@reddoorla/maintenance 0.49.0 → 0.51.0

package/dist/cli/bin.js

@@ -71,12 +71,54 @@ function isHttpUrl(s) {
   }
   return parsed.protocol === "http:" || parsed.protocol === "https:";
 }
+function isNetlifyAppUrl(s) {
+  let parsed;
+  try {
+    parsed = new URL(s);
+  } catch {
+    return false;
+  }
+  const host = parsed.hostname.toLowerCase();
+  return host === "netlify.app" || host.endsWith(".netlify.app");
+}
 var init_url = __esm({
   "src/util/url.ts"() {
     "use strict";
   }
 });
 
+// src/reports/airtable/throttle.ts
+function createMinIntervalThrottle(opts) {
+  const { minIntervalMs, now, delay } = opts;
+  return function wrap(fn) {
+    let chain = Promise.resolve();
+    let last = Number.NEGATIVE_INFINITY;
+    return (...args) => {
+      chain = chain.then(async () => {
+        const wait = minIntervalMs - (now() - last);
+        if (wait > 0) await delay(wait);
+        last = now();
+        fn(...args);
+      }).catch(() => {
+      });
+    };
+  };
+}
+function applyThrottle(base, opts) {
+  const real = base._base?.runAction;
+  if (typeof real !== "function") return base;
+  const wrap = createMinIntervalThrottle(opts);
+  const throttled = wrap(real.bind(base._base));
+  base._base.runAction = throttled;
+  base.runAction = throttled;
+  return base;
+}
+var init_throttle = __esm({
+  "src/reports/airtable/throttle.ts"() {
+    "use strict";
+  }
+});
+
 // src/reports/airtable/client.ts
 var client_exports = {};
 __export(client_exports, {
@@ -100,12 +142,20 @@ function readAirtableConfig() {
   return { apiKey, baseId };
 }
 function openBase(cfg) {
-  return new Airtable({ apiKey: cfg.apiKey }).base(cfg.baseId);
+  const base = new Airtable({ apiKey: cfg.apiKey }).base(cfg.baseId);
+  return applyThrottle(base, {
+    minIntervalMs: MIN_REQUEST_INTERVAL_MS,
+    now: () => Date.now(),
+    delay: (ms) => new Promise((resolve12) => setTimeout(resolve12, ms))
+  });
 }
+var MIN_REQUEST_INTERVAL_MS;
 var init_client = __esm({
   "src/reports/airtable/client.ts"() {
     "use strict";
     init_credentials();
+    init_throttle();
+    MIN_REQUEST_INTERVAL_MS = 220;
   }
 });
 
@@ -113,12 +163,15 @@ var init_client = __esm({
 var websites_exports = {};
 __export(websites_exports, {
   ACTIVE_STATUSES: () => ACTIVE_STATUSES,
+  SEVERITY_RANK: () => SEVERITY_RANK,
   WEBSITES_TABLE: () => WEBSITES_TABLE,
   getWebsiteBySlug: () => getWebsiteBySlug,
   isDashboardVisible: () => isDashboardVisible,
   listWebsites: () => listWebsites,
   mapRow: () => mapRow,
+  normalizeSecurityAdvisory: () => normalizeSecurityAdvisory,
   parseNotifyRouting: () => parseNotifyRouting,
+  parseSecurityAdvisories: () => parseSecurityAdvisories,
   siteSlug: () => siteSlug,
   updateA11yCounts: () => updateA11yCounts,
   updateAuditFields: () => updateAuditFields,
@@ -198,6 +251,15 @@ function mapRow(rec) {
     securityVulnsHigh: f["Security Vulns High"] ?? null,
     securityVulnsModerate: f["Security Vulns Moderate"] ?? null,
     securityVulnsLow: f["Security Vulns Low"] ?? null,
+    lastSecurityAuditAt: f["Last security audit at"] ?? null,
+    securityAdvisories: parseSecurityAdvisories(f["Security advisories"]),
+    certDaysRemaining: f["Cert days remaining"] ?? null,
+    domainCheckedAt: f["Domain checked at"] ?? null,
+    crossbrowserOk: typeof f["Crossbrowser OK"] === "boolean" ? f["Crossbrowser OK"] : null,
+    mobileOk: typeof f["Mobile OK"] === "boolean" ? f["Mobile OK"] : null,
+    linksOk: typeof f["Links OK"] === "boolean" ? f["Links OK"] : null,
+    brokenLinks: typeof f["Broken links"] === "number" ? f["Broken links"] : null,
+    browserCheckedAt: f["Browser checked at"] ?? null,
     copyIntro: trimToNull(f["Copy \u2014 Intro"]),
     copyContact: trimToNull(f["Copy \u2014 Contact"]),
     copyFooter: trimToNull(f["Copy \u2014 Footer"]),
@@ -254,12 +316,61 @@ function depsFields(counts) {
   }
   return fields;
 }
+function normalizeSecurityAdvisory(raw) {
+  if (!raw || typeof raw !== "object") return null;
+  const e = raw;
+  const module = typeof e["module"] === "string" ? e["module"] : null;
+  const severity = e["severity"];
+  if (module === null) return null;
+  if (severity !== "low" && severity !== "moderate" && severity !== "high" && severity !== "critical")
+    return null;
+  const cves = Array.isArray(e["cves"]) ? e["cves"].filter((c) => typeof c === "string") : [];
+  return {
+    module,
+    severity,
+    title: typeof e["title"] === "string" ? e["title"] : "",
+    cves,
+    url: typeof e["url"] === "string" ? e["url"] : null
+  };
+}
+function parseSecurityAdvisories(raw) {
+  if (typeof raw !== "string" || raw.trim() === "") return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (!Array.isArray(parsed)) return null;
+  return parsed.map(normalizeSecurityAdvisory).filter((a) => a !== null);
+}
+function securityAdvisoryFields(advisories) {
+  const capped = [...advisories].sort((a, b) => SEVERITY_RANK[a.severity] - SEVERITY_RANK[b.severity]).slice(0, MAX_PERSISTED_ADVISORIES);
+  return { "Security advisories": JSON.stringify(capped) };
+}
 function securityFields(counts) {
   return {
     "Security Vulns Critical": counts.critical,
     "Security Vulns High": counts.high,
     "Security Vulns Moderate": counts.moderate,
-    "Security Vulns Low": counts.low
+    "Security Vulns Low": counts.low,
+    // Stamp freshness alongside the counts so the Security Updates auto-tick can require a recent
+    // audit (a clean count from months ago must not silently keep ticking the box).
