@reddoorla/maintenance 0.31.0 → 0.33.0

package/dist/cli/bin.js

@@ -57,6 +57,79 @@ var init_credentials = __esm({
   }
 });
 
+// src/audits/util/spawn.ts
+import { spawn } from "child_process";
+function makeSpawn(internals = {}) {
+  const spawnImpl = internals.spawnImpl ?? spawn;
+  const killImpl = internals.killImpl ?? ((pid, sig) => process.kill(pid, sig));
+  const killGraceMs = internals.killGraceMs ?? 5e3;
+  const maxOutputBytes = internals.maxOutputBytes ?? 10 * 1024 * 1024;
+  return (cmd, args, opts = {}) => new Promise((resolve12, reject) => {
+    const streaming = opts.streaming === true;
+    const child = spawnImpl(cmd, [...args], {
+      cwd: opts.cwd,
+      env: opts.env ?? process.env,
+      stdio: streaming ? ["ignore", "inherit", "inherit"] : ["ignore", "pipe", "pipe"],
+      // Detach ONLY when a timeout can fire: the child then leads its own
+      // process group, so the timeout can kill the WHOLE tree (vite, and
+      // Chromium under lhci/playwright) via process.kill(-pid), not just the
+      // npx/pnpm wrapper. Without it, killing the wrapper orphaned the
+      // grandchildren — a zombie vite squatting its port, Chrome left running.
+      // We do NOT detach timeout-less streaming calls (pnpm install/up):
+      // detaching gains nothing there (no timeout → no group-kill) and would
+      // break terminal Ctrl-C, which only reaches the foreground group — i.e.
+      // it would re-orphan the very children this guards. We never unref() the
+      // child since we still await it.
+      detached: opts.timeoutMs !== void 0
+    });
+    const cap = (acc, chunk) => {
+      if (acc.length >= maxOutputBytes) return acc;
+      const next = acc + chunk;
+      return next.length > maxOutputBytes ? next.slice(0, maxOutputBytes) + TRUNCATION_MARKER : next;
+    };
+    let stdout = "";
+    let stderr = "";
+    if (!streaming) {
+      child.stdout?.on("data", (chunk) => stdout = cap(stdout, String(chunk)));
+      child.stderr?.on("data", (chunk) => stderr = cap(stderr, String(chunk)));
+    }
+    const killGroup = (sig) => {
+      if (child.pid === void 0) return;
+      try {
+        killImpl(-child.pid, sig);
+      } catch {
+      }
+    };
+    let killTimer;
+    const timer = opts.timeoutMs ? setTimeout(() => {
+      killGroup("SIGTERM");
+      killTimer = setTimeout(() => killGroup("SIGKILL"), killGraceMs);
+      killTimer.unref();
+      reject(new Error(`spawn timeout after ${opts.timeoutMs}ms: ${cmd}`));
+    }, opts.timeoutMs) : void 0;
+    const clearTimers = () => {
+      if (timer) clearTimeout(timer);
+      if (killTimer) clearTimeout(killTimer);
+    };
+    child.on("error", (err) => {
+      clearTimers();
+      reject(err);
+    });
+    child.on("close", (code) => {
+      clearTimers();
+      resolve12({ code: code ?? -1, stdout, stderr });
+    });
+  });
+}
+var TRUNCATION_MARKER, defaultSpawn;
+var init_spawn = __esm({
+  "src/audits/util/spawn.ts"() {
+    "use strict";
+    TRUNCATION_MARKER = "\n\u2026[output truncated]";
+    defaultSpawn = makeSpawn();
+  }
+});
+
 // src/reports/airtable/client.ts
 var client_exports = {};
 __export(client_exports, {
@@ -99,12 +172,19 @@ __export(websites_exports, {
   siteSlug: () => siteSlug,
   updateA11yCounts: () => updateA11yCounts,
   updateDepsCounts: () => updateDepsCounts,
+  updateGitHubSignals: () => updateGitHubSignals,
+  updateLaunched: () => updateLaunched,
   updateScores: () => updateScores,
   updateSecurityCounts: () => updateSecurityCounts
 });
 function siteSlug(name) {
   return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
 }
+function trimToNull(raw) {
+  if (typeof raw !== "string") return null;
+  const trimmed = raw.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
 function mapRow(rec) {
   const f = rec.fields;
   const attachments = f["Header image"] ?? [];
@@ -144,7 +224,15 @@ function mapRow(rec) {
       if (typeof raw !== "string") return null;
       const trimmed = raw.trim();
       return trimmed.length > 0 ? trimmed : null;
-    })()
+    })(),
+    copyIntro: trimToNull(f["Copy \u2014 Intro"]),
+    copyContact: trimToNull(f["Copy \u2014 Contact"]),
+    copyFooter: trimToNull(f["Copy \u2014 Footer"]),
+    launchedAt: f["Launched at"] ?? null,
+    renovateFailingCis: f["Renovate Failing CIs"] ?? null,
+    defaultBranchCi: f["Default Branch CI"] ?? null,
+    lastCommitAt: f["Last Commit At"] ?? null,
+    githubSignalsAt: f["GitHub Signals At"] ?? null
   };
 }
 async function listWebsites(base) {
@@ -202,6 +290,21 @@ async function updateSecurityCounts(base, recordId, counts) {
   };
   await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);
 }
+async function updateGitHubSignals(base, recordId, signals) {
+  const fields = {
+    "Renovate Failing CIs": signals.renovateFailingCis,
+    "Default Branch CI": signals.ciState,
+    "GitHub Signals At": signals.sweptAt
+  };
+  if (signals.lastCommitAt !== null) {
+    fields["Last Commit At"] = signals.lastCommitAt;
+  }
+  await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);
+}
+async function updateLaunched(base, recordId, at) {
+  const fields = { Status: "maintenance", "Launched at": at };
+  await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);
+}
 var WEBSITES_TABLE;
 var init_websites = __esm({
   "src/reports/airtable/websites.ts"() {
@@ -463,6 +566,186 @@ var init_write_audits_to_airtable = __esm({
   }
 });
 
+// src/github/gh.ts
+function mapRollupState(state) {
+  switch (state) {
+    case "SUCCESS":
+      return "passing";
+    case "FAILURE":
+    case "ERROR":
+      return "failing";
+    case "PENDING":
+    case "EXPECTED":
+      return "pending";
+    default:
+      return "none";
+  }
+}
+function makeGitHub(deps) {
+  const spawn2 = deps.spawn ?? defaultSpawn;
+  const env = { ...process.env, GH_TOKEN: deps.token };
+  async function gh(args) {
+    const r = await spawn2("gh", args, { env, timeoutMs: 6e4 });
+    if (r.code !== 0) throw new Error(`gh ${args[0]} failed (code ${r.code}): ${r.stderr.trim()}`);
+    return r.stdout;
+  }
+  return {
+    async openPullRequest(repo, pr) {
+      const out = await gh([
+        "pr",
+        "create",
+        "--repo",
+        repo,
+        "--head",
+        pr.head,
+        "--base",
+        pr.base,
+        "--title",
+        pr.title,
+        "--body",
+        pr.body
+      ]);
+      return { url: out.trim() };
+    },
+    async enableRepoAutoMerge(repo) {
+      await gh(["api", "-X", "PATCH", `repos/${repo}`, "-F", "allow_auto_merge=true"]);
+    },
+    async protectBranch(repo, branch, requiredChecks) {
+      const args = [
+        "api",
+        "-X",
+        "PUT",
+        `repos/${repo}/branches/${branch}/protection`,
+        "-H",
+        "Accept: application/vnd.github+json",
+        "-F",
+        "required_status_checks[strict]=true",
+        ...requiredChecks.flatMap((c) => ["-f", `required_status_checks[contexts][]=${c}`]),
+        "-F",
+        "enforce_admins=true",
+        "-F",
+        "required_pull_request_reviews=null",
+        "-F",
+        "restrictions=null"
+      ];
+      await gh(args);
+    },
+    async setRepoSecret(repo, name, value) {
+      await gh(["secret", "set", name, "--repo", repo, "--body", value]);
+    },
+    async repoExists(repo) {
+      const r = await spawn2("gh", ["api", `repos/${repo}`], { env, timeoutMs: 6e4 });
+      return r.code === 0;
+    },
+    async defaultBranch(repo) {
+      const out = await gh(["api", `repos/${repo}`, "--jq", ".default_branch"]);
+      return out.trim();
+    },
+    // filesOnBranch and branchProtectionContexts call `spawn` directly (not the
+    // throwing `gh()` helper) because a 404 is an expected, meaningful answer —
+    // "file/protection absent" — not an error. The remaining readers use `gh()`
+    // since a non-200 there is a genuine failure (e.g. missing token scope).
+    async filesOnBranch(repo, branch, paths) {
+      const present = [];
+      for (const p of paths) {
+        const r = await spawn2("gh", [`api`, `repos/${repo}/contents/${p}?ref=${branch}`], {
+          env,
+          timeoutMs: 6e4
+        });
+        if (r.code === 0) present.push(p);
+      }
+      return present;
+    },
+    async branchProtectionContexts(repo, branch) {
+      const r = await spawn2(
+        "gh",
+        [
+          "api",
+          `repos/${repo}/branches/${branch}/protection`,
+          "--jq",
+          ".required_status_checks.contexts[]?"
+        ],
+        { env, timeoutMs: 6e4 }
+      );
+      if (r.code !== 0) return [];
+      return r.stdout.split("\n").map((l) => l.trim()).filter((l) => l.length > 0);
+    },
+    async secretExists(repo, name) {
+      const out = await gh(["api", `repos/${repo}/actions/secrets`, "--jq", ".secrets[].name"]);
+      return out.split("\n").map((l) => l.trim()).includes(name);
+    },
+    async autoMergeEnabled(repo) {
+      const out = await gh(["api", `repos/${repo}`, "--jq", ".allow_auto_merge"]);
+      return out.trim() === "true";
+    },
+    async findOpenSelfUpdatingPR(repo) {
+      const out = await gh([
+        "api",
+        `repos/${repo}/pulls?state=open`,
+        "--jq",
+        '.[] | select(.head.ref | startswith("maint/self-updating-")) | .html_url'
+      ]);
+      const first = out.split("\n").map((l) => l.trim()).find((l) => l.length > 0);
+      return first ?? null;
+    },
+    async openPullRequests(repo) {
+      const [owner, name, ...rest] = repo.split("/");
+      if (!owner || !name || rest.length > 0) {
+        throw new Error(`openPullRequests: expected "owner/repo", got "${repo}"`);
+      }
+      const query = "query($owner:String!,$name:String!){repository(owner:$owner,name:$name){pullRequests(states:OPEN,first:100,orderBy:{field:CREATED_AT,direction:DESC}){nodes{number title url headRefName commits(last:1){nodes{commit{statusCheckRollup{state}}}}}}}}";
+      const out = await gh([
+        "api",
+        "graphql",
+        "-f",
+        `query=${query}`,
+        "-F",
+        `owner=${owner}`,
+        "-F",
+        `name=${name}`
+      ]);
+      const parsed = JSON.parse(out);
+      const nodes = parsed.data?.repository?.pullRequests?.nodes ?? [];
+      return nodes.map((n) => ({
+        number: n.number,
+        title: n.title,
+        url: n.url,
+        headRef: n.headRefName,
+        ciState: mapRollupState(n.commits?.nodes?.[0]?.commit?.statusCheckRollup?.state)
+      }));
+    },
+    async defaultBranchStatus(repo) {
+      const [owner, name, ...rest] = repo.split("/");
+      if (!owner || !name || rest.length > 0) {
+        throw new Error(`defaultBranchStatus: expected "owner/repo", got "${repo}"`);
+      }
+      const query = "query($owner:String!,$name:String!){repository(owner:$owner,name:$name){defaultBranchRef{target{... on Commit{committedDate statusCheckRollup{state}}}}}}";
+      const out = await gh([
+        "api",
+        "graphql",
+        "-f",
+        `query=${query}`,
+        "-F",
+        `owner=${owner}`,
+        "-F",
+        `name=${name}`
+      ]);
+      const parsed = JSON.parse(out);
+      const target = parsed.data?.repository?.defaultBranchRef?.target;
+      return {
+        ciState: mapRollupState(target?.statusCheckRollup?.state),
+        lastCommitAt: target?.committedDate ?? null
+      };
+    }
+  };
+}
+var init_gh = __esm({
+  "src/github/gh.ts"() {
+    "use strict";
+    init_spawn();
+  }
+});
+
 // src/reports/airtable/reports.ts
 function mapRow2(rec) {
   const f = rec.fields;
@@ -473,6 +756,7 @@ function mapRow2(rec) {
     reportId: String(f["Report ID"] ?? ""),
     siteId: linkSites[0] ?? "",
     reportType: f["Report type"] ?? "Maintenance",
+    period: f["Period"] ?? null,
     periodStart: f["Period start"] ?? null,
     periodEnd: f["Period end"] ?? null,
     completedOn: f["Completed on"] ?? null,
@@ -487,6 +771,8 @@ function mapRow2(rec) {
     draftReady: Boolean(f["Draft ready"]),
     approvedToSend: Boolean(f["Approved to send"]),
     sentAt: f["Sent at"] ?? null,
+    approvedAt: f["Approved At"] ?? null,
+    approvedBy: f["Approved By"] ?? null,
     deliveryStatus: f["Delivery status"] ?? "pending",
     renderedHtmlAttachment: html,
     resendMessageId: f["Resend message ID"] ?? null
@@ -526,6 +812,7 @@ async function createDraft(base, input) {
   if (input.gaUsersPrevious !== void 0) fields["GA users (prev period)"] = input.gaUsersPrevious;
   if (input.searchFoundPage1 !== void 0) fields["Search found page 1"] = input.searchFoundPage1;
   if (input.searchPosition !== void 0) fields["Search position"] = input.searchPosition;
+  if (input.period !== void 0) fields["Period"] = input.period;
   const created = await base(REPORTS_TABLE).create([{ fields }]);
   const rec = created[0];
   if (!rec) throw new Error("Airtable create returned no records");
@@ -545,18 +832,17 @@ async function listSendableReports(base) {
   });
   return out;
 }
-async function listReportsForSite(base, siteId) {
-  const safeId = escapeFormulaString(siteId);
+async function listAllReports(base) {
   const out = [];
-  await base(REPORTS_TABLE).select({
-    filterByFormula: `FIND(",${safeId},", "," & ARRAYJOIN({Site}, ",") & ",") > 0`,
-    pageSize: 100
-  }).eachPage((records, fetchNextPage) => {
+  await base(REPORTS_TABLE).select({ pageSize: 100 }).eachPage((records, fetchNextPage) => {
     for (const rec of records) out.push(mapRow2({ id: rec.id, fields: rec.fields }));
     fetchNextPage();
   });
   return out;
 }
+async function listReportsForSite(base, siteId) {
+  return (await listAllReports(base)).filter((r) => r.siteId === siteId);
+}
 async function stampSent(base, recordId, sentAt, messageId) {
   await base(REPORTS_TABLE).update([
     {
@@ -568,6 +854,17 @@ async function stampSent(base, recordId, sentAt, messageId) {
     }
   ]);
 }
+async function findReportByPeriod(base, siteId, reportType, period) {
+  const safeType = escapeFormulaString(reportType);
+  const safePeriod = escapeFormulaString(period);
+  const formula = `AND({Report type} = "${safeType}", {Period} = "${safePeriod}")`;
+  const rows = [];
+  await base(REPORTS_TABLE).select({ filterByFormula: formula, pageSize: 100 }).eachPage((records, fetchNextPage) => {
+    for (const rec of records) rows.push(mapRow2({ id: rec.id, fields: rec.fields }));
+    fetchNextPage();
+  });
+  return rows.find((r) => r.siteId === siteId) ?? null;
+}
 var REPORTS_TABLE;
 var init_reports = __esm({
   "src/reports/airtable/reports.ts"() {
@@ -576,6 +873,67 @@ var init_reports = __esm({
   }
 });
 
