@reddoorla/maintenance 0.49.0 → 0.51.0

package/dist/index.js

@@ -939,13 +939,348 @@ async function a11yAudit(ctx) {
   }
 }
 
+// src/audits/domain.ts
+import { promises as dnsPromises } from "dns";
+import tls from "tls";
+var MS_PER_DAY = 24 * 60 * 60 * 1e3;
+async function checkDomain(url, deps) {
+  let host;
+  try {
+    host = new URL(url).hostname;
+  } catch {
+    return { resolved: false, certDaysRemaining: null };
+  }
+  try {
+    await deps.lookup(host);
+  } catch {
+    return { resolved: false, certDaysRemaining: null };
+  }
+  let validTo;
+  try {
+    validTo = await deps.certValidTo(host);
+  } catch {
+    validTo = null;
+  }
+  if (!validTo || Number.isNaN(validTo.getTime()))
+    return { resolved: true, certDaysRemaining: null };
+  return {
+    resolved: true,
+    certDaysRemaining: Math.floor((validTo.getTime() - deps.now.getTime()) / MS_PER_DAY)
+  };
+}
+function defaultDomainDeps(now) {
+  return {
+    lookup: async (host) => {
+      await dnsPromises.lookup(host);
+    },
+    certValidTo: (host) => new Promise((resolvePromise) => {
+      const socket = tls.connect(
+        { host, port: 443, servername: host, timeout: 1e4, rejectUnauthorized: true },
+        () => {
+          const cert = socket.authorized ? socket.getPeerCertificate() : null;
+          socket.end();
+          const validTo = cert && cert.valid_to ? new Date(cert.valid_to) : null;
+          resolvePromise(validTo);
+        }
+      );
+      socket.on("error", () => resolvePromise(null));
+      socket.on("timeout", () => {
+        socket.destroy();
+        resolvePromise(null);
+      });
+    }),
+    now
+  };
+}
+async function domainAudit(ctx) {
+  const { site } = ctx;
+  const label = siteLabel(site);
+  if (!site.deployedUrl) {
+    return { audit: "domain", site: label, status: "skip", summary: "no deployed URL" };
+  }
+  const now = ctx.now ?? /* @__PURE__ */ new Date();
+  const deps = ctx.domainDeps ?? defaultDomainDeps(now);
+  const check = await checkDomain(site.deployedUrl, deps);
+  const checkedAt = now.toISOString();
+  const status = check.resolved && check.certDaysRemaining !== null && check.certDaysRemaining > 14 ? "pass" : "warn";
+  const summary = !check.resolved ? "did not resolve" : check.certDaysRemaining === null ? "resolved, no usable TLS cert" : `resolved, cert ${check.certDaysRemaining}d remaining`;
+  return {
+    audit: "domain",
+    site: label,
+    status,
+    summary,
+    details: { resolved: check.resolved, certDaysRemaining: check.certDaysRemaining, checkedAt }
+  };
+}
+
+// src/audits/route-discovery.ts
+var DEFAULT_CAP = 15;
+function parseSitemapUrls(xml) {
+  const out = [];
+  const re = /<loc>\s*([^<\s]+)\s*<\/loc>/gi;
+  let m;
+  while ((m = re.exec(xml)) !== null) {
+    const url = m[1];
+    if (url) out.push(url.trim());
+  }
+  return out;
+}
+function parseHtmlLinks(html, baseUrl) {
+  const out = /* @__PURE__ */ new Set();
+  const re = /<a\b[^>]*\bhref\s*=\s*["']([^"']+)["']/gi;
+  let m;
+  while ((m = re.exec(html)) !== null) {
+    const href = m[1];
+    if (!href || href.startsWith("#") || /^(mailto:|tel:|javascript:)/i.test(href)) continue;
+    try {
+      const u = new URL(href, baseUrl);
+      if (u.origin !== new URL(baseUrl).origin) continue;
+      out.add(u.pathname);
+    } catch {
+    }
+  }
+  return [...out];
+}
+function family(pathname) {
+  return pathname.split("/").filter(Boolean)[0] ?? "";
+}
+function sampleRoutePaths(urlsOrPaths, cap = DEFAULT_CAP) {
+  const seen = /* @__PURE__ */ new Set(["/"]);
+  const buckets = /* @__PURE__ */ new Map();
+  for (const raw of urlsOrPaths) {
+    let pathname;
+    try {
+      pathname = raw.startsWith("/") ? new URL(raw, "https://x.invalid").pathname : new URL(raw).pathname;
+    } catch {
+      continue;
+    }
+    if (pathname === "/") continue;
+    if (seen.has(pathname)) continue;
+    seen.add(pathname);
+    const fam = family(pathname);
+    const arr = buckets.get(fam) ?? [];
+    arr.push(pathname);
+    buckets.set(fam, arr);
+  }
+  const result = ["/"];
+  const families = [...buckets.values()];
+  let guard = 0;
+  while (result.length < cap && families.some((f) => f.length > 0) && guard++ < 1e4) {
+    for (const fam of families) {
+      if (result.length >= cap) break;
+      const next = fam.shift();
+      if (next) result.push(next);
+    }
+  }
+  return result;
+}
+function familyCountsOf(paths) {
+  const counts = {};
+  for (const p of paths) {
+    const key = p === "/" ? "/" : `/${family(p)}`;
+    counts[key] = (counts[key] ?? 0) + 1;
+  }
+  return counts;
+}
+async function discoverRoutes(deployedUrl, deps, cap = DEFAULT_CAP) {
+  const origin = new URL(deployedUrl).origin;
+  const abs = (paths) => paths.map((p) => new URL(p, origin).href);
+  const sitemapXml = await deps.fetchText(new URL("/sitemap.xml", origin).href);
+  if (sitemapXml) {
+    const urls = parseSitemapUrls(sitemapXml);
+    if (urls.length > 0) {
+      const paths = sampleRoutePaths(urls, cap);
+      return { routes: abs(paths), source: "sitemap", familyCounts: familyCountsOf(paths) };
+    }
+  }
+  const homeHtml = await deps.fetchText(origin);
+  if (homeHtml) {
+    const links = parseHtmlLinks(homeHtml, origin);
+    if (links.length > 0) {
+      const paths = sampleRoutePaths(links, cap);
+      return { routes: abs(paths), source: "homepage-links", familyCounts: familyCountsOf(paths) };
+    }
+  }
+  return { routes: [new URL("/", origin).href], source: "root-only", familyCounts: { "/": 1 } };
+}
+
