@reddoorla/maintenance 0.95.1 → 0.96.0

package/dist/{prospect-audit-PRHU53HS.js → prospect-audit-AJEE3Z4L.js}

@@ -109,7 +109,7 @@ async function runProspectAuditCommand(url, opts) {
       "No TURSO_DATABASE_URL, so the report cannot be saved or shared. Re-run with --out <file>, or set the Turso credentials."
     );
   }
-  const { runProspectAudit } = await import("./pipeline-YROAY6DT.js");
+  const { runProspectAudit } = await import("./pipeline-UUPXOS2J.js");
   const onStage = (name, status, detail) => {
     if (status === "start") console.error(`\u2026 ${name}`);
     else if (status === "ok") console.error(`\u2713 ${name}`);
@@ -117,6 +117,9 @@ async function runProspectAuditCommand(url, opts) {
   };
   const business = opts.business?.trim();
   const goal = opts.goal?.trim();
+  const splitList = (v) => (v ?? "").split(",").map((x) => x.trim()).filter((x) => x !== "");
+  const chosenTerms = splitList(opts.terms);
+  const chosenQuestions = splitList(opts.questions);
   if (goal !== void 0 && goal !== "" && !isSiteGoal(goal)) {
     return fail(`--goal must be one of: ${GOALS.join(", ")}`);
   }
@@ -131,11 +134,13 @@ async function runProspectAuditCommand(url, opts) {
       ...opts.competitors ? {
         competitors: opts.competitors.split(",").map((c) => c.trim()).filter(Boolean)
       } : {},
-      ...opts.probes === false ? { probes: false } : {}
+      ...opts.probes === false ? { probes: false } : {},
+      ...chosenTerms.length > 0 ? { terms: chosenTerms } : {},
+      ...chosenQuestions.length > 0 ? { questions: chosenQuestions } : {}
     },
     { ...opts.deps ?? {}, onStage }
   );
-  const { renderProspectReport } = await import("./render-YGNGTX3W.js");
+  const { renderProspectReport } = await import("./render-MHUUHPLN.js");
   const html = renderProspectReport(result);
   const warnings = [];
   let file = null;
@@ -152,8 +157,8 @@ async function runProspectAuditCommand(url, opts) {
   let auditId = null;
   if (canPersist) {
     try {
-      const { openDb, readDbConfig } = await import("./client-G2WGWPCA.js");
-      const { createProspectAudit } = await import("./prospect-audits-R3LWF6U7.js");
+      const { openDb, readDbConfig } = await import("./client-L7NAUG6J.js");
+      const { createProspectAudit } = await import("./prospect-audits-IZVQY3OQ.js");
       const db = await openDb(readDbConfig());
       const created = await createProspectAudit(db, {
         url: result.url,
@@ -163,7 +168,11 @@ async function runProspectAuditCommand(url, opts) {
         // renaming a column needs its own migration for no benefit here.
         business: result.businessName,
         status: auditStatus(result),
-        resultJson: JSON.stringify(result)
+        resultJson: JSON.stringify(result),
+        // #676: on the ROW, not only in result_json — a re-run reuses them and
+        // the /audits listing marks them without reading the blob.
+        chosenTerms: chosenTerms.length > 0 ? chosenTerms : null,
+        chosenQuestions: chosenQuestions.length > 0 ? chosenQuestions : null
       });
       auditId = created.id;
       token = created.token;
@@ -213,4 +222,4 @@ export {
   GOALS,
   runProspectAuditCommand
 };
-//# sourceMappingURL=prospect-audit-PRHU53HS.js.map
+//# sourceMappingURL=prospect-audit-AJEE3Z4L.js.map

package/dist/prospect-audit-AJEE3Z4L.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli/commands/prospect-audit.ts","../src/prospect/report-url.ts"],"sourcesContent":["import { mkdir, writeFile } from \"node:fs/promises\";\nimport { resolve } from \"node:path\";\nimport { hostnameOf, isHttpUrl, isPrivateOrLoopbackHost } from \"../../util/url.js\";\nimport { reportUrl, reportPrintUrl } from \"../../prospect/report-url.js\";\nimport type { ProspectAuditStatus } from \"../../db/prospect-audits.js\";\nimport type { PipelineDeps, StageName } from \"../../prospect/pipeline.js\";\nimport type { ProspectAuditResult } from \"../../prospect/types.js\";\nimport type { SendAuditEmailResult } from \"../../prospect/email.js\";\nimport type { SiteGoal } from \"../../prospect/goals.js\";\n\n/** The operator-selectable goals, in the order the dispatch dropdown lists\n *  them. `unknown` is deliberately absent: it is a finding the audit can reach\n *  on its own, never something an operator would choose. */\nexport const GOALS = [\n  \"book\",\n  \"enquire\",\n  \"call\",\n  \"visit\",\n  \"buy\",\n  \"demo\",\n  \"partner\",\n] as const satisfies readonly SiteGoal[];\n\nfunction isSiteGoal(value: string): value is SiteGoal {\n  return (GOALS as readonly string[]).includes(value);\n}\n\nexport type ProspectAuditCliOptions = {\n  business?: string;\n  /**\n   * The one action the site should produce from a visitor, chosen by the\n   * operator instead of inferred from the site.\n   *\n   * Worth overriding because the operator knows things the site does not say.\n   * A practice that wants online bookings but has never built one reads as\n   * \"call\" from its own pages, and grading it as \"call\" would score it well for\n   * doing the thing they are trying to stop doing.\n   */\n  goal?: string;\n  /** Comma-separated competitor domains. */\n  competitors?: string;\n  /** cac sets this false for `--no-probes`. */\n  probes?: boolean;\n  out?: string;\n  json?: boolean;\n  /**\n   * Email the internal sheet (scores, what wasn't measured and why, top\n   * fixes, and the shareable link) to `PROSPECT_AUDIT_RECIPIENTS`, once the\n   * report is rendered and the `--out`/Turso delivery attempts finish. A\n   * missing/empty recipients var, or a Resend failure, is a warning — never a\n   * crash — because by the time this runs the audit is already delivered (or\n   * recovered) by the code above it.