@reddoorla/maintenance 0.91.0 → 0.93.0

package/dist/forms/prismic.d.ts

@@ -0,0 +1,92 @@
+/**
+ * Copy for the submitter's confirmation email, resolved by the SITE from its own
+ * CMS and forwarded in the reserved `_reply` envelope.
+ *
+ * Everything here arrives over an untrusted boundary twice — once off the wire,
+ * once back out of the persisted `extraFields` JSON — so `parseReplyCopy` is the
+ * single gate both paths go through. It drops field by field rather than
+ * rejecting whole: a usable subject should still improve the email when the
+ * calendar block is malformed.
+ */
+type ReplyCalendar = {
+    title: string;
+    /** ISO 8601. Validated as parseable, not as any particular shape. */
+    start: string;
+    end?: string;
+    location?: string;
+    url?: string;
+    description?: string;
+};
+/** Inline formatting, as an offset range over a block's raw `text`. */
+type ReplySpan = {
+    start: number;
+    end: number;
+    type: "strong" | "em" | "link";
+    /** Required for `link`; https: and mailto: only, enforced at render. */
+    url?: string;
+};
+declare const REPLY_BLOCK_TYPES: readonly ["paragraph", "heading2", "heading3", "list-item", "o-list-item"];
+type ReplyBlockType = (typeof REPLY_BLOCK_TYPES)[number];
+/**
+ * One block of body copy.
+ *
+ * Deliberately an AST and NOT an HTML string. The envelope crosses an untrusted
+ * boundary twice, so a renderer that can only emit a fixed set of tags is what
+ * keeps "no attacker text reaches an outbound email" true by construction
+ * rather than by everyone downstream remembering to escape. See rich-text.ts.
+ */
+type ReplyBlock = {
+    type: ReplyBlockType;
+    text: string;
+    spans?: ReplySpan[];
+};
+type ReplyCopy = {
+    subject?: string;
+    body?: ReplyBlock[];
+    signature?: string;
+    calendar?: ReplyCalendar;
+};
+
+/**
+ * Resolve a submitter's confirmation copy from a Prismic repository.
+ *
+ * Published as its own subpath (`@reddoorla/maintenance/forms/prismic`) so the
+ * CMS-agnostic core stays that way: `./forms` must remain importable by a site
+ * that uses no CMS at all.
+ *
+ * The client is STRUCTURALLY typed rather than imported from
+ * `@prismicio/client`. The two reads below are the whole surface, every fleet
+ * site already constructs its own client, and duck-typing keeps this package's
+ * dependency list — and a consuming site's bundle — untouched. It also makes the
+ * tests a two-line object instead of a mocked SDK.
+ *
+ * Every read is wrapped: a CMS failure must cost the visitor nothing, because
+ * the submission itself is captured either way.
+ */
+
+type PrismicReader = {
+    getSingle: (type: string) => Promise<unknown>;
+    getByUID: (type: string, uid: string) => Promise<unknown>;
+};
+type ResolveReplyCopyOptions = {
+    /** The submission's form type; selects the entry in the singleton. */
+    formType: string;
+    /** Present for event forms only. A miss is not an error. */
+    eventUid?: string;
+    /** Custom type holding events. Default "rsvp". */
+    eventType?: string;
+    /** Singleton holding site-level defaults. Default "form_replies". */
+    settingsType?: string;
+    /** Calendar location when the event names none — usually the venue address. */
+    defaultLocation?: string;
+    /** Canonical URL of the event page, attached to the calendar entry. */
+    eventUrl?: string;
+};
+/**
+ * Site defaults for `formType`, overridden field-by-field by the event document
+ * when `eventUid` names one. Undefined means "nothing authored" — the caller
+ * omits `_reply` entirely and the shared package's own fallbacks apply.
+ */
+declare function resolveReplyCopy(client: PrismicReader, opts: ResolveReplyCopyOptions): Promise<ReplyCopy | undefined>;
+
+export { type PrismicReader, type ResolveReplyCopyOptions, resolveReplyCopy };

package/dist/forms/prismic.js

@@ -0,0 +1,105 @@
+import {
+  REPLY_BLOCK_TYPES,
+  parseReplyCopy
+} from "../chunk-I7NHLVVI.js";
+
+// src/forms/prismic.ts
+var DEFAULT_DURATION_MS = 2 * 60 * 60 * 1e3;
+function record(v) {
+  return v && typeof v === "object" && !Array.isArray(v) ? v : {};
+}
+function text(v) {
+  if (typeof v !== "string") return void 0;
+  const t = v.trim();
+  return t === "" ? void 0 : t;
+}
+function blocks(v) {
+  if (!Array.isArray(v)) return void 0;
+  const out = [];
+  for (const raw of v) {
+    const b = record(raw);
+    const body = typeof b.text === "string" ? b.text : "";
+    if (body.trim() === "") continue;
+    const declared = typeof b.type === "string" ? b.type : "paragraph";
+    const type = REPLY_BLOCK_TYPES.includes(declared) ? declared : "paragraph";
+    const block = { type, text: body };
+    const spans = Array.isArray(b.spans) ? b.spans.map(record) : [];
+    const mapped = [];
+    for (const s of spans) {
+      const kind = s.type === "hyperlink" ? "link" : s.type;
+      if (kind !== "strong" && kind !== "em" && kind !== "link") continue;
+      const start = typeof s.start === "number" ? s.start : NaN;
+      const end = typeof s.end === "number" ? s.end : NaN;
+      if (!Number.isFinite(start) || !Number.isFinite(end)) continue;
+      const span = { start, end, type: kind };
+      const url = text(record(s.data).url);
+      if (url) span.url = url;
+      mapped.push(span);
+    }
+    if (mapped.length > 0) block.spans = mapped;
+    out.push(block);
+  }
+  return out.length > 0 ? out : void 0;
+}
+function flatText(v) {
+  if (!Array.isArray(v)) return void 0;
+  const out = v.map((b) => text(record(b).text)).filter((t) => t !== void 0);
+  return out.length > 0 ? out.join(" ") : void 0;
+}
+function timestamp(v) {
+  const s = text(v);
+  if (!s) return void 0;
+  const ms = Date.parse(s);
+  return Number.isNaN(ms) ? void 0 : new Date(ms).toISOString();
+}
+async function attempt(run) {
+  try {
+    return await run();
+  } catch {
+    return void 0;
+  }
+}
+function calendarFrom(data, opts) {
+  const start = timestamp(data.start_time);
+  const title = text(data.name);
+  if (!start || !title) return void 0;
+  const cal = {
+    title,
+    start,
+    end: timestamp(data.end_time) ?? new Date(Date.parse(start) + DEFAULT_DURATION_MS).toISOString()
+  };
+  const location = text(data.location) ?? opts.defaultLocation;
+  if (location) cal.location = location;
+  if (opts.eventUrl) cal.url = opts.eventUrl;
+  return cal;
+}
+async function resolveReplyCopy(client, opts) {
+  const settings = record(
+    await attempt(() => client.getSingle(opts.settingsType ?? "form_replies"))
+  );
+  const settingsData = record(settings.data);
+  const entries = (Array.isArray(settingsData.replies) ? settingsData.replies : []).map(record);
+  const matches = entries.filter((e) => e.form_type === opts.formType);
+  const entry = matches.find((e) => text(e.subject) !== void 0 || blocks(e.body) !== void 0) ?? matches[0] ?? {};
+  const draft = {
+    subject: text(entry.subject),
+    body: blocks(entry.body),
+    signature: flatText(settingsData.signature)
