@reddoorla/maintenance 0.71.0 → 0.74.0

package/dist/{chunk-M7HOQ4W7.js → chunk-PERP7LSS.js}

@@ -19,7 +19,7 @@ import {
 import {
   a11yRoutes,
   smokeRoutes
-} from "./chunk-LPMQXS2N.js";
+} from "./chunk-LJPCMXR7.js";
 
 // src/audits/deps.ts
 import { readFile } from "fs/promises";
@@ -496,7 +496,10 @@ async function dependabotAudit(deps, repo, label) {
   let alerts;
   try {
     alerts = await deps.listAlerts(repo);
-  } catch {
+  } catch (e) {
+    console.error(
+      `[security] ${label}: dependabot API failed \u2014 degraded to pnpm audit: ${e instanceof Error ? e.message : String(e)}`
+    );
     return null;
   }
   const counts = { low: 0, moderate: 0, high: 0, critical: 0 };
@@ -1116,6 +1119,67 @@ function parseHtmlLinks(html, baseUrl) {
 function family(pathname) {
   return pathname.split("/").filter(Boolean)[0] ?? "";
 }
+var ASSET_EXTENSIONS = /* @__PURE__ */ new Set([
+  "pdf",
+  "doc",
+  "docx",
+  "xls",
+  "xlsx",
+  "ppt",
+  "pptx",
+  "csv",
+  "txt",
+  "rtf",
+  "jpg",
+  "jpeg",
+  "png",
+  "gif",
+  "webp",
+  "avif",
+  "svg",
+  "ico",
+  "bmp",
+  "tif",
+  "tiff",
+  "css",
+  "js",
+  "mjs",
+  "map",
+  "json",
+  "xml",
+  "webmanifest",
+  "rss",
+  "atom",
+  "zip",
+  "gz",
+  "tar",
+  "rar",
+  "7z",
+  "dmg",
+  "exe",
+  "mp3",
+  "mp4",
+  "webm",
+  "mov",
+  "avi",
+  "wav",
+  "ogg",
+  "m4a",
+  "m4v",
+  "woff",
+  "woff2",
+  "ttf",
+  "otf",
+  "eot"
+]);
+function isPageRoutePath(pathname) {
+  const last = pathname.split("/").filter(Boolean).pop() ?? "";
+  const dot = last.lastIndexOf(".");
+  if (dot <= 0) return true;
+  const ext = last.slice(dot + 1).toLowerCase();
+  if (ext === "html" || ext === "htm") return true;
+  return !ASSET_EXTENSIONS.has(ext);
+}
 function sampleRoutePaths(urlsOrPaths, cap = DEFAULT_CAP) {
   const seen = /* @__PURE__ */ new Set(["/"]);
   const buckets = /* @__PURE__ */ new Map();
@@ -1126,9 +1190,11 @@ function sampleRoutePaths(urlsOrPaths, cap = DEFAULT_CAP) {
     } catch {
       continue;
     }
-    if (pathname === "/") continue;
+    pathname = pathname.replace(/\/+$/, "");
+    if (pathname === "") continue;
     if (seen.has(pathname)) continue;
     seen.add(pathname);
+    if (!isPageRoutePath(pathname)) continue;
     const fam = family(pathname);
     const arr = buckets.get(fam) ?? [];
     arr.push(pathname);
@@ -1180,32 +1246,174 @@ async function discoverRoutes(deployedUrl, deps, cap = DEFAULT_CAP) {
 function isBroken(status) {
   return status === null || status >= 400;
 }
+function isOkStatus(status) {
+  return status !== null && status >= 200 && status < 400;
+}
+function decodeEntities(s) {
+  return s.replace(/&amp;/gi, "&").replace(/&lt;/gi, "<").replace(/&gt;/gi, ">").replace(/&quot;/gi, '"').replace(/&#0?39;|&apos;/gi, "'").replace(/&nbsp;/gi, " ");
+}
+function extractTitleMeta(html) {
+  const t = /<title[^>]*>([\s\S]*?)<\/title>/i.exec(html);
+  const title = t?.[1] ? decodeEntities(t[1]).trim() || null : null;
+  let metaDescription = null;
+  const metaTags = html.match(/<meta\b[^>]*>/gi) ?? [];
+  for (const tag of metaTags) {
+    if (!/\bname\s*=\s*["']description["']/i.test(tag)) continue;
+    const content = /\bcontent\s*=\s*("([^"]*)"|'([^']*)')/i.exec(tag);
+    const raw = content?.[2] ?? content?.[3] ?? "";
+    metaDescription = decodeEntities(raw).trim() || null;
+    break;
+  }
+  return { title, metaDescription };
+}
+var REVERIFY_RETRY_DELAYS_MS = [15e3, 45e3];
+var defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
+function isRetryableStatus(status) {
