@reddoorla/maintenance 0.49.0 → 0.50.0

package/dist/cli/commands/audit.d.ts

@@ -1,4 +1,4 @@
-import { S as Site, a as AuditResult, A as AuditName } from '../../types-DeKpgkG-.js';
+import { S as Site, a as AuditResult, A as AuditName } from '../../types-QG-QhCYh.js';
 
 type AuditCommandOptions = {
     only?: string;
@@ -32,10 +32,8 @@ declare function parseConcurrency(value: string | undefined): boolean | number;
  *  null when there's nothing to warn about. Keeps the mixed-provenance result
  *  table from silently confusing the operator. */
 declare function deployedUrlNotice(which: AuditName[], url: string | undefined, cwd: string): string | null;
-/** A fleet site needs a local checkout unless every requested audit can run
- *  against its deployed URL. Today only lighthouse has a deployed mode, so a
- *  site is checkout-free exactly when it has a `deployedUrl` and lighthouse is
- *  the only requested audit. */
+/** A fleet site needs a local checkout unless every requested audit is checkout-free AND the site
+ *  has a `deployedUrl` for them to run against. */
 declare function auditNeedsCheckout(site: Site, which: AuditName[]): boolean;
 /** Apply a single-site `--url` to the resolved sites. Returns the input
  *  untouched when no url is given; otherwise requires exactly one site and

package/dist/cli/commands/audit.js

@@ -159,6 +159,14 @@ function mapRow(rec) {
     securityVulnsHigh: f["Security Vulns High"] ?? null,
     securityVulnsModerate: f["Security Vulns Moderate"] ?? null,
     securityVulnsLow: f["Security Vulns Low"] ?? null,
+    lastSecurityAuditAt: f["Last security audit at"] ?? null,
+    certDaysRemaining: f["Cert days remaining"] ?? null,
+    domainCheckedAt: f["Domain checked at"] ?? null,
+    crossbrowserOk: typeof f["Crossbrowser OK"] === "boolean" ? f["Crossbrowser OK"] : null,
+    mobileOk: typeof f["Mobile OK"] === "boolean" ? f["Mobile OK"] : null,
+    linksOk: typeof f["Links OK"] === "boolean" ? f["Links OK"] : null,
+    brokenLinks: typeof f["Broken links"] === "number" ? f["Broken links"] : null,
+    browserCheckedAt: f["Browser checked at"] ?? null,
     copyIntro: trimToNull(f["Copy \u2014 Intro"]),
     copyContact: trimToNull(f["Copy \u2014 Contact"]),
     copyFooter: trimToNull(f["Copy \u2014 Footer"]),
@@ -220,7 +228,24 @@ function securityFields(counts) {
     "Security Vulns Critical": counts.critical,
     "Security Vulns High": counts.high,
     "Security Vulns Moderate": counts.moderate,
-    "Security Vulns Low": counts.low
+    "Security Vulns Low": counts.low,
+    // Stamp freshness alongside the counts so the Security Updates auto-tick can require a recent
+    // audit (a clean count from months ago must not silently keep ticking the box).
+    "Last security audit at": (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function domainFields(result) {
+  const fields = { "Domain checked at": result.checkedAt };
+  if (result.certDaysRemaining !== null) fields["Cert days remaining"] = result.certDaysRemaining;
+  return fields;
+}
+function browserFields(r) {
+  return {
+    "Crossbrowser OK": r.desktopOk,
+    "Mobile OK": r.mobileOk,
+    "Links OK": r.linksOk,
+    "Broken links": r.brokenLinks,
+    "Browser checked at": r.checkedAt
   };
 }
 async function updateScores(base, recordId, scores) {
@@ -241,6 +266,8 @@ async function updateAuditFields(base, recordId, audits) {
   if (audits.a11y) Object.assign(fields, a11yFields(audits.a11y));
   if (audits.deps) Object.assign(fields, depsFields(audits.deps));
   if (audits.security) Object.assign(fields, securityFields(audits.security));
+  if (audits.domain) Object.assign(fields, domainFields(audits.domain));
+  if (audits.browser) Object.assign(fields, browserFields(audits.browser));
   await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);
   return fields;
 }
@@ -435,6 +462,53 @@ var init_security_airtable = __esm({
   }
 });
 
+// src/audits/domain-airtable.ts
+function hasDomainResult(result) {
+  if (result.audit !== "domain") return false;
+  const d = result.details;
+  return !!d && typeof d.checkedAt === "string";
+}
+function domainResultFromAudit(result) {
+  if (result.audit !== "domain") {
