@reddoorla/maintenance 0.93.1 → 0.94.0

package/dist/{health-mirror-55RRU6BI.js → health-mirror-EB76EERV.js}

@@ -1,14 +1,14 @@
 import {
   mirrorHealthFields,
   mirrorScheduleFields
-} from "./chunk-QBAAZY7W.js";
-import "./chunk-P6AORG32.js";
+} from "./chunk-WVNDEYXL.js";
+import "./chunk-6R56OKJZ.js";
 import {
   TURSO_IS_AUTHORITATIVE
 } from "./chunk-SVAAONYB.js";
 import "./chunk-F3JWOPTG.js";
 import "./chunk-VAD43MOR.js";
-import "./chunk-7NYN2P6I.js";
+import "./chunk-3Z6X3BHU.js";
 import {
   openDb,
   readDbConfig
@@ -43,4 +43,4 @@ export {
   makeHealthMirrorBestEffort,
   makeScheduleMirrorBestEffort
 };
-//# sourceMappingURL=health-mirror-55RRU6BI.js.map
+//# sourceMappingURL=health-mirror-EB76EERV.js.map

package/dist/{import-airtable-OHVY344G.js → import-airtable-TAKSN4NV.js}

@@ -14,9 +14,9 @@ import {
   renderedHtmlUrl,
   scheduleColumnFor,
   siteValueFor
-} from "./chunk-P6AORG32.js";
+} from "./chunk-6R56OKJZ.js";
 import "./chunk-VAD43MOR.js";
-import "./chunk-7NYN2P6I.js";
+import "./chunk-3Z6X3BHU.js";
 export {
   EXCLUDED_WEBSITE_FIELDS,
   HEALTH_BOOLEAN,
@@ -34,4 +34,4 @@ export {
   scheduleColumnFor,
   siteValueFor
 };
-//# sourceMappingURL=import-airtable-OHVY344G.js.map
+//# sourceMappingURL=import-airtable-TAKSN4NV.js.map

package/dist/index.d.ts

@@ -116,6 +116,7 @@ type VerifyDeps = {
  *  which never manufactures a verdict. */
 type FormSubmitOutcome = {
     formPresent: false;
+    formsHealth?: FormsHealth;
 } | {
     formPresent: true;
     success: boolean;
@@ -136,9 +137,70 @@ type FormSubmitOutcome = {
      *  re-filled once before the click. On a pass this is production proof the
      *  wipe happens; on a failure it says one refill wasn't enough. */
     refilled?: boolean;
+    /** What the site's REAL Turnstile widget did while the probe was on the
+     *  page. The probe does NOT swap the sitekey — `testSitekey` only names the
+     *  fake token VALUE it injects — so the real widget renders with the real
+     *  `PUBLIC_TURNSTILE_SITE_KEY` on every run, and this records what it did.
+     *  Undefined = not observed (an older runner, or the page never loaded). */
+    turnstile?: TurnstileObservation;
+    /** The `forms` block the preflight already read. Carried out rather than
+     *  re-fetched so the verdict cannot disagree with the gate that admitted
+     *  the probe. Undefined = an older runner that did not report it. */
+    formsHealth?: FormsHealth;
 } | {
     testModeUndeclared: true;
 };
+/**
+ * What a browser saw the site's own Turnstile widget do. Only two of Cloudflare's
+ * failure modes are BROWSER-INDEPENDENT, and the distinction is the whole point:
+ *
+ * - `110200` is a domain-binding rejection, emitted before any challenge is
+ *   attempted. It means this hostname is not on the widget's allowlist, the widget
+ *   mints NO token, and on a `Require Turnstile` site every real lead is bucketed
+ *   as spam. It fires identically for a human and for automation, so a probe can
+ *   assert on it.
+ * - `600010` is a challenge failure, and Cloudflare returns it to ANY driven
+ *   browser whatever the configuration — measured 2026-09-04 against the
+ *   known-good reddoorla.com canary and against Playwright headed and headless,
+ *   while the same page in an ordinary Chrome window minted a token siteverify
+ *   accepted. It carries NO information about the site and must never be a verdict.
+ *
+ * A "pass" therefore needs POSITIVE evidence — the mount point AND Cloudflare's
+ * script — never merely the absence of an error string. The SSR'd container alone
+ * proves only that the env var is set.
+ */
+type TurnstileObservation = {
+    /** A `.cf-turnstile` mount point was in the DOM on the route the probe settled
+     *  on. NOT sufficient on its own: the starter server-renders that div from
+     *  `{#if turnstileSiteKey}`, so it is present whenever the env var is set —
+     *  including when the widget never initialises. Pairing it with `scriptLoaded`
+     *  is what makes "pass" positive evidence rather than the absence of a string. */
+    containerPresent: boolean;
+    /** Cloudflare's `api.js` was actually fetched and answered 2xx. Without it
+     *  `window.turnstile` never exists, no widget is created and no token is ever
+     *  minted — while the SSR'd container sits there looking healthy. */
+    scriptLoaded: boolean;
+    /** An uncaught (or logged) `110200` — this hostname is not on the widget. */
+    hostnameRejected: boolean;
+    /** The page reported the widget could not render. The starter catches a
+     *  `loadTurnstile()` rejection and logs `[turnstile] widget did not render` at
+     *  console.WARN — not error — so this is deliberately matched across every
+     *  console level, not just errors. */
+    initFailed: boolean;
+    /** Cloudflare raised some OTHER error against the widget — an invalid, deleted,
+     *  rotated or disabled sitekey (110100, 110110, 400020, 400070), or another
+     *  `110xxx`. Its whole job is to deny the green: without it, a widget deleted at
+     *  Cloudflare scores "pass", because api.js still answers 2xx (its URL carries no
+     *  sitekey), the mount point is still server-rendered, and the pass arm's negative
+     *  half was the absence of one six-digit string.
+     *
+     *  Never a fail. This fleet has MEASURED only 110200 and 600010 verbatim, and an
+     *  unmeasured code does not get the authority to raise a red on a gated site — it
+     *  lands as `null`, "looked, cannot tell", which the cockpit already renders as
+     *  the amber `turnstile-unverified` watch. That asymmetry is what makes it safe to
+     *  match a family by prefix rather than a list by measurement. */
+    widgetError: boolean;
+};
 /** Injected browser IO. The real impl drives Playwright; tests pass a fake. */
 type FormRunner = {
     submit: (opts: {
@@ -148,6 +210,17 @@ type FormRunner = {
     }) => Promise<FormSubmitOutcome>;
     close?: () => Promise<void>;
 };
+/**
+ * The site's `/health` `forms` block, read once in the preflight. `testMode` gates
+ * whether the probe may submit at all; `turnstile` is `!!PUBLIC_TURNSTILE_SITE_KEY`
+ * on the deployed site — it says a sitekey is CONFIGURED and nothing more, since
+ * /health never contacts Cloudflare. Null = absent or malformed (an older site
+ * package whose /health has no such key).
+ */
+type FormsHealth = {
+    testMode: boolean;
+    turnstile: boolean | null;
+};
 
