@reddoorla/maintenance 0.60.1 → 0.62.0

package/dist/client-GTMJTXBK.js

@@ -0,0 +1,11 @@
+import {
+  openDb,
+  readDbConfig
+} from "./chunk-6ZKM7OIJ.js";
+import "./chunk-XKKTK6WA.js";
+import "./chunk-6VAL7XJT.js";
+export {
+  openDb,
+  readDbConfig
+};
+//# sourceMappingURL=client-GTMJTXBK.js.map

package/dist/{convert-to-pnpm-KNCXU6FM.js → convert-to-pnpm-JG3767ZQ.js}

@@ -5,7 +5,7 @@ import {
 } from "./chunk-4NAOR44V.js";
 import {
   resolveSites
-} from "./chunk-6CSCLBAA.js";
+} from "./chunk-SAOCVNX7.js";
 import {
   convertToPnpm
 } from "./chunk-2X322ZES.js";
@@ -48,4 +48,4 @@ async function runConvertToPnpmCommand(site, opts) {
 export {
   runConvertToPnpmCommand
 };
-//# sourceMappingURL=convert-to-pnpm-KNCXU6FM.js.map
+//# sourceMappingURL=convert-to-pnpm-JG3767ZQ.js.map

package/dist/{db-AXKMRTVA.js → db-Y6BVTNH7.js}

@@ -1,9 +1,9 @@
 // src/cli/commands/db.ts
 async function runDbCommand(action, opts) {
   if (action === "migrate") {
-    const { readDbConfig } = await import("./client-JA6QLEDW.js");
+    const { readDbConfig } = await import("./client-GTMJTXBK.js");
     const cfg = opts.url ? { url: opts.url } : readDbConfig();
-    const { runMigrations } = await import("./migrate-P2LS4WXI.js");
+    const { runMigrations } = await import("./migrate-BFOG2OCP.js");
     const { createClient } = await import("@libsql/client");
     const client = createClient(cfg.url === ":memory:" ? { url: ":memory:" } : cfg);
     const ran = await runMigrations(client);
@@ -20,4 +20,4 @@ async function runDbCommand(action, opts) {
 export {
   runDbCommand
 };
-//# sourceMappingURL=db-AXKMRTVA.js.map
+//# sourceMappingURL=db-Y6BVTNH7.js.map

package/dist/{digest-RVIOHUXR.js → digest-ABJROO4H.js}

@@ -1,3 +1,14 @@
+import {
+  collectAnalyticsFailures,
+  collectCiAlerts,
+  collectDeliveryFailures,
+  collectLighthouseAlerts,
+  collectRenovateAlerts,
+  collectVulnAlerts,
+  diffAttention,
+  readDigestState,
+  writeDigestState
+} from "./chunk-BMDBOPN3.js";
 import {
   isIdempotencyConflict
 } from "./chunk-OGGRFBL4.js";
@@ -9,7 +20,7 @@ import {
 import {
   listWebsites,
   siteSlug
-} from "./chunk-L4ULXHIN.js";
+} from "./chunk-BLD6AYJO.js";
 import {
   openBase,
   readAirtableConfig
@@ -19,201 +30,6 @@ import {
 } from "./chunk-WEKL2HYJ.js";
 import "./chunk-6VAL7XJT.js";
 
-// src/alerts/digest-collectors.ts
-function dashboardUrl(baseUrl, siteName) {
-  return `${baseUrl.replace(/\/$/, "")}/s/${siteSlug(siteName)}`;
-}
-var GITHUB_SIGNALS_STALE_DAYS = 3;
-var MS_PER_DAY = 24 * 60 * 60 * 1e3;
-function gitHubSignalsStale(swept, now) {
-  if (swept === null) return true;
-  const ageMs = now.getTime() - Date.parse(swept);
-  if (!Number.isFinite(ageMs)) return true;
-  return ageMs > GITHUB_SIGNALS_STALE_DAYS * MS_PER_DAY;
-}
-var AUTO_FIX_EXHAUSTED_CYCLES = 3;
-function collectVulnAlerts(sites, baseUrl) {
-  const items = [];
-  for (const s of sites) {
-    const critical = s.securityVulnsCritical ?? 0;
-    const high = s.securityVulnsHigh ?? 0;
-    const metric = critical + high;
-    if (metric <= 0) continue;
-    const attempts = s.securityAutoFixAttempts ?? 0;
-    const exhausted = attempts >= AUTO_FIX_EXHAUSTED_CYCLES;
-    const noun = metric === 1 ? "vuln" : "vulns";
-    items.push({
-      key: `vuln:${s.id}`,
-      kind: "vuln",
-      siteName: s.name,
-      title: exhausted ? `${metric} critical/high ${noun} \u2014 auto-fix failed (${attempts}\xD7)` : `${metric} critical/high ${noun}`,
-      url: dashboardUrl(baseUrl, s.name),
-      severity: exhausted || critical > 0 ? "critical" : "warning",
-      metric,
-      ...exhausted ? { autoFixExhausted: true } : {}
-    });
-  }
-  return items;
-}
-var LIGHTHOUSE_FLOOR = 75;
-var LIGHTHOUSE_CATEGORIES = [
-  { field: "pScore", slug: "performance", label: "Performance" },
-  { field: "rScore", slug: "accessibility", label: "Accessibility" },
-  { field: "bpScore", slug: "best-practices", label: "Best Practices" },
-  { field: "seoScore", slug: "seo", label: "SEO" }
-];
-function collectLighthouseAlerts(sites, baseUrl) {
-  const items = [];
-  for (const s of sites) {
-    for (const cat of LIGHTHOUSE_CATEGORIES) {
-      const score = s[cat.field];
-      if (score === null || score >= LIGHTHOUSE_FLOOR) continue;
-      items.push({
-        key: `lighthouse:${s.id}:${cat.slug}`,
-        kind: "lighthouse",
-        siteName: s.name,
-        title: `Lighthouse ${cat.label} ${score} (below ${LIGHTHOUSE_FLOOR})`,
-        url: dashboardUrl(baseUrl, s.name),
-        severity: "warning",
-        metric: 100 - score
-      });
-    }
-  }
-  return items;
-}
-function collectDeliveryFailures(reports, sitesById, baseUrl) {
-  const items = [];
-  for (const r of reports) {
-    if (r.deliveryStatus !== "bounced" && r.deliveryStatus !== "complained") continue;
-    const site = sitesById.get(r.siteId);
-    if (!site) continue;
-    const complained = r.deliveryStatus === "complained";
-    items.push({
-      key: `delivery:${r.id}`,
-      kind: "delivery",
-      siteName: site.name,
-      title: complained ? "Spam complaint on a sent report" : "A sent report bounced",
-      url: dashboardUrl(baseUrl, site.name),
-      severity: complained ? "critical" : "warning",
-      metric: 1
-    });
-  }
-  return items;
-}
-function collectRenovateAlerts(sites, baseUrl, now = /* @__PURE__ */ new Date()) {
-  const items = [];
-  for (const s of sites) {
-    if (gitHubSignalsStale(s.githubSignalsAt, now)) continue;
-    const n = s.renovateFailingCis ?? 0;
-    if (n <= 0) continue;
-    items.push({
-      key: `renovate:${s.id}`,
-      kind: "renovate",
-      siteName: s.name,
-      title: `${n} Renovate ${n === 1 ? "PR" : "PRs"} failing CI`,
-      url: dashboardUrl(baseUrl, s.name),
-      severity: "warning",
-      metric: n
-    });
-  }
-  return items;
-}
-function collectCiAlerts(sites, baseUrl, now = /* @__PURE__ */ new Date()) {
-  const items = [];
-  for (const s of sites) {
-    if (gitHubSignalsStale(s.githubSignalsAt, now)) continue;
-    if (s.defaultBranchCi !== "failing") continue;
-    items.push({
-      key: `ci:${s.id}`,
-      kind: "ci",
-      siteName: s.name,
-      title: "Default-branch CI failing",
-      url: dashboardUrl(baseUrl, s.name),
-      severity: "warning",
-      metric: 1
-    });
-  }
-  return items;
-}
-var ANALYTICS_SOFT_FAIL_STALE_DAYS = 45;
-function collectAnalyticsFailures(sites, baseUrl, now = /* @__PURE__ */ new Date()) {
-  const items = [];
-  for (const s of sites) {
-    const at = s.analyticsSoftFailAt;
-    if (at === null) continue;
-    const ageMs = now.getTime() - Date.parse(at);
-    if (Number.isFinite(ageMs) && ageMs > ANALYTICS_SOFT_FAIL_STALE_DAYS * MS_PER_DAY) continue;
-    items.push({
-      key: `analytics:${s.id}`,
-      kind: "analytics",
-      siteName: s.name,
-      title: "GA/Search enrichment failing (analytics blank)",
-      url: dashboardUrl(baseUrl, s.name),
-      severity: "warning",
-      metric: 1
-    });
-  }
-  return items;
-}
-
-// src/alerts/digest-state.ts
-function diffAttention(items, prior, today) {
-  const tagged = [];
-  const next = {};
-  for (const it of items) {
-    const was = prior[it.key];
-    let status;
-    let firstFlaggedAt;
-    if (!was) {
-      status = "new";
-      firstFlaggedAt = today;
-    } else if (it.metric > was.metric) {
-      status = "worse";
-      firstFlaggedAt = was.firstFlaggedAt;
-    } else {
-      status = "standing";
-      firstFlaggedAt = was.firstFlaggedAt;
-    }
-    tagged.push({ ...it, status });
-    next[it.key] = { metric: it.metric, firstFlaggedAt };
-  }
-  return { tagged, next };
-}
-var DIGEST_STATE_TABLE = "Digest State";
-async function readDigestState(base) {
-  const rows = [];
-  await base(DIGEST_STATE_TABLE).select({ maxRecords: 1, pageSize: 1 }).eachPage((records, fetchNextPage) => {
-    for (const rec of records) rows.push({ id: rec.id, fields: rec.fields });
-    fetchNextPage();
-  });
-  const first = rows[0];
-  if (!first) return {};
-  const raw = first.fields["Snapshot"];
-  if (typeof raw !== "string") return {};
-  try {
-    return JSON.parse(raw);
-  } catch {
-    return {};
-  }
-}
-async function writeDigestState(base, snap, updatedAt = (/* @__PURE__ */ new Date()).toISOString()) {
-  const rows = [];
-  await base(DIGEST_STATE_TABLE).select({ maxRecords: 1, pageSize: 1 }).eachPage((records, fetchNextPage) => {
-    for (const rec of records) rows.push({ id: rec.id });
-    fetchNextPage();
-  });
-  const fields = {
-    Snapshot: JSON.stringify(snap),
-    "Updated At": updatedAt
-  };
-  const existing = rows[0];
-  if (existing) {
-    await base(DIGEST_STATE_TABLE).update([{ id: existing.id, fields }]);
-  } else {
-    await base(DIGEST_STATE_TABLE).create([{ fields }]);
-  }
-}
-
 // src/reports/digest.ts
 var GREY = "#757575";
 var RED = "#C00";
@@ -410,4 +226,4 @@ export {
   renderDigestHtml,
   runDigest
 };
-//# sourceMappingURL=digest-RVIOHUXR.js.map
+//# sourceMappingURL=digest-ABJROO4H.js.map

