@aglyn/tenant-data-admin 1.0.0-beta.222 → 1.0.0-beta.224

package/src/lib/server/render-monitor.js

@@ -0,0 +1,573 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { TENANT_APEX } from "@aglyn/aglyn/app-utils/tenant-apex";
+/**
+ * THE RENDER MONITOR (AGL-3568): does a published site still render a page
+ * that was not already in a cache?
+ *
+ * On 2026-10-05 every uncached page render on the published-site runtime
+ * hung to the platform's 60 s limit for 28 minutes, and nothing alerted. The
+ * three monitors that existed each missed it for its own reason:
+ *
+ *  - the GitHub uptime probe is scheduled every 15 minutes and GitHub ran it
+ *    four times that day, none of them during the outage;
+ *  - its page rows fetch `/`, which the ISR cache answers, so a visitor's
+ *    page that was cached still loaded and the row stayed green;
+ *  - `/api/health/render/site` runs the page LOADER in-process and never the
+ *    site layout, which is where the request was stuck.
+ *
+ * So this fetches pages over HTTP, from the console (a different deployment
+ * from the one it watches), on Cloud Scheduler every five minutes, and asks
+ * for two pages no cache can answer:
+ *
+ *  - `dynamic` — `/search`, a route every site has that renders on every
+ *    request (`force-dynamic`) inside the full site layout. A 200 that is a
+ *    complete document proves the layout and head ran just now.
+ *  - `isr` — a path nobody has ever requested, under the catch-all page.
+ *    A never-seen path is the one request the ISR cache cannot answer, so it
+ *    renders in the same static context every published page renders in,
+ *    which is the context the 2026-09-09 outage only appeared in. It is a
+ *    404 by construction, and the site's own not-found page is drawn inside
+ *    the same layout, so a complete 404 document is a pass.
+ *
+ * A site that fails `threshold` runs in a row raises
+ * `system.siteRenderFailing` once; the first passing run after that raises
+ * `system.siteRenderRecovered` once. The state lives in
+ * `operatorHealthState/render-monitor--<host>`, beside every other health
+ * check, so Staff → Operator alerts lists it with its status and since when.
+ *
+ * Nothing here names an Aglyn host for anyone else: the default target is the
+ * install's own demonstration site label under its own tenant apex, the
+ * convention the middleware and the render canaries already follow. The one
+ * exception is `PLATFORM_RENDER_PAGES` below, which applies on Aglyn's own
+ * console deployment and nowhere else.
+ *
+ * ## Real pages, rendered fresh (AGL-3571)
+ *
+ * The two probes above draw the layout. They do not draw a page BODY, and
+ * beta.223 hung only on page bodies with an image in them (an ancestor walk
+ * looped on the page root, AGL-3565): `demo` has no images and the not-found
+ * page has no body, so this monitor read green through it. So a third probe,
+ * `page`, renders a real published page through the full ISR path — through
+ * the tenant's `*.vercel.app` production domain (`RENDER_MONITOR_RENDER_ORIGIN`),
+ * which honors `?tenantHost=` and sits behind Deployment Protection, naming
+ * the site with a spelling no cache holds (`freshHostSpelling`). The cache key
+ * includes the `[host]` segment, and `normalizeHostAlias` resolves every
+ * spelling to the same site. Without the automation bypass the render origin
+ * answers its sign-in redirect, so no `page` probe is made at all.
+ *
+ * One page per site per run, rotating through that site's list: a platform
+ * break fails every page with an image, so every run, and alerts as fast as
+ * before; a break on one page alone is seen on its turn.
+ */ /** The state documents' collection: the health checks' own. */ const RENDER_MONITOR_COLLECTION = 'operatorHealthState';
+/** Every render monitor document id starts with this. */ export const RENDER_MONITOR_CHECK_PREFIX = 'render-monitor--';
+/** The beat id `/api/health/crons` reads for the scheduled run. */ export const RENDER_MONITOR_JOB_ID = 'render-monitor';
+/**
+ * How long one page fetch may take. Well under the 60 s a platform function
+ * may run, so a hung render is graded here as a timeout rather than waiting
+ * for the platform's 504, and well under the route's own `maxDuration`.
