@impeccable/reviews 0.1.2 → 0.1.3

package/dist/fence.js

@@ -330,7 +330,7 @@ function scriptsIn(dir) {
  * package.json and the files the scripts and listed tools load from the checkout by convention (`*.config.js`, `.*rc`): once the agent
  * changes one, what runs is no longer the repository's own code.
  */
-/** The ci-tunnel case corrects Vite's preview.allowedHosts and proves it with the local preview check, which runs in its own copy and environment: after that edit only the shell stops. */
+/** A rerun on Impeccable's tunnel (first-preview-failure) corrects Vite's preview.allowedHosts and proves it with the local preview check, which runs in its own copy and environment: after that edit only the shell stops. */
 const VITE_CONFIG = /(?:^|\/)vite\.config\.[cm]?[jt]s$/i;
 const LOADED = /(?:^|\/)(?:package\.json|[\w.-]+\.config\.[cm]?[jt]s|\.[\w-]+rc(?:\.\w+)*|tsconfig[^/]*\.json|knexfile\.[^/]+|bunfig\.toml|prisma\/seed\.[^/]+|node_modules\/.+)$/i;
 /** Why scripts and tools stop running: the agent changed a package.json (true when it does not say which), or a file named here that they load. */

package/dist/playbook/cases/cloudflare-previews.md

@@ -10,8 +10,8 @@ Cloudflare Pages deploys previews of the pull requests: impeccable_cloudflare_pr
 ### Reference
 
 - **Behind Cloudflare Access** (`gate: "cloudflare-access"`): Cloudflare's login stands in front of the previews. Get past it as preview-protection says, which proves the preview, and go on with step 2; when nothing got past it, that case says how the run ends.
-- **Another app, or no answer from any of the three**: Cloudflare's previews do not show this app. Set the preview up as ci-tunnel or static-site says instead, and say under "What is not verified" what the Cloudflare address answered.
-- **Nothing listed**: Cloudflare's previews are not on record, so set the preview up as ci-tunnel or static-site says. An `error` means a read failed, so a preview may exist that is not listed: say so under "What is not verified".
+- **Another app, or no answer from any of the three**: Cloudflare's previews do not show this app. Set the preview up as server-previews or static-site says instead, and say under "What is not verified" what the Cloudflare address answered.
+- **Nothing listed**: Cloudflare's previews are not on record, so set the preview up as server-previews or static-site says. An `error` means a read failed, so a preview may exist that is not listed: say so under "What is not verified".
 - **The pull requests**: no setup pull request; the test drive branches from the default branch, and Cloudflare builds every pushed branch, so pull-requests' step 4 goes the Vercel way with impeccable_cloudflare_previews in place of impeccable_hosted_previews: with `branch: "impeccable/test-drive"` it waits up to five minutes for the check run on the pushed head, under a status line with its timer, and the test drive's page is proven on the alias it lists before the pull request opens. In place of pull-requests' step 3, build the test drive branch once with the build Cloudflare runs (the Pages project's build command, which the checkout's `package.json` `build` script usually is), so a page that does not build is never pushed.
 - The evidence is read only: link, deploy and change nothing on Cloudflare. The one Cloudflare sign-in is impeccable_cloudflare_access's, behind Access, on the person's yes. Cloudflare does not report its previews as GitHub deployments, so Impeccable finds them by their address pattern, the branch's alias: save the pattern the proof answered, and no other.
 - The report names the address that answered with this app under "What we found", and the pattern saved under "What was configured, and by whom". The test drive's own preview, which Cloudflare builds after the run, goes under "What is not verified".

package/dist/playbook/cases/first-preview-failure.md

@@ -25,4 +25,4 @@ A rerun: the setup pull request an earlier run opened has a preview job that fai
 | upload | The real build output and its entry page; correct `outputDir`. |
 | seed | The migration or seed command and the throwaway database. |
 | start | `startCommand`, `port`, `env` and readiness. |
-| tunnel | The app refusing the forwarded Host (see ci-tunnel), not Impeccable's own access gate: a 403 on the bare link alone is not a broken preview. |
+| tunnel | A repository already on Impeccable's tunnel: the app refusing the forwarded Host, allowed in the framework's host check for previews only (Rails `config.hosts`, Django `ALLOWED_HOSTS`, Vite `preview.allowedHosts`), not Impeccable's own access gate: a 403 on the bare link alone is not a broken preview. |