+  };
+  if (opts.eventUid) {
+    const event = record(
+      await attempt(() => client.getByUID(opts.eventType ?? "rsvp", opts.eventUid))
+    );
+    const data = record(event.data);
+    if (Object.keys(data).length > 0) {
+      draft.subject = text(data.reply_subject) ?? draft.subject;
+      draft.body = blocks(data.reply_body) ?? draft.body;
+      draft.calendar = calendarFrom(data, opts);
+    }
+  }
+  return parseReplyCopy(draft);
+}
+export {
+  resolveReplyCopy
+};
+//# sourceMappingURL=prismic.js.map

package/dist/forms/prismic.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/forms/prismic.ts"],"sourcesContent":["/**\n * Resolve a submitter's confirmation copy from a Prismic repository.\n *\n * Published as its own subpath (`@reddoorla/maintenance/forms/prismic`) so the\n * CMS-agnostic core stays that way: `./forms` must remain importable by a site\n * that uses no CMS at all.\n *\n * The client is STRUCTURALLY typed rather than imported from\n * `@prismicio/client`. The two reads below are the whole surface, every fleet\n * site already constructs its own client, and duck-typing keeps this package's\n * dependency list — and a consuming site's bundle — untouched. It also makes the\n * tests a two-line object instead of a mocked SDK.\n *\n * Every read is wrapped: a CMS failure must cost the visitor nothing, because\n * the submission itself is captured either way.\n */\nimport {\n  parseReplyCopy,\n  REPLY_BLOCK_TYPES,\n  type ReplyBlock,\n  type ReplyCalendar,\n  type ReplyCopy,\n  type ReplySpan,\n} from \"./reply-copy.js\";\n\nexport type PrismicReader = {\n  getSingle: (type: string) => Promise<unknown>;\n  getByUID: (type: string, uid: string) => Promise<unknown>;\n};\n\nexport type ResolveReplyCopyOptions = {\n  /** The submission's form type; selects the entry in the singleton. */\n  formType: string;\n  /** Present for event forms only. A miss is not an error. */\n  eventUid?: string;\n  /** Custom type holding events. Default \"rsvp\". */\n  eventType?: string;\n  /** Singleton holding site-level defaults. Default \"form_replies\". */\n  settingsType?: string;\n  /** Calendar location when the event names none — usually the venue address. */\n  defaultLocation?: string;\n  /** Canonical URL of the event page, attached to the calendar entry. */\n  eventUrl?: string;\n};\n\nconst DEFAULT_DURATION_MS = 2 * 60 * 60 * 1000;\n\nfunction record(v: unknown): Record<string, unknown> {\n  return v && typeof v === \"object\" && !Array.isArray(v) ? (v as Record<string, unknown>) : {};\n}\n\nfunction text(v: unknown): string | undefined {\n  if (typeof v !== \"string\") return undefined;\n  const t = v.trim();\n  return t === \"\" ? undefined : t;\n}\n\n/** Prismic Rich Text is already a block/span AST, and `ReplyBlock` is modelled\n *  on it — so this is close to a pass-through, mapping Prismic's `hyperlink`\n *  onto our `link` and dropping any block or span kind the renderer does not\n *  know. Nothing is converted to HTML here: the AST crosses the wire and the\n *  shared renderer is the only thing that ever emits a tag. */\nfunction blocks(v: unknown): ReplyBlock[] | undefined {\n  if (!Array.isArray(v)) return undefined;\n  const out: ReplyBlock[] = [];\n  for (const raw of v) {\n    const b = record(raw);\n    const body = typeof b.text === \"string\" ? b.text : \"\";\n    if (body.trim() === \"\") continue;\n    const declared = typeof b.type === \"string\" ? b.type : \"paragraph\";\n    const type = (REPLY_BLOCK_TYPES as readonly string[]).includes(declared)\n      ? (declared as ReplyBlock[\"type\"])\n      : \"paragraph\";\n    const block: ReplyBlock = { type, text: body };\n    const spans = Array.isArray(b.spans) ? b.spans.map(record) : [];\n    const mapped: ReplySpan[] = [];\n    for (const s of spans) {\n      const kind = s.type === \"hyperlink\" ? \"link\" : s.type;\n      if (kind !== \"strong\" && kind !== \"em\" && kind !== \"link\") continue;\n      const start = typeof s.start === \"number\" ? s.start : NaN;\n      const end = typeof s.end === \"number\" ? s.end : NaN;\n      if (!Number.isFinite(start) || !Number.isFinite(end)) continue;\n      const span: ReplySpan = { start, end, type: kind };\n      const url = text(record(s.data).url);\n      if (url) span.url = url;\n      mapped.push(span);\n    }\n    if (mapped.length > 0) block.spans = mapped;\n    out.push(block);\n  }\n  return out.length > 0 ? out : undefined;\n}\n\n/** The signature is a short sign-off, so it stays flat text. */\nfunction flatText(v: unknown): string | undefined {\n  if (!Array.isArray(v)) return undefined;\n  const out = v.map((b) => text(record(b).text)).filter((t): t is string => t !== undefined);\n  return out.length > 0 ? out.join(\" \") : undefined;\n}\n\n/** A Prismic Timestamp (\"2026-09-12T18:00:00+0000\") as an ISO string, or\n *  undefined when the field is blank or unparseable. */\nfunction timestamp(v: unknown): string | undefined {\n  const s = text(v);\n  if (!s) return undefined;\n  const ms = Date.parse(s);\n  return Number.isNaN(ms) ? undefined : new Date(ms).toISOString();\n}\n\n/** Never let a CMS read fail the caller. */\nasync function attempt<T>(run: () => Promise<T>): Promise<T | undefined> {\n  try {\n    return await run();\n  } catch {\n    return undefined;\n  }\n}\n\nfunction calendarFrom(\n  data: Record<string, unknown>,\n  opts: ResolveReplyCopyOptions,\n): ReplyCalendar | undefined {\n  const start = timestamp(data.start_time);\n  const title = text(data.name);\n  // No start, no calendar — and deliberately no guess. An invite for the wrong\n  // evening is worse for a guest than no invite at all.\n  if (!start || !title) return undefined;\n  const cal: ReplyCalendar = {\n    title,\n    start,\n    end:\n      timestamp(data.end_time) ?? new Date(Date.parse(start) + DEFAULT_DURATION_MS).toISOString(),\n  };\n  const location = text(data.location) ?? opts.defaultLocation;\n  if (location) cal.location = location;\n  if (opts.eventUrl) cal.url = opts.eventUrl;\n  return cal;\n}\n\n/**\n * Site defaults for `formType`, overridden field-by-field by the event document\n * when `eventUid` names one. Undefined means \"nothing authored\" — the caller\n * omits `_reply` entirely and the shared package's own fallbacks apply.\n */\nexport async function resolveReplyCopy(\n  client: PrismicReader,\n  opts: ResolveReplyCopyOptions,\n): Promise<ReplyCopy | undefined> {\n  const settings = record(\n    await attempt(() => client.getSingle(opts.settingsType ?? \"form_replies\")),\n  );\n  const settingsData = record(settings.data);\n  const entries = (Array.isArray(settingsData.replies) ? settingsData.replies : []).map(record);\n  // Prefer the first row for this form type that actually SAYS something.\n  //\n  // A repeatable group hands the editor a new row with the Select unset or\n  // defaulted, so a document part-way through being filled in genuinely does\n  // contain several blank rows all claiming the same form type. Taking the\n  // first match outright meant one stray blank row above the real copy\n  // silently discarded it — the reply fell back to the built-in default and\n  // looked, from the client's side, exactly like the feature not working.