@reddoorla/maintenance 0.86.0 → 0.87.0

package/dist/prospect/types.d.ts

@@ -0,0 +1,267 @@
+import { a as AuditResult } from '../types-OIQZ5hWN.js';
+
+/** Every pipeline stage resolves to this. A failed stage degrades its report
+ *  section to "not measured" — it never kills the run (spec: error handling). */
+type StageResult<T> = {
+    ok: true;
+    data: T;
+} | {
+    ok: false;
+    error: string;
+};
+type RobotsAgentAccess = {
+    agent: string;
+    /** May this agent fetch "/" per robots.txt? (No robots.txt → allowed.) */
+    allowed: boolean;
+    /** The deciding rule, e.g. "User-agent: GPTBot → Disallow: /". Null = no rule matched. */
+    matchedRule: string | null;
+};
+type PageExtract = {
+    title: string | null;
+    metaDescription: string | null;
+    canonical: string | null;
+    /** property/name → content for og:* and twitter:* metas. */
+    social: Record<string, string>;
+    /** `level` is 1-6 (H1-H6). */
+    headings: {
+        level: number;
+        text: string;
+    }[];
+    /** Raw text of each <script type="application/ld+json"> block. */
+    jsonLd: string[];
+    images: {
+        total: number;
+        withAlt: number;
+    };
+    hasViewportMeta: boolean;
+    /** Visible text, whitespace-collapsed. */
+    text: string;
+};
+type PageCapture = {
+    url: string;
+    /** HTTP status of the raw fetch. Null = the fetch itself failed. */
+    status: number | null;
+    /** Extract of the raw HTTP HTML (what non-JS crawlers see). */
+    raw: PageExtract | null;
+    /** Extract of the Playwright-rendered DOM (what a browser sees). */
+    rendered: PageExtract | null;
+    error: string | null;
+};
+type CrawlResult = {
+    /** Normalized origin, e.g. "https://example.com". */
+    origin: string;
+    robotsTxt: string | null;
+    /** One entry per agent in crawl.ts's ALL_AGENTS (6 AI + 2 classical). */
+    agentAccess: RobotsAgentAccess[];
+    sitemap: {
+        present: boolean;
+        urlCount: number;
+    };
+    llmsTxt: {
+        present: boolean;
+        firstLine: string | null;
+    };
+    /** Per sidecar, the error that stopped us fetching it, or null. A fetch that
+     *  FAILED must never be reported as "the site has no robots.txt" — that would
+     *  claim the crawlers are unrestricted when we simply did not look. */
+    sidecarErrors: {
+        robots: string | null;
+        llms: string | null;
+        sitemap: string | null;
+    };
+    /** Lower-cased homepage response headers (security-header check input). */
+    homeHeaders: Record<string, string>;
+    pages: PageCapture[];
+};
+type ChecksResult = {
+    /** False when the robots.txt fetch itself failed, so "no AI crawler is
+     *  blocked" would be our silence rather than the site's answer. The report
+     *  must say "not measured" for crawler access when this is false. */
+    crawlerAccessMeasured: boolean;
+    crawlerAccess: {
+        blockedAi: string[];
+        allowedAi: string[];
+        blockedClassical: string[];
+    };
+    jsDependence: {
+        /** 0..1 — fraction of rendered words absent from the raw HTML, weighted by
+         *  page size (total missing words / total rendered words across every
+         *  comparable page) — or null when no page produced a comparable pair.
+         *  Never 0 for "nothing measured": a page whose raw fetch was blocked, or
+         *  whose rendered text tokenizes to nothing, drops out of the average
+         *  rather than forcing it toward a false "perfectly crawlable". */
+        avgMissing: number | null;
+        perPage: {
+            url: string;
+            /** 0..1 — this page's own missing fraction (unweighted). */
+            missing: number;
+            /** Token count wordSet(rendered.text) produced for this page — the
+             *  weight avgMissing gives it, and why a "coming soon" stub can't swing
+             *  the headline number the way a full page does. */
+            renderedWords: number;
+        }[];
+    };
+    schema: {
+        typesFound: string[];
+        missingExpected: string[];
+        invalidBlocks: number;
+    };
+    meta: {
+        pageCount: number;
+        missingTitle: number;
+        missingDescription: number;
+        missingCanonical: number;
+        missingSocial: number;
+        /** Pages where neither the raw nor the rendered fetch produced an extract
+         *  — excluded from pageCount and every other meta denominator above, so a
+         *  report reading "1 of 2 pages missing a description" doesn't silently
+         *  hide the third page that produced nothing at all. */
+        pagesWithoutExtract: number;
+    };
+    headings: {
+        pagesWithoutH1: number;
+        pagesWithLevelSkips: number;
+    };
+    securityHeaders: {
+        present: string[];
+        missing: string[];
+    };
+    /** False when the sitemap.xml fetch itself failed (crawl.sidecarErrors.sitemap
+     *  !== null), so `sitemapPresent: false` would otherwise read as "confirmed
+     *  absent" rather than "we never got an answer". The report must say "not
+     *  measured" for sitemap presence when this is false, and computeScores must
+     *  treat it as neutral rather than penalizing the technical component for a
+     *  fetch we could not complete. */
+    sitemapMeasured: boolean;
+    sitemapPresent: boolean;
+    /** Same as sitemapMeasured, for the llms.txt fetch (crawl.sidecarErrors.llms). */
+    llmsTxtMeasured: boolean;
+    llmsTxtPresent: boolean;
+    viewportOk: boolean;
+};
+type BuyerQuestion = {
+    question: string;
+    answered: "yes" | "partial" | "no";
+    /** Is there a passage an AI answer could quote verbatim? */
+    quotable: boolean;
+    page: string | null;
+    evidence: string | null;
+};
+type Fix = {
+    title: string;
+    why: string;
+    impact: "high" | "medium" | "low";
+    effort: "low" | "medium" | "high";
+    tier: "crawl" | "content" | "technical";
+};
+type AnalyzeResult = {
+    /** The business's proper name, as a searchable proper noun — "Acme Roofing",
+     *  not a description of it. Empty string when the site never states one,
+     *  which is itself a finding. This is what the visibility probes query and
+     *  brand-match against; `business` below is prose and unsearchable. */
+    businessName: string;
+    /** The model's read of what this company does, for whom, where. */
+    business: string;
+    entityClarity: {
+        score: number;
+        missing: string[];
+    };
+    buyerQuestions: BuyerQuestion[];
+    /** Standalone searches for the visibility probes — what a buyer types before
+     *  they know this company exists. Distinct from `buyerQuestions`, which are
+     *  phrased about this site and are unanswerable on their own; see the schema
+     *  comment in analyze.ts for what that cost us. Never mentions the business. */
+    categoryQueries: string[];
+    fixes: Fix[];
+    narrative: {
+        findability: string;
+        readability: string;
+        answers: string;
+    };
+};
+type ProbeAnswer = {
+    engine: string;
+    query: string;
+    /** "branded" ("who is X" / "X reviews") always echoes the name back even when
+     *  an engine knows nothing real, so it cannot be trusted as a discoverability
+     *  signal. "category" is a real buyer question — the one the score is built
+     *  from. "competitor" is a head-to-head comparison query. */
+    kind: "branded" | "category" | "competitor";
+    domainCited: boolean;
+    brandMentioned: boolean;
+    citedDomains: string[];
+    /** First ~300 chars of the engine's answer — the report's receipt. */
+    snippet: string;
+    /** True when `snippet` is a truncated prefix of a longer answer — set
+     *  right where the truncation happens (probes.ts's SNIPPET_CHARS), so the
+     *  renderer never has to re-derive "was this cut short?" from a length
+     *  check of its own against a constant it can't see. */
+    truncated: boolean;
+    /** ISO-8601, set when the answer came back — this stage's whole output is
+     *  quotable claims about a live third party, and answer engines' answers
+     *  drift, so a disputed line in a report needs a date attached. */
+    askedAt: string;
+};
+type ProbesResult = {
+    answers: ProbeAnswer[];
+    /** 0..100 — fraction of CATEGORY answers (real buyer questions) where the
+     *  prospect was cited or mentioned. Null — never 0 — when no category query
+     *  ran at all, e.g. the analyze stage failed and supplied no buyer questions.
+     *  Deliberately excludes branded answers: "who is X"/"X reviews" echo the name
+     *  back even when the engine knows nothing real, which would put a floor
+     *  under the score that has nothing to do with discoverability. */
+    visibilityScore: number | null;
+    /** Did any branded query produce a real citation of the prospect's own
+     *  domain — not merely an echo of the name in prose. Reported separately from
+     *  visibilityScore because it answers a different question ("does the engine
+     *  know this business exists at all") from the one the score answers ("would
+     *  it surface this business to someone who didn't already name it"). */
+    brandedRecognized: boolean;
+    competitorsSeen: {
+        domain: string;
+        count: number;
+    }[];
+};
+type LighthouseScores = {
+    performance: number | null;
+    accessibility: number | null;
+    bestPractices: number | null;
+    seo: number | null;
+    summary: string;
+    status: AuditResult["status"];
+};
+type Scores = {
+    findability: number | null;
+    readability: number | null;
+    answers: number | null;
+    aiVisibility: number | null;
+};
+type ProspectAuditResult = {
+    url: string;
+    /** The resolved searchable proper NOUN — "Acme Roofing", not a description
+     *  of it (mirrors `AnalyzeResult.businessName`, the value this is usually
+     *  copied from). Distinct from `AnalyzeResult.business` (prose, nested
+     *  under `analyze.data`) — the two share a root name only because they're
+     *  one level apart, not because they hold the same kind of value. Null
+     *  when no name was ever resolved (operator override empty, model returned
+     *  none) — itself a finding, not an error. Persisted verbatim into the
+     *  database's `business` COLUMN (kept as-is; a rename there would need its
+     *  own migration for no benefit) — map at that one boundary, not here. */
+    businessName: string | null;
+    generatedAt: string;
+    scores: Scores;
+    /** The crawl is the one fatal stage (see pipeline.ts): a crawl failure
+     *  throws before a ProspectAuditResult is ever built, so the `ok:false`
+     *  branch of StageResult can never appear here. Narrowed to the success
+     *  shape only, so consumers never handle the impossible branch. */
+    crawl: {
+        ok: true;
+        data: CrawlResult;
+    };
+    checks: StageResult<ChecksResult>;
+    lighthouse: StageResult<LighthouseScores>;
+    analyze: StageResult<AnalyzeResult>;
+    probes: StageResult<ProbesResult>;
+};
+
+export type { AnalyzeResult, BuyerQuestion, ChecksResult, CrawlResult, Fix, LighthouseScores, PageCapture, PageExtract, ProbeAnswer, ProbesResult, ProspectAuditResult, RobotsAgentAccess, Scores, StageResult };

