@reddoorla/maintenance 0.86.0 → 0.88.2

package/dist/index.js

@@ -1,29 +1,22 @@
+import "./chunk-ANJNTAMM.js";
 import "./chunk-2SLED3NB.js";
-import "./chunk-F5KM4LEQ.js";
 import {
   draftReportForSite
-} from "./chunk-BYK66EWO.js";
+} from "./chunk-J3WEZGIN.js";
 import {
   approveBlockers
-} from "./chunk-N45M3FDK.js";
+} from "./chunk-6I6L3CMX.js";
 import {
   findDueReports
 } from "./chunk-PZR4EBPY.js";
-import {
-  upgradeSvelte4to5
-} from "./chunk-Z3KYFUN6.js";
 import {
   DEFAULT_INIT_STEPS,
   a11yFixturesPage,
   init
-} from "./chunk-ZKXSX4LO.js";
-import {
-  convertToPnpm
-} from "./chunk-XIDUYLSR.js";
+} from "./chunk-K6SLF6GI.js";
 import {
   svelteCodemods
 } from "./chunk-IYSEC543.js";
-import "./chunk-J7SZQUCW.js";
 import "./chunk-BQRFQSGY.js";
 import "./chunk-Y53WOQIJ.js";
 import {
@@ -31,19 +24,39 @@ import {
   selfCaretRange,
   selfPackageVersion
 } from "./chunk-7RJ2HMMJ.js";
-import "./chunk-ILUNZHYV.js";
+import "./chunk-YFAXOD7Z.js";
 import {
   bumpDeps
 } from "./chunk-2NJQLSEU.js";
 import "./chunk-R53VL3RI.js";
 import {
-  fromAirtableBase
-} from "./chunk-SLUQ7R6I.js";
+  upgradeSvelte4to5
+} from "./chunk-Z3KYFUN6.js";
+import "./chunk-J7SZQUCW.js";
+import {
+  convertToPnpm
+} from "./chunk-XIDUYLSR.js";
 import {
   parseAddresses,
   sendApprovedReports,
   withGlobalCc
-} from "./chunk-2NDRHXMR.js";
+} from "./chunk-DGZWFI2G.js";
+import "./chunk-BRYXFH77.js";
+import "./chunk-NYUYNYQL.js";
+import {
+  isPendingApproval
+} from "./chunk-F3JWOPTG.js";
+import {
+  checklistFor,
+  gatingFields,
+  isHealthGateClear
+} from "./chunk-VAD43MOR.js";
+import {
+  fromAirtableBase
+} from "./chunk-PR343K7F.js";
+import "./chunk-IY6256GK.js";
+import "./chunk-HN6I2XWI.js";
+import "./chunk-XP5WM2LV.js";
 import "./chunk-GECESMVS.js";
 import {
   domainFromUrl,
@@ -55,29 +68,25 @@ import {
   BLURRED_CID,
   CHECK_CID,
   loadBundledImages,
-  renderReportHtml
-} from "./chunk-CQR4LIM7.js";
-import "./chunk-Z7AXYKQB.js";
+  renderReportHtml,
+  rendersCommentary
+} from "./chunk-KJGKZLCT.js";
 import {
   escapeHtml,
   safeUrl
-} from "./chunk-DJZWYIPP.js";
+} from "./chunk-BGTYPVLT.js";
 import {
-  isPendingApproval
-} from "./chunk-ACBRLLFT.js";
-import {
-  checklistFor,
-  gatingFields,
-  isHealthGateClear
-} from "./chunk-VAD43MOR.js";
-import "./chunk-HN6I2XWI.js";
+  CANONICAL_STATUSES,
+  SEVERITY_RANK,
+  siteSlug,
+  toAirtableStatus
+} from "./chunk-7NYN2P6I.js";
 import "./chunk-WEKL2HYJ.js";
-import "./chunk-NYUYNYQL.js";
 import {
   syncConfigs
-} from "./chunk-3VQWSE3F.js";
-import "./chunk-3G25KIWW.js";
+} from "./chunk-7UAYMAKR.js";
 import "./chunk-73UFRZKY.js";
+import "./chunk-3G25KIWW.js";
 import "./chunk-OTGB6YQO.js";
 import {
   ALL_AUDIT_NAMES,
@@ -87,18 +96,18 @@ import {
   runAudits,
   runAuditsAcross,
   securityAudit
-} from "./chunk-2ZPT7GLV.js";
+} from "./chunk-B23FFWU4.js";
 import "./chunk-LKGVSM2O.js";
 import "./chunk-GASBX52O.js";
 import "./chunk-XHHMM5HX.js";
 import {
   fromJsonFile,
   localPath
-} from "./chunk-6TWWY7ZU.js";
-import "./chunk-XUGSZP7Z.js";
-import "./chunk-EVBCK2KC.js";
-import "./chunk-JHGHLKFS.js";
-import "./chunk-3SF7D4DY.js";
+} from "./chunk-Z3JXLULD.js";
+import "./chunk-W45FZEGE.js";
+import "./chunk-RARREDQE.js";
+import "./chunk-WS6NU475.js";
+import "./chunk-MFHS7IQ2.js";
 import "./chunk-A3WDWNN5.js";
 import {
   isLeadFormType
@@ -111,15 +120,9 @@ import "./chunk-UDRHAQT7.js";
 import "./chunk-PTDMVGKL.js";
 import "./chunk-LBYOLBW7.js";
 import "./chunk-XXTZBPUY.js";
-import {
-  CANONICAL_STATUSES,
-  SEVERITY_RANK,
