@reddoorla/maintenance 0.7.0 → 0.9.0

package/dist/index.js

@@ -335,9 +335,9 @@ async function securityAudit(ctx) {
 }
 
 // src/audits/lighthouse.ts
-import { readFile as readFile3, writeFile, mkdtemp, rm } from "fs/promises";
+import { readFile as readFile4, writeFile, mkdtemp, rm } from "fs/promises";
 import { tmpdir } from "os";
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 
 // src/configs/lighthouse.ts
 var lighthouseConfig = {
@@ -370,10 +370,37 @@ var lighthouseConfig = {
   }
 };
 
+// src/audits/util/site-config.ts
+import { readFile as readFile3 } from "fs/promises";
+import { join as join3 } from "path";
+async function readSiteConfig(sitePath) {
+  let raw;
+  try {
+    raw = await readFile3(join3(sitePath, "package.json"), "utf-8");
+  } catch {
+    return {};
+  }
+  let pkg;
+  try {
+    pkg = JSON.parse(raw);
+  } catch {
+    return {};
+  }
+  if (!pkg || typeof pkg !== "object") return {};
+  const cfg = pkg.reddoor;
+  if (!cfg || typeof cfg !== "object") return {};
+  const out = {};
+  const url = cfg.lighthouseUrl;
+  if (typeof url === "string" && url.length > 0) {
+    out.lighthouseUrl = url;
+  }
+  return out;
+}
+
 // src/audits/lighthouse.ts
 async function readJsonMaybe(path) {
   try {
-    const raw = await readFile3(path, "utf-8");
+    const raw = await readFile4(path, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -409,15 +436,28 @@ async function lighthouseAudit(ctx) {
   const spawn2 = ctx.spawn ?? defaultSpawn;
   const site = ctx.site;
   const label = siteLabel(site);
-  const configDir = await mkdtemp(join3(tmpdir(), "reddoor-lhci-"));
-  const configPath = join3(configDir, "lighthouserc.json");
-  await writeFile(configPath, JSON.stringify(lighthouseConfig), "utf-8");
-  const resultsDir = join3(site.path, ".lighthouseci");
+  const siteCfg = await readSiteConfig(site.path);
+  const resolvedConfig = siteCfg.lighthouseUrl ? {
+    ...lighthouseConfig,
+    ci: {
+      ...lighthouseConfig.ci,
+      collect: { ...lighthouseConfig.ci.collect, url: [siteCfg.lighthouseUrl] }
+    }
+  } : lighthouseConfig;
+  const configDir = await mkdtemp(join4(tmpdir(), "reddoor-lhci-"));
+  const configPath = join4(configDir, "lighthouserc.json");
+  await writeFile(configPath, JSON.stringify(resolvedConfig), "utf-8");
+  const resultsDir = join4(site.path, ".lighthouseci");
   await rm(resultsDir, { recursive: true, force: true });
   let raw;
   try {
     raw = await spawn2("npx", ["--yes", "@lhci/cli", "autorun", `--config=${configPath}`], {
-      cwd: site.path
+      cwd: site.path,
+      // lhci autorun boots the site's dev server, downloads Chrome on first
+      // use, and runs the audit — easily 2–3 min on a cold tree. The shared
+      // 30 s default in runAudits is fine for deps/lint/security but starves
+      // lhci.
+      timeoutMs: 5 * 6e4
     });
   } catch (err) {
     await rm(configDir, { recursive: true, force: true });
@@ -433,7 +473,7 @@ async function lighthouseAudit(ctx) {
     throw err;
   }
   await rm(configDir, { recursive: true, force: true });
-  const manifest = await readJsonMaybe(join3(resultsDir, "manifest.json"));
+  const manifest = await readJsonMaybe(join4(resultsDir, "manifest.json"));
   if (!manifest || manifest.length === 0) {
     return {
       audit: "lighthouse",
@@ -442,7 +482,7 @@ async function lighthouseAudit(ctx) {
       summary: `lighthouse: no manifest written (exit ${raw.code})${raw.stderr ? ` \u2014 ${raw.stderr.slice(0, 200)}` : ""}`
     };
   }
-  const assertionResults = await readJsonMaybe(join3(resultsDir, "assertion-results.json")) ?? [];
+  const assertionResults = await readJsonMaybe(join4(resultsDir, "assertion-results.json")) ?? [];
   const failed = assertionResults.filter((a) => !a.passed);
   const assertions = failed.map((a) => ({
     category: categoryFromAssertion(a),
@@ -468,9 +508,9 @@ async function lighthouseAudit(ctx) {
 }
 
