@reddoorla/maintenance 0.71.0 → 0.72.0

package/README.md

@@ -368,20 +368,21 @@ This repo's Netlify site hosts the whole dashboard + forms surface: the Resend d
 
 **2. Set env vars** in Site settings → Environment variables:
 
-| Variable                | Value                                                                                                                              |
-| ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------- |
-| `AIRTABLE_PAT`          | Same PAT used by the CLI (read+write on the Websites + Reports tables)                                                             |
-| `AIRTABLE_BASE_ID`      | `appHG8nLOzULzXOER`                                                                                                                |
-| `RESEND_WEBHOOK_SECRET` | Generated by Resend in step 4 — paste back here after creating the endpoint                                                        |
-| `TURSO_DATABASE_URL`    | `libsql://<db>-<org>.turso.io` — submissions + spam counters live here; the dashboard + forms functions 500 without it             |
-| `TURSO_AUTH_TOKEN`      | Auth token for that Turso url (required for a remote `libsql://` url)                                                              |
-| `FORMS_INGEST_TOKEN`    | Shared secret gating `POST /api/forms/:slug` — the SAME value is set on each fleet site                                            |
-| `DASHBOARD_PASSWORD`    | Basic-auth password gating the cockpit, per-site dashboards, and every action endpoint — the dashboard is unauthable without it    |
-| `DASHBOARD_BASE_URL`    | Public base URL of this deploy (e.g. `https://<your-site>.netlify.app`) — used to build absolute links such as report approve URLs |
-| `RENOVATE_TOKEN`        | GitHub PAT with `actions:write` — powers the dashboard's "Trigger Renovate" button (the button 502s without it)                    |
-| `GH_TOKEN`              | GitHub token for the dashboard's request-path REST calls (fleet-refresh dispatch + GitHub-sourced signals)                         |
-
-> The first six vars cover the webhook + forms ingest; `DASHBOARD_PASSWORD` / `DASHBOARD_BASE_URL` / `RENOVATE_TOKEN` / `GH_TOKEN` are additionally required by the operator **dashboard** this same deploy serves (cockpit at `/`, per-site at `/s/:slug`).
+| Variable                | Value                                                                                                                                                                                                                                                    |
+| ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `AIRTABLE_PAT`          | Same PAT used by the CLI (read+write on the Websites + Reports tables)                                                                                                                                                                                   |
+| `AIRTABLE_BASE_ID`      | `appHG8nLOzULzXOER`                                                                                                                                                                                                                                      |
+| `RESEND_WEBHOOK_SECRET` | Generated by Resend in step 4 — paste back here after creating the endpoint                                                                                                                                                                              |
+| `TURSO_DATABASE_URL`    | `libsql://<db>-<org>.turso.io` — submissions + spam counters live here; the dashboard + forms functions 500 without it                                                                                                                                   |
+| `TURSO_AUTH_TOKEN`      | Auth token for that Turso url (required for a remote `libsql://` url)                                                                                                                                                                                    |
+| `FORMS_INGEST_TOKEN`    | Shared secret gating `POST /api/forms/:slug` — the SAME value is set on each fleet site                                                                                                                                                                  |
+| `TURNSTILE_SECRET_KEY`  | Cloudflare Turnstile secret for central spam verification. **Optional** — absent → Turnstile is disabled and fails open (the heuristic classifier is then the only defense). The per-site `PUBLIC_TURNSTILE_SITE_KEY` lives on each fleet site, not here |
+| `DASHBOARD_PASSWORD`    | Basic-auth password gating the cockpit, per-site dashboards, and every action endpoint — the dashboard is unauthable without it                                                                                                                          |
+| `DASHBOARD_BASE_URL`    | Public base URL of this deploy (e.g. `https://<your-site>.netlify.app`) — used to build absolute links such as report approve URLs                                                                                                                       |
+| `RENOVATE_TOKEN`        | GitHub PAT with `actions:write` — powers the dashboard's "Trigger Renovate" button (the button 502s without it)                                                                                                                                          |
+| `GH_TOKEN`              | GitHub token for the dashboard's request-path REST calls (fleet-refresh dispatch + GitHub-sourced signals)                                                                                                                                               |
+
+> The first seven vars cover the webhook + forms ingest (`TURNSTILE_SECRET_KEY` optional); `DASHBOARD_PASSWORD` / `DASHBOARD_BASE_URL` / `RENOVATE_TOKEN` / `GH_TOKEN` are additionally required by the operator **dashboard** this same deploy serves (cockpit at `/`, per-site at `/s/:slug`).
 
 **3. Trigger a deploy** (Deploys → Trigger deploy → Deploy site). When it goes green, curl the health endpoint:
 

package/dist/airtable-U2GTDTK5.js

@@ -0,0 +1,9 @@
+import {
+  fromAirtableBase
+} from "./chunk-HR5SONJC.js";
+import "./chunk-U5SZ4FOP.js";
+import "./chunk-BWKK2ZXS.js";
+export {
+  fromAirtableBase
+};
+//# sourceMappingURL=airtable-U2GTDTK5.js.map