-  siteSlug,
-  toAirtableStatus
-} from "./chunk-LDWZSLSU.js";
 import "./chunk-6VAL7XJT.js";
 import "./chunk-NMAWXBJA.js";
-import "./chunk-C6B4RHXR.js";
+import "./chunk-O3GT46R2.js";
 
 // src/recipes/index.ts
 var ALL_RECIPE_NAMES = [
@@ -314,6 +317,15 @@ var SUBMISSION_STATUS_SCRIPT = `document.querySelectorAll("button.subm-status").
 // src/dashboard/site-details.ts
 var SITE_STATUS_OPTIONS = CANONICAL_STATUSES.map(toAirtableStatus);
 var FREQ_OPTIONS = ["None", "Monthly", "Quarterly", "Yearly"];
+var WATCH_CONDITION_OPTIONS = [
+  "Performance",
+  "Accessibility",
+  "Best Practices",
+  "SEO",
+  "stale repo",
+  "no custom domain"
+];
+var CLEAR_SECRET = "__clear__";
 
 // src/dashboard/render.ts
 var DASH = "\u2014";
@@ -465,14 +477,27 @@ function recipientsLine(site) {
   const ccPart = cc.length > 0 ? ` \xB7 CC ${cc.map(escapeHtml).join(", ")}` : "";
   return `<span class="recipients">To ${to.map(escapeHtml).join(", ")}${ccPart}</span>`;
 }
+function rerenderButton(r) {
+  if (r.sentAt !== null) return "";
+  const url = `/api/reports/${encodeURIComponent(r.id)}/rerender`;
+  return `<button class="rerender" data-rerender-url="${escapeHtml(url)}" title="Re-render this report from its current row (runs in Actions; takes a minute or two)">refresh preview</button>`;
+}
+function reportPreviewUrl(reportId) {
+  return `/api/reports/${encodeURIComponent(reportId)}/preview`;
+}
+function commentaryEditor(r) {
+  if (!rendersCommentary(r.reportType)) return "";
+  const url = `/api/reports/${encodeURIComponent(r.id)}/commentary`;
+  return `<div class="commentary"><label for="commentary-${escapeHtml(r.id)}">Commentary <span class="muted">(re-rendered into the email at send)</span></label><textarea id="commentary-${escapeHtml(r.id)}" data-commentary-for="${escapeHtml(r.id)}" data-commentary-url="${escapeHtml(url)}" rows="3">${escapeHtml(r.commentary ?? "")}</textarea><span class="commentary-saved" data-for="${escapeHtml(r.id)}"></span></div>`;
+}
 function pendingRow(r, site, now) {
   const type = escapeHtml(r.reportType);
   const period = r.period ? escapeHtml(r.period) : "\u2014";
   const findings = approveBlockers(site, r);
   const blocked = findings.some((f) => f.level === "fail");
-  const preview = r.renderedHtmlAttachment ? `<a href="${escapeHtml(safeUrl(r.renderedHtmlAttachment.url))}" rel="noopener noreferrer" title="rendered at draft time \u2014 Commentary/subject edits after drafting are not reflected">draft preview \u25B8</a>` : `<span class="muted">no preview yet</span>`;
+  const preview = r.renderedHtmlAttachment ? `<a href="${escapeHtml(reportPreviewUrl(r.id))}" rel="noopener noreferrer" title="rendered at draft time \u2014 Commentary/subject edits after drafting are not reflected">draft preview \u25B8</a>` : `<span class="muted">no preview yet</span>`;
   const sendLine = sendTimingLine(now);
-  return `<li><div class="pending-head"><strong>${type}</strong> <span class="muted">${period}</span> ${preflightChip(findings)} ${preview} ${approveButton(r, blocked)}</div><div class="pending-info">${recipientsLine(site)} ${sendLine}</div>${checklistBlock(r)}${overrideControl(r)}</li>`;
+  return `<li><div class="pending-head"><strong>${type}</strong> <span class="muted">${period}</span> ${preflightChip(findings)} ${preview} ${rerenderButton(r)} ${approveButton(r, blocked)}</div><div class="pending-info">${recipientsLine(site)} ${sendLine}</div>${checklistBlock(r)}${commentaryEditor(r)}${overrideControl(r)}</li>`;
 }
 function pendingSection(reports, site, now) {
   const pending = reports.filter(isPendingApproval);