+// src/audits/browser.ts
+function isBroken(status) {
+  return status === null || status >= 400;
+}
+function summarizeBrowser(routes, links, familyCounts) {
+  const desktopChecks = routes.flatMap((r) => r.desktop);
+  const mobileChecks = routes.flatMap((r) => r.mobile);
+  const desktopOk = routes.length > 0 && routes.every((r) => r.desktop.length > 0 && r.desktop.every((d) => d.ok));
+  const mobileOk = routes.length > 0 && routes.every((r) => r.mobile.length > 0 && r.mobile.every((m) => m.ok));
+  const brokenLinks = links.filter((l) => isBroken(l.status)).length;
+  const linksOk = links.length > 0 && brokenLinks === 0;
+  const engines = [...new Set(desktopChecks.map((d) => d.engine))];
+  const devices2 = [...new Set(mobileChecks.map((m) => m.device))];
+  const families = Object.entries(familyCounts).map(([f, n]) => f === "/" ? "/" : `${f} \xD7${n}`).join(", ");
+  const note = `${routes.length} routes (${families}); desktop ${engines.join("/") || "\u2014"}; mobile ${devices2.join("/") || "\u2014"}; ${links.length} links, ${brokenLinks} broken`;
+  return { desktopOk, mobileOk, linksOk, brokenLinks, routesChecked: routes.length, note };
+}
+async function browserAudit(ctx) {
+  const { site } = ctx;
+  const label = siteLabel(site);
+  if (!site.deployedUrl) {
+    return { audit: "browser", site: label, status: "skip", summary: "no deployed URL" };
+  }
+  const now = ctx.now ?? /* @__PURE__ */ new Date();
+  const discoverDeps = ctx.discoverDeps ?? defaultDiscoverDeps();
+  const runner = ctx.browserRunner ?? await defaultBrowserRunner();
+  try {
+    const discovered = await discoverRoutes(site.deployedUrl, discoverDeps);
+    const routeResults = await runner.probe(discovered.routes);
+    const internalLinks = [...new Set(routeResults.flatMap((r) => r.links))];
+    const linkResults = await runner.checkLinks(internalLinks);
+    const summary = summarizeBrowser(
+      routeResults,
+      linkResults,
+      discovered.familyCounts ?? familyCountsOf(discovered.routes)
+    );
+    const status = summary.desktopOk && summary.mobileOk && summary.linksOk ? "pass" : "warn";
+    return {
+      audit: "browser",
+      site: label,
+      status,
+      summary: summary.note,
+      details: { ...summary, checkedAt: now.toISOString() }
+    };
+  } finally {
+    await runner.close?.();
+  }
+}
+function defaultDiscoverDeps() {
+  return {
+    fetchText: async (url) => {
+      try {
+        const res = await fetch(url, { redirect: "follow" });
+        if (!res.ok) return null;
+        return await res.text();
+      } catch {
+        return null;
+      }
+    }
+  };
+}
+var DESKTOP_VIEWPORT = { width: 1366, height: 900 };
+var PAGE_TIMEOUT_MS = 3e4;
+async function defaultBrowserRunner() {
+  const { chromium, firefox, webkit, devices: devices2 } = await import("@playwright/test");
+  const desktopEngines = [
+    { engine: "chromium", type: chromium },
+    { engine: "firefox", type: firefox },
+    { engine: "webkit", type: webkit }
+  ];
+  const mobileTargets = [
+    { device: "Pixel 7", descriptor: devices2["Pixel 7"] },
+    { device: "iPhone 14", descriptor: devices2["iPhone 14"] }
+  ];
+  return {
+    async probe(urls) {
+      const results = [];
+      const browsers = await Promise.all(desktopEngines.map((e) => e.type.launch()));
+      const mobileBrowsers = await Promise.all(mobileTargets.map(() => chromium.launch()));
+      try {
+        for (const url of urls) {
+          const desktop = [];
+          const linkSet = /* @__PURE__ */ new Set();
+          for (let i = 0; i < desktopEngines.length; i++) {
+            const engine = desktopEngines[i].engine;
+            const browser = browsers[i];
+            const ctx = await browser.newContext({ viewport: DESKTOP_VIEWPORT });
+            const page = await ctx.newPage();
+            const errors = [];
+            page.on("pageerror", (e) => errors.push(String(e)));
+            let ok = false;
+            try {
+              const resp = await page.goto(url, {
+                waitUntil: "domcontentloaded",
+                timeout: PAGE_TIMEOUT_MS
+              });
+              const hasMain = await page.locator("main, [role=main]").first().isVisible().catch(() => false);
+              ok = !!resp && resp.ok() && errors.length === 0 && hasMain;
+              if (engine === "chromium") {
+                const hrefs = await page.evaluate("Array.from(document.querySelectorAll('a[href]')).map((a) => a.href)").catch(() => []);
+                const origin = new URL(url).origin;
+                for (const h of hrefs) {
+                  try {
+                    if (new URL(h).origin === origin) linkSet.add(new URL(h).href);
+                  } catch {
+                  }
+                }
+              }
+            } catch {
+              ok = false;
+            } finally {
+              await ctx.close().catch(() => {
+              });
+            }
+            desktop.push({ engine, ok });
+          }
+          const mobile = [];
+          for (let i = 0; i < mobileTargets.length; i++) {
+            const { device, descriptor } = mobileTargets[i];
+            const browser = mobileBrowsers[i];
+            const ctx = await browser.newContext({ ...descriptor });
+            const page = await ctx.newPage();
+            const errors = [];
+            page.on("pageerror", (e) => errors.push(String(e)));
+            let ok = false;
+            try {
+              const resp = await page.goto(url, {
+                waitUntil: "domcontentloaded",