+ */ export const RENDER_MONITOR_TIMEOUT_MS = 25000;
+/** Failing runs in a row before the alert goes out. */ export const RENDER_MONITOR_DEFAULT_THRESHOLD = 2;
+/**
+ * The prefix of the never-requested path the `isr` probe asks for. A
+ * lowercase slug on purpose: it must reach the catch-all page like any
+ * screen slug would, not a reserved or rewritten route.
+ */ export const RENDER_PROBE_ISR_PREFIX = '/aglyn-render-probe-';
+export const RENDER_PROBES = [
+    {
+        kind: 'dynamic',
+        path: ()=>'/search',
+        expectStatus: 200
+    },
+    {
+        kind: 'isr',
+        path: (nonce)=>`${RENDER_PROBE_ISR_PREFIX}${nonce}`,
+        expectStatus: 404
+    }
+];
+/** Vercel's challenge interstitial, matched on the body like the front doors. */ const CHECKPOINT_MARKER = /Vercel Security Checkpoint/i;
+/**
+ * Cache states that mean the bytes came out of a store. A probe meant to
+ * prove a render cannot pass on one of these, whatever the status.
+ */ const CACHED_STATES = new Set([
+    'HIT',
+    'STALE',
+    'PRERENDER'
+]);
+/**
+ * Grade one probe response. Pure.
+ *
+ * The page markers are the front doors' (`tools/scripts/lib/front-door.mjs`)
+ * and for their reason: structural, never site copy. `</html>` proves the
+ * document finished streaming, `/_next/static/` that our build produced it.
+ */ export function gradeRenderProbe(response, expectStatus) {
+    var _response_body, _response_contentType, _response_cacheState;
+    const body = (_response_body = response.body) != null ? _response_body : '';
+    if (CHECKPOINT_MARKER.test(body)) {
+        return {
+            ok: false,
+            challenged: true,
+            code: 'challenged',
+            detail: `bot protection answered (HTTP ${response.status}) instead of the site; check AGLYN_PROBE_TOKEN on the console`
+        };
+    }
+    if (response.status >= 300 && response.status < 400) {
+        var _response_location;
+        return {
+            ok: false,
+            challenged: false,
+            code: 'redirected',
+            detail: `redirected to ${(_response_location = response.location) != null ? _response_location : '?'}, so no page was rendered`
+        };
+    }
+    if (response.status !== expectStatus) {
+        return {
+            ok: false,
+            challenged: false,
+            code: `http-${response.status}`,
+            detail: `HTTP ${response.status}`
+        };
+    }
+    if (!/text\/html/i.test((_response_contentType = response.contentType) != null ? _response_contentType : '')) {
+        return {
+            ok: false,
+            challenged: false,
+            code: 'not-html',
+            detail: `not HTML (${response.contentType || 'no content-type'})`
+        };
+    }
+    if (!body.includes('</html>')) {
+        return {
+            ok: false,
+            challenged: false,
+            code: 'incomplete',
+            detail: 'the document never finished (no </html>)'
+        };
+    }
+    if (!body.includes('/_next/static/')) {
+        return {
+            ok: false,
+            challenged: false,
+            code: 'not-our-render',
+            detail: 'no Next asset references, so the app did not render it'
+        };
+    }
+    const cache = String((_response_cacheState = response.cacheState) != null ? _response_cacheState : '').trim().toUpperCase();
+    if (CACHED_STATES.has(cache)) {
+        return {
+            ok: false,
+            challenged: false,
+            code: 'served-from-cache',
+            detail: `served from cache (${cache}), so it proves no render`
+        };
+    }
+    return {
+        ok: true,
+        challenged: false,
+        code: 'ok',
+        detail: 'rendered'
+    };
+}
+/**
+ * The pages Aglyn's own console renders fresh when `RENDER_MONITOR_PAGES` is
+ * unset: the canary's real client pages (`tools/scripts/lib/prod-canary.mjs`
+ * `DEFAULT_TENANT_HOSTS`), images, reusable components, repeats and a form
+ * between them. Applied ONLY on that console deployment (`VERCEL_PROJECT_ID`),
+ * so no other install ever requests them.