@@ -502,12 +527,13 @@ function reportRow(r, site) {
   const id = escapeHtml(r.reportId);
   const ga = gaUsersCell(r);
   const search = searchCell(r);
-  const link = r.renderedHtmlAttachment ? `<a href="${escapeHtml(safeUrl(r.renderedHtmlAttachment.url))}">view</a>` : `<span class="muted">no attachment</span>`;
+  const link = r.renderedHtmlAttachment ? `<a href="${escapeHtml(reportPreviewUrl(r.id))}">view</a>` : `<span class="muted">no attachment</span>`;
   const action = isPendingApproval(r) ? approveButton(
     r,
     approveBlockers(site, r).some((f) => f.level === "fail")
   ) : "";
-  return `<tr><td>${date}</td><td>${type}</td><td><code>${id}</code></td><td>${ga}</td><td>${search}</td><td>${link}</td><td>${action}</td></tr>`;
+  const commentary = r.sentAt === null && !isPendingApproval(r) ? `<tr class="commentary-row"><td colspan="7">${commentaryEditor(r)}</td></tr>` : "";
+  return `<tr><td>${date}</td><td>${type}</td><td><code>${id}</code></td><td>${ga}</td><td>${search}</td><td>${link}</td><td>${action}</td></tr>${commentary}`;
 }
 var SUBMISSIONS_PER_SITE_CAP = 25;
 function submissionsSection(submissions, site) {
@@ -586,8 +612,45 @@ function selectRow(label, field, options, current, url) {
 function inputRow(label, field, value, url) {
   return `<div class="detail"><dt><label for="detail-${field}">${escapeHtml(label)}</label></dt><dd><input type="text" id="detail-${field}" data-detail-field="${field}" data-details-url="${url}" value="${escapeHtml(value ?? "")}" />${savedSpan(field)}</dd></div>`;
 }
+var DETAIL_VALUE_FN = `function detailValue(el) {
+      if (el.type === "checkbox") return el.checked ? "true" : "false";
+      if (el.multiple) return Array.from(el.selectedOptions).map((o) => o.value).join(",");
+      return el.value;
+    }`;
+var SAVE_DETAIL_FN = `function saveDetail(el, root) {
+      const span = root.querySelector('.detail-saved[data-for="' + el.dataset.detailField + '"]');
+      return fetch(el.dataset.detailsUrl, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ field: el.dataset.detailField, value: detailValue(el) }),
+      })
+        .then((r) => {
+          if (span) span.textContent = r.ok ? " \\u2713" : " \\u2717";
+          if (r.ok && "defaultValue" in el) el.defaultValue = el.value;
+        })
+        .catch(() => {
+          if (span) span.textContent = " \\u2717";
+        });
+    }`;
+function toDateInputValue(value) {
+  return (value ?? "").slice(0, 10);
+}
 function dateRow(label, field, value, url) {
-  return `<div class="detail"><dt><label for="detail-${field}">${escapeHtml(label)}</label></dt><dd><input type="date" id="detail-${field}" data-detail-field="${field}" data-details-url="${url}" value="${escapeHtml(value ?? "")}" />${savedSpan(field)}</dd></div>`;
+  return `<div class="detail"><dt><label for="detail-${field}">${escapeHtml(label)}</label></dt><dd><input type="date" id="detail-${field}" data-detail-field="${field}" data-details-url="${url}" value="${escapeHtml(toDateInputValue(value))}" />${savedSpan(field)}</dd></div>`;
+}
+function checkboxRow(label, field, checked, url) {
+  return `<div class="detail"><dt><label for="detail-${field}">${escapeHtml(label)}</label></dt><dd><input type="checkbox" id="detail-${field}" data-detail-field="${field}" data-details-url="${url}"${checked ? " checked" : ""} />${savedSpan(field)}</dd></div>`;
+}
+function multiSelectRow(label, field, options, selected, url) {
+  const sel = new Set(selected);
+  const opts = options.map(
+    (o) => `<option value="${escapeHtml(o)}"${sel.has(o) ? " selected" : ""}>${escapeHtml(o)}</option>`