package/dist/digest-ABJROO4H.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/reports/digest.ts"],"sourcesContent":["// src/reports/digest.ts\nimport { openBase, readAirtableConfig, type AirtableBase } from \"./airtable/client.js\";\nimport { listAllReports, isPendingApproval } from \"./airtable/reports.js\";\nimport type { ReportRow } from \"./airtable/reports.js\";\nimport { listWebsites, siteSlug, type WebsiteRow } from \"./airtable/websites.js\";\nimport { defaultResendClient, type ResendClient } from \"./send/resend.js\";\nimport { isIdempotencyConflict } from \"./send/idempotency.js\";\nimport {\n  collectVulnAlerts,\n  collectDeliveryFailures,\n  collectLighthouseAlerts,\n  collectRenovateAlerts,\n  collectCiAlerts,\n  collectAnalyticsFailures,\n} from \"../alerts/digest-collectors.js\";\nimport { diffAttention, readDigestState, writeDigestState } from \"../alerts/digest-state.js\";\nimport { escapeHtml as esc } from \"../util/html.js\";\nimport type {\n  AttentionItem,\n  AttentionSeverity,\n  AttentionStatus,\n  ReadyItem,\n  DigestSections,\n} from \"../alerts/attention.js\";\n\n// The attention/digest contract lives in `../alerts/attention.ts` (a dependency-free\n// types module) so the `alerts/*` collectors can depend on it without importing back\n// from this renderer/IO module — see attention.ts for the cycle it breaks. Re-exported\n// here so existing `from \"./digest.js\"` type importers keep resolving.\nexport type {\n  AttentionItem,\n  AttentionSeverity,\n  AttentionStatus,\n  ReadyItem,\n  DigestSections,\n} from \"../alerts/attention.js\";\n\nconst GREY = \"#757575\";\nconst RED = \"#C00\";\n\n/** Shared anchor style — Gmail does not inherit font-family into <a> tags. */\nconst ANCHOR_STYLE = `color:${RED};font-family:helvetica,sans-serif`;\n\nfunction readySection(items: ReadyItem[]): string {\n  const heading = `<h2 style=\"color:${RED};font-family:helvetica,sans-serif;font-size:20px;font-weight:700;margin:32px 0 8px\">Ready for your yes</h2>`;\n  if (items.length === 0) {\n    return `${heading}<p style=\"color:${GREY};font-family:helvetica,sans-serif;font-size:16px;margin:0\">Nothing waiting on you.</p>`;\n  }\n  const rows = items\n    .map((it) => {\n      const safeUrl = it.dashboardUrl.startsWith(\"https://\") ? it.dashboardUrl : undefined;\n      const link = safeUrl\n        ? `<a href=\"${esc(safeUrl)}\" style=\"${ANCHOR_STYLE}\">review &amp; approve</a>`\n        : `review &amp; approve`;\n      return `\n      <tr>\n        <td style=\"color:${GREY};font-family:helvetica,sans-serif;font-size:16px;line-height:24px;padding-bottom:8px\">\n          <strong style=\"color:#222\">${esc(it.siteName)}</strong> — ${esc(it.reportType)} (${esc(it.period)})\n          — ${link}\n        </td>\n      </tr>`;\n    })\n    .join(\"\");\n  return `${heading}<table role=\"presentation\" style=\"border-collapse:collapse;margin:0\">${rows}</table>`;\n}\n\nconst SEVERITY_ORDER: Record<AttentionSeverity, number> = { critical: 0, warning: 1 };\n\n/** Render the per-item status badge (\"NEW\"/\"WORSE\"); standing items get nothing. */\nfunction attentionBadge(status?: AttentionStatus): string {\n  if (status === \"new\")\n    return `<strong style=\"color:${RED};font-family:helvetica,sans-serif\">NEW</strong> `;\n  if (status === \"worse\")\n    return `<strong style=\"color:${RED};font-family:helvetica,sans-serif\">WORSE</strong> `;\n  return \"\";\n}\n\nfunction attentionSection(items: AttentionItem[]): string {\n  const heading = `<h2 style=\"color:${RED};font-family:helvetica,sans-serif;font-size:20px;font-weight:700;margin:32px 0 8px\">Needs attention</h2>`;\n  if (items.length === 0) {\n    return `${heading}<p style=\"color:${GREY};font-family:helvetica,sans-serif;font-size:16px;margin:0\">All clear — nothing needs attention.</p>`;\n  }\n\n  // Group by siteName, preserving first-seen site order; sort within a site by\n  // severity (critical first).\n  const bySite = new Map<string, AttentionItem[]>();\n  for (const it of items) {\n    const bucket = bySite.get(it.siteName);\n    if (bucket) bucket.push(it);\n    else bySite.set(it.siteName, [it]);\n  }\n\n  const groups = [...bySite.entries()]\n    .map(([siteName, siteItems]) => {\n      const sorted = [...siteItems].sort(\n        (a, b) => SEVERITY_ORDER[a.severity] - SEVERITY_ORDER[b.severity],\n      );\n      const rows = sorted\n        .map((it) => {\n          const safeUrl = it.url?.startsWith(\"https://\") ? it.url : undefined;\n          const titleHtml = safeUrl\n            ? `<a href=\"${esc(safeUrl)}\" style=\"${ANCHOR_STYLE}\">${esc(it.title)}</a>`\n            : esc(it.title);\n          return `\n          <tr>\n            <td style=\"color:${GREY};font-family:helvetica,sans-serif;font-size:16px;line-height:24px;padding-bottom:8px\">${attentionBadge(it.status)}${titleHtml}</td>\n          </tr>`;\n        })\n        .join(\"\");\n      return `\n      <tr>\n        <td style=\"color:#222;font-family:helvetica,sans-serif;font-size:16px;font-weight:700;padding:8px 0 4px\">${esc(siteName)}</td>\n      </tr>\n      ${rows}`;\n    })\n    .join(\"\");\n\n  return `${heading}<table role=\"presentation\" style=\"border-collapse:collapse;margin:0\">${groups}</table>`;\n}\n\nconst FROM_ADDRESS = \"Reddoor Reports <reports@reddoorla.com>\";\n/** Single-operator fleet — fallback when OPERATOR_EMAIL is unset. */\nconst DIGEST_OPERATOR_FALLBACK = \"info@reddoorla.com\";\n\n/** UTC \"YYYY-MM-DD\" — the Resend idempotency key suffix, so a same-day cron re-fire dedupes. */\nfunction digestDateKey(d: Date): string {\n  return d.toISOString().slice(0, 10);\n}\n\n/**\n * The gate for \"Ready for your yes\": Draft ready ∧ ¬Approved to send ∧ Sent at BLANK.\n *\n * Implemented as `listAllReports(base).filter(...)` (the authorized deviation from the plan's\n * draft, which pre-dated Slice 1's merged fix): `listAllReports` already calls `mapRow`, which\n * handles `Period` correctly, so no local `rawToReportRow` duplicate is needed. The JS filter\n * does real work — the test fake does NOT evaluate `filterByFormula` — so correctness is\n * test-provable here.\n *\n * Exported: the fleet homepage (Task 3.5b) reuses it for the pending-approval count.\n */\nexport async function listPendingApproval(base: AirtableBase): Promise<ReportRow[]> {\n  return (await listAllReports(base)).filter(isPendingApproval);\n}\n\n// ── collectAttention (IO wrapper, sibling to runDigest) ──────────────────────\n\nexport type CollectAttentionDeps = {\n  base: AirtableBase;\n  /** Same baseUrl value runDigest threads; used for the /s/<slug> links. */\n  baseUrl: string;\n  /** Pre-fetched Websites rows. When supplied (runDigest already read them),\n   *  collectAttention reuses them instead of issuing a second `listWebsites`. */\n  websites?: WebsiteRow[];\n  /** Pre-fetched Reports rows. When supplied (runDigest already read them),\n   *  collectAttention reuses them instead of issuing a second `listAllReports`. */\n  reports?: ReportRow[];\n  /** Clock for the GitHub-signals staleness gate (collectCiAlerts /\n   *  collectRenovateAlerts skip a >3-day-stale sweep). Defaults to wall-clock;\n   *  runDigest threads its run-start `today` so a quiet repo's frozen CI/Renovate\n   *  signal stops badging once its sweep goes stale. */\n  now?: Date;\n};\n\n/** Run a single collector under a try/catch: a thrown collector logs and yields []\n *  so one broken signal never blanks the whole \"Needs attention\" section. */\nfunction runCollector(label: string, fn: () => AttentionItem[]): AttentionItem[] {\n  try {\n    return fn();\n  } catch (e) {\n    console.warn(`⚠ attention collector \"${label}\" failed: ${(e as Error).message}`);\n    return [];\n  }\n}\n\n/**\n * Fetch the free signals once (listAllReports + listWebsites) — or reuse the\n * `reports`/`websites` arrays runDigest already read, so a single run reads each\n * table once — build the sitesById map the delivery collector needs, and run each\n * pure collector isolated. Returns the union of items; diffing/badging happens in\n * runDigest.