@reddoorla/maintenance 0.95.1 → 0.97.0

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import { a as AuditResult, S as Site, A as AuditName, b as RecipeResult, R as RecipeName, I as InventoryProvider } from './types-D_bpy89i.js';
 export { C as ConfigName } from './types-D_bpy89i.js';
-import { A as AirtableBase, a as FleetEventType } from './fleet-events-cF2Om88w.js';
+import { A as AirtableBase, W as WebsiteRow, a as FleetEventType } from './fleet-events-CkOZpMVC.js';
 import { F as FormType } from './types-RXY-vY-5.js';
 export { SyncConfigsOptions, syncConfigs } from './recipes/sync-configs.js';
 import 'airtable/lib/airtable_base.js';
@@ -315,14 +315,27 @@ type DependabotAlert = {
     scope: "runtime" | "development" | null;
     /** Dependency graph relationship (`dependency.relationship`), or null when GitHub reports
      *  "unknown"/nothing. "transitive" means no direct-dep bump can fix it — Renovate's vuln
-     *  alerts have no fix vehicle until the weekly lockfile-maintenance window. */
-    relationship: "direct" | "transitive" | null;
+     *  alerts have no fix vehicle until the weekly lockfile-maintenance window. "inconclusive"
+     *  is what GitHub stamps on an alert filed against a manifest its dependency graph still
+     *  tracks but the tree no longer holds (#702) — kept, never folded to null, because it is
+     *  the secondary tell for a ghost alert. */
+    relationship: "direct" | "transitive" | "inconclusive" | null;
+    /** The manifest the alert was filed against (`dependency.manifest_path`, e.g.
+     *  `package-lock.json`), or null when absent. GitHub retains a manifest after the file is
+     *  deleted from the default branch and keeps filing alerts against that frozen snapshot;
+     *  the audit resolves this path with {@link GitHubRest.manifestExists} to tell a ghost from
+     *  a live vulnerability (#702). */
+    manifestPath: string | null;
 };
 
 /** The Dependabot fetch the security audit needs, injectable for tests. The real default is
  *  built from GITHUB_TOKEN; absent token (or a site with no gitRepo) → pnpm/npm audit fallback. */
 type DependabotDeps = {
     listAlerts: (repo: string) => Promise<DependabotAlert[]>;
+    /** Whether an alert's `manifestPath` is still on the default branch. Optional: without it
+     *  every alert counts, which is the loud direction. A lookup that THROWS also counts the
+     *  alert — an API hiccup must never quietly suppress a real vulnerability (#702). */
+    manifestExists?: (repo: string, path: string) => Promise<boolean>;
 };
 declare function securityAudit(ctx: AuditContext): Promise<AuditResult>;
 
@@ -487,407 +500,18 @@ type AirtableInventoryOptions = {
 };
 /**
  * Read sites from the Airtable Websites table as an InventoryProvider.
- * Each row becomes one Site; `path` is computed as `{workdir}/{slug}`.
- * Only LIVE `maintenance` sites that have a `url` are included — pre-launch
- * stages ("launching" / "building", via isPreLaunch) are excluded so a
- * not-yet-live site is never audited as production (its deploy/domain/uptime/CMS
- * audits would fail against nothing and red its Airtable row) nor swept by other
- * `--fleet airtable` ops; it re-enters the fleet when a Launch report flips its
- * Status to "maintained". The production URL is exposed as `Site.deployedUrl` so
- * the lighthouse audit can run against it with no checkout. `repoUrl` is
- * intentionally NOT set from `url` — a clone source must come from `gitRepo`
- * (`owner/repo`), never the production URL.
- */
-declare function fromAirtableBase(base: AirtableBase, opts?: AirtableInventoryOptions): InventoryProvider;
-
-/**
- * The site-status vocabulary — ONE module owns it (#539 Phase 4).
- *
- * The fleet's lifecycle names were inherited from an Airtable single-select
- * written by hand years ago ("probably not our problem"). The operator approved
- * a canonical vocabulary, and the migration is now COMPLETE in both stores:
- * Airtable's "Status" single-select carries exactly the six canonical options
- * and nothing else. This module no longer knows the old names at all.
- *
- * The retired mapping, kept as the record of what was merged into what:
- *
- *   old (retired 2026-08-25)    new (canonical)
- *   ─────────────────────────   ───────────────
- *   in development              building
- *   launch period               launching
- *   maintenance                 maintained
- *   hosting                     hosted-only
- *   probably not our problem    external
- *   legacy                    ┐
- *   deprecated                ┴ archived        ← approved MERGE, many-to-one
- *
- * `legacy` and `deprecated` were already treated identically by every PREDICATE
- * (ARCHIVED_STATUSES held both), so collapsing them changes no *selection* — no
- * fleet op gains or loses a site. It is NOT true that collapsing them changes
- * nothing at all, and one surface proved it: the cockpit's Archived lane LABELS
- * each row with its Status cell, and canonicalizing there rendered all 12 live
- * archived rows as "archived". That lane now labels from `statusRaw`, which is
- * exactly why `WebsiteRow.statusRaw` exists. The rule this leaves behind:
- * canonical values decide BEHAVIOUR; anything DISPLAYING a Status cell, or
- * writing one back, uses the raw cell.
  *
- * The merge had NO clean reverse map while both vocabularies coexisted, which
- * is why `toAirtableStatus` had to pick one archived name deliberately. With the
- * old names retired there is nothing left to pick between, and no code path
- * feeds operator-supplied text through it anyway (see
- * `src/recipes/forms-notify-target.ts`, which writes `--restore` verbatim).
