@reddoorla/maintenance 0.65.0 → 0.65.3

package/dist/{chunk-QSL3EJGI.js → chunk-WXNSLK4Q.js}

@@ -10,7 +10,7 @@ import {
   loadBundledImages,
   renderReportHtml,
   resolveCopy
-} from "./chunk-U3MF6RCS.js";
+} from "./chunk-SYTPVYIK.js";
 import {
   checklistFor,
   isChecklistComplete,
@@ -24,7 +24,7 @@ import {
   listWebsites,
   siteSlug,
   updateLaunched
-} from "./chunk-7RGQ4KLE.js";
+} from "./chunk-CCXVX5JN.js";
 import {
   openBase,
   readAirtableConfig
@@ -303,4 +303,4 @@ export {
   parseAddresses,
   isProbablyEmail
 };
-//# sourceMappingURL=chunk-QSL3EJGI.js.map
+//# sourceMappingURL=chunk-WXNSLK4Q.js.map

package/dist/{chunk-4GACMVNE.js → chunk-YEGHUODU.js}

@@ -106,6 +106,22 @@ function makeGitHub(deps) {
       }
       return present;
     },
+    async fileContentsOnBranch(repo, branch, path) {
+      assertUrlSegment("branch", branch);
+      assertUrlSegment("path", path);
+      const r = await spawn(
+        "gh",
+        [
+          "api",
+          `repos/${repo}/contents/${path}?ref=${branch}`,
+          "-H",
+          "Accept: application/vnd.github.raw"
+        ],
+        { env, timeoutMs: 6e4 }
+      );
+      if (r.code !== 0) return null;
+      return r.stdout;
+    },
     async branchProtectionContexts(repo, branch) {
       assertUrlSegment("branch", branch);
       const r = await spawn(
@@ -239,4 +255,4 @@ export {
   assertUrlSegment,
   makeGitHub
 };
-//# sourceMappingURL=chunk-4GACMVNE.js.map
+//# sourceMappingURL=chunk-YEGHUODU.js.map

