@reddoorla/maintenance 0.54.1 → 0.54.3

package/README.md

@@ -294,6 +294,8 @@ RESEND_API_KEY=re_XXXX
 RESEND_WEBHOOK_SECRET=whsec_XXXX  # only for the deployed webhook
 ```
 
+> The above is the **report CLI** env. The **deployed Netlify functions** (dashboard + form-ingest) additionally require `TURSO_DATABASE_URL` (+ optional `TURSO_AUTH_TOKEN`) — submissions live in libSQL/Turso, not Airtable. See [Site deployment](#site-deployment-netlify--resend) for the full env table.
+
 ### Operator flow
 
 0. **Prereq: refresh Lighthouse scores on each Websites row.** From each site's checkout:
@@ -334,25 +336,28 @@ RESEND_WEBHOOK_SECRET=whsec_XXXX  # only for the deployed webhook
 
    Renders + sends every Reports row with `Draft ready=true && Approved to send=true && Sent at IS NULL`. Stamps `Sent at` + `Delivery status=pending` on each.
 
-5. **Delivery status updates automatically** via the Resend webhook (Netlify Function at `netlify/functions/resend-webhook.mts`) — `Delivery status` flips to `delivered` / `bounced` / `complained` as events arrive. Deploy procedure: see [Webhook deployment](#webhook-deployment-netlify--resend) below.
+5. **Delivery status updates automatically** via the Resend webhook (Netlify Function at `netlify/functions/resend-webhook.mts`) — `Delivery status` flips to `delivered` / `bounced` / `complained` as events arrive. Deploy procedure: see [Site deployment](#site-deployment-netlify--resend) below.
 
-### Webhook deployment (Netlify + Resend)
+### Site deployment (Netlify + Resend)
 
-The Resend delivery webhook lives at `netlify/functions/resend-webhook.mts` in this repo. Deploying it is a one-time operation per environment: connect the repo to a Netlify site, set three env vars, register the deployed URL with Resend.
+This repo's Netlify site hosts the whole dashboard + forms surface: the Resend delivery webhook (`netlify/functions/resend-webhook.mts`), the cockpit/per-site dashboard, the `/submissions` page, and the form-ingest + submission-status endpoints. Deploying is a one-time operation per environment: connect the repo to a Netlify site, set its env vars, register the deployed URL with Resend.
 
 **1. Create the Netlify site:**
 
-- New site → Import from Git → pick `tucksravin/reddoor-maintenance`.
+- New site → Import from Git → pick `reddoorla/reddoor-maintenance`.
 - Branch to deploy: `main`. Build settings are read from [`netlify.toml`](netlify.toml) (no build command needed — functions-only).
 - Site name: pick something stable (e.g. `reddoor-webhooks`) since it ends up in the public webhook URL.
 
 **2. Set env vars** in Site settings → Environment variables:
 
-| Variable                | Value                                                                       |
-| ----------------------- | --------------------------------------------------------------------------- |
-| `AIRTABLE_PAT`          | Same PAT used by the CLI (read+write on the Websites + Reports tables)      |
-| `AIRTABLE_BASE_ID`      | `appHG8nLOzULzXOER`                                                         |
-| `RESEND_WEBHOOK_SECRET` | Generated by Resend in step 4 — paste back here after creating the endpoint |
+| Variable                | Value                                                                                                                  |
+| ----------------------- | ---------------------------------------------------------------------------------------------------------------------- |
+| `AIRTABLE_PAT`          | Same PAT used by the CLI (read+write on the Websites + Reports tables)                                                 |
+| `AIRTABLE_BASE_ID`      | `appHG8nLOzULzXOER`                                                                                                    |
+| `RESEND_WEBHOOK_SECRET` | Generated by Resend in step 4 — paste back here after creating the endpoint                                            |
+| `TURSO_DATABASE_URL`    | `libsql://<db>-<org>.turso.io` — submissions + spam counters live here; the dashboard + forms functions 500 without it |
+| `TURSO_AUTH_TOKEN`      | Auth token for that Turso url (required for a remote `libsql://` url)                                                  |