+                timeout: PAGE_TIMEOUT_MS
+              });
+              const overflow = await page.evaluate("document.documentElement.scrollWidth > window.innerWidth + 2").catch(() => true);
+              ok = !!resp && resp.ok() && errors.length === 0 && !overflow;
+            } catch {
+              ok = false;
+            } finally {
+              await ctx.close().catch(() => {
+              });
+            }
+            mobile.push({ device, ok });
+          }
+          results.push({ url, desktop, mobile, links: [...linkSet] });
+        }
+      } finally {
+        await Promise.all([...browsers, ...mobileBrowsers].map((b) => b.close().catch(() => {
+        })));
+      }
+      return results;
+    },
+    async checkLinks(urls) {
+      const out = [];
+      for (const url of urls) {
+        let status;
+        try {
+          let res = await fetch(url, { method: "HEAD", redirect: "follow" });
+          if (res.status === 405 || res.status === 501) {
+            res = await fetch(url, { method: "GET", redirect: "follow" });
+          }
+          status = res.status;
+        } catch {
+          status = null;
+        }
+        out.push({ url, status });
+      }
+      return out;
+    }
+  };
+}
+
 // src/audits/index.ts
 var REGISTRY = {
   deps: depsAudit,
   lint: lintAudit,
   security: securityAudit,
   lighthouse: lighthouseAudit,
-  a11y: a11yAudit
+  a11y: a11yAudit,
+  domain: domainAudit,
+  browser: browserAudit
 };
 var ALL_AUDIT_NAMES = Object.keys(REGISTRY);
 var DEFAULT_AUDIT_TIMEOUT_MS = 3e4;
@@ -2557,6 +2892,16 @@ function isHttpUrl(s) {
   }
   return parsed.protocol === "http:" || parsed.protocol === "https:";
 }
+function isNetlifyAppUrl(s) {
+  let parsed;
+  try {
+    parsed = new URL(s);
+  } catch {
+    return false;
+  }
+  const host = parsed.hostname.toLowerCase();
+  return host === "netlify.app" || host.endsWith(".netlify.app");
+}
 
 // src/inventory/json.ts
 function validate(raw) {
@@ -2684,6 +3029,15 @@ function mapRow(rec) {
     securityVulnsHigh: f["Security Vulns High"] ?? null,
     securityVulnsModerate: f["Security Vulns Moderate"] ?? null,
     securityVulnsLow: f["Security Vulns Low"] ?? null,
+    lastSecurityAuditAt: f["Last security audit at"] ?? null,
+    securityAdvisories: parseSecurityAdvisories(f["Security advisories"]),
+    certDaysRemaining: f["Cert days remaining"] ?? null,
+    domainCheckedAt: f["Domain checked at"] ?? null,
+    crossbrowserOk: typeof f["Crossbrowser OK"] === "boolean" ? f["Crossbrowser OK"] : null,
+    mobileOk: typeof f["Mobile OK"] === "boolean" ? f["Mobile OK"] : null,
+    linksOk: typeof f["Links OK"] === "boolean" ? f["Links OK"] : null,
+    brokenLinks: typeof f["Broken links"] === "number" ? f["Broken links"] : null,
+    browserCheckedAt: f["Browser checked at"] ?? null,
     copyIntro: trimToNull(f["Copy \u2014 Intro"]),
     copyContact: trimToNull(f["Copy \u2014 Contact"]),
     copyFooter: trimToNull(f["Copy \u2014 Footer"]),
@@ -2706,6 +3060,40 @@ async function listWebsites(base) {
   });
   return out;
 }
+var SEVERITY_RANK = {
+  critical: 0,
+  high: 1,
+  moderate: 2,
+  low: 3
+};
+function normalizeSecurityAdvisory(raw) {
+  if (!raw || typeof raw !== "object") return null;
+  const e = raw;
+  const module = typeof e["module"] === "string" ? e["module"] : null;
+  const severity = e["severity"];
+  if (module === null) return null;
+  if (severity !== "low" && severity !== "moderate" && severity !== "high" && severity !== "critical")
+    return null;
+  const cves = Array.isArray(e["cves"]) ? e["cves"].filter((c) => typeof c === "string") : [];
+  return {
+    module,
+    severity,
+    title: typeof e["title"] === "string" ? e["title"] : "",
+    cves,
+    url: typeof e["url"] === "string" ? e["url"] : null
+  };
+}
+function parseSecurityAdvisories(raw) {
+  if (typeof raw !== "string" || raw.trim() === "") return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (!Array.isArray(parsed)) return null;
+  return parsed.map(normalizeSecurityAdvisory).filter((a) => a !== null);
+}
 async function updateLaunched(base, recordId, at) {
   const fields = { Status: "maintenance", "Launched at": at };
   await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);
@@ -3363,9 +3751,32 @@ function mapRow2(rec) {
     deliveryStatus: f["Delivery status"] ?? "pending",
     renderedHtmlAttachment: html,
     resendMessageId: f["Resend message ID"] ?? null,
-    checklist: Object.fromEntries(ALL_CHECKLIST_FIELDS.map((name) => [name, Boolean(f[name])]))
+    checklist: Object.fromEntries(ALL_CHECKLIST_FIELDS.map((name) => [name, Boolean(f[name])])),
+    autoEvidence: parseAutoEvidence(f["Checklist auto-evidence"])
   };
 }
+function parseAutoEvidence(raw) {
+  if (typeof raw !== "string" || !raw.trim()) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+  const out = {};
+  for (const [field, v] of Object.entries(parsed)) {
+    if (!v || typeof v !== "object") continue;
+    const o = v;
+    if (o.result !== "pass" && o.result !== "fail" && o.result !== "unknown") continue;
+    out[field] = {
+      result: o.result,
+      checkedAt: typeof o.checkedAt === "string" ? o.checkedAt : null,
+      note: typeof o.note === "string" ? o.note : ""
+    };
+  }
+  return Object.keys(out).length > 0 ? out : null;
+}
 function lighthouseFromFields(f) {
   const p = f["Lighthouse \u2014 Performance"];
   const a = f["Lighthouse \u2014 Accessibility"];
@@ -3399,6 +3810,10 @@ async function createDraft(base, input) {
