@reddoorla/maintenance 0.95.0 → 0.96.0

package/dist/{submissions-3I3GAQAX.js → submissions-JDZP35JM.js}

@@ -2,7 +2,7 @@ import {
   toFormType,
   toNotifyStatus,
   toStatus
-} from "./chunk-2SLED3NB.js";
+} from "./chunk-YDZ7XGPZ.js";
 import {
   SIGNUP_FORM_TYPES
 } from "./chunk-2OP4JKIQ.js";
@@ -28,7 +28,11 @@ function rowFromDb(r) {
     resendMessageId: r.resend_message_id,
     spamScore: typeof r.spam_score === "number" ? r.spam_score : null,
     spamReason: r.spam_reason,
-    fanoutStatus: r.fanout_status
+    fanoutStatus: r.fanout_status,
+    bounceType: r.bounce_type,
+    bounceSubType: r.bounce_subtype,
+    bounceMessage: r.bounce_message,
+    bounceAckAt: r.bounce_ack_at
   };
 }
 function newSubmissionId() {
@@ -62,7 +66,13 @@ async function createSubmission(db, input) {
     spam_score: input.spamScore ?? null,
     spam_reason: input.spamReason ?? null,
     // Always null at insert: the fan-out runs after the row exists (stampFanout).
-    fanout_status: null
+    fanout_status: null,
+    // Always null at insert too: a bounce is reported by a webhook minutes
+    // later, and the ack is an operator gesture after that (#783).
+    bounce_type: null,
+    bounce_subtype: null,
+    bounce_message: null,
+    bounce_ack_at: null
   }).execute();
   const created = await getSubmissionById(db, id);
   if (!created) throw new Error("createSubmission: row vanished after insert");
@@ -234,7 +244,11 @@ async function backfillSubmission(db, row) {
     resend_message_id: row.resendMessageId,
     spam_score: row.spamScore ?? null,
     spam_reason: row.spamReason ?? null,
-    fanout_status: row.fanoutStatus ?? null
+    fanout_status: row.fanoutStatus ?? null,
+    bounce_type: row.bounceType ?? null,
+    bounce_subtype: row.bounceSubType ?? null,
+    bounce_message: row.bounceMessage ?? null,
+    bounce_ack_at: row.bounceAckAt ?? null
   }).onConflict((oc) => oc.column("id").doNothing()).execute();
 }
 async function rescoreSubmissionSpam(db, id, score, reason) {
@@ -249,21 +263,47 @@ async function markFilteredAsRead(db, filter) {
   ).executeTakeFirst();
   return Number(res.numUpdatedRows);
 }
-async function markNotifyBouncedByMessageId(db, messageId) {
+async function markNotifyBouncedByMessageId(db, messageId, detail = null) {
   if (messageId === "") return false;
-  const res = await db.updateTable("submissions").set({ notify_status: "bounced" }).where("resend_message_id", "=", messageId).executeTakeFirst();
+  const res = await db.updateTable("submissions").set(
+    detail === null ? { notify_status: "bounced" } : {
+      notify_status: "bounced",
+      bounce_type: detail.type,
+      bounce_subtype: detail.subType,
+      bounce_message: detail.message
+    }
+  ).where("resend_message_id", "=", messageId).executeTakeFirst();
   if (Number(res.numUpdatedRows) > 0) return true;
   const existing = await db.selectFrom("submissions").select("id").where("resend_message_id", "=", messageId).executeTakeFirst();
   return existing !== void 0;
 }
+async function ackNotifyBounce(db, id, now) {
+  const res = await db.updateTable("submissions").set({ bounce_ack_at: now.toISOString() }).where("id", "=", id).where("notify_status", "=", "bounced").where("bounce_ack_at", "is", null).executeTakeFirst();
+  return Number(res.numUpdatedRows) > 0;
+}
 async function countNotifyBouncedBySite(db, sinceDate) {
-  const rows = await db.selectFrom("submissions").select(["site_id", (eb) => eb.fn.countAll().as("n")]).where("notify_status", "=", "bounced").where("submitted_at", ">=", sinceDate).groupBy("site_id").execute();
-  return new Map(rows.map((r) => [r.site_id, Number(r.n)]));
+  const rows = await db.selectFrom("submissions").select([
+    "site_id",
+    (eb) => eb.fn.countAll().as("n"),
+    // lower() is ASCII-only in SQLite, which is all this needs: the value is a
+    // Resend enum ("Permanent"/"Transient"/"Undetermined"). Matching it
+    // case-insensitively here keeps the SQL agreeing with isPermanentBounce.
+    sql`sum(case when lower(bounce_type) = 'permanent' then 1 else 0 end)`.as(
+      "permanent_n"
+    )
+  ]).where("notify_status", "=", "bounced").where("submitted_at", ">=", sinceDate).where("bounce_ack_at", "is", null).groupBy("site_id").execute();
+  return new Map(
+    rows.map((r) => [
+      r.site_id,
+      { total: Number(r.n) || 0, permanent: Number(r.permanent_n) || 0 }
+    ])
+  );
 }
 export {
   MIN_DUP_BODY_LEN,
   MIN_SIMILAR_TOKENS,
   SIMILARITY_THRESHOLD,
+  ackNotifyBounce,
   backfillSubmission,
   countAutoSpamSince,
   countNotifyBouncedBySite,
@@ -286,4 +326,4 @@ export {
   stampFanout,
   stampNotified
 };
-//# sourceMappingURL=submissions-3I3GAQAX.js.map
+//# sourceMappingURL=submissions-JDZP35JM.js.map

