@reddoorla/maintenance 0.96.0 → 0.97.0

package/dist/chunk-X56LAKPR.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/audits/lighthouse-airtable.ts"],"sourcesContent":["import { readFile } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport type { AuditResult } from \"../types.js\";\nimport type { LighthouseScoreWriteback } from \"../reports/types.js\";\nimport { siteSlug } from \"../reports/airtable/websites.js\";\n\nconst LIGHTHOUSE_CATEGORIES = [\"performance\", \"accessibility\", \"best-practices\", \"seo\"] as const;\n\n/**\n * True when the result carries real lighthouse scores worth persisting.\n *\n * The `audit --write-back` policy used to refuse on any `status: \"fail\"`,\n * but that conflates two very different failure modes:\n *   1. Infrastructure failure (no lhr-*.json written, spawn timeout, etc.)\n *      → `details.summary` empty → all-zeros would corrupt the dashboard\n *   2. Assertion failure (scores below threshold, e.g. best-practices < 0.9)\n *      → `details.summary` has real numbers → tracking these IS the point\n *\n * The dashboard exists to surface drift over time. Refusing to write the\n * very numbers the dashboard wants to plot — just because one assertion\n * tripped — defeats the purpose. Write whenever real scores exist.\n */\nexport function hasRealScores(result: AuditResult): boolean {\n  if (result.audit !== \"lighthouse\") return false;\n  const details = (result.details ?? {}) as { summary?: Record<string, number> };\n  const summary = details.summary ?? {};\n  return LIGHTHOUSE_CATEGORIES.some(\n    (k) => typeof summary[k] === \"number\" && !Number.isNaN(summary[k]),\n  );\n}\n\n/**\n * Extract the four Lighthouse scores (as integer percentages) from a\n * `lighthouse` AuditResult. LHCI manifest summaries are floats in [0,1];\n * multiply + round. A category absent from the summary — e.g. Lighthouse\n * errored its audit (NO_LCP nulls the whole performance category) — yields\n * `null`, NOT 0, so the write path can clear the Airtable cell (\"—\") instead\n * of persisting a misleading zero. (`hasRealScores` still gates the write on\n * at least one real number, so an all-null infra failure is refused upstream.)\n */\nexport function lighthouseScoresFromResult(result: AuditResult): LighthouseScoreWriteback {\n  if (result.audit !== \"lighthouse\") {\n    throw new Error(`Expected a 'lighthouse' AuditResult, got '${result.audit}'`);\n  }\n  const details = (result.details ?? {}) as { summary?: Record<string, number> };\n  const summary = details.summary ?? {};\n  const toPct = (n: number | undefined): number | null =>\n    typeof n === \"number\" && !Number.isNaN(n) ? Math.round(n * 100) : null;\n  return {\n    performance: toPct(summary[\"performance\"]),\n    accessibility: toPct(summary[\"accessibility\"]),\n    bestPractices: toPct(summary[\"best-practices\"]),\n    seo: toPct(summary[\"seo\"]),\n  };\n}\n\n/**\n * Derive a site slug from the cwd's package.json#name. Used by\n * `audit lighthouse --write-back` when the operator doesn't pass an\n * explicit slug — the cwd is the site checkout, so package.json#name is\n * usually the canonical site name.\n */\nexport async function resolveSlugFromCwd(cwd: string): Promise<string> {\n  try {\n    const pkgPath = join(cwd, \"package.json\");\n    const raw = await readFile(pkgPath, \"utf-8\");\n    const pkg = JSON.parse(raw) as { name?: string };\n    if (!pkg.name) throw new Error(\"package.json has no 'name' field\");\n    return siteSlug(pkg.name);\n  } catch (e) {\n    throw new Error(\n      `Could not derive site slug from ${cwd}/package.json: ${(e as Error).message}. ` +\n        `Pass --write-back=<slug> explicitly.`,\n      { cause: e },\n    );\n  }\n}\n"],"mappings":";;;;;AAAA,SAAS,gBAAgB;AACzB,SAAS,YAAY;AAKrB,IAAM,wBAAwB,CAAC,eAAe,iBAAiB,kBAAkB,KAAK;AAgB/E,SAAS,cAAc,QAA8B;AAC1D,MAAI,OAAO,UAAU,aAAc,QAAO;AAC1C,QAAM,UAAW,OAAO,WAAW,CAAC;AACpC,QAAM,UAAU,QAAQ,WAAW,CAAC;AACpC,SAAO,sBAAsB;AAAA,IAC3B,CAAC,MAAM,OAAO,QAAQ,CAAC,MAAM,YAAY,CAAC,OAAO,MAAM,QAAQ,CAAC,CAAC;AAAA,EACnE;AACF;AAWO,SAAS,2BAA2B,QAA+C;AACxF,MAAI,OAAO,UAAU,cAAc;AACjC,UAAM,IAAI,MAAM,6CAA6C,OAAO,KAAK,GAAG;AAAA,EAC9E;AACA,QAAM,UAAW,OAAO,WAAW,CAAC;AACpC,QAAM,UAAU,QAAQ,WAAW,CAAC;AACpC,QAAM,QAAQ,CAAC,MACb,OAAO,MAAM,YAAY,CAAC,OAAO,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,GAAG,IAAI;AACpE,SAAO;AAAA,IACL,aAAa,MAAM,QAAQ,aAAa,CAAC;AAAA,IACzC,eAAe,MAAM,QAAQ,eAAe,CAAC;AAAA,IAC7C,eAAe,MAAM,QAAQ,gBAAgB,CAAC;AAAA,IAC9C,KAAK,MAAM,QAAQ,KAAK,CAAC;AAAA,EAC3B;AACF;AAQA,eAAsB,mBAAmB,KAA8B;AACrE,MAAI;AACF,UAAM,UAAU,KAAK,KAAK,cAAc;AACxC,UAAM,MAAM,MAAM,SAAS,SAAS,OAAO;AAC3C,UAAM,MAAM,KAAK,MAAM,GAAG;AAC1B,QAAI,CAAC,IAAI,KAAM,OAAM,IAAI,MAAM,kCAAkC;AACjE,WAAO,SAAS,IAAI,IAAI;AAAA,EAC1B,SAAS,GAAG;AACV,UAAM,IAAI;AAAA,MACR,mCAAmC,GAAG,kBAAmB,EAAY,OAAO;AAAA,MAE5E,EAAE,OAAO,EAAE;AAAA,IACb;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-IY6256GK.js → chunk-YJBSB4LP.js}

