@reddoorla/maintenance 0.85.2 → 0.87.0

package/dist/index.js

@@ -1,110 +1,124 @@
 import "./chunk-2SLED3NB.js";
-import "./chunk-TP5M2NQB.js";
+import "./chunk-NCMZMLY7.js";
+import {
+  draftReportForSite
+} from "./chunk-BBUSGEES.js";
 import {
   approveBlockers
-} from "./chunk-LTB6KVJW.js";
+} from "./chunk-SDDPUAWH.js";
+import {
+  findDueReports
+} from "./chunk-PZR4EBPY.js";
 import {
   DEFAULT_INIT_STEPS,
   a11yFixturesPage,
   init
-} from "./chunk-WYYQK4D3.js";
+} from "./chunk-TD2NNXLZ.js";
+import "./chunk-BQRFQSGY.js";
+import "./chunk-Y53WOQIJ.js";
 import {
   onboard,
   selfCaretRange,
   selfPackageVersion
-} from "./chunk-UYCAF77E.js";
-import {
-  findDueReports
-} from "./chunk-D4FVAIEJ.js";
-import {
-  draftReportForSite
-} from "./chunk-MGR2H7F4.js";
-import "./chunk-62VF32IC.js";
+} from "./chunk-7RJ2HMMJ.js";
+import "./chunk-YFAXOD7Z.js";
 import {
-  domainFromUrl,
-  generateHeaderImage,
-  loadPlate
-} from "./chunk-37S6L6G4.js";
+  bumpDeps
+} from "./chunk-2NJQLSEU.js";
+import "./chunk-R53VL3RI.js";
 import {
   upgradeSvelte4to5
-} from "./chunk-ICXV25N7.js";
+} from "./chunk-Z3KYFUN6.js";
 import {
   convertToPnpm
-} from "./chunk-RJB3QUSP.js";
+} from "./chunk-XIDUYLSR.js";
 import {
   svelteCodemods
-} from "./chunk-LS6QPANO.js";
+} from "./chunk-IYSEC543.js";
 import "./chunk-J7SZQUCW.js";
-import "./chunk-R6FPFMOS.js";
-import "./chunk-S56JQJ4F.js";
-import "./chunk-R53VL3RI.js";
 import {
   parseAddresses,
   sendApprovedReports,
   withGlobalCc
-} from "./chunk-COZPL62X.js";
+} from "./chunk-NDWYJLRF.js";
+import "./chunk-NYUYNYQL.js";
+import {
+  isPendingApproval
+} from "./chunk-F3JWOPTG.js";
+import {
+  checklistFor,
+  gatingFields,
+  isHealthGateClear
+} from "./chunk-VAD43MOR.js";
+import {
+  fromAirtableBase
+} from "./chunk-C6CLRKPV.js";
+import "./chunk-IY6256GK.js";
+import "./chunk-HN6I2XWI.js";
+import "./chunk-ZGBEIWSC.js";
 import "./chunk-GECESMVS.js";
 import {
   BLURRED_CID,
   CHECK_CID,
-  checklistFor,
-  gatingFields,
-  isHealthGateClear,
-  isPendingApproval,
   loadBundledImages,
-  renderReportHtml
-} from "./chunk-6QRLRT3P.js";
-import "./chunk-MPBXOJ3N.js";
+  renderReportHtml,
+  rendersCommentary
+} from "./chunk-MT2JINSS.js";
 import {
   escapeHtml,
   safeUrl
-} from "./chunk-SEEA6RXF.js";
-import "./chunk-WEKL2HYJ.js";
+} from "./chunk-DJZWYIPP.js";
 import {
-  bumpDeps
-} from "./chunk-SDUJIANJ.js";
+  domainFromUrl,
+  generateHeaderImage,
+  loadHeadline,
+  loadPlate
+} from "./chunk-5UINJNAJ.js";
+import {
+  CANONICAL_STATUSES,
+  SEVERITY_RANK,
+  siteSlug,
+  toAirtableStatus
+} from "./chunk-7NYN2P6I.js";
+import "./chunk-WEKL2HYJ.js";
 import {
   syncConfigs
-} from "./chunk-Q276MZ7E.js";
+} from "./chunk-7UAYMAKR.js";
 import "./chunk-73UFRZKY.js";
-import "./chunk-ZTPPCHDB.js";
+import "./chunk-3G25KIWW.js";
 import "./chunk-OTGB6YQO.js";
 import {
   ALL_AUDIT_NAMES,
   a11yAudit,
   depsAudit,
-  lighthouseAudit,
   lintAudit,
   runAudits,
   runAuditsAcross,
   securityAudit
-} from "./chunk-DTTIFYAM.js";
+} from "./chunk-3JQ2FO3D.js";
 import "./chunk-LKGVSM2O.js";
 import "./chunk-GASBX52O.js";
-import "./chunk-VRWUL4TR.js";
-import "./chunk-QG6OSL4M.js";