\n *\n * The Renovate + CI signals come from the SAME persisted collectors the operator\n * cockpit (`buildCockpitModel`) runs — `collectRenovateAlerts` (key\n * `renovate:<siteId>`) and `collectCiAlerts` (key `ci:<siteId>`), reading the\n * nightly-persisted `renovateFailingCis`/`defaultBranchCi` fields. This is the\n * key-space unification: because the digest writes the shared Digest State\n * snapshot with these same keys, the cockpit's NEW/WORSE diff finds them and the\n * two surfaces agree (the prior live per-PR `renovate:<repo>#<n>` sweep never\n * matched the cockpit's keys, so its cards badged NEW forever).\n */\nexport async function collectAttention(deps: CollectAttentionDeps): Promise<AttentionItem[]> {\n  const reports = deps.reports ?? (await listAllReports(deps.base));\n  const websites = deps.websites ?? (await listWebsites(deps.base));\n  const now = deps.now ?? new Date();\n  const sitesById = new Map<string, WebsiteRow>(websites.map((w) => [w.id, w]));\n  return [\n    ...runCollector(\"vuln\", () => collectVulnAlerts(websites, deps.baseUrl)),\n    ...runCollector(\"delivery\", () => collectDeliveryFailures(reports, sitesById, deps.baseUrl)),\n    ...runCollector(\"lighthouse\", () => collectLighthouseAlerts(websites, deps.baseUrl)),\n    ...runCollector(\"renovate\", () => collectRenovateAlerts(websites, deps.baseUrl, now)),\n    ...runCollector(\"ci\", () => collectCiAlerts(websites, deps.baseUrl, now)),\n    ...runCollector(\"analytics\", () => collectAnalyticsFailures(websites, deps.baseUrl, now)),\n  ];\n}\n\nexport type DigestRunOptions = {\n  resend?: ResendClient;\n  /** Dashboard origin for the /s/<slug> links, e.g. \"https://reddoor-maintenance.netlify.app\". */\n  baseUrl: string;\n  /**\n   * Inject a pre-opened Airtable base (tests, server handlers).\n   * When omitted, `openBase(readAirtableConfig())` is called from the environment.\n   */\n  base?: AirtableBase;\n};\n\nexport async function runDigest(\n  options: DigestRunOptions,\n): Promise<{ output: string; code: number }> {\n  // Capture clock BEFORE any await so the idempotency key can't roll past midnight mid-run.\n  const today = new Date();\n  try {\n    const base = options.base ?? openBase(readAirtableConfig());\n    // Read each table ONCE for the whole run, then thread the arrays into\n    // collectAttention so it doesn't re-fetch (was: listWebsites ×2, listAllReports\n    // ×2). Pending is derived in-line with listPendingApproval's exact predicate.\n    const reports = await listAllReports(base);\n    const websites = await listWebsites(base);\n    const sites = new Map(websites.map((w) => [w.id, w]));\n\n    const pending = reports.filter(isPendingApproval);\n\n    const readyForYourYes: ReadyItem[] = [];\n    const baseUrl = options.baseUrl.replace(/\\/$/, \"\");\n    for (const r of pending) {\n      const site = sites.get(r.siteId);\n      if (!site) continue; // orphan report → skip rather than render a broken link\n      // An empty Name slugs to \"\" → `/s/` is a dead link (getWebsiteBySlug can't\n      // match it). Fall back to the fleet homepage so the operator still lands\n      // somewhere usable instead of a 404.\n      const slug = siteSlug(site.name);\n      readyForYourYes.push({\n        siteName: site.name,\n        reportType: r.reportType,\n        period: r.period ?? \"—\",\n        dashboardUrl: slug ? `${baseUrl}/s/${slug}` : baseUrl,\n      });\n    }\n\n    // M5: collect the free signals (isolated), diff against yesterday's snapshot.\n    // Renovate + CI come from the persisted collectors (the same ones the cockpit\n    // runs), so the snapshot this digest writes carries the `renovate:<siteId>` /\n    // `ci:<siteId>` keys the cockpit diffs against — no live GitHub sweep here.\n    const collected = await collectAttention({\n      base,\n      baseUrl: options.baseUrl,\n      websites,\n      reports,\n      now: today,\n    });\n    const prior = await readDigestState(base);\n    const { tagged, next } = diffAttention(collected, prior, digestDateKey(today));\n    const needsAttention = tagged;\n\n    // No-noise default: skip entirely when there's nothing to report.\n    if (readyForYourYes.length === 0 && needsAttention.length === 0) {\n      // On a skip, `collected` is [] so `next` is {} — still persist it so a key that\n      // resolved on a quiet day clears and a later recurrence diffs as NEW (spec §10).\n      // Wrapped: a write failure can't fail the skip.\n      try {\n        await writeDigestState(base, next);\n      } catch (e) {\n        console.warn(`⚠ digest state write failed: ${(e as Error).message}`);\n      }\n      return { output: \"Digest skipped (nothing ready, nothing needs attention).\", code: 0 };\n    }\n\n    const html = renderDigestHtml({ readyForYourYes, needsAttention });\n    const client = options.resend ?? defaultResendClient();\n    const to = [process.env.OPERATOR_EMAIL?.trim() || DIGEST_OPERATOR_FALLBACK];\n    const n = readyForYourYes.length;\n    const reportWord = n === 1 ? \"report\" : \"reports\";\n    let result: Awaited<ReturnType<typeof client.send>>;\n    try {\n      result = await client.send({\n        from: FROM_ADDRESS,\n        to,\n        subject: `Your fleet — ${digestDateKey(today)}: ${n} ${reportWord} ready for your yes`,\n        html,\n        idempotencyKey: `digest-${digestDateKey(today)}`,\n      });\n    } catch (err) {\n      // A same-UTC-day re-run whose content changed re-sends with the same\n      // `digest-<date>` idempotency key but a DIFFERENT body. Resend rejects that\n      // with a 409 (`invalid_idempotent_request`) — \"This idempotency key has been\n      // used ... but the request body was modified ...\". The operator already got\n      // today's digest on the first send, so re-sending a changed version same-day\n      // would just be a duplicate: treat it as an \"already sent today\" no-op.\n      //\n      // ResendClient (send/resend.ts) wraps the API error as a plain Error and only\n      // preserves the *message* string (no name/statusCode), so the message\n      // substring is the only reliable discriminator — match defensively on it.\n      // Any OTHER send error re-throws to the outer catch → {code:1}, so a genuine\n      // Resend/network failure still fails loudly.