@reddoorla/maintenance 0.87.0 → 0.88.3

package/dist/{db-UXNIZ2RG.js → db-DXUUAMXT.js}

@@ -1,9 +1,9 @@
 // src/cli/commands/db.ts
 async function runDbCommand(action, opts) {
   if (action === "migrate") {
-    const { readDbConfig } = await import("./client-AUE3XUPO.js");
+    const { readDbConfig } = await import("./client-JYKPVCJX.js");
     const cfg = opts.url ? { url: opts.url } : readDbConfig();
-    const { runMigrations } = await import("./migrate-GQH237A6.js");
+    const { runMigrations } = await import("./migrate-YITCXBLS.js");
     const { createClient } = await import("@libsql/client");
     const client = createClient(cfg.url === ":memory:" ? { url: ":memory:" } : cfg);
     const ran = await runMigrations(client);
@@ -13,7 +13,7 @@ async function runDbCommand(action, opts) {
     };
   }
   if (action === "replay-deadletters") {
-    const { readDbConfig, openDb } = await import("./client-AUE3XUPO.js");
+    const { readDbConfig, openDb } = await import("./client-JYKPVCJX.js");
     const db = await openDb(opts.url ? { url: opts.url } : readDbConfig());
     const { openBase, readAirtableConfig } = await import("./client-EPVO3FEH.js");
     const { getWebsiteBySlug } = await import("./websites-D6WYFAES.js");
@@ -26,12 +26,12 @@ async function runDbCommand(action, opts) {
       listRecentSubmissionsForEmail,
       markSubmissionsSpamRetro
     } = await import("./submissions-3I3GAQAX.js");
-    const { makeNotify } = await import("./notify-C645PGD5.js");
-    const { classifySpam } = await import("./spam-classifier-XLBFCO7G.js");
-    const { forwardNewsletterToWebhook } = await import("./webhook-VOGOW3W6.js");
+    const { makeNotify } = await import("./notify-4HP4GZ2H.js");
+    const { classifySpam } = await import("./spam-classifier-T5H4VTP6.js");
+    const { forwardNewsletterToWebhook } = await import("./webhook-XM6EV4XT.js");
     const { addMailchimpMember, mailchimpTagsFor } = await import("./mailchimp-XYCTEEJY.js");
     const { defaultResendClient } = await import("./resend-G2BJMAQV.js");
-    const { replayDeadLetters } = await import("./replay-C2LXMJZP.js");
+    const { replayDeadLetters } = await import("./replay-4S6ENYCH.js");
     let send = null;
     try {
       send = defaultResendClient().send;
@@ -75,7 +75,7 @@ async function runDbCommand(action, opts) {
     return { output: lines.join("\n"), code: result.stillFailing.length > 0 ? 1 : 0 };
   }
   if (action === "import-airtable" || action === "parity" || action === "sync") {
-    const { readDbConfig, openDb } = await import("./client-AUE3XUPO.js");
+    const { readDbConfig, openDb } = await import("./client-JYKPVCJX.js");
     const db = await openDb(opts.url ? { url: opts.url } : readDbConfig());
     const { openBase, readAirtableConfig } = await import("./client-EPVO3FEH.js");
     const base = openBase(readAirtableConfig());
@@ -116,7 +116,7 @@ async function runDbCommand(action, opts) {
       return { output: lines.join("\n"), code: 0 };
     }
     if (action === "sync") {
-      const { syncFleetState, formatSyncResult } = await import("./sync-CTUVXMCK.js");
+      const { syncFleetState, formatSyncResult } = await import("./sync-GBFV45WX.js");
       const result2 = await syncFleetState(db, {
         ...io,
         fetchAttachment: async (url) => {
@@ -133,12 +133,12 @@ async function runDbCommand(action, opts) {
         code: result2.parity.mismatches.length > 0 ? 1 : 0
       };
     }
-    const { checkFleetParity, formatParityResult } = await import("./parity-56KA2DGR.js");
+    const { checkFleetParity, formatParityResult } = await import("./parity-NBYZUBFU.js");
     const result = await checkFleetParity(db, io);
     return { output: formatParityResult(result), code: result.mismatches.length > 0 ? 1 : 0 };
   }
   if (action === "backfill-header-images") {
-    const { readDbConfig, openDb } = await import("./client-AUE3XUPO.js");
+    const { readDbConfig, openDb } = await import("./client-JYKPVCJX.js");
     const db = await openDb(opts.url ? { url: opts.url } : readDbConfig());
     const { openBase, readAirtableConfig } = await import("./client-EPVO3FEH.js");
     const base = openBase(readAirtableConfig());
@@ -159,19 +159,94 @@ async function runDbCommand(action, opts) {
     });
     return { output: formatBackfillResult(result), code: result.failed.length > 0 ? 1 : 0 };
   }
+  if (action === "backfill-digest-state") {
+    const { readDbConfig, openDb } = await import("./client-JYKPVCJX.js");
+    const db = await openDb(opts.url ? { url: opts.url } : readDbConfig());
+    const { readDigestState: readTurso, writeDigestState: writeTurso } = await import("./digest-state-3KHZF7GD.js");
+    const existing = await readTurso(db);
+    if (Object.keys(existing).length > 0) {
+      return {
+        output: `DIGEST_BACKFILL skipped=1 reason=turso-already-populated keys=${Object.keys(existing).length}`,
+        code: 0
+      };
+    }
+    const { openBase, readAirtableConfig } = await import("./client-EPVO3FEH.js");
+    const base = openBase(readAirtableConfig());
+    const { readDigestState: readAirtable, DIGEST_STATE_TABLE } = await import("./digest-state-F37XUCS5.js");
+    const rows = await base(DIGEST_STATE_TABLE).select({ maxRecords: 1, pageSize: 1 }).all();
+    const snap = await readAirtable(base);
+    const keys = Object.keys(snap).length;
+    await writeTurso(db, snap);
+    const stored = (await db.selectFrom("digest_state").selectAll().execute()).length;
+    const after = Object.keys(await readTurso(db)).length;
+    return {
+      output: `DIGEST_BACKFILL source=${rows.length > 0 ? "row" : "absent"} copied=${keys} verified=${after} rows=${stored}`,
+      code: after === keys && stored === 1 ? 0 : 1
+    };
+  }
   if (action === "dump") {
-    const { readDbConfig } = await import("./client-AUE3XUPO.js");
+    const { readDbConfig } = await import("./client-JYKPVCJX.js");
     const cfg = opts.url ? { url: opts.url } : readDbConfig();
     const { createClient } = await import("@libsql/client");
     const client = createClient(cfg.url === ":memory:" ? { url: ":memory:" } : cfg);
-    const { dumpDatabase } = await import("./dump-P6EBSIOH.js");
-    const sql = await dumpDatabase({
+    const { dumpDatabase } = await import("./dump-EPL7AZFR.js");
+    const sql = await dumpDatabase(
+      {
+        execute: async (q) => {
+          const r = await client.execute(q);
+          return { columns: r.columns, rows: r.rows };
+        }
+      },
+      (/* @__PURE__ */ new Date()).toISOString()
+    );
+    return { output: sql, code: 0 };
+  }
+  if (action === "restore") {
+    const file = opts.file;
+    if (!file) return { output: "restore: pass the dump path via --file", code: 1 };
+    if (!opts.url) {
+      return {
+        output: "restore: pass the TARGET database via --url (never defaults, to keep production out of reach)",
+        code: 1
+      };
+    }
+    const { readFile } = await import("fs/promises");
+    const sql = await readFile(file, "utf-8");
+    const { parseDumpManifest } = await import("./dump-EPL7AZFR.js");
+    const manifest = parseDumpManifest(sql);
+    if (!manifest) return { output: "RESTORE refused=manifest-absent", code: 1 };
+    const { createClient } = await import("@libsql/client");
+    const target = createClient({ url: opts.url });
+    const existing = await target.execute(
+      "SELECT COUNT(*) AS n FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%'"
+    );
+    if (Number(existing.rows[0]?.n ?? 0) > 0) {
+      return { output: "RESTORE refused=target-not-empty", code: 1 };
+    }
+    await target.executeMultiple(sql);
+    const { tableCounts, headerImageBytes } = await import("./dump-EPL7AZFR.js");
+    const exec = {
       execute: async (q) => {
-        const r = await client.execute(q);
+        const r = await target.execute(q);
         return { columns: r.columns, rows: r.rows };
       }
-    });
-    return { output: sql, code: 0 };
+    };
+    const counts = await tableCounts(exec);
+    const bytes = await headerImageBytes(exec);
+    const bad = [];
+    for (const [t, want] of Object.entries(manifest.tables)) {
+      if ((counts[t] ?? 0) !== want) bad.push(`${t}: origin=${want} restored=${counts[t] ?? 0}`);
+    }
+    if (bytes !== manifest.blobBytes)
+      bad.push(`header_image bytes: origin=${manifest.blobBytes} restored=${bytes}`);
+    const rows = Object.values(counts).reduce((a, b) => a + b, 0);
+    return {
+      output: [
+        ...bad.map((b) => `\u2717 ${b}`),
+        `RESTORE loaded=true tables=${Object.keys(counts).length} rows=${rows} blob_bytes=${bytes} mismatches=${bad.length}`
+      ].join("\n"),
+      code: bad.length > 0 ? 1 : 0
+    };
   }
   if (action === "verify-dump") {
     const file = opts.file;
@@ -185,33 +260,53 @@ async function runDbCommand(action, opts) {
     } catch (err) {
       return { output: `DUMP_VERIFY loaded=false error=${String(err)}`, code: 1 };
     }
-    const { tableCounts, countInsertsInDump } = await import("./dump-P6EBSIOH.js");
-    const restored = await tableCounts({
+    const { tableCounts, headerImageBytes, parseDumpManifest } = await import("./dump-EPL7AZFR.js");
+    const manifest = parseDumpManifest(sql);
+    if (!manifest) {
+      return {
+        output: "DUMP_VERIFY loaded=true manifest=absent \u2014 dump predates the origin manifest",
+        code: 1
+      };
+    }
+    const exec = {
       execute: async (q) => {
         const r = await scratch.execute(q);
         return { columns: r.columns, rows: r.rows };
       }
-    });
-    const expected = countInsertsInDump(sql);
+    };
+    const restored = await tableCounts(exec);
+    const restoredBlobBytes = await headerImageBytes(exec);
     const mismatches = [];
-    for (const [table, want] of Object.entries(expected)) {
+    for (const [table, want] of Object.entries(manifest.tables)) {
       if ((restored[table] ?? 0) !== want) {
-        mismatches.push(`${table}: dump=${want} restored=${restored[table] ?? 0}`);
+        mismatches.push(`${table}: origin=${want} restored=${restored[table] ?? 0}`);
       }
     }
+    for (const table of Object.keys(restored)) {
+      if (!(table in manifest.tables)) mismatches.push(`${table}: not in origin manifest`);
+    }
+    const { DATABASE_TABLES } = await import("./schema-75PJECAE.js");
+    for (const table of DATABASE_TABLES) {
+      if (!(table in restored)) mismatches.push(`${table}: MISSING from the backup entirely`);
+    }
+    if (restoredBlobBytes !== manifest.blobBytes) {
+      mismatches.push(
+        `header_image bytes: origin=${manifest.blobBytes} restored=${restoredBlobBytes}`
+      );
+    }
     const total = Object.values(restored).reduce((a, b) => a + b, 0);
     const lines = [
       ...mismatches.map((m) => `\u2717 ${m}`),
-      `DUMP_VERIFY loaded=true tables=${Object.keys(restored).length} rows=${total} mismatches=${mismatches.length}`
+      `DUMP_VERIFY loaded=true tables=${Object.keys(restored).length} rows=${total} blob_bytes=${restoredBlobBytes} mismatches=${mismatches.length}`
     ];
     return { output: lines.join("\n"), code: mismatches.length > 0 ? 1 : 0 };
   }
   return {
-    output: `unknown db action '${action}'. Use: migrate, replay-deadletters, import-airtable, parity, sync, backfill-header-images, dump, verify-dump.`,
+    output: `unknown db action '${action}'. Use: migrate, replay-deadletters, import-airtable, parity, sync, backfill-header-images, backfill-digest-state, dump, verify-dump, restore.`,