+// src/reports/copy.ts
+function override(v) {
+  if (typeof v !== "string") return null;
+  const t = v.trim();
+  return t.length > 0 ? t : null;
+}
+function splitLines(s) {
+  return s.split(/\r?\n/).filter((l) => l.trim().length > 0);
+}
+function resolveCopy(site) {
+  const intro = override(site.copyIntro);
+  const contact = override(site.copyContact);
+  const footer = override(site.copyFooter);
+  const footerLines = footer ? splitLines(footer) : null;
+  return {
+    ...DEFAULT_COPY,
+    maintenanceIntro: intro ?? DEFAULT_COPY.maintenanceIntro,
+    contact: contact ? splitLines(contact) : DEFAULT_COPY.contact,
+    footerOrg: footerLines?.[0] ?? DEFAULT_COPY.footerOrg,
+    footerAddress: footerLines ? footerLines.slice(1) : DEFAULT_COPY.footerAddress
+  };
+}
+var DEFAULT_COPY;
+var init_copy = __esm({
+  "src/reports/copy.ts"() {
+    "use strict";
+    DEFAULT_COPY = {
+      maintenanceIntro: "Includes checking the hosting, DNS, Content Management System (CMS, if applicable), search indexing and security of the site for major flaws and updating as necessary.",
+      maintenanceChecks: [
+        "Reviewed Logs",
+        "CMS Checked",
+        "DNS Checked",
+        "Google Indexed",
+        "Reviewed Certificate",
+        "Security Updates"
+      ],
+      testingIntro: "Testing includes checks similar to those at launch: testing on common browsers and operating systems, at different screen sizes, and checking every function, and updating all packages for performance rather than just those needed for security.",
+      testingChecklist: [
+        "Desktop Browsers",
+        "Mobile Browsers",
+        "Package Updates",
+        "Bottlenecks",
+        "Form Functionality",
+        "Animation Functionality"
+      ],
+      notesHeader: "NOTES",
+      seoCta: "Contact us if you are interested in more in-depth data or have questions about SEO.",
+      contact: ["Just hit reply.", "We're here to help in any way we can."],
+      footerOrg: "Reddoor Creative, LLC",
+      footerAddress: ["29027 Dapper Dan", "Fair Oaks Ranch, TX 78015"],
+      launchHeading: "LAUNCHED",
+      launchBody: "Your site is live. We've set it up on the Reddoor stack with hosting, security, and automatic maintenance so it stays fast and healthy. Here's what's in place:",
+      launchSetupItems: [
+        "Hosting, DNS, and SSL configured",
+        "Continuous integration + automatic dependency updates",
+        "Analytics and uptime monitoring"
+      ]
+    };
+  }
+});
+
 // src/reports/maintenance-email/assets/index.ts
 import { readFile as readFile13 } from "fs/promises";
 import { existsSync as existsSync3 } from "fs";
@@ -665,16 +1023,9 @@ function analyticsTrendLine(cur, prev) {
   if (pct < 0) return trendText(TREND_NEUTRAL, `\u25BC ${Math.abs(pct)}% vs last period ${range}`);
   return trendText(TREND_NEUTRAL, `No change vs last period (${fmtUsers(prev)})`);
 }
-function maintenanceChecksSection(searchPosition) {
-  const googleLabel = searchPosition !== void 0 ? `Page 1 Google Result (#${searchPosition})` : "Google Indexed";
-  const rows = [
-    "Reviewed Logs",
-    "CMS Checked",
-    "DNS Checked",
-    googleLabel,
-    "Reviewed Certificate",
-    "Security Updates"
-  ];
+function maintenanceChecksSection(copy, searchPosition) {
+  const googleLabel = searchPosition !== void 0 ? `Page 1 Google Result (#${searchPosition})` : copy.maintenanceChecks[3];
+  const rows = copy.maintenanceChecks.map((label, i) => i === 3 ? googleLabel : label);
   return rows.map(
     (label, i) => `
     <mj-section background-color="white" padding="0px"${i === rows.length - 1 ? ' padding-bottom="36px"' : ""}>
@@ -689,15 +1040,8 @@ function maintenanceChecksSection(searchPosition) {
     </mj-section>`
   ).join("");
 }
-function testingChecklistSection() {
-  const rows = [
-    "Desktop Browsers",
-    "Mobile Browsers",
-    "Package Updates",
-    "Bottlenecks",
-    "Form Functionality",
-    "Animation Functionality"
-  ];
+function testingChecklistSection(copy) {
+  const rows = copy.testingChecklist;
   return rows.map(
     (label, i) => `
     <mj-section background-color="#F4F4F4" padding="0px"${i === rows.length - 1 ? ' padding-bottom="60px"' : ""}>
@@ -725,20 +1069,20 @@ function maintenanceTestingPlaceholder(lastTested) {
       </mj-column>
     </mj-section>`;
 }
-function testingIntroSection() {
+function testingIntroSection(copy) {
   return `
     <mj-section background-color="#F4F4F4">
       <mj-column>
         <mj-text color="#C00" font-size="20px" font-weight="700" padding-top="75px">TESTING</mj-text>
-        <mj-text color="#757575" font-family="helvetica, sans-serif" font-size="16px" font-weight="300" line-height="24px">Testing includes checks similar to those at launch: testing on common browsers and operating systems, at different screen sizes, and checking every function, and updating all packages for performance rather than just those needed for security.</mj-text>
+        <mj-text color="#757575" font-family="helvetica, sans-serif" font-size="16px" font-weight="300" line-height="24px">${escapeXml(copy.testingIntro)}</mj-text>
       </mj-column>
     </mj-section>`;
 }
-function commentarySection(text) {
+function commentarySection(text, copy) {
   return `
     <mj-section background-color="white">
       <mj-column>
-        <mj-text color="#C00" font-size="20px" font-weight="700" padding-top="55px">NOTES</mj-text>
+        <mj-text color="#C00" font-size="20px" font-weight="700" padding-top="55px">${escapeXml(copy.notesHeader)}</mj-text>
         <mj-text color="#757575" font-family="helvetica, sans-serif" font-size="16px" font-weight="300" line-height="24px">${escapeXml(text).replace(/\n/g, "<br/>")}</mj-text>
       </mj-column>
     </mj-section>`;
@@ -760,6 +1104,7 @@ function headerStyleBlock(data) {
   return `<mj-style>.rd-header img { height: auto !important; aspect-ratio: ${data.headerWidth} / ${data.headerHeight}; }</mj-style>`;
 }
 function buildMjml(data) {
+  const copy = data.copy ?? DEFAULT_COPY;
   const isTesting = data.reportType === "Testing";
   const previewText = `Checked up on ${escapeXml(data.siteName)}`;
   return `<mjml>
@@ -783,10 +1128,10 @@ function buildMjml(data) {
         <mj-text color="#C00" font-size="20px" font-weight="700" padding-top="75px">COMPLETED ON</mj-text>
         <mj-text color="#C00" font-size="44px" font-weight="400">${fmtDate(data.completedOn)}</mj-text>
         <mj-text color="#C00" font-size="20px" font-weight="700" padding-top="75px">MAINTENANCE CHECKS</mj-text>
-        <mj-text color="#757575" font-family="helvetica, sans-serif" font-size="16px" font-weight="300" line-height="24px">Includes checking the hosting, DNS, Content Management System (CMS, if applicable), search indexing and security of the site for major flaws and updating as necessary.</mj-text>
+        <mj-text color="#757575" font-family="helvetica, sans-serif" font-size="16px" font-weight="300" line-height="24px">${escapeXml(copy.maintenanceIntro)}</mj-text>
       </mj-column>
     </mj-section>
-    ${maintenanceChecksSection(data.searchPosition)}
+    ${maintenanceChecksSection(copy, data.searchPosition)}
     <mj-section background-color="#F4F4F4">
       <mj-column>
         <mj-text color="#C00" font-size="20px" font-weight="700" padding-top="55px">LIGHTHOUSE SCORES*</mj-text>
@@ -813,22 +1158,23 @@ function buildMjml(data) {
         <mj-text color="#C00" font-size="20px" font-weight="700" padding-top="75px">ANALYTICS</mj-text>
         <mj-text color="#C00" font-size="44px" font-weight="400">${data.gaUsersCurrent !== void 0 ? fmtUsers(data.gaUsersCurrent) : "\u2014"} Users</mj-text>
         ${analyticsTrendLine(data.gaUsersCurrent, data.gaUsersPrevious)}
-        <mj-text color="#757575" font-family="helvetica, sans-serif" font-size="12px" font-weight="300" padding-top="24px" padding-bottom="36px" line-height="20px">Contact us if you are interested in more in-depth data or have questions about SEO.</mj-text>
+        <mj-text color="#757575" font-family="helvetica, sans-serif" font-size="12px" font-weight="300" padding-top="24px" padding-bottom="36px" line-height="20px">${escapeXml(copy.seoCta)}</mj-text>
       </mj-column>
     </mj-section>
-    ${isTesting ? testingIntroSection() + testingChecklistSection() : maintenanceTestingPlaceholder(data.lastTestedDate)}
-    ${data.commentary ? commentarySection(data.commentary) : ""}
+    ${isTesting ? testingIntroSection(copy) + testingChecklistSection(copy) : maintenanceTestingPlaceholder(data.lastTestedDate)}
+    ${data.commentary ? commentarySection(data.commentary, copy) : ""}
     <mj-section background-color="white">
       <mj-column padding-top="36px">
         <mj-text color="#C00" font-family="helvetica, sans-serif" font-size="24px" font-weight="700" padding-top="36px" line-height="36px">Any questions, concerns or requests?</mj-text>
-        <mj-text font-family="helvetica, sans-serif" font-size="24px" font-weight="300" line-height="30px">Just hit reply.</mj-text>
-        <mj-text font-family="helvetica, sans-serif" font-size="24px" font-weight="300" padding-top="0px" line-height="30px" padding-bottom="36px">We're here to help in any way we can.</mj-text>
+        ${copy.contact.map(
+    (line, i) => i === copy.contact.length - 1 ? `<mj-text font-family="helvetica, sans-serif" font-size="24px" font-weight="300" padding-top="0px" line-height="30px" padding-bottom="36px">${escapeXml(line)}</mj-text>` : `<mj-text font-family="helvetica, sans-serif" font-size="24px" font-weight="300" line-height="30px">${escapeXml(line)}</mj-text>`
+  ).join("\n        ")}
         <mj-divider border-width="1px" border-style="solid" border-color="#CCCCCC" padding="0" />
         <mj-text color="#757575" font-family="helvetica, sans-serif" font-size="12px" font-weight="300" padding-top="24px" line-height="20px" font-style="italic">Copyright ${(/* @__PURE__ */ new Date()).getUTCFullYear()} Reddoor Creative, LLC. All rights reserved.</mj-text>
         <mj-text color="#757575" font-family="helvetica, sans-serif" font-size="12px" font-weight="700" line-height="16px" padding-top="0" padding-bottom="0px">Our mailing address is:</mj-text>
-        <mj-text color="#757575" font-family="helvetica, sans-serif" font-size="12px" font-weight="300" line-height="16px" padding-top="0" padding-bottom="0px">Reddoor Creative, LLC</mj-text>
-        <mj-text color="#757575" font-family="helvetica, sans-serif" font-size="12px" font-weight="300" line-height="16px" padding-top="0" padding-bottom="0px">29027 Dapper Dan</mj-text>
-        <mj-text color="#757575" font-family="helvetica, sans-serif" font-size="12px" font-weight="300" line-height="16px" padding-top="0" padding-bottom="0px">Fair Oaks Ranch, TX 78015</mj-text>
+        ${[copy.footerOrg, ...copy.footerAddress].map(
+    (line) => `<mj-text color="#757575" font-family="helvetica, sans-serif" font-size="12px" font-weight="300" line-height="16px" padding-top="0" padding-bottom="0px">${escapeXml(line)}</mj-text>`
+  ).join("\n        ")}
       </mj-column>
     </mj-section>
   </mj-body>
@@ -838,6 +1184,7 @@ var CHECK_PNG, BLURRED_TESTS, TREND_UP, TREND_NEUTRAL;
 var init_template = __esm({
   "src/reports/maintenance-email/template.ts"() {
     "use strict";
+    init_copy();
     init_assets();
     CHECK_PNG = `cid:${CHECK_CID}`;
     BLURRED_TESTS = `cid:${BLURRED_CID}`;
@@ -846,10 +1193,73 @@ var init_template = __esm({
   }
 });
 