+ * No longer what `--fleet` resolves through: since #646 step 4 the fleet roster
+ * is read from Turso (`fromTursoDb`, `src/inventory/turso.ts`), because a site
+ * created by the Turso-native `ensure-site` has no Airtable record at all. This
+ * stays as the Airtable half of the selection-parity instrument and a public
+ * export until the operator approves deleting the Airtable layer (steps 6–8).
  *
- * THE SHAPE OF THE TRANSITION (three stages):
- *
- *   stage 1 (DONE)  code speaks the NEW vocabulary internally; reads canonicalize
- *                   at the two Airtable/Turso seams; writes still emit the OLD
- *                   Airtable option names. Airtable untouched. No SELECTION
- *                   change — every predicate picks exactly the sites it picked
- *                   before (pinned row-by-row in tests/reports/airtable/
- *                   site-status.test.ts). Displayed labels come from `statusRaw`.
- *   stage 2 (DONE)  the Airtable "Status" single-select gained the 6 new options
- *                   and all 44 cells were migrated (verified live: maintained=13,
- *                   archived=12, external=9, building=6, hosted-only=2,
- *                   launching=2 — zero old values, zero unrecognized), `db sync`
- *                   ran clean (mismatches=0), and AIRTABLE_USES_NEW_VOCABULARY
- *                   flipped to true. Writers now emit canonical names verbatim.
- *                   The alias map STAYS: the 7 old options still exist in the
- *                   field, so a human can still pick one in the Airtable UI.
- *   stage 3 (DONE)  the operator deleted the 7 old options from the Airtable
- *                   "Status" field on 2026-08-25, which is what made this safe:
- *                   the gate was always "no old value CAN BE ENTERED", not
- *                   merely "none is stored". Verified against the live base
- *                   before any code changed — the field carries exactly the six
- *                   canonical choices, byte-exact, and all 44 cells still hold a
- *                   canonical value with ZERO blanks (deleting a single-select
- *                   option CLEARS the cells using it, so "no cell was blanked"
- *                   was checked, not assumed). AIRTABLE_STATUS_ALIASES,
- *                   AIRTABLE_OLD_NAMES and AIRTABLE_USES_NEW_VOCABULARY are
- *                   gone; both functions reduce to the identity.
- *
- * WHAT CHANGED IN BEHAVIOUR AT STAGE 3, and it is the only thing that did: an
- * old name is no longer translated. `canonicalizeStatus("maintenance")` used to
- * yield `maintained`; it now yields `"maintenance"` verbatim, which
- * `isUnrecognizedStatus` flags and the cockpit surfaces as a watch row. That is
- * intended. The option cannot be selected any more, so a stored old value would
- * mean something went wrong — a restored backup, a scripted write, an API
- * caller with a stale constant — and the fleet should say so rather than absorb
- * it into a status nobody chose.
- *
- * Canonicalization happens on READ, never at rest: `src/db/import-airtable.ts`
- * still stores the raw Airtable cell verbatim in `sites.status`, so the hourly
- * parity check keeps comparing raw-to-raw and the importer stays honest to its
- * source. Both readers — `mapRow` (Airtable) and `rowFromJoined` (Turso) — run
- * the raw value through `canonicalizeStatus`, which is what keeps the #558
- * reader-equivalence instrument green.
- */
-/** The canonical site lifecycle vocabulary. */
-type Status = "building" | "launching" | "maintained" | "hosted-only" | "external" | "archived";
-
-type Frequency = "None" | "Monthly" | "Quarterly" | "Yearly";
-
-/**
- * Per-site notification routing. When present on a `maintained` site, the form
- * notification is addressed by the value of a submission field (`field`, read from
- * `extraFields`) — e.g. route a contact form's `interest` to a different recipient
- * per option, always CC-ing a shared address. Absent (`null`) → the site keeps the
- * default single-POC behavior. Recipients live HERE (server-side Airtable config),
- * never supplied by the submitting site, so the ingest can't be turned into an open
- * relay.
+ * The selection rule itself is `selectFleetSites` — shared, so the two providers
+ * cannot drift. `meta.airtableRowId` is kept alongside `meta.siteId` for any
+ * consumer that still reads the old key.
  */
-type NotifyRouting = {
-    /** The `extraFields` key whose value selects a route, e.g. "interest". */
-    field: string;
-    /** Field-value → recipient address(es). */
-    routes: Record<string, string | string[]>;
-    /** Recipient(s) when the value matches no route. */
-    default?: string | string[];
-    /** Address(es) CC'd on every routed (maintenance) send. */
-    cc?: string[];
-};
-type WebsiteRow = {
-    id: string;
-    name: string;
-    url: string;
-    /** Canonical lifecycle status (see ./site-status.ts). Canonicalized at the read
-     *  boundary, so an old-vocabulary Airtable cell and a new one read identically.
-     *  A present-but-unrecognized cell survives VERBATIM (blind-cast) rather than
-     *  becoming null — `isUnrecognizedStatus` flags it, and null would make
-     *  due.ts/preflight.ts treat the row as eligible-by-default. */
-    status: Status | null;
-    /** The literal Airtable Status cell behind `status` — same pattern as
-     *  `maintenanceFreqRaw`. The dashboard status editor round-trips THIS, so its
-     *  dropdown offers and preselects the values Airtable actually holds while the
-     *  two vocabularies coexist. Null = blank cell. */
-    statusRaw: string | null;
-    pointOfContact: string | null;
-    maintenanceFreq: Frequency;
-    testingFreq: Frequency;
-    /** The literal Airtable cell values behind the coerced frequencies. `toFrequency`
-     *  trims whitespace ("Monthly " reads as Monthly), then maps any still-unrecognized
-     *  value ("Quaterly") to "None" with a LOUD console.warn so nothing bogus reaches a
-     *  client email and the drop is never invisible. Preflight validates THESE to surface
-     *  the same failure as a structured finding. Null = blank cell. */
-    maintenanceFreqRaw: string | null;
-    testingFreqRaw: string | null;
-    /** Last manually-recorded maintenance day (used as fallback when no Reports row exists). */
-    maintenanceDay: string | null;
-    testingDay: string | null;
-    ga4PropertyId: string | null;
-    /** Operator-supplied query for the Google search-presence check (e.g. the business name).
