@reddoorla/maintenance 0.69.0 → 0.72.0

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { a as AuditResult, S as Site, A as AuditName, b as RecipeResult, R as RecipeName, I as InventoryProvider } from './types-Dg4mHvyf.js';
-export { C as ConfigName } from './types-Dg4mHvyf.js';
+import { a as AuditResult, S as Site, A as AuditName, b as RecipeResult, R as RecipeName, I as InventoryProvider } from './types-0jreMCF5.js';
+export { C as ConfigName } from './types-0jreMCF5.js';
 import * as airtable_lib_airtable_base_js from 'airtable/lib/airtable_base.js';
 import { F as FormType } from './types-RXY-vY-5.js';
 export { SyncConfigsOptions, syncConfigs } from './recipes/sync-configs.js';
@@ -41,7 +41,9 @@ type DiscoverDeps = {
     fetchText: (url: string) => Promise<string | null>;
 };
 
-/** One route probed across desktop engines + mobile devices, plus the internal links found on it. */
+/** One route probed across desktop engines + mobile devices, plus the internal links found on it,
+ *  plus the chromium-derived reachability + SEO signals (captured on the page chromium already
+ *  opened — no extra navigation). */
 type RouteResult = {
     url: string;
     /** Per desktop engine (chromium/firefox/webkit): loaded with no JS error + a visible main landmark. */
@@ -56,6 +58,12 @@ type RouteResult = {
     }>;
     /** Same-origin links discovered on the page (absolute URLs), for the Links check. */
     links: string[];
+    /** HTTP status of the chromium navigation (2xx/3xx = reachable). null = the nav failed/threw. */
+    status: number | null;
+    /** The chromium `<title>` (trimmed by the reducer), or null when not captured. */
+    title: string | null;
+    /** The chromium `meta[name="description"]` content, or null when absent/not captured. */
+    metaDescription: string | null;
 };
 type LinkResult = {
     url: string;
@@ -68,6 +76,29 @@ type BrowserRunner = {
     close?: () => Promise<void>;
 };
 
+/** Outcome of driving one site's contact form. `formPresent:false` ⇒ n/a
+ *  (persisted). `testModeUndeclared` ⇒ the site's /health does not declare
+ *  `forms.testMode`, so the probe refused to submit — a plain skip, prior
+ *  verdict preserved. */
+type FormSubmitOutcome = {
+    formPresent: false;
+} | {
+    formPresent: true;
+    success: boolean;
+    detail?: string;
+} | {
+    testModeUndeclared: true;
+};
+/** Injected browser IO. The real impl drives Playwright; tests pass a fake. */
+type FormRunner = {
+    submit: (opts: {
+        baseUrl: string;
+        testMode: boolean;
+        testSitekey: string;
+    }) => Promise<FormSubmitOutcome>;
+    close?: () => Promise<void>;
+};
+
 /** Result of probing a site's latest PRODUCTION Netlify deploy. Every field is
  *  nullable: a site with no production deploy yet degrades to all-nulls (a real
  *  "none" verdict). A read FAILURE is NOT represented here — it surfaces as
@@ -109,6 +140,38 @@ type NetlifyDeployDeps = {
     now: Date;
 };
 