package/dist/prospect/types.js

@@ -0,0 +1 @@
+//# sourceMappingURL=types.js.map

package/dist/{prospect-audit-IUNCJ2LV.js → prospect-audit-KSXUNQ5J.js}

@@ -85,7 +85,7 @@ async function runProspectAuditCommand(url, opts) {
       "No TURSO_DATABASE_URL, so the report cannot be saved or shared. Re-run with --out <file>, or set the Turso credentials."
     );
   }
-  const { runProspectAudit } = await import("./pipeline-S6CVHDGB.js");
+  const { runProspectAudit } = await import("./pipeline-3AANZFCR.js");
   const onStage = (name, status, detail) => {
     if (status === "start") console.error(`\u2026 ${name}`);
     else if (status === "ok") console.error(`\u2713 ${name}`);
@@ -103,7 +103,7 @@ async function runProspectAuditCommand(url, opts) {
     },
     { ...opts.deps ?? {}, onStage }
   );
-  const { renderProspectReport } = await import("./render-AQAVQDPZ.js");
+  const { renderProspectReport } = await import("./render-IFOGFB5T.js");
   const html = renderProspectReport(result);
   const warnings = [];
   let file = null;
@@ -146,7 +146,7 @@ async function runProspectAuditCommand(url, opts) {
   let email = null;
   if (opts.email) {
     try {
-      const { sendAuditEmail, parseProspectAuditRecipients } = await import("./email-VTTTKKL5.js");
+      const { sendAuditEmail, parseProspectAuditRecipients } = await import("./email-KJXASVH5.js");
       const recipients = parseProspectAuditRecipients(process.env.PROSPECT_AUDIT_RECIPIENTS);
       email = await sendAuditEmail(result, { link, recipients, auditId });
       if (!email.sent) {
@@ -171,4 +171,4 @@ async function runProspectAuditCommand(url, opts) {
 export {
   runProspectAuditCommand
 };
-//# sourceMappingURL=prospect-audit-IUNCJ2LV.js.map
+//# sourceMappingURL=prospect-audit-KSXUNQ5J.js.map

package/dist/recipes/sync-configs.js

@@ -2,9 +2,9 @@ import {
   ALL_CONFIG_NAMES,
   isConfigName,
   syncConfigs
-} from "../chunk-3VQWSE3F.js";
-import "../chunk-3G25KIWW.js";
+} from "../chunk-7UAYMAKR.js";
 import "../chunk-73UFRZKY.js";
+import "../chunk-3G25KIWW.js";
 import "../chunk-XTK5VIQB.js";
 import "../chunk-XXTZBPUY.js";
 export {

package/dist/{render-AQAVQDPZ.js → render-IFOGFB5T.js}

@@ -1,10 +1,10 @@
 import {
   renderProspectReport
-} from "./chunk-W7Z3BGCI.js";
-import "./chunk-X3B723J4.js";
+} from "./chunk-DEWJMMG3.js";
+import "./chunk-HSI6Q7MI.js";
 import "./chunk-DJZWYIPP.js";
 import "./chunk-EVBCK2KC.js";
 export {
   renderProspectReport
 };
-//# sourceMappingURL=render-AQAVQDPZ.js.map
+//# sourceMappingURL=render-IFOGFB5T.js.map

package/dist/render-IFOGFB5T.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/render-from-row-BWSOIYDS.js

@@ -0,0 +1,17 @@
+import {
+  renderReportFromRow,
+  requireLighthouse,
+  windowDays
+} from "./chunk-ZGBEIWSC.js";
+import "./chunk-GECESMVS.js";
+import "./chunk-MT2JINSS.js";
+import "./chunk-DJZWYIPP.js";
+import "./chunk-5UINJNAJ.js";
+import "./chunk-7NYN2P6I.js";
+import "./chunk-EVBCK2KC.js";
+export {
+  renderReportFromRow,
+  requireLighthouse,
+  windowDays
+};
+//# sourceMappingURL=render-from-row-BWSOIYDS.js.map

package/dist/render-from-row-BWSOIYDS.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/{renovate-dispatch-QJY75ODR.js → renovate-dispatch-6GQWTRKX.js}

@@ -5,16 +5,16 @@ import {
   openBase,
   readAirtableConfig
 } from "./chunk-HN6I2XWI.js";
-import {
-  makeGitHub
-} from "./chunk-XHHMM5HX.js";
-import "./chunk-LBYOLBW7.js";
 import {
   allActionableVulnsTransitive,
   isDashboardVisible,
   listWebsites,
   updateAutoFixAttempts
-} from "./chunk-LDWZSLSU.js";
+} from "./chunk-7NYN2P6I.js";
+import {
+  makeGitHub
+} from "./chunk-XHHMM5HX.js";
+import "./chunk-LBYOLBW7.js";
 import "./chunk-6VAL7XJT.js";
 
 // src/github/renovate-dispatch.ts
@@ -130,10 +130,10 @@ async function runRenovateDispatchCommand(opts) {
     for (const f of result.failed) lines.push(`  \u21B3 ${f.repo}: ${f.error}`);
   }
   const attemptUpdates = computeAutoFixAttemptUpdates(websites, result);
-  const attemptTally = await applyAutoFixAttemptUpdates(
-    attemptUpdates,
-    (id, attempts) => updateAutoFixAttempts(base, id, attempts)
-  );
+  const attemptTally = await applyAutoFixAttemptUpdates(attemptUpdates, async (id, attempts) => {
+    const fields = await updateAutoFixAttempts(base, id, attempts);
+    await opts.siteMirror?.health(id, fields);
+  });
   lines.push(formatRenovateDispatchSummary(result));
   lines.push(formatAutoFixAttemptsSummary(attemptTally));
   return { output: lines.join("\n"), code: 0 };
@@ -141,4 +141,4 @@ async function runRenovateDispatchCommand(opts) {
 export {
   runRenovateDispatchCommand
 };
-//# sourceMappingURL=renovate-dispatch-QJY75ODR.js.map
+//# sourceMappingURL=renovate-dispatch-6GQWTRKX.js.map