\n  const matches = entries.filter((e) => e.form_type === opts.formType);\n  const entry =\n    matches.find((e) => text(e.subject) !== undefined || blocks(e.body) !== undefined) ??\n    matches[0] ??\n    {};\n\n  const draft: Record<string, unknown> = {\n    subject: text(entry.subject),\n    body: blocks(entry.body),\n    signature: flatText(settingsData.signature),\n  };\n\n  if (opts.eventUid) {\n    const event = record(\n      await attempt(() => client.getByUID(opts.eventType ?? \"rsvp\", opts.eventUid as string)),\n    );\n    const data = record(event.data);\n    if (Object.keys(data).length > 0) {\n      draft.subject = text(data.reply_subject) ?? draft.subject;\n      draft.body = blocks(data.reply_body) ?? draft.body;\n      draft.calendar = calendarFrom(data, opts);\n    }\n  }\n\n  return parseReplyCopy(draft);\n}\n"],"mappings":";;;;;;AA6CA,IAAM,sBAAsB,IAAI,KAAK,KAAK;AAE1C,SAAS,OAAO,GAAqC;AACnD,SAAO,KAAK,OAAO,MAAM,YAAY,CAAC,MAAM,QAAQ,CAAC,IAAK,IAAgC,CAAC;AAC7F;AAEA,SAAS,KAAK,GAAgC;AAC5C,MAAI,OAAO,MAAM,SAAU,QAAO;AAClC,QAAM,IAAI,EAAE,KAAK;AACjB,SAAO,MAAM,KAAK,SAAY;AAChC;AAOA,SAAS,OAAO,GAAsC;AACpD,MAAI,CAAC,MAAM,QAAQ,CAAC,EAAG,QAAO;AAC9B,QAAM,MAAoB,CAAC;AAC3B,aAAW,OAAO,GAAG;AACnB,UAAM,IAAI,OAAO,GAAG;AACpB,UAAM,OAAO,OAAO,EAAE,SAAS,WAAW,EAAE,OAAO;AACnD,QAAI,KAAK,KAAK,MAAM,GAAI;AACxB,UAAM,WAAW,OAAO,EAAE,SAAS,WAAW,EAAE,OAAO;AACvD,UAAM,OAAQ,kBAAwC,SAAS,QAAQ,IAClE,WACD;AACJ,UAAM,QAAoB,EAAE,MAAM,MAAM,KAAK;AAC7C,UAAM,QAAQ,MAAM,QAAQ,EAAE,KAAK,IAAI,EAAE,MAAM,IAAI,MAAM,IAAI,CAAC;AAC9D,UAAM,SAAsB,CAAC;AAC7B,eAAW,KAAK,OAAO;AACrB,YAAM,OAAO,EAAE,SAAS,cAAc,SAAS,EAAE;AACjD,UAAI,SAAS,YAAY,SAAS,QAAQ,SAAS,OAAQ;AAC3D,YAAM,QAAQ,OAAO,EAAE,UAAU,WAAW,EAAE,QAAQ;AACtD,YAAM,MAAM,OAAO,EAAE,QAAQ,WAAW,EAAE,MAAM;AAChD,UAAI,CAAC,OAAO,SAAS,KAAK,KAAK,CAAC,OAAO,SAAS,GAAG,EAAG;AACtD,YAAM,OAAkB,EAAE,OAAO,KAAK,MAAM,KAAK;AACjD,YAAM,MAAM,KAAK,OAAO,EAAE,IAAI,EAAE,GAAG;AACnC,UAAI,IAAK,MAAK,MAAM;AACpB,aAAO,KAAK,IAAI;AAAA,IAClB;AACA,QAAI,OAAO,SAAS,EAAG,OAAM,QAAQ;AACrC,QAAI,KAAK,KAAK;AAAA,EAChB;AACA,SAAO,IAAI,SAAS,IAAI,MAAM;AAChC;AAGA,SAAS,SAAS,GAAgC;AAChD,MAAI,CAAC,MAAM,QAAQ,CAAC,EAAG,QAAO;AAC9B,QAAM,MAAM,EAAE,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,MAAmB,MAAM,MAAS;AACzF,SAAO,IAAI,SAAS,IAAI,IAAI,KAAK,GAAG,IAAI;AAC1C;AAIA,SAAS,UAAU,GAAgC;AACjD,QAAM,IAAI,KAAK,CAAC;AAChB,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,KAAK,KAAK,MAAM,CAAC;AACvB,SAAO,OAAO,MAAM,EAAE,IAAI,SAAY,IAAI,KAAK,EAAE,EAAE,YAAY;AACjE;AAGA,eAAe,QAAW,KAA+C;AACvE,MAAI;AACF,WAAO,MAAM,IAAI;AAAA,EACnB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,aACP,MACA,MAC2B;AAC3B,QAAM,QAAQ,UAAU,KAAK,UAAU;AACvC,QAAM,QAAQ,KAAK,KAAK,IAAI;AAG5B,MAAI,CAAC,SAAS,CAAC,MAAO,QAAO;AAC7B,QAAM,MAAqB;AAAA,IACzB;AAAA,IACA;AAAA,IACA,KACE,UAAU,KAAK,QAAQ,KAAK,IAAI,KAAK,KAAK,MAAM,KAAK,IAAI,mBAAmB,EAAE,YAAY;AAAA,EAC9F;AACA,QAAM,WAAW,KAAK,KAAK,QAAQ,KAAK,KAAK;AAC7C,MAAI,SAAU,KAAI,WAAW;AAC7B,MAAI,KAAK,SAAU,KAAI,MAAM,KAAK;AAClC,SAAO;AACT;AAOA,eAAsB,iBACpB,QACA,MACgC;AAChC,QAAM,WAAW;AAAA,IACf,MAAM,QAAQ,MAAM,OAAO,UAAU,KAAK,gBAAgB,cAAc,CAAC;AAAA,EAC3E;AACA,QAAM,eAAe,OAAO,SAAS,IAAI;AACzC,QAAM,WAAW,MAAM,QAAQ,aAAa,OAAO,IAAI,aAAa,UAAU,CAAC,GAAG,IAAI,MAAM;AAS5F,QAAM,UAAU,QAAQ,OAAO,CAAC,MAAM,EAAE,cAAc,KAAK,QAAQ;AACnE,QAAM,QACJ,QAAQ,KAAK,CAAC,MAAM,KAAK,EAAE,OAAO,MAAM,UAAa,OAAO,EAAE,IAAI,MAAM,MAAS,KACjF,QAAQ,CAAC,KACT,CAAC;AAEH,QAAM,QAAiC;AAAA,IACrC,SAAS,KAAK,MAAM,OAAO;AAAA,IAC3B,MAAM,OAAO,MAAM,IAAI;AAAA,IACvB,WAAW,SAAS,aAAa,SAAS;AAAA,EAC5C;AAEA,MAAI,KAAK,UAAU;AACjB,UAAM,QAAQ;AAAA,MACZ,MAAM,QAAQ,MAAM,OAAO,SAAS,KAAK,aAAa,QAAQ,KAAK,QAAkB,CAAC;AAAA,IACxF;AACA,UAAM,OAAO,OAAO,MAAM,IAAI;AAC9B,QAAI,OAAO,KAAK,IAAI,EAAE,SAAS,GAAG;AAChC,YAAM,UAAU,KAAK,KAAK,aAAa,KAAK,MAAM;AAClD,YAAM,OAAO,OAAO,KAAK,UAAU,KAAK,MAAM;AAC9C,YAAM,WAAW,aAAa,MAAM,IAAI;AAAA,IAC1C;AAAA,EACF;AAEA,SAAO,eAAe,KAAK;AAC7B;","names":[]}

package/dist/{forms-notify-target-YCZUAHTY.js → forms-notify-target-RMZPKT6S.js}

@@ -1,9 +1,10 @@
 import {
   describeNotifyTarget
-} from "./chunk-SJOXWJ5Y.js";
-import "./chunk-JRHIFA5R.js";
+} from "./chunk-4763KQ6O.js";
+import "./chunk-QF6IQQFP.js";
 import "./chunk-5ML7FMBD.js";
 import "./chunk-NO74DXDP.js";
+import "./chunk-I7NHLVVI.js";
 import {
   openBase,
   readAirtableConfig
@@ -163,4 +164,4 @@ export {
   formatNotifyTarget,
   runFormsNotifyTargetCommand
 };
-//# sourceMappingURL=forms-notify-target-YCZUAHTY.js.map
+//# sourceMappingURL=forms-notify-target-RMZPKT6S.js.map

package/dist/{forms-notify-target-YCZUAHTY.js.map → forms-notify-target-RMZPKT6S.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/recipes/forms-notify-target.ts","../src/cli/commands/forms-notify-target.ts"],"sourcesContent":["import { openBase, readAirtableConfig } from \"../reports/airtable/client.js\";\nimport type { AirtableBase } from \"../reports/airtable/client.js\";\nimport type { SiteMirror } from \"../db/site-mirror.js\";\nimport {\n  listWebsites,\n  siteSlug,\n  updateSiteField,\n  type Status,\n  type WebsiteRow,\n} from \"../reports/airtable/websites.js\";\nimport { canonicalizeStatus, toAirtableStatus } from \"../reports/airtable/site-status.js\";\nimport { describeNotifyTarget, type NotifyTarget } from \"../forms/notify.js\";\n\n/** The Airtable column the pre-launch guard actually lives in. */\nexport const STATUS_COLUMN = \"Status\";\n\n/** The two ends of the verify flip. Deliberately the ONLY transition this\n *  performs: a site in any other status is already guarded (or is deliberately\n *  something else, like \"hosted-only\"), and silently rewriting that would be the\n *  same class of unseen change as the incident. */\nexport const LIVE_STATUS: Status = \"maintained\";\nexport const VERIFY_STATUS: Status = \"launching\";\n\nexport type FormsNotifyTargetDeps = {\n  base?: AirtableBase;\n  /** Site slug or the Airtable Websites NAME (both accepted). */\n  site: string;\n  /** `on` routes notifications to the operator; `off` restores. Omit to read. */\n  set?: \"on\" | \"off\";\n  /** Status to restore with `--set off`. Required, never inferred. */\n  restore?: string;\n  /** #539 Phase 5: Turso write-through for the Status cell this flips. Injected\n   *  at the CLI root, never defaulted — the unit suite calls this with a fake\n   *  base and must not open a real libSQL handle. */\n  siteMirror?: SiteMirror;\n};\n\nexport type FormsNotifyTargetResult = {\n  site: string;\n  status: Status | null;\n  target: NotifyTarget;\n  /** Present only when a flip was attempted. `confirmed` is the whole point:\n   *  it comes from RE-READING the row, not from the write call returning. */\n  flip?: { from: Status | null; to: Status; confirmed: boolean };\n};\n\n/**\n * The exact Airtable cell to write for an operator-supplied `--restore` value:\n * the operator's own string, verbatim.