@aglyn/tenant-data-admin 1.0.0-beta.223 → 1.0.0-beta.225

package/src/lib/server/render-monitor.js

@@ -46,13 +46,46 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
  *
  * A site that fails `threshold` runs in a row raises
  * `system.siteRenderFailing` once; the first passing run after that raises
- * `system.siteRenderRecovered` once. The state lives in
+ * `system.siteRenderRecovered` once.
+ *
+ * ## A challenge is not a failed render (AGL-3580)
+ *
+ * When bot protection answers instead of the site, this run saw nothing about
+ * the site at all. On 2026-10-05 the console had no `AGLYN_PROBE_TOKEN`, every
+ * `/search` probe got the 429 checkpoint for three hours, and the monitor told
+ * the operator "Pages are not rendering on aglyn.com" and then "rendering
+ * again after 3 h" about a site that was serving pages the whole time. So a
+ * run whose only failures are challenges is BLIND: it leaves the site's
+ * verdict and failure count exactly as they were, and `threshold` blind runs
+ * in a row raise `system.renderMonitorBlind` once, which names the setup
+ * problem instead of an outage. A run with a real failure beside a challenge
+ * is still a failure, because the real one is evidence. The state lives in
  * `operatorHealthState/render-monitor--<host>`, beside every other health
  * check, so Staff → Operator alerts lists it with its status and since when.
  *
- * Nothing here names an Aglyn host: the default target is the install's own
- * demonstration site label under its own tenant apex, the convention the
- * middleware and the render canaries already follow.
+ * Nothing here names an Aglyn host for anyone else: the default target is the
+ * install's own demonstration site label under its own tenant apex, the
+ * convention the middleware and the render canaries already follow. The one
+ * exception is `PLATFORM_RENDER_PAGES` below, which applies on Aglyn's own
+ * console deployment and nowhere else.
+ *
+ * ## Real pages, rendered fresh (AGL-3571)
+ *
+ * The two probes above draw the layout. They do not draw a page BODY, and
+ * beta.223 hung only on page bodies with an image in them (an ancestor walk
+ * looped on the page root, AGL-3565): `demo` has no images and the not-found
+ * page has no body, so this monitor read green through it. So a third probe,
+ * `page`, renders a real published page through the full ISR path — through
+ * the tenant's `*.vercel.app` production domain (`RENDER_MONITOR_RENDER_ORIGIN`),
+ * which honors `?tenantHost=` and sits behind Deployment Protection, naming
+ * the site with a spelling no cache holds (`freshHostSpelling`). The cache key
+ * includes the `[host]` segment, and `normalizeHostAlias` resolves every
+ * spelling to the same site. Without the automation bypass the render origin
+ * answers its sign-in redirect, so no `page` probe is made at all.
+ *
+ * One page per site per run, rotating through that site's list: a platform
+ * break fails every page with an image, so every run, and alerts as fast as
+ * before; a break on one page alone is seen on its turn.
  */ /** The state documents' collection: the health checks' own. */ const RENDER_MONITOR_COLLECTION = 'operatorHealthState';
 /** Every render monitor document id starts with this. */ export const RENDER_MONITOR_CHECK_PREFIX = 'render-monitor--';
 /** The beat id `/api/health/crons` reads for the scheduled run. */ export const RENDER_MONITOR_JOB_ID = 'render-monitor';
@@ -162,6 +195,121 @@ export const RENDER_PROBES = [
         detail: 'rendered'
     };
 }
+/**
+ * The pages Aglyn's own console renders fresh when `RENDER_MONITOR_PAGES` is
+ * unset: the canary's real client pages (`tools/scripts/lib/prod-canary.mjs`
+ * `DEFAULT_TENANT_HOSTS`), images, reusable components, repeats and a form
+ * between them. Applied ONLY on that console deployment (`VERCEL_PROJECT_ID`),
+ * so no other install ever requests them.