-     *  Null = no query set → the check is skipped for this site. */
-    searchQuery: string | null;
-    /** Explicit Search Console property for this site (`sc-domain:...` or `https://.../`).
-     *  Null = auto-resolve from the SA's visible properties by host. */
-    searchConsoleProperty: string | null;
-    /** ISO timestamp of the last draft run where THIS site's GA/Search enrichment
-     *  ERRORED (vs a legitimate "not configured" skip). Set by drafting on a soft-fail,
-     *  cleared (null) on a clean enrichment, so the per-site analytics-failure signal
-     *  self-heals. Null when the operator-added `Analytics soft-fail at` column is absent. */
-    analyticsSoftFailAt: string | null;
-    /** GitHub repo identity as `owner/repo`. Null = no git wiring → self-update ops skip
-     *  (or, for local runs, fall back to the checkout's origin remote). */
-    gitRepo: string | null;
-    reportRecipientsTo: string | null;
-    reportRecipientsCc: string | null;
-    acceptedWatchConditions: string[];
-    /** First attachment in the Header image field (Airtable's signed URL — fetch before expiry). */
-    headerImage: {
-        url: string;
-        filename: string;
-        type: string;
-    } | null;
-    /** Lighthouse "current state" snapshot, kept fresh by `audit lighthouse --write-airtable`. */
-    pScore: number | null;
-    rScore: number | null;
-    bpScore: number | null;
-    seoScore: number | null;
-    /** ISO timestamp set by `audit lighthouse --write-airtable` when scores were last refreshed. */
-    lastLighthouseAuditAt: string | null;
-    /** Last-known counts from non-lighthouse audits, written by
-     *  `audit --write-airtable`. `null` = never audited (or this audit
-     *  type was skipped on the last run). 0 = audited, clean. */
-    a11yViolations: number | null;
-    /** Declared-range drift vs the Reddoor baseline (what package.json asks for). */
-    depsDrifted: number | null;
-    depsMajorBehind: number | null;
-    /** Real installed-version drift: deps behind the registry's latest, from the
-     *  committed lockfile (`pnpm outdated`). Null = not determined this run. */
-    depsOutdated: number | null;
-    /** Of {@link depsOutdated}, how many are a *major* version behind the
-     *  registry's latest — the "majors available on npm" signal, distinct from the
-     *  baseline-drift {@link depsMajorBehind}. Null = not determined this run. */
-    depsMajorOutdated: number | null;
-    securityVulnsCritical: number | null;
-    securityVulnsHigh: number | null;
-    securityVulnsModerate: number | null;
-    securityVulnsLow: number | null;
-    /** Count of consecutive nightly Renovate auto-fix dispatches for the CURRENT
-     *  critical/high vuln episode that have NOT yet cleared it. Owned by
-     *  `renovate-dispatch`: +1 per real dispatch, reset to 0 when vulns clear.
-     *  Null = field absent / never dispatched → reads as 0. At/above
-     *  AUTO_FIX_EXHAUSTED_CYCLES the vuln renders as "auto-fix failed". */
-    securityAutoFixAttempts: number | null;
-    /** ISO timestamp the security audit last ran — gates freshness of the Security Updates auto-tick
-     *  (clean counts only auto-tick when recent). */
-    lastSecurityAuditAt: string | null;
-    /** The known advisories behind the counts (severity-sorted, capped), so the dashboard can show
-     *  WHICH packages are vulnerable, not just the totals. null = never audited / unparseable;
-     *  empty array = audited clean. Written alongside the counts by the security audit. */
-    securityAdvisories: SecurityAdvisory[] | null;
-    /** Domain/DNS/SSL probe (the `domain` audit). `certDaysRemaining` is days until the TLS cert
-     *  expires (null = unresolved or no usable cert); `domainCheckedAt` is when it last ran. */
-    certDaysRemaining: number | null;
-    domainCheckedAt: string | null;
-    /** Netlify site id — the IDENTITY the `netlify-deploy` audit needs to query the
-     *  Netlify API. Read-only input (operator-set in Airtable); null = not on Netlify
-     *  (or not wired) → that audit skips. Never derived from the URL. */
-    netlifyId: string | null;
-    /** Latest PRODUCTION deploy health (the `netlify-deploy` audit). `deployStatus` is
-     *  Netlify's deploy state lower-cased (`ready`/`error`/`building`/…), null = none / not
-     *  checked; `lastDeployAt` is when it deployed; `deployLogUrl` links to the deploy/log. */
-    deployStatus: string | null;
-    lastDeployAt: string | null;
-    deployLogUrl: string | null;
-    /** When the `netlify-deploy` audit last RAN (freshness stamp for `deployStatus`). The audit
-     *  already writes "Deploy checked at"; this read-back is the Plan-2 fix so `deployEvidence`
-     *  (Plan 4) can gate on check time — NOT on `lastDeployAt`, which is deploy time, not check time. */
-    deployCheckedAt: string | null;
-    /** Function-health verdict (the `function-health` audit): the deployed `/health` function
-     *  answered `ok:true` (pass) or `ok:false` (fail). Single-select `pass`/`fail`; null = never ran
-     *  / unreachable (→ Plan 4 maps to unknown/amber). Kept SEPARATE from `deployStatus` so
-     *  `isFailedDeployStatus` keeps meaning "the build failed". */
-    functionHealth: "pass" | "fail" | null;
-    /** CMS reachability (server-side), derived from the same `/health` body's `details.prismic ===
-     *  "ok"`. Single-select `pass`/`fail`; null = never ran. No per-site Prismic token or identity
-     *  column is ever built — this rides `/health`. */
-    cmsReachable: "pass" | "fail" | null;
-    /** Does the deployed site's Turnstile widget actually work? Single-select `pass`/`fail`;
-     *  null = **unverified**, which is the normal state — see below. Freshness gated by
-     *  `formE2eCheckedAt`, the clock of the audit that writes it. Powers the cockpit Require-Turnstile guardrail: a site with
-     *  `requireTurnstile` ON but no working widget silently buckets 100% of its real leads.