package/dist/chunk-YEGHUODU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/github/gh.ts"],"sourcesContent":["import { defaultSpawn, type SpawnFn } from \"../audits/util/spawn.js\";\n\n/** Aggregate CI state of a PR's head commit, normalized from GitHub's rollup. */\nexport type CiState = \"passing\" | \"failing\" | \"pending\" | \"none\";\n\n/** GitHub's computed mergeability of a PR. `UNKNOWN` is transient — GitHub is\n *  still computing it (e.g. right after a push) — so it should be read as \"not\n *  known to conflict\", never as conflicting. */\nexport type PrMergeable = \"MERGEABLE\" | \"CONFLICTING\" | \"UNKNOWN\";\n\n/** A minimal open-PR summary with its head-commit CI rollup state + mergeability. */\nexport type PullRequestSummary = {\n  number: number;\n  title: string;\n  url: string;\n  headRef: string;\n  ciState: CiState;\n  mergeable: PrMergeable;\n};\n\n/**\n * Reject a value before it's interpolated into a `gh api` URL path. The\n * `owner/repo` split methods already validate shape; this is the defense-in-depth\n * guard for the `branch` and file-`path` segments. An unexpected value (`..`, a\n * leading `/`, whitespace, or a URL-structural char like `?#%` or a backslash)\n * could otherwise retarget the endpoint (escape the intended path, smuggle a\n * query string, or traverse). Conservative by design — legit branch names like\n * `maint/self-updating-x` and paths like `.github/workflows/ci.yml` pass.\n *\n * Both branch refs (`maint/self-updating-x`) and file paths\n * (`.github/workflows/ci.yml`) legitimately contain `/`, so a single slash is\n * allowed; what's rejected is `..`, a leading `/`, whitespace, or a\n * URL-structural char (`?`, `#`, `%`, backslash) that could escape or retarget\n * the endpoint.\n */\nexport function assertUrlSegment(kind: \"branch\" | \"path\", value: string): void {\n  const structural = /[\\s?#%\\\\]|\\.\\./;\n  if (value.length === 0 || value.startsWith(\"/\") || structural.test(value)) {\n    throw new Error(\n      `unsafe ${kind} for gh api path (illegal characters or traversal): ${JSON.stringify(value)}`,\n    );\n  }\n}\n\n/** Map GitHub's `statusCheckRollup.state` enum to our normalized CiState. */\nfunction mapRollupState(state: string | null | undefined): CiState {\n  switch (state) {\n    case \"SUCCESS\":\n      return \"passing\";\n    case \"FAILURE\":\n    case \"ERROR\":\n      return \"failing\";\n    case \"PENDING\":\n    case \"EXPECTED\":\n      return \"pending\";\n    default:\n      return \"none\"; // null/undefined = no checks reported\n  }\n}\n\n/** Coerce GitHub's `mergeable` enum to our PrMergeable. Anything unexpected\n *  (including the literal `UNKNOWN` GitHub returns while still computing) maps to\n *  `UNKNOWN` — i.e. \"not known to conflict\". Only an explicit `CONFLICTING` is. */\nfunction mapMergeable(state: string | null | undefined): PrMergeable {\n  return state === \"MERGEABLE\" || state === \"CONFLICTING\" ? state : \"UNKNOWN\";\n}\n\nexport type GitHub = {\n  openPullRequest: (\n    repo: string,\n    pr: { head: string; base: string; title: string; body: string },\n  ) => Promise<{ url: string }>;\n  enableRepoAutoMerge: (repo: string) => Promise<void>;\n  protectBranch: (repo: string, branch: string, requiredChecks: string[]) => Promise<void>;\n  setRepoSecret: (repo: string, name: string, value: string) => Promise<void>;\n  repoExists: (repo: string) => Promise<boolean>;\n  defaultBranch: (repo: string) => Promise<string>;\n  filesOnBranch: (repo: string, branch: string, paths: string[]) => Promise<string[]>;\n  /** The raw contents of `path` on `branch`, or null when the file is absent (404).\n   *  Lets a caller detect a present-but-STALE file (content drift), where\n   *  `filesOnBranch` only sees existence. */\n  fileContentsOnBranch: (repo: string, branch: string, path: string) => Promise<string | null>;\n  branchProtectionContexts: (repo: string, branch: string) => Promise<string[]>;\n  secretExists: (repo: string, name: string) => Promise<boolean>;\n  autoMergeEnabled: (repo: string) => Promise<boolean>;\n  findOpenSelfUpdatingPR: (repo: string) => Promise<string | null>;\n  /** All open PRs on a repo with each head commit's normalized CI rollup state. */\n  openPullRequests: (repo: string) => Promise<PullRequestSummary[]>;\n  /** The default branch's latest-commit date + normalized CI rollup, one query. */\n  defaultBranchStatus: (repo: string) => Promise<{ ciState: CiState; lastCommitAt: string | null }>;\n  /** Renovate PRs (head `renovate/*`) merged at/after `sinceIso`. Used to record\n   *  `pr_automerged` fleet events. gh-shell (Actions only). */\n  mergedRenovatePullRequests: (\n    repo: string,\n    sinceIso: string,\n  ) => Promise<Array<{ number: number; title: string; url: string; mergedAt: string }>>;\n  /** Fire a `workflow_dispatch` for `<workflow>` (a filename like `renovate.yml`)\n   *  on `ref`. Requires the token's `actions:write` scope; a 404 (no such\n   *  workflow) or 403 (missing scope) surfaces as a thrown error. */\n  dispatchWorkflow: (repo: string, workflow: string, ref: string) => Promise<void>;\n};\n\nexport function makeGitHub(deps: { token: string; spawn?: SpawnFn }): GitHub {\n  const spawn = deps.spawn ?? defaultSpawn;\n  const env = { ...process.env, GH_TOKEN: deps.token };\n\n  async function gh(args: string[]): Promise<string> {\n    const r = await spawn(\"gh\", args, { env, timeoutMs: 60_000 });\n    if (r.code !== 0) throw new Error(`gh ${args[0]} failed (code ${r.code}): ${r.stderr.trim()}`);\n    return r.stdout;\n  }\n\n  return {\n    async openPullRequest(repo, pr) {\n      const out = await gh([\n        \"pr\",\n        \"create\",\n        \"--repo\",\n        repo,\n        \"--head\",\n        pr.head,\n        \"--base\",\n        pr.base,\n        \"--title\",\n        pr.title,\n        \"--body\",\n        pr.body,\n      ]);\n      return { url: out.trim() };\n    },\n    async enableRepoAutoMerge(repo) {\n      await gh([\"api\", \"-X\", \"PATCH\", `repos/${repo}`, \"-F\", \"allow_auto_merge=true\"]);\n    },\n    async protectBranch(repo, branch, requiredChecks) {\n      assertUrlSegment(\"branch\", branch);\n      const args = [\n        \"api\",\n        \"-X\",\n        \"PUT\",\n        `repos/${repo}/branches/${branch}/protection`,\n        \"-H\",\n        \"Accept: application/vnd.github+json\",\n        \"-F\",\n        \"required_status_checks[strict]=true\",\n        ...requiredChecks.flatMap((c) => [\"-f\", `required_status_checks[contexts][]=${c}`]),\n        \"-F\",\n        \"enforce_admins=true\",\n        \"-F\",\n        \"required_pull_request_reviews=null\",\n        \"-F\",\n        \"restrictions=null\",\n      ];\n      await gh(args);\n    },\n    async setRepoSecret(repo, name, value) {\n      await gh([\"secret\", \"set\", name, \"--repo\", repo, \"--body\", value]);\n    },\n    async repoExists(repo) {\n      const r = await spawn(\"gh\", [\"api\", `repos/${repo}`], { env, timeoutMs: 60_000 });\n      return r.code === 0;\n    },\n    async defaultBranch(repo) {\n      const out = await gh([\"api\", `repos/${repo}`, \"--jq\", \".default_branch\"]);\n      return out.trim();\n    },\n    // filesOnBranch and branchProtectionContexts call `spawn` directly (not the\n    // throwing `gh()` helper) because a 404 is an expected, meaningful answer —\n    // \"file/protection absent\" — not an error. The remaining readers use `gh()`\n    // since a non-200 there is a genuine failure (e.g. missing token scope).