+ */ export const PLATFORM_RENDER_PAGES = [
+    'ready-to-roll.aglyn.app/',
+    'edr-construction.aglyn.app/',
+    'edr-construction.aglyn.app/services',
+    'edr-construction.aglyn.app/contact'
+].join(' ');
+/** Aglyn's console project on Vercel, the one deployment the list above is for. */ export const PLATFORM_CONSOLE_VERCEL_PROJECT_ID = 'prj_gEzxEXc0Lhs81rmaXIg2a1GbsDfl';
+/**
+ * The tenant's production project domain on Vercel: follows every promote and
+ * rollback, honors `?tenantHost=`, and is reachable only with the bypass.
+ */ export const PLATFORM_RENDER_ORIGIN = 'https://aglyn-tenant-aglyn.vercel.app';
+/** The middleware's custom-domain sentinel (`apps/tenant/utils/get-host.ts`). */ const CNAME_HOST_PREFIX = 'cname--';
+/** Letters past this are never recased, so the bit arithmetic stays in 32 bits. */ const MAX_SPELLING_BITS = 30;
+function spellingLetters(host) {
+    return [
+        ...host.toLowerCase()
+    ].map((char, index)=>/[a-z]/.test(char) ? index : -1).filter((index)=>index >= 0).slice(0, MAX_SPELLING_BITS);
+}
+/**
+ * Spelling number `n` of one site: a `?tenantHost=` value that resolves to
+ * that site and is a `[host]` route segment no other number produces, so the
+ * page it asks for has no cache entry to come from.
+ *
+ *  - `{sub}.{apex}` → the full name, letters upper-cased by the bits of `n`,
+ *    then one trailing dot per exhausted round of cases.
+ *  - any other name → `cname--{name}`, recased the same way and cycling after
+ *    `2 ** letters` (that form keeps trailing dots), with the prefix left
+ *    lower-case because the canonical-domain redirect tests the raw segment.
+ *
+ * MUST stay identical to `freshHostSpelling` in
+ * `tools/scripts/lib/prod-canary.mjs`; `apps/tenant/specs/probe-host-spelling.spec.ts`
+ * pins both against `normalizeHostAlias`.
+ */ export function freshHostSpelling(host, n, apex = TENANT_APEX) {
+    const subdomain = host.endsWith(`.${apex}`);
+    const prefix = subdomain ? '' : CNAME_HOST_PREFIX;
+    const chars = [
+        ...host.toLowerCase()
+    ];
+    const letters = spellingLetters(host);
+    const capacity = 2 ** letters.length;
+    const value = Math.max(0, Math.floor(Number(n) || 0));
+    const bits = value % capacity;
+    letters.forEach((index, bit)=>{
+        if (Math.floor(bits / 2 ** bit) % 2 === 1) chars[index] = chars[index].toUpperCase();
+    });
+    const dots = subdomain ? '.'.repeat(Math.floor(value / capacity)) : '';
+    return `${prefix}${chars.join('')}${dots}`;
+}
+/**
+ * The spelling number for a run at `nowMs`: minutes since 2026-10-01, so it
+ * never repeats on one deployment — a `{sub}.aglyn.app` name of 18 letters
+ * gains its first trailing dot after half a year.
+ */ export function renderSpellingNumber(nowMs) {
+    return Math.max(1, Math.floor((nowMs - Date.UTC(2026, 9, 1)) / 60000));
+}
+/**
+ * `"a.example.app b.example.app/services, https://b.example.app/contact"` →
+ * one entry per host, paths merged, `/` when an entry names none. Entries that
+ * are not a hostname are dropped, as `RENDER_MONITOR_ORIGINS` drops them.
+ */ export function parseRenderMonitorPages(text) {
+    const byHost = new Map();
+    for (const raw of String(text != null ? text : '').split(/[\s,]+/)){
+        var _byHost_get;
+        const entry = raw.trim().replace(/^https?:\/\//i, '');
+        if (!entry) continue;
+        const slash = entry.indexOf('/');
+        const host = (slash === -1 ? entry : entry.slice(0, slash)).toLowerCase();
+        if (!/^[a-z0-9-]+(\.[a-z0-9-]+)+$/.test(host)) continue;
+        const path = slash === -1 ? '/' : entry.slice(slash).replace(/\/+$/, '') || '/';
+        const paths = (_byHost_get = byHost.get(host)) != null ? _byHost_get : [];
+        if (!paths.includes(path)) paths.push(path);
+        byHost.set(host, paths);
+    }
+    return [
+        ...byHost
+    ].map(([host, paths])=>({
+            origin: `https://${host}`,
+            host,
+            paths
+        }));
+}
+/**
+ * Which real pages the monitor renders, and through which origin.