\n   */\n  email?: boolean;\n  /**\n   * #676. Search terms and buyer questions chosen by hand, comma-separated.\n   *\n   * Blank generates them, exactly as before — this is an override for a client\n   * we already know, and for a comparison over time, where the terms have to\n   * stay fixed between runs.\n   */\n  terms?: string;\n  questions?: string;\n  /** Test seam: injected pipeline deps. Never set from the CLI. */\n  deps?: PipelineDeps;\n};\n\ntype RecoveryWrite = { htmlPath: string; jsonPath: string };\n\nfunction fail(message: string): { output: string; code: number } {\n  return { output: message, code: 2 };\n}\n\nfunction errorMessage(err: unknown): string {\n  return err instanceof Error ? err.message : String(err);\n}\n\nfunction scoreLine(label: string, value: number | null): string {\n  return `${label.padEnd(14)} ${value === null ? \"not measured\" : String(value).padStart(3)}`;\n}\n\n/** Item 3: the `status` column exists to answer, without deserializing the\n *  whole result_json, whether this was a clean run or a degraded one. crawl\n *  is excluded — it's the one fatal stage (see pipeline.ts), so by the time a\n *  ProspectAuditResult exists it was always ok. Every other stage's\n *  StageResult already collapses \"failed\" and \"deliberately skipped\"\n *  (--no-probes, the checks→analyze cascade) into the same `ok: false` — both\n *  mean the report has a \"not measured\" section, so both count as partial\n *  here too. */\nfunction auditStatus(result: ProspectAuditResult): ProspectAuditStatus {\n  const allStagesOk =\n    result.checks.ok && result.lighthouse.ok && result.analyze.ok && result.probes.ok;\n  return allStagesOk ? \"complete\" : \"partial\";\n}\n\n/** Filesystem-safe, never empty. Collapses anything outside [a-z0-9.-] to a\n *  single dash so a hostname becomes a sane filename fragment. */\nfunction slugify(s: string): string {\n  const slug = s\n    .toLowerCase()\n    .replace(/[^a-z0-9.-]+/g, \"-\")\n    .replace(/^-+|-+$/g, \"\");\n  return slug || \"prospect\";\n}\n\n/**\n * Last-resort write when NEITHER `--out` nor the database persist made it —\n * the one situation a paid, already-run audit must never end in silently. Lands\n * in `reports/`, mirroring header-image.ts's own convention for CLI-written\n * artifacts (mkdir -p, resolved against cwd), rather than a bare file dropped\n * into whatever directory the operator happened to be standing in when they\n * ran the command — often unrelated to this repo at all in fleet-tool usage.\n */\nasync function writeRecoveryFiles(\n  result: ProspectAuditResult,\n  html: string,\n): Promise<RecoveryWrite> {\n  const dir = resolve(\"reports\");\n  await mkdir(dir, { recursive: true });\n  const stamp = new Date().toISOString().replace(/[:.]/g, \"-\");\n  const base = `prospect-audit-${slugify(hostnameOf(result.url))}-${stamp}`;\n  const htmlPath = resolve(dir, `${base}.html`);\n  const jsonPath = resolve(dir, `${base}.json`);\n  await writeFile(htmlPath, html, \"utf-8\");\n  await writeFile(jsonPath, JSON.stringify(result, null, 2), \"utf-8\");\n  return { htmlPath, jsonPath };\n}\n\nfunction summarize(\n  result: ProspectAuditResult,\n  link: string | null,\n  file: string | null,\n  warnings: string[],\n  recovery: RecoveryWrite | null,\n  email: SendAuditEmailResult | null,\n): string {\n  const lines = [\n    `Prospect audit — ${result.businessName ?? result.url}`,\n    \"\",\n    scoreLine(\"Findability\", result.scores.findability),\n    scoreLine(\"Readability\", result.scores.readability),\n    scoreLine(\"Answers\", result.scores.answers),\n    // No AI Visibility line: the score was removed from every presentation\n    // surface (web, print, email, here) — the measurement lives on as the\n    // report's receipts section, not as a number that reads as ours to move.\n  ];\n  for (const [name, stage] of [\n    [\"checks\", result.checks],\n    [\"lighthouse\", result.lighthouse],\n    [\"analyze\", result.analyze],\n    [\"probes\", result.probes],\n  ] as const) {\n    if (!stage.ok) lines.push(`  ! ${name} not measured — ${stage.error}`);\n  }\n  if (file) lines.push(\"\", `Report written to ${file}`);\n  if (link) lines.push(\"\", `Shareable link: ${link}`);\n  if (email?.sent) {\n    lines.push(\"\", `Emailed to ${email.recipients.join(\", \")} (${email.messageId})`);\n  }\n  for (const w of warnings) lines.push(\"\", `! ${w}`);\n  if (recovery) {\n    lines.push(\n      \"\",\n      \"Neither --out nor the database took this report — wrote a recovery copy instead:\",\n      `  ${recovery.htmlPath}`,\n      `  ${recovery.jsonPath}`,\n    );\n  }\n  return lines.join(\"\\n\");\n}\n\n/**\n * Run one prospect audit end to end. Progress goes to stderr so `--json` stdout\n * stays pipeable. Persistence needs Turso; without it `--out` is mandatory,\n * because an audit nobody can read afterwards is just a bill.\n *\n * By the time `runProspectAudit` resolves, the money is already spent — only\n * the crawl is fatal, every other stage degrades rather than throwing. So the\n * `--out` write and the database persist below are each wrapped in their own\n * try/catch and attempted independently: a bad `--out` path must not cost a\n * working Turso persist (or vice versa), and if BOTH fail — or persist fails\n * with no `--out` given at all — a recovery copy goes to `reports/` rather\n * than the run ending with nothing anywhere. `--json` only changes the SHAPE\n * of stdout; it still runs the same `--out`/persist/recovery logic beneath it.