@reddoorla/maintenance 0.96.0 → 0.97.0

package/dist/ensure-site-JEKV2ODE.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/fleet/ensure-site.ts"],"sourcesContent":["/**\n * `ensure-site`, Turso-native (#539 Phase 6 step 3, #646; operator decision\n * 2026-09-17).\n *\n * Find-or-create a site by SLUG so it exists in the fleet from day one. Turso is\n * the source of truth: a new site gets a minted `site_<ULID>` id and its three\n * rows (`sites`, `site_health`, `site_schedule`) in one transaction. The command\n * is re-run to RESUME a partial bootstrap, so everything keys on the slug — a\n * re-run finds the site and never mints a second id.\n *\n * Fill-blanks-only on the exists path: a resumed bootstrap must never clobber an\n * operator's edit. The one exception is `displayName` (#664): `--name` targets the\n * name and nothing else, so a differing value IS the operator's rename. A rename\n * changes `sites.name` only; `sites.slug` is the stable external handle and never\n * moves, which is why a name that would slugify differently is refused outright.\n *\n * ## The Airtable shadow for a NEW site: none\n *\n * A new site is not written to Airtable at all. An Airtable record would carry\n * its own `rec` id that is NOT the site id, and every batch job still enumerating\n * the fleet from Airtable (#646 step 4, not yet done) would then write Turso by\n * that `rec` id — an UPDATE matching no row, which under the freeze THROWS\n * (`mirrored=missed`). A half-visible site that reds the nightly sweeps is worse\n * than one those sweeps cannot see yet. The rollback week is over and a rollback\n * to Airtable has never been rehearsed, so there is no recovery the record would\n * be keeping trustworthy. Every Airtable shadow writer skips a `site_` id with an\n * `AIRTABLE_SHADOW skipped=non-rec-id` line (`src/fleet/site-id.ts`).\n *\n * The cost, named: until step 4 moves batch enumeration to Turso, a site created\n * here is invisible to the Airtable-enumerated jobs (audits incl. form-e2e,\n * report drafting, digest, github-signals, renovate-dispatch…). Form ingest,\n * the dashboard and every Turso reader see it immediately.\n *\n * ## Pre-existing `rec` sites\n *\n * Both id shapes coexist permanently. A `rec` site found in Turso keeps its id,\n * and its fill-blanks / rename is still shadowed to Airtable (Airtable stays the\n * shadow until step 6), Airtable first so a re-run converges both stores.\n *\n * The #645 heal survives in one form: when Turso has no row for the slug but\n * Airtable does, the Airtable record is ADOPTED under its own `rec` id instead of\n * minting a second identity for the same site. That lookup runs only when an\n * Airtable client is wired, and a lookup that FAILS refuses the create — minting\n * while unable to rule out a duplicate identity would be the one unrecoverable\n * outcome here.\n */\nimport { siteSlug } from \"./site-row.js\";\nimport { isAirtableRecordId, mintSiteId, skipsAirtableShadow } from \"./site-id.js\";\nimport type { NewSiteRow, SiteIdentityPatch } from \"../db/fleet-state.js\";\n\nexport type { SiteIdentityPatch } from \"../db/fleet-state.js\";\n\nexport type EnsureSiteInput = {\n  /** Canonical slug; normalised through `siteSlug`. The stored `sites.slug`. */\n  slug: string;\n  /** Human display name. Written on create (default: the slug) and, unlike every\n   *  other input, UPDATED on an existing site when it differs (#664) — it is used\n   *  verbatim in client-facing copy (forms auto-reply intro, report subjects).\n   *  Must slugify to the same slug, or it is refused. */\n  displayName?: string;\n  url?: string;\n  pointOfContact?: string;\n  /** owner/repo. Default on create: `reddoorla/<slug>`. */\n  gitRepo?: string;\n};\n\n/** The identity columns of an existing site, as `ensure-site` compares them. */\nexport type ExistingSite = {\n  id: string;\n  name: string;\n  url: string | null;\n  pointOfContact: string | null;\n  gitRepo: string | null;\n};\n\n/** The Turso operations the creator needs. `src/db/site-create.ts` implements it. */\nexport type SiteStore = {\n  findBySlug: (slug: string) => Promise<ExistingSite | null>;\n  /** Insert all three rows atomically. Rejects with `code: \"SLUG_TAKEN\"` when the\n   *  `sites.slug` UNIQUE index refuses the row. */\n  create: (site: NewSiteRow) => Promise<void>;\n  /** Resolves whether a row matched. Never touches the slug (by type). */\n  updateIdentity: (siteId: string, patch: SiteIdentityPatch) => Promise<boolean>;\n};\n\n/** The Airtable layer, as the creator still needs it until #646 step 6. Every\n *  member is legacy: the lookup + adopt keep the #645 heal, `update` shadows a\n *  `rec` site's fill. The CLI wires it only when Airtable credentials exist. */\nexport type LegacyAirtableSites = {\n  findBySlug: (slug: string) => Promise<{ id: string; fields: Record<string, unknown> } | null>;\n  /** Insert Turso rows for an Airtable record that has none (the #645 heal). */\n  adopt: (rec: { id: string; fields: Record<string, unknown> }) => Promise<void>;\n  update: (recordId: string, patch: SiteIdentityPatch) => Promise<void>;\n};\n\nexport type EnsureSiteDeps = {\n  store: SiteStore;\n  airtable?: LegacyAirtableSites | null;\n  /** Injectable for tests; defaults to {@link mintSiteId}. */\n  mintId?: () => string;\n};\n\nexport type EnsureSiteResult = {\n  status: \"created\" | \"exists\";\n  siteId: string;\n  /** Identity fields written on the exists path (`name` = a `--name` rename). */\n  updatedFields: Array<keyof SiteIdentityPatch>;\n  /** Inputs that DIFFERED from an existing non-blank value and were left untouched\n   *  (fill-blanks-only) — surfaced so a resumed bootstrap with a corrected value\n   *  does not silently discard it. */\n  skippedMismatches: Array<keyof SiteIdentityPatch>;\n  /** #645: the site existed in Airtable with NO Turso row, and this run adopted it.\n   *  Its leads were being answered `unknown-site` until now. */\n  healedDbRow: boolean;\n  /** What happened to the Airtable shadow: `skipped` for a `site_` id (created or\n   *  updated), `written` when a `rec` site's changes were shadowed, `none` when\n   *  there was nothing to shadow or no Airtable client was wired. */\n  airtableShadow: \"skipped\" | \"written\" | \"none\";\n};\n\nconst slugTaken = (err: unknown): boolean =>\n  typeof err === \"object\" && err !== null && (err as { code?: unknown }).code === \"SLUG_TAKEN\";\n\nexport async function ensureSite(\n  input: EnsureSiteInput,\n  deps: EnsureSiteDeps,\n): Promise<EnsureSiteResult> {\n  const { store } = deps;\n  const airtable = deps.airtable ?? null;\n  const slug = siteSlug(input.slug);\n  if (!slug) throw new Error(`ensure-site: '${input.slug}' does not slugify to a usable slug`);\n  if (input.displayName !