+  return status === null || status === 403 || status === 408 || status === 429 || status >= 500;
+}
+async function fetchStatusesWithCooldown(urls, verify, sleep) {
+  const byUrl = /* @__PURE__ */ new Map();
+  for (const url of new Set(urls)) byUrl.set(url, await verify.fetchPage(url));
+  for (const delayMs of REVERIFY_RETRY_DELAYS_MS) {
+    const pending = [...byUrl.entries()].filter(([, f]) => !isOkStatus(f.status) && isRetryableStatus(f.status)).map(([u]) => u);
+    if (pending.length === 0) break;
+    await sleep(delayMs);
+    for (const url of pending) byUrl.set(url, await verify.fetchPage(url));
+  }
+  return byUrl;
+}
+async function reverifyRoutes(routes, verify, sleep = defaultSleep) {
+  const statusIdx = [];
+  const titleMetaIdx = [];
+  routes.forEach((r, i) => {
+    if (!isOkStatus(r.status)) statusIdx.push(i);
+    else if (!(r.title ?? "").trim() || !(r.metaDescription ?? "").trim()) titleMetaIdx.push(i);
+  });
+  const statusFetches = await fetchStatusesWithCooldown(
+    statusIdx.map((i) => routes[i].url),
+    verify,
+    sleep
+  );
+  const fetchedByIdx = /* @__PURE__ */ new Map();
+  for (const i of titleMetaIdx) fetchedByIdx.set(i, await verify.fetchPage(routes[i].url));
+  const out = [...routes];
+  const reverified = [];
+  for (const i of statusIdx) {
+    const r = routes[i];
+    const fetched = statusFetches.get(r.url);
+    reverified.push({ url: r.url, browserStatus: r.status, fetchedStatus: fetched.status });
+    const ok = isOkStatus(fetched.status);
+    out[i] = {
+      ...r,
+      status: fetched.status,
+      title: ok ? fetched.title : null,
+      metaDescription: ok ? fetched.metaDescription : null
+    };
+  }
+  for (const i of titleMetaIdx) {
+    const r = routes[i];
+    const fetched = fetchedByIdx.get(i);
+    if (!isOkStatus(fetched.status)) continue;
+    out[i] = {
+      ...r,
+      title: (r.title ?? "").trim() ? r.title : fetched.title,
+      metaDescription: (r.metaDescription ?? "").trim() ? r.metaDescription : fetched.metaDescription
+    };
+  }
+  return { routes: out, reverified };
+}
+function excuseChallengedEngineChecks(routes) {
+  const excused = [];
+  const excusable = (e) => !e.ok && typeof e.status === "number" && !isOkStatus(e.status) && isRetryableStatus(e.status);
+  const out = routes.map((route) => {
+    if (!isOkStatus(route.status)) return route;
+    const desktop = route.desktop.map((d) => {
+      if (!excusable(d)) return d;
+      excused.push(
+        `${route.url} [${d.engine}]: browser saw ${d.status}, route re-verified reachable (${route.status})`
+      );
+      return { ...d, ok: true };
+    });
+    const mobile = route.mobile.map((m) => {
+      if (!excusable(m)) return m;
+      excused.push(
+        `${route.url} [${m.device}]: browser saw ${m.status}, route re-verified reachable (${route.status})`
+      );
+      return { ...m, ok: true };
+    });
+    return { ...route, desktop, mobile };
+  });
+  return { routes: out, excused };
+}
+async function reverifyLinks(links, verify, sleep = defaultSleep) {
+  const suspects = links.filter((l) => isBroken(l.status) && isRetryableStatus(l.status));
+  if (suspects.length === 0) return { links, reverified: [] };
+  const fetched = await fetchStatusesWithCooldown(
+    suspects.map((l) => l.url),
+    verify,
+    sleep
+  );
+  const suspectUrls = new Set(suspects.map((l) => l.url));
+  const reverified = [];
+  const out = links.map((l) => {
+    if (!suspectUrls.has(l.url)) return l;
+    const finalStatus = fetched.get(l.url).status;