\n */\nexport async function runProspectAuditCommand(\n  url: string,\n  opts: ProspectAuditCliOptions,\n): Promise<{ output: string; code: number }> {\n  if (!isHttpUrl(url)) {\n    return fail(`\"${url}\" is not a URL. Pass the full address, e.g. https://example.com`);\n  }\n  // #612 review: this validated only the SHAPE. The sole private-address guard\n  // was in `triggerProspectAudit` — one layer at the far end of the chain — so\n  // anyone running the CLI directly, or any future second caller, had none.\n  // `crawlSite` now refuses too; this keeps the refusal a clean message instead\n  // of a thrown crawl error.\n  if (isPrivateOrLoopbackHost(new URL(url).hostname)) {\n    return fail(`\"${url}\" is a private or loopback address — refusing to audit it.`);\n  }\n  const canPersist = Boolean(process.env.TURSO_DATABASE_URL);\n  if (!canPersist && !opts.out) {\n    return fail(\n      \"No TURSO_DATABASE_URL, so the report cannot be saved or shared. Re-run with --out <file>, or set the Turso credentials.\",\n    );\n  }\n\n  const { runProspectAudit } = await import(\"../../prospect/pipeline.js\");\n  const onStage = (name: StageName, status: \"start\" | \"ok\" | \"fail\", detail?: string): void => {\n    if (status === \"start\") console.error(`… ${name}`);\n    else if (status === \"ok\") console.error(`✓ ${name}`);\n    else console.error(`! ${name} — ${detail ?? \"failed\"}`);\n  };\n\n  const business = opts.business?.trim();\n  const goal = opts.goal?.trim();\n  // #676. Comma-separated on a flag (a newline is not typeable in one); the\n  // cockpit's textareas split on newlines instead. Both drop blanks, and both\n  // treat \"nothing usable\" as \"generate\".\n  const splitList = (v: string | undefined): string[] =>\n    (v ?? \"\")\n      .split(\",\")\n      .map((x) => x.trim())\n      .filter((x) => x !== \"\");\n  const chosenTerms = splitList(opts.terms);\n  const chosenQuestions = splitList(opts.questions);\n  if (goal !== undefined && goal !== \"\" && !isSiteGoal(goal)) {\n    return fail(`--goal must be one of: ${GOALS.join(\", \")}`);\n  }\n\n  const result = await runProspectAudit(\n    url,\n    {\n      ...(business ? { business } : {}),\n      // An empty string is what a blank dispatch field sends; it must read as\n      // \"not supplied\" so the model's own inference still runs, rather than\n      // overriding it with nothing.\n      ...(goal ? { goal } : {}),\n      ...(opts.competitors\n        ? {\n            competitors: opts.competitors\n              .split(\",\")\n              .map((c) => c.trim())\n              .filter(Boolean),\n          }\n        : {}),\n      ...(opts.probes === false ? { probes: false } : {}),\n      ...(chosenTerms.length > 0 ? { terms: chosenTerms } : {}),\n      ...(chosenQuestions.length > 0 ? { questions: chosenQuestions } : {}),\n    },\n    { ...(opts.deps ?? {}), onStage },\n  );\n\n  const { renderProspectReport } = await import(\"../../prospect/render.js\");\n  const html = renderProspectReport(result);\n\n  const warnings: string[] = [];\n\n  let file: string | null = null;\n  if (opts.out) {\n    try {\n      await writeFile(opts.out, html, \"utf-8\");\n      file = opts.out;\n    } catch (err) {\n      warnings.push(`Could not write --out (${opts.out}): ${errorMessage(err)}`);\n    }\n  }\n\n  let link: string | null = null;\n  let token: string | null = null;\n  let auditId: string | null = null;\n  if (canPersist) {\n    try {\n      const { openDb, readDbConfig } = await import(\"../../db/client.js\");\n      const { createProspectAudit } = await import(\"../../db/prospect-audits.js\");\n      const db = await openDb(readDbConfig());\n      const created = await createProspectAudit(db, {\n        url: result.url,\n        // Map at the boundary: ProspectAuditResult.businessName is the field\n        // name (Item 2 — it's a resolved NAME, not a description); the\n        // `prospect_audits.business` column keeps its existing name, since\n        // renaming a column needs its own migration for no benefit here.\n        business: result.businessName,\n        status: auditStatus(result),\n        resultJson: JSON.stringify(result),\n        // #676: on the ROW, not only in result_json — a re-run reuses them and\n        // the /audits listing marks them without reading the blob.\n        chosenTerms: chosenTerms.length > 0 ? chosenTerms : null,\n        chosenQuestions: chosenQuestions.length > 0 ? chosenQuestions : null,\n      });\n      auditId = created.id;\n      token = created.token;\n      link = reportUrl(token);\n    } catch (err) {\n      warnings.push(`Could not save to the database: ${errorMessage(err)}`);\n    }\n  }\n\n  const delivered = file !== null || link !== null;\n  const recovery = delivered ? null : await writeRecoveryFiles(result, html);\n  const code = delivered ? 0 : 1;\n\n  // The audit is already delivered (or recovered) above — an email failure\n  // must never take that away. Same independent try/catch shape as the\n  // --out write and the Turso persist: record a warning, keep going, never\n  // touch `code`. Dynamically imported for the same reason db/client.js and\n  // prospect/render.js are above: it reaches `resend` (a devDependency) and\n  // must stay out of bin.js's static import graph (see bin.ts's\n  // central-dep-blocker comment).\n  // The PDF leave-behind, printed from the website's print route — a document\n  // designed for paper, not the interactive report with its evidence folded\n  // away behind disclosures.