     code: 1
   };
 }
 export {
   runDbCommand
 };
-//# sourceMappingURL=db-UXNIZ2RG.js.map
+//# sourceMappingURL=db-DXUUAMXT.js.map

package/dist/db-DXUUAMXT.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli/commands/db.ts"],"sourcesContent":["export type DbCommandOptions = {\n  /** Override the libSQL url (tests use \":memory:\"); otherwise read from env. */\n  url?: string;\n  /** verify-dump: path to the dump file to load into a scratch engine. */\n  file?: string;\n  cwd?: string;\n  verbose?: boolean;\n};\n\n/** `db <action>` — migrate | replay-deadletters | import-airtable | parity | sync | dump | verify-dump. The db layer is imported\n *  dynamically so a non-db CLI invocation (and `--help`) never loads\n *  @libsql/client. Config is resolved inside each branch so an unknown action\n *  returns without needing any Turso env. */\nexport async function runDbCommand(\n  action: string,\n  opts: DbCommandOptions,\n): Promise<{ output: string; code: number }> {\n  if (action === \"migrate\") {\n    const { readDbConfig } = await import(\"../../db/client.js\");\n    const cfg = opts.url ? { url: opts.url } : readDbConfig();\n    const { runMigrations } = await import(\"../../db/migrate.js\");\n    const { createClient } = await import(\"@libsql/client\");\n    const client = createClient(cfg.url === \":memory:\" ? { url: \":memory:\" } : cfg);\n    const ran = await runMigrations(client);\n    return {\n      output: ran.length ? `Applied migrations: ${ran.join(\", \")}` : \"Already up to date.\",\n      code: 0,\n    };\n  }\n\n  // Re-run every lead that dead-lettered during a site-lookup outage (#539\n  // Phase 0) through the normal ingest pipeline. Exit 1 while any row is STILL\n  // failing — the store hasn't recovered and the operator should not read the\n  // run as \"all leads landed\". Zero rows is a clean 0: nothing owed.\n  if (action === \"replay-deadletters\") {\n    const { readDbConfig, openDb } = await import(\"../../db/client.js\");\n    const db = await openDb(opts.url ? { url: opts.url } : readDbConfig());\n    const { openBase, readAirtableConfig } = await import(\"../../reports/airtable/client.js\");\n    const { getWebsiteBySlug } = await import(\"../../reports/airtable/websites.js\");\n    const base = openBase(readAirtableConfig());\n    const {\n      createSubmission,\n      stampNotified,\n      stampFanout,\n      findRecentDuplicateSubmissions,\n      listRecentSubmissionsForEmail,\n      markSubmissionsSpamRetro,\n    } = await import(\"../../db/submissions.js\");\n    const { makeNotify } = await import(\"../../forms/notify.js\");\n    const { classifySpam } = await import(\"../../forms/spam-classifier.js\");\n    const { forwardNewsletterToWebhook } = await import(\"../../forms/webhook.js\");\n    const { addMailchimpMember, mailchimpTagsFor } = await import(\"../../forms/mailchimp.js\");\n    const { defaultResendClient } = await import(\"../../reports/send/resend.js\");\n    const { replayDeadLetters } = await import(\"../../forms/replay.js\");\n\n    // Same degradation as the ingest handler: an unconfigured Resend key means\n    // replayed leads land un-emailed (notify=failed) rather than blocking replay.\n    let send = null;\n    try {\n      send = defaultResendClient().send;\n    } catch (err) {\n      console.error(`[db] Resend unconfigured; replaying without email: ${String(err)}`);\n    }\n\n    // Mirrors the production handler's deps minus `deadLetter` (replayDeadLetters\n    // forbids and strips it — a throwing lookup must retry, not duplicate) and\n    // minus `defer` (a CLI has no post-response phase; the inline tail is fine).\n    const result = await replayDeadLetters(db, {\n      getWebsiteBySlug: (s) => getWebsiteBySlug(base, s),\n      createSubmission: (input) => createSubmission(db, input),\n      notify: makeNotify(send),\n      stampNotified: (id, status, messageId) => stampNotified(db, id, status, messageId),\n      now: () => new Date(),\n      classifySpam: (n, outcome) =>\n        classifySpam({\n          name: n.name,\n          email: n.email,\n          ...(n.message !== undefined ? { message: n.message } : {}),\n          formType: n.formType,\n          extraFields: n.extraFields,\n          turnstile: outcome,\n        }),\n      findRecentDuplicates: (message, since) =>\n        findRecentDuplicateSubmissions(db, message, since.toISOString()),\n      listRecentSubmissionsForEmail: (email, since) =>\n        listRecentSubmissionsForEmail(db, email, since.toISOString()),\n      retroBucket: (ids, reason) => markSubmissionsSpamRetro(db, ids, reason),\n      forwardNewsletter: (url, submission, site) =>\n        forwardNewsletterToWebhook(url, submission, site),\n      addToMailchimp: (site, submission) =>\n        addMailchimpMember({\n          apiKey: site.mailchimpApiKey ?? \"\",\n          audienceId: site.mailchimpAudienceId ?? \"\",\n          email: submission.email,\n          name: submission.name,\n          tags: mailchimpTagsFor(submission.formType),\n        }),\n      stampFanout: (id, fanoutStatus) => stampFanout(db, id, fanoutStatus),\n    });\n\n    const lines = [\n      ...result.replayed.map(\n        (r) => `replayed ${r.id} → ${r.outcome}${r.submissionId ? ` (${r.submissionId})` : \"\"}`,\n      ),\n      ...result.stillFailing.map((r) => `still failing ${r.id}: ${r.error}`),\n      `DEADLETTER_REPLAY replayed=${result.replayed.length} still_failing=${result.stillFailing.length}`,\n    ];\n    return { output: lines.join(\"\\n\"), code: result.stillFailing.length > 0 ? 1 : 0 };\n  }\n\n  // Phase 1.3/1.4 of #539. Both read the same two Airtable tables raw (id +\n  // fields, no mapRow coercion — the importer's mapping is the authority) and\n  // share that mapping, so parity is definitionally checked against what the\n  // importer writes.\n  if (action === \"import-airtable\" || action === \"parity\" || action === \"sync\") {\n    const { readDbConfig, openDb } = await import(\"../../db/client.js\");\n    const db = await openDb(opts.url ? { url: opts.url } : readDbConfig());\n    const { openBase, readAirtableConfig } = await import(\"../../reports/airtable/client.js\");\n    const base = openBase(readAirtableConfig());\n    const listRaw = async (table: string) =>\n      (await base(table).select().all()).map((r) => ({\n        id: r.id,\n        fields: r.fields as Record<string, unknown>,\n      }));\n    const io = {\n      listWebsiteRecords: () => listRaw(\"Websites\"),\n      listReportRecords: () => listRaw(\"Reports\"),\n      now: () => new Date(),\n    };\n\n    if (action === \"import-airtable\") {\n      const { importFleetState, formatReapSummary } = await import(\"../../db/import-airtable.js\");\n      const summary = await importFleetState(db, {\n        ...io,\n        // Attachment bodies ride expiring signed URLs; a failed fetch imports the\n        // row with rendered_html null and is NAMED in the summary, never silent.\n        fetchAttachment: async (url) => {\n          try {\n            const res = await fetch(url);\n            return res.ok ? await res.text() : null;\n          } catch {\n            return null;\n          }\n        },\n      });\n      const lines = [\n        `imported ${summary.sites} site(s) → sites/site_health/site_schedule`,\n        `imported ${summary.reports} report(s)`,\n      ];\n      if (summary.renderedHtmlMisses.length > 0) {\n        lines.push(\n          `⚠ ${summary.renderedHtmlMisses.length} report(s) imported WITHOUT Rendered HTML ` +\n            `(fetch failed / URL expired): ${summary.renderedHtmlMisses.join(\", \")}`,\n        );\n      }\n      // The import deletes rows Airtable no longer has, so this one-shot path\n      // reports the reap exactly as `db sync` does — same formatter, no second\n      // copy to fall out of step.\n      lines.push(...formatReapSummary(summary.reaped));\n      return { output: lines.join(\"\\n\"), code: 0 };\n    }\n\n    // Phase 2 backbone (#539): one hourly pass = import (attachment fetches\n    // only where the stored row lacks a body) + parity + one retry to absorb\n    // the import-read/parity-read race. Exit 1 on persistent mismatch.\n    if (action === \"sync\") {\n      const { syncFleetState, formatSyncResult } = await import(\"../../db/sync.js\");\n      const result = await syncFleetState(db, {\n        ...io,\n        fetchAttachment: async (url) => {\n          try {\n            const res = await fetch(url);\n            return res.ok ? await res.text() : null;\n          } catch {\n            return null;\n          }\n        },\n      });\n      return {\n        output: formatSyncResult(result),\n        code: result.parity.mismatches.length > 0 ? 1 : 0,\n      };\n    }\n\n    const { checkFleetParity, formatParityResult } = await import(\"../../db/parity.js\");\n    const result = await checkFleetParity(db, io);\n    return { output: formatParityResult(result), code: result.mismatches.length > 0 ? 1 : 0 };\n  }\n\n  // One-shot completion of design D5 (#539 Phase 2): copy every site's CURRENT\n  // Airtable \"Header image\" attachment into sites.header_image*. Idempotent —\n  // an already-populated BLOB is never overwritten (a re-run must not clobber\n  // a freshly generated image with a stale Airtable copy). Exit 1 when any\n  // fetch failed, so a partial backfill is never read as complete.\n  if (action === \"backfill-header-images\") {\n    const { readDbConfig, openDb } = await import(\"../../db/client.js\");\n    const db = await openDb(opts.url ? { url: opts.url } : readDbConfig());\n    const { openBase, readAirtableConfig } = await import(\"../../reports/airtable/client.js\");\n    const base = openBase(readAirtableConfig());\n    const { backfillHeaderImages, formatBackfillResult } =\n      await import(\"../../db/header-images.js\");\n    const result = await backfillHeaderImages(db, {\n      listWebsiteRecords: async () =>\n        (await base(\"Websites\").select().all()).map((r) => ({\n          id: r.id,\n          fields: r.fields as Record<string, unknown>,\n        })),\n      fetchBytes: async (url) => {\n        try {\n          const res = await fetch(url);\n          return res.ok ? new Uint8Array(await res.arrayBuffer()) : null;\n        } catch {\n          return null;\n        }\n      },\n    });\n    return { output: formatBackfillResult(result), code: result.failed.length > 0 ? 1 : 0 };\n  }\n\n  // #609: one-shot copy of the single Airtable \"Digest State\" row into Turso,\n  // so the first digest run after the read repoint sees yesterday's snapshot\n  // instead of an empty one. An empty read is not a crash — it badges EVERY\n  // item NEW, which lands in the operator's inbox reading as \"the whole fleet\n  // degraded overnight\". REFUSES to overwrite a snapshot Turso already holds:\n  // a re-run must never replace a fresher snapshot with a stale Airtable copy.