@reddoorla/maintenance 0.49.0 → 0.51.0

package/dist/cli/commands/audit.d.ts

@@ -1,4 +1,4 @@
-import { S as Site, a as AuditResult, A as AuditName } from '../../types-DeKpgkG-.js';
+import { S as Site, a as AuditResult, A as AuditName } from '../../types-QG-QhCYh.js';
 
 type AuditCommandOptions = {
     only?: string;
@@ -32,10 +32,8 @@ declare function parseConcurrency(value: string | undefined): boolean | number;
  *  null when there's nothing to warn about. Keeps the mixed-provenance result
  *  table from silently confusing the operator. */
 declare function deployedUrlNotice(which: AuditName[], url: string | undefined, cwd: string): string | null;
-/** A fleet site needs a local checkout unless every requested audit can run
- *  against its deployed URL. Today only lighthouse has a deployed mode, so a
- *  site is checkout-free exactly when it has a `deployedUrl` and lighthouse is
- *  the only requested audit. */
+/** A fleet site needs a local checkout unless every requested audit is checkout-free AND the site
+ *  has a `deployedUrl` for them to run against. */
 declare function auditNeedsCheckout(site: Site, which: AuditName[]): boolean;
 /** Apply a single-site `--url` to the resolved sites. Returns the input
  *  untouched when no url is given; otherwise requires exactly one site and

package/dist/cli/commands/audit.js

@@ -38,6 +38,38 @@ var init_credentials = __esm({
   }
 });
 
+// src/reports/airtable/throttle.ts
+function createMinIntervalThrottle(opts) {
+  const { minIntervalMs, now, delay } = opts;
+  return function wrap(fn) {
+    let chain = Promise.resolve();
+    let last = Number.NEGATIVE_INFINITY;
+    return (...args) => {
+      chain = chain.then(async () => {
+        const wait = minIntervalMs - (now() - last);
+        if (wait > 0) await delay(wait);
+        last = now();
+        fn(...args);
+      }).catch(() => {
+      });
+    };
+  };
+}
+function applyThrottle(base, opts) {
+  const real = base._base?.runAction;
+  if (typeof real !== "function") return base;
+  const wrap = createMinIntervalThrottle(opts);
+  const throttled = wrap(real.bind(base._base));
+  base._base.runAction = throttled;
+  base.runAction = throttled;
+  return base;
+}
+var init_throttle = __esm({
+  "src/reports/airtable/throttle.ts"() {
+    "use strict";
+  }
+});
+
 // src/reports/airtable/client.ts
 var client_exports = {};
 __export(client_exports, {
@@ -61,12 +93,20 @@ function readAirtableConfig() {
   return { apiKey, baseId };
 }
 function openBase(cfg) {
-  return new Airtable({ apiKey: cfg.apiKey }).base(cfg.baseId);
+  const base = new Airtable({ apiKey: cfg.apiKey }).base(cfg.baseId);
+  return applyThrottle(base, {
+    minIntervalMs: MIN_REQUEST_INTERVAL_MS,
+    now: () => Date.now(),
+    delay: (ms) => new Promise((resolve3) => setTimeout(resolve3, ms))
+  });
 }
+var MIN_REQUEST_INTERVAL_MS;
 var init_client = __esm({
   "src/reports/airtable/client.ts"() {
     "use strict";
     init_credentials();
+    init_throttle();
+    MIN_REQUEST_INTERVAL_MS = 220;
   }
 });
 
@@ -74,12 +114,15 @@ var init_client = __esm({
 var websites_exports = {};
 __export(websites_exports, {
   ACTIVE_STATUSES: () => ACTIVE_STATUSES,
+  SEVERITY_RANK: () => SEVERITY_RANK,