+ */ export const PLATFORM_RENDER_PAGES = [
+    'ready-to-roll.aglyn.app/',
+    'edr-construction.aglyn.app/',
+    'edr-construction.aglyn.app/services',
+    'edr-construction.aglyn.app/contact'
+].join(' ');
+/** Aglyn's console project on Vercel, the one deployment the list above is for. */ export const PLATFORM_CONSOLE_VERCEL_PROJECT_ID = 'prj_gEzxEXc0Lhs81rmaXIg2a1GbsDfl';
+/**
+ * The tenant's production project domain on Vercel: follows every promote and
+ * rollback, honors `?tenantHost=`, and is reachable only with the bypass.
+ */ export const PLATFORM_RENDER_ORIGIN = 'https://aglyn-tenant-aglyn.vercel.app';
+/** The middleware's custom-domain sentinel (`apps/tenant/utils/get-host.ts`). */ const CNAME_HOST_PREFIX = 'cname--';
+/** Letters past this are never recased, so the bit arithmetic stays in 32 bits. */ const MAX_SPELLING_BITS = 30;
+function spellingLetters(host) {
+    return [
+        ...host.toLowerCase()
+    ].map((char, index)=>/[a-z]/.test(char) ? index : -1).filter((index)=>index >= 0).slice(0, MAX_SPELLING_BITS);
+}
+/**
+ * Spelling number `n` of one site: a `?tenantHost=` value that resolves to
+ * that site and is a `[host]` route segment no other number produces, so the
+ * page it asks for has no cache entry to come from.
+ *
+ *  - `{sub}.{apex}` → the full name, letters upper-cased by the bits of `n`,
+ *    then one trailing dot per exhausted round of cases.
+ *  - any other name → `cname--{name}`, recased the same way and cycling after
+ *    `2 ** letters` (that form keeps trailing dots), with the prefix left
+ *    lower-case because the canonical-domain redirect tests the raw segment.
+ *
+ * MUST stay identical to `freshHostSpelling` in
+ * `tools/scripts/lib/prod-canary.mjs`; `apps/tenant/specs/probe-host-spelling.spec.ts`
+ * pins both against `normalizeHostAlias`.
+ */ export function freshHostSpelling(host, n, apex = TENANT_APEX) {
+    const subdomain = host.endsWith(`.${apex}`);
+    const prefix = subdomain ? '' : CNAME_HOST_PREFIX;
+    const chars = [
+        ...host.toLowerCase()
+    ];
+    const letters = spellingLetters(host);
+    const capacity = 2 ** letters.length;
+    const value = Math.max(0, Math.floor(Number(n) || 0));
+    const bits = value % capacity;
+    letters.forEach((index, bit)=>{
+        if (Math.floor(bits / 2 ** bit) % 2 === 1) chars[index] = chars[index].toUpperCase();
+    });
+    const dots = subdomain ? '.'.repeat(Math.floor(value / capacity)) : '';
+    return `${prefix}${chars.join('')}${dots}`;
+}
+/**
+ * The spelling number for a run at `nowMs`: minutes since 2026-10-01, so it
+ * never repeats on one deployment — a `{sub}.aglyn.app` name of 18 letters
+ * gains its first trailing dot after half a year.
+ */ export function renderSpellingNumber(nowMs) {
+    return Math.max(1, Math.floor((nowMs - Date.UTC(2026, 9, 1)) / 60000));
+}
+/**
+ * `"a.example.app b.example.app/services, https://b.example.app/contact"` →
+ * one entry per host, paths merged, `/` when an entry names none. Entries that
+ * are not a hostname are dropped, as `RENDER_MONITOR_ORIGINS` drops them.