@@ -1,3 +1,7 @@
+import {
+  skipsAirtableShadow
+} from "./chunk-RQJFGK3A.js";
+
 // src/reports/airtable/attachments.ts
 function looksLikeHtml(bytes) {
   const start = bytes[0] === 239 && bytes[1] === 187 && bytes[2] === 191 ? 3 : 0;
@@ -23,6 +27,7 @@ async function fetchAttachmentBytes(url) {
   return { bytes, contentType };
 }
 async function uploadAttachment(recordId, fieldName, body, filename, contentType, opts = {}) {
+  if (skipsAirtableShadow("uploadAttachment", recordId)) return;
   const apiKey = process.env.AIRTABLE_PAT;
   const baseId = process.env.AIRTABLE_BASE_ID;
   if (!apiKey || !baseId) {
@@ -79,4 +84,4 @@ export {
   fetchAttachmentBytes,
   uploadAttachment
 };
-//# sourceMappingURL=chunk-IY6256GK.js.map
+//# sourceMappingURL=chunk-YJBSB4LP.js.map

package/dist/chunk-YJBSB4LP.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/reports/airtable/attachments.ts"],"sourcesContent":["import { skipsAirtableShadow } from \"../../fleet/site-id.js\";\n\n/** Cheap HTML sniff: an Airtable signed-URL \"200\" that is really a login/error page\n *  starts with `<!doctype html`, `<html`, or `<head` after an optional UTF-8 BOM /\n *  leading whitespace. We only need to catch the common error-page case, not parse\n *  HTML. */\nfunction looksLikeHtml(bytes: Uint8Array): boolean {\n  // Inspect the first ~64 bytes as ASCII (1 byte → 1 char; enough for a doctype /\n  // opening tag). Skip a leading UTF-8 BOM (bytes EF BB BF) by index, then strip any\n  // leading ASCII whitespace, and match the common HTML openers case-insensitively.\n  const start = bytes[0] === 0xef && bytes[1] === 0xbb && bytes[2] === 0xbf ? 3 : 0;\n  const head = Buffer.from(bytes.slice(start, start + 64))\n    .toString(\"ascii\")\n    .replace(/^[\\s]+/, \"\")\n    .toLowerCase();\n  return head.startsWith(\"<!doctype html\") || head.startsWith(\"<html\") || head.startsWith(\"<head\");\n}\n\nexport async function fetchAttachmentBytes(\n  url: string,\n): Promise<{ bytes: Uint8Array; contentType: string }> {\n  const res = await fetch(url);\n  if (!res.ok) {\n    throw new Error(\n      `Failed to fetch Airtable attachment ${res.status} ${res.statusText} (url=${url})`,\n    );\n  }\n  const contentType = res.headers.get(\"content-type\") ?? \"application/octet-stream\";\n  const ab = await res.arrayBuffer();\n  const bytes = new Uint8Array(ab);\n  // Sanity-gate the body: a 200 that is actually an HTML error/login page (expired\n  // signed URL, auth wall) would otherwise be attached as the \"image\" and ship a\n  // broken header. Accept an explicit image/* content-type; otherwise reject anything\n  // that sniffs as HTML — so the send fails loudly rather than emailing a broken image.\n  const isImageType = contentType.toLowerCase().startsWith(\"image/\");\n  if (!isImageType && looksLikeHtml(bytes)) {\n    throw new Error(\n      `Airtable attachment did not return image data (content-type=\"${contentType}\", ` +\n        `body looks like an HTML page — the signed URL may have expired) (url=${url})`,\n    );\n  }\n  return { bytes, contentType };\n}\n\n/**\n * Upload bytes (or a string) as an attachment to a specific record + field.\n * Uses Airtable's content.airtable.com upload endpoint (base64 body) because\n * the standard SDK only accepts public URLs for attachments, and we don't\n * host the generated content anywhere public.\n *\n * Docs: https://airtable.com/developers/web/api/upload-attachment\n *\n * Requires AIRTABLE_PAT + AIRTABLE_BASE_ID in env (same as the rest of the\n * reports module). The fieldName is URL-encoded for the request path.\n */\n/**\n * Upload one file into an Airtable attachment field.\n *\n * ⚠️ Airtable's uploadAttachment endpoint APPENDS — it never replaces. Every\n * re-upload therefore stacks another file in the field while readers\n * (`websites.ts`, `db/header-images.ts`) take attachment [0], the OLDEST. Left\n * alone that means a field silently serves a stale image forever: beachfront\n * accumulated four headers and kept sending the first, which is how a\n * pre-clean-plate header reached a 2026-08-24 announcement and got a second\n * headline printed over its baked one.