   WEBSITES_TABLE: () => WEBSITES_TABLE,
   getWebsiteBySlug: () => getWebsiteBySlug,
   isDashboardVisible: () => isDashboardVisible,
   listWebsites: () => listWebsites,
   mapRow: () => mapRow,
+  normalizeSecurityAdvisory: () => normalizeSecurityAdvisory,
   parseNotifyRouting: () => parseNotifyRouting,
+  parseSecurityAdvisories: () => parseSecurityAdvisories,
   siteSlug: () => siteSlug,
   updateA11yCounts: () => updateA11yCounts,
   updateAuditFields: () => updateAuditFields,
@@ -159,6 +202,15 @@ function mapRow(rec) {
     securityVulnsHigh: f["Security Vulns High"] ?? null,
     securityVulnsModerate: f["Security Vulns Moderate"] ?? null,
     securityVulnsLow: f["Security Vulns Low"] ?? null,
+    lastSecurityAuditAt: f["Last security audit at"] ?? null,
+    securityAdvisories: parseSecurityAdvisories(f["Security advisories"]),
+    certDaysRemaining: f["Cert days remaining"] ?? null,
+    domainCheckedAt: f["Domain checked at"] ?? null,
+    crossbrowserOk: typeof f["Crossbrowser OK"] === "boolean" ? f["Crossbrowser OK"] : null,
+    mobileOk: typeof f["Mobile OK"] === "boolean" ? f["Mobile OK"] : null,
+    linksOk: typeof f["Links OK"] === "boolean" ? f["Links OK"] : null,
+    brokenLinks: typeof f["Broken links"] === "number" ? f["Broken links"] : null,
+    browserCheckedAt: f["Browser checked at"] ?? null,
     copyIntro: trimToNull(f["Copy \u2014 Intro"]),
     copyContact: trimToNull(f["Copy \u2014 Contact"]),
     copyFooter: trimToNull(f["Copy \u2014 Footer"]),
@@ -215,12 +267,61 @@ function depsFields(counts) {
   }
   return fields;
 }
+function normalizeSecurityAdvisory(raw) {
+  if (!raw || typeof raw !== "object") return null;
+  const e = raw;
+  const module = typeof e["module"] === "string" ? e["module"] : null;
+  const severity = e["severity"];
+  if (module === null) return null;
+  if (severity !== "low" && severity !== "moderate" && severity !== "high" && severity !== "critical")
+    return null;
+  const cves = Array.isArray(e["cves"]) ? e["cves"].filter((c) => typeof c === "string") : [];
+  return {
+    module,
+    severity,
+    title: typeof e["title"] === "string" ? e["title"] : "",
+    cves,
+    url: typeof e["url"] === "string" ? e["url"] : null
+  };
+}
+function parseSecurityAdvisories(raw) {
+  if (typeof raw !== "string" || raw.trim() === "") return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (!Array.isArray(parsed)) return null;
+  return parsed.map(normalizeSecurityAdvisory).filter((a) => a !== null);
+}
+function securityAdvisoryFields(advisories) {
+  const capped = [...advisories].sort((a, b) => SEVERITY_RANK[a.severity] - SEVERITY_RANK[b.severity]).slice(0, MAX_PERSISTED_ADVISORIES);
+  return { "Security advisories": JSON.stringify(capped) };
+}
 function securityFields(counts) {
   return {
     "Security Vulns Critical": counts.critical,
     "Security Vulns High": counts.high,
     "Security Vulns Moderate": counts.moderate,
-    "Security Vulns Low": counts.low
+    "Security Vulns Low": counts.low,
+    // Stamp freshness alongside the counts so the Security Updates auto-tick can require a recent
+    // audit (a clean count from months ago must not silently keep ticking the box).