package/dist/playbook/cases/monorepo.md

@@ -8,9 +8,10 @@ The state's repository has an `apps` item: the scan proposed several apps, folde
    - **An item that is `done` or `skipped`** was answered before, on the setup page or by an earlier run (a run that stopped at the question left the scan's default, as a skip does): write nothing and ask nothing; the state's apps that are `enabled` are the chosen ones. Step 4.
 2. **Ask which apps get previews**, once, with impeccable_ask: `id: "apps"`, `kind: "multi"`, `title` *"This repository has several apps"*, `prompt` *"Which apps should get Impeccable previews?"*, `hint` *"Each draws pages of its own; untick any that should not get previews."*, and `options` one per app the answer listed: `value` its `key`, `label` its `name` and folder (*"Storefront · apps/storefront"*), `selected: true` on every one. The repository's own app (`main`) is among them only where the Worker kept it as a product of its own, with pages outside every app's folder: its label is its name and `/`. Done when it answered `values`, or a skip.
 3. **Write the picks**, one action a call as the item's instructions give them: `enable` each chosen app that is off, then `disable` each app that is on and was not chosen. The last app that is on cannot be switched off (409), which is why the enables come first. **After Skip**, write nothing more: the app the scan switched on stays the one that is on. Done when the last answer's `apps` show `enabled` true for every chosen app and false for the rest, or, after Skip, the confirm's answer stands.
-4. **Read the state again** with impeccable_state. Done when the preview item's `apps` names each chosen app's `directory`, `build` and `method`, and `perApp` its status.
-5. **Set each chosen app up**, one after the other, as the playbook's steps 3 and 4 say for that app alone, `appKey` on every write and check (`preview`, `test-accounts`, `latest-pull-check`, `connection-check`): its method by the case that applies to it (ci-tunnel when its pages need a server, static-site when they do not, a host's case when the host deploys that app as a project of its own, proven on that app's own address), and its own sign-in when the scan item's `accessByApp` says it has one, each account question's title naming the app (*"Order desk admin account"*). Done when every chosen app's method is saved and its sign-in saved or skipped, and no other app got a write, a build or a question.
-6. **The pull requests** as pull-requests says, once for the repository: the setup commit takes the state's one workflow `file` (a job for each chosen app whose preview Impeccable builds) once every chosen app's method and build settings are saved; the test drive adds its page to every chosen app, in that app's own framework and linked from that app's own public page, so one review renders each of them on its own preview; that case's step 3 proves each chosen app with the input that proved it; its step 6 checks once, with the first chosen app's `appKey`, and the other apps' previews go under "What is not verified". Done when pull-requests' steps are done.
+4. **Read the state again** with impeccable_state. Done when the preview item's `apps` names each chosen app's `directory`, `build` and `method` (none yet for an app not set up), and `perApp` its status.
+5. **Set each chosen app up**, one after the other, as the playbook's steps 3 and 4 say for that app alone, `appKey` on every write and check (`preview`, `test-accounts`, `latest-pull-check`, `connection-check`): its method by the case that applies to it (server-previews when its pages need a server, static-site when they do not, a host's case when the host deploys that app as a project of its own, proven on that app's own address), and its own sign-in when the scan item's `accessByApp` says it has one, each account question's title naming the app (*"Order desk admin account"*). Done when every chosen app's method is saved, or its preview skipped as server-previews says, and its sign-in saved or skipped, and no other app got a write, a build or a question.
+6. **The pull requests** as pull-requests says, once for the repository: the setup commit takes the state's one workflow `file` (a job for each chosen static site whose preview Impeccable builds) once every chosen app's method and build settings are saved, or its preview skipped as server-previews says; the test drive adds its page to every chosen app with a preview (an app whose preview was skipped gets none, and goes under "What was skipped, and why"), in that app's own framework and linked from that app's own public page, so one review renders each of them on its own preview; that case's step 3 proves each chosen app with the input that proved it; its step 6 checks once, with the `appKey` of the first chosen app with a preview, and the other apps' previews go under "What is not verified". Done when pull-requests' steps are done.
+   - **A chosen app whose preview was skipped** (server-previews): it stays on, with no method, no job in the workflow and no test drive page. It holds nothing back: the other apps' setup commit, test drive and checks go on as above, and its checkup entry left in `next` counts as done for the playbook's step 5. The report says, on its line and under "What was skipped, and why", that it gets no preview until its host deploys them.
    - **A host previews some chosen apps and Impeccable builds the others**: a host's case speaks for its own app. The setup commit carries the workflow for the others and the test drive branches from it, and pull-requests' step 4 goes each app's way: the host's app proven on the host's build, the others by the workflow. The repository goes without a workflow and a setup pull request only where a host previews every chosen app.
 7. **Report per app**: under "What was configured, and by whom", one line per app the question offered: on or off and why (picked, unticked, the scan's default after a skip), its method, its sign-in, what was verified; an app left out is under "What was skipped, and why" as well, with the setup page as where it is turned on. Done when every app is on one line.
 

package/dist/playbook/cases/netlify-previews.md

@@ -10,8 +10,8 @@ Netlify deploys previews of the pull requests: impeccable_netlify_previews lists
 ### Reference
 
 - **Behind a password or Netlify's login** (`gate: "netlify-protection"`): the site password, or Netlify's team login, stands in front of the previews. That is the preview-protection case's, whose steps come before step 2: the password is got past on the person's yes, the team login is not.
-- **Another app, or no answer from any of the three**: Netlify's previews do not show this app. Set the preview up as ci-tunnel or static-site says instead, and say under "What is not verified" what the Netlify address answered.
-- **Nothing listed**: Netlify's previews are not on record. Where the checkout is set up for Netlify that is the netlify-setup case's; else set the preview up as ci-tunnel or static-site says. An `error` means a read failed, so a preview may exist that is not listed: say so under "What is not verified".
+- **Another app, or no answer from any of the three**: Netlify's previews do not show this app. Set the preview up as server-previews or static-site says instead, and say under "What is not verified" what the Netlify address answered.
+- **Nothing listed**: Netlify's previews are not on record. Where the checkout is set up for Netlify that is the netlify-setup case's; else set the preview up as server-previews or static-site says. An `error` means a read failed, so a preview may exist that is not listed: say so under "What is not verified".
 - **The pull requests**: no setup pull request; the test drive branches from the default branch. Netlify builds a deploy preview only for a pull request, so the test drive opens as a draft, its deploy preview is waited for and the test drive's page proven on it, and then the draft is marked ready: pull-requests' step 4. In place of pull-requests' step 3, build the test drive branch once with the build Netlify runs (`netlify.toml`'s `[build]` `command`, else the package's `build` script), so a page that does not build is never pushed.
 - The evidence is read only: link, deploy and change nothing on Netlify. Netlify does not report its previews as GitHub deployments, so Impeccable finds them by their address pattern: save the pattern the proof answered, and no other.
 - The report names the address that answered with this app under "What we found", and the pattern saved under "What was configured, and by whom". The test drive's own preview, which Netlify builds after the run, goes under "What is not verified".

package/dist/playbook/cases/netlify-setup.md

@@ -1,13 +1,13 @@
 ### When this applies
 
-The checkout is set up for Netlify: a `netlify.toml`, a `.netlify/` folder, or a package script that runs the `netlify` command (a Netlify package alone, `@netlify/*` or `netlify-cli`, says nothing of where the repository deploys). And no pull request has a Netlify deploy preview: impeccable_netlify_previews lists none, and no `error` (an error says nothing either way). These steps replace the playbook's step 3. As in netlify-previews, the repository needs no workflow and no setup pull request.
+The checkout is set up for Netlify: a `netlify.toml`, a `.netlify/` folder, or a package script that runs the `netlify` command (a Netlify package alone, `@netlify/*` or `netlify-cli`, says nothing of where the repository deploys); or the person picked Netlify in server-previews. And no pull request has a Netlify deploy preview: impeccable_netlify_previews lists none, and no `error` (an error says nothing either way). These steps replace the playbook's step 3. As in netlify-previews, the repository needs no workflow and no setup pull request.
 