+  ).join("");
+  return `<div class="detail wide"><dt><label for="detail-${field}">${escapeHtml(label)}</label></dt><dd><select multiple id="detail-${field}" data-detail-field="${field}" data-details-url="${url}">${opts}</select>${savedSpan(field)}</dd></div>`;
+}
+function secretRow(label, field, isSet, url) {
+  const ph = isSet ? `\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022 (type to replace, or ${CLEAR_SECRET} to erase)` : "not set";
+  return `<div class="detail"><dt><label for="detail-${field}">${escapeHtml(label)}</label></dt><dd><input type="password" autocomplete="off" id="detail-${field}" data-detail-field="${field}" data-details-url="${url}" placeholder="${escapeHtml(ph)}" />${savedSpan(field)}</dd></div>`;
 }
 function textareaRow(label, field, value, url) {
   return `<div class="detail wide"><dt><label for="detail-${field}">${escapeHtml(label)}</label></dt><dd><textarea id="detail-${field}" data-detail-field="${field}" data-details-url="${url}">${escapeHtml(value ?? "")}</textarea>${savedSpan(field)}</dd></div>`;
@@ -621,6 +684,15 @@ function siteDetailsSection(site) {
     // Raw JSON, and shown as the raw cell rather than the parsed object: what the
     // operator edits has to be the thing `parseNotifyRouting` will read back.
     textareaRow("Notify routing (JSON)", "notifyRouting", site.notifyRoutingRaw, url),
+    checkboxRow("Require Turnstile", "requireTurnstile", site.requireTurnstile, url),
+    secretRow("Mailchimp API key", "mailchimpApiKey", site.mailchimpApiKey !== null, url),
+    multiSelectRow(
+      "Accepted watch conditions",
+      "acceptedWatchConditions",
+      WATCH_CONDITION_OPTIONS,
+      site.acceptedWatchConditions,
+      url
+    ),
     textareaRow("Copy \u2014 Intro", "copyIntro", site.copyIntro, url),
     textareaRow("Copy \u2014 Contact", "copyContact", site.copyContact, url),
     textareaRow("Copy \u2014 Footer", "copyFooter", site.copyFooter, url),
@@ -847,9 +919,18 @@ function renderSiteDashboardHtml(site, reports, submissions = [], spamTotals = n
   ${spamScreenSection(spamTotals, submissions, now)}
   ${submissionsSection(submissions, site)}
   <script>
+    // The SAME pending report is rendered twice \u2014 once in the pending list, once
+    // in the reports history \u2014 so one report id owns two Approve buttons. Every
+    // state change has to reach both, or the two places you look disagree: one
+    // says "Approved", the other still says "Approve" and (with the gate clear)
+    // is still enabled.
+    function approveButtonsFor(id) {
+      return Array.from(document.querySelectorAll('button.approve[data-report-id="' + id + '"]'));
+    }
     document.querySelectorAll("button.approve").forEach((b) => {
       b.addEventListener("click", async () => {
-        b.disabled = true;
+        const twins = approveButtonsFor(b.dataset.reportId);
+        twins.forEach((t) => { t.disabled = true; });
         // is-loading swaps the label for a spinner; aria-busy is the same news for a
         // screen reader, which cannot see it. Both are cleared in the finally below so
         // no exit path can strand the button spinning forever.
@@ -858,30 +939,41 @@ function renderSiteDashboardHtml(site, reports, submissions = [], spamTotals = n
         try {
           const res = await fetch(b.dataset.approveUrl, { method: "POST" });
           if (res.ok) {
-            b.textContent = "Approved";
-            // Terminal success: darker green, and it stays disabled (approving twice is
-            // a no-op server-side, but the button should not invite the second click).