== undefined && siteSlug(input.displayName) !== slug) {\n    throw new Error(\n      `ensure-site: display name '${input.displayName}' slugifies to '${siteSlug(input.displayName)}', not '${slug}' — a rename never changes the slug`,\n    );\n  }\n\n  let existing = await store.findBySlug(slug);\n  let healedDbRow = false;\n\n  if (!existing && airtable) {\n    // Throws through on failure — see \"Pre-existing rec sites\" above.\n    const legacy = await airtable.findBySlug(slug);\n    if (legacy) {\n      await airtable.adopt(legacy);\n      existing = await store.findBySlug(slug);\n      if (!existing) {\n        throw new Error(\n          `ensure-site: adopted Airtable record ${legacy.id} for '${slug}' but Turso still has no row for the slug`,\n        );\n      }\n      healedDbRow = true;\n    }\n  }\n\n  if (!existing) {\n    const id = (deps.mintId ?? mintSiteId)();\n    try {\n      await store.create({\n        id,\n        slug,\n        name: input.displayName ?? slug,\n        status: \"building\",\n        url: input.url ?? null,\n        pointOfContact: input.pointOfContact ?? null,\n        gitRepo: input.gitRepo ?? `reddoorla/${slug}`,\n      });\n    } catch (err) {\n      if (!slugTaken(err)) throw err;\n      const owner = await store.findBySlug(slug).catch(() => null);\n      throw new Error(\n        `ensure-site: slug '${slug}' is already taken${owner ? ` by site ${owner.id}` : \"\"} — it was created after this run looked; re-run to resume that site`,\n        { cause: err },\n      );\n    }\n    skipsAirtableShadow(\"ensureSite.create\", id);\n    return {\n      status: \"created\",\n      siteId: id,\n      updatedFields: [],\n      skippedMismatches: [],\n      healedDbRow: false,\n      airtableShadow: \"skipped\",\n    };\n  }\n\n  const patch: SiteIdentityPatch = {};\n  const skippedMismatches: Array<keyof SiteIdentityPatch> = [];\n  const consider = (\n    key: \"url\" | \"pointOfContact\" | \"gitRepo\",\n    provided: string | undefined,\n    current: string | null,\n  ) => {\n    if (!provided) return;\n    if (current === null || current === \"\") patch[key] = provided;\n    else if (current !== provided) skippedMismatches.push(key);\n  };\n  consider(\"url\", input.url, existing.url);\n  consider(\"pointOfContact\", input.pointOfContact, existing.pointOfContact);\n  consider(\"gitRepo\", input.gitRepo, existing.gitRepo);\n  if (input.displayName !== undefined && existing.name !== input.displayName) {\n    patch.name = input.displayName;\n  }\n\n  const updatedFields = Object.keys(patch) as Array<keyof SiteIdentityPatch>;\n  let airtableShadow: EnsureSiteResult[\"airtableShadow\"] = \"none\";\n  if (updatedFields.length > 0) {\n    if (skipsAirtableShadow(\"ensureSite.update\", existing.id)) {\n      airtableShadow = \"skipped\";\n    } else if (airtable && isAirtableRecordId(existing.id)) {\n      await airtable.update(existing.id, patch);\n      airtableShadow = \"written\";\n    }\n    if (!(await store.updateIdentity(existing.id, patch))) {\n      throw new Error(`ensure-site: site ${existing.id} vanished from Turso mid-run`);\n    }\n  }\n  return {\n    status: \"exists\",\n    siteId: existing.id,\n    updatedFields,\n    skippedMismatches,\n    healedDbRow,\n    airtableShadow,\n  };\n}\n"],"mappings":";;;;;;;;;;AAwHA,IAAM,YAAY,CAAC,QACjB,OAAO,QAAQ,YAAY,QAAQ,QAAS,IAA2B,SAAS;AAElF,eAAsB,WACpB,OACA,MAC2B;AAC3B,QAAM,EAAE,MAAM,IAAI;AAClB,QAAM,WAAW,KAAK,YAAY;AAClC,QAAM,OAAO,SAAS,MAAM,IAAI;AAChC,MAAI,CAAC,KAAM,OAAM,IAAI,MAAM,iBAAiB,MAAM,IAAI,qCAAqC;AAC3F,MAAI,MAAM,gBAAgB,UAAa,SAAS,MAAM,WAAW,MAAM,MAAM;AAC3E,UAAM,IAAI;AAAA,MACR,8BAA8B,MAAM,WAAW,mBAAmB,SAAS,MAAM,WAAW,CAAC,WAAW,IAAI;AAAA,IAC9G;AAAA,EACF;AAEA,MAAI,WAAW,MAAM,MAAM,WAAW,IAAI;AAC1C,MAAI,cAAc;AAElB,MAAI,CAAC,YAAY,UAAU;AAEzB,UAAM,SAAS,MAAM,SAAS,WAAW,IAAI;AAC7C,QAAI,QAAQ;AACV,YAAM,SAAS,MAAM,MAAM;AAC3B,iBAAW,MAAM,MAAM,WAAW,IAAI;AACtC,UAAI,CAAC,UAAU;AACb,cAAM,IAAI;AAAA,UACR,wCAAwC,OAAO,EAAE,SAAS,IAAI;AAAA,QAChE;AAAA,MACF;AACA,oBAAc;AAAA,IAChB;AAAA,EACF;AAEA,MAAI,CAAC,UAAU;AACb,UAAM,MAAM,KAAK,UAAU,YAAY;AACvC,QAAI;AACF,YAAM,MAAM,OAAO;AAAA,QACjB;AAAA,QACA;AAAA,QACA,MAAM,MAAM,eAAe;AAAA,QAC3B,QAAQ;AAAA,QACR,KAAK,MAAM,OAAO;AAAA,QAClB,gBAAgB,MAAM,kBAAkB;AAAA,QACxC,SAAS,MAAM,WAAW,aAAa,IAAI;AAAA,MAC7C,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,UAAI,CAAC,UAAU,GAAG,EAAG,OAAM;AAC3B,YAAM,QAAQ,MAAM,MAAM,WAAW,IAAI,EAAE,MAAM,MAAM,IAAI;AAC3D,YAAM,IAAI;AAAA,QACR,sBAAsB,IAAI,qBAAqB,QAAQ,YAAY,MAAM,EAAE,KAAK,EAAE;AAAA,QAClF,EAAE,OAAO,IAAI;AAAA,MACf;AAAA,IACF;AACA,wBAAoB,qBAAqB,EAAE;AAC3C,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,eAAe,CAAC;AAAA,MAChB,mBAAmB,CAAC;AAAA,MACpB,aAAa;AAAA,MACb,gBAAgB;AAAA,IAClB;AAAA,EACF;AAEA,QAAM,QAA2B,CAAC;AAClC,QAAM,oBAAoD,CAAC;AAC3D,QAAM,WAAW,CACf,KACA,UACA,YACG;AACH,QAAI,CAAC,SAAU;AACf,QAAI,YAAY,QAAQ,YAAY,GAAI,OAAM,GAAG,IAAI;AAAA,aAC5C,YAAY,SAAU,mBAAkB,KAAK,GAAG;AAAA,EAC3D;AACA,WAAS,OAAO,MAAM,KAAK,SAAS,GAAG;AACvC,WAAS,kBAAkB,MAAM,gBAAgB,SAAS,cAAc;AACxE,WAAS,WAAW,MAAM,SAAS,SAAS,OAAO;AACnD,MAAI,MAAM,gBAAgB,UAAa,SAAS,SAAS,MAAM,aAAa;AAC1E,UAAM,OAAO,MAAM;AAAA,EACrB;AAEA,QAAM,gBAAgB,OAAO,KAAK,KAAK;AACvC,MAAI,iBAAqD;AACzD,MAAI,cAAc,SAAS,GAAG;AAC5B,QAAI,oBAAoB,qBAAqB,SAAS,EAAE,GAAG;AACzD,uBAAiB;AAAA,IACnB,WAAW,YAAY,mBAAmB,SAAS,EAAE,GAAG;AACtD,YAAM,SAAS,OAAO,SAAS,IAAI,KAAK;AACxC,uBAAiB;AAAA,IACnB;AACA,QAAI,CAAE,MAAM,MAAM,eAAe,SAAS,IAAI,KAAK,GAAI;AACrD,YAAM,IAAI,MAAM,qBAAqB,SAAS,EAAE,8BAA8B;AAAA,IAChF;AAAA,EACF;AACA,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,QAAQ,SAAS;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;","names":[]}

package/dist/{ensure-site-XESZHZEB.js → ensure-site-OO4UPWNQ.js}

@@ -1,14 +1,12 @@
-import {
-  openBase,
-  readAirtableConfig
-} from "./chunk-HN6I2XWI.js";
 import {
   WEBSITES_TABLE,
   mapRow,
-  siteSlug,
   toAirtableStatus
-} from "./chunk-KN52PM63.js";
-import "./chunk-6VAL7XJT.js";
+} from "./chunk-TC4GANMX.js";
+import {
+  siteSlug
+} from "./chunk-ICSRWW5Q.js";
+import "./chunk-RQJFGK3A.js";
 
 // src/reports/airtable/ensure-site.ts
 var COLS = {
@@ -16,6 +14,17 @@ var COLS = {
   pointOfContact: "point of contact",
   gitRepo: "Git repo"
 };
+async function findWebsiteRecordBySlug(base, slug) {
+  let found = null;
+  await base(WEBSITES_TABLE).select({ pageSize: 100 }).eachPage((records, fetchNextPage) => {
+    for (const rec of records) {
+      if (!found && siteSlug(mapRow(rec).name) === slug)