 ### Steps
 
 1. **Sign in**, before any other preview work, with impeccable_ask: `kind: "confirm"`, `id: "netlify-setup"`. The tool does the rest: it shows the sign-in screen only when the Netlify CLI is signed out (a person signed in already is asked nothing), runs the login in the browser and offers a retry. Done when it answered `confirmed`.
    - **`cli: "missing"`**: install the CLI with the person's package manager (`npm install -g netlify-cli`, `pnpm add -g netlify-cli`, `yarn global add netlify-cli` or `bun add -g netlify-cli`), then ask again: the screen shows no second time.
    - **`teams` in the answer** (the person has several Netlify teams): ask once which owns the site, `kind: "single"`, `id: "netlify-team"`, `options` the teams as given (the tool words the rest), and pass the pick to `sites:create` as `--account-slug`.
-   - **Skip**: set the preview up as ci-tunnel or static-site says, and say under "What was skipped, and why" that Netlify was found and the sign-in was skipped. The steps below do not apply.
+   - **Skip**: set the preview up as server-previews or static-site says, and say under "What was skipped, and why" that Netlify was found and the sign-in was skipped. The steps below do not apply.
 2. **Link or create the site**: `netlify link --git-remote-url <the GitHub origin>` links a site Netlify already builds from this repository; when it finds none, `netlify sites:create --name <name>` creates one in the person's team and links this folder. Name it after the repository: lowercase letters, digits and hyphens, at most 40 characters; a name Netlify says is taken gets `-2`. Done when `netlify status` names the linked project.
 3. **Connect the repository** with impeccable_netlify_connect: it connects the linked site to this repository through Netlify's GitHub app, so pull requests build deploy previews, and asks the person for the app's access when Netlify cannot read the repository. Give `command` and `publish` only where no `netlify.toml` sets the build. Done when it answered `connected: true`; a site `netlify link` found is connected already, and it says so.
 4. **Build and push the test drive** (the Test drive task) as pull-requests' steps 2 to 4 say, with the changes netlify-previews' reference gives: from the default branch, no setup pull request, built once with the build Netlify runs. Stage its files by name: `netlify sites:create` writes `.netlify/` and may add it to `.gitignore`, and that change stays out of the pull request. Done when `git push -u origin impeccable/test-drive` succeeded.
@@ -15,7 +15,7 @@ The checkout is set up for Netlify: a `netlify.toml`, a `.netlify/` folder, or a
 
 ### Reference
 
-- **A step fails before the test drive is pushed** (the sign-in skipped or not completed, the site not created, the repository not connected): the Netlify setup ends there. Set the preview up as ci-tunnel or static-site says, say under "What was skipped, and why" what stopped it, and put the person's step in `left` when there is one, such as "Give Netlify's GitHub app access to the repository", with the `access` page in the report.
+- **A step fails before the test drive is pushed** (the sign-in skipped or not completed, the site not created, the repository not connected): the Netlify setup ends there. Set the preview up as server-previews or static-site says, say under "What was skipped, and why" what stopped it, and put the person's step in `left` when there is one, such as "Give Netlify's GitHub app access to the repository", with the `access` page in the report.
 - **No preview for the draft**: save no method, set up no other preview, and leave the draft as it is, unrecorded, as pull-requests' "No preview, no test drive" says; the site and the connection stay, and the report names them.
   - **The build failed** (`state` is `error` or `failure`): say so under "What is not verified", with the command that builds this linked checkout as Netlify does and prints why, for the person to run: `netlify deploy --build --context deploy-preview`. It never runs here, since it builds with their Netlify sign-in.
   - **No deploy preview within five minutes**: the build had not finished, or Netlify builds no deploy preview for pull requests here: Deploy Previews may be off in the site's settings, so put "Turn Deploy Previews on in the site's Netlify settings" in `left`.

package/dist/playbook/cases/pull-requests.md

@@ -6,11 +6,11 @@ Every run, once the settings are saved. The person merges the setup pull request
 
 1. **The setup commit**, when the repository needs a change to keep previews working: the workflow and any fix the build needed, nothing else. With the workflow current on the default branch and no fix, there is none. Check access as workflow-as-person says, branch `impeccable/setup` from `origin/<defaultBranch>`, and bring in the workflow and commit as that case says. Push it in step 7, after the test drive. Done when that case's steps are done.
 2. **The test drive page**, always. The test drive shows the person a whole review: pages to capture, a finding for each measure, and a new page, which is what starts the review's visitor sessions. Branch `impeccable/test-drive` from the setup commit, so it carries the same workflow and its preview runs from its own head (from the default branch when there is no setup commit). Add one small, self-contained page in the repository's own framework, such as `/impeccable-test-drive`: a file where the routing finds pages, plus its styles, with a heading, a paragraph and a few elements in the app's own words (so the review judges it as one of the app's pages), and the flaws below. Link it from a page **a visitor opens without signing in**, the landing page when it is one, and keep the new page open without signing in too: no guard, on the server or in the browser, sends it to the sign-in. Done when the new page carries every flaw below with its comment, and the page you picked links to it.
-3. **Prove both pages** with impeccable_verify_preview, for a preview Impeccable builds itself (ci-tunnel, static-site): the input that proved the preview, with both pages in `paths` for a server (a redirect to the sign-in fails there) or in `entries` for a static site. A host's preview (vercel-previews, vercel-setup, netlify-previews, netlify-setup) is proven on the host's own build in step 4 instead; its case says how the branch is built here first. Done when it answers `verified: true`, or the preview is a host's.
+3. **Prove both pages** with impeccable_verify_preview, for a preview Impeccable builds itself (static-site): the input that proved the preview, with both pages in `entries`. A host's preview (vercel-previews, vercel-setup, netlify-previews, netlify-setup) is proven on the host's own build in step 4 instead; its case says how the branch is built here first. Done when it answers `verified: true`, or the preview is a host's.
 4. **Push the test drive and prove its preview**: commit, `git push -u origin impeccable/test-drive`, then the way its preview comes:
    - **Vercel** (vercel-previews, vercel-setup) builds every push: impeccable_hosted_previews with `branch: "impeccable/test-drive"` waits up to five minutes for its deployment of the pushed head, under a status line with its timer. Prove the test drive's page on that address with impeccable_prove_preview (past Vercel's login as preview-protection says), and save the method as the case says. Then step 5.
    - **Netlify** (netlify-previews, netlify-setup) builds a deploy preview only for a pull request: open the test drive now as a **draft**, step 5's `gh pr create` with `--draft`, which Impeccable leaves unreviewed. impeccable_netlify_previews with `pull` the number it printed waits up to five minutes for the deploy preview, under a status line with its timer. Prove the test drive's page on it, save the method as the case says, then `gh pr ready impeccable/test-drive --repo <owner>/<repo>` marks it ready, which starts the review. Then step 5's recording.
-   - **Impeccable's own preview** (ci-tunnel, static-site): the workflow in the branch builds it on the pull request, and Impeccable's review holds up to eight minutes for that job before it renders, so step 3's proof and the workflow in the branch (from the setup commit) are all this step takes. Then step 5.
+   - **Impeccable's own preview** (static-site): the workflow in the branch builds it on the pull request, and Impeccable's review holds up to eight minutes for that job before it renders, so step 3's proof and the workflow in the branch (from the setup commit) are all this step takes. Then step 5.
 