+    "Last security audit at": (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function domainFields(result) {
+  const fields = { "Domain checked at": result.checkedAt };
+  if (result.certDaysRemaining !== null) fields["Cert days remaining"] = result.certDaysRemaining;
+  return fields;
+}
+function browserFields(r) {
+  return {
+    "Crossbrowser OK": r.desktopOk,
+    "Mobile OK": r.mobileOk,
+    "Links OK": r.linksOk,
+    "Broken links": r.brokenLinks,
+    "Browser checked at": r.checkedAt
   };
 }
 async function updateScores(base, recordId, scores) {
@@ -280,6 +391,10 @@ async function updateAuditFields(base, recordId, audits) {
   if (audits.a11y) Object.assign(fields, a11yFields(audits.a11y));
   if (audits.deps) Object.assign(fields, depsFields(audits.deps));
   if (audits.security) Object.assign(fields, securityFields(audits.security));
+  if (audits.securityAdvisories)
+    Object.assign(fields, securityAdvisoryFields(audits.securityAdvisories));
+  if (audits.domain) Object.assign(fields, domainFields(audits.domain));
+  if (audits.browser) Object.assign(fields, browserFields(audits.browser));
   await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);
   return fields;
 }
@@ -298,7 +413,7 @@ async function updateLaunched(base, recordId, at) {
   const fields = { Status: "maintenance", "Launched at": at };
   await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);
 }
-var WEBSITES_TABLE, ACTIVE_STATUSES, FREQUENCIES;
+var WEBSITES_TABLE, ACTIVE_STATUSES, FREQUENCIES, SEVERITY_RANK, MAX_PERSISTED_ADVISORIES;
 var init_websites = __esm({
   "src/reports/airtable/websites.ts"() {
     "use strict";
@@ -308,6 +423,13 @@ var init_websites = __esm({
       "launch period"
     ]);
     FREQUENCIES = ["None", "Monthly", "Quarterly", "Yearly"];
+    SEVERITY_RANK = {
+      critical: 0,
+      high: 1,
+      moderate: 2,
+      low: 3
+    };
+    MAX_PERSISTED_ADVISORIES = 25;
   }
 });
 
@@ -468,9 +590,66 @@ function securityCountsFromResult(result) {
   const c = details?.counts ?? { low: 0, moderate: 0, high: 0, critical: 0 };
   return { critical: c.critical, high: c.high, moderate: c.moderate, low: c.low };
 }
+function advisoriesFromResult(result) {
+  if (result.audit !== "security") {
+    throw new Error(`Expected a 'security' AuditResult, got '${result.audit}'`);
+  }
+  const details = result.details;
+  const raw = details?.advisories;
+  if (!Array.isArray(raw)) return [];
+  return raw.map(normalizeSecurityAdvisory).filter((a) => a !== null);
+}
 var init_security_airtable = __esm({
   "src/audits/security-airtable.ts"() {
     "use strict";
+    init_websites();
+  }
+});
+
+// src/audits/domain-airtable.ts
+function hasDomainResult(result) {
+  if (result.audit !== "domain") return false;
+  const d = result.details;
+  return !!d && typeof d.checkedAt === "string";
+}
+function domainResultFromAudit(result) {
+  if (result.audit !== "domain") {
+    throw new Error(`Expected a 'domain' AuditResult, got '${result.audit}'`);
+  }
+  const d = result.details;
+  return {
+    certDaysRemaining: typeof d?.certDaysRemaining === "number" ? d.certDaysRemaining : null,
+    checkedAt: typeof d?.checkedAt === "string" ? d.checkedAt : (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+var init_domain_airtable = __esm({
+  "src/audits/domain-airtable.ts"() {
+    "use strict";
+  }
+});
+
+// src/audits/browser-airtable.ts
+function hasBrowserResult(result) {
+  if (result.audit !== "browser") return false;
+  const d = result.details;
+  return !!d && typeof d.checkedAt === "string";
+}
+function browserFieldsFromAudit(result) {
+  if (result.audit !== "browser") {
+    throw new Error(`Expected a 'browser' AuditResult, got '${result.audit}'`);
+  }
+  const d = result.details;
+  return {
+    desktopOk: d?.desktopOk === true,
+    mobileOk: d?.mobileOk === true,
+    linksOk: d?.linksOk === true,
+    brokenLinks: typeof d?.brokenLinks === "number" ? d.brokenLinks : 0,
+    checkedAt: typeof d?.checkedAt === "string" ? d.checkedAt : (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+var init_browser_airtable = __esm({
+  "src/audits/browser-airtable.ts"() {
+    "use strict";
   }
 });
 
@@ -484,22 +663,14 @@ __export(write_audits_to_airtable_exports, {
 async function writeAuditsToAirtable(args) {
   const { base, websites, slug, results } = args;
   const lhResult = results.find((r) => r.audit === "lighthouse");
-  if (!lhResult) {
-    throw Object.assign(
-      new Error(
-        "--write-airtable requires a lighthouse result; did you pass --only without lighthouse?"