 // src/audits/a11y.ts
-import { readFile as readFile4, writeFile as writeFile2, mkdtemp as mkdtemp2, rm as rm2 } from "fs/promises";
+import { readFile as readFile5, writeFile as writeFile2, mkdtemp as mkdtemp2, rm as rm2 } from "fs/promises";
 import { tmpdir as tmpdir2 } from "os";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 
 // src/configs/playwright-a11y.ts
 import { defineConfig, devices } from "@playwright/test";
@@ -508,7 +548,7 @@ var playwrightA11yConfig = defineConfig({
 var RESULTS_REL = ".reddoor-a11y/results.json";
 async function readJsonMaybe2(path) {
   try {
-    const raw = await readFile4(path, "utf-8");
+    const raw = await readFile5(path, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -564,11 +604,11 @@ async function a11yAudit(ctx) {
   const spawn2 = ctx.spawn ?? defaultSpawn;
   const site = ctx.site;
   const label = siteLabel(site);
-  const specDir = await mkdtemp2(join4(tmpdir2(), "reddoor-a11y-spec-"));
-  const specPath = join4(specDir, "a11y.spec.ts");
+  const specDir = await mkdtemp2(join5(tmpdir2(), "reddoor-a11y-spec-"));
+  const specPath = join5(specDir, "a11y.spec.ts");
   await writeFile2(specPath, buildSpec(), "utf-8");
-  const resultsPath = join4(site.path, RESULTS_REL);
-  await rm2(join4(site.path, ".reddoor-a11y"), { recursive: true, force: true });
+  const resultsPath = join5(site.path, RESULTS_REL);
+  await rm2(join5(site.path, ".reddoor-a11y"), { recursive: true, force: true });
   let raw;
   try {
     raw = await spawn2("npx", ["--yes", "playwright", "test", "--reporter=line", specPath], {
@@ -650,8 +690,8 @@ async function runAuditsAcross(sites, which) {
 }
 
 // src/recipes/sync-configs.ts
-import { readFile as readFile5, writeFile as writeFile3 } from "fs/promises";
-import { join as join5 } from "path";
+import { readFile as readFile6, writeFile as writeFile3 } from "fs/promises";
+import { join as join6 } from "path";
 
 // src/recipes/sync-configs/templates.ts
 var eslint = {
@@ -904,7 +944,7 @@ async function withRecipe(body) {
 var GITIGNORE_CONFIG = "gitignore";
 async function readMaybe(path) {
   try {
-    return await readFile5(path, "utf-8");
+    return await readFile6(path, "utf-8");
   } catch {
     return null;
   }
@@ -912,13 +952,13 @@ async function readMaybe(path) {
 async function planTemplateDiffs(cwd, templates) {
   const diffs = [];
   for (const t of templates) {
-    const existing = await readMaybe(join5(cwd, t.path));
+    const existing = await readMaybe(join6(cwd, t.path));
     if (existing !== t.contents) diffs.push(t);
   }
   return diffs;
 }
 async function planGitignore(cwd) {
-  const existing = await readMaybe(join5(cwd, ".gitignore"));
+  const existing = await readMaybe(join6(cwd, ".gitignore"));
   const merge = mergeGitignore(existing, CANONICAL_GITIGNORE_ENTRIES);
   const tracked = await listTrackedFiles(cwd);
   const toUntrack = findTrackedArtifacts(tracked, CANONICAL_GITIGNORE_ENTRIES);
@@ -926,7 +966,7 @@ async function planGitignore(cwd) {
   return { kind: "apply", content: merge.content, toUntrack, added: merge.added };
 }
 async function applyGitignore(cwd, plan) {
-  await writeFile3(join5(cwd, ".gitignore"), plan.content, "utf-8");
+  await writeFile3(join6(cwd, ".gitignore"), plan.content, "utf-8");
   if (plan.toUntrack.length > 0) {
     await removeFromIndex(cwd, plan.toUntrack);
   }
@@ -949,7 +989,7 @@ async function syncConfigs(site, opts = {}) {
     },
     apply: async ({ templateDiffs, gitignorePlan }, { commit: commit2 }) => {
       for (const t of templateDiffs) {
-        await writeFile3(join5(site.path, t.path), t.contents, "utf-8");
+        await writeFile3(join6(site.path, t.path), t.contents, "utf-8");
         await commit2(`chore: sync ${t.config} config from @reddoorla/maintenance`);
       }
       if (gitignorePlan.kind === "apply") {
@@ -963,7 +1003,7 @@ async function syncConfigs(site, opts = {}) {
 