 /** Result of probing a site's latest PRODUCTION Netlify deploy. Every field is
  *  nullable: a site with no production deploy yet degrades to all-nulls (a real
@@ -649,12 +722,20 @@ type WebsiteRow = {
      *  "ok"`. Single-select `pass`/`fail`; null = never ran. No per-site Prismic token or identity
      *  column is ever built — this rides `/health`. */
     cmsReachable: "pass" | "fail" | null;
-    /** From the same `/health` body's `forms.turnstile` boolean: does the deployed site report
-     *  the Turnstile widget configured (`PUBLIC_TURNSTILE_SITE_KEY` set)? Single-select
-     *  `pass`/`fail`; null = never ran / older site package whose `/health` has no `forms`
-     *  block. Freshness gated by `functionHealthCheckedAt`. Powers the cockpit Require-Turnstile
-     *  guardrail: a site with `requireTurnstile` ON but no widget silently buckets 100% of its
-     *  real leads (and form-e2e can't see it — testMode bypasses the gate). */
+    /** Does the deployed site's Turnstile widget actually work? Single-select `pass`/`fail`;
+     *  null = **unverified**, which is the normal state — see below. Freshness gated by
+     *  `formE2eCheckedAt`, the clock of the audit that writes it. Powers the cockpit Require-Turnstile guardrail: a site with
+     *  `requireTurnstile` ON but no working widget silently buckets 100% of its real leads.
+     *
+     *  One of the two `"fail"` arms is derived from `/health` (the other is a browser seeing
+     *  110200 on the live hostname), whose `forms.turnstile` is a truthiness check
+     *  on `PUBLIC_TURNSTILE_SITE_KEY` that never contacts Cloudflare (see
+     *  audits/function-health-airtable.ts for the incident). No key IS proof the widget can't
+     *  work; a key is NOT proof that it can — a sitekey whose widget is full at Cloudflare's
+     *  10-hostname cap sets the var and still mints no token. So a `"pass"` here has to be
+     *  earned by a real browser rendering the real widget (form-e2e), and until it is, null
+     *  keeps the site in the cockpit's amber "can't verify" watch rather than claiming health
+     *  nobody measured. */
     turnstileWidget: "pass" | "fail" | null;
     /** When the `function-health` audit last ran — the freshness gate for `functionHealth`,
      *  `cmsReachable`, and `turnstileWidget`. Null = never ran. */

