@reddoorla/maintenance 0.54.4 → 0.55.0

package/dist/cli/bin.js

@@ -174,6 +174,7 @@ __export(websites_exports, {
   parseSecurityAdvisories: () => parseSecurityAdvisories,
   siteSlug: () => siteSlug,
   updateA11yCounts: () => updateA11yCounts,
+  updateAnalyticsHealth: () => updateAnalyticsHealth,
   updateAuditFields: () => updateAuditFields,
   updateDepsCounts: () => updateDepsCounts,
   updateGitHubSignals: () => updateGitHubSignals,
@@ -234,6 +235,7 @@ function mapRow(rec) {
     ga4PropertyId: f["GA4 property ID"] ?? null,
     searchQuery: f["Search query"] ?? null,
     searchConsoleProperty: f["Search Console property"] ?? null,
+    analyticsSoftFailAt: f["Analytics soft-fail at"] ?? null,
     gitRepo: f["Git repo"] ?? null,
     reportRecipientsTo: f["Report recipients (To)"] ?? null,
     reportRecipientsCc: f["Report recipients (CC)"] ?? null,
@@ -376,6 +378,10 @@ function browserFields(r) {
 async function updateScores(base, recordId, scores) {
   await base(WEBSITES_TABLE).update([{ id: recordId, fields: scoreFields(scores) }]);
 }
+async function updateAnalyticsHealth(base, recordId, at) {
+  const fields = { "Analytics soft-fail at": at };
+  await base(WEBSITES_TABLE).update([{ id: recordId, fields }]);
+}
 async function updateA11yCounts(base, recordId, counts) {
   await base(WEBSITES_TABLE).update([{ id: recordId, fields: a11yFields(counts) }]);
 }
@@ -1629,6 +1635,10 @@ var init_attachments = __esm({
 });
 
 // src/reports/send/resend.ts
+var resend_exports = {};
+__export(resend_exports, {
+  defaultResendClient: () => defaultResendClient
+});
 import { Resend } from "resend";
 function defaultResendClient() {
   const key = process.env.RESEND_API_KEY;
@@ -1777,7 +1787,26 @@ function collectCiAlerts(sites, baseUrl, now = /* @__PURE__ */ new Date()) {
   }
   return items;
 }
-var GITHUB_SIGNALS_STALE_DAYS, MS_PER_DAY4, LIGHTHOUSE_FLOOR, LIGHTHOUSE_CATEGORIES2;
+function collectAnalyticsFailures(sites, baseUrl, now = /* @__PURE__ */ new Date()) {
+  const items = [];
+  for (const s of sites) {
+    const at = s.analyticsSoftFailAt;
+    if (at === null) continue;
+    const ageMs = now.getTime() - Date.parse(at);
+    if (Number.isFinite(ageMs) && ageMs > ANALYTICS_SOFT_FAIL_STALE_DAYS * MS_PER_DAY4) continue;
+    items.push({
+      key: `analytics:${s.id}`,
+      kind: "analytics",
+      siteName: s.name,
+      title: "GA/Search enrichment failing (analytics blank)",
+      url: dashboardUrl(baseUrl, s.name),
+      severity: "warning",
+      metric: 1
+    });
+  }
+  return items;
+}
+var GITHUB_SIGNALS_STALE_DAYS, MS_PER_DAY4, LIGHTHOUSE_FLOOR, LIGHTHOUSE_CATEGORIES2, ANALYTICS_SOFT_FAIL_STALE_DAYS;
 var init_digest_collectors = __esm({
   "src/alerts/digest-collectors.ts"() {
     "use strict";
@@ -1791,6 +1820,7 @@ var init_digest_collectors = __esm({
       { field: "bpScore", slug: "best-practices", label: "Best Practices" },
       { field: "seoScore", slug: "seo", label: "SEO" }
     ];
+    ANALYTICS_SOFT_FAIL_STALE_DAYS = 45;
   }
 });
 
@@ -1946,7 +1976,8 @@ async function collectAttention(deps) {
     ...runCollector("delivery", () => collectDeliveryFailures(reports, sitesById, deps.baseUrl)),
     ...runCollector("lighthouse", () => collectLighthouseAlerts(websites, deps.baseUrl)),
     ...runCollector("renovate", () => collectRenovateAlerts(websites, deps.baseUrl, now)),
-    ...runCollector("ci", () => collectCiAlerts(websites, deps.baseUrl, now))
+    ...runCollector("ci", () => collectCiAlerts(websites, deps.baseUrl, now)),
+    ...runCollector("analytics", () => collectAnalyticsFailures(websites, deps.baseUrl, now))
   ];
 }
 async function runDigest(options) {
@@ -6817,6 +6848,17 @@ async function draftReportForSite(base, siteRow, reportType, options = {}) {
     return { reportRow: null, htmlPath: path, html, softFailures, queued: null, supersededIds: [] };
   }
   if (base === null) throw new Error("base required when previewOnly=false");
+  if (readGaConfig() !== null && Boolean(siteRow.ga4PropertyId || siteRow.searchQuery)) {
+    try {
+      await updateAnalyticsHealth(
+        base,
+        siteRow.id,
+        softFailures.length > 0 ? today.toISOString() : null
+      );
+    } catch (e) {
+      console.warn(`\u26A0 analytics-health write skipped for ${siteRow.name}: ${e.message}`);
+    }
+  }
   if (options.completeRowId) {
     await uploadDraftHtml(options.completeRowId, slug, periodEnd, html);
     const outcome2 = await queueDraft(base, {
@@ -6919,6 +6961,25 @@ async function derivePeriodStart(base, siteRow, reportType, today) {
   return start;
 }
 
