@reddoorla/maintenance 0.95.1 → 0.97.0

package/dist/{chunk-TO7DJYLZ.js → chunk-L3S3QZXL.js}

@@ -3,14 +3,14 @@ import {
 } from "./chunk-LKGVSM2O.js";
 import {
   readGitHubConfig
-} from "./chunk-GASBX52O.js";
+} from "./chunk-MVKNU4QD.js";
 import {
   assertUrlSegment
-} from "./chunk-XHHMM5HX.js";
+} from "./chunk-43SW3FGW.js";
 import {
   lighthouseAudit,
   readSiteConfig
-} from "./chunk-2NQUCS7O.js";
+} from "./chunk-BIYQN7FH.js";
 import {
   smokeAudit
 } from "./chunk-UDRHAQT7.js";
@@ -29,7 +29,7 @@ import {
 import {
   a11yRoutes,
   smokeRoutes
-} from "./chunk-YLYXW5PH.js";
+} from "./chunk-CXICCLNM.js";
 
 // src/audits/deps.ts
 import { readFile } from "fs/promises";
@@ -247,6 +247,7 @@ function mapDependabotAlert(raw) {
   const cveId = typeof adv["cve_id"] === "string" ? adv["cve_id"] : null;
   const rawScope = dependency["scope"];
   const rawRelationship = dependency["relationship"];
+  const rawManifest = dependency["manifest_path"];
   return {
     package: packageName,
     severity: typeof adv["severity"] === "string" ? adv["severity"] : "",
@@ -254,7 +255,8 @@ function mapDependabotAlert(raw) {
     cves: cveId ? [cveId] : [],
     url: typeof raw["html_url"] === "string" ? raw["html_url"] : null,
     scope: rawScope === "runtime" || rawScope === "development" ? rawScope : null,
-    relationship: rawRelationship === "direct" || rawRelationship === "transitive" ? rawRelationship : null
+    relationship: rawRelationship === "direct" || rawRelationship === "transitive" || rawRelationship === "inconclusive" ? rawRelationship : null,
+    manifestPath: typeof rawManifest === "string" && rawManifest ? rawManifest : null
   };
 }
 function makeGitHubRest(deps) {
@@ -397,6 +399,23 @@ function makeGitHubRest(deps) {
         url = nextLink(res.headers.get("link"));
       }
       return out;
+    },
+    async manifestExists(repo, path) {
+      const { owner, name } = splitRepo(repo);
+      assertUrlSegment("path", owner);
+      assertUrlSegment("path", name);
+      const encoded = path.split("/").map(encodeURIComponent).join("/");
+      const res = await doFetch(`${GITHUB_API}/repos/${owner}/${name}/contents/${encoded}`, {
+        headers: baseHeaders,
+        signal: AbortSignal.timeout(DEPENDABOT_FETCH_TIMEOUT_MS)
+      });
+      if (res.status === 404) return false;
+      if (!res.ok) {
+        throw new Error(
+          `GitHub GET contents/${path} ${owner}/${name} failed (${res.status}): ${await bodyText(res)}`
+        );
+      }
+      return true;
     }
   };
 }
@@ -497,7 +516,25 @@ function defaultDependabotDeps() {
   const cfg = readGitHubConfig();
   if (!cfg) return null;
   const gh = makeGitHubRest({ token: cfg.token });
-  return { listAlerts: (repo) => gh.listDependabotAlerts(repo, { state: "open" }) };
+  return {
+    listAlerts: (repo) => gh.listDependabotAlerts(repo, { state: "open" }),
+    manifestExists: (repo, path) => gh.manifestExists(repo, path)
+  };
+}
+async function absentManifests(deps, repo, alerts, label) {
+  const absent = /* @__PURE__ */ new Set();
+  if (!deps.manifestExists) return absent;
+  const paths = new Set(alerts.flatMap((a) => a.manifestPath ? [a.manifestPath] : []));
+  for (const path of paths) {
+    try {
+      if (!await deps.manifestExists(repo, path)) absent.add(path);
+    } catch (e) {
+      console.error(
+        `[security] ${label}: could not resolve manifest ${path} \u2014 counting its alerts: ${e instanceof Error ? e.message : String(e)}`
