@reddoorla/maintenance 0.32.0 → 0.33.0

package/dist/cli/bin.js

@@ -57,6 +57,79 @@ var init_credentials = __esm({
   }
 });
 
+// src/audits/util/spawn.ts
+import { spawn } from "child_process";
+function makeSpawn(internals = {}) {
+  const spawnImpl = internals.spawnImpl ?? spawn;
+  const killImpl = internals.killImpl ?? ((pid, sig) => process.kill(pid, sig));
+  const killGraceMs = internals.killGraceMs ?? 5e3;
+  const maxOutputBytes = internals.maxOutputBytes ?? 10 * 1024 * 1024;
+  return (cmd, args, opts = {}) => new Promise((resolve12, reject) => {
+    const streaming = opts.streaming === true;
+    const child = spawnImpl(cmd, [...args], {
+      cwd: opts.cwd,
+      env: opts.env ?? process.env,
+      stdio: streaming ? ["ignore", "inherit", "inherit"] : ["ignore", "pipe", "pipe"],
+      // Detach ONLY when a timeout can fire: the child then leads its own
+      // process group, so the timeout can kill the WHOLE tree (vite, and
+      // Chromium under lhci/playwright) via process.kill(-pid), not just the
+      // npx/pnpm wrapper. Without it, killing the wrapper orphaned the
+      // grandchildren — a zombie vite squatting its port, Chrome left running.
+      // We do NOT detach timeout-less streaming calls (pnpm install/up):
+      // detaching gains nothing there (no timeout → no group-kill) and would
+      // break terminal Ctrl-C, which only reaches the foreground group — i.e.
+      // it would re-orphan the very children this guards. We never unref() the
+      // child since we still await it.
+      detached: opts.timeoutMs !== void 0
+    });
+    const cap = (acc, chunk) => {
+      if (acc.length >= maxOutputBytes) return acc;
+      const next = acc + chunk;
+      return next.length > maxOutputBytes ? next.slice(0, maxOutputBytes) + TRUNCATION_MARKER : next;
+    };
+    let stdout = "";
+    let stderr = "";
+    if (!streaming) {
+      child.stdout?.on("data", (chunk) => stdout = cap(stdout, String(chunk)));
+      child.stderr?.on("data", (chunk) => stderr = cap(stderr, String(chunk)));
+    }
+    const killGroup = (sig) => {
+      if (child.pid === void 0) return;
+      try {
+        killImpl(-child.pid, sig);
+      } catch {
+      }
+    };
+    let killTimer;
+    const timer = opts.timeoutMs ? setTimeout(() => {
+      killGroup("SIGTERM");
+      killTimer = setTimeout(() => killGroup("SIGKILL"), killGraceMs);
+      killTimer.unref();
+      reject(new Error(`spawn timeout after ${opts.timeoutMs}ms: ${cmd}`));
+    }, opts.timeoutMs) : void 0;
+    const clearTimers = () => {
+      if (timer) clearTimeout(timer);
+      if (killTimer) clearTimeout(killTimer);
+    };
+    child.on("error", (err) => {
+      clearTimers();
+      reject(err);
+    });
+    child.on("close", (code) => {
+      clearTimers();
+      resolve12({ code: code ?? -1, stdout, stderr });
+    });
+  });
+}
+var TRUNCATION_MARKER, defaultSpawn;
+var init_spawn = __esm({
+  "src/audits/util/spawn.ts"() {
+    "use strict";
+    TRUNCATION_MARKER = "\n\u2026[output truncated]";
+    defaultSpawn = makeSpawn();
+  }
+});
+
 // src/reports/airtable/client.ts
 var client_exports = {};
 __export(client_exports, {
@@ -99,12 +172,19 @@ __export(websites_exports, {
   siteSlug: () => siteSlug,
   updateA11yCounts: () => updateA11yCounts,
   updateDepsCounts: () => updateDepsCounts,
+  updateGitHubSignals: () => updateGitHubSignals,
+  updateLaunched: () => updateLaunched,
   updateScores: () => updateScores,
   updateSecurityCounts: () => updateSecurityCounts
 });
 function siteSlug(name) {
   return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
 }
+function trimToNull(raw) {
+  if (typeof raw !== "string") return null;
+  const trimmed = raw.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
 function mapRow(rec) {
   const f = rec.fields;
   const attachments = f["Header image"] ?? [];
@@ -144,7 +224,15 @@ function mapRow(rec) {
       if (typeof raw !== "string") return null;
       const trimmed = raw.trim();
       return trimmed.length > 0 ? trimmed : null;
-    })()
+    })(),
+    copyIntro: trimToNull(f["Copy \u2014 Intro"]),
+    copyContact: trimToNull(f["Copy \u2014 Contact"]),
+    copyFooter: trimToNull(f["Copy \u2014 Footer"]),
+    launchedAt: f["Launched at"] ?? null,
+    renovateFailingCis: f["Renovate Failing CIs"] ?? null,
+    defaultBranchCi: f["Default Branch CI"] ?? null,
+    lastCommitAt: f["Last Commit At"] ?? null,
+    githubSignalsAt: f["GitHub Signals At"] ?? null
   };
 }
 async function listWebsites(base) {
@@ -202,6 +290,21 @@ async function updateSecurityCounts(base, recordId, counts) {
   };
   await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);
 }
+async function updateGitHubSignals(base, recordId, signals) {
+  const fields = {
+    "Renovate Failing CIs": signals.renovateFailingCis,
+    "Default Branch CI": signals.ciState,
+    "GitHub Signals At": signals.sweptAt
+  };
+  if (signals.lastCommitAt !== null) {
+    fields["Last Commit At"] = signals.lastCommitAt;
+  }
+  await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);
+}
+async function updateLaunched(base, recordId, at) {
+  const fields = { Status: "maintenance", "Launched at": at };
+  await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);
+}
 var WEBSITES_TABLE;
 var init_websites = __esm({
   "src/reports/airtable/websites.ts"() {
@@ -463,6 +566,186 @@ var init_write_audits_to_airtable = __esm({
   }
 });
 