\n *\n * This is the ONE non-revertible surface in the #539 Phase 4 stage-1 rename —\n * every other change is code, and `git revert` undoes code. It cannot undo a\n * rewritten Airtable cell. So the rule here is stricter than everywhere else:\n * substitute only when the substitution is provably lossless, i.e. when\n * canonicalizing and mapping back ROUND-TRIPS to the operator's own string.\n *\n * That condition is, today, never false in a way that changes the answer — which\n * is the point. `toAirtableStatus(canonicalizeStatus(raw))` either equals `raw`\n * (so writing it is writing `raw`) or it does not (so we must write `raw`). The\n * function therefore reduces to \"write raw\", and it is written this way so the\n * reduction is visible rather than assumed. The case that made it matter:\n * `--restore legacy` canonicalizes to `archived`, which maps back to\n * \"deprecated\" — a different, real, operator-visible Airtable option that nobody\n * asked for. `hosting` → `hosted-only` → \"hosting\" round-trips and is safe.\n *\n * Airtable, not this module, is the authority on which option strings the\n * \"Status\" single-select accepts. Writing verbatim delegates to it: a typo is\n * rejected loudly at the API, exactly as it was before the rename.\n */\nexport function restoreCell(raw: string): string {\n  const canonical = canonicalizeStatus(raw);\n  if (canonical === null) return raw;\n  const roundTripped = toAirtableStatus(canonical);\n  return roundTripped === raw ? roundTripped : raw;\n}\n\nfunction findSite(rows: WebsiteRow[], site: string): WebsiteRow | undefined {\n  const wanted = site.trim().toLowerCase();\n  return rows.find(\n    (r) => siteSlug(r.name) === siteSlug(site) || r.name.trim().toLowerCase() === wanted,\n  );\n}\n\n/**\n * Answer \"who would a form submission on this site email?\" — and optionally\n * flip the pre-launch guard, confirming the flip by reading it back.\n *\n * The guard is a single Airtable `Status` cell. Nothing between \"I intended to\n * flip it\" and \"the client received a test lead\" reported the current state, so\n * on 2026-08-03 a flip that never landed sent a real client a test submission.\n * The fix is not a better intention, it is feedback: this reads the row back\n * after every write and refuses to call the flip confirmed on anything less.\n */\nexport async function formsNotifyTarget(\n  deps: FormsNotifyTargetDeps,\n): Promise<FormsNotifyTargetResult> {\n  const base = deps.base ?? openBase(readAirtableConfig());\n  const rows = await listWebsites(base);\n  const row = findSite(rows, deps.site);\n  if (!row) {\n    // The Websites NAME is not the repo slug (\"Sonder\", not \"gallerysonder\"),\n    // and that mismatch has cost time before — so name the near misses rather\n    // than making the operator go read Airtable to find the spelling.\n    const needle = siteSlug(deps.site);\n    const near = rows\n      .map((r) => r.name)\n      .filter((n) => siteSlug(n).includes(needle) || needle.includes(siteSlug(n)));\n    throw Object.assign(\n      new Error(\n        `No Websites row matches '${deps.site}'. The Websites NAME is not always the repo ` +\n          `slug (Sonder, not gallerysonder).` +\n          (near.length > 0 ? ` Did you mean: ${near.join(\", \")}?` : \"\"),\n      ),\n      { exitCode: 2 },\n    );\n  }\n\n  if (!deps.set) {\n    return { site: row.name, status: row.status, target: describeNotifyTarget(row) };\n  }\n\n  // `--restore` is operator free text. It is canonicalized for what this command\n  // REPORTS (`flip.to`, and the predicates downstream), but NEVER for what it\n  // WRITES — see `restoreCell` below.\n  const restoreRaw = deps.restore?.trim();\n  const to = deps.set === \"on\" ? VERIFY_STATUS : (canonicalizeStatus(restoreRaw) ?? undefined);\n  if (deps.set === \"off\" && !to) {\n    throw Object.assign(\n      new Error(\n        `--set off needs --restore <status>: the status to return to is never inferred. ` +\n          `Guessing \"${LIVE_STATUS}\" for a site that was \"hosted-only\" or \"archived\" would start ` +\n          `sending real client notifications — the inverse of the failure this command exists ` +\n          `to prevent.`,\n      ),\n      { exitCode: 2 },\n    );\n  }\n  // Only ever flip a LIVE site into verify mode. A site already outside\n  // \"maintained\" is guarded already, and rewriting its status would destroy a\n  // real value nobody asked us to touch.\n  if (deps.set === \"on\" && row.status !== LIVE_STATUS) {\n    throw Object.assign(\n      new Error(\n        `${row.name} is \"${row.status ?? \"blank\"}\", not \"${LIVE_STATUS}\" — notifications ` +\n          `already go to the operator only, so there is nothing to flip. Leaving the status ` +\n          `untouched.`,\n      ),\n      { exitCode: 2 },\n    );\n  }\n\n  // `--set on` writes a status this MODULE owns (VERIFY_STATUS), so mapping it to\n  // the current Airtable vocabulary is correct. `--set off` writes the operator's\n  // own string — see restoreCell.\n  const cell = deps.set === \"on\" ? toAirtableStatus(VERIFY_STATUS) : restoreCell(restoreRaw!);\n  await updateSiteField(base, row.id, STATUS_COLUMN, cell);\n  // Mirror the same cell. The console reads Status from Turso, so without this a\n  // site flipped into verify mode still reads as live for up to an hour — on the\n  // one surface an operator would check to confirm the flip.\n  await deps.siteMirror?.site(row.id, { [STATUS_COLUMN]: cell });\n\n  // Read it back. The write returning is NOT evidence the field changed.\n  const after = findSite(await listWebsites(base), deps.site);\n  if (!after) {\n    throw Object.assign(new Error(`${row.name} vanished from Websites during the flip.`), {\n      exitCode: 1,\n    });\n  }\n  return {\n    site: after.name,\n    status: after.status,\n    target: describeNotifyTarget(after),\n    // `confirmed` compares the RAW cell against the exact string written, not\n    // canonical-to-canonical. Canonical equality is too weak to be a read-back\n    // guard here: `legacy` and `deprecated` are the same canonical status, so a\n    // cell holding either would confirm a flip to the other. Comparing raw is the\n    // only comparison that can actually catch \"the cell is not what I sent\". The\n    // canonical check rides along so a reader that stopped canonicalizing is\n    // caught too.\n    flip: {\n      from: row.status,\n      to: to!,\n      confirmed: after.statusRaw === cell && after.status === to,\n    },\n  };\n}\n","import {\n  formsNotifyTarget,\n  LIVE_STATUS,\n  VERIFY_STATUS,\n  type FormsNotifyTargetResult,\n} from \"../../recipes/forms-notify-target.js\";\n\nexport type FormsNotifyTargetCommandOptions = {\n  set?: string;\n  restore?: string;\n  cwd?: string;\n};\n\nconst AUDIENCE_LABEL = {\n  client: \"THE CLIENT\",\n  operator: \"OPERATOR ONLY\",\n  nobody: \"NOBODY\",\n} as const;\n\n/** The line that decides whether it is safe to test-submit. Deliberately the\n *  loudest thing on screen: the incident happened because the answer was\n *  invisible, not because it was subtle. */\nexport function formatNotifyTarget(r: FormsNotifyTargetResult): string {\n  const lines: string[] = [];\n  if (r.flip) {\n    const arrow = `${r.flip.from ?? \"blank\"} → ${r.flip.to}`;\n    lines.push(\n      r.flip.confirmed\n        ? `${r.site}  Status: ${arrow}  ✓ confirmed by read-back`\n        : `${r.site}  Status: ${arrow}  ✗ NOT CONFIRMED — the row still reads \"${r.status ?? \"blank\"}\". Nothing was verified; do not test-submit.