 // src/recipes/bump-deps.ts
 import { stat } from "fs/promises";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 async function exists(path) {
   try {
     await stat(path);
@@ -992,10 +1032,10 @@ async function bumpDeps(site, opts = {}) {
     // land on top of whatever else was in the tree.
     checkTreeFirst: true,
     plan: async () => {
-      const hasPnpmLock = await exists(join6(site.path, "pnpm-lock.yaml"));
+      const hasPnpmLock = await exists(join7(site.path, "pnpm-lock.yaml"));
       if (!hasPnpmLock) {
-        const hasNpmLock = await exists(join6(site.path, "package-lock.json"));
-        const hasYarnLock = await exists(join6(site.path, "yarn.lock"));
+        const hasNpmLock = await exists(join7(site.path, "package-lock.json"));
+        const hasYarnLock = await exists(join7(site.path, "yarn.lock"));
         if (hasNpmLock || hasYarnLock) {
           const competing = hasNpmLock ? "package-lock.json" : "yarn.lock";
           return {
@@ -1030,12 +1070,12 @@ async function bumpDeps(site, opts = {}) {
 }
 
 // src/recipes/svelte-5/index.ts
-import { join as join12 } from "path";
+import { join as join13 } from "path";
 
 // src/util/pkg.ts
-import { readFile as readFile6, writeFile as writeFile4 } from "fs/promises";
+import { readFile as readFile7, writeFile as writeFile4 } from "fs/promises";
 async function readPackageJson(path) {
-  const raw = await readFile6(path, "utf-8");
+  const raw = await readFile7(path, "utf-8");
   return JSON.parse(raw);
 }
 function detectIndentFromContent(raw) {
@@ -1045,7 +1085,7 @@ function detectIndentFromContent(raw) {
 async function writePackageJson(path, pkg) {
   let indent = "  ";
   try {
-    const existing = await readFile6(path, "utf-8");
+    const existing = await readFile7(path, "utf-8");
     indent = detectIndentFromContent(existing);
   } catch {
   }
@@ -1079,7 +1119,7 @@ function bumpDep(pkg, name, version, opts = {}) {
 }
 
 // src/recipes/svelte-5/step-bump-versions.ts
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 var SVELTE_5_VERSIONS = {
   svelte: "^5.55.5",
   "@sveltejs/kit": "^2.59.0",
@@ -1092,7 +1132,7 @@ var SVELTE_5_VERSIONS = {
   "typescript-svelte-plugin": "^0.3.52"
 };
 async function bumpToSvelte5Versions(cwd) {
-  const pkgPath = join7(cwd, "package.json");
+  const pkgPath = join8(cwd, "package.json");
   const pkg = await readPackageJson(pkgPath);
   let next = pkg;
   for (const [name, version] of Object.entries(SVELTE_5_VERSIONS)) {
@@ -1104,8 +1144,8 @@ async function bumpToSvelte5Versions(cwd) {
 }
 
 // src/recipes/svelte-5/step-svelte-config.ts
-import { readFile as readFile7, writeFile as writeFile5 } from "fs/promises";
-import { join as join8 } from "path";
+import { readFile as readFile8, writeFile as writeFile5 } from "fs/promises";
+import { join as join9 } from "path";
 var VITE_PLUGIN_PKG = "@sveltejs/vite-plugin-svelte";
 var IMPORT_FROM_VITE_PLUGIN = new RegExp(
   String.raw`^import\s+\{\s*([^}]+?)\s*\}\s+from\s+["']` + VITE_PLUGIN_PKG.replace(/[/]/g, "\\/") + String.raw`["'];?[ \t]*\n`,
@@ -1146,10 +1186,10 @@ function dropPreprocessKey(source) {
   return source.slice(0, m.index) + source.slice(tailIdx).replace(new RegExp(`^${indent}\\n`), "");
 }
 async function migrateSvelteConfig(cwd) {
-  const path = join8(cwd, "svelte.config.js");
+  const path = join9(cwd, "svelte.config.js");
   let src;
   try {
-    src = await readFile7(path, "utf-8");
+    src = await readFile8(path, "utf-8");
   } catch {
     return false;
   }
@@ -1183,9 +1223,9 @@ async function runSvelteMigrate(cwd, spawn2 = defaultSpawn) {
 }
 