+    "Last security audit at": (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function domainFields(result) {
+  const fields = { "Domain checked at": result.checkedAt };
+  if (result.certDaysRemaining !== null) fields["Cert days remaining"] = result.certDaysRemaining;
+  return fields;
+}
+function browserFields(r) {
+  return {
+    "Crossbrowser OK": r.desktopOk,
+    "Mobile OK": r.mobileOk,
+    "Links OK": r.linksOk,
+    "Broken links": r.brokenLinks,
+    "Browser checked at": r.checkedAt
   };
 }
 async function updateScores(base, recordId, scores) {
@@ -241,6 +342,10 @@ async function updateAuditFields(base, recordId, audits) {
   if (audits.a11y) Object.assign(fields, a11yFields(audits.a11y));
   if (audits.deps) Object.assign(fields, depsFields(audits.deps));
   if (audits.security) Object.assign(fields, securityFields(audits.security));
+  if (audits.securityAdvisories)
+    Object.assign(fields, securityAdvisoryFields(audits.securityAdvisories));
+  if (audits.domain) Object.assign(fields, domainFields(audits.domain));
+  if (audits.browser) Object.assign(fields, browserFields(audits.browser));
   await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);
   return fields;
 }
@@ -259,7 +364,7 @@ async function updateLaunched(base, recordId, at) {
   const fields = { Status: "maintenance", "Launched at": at };
   await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);
 }
-var WEBSITES_TABLE, ACTIVE_STATUSES, FREQUENCIES;
+var WEBSITES_TABLE, ACTIVE_STATUSES, FREQUENCIES, SEVERITY_RANK, MAX_PERSISTED_ADVISORIES;
 var init_websites = __esm({
   "src/reports/airtable/websites.ts"() {
     "use strict";
@@ -269,6 +374,13 @@ var init_websites = __esm({
       "launch period"
     ]);
     FREQUENCIES = ["None", "Monthly", "Quarterly", "Yearly"];
+    SEVERITY_RANK = {
+      critical: 0,
+      high: 1,
+      moderate: 2,
+      low: 3
+    };
+    MAX_PERSISTED_ADVISORIES = 25;
   }
 });
 
@@ -429,9 +541,66 @@ function securityCountsFromResult(result) {
   const c = details?.counts ?? { low: 0, moderate: 0, high: 0, critical: 0 };
   return { critical: c.critical, high: c.high, moderate: c.moderate, low: c.low };
 }
+function advisoriesFromResult(result) {
+  if (result.audit !== "security") {
+    throw new Error(`Expected a 'security' AuditResult, got '${result.audit}'`);
+  }
+  const details = result.details;
+  const raw = details?.advisories;
+  if (!Array.isArray(raw)) return [];
+  return raw.map(normalizeSecurityAdvisory).filter((a) => a !== null);
+}
 var init_security_airtable = __esm({
   "src/audits/security-airtable.ts"() {
     "use strict";
+    init_websites();
+  }
+});
+
+// src/audits/domain-airtable.ts
+function hasDomainResult(result) {
+  if (result.audit !== "domain") return false;
+  const d = result.details;
+  return !!d && typeof d.checkedAt === "string";
+}
+function domainResultFromAudit(result) {
+  if (result.audit !== "domain") {
+    throw new Error(`Expected a 'domain' AuditResult, got '${result.audit}'`);
+  }
+  const d = result.details;
+  return {
+    certDaysRemaining: typeof d?.certDaysRemaining === "number" ? d.certDaysRemaining : null,
+    checkedAt: typeof d?.checkedAt === "string" ? d.checkedAt : (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+var init_domain_airtable = __esm({
+  "src/audits/domain-airtable.ts"() {
+    "use strict";
+  }
+});
+
+// src/audits/browser-airtable.ts
+function hasBrowserResult(result) {
+  if (result.audit !== "browser") return false;
+  const d = result.details;
+  return !!d && typeof d.checkedAt === "string";
+}
+function browserFieldsFromAudit(result) {
+  if (result.audit !== "browser") {
+    throw new Error(`Expected a 'browser' AuditResult, got '${result.audit}'`);
+  }
+  const d = result.details;
+  return {
+    desktopOk: d?.desktopOk === true,
+    mobileOk: d?.mobileOk === true,
+    linksOk: d?.linksOk === true,
+    brokenLinks: typeof d?.brokenLinks === "number" ? d.brokenLinks : 0,
+    checkedAt: typeof d?.checkedAt === "string" ? d.checkedAt : (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+var init_browser_airtable = __esm({
+  "src/audits/browser-airtable.ts"() {
+    "use strict";
   }
 });
 
@@ -445,22 +614,14 @@ __export(write_audits_to_airtable_exports, {
 async function writeAuditsToAirtable(args) {
   const { base, websites, slug, results } = args;
   const lhResult = results.find((r) => r.audit === "lighthouse");
-  if (!lhResult) {
-    throw Object.assign(
-      new Error(
-        "--write-airtable requires a lighthouse result; did you pass --only without lighthouse?"