\n  if (action === \"backfill-digest-state\") {\n    const { readDbConfig, openDb } = await import(\"../../db/client.js\");\n    const db = await openDb(opts.url ? { url: opts.url } : readDbConfig());\n    const { readDigestState: readTurso, writeDigestState: writeTurso } =\n      await import(\"../../db/digest-state.js\");\n    const existing = await readTurso(db);\n    if (Object.keys(existing).length > 0) {\n      return {\n        output: `DIGEST_BACKFILL skipped=1 reason=turso-already-populated keys=${Object.keys(existing).length}`,\n        code: 0,\n      };\n    }\n    const { openBase, readAirtableConfig } = await import(\"../../reports/airtable/client.js\");\n    const base = openBase(readAirtableConfig());\n    const { readDigestState: readAirtable, DIGEST_STATE_TABLE } =\n      await import(\"../../alerts/digest-state.js\");\n    // `source` separates \"Airtable has no row\" from \"Airtable has a row holding\n    // an empty snapshot\" — the reader collapses BOTH to {}, so copied=0 alone\n    // cannot tell a quiet fleet from a failed read. Learned by running this: the\n    // first real run printed copied=0 and only a hand probe showed the row was\n    // there and genuinely empty.\n    const rows = await base(DIGEST_STATE_TABLE).select({ maxRecords: 1, pageSize: 1 }).all();\n    const snap = await readAirtable(base);\n    const keys = Object.keys(snap).length;\n    await writeTurso(db, snap);\n    // Read it BACK. A returning write is not evidence the row landed — the same\n    // rule forms-notify-target learned on 2026-08-03. `stored` counts the ROW,\n    // not its keys, so an empty-but-present snapshot verifies as written.\n    const stored = (await db.selectFrom(\"digest_state\").selectAll().execute()).length;\n    const after = Object.keys(await readTurso(db)).length;\n    return {\n      output:\n        `DIGEST_BACKFILL source=${rows.length > 0 ? \"row\" : \"absent\"} ` +\n        `copied=${keys} verified=${after} rows=${stored}`,\n      code: after === keys && stored === 1 ? 0 : 1,\n    };\n  }\n\n  // Phase 1.5 of #539: platform-auth-free SQL dump to stdout-adjacent output.\n  // The nightly backup workflow redirects this to a file, encrypts, uploads;\n  // the rehearsed restore loads it into stock sqlite3 and compares row counts.\n  if (action === \"dump\") {\n    const { readDbConfig } = await import(\"../../db/client.js\");\n    const cfg = opts.url ? { url: opts.url } : readDbConfig();\n    const { createClient } = await import(\"@libsql/client\");\n    const client = createClient(cfg.url === \":memory:\" ? { url: \":memory:\" } : cfg);\n    const { dumpDatabase } = await import(\"../../db/dump.js\");\n    const sql = await dumpDatabase(\n      {\n        execute: async (q) => {\n          const r = await client.execute(q);\n          return { columns: r.columns, rows: r.rows as Array<Record<string, unknown>> };\n        },\n      },\n      new Date().toISOString(),\n    );\n    return { output: sql, code: 0 };\n  }\n\n  // Load a dump back into a REAL libSQL target (#612 review). The nightly\n  // rehearsal loads into `:memory:`, which proves the SQL parses — it does not\n  // prove you can get the data back into Turso, and that is the operation an\n  // actual recovery needs. Replaying ~17 MB of SQL with megabytes of inline hex\n  // over HTTP is materially different from an in-process load, and it had never\n  // been done. Refuses to touch a database that already holds rows: a restore\n  // is for an EMPTY target, and pointing this at production by mistake should\n  // cost nothing.\n  if (action === \"restore\") {\n    const file = opts.file;\n    if (!file) return { output: \"restore: pass the dump path via --file\", code: 1 };\n    if (!opts.url) {\n      return {\n        output:\n          \"restore: pass the TARGET database via --url (never defaults, to keep production out of reach)\",\n        code: 1,\n      };\n    }\n    const { readFile } = await import(\"node:fs/promises\");\n    const sql = await readFile(file, \"utf-8\");\n    const { parseDumpManifest } = await import(\"../../db/dump.js\");\n    const manifest = parseDumpManifest(sql);\n    if (!manifest) return { output: \"RESTORE refused=manifest-absent\", code: 1 };\n    const { createClient } = await import(\"@libsql/client\");\n    const target = createClient({ url: opts.url });\n    const existing = await target.execute(\n      \"SELECT COUNT(*) AS n FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%'\",\n    );\n    if (Number(existing.rows[0]?.n ?? 0) > 0) {\n      return { output: \"RESTORE refused=target-not-empty\", code: 1 };\n    }\n    await target.executeMultiple(sql);\n    const { tableCounts, headerImageBytes } = await import(\"../../db/dump.js\");\n    const exec = {\n      execute: async (q: string) => {\n        const r = await target.execute(q);\n        return { columns: r.columns, rows: r.rows as Array<Record<string, unknown>> };\n      },\n    };\n    const counts = await tableCounts(exec);\n    const bytes = await headerImageBytes(exec);\n    // Same origin-anchored comparison as verify-dump: a restore that \"succeeded\"\n    // with fewer rows than the origin held is not a restore.\n    const bad: string[] = [];\n    for (const [t, want] of Object.entries(manifest.tables)) {\n      if ((counts[t] ?? 0) !== want) bad.push(`${t}: origin=${want} restored=${counts[t] ?? 0}`);\n    }\n    if (bytes !== manifest.blobBytes)\n      bad.push(`header_image bytes: origin=${manifest.blobBytes} restored=${bytes}`);\n    const rows = Object.values(counts).reduce((a, b) => a + b, 0);\n    return {\n      output: [\n        ...bad.map((b) => `✗ ${b}`),\n        `RESTORE loaded=true tables=${Object.keys(counts).length} rows=${rows} blob_bytes=${bytes} mismatches=${bad.length}`,\n      ].join(\"\\n\"),\n      code: bad.length > 0 ? 1 : 0,\n    };\n  }\n\n  // The restore rehearsal (Phase 1.5's hard gate), runnable every night: load\n  // the dump into a FRESH in-memory engine and compare what came back against\n  // the ORIGIN MANIFEST the dump carries.\n  //\n  // It used to compare against INSERT counts parsed out of the dump text — i.e.\n  // the dump against itself. Both sides derived from one artifact, so a dump\n  // that collected 5 of 44 sites shrank both numbers together and verified\n  // clean. The manifest is read from the live database before any row is\n  // serialised, which is the only measurement that can notice a short dump.\n  //\n  // A dump that cannot restore is not a backup — and per the repo's instrument\n  // rule the check emits its machine line on every run, clean included.\n  if (action === \"verify-dump\") {\n    const file = opts.file;\n    if (!file) return { output: \"verify-dump: pass the dump path via --file\", code: 1 };\n    const { readFile } = await import(\"node:fs/promises\");\n    const sql = await readFile(file, \"utf-8\");\n    const { createClient } = await import(\"@libsql/client\");\n    const scratch = createClient({ url: \":memory:\" });\n    try {\n      await scratch.executeMultiple(sql);\n    } catch (err) {\n      return { output: `DUMP_VERIFY loaded=false error=${String(err)}`, code: 1 };\n    }\n    const { tableCounts, headerImageBytes, parseDumpManifest } = await import(\"../../db/dump.js\");\n    const manifest = parseDumpManifest(sql);\n    if (!manifest) {\n      // Refuse rather than fall back to self-comparison. Falling back would\n      // re-enable exactly the blind spot the manifest exists to close, and it\n      // would do so silently on the one artifact nobody was watching.\n      return {\n        output: \"DUMP_VERIFY loaded=true manifest=absent — dump predates the origin manifest\",\n        code: 1,\n      };\n    }\n    const exec = {\n      execute: async (q: string) => {\n        const r = await scratch.execute(q);\n        return { columns: r.columns, rows: r.rows as Array<Record<string, unknown>> };\n      },\n    };\n    const restored = await tableCounts(exec);\n    const restoredBlobBytes = await headerImageBytes(exec);\n    const mismatches: string[] = [];\n    for (const [table, want] of Object.entries(manifest.tables)) {\n      if ((restored[table] ?? 0) !== want) {\n        mismatches.push(`${table}: origin=${want} restored=${restored[table] ?? 0}`);\n      }\n    }\n    // A table the origin held and the dump never mentioned would otherwise be\n    // invisible: absent from `restored` AND absent from the loop above.\n    for (const table of Object.keys(restored)) {\n      if (!(table in manifest.tables)) mismatches.push(`${table}: not in origin manifest`);\n    }\n    // Coverage: every table the APP owns must be present. `tables=N` used to be\n    // printed and never asserted, so a table a migration failed to create — or\n    // that the dump lost — rode green forever. `digest_state` and\n    // `prospect_audits` were both absent from every artifact the night this was\n    // found, purely because they postdated the last run.\n    const { DATABASE_TABLES } = await import(\"../../db/schema.js\");\n    for (const table of DATABASE_TABLES) {\n      if (!(table in restored)) mismatches.push(`${table}: MISSING from the backup entirely`);\n    }\n    if (restoredBlobBytes !== manifest.blobBytes) {\n      mismatches.push(\n        `header_image bytes: origin=${manifest.blobBytes} restored=${restoredBlobBytes}`,\n      );\n    }\n    const total = Object.values(restored).reduce((a, b) => a + b, 0);\n    const lines = [\n      ...mismatches.map((m) => `✗ ${m}`),\n      `DUMP_VERIFY loaded=true tables=${Object.keys(restored).length} rows=${total} blob_bytes=${restoredBlobBytes} mismatches=${mismatches.length}`,\n    ];\n    return { output: lines.join(\"\\n\"), code: mismatches.length > 0 ? 1 : 0 };\n  }\n\n  return {\n    output: `unknown db action '${action}'. Use: migrate, replay-deadletters, import-airtable, parity, sync, backfill-header-images, backfill-digest-state, dump, verify-dump, restore.`,\n    code: 1,\n  };\n}\n"],"mappings":";AAaA,eAAsB,aACpB,QACA,MAC2C;AAC3C,MAAI,WAAW,WAAW;AACxB,UAAM,EAAE,aAAa,IAAI,MAAM,OAAO,sBAAoB;AAC1D,UAAM,MAAM,KAAK,MAAM,EAAE,KAAK,KAAK,IAAI,IAAI,aAAa;AACxD,UAAM,EAAE,cAAc,IAAI,MAAM,OAAO,uBAAqB;AAC5D,UAAM,EAAE,aAAa,IAAI,MAAM,OAAO,gBAAgB;AACtD,UAAM,SAAS,aAAa,IAAI,QAAQ,aAAa,EAAE,KAAK,WAAW,IAAI,GAAG;AAC9E,UAAM,MAAM,MAAM,cAAc,MAAM;AACtC,WAAO;AAAA,MACL,QAAQ,IAAI,SAAS,uBAAuB,IAAI,KAAK,IAAI,CAAC,KAAK;AAAA,MAC/D,MAAM;AAAA,IACR;AAAA,EACF;AAMA,MAAI,WAAW,sBAAsB;AACnC,UAAM,EAAE,cAAc,OAAO,IAAI,MAAM,OAAO,sBAAoB;AAClE,UAAM,KAAK,MAAM,OAAO,KAAK,MAAM,EAAE,KAAK,KAAK,IAAI,IAAI,aAAa,CAAC;AACrE,UAAM,EAAE,UAAU,mBAAmB,IAAI,MAAM,OAAO,sBAAkC;AACxF,UAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,wBAAoC;AAC9E,UAAM,OAAO,SAAS,mBAAmB,CAAC;AAC1C,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,IAAI,MAAM,OAAO,2BAAyB;AAC1C,UAAM,EAAE,WAAW,IAAI,MAAM,OAAO,sBAAuB;AAC3D,UAAM,EAAE,aAAa,IAAI,MAAM,OAAO,+BAAgC;AACtE,UAAM,EAAE,2BAA2B,IAAI,MAAM,OAAO,uBAAwB;AAC5E,UAAM,EAAE,oBAAoB,iBAAiB,IAAI,MAAM,OAAO,yBAA0B;AACxF,UAAM,EAAE,oBAAoB,IAAI,MAAM,OAAO,sBAA8B;AAC3E,UAAM,EAAE,kBAAkB,IAAI,MAAM,OAAO,sBAAuB;AAIlE,QAAI,OAAO;AACX,QAAI;AACF,aAAO,oBAAoB,EAAE;AAAA,IAC/B,SAAS,KAAK;AACZ,cAAQ,MAAM,sDAAsD,OAAO,GAAG,CAAC,EAAE;AAAA,IACnF;AAKA,UAAM,SAAS,MAAM,kBAAkB,IAAI;AAAA,MACzC,kBAAkB,CAAC,MAAM,iBAAiB,MAAM,CAAC;AAAA,MACjD,kBAAkB,CAAC,UAAU,iBAAiB,IAAI,KAAK;AAAA,MACvD,QAAQ,WAAW,IAAI;AAAA,MACvB,eAAe,CAAC,IAAI,QAAQ,cAAc,cAAc,IAAI,IAAI,QAAQ,SAAS;AAAA,MACjF,KAAK,MAAM,oBAAI,KAAK;AAAA,MACpB,cAAc,CAAC,GAAG,YAChB,aAAa;AAAA,QACX,MAAM,EAAE;AAAA,QACR,OAAO,EAAE;AAAA,QACT,GAAI,EAAE,YAAY,SAAY,EAAE,SAAS,EAAE,QAAQ,IAAI,CAAC;AAAA,QACxD,UAAU,EAAE;AAAA,QACZ,aAAa,EAAE;AAAA,QACf,WAAW;AAAA,MACb,CAAC;AAAA,MACH,sBAAsB,CAAC,SAAS,UAC9B,+BAA+B,IAAI,SAAS,MAAM,YAAY,CAAC;AAAA,MACjE,+BAA+B,CAAC,OAAO,UACrC,8BAA8B,IAAI,OAAO,MAAM,YAAY,CAAC;AAAA,MAC9D,aAAa,CAAC,KAAK,WAAW,yBAAyB,IAAI,KAAK,MAAM;AAAA,MACtE,mBAAmB,CAAC,KAAK,YAAY,SACnC,2BAA2B,KAAK,YAAY,IAAI;AAAA,MAClD,gBAAgB,CAAC,MAAM,eACrB,mBAAmB;AAAA,QACjB,QAAQ,KAAK,mBAAmB;AAAA,QAChC,YAAY,KAAK,uBAAuB;AAAA,QACxC,OAAO,WAAW;AAAA,QAClB,MAAM,WAAW;AAAA,QACjB,MAAM,iBAAiB,WAAW,QAAQ;AAAA,MAC5C,CAAC;AAAA,MACH,aAAa,CAAC,IAAI,iBAAiB,YAAY,IAAI,IAAI,YAAY;