@reddoorla/maintenance 0.81.0 → 0.82.0

package/dist/{github-signals-2BFMZLPV.js → github-signals-HTH7474O.js}

@@ -3,8 +3,8 @@ import {
 } from "./chunk-PZQ3WED2.js";
 import {
   formatFleetWriteSummary
-} from "./chunk-JR67FZVC.js";
-import "./chunk-3PU2QWOJ.js";
+} from "./chunk-2BHSGLWR.js";
+import "./chunk-LMCO7CYQ.js";
 import {
   detectSignalEvents,
   fleetSweptEvent
@@ -22,7 +22,7 @@ import {
   listWebsites,
   siteSlug,
   updateGitHubSignals
-} from "./chunk-GXVX4HUH.js";
+} from "./chunk-YRM6EED7.js";
 import {
   openBase,
   readAirtableConfig
@@ -134,4 +134,4 @@ export {
   githubSignalsExitCode,
   runGitHubSignalsCommand
 };
-//# sourceMappingURL=github-signals-2BFMZLPV.js.map
+//# sourceMappingURL=github-signals-HTH7474O.js.map

package/dist/{header-image-H4N54DHN.js → header-image-WMHZFU7B.js}

@@ -8,7 +8,7 @@ import {
   ACTIVE_STATUSES,
   listWebsites,
   siteSlug
-} from "./chunk-GXVX4HUH.js";
+} from "./chunk-YRM6EED7.js";
 import {
   openBase,
   readAirtableConfig
@@ -92,4 +92,4 @@ export {
   resolveTargets,
   runHeaderImageCommand
 };
-//# sourceMappingURL=header-image-H4N54DHN.js.map
+//# sourceMappingURL=header-image-WMHZFU7B.js.map

package/dist/{health-endpoint-LFVE26QS.js → health-endpoint-4E53ZMLE.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-4NAOR44V.js";
 import {
   resolveSites
-} from "./chunk-4BHNP6Y2.js";
+} from "./chunk-ODC4PXZL.js";
 import {
   healthEndpoint
 } from "./chunk-FX7RAMGC.js";
@@ -51,4 +51,4 @@ async function runHealthEndpointCommand(site, opts) {
 export {
   runHealthEndpointCommand
 };
-//# sourceMappingURL=health-endpoint-LFVE26QS.js.map
+//# sourceMappingURL=health-endpoint-4E53ZMLE.js.map

package/dist/index.d.ts

@@ -224,6 +224,10 @@ type DependabotAlert = {
     /** Dependency graph scope, or null when GitHub doesn't classify it. "development" marks a
      *  build-time-only dependency (lower live-exploit surface for a static site). */
     scope: "runtime" | "development" | null;
+    /** Dependency graph relationship (`dependency.relationship`), or null when GitHub reports
+     *  "unknown"/nothing. "transitive" means no direct-dep bump can fix it — Renovate's vuln
+     *  alerts have no fix vehicle until the weekly lockfile-maintenance window. */
+    relationship: "direct" | "transitive" | null;
 };
 
 /** The Dependabot fetch the security audit needs, injectable for tests. The real default is
@@ -619,6 +623,11 @@ type SecurityAdvisory = {
      *  dashboard flag build-time-only ("development") vulns. Omitted for advisories from the
      *  lockfile `pnpm audit` fallback, which carries no per-package graph scope. */
     scope?: "runtime" | "development";
+    /** GitHub Dependabot dependency-graph relationship, when known. "transitive" means no
+     *  direct-dep bump can fix it — Renovate's vuln alerts have no fix vehicle until the weekly
+     *  lockfile-maintenance window. Omitted when GitHub reports "unknown" or for the
+     *  `pnpm audit` fallback. Drives {@link allActionableVulnsTransitive}. */
+    relationship?: "direct" | "transitive";
 };
 
 type ResolvedCopy = {

package/dist/index.js

@@ -1,8 +1,8 @@
 import "./chunk-2SLED3NB.js";
-import "./chunk-KKIKJWM2.js";
+import "./chunk-VXXF4Y25.js";
 import {
   draftReportForSite
-} from "./chunk-6M2IXJ3E.js";
+} from "./chunk-UH5YPYS4.js";
 import "./chunk-62VF32IC.js";
 import {
   domainFromUrl,
@@ -11,7 +11,7 @@ import {
 } from "./chunk-37S6L6G4.js";
 import {
   approveBlockers
-} from "./chunk-R5KAXGSP.js";
+} from "./chunk-5E4L7WKE.js";
 import {
   findDueReports
 } from "./chunk-D4FVAIEJ.js";
@@ -22,7 +22,7 @@ import {
   DEFAULT_INIT_STEPS,
   a11yFixturesPage,
   init
-} from "./chunk-TEOENEJH.js";
+} from "./chunk-ZXRRKKMR.js";
 import {
   convertToPnpm
 } from "./chunk-MGJ72BA4.js";
@@ -42,7 +42,7 @@ import {
   parseAddresses,
   sendApprovedReports,
   withGlobalCc
-} from "./chunk-42A4H6SF.js";
+} from "./chunk-FFI7P74K.js";
 import "./chunk-GECESMVS.js";
 import {
   BLURRED_CID,
@@ -78,7 +78,7 @@ import {
   runAudits,
   runAuditsAcross,
   securityAudit
-} from "./chunk-JMAFXEQE.js";
+} from "./chunk-T4FQ6TZT.js";
 import "./chunk-GASBX52O.js";
 import "./chunk-YAMRVXOD.js";
 import "./chunk-LKGVSM2O.js";
@@ -98,12 +98,12 @@ import "./chunk-XXTZBPUY.js";
 import "./chunk-XTK5VIQB.js";
 import {
   fromAirtableBase
-} from "./chunk-SK44IFZN.js";
+} from "./chunk-OIDDJLS7.js";
 import "./chunk-U5SZ4FOP.js";
 import {
   SEVERITY_RANK,
   siteSlug
-} from "./chunk-GXVX4HUH.js";
+} from "./chunk-YRM6EED7.js";
 import "./chunk-HN6I2XWI.js";
 import "./chunk-6VAL7XJT.js";
 import "./chunk-NMAWXBJA.js";