-      ),
-      { exitCode: 2 }
-    );
-  }
   const target = websites.find((w) => siteSlug(w.name) === slug);
   if (!target) {
     throw Object.assign(new Error(`No Websites row matched slug "${slug}"`), { exitCode: 2 });
   }
   const writes = [];
   const audits = {};
-  const lhHasScores = hasRealScores(lhResult);
-  if (lhHasScores) {
+  const lhHasScores = lhResult ? hasRealScores(lhResult) : false;
+  if (lhResult && lhHasScores) {
     const scores = lighthouseScoresFromResult(lhResult);
     audits.scores = scores;
     writes.push({ audit: "lighthouse", counts: scores });
@@ -481,12 +642,25 @@ async function writeAuditsToAirtable(args) {
   if (sec && hasSecurityCounts(sec)) {
     const counts = securityCountsFromResult(sec);
     audits.security = counts;
+    audits.securityAdvisories = advisoriesFromResult(sec);
     writes.push({ audit: "security", counts });
   }
+  const dom = results.find((r) => r.audit === "domain");
+  if (dom && hasDomainResult(dom)) {
+    const result = domainResultFromAudit(dom);
+    audits.domain = result;
+    writes.push({ audit: "domain", counts: result });
+  }
+  const browser = results.find((r) => r.audit === "browser");
+  if (browser && hasBrowserResult(browser)) {
+    const fields = browserFieldsFromAudit(browser);
+    audits.browser = fields;
+    writes.push({ audit: "browser", counts: fields });
+  }
   if (Object.keys(audits).length > 0) {
     await updateAuditFields(base, target.id, audits);
   }
-  if (!lhHasScores) {
+  if (lhResult && !lhHasScores) {
     const persisted = writes.map((w) => w.audit);
     throw Object.assign(
       new Error(
@@ -537,6 +711,8 @@ var init_write_audits_to_airtable = __esm({
     init_a11y_airtable();
     init_deps_airtable();
     init_security_airtable();
+    init_domain_airtable();
+    init_browser_airtable();
   }
 });
 
@@ -1485,13 +1661,348 @@ async function a11yAudit(ctx) {
   }
 }
 
+// src/audits/domain.ts
+import { promises as dnsPromises } from "dns";
+import tls from "tls";
+var MS_PER_DAY = 24 * 60 * 60 * 1e3;
+async function checkDomain(url, deps) {
+  let host;
+  try {
+    host = new URL(url).hostname;
+  } catch {
+    return { resolved: false, certDaysRemaining: null };
+  }
+  try {
+    await deps.lookup(host);
+  } catch {
+    return { resolved: false, certDaysRemaining: null };
+  }
+  let validTo;
+  try {
+    validTo = await deps.certValidTo(host);
+  } catch {
+    validTo = null;
+  }
+  if (!validTo || Number.isNaN(validTo.getTime()))
+    return { resolved: true, certDaysRemaining: null };
+  return {
+    resolved: true,
+    certDaysRemaining: Math.floor((validTo.getTime() - deps.now.getTime()) / MS_PER_DAY)
+  };
+}
+function defaultDomainDeps(now) {
+  return {
+    lookup: async (host) => {
+      await dnsPromises.lookup(host);
+    },
+    certValidTo: (host) => new Promise((resolvePromise) => {
+      const socket = tls.connect(
+        { host, port: 443, servername: host, timeout: 1e4, rejectUnauthorized: true },
+        () => {
+          const cert = socket.authorized ? socket.getPeerCertificate() : null;
+          socket.end();
+          const validTo = cert && cert.valid_to ? new Date(cert.valid_to) : null;
+          resolvePromise(validTo);
+        }
+      );
+      socket.on("error", () => resolvePromise(null));
+      socket.on("timeout", () => {
+        socket.destroy();
+        resolvePromise(null);
+      });
+    }),
+    now
+  };
+}
+async function domainAudit(ctx) {
+  const { site } = ctx;
+  const label = siteLabel(site);
+  if (!site.deployedUrl) {
+    return { audit: "domain", site: label, status: "skip", summary: "no deployed URL" };
+  }
+  const now = ctx.now ?? /* @__PURE__ */ new Date();
+  const deps = ctx.domainDeps ?? defaultDomainDeps(now);