package/dist/submissions-JDZP35JM.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/db/submissions.ts"],"sourcesContent":["import { sql } from \"kysely\";\nimport type { Selectable, SqlBool } from \"kysely\";\nimport type { Db } from \"./client.js\";\nimport type { SubmissionsTable } from \"./schema.js\";\nimport {\n  type SubmissionRow,\n  type SubmissionInput,\n  type BounceDetail,\n  toFormType,\n  toStatus,\n  toNotifyStatus,\n} from \"../reports/submission-row.js\";\nimport type { FormType, SubmissionStatus } from \"../reports/submission-row.js\";\nimport { SIGNUP_FORM_TYPES } from \"../forms/types.js\";\n\nexport type SubmissionFilter = {\n  siteId?: string;\n  formType?: FormType;\n  status?: SubmissionStatus;\n  /** LIKE %q% across name/email/message/phone, case-insensitive */\n  search?: string;\n  /** submitted_at >= from (ISO string) */\n  from?: string;\n  /** submitted_at <= to (ISO string) */\n  to?: string;\n  /** exact spam_reason token (comma-boundary match; a stored \":N\" count suffix on\n   *  the token still matches) */\n  reason?: string;\n};\n\n/** Map a raw DB row to the canonical SubmissionRow, narrowing the enum columns\n *  with the SAME validators the Airtable mapRow uses — SQLite stores TEXT, so a\n *  bad stored value must still be defended against. */\nfunction rowFromDb(r: Selectable<SubmissionsTable>): SubmissionRow {\n  return {\n    id: r.id,\n    submissionId: r.submission_id,\n    siteId: r.site_id,\n    formType: toFormType(r.form_type),\n    name: r.name,\n    email: r.email,\n    phone: r.phone,\n    message: r.message,\n    extraFields: r.extra_fields,\n    sourceUrl: r.source_url,\n    utm: r.utm,\n    submittedAt: r.submitted_at,\n    status: toStatus(r.status),\n    notifyStatus: toNotifyStatus(r.notify_status),\n    resendMessageId: r.resend_message_id,\n    spamScore: typeof r.spam_score === \"number\" ? r.spam_score : null,\n    spamReason: r.spam_reason,\n    fanoutStatus: r.fanout_status,\n    bounceType: r.bounce_type,\n    bounceSubType: r.bounce_subtype,\n    bounceMessage: r.bounce_message,\n    bounceAckAt: r.bounce_ack_at,\n  };\n}\n\n/** Opaque, collision-free id. crypto is a Node 20 global — no new dep. */\nexport function newSubmissionId(): string {\n  return `sub_${crypto.randomUUID()}`;\n}\n\nexport async function getSubmissionById(db: Db, id: string): Promise<SubmissionRow | null> {\n  const r = await db.selectFrom(\"submissions\").selectAll().where(\"id\", \"=\", id).executeTakeFirst();\n  return r ? rowFromDb(r) : null;\n}\n\nexport async function createSubmission(db: Db, input: SubmissionInput): Promise<SubmissionRow> {\n  const id = newSubmissionId();\n  const extra =\n    input.extraFields !== undefined && Object.keys(input.extraFields).length > 0\n      ? JSON.stringify(input.extraFields)\n      : null;\n  await db\n    .insertInto(\"submissions\")\n    .values({\n      id,\n      // Display number: MAX+1 in a single statement. libSQL is single-writer, so\n      // writes serialize and this is race-free.\n      submission_id: sql<number>`(SELECT COALESCE(MAX(submission_id), 0) + 1 FROM submissions)`,\n      site_id: input.siteId,\n      form_type: input.formType,\n      name: input.name,\n      email: input.email,\n      phone: input.phone ?? null,\n      message: input.message ?? null,\n      extra_fields: extra,\n      source_url: input.sourceUrl ?? null,\n      utm: input.utm ?? null,\n      submitted_at: input.submittedAt.toISOString(),\n      status: input.status ?? \"new\",\n      notify_status: \"skipped\",\n      resend_message_id: null,\n      spam_score: input.spamScore ?? null,\n      spam_reason: input.spamReason ?? null,\n      // Always null at insert: the fan-out runs after the row exists (stampFanout).\n      fanout_status: null,\n      // Always null at insert too: a bounce is reported by a webhook minutes\n      // later, and the ack is an operator gesture after that (#783).\n      bounce_type: null,\n      bounce_subtype: null,\n      bounce_message: null,\n      bounce_ack_at: null,\n    })\n    .execute();\n  const created = await getSubmissionById(db, id);\n  if (!created) throw new Error(\"createSubmission: row vanished after insert\");\n  return created;\n}\n\nimport type { NotifyStatus } from \"../reports/submission-row.js\";\n\nexport async function listNewSubmissions(db: Db, max = 200): Promise<SubmissionRow[]> {\n  // Bound the fetch (matches listSubmissionsForSite's default): the cockpit loads this whole\n  // array on every render. Unbounded, it deserializes every unread submission fleet-wide. The\n  // badge count therefore caps at `max` — acceptable, since >200 unread fleet-wide is itself a\n  // triage emergency, and the /submissions page is the unbounded, filterable view.\n  const rows = await db\n    .selectFrom(\"submissions\")\n    .selectAll()\n    .where(\"status\", \"=\", \"new\")\n    .orderBy(\"submitted_at\", \"desc\")\n    .limit(max)\n    .execute();\n  return rows.map(rowFromDb);\n}\n\n/** Same signature shape as the Airtable version (takes `{ id, name }`) so the\n *  composition-root swap is import-only — but here we filter by id directly, with\n *  no linked-field/primary-field workaround and no JS-confirm pass. */\nexport async function listSubmissionsForSite(\n  db: Db,\n  site: { id: string; name: string },\n  max = 200,\n): Promise<SubmissionRow[]> {\n  const rows = await db\n    .selectFrom(\"submissions\")\n    .selectAll()\n    .where(\"site_id\", \"=\", site.id)\n    .orderBy(\"submitted_at\", \"desc\")\n    .limit(max)\n    .execute();\n  return rows.map(rowFromDb);\n}\n\nexport async function setSubmissionStatusRow(\n  db: Db,\n  id: string,\n  status: SubmissionStatus,\n): Promise<void> {\n  await db.updateTable(\"submissions\").set({ status }).where(\"id\", \"=\", id).execute();\n}\n\nexport async function stampNotified(\n  db: Db,\n  id: string,\n  status: NotifyStatus,\n  messageId: string | null,\n): Promise<void> {\n  const patch =\n    messageId !== null\n      ? { notify_status: status, resend_message_id: messageId }\n      : { notify_status: status };\n  await db.updateTable(\"submissions\").set(patch).where(\"id\", \"=\", id).execute();\n}\n\n/** Record the newsletter fan-out outcome on a row (comma-joined destination tokens,\n *  see ingest.ts). REPLACES any previous value — the fan-out runs once per submission,\n *  so the last write is the whole truth; unlike markSubmissionsSpamRetro there is no\n *  earlier trail worth appending to. No status guard: this is provenance about what\n *  the pipeline did, not a triage decision, so it stays accurate even for a row the\n *  operator has already read or archived. */\nexport async function stampFanout(db: Db, id: string, fanoutStatus: string): Promise<void> {\n  await db\n    .updateTable(\"submissions\")\n    .set({ fanout_status: fanoutStatus })\n    .where(\"id\", \"=\", id)\n    .execute();\n}\n\n// NOTE: listSubmissionsFiltered and countSubmissionsFiltered share identical filter\n// logic via applySubmissionFilter — always update both through that helper.\nfunction applySubmissionFilter<O>(\n  qb: import(\"kysely\").SelectQueryBuilder<import(\"./schema.js\").Database, \"submissions\", O>,\n  f: SubmissionFilter,\n) {\n  let q = qb;\n  if (f.siteId !== undefined) q = q.where(\"site_id\", \"=\", f.siteId);\n  if (f.formType !== undefined) q = q.where(\"form_type\", \"=\", f.formType);\n  if (f.status !== undefined) q = q.where(\"status\", \"=\", f.status);\n  if (f.from !== undefined) q = q.where(\"submitted_at\", \">=\", f.from);\n  if (f.to !== undefined) q = q.where(\"submitted_at\", \"<=\", f.to);\n  if (f.search !== undefined && f.search.trim() !== \"\") {\n    // Escape LIKE metacharacters so a user's literal `%`/`_` (or the escape char `\\`) match\n    // literally rather than as wildcards: searching `john_doe` must not also hit `johnXdoe`,\n    // and a bare `%` must not match everything. `\\` is escaped first (it's the ESCAPE char).\n    // Parameterized regardless (no injection) — this is a correctness fix. Uses sql`` because\n    // kysely's `like` operator can't attach an ESCAPE clause.\n    const term = f.search\n      .trim()\n      .toLowerCase()\n      .replace(/[\\\\%_]/g, \"\\\\$&\");\n    const like = `%${term}%`;\n    q = q.where((eb) =>\n      eb.or([\n        sql<SqlBool>`lower(${eb.ref(\"name\")}) like ${like} escape '\\\\'`,\n        sql<SqlBool>`lower(${eb.ref(\"email\")}) like ${like} escape '\\\\'`,\n        sql<SqlBool>`lower(${eb.ref(\"message\")}) like ${like} escape '\\\\'`,\n        sql<SqlBool>`lower(${eb.ref(\"phone\")}) like ${like} escape '\\\\'`,\n      ]),\n    );\n  }\n  if (f.reason !== undefined && f.reason.trim() !== \"\") {\n    // spam_reason is a comma-joined token list (ingest.ts joins \",\"; retro appends\n    // \",<reason>\"). Comma-boundary match so \"links\" never matches \"backlinks\" and\n    // \"turnstile-required-absent\" never matches \"-failed\"; the second branch accepts\n    // a per-token count suffix (\"keywords:4\" matches reason=keywords). LIKE\n    // metacharacters escaped exactly like the search branch. lower() both sides is\n    // safe: tokens are ASCII classifier codes.\n    const token = f.reason\n      .trim()\n      .toLowerCase()\n      .replace(/[\\\\%_]/g, \"\\\\$&\");\n    q = q.where((eb) =>\n      eb.or([\n        sql<SqlBool>`',' || lower(${eb.ref(\"spam_reason\")}) || ',' like ${`%,${token},%`} escape '\\\\'`,\n        sql<SqlBool>`',' || lower(${eb.ref(\"spam_reason\")}) || ',' like ${`%,${token}:%`} escape '\\\\'`,\n      ]),\n    );\n  }\n  return q;\n}\n\nexport async function listSubmissionsFiltered(\n  db: Db,\n  filter: SubmissionFilter,\n  opts: { limit: number; offset: number },\n): Promise<SubmissionRow[]> {\n  const base = db.selectFrom(\"submissions\").selectAll();\n  const rows = await applySubmissionFilter(base, filter)\n    .orderBy(\"submitted_at\", \"desc\")\n    .limit(opts.limit)\n    .offset(opts.offset)\n    .execute();\n  return rows.map(rowFromDb);\n}\n\nexport async function countSubmissionsFiltered(db: Db, filter: SubmissionFilter): Promise<number> {\n  const base = db.selectFrom(\"submissions\").select((eb) => eb.fn.countAll<number>().as(\"n\"));\n  const res = await applySubmissionFilter(base, filter).executeTakeFirstOrThrow();\n  return Number(res.n);\n}\n\n/** Fleet-wide count of auto-filtered spam (`status = 'spam_auto'`) submitted on/after\n *  `sinceDate` (ISO). Powers the cockpit \"N auto-filtered this week — review\" affordance;\n *  the caller picks the window (like `listScreenOutsSince`), keeping this query pure. */\nexport async function countAutoSpamSince(db: Db, sinceDate: string): Promise<number> {\n  const res = await db\n    .selectFrom(\"submissions\")\n    .select((eb) => eb.fn.countAll<number>().as(\"n\"))\n    .where(\"status\", \"=\", \"spam_auto\")\n    .where(\"submitted_at\", \">=\", sinceDate)\n    .executeTakeFirstOrThrow();\n  return Number(res.n);\n}\n\nexport type SiteSubmissionCounts = { leads: number; signups: number; spamAuto: number };\n\n/** Per-site submission counts on/after `sinceIso` (full ISO timestamp) for the\n *  digest telemetry line. Grouped one-query: leads/signups = rows NOT auto- or\n *  operator-bucketed as spam (status NOT IN ('spam_auto','spam')) split by\n *  isLeadFormType; spamAuto = status='spam_auto'. Keyed by Websites record id. */\nexport async function countSubmissionsSinceBySite(\n  db: Db,\n  sinceIso: string,\n): Promise<Map<string, SiteSubmissionCounts>> {\n  const signupList = sql.join(SIGNUP_FORM_TYPES.map((t) => sql`${t}`));\n  const rows = await db\n    .selectFrom(\"submissions\")\n    .select([\n      \"site_id\",\n      sql<number>`sum(case when status not in ('spam_auto','spam') and form_type not in (${signupList}) then 1 else 0 end)`.as(\n        \"leads_n\",\n      ),\n      sql<number>`sum(case when status not in ('spam_auto','spam') and form_type in (${signupList}) then 1 else 0 end)`.as(\n        \"signups_n\",\n      ),\n      sql<number>`sum(case when status = 'spam_auto' then 1 else 0 end)`.as(\"spam_auto_n\"),\n    ])\n    .where(\"submitted_at\", \">=\", sinceIso)\n    .groupBy(\"site_id\")\n    .execute();\n  return new Map(\n    rows.map((r) => [\n      r.site_id,\n      {\n        leads: Number(r.leads_n) || 0,\n        signups: Number(r.signups_n) || 0,\n        spamAuto: Number(r.spam_auto_n) || 0,\n      },\n    ]),\n  );\n}\n\n/** A normalized body shorter than this never triggers the exact-duplicate signal —\n *  short/boilerplate lines (a newsletter \"subscribe\", \"hi\") legitimately repeat\n *  across real people. */\nexport const MIN_DUP_BODY_LEN = 40;\n\n/** Both token sets must be at least this large before the Jaccard tier can fire —\n *  two short genuine messages (\"what are your hours?\" variants) share most of their\n *  few tokens and would otherwise collide. */\nexport const MIN_SIMILAR_TOKENS = 25;\n\n/** Jaccard similarity (token sets) at or above this marks a near-duplicate. 