@reddoorla/maintenance 0.96.0 → 0.98.0

package/dist/{github-signals-DMU74SAX.js → github-signals-RGRPYTUB.js}

@@ -3,8 +3,8 @@ import {
 } from "./chunk-PZQ3WED2.js";
 import {
   formatFleetWriteSummary
-} from "./chunk-ZH5LOQET.js";
-import "./chunk-37B4LVB3.js";
+} from "./chunk-FHFXJ3EM.js";
+import "./chunk-X56LAKPR.js";
 import "./chunk-WQLNUEZL.js";
 import {
   detectSignalEvents,
@@ -15,19 +15,21 @@ import {
   readAirtableConfig
 } from "./chunk-HN6I2XWI.js";
 import {
-  listWebsites,
-  siteSlug,
   updateGitHubSignals
-} from "./chunk-KN52PM63.js";
+} from "./chunk-TC4GANMX.js";
+import {
+  siteSlug
+} from "./chunk-ICSRWW5Q.js";
+import "./chunk-RQJFGK3A.js";
 import {
   makeGitHub
 } from "./chunk-43SW3FGW.js";
 import {
   recordFleetEventsBestEffort
-} from "./chunk-EQQ4H6L3.js";
-import "./chunk-6INOBNRO.js";
-import "./chunk-T76MA2FH.js";
+} from "./chunk-3YALLSBF.js";
+import "./chunk-MNRWHSFS.js";
 import "./chunk-LBYOLBW7.js";
+import "./chunk-CP6MVZ5X.js";
 import "./chunk-6VAL7XJT.js";
 
 // src/audits/github-signals.ts
@@ -61,18 +63,21 @@ function githubSignalsExitCode(written, failed) {
   return failed > written ? 1 : 0;
 }
 async function runGitHubSignalsCommand(opts, deps = {}) {
-  if (!opts.fleet || !opts.writeAirtable) {
-    return { output: "github-signals currently supports only --fleet --write-airtable", code: 2 };
+  if (!opts.fleet || !opts.writeBack) {
+    return { output: "github-signals currently supports only --fleet --write-back", code: 2 };
   }
-  const token = process.env.RENOVATE_TOKEN?.trim() || process.env.GH_TOKEN?.trim();
+  const token = process.env.GH_TOKEN?.trim();
   if (!token) {
     return {
-      output: "github-signals skipped: no RENOVATE_TOKEN/GH_TOKEN (fleet read) configured.",
+      output: "github-signals skipped: no GH_TOKEN (fleet read) configured.",
       code: 0
     };
   }
   const base = deps.openBase ? deps.openBase() : openBase(readAirtableConfig());
-  const websites = await listWebsites(base);
+  const websites = await (deps.roster ?? (async () => {
+    const { readFleetRoster } = await import("./roster-EJ3ILR52.js");
+    return readFleetRoster();
+  }))();
   const gh = deps.makeGh ? deps.makeGh(token) : makeGitHub({ token });
   const sites = websites.map((w) => ({
     path: "",
@@ -91,7 +96,7 @@ async function runGitHubSignalsCommand(opts, deps = {}) {
   );
   const sweptAt = (/* @__PURE__ */ new Date()).toISOString();
   const makeMirror = deps.makeMirror ?? (async () => {
-    const { makeHealthMirrorBestEffort } = await import("./health-mirror-ONRT4DQ5.js");
+    const { makeHealthMirrorBestEffort } = await import("./health-mirror-WZUHWCCV.js");
     return makeHealthMirrorBestEffort();
   });
   const mirror = await makeMirror();
@@ -156,4 +161,4 @@ export {
   githubSignalsExitCode,
   runGitHubSignalsCommand
 };
-//# sourceMappingURL=github-signals-DMU74SAX.js.map
+//# sourceMappingURL=github-signals-RGRPYTUB.js.map