-import "./chunk-DC5H7KEQ.js";
-import "./chunk-4SOCPK7A.js";
+import "./chunk-XHHMM5HX.js";
 import {
   fromJsonFile,
   localPath
-} from "./chunk-FDIFTIXC.js";
-import "./chunk-4DHQCN5H.js";
+} from "./chunk-6TWWY7ZU.js";
+import "./chunk-XUGSZP7Z.js";
+import "./chunk-EVBCK2KC.js";
+import "./chunk-JHGHLKFS.js";
+import "./chunk-3SF7D4DY.js";
 import "./chunk-A3WDWNN5.js";
 import {
   isLeadFormType
 } from "./chunk-2OP4JKIQ.js";
-import "./chunk-XXTZBPUY.js";
 import "./chunk-XTK5VIQB.js";
 import {
-  fromAirtableBase
-} from "./chunk-NWB4O5EY.js";
-import "./chunk-U5SZ4FOP.js";
-import {
-  SEVERITY_RANK,
-  siteSlug
-} from "./chunk-577HCGZO.js";
-import "./chunk-HN6I2XWI.js";
+  lighthouseAudit
+} from "./chunk-2NQUCS7O.js";
+import "./chunk-UDRHAQT7.js";
+import "./chunk-PTDMVGKL.js";
+import "./chunk-LBYOLBW7.js";
+import "./chunk-XXTZBPUY.js";
 import "./chunk-6VAL7XJT.js";
 import "./chunk-NMAWXBJA.js";
 import "./chunk-C6B4RHXR.js";
@@ -128,6 +142,16 @@ function isRecipeName(value) {
   return ALL_RECIPE_NAMES.includes(value);
 }
 
+// src/dashboard/favicon.ts
+var REDDOOR_FAVICON_PNG_BASE64 = "iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAMAAABEpIrGAAAACXBIWXMAAAAnAAAAJwEqCZFPAAAAk1BMVEVHcEzkGTfjGDbjGTfjGTfjGTfjGTfjGDbjGDbjGTfjGTfjGTfkGTfjGTfjGDbjGDbkGTfjGDbjGDbjGTfjGTfjGDbjGTfjGDbjGTfjGDbjGTfjGTfjGDbjGDbjGDbjGDbjGTfjGTbjGDbjGDbjGDbjGDbjGTfjGTfjGTfjGDbjGDbjGTfjGDbjGDbjGTfjGTbkGTfxxbwzAAAALXRSTlMA4DABMOD8cOBwDltwi+bFLMlk54/BDVPk/I61/u2cFaBw9nqO1izBIQE+Becdo6eEAAABBElEQVQ4y91SCVYCMQwt4kxbcEHFfUFFcMGf9P6nM0kXEPEAmtdJs+cnU+f+He2fIIEAYuVgkmvDfTG9Rh+6LoRBUBqE7gi09l9eAeeTrZJoFd5uQWfj4VbPvRqwmj9zfzP6CYpyi48F6HW5A3WuMHsEPsfvO8cSkMPTe+pfRr/MTckdg+4enqL3PkYf/YFIqiiP8VAw6EZkH6QEO0xJLUhmdbY5+TjHkCVohprlcpzlnJw9GlNkrZC16uCmWIaAZItNrT4xV0T2yxrIWoNKy4rdVXOq0MycWp4r43FOMQWciibMYaOHCXKSPhapqTupGFAnwHoVuUUZq7jaSkqDb0/uD9MXqvJMDtU7lL0AAAAASUVORK5CYII=";
+var FAVICON_LINK = `<link rel="icon" type="image/png" href="data:image/png;base64,${REDDOOR_FAVICON_PNG_BASE64}" />`;
+
+// src/dashboard/auth/render.ts
+function renderAuthChrome(email) {
+  if (!email) return "";
+  return `<div style="float:right;font-size:0.8rem;color:#666">${escapeHtml(email)} \xB7 <a href="/auth/logout">sign out</a></div>`;
+}
+
 // src/dashboard/relative-time.ts
 function relativeTimeFromNow(iso, now = /* @__PURE__ */ new Date()) {
   if (!iso) return "\u2014";
@@ -147,10 +171,6 @@ function relativeTimeFromNow(iso, now = /* @__PURE__ */ new Date()) {
   return `${months}mo ago`;
 }
 
-// src/dashboard/favicon.ts
-var REDDOOR_FAVICON_PNG_BASE64 = "iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAMAAABEpIrGAAAACXBIWXMAAAAnAAAAJwEqCZFPAAAAk1BMVEVHcEzkGTfjGDbjGTfjGTfjGTfjGTfjGDbjGDbjGTfjGTfjGTfkGTfjGTfjGDbjGDbkGTfjGDbjGDbjGTfjGTfjGDbjGTfjGDbjGTfjGDbjGTfjGTfjGDbjGDbjGDbjGDbjGTfjGTbjGDbjGDbjGDbjGDbjGTfjGTfjGTfjGDbjGDbjGTfjGDbjGDbjGTfjGTbkGTfxxbwzAAAALXRSTlMA4DABMOD8cOBwDltwi+bFLMlk54/BDVPk/I61/u2cFaBw9nqO1izBIQE+Becdo6eEAAABBElEQVQ4y91SCVYCMQwt4kxbcEHFfUFFcMGf9P6nM0kXEPEAmtdJs+cnU+f+He2fIIEAYuVgkmvDfTG9Rh+6LoRBUBqE7gi09l9eAeeTrZJoFd5uQWfj4VbPvRqwmj9zfzP6CYpyi48F6HW5A3WuMHsEPsfvO8cSkMPTe+pfRr/MTckdg+4enqL3PkYf/YFIqiiP8VAw6EZkH6QEO0xJLUhmdbY5+TjHkCVohprlcpzlnJw9GlNkrZC16uCmWIaAZItNrT4xV0T2yxrIWoNKy4rdVXOq0MycWp4r43FOMQWciibMYaOHCXKSPhapqTupGFAnwHoVuUUZq7jaSkqDb0/uD9MXqvJMDtU7lL0AAAAASUVORK5CYII=";
