@reddoorla/maintenance 0.49.0 → 0.50.0

package/dist/index.js

@@ -939,13 +939,348 @@ async function a11yAudit(ctx) {
   }
 }
 
+// src/audits/domain.ts
+import { promises as dnsPromises } from "dns";
+import tls from "tls";
+var MS_PER_DAY = 24 * 60 * 60 * 1e3;
+async function checkDomain(url, deps) {
+  let host;
+  try {
+    host = new URL(url).hostname;
+  } catch {
+    return { resolved: false, certDaysRemaining: null };
+  }
+  try {
+    await deps.lookup(host);
+  } catch {
+    return { resolved: false, certDaysRemaining: null };
+  }
+  let validTo;
+  try {
+    validTo = await deps.certValidTo(host);
+  } catch {
+    validTo = null;
+  }
+  if (!validTo || Number.isNaN(validTo.getTime()))
+    return { resolved: true, certDaysRemaining: null };
+  return {
+    resolved: true,
+    certDaysRemaining: Math.floor((validTo.getTime() - deps.now.getTime()) / MS_PER_DAY)
+  };
+}
+function defaultDomainDeps(now) {
+  return {
+    lookup: async (host) => {
+      await dnsPromises.lookup(host);
+    },
+    certValidTo: (host) => new Promise((resolvePromise) => {
+      const socket = tls.connect(
+        { host, port: 443, servername: host, timeout: 1e4, rejectUnauthorized: true },
+        () => {
+          const cert = socket.authorized ? socket.getPeerCertificate() : null;
+          socket.end();
+          const validTo = cert && cert.valid_to ? new Date(cert.valid_to) : null;
+          resolvePromise(validTo);
+        }
+      );
+      socket.on("error", () => resolvePromise(null));
+      socket.on("timeout", () => {
+        socket.destroy();
+        resolvePromise(null);
+      });
+    }),
+    now
+  };
+}
+async function domainAudit(ctx) {
+  const { site } = ctx;
+  const label = siteLabel(site);
+  if (!site.deployedUrl) {
+    return { audit: "domain", site: label, status: "skip", summary: "no deployed URL" };
+  }
+  const now = ctx.now ?? /* @__PURE__ */ new Date();
+  const deps = ctx.domainDeps ?? defaultDomainDeps(now);
+  const check = await checkDomain(site.deployedUrl, deps);
+  const checkedAt = now.toISOString();
+  const status = check.resolved && check.certDaysRemaining !== null && check.certDaysRemaining > 14 ? "pass" : "warn";
+  const summary = !check.resolved ? "did not resolve" : check.certDaysRemaining === null ? "resolved, no usable TLS cert" : `resolved, cert ${check.certDaysRemaining}d remaining`;
+  return {
+    audit: "domain",
+    site: label,
+    status,
+    summary,
+    details: { resolved: check.resolved, certDaysRemaining: check.certDaysRemaining, checkedAt }
+  };
+}
+
+// src/audits/route-discovery.ts
+var DEFAULT_CAP = 15;
+function parseSitemapUrls(xml) {
+  const out = [];
+  const re = /<loc>\s*([^<\s]+)\s*<\/loc>/gi;
+  let m;
+  while ((m = re.exec(xml)) !== null) {
+    const url = m[1];
+    if (url) out.push(url.trim());
+  }
+  return out;
+}
+function parseHtmlLinks(html, baseUrl) {
+  const out = /* @__PURE__ */ new Set();
+  const re = /<a\b[^>]*\bhref\s*=\s*["']([^"']+)["']/gi;
+  let m;
+  while ((m = re.exec(html)) !== null) {
+    const href = m[1];
+    if (!href || href.startsWith("#") || /^(mailto:|tel:|javascript:)/i.test(href)) continue;
+    try {
+      const u = new URL(href, baseUrl);
+      if (u.origin !== new URL(baseUrl).origin) continue;
+      out.add(u.pathname);
+    } catch {
+    }
+  }
+  return [...out];
+}
+function family(pathname) {
+  return pathname.split("/").filter(Boolean)[0] ?? "";
+}
+function sampleRoutePaths(urlsOrPaths, cap = DEFAULT_CAP) {
+  const seen = /* @__PURE__ */ new Set(["/"]);