\n    async filesOnBranch(repo, branch, paths) {\n      assertUrlSegment(\"branch\", branch);\n      const present: string[] = [];\n      for (const p of paths) {\n        assertUrlSegment(\"path\", p);\n        const r = await spawn(\"gh\", [`api`, `repos/${repo}/contents/${p}?ref=${branch}`], {\n          env,\n          timeoutMs: 60_000,\n        });\n        if (r.code === 0) present.push(p);\n      }\n      return present;\n    },\n    async fileContentsOnBranch(repo, branch, path) {\n      // Same spawn-directly rationale as filesOnBranch: a 404 (file absent) is an\n      // expected answer (null), not an error. The `raw` media type returns the file\n      // bytes verbatim (no base64 envelope) so the result compares directly against a\n      // canonical template.\n      assertUrlSegment(\"branch\", branch);\n      assertUrlSegment(\"path\", path);\n      const r = await spawn(\n        \"gh\",\n        [\n          \"api\",\n          `repos/${repo}/contents/${path}?ref=${branch}`,\n          \"-H\",\n          \"Accept: application/vnd.github.raw\",\n        ],\n        { env, timeoutMs: 60_000 },\n      );\n      if (r.code !== 0) return null; // 404 = file absent on this branch\n      return r.stdout;\n    },\n    async branchProtectionContexts(repo, branch) {\n      assertUrlSegment(\"branch\", branch);\n      const r = await spawn(\n        \"gh\",\n        [\n          \"api\",\n          `repos/${repo}/branches/${branch}/protection`,\n          \"--jq\",\n          \".required_status_checks.contexts[]?\",\n        ],\n        { env, timeoutMs: 60_000 },\n      );\n      if (r.code !== 0) return []; // 404 = no protection configured\n      return r.stdout\n        .split(\"\\n\")\n        .map((l) => l.trim())\n        .filter((l) => l.length > 0);\n    },\n    async secretExists(repo, name) {\n      // per_page=100: the REST default of 30 would false-negative on a repo with >30 secrets,\n      // wrongly reporting an existing secret absent (→ a needless overwrite).\n      const out = await gh([\n        \"api\",\n        `repos/${repo}/actions/secrets?per_page=100`,\n        \"--jq\",\n        \".secrets[].name\",\n      ]);\n      return out\n        .split(\"\\n\")\n        .map((l) => l.trim())\n        .includes(name);\n    },\n    async autoMergeEnabled(repo) {\n      const out = await gh([\"api\", `repos/${repo}`, \"--jq\", \".allow_auto_merge\"]);\n      return out.trim() === \"true\";\n    },\n    async findOpenSelfUpdatingPR(repo) {\n      // per_page=100: with the REST default of 30, a repo with >30 open PRs (plausible under\n      // Renovate) could page past the existing self-updating PR and open a duplicate.\n      const out = await gh([\n        \"api\",\n        `repos/${repo}/pulls?state=open&per_page=100`,\n        \"--jq\",\n        '.[] | select(.head.ref | startswith(\"maint/self-updating-\")) | .html_url',\n      ]);\n      const first = out\n        .split(\"\\n\")\n        .map((l) => l.trim())\n        .find((l) => l.length > 0);\n      return first ?? null;\n    },\n    async openPullRequests(repo) {\n      const [owner, name, ...rest] = repo.split(\"/\");\n      if (!owner || !name || rest.length > 0) {\n        throw new Error(`openPullRequests: expected \"owner/repo\", got \"${repo}\"`);\n      }\n      const query =\n        \"query($owner:String!,$name:String!){repository(owner:$owner,name:$name){\" +\n        \"pullRequests(states:OPEN,first:100,orderBy:{field:CREATED_AT,direction:DESC}){nodes{number title url headRefName mergeable \" +\n        \"commits(last:1){nodes{commit{statusCheckRollup{state}}}}}}}}\";\n      const out = await gh([\n        \"api\",\n        \"graphql\",\n        \"-f\",\n        `query=${query}`,\n        \"-F\",\n        `owner=${owner}`,\n        \"-F\",\n        `name=${name}`,\n      ]);\n      const parsed = JSON.parse(out) as {\n        data?: {\n          repository?: {\n            pullRequests?: {\n              nodes?: Array<{\n                number: number;\n                title: string;\n                url: string;\n                headRefName: string;\n                mergeable?: string;\n                commits?: {\n                  nodes?: Array<{ commit?: { statusCheckRollup?: { state?: string } } }>;\n                };\n              }>;\n            };\n          };\n        };\n      };\n      const nodes = parsed.data?.repository?.pullRequests?.nodes ?? [];\n      return nodes.map((n) => ({\n        number: n.number,\n        title: n.title,\n        url: n.url,\n        headRef: n.headRefName,\n        ciState: mapRollupState(n.commits?.nodes?.[0]?.commit?.statusCheckRollup?.state),\n        mergeable: mapMergeable(n.mergeable),\n      }));\n    },\n    async defaultBranchStatus(repo) {\n      const [owner, name, ...rest] = repo.split(\"/\");\n      if (!owner || !name || rest.length > 0) {\n        throw new Error(`defaultBranchStatus: expected \"owner/repo\", got \"${repo}\"`);\n      }\n      const query =\n        \"query($owner:String!,$name:String!){repository(owner:$owner,name:$name){\" +\n        \"defaultBranchRef{target{... on Commit{committedDate statusCheckRollup{state}}}}}}\";\n      const out = await gh([\n        \"api\",\n        \"graphql\",\n        \"-f\",\n        `query=${query}`,\n        \"-F\",\n        `owner=${owner}`,\n        \"-F\",\n        `name=${name}`,\n      ]);\n      const parsed = JSON.parse(out) as {\n        data?: {\n          repository?: {\n            defaultBranchRef?: {\n              target?: { committedDate?: string; statusCheckRollup?: { state?: string } | null };\n            } | null;\n          };\n        };\n      };\n      const target = parsed.data?.repository?.defaultBranchRef?.target;\n      return {\n        ciState: mapRollupState(target?.statusCheckRollup?.state),\n        lastCommitAt: target?.committedDate ?? null,\n      };\n    },\n    async mergedRenovatePullRequests(repo, sinceIso) {\n      const [owner, name, ...rest] = repo.split(\"/\");\n      if (!owner || !name || rest.length > 0) {\n        throw new Error(`mergedRenovatePullRequests: expected \"owner/repo\", got \"${repo}\"`);\n      }\n      // per_page=50: comfortably covers a week of Renovate merges on one repo. The\n      // list endpoint returns merged_at + head.ref, so the filter is local.\n      const out = await gh([\n        \"api\",\n        `repos/${owner}/${name}/pulls?state=closed&sort=updated&direction=desc&per_page=50`,\n      ]);\n      const arr = JSON.parse(out) as Array<{\n        number: number;\n        title: string;\n        html_url: string;\n        merged_at: string | null;\n        head?: { ref?: string };\n      }>;\n      return arr\n        .filter(\n          (p) =>\n            p.merged_at !