-      ),
-      { exitCode: 2 }
-    );
-  }
   const target = websites.find((w) => siteSlug(w.name) === slug);
   if (!target) {
     throw Object.assign(new Error(`No Websites row matched slug "${slug}"`), { exitCode: 2 });
   }
   const writes = [];
   const audits = {};
-  const lhHasScores = hasRealScores(lhResult);
-  if (lhHasScores) {
+  const lhHasScores = lhResult ? hasRealScores(lhResult) : false;
+  if (lhResult && lhHasScores) {
     const scores = lighthouseScoresFromResult(lhResult);
     audits.scores = scores;
     writes.push({ audit: "lighthouse", counts: scores });
@@ -520,12 +691,25 @@ async function writeAuditsToAirtable(args) {
   if (sec && hasSecurityCounts(sec)) {
     const counts = securityCountsFromResult(sec);
     audits.security = counts;
+    audits.securityAdvisories = advisoriesFromResult(sec);
     writes.push({ audit: "security", counts });
   }
+  const dom = results.find((r) => r.audit === "domain");
+  if (dom && hasDomainResult(dom)) {
+    const result = domainResultFromAudit(dom);
+    audits.domain = result;
+    writes.push({ audit: "domain", counts: result });
+  }
+  const browser = results.find((r) => r.audit === "browser");
+  if (browser && hasBrowserResult(browser)) {
+    const fields = browserFieldsFromAudit(browser);
+    audits.browser = fields;
+    writes.push({ audit: "browser", counts: fields });
+  }
   if (Object.keys(audits).length > 0) {
     await updateAuditFields(base, target.id, audits);
   }
-  if (!lhHasScores) {
+  if (lhResult && !lhHasScores) {
     const persisted = writes.map((w) => w.audit);
     throw Object.assign(
       new Error(
@@ -576,6 +760,8 @@ var init_write_audits_to_airtable = __esm({
     init_a11y_airtable();
     init_deps_airtable();
     init_security_airtable();
+    init_domain_airtable();
+    init_browser_airtable();
   }
 });
 
@@ -661,9 +847,32 @@ function mapRow2(rec) {
     deliveryStatus: f["Delivery status"] ?? "pending",
     renderedHtmlAttachment: html,
     resendMessageId: f["Resend message ID"] ?? null,
-    checklist: Object.fromEntries(ALL_CHECKLIST_FIELDS.map((name) => [name, Boolean(f[name])]))
+    checklist: Object.fromEntries(ALL_CHECKLIST_FIELDS.map((name) => [name, Boolean(f[name])])),
+    autoEvidence: parseAutoEvidence(f["Checklist auto-evidence"])
   };
 }
+function parseAutoEvidence(raw) {
+  if (typeof raw !== "string" || !raw.trim()) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+  const out = {};
+  for (const [field, v] of Object.entries(parsed)) {
+    if (!v || typeof v !== "object") continue;
+    const o = v;
+    if (o.result !== "pass" && o.result !== "fail" && o.result !== "unknown") continue;
+    out[field] = {
+      result: o.result,
+      checkedAt: typeof o.checkedAt === "string" ? o.checkedAt : null,
+      note: typeof o.note === "string" ? o.note : ""
+    };
+  }
+  return Object.keys(out).length > 0 ? out : null;
+}
 function lighthouseFromFields(f) {
   const p = f["Lighthouse \u2014 Performance"];
   const a = f["Lighthouse \u2014 Accessibility"];
@@ -700,6 +909,10 @@ async function createDraft(base, input) {
   if (input.searchPosition !== void 0) fields["Search position"] = input.searchPosition;
   if (input.period !== void 0) fields["Period"] = input.period;
   if (input.subjectOverride !== void 0) fields["Subject override"] = input.subjectOverride;
+  for (const field of input.checklistTicks ?? []) fields[field] = true;
+  if (input.autoEvidence && Object.keys(input.autoEvidence).length > 0) {
+    fields["Checklist auto-evidence"] = JSON.stringify(input.autoEvidence);
+  }
   const created = await base(REPORTS_TABLE).create([{ fields }]);
   const rec = created[0];
   if (!rec) throw new Error("Airtable create returned no records");
@@ -1470,7 +1683,7 @@ function gitHubSignalsStale(swept, now) {
   if (swept === null) return true;
   const ageMs = now.getTime() - Date.parse(swept);
   if (!Number.isFinite(ageMs)) return true;
-  return ageMs > GITHUB_SIGNALS_STALE_DAYS * MS_PER_DAY2;
+  return ageMs > GITHUB_SIGNALS_STALE_DAYS * MS_PER_DAY4;
 }
 function collectVulnAlerts(sites, baseUrl) {
   const items = [];
@@ -1564,13 +1777,13 @@ function collectCiAlerts(sites, baseUrl, now = /* @__PURE__ */ new Date()) {
   }
   return items;
 }
-var GITHUB_SIGNALS_STALE_DAYS, MS_PER_DAY2, LIGHTHOUSE_FLOOR, LIGHTHOUSE_CATEGORIES2;
+var GITHUB_SIGNALS_STALE_DAYS, MS_PER_DAY4, LIGHTHOUSE_FLOOR, LIGHTHOUSE_CATEGORIES2;
 var init_digest_collectors = __esm({
   "src/alerts/digest-collectors.ts"() {
     "use strict";
     init_websites();
     GITHUB_SIGNALS_STALE_DAYS = 3;
-    MS_PER_DAY2 = 24 * 60 * 60 * 1e3;
+    MS_PER_DAY4 = 24 * 60 * 60 * 1e3;
     LIGHTHOUSE_FLOOR = 75;
     LIGHTHOUSE_CATEGORIES2 = [