+// src/alerts/analytics-health.ts
+init_html();
+var MIN_FAILED_SITES = 2;
+function assessAnalyticsAlert(h) {
+  const { softFailedSites, configuredSites } = h;
+  const fire = configuredSites >= 2 && softFailedSites >= MIN_FAILED_SITES && softFailedSites * 2 >= configuredSites;
+  const reason = fire ? `${softFailedSites} of ${configuredSites} analytics-configured sites had GA/Search enrichment fail this run \u2014 the shared GA_SUBJECT likely lost access (an offboarded user, revoked property access, or a botched role-account cutover). Reports were drafted with BLANK analytics.` : "";
+  return { fire, reason };
+}
+function composeAnalyticsAlertEmail(h, dashboardUrl2) {
+  const subject = `\u26A0 Fleet analytics enrichment failing \u2014 ${h.softFailedSites}/${h.configuredSites} sites`;
+  const { reason } = assessAnalyticsAlert(h);
+  const html = `<p><strong>${escapeHtml(reason)}</strong></p>
+<p>This usually means the Google Workspace user the service account impersonates can no longer read the GA4 / Search Console properties. Reports still send \u2014 but with blank analytics \u2014 until the subject is restored.</p>
+<p>Next step: follow the GA/Search subject runbook (<code>docs/runbooks/ga-search-role-account-cutover.md</code>) to restore or move the subject, then re-run <code>reddoor-maint report --due</code> and confirm the warning clears.</p>
+<p><a href="${escapeHtml(dashboardUrl2)}">Open the fleet dashboard \u2192</a></p>`;
+  return { subject, html };
+}
+
 // src/cli/commands/report.ts
 function draftLine(reportId, queued, supersededIds, verb = "drafted") {
   const id = reportId ?? "(unknown)";
@@ -6969,15 +7030,44 @@ async function runReportCommand(slug, opts) {
 }
 async function runDueDraft() {
   const base = openBase(readAirtableConfig());
-  return draftDueReports(base, /* @__PURE__ */ new Date());
+  const result = await draftDueReports(base, /* @__PURE__ */ new Date());
+  await alertOnFleetAnalyticsFailure(result.health);
+  return { output: result.output, code: result.code };
+}
+async function alertOnFleetAnalyticsFailure(health) {
+  if (!assessAnalyticsAlert(health).fire) return;
+  try {
+    const to = process.env.OPERATOR_EMAIL?.trim() || "info@reddoorla.com";
+    const { subject, html } = composeAnalyticsAlertEmail(health, dashboardBaseUrl());
+    const { defaultResendClient: defaultResendClient2 } = await Promise.resolve().then(() => (init_resend(), resend_exports));
+    await defaultResendClient2().send({
+      from: "Reddoor Reports <reports@reddoorla.com>",
+      to: [to],
+      subject,
+      html,
+      idempotencyKey: `analytics-alert-${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}`
+    });
+    console.warn(`\u26A0 ${subject} \u2014 operator alerted (${to})`);
+  } catch (e) {
+    console.warn(`\u26A0 analytics-failure alert send failed: ${e.message}`);
+  }
 }
 async function draftDueReports(base, today) {
   const websites = await listWebsites(base);
   const reports = await listAllReports(base);
   const due = findDueReports(websites, reports, today);
-  if (due.length === 0) return { output: "No reports due.", code: 0 };
+  const gaConfigured = readGaConfig() !== null;
+  const isAnalyticsConfigured = (s) => gaConfigured && Boolean(s.ga4PropertyId || s.searchQuery);
+  if (due.length === 0) {
+    return {
+      output: "No reports due.",
+      code: 0,
+      health: { softFailedSites: 0, configuredSites: 0 }
+    };
+  }
   const lines = [];
   let softFailedSites = 0;
+  let gaConfiguredSites = 0;
   let skipped = 0;
   for (const item of due) {
     const period = reportPeriodKey(item.dueDate);
@@ -7015,6 +7105,7 @@ async function draftDueReports(base, today) {
             "completed half-made draft"
           )
         );
+        if (isAnalyticsConfigured(item.site)) gaConfiguredSites++;
         if (result.softFailures.length > 0) softFailedSites++;
       } catch (e) {
         lines.push(`\u2717 failed: ${item.site.name} ${item.reportType} \u2014 ${e.message}`);
@@ -7035,6 +7126,7 @@ async function draftDueReports(base, today) {
       const result = await draftReportForSite(base, item.site, item.reportType, { period });
       lines.push(draftLine(result.reportRow?.reportId, result.queued, result.supersededIds));
       if (result.reportRow) reports.push(result.reportRow);
+      if (isAnalyticsConfigured(item.site)) gaConfiguredSites++;
       if (result.softFailures.length > 0) softFailedSites++;
     } catch (e) {
       lines.push(`\u2717 failed: ${item.site.name} ${item.reportType} \u2014 ${e.message}`);
@@ -7048,7 +7140,11 @@ async function draftDueReports(base, today) {
       `\u26A0 ${softFailedSites} site${softFailedSites === 1 ? "" : "s"} had GA/Search enrichment fail \u2014 drafted with blank analytics; check the logs above`
     );
   }
-  return { output: lines.join("\n"), code: lines.some((l) => l.startsWith("\u2717")) ? 1 : 0 };
+  return {
+    output: lines.join("\n"),
+    code: lines.some((l) => l.startsWith("\u2717")) ? 1 : 0,
+    health: { softFailedSites, configuredSites: gaConfiguredSites }
+  };
 }
 async function runSingleSiteDraft(slug, opts) {
   const base = openBase(readAirtableConfig());