== null &&\n            p.merged_at >= sinceIso && // ISO8601 UTC strings sort lexicographically\n            (p.head?.ref ?? \"\").startsWith(\"renovate/\"),\n        )\n        .map((p) => ({\n          number: p.number,\n          title: p.title,\n          url: p.html_url,\n          mergedAt: p.merged_at as string,\n        }));\n    },\n    async dispatchWorkflow(repo, workflow, ref) {\n      const [owner, name, ...rest] = repo.split(\"/\");\n      if (!owner || !name || rest.length > 0) {\n        throw new Error(`dispatchWorkflow: expected \"owner/repo\", got \"${repo}\"`);\n      }\n      // Every segment interpolates into the API path, so guard them all like the\n      // other write methods do (defense in depth). `owner`/`name` are the most\n      // operator-controlled (typed into Airtable's \"Git repo\"); `workflow` is a\n      // constant today; `ref` is repo-sourced. A junk value like `repo?x=1` would\n      // otherwise smuggle a query string past the bare two-part shape check.\n      assertUrlSegment(\"path\", owner);\n      assertUrlSegment(\"path\", name);\n      assertUrlSegment(\"path\", workflow);\n      assertUrlSegment(\"branch\", ref);\n      await gh([\n        \"api\",\n        \"-X\",\n        \"POST\",\n        `repos/${owner}/${name}/actions/workflows/${workflow}/dispatches`,\n        \"-f\",\n        `ref=${ref}`,\n      ]);\n    },\n  };\n}\n"],"mappings":";;;;;AAmCO,SAAS,iBAAiB,MAAyB,OAAqB;AAC7E,QAAM,aAAa;AACnB,MAAI,MAAM,WAAW,KAAK,MAAM,WAAW,GAAG,KAAK,WAAW,KAAK,KAAK,GAAG;AACzE,UAAM,IAAI;AAAA,MACR,UAAU,IAAI,uDAAuD,KAAK,UAAU,KAAK,CAAC;AAAA,IAC5F;AAAA,EACF;AACF;AAGA,SAAS,eAAe,OAA2C;AACjE,UAAQ,OAAO;AAAA,IACb,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAKA,SAAS,aAAa,OAA+C;AACnE,SAAO,UAAU,eAAe,UAAU,gBAAgB,QAAQ;AACpE;AAqCO,SAAS,WAAW,MAAkD;AAC3E,QAAM,QAAQ,KAAK,SAAS;AAC5B,QAAM,MAAM,EAAE,GAAG,QAAQ,KAAK,UAAU,KAAK,MAAM;AAEnD,iBAAe,GAAG,MAAiC;AACjD,UAAM,IAAI,MAAM,MAAM,MAAM,MAAM,EAAE,KAAK,WAAW,IAAO,CAAC;AAC5D,QAAI,EAAE,SAAS,EAAG,OAAM,IAAI,MAAM,MAAM,KAAK,CAAC,CAAC,iBAAiB,EAAE,IAAI,MAAM,EAAE,OAAO,KAAK,CAAC,EAAE;AAC7F,WAAO,EAAE;AAAA,EACX;AAEA,SAAO;AAAA,IACL,MAAM,gBAAgB,MAAM,IAAI;AAC9B,YAAM,MAAM,MAAM,GAAG;AAAA,QACnB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,GAAG;AAAA,QACH;AAAA,QACA,GAAG;AAAA,QACH;AAAA,QACA,GAAG;AAAA,QACH;AAAA,QACA,GAAG;AAAA,MACL,CAAC;AACD,aAAO,EAAE,KAAK,IAAI,KAAK,EAAE;AAAA,IAC3B;AAAA,IACA,MAAM,oBAAoB,MAAM;AAC9B,YAAM,GAAG,CAAC,OAAO,MAAM,SAAS,SAAS,IAAI,IAAI,MAAM,uBAAuB,CAAC;AAAA,IACjF;AAAA,IACA,MAAM,cAAc,MAAM,QAAQ,gBAAgB;AAChD,uBAAiB,UAAU,MAAM;AACjC,YAAM,OAAO;AAAA,QACX;AAAA,QACA;AAAA,QACA;AAAA,QACA,SAAS,IAAI,aAAa,MAAM;AAAA,QAChC;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,GAAG,eAAe,QAAQ,CAAC,MAAM,CAAC,MAAM,sCAAsC,CAAC,EAAE,CAAC;AAAA,QAClF;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,YAAM,GAAG,IAAI;AAAA,IACf;AAAA,IACA,MAAM,cAAc,MAAM,MAAM,OAAO;AACrC,YAAM,GAAG,CAAC,UAAU,OAAO,MAAM,UAAU,MAAM,UAAU,KAAK,CAAC;AAAA,IACnE;AAAA,IACA,MAAM,WAAW,MAAM;AACrB,YAAM,IAAI,MAAM,MAAM,MAAM,CAAC,OAAO,SAAS,IAAI,EAAE,GAAG,EAAE,KAAK,WAAW,IAAO,CAAC;AAChF,aAAO,EAAE,SAAS;AAAA,IACpB;AAAA,IACA,MAAM,cAAc,MAAM;AACxB,YAAM,MAAM,MAAM,GAAG,CAAC,OAAO,SAAS,IAAI,IAAI,QAAQ,iBAAiB,CAAC;AACxE,aAAO,IAAI,KAAK;AAAA,IAClB;AAAA;AAAA;AAAA;AAAA;AAAA,IAKA,MAAM,cAAc,MAAM,QAAQ,OAAO;AACvC,uBAAiB,UAAU,MAAM;AACjC,YAAM,UAAoB,CAAC;AAC3B,iBAAW,KAAK,OAAO;AACrB,yBAAiB,QAAQ,CAAC;AAC1B,cAAM,IAAI,MAAM,MAAM,MAAM,CAAC,OAAO,SAAS,IAAI,aAAa,CAAC,QAAQ,MAAM,EAAE,GAAG;AAAA,UAChF;AAAA,UACA,WAAW;AAAA,QACb,CAAC;AACD,YAAI,EAAE,SAAS,EAAG,SAAQ,KAAK,CAAC;AAAA,MAClC;AACA,aAAO;AAAA,IACT;AAAA,IACA,MAAM,qBAAqB,MAAM,QAAQ,MAAM;AAK7C,uBAAiB,UAAU,MAAM;AACjC,uBAAiB,QAAQ,IAAI;AAC7B,YAAM,IAAI,MAAM;AAAA,QACd;AAAA,QACA;AAAA,UACE;AAAA,UACA,SAAS,IAAI,aAAa,IAAI,QAAQ,MAAM;AAAA,UAC5C;AAAA,UACA;AAAA,QACF;AAAA,QACA,EAAE,KAAK,WAAW,IAAO;AAAA,MAC3B;AACA,UAAI,EAAE,SAAS,EAAG,QAAO;AACzB,aAAO,EAAE;AAAA,IACX;AAAA,IACA,MAAM,yBAAyB,MAAM,QAAQ;AAC3C,uBAAiB,UAAU,MAAM;AACjC,YAAM,IAAI,MAAM;AAAA,QACd;AAAA,QACA;AAAA,UACE;AAAA,UACA,SAAS,IAAI,aAAa,MAAM;AAAA,UAChC;AAAA,UACA;AAAA,QACF;AAAA,QACA,EAAE,KAAK,WAAW,IAAO;AAAA,MAC3B;AACA,UAAI,EAAE,SAAS,EAAG,QAAO,CAAC;AAC1B,aAAO,EAAE,OACN,MAAM,IAAI,EACV,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC;AAAA,IAC/B;AAAA,IACA,MAAM,aAAa,MAAM,MAAM;AAG7B,YAAM,MAAM,MAAM,GAAG;AAAA,QACnB;AAAA,QACA,SAAS,IAAI;AAAA,QACb;AAAA,QACA;AAAA,MACF,CAAC;AACD,aAAO,IACJ,MAAM,IAAI,EACV,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,SAAS,IAAI;AAAA,IAClB;AAAA,IACA,MAAM,iBAAiB,MAAM;AAC3B,YAAM,MAAM,MAAM,GAAG,CAAC,OAAO,SAAS,IAAI,IAAI,QAAQ,mBAAmB,CAAC;AAC1E,aAAO,IAAI,KAAK,MAAM;AAAA,IACxB;AAAA,IACA,MAAM,uBAAuB,MAAM;AAGjC,YAAM,MAAM,MAAM,GAAG;AAAA,QACnB;AAAA,QACA,SAAS,IAAI;AAAA,QACb;AAAA,QACA;AAAA,MACF,CAAC;AACD,YAAM,QAAQ,IACX,MAAM,IAAI,EACV,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC;AAC3B,aAAO,SAAS;AAAA,IAClB;AAAA,IACA,MAAM,iBAAiB,MAAM;AAC3B,YAAM,CAAC,OAAO,MAAM,GAAG,IAAI,IAAI,KAAK,MAAM,GAAG;AAC7C,UAAI,CAAC,SAAS,CAAC,QAAQ,KAAK,SAAS,GAAG;AACtC,cAAM,IAAI,MAAM,iDAAiD,IAAI,GAAG;AAAA,MAC1E;AACA,YAAM,QACJ;AAGF,YAAM,MAAM,MAAM,GAAG;AAAA,QACnB;AAAA,QACA;AAAA,QACA;AAAA,QACA,SAAS,KAAK;AAAA,QACd;AAAA,QACA,SAAS,KAAK;AAAA,QACd;AAAA,QACA,QAAQ,IAAI;AAAA,MACd,CAAC;AACD,YAAM,SAAS,KAAK,MAAM,GAAG;AAkB7B,YAAM,QAAQ,OAAO,MAAM,YAAY,cAAc,SAAS,CAAC;AAC/D,aAAO,MAAM,IAAI,CAAC,OAAO;AAAA,QACvB,QAAQ,EAAE;AAAA,QACV,OAAO,EAAE;AAAA,QACT,KAAK,EAAE;AAAA,QACP,SAAS,EAAE;AAAA,QACX,SAAS,eAAe,EAAE,SAAS,QAAQ,CAAC,GAAG,QAAQ,mBAAmB,KAAK;AAAA,QAC/E,WAAW,aAAa,EAAE,SAAS;AAAA,MACrC,EAAE;AAAA,IACJ;AAAA,IACA,MAAM,oBAAoB,MAAM;AAC9B,YAAM,CAAC,OAAO,MAAM,GAAG,IAAI,IAAI,KAAK,MAAM,GAAG;AAC7C,UAAI,CAAC,SAAS,CAAC,QAAQ,KAAK,SAAS,GAAG;AACtC,cAAM,IAAI,MAAM,oDAAoD,IAAI,GAAG;AAAA,MAC7E;AACA,YAAM,QACJ;AAEF,YAAM,MAAM,MAAM,GAAG;AAAA,QACnB;AAAA,QACA;AAAA,QACA;AAAA,QACA,SAAS,KAAK;AAAA,QACd;AAAA,QACA,SAAS,KAAK;AAAA,QACd;AAAA,QACA,QAAQ,IAAI;AAAA,MACd,CAAC;AACD,YAAM,SAAS,KAAK,MAAM,GAAG;AAS7B,YAAM,SAAS,OAAO,MAAM,YAAY,kBAAkB;AAC1D,aAAO;AAAA,QACL,SAAS,eAAe,QAAQ,mBAAmB,KAAK;AAAA,QACxD,cAAc,QAAQ,iBAAiB;AAAA,MACzC;AAAA,IACF;AAAA,IACA,MAAM,2BAA2B,MAAM,UAAU;AAC/C,YAAM,CAAC,OAAO,MAAM,GAAG,IAAI,IAAI,KAAK,MAAM,GAAG;AAC7C,UAAI,CAAC,SAAS,CAAC,QAAQ,KAAK,SAAS,GAAG;AACtC,cAAM,IAAI,MAAM,2DAA2D,IAAI,GAAG;AAAA,MACpF;AAGA,YAAM,MAAM,MAAM,GAAG;AAAA,QACnB;AAAA,QACA,SAAS,KAAK,IAAI,IAAI;AAAA,MACxB,CAAC;AACD,YAAM,MAAM,KAAK,MAAM,GAAG;AAO1B,aAAO,IACJ;AAAA,QACC,CAAC,MACC,EAAE,cAAc,QAChB,EAAE,aAAa;AAAA,SACd,EAAE,MAAM,OAAO,IAAI,WAAW,WAAW;AAAA,MAC9C,EACC,IAAI,CAAC,OAAO;AAAA,QACX,QAAQ,EAAE;AAAA,QACV,OAAO,EAAE;AAAA,QACT,KAAK,EAAE;AAAA,QACP,UAAU,EAAE;AAAA,MACd,EAAE;AAAA,IACN;AAAA,IACA,MAAM,iBAAiB,MAAM,UAAU,KAAK;AAC1C,YAAM,CAAC,OAAO,MAAM,GAAG,IAAI,IAAI,KAAK,MAAM,GAAG;AAC7C,UAAI,CAAC,SAAS,CAAC,QAAQ,KAAK,SAAS,GAAG;AACtC,cAAM,IAAI,MAAM,iDAAiD,IAAI,GAAG;AAAA,MAC1E;AAMA,uBAAiB,QAAQ,KAAK;AAC9B,uBAAiB,QAAQ,IAAI;AAC7B,uBAAiB,QAAQ,QAAQ;AACjC,uBAAiB,UAAU,GAAG;AAC9B,YAAM,GAAG;AAAA,QACP;AAAA,QACA;AAAA,QACA;AAAA,QACA,SAAS,KAAK,IAAI,IAAI,sBAAsB,QAAQ;AAAA,QACpD;AAAA,QACA,OAAO,GAAG;AAAA,MACZ,CAAC;AAAA,IACH;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-O65I7G7G.js → chunk-ZO7WNY57.js}