+    reverified.push({ url: l.url, firstStatus: l.status, fetchedStatus: finalStatus });
+    return { url: l.url, status: finalStatus };
+  });
+  return { links: out, reverified };
+}
+var fmtEntryStatus = (s) => typeof s === "number" && !isOkStatus(s) ? ` \u2192 ${s}` : "";
 function summarizeBrowser(routes, links, familyCounts) {
   const desktopChecks = routes.flatMap((r) => r.desktop);
   const mobileChecks = routes.flatMap((r) => r.mobile);
   const desktopOk = routes.length > 0 && routes.every((r) => r.desktop.length > 0 && r.desktop.every((d) => d.ok));
   const mobileOk = routes.length > 0 && routes.every((r) => r.mobile.length > 0 && r.mobile.every((m) => m.ok));
-  const brokenLinks = links.filter((l) => isBroken(l.status)).length;
+  const desktopFailures = routes.flatMap(
+    (r) => r.desktop.length === 0 ? [`${r.url}: no desktop observations`] : r.desktop.filter((d) => !d.ok).map((d) => `${r.url} [${d.engine}]${fmtEntryStatus(d.status)}`)
+  );
+  const mobileFailures = routes.flatMap(
+    (r) => r.mobile.length === 0 ? [`${r.url}: no mobile observations`] : r.mobile.filter((m) => !m.ok).map((m) => `${r.url} [${m.device}]${fmtEntryStatus(m.status)}`)
+  );
+  const brokenLinkUrls = links.filter((l) => isBroken(l.status)).map((l) => `${l.url} \u2192 ${l.status ?? "no response"}`);
+  const brokenLinks = brokenLinkUrls.length;
   const linksOk = links.length > 0 && brokenLinks === 0;
-  const reachableOk = routes.length > 0 && routes.every((r) => r.status !== null && r.status >= 200 && r.status < 400);
-  const trimmedTitles = routes.map((r) => (r.title ?? "").trim());
-  const eachTitleMetaValid = routes.length > 0 && routes.every((r, i) => {
-    const t = trimmedTitles[i];
+  const unreachableUrls = routes.filter((r) => !isOkStatus(r.status)).map((r) => `${r.url} \u2192 ${r.status ?? "no response"}`);
+  const reachableOk = routes.length > 0 && unreachableUrls.length === 0;
+  const titleMetaProblems = [];
+  for (const r of routes) {
+    const t = (r.title ?? "").trim();
     const desc = (r.metaDescription ?? "").trim();
-    return t.length > 0 && t.length <= 70 && desc.length > 0;
-  });
-  const noDuplicateTitles = new Set(trimmedTitles).size === trimmedTitles.length;
-  const titleMetaOk = eachTitleMetaValid && noDuplicateTitles;
+    if (t.length === 0) titleMetaProblems.push(`${r.url}: empty title`);
+    else if (t.length > 70) titleMetaProblems.push(`${r.url}: title ${t.length} chars (max 70)`);
+    if (desc.length === 0) titleMetaProblems.push(`${r.url}: missing meta description`);
+  }
+  const byTitle = /* @__PURE__ */ new Map();
+  for (const r of routes) {
+    const t = (r.title ?? "").trim();
+    if (t.length === 0) continue;
+    byTitle.set(t, [...byTitle.get(t) ?? [], r.url]);
+  }
+  for (const [t, urls] of byTitle) {
+    if (urls.length > 1) titleMetaProblems.push(`duplicate title "${t}": ${urls.join(" + ")}`);
+  }
+  const titleMetaOk = routes.length > 0 && titleMetaProblems.length === 0;
   const engines = [...new Set(desktopChecks.map((d) => d.engine))];
   const devices = [...new Set(mobileChecks.map((m) => m.device))];
   const families = Object.entries(familyCounts).map(([f, n]) => f === "/" ? "/" : `${f} \xD7${n}`).join(", ");
-  const note = `${routes.length} routes (${families}); desktop ${engines.join("/") || "\u2014"}; mobile ${devices.join("/") || "\u2014"}; ${links.length} links, ${brokenLinks} broken`;
+  const firstOf = (xs, n) => xs.slice(0, n).join("; ") + (xs.length > n ? ` (+${xs.length - n} more)` : "");