-     *
-     *  One of the two `"fail"` arms is derived from `/health` (the other is a browser seeing
-     *  110200 on the live hostname), whose `forms.turnstile` is a truthiness check
-     *  on `PUBLIC_TURNSTILE_SITE_KEY` that never contacts Cloudflare (see
-     *  audits/function-health-airtable.ts for the incident). No key IS proof the widget can't
-     *  work; a key is NOT proof that it can — a sitekey whose widget is full at Cloudflare's
-     *  10-hostname cap sets the var and still mints no token. So a `"pass"` here has to be
-     *  earned by a real browser rendering the real widget (form-e2e), and until it is, null
-     *  keeps the site in the cockpit's amber "can't verify" watch rather than claiming health
-     *  nobody measured. */
-    turnstileWidget: "pass" | "fail" | null;
-    /** When the `function-health` audit last ran — the freshness gate for `functionHealth`,
-     *  `cmsReachable`, and `turnstileWidget`. Null = never ran. */
-    functionHealthCheckedAt: string | null;
-    /** Deployed-URL browser probe (the `browser` audit): cross-engine render OK, mobile render OK,
-     *  internal-links OK + broken count, and when it last ran (one timestamp gates all three). */
-    crossbrowserOk: boolean | null;
-    mobileOk: boolean | null;
-    linksOk: boolean | null;
-    brokenLinks: number | null;
-    browserCheckedAt: string | null;
-    /** Uptime-reachable verdict (browser audit): every sampled route returned 2xx/3xx. Single-select
-     *  `pass`/`fail`; null = never ran. Point-in-time. Freshness-gated by `browserCheckedAt`. */
-    reachableOk: "pass" | "fail" | null;
-    /** Titles & meta verdict (browser audit, chromium): every sampled route has a non-empty `<title>`
-     *  ≤ 70 chars + a non-empty meta description, and no duplicate titles across the sample.
-     *  Single-select `pass`/`fail`; null = never ran. Freshness-gated by `browserCheckedAt`. */
-    titleMetaOk: "pass" | "fail" | null;
-    /** Per-site copy overrides (M6a). Blank → null → the DEFAULT_COPY value. */
-    copyIntro: string | null;
-    copyContact: string | null;
-    copyFooter: string | null;
-    /** Go-live timestamp, stamped when a Launch report sends (M6b). Null = not yet launched. */
-    launchedAt: string | null;
-    /** Optional per-site webhook (e.g. Zapier Catch Hook). When set, the ingest
-     *  POSTs newsletter-formType submissions here (best-effort). Blank → null. */
-    newsletterWebhook: string | null;
-    /** Per-site Mailchimp (newsletter). Both must be set for the direct add;
-     *  blank → skipped. The API key is `key-dc` format; dc is derived from it. */
-    mailchimpApiKey: string | null;
-    mailchimpAudienceId: string | null;
-    /** Per-site Cloudflare Turnstile gate (Airtable checkbox). When true, a submission
-     *  whose Turnstile token verifies as "fail" (forged) OR "absent" (secret configured
-     *  centrally but NO token forwarded — the direct-POST-bot signature) is escalated to
-     *  auto-spam regardless of content score. A present-but-expired token stays
-     *  "unverifiable" and neutral (a real browser DID render the widget — fail-open).
-     *  ROLLOUT PRECONDITION: only enable on a site whose DEPLOYED package forwards
-     *  `_meta.turnstileToken` from EVERY form (widget rendered + `cf-turnstile-response`
-     *  posted; check the site's `/health` → forms.turnstile:true). A site that never
-     *  forwards tokens would silently bucket 100% of its real leads — and the form-e2e
-     *  probe cannot catch that state (testMode bypasses the gate). */
-    requireTurnstile: boolean;
-    /** GitHub-signals sweep (slice 2a), written nightly by `github-signals --fleet`. */
-    renovateFailingCis: number | null;
-    defaultBranchCi: string | null;
-    lastCommitAt: string | null;
-    githubSignalsAt: string | null;
-    /** Per-site smoke-suite verdict (the `smoke` audit runs `pnpm test:smoke`).
-     *  Single-select pass/fail; null = never ran. `lastSmokeAt` gates freshness. */
-    smokeOk: "pass" | "fail" | null;
-    lastSmokeAt: string | null;
-    /** Synthetic form end-to-end verdict (the `form-e2e` audit submits the real prod
-     *  contact form in test-mode). Single-select pass/fail; null = never ran OR (with
-     *  a fresh `formE2eCheckedAt`) no contact form → n/a. `formE2eCheckedAt` gates
-     *  freshness AND encodes the n/a-vs-never-ran distinction. */
-    formE2eOk: "pass" | "fail" | null;
-    formE2eCheckedAt: string | null;
-    /**
-     * Nightly Prismic model drift sweep (`prismic-models --fleet --write-airtable`).