@@ -1,6 +1,6 @@
 import {
   applyGotchaCodemods
-} from "./chunk-OQPMZ6BM.js";
+} from "./chunk-J7SZQUCW.js";
 import {
   withRecipe
 } from "./chunk-XKOZUVK2.js";
@@ -243,4 +243,4 @@ async function upgradeSvelte4to5(site, opts = {}) {
 export {
   upgradeSvelte4to5
 };
-//# sourceMappingURL=chunk-O65I7G7G.js.map
+//# sourceMappingURL=chunk-ZO7WNY57.js.map

package/dist/cli/bin.js

@@ -105,7 +105,7 @@ cli.command("sync-configs [site]", "Sync canonical configs into a site.").option
   'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../sync-configs-NYC3Z625.js")).runSyncConfigsCommand(site, opts),
+    async () => (await import("../sync-configs-TPJMRNRU.js")).runSyncConfigsCommand(site, opts),
     opts
   )
 );
@@ -114,7 +114,7 @@ cli.command("bump-deps [site]", "Bump dependencies.").option("--group <group>",
   'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../bump-deps-3QQHYDKJ.js")).runBumpDepsCommand(site, opts),
+    async () => (await import("../bump-deps-2MAMI7DB.js")).runBumpDepsCommand(site, opts),
     opts
   )
 );
@@ -123,7 +123,7 @@ cli.command(
   "Bootstrap a repo to keep itself updated (CI + Renovate + auto-merge)."
 ).option("--dry", "List what would be enabled without writing or opening PRs").option("--fleet <inventory>", 'Inventory file (.json or .mjs/.js), or "airtable"').option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../self-updating-YXOGQWH5.js")).runSelfUpdatingCommand(site, opts),
+    async () => (await import("../self-updating-VXVJSV5T.js")).runSelfUpdatingCommand(site, opts),
     opts
   )
 );
@@ -132,7 +132,7 @@ cli.command("upgrade <upgrade> [site]", "Run a named upgrade recipe (svelte-4-to
   'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (upgrade, site, opts) => runOrExit(
-    async () => (await import("../upgrade-UBPPJ6HN.js")).runUpgradeCommand(upgrade, site, opts),
+    async () => (await import("../upgrade-7TN2XPFK.js")).runUpgradeCommand(upgrade, site, opts),
     opts
   )
 );
@@ -144,7 +144,7 @@ cli.command(
   'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../convert-to-pnpm-ZO673UFB.js")).runConvertToPnpmCommand(site, opts),
+    async () => (await import("../convert-to-pnpm-3OEHYF76.js")).runConvertToPnpmCommand(site, opts),
     opts
   )
 );
@@ -153,7 +153,7 @@ cli.command("svelte-codemods [site]", "Apply Svelte 5 gotcha codemods to an alre
   'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../svelte-codemods-745QM25J.js")).runSvelteCodemodsCommand(site, opts),
+    async () => (await import("../svelte-codemods-5RXRRTMK.js")).runSvelteCodemodsCommand(site, opts),
     opts
   )
 );
@@ -165,7 +165,7 @@ cli.command(
   'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../onboard-K2EL4MSG.js")).runOnboardCommand(site, opts),
+    async () => (await import("../onboard-2PLVVJWN.js")).runOnboardCommand(site, opts),
     opts
   )
 );
@@ -176,14 +176,14 @@ cli.command(
   "--fleet <inventory>",
   'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
-  async (site, opts) => runOrExit(async () => (await import("../init-FOHNISF2.js")).runInitCommand(site, opts), opts)
+  async (site, opts) => runOrExit(async () => (await import("../init-VA3H4OHM.js")).runInitCommand(site, opts), opts)
 );
 cli.command(
   "launch <site>",
   "Bootstrap + first-audit a site, then draft its launch email for approval."
 ).action(
   async (site, opts) => runOrExit(
-    async () => (await import("../launch-TM3IHSSU.js")).runLaunchCommand(site, opts),
+    async () => (await import("../launch-OMHMW5OK.js")).runLaunchCommand(site, opts),
     opts
   )
 );
@@ -192,7 +192,7 @@ cli.command(
   "Draft the monthly-report announcement email for maintenance sites (all, or one) for approval."
 ).action(
   async (site, opts) => runOrExit(
-    async () => (await import("../announce-GFLKAPTT.js")).runAnnounceCommand(site, opts),
+    async () => (await import("../announce-WXWOHR2I.js")).runAnnounceCommand(site, opts),
     opts
   )
 );
@@ -201,7 +201,7 @@ cli.command(
   "Operator self-tests. kind=email: preview a report email for a site (or --all) to yourself."
 ).option("--type <type>", "Report type: announcement (default) | maintenance | testing | launch").option("--to <addr>", "Recipient(s), comma-separated. Default: OPERATOR_EMAIL.").option("--all", "Send a preview for every maintenance site (to --to/operator).").option("--dry-run", "Render only; write reports/<slug>/selftest-<type>.html; do not send.").action(
   async (kind, site, opts) => runOrExit(
-    async () => (await import("../selftest-VE7CSGWE.js")).runSelftestCommand(kind, site, opts),
+    async () => (await import("../selftest-FV4MO7TX.js")).runSelftestCommand(kind, site, opts),
     opts
   )
 );
@@ -216,7 +216,7 @@ cli.command("report [site]", "Draft or send maintenance/testing reports.").optio
   "Email the operator one daily digest of reports ready for approval (skips when empty)."
 ).action(
   async (site, opts) => runOrExit(
-    async () => (await import("../report-UEYKO6WH.js")).runReportCommand(site, opts),
+    async () => (await import("../report-X3XPBRBO.js")).runReportCommand(site, opts),
     opts
   )
 );
@@ -225,7 +225,7 @@ cli.command(
   "Sweep the fleet for GitHub signals (Renovate-failing/CI/last-commit) and write Airtable."
 ).option("--fleet", "Run across every site in the Airtable inventory.").option("--write-airtable", "Write each site's signals back to its Websites row.").action(
   async (opts) => runOrExit(
-    async () => (await import("../github-signals-N5JGWHW2.js")).runGitHubSignalsCommand({
+    async () => (await import("../github-signals-H7VU4EOH.js")).runGitHubSignalsCommand({
       fleet: opts.fleet,
       writeAirtable: opts.writeAirtable
     }),
@@ -243,7 +243,7 @@ cli.command(
   "Trigger Renovate on fleet sites the security sweep flagged with critical/high vulns."
 ).option("--fleet", "Run across every active, repo-backed site in the Airtable inventory.").action(
   async (opts) => runOrExit(
-    async () => (await import("../renovate-dispatch-H25CQ36P.js")).runRenovateDispatchCommand({
+    async () => (await import("../renovate-dispatch-K6VO5KWM.js")).runRenovateDispatchCommand({
       fleet: opts.fleet
     }),
     opts