   if (input.searchPosition !== void 0) fields["Search position"] = input.searchPosition;
   if (input.period !== void 0) fields["Period"] = input.period;
   if (input.subjectOverride !== void 0) fields["Subject override"] = input.subjectOverride;
+  for (const field of input.checklistTicks ?? []) fields[field] = true;
+  if (input.autoEvidence && Object.keys(input.autoEvidence).length > 0) {
+    fields["Checklist auto-evidence"] = JSON.stringify(input.autoEvidence);
+  }
   const created = await base(REPORTS_TABLE).create([{ fields }]);
   const rec = created[0];
   if (!rec) throw new Error("Airtable create returned no records");
@@ -3467,6 +3882,118 @@ async function queueDraft(base, report) {
   return { queued: true, supersededIds };
 }
 
+// src/reports/auto-tick.ts
+var STALE_DAYS = 3;
+var MS_PER_DAY2 = 24 * 60 * 60 * 1e3;
+function isFresh(checkedAt, now) {
+  if (!checkedAt) return false;
+  const t = new Date(checkedAt).getTime();
+  if (Number.isNaN(t)) return false;
+  return now.getTime() - t <= STALE_DAYS * MS_PER_DAY2;
+}
+var CERT_MIN_DAYS = 14;
+function autoTickChecklist(site, reportType, now, signals) {
+  const out = /* @__PURE__ */ new Map();
+  const fields = new Set(checklistFor(reportType).map((i) => i.field));
+  if (fields.has("Maint: Google Indexed")) {
+    const g = googleEvidence(now, signals.search);
+    if (g) out.set("Maint: Google Indexed", g);
+  }
+  if (fields.has("Maint: Security Updates")) {
+    const s = securityEvidence(site, now);
+    if (s) out.set("Maint: Security Updates", s);
+  }
+  if (fields.has("Maint: Domain, DNS & SSL")) {
+    const d = domainEvidence(site, now);
+    if (d) out.set("Maint: Domain, DNS & SSL", d);
+  }
+  if (fields.has("Test: Desktop Browsers")) {
+    const e = browserEvidence(
+      site.crossbrowserOk,
+      site,
+      now,
+      "Desktop renders cleanly",
+      "render errors"
+    );
+    if (e) out.set("Test: Desktop Browsers", e);
+  }
+  if (fields.has("Test: Mobile Browsers")) {
+    const e = browserEvidence(
+      site.mobileOk,
+      site,
+      now,
+      "Mobile renders cleanly",
+      "overflow/errors"
+    );
+    if (e) out.set("Test: Mobile Browsers", e);
+  }
+  if (fields.has("Test: Links & Navigation")) {
+    const broken = site.brokenLinks;
+    const failNote = broken && broken > 0 ? `${broken} broken link(s)` : "broken links / nav";
+    const e = browserEvidence(site.linksOk, site, now, "All internal links resolve", failNote);
+    if (e) out.set("Test: Links & Navigation", e);
+  }
+  return out;
+}
+function browserEvidence(ok, site, now, passNote, failNote) {
+  if (ok === null || !site.browserCheckedAt) return null;
+  const at = site.browserCheckedAt;
+  if (!isFresh(at, now)) {
+    return { result: "unknown", checkedAt: at, note: "Browser check is stale (>3d)" };
+  }
+  return ok ? { result: "pass", checkedAt: at, note: passNote } : { result: "fail", checkedAt: at, note: failNote };
+}
+function securityEvidence(site, now) {
+  const crit = site.securityVulnsCritical;
+  const high = site.securityVulnsHigh;
+  if (crit === null || high === null || !site.lastSecurityAuditAt) return null;
+  const at = site.lastSecurityAuditAt;
+  if (!isFresh(at, now)) {
+    return { result: "unknown", checkedAt: at, note: "Security audit is stale (>3d)" };
+  }
+  if (crit === 0 && high === 0) {
+    return { result: "pass", checkedAt: at, note: "No known critical/high vulnerabilities" };
+  }
+  return { result: "fail", checkedAt: at, note: `${crit} critical / ${high} high vuln(s)` };
+}
+function googleEvidence(now, search) {
+  const at = now.toISOString();
+  if (search.softFailed) {
+    return { result: "unknown", checkedAt: at, note: "Search Console unavailable this run" };
+  }
+  if (search.value === null) return null;
+  if (search.value.foundOnPage1) {
+    const pos2 = search.value.position;
+    return {
+      result: "pass",
+      checkedAt: at,
+      note: `Page 1 on Google${pos2 !== null ? ` (#${pos2})` : ""}`
+    };
+  }
+  const pos = search.value.position;
+  return {
+    result: "fail",
+    checkedAt: at,
+    note: `Not on page 1${pos !== null ? ` (avg #${pos})` : ""}`
+  };
+}
+function domainEvidence(site, now) {
+  if (!site.url || isNetlifyAppUrl(site.url)) return null;
+  if (!site.domainCheckedAt) return null;
+  const at = site.domainCheckedAt;
+  if (!isFresh(site.domainCheckedAt, now)) {
+    return { result: "unknown", checkedAt: at, note: "Domain check is stale (>3d)" };
+  }
+  const days = site.certDaysRemaining;
+  if (days === null) {
+    return { result: "fail", checkedAt: at, note: "Did not resolve, or no valid TLS cert" };
+  }
+  if (days <= CERT_MIN_DAYS) {
+    return { result: "fail", checkedAt: at, note: `TLS cert expires in ${days}d` };
+  }
+  return { result: "pass", checkedAt: at, note: `Custom domain, valid cert (${days}d left)` };
+}
+
 // src/reports/airtable/attachments.ts
 function looksLikeHtml(bytes) {
   const start = bytes[0] === 239 && bytes[1] === 187 && bytes[2] === 191 ? 3 : 0;
@@ -3538,7 +4065,7 @@ import { readFileSync as readFileSync3 } from "fs";
 import { JWT } from "google-auth-library";
 import { BetaAnalyticsDataClient } from "@google-analytics/data";
 var ANALYTICS_READONLY = "https://www.googleapis.com/auth/analytics.readonly";
-var MS_PER_DAY = 864e5;
+var MS_PER_DAY3 = 864e5;
 function ymd2(d) {
   return d.toISOString().slice(0, 10);
 }
@@ -3551,9 +4078,9 @@ async function fetchPeriodUsers(query, periodStart, periodEnd) {
     subject: query.subject
   });
   const client = new BetaAnalyticsDataClient({ authClient });