+  const buckets = /* @__PURE__ */ new Map();
+  for (const raw of urlsOrPaths) {
+    let pathname;
+    try {
+      pathname = raw.startsWith("/") ? new URL(raw, "https://x.invalid").pathname : new URL(raw).pathname;
+    } catch {
+      continue;
+    }
+    if (pathname === "/") continue;
+    if (seen.has(pathname)) continue;
+    seen.add(pathname);
+    const fam = family(pathname);
+    const arr = buckets.get(fam) ?? [];
+    arr.push(pathname);
+    buckets.set(fam, arr);
+  }
+  const result = ["/"];
+  const families = [...buckets.values()];
+  let guard = 0;
+  while (result.length < cap && families.some((f) => f.length > 0) && guard++ < 1e4) {
+    for (const fam of families) {
+      if (result.length >= cap) break;
+      const next = fam.shift();
+      if (next) result.push(next);
+    }
+  }
+  return result;
+}
+function familyCountsOf(paths) {
+  const counts = {};
+  for (const p of paths) {
+    const key = p === "/" ? "/" : `/${family(p)}`;
+    counts[key] = (counts[key] ?? 0) + 1;
+  }
+  return counts;
+}
+async function discoverRoutes(deployedUrl, deps, cap = DEFAULT_CAP) {
+  const origin = new URL(deployedUrl).origin;
+  const abs = (paths) => paths.map((p) => new URL(p, origin).href);
+  const sitemapXml = await deps.fetchText(new URL("/sitemap.xml", origin).href);
+  if (sitemapXml) {
+    const urls = parseSitemapUrls(sitemapXml);
+    if (urls.length > 0) {
+      const paths = sampleRoutePaths(urls, cap);
+      return { routes: abs(paths), source: "sitemap", familyCounts: familyCountsOf(paths) };
+    }
+  }
+  const homeHtml = await deps.fetchText(origin);
+  if (homeHtml) {
+    const links = parseHtmlLinks(homeHtml, origin);
+    if (links.length > 0) {
+      const paths = sampleRoutePaths(links, cap);
+      return { routes: abs(paths), source: "homepage-links", familyCounts: familyCountsOf(paths) };
+    }
+  }
+  return { routes: [new URL("/", origin).href], source: "root-only", familyCounts: { "/": 1 } };
+}
+
+// src/audits/browser.ts
+function isBroken(status) {
+  return status === null || status >= 400;
+}
+function summarizeBrowser(routes, links, familyCounts) {
+  const desktopChecks = routes.flatMap((r) => r.desktop);
+  const mobileChecks = routes.flatMap((r) => r.mobile);
+  const desktopOk = routes.length > 0 && routes.every((r) => r.desktop.length > 0 && r.desktop.every((d) => d.ok));
+  const mobileOk = routes.length > 0 && routes.every((r) => r.mobile.length > 0 && r.mobile.every((m) => m.ok));
+  const brokenLinks = links.filter((l) => isBroken(l.status)).length;
+  const linksOk = links.length > 0 && brokenLinks === 0;
+  const engines = [...new Set(desktopChecks.map((d) => d.engine))];
+  const devices2 = [...new Set(mobileChecks.map((m) => m.device))];
+  const families = Object.entries(familyCounts).map(([f, n]) => f === "/" ? "/" : `${f} \xD7${n}`).join(", ");
+  const note = `${routes.length} routes (${families}); desktop ${engines.join("/") || "\u2014"}; mobile ${devices2.join("/") || "\u2014"}; ${links.length} links, ${brokenLinks} broken`;
+  return { desktopOk, mobileOk, linksOk, brokenLinks, routesChecked: routes.length, note };
+}
+async function browserAudit(ctx) {
+  const { site } = ctx;
+  const label = siteLabel(site);
+  if (!site.deployedUrl) {
+    return { audit: "browser", site: label, status: "skip", summary: "no deployed URL" };
+  }
+  const now = ctx.now ?? /* @__PURE__ */ new Date();
+  const discoverDeps = ctx.discoverDeps ?? defaultDiscoverDeps();
+  const runner = ctx.browserRunner ?? await defaultBrowserRunner();