package/dist/{renovate-dispatch-QJY75ODR.js.map → renovate-dispatch-6GQWTRKX.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/github/renovate-dispatch.ts","../src/cli/commands/renovate-dispatch.ts"],"sourcesContent":["import {\n  allActionableVulnsTransitive,\n  isDashboardVisible,\n  type WebsiteRow,\n} from \"../reports/airtable/websites.js\";\nimport { isRenovatePR } from \"../alerts/renovate.js\";\nimport type { PullRequestSummary } from \"./gh.js\";\n\n/**\n * On-demand Renovate trigger for fleet sites.\n *\n * The nightly security sweep (`fleet-security.yml`) writes each active site's\n * vulnerability counts to Airtable. This module turns that into action: for the\n * sites the sweep just flagged with *actionable* (critical or high) vulns, it\n * dispatches that repo's `renovate.yml` `workflow_dispatch` so Renovate runs off\n * its twice-daily schedule. Renovate's OSV vulnerability alerts bypass the\n * schedule, so the remediation PR opens immediately — and because GitHub's\n * platform auto-merge is disabled fleet-wide, Renovate merges it from inside that\n * same run (or a later scheduled one) per the shared preset, which is what keeps\n * the preset's \"majors are never auto-merged\" rule authoritative. Moderate/low\n * vulns are left to the normal schedule — not urgent enough to dispatch + churn\n * CI nightly.\n */\n\n/** The per-repo workflow file the fleet uses for its self-hosted Renovate run. */\nexport const RENOVATE_WORKFLOW_FILE = \"renovate.yml\";\n\n/**\n * Does the repo have a HEALTHY open Renovate PR — one that is NOT conflicting?\n *\n * A healthy PR means remediation is genuinely in flight (moving toward merge), so\n * re-dispatching would just churn CI — skip it. A CONFLICTING Renovate PR is STUCK\n * (its branch fell behind the base after another PR merged the same lockfile), so\n * it does NOT count as healthy: re-dispatching triggers Renovate to rebase it.\n * `UNKNOWN` mergeability (GitHub still computing it) is treated as healthy — don't\n * churn on uncertainty. Reuses {@link isRenovatePR} for the branch-prefix check.\n */\nexport function hasHealthyRenovatePr(prs: PullRequestSummary[]): boolean {\n  return prs.some((pr) => isRenovatePR(pr) && pr.mergeable !== \"CONFLICTING\");\n}\n\n/** A site selected for an on-demand Renovate run, with the reason (vuln counts). */\nexport type RenovateDispatchTarget = {\n  repo: string; // owner/repo, from the Websites \"Git repo\" field\n  siteName: string;\n  critical: number;\n  high: number;\n};\n\n/**\n * Pick the active, repo-backed sites whose latest security sweep found a\n * critical or high vulnerability. A `null` vuln count is treated as zero (a site\n * that was never swept, or had its counts cleared, is not dispatched). Inactive\n * sites and sites without a `Git repo` are excluded — there's nothing to kick.\n *\n * Counts are only guaranteed fresh for sites the sweep actually audited (active +\n * URL present); a site whose write-back failed/was skipped this run is selected on\n * its last-known counts. That's safe — a stale-high false dispatch is an idempotent\n * Renovate no-op, and the open-PR skip in `dispatchRenovateAcross` avoids re-firing\n * when remediation is already in flight.\n */\nexport function selectRenovateTargets(sites: WebsiteRow[]): RenovateDispatchTarget[] {\n  const targets: RenovateDispatchTarget[] = [];\n  for (const s of sites) {\n    if (!isDashboardVisible(s)) continue; // active (maintenance / launch period) only\n    const repo = s.gitRepo?.trim();\n    if (!repo) continue; // repo-backed only — the dispatch target is its renovate.yml\n    const critical = s.securityVulnsCritical ?? 0;\n    const high = s.securityVulnsHigh ?? 0;\n    if (critical + high <= 0) continue; // actionable (critical/high) vulns only\n    targets.push({ repo, siteName: s.name, critical, high });\n  }\n  return targets;\n}\n\n/** Injected GitHub operations — real ones come from `makeGitHub`, fakes from tests. */\nexport type RenovateDispatchDeps = {\n  /** True iff the repo has a HEALTHY (non-conflicting) open Renovate PR —\n   *  remediation in flight, so don't re-dispatch. A conflicting/stuck PR returns\n   *  false so the dispatch goes through and Renovate rebases it. */\n  hasHealthyOpenRenovatePr: (repo: string) => Promise<boolean>;\n  defaultBranch: (repo: string) => Promise<string>;\n  dispatch: (repo: string, workflow: string, ref: string) => Promise<void>;\n};\n\nexport type RenovateDispatchResult = {\n  dispatched: string[];\n  /** Repos skipped because a Renovate PR is already open — no point re-firing. */\n  skipped: string[];\n  failed: { repo: string; error: string }[];\n};\n\n/**\n * Dispatch `renovate.yml` for each target on its default branch.\n *\n * Skips a repo with a HEALTHY (non-conflicting) open Renovate PR — remediation is\n * in flight, so re-dispatching would just churn CI (keeps a persistent vuln from\n * re-firing every nightly run while its fix PR waits, e.g. a human-gated major\n * bump). A repo whose open Renovate PR is CONFLICTING/stuck is NOT skipped:\n * dispatching triggers Renovate to rebase it. Best-effort and isolated: a repo\n * that lacks `renovate.yml`, or whose\n * dispatch/PR-check is refused (the token's `actions:write` scope), is recorded in\n * `failed` and the rest still run. Never throws — the caller (a follow-up step on\n * the security sweep) must not be able to fail the sweep over a dispatch hiccup.\n */\nexport async function dispatchRenovateAcross(\n  targets: RenovateDispatchTarget[],\n  deps: RenovateDispatchDeps,\n): Promise<RenovateDispatchResult> {\n  const dispatched: string[] = [];\n  const skipped: string[] = [];\n  const failed: { repo: string; error: string }[] = [];\n  for (const t of targets) {\n    try {\n      if (await deps.hasHealthyOpenRenovatePr(t.repo)) {\n        skipped.push(t.repo);\n        continue;\n      }\n      const ref = await deps.defaultBranch(t.repo);\n      await deps.dispatch(t.repo, RENOVATE_WORKFLOW_FILE, ref);\n      dispatched.push(t.repo);\n    } catch (e) {\n      failed.push({ repo: t.repo, error: e instanceof Error ? e.message : String(e) });\n    }\n  }\n  return { dispatched, skipped, failed };\n}\n\n/** Machine-readable counts line the workflow greps to annotate partial failures. */\nexport function formatRenovateDispatchSummary(result: RenovateDispatchResult): string {\n  return `RENOVATE_DISPATCH_SUMMARY dispatched=${result.dispatched.length} skipped=${result.skipped.length} failed=${result.failed.length}`;\n}\n\n/**\n * Plan the per-site auto-fix-attempt counter writes from a dispatch result. PURE.\n * For each site:\n *   - vulns now 0 (or never counted)       → reset to 0   (episode resolved)\n *   - else dispatched this run             → attempts + 1 (a fresh failed-so-far attempt)\n *   - else (skipped / failed / untouched)  → unchanged\n * The RESET applies fleet-wide — regardless of Status or Git repo — so a site\n * archived or un-repo'd after its episode can't carry a stale counter into its\n * next vuln (Alamo sat at 7 from a long-closed episode). A null vuln count\n * (never-audited) reads as zero, consistent with the existing null-as-zero\n * semantics, so a lingering counter on such a row also clears. The INCREMENT\n * keeps its active + repo-backed filters (only those sites are dispatched).