@reddoorla/maintenance 0.88.3 → 0.89.0

package/dist/{chunk-GQDDWYU2.js.map → chunk-QBAAZY7W.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/db/fleet-state.ts"],"sourcesContent":["/** Phase 2 of the Airtable → Turso migration (#539): the fleet-state READ layer.\n *\n *  Returns the exact `WebsiteRow` shape the Airtable module returns, so every\n *  repoint is an import-only swap at a composition root — the same trick\n *  listSubmissionsForSite used for the hybrid-db cutover. The raw values live\n *  in `sites`/`site_health`/`site_schedule` (written by the importer / hourly\n *  sync); coercion to `WebsiteRow` happens HERE, reusing the Airtable module's\n *  own exported coercers (`toVerdict`, `toFrequency`, `parseNotifyRouting`,\n *  `parseSecurityAdvisories`, `trimToNull`) so there is one truth for each.\n *\n *  The equivalence instrument (tests/db/fleet-state.test.ts) pins this module\n *  to `mapRow` field-by-field: for a fixture record, `mapRow(rec)` must deep-\n *  equal the row read back through here after an import. A new WebsiteRow\n *  field fails that test until this module carries it.\n *\n *  `headerImage` is the ONE deliberate exception (design D5): Airtable stopped\n *  being its source — the bytes belong in `sites.header_image*`. Those columns\n *  ARE now written: the header-image CLI dual-writes on every generation and the\n *  one-shot backfill copied the rest, so as of 2026-08-25 production carries a\n *  BLOB for 12 of the 13 maintained sites (the 13th, LA Homelessness Youth, has\n *  no header image in Airtable either — its reports are blocked at approve for\n *  exactly that). An earlier version of this comment said the columns were empty\n *  fleet-wide; that was true when written and is no longer.\n *\n *  The `url` is \"\" because the bytes live in the row itself, not behind a signed\n *  URL — which is why `url` is NOT a usable handle. A consumer that needs the\n *  image calls `loadHeaderImage(db, siteId)` for the bytes; the send path still\n *  fetches the Airtable attachment, and moving it over is its own change.\n */\nimport { sql, type Selectable, type Updateable } from \"kysely\";\nimport type { Db } from \"./client.js\";\nimport type { ReportsTable, SiteHealthTable, SiteScheduleTable, SitesTable } from \"./schema.js\";\nimport {\n  SITE_FIELDS,\n  siteValueFor,\n  healthColumnFor,\n  scheduleColumnFor,\n  mapReportRecord,\n  mapWebsiteRecord,\n  type RawRecord,\n} from \"./import-airtable.js\";\nimport type { AirtableCellValue } from \"../reports/airtable/websites.js\";\nimport {\n  toReportType,\n  parseAutoEvidence,\n  type ReportRow,\n  type DeliveryStatus,\n} from \"../reports/airtable/reports.js\";\nimport { MAINTENANCE_CHECKLIST, TESTING_CHECKLIST } from \"../reports/checklist.js\";\nimport type { WebsiteRow } from \"../reports/airtable/websites.js\";\nimport { canonicalizeStatus } from \"../reports/airtable/site-status.js\";\nimport {\n  parseNotifyRouting,\n  parseSecurityAdvisories,\n  toFrequency,\n  toPrismicModelsVerdict,\n  toVerdict,\n  trimToNull,\n} from \"../reports/airtable/websites.js\";\n\ntype JoinedRow = Record<string, unknown>;\n\nconst str = (v: unknown): string | null => (typeof v === \"string\" ? v : null);\nconst num = (v: unknown): number | null => (typeof v === \"number\" ? v : null);\n/** Stored 1/0/null (importer's b01n) → boolean | null. */\nconst bool = (v: unknown): boolean | null => (typeof v === \"number\" ? v !== 0 : null);\n\n/** Stored JSON array (importer-normalized) → the trimmed string[] mapRow yields. */\nfunction parseAwc(raw: unknown): string[] {\n  if (typeof raw !== \"string\" || raw.trim() === \"\") return [];\n  try {\n    const parsed: unknown = JSON.parse(raw);\n    if (!Array.isArray(parsed)) return [];\n    return parsed\n      .filter((x): x is string => typeof x === \"string\")\n      .map((s) => s.trim())\n      .filter(Boolean);\n  } catch {\n    return [];\n  }\n}\n\nfunction rowFromJoined(r: JoinedRow): WebsiteRow {\n  const name = String(r.name ?? \"\");\n  const headerFilename = str(r.header_image_filename);\n  const headerType = str(r.header_image_type);\n  return {\n    id: String(r.id),\n    name,\n    url: str(r.url) ?? \"\",\n    // `sites.status` holds the RAW Airtable cell (the importer stores it verbatim\n    // so the hourly parity check compares raw-to-raw). Canonicalizing HERE — the\n    // twin of mapRow's seam — is what keeps the #558 equivalence instrument green.\n    status: canonicalizeStatus(r.status),\n    statusRaw: str(r.status),\n    pointOfContact: str(r.point_of_contact),\n    maintenanceFreq: toFrequency(r.maintenance_freq, `${name} maintenance`),\n    testingFreq: toFrequency(r.testing_freq, `${name} testing`),\n    maintenanceFreqRaw: str(r.maintenance_freq),\n    testingFreqRaw: str(r.testing_freq),\n    maintenanceDay: str(r.maintenance_day),\n    testingDay: str(r.testing_day),\n    ga4PropertyId: str(r.ga4_property_id),\n    searchQuery: str(r.search_query),\n    searchConsoleProperty: str(r.search_console_property),\n    analyticsSoftFailAt: str(r.analytics_soft_fail_at),\n    gitRepo: str(r.git_repo),\n    reportRecipientsTo: str(r.report_recipients_to),\n    reportRecipientsCc: str(r.report_recipients_cc),\n    acceptedWatchConditions: parseAwc(r.accepted_watch_conditions),\n    headerImage:\n      headerFilename !== null && headerType !== null\n        ? { url: \"\", filename: headerFilename, type: headerType }\n        : null,\n    pScore: num(r.p_score),\n    rScore: num(r.r_score),\n    bpScore: num(r.bp_score),\n    seoScore: num(r.seo_score),\n    lastLighthouseAuditAt: str(r.lighthouse_at),\n    a11yViolations: num(r.a11y_violations),\n    depsDrifted: num(r.deps_drifted),\n    depsMajorBehind: num(r.deps_major_behind),\n    depsOutdated: num(r.deps_outdated),\n    depsMajorOutdated: num(r.deps_major_outdated),\n    securityVulnsCritical: num(r.vulns_critical),\n    securityVulnsHigh: num(r.vulns_high),\n    securityVulnsModerate: num(r.vulns_moderate),\n    securityVulnsLow: num(r.vulns_low),\n    securityAutoFixAttempts: num(r.auto_fix_attempts),\n    lastSecurityAuditAt: str(r.security_audit_at),\n    securityAdvisories: parseSecurityAdvisories(r.security_advisories),\n    certDaysRemaining: num(r.cert_days_remaining),\n    domainCheckedAt: str(r.domain_checked_at),\n    netlifyId: trimToNull(r.netlify_id),\n    deployStatus: str(r.deploy_status),\n    lastDeployAt: str(r.last_deploy_at),\n    deployLogUrl: str(r.deploy_log_url),\n    deployCheckedAt: str(r.deploy_checked_at),\n    functionHealth: toVerdict(r.function_health),\n    cmsReachable: toVerdict(r.cms_reachable),\n    turnstileWidget: toVerdict(r.turnstile_widget),\n    functionHealthCheckedAt: str(r.function_health_checked_at),\n    crossbrowserOk: bool(r.crossbrowser_ok),\n    mobileOk: bool(r.mobile_ok),\n    linksOk: bool(r.links_ok),\n    brokenLinks: num(r.broken_links),\n    browserCheckedAt: str(r.browser_checked_at),\n    reachableOk: toVerdict(r.uptime_reachable),\n    titleMetaOk: toVerdict(r.titles_meta_ok),\n    copyIntro: trimToNull(r.copy_intro),\n    copyContact: trimToNull(r.copy_contact),\n    copyFooter: trimToNull(r.copy_footer),\n    launchedAt: str(r.launched_at),\n    newsletterWebhook: trimToNull(r.newsletter_webhook),\n    notifyRouting: parseNotifyRouting(r.notify_routing),\n    notifyRoutingRaw: trimToNull(r.notify_routing),\n    mailchimpApiKey: trimToNull(r.mailchimp_api_key),\n    mailchimpAudienceId: trimToNull(r.mailchimp_audience_id),\n    requireTurnstile: typeof r.require_turnstile === \"number\" ? r.require_turnstile !== 0 : false,\n    renovateFailingCis: num(r.renovate_failing_cis),\n    defaultBranchCi: str(r.default_branch_ci),\n    lastCommitAt: str(r.last_commit_at),\n    githubSignalsAt: str(r.github_signals_at),\n    smokeOk: toVerdict(r.smoke_ok),\n    lastSmokeAt: str(r.last_smoke_at),\n    formE2eOk: toVerdict(r.form_e2e_ok),\n    formE2eCheckedAt: str(r.form_e2e_checked_at),\n    prismicModels: toPrismicModelsVerdict(r.prismic_models),\n    prismicModelsCheckedAt: str(r.prismic_models_checked_at),\n    prismicModelsDrift: str(r.prismic_models_drift),\n    prismicAckUntil: str(r.prismic_ack_until),\n    nextMaintenanceAt: str(r.next_maintenance_at),\n    nextTestingAt: str(r.next_testing_at),\n  };\n}\n\n/** Every sites column EXCEPT the header-image BLOB. Since the 2026-08-24\n *  backfill, header_image holds 0.7–3.5 MB JPEGs — a selectAll would haul\n *  megabytes into every site lookup (per LEAD on the ingest path, ×44 on the\n *  fleet list) and Turso bills the bytes. WebsiteRow only needs the metadata\n *  columns; the bytes have their own dedicated readers when a consumer wants\n *  them. Kept in lockstep with SitesTable by the blob-exclusion test. */\nconst SITE_COLUMNS = [\n  \"sites.id\",\n  \"sites.slug\",\n  \"sites.name\",\n  \"sites.url\",\n  \"sites.status\",\n  \"sites.point_of_contact\",\n  \"sites.maintenance_freq\",\n  \"sites.testing_freq\",\n  \"sites.maintenance_day\",\n  \"sites.testing_day\",\n  \"sites.ga4_property_id\",\n  \"sites.search_query\",\n  \"sites.search_console_property\",\n  \"sites.git_repo\",\n  \"sites.netlify_id\",\n  \"sites.report_recipients_to\",\n  \"sites.report_recipients_cc\",\n  \"sites.copy_intro\",\n  \"sites.copy_contact\",\n  \"sites.copy_footer\",\n  \"sites.newsletter_webhook\",\n  \"sites.mailchimp_api_key\",\n  \"sites.mailchimp_audience_id\",\n  \"sites.notify_routing\",\n  \"sites.require_turnstile\",\n  \"sites.accepted_watch_conditions\",\n  \"sites.prismic_ack_until\",\n  \"sites.launched_at\",\n  \"sites.header_image_filename\",\n  \"sites.header_image_type\",\n  \"sites.header_image_generated_at\",\n  \"sites.legacy\",\n] as const;\n\n/** The three-table join every read composes from. site_health/site_schedule\n *  rows are upserted alongside sites by the importer, but LEFT JOIN anyway —\n *  a site row must never vanish from a surface because a health row is absent. */\nfunction joined(db: Db) {\n  return db\n    .selectFrom(\"sites\")\n    .leftJoin(\"site_health\", \"site_health.site_id\", \"sites.id\")\n    .leftJoin(\"site_schedule\", \"site_schedule.site_id\", \"sites.id\")\n    .select(SITE_COLUMNS)\n    .selectAll([\"site_health\", \"site_schedule\"]);\n}\n\n/** Write-through for the site-detail editor (Phase 2): after the Airtable\n *  write (still the Phase 2 source of truth), mirror the same cell into\n *  `sites` so a Turso-reading page renders the edit immediately instead of\n *  waiting for the next hourly sync. The column mapping is the IMPORTER's own\n *  map — one truth — and the value gets the importer's empty-clears-to-null\n *  semantics. Throws on a column the importer doesn't claim (the lockstep\n *  test makes that unreachable for the editor's allowlist); the caller treats\n *  a mirror failure as non-fatal — the hourly sync converges it.\n *\n *  Handles the non-text columns too (`Require Turnstile` is a checkbox,\n *  `Accepted Watch Conditions` a multi-select): the coercion is NOT repeated\n *  here, it is delegated to the importer's own `siteValueFor`. That delegation\n *  is the whole safety property — parity compares raw-to-raw, so a mirror that\n *  stored `\"true\"` where the importer stores `1` would red every hourly run. */\nexport async function mirrorSiteField(\n  db: Db,\n  siteId: string,\n  airtableColumn: string,\n  value: AirtableCellValue,\n): Promise<void> {\n  await mirrorSiteFields(db, siteId, { [airtableColumn]: value });\n}\n\n/** The multi-column form, and where the work actually happens (#539 Phase 5).\n *\n *  `updateLaunched` is why it exists: it flips `Status` AND stamps `Launched at`\n *  in one Airtable update, and mirroring those as two separate UPDATEs would\n *  open a window where Turso says a site is maintained but never launched.\n *\n *  Same contract as {@link mirrorHealthFields}, deliberately — it takes the\n *  EXACT FieldSet just written to Airtable (the writers return it, so the mirror\n *  cannot carry a different payload), and returns whether a `sites` row matched:\n *  a site the hourly sync hasn't imported yet updates 0 rows → false, so the\n *  caller can count it honestly instead of claiming it mirrored. An empty\n *  FieldSet runs no SQL and returns true — nothing to mirror is not a miss. */\nexport async function mirrorSiteFields(\n  db: Db,\n  siteId: string,\n  fields: Record<string, unknown>,\n): Promise<boolean> {\n  const patch: Record<string, string | number | null> = {};\n  for (const [airtableColumn, value] of Object.entries(fields)) {\n    const col = SITE_FIELDS[airtableColumn];\n    if (!col)\n      throw new Error(`mirrorSiteFields: importer claims no sites column for '${airtableColumn}'`);\n    // Empty text still clears to null (the importer's `s()` does the same); the\n    // non-text columns get their own coercion inside siteValueFor.\n    patch[col] = siteValueFor(col, value);\n  }\n  if (Object.keys(patch).length === 0) return true;\n  const res = await db\n    .updateTable(\"sites\")\n    .set(patch as Updateable<SitesTable>)\n    .where(\"id\", \"=\", siteId)\n    .executeTakeFirst();\n  // kysely/libSQL reports numUpdatedRows as a BigInt — compare in BigInt.\n  return res.numUpdatedRows > 0n;\n}\n\n/** Mirror a NEWLY CREATED Airtable Websites record into Turso (#539 Phase 5).\n *\n *  `ensure-site` CREATES a row, and every other site mirror is an UPDATE, which\n *  does nothing at all for a row that does not exist yet — so a site\n *  bootstrapped at 09:05 was invisible until the 09:20 sync, and every mirror\n *  the rest of the bootstrap fired reported `mirrored=missed` with nothing to\n *  update.\n *\n *  Maps with the IMPORTER's own `mapWebsiteRecord`, which is also exactly what\n *  parity diffs against: that delegation is what makes the mirrored rows\n *  parity-clean by construction rather than by a column list someone has to\n *  remember to extend.\n *\n *  All THREE rows, not just `sites`. Parity reverse-checks `site_health` and\n *  `site_schedule` per site and reports a missing one as `(row) ABSENT`, and a\n *  later `mirrorHealthFields` would return `missed` forever with no row to hit.\n *\n *  Upserts rather than inserts because `ensure-site` is re-run to RESUME a\n *  bootstrap. The header_image* columns survive that by construction —\n *  `mapWebsiteRecord` does not carry them (Airtable stopped being their source,\n *  design D5), so the conflict branch cannot blank a stored plate whose bytes\n *  live in no other store. */\nexport async function mirrorSiteInsert(db: Db, rec: RawRecord, computedAt: string): Promise<void> {\n  const { site, health, schedule } = mapWebsiteRecord(rec, computedAt);\n  await db\n    .insertInto(\"sites\")\n    .values(site)\n    .onConflict((oc) => oc.column(\"id\").doUpdateSet(site))\n    .execute();\n  await db\n    .insertInto(\"site_health\")\n    .values(health)\n    .onConflict((oc) => oc.column(\"site_id\").doUpdateSet(health))\n    .execute();\n  await db\n    .insertInto(\"site_schedule\")\n    .values(schedule)\n    .onConflict((oc) => oc.column(\"site_id\").doUpdateSet(schedule))\n    .execute();\n}\n\n/** Write-through mirror for the nightly health writers (#539 Phase 3). Takes\n *  the EXACT FieldSet just written to Airtable (updateAuditFields /\n *  updateGitHubSignals return it), so the mirror can never carry a different\n *  payload than the Airtable write it shadows. Resolution + coercion come from\n *  the importer's healthColumnFor — one truth; an Airtable column no\n *  site_health column claims throws (same contract as mirrorSiteField).