+  const check = await checkDomain(site.deployedUrl, deps);
+  const checkedAt = now.toISOString();
+  const status = check.resolved && check.certDaysRemaining !== null && check.certDaysRemaining > 14 ? "pass" : "warn";
+  const summary = !check.resolved ? "did not resolve" : check.certDaysRemaining === null ? "resolved, no usable TLS cert" : `resolved, cert ${check.certDaysRemaining}d remaining`;
+  return {
+    audit: "domain",
+    site: label,
+    status,
+    summary,
+    details: { resolved: check.resolved, certDaysRemaining: check.certDaysRemaining, checkedAt }
+  };
+}
+
+// src/audits/route-discovery.ts
+var DEFAULT_CAP = 15;
+function parseSitemapUrls(xml) {
+  const out = [];
+  const re = /<loc>\s*([^<\s]+)\s*<\/loc>/gi;
+  let m;
+  while ((m = re.exec(xml)) !== null) {
+    const url = m[1];
+    if (url) out.push(url.trim());
+  }
+  return out;
+}
+function parseHtmlLinks(html, baseUrl) {
+  const out = /* @__PURE__ */ new Set();
+  const re = /<a\b[^>]*\bhref\s*=\s*["']([^"']+)["']/gi;
+  let m;
+  while ((m = re.exec(html)) !== null) {
+    const href = m[1];
+    if (!href || href.startsWith("#") || /^(mailto:|tel:|javascript:)/i.test(href)) continue;
+    try {
+      const u = new URL(href, baseUrl);
+      if (u.origin !== new URL(baseUrl).origin) continue;
+      out.add(u.pathname);
+    } catch {
+    }
+  }
+  return [...out];
+}
+function family(pathname) {
+  return pathname.split("/").filter(Boolean)[0] ?? "";
+}
+function sampleRoutePaths(urlsOrPaths, cap = DEFAULT_CAP) {
+  const seen = /* @__PURE__ */ new Set(["/"]);
+  const buckets = /* @__PURE__ */ new Map();
+  for (const raw of urlsOrPaths) {
+    let pathname;
+    try {
+      pathname = raw.startsWith("/") ? new URL(raw, "https://x.invalid").pathname : new URL(raw).pathname;
+    } catch {
+      continue;
+    }
+    if (pathname === "/") continue;
+    if (seen.has(pathname)) continue;
+    seen.add(pathname);
+    const fam = family(pathname);
+    const arr = buckets.get(fam) ?? [];
+    arr.push(pathname);
+    buckets.set(fam, arr);
+  }
+  const result = ["/"];
+  const families = [...buckets.values()];
+  let guard = 0;
+  while (result.length < cap && families.some((f) => f.length > 0) && guard++ < 1e4) {
+    for (const fam of families) {
+      if (result.length >= cap) break;
+      const next = fam.shift();
+      if (next) result.push(next);
+    }
+  }
+  return result;
+}
+function familyCountsOf(paths) {
+  const counts = {};
+  for (const p of paths) {
+    const key = p === "/" ? "/" : `/${family(p)}`;
+    counts[key] = (counts[key] ?? 0) + 1;
+  }
+  return counts;
+}
+async function discoverRoutes(deployedUrl, deps, cap = DEFAULT_CAP) {
+  const origin = new URL(deployedUrl).origin;
+  const abs = (paths) => paths.map((p) => new URL(p, origin).href);
+  const sitemapXml = await deps.fetchText(new URL("/sitemap.xml", origin).href);
+  if (sitemapXml) {
+    const urls = parseSitemapUrls(sitemapXml);
+    if (urls.length > 0) {
+      const paths = sampleRoutePaths(urls, cap);
+      return { routes: abs(paths), source: "sitemap", familyCounts: familyCountsOf(paths) };
+    }
+  }
+  const homeHtml = await deps.fetchText(origin);
+  if (homeHtml) {
+    const links = parseHtmlLinks(homeHtml, origin);
+    if (links.length > 0) {
+      const paths = sampleRoutePaths(links, cap);
+      return { routes: abs(paths), source: "homepage-links", familyCounts: familyCountsOf(paths) };
+    }
+  }
+  return { routes: [new URL("/", origin).href], source: "root-only", familyCounts: { "/": 1 } };
+}
+
+// src/audits/browser.ts
+function isBroken(status) {
+  return status === null || status >= 400;
+}
+function summarizeBrowser(routes, links, familyCounts) {
+  const desktopChecks = routes.flatMap((r) => r.desktop);