-var FAVICON_LINK = `<link rel="icon" type="image/png" href="data:image/png;base64,${REDDOOR_FAVICON_PNG_BASE64}" />`;
-
 // src/dashboard/onboarding.ts
 function isNonEmpty(s) {
   return typeof s === "string" && s.trim().length > 0;
@@ -294,15 +314,16 @@ var SUBMISSION_STATUS_SCRIPT = `document.querySelectorAll("button.subm-status").
     });`;
 
 // src/dashboard/site-details.ts
-var SITE_STATUS_OPTIONS = [
-  "in development",
-  "launch period",
-  "maintenance",
-  "hosting",
-  "probably not our problem",
-  "deprecated"
-];
+var SITE_STATUS_OPTIONS = CANONICAL_STATUSES.map(toAirtableStatus);
 var FREQ_OPTIONS = ["None", "Monthly", "Quarterly", "Yearly"];
+var WATCH_CONDITION_OPTIONS = [
+  "Performance",
+  "Accessibility",
+  "Best Practices",
+  "SEO",
+  "stale repo",
+  "no custom domain"
+];
 
 // src/dashboard/render.ts
 var DASH = "\u2014";
@@ -454,14 +475,27 @@ function recipientsLine(site) {
   const ccPart = cc.length > 0 ? ` \xB7 CC ${cc.map(escapeHtml).join(", ")}` : "";
   return `<span class="recipients">To ${to.map(escapeHtml).join(", ")}${ccPart}</span>`;
 }
+function rerenderButton(r) {
+  if (r.sentAt !== null) return "";
+  const url = `/api/reports/${encodeURIComponent(r.id)}/rerender`;
+  return `<button class="rerender" data-rerender-url="${escapeHtml(url)}" title="Re-render this report from its current row (runs in Actions; takes a minute or two)">refresh preview</button>`;
+}
+function reportPreviewUrl(reportId) {
+  return `/api/reports/${encodeURIComponent(reportId)}/preview`;
+}
+function commentaryEditor(r) {
+  if (!rendersCommentary(r.reportType)) return "";
+  const url = `/api/reports/${encodeURIComponent(r.id)}/commentary`;
+  return `<div class="commentary"><label for="commentary-${escapeHtml(r.id)}">Commentary <span class="muted">(re-rendered into the email at send)</span></label><textarea id="commentary-${escapeHtml(r.id)}" data-commentary-for="${escapeHtml(r.id)}" data-commentary-url="${escapeHtml(url)}" rows="3">${escapeHtml(r.commentary ?? "")}</textarea><span class="commentary-saved" data-for="${escapeHtml(r.id)}"></span></div>`;
+}
 function pendingRow(r, site, now) {
   const type = escapeHtml(r.reportType);
   const period = r.period ? escapeHtml(r.period) : "\u2014";
   const findings = approveBlockers(site, r);
   const blocked = findings.some((f) => f.level === "fail");
-  const preview = r.renderedHtmlAttachment ? `<a href="${escapeHtml(safeUrl(r.renderedHtmlAttachment.url))}" rel="noopener noreferrer" title="rendered at draft time \u2014 Commentary/subject edits after drafting are not reflected">draft preview \u25B8</a>` : `<span class="muted">no preview yet</span>`;
+  const preview = r.renderedHtmlAttachment ? `<a href="${escapeHtml(reportPreviewUrl(r.id))}" rel="noopener noreferrer" title="rendered at draft time \u2014 Commentary/subject edits after drafting are not reflected">draft preview \u25B8</a>` : `<span class="muted">no preview yet</span>`;
   const sendLine = sendTimingLine(now);