 // src/recipes/svelte-5/step-tailwind-upgrade.ts
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 async function upgradeTailwind(cwd, spawn2 = defaultSpawn) {
-  const pkg = await readPackageJson(join9(cwd, "package.json"));
+  const pkg = await readPackageJson(join10(cwd, "package.json"));
   const tailwindVersion = pkg.devDependencies?.tailwindcss ?? pkg.dependencies?.tailwindcss;
   if (!tailwindVersion) return { ran: false, reason: "tailwindcss not installed" };
   if (/^\^?4\./.test(tailwindVersion)) return { ran: false, reason: "already on tailwind 4.x" };
@@ -1206,8 +1246,8 @@ async function upgradeTailwind(cwd, spawn2 = defaultSpawn) {
 }
 
 // src/recipes/svelte-5/step-gotchas.ts
-import { readFile as readFile8, writeFile as writeFile6 } from "fs/promises";
-import { join as join10 } from "path";
+import { readFile as readFile9, writeFile as writeFile6 } from "fs/promises";
+import { join as join11 } from "path";
 import { glob as glob2 } from "tinyglobby";
 
 // src/recipes/svelte-5/codemods/on-event-to-handler.ts
@@ -1539,8 +1579,8 @@ async function planGotchaCodemods(cwd) {
   const changes = [];
   const relPaths = await glob2(SVELTE_GLOBS, { cwd, ignore: IGNORE2, absolute: false });
   for (const rel of relPaths) {
-    const path = join10(cwd, rel);
-    const before = await readFile8(path, "utf-8");
+    const path = join11(cwd, rel);
+    const before = await readFile9(path, "utf-8");
     const after = CODEMODS.reduce((s, fn) => fn(s), before);
     if (after !== before) changes.push({ rel, after });
   }
@@ -1549,7 +1589,7 @@ async function planGotchaCodemods(cwd) {
 async function applyGotchaCodemods(cwd) {
   const changes = await planGotchaCodemods(cwd);
   for (const c of changes) {
-    await writeFile6(join10(cwd, c.rel), c.after, "utf-8");
+    await writeFile6(join11(cwd, c.rel), c.after, "utf-8");
   }
   return { filesChanged: changes.length };
 }
@@ -1573,7 +1613,7 @@ async function verifyMigration(cwd, spawn2 = defaultSpawn) {
 
 // src/recipes/svelte-5/step-summary.ts
 import { writeFile as writeFile7 } from "fs/promises";
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 async function writeMigrationSummary(input) {
   const lines = [
     `# Svelte 4 \u2192 5 migration summary`,
@@ -1590,7 +1630,7 @@ async function writeMigrationSummary(input) {
     `- Verify Playwright a11y tests still pass.`
   ];
   const content = lines.join("\n") + "\n";
-  const path = join11(input.cwd, "MIGRATION_SVELTE_5.md");
+  const path = join12(input.cwd, "MIGRATION_SVELTE_5.md");
   await writeFile7(path, content, "utf-8");
   return path;
 }
@@ -1598,7 +1638,7 @@ async function writeMigrationSummary(input) {
 // src/recipes/svelte-5/index.ts
 async function alreadyOnSvelte5(cwd) {
   try {
-    const pkg = await readPackageJson(join12(cwd, "package.json"));
+    const pkg = await readPackageJson(join13(cwd, "package.json"));
     const v = pkg.devDependencies?.svelte ?? pkg.dependencies?.svelte;
     return !!v && /^\^?5\./.test(v);
   } catch {
@@ -1653,7 +1693,7 @@ async function upgradeSvelte4to5(site, opts = {}) {
 
 // src/recipes/svelte-codemods.ts
 import { writeFile as writeFile8 } from "fs/promises";
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 async function svelteCodemods(site) {
   return withRecipe({
     name: "svelte-codemods",
@@ -1667,7 +1707,7 @@ async function svelteCodemods(site) {
     },
     apply: async (changes, { commit: commit2, cwd }) => {
       for (const c of changes) {
-        await writeFile8(join13(cwd, c.rel), c.after, "utf-8");
+        await writeFile8(join14(cwd, c.rel), c.after, "utf-8");
       }
       await commit2(`refactor(svelte5): apply codemods (${changes.length} files)`);
       return { kind: "ok" };
@@ -1677,7 +1717,7 @@ async function svelteCodemods(site) {
 
 // src/recipes/convert-to-pnpm.ts
 import { rm as rm3, stat as stat2 } from "fs/promises";
-import { join as join14 } from "path";
+import { join as join15 } from "path";
 
