fix: harden degraded source handling

apis/sources/bls.mjs

@@ -52,6 +52,11 @@ export async function getSeries(seriesIds, opts = {}) {
   }
 }
 
+function isInvalidKeyResponse(resp) {
+  const message = Array.isArray(resp?.message) ? resp.message.join(' ') : String(resp?.message || resp?.error || '');
+  return Boolean(resp) && /key:.*invalid|invalid.*key|registrationkey/i.test(message);
+}
+
 // Extract the latest observation from a BLS series response
 function latestFromSeries(seriesData) {
   if (!seriesData?.data?.length) return null;
@@ -95,17 +100,25 @@ function momChange(seriesData) {
 // Briefing — pull latest CPI, unemployment, payrolls
 export async function briefing(apiKey) {
   const seriesIds = Object.keys(SERIES);
-  const resp = await getSeries(seriesIds, { apiKey });
+  let resp = await getSeries(seriesIds, { apiKey });
+  let configWarning = null;
+
+  if (apiKey && isInvalidKeyResponse(resp)) {
+    configWarning = 'Configured BLS_API_KEY was rejected; retried with unauthenticated BLS v1 API.';
+    resp = await getSeries(seriesIds, { apiKey: null });
+  }
 
   if (resp.error) {
-    return { source: 'BLS', error: resp.error, timestamp: new Date().toISOString() };
+    return { source: 'BLS', status: 'degraded', error: resp.error, configWarning, timestamp: new Date().toISOString() };
   }
 
   if (resp.status !== 'REQUEST_SUCCEEDED' || !resp.Results?.series?.length) {
     return {
       source: 'BLS',
+      status: 'degraded',
       error: resp.message?.[0] || 'BLS API returned no data',
       rawStatus: resp.status,
+      configWarning,
       timestamp: new Date().toISOString(),
     };
   }
@@ -155,6 +168,7 @@ export async function briefing(apiKey) {
   return {
     source: 'BLS',
     timestamp: new Date().toISOString(),
+    ...(configWarning ? { status: 'degraded', configWarning } : { status: 'ok' }),
     indicators,
     signals,
   };