\n *  Partial by design: absent fields stay untouched, matching\n *  updateGitHubSignals' deliberate omission of a null lastCommitAt. Returns\n *  whether a site_health row matched: a site the hourly sync hasn't imported\n *  yet updates 0 rows → false, so the caller can count it honestly\n *  (mirror_missed) instead of claiming it mirrored — it still converges on the\n *  next sync, like every mirror. An empty FieldSet runs no SQL and returns\n *  true: nothing to mirror is not a miss. */\nexport async function mirrorHealthFields(\n  db: Db,\n  siteId: string,\n  fields: Record<string, unknown>,\n): Promise<boolean> {\n  // Per-column value types (number vs text) are guaranteed by healthColumnFor's\n  // coercion — the numeric/text split lives there, once — so the patch builds\n  // untyped and casts at the .set() boundary (the importer's own idiom).\n  const patch: Record<string, string | number | null> = {};\n  for (const [field, value] of Object.entries(fields)) {\n    const m = healthColumnFor(field);\n    if (!m)\n      throw new Error(`mirrorHealthFields: importer claims no site_health column for '${field}'`);\n    patch[m.col] = m.coerce(value);\n  }\n  if (Object.keys(patch).length === 0) return true;\n  const res = await db\n    .updateTable(\"site_health\")\n    .set(patch as Updateable<SiteHealthTable>)\n    .where(\"site_id\", \"=\", siteId)\n    .executeTakeFirst();\n  // kysely/libSQL reports numUpdatedRows as a BigInt — compare in BigInt.\n  return res.numUpdatedRows > 0n;\n}\n\n/** The site_schedule twin of {@link mirrorHealthFields}, for the nightly\n *  next-due write-back. `computedAt` stamps when THIS computation ran — the\n *  hourly sync overwrites it with its own import stamp, same as every mirrored\n *  value. Empty fields → full no-op (no lone computed_at stamp for a write\n *  that carried nothing). Same return contract as mirrorHealthFields: false\n *  when the UPDATE matched no site_schedule row (site not yet imported), true\n *  otherwise — including the empty-fields no-op. */\nexport async function mirrorScheduleFields(\n  db: Db,\n  siteId: string,\n  fields: Record<string, unknown>,\n  computedAt: string,\n): Promise<boolean> {\n  const patch: Record<string, string | null> = {};\n  for (const [field, value] of Object.entries(fields)) {\n    const m = scheduleColumnFor(field);\n    if (!m)\n      throw new Error(\n        `mirrorScheduleFields: importer claims no site_schedule column for '${field}'`,\n      );\n    patch[m.col] = m.coerce(value);\n  }\n  if (Object.keys(patch).length === 0) return true;\n  patch.computed_at = computedAt;\n  const res = await db\n    .updateTable(\"site_schedule\")\n    .set(patch as Updateable<SiteScheduleTable>)\n    .where(\"site_id\", \"=\", siteId)\n    .executeTakeFirst();\n  return res.numUpdatedRows > 0n;\n}\n\n/** Same contract as the Airtable getWebsiteBySlug: slug is siteSlug(Name),\n *  precomputed into the UNIQUE sites.slug column at import time. */\nexport async function getSiteBySlug(db: Db, slug: string): Promise<WebsiteRow | null> {\n  const r = await joined(db).where(\"sites.slug\", \"=\", slug).executeTakeFirst();\n  return r ? rowFromJoined(r as JoinedRow) : null;\n}\n\n/** By Airtable rec id (the PK) — approve-report's lookup shape. */\nexport async function getSiteById(db: Db, id: string): Promise<WebsiteRow | null> {\n  const r = await joined(db).where(\"sites.id\", \"=\", id).executeTakeFirst();\n  return r ? rowFromJoined(r as JoinedRow) : null;\n}\n\n/** Same contract as the Airtable listWebsites: every site, one row each.\n *  Name-ordered for determinism (Airtable returned table order; no consumer\n *  is order-sensitive — the cockpit groups and sorts itself). */\nexport async function listSites(db: Db): Promise<WebsiteRow[]> {\n  const rows = await joined(db).orderBy(\"sites.name\").execute();\n  return rows.map((r) => rowFromJoined(r as JoinedRow));\n}\n\n// ————————————————————————— reports —————————————————————————\n\n/** stable checklist key → Airtable column name. The importer stores stable keys\n *  (mapReportRecord); `ReportRow.checklist` exposes Airtable column names — one\n *  derived map, built from the checklist definitions themselves. */\nconst CHECKLIST_FIELD_BY_KEY: ReadonlyMap<string, string> = new Map(\n  [...MAINTENANCE_CHECKLIST, ...TESTING_CHECKLIST].map((i) => [i.key, i.field]),\n);\n\nfunction checklistFromStored(raw: string | null): Record<string, boolean> {\n  let stored: Record<string, unknown> = {};\n  if (typeof raw === \"string\" && raw.trim() !== \"\") {\n    try {\n      const parsed: unknown = JSON.parse(raw);\n      if (parsed && typeof parsed === \"object\" && !Array.isArray(parsed))\n        stored = parsed as Record<string, unknown>;\n    } catch {\n      // fall through to all-false — a bad blob must not throw the page\n    }\n  }\n  const out: Record<string, boolean> = {};\n  for (const [key, field] of CHECKLIST_FIELD_BY_KEY) out[field] = Boolean(stored[key]);\n  return out;\n}\n\n/**\n * `hasRenderedHtml` is passed separately rather than read off `r`, because the\n * list read deliberately does not fetch the body (see REPORT_LIST_COLUMNS) and\n * only ever needed its null-ness. Taking it as an argument means a list row and a\n * full row are both honest inputs, and nothing here can start depending on body\n * CONTENT without the type changing to say so.\n */\nfunction reportRowFromDb(\n  r: Omit<Selectable<ReportsTable>, \"rendered_html\">,\n  hasRenderedHtml: boolean,\n): ReportRow {\n  const p = r.lighthouse_performance;\n  const a = r.lighthouse_accessibility;\n  const b = r.lighthouse_best_practices;\n  const seo = r.lighthouse_seo;\n  const lighthouse =\n    typeof p === \"number\" &&\n    typeof a === \"number\" &&\n    typeof b === \"number\" &&\n    typeof seo === \"number\"\n      ? { performance: p, accessibility: a, bestPractices: b, seo }\n      : null;\n  return {\n    id: r.id,\n    reportId: r.report_id ?? \"\",\n    siteId: r.site_id ?? \"\",\n    reportType: toReportType(r.report_type ?? undefined),\n    period: r.period,\n    periodStart: r.period_start,\n    periodEnd: r.period_end,\n    completedOn: r.completed_on,\n    lighthouse,\n    gaUsersCurrent: r.ga_users_current,\n    gaUsersPrevious: r.ga_users_previous,\n    searchFoundPage1: bool(r.search_found_page1),\n    searchPosition: r.search_position,\n    lastTestedDate: r.last_tested_date,\n    commentary: r.commentary,\n    subjectOverride: r.subject_override,\n    draftReady: r.draft_ready !== 0,\n    approvedToSend: r.approved_to_send !== 0,\n    sentAt: r.sent_at,\n    approvedAt: r.approved_at,\n    approvedBy: r.approved_by,\n    deliveryStatus: (r.delivery_status ?? \"pending\") as DeliveryStatus,\n    // The body lives IN the row (rendered_html) — the link points at the\n    // dashboard's own preview route instead of an EXPIRING Airtable signed URL.\n    // Strictly better for the operator: the old link 404'd once the URL aged out.\n    renderedHtmlAttachment: hasRenderedHtml\n      ? { url: `/api/reports/${r.id}/preview`, filename: `${r.report_id ?? r.id}.html` }\n      : null,\n    resendMessageId: r.resend_message_id,\n    checklist: checklistFromStored(r.checklist),\n    autoEvidence: parseAutoEvidence(r.checklist_auto_evidence),\n    sendOverride: r.send_override !== 0,\n    overrideReason: r.override_reason,\n    overrideBy: r.override_by,\n    overrideAt: r.override_at,\n  };\n}\n\n/** Every reports column EXCEPT the rendered_html body — the exact hazard\n *  SITE_COLUMNS guards against on `sites`, on the table where it currently costs\n *  more. Live, all 16 reports carry a body: 1.17 MB total, avg 73 KB. A list read\n *  wants the body only to know WHETHER there is one, so `has_rendered_html`\n *  computes that in SQL and the bytes stay in the database. Kept in lockstep with\n *  ReportsTable by the body-exclusion test. */\nexport const REPORT_LIST_COLUMNS = [\n  \"id\",\n  \"site_id\",\n  \"report_id\",\n  \"report_type\",\n  \"period\",\n  \"period_start\",\n  \"period_end\",\n  \"completed_on\",\n  \"lighthouse_performance\",\n  \"lighthouse_accessibility\",\n  \"lighthouse_best_practices\",\n  \"lighthouse_seo\",\n  \"ga_users_current\",\n  \"ga_users_previous\",\n  \"search_found_page1\",\n  \"search_position\",\n  \"last_tested_date\",\n  \"commentary\",\n  \"subject_override\",\n  \"draft_ready\",\n  \"approved_to_send\",\n  \"approved_at\",\n  \"approved_by\",\n  \"send_override\",\n  \"override_reason\",\n  \"override_by\",\n  \"override_at\",\n  \"sent_at\",\n  \"delivery_status\",\n  \"resend_message_id\",\n  \"checklist\",\n  \"checklist_auto_evidence\",\n] as const;\n\n/** The one thing a list read still needs from the body: whether there IS one.\n *  Computed in SQLite so the bytes never cross the wire. */\nconst HAS_RENDERED_HTML = sql<number>`(rendered_html is not null)`.as(\"has_rendered_html\");\n\n/** Same contract as the Airtable listAllReports. Newest-period-first (Airtable\n *  returned manual table order; every consumer filters/sorts itself). */\nexport async function listAllReports(db: Db): Promise<ReportRow[]> {\n  const rows = await db\n    .selectFrom(\"reports\")\n    .select(REPORT_LIST_COLUMNS)\n    .select(HAS_RENDERED_HTML)\n    .orderBy(\"period_start\", \"desc\")\n    .orderBy(\"id\")\n    .execute();\n  return rows.map((r) => reportRowFromDb(r, r.has_rendered_html !== 0));\n}\n\n/** Same contract as the Airtable listReportsForSite — served by idx_reports_site.\n *  Body-free for the same reason as listAllReports: the site-detail page renders\n *  a link, never the HTML. */\nexport async function listReportsForSite(db: Db, siteId: string): Promise<ReportRow[]> {\n  const rows = await db\n    .selectFrom(\"reports\")\n    .select(REPORT_LIST_COLUMNS)\n    .select(HAS_RENDERED_HTML)\n    .where(\"site_id\", \"=\", siteId)\n    .orderBy(\"period_start\", \"desc\")\n    .orderBy(\"id\")\n    .execute();\n  return rows.map((r) => reportRowFromDb(r, r.has_rendered_html !== 0));\n}\n\n/** Columns a report writer mirrors after its Airtable write (same pattern as\n *  mirrorSiteField): the approve/override flow, the resend-webhook's delivery\n *  status, and — since #539 Phase 5 — the drafting path's queue flag and a\n *  re-run's refreshed scores.\n *\n *  `rendered_html` stays deliberately OUT even though the drafting path now\n *  writes it: bodies go through `storeRenderedHtml`, so a request handler\n *  holding a patch cannot accidentally write megabytes of HTML. `sent_at` and\n *  `resend_message_id` stay out because nothing but the send batch writes them\n *  and the hourly sync converges those. */\nexport type ReportMirrorPatch = Partial<\n  Pick<\n    ReportsTable,\n    | \"approved_to_send\"\n    | \"approved_at\"\n    | \"approved_by\"\n    | \"send_override\"\n    | \"override_reason\"\n    | \"override_by\"\n    | \"override_at\"\n    | \"delivery_status\"\n    // Phase 4 report review: the console edits commentary and re-renders the\n    // page immediately after the write, so the mirror has to carry it or the\n    // operator sees their own save as a no-op until the next hourly sync.\n    | \"commentary\"\n    // Phase 5 drafting path. `draft_ready` is the queue flag `queueDraft`\n    // writes — for the new draft AND for every row it supersedes, so without it\n    // the console shows a site with two queued reports until the next sync.\n    | \"draft_ready\"\n    // A re-run (announce/launch reuse) refreshes an existing row's scores so the\n    // eventually-sent email is not stale; the console reads the same numbers.\n    | \"lighthouse_performance\"\n    | \"lighthouse_accessibility\"\n    | \"lighthouse_best_practices\"\n    | \"lighthouse_seo\"\n    | \"ga_users_current\"\n    | \"ga_users_previous\"\n    | \"search_found_page1\"\n    | \"search_position\"\n    | \"completed_on\"\n  >\n>;\n\n/** Mirror an Airtable report write into Turso so the page re-render after an\n *  approve/override/bounce shows the new state immediately instead of after\n *  the next hourly sync. Callers treat a failure as non-fatal (the sync\n *  converges it); an empty patch is a no-op, never invalid SQL. */\nexport async function mirrorReportPatch(\n  db: Db,\n  reportId: string,\n  patch: ReportMirrorPatch,\n): Promise<void> {\n  if (Object.keys(patch).length === 0) return;\n  await db.updateTable(\"reports\").set(patch).where(\"id\", \"=\", reportId).execute();\n}\n\n/** Mirror a NEWLY CREATED Airtable Reports record into Turso (#539 Phase 5).\n *\n *  Every other report mirror is an UPDATE, which silently does nothing for a row\n *  that does not exist yet — so a draft created at 09:05 was invisible to the\n *  Turso-backed console until the 09:20 sync. Takes the raw record Airtable\n *  echoed back from the create, and maps it with the IMPORTER's own\n *  `mapReportRecord`: parity diffs Turso against exactly that function, so\n *  delegating is what makes the mirrored row parity-clean by construction rather\n *  than by a column list someone has to remember to extend.\n *\n *  Upsert, not insert, and the conflict branch drops `rendered_html` for the\n *  same reason the importer's does: the body is written later by a separate\n *  sharp-bearing step, so a re-mirror carrying null would blank a render that\n *  had already succeeded. */\nexport async function mirrorReportInsert(db: Db, rec: RawRecord): Promise<void> {\n  const row = mapReportRecord(rec, null);\n  const { rendered_html: _rh, ...rowSansHtml } = row;\n  void _rh;\n  await db\n    .insertInto(\"reports\")\n    .values(row)\n    .onConflict((oc) => oc.column(\"id\").doUpdateSet(rowSansHtml))\n    .execute();\n}\n\n/**\n * Store a freshly rendered report body, replacing whatever was there.\n *\n * Deliberately NOT part of `ReportMirrorPatch`: that patch is the request path's\n * write-through (approve, override, delivery status), and a rendered body is\n * produced by a batch job with sharp, never by a dashboard POST. Keeping it out\n * means a handler cannot accidentally write megabytes of HTML from a request.\n *\n * It REPLACES unconditionally. The importer's `when-missing` mode skips a report\n * that already has a body — correct for an import, wrong here: a refresh whose\n * entire purpose is showing the newest commentary must overwrite.\n */\nexport async function storeRenderedHtml(db: Db, reportId: string, html: string): Promise<void> {\n  await db.updateTable(\"reports\").set({ rendered_html: html }).where(\"id\", \"=\", reportId).execute();\n}\n\n/** By rec id (the PK) — approve-report's read. */\nexport async function getReportById(db: Db, id: string): Promise<ReportRow | null> {\n  const r = await db.selectFrom(\"reports\").selectAll().where(\"id\", \"=\", id).executeTakeFirst();\n  return r ? reportRowFromDb(r, r.rendered_html !