package/dist/cli/commands/audit.js

@@ -8,11 +8,11 @@ import {
 } from "../../chunk-4NAOR44V.js";
 import {
   resolveSites
-} from "../../chunk-FH7WQHD7.js";
+} from "../../chunk-VUKSRWRD.js";
 import {
   ALL_AUDIT_NAMES,
   runOneAudit
-} from "../../chunk-TC7Z5LG7.js";
+} from "../../chunk-WCN54744.js";
 import "../../chunk-LKGVSM2O.js";
 import {
   recordFleetEventsBestEffort
@@ -20,7 +20,7 @@ import {
 import "../../chunk-PTPTVVY7.js";
 import "../../chunk-XKKTK6WA.js";
 import "../../chunk-GASBX52O.js";
-import "../../chunk-4GACMVNE.js";
+import "../../chunk-YEGHUODU.js";
 import "../../chunk-FDIFTIXC.js";
 import "../../chunk-HVOOCK6L.js";
 import "../../chunk-XXTZBPUY.js";
@@ -231,9 +231,9 @@ ${skipNotice}`;
   let writeBackFailed = false;
   if (opts.writeAirtable !== void 0) {
     const { openBase, readAirtableConfig } = await import("../../client-EPVO3FEH.js");
-    const { listWebsites } = await import("../../websites-CSVLSEVL.js");
+    const { listWebsites } = await import("../../websites-EIPNY4DY.js");
     if (opts.fleet !== void 0) {
-      const { writeFleetAuditsToAirtable, formatFleetWriteSummary } = await import("../../write-audits-to-airtable-JCV7FYAW.js");
+      const { writeFleetAuditsToAirtable, formatFleetWriteSummary } = await import("../../write-audits-to-airtable-WVWFESZW.js");
       const base = openBase(readAirtableConfig());
       const websites = await listWebsites(base);
       const fleetWrite = await writeFleetAuditsToAirtable({ base, websites, results });
@@ -249,8 +249,8 @@ ${skipNotice}`;
 
 ${formatFleetWriteSummary(fleetWrite)}`;
     } else {
-      const { resolveSlugFromCwd } = await import("../../lighthouse-airtable-5FHELRCA.js");
-      const { writeAuditsToAirtable } = await import("../../write-audits-to-airtable-JCV7FYAW.js");
+      const { resolveSlugFromCwd } = await import("../../lighthouse-airtable-4KWC3P72.js");
+      const { writeAuditsToAirtable } = await import("../../write-audits-to-airtable-WVWFESZW.js");
       const slug = typeof opts.writeAirtable === "string" && opts.writeAirtable.length > 0 ? opts.writeAirtable : await resolveSlugFromCwd(cwd);
       let writeSummary = null;
       await new Listr(

package/dist/{convert-to-pnpm-ZO673UFB.js → convert-to-pnpm-3OEHYF76.js}

@@ -1,3 +1,6 @@
+import {
+  runRecipeOverSites
+} from "./chunk-VPJ7N6P7.js";
 import {
   appendSkipNotice,
   fleetWorkdir,
@@ -5,7 +8,7 @@ import {
 } from "./chunk-4NAOR44V.js";
 import {
   resolveSites
-} from "./chunk-FH7WQHD7.js";
+} from "./chunk-VUKSRWRD.js";
 import {
   convertToPnpm
 } from "./chunk-2X322ZES.js";
@@ -39,8 +42,7 @@ async function runConvertToPnpmCommand(site, opts) {
     sites = prep.prepared;
     skipped = prep.skipped;
   }
-  const results = [];
-  for (const s of sites) results.push(await convertToPnpm(s));
+  const results = await runRecipeOverSites("convert-to-pnpm", sites, (s) => convertToPnpm(s));
   const output = results.map(formatResult).join("\n");
   const code = results.some((r) => r.status === "failed") ? 1 : 0;
   return { output: appendSkipNotice(output, skipped), code };
@@ -48,4 +50,4 @@ async function runConvertToPnpmCommand(site, opts) {
 export {
   runConvertToPnpmCommand
 };
-//# sourceMappingURL=convert-to-pnpm-ZO673UFB.js.map
+//# sourceMappingURL=convert-to-pnpm-3OEHYF76.js.map