-            b.classList.add("is-approved");
+            // Terminal success: darker green, and they stay disabled (approving twice
+            // is a no-op server-side, but the button should not invite the second
+            // click). Applied to every twin, not just the one that was clicked.
+            twins.forEach((t) => {
+              t.textContent = "Approved";
+              t.classList.add("is-approved");
+            });
           } else {
             // A 409 carries { reason, blockers } \u2014 surface WHY instead of a bare
             // "Failed" next to a possibly-stale green chip. textContent/title
             // assignment only (no innerHTML), so server strings stay inert.
             const data = await res.json().catch(() => null);
-            b.textContent = data && data.reason === "send-blocked" ? "Blocked" : "Failed";
+            const label = data && data.reason === "send-blocked" ? "Blocked" : "Failed";
             // Double-backslash, NOT single: this whole block lives inside the renderer's
             // template literal, so a single-backslash escape is consumed HERE at build
             // time and emits a real newline into the served HTML \u2014 an unterminated string
             // literal that kills the parse of the entire script element, taking every
             // handler on the page with it (exactly how approve/override/renovate went
             // dead). Note this comment must also avoid backticks for the same reason.
-            if (data && Array.isArray(data.blockers)) b.title = data.blockers.join("\\n");
-            b.disabled = false;
+            const title = data && Array.isArray(data.blockers) ? data.blockers.join("\\n") : null;
+            // Re-enable EVERY twin, not just the clicked one \u2014 leaving the other
+            // disabled would strand it reading "Approve" and unusable.
+            twins.forEach((t) => {
+              t.textContent = label;
+              if (title !== null) t.title = title;
+              t.disabled = false;
+            });
           }
         } catch {
           // Network rejection (offline, DNS, abort): mirror the !res.ok path so
-          // the button doesn't sit permanently disabled reading "Approve".
-          b.textContent = "Failed";
-          b.disabled = false;
+          // the buttons don't sit permanently disabled reading "Approve".
+          twins.forEach((t) => {
+            t.textContent = "Failed";
+            t.disabled = false;
+          });
         } finally {
           b.classList.remove("is-loading");
           b.removeAttribute("aria-busy");
@@ -894,7 +986,12 @@ function renderSiteDashboardHtml(site, reports, submissions = [], spamTotals = n
     // refused client-side AND server-side).
     document.querySelectorAll("button.override-toggle").forEach((b) => {
       b.addEventListener("click", () => {
-        const form = b.nextElementSibling;
+        // Scoped lookup, not nextElementSibling: adjacency is a markup accident,
+        // and anything inserted between the toggle and its form would kill "Send
+        // anyway\u2026" silently. The submit handler six lines down already uses
+        // closest(); this is the same contract from the other end.
+        const wrap = b.closest(".override");
+        const form = wrap ? wrap.querySelector(".override-form") : null;
         if (form) form.hidden = !form.hidden;
       });
     });
@@ -919,13 +1016,14 @@ function renderSiteDashboardHtml(site, reports, submissions = [], spamTotals = n
           if (res.ok) {
             if (status) status.textContent = "Overridden \u2713";
             if (input) input.disabled = true;
-            // Reflect the send-anyway state on the row's own Approve button too \u2014
-            // it stays server-gated disabled, but the label should stop implying
-            // "waiting on you" once an override has gone through.
-            const approveBtn = document.querySelector(
-              'button.approve[data-report-id="' + b.dataset.reportId + '"]',
-            );
-            if (approveBtn) approveBtn.textContent = "Overridden";
+            // Reflect the send-anyway state on the row's own Approve buttons too \u2014
+            // they stay server-gated disabled, but the label should stop implying
+            // "waiting on you" once an override has gone through. ALL of them: the
+            // same report is rendered in both the pending list and the history, so
+            // a singular querySelector updated the first and left the second lying.
+            approveButtonsFor(b.dataset.reportId).forEach((t) => {
+              t.textContent = "Overridden";
+            });
           } else {
             // A 409 carries { reason, blockers } \u2014 surface WHY (textContent only,
             // never innerHTML, so server strings stay inert).
@@ -963,26 +1061,66 @@ function renderSiteDashboardHtml(site, reports, submissions = [], spamTotals = n
     });
     // Site-details editor: save on change (selects) / blur (inputs+textareas, only
     // when the value actually changed). The per-field span shows \u2713 / \u2717.