+// src/github/gh.ts
+function mapRollupState(state) {
+  switch (state) {
+    case "SUCCESS":
+      return "passing";
+    case "FAILURE":
+    case "ERROR":
+      return "failing";
+    case "PENDING":
+    case "EXPECTED":
+      return "pending";
+    default:
+      return "none";
+  }
+}
+function makeGitHub(deps) {
+  const spawn2 = deps.spawn ?? defaultSpawn;
+  const env = { ...process.env, GH_TOKEN: deps.token };
+  async function gh(args) {
+    const r = await spawn2("gh", args, { env, timeoutMs: 6e4 });
+    if (r.code !== 0) throw new Error(`gh ${args[0]} failed (code ${r.code}): ${r.stderr.trim()}`);
+    return r.stdout;
+  }
+  return {
+    async openPullRequest(repo, pr) {
+      const out = await gh([
+        "pr",
+        "create",
+        "--repo",
+        repo,
+        "--head",
+        pr.head,
+        "--base",
+        pr.base,
+        "--title",
+        pr.title,
+        "--body",
+        pr.body
+      ]);
+      return { url: out.trim() };
+    },
+    async enableRepoAutoMerge(repo) {
+      await gh(["api", "-X", "PATCH", `repos/${repo}`, "-F", "allow_auto_merge=true"]);
+    },
+    async protectBranch(repo, branch, requiredChecks) {
+      const args = [
+        "api",
+        "-X",
+        "PUT",
+        `repos/${repo}/branches/${branch}/protection`,
+        "-H",
+        "Accept: application/vnd.github+json",
+        "-F",
+        "required_status_checks[strict]=true",
+        ...requiredChecks.flatMap((c) => ["-f", `required_status_checks[contexts][]=${c}`]),
+        "-F",
+        "enforce_admins=true",
+        "-F",
+        "required_pull_request_reviews=null",
+        "-F",
+        "restrictions=null"
+      ];
+      await gh(args);
+    },
+    async setRepoSecret(repo, name, value) {
+      await gh(["secret", "set", name, "--repo", repo, "--body", value]);
+    },
+    async repoExists(repo) {
+      const r = await spawn2("gh", ["api", `repos/${repo}`], { env, timeoutMs: 6e4 });
+      return r.code === 0;
+    },
+    async defaultBranch(repo) {
+      const out = await gh(["api", `repos/${repo}`, "--jq", ".default_branch"]);
+      return out.trim();
+    },
+    // filesOnBranch and branchProtectionContexts call `spawn` directly (not the
+    // throwing `gh()` helper) because a 404 is an expected, meaningful answer —
+    // "file/protection absent" — not an error. The remaining readers use `gh()`
+    // since a non-200 there is a genuine failure (e.g. missing token scope).
+    async filesOnBranch(repo, branch, paths) {
+      const present = [];
+      for (const p of paths) {
+        const r = await spawn2("gh", [`api`, `repos/${repo}/contents/${p}?ref=${branch}`], {
+          env,
+          timeoutMs: 6e4
+        });
+        if (r.code === 0) present.push(p);
+      }
+      return present;
+    },
+    async branchProtectionContexts(repo, branch) {
+      const r = await spawn2(
+        "gh",
+        [
+          "api",
+          `repos/${repo}/branches/${branch}/protection`,
+          "--jq",
+          ".required_status_checks.contexts[]?"
+        ],
+        { env, timeoutMs: 6e4 }
+      );
+      if (r.code !== 0) return [];
+      return r.stdout.split("\n").map((l) => l.trim()).filter((l) => l.length > 0);
+    },
+    async secretExists(repo, name) {
+      const out = await gh(["api", `repos/${repo}/actions/secrets`, "--jq", ".secrets[].name"]);
+      return out.split("\n").map((l) => l.trim()).includes(name);
+    },
+    async autoMergeEnabled(repo) {
+      const out = await gh(["api", `repos/${repo}`, "--jq", ".allow_auto_merge"]);
+      return out.trim() === "true";
+    },
+    async findOpenSelfUpdatingPR(repo) {
+      const out = await gh([
+        "api",
+        `repos/${repo}/pulls?state=open`,
+        "--jq",
+        '.[] | select(.head.ref | startswith("maint/self-updating-")) | .html_url'
+      ]);
+      const first = out.split("\n").map((l) => l.trim()).find((l) => l.length > 0);
+      return first ?? null;
+    },
+    async openPullRequests(repo) {
+      const [owner, name, ...rest] = repo.split("/");
+      if (!owner || !name || rest.length > 0) {
+        throw new Error(`openPullRequests: expected "owner/repo", got "${repo}"`);
+      }
+      const query = "query($owner:String!,$name:String!){repository(owner:$owner,name:$name){pullRequests(states:OPEN,first:100,orderBy:{field:CREATED_AT,direction:DESC}){nodes{number title url headRefName commits(last:1){nodes{commit{statusCheckRollup{state}}}}}}}}";
+      const out = await gh([
+        "api",
+        "graphql",
+        "-f",
+        `query=${query}`,
+        "-F",
+        `owner=${owner}`,
+        "-F",
+        `name=${name}`
+      ]);
+      const parsed = JSON.parse(out);
+      const nodes = parsed.data?.repository?.pullRequests?.nodes ?? [];
+      return nodes.map((n) => ({
+        number: n.number,
+        title: n.title,
+        url: n.url,
+        headRef: n.headRefName,
+        ciState: mapRollupState(n.commits?.nodes?.[0]?.commit?.statusCheckRollup?.state)
+      }));
+    },
+    async defaultBranchStatus(repo) {
+      const [owner, name, ...rest] = repo.split("/");
+      if (!owner || !name || rest.length > 0) {
+        throw new Error(`defaultBranchStatus: expected "owner/repo", got "${repo}"`);
+      }
+      const query = "query($owner:String!,$name:String!){repository(owner:$owner,name:$name){defaultBranchRef{target{... on Commit{committedDate statusCheckRollup{state}}}}}}";
+      const out = await gh([
+        "api",
+        "graphql",
+        "-f",
+        `query=${query}`,
+        "-F",
+        `owner=${owner}`,
+        "-F",
+        `name=${name}`
+      ]);
+      const parsed = JSON.parse(out);
+      const target = parsed.data?.repository?.defaultBranchRef?.target;
+      return {
+        ciState: mapRollupState(target?.statusCheckRollup?.state),
+        lastCommitAt: target?.committedDate ?? null
+      };
+    }
+  };
+}
+var init_gh = __esm({
+  "src/github/gh.ts"() {
+    "use strict";
+    init_spawn();
+  }
+});
+
 // src/reports/airtable/reports.ts
 function mapRow2(rec) {
   const f = rec.fields;
@@ -507,6 +790,9 @@ function lighthouseFromFields(f) {
 function ymd(d) {
   return d.toISOString().slice(0, 10);
 }
+function escapeFormulaString(s) {
+  return s.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+}
 async function createDraft(base, input) {
   const fields = {
     "Report ID": input.reportId,
@@ -568,6 +854,17 @@ async function stampSent(base, recordId, sentAt, messageId) {
     }
   ]);
 }
+async function findReportByPeriod(base, siteId, reportType, period) {
+  const safeType = escapeFormulaString(reportType);
+  const safePeriod = escapeFormulaString(period);
+  const formula = `AND({Report type} = "${safeType}", {Period} = "${safePeriod}")`;
+  const rows = [];
+  await base(REPORTS_TABLE).select({ filterByFormula: formula, pageSize: 100 }).eachPage((records, fetchNextPage) => {
+    for (const rec of records) rows.push(mapRow2({ id: rec.id, fields: rec.fields }));
+    fetchNextPage();
+  });
+  return rows.find((r) => r.siteId === siteId) ?? null;
+}
 var REPORTS_TABLE;
 var init_reports = __esm({
   "src/reports/airtable/reports.ts"() {
@@ -576,6 +873,67 @@ var init_reports = __esm({
   }
 });
 