    Done when the test drive's page is proven on its preview, and a host's method saved; when nothing proved it, the reference below says how the run goes on.
 5. **Open the test drive and record it**: `gh pr create --repo <owner>/<repo> --head impeccable/test-drive --base <defaultBranch>` with the title "Impeccable test drive (safe to close)" and a body that starts "This pull request only shows Impeccable reviewing a change. Close it when you are done; nothing here needs to be merged." and then names the two pages and lists the flaws planted for the review to find, one line each (a Netlify draft opened this way in step 4, and was marked ready there). Record it right away with impeccable_test_pr, so the web page follows its review; it refuses a draft. Done when impeccable_test_pr answered "Recorded".

package/dist/playbook/cases/server-previews.md

@@ -0,0 +1,17 @@
+### When this applies
+
+The pages need a server from this repository (SSR, API routes, or a backend the front end calls; a front end whose bundle builds on its own still needs its backend here), and no host's previews show them: no host case applied, or one ended without a preview. Impeccable no longer runs a server in CI for a new setup, so such pages are previewed only by their host's pull request previews. These steps replace the playbook's step 3.
+
+### Steps
+
+1. **Ask where the previews come from**, once, with impeccable_ask: `id: "preview-host"`, `kind: "single"`, `title` *"Pull request previews"*, `prompt` *"Which host should deploy a preview of each pull request?"*, `hint` *"Impeccable reviews this app on its host's previews, and no longer runs its server itself."*, and `options` Vercel (`vercel`) and Netlify (`netlify`). Done when it answered a value, or a skip.
+   - **Several apps**: ask once for each app this case applies to, the title naming the app (*"Order desk previews"*).
+   - **Asked already for this app in this run**, or a host's setup for it ended without a preview (the sign-in skipped, a step failed): ask nothing, and go on as after a skip.
+2. **Set the host up**: on `vercel`, as the vercel-setup case says, and on `netlify`, as the netlify-setup case says. The pick stands in for that case's "When this applies": its steps run whatever the checkout holds for the host, and even where the host already deploys previews that showed another app or did not answer, since the test drive's own preview, proven on that host, decides. Done when that case's steps are done.
+3. **After a skip**: no preview, no test drive. Save no method and write no workflow for these pages, and open no test drive, as pull-requests' "No preview, no test drive" says. Mark the Preview method and Test drive tasks failed, say under "What was skipped, and why" that the pages need a server and no host deploys previews of them, and put "Turn on your host's pull request previews, then run the setup again" in `left`, naming Vercel, Netlify and Cloudflare in the report. The checkup's entry for this preview then stays in `next`, which counts as done for the playbook's step 5. With several apps this holds for the skipped app alone: the other chosen apps' previews and the test drive go on as monorepo says, and the tasks fail only where no app has a preview. Done when the report says so.
+
+### Reference
+
+- **Already on Impeccable's tunnel**: a repository whose state shows `ci-tunnel` as the preview's method, with its workflow committed, keeps working as it is. Change nothing about that preview: a host the person picks here replaces it once its preview is saved, and after a skip the tunnel stays, which the report says in place of the step for `left`.
+- **Never save `ci-tunnel`**: impeccable_write refuses it.
+- The sign-in case applies all the same: the accounts serve the host's previews once they come.

package/dist/playbook/cases/sign-in.md

@@ -18,4 +18,3 @@ The app has its own sign-in: a form that takes a username or an email and a pass
 - impeccable_ask and impeccable_write are the terminal prompt the instructions' `signIn` describes: the person types each password hidden, and it goes straight to `test-accounts`.
 - **A password is only the reference impeccable_ask returned**; impeccable_write refuses any other, so a password in the seed, a README or an env file stays where it is. When the seed sets one, name its file in the account question's hint and let the person type it.
 - `loginPage` is the login form's path when the code names one, such as `/login`.
-- A `ci-tunnel` preview runs the seed, so the seed's accounts exist there.

package/dist/playbook/cases/static-site.md

@@ -1,6 +1,6 @@
 ### When this applies
 
-The pages need no server from this repository: plain HTML, or a build that writes a complete static site. Pages that need SSR, API routes or a backend here follow ci-tunnel; an external API they call does not change that. A build that writes only JavaScript, CSS or types is a library, not a site.
+The pages need no server from this repository: plain HTML, or a build that writes a complete static site. Pages that need SSR, API routes or a backend here follow server-previews; an external API they call does not change that. A build that writes only JavaScript, CSS or types is a library, not a site.
 