AAAA,IACrE,CAAC;AAED,UAAM,QAAQ;AAAA,MACZ,GAAG,OAAO,SAAS;AAAA,QACjB,CAAC,MAAM,YAAY,EAAE,EAAE,WAAM,EAAE,OAAO,GAAG,EAAE,eAAe,KAAK,EAAE,YAAY,MAAM,EAAE;AAAA,MACvF;AAAA,MACA,GAAG,OAAO,aAAa,IAAI,CAAC,MAAM,iBAAiB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;AAAA,MACrE,8BAA8B,OAAO,SAAS,MAAM,kBAAkB,OAAO,aAAa,MAAM;AAAA,IAClG;AACA,WAAO,EAAE,QAAQ,MAAM,KAAK,IAAI,GAAG,MAAM,OAAO,aAAa,SAAS,IAAI,IAAI,EAAE;AAAA,EAClF;AAMA,MAAI,WAAW,qBAAqB,WAAW,YAAY,WAAW,QAAQ;AAC5E,UAAM,EAAE,cAAc,OAAO,IAAI,MAAM,OAAO,sBAAoB;AAClE,UAAM,KAAK,MAAM,OAAO,KAAK,MAAM,EAAE,KAAK,KAAK,IAAI,IAAI,aAAa,CAAC;AACrE,UAAM,EAAE,UAAU,mBAAmB,IAAI,MAAM,OAAO,sBAAkC;AACxF,UAAM,OAAO,SAAS,mBAAmB,CAAC;AAC1C,UAAM,UAAU,OAAO,WACpB,MAAM,KAAK,KAAK,EAAE,OAAO,EAAE,IAAI,GAAG,IAAI,CAAC,OAAO;AAAA,MAC7C,IAAI,EAAE;AAAA,MACN,QAAQ,EAAE;AAAA,IACZ,EAAE;AACJ,UAAM,KAAK;AAAA,MACT,oBAAoB,MAAM,QAAQ,UAAU;AAAA,MAC5C,mBAAmB,MAAM,QAAQ,SAAS;AAAA,MAC1C,KAAK,MAAM,oBAAI,KAAK;AAAA,IACtB;AAEA,QAAI,WAAW,mBAAmB;AAChC,YAAM,EAAE,kBAAkB,kBAAkB,IAAI,MAAM,OAAO,+BAA6B;AAC1F,YAAM,UAAU,MAAM,iBAAiB,IAAI;AAAA,QACzC,GAAG;AAAA;AAAA;AAAA,QAGH,iBAAiB,OAAO,QAAQ;AAC9B,cAAI;AACF,kBAAM,MAAM,MAAM,MAAM,GAAG;AAC3B,mBAAO,IAAI,KAAK,MAAM,IAAI,KAAK,IAAI;AAAA,UACrC,QAAQ;AACN,mBAAO;AAAA,UACT;AAAA,QACF;AAAA,MACF,CAAC;AACD,YAAM,QAAQ;AAAA,QACZ,YAAY,QAAQ,KAAK;AAAA,QACzB,YAAY,QAAQ,OAAO;AAAA,MAC7B;AACA,UAAI,QAAQ,mBAAmB,SAAS,GAAG;AACzC,cAAM;AAAA,UACJ,UAAK,QAAQ,mBAAmB,MAAM,2EACH,QAAQ,mBAAmB,KAAK,IAAI,CAAC;AAAA,QAC1E;AAAA,MACF;AAIA,YAAM,KAAK,GAAG,kBAAkB,QAAQ,MAAM,CAAC;AAC/C,aAAO,EAAE,QAAQ,MAAM,KAAK,IAAI,GAAG,MAAM,EAAE;AAAA,IAC7C;AAKA,QAAI,WAAW,QAAQ;AACrB,YAAM,EAAE,gBAAgB,iBAAiB,IAAI,MAAM,OAAO,oBAAkB;AAC5E,YAAMA,UAAS,MAAM,eAAe,IAAI;AAAA,QACtC,GAAG;AAAA,QACH,iBAAiB,OAAO,QAAQ;AAC9B,cAAI;AACF,kBAAM,MAAM,MAAM,MAAM,GAAG;AAC3B,mBAAO,IAAI,KAAK,MAAM,IAAI,KAAK,IAAI;AAAA,UACrC,QAAQ;AACN,mBAAO;AAAA,UACT;AAAA,QACF;AAAA,MACF,CAAC;AACD,aAAO;AAAA,QACL,QAAQ,iBAAiBA,OAAM;AAAA,QAC/B,MAAMA,QAAO,OAAO,WAAW,SAAS,IAAI,IAAI;AAAA,MAClD;AAAA,IACF;AAEA,UAAM,EAAE,kBAAkB,mBAAmB,IAAI,MAAM,OAAO,sBAAoB;AAClF,UAAM,SAAS,MAAM,iBAAiB,IAAI,EAAE;AAC5C,WAAO,EAAE,QAAQ,mBAAmB,MAAM,GAAG,MAAM,OAAO,WAAW,SAAS,IAAI,IAAI,EAAE;AAAA,EAC1F;AAOA,MAAI,WAAW,0BAA0B;AACvC,UAAM,EAAE,cAAc,OAAO,IAAI,MAAM,OAAO,sBAAoB;AAClE,UAAM,KAAK,MAAM,OAAO,KAAK,MAAM,EAAE,KAAK,KAAK,IAAI,IAAI,aAAa,CAAC;AACrE,UAAM,EAAE,UAAU,mBAAmB,IAAI,MAAM,OAAO,sBAAkC;AACxF,UAAM,OAAO,SAAS,mBAAmB,CAAC;AAC1C,UAAM,EAAE,sBAAsB,qBAAqB,IACjD,MAAM,OAAO,6BAA2B;AAC1C,UAAM,SAAS,MAAM,qBAAqB,IAAI;AAAA,MAC5C,oBAAoB,aACjB,MAAM,KAAK,UAAU,EAAE,OAAO,EAAE,IAAI,GAAG,IAAI,CAAC,OAAO;AAAA,QAClD,IAAI,EAAE;AAAA,QACN,QAAQ,EAAE;AAAA,MACZ,EAAE;AAAA,MACJ,YAAY,OAAO,QAAQ;AACzB,YAAI;AACF,gBAAM,MAAM,MAAM,MAAM,GAAG;AAC3B,iBAAO,IAAI,KAAK,IAAI,WAAW,MAAM,IAAI,YAAY,CAAC,IAAI;AAAA,QAC5D,QAAQ;AACN,iBAAO;AAAA,QACT;AAAA,MACF;AAAA,IACF,CAAC;AACD,WAAO,EAAE,QAAQ,qBAAqB,MAAM,GAAG,MAAM,OAAO,OAAO,SAAS,IAAI,IAAI,EAAE;AAAA,EACxF;AAQA,MAAI,WAAW,yBAAyB;AACtC,UAAM,EAAE,cAAc,OAAO,IAAI,MAAM,OAAO,sBAAoB;AAClE,UAAM,KAAK,MAAM,OAAO,KAAK,MAAM,EAAE,KAAK,KAAK,IAAI,IAAI,aAAa,CAAC;AACrE,UAAM,EAAE,iBAAiB,WAAW,kBAAkB,WAAW,IAC/D,MAAM,OAAO,4BAA0B;AACzC,UAAM,WAAW,MAAM,UAAU,EAAE;AACnC,QAAI,OAAO,KAAK,QAAQ,EAAE,SAAS,GAAG;AACpC,aAAO;AAAA,QACL,QAAQ,iEAAiE,OAAO,KAAK,QAAQ,EAAE,MAAM;AAAA,QACrG,MAAM;AAAA,MACR;AAAA,IACF;AACA,UAAM,EAAE,UAAU,mBAAmB,IAAI,MAAM,OAAO,sBAAkC;AACxF,UAAM,OAAO,SAAS,mBAAmB,CAAC;AAC1C,UAAM,EAAE,iBAAiB,cAAc,mBAAmB,IACxD,MAAM,OAAO,4BAA8B;AAM7C,UAAM,OAAO,MAAM,KAAK,kBAAkB,EAAE,OAAO,EAAE,YAAY,GAAG,UAAU,EAAE,CAAC,EAAE,IAAI;AACvF,UAAM,OAAO,MAAM,aAAa,IAAI;AACpC,UAAM,OAAO,OAAO,KAAK,IAAI,EAAE;AAC/B,UAAM,WAAW,IAAI,IAAI;AAIzB,UAAM,UAAU,MAAM,GAAG,WAAW,cAAc,EAAE,UAAU,EAAE,QAAQ,GAAG;AAC3E,UAAM,QAAQ,OAAO,KAAK,MAAM,UAAU,EAAE,CAAC,EAAE;AAC/C,WAAO;AAAA,MACL,QACE,0BAA0B,KAAK,SAAS,IAAI,QAAQ,QAAQ,WAClD,IAAI,aAAa,KAAK,SAAS,MAAM;AAAA,MACjD,MAAM,UAAU,QAAQ,WAAW,IAAI,IAAI;AAAA,IAC7C;AAAA,EACF;AAKA,MAAI,WAAW,QAAQ;AACrB,UAAM,EAAE,aAAa,IAAI,MAAM,OAAO,sBAAoB;AAC1D,UAAM,MAAM,KAAK,MAAM,EAAE,KAAK,KAAK,IAAI,IAAI,aAAa;AACxD,UAAM,EAAE,aAAa,IAAI,MAAM,OAAO,gBAAgB;AACtD,UAAM,SAAS,aAAa,IAAI,QAAQ,aAAa,EAAE,KAAK,WAAW,IAAI,GAAG;AAC9E,UAAM,EAAE,aAAa,IAAI,MAAM,OAAO,oBAAkB;AACxD,UAAM,MAAM,MAAM;AAAA,MAChB;AAAA,QACE,SAAS,OAAO,MAAM;AACpB,gBAAM,IAAI,MAAM,OAAO,QAAQ,CAAC;AAChC,iBAAO,EAAE,SAAS,EAAE,SAAS,MAAM,EAAE,KAAuC;AAAA,QAC9E;AAAA,MACF;AAAA,OACA,oBAAI,KAAK,GAAE,YAAY;AAAA,IACzB;AACA,WAAO,EAAE,QAAQ,KAAK,MAAM,EAAE;AAAA,EAChC;AAUA,MAAI,WAAW,WAAW;AACxB,UAAM,OAAO,KAAK;AAClB,QAAI,CAAC,KAAM,QAAO,EAAE,QAAQ,0CAA0C,MAAM,EAAE;AAC9E,QAAI,CAAC,KAAK,KAAK;AACb,aAAO;AAAA,QACL,QACE;AAAA,QACF,MAAM;AAAA,MACR;AAAA,IACF;AACA,UAAM,EAAE,SAAS,IAAI,MAAM,OAAO,aAAkB;AACpD,UAAM,MAAM,MAAM,SAAS,MAAM,OAAO;AACxC,UAAM,EAAE,kBAAkB,IAAI,MAAM,OAAO,oBAAkB;AAC7D,UAAM,WAAW,kBAAkB,GAAG;AACtC,QAAI,CAAC,SAAU,QAAO,EAAE,QAAQ,mCAAmC,MAAM,EAAE;AAC3E,UAAM,EAAE,aAAa,IAAI,MAAM,OAAO,gBAAgB;AACtD,UAAM,SAAS,aAAa,EAAE,KAAK,KAAK,IAAI,CAAC;AAC7C,UAAM,WAAW,MAAM,OAAO;AAAA,MAC5B;AAAA,IACF;AACA,QAAI,OAAO,SAAS,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,GAAG;AACxC,aAAO,EAAE,QAAQ,oCAAoC,MAAM,EAAE;AAAA,IAC/D;AACA,UAAM,OAAO,gBAAgB,GAAG;AAChC,UAAM,EAAE,aAAa,iBAAiB,IAAI,MAAM,OAAO,oBAAkB;AACzE,UAAM,OAAO;AAAA,MACX,SAAS,OAAO,MAAc;AAC5B,cAAM,IAAI,MAAM,OAAO,QAAQ,CAAC;AAChC,eAAO,EAAE,SAAS,EAAE,SAAS,MAAM,EAAE,KAAuC;AAAA,MAC9E;AAAA,IACF;AACA,UAAM,SAAS,MAAM,YAAY,IAAI;AACrC,UAAM,QAAQ,MAAM,iBAAiB,IAAI;AAGzC,UAAM,MAAgB,CAAC;AACvB,eAAW,CAAC,GAAG,IAAI,KAAK,OAAO,QAAQ,SAAS,MAAM,GAAG;AACvD,WAAK,OAAO,CAAC,KAAK,OAAO,KAAM,KAAI,KAAK,GAAG,CAAC,YAAY,IAAI,aAAa,OAAO,CAAC,KAAK,CAAC,EAAE;AAAA,IAC3F;AACA,QAAI,UAAU,SAAS;AACrB,UAAI,KAAK,8BAA8B,SAAS,SAAS,aAAa,KAAK,EAAE;AAC/E,UAAM,OAAO,OAAO,OAAO,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,IAAI,GAAG,CAAC;AAC5D,WAAO;AAAA,MACL,QAAQ;AAAA,QACN,GAAG,IAAI,IAAI,CAAC,MAAM,UAAK,CAAC,EAAE;AAAA,QAC1B,8BAA8B,OAAO,KAAK,MAAM,EAAE,MAAM,SAAS,IAAI,eAAe,KAAK,eAAe,IAAI,MAAM;AAAA,MACpH,EAAE,KAAK,IAAI;AAAA,MACX,MAAM,IAAI,SAAS,IAAI,IAAI;AAAA,IAC7B;AAAA,EACF;AAcA,MAAI,WAAW,eAAe;AAC5B,UAAM,OAAO,KAAK;AAClB,QAAI,CAAC,KAAM,QAAO,EAAE,QAAQ,8CAA8C,MAAM,EAAE;AAClF,UAAM,EAAE,SAAS,IAAI,MAAM,OAAO,aAAkB;AACpD,UAAM,MAAM,MAAM,SAAS,MAAM,OAAO;AACxC,UAAM,EAAE,aAAa,IAAI,MAAM,OAAO,gBAAgB;AACtD,UAAM,UAAU,aAAa,EAAE,KAAK,WAAW,CAAC;AAChD,QAAI;AACF,YAAM,QAAQ,gBAAgB,GAAG;AAAA,IACnC,SAAS,KAAK;AACZ,aAAO,EAAE,QAAQ,kCAAkC,OAAO,GAAG,CAAC,IAAI,MAAM,EAAE;AAAA,IAC5E;AACA,UAAM,EAAE,aAAa,kBAAkB,kBAAkB,IAAI,MAAM,OAAO,oBAAkB;AAC5F,UAAM,WAAW,kBAAkB,GAAG;AACtC,QAAI,CAAC,UAAU;AAIb,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,MAAM;AAAA,MACR;AAAA,IACF;AACA,UAAM,OAAO;AAAA,MACX,SAAS,OAAO,MAAc;AAC5B,cAAM,IAAI,MAAM,QAAQ,QAAQ,CAAC;AACjC,eAAO,EAAE,SAAS,EAAE,SAAS,MAAM,EAAE,KAAuC;AAAA,MAC9E;AAAA,IACF;AACA,UAAM,WAAW,MAAM,YAAY,IAAI;AACvC,UAAM,oBAAoB,MAAM,iBAAiB,IAAI;AACrD,UAAM,aAAuB,CAAC;AAC9B,eAAW,CAAC,OAAO,IAAI,KAAK,OAAO,QAAQ,SAAS,MAAM,GAAG;AAC3D,WAAK,SAAS,KAAK,KAAK,OAAO,MAAM;AACnC,mBAAW,KAAK,GAAG,KAAK,YAAY,IAAI,aAAa,SAAS,KAAK,KAAK,CAAC,EAAE;AAAA,MAC7E;AAAA,IACF;AAGA,eAAW,SAAS,OAAO,KAAK,QAAQ,GAAG;AACzC,UAAI,EAAE,SAAS,SAAS,QAAS,YAAW,KAAK,GAAG,KAAK,0BAA0B;AAAA,IACrF;AAMA,UAAM,EAAE,gBAAgB,IAAI,MAAM,OAAO,sBAAoB;AAC7D,eAAW,SAAS,iBAAiB;AACnC,UAAI,EAAE,SAAS,UAAW,YAAW,KAAK,GAAG,KAAK,oCAAoC;AAAA,IACxF;AACA,QAAI,sBAAsB,SAAS,WAAW;AAC5C,iBAAW;AAAA,QACT,8BAA8B,SAAS,SAAS,aAAa,iBAAiB;AAAA,MAChF;AAAA,IACF;AACA,UAAM,QAAQ,OAAO,OAAO,QAAQ,EAAE,OAAO,CAAC,GAAG,MAAM,IAAI,GAAG,CAAC;AAC/D,UAAM,QAAQ;AAAA,MACZ,GAAG,WAAW,IAAI,CAAC,MAAM,UAAK,CAAC,EAAE;AAAA,MACjC,kCAAkC,OAAO,KAAK,QAAQ,EAAE,MAAM,SAAS,KAAK,eAAe,iBAAiB,eAAe,WAAW,MAAM;AAAA,IAC9I;AACA,WAAO,EAAE,QAAQ,MAAM,KAAK,IAAI,GAAG,MAAM,WAAW,SAAS,IAAI,IAAI,EAAE;AAAA,EACzE;AAEA,SAAO;AAAA,IACL,QAAQ,sBAAsB,MAAM;AAAA,IACpC,MAAM;AAAA,EACR;AACF;","names":["result"]}

package/dist/{digest-FW6QMZZJ.js → digest-NBLECFM7.js}

@@ -12,16 +12,17 @@ import {
   collectPrismicDriftAlerts,
   collectRenovateAlerts,
   collectTurnstileGuardrailAlerts,
-  collectVulnAlerts,
-  diffAttention,
-  readDigestState,
-  writeDigestState
-} from "./chunk-NCMZMLY7.js";
-import "./chunk-SDDPUAWH.js";
+  collectVulnAlerts
+} from "./chunk-WPL5GERE.js";
+import "./chunk-6I6L3CMX.js";
 import "./chunk-PZR4EBPY.js";
 import {
   isIdempotencyConflict
-} from "./chunk-NDWYJLRF.js";
+} from "./chunk-DGZWFI2G.js";
+import {
+  diffAttention,
+  writeDigestState
+} from "./chunk-BRYXFH77.js";
 import {
   isPendingApproval,
   listAllReports
@@ -32,13 +33,13 @@ import {
   openBase,
   readAirtableConfig
 } from "./chunk-HN6I2XWI.js";
-import "./chunk-ZGBEIWSC.js";
+import "./chunk-XP5WM2LV.js";
 import "./chunk-GECESMVS.js";
-import "./chunk-MT2JINSS.js";
+import "./chunk-5UINJNAJ.js";
+import "./chunk-KJGKZLCT.js";
 import {
   escapeHtml
-} from "./chunk-DJZWYIPP.js";
-import "./chunk-5UINJNAJ.js";
+} from "./chunk-BGTYPVLT.js";
 import {
   listWebsites,
   siteSlug
@@ -46,10 +47,10 @@ import {
 import {
   defaultResendClient
 } from "./chunk-WEKL2HYJ.js";
-import "./chunk-XUGSZP7Z.js";
-import "./chunk-EVBCK2KC.js";
-import "./chunk-JHGHLKFS.js";
-import "./chunk-3SF7D4DY.js";
+import "./chunk-W45FZEGE.js";
+import "./chunk-RARREDQE.js";
+import "./chunk-WS6NU475.js";
+import "./chunk-MFHS7IQ2.js";
 import "./chunk-6VAL7XJT.js";
 
 // src/reports/digest.ts
@@ -148,7 +149,7 @@ async function listPendingApproval(base) {
 async function fetchNotifyBounceCounts(now) {
   try {
     const [{ openDb, readDbConfig }, { countNotifyBouncedBySite }, { screenOutsSince }] = await Promise.all([
-      import("./client-AUE3XUPO.js"),
+      import("./client-JYKPVCJX.js"),
       import("./submissions-3I3GAQAX.js"),
       import("./screenouts-7P5GOZMV.js")
     ]);
@@ -159,11 +160,89 @@ async function fetchNotifyBounceCounts(now) {
     return /* @__PURE__ */ new Map();
   }
 }
+async function readDigestStateFromDb() {
+  const [{ openDb, readDbConfig }, { readDigestState }] = await Promise.all([
+    import("./client-JYKPVCJX.js"),
+    import("./digest-state-3KHZF7GD.js")
+  ]);
+  return readDigestState(await openDb(readDbConfig()));
+}
+async function writeRollupOnce(options, now) {
+  if (options.cockpitRollup) {
+    await options.cockpitRollup.write(now);
+    return "written";
+  }
+  return writeCockpitRollupToDb(now);
+}
+async function writeDigestStateToDb(next) {
+  const [{ openDb, readDbConfig }, { writeDigestState: writeDigestState2 }] = await Promise.all([
+    import("./client-JYKPVCJX.js"),
+    import("./digest-state-3KHZF7GD.js")
+  ]);
+  await writeDigestState2(await openDb(readDbConfig()), next);
+}
+async function writeCockpitRollupToDb(now) {
+  if (!process.env.TURSO_DATABASE_URL) return "absent";
+  const [{ openDb, readDbConfig }, { writeCockpitRollup }, screenouts, submissions, collectors] = await Promise.all([
+    import("./client-JYKPVCJX.js"),
+    import("./digest-state-3KHZF7GD.js"),
+    import("./screenouts-7P5GOZMV.js"),
+    import("./submissions-3I3GAQAX.js"),
+    import("./digest-collectors-NM7WUWQP.js")
+  ]);
+  const db = await openDb(readDbConfig());
+  const SCREEN_OUT_WINDOW_DAYS = 30;
+  const screenOutSince = screenouts.screenOutsSince(now, SCREEN_OUT_WINDOW_DAYS);
+  const bounceSince = screenouts.screenOutsSince(now, collectors.NOTIFY_BOUNCE_WINDOW_DAYS);
+  const totals = { honeypot: 0, tooFast: 0, markedSpam: 0 };
+  for (const t of (await screenouts.listScreenOutsSince(db, screenOutSince)).values()) {
+    totals.honeypot += t.honeypot;
+    totals.tooFast += t.tooFast;
+    totals.markedSpam += t.markedSpam;
+  }
+  const bounces = await submissions.countNotifyBouncedBySite(db, bounceSince);
+  await writeCockpitRollup(db, {
+    spamTotals: totals,
+    notifyBounces: Object.fromEntries(bounces),
+    windowDays: {
+      screenOuts: SCREEN_OUT_WINDOW_DAYS,
+      bounces: collectors.NOTIFY_BOUNCE_WINDOW_DAYS
