@reddoorla/maintenance 0.61.0 → 0.62.0

package/dist/github-signals-XTJLKOXJ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/audits/github-signals.ts","../src/cli/commands/github-signals.ts"],"sourcesContent":["import type { Site } from \"../types.js\";\nimport type { CiState, PullRequestSummary } from \"../github/gh.js\";\nimport { isFailingRenovatePR } from \"../alerts/renovate.js\";\n\n/** One swept row, ready for the Airtable writer (slug-keyed by `site`). */\nexport type GitHubSignalsRow = {\n  site: string; // the site name/slug the writer matches on\n  repo: string; // owner/repo\n  renovateFailingCis: number;\n  ciState: CiState;\n  lastCommitAt: string | null;\n};\n\n/** Injected GitHub reads (so the sweep is pure + testable). */\nexport type GitHubSignalsDeps = {\n  openPullRequests: (repo: string) => Promise<PullRequestSummary[]>;\n  defaultBranchStatus: (repo: string) => Promise<{ ciState: CiState; lastCommitAt: string | null }>;\n};\n\n/** Per repo-backed site: count its failing Renovate PRs + read its default-branch\n *  status. Sites without `gitRepo` are skipped (not errors). A repo whose probe\n *  throws is reported via `onSkip` and produces no row — one GitHub hiccup never\n *  sinks the sweep. PURE over `deps`. */\nexport async function collectGitHubSignals(\n  sites: Site[],\n  deps: GitHubSignalsDeps,\n  onSkip: (s: { repo: string }) => void = () => {},\n): Promise<GitHubSignalsRow[]> {\n  const rows: GitHubSignalsRow[] = [];\n  for (const s of sites) {\n    const repo = s.gitRepo;\n    if (!repo) continue;\n    const name = s.name;\n    if (!name) continue;\n    try {\n      const prs = await deps.openPullRequests(repo);\n      const status = await deps.defaultBranchStatus(repo);\n      rows.push({\n        site: name,\n        repo,\n        renovateFailingCis: prs.filter(isFailingRenovatePR).length,\n        ciState: status.ciState,\n        lastCommitAt: status.lastCommitAt,\n      });\n    } catch {\n      onSkip({ repo });\n    }\n  }\n  return rows;\n}\n","import { openBase, readAirtableConfig } from \"../../reports/airtable/client.js\";\nimport { listWebsites, siteSlug, updateGitHubSignals } from \"../../reports/airtable/websites.js\";\nimport type { Site } from \"../../types.js\";\nimport { collectGitHubSignals } from \"../../audits/github-signals.js\";\nimport { makeGitHub } from \"../../github/gh.js\";\nimport {\n  formatFleetWriteSummary,\n  type FleetWriteResult,\n} from \"../../audits/write-audits-to-airtable.js\";\nimport { detectSignalEvents, fleetSweptEvent } from \"../../audits/fleet-event-detectors.js\";\nimport { recordFleetEventsBestEffort } from \"../../audits/fleet-events-writer.js\";\nimport type { FleetEvent } from \"../../db/fleet-events.js\";\n\n/** Exit code for a fleet github-signals run. Exit 1 when failures are the\n *  MAJORITY of the fleet (`failed > written`), not only on a total wipeout —\n *  a run where 11/12 repos failed but 1 wrote should still signal an outage.\n *  All-success or a minority of flakes (e.g. 1/12 failed) stays exit 0. The\n *  no-token clean-skip returns 0 separately (before any probe runs). */\nexport function githubSignalsExitCode(written: number, failed: number): number {\n  return failed > written ? 