package/dist/github-signals-RGRPYTUB.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/audits/github-signals.ts","../src/cli/commands/github-signals.ts"],"sourcesContent":["import type { Site } from \"../types.js\";\nimport type { CiState, PullRequestSummary } from \"../github/gh.js\";\nimport { isFailingRenovatePR } from \"../alerts/renovate.js\";\n\n/** One swept row, ready for the Airtable writer (slug-keyed by `site`). */\nexport type GitHubSignalsRow = {\n  site: string; // the site name/slug the writer matches on\n  repo: string; // owner/repo\n  renovateFailingCis: number;\n  ciState: CiState;\n  lastCommitAt: string | null;\n};\n\n/** Injected GitHub reads (so the sweep is pure + testable). */\nexport type GitHubSignalsDeps = {\n  openPullRequests: (repo: string) => Promise<PullRequestSummary[]>;\n  defaultBranchStatus: (repo: string) => Promise<{ ciState: CiState; lastCommitAt: string | null }>;\n};\n\n/** Per repo-backed site: count its failing Renovate PRs + read its default-branch\n *  status. Sites without `gitRepo` are skipped (not errors). A repo whose probe\n *  throws is reported via `onSkip` and produces no row — one GitHub hiccup never\n *  sinks the sweep. PURE over `deps`. */\nexport async function collectGitHubSignals(\n  sites: Site[],\n  deps: GitHubSignalsDeps,\n  onSkip: (s: { repo: string }) => void = () => {},\n): Promise<GitHubSignalsRow[]> {\n  const rows: GitHubSignalsRow[] = [];\n  for (const s of sites) {\n    const repo = s.gitRepo;\n    if (!repo) continue;\n    const name = s.name;\n    if (!name) continue;\n    try {\n      const prs = await deps.openPullRequests(repo);\n      const status = await deps.defaultBranchStatus(repo);\n      rows.push({\n        site: name,\n        repo,\n        renovateFailingCis: prs.filter(isFailingRenovatePR).length,\n        ciState: status.ciState,\n        lastCommitAt: status.lastCommitAt,\n      });\n    } catch {\n      onSkip({ repo });\n    }\n  }\n  return rows;\n}\n","import { openBase, readAirtableConfig, type AirtableBase } from \"../../reports/airtable/client.js\";\nimport { siteSlug, updateGitHubSignals } from \"../../reports/airtable/websites.js\";\nimport type { FleetRoster } from \"../../fleet/roster.js\";\nimport type { Site } from \"../../types.js\";\nimport { collectGitHubSignals } from \"../../audits/github-signals.js\";\nimport { makeGitHub, type GitHub } from \"../../github/gh.js\";\nimport {\n  formatFleetWriteSummary,\n  type FleetWriteResult,\n} from \"../../audits/write-audits-to-airtable.js\";\nimport { detectSignalEvents, fleetSweptEvent } from \"../../audits/fleet-event-detectors.js\";\nimport { recordFleetEventsBestEffort } from \"../../audits/fleet-events-writer.js\";\nimport type { FleetEvent } from \"../../db/fleet-events.js\";\nimport type { HealthMirror } from \"../../audits/health-mirror.js\";\n\n/** The slice of the GitHub client this sweep actually probes. */\ntype GhProbes = Pick<\n  GitHub,\n  \"openPullRequests\" | \"defaultBranchStatus\" | \"mergedRenovatePullRequests\"\n>;\n\n/** Injectable wiring for {@link runGitHubSignalsCommand}. Every default is the\n *  real fleet path; tests override to reach the per-row write+mirror loop —\n *  the hand-rolled `makeHealthMirrorBestEffort()` call made that loop\n *  untestable (no test could prove a mirror throw stays out of `failed`, that\n *  the counters increment the right way round, or that the mirror sees the\n *  same payload Airtable got). Same seam shape as\n *  `writeFleetAuditsToAirtable`'s `mirror` argument. */\nexport type GitHubSignalsDeps = {\n  /** Airtable base (default: real creds via readAirtableConfig). Still needed:\n   *  the signals write is an Airtable SHADOW write. */\n  openBase: () => AirtableBase;\n  /** #646 step 4: the fleet roster this sweep walks. Default: Turso\n   *  (`readFleetRoster`) — Airtable cannot see a `site_<ULID>` site at all. */\n  roster: FleetRoster;\n  /** GitHub probe client for the fleet token (default: makeGitHub). */\n  makeGh: (token: string) => GhProbes;\n  /** Turso mirror factory (default: makeHealthMirrorBestEffort — null without\n   *  libSQL creds, leaving the Airtable sweep byte-for-byte unchanged). */\n  makeMirror: () => Promise<HealthMirror | null>;\n  /** Fleet-activity recorder (default: recordFleetEventsBestEffort). */\n  recordEvents: (events: FleetEvent[], now: Date) => Promise<void>;\n};\n\n/** Exit code for a fleet github-signals run. Exit 1 when failures are the\n *  MAJORITY of the fleet (`failed > written`), not only on a total wipeout —\n *  a run where 11/12 repos failed but 1 wrote should still signal an outage.