\n      if (isIdempotencyConflict(err)) {\n        // Do NOT write the snapshot: the first send already persisted it; writing\n        // this run's `next` would diff against the first run's snapshot and mis-badge.\n        return {\n          output:\n            \"Digest already sent today (content changed since the first send) — skipped to avoid a duplicate.\",\n          code: 0,\n        };\n      }\n      throw err;\n    }\n    // Persist the next snapshot AFTER a successful send. A write failure is caught +\n    // logged: the digest already went out, tomorrow re-news at worst. (The send-FAILURE\n    // path never reaches here — the outer catch returns code 1 with no write, preserving\n    // the NEW badge for the retry.)\n    try {\n      await writeDigestState(base, next);\n    } catch (e) {\n      console.warn(`⚠ digest state write failed: ${(e as Error).message}`);\n    }\n    return { output: `Digest sent to ${to.join(\", \")} (${result.messageId})`, code: 0 };\n  } catch (err) {\n    // Re-throw config errors (exitCode=2: missing env vars, bad config) so runOrExit\n    // surfaces them with the correct process exit code rather than collapsing to 1.\n    if (typeof (err as { exitCode?: unknown }).exitCode === \"number\") {\n      throw err;\n    }\n    const message = err instanceof Error ? err.message : String(err);\n    return { output: `digest failed: ${message}`, code: 1 };\n  }\n}\n\n/** Pure render of the unified daily operator digest. No IO — the caller (runDigest)\n *  collects the rows and decides whether to send. */\nexport function renderDigestHtml(sections: DigestSections): string {\n  return `<!doctype html>\n<html>\n  <head><meta charset=\"utf-8\"></head>\n  <body style=\"margin:0;padding:0;background:#ffffff\">\n    <table width=\"100%\" style=\"border-collapse:collapse\">\n      <tr>\n        <td align=\"center\" style=\"padding:24px\">\n          <table width=\"600\" style=\"border-collapse:collapse\">\n            <tr>\n              <td>\n                <h1 style=\"color:${RED};font-family:helvetica,sans-serif;font-size:24px;font-weight:700;margin:0 0 8px\">Your fleet today</h1>\n                ${readySection(sections.readyForYourYes)}\n                ${attentionSection(sections.needsAttention)}\n              </td>\n            </tr>\n          </table>\n        </td>\n      </tr>\n    </table>\n  </body>\n</html>`;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCA,IAAM,OAAO;AACb,IAAM,MAAM;AAGZ,IAAM,eAAe,SAAS,GAAG;AAEjC,SAAS,aAAa,OAA4B;AAChD,QAAM,UAAU,oBAAoB,GAAG;AACvC,MAAI,MAAM,WAAW,GAAG;AACtB,WAAO,GAAG,OAAO,mBAAmB,IAAI;AAAA,EAC1C;AACA,QAAM,OAAO,MACV,IAAI,CAAC,OAAO;AACX,UAAM,UAAU,GAAG,aAAa,WAAW,UAAU,IAAI,GAAG,eAAe;AAC3E,UAAM,OAAO,UACT,YAAY,WAAI,OAAO,CAAC,YAAY,YAAY,+BAChD;AACJ,WAAO;AAAA;AAAA,2BAEc,IAAI;AAAA,uCACQ,WAAI,GAAG,QAAQ,CAAC,oBAAe,WAAI,GAAG,UAAU,CAAC,KAAK,WAAI,GAAG,MAAM,CAAC;AAAA,mBAC7F,IAAI;AAAA;AAAA;AAAA,EAGd,CAAC,EACA,KAAK,EAAE;AACV,SAAO,GAAG,OAAO,wEAAwE,IAAI;AAC/F;AAEA,IAAM,iBAAoD,EAAE,UAAU,GAAG,SAAS,EAAE;AAGpF,SAAS,eAAe,QAAkC;AACxD,MAAI,WAAW;AACb,WAAO,wBAAwB,GAAG;AACpC,MAAI,WAAW;AACb,WAAO,wBAAwB,GAAG;AACpC,SAAO;AACT;AAEA,SAAS,iBAAiB,OAAgC;AACxD,QAAM,UAAU,oBAAoB,GAAG;AACvC,MAAI,MAAM,WAAW,GAAG;AACtB,WAAO,GAAG,OAAO,mBAAmB,IAAI;AAAA,EAC1C;AAIA,QAAM,SAAS,oBAAI,IAA6B;AAChD,aAAW,MAAM,OAAO;AACtB,UAAM,SAAS,OAAO,IAAI,GAAG,QAAQ;AACrC,QAAI,OAAQ,QAAO,KAAK,EAAE;AAAA,QACrB,QAAO,IAAI,GAAG,UAAU,CAAC,EAAE,CAAC;AAAA,EACnC;AAEA,QAAM,SAAS,CAAC,GAAG,OAAO,QAAQ,CAAC,EAChC,IAAI,CAAC,CAAC,UAAU,SAAS,MAAM;AAC9B,UAAM,SAAS,CAAC,GAAG,SAAS,EAAE;AAAA,MAC5B,CAAC,GAAG,MAAM,eAAe,EAAE,QAAQ,IAAI,eAAe,EAAE,QAAQ;AAAA,IAClE;AACA,UAAM,OAAO,OACV,IAAI,CAAC,OAAO;AACX,YAAM,UAAU,GAAG,KAAK,WAAW,UAAU,IAAI,GAAG,MAAM;AAC1D,YAAM,YAAY,UACd,YAAY,WAAI,OAAO,CAAC,YAAY,YAAY,KAAK,WAAI,GAAG,KAAK,CAAC,SAClE,WAAI,GAAG,KAAK;AAChB,aAAO;AAAA;AAAA,+BAEc,IAAI,yFAAyF,eAAe,GAAG,MAAM,CAAC,GAAG,SAAS;AAAA;AAAA,IAEzJ,CAAC,EACA,KAAK,EAAE;AACV,WAAO;AAAA;AAAA,mHAEsG,WAAI,QAAQ,CAAC;AAAA;AAAA,QAExH,IAAI;AAAA,EACR,CAAC,EACA,KAAK,EAAE;AAEV,SAAO,GAAG,OAAO,wEAAwE,MAAM;AACjG;AAEA,IAAM,eAAe;AAErB,IAAM,2BAA2B;AAGjC,SAAS,cAAc,GAAiB;AACtC,SAAO,EAAE,YAAY,EAAE,MAAM,GAAG,EAAE;AACpC;AAaA,eAAsB,oBAAoB,MAA0C;AAClF,UAAQ,MAAM,eAAe,IAAI,GAAG,OAAO,iBAAiB;AAC9D;AAuBA,SAAS,aAAa,OAAe,IAA4C;AAC/E,MAAI;AACF,WAAO,GAAG;AAAA,EACZ,SAAS,GAAG;AACV,YAAQ,KAAK,+BAA0B,KAAK,aAAc,EAAY,OAAO,EAAE;AAC/E,WAAO,CAAC;AAAA,EACV;AACF;AAkBA,eAAsB,iBAAiB,MAAsD;AAC3F,QAAM,UAAU,KAAK,WAAY,MAAM,eAAe,KAAK,IAAI;AAC/D,QAAM,WAAW,KAAK,YAAa,MAAM,aAAa,KAAK,IAAI;AAC/D,QAAM,MAAM,KAAK,OAAO,oBAAI,KAAK;AACjC,QAAM,YAAY,IAAI,IAAwB,SAAS,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AAC5E,SAAO;AAAA,IACL,GAAG,aAAa,QAAQ,MAAM,kBAAkB,UAAU,KAAK,OAAO,CAAC;AAAA,IACvE,GAAG,aAAa,YAAY,MAAM,wBAAwB,SAAS,WAAW,KAAK,OAAO,CAAC;AAAA,IAC3F,GAAG,aAAa,cAAc,MAAM,wBAAwB,UAAU,KAAK,OAAO,CAAC;AAAA,IACnF,GAAG,aAAa,YAAY,MAAM,sBAAsB,UAAU,KAAK,SAAS,GAAG,CAAC;AAAA,IACpF,GAAG,aAAa,MAAM,MAAM,gBAAgB,UAAU,KAAK,SAAS,GAAG,CAAC;AAAA,IACxE,GAAG,aAAa,aAAa,MAAM,yBAAyB,UAAU,KAAK,SAAS,GAAG,CAAC;AAAA,EAC1F;AACF;AAaA,eAAsB,UACpB,SAC2C;AAE3C,QAAM,QAAQ,oBAAI,KAAK;AACvB,MAAI;AACF,UAAM,OAAO,QAAQ,QAAQ,SAAS,mBAAmB,CAAC;AAI1D,UAAM,UAAU,MAAM,eAAe,IAAI;AACzC,UAAM,WAAW,MAAM,aAAa,IAAI;AACxC,UAAM,QAAQ,IAAI,IAAI,SAAS,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AAEpD,UAAM,UAAU,QAAQ,OAAO,iBAAiB;AAEhD,UAAM,kBAA+B,CAAC;AACtC,UAAM,UAAU,QAAQ,QAAQ,QAAQ,OAAO,EAAE;AACjD,eAAW,KAAK,SAAS;AACvB,YAAM,OAAO,MAAM,IAAI,EAAE,MAAM;AAC/B,UAAI,CAAC,KAAM;AAIX,YAAM,OAAO,SAAS,KAAK,IAAI;AAC/B,sBAAgB,KAAK;AAAA,QACnB,UAAU,KAAK;AAAA,QACf,YAAY,EAAE;AAAA,QACd,QAAQ,EAAE,UAAU;AAAA,QACpB,cAAc,OAAO,GAAG,OAAO,MAAM,IAAI,KAAK;AAAA,MAChD,CAAC;AAAA,IACH;AAMA,UAAM,YAAY,MAAM,iBAAiB;AAAA,MACvC;AAAA,MACA,SAAS,QAAQ;AAAA,MACjB;AAAA,MACA;AAAA,MACA,KAAK;AAAA,IACP,CAAC;AACD,UAAM,QAAQ,MAAM,gBAAgB,IAAI;AACxC,UAAM,EAAE,QAAQ,KAAK,IAAI,cAAc,WAAW,OAAO,cAAc,KAAK,CAAC;AAC7E,UAAM,iBAAiB;AAGvB,QAAI,gBAAgB,WAAW,KAAK,eAAe,WAAW,GAAG;AAI/D,UAAI;AACF,cAAM,iBAAiB,MAAM,IAAI;AAAA,MACnC,SAAS,GAAG;AACV,gBAAQ,KAAK,qCAAiC,EAAY,OAAO,EAAE;AAAA,MACrE;AACA,aAAO,EAAE,QAAQ,4DAA4D,MAAM,EAAE;AAAA,IACvF;AAEA,UAAM,OAAO,iBAAiB,EAAE,iBAAiB,eAAe,CAAC;AACjE,UAAM,SAAS,QAAQ,UAAU,oBAAoB;AACrD,UAAM,KAAK,CAAC,QAAQ,IAAI,gBAAgB,KAAK,KAAK,wBAAwB;AAC1E,UAAM,IAAI,gBAAgB;AAC1B,UAAM,aAAa,MAAM,IAAI,WAAW;AACxC,QAAI;AACJ,QAAI;AACF,eAAS,MAAM,OAAO,KAAK;AAAA,QACzB,MAAM;AAAA,QACN;AAAA,QACA,SAAS,qBAAgB,cAAc,KAAK,CAAC,KAAK,CAAC,IAAI,UAAU;AAAA,QACjE;AAAA,QACA,gBAAgB,UAAU,cAAc,KAAK,CAAC;AAAA,MAChD,CAAC;AAAA,IACH,SAAS,KAAK;AAaZ,UAAI,sBAAsB,GAAG,GAAG;AAG9B,eAAO;AAAA,UACL,QACE;AAAA,UACF,MAAM;AAAA,QACR;AAAA,MACF;AACA,YAAM;AAAA,IACR;AAKA,QAAI;AACF,YAAM,iBAAiB,MAAM,IAAI;AAAA,IACnC,SAAS,GAAG;AACV,cAAQ,KAAK,qCAAiC,EAAY,OAAO,EAAE;AAAA,IACrE;AACA,WAAO,EAAE,QAAQ,kBAAkB,GAAG,KAAK,IAAI,CAAC,KAAK,OAAO,SAAS,KAAK,MAAM,EAAE;AAAA,EACpF,SAAS,KAAK;AAGZ,QAAI,OAAQ,IAA+B,aAAa,UAAU;AAChE,YAAM;AAAA,IACR;AACA,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,WAAO,EAAE,QAAQ,kBAAkB,OAAO,IAAI,MAAM,EAAE;AAAA,EACxD;AACF;AAIO,SAAS,iBAAiB,UAAkC;AACjE,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mCAU0B,GAAG;AAAA,kBACpB,aAAa,SAAS,eAAe,CAAC;AAAA,kBACtC,iBAAiB,SAAS,cAAc,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAS3D;","names":[]}