+ *
+ * `RENDER_MONITOR_PAGES` (same grammar as the canary's `CANARY_TENANT_HOSTS`)
+ * and `RENDER_MONITOR_RENDER_ORIGIN`, else — on Aglyn's own console only —
+ * `PLATFORM_RENDER_PAGES` through `PLATFORM_RENDER_ORIGIN`. `off` (here or in
+ * `RENDER_MONITOR_ORIGINS`) renders none. No render origin, no pages.
+ */ export function resolveRenderMonitorPages(env) {
+    var _env_RENDER_MONITOR_PAGES, _env_RENDER_MONITOR_ORIGINS;
+    const off = /^(off|none|false|0)$/i;
+    const raw = String((_env_RENDER_MONITOR_PAGES = env['RENDER_MONITOR_PAGES']) != null ? _env_RENDER_MONITOR_PAGES : '').trim();
+    if (off.test(raw) || off.test(String((_env_RENDER_MONITOR_ORIGINS = env['RENDER_MONITOR_ORIGINS']) != null ? _env_RENDER_MONITOR_ORIGINS : '').trim())) {
+        return {
+            renderOrigin: '',
+            pages: []
+        };
+    }
+    const platform = env['VERCEL_PROJECT_ID'] === PLATFORM_CONSOLE_VERCEL_PROJECT_ID;
+    const renderOrigin = originOf(env['RENDER_MONITOR_RENDER_ORIGIN']) || (platform ? PLATFORM_RENDER_ORIGIN : '');
+    const pages = parseRenderMonitorPages(raw || (platform ? PLATFORM_RENDER_PAGES : ''));
+    return renderOrigin ? {
+        renderOrigin,
+        pages
+    } : {
+        renderOrigin: '',
+        pages: []
+    };
+}
 /** A configured value as an origin, or '' when it is not one. */ export function originOf(value) {
     const trimmed = String(value != null ? value : '').trim().replace(/\/+$/, '');
     return /^https?:\/\/[^/\s?#]+$/i.test(trimmed) ? trimmed.toLowerCase() : '';
@@ -184,15 +332,21 @@ export const RENDER_PROBES = [
     const label = String((_env_AGLYN_TENANT_DEMO = env['AGLYN_TENANT_DEMO']) != null ? _env_AGLYN_TENANT_DEMO : '').trim() || 'demo';
     const demo = originOf(env['OPERATOR_HEALTH_TENANT_ORIGIN']) || originOf(`https://${label}.${apex}`);
     const listed = raw.split(/[\s,]+/).map((value)=>originOf(value)).filter(Boolean);
+    // A site whose pages are rendered is watched whole: its layout probes too.
+    const paged = resolveRenderMonitorPages(env).pages.map((page)=>page.origin);
     return [
         ...new Set([
             demo,
-            ...listed
+            ...listed,
+            ...paged
         ].filter(Boolean))
     ];
 }
 /** The state document id for one origin. */ export function renderMonitorCheckId(origin) {
-    return `${RENDER_MONITOR_CHECK_PREFIX}${new URL(origin).host}`;
+    return renderMonitorHostCheckId(new URL(origin).host);
+}
+/** The state document id for one host, as {@link renderMonitorCheckId} names it. */ export function renderMonitorHostCheckId(host) {
+    return `${RENDER_MONITOR_CHECK_PREFIX}${host}`;
 }
 /**
  * The next state for one site, given what this run saw. Pure.
@@ -201,15 +355,47 @@ export const RENDER_PROBES = [
  * failed, so one slow cold start or one dropped connection says nothing. It
  * turns back on the first passing run, because a render that works is
  * proof, and a recovery held back is a recovery nobody hears about.
+ *
+ * A BLIND observation (every failure was a bot-protection challenge) changes
+ * nothing about the site: its status, failure count and since-time carry over
+ * untouched, and only the blind count moves. It transitions to `blind` once,
+ * on the `threshold`-th blind run in a row.