+// src/reports/copy.ts
+function override(v) {
+  if (typeof v !== "string") return null;
+  const t = v.trim();
+  return t.length > 0 ? t : null;
+}
+function splitLines(s) {
+  return s.split(/\r?\n/).filter((l) => l.trim().length > 0);
+}
+function resolveCopy(site) {
+  const intro = override(site.copyIntro);
+  const contact = override(site.copyContact);
+  const footer = override(site.copyFooter);
+  const footerLines = footer ? splitLines(footer) : null;
+  return {
+    ...DEFAULT_COPY,
+    maintenanceIntro: intro ?? DEFAULT_COPY.maintenanceIntro,
+    contact: contact ? splitLines(contact) : DEFAULT_COPY.contact,
+    footerOrg: footerLines?.[0] ?? DEFAULT_COPY.footerOrg,
+    footerAddress: footerLines ? footerLines.slice(1) : DEFAULT_COPY.footerAddress
+  };
+}
+var DEFAULT_COPY;
+var init_copy = __esm({
+  "src/reports/copy.ts"() {
+    "use strict";
+    DEFAULT_COPY = {
+      maintenanceIntro: "Includes checking the hosting, DNS, Content Management System (CMS, if applicable), search indexing and security of the site for major flaws and updating as necessary.",
+      maintenanceChecks: [
+        "Reviewed Logs",
+        "CMS Checked",
+        "DNS Checked",
+        "Google Indexed",
+        "Reviewed Certificate",
+        "Security Updates"
+      ],
+      testingIntro: "Testing includes checks similar to those at launch: testing on common browsers and operating systems, at different screen sizes, and checking every function, and updating all packages for performance rather than just those needed for security.",
+      testingChecklist: [
+        "Desktop Browsers",
+        "Mobile Browsers",
+        "Package Updates",
+        "Bottlenecks",
+        "Form Functionality",
+        "Animation Functionality"
+      ],
+      notesHeader: "NOTES",
+      seoCta: "Contact us if you are interested in more in-depth data or have questions about SEO.",
+      contact: ["Just hit reply.", "We're here to help in any way we can."],
+      footerOrg: "Reddoor Creative, LLC",
+      footerAddress: ["29027 Dapper Dan", "Fair Oaks Ranch, TX 78015"],
+      launchHeading: "LAUNCHED",
+      launchBody: "Your site is live. We've set it up on the Reddoor stack with hosting, security, and automatic maintenance so it stays fast and healthy. Here's what's in place:",
+      launchSetupItems: [
+        "Hosting, DNS, and SSL configured",
+        "Continuous integration + automatic dependency updates",
+        "Analytics and uptime monitoring"
+      ]
+    };
+  }
+});
+
 // src/reports/maintenance-email/assets/index.ts
 import { readFile as readFile13 } from "fs/promises";
 import { existsSync as existsSync3 } from "fs";
@@ -665,16 +1023,9 @@ function analyticsTrendLine(cur, prev) {
   if (pct < 0) return trendText(TREND_NEUTRAL, `\u25BC ${Math.abs(pct)}% vs last period ${range}`);
   return trendText(TREND_NEUTRAL, `No change vs last period (${fmtUsers(prev)})`);
 }
-function maintenanceChecksSection(searchPosition) {
-  const googleLabel = searchPosition !== void 0 ? `Page 1 Google Result (#${searchPosition})` : "Google Indexed";
-  const rows = [
-    "Reviewed Logs",
-    "CMS Checked",
-    "DNS Checked",
-    googleLabel,
-    "Reviewed Certificate",
-    "Security Updates"
-  ];
+function maintenanceChecksSection(copy, searchPosition) {
+  const googleLabel = searchPosition !== void 0 ? `Page 1 Google Result (#${searchPosition})` : copy.maintenanceChecks[3];
+  const rows = copy.maintenanceChecks.map((label, i) => i === 3 ? googleLabel : label);
   return rows.map(
     (label, i) => `
     <mj-section background-color="white" padding="0px"${i === rows.length - 1 ? ' padding-bottom="36px"' : ""}>
@@ -689,15 +1040,8 @@ function maintenanceChecksSection(searchPosition) {
     </mj-section>`
   ).join("");
 }
-function testingChecklistSection() {
-  const rows = [
-    "Desktop Browsers",
-    "Mobile Browsers",
-    "Package Updates",
-    "Bottlenecks",
-    "Form Functionality",
-    "Animation Functionality"
-  ];
+function testingChecklistSection(copy) {
+  const rows = copy.testingChecklist;
   return rows.map(
     (label, i) => `
     <mj-section background-color="#F4F4F4" padding="0px"${i === rows.length - 1 ? ' padding-bottom="60px"' : ""}>
@@ -725,20 +1069,20 @@ function maintenanceTestingPlaceholder(lastTested) {
       </mj-column>
     </mj-section>`;
 }
-function testingIntroSection() {
+function testingIntroSection(copy) {
   return `
     <mj-section background-color="#F4F4F4">
       <mj-column>
         <mj-text color="#C00" font-size="20px" font-weight="700" padding-top="75px">TESTING</mj-text>
-        <mj-text color="#757575" font-family="helvetica, sans-serif" font-size="16px" font-weight="300" line-height="24px">Testing includes checks similar to those at launch: testing on common browsers and operating systems, at different screen sizes, and checking every function, and updating all packages for performance rather than just those needed for security.</mj-text>
+        <mj-text color="#757575" font-family="helvetica, sans-serif" font-size="16px" font-weight="300" line-height="24px">${escapeXml(copy.testingIntro)}</mj-text>
       </mj-column>
     </mj-section>`;
 }
-function commentarySection(text) {
+function commentarySection(text, copy) {
   return `
     <mj-section background-color="white">
       <mj-column>
-        <mj-text color="#C00" font-size="20px" font-weight="700" padding-top="55px">NOTES</mj-text>
+        <mj-text color="#C00" font-size="20px" font-weight="700" padding-top="55px">${escapeXml(copy.notesHeader)}</mj-text>
         <mj-text color="#757575" font-family="helvetica, sans-serif" font-size="16px" font-weight="300" line-height="24px">${escapeXml(text).replace(/\n/g, "<br/>")}</mj-text>
       </mj-column>
     </mj-section>`;
@@ -760,6 +1104,7 @@ function headerStyleBlock(data) {
   return `<mj-style>.rd-header img { height: auto !important; aspect-ratio: ${data.headerWidth} / ${data.headerHeight}; }</mj-style>`;
 }
 function buildMjml(data) {
+  const copy = data.copy ?? DEFAULT_COPY;
   const isTesting = data.reportType === "Testing";
   const previewText = `Checked up on ${escapeXml(data.siteName)}`;
   return `<mjml>
@@ -783,10 +1128,10 @@ function buildMjml(data) {
         <mj-text color="#C00" font-size="20px" font-weight="700" padding-top="75px">COMPLETED ON</mj-text>
         <mj-text color="#C00" font-size="44px" font-weight="400">${fmtDate(data.completedOn)}</mj-text>
         <mj-text color="#C00" font-size="20px" font-weight="700" padding-top="75px">MAINTENANCE CHECKS</mj-text>
-        <mj-text color="#757575" font-family="helvetica, sans-serif" font-size="16px" font-weight="300" line-height="24px">Includes checking the hosting, DNS, Content Management System (CMS, if applicable), search indexing and security of the site for major flaws and updating as necessary.</mj-text>
+        <mj-text color="#757575" font-family="helvetica, sans-serif" font-size="16px" font-weight="300" line-height="24px">${escapeXml(copy.maintenanceIntro)}</mj-text>
       </mj-column>
     </mj-section>
-    ${maintenanceChecksSection(data.searchPosition)}
+    ${maintenanceChecksSection(copy, data.searchPosition)}
     <mj-section background-color="#F4F4F4">
       <mj-column>
         <mj-text color="#C00" font-size="20px" font-weight="700" padding-top="55px">LIGHTHOUSE SCORES*</mj-text>
@@ -813,22 +1158,23 @@ function buildMjml(data) {
         <mj-text color="#C00" font-size="20px" font-weight="700" padding-top="75px">ANALYTICS</mj-text>
         <mj-text color="#C00" font-size="44px" font-weight="400">${data.gaUsersCurrent !== void 0 ? fmtUsers(data.gaUsersCurrent) : "\u2014"} Users</mj-text>
         ${analyticsTrendLine(data.gaUsersCurrent, data.gaUsersPrevious)}
-        <mj-text color="#757575" font-family="helvetica, sans-serif" font-size="12px" font-weight="300" padding-top="24px" padding-bottom="36px" line-height="20px">Contact us if you are interested in more in-depth data or have questions about SEO.</mj-text>
+        <mj-text color="#757575" font-family="helvetica, sans-serif" font-size="12px" font-weight="300" padding-top="24px" padding-bottom="36px" line-height="20px">${escapeXml(copy.seoCta)}</mj-text>
       </mj-column>
     </mj-section>
-    ${isTesting ? testingIntroSection() + testingChecklistSection() : maintenanceTestingPlaceholder(data.lastTestedDate)}
-    ${data.commentary ? commentarySection(data.commentary) : ""}
+    ${isTesting ? testingIntroSection(copy) + testingChecklistSection(copy) : maintenanceTestingPlaceholder(data.lastTestedDate)}
+    ${data.commentary ? commentarySection(data.commentary, copy) : ""}
     <mj-section background-color="white">
       <mj-column padding-top="36px">
         <mj-text color="#C00" font-family="helvetica, sans-serif" font-size="24px" font-weight="700" padding-top="36px" line-height="36px">Any questions, concerns or requests?</mj-text>
-        <mj-text font-family="helvetica, sans-serif" font-size="24px" font-weight="300" line-height="30px">Just hit reply.</mj-text>
-        <mj-text font-family="helvetica, sans-serif" font-size="24px" font-weight="300" padding-top="0px" line-height="30px" padding-bottom="36px">We're here to help in any way we can.</mj-text>
+        ${copy.contact.map(
+    (line, i) => i === copy.contact.length - 1 ? `<mj-text font-family="helvetica, sans-serif" font-size="24px" font-weight="300" padding-top="0px" line-height="30px" padding-bottom="36px">${escapeXml(line)}</mj-text>` : `<mj-text font-family="helvetica, sans-serif" font-size="24px" font-weight="300" line-height="30px">${escapeXml(line)}</mj-text>`
+  ).join("\n        ")}
         <mj-divider border-width="1px" border-style="solid" border-color="#CCCCCC" padding="0" />
         <mj-text color="#757575" font-family="helvetica, sans-serif" font-size="12px" font-weight="300" padding-top="24px" line-height="20px" font-style="italic">Copyright ${(/* @__PURE__ */ new Date()).getUTCFullYear()} Reddoor Creative, LLC. All rights reserved.</mj-text>
         <mj-text color="#757575" font-family="helvetica, sans-serif" font-size="12px" font-weight="700" line-height="16px" padding-top="0" padding-bottom="0px">Our mailing address is:</mj-text>
-        <mj-text color="#757575" font-family="helvetica, sans-serif" font-size="12px" font-weight="300" line-height="16px" padding-top="0" padding-bottom="0px">Reddoor Creative, LLC</mj-text>
-        <mj-text color="#757575" font-family="helvetica, sans-serif" font-size="12px" font-weight="300" line-height="16px" padding-top="0" padding-bottom="0px">29027 Dapper Dan</mj-text>
-        <mj-text color="#757575" font-family="helvetica, sans-serif" font-size="12px" font-weight="300" line-height="16px" padding-top="0" padding-bottom="0px">Fair Oaks Ranch, TX 78015</mj-text>
+        ${[copy.footerOrg, ...copy.footerAddress].map(
+    (line) => `<mj-text color="#757575" font-family="helvetica, sans-serif" font-size="12px" font-weight="300" line-height="16px" padding-top="0" padding-bottom="0px">${escapeXml(line)}</mj-text>`
+  ).join("\n        ")}
       </mj-column>
     </mj-section>
   </mj-body>
@@ -838,6 +1184,7 @@ var CHECK_PNG, BLURRED_TESTS, TREND_UP, TREND_NEUTRAL;
 var init_template = __esm({
   "src/reports/maintenance-email/template.ts"() {
     "use strict";
+    init_copy();
     init_assets();
     CHECK_PNG = `cid:${CHECK_CID}`;
     BLURRED_TESTS = `cid:${BLURRED_CID}`;
@@ -846,10 +1193,73 @@ var init_template = __esm({
   }
 });
 
+// src/reports/launch-email/template.ts
+function buildLaunchMjml(data) {
+  const copy = data.copy ?? DEFAULT_COPY;
+  const previewText = `${escapeXml(data.siteName)} is live`;
+  const setupRows = copy.launchSetupItems.map(
+    (item) => `
+      <mj-text color="${GREY}" font-family="helvetica, sans-serif" font-size="16px" font-weight="300" line-height="24px" padding-top="4px" padding-bottom="4px">\u2022 ${escapeXml(item)}</mj-text>`
+  ).join("");
+  const contactRows = copy.contact.map(
+    (line) => `
+      <mj-text font-family="helvetica, sans-serif" font-size="24px" font-weight="300" line-height="30px">${escapeXml(line)}</mj-text>`
+  ).join("");
+  const footerAddressRows = copy.footerAddress.map(
+    (line) => `
+      <mj-text color="${GREY}" font-family="helvetica, sans-serif" font-size="12px" font-weight="300" line-height="16px" padding-top="0" padding-bottom="0px">${escapeXml(line)}</mj-text>`
+  ).join("");
+  return `<mjml>
+  <mj-head>
+    <mj-attributes>
+      <mj-text font-family="helvetica, sans-serif" padding-left="5px" padding-right="5px" />
+      <mj-section padding-left="11%" padding-right="11%"/>
+      <mj-image padding="0px" />
+    </mj-attributes>
+    <mj-preview>${previewText}</mj-preview>
+    ${headerStyleBlock(data)}
+  </mj-head>
+  <mj-body background-color="white">
+    <mj-section background-color="#F4F4F4" padding-top="0px" padding-bottom="0px" padding-left="0px" padding-right="0px">
+      <mj-column>${headerImageTag(data)}</mj-column>
+    </mj-section>
+    <mj-section background-color="white">
+      <mj-column>
+        <mj-text color="${RED}" font-size="20px" font-weight="700" padding-top="75px">${escapeXml(copy.launchHeading)}</mj-text>
+        <mj-text color="${RED}" font-size="44px" font-weight="400">${fmtDate(data.completedOn)}</mj-text>
+        <mj-text color="${GREY}" font-family="helvetica, sans-serif" font-size="16px" font-weight="300" line-height="24px" padding-top="20px">${escapeXml(copy.launchBody)}</mj-text>
+        ${setupRows}
+      </mj-column>
+    </mj-section>
+    <mj-section background-color="white">
+      <mj-column padding-top="36px">
+        <mj-text color="${RED}" font-family="helvetica, sans-serif" font-size="24px" font-weight="700" padding-top="36px" line-height="36px">Any questions, concerns or requests?</mj-text>
+        ${contactRows}
+        <mj-divider border-width="1px" border-style="solid" border-color="#CCCCCC" padding="0" />
+        <mj-text color="${GREY}" font-family="helvetica, sans-serif" font-size="12px" font-weight="300" padding-top="24px" line-height="20px" font-style="italic">Copyright ${(/* @__PURE__ */ new Date()).getUTCFullYear()} ${escapeXml(copy.footerOrg)}. All rights reserved.</mj-text>
+        <mj-text color="${GREY}" font-family="helvetica, sans-serif" font-size="12px" font-weight="700" line-height="16px" padding-top="0" padding-bottom="0px">Our mailing address is:</mj-text>
+        <mj-text color="${GREY}" font-family="helvetica, sans-serif" font-size="12px" font-weight="300" line-height="16px" padding-top="0" padding-bottom="0px">${escapeXml(copy.footerOrg)}</mj-text>
+        ${footerAddressRows}
+      </mj-column>
+    </mj-section>
+  </mj-body>
+</mjml>`;
+}
+var RED, GREY;
+var init_template2 = __esm({
+  "src/reports/launch-email/template.ts"() {
+    "use strict";
+    init_copy();
+    init_template();
+    RED = "#C00";
+    GREY = "#757575";
+  }
+});
+
 // src/reports/render.ts
 import mjml2html from "mjml";
 async function renderReportHtml(data) {
-  const mjml = buildMjml(data);
+  const mjml = data.reportType === "Launch" ? buildLaunchMjml(data) : buildMjml(data);
   const out = await mjml2html(mjml, { validationLevel: "strict" });
   return { html: out.html, warnings: out.errors ?? [] };
 }
@@ -857,6 +1267,7 @@ var init_render = __esm({
   "src/reports/render.ts"() {
     "use strict";
     init_template();
+    init_template2();
   }
 });
 