\n *\n * Pass `{ replaceIn: \"<table>\" }` for a field that should hold exactly one\n * current file (the site header). Omit it where history is wanted (per-period\n * report previews, which are one row per period anyway).\n *\n * The table is part of the option rather than a separate flag because the prune\n * PATCHes `/v0/{baseId}/{table}/{recordId}` — an earlier version omitted the\n * table segment entirely and 403'd on every call, so `replace` cannot be asked\n * for without supplying it.\n */\nexport async function uploadAttachment(\n  recordId: string,\n  fieldName: string,\n  body: Uint8Array | string,\n  filename: string,\n  contentType: string,\n  opts: { replaceIn?: string } = {},\n): Promise<void> {\n  // #646 step 3: a `site_<ULID>` site was created in Turso and has no Airtable\n  // record to attach to. Checked BEFORE the credential gate — skipping needs no\n  // creds, and a run without them must not fail on a write it was never going to make.\n  if (skipsAirtableShadow(\"uploadAttachment\", recordId)) return;\n  const apiKey = process.env.AIRTABLE_PAT;\n  const baseId = process.env.AIRTABLE_BASE_ID;\n  if (!apiKey || !baseId) {\n    throw new Error(\"AIRTABLE_PAT and AIRTABLE_BASE_ID must be set\");\n  }\n  const base64 =\n    typeof body === \"string\"\n      ? Buffer.from(body, \"utf-8\").toString(\"base64\")\n      : Buffer.from(body).toString(\"base64\");\n  const payload = { contentType, file: base64, filename };\n  const url = `https://content.airtable.com/v0/${baseId}/${recordId}/${encodeURIComponent(fieldName)}/uploadAttachment`;\n  const res = await fetch(url, {\n    method: \"POST\",\n    headers: {\n      Authorization: `Bearer ${apiKey}`,\n      \"Content-Type\": \"application/json\",\n    },\n    body: JSON.stringify(payload),\n  });\n  if (!res.ok) {\n    throw new Error(`Airtable upload failed: ${res.status} ${res.statusText} ${await res.text()}`);\n  }\n  if (!opts.replaceIn) return;\n\n  // The upload response carries the record with the field's full, post-append\n  // attachment list. Keep only the last entry (the one just uploaded) by\n  // PATCHing the field to that id — Airtable preserves an attachment referenced\n  // by id alone and drops any omitted. Best-effort: the file IS uploaded by this\n  // point, so a prune failure must not fail the caller; it only leaves the\n  // field over-full, which the next successful run tidies.\n  try {\n    const body = (await res.json()) as {\n      fields?: Record<string, Array<{ id?: string }> | undefined>;\n    };\n    // Airtable keys this response's `fields` by FIELD ID, not field name — verified\n    // live 2026-08-24: {\"id\":\"rec…\",\"createdTime\":…,\"fields\":{\"fldBUAW180p8MIpvh\":[…]}}.\n    // Looking it up by NAME therefore yielded undefined, `list` was [], and the\n    // `length <= 1` guard returned silently — so `replace` never pruned anything on a\n    // real call, while a name-keyed test stub kept it green. Eleven site header fields\n    // stacked before the discrepancy surfaced. The endpoint writes exactly ONE field,\n    // so its response carries exactly one entry: take it whatever it is keyed by, and\n    // fall back to the name in case Airtable ever switches.\n    const lists = Object.values(body.fields ?? {}).filter((v) => Array.isArray(v));\n    const list = body.fields?.[fieldName] ?? (lists.length === 1 ? lists[0] : undefined);\n    if (!list) {\n      // Never return quietly here: silence is what let the no-op ship.\n      console.warn(\n        `⚠ attachment prune skipped for \"${fieldName}\": upload response carried no ` +\n          `attachment list (fields keys: ${Object.keys(body.fields ?? {}).join(\", \") || \"none\"})`,\n      );\n      return;\n    }\n    if (list.length <= 1) return;\n    const newest = list[list.length - 1]?.id;\n    if (!newest) {\n      console.warn(`⚠ kept ${list.length} attachments in \"${fieldName}\": newest entry has no id`);\n      return;\n    }\n    // /v0/{baseId}/{table}/{recordId} — the table segment is REQUIRED. Without it\n    // Airtable answers 403 Forbidden (not 404), which reads like a token-scope\n    // problem and sent this in the wrong direction once already.