+ */ export function parseRenderMonitorPages(text) {
+    const byHost = new Map();
+    for (const raw of String(text != null ? text : '').split(/[\s,]+/)){
+        var _byHost_get;
+        const entry = raw.trim().replace(/^https?:\/\//i, '');
+        if (!entry) continue;
+        const slash = entry.indexOf('/');
+        const host = (slash === -1 ? entry : entry.slice(0, slash)).toLowerCase();
+        if (!/^[a-z0-9-]+(\.[a-z0-9-]+)+$/.test(host)) continue;
+        const path = slash === -1 ? '/' : entry.slice(slash).replace(/\/+$/, '') || '/';
+        const paths = (_byHost_get = byHost.get(host)) != null ? _byHost_get : [];
+        if (!paths.includes(path)) paths.push(path);
+        byHost.set(host, paths);
+    }
+    return [
+        ...byHost
+    ].map(([host, paths])=>({
+            origin: `https://${host}`,
+            host,
+            paths
+        }));
+}
+/**
+ * Which real pages the monitor renders, and through which origin.
+ *
+ * `RENDER_MONITOR_PAGES` (same grammar as the canary's `CANARY_TENANT_HOSTS`)
+ * and `RENDER_MONITOR_RENDER_ORIGIN`, else — on Aglyn's own console only —
+ * `PLATFORM_RENDER_PAGES` through `PLATFORM_RENDER_ORIGIN`. `off` (here or in
+ * `RENDER_MONITOR_ORIGINS`) renders none. No render origin, no pages.
+ */ export function resolveRenderMonitorPages(env) {
+    var _env_RENDER_MONITOR_PAGES, _env_RENDER_MONITOR_ORIGINS;
+    const off = /^(off|none|false|0)$/i;
+    const raw = String((_env_RENDER_MONITOR_PAGES = env['RENDER_MONITOR_PAGES']) != null ? _env_RENDER_MONITOR_PAGES : '').trim();
+    if (off.test(raw) || off.test(String((_env_RENDER_MONITOR_ORIGINS = env['RENDER_MONITOR_ORIGINS']) != null ? _env_RENDER_MONITOR_ORIGINS : '').trim())) {
+        return {
+            renderOrigin: '',
+            pages: []
+        };
+    }
+    const platform = env['VERCEL_PROJECT_ID'] === PLATFORM_CONSOLE_VERCEL_PROJECT_ID;
+    const renderOrigin = originOf(env['RENDER_MONITOR_RENDER_ORIGIN']) || (platform ? PLATFORM_RENDER_ORIGIN : '');
+    const pages = parseRenderMonitorPages(raw || (platform ? PLATFORM_RENDER_PAGES : ''));
+    return renderOrigin ? {
+        renderOrigin,
+        pages
+    } : {
+        renderOrigin: '',
+        pages: []
+    };
+}
+/** A configured value as an origin, or '' when it is not one. */ export function originOf(value) {
+    const trimmed = String(value != null ? value : '').trim().replace(/\/+$/, '');
+    return /^https?:\/\/[^/\s?#]+$/i.test(trimmed) ? trimmed.toLowerCase() : '';
+}
+/**
+ * Which sites the monitor renders, from the console's environment.
+ *
+ * 1. The install's demonstration site: `OPERATOR_HEALTH_TENANT_ORIGIN` when
+ *    set (the one published site the operator alerts tick already watches),
+ *    else `https://<AGLYN_TENANT_DEMO or demo>.<tenant apex>`.
+ * 2. Plus every origin in `RENDER_MONITOR_ORIGINS`, comma separated.
+ *
+ * `RENDER_MONITOR_ORIGINS=off` watches nothing, for an install with no
+ * published site to watch. Values that are not origins are dropped.