@@ -931,9 +1342,223 @@ var init_resend = __esm({
   }
 });
 
+// src/alerts/digest-collectors.ts
+function dashboardUrl(baseUrl, siteName) {
+  return `${baseUrl.replace(/\/$/, "")}/s/${siteSlug(siteName)}`;
+}
+function collectVulnAlerts(sites, baseUrl) {
+  const items = [];
+  for (const s of sites) {
+    const critical = s.securityVulnsCritical ?? 0;
+    const high = s.securityVulnsHigh ?? 0;
+    const metric = critical + high;
+    if (metric <= 0) continue;
+    items.push({
+      key: `vuln:${s.id}`,
+      kind: "vuln",
+      siteName: s.name,
+      title: `${metric} critical/high ${metric === 1 ? "vuln" : "vulns"}`,
+      url: dashboardUrl(baseUrl, s.name),
+      severity: critical > 0 ? "critical" : "warning",
+      metric
+    });
+  }
+  return items;
+}
+function collectLighthouseAlerts(sites, baseUrl) {
+  const items = [];
+  for (const s of sites) {
+    for (const cat of LIGHTHOUSE_CATEGORIES2) {
+      const score = s[cat.field];
+      if (score === null || score >= LIGHTHOUSE_FLOOR) continue;
+      items.push({
+        key: `lighthouse:${s.id}:${cat.slug}`,
+        kind: "lighthouse",
+        siteName: s.name,
+        title: `Lighthouse ${cat.label} ${score} (below ${LIGHTHOUSE_FLOOR})`,
+        url: dashboardUrl(baseUrl, s.name),
+        severity: "warning",
+        metric: 100 - score
+      });
+    }
+  }
+  return items;
+}
+function collectDeliveryFailures(reports, sitesById, baseUrl) {
+  const items = [];
+  for (const r of reports) {
+    if (r.deliveryStatus !== "bounced" && r.deliveryStatus !== "complained") continue;
+    const site = sitesById.get(r.siteId);
+    if (!site) continue;
+    const complained = r.deliveryStatus === "complained";
+    items.push({
+      key: `delivery:${r.id}`,
+      kind: "delivery",
+      siteName: site.name,
+      title: complained ? "Spam complaint on a sent report" : "A sent report bounced",
+      url: dashboardUrl(baseUrl, site.name),
+      severity: complained ? "critical" : "warning",
+      metric: 1
+    });
+  }
+  return items;
+}
+function renovateFindingsToAttention(result) {
+  const items = [];
+  for (const f of result.findings) {
+    items.push({
+      key: `renovate:${f.repo}#${f.pr.number}`,
+      kind: "renovate",
+      siteName: f.site,
+      title: `Renovate update failing CI: ${f.pr.title}`,
+      url: f.pr.url,
+      severity: "warning",
+      metric: 1
+    });
+  }
+  if (result.skipped.length > 0) {
+    items.push({
+      key: "renovate:skipped",
+      kind: "renovate",
+      siteName: "Fleet checks",
+      title: `Couldn't check ${result.skipped.length} repo(s) for failing Renovate PRs`,
+      severity: "warning",
+      metric: result.skipped.length
+    });
+  }
+  return items;
+}
+function buildRenovateProbe() {
+  const token = process.env.RENOVATE_TOKEN?.trim() || process.env.GH_TOKEN?.trim();
+  if (!token) return void 0;
+  return makeGitHub({ token }).openPullRequests;
+}
+var LIGHTHOUSE_FLOOR, LIGHTHOUSE_CATEGORIES2;
+var init_digest_collectors = __esm({
+  "src/alerts/digest-collectors.ts"() {
+    "use strict";
+    init_websites();
+    init_gh();
+    LIGHTHOUSE_FLOOR = 75;
+    LIGHTHOUSE_CATEGORIES2 = [
+      { field: "pScore", slug: "performance", label: "Performance" },
+      { field: "rScore", slug: "accessibility", label: "Accessibility" },
+      { field: "bpScore", slug: "best-practices", label: "Best Practices" },
+      { field: "seoScore", slug: "seo", label: "SEO" }
+    ];
+  }
+});
+
+// src/alerts/renovate.ts
+function isRenovatePR(pr) {
+  return RENOVATE_HEAD_PREFIXES.some((p) => pr.headRef.startsWith(p));
+}
+function isFailingRenovatePR(pr) {
+  return isRenovatePR(pr) && pr.ciState === "failing";
+}
+function siteLabel2(site) {
+  const display = site.meta?.["displayName"];
+  if (typeof display === "string" && display.length > 0) return display;
+  if (typeof site.name === "string" && site.name.length > 0) return site.name;
+  return "unknown";
+}
+async function collectRenovateFailures(sites, probe) {
+  const findings = [];
+  const skipped = [];
+  for (const site of sites) {
+    const repo = site.gitRepo;
+    if (!repo) continue;
+    let prs;
+    try {
+      prs = await probe(repo);
+    } catch {
+      skipped.push(repo);
+      continue;
+    }
+    for (const pr of prs) {
+      if (isFailingRenovatePR(pr)) {
+        findings.push({ site: siteLabel2(site), repo, pr });
+      }
+    }
+  }
+  return { findings, skipped };
+}
+var RENOVATE_HEAD_PREFIXES;
+var init_renovate = __esm({
+  "src/alerts/renovate.ts"() {
+    "use strict";
+    RENOVATE_HEAD_PREFIXES = ["renovate/", "renovate-"];
+  }
+});
+
+// src/alerts/digest-state.ts
+function diffAttention(items, prior, today) {
+  const tagged = [];
+  const next = {};
+  for (const it of items) {
+    const was = prior[it.key];
+    let status;
+    let firstFlaggedAt;
+    if (!was) {
+      status = "new";
+      firstFlaggedAt = today;
+    } else if (it.metric > was.metric) {
+      status = "worse";
+      firstFlaggedAt = was.firstFlaggedAt;
+    } else {
+      status = "standing";
+      firstFlaggedAt = was.firstFlaggedAt;
+    }
+    tagged.push({ ...it, status });
+    next[it.key] = { metric: it.metric, firstFlaggedAt };
+  }
+  return { tagged, next };
+}
+async function readDigestState(base) {
+  const rows = [];
+  await base(DIGEST_STATE_TABLE).select({ maxRecords: 1, pageSize: 1 }).eachPage((records, fetchNextPage) => {
+    for (const rec of records) rows.push({ id: rec.id, fields: rec.fields });
+    fetchNextPage();
+  });
+  const first = rows[0];
+  if (!first) return {};
+  const raw = first.fields["Snapshot"];
+  if (typeof raw !== "string") return {};
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return {};
+  }
+}
+async function writeDigestState(base, snap, updatedAt = (/* @__PURE__ */ new Date()).toISOString()) {
+  const rows = [];
+  await base(DIGEST_STATE_TABLE).select({ maxRecords: 1, pageSize: 1 }).eachPage((records, fetchNextPage) => {
+    for (const rec of records) rows.push({ id: rec.id });
+    fetchNextPage();
+  });
+  const fields = {
+    Snapshot: JSON.stringify(snap),
+    "Updated At": updatedAt
+  };
+  const existing = rows[0];
+  if (existing) {
+    await base(DIGEST_STATE_TABLE).update([{ id: existing.id, fields }]);
+  } else {
+    await base(DIGEST_STATE_TABLE).create([{ fields }]);
+  }
+}
+var DIGEST_STATE_TABLE;
+var init_digest_state = __esm({
+  "src/alerts/digest-state.ts"() {
+    "use strict";
+    DIGEST_STATE_TABLE = "Digest State";
+  }
+});
+
 // src/reports/digest.ts
 var digest_exports = {};
 __export(digest_exports, {
+  collectAttention: () => collectAttention,
   listPendingApproval: () => listPendingApproval,
   renderDigestHtml: () => renderDigestHtml,
   runDigest: () => runDigest
@@ -942,16 +1567,16 @@ function esc(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
 function readySection(items) {
-  const heading = `<h2 style="color:${RED};font-family:helvetica,sans-serif;font-size:20px;font-weight:700;margin:32px 0 8px">Ready for your yes</h2>`;
+  const heading = `<h2 style="color:${RED2};font-family:helvetica,sans-serif;font-size:20px;font-weight:700;margin:32px 0 8px">Ready for your yes</h2>`;
   if (items.length === 0) {
-    return `${heading}<p style="color:${GREY};font-family:helvetica,sans-serif;font-size:16px;margin:0">Nothing waiting on you.</p>`;
+    return `${heading}<p style="color:${GREY2};font-family:helvetica,sans-serif;font-size:16px;margin:0">Nothing waiting on you.</p>`;
   }
   const rows = items.map((it) => {
     const safeUrl = it.dashboardUrl.startsWith("https://") ? it.dashboardUrl : void 0;
     const link = safeUrl ? `<a href="${esc(safeUrl)}" style="${ANCHOR_STYLE}">review &amp; approve</a>` : `review &amp; approve`;
     return `
       <tr>
-        <td style="color:${GREY};font-family:helvetica,sans-serif;font-size:16px;line-height:24px;padding-bottom:8px">
+        <td style="color:${GREY2};font-family:helvetica,sans-serif;font-size:16px;line-height:24px;padding-bottom:8px">
           <strong style="color:#222">${esc(it.siteName)}</strong> \u2014 ${esc(it.reportType)} (${esc(it.period)})
           \u2014 ${link}
         </td>
@@ -959,36 +1584,105 @@ function readySection(items) {
   }).join("");
   return `${heading}<table role="presentation" style="border-collapse:collapse;margin:0">${rows}</table>`;
 }
+function attentionBadge(status) {
+  if (status === "new")
+    return `<strong style="color:${RED2};font-family:helvetica,sans-serif">NEW</strong> `;
+  if (status === "worse")
+    return `<strong style="color:${RED2};font-family:helvetica,sans-serif">WORSE</strong> `;
+  return "";
+}
 function attentionSection(items) {
-  const heading = `<h2 style="color:${RED};font-family:helvetica,sans-serif;font-size:20px;font-weight:700;margin:32px 0 8px">Needs attention</h2>`;
+  const heading = `<h2 style="color:${RED2};font-family:helvetica,sans-serif;font-size:20px;font-weight:700;margin:32px 0 8px">Needs attention</h2>`;
   if (items.length === 0) {
-    return `${heading}<p style="color:${GREY};font-family:helvetica,sans-serif;font-size:16px;margin:0">All clear \u2014 nothing needs attention.</p>`;
+    return `${heading}<p style="color:${GREY2};font-family:helvetica,sans-serif;font-size:16px;margin:0">All clear \u2014 nothing needs attention.</p>`;
   }
-  const rows = items.map((it) => {