+// src/reports/launch-email/template.ts
+function buildLaunchMjml(data) {
+  const copy = data.copy ?? DEFAULT_COPY;
+  const previewText = `${escapeXml(data.siteName)} is live`;
+  const setupRows = copy.launchSetupItems.map(
+    (item) => `
+      <mj-text color="${GREY}" font-family="helvetica, sans-serif" font-size="16px" font-weight="300" line-height="24px" padding-top="4px" padding-bottom="4px">\u2022 ${escapeXml(item)}</mj-text>`
+  ).join("");
+  const contactRows = copy.contact.map(
+    (line) => `
+      <mj-text font-family="helvetica, sans-serif" font-size="24px" font-weight="300" line-height="30px">${escapeXml(line)}</mj-text>`
+  ).join("");
+  const footerAddressRows = copy.footerAddress.map(
+    (line) => `
+      <mj-text color="${GREY}" font-family="helvetica, sans-serif" font-size="12px" font-weight="300" line-height="16px" padding-top="0" padding-bottom="0px">${escapeXml(line)}</mj-text>`
+  ).join("");
+  return `<mjml>
+  <mj-head>
+    <mj-attributes>
+      <mj-text font-family="helvetica, sans-serif" padding-left="5px" padding-right="5px" />
+      <mj-section padding-left="11%" padding-right="11%"/>
+      <mj-image padding="0px" />
+    </mj-attributes>
+    <mj-preview>${previewText}</mj-preview>
+    ${headerStyleBlock(data)}
+  </mj-head>
+  <mj-body background-color="white">
+    <mj-section background-color="#F4F4F4" padding-top="0px" padding-bottom="0px" padding-left="0px" padding-right="0px">
+      <mj-column>${headerImageTag(data)}</mj-column>
+    </mj-section>
+    <mj-section background-color="white">
+      <mj-column>
+        <mj-text color="${RED}" font-size="20px" font-weight="700" padding-top="75px">${escapeXml(copy.launchHeading)}</mj-text>
+        <mj-text color="${RED}" font-size="44px" font-weight="400">${fmtDate(data.completedOn)}</mj-text>
+        <mj-text color="${GREY}" font-family="helvetica, sans-serif" font-size="16px" font-weight="300" line-height="24px" padding-top="20px">${escapeXml(copy.launchBody)}</mj-text>
+        ${setupRows}
+      </mj-column>
+    </mj-section>
+    <mj-section background-color="white">
+      <mj-column padding-top="36px">
+        <mj-text color="${RED}" font-family="helvetica, sans-serif" font-size="24px" font-weight="700" padding-top="36px" line-height="36px">Any questions, concerns or requests?</mj-text>
+        ${contactRows}
+        <mj-divider border-width="1px" border-style="solid" border-color="#CCCCCC" padding="0" />
+        <mj-text color="${GREY}" font-family="helvetica, sans-serif" font-size="12px" font-weight="300" padding-top="24px" line-height="20px" font-style="italic">Copyright ${(/* @__PURE__ */ new Date()).getUTCFullYear()} ${escapeXml(copy.footerOrg)}. All rights reserved.</mj-text>
+        <mj-text color="${GREY}" font-family="helvetica, sans-serif" font-size="12px" font-weight="700" line-height="16px" padding-top="0" padding-bottom="0px">Our mailing address is:</mj-text>
+        <mj-text color="${GREY}" font-family="helvetica, sans-serif" font-size="12px" font-weight="300" line-height="16px" padding-top="0" padding-bottom="0px">${escapeXml(copy.footerOrg)}</mj-text>
+        ${footerAddressRows}
+      </mj-column>
+    </mj-section>
+  </mj-body>
+</mjml>`;
+}
+var RED, GREY;
+var init_template2 = __esm({
+  "src/reports/launch-email/template.ts"() {
+    "use strict";
+    init_copy();
+    init_template();
+    RED = "#C00";
+    GREY = "#757575";
+  }
+});
+
 // src/reports/render.ts
 import mjml2html from "mjml";
 async function renderReportHtml(data) {
-  const mjml = buildMjml(data);
+  const mjml = data.reportType === "Launch" ? buildLaunchMjml(data) : buildMjml(data);
   const out = await mjml2html(mjml, { validationLevel: "strict" });
   return { html: out.html, warnings: out.errors ?? [] };
 }
@@ -857,6 +1267,7 @@ var init_render = __esm({
   "src/reports/render.ts"() {
     "use strict";
     init_template();
+    init_template2();
   }
 });
 
@@ -899,44 +1310,6 @@ var init_attachments = __esm({
   }
 });
 