package/dist/{init-RYKQFSZI.js → init-3ZJ7Z5NG.js}

@@ -5,10 +5,10 @@ import {
 } from "./chunk-4NAOR44V.js";
 import {
   resolveSites
-} from "./chunk-4BHNP6Y2.js";
+} from "./chunk-ODC4PXZL.js";
 import {
   init
-} from "./chunk-TEOENEJH.js";
+} from "./chunk-ZXRRKKMR.js";
 import "./chunk-MGJ72BA4.js";
 import "./chunk-LS6QPANO.js";
 import "./chunk-J7SZQUCW.js";
@@ -20,7 +20,7 @@ import "./chunk-Q276MZ7E.js";
 import "./chunk-73UFRZKY.js";
 import "./chunk-ZTPPCHDB.js";
 import "./chunk-OTGB6YQO.js";
-import "./chunk-JMAFXEQE.js";
+import "./chunk-T4FQ6TZT.js";
 import "./chunk-GASBX52O.js";
 import "./chunk-YAMRVXOD.js";
 import "./chunk-LKGVSM2O.js";
@@ -107,4 +107,4 @@ async function runInitCommand(site, opts) {
 export {
   runInitCommand
 };
-//# sourceMappingURL=init-RYKQFSZI.js.map
+//# sourceMappingURL=init-3ZJ7Z5NG.js.map

package/dist/{launch-EGKYS3BD.js → launch-FRCDOB56.js}

@@ -4,15 +4,15 @@ import {
 import "./chunk-MNDIED4M.js";
 import {
   writeAuditsToAirtable
-} from "./chunk-JR67FZVC.js";
+} from "./chunk-2BHSGLWR.js";
 import {
   hasRealScores,
   lighthouseScoresFromResult
-} from "./chunk-3PU2QWOJ.js";
+} from "./chunk-LMCO7CYQ.js";
 import "./chunk-5L3FPQIJ.js";
 import {
   resolveSites
-} from "./chunk-4BHNP6Y2.js";
+} from "./chunk-ODC4PXZL.js";
 import {
   queueDraft
 } from "./chunk-62VF32IC.js";
@@ -30,7 +30,7 @@ import "./chunk-SEEA6RXF.js";
 import "./chunk-73UFRZKY.js";
 import {
   runAudits
-} from "./chunk-JMAFXEQE.js";
+} from "./chunk-T4FQ6TZT.js";
 import "./chunk-GASBX52O.js";
 import "./chunk-YAMRVXOD.js";
 import "./chunk-LKGVSM2O.js";
@@ -46,7 +46,7 @@ import "./chunk-U5SZ4FOP.js";
 import {
   listWebsites,
   siteSlug
-} from "./chunk-GXVX4HUH.js";
+} from "./chunk-YRM6EED7.js";
 import {
   openBase,
   readAirtableConfig
@@ -216,4 +216,4 @@ async function runLaunchCommand(site, opts) {
 export {
   runLaunchCommand
 };
-//# sourceMappingURL=launch-EGKYS3BD.js.map
+//# sourceMappingURL=launch-FRCDOB56.js.map

package/dist/{lighthouse-airtable-ZXNMDEPE.js → lighthouse-airtable-I46QCEIS.js}

@@ -2,11 +2,11 @@ import {
   hasRealScores,
   lighthouseScoresFromResult,
   resolveSlugFromCwd
-} from "./chunk-3PU2QWOJ.js";
-import "./chunk-GXVX4HUH.js";
+} from "./chunk-LMCO7CYQ.js";
+import "./chunk-YRM6EED7.js";
 export {
   hasRealScores,
   lighthouseScoresFromResult,
   resolveSlugFromCwd
 };
-//# sourceMappingURL=lighthouse-airtable-ZXNMDEPE.js.map
+//# sourceMappingURL=lighthouse-airtable-I46QCEIS.js.map

package/dist/{onboard-RDGHVCNG.js → onboard-45NPDMMW.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-4NAOR44V.js";
 import {
   resolveSites
-} from "./chunk-4BHNP6Y2.js";
+} from "./chunk-ODC4PXZL.js";
 import {
   onboard
 } from "./chunk-NT4WIP7I.js";
@@ -70,4 +70,4 @@ async function runOnboardCommand(site, opts) {
 export {
   runOnboardCommand
 };
-//# sourceMappingURL=onboard-RDGHVCNG.js.map
+//# sourceMappingURL=onboard-45NPDMMW.js.map

package/dist/{orchestrate-NY6L4Q7Q.js → orchestrate-34JYNIXT.js}

@@ -4,7 +4,7 @@ import {
   parseAddresses,
   sendApprovedReports,
   withGlobalCc
-} from "./chunk-42A4H6SF.js";
+} from "./chunk-FFI7P74K.js";
 import "./chunk-GECESMVS.js";
 import "./chunk-6QRLRT3P.js";
 import "./chunk-MPBXOJ3N.js";
@@ -14,7 +14,7 @@ import "./chunk-QG6OSL4M.js";
 import "./chunk-DC5H7KEQ.js";
 import "./chunk-4SOCPK7A.js";
 import "./chunk-U5SZ4FOP.js";
-import "./chunk-GXVX4HUH.js";
+import "./chunk-YRM6EED7.js";
 import "./chunk-HN6I2XWI.js";
 import "./chunk-6VAL7XJT.js";
 export {
@@ -24,4 +24,4 @@ export {
   sendApprovedReports,
   withGlobalCc
 };
-//# sourceMappingURL=orchestrate-NY6L4Q7Q.js.map
+//# sourceMappingURL=orchestrate-34JYNIXT.js.map

package/dist/{preflight-SRDQS7Y6.js → preflight-WVD32COX.js}

@@ -1,8 +1,8 @@
 import {
   preflight
-} from "./chunk-R5KAXGSP.js";
+} from "./chunk-5E4L7WKE.js";
 import "./chunk-D4FVAIEJ.js";
-import "./chunk-42A4H6SF.js";
+import "./chunk-FFI7P74K.js";
 import "./chunk-GECESMVS.js";
 import "./chunk-6QRLRT3P.js";
 import "./chunk-MPBXOJ3N.js";
@@ -12,7 +12,7 @@ import "./chunk-QG6OSL4M.js";
 import "./chunk-DC5H7KEQ.js";
 import "./chunk-4SOCPK7A.js";
 import "./chunk-U5SZ4FOP.js";
-import "./chunk-GXVX4HUH.js";
+import "./chunk-YRM6EED7.js";
 import "./chunk-HN6I2XWI.js";
 import "./chunk-6VAL7XJT.js";
 