+ */ export function resolveRenderMonitorTargets(env) {
+    var _env_RENDER_MONITOR_ORIGINS, _env_NEXT_PUBLIC_TENANT_DOMAIN, _env_AGLYN_TENANT_DEMO;
+    const raw = String((_env_RENDER_MONITOR_ORIGINS = env['RENDER_MONITOR_ORIGINS']) != null ? _env_RENDER_MONITOR_ORIGINS : '').trim();
+    if (/^(off|none|false|0)$/i.test(raw)) return [];
+    const apex = String((_env_NEXT_PUBLIC_TENANT_DOMAIN = env['NEXT_PUBLIC_TENANT_DOMAIN']) != null ? _env_NEXT_PUBLIC_TENANT_DOMAIN : '').trim() || TENANT_APEX;
+    const label = String((_env_AGLYN_TENANT_DEMO = env['AGLYN_TENANT_DEMO']) != null ? _env_AGLYN_TENANT_DEMO : '').trim() || 'demo';
+    const demo = originOf(env['OPERATOR_HEALTH_TENANT_ORIGIN']) || originOf(`https://${label}.${apex}`);
+    const listed = raw.split(/[\s,]+/).map((value)=>originOf(value)).filter(Boolean);
+    // A site whose pages are rendered is watched whole: its layout probes too.
+    const paged = resolveRenderMonitorPages(env).pages.map((page)=>page.origin);
+    return [
+        ...new Set([
+            demo,
+            ...listed,
+            ...paged
+        ].filter(Boolean))
+    ];
+}
+/** The state document id for one origin. */ export function renderMonitorCheckId(origin) {
+    return `${RENDER_MONITOR_CHECK_PREFIX}${new URL(origin).host}`;
+}
+/**
+ * The next state for one site, given what this run saw. Pure.
+ *
+ * The status turns `degraded` only once `threshold` runs in a row have
+ * failed, so one slow cold start or one dropped connection says nothing. It
+ * turns back on the first passing run, because a render that works is
+ * proof, and a recovery held back is a recovery nobody hears about.
+ */ export function nextRenderMonitorState(prior, observation, context) {
+    var _observation_detail, _ref, _ref1, _ref2, _ref3;
+    const { origin, label, threshold, now } = context;
+    const checkId = renderMonitorCheckId(origin);
+    const detail = String((_observation_detail = observation.detail) != null ? _observation_detail : '').slice(0, 1000);
+    const wasDegraded = (prior == null ? void 0 : prior.status) === 'degraded';
+    if (observation.ok) {
+        return {
+            next: {
+                checkId,
+                label,
+                origin,
+                status: 'ok',
+                sinceMs: !wasDegraded && (prior == null ? void 0 : prior.sinceMs) ? prior.sinceMs : now,
+                detail,
+                updatedAtMs: now,
+                consecutiveFailures: 0,
+                failingSinceMs: null,
+                lastOkAtMs: now
+            },
+            transition: wasDegraded ? 'recovered' : null
+        };
+    }
+    const failures = ((_ref = prior == null ? void 0 : prior.consecutiveFailures) != null ? _ref : 0) + 1;
+    const failingSinceMs = (_ref1 = prior == null ? void 0 : prior.failingSinceMs) != null ? _ref1 : now;
+    const degraded = wasDegraded || failures >= Math.max(1, threshold);
+    return {
+        next: {
+            checkId,
+            label,
+            origin,
+            status: degraded ? 'degraded' : 'ok',
+            sinceMs: degraded ? wasDegraded && (prior == null ? void 0 : prior.sinceMs) ? prior.sinceMs : failingSinceMs : (_ref2 = prior == null ? void 0 : prior.sinceMs) != null ? _ref2 : now,
+            detail,
+            updatedAtMs: now,
+            consecutiveFailures: failures,
+            failingSinceMs,
+            lastOkAtMs: (_ref3 = prior == null ? void 0 : prior.lastOkAtMs) != null ? _ref3 : null
+        },
+        transition: degraded && !wasDegraded ? 'failing' : null
+    };
+}
+/**
+ * The default store: one Firestore transaction on the site's document, so
+ * two overlapping runs cannot both decide they saw the edge.