-// src/reports/maintenance-email/header-image.ts
-import sharp from "sharp";
-function channelToHex(value) {
-  return Math.max(0, Math.min(255, Math.round(value))).toString(16).padStart(2, "0");
-}
-async function prepareHeaderImage(bytes, options = {}) {
-  const requestedDisplayWidth = options.displayWidth ?? DEFAULT_DISPLAY_WIDTH;
-  const input = Buffer.from(bytes);
-  const meta = await sharp(input).metadata();
-  const origWidth = meta.width;
-  const origHeight = meta.height;
-  if (!origWidth || !origHeight) {
-    throw new Error("prepareHeaderImage: could not read source image dimensions");
-  }
-  const displayWidth = Math.min(requestedDisplayWidth, origWidth);
-  const displayHeight = Math.round(displayWidth * origHeight / origWidth);
-  const targetSourceWidth = Math.min(origWidth, displayWidth * RETINA_SCALE);
-  const out = await sharp(input).resize({ width: targetSourceWidth, withoutEnlargement: true }).flatten({ background: "#ffffff" }).jpeg({ quality: JPEG_QUALITY }).toBuffer();
-  const { dominant } = await sharp(out).stats();
-  const placeholderColor = `#${channelToHex(dominant.r)}${channelToHex(dominant.g)}${channelToHex(dominant.b)}`;
-  return {
-    bytes: new Uint8Array(out),
-    contentType: "image/jpeg",
-    displayWidth,
-    displayHeight,
-    placeholderColor
-  };
-}
-var DEFAULT_DISPLAY_WIDTH, RETINA_SCALE, JPEG_QUALITY;
-var init_header_image = __esm({
-  "src/reports/maintenance-email/header-image.ts"() {
-    "use strict";
-    DEFAULT_DISPLAY_WIDTH = 600;
-    RETINA_SCALE = 2;
-    JPEG_QUALITY = 82;
-  }
-});
-
 // src/reports/send/resend.ts
 import { Resend } from "resend";
 function defaultResendClient() {
@@ -963,9 +1336,498 @@ function defaultResendClient() {
     }
   };
 }
-var init_resend = __esm({
-  "src/reports/send/resend.ts"() {
+var init_resend = __esm({
+  "src/reports/send/resend.ts"() {
+    "use strict";
+  }
+});
+
+// src/alerts/digest-collectors.ts
+function dashboardUrl(baseUrl, siteName) {
+  return `${baseUrl.replace(/\/$/, "")}/s/${siteSlug(siteName)}`;
+}
+function collectVulnAlerts(sites, baseUrl) {
+  const items = [];
+  for (const s of sites) {
+    const critical = s.securityVulnsCritical ?? 0;
+    const high = s.securityVulnsHigh ?? 0;
+    const metric = critical + high;
+    if (metric <= 0) continue;
+    items.push({
+      key: `vuln:${s.id}`,
+      kind: "vuln",
+      siteName: s.name,
+      title: `${metric} critical/high ${metric === 1 ? "vuln" : "vulns"}`,
+      url: dashboardUrl(baseUrl, s.name),
+      severity: critical > 0 ? "critical" : "warning",
+      metric
+    });
+  }
+  return items;
+}
+function collectLighthouseAlerts(sites, baseUrl) {
+  const items = [];
+  for (const s of sites) {
+    for (const cat of LIGHTHOUSE_CATEGORIES2) {
+      const score = s[cat.field];
+      if (score === null || score >= LIGHTHOUSE_FLOOR) continue;
+      items.push({
+        key: `lighthouse:${s.id}:${cat.slug}`,
+        kind: "lighthouse",
+        siteName: s.name,
+        title: `Lighthouse ${cat.label} ${score} (below ${LIGHTHOUSE_FLOOR})`,
+        url: dashboardUrl(baseUrl, s.name),
+        severity: "warning",
+        metric: 100 - score
+      });
+    }
+  }
+  return items;
+}
+function collectDeliveryFailures(reports, sitesById, baseUrl) {
+  const items = [];
+  for (const r of reports) {
+    if (r.deliveryStatus !== "bounced" && r.deliveryStatus !== "complained") continue;
+    const site = sitesById.get(r.siteId);
+    if (!site) continue;
+    const complained = r.deliveryStatus === "complained";
+    items.push({
+      key: `delivery:${r.id}`,
+      kind: "delivery",
+      siteName: site.name,
+      title: complained ? "Spam complaint on a sent report" : "A sent report bounced",
+      url: dashboardUrl(baseUrl, site.name),
+      severity: complained ? "critical" : "warning",
+      metric: 1
+    });
+  }
+  return items;
+}
+function renovateFindingsToAttention(result) {
+  const items = [];
+  for (const f of result.findings) {
+    items.push({
+      key: `renovate:${f.repo}#${f.pr.number}`,
+      kind: "renovate",
+      siteName: f.site,
+      title: `Renovate update failing CI: ${f.pr.title}`,
+      url: f.pr.url,
+      severity: "warning",
+      metric: 1
+    });
+  }
+  if (result.skipped.length > 0) {
+    items.push({
+      key: "renovate:skipped",
+      kind: "renovate",
+      siteName: "Fleet checks",
+      title: `Couldn't check ${result.skipped.length} repo(s) for failing Renovate PRs`,
+      severity: "warning",
+      metric: result.skipped.length
+    });
+  }
+  return items;
+}
+function buildRenovateProbe() {
+  const token = process.env.RENOVATE_TOKEN?.trim() || process.env.GH_TOKEN?.trim();
+  if (!token) return void 0;
+  return makeGitHub({ token }).openPullRequests;
+}
+var LIGHTHOUSE_FLOOR, LIGHTHOUSE_CATEGORIES2;
+var init_digest_collectors = __esm({
+  "src/alerts/digest-collectors.ts"() {
+    "use strict";
+    init_websites();
+    init_gh();
+    LIGHTHOUSE_FLOOR = 75;
+    LIGHTHOUSE_CATEGORIES2 = [
+      { field: "pScore", slug: "performance", label: "Performance" },
+      { field: "rScore", slug: "accessibility", label: "Accessibility" },
+      { field: "bpScore", slug: "best-practices", label: "Best Practices" },
+      { field: "seoScore", slug: "seo", label: "SEO" }
+    ];
+  }
+});
+
+// src/alerts/renovate.ts
+function isRenovatePR(pr) {
+  return RENOVATE_HEAD_PREFIXES.some((p) => pr.headRef.startsWith(p));
+}
+function isFailingRenovatePR(pr) {
+  return isRenovatePR(pr) && pr.ciState === "failing";
+}
+function siteLabel2(site) {
+  const display = site.meta?.["displayName"];
+  if (typeof display === "string" && display.length > 0) return display;
+  if (typeof site.name === "string" && site.name.length > 0) return site.name;
+  return "unknown";
+}
+async function collectRenovateFailures(sites, probe) {
+  const findings = [];
+  const skipped = [];
+  for (const site of sites) {
+    const repo = site.gitRepo;
+    if (!repo) continue;
+    let prs;
+    try {
+      prs = await probe(repo);
+    } catch {
+      skipped.push(repo);
+      continue;
+    }
+    for (const pr of prs) {
+      if (isFailingRenovatePR(pr)) {
+        findings.push({ site: siteLabel2(site), repo, pr });
+      }
+    }
+  }
+  return { findings, skipped };
+}
+var RENOVATE_HEAD_PREFIXES;
+var init_renovate = __esm({
+  "src/alerts/renovate.ts"() {
+    "use strict";
+    RENOVATE_HEAD_PREFIXES = ["renovate/", "renovate-"];
+  }
+});
+
+// src/alerts/digest-state.ts
+function diffAttention(items, prior, today) {
+  const tagged = [];
+  const next = {};
+  for (const it of items) {
+    const was = prior[it.key];
+    let status;
+    let firstFlaggedAt;
+    if (!was) {
+      status = "new";
+      firstFlaggedAt = today;
+    } else if (it.metric > was.metric) {
+      status = "worse";
+      firstFlaggedAt = was.firstFlaggedAt;
+    } else {
+      status = "standing";
+      firstFlaggedAt = was.firstFlaggedAt;
+    }
+    tagged.push({ ...it, status });
+    next[it.key] = { metric: it.metric, firstFlaggedAt };
+  }
+  return { tagged, next };
+}
+async function readDigestState(base) {
+  const rows = [];
+  await base(DIGEST_STATE_TABLE).select({ maxRecords: 1, pageSize: 1 }).eachPage((records, fetchNextPage) => {
+    for (const rec of records) rows.push({ id: rec.id, fields: rec.fields });
+    fetchNextPage();
+  });
+  const first = rows[0];
+  if (!first) return {};
+  const raw = first.fields["Snapshot"];
+  if (typeof raw !== "string") return {};
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return {};
+  }
+}
+async function writeDigestState(base, snap, updatedAt = (/* @__PURE__ */ new Date()).toISOString()) {
+  const rows = [];
+  await base(DIGEST_STATE_TABLE).select({ maxRecords: 1, pageSize: 1 }).eachPage((records, fetchNextPage) => {
+    for (const rec of records) rows.push({ id: rec.id });
+    fetchNextPage();
+  });
+  const fields = {
+    Snapshot: JSON.stringify(snap),
+    "Updated At": updatedAt
+  };
+  const existing = rows[0];
+  if (existing) {
+    await base(DIGEST_STATE_TABLE).update([{ id: existing.id, fields }]);
+  } else {
+    await base(DIGEST_STATE_TABLE).create([{ fields }]);
+  }
+}
+var DIGEST_STATE_TABLE;
+var init_digest_state = __esm({
+  "src/alerts/digest-state.ts"() {
+    "use strict";
+    DIGEST_STATE_TABLE = "Digest State";
+  }
+});
+
+// src/reports/digest.ts
+var digest_exports = {};
+__export(digest_exports, {
+  collectAttention: () => collectAttention,
+  listPendingApproval: () => listPendingApproval,
+  renderDigestHtml: () => renderDigestHtml,
+  runDigest: () => runDigest
+});
+function esc(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function readySection(items) {
+  const heading = `<h2 style="color:${RED2};font-family:helvetica,sans-serif;font-size:20px;font-weight:700;margin:32px 0 8px">Ready for your yes</h2>`;
+  if (items.length === 0) {
+    return `${heading}<p style="color:${GREY2};font-family:helvetica,sans-serif;font-size:16px;margin:0">Nothing waiting on you.</p>`;
+  }
+  const rows = items.map((it) => {
+    const safeUrl = it.dashboardUrl.startsWith("https://") ? it.dashboardUrl : void 0;
+    const link = safeUrl ? `<a href="${esc(safeUrl)}" style="${ANCHOR_STYLE}">review &amp; approve</a>` : `review &amp; approve`;
+    return `
+      <tr>
+        <td style="color:${GREY2};font-family:helvetica,sans-serif;font-size:16px;line-height:24px;padding-bottom:8px">
+          <strong style="color:#222">${esc(it.siteName)}</strong> \u2014 ${esc(it.reportType)} (${esc(it.period)})
+          \u2014 ${link}
+        </td>
+      </tr>`;
+  }).join("");
+  return `${heading}<table role="presentation" style="border-collapse:collapse;margin:0">${rows}</table>`;
+}
+function attentionBadge(status) {
+  if (status === "new")
+    return `<strong style="color:${RED2};font-family:helvetica,sans-serif">NEW</strong> `;
+  if (status === "worse")
+    return `<strong style="color:${RED2};font-family:helvetica,sans-serif">WORSE</strong> `;
+  return "";
+}
+function attentionSection(items) {
+  const heading = `<h2 style="color:${RED2};font-family:helvetica,sans-serif;font-size:20px;font-weight:700;margin:32px 0 8px">Needs attention</h2>`;
+  if (items.length === 0) {
+    return `${heading}<p style="color:${GREY2};font-family:helvetica,sans-serif;font-size:16px;margin:0">All clear \u2014 nothing needs attention.</p>`;
+  }
+  const bySite = /* @__PURE__ */ new Map();
+  for (const it of items) {
+    const bucket = bySite.get(it.siteName);
+    if (bucket) bucket.push(it);
+    else bySite.set(it.siteName, [it]);
+  }
+  const groups = [...bySite.entries()].map(([siteName, siteItems]) => {
+    const sorted = [...siteItems].sort(
+      (a, b) => SEVERITY_ORDER[a.severity] - SEVERITY_ORDER[b.severity]
+    );
+    const rows = sorted.map((it) => {
+      const safeUrl = it.url?.startsWith("https://") ? it.url : void 0;
+      const titleHtml = safeUrl ? `<a href="${esc(safeUrl)}" style="${ANCHOR_STYLE}">${esc(it.title)}</a>` : esc(it.title);
+      return `
+          <tr>
+            <td style="color:${GREY2};font-family:helvetica,sans-serif;font-size:16px;line-height:24px;padding-bottom:8px">${attentionBadge(it.status)}${titleHtml}</td>
+          </tr>`;
+    }).join("");
+    return `
+      <tr>
+        <td style="color:#222;font-family:helvetica,sans-serif;font-size:16px;font-weight:700;padding:8px 0 4px">${esc(siteName)}</td>
+      </tr>
+      ${rows}`;
+  }).join("");
+  return `${heading}<table role="presentation" style="border-collapse:collapse;margin:0">${groups}</table>`;
+}
+function digestDateKey(d) {
+  return d.toISOString().slice(0, 10);
+}
+function isIdempotencyConflict(err) {
+  const message = err instanceof Error ? err.message : String(err);
+  if (/idempotency key has been used/i.test(message)) return true;
+  const e = err;
+  if (e.name === "invalid_idempotent_request") return true;
+  if (e.statusCode === 409) return true;
+  return false;
+}
+async function listPendingApproval(base) {
+  return (await listAllReports(base)).filter(
+    (r) => r.draftReady && !r.approvedToSend && r.sentAt === null
+  );
+}
+function runCollector(label, fn) {
+  try {
+    return fn();
+  } catch (e) {
+    console.warn(`\u26A0 attention collector "${label}" failed: ${e.message}`);
+    return [];
+  }
+}
+async function runCollectorAsync(label, fn) {
+  try {
+    return await fn();
+  } catch (e) {
+    console.warn(`\u26A0 attention collector "${label}" failed: ${e.message}`);
+    return [];
+  }
+}
+async function collectAttention(deps) {
+  const reports = deps.reports ?? await listAllReports(deps.base);
+  const websites = deps.websites ?? await listWebsites(deps.base);
+  const sitesById = new Map(websites.map((w) => [w.id, w]));
+  const renovate = deps.renovateProbe ? await runCollectorAsync("renovate", async () => {
+    const sites = websites.map((w) => ({
+      path: "",
+      name: w.name,
+      meta: {},
+      ...w.gitRepo ? { gitRepo: w.gitRepo } : {}
+    }));
+    const result = await collectRenovateFailures(sites, deps.renovateProbe);
+    return renovateFindingsToAttention(result);
+  }) : [];
+  return [
+    ...runCollector("vuln", () => collectVulnAlerts(websites, deps.baseUrl)),
+    ...runCollector("delivery", () => collectDeliveryFailures(reports, sitesById, deps.baseUrl)),
+    ...runCollector("lighthouse", () => collectLighthouseAlerts(websites, deps.baseUrl)),
+    ...renovate
+  ];
+}
+async function runDigest(options) {
+  const today = /* @__PURE__ */ new Date();
+  try {
+    const base = options.base ?? openBase(readAirtableConfig());
+    const reports = await listAllReports(base);
+    const websites = await listWebsites(base);
+    const sites = new Map(websites.map((w) => [w.id, w]));
+    const pending = reports.filter((r) => r.draftReady && !r.approvedToSend && r.sentAt === null);
+    const readyForYourYes = [];
+    for (const r of pending) {
+      const site = sites.get(r.siteId);
+      if (!site) continue;
+      readyForYourYes.push({
+        siteName: site.name,
+        reportType: r.reportType,
+        period: r.period ?? "\u2014",
+        dashboardUrl: `${options.baseUrl.replace(/\/$/, "")}/s/${siteSlug(site.name)}`
+      });
+    }
+    const renovateProbe = buildRenovateProbe();
+    const collected = await collectAttention({
+      base,
+      baseUrl: options.baseUrl,
+      websites,
+      reports,
+      ...renovateProbe ? { renovateProbe } : {}
+    });
+    const prior = await readDigestState(base);
+    const { tagged, next } = diffAttention(collected, prior, digestDateKey(today));
+    const needsAttention = tagged;
+    if (readyForYourYes.length === 0 && needsAttention.length === 0) {
+      try {
+        await writeDigestState(base, next);
+      } catch (e) {
+        console.warn(`\u26A0 digest state write failed: ${e.message}`);
+      }
+      return { output: "Digest skipped (nothing ready, nothing needs attention).", code: 0 };
+    }
+    const html = renderDigestHtml({ readyForYourYes, needsAttention });
+    const client = options.resend ?? defaultResendClient();
+    const to = [process.env.OPERATOR_EMAIL?.trim() || DIGEST_OPERATOR_FALLBACK];
+    const n = readyForYourYes.length;
+    const reportWord = n === 1 ? "report" : "reports";
+    let result;
+    try {
+      result = await client.send({
+        from: FROM_ADDRESS,
+        to,
+        subject: `Your fleet \u2014 ${digestDateKey(today)}: ${n} ${reportWord} ready for your yes`,
+        html,
+        idempotencyKey: `digest-${digestDateKey(today)}`
+      });
+    } catch (err) {
+      if (isIdempotencyConflict(err)) {
+        return {
+          output: "Digest already sent today (content changed since the first send) \u2014 skipped to avoid a duplicate.",
+          code: 0
+        };
+      }
+      throw err;
+    }
+    try {
+      await writeDigestState(base, next);
+    } catch (e) {
+      console.warn(`\u26A0 digest state write failed: ${e.message}`);
+    }
+    return { output: `Digest sent to ${to.join(", ")} (${result.messageId})`, code: 0 };
+  } catch (err) {
+    if (typeof err.exitCode === "number") {
+      throw err;
+    }
+    const message = err instanceof Error ? err.message : String(err);
+    return { output: `digest failed: ${message}`, code: 1 };
+  }
+}
+function renderDigestHtml(sections) {
+  return `<!doctype html>
+<html>
+  <head><meta charset="utf-8"></head>
+  <body style="margin:0;padding:0;background:#ffffff">
+    <table width="100%" style="border-collapse:collapse">
+      <tr>
+        <td align="center" style="padding:24px">
+          <table width="600" style="border-collapse:collapse">
+            <tr>
+              <td>
+                <h1 style="color:${RED2};font-family:helvetica,sans-serif;font-size:24px;font-weight:700;margin:0 0 8px">Your fleet today</h1>
+                ${readySection(sections.readyForYourYes)}
+                ${attentionSection(sections.needsAttention)}
+              </td>
+            </tr>
+          </table>
+        </td>
+      </tr>
+    </table>
+  </body>
+</html>`;
+}
+var GREY2, RED2, ANCHOR_STYLE, SEVERITY_ORDER, FROM_ADDRESS, DIGEST_OPERATOR_FALLBACK;
+var init_digest = __esm({
+  "src/reports/digest.ts"() {
+    "use strict";
+    init_client();
+    init_reports();
+    init_websites();
+    init_resend();
+    init_digest_collectors();
+    init_renovate();
+    init_digest_state();
+    GREY2 = "#757575";
+    RED2 = "#C00";
+    ANCHOR_STYLE = `color:${RED2};font-family:helvetica,sans-serif`;
+    SEVERITY_ORDER = { critical: 0, warning: 1 };
+    FROM_ADDRESS = "Reddoor Reports <reports@reddoorla.com>";
+    DIGEST_OPERATOR_FALLBACK = "info@reddoorla.com";
+  }
+});
+
+// src/reports/maintenance-email/header-image.ts
+import sharp from "sharp";
+function channelToHex(value) {
+  return Math.max(0, Math.min(255, Math.round(value))).toString(16).padStart(2, "0");
+}
+async function prepareHeaderImage(bytes, options = {}) {
+  const requestedDisplayWidth = options.displayWidth ?? DEFAULT_DISPLAY_WIDTH;
+  const input = Buffer.from(bytes);
+  const meta = await sharp(input).metadata();
+  const origWidth = meta.width;
+  const origHeight = meta.height;
+  if (!origWidth || !origHeight) {
+    throw new Error("prepareHeaderImage: could not read source image dimensions");
+  }
+  const displayWidth = Math.min(requestedDisplayWidth, origWidth);
+  const displayHeight = Math.round(displayWidth * origHeight / origWidth);
+  const targetSourceWidth = Math.min(origWidth, displayWidth * RETINA_SCALE);
+  const out = await sharp(input).resize({ width: targetSourceWidth, withoutEnlargement: true }).flatten({ background: "#ffffff" }).jpeg({ quality: JPEG_QUALITY }).toBuffer();
+  const { dominant } = await sharp(out).stats();
+  const placeholderColor = `#${channelToHex(dominant.r)}${channelToHex(dominant.g)}${channelToHex(dominant.b)}`;
+  return {
+    bytes: new Uint8Array(out),
+    contentType: "image/jpeg",
+    displayWidth,
+    displayHeight,
+    placeholderColor
+  };
+}
+var DEFAULT_DISPLAY_WIDTH, RETINA_SCALE, JPEG_QUALITY;
+var init_header_image = __esm({
+  "src/reports/maintenance-email/header-image.ts"() {
     "use strict";
+    DEFAULT_DISPLAY_WIDTH = 600;
+    RETINA_SCALE = 2;
+    JPEG_QUALITY = 82;
   }
 });
 