-  return `<li><div class="pending-head"><strong>${type}</strong> <span class="muted">${period}</span> ${preflightChip(findings)} ${preview} ${approveButton(r, blocked)}</div><div class="pending-info">${recipientsLine(site)} ${sendLine}</div>${checklistBlock(r)}${overrideControl(r)}</li>`;
+  return `<li><div class="pending-head"><strong>${type}</strong> <span class="muted">${period}</span> ${preflightChip(findings)} ${preview} ${rerenderButton(r)} ${approveButton(r, blocked)}</div><div class="pending-info">${recipientsLine(site)} ${sendLine}</div>${checklistBlock(r)}${commentaryEditor(r)}${overrideControl(r)}</li>`;
 }
 function pendingSection(reports, site, now) {
   const pending = reports.filter(isPendingApproval);
@@ -476,8 +510,8 @@ function gaUsersCell(r) {
   const current = String(r.gaUsersCurrent);
   if (r.gaUsersPrevious === null) return escapeHtml(current);
   const delta = r.gaUsersCurrent - r.gaUsersPrevious;
-  const sign = delta > 0 ? "+" : "";
-  return `${escapeHtml(current)} <span class="muted">(${escapeHtml(`${sign}${delta}`)})</span>`;
+  const sign2 = delta > 0 ? "+" : "";
+  return `${escapeHtml(current)} <span class="muted">(${escapeHtml(`${sign2}${delta}`)})</span>`;
 }
 function searchCell(r) {
   if (r.searchFoundPage1 && r.searchPosition !== null) {
@@ -491,12 +525,13 @@ function reportRow(r, site) {
   const id = escapeHtml(r.reportId);
   const ga = gaUsersCell(r);
   const search = searchCell(r);
-  const link = r.renderedHtmlAttachment ? `<a href="${escapeHtml(safeUrl(r.renderedHtmlAttachment.url))}">view</a>` : `<span class="muted">no attachment</span>`;
+  const link = r.renderedHtmlAttachment ? `<a href="${escapeHtml(reportPreviewUrl(r.id))}">view</a>` : `<span class="muted">no attachment</span>`;
   const action = isPendingApproval(r) ? approveButton(
     r,
     approveBlockers(site, r).some((f) => f.level === "fail")
   ) : "";
-  return `<tr><td>${date}</td><td>${type}</td><td><code>${id}</code></td><td>${ga}</td><td>${search}</td><td>${link}</td><td>${action}</td></tr>`;
+  const commentary = r.sentAt === null && !isPendingApproval(r) ? `<tr class="commentary-row"><td colspan="7">${commentaryEditor(r)}</td></tr>` : "";
+  return `<tr><td>${date}</td><td>${type}</td><td><code>${id}</code></td><td>${ga}</td><td>${search}</td><td>${link}</td><td>${action}</td></tr>${commentary}`;
 }
 var SUBMISSIONS_PER_SITE_CAP = 25;
 function submissionsSection(submissions, site) {
@@ -575,6 +610,28 @@ function selectRow(label, field, options, current, url) {
 function inputRow(label, field, value, url) {
   return `<div class="detail"><dt><label for="detail-${field}">${escapeHtml(label)}</label></dt><dd><input type="text" id="detail-${field}" data-detail-field="${field}" data-details-url="${url}" value="${escapeHtml(value ?? "")}" />${savedSpan(field)}</dd></div>`;
 }
+var DETAIL_VALUE_FN = `function detailValue(el) {
+      if (el.type === "checkbox") return el.checked ? "true" : "false";
+      if (el.multiple) return Array.from(el.selectedOptions).map((o) => o.value).join(",");
+      return el.value;
+    }`;
+function dateRow(label, field, value, url) {
+  return `<div class="detail"><dt><label for="detail-${field}">${escapeHtml(label)}</label></dt><dd><input type="date" id="detail-${field}" data-detail-field="${field}" data-details-url="${url}" value="${escapeHtml(value ?? "")}" />${savedSpan(field)}</dd></div>`;