-     *
-     * FOUR-VALUED, unlike every other verdict column in this table, and the extra
-     * state is the point:
-     *
-     *   - `pass`    — the repo and its Prismic repository were compared and agree.
-     *   - `fail`    — they were compared and DIVERGE (a model to create/update, or
-     *                 one that exists only in Prismic). A finding for a human.
-     *   - `unknown` — THE CHECK ITSELF FAILED. Unreadable checkout, broken config,
-     *                 missing/expired token, unreadable remote. Nothing at all was
-     *                 established about this site's models.
-     *   - `null`    — no verdict to hold: the sweep has never run for this site, or
-     *                 it ran and found no Prismic config at all (a repo that simply
-     *                 is not a Prismic site). `prismicModelsCheckedAt` separates
-     *                 those two — fresh timestamp, blank verdict = "checked, and
-     *                 there is nothing here to check".
-     *
-     * `unknown` exists because the alternatives are both wrong in the dangerous
-     * direction. Writing `pass` for a site nobody could read is a green tick over
-     * an outage; writing NOTHING (the obvious "leave the last known value alone")
-     * leaves yesterday's `pass` standing for a site that has been failing every
-     * night since — and nothing ages a stale `pass` out, because the digest's
-     * freshness gate only ever examines failures. Both make "I could not read this
-     * site" indistinguishable from "this site is fine", in the record the cockpit
-     * and the digest read.
-     *
-     * OPERATOR PRECONDITION: `Prismic Models` is a single select whose options are
-     * `pass`, `fail`, `unknown`. Until the three columns exist the sweep's writes
-     * fail with UNKNOWN_FIELD_NAME and are collected as soft failures — the feature
-     * ships dark rather than reddening the nightly.
-     */
-    prismicModels: PrismicModelsVerdict | null;
-    /** When the sweep last ran for this site — written on EVERY outcome, including
-     *  `unknown` and blank, so the age of the row is the age of the answer. */
-    prismicModelsCheckedAt: string | null;
-    /** What the sweep found, verbatim: the drift report for a `fail`, the reason
-     *  nothing could be established for an `unknown`, the skip reason for a blank,
-     *  and null for a `pass` (which clears yesterday's finding). */
-    prismicModelsDrift: string | null;
-    /**
-     * An expiry the operator sets to accept a KNOWN, EXPECTED `fail` — most often
-     * "I am modelling in Prismic on a branch that has not landed, so Prismic is
-     * legitimately ahead of `main`". While this timestamp is in the future the
-     * drift item is not raised.
-     *
-     * It expires on purpose, and nothing renews it automatically. A permanent ack
-     * would reproduce this column's own failure mode one step later: once the
-     * branch lands, the same acked cell would swallow real drift and "nobody is
-     * looking at this" would render as "this is fine". An expiry means the worst
-     * case is a silence that ends by itself.
-     *
-     * Narrow by construction — it mutes only `fail`, the finding the operator
-     * actually reviewed. `unknown` (the check could not run) and a verdict too old
-     * to be current are never muted by it; see `collectPrismicDriftAlerts`.
-     *
-     * OPERATOR PRECONDITION: `Prismic Ack Until` is a dateTime column. Until it
-     * exists this reads null and nothing is acked, which is the safe direction.
-     */
-    prismicAckUntil: string | null;
-    notifyRouting: NotifyRouting | null;
-    /** The RAW `Notify Routing` cell, verbatim. Same reason `statusRaw` exists: the
-     *  dashboard editor round-trips this JSON, and re-serializing the PARSED object
-     *  would drop any key the parser ignores and reformat what the operator typed —
-     *  a silent rewrite of a cell they only opened to look at. */
-    notifyRoutingRaw: string | null;
-    /** Read-back of the code-owned next-due dates (date-only, written by the
-     *  nightly `writeNextDueDates`). These exist so the writer can DIFF the
-     *  freshly-computed dates against what the row already holds and skip the
-     *  ~31 no-op writes a night the fleet was paying for (#539 Phase 3). Null =
-     *  cell blank or the operator-added `Next … at` column absent. */
-    nextMaintenanceAt: string | null;
-    nextTestingAt: string | null;
-};
-/** The `Prismic Models` cell — see {@link WebsiteRow.prismicModels} for why it
- *  carries a third state that no other verdict column in this table has. */
-type PrismicModelsVerdict = "pass" | "fail" | "unknown";
-type Severity = "low" | "moderate" | "high" | "critical";
-/** One known vulnerability behind the security counts, as persisted/rendered. */
-type SecurityAdvisory = {
-    module: string;
-    severity: Severity;
-    title: string;
-    cves: string[];
-    url: string | null;
-    /** GitHub Dependabot dependency scope ("runtime" | "development"), when known. Lets the
-     *  dashboard flag build-time-only ("development") vulns. Omitted for advisories from the
-     *  lockfile `pnpm audit` fallback, which carries no per-package graph scope. */
-    scope?: "runtime" | "development";
-    /** GitHub Dependabot dependency-graph relationship, when known. "transitive" means no
-     *  direct-dep bump can fix it — Renovate's vuln alerts have no fix vehicle until the weekly
-     *  lockfile-maintenance window. Omitted when GitHub reports "unknown" or for the
-     *  `pnpm audit` fallback. Drives {@link allActionableVulnsTransitive}. */
-    relationship?: "direct" | "transitive";
-};
+declare function fromAirtableBase(base: AirtableBase, opts?: AirtableInventoryOptions): InventoryProvider;
 
 type ResolvedCopy = {
     maintenanceIntro: string;
@@ -992,6 +616,16 @@ type EvidenceRecord = {
     note: string;
 };
 
+/**
+ * The report-row model and its pure, vendor-neutral coercers.