package/dist/{github-signals-UL2BBS3Q.js → github-signals-XTJLKOXJ.js}

@@ -3,17 +3,26 @@ import {
 } from "./chunk-PZQ3WED2.js";
 import {
   formatFleetWriteSummary
-} from "./chunk-LMXIZITU.js";
-import "./chunk-HPSGCDWY.js";
+} from "./chunk-4REUHZAW.js";
+import "./chunk-YYUY2OVP.js";
 import {
   makeGitHub
-} from "./chunk-XB6T4ETK.js";
+} from "./chunk-OSRFDGQM.js";
+import {
+  detectSignalEvents,
+  fleetSweptEvent
+} from "./chunk-5L3FPQIJ.js";
+import {
+  recordFleetEventsBestEffort
+} from "./chunk-L5F664ZA.js";
+import "./chunk-6ZKM7OIJ.js";
+import "./chunk-XKKTK6WA.js";
 import "./chunk-HVOOCK6L.js";
 import {
   listWebsites,
   siteSlug,
   updateGitHubSignals
-} from "./chunk-L4ULXHIN.js";
+} from "./chunk-BLD6AYJO.js";
 import {
   openBase,
   readAirtableConfig
@@ -82,6 +91,9 @@ async function runGitHubSignalsCommand(opts) {
   const sweptAt = (/* @__PURE__ */ new Date()).toISOString();
   const result = { written: [], failed: [] };
   const byRepo = new Map(websites.filter((w) => w.gitRepo).map((w) => [w.gitRepo, w]));
+  const events = [];
+  const sweptMs = Date.parse(sweptAt);
+  const since24h = new Date(sweptMs - 24 * 60 * 60 * 1e3).toISOString();
   for (const row of rows) {
     const target = byRepo.get(row.repo);
     if (!target) {
@@ -99,11 +111,20 @@ async function runGitHubSignalsCommand(opts) {
         siteName: target.name,
         writes: [{ audit: "github-signals", counts: row }]
       });
+      const since = target.githubSignalsAt ?? since24h;
+      let merged = [];
+      try {
+        merged = await gh.mergedRenovatePullRequests(row.repo, since);
+      } catch {
+      }
+      events.push(...detectSignalEvents(target, row, merged, sweptAt));
     } catch (e) {
       result.failed.push({ slug: siteSlug(row.site), error: e.message });
     }
   }
   for (const repo of skipped) result.failed.push({ slug: repo, error: "probe failed (skipped)" });
+  events.push(fleetSweptEvent("github-signals", result.written.length, sweptAt));
+  await recordFleetEventsBestEffort(events, /* @__PURE__ */ new Date());
   return {
     output: formatFleetWriteSummary(result),
     code: githubSignalsExitCode(result.written.length, result.failed.length)
@@ -113,4 +134,4 @@ export {
   githubSignalsExitCode,
   runGitHubSignalsCommand
 };
-//# sourceMappingURL=github-signals-UL2BBS3Q.js.map
+//# sourceMappingURL=github-signals-XTJLKOXJ.js.map