  */ export function nextRenderMonitorState(prior, observation, context) {
     var _observation_detail, _ref, _ref1, _ref2, _ref3;
     const { origin, label, threshold, now } = context;
     const checkId = renderMonitorCheckId(origin);
     const detail = String((_observation_detail = observation.detail) != null ? _observation_detail : '').slice(0, 1000);
     const wasDegraded = (prior == null ? void 0 : prior.status) === 'degraded';
-    if (observation.ok) {
+    if (!observation.ok && observation.blind) {
+        var _ref4, _ref5, _ref6, _ref7, _ref8, _ref9, _ref10;
+        const blindRuns = ((_ref4 = prior == null ? void 0 : prior.consecutiveBlindRuns) != null ? _ref4 : 0) + 1;
         return {
             next: {
+                checkId,
+                label,
+                origin,
+                status: wasDegraded ? 'degraded' : 'ok',
+                sinceMs: (_ref5 = prior == null ? void 0 : prior.sinceMs) != null ? _ref5 : now,
+                detail: `The monitor cannot see this site: ${detail}`.slice(0, 1000),
+                updatedAtMs: now,
+                consecutiveFailures: (_ref6 = prior == null ? void 0 : prior.consecutiveFailures) != null ? _ref6 : 0,
+                failingSinceMs: (_ref7 = prior == null ? void 0 : prior.failingSinceMs) != null ? _ref7 : null,
+                lastOkAtMs: (_ref8 = prior == null ? void 0 : prior.lastOkAtMs) != null ? _ref8 : null,
+                consecutiveBlindRuns: blindRuns,
+                blindSinceMs: (_ref9 = prior == null ? void 0 : prior.blindSinceMs) != null ? _ref9 : now,
+                lastObservedAtMs: (_ref10 = prior == null ? void 0 : prior.lastObservedAtMs) != null ? _ref10 : null
+            },
+            transition: blindRuns === Math.max(1, threshold) ? 'blind' : null
+        };
+    }
+    const sighted = {
+        consecutiveBlindRuns: 0,
+        blindSinceMs: null,
+        lastObservedAtMs: now
+    };
+    if (observation.ok) {
+        return {
+            next: _extends({
                 checkId,
                 label,
                 origin,
@@ -220,7 +406,7 @@ export const RENDER_PROBES = [
                 consecutiveFailures: 0,
                 failingSinceMs: null,
                 lastOkAtMs: now
-            },
+            }, sighted),
             transition: wasDegraded ? 'recovered' : null
         };
     }
@@ -228,7 +414,7 @@ export const RENDER_PROBES = [
     const failingSinceMs = (_ref1 = prior == null ? void 0 : prior.failingSinceMs) != null ? _ref1 : now;
     const degraded = wasDegraded || failures >= Math.max(1, threshold);
     return {
-        next: {
+        next: _extends({
             checkId,
             label,
             origin,
@@ -239,7 +425,7 @@ export const RENDER_PROBES = [
             consecutiveFailures: failures,
             failingSinceMs,
             lastOkAtMs: (_ref3 = prior == null ? void 0 : prior.lastOkAtMs) != null ? _ref3 : null
-        },
+        }, sighted),
         transition: degraded && !wasDegraded ? 'failing' : null
     };
 }
@@ -269,11 +455,20 @@ function describeDuration(ms) {
     const rest = minutes % 60;
     return rest ? `${hours} h ${rest} min` : `${hours} h`;
 }
+/**
+ * The `page` probe's URL for one run: this run's page of the site's list
+ * (rotating every five-minute slot), under this run's spelling of the site.