+        found = { id: rec.id, fields: rec.fields };
+    }
+    fetchNextPage();
+  });
+  return found;
+}
 async function ensureSite(base, input, mirror) {
   const slug = siteSlug(input.slug);
   if (!slug) throw new Error(`ensure-site: '${input.slug}' does not slugify to a usable slug`);
@@ -85,40 +94,8 @@ async function ensureSite(base, input, mirror) {
   }
   return { status: "exists", siteId: existing.id, updatedFields, skippedMismatches, healedDbRow };
 }
-
-// src/cli/commands/ensure-site.ts
-async function runEnsureSiteCommand(slug, opts) {
-  if (!slug) return { output: "Provide a <slug> (e.g. `ensure-site roalson`).", code: 2 };
-  try {
-    const base = openBase(readAirtableConfig());
-    const { makeSiteMirror } = await import("./site-mirror-H2FYMN55.js");
-    const result = await ensureSite(
-      base,
-      {
-        slug,
-        ...opts.name ? { displayName: opts.name } : {},
-        ...opts.url ? { url: opts.url } : {},
-        ...opts.contact ? { pointOfContact: opts.contact } : {},
-        ...opts.gitRepo ? { gitRepo: opts.gitRepo } : {}
-      },
-      await makeSiteMirror()
-    );
-    const renamed = result.updatedFields.includes("Name") ? ` \u2014 Name set to "${opts.name}"` : "";
-    const blanks = result.updatedFields.filter((f) => f !== "Name");
-    const filled = blanks.length > 0 ? ` \u2014 filled blank field(s): ${blanks.join(", ")}` : "";
-    const skipped = result.skippedMismatches.length > 0 ? ` \u2014 differs from existing, left untouched (edit in Airtable): ${result.skippedMismatches.join(", ")}` : "";
-    const healed = result.healedDbRow ? ` \u2014 HEALED: the Turso row was MISSING and has been inserted; leads for this slug were being dropped (run \`db replay-deadletters\`)` : "";
-    const nameNote = result.status === "created" && !opts.name ? ` \u2014 Name set to "${slug}"; retitle in Airtable before forms/announce go live (or re-run with --name)` : "";
-    return {
-      output: `[${slug}] ${result.status} (${result.siteId})${healed}${renamed}${filled}${skipped}${nameNote}`,
-      code: 0
-    };
-  } catch (err) {
-    const e = err;
-    return { output: e.message ?? String(err), code: e.exitCode ?? 1 };
-  }
-}
 export {
-  runEnsureSiteCommand
+  ensureSite,
+  findWebsiteRecordBySlug
 };
-//# sourceMappingURL=ensure-site-XESZHZEB.js.map
+//# sourceMappingURL=ensure-site-OO4UPWNQ.js.map

package/dist/ensure-site-OO4UPWNQ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/reports/airtable/ensure-site.ts"],"sourcesContent":["import type { FieldSet, Records } from \"airtable\";\nimport type { AirtableBase } from \"./client.js\";\nimport { WEBSITES_TABLE, mapRow, siteSlug, type WebsiteRow } from \"./websites.js\";\nimport { toAirtableStatus } from \"./site-status.js\";\n\nexport type EnsureSiteInput = {\n  /** Canonical slug — matches by siteSlug(Name); the Name on create when no displayName given. */\n  slug: string;\n  /** Human display name written to Name on create, and — unlike every other\n   *  input — UPDATED on an existing row when it differs (#664). Name is\n   *  consumed VERBATIM in client-facing copy (forms auto-reply intro, report\n   *  subjects), so a bare machine slug there reads as \"Thanks for reaching out\n   *  to acme-co.\" — and the row that has it is exactly the one created before\n   *  the name was settled, which only this command re-run can fix. Must\n   *  slugify to the same slug or the row wouldn't be found on re-run. */\n  displayName?: string;\n  url?: string;\n  pointOfContact?: string;\n  /** owner/repo. Default on create: `reddoorla/<slug>`. */\n  gitRepo?: string;\n};\n\n/** #539 Phase 5. Structurally typed rather than importing the db layer's\n *  `SiteMirror`, so this module stays the leaf it has always been — a real\n *  `SiteMirror` satisfies it. Two ops because `ensureSite` has two write paths,\n *  and the create one is the reason this exists: every other site mirror is an\n *  UPDATE, which does nothing for a row that does not exist yet. */\nexport type EnsureSiteMirror = {\n  created: (rec: { id: string; fields: Record<string, unknown> }) => Promise<void>;\n  site: (siteId: string, fields: Record<string, unknown>) => Promise<void>;\n  /** #645. Does Turso hold a row for this site id? Optional so every pre-#645\n   *  caller (and every hand-built test mirror) is byte-for-byte unchanged —\n   *  absent means the heal below never runs. */\n  hasRow?: (siteId: string) => Promise<boolean>;\n};\n\nexport type EnsureSiteResult = {\n  status: \"created\" | \"exists\";\n  siteId: string;\n  /** Airtable column names written on the exists path (create path writes all). */\n  updatedFields: string[];\n  /** Inputs that DIFFERED from an existing non-blank cell and were left\n   *  untouched (fill-blanks-only) — surfaced so a resumed bootstrap with a\n   *  corrected value doesn't silently discard it. */\n  skippedMismatches: string[];\n  /** #645. True when the site existed in Airtable but had NO Turso row and this\n   *  run inserted one. Surfaced rather than logged-only because it is the\n   *  difference between \"nothing to do\" and \"this site's leads were being\n   *  dropped until just now\". */\n  healedDbRow: boolean;\n};\n\n/** Column-name map (load-bearing magic strings — see websites.ts's mapRow header). */\nconst COLS = {\n  url: \"url\",\n  pointOfContact: \"point of contact\",\n  gitRepo: \"Git repo\",\n} as const;\n\n/**\n * One select over Websites, returning the RAW stored record whose Name slugifies\n * to `slug` (#646 step 3). The Turso-native creator (`src/fleet/ensure-site.ts`)\n * uses it for the #645 heal only — to ADOPT an Airtable site that has no Turso row\n * under its own `rec` id instead of minting a second identity for it. Raw, not a\n * mapped `WebsiteRow`, because the adopt re-inserts what Airtable STORED.\n */\nexport async function findWebsiteRecordBySlug(\n  base: AirtableBase,\n  slug: string,\n): Promise<{ id: string; fields: Record<string, unknown> } | null> {\n  let found: { id: string; fields: Record<string, unknown> } | null = null;\n  await base(WEBSITES_TABLE)\n    .select({ pageSize: 100 })\n    .eachPage((records, fetchNextPage) => {\n      for (const rec of records) {\n        if (!found && siteSlug(mapRow(rec).name) === slug)\n          found = { id: rec.id, fields: rec.fields };\n      }\n      fetchNextPage();\n    });\n  return found;\n}\n\n/**\n * @deprecated since #646 step 3 — the `ensure-site` command no longer calls this.\n * New sites are created in Turso by `src/fleet/ensure-site.ts` with `site_<ULID>`\n * ids and no Airtable record. Kept, not deleted, because removing anything from\n * the Airtable layer is #646 steps 6–8, which need their own go.