@@ -1006,6 +1868,14 @@ async function sendApprovedReports(options = {}) {
     try {
       const messageId = await sendOne(client, base, site, report);
       lines.push(`\u2713 sent: ${report.reportId} (${messageId})`);
+      if (report.reportType === "Launch") {
+        try {
+          await updateLaunched(base, site.id, (/* @__PURE__ */ new Date()).toISOString());
+          lines.push(`  \u21B3 launched: ${site.name} flipped to maintenance`);
+        } catch (e) {
+          lines.push(`  \u26A0 launch flip failed for ${site.name}: ${e.message}`);
+        }
+      }
     } catch (e) {
       lines.push(`\u2717 ${report.reportId} \u2014 ${e.message}`);
       anyFailed = true;
@@ -1038,6 +1908,7 @@ async function sendOne(client, base, site, report) {
     searchPosition: report.searchFoundPage1 && report.searchPosition !== null ? report.searchPosition : void 0,
     lastTestedDate: report.lastTestedDate ? new Date(report.lastTestedDate) : null,
     commentary: report.commentary,
+    copy: resolveCopy(site),
     headerImageCid: cidName,
     headerWidth: header.displayWidth,
     headerHeight: header.displayHeight,
@@ -1071,7 +1942,7 @@ async function sendOne(client, base, site, report) {
     }
   }
   const payload = {
-    from: FROM_ADDRESS,
+    from: FROM_ADDRESS2,
     to,
     replyTo: REPLY_TO,
     subject,
@@ -1132,7 +2003,7 @@ function isProbablyEmail(s) {
   if (/\s/.test(s)) return false;
   return true;
 }
-var FROM_ADDRESS, REPLY_TO, MONTHS2;
+var FROM_ADDRESS2, REPLY_TO, MONTHS2;
 var init_orchestrate = __esm({
   "src/reports/send/orchestrate.ts"() {
     "use strict";
@@ -1141,10 +2012,11 @@ var init_orchestrate = __esm({
     init_websites();
     init_attachments();
     init_render();
+    init_copy();
     init_assets();
     init_header_image();
     init_resend();
-    FROM_ADDRESS = "Reddoor Reports <reports@reddoorla.com>";
+    FROM_ADDRESS2 = "Reddoor Reports <reports@reddoorla.com>";
     REPLY_TO = "info@reddoorla.com";
     MONTHS2 = [
       "January",
@@ -1173,72 +2045,8 @@ import { cac } from "cac";
 import { resolve as resolve2 } from "path";
 import { Listr } from "listr2";
 
