feat(digest): on-demand weekly distribution-metrics CLI under PII invariants

[SoapyRED]

Summary

Rebuilds the weekly digest that was killed on 2026-05-06 (commit 569cdfc: "privacy hardening, low-signal feature") under a strict spec confirmed in conversation. Hard invariants encoded in CLAUDE.md FAULT 14 + scripts/weekly-digest/README.md verbatim + pii-filter.mjs at runtime + test.mjs at PR time.

Six invariants (all enforced)

1. On-demand only. npm run digest. No workflow, no cron, no email.
2. Output to stdout or scripts/weekly-digest/output/ (gitignored). Never to a tracked file. git check-ignore verified.
3. PII filter — zero tolerance. Email pattern OR cus_* / sub_* Stripe ID in the assembled output → script throws.
4. Stripe = aggregates only. No /v1/customers. No customer-object expansion. Permitted out of any Stripe response: amount, currency, status, items.data[].price.{unit_amount, recurring}, items.data[].quantity, created, canceled_at. Everything else dropped inside the module before the result leaves.
5. Honest empty state. All sources hasMovement: false → print No movement this week and exit. No filler.
6. Kill-switch. SCRIPTS_WEEKLY_DIGEST=enabled in .env.local; unset → exit 0 with one-line message.

Sources (closed scope without explicit approval)

Source	Module	Auth	Behaviour without key
npm freightutils-mcp	npm-downloads.mjs	none	n/a — public
GitHub SoapyRED/{freighttools,freightutils-mcp}	github-stats.mjs	GITHUB_TOKEN optional	unauthenticated 60/hr
Smithery @freightutils/freightutils-mcp	smithery-stats.mjs	SMITHERY_API_KEY required	section renders as manual-check with listing URL
Stripe aggregates	stripe-aggregates.mjs	STRIPE_SECRET_KEY required	section renders as not-configured

Test results (npm run digest:test)

15 assertions PASS — pii-filter behaves on positive + negative cases; every section runs with PII-laden fixture payloads (emails in GitHub repo owner, cus_* / sub_* IDs in Stripe responses, receipt_email on charges); assembled output contains zero leaked PII; empty-state path also covered.

✓ pii-filter clean on clean text
✓ pii-filter caught email: leaked.user@example.com
✓ assertNoPii throws on email
✓ pii-filter caught cus_ id: cus_FixtureLeakageDeadbeef00
✓ assertNoPii throws on cus_ id
✓ pii-filter caught sub_ id: sub_FixtureLeakageDeadbeef00
✓ assertNoPii throws on sub_ id
✓ stripe active-count populated from fixture
✓ stripe gross-volume populated from fixture
✓ npm / github / smithery sections populated
✓ digest output is PII-free despite fixture injections
✓ assertNoPii on full output: no throw
✓ empty-state prints "No movement this week."

npm run digest with kill-switch unset → exits 0 with the expected one-line message.

FAULT 5 application

Item	Status
CHANGELOG.md entry	SKIPPED — see note below
/changelog renders	n/a
withAuditRest on new routes	n/a (no API routes)
generateMetadata on new pages	n/a (no pages)
sitemap.ts updated	n/a
openapi.json updated	n/a
nav / footer / Postman / npm-mcp / README	n/a
tsc clean	✓ (exit 0)
lint:audit / lint:api-casing / lint:seo-titles	✓ all PASS

Why no public CHANGELOG entry. This PR has zero user-visible changes — it's an internal dev-only CLI invoked from one developer's machine. The FAULT 5 rule wording is "CHANGELOG.md entry added describing this PR's user-visible changes". Publishing "we monitor Stripe / npm / GitHub / Smithery weekly" on the public changelog would also leak signal we don't need to give out. The CLAUDE.md FAULT 14 paragraph is the durable record for future Claude Code sessions — that's where the invariants live.

Test plan (post-merge)

• Vercel preview READY (Vercel will build but there are no app-surface changes; build should be a no-op pass)
• Post-merge: 10-path Sentry-quiet sweep (existing routes still 200; no new surface to test)

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
freighttools	Ready	Preview, Comment	May 16, 2026 9:24am