1 : 0;\n}\n\n/** `github-signals --fleet --write-airtable`: sweep every repo-backed site for its\n *  Renovate-failing count + default-branch CI state + last-commit date, write each\n *  row serially (Airtable ~5 req/sec), and emit FLEET_WRITE_SUMMARY for CI. A\n *  missing fleet token is a clean skip (local runs), not a failure. */\nexport async function runGitHubSignalsCommand(opts: {\n  fleet?: boolean | undefined;\n  writeAirtable?: boolean | undefined;\n}): Promise<{ output: string; code: number }> {\n  if (!opts.fleet || !opts.writeAirtable) {\n    return { output: \"github-signals currently supports only --fleet --write-airtable\", code: 2 };\n  }\n  const token = process.env.RENOVATE_TOKEN?.trim() || process.env.GH_TOKEN?.trim();\n  if (!token) {\n    return {\n      output: \"github-signals skipped: no RENOVATE_TOKEN/GH_TOKEN (fleet read) configured.\",\n      code: 0,\n    };\n  }\n  const base = openBase(readAirtableConfig());\n  const websites = await listWebsites(base);\n  const gh = makeGitHub({ token });\n  const sites: Site[] = websites.map((w) => ({\n    path: \"\",\n    name: w.name,\n    meta: {},\n    ...(w.gitRepo ? { gitRepo: w.gitRepo } : {}),\n  }));\n\n  const skipped: string[] = [];\n  const rows = await collectGitHubSignals(\n    sites,\n    {\n      openPullRequests: (r) => gh.openPullRequests(r),\n      defaultBranchStatus: (r) => gh.defaultBranchStatus(r),\n    },\n    ({ repo }) => skipped.push(repo),\n  );\n\n  const sweptAt = new Date().toISOString();\n  const result: FleetWriteResult = { written: [], failed: [] };\n  const byRepo = new Map(websites.filter((w) => w.gitRepo).map((w) => [w.gitRepo, w]));\n  const events: FleetEvent[] = [];\n  const sweptMs = Date.parse(sweptAt);\n  const since24h = new Date(sweptMs - 24 * 60 * 60 * 1000).toISOString();\n  // Serial: Airtable's ~5 req/sec limit (matches writeFleetAuditsToAirtable).\n  for (const row of rows) {\n    const target = byRepo.get(row.repo);\n    if (!target) {\n      result.failed.push({ slug: siteSlug(row.site), error: \"no Websites row matched\" });\n      continue;\n    }\n    try {\n      await updateGitHubSignals(base, target.id, {\n        renovateFailingCis: row.renovateFailingCis,\n        ciState: row.ciState,\n        lastCommitAt: row.lastCommitAt,\n        sweptAt,\n      });\n      result.written.push({\n        siteName: target.name,\n        writes: [{ audit: \"github-signals\", counts: row }],\n      });\n      // Fleet-activity events for this repo: merged Renovate PRs since the last sweep\n      // (watermark = the row's prior GitHub Signals At, else a 24h fallback) + a\n      // CI-recovered transition. A PR-fetch hiccup drops only this repo's PR events.\n      const since = target.githubSignalsAt ?? since24h;\n      let merged: Awaited<ReturnType<typeof gh.mergedRenovatePullRequests>> = [];\n      try {\n        merged = await gh.mergedRenovatePullRequests(row.repo, since);\n      } catch {\n        // PR list unavailable this run — skip pr_automerged for this repo, keep ci_recovered\n      }\n      events.push(...detectSignalEvents(target, row, merged, sweptAt));\n    } catch (e) {\n      result.failed.push({ slug: siteSlug(row.site), error: (e as Error).message });\n    }\n  }\n  for (const repo of skipped) result.failed.push({ slug: repo, error: \"probe failed (skipped)\" });\n\n  events.push(fleetSweptEvent(\"github-signals\", result.written.length, sweptAt));\n  await recordFleetEventsBestEffort(events, new Date());\n\n  // Exit non-zero when failures are the MAJORITY of the fleet, not only on a\n  // total wipeout. A run where 11/12 repos failed but 1 wrote used to return 0,\n  // masking a large outage. The nightly cron step is `continue-on-error`, so a\n  // non-zero here is an operator-visibility signal, not a red build.\n  return {\n    output: formatFleetWriteSummary(result),\n    code: githubSignalsExitCode(result.written.length, result.failed.length),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuBA,eAAsB,qBACpB,OACA,MACA,SAAwC,MAAM;AAAC,GAClB;AAC7B,QAAM,OAA2B,CAAC;AAClC,aAAW,KAAK,OAAO;AACrB,UAAM,OAAO,EAAE;AACf,QAAI,CAAC,KAAM;AACX,UAAM,OAAO,EAAE;AACf,QAAI,CAAC,KAAM;AACX,QAAI;AACF,YAAM,MAAM,MAAM,KAAK,iBAAiB,IAAI;AAC5C,YAAM,SAAS,MAAM,KAAK,oBAAoB,IAAI;AAClD,WAAK,KAAK;AAAA,QACR,MAAM;AAAA,QACN;AAAA,QACA,oBAAoB,IAAI,OAAO,mBAAmB,EAAE;AAAA,QACpD,SAAS,OAAO;AAAA,QAChB,cAAc,OAAO;AAAA,MACvB,CAAC;AAAA,IACH,QAAQ;AACN,aAAO,EAAE,KAAK,CAAC;AAAA,IACjB;AAAA,EACF;AACA,SAAO;AACT;;;AC/BO,SAAS,sBAAsB,SAAiB,QAAwB;AAC7E,SAAO,SAAS,UAAU,IAAI;AAChC;AAMA,eAAsB,wBAAwB,MAGA;AAC5C,MAAI,CAAC,KAAK,SAAS,CAAC,KAAK,eAAe;AACtC,WAAO,EAAE,QAAQ,mEAAmE,MAAM,EAAE;AAAA,EAC9F;AACA,QAAM,QAAQ,QAAQ,IAAI,gBAAgB,KAAK,KAAK,QAAQ,IAAI,UAAU,KAAK;AAC/E,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,MAAM;AAAA,IACR;AAAA,EACF;AACA,QAAM,OAAO,SAAS,mBAAmB,CAAC;AAC1C,QAAM,WAAW,MAAM,aAAa,IAAI;AACxC,QAAM,KAAK,WAAW,EAAE,MAAM,CAAC;AAC/B,QAAM,QAAgB,SAAS,IAAI,CAAC,OAAO;AAAA,IACzC,MAAM;AAAA,IACN,MAAM,EAAE;AAAA,IACR,MAAM,CAAC;AAAA,IACP,GAAI,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5C,EAAE;AAEF,QAAM,UAAoB,CAAC;AAC3B,QAAM,OAAO,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,MACE,kBAAkB,CAAC,MAAM,GAAG,iBAAiB,CAAC;AAAA,MAC9C,qBAAqB,CAAC,MAAM,GAAG,oBAAoB,CAAC;AAAA,IACtD;AAAA,IACA,CAAC,EAAE,KAAK,MAAM,QAAQ,KAAK,IAAI;AAAA,EACjC;AAEA,QAAM,WAAU,oBAAI,KAAK,GAAE,YAAY;AACvC,QAAM,SAA2B,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAC,EAAE;AAC3D,QAAM,SAAS,IAAI,IAAI,SAAS,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;AACnF,QAAM,SAAuB,CAAC;AAC9B,QAAM,UAAU,KAAK,MAAM,OAAO;AAClC,QAAM,WAAW,IAAI,KAAK,UAAU,KAAK,KAAK,KAAK,GAAI,EAAE,YAAY;AAErE,aAAW,OAAO,MAAM;AACtB,UAAM,SAAS,OAAO,IAAI,IAAI,IAAI;AAClC,QAAI,CAAC,QAAQ;AACX,aAAO,OAAO,KAAK,EAAE,MAAM,SAAS,IAAI,IAAI,GAAG,OAAO,0BAA0B,CAAC;AACjF;AAAA,IACF;AACA,QAAI;AACF,YAAM,oBAAoB,MAAM,OAAO,IAAI;AAAA,QACzC,oBAAoB,IAAI;AAAA,QACxB,SAAS,IAAI;AAAA,QACb,cAAc,IAAI;AAAA,QAClB;AAAA,MACF,CAAC;AACD,aAAO,QAAQ,KAAK;AAAA,QAClB,UAAU,OAAO;AAAA,QACjB,QAAQ,CAAC,EAAE,OAAO,kBAAkB,QAAQ,IAAI,CAAC;AAAA,MACnD,CAAC;AAID,YAAM,QAAQ,OAAO,mBAAmB;AACxC,UAAI,SAAoE,CAAC;AACzE,UAAI;AACF,iBAAS,MAAM,GAAG,2BAA2B,IAAI,MAAM,KAAK;AAAA,MAC9D,QAAQ;AAAA,MAER;AACA,aAAO,KAAK,GAAG,mBAAmB,QAAQ,KAAK,QAAQ,OAAO,CAAC;AAAA,IACjE,SAAS,GAAG;AACV,aAAO,OAAO,KAAK,EAAE,MAAM,SAAS,IAAI,IAAI,GAAG,OAAQ,EAAY,QAAQ,CAAC;AAAA,IAC9E;AAAA,EACF;AACA,aAAW,QAAQ,QAAS,QAAO,OAAO,KAAK,EAAE,MAAM,MAAM,OAAO,yBAAyB,CAAC;AAE9F,SAAO,KAAK,gBAAgB,kBAAkB,OAAO,QAAQ,QAAQ,OAAO,CAAC;AAC7E,QAAM,4BAA4B,QAAQ,oBAAI,KAAK,CAAC;AAMpD,SAAO;AAAA,IACL,QAAQ,wBAAwB,MAAM;AAAA,IACtC,MAAM,sBAAsB,OAAO,QAAQ,QAAQ,OAAO,OAAO,MAAM;AAAA,EACzE;AACF;","names":[]}