-// src/audits/util/spawn.ts
-import { spawn } from "child_process";
-var TRUNCATION_MARKER = "\n\u2026[output truncated]";
-function makeSpawn(internals = {}) {
-  const spawnImpl = internals.spawnImpl ?? spawn;
-  const killImpl = internals.killImpl ?? ((pid, sig) => process.kill(pid, sig));
-  const killGraceMs = internals.killGraceMs ?? 5e3;
-  const maxOutputBytes = internals.maxOutputBytes ?? 10 * 1024 * 1024;
-  return (cmd, args, opts = {}) => new Promise((resolve11, reject) => {
-    const streaming = opts.streaming === true;
-    const child = spawnImpl(cmd, [...args], {
-      cwd: opts.cwd,
-      env: opts.env ?? process.env,
-      stdio: streaming ? ["ignore", "inherit", "inherit"] : ["ignore", "pipe", "pipe"],
-      // Detach ONLY when a timeout can fire: the child then leads its own
-      // process group, so the timeout can kill the WHOLE tree (vite, and
-      // Chromium under lhci/playwright) via process.kill(-pid), not just the
-      // npx/pnpm wrapper. Without it, killing the wrapper orphaned the
-      // grandchildren — a zombie vite squatting its port, Chrome left running.
-      // We do NOT detach timeout-less streaming calls (pnpm install/up):
-      // detaching gains nothing there (no timeout → no group-kill) and would
-      // break terminal Ctrl-C, which only reaches the foreground group — i.e.
-      // it would re-orphan the very children this guards. We never unref() the
-      // child since we still await it.
-      detached: opts.timeoutMs !== void 0
-    });
-    const cap = (acc, chunk) => {
-      if (acc.length >= maxOutputBytes) return acc;
-      const next = acc + chunk;
-      return next.length > maxOutputBytes ? next.slice(0, maxOutputBytes) + TRUNCATION_MARKER : next;
-    };
-    let stdout = "";
-    let stderr = "";
-    if (!streaming) {
-      child.stdout?.on("data", (chunk) => stdout = cap(stdout, String(chunk)));
-      child.stderr?.on("data", (chunk) => stderr = cap(stderr, String(chunk)));
-    }
-    const killGroup = (sig) => {
-      if (child.pid === void 0) return;
-      try {
-        killImpl(-child.pid, sig);
-      } catch {
-      }
-    };
-    let killTimer;
-    const timer = opts.timeoutMs ? setTimeout(() => {
-      killGroup("SIGTERM");
-      killTimer = setTimeout(() => killGroup("SIGKILL"), killGraceMs);
-      killTimer.unref();
-      reject(new Error(`spawn timeout after ${opts.timeoutMs}ms: ${cmd}`));
-    }, opts.timeoutMs) : void 0;
-    const clearTimers = () => {
-      if (timer) clearTimeout(timer);
-      if (killTimer) clearTimeout(killTimer);
-    };
-    child.on("error", (err) => {
-      clearTimers();
-      reject(err);
-    });
-    child.on("close", (code) => {
-      clearTimers();
-      resolve11({ code: code ?? -1, stdout, stderr });
-    });
-  });
-}
-var defaultSpawn = makeSpawn();
+// src/audits/index.ts
+init_spawn();
 
 // src/audits/deps.ts
 import { readFile } from "fs/promises";
@@ -1288,6 +2096,9 @@ var baselineVersions = {
   "@zerodevx/svelte-img": "^2.1.2"
 };
 
+// src/audits/deps.ts
+init_spawn();
+
 // src/audits/deps-outdated.ts
 import { stat } from "fs/promises";
 import { join as join2 } from "path";
@@ -1467,6 +2278,7 @@ async function lintAudit(ctx) {
 }
 
 // src/audits/security.ts
+init_spawn();
 function classify(v) {
   if (v.critical > 0 || v.high > 0) return "fail";
   if (v.moderate > 0 || v.low > 0) return "warn";
@@ -1641,6 +2453,9 @@ var lighthouseConfig = {
   }
 };
 
+// src/audits/lighthouse.ts
+init_spawn();
+
 // src/audits/util/site-config.ts
 import { readFile as readFile3 } from "fs/promises";
 import { join as join5 } from "path";
@@ -1671,7 +2486,7 @@ async function readSiteConfig(sitePath) {
 // src/util/free-port.ts
 import { createServer } from "net";
 async function findFreePort() {
-  return new Promise((resolve11, reject) => {
+  return new Promise((resolve12, reject) => {
     const server = createServer();
     server.unref();
     server.on("error", reject);
@@ -1679,7 +2494,7 @@ async function findFreePort() {
       const addr = server.address();
       if (typeof addr === "object" && addr) {
         const port = addr.port;
-        server.close(() => resolve11(port));
+        server.close(() => resolve12(port));
       } else {
         server.close();
         reject(new Error("findFreePort: could not determine assigned port from socket"));
@@ -1909,6 +2724,7 @@ var playwrightA11yConfig = defineConfig({
 });
 
 // src/audits/a11y.ts
+init_spawn();
 var RESULTS_REL = ".reddoor-a11y/results.json";
 async function readJsonMaybe2(path) {
   try {
@@ -2225,6 +3041,7 @@ async function resolveSites(input) {
 }
 
 // src/cli/fleet/clone-if-needed.ts
+init_spawn();
 import { stat as stat2, readdir as readdir2, mkdir } from "fs/promises";
 import { isAbsolute as isAbsolute2, join as join8 } from "path";
 function deriveNameFromRepoUrl(repoUrl) {
@@ -3059,6 +3876,7 @@ async function runSyncConfigsCommand(site, opts) {
 import { resolve as resolve4 } from "path";
 
 // src/recipes/bump-deps.ts
+init_spawn();
 import { stat as stat3 } from "fs/promises";
 import { join as join12 } from "path";
 async function exists2(path) {
@@ -3084,247 +3902,97 @@ async function bumpDeps(site, opts = {}) {
   return withRecipe({
     name: "bump-deps",
     site,
-    // pnpm install (in plan) mutates the lockfile, so the clean-tree check
-    // MUST happen first — otherwise a desynced-lockfile resync would silently
-    // land on top of whatever else was in the tree.
-    checkTreeFirst: true,
-    plan: async () => {
-      const hasPnpmLock = await exists2(join12(site.path, "pnpm-lock.yaml"));
-      if (!hasPnpmLock) {
-        const hasNpmLock = await exists2(join12(site.path, "package-lock.json"));
-        const hasYarnLock = await exists2(join12(site.path, "yarn.lock"));
-        if (hasNpmLock || hasYarnLock) {
-          const competing = hasNpmLock ? "package-lock.json" : "yarn.lock";
-          return {
-            kind: "failed",
-            notes: `site has ${competing} but no pnpm-lock.yaml \u2014 run convert-to-pnpm first`
-          };
-        }
-      }
-      await spawn2("pnpm", ["install"], { cwd: site.path, streaming: true });
-      const outdated = await spawn2(
-        "pnpm",
-        ["outdated", "--json", ...outdatedFlagsForGroup(group)],
-        { cwd: site.path }
-      );
-      let parsed;
-      try {
-        parsed = JSON.parse(outdated.stdout || "{}");
-      } catch {
-        parsed = {};
-      }
-      if (Object.keys(parsed).length === 0) {
-        return { kind: "noop", notes: `pnpm outdated reported nothing for group=${group}` };
-      }
-      return { kind: "apply", plan: { group } };
-    },
-    apply: async ({ group: g }, { commit: commit2, cwd }) => {
-      await spawn2("pnpm", ["up", ...upFlagsForGroup(g)], { cwd, streaming: true });
-      await commit2(`chore(deps): bump dependencies (${g})`);
-      return { kind: "ok" };
-    }
-  });
-}
-
-// src/cli/commands/bump-deps.ts
-var GROUPS = ["patch", "minor", "major"];
-function formatResult2(r) {
-  if (r.status === "noop") return `[${r.site}] noop: ${r.notes ?? ""}`;
-  return `[${r.site}] applied: ${r.commits.length} commit(s)
-${r.notes ?? ""}`;
-}
-async function runBumpDepsCommand(site, opts) {
-  const group = opts.group ?? "minor";
-  if (!GROUPS.includes(group)) {
-    throw Object.assign(
-      new Error(`unknown --group: ${group}. expected one of ${GROUPS.join(", ")}`),
-      { exitCode: 2 }
-    );
-  }
-  const cwd = opts.cwd ? resolve4(opts.cwd) : process.cwd();
-  let sites = await resolveSites({
-    ...site !== void 0 ? { site } : {},
-    ...opts.fleet !== void 0 ? { fleet: opts.fleet } : {},
-    cwd
-  });
-  if (opts.fleet) {
-    const workdir = opts.workdir ?? `${process.env.HOME ?? ""}/.reddoor-maint/sites`;
-    sites = await Promise.all(sites.map((s) => cloneIfNeeded(s, { workdir })));
-  }
-  const results = [];
-  for (const s of sites) results.push(await bumpDeps(s, { group }));
-  const output = results.map(formatResult2).join("\n");
-  const code = results.some((r) => r.status === "failed") ? 1 : 0;
-  return { output, code };
-}
-
-// src/cli/commands/self-updating.ts
-import { resolve as resolve5 } from "path";
-
-// src/recipes/self-updating/index.ts
-import { mkdir as mkdir3, writeFile as writeFile4 } from "fs/promises";
-import { dirname as dirname2, join as join13 } from "path";
-
-// src/github/config.ts
-function readGitHubConfig() {
-  const token = process.env.GITHUB_TOKEN?.trim();
-  if (!token) return null;
-  const renovateToken = process.env.RENOVATE_TOKEN?.trim() || token;
-  return { token, renovateToken };
-}
-
-// src/github/gh.ts
-function mapRollupState(state) {
-  switch (state) {
-    case "SUCCESS":
-      return "passing";
-    case "FAILURE":
-    case "ERROR":
-      return "failing";
-    case "PENDING":
-    case "EXPECTED":
-      return "pending";
-    default:
-      return "none";
-  }
-}
-function makeGitHub(deps) {
-  const spawn2 = deps.spawn ?? defaultSpawn;
-  const env = { ...process.env, GH_TOKEN: deps.token };
-  async function gh(args) {
-    const r = await spawn2("gh", args, { env, timeoutMs: 6e4 });
-    if (r.code !== 0) throw new Error(`gh ${args[0]} failed (code ${r.code}): ${r.stderr.trim()}`);
-    return r.stdout;
-  }
-  return {
-    async openPullRequest(repo, pr) {
-      const out = await gh([
-        "pr",
-        "create",
-        "--repo",
-        repo,
-        "--head",
-        pr.head,
-        "--base",
-        pr.base,
-        "--title",
-        pr.title,
-        "--body",
-        pr.body
-      ]);
-      return { url: out.trim() };
-    },
-    async enableRepoAutoMerge(repo) {
-      await gh(["api", "-X", "PATCH", `repos/${repo}`, "-F", "allow_auto_merge=true"]);
-    },
-    async protectBranch(repo, branch, requiredChecks) {
-      const args = [
-        "api",
-        "-X",
-        "PUT",
-        `repos/${repo}/branches/${branch}/protection`,
-        "-H",
-        "Accept: application/vnd.github+json",
-        "-F",
-        "required_status_checks[strict]=true",
-        ...requiredChecks.flatMap((c) => ["-f", `required_status_checks[contexts][]=${c}`]),
-        "-F",
-        "enforce_admins=true",
-        "-F",
-        "required_pull_request_reviews=null",
-        "-F",
-        "restrictions=null"
-      ];
-      await gh(args);
-    },
-    async setRepoSecret(repo, name, value) {
-      await gh(["secret", "set", name, "--repo", repo, "--body", value]);
-    },
-    async repoExists(repo) {
-      const r = await spawn2("gh", ["api", `repos/${repo}`], { env, timeoutMs: 6e4 });
-      return r.code === 0;
-    },
-    async defaultBranch(repo) {
-      const out = await gh(["api", `repos/${repo}`, "--jq", ".default_branch"]);
-      return out.trim();
-    },
-    // filesOnBranch and branchProtectionContexts call `spawn` directly (not the
-    // throwing `gh()` helper) because a 404 is an expected, meaningful answer —
-    // "file/protection absent" — not an error. The remaining readers use `gh()`
-    // since a non-200 there is a genuine failure (e.g. missing token scope).
-    async filesOnBranch(repo, branch, paths) {
-      const present = [];
-      for (const p of paths) {
-        const r = await spawn2("gh", [`api`, `repos/${repo}/contents/${p}?ref=${branch}`], {
-          env,
-          timeoutMs: 6e4
-        });
-        if (r.code === 0) present.push(p);
+    // pnpm install (in plan) mutates the lockfile, so the clean-tree check
+    // MUST happen first — otherwise a desynced-lockfile resync would silently
+    // land on top of whatever else was in the tree.
+    checkTreeFirst: true,
+    plan: async () => {
+      const hasPnpmLock = await exists2(join12(site.path, "pnpm-lock.yaml"));
+      if (!hasPnpmLock) {
+        const hasNpmLock = await exists2(join12(site.path, "package-lock.json"));
+        const hasYarnLock = await exists2(join12(site.path, "yarn.lock"));
+        if (hasNpmLock || hasYarnLock) {
+          const competing = hasNpmLock ? "package-lock.json" : "yarn.lock";
+          return {
+            kind: "failed",
+            notes: `site has ${competing} but no pnpm-lock.yaml \u2014 run convert-to-pnpm first`
+          };
+        }
       }
-      return present;
-    },
-    async branchProtectionContexts(repo, branch) {
-      const r = await spawn2(
-        "gh",
-        [
-          "api",
-          `repos/${repo}/branches/${branch}/protection`,
-          "--jq",
-          ".required_status_checks.contexts[]?"
-        ],
-        { env, timeoutMs: 6e4 }
+      await spawn2("pnpm", ["install"], { cwd: site.path, streaming: true });
+      const outdated = await spawn2(
+        "pnpm",
+        ["outdated", "--json", ...outdatedFlagsForGroup(group)],
+        { cwd: site.path }
       );
-      if (r.code !== 0) return [];
-      return r.stdout.split("\n").map((l) => l.trim()).filter((l) => l.length > 0);
-    },
-    async secretExists(repo, name) {
-      const out = await gh(["api", `repos/${repo}/actions/secrets`, "--jq", ".secrets[].name"]);
-      return out.split("\n").map((l) => l.trim()).includes(name);
-    },
-    async autoMergeEnabled(repo) {
-      const out = await gh(["api", `repos/${repo}`, "--jq", ".allow_auto_merge"]);
-      return out.trim() === "true";
-    },
-    async findOpenSelfUpdatingPR(repo) {
-      const out = await gh([
-        "api",
-        `repos/${repo}/pulls?state=open`,
-        "--jq",
-        '.[] | select(.head.ref | startswith("maint/self-updating-")) | .html_url'
-      ]);
-      const first = out.split("\n").map((l) => l.trim()).find((l) => l.length > 0);
-      return first ?? null;
-    },
-    async openPullRequests(repo) {
-      const [owner, name, ...rest] = repo.split("/");
-      if (!owner || !name || rest.length > 0) {
-        throw new Error(`openPullRequests: expected "owner/repo", got "${repo}"`);
+      let parsed;
+      try {
+        parsed = JSON.parse(outdated.stdout || "{}");
+      } catch {
+        parsed = {};
       }
-      const query = "query($owner:String!,$name:String!){repository(owner:$owner,name:$name){pullRequests(states:OPEN,first:100,orderBy:{field:CREATED_AT,direction:DESC}){nodes{number title url headRefName commits(last:1){nodes{commit{statusCheckRollup{state}}}}}}}}";
-      const out = await gh([
-        "api",
-        "graphql",
-        "-f",
-        `query=${query}`,
-        "-F",
-        `owner=${owner}`,
-        "-F",
-        `name=${name}`
-      ]);
-      const parsed = JSON.parse(out);
-      const nodes = parsed.data?.repository?.pullRequests?.nodes ?? [];
-      return nodes.map((n) => ({
-        number: n.number,
-        title: n.title,
-        url: n.url,
-        headRef: n.headRefName,
-        ciState: mapRollupState(n.commits?.nodes?.[0]?.commit?.statusCheckRollup?.state)
-      }));
+      if (Object.keys(parsed).length === 0) {
+        return { kind: "noop", notes: `pnpm outdated reported nothing for group=${group}` };
+      }
+      return { kind: "apply", plan: { group } };
+    },
+    apply: async ({ group: g }, { commit: commit2, cwd }) => {
+      await spawn2("pnpm", ["up", ...upFlagsForGroup(g)], { cwd, streaming: true });
+      await commit2(`chore(deps): bump dependencies (${g})`);
+      return { kind: "ok" };
     }
-  };
+  });
+}
+
+// src/cli/commands/bump-deps.ts
+var GROUPS = ["patch", "minor", "major"];
+function formatResult2(r) {
+  if (r.status === "noop") return `[${r.site}] noop: ${r.notes ?? ""}`;
+  return `[${r.site}] applied: ${r.commits.length} commit(s)
+${r.notes ?? ""}`;
+}
+async function runBumpDepsCommand(site, opts) {
+  const group = opts.group ?? "minor";
+  if (!GROUPS.includes(group)) {
+    throw Object.assign(
+      new Error(`unknown --group: ${group}. expected one of ${GROUPS.join(", ")}`),
+      { exitCode: 2 }
+    );
+  }
+  const cwd = opts.cwd ? resolve4(opts.cwd) : process.cwd();
+  let sites = await resolveSites({
+    ...site !== void 0 ? { site } : {},
+    ...opts.fleet !== void 0 ? { fleet: opts.fleet } : {},
+    cwd
+  });
+  if (opts.fleet) {
+    const workdir = opts.workdir ?? `${process.env.HOME ?? ""}/.reddoor-maint/sites`;
+    sites = await Promise.all(sites.map((s) => cloneIfNeeded(s, { workdir })));
+  }
+  const results = [];
+  for (const s of sites) results.push(await bumpDeps(s, { group }));
+  const output = results.map(formatResult2).join("\n");
+  const code = results.some((r) => r.status === "failed") ? 1 : 0;
+  return { output, code };
+}
+
+// src/cli/commands/self-updating.ts
+import { resolve as resolve5 } from "path";
+
+// src/recipes/self-updating/index.ts
+import { mkdir as mkdir3, writeFile as writeFile4 } from "fs/promises";
+import { dirname as dirname2, join as join13 } from "path";
+
+// src/github/config.ts
+function readGitHubConfig() {
+  const token = process.env.GITHUB_TOKEN?.trim();
+  if (!token) return null;
+  const renovateToken = process.env.RENOVATE_TOKEN?.trim() || token;
+  return { token, renovateToken };
 }
 