+ *
+ * `ReportRow` is what BOTH readers return — `mapRow` over an Airtable record
+ * (`src/reports/airtable/reports.ts`) and the Turso report reader in
+ * `src/db/fleet-state.ts`. Moved out of the Airtable module in #539 Phase 6
+ * step 1 (#646) so the Turso read path does not depend on the directory Phase 6
+ * deletes. `src/reports/airtable/reports.ts` re-exports every name.
+ */
+
 type DeliveryStatus = "pending" | "delivered" | "bounced" | "complained";
 type ReportRow = {
     id: string;
@@ -1040,13 +674,6 @@ type ReportRow = {
     overrideBy: string | null;
     overrideAt: string | null;
 };
-/** Called with the record Airtable echoed back from the create, before it is
- *  mapped (#539 Phase 5). Structurally typed rather than importing the db
- *  layer's `RawRecord`, so this module stays the leaf it has always been. */
-type CreatedDraftMirror = (rec: {
-    id: string;
-    fields: Record<string, unknown>;
-}) => Promise<void>;
 
 /** Report rows (migration 0007). PK = Airtable rec id. `checklist` is JSON
  *  keyed by the STABLE checklist key (src/reports/checklist.ts), not the
@@ -1097,7 +724,10 @@ interface ReportsTable {
  *  holding a patch cannot accidentally write megabytes of HTML. */
 type ReportMirrorPatch = Partial<Pick<ReportsTable, "approved_to_send" | "approved_at" | "approved_by" | "send_override" | "override_reason" | "override_by" | "override_at" | "delivery_status" | "commentary" | "draft_ready" | "lighthouse_performance" | "lighthouse_accessibility" | "lighthouse_best_practices" | "lighthouse_seo" | "ga_users_current" | "ga_users_previous" | "search_found_page1" | "search_position" | "completed_on" | "sent_at" | "resend_message_id">>;
 
-/** #539 Phase 5: the Turso write-through for the Reports write surface.
+/** #539 Phase 5: the Turso write-through for the Reports write surface — and,
+ *  since #646 step 4, the surface itself: `create` MINTS nothing (the creator
+ *  does) but it is the only place a report row comes into existence, and
+ *  `forSite` is the drafting path's read.
  *
  *  Before this, the only report mirrors were UPDATEs on the request path
  *  (approve, override, delivery status, commentary). Everything the DRAFTING
@@ -1116,13 +746,38 @@ type ReportMirrorPatch = Partial<Pick<ReportsTable, "approved_to_send" | "approv
  *  line means the wiring is gone, not that conditions were quiet.
  */
 
-/** The three shapes a report write takes. Injected as ONE object rather than
- *  three parameters because they share a db handle and always travel together:
- *  a caller holding `created` but not `body` produces exactly the half-mirrored
- *  state (row present, preview 404) this module exists to prevent. */
+/** The drafting path's whole report surface. Injected as ONE object rather than
+ *  as separate parameters because they share a db handle and always travel
+ *  together: a caller holding `create` but not `body` produces exactly the
+ *  half-written state (row present, preview 404) this module exists to prevent.
+ *
+ *  Since #646 step 4 this is no longer only a mirror. `create` is the PRIMARY
+ *  write — Turso mints the report id and owns the row, and there is no Airtable
+ *  record for it to shadow (see `src/reports/create-report.ts`) — and `forSite`
+ *  is a READ the drafting path used to make against Airtable, which cannot see a
+ *  report for a `site_<ULID>` site. `body` and `patch` keep their older meaning:
+ *  write-throughs for state whose `rec…` rows Airtable may still shadow. The name
+ *  is kept because every composition root and every injection site already uses
+ *  it, and a rename would churn ten files to say what this comment says. */
 type ReportMirror = {
-    /** A row Airtable just CREATED, as Airtable echoed it back. */
-    created: CreatedDraftMirror;
+    /** Insert a brand-new report row and return what Turso stored. Not a mirror:
+     *  the row exists nowhere else. */
+    create: (rec: {
+        id: string;
+        fields: Record<string, unknown>;
+    }) => Promise<ReportRow>;
+    /** A row AIRTABLE created, as Airtable echoed it back — the pre-step-4 shape.
+     *  NO production path calls it any more: it pairs with the legacy Airtable
+     *  `createDraft`, which nothing calls either. Both are kept rather than
+     *  deleted because deleting from the Airtable layer is step 6, and both go
+     *  together when it comes. */
+    created: (rec: {
+        id: string;
+        fields: Record<string, unknown>;
+    }) => Promise<void>;
+    /** Every report for one site — the single-queue rule's and the period
+     *  derivation's read. */
+    forSite: (siteId: string) => Promise<ReportRow[]>;
     /** A freshly rendered body for an existing row. */
     body: (reportId: string, html: string) => Promise<void>;
     /** Columns just written to an existing row. */
@@ -1154,7 +809,10 @@ type ReportMirror = {
  *  pass the EXACT FieldSet the Airtable writer returned, so the mirror can never
  *  carry a different payload than the write it shadows. */
 type SiteMirror = {
-    /** A row Airtable just CREATED, as Airtable echoed it back (`ensure-site`).