       { field: "pScore", slug: "performance", label: "Performance" },
@@ -2015,35 +2228,33 @@ async function sendOne(client, base, site, report) {
   });
   const reportDate = report.completedOn ? new Date(report.completedOn) : /* @__PURE__ */ new Date();
   const subject = report.subjectOverride ?? `${site.name} \u2014 ${monthYear(reportDate)} ${report.reportType} Report`;
+  const attachments = [
+    toInlineAttachment({
+      bytes: header.bytes,
+      filename: `${cidName}.jpg`,
+      contentType: header.contentType,
+      cid: cidName
+    })
+  ];
+  for (const img of [bundled.check, bundled.blurred]) {
+    if (html.includes(`cid:${img.cid}`)) {
+      attachments.push(
+        toInlineAttachment({
+          bytes: img.bytes,
+          filename: img.filename,
+          contentType: img.contentType,
+          cid: img.cid
+        })
+      );
+    }
+  }
   const payload = {
     from: FROM_ADDRESS2,
     to,
     replyTo: REPLY_TO,
     subject,
     html,
-    attachments: [
-      toInlineAttachment({
-        bytes: header.bytes,
-        filename: `${cidName}.jpg`,
-        contentType: header.contentType,
-        cid: cidName
-      }),
-      // Bundled images referenced via cid:rd-check-png / cid:rd-blurred-tests-jpg
-      // in the template. Attached inline so the email is self-contained — no
-      // external CDN dependency, no image-blocked broken icons in webmail.
-      toInlineAttachment({
-        bytes: bundled.check.bytes,
-        filename: bundled.check.filename,
-        contentType: bundled.check.contentType,
-        cid: bundled.check.cid
-      }),
-      toInlineAttachment({
-        bytes: bundled.blurred.bytes,
-        filename: bundled.blurred.filename,
-        contentType: bundled.blurred.contentType,
-        cid: bundled.blurred.cid
-      })
-    ],
+    attachments,
     // Stable across retries of the same row — if Airtable stamping fails after a
     // successful Resend, the next --send-ready replays with the same key and
     // Resend returns the original message id rather than sending a duplicate.
@@ -3073,13 +3284,348 @@ async function a11yAudit(ctx) {
   }
 }
 
+// src/audits/domain.ts
+import { promises as dnsPromises } from "dns";
+import tls from "tls";
+var MS_PER_DAY = 24 * 60 * 60 * 1e3;
+async function checkDomain(url, deps) {
+  let host;
+  try {
+    host = new URL(url).hostname;
+  } catch {
+    return { resolved: false, certDaysRemaining: null };
+  }
+  try {
+    await deps.lookup(host);
+  } catch {
+    return { resolved: false, certDaysRemaining: null };
+  }
+  let validTo;
+  try {
+    validTo = await deps.certValidTo(host);
+  } catch {
+    validTo = null;
+  }
+  if (!validTo || Number.isNaN(validTo.getTime()))
+    return { resolved: true, certDaysRemaining: null };
+  return {
+    resolved: true,
+    certDaysRemaining: Math.floor((validTo.getTime() - deps.now.getTime()) / MS_PER_DAY)
+  };
+}
+function defaultDomainDeps(now) {
+  return {
+    lookup: async (host) => {
+      await dnsPromises.lookup(host);
+    },
+    certValidTo: (host) => new Promise((resolvePromise) => {
+      const socket = tls.connect(
+        { host, port: 443, servername: host, timeout: 1e4, rejectUnauthorized: true },
+        () => {
+          const cert = socket.authorized ? socket.getPeerCertificate() : null;
+          socket.end();
+          const validTo = cert && cert.valid_to ? new Date(cert.valid_to) : null;
+          resolvePromise(validTo);
+        }
+      );
+      socket.on("error", () => resolvePromise(null));
+      socket.on("timeout", () => {
+        socket.destroy();
+        resolvePromise(null);
+      });
+    }),
+    now
+  };
+}
+async function domainAudit(ctx) {
+  const { site } = ctx;
+  const label = siteLabel(site);
+  if (!site.deployedUrl) {
+    return { audit: "domain", site: label, status: "skip", summary: "no deployed URL" };
+  }
+  const now = ctx.now ?? /* @__PURE__ */ new Date();
+  const deps = ctx.domainDeps ?? defaultDomainDeps(now);
+  const check = await checkDomain(site.deployedUrl, deps);
+  const checkedAt = now.toISOString();
+  const status = check.resolved && check.certDaysRemaining !== null && check.certDaysRemaining > 14 ? "pass" : "warn";
+  const summary = !check.resolved ? "did not resolve" : check.certDaysRemaining === null ? "resolved, no usable TLS cert" : `resolved, cert ${check.certDaysRemaining}d remaining`;
+  return {
+    audit: "domain",
+    site: label,
+    status,
+    summary,
+    details: { resolved: check.resolved, certDaysRemaining: check.certDaysRemaining, checkedAt }
+  };
+}
+
+// src/audits/route-discovery.ts
+var DEFAULT_CAP = 15;
+function parseSitemapUrls(xml) {