+    throw new Error(`Expected a 'domain' AuditResult, got '${result.audit}'`);
+  }
+  const d = result.details;
+  return {
+    certDaysRemaining: typeof d?.certDaysRemaining === "number" ? d.certDaysRemaining : null,
+    checkedAt: typeof d?.checkedAt === "string" ? d.checkedAt : (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+var init_domain_airtable = __esm({
+  "src/audits/domain-airtable.ts"() {
+    "use strict";
+  }
+});
+
+// src/audits/browser-airtable.ts
+function hasBrowserResult(result) {
+  if (result.audit !== "browser") return false;
+  const d = result.details;
+  return !!d && typeof d.checkedAt === "string";
+}
+function browserFieldsFromAudit(result) {
+  if (result.audit !== "browser") {
+    throw new Error(`Expected a 'browser' AuditResult, got '${result.audit}'`);
+  }
+  const d = result.details;
+  return {
+    desktopOk: d?.desktopOk === true,
+    mobileOk: d?.mobileOk === true,
+    linksOk: d?.linksOk === true,
+    brokenLinks: typeof d?.brokenLinks === "number" ? d.brokenLinks : 0,
+    checkedAt: typeof d?.checkedAt === "string" ? d.checkedAt : (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+var init_browser_airtable = __esm({
+  "src/audits/browser-airtable.ts"() {
+    "use strict";
+  }
+});
+
 // src/audits/write-audits-to-airtable.ts
 var write_audits_to_airtable_exports = {};
 __export(write_audits_to_airtable_exports, {
@@ -445,22 +519,14 @@ __export(write_audits_to_airtable_exports, {
 async function writeAuditsToAirtable(args) {
   const { base, websites, slug, results } = args;
   const lhResult = results.find((r) => r.audit === "lighthouse");
-  if (!lhResult) {
-    throw Object.assign(
-      new Error(
-        "--write-airtable requires a lighthouse result; did you pass --only without lighthouse?"
-      ),
-      { exitCode: 2 }
-    );
-  }
   const target = websites.find((w) => siteSlug(w.name) === slug);
   if (!target) {
     throw Object.assign(new Error(`No Websites row matched slug "${slug}"`), { exitCode: 2 });
   }
   const writes = [];
   const audits = {};
-  const lhHasScores = hasRealScores(lhResult);
-  if (lhHasScores) {
+  const lhHasScores = lhResult ? hasRealScores(lhResult) : false;
+  if (lhResult && lhHasScores) {
     const scores = lighthouseScoresFromResult(lhResult);
     audits.scores = scores;
     writes.push({ audit: "lighthouse", counts: scores });
@@ -483,10 +549,22 @@ async function writeAuditsToAirtable(args) {
     audits.security = counts;
     writes.push({ audit: "security", counts });
   }
+  const dom = results.find((r) => r.audit === "domain");
+  if (dom && hasDomainResult(dom)) {
+    const result = domainResultFromAudit(dom);
+    audits.domain = result;
+    writes.push({ audit: "domain", counts: result });
+  }
+  const browser = results.find((r) => r.audit === "browser");
+  if (browser && hasBrowserResult(browser)) {
+    const fields = browserFieldsFromAudit(browser);
+    audits.browser = fields;
+    writes.push({ audit: "browser", counts: fields });
+  }
   if (Object.keys(audits).length > 0) {
     await updateAuditFields(base, target.id, audits);
   }
-  if (!lhHasScores) {
+  if (lhResult && !lhHasScores) {
     const persisted = writes.map((w) => w.audit);
     throw Object.assign(
       new Error(
@@ -537,6 +615,8 @@ var init_write_audits_to_airtable = __esm({
     init_a11y_airtable();
     init_deps_airtable();
     init_security_airtable();
+    init_domain_airtable();
+    init_browser_airtable();
   }
 });
 
@@ -1485,13 +1565,348 @@ async function a11yAudit(ctx) {
   }
 }
 
+// src/audits/domain.ts
+import { promises as dnsPromises } from "dns";
+import tls from "tls";
+var MS_PER_DAY = 24 * 60 * 60 * 1e3;
+async function checkDomain(url, deps) {
+  let host;
+  try {
+    host = new URL(url).hostname;
+  } catch {
+    return { resolved: false, certDaysRemaining: null };
+  }
+  try {
+    await deps.lookup(host);
+  } catch {
+    return { resolved: false, certDaysRemaining: null };
+  }
+  let validTo;
+  try {
+    validTo = await deps.certValidTo(host);
+  } catch {
+    validTo = null;
+  }
+  if (!validTo || Number.isNaN(validTo.getTime()))
+    return { resolved: true, certDaysRemaining: null };