-    const safeUrl = it.url?.startsWith("https://") ? it.url : void 0;
-    const label = safeUrl ? `<a href="${esc(safeUrl)}" style="${ANCHOR_STYLE}">${esc(it.title)}</a>` : esc(it.title);
+  const bySite = /* @__PURE__ */ new Map();
+  for (const it of items) {
+    const bucket = bySite.get(it.siteName);
+    if (bucket) bucket.push(it);
+    else bySite.set(it.siteName, [it]);
+  }
+  const groups = [...bySite.entries()].map(([siteName, siteItems]) => {
+    const sorted = [...siteItems].sort(
+      (a, b) => SEVERITY_ORDER[a.severity] - SEVERITY_ORDER[b.severity]
+    );
+    const rows = sorted.map((it) => {
+      const safeUrl = it.url?.startsWith("https://") ? it.url : void 0;
+      const titleHtml = safeUrl ? `<a href="${esc(safeUrl)}" style="${ANCHOR_STYLE}">${esc(it.title)}</a>` : esc(it.title);
+      return `
+          <tr>
+            <td style="color:${GREY2};font-family:helvetica,sans-serif;font-size:16px;line-height:24px;padding-bottom:8px">${attentionBadge(it.status)}${titleHtml}</td>
+          </tr>`;
+    }).join("");
     return `
       <tr>
-        <td style="color:${GREY};font-family:helvetica,sans-serif;font-size:16px;line-height:24px;padding-bottom:8px">${label}</td>
-      </tr>`;
+        <td style="color:#222;font-family:helvetica,sans-serif;font-size:16px;font-weight:700;padding:8px 0 4px">${esc(siteName)}</td>
+      </tr>
+      ${rows}`;
   }).join("");
-  return `${heading}<table role="presentation" style="border-collapse:collapse;margin:0">${rows}</table>`;
+  return `${heading}<table role="presentation" style="border-collapse:collapse;margin:0">${groups}</table>`;
 }
 function digestDateKey(d) {
   return d.toISOString().slice(0, 10);
 }
+function isIdempotencyConflict(err) {
+  const message = err instanceof Error ? err.message : String(err);
+  if (/idempotency key has been used/i.test(message)) return true;
+  const e = err;
+  if (e.name === "invalid_idempotent_request") return true;
+  if (e.statusCode === 409) return true;
+  return false;
+}
 async function listPendingApproval(base) {
   return (await listAllReports(base)).filter(
     (r) => r.draftReady && !r.approvedToSend && r.sentAt === null
   );
 }
+function runCollector(label, fn) {
+  try {
+    return fn();
+  } catch (e) {
+    console.warn(`\u26A0 attention collector "${label}" failed: ${e.message}`);
+    return [];
+  }
+}
+async function runCollectorAsync(label, fn) {
+  try {
+    return await fn();
+  } catch (e) {
+    console.warn(`\u26A0 attention collector "${label}" failed: ${e.message}`);
+    return [];
+  }
+}
+async function collectAttention(deps) {
+  const reports = deps.reports ?? await listAllReports(deps.base);
+  const websites = deps.websites ?? await listWebsites(deps.base);
+  const sitesById = new Map(websites.map((w) => [w.id, w]));
+  const renovate = deps.renovateProbe ? await runCollectorAsync("renovate", async () => {
+    const sites = websites.map((w) => ({
+      path: "",
+      name: w.name,
+      meta: {},
+      ...w.gitRepo ? { gitRepo: w.gitRepo } : {}
+    }));
+    const result = await collectRenovateFailures(sites, deps.renovateProbe);
+    return renovateFindingsToAttention(result);
+  }) : [];
+  return [
+    ...runCollector("vuln", () => collectVulnAlerts(websites, deps.baseUrl)),
+    ...runCollector("delivery", () => collectDeliveryFailures(reports, sitesById, deps.baseUrl)),
+    ...runCollector("lighthouse", () => collectLighthouseAlerts(websites, deps.baseUrl)),
+    ...renovate
+  ];
+}
 async function runDigest(options) {
   const today = /* @__PURE__ */ new Date();
   try {
     const base = options.base ?? openBase(readAirtableConfig());
+    const reports = await listAllReports(base);
     const websites = await listWebsites(base);
     const sites = new Map(websites.map((w) => [w.id, w]));
-    const pending = await listPendingApproval(base);
+    const pending = reports.filter((r) => r.draftReady && !r.approvedToSend && r.sentAt === null);
     const readyForYourYes = [];
     for (const r of pending) {
       const site = sites.get(r.siteId);
@@ -1000,8 +1694,23 @@ async function runDigest(options) {
         dashboardUrl: `${options.baseUrl.replace(/\/$/, "")}/s/${siteSlug(site.name)}`
       });
     }
-    const needsAttention = [];
+    const renovateProbe = buildRenovateProbe();
+    const collected = await collectAttention({
+      base,
+      baseUrl: options.baseUrl,
+      websites,
+      reports,
+      ...renovateProbe ? { renovateProbe } : {}
+    });
+    const prior = await readDigestState(base);
+    const { tagged, next } = diffAttention(collected, prior, digestDateKey(today));
+    const needsAttention = tagged;
     if (readyForYourYes.length === 0 && needsAttention.length === 0) {
+      try {
+        await writeDigestState(base, next);
+      } catch (e) {
+        console.warn(`\u26A0 digest state write failed: ${e.message}`);
+      }
       return { output: "Digest skipped (nothing ready, nothing needs attention).", code: 0 };
     }
     const html = renderDigestHtml({ readyForYourYes, needsAttention });
@@ -1009,13 +1718,29 @@ async function runDigest(options) {
     const to = [process.env.OPERATOR_EMAIL?.trim() || DIGEST_OPERATOR_FALLBACK];
     const n = readyForYourYes.length;
     const reportWord = n === 1 ? "report" : "reports";
-    const result = await client.send({
-      from: FROM_ADDRESS,
-      to,
-      subject: `Your fleet \u2014 ${digestDateKey(today)}: ${n} ${reportWord} ready for your yes`,
-      html,
-      idempotencyKey: `digest-${digestDateKey(today)}`
-    });
+    let result;
+    try {
+      result = await client.send({
+        from: FROM_ADDRESS,
+        to,
+        subject: `Your fleet \u2014 ${digestDateKey(today)}: ${n} ${reportWord} ready for your yes`,
+        html,
+        idempotencyKey: `digest-${digestDateKey(today)}`
+      });
+    } catch (err) {
+      if (isIdempotencyConflict(err)) {
+        return {
+          output: "Digest already sent today (content changed since the first send) \u2014 skipped to avoid a duplicate.",
+          code: 0
+        };
+      }
+      throw err;
+    }
+    try {
+      await writeDigestState(base, next);
+    } catch (e) {
+      console.warn(`\u26A0 digest state write failed: ${e.message}`);
+    }
     return { output: `Digest sent to ${to.join(", ")} (${result.messageId})`, code: 0 };
   } catch (err) {
     if (typeof err.exitCode === "number") {
@@ -1036,7 +1761,7 @@ function renderDigestHtml(sections) {
           <table width="600" style="border-collapse:collapse">
             <tr>
               <td>
-                <h1 style="color:${RED};font-family:helvetica,sans-serif;font-size:24px;font-weight:700;margin:0 0 8px">Your fleet today</h1>
+                <h1 style="color:${RED2};font-family:helvetica,sans-serif;font-size:24px;font-weight:700;margin:0 0 8px">Your fleet today</h1>
                 ${readySection(sections.readyForYourYes)}
                 ${attentionSection(sections.needsAttention)}
               </td>
@@ -1048,7 +1773,7 @@ function renderDigestHtml(sections) {
   </body>
 </html>`;
 }
-var GREY, RED, ANCHOR_STYLE, FROM_ADDRESS, DIGEST_OPERATOR_FALLBACK;
+var GREY2, RED2, ANCHOR_STYLE, SEVERITY_ORDER, FROM_ADDRESS, DIGEST_OPERATOR_FALLBACK;
 var init_digest = __esm({
   "src/reports/digest.ts"() {
     "use strict";
@@ -1056,9 +1781,13 @@ var init_digest = __esm({
     init_reports();
     init_websites();
     init_resend();
-    GREY = "#757575";
-    RED = "#C00";
-    ANCHOR_STYLE = `color:${RED};font-family:helvetica,sans-serif`;
+    init_digest_collectors();
+    init_renovate();
+    init_digest_state();
+    GREY2 = "#757575";
+    RED2 = "#C00";
+    ANCHOR_STYLE = `color:${RED2};font-family:helvetica,sans-serif`;
+    SEVERITY_ORDER = { critical: 0, warning: 1 };
     FROM_ADDRESS = "Reddoor Reports <reports@reddoorla.com>";
     DIGEST_OPERATOR_FALLBACK = "info@reddoorla.com";
   }
@@ -1139,6 +1868,14 @@ async function sendApprovedReports(options = {}) {
     try {
       const messageId = await sendOne(client, base, site, report);
       lines.push(`\u2713 sent: ${report.reportId} (${messageId})`);
+      if (report.reportType === "Launch") {
+        try {
+          await updateLaunched(base, site.id, (/* @__PURE__ */ new Date()).toISOString());
+          lines.push(`  \u21B3 launched: ${site.name} flipped to maintenance`);
+        } catch (e) {
+          lines.push(`  \u26A0 launch flip failed for ${site.name}: ${e.message}`);
+        }
+      }
     } catch (e) {
       lines.push(`\u2717 ${report.reportId} \u2014 ${e.message}`);
       anyFailed = true;
@@ -1171,6 +1908,7 @@ async function sendOne(client, base, site, report) {
     searchPosition: report.searchFoundPage1 && report.searchPosition !== null ? report.searchPosition : void 0,
     lastTestedDate: report.lastTestedDate ? new Date(report.lastTestedDate) : null,
     commentary: report.commentary,
+    copy: resolveCopy(site),
     headerImageCid: cidName,
     headerWidth: header.displayWidth,
     headerHeight: header.displayHeight,
@@ -1274,6 +2012,7 @@ var init_orchestrate = __esm({
     init_websites();
     init_attachments();
     init_render();
+    init_copy();
     init_assets();
     init_header_image();
     init_resend();
@@ -1306,72 +2045,8 @@ import { cac } from "cac";
 import { resolve as resolve2 } from "path";
 import { Listr } from "listr2";
 