package/dist/convert-to-pnpm-3OEHYF76.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli/commands/convert-to-pnpm.ts"],"sourcesContent":["import { resolve } from \"node:path\";\nimport { convertToPnpm } from \"../../recipes/convert-to-pnpm.js\";\nimport type { RecipeResult } from \"../../types.js\";\nimport { resolveSites } from \"../fleet/resolve-sites.js\";\nimport { prepareFleetSites, appendSkipNotice, type SkippedSite } from \"../fleet/prepare-sites.js\";\nimport { runRecipeOverSites } from \"../fleet/run-recipe-over-sites.js\";\nimport { fleetWorkdir } from \"../../util/fleet-workdir.js\";\n\nexport type ConvertToPnpmCommandOptions = {\n  fleet?: string;\n  workdir?: string;\n  cwd?: string;\n};\n\nfunction formatResult(r: RecipeResult): string {\n  if (r.status === \"noop\") return `[${r.site}] noop: ${r.notes ?? \"\"}`;\n  if (r.status === \"failed\") return `[${r.site}] failed: ${r.notes ?? \"\"}`;\n  return `[${r.site}] applied: ${r.commits.length} commit(s)\\n${r.notes ?? \"\"}`;\n}\n\nexport async function runConvertToPnpmCommand(\n  site: string | undefined,\n  opts: ConvertToPnpmCommandOptions,\n): Promise<{ output: string; code: number }> {\n  const cwd = opts.cwd ? resolve(opts.cwd) : process.cwd();\n\n  let sites = await resolveSites({\n    ...(site !== undefined ? { site } : {}),\n    ...(opts.fleet !== undefined ? { fleet: opts.fleet } : {}),\n    cwd,\n  });\n\n  let skipped: SkippedSite[] = [];\n  if (opts.fleet) {\n    const workdir = opts.workdir ?? fleetWorkdir();\n    const prep = await prepareFleetSites(sites, { workdir });\n    sites = prep.prepared;\n    skipped = prep.skipped;\n  }\n\n  const results = await runRecipeOverSites(\"convert-to-pnpm\", sites, (s) => convertToPnpm(s));\n\n  const output = results.map(formatResult).join(\"\\n\");\n  const code = results.some((r) => r.status === \"failed\") ? 1 : 0;\n  return { output: appendSkipNotice(output, skipped), code };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,eAAe;AAcxB,SAAS,aAAa,GAAyB;AAC7C,MAAI,EAAE,WAAW,OAAQ,QAAO,IAAI,EAAE,IAAI,WAAW,EAAE,SAAS,EAAE;AAClE,MAAI,EAAE,WAAW,SAAU,QAAO,IAAI,EAAE,IAAI,aAAa,EAAE,SAAS,EAAE;AACtE,SAAO,IAAI,EAAE,IAAI,cAAc,EAAE,QAAQ,MAAM;AAAA,EAAe,EAAE,SAAS,EAAE;AAC7E;AAEA,eAAsB,wBACpB,MACA,MAC2C;AAC3C,QAAM,MAAM,KAAK,MAAM,QAAQ,KAAK,GAAG,IAAI,QAAQ,IAAI;AAEvD,MAAI,QAAQ,MAAM,aAAa;AAAA,IAC7B,GAAI,SAAS,SAAY,EAAE,KAAK,IAAI,CAAC;AAAA,IACrC,GAAI,KAAK,UAAU,SAAY,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAAA,IACxD;AAAA,EACF,CAAC;AAED,MAAI,UAAyB,CAAC;AAC9B,MAAI,KAAK,OAAO;AACd,UAAM,UAAU,KAAK,WAAW,aAAa;AAC7C,UAAM,OAAO,MAAM,kBAAkB,OAAO,EAAE,QAAQ,CAAC;AACvD,YAAQ,KAAK;AACb,cAAU,KAAK;AAAA,EACjB;AAEA,QAAM,UAAU,MAAM,mBAAmB,mBAAmB,OAAO,CAAC,MAAM,cAAc,CAAC,CAAC;AAE1F,QAAM,SAAS,QAAQ,IAAI,YAAY,EAAE,KAAK,IAAI;AAClD,QAAM,OAAO,QAAQ,KAAK,CAAC,MAAM,EAAE,WAAW,QAAQ,IAAI,IAAI;AAC9D,SAAO,EAAE,QAAQ,iBAAiB,QAAQ,OAAO,GAAG,KAAK;AAC3D;","names":[]}

package/dist/{digest-R3ROSGLP.js → digest-BTHXYYQZ.js}

@@ -8,7 +8,7 @@ import {
   diffAttention,
   readDigestState,
   writeDigestState
-} from "./chunk-4A5PYCGB.js";
+} from "./chunk-IMMB64VH.js";
 import {
   isIdempotencyConflict
 } from "./chunk-OGGRFBL4.js";
@@ -20,7 +20,7 @@ import {
 import {
   listWebsites,
   siteSlug
-} from "./chunk-7RGQ4KLE.js";
+} from "./chunk-CCXVX5JN.js";
 import {
   openBase,
   readAirtableConfig
@@ -226,4 +226,4 @@ export {
   renderDigestHtml,
   runDigest
 };
-//# sourceMappingURL=digest-R3ROSGLP.js.map
+//# sourceMappingURL=digest-BTHXYYQZ.js.map

package/dist/{github-signals-N5JGWHW2.js → github-signals-H7VU4EOH.js}

@@ -3,8 +3,8 @@ import {
 } from "./chunk-PZQ3WED2.js";
 import {
   formatFleetWriteSummary
-} from "./chunk-LM42CATB.js";
-import "./chunk-CSTLFSGM.js";
+} from "./chunk-MEP6PR32.js";
+import "./chunk-N5MZ6WRX.js";
 import {
   detectSignalEvents,
   fleetSweptEvent
@@ -16,13 +16,13 @@ import "./chunk-PTPTVVY7.js";
 import "./chunk-XKKTK6WA.js";
 import {
   makeGitHub
-} from "./chunk-4GACMVNE.js";
+} from "./chunk-YEGHUODU.js";
 import "./chunk-HVOOCK6L.js";
 import {
   listWebsites,
   siteSlug,
   updateGitHubSignals
-} from "./chunk-7RGQ4KLE.js";
+} from "./chunk-CCXVX5JN.js";
 import {
   openBase,
   readAirtableConfig
@@ -134,4 +134,4 @@ export {
   githubSignalsExitCode,
   runGitHubSignalsCommand
 };
-//# sourceMappingURL=github-signals-N5JGWHW2.js.map
+//# sourceMappingURL=github-signals-H7VU4EOH.js.map

package/dist/index.d.ts

@@ -69,10 +69,12 @@ type BrowserRunner = {
 };
 