+    },
+    computedAt: now.toISOString()
+  });
+  return "written";
+}
+async function persistDigestState(base, next, writeState, writeRollup) {
+  let turso = 0;
+  let airtable = 0;
+  let rollup = "0";
+  try {
+    await (writeState ?? writeDigestStateToDb)(next);
+    turso = 1;
+  } catch (e) {
+    console.warn(`\u26A0 digest state write failed (turso): ${e.message}`);
+  }
+  try {
+    await writeDigestState(base, next);
+    airtable = 1;
+  } catch (e) {
+    console.warn(`\u26A0 digest state write failed (airtable): ${e.message}`);
+  }
+  if (writeRollup) {
+    try {
+      rollup = await writeRollup() === "absent" ? "absent" : "1";
+    } catch (e) {
+      rollup = "0";
+      console.warn(`\u26A0 cockpit rollup write failed: ${e.message}`);
+    }
+  }
+  console.log(`DIGEST_STATE_WRITE turso=${turso} airtable=${airtable} rollup=${rollup}`);
+}
 var SUBMISSIONS_DIGEST_WINDOW_MS = 24 * 60 * 60 * 1e3;
 async function fetchSubmissionsDigestCounts(now) {
   try {
     const [{ openDb, readDbConfig }, { countSubmissionsSinceBySite }] = await Promise.all([
-      import("./client-AUE3XUPO.js"),
+      import("./client-JYKPVCJX.js"),
       import("./submissions-3I3GAQAX.js")
     ]);
     const db = await openDb(readDbConfig());
@@ -260,17 +339,18 @@ async function runDigest(options) {
       reports,
       now: today
     });
-    const prior = await readDigestState(base);
+    const prior = await (options.digestState?.read ?? readDigestStateFromDb)();
     const { tagged, next } = diffAttention(collected, prior, digestDateKey(today));
     const needsAttention = tagged.filter(
       (it) => it.kind !== "vuln" || it.autoFixExhausted === true
     );
     if (readyForYourYes.length === 0 && needsAttention.length === 0) {
-      try {
-        await writeDigestState(base, next);
-      } catch (e) {
-        console.warn(`\u26A0 digest state write failed: ${e.message}`);
-      }
+      await persistDigestState(
+        base,
+        next,
+        options.digestState?.write,
+        () => writeRollupOnce(options, today)
+      );
       return { output: "Digest skipped (nothing ready, nothing needs attention).", code: 0 };
     }
     const counts = options.submissionCounts !== void 0 ? options.submissionCounts : await fetchSubmissionsDigestCounts(today);
@@ -298,11 +378,12 @@ async function runDigest(options) {
       }
       throw err;
     }
-    try {
-      await writeDigestState(base, next);
-    } catch (e) {
-      console.warn(`\u26A0 digest state write failed: ${e.message}`);
-    }
+    await persistDigestState(
+      base,
+      next,
+      options.digestState?.write,
+      () => writeRollupOnce(options, today)
+    );
     return { output: `Digest sent to ${to.join(", ")} (${result.messageId})`, code: 0 };
   } catch (err) {
     if (typeof err.exitCode === "number") {
@@ -343,4 +424,4 @@ export {
   renderDigestHtml,
   runDigest
 };
-//# sourceMappingURL=digest-FW6QMZZJ.js.map
+//# sourceMappingURL=digest-NBLECFM7.js.map

package/dist/digest-NBLECFM7.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/reports/digest.ts"],"sourcesContent":["// src/reports/digest.ts\nimport { openBase, readAirtableConfig, type AirtableBase } from \"./airtable/client.js\";\nimport { listAllReports, isPendingApproval } from \"./airtable/reports.js\";\nimport type { ReportRow } from \"./airtable/reports.js\";\nimport { listWebsites, siteSlug, type WebsiteRow } from \"./airtable/websites.js\";\nimport { defaultResendClient, type ResendClient } from \"./send/resend.js\";\nimport { isIdempotencyConflict } from \"./send/idempotency.js\";\nimport {\n  collectVulnAlerts,\n  collectDeliveryFailures,\n  collectPreflightBlocked,\n  collectLighthouseAlerts,\n  collectRenovateAlerts,\n  collectCiAlerts,\n  collectAnalyticsFailures,\n  collectTurnstileGuardrailAlerts,\n  collectNotifyBounceAlerts,\n  collectPrismicDriftAlerts,\n  NOTIFY_BOUNCE_WINDOW_DAYS,\n} from \"../alerts/digest-collectors.js\";\nimport { diffAttention } from \"../alerts/digest-state.js\";\nimport {\n  writeDigestState as writeAirtableDigestState,\n  type DigestSnapshot,\n} from \"../alerts/digest-state.js\";\nimport { escapeHtml as esc } from \"../util/html.js\";\nimport { operatorEmail } from \"../util/operator.js\";\nimport type {\n  AttentionItem,\n  AttentionSeverity,\n  AttentionStatus,\n  ReadyItem,\n  DigestSections,\n  SubmissionsDigestSection,\n} from \"../alerts/attention.js\";\n// Type-only: erased at compile time, so the kysely/libsql devDependency never loads\n// in a consuming fleet site (the runtime read is the dynamic import in\n// fetchSubmissionsDigestCounts, same rule as fetchNotifyBounceCounts).\nimport type { SiteSubmissionCounts } from \"../db/submissions.js\";\n\n// The attention/digest contract lives in `../alerts/attention.ts` (a dependency-free\n// types module) so the `alerts/*` collectors can depend on it without importing back\n// from this renderer/IO module — see attention.ts for the cycle it breaks. Re-exported\n// here so existing `from \"./digest.js\"` type importers keep resolving.\nexport type {\n  AttentionItem,\n  AttentionSeverity,\n  AttentionStatus,\n  ReadyItem,\n  DigestSections,\n  SubmissionsDigestSection,\n} from \"../alerts/attention.js\";\n\nconst GREY = \"#757575\";\nconst RED = \"#C00\";\n\n/** Shared anchor style — Gmail does not inherit font-family into <a> tags. */\nconst ANCHOR_STYLE = `color:${RED};font-family:helvetica,sans-serif`;\n\nfunction readySection(items: ReadyItem[]): string {\n  const heading = `<h2 style=\"color:${RED};font-family:helvetica,sans-serif;font-size:20px;font-weight:700;margin:32px 0 8px\">Ready for your yes</h2>`;\n  if (items.length === 0) {\n    return `${heading}<p style=\"color:${GREY};font-family:helvetica,sans-serif;font-size:16px;margin:0\">Nothing waiting on you.</p>`;\n  }\n  const rows = items\n    .map((it) => {\n      const safeUrl = it.dashboardUrl.startsWith(\"https://\") ? it.dashboardUrl : undefined;\n      const link = safeUrl\n        ? `<a href=\"${esc(safeUrl)}\" style=\"${ANCHOR_STYLE}\">review &amp; approve</a>`\n        : `review &amp; approve`;\n      return `\n      <tr>\n        <td style=\"color:${GREY};font-family:helvetica,sans-serif;font-size:16px;line-height:24px;padding-bottom:8px\">\n          <strong style=\"color:#222\">${esc(it.siteName)}</strong> — ${esc(it.reportType)} (${esc(it.period)})\n          — ${link}\n        </td>\n      </tr>`;\n    })\n    .join(\"\");\n  return `${heading}<table role=\"presentation\" style=\"border-collapse:collapse;margin:0\">${rows}</table>`;\n}\n\nconst SEVERITY_ORDER: Record<AttentionSeverity, number> = { critical: 0, warning: 1 };\n\n/** Render the per-item status badge (\"NEW\"/\"WORSE\"); standing items get nothing. */\nfunction attentionBadge(status?: AttentionStatus): string {\n  if (status === \"new\")\n    return `<strong style=\"color:${RED};font-family:helvetica,sans-serif\">NEW</strong> `;\n  if (status === \"worse\")\n    return `<strong style=\"color:${RED};font-family:helvetica,sans-serif\">WORSE</strong> `;\n  return \"\";\n}\n\nfunction attentionSection(items: AttentionItem[]): string {\n  const heading = `<h2 style=\"color:${RED};font-family:helvetica,sans-serif;font-size:20px;font-weight:700;margin:32px 0 8px\">Needs attention</h2>`;\n  if (items.length === 0) {\n    return `${heading}<p style=\"color:${GREY};font-family:helvetica,sans-serif;font-size:16px;margin:0\">All clear — nothing needs attention.</p>`;\n  }\n\n  // Group by siteName, preserving first-seen site order; sort within a site by\n  // severity (critical first).\n  const bySite = new Map<string, AttentionItem[]>();\n  for (const it of items) {\n    const bucket = bySite.get(it.siteName);\n    if (bucket) bucket.push(it);\n    else bySite.set(it.siteName, [it]);\n  }\n\n  const groups = [...bySite.entries()]\n    .map(([siteName, siteItems]) => {\n      const sorted = [...siteItems].sort(\n        (a, b) => SEVERITY_ORDER[a.severity] - SEVERITY_ORDER[b.severity],\n      );\n      const rows = sorted\n        .map((it) => {\n          const safeUrl = it.url?.startsWith(\"https://\") ? it.url : undefined;\n          const titleHtml = safeUrl\n            ? `<a href=\"${esc(safeUrl)}\" style=\"${ANCHOR_STYLE}\">${esc(it.title)}</a>`\n            : esc(it.title);\n          return `\n          <tr>\n            <td style=\"color:${GREY};font-family:helvetica,sans-serif;font-size:16px;line-height:24px;padding-bottom:8px\">${attentionBadge(it.status)}${titleHtml}</td>\n          </tr>`;\n        })\n        .join(\"\");\n      return `\n      <tr>\n        <td style=\"color:#222;font-family:helvetica,sans-serif;font-size:16px;font-weight:700;padding:8px 0 4px\">${esc(siteName)}</td>\n      </tr>\n      ${rows}`;\n    })\n    .join(\"\");\n\n  return `${heading}<table role=\"presentation\" style=\"border-collapse:collapse;margin:0\">${groups}</table>`;\n}\n\n/** The \"Submissions (24h)\" telemetry block: fleet totals + a per-site glance line.\n *  Context, not an alarm — absent/null section or all-zero totals render nothing\n *  (no-noise), and the section never triggers a send on its own (see runDigest). */\nfunction submissionsSection(s: SubmissionsDigestSection | null | undefined): string {\n  if (!s) return \"\";\n  if (s.leads === 0 && s.signups === 0 && s.spamAuto === 0) return \"\";\n  const heading = `<h2 style=\"color:${RED};font-family:helvetica,sans-serif;font-size:20px;font-weight:700;margin:32px 0 8px\">Submissions (24h)</h2>`;\n  // All three terms always render together — omitting a zero term next to a nonzero\n  // one reads as \"not measured\" rather than \"none\"; simplest honest form.\n  const totals = [\n    `${s.leads} new lead${s.leads === 1 ? \"\" : \"s\"}`,\n    `${s.signups} newsletter/RSVP signup${s.signups === 1 ? \"\" : \"s\"}`,\n    `${s.spamAuto} auto-filtered spam`,\n  ].join(\" · \");\n  const totalLine = `<p style=\"color:${GREY};font-family:helvetica,sans-serif;font-size:16px;margin:0\">${totals}</p>`;\n  if (s.bySite.length === 0) return `${heading}${totalLine}`;\n  const rows = s.bySite\n    .map((site) => {\n      const parts: string[] = [];\n      if (site.leads > 0) parts.push(`${site.leads} lead${site.leads === 1 ? \"\" : \"s\"}`);\n      if (site.signups > 0) parts.push(`${site.signups} signup${site.signups === 1 ? \"\" : \"s\"}`);\n      if (site.spamAuto > 0) parts.push(`${site.spamAuto} auto-filtered`);\n      return `\n      <tr>\n        <td style=\"color:${GREY};font-family:helvetica,sans-serif;font-size:16px;line-height:24px;padding-bottom:8px\">\n          <strong style=\"color:#222\">${esc(site.siteName)}</strong> — ${parts.join(\" · \")}\n        </td>\n      </tr>`;\n    })\n    .join(\"\");\n  return `${heading}${totalLine}<table role=\"presentation\" style=\"border-collapse:collapse;margin:8px 0 0\">${rows}</table>`;\n}\n\nconst FROM_ADDRESS = \"Reddoor Reports <reports@reddoorla.com>\";\n\n/** UTC \"YYYY-MM-DD\" — the Resend idempotency key suffix, so a same-day cron re-fire dedupes. */\nfunction digestDateKey(d: Date): string {\n  return d.toISOString().slice(0, 10);\n}\n\n/**\n * The gate for \"Ready for your yes\": Draft ready ∧ ¬Approved to send ∧ Sent at BLANK.\n *\n * Implemented as `listAllReports(base).filter(...)` (the authorized deviation from the plan's\n * draft, which pre-dated Slice 1's merged fix): `listAllReports` already calls `mapRow`, which\n * handles `Period` correctly, so no local `rawToReportRow` duplicate is needed. The JS filter\n * does real work — the test fake does NOT evaluate `filterByFormula` — so correctness is\n * test-provable here.