 // src/recipes/self-updating/index.ts
+init_gh();
 var SELF_UPDATING_CONFIGS = ["ci", "renovate-action", "renovate-config"];
 var REQUIRED_CHECK = "ci / ci";
 function resultOf(site, status, notes, commits = []) {
@@ -3493,6 +4161,9 @@ function bumpDep(pkg, name, version2, opts = {}) {
   return next;
 }
 
+// src/recipes/svelte-5/index.ts
+init_spawn();
+
 // src/recipes/svelte-5/step-bump-versions.ts
 import { join as join14 } from "path";
 var SVELTE_5_VERSIONS = {
@@ -3577,6 +4248,7 @@ async function migrateSvelteConfig(cwd) {
 }
 
 // src/recipes/svelte-5/step-svelte-migrate.ts
+init_spawn();
 async function runSvelteMigrate(cwd, spawn2 = defaultSpawn) {
   try {
     const { code, stderr } = await spawn2(
@@ -3598,6 +4270,7 @@ async function runSvelteMigrate(cwd, spawn2 = defaultSpawn) {
 }
 
 // src/recipes/svelte-5/step-tailwind-upgrade.ts
+init_spawn();
 import { join as join16 } from "path";
 async function upgradeTailwind(cwd, spawn2 = defaultSpawn) {
   const pkg = await readPackageJson(join16(cwd, "package.json"));
@@ -3984,6 +4657,7 @@ async function applyGotchaCodemods(cwd) {
 }
 
 // src/recipes/svelte-5/step-verify.ts
+init_spawn();
 async function verifyMigration(cwd, spawn2 = defaultSpawn) {
   let install;
   try {
@@ -4123,6 +4797,7 @@ import { resolve as resolve7 } from "path";
 // src/recipes/convert-to-pnpm.ts
 import { rm as rm3, stat as stat4 } from "fs/promises";
 import { join as join20 } from "path";
+init_spawn();
 
 // src/recipes/convert-to-pnpm/script-rewrites.ts
 function rewriteScriptForPnpm(script) {
@@ -4235,6 +4910,7 @@ import { resolve as resolve8 } from "path";
 // src/recipes/onboard.ts
 import { stat as stat5 } from "fs/promises";
 import { join as join22 } from "path";
+init_spawn();
 
 // src/util/self-version.ts
 import { readFileSync as readFileSync2, existsSync as existsSync2 } from "fs";
@@ -4520,10 +5196,17 @@ function findDueReports(websites, reports, today) {
   }
   return out;
 }
+function reportPeriodKey(dueDate) {
+  if (Number.isNaN(dueDate.getTime())) throw new TypeError("reportPeriodKey: invalid Date");
+  const year = dueDate.getUTCFullYear();
+  const month = String(dueDate.getUTCMonth() + 1).padStart(2, "0");
+  return `${year}-${month}`;
+}
 
 // src/reports/draft.ts
 init_render();
 init_websites();
+init_copy();
 init_reports();
 init_attachments();
 import { mkdir as mkdir4, writeFile as writeFile10 } from "fs/promises";
@@ -4684,6 +5367,7 @@ async function draftReportForSite(base, siteRow, reportType, options = {}) {
     searchPosition: search?.foundOnPage1 ? search.position ?? void 0 : void 0,
     lastTestedDate,
     commentary: null,
+    copy: resolveCopy(siteRow),
     headerImageCid: cidName
   });
   if (options.previewOnly) {
@@ -4698,6 +5382,7 @@ async function draftReportForSite(base, siteRow, reportType, options = {}) {
     reportId,
     siteId: siteRow.id,
     reportType,
+    period: options.period ?? periodEnd.toISOString().slice(0, 7),
     periodStart,
     periodEnd,
     completedOn,
@@ -4760,7 +5445,14 @@ async function derivePeriodStart(base, siteRow, reportType, today) {
 }
 
 // src/cli/commands/report.ts
+function dashboardBaseUrl() {
+  return process.env.DASHBOARD_BASE_URL?.trim() || "https://reddoor-maintenance.netlify.app";
+}
 async function runReportCommand(slug, opts) {
+  if (opts.digest) {
+    const { runDigest: runDigest2 } = await Promise.resolve().then(() => (init_digest(), digest_exports));
+    return runDigest2({ baseUrl: dashboardBaseUrl() });
+  }
   if (opts.sendReady) {
     const { sendApprovedReports: sendApprovedReports2 } = await Promise.resolve().then(() => (init_orchestrate(), orchestrate_exports));
     return sendApprovedReports2();
@@ -4772,7 +5464,7 @@ async function runReportCommand(slug, opts) {
     return runSingleSiteDraft(slug, { previewOnly: Boolean(opts.preview) });
   }
   throw Object.assign(
-    new Error("Usage: reddoor-maint report [<slug>] [--due] [--preview] [--send-ready]"),
+    new Error("Usage: reddoor-maint report [<slug>] [--due] [--preview] [--send-ready] [--digest]"),
     {
       exitCode: 2
     }
@@ -4780,25 +5472,38 @@ async function runReportCommand(slug, opts) {
 }
 async function runDueDraft() {
   const base = openBase(readAirtableConfig());
+  return draftDueReports(base, /* @__PURE__ */ new Date());
+}
+async function draftDueReports(base, today) {
   const websites = await listWebsites(base);
-  const reports = [];
-  for (const w of websites) {
-    const rs = await listReportsForSite(base, w.id);
-    reports.push(...rs);
-  }
-  const due = findDueReports(websites, reports, /* @__PURE__ */ new Date());
+  const reports = await listAllReports(base);
+  const due = findDueReports(websites, reports, today);
   if (due.length === 0) return { output: "No reports due.", code: 0 };
   const lines = [];
   let softFailedSites = 0;
+  let skipped = 0;
   for (const item of due) {
+    const period = reportPeriodKey(item.dueDate);
+    const already = reports.some(
+      (r) => r.siteId === item.site.id && r.reportType === item.reportType && r.period === period
+    );
+    if (already) {
+      skipped++;
+      lines.push(`\u2022 skipped (already drafted ${period}): ${item.site.name} ${item.reportType}`);
+      continue;
+    }
     try {
-      const result = await draftReportForSite(base, item.site, item.reportType);
+      const result = await draftReportForSite(base, item.site, item.reportType, { period });
       lines.push(`\u2713 drafted: ${result.reportRow?.reportId}`);
+      if (result.reportRow) reports.push(result.reportRow);
       if (result.softFailures.length > 0) softFailedSites++;
     } catch (e) {
       lines.push(`\u2717 failed: ${item.site.name} ${item.reportType} \u2014 ${e.message}`);
     }
   }
+  if (skipped > 0) {
+    lines.push(`\u2022 ${skipped} already drafted this period`);
+  }
   if (softFailedSites > 0) {
     lines.push(
       `\u26A0 ${softFailedSites} site${softFailedSites === 1 ? "" : "s"} had GA/Search enrichment fail \u2014 drafted with blank analytics; check the logs above`
@@ -4984,6 +5689,256 @@ async function runInitCommand(site, opts) {
   return { output, code };
 }
 