\n *  All-success or a minority of flakes (e.g. 1/12 failed) stays exit 0. The\n *  no-token clean-skip returns 0 separately (before any probe runs). */\nexport function githubSignalsExitCode(written: number, failed: number): number {\n  return failed > written ? 1 : 0;\n}\n\n/** `github-signals --fleet --write-back`: sweep every repo-backed site for its\n *  Renovate-failing count + default-branch CI state + last-commit date, write each\n *  row serially (Airtable ~5 req/sec), and emit FLEET_WRITE_SUMMARY for CI. A\n *  missing fleet token is a clean skip (local runs), not a failure. */\nexport async function runGitHubSignalsCommand(\n  opts: {\n    fleet?: boolean | undefined;\n    writeBack?: boolean | undefined;\n  },\n  deps: Partial<GitHubSignalsDeps> = {},\n): Promise<{ output: string; code: number }> {\n  if (!opts.fleet || !opts.writeBack) {\n    return { output: \"github-signals currently supports only --fleet --write-back\", code: 2 };\n  }\n  const token = process.env.GH_TOKEN?.trim();\n  if (!token) {\n    return {\n      output: \"github-signals skipped: no GH_TOKEN (fleet read) configured.\",\n      code: 0,\n    };\n  }\n  const base = deps.openBase ? deps.openBase() : openBase(readAirtableConfig());\n  const websites = await (\n    deps.roster ??\n    (async () => {\n      const { readFleetRoster } = await import(\"../../fleet/roster.js\");\n      return readFleetRoster();\n    })\n  )();\n  const gh: GhProbes = deps.makeGh ? deps.makeGh(token) : makeGitHub({ token });\n  const sites: Site[] = websites.map((w) => ({\n    path: \"\",\n    name: w.name,\n    meta: {},\n    ...(w.gitRepo ? { gitRepo: w.gitRepo } : {}),\n  }));\n\n  const skipped: string[] = [];\n  const rows = await collectGitHubSignals(\n    sites,\n    {\n      openPullRequests: (r) => gh.openPullRequests(r),\n      defaultBranchStatus: (r) => gh.defaultBranchStatus(r),\n    },\n    ({ repo }) => skipped.push(repo),\n  );\n\n  const sweptAt = new Date().toISOString();\n  // Phase 3 dual-write (#539): mirror each row's written FieldSet into\n  // site_health. Null when libSQL creds are absent — the Airtable sweep\n  // proceeds exactly as before. (Dynamic import so the no-mirror path never\n  // loads the db client.)\n  const makeMirror =\n    deps.makeMirror ??\n    (async () => {\n      const { makeHealthMirrorBestEffort } = await import(\"../../audits/health-mirror.js\");\n      return makeHealthMirrorBestEffort();\n    });\n  const mirror = await makeMirror();\n  const result: FleetWriteResult = {\n    written: [],\n    failed: [],\n    ...(mirror ? { mirrored: 0, mirrorFailed: 0, mirrorMissed: 0 } : {}),\n  };\n  const byRepo = new Map(websites.filter((w) => w.gitRepo).map((w) => [w.gitRepo, w]));\n  const events: FleetEvent[] = [];\n  const sweptMs = Date.parse(sweptAt);\n  const since24h = new Date(sweptMs - 24 * 60 * 60 * 1000).toISOString();\n  // Serial: Airtable's ~5 req/sec limit (matches writeFleetAuditsToAirtable).\n  for (const row of rows) {\n    const target = byRepo.get(row.repo);\n    if (!target) {\n      result.failed.push({ slug: siteSlug(row.site), error: \"no Websites row matched\" });\n      continue;\n    }\n    try {\n      const ghFields = await updateGitHubSignals(base, target.id, {\n        renovateFailingCis: row.renovateFailingCis,\n        ciState: row.ciState,\n        lastCommitAt: row.lastCommitAt,\n        sweptAt,\n      });\n      if (mirror) {\n        // Count, never throw: a Turso blip must not move an Airtable-written\n        // row into `failed` (that would red the sweep via githubSignalsExitCode\n        // on a fleet-wide mirror outage). A 0-row match (site not yet imported)\n        // is a miss, not a mirror — see FleetWriteResult.mirrorMissed.\n        try {\n          if (await mirror(target.id, ghFields)) {\n            result.mirrored = (result.mirrored ?? 0) + 1;\n          } else {\n            result.mirrorMissed = (result.mirrorMissed ?? 0) + 1;\n          }\n        } catch (e) {\n          result.mirrorFailed = (result.mirrorFailed ?? 0) + 1;\n          console.error(`[health-mirror] ${target.name}: ${(e as Error).message}`);\n        }\n      }\n      result.written.push({\n        siteName: target.name,\n        writes: [{ audit: \"github-signals\", counts: row }],\n      });\n      // Fleet-activity events for this repo: merged Renovate PRs since the last sweep\n      // (watermark = the row's prior GitHub Signals At, else a 24h fallback) + a\n      // CI-recovered transition. A PR-fetch hiccup drops only this repo's PR events.