@@ -63,4 +63,4 @@ async function runPreflightCommand(site, opts) {
 export {
   runPreflightCommand
 };
-//# sourceMappingURL=preflight-SRDQS7Y6.js.map
+//# sourceMappingURL=preflight-WVD32COX.js.map

package/dist/{renovate-dispatch-7D7FMMJP.js → renovate-dispatch-LOOCNZTW.js}

@@ -6,10 +6,11 @@ import {
 } from "./chunk-YAMRVXOD.js";
 import "./chunk-HVOOCK6L.js";
 import {
+  allActionableVulnsTransitive,
   isDashboardVisible,
   listWebsites,
   updateAutoFixAttempts
-} from "./chunk-GXVX4HUH.js";
+} from "./chunk-YRM6EED7.js";
 import {
   openBase,
   readAirtableConfig
@@ -69,7 +70,9 @@ function computeAutoFixAttemptUpdates(sites, result) {
     if (!isDashboardVisible(s)) continue;
     const repo = s.gitRepo?.trim();
     if (!repo) continue;
-    if (dispatched.has(repo)) updates.push({ id: s.id, attempts: current + 1 });
+    if (!dispatched.has(repo)) continue;
+    if (allActionableVulnsTransitive(s.securityAdvisories)) continue;
+    updates.push({ id: s.id, attempts: current + 1 });
   }
   return updates;
 }
@@ -138,4 +141,4 @@ async function runRenovateDispatchCommand(opts) {
 export {
   runRenovateDispatchCommand
 };
-//# sourceMappingURL=renovate-dispatch-7D7FMMJP.js.map
+//# sourceMappingURL=renovate-dispatch-LOOCNZTW.js.map