+      );
+    }
+  }
+  return absent;
 }
 function ghSeverityToApp(s) {
   if (s === "critical" || s === "high" || s === "low") return s;
@@ -514,12 +551,13 @@ async function dependabotAudit(deps, repo, label) {
     );
     return null;
   }
+  const absent = await absentManifests(deps, repo, alerts, label);
   const counts = { low: 0, moderate: 0, high: 0, critical: 0 };
   const advisories = [];
+  const ghostAdvisories = [];
   for (const a of alerts) {
     const severity = ghSeverityToApp(a.severity);
-    counts[severity] += 1;
-    advisories.push({
+    const entry = {
       module: a.package,
       severity,
       title: a.summary || "(no title)",
@@ -527,12 +565,36 @@ async function dependabotAudit(deps, repo, label) {
       ...a.url ? { url: a.url } : {},
       ...a.scope ? { scope: a.scope } : {},
       ...a.relationship ? { relationship: a.relationship } : {}
-    });
+    };
+    if (a.manifestPath && absent.has(a.manifestPath)) {
+      ghostAdvisories.push({ ...entry, manifestPath: a.manifestPath });
+      continue;
+    }
+    counts[severity] += 1;
+    advisories.push(entry);
   }
-  const status = classify(counts);
+  const liveStatus = classify(counts);
   const total = counts.low + counts.moderate + counts.high + counts.critical;
-  const summary = status === "pass" ? "Dependabot: 0 alerts" : `Dependabot: ${total} alert(s) (${counts.critical}C/${counts.high}H/${counts.moderate}M/${counts.low}L)`;
-  return { audit: "security", site: label, status, summary, details: { counts, advisories } };
+  const liveSummary = liveStatus === "pass" ? ghostAdvisories.length > 0 ? "Dependabot: 0 live alert(s)" : "Dependabot: 0 alerts" : `Dependabot: ${total} alert(s) (${counts.critical}C/${counts.high}H/${counts.moderate}M/${counts.low}L)`;
+  if (ghostAdvisories.length === 0) {
+    return {
+      audit: "security",
+      site: label,
+      status: liveStatus,
+      summary: liveSummary,
+      details: { counts, advisories }
+    };
+  }
+  const status = liveStatus === "pass" ? "warn" : liveStatus;
+  const manifests = [...new Set(ghostAdvisories.map((g) => g.manifestPath))].join(", ");
+  const summary = `${liveSummary}; ${ghostAdvisories.length} alert(s) on a manifest GitHub no longer tracks (${manifests}) \u2014 dismiss as inaccurate`;
+  return {
+    audit: "security",
+    site: label,
+    status,
+    summary,
+    details: { counts, advisories, ghostAdvisories }
+  };
 }
 async function securityAudit(ctx) {
   const spawn = ctx.spawn ?? defaultSpawn;
@@ -600,7 +662,36 @@ async function readJsonMaybe(path) {
     return null;
   }
 }
-function buildPlaywrightConfig(port, sitePath) {
+var DEV_SERVER_TIMEOUT_MS = 12e4;
+var PREVIEW_SERVER_TIMEOUT_MS = 5 * 6e4;
+var PLAYWRIGHT_TIMEOUT_MS = 5 * 6e4;
+var PLAYWRIGHT_PREVIEW_TIMEOUT_MS = 10 * 6e4;
+function webServerBlock(opts) {
+  return `{
+      command: ${JSON.stringify(opts.command)},
+      url: ${JSON.stringify(opts.url)},
+      cwd: ${JSON.stringify(opts.sitePath)},
+      reuseExistingServer: false,
+      timeout: ${opts.timeoutMs},
+    }`;
+}
+function buildPlaywrightConfig(port, sitePath, previewPort) {
+  const dev = webServerBlock({
+    command: `npm run vite:dev -- --port ${port} --strictPort`,
+    url: `http://localhost:${port}/dev/a11y-fixtures`,
+    sitePath,
+    timeoutMs: DEV_SERVER_TIMEOUT_MS
+  });