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { S as Site, a as AuditResult, A as AuditName, b as RecipeResult, R as RecipeName, I as InventoryProvider } from './types-QG-QhCYh.js';
-export { C as ConfigName } from './types-QG-QhCYh.js';
+import { S as Site, a as AuditResult, A as AuditName, b as RecipeResult, R as RecipeName, I as InventoryProvider } from './types-Dg4mHvyf.js';
+export { C as ConfigName } from './types-Dg4mHvyf.js';
 import * as airtable_lib_airtable_base_js from 'airtable/lib/airtable_base.js';
 import { F as FormType } from './types-RXY-vY-5.js';
 export { SyncConfigsOptions, syncConfigs } from './recipes/sync-configs.js';
@@ -68,10 +68,33 @@ type BrowserRunner = {
     close?: () => Promise<void>;
 };
 
+/** Result of probing a site's latest PRODUCTION Netlify deploy. Every field is
+ *  nullable: a network/parse failure (or a site with no deploys yet) degrades to
+ *  all-nulls rather than throwing, so the audit always returns a verdict.
+ *  - `state` is Netlify's raw deploy state (`ready`/`error`/`building`/…), lower-cased,
+ *    or null when it couldn't be read.
+ *  - `deployedAt` is the deploy's publish/create time (ISO), or null.
+ *  - `logUrl` links to the deploy (its live URL or the Netlify admin/build-log page).
+ *  - `errorMessage` is Netlify's `error_message` for a failed build, or null. */
+type NetlifyDeployCheck = {
+    state: string | null;
+    deployedAt: string | null;
+    logUrl: string | null;
+    errorMessage: string | null;
+};
+/** Injected IO so the check is unit-testable without hitting the Netlify API.
+ *  `fetchLatestProductionDeploy` returns the parsed first (latest) production
+ *  deploy object, or null when the site has none / the call failed. `now` is the
+ *  clock for the checked-at stamp. */
+type NetlifyDeployDeps = {
+    fetchLatestProductionDeploy: (siteId: string) => Promise<NetlifyDeployCheck | null>;
+    now: Date;
+};
+
 type AuditContext = {
     site: Site;
     spawn?: SpawnFn;
-    /** Clock injection (domain + browser audits). Defaults to `new Date()`. */
+    /** Clock injection (domain + browser + netlify-deploy audits). Defaults to `new Date()`. */
     now?: Date;
     /** DNS/TLS injection for the domain audit (tests). Defaults to real DNS+TLS. */
     domainDeps?: DomainDeps;
@@ -79,6 +102,8 @@ type AuditContext = {
     discoverDeps?: DiscoverDeps;
     /** Playwright runner injection for the browser audit (tests). Defaults to real Playwright. */
     browserRunner?: BrowserRunner;
+    /** Netlify API injection for the netlify-deploy audit (tests). Defaults to a real API call. */
+    netlifyDeployDeps?: NetlifyDeployDeps;
 };
 
 declare function depsAudit(ctx: AuditContext): Promise<AuditResult>;
@@ -326,6 +351,16 @@ type WebsiteRow = {
      *  expires (null = unresolved or no usable cert); `domainCheckedAt` is when it last ran. */
     certDaysRemaining: number | null;
     domainCheckedAt: string | null;
+    /** Netlify site id — the IDENTITY the `netlify-deploy` audit needs to query the
+     *  Netlify API. Read-only input (operator-set in Airtable); null = not on Netlify
+     *  (or not wired) → that audit skips. Never derived from the URL. */
+    netlifyId: string | null;