== null) : null;\n}\n\n/** The preview route's read: the stored rendered body, or null when the report\n *  has none (imported while its signed URL was expired, or predates rendering). */\nexport async function getReportHtml(\n  db: Db,\n  id: string,\n): Promise<{ html: string; reportId: string | null } | null> {\n  const r = await db\n    .selectFrom(\"reports\")\n    .select([\"rendered_html\", \"report_id\"])\n    .where(\"id\", \"=\", id)\n    .executeTakeFirst();\n  if (!r || r.rendered_html === null) return null;\n  return { html: r.rendered_html, reportId: r.report_id };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,SAAS,WAA6C;AAiCtD,IAAM,MAAM,CAAC,MAA+B,OAAO,MAAM,WAAW,IAAI;AACxE,IAAM,MAAM,CAAC,MAA+B,OAAO,MAAM,WAAW,IAAI;AAExE,IAAM,OAAO,CAAC,MAAgC,OAAO,MAAM,WAAW,MAAM,IAAI;AAGhF,SAAS,SAAS,KAAwB;AACxC,MAAI,OAAO,QAAQ,YAAY,IAAI,KAAK,MAAM,GAAI,QAAO,CAAC;AAC1D,MAAI;AACF,UAAM,SAAkB,KAAK,MAAM,GAAG;AACtC,QAAI,CAAC,MAAM,QAAQ,MAAM,EAAG,QAAO,CAAC;AACpC,WAAO,OACJ,OAAO,CAAC,MAAmB,OAAO,MAAM,QAAQ,EAChD,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,OAAO;AAAA,EACnB,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,SAAS,cAAc,GAA0B;AAC/C,QAAM,OAAO,OAAO,EAAE,QAAQ,EAAE;AAChC,QAAM,iBAAiB,IAAI,EAAE,qBAAqB;AAClD,QAAM,aAAa,IAAI,EAAE,iBAAiB;AAC1C,SAAO;AAAA,IACL,IAAI,OAAO,EAAE,EAAE;AAAA,IACf;AAAA,IACA,KAAK,IAAI,EAAE,GAAG,KAAK;AAAA;AAAA;AAAA;AAAA,IAInB,QAAQ,mBAAmB,EAAE,MAAM;AAAA,IACnC,WAAW,IAAI,EAAE,MAAM;AAAA,IACvB,gBAAgB,IAAI,EAAE,gBAAgB;AAAA,IACtC,iBAAiB,YAAY,EAAE,kBAAkB,GAAG,IAAI,cAAc;AAAA,IACtE,aAAa,YAAY,EAAE,cAAc,GAAG,IAAI,UAAU;AAAA,IAC1D,oBAAoB,IAAI,EAAE,gBAAgB;AAAA,IAC1C,gBAAgB,IAAI,EAAE,YAAY;AAAA,IAClC,gBAAgB,IAAI,EAAE,eAAe;AAAA,IACrC,YAAY,IAAI,EAAE,WAAW;AAAA,IAC7B,eAAe,IAAI,EAAE,eAAe;AAAA,IACpC,aAAa,IAAI,EAAE,YAAY;AAAA,IAC/B,uBAAuB,IAAI,EAAE,uBAAuB;AAAA,IACpD,qBAAqB,IAAI,EAAE,sBAAsB;AAAA,IACjD,SAAS,IAAI,EAAE,QAAQ;AAAA,IACvB,oBAAoB,IAAI,EAAE,oBAAoB;AAAA,IAC9C,oBAAoB,IAAI,EAAE,oBAAoB;AAAA,IAC9C,yBAAyB,SAAS,EAAE,yBAAyB;AAAA,IAC7D,aACE,mBAAmB,QAAQ,eAAe,OACtC,EAAE,KAAK,IAAI,UAAU,gBAAgB,MAAM,WAAW,IACtD;AAAA,IACN,QAAQ,IAAI,EAAE,OAAO;AAAA,IACrB,QAAQ,IAAI,EAAE,OAAO;AAAA,IACrB,SAAS,IAAI,EAAE,QAAQ;AAAA,IACvB,UAAU,IAAI,EAAE,SAAS;AAAA,IACzB,uBAAuB,IAAI,EAAE,aAAa;AAAA,IAC1C,gBAAgB,IAAI,EAAE,eAAe;AAAA,IACrC,aAAa,IAAI,EAAE,YAAY;AAAA,IAC/B,iBAAiB,IAAI,EAAE,iBAAiB;AAAA,IACxC,cAAc,IAAI,EAAE,aAAa;AAAA,IACjC,mBAAmB,IAAI,EAAE,mBAAmB;AAAA,IAC5C,uBAAuB,IAAI,EAAE,cAAc;AAAA,IAC3C,mBAAmB,IAAI,EAAE,UAAU;AAAA,IACnC,uBAAuB,IAAI,EAAE,cAAc;AAAA,IAC3C,kBAAkB,IAAI,EAAE,SAAS;AAAA,IACjC,yBAAyB,IAAI,EAAE,iBAAiB;AAAA,IAChD,qBAAqB,IAAI,EAAE,iBAAiB;AAAA,IAC5C,oBAAoB,wBAAwB,EAAE,mBAAmB;AAAA,IACjE,mBAAmB,IAAI,EAAE,mBAAmB;AAAA,IAC5C,iBAAiB,IAAI,EAAE,iBAAiB;AAAA,IACxC,WAAW,WAAW,EAAE,UAAU;AAAA,IAClC,cAAc,IAAI,EAAE,aAAa;AAAA,IACjC,cAAc,IAAI,EAAE,cAAc;AAAA,IAClC,cAAc,IAAI,EAAE,cAAc;AAAA,IAClC,iBAAiB,IAAI,EAAE,iBAAiB;AAAA,IACxC,gBAAgB,UAAU,EAAE,eAAe;AAAA,IAC3C,cAAc,UAAU,EAAE,aAAa;AAAA,IACvC,iBAAiB,UAAU,EAAE,gBAAgB;AAAA,IAC7C,yBAAyB,IAAI,EAAE,0BAA0B;AAAA,IACzD,gBAAgB,KAAK,EAAE,eAAe;AAAA,IACtC,UAAU,KAAK,EAAE,SAAS;AAAA,IAC1B,SAAS,KAAK,EAAE,QAAQ;AAAA,IACxB,aAAa,IAAI,EAAE,YAAY;AAAA,IAC/B,kBAAkB,IAAI,EAAE,kBAAkB;AAAA,IAC1C,aAAa,UAAU,EAAE,gBAAgB;AAAA,IACzC,aAAa,UAAU,EAAE,cAAc;AAAA,IACvC,WAAW,WAAW,EAAE,UAAU;AAAA,IAClC,aAAa,WAAW,EAAE,YAAY;AAAA,IACtC,YAAY,WAAW,EAAE,WAAW;AAAA,IACpC,YAAY,IAAI,EAAE,WAAW;AAAA,IAC7B,mBAAmB,WAAW,EAAE,kBAAkB;AAAA,IAClD,eAAe,mBAAmB,EAAE,cAAc;AAAA,IAClD,kBAAkB,WAAW,EAAE,cAAc;AAAA,IAC7C,iBAAiB,WAAW,EAAE,iBAAiB;AAAA,IAC/C,qBAAqB,WAAW,EAAE,qBAAqB;AAAA,IACvD,kBAAkB,OAAO,EAAE,sBAAsB,WAAW,EAAE,sBAAsB,IAAI;AAAA,IACxF,oBAAoB,IAAI,EAAE,oBAAoB;AAAA,IAC9C,iBAAiB,IAAI,EAAE,iBAAiB;AAAA,IACxC,cAAc,IAAI,EAAE,cAAc;AAAA,IAClC,iBAAiB,IAAI,EAAE,iBAAiB;AAAA,IACxC,SAAS,UAAU,EAAE,QAAQ;AAAA,IAC7B,aAAa,IAAI,EAAE,aAAa;AAAA,IAChC,WAAW,UAAU,EAAE,WAAW;AAAA,IAClC,kBAAkB,IAAI,EAAE,mBAAmB;AAAA,IAC3C,eAAe,uBAAuB,EAAE,cAAc;AAAA,IACtD,wBAAwB,IAAI,EAAE,yBAAyB;AAAA,IACvD,oBAAoB,IAAI,EAAE,oBAAoB;AAAA,IAC9C,iBAAiB,IAAI,EAAE,iBAAiB;AAAA,IACxC,mBAAmB,IAAI,EAAE,mBAAmB;AAAA,IAC5C,eAAe,IAAI,EAAE,eAAe;AAAA,EACtC;AACF;AAQA,IAAM,eAAe;AAAA,EACnB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAKA,SAAS,OAAO,IAAQ;AACtB,SAAO,GACJ,WAAW,OAAO,EAClB,SAAS,eAAe,uBAAuB,UAAU,EACzD,SAAS,iBAAiB,yBAAyB,UAAU,EAC7D,OAAO,YAAY,EACnB,UAAU,CAAC,eAAe,eAAe,CAAC;AAC/C;AAgBA,eAAsB,gBACpB,IACA,QACA,gBACA,OACe;AACf,QAAM,iBAAiB,IAAI,QAAQ,EAAE,CAAC,cAAc,GAAG,MAAM,CAAC;AAChE;AAcA,eAAsB,iBACpB,IACA,QACA,QACkB;AAClB,QAAM,QAAgD,CAAC;AACvD,aAAW,CAAC,gBAAgB,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AAC5D,UAAM,MAAM,YAAY,cAAc;AACtC,QAAI,CAAC;AACH,YAAM,IAAI,MAAM,0DAA0D,cAAc,GAAG;AAG7F,UAAM,GAAG,IAAI,aAAa,KAAK,KAAK;AAAA,EACtC;AACA,MAAI,OAAO,KAAK,KAAK,EAAE,WAAW,EAAG,QAAO;AAC5C,QAAM,MAAM,MAAM,GACf,YAAY,OAAO,EACnB,IAAI,KAA+B,EACnC,MAAM,MAAM,KAAK,MAAM,EACvB,iBAAiB;AAEpB,SAAO,IAAI,iBAAiB;AAC9B;AAwBA,eAAsB,iBAAiB,IAAQ,KAAgB,YAAmC;AAChG,QAAM,EAAE,MAAM,QAAQ,SAAS,IAAI,iBAAiB,KAAK,UAAU;AACnE,QAAM,GACH,WAAW,OAAO,EAClB,OAAO,IAAI,EACX,WAAW,CAAC,OAAO,GAAG,OAAO,IAAI,EAAE,YAAY,IAAI,CAAC,EACpD,QAAQ;AACX,QAAM,GACH,WAAW,aAAa,EACxB,OAAO,MAAM,EACb,WAAW,CAAC,OAAO,GAAG,OAAO,SAAS,EAAE,YAAY,MAAM,CAAC,EAC3D,QAAQ;AACX,QAAM,GACH,WAAW,eAAe,EAC1B,OAAO,QAAQ,EACf,WAAW,CAAC,OAAO,GAAG,OAAO,SAAS,EAAE,YAAY,QAAQ,CAAC,EAC7D,QAAQ;AACb;AAeA,eAAsB,mBACpB,IACA,QACA,QACkB;AAIlB,QAAM,QAAgD,CAAC;AACvD,aAAW,CAAC,OAAO,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACnD,UAAM,IAAI,gBAAgB,KAAK;AAC/B,QAAI,CAAC;AACH,YAAM,IAAI,MAAM,kEAAkE,KAAK,GAAG;AAC5F,UAAM,EAAE,GAAG,IAAI,EAAE,OAAO,KAAK;AAAA,EAC/B;AACA,MAAI,OAAO,KAAK,KAAK,EAAE,WAAW,EAAG,QAAO;AAC5C,QAAM,MAAM,MAAM,GACf,YAAY,aAAa,EACzB,IAAI,KAAoC,EACxC,MAAM,WAAW,KAAK,MAAM,EAC5B,iBAAiB;AAEpB,SAAO,IAAI,iBAAiB;AAC9B;AASA,eAAsB,qBACpB,IACA,QACA,QACA,YACkB;AAClB,QAAM,QAAuC,CAAC;AAC9C,aAAW,CAAC,OAAO,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACnD,UAAM,IAAI,kBAAkB,KAAK;AACjC,QAAI,CAAC;AACH,YAAM,IAAI;AAAA,QACR,sEAAsE,KAAK;AAAA,MAC7E;AACF,UAAM,EAAE,GAAG,IAAI,EAAE,OAAO,KAAK;AAAA,EAC/B;AACA,MAAI,OAAO,KAAK,KAAK,EAAE,WAAW,EAAG,QAAO;AAC5C,QAAM,cAAc;AACpB,QAAM,MAAM,MAAM,GACf,YAAY,eAAe,EAC3B,IAAI,KAAsC,EAC1C,MAAM,WAAW,KAAK,MAAM,EAC5B,iBAAiB;AACpB,SAAO,IAAI,iBAAiB;AAC9B;AAIA,eAAsB,cAAc,IAAQ,MAA0C;AACpF,QAAM,IAAI,MAAM,OAAO,EAAE,EAAE,MAAM,cAAc,KAAK,IAAI,EAAE,iBAAiB;AAC3E,SAAO,IAAI,cAAc,CAAc,IAAI;AAC7C;AAGA,eAAsB,YAAY,IAAQ,IAAwC;AAChF,QAAM,IAAI,MAAM,OAAO,EAAE,EAAE,MAAM,YAAY,KAAK,EAAE,EAAE,iBAAiB;AACvE,SAAO,IAAI,cAAc,CAAc,IAAI;AAC7C;AAKA,eAAsB,UAAU,IAA+B;AAC7D,QAAM,OAAO,MAAM,OAAO,EAAE,EAAE,QAAQ,YAAY,EAAE,QAAQ;AAC5D,SAAO,KAAK,IAAI,CAAC,MAAM,cAAc,CAAc,CAAC;AACtD;AAOA,IAAM,yBAAsD,IAAI;AAAA,EAC9D,CAAC,GAAG,uBAAuB,GAAG,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC;AAC9E;AAEA,SAAS,oBAAoB,KAA6C;AACxE,MAAI,SAAkC,CAAC;AACvC,MAAI,OAAO,QAAQ,YAAY,IAAI,KAAK,MAAM,IAAI;AAChD,QAAI;AACF,YAAM,SAAkB,KAAK,MAAM,GAAG;AACtC,UAAI,UAAU,OAAO,WAAW,YAAY,CAAC,MAAM,QAAQ,MAAM;AAC/D,iBAAS;AAAA,IACb,QAAQ;AAAA,IAER;AAAA,EACF;AACA,QAAM,MAA+B,CAAC;AACtC,aAAW,CAAC,KAAK,KAAK,KAAK,uBAAwB,KAAI,KAAK,IAAI,QAAQ,OAAO,GAAG,CAAC;AACnF,SAAO;AACT;AASA,SAAS,gBACP,GACA,iBACW;AACX,QAAM,IAAI,EAAE;AACZ,QAAM,IAAI,EAAE;AACZ,QAAM,IAAI,EAAE;AACZ,QAAM,MAAM,EAAE;AACd,QAAM,aACJ,OAAO,MAAM,YACb,OAAO,MAAM,YACb,OAAO,MAAM,YACb,OAAO,QAAQ,WACX,EAAE,aAAa,GAAG,eAAe,GAAG,eAAe,GAAG,IAAI,IAC1D;AACN,SAAO;AAAA,IACL,IAAI,EAAE;AAAA,IACN,UAAU,EAAE,aAAa;AAAA,IACzB,QAAQ,EAAE,WAAW;AAAA,IACrB,YAAY,aAAa,EAAE,eAAe,MAAS;AAAA,IACnD,QAAQ,EAAE;AAAA,IACV,aAAa,EAAE;AAAA,IACf,WAAW,EAAE;AAAA,IACb,aAAa,EAAE;AAAA,IACf;AAAA,IACA,gBAAgB,EAAE;AAAA,IAClB,iBAAiB,EAAE;AAAA,IACnB,kBAAkB,KAAK,EAAE,kBAAkB;AAAA,IAC3C,gBAAgB,EAAE;AAAA,IAClB,gBAAgB,EAAE;AAAA,IAClB,YAAY,EAAE;AAAA,IACd,iBAAiB,EAAE;AAAA,IACnB,YAAY,EAAE,gBAAgB;AAAA,IAC9B,gBAAgB,EAAE,qBAAqB;AAAA,IACvC,QAAQ,EAAE;AAAA,IACV,YAAY,EAAE;AAAA,IACd,YAAY,EAAE;AAAA,IACd,gBAAiB,EAAE,mBAAmB;AAAA;AAAA;AAAA;AAAA,IAItC,wBAAwB,kBACpB,EAAE,KAAK,gBAAgB,EAAE,EAAE,YAAY,UAAU,GAAG,EAAE,aAAa,EAAE,EAAE,QAAQ,IAC/E;AAAA,IACJ,iBAAiB,EAAE;AAAA,IACnB,WAAW,oBAAoB,EAAE,SAAS;AAAA,IAC1C,cAAc,kBAAkB,EAAE,uBAAuB;AAAA,IACzD,cAAc,EAAE,kBAAkB;AAAA,IAClC,gBAAgB,EAAE;AAAA,IAClB,YAAY,EAAE;AAAA,IACd,YAAY,EAAE;AAAA,EAChB;AACF;AAQO,IAAM,sBAAsB;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAIA,IAAM,oBAAoB,iCAAyC,GAAG,mBAAmB;AAIzF,eAAsB,eAAe,IAA8B;AACjE,QAAM,OAAO,MAAM,GAChB,WAAW,SAAS,EACpB,OAAO,mBAAmB,EAC1B,OAAO,iBAAiB,EACxB,QAAQ,gBAAgB,MAAM,EAC9B,QAAQ,IAAI,EACZ,QAAQ;AACX,SAAO,KAAK,IAAI,CAAC,MAAM,gBAAgB,GAAG,EAAE,sBAAsB,CAAC,CAAC;AACtE;AAKA,eAAsB,mBAAmB,IAAQ,QAAsC;AACrF,QAAM,OAAO,MAAM,GAChB,WAAW,SAAS,EACpB,OAAO,mBAAmB,EAC1B,OAAO,iBAAiB,EACxB,MAAM,WAAW,KAAK,MAAM,EAC5B,QAAQ,gBAAgB,MAAM,EAC9B,QAAQ,IAAI,EACZ,QAAQ;AACX,SAAO,KAAK,IAAI,CAAC,MAAM,gBAAgB,GAAG,EAAE,sBAAsB,CAAC,CAAC;AACtE;AAiDA,eAAsB,kBACpB,IACA,UACA,OACe;AACf,MAAI,OAAO,KAAK,KAAK,EAAE,WAAW,EAAG;AACrC,QAAM,GAAG,YAAY,SAAS,EAAE,IAAI,KAAK,EAAE,MAAM,MAAM,KAAK,QAAQ,EAAE,QAAQ;AAChF;AAgBA,eAAsB,mBAAmB,IAAQ,KAA+B;AAC9E,QAAM,MAAM,gBAAgB,KAAK,IAAI;AACrC,QAAM,EAAE,eAAe,KAAK,GAAG,YAAY,IAAI;AAC/C,OAAK;AACL,QAAM,GACH,WAAW,SAAS,EACpB,OAAO,GAAG,EACV,WAAW,CAAC,OAAO,GAAG,OAAO,IAAI,EAAE,YAAY,WAAW,CAAC,EAC3D,QAAQ;AACb;AAcA,eAAsB,kBAAkB,IAAQ,UAAkB,MAA6B;AAC7F,QAAM,GAAG,YAAY,SAAS,EAAE,IAAI,EAAE,eAAe,KAAK,CAAC,EAAE,MAAM,MAAM,KAAK,QAAQ,EAAE,QAAQ;AAClG;AAGA,eAAsB,cAAc,IAAQ,IAAuC;AACjF,QAAM,IAAI,MAAM,GAAG,WAAW,SAAS,EAAE,UAAU,EAAE,MAAM,MAAM,KAAK,EAAE,EAAE,iBAAiB;AAC3F,SAAO,IAAI,gBAAgB,GAAG,EAAE,kBAAkB,IAAI,IAAI;AAC5D;AAIA,eAAsB,cACpB,IACA,IAC2D;AAC3D,QAAM,IAAI,MAAM,GACb,WAAW,SAAS,EACpB,OAAO,CAAC,iBAAiB,WAAW,CAAC,EACrC,MAAM,MAAM,KAAK,EAAE,EACnB,iBAAiB;AACpB,MAAI,CAAC,KAAK,EAAE,kBAAkB,KAAM,QAAO;AAC3C,SAAO,EAAE,MAAM,EAAE,eAAe,UAAU,EAAE,UAAU;AACxD;","names":[]}
+{"version":3,"sources":["../src/db/fleet-state.ts"],"sourcesContent":["/** Phase 2 of the Airtable → Turso migration (#539): the fleet-state READ layer.\n *\n *  Returns the exact `WebsiteRow` shape the Airtable module returns, so every\n *  repoint is an import-only swap at a composition root — the same trick\n *  listSubmissionsForSite used for the hybrid-db cutover. The raw values live\n *  in `sites`/`site_health`/`site_schedule` (written by the importer / hourly\n *  sync); coercion to `WebsiteRow` happens HERE, reusing the Airtable module's\n *  own exported coercers (`toVerdict`, `toFrequency`, `parseNotifyRouting`,\n *  `parseSecurityAdvisories`, `trimToNull`) so there is one truth for each.\n *\n *  The equivalence instrument (tests/db/fleet-state.test.ts) pins this module\n *  to `mapRow` field-by-field: for a fixture record, `mapRow(rec)` must deep-\n *  equal the row read back through here after an import. A new WebsiteRow\n *  field fails that test until this module carries it.\n *\n *  `headerImage` is the ONE deliberate exception (design D5): Airtable stopped\n *  being its source — the bytes belong in `sites.header_image*`. Those columns\n *  ARE now written: the header-image CLI dual-writes on every generation and the\n *  one-shot backfill copied the rest, so as of 2026-08-25 production carries a\n *  BLOB for 12 of the 13 maintained sites (the 13th, LA Homelessness Youth, has\n *  no header image in Airtable either — its reports are blocked at approve for\n *  exactly that). An earlier version of this comment said the columns were empty\n *  fleet-wide; that was true when written and is no longer.\n *\n *  The `url` is \"\" because the bytes live in the row itself, not behind a signed\n *  URL — which is why `url` is NOT a usable handle. A consumer that needs the\n *  image calls `loadHeaderImage(db, siteId)` for the bytes; the send path still\n *  fetches the Airtable attachment, and moving it over is its own change.\n */\nimport { sql, type Selectable, type Updateable } from \"kysely\";\nimport type { Db } from \"./client.js\";\nimport type { ReportsTable, SiteHealthTable, SiteScheduleTable, SitesTable } from \"./schema.js\";\nimport {\n  SITE_FIELDS,\n  siteValueFor,\n  healthColumnFor,\n  scheduleColumnFor,\n  mapReportRecord,\n  mapWebsiteRecord,\n  type RawRecord,\n} from \"./import-airtable.js\";\nimport type { AirtableCellValue } from \"../reports/airtable/websites.js\";\nimport {\n  toReportType,\n  parseAutoEvidence,\n  type ReportRow,\n  type DeliveryStatus,\n} from \"../reports/airtable/reports.js\";\nimport { MAINTENANCE_CHECKLIST, TESTING_CHECKLIST } from \"../reports/checklist.js\";\nimport type { WebsiteRow } from \"../reports/airtable/websites.js\";\nimport { canonicalizeStatus } from \"../reports/airtable/site-status.js\";\nimport {\n  parseNotifyRouting,\n  parseSecurityAdvisories,\n  toFrequency,\n  toPrismicModelsVerdict,\n  toVerdict,\n  trimToNull,\n} from \"../reports/airtable/websites.js\";\n\ntype JoinedRow = Record<string, unknown>;\n\nconst str = (v: unknown): string | null => (typeof v === \"string\" ? v : null);\nconst num = (v: unknown): number | null => (typeof v === \"number\" ? v : null);\n/** Stored 1/0/null (importer's b01n) → boolean | null. */\nconst bool = (v: unknown): boolean | null => (typeof v === \"number\" ? v !== 0 : null);\n\n/** Stored JSON array (importer-normalized) → the trimmed string[] mapRow yields. */\nfunction parseAwc(raw: unknown): string[] {\n  if (typeof raw !== \"string\" || raw.trim() === \"\") return [];\n  try {\n    const parsed: unknown = JSON.parse(raw);\n    if (!Array.isArray(parsed)) return [];\n    return parsed\n      .filter((x): x is string => typeof x === \"string\")\n      .map((s) => s.trim())\n      .filter(Boolean);\n  } catch {\n    return [];\n  }\n}\n\nfunction rowFromJoined(r: JoinedRow): WebsiteRow {\n  const name = String(r.name ?? \"\");\n  const headerFilename = str(r.header_image_filename);\n  const headerType = str(r.header_image_type);\n  return {\n    id: String(r.id),\n    name,\n    url: str(r.url) ?? \"\",\n    // `sites.status` holds the RAW Airtable cell (the importer stores it verbatim\n    // so the hourly parity check compares raw-to-raw). Canonicalizing HERE — the\n    // twin of mapRow's seam — is what keeps the #558 equivalence instrument green.\n    status: canonicalizeStatus(r.status),\n    statusRaw: str(r.status),\n    pointOfContact: str(r.point_of_contact),\n    maintenanceFreq: toFrequency(r.maintenance_freq, `${name} maintenance`),\n    testingFreq: toFrequency(r.testing_freq, `${name} testing`),\n    maintenanceFreqRaw: str(r.maintenance_freq),\n    testingFreqRaw: str(r.testing_freq),\n    maintenanceDay: str(r.maintenance_day),\n    testingDay: str(r.testing_day),\n    ga4PropertyId: str(r.ga4_property_id),\n    searchQuery: str(r.search_query),\n    searchConsoleProperty: str(r.search_console_property),\n    analyticsSoftFailAt: str(r.analytics_soft_fail_at),\n    gitRepo: str(r.git_repo),\n    reportRecipientsTo: str(r.report_recipients_to),\n    reportRecipientsCc: str(r.report_recipients_cc),\n    acceptedWatchConditions: parseAwc(r.accepted_watch_conditions),\n    headerImage:\n      headerFilename !== null && headerType !== null\n        ? { url: \"\", filename: headerFilename, type: headerType }\n        : null,\n    pScore: num(r.p_score),\n    rScore: num(r.r_score),\n    bpScore: num(r.bp_score),\n    seoScore: num(r.seo_score),\n    lastLighthouseAuditAt: str(r.lighthouse_at),\n    a11yViolations: num(r.a11y_violations),\n    depsDrifted: num(r.deps_drifted),\n    depsMajorBehind: num(r.deps_major_behind),\n    depsOutdated: num(r.deps_outdated),\n    depsMajorOutdated: num(r.deps_major_outdated),\n    securityVulnsCritical: num(r.vulns_critical),\n    securityVulnsHigh: num(r.vulns_high),\n    securityVulnsModerate: num(r.vulns_moderate),\n    securityVulnsLow: num(r.vulns_low),\n    securityAutoFixAttempts: num(r.auto_fix_attempts),\n    lastSecurityAuditAt: str(r.security_audit_at),\n    securityAdvisories: parseSecurityAdvisories(r.security_advisories),\n    certDaysRemaining: num(r.cert_days_remaining),\n    domainCheckedAt: str(r.domain_checked_at),\n    netlifyId: trimToNull(r.netlify_id),\n    deployStatus: str(r.deploy_status),\n    lastDeployAt: str(r.last_deploy_at),\n    deployLogUrl: str(r.deploy_log_url),\n    deployCheckedAt: str(r.deploy_checked_at),\n    functionHealth: toVerdict(r.function_health),\n    cmsReachable: toVerdict(r.cms_reachable),\n    turnstileWidget: toVerdict(r.turnstile_widget),\n    functionHealthCheckedAt: str(r.function_health_checked_at),\n    crossbrowserOk: bool(r.crossbrowser_ok),\n    mobileOk: bool(r.mobile_ok),\n    linksOk: bool(r.links_ok),\n    brokenLinks: num(r.broken_links),\n    browserCheckedAt: str(r.browser_checked_at),\n    reachableOk: toVerdict(r.uptime_reachable),\n    titleMetaOk: toVerdict(r.titles_meta_ok),\n    copyIntro: trimToNull(r.copy_intro),\n    copyContact: trimToNull(r.copy_contact),\n    copyFooter: trimToNull(r.copy_footer),\n    launchedAt: str(r.launched_at),\n    newsletterWebhook: trimToNull(r.newsletter_webhook),\n    notifyRouting: parseNotifyRouting(r.notify_routing),\n    notifyRoutingRaw: trimToNull(r.notify_routing),\n    mailchimpApiKey: trimToNull(r.mailchimp_api_key),\n    mailchimpAudienceId: trimToNull(r.mailchimp_audience_id),\n    requireTurnstile: typeof r.require_turnstile === \"number\" ? r.require_turnstile !