0.9 is\n *  deliberately strict: a template spray with one substituted greeting/target still\n *  clears it, while two independently-written enquiries about the same business\n *  never do. */\nexport const SIMILARITY_THRESHOLD = 0.9;\n\n/** Fold a message body down to its template skeleton. Full-Unicode lowercase first\n *  (JS `toLowerCase()` — SQLite's `lower()` is ASCII-only, which is why this whole\n *  comparison lives in JS, folding BOTH sides identically so byte-identical Cyrillic\n *  copies keep matching), then strip everything a spray substitutes per target —\n *  URLs, emails, bare domains, digit runs — and collapse whitespace. Over-stripping\n *  is safe: it happens symmetrically on both sides. */\nfunction normalizeBody(body: string): string {\n  return body\n    .toLowerCase()\n    .replace(/https?:\\/\\/\\S+/gu, \" \") // full URLs\n    .replace(/www\\.\\S+/gu, \" \") // scheme-less www. links\n    .replace(/\\S+@\\S+/gu, \" \") // email addresses\n    .replace(/\\b[a-z0-9-]+(\\.[a-z0-9-]+)+\\b/gu, \" \") // bare domain tokens (word.tld)\n    .replace(/\\d+/gu, \" \") // digit runs (phone numbers, prices, years)\n    .replace(/\\s+/gu, \" \")\n    .trim();\n}\n\n/** Letter-only token set of a normalized body (punctuation/symbols are separators). */\nfunction tokenSet(normalized: string): Set<string> {\n  return new Set(normalized.split(/[^\\p{L}]+/u).filter((t) => t.length > 0));\n}\n\nfunction jaccard(a: Set<string>, b: Set<string>): number {\n  let intersection = 0;\n  for (const t of a) if (b.has(t)) intersection++;\n  const union = a.size + b.size - intersection;\n  return union === 0 ? 0 : intersection / union;\n}\n\n/** Fleet-wide duplicate/near-duplicate lookup for the spray spam signal — the same\n *  pitch blasted across sites shows up as identical OR near-identical bodies (the\n *  live dog-harness spray differed ONLY in greeting; SEO sprays substitute the\n *  target domain per site — exact match alone missed both). Scans rows submitted\n *  on/after `sinceDate` and compares in JS (see normalizeBody for why not SQL):\n *  - `exact`: normalized equality, only when the normalized incoming body is at\n *    least MIN_DUP_BODY_LEN chars.\n *  - `similar`: token-set Jaccard >= SIMILARITY_THRESHOLD, only when BOTH sets have\n *    at least MIN_SIMILAR_TOKENS tokens. A row matched as exact never re-appears here.\n *  Returned statuses let the caller retro-bucket still-'new' prior copies. The 2000-row\n *  LIMIT is a safety bound only — current volume is ~130/month, so a 30-day window is\n *  always a full scan. */\n/** One matched prior row from the duplicate scan. Carries siteId + email so the\n *  ingest caller can exempt a GENUINE same-sender resubmission on the same site\n *  (a real visitor double-submitting / resending after silence) — only cross-site\n *  or different-sender copies are spray evidence. */\nexport type DuplicateMatch = { id: string; status: string; siteId: string; email: string };\n\nexport async function findRecentDuplicateSubmissions(\n  db: Db,\n  message: string,\n  sinceDate: string,\n): Promise<{\n  exact: DuplicateMatch[];\n  similar: DuplicateMatch[];\n}> {\n  const incoming = normalizeBody(message);\n  const incomingTokens = tokenSet(incoming);\n  const exactEligible = incoming.length >= MIN_DUP_BODY_LEN;\n  const similarEligible = incomingTokens.size >= MIN_SIMILAR_TOKENS;\n  // Too short for either tier — skip the scan entirely (nothing could match).\n  if (!exactEligible && !similarEligible) return { exact: [], similar: [] };\n\n  const rows = await db\n    .selectFrom(\"submissions\")\n    .select([\"id\", \"status\", \"message\", \"site_id\", \"email\"])\n    .where(\"message\", \"is not\", null)\n    .where(\"submitted_at\", \">=\", sinceDate)\n    .orderBy(\"submitted_at\", \"desc\")\n    .limit(2000)\n    .execute();\n\n  const exact: DuplicateMatch[] = [];\n  const similar: DuplicateMatch[] = [];\n  for (const row of rows) {\n    const stored = normalizeBody(row.message ?? \"\");\n    const match: DuplicateMatch = {\n      id: row.id,\n      status: row.status,\n      siteId: row.site_id,\n      email: row.email,\n    };\n    if (exactEligible && stored === incoming) {\n      exact.push(match);\n      continue; // an exact match must not also appear in similar\n    }\n    if (!similarEligible) continue;\n    const storedTokens = tokenSet(stored);\n    if (storedTokens.size < MIN_SIMILAR_TOKENS) continue;\n    if (jaccard(incomingTokens, storedTokens) >= SIMILARITY_THRESHOLD) {\n      similar.push(match);\n    }\n  }\n  return { exact, similar };\n}\n\n/** Recent non-newsletter submissions from `email` (case/whitespace-folded), on/after\n *  `sinceDate` (ISO). Powers the cross-site repeat-sender signal: the fleet's sites\n *  are UNRELATED businesses, so the same address writing to 2+ of them inside a month\n *  is a solicitation tell — the caller compares siteIds (same-site repeats are genuine\n *  follow-ups). Newsletter rows are excluded: one person subscribing on two sites is\n *  legitimate. Both sides fold in SQL (same-side folding, see the normalizeBody note). */\nexport async function listRecentSubmissionsForEmail(\n  db: Db,\n  email: string,\n  sinceDate: string,\n): Promise<Array<{ id: string; siteId: string; status: string }>> {\n  if (email.trim() === \"\") return [];\n  const rows = await db\n    .selectFrom(\"submissions\")\n    .select([\"id\", \"site_id\", \"status\"])\n    .where(\"form_type\", \"!=\", \"newsletter\")\n    .where(\"submitted_at\", \">=\", sinceDate)\n    .where((eb) => sql<SqlBool>`lower(trim(${eb.ref(\"email\")})) = lower(trim(${email}))`)\n    .execute();\n  return rows.map((r) => ({ id: r.id, siteId: r.site_id, status: r.status }));\n}\n\n/** Retroactively re-bucket prior spray copies once a later copy identifies the spray\n *  (the FIRST copy is always delivered by design — only a repeat reveals it). Appends\n *  `retroReason` to any existing spam_reason so the original classifier trail survives.\n *  The `status = 'new'` guard is load-bearing: rows the operator already read/replied/\n *  archived/marked are NEVER touched — this only cleans the unread queue. */\nexport async function markSubmissionsSpamRetro(\n  db: Db,\n  ids: string[],\n  retroReason: string,\n): Promise<void> {\n  if (ids.length === 0) return;\n  await db\n    .updateTable(\"submissions\")\n    .set({\n      status: \"spam_auto\",\n      spam_reason: sql<string>`CASE WHEN spam_reason IS NULL OR spam_reason = '' THEN ${retroReason} ELSE spam_reason || ',' || ${retroReason} END`,\n    })\n    .where(\"id\", \"in\", ids)\n    .where(\"status\", \"=\", \"new\")\n    .execute();\n}\n\n/** spam_reason strings for EVERY row matching `filter` (not just one page). Powers the\n *  /submissions per-reason facet line, which must tally the WHOLE filtered bucket — the\n *  rollout runbook directs the operator to judge the canary from it, and a page-scoped\n *  tally under the full-bucket total silently misread once the bucket passed one page.\n *  Capped (default 2000) as a safety bound far above any real bucket. */\nexport async function listSpamReasonsFiltered(\n  db: Db,\n  filter: SubmissionFilter,\n  cap = 2000,\n): Promise<string[]> {\n  const base = db.selectFrom(\"submissions\").select([\"spam_reason\"]);\n  const rows = await applySubmissionFilter(base, filter)\n    .where(\"spam_reason\", \"is not\", null)\n    .limit(cap)\n    .execute();\n  return rows.map((r) => r.spam_reason).filter((r): r is string => r !== null && r !== \"\");\n}\n\n/** Insert a SubmissionRow verbatim, preserving its id, display number, and status.\n *  ON CONFLICT(id) DO NOTHING makes the whole backfill re-runnable. */\nexport async function backfillSubmission(db: Db, row: SubmissionRow): Promise<void> {\n  await db\n    .insertInto(\"submissions\")\n    .values({\n      id: row.id,\n      submission_id: row.submissionId,\n      site_id: row.siteId,\n      form_type: row.formType,\n      name: row.name,\n      email: row.email,\n      phone: row.phone,\n      message: row.message,\n      extra_fields: row.extraFields,\n      source_url: row.sourceUrl,\n      utm: row.utm,\n      submitted_at: row.submittedAt,\n      status: row.status,\n      notify_status: row.notifyStatus,\n      resend_message_id: row.resendMessageId,\n      spam_score: row.spamScore ?? null,\n      spam_reason: row.spamReason ?? null,\n      fanout_status: row.fanoutStatus ?? null,\n      bounce_type: row.bounceType ?? null,\n      bounce_subtype: row.bounceSubType ?? null,\n      bounce_message: row.bounceMessage ?? null,\n      bounce_ack_at: row.bounceAckAt ?? null,\n    })\n    .onConflict((oc) => oc.column(\"id\").doNothing())\n    .execute();\n}\n\n/** Re-score write for the `submissions rescore` CLI (2026-07-16): flip ONE still-'new'\n *  row to spam_auto with the CURRENT classifier's verdict. Unlike markSubmissionsSpamRetro\n *  (which appends to the old trail), this REPLACES spam_score/spam_reason — the point of a\n *  re-score is that today's verdict supersedes the stale ingest-time one; the caller bakes\n *  its provenance marker (retro-rescore) into `reason`. The status='new' guard is\n *  load-bearing: rows the operator already read/replied/archived/marked are NEVER\n *  re-bucketed. Returns true when the row was written (false = no longer 'new'). */\nexport async function rescoreSubmissionSpam(\n  db: Db,\n  id: string,\n  score: number,\n  reason: string,\n): Promise<boolean> {\n  const res = await db\n    .updateTable(\"submissions\")\n    .set({ status: \"spam_auto\", spam_score: score, spam_reason: reason })\n    .where(\"id\", \"=\", id)\n    .where(\"status\", \"=\", \"new\")\n    .executeTakeFirst();\n  return Number(res.numUpdatedRows) > 0;\n}\n\n/** Bulk triage for the /submissions page (2026-07-16): flip EVERY still-'new' row\n *  matching `filter` to 'read', server-side, so a 100-row backlog is one click instead\n *  of 100. Reuses applySubmissionFilter (via an id-subquery — kysely's update builder\n *  can't take the select-only helper directly) so the POST flips exactly the bucket the\n *  GET rendered. The outer status='new' guard is load-bearing: spam/archived/read rows\n *  are never touched even when the filter matches them (bulk-\"reading\" a spam_auto row\n *  would resurrect it into the per-site strip). Returns the number of rows flipped. */\nexport async function markFilteredAsRead(db: Db, filter: SubmissionFilter): Promise<number> {\n  const res = await db\n    .updateTable(\"submissions\")\n    .set({ status: \"read\" })\n    .where(\"status\", \"=\", \"new\")\n    .where(\"id\", \"in\", (eb) =>\n      applySubmissionFilter(eb.selectFrom(\"submissions\").select(\"id\"), filter),\n    )\n    .executeTakeFirst();\n  return Number(res.numUpdatedRows);\n}\n\n/** Flip a submission's notify_status to 'bounced' by its Resend message id — the\n *  resend-webhook's mapping from a bounce/complaint event back onto the lead whose\n *  notification it was (2026-07-16, the Espada failure mode: 'sent' only means Resend\n *  ACCEPTED the email). Returns whether any row matched, so the webhook can tell a\n *  submission notification apart from a report email (unknown id → false → the report\n *  path handles it). Idempotent: a svix replay re-writes the same terminal value. In\n *  practice only 'sent' rows can match — stampNotified stamps the message id and the\n *  'sent' status together, and failed/skipped rows carry no id. */\nexport async function markNotifyBouncedByMessageId(\n  db: Db,\n  messageId: string,\n  /** Resend's `data.bounce`, parsed (#783). Null for a complaint, which carries\n   *  no bounce object, and for any payload whose shape we did not recognize.\n   *\n   *  A null detail deliberately does NOT clear a classification already stored:\n   *  a svix replay of the same event, or a later complaint on a message that\n   *  already bounced, must not erase the diagnosis the first delivery carried. */\n  detail: BounceDetail | null = null,\n): Promise<boolean> {\n  if (messageId === \"\") return false;\n  const res = await db\n    .updateTable(\"submissions\")\n    .set(\n      detail === null\n        ? { notify_status: \"bounced\" }\n        : {\n            notify_status: \"bounced\",\n            bounce_type: detail.type,\n            bounce_subtype: detail.subType,\n            bounce_message: detail.message,\n          },\n    )\n    .where(\"resend_message_id\", \"=\", messageId)\n    .executeTakeFirst();\n  if (Number(res.numUpdatedRows) > 0) return true;\n  // A replayed webhook must still report \"this was a submission\" (200, stop svix\n  // retrying) even though the terminal value is already written — matched-but-\n  // unchanged rows still count in numUpdatedRows on SQLite, but don't rely on it.\n  const existing = await db\n    .selectFrom(\"submissions\")\n    .select(\"id\")\n    .where(\"resend_message_id\", \"=\", messageId)\n    .executeTakeFirst();\n  return existing !== undefined;\n}\n\n/** Acknowledge ONE bounced notification as \"not a dead address\" (#783).