+    /** Latest PRODUCTION deploy health (the `netlify-deploy` audit). `deployStatus` is
+     *  Netlify's deploy state lower-cased (`ready`/`error`/`building`/…), null = none / not
+     *  checked; `lastDeployAt` is when it deployed; `deployLogUrl` links to the deploy/log. */
+    deployStatus: string | null;
+    lastDeployAt: string | null;
+    deployLogUrl: string | null;
     /** Deployed-URL browser probe (the `browser` audit): cross-engine render OK, mobile render OK,
      *  internal-links OK + broken count, and when it last ran (one timestamp gates all three). */
     crossbrowserOk: boolean | null;
@@ -380,7 +415,11 @@ type ResolvedCopy = {
     announceBody: string;
     announceImprovementResend: string;
     announceImprovementSvelte5: string;
+    /** The cadence lead-in, ending at the em dash. Rendered followed by `announceCadenceNote`
+     *  in italics. */
     announceCadence: string;
+    /** The reassurance tail, rendered italic after `announceCadence`. */
+    announceCadenceNote: string;
     announceOpenDoor: string;
 };
 
@@ -418,6 +457,10 @@ type ReportData = {
      *  `| undefined` is explicit so callers can pass `undefined` under exactOptionalPropertyTypes. */
     gaUsersCurrent?: number | undefined;
     gaUsersPrevious?: number | undefined;
+    /** Length in days of the GA "current" window (compared against the equal-length prior window).
+     *  Drives the analytics trend label ("vs the previous N days"); omitted → the generic
+     *  "last period". `| undefined` for exactOptionalPropertyTypes. */
+    gaPeriodDays?: number | undefined;
     /** Site's rounded average Google position for its query, when on page 1 (from Search Console).
      *  `undefined` = not on page 1, not checked, or unconfigured — rendered as today's plain check. */
     searchPosition?: number | undefined;
@@ -721,6 +764,8 @@ type AttentionItem = {
     autoFixExhausted?: boolean;
 };
 
+type FleetEventType = "pr_automerged" | "vuln_cleared" | "ci_recovered" | "site_launched" | "fleet_swept" | "cert_renewed";
+
 type Tier = "attention" | "watch" | "healthy";
 type SiteCard = {
     site: WebsiteRow;
@@ -765,6 +810,16 @@ type CockpitSummary = {
     /** Count of NEW submissions across the fleet (optional for back-compat). */
     newSubmissions?: number;
 };
+/** A render-ready row for the cockpit "Recently" lane. `url` is an external link
+ *  (PR) when present; `slug` links to `/s/<slug>` when the event names a site. */
+type RecentEntry = {
+    type: FleetEventType;
+    summary: string;
+    siteName: string | null;
+    slug: string | null;
+    url: string | null;
+    ts: string;
+};
 type CockpitModel = {
     summary: CockpitSummary;
     /** All visible sites, ordered: attention (worst-first) → watch (A-Z) → healthy (A-Z). */
@@ -777,6 +832,8 @@ type CockpitModel = {
         caught: number;
         through: number;
     } | null;
+    /** Recent fleet-activity events for the "Recently" lane (optional for back-compat). */
+    recent?: RecentEntry[];
 };
 
 /**

package/dist/index.js

@@ -1,34 +1,41 @@
+import {
+  findDueReports
+} from "./chunk-WVRPOXKH.js";
+import {
+  upgradeSvelte4to5
+} from "./chunk-O65I7G7G.js";
 import {
   DEFAULT_INIT_STEPS,
   a11yFixturesPage,
   init
-} from "./chunk-HB7QPECR.js";