+  try {
+    const discovered = await discoverRoutes(site.deployedUrl, discoverDeps);
+    const routeResults = await runner.probe(discovered.routes);
+    const internalLinks = [...new Set(routeResults.flatMap((r) => r.links))];
+    const linkResults = await runner.checkLinks(internalLinks);
+    const summary = summarizeBrowser(
+      routeResults,
+      linkResults,
+      discovered.familyCounts ?? familyCountsOf(discovered.routes)
+    );
+    const status = summary.desktopOk && summary.mobileOk && summary.linksOk ? "pass" : "warn";
+    return {
+      audit: "browser",
+      site: label,
+      status,
+      summary: summary.note,
+      details: { ...summary, checkedAt: now.toISOString() }
+    };
+  } finally {
+    await runner.close?.();
+  }
+}
+function defaultDiscoverDeps() {
+  return {
+    fetchText: async (url) => {
+      try {
+        const res = await fetch(url, { redirect: "follow" });
+        if (!res.ok) return null;
+        return await res.text();
+      } catch {
+        return null;
+      }
+    }
+  };
+}
+var DESKTOP_VIEWPORT = { width: 1366, height: 900 };
+var PAGE_TIMEOUT_MS = 3e4;
+async function defaultBrowserRunner() {
+  const { chromium, firefox, webkit, devices: devices2 } = await import("@playwright/test");
+  const desktopEngines = [
+    { engine: "chromium", type: chromium },
+    { engine: "firefox", type: firefox },
+    { engine: "webkit", type: webkit }
+  ];
+  const mobileTargets = [
+    { device: "Pixel 7", descriptor: devices2["Pixel 7"] },
+    { device: "iPhone 14", descriptor: devices2["iPhone 14"] }
+  ];
+  return {
+    async probe(urls) {
+      const results = [];
+      const browsers = await Promise.all(desktopEngines.map((e) => e.type.launch()));
+      const mobileBrowsers = await Promise.all(mobileTargets.map(() => chromium.launch()));
+      try {
+        for (const url of urls) {
+          const desktop = [];
+          const linkSet = /* @__PURE__ */ new Set();
+          for (let i = 0; i < desktopEngines.length; i++) {
+            const engine = desktopEngines[i].engine;
+            const browser = browsers[i];
+            const ctx = await browser.newContext({ viewport: DESKTOP_VIEWPORT });
+            const page = await ctx.newPage();
+            const errors = [];
+            page.on("pageerror", (e) => errors.push(String(e)));
+            let ok = false;
+            try {
+              const resp = await page.goto(url, {
+                waitUntil: "domcontentloaded",
+                timeout: PAGE_TIMEOUT_MS
+              });
+              const hasMain = await page.locator("main, [role=main]").first().isVisible().catch(() => false);
+              ok = !!resp && resp.ok() && errors.length === 0 && hasMain;
+              if (engine === "chromium") {
+                const hrefs = await page.evaluate("Array.from(document.querySelectorAll('a[href]')).map((a) => a.href)").catch(() => []);
+                const origin = new URL(url).origin;
+                for (const h of hrefs) {
+                  try {
+                    if (new URL(h).origin === origin) linkSet.add(new URL(h).href);
+                  } catch {
+                  }
+                }
+              }
+            } catch {
+              ok = false;
+            } finally {
+              await ctx.close().catch(() => {
+              });
+            }
+            desktop.push({ engine, ok });
+          }
+          const mobile = [];
+          for (let i = 0; i < mobileTargets.length; i++) {