\n    const patchUrl = `https://api.airtable.com/v0/${baseId}/${encodeURIComponent(opts.replaceIn)}/${recordId}`;\n    const patch = await fetch(patchUrl, {\n      method: \"PATCH\",\n      headers: { Authorization: `Bearer ${apiKey}`, \"Content-Type\": \"application/json\" },\n      body: JSON.stringify({ fields: { [fieldName]: [{ id: newest }] } }),\n    });\n    if (!patch.ok) {\n      console.warn(\n        `⚠ kept ${list.length} attachments in \"${fieldName}\" — prune failed: ${patch.status} ${patch.statusText}`,\n      );\n    }\n  } catch (e) {\n    console.warn(`⚠ attachment prune skipped for \"${fieldName}\": ${(e as Error).message}`);\n  }\n}\n"],"mappings":";;;;;AAMA,SAAS,cAAc,OAA4B;AAIjD,QAAM,QAAQ,MAAM,CAAC,MAAM,OAAQ,MAAM,CAAC,MAAM,OAAQ,MAAM,CAAC,MAAM,MAAO,IAAI;AAChF,QAAM,OAAO,OAAO,KAAK,MAAM,MAAM,OAAO,QAAQ,EAAE,CAAC,EACpD,SAAS,OAAO,EAChB,QAAQ,UAAU,EAAE,EACpB,YAAY;AACf,SAAO,KAAK,WAAW,gBAAgB,KAAK,KAAK,WAAW,OAAO,KAAK,KAAK,WAAW,OAAO;AACjG;AAEA,eAAsB,qBACpB,KACqD;AACrD,QAAM,MAAM,MAAM,MAAM,GAAG;AAC3B,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,IAAI;AAAA,MACR,uCAAuC,IAAI,MAAM,IAAI,IAAI,UAAU,SAAS,GAAG;AAAA,IACjF;AAAA,EACF;AACA,QAAM,cAAc,IAAI,QAAQ,IAAI,cAAc,KAAK;AACvD,QAAM,KAAK,MAAM,IAAI,YAAY;AACjC,QAAM,QAAQ,IAAI,WAAW,EAAE;AAK/B,QAAM,cAAc,YAAY,YAAY,EAAE,WAAW,QAAQ;AACjE,MAAI,CAAC,eAAe,cAAc,KAAK,GAAG;AACxC,UAAM,IAAI;AAAA,MACR,gEAAgE,WAAW,gFACD,GAAG;AAAA,IAC/E;AAAA,EACF;AACA,SAAO,EAAE,OAAO,YAAY;AAC9B;AAiCA,eAAsB,iBACpB,UACA,WACA,MACA,UACA,aACA,OAA+B,CAAC,GACjB;AAIf,MAAI,oBAAoB,oBAAoB,QAAQ,EAAG;AACvD,QAAM,SAAS,QAAQ,IAAI;AAC3B,QAAM,SAAS,QAAQ,IAAI;AAC3B,MAAI,CAAC,UAAU,CAAC,QAAQ;AACtB,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AACA,QAAM,SACJ,OAAO,SAAS,WACZ,OAAO,KAAK,MAAM,OAAO,EAAE,SAAS,QAAQ,IAC5C,OAAO,KAAK,IAAI,EAAE,SAAS,QAAQ;AACzC,QAAM,UAAU,EAAE,aAAa,MAAM,QAAQ,SAAS;AACtD,QAAM,MAAM,mCAAmC,MAAM,IAAI,QAAQ,IAAI,mBAAmB,SAAS,CAAC;AAClG,QAAM,MAAM,MAAM,MAAM,KAAK;AAAA,IAC3B,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,eAAe,UAAU,MAAM;AAAA,MAC/B,gBAAgB;AAAA,IAClB;AAAA,IACA,MAAM,KAAK,UAAU,OAAO;AAAA,EAC9B,CAAC;AACD,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,IAAI,MAAM,2BAA2B,IAAI,MAAM,IAAI,IAAI,UAAU,IAAI,MAAM,IAAI,KAAK,CAAC,EAAE;AAAA,EAC/F;AACA,MAAI,CAAC,KAAK,UAAW;AAQrB,MAAI;AACF,UAAMA,QAAQ,MAAM,IAAI,KAAK;AAW7B,UAAM,QAAQ,OAAO,OAAOA,MAAK,UAAU,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,MAAM,QAAQ,CAAC,CAAC;AAC7E,UAAM,OAAOA,MAAK,SAAS,SAAS,MAAM,MAAM,WAAW,IAAI,MAAM,CAAC,IAAI;AAC1E,QAAI,CAAC,MAAM;AAET,cAAQ;AAAA,QACN,wCAAmC,SAAS,+DACT,OAAO,KAAKA,MAAK,UAAU,CAAC,CAAC,EAAE,KAAK,IAAI,KAAK,MAAM;AAAA,MACxF;AACA;AAAA,IACF;AACA,QAAI,KAAK,UAAU,EAAG;AACtB,UAAM,SAAS,KAAK,KAAK,SAAS,CAAC,GAAG;AACtC,QAAI,CAAC,QAAQ;AACX,cAAQ,KAAK,eAAU,KAAK,MAAM,oBAAoB,SAAS,2BAA2B;AAC1F;AAAA,IACF;AAIA,UAAM,WAAW,+BAA+B,MAAM,IAAI,mBAAmB,KAAK,SAAS,CAAC,IAAI,QAAQ;AACxG,UAAM,QAAQ,MAAM,MAAM,UAAU;AAAA,MAClC,QAAQ;AAAA,MACR,SAAS,EAAE,eAAe,UAAU,MAAM,IAAI,gBAAgB,mBAAmB;AAAA,MACjF,MAAM,KAAK,UAAU,EAAE,QAAQ,EAAE,CAAC,SAAS,GAAG,CAAC,EAAE,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;AAAA,IACpE,CAAC;AACD,QAAI,CAAC,MAAM,IAAI;AACb,cAAQ;AAAA,QACN,eAAU,KAAK,MAAM,oBAAoB,SAAS,0BAAqB,MAAM,MAAM,IAAI,MAAM,UAAU;AAAA,MACzG;AAAA,IACF;AAAA,EACF,SAAS,GAAG;AACV,YAAQ,KAAK,wCAAmC,SAAS,MAAO,EAAY,OAAO,EAAE;AAAA,EACvF;AACF;","names":["body"]}

package/dist/{chunk-EQQ4H6L3.js → chunk-YXWBM26P.js}

@@ -1,7 +1,7 @@
 import {
   openDb,
   readDbConfig
-} from "./chunk-6INOBNRO.js";
+} from "./chunk-MMSMZC7S.js";
 
 // src/db/fleet-events.ts
 async function recordFleetEvent(db, e) {
@@ -47,4 +47,4 @@ async function recordFleetEventsBestEffort(events, now, open = () => openDb(read
 export {
   recordFleetEventsBestEffort
 };
-//# sourceMappingURL=chunk-EQQ4H6L3.js.map
+//# sourceMappingURL=chunk-YXWBM26P.js.map

package/dist/cli/bin.js

@@ -8,6 +8,36 @@ import { dirname as dirname2 } from "path";
 import { fileURLToPath } from "url";
 import { cac } from "cac";
 
+// src/cli/retired-flags.ts
+var RETIRED_FLAGS = {
+  "--write-airtable": "--write-back"
+};
+function rewriteRetiredFlags(argv, note = (message) => console.error(message)) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = argv.slice(0, 2);
+  let terminated = false;
+  for (const token of argv.slice(2)) {
+    if (terminated || token === "--") {
+      terminated = true;
+      out.push(token);
+      continue;
+    }
+    const eq = token.indexOf("=");
+    const name = eq === -1 ? token : token.slice(0, eq);
+    const next = Object.hasOwn(RETIRED_FLAGS, name) ? RETIRED_FLAGS[name] : void 0;
+    if (next === void 0) {