+ */ export function pageProbeUrl(renderOrigin, site, slot, spelling) {
+    var _site_paths_;
+    const path = (_site_paths_ = site.paths[Math.abs(slot) % site.paths.length]) != null ? _site_paths_ : '/';
+    const url = new URL(path, renderOrigin);
+    url.searchParams.set('tenantHost', freshHostSpelling(site.host, spelling));
+    return url.toString();
+}
 function probeLine(row) {
     return `${row.kind} ${new URL(row.url).pathname}: ${row.detail} (${row.ms} ms)`;
 }
-/** Fetch and grade one probe. Never throws. */ async function runProbe(origin, spec, options) {
-    const url = `${origin}${spec.path(options.nonce)}`;
+/** Fetch and grade one probe. Never throws. */ async function runProbe(url, spec, options) {
     const startedAt = options.clock();
     try {
         var _response_headers_get;
@@ -323,7 +518,7 @@ function probeLine(row) {
  * A dry run fetches and grades and writes nothing, so a person can ask
  * "what would the monitor see right now" without moving its state.
  */ export async function runRenderMonitor(options = {}) {
-    var _options_env, _options_now, _options_store, _options_raise, _env_RENDER_MONITOR_FAILURE_THRESHOLD, _options_nonce;
+    var _options_env, _options_now, _options_store, _options_raise, _env_RENDER_MONITOR_FAILURE_THRESHOLD, _options_nonce, _options_fetcher, _options_headers, _options_timeoutMs;
     const env = (_options_env = options.env) != null ? _options_env : process.env;
     const clock = (_options_now = options.now) != null ? _options_now : Date.now;
     const store = (_options_store = options.store) != null ? _options_store : firestoreStore;
@@ -332,26 +527,42 @@ function probeLine(row) {
     const parsedThreshold = Number.parseInt(String((_env_RENDER_MONITOR_FAILURE_THRESHOLD = env['RENDER_MONITOR_FAILURE_THRESHOLD']) != null ? _env_RENDER_MONITOR_FAILURE_THRESHOLD : ''), 10);
     const threshold = Number.isFinite(parsedThreshold) && parsedThreshold >= 1 ? parsedThreshold : RENDER_MONITOR_DEFAULT_THRESHOLD;
     const nonce = (_options_nonce = options.nonce) != null ? _options_nonce : ()=>`${clock().toString(36)}${Math.random().toString(36).slice(2, 8)}`;
+    const probeOptions = {
+        fetcher: (_options_fetcher = options.fetcher) != null ? _options_fetcher : fetch,
+        headers: (_options_headers = options.headers) != null ? _options_headers : {},
+        timeoutMs: (_options_timeoutMs = options.timeoutMs) != null ? _options_timeoutMs : RENDER_MONITOR_TIMEOUT_MS,
+        clock
+    };
+    // Real pages need the render origin AND the bypass that gets past its
+    // Deployment Protection; without both a `page` probe could only fail.
+    const { renderOrigin, pages } = resolveRenderMonitorPages(env);
+    const canRenderPages = Boolean(renderOrigin && probeOptions.headers['x-vercel-protection-bypass']);
+    const runAt = clock();
+    const slot = Math.floor(runAt / 300000);
     const sites = await Promise.all(resolveRenderMonitorTargets(env).map(async (origin)=>{
-        const probes = await Promise.all(RENDER_PROBES.map((spec)=>{
-            var _options_fetcher, _options_headers, _options_timeoutMs;
-            return runProbe(origin, spec, {
-                fetcher: (_options_fetcher = options.fetcher) != null ? _options_fetcher : fetch,
-                headers: (_options_headers = options.headers) != null ? _options_headers : {},
-                nonce: nonce(),
-                timeoutMs: (_options_timeoutMs = options.timeoutMs) != null ? _options_timeoutMs : RENDER_MONITOR_TIMEOUT_MS,
-                clock
-            });
-        }));
+        const layoutProbes = RENDER_PROBES.map((spec)=>runProbe(`${origin}${spec.path(nonce())}`, spec, probeOptions));
+        const site = canRenderPages ? pages.find((page)=>page.origin === origin) : undefined;
+        const pageProbe = site ? [
+            runProbe(pageProbeUrl(renderOrigin, site, slot, renderSpellingNumber(runAt)), {
+                kind: 'page',
+                expectStatus: 200
+            }, probeOptions)
+        ] : [];
+        const probes = await Promise.all([
+            ...layoutProbes,
+            ...pageProbe
+        ]);
         const ok = probes.every((probe)=>probe.ok);
-        const site = {
+        const failing = probes.filter((probe)=>!probe.ok);
+        const blind = !ok && failing.every((probe)=>probe.challenged);
+        const result = {
             origin,