== 0 : false,\n    renovateFailingCis: num(r.renovate_failing_cis),\n    defaultBranchCi: str(r.default_branch_ci),\n    lastCommitAt: str(r.last_commit_at),\n    githubSignalsAt: str(r.github_signals_at),\n    smokeOk: toVerdict(r.smoke_ok),\n    lastSmokeAt: str(r.last_smoke_at),\n    formE2eOk: toVerdict(r.form_e2e_ok),\n    formE2eCheckedAt: str(r.form_e2e_checked_at),\n    prismicModels: toPrismicModelsVerdict(r.prismic_models),\n    prismicModelsCheckedAt: str(r.prismic_models_checked_at),\n    prismicModelsDrift: str(r.prismic_models_drift),\n    prismicAckUntil: str(r.prismic_ack_until),\n    nextMaintenanceAt: str(r.next_maintenance_at),\n    nextTestingAt: str(r.next_testing_at),\n  };\n}\n\n/** Every sites column EXCEPT the header-image BLOB. Since the 2026-08-24\n *  backfill, header_image holds 0.7–3.5 MB JPEGs — a selectAll would haul\n *  megabytes into every site lookup (per LEAD on the ingest path, ×44 on the\n *  fleet list) and Turso bills the bytes. WebsiteRow only needs the metadata\n *  columns; the bytes have their own dedicated readers when a consumer wants\n *  them. Kept in lockstep with SitesTable by the blob-exclusion test. */\nconst SITE_COLUMNS = [\n  \"sites.id\",\n  \"sites.slug\",\n  \"sites.name\",\n  \"sites.url\",\n  \"sites.status\",\n  \"sites.point_of_contact\",\n  \"sites.maintenance_freq\",\n  \"sites.testing_freq\",\n  \"sites.maintenance_day\",\n  \"sites.testing_day\",\n  \"sites.ga4_property_id\",\n  \"sites.search_query\",\n  \"sites.search_console_property\",\n  \"sites.git_repo\",\n  \"sites.netlify_id\",\n  \"sites.report_recipients_to\",\n  \"sites.report_recipients_cc\",\n  \"sites.copy_intro\",\n  \"sites.copy_contact\",\n  \"sites.copy_footer\",\n  \"sites.newsletter_webhook\",\n  \"sites.mailchimp_api_key\",\n  \"sites.mailchimp_audience_id\",\n  \"sites.notify_routing\",\n  \"sites.require_turnstile\",\n  \"sites.accepted_watch_conditions\",\n  \"sites.prismic_ack_until\",\n  \"sites.launched_at\",\n  \"sites.header_image_filename\",\n  \"sites.header_image_type\",\n  \"sites.header_image_generated_at\",\n  \"sites.legacy\",\n] as const;\n\n/** The three-table join every read composes from. site_health/site_schedule\n *  rows are upserted alongside sites by the importer, but LEFT JOIN anyway —\n *  a site row must never vanish from a surface because a health row is absent. */\nfunction joined(db: Db) {\n  return db\n    .selectFrom(\"sites\")\n    .leftJoin(\"site_health\", \"site_health.site_id\", \"sites.id\")\n    .leftJoin(\"site_schedule\", \"site_schedule.site_id\", \"sites.id\")\n    .select(SITE_COLUMNS)\n    .selectAll([\"site_health\", \"site_schedule\"]);\n}\n\n/** Write-through for the site-detail editor (Phase 2): after the Airtable\n *  write (still the Phase 2 source of truth), mirror the same cell into\n *  `sites` so a Turso-reading page renders the edit immediately instead of\n *  waiting for the next hourly sync. The column mapping is the IMPORTER's own\n *  map — one truth — and the value gets the importer's empty-clears-to-null\n *  semantics. Throws on a column the importer doesn't claim (the lockstep\n *  test makes that unreachable for the editor's allowlist); the caller treats\n *  a mirror failure as non-fatal — the hourly sync converges it.\n *\n *  Handles the non-text columns too (`Require Turnstile` is a checkbox,\n *  `Accepted Watch Conditions` a multi-select): the coercion is NOT repeated\n *  here, it is delegated to the importer's own `siteValueFor`. That delegation\n *  is the whole safety property — parity compares raw-to-raw, so a mirror that\n *  stored `\"true\"` where the importer stores `1` would red every hourly run. */\nexport async function mirrorSiteField(\n  db: Db,\n  siteId: string,\n  airtableColumn: string,\n  value: AirtableCellValue,\n): Promise<void> {\n  await mirrorSiteFields(db, siteId, { [airtableColumn]: value });\n}\n\n/** The multi-column form, and where the work actually happens (#539 Phase 5).\n *\n *  `updateLaunched` is why it exists: it flips `Status` AND stamps `Launched at`\n *  in one Airtable update, and mirroring those as two separate UPDATEs would\n *  open a window where Turso says a site is maintained but never launched.\n *\n *  Same contract as {@link mirrorHealthFields}, deliberately — it takes the\n *  EXACT FieldSet just written to Airtable (the writers return it, so the mirror\n *  cannot carry a different payload), and returns whether a `sites` row matched:\n *  a site the hourly sync hasn't imported yet updates 0 rows → false, so the\n *  caller can count it honestly instead of claiming it mirrored. An empty\n *  FieldSet runs no SQL and returns true — nothing to mirror is not a miss. */\nexport async function mirrorSiteFields(\n  db: Db,\n  siteId: string,\n  fields: Record<string, unknown>,\n): Promise<boolean> {\n  const patch: Record<string, string | number | null> = {};\n  for (const [airtableColumn, value] of Object.entries(fields)) {\n    const col = SITE_FIELDS[airtableColumn];\n    if (!col)\n      throw new Error(`mirrorSiteFields: importer claims no sites column for '${airtableColumn}'`);\n    // Empty text still clears to null (the importer's `s()` does the same); the\n    // non-text columns get their own coercion inside siteValueFor.\n    patch[col] = siteValueFor(col, value);\n  }\n  if (Object.keys(patch).length === 0) return true;\n  const res = await db\n    .updateTable(\"sites\")\n    .set(patch as Updateable<SitesTable>)\n    .where(\"id\", \"=\", siteId)\n    .executeTakeFirst();\n  // kysely/libSQL reports numUpdatedRows as a BigInt — compare in BigInt.\n  return res.numUpdatedRows > 0n;\n}\n\n/** Mirror a NEWLY CREATED Airtable Websites record into Turso (#539 Phase 5).\n *\n *  `ensure-site` CREATES a row, and every other site mirror is an UPDATE, which\n *  does nothing at all for a row that does not exist yet — so a site\n *  bootstrapped at 09:05 was invisible until the 09:20 sync, and every mirror\n *  the rest of the bootstrap fired reported `mirrored=missed` with nothing to\n *  update.\n *\n *  Maps with the IMPORTER's own `mapWebsiteRecord`, which is also exactly what\n *  parity diffs against: that delegation is what makes the mirrored rows\n *  parity-clean by construction rather than by a column list someone has to\n *  remember to extend.\n *\n *  All THREE rows, not just `sites`. Parity reverse-checks `site_health` and\n *  `site_schedule` per site and reports a missing one as `(row) ABSENT`, and a\n *  later `mirrorHealthFields` would return `missed` forever with no row to hit.\n *\n *  Upserts rather than inserts because `ensure-site` is re-run to RESUME a\n *  bootstrap. The header_image* columns survive that by construction —\n *  `mapWebsiteRecord` does not carry them (Airtable stopped being their source,\n *  design D5), so the conflict branch cannot blank a stored plate whose bytes\n *  live in no other store. */\nexport async function mirrorSiteInsert(db: Db, rec: RawRecord, computedAt: string): Promise<void> {\n  const { site, health, schedule } = mapWebsiteRecord(rec, computedAt);\n  await db\n    .insertInto(\"sites\")\n    .values(site)\n    .onConflict((oc) => oc.column(\"id\").doUpdateSet(site))\n    .execute();\n  await db\n    .insertInto(\"site_health\")\n    .values(health)\n    .onConflict((oc) => oc.column(\"site_id\").doUpdateSet(health))\n    .execute();\n  await db\n    .insertInto(\"site_schedule\")\n    .values(schedule)\n    .onConflict((oc) => oc.column(\"site_id\").doUpdateSet(schedule))\n    .execute();\n}\n\n/** Write-through mirror for the nightly health writers (#539 Phase 3). Takes\n *  the EXACT FieldSet just written to Airtable (updateAuditFields /\n *  updateGitHubSignals return it), so the mirror can never carry a different\n *  payload than the Airtable write it shadows. Resolution + coercion come from\n *  the importer's healthColumnFor — one truth; an Airtable column no\n *  site_health column claims throws (same contract as mirrorSiteField).\n *  Partial by design: absent fields stay untouched, matching\n *  updateGitHubSignals' deliberate omission of a null lastCommitAt. Returns\n *  whether a site_health row matched: a site the hourly sync hasn't imported\n *  yet updates 0 rows → false, so the caller can count it honestly\n *  (mirror_missed) instead of claiming it mirrored — it still converges on the\n *  next sync, like every mirror. An empty FieldSet runs no SQL and returns\n *  true: nothing to mirror is not a miss. */\nexport async function mirrorHealthFields(\n  db: Db,\n  siteId: string,\n  fields: Record<string, unknown>,\n): Promise<boolean> {\n  // Per-column value types (number vs text) are guaranteed by healthColumnFor's\n  // coercion — the numeric/text split lives there, once — so the patch builds\n  // untyped and casts at the .set() boundary (the importer's own idiom).\n  const patch: Record<string, string | number | null> = {};\n  for (const [field, value] of Object.entries(fields)) {\n    const m = healthColumnFor(field);\n    if (!m)\n      throw new Error(`mirrorHealthFields: importer claims no site_health column for '${field}'`);\n    patch[m.col] = m.coerce(value);\n  }\n  if (Object.keys(patch).length === 0) return true;\n  const res = await db\n    .updateTable(\"site_health\")\n    .set(patch as Updateable<SiteHealthTable>)\n    .where(\"site_id\", \"=\", siteId)\n    .executeTakeFirst();\n  // kysely/libSQL reports numUpdatedRows as a BigInt — compare in BigInt.\n  return res.numUpdatedRows > 0n;\n}\n\n/** The site_schedule twin of {@link mirrorHealthFields}, for the nightly\n *  next-due write-back. `computedAt` stamps when THIS computation ran — the\n *  hourly sync overwrites it with its own import stamp, same as every mirrored\n *  value. Empty fields → full no-op (no lone computed_at stamp for a write\n *  that carried nothing). Same return contract as mirrorHealthFields: false\n *  when the UPDATE matched no site_schedule row (site not yet imported), true\n *  otherwise — including the empty-fields no-op. */\nexport async function mirrorScheduleFields(\n  db: Db,\n  siteId: string,\n  fields: Record<string, unknown>,\n  computedAt: string,\n): Promise<boolean> {\n  const patch: Record<string, string | null> = {};\n  for (const [field, value] of Object.entries(fields)) {\n    const m = scheduleColumnFor(field);\n    if (!m)\n      throw new Error(\n        `mirrorScheduleFields: importer claims no site_schedule column for '${field}'`,\n      );\n    patch[m.col] = m.coerce(value);\n  }\n  if (Object.keys(patch).length === 0) return true;\n  patch.computed_at = computedAt;\n  const res = await db\n    .updateTable(\"site_schedule\")\n    .set(patch as Updateable<SiteScheduleTable>)\n    .where(\"site_id\", \"=\", siteId)\n    .executeTakeFirst();\n  return res.numUpdatedRows > 0n;\n}\n\n/** Same contract as the Airtable getWebsiteBySlug: slug is siteSlug(Name),\n *  precomputed into the UNIQUE sites.slug column at import time. */\nexport async function getSiteBySlug(db: Db, slug: string): Promise<WebsiteRow | null> {\n  const r = await joined(db).where(\"sites.slug\", \"=\", slug).executeTakeFirst();\n  return r ? rowFromJoined(r as JoinedRow) : null;\n}\n\n/** By Airtable rec id (the PK) — approve-report's lookup shape. */\nexport async function getSiteById(db: Db, id: string): Promise<WebsiteRow | null> {\n  const r = await joined(db).where(\"sites.id\", \"=\", id).executeTakeFirst();\n  return r ? rowFromJoined(r as JoinedRow) : null;\n}\n\n/** Same contract as the Airtable listWebsites: every site, one row each.\n *  Name-ordered for determinism (Airtable returned table order; no consumer\n *  is order-sensitive — the cockpit groups and sorts itself). */\nexport async function listSites(db: Db): Promise<WebsiteRow[]> {\n  const rows = await joined(db).orderBy(\"sites.name\").execute();\n  return rows.map((r) => rowFromJoined(r as JoinedRow));\n}\n\n// ————————————————————————— reports —————————————————————————\n\n/** stable checklist key → Airtable column name. The importer stores stable keys\n *  (mapReportRecord); `ReportRow.checklist` exposes Airtable column names — one\n *  derived map, built from the checklist definitions themselves. */\nconst CHECKLIST_FIELD_BY_KEY: ReadonlyMap<string, string> = new Map(\n  [...MAINTENANCE_CHECKLIST, ...TESTING_CHECKLIST].map((i) => [i.key, i.field]),\n);\n\nfunction checklistFromStored(raw: string | null): Record<string, boolean> {\n  let stored: Record<string, unknown> = {};\n  if (typeof raw === \"string\" && raw.trim() !== \"\") {\n    try {\n      const parsed: unknown = JSON.parse(raw);\n      if (parsed && typeof parsed === \"object\" && !Array.isArray(parsed))\n        stored = parsed as Record<string, unknown>;\n    } catch {\n      // fall through to all-false — a bad blob must not throw the page\n    }\n  }\n  const out: Record<string, boolean> = {};\n  for (const [key, field] of CHECKLIST_FIELD_BY_KEY) out[field] = Boolean(stored[key]);\n  return out;\n}\n\n/**\n * `hasRenderedHtml` is passed separately rather than read off `r`, because the\n * list read deliberately does not fetch the body (see REPORT_LIST_COLUMNS) and\n * only ever needed its null-ness. Taking it as an argument means a list row and a\n * full row are both honest inputs, and nothing here can start depending on body\n * CONTENT without the type changing to say so.\n */\nfunction reportRowFromDb(\n  r: Omit<Selectable<ReportsTable>, \"rendered_html\">,\n  hasRenderedHtml: boolean,\n): ReportRow {\n  const p = r.lighthouse_performance;\n  const a = r.lighthouse_accessibility;\n  const b = r.lighthouse_best_practices;\n  const seo = r.lighthouse_seo;\n  const lighthouse =\n    typeof p === \"number\" &&\n    typeof a === \"number\" &&\n    typeof b === \"number\" &&\n    typeof seo === \"number\"\n      ? { performance: p, accessibility: a, bestPractices: b, seo }\n      : null;\n  return {\n    id: r.id,\n    reportId: r.report_id ?? \"\",\n    siteId: r.site_id ?? \"\",\n    reportType: toReportType(r.report_type ?? undefined),\n    period: r.period,\n    periodStart: r.period_start,\n    periodEnd: r.period_end,\n    completedOn: r.completed_on,\n    lighthouse,\n    gaUsersCurrent: r.ga_users_current,\n    gaUsersPrevious: r.ga_users_previous,\n    searchFoundPage1: bool(r.search_found_page1),\n    searchPosition: r.search_position,\n    lastTestedDate: r.last_tested_date,\n    commentary: r.commentary,\n    subjectOverride: r.subject_override,\n    draftReady: r.draft_ready !== 0,\n    approvedToSend: r.approved_to_send !== 0,\n    sentAt: r.sent_at,\n    approvedAt: r.approved_at,\n    approvedBy: r.approved_by,\n    deliveryStatus: (r.delivery_status ?? \"pending\") as DeliveryStatus,\n    // The body lives IN the row (rendered_html) — the link points at the\n    // dashboard's own preview route instead of an EXPIRING Airtable signed URL.\n    // Strictly better for the operator: the old link 404'd once the URL aged out.\n    renderedHtmlAttachment: hasRenderedHtml\n      ? { url: `/api/reports/${r.id}/preview`, filename: `${r.report_id ?? r.id}.html` }\n      : null,\n    resendMessageId: r.resend_message_id,\n    checklist: checklistFromStored(r.checklist),\n    autoEvidence: parseAutoEvidence(r.checklist_auto_evidence),\n    sendOverride: r.send_override !== 0,\n    overrideReason: r.override_reason,\n    overrideBy: r.override_by,\n    overrideAt: r.override_at,\n  };\n}\n\n/** Every reports column EXCEPT the rendered_html body — the exact hazard\n *  SITE_COLUMNS guards against on `sites`, on the table where it currently costs\n *  more. Live, all 16 reports carry a body: 1.17 MB total, avg 73 KB. A list read\n *  wants the body only to know WHETHER there is one, so `has_rendered_html`\n *  computes that in SQL and the bytes stay in the database. Kept in lockstep with\n *  ReportsTable by the body-exclusion test. */\nexport const REPORT_LIST_COLUMNS = [\n  \"id\",\n  \"site_id\",\n  \"report_id\",\n  \"report_type\",\n  \"period\",\n  \"period_start\",\n  \"period_end\",\n  \"completed_on\",\n  \"lighthouse_performance\",\n  \"lighthouse_accessibility\",\n  \"lighthouse_best_practices\",\n  \"lighthouse_seo\",\n  \"ga_users_current\",\n  \"ga_users_previous\",\n  \"search_found_page1\",\n  \"search_position\",\n  \"last_tested_date\",\n  \"commentary\",\n  \"subject_override\",\n  \"draft_ready\",\n  \"approved_to_send\",\n  \"approved_at\",\n  \"approved_by\",\n  \"send_override\",\n  \"override_reason\",\n  \"override_by\",\n  \"override_at\",\n  \"sent_at\",\n  \"delivery_status\",\n  \"resend_message_id\",\n  \"checklist\",\n  \"checklist_auto_evidence\",\n] as const;\n\n/** The one thing a list read still needs from the body: whether there IS one.