+ */ const firestoreStore = async (checkId, work)=>{
+    const { default: firebaseAdmin } = await import("./firebase-admin.js");
+    const db = firebaseAdmin.app().firestore();
+    const ref = db.collection(RENDER_MONITOR_COLLECTION).doc(checkId);
+    return db.runTransaction(async (transaction)=>{
+        const snapshot = await transaction.get(ref);
+        const prior = snapshot.exists ? snapshot.data() : null;
+        const { next, result } = work(prior);
+        transaction.set(ref, next);
+        return result;
+    });
+};
+const defaultRaise = async (type, options)=>{
+    const { raiseOperatorAlert } = await import("./operator-alerts.js");
+    return raiseOperatorAlert(type, options);
+};
+function describeDuration(ms) {
+    const minutes = Math.max(1, Math.round(ms / 60000));
+    if (minutes < 60) return `${minutes} min`;
+    const hours = Math.floor(minutes / 60);
+    const rest = minutes % 60;
+    return rest ? `${hours} h ${rest} min` : `${hours} h`;
+}
+/**
+ * The `page` probe's URL for one run: this run's page of the site's list
+ * (rotating every five-minute slot), under this run's spelling of the site.
+ */ export function pageProbeUrl(renderOrigin, site, slot, spelling) {
+    var _site_paths_;
+    const path = (_site_paths_ = site.paths[Math.abs(slot) % site.paths.length]) != null ? _site_paths_ : '/';
+    const url = new URL(path, renderOrigin);
+    url.searchParams.set('tenantHost', freshHostSpelling(site.host, spelling));
+    return url.toString();
+}
+function probeLine(row) {
+    return `${row.kind} ${new URL(row.url).pathname}: ${row.detail} (${row.ms} ms)`;
+}
+/** Fetch and grade one probe. Never throws. */ async function runProbe(url, spec, options) {
+    const startedAt = options.clock();
+    try {
+        var _response_headers_get;
+        const response = await options.fetcher(url, {
+            redirect: 'manual',
+            cache: 'no-store',
+            headers: _extends({
+                'user-agent': 'aglyn-render-monitor',
+                accept: 'text/html,application/xhtml+xml'
+            }, options.headers),
+            signal: AbortSignal.timeout(options.timeoutMs)
+        });
+        const body = await response.text();
+        const verdict = gradeRenderProbe({
+            status: response.status,
+            contentType: response.headers.get('content-type'),
+            body,
+            location: response.headers.get('location'),
+            cacheState: (_response_headers_get = response.headers.get('x-vercel-cache')) != null ? _response_headers_get : response.headers.get('x-nextjs-cache')
+        }, spec.expectStatus);
+        return _extends({
+            kind: spec.kind,
+            url,
+            ms: options.clock() - startedAt,
+            httpStatus: response.status
+        }, verdict);
+    } catch (error) {
+        var _ref, _ref1;
+        var _error_cause;
+        const name = error == null ? void 0 : error.name;
+        const timedOut = name === 'TimeoutError' || name === 'AbortError';
+        return {
+            kind: spec.kind,
+            url,
+            ms: options.clock() - startedAt,
+            httpStatus: null,
+            ok: false,
+            challenged: false,
+            code: timedOut ? 'timeout' : 'unreachable',
+            detail: timedOut ? `no complete page in ${Math.round(options.timeoutMs / 1000)} s` : `unreachable (${(_ref = (_ref1 = error == null ? void 0 : (_error_cause = error.cause) == null ? void 0 : _error_cause.code) != null ? _ref1 : name) != null ? _ref : 'error'})`
+        };
+    }
+}
+/**
+ * One run: render every target, record each site's state, raise the edge.
+ *
+ * A dry run fetches and grades and writes nothing, so a person can ask
+ * "what would the monitor see right now" without moving its state.