+  const mobileChecks = routes.flatMap((r) => r.mobile);
+  const desktopOk = routes.length > 0 && routes.every((r) => r.desktop.length > 0 && r.desktop.every((d) => d.ok));
+  const mobileOk = routes.length > 0 && routes.every((r) => r.mobile.length > 0 && r.mobile.every((m) => m.ok));
+  const brokenLinks = links.filter((l) => isBroken(l.status)).length;
+  const linksOk = links.length > 0 && brokenLinks === 0;
+  const engines = [...new Set(desktopChecks.map((d) => d.engine))];
+  const devices2 = [...new Set(mobileChecks.map((m) => m.device))];
+  const families = Object.entries(familyCounts).map(([f, n]) => f === "/" ? "/" : `${f} \xD7${n}`).join(", ");
+  const note = `${routes.length} routes (${families}); desktop ${engines.join("/") || "\u2014"}; mobile ${devices2.join("/") || "\u2014"}; ${links.length} links, ${brokenLinks} broken`;
+  return { desktopOk, mobileOk, linksOk, brokenLinks, routesChecked: routes.length, note };
+}
+async function browserAudit(ctx) {
+  const { site } = ctx;
+  const label = siteLabel(site);
+  if (!site.deployedUrl) {
+    return { audit: "browser", site: label, status: "skip", summary: "no deployed URL" };
+  }
+  const now = ctx.now ?? /* @__PURE__ */ new Date();
+  const discoverDeps = ctx.discoverDeps ?? defaultDiscoverDeps();
+  const runner = ctx.browserRunner ?? await defaultBrowserRunner();
+  try {
+    const discovered = await discoverRoutes(site.deployedUrl, discoverDeps);
+    const routeResults = await runner.probe(discovered.routes);
+    const internalLinks = [...new Set(routeResults.flatMap((r) => r.links))];
+    const linkResults = await runner.checkLinks(internalLinks);
+    const summary = summarizeBrowser(
+      routeResults,
+      linkResults,
+      discovered.familyCounts ?? familyCountsOf(discovered.routes)
+    );
+    const status = summary.desktopOk && summary.mobileOk && summary.linksOk ? "pass" : "warn";
+    return {
+      audit: "browser",
+      site: label,
+      status,
+      summary: summary.note,
+      details: { ...summary, checkedAt: now.toISOString() }
+    };
+  } finally {
+    await runner.close?.();
+  }
+}
+function defaultDiscoverDeps() {
+  return {
+    fetchText: async (url) => {
+      try {
+        const res = await fetch(url, { redirect: "follow" });
+        if (!res.ok) return null;
+        return await res.text();
+      } catch {
+        return null;
+      }
+    }
+  };
+}
+var DESKTOP_VIEWPORT = { width: 1366, height: 900 };
+var PAGE_TIMEOUT_MS = 3e4;
+async function defaultBrowserRunner() {
+  const { chromium, firefox, webkit, devices: devices2 } = await import("@playwright/test");
+  const desktopEngines = [
+    { engine: "chromium", type: chromium },
+    { engine: "firefox", type: firefox },
+    { engine: "webkit", type: webkit }
+  ];
+  const mobileTargets = [
+    { device: "Pixel 7", descriptor: devices2["Pixel 7"] },
+    { device: "iPhone 14", descriptor: devices2["iPhone 14"] }
+  ];
+  return {
+    async probe(urls) {
+      const results = [];
+      const browsers = await Promise.all(desktopEngines.map((e) => e.type.launch()));
+      const mobileBrowsers = await Promise.all(mobileTargets.map(() => chromium.launch()));
+      try {
+        for (const url of urls) {
+          const desktop = [];
+          const linkSet = /* @__PURE__ */ new Set();
+          for (let i = 0; i < desktopEngines.length; i++) {
+            const engine = desktopEngines[i].engine;
+            const browser = browsers[i];
+            const ctx = await browser.newContext({ viewport: DESKTOP_VIEWPORT });
+            const page = await ctx.newPage();
+            const errors = [];
+            page.on("pageerror", (e) => errors.push(String(e)));
+            let ok = false;
+            try {