`,\n    );\n  } else {\n    lines.push(`${r.site}  Status: ${r.status ?? \"blank\"}`);\n  }\n\n  lines.push(`A submission right now would notify: ${AUDIENCE_LABEL[r.target.audience]}`);\n  if (r.target.to.length > 0) lines.push(`  to: ${r.target.to.join(\", \")}`);\n  if (r.target.cc.length > 0) lines.push(`  cc: ${r.target.cc.join(\", \")}`);\n  lines.push(`  ${r.target.reason}`);\n\n  if (r.target.audience === \"client\") {\n    lines.push(\n      \"\",\n      `⚠️  A test submission WILL email the client, and email cannot be recalled.`,\n      `   Route it to yourself first:  reddoor forms-notify-target ${r.site} --set on`,\n    );\n  }\n  if (r.flip?.confirmed && r.flip.to === VERIFY_STATUS) {\n    lines.push(\n      \"\",\n      `Safe to test. When you are done, restore it:`,\n      `  reddoor forms-notify-target ${r.site} --set off --restore ${r.flip.from ?? LIVE_STATUS}`,\n    );\n  }\n  return lines.join(\"\\n\");\n}\n\n/**\n * `forms-notify-target <site>` — show who a form submission would email, and\n * optionally flip the pre-launch guard with a read-back confirmation.\n *\n * Read-only by default: answering the question must never be riskier than not\n * asking it.\n */\nexport async function runFormsNotifyTargetCommand(\n  site: string | undefined,\n  opts: FormsNotifyTargetCommandOptions,\n): Promise<{ output: string; code: number }> {\n  if (!site?.trim()) {\n    return { output: \"forms-notify-target requires <site> (slug or Airtable name)\", code: 2 };\n  }\n  const set = opts.set?.trim().toLowerCase();\n  if (set !== undefined && set !== \"on\" && set !== \"off\") {\n    return { output: `--set must be 'on' or 'off' (got '${opts.set}')`, code: 2 };\n  }\n  try {\n    // #539 Phase 5: the flip writes Status on the Websites row; mirror it so the\n    // console (which reads Turso) shows the new routing immediately.\n    const { makeSiteMirror } = await import(\"../../db/site-mirror.js\");\n    const result = await formsNotifyTarget({\n      siteMirror: await makeSiteMirror(),\n      site: site.trim(),\n      ...(set ? { set: set as \"on\" | \"off\" } : {}),\n      ...(opts.restore ? { restore: opts.restore } : {}),\n    });\n    // An unconfirmed flip must not exit 0: a script (or a person skimming) that\n    // reads exit status would otherwise take \"I flipped it\" on faith, which is\n    // exactly the assumption that sent a client a test lead.\n    return {\n      output: formatNotifyTarget(result),\n      code: result.flip && !result.flip.confirmed ? 1 : 0,\n    };\n  } catch (err) {\n    const e = err as { message?: string; exitCode?: number };\n    return { output: e.message ?? String(err), code: e.exitCode ?? 1 };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAcO,IAAM,gBAAgB;AAMtB,IAAM,cAAsB;AAC5B,IAAM,gBAAwB;AAgD9B,SAAS,YAAY,KAAqB;AAC/C,QAAM,YAAY,mBAAmB,GAAG;AACxC,MAAI,cAAc,KAAM,QAAO;AAC/B,QAAM,eAAe,iBAAiB,SAAS;AAC/C,SAAO,iBAAiB,MAAM,eAAe;AAC/C;AAEA,SAAS,SAAS,MAAoB,MAAsC;AAC1E,QAAM,SAAS,KAAK,KAAK,EAAE,YAAY;AACvC,SAAO,KAAK;AAAA,IACV,CAAC,MAAM,SAAS,EAAE,IAAI,MAAM,SAAS,IAAI,KAAK,EAAE,KAAK,KAAK,EAAE,YAAY,MAAM;AAAA,EAChF;AACF;AAYA,eAAsB,kBACpB,MACkC;AAClC,QAAM,OAAO,KAAK,QAAQ,SAAS,mBAAmB,CAAC;AACvD,QAAM,OAAO,MAAM,aAAa,IAAI;AACpC,QAAM,MAAM,SAAS,MAAM,KAAK,IAAI;AACpC,MAAI,CAAC,KAAK;AAIR,UAAM,SAAS,SAAS,KAAK,IAAI;AACjC,UAAM,OAAO,KACV,IAAI,CAAC,MAAM,EAAE,IAAI,EACjB,OAAO,CAAC,MAAM,SAAS,CAAC,EAAE,SAAS,MAAM,KAAK,OAAO,SAAS,SAAS,CAAC,CAAC,CAAC;AAC7E,UAAM,OAAO;AAAA,MACX,IAAI;AAAA,QACF,4BAA4B,KAAK,IAAI,mFAElC,KAAK,SAAS,IAAI,kBAAkB,KAAK,KAAK,IAAI,CAAC,MAAM;AAAA,MAC9D;AAAA,MACA,EAAE,UAAU,EAAE;AAAA,IAChB;AAAA,EACF;AAEA,MAAI,CAAC,KAAK,KAAK;AACb,WAAO,EAAE,MAAM,IAAI,MAAM,QAAQ,IAAI,QAAQ,QAAQ,qBAAqB,GAAG,EAAE;AAAA,EACjF;AAKA,QAAM,aAAa,KAAK,SAAS,KAAK;AACtC,QAAM,KAAK,KAAK,QAAQ,OAAO,gBAAiB,mBAAmB,UAAU,KAAK;AAClF,MAAI,KAAK,QAAQ,SAAS,CAAC,IAAI;AAC7B,UAAM,OAAO;AAAA,MACX,IAAI;AAAA,QACF,4FACe,WAAW;AAAA,MAG5B;AAAA,MACA,EAAE,UAAU,EAAE;AAAA,IAChB;AAAA,EACF;AAIA,MAAI,KAAK,QAAQ,QAAQ,IAAI,WAAW,aAAa;AACnD,UAAM,OAAO;AAAA,MACX,IAAI;AAAA,QACF,GAAG,IAAI,IAAI,QAAQ,IAAI,UAAU,OAAO,WAAW,WAAW;AAAA,MAGhE;AAAA,MACA,EAAE,UAAU,EAAE;AAAA,IAChB;AAAA,EACF;AAKA,QAAM,OAAO,KAAK,QAAQ,OAAO,iBAAiB,aAAa,IAAI,YAAY,UAAW;AAC1F,QAAM,gBAAgB,MAAM,IAAI,IAAI,eAAe,IAAI;AAIvD,QAAM,KAAK,YAAY,KAAK,IAAI,IAAI,EAAE,CAAC,aAAa,GAAG,KAAK,CAAC;AAG7D,QAAM,QAAQ,SAAS,MAAM,aAAa,IAAI,GAAG,KAAK,IAAI;AAC1D,MAAI,CAAC,OAAO;AACV,UAAM,OAAO,OAAO,IAAI,MAAM,GAAG,IAAI,IAAI,0CAA0C,GAAG;AAAA,MACpF,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AACA,SAAO;AAAA,IACL,MAAM,MAAM;AAAA,IACZ,QAAQ,MAAM;AAAA,IACd,QAAQ,qBAAqB,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQlC,MAAM;AAAA,MACJ,MAAM,IAAI;AAAA,MACV;AAAA,MACA,WAAW,MAAM,cAAc,QAAQ,MAAM,WAAW;AAAA,IAC1D;AAAA,EACF;AACF;;;AC5KA,IAAM,iBAAiB;AAAA,EACrB,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,QAAQ;AACV;AAKO,SAAS,mBAAmB,GAAoC;AACrE,QAAM,QAAkB,CAAC;AACzB,MAAI,EAAE,MAAM;AACV,UAAM,QAAQ,GAAG,EAAE,KAAK,QAAQ,OAAO,WAAM,EAAE,KAAK,EAAE;AACtD,UAAM;AAAA,MACJ,EAAE,KAAK,YACH,GAAG,EAAE,IAAI,aAAa,KAAK,oCAC3B,GAAG,EAAE,IAAI,aAAa,KAAK,sDAA4C,EAAE,UAAU,OAAO;AAAA,IAChG;AAAA,EACF,OAAO;AACL,UAAM,KAAK,GAAG,EAAE,IAAI,aAAa,EAAE,UAAU,OAAO,EAAE;AAAA,EACxD;AAEA,QAAM,KAAK,wCAAwC,eAAe,EAAE,OAAO,QAAQ,CAAC,EAAE;AACtF,MAAI,EAAE,OAAO,GAAG,SAAS,EAAG,OAAM,KAAK,SAAS,EAAE,OAAO,GAAG,KAAK,IAAI,CAAC,EAAE;AACxE,MAAI,EAAE,OAAO,GAAG,SAAS,EAAG,OAAM,KAAK,SAAS,EAAE,OAAO,GAAG,KAAK,IAAI,CAAC,EAAE;AACxE,QAAM,KAAK,KAAK,EAAE,OAAO,MAAM,EAAE;AAEjC,MAAI,EAAE,OAAO,aAAa,UAAU;AAClC,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA,+DAA+D,EAAE,IAAI;AAAA,IACvE;AAAA,EACF;AACA,MAAI,EAAE,MAAM,aAAa,EAAE,KAAK,OAAO,eAAe;AACpD,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA,iCAAiC,EAAE,IAAI,wBAAwB,EAAE,KAAK,QAAQ,WAAW;AAAA,IAC3F;AAAA,EACF;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;AASA,eAAsB,4BACpB,MACA,MAC2C;AAC3C,MAAI,CAAC,MAAM,KAAK,GAAG;AACjB,WAAO,EAAE,QAAQ,+DAA+D,MAAM,EAAE;AAAA,EAC1F;AACA,QAAM,MAAM,KAAK,KAAK,KAAK,EAAE,YAAY;AACzC,MAAI,QAAQ,UAAa,QAAQ,QAAQ,QAAQ,OAAO;AACtD,WAAO,EAAE,QAAQ,qCAAqC,KAAK,GAAG,MAAM,MAAM,EAAE;AAAA,EAC9E;AACA,MAAI;AAGF,UAAM,EAAE,eAAe,IAAI,MAAM,OAAO,2BAAyB;AACjE,UAAM,SAAS,MAAM,kBAAkB;AAAA,MACrC,YAAY,MAAM,eAAe;AAAA,MACjC,MAAM,KAAK,KAAK;AAAA,MAChB,GAAI,MAAM,EAAE,IAAyB,IAAI,CAAC;AAAA,MAC1C,GAAI,KAAK,UAAU,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,IAClD,CAAC;AAID,WAAO;AAAA,MACL,QAAQ,mBAAmB,MAAM;AAAA,MACjC,MAAM,OAAO,QAAQ,CAAC,OAAO,KAAK,YAAY,IAAI;AAAA,IACpD;AAAA,EACF,SAAS,KAAK;AACZ,UAAM,IAAI;AACV,WAAO,EAAE,QAAQ,EAAE,WAAW,OAAO,GAAG,GAAG,MAAM,EAAE,YAAY,EAAE;AAAA,EACnE;AACF;","names":[]}