\n *\n *  The row keeps its bounce record — status, type, sub-type and the receiving\n *  server's message all stay — and simply stops counting toward the alarm. That\n *  is the difference from the production workaround this replaces, which flipped\n *  `bounced` back to `sent` by id and destroyed the evidence along with the\n *  alarm.\n *\n *  Guarded on `notify_status = 'bounced'` (there is nothing to acknowledge on a\n *  healthy row) and on `bounce_ack_at IS NULL`, which makes it idempotent and\n *  keeps the FIRST acknowledgement's timestamp — the honest one, since that is\n *  when the operator actually looked. Returns whether this call was the one that\n *  wrote. A PERMANENT bounce is deliberately still ackable: the ack means \"I\n *  have looked at this\", not \"this was a false alarm\", and refusing it would\n *  leave no way to close the case after genuinely fixing the mailbox. */\nexport async function ackNotifyBounce(db: Db, id: string, now: Date): Promise<boolean> {\n  const res = await db\n    .updateTable(\"submissions\")\n    .set({ bounce_ack_at: now.toISOString() })\n    .where(\"id\", \"=\", id)\n    .where(\"notify_status\", \"=\", \"bounced\")\n    .where(\"bounce_ack_at\", \"is\", null)\n    .executeTakeFirst();\n  return Number(res.numUpdatedRows) > 0;\n}\n\n/** Per-site bounce counts, split by whether the payload said the ADDRESS is bad. */\nexport type NotifyBounceCounts = {\n  /** Unacknowledged bounced notifications in the window. */\n  total: number;\n  /** How many of those Resend classified `Permanent` (#783). Counted ONLY where\n   *  the payload actually said so: a null classification — every row written\n   *  before migration 0018, and every complaint — counts toward `total` and\n   *  never toward this. Reading null as permanent would keep accusing the\n   *  address on exactly the rows that caused the false alarm. */\n  permanent: number;\n};\n\n/** Per-site counts of bounced lead notifications on/after `sinceDate` (ISO), keyed by\n *  the Websites record id (`site_id`). Powers the notify-bounce attention collector —\n *  the caller picks the window (like `countAutoSpamSince`), keeping this query pure.\n *  Windowed on `submitted_at`: the bounce lands minutes after the submission, and\n *  submissions carry no bounce timestamp column (append-only schema, 2026-07-16).\n *\n *  Acknowledged rows are excluded outright (#783), which is what lets a diagnosed\n *  false alarm clear the same day instead of aging out over fourteen. A site whose\n *  every bounce is acked drops out of the map entirely, exactly like a site that\n *  never bounced — both are \"nothing to raise\". */\nexport async function countNotifyBouncedBySite(\n  db: Db,\n  sinceDate: string,\n): Promise<Map<string, NotifyBounceCounts>> {\n  const rows = await db\n    .selectFrom(\"submissions\")\n    .select([\n      \"site_id\",\n      (eb) => eb.fn.countAll<number>().as(\"n\"),\n      // lower() is ASCII-only in SQLite, which is all this needs: the value is a\n      // Resend enum (\"Permanent\"/\"Transient\"/\"Undetermined\"). Matching it\n      // case-insensitively here keeps the SQL agreeing with isPermanentBounce.\n      sql<number>`sum(case when lower(bounce_type) = 'permanent' then 1 else 0 end)`.as(\n        \"permanent_n\",\n      ),\n    ])\n    .where(\"notify_status\", \"=\", \"bounced\")\n    .where(\"submitted_at\", \">=\", sinceDate)\n    .where(\"bounce_ack_at\", \"is\", null)\n    .groupBy(\"site_id\")\n    .execute();\n  return new Map(\n    rows.map((r) => [\n      r.site_id,\n      { total: Number(r.n) || 0, permanent: Number(r.permanent_n) || 0 },\n    ]),\n  );\n}\n"],"mappings":";;;;;;;;;;AAAA,SAAS,WAAW;AAiCpB,SAAS,UAAU,GAAgD;AACjE,SAAO;AAAA,IACL,IAAI,EAAE;AAAA,IACN,cAAc,EAAE;AAAA,IAChB,QAAQ,EAAE;AAAA,IACV,UAAU,WAAW,EAAE,SAAS;AAAA,IAChC,MAAM,EAAE;AAAA,IACR,OAAO,EAAE;AAAA,IACT,OAAO,EAAE;AAAA,IACT,SAAS,EAAE;AAAA,IACX,aAAa,EAAE;AAAA,IACf,WAAW,EAAE;AAAA,IACb,KAAK,EAAE;AAAA,IACP,aAAa,EAAE;AAAA,IACf,QAAQ,SAAS,EAAE,MAAM;AAAA,IACzB,cAAc,eAAe,EAAE,aAAa;AAAA,IAC5C,iBAAiB,EAAE;AAAA,IACnB,WAAW,OAAO,EAAE,eAAe,WAAW,EAAE,aAAa;AAAA,IAC7D,YAAY,EAAE;AAAA,IACd,cAAc,EAAE;AAAA,IAChB,YAAY,EAAE;AAAA,IACd,eAAe,EAAE;AAAA,IACjB,eAAe,EAAE;AAAA,IACjB,aAAa,EAAE;AAAA,EACjB;AACF;AAGO,SAAS,kBAA0B;AACxC,SAAO,OAAO,OAAO,WAAW,CAAC;AACnC;AAEA,eAAsB,kBAAkB,IAAQ,IAA2C;AACzF,QAAM,IAAI,MAAM,GAAG,WAAW,aAAa,EAAE,UAAU,EAAE,MAAM,MAAM,KAAK,EAAE,EAAE,iBAAiB;AAC/F,SAAO,IAAI,UAAU,CAAC,IAAI;AAC5B;AAEA,eAAsB,iBAAiB,IAAQ,OAAgD;AAC7F,QAAM,KAAK,gBAAgB;AAC3B,QAAM,QACJ,MAAM,gBAAgB,UAAa,OAAO,KAAK,MAAM,WAAW,EAAE,SAAS,IACvE,KAAK,UAAU,MAAM,WAAW,IAChC;AACN,QAAM,GACH,WAAW,aAAa,EACxB,OAAO;AAAA,IACN;AAAA;AAAA;AAAA,IAGA,eAAe;AAAA,IACf,SAAS,MAAM;AAAA,IACf,WAAW,MAAM;AAAA,IACjB,MAAM,MAAM;AAAA,IACZ,OAAO,MAAM;AAAA,IACb,OAAO,MAAM,SAAS;AAAA,IACtB,SAAS,MAAM,WAAW;AAAA,IAC1B,cAAc;AAAA,IACd,YAAY,MAAM,aAAa;AAAA,IAC/B,KAAK,MAAM,OAAO;AAAA,IAClB,cAAc,MAAM,YAAY,YAAY;AAAA,IAC5C,QAAQ,MAAM,UAAU;AAAA,IACxB,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,YAAY,MAAM,aAAa;AAAA,IAC/B,aAAa,MAAM,cAAc;AAAA;AAAA,IAEjC,eAAe;AAAA;AAAA;AAAA,IAGf,aAAa;AAAA,IACb,gBAAgB;AAAA,IAChB,gBAAgB;AAAA,IAChB,eAAe;AAAA,EACjB,CAAC,EACA,QAAQ;AACX,QAAM,UAAU,MAAM,kBAAkB,IAAI,EAAE;AAC9C,MAAI,CAAC,QAAS,OAAM,IAAI,MAAM,6CAA6C;AAC3E,SAAO;AACT;AAIA,eAAsB,mBAAmB,IAAQ,MAAM,KAA+B;AAKpF,QAAM,OAAO,MAAM,GAChB,WAAW,aAAa,EACxB,UAAU,EACV,MAAM,UAAU,KAAK,KAAK,EAC1B,QAAQ,gBAAgB,MAAM,EAC9B,MAAM,GAAG,EACT,QAAQ;AACX,SAAO,KAAK,IAAI,SAAS;AAC3B;AAKA,eAAsB,uBACpB,IACA,MACA,MAAM,KACoB;AAC1B,QAAM,OAAO,MAAM,GAChB,WAAW,aAAa,EACxB,UAAU,EACV,MAAM,WAAW,KAAK,KAAK,EAAE,EAC7B,QAAQ,gBAAgB,MAAM,EAC9B,MAAM,GAAG,EACT,QAAQ;AACX,SAAO,KAAK,IAAI,SAAS;AAC3B;AAEA,eAAsB,uBACpB,IACA,IACA,QACe;AACf,QAAM,GAAG,YAAY,aAAa,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,MAAM,MAAM,KAAK,EAAE,EAAE,QAAQ;AACnF;AAEA,eAAsB,cACpB,IACA,IACA,QACA,WACe;AACf,QAAM,QACJ,cAAc,OACV,EAAE,eAAe,QAAQ,mBAAmB,UAAU,IACtD,EAAE,eAAe,OAAO;AAC9B,QAAM,GAAG,YAAY,aAAa,EAAE,IAAI,KAAK,EAAE,MAAM,MAAM,KAAK,EAAE,EAAE,QAAQ;AAC9E;AAQA,eAAsB,YAAY,IAAQ,IAAY,cAAqC;AACzF,QAAM,GACH,YAAY,aAAa,EACzB,IAAI,EAAE,eAAe,aAAa,CAAC,EACnC,MAAM,MAAM,KAAK,EAAE,EACnB,QAAQ;AACb;AAIA,SAAS,sBACP,IACA,GACA;AACA,MAAI,IAAI;AACR,MAAI,EAAE,WAAW,OAAW,KAAI,EAAE,MAAM,WAAW,KAAK,EAAE,MAAM;AAChE,MAAI,EAAE,aAAa,OAAW,KAAI,EAAE,MAAM,aAAa,KAAK,EAAE,QAAQ;AACtE,MAAI,EAAE,WAAW,OAAW,KAAI,EAAE,MAAM,UAAU,KAAK,EAAE,MAAM;AAC/D,MAAI,EAAE,SAAS,OAAW,KAAI,EAAE,MAAM,gBAAgB,MAAM,EAAE,IAAI;AAClE,MAAI,EAAE,OAAO,OAAW,KAAI,EAAE,MAAM,gBAAgB,MAAM,EAAE,EAAE;AAC9D,MAAI,EAAE,WAAW,UAAa,EAAE,OAAO,KAAK,MAAM,IAAI;AAMpD,UAAM,OAAO,EAAE,OACZ,KAAK,EACL,YAAY,EACZ,QAAQ,WAAW,MAAM;AAC5B,UAAM,OAAO,IAAI,IAAI;AACrB,QAAI,EAAE;AAAA,MAAM,CAAC,OACX,GAAG,GAAG;AAAA,QACJ,YAAqB,GAAG,IAAI,MAAM,CAAC,UAAU,IAAI;AAAA,QACjD,YAAqB,GAAG,IAAI,OAAO,CAAC,UAAU,IAAI;AAAA,QAClD,YAAqB,GAAG,IAAI,SAAS,CAAC,UAAU,IAAI;AAAA,QACpD,YAAqB,GAAG,IAAI,OAAO,CAAC,UAAU,IAAI;AAAA,MACpD,CAAC;AAAA,IACH;AAAA,EACF;AACA,MAAI,EAAE,WAAW,UAAa,EAAE,OAAO,KAAK,MAAM,IAAI;AAOpD,UAAM,QAAQ,EAAE,OACb,KAAK,EACL,YAAY,EACZ,QAAQ,WAAW,MAAM;AAC5B,QAAI,EAAE;AAAA,MAAM,CAAC,OACX,GAAG,GAAG;AAAA,QACJ,mBAA4B,GAAG,IAAI,aAAa,CAAC,iBAAiB,KAAK,KAAK,IAAI;AAAA,QAChF,mBAA4B,GAAG,IAAI,aAAa,CAAC,iBAAiB,KAAK,KAAK,IAAI;AAAA,MAClF,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAsB,wBACpB,IACA,QACA,MAC0B;AAC1B,QAAM,OAAO,GAAG,WAAW,aAAa,EAAE,UAAU;AACpD,QAAM,OAAO,MAAM,sBAAsB,MAAM,MAAM,EAClD,QAAQ,gBAAgB,MAAM,EAC9B,MAAM,KAAK,KAAK,EAChB,OAAO,KAAK,MAAM,EAClB,QAAQ;AACX,SAAO,KAAK,IAAI,SAAS;AAC3B;AAEA,eAAsB,yBAAyB,IAAQ,QAA2C;AAChG,QAAM,OAAO,GAAG,WAAW,aAAa,EAAE,OAAO,CAAC,OAAO,GAAG,GAAG,SAAiB,EAAE,GAAG,GAAG,CAAC;AACzF,QAAM,MAAM,MAAM,sBAAsB,MAAM,MAAM,EAAE,wBAAwB;AAC9E,SAAO,OAAO,IAAI,CAAC;AACrB;AAKA,eAAsB,mBAAmB,IAAQ,WAAoC;AACnF,QAAM,MAAM,MAAM,GACf,WAAW,aAAa,EACxB,OAAO,CAAC,OAAO,GAAG,GAAG,SAAiB,EAAE,GAAG,GAAG,CAAC,EAC/C,MAAM,UAAU,KAAK,WAAW,EAChC,MAAM,gBAAgB,MAAM,SAAS,EACrC,wBAAwB;AAC3B,SAAO,OAAO,IAAI,CAAC;AACrB;AAQA,eAAsB,4BACpB,IACA,UAC4C;AAC5C,QAAM,aAAa,IAAI,KAAK,kBAAkB,IAAI,CAAC,MAAM,MAAM,CAAC,EAAE,CAAC;AACnE,QAAM,OAAO,MAAM,GAChB,WAAW,aAAa,EACxB,OAAO;AAAA,IACN;AAAA,IACA,6EAAqF,UAAU,uBAAuB;AAAA,MACpH;AAAA,IACF;AAAA,IACA,yEAAiF,UAAU,uBAAuB;AAAA,MAChH;AAAA,IACF;AAAA,IACA,2DAAmE,GAAG,aAAa;AAAA,EACrF,CAAC,EACA,MAAM,gBAAgB,MAAM,QAAQ,EACpC,QAAQ,SAAS,EACjB,QAAQ;AACX,SAAO,IAAI;AAAA,IACT,KAAK,IAAI,CAAC,MAAM;AAAA,MACd,EAAE;AAAA,MACF;AAAA,QACE,OAAO,OAAO,EAAE,OAAO,KAAK;AAAA,QAC5B,SAAS,OAAO,EAAE,SAAS,KAAK;AAAA,QAChC,UAAU,OAAO,EAAE,WAAW,KAAK;AAAA,MACrC;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAKO,IAAM,mBAAmB;AAKzB,IAAM,qBAAqB;AAM3B,IAAM,uBAAuB;AAQpC,SAAS,cAAc,MAAsB;AAC3C,SAAO,KACJ,YAAY,EACZ,QAAQ,oBAAoB,GAAG,EAC/B,QAAQ,cAAc,GAAG,EACzB,QAAQ,aAAa,GAAG,EACxB,QAAQ,mCAAmC,GAAG,EAC9C,QAAQ,SAAS,GAAG,EACpB,QAAQ,SAAS,GAAG,EACpB,KAAK;AACV;AAGA,SAAS,SAAS,YAAiC;AACjD,SAAO,IAAI,IAAI,WAAW,MAAM,YAAY,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAC3E;AAEA,SAAS,QAAQ,GAAgB,GAAwB;AACvD,MAAI,eAAe;AACnB,aAAW,KAAK,EAAG,KAAI,EAAE,IAAI,CAAC,EAAG;AACjC,QAAM,QAAQ,EAAE,OAAO,EAAE,OAAO;AAChC,SAAO,UAAU,IAAI,IAAI,eAAe;AAC1C;AAoBA,eAAsB,+BACpB,IACA,SACA,WAIC;AACD,QAAM,WAAW,cAAc,OAAO;AACtC,QAAM,iBAAiB,SAAS,QAAQ;AACxC,QAAM,gBAAgB,SAAS,UAAU;AACzC,QAAM,kBAAkB,eAAe,QAAQ;AAE/C,MAAI,CAAC,iBAAiB,CAAC,gBAAiB,QAAO,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,EAAE;AAExE,QAAM,OAAO,MAAM,GAChB,WAAW,aAAa,EACxB,OAAO,CAAC,MAAM,UAAU,WAAW,WAAW,OAAO,CAAC,EACtD,MAAM,WAAW,UAAU,IAAI,EAC/B,MAAM,gBAAgB,MAAM,SAAS,EACrC,QAAQ,gBAAgB,MAAM,EAC9B,MAAM,GAAI,EACV,QAAQ;AAEX,QAAM,QAA0B,CAAC;AACjC,QAAM,UAA4B,CAAC;AACnC,aAAW,OAAO,MAAM;AACtB,UAAM,SAAS,cAAc,IAAI,WAAW,EAAE;AAC9C,UAAM,QAAwB;AAAA,MAC5B,IAAI,IAAI;AAAA,MACR,QAAQ,IAAI;AAAA,MACZ,QAAQ,IAAI;AAAA,MACZ,OAAO,IAAI;AAAA,IACb;AACA,QAAI,iBAAiB,WAAW,UAAU;AACxC,YAAM,KAAK,KAAK;AAChB;AAAA,IACF;AACA,QAAI,CAAC,gBAAiB;AACtB,UAAM,eAAe,SAAS,MAAM;AACpC,QAAI,aAAa,OAAO,mBAAoB;AAC5C,QAAI,QAAQ,gBAAgB,YAAY,KAAK,sBAAsB;AACjE,cAAQ,KAAK,KAAK;AAAA,IACpB;AAAA,EACF;AACA,SAAO,EAAE,OAAO,QAAQ;AAC1B;AAQA,eAAsB,8BACpB,IACA,OACA,WACgE;AAChE,MAAI,MAAM,KAAK,MAAM,GAAI,QAAO,CAAC;AACjC,QAAM,OAAO,MAAM,GAChB,WAAW,aAAa,EACxB,OAAO,CAAC,MAAM,WAAW,QAAQ,CAAC,EAClC,MAAM,aAAa,MAAM,YAAY,EACrC,MAAM,gBAAgB,MAAM,SAAS,EACrC,MAAM,CAAC,OAAO,iBAA0B,GAAG,IAAI,OAAO,CAAC,mBAAmB,KAAK,IAAI,EACnF,QAAQ;AACX,SAAO,KAAK,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,QAAQ,EAAE,SAAS,QAAQ,EAAE,OAAO,EAAE;AAC5E;AAOA,eAAsB,yBACpB,IACA,KACA,aACe;AACf,MAAI,IAAI,WAAW,EAAG;AACtB,QAAM,GACH,YAAY,aAAa,EACzB,IAAI;AAAA,IACH,QAAQ;AAAA,IACR,aAAa,6DAAqE,WAAW,+BAA+B,WAAW;AAAA,EACzI,CAAC,EACA,MAAM,MAAM,MAAM,GAAG,EACrB,MAAM,UAAU,KAAK,KAAK,EAC1B,QAAQ;AACb;AAOA,eAAsB,wBACpB,IACA,QACA,MAAM,KACa;AACnB,QAAM,OAAO,GAAG,WAAW,aAAa,EAAE,OAAO,CAAC,aAAa,CAAC;AAChE,QAAM,OAAO,MAAM,sBAAsB,MAAM,MAAM,EAClD,MAAM,eAAe,UAAU,IAAI,EACnC,MAAM,GAAG,EACT,QAAQ;AACX,SAAO,KAAK,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,MAAmB,MAAM,QAAQ,MAAM,EAAE;AACzF;AAIA,eAAsB,mBAAmB,IAAQ,KAAmC;AAClF,QAAM,GACH,WAAW,aAAa,EACxB,OAAO;AAAA,IACN,IAAI,IAAI;AAAA,IACR,eAAe,IAAI;AAAA,IACnB,SAAS,IAAI;AAAA,IACb,WAAW,IAAI;AAAA,IACf,MAAM,IAAI;AAAA,IACV,OAAO,IAAI;AAAA,IACX,OAAO,IAAI;AAAA,IACX,SAAS,IAAI;AAAA,IACb,cAAc,IAAI;AAAA,IAClB,YAAY,IAAI;AAAA,IAChB,KAAK,IAAI;AAAA,IACT,cAAc,IAAI;AAAA,IAClB,QAAQ,IAAI;AAAA,IACZ,eAAe,IAAI;AAAA,IACnB,mBAAmB,IAAI;AAAA,IACvB,YAAY,IAAI,aAAa;AAAA,IAC7B,aAAa,IAAI,cAAc;AAAA,IAC/B,eAAe,IAAI,gBAAgB;AAAA,IACnC,aAAa,IAAI,cAAc;AAAA,IAC/B,gBAAgB,IAAI,iBAAiB;AAAA,IACrC,gBAAgB,IAAI,iBAAiB;AAAA,IACrC,eAAe,IAAI,eAAe;AAAA,EACpC,CAAC,EACA,WAAW,CAAC,OAAO,GAAG,OAAO,IAAI,EAAE,UAAU,CAAC,EAC9C,QAAQ;AACb;AASA,eAAsB,sBACpB,IACA,IACA,OACA,QACkB;AAClB,QAAM,MAAM,MAAM,GACf,YAAY,aAAa,EACzB,IAAI,EAAE,QAAQ,aAAa,YAAY,OAAO,aAAa,OAAO,CAAC,EACnE,MAAM,MAAM,KAAK,EAAE,EACnB,MAAM,UAAU,KAAK,KAAK,EAC1B,iBAAiB;AACpB,SAAO,OAAO,IAAI,cAAc,IAAI;AACtC;AASA,eAAsB,mBAAmB,IAAQ,QAA2C;AAC1F,QAAM,MAAM,MAAM,GACf,YAAY,aAAa,EACzB,IAAI,EAAE,QAAQ,OAAO,CAAC,EACtB,MAAM,UAAU,KAAK,KAAK,EAC1B;AAAA,IAAM;AAAA,IAAM;AAAA,IAAM,CAAC,OAClB,sBAAsB,GAAG,WAAW,aAAa,EAAE,OAAO,IAAI,GAAG,MAAM;AAAA,EACzE,EACC,iBAAiB;AACpB,SAAO,OAAO,IAAI,cAAc;AAClC;AAUA,eAAsB,6BACpB,IACA,WAOA,SAA8B,MACZ;AAClB,MAAI,cAAc,GAAI,QAAO;AAC7B,QAAM,MAAM,MAAM,GACf,YAAY,aAAa,EACzB;AAAA,IACC,WAAW,OACP,EAAE,eAAe,UAAU,IAC3B;AAAA,MACE,eAAe;AAAA,MACf,aAAa,OAAO;AAAA,MACpB,gBAAgB,OAAO;AAAA,MACvB,gBAAgB,OAAO;AAAA,IACzB;AAAA,EACN,EACC,MAAM,qBAAqB,KAAK,SAAS,EACzC,iBAAiB;AACpB,MAAI,OAAO,IAAI,cAAc,IAAI,EAAG,QAAO;AAI3C,QAAM,WAAW,MAAM,GACpB,WAAW,aAAa,EACxB,OAAO,IAAI,EACX,MAAM,qBAAqB,KAAK,SAAS,EACzC,iBAAiB;AACpB,SAAO,aAAa;AACtB;AAiBA,eAAsB,gBAAgB,IAAQ,IAAY,KAA6B;AACrF,QAAM,MAAM,MAAM,GACf,YAAY,aAAa,EACzB,IAAI,EAAE,eAAe,IAAI,YAAY,EAAE,CAAC,EACxC,MAAM,MAAM,KAAK,EAAE,EACnB,MAAM,iBAAiB,KAAK,SAAS,EACrC,MAAM,iBAAiB,MAAM,IAAI,EACjC,iBAAiB;AACpB,SAAO,OAAO,IAAI,cAAc,IAAI;AACtC;AAwBA,eAAsB,yBACpB,IACA,WAC0C;AAC1C,QAAM,OAAO,MAAM,GAChB,WAAW,aAAa,EACxB,OAAO;AAAA,IACN;AAAA,IACA,CAAC,OAAO,GAAG,GAAG,SAAiB,EAAE,GAAG,GAAG;AAAA;AAAA;AAAA;AAAA,IAIvC,uEAA+E;AAAA,MAC7E;AAAA,IACF;AAAA,EACF,CAAC,EACA,MAAM,iBAAiB,KAAK,SAAS,EACrC,MAAM,gBAAgB,MAAM,SAAS,EACrC,MAAM,iBAAiB,MAAM,IAAI,EACjC,QAAQ,SAAS,EACjB,QAAQ;AACX,SAAO,IAAI;AAAA,IACT,KAAK,IAAI,CAAC,MAAM;AAAA,MACd,EAAE;AAAA,MACF,EAAE,OAAO,OAAO,EAAE,CAAC,KAAK,GAAG,WAAW,OAAO,EAAE,WAAW,KAAK,EAAE;AAAA,IACnE,CAAC;AAAA,EACH;AACF;","names":[]}

