@reddoorla/maintenance 0.64.0 → 0.65.0

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { S as Site, a as AuditResult, A as AuditName, b as RecipeResult, R as RecipeName, I as InventoryProvider } from './types-Dg4mHvyf.js';
+import { a as AuditResult, S as Site, A as AuditName, b as RecipeResult, R as RecipeName, I as InventoryProvider } from './types-Dg4mHvyf.js';
 export { C as ConfigName } from './types-Dg4mHvyf.js';
 import * as airtable_lib_airtable_base_js from 'airtable/lib/airtable_base.js';
 import { F as FormType } from './types-RXY-vY-5.js';
@@ -91,6 +91,33 @@ type NetlifyDeployDeps = {
     now: Date;
 };
 
+/** One GitHub Dependabot alert, mapped to the fields the security audit needs. */
+type DependabotAlert = {
+    /** The vulnerable package name (`dependency.package.name`). */
+    package: string;
+    /** GitHub's raw severity vocabulary: "low" | "medium" | "high" | "critical". The audit layer
+     *  maps "medium" → the app's "moderate"; the rest pass through. */
+    severity: string;
+    /** Human advisory summary (`security_advisory.summary`). */
+    summary: string;
+    /** CVE id from the advisory's `cve_id`, as a 0- or 1-element array. Empty for GHSA-only
+     *  advisories (no CVE assigned) — those have no inline identifier here, but `url` still links
+     *  to the GHSA advisory page. (The GitHub `identifiers[]` array is intentionally not surfaced.) */
+    cves: string[];
+    /** Link to the alert (`html_url`), or null. */
+    url: string | null;
+    /** Dependency graph scope, or null when GitHub doesn't classify it. "development" marks a
+     *  build-time-only dependency (lower live-exploit surface for a static site). */
+    scope: "runtime" | "development" | null;
+};
+
+/** The Dependabot fetch the security audit needs, injectable for tests. The real default is
+ *  built from GITHUB_TOKEN; absent token (or a site with no gitRepo) → pnpm/npm audit fallback. */
+type DependabotDeps = {
+    listAlerts: (repo: string) => Promise<DependabotAlert[]>;
+};
+declare function securityAudit(ctx: AuditContext): Promise<AuditResult>;
+
 type AuditContext = {
     site: Site;
     spawn?: SpawnFn;
@@ -104,14 +131,15 @@ type AuditContext = {
     browserRunner?: BrowserRunner;
     /** Netlify API injection for the netlify-deploy audit (tests). Defaults to a real API call. */
     netlifyDeployDeps?: NetlifyDeployDeps;
+    /** GitHub Dependabot fetch injection for the security audit (tests). Defaults to a real client
+     *  from GITHUB_TOKEN; absent token or no site.gitRepo → the pnpm/npm audit fallback. */
+    dependabotDeps?: DependabotDeps;
 };
 
 declare function depsAudit(ctx: AuditContext): Promise<AuditResult>;
 
 declare function lintAudit(ctx: AuditContext): Promise<AuditResult>;
 
-declare function securityAudit(ctx: AuditContext): Promise<AuditResult>;
-
 declare function lighthouseAudit(ctx: AuditContext): Promise<AuditResult>;
 
 declare function a11yAudit(ctx: AuditContext): Promise<AuditResult>;
@@ -307,6 +335,7 @@ type WebsiteRow = {
     gitRepo: string | null;
     reportRecipientsTo: string | null;
     reportRecipientsCc: string | null;
+    acceptedWatchConditions: string[];
     /** First attachment in the Header image field (Airtable's signed URL — fetch before expiry). */
     headerImage: {
         url: string;
@@ -396,6 +425,10 @@ type SecurityAdvisory = {
     title: string;
     cves: string[];
     url: string | null;
+    /** GitHub Dependabot dependency scope ("runtime" | "development"), when known. Lets the
+     *  dashboard flag build-time-only ("development") vulns. Omitted for advisories from the
+     *  lockfile `pnpm audit` fallback, which carries no per-package graph scope. */
+    scope?: "runtime" | "development";
 };
 
 type ResolvedCopy = {
@@ -776,6 +809,9 @@ type SiteCard = {
     watchReasons: string[];
     /** Structured watch tags ("lighthouse" / "stale") for the client filter. */
     watchSignals: string[];
+    /** Watch reasons the operator has accepted: suppressed from the band, shown as a
+     *  muted chip. Populated whenever the underlying condition is currently active. */
+    acceptedReasons: string[];
     /** Count of NEW submissions for this site (optional; populated by buildCockpitModel). */
     newSubmissions?: number;
 };