\n      const since = target.githubSignalsAt ?? since24h;\n      let merged: Awaited<ReturnType<typeof gh.mergedRenovatePullRequests>> = [];\n      try {\n        merged = await gh.mergedRenovatePullRequests(row.repo, since);\n      } catch {\n        // PR list unavailable this run — skip pr_automerged for this repo, keep ci_recovered\n      }\n      events.push(...detectSignalEvents(target, row, merged, sweptAt));\n    } catch (e) {\n      result.failed.push({ slug: siteSlug(row.site), error: (e as Error).message });\n    }\n  }\n  for (const repo of skipped) result.failed.push({ slug: repo, error: \"probe failed (skipped)\" });\n\n  events.push(fleetSweptEvent(\"github-signals\", result.written.length, sweptAt));\n  await (deps.recordEvents ?? recordFleetEventsBestEffort)(events, new Date());\n\n  // Exit non-zero when failures are the MAJORITY of the fleet, not only on a\n  // total wipeout. A run where 11/12 repos failed but 1 wrote used to return 0,\n  // masking a large outage. The nightly cron step is `continue-on-error`, so a\n  // non-zero here is an operator-visibility signal, not a red build.\n  return {\n    output: formatFleetWriteSummary(result),\n    code: githubSignalsExitCode(result.written.length, result.failed.length),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuBA,eAAsB,qBACpB,OACA,MACA,SAAwC,MAAM;AAAC,GAClB;AAC7B,QAAM,OAA2B,CAAC;AAClC,aAAW,KAAK,OAAO;AACrB,UAAM,OAAO,EAAE;AACf,QAAI,CAAC,KAAM;AACX,UAAM,OAAO,EAAE;AACf,QAAI,CAAC,KAAM;AACX,QAAI;AACF,YAAM,MAAM,MAAM,KAAK,iBAAiB,IAAI;AAC5C,YAAM,SAAS,MAAM,KAAK,oBAAoB,IAAI;AAClD,WAAK,KAAK;AAAA,QACR,MAAM;AAAA,QACN;AAAA,QACA,oBAAoB,IAAI,OAAO,mBAAmB,EAAE;AAAA,QACpD,SAAS,OAAO;AAAA,QAChB,cAAc,OAAO;AAAA,MACvB,CAAC;AAAA,IACH,QAAQ;AACN,aAAO,EAAE,KAAK,CAAC;AAAA,IACjB;AAAA,EACF;AACA,SAAO;AACT;;;ACAO,SAAS,sBAAsB,SAAiB,QAAwB;AAC7E,SAAO,SAAS,UAAU,IAAI;AAChC;AAMA,eAAsB,wBACpB,MAIA,OAAmC,CAAC,GACO;AAC3C,MAAI,CAAC,KAAK,SAAS,CAAC,KAAK,WAAW;AAClC,WAAO,EAAE,QAAQ,+DAA+D,MAAM,EAAE;AAAA,EAC1F;AACA,QAAM,QAAQ,QAAQ,IAAI,UAAU,KAAK;AACzC,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,MAAM;AAAA,IACR;AAAA,EACF;AACA,QAAM,OAAO,KAAK,WAAW,KAAK,SAAS,IAAI,SAAS,mBAAmB,CAAC;AAC5E,QAAM,WAAW,OACf,KAAK,WACJ,YAAY;AACX,UAAM,EAAE,gBAAgB,IAAI,MAAM,OAAO,sBAAuB;AAChE,WAAO,gBAAgB;AAAA,EACzB,IACA;AACF,QAAM,KAAe,KAAK,SAAS,KAAK,OAAO,KAAK,IAAI,WAAW,EAAE,MAAM,CAAC;AAC5E,QAAM,QAAgB,SAAS,IAAI,CAAC,OAAO;AAAA,IACzC,MAAM;AAAA,IACN,MAAM,EAAE;AAAA,IACR,MAAM,CAAC;AAAA,IACP,GAAI,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5C,EAAE;AAEF,QAAM,UAAoB,CAAC;AAC3B,QAAM,OAAO,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,MACE,kBAAkB,CAAC,MAAM,GAAG,iBAAiB,CAAC;AAAA,MAC9C,qBAAqB,CAAC,MAAM,GAAG,oBAAoB,CAAC;AAAA,IACtD;AAAA,IACA,CAAC,EAAE,KAAK,MAAM,QAAQ,KAAK,IAAI;AAAA,EACjC;AAEA,QAAM,WAAU,oBAAI,KAAK,GAAE,YAAY;AAKvC,QAAM,aACJ,KAAK,eACJ,YAAY;AACX,UAAM,EAAE,2BAA2B,IAAI,MAAM,OAAO,6BAA+B;AACnF,WAAO,2BAA2B;AAAA,EACpC;AACF,QAAM,SAAS,MAAM,WAAW;AAChC,QAAM,SAA2B;AAAA,IAC/B,SAAS,CAAC;AAAA,IACV,QAAQ,CAAC;AAAA,IACT,GAAI,SAAS,EAAE,UAAU,GAAG,cAAc,GAAG,cAAc,EAAE,IAAI,CAAC;AAAA,EACpE;AACA,QAAM,SAAS,IAAI,IAAI,SAAS,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;AACnF,QAAM,SAAuB,CAAC;AAC9B,QAAM,UAAU,KAAK,MAAM,OAAO;AAClC,QAAM,WAAW,IAAI,KAAK,UAAU,KAAK,KAAK,KAAK,GAAI,EAAE,YAAY;AAErE,aAAW,OAAO,MAAM;AACtB,UAAM,SAAS,OAAO,IAAI,IAAI,IAAI;AAClC,QAAI,CAAC,QAAQ;AACX,aAAO,OAAO,KAAK,EAAE,MAAM,SAAS,IAAI,IAAI,GAAG,OAAO,0BAA0B,CAAC;AACjF;AAAA,IACF;AACA,QAAI;AACF,YAAM,WAAW,MAAM,oBAAoB,MAAM,OAAO,IAAI;AAAA,QAC1D,oBAAoB,IAAI;AAAA,QACxB,SAAS,IAAI;AAAA,QACb,cAAc,IAAI;AAAA,QAClB;AAAA,MACF,CAAC;AACD,UAAI,QAAQ;AAKV,YAAI;AACF,cAAI,MAAM,OAAO,OAAO,IAAI,QAAQ,GAAG;AACrC,mBAAO,YAAY,OAAO,YAAY,KAAK;AAAA,UAC7C,OAAO;AACL,mBAAO,gBAAgB,OAAO,gBAAgB,KAAK;AAAA,UACrD;AAAA,QACF,SAAS,GAAG;AACV,iBAAO,gBAAgB,OAAO,gBAAgB,KAAK;AACnD,kBAAQ,MAAM,mBAAmB,OAAO,IAAI,KAAM,EAAY,OAAO,EAAE;AAAA,QACzE;AAAA,MACF;AACA,aAAO,QAAQ,KAAK;AAAA,QAClB,UAAU,OAAO;AAAA,QACjB,QAAQ,CAAC,EAAE,OAAO,kBAAkB,QAAQ,IAAI,CAAC;AAAA,MACnD,CAAC;AAID,YAAM,QAAQ,OAAO,mBAAmB;AACxC,UAAI,SAAoE,CAAC;AACzE,UAAI;AACF,iBAAS,MAAM,GAAG,2BAA2B,IAAI,MAAM,KAAK;AAAA,MAC9D,QAAQ;AAAA,MAER;AACA,aAAO,KAAK,GAAG,mBAAmB,QAAQ,KAAK,QAAQ,OAAO,CAAC;AAAA,IACjE,SAAS,GAAG;AACV,aAAO,OAAO,KAAK,EAAE,MAAM,SAAS,IAAI,IAAI,GAAG,OAAQ,EAAY,QAAQ,CAAC;AAAA,IAC9E;AAAA,EACF;AACA,aAAW,QAAQ,QAAS,QAAO,OAAO,KAAK,EAAE,MAAM,MAAM,OAAO,yBAAyB,CAAC;AAE9F,SAAO,KAAK,gBAAgB,kBAAkB,OAAO,QAAQ,QAAQ,OAAO,CAAC;AAC7E,SAAO,KAAK,gBAAgB,6BAA6B,QAAQ,oBAAI,KAAK,CAAC;AAM3E,SAAO;AAAA,IACL,QAAQ,wBAAwB,MAAM;AAAA,IACtC,MAAM,sBAAsB,OAAO,QAAQ,QAAQ,OAAO,OAAO,MAAM;AAAA,EACzE;AACF;","names":[]}