-// src/audits/util/spawn.ts
-import { spawn } from "child_process";
-var TRUNCATION_MARKER = "\n\u2026[output truncated]";
-function makeSpawn(internals = {}) {
-  const spawnImpl = internals.spawnImpl ?? spawn;
-  const killImpl = internals.killImpl ?? ((pid, sig) => process.kill(pid, sig));
-  const killGraceMs = internals.killGraceMs ?? 5e3;
-  const maxOutputBytes = internals.maxOutputBytes ?? 10 * 1024 * 1024;
-  return (cmd, args, opts = {}) => new Promise((resolve11, reject) => {
-    const streaming = opts.streaming === true;
-    const child = spawnImpl(cmd, [...args], {
-      cwd: opts.cwd,
-      env: opts.env ?? process.env,
-      stdio: streaming ? ["ignore", "inherit", "inherit"] : ["ignore", "pipe", "pipe"],
-      // Detach ONLY when a timeout can fire: the child then leads its own
-      // process group, so the timeout can kill the WHOLE tree (vite, and
-      // Chromium under lhci/playwright) via process.kill(-pid), not just the
-      // npx/pnpm wrapper. Without it, killing the wrapper orphaned the
-      // grandchildren — a zombie vite squatting its port, Chrome left running.
-      // We do NOT detach timeout-less streaming calls (pnpm install/up):
-      // detaching gains nothing there (no timeout → no group-kill) and would
-      // break terminal Ctrl-C, which only reaches the foreground group — i.e.
-      // it would re-orphan the very children this guards. We never unref() the
-      // child since we still await it.
-      detached: opts.timeoutMs !== void 0
-    });
-    const cap = (acc, chunk) => {
-      if (acc.length >= maxOutputBytes) return acc;
-      const next = acc + chunk;
-      return next.length > maxOutputBytes ? next.slice(0, maxOutputBytes) + TRUNCATION_MARKER : next;
-    };
-    let stdout = "";
-    let stderr = "";
-    if (!streaming) {
-      child.stdout?.on("data", (chunk) => stdout = cap(stdout, String(chunk)));
-      child.stderr?.on("data", (chunk) => stderr = cap(stderr, String(chunk)));
-    }
-    const killGroup = (sig) => {
-      if (child.pid === void 0) return;
-      try {
-        killImpl(-child.pid, sig);
-      } catch {
-      }
-    };
-    let killTimer;
-    const timer = opts.timeoutMs ? setTimeout(() => {
-      killGroup("SIGTERM");
-      killTimer = setTimeout(() => killGroup("SIGKILL"), killGraceMs);
-      killTimer.unref();
-      reject(new Error(`spawn timeout after ${opts.timeoutMs}ms: ${cmd}`));
-    }, opts.timeoutMs) : void 0;
-    const clearTimers = () => {
-      if (timer) clearTimeout(timer);
-      if (killTimer) clearTimeout(killTimer);
-    };
-    child.on("error", (err) => {
-      clearTimers();
-      reject(err);
-    });
-    child.on("close", (code) => {
-      clearTimers();
-      resolve11({ code: code ?? -1, stdout, stderr });
-    });
-  });
-}
-var defaultSpawn = makeSpawn();
+// src/audits/index.ts
+init_spawn();
 
 // src/audits/deps.ts
 import { readFile } from "fs/promises";
@@ -1421,6 +2096,9 @@ var baselineVersions = {
   "@zerodevx/svelte-img": "^2.1.2"
 };
 
+// src/audits/deps.ts
+init_spawn();
+
 // src/audits/deps-outdated.ts
 import { stat } from "fs/promises";
 import { join as join2 } from "path";
@@ -1600,6 +2278,7 @@ async function lintAudit(ctx) {
 }
 
 // src/audits/security.ts
+init_spawn();
 function classify(v) {
   if (v.critical > 0 || v.high > 0) return "fail";
   if (v.moderate > 0 || v.low > 0) return "warn";
@@ -1774,6 +2453,9 @@ var lighthouseConfig = {
   }
 };
 
+// src/audits/lighthouse.ts
+init_spawn();
+
 // src/audits/util/site-config.ts
 import { readFile as readFile3 } from "fs/promises";
 import { join as join5 } from "path";
@@ -1804,7 +2486,7 @@ async function readSiteConfig(sitePath) {
 // src/util/free-port.ts
 import { createServer } from "net";
 async function findFreePort() {
-  return new Promise((resolve11, reject) => {
+  return new Promise((resolve12, reject) => {
     const server = createServer();
     server.unref();
     server.on("error", reject);
@@ -1812,7 +2494,7 @@ async function findFreePort() {
       const addr = server.address();
       if (typeof addr === "object" && addr) {
         const port = addr.port;
-        server.close(() => resolve11(port));
+        server.close(() => resolve12(port));
       } else {
         server.close();
         reject(new Error("findFreePort: could not determine assigned port from socket"));
@@ -2042,6 +2724,7 @@ var playwrightA11yConfig = defineConfig({
 });
 
 // src/audits/a11y.ts
+init_spawn();
 var RESULTS_REL = ".reddoor-a11y/results.json";
 async function readJsonMaybe2(path) {
   try {
@@ -2358,6 +3041,7 @@ async function resolveSites(input) {
 }
 
 // src/cli/fleet/clone-if-needed.ts
+init_spawn();
 import { stat as stat2, readdir as readdir2, mkdir } from "fs/promises";
 import { isAbsolute as isAbsolute2, join as join8 } from "path";
 function deriveNameFromRepoUrl(repoUrl) {
@@ -3192,6 +3876,7 @@ async function runSyncConfigsCommand(site, opts) {
 import { resolve as resolve4 } from "path";
 
 // src/recipes/bump-deps.ts
+init_spawn();
 import { stat as stat3 } from "fs/promises";
 import { join as join12 } from "path";
 async function exists2(path) {
@@ -3306,158 +3991,8 @@ function readGitHubConfig() {
   return { token, renovateToken };
 }
 