+  const out = [];
+  const re = /<loc>\s*([^<\s]+)\s*<\/loc>/gi;
+  let m;
+  while ((m = re.exec(xml)) !== null) {
+    const url = m[1];
+    if (url) out.push(url.trim());
+  }
+  return out;
+}
+function parseHtmlLinks(html, baseUrl) {
+  const out = /* @__PURE__ */ new Set();
+  const re = /<a\b[^>]*\bhref\s*=\s*["']([^"']+)["']/gi;
+  let m;
+  while ((m = re.exec(html)) !== null) {
+    const href = m[1];
+    if (!href || href.startsWith("#") || /^(mailto:|tel:|javascript:)/i.test(href)) continue;
+    try {
+      const u = new URL(href, baseUrl);
+      if (u.origin !== new URL(baseUrl).origin) continue;
+      out.add(u.pathname);
+    } catch {
+    }
+  }
+  return [...out];
+}
+function family(pathname) {
+  return pathname.split("/").filter(Boolean)[0] ?? "";
+}
+function sampleRoutePaths(urlsOrPaths, cap = DEFAULT_CAP) {
+  const seen = /* @__PURE__ */ new Set(["/"]);
+  const buckets = /* @__PURE__ */ new Map();
+  for (const raw of urlsOrPaths) {
+    let pathname;
+    try {
+      pathname = raw.startsWith("/") ? new URL(raw, "https://x.invalid").pathname : new URL(raw).pathname;
+    } catch {
+      continue;
+    }
+    if (pathname === "/") continue;
+    if (seen.has(pathname)) continue;
+    seen.add(pathname);
+    const fam = family(pathname);
+    const arr = buckets.get(fam) ?? [];
+    arr.push(pathname);
+    buckets.set(fam, arr);
+  }
+  const result = ["/"];
+  const families = [...buckets.values()];
+  let guard = 0;
+  while (result.length < cap && families.some((f) => f.length > 0) && guard++ < 1e4) {
+    for (const fam of families) {
+      if (result.length >= cap) break;
+      const next = fam.shift();
+      if (next) result.push(next);
+    }
+  }
+  return result;
+}
+function familyCountsOf(paths) {
+  const counts = {};
+  for (const p of paths) {
+    const key = p === "/" ? "/" : `/${family(p)}`;
+    counts[key] = (counts[key] ?? 0) + 1;
+  }
+  return counts;
+}
+async function discoverRoutes(deployedUrl, deps, cap = DEFAULT_CAP) {
+  const origin = new URL(deployedUrl).origin;
+  const abs = (paths) => paths.map((p) => new URL(p, origin).href);
+  const sitemapXml = await deps.fetchText(new URL("/sitemap.xml", origin).href);
+  if (sitemapXml) {
+    const urls = parseSitemapUrls(sitemapXml);
+    if (urls.length > 0) {
+      const paths = sampleRoutePaths(urls, cap);
+      return { routes: abs(paths), source: "sitemap", familyCounts: familyCountsOf(paths) };
+    }
+  }
+  const homeHtml = await deps.fetchText(origin);
+  if (homeHtml) {
+    const links = parseHtmlLinks(homeHtml, origin);
+    if (links.length > 0) {
+      const paths = sampleRoutePaths(links, cap);
+      return { routes: abs(paths), source: "homepage-links", familyCounts: familyCountsOf(paths) };
+    }
+  }
+  return { routes: [new URL("/", origin).href], source: "root-only", familyCounts: { "/": 1 } };
+}
+
+// src/audits/browser.ts
+function isBroken(status) {
+  return status === null || status >= 400;
+}
+function summarizeBrowser(routes, links, familyCounts) {
+  const desktopChecks = routes.flatMap((r) => r.desktop);
+  const mobileChecks = routes.flatMap((r) => r.mobile);
+  const desktopOk = routes.length > 0 && routes.every((r) => r.desktop.length > 0 && r.desktop.every((d) => d.ok));
+  const mobileOk = routes.length > 0 && routes.every((r) => r.mobile.length > 0 && r.mobile.every((m) => m.ok));
+  const brokenLinks = links.filter((l) => isBroken(l.status)).length;
+  const linksOk = links.length > 0 && brokenLinks === 0;
+  const engines = [...new Set(desktopChecks.map((d) => d.engine))];
+  const devices2 = [...new Set(mobileChecks.map((m) => m.device))];
+  const families = Object.entries(familyCounts).map(([f, n]) => f === "/" ? "/" : `${f} \xD7${n}`).join(", ");
+  const note = `${routes.length} routes (${families}); desktop ${engines.join("/") || "\u2014"}; mobile ${devices2.join("/") || "\u2014"}; ${links.length} links, ${brokenLinks} broken`;
+  return { desktopOk, mobileOk, linksOk, brokenLinks, routesChecked: routes.length, note };
+}
+async function browserAudit(ctx) {
+  const { site } = ctx;
+  const label = siteLabel(site);
+  if (!site.deployedUrl) {
+    return { audit: "browser", site: label, status: "skip", summary: "no deployed URL" };
+  }
+  const now = ctx.now ?? /* @__PURE__ */ new Date();
+  const discoverDeps = ctx.discoverDeps ?? defaultDiscoverDeps();
+  const runner = ctx.browserRunner ?? await defaultBrowserRunner();
+  try {
+    const discovered = await discoverRoutes(site.deployedUrl, discoverDeps);
+    const routeResults = await runner.probe(discovered.routes);
+    const internalLinks = [...new Set(routeResults.flatMap((r) => r.links))];