package/dist/{svelte-codemods-WSV2FGNG.js → svelte-codemods-QWGIRNN6.js}

@@ -5,20 +5,20 @@ import {
   appendSkipNotice,
   fleetWorkdir,
   prepareFleetSites
-} from "./chunk-LM2NHRCJ.js";
+} from "./chunk-SHGIDTYF.js";
 import {
   resolveSites
-} from "./chunk-Z2K4JPQ3.js";
+} from "./chunk-H445EH33.js";
 import {
   svelteCodemods
-} from "./chunk-2LYOAB2E.js";
+} from "./chunk-RRE74VWI.js";
 import "./chunk-J7SZQUCW.js";
-import "./chunk-ZQV7UQNE.js";
+import "./chunk-SQ4FSNYL.js";
 import "./chunk-Z3JXLULD.js";
 import "./chunk-LBYOLBW7.js";
 import "./chunk-RARREDQE.js";
 import "./chunk-XXTZBPUY.js";
-import "./chunk-AVEQUR44.js";
+import "./chunk-EASYCD6F.js";
 
 // src/cli/commands/svelte-codemods.ts
 import { resolve } from "path";
@@ -51,4 +51,4 @@ async function runSvelteCodemodsCommand(site, opts) {
 export {
   runSvelteCodemodsCommand
 };
-//# sourceMappingURL=svelte-codemods-WSV2FGNG.js.map
+//# sourceMappingURL=svelte-codemods-QWGIRNN6.js.map

package/dist/{sync-K3PKHVLH.js → sync-NKPDCMYW.js}

@@ -1,15 +1,15 @@
 import {
   checkFleetParity,
   formatParityResult
-} from "./chunk-KZRR4NFG.js";
-import "./chunk-WVNDEYXL.js";
+} from "./chunk-D3CTOCUR.js";
+import "./chunk-GEUC5VGM.js";
 import {
   formatReapSummary,
   importFleetState
-} from "./chunk-6R56OKJZ.js";
+} from "./chunk-UIITN37J.js";
 import "./chunk-F3JWOPTG.js";
 import "./chunk-VAD43MOR.js";
-import "./chunk-3Z6X3BHU.js";
+import "./chunk-KN52PM63.js";
 
 // src/db/sync.ts
 async function syncFleetState(db, io) {
@@ -43,4 +43,4 @@ export {
   formatSyncResult,
   syncFleetState
 };
-//# sourceMappingURL=sync-K3PKHVLH.js.map
+//# sourceMappingURL=sync-NKPDCMYW.js.map

package/dist/{sync-configs-RRIHNLIJ.js → sync-configs-HGLQV55H.js}

@@ -5,10 +5,10 @@ import {
   appendSkipNotice,
   fleetWorkdir,
   prepareFleetSites
-} from "./chunk-LM2NHRCJ.js";
+} from "./chunk-SHGIDTYF.js";
 import {
   resolveSites
-} from "./chunk-Z2K4JPQ3.js";
+} from "./chunk-H445EH33.js";
 import {
   ALL_CONFIG_NAMES,
   CANONICAL_GITIGNORE_ENTRIES,
@@ -16,8 +16,8 @@ import {
   mergeGitignore,
   planTemplateDiffs,
   syncConfigs
-} from "./chunk-FUWFLAWQ.js";
-import "./chunk-ZQV7UQNE.js";
+} from "./chunk-IMYL67JV.js";
+import "./chunk-SQ4FSNYL.js";
 import {
   ALL_TEMPLATES,
   templatesByName
@@ -26,7 +26,7 @@ import "./chunk-Z3JXLULD.js";
 import "./chunk-LBYOLBW7.js";
 import "./chunk-RARREDQE.js";
 import "./chunk-XXTZBPUY.js";
-import "./chunk-AVEQUR44.js";
+import "./chunk-EASYCD6F.js";
 
 // src/cli/commands/sync-configs.ts
 import { readFile } from "fs/promises";
@@ -107,4 +107,4 @@ async function runSyncConfigsCommand(site, opts) {
 export {
   runSyncConfigsCommand
 };
-//# sourceMappingURL=sync-configs-RRIHNLIJ.js.map
+//# sourceMappingURL=sync-configs-HGLQV55H.js.map

package/dist/{upgrade-VTD6V4HS.js → upgrade-WZ44IARG.js}

@@ -5,21 +5,21 @@ import {
   appendSkipNotice,
   fleetWorkdir,
   prepareFleetSites
-} from "./chunk-LM2NHRCJ.js";
+} from "./chunk-SHGIDTYF.js";
 import {
   resolveSites
-} from "./chunk-Z2K4JPQ3.js";
+} from "./chunk-H445EH33.js";
 import {
   upgradeSvelte4to5
-} from "./chunk-BCKEP5S6.js";
+} from "./chunk-ECDJDHKT.js";
 import "./chunk-J7SZQUCW.js";
-import "./chunk-ZQV7UQNE.js";
+import "./chunk-SQ4FSNYL.js";
 import "./chunk-OTGB6YQO.js";
 import "./chunk-Z3JXLULD.js";
 import "./chunk-LBYOLBW7.js";
 import "./chunk-RARREDQE.js";
 import "./chunk-XXTZBPUY.js";
-import "./chunk-AVEQUR44.js";
+import "./chunk-EASYCD6F.js";
 
 // src/cli/commands/upgrade.ts
 import { resolve } from "path";
@@ -60,4 +60,4 @@ async function runUpgradeCommand(upgradeName, site, opts = {}) {
 export {
   runUpgradeCommand
 };
-//# sourceMappingURL=upgrade-VTD6V4HS.js.map
+//# sourceMappingURL=upgrade-WZ44IARG.js.map

package/dist/util/git.d.ts

@@ -72,20 +72,59 @@ declare function isOwnerRepo(repo: string): boolean;
  * before reusing it. Returns false if either side is unparseable.
  */
 declare function sameOwnerRepo(a: string, b: string): boolean;
-/** Derive `owner/repo` from a git remote URL (https or scp-style). Null if unparseable. */
+/**
+ * Derive `owner/repo` from a GITHUB git remote URL (https, ssh, git:// or
+ * scp-style). `null` when the remote is not a GitHub repository URL: another
+ * host, a traversal segment, a nested or too-short path, a local filesystem
+ * path, anything unparseable.
+ *
+ * PARSED, not pattern-matched (#712). The previous implementation stripped
+ * `^https?://[^/]+/` — throwing the HOST away — and returned the last two path
+ * segments of whatever remained, so each of these yielded a confident,
+ * correctly-shaped GitHub write target for a repository the code was not in:
+ * `https://gitlab.com/acme/site.git` -> `acme/site`;
+ * `https://user@evil.example.com/attacker/target` -> `attacker/target`;
+ * `https://github.com/ok/repo/../../evil/target` -> `evil/target`;
+ * `https://github.com/ok/repo?x=/evil/other` -> `evil/other`;
+ * `/Users/me/Documents/GitHub/reddoor-starter` -> `GitHub/reddoor-starter`.
+ *
+ * A `..` anywhere in the raw remote is REFUSED rather than resolved: `new URL`
+ * (like curl, and so git-over-https) collapses `ok/repo/../../evil/target` to
+ * `/evil/target`, while ssh hands the literal path to the server. The two
+ * transports disagree about which repository the remote names, so neither
+ * answer is proven — and `..` is already inadmissible in an identity this
+ * project accepts (see {@link isOwnerRepo}).
+ */
 declare function parseOwnerRepo(remoteUrl: string): string | null;
 /** `origin` remote URL for a checkout, trimmed. Throws (via git) if there's no origin. */
 declare function getRemoteUrl(cwd: string): Promise<string>;
 /**
- * Resolve the `owner/repo` a recipe will act on. An explicit `site.gitRepo`
- * (Airtable, or a JSON inventory) wins; otherwise derive it from the checkout's
- * `origin`.
+ * Resolve the `owner/repo` a recipe will act on, and PROVE it rather than infer
+ * it. An explicit `site.gitRepo` (Airtable, or a JSON inventory) wins;
+ * otherwise it is derived from the checkout's `origin`.
+ *
+ * Returns `null` for the two states that genuinely mean "nothing is wired
+ * here": `site.path` is not inside a git work tree, and the work tree has no
+ * `origin`. Everything else THROWS, naming both sides, because callers write
+ * repo secrets, branch-protection rulesets and pull requests at this identity
+ * — a wrong one is not cosmetic (#712):
  *
- * Returns `null` when there is nothing to act on (no `gitRepo`, no origin) — a
- * benign "nothing wired" state. THROWS when a value IS present but does not
- * match the strict `owner/repo` shape: callers write repo secrets, branch
- * protection and pull requests at this identity, so a typo'd or
- * attacker-controlled value must be rejected here, before the first `gh` call.
+ *  - a value that is present but is not a clean `owner/repo`;
+ *  - an `origin` that is not a GitHub repository URL. A GitLab or impostor host
+ *    answered with a GitHub write target is the core of this class;
+ *  - a `site.path` that is not the ROOT of its work tree. `git remote get-url`
+ *    walks UP, so a site directory with no clone in it yet — exactly what the
+ *    positional `/new-site` route points at — resolved to whatever repository
+ *    happened to enclose it. Run a recipe against such a directory from under
+ *    the maintenance checkout and the token secret plus a ruleset landed on
+ *    `reddoorla/reddoor-maintenance`. No attacker required; a wrong `cd` was
+ *    enough. The cost is that "run me from a subdirectory" now refuses instead
+ *    of guessing — the refusal names the root, so the fix is one `cd`, or an
+ *    explicit identity;
+ *  - any git failure that is not one of the two benign shapes above. "There is
+ *    no remote" and "git could not run" used to be the same answer to the
+ *    caller, so `selfUpdating` printed "add an origin remote" for a missing
+ *    binary, an unreadable path and a dubious-ownership refusal alike.
  *
  * Extracted from `self-updating`'s private `resolveRepo` because `prismic-ci`
  * read `site.gitRepo` directly and therefore refused every POSITIONAL run with

package/dist/util/git.js

@@ -19,7 +19,7 @@ import {
   resolveOwnerRepo,
   sameOwnerRepo,
   stageAll
-} from "../chunk-AVEQUR44.js";
+} from "../chunk-EASYCD6F.js";
 export {
   OWNER_REPO_RE,
   branchName,

package/dist/{webflow-IRKOIT7S.js → webflow-624FEBFD.js}

@@ -1,9 +1,9 @@
-import {
-  assetRef
-} from "./chunk-UWJZXL2D.js";
 import {
   runMigration
 } from "./chunk-6DOFNDXU.js";
+import {
+  assetRef
+} from "./chunk-UWJZXL2D.js";
 
 // src/cli/commands/webflow.ts
 import { mkdir, readFile, writeFile } from "fs/promises";
@@ -545,4 +545,4 @@ async function runWebflowCommand(action, target, opts = {}) {
 export {
   runWebflowCommand
 };
-//# sourceMappingURL=webflow-IRKOIT7S.js.map
+//# sourceMappingURL=webflow-624FEBFD.js.map

package/dist/{websites-TB4TCAWM.js → websites-6DHIHJ2D.js}

@@ -6,6 +6,7 @@ import {
   SEVERITY_RANK,
   WEBSITES_TABLE,
   allActionableVulnsTransitive,
+  analyticsHealthFields,
   getWebsiteBySlug,
   isArchivedStatus,
   isDashboardVisible,
@@ -33,7 +34,7 @@ import {
   updateScores,
   updateSecurityCounts,
   updateSiteField
-} from "./chunk-3Z6X3BHU.js";
+} from "./chunk-KN52PM63.js";
 export {
   ACTIVE_STATUSES,
   ARCHIVED_STATUSES,
@@ -42,6 +43,7 @@ export {
   SEVERITY_RANK,
   WEBSITES_TABLE,
   allActionableVulnsTransitive,
+  analyticsHealthFields,
   getWebsiteBySlug,
   isArchivedStatus,
   isDashboardVisible,
@@ -70,4 +72,4 @@ export {
   updateSecurityCounts,
   updateSiteField
 };
-//# sourceMappingURL=websites-TB4TCAWM.js.map
+//# sourceMappingURL=websites-6DHIHJ2D.js.map

package/dist/{write-audits-to-airtable-53EVXKMU.js → write-audits-to-airtable-BIK6LNVC.js}

@@ -3,15 +3,15 @@ import {
   formatFleetWriteSummary,
   writeAuditsToAirtable,
   writeFleetAuditsToAirtable
-} from "./chunk-5EEMTJMT.js";
-import "./chunk-XN37VTDB.js";
-import "./chunk-SVAAONYB.js";
+} from "./chunk-ZH5LOQET.js";
+import "./chunk-37B4LVB3.js";
+import "./chunk-WQLNUEZL.js";
 import "./chunk-5L3FPQIJ.js";
-import "./chunk-3Z6X3BHU.js";
+import "./chunk-KN52PM63.js";
 export {
   fleetWriteFailed,
   formatFleetWriteSummary,
   writeAuditsToAirtable,
   writeFleetAuditsToAirtable
 };
-//# sourceMappingURL=write-audits-to-airtable-53EVXKMU.js.map
+//# sourceMappingURL=write-audits-to-airtable-BIK6LNVC.js.map

package/dist/write-audits-to-airtable-BIK6LNVC.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reddoorla/maintenance",
-  "version": "0.95.0",
+  "version": "0.96.0",
   "description": "Canonical maintenance configs, audits, and recipes for the reddoor stack.",
   "type": "module",
   "license": "MIT",
@@ -117,8 +117,9 @@
     "zod": "^4.4.3"
   },
   "scripts": {
-    "verify": "pnpm typecheck && pnpm lint && pnpm build && pnpm test:coverage && pnpm test:dist",
+    "verify": "pnpm typecheck && pnpm lint && pnpm check:match-harness-snapshots && pnpm build && pnpm test:coverage && pnpm test:dist",
     "build": "tsup",
+    "check:match-harness-snapshots": "node scripts/check-match-harness-snapshots.mjs",
     "dev": "tsup --watch",
     "pretest": "pnpm run build",
     "test": "vitest run",

package/dist/airtable-JGCPS7JH.js

@@ -1,9 +0,0 @@
-import {
-  fromAirtableBase
-} from "./chunk-5GUJ36TL.js";
-import "./chunk-3Z6X3BHU.js";
-import "./chunk-RARREDQE.js";
-export {
-  fromAirtableBase
-};
-//# sourceMappingURL=airtable-JGCPS7JH.js.map

