@reddoorla/maintenance 0.49.0 → 0.50.0

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { S as Site, a as AuditResult, A as AuditName, b as RecipeResult, R as RecipeName, I as InventoryProvider } from './types-DeKpgkG-.js';
-export { C as ConfigName } from './types-DeKpgkG-.js';
+import { S as Site, a as AuditResult, A as AuditName, b as RecipeResult, R as RecipeName, I as InventoryProvider } from './types-QG-QhCYh.js';
+export { C as ConfigName } from './types-QG-QhCYh.js';
 import * as airtable_lib_airtable_base_js from 'airtable/lib/airtable_base.js';
 import { F as FormType } from './types-RXY-vY-5.js';
 export { SyncConfigsOptions, syncConfigs } from './recipes/sync-configs.js';
@@ -20,9 +20,65 @@ type SpawnOptions = {
 };
 type SpawnFn = (cmd: string, args: readonly string[], opts?: SpawnOptions) => Promise<SpawnResult>;
 
+/** Injected IO so the check is unit-testable without real DNS/TLS. `lookup` throws when the host
+ *  doesn't resolve; `certValidTo` returns the cert's notAfter date, or null when there's none. */
+type DomainDeps = {
+    lookup: (host: string) => Promise<void>;
+    certValidTo: (host: string) => Promise<Date | null>;
+    now: Date;
+};
+
+/**
+ * Route discovery for the deployed-URL browser audit. Pulls the site's sitemap, then samples a
+ * REPRESENTATIVE set of paths — bucketed by path family (first segment) and sampled round-robin —
+ * so every page *type* is covered, including the dynamic CMS-generated templates (Prismic
+ * `[uid]`/`[slug]` detail pages: blog posts, projects, portfolio items) where broken
+ * images / overflowing galleries / dead links hide. Taking the first N sitemap entries would skew
+ * to top-level static pages and miss them. Pure functions + one fetch-injected entry point.
+ */
+type DiscoverDeps = {
+    /** Fetch a URL, returning its text body, or null on any non-2xx / network error. */
+    fetchText: (url: string) => Promise<string | null>;
+};
+
+/** One route probed across desktop engines + mobile devices, plus the internal links found on it. */
+type RouteResult = {
+    url: string;
+    /** Per desktop engine (chromium/firefox/webkit): loaded with no JS error + a visible main landmark. */
+    desktop: Array<{
+        engine: string;
+        ok: boolean;
+    }>;
+    /** Per mobile device: loaded with no JS error and no horizontal overflow. */
+    mobile: Array<{
+        device: string;
+        ok: boolean;
+    }>;
+    /** Same-origin links discovered on the page (absolute URLs), for the Links check. */
+    links: string[];
+};
+type LinkResult = {
+    url: string;
+    status: number | null;
+};
+/** Injected browser IO. The real impl drives Playwright; tests pass a fake. */
+type BrowserRunner = {
+    probe: (urls: string[]) => Promise<RouteResult[]>;
+    checkLinks: (urls: string[]) => Promise<LinkResult[]>;
+    close?: () => Promise<void>;
+};
+
 type AuditContext = {
     site: Site;
     spawn?: SpawnFn;
+    /** Clock injection (domain + browser audits). Defaults to `new Date()`. */
+    now?: Date;
+    /** DNS/TLS injection for the domain audit (tests). Defaults to real DNS+TLS. */
+    domainDeps?: DomainDeps;
+    /** Sitemap/homepage fetch injection for the browser audit (tests). Defaults to real fetch. */
+    discoverDeps?: DiscoverDeps;
+    /** Playwright runner injection for the browser audit (tests). Defaults to real Playwright. */
+    browserRunner?: BrowserRunner;
 };
 
 declare function depsAudit(ctx: AuditContext): Promise<AuditResult>;
@@ -248,6 +304,20 @@ type WebsiteRow = {
     securityVulnsHigh: number | null;
     securityVulnsModerate: number | null;
     securityVulnsLow: number | null;
+    /** ISO timestamp the security audit last ran — gates freshness of the Security Updates auto-tick
+     *  (clean counts only auto-tick when recent). */
+    lastSecurityAuditAt: string | null;
+    /** Domain/DNS/SSL probe (the `domain` audit). `certDaysRemaining` is days until the TLS cert
+     *  expires (null = unresolved or no usable cert); `domainCheckedAt` is when it last ran. */
+    certDaysRemaining: number | null;
+    domainCheckedAt: string | null;
+    /** Deployed-URL browser probe (the `browser` audit): cross-engine render OK, mobile render OK,
+     *  internal-links OK + broken count, and when it last ran (one timestamp gates all three). */
+    crossbrowserOk: boolean | null;
+    mobileOk: boolean | null;
+    linksOk: boolean | null;
+    brokenLinks: number | null;
+    browserCheckedAt: string | null;
     /** Per-site copy overrides (M6a). Blank → null → the DEFAULT_COPY value. */
     copyIntro: string | null;
     copyContact: string | null;
@@ -356,6 +426,14 @@ type ReportData = {
     headerBgColor?: string;
 };
 
+/** A single auto-check outcome. `pass` + fresh ⇒ the caller ticks the box. */
+type EvidenceResult = "pass" | "fail" | "unknown";
+type EvidenceRecord = {
+    result: EvidenceResult;
+    checkedAt: string | null;
+    note: string;
+};
+
 type DeliveryStatus = "pending" | "delivered" | "bounced" | "complained";
 type ReportRow = {
     id: string;
@@ -391,6 +469,10 @@ type ReportRow = {
      *  missing/false cells read false. Maintenance/Testing reports gate approve+send on the relevant
      *  subset (see src/reports/checklist.ts). */
     checklist: Record<string, boolean>;
+    /** Snapshot of the auto-tick evidence at draft time, keyed by checklist field → evidence
+     *  record. Null when the report predates auto-tick or carried no auto-checked items. Drives the
+     *  dashboard's green/amber badges; the gate still reads the booleans, not this. */
+    autoEvidence: Record<string, EvidenceRecord> | null;
 };
 
 type DraftOptions = {