@reddoorla/maintenance 0.63.0 → 0.65.0

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { S as Site, a as AuditResult, A as AuditName, b as RecipeResult, R as RecipeName, I as InventoryProvider } from './types-Dg4mHvyf.js';
+import { a as AuditResult, S as Site, A as AuditName, b as RecipeResult, R as RecipeName, I as InventoryProvider } from './types-Dg4mHvyf.js';
 export { C as ConfigName } from './types-Dg4mHvyf.js';
 import * as airtable_lib_airtable_base_js from 'airtable/lib/airtable_base.js';
 import { F as FormType } from './types-RXY-vY-5.js';
@@ -91,6 +91,33 @@ type NetlifyDeployDeps = {
     now: Date;
 };
 
+/** One GitHub Dependabot alert, mapped to the fields the security audit needs. */
+type DependabotAlert = {
+    /** The vulnerable package name (`dependency.package.name`). */
+    package: string;
+    /** GitHub's raw severity vocabulary: "low" | "medium" | "high" | "critical". The audit layer
+     *  maps "medium" → the app's "moderate"; the rest pass through. */
+    severity: string;
+    /** Human advisory summary (`security_advisory.summary`). */
+    summary: string;
+    /** CVE id from the advisory's `cve_id`, as a 0- or 1-element array. Empty for GHSA-only
+     *  advisories (no CVE assigned) — those have no inline identifier here, but `url` still links
+     *  to the GHSA advisory page. (The GitHub `identifiers[]` array is intentionally not surfaced.) */
+    cves: string[];
+    /** Link to the alert (`html_url`), or null. */
+    url: string | null;
+    /** Dependency graph scope, or null when GitHub doesn't classify it. "development" marks a
+     *  build-time-only dependency (lower live-exploit surface for a static site). */
+    scope: "runtime" | "development" | null;
+};
+
+/** The Dependabot fetch the security audit needs, injectable for tests. The real default is
+ *  built from GITHUB_TOKEN; absent token (or a site with no gitRepo) → pnpm/npm audit fallback. */
+type DependabotDeps = {
+    listAlerts: (repo: string) => Promise<DependabotAlert[]>;
+};
+declare function securityAudit(ctx: AuditContext): Promise<AuditResult>;
+
 type AuditContext = {
     site: Site;
     spawn?: SpawnFn;
@@ -104,14 +131,15 @@ type AuditContext = {
     browserRunner?: BrowserRunner;
     /** Netlify API injection for the netlify-deploy audit (tests). Defaults to a real API call. */
     netlifyDeployDeps?: NetlifyDeployDeps;
+    /** GitHub Dependabot fetch injection for the security audit (tests). Defaults to a real client
+     *  from GITHUB_TOKEN; absent token or no site.gitRepo → the pnpm/npm audit fallback. */
+    dependabotDeps?: DependabotDeps;
 };
 
 declare function depsAudit(ctx: AuditContext): Promise<AuditResult>;
 
 declare function lintAudit(ctx: AuditContext): Promise<AuditResult>;
 
-declare function securityAudit(ctx: AuditContext): Promise<AuditResult>;
-
 declare function lighthouseAudit(ctx: AuditContext): Promise<AuditResult>;
 
 declare function a11yAudit(ctx: AuditContext): Promise<AuditResult>;
@@ -307,6 +335,7 @@ type WebsiteRow = {
     gitRepo: string | null;
     reportRecipientsTo: string | null;
     reportRecipientsCc: string | null;
+    acceptedWatchConditions: string[];
     /** First attachment in the Header image field (Airtable's signed URL — fetch before expiry). */
     headerImage: {
         url: string;
@@ -396,6 +425,10 @@ type SecurityAdvisory = {
     title: string;
     cves: string[];
     url: string | null;
+    /** GitHub Dependabot dependency scope ("runtime" | "development"), when known. Lets the
+     *  dashboard flag build-time-only ("development") vulns. Omitted for advisories from the
+     *  lockfile `pnpm audit` fallback, which carries no per-package graph scope. */
+    scope?: "runtime" | "development";
 };
 
 type ResolvedCopy = {
@@ -776,6 +809,9 @@ type SiteCard = {
     watchReasons: string[];
     /** Structured watch tags ("lighthouse" / "stale") for the client filter. */
     watchSignals: string[];
+    /** Watch reasons the operator has accepted: suppressed from the band, shown as a
+     *  muted chip. Populated whenever the underlying condition is currently active. */
+    acceptedReasons: string[];
     /** Count of NEW submissions for this site (optional; populated by buildCockpitModel). */
     newSubmissions?: number;
 };