package/dist/renovate-dispatch-LOOCNZTW.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/github/renovate-dispatch.ts","../src/cli/commands/renovate-dispatch.ts"],"sourcesContent":["import {\n  allActionableVulnsTransitive,\n  isDashboardVisible,\n  type WebsiteRow,\n} from \"../reports/airtable/websites.js\";\nimport { isRenovatePR } from \"../alerts/renovate.js\";\nimport type { PullRequestSummary } from \"./gh.js\";\n\n/**\n * On-demand Renovate trigger for fleet sites.\n *\n * The nightly security sweep (`fleet-security.yml`) writes each active site's\n * vulnerability counts to Airtable. This module turns that into action: for the\n * sites the sweep just flagged with *actionable* (critical or high) vulns, it\n * dispatches that repo's `renovate.yml` `workflow_dispatch` so Renovate runs off\n * its twice-daily schedule. Renovate's OSV vulnerability alerts bypass the\n * schedule, so the remediation PR opens immediately — and because GitHub's\n * platform auto-merge is disabled fleet-wide, Renovate merges it from inside that\n * same run (or a later scheduled one) per the shared preset, which is what keeps\n * the preset's \"majors are never auto-merged\" rule authoritative. Moderate/low\n * vulns are left to the normal schedule — not urgent enough to dispatch + churn\n * CI nightly.\n */\n\n/** The per-repo workflow file the fleet uses for its self-hosted Renovate run. */\nexport const RENOVATE_WORKFLOW_FILE = \"renovate.yml\";\n\n/**\n * Does the repo have a HEALTHY open Renovate PR — one that is NOT conflicting?\n *\n * A healthy PR means remediation is genuinely in flight (moving toward merge), so\n * re-dispatching would just churn CI — skip it. A CONFLICTING Renovate PR is STUCK\n * (its branch fell behind the base after another PR merged the same lockfile), so\n * it does NOT count as healthy: re-dispatching triggers Renovate to rebase it.\n * `UNKNOWN` mergeability (GitHub still computing it) is treated as healthy — don't\n * churn on uncertainty. Reuses {@link isRenovatePR} for the branch-prefix check.\n */\nexport function hasHealthyRenovatePr(prs: PullRequestSummary[]): boolean {\n  return prs.some((pr) => isRenovatePR(pr) && pr.mergeable !== \"CONFLICTING\");\n}\n\n/** A site selected for an on-demand Renovate run, with the reason (vuln counts). */\nexport type RenovateDispatchTarget = {\n  repo: string; // owner/repo, from the Websites \"Git repo\" field\n  siteName: string;\n  critical: number;\n  high: number;\n};\n\n/**\n * Pick the active, repo-backed sites whose latest security sweep found a\n * critical or high vulnerability. A `null` vuln count is treated as zero (a site\n * that was never swept, or had its counts cleared, is not dispatched). Inactive\n * sites and sites without a `Git repo` are excluded — there's nothing to kick.\n *\n * Counts are only guaranteed fresh for sites the sweep actually audited (active +\n * URL present); a site whose write-back failed/was skipped this run is selected on\n * its last-known counts. That's safe — a stale-high false dispatch is an idempotent\n * Renovate no-op, and the open-PR skip in `dispatchRenovateAcross` avoids re-firing\n * when remediation is already in flight.\n */\nexport function selectRenovateTargets(sites: WebsiteRow[]): RenovateDispatchTarget[] {\n  const targets: RenovateDispatchTarget[] = [];\n  for (const s of sites) {\n    if (!isDashboardVisible(s)) continue; // active (maintenance / launch period) only\n    const repo = s.gitRepo?.trim();\n    if (!repo) continue; // repo-backed only — the dispatch target is its renovate.yml\n    const critical = s.securityVulnsCritical ?? 0;\n    const high = s.securityVulnsHigh ?? 0;\n    if (critical + high <= 0) continue; // actionable (critical/high) vulns only\n    targets.push({ repo, siteName: s.name, critical, high });\n  }\n  return targets;\n}\n\n/** Injected GitHub operations — real ones come from `makeGitHub`, fakes from tests. */\nexport type RenovateDispatchDeps = {\n  /** True iff the repo has a HEALTHY (non-conflicting) open Renovate PR —\n   *  remediation in flight, so don't re-dispatch. A conflicting/stuck PR returns\n   *  false so the dispatch goes through and Renovate rebases it. */\n  hasHealthyOpenRenovatePr: (repo: string) => Promise<boolean>;\n  defaultBranch: (repo: string) => Promise<string>;\n  dispatch: (repo: string, workflow: string, ref: string) => Promise<void>;\n};\n\nexport type RenovateDispatchResult = {\n  dispatched: string[];\n  /** Repos skipped because a Renovate PR is already open — no point re-firing. */\n  skipped: string[];\n  failed: { repo: string; error: string }[];\n};\n\n/**\n * Dispatch `renovate.yml` for each target on its default branch.\n *\n * Skips a repo with a HEALTHY (non-conflicting) open Renovate PR — remediation is\n * in flight, so re-dispatching would just churn CI (keeps a persistent vuln from\n * re-firing every nightly run while its fix PR waits, e.g. a human-gated major\n * bump). A repo whose open Renovate PR is CONFLICTING/stuck is NOT skipped:\n * dispatching triggers Renovate to rebase it. Best-effort and isolated: a repo\n * that lacks `renovate.yml`, or whose\n * dispatch/PR-check is refused (the token's `actions:write` scope), is recorded in\n * `failed` and the rest still run. Never throws — the caller (a follow-up step on\n * the security sweep) must not be able to fail the sweep over a dispatch hiccup.