+    /** A row Airtable just CREATED, as Airtable echoed it back. `ensure-site` used
+     *  this until #646 step 3; it now creates sites in Turso directly
+     *  (`src/fleet/ensure-site.ts`), and neither this nor `hasRow` has a caller left
+     *  outside tests — both go with the Airtable layer in step 6.
      *  Every other op is an UPDATE, which does nothing for a row that does not
      *  exist yet — so without this a bootstrapped site is invisible to Turso and
      *  every mirror the rest of the bootstrap fires reports `mirrored=missed`. */
@@ -1166,6 +824,13 @@ type SiteMirror = {
     health: (siteId: string, fields: Record<string, unknown>) => Promise<void>;
     /** Columns that live in `sites`. */
     site: (siteId: string, fields: Record<string, unknown>) => Promise<void>;
+    /** #645. Does Turso hold a row for this site id? A pure READ, so it is the one
+     *  op here that neither logs a SITE_MIRROR line nor throws under the freeze —
+     *  `ensure-site` uses it to decide whether to heal, and a probe that threw
+     *  would sink the very command that repairs the gap. Creds-absent answers
+     *  `true` ("assume present"), so a mirror that cannot read can never provoke
+     *  a blind insert. */
+    hasRow: (siteId: string) => Promise<boolean>;
 };
 
 type ShootOptions = {
@@ -1174,6 +839,9 @@ type ShootOptions = {
     height: number;
     deviceScaleFactor: number;
     settleMs: number;
+    /** Extra CSS selector(s) hidden before the shutter, for a site whose consent
+     *  or interstitial UI the class/id heuristic misses. */
+    consentSelector?: string;
 };
 /** Injected browser IO. The real impl drives Playwright; tests pass a fake. */
 type Shooter = {
@@ -1187,8 +855,11 @@ type GenerateInput = {
     slug?: string;
     /** Injected browser IO (tests). */
     shooter?: Shooter;
-    /** Per-site settle override for animation-heavy or consent-gated homepages. */
+    /** Per-site settle override for animation-heavy homepages. */
     settleMs?: number;
+    /** Extra CSS selector(s) hidden before the shutter, for consent or
+     *  interstitial UI the capture's class/id heuristic misses (#654). */
+    consentSelector?: string;
 };
 type GeneratedHeaderImage = {
     bytes: Uint8Array;
@@ -1337,6 +1008,25 @@ type ResendClient = {
 
 type OrchestrateOptions = {
     resend?: ResendClient;
+    /**
+     * #646 step 4: the send queue and the fleet roster, read from TURSO.
+     *
+     * Required rather than defaulted, for the reason the mirrors below are: this
+     * function is called directly by tests, and a default would let one reach a
+     * live store. The CLI wires `listSendableReports`/`listSites` over one
+     * connection.
+     */
+    sendable: () => Promise<ReportRow[]>;
+    roster: () => Promise<WebsiteRow[]>;
+    /**
+     * The site's header plate, from `sites.header_image*` (design D5 made Turso its
+     * source; the re-render path has read it from there since #643). `null` means
+     * Turso holds no bytes for that site, and the send falls back to the site's
+     * Airtable attachment — which is the ONLY reason this path still reads
+     * Airtable, and why the fallback fetches ONE site's record rather than the
+     * roster it used to get the signed url from.
+     */
+    loadHeaderPlate: (siteId: string) => Promise<Uint8Array | null>;
     /** #539 Phase 5: Turso write-through for the Websites row a Launch send
      *  updates. Injected rather than defaulted — this function is called directly
      *  by tests, and a default would open a real libSQL handle inside the suite. */
@@ -1349,7 +1039,7 @@ type OrchestrateOptions = {
      *  through `mirrorWrite` so the freeze switch owns the error semantics. */
     reportSentMirror?: (reportId: string, sentAt: Date, messageId: string | null) => Promise<void>;
 };
-declare function sendApprovedReports(options?: OrchestrateOptions): Promise<{
+declare function sendApprovedReports(options: OrchestrateOptions): Promise<{
     output: string;
     code: number;
 }>;
@@ -1452,6 +1142,15 @@ type SubmissionRow = {
      *  was attempted: a non-newsletter form, a spam row, a site with no destination
      *  configured, or a row written before 0005. See ingest.ts for the token grammar. */
     fanoutStatus?: string | null;
+    /** Resend's bounce classification, kept so a content rejection by the CLIENT's
+     *  mail filter can be told apart from a dead mailbox (#783). Null for a
+     *  complaint, and for every row written before migration 0018. */
+    bounceType?: string | null;
+    bounceSubType?: string | null;
+    bounceMessage?: string | null;
+    /** ISO-8601 of the operator saying "this address is not dead" (#783). The row
+     *  keeps its bounce record and stops counting toward the alarm. */
+    bounceAckAt?: string | null;
 };
 
 type ScreenOutTotals = {
@@ -1474,6 +1173,13 @@ type AttentionItem = {
     /** Stable identity for diffing: `vuln:<siteId>`, `delivery:<reportId>`. */
     key: string;
     kind: "vuln" | "delivery" | "renovate" | "lighthouse" | "ci" | "analytics" | "preflight" | "turnstile" | "notify-bounce"
+    /** #645. Leads captured by the dead-letter because their site could not be
+     *  placed — a store outage during the lookup, or (since #645) a slug with no
+     *  Turso row at all. Until this kind existed a dropped lead had NO alarm
+     *  anywhere: the queue could fill and nothing said so. Keyed by SLUG, not by
+     *  site id, because the whole point of the worst case is that the slug
+     *  resolves to no site. */
+     | "deadletter"
     /** The nightly Prismic model sweep. THREE item flavors share this kind —
      *  `prismic-drift:` (repo and Prismic diverge), `prismic-unknown:` (the check
      *  ran and could not answer), `prismic-stale:` (nobody has re-established the
@@ -1612,6 +1318,17 @@ type CockpitModel = {
      *  invisible to every fleet op, so the Needs-you feed surfaces them as amber watch
      *  rows (optional for back-compat). */
     unrecognizedStatus?: OffFleetSiteEntry[];
+    /** #786. Attention items that belong to NO site card. The grid is built from
+     *  the visible sites and items are grouped onto it by `siteName`, so an item
+     *  naming a site the fleet does not have matched nothing and was dropped —
+     *  silently, on the one surface the operator actually watches.