+  const note = `${routes.length} routes (${families}); desktop ${engines.join("/") || "\u2014"}; mobile ${devices.join("/") || "\u2014"}; ${links.length} links, ${brokenLinks} broken` + (unreachableUrls.length > 0 ? `; unreachable: ${firstOf(unreachableUrls, 3)}` : "") + (titleMetaProblems.length > 0 ? `; title/meta: ${firstOf(titleMetaProblems, 3)}` : "") + (desktopFailures.length > 0 ? `; desktop failing: ${firstOf(desktopFailures, 3)}` : "") + (mobileFailures.length > 0 ? `; mobile failing: ${firstOf(mobileFailures, 3)}` : "") + (brokenLinkUrls.length > 0 ? `; broken: ${firstOf(brokenLinkUrls, 3)}` : "");
   return {
     desktopOk,
     mobileOk,
     linksOk,
     reachableOk,
     titleMetaOk,
+    unreachableUrls,
+    titleMetaProblems,
+    desktopFailures,
+    mobileFailures,
+    brokenLinkUrls,
     brokenLinks,
     routesChecked: routes.length,
     note
@@ -1219,24 +1427,47 @@ async function browserAudit(ctx) {
   }
   const now = ctx.now ?? /* @__PURE__ */ new Date();
   const discoverDeps = ctx.discoverDeps ?? defaultDiscoverDeps();
+  const verifyDeps = ctx.verifyDeps ?? defaultVerifyDeps();
   const runner = ctx.browserRunner ?? await defaultBrowserRunner();
   try {
     const discovered = await discoverRoutes(site.deployedUrl, discoverDeps);
-    const routeResults = await runner.probe(discovered.routes);
+    const probed = await runner.probe(discovered.routes);
+    const { routes: reverifiedRoutes, reverified } = await reverifyRoutes(probed, verifyDeps);
+    const { routes: routeResults, excused } = excuseChallengedEngineChecks(reverifiedRoutes);
     const internalLinks = [...new Set(routeResults.flatMap((r) => r.links))];
-    const linkResults = await runner.checkLinks(internalLinks);
+    const rawLinks = await runner.checkLinks(internalLinks);
+    const { links: linkResults, reverified: linkReverified } = await reverifyLinks(
+      rawLinks,
+      verifyDeps
+    );
     const summary = summarizeBrowser(
       routeResults,
       linkResults,
       discovered.familyCounts ?? familyCountsOf(discovered.routes)
     );
+    const cleared = reverified.filter((v) => isOkStatus(v.fetchedStatus));
+    const reverifiedUrls = cleared.map(
+      (v) => `${v.url}: browser saw ${v.browserStatus ?? "no response"}, plain fetch ${v.fetchedStatus}`
+    );
+    const clearedLinks = linkReverified.filter((v) => isOkStatus(v.fetchedStatus));
+    const linkReverifiedUrls = clearedLinks.map(
+      (v) => `${v.url}: first check saw ${v.firstStatus ?? "no response"}, plain re-fetch ${v.fetchedStatus}`
+    );
+    const note = summary.note + (cleared.length > 0 ? `; ${cleared.length} route(s) re-verified reachable by plain fetch after a browser-side challenge/flake` : "") + (excused.length > 0 ? `; ${excused.length} engine/device check(s) excused (challenge on a re-verified-reachable route)` : "") + (clearedLinks.length > 0 ? `; ${clearedLinks.length} link(s) re-verified ok by plain fetch after cooldown` : "");
     const status = summary.desktopOk && summary.mobileOk && summary.linksOk ? "pass" : "warn";
     return {
       audit: "browser",
       site: label,
       status,
-      summary: summary.note,
-      details: { ...summary, checkedAt: now.toISOString() }
+      summary: note,
+      details: {
+        ...summary,
+        note,
+        reverifiedUrls,
+        excusedEngineChecks: excused,
+        linkReverifiedUrls,
+        checkedAt: now.toISOString()
+      }
     };
   } finally {
     await runner.close?.();
@@ -1259,6 +1490,25 @@ function defaultDiscoverDeps() {
     }
   };
 }
+function defaultVerifyDeps() {
+  return {
+    fetchPage: async (url) => {