+  const preview = previewPort === void 0 ? void 0 : webServerBlock({
+    command: `npm run build && npm run preview -- --port ${previewPort} --strictPort`,
+    url: `http://localhost:${previewPort}/`,
+    sitePath,
+    timeoutMs: PREVIEW_SERVER_TIMEOUT_MS
+  });
+  const webServer = preview === void 0 ? dev : `[
+    ${dev},
+    ${preview},
+  ]`;
   return `import { defineConfig } from "@playwright/test";
 
 export default defineConfig({
@@ -614,24 +705,18 @@ export default defineConfig({
     baseURL: "http://localhost:${port}",
     trace: "on-first-retry",
   },
-  webServer: {
-    // --strictPort: refuse to bump to a different port if ours is taken,
-    //   so the audit fails loudly instead of probing a zombie.
-    // reuseExistingServer:false: never reuse \u2014 we control the lifecycle.
-    // cwd: playwright's default webServer.cwd is the config file's
-    //   directory. Our config lives in /tmp so without this override,
-    //   "npm run vite:dev" tries to read /tmp/.../package.json and
-    //   ENOENTs before vite ever starts. Caltex 2026-05-28 (0.10.5).
-    command: "npm run vite:dev -- --port ${port} --strictPort",
-    url: "http://localhost:${port}/dev/a11y-fixtures",
-    cwd: ${JSON.stringify(sitePath)},
-    reuseExistingServer: false,
-    timeout: 120_000,
-  },
+  webServer: ${webServer},
 });
 `;
 }
-function buildSpec(axePages) {
+async function allocateDistinctPort(taken) {
+  for (let attempt = 0; attempt < 5; attempt += 1) {
+    const candidate = await findFreePort();
+    if (candidate !== taken) return candidate;
+  }
+  throw new Error(`a11y: could not allocate a second free port distinct from ${taken}`);
+}
+function buildSpec(axePages, smokeOrigin = "") {
   return `import { test, expect } from "@playwright/test";
 import AxeBuilder from "@axe-core/playwright";
 import { mkdir, writeFile } from "node:fs/promises";
@@ -639,6 +724,13 @@ import { dirname } from "node:path";
 
 const pages = ${JSON.stringify(axePages)};
 const smokePages = ${JSON.stringify(smokeRoutes)};
+// Absolute origin for the hydration smoke when the site has opted its gates
+// onto a production build (#700). The axe loop runs against the dev server via
+// baseURL; these routes run against the built bundle on a second port, and the
+// origin has to be explicit or they would silently fall back to baseURL \u2014 i.e.
+// to dev \u2014 and measure exactly what this exists to stop measuring. Empty string
+// = one server for both, the default.
+const SMOKE_ORIGIN = ${JSON.stringify(smokeOrigin)};
 const OUTPUT = process.env.REDDOOR_A11Y_OUTPUT;
 
 // Playwright's default per-test timeout is 30s. We loop through every
@@ -664,7 +756,23 @@ test("a11y + hydration across configured routes", async ({ page }) => {
 
   for (const { path, name } of pages) {
     currentRoute = name;
-    await page.goto(path);
+    const response = await page.goto(path);
+    // A route that does not exist is a config problem, not a markup one. The
+    // audit used to navigate, get a 404, run axe over whatever the error page
+    // was and report the count -- for months that page was a bare fallback with
+    // nothing to flag, so a missing fixture read as green. When reddoor-website
+    // gave its 404 page a designed watermark the count went to 1 with no route
+    // and no rule in the summary, and the "violation" was bisected as markup
+    // (#680). Name it as a missing route and do not scan the error page.