package/dist/index.js

@@ -1,4 +1,4 @@
-import "./chunk-BMDBOPN3.js";
+import "./chunk-4A5PYCGB.js";
 import {
   findDueReports
 } from "./chunk-WVRPOXKH.js";
@@ -9,7 +9,7 @@ import {
   DEFAULT_INIT_STEPS,
   a11yFixturesPage,
   init
-} from "./chunk-KTPPKO2C.js";
+} from "./chunk-FX3QBSUF.js";
 import {
   convertToPnpm
 } from "./chunk-2X322ZES.js";
@@ -24,11 +24,11 @@ import {
 } from "./chunk-ZYBOT5PM.js";
 import {
   draftReportForSite
-} from "./chunk-NPJFHBAX.js";
+} from "./chunk-M5LX2VSR.js";
 import "./chunk-6LIWDIXU.js";
 import {
   sendApprovedReports
-} from "./chunk-J37CZORZ.js";
+} from "./chunk-QSL3EJGI.js";
 import "./chunk-OGGRFBL4.js";
 import "./chunk-GECESMVS.js";
 import {
@@ -62,11 +62,13 @@ import {
   runAudits,
   runAuditsAcross,
   securityAudit
-} from "./chunk-SS7BKOIX.js";
+} from "./chunk-TC7Z5LG7.js";
 import "./chunk-LKGVSM2O.js";
-import "./chunk-L5F664ZA.js";
-import "./chunk-6ZKM7OIJ.js";
+import "./chunk-G2YRXV26.js";
+import "./chunk-PTPTVVY7.js";
 import "./chunk-XKKTK6WA.js";
+import "./chunk-GASBX52O.js";
+import "./chunk-4GACMVNE.js";
 import {
   fromJsonFile,
   localPath
@@ -76,12 +78,12 @@ import "./chunk-XXTZBPUY.js";
 import "./chunk-XTK5VIQB.js";
 import {
   fromAirtableBase
-} from "./chunk-ZEX2T6JH.js";
+} from "./chunk-MQM5YP4J.js";
 import "./chunk-U5SZ4FOP.js";
 import {
   SEVERITY_RANK,
   siteSlug
-} from "./chunk-BLD6AYJO.js";
+} from "./chunk-7RGQ4KLE.js";
 import "./chunk-HN6I2XWI.js";
 import "./chunk-WEKL2HYJ.js";
 import "./chunk-6VAL7XJT.js";
@@ -285,12 +287,13 @@ function securitySub(site) {
 function advisoryRow(a) {
   const sev = escapeHtml(a.severity);
   const module = escapeHtml(a.module);
+  const scope = a.scope === "development" ? ` <span class="muted">(dev)</span>` : "";
   const title = a.title ? ` \u2014 ${escapeHtml(a.title)}` : "";
   const cves = a.cves.length > 0 ? ` <span class="muted">(${escapeHtml(a.cves.join(", "))})</span>` : "";
   const link = a.url ? ` <a href="${escapeHtml(safeUrl(a.url))}" rel="noopener noreferrer">advisory \u25B8</a>` : "";
   return `<li class="vuln-item">
     <span class="pill sev-${sev}">${sev}</span>
-    <strong>${module}</strong>${title}${cves}${link}
+    <strong>${module}</strong>${scope}${title}${cves}${link}
   </li>`;
 }
 function securitySection(site) {
@@ -651,7 +654,7 @@ function isReadyDeployStatus(status) {
 function isFailedDeployStatus(status) {
   return status !== null && FAILED_DEPLOY_STATES.has(status.toLowerCase());
 }
-var NEEDS_YOU_GROUP_RANK = { broken: 0, approval: 1, slipping: 2 };
+var NEEDS_YOU_GROUP_RANK = { broken: 0, watch: 1, approval: 2 };
 function buildNeedsYouFeed(model) {
   const bySlug = /* @__PURE__ */ new Map();
   const get = (siteName) => {
@@ -664,8 +667,8 @@ function buildNeedsYouFeed(model) {
         reasons: [],
         hasCritical: false,
         broken: false,
-        approval: false,
-        slipping: false
+        watch: false,
+        approval: false
       };
       bySlug.set(slug, a);
     }
@@ -673,17 +676,25 @@ function buildNeedsYouFeed(model) {
   };
   for (const card2 of model.cards) {
     if (card2.tier === "attention") {
-      for (const item of card2.items) {
-        if (item.kind === "vuln" && item.autoFixExhausted !== true) continue;
+      const isSelfPatchingVuln = (it) => it.kind === "vuln" && it.autoFixExhausted !== true;
+      const hardBroken = card2.items.filter((it) => !isSelfPatchingVuln(it));
+      const selfPatchingVulns = card2.items.filter(isSelfPatchingVuln);
+      if (hardBroken.length > 0) {
         const a = get(card2.site.name);