+    const linkResults = await runner.checkLinks(internalLinks);
+    const summary = summarizeBrowser(
+      routeResults,
+      linkResults,
+      discovered.familyCounts ?? familyCountsOf(discovered.routes)
+    );
+    const status = summary.desktopOk && summary.mobileOk && summary.linksOk ? "pass" : "warn";
+    return {
+      audit: "browser",
+      site: label,
+      status,
+      summary: summary.note,
+      details: { ...summary, checkedAt: now.toISOString() }
+    };
+  } finally {
+    await runner.close?.();
+  }
+}
+function defaultDiscoverDeps() {
+  return {
+    fetchText: async (url) => {
+      try {
+        const res = await fetch(url, { redirect: "follow" });
+        if (!res.ok) return null;
+        return await res.text();
+      } catch {
+        return null;
+      }
+    }
+  };
+}
+var DESKTOP_VIEWPORT = { width: 1366, height: 900 };
+var PAGE_TIMEOUT_MS = 3e4;
+async function defaultBrowserRunner() {
+  const { chromium, firefox, webkit, devices: devices2 } = await import("@playwright/test");
+  const desktopEngines = [
+    { engine: "chromium", type: chromium },
+    { engine: "firefox", type: firefox },
+    { engine: "webkit", type: webkit }
+  ];
+  const mobileTargets = [
+    { device: "Pixel 7", descriptor: devices2["Pixel 7"] },
+    { device: "iPhone 14", descriptor: devices2["iPhone 14"] }
+  ];
+  return {
+    async probe(urls) {
+      const results = [];
+      const browsers = await Promise.all(desktopEngines.map((e) => e.type.launch()));
+      const mobileBrowsers = await Promise.all(mobileTargets.map(() => chromium.launch()));
+      try {
+        for (const url of urls) {
+          const desktop = [];
+          const linkSet = /* @__PURE__ */ new Set();
+          for (let i = 0; i < desktopEngines.length; i++) {
+            const engine = desktopEngines[i].engine;
+            const browser = browsers[i];
+            const ctx = await browser.newContext({ viewport: DESKTOP_VIEWPORT });
+            const page = await ctx.newPage();
+            const errors = [];
+            page.on("pageerror", (e) => errors.push(String(e)));
+            let ok = false;
+            try {
+              const resp = await page.goto(url, {
+                waitUntil: "domcontentloaded",
+                timeout: PAGE_TIMEOUT_MS
+              });
+              const hasMain = await page.locator("main, [role=main]").first().isVisible().catch(() => false);
+              ok = !!resp && resp.ok() && errors.length === 0 && hasMain;
+              if (engine === "chromium") {
+                const hrefs = await page.evaluate("Array.from(document.querySelectorAll('a[href]')).map((a) => a.href)").catch(() => []);
+                const origin = new URL(url).origin;
+                for (const h of hrefs) {
+                  try {
+                    if (new URL(h).origin === origin) linkSet.add(new URL(h).href);
+                  } catch {
+                  }
+                }
+              }
+            } catch {
+              ok = false;
+            } finally {
+              await ctx.close().catch(() => {
+              });
+            }
+            desktop.push({ engine, ok });
+          }
+          const mobile = [];
+          for (let i = 0; i < mobileTargets.length; i++) {
+            const { device, descriptor } = mobileTargets[i];
+            const browser = mobileBrowsers[i];
+            const ctx = await browser.newContext({ ...descriptor });
+            const page = await ctx.newPage();
+            const errors = [];
+            page.on("pageerror", (e) => errors.push(String(e)));
+            let ok = false;
+            try {
+              const resp = await page.goto(url, {
+                waitUntil: "domcontentloaded",
+                timeout: PAGE_TIMEOUT_MS
+              });
+              const overflow = await page.evaluate("document.documentElement.scrollWidth > window.innerWidth + 2").catch(() => true);
+              ok = !!resp && resp.ok() && errors.length === 0 && !overflow;
+            } catch {
+              ok = false;
+            } finally {
+              await ctx.close().catch(() => {
+              });
+            }
+            mobile.push({ device, ok });
+          }
+          results.push({ url, desktop, mobile, links: [...linkSet] });
+        }
+      } finally {
+        await Promise.all([...browsers, ...mobileBrowsers].map((b) => b.close().catch(() => {
+        })));
+      }
+      return results;
+    },
+    async checkLinks(urls) {
+      const out = [];
+      for (const url of urls) {
+        let status;
+        try {
+          let res = await fetch(url, { method: "HEAD", redirect: "follow" });
+          if (res.status === 405 || res.status === 501) {