+      try {
+        const res = await fetch(url, {
+          redirect: "follow",
+          signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+        });
+        const isHtml = (res.headers.get("content-type") ?? "").includes("html");
+        if (!res.ok || !isHtml) {
+          return { status: res.status, title: null, metaDescription: null };
+        }
+        return { status: res.status, ...extractTitleMeta(await res.text()) };
+      } catch {
+        return { status: null, title: null, metaDescription: null };
+      }
+    }
+  };
+}
 var DESKTOP_VIEWPORT = { width: 1366, height: 900 };
 var PAGE_TIMEOUT_MS = 3e4;
 async function defaultBrowserRunner() {
@@ -1292,11 +1542,13 @@ async function defaultBrowserRunner() {
             const errors = [];
             page.on("pageerror", (e) => errors.push(String(e)));
             let ok = false;
+            let navStatus = null;
             try {
               const resp = await page.goto(url, {
                 waitUntil: "domcontentloaded",
                 timeout: PAGE_TIMEOUT_MS
               });
+              navStatus = resp ? resp.status() : null;
               const hasMain = await page.locator("main, [role=main]").first().isVisible().catch(() => false);
               ok = !!resp && resp.ok() && errors.length === 0 && hasMain;
               if (engine === "chromium") {
@@ -1320,7 +1572,7 @@ async function defaultBrowserRunner() {
               await ctx.close().catch(() => {
               });
             }
-            desktop.push({ engine, ok });
+            desktop.push({ engine, ok, status: navStatus });
           }
           const mobile = [];
           for (let i = 0; i < mobileTargets.length; i++) {
@@ -1331,11 +1583,13 @@ async function defaultBrowserRunner() {
             const errors = [];
             page.on("pageerror", (e) => errors.push(String(e)));
             let ok = false;
+            let navStatus = null;
             try {
               const resp = await page.goto(url, {
                 waitUntil: "domcontentloaded",
                 timeout: PAGE_TIMEOUT_MS
               });
+              navStatus = resp ? resp.status() : null;
               const overflow = await page.evaluate("document.documentElement.scrollWidth > window.innerWidth + 2").catch(() => true);
               ok = !!resp && resp.ok() && errors.length === 0 && !overflow;
             } catch {
@@ -1344,7 +1598,7 @@ async function defaultBrowserRunner() {
               await ctx.close().catch(() => {
               });
             }
-            mobile.push({ device, ok });
+            mobile.push({ device, ok, status: navStatus });
           }
           results.push({
             url,
@@ -1391,6 +1645,7 @@ async function defaultBrowserRunner() {
 }
 
 // src/audits/netlify-deploy.ts
+var NETLIFY_FETCH_TIMEOUT_MS = 15e3;
 var READY_STATES = /* @__PURE__ */ new Set(["ready"]);
 var FAILED_STATES = /* @__PURE__ */ new Set(["error", "failed", "rejected"]);
 function isReadyState(state) {
@@ -1415,7 +1670,8 @@ function defaultNetlifyDeployDeps(token, now, fetchImpl = fetch) {
       let res;
       try {
         res = await fetchImpl(url, {
-          headers: { Authorization: `Bearer ${token}` }
+          headers: { Authorization: `Bearer ${token}` },
+          signal: AbortSignal.timeout(NETLIFY_FETCH_TIMEOUT_MS)
         });
       } catch {
         return { ok: false };
@@ -1890,4 +2146,4 @@ export {
   runAudits,
   runAuditsAcross
 };
-//# sourceMappingURL=chunk-M7HOQ4W7.js.map
+//# sourceMappingURL=chunk-PERP7LSS.js.map