+            const { device, descriptor } = mobileTargets[i];
+            const browser = mobileBrowsers[i];
+            const ctx = await browser.newContext({ ...descriptor });
+            const page = await ctx.newPage();
+            const errors = [];
+            page.on("pageerror", (e) => errors.push(String(e)));
+            let ok = false;
+            try {
+              const resp = await page.goto(url, {
+                waitUntil: "domcontentloaded",
+                timeout: PAGE_TIMEOUT_MS
+              });
+              const overflow = await page.evaluate("document.documentElement.scrollWidth > window.innerWidth + 2").catch(() => true);
+              ok = !!resp && resp.ok() && errors.length === 0 && !overflow;
+            } catch {
+              ok = false;
+            } finally {
+              await ctx.close().catch(() => {
+              });
+            }
+            mobile.push({ device, ok });
+          }
+          results.push({ url, desktop, mobile, links: [...linkSet] });
+        }
+      } finally {
+        await Promise.all([...browsers, ...mobileBrowsers].map((b) => b.close().catch(() => {
+        })));
+      }
+      return results;
+    },
+    async checkLinks(urls) {
+      const out = [];
+      for (const url of urls) {
+        let status;
+        try {
+          let res = await fetch(url, { method: "HEAD", redirect: "follow" });
+          if (res.status === 405 || res.status === 501) {
+            res = await fetch(url, { method: "GET", redirect: "follow" });
+          }
+          status = res.status;
+        } catch {
+          status = null;
+        }
+        out.push({ url, status });
+      }
+      return out;
+    }
+  };
+}
+
 // src/audits/index.ts
 var REGISTRY = {
   deps: depsAudit,
   lint: lintAudit,
   security: securityAudit,
   lighthouse: lighthouseAudit,
-  a11y: a11yAudit
+  a11y: a11yAudit,
+  domain: domainAudit,
+  browser: browserAudit
 };
 var ALL_AUDIT_NAMES = Object.keys(REGISTRY);
 var DEFAULT_AUDIT_TIMEOUT_MS = 3e4;
@@ -2557,6 +2892,16 @@ function isHttpUrl(s) {
   }
   return parsed.protocol === "http:" || parsed.protocol === "https:";
 }
+function isNetlifyAppUrl(s) {
+  let parsed;
+  try {
+    parsed = new URL(s);
+  } catch {
+    return false;
+  }
+  const host = parsed.hostname.toLowerCase();
+  return host === "netlify.app" || host.endsWith(".netlify.app");
+}
 
 // src/inventory/json.ts
 function validate(raw) {
@@ -2684,6 +3029,14 @@ function mapRow(rec) {
     securityVulnsHigh: f["Security Vulns High"] ?? null,
     securityVulnsModerate: f["Security Vulns Moderate"] ?? null,
     securityVulnsLow: f["Security Vulns Low"] ?? null,
+    lastSecurityAuditAt: f["Last security audit at"] ?? null,
+    certDaysRemaining: f["Cert days remaining"] ?? null,
+    domainCheckedAt: f["Domain checked at"] ?? null,
+    crossbrowserOk: typeof f["Crossbrowser OK"] === "boolean" ? f["Crossbrowser OK"] : null,
+    mobileOk: typeof f["Mobile OK"] === "boolean" ? f["Mobile OK"] : null,
+    linksOk: typeof f["Links OK"] === "boolean" ? f["Links OK"] : null,
+    brokenLinks: typeof f["Broken links"] === "number" ? f["Broken links"] : null,
+    browserCheckedAt: f["Browser checked at"] ?? null,
     copyIntro: trimToNull(f["Copy \u2014 Intro"]),
     copyContact: trimToNull(f["Copy \u2014 Contact"]),
     copyFooter: trimToNull(f["Copy \u2014 Footer"]),
@@ -3363,9 +3716,32 @@ function mapRow2(rec) {
     deliveryStatus: f["Delivery status"] ?? "pending",
     renderedHtmlAttachment: html,