+} from "./chunk-KTPPKO2C.js";
+import {
+  convertToPnpm
+} from "./chunk-2X322ZES.js";
 import {
   svelteCodemods
 } from "./chunk-FUD4I2ZW.js";
+import "./chunk-OQPMZ6BM.js";
 import {
   onboard,
   selfCaretRange,
   selfPackageVersion
 } from "./chunk-ZYBOT5PM.js";
-import "./chunk-VDBENQUA.js";
-import {
-  findDueReports
-} from "./chunk-WVRPOXKH.js";
 import {
   draftReportForSite
-} from "./chunk-TZN2G6FD.js";
+} from "./chunk-TYRCYHRA.js";
 import "./chunk-6LIWDIXU.js";
+import "./chunk-BMDBOPN3.js";
 import {
   sendApprovedReports
-} from "./chunk-KC4HU7BC.js";
-import "./chunk-OGGRFBL4.js";
+} from "./chunk-76VIUWR3.js";
 import {
   BLURRED_CID,
   CHECK_CID,
   loadBundledImages,
   renderReportHtml
-} from "./chunk-BWLUNY7L.js";
+} from "./chunk-2T3HZ3DB.js";
+import "./chunk-OGGRFBL4.js";
 import {
   checklistFor,
   escapeHtml,
@@ -39,18 +46,11 @@ import {
 import {
   bumpDeps
 } from "./chunk-D3DQFC32.js";
-import {
-  upgradeSvelte4to5
-} from "./chunk-O65I7G7G.js";
-import "./chunk-OQPMZ6BM.js";
-import {
-  convertToPnpm
-} from "./chunk-2X322ZES.js";
 import {
   syncConfigs
-} from "./chunk-JNXCDUYB.js";
-import "./chunk-CASCWQQX.js";
+} from "./chunk-XVR7UM6Z.js";
 import "./chunk-XKOZUVK2.js";
+import "./chunk-CASCWQQX.js";
 import "./chunk-OTGB6YQO.js";
 import {
   ALL_AUDIT_NAMES,
@@ -61,8 +61,11 @@ import {
   runAudits,
   runAuditsAcross,
   securityAudit
-} from "./chunk-5PHCZ6L5.js";
+} from "./chunk-SS7BKOIX.js";
 import "./chunk-LKGVSM2O.js";
+import "./chunk-L5F664ZA.js";
+import "./chunk-6ZKM7OIJ.js";
+import "./chunk-XKKTK6WA.js";
 import {
   fromJsonFile,
   localPath
@@ -72,12 +75,12 @@ import "./chunk-XXTZBPUY.js";
 import "./chunk-XTK5VIQB.js";
 import {
   fromAirtableBase
-} from "./chunk-TLZ4V2BE.js";
+} from "./chunk-ZEX2T6JH.js";
 import "./chunk-U5SZ4FOP.js";
 import {
   SEVERITY_RANK,
   siteSlug
-} from "./chunk-L4ULXHIN.js";
+} from "./chunk-BLD6AYJO.js";
 import "./chunk-HN6I2XWI.js";
 import "./chunk-WEKL2HYJ.js";
 import "./chunk-6VAL7XJT.js";
@@ -639,6 +642,14 @@ function renderSiteDashboardHtml(site, reports, submissions = [], spamTotals = n
 
 // src/dashboard/fleet-cockpit.ts
 var MS_PER_DAY = 24 * 60 * 60 * 1e3;
+var READY_DEPLOY_STATES = /* @__PURE__ */ new Set(["ready"]);
+var FAILED_DEPLOY_STATES = /* @__PURE__ */ new Set(["error", "failed", "rejected"]);
+function isReadyDeployStatus(status) {
+  return status !== null && READY_DEPLOY_STATES.has(status.toLowerCase());
+}
+function isFailedDeployStatus(status) {
+  return status !== null && FAILED_DEPLOY_STATES.has(status.toLowerCase());
+}
 var NEEDS_YOU_GROUP_RANK = { broken: 0, approval: 1, slipping: 2 };
 function buildNeedsYouFeed(model) {
   const bySlug = /* @__PURE__ */ new Map();
@@ -776,10 +787,25 @@ function card(site) {
     site.securityVulnsModerate,
     site.securityVulnsLow
   )}
+        <span class="metric-label">deploy</span> ${deployBadge(site)}
       </span>
     </div>
   </article>`;
 }
+function deployBadge(site) {
+  const state = site.deployStatus;
+  if (state === null) {
+    return `<span class="metric deploy unknown" title="No deploy data">${DASH2}</span>`;
+  }
+  const cls = isReadyDeployStatus(state) ? "deploy ready" : isFailedDeployStatus(state) ? "deploy failed" : "deploy building";