package/dist/github-signals-XTJLKOXJ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/audits/github-signals.ts","../src/cli/commands/github-signals.ts"],"sourcesContent":["import type { Site } from \"../types.js\";\nimport type { CiState, PullRequestSummary } from \"../github/gh.js\";\nimport { isFailingRenovatePR } from \"../alerts/renovate.js\";\n\n/** One swept row, ready for the Airtable writer (slug-keyed by `site`). */\nexport type GitHubSignalsRow = {\n  site: string; // the site name/slug the writer matches on\n  repo: string; // owner/repo\n  renovateFailingCis: number;\n  ciState: CiState;\n  lastCommitAt: string | null;\n};\n\n/** Injected GitHub reads (so the sweep is pure + testable). */\nexport type GitHubSignalsDeps = {\n  openPullRequests: (repo: string) => Promise<PullRequestSummary[]>;\n  defaultBranchStatus: (repo: string) => Promise<{ ciState: CiState; lastCommitAt: string | null }>;\n};\n\n/** Per repo-backed site: count its failing Renovate PRs + read its default-branch\n *  status. Sites without `gitRepo` are skipped (not errors). A repo whose probe\n *  throws is reported via `onSkip` and produces no row — one GitHub hiccup never\n *  sinks the sweep. PURE over `deps`. */\nexport async function collectGitHubSignals(\n  sites: Site[],\n  deps: GitHubSignalsDeps,\n  onSkip: (s: { repo: string }) => void = () => {},\n): Promise<GitHubSignalsRow[]> {\n  const rows: GitHubSignalsRow[] = [];\n  for (const s of sites) {\n    const repo = s.gitRepo;\n    if (!repo) continue;\n    const name = s.name;\n    if (!name) continue;\n    try {\n      const prs = await deps.openPullRequests(repo);\n      const status = await deps.defaultBranchStatus(repo);\n      rows.push({\n        site: name,\n        repo,\n        renovateFailingCis: prs.filter(isFailingRenovatePR).length,\n        ciState: status.ciState,\n        lastCommitAt: status.lastCommitAt,\n      });\n    } catch {\n      onSkip({ repo });\n    }\n  }\n  return rows;\n}\n","import { openBase, readAirtableConfig } from \"../../reports/airtable/client.js\";\nimport { listWebsites, siteSlug, updateGitHubSignals } from \"../../reports/airtable/websites.js\";\nimport type { Site } from \"../../types.js\";\nimport { collectGitHubSignals } from \"../../audits/github-signals.js\";\nimport { makeGitHub } from \"../../github/gh.js\";\nimport {\n  formatFleetWriteSummary,\n  type FleetWriteResult,\n} from \"../../audits/write-audits-to-airtable.js\";\nimport { detectSignalEvents, fleetSweptEvent } from \"../../audits/fleet-event-detectors.js\";\nimport { recordFleetEventsBestEffort } from \"../../audits/fleet-events-writer.js\";\nimport type { FleetEvent } from \"../../db/fleet-events.js\";\n\n/** Exit code for a fleet github-signals run. Exit 1 when failures are the\n *  MAJORITY of the fleet (`failed > written`), not only on a total wipeout —\n *  a run where 11/12 repos failed but 1 wrote should still signal an outage.\n *  All-success or a minority of flakes (e.g. 1/12 failed) stays exit 0. The\n *  no-token clean-skip returns 0 separately (before any probe runs). */\nexport function githubSignalsExitCode(written: number, failed: number): number {\n  return failed > written ? 1 : 0;\n}\n\n/** `github-signals --fleet --write-airtable`: sweep every repo-backed site for its\n *  Renovate-failing count + default-branch CI state + last-commit date, write each\n *  row serially (Airtable ~5 req/sec), and emit FLEET_WRITE_SUMMARY for CI. A\n *  missing fleet token is a clean skip (local runs), not a failure. */\nexport async function runGitHubSignalsCommand(opts: {\n  fleet?: boolean | undefined;\n  writeAirtable?: boolean | undefined;\n}): Promise<{ output: string; code: number }> {\n  if (!opts.fleet || !opts.writeAirtable) {\n    return { output: \"github-signals currently supports only --fleet --write-airtable\", code: 2 };\n  }\n  const token = process.env.RENOVATE_TOKEN?.trim() || process.env.GH_TOKEN?.trim();\n  if (!token) {\n    return {\n      output: \"github-signals skipped: no RENOVATE_TOKEN/GH_TOKEN (fleet read) configured.\",\n      code: 0,\n    };\n  }\n  const base = openBase(readAirtableConfig());\n  const websites = await listWebsites(base);\n  const gh = makeGitHub({ token });\n  const sites: Site[] = websites.map((w) => ({\n    path: \"\",\n    name: w.name,\n    meta: {},\n    ...(w.gitRepo ? { gitRepo: w.gitRepo } : {}),\n  }));\n\n  const skipped: string[] = [];\n  const rows = await collectGitHubSignals(\n    sites,\n    {\n      openPullRequests: (r) => gh.openPullRequests(r),\n      defaultBranchStatus: (r) => gh.defaultBranchStatus(r),\n    },\n    ({ repo }) => skipped.push(repo),\n  );\n\n  const sweptAt = new Date().toISOString();\n  const result: FleetWriteResult = { written: [], failed: [] };\n  const byRepo = new Map(websites.filter((w) => w.gitRepo).map((w) => [w.gitRepo, w]));\n  const events: FleetEvent[] = [];\n  const sweptMs = Date.parse(sweptAt);\n  const since24h = new Date(sweptMs - 24 * 60 * 60 * 1000).toISOString();\n  // Serial: Airtable's ~5 req/sec limit (matches writeFleetAuditsToAirtable).