-    function saveDetail(el) {
-      const span = document.querySelector('.detail-saved[data-for="' + el.dataset.detailField + '"]');
-      fetch(el.dataset.detailsUrl, {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({ field: el.dataset.detailField, value: el.value }),
-      })
-        .then((r) => {
-          if (span) span.textContent = r.ok ? " \u2713" : " \u2717";
-        })
-        .catch(() => {
-          if (span) span.textContent = " \u2717";
-        });
-    }
+    ${DETAIL_VALUE_FN}
+    ${SAVE_DETAIL_FN}
     document.querySelectorAll("select[data-detail-field]").forEach((s) => {
-      s.addEventListener("change", () => saveDetail(s));
+      s.addEventListener("change", () => saveDetail(s, document));
+    });
+    // Checkboxes save on CHANGE. They cannot use the blur path below: that path
+    // only fires when \`value !== defaultValue\`, and for a checkbox both are the
+    // "on" content attribute, so it would never save at all.
+    document.querySelectorAll("input[type=checkbox][data-detail-field]").forEach((c) => {
+      c.addEventListener("change", () => saveDetail(c, document));
     });
-    document.querySelectorAll("input[data-detail-field], textarea[data-detail-field]").forEach((i) => {
+    document.querySelectorAll("input:not([type=checkbox])[data-detail-field], textarea[data-detail-field]").forEach((i) => {
+      // A save needs BOTH a real edit gesture and a changed value. \`value !==
+      // defaultValue\` alone is not evidence of an edit: the browser rewrites
+      // \`.value\` on its own when a control is handed a value it cannot represent
+      // (an ISO datetime in a date input sanitizes to ""), and the blur that
+      // follows an untouched tab-through then posts that empty string as if the
+      // operator had cleared the field. Requiring an \`input\` event first means
+      // only a human keystroke or picker choice can arm the save.
+      i.addEventListener("input", () => { i.dataset.edited = "1"; });
       i.addEventListener("blur", () => {
-        if (i.value !== i.defaultValue) saveDetail(i);
+        if (i.dataset.edited === "1" && i.value !== i.defaultValue) saveDetail(i, document);
+      });
+    });
+    // Refresh preview: dispatch the re-render workflow, then tell the operator to
+    // reload once it lands. No polling \u2014 the run takes a minute or two and a
+    // spinner that long reads as a hang.
+    document.querySelectorAll("button.rerender").forEach((b) => {
+      b.addEventListener("click", async () => {
+        b.disabled = true;
+        b.textContent = "Refreshing\u2026";
+        try {
+          const res = await fetch(b.dataset.rerenderUrl, { method: "POST" });
+          b.textContent = res.ok ? "Queued \u2713 reload in ~2 min" : "Failed";
+          if (!res.ok) b.disabled = false;
+        } catch {
+          b.textContent = "Failed";
+          b.disabled = false;
+        }
+      });
+    });
+    // Report commentary: save on blur, only when it actually changed. Same
+    // shape as the site-details editor, but keyed on the REPORT id rather than a
+    // field name, so it posts { text } to the report's own endpoint.
+    document.querySelectorAll("textarea[data-commentary-for]").forEach((t) => {
+      t.addEventListener("blur", () => {
+        if (t.value === t.defaultValue) return;
+        const span = document.querySelector('.commentary-saved[data-for="' + t.dataset.commentaryFor + '"]');
+        fetch(t.dataset.commentaryUrl, {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({ text: t.value }),
+        })
+          .then((r) => {
+            if (span) span.textContent = r.ok ? " \u2713" : " \u2717";
+            if (r.ok) t.defaultValue = t.value;
+          })
+          .catch(() => {
+            if (span) span.textContent = " \u2717";
+          });
       });
     });
     ${SUBMISSION_STATUS_SCRIPT}
@@ -1537,41 +1675,38 @@ var AUDIT_SCRIPT = `<script>
   function rfStop(){ try { localStorage.removeItem(RF_KEY); } catch(e){} }
   // Per-workflow ETA hint (the lighthouse fleet sweep runs ~48 min; security ~1-2 min).
   function rfEta(label){ return label === 'lighthouse' ? '~48m' : label === 'security' ? '~2m' : ''; }
-  // Map a raw GitHub step name to a coarse human phase. Order matters (the audit step
-  // name also contains 'browser'; 'playwright install' also contains 'install').