\n * Returns only the rows whose value CHANGES (a steady fleet writes nothing —\n * a 0→0 site emits no write). A skipped repo (healthy Renovate PR in flight) is\n * NOT a failed attempt — a fix is genuinely moving toward merge — so its counter\n * holds. A dispatched site whose critical/high advisories are ALL proven\n * TRANSITIVE also holds: Renovate has no direct-dep bump to open, so the run is a\n * known green no-op waiting on the weekly lockfile window, not a failed fix\n * attempt (Sonder rode 5 such no-ops to a false \"auto-fix failed\", 2026-08-10).\n * Missing/unknown relationship data keeps the increment — never mute on absence.\n */\nexport function computeAutoFixAttemptUpdates(\n  sites: WebsiteRow[],\n  result: RenovateDispatchResult,\n): { id: string; attempts: number }[] {\n  const dispatched = new Set(result.dispatched);\n  const updates: { id: string; attempts: number }[] = [];\n  for (const s of sites) {\n    const current = s.securityAutoFixAttempts ?? 0;\n    const vulns = (s.securityVulnsCritical ?? 0) + (s.securityVulnsHigh ?? 0);\n    if (vulns === 0) {\n      // Episode resolved (or never confirmed): reset REGARDLESS of status/repo —\n      // a site archived or un-repo'd after its episode must not carry a stale\n      // counter into its next vuln (Alamo sat at 7 from a long-closed episode).\n      if (current !== 0) updates.push({ id: s.id, attempts: 0 });\n      continue;\n    }\n    if (!isDashboardVisible(s)) continue; // increments stay active-only\n    const repo = s.gitRepo?.trim();\n    if (!repo) continue; // …and repo-backed-only\n    if (!dispatched.has(repo)) continue;\n    // Transitive-only episode: the dispatch can't produce a fix PR (no direct dep\n    // to bump) — don't count the no-op as a failed attempt.\n    if (allActionableVulnsTransitive(s.securityAdvisories)) continue;\n    updates.push({ id: s.id, attempts: current + 1 });\n  }\n  return updates;\n}\n\n/**\n * Apply the planned counter updates with an injected writer, BEST-EFFORT: a writer\n * that throws (e.g. the Airtable field not yet created, or a transient error) is\n * counted in `failed` and never propagates — the security sweep must not fail over\n * counter bookkeeping. Returns the applied/failed tallies for the summary line.\n */\nexport async function applyAutoFixAttemptUpdates(\n  updates: { id: string; attempts: number }[],\n  write: (id: string, attempts: number) => Promise<void>,\n): Promise<{ written: number; failed: number }> {\n  let written = 0;\n  let failed = 0;\n  for (const u of updates) {\n    try {\n      await write(u.id, u.attempts);\n      written++;\n    } catch {\n      failed++;\n    }\n  }\n  return { written, failed };\n}\n\n/** Machine-readable counts line the workflow can grep, mirroring RENOVATE_DISPATCH_SUMMARY. */\nexport function formatAutoFixAttemptsSummary(tally: { written: number; failed: number }): string {\n  return `AUTO_FIX_ATTEMPTS_SUMMARY written=${tally.written} failed=${tally.failed}`;\n}\n","import { openBase, readAirtableConfig, type AirtableBase } from \"../../reports/airtable/client.js\";\nimport { listWebsites, updateAutoFixAttempts } from \"../../reports/airtable/websites.js\";\nimport { makeGitHub } from \"../../github/gh.js\";\nimport {\n  selectRenovateTargets,\n  dispatchRenovateAcross,\n  formatRenovateDispatchSummary,\n  hasHealthyRenovatePr,\n  computeAutoFixAttemptUpdates,\n  applyAutoFixAttemptUpdates,\n  formatAutoFixAttemptsSummary,\n  type RenovateDispatchResult,\n} from \"../../github/renovate-dispatch.js\";\n\n/**\n * `renovate-dispatch --fleet`: read the Websites table, pick the active,\n * repo-backed sites the latest security sweep flagged with critical/high vulns,\n * and fire each one's `renovate.yml` `workflow_dispatch` so Renovate's OSV\n * vulnerability alerts open the remediation PR now (instead of waiting for the\n * weekly schedule). Designed to run as a best-effort follow-up step on\n * `fleet-security.yml` AFTER the sweep has written fresh counts to Airtable.\n *\n * Always exits 0: a missing token is a clean skip; a partial dispatch failure\n * (a repo without `renovate.yml`, or a token lacking `actions:write`) is reported\n * in the summary for the workflow to annotate, never failing the security sweep.\n */\nexport async function runRenovateDispatchCommand(opts: {\n  fleet?: boolean | undefined;\n  /** Inject a pre-opened Airtable base (tests). Defaults to env config. */\n  base?: AirtableBase;\n}): Promise<{ output: string; code: number }> {\n  if (!opts.fleet) {\n    return { output: \"renovate-dispatch currently supports only --fleet\", code: 2 };\n  }\n  const token = process.env.RENOVATE_TOKEN?.trim() || process.env.GH_TOKEN?.trim();\n  if (!token) {\n    return {\n      output: \"renovate-dispatch skipped: no RENOVATE_TOKEN/GH_TOKEN (fleet dispatch) configured.\",\n      code: 0,\n    };\n  }\n\n  const base = opts.base ?? openBase(readAirtableConfig());\n  const websites = await listWebsites(base);\n  const targets = selectRenovateTargets(websites);\n\n  const lines: string[] = [];\n  let result: RenovateDispatchResult = { dispatched: [], skipped: [], failed: [] };\n  if (targets.length === 0) {\n    lines.push(\n      \"No active repo-backed sites with critical/high vulnerabilities — nothing to dispatch.\",\n    );\n  } else {\n    const gh = makeGitHub({ token });\n    result = await dispatchRenovateAcross(targets, {\n      hasHealthyOpenRenovatePr: async (repo) =>\n        hasHealthyRenovatePr(await gh.openPullRequests(repo)),\n      defaultBranch: (repo) => gh.defaultBranch(repo),\n      dispatch: (repo, workflow, ref) => gh.dispatchWorkflow(repo, workflow, ref),\n    });\n\n    const failedRepos = new Set(result.failed.map((f) => f.repo));\n    const skippedRepos = new Set(result.skipped);\n    for (const t of targets) {\n      const status = failedRepos.has(t.repo)\n        ? \"FAILED                       \"\n        : skippedRepos.has(t.repo)\n          ? \"skipped (open Renovate PR)   \"\n          : \"dispatched                   \";\n      lines.push(`${status} ${t.repo} (critical=${t.critical} high=${t.high}) — ${t.siteName}`);\n    }\n    for (const f of result.failed) lines.push(`  ↳ ${f.repo}: ${f.error}`);\n  }\n\n  // Counter bookkeeping runs on EVERY fleet run — the reset-on-clean branch was\n  // previously unreachable behind the zero-targets early return, so a fully-clean\n  // fleet never cleared stale counters (Alamo stuck at 7, 2026-07). Best-effort:\n  // a failed write is tallied, never thrown. Uses the full `websites` list so\n  // 0-vuln sites reset.