-// src/github/gh.ts
-function mapRollupState(state) {
-  switch (state) {
-    case "SUCCESS":
-      return "passing";
-    case "FAILURE":
-    case "ERROR":
-      return "failing";
-    case "PENDING":
-    case "EXPECTED":
-      return "pending";
-    default:
-      return "none";
-  }
-}
-function makeGitHub(deps) {
-  const spawn2 = deps.spawn ?? defaultSpawn;
-  const env = { ...process.env, GH_TOKEN: deps.token };
-  async function gh(args) {
-    const r = await spawn2("gh", args, { env, timeoutMs: 6e4 });
-    if (r.code !== 0) throw new Error(`gh ${args[0]} failed (code ${r.code}): ${r.stderr.trim()}`);
-    return r.stdout;
-  }
-  return {
-    async openPullRequest(repo, pr) {
-      const out = await gh([
-        "pr",
-        "create",
-        "--repo",
-        repo,
-        "--head",
-        pr.head,
-        "--base",
-        pr.base,
-        "--title",
-        pr.title,
-        "--body",
-        pr.body
-      ]);
-      return { url: out.trim() };
-    },
-    async enableRepoAutoMerge(repo) {
-      await gh(["api", "-X", "PATCH", `repos/${repo}`, "-F", "allow_auto_merge=true"]);
-    },
-    async protectBranch(repo, branch, requiredChecks) {
-      const args = [
-        "api",
-        "-X",
-        "PUT",
-        `repos/${repo}/branches/${branch}/protection`,
-        "-H",
-        "Accept: application/vnd.github+json",
-        "-F",
-        "required_status_checks[strict]=true",
-        ...requiredChecks.flatMap((c) => ["-f", `required_status_checks[contexts][]=${c}`]),
-        "-F",
-        "enforce_admins=true",
-        "-F",
-        "required_pull_request_reviews=null",
-        "-F",
-        "restrictions=null"
-      ];
-      await gh(args);
-    },
-    async setRepoSecret(repo, name, value) {
-      await gh(["secret", "set", name, "--repo", repo, "--body", value]);
-    },
-    async repoExists(repo) {
-      const r = await spawn2("gh", ["api", `repos/${repo}`], { env, timeoutMs: 6e4 });
-      return r.code === 0;
-    },
-    async defaultBranch(repo) {
-      const out = await gh(["api", `repos/${repo}`, "--jq", ".default_branch"]);
-      return out.trim();
-    },
-    // filesOnBranch and branchProtectionContexts call `spawn` directly (not the
-    // throwing `gh()` helper) because a 404 is an expected, meaningful answer —
-    // "file/protection absent" — not an error. The remaining readers use `gh()`
-    // since a non-200 there is a genuine failure (e.g. missing token scope).
-    async filesOnBranch(repo, branch, paths) {
-      const present = [];
-      for (const p of paths) {
-        const r = await spawn2("gh", [`api`, `repos/${repo}/contents/${p}?ref=${branch}`], {
-          env,
-          timeoutMs: 6e4
-        });
-        if (r.code === 0) present.push(p);
-      }
-      return present;
-    },
-    async branchProtectionContexts(repo, branch) {
-      const r = await spawn2(
-        "gh",
-        [
-          "api",
-          `repos/${repo}/branches/${branch}/protection`,
-          "--jq",
-          ".required_status_checks.contexts[]?"
-        ],
-        { env, timeoutMs: 6e4 }
-      );
-      if (r.code !== 0) return [];
-      return r.stdout.split("\n").map((l) => l.trim()).filter((l) => l.length > 0);
-    },
-    async secretExists(repo, name) {
-      const out = await gh(["api", `repos/${repo}/actions/secrets`, "--jq", ".secrets[].name"]);
-      return out.split("\n").map((l) => l.trim()).includes(name);
-    },
-    async autoMergeEnabled(repo) {
-      const out = await gh(["api", `repos/${repo}`, "--jq", ".allow_auto_merge"]);
-      return out.trim() === "true";
-    },
-    async findOpenSelfUpdatingPR(repo) {
-      const out = await gh([
-        "api",
-        `repos/${repo}/pulls?state=open`,
-        "--jq",
-        '.[] | select(.head.ref | startswith("maint/self-updating-")) | .html_url'
-      ]);
-      const first = out.split("\n").map((l) => l.trim()).find((l) => l.length > 0);
-      return first ?? null;
-    },
-    async openPullRequests(repo) {
-      const [owner, name, ...rest] = repo.split("/");
-      if (!owner || !name || rest.length > 0) {
-        throw new Error(`openPullRequests: expected "owner/repo", got "${repo}"`);
-      }
-      const query = "query($owner:String!,$name:String!){repository(owner:$owner,name:$name){pullRequests(states:OPEN,first:100,orderBy:{field:CREATED_AT,direction:DESC}){nodes{number title url headRefName commits(last:1){nodes{commit{statusCheckRollup{state}}}}}}}}";
-      const out = await gh([
-        "api",
-        "graphql",
-        "-f",
-        `query=${query}`,
-        "-F",
-        `owner=${owner}`,
-        "-F",
-        `name=${name}`
-      ]);
-      const parsed = JSON.parse(out);
-      const nodes = parsed.data?.repository?.pullRequests?.nodes ?? [];
-      return nodes.map((n) => ({
-        number: n.number,
-        title: n.title,
-        url: n.url,
-        headRef: n.headRefName,
-        ciState: mapRollupState(n.commits?.nodes?.[0]?.commit?.statusCheckRollup?.state)
-      }));
-    }
-  };
-}
-
 // src/recipes/self-updating/index.ts
+init_gh();
 var SELF_UPDATING_CONFIGS = ["ci", "renovate-action", "renovate-config"];
 var REQUIRED_CHECK = "ci / ci";
 function resultOf(site, status, notes, commits = []) {
@@ -3626,6 +4161,9 @@ function bumpDep(pkg, name, version2, opts = {}) {
   return next;
 }
 
+// src/recipes/svelte-5/index.ts
+init_spawn();
+
 // src/recipes/svelte-5/step-bump-versions.ts
 import { join as join14 } from "path";
 var SVELTE_5_VERSIONS = {
@@ -3710,6 +4248,7 @@ async function migrateSvelteConfig(cwd) {
 }
 
 // src/recipes/svelte-5/step-svelte-migrate.ts
+init_spawn();
 async function runSvelteMigrate(cwd, spawn2 = defaultSpawn) {
   try {
     const { code, stderr } = await spawn2(
@@ -3731,6 +4270,7 @@ async function runSvelteMigrate(cwd, spawn2 = defaultSpawn) {
 }
 
 // src/recipes/svelte-5/step-tailwind-upgrade.ts
+init_spawn();
 import { join as join16 } from "path";
 async function upgradeTailwind(cwd, spawn2 = defaultSpawn) {
   const pkg = await readPackageJson(join16(cwd, "package.json"));
@@ -4117,6 +4657,7 @@ async function applyGotchaCodemods(cwd) {
 }
 
 // src/recipes/svelte-5/step-verify.ts
+init_spawn();
 async function verifyMigration(cwd, spawn2 = defaultSpawn) {
   let install;
   try {
@@ -4256,6 +4797,7 @@ import { resolve as resolve7 } from "path";
 // src/recipes/convert-to-pnpm.ts
 import { rm as rm3, stat as stat4 } from "fs/promises";
 import { join as join20 } from "path";
+init_spawn();
 
 // src/recipes/convert-to-pnpm/script-rewrites.ts
 function rewriteScriptForPnpm(script) {
@@ -4368,6 +4910,7 @@ import { resolve as resolve8 } from "path";
 // src/recipes/onboard.ts
 import { stat as stat5 } from "fs/promises";
 import { join as join22 } from "path";
+init_spawn();
 
 // src/util/self-version.ts
 import { readFileSync as readFileSync2, existsSync as existsSync2 } from "fs";
@@ -4663,6 +5206,7 @@ function reportPeriodKey(dueDate) {
 // src/reports/draft.ts
 init_render();
 init_websites();
+init_copy();
 init_reports();
 init_attachments();
 import { mkdir as mkdir4, writeFile as writeFile10 } from "fs/promises";
@@ -4823,6 +5367,7 @@ async function draftReportForSite(base, siteRow, reportType, options = {}) {
     searchPosition: search?.foundOnPage1 ? search.position ?? void 0 : void 0,
     lastTestedDate,
     commentary: null,
+    copy: resolveCopy(siteRow),
     headerImageCid: cidName
   });
   if (options.previewOnly) {
@@ -5144,6 +5689,256 @@ async function runInitCommand(site, opts) {
   return { output, code };
 }
 