 // src/recipes/convert-to-pnpm/script-rewrites.ts
 function rewriteScriptForPnpm(script) {
@@ -1710,9 +1750,9 @@ async function exists2(path) {
 async function convertToPnpm(site, opts = {}) {
   const spawn2 = opts.spawn ?? defaultSpawn;
   const pnpmVersion = opts.pnpmVersion ?? DEFAULT_PNPM_VERSION;
-  const pnpmLockPath = join14(site.path, "pnpm-lock.yaml");
-  const npmLockPath = join14(site.path, "package-lock.json");
-  const yarnLockPath = join14(site.path, "yarn.lock");
+  const pnpmLockPath = join15(site.path, "pnpm-lock.yaml");
+  const npmLockPath = join15(site.path, "package-lock.json");
+  const yarnLockPath = join15(site.path, "yarn.lock");
   return withRecipe({
     name: "convert-to-pnpm",
     site,
@@ -1735,7 +1775,7 @@ async function convertToPnpm(site, opts = {}) {
       if (hasYarnLock) await rm3(yarnLockPath, { force: true });
       const sourceLock = hasNpmLock ? "package-lock.json" : "yarn.lock";
       await commit2(`chore(pnpm): remove ${sourceLock}`);
-      const pkgPath = join14(cwd, "package.json");
+      const pkgPath = join15(cwd, "package.json");
       const pkg = await readPackageJson(pkgPath);
       const next = { ...pkg, packageManager: `pnpm@${pnpmVersion}` };
       if (pkg.scripts && typeof pkg.scripts === "object") {
@@ -1748,7 +1788,7 @@ async function convertToPnpm(site, opts = {}) {
       }
       await writePackageJson(pkgPath, next);
       await commit2("chore(pnpm): pin packageManager + rewrite npm scripts");
-      await rm3(join14(cwd, "node_modules"), { recursive: true, force: true });
+      await rm3(join15(cwd, "node_modules"), { recursive: true, force: true });
       const installResult = await spawn2("pnpm", ["install"], { cwd, streaming: true });
       if (installResult.code !== 0) {
         return { kind: "failed", notes: `pnpm install failed (exit ${installResult.code})` };
@@ -1761,16 +1801,16 @@ async function convertToPnpm(site, opts = {}) {
 
 // src/recipes/onboard.ts
 import { stat as stat3 } from "fs/promises";
-import { join as join16 } from "path";
+import { join as join17 } from "path";
 
 // src/util/self-version.ts
 import { readFileSync } from "fs";
 import { fileURLToPath } from "url";
-import { dirname, join as join15 } from "path";
+import { dirname, join as join16 } from "path";
 function selfPackageVersion(callerImportMetaUrl) {
   try {
-    const here = dirname(fileURLToPath(callerImportMetaUrl));
-    const raw = readFileSync(join15(here, "..", "..", "package.json"), "utf-8");
+    const here2 = dirname(fileURLToPath(callerImportMetaUrl));
+    const raw = readFileSync(join16(here2, "..", "..", "package.json"), "utf-8");
     const pkg = JSON.parse(raw);
     return pkg.version ?? "0.0.0";
   } catch {
@@ -1820,13 +1860,13 @@ async function onboard(site, opts = {}) {
     name: "onboard",
     site,
     plan: async () => {
-      if (!await exists3(join16(site.path, "pnpm-lock.yaml"))) {
+      if (!await exists3(join17(site.path, "pnpm-lock.yaml"))) {
         return {
           kind: "failed",
           notes: "no pnpm-lock.yaml at site root \u2014 run convert-to-pnpm first"
         };
       }
-      const pkgPath = join16(site.path, "package.json");
+      const pkgPath = join17(site.path, "package.json");
       const pkg = await readPackageJson(pkgPath);
       const toAdd = [];
       if (!isDeclared(pkg, PACKAGE_NAME)) {
@@ -1846,7 +1886,7 @@ async function onboard(site, opts = {}) {
       return { kind: "apply", plan: { pkg, toAdd } };
     },
     apply: async ({ pkg, toAdd }, { commit: commit2, cwd }) => {
-      const pkgPath = join16(cwd, "package.json");
+      const pkgPath = join17(cwd, "package.json");
       let next = pkg;
       for (const dep of toAdd) {
         next = bumpDep(next, dep.name, dep.version);
@@ -1889,7 +1929,7 @@ function localPath(path, opts = {}) {
 }
 