-  const lengthDays = Math.round((periodEnd.getTime() - periodStart.getTime()) / MS_PER_DAY);
-  const prevEnd = new Date(periodStart.getTime() - MS_PER_DAY);
-  const prevStart = new Date(prevEnd.getTime() - lengthDays * MS_PER_DAY);
+  const lengthDays = Math.round((periodEnd.getTime() - periodStart.getTime()) / MS_PER_DAY3);
+  const prevEnd = new Date(periodStart.getTime() - MS_PER_DAY3);
+  const prevStart = new Date(prevEnd.getTime() - lengthDays * MS_PER_DAY3);
   const property = `properties/${query.propertyId}`;
   const run = async (start, end) => {
     const [resp] = await client.runReport({
@@ -3677,7 +4204,7 @@ async function draftReportForSite(base, siteRow, reportType, options = {}) {
   const periodStart = base !== null ? await derivePeriodStart(base, siteRow, reportType, today) : daysAgo(today, 30);
   const periodEnd = today;
   const completedOn = today;
-  const lastTestedDate = reportType === "Maintenance" && siteRow.testingDay ? new Date(siteRow.testingDay) : null;
+  const lastTestedDate = reportType === "Maintenance" && siteRow.lastLighthouseAuditAt ? new Date(siteRow.lastLighthouseAuditAt) : null;
   const gaResult = base !== null ? await fetchGaUsers(siteRow, periodStart, periodEnd) : NO_ENRICHMENT;
   const searchResult = base !== null ? await fetchSearch(siteRow, periodStart, periodEnd) : NO_ENRICHMENT;
   const gaUsers = gaResult.value;
@@ -3724,6 +4251,9 @@ async function draftReportForSite(base, siteRow, reportType, options = {}) {
       supersededIds: outcome2.supersededIds
     };
   }
+  const evidence = autoTickChecklist(siteRow, reportType, completedOn, { search: searchResult });
+  const checklistTicks = [...evidence.entries()].filter(([, e]) => e.result === "pass").map(([field]) => field);
+  const autoEvidence = Object.fromEntries(evidence);
   const reportId = `${siteRow.name} \u2014 ${reportType} \u2014 ${periodEnd.toISOString().slice(0, 10)}`;
   const created = await createDraft(base, {
     reportId,
@@ -3737,7 +4267,9 @@ async function draftReportForSite(base, siteRow, reportType, options = {}) {
     lastTestedDate,
     ...gaUsers ? { gaUsersCurrent: gaUsers.current, gaUsersPrevious: gaUsers.previous } : {},
     ...search ? { searchFoundPage1: search.foundOnPage1 } : {},
-    ...search?.foundOnPage1 && search.position !== null ? { searchPosition: search.position } : {}
+    ...search?.foundOnPage1 && search.position !== null ? { searchPosition: search.position } : {},
+    checklistTicks,
+    autoEvidence
   });
   await uploadDraftHtml(created.id, slug, periodEnd, html);
   const outcome = await queueDraft(base, {
@@ -3807,6 +4339,36 @@ async function derivePeriodStart(base, siteRow, reportType, today) {
 
 // src/reports/airtable/client.ts
 import Airtable from "airtable";
+
+// src/reports/airtable/throttle.ts
+function createMinIntervalThrottle(opts) {
+  const { minIntervalMs, now, delay } = opts;
+  return function wrap(fn) {
+    let chain = Promise.resolve();
+    let last = Number.NEGATIVE_INFINITY;
+    return (...args) => {
+      chain = chain.then(async () => {
+        const wait = minIntervalMs - (now() - last);
+        if (wait > 0) await delay(wait);
+        last = now();
+        fn(...args);
+      }).catch(() => {
+      });
+    };
+  };
+}
+function applyThrottle(base, opts) {
+  const real = base._base?.runAction;
+  if (typeof real !== "function") return base;
+  const wrap = createMinIntervalThrottle(opts);
+  const throttled = wrap(real.bind(base._base));
+  base._base.runAction = throttled;
+  base.runAction = throttled;
+  return base;
+}
+
+// src/reports/airtable/client.ts
+var MIN_REQUEST_INTERVAL_MS = 220;
 function missing(name) {
   return Object.assign(
     new Error(
@@ -3823,7 +4385,12 @@ function readAirtableConfig() {
   return { apiKey, baseId };
 }
 function openBase(cfg) {
-  return new Airtable({ apiKey: cfg.apiKey }).base(cfg.baseId);
+  const base = new Airtable({ apiKey: cfg.apiKey }).base(cfg.baseId);
+  return applyThrottle(base, {
+    minIntervalMs: MIN_REQUEST_INTERVAL_MS,
+    now: () => Date.now(),
+    delay: (ms) => new Promise((resolve) => setTimeout(resolve, ms))
+  });
 }
 
 // src/reports/maintenance-email/header-image.ts
@@ -4026,35 +4593,33 @@ async function sendOne(client, base, site, report) {
   });
   const reportDate = report.completedOn ? new Date(report.completedOn) : /* @__PURE__ */ new Date();
   const subject = report.subjectOverride ?? `${site.name} \u2014 ${monthYear(reportDate)} ${report.reportType} Report`;
+  const attachments = [
+    toInlineAttachment({
+      bytes: header.bytes,
+      filename: `${cidName}.jpg`,
+      contentType: header.contentType,
+      cid: cidName
+    })
+  ];
+  for (const img of [bundled.check, bundled.blurred]) {
+    if (html.includes(`cid:${img.cid}`)) {
+      attachments.push(
+        toInlineAttachment({
+          bytes: img.bytes,
+          filename: img.filename,
+          contentType: img.contentType,
+          cid: img.cid
+        })
+      );
+    }
+  }
   const payload = {
     from: FROM_ADDRESS,
     to,
     replyTo: REPLY_TO,
     subject,
     html,
-    attachments: [
-      toInlineAttachment({
-        bytes: header.bytes,
-        filename: `${cidName}.jpg`,
-        contentType: header.contentType,
-        cid: cidName
-      }),
-      // Bundled images referenced via cid:rd-check-png / cid:rd-blurred-tests-jpg
-      // in the template. Attached inline so the email is self-contained — no
-      // external CDN dependency, no image-blocked broken icons in webmail.