package/dist/{announce-3JE5FKW7.js → announce-HJCGEVJA.js}

@@ -1,14 +1,14 @@
 import {
   scoresFromRow
-} from "./chunk-PSJQE6T6.js";
+} from "./chunk-SQJ53Z7R.js";
 import {
   fetchGaUsers,
   fetchSearch,
   readGaConfig
-} from "./chunk-6J25IIAI.js";
+} from "./chunk-NRISG4XD.js";
 import {
   queueDraft
-} from "./chunk-2PWQ6MPG.js";
+} from "./chunk-KLVMJYZZ.js";
 import {
   defaultReportSubject
 } from "./chunk-GECESMVS.js";
@@ -20,13 +20,13 @@ import {
   resolveCopy,
   updateReportScores,
   uploadAttachment
-} from "./chunk-AYM2EFSK.js";
+} from "./chunk-JCITWZQR.js";
 import "./chunk-U5SZ4FOP.js";
 import {
   listWebsites,
   siteSlug,
   updateAnalyticsHealth
-} from "./chunk-YWRQEDB3.js";
+} from "./chunk-BWKK2ZXS.js";
 import {
   openBase,
   readAirtableConfig
@@ -183,4 +183,4 @@ export {
   formatAnnounceResult,
   runAnnounceCommand
 };
-//# sourceMappingURL=announce-3JE5FKW7.js.map
+//# sourceMappingURL=announce-HJCGEVJA.js.map

package/dist/{bump-deps-K3JMLMBB.js → bump-deps-GZEJAUKI.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-4NAOR44V.js";
 import {
   resolveSites
-} from "./chunk-Y7LZHPDF.js";
+} from "./chunk-GI4M2AMO.js";
 import {
   bumpDeps
 } from "./chunk-D3DQFC32.js";
@@ -57,4 +57,4 @@ async function runBumpDepsCommand(site, opts) {
 export {
   runBumpDepsCommand
 };
-//# sourceMappingURL=bump-deps-K3JMLMBB.js.map
+//# sourceMappingURL=bump-deps-GZEJAUKI.js.map

package/dist/{chunk-52TDNN7K.js → chunk-7P7YETHG.js}

@@ -12,18 +12,18 @@ import {
   renderReportHtml,
   resolveCopy,
   stampSent
-} from "./chunk-AYM2EFSK.js";
+} from "./chunk-JCITWZQR.js";
 import {
   defaultResendClient
 } from "./chunk-WEKL2HYJ.js";
 import {
   recordFleetEventsBestEffort
-} from "./chunk-J2SHWT2O.js";
+} from "./chunk-GYNRZCM6.js";
 import {
   listWebsites,
   siteSlug,
   updateLaunched
-} from "./chunk-YWRQEDB3.js";
+} from "./chunk-BWKK2ZXS.js";
 import {
   openBase,
   readAirtableConfig
@@ -331,4 +331,4 @@ export {
   parseAddresses,
   isProbablyEmail
 };
-//# sourceMappingURL=chunk-52TDNN7K.js.map
+//# sourceMappingURL=chunk-7P7YETHG.js.map

package/dist/{chunk-MPRLMGJU.js → chunk-APTAITXZ.js}

@@ -21,7 +21,7 @@ import {
 } from "./chunk-XKOZUVK2.js";
 import {
   runAudits
-} from "./chunk-M7HOQ4W7.js";
+} from "./chunk-BHE5CUWI.js";
 import {
   siteLabel
 } from "./chunk-XXTZBPUY.js";
@@ -143,4 +143,4 @@ export {
   DEFAULT_INIT_STEPS,
   init
 };
-//# sourceMappingURL=chunk-MPRLMGJU.js.map
+//# sourceMappingURL=chunk-APTAITXZ.js.map

package/dist/{chunk-M7HOQ4W7.js → chunk-BHE5CUWI.js}

@@ -19,7 +19,7 @@ import {
 import {
   a11yRoutes,
   smokeRoutes
-} from "./chunk-LPMQXS2N.js";
+} from "./chunk-LJPCMXR7.js";
 
 // src/audits/deps.ts
 import { readFile } from "fs/promises";
@@ -496,7 +496,10 @@ async function dependabotAudit(deps, repo, label) {
   let alerts;
   try {
     alerts = await deps.listAlerts(repo);
-  } catch {
+  } catch (e) {
+    console.error(
+      `[security] ${label}: dependabot API failed \u2014 degraded to pnpm audit: ${e instanceof Error ? e.message : String(e)}`
+    );
     return null;
   }
   const counts = { low: 0, moderate: 0, high: 0, critical: 0 };
@@ -1391,6 +1394,7 @@ async function defaultBrowserRunner() {
 }
 
 // src/audits/netlify-deploy.ts
+var NETLIFY_FETCH_TIMEOUT_MS = 15e3;
 var READY_STATES = /* @__PURE__ */ new Set(["ready"]);
 var FAILED_STATES = /* @__PURE__ */ new Set(["error", "failed", "rejected"]);
 function isReadyState(state) {
@@ -1415,7 +1419,8 @@ function defaultNetlifyDeployDeps(token, now, fetchImpl = fetch) {
       let res;
       try {
         res = await fetchImpl(url, {
-          headers: { Authorization: `Bearer ${token}` }
+          headers: { Authorization: `Bearer ${token}` },
+          signal: AbortSignal.timeout(NETLIFY_FETCH_TIMEOUT_MS)
         });
       } catch {
         return { ok: false };
@@ -1890,4 +1895,4 @@ export {
   runAudits,
   runAuditsAcross
 };
-//# sourceMappingURL=chunk-M7HOQ4W7.js.map
+//# sourceMappingURL=chunk-BHE5CUWI.js.map