+     *
+     *  The collector that produces them is the one whose entire point is that the
+     *  site is missing: a dead letter for a slug resolving to no fleet row means
+     *  leads are being dropped RIGHT NOW. Kept general rather than
+     *  dead-letter-specific, so a future card-less item lands here instead of
+     *  vanishing the same way. Optional for back-compat with hand-built models. */
+    cardless?: AttentionItem[];
 };
 /** The cockpit's alarm verdict for ONE site, for the /s/<slug> page header. */
 type SiteAlarmContext = {
@@ -1702,4 +1419,26 @@ declare function loadPlate(): Promise<Uint8Array>;
 /** Read a headline overlay (transparent PNG, ink-box cropped). */
 declare function loadHeadline(kind: HeadlineKind): Promise<Uint8Array>;
 
-export { ALL_AUDIT_NAMES, ALL_RECIPE_NAMES, type AirtableInventoryOptions, AuditName, AuditResult, BLURRED_CID, type BumpDepsOptions, type BundledImage, CHECK_CID, type ConvertToPnpmOptions, DEFAULT_INIT_STEPS, type DraftOptions, type DraftResult, type DueItem, type GenerateInput, type GeneratedHeaderImage, type HeaderImage, type InitOptions, type InitResult, type InitStep, type InitStepResult, InventoryProvider, type LighthouseScores, type LocalPathOptions, type OnboardAudit, type OnboardOptions, type OrchestrateOptions, RecipeName, RecipeResult, type RefreshHeaderDeps, type RenderResult, type ReportData, type ReportType, Site, type UpgradeSvelte4to5Options, a11yAudit, a11yFixturesPage, bumpDeps, convertToPnpm, depsAudit, domainFromUrl, draftReportForSite, findDueReports, fromAirtableBase, fromJsonFile, generateHeaderImage, init, isRecipeName, lighthouseAudit, lintAudit, loadBundledImages, loadHeadline, loadPlate, localPath, onboard, renderCockpitHtml, renderReportHtml, renderSiteDashboardHtml, runAudits, runAuditsAcross, securityAudit, selfCaretRange, selfPackageVersion, sendApprovedReports, svelteCodemods, upgradeSvelte4to5, verifyBasicAuth };
+/** The plate's pixel dimensions — Figma frame 600x800 exported at 4x. */
+declare const CANVAS: {
+    readonly width: 2400;
+    readonly height: 3200;
+};
+/** The MacBook Pro screen the site screenshot is pasted into — the area inside
+ *  the bezel, so the bezel stays visible around the content exactly as it does
+ *  in the hand-made headers. Aspect 1.6017 (16:10 to within 0.11%).
+ *
+ *  Measured on plate-clean.png: content spans x 310..1655, y 1888..2727, with a
+ *  single anti-aliased blend pixel on the outside of the left, top and bottom
+ *  edges (x=309 rgb(5,10,8); y=1887 rgb(14,29,24); y=2727 rgb(27,50,74)). The
+ *  rect INCLUDES those blend pixels deliberately: each one is part baked
+ *  screenshot, so leaving it uncovered leaves a faint tinted line of the other
+ *  site, while covering it repaints one pixel of bezel edge and is invisible. */
+declare const SCREEN: {
+    readonly x: 309;
+    readonly y: 1887;
+    readonly w: 1347;
+    readonly h: 841;
+};
+
+export { ALL_AUDIT_NAMES, ALL_RECIPE_NAMES, type AirtableInventoryOptions, AuditName, AuditResult, BLURRED_CID, type BumpDepsOptions, type BundledImage, CANVAS, CHECK_CID, type ConvertToPnpmOptions, DEFAULT_INIT_STEPS, type DraftOptions, type DraftResult, type DueItem, type GenerateInput, type GeneratedHeaderImage, type HeaderImage, type InitOptions, type InitResult, type InitStep, type InitStepResult, InventoryProvider, type LighthouseScores, type LocalPathOptions, type OnboardAudit, type OnboardOptions, type OrchestrateOptions, RecipeName, RecipeResult, type RefreshHeaderDeps, type RenderResult, type ReportData, type ReportType, SCREEN, Site, type UpgradeSvelte4to5Options, a11yAudit, a11yFixturesPage, bumpDeps, convertToPnpm, depsAudit, domainFromUrl, draftReportForSite, findDueReports, fromAirtableBase, fromJsonFile, generateHeaderImage, init, isRecipeName, lighthouseAudit, lintAudit, loadBundledImages, loadHeadline, loadPlate, localPath, onboard, renderCockpitHtml, renderReportHtml, renderSiteDashboardHtml, runAudits, runAuditsAcross, securityAudit, selfCaretRange, selfPackageVersion, sendApprovedReports, svelteCodemods, upgradeSvelte4to5, verifyBasicAuth };