+            res = await fetch(url, { method: "GET", redirect: "follow" });
+          }
+          status = res.status;
+        } catch {
+          status = null;
+        }
+        out.push({ url, status });
+      }
+      return out;
+    }
+  };
+}
+
 // src/audits/index.ts
 var REGISTRY = {
   deps: depsAudit,
   lint: lintAudit,
   security: securityAudit,
   lighthouse: lighthouseAudit,
-  a11y: a11yAudit
+  a11y: a11yAudit,
+  domain: domainAudit,
+  browser: browserAudit
 };
 var ALL_AUDIT_NAMES = Object.keys(REGISTRY);
 var DEFAULT_AUDIT_TIMEOUT_MS = 3e4;
@@ -3556,8 +4102,13 @@ function deployedUrlNotice(which, url, cwd) {
   if (others.length === 0) return null;
   return `note: --url only affects lighthouse; ${others.join(", ")} ran against the local checkout at ${cwd}`;
 }
+var CHECKOUT_FREE_AUDITS = /* @__PURE__ */ new Set([
+  "lighthouse",
+  "domain",
+  "browser"
+]);
 function auditNeedsCheckout(site, which) {
-  const deployedCapable = site.deployedUrl !== void 0 && which.every((n) => n === "lighthouse");
+  const deployedCapable = site.deployedUrl !== void 0 && which.every((n) => CHECKOUT_FREE_AUDITS.has(n));
   return !deployedCapable;
 }
 function applyDeployedUrl(sites, url) {
@@ -5811,6 +6362,120 @@ async function queueDraft(base, report) {
   return { queued: true, supersededIds };
 }
 
+// src/reports/auto-tick.ts
+init_checklist();
+init_url();
+var STALE_DAYS = 3;
+var MS_PER_DAY2 = 24 * 60 * 60 * 1e3;
+function isFresh(checkedAt, now) {
+  if (!checkedAt) return false;
+  const t = new Date(checkedAt).getTime();
+  if (Number.isNaN(t)) return false;
+  return now.getTime() - t <= STALE_DAYS * MS_PER_DAY2;
+}
+var CERT_MIN_DAYS = 14;
+function autoTickChecklist(site, reportType, now, signals) {
+  const out = /* @__PURE__ */ new Map();
+  const fields = new Set(checklistFor(reportType).map((i) => i.field));
+  if (fields.has("Maint: Google Indexed")) {
+    const g = googleEvidence(now, signals.search);
+    if (g) out.set("Maint: Google Indexed", g);
+  }
+  if (fields.has("Maint: Security Updates")) {
+    const s = securityEvidence(site, now);
+    if (s) out.set("Maint: Security Updates", s);
+  }
+  if (fields.has("Maint: Domain, DNS & SSL")) {
+    const d = domainEvidence(site, now);
+    if (d) out.set("Maint: Domain, DNS & SSL", d);
+  }
+  if (fields.has("Test: Desktop Browsers")) {
+    const e = browserEvidence(
+      site.crossbrowserOk,
+      site,
+      now,
+      "Desktop renders cleanly",
+      "render errors"
+    );
+    if (e) out.set("Test: Desktop Browsers", e);
+  }
+  if (fields.has("Test: Mobile Browsers")) {
+    const e = browserEvidence(
+      site.mobileOk,
+      site,
+      now,
+      "Mobile renders cleanly",
+      "overflow/errors"
+    );
+    if (e) out.set("Test: Mobile Browsers", e);
+  }
+  if (fields.has("Test: Links & Navigation")) {
+    const broken = site.brokenLinks;
+    const failNote = broken && broken > 0 ? `${broken} broken link(s)` : "broken links / nav";
+    const e = browserEvidence(site.linksOk, site, now, "All internal links resolve", failNote);
+    if (e) out.set("Test: Links & Navigation", e);
+  }
+  return out;
+}
+function browserEvidence(ok, site, now, passNote, failNote) {
+  if (ok === null || !site.browserCheckedAt) return null;
+  const at = site.browserCheckedAt;
+  if (!isFresh(at, now)) {
+    return { result: "unknown", checkedAt: at, note: "Browser check is stale (>3d)" };
+  }
+  return ok ? { result: "pass", checkedAt: at, note: passNote } : { result: "fail", checkedAt: at, note: failNote };
+}
+function securityEvidence(site, now) {
+  const crit = site.securityVulnsCritical;
+  const high = site.securityVulnsHigh;
+  if (crit === null || high === null || !site.lastSecurityAuditAt) return null;
+  const at = site.lastSecurityAuditAt;
+  if (!isFresh(at, now)) {
+    return { result: "unknown", checkedAt: at, note: "Security audit is stale (>3d)" };
+  }
+  if (crit === 0 && high === 0) {
+    return { result: "pass", checkedAt: at, note: "No known critical/high vulnerabilities" };
+  }
+  return { result: "fail", checkedAt: at, note: `${crit} critical / ${high} high vuln(s)` };
+}
+function googleEvidence(now, search) {
+  const at = now.toISOString();
+  if (search.softFailed) {
+    return { result: "unknown", checkedAt: at, note: "Search Console unavailable this run" };
+  }
+  if (search.value === null) return null;
+  if (search.value.foundOnPage1) {
+    const pos2 = search.value.position;
+    return {
+      result: "pass",
+      checkedAt: at,
+      note: `Page 1 on Google${pos2 !== null ? ` (#${pos2})` : ""}`
+    };
+  }
+  const pos = search.value.position;
+  return {
+    result: "fail",