+      out.push(token);
+      continue;
+    }
+    if (!seen.has(name)) {
+      seen.add(name);
+      note(`note: ${name} is now ${next}; the old spelling still works.`);
+    }
+    out.push(eq === -1 ? next : `${next}${token.slice(eq)}`);
+  }
+  return out;
+}
+
 // src/cli/version.ts
 import { readFileSync, existsSync } from "fs";
 import { dirname, join } from "path";
@@ -91,9 +121,9 @@ cli.command("list-recipes", "Print the available recipes.").action(() => {
 });
 cli.command("audit [site]", "Run audits against a site (default: cwd).").option("--only <names>", "Comma-separated audit names (e.g. deps,lighthouse)").option("--json", "Machine-readable JSON output").option(
   "--fleet <inventory>",
-  'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
+  'Inventory file (.json or .mjs/.js), or "turso" to read the fleet roster from the database ("airtable" is a deprecated alias)'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").option(
-  "--write-airtable [slug]",
+  "--write-back [slug]",
   "After lighthouse runs, write pScore/rScore/bpScore/seoScore + timestamp to the matching Websites row. Slug defaults to cwd's package.json#name."
 ).option("--fail-on-violations", "Exit non-zero if any a11y violations are found (for CI gates)").option(
   "--url <url>",
@@ -109,37 +139,43 @@ cli.command("audit [site]", "Run audits against a site (default: cwd).").option(
 );
 cli.command("sync-configs [site]", "Sync canonical configs into a site.").option("--only <names>", "Comma-separated config names (e.g. eslint,prettier)").option("--dry", "Print diff without writing").option(
   "--fleet <inventory>",
-  'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
+  'Inventory file (.json or .mjs/.js), or "turso" to read the fleet roster from the database ("airtable" is a deprecated alias)'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../sync-configs-HGLQV55H.js")).runSyncConfigsCommand(site, opts),
+    async () => (await import("../sync-configs-OXSWKVZ2.js")).runSyncConfigsCommand(site, opts),
     opts
   )
 );
 cli.command("bump-deps [site]", "Bump dependencies.").option("--group <group>", "patch | minor | major", { default: "minor" }).option(
   "--fleet <inventory>",
-  'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
+  'Inventory file (.json or .mjs/.js), or "turso" to read the fleet roster from the database ("airtable" is a deprecated alias)'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../bump-deps-EL3TKMIL.js")).runBumpDepsCommand(site, opts),
+    async () => (await import("../bump-deps-775VLDYB.js")).runBumpDepsCommand(site, opts),
     opts
   )
 );
 cli.command(
   "self-updating [site]",
   "Bootstrap a repo to keep itself updated (Renovate + protection; platform auto-merge off; ci.yml is the starter's, not managed here)."
-).option("--dry", "List what would be enabled without writing or opening PRs").option("--fleet <inventory>", 'Inventory file (.json or .mjs/.js), or "airtable"').option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
+).option("--dry", "List what would be enabled without writing or opening PRs").option(
+  "--fleet <inventory>",
+  'Inventory file (.json or .mjs/.js), or "turso" ("airtable" is a deprecated alias)'
+).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../self-updating-RKKIYNV4.js")).runSelfUpdatingCommand(site, opts),
+    async () => (await import("../self-updating-ZUWPGYUP.js")).runSelfUpdatingCommand(site, opts),
     opts
   )
 );
 cli.command(
   "prismic-ci [site]",
   "Add the Prismic model delivery workflow to a site via PR (one PR per repo; never pushes to main)."
-).option("--dry", "List the sites that would be offered the workflow, without opening any PR").option("--fleet <inventory>", 'Inventory file (.json or .mjs/.js), or "airtable"').option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
+).option("--dry", "List the sites that would be offered the workflow, without opening any PR").option(
+  "--fleet <inventory>",
+  'Inventory file (.json or .mjs/.js), or "turso" ("airtable" is a deprecated alias)'
+).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../prismic-ci-AHY5ULJR.js")).runPrismicCiCommand(site, opts),
+    async () => (await import("../prismic-ci-NAPWOXXD.js")).runPrismicCiCommand(site, opts),
     opts
   )
 );
@@ -149,21 +185,24 @@ cli.command(
 ).option(
   "--apply",
   "Push local models to Prismic. Never deletes \u2014 remote-only models are reported."