+// src/cli/commands/launch.ts
+import { resolve as resolve11 } from "path";
+
+// src/recipes/launch.ts
+init_lighthouse_airtable();
+init_write_audits_to_airtable();
+init_client();
+init_websites();
+init_reports();
+init_attachments();
+init_render();
+init_copy();
+async function launch(site, deps = {}) {
+  const label = siteLabel(site);
+  const bootstrap = deps.bootstrap ?? selfUpdating;
+  const audit = deps.audit ?? runAudits;
+  const base = deps.base ?? openBase(readAirtableConfig());
+  const steps = [];
+  const stop = () => ({ site: label, steps, complete: false });
+  let recipe;
+  try {
+    recipe = await bootstrap(site);
+  } catch (err) {
+    steps.push({ name: "self-updating", result: errorOf(err) });
+    return stop();
+  }
+  steps.push({ name: "self-updating", result: { kind: "recipe", result: recipe } });
+  if (recipe.status === "failed") return stop();
+  let results;
+  try {
+    results = await audit(site);
+  } catch (err) {
+    steps.push({ name: "audit", result: errorOf(err) });
+    return stop();
+  }
+  const lhResult = results.find((r) => r.audit === "lighthouse");
+  if (!lhResult || !hasRealScores(lhResult)) {
+    steps.push({
+      name: "audit",
+      result: { kind: "error", message: "lighthouse audit produced no real scores" }
+    });
+    return stop();
+  }
+  const scores = lighthouseScoresFromResult(lhResult);
+  const websites = await listWebsites(base);
+  const target = websites.find((w) => siteSlug(w.name) === siteSlug(label));
+  if (!target) {
+    steps.push({
+      name: "audit",
+      result: { kind: "error", message: `no Websites row matched site "${label}"` }
+    });
+    return stop();
+  }
+  try {
+    await writeAuditsToAirtable({ base, websites, slug: siteSlug(target.name), results });
+  } catch (err) {
+    steps.push({ name: "audit", result: errorOf(err) });
+    return stop();
+  }
+  steps.push({ name: "audit", result: { kind: "audit", results, scores } });
+  const today = /* @__PURE__ */ new Date();
+  const period = today.toISOString().slice(0, 7);
+  const slug = siteSlug(target.name);
+  let report;
+  try {
+    const existing = await findReportByPeriod(base, target.id, "Launch", period);
+    report = existing ?? await createDraft(base, draftInputFor(target, scores, today, period));
+  } catch (err) {
+    steps.push({ name: "draft", result: errorOf(err) });
+    return stop();
+  }
+  try {
+    const { html } = await renderReportHtml({
+      siteName: target.name,
+      siteUrl: target.url,
+      reportType: "Launch",
+      completedOn: today,
+      lighthouse: scores,
+      lastTestedDate: null,
+      commentary: null,
+      copy: resolveCopy(target),
+      headerImageCid: `${slug}-header`
+    });
+    try {
+      await uploadAttachment(
+        report.id,
+        "Rendered HTML",
+        html,
+        `${slug}-${today.toISOString().slice(0, 10)}.html`,
+        "text/html"
+      );
+    } catch (uploadErr) {
+      console.warn(
+        `\u26A0 Launch preview upload skipped for ${target.name}: ${uploadErr instanceof Error ? uploadErr.message : String(uploadErr)}`
+      );
+    }
+    await setDraftReady(base, report.id, true);
+  } catch (err) {
+    steps.push({ name: "draft", result: errorOf(err) });
+    return stop();
+  }
+  steps.push({ name: "draft", result: { kind: "draft", report } });
+  return { site: label, steps, complete: true };
+}
+function draftInputFor(target, scores, today, period) {
+  const reportType = "Launch";
+  const reportId = `${target.name} \u2014 ${reportType} \u2014 ${today.toISOString().slice(0, 10)}`;
+  return {
+    reportId,
+    siteId: target.id,
+    reportType,
+    period,
+    periodStart: today,
+    periodEnd: today,
+    completedOn: today,
+    lighthouse: scores,
+    lastTestedDate: null
+  };
+}
+function errorOf(err) {
+  return { kind: "error", message: err instanceof Error ? err.message : String(err) };
+}
+
+// src/cli/commands/launch.ts
+function formatStep2(name, r) {
+  if (r.kind === "error") return `${name.padEnd(20)} error: ${r.message}`;
+  if (r.kind === "audit") {
+    const s = r.scores;
+    return `${name.padEnd(20)} audited (P=${s.performance} A=${s.accessibility} BP=${s.bestPractices} SEO=${s.seo})`;
+  }
+  if (r.kind === "draft") {
+    return `${name.padEnd(20)} drafted ${r.report.reportId}`;
+  }
+  const rec = r.result;
+  if (rec.status === "noop") return `${name.padEnd(20)} noop${rec.notes ? ` \u2014 ${rec.notes}` : ""}`;
+  if (rec.status === "failed")
+    return `${name.padEnd(20)} failed${rec.notes ? ` \u2014 ${rec.notes}` : ""}`;
+  return `${name.padEnd(20)} applied (${rec.commits.length} commit${rec.commits.length === 1 ? "" : "s"})${rec.notes ? ` \u2014 ${rec.notes}` : ""}`;
+}
+function formatResult9(r) {
+  const header = `[${r.site}] launch \u2014 ${r.complete ? "drafted (awaiting approval)" : "STOPPED"}`;
+  const body = r.steps.map((s) => formatStep2(s.name, s.result)).join("\n");
+  return `${header}
+${body}`;
+}
+async function runLaunchCommand(site, opts) {
+  const cwd = opts.cwd ? resolve11(opts.cwd) : process.cwd();
+  const sites = await resolveSites({ site, cwd });
+  const target = sites[0];
+  if (!target) {
+    return { output: `No site resolved for "${site}".`, code: 1 };
+  }
+  const result = await launch(target);
+  return { output: formatResult9(result), code: result.complete ? 0 : 1 };
+}
+
+// src/cli/commands/github-signals.ts
+init_client();
+init_websites();
+
+// src/audits/github-signals.ts
+init_renovate();
+async function collectGitHubSignals(sites, deps, onSkip = () => {
+}) {
+  const rows = [];
+  for (const s of sites) {
+    const repo = s.gitRepo;
+    if (!repo) continue;
+    const name = s.name;
+    if (!name) continue;
+    try {
+      const prs = await deps.openPullRequests(repo);
+      const status = await deps.defaultBranchStatus(repo);
+      rows.push({
+        site: name,
+        repo,
+        renovateFailingCis: prs.filter(isFailingRenovatePR).length,
+        ciState: status.ciState,
+        lastCommitAt: status.lastCommitAt
+      });
+    } catch {
+      onSkip({ repo });
+    }
+  }
+  return rows;
+}
+
+// src/cli/commands/github-signals.ts
+init_gh();
+init_write_audits_to_airtable();
+async function runGitHubSignalsCommand(opts) {
+  if (!opts.fleet || !opts.writeAirtable) {
+    return { output: "github-signals currently supports only --fleet --write-airtable", code: 2 };
+  }
+  const token = process.env.RENOVATE_TOKEN?.trim() || process.env.GH_TOKEN?.trim();
+  if (!token) {
+    return {
+      output: "github-signals skipped: no RENOVATE_TOKEN/GH_TOKEN (fleet read) configured.",
+      code: 0
+    };
+  }
+  const base = openBase(readAirtableConfig());
+  const websites = await listWebsites(base);
+  const gh = makeGitHub({ token });
+  const sites = websites.map((w) => ({
+    path: "",
+    name: w.name,
+    meta: {},
+    ...w.gitRepo ? { gitRepo: w.gitRepo } : {}
+  }));
+  const skipped = [];
+  const rows = await collectGitHubSignals(
+    sites,
+    {
+      openPullRequests: (r) => gh.openPullRequests(r),
+      defaultBranchStatus: (r) => gh.defaultBranchStatus(r)
+    },
+    ({ repo }) => skipped.push(repo)
+  );
+  const sweptAt = (/* @__PURE__ */ new Date()).toISOString();
+  const result = { written: [], failed: [] };
+  const byRepo = new Map(websites.filter((w) => w.gitRepo).map((w) => [w.gitRepo, w]));
+  for (const row of rows) {
+    const target = byRepo.get(row.repo);
+    if (!target) {
+      result.failed.push({ slug: siteSlug(row.site), error: "no Websites row matched" });
+      continue;
+    }
+    try {
+      await updateGitHubSignals(base, target.id, {
+        renovateFailingCis: row.renovateFailingCis,
+        ciState: row.ciState,
+        lastCommitAt: row.lastCommitAt,
+        sweptAt
+      });
+      result.written.push({
+        siteName: target.name,
+        writes: [{ audit: "github-signals", counts: row }]
+      });
+    } catch (e) {
+      result.failed.push({ slug: siteSlug(row.site), error: e.message });
+    }
+  }
+  for (const repo of skipped) result.failed.push({ slug: repo, error: "probe failed (skipped)" });
+  return {
+    output: formatFleetWriteSummary(result),
+    code: result.failed.length > 0 && result.written.length === 0 ? 1 : 0
+  };
+}
+
 // src/cli/version.ts
 import { readFileSync as readFileSync5, existsSync as existsSync4 } from "fs";
 import { dirname as dirname8, join as join27 } from "path";
@@ -5286,6 +6081,12 @@ cli.command(
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(() => runInitCommand(site, opts), opts)
 );
+cli.command(
+  "launch <site>",
+  "Bootstrap + first-audit a site, then draft its launch email for approval."
+).action(
+  async (site, opts) => runOrExit(() => runLaunchCommand(site, opts), opts)
+);
 cli.command("report [site]", "Draft or send maintenance/testing reports.").option("--due", "Scan all Websites and draft overdue reports.").option(
   "--preview",
   "Single-site dry run; writes reports/<slug>/draft.html, never touches Airtable."
@@ -5298,6 +6099,15 @@ cli.command("report [site]", "Draft or send maintenance/testing reports.").optio
 ).action(
   async (site, opts) => runOrExit(() => runReportCommand(site, opts), opts)
 );
+cli.command(
+  "github-signals",
+  "Sweep the fleet for GitHub signals (Renovate-failing/CI/last-commit) and write Airtable."
+).option("--fleet", "Run across every site in the Airtable inventory.").option("--write-airtable", "Write each site's signals back to its Websites row.").action(
+  async (opts) => runOrExit(
+    () => runGitHubSignalsCommand({ fleet: opts.fleet, writeAirtable: opts.writeAirtable }),
+    opts
+  )
+);
 cli.help();
 cli.version(version);
 cli.parse();