\n  const attemptUpdates = computeAutoFixAttemptUpdates(websites, result);\n  const attemptTally = await applyAutoFixAttemptUpdates(attemptUpdates, (id, attempts) =>\n    updateAutoFixAttempts(base, id, attempts),\n  );\n\n  lines.push(formatRenovateDispatchSummary(result));\n  lines.push(formatAutoFixAttemptsSummary(attemptTally));\n\n  return { output: lines.join(\"\\n\"), code: 0 };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAyBO,IAAM,yBAAyB;AAY/B,SAAS,qBAAqB,KAAoC;AACvE,SAAO,IAAI,KAAK,CAAC,OAAO,aAAa,EAAE,KAAK,GAAG,cAAc,aAAa;AAC5E;AAsBO,SAAS,sBAAsB,OAA+C;AACnF,QAAM,UAAoC,CAAC;AAC3C,aAAW,KAAK,OAAO;AACrB,QAAI,CAAC,mBAAmB,CAAC,EAAG;AAC5B,UAAM,OAAO,EAAE,SAAS,KAAK;AAC7B,QAAI,CAAC,KAAM;AACX,UAAM,WAAW,EAAE,yBAAyB;AAC5C,UAAM,OAAO,EAAE,qBAAqB;AACpC,QAAI,WAAW,QAAQ,EAAG;AAC1B,YAAQ,KAAK,EAAE,MAAM,UAAU,EAAE,MAAM,UAAU,KAAK,CAAC;AAAA,EACzD;AACA,SAAO;AACT;AAgCA,eAAsB,uBACpB,SACA,MACiC;AACjC,QAAM,aAAuB,CAAC;AAC9B,QAAM,UAAoB,CAAC;AAC3B,QAAM,SAA4C,CAAC;AACnD,aAAW,KAAK,SAAS;AACvB,QAAI;AACF,UAAI,MAAM,KAAK,yBAAyB,EAAE,IAAI,GAAG;AAC/C,gBAAQ,KAAK,EAAE,IAAI;AACnB;AAAA,MACF;AACA,YAAM,MAAM,MAAM,KAAK,cAAc,EAAE,IAAI;AAC3C,YAAM,KAAK,SAAS,EAAE,MAAM,wBAAwB,GAAG;AACvD,iBAAW,KAAK,EAAE,IAAI;AAAA,IACxB,SAAS,GAAG;AACV,aAAO,KAAK,EAAE,MAAM,EAAE,MAAM,OAAO,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,EAAE,CAAC;AAAA,IACjF;AAAA,EACF;AACA,SAAO,EAAE,YAAY,SAAS,OAAO;AACvC;AAGO,SAAS,8BAA8B,QAAwC;AACpF,SAAO,wCAAwC,OAAO,WAAW,MAAM,YAAY,OAAO,QAAQ,MAAM,WAAW,OAAO,OAAO,MAAM;AACzI;AAuBO,SAAS,6BACd,OACA,QACoC;AACpC,QAAM,aAAa,IAAI,IAAI,OAAO,UAAU;AAC5C,QAAM,UAA8C,CAAC;AACrD,aAAW,KAAK,OAAO;AACrB,UAAM,UAAU,EAAE,2BAA2B;AAC7C,UAAM,SAAS,EAAE,yBAAyB,MAAM,EAAE,qBAAqB;AACvE,QAAI,UAAU,GAAG;AAIf,UAAI,YAAY,EAAG,SAAQ,KAAK,EAAE,IAAI,EAAE,IAAI,UAAU,EAAE,CAAC;AACzD;AAAA,IACF;AACA,QAAI,CAAC,mBAAmB,CAAC,EAAG;AAC5B,UAAM,OAAO,EAAE,SAAS,KAAK;AAC7B,QAAI,CAAC,KAAM;AACX,QAAI,CAAC,WAAW,IAAI,IAAI,EAAG;AAG3B,QAAI,6BAA6B,EAAE,kBAAkB,EAAG;AACxD,YAAQ,KAAK,EAAE,IAAI,EAAE,IAAI,UAAU,UAAU,EAAE,CAAC;AAAA,EAClD;AACA,SAAO;AACT;AAQA,eAAsB,2BACpB,SACA,OAC8C;AAC9C,MAAI,UAAU;AACd,MAAI,SAAS;AACb,aAAW,KAAK,SAAS;AACvB,QAAI;AACF,YAAM,MAAM,EAAE,IAAI,EAAE,QAAQ;AAC5B;AAAA,IACF,QAAQ;AACN;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,SAAS,OAAO;AAC3B;AAGO,SAAS,6BAA6B,OAAoD;AAC/F,SAAO,qCAAqC,MAAM,OAAO,WAAW,MAAM,MAAM;AAClF;;;ACtLA,eAAsB,2BAA2B,MAIH;AAC5C,MAAI,CAAC,KAAK,OAAO;AACf,WAAO,EAAE,QAAQ,qDAAqD,MAAM,EAAE;AAAA,EAChF;AACA,QAAM,QAAQ,QAAQ,IAAI,gBAAgB,KAAK,KAAK,QAAQ,IAAI,UAAU,KAAK;AAC/E,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,MAAM;AAAA,IACR;AAAA,EACF;AAEA,QAAM,OAAO,KAAK,QAAQ,SAAS,mBAAmB,CAAC;AACvD,QAAM,WAAW,MAAM,aAAa,IAAI;AACxC,QAAM,UAAU,sBAAsB,QAAQ;AAE9C,QAAM,QAAkB,CAAC;AACzB,MAAI,SAAiC,EAAE,YAAY,CAAC,GAAG,SAAS,CAAC,GAAG,QAAQ,CAAC,EAAE;AAC/E,MAAI,QAAQ,WAAW,GAAG;AACxB,UAAM;AAAA,MACJ;AAAA,IACF;AAAA,EACF,OAAO;AACL,UAAM,KAAK,WAAW,EAAE,MAAM,CAAC;AAC/B,aAAS,MAAM,uBAAuB,SAAS;AAAA,MAC7C,0BAA0B,OAAO,SAC/B,qBAAqB,MAAM,GAAG,iBAAiB,IAAI,CAAC;AAAA,MACtD,eAAe,CAAC,SAAS,GAAG,cAAc,IAAI;AAAA,MAC9C,UAAU,CAAC,MAAM,UAAU,QAAQ,GAAG,iBAAiB,MAAM,UAAU,GAAG;AAAA,IAC5E,CAAC;AAED,UAAM,cAAc,IAAI,IAAI,OAAO,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC;AAC5D,UAAM,eAAe,IAAI,IAAI,OAAO,OAAO;AAC3C,eAAW,KAAK,SAAS;AACvB,YAAM,SAAS,YAAY,IAAI,EAAE,IAAI,IACjC,kCACA,aAAa,IAAI,EAAE,IAAI,IACrB,kCACA;AACN,YAAM,KAAK,GAAG,MAAM,IAAI,EAAE,IAAI,cAAc,EAAE,QAAQ,SAAS,EAAE,IAAI,YAAO,EAAE,QAAQ,EAAE;AAAA,IAC1F;AACA,eAAW,KAAK,OAAO,OAAQ,OAAM,KAAK,YAAO,EAAE,IAAI,KAAK,EAAE,KAAK,EAAE;AAAA,EACvE;AAOA,QAAM,iBAAiB,6BAA6B,UAAU,MAAM;AACpE,QAAM,eAAe,MAAM;AAAA,IAA2B;AAAA,IAAgB,CAAC,IAAI,aACzE,sBAAsB,MAAM,IAAI,QAAQ;AAAA,EAC1C;AAEA,QAAM,KAAK,8BAA8B,MAAM,CAAC;AAChD,QAAM,KAAK,6BAA6B,YAAY,CAAC;AAErD,SAAO,EAAE,QAAQ,MAAM,KAAK,IAAI,GAAG,MAAM,EAAE;AAC7C;","names":[]}
+{"version":3,"sources":["../src/github/renovate-dispatch.ts","../src/cli/commands/renovate-dispatch.ts"],"sourcesContent":["import {\n  allActionableVulnsTransitive,\n  isDashboardVisible,\n  type WebsiteRow,\n} from \"../reports/airtable/websites.js\";\nimport { isRenovatePR } from \"../alerts/renovate.js\";\nimport type { PullRequestSummary } from \"./gh.js\";\n\n/**\n * On-demand Renovate trigger for fleet sites.\n *\n * The nightly security sweep (`fleet-security.yml`) writes each active site's\n * vulnerability counts to Airtable. This module turns that into action: for the\n * sites the sweep just flagged with *actionable* (critical or high) vulns, it\n * dispatches that repo's `renovate.yml` `workflow_dispatch` so Renovate runs off\n * its twice-daily schedule. Renovate's OSV vulnerability alerts bypass the\n * schedule, so the remediation PR opens immediately — and because GitHub's\n * platform auto-merge is disabled fleet-wide, Renovate merges it from inside that\n * same run (or a later scheduled one) per the shared preset, which is what keeps\n * the preset's \"majors are never auto-merged\" rule authoritative. Moderate/low\n * vulns are left to the normal schedule — not urgent enough to dispatch + churn\n * CI nightly.\n */\n\n/** The per-repo workflow file the fleet uses for its self-hosted Renovate run. */\nexport const RENOVATE_WORKFLOW_FILE = \"renovate.yml\";\n\n/**\n * Does the repo have a HEALTHY open Renovate PR — one that is NOT conflicting?\n *\n * A healthy PR means remediation is genuinely in flight (moving toward merge), so\n * re-dispatching would just churn CI — skip it. A CONFLICTING Renovate PR is STUCK\n * (its branch fell behind the base after another PR merged the same lockfile), so\n * it does NOT count as healthy: re-dispatching triggers Renovate to rebase it.\n * `UNKNOWN` mergeability (GitHub still computing it) is treated as healthy — don't\n * churn on uncertainty. Reuses {@link isRenovatePR} for the branch-prefix check.\n */\nexport function hasHealthyRenovatePr(prs: PullRequestSummary[]): boolean {\n  return prs.some((pr) => isRenovatePR(pr) && pr.mergeable !== \"CONFLICTING\");\n}\n\n/** A site selected for an on-demand Renovate run, with the reason (vuln counts). */\nexport type RenovateDispatchTarget = {\n  repo: string; // owner/repo, from the Websites \"Git repo\" field\n  siteName: string;\n  critical: number;\n  high: number;\n};\n\n/**\n * Pick the active, repo-backed sites whose latest security sweep found a\n * critical or high vulnerability. A `null` vuln count is treated as zero (a site\n * that was never swept, or had its counts cleared, is not dispatched). Inactive\n * sites and sites without a `Git repo` are excluded — there's nothing to kick.\n *\n * Counts are only guaranteed fresh for sites the sweep actually audited (active +\n * URL present); a site whose write-back failed/was skipped this run is selected on\n * its last-known counts. That's safe — a stale-high false dispatch is an idempotent\n * Renovate no-op, and the open-PR skip in `dispatchRenovateAcross` avoids re-firing\n * when remediation is already in flight.\n */\nexport function selectRenovateTargets(sites: WebsiteRow[]): RenovateDispatchTarget[] {\n  const targets: RenovateDispatchTarget[] = [];\n  for (const s of sites) {\n    if (!isDashboardVisible(s)) continue; // active (maintenance / launch period) only\n    const repo = s.gitRepo?.trim();\n    if (!repo) continue; // repo-backed only — the dispatch target is its renovate.yml\n    const critical = s.securityVulnsCritical ?? 0;\n    const high = s.securityVulnsHigh ?? 