\n *\n * Exported: the fleet homepage (Task 3.5b) reuses it for the pending-approval count.\n */\nexport async function listPendingApproval(base: AirtableBase): Promise<ReportRow[]> {\n  return (await listAllReports(base)).filter(isPendingApproval);\n}\n\n// ── collectAttention (IO wrapper, sibling to runDigest) ──────────────────────\n\nexport type CollectAttentionDeps = {\n  base: AirtableBase;\n  /** Same baseUrl value runDigest threads; used for the /s/<slug> links. */\n  baseUrl: string;\n  /** Pre-fetched Websites rows. When supplied (runDigest already read them),\n   *  collectAttention reuses them instead of issuing a second `listWebsites`. */\n  websites?: WebsiteRow[];\n  /** Pre-fetched Reports rows. When supplied (runDigest already read them),\n   *  collectAttention reuses them instead of issuing a second `listAllReports`. */\n  reports?: ReportRow[];\n  /** Clock for the GitHub-signals staleness gate (collectCiAlerts /\n   *  collectRenovateAlerts skip a >3-day-stale sweep). Defaults to wall-clock;\n   *  runDigest threads its run-start `today` so a quiet repo's frozen CI/Renovate\n   *  signal stops badging once its sweep goes stale. */\n  now?: Date;\n  /** Pre-fetched per-site bounced-lead-notification counts (tests, or a caller with\n   *  an open db). When omitted, collectAttention reads them from libSQL itself —\n   *  defensively, so a missing TURSO env or a Turso blip drops just this signal. */\n  notifyBounces?: ReadonlyMap<string, number>;\n};\n\n/** Per-site bounced-notification counts for the notify-bounce collector, read from\n *  libSQL over the collector's own window. The db modules are imported DYNAMICALLY:\n *  src/db/submissions.ts pulls kysely at top level, and kysely/libsql live in\n *  devDependencies consuming fleet sites don't install — a static import here would\n *  crash their CLI at require time (same rule as openDb's own lazy loads). Any\n *  failure (no TURSO env, Turso down) logs and yields an empty map: the digest\n *  must never blank over a missing optional signal. */\nasync function fetchNotifyBounceCounts(now: Date): Promise<ReadonlyMap<string, number>> {\n  try {\n    const [{ openDb, readDbConfig }, { countNotifyBouncedBySite }, { screenOutsSince }] =\n      await Promise.all([\n        import(\"../db/client.js\"),\n        import(\"../db/submissions.js\"),\n        import(\"../db/screenouts.js\"),\n      ]);\n    const db = await openDb(readDbConfig());\n    return await countNotifyBouncedBySite(db, screenOutsSince(now, NOTIFY_BOUNCE_WINDOW_DAYS));\n  } catch (e) {\n    console.warn(`⚠ notify-bounce counts unavailable (libSQL): ${(e as Error).message}`);\n    return new Map();\n  }\n}\n\n/** The prior snapshot, from Turso (#609). Dynamically imported for the same\n *  reason as fetchNotifyBounceCounts: kysely/libsql are devDependencies that\n *  consuming fleet sites do not install, so a static import would crash their\n *  CLI at require time.\n *\n *  NOT defensive, deliberately — the Airtable read it replaces was not either.\n *  Swallowing a failure here would silently badge every item NEW, which reads\n *  as \"the whole fleet degraded overnight\" in the operator's inbox. A thrown\n *  error is the honest outcome. */\nasync function readDigestStateFromDb(): Promise<DigestSnapshot> {\n  const [{ openDb, readDbConfig }, { readDigestState }] = await Promise.all([\n    import(\"../db/client.js\"),\n    import(\"../db/digest-state.js\"),\n  ]);\n  return readDigestState(await openDb(readDbConfig()));\n}\n\n/** Bridge the injectable seam (returns void) onto the three-state contract the\n *  log line reports. An injected writer that resolves is a real write. */\nasync function writeRollupOnce(\n  options: DigestRunOptions,\n  now: Date,\n): Promise<\"written\" | \"absent\"> {\n  if (options.cockpitRollup) {\n    await options.cockpitRollup.write(now);\n    return \"written\";\n  }\n  return writeCockpitRollupToDb(now);\n}\n\n/** The write half of {@link readDigestStateFromDb}, same lazy-import rule. */\nasync function writeDigestStateToDb(next: DigestSnapshot): Promise<void> {\n  const [{ openDb, readDbConfig }, { writeDigestState }] = await Promise.all([\n    import(\"../db/client.js\"),\n    import(\"../db/digest-state.js\"),\n  ]);\n  await writeDigestState(await openDb(readDbConfig()), next);\n}\n\n/**\n * Compute the cockpit's \"since a window\" roll-ups once, here, instead of on\n * every page load (MED-16 of the 2026-08-26 review).\n *\n * Both aggregates read the whole `submissions` table — the one unbounded-growth\n * table in the schema — and the cockpit root is the operator's most-loaded page.\n * Turso meters row scans, so recomputing them per request is a cost that grows\n * forever against numbers that move once a day.\n *\n * The trade is explicit: the figures become up to 24h old. That is why the\n * payload carries `computedAt` and the windows it used, and why an absent\n * roll-up reads as null rather than zero — a stale or unmeasured number\n * presented as live is worse than no number.\n *\n * Best-effort, like the snapshot write beside it: the digest has already been\n * sent by the time this runs, and a failed roll-up costs one strip on one page\n * until tomorrow, never the digest.\n */\nasync function writeCockpitRollupToDb(now: Date): Promise<\"written\" | \"absent\"> {\n  // No Turso configured is a THIRD state, not a failure: it is what every unit\n  // test looks like, and reporting it as `rollup=0` would train the eye to\n  // ignore the number that is supposed to catch a dead writer. Same three-state\n  // vocabulary the site mirrors already use (`mirrored=1|0|absent`).\n  if (!process.env.TURSO_DATABASE_URL) return \"absent\";\n  const [{ openDb, readDbConfig }, { writeCockpitRollup }, screenouts, submissions, collectors] =\n    await Promise.all([\n      import(\"../db/client.js\"),\n      import(\"../db/digest-state.js\"),\n      import(\"../db/screenouts.js\"),\n      import(\"../db/submissions.js\"),\n      import(\"../alerts/digest-collectors.js\"),\n    ]);\n  const db = await openDb(readDbConfig());\n  const SCREEN_OUT_WINDOW_DAYS = 30;\n  const screenOutSince = screenouts.screenOutsSince(now, SCREEN_OUT_WINDOW_DAYS);\n  const bounceSince = screenouts.screenOutsSince(now, collectors.NOTIFY_BOUNCE_WINDOW_DAYS);\n\n  const totals = { honeypot: 0, tooFast: 0, markedSpam: 0 };\n  for (const t of (await screenouts.listScreenOutsSince(db, screenOutSince)).values()) {\n    totals.honeypot += t.honeypot;\n    totals.tooFast += t.tooFast;\n    totals.markedSpam += t.markedSpam;\n  }\n  const bounces = await submissions.countNotifyBouncedBySite(db, bounceSince);\n\n  await writeCockpitRollup(db, {\n    spamTotals: totals,\n    notifyBounces: Object.fromEntries(bounces),\n    windowDays: {\n      screenOuts: SCREEN_OUT_WINDOW_DAYS,\n      bounces: collectors.NOTIFY_BOUNCE_WINDOW_DAYS,\n    },\n    computedAt: now.toISOString(),\n  });\n  return \"written\";\n}\n\n/** Persist the next snapshot to BOTH stores (#609 dual-write).\n *\n *  Turso is the read side, so a failure there is the one that actually costs\n *  correct NEW badges tomorrow — but Airtable keeps being written so the move\n *  stays reversible while Phase 5 is in flight. Both are best-effort: the\n *  digest has already been sent (or deliberately skipped) by the time this\n *  runs, and a snapshot write failure re-news at worst.\n *\n *  The DIGEST_STATE_WRITE line exists because of #585: a dual-write that\n *  silently stopped running looked identical to a healthy one for weeks. One\n *  line, always emitted, naming both halves. */\nasync function persistDigestState(\n  base: AirtableBase,\n  next: DigestSnapshot,\n  writeState?: (snap: DigestSnapshot) => Promise<void>,\n  writeRollup?: () => Promise<\"written\" | \"absent\">,\n): Promise<void> {\n  let turso = 0;\n  let airtable = 0;\n  let rollup: \"1\" | \"0\" | \"absent\" = \"0\";\n  try {\n    await (writeState ?? writeDigestStateToDb)(next);\n    turso = 1;\n  } catch (e) {\n    console.warn(`⚠ digest state write failed (turso): ${(e as Error).message}`);\n  }\n  try {\n    await writeAirtableDigestState(base, next);\n    airtable = 1;\n  } catch (e) {\n    console.warn(`⚠ digest state write failed (airtable): ${(e as Error).message}`);\n  }\n  // The cockpit roll-up rides the same \"already sent, best-effort\" contract, and\n  // gets its own counter on the line for the #585 reason: a dual-write that\n  // silently stopped running looked identical to a healthy one for weeks. An\n  // ABSENT `rollup=` is a different failure from `rollup=0`.\n  if (writeRollup) {\n    try {\n      rollup = (await writeRollup()) === \"absent\" ? \"absent\" : \"1\";\n    } catch (e) {\n      rollup = \"0\";\n      console.warn(`⚠ cockpit rollup write failed: ${(e as Error).message}`);\n    }\n  }\n  console.log(`DIGEST_STATE_WRITE turso=${turso} airtable=${airtable} rollup=${rollup}`);\n}\n\n/** The \"Submissions (24h)\" telemetry window — a precise 24h ISO-timestamp compare\n *  (unlike screenOutsSince's date-only strings). */\nconst SUBMISSIONS_DIGEST_WINDOW_MS = 24 * 60 * 60 * 1000;\n\n/** Per-site submission counts for the digest telemetry section, read from libSQL.\n *  Dynamic imports + fail-soft for the same reason as fetchNotifyBounceCounts:\n *  kysely/libsql are devDependencies consuming fleet sites don't install, and a\n *  Turso blip must drop just this section, never the digest. Returns null (not an\n *  empty map) on failure so the renderer can omit the section rather than claim a\n *  quiet fleet. */\nasync function fetchSubmissionsDigestCounts(\n  now: Date,\n): Promise<ReadonlyMap<string, SiteSubmissionCounts> | null> {\n  try {\n    const [{ openDb, readDbConfig }, { countSubmissionsSinceBySite }] = await Promise.all([\n      import(\"../db/client.js\"),\n      import(\"../db/submissions.js\"),\n    ]);\n    const db = await openDb(readDbConfig());\n    return await countSubmissionsSinceBySite(\n      db,\n      new Date(now.getTime() - SUBMISSIONS_DIGEST_WINDOW_MS).toISOString(),\n    );\n  } catch (e) {\n    console.warn(`⚠ submissions telemetry unavailable (libSQL): ${(e as Error).message}`);\n    return null;\n  }\n}\n\n/** Assemble the \"Submissions (24h)\" section from the per-site counts. PURE (exported\n *  for direct tests). Totals sum ALL map entries — an orphan site id still counts in\n *  the fleet totals. bySite lists only ids that resolve in `sitesById` AND carry any\n *  nonzero count, sorted by total volume desc then siteName A-Z. null counts (libSQL\n *  unavailable) → null (section omitted). */\nexport function buildSubmissionsDigestSection(\n  counts: ReadonlyMap<string, SiteSubmissionCounts> | null,\n  sitesById: ReadonlyMap<string, WebsiteRow>,\n): SubmissionsDigestSection | null {\n  if (counts === null) return null;\n  let leads = 0;\n  let signups = 0;\n  let spamAuto = 0;\n  const bySite: SubmissionsDigestSection[\"bySite\"] = [];\n  for (const [siteId, c] of counts) {\n    leads += c.leads;\n    signups += c.signups;\n    spamAuto += c.spamAuto;\n    const site = sitesById.get(siteId);\n    if (site && c.leads + c.signups + c.spamAuto > 0) {\n      bySite.push({ siteName: site.name, ...c });\n    }\n  }\n  bySite.sort(\n    (a, b) =>\n      b.leads + b.signups + b.spamAuto - (a.leads + a.signups + a.spamAuto) ||\n      a.siteName.localeCompare(b.siteName),\n  );\n  return { leads, signups, spamAuto, bySite };\n}\n\n/** Run a single collector under a try/catch: a thrown collector logs and yields []\n *  so one broken signal never blanks the whole \"Needs attention\" section. */\nfunction runCollector(label: string, fn: () => AttentionItem[]): AttentionItem[] {\n  try {\n    return fn();\n  } catch (e) {\n    console.warn(`⚠ attention collector \"${label}\" failed: ${(e as Error).message}`);\n    return [];\n  }\n}\n\n/**\n * Fetch the free signals once (listAllReports + listWebsites) — or reuse the\n * `reports`/`websites` arrays runDigest already read, so a single run reads each\n * table once — build the sitesById map the delivery collector needs, and run each\n * pure collector isolated. Returns the union of items; diffing/badging happens in\n * runDigest.