package/dist/index.js

@@ -1,4 +1,4 @@
-import "./chunk-BMDBOPN3.js";
+import "./chunk-4A5PYCGB.js";
 import {
   findDueReports
 } from "./chunk-WVRPOXKH.js";
@@ -9,7 +9,7 @@ import {
   DEFAULT_INIT_STEPS,
   a11yFixturesPage,
   init
-} from "./chunk-KTPPKO2C.js";
+} from "./chunk-FX3QBSUF.js";
 import {
   convertToPnpm
 } from "./chunk-2X322ZES.js";
@@ -24,11 +24,11 @@ import {
 } from "./chunk-ZYBOT5PM.js";
 import {
   draftReportForSite
-} from "./chunk-NPJFHBAX.js";
+} from "./chunk-M5LX2VSR.js";
 import "./chunk-6LIWDIXU.js";
 import {
   sendApprovedReports
-} from "./chunk-J37CZORZ.js";
+} from "./chunk-QSL3EJGI.js";
 import "./chunk-OGGRFBL4.js";
 import "./chunk-GECESMVS.js";
 import {
@@ -62,11 +62,13 @@ import {
   runAudits,
   runAuditsAcross,
   securityAudit
-} from "./chunk-SS7BKOIX.js";
+} from "./chunk-TC7Z5LG7.js";
 import "./chunk-LKGVSM2O.js";
-import "./chunk-L5F664ZA.js";
-import "./chunk-6ZKM7OIJ.js";
+import "./chunk-G2YRXV26.js";
+import "./chunk-PTPTVVY7.js";
 import "./chunk-XKKTK6WA.js";
+import "./chunk-GASBX52O.js";
+import "./chunk-4GACMVNE.js";
 import {
   fromJsonFile,
   localPath
@@ -76,12 +78,12 @@ import "./chunk-XXTZBPUY.js";
 import "./chunk-XTK5VIQB.js";
 import {
   fromAirtableBase
-} from "./chunk-ZEX2T6JH.js";
+} from "./chunk-MQM5YP4J.js";
 import "./chunk-U5SZ4FOP.js";
 import {
   SEVERITY_RANK,
   siteSlug
-} from "./chunk-BLD6AYJO.js";
+} from "./chunk-7RGQ4KLE.js";
 import "./chunk-HN6I2XWI.js";
 import "./chunk-WEKL2HYJ.js";
 import "./chunk-6VAL7XJT.js";
@@ -285,12 +287,13 @@ function securitySub(site) {
 function advisoryRow(a) {
   const sev = escapeHtml(a.severity);
   const module = escapeHtml(a.module);
+  const scope = a.scope === "development" ? ` <span class="muted">(dev)</span>` : "";
   const title = a.title ? ` \u2014 ${escapeHtml(a.title)}` : "";
   const cves = a.cves.length > 0 ? ` <span class="muted">(${escapeHtml(a.cves.join(", "))})</span>` : "";
   const link = a.url ? ` <a href="${escapeHtml(safeUrl(a.url))}" rel="noopener noreferrer">advisory \u25B8</a>` : "";
   return `<li class="vuln-item">
     <span class="pill sev-${sev}">${sev}</span>
-    <strong>${module}</strong>${title}${cves}${link}
+    <strong>${module}</strong>${scope}${title}${cves}${link}
   </li>`;
 }
 function securitySection(site) {
@@ -832,6 +835,8 @@ function chips(c) {
   });
   for (const reason of c.watchReasons)
     items.push(`<span class="chip">${escapeHtml(reason)}</span>`);
+  for (const reason of c.acceptedReasons)
+    items.push(`<span class="chip accepted">\u2713 accepted: ${escapeHtml(reason)}</span>`);
   return items.length ? `<div class="chips">${items.join("")}</div>` : "";
 }
 function signalsAttr(c) {
@@ -963,6 +968,8 @@ details.fleet-browse > summary, details.inbox > summary { cursor:pointer; font-w
 @media (prefers-color-scheme: dark) { .chip { background:#222; } }
 .chip.critical { background:#fdecea; color:#b00; }
 .chip.stuck { border:1px solid #b00; font-weight:600; }
+.chip.accepted { background:transparent; border:1px dashed #bbb; color:#888; }
+@media (prefers-color-scheme: dark) { .chip.accepted { border-color:#444; color:#888; } }
 .badge { font-weight:700; color:#C00; font-size:0.72rem; margin-right:0.25rem; }
 .verdict { border-radius:8px; padding:0.9rem 1.1rem; margin-bottom:1.25rem; }
 .verdict .verdict-line { font-weight:800; font-size:1.4rem; }