\n */\nexport async function dispatchRenovateAcross(\n  targets: RenovateDispatchTarget[],\n  deps: RenovateDispatchDeps,\n): Promise<RenovateDispatchResult> {\n  const dispatched: string[] = [];\n  const skipped: string[] = [];\n  const failed: { repo: string; error: string }[] = [];\n  for (const t of targets) {\n    try {\n      if (await deps.hasHealthyOpenRenovatePr(t.repo)) {\n        skipped.push(t.repo);\n        continue;\n      }\n      const ref = await deps.defaultBranch(t.repo);\n      await deps.dispatch(t.repo, RENOVATE_WORKFLOW_FILE, ref);\n      dispatched.push(t.repo);\n    } catch (e) {\n      failed.push({ repo: t.repo, error: e instanceof Error ? e.message : String(e) });\n    }\n  }\n  return { dispatched, skipped, failed };\n}\n\n/** Machine-readable counts line the workflow greps to annotate partial failures. */\nexport function formatRenovateDispatchSummary(result: RenovateDispatchResult): string {\n  return `RENOVATE_DISPATCH_SUMMARY dispatched=${result.dispatched.length} skipped=${result.skipped.length} failed=${result.failed.length}`;\n}\n\n/**\n * Plan the per-site auto-fix-attempt counter writes from a dispatch result. PURE.\n * For each site:\n *   - vulns now 0 (or never counted)       → reset to 0   (episode resolved)\n *   - else dispatched this run             → attempts + 1 (a fresh failed-so-far attempt)\n *   - else (skipped / failed / untouched)  → unchanged\n * The RESET applies fleet-wide — regardless of Status or Git repo — so a site\n * archived or un-repo'd after its episode can't carry a stale counter into its\n * next vuln (Alamo sat at 7 from a long-closed episode). A null vuln count\n * (never-audited) reads as zero, consistent with the existing null-as-zero\n * semantics, so a lingering counter on such a row also clears. The INCREMENT\n * keeps its active + repo-backed filters (only those sites are dispatched).\n * Returns only the rows whose value CHANGES (a steady fleet writes nothing —\n * a 0→0 site emits no write). A skipped repo (healthy Renovate PR in flight) is\n * NOT a failed attempt — a fix is genuinely moving toward merge — so its counter\n * holds. A dispatched site whose critical/high advisories are ALL proven\n * TRANSITIVE also holds: Renovate has no direct-dep bump to open, so the run is a\n * known green no-op waiting on the weekly lockfile window, not a failed fix\n * attempt (Sonder rode 5 such no-ops to a false \"auto-fix failed\", 2026-08-10).\n * Missing/unknown relationship data keeps the increment — never mute on absence.\n */\nexport function computeAutoFixAttemptUpdates(\n  sites: WebsiteRow[],\n  result: RenovateDispatchResult,\n): { id: string; attempts: number }[] {\n  const dispatched = new Set(result.dispatched);\n  const updates: { id: string; attempts: number }[] = [];\n  for (const s of sites) {\n    const current = s.securityAutoFixAttempts ?? 0;\n    const vulns = (s.securityVulnsCritical ?? 0) + (s.securityVulnsHigh ?? 0);\n    if (vulns === 0) {\n      // Episode resolved (or never confirmed): reset REGARDLESS of status/repo —\n      // a site archived or un-repo'd after its episode must not carry a stale\n      // counter into its next vuln (Alamo sat at 7 from a long-closed episode).\n      if (current !== 0) updates.push({ id: s.id, attempts: 0 });\n      continue;\n    }\n    if (!isDashboardVisible(s)) continue; // increments stay active-only\n    const repo = s.gitRepo?.trim();\n    if (!repo) continue; // …and repo-backed-only\n    if (!dispatched.has(repo)) continue;\n    // Transitive-only episode: the dispatch can't produce a fix PR (no direct dep\n    // to bump) — don't count the no-op as a failed attempt.\n    if (allActionableVulnsTransitive(s.securityAdvisories)) continue;\n    updates.push({ id: s.id, attempts: current + 1 });\n  }\n  return updates;\n}\n\n/**\n * Apply the planned counter updates with an injected writer, BEST-EFFORT: a writer\n * that throws (e.g. the Airtable field not yet created, or a transient error) is\n * counted in `failed` and never propagates — the security sweep must not fail over\n * counter bookkeeping. Returns the applied/failed tallies for the summary line.\n */\nexport async function applyAutoFixAttemptUpdates(\n  updates: { id: string; attempts: number }[],\n  write: (id: string, attempts: number) => Promise<void>,\n): Promise<{ written: number; failed: number }> {\n  let written = 0;\n  let failed = 0;\n  for (const u of updates) {\n    try {\n      await write(u.id, u.attempts);\n      written++;\n    } catch {\n      failed++;\n    }\n  }\n  return { written, failed };\n}\n\n/** Machine-readable counts line the workflow can grep, mirroring RENOVATE_DISPATCH_SUMMARY. */\nexport function formatAutoFixAttemptsSummary(tally: { written: number; failed: number }): string {\n  return `AUTO_FIX_ATTEMPTS_SUMMARY written=${tally.written} failed=${tally.failed}`;\n}\n","import { openBase, readAirtableConfig, type AirtableBase } from \"../../reports/airtable/client.js\";\nimport { listWebsites, updateAutoFixAttempts } from \"../../reports/airtable/websites.js\";\nimport { makeGitHub } from \"../../github/gh.js\";\nimport {\n  selectRenovateTargets,\n  dispatchRenovateAcross,\n  formatRenovateDispatchSummary,\n  hasHealthyRenovatePr,\n  computeAutoFixAttemptUpdates,\n  applyAutoFixAttemptUpdates,\n  formatAutoFixAttemptsSummary,\n  type RenovateDispatchResult,\n} from \"../../github/renovate-dispatch.js\";\n\n/**\n * `renovate-dispatch --fleet`: read the Websites table, pick the active,\n * repo-backed sites the latest security sweep flagged with critical/high vulns,\n * and fire each one's `renovate.yml` `workflow_dispatch` so Renovate's OSV\n * vulnerability alerts open the remediation PR now (instead of waiting for the\n * weekly schedule). Designed to run as a best-effort follow-up step on\n * `fleet-security.yml` AFTER the sweep has written fresh counts to Airtable.\n *\n * Always exits 0: a missing token is a clean skip; a partial dispatch failure\n * (a repo without `renovate.yml`, or a token lacking `actions:write`) is reported\n * in the summary for the workflow to annotate, never failing the security sweep.