+| `FORMS_INGEST_TOKEN`    | Shared secret gating `POST /api/forms/:slug` — the SAME value is set on each fleet site                                |
 
 **3. Trigger a deploy** (Deploys → Trigger deploy → Deploy site). When it goes green, curl the health endpoint:
 

package/dist/cli/bin.js

@@ -361,7 +361,7 @@ function securityFields(counts) {
 }
 function domainFields(result) {
   const fields = { "Domain checked at": result.checkedAt };
-  if (result.certDaysRemaining !== null) fields["Cert days remaining"] = result.certDaysRemaining;
+  fields["Cert days remaining"] = result.certDaysRemaining;
   return fields;
 }
 function browserFields(r) {
@@ -2430,17 +2430,30 @@ function readDbConfig() {
   const authToken = process.env.TURSO_AUTH_TOKEN;
   return authToken ? { url, authToken } : { url };
 }
+function ensureMigrated(url, client) {
+  if (url === ":memory:") return runMigrations(client).then(() => void 0);
+  const cached = migrationsByUrl.get(url);
+  if (cached) return cached;
+  const p = runMigrations(client).then(() => void 0).catch((err) => {
+    migrationsByUrl.delete(url);
+    throw err;
+  });
+  migrationsByUrl.set(url, p);
+  return p;
+}
 async function openDb(cfg) {
   const clientConfig = cfg.authToken ? { url: cfg.url, authToken: cfg.authToken } : { url: cfg.url };
   const client = createClient(clientConfig);
-  await runMigrations(client);
+  await ensureMigrated(cfg.url, client);
   return new Kysely({ dialect: new LibsqlDialect({ client }) });
 }
+var migrationsByUrl;
 var init_client2 = __esm({
   "src/db/client.ts"() {
     "use strict";
     init_credentials();
     init_migrate();
+    migrationsByUrl = /* @__PURE__ */ new Map();
   }
 });
 
@@ -3608,11 +3621,15 @@ async function browserAudit(ctx) {
     await runner.close?.();
   }
 }
+var FETCH_TIMEOUT_MS = 1e4;
 function defaultDiscoverDeps() {
   return {
     fetchText: async (url) => {
       try {
-        const res = await fetch(url, { redirect: "follow" });
+        const res = await fetch(url, {
+          redirect: "follow",
+          signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+        });
         if (!res.ok) return null;
         return await res.text();
       } catch {
@@ -3713,9 +3730,17 @@ async function defaultBrowserRunner() {
       for (const url of urls) {
         let status;
         try {
-          let res = await fetch(url, { method: "HEAD", redirect: "follow" });
+          let res = await fetch(url, {
+            method: "HEAD",
+            redirect: "follow",
+            signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+          });
           if (res.status === 405 || res.status === 501) {
-            res = await fetch(url, { method: "GET", redirect: "follow" });
+            res = await fetch(url, {
+              method: "GET",
+              redirect: "follow",
+              signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+            });
           }
           status = res.status;
         } catch {
@@ -5101,7 +5126,12 @@ function makeGitHub(deps) {
       return r.stdout.split("\n").map((l) => l.trim()).filter((l) => l.length > 0);
     },
     async secretExists(repo, name) {
-      const out = await gh(["api", `repos/${repo}/actions/secrets`, "--jq", ".secrets[].name"]);
+      const out = await gh([
+        "api",
+        `repos/${repo}/actions/secrets?per_page=100`,
+        "--jq",
+        ".secrets[].name"
+      ]);
       return out.split("\n").map((l) => l.trim()).includes(name);
     },
     async autoMergeEnabled(repo) {
@@ -5111,7 +5141,7 @@ function makeGitHub(deps) {
     async findOpenSelfUpdatingPR(repo) {
       const out = await gh([
         "api",
-        `repos/${repo}/pulls?state=open`,
+        `repos/${repo}/pulls?state=open&per_page=100`,
         "--jq",
         '.[] | select(.head.ref | startswith("maint/self-updating-")) | .html_url'
       ]);
@@ -6980,7 +7010,7 @@ async function draftDueReports(base, today) {
       continue;
     }
     const pendingEarlier = reports.find(
-      (r) => r.siteId === item.site.id && r.reportType === item.reportType && r.sentAt === null && r.period !== null && r.period < period
+      (r) => r.siteId === item.site.id && r.reportType === item.reportType && r.draftReady && r.sentAt === null && r.period !== null && r.period < period
     );
     if (pendingEarlier) {
       skipped++;