\n  //\n  // Best-effort by design. Every other stage in this pipeline degrades rather\n  // than throwing, and an attachment is not worth losing a delivered report\n  // over: if this fails the email still goes, with the link, and a warning says\n  // the PDF is missing. It also needs a token — with no persisted report there\n  // is no page to print.\n  let pdf: Buffer | null = null;\n  if (opts.email && token) {\n    try {\n      const { renderReportPdf } = await import(\"../../prospect/pdf.js\");\n      pdf = await renderReportPdf(reportPrintUrl(token));\n    } catch (err) {\n      warnings.push(`Could not attach the PDF: ${errorMessage(err)}`);\n    }\n  }\n\n  let email: SendAuditEmailResult | null = null;\n  if (opts.email) {\n    try {\n      const { sendAuditEmail, parseProspectAuditRecipients } =\n        await import(\"../../prospect/email.js\");\n      const recipients = parseProspectAuditRecipients(process.env.PROSPECT_AUDIT_RECIPIENTS);\n      email = await sendAuditEmail(result, { link, recipients, auditId, pdf });\n      if (!email.sent) {\n        warnings.push(`Could not email the audit sheet: ${email.reason}`);\n      }\n    } catch (err) {\n      warnings.push(`Could not email the audit sheet: ${errorMessage(err)}`);\n    }\n  }\n\n  if (opts.json) {\n    return {\n      output: JSON.stringify(\n        { result, out: file, link, token, recovery, warnings, email },\n        null,\n        2,\n      ),\n      code,\n    };\n  }\n\n  return { output: summarize(result, link, file, warnings, recovery, email), code };\n}\n","/** Where the prospect-facing report lives now: a real, branded route on the\n *  marketing site rather than generated HTML on the ops app's domain. */\nexport const DEFAULT_REPORT_BASE_URL = \"https://reddoorla.com\";\n\n/**\n * Resolve the public report origin.\n *\n * Deliberately its own variable rather than reusing `DASHBOARD_BASE_URL`. That\n * one addresses operators and points at the ops app; this one addresses a\n * prospect and points at reddoorla.com. They are different audiences on\n * different domains, and sharing a variable would mean one of them silently\n * moving the day the other is repointed.\n */\nexport function resolveReportBaseUrl(raw: string | undefined): string {\n  return (raw?.trim() || DEFAULT_REPORT_BASE_URL).replace(/\\/$/, \"\");\n}\n\n/** The link a prospect opens. */\nexport function reportUrl(token: string, raw = process.env.REPORT_BASE_URL): string {\n  return `${resolveReportBaseUrl(raw)}/audit/${token}`;\n}\n\n/** The print-designed variant, which the runner renders to a PDF. Same token,\n *  same guards — a separate document, not a stylesheet over the page. */\nexport function reportPrintUrl(token: string, raw = process.env.REPORT_BASE_URL): string {\n  return `${reportUrl(token, raw)}/print`;\n}\n"],"mappings":";;;;;;;AAAA,SAAS,OAAO,iBAAiB;AACjC,SAAS,eAAe;;;ACCjB,IAAM,0BAA0B;AAWhC,SAAS,qBAAqB,KAAiC;AACpE,UAAQ,KAAK,KAAK,KAAK,yBAAyB,QAAQ,OAAO,EAAE;AACnE;AAGO,SAAS,UAAU,OAAe,MAAM,QAAQ,IAAI,iBAAyB;AAClF,SAAO,GAAG,qBAAqB,GAAG,CAAC,UAAU,KAAK;AACpD;AAIO,SAAS,eAAe,OAAe,MAAM,QAAQ,IAAI,iBAAyB;AACvF,SAAO,GAAG,UAAU,OAAO,GAAG,CAAC;AACjC;;;ADbO,IAAM,QAAQ;AAAA,EACnB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,SAAS,WAAW,OAAkC;AACpD,SAAQ,MAA4B,SAAS,KAAK;AACpD;AA4CA,SAAS,KAAK,SAAmD;AAC/D,SAAO,EAAE,QAAQ,SAAS,MAAM,EAAE;AACpC;AAEA,SAAS,aAAa,KAAsB;AAC1C,SAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AACxD;AAEA,SAAS,UAAU,OAAe,OAA8B;AAC9D,SAAO,GAAG,MAAM,OAAO,EAAE,CAAC,IAAI,UAAU,OAAO,iBAAiB,OAAO,KAAK,EAAE,SAAS,CAAC,CAAC;AAC3F;AAUA,SAAS,YAAY,QAAkD;AACrE,QAAM,cACJ,OAAO,OAAO,MAAM,OAAO,WAAW,MAAM,OAAO,QAAQ,MAAM,OAAO,OAAO;AACjF,SAAO,cAAc,aAAa;AACpC;AAIA,SAAS,QAAQ,GAAmB;AAClC,QAAM,OAAO,EACV,YAAY,EACZ,QAAQ,iBAAiB,GAAG,EAC5B,QAAQ,YAAY,EAAE;AACzB,SAAO,QAAQ;AACjB;AAUA,eAAe,mBACb,QACA,MACwB;AACxB,QAAM,MAAM,QAAQ,SAAS;AAC7B,QAAM,MAAM,KAAK,EAAE,WAAW,KAAK,CAAC;AACpC,QAAM,SAAQ,oBAAI,KAAK,GAAE,YAAY,EAAE,QAAQ,SAAS,GAAG;AAC3D,QAAM,OAAO,kBAAkB,QAAQ,WAAW,OAAO,GAAG,CAAC,CAAC,IAAI,KAAK;AACvE,QAAM,WAAW,QAAQ,KAAK,GAAG,IAAI,OAAO;AAC5C,QAAM,WAAW,QAAQ,KAAK,GAAG,IAAI,OAAO;AAC5C,QAAM,UAAU,UAAU,MAAM,OAAO;AACvC,QAAM,UAAU,UAAU,KAAK,UAAU,QAAQ,MAAM,CAAC,GAAG,OAAO;AAClE,SAAO,EAAE,UAAU,SAAS;AAC9B;AAEA,SAAS,UACP,QACA,MACA,MACA,UACA,UACA,OACQ;AACR,QAAM,QAAQ;AAAA,IACZ,yBAAoB,OAAO,gBAAgB,OAAO,GAAG;AAAA,IACrD;AAAA,IACA,UAAU,eAAe,OAAO,OAAO,WAAW;AAAA,IAClD,UAAU,eAAe,OAAO,OAAO,WAAW;AAAA,IAClD,UAAU,WAAW,OAAO,OAAO,OAAO;AAAA;AAAA;AAAA;AAAA,EAI5C;AACA,aAAW,CAAC,MAAM,KAAK,KAAK;AAAA,IAC1B,CAAC,UAAU,OAAO,MAAM;AAAA,IACxB,CAAC,cAAc,OAAO,UAAU;AAAA,IAChC,CAAC,WAAW,OAAO,OAAO;AAAA,IAC1B,CAAC,UAAU,OAAO,MAAM;AAAA,EAC1B,GAAY;AACV,QAAI,CAAC,MAAM,GAAI,OAAM,KAAK,OAAO,IAAI,wBAAmB,MAAM,KAAK,EAAE;AAAA,EACvE;AACA,MAAI,KAAM,OAAM,KAAK,IAAI,qBAAqB,IAAI,EAAE;AACpD,MAAI,KAAM,OAAM,KAAK,IAAI,mBAAmB,IAAI,EAAE;AAClD,MAAI,OAAO,MAAM;AACf,UAAM,KAAK,IAAI,cAAc,MAAM,WAAW,KAAK,IAAI,CAAC,KAAK,MAAM,SAAS,GAAG;AAAA,EACjF;AACA,aAAW,KAAK,SAAU,OAAM,KAAK,IAAI,KAAK,CAAC,EAAE;AACjD,MAAI,UAAU;AACZ,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA,KAAK,SAAS,QAAQ;AAAA,MACtB,KAAK,SAAS,QAAQ;AAAA,IACxB;AAAA,EACF;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;AAgBA,eAAsB,wBACpB,KACA,MAC2C;AAC3C,MAAI,CAAC,UAAU,GAAG,GAAG;AACnB,WAAO,KAAK,IAAI,GAAG,iEAAiE;AAAA,EACtF;AAMA,MAAI,wBAAwB,IAAI,IAAI,GAAG,EAAE,QAAQ,GAAG;AAClD,WAAO,KAAK,IAAI,GAAG,iEAA4D;AAAA,EACjF;AACA,QAAM,aAAa,QAAQ,QAAQ,IAAI,kBAAkB;AACzD,MAAI,CAAC,cAAc,CAAC,KAAK,KAAK;AAC5B,WAAO;AAAA,MACL;AAAA,IACF;AAAA,EACF;AAEA,QAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,wBAA4B;AACtE,QAAM,UAAU,CAAC,MAAiB,QAAiC,WAA0B;AAC3F,QAAI,WAAW,QAAS,SAAQ,MAAM,UAAK,IAAI,EAAE;AAAA,aACxC,WAAW,KAAM,SAAQ,MAAM,UAAK,IAAI,EAAE;AAAA,QAC9C,SAAQ,MAAM,KAAK,IAAI,WAAM,UAAU,QAAQ,EAAE;AAAA,EACxD;AAEA,QAAM,WAAW,KAAK,UAAU,KAAK;AACrC,QAAM,OAAO,KAAK,MAAM,KAAK;AAI7B,QAAM,YAAY,CAAC,OAChB,KAAK,IACH,MAAM,GAAG,EACT,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,CAAC,MAAM,MAAM,EAAE;AAC3B,QAAM,cAAc,UAAU,KAAK,KAAK;AACxC,QAAM,kBAAkB,UAAU,KAAK,SAAS;AAChD,MAAI,SAAS,UAAa,SAAS,MAAM,CAAC,WAAW,IAAI,GAAG;AAC1D,WAAO,KAAK,0BAA0B,MAAM,KAAK,IAAI,CAAC,EAAE;AAAA,EAC1D;AAEA,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA;AAAA,MACE,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,MAI/B,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,MACvB,GAAI,KAAK,cACL;AAAA,QACE,aAAa,KAAK,YACf,MAAM,GAAG,EACT,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,OAAO;AAAA,MACnB,IACA,CAAC;AAAA,MACL,GAAI,KAAK,WAAW,QAAQ,EAAE,QAAQ,MAAM,IAAI,CAAC;AAAA,MACjD,GAAI,YAAY,SAAS,IAAI,EAAE,OAAO,YAAY,IAAI,CAAC;AAAA,MACvD,GAAI,gBAAgB,SAAS,IAAI,EAAE,WAAW,gBAAgB,IAAI,CAAC;AAAA,IACrE;AAAA,IACA,EAAE,GAAI,KAAK,QAAQ,CAAC,GAAI,QAAQ;AAAA,EAClC;AAEA,QAAM,EAAE,qBAAqB,IAAI,MAAM,OAAO,sBAA0B;AACxE,QAAM,OAAO,qBAAqB,MAAM;AAExC,QAAM,WAAqB,CAAC;AAE5B,MAAI,OAAsB;AAC1B,MAAI,KAAK,KAAK;AACZ,QAAI;AACF,YAAM,UAAU,KAAK,KAAK,MAAM,OAAO;AACvC,aAAO,KAAK;AAAA,IACd,SAAS,KAAK;AACZ,eAAS,KAAK,0BAA0B,KAAK,GAAG,MAAM,aAAa,GAAG,CAAC,EAAE;AAAA,IAC3E;AAAA,EACF;AAEA,MAAI,OAAsB;AAC1B,MAAI,QAAuB;AAC3B,MAAI,UAAyB;AAC7B,MAAI,YAAY;AACd,QAAI;AACF,YAAM,EAAE,QAAQ,aAAa,IAAI,MAAM,OAAO,sBAAoB;AAClE,YAAM,EAAE,oBAAoB,IAAI,MAAM,OAAO,+BAA6B;AAC1E,YAAM,KAAK,MAAM,OAAO,aAAa,CAAC;AACtC,YAAM,UAAU,MAAM,oBAAoB,IAAI;AAAA,QAC5C,KAAK,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA,QAKZ,UAAU,OAAO;AAAA,QACjB,QAAQ,YAAY,MAAM;AAAA,QAC1B,YAAY,KAAK,UAAU,MAAM;AAAA;AAAA;AAAA,QAGjC,aAAa,YAAY,SAAS,IAAI,cAAc;AAAA,QACpD,iBAAiB,gBAAgB,SAAS,IAAI,kBAAkB;AAAA,MAClE,CAAC;AACD,gBAAU,QAAQ;AAClB,cAAQ,QAAQ;AAChB,aAAO,UAAU,KAAK;AAAA,IACxB,SAAS,KAAK;AACZ,eAAS,KAAK,mCAAmC,aAAa,GAAG,CAAC,EAAE;AAAA,IACtE;AAAA,EACF;AAEA,QAAM,YAAY,SAAS,QAAQ,SAAS;AAC5C,QAAM,WAAW,YAAY,OAAO,MAAM,mBAAmB,QAAQ,IAAI;AACzE,QAAM,OAAO,YAAY,IAAI;AAkB7B,MAAI,MAAqB;AACzB,MAAI,KAAK,SAAS,OAAO;AACvB,QAAI;AACF,YAAM,EAAE,gBAAgB,IAAI,MAAM,OAAO,mBAAuB;AAChE,YAAM,MAAM,gBAAgB,eAAe,KAAK,CAAC;AAAA,IACnD,SAAS,KAAK;AACZ,eAAS,KAAK,6BAA6B,aAAa,GAAG,CAAC,EAAE;AAAA,IAChE;AAAA,EACF;AAEA,MAAI,QAAqC;AACzC,MAAI,KAAK,OAAO;AACd,QAAI;AACF,YAAM,EAAE,gBAAgB,6BAA6B,IACnD,MAAM,OAAO,qBAAyB;AACxC,YAAM,aAAa,6BAA6B,QAAQ,IAAI,yBAAyB;AACrF,cAAQ,MAAM,eAAe,QAAQ,EAAE,MAAM,YAAY,SAAS,IAAI,CAAC;AACvE,UAAI,CAAC,MAAM,MAAM;AACf,iBAAS,KAAK,oCAAoC,MAAM,MAAM,EAAE;AAAA,MAClE;AAAA,IACF,SAAS,KAAK;AACZ,eAAS,KAAK,oCAAoC,aAAa,GAAG,CAAC,EAAE;AAAA,IACvE;AAAA,EACF;AAEA,MAAI,KAAK,MAAM;AACb,WAAO;AAAA,MACL,QAAQ,KAAK;AAAA,QACX,EAAE,QAAQ,KAAK,MAAM,MAAM,OAAO,UAAU,UAAU,MAAM;AAAA,QAC5D;AAAA,QACA;AAAA,MACF;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,QAAQ,UAAU,QAAQ,MAAM,MAAM,UAAU,UAAU,KAAK,GAAG,KAAK;AAClF;","names":[]}

package/dist/{prospect-audits-R3LWF6U7.js → prospect-audits-IZVQY3OQ.js}

@@ -1,5 +1,6 @@
 import {
   MAX_RECENT_PROSPECT_AUDITS,
+  OPENED_AT_COALESCE_MS,
   OVERRIDES_MAX_LEN,
   createProspectAudit,
   generateToken,
@@ -10,9 +11,10 @@ import {
   setProspectAuditOverrides,
   siteKey,
   touchProspectAuditOpened
-} from "./chunk-XPJQXSC4.js";
+} from "./chunk-P7323YVW.js";
 export {
   MAX_RECENT_PROSPECT_AUDITS,
+  OPENED_AT_COALESCE_MS,
   OVERRIDES_MAX_LEN,
   createProspectAudit,
   generateToken,
@@ -24,4 +26,4 @@ export {
   siteKey,
   touchProspectAuditOpened
 };
-//# sourceMappingURL=prospect-audits-R3LWF6U7.js.map
+//# sourceMappingURL=prospect-audits-IZVQY3OQ.js.map

package/dist/protection-audit-3J3UEOVT.js

@@ -0,0 +1,413 @@
+import {
+  rulesetGaps
+} from "./chunk-MNDIED4M.js";
+import {
+  makeGitHub
+} from "./chunk-43SW3FGW.js";
+import "./chunk-LBYOLBW7.js";
+
+// src/audits/protection-coverage.ts
+var RENOVATE_WORKFLOW_FILE = "renovate.yml";
+var RENOVATE_STALE_AFTER_DAYS = 3;
+var ACCEPTED_GAPS = [];
+function partitionAcceptedGaps(repo, gaps, now, accepted = ACCEPTED_GAPS) {
+  const live = [];
+  const acceptedOut = [];
+  for (const gap of gaps) {
+    const match = accepted.find(
+      (a) => a.repo === repo && gap.startsWith(a.detailPrefix) && now < new Date(a.until)
+    );
+    if (match) acceptedOut.push(`${gap} [accepted until ${match.until}: ${match.reason}]`);
+    else live.push(gap);
+  }
+  return { live, accepted: acceptedOut };
+}
+function secretScanningGaps(repo, state, openAlerts) {
+  const gaps = [];
+  if (state.secretScanning !== "enabled")
+    gaps.push(`secret scanning ${state.secretScanning} (fleet floor is enabled)`);
+  if (state.pushProtection !== "enabled")
+    gaps.push(`push protection ${state.pushProtection} (fleet floor is enabled)`);
+  if (state.secretScanning === "enabled") {
+    if (openAlerts === "unavailable")
+      gaps.push(
+        `open secret-scanning alerts unreadable on ${repo} (token lacks security_events/admin read \u2014 unverified, not clean)`
+      );
+    else if (openAlerts > 0)
+      gaps.push(
+        `${openAlerts} open secret-scanning alert${openAlerts === 1 ? "" : "s"} on ${repo} \u2014 a leaked credential nobody has triaged. Fix: rotate or restrict the secret, then close the alert with a resolution at https://github.com/${repo}/security/secret-scanning (redacting the value at HEAD does NOT close it \u2014 the history is still public).`
+      );
+  }
+  return gaps;
+}
+function renovateGaps(health, now) {
+  if (!health.present) return ["no renovate workflow (dependency updates never run here)"];
+  if (health.state !== "active")