package/dist/chunk-4AIYWWKV.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/alerts/digest-collectors.ts"],"sourcesContent":["// src/alerts/digest-collectors.ts\nimport type { AttentionItem } from \"./attention.js\";\nimport {\n  allActionableVulnsTransitive,\n  siteSlug,\n  ACTIVE_STATUSES,\n  isPreLaunch,\n  type WebsiteRow,\n} from \"../reports/airtable/websites.js\";\nimport type { ReportRow } from \"../reports/airtable/reports.js\";\nimport { approveBlockers } from \"../reports/preflight.js\";\n\n/** Build the same `/s/<slug>` dashboard link the M3 ready-section uses, trailing-slash-safe.\n *  An empty Name slugs to \"\" and `/s/` is a dead link — fall back to the fleet homepage,\n *  exactly like the ready-section does. */\nfunction dashboardUrl(baseUrl: string, siteName: string): string {\n  const root = baseUrl.replace(/\\/$/, \"\");\n  const slug = siteSlug(siteName);\n  return slug ? `${root}/s/${slug}` : root;\n}\n\n/**\n * A GitHub-signals sweep older than this (or never run) is no longer trustworthy:\n * a repo whose nightly probe THREW stops being re-swept, so its persisted\n * `Default Branch CI` / `Renovate Failing CIs` freeze at their last value forever\n * — a phantom 🔴 that can never clear. 3 days ≈ 3× the daily sweep interval, so a\n * single missed/flaky run doesn't drop a real signal. The CI/Renovate collectors\n * (only) skip a site whose `githubSignalsAt` is staler than this. Vuln/Lighthouse/\n * delivery signals come from other sweeps and are unaffected.\n */\nconst GITHUB_SIGNALS_STALE_DAYS = 3;\nconst MS_PER_DAY = 24 * 60 * 60 * 1000;\n\n/** True when a site's GitHub-signals sweep is too old (or never ran) to trust the\n *  persisted CI/Renovate fields. A null `githubSignalsAt` (never swept) is stale —\n *  there's no sweep to vouch for the values. A future timestamp (now - swept < 0)\n *  is fresh. `now` is injected so the gate is testable. */\nfunction gitHubSignalsStale(swept: string | null, now: Date): boolean {\n  if (swept === null) return true;\n  const ageMs = now.getTime() - Date.parse(swept);\n  if (!Number.isFinite(ageMs)) return true; // unparseable timestamp → don't trust it\n  return ageMs > GITHUB_SIGNALS_STALE_DAYS * MS_PER_DAY;\n}\n\n/** Renovate auto-fix dispatches for one vuln episode before it's \"exhausted\" (manual fix needed). */\nconst AUTO_FIX_EXHAUSTED_CYCLES = 3;\n\n/**\n * One attention item per site carrying current critical+high vulns (medium/low omitted\n * per the locked threshold). PURE: takes already-fetched Websites rows. `metric` is the\n * critical+high count (so a rising count diffs as WORSE); `severity` is `critical` when\n * any critical exists, else `warning`. Null counts (never audited) read as 0 → skipped.\n * Once `securityAutoFixAttempts` reaches AUTO_FIX_EXHAUSTED_CYCLES the item is flagged\n * `autoFixExhausted` (forced-critical, escalated title) — Renovate tried and couldn't fix it.\n * EXCEPT when the persisted advisories prove every critical/high vuln is TRANSITIVE: then\n * nightly dispatches were green no-ops (no direct dep to bump — the fix rides the weekly\n * lockfile window), \"auto-fix failed\" would be a lie, and a stale pre-fix counter must not\n * escalate (Sonder said \"auto-fix failed (5×)\" on exactly this, 2026-08-10). Those sites get\n * an honest transitive-only title, keep count-based severity, and stay out of the digest\n * email (amber cockpit Watch still shows them). Unknown relationship data never mutes.\n *\n * Emission is UNCONDITIONAL — every surface applies its own policy on top:\n *   - digest email: includes a vuln only when `autoFixExhausted` (the operator hears\n *     about a vuln only after Renovate tried and failed; before that the fleet is\n *     still self-patching) — runDigest filters\n *   - cockpit: non-exhausted vuln → amber Watch; exhausted → hard break (assignTier),\n *     and only an exhausted vuln pierces the pre-launch mute (piercesPreLaunchMute)\n */\nexport function collectVulnAlerts(sites: WebsiteRow[], baseUrl: string): AttentionItem[] {\n  const items: AttentionItem[] = [];\n  for (const s of sites) {\n    const critical = s.securityVulnsCritical ?? 0;\n    const high = s.securityVulnsHigh ?? 0;\n    const metric = critical + high;\n    if (metric <= 0) continue;\n    const attempts = s.securityAutoFixAttempts ?? 0;\n    const transitiveOnly = allActionableVulnsTransitive(s.securityAdvisories);\n    const exhausted = !transitiveOnly && attempts >= AUTO_FIX_EXHAUSTED_CYCLES;\n    const noun = metric === 1 ? \"vuln\" : \"vulns\";\n    items.push({\n      key: `vuln:${s.id}`,\n      kind: \"vuln\",\n      siteName: s.name,\n      title: exhausted\n        ? `${metric} critical/high ${noun} — auto-fix failed (${attempts}×)`\n        : transitiveOnly\n          ? `${metric} critical/high ${noun} — transitive-only, fix rides the weekly lockfile window`\n          : `${metric} critical/high ${noun}`,\n      url: dashboardUrl(baseUrl, s.name),\n      severity: exhausted || critical > 0 ? \"critical\" : \"warning\",\n      metric,\n      ...(exhausted ? { autoFixExhausted: true } : {}),\n    });\n  }\n  return items;\n}\n\n/** Absolute floor below which a Lighthouse category is \"Needs attention\" (Tucker's call). */\nconst LIGHTHOUSE_FLOOR = 75;\n\n/** The four Lighthouse categories, each mapped to its WebsiteRow score field, URL slug,\n *  and the human label rendered in the digest title. Order is the operator's reading order. */\nconst LIGHTHOUSE_CATEGORIES: ReadonlyArray<{\n  field: \"pScore\" | \"rScore\" | \"bpScore\" | \"seoScore\";\n  slug: string;\n  label: string;\n}> = [\n  { field: \"pScore\", slug: \"performance\", label: \"Performance\" },\n  { field: \"rScore\", slug: \"accessibility\", label: \"Accessibility\" },\n  { field: \"bpScore\", slug: \"best-practices\", label: \"Best Practices\" },\n  { field: \"seoScore\", slug: \"seo\", label: \"SEO\" },\n];\n\n/**\n * One attention item per Lighthouse category below the absolute floor (75) for each site.\n * PURE: takes already-fetched Websites rows. Categories are Performance/Accessibility/\n * Best-Practices/SEO. A null score (never audited) or a score >= 75 is skipped. The\n * `metric` is the DEFICIT (`100 - score`): a lower score → higher metric, so a category\n * that drops further diffs as WORSE and one that first crosses below 75 diffs as NEW —\n * which is how `diffAttention`'s \"WORSE on increase\" rule reads an inverted score. `key`\n * is `lighthouse:<siteId>:<categorySlug>`, so the four categories stay distinct per site.\n */\nexport function collectLighthouseAlerts(sites: WebsiteRow[], baseUrl: string): AttentionItem[] {\n  const items: AttentionItem[] = [];\n  for (const s of sites) {\n    for (const cat of LIGHTHOUSE_CATEGORIES) {\n      const score = s[cat.field];\n      if (score === null || score >= LIGHTHOUSE_FLOOR) continue;\n      items.push({\n        key: `lighthouse:${s.id}:${cat.slug}`,\n        kind: \"lighthouse\",\n        siteName: s.name,\n        title: `Lighthouse ${cat.label} ${score} (below ${LIGHTHOUSE_FLOOR})`,\n        url: dashboardUrl(baseUrl, s.name),\n        severity: \"warning\",\n        metric: 100 - score,\n      });\n    }\n  }\n  return items;\n}\n\n/**\n * One attention item per report whose `deliveryStatus` is a failure (`bounced` or\n * `complained` — `delivered`/`pending` are ignored). PURE: takes already-fetched\n * Reports rows + a record-id→site map. A complaint ranks above a bounce (locked\n * threshold), so `severity` is `critical` for complained / `warning` for bounced.\n * `metric` is 1 (a binary event). Orphans (siteId not in the map) are skipped, as\n * the M3 ready-section does, so the digest never renders a broken link. The diff\n * key is the report RECORD id, so two failures on one site stay distinct.\n */\n/**\n * One attention item per unsent draft whose send is ALREADY known to fail\n * (approveBlockers: recipients / header image / report scores). An APPROVED one\n * is critical — the next 09:23 UTC run will go red on it; a pending one is a\n * warning — approving it just schedules that failure. Keyed `preflight:<reportId>`.\n * PURE; same predicate the approve gate and the dashboard chip use.\n */\nexport function collectPreflightBlocked(\n  reports: ReportRow[],\n  sitesById: Map<string, WebsiteRow>,\n  baseUrl: string,\n): AttentionItem[] {\n  const items: AttentionItem[] = [];\n  for (const r of reports) {\n    if (!r.draftReady || r.sentAt !== null) continue;\n    // The approved state rides the KEY so a pending→approved escalation with\n    // unchanged blockers re-news as a fresh critical instead of diffing\n    // \"standing\" against its old warning self.\n    const state = r.approvedToSend ? \"approved\" : \"pending\";\n    const site = sitesById.get(r.siteId);\n    if (!site) {\n      // A dangling/empty Site link is itself a send blocker (sendApprovedReports\n      // fails with \"Site row not found\") — surface it; the empty-slug\n      // dashboardUrl fallback yields the fleet root, not a broken /s/ link.\n      items.push({\n        key: `preflight:${r.id}:${state}`,\n        kind: \"preflight\",\n        siteName: \"(unlinked site)\",\n        title: r.approvedToSend\n          ? `Approved ${r.reportType} will fail at send — site-not-found`\n          : `${r.reportType} draft can't be approved — site-not-found`,\n        url: dashboardUrl(baseUrl, \"\"),\n        severity: r.approvedToSend ? \"critical\" : \"warning\",\n        metric: 1,\n      });\n      continue;\n    }\n    const fails = approveBlockers(site, r).filter((f) => f.level === \"fail\");\n    if (fails.length === 0) continue;\n    const first = fails[0]!;\n    const more = fails.length > 1 ? ` (+${fails.length - 1} more)` : \"\";\n    items.push({\n      key: `preflight:${r.id}:${state}`,\n      kind: \"preflight\",\n      siteName: site.name,\n      title: r.approvedToSend\n        ? `Approved ${r.reportType} will fail at send — ${first.check}${more}`\n        : `${r.reportType} draft can't be approved — ${first.check}${more}`,\n      url: dashboardUrl(baseUrl, site.name),\n      severity: r.approvedToSend ? \"critical\" : \"warning\",\n      metric: fails.length,\n    });\n  }\n  return items;\n}\n\nexport function collectDeliveryFailures(\n  reports: ReportRow[],\n  sitesById: Map<string, WebsiteRow>,\n  baseUrl: string,\n): AttentionItem[] {\n  const items: AttentionItem[] = [];\n  for (const r of reports) {\n    if (r.deliveryStatus !== \"bounced\" && r.deliveryStatus !== \"complained\") continue;\n    const site = sitesById.get(r.siteId);\n    if (!site) continue; // orphan → skip rather than render a broken link\n    const complained = r.deliveryStatus === \"complained\";\n    items.push({\n      key: `delivery:${r.id}`,\n      kind: \"delivery\",\n      siteName: site.name,\n      title: complained ? \"Spam complaint on a sent report\" : \"A sent report bounced\",\n      url: dashboardUrl(baseUrl, site.name),\n      severity: complained ? \"critical\" : \"warning\",\n      metric: 1,\n    });\n  }\n  return items;\n}\n\n/**\n * One attention item per site carrying failing Renovate PRs, read from the\n * slice-2a-persisted `renovateFailingCis` field (the nightly github-signals sweep\n * populates it). PURE. Keyed `renovate:<siteId>` so the digest and the cockpit\n * share one diff key. `metric` is the count (a rising count diffs WORSE); severity\n * `warning`. Null/0 → skipped. A site whose `githubSignalsAt` is >3 days stale (or\n * null) is ALSO skipped — a repo that stopped being swept must not show a phantom\n * count forever (`now` injected, defaults to wall-clock).\n */\nexport function collectRenovateAlerts(\n  sites: WebsiteRow[],\n  baseUrl: string,\n  now: Date = new Date(),\n): AttentionItem[] {\n  const items: AttentionItem[] = [];\n  for (const s of sites) {\n    if (gitHubSignalsStale(s.githubSignalsAt, now)) continue;\n    const n = s.renovateFailingCis ?? 0;\n    if (n <= 0) continue;\n    items.push({\n      key: `renovate:${s.id}`,\n      kind: \"renovate\",\n      siteName: s.name,\n      title: `${n} Renovate ${n === 1 ? \"PR\" : \"PRs\"} failing CI`,\n      url: dashboardUrl(baseUrl, s.name),\n      severity: \"warning\",\n      metric: n,\n    });\n  }\n  return items;\n}\n\n/**\n * One attention item per site whose persisted default-branch CI rollup is\n * `failing` (slice 2a). PURE. `metric` 1 (binary); severity `warning`. Any other\n * state (passing/pending/none) or null is skipped. A site whose `githubSignalsAt`\n * is >3 days stale (or null) is ALSO skipped — a repo that stopped being swept must\n * not show a phantom 🔴 forever (`now` injected, defaults to wall-clock).