-).option("--pull", "Write remote-only models into the repo (single-site; review + PR the result).").option("--tokens", "Print the per-site write-token doctor: which env var, present?, reads?").option("--fleet <inventory>", 'Inventory file (.json or .mjs/.js), or "airtable". Read-only.').option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").option("--write-airtable", "Fleet mode: persist each site's verdict to its Websites row").option(
+).option("--pull", "Write remote-only models into the repo (single-site; review + PR the result).").option("--tokens", "Print the per-site write-token doctor: which env var, present?, reads?").option(
+  "--fleet <inventory>",
+  'Inventory file (.json or .mjs/.js), or "turso" ("airtable" is a deprecated alias). Read-only.'
+).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").option("--write-back", "Fleet mode: persist each site's verdict to its Websites row").option(
   "--comment-file <path>",
   "Write the report to this file (the CI workflow posts it as a PR comment)"
 ).action(
   async (site, opts) => runOrExit(
-    async () => (await import("../prismic-models-URYGODNY.js")).runPrismicModelsCommand(site, opts),
+    async () => (await import("../prismic-models-LL6ORTQ2.js")).runPrismicModelsCommand(site, opts),
     opts
   )
 );
 cli.command("upgrade <upgrade> [site]", "Run a named upgrade recipe (svelte-4-to-5).").example("reddoor-maint upgrade svelte-4-to-5 ./my-site").option(
   "--fleet <inventory>",
-  'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
+  'Inventory file (.json or .mjs/.js), or "turso" to read the fleet roster from the database ("airtable" is a deprecated alias)'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (upgrade, site, opts) => runOrExit(
-    async () => (await import("../upgrade-WZ44IARG.js")).runUpgradeCommand(upgrade, site, opts),
+    async () => (await import("../upgrade-EVAL3JTO.js")).runUpgradeCommand(upgrade, site, opts),
     opts
   )
 );
@@ -172,19 +211,19 @@ cli.command(
   "Convert an npm/yarn site to pnpm (lockfile, packageManager, scripts)."
 ).option(
   "--fleet <inventory>",
-  'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
+  'Inventory file (.json or .mjs/.js), or "turso" to read the fleet roster from the database ("airtable" is a deprecated alias)'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../convert-to-pnpm-4DON7IFS.js")).runConvertToPnpmCommand(site, opts),
+    async () => (await import("../convert-to-pnpm-KLWA53N5.js")).runConvertToPnpmCommand(site, opts),
     opts
   )
 );
 cli.command("svelte-codemods [site]", "Apply Svelte 5 gotcha codemods to an already-migrated site.").option(
   "--fleet <inventory>",
-  'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
+  'Inventory file (.json or .mjs/.js), or "turso" to read the fleet roster from the database ("airtable" is a deprecated alias)'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../svelte-codemods-QWGIRNN6.js")).runSvelteCodemodsCommand(site, opts),
+    async () => (await import("../svelte-codemods-VOLOKKFI.js")).runSvelteCodemodsCommand(site, opts),
     opts
   )
 );
@@ -193,10 +232,10 @@ cli.command(
   "Write src/routes/health/+server.ts (function-health probe for the report gate)."
 ).option(
   "--fleet <inventory>",
-  'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
+  'Inventory file (.json or .mjs/.js), or "turso" to read the fleet roster from the database ("airtable" is a deprecated alias)'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../health-endpoint-UCLMSSCN.js")).runHealthEndpointCommand(site, opts),
+    async () => (await import("../health-endpoint-BJ6BKRHF.js")).runHealthEndpointCommand(site, opts),
     opts
   )
 );
@@ -205,10 +244,10 @@ cli.command(
   "Install the matching-a-page gate harness (dev-guarded /dev/match/[uid] route + matching/ scripts) for a live-reference rebuild."
 ).option("--ref <url>", "Reference (live) site URL the harness gates against \u2014 required").option("--cand <url>", "Candidate origin (default http://localhost:5173)").option("--matrix <list>", "Breakpoint matrix, comma-separated (default 1440,834,390)").option(
   "--fleet <inventory>",
-  'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
+  'Inventory file (.json or .mjs/.js), or "turso" to read the fleet roster from the database ("airtable" is a deprecated alias)'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../match-harness-OW45CB5H.js")).runMatchHarnessCommand(site, opts),
+    async () => (await import("../match-harness-GBCDSVPS.js")).runMatchHarnessCommand(site, opts),
     opts
   )
 );
@@ -217,10 +256,10 @@ cli.command(
   "Add the smoke suite (test:smoke + playwright config + /health smoke routes)."
 ).option(
   "--fleet <inventory>",
-  'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
+  'Inventory file (.json or .mjs/.js), or "turso" to read the fleet roster from the database ("airtable" is a deprecated alias)'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../smoke-suite-BWHR3XX5.js")).runSmokeSuiteCommand(site, opts),
+    async () => (await import("../smoke-suite-WAUPI6EJ.js")).runSmokeSuiteCommand(site, opts),
     opts
   )
 );
@@ -229,10 +268,10 @@ cli.command(
   "Install @reddoorla/maintenance + audit deps on a site (run after convert-to-pnpm)."