\n *  Computed in SQLite so the bytes never cross the wire. */\nconst HAS_RENDERED_HTML = sql<number>`(rendered_html is not null)`.as(\"has_rendered_html\");\n\n/** Same contract as the Airtable listAllReports. Newest-period-first (Airtable\n *  returned manual table order; every consumer filters/sorts itself). */\nexport async function listAllReports(db: Db): Promise<ReportRow[]> {\n  const rows = await db\n    .selectFrom(\"reports\")\n    .select(REPORT_LIST_COLUMNS)\n    .select(HAS_RENDERED_HTML)\n    .orderBy(\"period_start\", \"desc\")\n    .orderBy(\"id\")\n    .execute();\n  return rows.map((r) => reportRowFromDb(r, r.has_rendered_html !== 0));\n}\n\n/** Same contract as the Airtable listReportsForSite — served by idx_reports_site.\n *  Body-free for the same reason as listAllReports: the site-detail page renders\n *  a link, never the HTML. */\nexport async function listReportsForSite(db: Db, siteId: string): Promise<ReportRow[]> {\n  const rows = await db\n    .selectFrom(\"reports\")\n    .select(REPORT_LIST_COLUMNS)\n    .select(HAS_RENDERED_HTML)\n    .where(\"site_id\", \"=\", siteId)\n    .orderBy(\"period_start\", \"desc\")\n    .orderBy(\"id\")\n    .execute();\n  return rows.map((r) => reportRowFromDb(r, r.has_rendered_html !== 0));\n}\n\n/** Columns a report writer mirrors after its Airtable write (same pattern as\n *  mirrorSiteField): the approve/override flow, the resend-webhook's delivery\n *  status, and — since #539 Phase 5 — the drafting path's queue flag and a\n *  re-run's refreshed scores.\n *\n *  `rendered_html` stays deliberately OUT even though the drafting path now\n *  writes it: bodies go through `storeRenderedHtml`, so a request handler\n *  holding a patch cannot accidentally write megabytes of HTML. */\nexport type ReportMirrorPatch = Partial<\n  Pick<\n    ReportsTable,\n    | \"approved_to_send\"\n    | \"approved_at\"\n    | \"approved_by\"\n    | \"send_override\"\n    | \"override_reason\"\n    | \"override_by\"\n    | \"override_at\"\n    | \"delivery_status\"\n    // Phase 4 report review: the console edits commentary and re-renders the\n    // page immediately after the write, so the mirror has to carry it or the\n    // operator sees their own save as a no-op until the next hourly sync.\n    | \"commentary\"\n    // Phase 5 drafting path. `draft_ready` is the queue flag `queueDraft`\n    // writes — for the new draft AND for every row it supersedes, so without it\n    // the console shows a site with two queued reports until the next sync.\n    | \"draft_ready\"\n    // A re-run (announce/launch reuse) refreshes an existing row's scores so the\n    // eventually-sent email is not stale; the console reads the same numbers.\n    | \"lighthouse_performance\"\n    | \"lighthouse_accessibility\"\n    | \"lighthouse_best_practices\"\n    | \"lighthouse_seo\"\n    | \"ga_users_current\"\n    | \"ga_users_previous\"\n    | \"search_found_page1\"\n    | \"search_position\"\n    | \"completed_on\"\n    // #643 (the freeze): the send batch mirrors its own `Sent at` stamp. These\n    // used to stay out because the hourly sync converged them; that sync is\n    // retired, and the console's already-sent guards (approve, the commentary\n    // lock, re-render) read `sent_at` from Turso — an unmirrored stamp would\n    // disarm all three for every post-flip send.\n    | \"sent_at\"\n    | \"resend_message_id\"\n  >\n>;\n\n/** Mirror an Airtable report write into Turso so the page re-render after an\n *  approve/override/bounce shows the new state immediately. Callers route\n *  failures through `mirrorWrite`, which decides fatal vs swallowed by the\n *  freeze switch; an empty patch is a no-op, never invalid SQL. */\nexport async function mirrorReportPatch(\n  db: Db,\n  reportId: string,\n  patch: ReportMirrorPatch,\n): Promise<void> {\n  if (Object.keys(patch).length === 0) return;\n  await db.updateTable(\"reports\").set(patch).where(\"id\", \"=\", reportId).execute();\n}\n\n/** Mirror a NEWLY CREATED Airtable Reports record into Turso (#539 Phase 5).\n *\n *  Every other report mirror is an UPDATE, which silently does nothing for a row\n *  that does not exist yet — so a draft created at 09:05 was invisible to the\n *  Turso-backed console until the 09:20 sync. Takes the raw record Airtable\n *  echoed back from the create, and maps it with the IMPORTER's own\n *  `mapReportRecord`: parity diffs Turso against exactly that function, so\n *  delegating is what makes the mirrored row parity-clean by construction rather\n *  than by a column list someone has to remember to extend.\n *\n *  Upsert, not insert, and the conflict branch drops `rendered_html` for the\n *  same reason the importer's does: the body is written later by a separate\n *  sharp-bearing step, so a re-mirror carrying null would blank a render that\n *  had already succeeded. */\nexport async function mirrorReportInsert(db: Db, rec: RawRecord): Promise<void> {\n  const row = mapReportRecord(rec, null);\n  const { rendered_html: _rh, ...rowSansHtml } = row;\n  void _rh;\n  await db\n    .insertInto(\"reports\")\n    .values(row)\n    .onConflict((oc) => oc.column(\"id\").doUpdateSet(rowSansHtml))\n    .execute();\n}\n\n/**\n * Store a freshly rendered report body, replacing whatever was there.\n *\n * Deliberately NOT part of `ReportMirrorPatch`: that patch is the request path's\n * write-through (approve, override, delivery status), and a rendered body is\n * produced by a batch job with sharp, never by a dashboard POST. Keeping it out\n * means a handler cannot accidentally write megabytes of HTML from a request.\n *\n * It REPLACES unconditionally. The importer's `when-missing` mode skips a report\n * that already has a body — correct for an import, wrong here: a refresh whose\n * entire purpose is showing the newest commentary must overwrite.\n */\nexport async function storeRenderedHtml(db: Db, reportId: string, html: string): Promise<void> {\n  await db.updateTable(\"reports\").set({ rendered_html: html }).where(\"id\", \"=\", reportId).execute();\n}\n\n/** By rec id (the PK) — approve-report's read. */\nexport async function getReportById(db: Db, id: string): Promise<ReportRow | null> {\n  const r = await db.selectFrom(\"reports\").selectAll().where(\"id\", \"=\", id).executeTakeFirst();\n  return r ? reportRowFromDb(r, r.rendered_html !== null) : null;\n}\n\n/** The preview route's read: the stored rendered body, or null when the report\n *  has none (imported while its signed URL was expired, or predates rendering). */\nexport async function getReportHtml(\n  db: Db,\n  id: string,\n): Promise<{ html: string; reportId: string | null } | null> {\n  const r = await db\n    .selectFrom(\"reports\")\n    .select([\"rendered_html\", \"report_id\"])\n    .where(\"id\", \"=\", id)\n    .executeTakeFirst();\n  if (!r || r.rendered_html === null) return null;\n  return { html: r.rendered_html, reportId: r.report_id };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,SAAS,WAA6C;AAiCtD,IAAM,MAAM,CAAC,MAA+B,OAAO,MAAM,WAAW,IAAI;AACxE,IAAM,MAAM,CAAC,MAA+B,OAAO,MAAM,WAAW,IAAI;AAExE,IAAM,OAAO,CAAC,MAAgC,OAAO,MAAM,WAAW,MAAM,IAAI;AAGhF,SAAS,SAAS,KAAwB;AACxC,MAAI,OAAO,QAAQ,YAAY,IAAI,KAAK,MAAM,GAAI,QAAO,CAAC;AAC1D,MAAI;AACF,UAAM,SAAkB,KAAK,MAAM,GAAG;AACtC,QAAI,CAAC,MAAM,QAAQ,MAAM,EAAG,QAAO,CAAC;AACpC,WAAO,OACJ,OAAO,CAAC,MAAmB,OAAO,MAAM,QAAQ,EAChD,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,OAAO;AAAA,EACnB,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,SAAS,cAAc,GAA0B;AAC/C,QAAM,OAAO,OAAO,EAAE,QAAQ,EAAE;AAChC,QAAM,iBAAiB,IAAI,EAAE,qBAAqB;AAClD,QAAM,aAAa,IAAI,EAAE,iBAAiB;AAC1C,SAAO;AAAA,IACL,IAAI,OAAO,EAAE,EAAE;AAAA,IACf;AAAA,IACA,KAAK,IAAI,EAAE,GAAG,KAAK;AAAA;AAAA;AAAA;AAAA,IAInB,QAAQ,mBAAmB,EAAE,MAAM;AAAA,IACnC,WAAW,IAAI,EAAE,MAAM;AAAA,IACvB,gBAAgB,IAAI,EAAE,gBAAgB;AAAA,IACtC,iBAAiB,YAAY,EAAE,kBAAkB,GAAG,IAAI,cAAc;AAAA,IACtE,aAAa,YAAY,EAAE,cAAc,GAAG,IAAI,UAAU;AAAA,IAC1D,oBAAoB,IAAI,EAAE,gBAAgB;AAAA,IAC1C,gBAAgB,IAAI,EAAE,YAAY;AAAA,IAClC,gBAAgB,IAAI,EAAE,eAAe;AAAA,IACrC,YAAY,IAAI,EAAE,WAAW;AAAA,IAC7B,eAAe,IAAI,EAAE,eAAe;AAAA,IACpC,aAAa,IAAI,EAAE,YAAY;AAAA,IAC/B,uBAAuB,IAAI,EAAE,uBAAuB;AAAA,IACpD,qBAAqB,IAAI,EAAE,sBAAsB;AAAA,IACjD,SAAS,IAAI,EAAE,QAAQ;AAAA,IACvB,oBAAoB,IAAI,EAAE,oBAAoB;AAAA,IAC9C,oBAAoB,IAAI,EAAE,oBAAoB;AAAA,IAC9C,yBAAyB,SAAS,EAAE,yBAAyB;AAAA,IAC7D,aACE,mBAAmB,QAAQ,eAAe,OACtC,EAAE,KAAK,IAAI,UAAU,gBAAgB,MAAM,WAAW,IACtD;AAAA,IACN,QAAQ,IAAI,EAAE,OAAO;AAAA,IACrB,QAAQ,IAAI,EAAE,OAAO;AAAA,IACrB,SAAS,IAAI,EAAE,QAAQ;AAAA,IACvB,UAAU,IAAI,EAAE,SAAS;AAAA,IACzB,uBAAuB,IAAI,EAAE,aAAa;AAAA,IAC1C,gBAAgB,IAAI,EAAE,eAAe;AAAA,IACrC,aAAa,IAAI,EAAE,YAAY;AAAA,IAC/B,iBAAiB,IAAI,EAAE,iBAAiB;AAAA,IACxC,cAAc,IAAI,EAAE,aAAa;AAAA,IACjC,mBAAmB,IAAI,EAAE,mBAAmB;AAAA,IAC5C,uBAAuB,IAAI,EAAE,cAAc;AAAA,IAC3C,mBAAmB,IAAI,EAAE,UAAU;AAAA,IACnC,uBAAuB,IAAI,EAAE,cAAc;AAAA,IAC3C,kBAAkB,IAAI,EAAE,SAAS;AAAA,IACjC,yBAAyB,IAAI,EAAE,iBAAiB;AAAA,IAChD,qBAAqB,IAAI,EAAE,iBAAiB;AAAA,IAC5C,oBAAoB,wBAAwB,EAAE,mBAAmB;AAAA,IACjE,mBAAmB,IAAI,EAAE,mBAAmB;AAAA,IAC5C,iBAAiB,IAAI,EAAE,iBAAiB;AAAA,IACxC,WAAW,WAAW,EAAE,UAAU;AAAA,IAClC,cAAc,IAAI,EAAE,aAAa;AAAA,IACjC,cAAc,IAAI,EAAE,cAAc;AAAA,IAClC,cAAc,IAAI,EAAE,cAAc;AAAA,IAClC,iBAAiB,IAAI,EAAE,iBAAiB;AAAA,IACxC,gBAAgB,UAAU,EAAE,eAAe;AAAA,IAC3C,cAAc,UAAU,EAAE,aAAa;AAAA,IACvC,iBAAiB,UAAU,EAAE,gBAAgB;AAAA,IAC7C,yBAAyB,IAAI,EAAE,0BAA0B;AAAA,IACzD,gBAAgB,KAAK,EAAE,eAAe;AAAA,IACtC,UAAU,KAAK,EAAE,SAAS;AAAA,IAC1B,SAAS,KAAK,EAAE,QAAQ;AAAA,IACxB,aAAa,IAAI,EAAE,YAAY;AAAA,IAC/B,kBAAkB,IAAI,EAAE,kBAAkB;AAAA,IAC1C,aAAa,UAAU,EAAE,gBAAgB;AAAA,IACzC,aAAa,UAAU,EAAE,cAAc;AAAA,IACvC,WAAW,WAAW,EAAE,UAAU;AAAA,IAClC,aAAa,WAAW,EAAE,YAAY;AAAA,IACtC,YAAY,WAAW,EAAE,WAAW;AAAA,IACpC,YAAY,IAAI,EAAE,WAAW;AAAA,IAC7B,mBAAmB,WAAW,EAAE,kBAAkB;AAAA,IAClD,eAAe,mBAAmB,EAAE,cAAc;AAAA,IAClD,kBAAkB,WAAW,EAAE,cAAc;AAAA,IAC7C,iBAAiB,WAAW,EAAE,iBAAiB;AAAA,IAC/C,qBAAqB,WAAW,EAAE,qBAAqB;AAAA,IACvD,kBAAkB,OAAO,EAAE,sBAAsB,WAAW,EAAE,sBAAsB,IAAI;AAAA,IACxF,oBAAoB,IAAI,EAAE,oBAAoB;AAAA,IAC9C,iBAAiB,IAAI,EAAE,iBAAiB;AAAA,IACxC,cAAc,IAAI,EAAE,cAAc;AAAA,IAClC,iBAAiB,IAAI,EAAE,iBAAiB;AAAA,IACxC,SAAS,UAAU,EAAE,QAAQ;AAAA,IAC7B,aAAa,IAAI,EAAE,aAAa;AAAA,IAChC,WAAW,UAAU,EAAE,WAAW;AAAA,IAClC,kBAAkB,IAAI,EAAE,mBAAmB;AAAA,IAC3C,eAAe,uBAAuB,EAAE,cAAc;AAAA,IACtD,wBAAwB,IAAI,EAAE,yBAAyB;AAAA,IACvD,oBAAoB,IAAI,EAAE,oBAAoB;AAAA,IAC9C,iBAAiB,IAAI,EAAE,iBAAiB;AAAA,IACxC,mBAAmB,IAAI,EAAE,mBAAmB;AAAA,IAC5C,eAAe,IAAI,EAAE,eAAe;AAAA,EACtC;AACF;AAQA,IAAM,eAAe;AAAA,EACnB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAKA,SAAS,OAAO,IAAQ;AACtB,SAAO,GACJ,WAAW,OAAO,EAClB,SAAS,eAAe,uBAAuB,UAAU,EACzD,SAAS,iBAAiB,yBAAyB,UAAU,EAC7D,OAAO,YAAY,EACnB,UAAU,CAAC,eAAe,eAAe,CAAC;AAC/C;AAgBA,eAAsB,gBACpB,IACA,QACA,gBACA,OACe;AACf,QAAM,iBAAiB,IAAI,QAAQ,EAAE,CAAC,cAAc,GAAG,MAAM,CAAC;AAChE;AAcA,eAAsB,iBACpB,IACA,QACA,QACkB;AAClB,QAAM,QAAgD,CAAC;AACvD,aAAW,CAAC,gBAAgB,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AAC5D,UAAM,MAAM,YAAY,cAAc;AACtC,QAAI,CAAC;AACH,YAAM,IAAI,MAAM,0DAA0D,cAAc,GAAG;AAG7F,UAAM,GAAG,IAAI,aAAa,KAAK,KAAK;AAAA,EACtC;AACA,MAAI,OAAO,KAAK,KAAK,EAAE,WAAW,EAAG,QAAO;AAC5C,QAAM,MAAM,MAAM,GACf,YAAY,OAAO,EACnB,IAAI,KAA+B,EACnC,MAAM,MAAM,KAAK,MAAM,EACvB,iBAAiB;AAEpB,SAAO,IAAI,iBAAiB;AAC9B;AAwBA,eAAsB,iBAAiB,IAAQ,KAAgB,YAAmC;AAChG,QAAM,EAAE,MAAM,QAAQ,SAAS,IAAI,iBAAiB,KAAK,UAAU;AACnE,QAAM,GACH,WAAW,OAAO,EAClB,OAAO,IAAI,EACX,WAAW,CAAC,OAAO,GAAG,OAAO,IAAI,EAAE,YAAY,IAAI,CAAC,EACpD,QAAQ;AACX,QAAM,GACH,WAAW,aAAa,EACxB,OAAO,MAAM,EACb,WAAW,CAAC,OAAO,GAAG,OAAO,SAAS,EAAE,YAAY,MAAM,CAAC,EAC3D,QAAQ;AACX,QAAM,GACH,WAAW,eAAe,EAC1B,OAAO,QAAQ,EACf,WAAW,CAAC,OAAO,GAAG,OAAO,SAAS,EAAE,YAAY,QAAQ,CAAC,EAC7D,QAAQ;AACb;AAeA,eAAsB,mBACpB,IACA,QACA,QACkB;AAIlB,QAAM,QAAgD,CAAC;AACvD,aAAW,CAAC,OAAO,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACnD,UAAM,IAAI,gBAAgB,KAAK;AAC/B,QAAI,CAAC;AACH,YAAM,IAAI,MAAM,kEAAkE,KAAK,GAAG;AAC5F,UAAM,EAAE,GAAG,IAAI,EAAE,OAAO,KAAK;AAAA,EAC/B;AACA,MAAI,OAAO,KAAK,KAAK,EAAE,WAAW,EAAG,QAAO;AAC5C,QAAM,MAAM,MAAM,GACf,YAAY,aAAa,EACzB,IAAI,KAAoC,EACxC,MAAM,WAAW,KAAK,MAAM,EAC5B,iBAAiB;AAEpB,SAAO,IAAI,iBAAiB;AAC9B;AASA,eAAsB,qBACpB,IACA,QACA,QACA,YACkB;AAClB,QAAM,QAAuC,CAAC;AAC9C,aAAW,CAAC,OAAO,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACnD,UAAM,IAAI,kBAAkB,KAAK;AACjC,QAAI,CAAC;AACH,YAAM,IAAI;AAAA,QACR,sEAAsE,KAAK;AAAA,MAC7E;AACF,UAAM,EAAE,GAAG,IAAI,EAAE,OAAO,KAAK;AAAA,EAC/B;AACA,MAAI,OAAO,KAAK,KAAK,EAAE,WAAW,EAAG,QAAO;AAC5C,QAAM,cAAc;AACpB,QAAM,MAAM,MAAM,GACf,YAAY,eAAe,EAC3B,IAAI,KAAsC,EAC1C,MAAM,WAAW,KAAK,MAAM,EAC5B,iBAAiB;AACpB,SAAO,IAAI,iBAAiB;AAC9B;AAIA,eAAsB,cAAc,IAAQ,MAA0C;AACpF,QAAM,IAAI,MAAM,OAAO,EAAE,EAAE,MAAM,cAAc,KAAK,IAAI,EAAE,iBAAiB;AAC3E,SAAO,IAAI,cAAc,CAAc,IAAI;AAC7C;AAGA,eAAsB,YAAY,IAAQ,IAAwC;AAChF,QAAM,IAAI,MAAM,OAAO,EAAE,EAAE,MAAM,YAAY,KAAK,EAAE,EAAE,iBAAiB;AACvE,SAAO,IAAI,cAAc,CAAc,IAAI;AAC7C;AAKA,eAAsB,UAAU,IAA+B;AAC7D,QAAM,OAAO,MAAM,OAAO,EAAE,EAAE,QAAQ,YAAY,EAAE,QAAQ;AAC5D,SAAO,KAAK,IAAI,CAAC,MAAM,cAAc,CAAc,CAAC;AACtD;AAOA,IAAM,yBAAsD,IAAI;AAAA,EAC9D,CAAC,GAAG,uBAAuB,GAAG,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC;AAC9E;AAEA,SAAS,oBAAoB,KAA6C;AACxE,MAAI,SAAkC,CAAC;AACvC,MAAI,OAAO,QAAQ,YAAY,IAAI,KAAK,MAAM,IAAI;AAChD,QAAI;AACF,YAAM,SAAkB,KAAK,MAAM,GAAG;AACtC,UAAI,UAAU,OAAO,WAAW,YAAY,CAAC,MAAM,QAAQ,MAAM;AAC/D,iBAAS;AAAA,IACb,QAAQ;AAAA,IAER;AAAA,EACF;AACA,QAAM,MAA+B,CAAC;AACtC,aAAW,CAAC,KAAK,KAAK,KAAK,uBAAwB,KAAI,KAAK,IAAI,QAAQ,OAAO,GAAG,CAAC;AACnF,SAAO;AACT;AASA,SAAS,gBACP,GACA,iBACW;AACX,QAAM,IAAI,EAAE;AACZ,QAAM,IAAI,EAAE;AACZ,QAAM,IAAI,EAAE;AACZ,QAAM,MAAM,EAAE;AACd,QAAM,aACJ,OAAO,MAAM,YACb,OAAO,MAAM,YACb,OAAO,MAAM,YACb,OAAO,QAAQ,WACX,EAAE,aAAa,GAAG,eAAe,GAAG,eAAe,GAAG,IAAI,IAC1D;AACN,SAAO;AAAA,IACL,IAAI,EAAE;AAAA,IACN,UAAU,EAAE,aAAa;AAAA,IACzB,QAAQ,EAAE,WAAW;AAAA,IACrB,YAAY,aAAa,EAAE,eAAe,MAAS;AAAA,IACnD,QAAQ,EAAE;AAAA,IACV,aAAa,EAAE;AAAA,IACf,WAAW,EAAE;AAAA,IACb,aAAa,EAAE;AAAA,IACf;AAAA,IACA,gBAAgB,EAAE;AAAA,IAClB,iBAAiB,EAAE;AAAA,IACnB,kBAAkB,KAAK,EAAE,kBAAkB;AAAA,IAC3C,gBAAgB,EAAE;AAAA,IAClB,gBAAgB,EAAE;AAAA,IAClB,YAAY,EAAE;AAAA,IACd,iBAAiB,EAAE;AAAA,IACnB,YAAY,EAAE,gBAAgB;AAAA,IAC9B,gBAAgB,EAAE,qBAAqB;AAAA,IACvC,QAAQ,EAAE;AAAA,IACV,YAAY,EAAE;AAAA,IACd,YAAY,EAAE;AAAA,IACd,gBAAiB,EAAE,mBAAmB;AAAA;AAAA;AAAA;AAAA,IAItC,wBAAwB,kBACpB,EAAE,KAAK,gBAAgB,EAAE,EAAE,YAAY,UAAU,GAAG,EAAE,aAAa,EAAE,EAAE,QAAQ,IAC/E;AAAA,IACJ,iBAAiB,EAAE;AAAA,IACnB,WAAW,oBAAoB,EAAE,SAAS;AAAA,IAC1C,cAAc,kBAAkB,EAAE,uBAAuB;AAAA,IACzD,cAAc,EAAE,kBAAkB;AAAA,IAClC,gBAAgB,EAAE;AAAA,IAClB,YAAY,EAAE;AAAA,IACd,YAAY,EAAE;AAAA,EAChB;AACF;AAQO,IAAM,sBAAsB;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAIA,IAAM,oBAAoB,iCAAyC,GAAG,mBAAmB;AAIzF,eAAsB,eAAe,IAA8B;AACjE,QAAM,OAAO,MAAM,GAChB,WAAW,SAAS,EACpB,OAAO,mBAAmB,EAC1B,OAAO,iBAAiB,EACxB,QAAQ,gBAAgB,MAAM,EAC9B,QAAQ,IAAI,EACZ,QAAQ;AACX,SAAO,KAAK,IAAI,CAAC,MAAM,gBAAgB,GAAG,EAAE,sBAAsB,CAAC,CAAC;AACtE;AAKA,eAAsB,mBAAmB,IAAQ,QAAsC;AACrF,QAAM,OAAO,MAAM,GAChB,WAAW,SAAS,EACpB,OAAO,mBAAmB,EAC1B,OAAO,iBAAiB,EACxB,MAAM,WAAW,KAAK,MAAM,EAC5B,QAAQ,gBAAgB,MAAM,EAC9B,QAAQ,IAAI,EACZ,QAAQ;AACX,SAAO,KAAK,IAAI,CAAC,MAAM,gBAAgB,GAAG,EAAE,sBAAsB,CAAC,CAAC;AACtE;AAsDA,eAAsB,kBACpB,IACA,UACA,OACe;AACf,MAAI,OAAO,KAAK,KAAK,EAAE,WAAW,EAAG;AACrC,QAAM,GAAG,YAAY,SAAS,EAAE,IAAI,KAAK,EAAE,MAAM,MAAM,KAAK,QAAQ,EAAE,QAAQ;AAChF;AAgBA,eAAsB,mBAAmB,IAAQ,KAA+B;AAC9E,QAAM,MAAM,gBAAgB,KAAK,IAAI;AACrC,QAAM,EAAE,eAAe,KAAK,GAAG,YAAY,IAAI;AAC/C,OAAK;AACL,QAAM,GACH,WAAW,SAAS,EACpB,OAAO,GAAG,EACV,WAAW,CAAC,OAAO,GAAG,OAAO,IAAI,EAAE,YAAY,WAAW,CAAC,EAC3D,QAAQ;AACb;AAcA,eAAsB,kBAAkB,IAAQ,UAAkB,MAA6B;AAC7F,QAAM,GAAG,YAAY,SAAS,EAAE,IAAI,EAAE,eAAe,KAAK,CAAC,EAAE,MAAM,MAAM,KAAK,QAAQ,EAAE,QAAQ;AAClG;AAGA,eAAsB,cAAc,IAAQ,IAAuC;AACjF,QAAM,IAAI,MAAM,GAAG,WAAW,SAAS,EAAE,UAAU,EAAE,MAAM,MAAM,KAAK,EAAE,EAAE,iBAAiB;AAC3F,SAAO,IAAI,gBAAgB,GAAG,EAAE,kBAAkB,IAAI,IAAI;AAC5D;AAIA,eAAsB,cACpB,IACA,IAC2D;AAC3D,QAAM,IAAI,MAAM,GACb,WAAW,SAAS,EACpB,OAAO,CAAC,iBAAiB,WAAW,CAAC,EACrC,MAAM,MAAM,KAAK,EAAE,EACnB,iBAAiB;AACpB,MAAI,CAAC,KAAK,EAAE,kBAAkB,KAAM,QAAO;AAC3C,SAAO,EAAE,MAAM,EAAE,eAAe,UAAU,EAAE,UAAU;AACxD;","names":[]}