 ### Steps
 

package/dist/playbook/cases/vercel-previews.md

@@ -10,7 +10,7 @@ Vercel deploys previews of the pull requests: impeccable_hosted_previews lists a
 ### Reference
 
 - **Behind Vercel's login** (`gate: "vercel-protection"`): Deployment Protection stands in front of the previews. Get past it as preview-protection says, which proves the preview, and go on with step 2; when nothing got past it, that case says how the run ends.
-- **Another app, or no answer from any of the three**: Vercel's previews do not show this app. Set the preview up as ci-tunnel or static-site says instead, and say under "What is not verified" what the Vercel address answered.
+- **Another app, or no answer from any of the three**: Vercel's previews do not show this app. Set the preview up as server-previews or static-site says instead, and say under "What is not verified" what the Vercel address answered.
 - **The pull requests**: no setup pull request; the test drive branches from the default branch, and Vercel builds its preview from the push, which pull-requests' step 4 waits for and proves the test drive's page on before the pull request opens. In place of pull-requests' step 3, build the test drive branch once with the install and build Vercel runs (`vercel.json`'s `installCommand` and `buildCommand`, else the package's), as plain commands (`pnpm install`, then `pnpm run build`) and not with impeccable_verify_preview, which is for a preview Impeccable starts itself, so a page that does not build is never pushed.
 - The evidence is GitHub's: link, deploy and change nothing on Vercel, and save no address pattern, since Vercel reports each preview's address to GitHub itself.
 - The report names the address that answered with this app under "What we found", and puts the test drive's own preview under "What is not verified".

package/dist/playbook/cases/vercel-setup.md

@@ -1,6 +1,6 @@
 ### When this applies
 
-The checkout is set up for Vercel (`vercel.json`, `.vercel/project.json`, a `vercel` dependency or script) and Vercel has never deployed it: impeccable_hosted_previews lists no deployment that Vercel made (`vercel: true`), and no `error` (an error says nothing either way). These steps replace the playbook's step 3. As in vercel-previews, the repository needs no workflow and no setup pull request.
+The checkout is set up for Vercel (`vercel.json`, `.vercel/project.json`, a `vercel` dependency or script), or the person picked Vercel in server-previews, and Vercel has never deployed it: impeccable_hosted_previews lists no deployment that Vercel made (`vercel: true`), and no `error` (an error says nothing either way). These steps replace the playbook's step 3. As in vercel-previews, the repository needs no workflow and no setup pull request.
 
 ### Steps
 
@@ -8,7 +8,7 @@ The checkout is set up for Vercel (`vercel.json`, `.vercel/project.json`, a `ver
    - **`cli: "missing"`**: install the CLI with the person's package manager (`npm install -g vercel`, `pnpm add -g vercel`, `yarn global add vercel` or `bun add -g vercel`), then ask again: the screen shows no second time.
    - **`teams` in the answer instead of `team`** (several teams, none current): ask once which owns the project, `kind: "single"`, `id: "vercel-team"`, `options` the teams as given (the tool words the rest). The pick is the team.
    - **Neither `team` nor `teams`**: the account has no team, and `vercel link --yes` without `--team` links in the person's own scope.
-   - **Skip**: set the preview up as ci-tunnel or static-site says, and say under "What was skipped, and why" that Vercel was found and the sign-in was skipped. The steps below do not apply.
+   - **Skip**: set the preview up as server-previews or static-site says, and say under "What was skipped, and why" that Vercel was found and the sign-in was skipped. The steps below do not apply.
 2. **Create the project** (run each Vercel command plain: its answer is short, and a pipe to `tail` is refused): `vercel link --yes --team <the team>` creates the project in that team, named after the folder (or links the one that has that name), and connects the GitHub `origin`; the CLI names no team on its own without a terminal, so the option is given whenever there is a team. Done when it prints the linked project.
 3. **Connect the repository, and lock the project before its first deployment**, with impeccable_vercel_connect: it runs the connection on the linked project, asks the person for Vercel's GitHub app's access when the app cannot reach the repository, and then, on a project with no production deployment, puts Vercel's login in front of every address of the project, its own included. Vercel makes a new project's first deployment Production whatever branch it builds and serves it at the project's own address, and the test drive's push is that first deployment. Done when it answered `connected: true` with `production: "exists"` or `locked: true`; a project connected by the link already is, and it says so.
 4. **Build and push the test drive** (the Test drive task) as pull-requests' steps 2 to 4 say, with the changes vercel-previews' reference gives: from the default branch, no setup pull request, built once with plain commands. Stage its files by name: `vercel link` writes `.vercel/` and a `.env.local` that holds a Vercel token, and may add `.vercel` to `.gitignore`, and none of that goes into the pull request. Its push starts the project's first deployment. Done when `git push -u origin impeccable/test-drive` succeeded.
@@ -16,7 +16,7 @@ The checkout is set up for Vercel (`vercel.json`, `.vercel/project.json`, a `ver
 
 ### Reference
 
-- **A step fails before the test drive is pushed** (the sign-in skipped or not completed, the team skipped, the project not created, the repository not connected): the Vercel setup ends there. Set the preview up as ci-tunnel or static-site says, say under "What was skipped, and why" what stopped it, and put the person's step in `left` when there is one, such as "Give Vercel's GitHub app access to the repository", with the `access` page in the report.
+- **A step fails before the test drive is pushed** (the sign-in skipped or not completed, the team skipped, the project not created, the repository not connected): the Vercel setup ends there. Set the preview up as server-previews or static-site says, say under "What was skipped, and why" what stopped it, and put the person's step in `left` when there is one, such as "Give Vercel's GitHub app access to the repository", with the `access` page in the report.
 - **A push before step 3** is refused, since a connected project builds every push: run impeccable_vercel_connect first.
 - **`locked: false`** from step 3, with `production` not "exists": push nothing, and set up no other preview either, since the connected project would build that push as its first deployment, public at its own address. Mark the Test drive task failed, say under "What was skipped, and why" what stopped the lock (the answer's `reason`) and how the person locks the project (Vercel Authentication for All Deployments, under the project's Settings → Deployment Protection), and put "Lock the Vercel project, then run the setup again" in `left`.
 - **No preview for the pushed test drive**: save no method, set up no other preview and open no pull request, as pull-requests' "No preview, no test drive" says; the project and the connection stay, and the report names them.