0;\n    if (critical + high <= 0) continue; // actionable (critical/high) vulns only\n    targets.push({ repo, siteName: s.name, critical, high });\n  }\n  return targets;\n}\n\n/** Injected GitHub operations — real ones come from `makeGitHub`, fakes from tests. */\nexport type RenovateDispatchDeps = {\n  /** True iff the repo has a HEALTHY (non-conflicting) open Renovate PR —\n   *  remediation in flight, so don't re-dispatch. A conflicting/stuck PR returns\n   *  false so the dispatch goes through and Renovate rebases it. */\n  hasHealthyOpenRenovatePr: (repo: string) => Promise<boolean>;\n  defaultBranch: (repo: string) => Promise<string>;\n  dispatch: (repo: string, workflow: string, ref: string) => Promise<void>;\n};\n\nexport type RenovateDispatchResult = {\n  dispatched: string[];\n  /** Repos skipped because a Renovate PR is already open — no point re-firing. */\n  skipped: string[];\n  failed: { repo: string; error: string }[];\n};\n\n/**\n * Dispatch `renovate.yml` for each target on its default branch.\n *\n * Skips a repo with a HEALTHY (non-conflicting) open Renovate PR — remediation is\n * in flight, so re-dispatching would just churn CI (keeps a persistent vuln from\n * re-firing every nightly run while its fix PR waits, e.g. a human-gated major\n * bump). A repo whose open Renovate PR is CONFLICTING/stuck is NOT skipped:\n * dispatching triggers Renovate to rebase it. Best-effort and isolated: a repo\n * that lacks `renovate.yml`, or whose\n * dispatch/PR-check is refused (the token's `actions:write` scope), is recorded in\n * `failed` and the rest still run. Never throws — the caller (a follow-up step on\n * the security sweep) must not be able to fail the sweep over a dispatch hiccup.\n */\nexport async function dispatchRenovateAcross(\n  targets: RenovateDispatchTarget[],\n  deps: RenovateDispatchDeps,\n): Promise<RenovateDispatchResult> {\n  const dispatched: string[] = [];\n  const skipped: string[] = [];\n  const failed: { repo: string; error: string }[] = [];\n  for (const t of targets) {\n    try {\n      if (await deps.hasHealthyOpenRenovatePr(t.repo)) {\n        skipped.push(t.repo);\n        continue;\n      }\n      const ref = await deps.defaultBranch(t.repo);\n      await deps.dispatch(t.repo, RENOVATE_WORKFLOW_FILE, ref);\n      dispatched.push(t.repo);\n    } catch (e) {\n      failed.push({ repo: t.repo, error: e instanceof Error ? e.message : String(e) });\n    }\n  }\n  return { dispatched, skipped, failed };\n}\n\n/** Machine-readable counts line the workflow greps to annotate partial failures. */\nexport function formatRenovateDispatchSummary(result: RenovateDispatchResult): string {\n  return `RENOVATE_DISPATCH_SUMMARY dispatched=${result.dispatched.length} skipped=${result.skipped.length} failed=${result.failed.length}`;\n}\n\n/**\n * Plan the per-site auto-fix-attempt counter writes from a dispatch result. PURE.\n * For each site:\n *   - vulns now 0 (or never counted)       → reset to 0   (episode resolved)\n *   - else dispatched this run             → attempts + 1 (a fresh failed-so-far attempt)\n *   - else (skipped / failed / untouched)  → unchanged\n * The RESET applies fleet-wide — regardless of Status or Git repo — so a site\n * archived or un-repo'd after its episode can't carry a stale counter into its\n * next vuln (Alamo sat at 7 from a long-closed episode). A null vuln count\n * (never-audited) reads as zero, consistent with the existing null-as-zero\n * semantics, so a lingering counter on such a row also clears. The INCREMENT\n * keeps its active + repo-backed filters (only those sites are dispatched).\n * Returns only the rows whose value CHANGES (a steady fleet writes nothing —\n * a 0→0 site emits no write). A skipped repo (healthy Renovate PR in flight) is\n * NOT a failed attempt — a fix is genuinely moving toward merge — so its counter\n * holds. A dispatched site whose critical/high advisories are ALL proven\n * TRANSITIVE also holds: Renovate has no direct-dep bump to open, so the run is a\n * known green no-op waiting on the weekly lockfile window, not a failed fix\n * attempt (Sonder rode 5 such no-ops to a false \"auto-fix failed\", 2026-08-10).\n * Missing/unknown relationship data keeps the increment — never mute on absence.\n */\nexport function computeAutoFixAttemptUpdates(\n  sites: WebsiteRow[],\n  result: RenovateDispatchResult,\n): { id: string; attempts: number }[] {\n  const dispatched = new Set(result.dispatched);\n  const updates: { id: string; attempts: number }[] = [];\n  for (const s of sites) {\n    const current = s.securityAutoFixAttempts ?? 0;\n    const vulns = (s.securityVulnsCritical ?? 0) + (s.securityVulnsHigh ?? 0);\n    if (vulns === 0) {\n      // Episode resolved (or never confirmed): reset REGARDLESS of status/repo —\n      // a site archived or un-repo'd after its episode must not carry a stale\n      // counter into its next vuln (Alamo sat at 7 from a long-closed episode).\n      if (current !== 0) updates.push({ id: s.id, attempts: 0 });\n      continue;\n    }\n    if (!isDashboardVisible(s)) continue; // increments stay active-only\n    const repo = s.gitRepo?.trim();\n    if (!repo) continue; // …and repo-backed-only\n    if (!dispatched.has(repo)) continue;\n    // Transitive-only episode: the dispatch can't produce a fix PR (no direct dep\n    // to bump) — don't count the no-op as a failed attempt.\n    if (allActionableVulnsTransitive(s.securityAdvisories)) continue;\n    updates.push({ id: s.id, attempts: current + 1 });\n  }\n  return updates;\n}\n\n/**\n * Apply the planned counter updates with an injected writer, BEST-EFFORT: a writer\n * that throws (e.g. the Airtable field not yet created, or a transient error) is\n * counted in `failed` and never propagates — the security sweep must not fail over\n * counter bookkeeping. Returns the applied/failed tallies for the summary line.\n */\nexport async function applyAutoFixAttemptUpdates(\n  updates: { id: string; attempts: number }[],\n  write: (id: string, attempts: number) => Promise<void>,\n): Promise<{ written: number; failed: number }> {\n  let written = 0;\n  let failed = 0;\n  for (const u of updates) {\n    try {\n      await write(u.id, u.attempts);\n      written++;\n    } catch {\n      failed++;\n    }\n  }\n  return { written, failed };\n}\n\n/** Machine-readable counts line the workflow can grep, mirroring RENOVATE_DISPATCH_SUMMARY. */\nexport function formatAutoFixAttemptsSummary(tally: { written: number; failed: number }): string {\n  return `AUTO_FIX_ATTEMPTS_SUMMARY written=${tally.written} failed=${tally.failed}`;\n}\n","import { openBase, readAirtableConfig, type AirtableBase } from \"../../reports/airtable/client.js\";\nimport type { SiteMirror } from \"../../db/site-mirror.js\";\nimport { listWebsites, updateAutoFixAttempts } from \"../../reports/airtable/websites.js\";\nimport { makeGitHub } from \"../../github/gh.js\";\nimport {\n  selectRenovateTargets,\n  dispatchRenovateAcross,\n  formatRenovateDispatchSummary,\n  hasHealthyRenovatePr,\n  computeAutoFixAttemptUpdates,\n  applyAutoFixAttemptUpdates,\n  formatAutoFixAttemptsSummary,\n  type RenovateDispatchResult,\n} from \"../../github/renovate-dispatch.js\";\n\n/**\n * `renovate-dispatch --fleet`: read the Websites table, pick the active,\n * repo-backed sites the latest security sweep flagged with critical/high vulns,\n * and fire each one's `renovate.yml` `workflow_dispatch` so Renovate's OSV\n * vulnerability alerts open the remediation PR now (instead of waiting for the\n * weekly schedule). Designed to run as a best-effort follow-up step on\n * `fleet-security.yml` AFTER the sweep has written fresh counts to Airtable.