\n *\n * Find-or-create the Websites row for a slug so a new site exists in the fleet\n * inventory (audits, form-ingest slug resolution, reports) from day one.\n *\n * Fill-blanks-only on the exists path: this command runs from a bootstrap skill\n * that may be re-run to resume — it must never clobber operator-edited cells.\n * The one exception is `displayName` (#664): `--name` targets Name and nothing\n * else, so a differing value IS the operator's edit, and the create message\n * sends them back here to make it. Frequencies are deliberately NOT set\n * (launch flips the lifecycle); Status is only written on create (\"building\" —\n * Airtable's \"in development\" until the stage-2 vocabulary switch flips).\n */\nexport async function ensureSite(\n  base: AirtableBase,\n  input: EnsureSiteInput,\n  mirror?: EnsureSiteMirror,\n): Promise<EnsureSiteResult> {\n  const slug = siteSlug(input.slug);\n  if (!slug) throw new Error(`ensure-site: '${input.slug}' does not slugify to a usable slug`);\n  if (input.displayName && siteSlug(input.displayName) !== slug)\n    throw new Error(\n      `ensure-site: display name '${input.displayName}' slugifies to '${siteSlug(input.displayName)}', not '${slug}' — the row would not be found on re-run`,\n    );\n\n  // Paged inline rather than through `listWebsites` so the RAW stored record\n  // survives alongside the mapped row: the #645 heal below re-inserts what\n  // Airtable STORED (the same contract as the create path's mirror), and a\n  // mapped `WebsiteRow` cannot be turned back into a FieldSet. Same single\n  // select `listWebsites` issues — no extra Airtable read.\n  const raw: Array<{ id: string; fields: Record<string, unknown> }> = [];\n  await base(WEBSITES_TABLE)\n    .select({ pageSize: 100 })\n    .eachPage((records, fetchNextPage) => {\n      for (const rec of records) raw.push({ id: rec.id, fields: rec.fields });\n      fetchNextPage();\n    });\n  let existing: WebsiteRow | undefined;\n  let existingRaw: { id: string; fields: Record<string, unknown> } | undefined;\n  for (const rec of raw) {\n    const row = mapRow(rec);\n    if (siteSlug(row.name) === slug) {\n      existing = row;\n      existingRaw = rec;\n      break;\n    }\n  }\n\n  if (!existing || !existingRaw) {\n    const fields: FieldSet = {\n      Name: input.displayName ?? slug,\n      Status: toAirtableStatus(\"building\"),\n      [COLS.gitRepo]: input.gitRepo ?? `reddoorla/${slug}`,\n    };\n    if (input.url) fields[COLS.url] = input.url;\n    if (input.pointOfContact) fields[COLS.pointOfContact] = input.pointOfContact;\n    const created = (await base(WEBSITES_TABLE).create([{ fields }])) as Records<FieldSet>;\n    const rec = created[0]!;\n    // The mirror gets what Airtable STORED, never the `fields` we sent: parity\n    // diffs Turso against the stored record, so mapping our own payload would\n    // diverge the moment Airtable normalises a value.\n    await mirror?.created({ id: rec.id, fields: rec.fields as Record<string, unknown> });\n    return {\n      status: \"created\",\n      siteId: rec.id,\n      updatedFields: [],\n      skippedMismatches: [],\n      // The create path just inserted the row; there is nothing to heal, and a\n      // `hasRow` probe here would be a round-trip whose answer is already known.\n      healedDbRow: false,\n    };\n  }\n\n  // #645. THE gap: before this, `exists` meant \"Airtable has it\" and said nothing\n  // about Turso. Post-flip (#643) the form-ingest lookup reads Turso ONLY, so a\n  // site with an Airtable row and no Turso row has every lead answered\n  // `unknown-site` — silently, permanently, and with no alarm once Phase 6 (#646)\n  // deletes `mirror_missed`. `ensure-site` is the command an operator already\n  // re-runs to finish a half-created site, so the heal belongs here.\n  //\n  // FIRST, before the fill-blanks update below: `mirror.site` is an UPDATE, and\n  // under the freeze a no-match THROWS (`SITE_MIRROR … no such row in Turso`).\n  // Healing second would abort ensure-site on exactly the site it exists to\n  // repair. `mirrorSiteInsert` is an upsert, so a lost race just re-writes.\n  let healedDbRow = false;\n  if (mirror?.hasRow && !(await mirror.hasRow(existingRaw.id))) {\n    await mirror.created(existingRaw);\n    healedDbRow = true;\n  }\n\n  const updates: FieldSet = {};\n  const skippedMismatches: string[] = [];\n  const blank = (v: unknown) => v === null || v === undefined || v === \"\";\n  const consider = (column: string, provided: string | undefined, current: unknown) => {\n    if (!provided) return;\n    if (blank(current)) updates[column] = provided;\n    else if (current !== provided) skippedMismatches.push(column);\n  };\n  consider(COLS.url, input.url, existing.url || null);\n  consider(COLS.pointOfContact, input.pointOfContact, existing.pointOfContact);\n  consider(COLS.gitRepo, input.gitRepo, existing.gitRepo);\n  // #664: Name is NOT fill-blanks. It is never blank (the slug match found it),\n  // and `--name` is the only way to retitle a row created before the display\n  // name was settled — the slugify guard above already proved the new value\n  // resolves to the same row. Goes through the same update + mirror below, so\n  // Turso gets it too.\n  if (input.displayName && existing.name !== input.displayName) {\n    updates[\"Name\"] = input.displayName;\n  }\n\n  const updatedFields = Object.keys(updates);\n  if (updatedFields.length > 0) {\n    await base(WEBSITES_TABLE).update([{ id: existing.id, fields: updates }]);\n    // The fill-blanks path writes real cells too — a resumed bootstrap that only\n    // filled a blank `url` would otherwise leave Turso stale until the sync.