     resendMessageId: f["Resend message ID"] ?? null,
-    checklist: Object.fromEntries(ALL_CHECKLIST_FIELDS.map((name) => [name, Boolean(f[name])]))
+    checklist: Object.fromEntries(ALL_CHECKLIST_FIELDS.map((name) => [name, Boolean(f[name])])),
+    autoEvidence: parseAutoEvidence(f["Checklist auto-evidence"])
   };
 }
+function parseAutoEvidence(raw) {
+  if (typeof raw !== "string" || !raw.trim()) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+  const out = {};
+  for (const [field, v] of Object.entries(parsed)) {
+    if (!v || typeof v !== "object") continue;
+    const o = v;
+    if (o.result !== "pass" && o.result !== "fail" && o.result !== "unknown") continue;
+    out[field] = {
+      result: o.result,
+      checkedAt: typeof o.checkedAt === "string" ? o.checkedAt : null,
+      note: typeof o.note === "string" ? o.note : ""
+    };
+  }
+  return Object.keys(out).length > 0 ? out : null;
+}
 function lighthouseFromFields(f) {
   const p = f["Lighthouse \u2014 Performance"];
   const a = f["Lighthouse \u2014 Accessibility"];
@@ -3399,6 +3775,10 @@ async function createDraft(base, input) {
   if (input.searchPosition !== void 0) fields["Search position"] = input.searchPosition;
   if (input.period !== void 0) fields["Period"] = input.period;
   if (input.subjectOverride !== void 0) fields["Subject override"] = input.subjectOverride;
+  for (const field of input.checklistTicks ?? []) fields[field] = true;
+  if (input.autoEvidence && Object.keys(input.autoEvidence).length > 0) {
+    fields["Checklist auto-evidence"] = JSON.stringify(input.autoEvidence);
+  }
   const created = await base(REPORTS_TABLE).create([{ fields }]);
   const rec = created[0];
   if (!rec) throw new Error("Airtable create returned no records");
@@ -3467,6 +3847,118 @@ async function queueDraft(base, report) {
   return { queued: true, supersededIds };
 }
 
+// src/reports/auto-tick.ts
+var STALE_DAYS = 3;
+var MS_PER_DAY2 = 24 * 60 * 60 * 1e3;
+function isFresh(checkedAt, now) {
+  if (!checkedAt) return false;
+  const t = new Date(checkedAt).getTime();
+  if (Number.isNaN(t)) return false;
+  return now.getTime() - t <= STALE_DAYS * MS_PER_DAY2;
+}
+var CERT_MIN_DAYS = 14;
+function autoTickChecklist(site, reportType, now, signals) {
+  const out = /* @__PURE__ */ new Map();
+  const fields = new Set(checklistFor(reportType).map((i) => i.field));
+  if (fields.has("Maint: Google Indexed")) {
+    const g = googleEvidence(now, signals.search);
+    if (g) out.set("Maint: Google Indexed", g);
+  }
+  if (fields.has("Maint: Security Updates")) {
+    const s = securityEvidence(site, now);
+    if (s) out.set("Maint: Security Updates", s);
+  }
+  if (fields.has("Maint: Domain, DNS & SSL")) {
+    const d = domainEvidence(site, now);
+    if (d) out.set("Maint: Domain, DNS & SSL", d);
+  }
+  if (fields.has("Test: Desktop Browsers")) {
+    const e = browserEvidence(
+      site.crossbrowserOk,
+      site,
+      now,
+      "Desktop renders cleanly",
+      "render errors"
+    );
+    if (e) out.set("Test: Desktop Browsers", e);
+  }
+  if (fields.has("Test: Mobile Browsers")) {
+    const e = browserEvidence(
+      site.mobileOk,
+      site,
+      now,
+      "Mobile renders cleanly",
+      "overflow/errors"
+    );
+    if (e) out.set("Test: Mobile Browsers", e);
+  }
+  if (fields.has("Test: Links & Navigation")) {
+    const broken = site.brokenLinks;
+    const failNote = broken && broken > 0 ? `${broken} broken link(s)` : "broken links / nav";
+    const e = browserEvidence(site.linksOk, site, now, "All internal links resolve", failNote);