 // src/inventory/json.ts
-import { readFile as readFile9 } from "fs/promises";
+import { readFile as readFile10 } from "fs/promises";
 import { isAbsolute } from "path";
 function validate(raw) {
   if (!Array.isArray(raw)) {
@@ -1919,21 +1959,111 @@ function validate(raw) {
 }
 function fromJsonFile(path) {
   return async () => {
-    const raw = JSON.parse(await readFile9(path, "utf-8"));
+    const raw = JSON.parse(await readFile10(path, "utf-8"));
     return validate(raw);
   };
 }
 
+// src/reports/airtable/websites.ts
+var WEBSITES_TABLE = "Websites";
+function siteSlug(name) {
+  return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+}
+function mapRow(rec) {
+  const f = rec.fields;
+  const attachments = f["Header image"] ?? [];
+  const header = attachments[0] ?? null;
+  return {
+    id: rec.id,
+    name: String(f["Name"] ?? ""),
+    url: String(f["url"] ?? ""),
+    status: f["Status"] ?? null,
+    pointOfContact: f["point of contact"] ?? null,
+    maintenanceFreq: f["maintenence freq"] ?? "None",
+    testingFreq: f["testing freq"] ?? "None",
+    maintenanceDay: f["maintenance day"] ?? null,
+    testingDay: f["testing day"] ?? null,
+    ga4PropertyId: f["GA4 property ID"] ?? null,
+    reportRecipientsTo: f["Report recipients (To)"] ?? null,
+    reportRecipientsCc: f["Report recipients (CC)"] ?? null,
+    headerImage: header,
+    pScore: f["pScore"] ?? null,
+    rScore: f["rScore"] ?? null,
+    bpScore: f["bpScore"] ?? null,
+    seoScore: f["seoScore"] ?? null,
+    lastLighthouseAuditAt: f["Last lighthouse audit at"] ?? null
+  };
+}
+async function listWebsites(base) {
+  const out = [];
+  await base(WEBSITES_TABLE).select({ pageSize: 100 }).eachPage((records, fetchNextPage) => {
+    for (const rec of records) out.push(mapRow({ id: rec.id, fields: rec.fields }));
+    fetchNextPage();
+  });
+  return out;
+}
+
+// src/inventory/airtable.ts
+function fromAirtableBase(base, opts = {}) {
+  return async () => {
+    const workdir = opts.workdir ?? process.env.REDDOOR_FLEET_WORKDIR;
+    if (!workdir) {
+      throw new Error(
+        "fromAirtableBase requires `workdir` option or REDDOOR_FLEET_WORKDIR env (sites need a local path)"
+      );
+    }
+    const websites = await listWebsites(base);
+    return websites.filter((w) => w.maintenanceFreq !== "None" || w.testingFreq !== "None").map((w) => {
+      const slug = siteSlug(w.name);
+      const site = {
+        path: `${workdir}/${slug}`,
+        name: slug,
+        meta: { airtableRowId: w.id, displayName: w.name }
+      };
+      if (w.url) site.repoUrl = w.url;
+      return site;
+    });
+  };
+}
+
 // src/reports/draft.ts
 import { mkdir, writeFile as writeFile9 } from "fs/promises";
-import { dirname as dirname2 } from "path";
+import { dirname as dirname3 } from "path";
 
 // src/reports/render.ts
 import mjml2html from "mjml";
 
+// src/reports/maintenance-email/assets/index.ts
+import { readFile as readFile11 } from "fs/promises";
+import { dirname as dirname2, join as join18 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+var here = dirname2(fileURLToPath2(import.meta.url));
+var CHECK_CID = "rd-check-png";
+var BLURRED_CID = "rd-blurred-tests-jpg";
+async function loadBundledImages() {
+  const [check, blurred] = await Promise.all([
+    readFile11(join18(here, "check.png")),
+    readFile11(join18(here, "blurredTests.jpg"))
+  ]);
+  return {
+    check: {
+      bytes: new Uint8Array(check),
+      contentType: "image/png",
+      cid: CHECK_CID,
+      filename: "check.png"
+    },
+    blurred: {
+      bytes: new Uint8Array(blurred),
+      contentType: "image/jpeg",
+      cid: BLURRED_CID,
+      filename: "blurredTests.jpg"
+    }
+  };
+}
+
 // src/reports/maintenance-email/template.ts
-var CHECK_PNG = "https://d3eq0h5l8sxf6t.cloudfront.net/maintenance-email/check.png";
-var BLURRED_TESTS = "https://d3eq0h5l8sxf6t.cloudfront.net/maintenance-email/blurredTests.jpg";
+var CHECK_PNG = `cid:${CHECK_CID}`;
+var BLURRED_TESTS = `cid:${BLURRED_CID}`;
 function fmtDate(d) {
   if (!d) return "";
   const mm = String(d.getUTCMonth() + 1).padStart(2, "0");
@@ -2104,43 +2234,6 @@ async function renderReportHtml(data) {
   return { html: out.html, warnings: out.errors ?? [] };
 }
 