\n    await mirror?.site(existing.id, updates);\n  }\n  return { status: \"exists\", siteId: existing.id, updatedFields, skippedMismatches, healedDbRow };\n}\n"],"mappings":";;;;;;;;;;;AAqDA,IAAM,OAAO;AAAA,EACX,KAAK;AAAA,EACL,gBAAgB;AAAA,EAChB,SAAS;AACX;AASA,eAAsB,wBACpB,MACA,MACiE;AACjE,MAAI,QAAgE;AACpE,QAAM,KAAK,cAAc,EACtB,OAAO,EAAE,UAAU,IAAI,CAAC,EACxB,SAAS,CAAC,SAAS,kBAAkB;AACpC,eAAW,OAAO,SAAS;AACzB,UAAI,CAAC,SAAS,SAAS,OAAO,GAAG,EAAE,IAAI,MAAM;AAC3C,gBAAQ,EAAE,IAAI,IAAI,IAAI,QAAQ,IAAI,OAAO;AAAA,IAC7C;AACA,kBAAc;AAAA,EAChB,CAAC;AACH,SAAO;AACT;AAmBA,eAAsB,WACpB,MACA,OACA,QAC2B;AAC3B,QAAM,OAAO,SAAS,MAAM,IAAI;AAChC,MAAI,CAAC,KAAM,OAAM,IAAI,MAAM,iBAAiB,MAAM,IAAI,qCAAqC;AAC3F,MAAI,MAAM,eAAe,SAAS,MAAM,WAAW,MAAM;AACvD,UAAM,IAAI;AAAA,MACR,8BAA8B,MAAM,WAAW,mBAAmB,SAAS,MAAM,WAAW,CAAC,WAAW,IAAI;AAAA,IAC9G;AAOF,QAAM,MAA8D,CAAC;AACrE,QAAM,KAAK,cAAc,EACtB,OAAO,EAAE,UAAU,IAAI,CAAC,EACxB,SAAS,CAAC,SAAS,kBAAkB;AACpC,eAAW,OAAO,QAAS,KAAI,KAAK,EAAE,IAAI,IAAI,IAAI,QAAQ,IAAI,OAAO,CAAC;AACtE,kBAAc;AAAA,EAChB,CAAC;AACH,MAAI;AACJ,MAAI;AACJ,aAAW,OAAO,KAAK;AACrB,UAAM,MAAM,OAAO,GAAG;AACtB,QAAI,SAAS,IAAI,IAAI,MAAM,MAAM;AAC/B,iBAAW;AACX,oBAAc;AACd;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,YAAY,CAAC,aAAa;AAC7B,UAAM,SAAmB;AAAA,MACvB,MAAM,MAAM,eAAe;AAAA,MAC3B,QAAQ,iBAAiB,UAAU;AAAA,MACnC,CAAC,KAAK,OAAO,GAAG,MAAM,WAAW,aAAa,IAAI;AAAA,IACpD;AACA,QAAI,MAAM,IAAK,QAAO,KAAK,GAAG,IAAI,MAAM;AACxC,QAAI,MAAM,eAAgB,QAAO,KAAK,cAAc,IAAI,MAAM;AAC9D,UAAM,UAAW,MAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;AAC/D,UAAM,MAAM,QAAQ,CAAC;AAIrB,UAAM,QAAQ,QAAQ,EAAE,IAAI,IAAI,IAAI,QAAQ,IAAI,OAAkC,CAAC;AACnF,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ,IAAI;AAAA,MACZ,eAAe,CAAC;AAAA,MAChB,mBAAmB,CAAC;AAAA;AAAA;AAAA,MAGpB,aAAa;AAAA,IACf;AAAA,EACF;AAaA,MAAI,cAAc;AAClB,MAAI,QAAQ,UAAU,CAAE,MAAM,OAAO,OAAO,YAAY,EAAE,GAAI;AAC5D,UAAM,OAAO,QAAQ,WAAW;AAChC,kBAAc;AAAA,EAChB;AAEA,QAAM,UAAoB,CAAC;AAC3B,QAAM,oBAA8B,CAAC;AACrC,QAAM,QAAQ,CAAC,MAAe,MAAM,QAAQ,MAAM,UAAa,MAAM;AACrE,QAAM,WAAW,CAAC,QAAgB,UAA8B,YAAqB;AACnF,QAAI,CAAC,SAAU;AACf,QAAI,MAAM,OAAO,EAAG,SAAQ,MAAM,IAAI;AAAA,aAC7B,YAAY,SAAU,mBAAkB,KAAK,MAAM;AAAA,EAC9D;AACA,WAAS,KAAK,KAAK,MAAM,KAAK,SAAS,OAAO,IAAI;AAClD,WAAS,KAAK,gBAAgB,MAAM,gBAAgB,SAAS,cAAc;AAC3E,WAAS,KAAK,SAAS,MAAM,SAAS,SAAS,OAAO;AAMtD,MAAI,MAAM,eAAe,SAAS,SAAS,MAAM,aAAa;AAC5D,YAAQ,MAAM,IAAI,MAAM;AAAA,EAC1B;AAEA,QAAM,gBAAgB,OAAO,KAAK,OAAO;AACzC,MAAI,cAAc,SAAS,GAAG;AAC5B,UAAM,KAAK,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,SAAS,IAAI,QAAQ,QAAQ,CAAC,CAAC;AAGxE,UAAM,QAAQ,KAAK,SAAS,IAAI,OAAO;AAAA,EACzC;AACA,SAAO,EAAE,QAAQ,UAAU,QAAQ,SAAS,IAAI,eAAe,mBAAmB,YAAY;AAChG;","names":[]}

package/dist/fleet-events-CkOZpMVC.d.ts

@@ -0,0 +1,435 @@
+import * as airtable_lib_airtable_base_js from 'airtable/lib/airtable_base.js';
+
+type AirtableConfig = {
+    apiKey: string;
+    baseId: string;
+};
+type AirtableBase = ReturnType<typeof openBase>;
+declare function openBase(cfg: AirtableConfig): airtable_lib_airtable_base_js.AirtableBase;
+
+/**
+ * The site-status vocabulary — ONE module owns it (#539 Phase 4).
+ *
+ * It lived at `src/reports/airtable/site-status.ts` until #539 Phase 6 step 1
+ * (#646) moved it here: `canonicalizeStatus` runs on every Turso lead read, so
+ * it cannot sit in the directory Phase 6 deletes. The Airtable write seam
+ * `toAirtableStatus`, discussed below, stayed behind in that file, which also
+ * re-exports everything here.
+ *
+ * The fleet's lifecycle names were inherited from an Airtable single-select
+ * written by hand years ago ("probably not our problem"). The operator approved
+ * a canonical vocabulary, and the migration is now COMPLETE in both stores:
+ * Airtable's "Status" single-select carries exactly the six canonical options
+ * and nothing else. This module no longer knows the old names at all.
+ *
+ * The retired mapping, kept as the record of what was merged into what:
+ *
+ *   old (retired 2026-08-25)    new (canonical)
+ *   ─────────────────────────   ───────────────
+ *   in development              building
+ *   launch period               launching
+ *   maintenance                 maintained
+ *   hosting                     hosted-only
+ *   probably not our problem    external
+ *   legacy                    ┐
+ *   deprecated                ┴ archived        ← approved MERGE, many-to-one
+ *
+ * `legacy` and `deprecated` were already treated identically by every PREDICATE
+ * (ARCHIVED_STATUSES held both), so collapsing them changes no *selection* — no
+ * fleet op gains or loses a site. It is NOT true that collapsing them changes
+ * nothing at all, and one surface proved it: the cockpit's Archived lane LABELS
+ * each row with its Status cell, and canonicalizing there rendered all 12 live
+ * archived rows as "archived". That lane now labels from `statusRaw`, which is
+ * exactly why `WebsiteRow.statusRaw` exists. The rule this leaves behind:
+ * canonical values decide BEHAVIOUR; anything DISPLAYING a Status cell, or
+ * writing one back, uses the raw cell.
+ *
+ * The merge had NO clean reverse map while both vocabularies coexisted, which
+ * is why `toAirtableStatus` had to pick one archived name deliberately. With the
+ * old names retired there is nothing left to pick between, and no code path
+ * feeds operator-supplied text through it anyway (see
+ * `src/recipes/forms-notify-target.ts`, which writes `--restore` verbatim).
+ *
+ * THE SHAPE OF THE TRANSITION (three stages):
+ *
+ *   stage 1 (DONE)  code speaks the NEW vocabulary internally; reads canonicalize
+ *                   at the two Airtable/Turso seams; writes still emit the OLD
+ *                   Airtable option names. Airtable untouched. No SELECTION
+ *                   change — every predicate picks exactly the sites it picked
+ *                   before (pinned row-by-row in tests/reports/airtable/
+ *                   site-status.test.ts). Displayed labels come from `statusRaw`.
+ *   stage 2 (DONE)  the Airtable "Status" single-select gained the 6 new options
+ *                   and all 44 cells were migrated (verified live: maintained=13,
+ *                   archived=12, external=9, building=6, hosted-only=2,
+ *                   launching=2 — zero old values, zero unrecognized), `db sync`
+ *                   ran clean (mismatches=0), and AIRTABLE_USES_NEW_VOCABULARY
+ *                   flipped to true. Writers now emit canonical names verbatim.
+ *                   The alias map STAYS: the 7 old options still exist in the
+ *                   field, so a human can still pick one in the Airtable UI.
+ *   stage 3 (DONE)  the operator deleted the 7 old options from the Airtable
+ *                   "Status" field on 2026-08-25, which is what made this safe:
+ *                   the gate was always "no old value CAN BE ENTERED", not
+ *                   merely "none is stored". Verified against the live base
+ *                   before any code changed — the field carries exactly the six
+ *                   canonical choices, byte-exact, and all 44 cells still hold a
+ *                   canonical value with ZERO blanks (deleting a single-select
+ *                   option CLEARS the cells using it, so "no cell was blanked"
+ *                   was checked, not assumed). AIRTABLE_STATUS_ALIASES,
+ *                   AIRTABLE_OLD_NAMES and AIRTABLE_USES_NEW_VOCABULARY are
+ *                   gone; both functions reduce to the identity.