+/** The parts of the deployed `/health` body this audit reads. `ok` is the endpoint's self-rollup
+ *  (`functionRan && prismic !== "error"`); `prismic` is the server-side CMS probe status; `forms`
+ *  are booleans recorded for the dashboard only. A public endpoint can return anything, so every
+ *  field is validated/coerced by `parseHealthBody`. */
+type HealthBody = {
+    ok: boolean;
+    prismic: "ok" | "error" | "skipped" | null;
+    forms: {
+        ingestUrl: boolean;
+        ingestToken: boolean;
+        turnstile: boolean;
+    } | null;
+};
+/** Outcome of fetching `{deployedUrl}/health`, distinguishing "no usable report" (`present:false`
+ *  → self-skip, the writer preserves the prior verdict) from "read a body" (`present:true`
+ *  → a real pass/fail). `present:true` with a real `HealthBody` is a 200 JSON response (`ok`
+ *  drives pass/fail); the fetch layer also synthesizes an all-`ok:false` body for "deployed but
+ *  erroring" responses (a non-404 non-2xx, or a 200 that isn't valid JSON) so those fail loudly
+ *  instead of silently skipping. Mirrors `netlify-deploy`'s `NetlifyDeployFetch` read/no-read split. */
+type HealthFetch = {
+    present: false;
+} | {
+    present: true;
+    body: HealthBody;
+};
+/** Injected IO so the audit is unit-testable without a network. `fetchHealth` returns a
+ *  `HealthFetch`; `now` is the clock for the checked-at stamp. */
+type FunctionHealthDeps = {
+    fetchHealth: (deployedUrl: string) => Promise<HealthFetch>;
+    now: Date;
+};
+
 /** One GitHub Dependabot alert, mapped to the fields the security audit needs. */
 type DependabotAlert = {
     /** The vulnerable package name (`dependency.package.name`). */
@@ -147,8 +210,12 @@ type AuditContext = {
     discoverDeps?: DiscoverDeps;
     /** Playwright runner injection for the browser audit (tests). Defaults to real Playwright. */
     browserRunner?: BrowserRunner;
+    /** Playwright runner injection for the form-e2e audit (tests). Defaults to real Playwright. */
+    formRunner?: FormRunner;
     /** Netlify API injection for the netlify-deploy audit (tests). Defaults to a real API call. */
     netlifyDeployDeps?: NetlifyDeployDeps;
+    /** `/health` fetch injection for the function-health audit (tests). Defaults to a real GET. */
+    functionHealthDeps?: FunctionHealthDeps;
     /** GitHub Dependabot fetch injection for the security audit (tests). Defaults to a real client
      *  from GITHUB_TOKEN; absent token or no site.gitRepo → the pnpm/npm audit fallback. */
     dependabotDeps?: DependabotDeps;
@@ -250,10 +317,11 @@ type InitOptions = {
     steps?: InitStep[];
 };
 /** convert-to-pnpm → onboard → sync-configs → svelte-codemods →
- * a11y-fixtures-page → audit. Order is deliberate — every step depends on
- * the prior one's output (pnpm before onboard's installs, onboard's deps
- * before sync-configs writes lighthouserc, fixtures page before audit
- * actually has a route to hit). */
+ * a11y-fixtures-page → health-endpoint → smoke-suite → audit. Order is
+ * deliberate — every step depends on the prior one's output (pnpm before
+ * onboard's installs, onboard's deps before sync-configs writes lighthouserc,
+ * fixtures page before audit actually has a route to hit; smoke-suite's
+ * `pnpm install` lands before the closing audit). */
 declare const DEFAULT_INIT_STEPS: InitStep[];
 /**
  * One-shot guided onboarding. Runs the default step sequence against a
@@ -296,11 +364,15 @@ type AirtableInventoryOptions = {
 /**
  * Read sites from the Airtable Websites table as an InventoryProvider.
  * Each row becomes one Site; `path` is computed as `{workdir}/{slug}`.
- * Only `maintenance` / `launch period` sites that have a `url` are included
- * (the live sites we audit + report on). The production URL is exposed as
- * `Site.deployedUrl` so the lighthouse audit can run against it with no
- * checkout. `repoUrl` is intentionally NOT set from `url` — a clone source
- * must come from `gitRepo` (`owner/repo`), never the production URL.
+ * Only LIVE `maintenance` sites that have a `url` are included — pre-launch
+ * stages ("launch period" / "in development", via isPreLaunch) are excluded so a
+ * not-yet-live site is never audited as production (its deploy/domain/uptime/CMS
+ * audits would fail against nothing and red its Airtable row) nor swept by other
+ * `--fleet airtable` ops; it re-enters the fleet when a Launch report flips its
+ * Status to "maintenance". The production URL is exposed as `Site.deployedUrl` so
+ * the lighthouse audit can run against it with no checkout. `repoUrl` is
+ * intentionally NOT set from `url` — a clone source must come from `gitRepo`
+ * (`owner/repo`), never the production URL.
  */
 declare function fromAirtableBase(base: AirtableBase, opts?: AirtableInventoryOptions): InventoryProvider;
 