 ).option("--audits <names>", "Comma-separated audit subset: lighthouse,a11y (default: both)").option(
   "--fleet <inventory>",
-  'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
+  'Inventory file (.json or .mjs/.js), or "turso" to read the fleet roster from the database ("airtable" is a deprecated alias)'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../onboard-CZYBWVWH.js")).runOnboardCommand(site, opts),
+    async () => (await import("../onboard-JQQIMQW7.js")).runOnboardCommand(site, opts),
     opts
   )
 );
@@ -241,25 +280,25 @@ cli.command(
   "One-shot guided onboarding: convert-to-pnpm \u2192 onboard \u2192 sync-configs \u2192 svelte-codemods \u2192 a11y-fixtures-page \u2192 health-endpoint \u2192 smoke-suite \u2192 audit."
 ).option(
   "--fleet <inventory>",
-  'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
+  'Inventory file (.json or .mjs/.js), or "turso" to read the fleet roster from the database ("airtable" is a deprecated alias)'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
-  async (site, opts) => runOrExit(async () => (await import("../init-3LMZTCVD.js")).runInitCommand(site, opts), opts)
+  async (site, opts) => runOrExit(async () => (await import("../init-GOWDA5QS.js")).runInitCommand(site, opts), opts)
 );
 cli.command(
   "launch <site>",
   "Bootstrap + first-audit a site, then draft its launch email for approval."
 ).action(
   async (site, opts) => runOrExit(
-    async () => (await import("../launch-XTDMC6LD.js")).runLaunchCommand(site, opts),
+    async () => (await import("../launch-7N3X2MXB.js")).runLaunchCommand(site, opts),
     opts
   )
 );
-cli.command("header-image [site]", "Generate a site's report header image from its live homepage.").option("--all", "Every live site with no Header image yet (backfill)").option("--force", "With --all, regenerate sites that already have one").option("--write-airtable", "Upload to the Websites row instead of writing a local file").option("--out-dir <path>", "Directory for local output (default: reports/)").option("--settle-ms <ms>", "Override the post-load settle delay for slow/animated homepages").option(
+cli.command("header-image [site]", "Generate a site's report header image from its live homepage.").option("--all", "Every live site with no Header image yet (backfill)").option("--force", "With --all, regenerate sites that already have one").option("--write-back", "Upload to the Websites row instead of writing a local file").option("--out-dir <path>", "Directory for local output (default: reports/)").option("--settle-ms <ms>", "Override the post-load settle delay for slow/animated homepages").option(
   "--consent-selector <css>",
   "Extra CSS selector(s) to hide before the shutter (consent UI the heuristic misses)"
 ).action(
   async (site, opts) => runOrExit(
-    async () => (await import("../header-image-BRTOLHJF.js")).runHeaderImageCommand(site, opts),
+    async () => (await import("../header-image-H7ZJAV26.js")).runHeaderImageCommand(site, opts),
     opts
   )
 );
@@ -268,7 +307,7 @@ cli.command(
   "Draft the monthly-report announcement email for maintenance sites (all, or one) for approval."
 ).action(
   async (site, opts) => runOrExit(
-    async () => (await import("../announce-45HVP4J4.js")).runAnnounceCommand(site, opts),
+    async () => (await import("../announce-5ZD2SBGD.js")).runAnnounceCommand(site, opts),
     opts
   )
 );
@@ -277,7 +316,7 @@ cli.command(
   "Show who a form submission would email, and optionally flip the pre-launch guard (read-back confirmed)."
 ).option("--set <on|off>", "Flip the guard: on = route to operator, off = restore.").option("--restore <status>", "Status to restore with --set off. Required; never inferred.").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../forms-notify-target-4NPLX2UG.js")).runFormsNotifyTargetCommand(
+    async () => (await import("../forms-notify-target-X6UEOI2M.js")).runFormsNotifyTargetCommand(
       site,
       opts
     ),
@@ -289,7 +328,7 @@ cli.command(
   "Operator self-tests. kind=email: preview a report email for a site (or --all) to yourself."
 ).option("--type <type>", "Report type: announcement (default) | maintenance | testing | launch").option("--to <addr>", "Recipient(s), comma-separated. Default: OPERATOR_EMAIL.").option("--all", "Send a preview for every maintenance site (to --to/operator).").option("--dry-run", "Render only; write reports/<slug>/selftest-<type>.html; do not send.").action(
   async (kind, site, opts) => runOrExit(
-    async () => (await import("../selftest-AFLR7YV7.js")).runSelftestCommand(kind, site, opts),
+    async () => (await import("../selftest-G4W3LIBQ.js")).runSelftestCommand(kind, site, opts),
     opts
   )
 );
@@ -301,13 +340,16 @@ cli.command(
   "Fleet mode: announcement\u2192maintenance sites; maintenance/testing\u2192all schedulable sites."
 ).action(
   async (site, opts) => runOrExit(
-    async () => (await import("../preflight-POZZI3GN.js")).runPreflightCommand(site, opts),
+    async () => (await import("../preflight-O7Q6FWHU.js")).runPreflightCommand(site, opts),
     opts
   )
 );
-cli.command("ensure-site <slug>", "Create/verify the Airtable Websites row for a new site.").option("--name <display name>", "Human Name for the row (client-facing copy uses it verbatim).").option("--url <url>", "Deployed URL (e.g. the Netlify site URL).").option("--contact <email>", "point of contact \u2014 the client address reports resolve to.").option("--git-repo <owner/repo>", "GitHub identity. Default on create: reddoorla/<slug>.").action(
+cli.command(
+  "ensure-site <slug>",
+  "Create/verify a site's fleet row in Turso (new sites get a site_<ULID> id)."