package/dist/index.js

@@ -3,10 +3,10 @@ import {
   DEFAULT_INIT_STEPS,
   a11yFixturesPage,
   init
-} from "./chunk-4NUKMPOO.js";
+} from "./chunk-5FCBYK6L.js";
 import {
   draftReportForSite
-} from "./chunk-ZRI5VRPG.js";
+} from "./chunk-BYGPUUCT.js";
 import "./chunk-YFAXOD7Z.js";
 import {
   upgradeSvelte4to5
@@ -19,7 +19,7 @@ import {
 } from "./chunk-LS6QPANO.js";
 import "./chunk-J7SZQUCW.js";
 import "./chunk-4R3YAQNV.js";
-import "./chunk-CVJF2IC5.js";
+import "./chunk-TGUESYGF.js";
 import "./chunk-R53VL3RI.js";
 import {
   onboard,
@@ -29,10 +29,10 @@ import {
 import {
   bumpDeps
 } from "./chunk-PPIZHDJL.js";
-import "./chunk-MVDMKKBN.js";
+import "./chunk-4AIYWWKV.js";
 import {
   approveBlockers
-} from "./chunk-E22WAIF2.js";
+} from "./chunk-AEUABPAJ.js";
 import {
   findDueReports
 } from "./chunk-PZR4EBPY.js";
@@ -40,7 +40,7 @@ import {
   parseAddresses,
   sendApprovedReports,
   withGlobalCc
-} from "./chunk-FCS36FDT.js";
+} from "./chunk-KQB2BX4V.js";
 import {
   isPendingApproval
 } from "./chunk-F3JWOPTG.js";
@@ -53,10 +53,10 @@ import "./chunk-BRYXFH77.js";
 import "./chunk-7MKT4I5T.js";
 import {
   fromAirtableBase
-} from "./chunk-PR343K7F.js";
+} from "./chunk-5GUJ36TL.js";
 import "./chunk-IY6256GK.js";
 import "./chunk-HN6I2XWI.js";
-import "./chunk-SKI23ZZH.js";
+import "./chunk-HTABUCF4.js";
 import "./chunk-GECESMVS.js";
 import {
   BLURRED_CID,
@@ -80,7 +80,7 @@ import {
   SEVERITY_RANK,
   siteSlug,
   toAirtableStatus
-} from "./chunk-7NYN2P6I.js";
+} from "./chunk-3Z6X3BHU.js";
 import "./chunk-WEKL2HYJ.js";
 import "./chunk-T7ZUUOZ2.js";
 import {
@@ -97,7 +97,7 @@ import {
   runAudits,
   runAuditsAcross,
   securityAudit
-} from "./chunk-JB4Q3C3M.js";
+} from "./chunk-TO7DJYLZ.js";
 import "./chunk-LKGVSM2O.js";
 import "./chunk-GASBX52O.js";
 import "./chunk-XHHMM5HX.js";
@@ -114,11 +114,11 @@ import {
 import "./chunk-UDRHAQT7.js";
 import "./chunk-PTDMVGKL.js";
 import "./chunk-LBYOLBW7.js";
-import "./chunk-RARREDQE.js";
 import "./chunk-A3WDWNN5.js";
 import {
   isLeadFormType
 } from "./chunk-2OP4JKIQ.js";
+import "./chunk-RARREDQE.js";
 import "./chunk-XXTZBPUY.js";
 import "./chunk-XTK5VIQB.js";
 import "./chunk-6VAL7XJT.js";
@@ -667,6 +667,9 @@ function siteDetailsSection(site) {
     selectRow("Status", "status", SITE_STATUS_OPTIONS, site.statusRaw, url),
     selectRow("Maintenance cadence", "maintenanceFreq", FREQ_OPTIONS, site.maintenanceFreq, url),
     selectRow("Testing cadence", "testingFreq", FREQ_OPTIONS, site.testingFreq, url),
+    // First, because it is the site's own address and the target every deployed
+    // audit drives. `site.url` is the row's value; `url` is this page's endpoint.
+    inputRow("Site URL", "url", site.url, url),
     inputRow("Report recipients (To)", "reportRecipientsTo", site.reportRecipientsTo, url),
     inputRow("Report recipients (CC)", "reportRecipientsCc", site.reportRecipientsCc, url),
     inputRow("Point of contact", "pointOfContact", site.pointOfContact, url),