+    return [
+      // A disabled workflow REJECTS workflow_dispatch (HTTP 403) — it must be
+      // re-enabled first; "just dispatch it" is a dead-end runbook line here.
+      `renovate workflow is ${health.state} (re-enable it: \`gh workflow enable renovate.yml -R <repo>\`, then dispatch once)`
+    ];
+  if (health.lastSuccessAt === null)
+    return [
+      "renovate workflow has never succeeded (dispatch it once; if this gap returns, the schedule never registered \u2014 push a commit touching the workflow file)"
+    ];
+  const succeededAt = Date.parse(health.lastSuccessAt);
+  if (Number.isNaN(succeededAt))
+    return [`renovate last-success timestamp unreadable: ${health.lastSuccessAt}`];
+  const days = (now.getTime() - succeededAt) / 864e5;
+  if (days > RENOVATE_STALE_AFTER_DAYS)
+    return [`renovate last succeeded ${Math.floor(days)}d ago (cron is twice daily)`];
+  return [];
+}
+function renovateBlockedGaps(blocked) {
+  const orphaned = blocked.filter((b) => b.orphaned);
+  if (orphaned.length === 0) return [];
+  return [
+    `renovate is BLOCKED on ${orphaned.length} branch(es) \u2014 ${orphaned.map((b) => b.branch).join(", ")} \u2014 it runs and succeeds but refuses to update them, so every dependency grouped there is frozen. Usual cause: the branch tip was authored by a retired bot identity, which reads to Renovate as a human edit. Fix: confirm the tip author is a bot, then delete the branch and let Renovate recreate it (\`gh api -X DELETE repos/<repo>/git/refs/heads/<branch>\`).`
+  ];
+}
+function dashboardVocabularyGaps(dash) {
+  if (!dash.present || dash.unknownSections.length === 0) return [];
+  return [
+    `renovate dashboard has ${dash.unknownSections.length} section(s) this audit does not recognise \u2014 ${dash.unknownSections.join(", ")}. Nothing is necessarily wrong with the repo, but the blocked-branch check reads Renovate's own headings, so drift there means it can no longer be trusted. Fix: reconcile KNOWN_DASHBOARD_SECTIONS in src/github/gh.ts against Renovate's dependency-dashboard.ts.`
+  ];
+}
+function isFeatureUpdateBranch(headRef) {
+  if (!headRef.startsWith("renovate/")) return false;
+  if (headRef === "renovate/lock-file-maintenance") return false;
+  return !/^renovate\/npm-.+-vulnerability$/.test(headRef);
+}
+var RENOVATE_DROUGHT_WARN_DAYS = 21;
+function renovateOutcome(window, now) {
+  const last = window.merges.filter((m) => isFeatureUpdateBranch(m.headRef))[0];
+  if (!last) {
+    return {
+      state: "unmeasured",
+      reason: window.truncated ? "no feature-update Renovate merge inside the scanned window, and the window is FULL (older history not read \u2014 this repo merges too many PRs to see back that far)" : "this repo has never merged a feature-update Renovate PR (no baseline to measure from)"
+    };
+  }
+  const days = Math.floor((now.getTime() - new Date(last.mergedAt).getTime()) / 864e5);
+  return {
+    state: days > RENOVATE_DROUGHT_WARN_DAYS ? "drought" : "delivering",
+    days,
+    lastBranch: last.headRef,
+    lastMergedAt: last.mergedAt
+  };
+}
+function renovateOutcomeLine(outcome) {
+  if (outcome.state === "delivering") return null;
+  if (outcome.state === "unmeasured") return `renovate outcome UNMEASURED \u2014 ${outcome.reason}`;
+  return `no feature update has LANDED in ${outcome.days}d (warns past ${RENOVATE_DROUGHT_WARN_DAYS}d; last was ${outcome.lastBranch} merged ${outcome.lastMergedAt.slice(0, 10)}). Security + lockfile Renovate PRs are excluded, so this is feature-version drift, not a security signal.`;
+}
+function renovateOutcomeSummary(outcomes) {
+  const n = (state) => outcomes.filter((o) => o.state === state).length;
+  return `RENOVATE_OUTCOME drought=${n("drought")} delivering=${n("delivering")} unmeasured=${n("unmeasured")} threshold=${RENOVATE_DROUGHT_WARN_DAYS}d`;
+}
+var BLOCKED_STALE_DAYS = 5;
+async function resolveBlockedBranches(repo, dash, deps, now) {
+  if (!dash.present) return [];
+  const states = [];
+  for (const branch of dash.blockedBranches) {
+    const tip = await deps.branchTip(repo, branch);
+    if (!tip) continue;
+    const ageDays = (now.getTime() - new Date(tip.committedAt).getTime()) / 864e5;
+    states.push({ branch, orphaned: tip.authorIsMachine || ageDays > BLOCKED_STALE_DAYS });
+  }
+  return states;
+}
+async function collectProtectionCoverage(org, deps, now = /* @__PURE__ */ new Date(), accepted = ACCEPTED_GAPS) {
+  const rows = [];
+  for (const r of await deps.listOrgRepos(org)) {
+    const repo = `${org}/${r.name}`;
+    if (r.archived || r.visibility !== "public") {
+      rows.push({
+        repo,
+        status: "skipped",
+        detail: r.archived ? "archived" : `${r.visibility} (rulesets need a paid plan)`
+      });
+      continue;
+    }
+    try {
+      const gaps = [];
+      let coveredDetail = "";
+      const rulesets = await deps.listRepoRulesets(repo);
+      if (rulesets.length === 0) {
+        gaps.push("no repo rulesets at all");
+      } else {
+        const judged = await Promise.all(
+          rulesets.map(async (rs) => {
+            const full = await deps.getRuleset(repo, rs.id);
+            return { name: rs.name, full, gaps: rulesetGaps(full, null) };
+          })
+        );
+        const covering = judged.find((j) => j.gaps.length === 0);
+        if (covering) {
+          const ciGated = (covering.full.rules ?? []).some(
+            (rule) => rule.type === "required_status_checks"
+          );
+          coveredDetail = `"${covering.name}"${ciGated ? "" : " \u2014 NO CI gate (refs rules only)"}`;