+    if (e) out.set("Test: Links & Navigation", e);
+  }
+  return out;
+}
+function browserEvidence(ok, site, now, passNote, failNote) {
+  if (ok === null || !site.browserCheckedAt) return null;
+  const at = site.browserCheckedAt;
+  if (!isFresh(at, now)) {
+    return { result: "unknown", checkedAt: at, note: "Browser check is stale (>3d)" };
+  }
+  return ok ? { result: "pass", checkedAt: at, note: passNote } : { result: "fail", checkedAt: at, note: failNote };
+}
+function securityEvidence(site, now) {
+  const crit = site.securityVulnsCritical;
+  const high = site.securityVulnsHigh;
+  if (crit === null || high === null || !site.lastSecurityAuditAt) return null;
+  const at = site.lastSecurityAuditAt;
+  if (!isFresh(at, now)) {
+    return { result: "unknown", checkedAt: at, note: "Security audit is stale (>3d)" };
+  }
+  if (crit === 0 && high === 0) {
+    return { result: "pass", checkedAt: at, note: "No known critical/high vulnerabilities" };
+  }
+  return { result: "fail", checkedAt: at, note: `${crit} critical / ${high} high vuln(s)` };
+}
+function googleEvidence(now, search) {
+  const at = now.toISOString();
+  if (search.softFailed) {
+    return { result: "unknown", checkedAt: at, note: "Search Console unavailable this run" };
+  }
+  if (search.value === null) return null;
+  if (search.value.foundOnPage1) {
+    const pos2 = search.value.position;
+    return {
+      result: "pass",
+      checkedAt: at,
+      note: `Page 1 on Google${pos2 !== null ? ` (#${pos2})` : ""}`
+    };
+  }
+  const pos = search.value.position;
+  return {
+    result: "fail",
+    checkedAt: at,
+    note: `Not on page 1${pos !== null ? ` (avg #${pos})` : ""}`
+  };
+}
+function domainEvidence(site, now) {
+  if (!site.url || isNetlifyAppUrl(site.url)) return null;
+  if (!site.domainCheckedAt) return null;
+  const at = site.domainCheckedAt;
+  if (!isFresh(site.domainCheckedAt, now)) {
+    return { result: "unknown", checkedAt: at, note: "Domain check is stale (>3d)" };
+  }
+  const days = site.certDaysRemaining;
+  if (days === null) {
+    return { result: "fail", checkedAt: at, note: "Did not resolve, or no valid TLS cert" };
+  }
+  if (days <= CERT_MIN_DAYS) {
+    return { result: "fail", checkedAt: at, note: `TLS cert expires in ${days}d` };
+  }
+  return { result: "pass", checkedAt: at, note: `Custom domain, valid cert (${days}d left)` };
+}
+
 // src/reports/airtable/attachments.ts
 function looksLikeHtml(bytes) {
   const start = bytes[0] === 239 && bytes[1] === 187 && bytes[2] === 191 ? 3 : 0;
@@ -3538,7 +4030,7 @@ import { readFileSync as readFileSync3 } from "fs";
 import { JWT } from "google-auth-library";
 import { BetaAnalyticsDataClient } from "@google-analytics/data";
 var ANALYTICS_READONLY = "https://www.googleapis.com/auth/analytics.readonly";
-var MS_PER_DAY = 864e5;
+var MS_PER_DAY3 = 864e5;
 function ymd2(d) {
   return d.toISOString().slice(0, 10);
 }
@@ -3551,9 +4043,9 @@ async function fetchPeriodUsers(query, periodStart, periodEnd) {
     subject: query.subject
   });
   const client = new BetaAnalyticsDataClient({ authClient });
-  const lengthDays = Math.round((periodEnd.getTime() - periodStart.getTime()) / MS_PER_DAY);
-  const prevEnd = new Date(periodStart.getTime() - MS_PER_DAY);
-  const prevStart = new Date(prevEnd.getTime() - lengthDays * MS_PER_DAY);
+  const lengthDays = Math.round((periodEnd.getTime() - periodStart.getTime()) / MS_PER_DAY3);
+  const prevEnd = new Date(periodStart.getTime() - MS_PER_DAY3);