+  return {
+    resolved: true,
+    certDaysRemaining: Math.floor((validTo.getTime() - deps.now.getTime()) / MS_PER_DAY)
+  };
+}
+function defaultDomainDeps(now) {
+  return {
+    lookup: async (host) => {
+      await dnsPromises.lookup(host);
+    },
+    certValidTo: (host) => new Promise((resolvePromise) => {
+      const socket = tls.connect(
+        { host, port: 443, servername: host, timeout: 1e4, rejectUnauthorized: true },
+        () => {
+          const cert = socket.authorized ? socket.getPeerCertificate() : null;
+          socket.end();
+          const validTo = cert && cert.valid_to ? new Date(cert.valid_to) : null;
+          resolvePromise(validTo);
+        }
+      );
+      socket.on("error", () => resolvePromise(null));
+      socket.on("timeout", () => {
+        socket.destroy();
+        resolvePromise(null);
+      });
+    }),
+    now
+  };
+}
+async function domainAudit(ctx) {
+  const { site } = ctx;
+  const label = siteLabel(site);
+  if (!site.deployedUrl) {
+    return { audit: "domain", site: label, status: "skip", summary: "no deployed URL" };
+  }
+  const now = ctx.now ?? /* @__PURE__ */ new Date();
+  const deps = ctx.domainDeps ?? defaultDomainDeps(now);
+  const check = await checkDomain(site.deployedUrl, deps);
+  const checkedAt = now.toISOString();
+  const status = check.resolved && check.certDaysRemaining !== null && check.certDaysRemaining > 14 ? "pass" : "warn";
+  const summary = !check.resolved ? "did not resolve" : check.certDaysRemaining === null ? "resolved, no usable TLS cert" : `resolved, cert ${check.certDaysRemaining}d remaining`;
+  return {
+    audit: "domain",
+    site: label,
+    status,
+    summary,
+    details: { resolved: check.resolved, certDaysRemaining: check.certDaysRemaining, checkedAt }
+  };
+}
+
+// src/audits/route-discovery.ts
+var DEFAULT_CAP = 15;
+function parseSitemapUrls(xml) {
+  const out = [];
+  const re = /<loc>\s*([^<\s]+)\s*<\/loc>/gi;
+  let m;
+  while ((m = re.exec(xml)) !== null) {
+    const url = m[1];
+    if (url) out.push(url.trim());
+  }
+  return out;
+}
+function parseHtmlLinks(html, baseUrl) {
+  const out = /* @__PURE__ */ new Set();
+  const re = /<a\b[^>]*\bhref\s*=\s*["']([^"']+)["']/gi;
+  let m;
+  while ((m = re.exec(html)) !== null) {
+    const href = m[1];
+    if (!href || href.startsWith("#") || /^(mailto:|tel:|javascript:)/i.test(href)) continue;
+    try {
+      const u = new URL(href, baseUrl);
+      if (u.origin !== new URL(baseUrl).origin) continue;
+      out.add(u.pathname);
+    } catch {
+    }
+  }
+  return [...out];
+}
+function family(pathname) {
+  return pathname.split("/").filter(Boolean)[0] ?? "";
+}
+function sampleRoutePaths(urlsOrPaths, cap = DEFAULT_CAP) {
+  const seen = /* @__PURE__ */ new Set(["/"]);
+  const buckets = /* @__PURE__ */ new Map();
+  for (const raw of urlsOrPaths) {
+    let pathname;
+    try {
+      pathname = raw.startsWith("/") ? new URL(raw, "https://x.invalid").pathname : new URL(raw).pathname;
+    } catch {
+      continue;
+    }
+    if (pathname === "/") continue;
+    if (seen.has(pathname)) continue;
+    seen.add(pathname);
+    const fam = family(pathname);
+    const arr = buckets.get(fam) ?? [];
+    arr.push(pathname);
+    buckets.set(fam, arr);
+  }
+  const result = ["/"];
+  const families = [...buckets.values()];
+  let guard = 0;
+  while (result.length < cap && families.some((f) => f.length > 0) && guard++ < 1e4) {
+    for (const fam of families) {
+      if (result.length >= cap) break;
+      const next = fam.shift();
+      if (next) result.push(next);
+    }
+  }
+  return result;
+}
+function familyCountsOf(paths) {
+  const counts = {};
+  for (const p of paths) {
+    const key = p === "/" ? "/" : `/${family(p)}`;
+    counts[key] = (counts[key] ?? 0) + 1;
+  }
+  return counts;
+}
+async function discoverRoutes(deployedUrl, deps, cap = DEFAULT_CAP) {
+  const origin = new URL(deployedUrl).origin;
+  const abs = (paths) => paths.map((p) => new URL(p, origin).href);
+  const sitemapXml = await deps.fetchText(new URL("/sitemap.xml", origin).href);
+  if (sitemapXml) {
+    const urls = parseSitemapUrls(sitemapXml);