\n *\n * The Renovate + CI signals come from the SAME persisted collectors the operator\n * cockpit (`buildCockpitModel`) runs — `collectRenovateAlerts` (key\n * `renovate:<siteId>`) and `collectCiAlerts` (key `ci:<siteId>`), reading the\n * nightly-persisted `renovateFailingCis`/`defaultBranchCi` fields. This is the\n * key-space unification: because the digest writes the shared Digest State\n * snapshot with these same keys, the cockpit's NEW/WORSE diff finds them and the\n * two surfaces agree (the prior live per-PR `renovate:<repo>#<n>` sweep never\n * matched the cockpit's keys, so its cards badged NEW forever).\n */\nexport async function collectAttention(deps: CollectAttentionDeps): Promise<AttentionItem[]> {\n  const reports = deps.reports ?? (await listAllReports(deps.base));\n  const websites = deps.websites ?? (await listWebsites(deps.base));\n  const now = deps.now ?? new Date();\n  const notifyBounces = deps.notifyBounces ?? (await fetchNotifyBounceCounts(now));\n  const sitesById = new Map<string, WebsiteRow>(websites.map((w) => [w.id, w]));\n  return [\n    ...runCollector(\"vuln\", () => collectVulnAlerts(websites, deps.baseUrl)),\n    ...runCollector(\"delivery\", () => collectDeliveryFailures(reports, sitesById, deps.baseUrl)),\n    ...runCollector(\"preflight\", () => collectPreflightBlocked(reports, sitesById, deps.baseUrl)),\n    ...runCollector(\"lighthouse\", () => collectLighthouseAlerts(websites, deps.baseUrl)),\n    ...runCollector(\"renovate\", () => collectRenovateAlerts(websites, deps.baseUrl, now)),\n    ...runCollector(\"ci\", () => collectCiAlerts(websites, deps.baseUrl, now)),\n    ...runCollector(\"analytics\", () => collectAnalyticsFailures(websites, deps.baseUrl, now)),\n    ...runCollector(\"turnstile\", () =>\n      collectTurnstileGuardrailAlerts(websites, deps.baseUrl, now),\n    ),\n    ...runCollector(\"notify-bounce\", () =>\n      collectNotifyBounceAlerts(websites, notifyBounces, deps.baseUrl),\n    ),\n    // Same collector the cockpit runs, over the same persisted `Prismic Models`\n    // columns and the same keys — so the snapshot this digest writes is the one\n    // the cockpit diffs NEW/WORSE against, and the two surfaces agree.\n    ...runCollector(\"prismic-drift\", () => collectPrismicDriftAlerts(websites, deps.baseUrl, now)),\n  ];\n}\n\nexport type DigestRunOptions = {\n  resend?: ResendClient;\n  /** Dashboard origin for the /s/<slug> links, e.g. \"https://reddoor-maintenance.netlify.app\". */\n  baseUrl: string;\n  /**\n   * Inject a pre-opened Airtable base (tests, server handlers).\n   * When omitted, `openBase(readAirtableConfig())` is called from the environment.\n   */\n  base?: AirtableBase;\n  /** Per-site submission counts for the \"Submissions (24h)\" section. undefined =\n   *  fetch from libSQL; null = simulate unavailable (section omitted); a Map =\n   *  injected (tests). */\n  submissionCounts?: ReadonlyMap<string, SiteSubmissionCounts> | null;\n  /**\n   * The prior-run snapshot store (#609). Production omits it and gets Turso.\n   *\n   * Injectable because the read is deliberately NOT defensive: swallowing a\n   * failure would badge every item NEW, which lands in the operator's inbox\n   * reading as \"the whole fleet degraded overnight\". That makes Turso a hard\n   * requirement of a real run — so tests, which have no libSQL, need a seam\n   * rather than an env var.\n   */\n  digestState?: {\n    read: () => Promise<DigestSnapshot>;\n    write: (snap: DigestSnapshot) => Promise<void>;\n  };\n  /**\n   * The cockpit roll-up writer (MED-16). Same seam and same reason as\n   * `digestState`: production omits it and gets Turso, tests inject.\n   *\n   * Without a seam this would be untestable in exactly the way that matters —\n   * `writeCockpitRollupToDb` opens a db from env, so in a test it throws and is\n   * caught, and the run reports `rollup=0` forever while looking healthy. That\n   * is the #585 shape the counter on the log line exists to expose.\n   */\n  cockpitRollup?: { write: (now: Date) => Promise<void> };\n  /**\n   * The run clock. Production omits it and gets `new Date()`.\n   *\n   * Injectable because several collectors this run feeds are AGE-SENSITIVE —\n   * `collectPrismicDriftAlerts` alone changes an item's key and its wording once\n   * a verdict crosses `PRISMIC_DRIFT_STALE_DAYS` — so a digest test that cannot\n   * fix the clock is asserting on the day it happens to run. Two did, and both\n   * went red four days after they were written, reporting the staleness wording\n   * as if the drift wiring had broken. `collectAttention` already takes a `now`\n   * for exactly this reason; this threads the same lever one layer out.\n   */\n  now?: Date;\n};\n\nexport async function runDigest(\n  options: DigestRunOptions,\n): Promise<{ output: string; code: number }> {\n  // Capture clock BEFORE any await so the idempotency key can't roll past midnight mid-run.\n  const today = options.now ?? new Date();\n  try {\n    const base = options.base ?? openBase(readAirtableConfig());\n    // Read each table ONCE for the whole run, then thread the arrays into\n    // collectAttention so it doesn't re-fetch (was: listWebsites ×2, listAllReports\n    // ×2). Pending is derived in-line with listPendingApproval's exact predicate.\n    const reports = await listAllReports(base);\n    const websites = await listWebsites(base);\n    const sites = new Map(websites.map((w) => [w.id, w]));\n\n    const pending = reports.filter(isPendingApproval);\n\n    const readyForYourYes: ReadyItem[] = [];\n    const baseUrl = options.baseUrl.replace(/\\/$/, \"\");\n    for (const r of pending) {\n      const site = sites.get(r.siteId);\n      if (!site) continue; // orphan report → skip rather than render a broken link\n      // An empty Name slugs to \"\" → `/s/` is a dead link (getWebsiteBySlug can't\n      // match it). Fall back to the fleet homepage so the operator still lands\n      // somewhere usable instead of a 404.\n      const slug = siteSlug(site.name);\n      readyForYourYes.push({\n        siteName: site.name,\n        reportType: r.reportType,\n        period: r.period ?? \"—\",\n        dashboardUrl: slug ? `${baseUrl}/s/${slug}` : baseUrl,\n      });\n    }\n\n    // M5: collect the free signals (isolated), diff against yesterday's snapshot.\n    // Renovate + CI come from the persisted collectors (the same ones the cockpit\n    // runs), so the snapshot this digest writes carries the `renovate:<siteId>` /\n    // `ci:<siteId>` keys the cockpit diffs against — no live GitHub sweep here.\n    const collected = await collectAttention({\n      base,\n      baseUrl: options.baseUrl,\n      websites,\n      reports,\n      now: today,\n    });\n    // #609: Turso is the read side now. Airtable keeps being WRITTEN below\n    // (dual-write, Phase 5's pattern everywhere else) so the move stays\n    // reversible, but nothing reads it any more.\n    const prior = await (options.digestState?.read ?? readDigestStateFromDb)();\n    const { tagged, next } = diffAttention(collected, prior, digestDateKey(today));\n    // The operator only HEARS about a vuln once Renovate's auto-fix is exhausted\n    // (tried and failed a couple of nightly cycles) — before that the fleet is\n    // still self-patching and the cockpit's amber Watch band is the only surface.\n    // Filter the EMAIL list only: `next` (written below) must keep every vuln key\n    // so the cockpit's diff against this same snapshot stays consistent, and so\n    // the exhausted-flip diffs as WORSE instead of arriving pre-badged-away.\n    const needsAttention = tagged.filter(\n      (it) => it.kind !== \"vuln\" || it.autoFixExhausted === true,\n    );\n\n    // No-noise default: skip entirely when there's nothing to report.\n    if (readyForYourYes.length === 0 && needsAttention.length === 0) {\n      // Persist `next` even on a skip: a key that resolved on a quiet day clears so a\n      // later recurrence diffs as NEW (spec §10), and — since the skip can now fire\n      // with muted pre-exhaustion vulns collected — their keys keep snapshotting so\n      // the eventual exhausted-flip diffs as WORSE. Wrapped: a write failure can't\n      // fail the skip.\n      await persistDigestState(base, next, options.digestState?.write, () =>\n        writeRollupOnce(options, today),\n      );\n      return { output: \"Digest skipped (nothing ready, nothing needs attention).\", code: 0 };\n    }\n\n    // Submissions telemetry rides only on a digest that is ALREADY sending — the\n    // skip predicate above is deliberately unchanged (leads already fire their own\n    // ingest-time notification; this is context, not an alarm), and fetching AFTER\n    // the skip check keeps quiet days from touching libSQL at all.\n    const counts =\n      options.submissionCounts !== undefined\n        ? options.submissionCounts\n        : await fetchSubmissionsDigestCounts(today);\n    const submissions = buildSubmissionsDigestSection(counts, sites);\n\n    const html = renderDigestHtml({ readyForYourYes, needsAttention, submissions });\n    const client = options.resend ?? defaultResendClient();\n    const to = [operatorEmail()];\n    const n = readyForYourYes.length;\n    const reportWord = n === 1 ? \"report\" : \"reports\";\n    let result: Awaited<ReturnType<typeof client.send>>;\n    try {\n      result = await client.send({\n        from: FROM_ADDRESS,\n        to,\n        subject: `Your fleet — ${digestDateKey(today)}: ${n} ${reportWord} ready for your yes`,\n        html,\n        idempotencyKey: `digest-${digestDateKey(today)}`,\n      });\n    } catch (err) {\n      // A same-UTC-day re-run whose content changed re-sends with the same\n      // `digest-<date>` idempotency key but a DIFFERENT body. Resend rejects that\n      // with a 409 (`invalid_idempotent_request`) — \"This idempotency key has been\n      // used ... but the request body was modified ...\". The operator already got\n      // today's digest on the first send, so re-sending a changed version same-day\n      // would just be a duplicate: treat it as an \"already sent today\" no-op.\n      //\n      // ResendClient (send/resend.ts) wraps the API error as a plain Error and only\n      // preserves the *message* string (no name/statusCode), so the message\n      // substring is the only reliable discriminator — match defensively on it.\n      // Any OTHER send error re-throws to the outer catch → {code:1}, so a genuine\n      // Resend/network failure still fails loudly.\n      if (isIdempotencyConflict(err)) {\n        // Do NOT write the snapshot: the first send already persisted it; writing\n        // this run's `next` would diff against the first run's snapshot and mis-badge.