 /** Result of probing a site's latest PRODUCTION Netlify deploy. Every field is
- *  nullable: a network/parse failure (or a site with no deploys yet) degrades to
- *  all-nulls rather than throwing, so the audit always returns a verdict.
+ *  nullable: a site with no production deploy yet degrades to all-nulls (a real
+ *  "none" verdict). A read FAILURE is NOT represented here — it surfaces as
+ *  `{ ok: false }` on the enclosing `NetlifyDeployFetch` so it can't be mistaken
+ *  for a verdict. See `NetlifyDeployFetch`.
  *  - `state` is Netlify's raw deploy state (`ready`/`error`/`building`/…), lower-cased,
- *    or null when it couldn't be read.
+ *    or null when the site has no production deploy.
  *  - `deployedAt` is the deploy's publish/create time (ISO), or null.
  *  - `logUrl` links to the deploy (its live URL or the Netlify admin/build-log page).
  *  - `errorMessage` is Netlify's `error_message` for a failed build, or null. */
@@ -82,12 +84,28 @@ type NetlifyDeployCheck = {
     logUrl: string | null;
     errorMessage: string | null;
 };
+/** Outcome of probing Netlify, distinguishing "couldn't read" from "read OK".
+ *  This distinction is load-bearing: `Deploy status` drives the cockpit's Broken
+ *  band (an ALARM), so a transient read failure must NOT be allowed to clear a
+ *  real `error` — unlike a degraded "no deploy yet", which is a real verdict.
+ *  - `{ ok: false }` — the API was unreachable/unreadable (network error, non-2xx,
+ *    malformed body). The caller persists nothing, leaving the prior status intact.
+ *  - `{ ok: true, deploy }` — the API answered. `deploy` is the latest production
+ *    deploy, or all-nulls when the site genuinely has no production deploy yet
+ *    (a real verdict, safe to persist). */
+type NetlifyDeployFetch = {
+    ok: false;
+} | {
+    ok: true;
+    deploy: NetlifyDeployCheck;
+};
 /** Injected IO so the check is unit-testable without hitting the Netlify API.
- *  `fetchLatestProductionDeploy` returns the parsed first (latest) production
- *  deploy object, or null when the site has none / the call failed. `now` is the
- *  clock for the checked-at stamp. */
+ *  `fetchLatestProductionDeploy` returns a `NetlifyDeployFetch` — `{ ok: false }`
+ *  when the call couldn't be read, else `{ ok: true, deploy }` with the latest
+ *  production deploy (or all-nulls for a site with none). `now` is the clock for
+ *  the checked-at stamp. */
 type NetlifyDeployDeps = {
-    fetchLatestProductionDeploy: (siteId: string) => Promise<NetlifyDeployCheck | null>;
+    fetchLatestProductionDeploy: (siteId: string) => Promise<NetlifyDeployFetch>;
     now: Date;
 };
 
@@ -359,6 +377,10 @@ type WebsiteRow = {
     /** Real installed-version drift: deps behind the registry's latest, from the
      *  committed lockfile (`pnpm outdated`). Null = not determined this run. */
     depsOutdated: number | null;
+    /** Of {@link depsOutdated}, how many are a *major* version behind the
+     *  registry's latest — the "majors available on npm" signal, distinct from the
+     *  baseline-drift {@link depsMajorBehind}. Null = not determined this run. */
+    depsMajorOutdated: number | null;
     securityVulnsCritical: number | null;
     securityVulnsHigh: number | null;
     securityVulnsModerate: number | null;

package/dist/index.js

@@ -1,22 +1,22 @@
-import "./chunk-4A5PYCGB.js";
+import "./chunk-IMMB64VH.js";
 import {
   findDueReports
 } from "./chunk-WVRPOXKH.js";
 import {
   upgradeSvelte4to5
-} from "./chunk-O65I7G7G.js";
+} from "./chunk-ZO7WNY57.js";
 import {
   DEFAULT_INIT_STEPS,
   a11yFixturesPage,
   init
-} from "./chunk-FX3QBSUF.js";
+} from "./chunk-LCKKIJ22.js";
 import {
   convertToPnpm
 } from "./chunk-2X322ZES.js";
 import {
   svelteCodemods
-} from "./chunk-FUD4I2ZW.js";
-import "./chunk-OQPMZ6BM.js";
+} from "./chunk-BTEBRTW4.js";
+import "./chunk-J7SZQUCW.js";
 import {
   onboard,
   selfCaretRange,
@@ -24,11 +24,11 @@ import {
 } from "./chunk-ZYBOT5PM.js";
 import {
   draftReportForSite
-} from "./chunk-M5LX2VSR.js";
+} from "./chunk-JWA4FO2J.js";
 import "./chunk-6LIWDIXU.js";
 import {
   sendApprovedReports
-} from "./chunk-QSL3EJGI.js";
+} from "./chunk-WXNSLK4Q.js";
 import "./chunk-OGGRFBL4.js";
 import "./chunk-GECESMVS.js";
 import {
@@ -36,7 +36,7 @@ import {
   CHECK_CID,
   loadBundledImages,
   renderReportHtml
-} from "./chunk-U3MF6RCS.js";
+} from "./chunk-SYTPVYIK.js";
 import {
   checklistFor,
   escapeHtml,
@@ -62,13 +62,13 @@ import {
   runAudits,
   runAuditsAcross,
   securityAudit
-} from "./chunk-TC7Z5LG7.js";
+} from "./chunk-WCN54744.js";
 import "./chunk-LKGVSM2O.js";
 import "./chunk-G2YRXV26.js";
 import "./chunk-PTPTVVY7.js";
 import "./chunk-XKKTK6WA.js";
 import "./chunk-GASBX52O.js";
-import "./chunk-4GACMVNE.js";
+import "./chunk-YEGHUODU.js";
 import {
   fromJsonFile,
   localPath
@@ -78,12 +78,12 @@ import "./chunk-XXTZBPUY.js";
 import "./chunk-XTK5VIQB.js";
 import {
   fromAirtableBase
-} from "./chunk-MQM5YP4J.js";
+} from "./chunk-ARHDSMFK.js";
 import "./chunk-U5SZ4FOP.js";
 import {
   SEVERITY_RANK,
   siteSlug
-} from "./chunk-7RGQ4KLE.js";
+} from "./chunk-CCXVX5JN.js";
 import "./chunk-HN6I2XWI.js";
 import "./chunk-WEKL2HYJ.js";
 import "./chunk-6VAL7XJT.js";
@@ -749,13 +749,13 @@ function a11ySpan(value) {
   const display = value === null ? DASH2 : String(value);
   return `<span class="metric a11y">${escapeHtml(display)}</span>`;
 }
-function depsSpan(drifted, majorBehind, outdated) {
+function depsSpan(drifted, majorBehind, outdated, majorOutdated) {
   if (drifted === null || majorBehind === null) {
     return `<span class="metric deps">${DASH2}</span>`;
   }
   const driftPart = drifted === 0 ? "0" : `${drifted} drifted (${majorBehind} major)`;
-  const display = outdated === null ? driftPart : `${driftPart} \xB7 ${outdated} outdated`;
-  return `<span class="metric deps">${escapeHtml(display)}</span>`;
+  const outdatedPart = outdated === null ? "" : ` \xB7 ${outdated} outdated${majorOutdated === null ? "" : ` (${majorOutdated} major)`}`;
+  return `<span class="metric deps">${escapeHtml(driftPart + outdatedPart)}</span>`;
 }
 function securitySpan(critical, high, moderate, low) {
   if (critical === null || high === null || moderate === null || low === null) {
@@ -792,7 +792,7 @@ function card(site) {
       </span>
       <span class="cluster health">
         <span class="metric-label">a11y</span> ${a11ySpan(site.a11yViolations)}
-        <span class="metric-label">deps</span> ${depsSpan(site.depsDrifted, site.depsMajorBehind, site.depsOutdated)}
+        <span class="metric-label">deps</span> ${depsSpan(site.depsDrifted, site.depsMajorBehind, site.depsOutdated, site.depsMajorOutdated)}
         <span class="metric-label">sec</span> ${securitySpan(
     site.securityVulnsCritical,
     site.securityVulnsHigh,