-        a.reasons.push(item.title);
+        for (const it of hardBroken) {
+          a.reasons.push(it.title);
+          if (it.severity === "critical") a.hasCritical = true;
+        }
         a.broken = true;
-        if (item.severity === "critical") a.hasCritical = true;
+      } else if (selfPatchingVulns.length > 0) {
+        const a = get(card2.site.name);
+        for (const it of selfPatchingVulns) a.reasons.push(it.title);
+        a.watch = true;
       }
     } else if (card2.tier === "watch" && card2.watchReasons.length > 0) {
       const a = get(card2.site.name);
       for (const r of card2.watchReasons) a.reasons.push(r);
-      a.slipping = true;
+      a.watch = true;
     }
   }
   for (const p of model.pending) {
@@ -694,7 +705,7 @@ function buildNeedsYouFeed(model) {
   const items = [];
   for (const a of bySlug.values()) {
     if (a.reasons.length === 0) continue;
-    const group = a.broken ? "broken" : a.approval ? "approval" : "slipping";
+    const group = a.broken ? "broken" : a.watch ? "watch" : "approval";
     items.push({
       group,
       hasCritical: a.hasCritical,
@@ -824,6 +835,8 @@ function chips(c) {
   });
   for (const reason of c.watchReasons)
     items.push(`<span class="chip">${escapeHtml(reason)}</span>`);
+  for (const reason of c.acceptedReasons)
+    items.push(`<span class="chip accepted">\u2713 accepted: ${escapeHtml(reason)}</span>`);
   return items.length ? `<div class="chips">${items.join("")}</div>` : "";
 }
 function signalsAttr(c) {
@@ -955,6 +968,8 @@ details.fleet-browse > summary, details.inbox > summary { cursor:pointer; font-w
 @media (prefers-color-scheme: dark) { .chip { background:#222; } }
 .chip.critical { background:#fdecea; color:#b00; }
 .chip.stuck { border:1px solid #b00; font-weight:600; }
+.chip.accepted { background:transparent; border:1px dashed #bbb; color:#888; }
+@media (prefers-color-scheme: dark) { .chip.accepted { border-color:#444; color:#888; } }
 .badge { font-weight:700; color:#C00; font-size:0.72rem; margin-right:0.25rem; }
 .verdict { border-radius:8px; padding:0.9rem 1.1rem; margin-bottom:1.25rem; }
 .verdict .verdict-line { font-weight:800; font-size:1.4rem; }
@@ -963,7 +978,11 @@ details.fleet-browse > summary, details.inbox > summary { cursor:pointer; font-w
 .verdict.ok .verdict-meta { color:#2e7d32; }
 .verdict.warn { background:#fdecea; color:#b00; }
 .verdict.warn .verdict-meta { color:#b00; opacity:0.85; }
-@media (prefers-color-scheme: dark) { .verdict.ok { background:#10240f; color:#7fce85; } .verdict.warn { background:#2a0f0d; color:#ff8a80; } }
+.verdict.watch { background:#fff4e5; color:#a65a00; }
+.verdict.watch .verdict-meta { color:#a65a00; opacity:0.85; }
+.verdict.soft { background:#e7f1ff; color:#1c5d99; }
+.verdict.soft .verdict-meta { color:#1c5d99; opacity:0.85; }
+@media (prefers-color-scheme: dark) { .verdict.ok { background:#10240f; color:#7fce85; } .verdict.warn { background:#2a0f0d; color:#ff8a80; } .verdict.watch { background:#2a2410; color:#ffd454; } .verdict.soft { background:#0f1d2a; color:#7fb6e8; } }
 .verdict .fleet-actions { margin:0.6rem 0 0; }
 .needs-you { border:1px solid #e5e5e5; border-radius:8px; padding:0.75rem 1rem; margin-bottom:1.25rem; }
 @media (prefers-color-scheme: dark) { .needs-you { border-color:#2a2a2a; background:#181818; } }
@@ -977,39 +996,66 @@ details.fleet-browse > summary, details.inbox > summary { cursor:pointer; font-w
 .dot { width:0.55rem; height:0.55rem; border-radius:50%; display:inline-block; flex:0 0 auto; }
 .dot.broken { background:#dc2626; }
 .dot.approval { background:#2563eb; }