\n  for (const row of rows) {\n    const target = byRepo.get(row.repo);\n    if (!target) {\n      result.failed.push({ slug: siteSlug(row.site), error: \"no Websites row matched\" });\n      continue;\n    }\n    try {\n      await updateGitHubSignals(base, target.id, {\n        renovateFailingCis: row.renovateFailingCis,\n        ciState: row.ciState,\n        lastCommitAt: row.lastCommitAt,\n        sweptAt,\n      });\n      result.written.push({\n        siteName: target.name,\n        writes: [{ audit: \"github-signals\", counts: row }],\n      });\n      // Fleet-activity events for this repo: merged Renovate PRs since the last sweep\n      // (watermark = the row's prior GitHub Signals At, else a 24h fallback) + a\n      // CI-recovered transition. A PR-fetch hiccup drops only this repo's PR events.\n      const since = target.githubSignalsAt ?? since24h;\n      let merged: Awaited<ReturnType<typeof gh.mergedRenovatePullRequests>> = [];\n      try {\n        merged = await gh.mergedRenovatePullRequests(row.repo, since);\n      } catch {\n        // PR list unavailable this run — skip pr_automerged for this repo, keep ci_recovered\n      }\n      events.push(...detectSignalEvents(target, row, merged, sweptAt));\n    } catch (e) {\n      result.failed.push({ slug: siteSlug(row.site), error: (e as Error).message });\n    }\n  }\n  for (const repo of skipped) result.failed.push({ slug: repo, error: \"probe failed (skipped)\" });\n\n  events.push(fleetSweptEvent(\"github-signals\", result.written.length, sweptAt));\n  await recordFleetEventsBestEffort(events, new Date());\n\n  // Exit non-zero when failures are the MAJORITY of the fleet, not only on a\n  // total wipeout. A run where 11/12 repos failed but 1 wrote used to return 0,\n  // masking a large outage. The nightly cron step is `continue-on-error`, so a\n  // non-zero here is an operator-visibility signal, not a red build.\n  return {\n    output: formatFleetWriteSummary(result),\n    code: githubSignalsExitCode(result.written.length, result.failed.length),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuBA,eAAsB,qBACpB,OACA,MACA,SAAwC,MAAM;AAAC,GAClB;AAC7B,QAAM,OAA2B,CAAC;AAClC,aAAW,KAAK,OAAO;AACrB,UAAM,OAAO,EAAE;AACf,QAAI,CAAC,KAAM;AACX,UAAM,OAAO,EAAE;AACf,QAAI,CAAC,KAAM;AACX,QAAI;AACF,YAAM,MAAM,MAAM,KAAK,iBAAiB,IAAI;AAC5C,YAAM,SAAS,MAAM,KAAK,oBAAoB,IAAI;AAClD,WAAK,KAAK;AAAA,QACR,MAAM;AAAA,QACN;AAAA,QACA,oBAAoB,IAAI,OAAO,mBAAmB,EAAE;AAAA,QACpD,SAAS,OAAO;AAAA,QAChB,cAAc,OAAO;AAAA,MACvB,CAAC;AAAA,IACH,QAAQ;AACN,aAAO,EAAE,KAAK,CAAC;AAAA,IACjB;AAAA,EACF;AACA,SAAO;AACT;;;AC/BO,SAAS,sBAAsB,SAAiB,QAAwB;AAC7E,SAAO,SAAS,UAAU,IAAI;AAChC;AAMA,eAAsB,wBAAwB,MAGA;AAC5C,MAAI,CAAC,KAAK,SAAS,CAAC,KAAK,eAAe;AACtC,WAAO,EAAE,QAAQ,mEAAmE,MAAM,EAAE;AAAA,EAC9F;AACA,QAAM,QAAQ,QAAQ,IAAI,gBAAgB,KAAK,KAAK,QAAQ,IAAI,UAAU,KAAK;AAC/E,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,MAAM;AAAA,IACR;AAAA,EACF;AACA,QAAM,OAAO,SAAS,mBAAmB,CAAC;AAC1C,QAAM,WAAW,MAAM,aAAa,IAAI;AACxC,QAAM,KAAK,WAAW,EAAE,MAAM,CAAC;AAC/B,QAAM,QAAgB,SAAS,IAAI,CAAC,OAAO;AAAA,IACzC,MAAM;AAAA,IACN,MAAM,EAAE;AAAA,IACR,MAAM,CAAC;AAAA,IACP,GAAI,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5C,EAAE;AAEF,QAAM,UAAoB,CAAC;AAC3B,QAAM,OAAO,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,MACE,kBAAkB,CAAC,MAAM,GAAG,iBAAiB,CAAC;AAAA,MAC9C,qBAAqB,CAAC,MAAM,GAAG,oBAAoB,CAAC;AAAA,IACtD;AAAA,IACA,CAAC,EAAE,KAAK,MAAM,QAAQ,KAAK,IAAI;AAAA,EACjC;AAEA,QAAM,WAAU,oBAAI,KAAK,GAAE,YAAY;AACvC,QAAM,SAA2B,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAC,EAAE;AAC3D,QAAM,SAAS,IAAI,IAAI,SAAS,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;AACnF,QAAM,SAAuB,CAAC;AAC9B,QAAM,UAAU,KAAK,MAAM,OAAO;AAClC,QAAM,WAAW,IAAI,KAAK,UAAU,KAAK,KAAK,KAAK,GAAI,EAAE,YAAY;AAErE,aAAW,OAAO,MAAM;AACtB,UAAM,SAAS,OAAO,IAAI,IAAI,IAAI;AAClC,QAAI,CAAC,QAAQ;AACX,aAAO,OAAO,KAAK,EAAE,MAAM,SAAS,IAAI,IAAI,GAAG,OAAO,0BAA0B,CAAC;AACjF;AAAA,IACF;AACA,QAAI;AACF,YAAM,oBAAoB,MAAM,OAAO,IAAI;AAAA,QACzC,oBAAoB,IAAI;AAAA,QACxB,SAAS,IAAI;AAAA,QACb,cAAc,IAAI;AAAA,QAClB;AAAA,MACF,CAAC;AACD,aAAO,QAAQ,KAAK;AAAA,QAClB,UAAU,OAAO;AAAA,QACjB,QAAQ,CAAC,EAAE,OAAO,kBAAkB,QAAQ,IAAI,CAAC;AAAA,MACnD,CAAC;AAID,YAAM,QAAQ,OAAO,mBAAmB;AACxC,UAAI,SAAoE,CAAC;AACzE,UAAI;AACF,iBAAS,MAAM,GAAG,2BAA2B,IAAI,MAAM,KAAK;AAAA,MAC9D,QAAQ;AAAA,MAER;AACA,aAAO,KAAK,GAAG,mBAAmB,QAAQ,KAAK,QAAQ,OAAO,CAAC;AAAA,IACjE,SAAS,GAAG;AACV,aAAO,OAAO,KAAK,EAAE,MAAM,SAAS,IAAI,IAAI,GAAG,OAAQ,EAAY,QAAQ,CAAC;AAAA,IAC9E;AAAA,EACF;AACA,aAAW,QAAQ,QAAS,QAAO,OAAO,KAAK,EAAE,MAAM,MAAM,OAAO,yBAAyB,CAAC;AAE9F,SAAO,KAAK,gBAAgB,kBAAkB,OAAO,QAAQ,QAAQ,OAAO,CAAC;AAC7E,QAAM,4BAA4B,QAAQ,oBAAI,KAAK,CAAC;AAMpD,SAAO;AAAA,IACL,QAAQ,wBAAwB,MAAM;AAAA,IACtC,MAAM,sBAAsB,OAAO,QAAQ,QAAQ,OAAO,OAAO,MAAM;AAAA,EACzE;AACF;","names":[]}