-      toInlineAttachment({
-        bytes: bundled.check.bytes,
-        filename: bundled.check.filename,
-        contentType: bundled.check.contentType,
-        cid: bundled.check.cid
-      }),
-      toInlineAttachment({
-        bytes: bundled.blurred.bytes,
-        filename: bundled.blurred.filename,
-        contentType: bundled.blurred.contentType,
-        cid: bundled.blurred.cid
-      })
-    ],
+    attachments,
     // Stable across retries of the same row — if Airtable stamping fails after a
     // successful Resend, the next --send-ready replays with the same key and
     // Resend returns the original message id rather than sending a duplicate.
@@ -4244,6 +4809,28 @@ function securitySub(site) {
   const l = site.securityVulnsLow ?? 0;
   return `${c}C / ${h}H / ${m}M / ${l}L`;
 }
+function advisoryRow(a) {
+  const sev = escapeHtml(a.severity);
+  const module = escapeHtml(a.module);
+  const title = a.title ? ` \u2014 ${escapeHtml(a.title)}` : "";
+  const cves = a.cves.length > 0 ? ` <span class="muted">(${escapeHtml(a.cves.join(", "))})</span>` : "";
+  const link = a.url ? ` <a href="${escapeHtml(safeUrl(a.url))}" rel="noopener noreferrer">advisory \u25B8</a>` : "";
+  return `<li class="vuln-item">
+    <span class="pill sev-${sev}">${sev}</span>
+    <strong>${module}</strong>${title}${cves}${link}
+  </li>`;
+}
+function securitySection(site) {
+  const advisories = site.securityAdvisories;
+  if (!advisories || advisories.length === 0) return "";
+  const sorted = [...advisories].sort(
+    (a, b) => SEVERITY_RANK[a.severity] - SEVERITY_RANK[b.severity]
+  );
+  return `<div class="section vulns">
+    <h2>Vulnerabilities (${sorted.length})</h2>
+    <ul class="vuln-list">${sorted.map(advisoryRow).join("")}</ul>
+  </div>`;
+}
 function checklistBlock(r) {
   const items = checklistFor(r.reportType);
   if (items.length === 0) return "";
@@ -4251,7 +4838,9 @@ function checklistBlock(r) {
   const url = `/api/reports/${encodeURIComponent(r.id)}/checklist`;
   const boxes = items.map((item) => {
     const checked = r.checklist[item.field] === true ? " checked" : "";
-    return `<label class="check-item"><input type="checkbox" class="checklist-checkbox" data-checklist-report-id="${rid}" data-field="${escapeHtml(item.field)}" data-checklist-url="${escapeHtml(url)}"${checked} /> ${escapeHtml(item.label)}</label>`;
+    const ev = r.autoEvidence?.[item.field];
+    const badge = ev ? ev.result === "pass" ? ` <span class="auto-badge auto-pass" title="${escapeHtml(ev.note)}">auto \u2713</span>` : ` <span class="auto-badge auto-amber" title="${escapeHtml(ev.note)}">auto: ${escapeHtml(ev.note)}</span>` : "";
+    return `<label class="check-item"><input type="checkbox" class="checklist-checkbox" data-checklist-report-id="${rid}" data-field="${escapeHtml(item.field)}" data-checklist-url="${escapeHtml(url)}"${checked} /> ${escapeHtml(item.label)}${badge}</label>`;
   }).join("");
   return `<div class="checklist" data-checklist-for="${rid}">${boxes}</div>`;
 }
@@ -4296,30 +4885,79 @@ function reportRow(r) {
   const action = isPendingApproval(r) ? approveButton(r) : "";
   return `<tr><td>${date}</td><td>${type}</td><td><code>${id}</code></td><td>${ga}</td><td>${search}</td><td>${link}</td><td>${action}</td></tr>`;
 }
+function extraFieldsList(raw) {
+  if (!raw || raw.trim() === "") return "";
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return `<div class="subm-kv"><span class="k">Extra fields</span> <code>${escapeHtml(raw)}</code></div>`;
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return `<div class="subm-kv"><span class="k">Extra fields</span> <code>${escapeHtml(raw)}</code></div>`;
+  }
+  const rows = Object.entries(parsed).map(
+    ([k, v]) => `<div class="subm-kv"><span class="k">${escapeHtml(k)}</span> ${escapeHtml(String(v))}</div>`
+  ).join("");
+  return rows;
+}
 function submissionRow(s) {
   const when = s.submittedAt ? escapeHtml(relativeTimeFromNow(s.submittedAt)) : "\u2014";
   const type = escapeHtml(s.formType);
   const who = escapeHtml(s.name || "(no name)");
   const email = escapeHtml(s.email || "");
-  const message = escapeHtml(s.message ?? "");
   const status = escapeHtml(s.status);
   const id = escapeHtml(s.id);
   const url = `/api/submissions/${encodeURIComponent(s.id)}/status`;
   const btn = (label, action) => `<button class="subm-status" data-id="${id}" data-status="${action}" data-url="${url}">${label}</button>`;
+  const kv = (label, value) => value === null || value === "" ? "" : `<div class="subm-kv"><span class="k">${label}</span> ${escapeHtml(String(value))}</div>`;