@@ -334,9 +406,10 @@ type WebsiteRow = {
     maintenanceFreq: Frequency;
     testingFreq: Frequency;
     /** The literal Airtable cell values behind the coerced frequencies. `toFrequency`
-     *  maps any unrecognized value ("Quaterly", "Monthly ") to "None" so nothing bogus
-     *  reaches a client email — which also makes typos invisible downstream. Preflight
-     *  validates THESE to make that failure mode loud. Null = blank cell. */
+     *  trims whitespace ("Monthly " reads as Monthly), then maps any still-unrecognized
+     *  value ("Quaterly") to "None" with a LOUD console.warn so nothing bogus reaches a
+     *  client email and the drop is never invisible. Preflight validates THESE to surface
+     *  the same failure as a structured finding. Null = blank cell. */
     maintenanceFreqRaw: string | null;
     testingFreqRaw: string | null;
     /** Last manually-recorded maintenance day (used as fallback when no Reports row exists). */
@@ -418,6 +491,22 @@ type WebsiteRow = {
     deployStatus: string | null;
     lastDeployAt: string | null;
     deployLogUrl: string | null;
+    /** When the `netlify-deploy` audit last RAN (freshness stamp for `deployStatus`). The audit
+     *  already writes "Deploy checked at"; this read-back is the Plan-2 fix so `deployEvidence`
+     *  (Plan 4) can gate on check time — NOT on `lastDeployAt`, which is deploy time, not check time. */
+    deployCheckedAt: string | null;
+    /** Function-health verdict (the `function-health` audit): the deployed `/health` function
+     *  answered `ok:true` (pass) or `ok:false` (fail). Single-select `pass`/`fail`; null = never ran
+     *  / unreachable (→ Plan 4 maps to unknown/amber). Kept SEPARATE from `deployStatus` so
+     *  `isFailedDeployStatus` keeps meaning "the build failed". */
+    functionHealth: "pass" | "fail" | null;
+    /** CMS reachability (server-side), derived from the same `/health` body's `details.prismic ===
+     *  "ok"`. Single-select `pass`/`fail`; null = never ran. No per-site Prismic token or identity
+     *  column is ever built — this rides `/health`. */
+    cmsReachable: "pass" | "fail" | null;
+    /** When the `function-health` audit last ran — the freshness gate for BOTH `functionHealth` and
+     *  `cmsReachable`. Null = never ran. */
+    functionHealthCheckedAt: string | null;
     /** Deployed-URL browser probe (the `browser` audit): cross-engine render OK, mobile render OK,
      *  internal-links OK + broken count, and when it last ran (one timestamp gates all three). */
     crossbrowserOk: boolean | null;
@@ -425,6 +514,13 @@ type WebsiteRow = {
     linksOk: boolean | null;
     brokenLinks: number | null;
     browserCheckedAt: string | null;
+    /** Uptime-reachable verdict (browser audit): every sampled route returned 2xx/3xx. Single-select
+     *  `pass`/`fail`; null = never ran. Point-in-time. Freshness-gated by `browserCheckedAt`. */
+    reachableOk: "pass" | "fail" | null;
+    /** Titles & meta verdict (browser audit, chromium): every sampled route has a non-empty `<title>`
+     *  ≤ 70 chars + a non-empty meta description, and no duplicate titles across the sample.
+     *  Single-select `pass`/`fail`; null = never ran. Freshness-gated by `browserCheckedAt`. */
+    titleMetaOk: "pass" | "fail" | null;
     /** Per-site copy overrides (M6a). Blank → null → the DEFAULT_COPY value. */
     copyIntro: string | null;
     copyContact: string | null;
@@ -447,6 +543,16 @@ type WebsiteRow = {
     defaultBranchCi: string | null;
     lastCommitAt: string | null;
     githubSignalsAt: string | null;
+    /** Per-site smoke-suite verdict (the `smoke` audit runs `pnpm test:smoke`).
+     *  Single-select pass/fail; null = never ran. `lastSmokeAt` gates freshness. */
+    smokeOk: "pass" | "fail" | null;
+    lastSmokeAt: string | null;
+    /** Synthetic form end-to-end verdict (the `form-e2e` audit submits the real prod
+     *  contact form in test-mode). Single-select pass/fail; null = never ran OR (with
+     *  a fresh `formE2eCheckedAt`) no contact form → n/a. `formE2eCheckedAt` gates
+     *  freshness AND encodes the n/a-vs-never-ran distinction. */
+    formE2eOk: "pass" | "fail" | null;
+    formE2eCheckedAt: string | null;
     notifyRouting: NotifyRouting | null;
 };
 type Severity = "low" | "moderate" | "high" | "critical";
@@ -559,7 +665,7 @@ type ReportData = {
 };
 