+{"version":3,"sources":["../src/recipes/forms-notify-target.ts","../src/cli/commands/forms-notify-target.ts"],"sourcesContent":["import { openBase, readAirtableConfig } from \"../reports/airtable/client.js\";\nimport type { AirtableBase } from \"../reports/airtable/client.js\";\nimport type { SiteMirror } from \"../db/site-mirror.js\";\nimport {\n  listWebsites,\n  siteSlug,\n  updateSiteField,\n  type Status,\n  type WebsiteRow,\n} from \"../reports/airtable/websites.js\";\nimport { canonicalizeStatus, toAirtableStatus } from \"../reports/airtable/site-status.js\";\nimport { describeNotifyTarget, type NotifyTarget } from \"../forms/notify.js\";\n\n/** The Airtable column the pre-launch guard actually lives in. */\nexport const STATUS_COLUMN = \"Status\";\n\n/** The two ends of the verify flip. Deliberately the ONLY transition this\n *  performs: a site in any other status is already guarded (or is deliberately\n *  something else, like \"hosted-only\"), and silently rewriting that would be the\n *  same class of unseen change as the incident. */\nexport const LIVE_STATUS: Status = \"maintained\";\nexport const VERIFY_STATUS: Status = \"launching\";\n\nexport type FormsNotifyTargetDeps = {\n  base?: AirtableBase;\n  /** Site slug or the Airtable Websites NAME (both accepted). */\n  site: string;\n  /** `on` routes notifications to the operator; `off` restores. Omit to read. */\n  set?: \"on\" | \"off\";\n  /** Status to restore with `--set off`. Required, never inferred. */\n  restore?: string;\n  /** #539 Phase 5: Turso write-through for the Status cell this flips. Injected\n   *  at the CLI root, never defaulted — the unit suite calls this with a fake\n   *  base and must not open a real libSQL handle. */\n  siteMirror?: SiteMirror;\n};\n\nexport type FormsNotifyTargetResult = {\n  site: string;\n  status: Status | null;\n  target: NotifyTarget;\n  /** Present only when a flip was attempted. `confirmed` is the whole point:\n   *  it comes from RE-READING the row, not from the write call returning. */\n  flip?: { from: Status | null; to: Status; confirmed: boolean };\n};\n\n/**\n * The exact Airtable cell to write for an operator-supplied `--restore` value:\n * the operator's own string, verbatim.\n *\n * This is the ONE non-revertible surface in the #539 Phase 4 stage-1 rename —\n * every other change is code, and `git revert` undoes code. It cannot undo a\n * rewritten Airtable cell. So the rule here is stricter than everywhere else:\n * substitute only when the substitution is provably lossless, i.e. when\n * canonicalizing and mapping back ROUND-TRIPS to the operator's own string.\n *\n * That condition is, today, never false in a way that changes the answer — which\n * is the point. `toAirtableStatus(canonicalizeStatus(raw))` either equals `raw`\n * (so writing it is writing `raw`) or it does not (so we must write `raw`). The\n * function therefore reduces to \"write raw\", and it is written this way so the\n * reduction is visible rather than assumed. The case that made it matter:\n * `--restore legacy` canonicalizes to `archived`, which maps back to\n * \"deprecated\" — a different, real, operator-visible Airtable option that nobody\n * asked for. `hosting` → `hosted-only` → \"hosting\" round-trips and is safe.\n *\n * Airtable, not this module, is the authority on which option strings the\n * \"Status\" single-select accepts. Writing verbatim delegates to it: a typo is\n * rejected loudly at the API, exactly as it was before the rename.\n */\nexport function restoreCell(raw: string): string {\n  const canonical = canonicalizeStatus(raw);\n  if (canonical === null) return raw;\n  const roundTripped = toAirtableStatus(canonical);\n  return roundTripped === raw ? roundTripped : raw;\n}\n\nfunction findSite(rows: WebsiteRow[], site: string): WebsiteRow | undefined {\n  const wanted = site.trim().toLowerCase();\n  return rows.find(\n    (r) => siteSlug(r.name) === siteSlug(site) || r.name.trim().toLowerCase() === wanted,\n  );\n}\n\n/**\n * Answer \"who would a form submission on this site email?\" — and optionally\n * flip the pre-launch guard, confirming the flip by reading it back.\n *\n * The guard is a single Airtable `Status` cell. Nothing between \"I intended to\n * flip it\" and \"the client received a test lead\" reported the current state, so\n * on 2026-08-03 a flip that never landed sent a real client a test submission.\n * The fix is not a better intention, it is feedback: this reads the row back\n * after every write and refuses to call the flip confirmed on anything less.\n */\nexport async function formsNotifyTarget(\n  deps: FormsNotifyTargetDeps,\n): Promise<FormsNotifyTargetResult> {\n  const base = deps.base ?? openBase(readAirtableConfig());\n  const rows = await listWebsites(base);\n  const row = findSite(rows, deps.site);\n  if (!row) {\n    // The Websites NAME is not the repo slug (\"Sonder\", not \"gallerysonder\"),\n    // and that mismatch has cost time before — so name the near misses rather\n    // than making the operator go read Airtable to find the spelling.\n    const needle = siteSlug(deps.site);\n    const near = rows\n      .map((r) => r.name)\n      .filter((n) => siteSlug(n).includes(needle) || needle.includes(siteSlug(n)));\n    throw Object.assign(\n      new Error(\n        `No Websites row matches '${deps.site}'. The Websites NAME is not always the repo ` +\n          `slug (Sonder, not gallerysonder).` +\n          (near.length > 0 ? ` Did you mean: ${near.join(\", \")}?` : \"\"),\n      ),\n      { exitCode: 2 },\n    );\n  }\n\n  if (!deps.set) {\n    return { site: row.name, status: row.status, target: describeNotifyTarget(row) };\n  }\n\n  // `--restore` is operator free text. It is canonicalized for what this command\n  // REPORTS (`flip.to`, and the predicates downstream), but NEVER for what it\n  // WRITES — see `restoreCell` below.\n  const restoreRaw = deps.restore?.trim();\n  const to = deps.set === \"on\" ? VERIFY_STATUS : (canonicalizeStatus(restoreRaw) ?? undefined);\n  if (deps.set === \"off\" && !to) {\n    throw Object.assign(\n      new Error(\n        `--set off needs --restore <status>: the status to return to is never inferred. ` +\n          `Guessing \"${LIVE_STATUS}\" for a site that was \"hosted-only\" or \"archived\" would start ` +\n          `sending real client notifications — the inverse of the failure this command exists ` +\n          `to prevent.`,\n      ),\n      { exitCode: 2 },\n    );\n  }\n  // Only ever flip a LIVE site into verify mode. A site already outside\n  // \"maintained\" is guarded already, and rewriting its status would destroy a\n  // real value nobody asked us to touch.\n  if (deps.set === \"on\" && row.status !== LIVE_STATUS) {\n    throw Object.assign(\n      new Error(\n        `${row.name} is \"${row.status ?? \"blank\"}\", not \"${LIVE_STATUS}\" — notifications ` +\n          `already go to the operator only, so there is nothing to flip. Leaving the status ` +\n          `untouched.