\n */\nexport async function runRenovateDispatchCommand(opts: {\n  fleet?: boolean | undefined;\n  /** Inject a pre-opened Airtable base (tests). Defaults to env config. */\n  base?: AirtableBase;\n}): Promise<{ output: string; code: number }> {\n  if (!opts.fleet) {\n    return { output: \"renovate-dispatch currently supports only --fleet\", code: 2 };\n  }\n  const token = process.env.RENOVATE_TOKEN?.trim() || process.env.GH_TOKEN?.trim();\n  if (!token) {\n    return {\n      output: \"renovate-dispatch skipped: no RENOVATE_TOKEN/GH_TOKEN (fleet dispatch) configured.\",\n      code: 0,\n    };\n  }\n\n  const base = opts.base ?? openBase(readAirtableConfig());\n  const websites = await listWebsites(base);\n  const targets = selectRenovateTargets(websites);\n\n  const lines: string[] = [];\n  let result: RenovateDispatchResult = { dispatched: [], skipped: [], failed: [] };\n  if (targets.length === 0) {\n    lines.push(\n      \"No active repo-backed sites with critical/high vulnerabilities — nothing to dispatch.\",\n    );\n  } else {\n    const gh = makeGitHub({ token });\n    result = await dispatchRenovateAcross(targets, {\n      hasHealthyOpenRenovatePr: async (repo) =>\n        hasHealthyRenovatePr(await gh.openPullRequests(repo)),\n      defaultBranch: (repo) => gh.defaultBranch(repo),\n      dispatch: (repo, workflow, ref) => gh.dispatchWorkflow(repo, workflow, ref),\n    });\n\n    const failedRepos = new Set(result.failed.map((f) => f.repo));\n    const skippedRepos = new Set(result.skipped);\n    for (const t of targets) {\n      const status = failedRepos.has(t.repo)\n        ? \"FAILED                       \"\n        : skippedRepos.has(t.repo)\n          ? \"skipped (open Renovate PR)   \"\n          : \"dispatched                   \";\n      lines.push(`${status} ${t.repo} (critical=${t.critical} high=${t.high}) — ${t.siteName}`);\n    }\n    for (const f of result.failed) lines.push(`  ↳ ${f.repo}: ${f.error}`);\n  }\n\n  // Counter bookkeeping runs on EVERY fleet run — the reset-on-clean branch was\n  // previously unreachable behind the zero-targets early return, so a fully-clean\n  // fleet never cleared stale counters (Alamo stuck at 7, 2026-07). Best-effort:\n  // a failed write is tallied, never thrown. Uses the full `websites` list so\n  // 0-vuln sites reset.\n  const attemptUpdates = computeAutoFixAttemptUpdates(websites, result);\n  const attemptTally = await applyAutoFixAttemptUpdates(attemptUpdates, (id, attempts) =>\n    updateAutoFixAttempts(base, id, attempts),\n  );\n\n  lines.push(formatRenovateDispatchSummary(result));\n  lines.push(formatAutoFixAttemptsSummary(attemptTally));\n\n  return { output: lines.join(\"\\n\"), code: 0 };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAyBO,IAAM,yBAAyB;AAY/B,SAAS,qBAAqB,KAAoC;AACvE,SAAO,IAAI,KAAK,CAAC,OAAO,aAAa,EAAE,KAAK,GAAG,cAAc,aAAa;AAC5E;AAsBO,SAAS,sBAAsB,OAA+C;AACnF,QAAM,UAAoC,CAAC;AAC3C,aAAW,KAAK,OAAO;AACrB,QAAI,CAAC,mBAAmB,CAAC,EAAG;AAC5B,UAAM,OAAO,EAAE,SAAS,KAAK;AAC7B,QAAI,CAAC,KAAM;AACX,UAAM,WAAW,EAAE,yBAAyB;AAC5C,UAAM,OAAO,EAAE,qBAAqB;AACpC,QAAI,WAAW,QAAQ,EAAG;AAC1B,YAAQ,KAAK,EAAE,MAAM,UAAU,EAAE,MAAM,UAAU,KAAK,CAAC;AAAA,EACzD;AACA,SAAO;AACT;AAgCA,eAAsB,uBACpB,SACA,MACiC;AACjC,QAAM,aAAuB,CAAC;AAC9B,QAAM,UAAoB,CAAC;AAC3B,QAAM,SAA4C,CAAC;AACnD,aAAW,KAAK,SAAS;AACvB,QAAI;AACF,UAAI,MAAM,KAAK,yBAAyB,EAAE,IAAI,GAAG;AAC/C,gBAAQ,KAAK,EAAE,IAAI;AACnB;AAAA,MACF;AACA,YAAM,MAAM,MAAM,KAAK,cAAc,EAAE,IAAI;AAC3C,YAAM,KAAK,SAAS,EAAE,MAAM,wBAAwB,GAAG;AACvD,iBAAW,KAAK,EAAE,IAAI;AAAA,IACxB,SAAS,GAAG;AACV,aAAO,KAAK,EAAE,MAAM,EAAE,MAAM,OAAO,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,EAAE,CAAC;AAAA,IACjF;AAAA,EACF;AACA,SAAO,EAAE,YAAY,SAAS,OAAO;AACvC;AAGO,SAAS,8BAA8B,QAAwC;AACpF,SAAO,wCAAwC,OAAO,WAAW,MAAM,YAAY,OAAO,QAAQ,MAAM,WAAW,OAAO,OAAO,MAAM;AACzI;AAuBO,SAAS,6BACd,OACA,QACoC;AACpC,QAAM,aAAa,IAAI,IAAI,OAAO,UAAU;AAC5C,QAAM,UAA8C,CAAC;AACrD,aAAW,KAAK,OAAO;AACrB,UAAM,UAAU,EAAE,2BAA2B;AAC7C,UAAM,SAAS,EAAE,yBAAyB,MAAM,EAAE,qBAAqB;AACvE,QAAI,UAAU,GAAG;AAIf,UAAI,YAAY,EAAG,SAAQ,KAAK,EAAE,IAAI,EAAE,IAAI,UAAU,EAAE,CAAC;AACzD;AAAA,IACF;AACA,QAAI,CAAC,mBAAmB,CAAC,EAAG;AAC5B,UAAM,OAAO,EAAE,SAAS,KAAK;AAC7B,QAAI,CAAC,KAAM;AACX,QAAI,CAAC,WAAW,IAAI,IAAI,EAAG;AAG3B,QAAI,6BAA6B,EAAE,kBAAkB,EAAG;AACxD,YAAQ,KAAK,EAAE,IAAI,EAAE,IAAI,UAAU,UAAU,EAAE,CAAC;AAAA,EAClD;AACA,SAAO;AACT;AAQA,eAAsB,2BACpB,SACA,OAC8C;AAC9C,MAAI,UAAU;AACd,MAAI,SAAS;AACb,aAAW,KAAK,SAAS;AACvB,QAAI;AACF,YAAM,MAAM,EAAE,IAAI,EAAE,QAAQ;AAC5B;AAAA,IACF,QAAQ;AACN;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,SAAS,OAAO;AAC3B;AAGO,SAAS,6BAA6B,OAAoD;AAC/F,SAAO,qCAAqC,MAAM,OAAO,WAAW,MAAM,MAAM;AAClF;;;ACtLA,eAAsB,2BAA2B,MAIH;AAC5C,MAAI,CAAC,KAAK,OAAO;AACf,WAAO,EAAE,QAAQ,qDAAqD,MAAM,EAAE;AAAA,EAChF;AACA,QAAM,QAAQ,QAAQ,IAAI,gBAAgB,KAAK,KAAK,QAAQ,IAAI,UAAU,KAAK;AAC/E,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,MAAM;AAAA,IACR;AAAA,EACF;AAEA,QAAM,OAAO,KAAK,QAAQ,SAAS,mBAAmB,CAAC;AACvD,QAAM,WAAW,MAAM,aAAa,IAAI;AACxC,QAAM,UAAU,sBAAsB,QAAQ;AAE9C,QAAM,QAAkB,CAAC;AACzB,MAAI,SAAiC,EAAE,YAAY,CAAC,GAAG,SAAS,CAAC,GAAG,QAAQ,CAAC,EAAE;AAC/E,MAAI,QAAQ,WAAW,GAAG;AACxB,UAAM;AAAA,MACJ;AAAA,IACF;AAAA,EACF,OAAO;AACL,UAAM,KAAK,WAAW,EAAE,MAAM,CAAC;AAC/B,aAAS,MAAM,uBAAuB,SAAS;AAAA,MAC7C,0BAA0B,OAAO,SAC/B,qBAAqB,MAAM,GAAG,iBAAiB,IAAI,CAAC;AAAA,MACtD,eAAe,CAAC,SAAS,GAAG,cAAc,IAAI;AAAA,MAC9C,UAAU,CAAC,MAAM,UAAU,QAAQ,GAAG,iBAAiB,MAAM,UAAU,GAAG;AAAA,IAC5E,CAAC;AAED,UAAM,cAAc,IAAI,IAAI,OAAO,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC;AAC5D,UAAM,eAAe,IAAI,IAAI,OAAO,OAAO;AAC3C,eAAW,KAAK,SAAS;AACvB,YAAM,SAAS,YAAY,IAAI,EAAE,IAAI,IACjC,kCACA,aAAa,IAAI,EAAE,IAAI,IACrB,kCACA;AACN,YAAM,KAAK,GAAG,MAAM,IAAI,EAAE,IAAI,cAAc,EAAE,QAAQ,SAAS,EAAE,IAAI,YAAO,EAAE,QAAQ,EAAE;AAAA,IAC1F;AACA,eAAW,KAAK,OAAO,OAAQ,OAAM,KAAK,YAAO,EAAE,IAAI,KAAK,EAAE,KAAK,EAAE;AAAA,EACvE;AAOA,QAAM,iBAAiB,6BAA6B,UAAU,MAAM;AACpE,QAAM,eAAe,MAAM;AAAA,IAA2B;AAAA,IAAgB,CAAC,IAAI,aACzE,sBAAsB,MAAM,IAAI,QAAQ;AAAA,EAC1C;AAEA,QAAM,KAAK,8BAA8B,MAAM,CAAC;AAChD,QAAM,KAAK,6BAA6B,YAAY,CAAC;AAErD,SAAO,EAAE,QAAQ,MAAM,KAAK,IAAI,GAAG,MAAM,EAAE;AAC7C;","names":[]}