+}
+function checkboxRow(label, field, checked, url) {
+  return `<div class="detail"><dt><label for="detail-${field}">${escapeHtml(label)}</label></dt><dd><input type="checkbox" id="detail-${field}" data-detail-field="${field}" data-details-url="${url}"${checked ? " checked" : ""} />${savedSpan(field)}</dd></div>`;
+}
+function multiSelectRow(label, field, options, selected, url) {
+  const sel = new Set(selected);
+  const opts = options.map(
+    (o) => `<option value="${escapeHtml(o)}"${sel.has(o) ? " selected" : ""}>${escapeHtml(o)}</option>`
+  ).join("");
+  return `<div class="detail wide"><dt><label for="detail-${field}">${escapeHtml(label)}</label></dt><dd><select multiple id="detail-${field}" data-detail-field="${field}" data-details-url="${url}">${opts}</select>${savedSpan(field)}</dd></div>`;
+}
+function secretRow(label, field, isSet, url) {
+  const ph = isSet ? "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022 (set \u2014 type to replace)" : "not set";
+  return `<div class="detail"><dt><label for="detail-${field}">${escapeHtml(label)}</label></dt><dd><input type="password" autocomplete="off" id="detail-${field}" data-detail-field="${field}" data-details-url="${url}" placeholder="${escapeHtml(ph)}" />${savedSpan(field)}</dd></div>`;
+}
 function textareaRow(label, field, value, url) {
   return `<div class="detail wide"><dt><label for="detail-${field}">${escapeHtml(label)}</label></dt><dd><textarea id="detail-${field}" data-detail-field="${field}" data-details-url="${url}">${escapeHtml(value ?? "")}</textarea>${savedSpan(field)}</dd></div>`;
 }
@@ -582,7 +639,11 @@ function siteDetailsSection(site) {
   const url = `/api/sites/${escapeHtml(siteSlug(site.name))}/details`;
   const lastCommit = site.lastCommitAt ? `${relativeTimeFromNow(site.lastCommitAt)}` : null;
   const rows = [
-    selectRow("Status", "status", SITE_STATUS_OPTIONS, site.status, url),
+    // `statusRaw`, not `status`: this select's options ARE the Airtable cell
+    // values (see SITE_STATUS_OPTIONS), so it must preselect against the raw cell.
+    // Comparing the canonical value would mis-preselect every site, and would show
+    // a "legacy" site as "deprecated" instead of the placeholder.
+    selectRow("Status", "status", SITE_STATUS_OPTIONS, site.statusRaw, url),
     selectRow("Maintenance cadence", "maintenanceFreq", FREQ_OPTIONS, site.maintenanceFreq, url),
     selectRow("Testing cadence", "testingFreq", FREQ_OPTIONS, site.testingFreq, url),
     inputRow("Report recipients (To)", "reportRecipientsTo", site.reportRecipientsTo, url),
@@ -591,6 +652,27 @@ function siteDetailsSection(site) {
     inputRow("GA4 property", "ga4PropertyId", site.ga4PropertyId, url),
     inputRow("Search query", "searchQuery", site.searchQuery, url),
     inputRow("Git repo", "gitRepo", site.gitRepo, url),
+    // #539 Phase 4 — the fields nothing rendered before. `Mailchimp API Key` is
+    // the one field in that group still absent, and deliberately: it is a live
+    // credential and every row here emits its stored value into the page.