package/dist/{chunk-6UCVWYDA.js → chunk-QLIUDTY6.js}

@@ -1,10 +1,10 @@
-import {
-  TURSO_IS_AUTHORITATIVE
-} from "./chunk-RUPPWAD6.js";
 import {
   hasRealScores,
   lighthouseScoresFromResult
 } from "./chunk-7BZUOZPU.js";
+import {
+  TURSO_IS_AUTHORITATIVE
+} from "./chunk-SVAAONYB.js";
 import {
   detectAuditEvents
 } from "./chunk-5L3FPQIJ.js";
@@ -343,4 +343,4 @@ export {
   formatFleetWriteSummary,
   writeFleetAuditsToAirtable
 };
-//# sourceMappingURL=chunk-6UCVWYDA.js.map
+//# sourceMappingURL=chunk-QLIUDTY6.js.map

package/dist/{chunk-XP5WM2LV.js → chunk-SKI23ZZH.js}

@@ -1,15 +1,15 @@
 import {
   defaultReportSubject
 } from "./chunk-GECESMVS.js";
-import {
-  applyReportTypeHeadline
-} from "./chunk-5UINJNAJ.js";
 import {
   announcementSiteExtras,
   loadBundledImages,
   renderReportHtml,
   resolveCopy
 } from "./chunk-KJGKZLCT.js";
+import {
+  applyReportTypeHeadline
+} from "./chunk-5UINJNAJ.js";
 import {
   siteSlug
 } from "./chunk-7NYN2P6I.js";
@@ -143,4 +143,4 @@ export {
   renderReportFromRow,
   windowDays
 };
-//# sourceMappingURL=chunk-XP5WM2LV.js.map
+//# sourceMappingURL=chunk-SKI23ZZH.js.map

package/dist/chunk-SVAAONYB.js

@@ -0,0 +1,21 @@
+// src/db/freeze.ts
+var TURSO_IS_AUTHORITATIVE = true;
+async function mirrorWrite(label, run, strict = TURSO_IS_AUTHORITATIVE) {
+  try {
+    await run();
+  } catch (err) {
+    if (strict) {
+      throw new Error(
+        `[${label}] Turso mirror failed and Turso is authoritative \u2014 the write is NOT recoverable by the hourly sync: ${String(err)}`,
+        { cause: err }
+      );
+    }
+    console.error(`[${label}] Turso mirror failed (sync will converge it): ${String(err)}`);
+  }
+}
+
+export {
+  TURSO_IS_AUTHORITATIVE,
+  mirrorWrite
+};
+//# sourceMappingURL=chunk-SVAAONYB.js.map

package/dist/chunk-SVAAONYB.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/db/freeze.ts"],"sourcesContent":["/** #612 (#539 Phase 5): the one switch that says which store is allowed to fail.\n *\n *  ## Why a switch exists at all\n *\n *  Through Phase 5 the mirrors are best-effort by design: Airtable is\n *  authoritative, so a Turso write that fails is caught, logged and swallowed,\n *  and the hourly `fleet-db-sync` import converges whatever it missed. That is\n *  correct — right up until the freeze stops the import.\n *\n *  After that, nothing converges anything. The same swallowed failure becomes\n *  permanent data loss announced only by a log line nobody is grepping. Three\n *  outcomes change meaning at the flip:\n *\n *  | outcome           | before the freeze              | after                        |\n *  |-------------------|--------------------------------|------------------------------|\n *  | `mirrored=0`      | the sync will fix it           | that write is gone           |\n *  | `mirrored=missed` | the site isn't imported yet    | impossible, therefore a bug  |\n *  | `mirrored=absent` | no creds; Airtable still has it| every write was discarded    |\n *\n *  So the freeze is not a config change. It is: invert which store is allowed\n *  to fail.\n *\n *  ## Why a code constant rather than an env var\n *\n *  The same built artifact runs in Netlify functions and in Actions runners. An\n *  env var could be set in one and missed in the other, giving a PARTIAL freeze\n *  — half the fleet treating Turso as authoritative and half not — which is a\n *  worse state than either end. A constant is uniform by construction, and\n *  flipping it is a one-line pull request with a diff a reviewer can see.\n *\n *  This is the same shape the site-status vocabulary migration used: code\n *  handles both worlds, then one reviewed commit flips the switch.\n *\n *  ## Reading this correctly\n *\n *  Consumers take it as a DEFAULT parameter rather than reading it inline, so\n *  tests can exercise both sides as fixtures. Exactly one test asserts the\n *  shipped value; every behavioural test injects. A suite that only ever read\n *  the shipped constant would prove nothing about the state it is not in.\n */\n\n/** `true` since the freeze (flipped 2026-08-31, the same PR that retired the\n *  hourly `fleet-db-sync` import — the two must move together, and did): Turso\n *  is the store that must succeed. The Airtable write is kept as the shadow for\n *  the one-week rollback window — still written, and DELIBERATELY still allowed\n *  to fail its caller: a shadow you might roll back to is one you keep\n *  trustworthy, so an Airtable outage still reds writes until Phase 6 deletes\n *  the shadow and the Airtable client layer with it.\n *\n *  Go/no-go recorded on #612: `FLEET_PARITY sites=44 health=44 schedule=44\n *  reports=17 mismatches=0` immediately before the flip. */\nexport const TURSO_IS_AUTHORITATIVE = true;\n\n/**\n * Run one Turso mirror write with the error semantics the current world calls\n * for: swallowed while Airtable is authoritative, fatal once Turso is.\n *\n * The mirror FACTORIES (`makeSiteMirror`, `makeReportMirror`, the health mirrors)\n * already do this internally. The Netlify request handlers do not use those\n * factories — `approve-report`, `report-commentary`, `resend-webhook` and\n * `site-details` each call `mirrorReportPatch` / `mirrorSiteField` directly,\n * wrapped in a hand-rolled `try { … } catch { console.error }`. Four independent\n * copies of the swallow, none of which consulted the switch, each carrying a\n * comment saying \"the sync converges it\".\n *\n * **That comment stops being true at the freeze.** With the hourly import\n * stopped, a swallowed mirror failure on an approve, a commentary edit, a\n * delivery-status webhook or a site-detail edit is permanent data loss whose only\n * trace is a log line nobody greps — and the Airtable write it shadows will have\n * already succeeded, so the two stores diverge silently.\n *\n * Under `strict` the failure is raised instead. The caller's own error handling\n * decides what that means for the response; what it must not mean is \"logged and\n * forgotten\". `strict` is a parameter with the constant as its default so tests\n * exercise both worlds as fixtures rather than only the shipped one.\n */\nexport async function mirrorWrite(\n  label: string,\n  run: () => Promise<void>,\n  strict: boolean = TURSO_IS_AUTHORITATIVE,\n): Promise<void> {\n  try {\n    await run();\n  } catch (err) {\n    if (strict) {\n      throw new Error(\n        `[${label}] Turso mirror failed and Turso is authoritative — ` +\n          `the write is NOT recoverable by the hourly sync: ${String(err)}`,\n        { cause: err },\n      );\n    }\n    console.error(`[${label}] Turso mirror failed (sync will converge it): ${String(err)}`);\n  }\n}\n"],"mappings":";AAmDO,IAAM,yBAAyB;AAyBtC,eAAsB,YACpB,OACA,KACA,SAAkB,wBACH;AACf,MAAI;AACF,UAAM,IAAI;AAAA,EACZ,SAAS,KAAK;AACZ,QAAI,QAAQ;AACV,YAAM,IAAI;AAAA,QACR,IAAI,KAAK,4GAC6C,OAAO,GAAG,CAAC;AAAA,QACjE,EAAE,OAAO,IAAI;AAAA,MACf;AAAA,IACF;AACA,YAAQ,MAAM,IAAI,KAAK,kDAAkD,OAAO,GAAG,CAAC,EAAE;AAAA,EACxF;AACF;","names":[]}