+        } else {
+          gaps.push(judged.map((j) => `"${j.name}": ${j.gaps.join("; ")}`).join(" | "));
+        }
+      }
+      const openAlerts = r.secretScanning === "enabled" ? await deps.openSecretAlerts(repo) : "unavailable";
+      gaps.push(...secretScanningGaps(repo, r, openAlerts));
+      gaps.push(...renovateGaps(await deps.workflowHealth(repo, RENOVATE_WORKFLOW_FILE), now));
+      const dash = await deps.dependencyDashboard(repo);
+      gaps.push(...dashboardVocabularyGaps(dash));
+      gaps.push(...renovateBlockedGaps(await resolveBlockedBranches(repo, dash, deps, now)));
+      const outcome = renovateOutcome(await deps.renovateMergeWindow(repo), now);
+      const { live, accepted: acked } = partitionAcceptedGaps(repo, gaps, now, accepted);
+      if (live.length > 0) {
+        rows.push({
+          repo,
+          status: "gap",
+          detail: [...live, ...acked].join(" | "),
+          renovateOutcome: outcome
+        });
+      } else if (acked.length > 0) {
+        rows.push({
+          repo,
+          status: "skipped",
+          detail: acked.join(" | "),
+          renovateOutcome: outcome
+        });
+      } else {
+        rows.push({
+          repo,
+          status: "covered",
+          detail: coveredDetail,
+          renovateOutcome: outcome
+        });
+      }
+    } catch (e) {
+      rows.push({
+        repo,
+        status: "gap",
+        detail: `probe failed: ${e instanceof Error ? e.message : String(e)}`
+      });
+    }
+  }
+  return rows;
+}
+
+// src/github/package-manager-pin.ts
+var PACKAGE_MANAGER_ACCEPTED_GAPS = [];
+function parsePackageManagerField(packageJson) {
+  let parsed;
+  try {
+    parsed = JSON.parse(packageJson);
+  } catch (e) {
+    return {
+      state: "unreadable",
+      reason: `package.json is not valid JSON (${e instanceof Error ? e.message : String(e)})`
+    };
+  }
+  if (typeof parsed !== "object" || parsed === null) {
+    return { state: "unreadable", reason: "package.json is not a JSON object" };
+  }
+  const value = parsed.packageManager;
+  if (value === void 0) return { state: "absent" };
+  if (typeof value !== "string") {
+    return { state: "unreadable", reason: `packageManager is ${typeof value}, not a string` };
+  }
+  return { state: "present", value };
+}
+function parsePnpmActionSetupPins(workflow) {
+  const lines = workflow.split("\n");
+  const pins = [];
+  const indentOf = (line) => line.length - line.trimStart().length;
+  const isBlank = (line) => line.trim().length === 0 || /^\s*#/.test(line);
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    const uses = /^(\s*)(-\s+)?uses:\s*['"]?pnpm\/action-setup(?=[@'"\s]|$)/.exec(line);
+    if (!uses) continue;
+    const contentIndent = uses[1].length + (uses[2] ? uses[2].length : 0);
+    for (let j = i + 1; j < lines.length; j++) {
+      const body = lines[j];
+      if (isBlank(body)) continue;
+      const indent = indentOf(body);
+      if (indent < contentIndent) break;
+      if (indent === contentIndent && /^\s*-\s/.test(body)) break;
+      if (indent !== contentIndent || !/^\s*with:\s*$/.test(body)) continue;
+      for (let k = j + 1; k < lines.length; k++) {
+        const input = lines[k];
+        if (isBlank(input)) continue;
+        if (indentOf(input) <= contentIndent) break;
+        const m = /^\s*version:\s*['"]?([^'"#\s]+)/.exec(input);
+        if (m) pins.push(m[1]);
+      }
+      break;
+    }
+  }
+  return pins;
+}
+function fleetPin(pins) {
+  if (pins.length === 0) return { state: "none" };
+  const tally = /* @__PURE__ */ new Map();
+  for (const p of pins) tally.set(p, (tally.get(p) ?? 0) + 1);
+  const counts = [...tally.entries()].map(([pin, count]) => ({ pin, count })).sort((a, b) => b.count - a.count || a.pin.localeCompare(b.pin));
+  const top = counts[0];
+  if (top.count * 2 > pins.length) {
+    return { state: "majority", pin: top.pin, count: top.count, total: pins.length };
+  }
+  return { state: "split", counts, total: pins.length };
+}
+function packageManagerGaps(facts, fleet) {
+  if (facts.packageJson === null) return [];
+  const field = parsePackageManagerField(facts.packageJson);
+  const gaps = [];
+  const pinnedWorkflows = facts.workflowPins.map((w) => `${w.file} (version: ${w.version})`).join(", ");
+  if (field.state === "unreadable") {
+    gaps.push(`packageManager unreadable \u2014 ${field.reason} (unverified, not clean)`);
+    return gaps;
+  }
+  if (field.state === "absent") {
+    const fleetSays = fleet.state === "majority" ? ` (the fleet pin is ${fleet.pin})` : " (fleet pin unsettled)";
+    gaps.push(
+      facts.workflowPins.length > 0 ? `no packageManager field in package.json${fleetSays}, and ${pinnedWorkflows} pins pnpm in a pnpm/action-setup step instead. Fix: add the field AND delete the workflow's version input in the SAME change \u2014 adding the field alone makes action-setup hard-error on the mismatch.` : `no packageManager field in package.json${fleetSays} \u2014 CI installs whatever pnpm the runner defaults to, so the version resolving this lockfile is GitHub's choice, not the repo's. Fix: add "packageManager" to package.json.`
+    );
+    return gaps;
+  }
+  if (fleet.state === "majority" && field.value !== fleet.pin) {
+    gaps.push(
+      `packageManager is ${field.value} but the fleet pin is ${fleet.pin} (${fleet.count}/${fleet.total} repos agree). Fix: bump the field, or say why this repo is deliberately apart.`
+    );
+  }
+  if (facts.workflowPins.length > 0) {
+    const agree = facts.workflowPins.every((w) => `pnpm@${w.version}` === field.value);