package/dist/{header-image-BRTOLHJF.js → header-image-43ZIEJKP.js}

@@ -1,19 +1,15 @@
 import {
   uploadAttachment
-} from "./chunk-IY6256GK.js";
-import {
-  openBase,
-  readAirtableConfig
-} from "./chunk-HN6I2XWI.js";
+} from "./chunk-YJBSB4LP.js";
 import {
   generateHeaderImage
-} from "./chunk-MZZDMBDT.js";
+} from "./chunk-LZMAG73U.js";
+import "./chunk-TC4GANMX.js";
 import {
   ACTIVE_STATUSES,
-  listWebsites,
   siteSlug
-} from "./chunk-KN52PM63.js";
-import "./chunk-6VAL7XJT.js";
+} from "./chunk-ICSRWW5Q.js";
+import "./chunk-RQJFGK3A.js";
 
 // src/cli/commands/header-image.ts
 import { mkdir, writeFile } from "fs/promises";
@@ -44,7 +40,7 @@ function parseSettleMs(value) {
 async function generateForTargets(targets, opts, generate = generateHeaderImage) {
   const outDir = resolve(opts.outDir ?? "reports");
   const settleMs = parseSettleMs(opts.settleMs);
-  if (!opts.writeAirtable) await mkdir(outDir, { recursive: true });
+  if (!opts.writeBack) await mkdir(outDir, { recursive: true });
   const lines = [];
   let failed = 0;
   for (const row of targets) {
@@ -57,7 +53,7 @@ async function generateForTargets(targets, opts, generate = generateHeaderImage)
         ...settleMs === void 0 ? {} : { settleMs },
         ...opts.consentSelector === void 0 ? {} : { consentSelector: opts.consentSelector }
       });
-      if (opts.writeAirtable) {
+      if (opts.writeBack) {
         await uploadAttachment(row.id, "Header image", gen.bytes, gen.filename, gen.contentType, {
           replaceIn: "Websites"
         });
@@ -81,7 +77,7 @@ async function generateForTargets(targets, opts, generate = generateHeaderImage)
       } else {
         const path = resolve(outDir, gen.filename);
         await writeFile(path, gen.bytes);
-        lines.push(`\u2714 ${row.name} \u2014 wrote ${path} (review, then re-run with --write-airtable)`);
+        lines.push(`\u2714 ${row.name} \u2014 wrote ${path} (review, then re-run with --write-back)`);
       }
     } catch (err) {
       failed++;
@@ -92,8 +88,8 @@ async function generateForTargets(targets, opts, generate = generateHeaderImage)
   return { output: lines.join("\n"), code: failed > 0 ? 1 : 0 };
 }
 async function runHeaderImageCommand(site, opts) {
-  const base = openBase(readAirtableConfig());
-  const rows = await listWebsites(base);
+  const { readFleetRoster } = await import("./roster-EJ3ILR52.js");
+  const rows = await readFleetRoster();
   const targets = resolveTargets(rows, { site, all: opts.all, force: opts.force });
   if (targets.length === 0) {
     return {
@@ -102,8 +98,8 @@ async function runHeaderImageCommand(site, opts) {
     };
   }
   let withStore = opts;
-  if (opts.writeAirtable && !opts.storeDb && process.env.TURSO_DATABASE_URL) {
-    const { openDb, readDbConfig } = await import("./client-L7NAUG6J.js");
+  if (opts.writeBack && !opts.storeDb && process.env.TURSO_DATABASE_URL) {
+    const { openDb, readDbConfig } = await import("./client-3XGSZMLU.js");
     const { storeHeaderImage } = await import("./header-images-SQBCE5OD.js");
     const db = await openDb(readDbConfig());
     withStore = { ...opts, storeDb: (id, img) => storeHeaderImage(db, id, img) };
@@ -116,4 +112,4 @@ export {
   resolveTargets,
   runHeaderImageCommand
 };
-//# sourceMappingURL=header-image-BRTOLHJF.js.map
+//# sourceMappingURL=header-image-43ZIEJKP.js.map