+    if (!response || response.status() !== 200) {
+      violations.push({
+        id: "route-missing",
+        impact: "serious",
+        route: name,
+        help: \`\${path} returned \${response ? response.status() : "no response"}\`,
+      });
+      continue;
+    }
     // Snap CSS transitions/animations to their resting state before axe runs.
     // AnimateIn-style fixtures transition opacity 0->1; sampling mid-transition
     // makes axe compute color-contrast against semi-transparent text, yielding a
@@ -697,7 +805,7 @@ test("a11y + hydration across configured routes", async ({ page }) => {
   // renders empty-but-valid won't false-fail -- only a real client crash does.
   for (const { path, name } of smokePages) {
     currentRoute = name;
-    await page.goto(path);
+    await page.goto(SMOKE_ORIGIN + path);
     // Let hydration + first effects run so a TDZ/ReferenceError surfaces.
     await page.waitForTimeout(2000);
   }
@@ -717,22 +825,45 @@ test("a11y + hydration across configured routes", async ({ page }) => {
 });
 `;
 }
+var NAMED_VIOLATIONS_MAX = 6;
+function describeViolations(violations) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const v of violations) {
+    const key = `${v.id}\0${v.route}`;
+    const g = groups.get(key);
+    if (g) g.n += 1;
+    else groups.set(key, { id: v.id, route: v.route, ...v.help ? { help: v.help } : {}, n: 1 });
+  }
+  const entries = [...groups.values()];
+  const shown = entries.slice(0, NAMED_VIOLATIONS_MAX).map((g) => {
+    const count = g.n > 1 ? ` \xD7${g.n}` : "";
+    const detail = g.id === "route-missing" && g.help ? ` (${g.help})` : "";
+    return `${g.id}${count} on ${g.route}${detail}`;
+  });
+  const rest = entries.length - shown.length;
+  return shown.join(", ") + (rest > 0 ? `, +${rest} more` : "");
+}
 async function a11yAudit(ctx) {
   const spawn = ctx.spawn ?? defaultSpawn;
   const site = ctx.site;
   const label = siteLabel(site);
   const specDir = await mkdtemp(join4(site.path, ".reddoor-a11y-spec-"));
   try {
-    const { a11yRoutes: siteRoutes } = await readSiteConfig(site.path);
+    const { a11yRoutes: siteRoutes, gateServer } = await readSiteConfig(site.path);
     const axePages = [
       ...a11yRoutes,
       ...(siteRoutes ?? []).map((path) => ({ path, name: path }))
     ];
-    const specPath = join4(specDir, "a11y.spec.ts");
-    await writeFile(specPath, buildSpec(axePages), "utf-8");
     const port = await findFreePort();
+    const previewPort = gateServer === "preview" ? await allocateDistinctPort(port) : void 0;
+    const specPath = join4(specDir, "a11y.spec.ts");
+    await writeFile(
+      specPath,
+      buildSpec(axePages, previewPort === void 0 ? "" : `http://localhost:${previewPort}`),
+      "utf-8"
+    );
     const configPath = join4(specDir, "playwright.config.ts");
-    await writeFile(configPath, buildPlaywrightConfig(port, site.path), "utf-8");
+    await writeFile(configPath, buildPlaywrightConfig(port, site.path, previewPort), "utf-8");
     const resultsPath = join4(site.path, RESULTS_REL);
     await rm(join4(site.path, ".reddoor-a11y"), { recursive: true, force: true });
     let raw;
@@ -747,7 +878,10 @@ async function a11yAudit(ctx) {
           // server, and runs axe over every configured route. The shared 30 s
           // default in runAudits is fine for deps/lint/security but starves
           // playwright (mirrors the lighthouse fix shipped earlier).