+    gaps.push(
+      `${pinnedWorkflows} pins a pnpm version input while package.json pins ${field.value}` + (agree ? " \u2014 they agree today, but nothing keeps them in step" : " \u2014 THEY DISAGREE") + `. pnpm/action-setup does not prefer either side, it hard-errors on a mismatch. Fix: delete the workflow's version input; packageManager is the single source of truth.`
+    );
+  }
+  return gaps;
+}
+async function collectPackageManagerPins(org, deps, now = /* @__PURE__ */ new Date(), accepted = PACKAGE_MANAGER_ACCEPTED_GAPS) {
+  const rows = [];
+  const facts = /* @__PURE__ */ new Map();
+  for (const r of await deps.listOrgRepos(org)) {
+    const repo = `${org}/${r.name}`;
+    if (r.archived || r.visibility !== "public") {
+      rows.push({
+        repo,
+        scope: "skipped",
+        gaps: [],
+        accepted: [],
+        detail: r.archived ? "archived" : `${r.visibility}`
+      });
+      continue;
+    }
+    try {
+      const packageJson = await deps.repoTextFile(repo, "package.json");
+      if (packageJson === null) {
+        rows.push({
+          repo,
+          scope: "out-of-scope",
+          gaps: [],
+          accepted: [],
+          detail: "no package.json"
+        });
+        continue;
+      }
+      const workflowPins = [];
+      for (const path of await deps.listWorkflowPaths(repo)) {
+        const contents = await deps.repoTextFile(repo, path);
+        if (contents === null) continue;
+        for (const version of parsePnpmActionSetupPins(contents)) {
+          workflowPins.push({ file: path.replace(/^\.github\/workflows\//, ""), version });
+        }
+      }
+      facts.set(repo, { packageJson, workflowPins });
+      rows.push({ repo, scope: "judged", gaps: [], accepted: [], detail: "" });
+    } catch (e) {
+      rows.push({
+        repo,
+        scope: "judged",
+        gaps: [`pnpm pin probe failed: ${e instanceof Error ? e.message : String(e)}`],
+        accepted: [],
+        detail: "probe failed"
+      });
+    }
+  }
+  const pinned = [];
+  for (const f of facts.values()) {
+    const field = parsePackageManagerField(f.packageJson);
+    if (field.state === "present") pinned.push(field.value);
+  }
+  const fleet = fleetPin(pinned);
+  return rows.map((row) => {
+    const f = facts.get(row.repo);
+    if (!f) return row;
+    const all = packageManagerGaps(f, fleet);
+    const split = partitionAcceptedGaps(row.repo, all, now, accepted);
+    const field = parsePackageManagerField(f.packageJson);
+    return {
+      ...row,
+      gaps: split.live,
+      accepted: split.accepted,
+      detail: field.state === "present" ? field.value : row.detail
+    };
+  });
+}
+function packageManagerPinSummary(rows) {
+  const judged = rows.filter((r) => r.scope === "judged");
+  const pins = judged.map((r) => r.detail).filter((d) => d.startsWith("pnpm@"));
+  const fleet = fleetPin(pins);
+  const pin = fleet.state === "majority" ? fleet.pin : fleet.state === "split" ? `SPLIT(${fleet.counts.map((c) => `${c.pin}x${c.count}`).join(",")})` : "none";
+  return `PACKAGE_MANAGER_PIN gaps=${judged.filter((r) => r.gaps.length > 0).length} pinned=${pins.length} judged=${judged.length} out-of-scope=${rows.filter((r) => r.scope === "out-of-scope").length} skipped=${rows.filter((r) => r.scope === "skipped").length} fleetPin=${pin}`;
+}
+
+// src/cli/commands/protection-audit.ts
+function protectionAuditExitCode(gaps) {
+  return gaps > 0 ? 1 : 0;
+}
+async function runProtectionAuditCommand(opts, depsOverride) {
+  const org = opts.org?.trim();
+  if (!org) {
+    return { output: "protection-audit requires --org <org>", code: 2 };
+  }
+  const token = process.env.RENOVATE_TOKEN?.trim() || process.env.GH_TOKEN?.trim();
+  if (!depsOverride && !token) {
+    return {
+      output: "protection-audit skipped: no RENOVATE_TOKEN/GH_TOKEN (fleet read) configured.",
+      code: 0
+    };
+  }
+  const deps = depsOverride ?? makeGitHub({ token });
+  const coverage = await collectProtectionCoverage(org, deps);
+  const pinRows = await collectPackageManagerPins(org, deps);
+  const pinByRepo = new Map(pinRows.map((p) => [p.repo, p]));
+  const rows = coverage.map((row) => {
+    const pin = pinByRepo.get(row.repo);
+    if (!pin || pin.gaps.length === 0) return row;
+    return {
+      ...row,
+      status: "gap",
+      detail: [row.detail, ...pin.gaps].filter((d) => d.length > 0).join(" | ")
+    };
+  });
+  const gaps = rows.filter((r) => r.status === "gap");
+  const covered = rows.filter((r) => r.status === "covered");
+  const skipped = rows.filter((r) => r.status === "skipped");
+  const lines = rows.map((r) => `${r.status.toUpperCase().padEnd(7)} ${r.repo} \u2014 ${r.detail}`);
+  const measured = rows.map((r) => r.renovateOutcome).filter((o) => o !== void 0);
+  for (const r of rows) {
+    const line = r.renovateOutcome && renovateOutcomeLine(r.renovateOutcome);
+    if (line) lines.push(`WARN    ${r.repo} \u2014 ${line}`);
+  }
+  for (const p of pinRows) {
+    for (const note of p.accepted) lines.push(`WARN    ${p.repo} \u2014 ${note}`);
+  }
+  lines.push(renovateOutcomeSummary(measured));
+  lines.push(packageManagerPinSummary(pinRows));
+  lines.push(
+    `PROTECTION_AUDIT gaps=${gaps.length} covered=${covered.length} skipped=${skipped.length} total=${rows.length}`
+  );
+  return { output: lines.join("\n"), code: protectionAuditExitCode(gaps.length) };
+}
+export {
+  protectionAuditExitCode,
+  runProtectionAuditCommand
+};
+//# sourceMappingURL=protection-audit-3J3UEOVT.js.map