package/dist/header-image-43ZIEJKP.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli/commands/header-image.ts"],"sourcesContent":["import { mkdir, writeFile } from \"node:fs/promises\";\nimport { resolve } from \"node:path\";\nimport { siteSlug, ACTIVE_STATUSES } from \"../../reports/airtable/websites.js\";\nimport type { WebsiteRow } from \"../../reports/airtable/websites.js\";\nimport { uploadAttachment } from \"../../reports/airtable/attachments.js\";\nimport { generateHeaderImage } from \"../../reports/header-image/index.js\";\nimport type { StoredHeaderImage } from \"../../db/header-images.js\";\n\nexport type HeaderImageOptions = {\n  all?: boolean;\n  force?: boolean;\n  writeBack?: boolean;\n  outDir?: string;\n  settleMs?: string;\n  consentSelector?: string;\n  /** Injected Turso store for the dual-write (#539, design D5): while Airtable\n   *  is still written (until the Phase 5 freeze), every upload ALSO lands the\n   *  bytes in sites.header_image* so the Turso read layer serves a real image.\n   *  Absent → Airtable-only (a local run without Turso env still works). */\n  storeDb?: (siteId: string, img: StoredHeaderImage) => Promise<void>;\n};\n\n/** Which rows this invocation should act on. Pure, so it is unit-tested. */\nexport function resolveTargets(\n  rows: readonly WebsiteRow[],\n  // `| undefined` spelled out because `exactOptionalPropertyTypes` otherwise\n  // rejects the caller passing through possibly-undefined CLI flags.\n  opts: { site?: string | undefined; all?: boolean | undefined; force?: boolean | undefined },\n): WebsiteRow[] {\n  if (opts.site) {\n    const want = siteSlug(opts.site);\n    return rows.filter((r) => siteSlug(r.name) === want);\n  }\n  if (!opts.all) return [];\n  return rows.filter((r) => {\n    if (!r.url) return false;\n    if (r.status === null || !ACTIVE_STATUSES.has(r.status)) return false;\n    return opts.force ? true : !r.headerImage;\n  });\n}\n\n/** Parse the `--settle-ms <ms>` flag. Unset → undefined (the generator's own\n *  default settle). `Number(\"abc\")` is NaN, which would sail through as a NaN\n *  timeout and silently skip the settle entirely, so anything non-finite or\n *  negative is rejected up front rather than producing a subtly-wrong capture. */\nexport function parseSettleMs(value: string | undefined): number | undefined {\n  if (value === undefined) return undefined;\n  const n = Number(value);\n  if (!Number.isFinite(n) || n < 0) {\n    throw Object.assign(\n      new Error(`--settle-ms must be a non-negative number of milliseconds, got \"${value}\"`),\n      { exitCode: 2 },\n    );\n  }\n  return n;\n}\n\n/** Injected in tests so the file-writing branch can be exercised without\n *  driving a real browser (mirrors `GenerateInput.shooter`). */\ntype Generate = typeof generateHeaderImage;\n\n/**\n * Generate a header image per target row and either upload it to Airtable or\n * write it locally for review. Split out of {@link runHeaderImageCommand} so\n * the local-output path is testable without an Airtable base.\n */\nexport async function generateForTargets(\n  targets: readonly WebsiteRow[],\n  opts: HeaderImageOptions,\n  generate: Generate = generateHeaderImage,\n): Promise<{ output: string; code: number }> {\n  const outDir = resolve(opts.outDir ?? \"reports\");\n  const settleMs = parseSettleMs(opts.settleMs);\n  // `reports/` does not exist on a fresh checkout, so the writeFile() below\n  // would throw ENOENT for the first operator to run the default (local) path.\n  // Create it once, before the loop, rather than per site.\n  if (!opts.writeBack) await mkdir(outDir, { recursive: true });\n\n  const lines: string[] = [];\n  let failed = 0;\n\n  for (const row of targets) {\n    try {\n      const gen = await generate({\n        url: row.url,\n        slug: siteSlug(row.name),\n        // `exactOptionalPropertyTypes` rejects an explicit `settleMs: undefined`\n        // against `settleMs?: number`, so omit the key entirely when unset.\n        ...(settleMs === undefined ? {} : { settleMs }),\n        ...(opts.consentSelector === undefined ? {} : { consentSelector: opts.consentSelector }),\n      });\n      if (opts.writeBack) {\n        // replaceIn: the field must hold exactly the current header — see\n        // uploadAttachment, where appending left readers on a stale [0].\n        await uploadAttachment(row.id, \"Header image\", gen.bytes, gen.filename, gen.contentType, {\n          replaceIn: \"Websites\",\n        });\n        let stored = \"\";\n        if (opts.storeDb) {\n          // Dual-write. A Turso failure must not void the Airtable upload —\n          // but it must be VISIBLE, never a silent divergence.