`,\n      ),\n      { exitCode: 2 },\n    );\n  }\n\n  // `--set on` writes a status this MODULE owns (VERIFY_STATUS), so mapping it to\n  // the current Airtable vocabulary is correct. `--set off` writes the operator's\n  // own string — see restoreCell.\n  const cell = deps.set === \"on\" ? toAirtableStatus(VERIFY_STATUS) : restoreCell(restoreRaw!);\n  await updateSiteField(base, row.id, STATUS_COLUMN, cell);\n  // Mirror the same cell. The console reads Status from Turso, so without this a\n  // site flipped into verify mode still reads as live for up to an hour — on the\n  // one surface an operator would check to confirm the flip.\n  await deps.siteMirror?.site(row.id, { [STATUS_COLUMN]: cell });\n\n  // Read it back. The write returning is NOT evidence the field changed.\n  const after = findSite(await listWebsites(base), deps.site);\n  if (!after) {\n    throw Object.assign(new Error(`${row.name} vanished from Websites during the flip.`), {\n      exitCode: 1,\n    });\n  }\n  return {\n    site: after.name,\n    status: after.status,\n    target: describeNotifyTarget(after),\n    // `confirmed` compares the RAW cell against the exact string written, not\n    // canonical-to-canonical. Canonical equality is too weak to be a read-back\n    // guard here: `legacy` and `deprecated` are the same canonical status, so a\n    // cell holding either would confirm a flip to the other. Comparing raw is the\n    // only comparison that can actually catch \"the cell is not what I sent\". The\n    // canonical check rides along so a reader that stopped canonicalizing is\n    // caught too.\n    flip: {\n      from: row.status,\n      to: to!,\n      confirmed: after.statusRaw === cell && after.status === to,\n    },\n  };\n}\n","import {\n  formsNotifyTarget,\n  LIVE_STATUS,\n  VERIFY_STATUS,\n  type FormsNotifyTargetResult,\n} from \"../../recipes/forms-notify-target.js\";\n\nexport type FormsNotifyTargetCommandOptions = {\n  set?: string;\n  restore?: string;\n  cwd?: string;\n};\n\nconst AUDIENCE_LABEL = {\n  client: \"THE CLIENT\",\n  operator: \"OPERATOR ONLY\",\n  nobody: \"NOBODY\",\n} as const;\n\n/** The line that decides whether it is safe to test-submit. Deliberately the\n *  loudest thing on screen: the incident happened because the answer was\n *  invisible, not because it was subtle. */\nexport function formatNotifyTarget(r: FormsNotifyTargetResult): string {\n  const lines: string[] = [];\n  if (r.flip) {\n    const arrow = `${r.flip.from ?? \"blank\"} → ${r.flip.to}`;\n    lines.push(\n      r.flip.confirmed\n        ? `${r.site}  Status: ${arrow}  ✓ confirmed by read-back`\n        : `${r.site}  Status: ${arrow}  ✗ NOT CONFIRMED — the row still reads \"${r.status ?? \"blank\"}\". Nothing was verified; do not test-submit.`,\n    );\n  } else {\n    lines.push(`${r.site}  Status: ${r.status ?? \"blank\"}`);\n  }\n\n  lines.push(`A submission right now would notify: ${AUDIENCE_LABEL[r.target.audience]}`);\n  if (r.target.to.length > 0) lines.push(`  to: ${r.target.to.join(\", \")}`);\n  if (r.target.cc.length > 0) lines.push(`  cc: ${r.target.cc.join(\", \")}`);\n  lines.push(`  ${r.target.reason}`);\n\n  if (r.target.audience === \"client\") {\n    lines.push(\n      \"\",\n      `⚠️  A test submission WILL email the client, and email cannot be recalled.`,\n      `   Route it to yourself first:  reddoor forms-notify-target ${r.site} --set on`,\n    );\n  }\n  if (r.flip?.confirmed && r.flip.to === VERIFY_STATUS) {\n    lines.push(\n      \"\",\n      `Safe to test. When you are done, restore it:`,\n      `  reddoor forms-notify-target ${r.site} --set off --restore ${r.flip.from ?? LIVE_STATUS}`,\n    );\n  }\n  return lines.join(\"\\n\");\n}\n\n/**\n * `forms-notify-target <site>` — show who a form submission would email, and\n * optionally flip the pre-launch guard with a read-back confirmation.\n *\n * Read-only by default: answering the question must never be riskier than not\n * asking it.\n */\nexport async function runFormsNotifyTargetCommand(\n  site: string | undefined,\n  opts: FormsNotifyTargetCommandOptions,\n): Promise<{ output: string; code: number }> {\n  if (!site?.trim()) {\n    return { output: \"forms-notify-target requires <site> (slug or Airtable name)\", code: 2 };\n  }\n  const set = opts.set?.trim().toLowerCase();\n  if (set !== undefined && set !== \"on\" && set !== \"off\") {\n    return { output: `--set must be 'on' or 'off' (got '${opts.set}')`, code: 2 };\n  }\n  try {\n    // #539 Phase 5: the flip writes Status on the Websites row; mirror it so the\n    // console (which reads Turso) shows the new routing immediately.\n    const { makeSiteMirror } = await import(\"../../db/site-mirror.js\");\n    const result = await formsNotifyTarget({\n      siteMirror: await makeSiteMirror(),\n      site: site.trim(),\n      ...(set ? { set: set as \"on\" | \"off\" } : {}),\n      ...(opts.restore ? { restore: opts.restore } : {}),\n    });\n    // An unconfirmed flip must not exit 0: a script (or a person skimming) that\n    // reads exit status would otherwise take \"I flipped it\" on faith, which is\n    // exactly the assumption that sent a client a test lead.\n    return {\n      output: formatNotifyTarget(result),\n      code: result.flip && !result.flip.confirmed ? 1 : 0,\n    };\n  } catch (err) {\n    const e = err as { message?: string; exitCode?: number };\n    return { output: e.message ?? String(err), code: e.exitCode ?? 1 };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAcO,IAAM,gBAAgB;AAMtB,IAAM,cAAsB;AAC5B,IAAM,gBAAwB;AAgD9B,SAAS,YAAY,KAAqB;AAC/C,QAAM,YAAY,mBAAmB,GAAG;AACxC,MAAI,cAAc,KAAM,QAAO;AAC/B,QAAM,eAAe,iBAAiB,SAAS;AAC/C,SAAO,iBAAiB,MAAM,eAAe;AAC/C;AAEA,SAAS,SAAS,MAAoB,MAAsC;AAC1E,QAAM,SAAS,KAAK,KAAK,EAAE,YAAY;AACvC,SAAO,KAAK;AAAA,IACV,CAAC,MAAM,SAAS,EAAE,IAAI,MAAM,SAAS,IAAI,KAAK,EAAE,KAAK,KAAK,EAAE,YAAY,MAAM;AAAA,EAChF;AACF;AAYA,eAAsB,kBACpB,MACkC;AAClC,QAAM,OAAO,KAAK,QAAQ,SAAS,mBAAmB,CAAC;AACvD,QAAM,OAAO,MAAM,aAAa,IAAI;AACpC,QAAM,MAAM,SAAS,MAAM,KAAK,IAAI;AACpC,MAAI,CAAC,KAAK;AAIR,UAAM,SAAS,SAAS,KAAK,IAAI;AACjC,UAAM,OAAO,KACV,IAAI,CAAC,MAAM,EAAE,IAAI,EACjB,OAAO,CAAC,MAAM,SAAS,CAAC,EAAE,SAAS,MAAM,KAAK,OAAO,SAAS,SAAS,CAAC,CAAC,CAAC;AAC7E,UAAM,OAAO;AAAA,MACX,IAAI;AAAA,QACF,4BAA4B,KAAK,IAAI,mFAElC,KAAK,SAAS,IAAI,kBAAkB,KAAK,KAAK,IAAI,CAAC,MAAM;AAAA,MAC9D;AAAA,MACA,EAAE,UAAU,EAAE;AAAA,IAChB;AAAA,EACF;AAEA,MAAI,CAAC,KAAK,KAAK;AACb,WAAO,EAAE,MAAM,IAAI,MAAM,QAAQ,IAAI,QAAQ,QAAQ,qBAAqB,GAAG,EAAE;AAAA,EACjF;AAKA,QAAM,aAAa,KAAK,SAAS,KAAK;AACtC,QAAM,KAAK,KAAK,QAAQ,OAAO,gBAAiB,mBAAmB,UAAU,KAAK;AAClF,MAAI,KAAK,QAAQ,SAAS,CAAC,IAAI;AAC7B,UAAM,OAAO;AAAA,MACX,IAAI;AAAA,QACF,4FACe,WAAW;AAAA,MAG5B;AAAA,MACA,EAAE,UAAU,EAAE;AAAA,IAChB;AAAA,EACF;AAIA,MAAI,KAAK,QAAQ,QAAQ,IAAI,WAAW,aAAa;AACnD,UAAM,OAAO;AAAA,MACX,IAAI;AAAA,QACF,GAAG,IAAI,IAAI,QAAQ,IAAI,UAAU,OAAO,WAAW,WAAW;AAAA,MAGhE;AAAA,MACA,EAAE,UAAU,EAAE;AAAA,IAChB;AAAA,EACF;AAKA,QAAM,OAAO,KAAK,QAAQ,OAAO,iBAAiB,aAAa,IAAI,YAAY,UAAW;AAC1F,QAAM,gBAAgB,MAAM,IAAI,IAAI,eAAe,IAAI;AAIvD,QAAM,KAAK,YAAY,KAAK,IAAI,IAAI,EAAE,CAAC,aAAa,GAAG,KAAK,CAAC;AAG7D,QAAM,QAAQ,SAAS,MAAM,aAAa,IAAI,GAAG,KAAK,IAAI;AAC1D,MAAI,CAAC,OAAO;AACV,UAAM,OAAO,OAAO,IAAI,MAAM,GAAG,IAAI,IAAI,0CAA0C,GAAG;AAAA,MACpF,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AACA,SAAO;AAAA,IACL,MAAM,MAAM;AAAA,IACZ,QAAQ,MAAM;AAAA,IACd,QAAQ,qBAAqB,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQlC,MAAM;AAAA,MACJ,MAAM,IAAI;AAAA,MACV;AAAA,MACA,WAAW,MAAM,cAAc,QAAQ,MAAM,WAAW;AAAA,IAC1D;AAAA,EACF;AACF;;;AC5KA,IAAM,iBAAiB;AAAA,EACrB,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,QAAQ;AACV;AAKO,SAAS,mBAAmB,GAAoC;AACrE,QAAM,QAAkB,CAAC;AACzB,MAAI,EAAE,MAAM;AACV,UAAM,QAAQ,GAAG,EAAE,KAAK,QAAQ,OAAO,WAAM,EAAE,KAAK,EAAE;AACtD,UAAM;AAAA,MACJ,EAAE,KAAK,YACH,GAAG,EAAE,IAAI,aAAa,KAAK,oCAC3B,GAAG,EAAE,IAAI,aAAa,KAAK,sDAA4C,EAAE,UAAU,OAAO;AAAA,IAChG;AAAA,EACF,OAAO;AACL,UAAM,KAAK,GAAG,EAAE,IAAI,aAAa,EAAE,UAAU,OAAO,EAAE;AAAA,EACxD;AAEA,QAAM,KAAK,wCAAwC,eAAe,EAAE,OAAO,QAAQ,CAAC,EAAE;AACtF,MAAI,EAAE,OAAO,GAAG,SAAS,EAAG,OAAM,KAAK,SAAS,EAAE,OAAO,GAAG,KAAK,IAAI,CAAC,EAAE;AACxE,MAAI,EAAE,OAAO,GAAG,SAAS,EAAG,OAAM,KAAK,SAAS,EAAE,OAAO,GAAG,KAAK,IAAI,CAAC,EAAE;AACxE,QAAM,KAAK,KAAK,EAAE,OAAO,MAAM,EAAE;AAEjC,MAAI,EAAE,OAAO,aAAa,UAAU;AAClC,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA,+DAA+D,EAAE,IAAI;AAAA,IACvE;AAAA,EACF;AACA,MAAI,EAAE,MAAM,aAAa,EAAE,KAAK,OAAO,eAAe;AACpD,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA,iCAAiC,EAAE,IAAI,wBAAwB,EAAE,KAAK,QAAQ,WAAW;AAAA,IAC3F;AAAA,EACF;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;AASA,eAAsB,4BACpB,MACA,MAC2C;AAC3C,MAAI,CAAC,MAAM,KAAK,GAAG;AACjB,WAAO,EAAE,QAAQ,+DAA+D,MAAM,EAAE;AAAA,EAC1F;AACA,QAAM,MAAM,KAAK,KAAK,KAAK,EAAE,YAAY;AACzC,MAAI,QAAQ,UAAa,QAAQ,QAAQ,QAAQ,OAAO;AACtD,WAAO,EAAE,QAAQ,qCAAqC,KAAK,GAAG,MAAM,MAAM,EAAE;AAAA,EAC9E;AACA,MAAI;AAGF,UAAM,EAAE,eAAe,IAAI,MAAM,OAAO,2BAAyB;AACjE,UAAM,SAAS,MAAM,kBAAkB;AAAA,MACrC,YAAY,MAAM,eAAe;AAAA,MACjC,MAAM,KAAK,KAAK;AAAA,MAChB,GAAI,MAAM,EAAE,IAAyB,IAAI,CAAC;AAAA,MAC1C,GAAI,KAAK,UAAU,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,IAClD,CAAC;AAID,WAAO;AAAA,MACL,QAAQ,mBAAmB,MAAM;AAAA,MACjC,MAAM,OAAO,QAAQ,CAAC,OAAO,KAAK,YAAY,IAAI;AAAA,IACpD;AAAA,EACF,SAAS,KAAK;AACZ,UAAM,IAAI;AACV,WAAO,EAAE,QAAQ,EAAE,WAAW,OAAO,GAAG,GAAG,MAAM,EAAE,YAAY,EAAE;AAAA,EACnE;AACF;","names":[]}

package/dist/{health-endpoint-UVX6R5N5.js → health-endpoint-DHKJUPRM.js}

@@ -5,20 +5,20 @@ import {
   appendSkipNotice,
   fleetWorkdir,
   prepareFleetSites
-} from "./chunk-TVL5MVUF.js";
+} from "./chunk-TCF6S7AD.js";
 import {
   resolveSites
 } from "./chunk-Q47DU255.js";
 import {
   healthEndpoint
-} from "./chunk-BQRFQSGY.js";
+} from "./chunk-4R3YAQNV.js";
 import "./chunk-R53VL3RI.js";
-import "./chunk-3G25KIWW.js";
+import "./chunk-ZTPPCHDB.js";
 import "./chunk-Z3JXLULD.js";
-import "./chunk-RARREDQE.js";
-import "./chunk-XTK5VIQB.js";
 import "./chunk-LBYOLBW7.js";
+import "./chunk-RARREDQE.js";
 import "./chunk-XXTZBPUY.js";
+import "./chunk-XTK5VIQB.js";
 
 // src/cli/commands/health-endpoint.ts
 import { resolve } from "path";
@@ -51,4 +51,4 @@ async function runHealthEndpointCommand(site, opts) {
 export {
   runHealthEndpointCommand
 };
-//# sourceMappingURL=health-endpoint-UVX6R5N5.js.map
+//# sourceMappingURL=health-endpoint-DHKJUPRM.js.map

package/dist/index.js

@@ -1,34 +1,34 @@
 import "./chunk-2SLED3NB.js";
+import {
+  DEFAULT_INIT_STEPS,
+  a11yFixturesPage,
+  init
+} from "./chunk-4NUKMPOO.js";
 import {
   draftReportForSite
 } from "./chunk-ZRI5VRPG.js";
 import "./chunk-YFAXOD7Z.js";
 import {
   upgradeSvelte4to5
-} from "./chunk-Z3KYFUN6.js";
-import {
-  DEFAULT_INIT_STEPS,
-  a11yFixturesPage,
-  init
-} from "./chunk-UXJZU23T.js";
+} from "./chunk-B6NUZ2ZX.js";
 import {
   convertToPnpm
-} from "./chunk-XIDUYLSR.js";
+} from "./chunk-7CJ3DVZW.js";
 import {
   svelteCodemods
-} from "./chunk-IYSEC543.js";
+} from "./chunk-LS6QPANO.js";
 import "./chunk-J7SZQUCW.js";
-import "./chunk-BQRFQSGY.js";
-import "./chunk-Y53WOQIJ.js";
+import "./chunk-4R3YAQNV.js";
+import "./chunk-CVJF2IC5.js";
+import "./chunk-R53VL3RI.js";
 import {
   onboard,
   selfCaretRange,
   selfPackageVersion
-} from "./chunk-7RJ2HMMJ.js";
+} from "./chunk-NTLSMJHW.js";
 import {
   bumpDeps
-} from "./chunk-2NJQLSEU.js";
-import "./chunk-R53VL3RI.js";
+} from "./chunk-PPIZHDJL.js";
 import "./chunk-MVDMKKBN.js";
 import {
   approveBlockers
@@ -82,10 +82,11 @@ import {
   toAirtableStatus
 } from "./chunk-7NYN2P6I.js";
 import "./chunk-WEKL2HYJ.js";
+import "./chunk-T7ZUUOZ2.js";
 import {
   syncConfigs
-} from "./chunk-A6T2R63Z.js";
-import "./chunk-3G25KIWW.js";
+} from "./chunk-3HS6LPFX.js";
+import "./chunk-ZTPPCHDB.js";
 import "./chunk-MLT4QY5X.js";
 import "./chunk-OTGB6YQO.js";
 import {
@@ -96,7 +97,7 @@ import {
   runAudits,
   runAuditsAcross,
   securityAudit
-} from "./chunk-QD427NIO.js";
+} from "./chunk-JB4Q3C3M.js";
 import "./chunk-LKGVSM2O.js";
 import "./chunk-GASBX52O.js";
 import "./chunk-XHHMM5HX.js";
@@ -106,20 +107,20 @@ import {
 } from "./chunk-Z3JXLULD.js";
 import "./chunk-DMPHP7UP.js";
 import "./chunk-22GKJO5F.js";
-import "./chunk-UDRHAQT7.js";
-import "./chunk-RARREDQE.js";
 import "./chunk-OCNSIBMP.js";
-import "./chunk-A3WDWNN5.js";
-import {
-  isLeadFormType
-} from "./chunk-2OP4JKIQ.js";
-import "./chunk-XTK5VIQB.js";
 import {
   lighthouseAudit
 } from "./chunk-2NQUCS7O.js";
+import "./chunk-UDRHAQT7.js";
 import "./chunk-PTDMVGKL.js";
 import "./chunk-LBYOLBW7.js";
+import "./chunk-RARREDQE.js";
+import "./chunk-A3WDWNN5.js";
+import {
+  isLeadFormType
+} from "./chunk-2OP4JKIQ.js";
 import "./chunk-XXTZBPUY.js";
+import "./chunk-XTK5VIQB.js";
 import "./chunk-6VAL7XJT.js";
 import "./chunk-NMAWXBJA.js";
 import "./chunk-YLYXW5PH.js";
@@ -1450,6 +1451,9 @@ h1 { margin: 0 0 0.25rem; font-size: 1.75rem; }
 .muted { color:#999; }
 .filters { display:flex; flex-wrap:wrap; gap:0.4rem; margin-bottom:1.25rem; }
 .filters button { font:inherit; font-size:0.85rem; padding:0.25rem 0.7rem; border:1px solid #ccc; border-radius:999px; background:transparent; color:inherit; cursor:pointer; }
+.top-nav { margin: 0.5rem 0 1rem; }
+.nav-btn { display:inline-block; font-size:0.9rem; padding:0.35rem 0.9rem; border:1px solid currentColor; border-radius:999px; text-decoration:none; }
+.nav-btn:hover { background: rgba(127,127,127,0.12); }
 .filters button[aria-pressed="true"] { background:#1a1a1a; color:#fff; border-color:#1a1a1a; }
 @media (prefers-color-scheme: dark) { .filters button[aria-pressed="true"] { background:#e8e8e8; color:#111; } }
 .fleet-actions { margin-bottom:1.25rem; }
@@ -1795,6 +1799,9 @@ function renderCockpitHtml(model, operatorEmail = null) {
   ${renderAuthChrome(operatorEmail)}
   <h1>Reddoor fleet cockpit</h1>
   <div class="meta">${total} site${total === 1 ? "" : "s"} on the Reddoor stack. <a href="/fleet">Fleet table \u2192</a></div>
+  <nav class="top-nav" aria-label="Cockpit pages">
+    <a class="nav-btn" href="/audits">Prospect audits \u2192</a>
+  </nav>
   ${verdictBar(model, feed)}
   ${renderNeedsYouFeed(feed)}
   ${renderFleetBrowsePanel(model)}