             ok,
+            blind,
             probes
         };
-        if (dryRun) return site;
+        if (dryRun) return result;
         const host = new URL(origin).host;
-        const failing = probes.filter((probe)=>!probe.ok);
         const detail = ok ? 'Fresh renders pass.' : failing.map(probeLine).join('; ');
         try {
             const now = clock();
@@ -359,7 +570,8 @@ function probeLine(row) {
                 var _ref, _ref1;
                 const decided = nextRenderMonitorState(prior, {
                     ok,
-                    detail
+                    detail,
+                    blind
                 }, {
                     origin,
                     label: `Page rendering on ${host}`,
@@ -374,9 +586,9 @@ function probeLine(row) {
                     })
                 };
             });
-            site.status = next.status;
-            site.consecutiveFailures = next.consecutiveFailures;
-            site.transition = transition;
+            result.status = next.status;
+            result.consecutiveFailures = next.consecutiveFailures;
+            result.transition = transition;
             if (transition === 'failing') {
                 await raise('system.siteRenderFailing', {
                     dedupeKey: host,
@@ -387,6 +599,16 @@ function probeLine(row) {
                         detail
                     }
                 });
+            } else if (transition === 'blind') {
+                var _next_consecutiveBlindRuns;
+                await raise('system.renderMonitorBlind', {
+                    dedupeKey: host,
+                    context: {
+                        site: host,
+                        runs: (_next_consecutiveBlindRuns = next.consecutiveBlindRuns) != null ? _next_consecutiveBlindRuns : threshold,
+                        detail
+                    }
+                });
             } else if (transition === 'recovered') {
                 await raise('system.siteRenderRecovered', {
                     dedupeKey: host,
@@ -397,10 +619,10 @@ function probeLine(row) {
                 });
             }
         } catch (error) {
-            site.error = error instanceof Error ? error.message : String(error);
+            result.error = error instanceof Error ? error.message : String(error);
             console.error(`[render-monitor] ${host} could not be recorded`, error);
         }
-        return site;
+        return result;
     }));
     return {
         dryRun,
@@ -408,5 +630,141 @@ function probeLine(row) {
         sites
     };
 }
+/**
+ * A verdict older than this says the monitor stopped, not that the site did.
+ * Four missed five-minute runs.
+ */ export const RENDER_PAGES_STALE_MS = 20 * 60000;
+/** How many sites one `?site=` may ask about. */ export const RENDER_PAGES_MAX_SITES = 10;
+/**
+ * Which watched hosts a `?site=` asks about. Pure.
+ *
+ * Absent or empty asks about every watched site. A host that is not watched
+ * is kept, so the caller can answer it red: a public monitor pointed at a
+ * site nobody renders is a monitor that can never go red, which is the
+ * mistake this door exists to undo.
+ */ export function requestedRenderPagesHosts(query, watchedOrigins) {
+    const asked = String(query != null ? query : '').split(/[\s,]+/).map((entry)=>entry.trim().toLowerCase().replace(/^https?:\/\//, '').replace(/\/.*$/, '')).filter((entry)=>/^[a-z0-9-]+(\.[a-z0-9-]+)+$/.test(entry));
+    const hosts = asked.length ? asked : watchedOrigins.map((origin)=>new URL(origin).host);
+    return [
+        ...new Set(hosts)
+    ].slice(0, RENDER_PAGES_MAX_SITES);
+}
+/**
+ * The public verdict on real pages, per site, from the render monitor's
+ * stored state (AGL-3580). Pure.
+ *
+ * This is what the status page's `Published sites` and `Marketing site`
+ * monitors read. Before it they read `/api/health/render/*`, which builds a
+ * node tree inside a route handler and never draws a page, and both stayed at
+ * 100% through two outages on 2026-10-05 in which every fresh page hung.
+ *
+ * Red is reserved for the one thing a visitor would notice:
+ *
+ *  - `not-rendering` — the monitor saw the site fail to render pages it could
+ *    not have served from a cache, `threshold` runs in a row.
+ *  - `not-watched` — the monitor renders nothing for this host, so this row
+ *    could never go red; fix the monitor's config or the URL.