+    inputRow("Netlify ID", "netlifyId", site.netlifyId, url),
+    inputRow("Search Console property", "searchConsoleProperty", site.searchConsoleProperty, url),
+    inputRow("Newsletter webhook", "newsletterWebhook", site.newsletterWebhook, url),
+    inputRow("Mailchimp audience ID", "mailchimpAudienceId", site.mailchimpAudienceId, url),
+    dateRow("Last maintenance day", "maintenanceDay", site.maintenanceDay, url),
+    dateRow("Last testing day", "testingDay", site.testingDay, url),
+    // Raw JSON, and shown as the raw cell rather than the parsed object: what the
+    // operator edits has to be the thing `parseNotifyRouting` will read back.
+    textareaRow("Notify routing (JSON)", "notifyRouting", site.notifyRoutingRaw, url),
+    checkboxRow("Require Turnstile", "requireTurnstile", site.requireTurnstile, url),
+    secretRow("Mailchimp API key", "mailchimpApiKey", site.mailchimpApiKey !== null, url),
+    multiSelectRow(
+      "Accepted watch conditions",
+      "acceptedWatchConditions",
+      WATCH_CONDITION_OPTIONS,
+      site.acceptedWatchConditions,
+      url
+    ),
     textareaRow("Copy \u2014 Intro", "copyIntro", site.copyIntro, url),
     textareaRow("Copy \u2014 Contact", "copyContact", site.copyContact, url),
     textareaRow("Copy \u2014 Footer", "copyFooter", site.copyFooter, url),
@@ -754,7 +836,7 @@ button.trigger-renovate:disabled { opacity: 0.6; cursor: default; }
 .chip.accepted { background: transparent; border: 1px dashed #bbb; color: #888; }
 @media (prefers-color-scheme: dark) { .chip.accepted { border-color: #444; } .chip.critical { background: #2a0f0d; color: #ff8a80; } }
 `;
-function renderSiteDashboardHtml(site, reports, submissions = [], spamTotals = null, now = /* @__PURE__ */ new Date(), alarm = null) {
+function renderSiteDashboardHtml(site, reports, submissions = [], spamTotals = null, now = /* @__PURE__ */ new Date(), alarm = null, operatorEmail = null) {
   const name = escapeHtml(site.name);
   const urlSafe = safeUrl(site.url);
   const allScoresNull = site.pScore === null && site.rScore === null && site.bpScore === null && site.seoScore === null;
@@ -787,6 +869,7 @@ function renderSiteDashboardHtml(site, reports, submissions = [], spamTotals = n
   <style>${STYLES}${SUBMISSION_STYLES}</style>
 </head>
 <body>
+  ${renderAuthChrome(operatorEmail)}
   <a class="home" href="/">\u2190 Fleet home</a>
   <h1>${name}</h1>
   <div class="meta"><a href="${escapeHtml(urlSafe)}">${escapeHtml(site.url)}</a></div>
@@ -932,12 +1015,13 @@ function renderSiteDashboardHtml(site, reports, submissions = [], spamTotals = n
     });
     // Site-details editor: save on change (selects) / blur (inputs+textareas, only
     // when the value actually changed). The per-field span shows \u2713 / \u2717.
+    ${DETAIL_VALUE_FN}
     function saveDetail(el) {
       const span = document.querySelector('.detail-saved[data-for="' + el.dataset.detailField + '"]');
       fetch(el.dataset.detailsUrl, {
         method: "POST",
         headers: { "content-type": "application/json" },
-        body: JSON.stringify({ field: el.dataset.detailField, value: el.value }),
+        body: JSON.stringify({ field: el.dataset.detailField, value: detailValue(el) }),
       })
         .then((r) => {
           if (span) span.textContent = r.ok ? " \u2713" : " \u2717";
@@ -949,11 +1033,55 @@ function renderSiteDashboardHtml(site, reports, submissions = [], spamTotals = n
     document.querySelectorAll("select[data-detail-field]").forEach((s) => {
       s.addEventListener("change", () => saveDetail(s));
     });
-    document.querySelectorAll("input[data-detail-field], textarea[data-detail-field]").forEach((i) => {
+    // Checkboxes save on CHANGE. They cannot use the blur path below: that path
+    // only fires when \`value !== defaultValue\`, and for a checkbox both are the
+    // "on" content attribute, so it would never save at all.