+ *
+ * WHAT CHANGED IN BEHAVIOUR AT STAGE 3, and it is the only thing that did: an
+ * old name is no longer translated. `canonicalizeStatus("maintenance")` used to
+ * yield `maintained`; it now yields `"maintenance"` verbatim, which
+ * `isUnrecognizedStatus` flags and the cockpit surfaces as a watch row. That is
+ * intended. The option cannot be selected any more, so a stored old value would
+ * mean something went wrong — a restored backup, a scripted write, an API
+ * caller with a stale constant — and the fleet should say so rather than absorb
+ * it into a status nobody chose.
+ *
+ * Canonicalization happens on READ, never at rest: `src/db/import-airtable.ts`
+ * still stores the raw Airtable cell verbatim in `sites.status`, so the hourly
+ * parity check keeps comparing raw-to-raw and the importer stays honest to its
+ * source. Both readers — `mapRow` (Airtable) and `rowFromJoined` (Turso) — run
+ * the raw value through `canonicalizeStatus`, which is what keeps the #558
+ * reader-equivalence instrument green.
+ */
+/** The canonical site lifecycle vocabulary. */
+type Status = "building" | "launching" | "maintained" | "hosted-only" | "external" | "archived";
+
+/**
+ * The fleet's site-row model and its pure, vendor-neutral coercers.
+ *
+ * `WebsiteRow` is what BOTH readers return — `mapRow` over an Airtable record
+ * (`src/reports/airtable/websites.ts`) and `rowFromJoined` over Turso
+ * (`src/db/fleet-state.ts`) — and the coercers below are the ONE truth each of
+ * them applies to a raw cell/column. They lived in the Airtable module until
+ * #539 Phase 6 step 1 (#646) moved them here: they run on every Turso lead read,
+ * so they could not stay in the directory Phase 6 deletes. Nothing here touches
+ * a store; the doc comments still name Airtable columns because that is where
+ * each value was first defined, and the Turso columns carry the same raw values.
+ *
+ * `src/reports/airtable/websites.ts` re-exports every name, so existing imports
+ * resolve unchanged.
+ */
+
+type Frequency = "None" | "Monthly" | "Quarterly" | "Yearly";
+
+/**
+ * Per-site notification routing. When present on a `maintained` site, the form
+ * notification is addressed by the value of a submission field (`field`, read from
+ * `extraFields`) — e.g. route a contact form's `interest` to a different recipient
+ * per option, always CC-ing a shared address. Absent (`null`) → the site keeps the
+ * default single-POC behavior. Recipients live HERE (server-side Airtable config),
+ * never supplied by the submitting site, so the ingest can't be turned into an open
+ * relay.
+ */
+type NotifyRouting = {
+    /** The `extraFields` key whose value selects a route, e.g. "interest". */
+    field: string;
+    /** Field-value → recipient address(es). */
+    routes: Record<string, string | string[]>;
+    /** Recipient(s) when the value matches no route. */
+    default?: string | string[];
+    /** Address(es) CC'd on every routed (maintenance) send. */
+    cc?: string[];
+};
+type WebsiteRow = {
+    id: string;
+    name: string;
+    url: string;
+    /** Canonical lifecycle status (see ./site-status.ts). Canonicalized at the read
+     *  boundary, so an old-vocabulary Airtable cell and a new one read identically.
+     *  A present-but-unrecognized cell survives VERBATIM (blind-cast) rather than
+     *  becoming null — `isUnrecognizedStatus` flags it, and null would make
+     *  due.ts/preflight.ts treat the row as eligible-by-default. */
+    status: Status | null;
+    /** The literal Airtable Status cell behind `status` — same pattern as
+     *  `maintenanceFreqRaw`. The dashboard status editor round-trips THIS, so its
+     *  dropdown offers and preselects the values Airtable actually holds while the
+     *  two vocabularies coexist. Null = blank cell. */
+    statusRaw: string | null;
+    pointOfContact: string | null;
+    maintenanceFreq: Frequency;
+    testingFreq: Frequency;
+    /** The literal Airtable cell values behind the coerced frequencies. `toFrequency`
+     *  trims whitespace ("Monthly " reads as Monthly), then maps any still-unrecognized
+     *  value ("Quaterly") to "None" with a LOUD console.warn so nothing bogus reaches a
+     *  client email and the drop is never invisible. Preflight validates THESE to surface
+     *  the same failure as a structured finding. Null = blank cell. */
+    maintenanceFreqRaw: string | null;
+    testingFreqRaw: string | null;
+    /** Last manually-recorded maintenance day (used as fallback when no Reports row exists). */
+    maintenanceDay: string | null;
+    testingDay: string | null;
+    ga4PropertyId: string | null;
+    /** Operator-supplied query for the Google search-presence check (e.g. the business name).
+     *  Null = no query set → the check is skipped for this site. */
+    searchQuery: string | null;
+    /** Explicit Search Console property for this site (`sc-domain:...` or `https://.../`).
+     *  Null = auto-resolve from the SA's visible properties by host. */
+    searchConsoleProperty: string | null;
+    /** ISO timestamp of the last draft run where THIS site's GA/Search enrichment
+     *  ERRORED (vs a legitimate "not configured" skip). Set by drafting on a soft-fail,
+     *  cleared (null) on a clean enrichment, so the per-site analytics-failure signal
+     *  self-heals. Null when the operator-added `Analytics soft-fail at` column is absent. */
+    analyticsSoftFailAt: string | null;
+    /** GitHub repo identity as `owner/repo`. Null = no git wiring → self-update ops skip
+     *  (or, for local runs, fall back to the checkout's origin remote). */
+    gitRepo: string | null;
+    reportRecipientsTo: string | null;
+    reportRecipientsCc: string | null;
+    acceptedWatchConditions: string[];
+    /** First attachment in the Header image field (Airtable's signed URL — fetch before expiry). */
+    headerImage: {
+        url: string;
+        filename: string;
+        type: string;
+    } | null;
+    /** Lighthouse "current state" snapshot, kept fresh by `audit lighthouse --write-back`. */
+    pScore: number | null;
+    rScore: number | null;
+    bpScore: number | null;
+    seoScore: number | null;
+    /** ISO timestamp set by `audit lighthouse --write-back` when scores were last refreshed. */
+    lastLighthouseAuditAt: string | null;
+    /** Last-known counts from non-lighthouse audits, written by
+     *  `audit --write-back`. `null` = never audited (or this audit
+     *  type was skipped on the last run). 0 = audited, clean. */
+    a11yViolations: number | null;
+    /** Declared-range drift vs the Reddoor baseline (what package.json asks for). */
+    depsDrifted: number | null;
+    depsMajorBehind: number | null;
+    /** Real installed-version drift: deps behind the registry's latest, from the
+     *  committed lockfile (`pnpm outdated`). Null = not determined this run. */
+    depsOutdated: number | null;
+    /** Of {@link depsOutdated}, how many are a *major* version behind the
+     *  registry's latest — the "majors available on npm" signal, distinct from the
+     *  baseline-drift {@link depsMajorBehind}. Null = not determined this run. */
+    depsMajorOutdated: number | null;
+    securityVulnsCritical: number | null;
+    securityVulnsHigh: number | null;
+    securityVulnsModerate: number | null;
+    securityVulnsLow: number | null;
+    /** Count of consecutive nightly Renovate auto-fix dispatches for the CURRENT
+     *  critical/high vuln episode that have NOT yet cleared it. Owned by
+     *  `renovate-dispatch`: +1 per real dispatch, reset to 0 when vulns clear.