package/dist/{report-MLCIIML5.js → report-CLF2753O.js}

@@ -1,7 +1,7 @@
 import {
   draftReportForSite,
   readGaConfig
-} from "./chunk-6M2IXJ3E.js";
+} from "./chunk-UH5YPYS4.js";
 import {
   reportTier
 } from "./chunk-62VF32IC.js";
@@ -23,7 +23,7 @@ import {
   listWebsites,
   siteSlug,
   updateNextDueDates
-} from "./chunk-GXVX4HUH.js";
+} from "./chunk-YRM6EED7.js";
 import {
   openBase,
   readAirtableConfig
@@ -73,11 +73,11 @@ function dashboardBaseUrl() {
 }
 async function runReportCommand(slug, opts) {
   if (opts.digest) {
-    const { runDigest } = await import("./digest-44QNZZKM.js");
+    const { runDigest } = await import("./digest-CLFUWW62.js");
     return runDigest({ baseUrl: dashboardBaseUrl() });
   }
   if (opts.sendReady) {
-    const { sendApprovedReports } = await import("./orchestrate-NY6L4Q7Q.js");
+    const { sendApprovedReports } = await import("./orchestrate-34JYNIXT.js");
     return sendApprovedReports();
   }
   if (opts.due) {
@@ -272,4 +272,4 @@ export {
   parseSingleSiteReportType,
   runReportCommand
 };
-//# sourceMappingURL=report-MLCIIML5.js.map
+//# sourceMappingURL=report-CLF2753O.js.map

package/dist/{self-updating-WJEHPASK.js → self-updating-5TJ2NB26.js}

@@ -12,7 +12,7 @@ import {
 } from "./chunk-4NAOR44V.js";
 import {
   resolveSites
-} from "./chunk-4BHNP6Y2.js";
+} from "./chunk-ODC4PXZL.js";
 import "./chunk-73UFRZKY.js";
 import "./chunk-GASBX52O.js";
 import "./chunk-YAMRVXOD.js";
@@ -62,4 +62,4 @@ async function runSelfUpdatingCommand(site, opts) {
 export {
   runSelfUpdatingCommand
 };
-//# sourceMappingURL=self-updating-WJEHPASK.js.map
+//# sourceMappingURL=self-updating-5TJ2NB26.js.map

package/dist/{selftest-ZJDB4JQB.js → selftest-BTCZLCTL.js}

@@ -1,8 +1,8 @@
 import {
   buildReportDataForSite,
   scoresFromRow
-} from "./chunk-AKRUYPLU.js";
-import "./chunk-6M2IXJ3E.js";
+} from "./chunk-4PW6ISX7.js";
+import "./chunk-UH5YPYS4.js";
 import "./chunk-62VF32IC.js";
 import "./chunk-37S6L6G4.js";
 import {
@@ -13,7 +13,7 @@ import {
   parseAddresses,
   prepareHeaderImage,
   renderReportEmail
-} from "./chunk-42A4H6SF.js";
+} from "./chunk-FFI7P74K.js";
 import "./chunk-GECESMVS.js";
 import "./chunk-6QRLRT3P.js";
 import {
@@ -30,7 +30,7 @@ import "./chunk-U5SZ4FOP.js";
 import {
   listWebsites,
   siteSlug
-} from "./chunk-GXVX4HUH.js";
+} from "./chunk-YRM6EED7.js";
 import {
   openBase,
   readAirtableConfig
@@ -162,4 +162,4 @@ async function runSelftestCommand(kind, site, opts) {
 export {
   runSelftestCommand
 };
-//# sourceMappingURL=selftest-ZJDB4JQB.js.map
+//# sourceMappingURL=selftest-BTCZLCTL.js.map

package/dist/{smoke-suite-SUEJFBYP.js → smoke-suite-GHKXMKIR.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-4NAOR44V.js";
 import {
   resolveSites
-} from "./chunk-4BHNP6Y2.js";
+} from "./chunk-ODC4PXZL.js";
 import {
   smokeSuite
 } from "./chunk-K5JZ5KLO.js";
@@ -51,4 +51,4 @@ async function runSmokeSuiteCommand(site, opts) {
 export {
   runSmokeSuiteCommand
 };
-//# sourceMappingURL=smoke-suite-SUEJFBYP.js.map
+//# sourceMappingURL=smoke-suite-GHKXMKIR.js.map