+    if (urls.length > 0) {
+      const paths = sampleRoutePaths(urls, cap);
+      return { routes: abs(paths), source: "sitemap", familyCounts: familyCountsOf(paths) };
+    }
+  }
+  const homeHtml = await deps.fetchText(origin);
+  if (homeHtml) {
+    const links = parseHtmlLinks(homeHtml, origin);
+    if (links.length > 0) {
+      const paths = sampleRoutePaths(links, cap);
+      return { routes: abs(paths), source: "homepage-links", familyCounts: familyCountsOf(paths) };
+    }
+  }
+  return { routes: [new URL("/", origin).href], source: "root-only", familyCounts: { "/": 1 } };
+}
+
+// src/audits/browser.ts
+function isBroken(status) {
+  return status === null || status >= 400;
+}
+function summarizeBrowser(routes, links, familyCounts) {
+  const desktopChecks = routes.flatMap((r) => r.desktop);
+  const mobileChecks = routes.flatMap((r) => r.mobile);
+  const desktopOk = routes.length > 0 && routes.every((r) => r.desktop.length > 0 && r.desktop.every((d) => d.ok));
+  const mobileOk = routes.length > 0 && routes.every((r) => r.mobile.length > 0 && r.mobile.every((m) => m.ok));
+  const brokenLinks = links.filter((l) => isBroken(l.status)).length;
+  const linksOk = links.length > 0 && brokenLinks === 0;
+  const engines = [...new Set(desktopChecks.map((d) => d.engine))];
+  const devices2 = [...new Set(mobileChecks.map((m) => m.device))];
+  const families = Object.entries(familyCounts).map(([f, n]) => f === "/" ? "/" : `${f} \xD7${n}`).join(", ");
+  const note = `${routes.length} routes (${families}); desktop ${engines.join("/") || "\u2014"}; mobile ${devices2.join("/") || "\u2014"}; ${links.length} links, ${brokenLinks} broken`;
+  return { desktopOk, mobileOk, linksOk, brokenLinks, routesChecked: routes.length, note };
+}
+async function browserAudit(ctx) {
+  const { site } = ctx;
+  const label = siteLabel(site);
+  if (!site.deployedUrl) {
+    return { audit: "browser", site: label, status: "skip", summary: "no deployed URL" };
+  }
+  const now = ctx.now ?? /* @__PURE__ */ new Date();
+  const discoverDeps = ctx.discoverDeps ?? defaultDiscoverDeps();
+  const runner = ctx.browserRunner ?? await defaultBrowserRunner();
+  try {
+    const discovered = await discoverRoutes(site.deployedUrl, discoverDeps);
+    const routeResults = await runner.probe(discovered.routes);
+    const internalLinks = [...new Set(routeResults.flatMap((r) => r.links))];
+    const linkResults = await runner.checkLinks(internalLinks);
+    const summary = summarizeBrowser(
+      routeResults,
+      linkResults,
+      discovered.familyCounts ?? familyCountsOf(discovered.routes)
+    );
+    const status = summary.desktopOk && summary.mobileOk && summary.linksOk ? "pass" : "warn";
+    return {
+      audit: "browser",
+      site: label,
+      status,
+      summary: summary.note,
+      details: { ...summary, checkedAt: now.toISOString() }
+    };
+  } finally {
+    await runner.close?.();
+  }
+}
+function defaultDiscoverDeps() {
+  return {
+    fetchText: async (url) => {
+      try {
+        const res = await fetch(url, { redirect: "follow" });
+        if (!res.ok) return null;
+        return await res.text();
+      } catch {
+        return null;
+      }
+    }
+  };
+}
+var DESKTOP_VIEWPORT = { width: 1366, height: 900 };
+var PAGE_TIMEOUT_MS = 3e4;
+async function defaultBrowserRunner() {
+  const { chromium, firefox, webkit, devices: devices2 } = await import("@playwright/test");
+  const desktopEngines = [
+    { engine: "chromium", type: chromium },
+    { engine: "firefox", type: firefox },
+    { engine: "webkit", type: webkit }
+  ];
+  const mobileTargets = [
+    { device: "Pixel 7", descriptor: devices2["Pixel 7"] },
+    { device: "iPhone 14", descriptor: devices2["iPhone 14"] }
+  ];
+  return {
+    async probe(urls) {
+      const results = [];
+      const browsers = await Promise.all(desktopEngines.map((e) => e.type.launch()));
+      const mobileBrowsers = await Promise.all(mobileTargets.map(() => chromium.launch()));
+      try {
+        for (const url of urls) {
+          const desktop = [];
+          const linkSet = /* @__PURE__ */ new Set();
+          for (let i = 0; i < desktopEngines.length; i++) {