\n        return {\n          output:\n            \"Digest already sent today (content changed since the first send) — skipped to avoid a duplicate.\",\n          code: 0,\n        };\n      }\n      throw err;\n    }\n    // Persist the next snapshot AFTER a successful send. A write failure is caught +\n    // logged: the digest already went out, tomorrow re-news at worst. (The send-FAILURE\n    // path never reaches here — the outer catch returns code 1 with no write, preserving\n    // the NEW badge for the retry.)\n    await persistDigestState(base, next, options.digestState?.write, () =>\n      writeRollupOnce(options, today),\n    );\n    return { output: `Digest sent to ${to.join(\", \")} (${result.messageId})`, code: 0 };\n  } catch (err) {\n    // Re-throw config errors (exitCode=2: missing env vars, bad config) so runOrExit\n    // surfaces them with the correct process exit code rather than collapsing to 1.\n    if (typeof (err as { exitCode?: unknown }).exitCode === \"number\") {\n      throw err;\n    }\n    const message = err instanceof Error ? err.message : String(err);\n    return { output: `digest failed: ${message}`, code: 1 };\n  }\n}\n\n/** Pure render of the unified daily operator digest. No IO — the caller (runDigest)\n *  collects the rows and decides whether to send. */\nexport function renderDigestHtml(sections: DigestSections): string {\n  return `<!doctype html>\n<html>\n  <head><meta charset=\"utf-8\"></head>\n  <body style=\"margin:0;padding:0;background:#ffffff\">\n    <table width=\"100%\" style=\"border-collapse:collapse\">\n      <tr>\n        <td align=\"center\" style=\"padding:24px\">\n          <table width=\"600\" style=\"border-collapse:collapse\">\n            <tr>\n              <td>\n                <h1 style=\"color:${RED};font-family:helvetica,sans-serif;font-size:24px;font-weight:700;margin:0 0 8px\">Your fleet today</h1>\n                ${readySection(sections.readyForYourYes)}\n                ${attentionSection(sections.needsAttention)}\n                ${submissionsSection(sections.submissions)}\n              </td>\n            </tr>\n          </table>\n        </td>\n      </tr>\n    </table>\n  </body>\n</html>`;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqDA,IAAM,OAAO;AACb,IAAM,MAAM;AAGZ,IAAM,eAAe,SAAS,GAAG;AAEjC,SAAS,aAAa,OAA4B;AAChD,QAAM,UAAU,oBAAoB,GAAG;AACvC,MAAI,MAAM,WAAW,GAAG;AACtB,WAAO,GAAG,OAAO,mBAAmB,IAAI;AAAA,EAC1C;AACA,QAAM,OAAO,MACV,IAAI,CAAC,OAAO;AACX,UAAM,UAAU,GAAG,aAAa,WAAW,UAAU,IAAI,GAAG,eAAe;AAC3E,UAAM,OAAO,UACT,YAAY,WAAI,OAAO,CAAC,YAAY,YAAY,+BAChD;AACJ,WAAO;AAAA;AAAA,2BAEc,IAAI;AAAA,uCACQ,WAAI,GAAG,QAAQ,CAAC,oBAAe,WAAI,GAAG,UAAU,CAAC,KAAK,WAAI,GAAG,MAAM,CAAC;AAAA,mBAC7F,IAAI;AAAA;AAAA;AAAA,EAGd,CAAC,EACA,KAAK,EAAE;AACV,SAAO,GAAG,OAAO,wEAAwE,IAAI;AAC/F;AAEA,IAAM,iBAAoD,EAAE,UAAU,GAAG,SAAS,EAAE;AAGpF,SAAS,eAAe,QAAkC;AACxD,MAAI,WAAW;AACb,WAAO,wBAAwB,GAAG;AACpC,MAAI,WAAW;AACb,WAAO,wBAAwB,GAAG;AACpC,SAAO;AACT;AAEA,SAAS,iBAAiB,OAAgC;AACxD,QAAM,UAAU,oBAAoB,GAAG;AACvC,MAAI,MAAM,WAAW,GAAG;AACtB,WAAO,GAAG,OAAO,mBAAmB,IAAI;AAAA,EAC1C;AAIA,QAAM,SAAS,oBAAI,IAA6B;AAChD,aAAW,MAAM,OAAO;AACtB,UAAM,SAAS,OAAO,IAAI,GAAG,QAAQ;AACrC,QAAI,OAAQ,QAAO,KAAK,EAAE;AAAA,QACrB,QAAO,IAAI,GAAG,UAAU,CAAC,EAAE,CAAC;AAAA,EACnC;AAEA,QAAM,SAAS,CAAC,GAAG,OAAO,QAAQ,CAAC,EAChC,IAAI,CAAC,CAAC,UAAU,SAAS,MAAM;AAC9B,UAAM,SAAS,CAAC,GAAG,SAAS,EAAE;AAAA,MAC5B,CAAC,GAAG,MAAM,eAAe,EAAE,QAAQ,IAAI,eAAe,EAAE,QAAQ;AAAA,IAClE;AACA,UAAM,OAAO,OACV,IAAI,CAAC,OAAO;AACX,YAAM,UAAU,GAAG,KAAK,WAAW,UAAU,IAAI,GAAG,MAAM;AAC1D,YAAM,YAAY,UACd,YAAY,WAAI,OAAO,CAAC,YAAY,YAAY,KAAK,WAAI,GAAG,KAAK,CAAC,SAClE,WAAI,GAAG,KAAK;AAChB,aAAO;AAAA;AAAA,+BAEc,IAAI,yFAAyF,eAAe,GAAG,MAAM,CAAC,GAAG,SAAS;AAAA;AAAA,IAEzJ,CAAC,EACA,KAAK,EAAE;AACV,WAAO;AAAA;AAAA,mHAEsG,WAAI,QAAQ,CAAC;AAAA;AAAA,QAExH,IAAI;AAAA,EACR,CAAC,EACA,KAAK,EAAE;AAEV,SAAO,GAAG,OAAO,wEAAwE,MAAM;AACjG;AAKA,SAAS,mBAAmB,GAAwD;AAClF,MAAI,CAAC,EAAG,QAAO;AACf,MAAI,EAAE,UAAU,KAAK,EAAE,YAAY,KAAK,EAAE,aAAa,EAAG,QAAO;AACjE,QAAM,UAAU,oBAAoB,GAAG;AAGvC,QAAM,SAAS;AAAA,IACb,GAAG,EAAE,KAAK,YAAY,EAAE,UAAU,IAAI,KAAK,GAAG;AAAA,IAC9C,GAAG,EAAE,OAAO,0BAA0B,EAAE,YAAY,IAAI,KAAK,GAAG;AAAA,IAChE,GAAG,EAAE,QAAQ;AAAA,EACf,EAAE,KAAK,QAAK;AACZ,QAAM,YAAY,mBAAmB,IAAI,8DAA8D,MAAM;AAC7G,MAAI,EAAE,OAAO,WAAW,EAAG,QAAO,GAAG,OAAO,GAAG,SAAS;AACxD,QAAM,OAAO,EAAE,OACZ,IAAI,CAAC,SAAS;AACb,UAAM,QAAkB,CAAC;AACzB,QAAI,KAAK,QAAQ,EAAG,OAAM,KAAK,GAAG,KAAK,KAAK,QAAQ,KAAK,UAAU,IAAI,KAAK,GAAG,EAAE;AACjF,QAAI,KAAK,UAAU,EAAG,OAAM,KAAK,GAAG,KAAK,OAAO,UAAU,KAAK,YAAY,IAAI,KAAK,GAAG,EAAE;AACzF,QAAI,KAAK,WAAW,EAAG,OAAM,KAAK,GAAG,KAAK,QAAQ,gBAAgB;AAClE,WAAO;AAAA;AAAA,2BAEc,IAAI;AAAA,uCACQ,WAAI,KAAK,QAAQ,CAAC,oBAAe,MAAM,KAAK,QAAK,CAAC;AAAA;AAAA;AAAA,EAGrF,CAAC,EACA,KAAK,EAAE;AACV,SAAO,GAAG,OAAO,GAAG,SAAS,8EAA8E,IAAI;AACjH;AAEA,IAAM,eAAe;AAGrB,SAAS,cAAc,GAAiB;AACtC,SAAO,EAAE,YAAY,EAAE,MAAM,GAAG,EAAE;AACpC;AAaA,eAAsB,oBAAoB,MAA0C;AAClF,UAAQ,MAAM,eAAe,IAAI,GAAG,OAAO,iBAAiB;AAC9D;AAgCA,eAAe,wBAAwB,KAAiD;AACtF,MAAI;AACF,UAAM,CAAC,EAAE,QAAQ,aAAa,GAAG,EAAE,yBAAyB,GAAG,EAAE,gBAAgB,CAAC,IAChF,MAAM,QAAQ,IAAI;AAAA,MAChB,OAAO,sBAAiB;AAAA,MACxB,OAAO,2BAAsB;AAAA,MAC7B,OAAO,0BAAqB;AAAA,IAC9B,CAAC;AACH,UAAM,KAAK,MAAM,OAAO,aAAa,CAAC;AACtC,WAAO,MAAM,yBAAyB,IAAI,gBAAgB,KAAK,yBAAyB,CAAC;AAAA,EAC3F,SAAS,GAAG;AACV,YAAQ,KAAK,qDAAiD,EAAY,OAAO,EAAE;AACnF,WAAO,oBAAI,IAAI;AAAA,EACjB;AACF;AAWA,eAAe,wBAAiD;AAC9D,QAAM,CAAC,EAAE,QAAQ,aAAa,GAAG,EAAE,gBAAgB,CAAC,IAAI,MAAM,QAAQ,IAAI;AAAA,IACxE,OAAO,sBAAiB;AAAA,IACxB,OAAO,4BAAuB;AAAA,EAChC,CAAC;AACD,SAAO,gBAAgB,MAAM,OAAO,aAAa,CAAC,CAAC;AACrD;AAIA,eAAe,gBACb,SACA,KAC+B;AAC/B,MAAI,QAAQ,eAAe;AACzB,UAAM,QAAQ,cAAc,MAAM,GAAG;AACrC,WAAO;AAAA,EACT;AACA,SAAO,uBAAuB,GAAG;AACnC;AAGA,eAAe,qBAAqB,MAAqC;AACvE,QAAM,CAAC,EAAE,QAAQ,aAAa,GAAG,EAAE,kBAAAA,kBAAiB,CAAC,IAAI,MAAM,QAAQ,IAAI;AAAA,IACzE,OAAO,sBAAiB;AAAA,IACxB,OAAO,4BAAuB;AAAA,EAChC,CAAC;AACD,QAAMA,kBAAiB,MAAM,OAAO,aAAa,CAAC,GAAG,IAAI;AAC3D;AAoBA,eAAe,uBAAuB,KAA0C;AAK9E,MAAI,CAAC,QAAQ,IAAI,mBAAoB,QAAO;AAC5C,QAAM,CAAC,EAAE,QAAQ,aAAa,GAAG,EAAE,mBAAmB,GAAG,YAAY,aAAa,UAAU,IAC1F,MAAM,QAAQ,IAAI;AAAA,IAChB,OAAO,sBAAiB;AAAA,IACxB,OAAO,4BAAuB;AAAA,IAC9B,OAAO,0BAAqB;AAAA,IAC5B,OAAO,2BAAsB;AAAA,IAC7B,OAAO,iCAAgC;AAAA,EACzC,CAAC;AACH,QAAM,KAAK,MAAM,OAAO,aAAa,CAAC;AACtC,QAAM,yBAAyB;AAC/B,QAAM,iBAAiB,WAAW,gBAAgB,KAAK,sBAAsB;AAC7E,QAAM,cAAc,WAAW,gBAAgB,KAAK,WAAW,yBAAyB;AAExF,QAAM,SAAS,EAAE,UAAU,GAAG,SAAS,GAAG,YAAY,EAAE;AACxD,aAAW,MAAM,MAAM,WAAW,oBAAoB,IAAI,cAAc,GAAG,OAAO,GAAG;AACnF,WAAO,YAAY,EAAE;AACrB,WAAO,WAAW,EAAE;AACpB,WAAO,cAAc,EAAE;AAAA,EACzB;AACA,QAAM,UAAU,MAAM,YAAY,yBAAyB,IAAI,WAAW;AAE1E,QAAM,mBAAmB,IAAI;AAAA,IAC3B,YAAY;AAAA,IACZ,eAAe,OAAO,YAAY,OAAO;AAAA,IACzC,YAAY;AAAA,MACV,YAAY;AAAA,MACZ,SAAS,WAAW;AAAA,IACtB;AAAA,IACA,YAAY,IAAI,YAAY;AAAA,EAC9B,CAAC;AACD,SAAO;AACT;AAaA,eAAe,mBACb,MACA,MACA,YACA,aACe;AACf,MAAI,QAAQ;AACZ,MAAI,WAAW;AACf,MAAI,SAA+B;AACnC,MAAI;AACF,WAAO,cAAc,sBAAsB,IAAI;AAC/C,YAAQ;AAAA,EACV,SAAS,GAAG;AACV,YAAQ,KAAK,6CAAyC,EAAY,OAAO,EAAE;AAAA,EAC7E;AACA,MAAI;AACF,UAAM,iBAAyB,MAAM,IAAI;AACzC,eAAW;AAAA,EACb,SAAS,GAAG;AACV,YAAQ,KAAK,gDAA4C,EAAY,OAAO,EAAE;AAAA,EAChF;AAKA,MAAI,aAAa;AACf,QAAI;AACF,eAAU,MAAM,YAAY,MAAO,WAAW,WAAW;AAAA,IAC3D,SAAS,GAAG;AACV,eAAS;AACT,cAAQ,KAAK,uCAAmC,EAAY,OAAO,EAAE;AAAA,IACvE;AAAA,EACF;AACA,UAAQ,IAAI,4BAA4B,KAAK,aAAa,QAAQ,WAAW,MAAM,EAAE;AACvF;AAIA,IAAM,+BAA+B,KAAK,KAAK,KAAK;AAQpD,eAAe,6BACb,KAC2D;AAC3D,MAAI;AACF,UAAM,CAAC,EAAE,QAAQ,aAAa,GAAG,EAAE,4BAA4B,CAAC,IAAI,MAAM,QAAQ,IAAI;AAAA,MACpF,OAAO,sBAAiB;AAAA,MACxB,OAAO,2BAAsB;AAAA,IAC/B,CAAC;AACD,UAAM,KAAK,MAAM,OAAO,aAAa,CAAC;AACtC,WAAO,MAAM;AAAA,MACX;AAAA,MACA,IAAI,KAAK,IAAI,QAAQ,IAAI,4BAA4B,EAAE,YAAY;AAAA,IACrE;AAAA,EACF,SAAS,GAAG;AACV,YAAQ,KAAK,sDAAkD,EAAY,OAAO,EAAE;AACpF,WAAO;AAAA,EACT;AACF;AAOO,SAAS,8BACd,QACA,WACiC;AACjC,MAAI,WAAW,KAAM,QAAO;AAC5B,MAAI,QAAQ;AACZ,MAAI,UAAU;AACd,MAAI,WAAW;AACf,QAAM,SAA6C,CAAC;AACpD,aAAW,CAAC,QAAQ,CAAC,KAAK,QAAQ;AAChC,aAAS,EAAE;AACX,eAAW,EAAE;AACb,gBAAY,EAAE;AACd,UAAM,OAAO,UAAU,IAAI,MAAM;AACjC,QAAI,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,GAAG;AAChD,aAAO,KAAK,EAAE,UAAU,KAAK,MAAM,GAAG,EAAE,CAAC;AAAA,IAC3C;AAAA,EACF;AACA,SAAO;AAAA,IACL,CAAC,GAAG,MACF,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,aAC5D,EAAE,SAAS,cAAc,EAAE,QAAQ;AAAA,EACvC;AACA,SAAO,EAAE,OAAO,SAAS,UAAU,OAAO;AAC5C;AAIA,SAAS,aAAa,OAAe,IAA4C;AAC/E,MAAI;AACF,WAAO,GAAG;AAAA,EACZ,SAAS,GAAG;AACV,YAAQ,KAAK,+BAA0B,KAAK,aAAc,EAAY,OAAO,EAAE;AAC/E,WAAO,CAAC;AAAA,EACV;AACF;AAkBA,eAAsB,iBAAiB,MAAsD;AAC3F,QAAM,UAAU,KAAK,WAAY,MAAM,eAAe,KAAK,IAAI;AAC/D,QAAM,WAAW,KAAK,YAAa,MAAM,aAAa,KAAK,IAAI;AAC/D,QAAM,MAAM,KAAK,OAAO,oBAAI,KAAK;AACjC,QAAM,gBAAgB,KAAK,iBAAkB,MAAM,wBAAwB,GAAG;AAC9E,QAAM,YAAY,IAAI,IAAwB,SAAS,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AAC5E,SAAO;AAAA,IACL,GAAG,aAAa,QAAQ,MAAM,kBAAkB,UAAU,KAAK,OAAO,CAAC;AAAA,IACvE,GAAG,aAAa,YAAY,MAAM,wBAAwB,SAAS,WAAW,KAAK,OAAO,CAAC;AAAA,IAC3F,GAAG,aAAa,aAAa,MAAM,wBAAwB,SAAS,WAAW,KAAK,OAAO,CAAC;AAAA,IAC5F,GAAG,aAAa,cAAc,MAAM,wBAAwB,UAAU,KAAK,OAAO,CAAC;AAAA,IACnF,GAAG,aAAa,YAAY,MAAM,sBAAsB,UAAU,KAAK,SAAS,GAAG,CAAC;AAAA,IACpF,GAAG,aAAa,MAAM,MAAM,gBAAgB,UAAU,KAAK,SAAS,GAAG,CAAC;AAAA,IACxE,GAAG,aAAa,aAAa,MAAM,yBAAyB,UAAU,KAAK,SAAS,GAAG,CAAC;AAAA,IACxF,GAAG;AAAA,MAAa;AAAA,MAAa,MAC3B,gCAAgC,UAAU,KAAK,SAAS,GAAG;AAAA,IAC7D;AAAA,IACA,GAAG;AAAA,MAAa;AAAA,MAAiB,MAC/B,0BAA0B,UAAU,eAAe,KAAK,OAAO;AAAA,IACjE;AAAA;AAAA;AAAA;AAAA,IAIA,GAAG,aAAa,iBAAiB,MAAM,0BAA0B,UAAU,KAAK,SAAS,GAAG,CAAC;AAAA,EAC/F;AACF;AAoDA,eAAsB,UACpB,SAC2C;AAE3C,QAAM,QAAQ,QAAQ,OAAO,oBAAI,KAAK;AACtC,MAAI;AACF,UAAM,OAAO,QAAQ,QAAQ,SAAS,mBAAmB,CAAC;AAI1D,UAAM,UAAU,MAAM,eAAe,IAAI;AACzC,UAAM,WAAW,MAAM,aAAa,IAAI;AACxC,UAAM,QAAQ,IAAI,IAAI,SAAS,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AAEpD,UAAM,UAAU,QAAQ,OAAO,iBAAiB;AAEhD,UAAM,kBAA+B,CAAC;AACtC,UAAM,UAAU,QAAQ,QAAQ,QAAQ,OAAO,EAAE;AACjD,eAAW,KAAK,SAAS;AACvB,YAAM,OAAO,MAAM,IAAI,EAAE,MAAM;AAC/B,UAAI,CAAC,KAAM;AAIX,YAAM,OAAO,SAAS,KAAK,IAAI;AAC/B,sBAAgB,KAAK;AAAA,QACnB,UAAU,KAAK;AAAA,QACf,YAAY,EAAE;AAAA,QACd,QAAQ,EAAE,UAAU;AAAA,QACpB,cAAc,OAAO,GAAG,OAAO,MAAM,IAAI,KAAK;AAAA,MAChD,CAAC;AAAA,IACH;AAMA,UAAM,YAAY,MAAM,iBAAiB;AAAA,MACvC;AAAA,MACA,SAAS,QAAQ;AAAA,MACjB;AAAA,MACA;AAAA,MACA,KAAK;AAAA,IACP,CAAC;AAID,UAAM,QAAQ,OAAO,QAAQ,aAAa,QAAQ,uBAAuB;AACzE,UAAM,EAAE,QAAQ,KAAK,IAAI,cAAc,WAAW,OAAO,cAAc,KAAK,CAAC;AAO7E,UAAM,iBAAiB,OAAO;AAAA,MAC5B,CAAC,OAAO,GAAG,SAAS,UAAU,GAAG,qBAAqB;AAAA,IACxD;AAGA,QAAI,gBAAgB,WAAW,KAAK,eAAe,WAAW,GAAG;AAM/D,YAAM;AAAA,QAAmB;AAAA,QAAM;AAAA,QAAM,QAAQ,aAAa;AAAA,QAAO,MAC/D,gBAAgB,SAAS,KAAK;AAAA,MAChC;AACA,aAAO,EAAE,QAAQ,4DAA4D,MAAM,EAAE;AAAA,IACvF;AAMA,UAAM,SACJ,QAAQ,qBAAqB,SACzB,QAAQ,mBACR,MAAM,6BAA6B,KAAK;AAC9C,UAAM,cAAc,8BAA8B,QAAQ,KAAK;AAE/D,UAAM,OAAO,iBAAiB,EAAE,iBAAiB,gBAAgB,YAAY,CAAC;AAC9E,UAAM,SAAS,QAAQ,UAAU,oBAAoB;AACrD,UAAM,KAAK,CAAC,cAAc,CAAC;AAC3B,UAAM,IAAI,gBAAgB;AAC1B,UAAM,aAAa,MAAM,IAAI,WAAW;AACxC,QAAI;AACJ,QAAI;AACF,eAAS,MAAM,OAAO,KAAK;AAAA,QACzB,MAAM;AAAA,QACN;AAAA,QACA,SAAS,qBAAgB,cAAc,KAAK,CAAC,KAAK,CAAC,IAAI,UAAU;AAAA,QACjE;AAAA,QACA,gBAAgB,UAAU,cAAc,KAAK,CAAC;AAAA,MAChD,CAAC;AAAA,IACH,SAAS,KAAK;AAaZ,UAAI,sBAAsB,GAAG,GAAG;AAG9B,eAAO;AAAA,UACL,QACE;AAAA,UACF,MAAM;AAAA,QACR;AAAA,MACF;AACA,YAAM;AAAA,IACR;AAKA,UAAM;AAAA,MAAmB;AAAA,MAAM;AAAA,MAAM,QAAQ,aAAa;AAAA,MAAO,MAC/D,gBAAgB,SAAS,KAAK;AAAA,IAChC;AACA,WAAO,EAAE,QAAQ,kBAAkB,GAAG,KAAK,IAAI,CAAC,KAAK,OAAO,SAAS,KAAK,MAAM,EAAE;AAAA,EACpF,SAAS,KAAK;AAGZ,QAAI,OAAQ,IAA+B,aAAa,UAAU;AAChE,YAAM;AAAA,IACR;AACA,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,WAAO,EAAE,QAAQ,kBAAkB,OAAO,IAAI,MAAM,EAAE;AAAA,EACxD;AACF;AAIO,SAAS,iBAAiB,UAAkC;AACjE,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mCAU0B,GAAG;AAAA,kBACpB,aAAa,SAAS,eAAe,CAAC;AAAA,kBACtC,iBAAiB,SAAS,cAAc,CAAC;AAAA,kBACzC,mBAAmB,SAAS,WAAW,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAS1D;","names":["writeDigestState"]}