-.dot.slipping { background:#f59e0b; }
+.dot.watch { background:#f59e0b; }
 `;
-function verdictBar(model, feedCount) {
+function needsYouCounts(feed) {
+  let broken = 0;
+  let watch = 0;
+  let approval = 0;
+  for (const i of feed) {
+    if (i.group === "broken") broken++;
+    else if (i.group === "watch") watch++;
+    else approval++;
+  }
+  return { broken, watch, approval };
+}
+function verdictBar(model, feed) {
   const auditedIso = fleetLastAuditedAt(model.cards);
-  const audited = auditedIso ? ` \xB7 fleet last audited ${escapeHtml(relativeTimeFromNow(auditedIso))}` : "";
-  const sites = model.cards.length;
-  const sitesWord = `${sites} site${sites === 1 ? "" : "s"}`;
+  const auditedTerm = auditedIso ? `fleet last audited ${escapeHtml(relativeTimeFromNow(auditedIso))}` : null;
+  const total = model.cards.length;
+  const { broken, watch, approval } = needsYouCounts(feed);
+  const healthy = Math.max(0, total - (broken + watch + approval));
   const actions = `<div class="fleet-actions">
       <button type="button" class="refresh-fleet" data-refresh-url="/api/fleet/refresh">\u21BB Audit fleet</button>
       <div id="rf-status" class="rf-status" aria-live="polite"></div>
     </div>`;
-  if (feedCount === 0) {
-    return `<div class="verdict ok">
-      <div class="verdict-line">\u2713 All clear</div>
-      <div class="verdict-meta">${sitesWord} healthy${audited}</div>
-      ${actions}
-    </div>`;
-  }
-  const noun = feedCount === 1 ? "site needs" : "sites need";
-  return `<div class="verdict warn">
-    <div class="verdict-line">\u26A0 ${feedCount} ${noun} you</div>
-    <div class="verdict-meta">${sitesWord}${audited}</div>
+  const render = (cls, line, terms) => `<div class="verdict ${cls}">
+    <div class="verdict-line">${line}</div>
+    <div class="verdict-meta">${terms.filter(Boolean).join(" \xB7 ")}</div>
     ${actions}
   </div>`;
+  if (broken === 0 && watch === 0 && approval === 0) {
+    const sitesWord = `${total} site${total === 1 ? "" : "s"}`;
+    return render("ok", "\u2713 All clear", [`${sitesWord} healthy`, auditedTerm]);
+  }
+  const watchTerm = watch > 0 ? `${watch} watching` : null;
+  const approvalTerm = approval > 0 ? `${approval} waiting on you` : null;
+  const healthyTerm = healthy > 0 ? `${healthy} healthy` : null;
+  if (broken > 0) {
+    return render("warn", `\u26A0 ${broken} site${broken === 1 ? "" : "s"} broken`, [
+      watchTerm,
+      approvalTerm,
+      healthyTerm,
+      auditedTerm
+    ]);
+  }
+  if (watch > 0) {
+    return render("watch", `${watch} site${watch === 1 ? "" : "s"} to watch`, [
+      approvalTerm,
+      healthyTerm,
+      auditedTerm
+    ]);
+  }
+  return render("soft", `${approval} waiting on you`, [healthyTerm, auditedTerm]);
 }
 var NEEDS_YOU_GROUP_LABEL = {
   broken: "Broken",
-  approval: "Waiting on your yes",
-  slipping: "Slipping"
+  watch: "Watch",
+  approval: "Waiting on your yes"
 };
 function renderNeedsYouFeed(feed) {
   if (feed.length === 0) return "";
-  const groups = ["broken", "approval", "slipping"];
+  const groups = ["broken", "watch", "approval"];
   const blocks = groups.map((g) => {
     const rows = feed.filter((i) => i.group === g);
     if (rows.length === 0) return "";
@@ -1213,7 +1259,7 @@ function renderCockpitHtml(model) {
 <body>
   <h1>Reddoor fleet cockpit</h1>
   <div class="meta">${total} site${total === 1 ? "" : "s"} on the Reddoor stack.</div>
-  ${verdictBar(model, feed.length)}
+  ${verdictBar(model, feed)}
   ${renderNeedsYouFeed(feed)}
   ${renderFleetBrowsePanel(model)}
   ${renderRecentlyLane(model)}