package/dist/playbook.js

@@ -12,13 +12,13 @@ export function loadCases(directory = new URL('./playbook/cases/', import.meta.u
 }
 /** The system prompt: the setup, its steps, then the reference and the cases. The instructions JSON carries every write shape and the fence decides what runs; this restates neither. */
 export function playbook(repo) {
-    return `You are Impeccable's setup agent, in a checkout of ${repo.owner}/${repo.name} on the person's own machine. This setup covers one situation: Impeccable previews the repository's web front end, taking the previews its host deploys for pull requests (vercel-previews, netlify-previews, cloudflare-previews, or vercel-setup and netlify-setup, which turn them on) or building it itself through the workflow the setup state generates (\`ci-tunnel\` for pages that need a server, \`static-upload\` for a static site), and signs in with the app's own username-or-email-and-password accounts when it has a sign-in. You read files and run commands here, save Impeccable's settings with the impeccable_* tools, and open pull requests as the person. The person watches this terminal, and a web page mirrors your tasks and the report.
+    return `You are Impeccable's setup agent, in a checkout of ${repo.owner}/${repo.name} on the person's own machine. This setup covers one situation: Impeccable previews the repository's web front end, taking the previews its host deploys for pull requests (vercel-previews, netlify-previews, cloudflare-previews, or vercel-setup and netlify-setup, which turn them on) or, for a static site, building it itself through the workflow the setup state generates (\`static-upload\`), and signs in with the app's own username-or-email-and-password accounts when it has a sign-in. You read files and run commands here, save Impeccable's settings with the impeccable_* tools, and open pull requests as the person. The person watches this terminal, and a web page mirrors your tasks and the report.
 
 # Steps
 
 1. **Read the state.** The setup API's instructions and state came with the first message, trimmed to this setup; impeccable_state reads the state again. Done when you know the preview item's status, \`file\` and \`workflowStanding\`, whether there is a \`signin\` item, whether there is an \`apps\` item (the monorepo case comes first then), and the titles in \`notPartOfThisSetup\`.
 2. **Read the repository**: manifests, the lockfile, scripts, framework config, CI workflows, env examples, the routes, the auth code and the seed. Done when you can name the package manager, the install, build and start commands, whether the pages need a server, how people sign in, and which pages a visitor opens without signing in.
-3. **Set up the preview** as the vercel-previews case says when impeccable_hosted_previews lists Vercel's previews of the pull requests, as the netlify-previews case says when impeccable_netlify_previews lists Netlify's (and as preview-protection says when the host's login or password stands in front of either), as the cloudflare-previews case says when impeccable_cloudflare_previews lists Cloudflare Pages', as the vercel-setup case says when the checkout is set up for Vercel and Vercel has never deployed it, as the netlify-setup case says when the checkout is set up for Netlify and it lists none, else as the ci-tunnel case says when the pages need a server, and as the static-site case says when they do not. Done when that case's steps are done.
+3. **Set up the preview** as the vercel-previews case says when impeccable_hosted_previews lists Vercel's previews of the pull requests, as the netlify-previews case says when impeccable_netlify_previews lists Netlify's (and as preview-protection says when the host's login or password stands in front of either), as the cloudflare-previews case says when impeccable_cloudflare_previews lists Cloudflare Pages', as the vercel-setup case says when the checkout is set up for Vercel and Vercel has never deployed it, as the netlify-setup case says when the checkout is set up for Netlify and it lists none, else as the server-previews case says when the pages need a server, and as the static-site case says when they do not. Done when that case's steps are done.
 4. **Set up the sign-in** as the sign-in case says, when the app has its own. Done when that case's steps are done.
 5. **Run impeccable_checkup**, do what \`next\` says, and run it again. Done when \`status\` is complete, or all that is left is in \`forPerson\` or \`waitingFor\`.
 6. **Open the pull requests** as the pull-requests case says. What waits on the person holds neither back. Done when that case's steps are done.

package/dist/tools.js

@@ -1755,7 +1755,7 @@ export function createTools(ctx) {
     return [
         tool('impeccable_workflow_access', 'Check workflow access', 'Check that the setup pull request can carry the workflow: reads the active GitHub CLI account and its scopes, the origin remote and the default branch, and refreshes origin/<defaultBranch>. Call it before branching. needsWorkflowScope true means the account lacks workflow access over HTTPS; base.status "refreshed" means origin/<defaultBranch> is current. Only the push itself proves Git may push.', NO_INPUT, (_p, pi, signal) => workflowAccessTool(pi, signal)),
         tool('impeccable_sync_workflow', 'Update the preview workflow', 'Write the state\'s workflow to .github/workflows/impeccable-preview.yml byte for byte and remove the retired workflow the state names, after checking access as impeccable_workflow_access does. Call it once the settings are saved, and again after committing: stagedMatches and committedMatches true (and retiredRemoval staged and committed) prove the commit holds the exact bytes; null means nothing was compared. It refuses, changing nothing, when the file has the person\'s local edits. It never branches, stages, commits or pushes.', NO_INPUT, (_p, pi, signal) => syncWorkflowTool(pi, signal)),
-        tool('impeccable_verify_preview', 'Check the local preview', 'Prove the preview on this machine before saving it: runs the steps in a throwaway copy of the checkout, with a throwaway database, and removes everything afterwards. For a server give start, port, paths and host: it starts the app and requests each path as localhost and as the tunnel host. For a static site give output: it checks the build wrote the entry pages. verified covers HTTP answers and files only, never rendering, sign-in or the CI runtime; a failure names its stage.', PREVIEW_VERIFICATION, async (p, pi, signal) => JSON.stringify(await verifyLocalPreview(p, pi.cwd, signal, ctx.sandbox))),
+        tool('impeccable_verify_preview', 'Check the local preview', 'Prove the preview on this machine before saving it: runs the steps in a throwaway copy of the checkout, with a throwaway database, and removes everything afterwards. For a server already on Impeccable\'s tunnel give start, port, paths and host: it starts the app and requests each path as localhost and as the tunnel host. For a static site give output: it checks the build wrote the entry pages. verified covers HTTP answers and files only, never rendering, sign-in or the CI runtime; a failure names its stage.', PREVIEW_VERIFICATION, async (p, pi, signal) => JSON.stringify(await verifyLocalPreview(p, pi.cwd, signal, ctx.sandbox))),
         tool('impeccable_preview_run', 'Read the preview attempt', 'On a rerun, once impeccable_test_pr recorded the setup pull request: read its preview workflow\'s runs. Answers each attempt with its failed stage and a fixed reason (never log text), the three-attempt budget (used, remaining, historyKnown), and adds the attempts to the task list. Reading is free.', PREVIEW_RUN, async (p, pi, signal) => {
             if (!retry.pr)
                 return 'Refused: record the setup pull request with impeccable_test_pr first.';
@@ -1832,6 +1832,9 @@ export function createTools(ctx) {
                 return `Refused: ${target.error}`;
             if (/\/(preview-auth\/[^/]+|preview-protection)$/.test(target.url))
                 return "Refused: a host's key is saved by impeccable_vercel_bypass (a Vercel bypass secret), impeccable_netlify_password (a Netlify site password) or impeccable_cloudflare_access (a Cloudflare Access service token), which opens the preview with it first, and never through this tool. Nothing was saved.";
+            if (target.url.endsWith('/preview') && object(p.body)?.intendedMethod === 'ci-tunnel') {
+                return "Refused: Impeccable no longer runs a server in CI for a new setup, so ci-tunnel is never saved. Pages that need a server get their host's pull request previews, as the server-previews case says. Nothing was saved.";
+            }
             if (target.url.endsWith('/preview') && object(p.body)?.intendedMethod === 'preview-deploy' && !hostedPreviewProven) {
                 return "Refused: prove a preview address with impeccable_prove_preview first: the host's previews become the method only once one answered with this app. Nothing was saved.";
             }
@@ -1855,7 +1858,7 @@ export function createTools(ctx) {
             const response = await call(pi, target.url, { method: target.method, body });
             if (target.url.endsWith('/preview') && response.ok) {
                 const keys = object(object(response.data)?.keys);
-                if (keys?.intendedMethod === 'stored' && ['ci-tunnel', 'static-upload'].includes(String(object(p.body)?.intendedMethod)))
+                if (keys?.intendedMethod === 'stored' && object(p.body)?.intendedMethod === 'static-upload')
                     retry.requireHistory = true;
                 if (object(p.body)?.intendedMethod === 'preview-deploy')
                     savedHost = provenHost;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@impeccable/reviews",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Set up a repository for Impeccable for PRs from your terminal.",
   "license": "SEE LICENSE IN LICENSE",
   "private": false,