+  const prevStart = new Date(prevEnd.getTime() - lengthDays * MS_PER_DAY3);
   const property = `properties/${query.propertyId}`;
   const run = async (start, end) => {
     const [resp] = await client.runReport({
@@ -3677,7 +4169,7 @@ async function draftReportForSite(base, siteRow, reportType, options = {}) {
   const periodStart = base !== null ? await derivePeriodStart(base, siteRow, reportType, today) : daysAgo(today, 30);
   const periodEnd = today;
   const completedOn = today;
-  const lastTestedDate = reportType === "Maintenance" && siteRow.testingDay ? new Date(siteRow.testingDay) : null;
+  const lastTestedDate = reportType === "Maintenance" && siteRow.lastLighthouseAuditAt ? new Date(siteRow.lastLighthouseAuditAt) : null;
   const gaResult = base !== null ? await fetchGaUsers(siteRow, periodStart, periodEnd) : NO_ENRICHMENT;
   const searchResult = base !== null ? await fetchSearch(siteRow, periodStart, periodEnd) : NO_ENRICHMENT;
   const gaUsers = gaResult.value;
@@ -3724,6 +4216,9 @@ async function draftReportForSite(base, siteRow, reportType, options = {}) {
       supersededIds: outcome2.supersededIds
     };
   }
+  const evidence = autoTickChecklist(siteRow, reportType, completedOn, { search: searchResult });
+  const checklistTicks = [...evidence.entries()].filter(([, e]) => e.result === "pass").map(([field]) => field);
+  const autoEvidence = Object.fromEntries(evidence);
   const reportId = `${siteRow.name} \u2014 ${reportType} \u2014 ${periodEnd.toISOString().slice(0, 10)}`;
   const created = await createDraft(base, {
     reportId,
@@ -3737,7 +4232,9 @@ async function draftReportForSite(base, siteRow, reportType, options = {}) {
     lastTestedDate,
     ...gaUsers ? { gaUsersCurrent: gaUsers.current, gaUsersPrevious: gaUsers.previous } : {},
     ...search ? { searchFoundPage1: search.foundOnPage1 } : {},
-    ...search?.foundOnPage1 && search.position !== null ? { searchPosition: search.position } : {}
+    ...search?.foundOnPage1 && search.position !== null ? { searchPosition: search.position } : {},
+    checklistTicks,
+    autoEvidence
   });
   await uploadDraftHtml(created.id, slug, periodEnd, html);
   const outcome = await queueDraft(base, {
@@ -4026,35 +4523,33 @@ async function sendOne(client, base, site, report) {
   });
   const reportDate = report.completedOn ? new Date(report.completedOn) : /* @__PURE__ */ new Date();
   const subject = report.subjectOverride ?? `${site.name} \u2014 ${monthYear(reportDate)} ${report.reportType} Report`;
+  const attachments = [
+    toInlineAttachment({
+      bytes: header.bytes,
+      filename: `${cidName}.jpg`,
+      contentType: header.contentType,
+      cid: cidName
+    })
+  ];
+  for (const img of [bundled.check, bundled.blurred]) {
+    if (html.includes(`cid:${img.cid}`)) {
+      attachments.push(
+        toInlineAttachment({
+          bytes: img.bytes,
+          filename: img.filename,
+          contentType: img.contentType,
+          cid: img.cid
+        })
+      );
+    }
+  }
   const payload = {
     from: FROM_ADDRESS,
     to,
     replyTo: REPLY_TO,
     subject,
     html,
-    attachments: [
-      toInlineAttachment({
-        bytes: header.bytes,
-        filename: `${cidName}.jpg`,
-        contentType: header.contentType,
-        cid: cidName
-      }),
-      // Bundled images referenced via cid:rd-check-png / cid:rd-blurred-tests-jpg
-      // in the template. Attached inline so the email is self-contained — no
-      // external CDN dependency, no image-blocked broken icons in webmail.