+  const sourceLink = s.sourceUrl ? `<div class="subm-kv"><span class="k">Source</span> <a href="${escapeHtml(safeUrl(s.sourceUrl))}" rel="noopener noreferrer">${escapeHtml(s.sourceUrl)}</a></div>` : "";
+  const messageBlock = s.message ? `<div class="subm-kv"><span class="k">Message</span></div><div class="subm-msg">${escapeHtml(s.message)}</div>` : "";
+  const details = [
+    kv("Phone", s.phone),
+    messageBlock,
+    sourceLink,
+    kv("UTM", s.utm),
+    extraFieldsList(s.extraFields),
+    kv("Notify", s.notifyStatus),
+    kv("Resend ID", s.resendMessageId),
+    kv("Submission #", s.submissionId)
+  ].join("");
   return `<li class="subm-item">
-    <div class="subm-head"><strong>${type}</strong> \xB7 ${who} <span class="muted">${email}</span> <span class="pill subm-${status}">${status}</span> <span class="muted">${when}</span></div>
-    ${message ? `<div class="subm-msg">${message}</div>` : ""}
+    <details>
+      <summary class="subm-head"><strong>${type}</strong> \xB7 ${who} <span class="muted">${email}</span> <span class="pill subm-${status}">${status}</span> <span class="muted">${when}</span></summary>
+      <div class="subm-detail">${details}</div>
+    </details>
     <div class="subm-actions">${btn("Read", "read")}${btn("Archive", "archived")}${btn("Spam", "spam")}</div>
   </li>`;
 }
+var SUBMISSIONS_PER_SITE_CAP = 25;
 function submissionsSection(submissions) {
   if (submissions.length === 0) return "";
-  const recent = [...submissions].sort((a, b) => (b.submittedAt ?? "").localeCompare(a.submittedAt ?? "")).slice(0, 25);
+  const recent = [...submissions].sort((a, b) => (b.submittedAt ?? "").localeCompare(a.submittedAt ?? "")).slice(0, SUBMISSIONS_PER_SITE_CAP);
+  const note = submissions.length > recent.length ? `<span class="muted"> \u2014 showing ${recent.length} of ${submissions.length}</span>` : "";
   return `<div class="section submissions">
-    <h2>Form submissions (${submissions.length})</h2>
+    <h2>Form submissions (${submissions.length})${note}</h2>
     <ul class="subm-list">${recent.map(submissionRow).join("")}</ul>
   </div>`;
 }
+var SPAM_WINDOW_DAYS = 30;
+function spamScreenSection(totals, submissions, now) {
+  const sinceMs = now.getTime() - SPAM_WINDOW_DAYS * 24 * 60 * 60 * 1e3;
+  const delivered = submissions.filter(
+    (s) => s.submittedAt !== null && Date.parse(s.submittedAt) >= sinceMs
+  ).length;
+  const t = totals ?? { honeypot: 0, tooFast: 0, markedSpam: 0 };
+  if (delivered === 0 && t.honeypot === 0 && t.tooFast === 0 && t.markedSpam === 0) return "";
+  const row = (label, n) => `<div class="spam-kv"><span class="k">${label}</span> ${escapeHtml(String(n))}</div>`;
+  return `<div class="section spam-screen">
+    <h2>Spam screen (30d)</h2>
+    ${row("Caught \u2014 honeypot", t.honeypot)}
+    ${row("Caught \u2014 too-fast", t.tooFast)}
+    ${row("Delivered", delivered)}
+    ${row("Marked spam", t.markedSpam)}
+  </div>`;
+}
 function setupSection(site) {
   const { score, total } = onboardingStatus(site);
   const missing2 = missingOnboarding(site);
@@ -4378,19 +5016,35 @@ button.approve:disabled { opacity: 0.6; cursor: default; }
 .checklist { display: flex; flex-wrap: wrap; gap: 0.25rem 1.25rem; margin: 0.5rem 0 0.25rem 0.25rem; }
 .check-item { display: flex; align-items: center; gap: 0.4rem; font-size: 0.9rem; }
 .check-item input { margin: 0; }
+.auto-badge { font-size: 0.72rem; border-radius: 0.25rem; padding: 0 0.35rem; white-space: nowrap; }
+.auto-pass { background: #e6f4ea; color: #137333; }
+.auto-amber { background: #fef7e0; color: #b06000; }
 .pill { font-size: 0.75rem; padding: 0.1rem 0.5rem; border-radius: 999px; font-weight: 700; }
 .subm-list { list-style: none; padding: 0; margin: 0; }
 .subm-item { padding: 0.6rem 0; border-bottom: 1px solid #eee; }
 @media (prefers-color-scheme: dark) { .subm-item { border-color: #2a2a2a; } }
 .subm-head { display: flex; flex-wrap: wrap; gap: 0.5rem; align-items: center; }
 .subm-msg { margin: 0.35rem 0; white-space: pre-wrap; }
+.subm-detail { padding: 0.35rem 0 0.2rem; }
+.subm-kv { font-size: 0.9rem; margin: 0.15rem 0; }
+.subm-kv .k { color: #888; margin-right: 0.4rem; }
+summary.subm-head { cursor: pointer; }
 .subm-actions { display: flex; gap: 0.4rem; }
 button.subm-status { font: inherit; padding: 0.25rem 0.7rem; border: 1px solid #888; border-radius: 6px; background: transparent; color: inherit; cursor: pointer; }
 button.subm-status:disabled { opacity: 0.6; cursor: default; }
+.spam-screen .spam-kv { font-size: 0.95rem; margin: 0.2rem 0; }
+.spam-screen .spam-kv .k { color: #888; display: inline-block; min-width: 11rem; }