+// src/cli/commands/launch.ts
+import { resolve as resolve11 } from "path";
+
+// src/recipes/launch.ts
+init_lighthouse_airtable();
+init_write_audits_to_airtable();
+init_client();
+init_websites();
+init_reports();
+init_attachments();
+init_render();
+init_copy();
+async function launch(site, deps = {}) {
+  const label = siteLabel(site);
+  const bootstrap = deps.bootstrap ?? selfUpdating;
+  const audit = deps.audit ?? runAudits;
+  const base = deps.base ?? openBase(readAirtableConfig());
+  const steps = [];
+  const stop = () => ({ site: label, steps, complete: false });
+  let recipe;
+  try {
+    recipe = await bootstrap(site);
+  } catch (err) {
+    steps.push({ name: "self-updating", result: errorOf(err) });
+    return stop();
+  }
+  steps.push({ name: "self-updating", result: { kind: "recipe", result: recipe } });
+  if (recipe.status === "failed") return stop();
+  let results;
+  try {
+    results = await audit(site);
+  } catch (err) {
+    steps.push({ name: "audit", result: errorOf(err) });
+    return stop();
+  }
+  const lhResult = results.find((r) => r.audit === "lighthouse");
+  if (!lhResult || !hasRealScores(lhResult)) {
+    steps.push({
+      name: "audit",
+      result: { kind: "error", message: "lighthouse audit produced no real scores" }
+    });
+    return stop();
+  }
+  const scores = lighthouseScoresFromResult(lhResult);
+  const websites = await listWebsites(base);
+  const target = websites.find((w) => siteSlug(w.name) === siteSlug(label));
+  if (!target) {
+    steps.push({
+      name: "audit",
+      result: { kind: "error", message: `no Websites row matched site "${label}"` }
+    });
+    return stop();
+  }
+  try {
+    await writeAuditsToAirtable({ base, websites, slug: siteSlug(target.name), results });
+  } catch (err) {
+    steps.push({ name: "audit", result: errorOf(err) });
+    return stop();
+  }
+  steps.push({ name: "audit", result: { kind: "audit", results, scores } });
+  const today = /* @__PURE__ */ new Date();
+  const period = today.toISOString().slice(0, 7);
+  const slug = siteSlug(target.name);
+  let report;
+  try {
+    const existing = await findReportByPeriod(base, target.id, "Launch", period);
+    report = existing ?? await createDraft(base, draftInputFor(target, scores, today, period));
+  } catch (err) {
+    steps.push({ name: "draft", result: errorOf(err) });
+    return stop();
+  }
+  try {
+    const { html } = await renderReportHtml({
+      siteName: target.name,
+      siteUrl: target.url,
+      reportType: "Launch",
+      completedOn: today,
+      lighthouse: scores,
+      lastTestedDate: null,
+      commentary: null,
+      copy: resolveCopy(target),
+      headerImageCid: `${slug}-header`
+    });
+    try {
+      await uploadAttachment(
+        report.id,
+        "Rendered HTML",
+        html,
+        `${slug}-${today.toISOString().slice(0, 10)}.html`,
+        "text/html"
+      );
+    } catch (uploadErr) {
+      console.warn(
+        `\u26A0 Launch preview upload skipped for ${target.name}: ${uploadErr instanceof Error ? uploadErr.message : String(uploadErr)}`
+      );
+    }
+    await setDraftReady(base, report.id, true);
+  } catch (err) {
+    steps.push({ name: "draft", result: errorOf(err) });
+    return stop();
+  }
+  steps.push({ name: "draft", result: { kind: "draft", report } });
+  return { site: label, steps, complete: true };
+}
+function draftInputFor(target, scores, today, period) {
+  const reportType = "Launch";
+  const reportId = `${target.name} \u2014 ${reportType} \u2014 ${today.toISOString().slice(0, 10)}`;
+  return {
+    reportId,
+    siteId: target.id,
+    reportType,
+    period,
+    periodStart: today,
+    periodEnd: today,
+    completedOn: today,
+    lighthouse: scores,
+    lastTestedDate: null
+  };
+}
+function errorOf(err) {
+  return { kind: "error", message: err instanceof Error ? err.message : String(err) };
+}
+
+// src/cli/commands/launch.ts
+function formatStep2(name, r) {
+  if (r.kind === "error") return `${name.padEnd(20)} error: ${r.message}`;
+  if (r.kind === "audit") {
+    const s = r.scores;
+    return `${name.padEnd(20)} audited (P=${s.performance} A=${s.accessibility} BP=${s.bestPractices} SEO=${s.seo})`;
+  }
+  if (r.kind === "draft") {
+    return `${name.padEnd(20)} drafted ${r.report.reportId}`;
+  }
+  const rec = r.result;
+  if (rec.status === "noop") return `${name.padEnd(20)} noop${rec.notes ? ` \u2014 ${rec.notes}` : ""}`;
+  if (rec.status === "failed")
+    return `${name.padEnd(20)} failed${rec.notes ? ` \u2014 ${rec.notes}` : ""}`;
+  return `${name.padEnd(20)} applied (${rec.commits.length} commit${rec.commits.length === 1 ? "" : "s"})${rec.notes ? ` \u2014 ${rec.notes}` : ""}`;
+}
+function formatResult9(r) {
+  const header = `[${r.site}] launch \u2014 ${r.complete ? "drafted (awaiting approval)" : "STOPPED"}`;
+  const body = r.steps.map((s) => formatStep2(s.name, s.result)).join("\n");
+  return `${header}
+${body}`;
+}
+async function runLaunchCommand(site, opts) {
+  const cwd = opts.cwd ? resolve11(opts.cwd) : process.cwd();
+  const sites = await resolveSites({ site, cwd });
+  const target = sites[0];
+  if (!target) {
+    return { output: `No site resolved for "${site}".`, code: 1 };
+  }
+  const result = await launch(target);
+  return { output: formatResult9(result), code: result.complete ? 0 : 1 };
+}
+
+// src/cli/commands/github-signals.ts
+init_client();
+init_websites();
+
+// src/audits/github-signals.ts
+init_renovate();
+async function collectGitHubSignals(sites, deps, onSkip = () => {
+}) {
+  const rows = [];
+  for (const s of sites) {
+    const repo = s.gitRepo;
+    if (!repo) continue;
+    const name = s.name;
+    if (!name) continue;
+    try {
+      const prs = await deps.openPullRequests(repo);
+      const status = await deps.defaultBranchStatus(repo);
+      rows.push({
+        site: name,
+        repo,
+        renovateFailingCis: prs.filter(isFailingRenovatePR).length,
+        ciState: status.ciState,
+        lastCommitAt: status.lastCommitAt
+      });
+    } catch {
+      onSkip({ repo });
+    }
+  }
+  return rows;
+}
+
+// src/cli/commands/github-signals.ts
+init_gh();
+init_write_audits_to_airtable();
+async function runGitHubSignalsCommand(opts) {
+  if (!opts.fleet || !opts.writeAirtable) {
+    return { output: "github-signals currently supports only --fleet --write-airtable", code: 2 };
+  }
+  const token = process.env.RENOVATE_TOKEN?.trim() || process.env.GH_TOKEN?.trim();
+  if (!token) {
+    return {
+      output: "github-signals skipped: no RENOVATE_TOKEN/GH_TOKEN (fleet read) configured.",
+      code: 0
+    };
+  }
+  const base = openBase(readAirtableConfig());
+  const websites = await listWebsites(base);
+  const gh = makeGitHub({ token });
+  const sites = websites.map((w) => ({
+    path: "",
+    name: w.name,
+    meta: {},
+    ...w.gitRepo ? { gitRepo: w.gitRepo } : {}
+  }));
+  const skipped = [];
+  const rows = await collectGitHubSignals(
+    sites,
+    {
+      openPullRequests: (r) => gh.openPullRequests(r),
+      defaultBranchStatus: (r) => gh.defaultBranchStatus(r)
+    },
+    ({ repo }) => skipped.push(repo)
+  );
+  const sweptAt = (/* @__PURE__ */ new Date()).toISOString();
+  const result = { written: [], failed: [] };
+  const byRepo = new Map(websites.filter((w) => w.gitRepo).map((w) => [w.gitRepo, w]));
+  for (const row of rows) {
+    const target = byRepo.get(row.repo);
+    if (!target) {
+      result.failed.push({ slug: siteSlug(row.site), error: "no Websites row matched" });
+      continue;
+    }
+    try {
+      await updateGitHubSignals(base, target.id, {
+        renovateFailingCis: row.renovateFailingCis,
+        ciState: row.ciState,
+        lastCommitAt: row.lastCommitAt,
+        sweptAt
+      });
+      result.written.push({
+        siteName: target.name,
+        writes: [{ audit: "github-signals", counts: row }]
+      });
+    } catch (e) {
+      result.failed.push({ slug: siteSlug(row.site), error: e.message });
+    }
+  }
+  for (const repo of skipped) result.failed.push({ slug: repo, error: "probe failed (skipped)" });
+  return {
+    output: formatFleetWriteSummary(result),
+    code: result.failed.length > 0 && result.written.length === 0 ? 1 : 0
+  };
+}
+
 // src/cli/version.ts
 import { readFileSync as readFileSync5, existsSync as existsSync4 } from "fs";
 import { dirname as dirname8, join as join27 } from "path";
@@ -5126,15 +6081,33 @@ cli.command(
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(() => runInitCommand(site, opts), opts)
 );
+cli.command(
+  "launch <site>",
+  "Bootstrap + first-audit a site, then draft its launch email for approval."
+).action(
+  async (site, opts) => runOrExit(() => runLaunchCommand(site, opts), opts)
+);
 cli.command("report [site]", "Draft or send maintenance/testing reports.").option("--due", "Scan all Websites and draft overdue reports.").option(
   "--preview",
   "Single-site dry run; writes reports/<slug>/draft.html, never touches Airtable."
 ).option(
   "--send-ready",
   "Send all Reports with Draft ready=true AND Approved to send=true AND Sent at IS NULL."
+).option(
+  "--digest",
+  "Email the operator one daily digest of reports ready for approval (skips when empty)."
 ).action(
   async (site, opts) => runOrExit(() => runReportCommand(site, opts), opts)
 );
+cli.command(
+  "github-signals",
+  "Sweep the fleet for GitHub signals (Renovate-failing/CI/last-commit) and write Airtable."
+).option("--fleet", "Run across every site in the Airtable inventory.").option("--write-airtable", "Write each site's signals back to its Websites row.").action(
+  async (opts) => runOrExit(
+    () => runGitHubSignalsCommand({ fleet: opts.fleet, writeAirtable: opts.writeAirtable }),
+    opts
+  )
+);
 cli.help();
 cli.version(version);
 cli.parse();