+ *  - `state-unavailable` — the verdicts could not be read at all.
+ *
+ * Green with a code is a verdict this door cannot improve on, and is never
+ * reported as an outage, because it is not one:
+ *
+ *  - `awaiting-first-run` — a site added since the monitor last ran.
+ *  - `monitor-blind` — bot protection answered the monitor; the site's last
+ *    real verdict stands, and the operator alert says what to fix.
+ *  - `observation-stale` — no run in {@link RENDER_PAGES_STALE_MS}; the
+ *    monitor's own `render-monitor` row on `/api/health/crons` is what goes
+ *    red for that, so a stopped scheduler is never told as a site outage.
+ */ export function renderPagesHealth(hosts, watchedOrigins, states, ms, now = Date.now()) {
+    const watched = new Set(watchedOrigins.map((origin)=>new URL(origin).host));
+    const iso = (value)=>typeof value === 'number' && Number.isFinite(value) ? new Date(value).toISOString() : null;
+    const checks = {};
+    if (!hosts.length) {
+        checks['sites'] = {
+            ok: false,
+            ms,
+            code: 'no-sites-watched',
+            lastObservedAt: null,
+            since: null
+        };
+        return checks;
+    }
+    for (const host of hosts){
+        var _ref, _state_lastObservedAtMs, _state_consecutiveBlindRuns, _state_updatedAtMs;
+        const blank = {
+            ms,
+            lastObservedAt: null,
+            since: null
+        };
+        if (!watched.has(host)) {
+            checks[host] = _extends({}, blank, {
+                ok: false,
+                code: 'not-watched'
+            });
+            continue;
+        }
+        if (states === null) {
+            checks[host] = _extends({}, blank, {
+                ok: false,
+                code: 'state-unavailable'
+            });
+            continue;
+        }
+        const state = states.get(renderMonitorHostCheckId(host));
+        if (!state) {
+            checks[host] = _extends({}, blank, {
+                ok: true,
+                code: 'awaiting-first-run'
+            });
+            continue;
+        }
+        const observed = (_ref = (_state_lastObservedAtMs = state.lastObservedAtMs) != null ? _state_lastObservedAtMs : state.lastOkAtMs) != null ? _ref : null;
+        const row = {
+            ms,
+            lastObservedAt: iso(observed),
+            since: iso(state.sinceMs)
+        };
+        if (state.status === 'degraded') {
+            checks[host] = _extends({}, row, {
+                ok: false,
+                code: 'not-rendering'
+            });
+        } else if (((_state_consecutiveBlindRuns = state.consecutiveBlindRuns) != null ? _state_consecutiveBlindRuns : 0) > 0) {
+            checks[host] = _extends({}, row, {
+                ok: true,
+                code: 'monitor-blind'
+            });
+        } else if (now - ((_state_updatedAtMs = state.updatedAtMs) != null ? _state_updatedAtMs : 0) > RENDER_PAGES_STALE_MS) {
+            checks[host] = _extends({}, row, {
+                ok: true,
+                code: 'observation-stale'
+            });
+        } else {
+            checks[host] = _extends({}, row, {
+                ok: true
+            });
+        }
+    }
+    return checks;
+}
+/**
+ * Read the stored verdicts for `hosts`, one batched read. Null when the read
+ * fails, which {@link renderPagesHealth} reports red rather than calm.
+ */ export async function readRenderMonitorStates(hosts) {
+    try {
+        const { default: firebaseAdmin } = await import("./firebase-admin.js");
+        const db = firebaseAdmin.app().firestore();
+        const refs = hosts.map((host)=>db.collection(RENDER_MONITOR_COLLECTION).doc(renderMonitorHostCheckId(host)));
+        const snapshots = refs.length ? await db.getAll(...refs) : [];
+        const states = new Map();
+        for (const snapshot of snapshots){
+            if (snapshot.exists) states.set(snapshot.id, snapshot.data());
+        }
+        return states;
+    } catch (error) {
+        console.error('[render-monitor] stored verdicts could not be read', error);
+        return null;
+    }
+}
 
 //# sourceMappingURL=render-monitor.js.map