package/dist/{submissions-RAYGOASP.js → submissions-KUXLKCSQ.js}

@@ -41,7 +41,7 @@ async function rescoreNewSubmissions(db, opts) {
 async function loadSiteNames() {
   try {
     const { openBase, readAirtableConfig } = await import("./client-EPVO3FEH.js");
-    const { listWebsites } = await import("./websites-U6642XSE.js");
+    const { listWebsites } = await import("./websites-JXG3WWAU.js");
     const sites = await listWebsites(openBase(readAirtableConfig()));
     return new Map(sites.map((s) => [s.id, s.name]));
   } catch (err) {
@@ -119,4 +119,4 @@ export {
   rescoreNewSubmissions,
   runSubmissionsCommand
 };
-//# sourceMappingURL=submissions-RAYGOASP.js.map
+//# sourceMappingURL=submissions-KUXLKCSQ.js.map

package/dist/{svelte-codemods-IWO7X3F3.js → svelte-codemods-YTCTLK7G.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-4NAOR44V.js";
 import {
   resolveSites
-} from "./chunk-4BHNP6Y2.js";
+} from "./chunk-ODC4PXZL.js";
 import {
   svelteCodemods
 } from "./chunk-LS6QPANO.js";
@@ -51,4 +51,4 @@ async function runSvelteCodemodsCommand(site, opts) {
 export {
   runSvelteCodemodsCommand
 };
-//# sourceMappingURL=svelte-codemods-IWO7X3F3.js.map
+//# sourceMappingURL=svelte-codemods-YTCTLK7G.js.map

package/dist/{sync-configs-7XGHFC6P.js → sync-configs-KSSQZU5L.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-4NAOR44V.js";
 import {
   resolveSites
-} from "./chunk-4BHNP6Y2.js";
+} from "./chunk-ODC4PXZL.js";
 import {
   ALL_CONFIG_NAMES,
   CANONICAL_GITIGNORE_ENTRIES,
@@ -113,4 +113,4 @@ async function runSyncConfigsCommand(site, opts) {
 export {
   runSyncConfigsCommand
 };
-//# sourceMappingURL=sync-configs-7XGHFC6P.js.map
+//# sourceMappingURL=sync-configs-KSSQZU5L.js.map

package/dist/{upgrade-AM4S7JF3.js → upgrade-UDAPY3SN.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-4NAOR44V.js";
 import {
   resolveSites
-} from "./chunk-4BHNP6Y2.js";
+} from "./chunk-ODC4PXZL.js";
 import {
   upgradeSvelte4to5
 } from "./chunk-B5ZUQZFL.js";
@@ -60,4 +60,4 @@ async function runUpgradeCommand(upgradeName, site, opts = {}) {
 export {
   runUpgradeCommand
 };
-//# sourceMappingURL=upgrade-AM4S7JF3.js.map
+//# sourceMappingURL=upgrade-UDAPY3SN.js.map

package/dist/{websites-U6642XSE.js → websites-JXG3WWAU.js}

@@ -5,6 +5,7 @@ import {
   PRE_LAUNCH_STATUSES,
   SEVERITY_RANK,
   WEBSITES_TABLE,
+  allActionableVulnsTransitive,
   getWebsiteBySlug,
   isArchivedStatus,
   isDashboardVisible,
@@ -28,7 +29,7 @@ import {
   updateScores,
   updateSecurityCounts,
   updateSiteField
-} from "./chunk-GXVX4HUH.js";
+} from "./chunk-YRM6EED7.js";
 export {
   ACTIVE_STATUSES,
   ARCHIVED_STATUSES,
@@ -36,6 +37,7 @@ export {
   PRE_LAUNCH_STATUSES,
   SEVERITY_RANK,
   WEBSITES_TABLE,
+  allActionableVulnsTransitive,
   getWebsiteBySlug,
   isArchivedStatus,
   isDashboardVisible,
@@ -60,4 +62,4 @@ export {
   updateSecurityCounts,
   updateSiteField
 };
-//# sourceMappingURL=websites-U6642XSE.js.map
+//# sourceMappingURL=websites-JXG3WWAU.js.map

package/dist/{write-audits-to-airtable-22T6D733.js → write-audits-to-airtable-7D3LV4KP.js}

@@ -2,13 +2,13 @@ import {
   formatFleetWriteSummary,
   writeAuditsToAirtable,
   writeFleetAuditsToAirtable
-} from "./chunk-JR67FZVC.js";
-import "./chunk-3PU2QWOJ.js";
+} from "./chunk-2BHSGLWR.js";
+import "./chunk-LMCO7CYQ.js";
 import "./chunk-5L3FPQIJ.js";
-import "./chunk-GXVX4HUH.js";
+import "./chunk-YRM6EED7.js";
 export {
   formatFleetWriteSummary,
   writeAuditsToAirtable,
   writeFleetAuditsToAirtable
 };
-//# sourceMappingURL=write-audits-to-airtable-22T6D733.js.map
+//# sourceMappingURL=write-audits-to-airtable-7D3LV4KP.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reddoorla/maintenance",
-  "version": "0.81.0",
+  "version": "0.82.0",
   "description": "Canonical maintenance configs, audits, and recipes for the reddoor stack.",
   "type": "module",
   "license": "MIT",
@@ -65,7 +65,7 @@
     "listr2": "^10.2.1",
     "node-html-parser": "^9.0.0",
     "prettier": "^3.1.1",
-    "prettier-plugin-svelte": "^3.2.6",
+    "prettier-plugin-svelte": "^4.0.0",
     "tinyglobby": "^0.2.10",
     "typescript-eslint": "^8.59.1"
   },
@@ -79,7 +79,7 @@
   },
   "devDependencies": {
     "@changesets/cli": "^2.31.0",
-    "@google-analytics/data": "^6.1.0",
+    "@google-analytics/data": "^7.0.0",
     "@lhci/cli": "^0.15.1",
     "@libsql/client": "^0.8.1",
     "@libsql/kysely-libsql": "^0.4.1",

package/dist/airtable-6L3JD7FY.js

@@ -1,9 +0,0 @@
-import {
-  fromAirtableBase
-} from "./chunk-SK44IFZN.js";
-import "./chunk-U5SZ4FOP.js";
-import "./chunk-GXVX4HUH.js";
-export {
-  fromAirtableBase
-};
-//# sourceMappingURL=airtable-6L3JD7FY.js.map