package/dist/playbook/cases/ci-tunnel.md

@@ -1,21 +0,0 @@
-### When this applies
-
-The pages need a server from this repository: SSR, API routes, or a backend the front end calls. A front end whose bundle builds on its own still needs its backend here.
-
-### Steps
-
-1. **Work out the commands** in the workflow's order: install, prepare, build, seed and start, each with the folder it runs in. Done when each has a command, or none, and a folder.
-2. **Prove them** with impeccable_verify_preview in server mode. Done when it answers `verified: true`; a failure names its `stage`, which the report explains, and pull-requests' "No preview, no test drive" says how the run goes on without a proof.
-3. **Save them** with impeccable_write to `preview`: `intendedMethod: "ci-tunnel"` and the settings you proved, from the keys `buildSettings` lists. Done when the answer's `keys` show each key stored or unchanged.
-
-### Reference
-
-- **Seed and migrate only a throwaway database**, never a shared or production one:
-  - **SQLite**: a relative file URL in `env` (`DATABASE_URL=file:./preview.db`), and the repository's schema setup as the prepare or seed step.
-  - **Postgres or MySQL**: `service`, which gives the steps their own `DATABASE_URL`.
-  - **Cloudflare D1**: `--local` migrations and seeds.
-- **The tunnel host refused** (localhost answers, the tunnel host gets a 403): allow the preview host in the framework's host check (Rails `config.hosts`, Django `ALLOWED_HOSTS` and `CSRF_TRUSTED_ORIGINS`, Vite `preview.allowedHosts`) for previews only, in the setup pull request; keep the check on.
-- **Readiness**: the job waits for `/` to answer. When only a base path answers, report it as a blocker: no setting points it elsewhere.
-- **Runtime**: compare `node --version` (or python, ruby, pnpm) with the repository's pins; the job sets its runtime from `runtimeVersion`, so a mismatch goes under "What is not verified".
-- **Env**: literal, non-secret values. A secret the app needs is `${{ secrets.NAME }}` in the saved `env`, and "Add the NAME repository secret" in `left`. A demo or test-login flag belongs in the preview's env only.
-- A verified result covers HTTP answers only: rendering and the CI runtime go under "What is not verified".