 .pill.subm-new { background: #e8f0fe; color: #1a56db; }
 .pill.subm-read { background: #f0f0f0; color: #555; }
 .pill.subm-archived { background: #eee; color: #888; }
 .pill.subm-spam { background: #fdecea; color: #b00; }
+.vuln-list { list-style: none; padding: 0; margin: 0; }
+.vuln-item { padding: 0.45rem 0; border-bottom: 1px solid #eee; display: flex; flex-wrap: wrap; gap: 0.5rem; align-items: baseline; }
+@media (prefers-color-scheme: dark) { .vuln-item { border-color: #2a2a2a; } }
+.pill.sev-critical { background: #fdecea; color: #b00; }
+.pill.sev-high { background: #fff0e6; color: #c4500a; }
+.pill.sev-moderate { background: #fff8e1; color: #8a6d00; }
+.pill.sev-low { background: #f0f0f0; color: #555; }
 .home { display: inline-block; font-size: 0.9rem; margin-bottom: 0.75rem; text-decoration: none; }
 .setup-line { font-size: 0.9rem; color: #666; margin-bottom: 1rem; }
 .setup-ok { color: #1b7a2f; font-weight: 600; }
@@ -4400,7 +5054,7 @@ button.subm-status:disabled { opacity: 0.6; cursor: default; }
 .detail dt { font-size: 0.75rem; text-transform: uppercase; letter-spacing: 0.04em; color: #999; }
 .detail dd { margin: 0; }
 `;
-function renderSiteDashboardHtml(site, reports, submissions = []) {
+function renderSiteDashboardHtml(site, reports, submissions = [], spamTotals = null, now = /* @__PURE__ */ new Date()) {
   const name = escapeHtml(site.name);
   const urlSafe = safeUrl(site.url);
   const allScoresNull = site.pScore === null && site.rScore === null && site.bpScore === null && site.seoScore === null;
@@ -4451,6 +5105,10 @@ function renderSiteDashboardHtml(site, reports, submissions = []) {
     ${healthSection}
   </div>
 
+  ${securitySection(site)}
+
+  ${spamScreenSection(spamTotals, submissions, now)}
+
   <div class="section">
     <h2>Reports</h2>
     ${reportsSection}
@@ -4610,6 +5268,8 @@ h1 { margin: 0 0 0.25rem; font-size: 1.75rem; }
 .summary { display:flex; flex-wrap:wrap; gap:0.5rem 1.25rem; align-items:baseline; margin-bottom:0.5rem; }
 .summary .tier { font-weight:700; }
 .summary .heads { color:#666; font-size:0.9rem; }
+.spam-rollup { font-size:0.9rem; margin-bottom:1rem; }
+.muted { color:#999; }
 .filters { display:flex; flex-wrap:wrap; gap:0.4rem; margin-bottom:1.25rem; }
 .filters button { font:inherit; font-size:0.85rem; padding:0.25rem 0.7rem; border:1px solid #ccc; border-radius:999px; background:transparent; color:inherit; cursor:pointer; }
 .filters button[aria-pressed="true"] { background:#1a1a1a; color:#fff; border-color:#1a1a1a; }
@@ -4671,6 +5331,11 @@ function summaryBar(model) {
     <div class="summary heads">${escapeHtml(heads)}</div>
     <div class="filters">${chips2}</div>`;
 }
+function spamRollup(model) {
+  const s = model.spam;
+  if (!s || s.caught === 0 && s.through === 0) return "";
+  return `<div class="spam-rollup muted">\u{1F6E1} Spam (30d) \u2014 caught ${s.caught} \xB7 through ${s.through}</div>`;
+}
 function allClearBanner(model) {
   if (model.summary.attention > 0) return "";
   const msg = model.cards.length === 0 ? "No sites on the fleet view yet." : "All clear \u2014 nothing needs your attention.";
@@ -4693,10 +5358,12 @@ function approveStrip(model) {
     ${rows}
   </section>`;
 }
+var SUBMISSIONS_STRIP_CAP = 10;
 function submissionsStrip(model) {
   const subs = model.submissions ?? [];
   if (subs.length === 0) return "";
-  const rows = subs.map((sub) => {
+  const shown = [...subs].sort((a, b) => (b.submittedAt ?? "").localeCompare(a.submittedAt ?? "")).slice(0, SUBMISSIONS_STRIP_CAP);
+  const rows = shown.map((sub) => {
     const href = `/s/${escapeHtml(sub.slug)}`;
     const when = sub.submittedAt ? escapeHtml(relativeTimeFromNow(sub.submittedAt)) : "";
     const who = escapeHtml(sub.name || sub.email);
@@ -4707,9 +5374,11 @@ function submissionsStrip(model) {
         <a href="${href}">open \u25B8</a>
       </div>`;
   }).join("");
+  const overflow = subs.length - shown.length;
+  const more = overflow > 0 ? `<div class="approve-row subm-more muted">+${overflow} more \u2014 triage on each site page</div>` : "";
   return `<section class="approve-strip subm-strip" data-tier="submissions">
     <h2>\u{1F4E5} New submissions (${subs.length})</h2>
-    ${rows}
+    ${rows}${more}
   </section>`;
 }
 function submBadge(c) {
@@ -4802,6 +5471,7 @@ function renderCockpitHtml(model) {
   <h1>Reddoor fleet cockpit</h1>
   <div class="meta">${total} site${total === 1 ? "" : "s"} on the Reddoor stack.</div>
   ${summaryBar(model)}
+  ${spamRollup(model)}
   ${allClearBanner(model)}
   ${approveStrip(model)}
   ${submissionsStrip(model)}