+).option("--name <display name>", "Human Name for the row (client-facing copy uses it verbatim).").option("--url <url>", "Deployed URL (e.g. the Netlify site URL).").option("--contact <email>", "point of contact \u2014 the client address reports resolve to.").option("--git-repo <owner/repo>", "GitHub identity. Default on create: reddoorla/<slug>.").action(
   async (slug, opts) => runOrExit(
-    async () => (await import("../ensure-site-XESZHZEB.js")).runEnsureSiteCommand(slug, opts),
+    async () => (await import("../ensure-site-2QZHFVQ3.js")).runEnsureSiteCommand(slug, opts),
     opts
   )
 );
@@ -334,7 +376,7 @@ cli.command(
   "Comma-separated buyer questions, chosen by hand. Blank asks the goal's fixed set. A chosen set gets its own version key, so comparisons never mix sets."
 ).action(
   async (url, opts) => runOrExit(
-    async () => (await import("../prospect-audit-AJEE3Z4L.js")).runProspectAuditCommand(url, opts),
+    async () => (await import("../prospect-audit-FMPGQIRQ.js")).runProspectAuditCommand(url, opts),
     opts
   )
 );
@@ -355,18 +397,18 @@ cli.command("report [site]", "Draft or send maintenance/testing reports.").optio
   "Regenerate one UNSENT report's stored HTML from its current row, so the console preview shows edited commentary. Refuses a sent report."
 ).action(
   async (site, opts) => runOrExit(
-    async () => (await import("../report-RC5LGPU3.js")).runReportCommand(site, opts),
+    async () => (await import("../report-IAHXN5CW.js")).runReportCommand(site, opts),
     opts
   )
 );
 cli.command(
   "github-signals",
-  "Sweep the fleet for GitHub signals (Renovate-failing/CI/last-commit) and write Airtable."
-).option("--fleet", "Run across every site in the Airtable inventory.").option("--write-airtable", "Write each site's signals back to its Websites row.").action(
+  "Sweep the fleet for GitHub signals (Renovate-failing/CI/last-commit) and write each site's row."
+).option("--fleet", "Run across every site in the Airtable inventory.").option("--write-back", "Write each site's signals back to its Websites row.").action(
   async (opts) => runOrExit(
-    async () => (await import("../github-signals-DMU74SAX.js")).runGitHubSignalsCommand({
+    async () => (await import("../github-signals-QIRTHHET.js")).runGitHubSignalsCommand({
       fleet: opts.fleet,
-      writeAirtable: opts.writeAirtable
+      writeBack: opts.writeBack
     }),
     opts
   )
@@ -376,7 +418,7 @@ cli.command(
   "Verify every public org repo carries a sound branch ruleset (empty bypass, PR-required)."
 ).option("--org <org>", "GitHub org to sweep (enumerated from the API, never a hand list).").action(
   async (opts) => runOrExit(
-    async () => (await import("../protection-audit-3J3UEOVT.js")).runProtectionAuditCommand({
+    async () => (await import("../protection-audit-YXJKFU6O.js")).runProtectionAuditCommand({
       org: opts.org
     }),
     opts
@@ -404,7 +446,7 @@ cli.command(
   "--by <who>",
   "replay-deadletters --abandon: who decided (default: OPERATOR_EMAIL, else 'operator')."
 ).action(
-  async (action, opts) => runOrExit(async () => (await import("../db-5K4CDEGJ.js")).runDbCommand(action, opts), opts)
+  async (action, opts) => runOrExit(async () => (await import("../db-II5WAK4D.js")).runDbCommand(action, opts), opts)
 );
 cli.command(
   "submissions <action>",
@@ -414,7 +456,7 @@ cli.command(
   "Write the re-buckets: status \u2192 spam_auto, spam_score/spam_reason replaced with the new verdict + 'retro-rescore' marker."
 ).action(
   async (action, opts) => runOrExit(
-    async () => (await import("../submissions-II5J35QM.js")).runSubmissionsCommand(action, opts),
+    async () => (await import("../submissions-2SHCFOKD.js")).runSubmissionsCommand(action, opts),
     opts
   )
 );
@@ -423,10 +465,10 @@ cli.command(
   "Trigger Renovate on fleet sites the security sweep flagged with critical/high vulns."
 ).option("--fleet", "Run across every active, repo-backed site in the Airtable inventory.").action(
   async (opts) => runOrExit(
-    async () => (await import("../renovate-dispatch-ONJMBUHJ.js")).runRenovateDispatchCommand({
+    async () => (await import("../renovate-dispatch-2IHAZDVA.js")).runRenovateDispatchCommand({
       fleet: opts.fleet,
       // #539 Phase 5: mirror the auto-fix counter into site_health.
-      siteMirror: await (await import("../site-mirror-H2FYMN55.js")).makeSiteMirror()
+      siteMirror: await (await import("../site-mirror-WR7ACXOV.js")).makeSiteMirror()
     }),
     opts
   )
@@ -451,7 +493,7 @@ cli.command(
   "freeze: JSON declaring slots the template has no token for (video poster, a panel rebuilt from a baked image). Keys must start with 'x.'"
 ).action(
   async (action, dir, opts) => runOrExit(
-    async () => (await import("../blux-RUFMNOUJ.js")).runBluxCommand(action, dir, opts),
+    async () => (await import("../blux-NXQLMS4W.js")).runBluxCommand(action, dir, opts),
     opts
   )
 );
@@ -476,7 +518,7 @@ cli.on("command:*", () => {
   );
   process.exit(1);
 });
-cli.parse();
+cli.parse(rewriteRetiredFlags(process.argv));
 export {
   runOrExit
 };