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { S as Site, a as AuditResult, A as AuditName, b as RecipeResult, R as RecipeName, I as InventoryProvider } from './types-QG-QhCYh.js';
-export { C as ConfigName } from './types-QG-QhCYh.js';
+import { S as Site, a as AuditResult, A as AuditName, b as RecipeResult, R as RecipeName, I as InventoryProvider } from './types-Dg4mHvyf.js';
+export { C as ConfigName } from './types-Dg4mHvyf.js';
 import * as airtable_lib_airtable_base_js from 'airtable/lib/airtable_base.js';
 import { F as FormType } from './types-RXY-vY-5.js';
 export { SyncConfigsOptions, syncConfigs } from './recipes/sync-configs.js';
@@ -68,10 +68,33 @@ type BrowserRunner = {
     close?: () => Promise<void>;
 };
 
+/** Result of probing a site's latest PRODUCTION Netlify deploy. Every field is
+ *  nullable: a network/parse failure (or a site with no deploys yet) degrades to
+ *  all-nulls rather than throwing, so the audit always returns a verdict.
+ *  - `state` is Netlify's raw deploy state (`ready`/`error`/`building`/…), lower-cased,
+ *    or null when it couldn't be read.
+ *  - `deployedAt` is the deploy's publish/create time (ISO), or null.
+ *  - `logUrl` links to the deploy (its live URL or the Netlify admin/build-log page).
+ *  - `errorMessage` is Netlify's `error_message` for a failed build, or null. */
+type NetlifyDeployCheck = {
+    state: string | null;
+    deployedAt: string | null;
+    logUrl: string | null;
+    errorMessage: string | null;
+};
+/** Injected IO so the check is unit-testable without hitting the Netlify API.
+ *  `fetchLatestProductionDeploy` returns the parsed first (latest) production
+ *  deploy object, or null when the site has none / the call failed. `now` is the
+ *  clock for the checked-at stamp. */
+type NetlifyDeployDeps = {
+    fetchLatestProductionDeploy: (siteId: string) => Promise<NetlifyDeployCheck | null>;
+    now: Date;
+};
+
 type AuditContext = {
     site: Site;
     spawn?: SpawnFn;
-    /** Clock injection (domain + browser audits). Defaults to `new Date()`. */
+    /** Clock injection (domain + browser + netlify-deploy audits). Defaults to `new Date()`. */
     now?: Date;
     /** DNS/TLS injection for the domain audit (tests). Defaults to real DNS+TLS. */
     domainDeps?: DomainDeps;
@@ -79,6 +102,8 @@ type AuditContext = {
     discoverDeps?: DiscoverDeps;
     /** Playwright runner injection for the browser audit (tests). Defaults to real Playwright. */
     browserRunner?: BrowserRunner;
+    /** Netlify API injection for the netlify-deploy audit (tests). Defaults to a real API call. */
+    netlifyDeployDeps?: NetlifyDeployDeps;
 };
 
 declare function depsAudit(ctx: AuditContext): Promise<AuditResult>;
@@ -326,6 +351,16 @@ type WebsiteRow = {
      *  expires (null = unresolved or no usable cert); `domainCheckedAt` is when it last ran. */
     certDaysRemaining: number | null;
     domainCheckedAt: string | null;
+    /** Netlify site id — the IDENTITY the `netlify-deploy` audit needs to query the
+     *  Netlify API. Read-only input (operator-set in Airtable); null = not on Netlify
+     *  (or not wired) → that audit skips. Never derived from the URL. */
+    netlifyId: string | null;
+    /** Latest PRODUCTION deploy health (the `netlify-deploy` audit). `deployStatus` is
+     *  Netlify's deploy state lower-cased (`ready`/`error`/`building`/…), null = none / not
+     *  checked; `lastDeployAt` is when it deployed; `deployLogUrl` links to the deploy/log. */
+    deployStatus: string | null;
+    lastDeployAt: string | null;
+    deployLogUrl: string | null;
     /** Deployed-URL browser probe (the `browser` audit): cross-engine render OK, mobile render OK,
      *  internal-links OK + broken count, and when it last ran (one timestamp gates all three). */
     crossbrowserOk: boolean | null;
@@ -380,7 +415,11 @@ type ResolvedCopy = {
     announceBody: string;
     announceImprovementResend: string;
     announceImprovementSvelte5: string;
+    /** The cadence lead-in, ending at the em dash. Rendered followed by `announceCadenceNote`
+     *  in italics. */
     announceCadence: string;
+    /** The reassurance tail, rendered italic after `announceCadence`. */
+    announceCadenceNote: string;
     announceOpenDoor: string;
 };
 
@@ -418,6 +457,10 @@ type ReportData = {
      *  `| undefined` is explicit so callers can pass `undefined` under exactOptionalPropertyTypes. */
     gaUsersCurrent?: number | undefined;
     gaUsersPrevious?: number | undefined;
+    /** Length in days of the GA "current" window (compared against the equal-length prior window).
+     *  Drives the analytics trend label ("vs the previous N days"); omitted → the generic
+     *  "last period". `| undefined` for exactOptionalPropertyTypes. */
+    gaPeriodDays?: number | undefined;
     /** Site's rounded average Google position for its query, when on page 1 (from Search Console).
      *  `undefined` = not on page 1, not checked, or unconfigured — rendered as today's plain check. */
     searchPosition?: number | undefined;
@@ -721,6 +764,8 @@ type AttentionItem = {
     autoFixExhausted?: boolean;
 };
 
+type FleetEventType = "pr_automerged" | "vuln_cleared" | "ci_recovered" | "site_launched" | "fleet_swept" | "cert_renewed";
+
 type Tier = "attention" | "watch" | "healthy";
 type SiteCard = {
     site: WebsiteRow;
@@ -765,6 +810,16 @@ type CockpitSummary = {
     /** Count of NEW submissions across the fleet (optional for back-compat). */
     newSubmissions?: number;
 };
+/** A render-ready row for the cockpit "Recently" lane. `url` is an external link
+ *  (PR) when present; `slug` links to `/s/<slug>` when the event names a site. */
+type RecentEntry = {
+    type: FleetEventType;
+    summary: string;
+    siteName: string | null;
+    slug: string | null;
+    url: string | null;
+    ts: string;
+};
 type CockpitModel = {
     summary: CockpitSummary;
     /** All visible sites, ordered: attention (worst-first) → watch (A-Z) → healthy (A-Z). */
@@ -777,14 +832,16 @@ type CockpitModel = {
         caught: number;
         through: number;
     } | null;
+    /** Recent fleet-activity events for the "Recently" lane (optional for back-compat). */
+    recent?: RecentEntry[];
 };
 
 /**
  * Render the fleet cockpit as a single HTML document. Pure function: no Airtable
  * access, no env reads, no I/O. The Netlify function handler builds the
  * CockpitModel (visible-site filter, tiering, NEW/WORSE badging, pending list)
- * and hands it here. Renders the doc shell + summary bar + filter chips + pinned
- * approve strip + three <details> tier sections of cards.
+ * and hands it here. Renders the doc shell + verdict bar + the per-site Needs-you
+ * feed + the collapsed Fleet browse panel (one flat, filterable card grid).
  */
 declare function renderCockpitHtml(model: CockpitModel): string;