+    checkedAt: at,
+    note: `Not on page 1${pos !== null ? ` (avg #${pos})` : ""}`
+  };
+}
+function domainEvidence(site, now) {
+  if (!site.url || isNetlifyAppUrl(site.url)) return null;
+  if (!site.domainCheckedAt) return null;
+  const at = site.domainCheckedAt;
+  if (!isFresh(site.domainCheckedAt, now)) {
+    return { result: "unknown", checkedAt: at, note: "Domain check is stale (>3d)" };
+  }
+  const days = site.certDaysRemaining;
+  if (days === null) {
+    return { result: "fail", checkedAt: at, note: "Did not resolve, or no valid TLS cert" };
+  }
+  if (days <= CERT_MIN_DAYS) {
+    return { result: "fail", checkedAt: at, note: `TLS cert expires in ${days}d` };
+  }
+  return { result: "pass", checkedAt: at, note: `Custom domain, valid cert (${days}d left)` };
+}
+
 // src/reports/draft.ts
 init_attachments();
 
@@ -5829,7 +6494,7 @@ import { readFileSync as readFileSync3 } from "fs";
 import { JWT } from "google-auth-library";
 import { BetaAnalyticsDataClient } from "@google-analytics/data";
 var ANALYTICS_READONLY = "https://www.googleapis.com/auth/analytics.readonly";
-var MS_PER_DAY = 864e5;
+var MS_PER_DAY3 = 864e5;
 function ymd2(d) {
   return d.toISOString().slice(0, 10);
 }
@@ -5842,9 +6507,9 @@ async function fetchPeriodUsers(query, periodStart, periodEnd) {
     subject: query.subject
   });
   const client = new BetaAnalyticsDataClient({ authClient });
-  const lengthDays = Math.round((periodEnd.getTime() - periodStart.getTime()) / MS_PER_DAY);
-  const prevEnd = new Date(periodStart.getTime() - MS_PER_DAY);
-  const prevStart = new Date(prevEnd.getTime() - lengthDays * MS_PER_DAY);
+  const lengthDays = Math.round((periodEnd.getTime() - periodStart.getTime()) / MS_PER_DAY3);
+  const prevEnd = new Date(periodStart.getTime() - MS_PER_DAY3);
+  const prevStart = new Date(prevEnd.getTime() - lengthDays * MS_PER_DAY3);
   const property = `properties/${query.propertyId}`;
   const run = async (start, end) => {
     const [resp] = await client.runReport({
@@ -5968,7 +6633,7 @@ async function draftReportForSite(base, siteRow, reportType, options = {}) {
   const periodStart = base !== null ? await derivePeriodStart(base, siteRow, reportType, today) : daysAgo(today, 30);
   const periodEnd = today;
   const completedOn = today;
-  const lastTestedDate = reportType === "Maintenance" && siteRow.testingDay ? new Date(siteRow.testingDay) : null;
+  const lastTestedDate = reportType === "Maintenance" && siteRow.lastLighthouseAuditAt ? new Date(siteRow.lastLighthouseAuditAt) : null;
   const gaResult = base !== null ? await fetchGaUsers(siteRow, periodStart, periodEnd) : NO_ENRICHMENT;
   const searchResult = base !== null ? await fetchSearch(siteRow, periodStart, periodEnd) : NO_ENRICHMENT;
   const gaUsers = gaResult.value;
@@ -6015,6 +6680,9 @@ async function draftReportForSite(base, siteRow, reportType, options = {}) {
       supersededIds: outcome2.supersededIds
     };
   }
+  const evidence = autoTickChecklist(siteRow, reportType, completedOn, { search: searchResult });
+  const checklistTicks = [...evidence.entries()].filter(([, e]) => e.result === "pass").map(([field]) => field);
+  const autoEvidence = Object.fromEntries(evidence);
   const reportId = `${siteRow.name} \u2014 ${reportType} \u2014 ${periodEnd.toISOString().slice(0, 10)}`;
   const created = await createDraft(base, {
     reportId,
@@ -6028,7 +6696,9 @@ async function draftReportForSite(base, siteRow, reportType, options = {}) {
     lastTestedDate,
     ...gaUsers ? { gaUsersCurrent: gaUsers.current, gaUsersPrevious: gaUsers.previous } : {},
     ...search ? { searchFoundPage1: search.foundOnPage1 } : {},
-    ...search?.foundOnPage1 && search.position !== null ? { searchPosition: search.position } : {}
+    ...search?.foundOnPage1 && search.position !== null ? { searchPosition: search.position } : {},
+    checklistTicks,
+    autoEvidence
   });
   await uploadDraftHtml(created.id, slug, periodEnd, html);
   const outcome = await queueDraft(base, {
@@ -6859,7 +7529,9 @@ var AUDIT_DESCRIPTIONS = {
   lighthouse: "Run @lhci/cli autorun using the canonical lighthouserc.",
   a11y: "Playwright + axe against the canonical a11y routes.",
   security: "pnpm audit (falls back to npm audit), prod-deps by default.",
-  lint: "ESLint + Prettier using the canonical configs."
+  lint: "ESLint + Prettier using the canonical configs.",
+  domain: "DNS resolve + TLS cert expiry against the deployed URL (checkout-free).",
+  browser: "Playwright across desktop engines + mobile devices + link-check against the deployed URL (checkout-free)."
 };
 var RECIPE_DESCRIPTIONS = {
   "sync-configs": "Overwrite a site's canonical configs to match @reddoorla/maintenance.",