-// src/reports/airtable/websites.ts
-var WEBSITES_TABLE = "Websites";
-function siteSlug(name) {
-  return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
-}
-function mapRow(rec) {
-  const f = rec.fields;
-  const attachments = f["Header image"] ?? [];
-  const header = attachments[0] ?? null;
-  return {
-    id: rec.id,
-    name: String(f["Name"] ?? ""),
-    url: String(f["url"] ?? ""),
-    pointOfContact: f["point of contact"] ?? null,
-    maintenanceFreq: f["maintenence freq"] ?? "None",
-    testingFreq: f["testing freq"] ?? "None",
-    maintenanceDay: f["maintenance day"] ?? null,
-    testingDay: f["testing day"] ?? null,
-    ga4PropertyId: f["GA4 property ID"] ?? null,
-    reportRecipientsTo: f["Report recipients (To)"] ?? null,
-    reportRecipientsCc: f["Report recipients (CC)"] ?? null,
-    headerImage: header,
-    pScore: f["pScore"] ?? null,
-    rScore: f["rScore"] ?? null,
-    bpScore: f["bpScore"] ?? null,
-    seoScore: f["seoScore"] ?? null
-  };
-}
-async function listWebsites(base) {
-  const out = [];
-  await base(WEBSITES_TABLE).select({ pageSize: 100 }).eachPage((records, fetchNextPage) => {
-    for (const rec of records) out.push(mapRow({ id: rec.id, fields: rec.fields }));
-    fetchNextPage();
-  });
-  return out;
-}
-
 // src/reports/airtable/reports.ts
 var REPORTS_TABLE = "Reports";
 function mapRow2(rec) {
@@ -2242,6 +2335,40 @@ async function stampSent(base, recordId, sentAt, messageId) {
   ]);
 }
 
+// src/reports/airtable/attachments.ts
+async function fetchAttachmentBytes(url) {
+  const res = await fetch(url);
+  if (!res.ok) {
+    throw new Error(
+      `Failed to fetch Airtable attachment ${res.status} ${res.statusText} (url=${url})`
+    );
+  }
+  const contentType = res.headers.get("content-type") ?? "application/octet-stream";
+  const ab = await res.arrayBuffer();
+  return { bytes: new Uint8Array(ab), contentType };
+}
+async function uploadAttachment(recordId, fieldName, body, filename, contentType) {
+  const apiKey = process.env.AIRTABLE_PAT;
+  const baseId = process.env.AIRTABLE_BASE_ID;
+  if (!apiKey || !baseId) {
+    throw new Error("AIRTABLE_PAT and AIRTABLE_BASE_ID must be set");
+  }
+  const base64 = typeof body === "string" ? Buffer.from(body, "utf-8").toString("base64") : Buffer.from(body).toString("base64");
+  const payload = { contentType, file: base64, filename };
+  const url = `https://content.airtable.com/v0/${baseId}/${recordId}/${encodeURIComponent(fieldName)}/uploadAttachment`;
+  const res = await fetch(url, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${apiKey}`,
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify(payload)
+  });
+  if (!res.ok) {
+    throw new Error(`Airtable upload failed: ${res.status} ${res.statusText} ${await res.text()}`);
+  }
+}
+
 // src/reports/draft.ts
 function scoresFromWebsite(siteRow) {
   const { pScore, rScore, bpScore, seoScore } = siteRow;
@@ -2280,7 +2407,7 @@ async function draftReportForSite(base, siteRow, reportType, options = {}) {
   });
   if (options.previewOnly) {
     const path = options.previewPath ?? `reports/${slug}/draft.html`;
-    await mkdir(dirname2(path), { recursive: true });
+    await mkdir(dirname3(path), { recursive: true });
     await writeFile9(path, html, "utf-8");
     return { reportRow: null, htmlPath: path, html };
   }
@@ -2296,7 +2423,8 @@ async function draftReportForSite(base, siteRow, reportType, options = {}) {
     lighthouse: scores,
     lastTestedDate
   });
-  await uploadHtmlAttachment(created.id, html, slug, periodEnd);
+  const htmlFilename = `${slug}-${periodEnd.toISOString().slice(0, 10)}.html`;
+  await uploadAttachment(created.id, "Rendered HTML", html, htmlFilename, "text/html");
   await setDraftReady(base, created.id, true);
   return { reportRow: created, htmlPath: null, html };
 }
@@ -2306,28 +2434,6 @@ async function derivePeriodStart(base, siteRow, reportType, today) {
   const latest = sameType[sameType.length - 1];
   return latest ? new Date(latest) : daysAgo(today, 30);
 }
-async function uploadHtmlAttachment(recordId, html, slug, periodEnd) {
-  const apiKey = process.env.AIRTABLE_PAT;
-  const baseId = process.env.AIRTABLE_BASE_ID;
-  const filename = `${slug}-${periodEnd.toISOString().slice(0, 10)}.html`;
-  const body = {
-    contentType: "text/html",
-    file: Buffer.from(html, "utf-8").toString("base64"),
-    filename
-  };
-  const url = `https://content.airtable.com/v0/${baseId}/${recordId}/Rendered%20HTML/uploadAttachment`;
-  const res = await fetch(url, {
-    method: "POST",
-    headers: {
-      Authorization: `Bearer ${apiKey}`,
-      "Content-Type": "application/json"
-    },
-    body: JSON.stringify(body)
-  });
-  if (!res.ok) {
-    throw new Error(`Airtable upload failed: ${res.status} ${res.statusText} ${await res.text()}`);
-  }
-}
 