\n *\n * Always exits 0: a missing token is a clean skip; a partial dispatch failure\n * (a repo without `renovate.yml`, or a token lacking `actions:write`) is reported\n * in the summary for the workflow to annotate, never failing the security sweep.\n */\nexport async function runRenovateDispatchCommand(opts: {\n  fleet?: boolean | undefined;\n  /** Inject a pre-opened Airtable base (tests). Defaults to env config. */\n  base?: AirtableBase;\n  /** #539 Phase 5: Turso write-through for the auto-fix counter. Injected from\n   *  bin.ts rather than defaulted here — this function is called directly by\n   *  tests, and a default would open a real libSQL handle inside the suite. */\n  siteMirror?: SiteMirror;\n}): Promise<{ output: string; code: number }> {\n  if (!opts.fleet) {\n    return { output: \"renovate-dispatch currently supports only --fleet\", code: 2 };\n  }\n  const token = process.env.RENOVATE_TOKEN?.trim() || process.env.GH_TOKEN?.trim();\n  if (!token) {\n    return {\n      output: \"renovate-dispatch skipped: no RENOVATE_TOKEN/GH_TOKEN (fleet dispatch) configured.\",\n      code: 0,\n    };\n  }\n\n  const base = opts.base ?? openBase(readAirtableConfig());\n  const websites = await listWebsites(base);\n  const targets = selectRenovateTargets(websites);\n\n  const lines: string[] = [];\n  let result: RenovateDispatchResult = { dispatched: [], skipped: [], failed: [] };\n  if (targets.length === 0) {\n    lines.push(\n      \"No active repo-backed sites with critical/high vulnerabilities — nothing to dispatch.\",\n    );\n  } else {\n    const gh = makeGitHub({ token });\n    result = await dispatchRenovateAcross(targets, {\n      hasHealthyOpenRenovatePr: async (repo) =>\n        hasHealthyRenovatePr(await gh.openPullRequests(repo)),\n      defaultBranch: (repo) => gh.defaultBranch(repo),\n      dispatch: (repo, workflow, ref) => gh.dispatchWorkflow(repo, workflow, ref),\n    });\n\n    const failedRepos = new Set(result.failed.map((f) => f.repo));\n    const skippedRepos = new Set(result.skipped);\n    for (const t of targets) {\n      const status = failedRepos.has(t.repo)\n        ? \"FAILED                       \"\n        : skippedRepos.has(t.repo)\n          ? \"skipped (open Renovate PR)   \"\n          : \"dispatched                   \";\n      lines.push(`${status} ${t.repo} (critical=${t.critical} high=${t.high}) — ${t.siteName}`);\n    }\n    for (const f of result.failed) lines.push(`  ↳ ${f.repo}: ${f.error}`);\n  }\n\n  // Counter bookkeeping runs on EVERY fleet run — the reset-on-clean branch was\n  // previously unreachable behind the zero-targets early return, so a fully-clean\n  // fleet never cleared stale counters (Alamo stuck at 7, 2026-07). Best-effort:\n  // a failed write is tallied, never thrown. Uses the full `websites` list so\n  // 0-vuln sites reset.\n  const attemptUpdates = computeAutoFixAttemptUpdates(websites, result);\n  const attemptTally = await applyAutoFixAttemptUpdates(attemptUpdates, async (id, attempts) => {\n    const fields = await updateAutoFixAttempts(base, id, attempts);\n    await opts.siteMirror?.health(id, fields);\n  });\n\n  lines.push(formatRenovateDispatchSummary(result));\n  lines.push(formatAutoFixAttemptsSummary(attemptTally));\n\n  return { output: lines.join(\"\\n\"), code: 0 };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAyBO,IAAM,yBAAyB;AAY/B,SAAS,qBAAqB,KAAoC;AACvE,SAAO,IAAI,KAAK,CAAC,OAAO,aAAa,EAAE,KAAK,GAAG,cAAc,aAAa;AAC5E;AAsBO,SAAS,sBAAsB,OAA+C;AACnF,QAAM,UAAoC,CAAC;AAC3C,aAAW,KAAK,OAAO;AACrB,QAAI,CAAC,mBAAmB,CAAC,EAAG;AAC5B,UAAM,OAAO,EAAE,SAAS,KAAK;AAC7B,QAAI,CAAC,KAAM;AACX,UAAM,WAAW,EAAE,yBAAyB;AAC5C,UAAM,OAAO,EAAE,qBAAqB;AACpC,QAAI,WAAW,QAAQ,EAAG;AAC1B,YAAQ,KAAK,EAAE,MAAM,UAAU,EAAE,MAAM,UAAU,KAAK,CAAC;AAAA,EACzD;AACA,SAAO;AACT;AAgCA,eAAsB,uBACpB,SACA,MACiC;AACjC,QAAM,aAAuB,CAAC;AAC9B,QAAM,UAAoB,CAAC;AAC3B,QAAM,SAA4C,CAAC;AACnD,aAAW,KAAK,SAAS;AACvB,QAAI;AACF,UAAI,MAAM,KAAK,yBAAyB,EAAE,IAAI,GAAG;AAC/C,gBAAQ,KAAK,EAAE,IAAI;AACnB;AAAA,MACF;AACA,YAAM,MAAM,MAAM,KAAK,cAAc,EAAE,IAAI;AAC3C,YAAM,KAAK,SAAS,EAAE,MAAM,wBAAwB,GAAG;AACvD,iBAAW,KAAK,EAAE,IAAI;AAAA,IACxB,SAAS,GAAG;AACV,aAAO,KAAK,EAAE,MAAM,EAAE,MAAM,OAAO,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,EAAE,CAAC;AAAA,IACjF;AAAA,EACF;AACA,SAAO,EAAE,YAAY,SAAS,OAAO;AACvC;AAGO,SAAS,8BAA8B,QAAwC;AACpF,SAAO,wCAAwC,OAAO,WAAW,MAAM,YAAY,OAAO,QAAQ,MAAM,WAAW,OAAO,OAAO,MAAM;AACzI;AAuBO,SAAS,6BACd,OACA,QACoC;AACpC,QAAM,aAAa,IAAI,IAAI,OAAO,UAAU;AAC5C,QAAM,UAA8C,CAAC;AACrD,aAAW,KAAK,OAAO;AACrB,UAAM,UAAU,EAAE,2BAA2B;AAC7C,UAAM,SAAS,EAAE,yBAAyB,MAAM,EAAE,qBAAqB;AACvE,QAAI,UAAU,GAAG;AAIf,UAAI,YAAY,EAAG,SAAQ,KAAK,EAAE,IAAI,EAAE,IAAI,UAAU,EAAE,CAAC;AACzD;AAAA,IACF;AACA,QAAI,CAAC,mBAAmB,CAAC,EAAG;AAC5B,UAAM,OAAO,EAAE,SAAS,KAAK;AAC7B,QAAI,CAAC,KAAM;AACX,QAAI,CAAC,WAAW,IAAI,IAAI,EAAG;AAG3B,QAAI,6BAA6B,EAAE,kBAAkB,EAAG;AACxD,YAAQ,KAAK,EAAE,IAAI,EAAE,IAAI,UAAU,UAAU,EAAE,CAAC;AAAA,EAClD;AACA,SAAO;AACT;AAQA,eAAsB,2BACpB,SACA,OAC8C;AAC9C,MAAI,UAAU;AACd,MAAI,SAAS;AACb,aAAW,KAAK,SAAS;AACvB,QAAI;AACF,YAAM,MAAM,EAAE,IAAI,EAAE,QAAQ;AAC5B;AAAA,IACF,QAAQ;AACN;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,SAAS,OAAO;AAC3B;AAGO,SAAS,6BAA6B,OAAoD;AAC/F,SAAO,qCAAqC,MAAM,OAAO,WAAW,MAAM,MAAM;AAClF;;;ACrLA,eAAsB,2BAA2B,MAQH;AAC5C,MAAI,CAAC,KAAK,OAAO;AACf,WAAO,EAAE,QAAQ,qDAAqD,MAAM,EAAE;AAAA,EAChF;AACA,QAAM,QAAQ,QAAQ,IAAI,gBAAgB,KAAK,KAAK,QAAQ,IAAI,UAAU,KAAK;AAC/E,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,MAAM;AAAA,IACR;AAAA,EACF;AAEA,QAAM,OAAO,KAAK,QAAQ,SAAS,mBAAmB,CAAC;AACvD,QAAM,WAAW,MAAM,aAAa,IAAI;AACxC,QAAM,UAAU,sBAAsB,QAAQ;AAE9C,QAAM,QAAkB,CAAC;AACzB,MAAI,SAAiC,EAAE,YAAY,CAAC,GAAG,SAAS,CAAC,GAAG,QAAQ,CAAC,EAAE;AAC/E,MAAI,QAAQ,WAAW,GAAG;AACxB,UAAM;AAAA,MACJ;AAAA,IACF;AAAA,EACF,OAAO;AACL,UAAM,KAAK,WAAW,EAAE,MAAM,CAAC;AAC/B,aAAS,MAAM,uBAAuB,SAAS;AAAA,MAC7C,0BAA0B,OAAO,SAC/B,qBAAqB,MAAM,GAAG,iBAAiB,IAAI,CAAC;AAAA,MACtD,eAAe,CAAC,SAAS,GAAG,cAAc,IAAI;AAAA,MAC9C,UAAU,CAAC,MAAM,UAAU,QAAQ,GAAG,iBAAiB,MAAM,UAAU,GAAG;AAAA,IAC5E,CAAC;AAED,UAAM,cAAc,IAAI,IAAI,OAAO,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC;AAC5D,UAAM,eAAe,IAAI,IAAI,OAAO,OAAO;AAC3C,eAAW,KAAK,SAAS;AACvB,YAAM,SAAS,YAAY,IAAI,EAAE,IAAI,IACjC,kCACA,aAAa,IAAI,EAAE,IAAI,IACrB,kCACA;AACN,YAAM,KAAK,GAAG,MAAM,IAAI,EAAE,IAAI,cAAc,EAAE,QAAQ,SAAS,EAAE,IAAI,YAAO,EAAE,QAAQ,EAAE;AAAA,IAC1F;AACA,eAAW,KAAK,OAAO,OAAQ,OAAM,KAAK,YAAO,EAAE,IAAI,KAAK,EAAE,KAAK,EAAE;AAAA,EACvE;AAOA,QAAM,iBAAiB,6BAA6B,UAAU,MAAM;AACpE,QAAM,eAAe,MAAM,2BAA2B,gBAAgB,OAAO,IAAI,aAAa;AAC5F,UAAM,SAAS,MAAM,sBAAsB,MAAM,IAAI,QAAQ;AAC7D,UAAM,KAAK,YAAY,OAAO,IAAI,MAAM;AAAA,EAC1C,CAAC;AAED,QAAM,KAAK,8BAA8B,MAAM,CAAC;AAChD,QAAM,KAAK,6BAA6B,YAAY,CAAC;AAErD,SAAO,EAAE,QAAQ,MAAM,KAAK,IAAI,GAAG,MAAM,EAAE;AAC7C;","names":[]}