package/dist/{chunk-DGZWFI2G.js → chunk-VBEKL445.js}

@@ -17,7 +17,7 @@ import {
 import {
   renderReportFromRow,
   requireLighthouse
-} from "./chunk-XP5WM2LV.js";
+} from "./chunk-SKI23ZZH.js";
 import {
   listWebsites,
   updateLaunched
@@ -66,8 +66,14 @@ async function sendApprovedReports(options = {}) {
       continue;
     }
     try {
-      const messageId = await sendOne(client, base, site, report);
-      lines.push(`\u2713 sent: ${report.reportId} (${messageId})`);
+      const sent = await sendOne(client, base, site, report);
+      lines.push(`\u2713 sent: ${report.reportId} (${sent.display})`);
+      try {
+        await options.reportSentMirror?.(report.id, sent.sentAt, sent.messageId);
+      } catch (e) {
+        lines.push(`  \u2717 sent-stamp mirror failed for ${report.reportId}: ${e.message}`);
+        anyFailed = true;
+      }
       if (report.sendOverride) {
         const failing = gatingHealth({
           reportType: report.reportType,
@@ -109,6 +115,7 @@ async function sendApprovedReports(options = {}) {
           );
         } catch (e) {
           lines.push(`  \u26A0 launch flip failed for ${site.name}: ${e.message}`);
+          anyFailed = true;
         }
       }
     } catch (e) {
@@ -177,14 +184,16 @@ async function sendOne(client, base, site, report) {
     result = await client.send(payload);
   } catch (err) {
     if (isIdempotencyConflict(err)) {
-      await stampSent(base, report.id, /* @__PURE__ */ new Date(), null);
+      const when2 = /* @__PURE__ */ new Date();
+      await stampSent(base, report.id, when2, null);
       console.log(`\u21BB already sent (idempotency conflict), stamped: ${report.reportId}`);
-      return "idempotent-conflict";
+      return { display: "idempotent-conflict", sentAt: when2, messageId: null };
     }
     throw err;
   }
-  await stampSent(base, report.id, /* @__PURE__ */ new Date(), result.messageId);
-  return result.messageId;
+  const when = /* @__PURE__ */ new Date();
+  await stampSent(base, report.id, when, result.messageId);
+  return { display: result.messageId, sentAt: when, messageId: result.messageId };
 }
 function parseAddresses(field) {
   if (!field) return null;
@@ -218,4 +227,4 @@ export {
   parseAddresses,
   isProbablyEmail
 };
-//# sourceMappingURL=chunk-DGZWFI2G.js.map
+//# sourceMappingURL=chunk-VBEKL445.js.map

package/dist/chunk-VBEKL445.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/reports/send/idempotency.ts","../src/reports/send/orchestrate.ts"],"sourcesContent":["/**\n * True when a thrown send error is Resend's same-key + DIFFERENT-body 409\n * (`invalid_idempotent_request`). The ResendClient (send/resend.ts) discards the\n * status/name and only surfaces the message string, so we match defensively on the\n * stable message substring \"idempotency key has been used\" (case-insensitive); a\n * `name`/`statusCode` of 409/`invalid_idempotent_request` is also accepted if a\n * future client happens to preserve it. A same-key + SAME-body re-send is deduped\n * by Resend (returns the original id) and never reaches here.\n *\n * Shared by both send surfaces that key into Resend's idempotency window:\n * `runDigest` (digest.ts, `digest-<date>` key) and `sendOne` (orchestrate.ts,\n * `report:<id>` key). Both treat a 409 as \"the email already went out under this\n * key on a prior run\" — a no-op for the digest, an already-done success for sendOne.\n */\nexport function isIdempotencyConflict(err: unknown): boolean {\n  const message = err instanceof Error ? err.message : String(err);\n  if (/idempotency key has been used/i.test(message)) return true;\n  const e = err as { name?: unknown; statusCode?: unknown };\n  if (e.name === \"invalid_idempotent_request\") return true;\n  if (e.statusCode === 409) return true;\n  return false;\n}\n","import { openBase, readAirtableConfig } from \"../airtable/client.js\";\nimport { listSendableReports, stampSent } from \"../airtable/reports.js\";\nimport { listWebsites, updateLaunched } from \"../airtable/websites.js\";\nimport type { WebsiteRow } from \"../airtable/websites.js\";\nimport type { ReportRow } from \"../airtable/reports.js\";\nimport { fetchAttachmentBytes } from \"../airtable/attachments.js\";\nimport { renderReportFromRow, requireLighthouse } from \"./render-from-row.js\";\nimport { defaultResendClient, type ResendClient } from \"./resend.js\";\nimport { isIdempotencyConflict } from \"./idempotency.js\";\nimport { gatingHealth, isHealthGateClear, isSendOverridden } from \"../checklist.js\";\nimport { recordFleetEventsBestEffort } from \"../../audits/fleet-events-writer.js\";\nimport type { SiteMirror } from \"../../db/site-mirror.js\";\n\nconst FROM_ADDRESS = \"Reddoor Reports <reports@reddoorla.com>\";\nconst REPLY_TO = \"info@reddoorla.com\";\n\n/** Operations inbox CC'd on every outgoing report so there's always an internal\n *  copy on file alongside the client recipients. */\nexport const GLOBAL_REPORT_CC = \"info@reddoorla.com\";\n\n/**\n * Append {@link GLOBAL_REPORT_CC} to a site's per-site CC list. The per-site CC is\n * passed through unchanged (preserving prior behavior); the global address is added\n * only when it isn't already present in the CC or To lists (case-insensitive), so a\n * report is never double-addressed to the ops inbox. Returns the final CC list (may\n * be empty if the global address is already the sole To recipient — the caller omits\n * an empty CC).\n */\nexport function withGlobalCc(perSiteCc: string[] | null, to: string[]): string[] {\n  const cc = [...(perSiteCc ?? [])];\n  const present = new Set([...cc, ...to].map((a) => a.toLowerCase()));\n  if (!present.has(GLOBAL_REPORT_CC.toLowerCase())) cc.push(GLOBAL_REPORT_CC);\n  return cc;\n}\n\nexport type OrchestrateOptions = {\n  resend?: ResendClient;\n  /** #539 Phase 5: Turso write-through for the Websites row a Launch send\n   *  updates. Injected rather than defaulted — this function is called directly\n   *  by tests, and a default would open a real libSQL handle inside the suite. */\n  siteMirror?: SiteMirror;\n  /** #643 (the freeze): Turso write-through for the `Sent at` / `Resend message\n   *  ID` stamp. stampSent is what removes a row from listSendableReports, so\n   *  once it lands there is no replay left to converge a lost mirror — and the\n   *  console's already-sent guards (approve, the commentary lock, re-render)\n   *  read `sent_at` from Turso. Injected like siteMirror; the CLI wires it\n   *  through `mirrorWrite` so the freeze switch owns the error semantics. */\n  reportSentMirror?: (reportId: string, sentAt: Date, messageId: string | null) => Promise<void>;\n};\n\nexport async function sendApprovedReports(\n  options: OrchestrateOptions = {},\n): Promise<{ output: string; code: number }> {\n  const base = openBase(readAirtableConfig());\n  const client = options.resend ?? defaultResendClient();\n\n  const sendable = await listSendableReports(base);\n  if (sendable.length === 0) return { output: \"No reports ready to send.\", code: 0 };\n\n  const websites = await listWebsites(base);\n  const sites = new Map(websites.map((w) => [w.id, w]));\n\n  const lines: string[] = [];\n  let anyFailed = false;\n  for (const report of sendable) {\n    const site = sites.get(report.siteId);\n    if (!site) {\n      lines.push(`✗ ${report.reportId} — Site row not found for id=${report.siteId}`);\n      anyFailed = true;\n      continue;\n    }\n    try {\n      const sent = await sendOne(client, base, site, report);\n      lines.push(`✓ sent: ${report.reportId} (${sent.display})`);\n      // Mirror the stamp into Turso. Caught here rather than thrown so one\n      // report's lost mirror still lets the batch continue AND still runs this\n      // report's Launch flip below — but it reds the run (`anyFailed`), because\n      // post-freeze nothing converges the miss; `db sync --force` is the manual\n      // converge during the rollback window.\n      try {\n        await options.reportSentMirror?.(report.id, sent.sentAt, sent.messageId);\n      } catch (e) {\n        lines.push(`  ✗ sent-stamp mirror failed for ${report.reportId}: ${(e as Error).message}`);\n        anyFailed = true;\n      }\n      if (report.sendOverride) {\n        const failing = gatingHealth({\n          reportType: report.reportType,\n          autoEvidence: report.autoEvidence ?? {},\n        })\n          .filter((h) => h.status !== \"pass\" && h.status !== \"n/a\")\n          .map((h) => h.field);\n        await recordFleetEventsBestEffort(\n          [\n            {\n              id: `report_sent_with_override:${report.id}`,\n              ts: new Date().toISOString(),\n              type: \"report_sent_with_override\",\n              siteId: site.id,\n              siteName: site.name,\n              summary: `sent with override — ${report.overrideReason ?? \"\"}`,\n              data: { reportId: report.reportId, reason: report.overrideReason, failing },\n            },\n          ],\n          new Date(),\n        );\n      }\n      if (report.reportType === \"Launch\") {\n        try {\n          const fields = await updateLaunched(base, site.id, new Date().toISOString());\n          // Status and `Launched at` travel together — mirroring them as two\n          // updates would open a window where Turso says a site is maintained\n          // but never launched.\n          await options.siteMirror?.site(site.id, fields);\n          lines.push(`  ↳ launched: ${site.name} flipped to maintained`);\n          await recordFleetEventsBestEffort(\n            [\n              {\n                id: `site_launched:${site.id}`,\n                ts: new Date().toISOString(),\n                type: \"site_launched\",\n                siteId: site.id,\n                siteName: site.name,\n                summary: \"launched — now in maintenance\",\n                data: null,\n              },\n            ],\n            new Date(),\n          );\n        } catch (e) {\n          // Post-freeze a swallowed flip failure is permanent divergence: Turso\n          // — the store lead routing reads — would keep the site in\n          // launch-period forever (its leads go operator-only). Red the run\n          // instead of shrugging; the email itself already went out.\n          lines.push(`  ⚠ launch flip failed for ${site.name}: ${(e as Error).message}`);\n          anyFailed = true;\n        }\n      }\n    } catch (e) {\n      lines.push(`✗ ${report.reportId} — ${(e as Error).message}`);\n      anyFailed = true;\n    }\n  }\n  return { output: lines.join(\"\\n\"), code: anyFailed ? 1 : 0 };\n}\n\n/** What the caller needs to mirror the stamp: the exact values stampSent wrote\n *  (`messageId` null on the 409 path, where Airtable's field is left untouched\n *  too), plus the display string for the ✓ line. */\ntype SentStamp = { display: string; sentAt: Date; messageId: string | null };\n\nasync function sendOne(\n  client: ResendClient,\n  base: ReturnType<typeof openBase>,\n  site: WebsiteRow,\n  report: ReportRow,\n): Promise<SentStamp> {\n  // Hard health gate: a Maintenance/Testing report whose gating evidence isn't all pass/n/a must\n  // never go out — even if \"Approved to send\" was set directly in Airtable. Throw so the row is\n  // skipped and `Sent at` stays null (at-least-once retry preserved). Launch/Announcement have no\n  // gating fields → vacuously clear. A logged send-anyway override (Phase 10) bypasses the gate.\n  const gateReport = { reportType: report.reportType, autoEvidence: report.autoEvidence ?? {} };\n  if (!isHealthGateClear(gateReport) && !isSendOverridden(report)) {\n    const failing = gatingHealth(gateReport)\n      .filter((h) => h.status !== \"pass\" && h.status !== \"n/a\")\n      .map((h) => {\n        const note = report.autoEvidence?.[h.field]?.note;\n        return `${h.field} (${h.status}${note ? `: ${note}` : \"\"})`;\n      })\n      .join(\"; \");\n    throw new Error(`Report ${report.reportId} health gate not clear — ${failing}`);\n  }\n  if (!site.headerImage) {\n    throw new Error(`Site '${site.name}' has no Header image set on the Websites row`);\n  }\n  // Fail fast, before the header fetch and the sharp downscale. Same rule and\n  // same message the renderer enforces — shared, not restated.\n  requireLighthouse(report);\n\n  // Resolve + validate recipients BEFORE the expensive work (header fetch + sharp\n  // downscale + full MJML render). A misconfigured-recipients site is a guaranteed\n  // failure, so fail fast here rather than after burning that work. Same checks +\n  // messages as before — only the position moved.\n  const explicitTo = parseAddresses(site.reportRecipientsTo);\n  // Run pointOfContact through the parser too — operators sometimes paste\n  // \"a@x, b@y\" into that single-line field.\n  const fallbackTo = parseAddresses(site.pointOfContact);\n  const to = explicitTo ?? fallbackTo ?? [];\n  if (to.length === 0) {\n    throw new Error(\n      `Site '${site.name}' has no recipients (Report recipients (To) AND point of contact are both empty)`,\n    );\n  }\n  for (const addr of to) {\n    if (!isProbablyEmail(addr)) {\n      throw new Error(\n        `Site '${site.name}' recipient is malformed: ${addr} — use a bare address only ` +\n          `(no \\`Name <addr>\\` display-name syntax); fix Report recipients (To) or point of contact in Airtable`,\n      );\n    }\n  }\n  const cc = parseAddresses(site.reportRecipientsCc);\n  if (cc) {\n    for (const addr of cc) {\n      if (!isProbablyEmail(addr)) {\n        throw new Error(\n          `Site '${site.name}' CC is malformed: ${addr} — fix Report recipients (CC) in Airtable`,\n        );\n      }\n    }\n  }\n\n  const original = await fetchAttachmentBytes(site.headerImage.url);\n  // ONE render path, shared with the console's on-demand re-render — so a\n  // preview cannot drift from what the client actually receives. The assembly\n  // that used to live here moved into renderReportFromRow unchanged.\n  const { html, attachments, subject } = await renderReportFromRow(site, report, original.bytes);\n\n  const payload: Parameters<ResendClient[\"send\"]>[0] = {\n    from: FROM_ADDRESS,\n    to,\n    replyTo: REPLY_TO,\n    subject,\n    html,\n    attachments,\n    // Stable across retries of the same row — if Airtable stamping fails after a\n    // successful Resend, the next --send-ready replays with the same key and\n    // Resend returns the original message id rather than sending a duplicate.\n    idempotencyKey: `report:${report.id}`,\n  };\n  // Always CC the ops inbox (info@reddoorla.com), in addition to any per-site CC.\n  const finalCc = withGlobalCc(cc, to);\n  if (finalCc.length > 0) payload.cc = finalCc;\n\n  let result: Awaited<ReturnType<ResendClient[\"send\"]>>;\n  try {\n    result = await client.send(payload);\n  } catch (err) {\n    // The send path is at-least-once: client.send succeeds → stampSent writes\n    // `Sent at` (the ONLY thing that removes the row from listSendableReports). If\n    // stampSent threw on a PRIOR run (an Airtable blip), `Sent at` stayed null and\n    // the row replays here. By replay time the rendered body has usually changed\n    // (operator Commentary edit, `report --due` rewrote scores, or the header\n    // re-encodes non-deterministically), so Resend rejects the same-key\n    // (`report:<id>`) / different-body re-send with a 409 (`invalid_idempotent_request`).\n    //\n    // That 409 means the email ALREADY WENT OUT under this key on the prior run.\n    // Do NOT re-throw and do NOT re-send (re-throwing leaves the row unstamped, and\n    // after the 24h key TTL a SECOND real email would go out). Instead stamp the row\n    // so it stops replaying, then return success so the caller runs the Launch flip —\n    // which self-heals a launch that sent-but-never-flipped on the prior run.\n    //\n    // Any OTHER error (real network/Resend failure) re-throws, exactly as before, so\n    // a genuine failure still fails loudly and the row replays next run.\n    if (isIdempotencyConflict(err)) {\n      // Stamp `Sent at` ONLY — the original send's messageId is unrecoverable on\n      // the 409 path, so we leave `Resend message ID` null rather than writing a\n      // sentinel that would masquerade as a real id and orphan webhook lookups.\n      // Still return the sentinel string so the caller logs the already-sent path\n      // and runs the Launch flip.\n      const when = new Date();\n      await stampSent(base, report.id, when, null);\n      console.log(`↻ already sent (idempotency conflict), stamped: ${report.reportId}`);\n      return { display: \"idempotent-conflict\", sentAt: when, messageId: null };\n    }\n    throw err;\n  }\n  const when = new Date();\n  await stampSent(base, report.id, when, result.messageId);\n  return { display: result.messageId, sentAt: when, messageId: result.messageId };\n}\n\n/**\n * Split a comma/newline-separated address field into a clean array.\n * Lowercases (case-insensitive dedupe) and removes empty entries. Returns\n * null if nothing survives. Does NOT understand `Display Name <email>` —\n * operators should put a bare address in the Airtable field, or use multiple\n * lines if needing multiple recipients.\n */\nexport function parseAddresses(field: string | null): string[] | null {\n  if (!field) return null;\n  const seen = new Set<string>();\n  const list: string[] = [];\n  for (const raw of field.split(/[,\\n]/)) {\n    const trimmed = raw.trim().toLowerCase();\n    if (!trimmed) continue;\n    if (seen.has(trimmed)) continue;\n    seen.add(trimmed);\n    list.push(trimmed);\n  }\n  return list.length > 0 ? list : null;\n}\n\n/**\n * Cheap email shape check — must contain exactly one @, with non-empty\n * local and domain parts and at least one dot in the domain. We're not\n * trying to be a full RFC validator; we're trying to catch operator\n * mistakes like \"ops at acme dot com\" or a missing @ before they 422\n * at Resend.\n */\nexport function isProbablyEmail(s: string): boolean {\n  const at = s.indexOf(\"@\");\n  if (at < 1 || at !== s.lastIndexOf(\"@\")) return false;\n  const local = s.slice(0, at);\n  const domain = s.slice(at + 1);\n  if (!local || !domain) return false;\n  if (!domain.includes(\".\")) return false;\n  if (/\\s/.test(s)) return false;\n  return true;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAcO,SAAS,sBAAsB,KAAuB;AAC3D,QAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,MAAI,iCAAiC,KAAK,OAAO,EAAG,QAAO;AAC3D,QAAM,IAAI;AACV,MAAI,EAAE,SAAS,6BAA8B,QAAO;AACpD,MAAI,EAAE,eAAe,IAAK,QAAO;AACjC,SAAO;AACT;;;ACRA,IAAM,eAAe;AACrB,IAAM,WAAW;AAIV,IAAM,mBAAmB;AAUzB,SAAS,aAAa,WAA4B,IAAwB;AAC/E,QAAM,KAAK,CAAC,GAAI,aAAa,CAAC,CAAE;AAChC,QAAM,UAAU,IAAI,IAAI,CAAC,GAAG,IAAI,GAAG,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;AAClE,MAAI,CAAC,QAAQ,IAAI,iBAAiB,YAAY,CAAC,EAAG,IAAG,KAAK,gBAAgB;AAC1E,SAAO;AACT;AAiBA,eAAsB,oBACpB,UAA8B,CAAC,GACY;AAC3C,QAAM,OAAO,SAAS,mBAAmB,CAAC;AAC1C,QAAM,SAAS,QAAQ,UAAU,oBAAoB;AAErD,QAAM,WAAW,MAAM,oBAAoB,IAAI;AAC/C,MAAI,SAAS,WAAW,EAAG,QAAO,EAAE,QAAQ,6BAA6B,MAAM,EAAE;AAEjF,QAAM,WAAW,MAAM,aAAa,IAAI;AACxC,QAAM,QAAQ,IAAI,IAAI,SAAS,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AAEpD,QAAM,QAAkB,CAAC;AACzB,MAAI,YAAY;AAChB,aAAW,UAAU,UAAU;AAC7B,UAAM,OAAO,MAAM,IAAI,OAAO,MAAM;AACpC,QAAI,CAAC,MAAM;AACT,YAAM,KAAK,UAAK,OAAO,QAAQ,qCAAgC,OAAO,MAAM,EAAE;AAC9E,kBAAY;AACZ;AAAA,IACF;AACA,QAAI;AACF,YAAM,OAAO,MAAM,QAAQ,QAAQ,MAAM,MAAM,MAAM;AACrD,YAAM,KAAK,gBAAW,OAAO,QAAQ,KAAK,KAAK,OAAO,GAAG;AAMzD,UAAI;AACF,cAAM,QAAQ,mBAAmB,OAAO,IAAI,KAAK,QAAQ,KAAK,SAAS;AAAA,MACzE,SAAS,GAAG;AACV,cAAM,KAAK,yCAAoC,OAAO,QAAQ,KAAM,EAAY,OAAO,EAAE;AACzF,oBAAY;AAAA,MACd;AACA,UAAI,OAAO,cAAc;AACvB,cAAM,UAAU,aAAa;AAAA,UAC3B,YAAY,OAAO;AAAA,UACnB,cAAc,OAAO,gBAAgB,CAAC;AAAA,QACxC,CAAC,EACE,OAAO,CAAC,MAAM,EAAE,WAAW,UAAU,EAAE,WAAW,KAAK,EACvD,IAAI,CAAC,MAAM,EAAE,KAAK;AACrB,cAAM;AAAA,UACJ;AAAA,YACE;AAAA,cACE,IAAI,6BAA6B,OAAO,EAAE;AAAA,cAC1C,KAAI,oBAAI,KAAK,GAAE,YAAY;AAAA,cAC3B,MAAM;AAAA,cACN,QAAQ,KAAK;AAAA,cACb,UAAU,KAAK;AAAA,cACf,SAAS,6BAAwB,OAAO,kBAAkB,EAAE;AAAA,cAC5D,MAAM,EAAE,UAAU,OAAO,UAAU,QAAQ,OAAO,gBAAgB,QAAQ;AAAA,YAC5E;AAAA,UACF;AAAA,UACA,oBAAI,KAAK;AAAA,QACX;AAAA,MACF;AACA,UAAI,OAAO,eAAe,UAAU;AAClC,YAAI;AACF,gBAAM,SAAS,MAAM,eAAe,MAAM,KAAK,KAAI,oBAAI,KAAK,GAAE,YAAY,CAAC;AAI3E,gBAAM,QAAQ,YAAY,KAAK,KAAK,IAAI,MAAM;AAC9C,gBAAM,KAAK,sBAAiB,KAAK,IAAI,wBAAwB;AAC7D,gBAAM;AAAA,YACJ;AAAA,cACE;AAAA,gBACE,IAAI,iBAAiB,KAAK,EAAE;AAAA,gBAC5B,KAAI,oBAAI,KAAK,GAAE,YAAY;AAAA,gBAC3B,MAAM;AAAA,gBACN,QAAQ,KAAK;AAAA,gBACb,UAAU,KAAK;AAAA,gBACf,SAAS;AAAA,gBACT,MAAM;AAAA,cACR;AAAA,YACF;AAAA,YACA,oBAAI,KAAK;AAAA,UACX;AAAA,QACF,SAAS,GAAG;AAKV,gBAAM,KAAK,mCAA8B,KAAK,IAAI,KAAM,EAAY,OAAO,EAAE;AAC7E,sBAAY;AAAA,QACd;AAAA,MACF;AAAA,IACF,SAAS,GAAG;AACV,YAAM,KAAK,UAAK,OAAO,QAAQ,WAAO,EAAY,OAAO,EAAE;AAC3D,kBAAY;AAAA,IACd;AAAA,EACF;AACA,SAAO,EAAE,QAAQ,MAAM,KAAK,IAAI,GAAG,MAAM,YAAY,IAAI,EAAE;AAC7D;AAOA,eAAe,QACb,QACA,MACA,MACA,QACoB;AAKpB,QAAM,aAAa,EAAE,YAAY,OAAO,YAAY,cAAc,OAAO,gBAAgB,CAAC,EAAE;AAC5F,MAAI,CAAC,kBAAkB,UAAU,KAAK,CAAC,iBAAiB,MAAM,GAAG;AAC/D,UAAM,UAAU,aAAa,UAAU,EACpC,OAAO,CAAC,MAAM,EAAE,WAAW,UAAU,EAAE,WAAW,KAAK,EACvD,IAAI,CAAC,MAAM;AACV,YAAM,OAAO,OAAO,eAAe,EAAE,KAAK,GAAG;AAC7C,aAAO,GAAG,EAAE,KAAK,KAAK,EAAE,MAAM,GAAG,OAAO,KAAK,IAAI,KAAK,EAAE;AAAA,IAC1D,CAAC,EACA,KAAK,IAAI;AACZ,UAAM,IAAI,MAAM,UAAU,OAAO,QAAQ,iCAA4B,OAAO,EAAE;AAAA,EAChF;AACA,MAAI,CAAC,KAAK,aAAa;AACrB,UAAM,IAAI,MAAM,SAAS,KAAK,IAAI,+CAA+C;AAAA,EACnF;AAGA,oBAAkB,MAAM;AAMxB,QAAM,aAAa,eAAe,KAAK,kBAAkB;AAGzD,QAAM,aAAa,eAAe,KAAK,cAAc;AACrD,QAAM,KAAK,cAAc,cAAc,CAAC;AACxC,MAAI,GAAG,WAAW,GAAG;AACnB,UAAM,IAAI;AAAA,MACR,SAAS,KAAK,IAAI;AAAA,IACpB;AAAA,EACF;AACA,aAAW,QAAQ,IAAI;AACrB,QAAI,CAAC,gBAAgB,IAAI,GAAG;AAC1B,YAAM,IAAI;AAAA,QACR,SAAS,KAAK,IAAI,6BAA6B,IAAI;AAAA,MAErD;AAAA,IACF;AAAA,EACF;AACA,QAAM,KAAK,eAAe,KAAK,kBAAkB;AACjD,MAAI,IAAI;AACN,eAAW,QAAQ,IAAI;AACrB,UAAI,CAAC,gBAAgB,IAAI,GAAG;AAC1B,cAAM,IAAI;AAAA,UACR,SAAS,KAAK,IAAI,sBAAsB,IAAI;AAAA,QAC9C;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,WAAW,MAAM,qBAAqB,KAAK,YAAY,GAAG;AAIhE,QAAM,EAAE,MAAM,aAAa,QAAQ,IAAI,MAAM,oBAAoB,MAAM,QAAQ,SAAS,KAAK;AAE7F,QAAM,UAA+C;AAAA,IACnD,MAAM;AAAA,IACN;AAAA,IACA,SAAS;AAAA,IACT;AAAA,IACA;AAAA,IACA;AAAA;AAAA;AAAA;AAAA,IAIA,gBAAgB,UAAU,OAAO,EAAE;AAAA,EACrC;AAEA,QAAM,UAAU,aAAa,IAAI,EAAE;AACnC,MAAI,QAAQ,SAAS,EAAG,SAAQ,KAAK;AAErC,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,OAAO,KAAK,OAAO;AAAA,EACpC,SAAS,KAAK;AAiBZ,QAAI,sBAAsB,GAAG,GAAG;AAM9B,YAAMA,QAAO,oBAAI,KAAK;AACtB,YAAM,UAAU,MAAM,OAAO,IAAIA,OAAM,IAAI;AAC3C,cAAQ,IAAI,wDAAmD,OAAO,QAAQ,EAAE;AAChF,aAAO,EAAE,SAAS,uBAAuB,QAAQA,OAAM,WAAW,KAAK;AAAA,IACzE;AACA,UAAM;AAAA,EACR;AACA,QAAM,OAAO,oBAAI,KAAK;AACtB,QAAM,UAAU,MAAM,OAAO,IAAI,MAAM,OAAO,SAAS;AACvD,SAAO,EAAE,SAAS,OAAO,WAAW,QAAQ,MAAM,WAAW,OAAO,UAAU;AAChF;AASO,SAAS,eAAe,OAAuC;AACpE,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,OAAiB,CAAC;AACxB,aAAW,OAAO,MAAM,MAAM,OAAO,GAAG;AACtC,UAAM,UAAU,IAAI,KAAK,EAAE,YAAY;AACvC,QAAI,CAAC,QAAS;AACd,QAAI,KAAK,IAAI,OAAO,EAAG;AACvB,SAAK,IAAI,OAAO;AAChB,SAAK,KAAK,OAAO;AAAA,EACnB;AACA,SAAO,KAAK,SAAS,IAAI,OAAO;AAClC;AASO,SAAS,gBAAgB,GAAoB;AAClD,QAAM,KAAK,EAAE,QAAQ,GAAG;AACxB,MAAI,KAAK,KAAK,OAAO,EAAE,YAAY,GAAG,EAAG,QAAO;AAChD,QAAM,QAAQ,EAAE,MAAM,GAAG,EAAE;AAC3B,QAAM,SAAS,EAAE,MAAM,KAAK,CAAC;AAC7B,MAAI,CAAC,SAAS,CAAC,OAAQ,QAAO;AAC9B,MAAI,CAAC,OAAO,SAAS,GAAG,EAAG,QAAO;AAClC,MAAI,KAAK,KAAK,CAAC,EAAG,QAAO;AACzB,SAAO;AACT;","names":["when"]}