 /** A single auto-check outcome. `pass` + fresh ⇒ the caller ticks the box. */
-type EvidenceResult = "pass" | "fail" | "unknown";
+type EvidenceResult = "pass" | "fail" | "unknown" | "n/a";
 type EvidenceRecord = {
     result: EvidenceResult;
     checkedAt: string | null;
@@ -602,9 +708,17 @@ type ReportRow = {
      *  subset (see src/reports/checklist.ts). */
     checklist: Record<string, boolean>;
     /** Snapshot of the auto-tick evidence at draft time, keyed by checklist field → evidence
-     *  record. Null when the report predates auto-tick or carried no auto-checked items. Drives the
-     *  dashboard's green/amber badges; the gate still reads the booleans, not this. */
+     *  record. Null when the report predates auto-tick or carried no auto-checked items. This is the
+     *  health gate's source of truth: `isHealthGateClear`/`gatingHealth` (src/reports/checklist.ts)
+     *  read these evidence records, NOT the checklist booleans — and also drive the dashboard badges. */
     autoEvidence: Record<string, EvidenceRecord> | null;
+    /** Logged send-anyway override (Phase 10). When `sendOverride` is true AND `overrideReason` is
+     *  non-empty, the health gate is bypassed for THIS report; `overrideBy`/`overrideAt` are the
+     *  audit trail (parallel to approvedBy/approvedAt). Missing cells read false/null. */
+    sendOverride: boolean;
+    overrideReason: string | null;
+    overrideBy: string | null;
+    overrideAt: string | null;
 };
 
 type DraftOptions = {
@@ -833,9 +947,9 @@ type AttentionItem = {
     autoFixExhausted?: boolean;
 };
 
-type FleetEventType = "pr_automerged" | "vuln_cleared" | "ci_recovered" | "site_launched" | "fleet_swept" | "cert_renewed";
+type FleetEventType = "pr_automerged" | "vuln_cleared" | "ci_recovered" | "site_launched" | "fleet_swept" | "cert_renewed" | "report_sent_with_override";
 
-type Tier = "attention" | "watch" | "healthy";
+type Tier = "attention" | "watch" | "healthy" | "pre-launch";
 type SiteCard = {
     site: WebsiteRow;
     tier: Tier;
@@ -871,6 +985,8 @@ type CockpitSummary = {
     attention: number;
     watch: number;
     healthy: number;
+    /** Count of pre-live "launch period" sites — muted, never counted as broken. */
+    preLaunch: number;
     criticalHighVulns: number;
     lighthouseBelowFloor: number;
     deliveryFailures: number;