+     *  Null = field absent / never dispatched → reads as 0. At/above
+     *  AUTO_FIX_EXHAUSTED_CYCLES the vuln renders as "auto-fix failed". */
+    securityAutoFixAttempts: number | null;
+    /** ISO timestamp the security audit last ran — gates freshness of the Security Updates auto-tick
+     *  (clean counts only auto-tick when recent). */
+    lastSecurityAuditAt: string | null;
+    /** The known advisories behind the counts (severity-sorted, capped), so the dashboard can show
+     *  WHICH packages are vulnerable, not just the totals. null = never audited / unparseable;
+     *  empty array = audited clean. Written alongside the counts by the security audit. */
+    securityAdvisories: SecurityAdvisory[] | null;
+    /** Domain/DNS/SSL probe (the `domain` audit). `certDaysRemaining` is days until the TLS cert
+     *  expires (null = unresolved or no usable cert); `domainCheckedAt` is when it last ran. */
+    certDaysRemaining: number | null;
+    domainCheckedAt: string | null;
+    /** Netlify site id — the IDENTITY the `netlify-deploy` audit needs to query the
+     *  Netlify API. Read-only input (operator-set in Airtable); null = not on Netlify
+     *  (or not wired) → that audit skips. Never derived from the URL. */
+    netlifyId: string | null;
+    /** Latest PRODUCTION deploy health (the `netlify-deploy` audit). `deployStatus` is
+     *  Netlify's deploy state lower-cased (`ready`/`error`/`building`/…), null = none / not
+     *  checked; `lastDeployAt` is when it deployed; `deployLogUrl` links to the deploy/log. */
+    deployStatus: string | null;
+    lastDeployAt: string | null;
+    deployLogUrl: string | null;
+    /** When the `netlify-deploy` audit last RAN (freshness stamp for `deployStatus`). The audit
+     *  already writes "Deploy checked at"; this read-back is the Plan-2 fix so `deployEvidence`
+     *  (Plan 4) can gate on check time — NOT on `lastDeployAt`, which is deploy time, not check time. */
+    deployCheckedAt: string | null;
+    /** Function-health verdict (the `function-health` audit): the deployed `/health` function
+     *  answered `ok:true` (pass) or `ok:false` (fail). Single-select `pass`/`fail`; null = never ran
+     *  / unreachable (→ Plan 4 maps to unknown/amber). Kept SEPARATE from `deployStatus` so
+     *  `isFailedDeployStatus` keeps meaning "the build failed". */
+    functionHealth: "pass" | "fail" | null;
+    /** CMS reachability (server-side), derived from the same `/health` body's `details.prismic ===
+     *  "ok"`. Single-select `pass`/`fail`; null = never ran. No per-site Prismic token or identity
+     *  column is ever built — this rides `/health`. */
+    cmsReachable: "pass" | "fail" | null;
+    /** Does the deployed site's Turnstile widget actually work? Single-select `pass`/`fail`;
+     *  null = **unverified**, which is the normal state — see below. Freshness gated by
+     *  `formE2eCheckedAt`, the clock of the audit that writes it. Powers the cockpit Require-Turnstile guardrail: a site with
+     *  `requireTurnstile` ON but no working widget silently buckets 100% of its real leads.
+     *
+     *  One of the two `"fail"` arms is derived from `/health` (the other is a browser seeing
+     *  110200 on the live hostname), whose `forms.turnstile` is a truthiness check
+     *  on `PUBLIC_TURNSTILE_SITE_KEY` that never contacts Cloudflare (see
+     *  audits/function-health-airtable.ts for the incident). No key IS proof the widget can't
+     *  work; a key is NOT proof that it can — a sitekey whose widget is full at Cloudflare's
+     *  10-hostname cap sets the var and still mints no token. So a `"pass"` here has to be
+     *  earned by a real browser rendering the real widget (form-e2e), and until it is, null
+     *  keeps the site in the cockpit's amber "can't verify" watch rather than claiming health
+     *  nobody measured. */
+    turnstileWidget: "pass" | "fail" | null;
+    /** When the `function-health` audit last ran — the freshness gate for `functionHealth`,
+     *  `cmsReachable`, and `turnstileWidget`. Null = never ran. */
+    functionHealthCheckedAt: string | null;
+    /** Deployed-URL browser probe (the `browser` audit): cross-engine render OK, mobile render OK,
+     *  internal-links OK + broken count, and when it last ran (one timestamp gates all three). */
+    crossbrowserOk: boolean | null;
+    mobileOk: boolean | null;
+    linksOk: boolean | null;
+    brokenLinks: number | null;
+    browserCheckedAt: string | null;
+    /** Uptime-reachable verdict (browser audit): every sampled route returned 2xx/3xx. Single-select
+     *  `pass`/`fail`; null = never ran. Point-in-time. Freshness-gated by `browserCheckedAt`. */
+    reachableOk: "pass" | "fail" | null;
+    /** Titles & meta verdict (browser audit, chromium): every sampled route has a non-empty `<title>`
+     *  ≤ 70 chars + a non-empty meta description, and no duplicate titles across the sample.
+     *  Single-select `pass`/`fail`; null = never ran. Freshness-gated by `browserCheckedAt`. */
+    titleMetaOk: "pass" | "fail" | null;
+    /** Per-site copy overrides (M6a). Blank → null → the DEFAULT_COPY value. */
+    copyIntro: string | null;
+    copyContact: string | null;
+    copyFooter: string | null;
+    /** Go-live timestamp, stamped when a Launch report sends (M6b). Null = not yet launched. */
+    launchedAt: string | null;
+    /** Optional per-site webhook (e.g. Zapier Catch Hook). When set, the ingest
+     *  POSTs newsletter-formType submissions here (best-effort). Blank → null. */
+    newsletterWebhook: string | null;
+    /** Per-site Mailchimp (newsletter). Both must be set for the direct add;
+     *  blank → skipped. The API key is `key-dc` format; dc is derived from it. */
+    mailchimpApiKey: string | null;
+    mailchimpAudienceId: string | null;
+    /** Per-site Cloudflare Turnstile gate (Airtable checkbox). When true, a submission
+     *  whose Turnstile token verifies as "fail" (forged) OR "absent" (secret configured
+     *  centrally but NO token forwarded — the direct-POST-bot signature) is escalated to
+     *  auto-spam regardless of content score. A present-but-expired token stays
+     *  "unverifiable" and neutral (a real browser DID render the widget — fail-open).
+     *  ROLLOUT PRECONDITION: only enable on a site whose DEPLOYED package forwards
+     *  `_meta.turnstileToken` from EVERY form (widget rendered + `cf-turnstile-response`
+     *  posted; check the site's `/health` → forms.turnstile:true). A site that never
+     *  forwards tokens would silently bucket 100% of its real leads — and the form-e2e
+     *  probe cannot catch that state (testMode bypasses the gate). */
+    requireTurnstile: boolean;
+    /** GitHub-signals sweep (slice 2a), written nightly by `github-signals --fleet`. */
+    renovateFailingCis: number | null;
+    defaultBranchCi: string | null;
+    lastCommitAt: string | null;
+    githubSignalsAt: string | null;
+    /** Per-site smoke-suite verdict (the `smoke` audit runs `pnpm test:smoke`).
+     *  Single-select pass/fail; null = never ran. `lastSmokeAt` gates freshness. */
+    smokeOk: "pass" | "fail" | null;
+    lastSmokeAt: string | null;
+    /** Synthetic form end-to-end verdict (the `form-e2e` audit submits the real prod
+     *  contact form in test-mode). Single-select pass/fail; null = never ran OR (with
+     *  a fresh `formE2eCheckedAt`) no contact form → n/a. `formE2eCheckedAt` gates
+     *  freshness AND encodes the n/a-vs-never-ran distinction. */
+    formE2eOk: "pass" | "fail" | null;
+    formE2eCheckedAt: string | null;
+    /**
+     * Nightly Prismic model drift sweep (`prismic-models --fleet --write-back`).