+            const engine = desktopEngines[i].engine;
+            const browser = browsers[i];
+            const ctx = await browser.newContext({ viewport: DESKTOP_VIEWPORT });
+            const page = await ctx.newPage();
+            const errors = [];
+            page.on("pageerror", (e) => errors.push(String(e)));
+            let ok = false;
+            try {
+              const resp = await page.goto(url, {
+                waitUntil: "domcontentloaded",
+                timeout: PAGE_TIMEOUT_MS
+              });
+              const hasMain = await page.locator("main, [role=main]").first().isVisible().catch(() => false);
+              ok = !!resp && resp.ok() && errors.length === 0 && hasMain;
+              if (engine === "chromium") {
+                const hrefs = await page.evaluate("Array.from(document.querySelectorAll('a[href]')).map((a) => a.href)").catch(() => []);
+                const origin = new URL(url).origin;
+                for (const h of hrefs) {
+                  try {
+                    if (new URL(h).origin === origin) linkSet.add(new URL(h).href);
+                  } catch {
+                  }
+                }
+              }
+            } catch {
+              ok = false;
+            } finally {
+              await ctx.close().catch(() => {
+              });
+            }
+            desktop.push({ engine, ok });
+          }
+          const mobile = [];
+          for (let i = 0; i < mobileTargets.length; i++) {
+            const { device, descriptor } = mobileTargets[i];
+            const browser = mobileBrowsers[i];
+            const ctx = await browser.newContext({ ...descriptor });
+            const page = await ctx.newPage();
+            const errors = [];
+            page.on("pageerror", (e) => errors.push(String(e)));
+            let ok = false;
+            try {
+              const resp = await page.goto(url, {
+                waitUntil: "domcontentloaded",
+                timeout: PAGE_TIMEOUT_MS
+              });
+              const overflow = await page.evaluate("document.documentElement.scrollWidth > window.innerWidth + 2").catch(() => true);
+              ok = !!resp && resp.ok() && errors.length === 0 && !overflow;
+            } catch {
+              ok = false;
+            } finally {
+              await ctx.close().catch(() => {
+              });
+            }
+            mobile.push({ device, ok });
+          }
+          results.push({ url, desktop, mobile, links: [...linkSet] });
+        }
+      } finally {
+        await Promise.all([...browsers, ...mobileBrowsers].map((b) => b.close().catch(() => {
+        })));
+      }
+      return results;
+    },
+    async checkLinks(urls) {
+      const out = [];
+      for (const url of urls) {
+        let status;
+        try {
+          let res = await fetch(url, { method: "HEAD", redirect: "follow" });
+          if (res.status === 405 || res.status === 501) {
+            res = await fetch(url, { method: "GET", redirect: "follow" });
+          }
+          status = res.status;
+        } catch {
+          status = null;
+        }
+        out.push({ url, status });
+      }
+      return out;
+    }
+  };
+}
+
 // src/audits/index.ts
 var REGISTRY = {
   deps: depsAudit,
   lint: lintAudit,
   security: securityAudit,
   lighthouse: lighthouseAudit,
-  a11y: a11yAudit
+  a11y: a11yAudit,
+  domain: domainAudit,
+  browser: browserAudit
 };
 var ALL_AUDIT_NAMES = Object.keys(REGISTRY);
 var DEFAULT_AUDIT_TIMEOUT_MS = 3e4;
@@ -1902,8 +2317,13 @@ function deployedUrlNotice(which, url, cwd) {
   if (others.length === 0) return null;
   return `note: --url only affects lighthouse; ${others.join(", ")} ran against the local checkout at ${cwd}`;
 }
+var CHECKOUT_FREE_AUDITS = /* @__PURE__ */ new Set([
+  "lighthouse",
+  "domain",
+  "browser"
+]);
 function auditNeedsCheckout(site, which) {
-  const deployedCapable = site.deployedUrl !== void 0 && which.every((n) => n === "lighthouse");
+  const deployedCapable = site.deployedUrl !== void 0 && which.every((n) => CHECKOUT_FREE_AUDITS.has(n));
   return !deployedCapable;
 }
 function applyDeployedUrl(sites, url) {