\n          try {\n            await opts.storeDb(row.id, {\n              bytes: gen.bytes,\n              filename: gen.filename,\n              contentType: gen.contentType,\n              generatedAt: new Date().toISOString(),\n            });\n            stored = \" + turso\";\n          } catch (err) {\n            stored = ` (⚠ turso store FAILED: ${err instanceof Error ? err.message : String(err)})`;\n          }\n        }\n        lines.push(\n          `✔ ${row.name} — uploaded ${gen.filename} (${(gen.bytes.byteLength / 1024 / 1024).toFixed(2)} MB)${stored}`,\n        );\n      } else {\n        const path = resolve(outDir, gen.filename);\n        await writeFile(path, gen.bytes);\n        lines.push(`✔ ${row.name} — wrote ${path} (review, then re-run with --write-back)`);\n      }\n    } catch (err) {\n      failed++;\n      lines.push(`✖ ${row.name} — ${err instanceof Error ? err.message : String(err)}`);\n    }\n  }\n\n  lines.push(`${targets.length - failed}/${targets.length} generated.`);\n  return { output: lines.join(\"\\n\"), code: failed > 0 ? 1 : 0 };\n}\n\n/**\n * `header-image [site]` — capture a site's live homepage and composite its\n * report header image. Defaults to writing the JPEG locally so the operator can\n * eyeball it; `--write-back` uploads it to the Websites row's Header image\n * field. `--all` backfills every live site that has no header image yet.\n */\nexport async function runHeaderImageCommand(\n  site: string | undefined,\n  opts: HeaderImageOptions,\n): Promise<{ output: string; code: number }> {\n  // #646 step 4: the roster comes from Turso, which holds every site. That also\n  // makes `--all` honest about what it backfills: `headerImage` on a Turso row\n  // reflects `sites.header_image*`, the bytes the report actually renders from\n  // (design D5), not the Airtable attachment the send path no longer needs.\n  const { readFleetRoster } = await import(\"../../fleet/roster.js\");\n  const rows = await readFleetRoster();\n  const targets = resolveTargets(rows, { site, all: opts.all, force: opts.force });\n  if (targets.length === 0) {\n    return {\n      output: site ? `No site matched \"${site}\".` : \"No sites need a header image.\",\n      code: 1,\n    };\n  }\n  // Wire the Turso dual-write when the env is present; a local run without it\n  // still works Airtable-only (the store is per-site error-isolated above).\n  let withStore = opts;\n  if (opts.writeBack && !opts.storeDb && process.env.TURSO_DATABASE_URL) {\n    const { openDb, readDbConfig } = await import(\"../../db/client.js\");\n    const { storeHeaderImage } = await import(\"../../db/header-images.js\");\n    const db = await openDb(readDbConfig());\n    withStore = { ...opts, storeDb: (id, img) => storeHeaderImage(db, id, img) };\n  }\n  return generateForTargets(targets, withStore);\n}\n"],"mappings":";;;;;;;;;;;;;;AAAA,SAAS,OAAO,iBAAiB;AACjC,SAAS,eAAe;AAsBjB,SAAS,eACd,MAGA,MACc;AACd,MAAI,KAAK,MAAM;AACb,UAAM,OAAO,SAAS,KAAK,IAAI;AAC/B,WAAO,KAAK,OAAO,CAAC,MAAM,SAAS,EAAE,IAAI,MAAM,IAAI;AAAA,EACrD;AACA,MAAI,CAAC,KAAK,IAAK,QAAO,CAAC;AACvB,SAAO,KAAK,OAAO,CAAC,MAAM;AACxB,QAAI,CAAC,EAAE,IAAK,QAAO;AACnB,QAAI,EAAE,WAAW,QAAQ,CAAC,gBAAgB,IAAI,EAAE,MAAM,EAAG,QAAO;AAChE,WAAO,KAAK,QAAQ,OAAO,CAAC,EAAE;AAAA,EAChC,CAAC;AACH;AAMO,SAAS,cAAc,OAA+C;AAC3E,MAAI,UAAU,OAAW,QAAO;AAChC,QAAM,IAAI,OAAO,KAAK;AACtB,MAAI,CAAC,OAAO,SAAS,CAAC,KAAK,IAAI,GAAG;AAChC,UAAM,OAAO;AAAA,MACX,IAAI,MAAM,mEAAmE,KAAK,GAAG;AAAA,MACrF,EAAE,UAAU,EAAE;AAAA,IAChB;AAAA,EACF;AACA,SAAO;AACT;AAWA,eAAsB,mBACpB,SACA,MACA,WAAqB,qBACsB;AAC3C,QAAM,SAAS,QAAQ,KAAK,UAAU,SAAS;AAC/C,QAAM,WAAW,cAAc,KAAK,QAAQ;AAI5C,MAAI,CAAC,KAAK,UAAW,OAAM,MAAM,QAAQ,EAAE,WAAW,KAAK,CAAC;AAE5D,QAAM,QAAkB,CAAC;AACzB,MAAI,SAAS;AAEb,aAAW,OAAO,SAAS;AACzB,QAAI;AACF,YAAM,MAAM,MAAM,SAAS;AAAA,QACzB,KAAK,IAAI;AAAA,QACT,MAAM,SAAS,IAAI,IAAI;AAAA;AAAA;AAAA,QAGvB,GAAI,aAAa,SAAY,CAAC,IAAI,EAAE,SAAS;AAAA,QAC7C,GAAI,KAAK,oBAAoB,SAAY,CAAC,IAAI,EAAE,iBAAiB,KAAK,gBAAgB;AAAA,MACxF,CAAC;AACD,UAAI,KAAK,WAAW;AAGlB,cAAM,iBAAiB,IAAI,IAAI,gBAAgB,IAAI,OAAO,IAAI,UAAU,IAAI,aAAa;AAAA,UACvF,WAAW;AAAA,QACb,CAAC;AACD,YAAI,SAAS;AACb,YAAI,KAAK,SAAS;AAGhB,cAAI;AACF,kBAAM,KAAK,QAAQ,IAAI,IAAI;AAAA,cACzB,OAAO,IAAI;AAAA,cACX,UAAU,IAAI;AAAA,cACd,aAAa,IAAI;AAAA,cACjB,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,YACtC,CAAC;AACD,qBAAS;AAAA,UACX,SAAS,KAAK;AACZ,qBAAS,gCAA2B,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,UACtF;AAAA,QACF;AACA,cAAM;AAAA,UACJ,UAAK,IAAI,IAAI,oBAAe,IAAI,QAAQ,MAAM,IAAI,MAAM,aAAa,OAAO,MAAM,QAAQ,CAAC,CAAC,OAAO,MAAM;AAAA,QAC3G;AAAA,MACF,OAAO;AACL,cAAM,OAAO,QAAQ,QAAQ,IAAI,QAAQ;AACzC,cAAM,UAAU,MAAM,IAAI,KAAK;AAC/B,cAAM,KAAK,UAAK,IAAI,IAAI,iBAAY,IAAI,0CAA0C;AAAA,MACpF;AAAA,IACF,SAAS,KAAK;AACZ;AACA,YAAM,KAAK,UAAK,IAAI,IAAI,WAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAAA,IAClF;AAAA,EACF;AAEA,QAAM,KAAK,GAAG,QAAQ,SAAS,MAAM,IAAI,QAAQ,MAAM,aAAa;AACpE,SAAO,EAAE,QAAQ,MAAM,KAAK,IAAI,GAAG,MAAM,SAAS,IAAI,IAAI,EAAE;AAC9D;AAQA,eAAsB,sBACpB,MACA,MAC2C;AAK3C,QAAM,EAAE,gBAAgB,IAAI,MAAM,OAAO,sBAAuB;AAChE,QAAM,OAAO,MAAM,gBAAgB;AACnC,QAAM,UAAU,eAAe,MAAM,EAAE,MAAM,KAAK,KAAK,KAAK,OAAO,KAAK,MAAM,CAAC;AAC/E,MAAI,QAAQ,WAAW,GAAG;AACxB,WAAO;AAAA,MACL,QAAQ,OAAO,oBAAoB,IAAI,OAAO;AAAA,MAC9C,MAAM;AAAA,IACR;AAAA,EACF;AAGA,MAAI,YAAY;AAChB,MAAI,KAAK,aAAa,CAAC,KAAK,WAAW,QAAQ,IAAI,oBAAoB;AACrE,UAAM,EAAE,QAAQ,aAAa,IAAI,MAAM,OAAO,sBAAoB;AAClE,UAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,6BAA2B;AACrE,UAAM,KAAK,MAAM,OAAO,aAAa,CAAC;AACtC,gBAAY,EAAE,GAAG,MAAM,SAAS,CAAC,IAAI,QAAQ,iBAAiB,IAAI,IAAI,GAAG,EAAE;AAAA,EAC7E;AACA,SAAO,mBAAmB,SAAS,SAAS;AAC9C;","names":[]}