+ */ export async function runRenderMonitor(options = {}) {
+    var _options_env, _options_now, _options_store, _options_raise, _env_RENDER_MONITOR_FAILURE_THRESHOLD, _options_nonce, _options_fetcher, _options_headers, _options_timeoutMs;
+    const env = (_options_env = options.env) != null ? _options_env : process.env;
+    const clock = (_options_now = options.now) != null ? _options_now : Date.now;
+    const store = (_options_store = options.store) != null ? _options_store : firestoreStore;
+    const raise = (_options_raise = options.raise) != null ? _options_raise : defaultRaise;
+    const dryRun = Boolean(options.dryRun);
+    const parsedThreshold = Number.parseInt(String((_env_RENDER_MONITOR_FAILURE_THRESHOLD = env['RENDER_MONITOR_FAILURE_THRESHOLD']) != null ? _env_RENDER_MONITOR_FAILURE_THRESHOLD : ''), 10);
+    const threshold = Number.isFinite(parsedThreshold) && parsedThreshold >= 1 ? parsedThreshold : RENDER_MONITOR_DEFAULT_THRESHOLD;
+    const nonce = (_options_nonce = options.nonce) != null ? _options_nonce : ()=>`${clock().toString(36)}${Math.random().toString(36).slice(2, 8)}`;
+    const probeOptions = {
+        fetcher: (_options_fetcher = options.fetcher) != null ? _options_fetcher : fetch,
+        headers: (_options_headers = options.headers) != null ? _options_headers : {},
+        timeoutMs: (_options_timeoutMs = options.timeoutMs) != null ? _options_timeoutMs : RENDER_MONITOR_TIMEOUT_MS,
+        clock
+    };
+    // Real pages need the render origin AND the bypass that gets past its
+    // Deployment Protection; without both a `page` probe could only fail.
+    const { renderOrigin, pages } = resolveRenderMonitorPages(env);
+    const canRenderPages = Boolean(renderOrigin && probeOptions.headers['x-vercel-protection-bypass']);
+    const runAt = clock();
+    const slot = Math.floor(runAt / 300000);
+    const sites = await Promise.all(resolveRenderMonitorTargets(env).map(async (origin)=>{
+        const layoutProbes = RENDER_PROBES.map((spec)=>runProbe(`${origin}${spec.path(nonce())}`, spec, probeOptions));
+        const site = canRenderPages ? pages.find((page)=>page.origin === origin) : undefined;
+        const pageProbe = site ? [
+            runProbe(pageProbeUrl(renderOrigin, site, slot, renderSpellingNumber(runAt)), {
+                kind: 'page',
+                expectStatus: 200
+            }, probeOptions)
+        ] : [];
+        const probes = await Promise.all([
+            ...layoutProbes,
+            ...pageProbe
+        ]);
+        const ok = probes.every((probe)=>probe.ok);
+        const result = {
+            origin,
+            ok,
+            probes
+        };
+        if (dryRun) return result;
+        const host = new URL(origin).host;
+        const failing = probes.filter((probe)=>!probe.ok);
+        const detail = ok ? 'Fresh renders pass.' : failing.map(probeLine).join('; ');
+        try {
+            const now = clock();
+            const { next, transition, failingSinceMs } = await store(renderMonitorCheckId(origin), (prior)=>{
+                var _ref, _ref1;
+                const decided = nextRenderMonitorState(prior, {
+                    ok,
+                    detail
+                }, {
+                    origin,
+                    label: `Page rendering on ${host}`,
+                    threshold,
+                    now
+                });
+                return {
+                    next: decided.next,
+                    result: _extends({}, decided, {
+                        // When the failures a recovery ends began.
+                        failingSinceMs: (_ref = (_ref1 = prior == null ? void 0 : prior.failingSinceMs) != null ? _ref1 : prior == null ? void 0 : prior.sinceMs) != null ? _ref : now
+                    })
+                };
+            });
+            result.status = next.status;
+            result.consecutiveFailures = next.consecutiveFailures;
+            result.transition = transition;
+            if (transition === 'failing') {
+                await raise('system.siteRenderFailing', {
+                    dedupeKey: host,
+                    context: {
+                        site: host,
+                        failures: next.consecutiveFailures,
+                        since: describeDuration(now - next.sinceMs),
+                        detail
+                    }
+                });
+            } else if (transition === 'recovered') {
+                await raise('system.siteRenderRecovered', {
+                    dedupeKey: host,
+                    context: {
+                        site: host,
+                        duration: describeDuration(now - failingSinceMs)
+                    }
+                });
+            }
+        } catch (error) {
+            result.error = error instanceof Error ? error.message : String(error);
+            console.error(`[render-monitor] ${host} could not be recorded`, error);
+        }
+        return result;
+    }));
+    return {
+        dryRun,
+        threshold,
+        sites
+    };
+}
+
+//# sourceMappingURL=render-monitor.js.map