package/dist/{report-4EVNDHOZ.js → report-R3E3Y7HR.js}

@@ -4,7 +4,7 @@ import {
 import {
   draftReportForSite,
   readGaConfig
-} from "./chunk-BYK66EWO.js";
+} from "./chunk-BBUSGEES.js";
 import {
   findDueReports,
   nextDueDate,
@@ -12,27 +12,27 @@ import {
 } from "./chunk-PZR4EBPY.js";
 import {
   reportTier
-} from "./chunk-ILUNZHYV.js";
-import "./chunk-5UINJNAJ.js";
-import "./chunk-CQR4LIM7.js";
-import "./chunk-Z7AXYKQB.js";
-import {
-  escapeHtml
-} from "./chunk-DJZWYIPP.js";
+} from "./chunk-YFAXOD7Z.js";
 import {
   listAllReports
-} from "./chunk-ACBRLLFT.js";
+} from "./chunk-F3JWOPTG.js";
 import "./chunk-VAD43MOR.js";
+import "./chunk-IY6256GK.js";
 import {
   openBase,
   readAirtableConfig
 } from "./chunk-HN6I2XWI.js";
-import "./chunk-EVBCK2KC.js";
+import "./chunk-MT2JINSS.js";
+import {
+  escapeHtml
+} from "./chunk-DJZWYIPP.js";
+import "./chunk-5UINJNAJ.js";
 import {
   listWebsites,
   siteSlug,
   updateNextDueDates
-} from "./chunk-LDWZSLSU.js";
+} from "./chunk-7NYN2P6I.js";
+import "./chunk-EVBCK2KC.js";
 import "./chunk-6VAL7XJT.js";
 
 // src/alerts/analytics-health.ts
@@ -78,12 +78,34 @@ function dashboardBaseUrl() {
 }
 async function runReportCommand(slug, opts) {
   if (opts.digest) {
-    const { runDigest } = await import("./digest-BL6UJYKH.js");
+    const { runDigest } = await import("./digest-FW6QMZZJ.js");
     return runDigest({ baseUrl: dashboardBaseUrl() });
   }
   if (opts.sendReady) {
-    const { sendApprovedReports } = await import("./orchestrate-77UO4BYJ.js");
-    return sendApprovedReports();
+    const { sendApprovedReports } = await import("./orchestrate-YLWQ6KK2.js");
+    const { makeSiteMirror } = await import("./site-mirror-NIREX5ME.js");
+    return sendApprovedReports({ siteMirror: await makeSiteMirror() });
+  }
+  if (opts.rerender) {
+    const { rerenderReport, formatRerenderResult } = await import("./rerender-3FM6DNRH.js");
+    const { renderReportFromRow } = await import("./render-from-row-BWSOIYDS.js");
+    const { openDb, readDbConfig } = await import("./client-AUE3XUPO.js");
+    const { getReportById, getSiteById, storeRenderedHtml } = await import("./fleet-state-7TJ2GYT2.js");
+    const { loadHeaderImage } = await import("./header-images-SQBCE5OD.js");
+    const { fetchAttachmentBytes } = await import("./attachments-NLZIJ5NU.js");
+    const db = await openDb(readDbConfig());
+    const result = await rerenderReport(
+      {
+        getReport: (id) => getReportById(db, id),
+        getSite: (id) => getSiteById(db, id),
+        loadHeaderPlate: async (id) => (await loadHeaderImage(db, id))?.bytes ?? null,
+        fetchAirtableHeader: async (url) => (await fetchAttachmentBytes(url)).bytes,
+        render: (site, report, plate) => renderReportFromRow(site, report, plate),
+        store: (id, html) => storeRenderedHtml(db, id, html)
+      },
+      opts.rerender
+    );
+    return { output: formatRerenderResult(result), code: result.status === "rendered" ? 0 : 1 };
   }
   if (opts.due) {
     return runDueDraft();
@@ -107,8 +129,16 @@ async function runReportCommand(slug, opts) {
 }
 async function runDueDraft() {
   const base = openBase(readAirtableConfig());
-  const { makeScheduleMirrorBestEffort } = await import("./health-mirror-4B2L7T2Y.js");
-  const result = await draftDueReports(base, /* @__PURE__ */ new Date(), await makeScheduleMirrorBestEffort());
+  const { makeScheduleMirrorBestEffort } = await import("./health-mirror-L5JBEJVA.js");
+  const { makeReportMirror } = await import("./report-mirror-4MNORYQ4.js");
+  const { makeSiteMirror } = await import("./site-mirror-NIREX5ME.js");
+  const result = await draftDueReports(
+    base,
+    /* @__PURE__ */ new Date(),
+    await makeScheduleMirrorBestEffort(),
+    await makeReportMirror(),
+    await makeSiteMirror()
+  );
   await alertOnFleetAnalyticsFailure(result.health);
   return { output: result.output, code: result.code };
 }
@@ -165,7 +195,11 @@ async function writeNextDueDates(base, websites, reports, today, scheduleMirror
   const mirrorNote = scheduleMirror ? ` mirrored=${mirrored} mirror_failed=${mirrorFailed} mirror_missed=${mirrorMissed}` : " mirror=absent";
   console.log(`NEXT_DUE_WRITE wrote=${wrote} skipped=${skipped} failed=${failed}${mirrorNote}`);
 }
-async function draftDueReports(base, today, scheduleMirror = null) {
+async function draftDueReports(base, today, scheduleMirror = null, reportMirror, siteMirror) {
+  const mirrorOpt = {
+    ...reportMirror ? { reportMirror } : {},
+    ...siteMirror ? { siteMirror } : {}
+  };
   const websites = await listWebsites(base);
   const reports = await listAllReports(base);
   await writeNextDueDates(base, websites, reports, today, scheduleMirror);
@@ -210,7 +244,8 @@ async function draftDueReports(base, today, scheduleMirror = null) {
         const result = await draftReportForSite(base, item.site, item.reportType, {
           period,
           completeRowId: existing.id,
-          existingRow: existing
+          existingRow: existing,
+          ...mirrorOpt
         });
         existing.draftReady = result.queued === true;
         lines.push(
@@ -241,7 +276,10 @@ async function draftDueReports(base, today, scheduleMirror = null) {
       continue;
     }
     try {
-      const result = await draftReportForSite(base, item.site, item.reportType, { period });
+      const result = await draftReportForSite(base, item.site, item.reportType, {
+        period,
+        ...mirrorOpt
+      });
       lines.push(draftLine(result.reportRow?.reportId, result.queued, result.supersededIds));
       if (result.reportRow) reports.push(result.reportRow);
       if (isAnalyticsConfigured(item.site)) gaConfiguredSites++;
@@ -283,11 +321,15 @@ async function runSingleSiteDraft(slug, opts) {
   if (!site) {
     throw Object.assign(new Error(`No Websites row matched slug "${slug}"`), { exitCode: 2 });
   }
+  const reportMirror = opts.previewOnly ? null : await (await import("./report-mirror-4MNORYQ4.js")).makeReportMirror();
+  const siteMirror = opts.previewOnly ? null : await (await import("./site-mirror-NIREX5ME.js")).makeSiteMirror();
   const result = await draftReportForSite(opts.previewOnly ? null : base, site, opts.reportType, {
     previewOnly: opts.previewOnly,
     // Only forced on. Left undefined, draftReportForSite keeps its default
     // (enrich iff there is a base), so the real drafting path is untouched.
-    ...opts.enrich ? { enrich: true } : {}
+    ...opts.enrich ? { enrich: true } : {},
+    ...reportMirror ? { reportMirror } : {},
+    ...siteMirror ? { siteMirror } : {}
   });
   if (opts.previewOnly) {
     return { output: `Preview written to ${result.htmlPath}`, code: 0 };
@@ -308,4 +350,4 @@ export {
   runReportCommand,
   writeNextDueDates
 };
-//# sourceMappingURL=report-4EVNDHOZ.js.map
+//# sourceMappingURL=report-R3E3Y7HR.js.map