+     *
+     * FOUR-VALUED, unlike every other verdict column in this table, and the extra
+     * state is the point:
+     *
+     *   - `pass`    — the repo and its Prismic repository were compared and agree.
+     *   - `fail`    — they were compared and DIVERGE (a model to create/update, or
+     *                 one that exists only in Prismic). A finding for a human.
+     *   - `unknown` — THE CHECK ITSELF FAILED. Unreadable checkout, broken config,
+     *                 missing/expired token, unreadable remote. Nothing at all was
+     *                 established about this site's models.
+     *   - `null`    — no verdict to hold: the sweep has never run for this site, or
+     *                 it ran and found no Prismic config at all (a repo that simply
+     *                 is not a Prismic site). `prismicModelsCheckedAt` separates
+     *                 those two — fresh timestamp, blank verdict = "checked, and
+     *                 there is nothing here to check".
+     *
+     * `unknown` exists because the alternatives are both wrong in the dangerous
+     * direction. Writing `pass` for a site nobody could read is a green tick over
+     * an outage; writing NOTHING (the obvious "leave the last known value alone")
+     * leaves yesterday's `pass` standing for a site that has been failing every
+     * night since — and nothing ages a stale `pass` out, because the digest's
+     * freshness gate only ever examines failures. Both make "I could not read this
+     * site" indistinguishable from "this site is fine", in the record the cockpit
+     * and the digest read.
+     *
+     * OPERATOR PRECONDITION: `Prismic Models` is a single select whose options are
+     * `pass`, `fail`, `unknown`. Until the three columns exist the sweep's writes
+     * fail with UNKNOWN_FIELD_NAME and are collected as soft failures — the feature
+     * ships dark rather than reddening the nightly.
+     */
+    prismicModels: PrismicModelsVerdict | null;
+    /** When the sweep last ran for this site — written on EVERY outcome, including
+     *  `unknown` and blank, so the age of the row is the age of the answer. */
+    prismicModelsCheckedAt: string | null;
+    /** What the sweep found, verbatim: the drift report for a `fail`, the reason
+     *  nothing could be established for an `unknown`, the skip reason for a blank,
+     *  and null for a `pass` (which clears yesterday's finding). */
+    prismicModelsDrift: string | null;
+    /**
+     * An expiry the operator sets to accept a KNOWN, EXPECTED `fail` — most often
+     * "I am modelling in Prismic on a branch that has not landed, so Prismic is
+     * legitimately ahead of `main`". While this timestamp is in the future the
+     * drift item is not raised.
+     *
+     * It expires on purpose, and nothing renews it automatically. A permanent ack
+     * would reproduce this column's own failure mode one step later: once the
+     * branch lands, the same acked cell would swallow real drift and "nobody is
+     * looking at this" would render as "this is fine". An expiry means the worst
+     * case is a silence that ends by itself.
+     *
+     * Narrow by construction — it mutes only `fail`, the finding the operator
+     * actually reviewed. `unknown` (the check could not run) and a verdict too old
+     * to be current are never muted by it; see `collectPrismicDriftAlerts`.
+     *
+     * OPERATOR PRECONDITION: `Prismic Ack Until` is a dateTime column. Until it
+     * exists this reads null and nothing is acked, which is the safe direction.
+     */
+    prismicAckUntil: string | null;
+    notifyRouting: NotifyRouting | null;
+    /** The RAW `Notify Routing` cell, verbatim. Same reason `statusRaw` exists: the
+     *  dashboard editor round-trips this JSON, and re-serializing the PARSED object
+     *  would drop any key the parser ignores and reformat what the operator typed —
+     *  a silent rewrite of a cell they only opened to look at. */
+    notifyRoutingRaw: string | null;
+    /** Read-back of the code-owned next-due dates (date-only, written by the
+     *  nightly `writeNextDueDates`). These exist so the writer can DIFF the
+     *  freshly-computed dates against what the row already holds and skip the
+     *  ~31 no-op writes a night the fleet was paying for (#539 Phase 3). Null =
+     *  cell blank or the operator-added `Next … at` column absent. */
+    nextMaintenanceAt: string | null;
+    nextTestingAt: string | null;
+};
+/** The `Prismic Models` cell — see {@link WebsiteRow.prismicModels} for why it
+ *  carries a third state that no other verdict column in this table has. */
+type PrismicModelsVerdict = "pass" | "fail" | "unknown";
+type Severity = "low" | "moderate" | "high" | "critical";
+/** One known vulnerability behind the security counts, as persisted/rendered. */
+type SecurityAdvisory = {
+    module: string;
+    severity: Severity;
+    title: string;
+    cves: string[];
+    url: string | null;
+    /** GitHub Dependabot dependency scope ("runtime" | "development"), when known. Lets the
+     *  dashboard flag build-time-only ("development") vulns. Omitted for advisories from the
+     *  lockfile `pnpm audit` fallback, which carries no per-package graph scope. */
+    scope?: "runtime" | "development";
+    /** GitHub Dependabot dependency-graph relationship, when known. "transitive" means no
+     *  direct-dep bump can fix it — Renovate's vuln alerts have no fix vehicle until the weekly
+     *  lockfile-maintenance window. Omitted when GitHub reports "unknown" or for the
+     *  `pnpm audit` fallback. Drives {@link allActionableVulnsTransitive}. */
+    relationship?: "direct" | "transitive";
+};
+
+type FleetEventType = "pr_automerged" | "vuln_cleared" | "ci_recovered" | "site_launched" | "fleet_swept" | "cert_renewed" | "report_sent_with_override";
+/** One recorded fleet activity event. `id` is deterministic (see the detectors)
+ *  so re-runs INSERT OR IGNORE without duplicating. `siteId`/`siteName` are null
+ *  for fleet-wide rollups; `data` is optional structured detail (e.g. the PR url). */
+type FleetEvent = {
+    id: string;
+    ts: string;
+    type: FleetEventType;
+    siteId: string | null;
+    siteName: string | null;
+    summary: string;
+    data: unknown | null;
+};
+
+export type { AirtableBase as A, FleetEvent as F, WebsiteRow as W, FleetEventType as a };

package/dist/{fleet-state-GJWGKTLD.js → fleet-state-RJROYXKO.js}

@@ -1,11 +1,15 @@
 import {
   REPORT_LIST_COLUMNS,
+  findReportByMessageId,
   getReportById,
   getReportHtml,
   getSiteById,
   getSiteBySlug,
+  insertReportRow,
+  insertSiteRows,
   listAllReports,
   listReportsForSite,
+  listSendableReports,
   listSites,
   mirrorHealthFields,
   mirrorReportInsert,
@@ -15,20 +19,25 @@ import {
   mirrorSiteFields,
   mirrorSiteInsert,
   siteRowExists,
-  storeRenderedHtml
-} from "./chunk-GEUC5VGM.js";
-import "./chunk-UIITN37J.js";
-import "./chunk-F3JWOPTG.js";
+  storeRenderedHtml,
+  updateSiteIdentity
+} from "./chunk-BINFZQ2T.js";
+import "./chunk-LF2TJN4X.js";
+import "./chunk-ASLDCWBF.js";
 import "./chunk-VAD43MOR.js";
-import "./chunk-KN52PM63.js";
+import "./chunk-ICSRWW5Q.js";
 export {
   REPORT_LIST_COLUMNS,
+  findReportByMessageId,
   getReportById,
   getReportHtml,
   getSiteById,
   getSiteBySlug,
+  insertReportRow,
+  insertSiteRows,
   listAllReports,
   listReportsForSite,
+  listSendableReports,
   listSites,
   mirrorHealthFields,
   mirrorReportInsert,
@@ -38,6 +47,7 @@ export {
   mirrorSiteFields,
   mirrorSiteInsert,
   siteRowExists,
-  storeRenderedHtml
+  storeRenderedHtml,
+  updateSiteIdentity
 };
-//# sourceMappingURL=fleet-state-GJWGKTLD.js.map
+//# sourceMappingURL=fleet-state-RJROYXKO.js.map