package/dist/{chunk-WPL5GERE.js → chunk-ZOCJBJQV.js}

@@ -1,6 +1,6 @@
 import {
   approveBlockers
-} from "./chunk-6I6L3CMX.js";
+} from "./chunk-KGUKL3CV.js";
 import {
   ACTIVE_STATUSES,
   allActionableVulnsTransitive,
@@ -299,4 +299,4 @@ export {
   prismicAckIsLive,
   collectPrismicDriftAlerts
 };
-//# sourceMappingURL=chunk-WPL5GERE.js.map
+//# sourceMappingURL=chunk-ZOCJBJQV.js.map

package/dist/{chunk-J3WEZGIN.js → chunk-ZRI5VRPG.js}

@@ -12,13 +12,13 @@ import {
 import {
   uploadAttachment
 } from "./chunk-IY6256GK.js";
-import {
-  generateHeaderImage
-} from "./chunk-5UINJNAJ.js";
 import {
   renderReportHtml,
   resolveCopy
 } from "./chunk-KJGKZLCT.js";
+import {
+  generateHeaderImage
+} from "./chunk-5UINJNAJ.js";
 import {
   siteSlug,
   updateAnalyticsHealth
@@ -741,4 +741,4 @@ export {
   fetchGaUsers,
   fetchSearch
 };
-//# sourceMappingURL=chunk-J3WEZGIN.js.map
+//# sourceMappingURL=chunk-ZRI5VRPG.js.map

package/dist/cli/bin.js

@@ -111,7 +111,7 @@ cli.command("sync-configs [site]", "Sync canonical configs into a site.").option
   'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../sync-configs-34JIA6KZ.js")).runSyncConfigsCommand(site, opts),
+    async () => (await import("../sync-configs-LVBITPLU.js")).runSyncConfigsCommand(site, opts),
     opts
   )
 );
@@ -138,7 +138,7 @@ cli.command(
   "Add the Prismic model delivery workflow to a site via PR (one PR per repo; never pushes to main)."
 ).option("--dry", "List the sites that would be offered the workflow, without opening any PR").option("--fleet <inventory>", 'Inventory file (.json or .mjs/.js), or "airtable"').option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../prismic-ci-MY2U6NN7.js")).runPrismicCiCommand(site, opts),
+    async () => (await import("../prismic-ci-PZ5LCPWT.js")).runPrismicCiCommand(site, opts),
     opts
   )
 );
@@ -153,7 +153,7 @@ cli.command(
   "Write the report to this file (the CI workflow posts it as a PR comment)"
 ).action(
   async (site, opts) => runOrExit(
-    async () => (await import("../prismic-models-IJWZW2EO.js")).runPrismicModelsCommand(site, opts),
+    async () => (await import("../prismic-models-6OYYZUR5.js")).runPrismicModelsCommand(site, opts),
     opts
   )
 );
@@ -230,14 +230,14 @@ cli.command(
   "--fleet <inventory>",
   'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
-  async (site, opts) => runOrExit(async () => (await import("../init-32AWPS7A.js")).runInitCommand(site, opts), opts)
+  async (site, opts) => runOrExit(async () => (await import("../init-NHKADHB6.js")).runInitCommand(site, opts), opts)
 );
 cli.command(
   "launch <site>",
   "Bootstrap + first-audit a site, then draft its launch email for approval."
 ).action(
   async (site, opts) => runOrExit(
-    async () => (await import("../launch-52WUE4TZ.js")).runLaunchCommand(site, opts),
+    async () => (await import("../launch-VQJ4Z35C.js")).runLaunchCommand(site, opts),
     opts
   )
 );
@@ -252,7 +252,7 @@ cli.command(
   "Draft the monthly-report announcement email for maintenance sites (all, or one) for approval."
 ).action(
   async (site, opts) => runOrExit(
-    async () => (await import("../announce-GKD5YJNB.js")).runAnnounceCommand(site, opts),
+    async () => (await import("../announce-OJFAS5JT.js")).runAnnounceCommand(site, opts),
     opts
   )
 );
@@ -261,7 +261,7 @@ cli.command(
   "Show who a form submission would email, and optionally flip the pre-launch guard (read-back confirmed)."
 ).option("--set <on|off>", "Flip the guard: on = route to operator, off = restore.").option("--restore <status>", "Status to restore with --set off. Required; never inferred.").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../forms-notify-target-SGDGXXK5.js")).runFormsNotifyTargetCommand(
+    async () => (await import("../forms-notify-target-LYSKME5L.js")).runFormsNotifyTargetCommand(
       site,
       opts
     ),
@@ -273,7 +273,7 @@ cli.command(
   "Operator self-tests. kind=email: preview a report email for a site (or --all) to yourself."
 ).option("--type <type>", "Report type: announcement (default) | maintenance | testing | launch").option("--to <addr>", "Recipient(s), comma-separated. Default: OPERATOR_EMAIL.").option("--all", "Send a preview for every maintenance site (to --to/operator).").option("--dry-run", "Render only; write reports/<slug>/selftest-<type>.html; do not send.").action(
   async (kind, site, opts) => runOrExit(
-    async () => (await import("../selftest-DIZ5JD2X.js")).runSelftestCommand(kind, site, opts),
+    async () => (await import("../selftest-CUX2FIQD.js")).runSelftestCommand(kind, site, opts),
     opts
   )
 );
@@ -285,13 +285,13 @@ cli.command(
   "Fleet mode: announcement\u2192maintenance sites; maintenance/testing\u2192all schedulable sites."
 ).action(
   async (site, opts) => runOrExit(
-    async () => (await import("../preflight-IMTYDDD4.js")).runPreflightCommand(site, opts),
+    async () => (await import("../preflight-LIN5NCYU.js")).runPreflightCommand(site, opts),
     opts
   )
 );
 cli.command("ensure-site <slug>", "Create/verify the Airtable Websites row for a new site.").option("--name <display name>", "Human Name for the row (client-facing copy uses it verbatim).").option("--url <url>", "Deployed URL (e.g. the Netlify site URL).").option("--contact <email>", "point of contact \u2014 the client address reports resolve to.").option("--git-repo <owner/repo>", "GitHub identity. Default on create: reddoorla/<slug>.").action(
   async (slug, opts) => runOrExit(
-    async () => (await import("../ensure-site-FU6527OU.js")).runEnsureSiteCommand(slug, opts),
+    async () => (await import("../ensure-site-NSNY2QHN.js")).runEnsureSiteCommand(slug, opts),
     opts
   )
 );
@@ -309,7 +309,7 @@ cli.command(
   "Email the internal sheet (scores, what wasn't measured, top fixes, the link) to PROSPECT_AUDIT_RECIPIENTS."
 ).action(
   async (url, opts) => runOrExit(
-    async () => (await import("../prospect-audit-WJQI7V5V.js")).runProspectAuditCommand(url, opts),
+    async () => (await import("../prospect-audit-DBBXL7EG.js")).runProspectAuditCommand(url, opts),
     opts
   )
 );
@@ -330,7 +330,7 @@ cli.command("report [site]", "Draft or send maintenance/testing reports.").optio
   "Regenerate one UNSENT report's stored HTML from its current row, so the console preview shows edited commentary. Refuses a sent report."
 ).action(
   async (site, opts) => runOrExit(
-    async () => (await import("../report-2LM2SX67.js")).runReportCommand(site, opts),
+    async () => (await import("../report-2N4PXO3L.js")).runReportCommand(site, opts),
     opts
   )
 );
@@ -339,7 +339,7 @@ cli.command(
   "Sweep the fleet for GitHub signals (Renovate-failing/CI/last-commit) and write Airtable."
 ).option("--fleet", "Run across every site in the Airtable inventory.").option("--write-airtable", "Write each site's signals back to its Websites row.").action(
   async (opts) => runOrExit(
-    async () => (await import("../github-signals-DB25UWY4.js")).runGitHubSignalsCommand({
+    async () => (await import("../github-signals-4YML6NY5.js")).runGitHubSignalsCommand({
       fleet: opts.fleet,
       writeAirtable: opts.writeAirtable
     }),
@@ -359,12 +359,18 @@ cli.command(
 );
 cli.command(
   "db <action>",
-  "Operate the libSQL store (migrate | replay-deadletters | import-airtable | parity | sync | backfill-header-images | backfill-digest-state | dump | verify-dump | restore)."
+  "Operate the libSQL store (migrate | replay-deadletters | import-airtable | parity | sync | backfill-header-images | backfill-digest-state | dump | verify-dump | restore | usage)."
 ).option("--file <path>", "verify-dump / restore: the dump file to load").option(
+  "--org <slug>",
+  "usage: Turso org slug (default: TURSO_ORG, else discovered from the token). The token itself comes from TURSO_FLEET_USAGE \u2014 never a flag, since argv is readable from ps."
+).option(
   "--url <url>",
   "restore: the TARGET database to load into. Required, never defaulted \u2014 a restore that could fall back to the ambient TURSO_DATABASE_URL is one keystroke from overwriting production."
+).option(
+  "--force",
+  "import-airtable / sync: run despite the freeze (#643) \u2014 a deliberate rollback-window converge from the frozen Airtable shadow. Without it both refuse while Turso is authoritative, because an import overwrites authoritative rows."
 ).action(
-  async (action, opts) => runOrExit(async () => (await import("../db-DXUUAMXT.js")).runDbCommand(action, opts), opts)
+  async (action, opts) => runOrExit(async () => (await import("../db-DAJX7NNW.js")).runDbCommand(action, opts), opts)
 );
 cli.command(
   "submissions <action>",
@@ -386,7 +392,7 @@ cli.command(
     async () => (await import("../renovate-dispatch-6GQWTRKX.js")).runRenovateDispatchCommand({
       fleet: opts.fleet,
       // #539 Phase 5: mirror the auto-fix counter into site_health.
-      siteMirror: await (await import("../site-mirror-Q763PLGG.js")).makeSiteMirror()
+      siteMirror: await (await import("../site-mirror-RQTEAID5.js")).makeSiteMirror()
     }),
     opts
   )