\n */\nexport function collectCiAlerts(\n  sites: WebsiteRow[],\n  baseUrl: string,\n  now: Date = new Date(),\n): AttentionItem[] {\n  const items: AttentionItem[] = [];\n  for (const s of sites) {\n    if (gitHubSignalsStale(s.githubSignalsAt, now)) continue;\n    if (s.defaultBranchCi !== \"failing\") continue;\n    items.push({\n      key: `ci:${s.id}`,\n      kind: \"ci\",\n      siteName: s.name,\n      title: \"Default-branch CI failing\",\n      url: dashboardUrl(baseUrl, s.name),\n      severity: \"warning\",\n      metric: 1,\n    });\n  }\n  return items;\n}\n\n/**\n * A soft-fail older than this is no longer a trustworthy CURRENT signal. Drafting\n * self-clears `analyticsSoftFailAt` on the next clean enrichment, so a non-null\n * value normally means \"errored on the most recent draft and hasn't recovered\" —\n * but a site that stopped being drafted (freq→None, deprecated) would otherwise\n * show a phantom forever. 45 days covers a monthly cadence + margin; older drops.\n */\nconst ANALYTICS_SOFT_FAIL_STALE_DAYS = 45;\n\n/**\n * One attention item per site whose last draft's GA/Search enrichment ERRORED, read\n * from the `analyticsSoftFailAt` timestamp (drafting sets it on a soft-fail, clears\n * it on a clean enrichment). PURE. Keyed `analytics:<siteId>` so the digest and the\n * cockpit share one diff key; `metric` 1 (binary), severity `warning`. A null\n * timestamp (clean, or the operator-added `Analytics soft-fail at` column absent) is\n * skipped, as is one staler than {@link ANALYTICS_SOFT_FAIL_STALE_DAYS}. On a\n * FLEET-WIDE subject outage many sites surface this at once — that breadth IS the\n * signal here; the report cron additionally emails a single concise fleet-wide alert\n * (see `assessAnalyticsAlert`). `now` injected, defaults to wall-clock.\n */\n/** A form-e2e run older than this can't confirm the CURRENT widget state. The run\n *  is nightly, so 3 days (mirrors GITHUB_SIGNALS_STALE_DAYS) tolerates a weekend of\n *  runner flakes without letting a months-old verdict drive an alarm. */\nconst TURNSTILE_WIDGET_STALE_DAYS = 3;\n\n/**\n * One CRITICAL attention item per site with `Require Turnstile` ON whose Turnstile\n * widget is known BROKEN (`turnstileWidget === \"fail\"`, fresh per\n * {@link TURNSTILE_WIDGET_STALE_DAYS}). That combination silently buckets 100% of the\n * site's real leads (token-less submissions escalate to spam_auto with notify skipped),\n * so the operator's inbox just goes quiet. PURE. Keyed `turnstile:<siteId>`. Because\n * this is an AttentionItem it rides assignTier's items short-circuit, which sits ABOVE\n * the accepted-watch mute loop — an accept key can never silence it. A null verdict or\n * a stale sweep is NOT alarmed here; assignTier raises those as an acceptable\n * \"can't verify\" watch instead. `now` injected, defaults to wall-clock.\n */\nexport function collectTurnstileGuardrailAlerts(\n  sites: WebsiteRow[],\n  baseUrl: string,\n  now: Date = new Date(),\n): AttentionItem[] {\n  const items: AttentionItem[] = [];\n  for (const s of sites) {\n    if (!s.requireTurnstile || s.turnstileWidget !== \"fail\") continue;\n    // The stamp of the audit that OWNS the verdict, not function-health's.\n    // `form-e2e` took ownership of `turnstileWidget` (#689) because only it opens\n    // a browser on the real widget; function-health merely re-stamped its own\n    // clock at 08:00 whether or not anything had looked at Turnstile, so gating on\n    // it would age a verdict against a timer that never stops — freezing a stale\n    // \"fail\" into a red that pages every morning and can never be muted. Verdict\n    // and stamp are now written in the SAME FieldSet (`formE2eFields`), so they\n    // always move together; `turnstile-freshness.test.ts` pins that coupling.\n    const at = s.formE2eCheckedAt;\n    if (at !== null) {\n      const ageMs = now.getTime() - Date.parse(at);\n      // Parseable and beyond the window → stale, downgraded to assignTier's watch.\n      // Unparseable (NaN) keeps the item — never silently drop a real failure.\n      if (Number.isFinite(ageMs) && ageMs > TURNSTILE_WIDGET_STALE_DAYS * MS_PER_DAY) continue;\n    }\n    items.push({\n      key: `turnstile:${s.id}`,\n      kind: \"turnstile\",\n      siteName: s.name,\n      // Sensor-neutral, and it has to be: the verdict now has TWO fail arms and the\n      // row carries no discriminator. Naming /health sent the operator to Netlify to\n      // check a `PUBLIC_TURNSTILE_SITE_KEY` that is correctly set — because on the\n      // only site that can raise this alarm (Require Turnstile presupposes the key)\n      // the reachable arm is the OTHER one: a browser seeing 110200, i.e. the\n      // hostname missing from the Cloudflare widget's allowlist. Both causes are\n      // named so the runbook fix is the obvious next step.\n      title:\n        \"Require Turnstile is ON but no working widget was found (no sitekey, or the \" +\n        \"hostname is not on the Cloudflare widget's allowlist) — real leads are being auto-bucketed\",\n      url: dashboardUrl(baseUrl, s.name),\n      severity: \"critical\",\n      metric: 1,\n    });\n  }\n  return items;\n}\n\n/** Bounced lead notifications inside the window before a site alarms. One bounce can\n *  be a transient greylist/full-mailbox blip; a repeat says the point-of-contact\n *  address itself is bad (the Espada mode: apm@ bounced 4 of 8 with nothing alarming). */\nexport const NOTIFY_BOUNCE_THRESHOLD = 2;\n\n/** Window (days) the bounce count covers. Two weeks: long enough that a low-volume\n *  site's second bounce still lands in the same window as its first, short enough\n *  that a long-fixed address doesn't alarm forever (bounced rows never self-clear —\n *  the alarm ages out as bounced submissions leave the window). */\nexport const NOTIFY_BOUNCE_WINDOW_DAYS = 14;\n\n/**\n * One CRITICAL attention item per site with >= {@link NOTIFY_BOUNCE_THRESHOLD} bounced\n * lead notifications in the last {@link NOTIFY_BOUNCE_WINDOW_DAYS} days — leads are\n * being captured but silently never reach the client, which is worse than no form at\n * all (notifyStatus \"sent\" only means Resend accepted the email; the resend-webhook\n * flips it to \"bounced\" when Resend later reports the failure, 2026-07-16). PURE:\n * takes the pre-fetched per-site counts (`countNotifyBouncedBySite`, keyed by the\n * Websites record id). Keyed `notify-bounce:<siteId>` so the digest and the cockpit\n * share one diff key; `metric` is the bounce count (a rising count diffs WORSE).\n * A site absent from the map (or below threshold) is skipped, as is a count for a\n * site id not in `sites` (orphan → never render a broken link).\n */\nexport function collectNotifyBounceAlerts(\n  sites: WebsiteRow[],\n  bouncedBySite: ReadonlyMap<string, number>,\n  baseUrl: string,\n): AttentionItem[] {\n  const items: AttentionItem[] = [];\n  for (const s of sites) {\n    const n = bouncedBySite.get(s.id) ?? 0;\n    if (n < NOTIFY_BOUNCE_THRESHOLD) continue;\n    items.push({\n      key: `notify-bounce:${s.id}`,\n      kind: \"notify-bounce\",\n      siteName: s.name,\n      title: `${n} lead notifications bounced (${NOTIFY_BOUNCE_WINDOW_DAYS}d) — check the point-of-contact address`,\n      url: dashboardUrl(baseUrl, s.name),\n      severity: \"critical\",\n      metric: n,\n    });\n  }\n  return items;\n}\n\nexport function collectAnalyticsFailures(\n  sites: WebsiteRow[],\n  baseUrl: string,\n  now: Date = new Date(),\n): AttentionItem[] {\n  const items: AttentionItem[] = [];\n  for (const s of sites) {\n    const at = s.analyticsSoftFailAt;\n    if (at === null) continue;\n    const ageMs = now.getTime() - Date.parse(at);\n    // Unparseable timestamp (NaN) → keep the item (don't silently drop a real failure\n    // on a parse glitch); only a parseable, beyond-window age is skipped as stale.\n    if (Number.isFinite(ageMs) && ageMs > ANALYTICS_SOFT_FAIL_STALE_DAYS * MS_PER_DAY) continue;\n    items.push({\n      key: `analytics:${s.id}`,\n      kind: \"analytics\",\n      siteName: s.name,\n      title: \"GA/Search enrichment failing (analytics blank)\",\n      url: dashboardUrl(baseUrl, s.name),\n      severity: \"warning\",\n      metric: 1,\n    });\n  }\n  return items;\n}\n\n/** How current a `fail` / `unknown` must be to still CLAIM the fleet's present\n *  state. The sweep is nightly, so 3 days (mirrors GITHUB_SIGNALS_STALE_DAYS)\n *  tolerates a weekend of runner flakes without letting a months-old finding drive\n *  a \"models diverge right now\" alarm. Past it the finding does not vanish — it\n *  converts to the staleness item below, which claims nothing about the models. */\nconst PRISMIC_DRIFT_STALE_DAYS = 3;\n\n/** How long a `pass` may go unrefreshed before it is treated as unverified.\n *\n *  Deliberately LONGER than the currency window, and the asymmetry is the point.\n *  An old `fail` stops being reported as CURRENT drift at 3 days because it may\n *  already be fixed. An old `pass` is a green claim nobody has re-established, and\n *  escalating that at 3 days would light up the WHOLE fleet after a long weekend of\n *  runner flakes — the noise that gets a real alarm muted. A week is the interval\n *  over which a silently-dead nightly actually matters. */\nconst PRISMIC_STALE_PASS_DAYS = 7;\n\n/**\n * True when the nightly `prismic-models --fleet airtable` sweep is EXPECTED to\n * cover this site. Mirrors the Airtable inventory's own filter (src/inventory/\n * airtable.ts): live `maintenance` sites (active, not pre-launch) that carry a\n * `url` AND a Name that yields a slug. Deliberately duplicated rather than\n * imported — the inventory builds `Site` objects and needs a workdir; this is a\n * pure predicate over a row — but the two must stay in step: widen the inventory\n * and widen this. That is no longer left to memory: every shape of row is put\n * through BOTH implementations by tests/alerts/prismic-sweep-scope.test.ts, which\n * goes red the moment they diverge.\n *\n * THE SLUG CLAUSE IS NOT COSMETIC, and it was the first drift this pair produced.\n * The inventory drops an empty-slug row (`siteSlug(name) === \"\"`) with a warning,\n * because such a row can neither form a checkout path nor be matched back to its\n * Websites row on write-back — and `writeSweepToAirtable` joins by that same slug,\n * so even a verdict computed for it could never land. Without this clause a live\n * site named in a script with no `[a-z0-9]` (or with an empty Name) was covered\n * here and swept nowhere: the permanent, un-ackable morning email this predicate\n * exists to prevent, produced by the predicate itself.\n *\n * Only the STALENESS escalation consults it. A `fail`/`unknown` is a verdict some\n * run actually established and is reported wherever it came from; the staleness\n * item is an alarm invented FROM AN ABSENCE, and an absence is only wrong where a\n * sweep was owed. A deprecated site that left the inventory would otherwise carry\n * a frozen `pass` into the digest every morning forever — un-ackable (attention\n * items sit above the accepted-watch mute) and unfixable except by hand-clearing\n * an Airtable cell.\n */\nfunction prismicSweepCovers(s: WebsiteRow): boolean {\n  return (\n    s.status !== null &&\n    ACTIVE_STATUSES.has(s.status) &&\n    !isPreLaunch(s.status) &&\n    s.url.length > 0 &&\n    siteSlug(s.name).length > 0\n  );\n}\n\n/**\n * One item per site whose nightly Prismic model verdict needs a human, from the\n * `prismic-models --fleet --write-airtable` sweep. PURE (`now` injected).\n *\n * The verdict is THREE-valued plus blank, and each state gets its own key so the\n * digest's snapshot diff (keyed on `key`) can never let one condition stand in for\n * another — a site sliding from drift to \"couldn't check\" re-news as NEW rather\n * than diffing \"standing\" against the drift it replaced (both carry `metric` 1):\n *\n *   - `fail`, fresh    → `prismic-drift:<siteId>`   — repo and Prismic diverge.