-      toInlineAttachment({
-        bytes: bundled.check.bytes,
-        filename: bundled.check.filename,
-        contentType: bundled.check.contentType,
-        cid: bundled.check.cid
-      }),
-      toInlineAttachment({
-        bytes: bundled.blurred.bytes,
-        filename: bundled.blurred.filename,
-        contentType: bundled.blurred.contentType,
-        cid: bundled.blurred.cid
-      })
-    ],
+    attachments,
     // Stable across retries of the same row — if Airtable stamping fails after a
     // successful Resend, the next --send-ready replays with the same key and
     // Resend returns the original message id rather than sending a duplicate.
@@ -4251,7 +4746,9 @@ function checklistBlock(r) {
   const url = `/api/reports/${encodeURIComponent(r.id)}/checklist`;
   const boxes = items.map((item) => {
     const checked = r.checklist[item.field] === true ? " checked" : "";
-    return `<label class="check-item"><input type="checkbox" class="checklist-checkbox" data-checklist-report-id="${rid}" data-field="${escapeHtml(item.field)}" data-checklist-url="${escapeHtml(url)}"${checked} /> ${escapeHtml(item.label)}</label>`;
+    const ev = r.autoEvidence?.[item.field];
+    const badge = ev ? ev.result === "pass" ? ` <span class="auto-badge auto-pass" title="${escapeHtml(ev.note)}">auto \u2713</span>` : ` <span class="auto-badge auto-amber" title="${escapeHtml(ev.note)}">auto: ${escapeHtml(ev.note)}</span>` : "";
+    return `<label class="check-item"><input type="checkbox" class="checklist-checkbox" data-checklist-report-id="${rid}" data-field="${escapeHtml(item.field)}" data-checklist-url="${escapeHtml(url)}"${checked} /> ${escapeHtml(item.label)}${badge}</label>`;
   }).join("");
   return `<div class="checklist" data-checklist-for="${rid}">${boxes}</div>`;
 }
@@ -4378,6 +4875,9 @@ button.approve:disabled { opacity: 0.6; cursor: default; }
 .checklist { display: flex; flex-wrap: wrap; gap: 0.25rem 1.25rem; margin: 0.5rem 0 0.25rem 0.25rem; }
 .check-item { display: flex; align-items: center; gap: 0.4rem; font-size: 0.9rem; }
 .check-item input { margin: 0; }
+.auto-badge { font-size: 0.72rem; border-radius: 0.25rem; padding: 0 0.35rem; white-space: nowrap; }
+.auto-pass { background: #e6f4ea; color: #137333; }
+.auto-amber { background: #fef7e0; color: #b06000; }
 .pill { font-size: 0.75rem; padding: 0.1rem 0.5rem; border-radius: 999px; font-weight: 700; }
 .subm-list { list-style: none; padding: 0; margin: 0; }
 .subm-item { padding: 0.6rem 0; border-bottom: 1px solid #eee; }