write failure keeps the\n * already-sent digest unaffected (next run re-news at worst).\n */\nexport async function writeDigestState(\n  base: AirtableBase,\n  snap: DigestSnapshot,\n  updatedAt: string = new Date().toISOString(),\n): Promise<void> {\n  const rows: { id: string }[] = [];\n  await base(DIGEST_STATE_TABLE)\n    .select({ maxRecords: 1, pageSize: 1 })\n    .eachPage((records, fetchNextPage) => {\n      for (const rec of records) rows.push({ id: rec.id });\n      fetchNextPage();\n    });\n  const fields: FieldSet = {\n    Snapshot: JSON.stringify(snap),\n    \"Updated At\": updatedAt,\n  };\n  const existing = rows[0];\n  if (existing) {\n    await base(DIGEST_STATE_TABLE).update([{ id: existing.id, fields }]);\n  } else {\n    await base(DIGEST_STATE_TABLE).create([{ fields }]);\n  }\n}\n"],"mappings":";AA+BO,SAAS,cACd,OACA,OACA,OACmD;AACnD,QAAM,SAA0B,CAAC;AACjC,QAAM,OAAuB,CAAC;AAC9B,aAAW,MAAM,OAAO;AACtB,UAAM,MAAM,MAAM,GAAG,GAAG;AACxB,UAAM,gBAAgB,GAAG,qBAAqB,QAAQ,KAAK,cAAc;AACzE,QAAI;AACJ,QAAI;AACJ,QAAI,CAAC,KAAK;AACR,eAAS;AACT,uBAAiB;AAAA,IACnB,WAAW,GAAG,SAAS,IAAI,UAAU,eAAe;AAClD,eAAS;AACT,uBAAiB,IAAI;AAAA,IACvB,OAAO;AACL,eAAS;AACT,uBAAiB,IAAI;AAAA,IACvB;AACA,WAAO,KAAK,EAAE,GAAG,IAAI,OAAO,CAAC;AAC7B,SAAK,GAAG,GAAG,IAAI;AAAA,MACb,QAAQ,GAAG;AAAA,MACX;AAAA,MACA,GAAI,GAAG,qBAAqB,OAAO,EAAE,WAAW,KAAK,IAAI,CAAC;AAAA,IAC5D;AAAA,EACF;AACA,SAAO,EAAE,QAAQ,KAAK;AACxB;AAGO,IAAM,qBAAqB;AAWlC,eAAsB,gBAAgB,MAA6C;AACjF,QAAM,OAA0D,CAAC;AACjE,QAAM,KAAK,kBAAkB,EAC1B,OAAO,EAAE,YAAY,GAAG,UAAU,EAAE,CAAC,EACrC,SAAS,CAAC,SAAS,kBAAkB;AACpC,eAAW,OAAO,QAAS,MAAK,KAAK,EAAE,IAAI,IAAI,IAAI,QAAQ,IAAI,OAAO,CAAC;AACvE,kBAAc;AAAA,EAChB,CAAC;AACH,QAAM,QAAQ,KAAK,CAAC;AACpB,MAAI,CAAC,MAAO,QAAO,CAAC;AACpB,QAAM,MAAM,MAAM,OAAO,UAAU;AACnC,MAAI,OAAO,QAAQ,SAAU,QAAO,CAAC;AACrC,MAAI;AACF,WAAO,KAAK,MAAM,GAAG;AAAA,EACvB,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AASA,eAAsB,iBACpB,MACA,MACA,aAAoB,oBAAI,KAAK,GAAE,YAAY,GAC5B;AACf,QAAM,OAAyB,CAAC;AAChC,QAAM,KAAK,kBAAkB,EAC1B,OAAO,EAAE,YAAY,GAAG,UAAU,EAAE,CAAC,EACrC,SAAS,CAAC,SAAS,kBAAkB;AACpC,eAAW,OAAO,QAAS,MAAK,KAAK,EAAE,IAAI,IAAI,GAAG,CAAC;AACnD,kBAAc;AAAA,EAChB,CAAC;AACH,QAAM,SAAmB;AAAA,IACvB,UAAU,KAAK,UAAU,IAAI;AAAA,IAC7B,cAAc;AAAA,EAChB;AACA,QAAM,WAAW,KAAK,CAAC;AACvB,MAAI,UAAU;AACZ,UAAM,KAAK,kBAAkB,EAAE,OAAO,CAAC,EAAE,IAAI,SAAS,IAAI,OAAO,CAAC,CAAC;AAAA,EACrE,OAAO;AACL,UAAM,KAAK,kBAAkB,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;AAAA,EACpD;AACF;","names":[]}