\n *   - `unknown`, fresh → `prismic-unknown:<siteId>` — the check RAN AND COULD NOT\n *     ANSWER (unreadable checkout, dead write token, unreachable Prismic). Its own\n *     wording, because reporting a dead token as \"models diverge\" sends the\n *     operator to fix a model when the job is to fix a secret.\n *   - any verdict nobody has re-established → `prismic-stale:<siteId>` — a `pass`\n *     older than {@link PRISMIC_STALE_PASS_DAYS} (or undateable), or a `fail` /\n *     `unknown` older than {@link PRISMIC_DRIFT_STALE_DAYS}. A stale verdict is\n *     never silence: dropping it would make \"nobody could evaluate this\" read\n *     exactly like \"this is fine\", which is the failure this whole column exists\n *     to close. Gated by {@link prismicSweepCovers}.\n *   - blank (never swept, or not a Prismic site) → nothing, at any age. There is\n *     no claim to un-verify.\n *\n * A `pass` inside its window is the ONLY silent verdict. At most one item per site\n * — the Airtable cell holds one state at a time.\n *\n * `warning`, not `critical`: on the cockpit ANY item already tiers the site 🔴, so\n * severity buys only (a) piercing the pre-launch mute and (b) sorting first in the\n * needs-you feed. `critical` is reserved for the guardrails that are actively\n * losing leads or breaking a live page (Turnstile, notify-bounce, delivery); a\n * model that drifted — or a check that could not run — is neither, and piercing\n * the pre-launch mute would alarm on exactly the sites the sweep excludes by\n * design.\n */\n/**\n * Is an operator's acceptance of a known divergence still in force?\n *\n * Every uncertain answer is `false` — an absent, blank or unparseable cell leaves\n * the alarm ringing. The asymmetry is the point: a mistyped date costing one noisy\n * item is recoverable, and a mistyped date silently muting a live finding is the\n * exact failure this column was built to close. The boundary belongs to the alarm\n * too: an ack \"until 09:00\" has nothing left to say at 09:00.\n */\nexport function prismicAckIsLive(ackUntil: string | null, now: Date): boolean {\n  if (ackUntil === null || ackUntil.trim() === \"\") return false;\n  const until = Date.parse(ackUntil);\n  if (!Number.isFinite(until)) return false;\n  return until > now.getTime();\n}\n\nexport function collectPrismicDriftAlerts(\n  sites: WebsiteRow[],\n  baseUrl: string,\n  now: Date = new Date(),\n): AttentionItem[] {\n  const items: AttentionItem[] = [];\n  for (const s of sites) {\n    const verdict = s.prismicModels;\n    if (verdict === null) continue;\n\n    const at = s.prismicModelsCheckedAt;\n    // +Infinity when there is no timestamp, NaN when it won't parse — both mean\n    // \"the age of this answer is unknowable\", which the two verdict families read\n    // in OPPOSITE directions on purpose (see `unverified`).\n    const ageMs = at === null ? Number.POSITIVE_INFINITY : now.getTime() - Date.parse(at);\n    const ageKnown = Number.isFinite(ageMs);\n    const windowDays = verdict === \"pass\" ? PRISMIC_STALE_PASS_DAYS : PRISMIC_DRIFT_STALE_DAYS;\n    // An undateable `pass` is unverified — a green claim nobody can date is not a\n    // green claim. An undateable `fail`/`unknown` is NOT downgraded: never silently\n    // drop a real finding over a parse glitch.\n    const unverified = ageKnown ? ageMs > windowDays * MS_PER_DAY : verdict === \"pass\";\n\n    if (unverified) {\n      if (!prismicSweepCovers(s)) continue;\n      items.push({\n        key: `prismic-stale:${s.id}`,\n        kind: \"prismic-drift\",\n        siteName: s.name,\n        title: `Prismic model check has not run recently — the last verdict (\"${verdict}\") is unverified`,\n        url: dashboardUrl(baseUrl, s.name),\n        severity: \"warning\",\n        metric: 1,\n      });\n      continue;\n    }\n\n    if (verdict === \"pass\") continue;\n\n    const first = s.prismicModelsDrift\n      ?.split(\"\\n\")\n      .find((l) => l.trim() !== \"\")\n      ?.trim();\n    if (verdict === \"unknown\") {\n      items.push({\n        key: `prismic-unknown:${s.id}`,\n        kind: \"prismic-drift\",\n        siteName: s.name,\n        title: first\n          ? `Prismic model check could not run — ${first}`\n          : \"Prismic model check could not run\",\n        url: dashboardUrl(baseUrl, s.name),\n        severity: \"warning\",\n        metric: 1,\n      });\n      continue;\n    }\n\n    // The operator has reviewed THIS divergence and accepted it until a date they\n    // set — see `WebsiteRow.prismicAckUntil`. Reached only on `fail`: the `unknown`\n    // and staleness branches above have already returned, so an ack can never mute\n    // \"the check could not run\" or \"nobody has re-established this\".\n    if (prismicAckIsLive(s.prismicAckUntil, now)) continue;\n\n    items.push({\n      key: `prismic-drift:${s.id}`,\n      kind: \"prismic-drift\",\n      siteName: s.name,\n      title: first\n        ? `Prismic models diverge from the repo — ${first}`\n        : \"Prismic models diverge from the repo\",\n      url: dashboardUrl(baseUrl, s.name),\n      severity: \"warning\",\n      metric: 1,\n    });\n  }\n  return items;\n}\n"],"mappings":";;;;;;;;;;;AAeA,SAAS,aAAa,SAAiB,UAA0B;AAC/D,QAAM,OAAO,QAAQ,QAAQ,OAAO,EAAE;AACtC,QAAM,OAAO,SAAS,QAAQ;AAC9B,SAAO,OAAO,GAAG,IAAI,MAAM,IAAI,KAAK;AACtC;AAWA,IAAM,4BAA4B;AAClC,IAAM,aAAa,KAAK,KAAK,KAAK;AAMlC,SAAS,mBAAmB,OAAsB,KAAoB;AACpE,MAAI,UAAU,KAAM,QAAO;AAC3B,QAAM,QAAQ,IAAI,QAAQ,IAAI,KAAK,MAAM,KAAK;AAC9C,MAAI,CAAC,OAAO,SAAS,KAAK,EAAG,QAAO;AACpC,SAAO,QAAQ,4BAA4B;AAC7C;AAGA,IAAM,4BAA4B;AAuB3B,SAAS,kBAAkB,OAAqB,SAAkC;AACvF,QAAM,QAAyB,CAAC;AAChC,aAAW,KAAK,OAAO;AACrB,UAAM,WAAW,EAAE,yBAAyB;AAC5C,UAAM,OAAO,EAAE,qBAAqB;AACpC,UAAM,SAAS,WAAW;AAC1B,QAAI,UAAU,EAAG;AACjB,UAAM,WAAW,EAAE,2BAA2B;AAC9C,UAAM,iBAAiB,6BAA6B,EAAE,kBAAkB;AACxE,UAAM,YAAY,CAAC,kBAAkB,YAAY;AACjD,UAAM,OAAO,WAAW,IAAI,SAAS;AACrC,UAAM,KAAK;AAAA,MACT,KAAK,QAAQ,EAAE,EAAE;AAAA,MACjB,MAAM;AAAA,MACN,UAAU,EAAE;AAAA,MACZ,OAAO,YACH,GAAG,MAAM,kBAAkB,IAAI,4BAAuB,QAAQ,UAC9D,iBACE,GAAG,MAAM,kBAAkB,IAAI,kEAC/B,GAAG,MAAM,kBAAkB,IAAI;AAAA,MACrC,KAAK,aAAa,SAAS,EAAE,IAAI;AAAA,MACjC,UAAU,aAAa,WAAW,IAAI,aAAa;AAAA,MACnD;AAAA,MACA,GAAI,YAAY,EAAE,kBAAkB,KAAK,IAAI,CAAC;AAAA,IAChD,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAGA,IAAM,mBAAmB;AAIzB,IAAM,wBAID;AAAA,EACH,EAAE,OAAO,UAAU,MAAM,eAAe,OAAO,cAAc;AAAA,EAC7D,EAAE,OAAO,UAAU,MAAM,iBAAiB,OAAO,gBAAgB;AAAA,EACjE,EAAE,OAAO,WAAW,MAAM,kBAAkB,OAAO,iBAAiB;AAAA,EACpE,EAAE,OAAO,YAAY,MAAM,OAAO,OAAO,MAAM;AACjD;AAWO,SAAS,wBAAwB,OAAqB,SAAkC;AAC7F,QAAM,QAAyB,CAAC;AAChC,aAAW,KAAK,OAAO;AACrB,eAAW,OAAO,uBAAuB;AACvC,YAAM,QAAQ,EAAE,IAAI,KAAK;AACzB,UAAI,UAAU,QAAQ,SAAS,iBAAkB;AACjD,YAAM,KAAK;AAAA,QACT,KAAK,cAAc,EAAE,EAAE,IAAI,IAAI,IAAI;AAAA,QACnC,MAAM;AAAA,QACN,UAAU,EAAE;AAAA,QACZ,OAAO,cAAc,IAAI,KAAK,IAAI,KAAK,WAAW,gBAAgB;AAAA,QAClE,KAAK,aAAa,SAAS,EAAE,IAAI;AAAA,QACjC,UAAU;AAAA,QACV,QAAQ,MAAM;AAAA,MAChB,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO;AACT;AAkBO,SAAS,wBACd,SACA,WACA,SACiB;AACjB,QAAM,QAAyB,CAAC;AAChC,aAAW,KAAK,SAAS;AACvB,QAAI,CAAC,EAAE,cAAc,EAAE,WAAW,KAAM;AAIxC,UAAM,QAAQ,EAAE,iBAAiB,aAAa;AAC9C,UAAM,OAAO,UAAU,IAAI,EAAE,MAAM;AACnC,QAAI,CAAC,MAAM;AAIT,YAAM,KAAK;AAAA,QACT,KAAK,aAAa,EAAE,EAAE,IAAI,KAAK;AAAA,QAC/B,MAAM;AAAA,QACN,UAAU;AAAA,QACV,OAAO,EAAE,iBACL,YAAY,EAAE,UAAU,6CACxB,GAAG,EAAE,UAAU;AAAA,QACnB,KAAK,aAAa,SAAS,EAAE;AAAA,QAC7B,UAAU,EAAE,iBAAiB,aAAa;AAAA,QAC1C,QAAQ;AAAA,MACV,CAAC;AACD;AAAA,IACF;AACA,UAAM,QAAQ,gBAAgB,MAAM,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,MAAM;AACvE,QAAI,MAAM,WAAW,EAAG;AACxB,UAAM,QAAQ,MAAM,CAAC;AACrB,UAAM,OAAO,MAAM,SAAS,IAAI,MAAM,MAAM,SAAS,CAAC,WAAW;AACjE,UAAM,KAAK;AAAA,MACT,KAAK,aAAa,EAAE,EAAE,IAAI,KAAK;AAAA,MAC/B,MAAM;AAAA,MACN,UAAU,KAAK;AAAA,MACf,OAAO,EAAE,iBACL,YAAY,EAAE,UAAU,6BAAwB,MAAM,KAAK,GAAG,IAAI,KAClE,GAAG,EAAE,UAAU,mCAA8B,MAAM,KAAK,GAAG,IAAI;AAAA,MACnE,KAAK,aAAa,SAAS,KAAK,IAAI;AAAA,MACpC,UAAU,EAAE,iBAAiB,aAAa;AAAA,MAC1C,QAAQ,MAAM;AAAA,IAChB,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEO,SAAS,wBACd,SACA,WACA,SACiB;AACjB,QAAM,QAAyB,CAAC;AAChC,aAAW,KAAK,SAAS;AACvB,QAAI,EAAE,mBAAmB,aAAa,EAAE,mBAAmB,aAAc;AACzE,UAAM,OAAO,UAAU,IAAI,EAAE,MAAM;AACnC,QAAI,CAAC,KAAM;AACX,UAAM,aAAa,EAAE,mBAAmB;AACxC,UAAM,KAAK;AAAA,MACT,KAAK,YAAY,EAAE,EAAE;AAAA,MACrB,MAAM;AAAA,MACN,UAAU,KAAK;AAAA,MACf,OAAO,aAAa,oCAAoC;AAAA,MACxD,KAAK,aAAa,SAAS,KAAK,IAAI;AAAA,MACpC,UAAU,aAAa,aAAa;AAAA,MACpC,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAWO,SAAS,sBACd,OACA,SACA,MAAY,oBAAI,KAAK,GACJ;AACjB,QAAM,QAAyB,CAAC;AAChC,aAAW,KAAK,OAAO;AACrB,QAAI,mBAAmB,EAAE,iBAAiB,GAAG,EAAG;AAChD,UAAM,IAAI,EAAE,sBAAsB;AAClC,QAAI,KAAK,EAAG;AACZ,UAAM,KAAK;AAAA,MACT,KAAK,YAAY,EAAE,EAAE;AAAA,MACrB,MAAM;AAAA,MACN,UAAU,EAAE;AAAA,MACZ,OAAO,GAAG,CAAC,aAAa,MAAM,IAAI,OAAO,KAAK;AAAA,MAC9C,KAAK,aAAa,SAAS,EAAE,IAAI;AAAA,MACjC,UAAU;AAAA,MACV,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AACA,SAAO;AACT;AASO,SAAS,gBACd,OACA,SACA,MAAY,oBAAI,KAAK,GACJ;AACjB,QAAM,QAAyB,CAAC;AAChC,aAAW,KAAK,OAAO;AACrB,QAAI,mBAAmB,EAAE,iBAAiB,GAAG,EAAG;AAChD,QAAI,EAAE,oBAAoB,UAAW;AACrC,UAAM,KAAK;AAAA,MACT,KAAK,MAAM,EAAE,EAAE;AAAA,MACf,MAAM;AAAA,MACN,UAAU,EAAE;AAAA,MACZ,OAAO;AAAA,MACP,KAAK,aAAa,SAAS,EAAE,IAAI;AAAA,MACjC,UAAU;AAAA,MACV,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AACA,SAAO;AACT;AASA,IAAM,iCAAiC;AAgBvC,IAAM,8BAA8B;AAa7B,SAAS,gCACd,OACA,SACA,MAAY,oBAAI,KAAK,GACJ;AACjB,QAAM,QAAyB,CAAC;AAChC,aAAW,KAAK,OAAO;AACrB,QAAI,CAAC,EAAE,oBAAoB,EAAE,oBAAoB,OAAQ;AASzD,UAAM,KAAK,EAAE;AACb,QAAI,OAAO,MAAM;AACf,YAAM,QAAQ,IAAI,QAAQ,IAAI,KAAK,MAAM,EAAE;AAG3C,UAAI,OAAO,SAAS,KAAK,KAAK,QAAQ,8BAA8B,WAAY;AAAA,IAClF;AACA,UAAM,KAAK;AAAA,MACT,KAAK,aAAa,EAAE,EAAE;AAAA,MACtB,MAAM;AAAA,MACN,UAAU,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAQZ,OACE;AAAA,MAEF,KAAK,aAAa,SAAS,EAAE,IAAI;AAAA,MACjC,UAAU;AAAA,MACV,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAKO,IAAM,0BAA0B;AAMhC,IAAM,4BAA4B;AAclC,SAAS,0BACd,OACA,eACA,SACiB;AACjB,QAAM,QAAyB,CAAC;AAChC,aAAW,KAAK,OAAO;AACrB,UAAM,IAAI,cAAc,IAAI,EAAE,EAAE,KAAK;AACrC,QAAI,IAAI,wBAAyB;AACjC,UAAM,KAAK;AAAA,MACT,KAAK,iBAAiB,EAAE,EAAE;AAAA,MAC1B,MAAM;AAAA,MACN,UAAU,EAAE;AAAA,MACZ,OAAO,GAAG,CAAC,gCAAgC,yBAAyB;AAAA,MACpE,KAAK,aAAa,SAAS,EAAE,IAAI;AAAA,MACjC,UAAU;AAAA,MACV,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEO,SAAS,yBACd,OACA,SACA,MAAY,oBAAI,KAAK,GACJ;AACjB,QAAM,QAAyB,CAAC;AAChC,aAAW,KAAK,OAAO;AACrB,UAAM,KAAK,EAAE;AACb,QAAI,OAAO,KAAM;AACjB,UAAM,QAAQ,IAAI,QAAQ,IAAI,KAAK,MAAM,EAAE;AAG3C,QAAI,OAAO,SAAS,KAAK,KAAK,QAAQ,iCAAiC,WAAY;AACnF,UAAM,KAAK;AAAA,MACT,KAAK,aAAa,EAAE,EAAE;AAAA,MACtB,MAAM;AAAA,MACN,UAAU,EAAE;AAAA,MACZ,OAAO;AAAA,MACP,KAAK,aAAa,SAAS,EAAE,IAAI;AAAA,MACjC,UAAU;AAAA,MACV,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAOA,IAAM,2BAA2B;AAUjC,IAAM,0BAA0B;AA8BhC,SAAS,mBAAmB,GAAwB;AAClD,SACE,EAAE,WAAW,QACb,gBAAgB,IAAI,EAAE,MAAM,KAC5B,CAAC,YAAY,EAAE,MAAM,KACrB,EAAE,IAAI,SAAS,KACf,SAAS,EAAE,IAAI,EAAE,SAAS;AAE9B;AA6CO,SAAS,iBAAiB,UAAyB,KAAoB;AAC5E,MAAI,aAAa,QAAQ,SAAS,KAAK,MAAM,GAAI,QAAO;AACxD,QAAM,QAAQ,KAAK,MAAM,QAAQ;AACjC,MAAI,CAAC,OAAO,SAAS,KAAK,EAAG,QAAO;AACpC,SAAO,QAAQ,IAAI,QAAQ;AAC7B;AAEO,SAAS,0BACd,OACA,SACA,MAAY,oBAAI,KAAK,GACJ;AACjB,QAAM,QAAyB,CAAC;AAChC,aAAW,KAAK,OAAO;AACrB,UAAM,UAAU,EAAE;AAClB,QAAI,YAAY,KAAM;AAEtB,UAAM,KAAK,EAAE;AAIb,UAAM,QAAQ,OAAO,OAAO,OAAO,oBAAoB,IAAI,QAAQ,IAAI,KAAK,MAAM,EAAE;AACpF,UAAM,WAAW,OAAO,SAAS,KAAK;AACtC,UAAM,aAAa,YAAY,SAAS,0BAA0B;AAIlE,UAAM,aAAa,WAAW,QAAQ,aAAa,aAAa,YAAY;AAE5E,QAAI,YAAY;AACd,UAAI,CAAC,mBAAmB,CAAC,EAAG;AAC5B,YAAM,KAAK;AAAA,QACT,KAAK,iBAAiB,EAAE,EAAE;AAAA,QAC1B,MAAM;AAAA,QACN,UAAU,EAAE;AAAA,QACZ,OAAO,sEAAiE,OAAO;AAAA,QAC/E,KAAK,aAAa,SAAS,EAAE,IAAI;AAAA,QACjC,UAAU;AAAA,QACV,QAAQ;AAAA,MACV,CAAC;AACD;AAAA,IACF;AAEA,QAAI,YAAY,OAAQ;AAExB,UAAM,QAAQ,EAAE,oBACZ,MAAM,IAAI,EACX,KAAK,CAAC,MAAM,EAAE,KAAK,MAAM,EAAE,GAC1B,KAAK;AACT,QAAI,YAAY,WAAW;AACzB,YAAM,KAAK;AAAA,QACT,KAAK,mBAAmB,EAAE,EAAE;AAAA,QAC5B,MAAM;AAAA,QACN,UAAU,EAAE;AAAA,QACZ,OAAO,QACH,4CAAuC,KAAK,KAC5C;AAAA,QACJ,KAAK,aAAa,SAAS,EAAE,IAAI;AAAA,QACjC,UAAU;AAAA,QACV,QAAQ;AAAA,MACV,CAAC;AACD;AAAA,IACF;AAMA,QAAI,iBAAiB,EAAE,iBAAiB,GAAG,EAAG;AAE9C,UAAM,KAAK;AAAA,MACT,KAAK,iBAAiB,EAAE,EAAE;AAAA,MAC1B,MAAM;AAAA,MACN,UAAU,EAAE;AAAA,MACZ,OAAO,QACH,+CAA0C,KAAK,KAC/C;AAAA,MACJ,KAAK,aAAa,SAAS,EAAE,IAAI;AAAA,MACjC,UAAU;AAAA,MACV,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AACA,SAAO;AACT;","names":[]}