package/dist/{health-endpoint-UCLMSSCN.js → health-endpoint-K5LXDPGE.js}

@@ -5,21 +5,21 @@ import {
   appendSkipNotice,
   fleetWorkdir,
   prepareFleetSites
-} from "./chunk-SHGIDTYF.js";
+} from "./chunk-DYTYPKFN.js";
 import {
   resolveSites
-} from "./chunk-H445EH33.js";
+} from "./chunk-S2PLX4XK.js";
 import {
   healthEndpoint
-} from "./chunk-XED2DNAI.js";
+} from "./chunk-LAG6IP7Y.js";
+import "./chunk-TJLKWQOX.js";
 import "./chunk-5CJVUPJU.js";
-import "./chunk-4UTJ4G6P.js";
-import "./chunk-SQ4FSNYL.js";
+import "./chunk-LUF52EIY.js";
 import "./chunk-Z3JXLULD.js";
 import "./chunk-LBYOLBW7.js";
 import "./chunk-RARREDQE.js";
 import "./chunk-XXTZBPUY.js";
-import "./chunk-EASYCD6F.js";
+import "./chunk-WMF5S2MB.js";
 
 // src/cli/commands/health-endpoint.ts
 import { resolve } from "path";
@@ -52,4 +52,4 @@ async function runHealthEndpointCommand(site, opts) {
 export {
   runHealthEndpointCommand
 };
-//# sourceMappingURL=health-endpoint-UCLMSSCN.js.map
+//# sourceMappingURL=health-endpoint-K5LXDPGE.js.map

package/dist/{health-mirror-ONRT4DQ5.js → health-mirror-WZUHWCCV.js}

@@ -1,19 +1,19 @@
-import {
-  mirrorHealthFields,
-  mirrorScheduleFields
-} from "./chunk-GEUC5VGM.js";
-import "./chunk-UIITN37J.js";
 import {
   TURSO_IS_AUTHORITATIVE
 } from "./chunk-WQLNUEZL.js";
-import "./chunk-F3JWOPTG.js";
+import {
+  mirrorHealthFields,
+  mirrorScheduleFields
+} from "./chunk-BINFZQ2T.js";
+import "./chunk-LF2TJN4X.js";
+import "./chunk-ASLDCWBF.js";
 import "./chunk-VAD43MOR.js";
-import "./chunk-KN52PM63.js";
+import "./chunk-ICSRWW5Q.js";
 import {
   openDb,
   readDbConfig
-} from "./chunk-6INOBNRO.js";
-import "./chunk-T76MA2FH.js";
+} from "./chunk-MNRWHSFS.js";
+import "./chunk-CP6MVZ5X.js";
 import "./chunk-6VAL7XJT.js";
 
 // src/audits/health-mirror.ts
@@ -43,4 +43,4 @@ export {
   makeHealthMirrorBestEffort,
   makeScheduleMirrorBestEffort
 };
-//# sourceMappingURL=health-mirror-ONRT4DQ5.js.map
+//# sourceMappingURL=health-mirror-WZUHWCCV.js.map

package/dist/{import-airtable-IIK2QUUF.js → import-airtable-UBF5GYAL.js}

@@ -14,9 +14,9 @@ import {
   renderedHtmlUrl,
   scheduleColumnFor,
   siteValueFor
-} from "./chunk-UIITN37J.js";
+} from "./chunk-LF2TJN4X.js";
 import "./chunk-VAD43MOR.js";
-import "./chunk-KN52PM63.js";
+import "./chunk-ICSRWW5Q.js";
 export {
   EXCLUDED_WEBSITE_FIELDS,
   HEALTH_BOOLEAN,
@@ -34,4 +34,4 @@ export {
   scheduleColumnFor,
   siteValueFor
 };
-//# sourceMappingURL=import-airtable-IIK2QUUF.js.map
+//# sourceMappingURL=import-airtable-UBF5GYAL.js.map