-          timeoutMs: 5 * 6e4
+          // A preview run pays for a production build before the first
+          // navigation, so the budget sized for "boot vite, then axe" would
+          // SIGKILL it mid-build and report it as an audit failure.
+          timeoutMs: previewPort === void 0 ? PLAYWRIGHT_TIMEOUT_MS : PLAYWRIGHT_PREVIEW_TIMEOUT_MS
         }
       );
     } catch (err) {
@@ -774,7 +908,11 @@ async function a11yAudit(ctx) {
     const hasSerious = (artifact.byImpact.serious ?? 0) > 0 || (artifact.byImpact.critical ?? 0) > 0;
     const hasAny = artifact.totalViolations > 0;
     const status = hasSerious ? "fail" : hasAny ? "warn" : "pass";
-    const summary = status === "pass" ? `a11y: 0 violations across ${a11yRoutes.length} routes (+${smokeRoutes.length} hydration smoke)` : `a11y: ${artifact.totalViolations} violations`;
+    const siteRouteCount = axePages.length - a11yRoutes.length;
+    const scanned = siteRouteCount > 0 ? `${axePages.length} routes (${a11yRoutes.length} fixtures + ${siteRouteCount} from package.json)` : `${axePages.length} routes`;
+    const smokeNote = previewPort === void 0 ? `+${smokeRoutes.length} hydration smoke` : `+${smokeRoutes.length} hydration smoke on a production preview`;
+    const named = describeViolations(artifact.violations ?? []);
+    const summary = status === "pass" ? `a11y: 0 violations across ${scanned} (${smokeNote})` : `a11y: ${artifact.totalViolations} violations across ${scanned}${named ? ` \u2014 ${named}` : ""}`;
     return {
       audit: "a11y",
       site: label,
@@ -1659,6 +1797,7 @@ async function functionHealthAudit(ctx) {
 // src/audits/form-e2e.ts
 var CF_TEST_SITEKEY = "1x00000000000000000000AA";
 var CONTACT_PATHS = ["/contact", "/"];
+var FORM_E2E_TESTMODE_UNDECLARED_SUMMARY = "site /health does not declare forms.testMode \u2014 probe refused (testMode forwarding not yet rolled out here)";
 var TESTMODE_SKIPPED_WORK_MS = 1e3;
 var BUDGET_WARN_RATIO = 0.5;
 function projectRealSubmissionMs(probeElapsedMs) {
@@ -1674,7 +1813,7 @@ function budgetThinSummary(probeElapsedMs) {
 var TURNSTILE_HOSTNAME_REJECTED = /\[Cloudflare Turnstile\][^\n]*?\b110200\b/;
 var TURNSTILE_WIDGET_ERROR = /\[Cloudflare Turnstile\][^\n]*?\b(?:110(?!200\b)\d{3}|400020|400070)\b/;
 var TURNSTILE_INIT_FAILED = /\[turnstile\] widget did not render/;
-var TURNSTILE_API_JS = /challenges\.cloudflare\.com\/turnstile\/v0\/api\.js/;
+var TURNSTILE_API_JS = /challenges\.cloudflare\.com\/turnstile\/v0\/(?:[\w.-]+\/)*api\.js/;
 function turnstileVerdict(health, observed) {
   if (health.turnstile === false) return "fail";
   if (!observed) return null;
@@ -1716,7 +1855,7 @@ async function formE2eAudit(ctx) {
         audit: "form-e2e",
         site: label,
         status: "skip",
-        summary: "site /health does not declare forms.testMode \u2014 probe refused (testMode forwarding not yet rolled out here)",
+        summary: FORM_E2E_TESTMODE_UNDECLARED_SUMMARY,
         details: { checkedAt, turnstileWidget: null }
       };
     }
@@ -2056,4 +2195,4 @@ export {
   runAudits,
   runAuditsAcross
 };
-//# sourceMappingURL=chunk-TO7DJYLZ.js.map
+//# sourceMappingURL=chunk-L3S3QZXL.js.map