+              const resp = await page.goto(url, {
+                waitUntil: "domcontentloaded",
+                timeout: PAGE_TIMEOUT_MS
+              });
+              const hasMain = await page.locator("main, [role=main]").first().isVisible().catch(() => false);
+              ok = !!resp && resp.ok() && errors.length === 0 && hasMain;
+              if (engine === "chromium") {
+                const hrefs = await page.evaluate("Array.from(document.querySelectorAll('a[href]')).map((a) => a.href)").catch(() => []);
+                const origin = new URL(url).origin;
+                for (const h of hrefs) {
+                  try {
+                    if (new URL(h).origin === origin) linkSet.add(new URL(h).href);
+                  } catch {
+                  }
+                }
+              }
+            } catch {
+              ok = false;
+            } finally {
+              await ctx.close().catch(() => {
+              });
+            }
+            desktop.push({ engine, ok });
+          }
+          const mobile = [];
+          for (let i = 0; i < mobileTargets.length; i++) {
+            const { device, descriptor } = mobileTargets[i];
+            const browser = mobileBrowsers[i];
+            const ctx = await browser.newContext({ ...descriptor });
+            const page = await ctx.newPage();
+            const errors = [];
+            page.on("pageerror", (e) => errors.push(String(e)));
+            let ok = false;
+            try {
+              const resp = await page.goto(url, {
+                waitUntil: "domcontentloaded",
+                timeout: PAGE_TIMEOUT_MS
+              });
+              const overflow = await page.evaluate("document.documentElement.scrollWidth > window.innerWidth + 2").catch(() => true);
+              ok = !!resp && resp.ok() && errors.length === 0 && !overflow;
+            } catch {
+              ok = false;
+            } finally {
+              await ctx.close().catch(() => {
+              });
+            }
+            mobile.push({ device, ok });
+          }
+          results.push({ url, desktop, mobile, links: [...linkSet] });
+        }
+      } finally {
+        await Promise.all([...browsers, ...mobileBrowsers].map((b) => b.close().catch(() => {
+        })));
+      }
+      return results;
+    },
+    async checkLinks(urls) {
+      const out = [];
+      for (const url of urls) {
+        let status;
+        try {
+          let res = await fetch(url, { method: "HEAD", redirect: "follow" });
+          if (res.status === 405 || res.status === 501) {
+            res = await fetch(url, { method: "GET", redirect: "follow" });
+          }
+          status = res.status;
+        } catch {
+          status = null;
+        }
+        out.push({ url, status });
+      }
+      return out;
+    }
+  };
+}
+
 // src/audits/index.ts
 var REGISTRY = {
   deps: depsAudit,
   lint: lintAudit,
   security: securityAudit,
   lighthouse: lighthouseAudit,
-  a11y: a11yAudit
+  a11y: a11yAudit,
+  domain: domainAudit,
+  browser: browserAudit
 };
 var ALL_AUDIT_NAMES = Object.keys(REGISTRY);
 var DEFAULT_AUDIT_TIMEOUT_MS = 3e4;
@@ -1902,8 +2413,13 @@ function deployedUrlNotice(which, url, cwd) {
   if (others.length === 0) return null;
   return `note: --url only affects lighthouse; ${others.join(", ")} ran against the local checkout at ${cwd}`;
 }
+var CHECKOUT_FREE_AUDITS = /* @__PURE__ */ new Set([
+  "lighthouse",
+  "domain",
+  "browser"
+]);
 function auditNeedsCheckout(site, which) {
-  const deployedCapable = site.deployedUrl !== void 0 && which.every((n) => n === "lighthouse");
+  const deployedCapable = site.deployedUrl !== void 0 && which.every((n) => CHECKOUT_FREE_AUDITS.has(n));
   return !deployedCapable;
 }
 function applyDeployedUrl(sites, url) {