+  const when = relativeTimeFromNow(site.lastDeployAt);
+  const label = escapeHtml(`${state}${when !== DASH2 ? ` \xB7 ${when}` : ""}`);
+  const url = site.deployLogUrl ? safeUrl(site.deployLogUrl) : "#";
+  if (url !== "#") {
+    return `<a class="metric ${cls}" href="${escapeHtml(url)}" target="_blank" rel="noopener">${label}</a>`;
+  }
+  return `<span class="metric ${cls}">${label}</span>`;
+}
 function submBadge(c) {
   const n = c.newSubmissions ?? 0;
   return n > 0 ? `<span class="chip">\u{1F4E5} ${n} new</span>` : "";
@@ -890,6 +916,16 @@ h1 { margin: 0 0 0.25rem; font-size: 1.75rem; }
 .cluster.lighthouse .score { display: inline-block; min-width: 2.25rem; text-align: right; }
 .metric-label { color: #999; font-size: 0.8rem; text-transform: uppercase; letter-spacing: 0.04em; }
 .metric { font-feature-settings: "tnum"; }
+.metric.deploy { font-size:0.78rem; padding:0.05rem 0.4rem; border-radius:6px; text-decoration:none; }
+.metric.deploy.ready { background:#e6f4ea; color:#1a7f37; }
+.metric.deploy.failed { background:#fdecea; color:#b00; font-weight:600; }
+.metric.deploy.building { background:#fff4e5; color:#9a6700; }
+.metric.deploy.unknown { color:#999; }
+@media (prefers-color-scheme: dark) {
+  .metric.deploy.ready { background:#0f2417; color:#4ac26b; }
+  .metric.deploy.failed { background:#3a1412; color:#ff6b6b; }
+  .metric.deploy.building { background:#2e2410; color:#e3b341; }
+}
 .spam-rollup { font-size:0.9rem; margin-bottom:1rem; }
 .muted { color:#999; }
 .filters { display:flex; flex-wrap:wrap; gap:0.4rem; margin-bottom:1.25rem; }
@@ -988,6 +1024,34 @@ function renderNeedsYouFeed(feed) {
   return `<section class="needs-you"><h2>Needs you (${feed.length})</h2>${blocks}</section>`;
 }
 var SUBMISSIONS_STRIP_CAP = 10;
+var RECENT_ICON = {
+  pr_automerged: "\u{1F527}",
+  vuln_cleared: "\u{1F6E1}",
+  ci_recovered: "\u2705",
+  site_launched: "\u{1F680}",
+  cert_renewed: "\u{1F512}",
+  fleet_swept: "\u{1F504}"
+};
+function renderRecentlyLane(model) {
+  const events = model.recent ?? [];
+  if (events.length === 0) return "";
+  const rows = events.map((e) => {
+    const icon = RECENT_ICON[e.type] ?? "\u2022";
+    const when = escapeHtml(relativeTimeFromNow(e.ts));
+    const site = e.siteName ? `<strong>${escapeHtml(e.siteName)}</strong> \u2014 ` : "";
+    const link = e.url ? `<a href="${escapeHtml(e.url)}">view \u25B8</a>` : e.slug ? `<a href="/s/${escapeHtml(e.slug)}">open \u25B8</a>` : "";
+    return `<div class="recent-row" data-type="${e.type}">
+        <span class="recent-icon">${icon}</span>
+        <span class="recent-what">${site}${escapeHtml(e.summary)}</span>
+        <span class="muted">${when}</span>
+        ${link}
+      </div>`;
+  }).join("");
+  return `<details class="recently">
+    <summary>\u{1F527} Recently (${events.length})</summary>
+    ${rows}
+  </details>`;
+}
 function renderInboxLane(model) {
   const subs = model.submissions ?? [];
   const spam = model.spam;
@@ -1151,6 +1215,7 @@ function renderCockpitHtml(model) {
   ${verdictBar(model, feed.length)}
   ${renderNeedsYouFeed(feed)}
   ${renderFleetBrowsePanel(model)}
+  ${renderRecentlyLane(model)}
   ${renderInboxLane(model)}
   ${AUDIT_SCRIPT}
   ${FLEET_BROWSE_SCRIPT}