 // src/reports/airtable/client.ts
 import Airtable from "airtable";
@@ -2342,19 +2448,6 @@ function openBase(cfg) {
   return new Airtable({ apiKey: cfg.apiKey }).base(cfg.baseId);
 }
 
-// src/reports/airtable/attachments.ts
-async function fetchAttachmentBytes(url) {
-  const res = await fetch(url);
-  if (!res.ok) {
-    throw new Error(
-      `Failed to fetch Airtable attachment ${res.status} ${res.statusText} (url=${url})`
-    );
-  }
-  const contentType = res.headers.get("content-type") ?? "application/octet-stream";
-  const ab = await res.arrayBuffer();
-  return { bytes: new Uint8Array(ab), contentType };
-}
-
 // src/reports/send/resend.ts
 import { Resend } from "resend";
 function defaultResendClient() {
@@ -2419,6 +2512,7 @@ async function sendOne(client, base, site, report) {
     throw new Error(`Report ${report.reportId} has no Lighthouse scores`);
   }
   const { bytes, contentType } = await fetchAttachmentBytes(site.headerImage.url);
+  const bundled = await loadBundledImages();
   const slug = siteSlug(site.name);
   const cidName = `${slug}-header`;
   const { html } = await renderReportHtml({
@@ -2471,6 +2565,21 @@ async function sendOne(client, base, site, report) {
         content: Buffer.from(bytes).toString("base64"),
         contentType,
         inlineContentId: cidName
+      },
+      // Bundled images referenced via cid:rd-check-png / cid:rd-blurred-tests-jpg
+      // in the template. Attached inline so the email is self-contained — no
+      // external CDN dependency, no image-blocked broken icons in webmail.
+      {
+        filename: bundled.check.filename,
+        content: Buffer.from(bundled.check.bytes).toString("base64"),
+        contentType: bundled.check.contentType,
+        inlineContentId: bundled.check.cid
+      },
+      {
+        filename: bundled.blurred.filename,
+        content: Buffer.from(bundled.blurred.bytes).toString("base64"),
+        contentType: bundled.blurred.contentType,
+        inlineContentId: bundled.blurred.cid
       }
     ],
     // Stable across retries of the same row — if Airtable stamping fails after a
@@ -2508,6 +2617,12 @@ function isProbablyEmail(s) {
 }
 
 // src/reports/due.ts
+var ELIGIBLE_STATUSES = /* @__PURE__ */ new Set([
+  "in development",
+  "launch period",
+  "maintenance",
+  "hosting"
+]);
 var MONTHS = {
   Monthly: 1,
   Quarterly: 3,
@@ -2537,6 +2652,7 @@ function findDueReports(websites, reports, today) {
   const out = [];
   const todayStart = startOfDay(today);
   for (const site of websites) {
+    if (site.status !== null && !ELIGIBLE_STATUSES.has(site.status)) continue;
     for (const type of ["Maintenance", "Testing"]) {
       const freq = type === "Maintenance" ? site.maintenanceFreq : site.testingFreq;
       if (freq === "None") continue;
@@ -2564,6 +2680,7 @@ export {
   depsAudit,
   draftReportForSite,
   findDueReports,
+  fromAirtableBase,
   fromJsonFile,
   isRecipeName,
   lighthouseAudit,