+    document.querySelectorAll("input[type=checkbox][data-detail-field]").forEach((c) => {
+      c.addEventListener("change", () => saveDetail(c));
+    });
+    document.querySelectorAll("input:not([type=checkbox])[data-detail-field], textarea[data-detail-field]").forEach((i) => {
       i.addEventListener("blur", () => {
         if (i.value !== i.defaultValue) saveDetail(i);
       });
     });
+    // Refresh preview: dispatch the re-render workflow, then tell the operator to
+    // reload once it lands. No polling \u2014 the run takes a minute or two and a
+    // spinner that long reads as a hang.
+    document.querySelectorAll("button.rerender").forEach((b) => {
+      b.addEventListener("click", async () => {
+        b.disabled = true;
+        b.textContent = "Refreshing\u2026";
+        try {
+          const res = await fetch(b.dataset.rerenderUrl, { method: "POST" });
+          b.textContent = res.ok ? "Queued \u2713 reload in ~2 min" : "Failed";
+          if (!res.ok) b.disabled = false;
+        } catch {
+          b.textContent = "Failed";
+          b.disabled = false;
+        }
+      });
+    });
+    // Report commentary: save on blur, only when it actually changed. Same
+    // shape as the site-details editor, but keyed on the REPORT id rather than a
+    // field name, so it posts { text } to the report's own endpoint.
+    document.querySelectorAll("textarea[data-commentary-for]").forEach((t) => {
+      t.addEventListener("blur", () => {
+        if (t.value === t.defaultValue) return;
+        const span = document.querySelector('.commentary-saved[data-for="' + t.dataset.commentaryFor + '"]');
+        fetch(t.dataset.commentaryUrl, {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({ text: t.value }),
+        })
+          .then((r) => {
+            if (span) span.textContent = r.ok ? " \u2713" : " \u2717";
+            if (r.ok) t.defaultValue = t.value;
+          })
+          .catch(() => {
+            if (span) span.textContent = " \u2717";
+          });
+      });
+    });
     ${SUBMISSION_STATUS_SCRIPT}
   </script>
 </body>
@@ -1612,7 +1740,7 @@ var AUDIT_SCRIPT = `<script>
   } catch(e){}
 })();
 </script>`;
-function renderCockpitHtml(model) {
+function renderCockpitHtml(model, operatorEmail = null) {
   const total = model.cards.length;
   const feed = buildNeedsYouFeed(model);
   return `<!doctype html>
@@ -1625,8 +1753,9 @@ function renderCockpitHtml(model) {
   <style>${STYLES2}</style>
 </head>
 <body>
+  ${renderAuthChrome(operatorEmail)}
   <h1>Reddoor fleet cockpit</h1>
-  <div class="meta">${total} site${total === 1 ? "" : "s"} on the Reddoor stack.</div>
+  <div class="meta">${total} site${total === 1 ? "" : "s"} on the Reddoor stack. <a href="/fleet">Fleet table \u2192</a></div>
   ${verdictBar(model, feed)}
   ${renderNeedsYouFeed(feed)}
   ${renderFleetBrowsePanel(model)}
@@ -1659,6 +1788,15 @@ function verifyBasicAuth(authHeader, expectedPassword) {
   if (a.length !== b.length) return false;
   return timingSafeEqual(a, b);
 }
+
+// src/dashboard/auth/signing.ts
+import { createHmac, timingSafeEqual as timingSafeEqual2 } from "crypto";
+
+// src/dashboard/auth/session.ts
+var SESSION_TTL_SECONDS = 30 * 24 * 60 * 60;
+
+// src/dashboard/prospect-audit-trigger.ts
+var PROSPECT_AUDIT_DUPLICATE_WINDOW_MS = 10 * 60 * 1e3;
 export {
   ALL_AUDIT_NAMES,
   ALL_RECIPE_NAMES,
@@ -1681,6 +1819,7 @@ export {
   lighthouseAudit,
   lintAudit,
   loadBundledImages,
+  loadHeadline,
   loadPlate,
   localPath,
   onboard,