-  function rfPhase(step){
-    if (!step) return '';
-    var s = step.toLowerCase();
-    if (s.indexOf('audit') !== -1 || s.indexOf('lighthouse') !== -1) return 'auditing the fleet\u2026';
-    if (s.indexOf('build') !== -1) return 'building\u2026';
-    if (s.indexOf('playwright') !== -1 || s.indexOf('browser') !== -1) return 'installing browsers\u2026';
-    if (s.indexOf('install') !== -1 || s.indexOf('depend') !== -1) return 'installing dependencies\u2026';
-    if (s.indexOf('set up') !== -1 || s.indexOf('checkout') !== -1) return 'setting up\u2026';
-    return step;
+  // Escape before interpolating. The values here are server-side enums and a
+  // GitHub html_url today, but this builds HTML from a REMOTE API response, and
+  // the house rule everywhere else on these pages is that no server string ever
+  // reaches the browser as markup. Cheaper to escape than to keep re-deciding.
+  function rfEsc(v){
+    return String(v == null ? '' : v)
+      .replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;')
+      .replace(/"/g,'&quot;').replace(/'/g,'&#39;');
+  }
+  // A run link must be a GitHub run URL. Anything else is dropped rather than
+  // rendered, so a compromised or unexpected API response cannot place an
+  // arbitrary href (javascript:, data:, an attacker's host) in the panel.
+  function rfRunUrl(u){
+    return typeof u === 'string' && u.indexOf('https://github.com/') === 0 ? rfEsc(u) : '';
   }
-  // Safe to build raw HTML: workflow/state/step are server-fixed (enums + GitHub step
-  // names) and url is GitHub's own html_url for our central repo \u2014 none are
-  // user-supplied. Don't interpolate untrusted fields here without escaping.
   function rfRender(status, startedAt){
     var failed = function(s){ return s === 'failure' || s === 'cancelled' || s === 'timed_out'; };
     var mins = Math.floor((Date.now() - startedAt) / 60000);
     var elapsed = mins < 1 ? '<1m' : mins + 'm';
     return status.perWorkflow.map(function(w){
-      var label = w.workflow.replace('.yml','').replace('fleet-','');
+      var label = String(w.workflow || '').replace('.yml','').replace('fleet-','');
       var done = w.state === 'success';
       var isFailed = failed(w.state);
       var icon = done ? '\u2713' : isFailed ? '\u2717' : '<span class="rf-spin"></span>';
-      var line = icon + ' ' + label + ' \u2014 ' + w.state.replace('_',' ');
+      var line = icon + ' ' + rfEsc(label) + ' \u2014 ' + rfEsc(String(w.state || '').replace('_',' '));
+      var url = rfRunUrl(w.url);
       if (!done && !isFailed){
-        var phase = rfPhase(w.step);
         var eta = rfEta(label);
-        var detail = [];
-        if (phase) detail.push(phase);
-        detail.push(elapsed + (eta ? ' / ' + eta : ''));
-        var link = w.url ? ' \xB7 <a href="'+w.url+'" target="_blank" rel="noopener">view run \u2197</a>' : '';
-        line += '<div class="rf-sub">' + detail.join(' \xB7 ') + link + '</div>';
-      } else if (isFailed && w.url){
-        line += ' <a href="'+w.url+'" target="_blank" rel="noopener">run</a>';
+        var link = url ? ' \xB7 <a href="'+url+'" target="_blank" rel="noopener">view run \u2197</a>' : '';
+        line += '<div class="rf-sub">' + elapsed + (eta ? ' / ' + eta : '') + link + '</div>';
+      } else if (isFailed && url){
+        line += ' <a href="'+url+'" target="_blank" rel="noopener">run</a>';
       }
       return '<div class="rf-row">' + line + '</div>';
     }).join('');
@@ -1700,6 +1835,8 @@ var SESSION_TTL_SECONDS = 30 * 24 * 60 * 60;
 
 // src/dashboard/prospect-audit-trigger.ts
 var PROSPECT_AUDIT_DUPLICATE_WINDOW_MS = 10 * 60 * 1e3;
+var PROSPECT_AUDIT_DAILY_CAP = 25;
+var DAILY_CAP_LOOKBACK = PROSPECT_AUDIT_DAILY_CAP * 2;
 export {
   ALL_AUDIT_NAMES,
   ALL_RECIPE_NAMES,