package/dist/playbook/github-previews.js

@@ -1,101 +0,0 @@
-import { execFile } from 'node:child_process';
-import { promisify } from 'node:util';
-const execFileAsync = promisify(execFile);
-const LIMIT = 20;
-const COVERAGE = 'Only the 20 newest GitHub deployments, their latest statuses, and the 20 most recently updated pull requests are checked. A missing match does not prove previews are absent. Empty GitHub deployment history does not prove that a live app or host previews do not exist. A deployment URL does not prove the application rendered.';
-const FAILURE = 'GitHub preview evidence could not be read completely.';
-const STATES = ['error', 'failure', 'inactive', 'in_progress', 'queued', 'pending', 'success'];
-function record(value) {
-    return value !== null && typeof value === 'object' && !Array.isArray(value)
-        ? value
-        : undefined;
-}
-function positiveInteger(value) {
-    return typeof value === 'number' && Number.isSafeInteger(value) && value > 0;
-}
-function sha(value) {
-    return typeof value === 'string' && /^[a-f0-9]{40}$/.test(value);
-}
-function previewUrl(value) {
-    if (typeof value !== 'string' || value.length > 2048 || !/^https:\/\/[^\s\\?#]+$/i.test(value))
-        return null;
-    try {
-        const url = new URL(value);
-        if (url.username || url.password || url.search || url.hash || /^https:\/\/[^/]*@/i.test(value))
-            return null;
-        return url.href;
-    }
-    catch {
-        return null;
-    }
-}
-/** Read a bounded projection of GitHub evidence; never return response bodies or command errors. */
-export async function readHostedPreviews(owner, repo, dependencies = {}) {
-    if (!/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/.test(owner)
-        || !/^[a-zA-Z0-9_.-]{1,100}$/.test(repo) || repo === '.' || repo === '..') {
-        return { coverage: COVERAGE, deployments: [], error: FAILURE };
-    }
-    const runGh = dependencies.runGh ?? (async (args) => {
-        const { stdout } = await execFileAsync('gh', args, {
-            encoding: 'utf8', timeout: 30_000, maxBuffer: 2 * 1024 * 1024, signal: dependencies.signal,
-        });
-        return stdout;
-    });
-    const base = `/repos/${owner}/${repo}`;
-    async function get(route) {
-        if (dependencies.signal?.aborted)
-            throw new Error(FAILURE);
-        const stdout = await runGh(['api', '--hostname', 'github.com', '--method', 'GET', route]);
-        if (dependencies.signal?.aborted)
-            throw new Error(FAILURE);
-        const data = JSON.parse(stdout);
-        if (!Array.isArray(data))
-            throw new Error(FAILURE);
-        return data.slice(0, LIMIT);
-    }
-    try {
-        const [deployments, pulls] = await Promise.all([
-            get(`${base}/deployments?per_page=${LIMIT}`),
-            get(`${base}/pulls?state=all&sort=updated&direction=desc&per_page=${LIMIT}`),
-        ]);
-        let incomplete = false;
-        const evidence = [];
-        for (const entry of deployments) {
-            if (dependencies.signal?.aborted) {
-                incomplete = true;
-                break;
-            }
-            const deployment = record(entry);
-            if (!deployment || !positiveInteger(deployment.id) || !sha(deployment.sha))
-                continue;
-            let latest;
-            try {
-                latest = record((await get(`${base}/deployments/${deployment.id}/statuses?per_page=1`))[0]);
-            }
-            catch {
-                incomplete = true;
-                if (dependencies.signal?.aborted)
-                    break;
-            }
-            const status = STATES.find((state) => state === latest?.state) ?? null;
-            const environment = typeof deployment.environment === 'string' && deployment.environment.length <= 100
-                && !/[\u0000-\u001f\u007f]/.test(deployment.environment) ? deployment.environment : null;
-            const pullRequests = [];
-            for (const item of pulls) {
-                const pull = record(item);
-                if (pull && positiveInteger(pull.number) && (pull.state === 'open' || pull.state === 'closed')
-                    && record(pull.head)?.sha === deployment.sha) {
-                    pullRequests.push({ number: pull.number, state: pull.state });
-                }
-            }
-            evidence.push({ id: deployment.id, sha: deployment.sha, environment, status,
-                previewUrl: status ? previewUrl(latest?.environment_url) : null, pullRequests });
-        }
-        incomplete ||= dependencies.signal?.aborted ?? false;
-        return { coverage: COVERAGE, deployments: evidence,
-            ...(incomplete ? { error: FAILURE } : { emptyDeploymentHistory: deployments.length === 0 }) };
-    }
-    catch {
-        return { coverage: COVERAGE, deployments: [], error: FAILURE };
-    }
-}

package/dist/playbook/netlify-pattern.js

@@ -1,24 +0,0 @@
-/** Keep Netlify's repository-wide pattern tied to successful discovery evidence. */
-export function netlifyPatternError(body, observed) {
-    const pattern = body.previewUrlPattern;
-    if (typeof pattern !== 'string')
-        return null;
-    let netlify = /netlify\.app|<site>/i.test(pattern);
-    try {
-        const hostname = new URL(pattern.replaceAll('{pr}', '1')).hostname;
-        netlify ||= hostname === 'netlify.app' || hostname.endsWith('.netlify.app');
-    }
-    catch { /* The canonical validation below rejects malformed Netlify patterns. */ }
-    if (!netlify)
-        return null;
-    const match = /^https:\/\/deploy-preview-\{pr\}--([a-z0-9](?:[a-z0-9-]*[a-z0-9])?)\.netlify\.app$/.exec(pattern);
-    if (!match || match[1].length > 63)
-        return 'Use a real Netlify site pattern from successful preview evidence; placeholders and malformed patterns are not saved.';
-    if (Object.hasOwn(body, 'appKey'))
-        return 'A Netlify preview URL pattern belongs to the repository; omit appKey.';
-    if (body.intendedMethod !== 'preview-deploy')
-        return 'Save a Netlify pattern with intendedMethod preview-deploy.';
-    if (!observed.has(pattern))
-        return 'Read this repository\'s Netlify previews first and choose a pattern backed by a successful current-head status.';
-    return null;
-}

package/dist/playbook/netlify-previews.js

@@ -1,144 +0,0 @@
-import { execFile } from 'node:child_process';
-import { promisify } from 'node:util';
-const execFileAsync = promisify(execFile);
-const FAILURE = 'Netlify preview evidence could not be read completely.';
-const COVERAGE = 'Only the 20 most recently updated pull requests, the newest 100 statuses on each exact head SHA, and the 100 most recently updated repository issue comments are checked. Context-derived URLs do not prove the application rendered. Bot comments are historical candidates, not current-head deployment proof. Missing evidence does not prove previews are absent.';
-const SITE = '[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?';
-const CONTEXT = new RegExp(`^netlify/(${SITE})/deploy-preview$`);
-const PREVIEW_HOST = new RegExp(`^deploy-preview-([1-9][0-9]*)--(${SITE})\\.netlify\\.app$`);
-const STATES = ['success', 'pending', 'failure', 'error'];
-function record(value) {
-    return value !== null && typeof value === 'object' && !Array.isArray(value)
-        ? value : undefined;
-}
-function cleanUrl(value) {
-    if (typeof value !== 'string' || value.length > 2048 || !/^https:\/\/[^\s\\?#@]+$/i.test(value))
-        return;
-    try {
-        const url = new URL(value);
-        if (!url.username && !url.password && !url.port && !url.search && !url.hash)
-            return url;
-    }
-    catch { /* Discard unsafe evidence without returning it. */ }
-}
-function urls(pull, site) {
-    if (`deploy-preview-${pull.number}--${site}`.length > 63)
-        return;
-    return {
-        previewUrl: `https://deploy-preview-${pull.number}--${site}.netlify.app/`,
-        previewUrlPattern: `https://deploy-preview-{pr}--${site}.netlify.app`,
-    };
-}
-function validTarget(value, pull, site) {
-    if (value === null || value === undefined || value === '')
-        return true;
-    const target = cleanUrl(value);
-    if (!target)
-        return false;
-    if (target.hostname === `deploy-preview-${pull.number}--${site}.netlify.app` && target.pathname === '/')
-        return true;
-    return target.hostname === 'app.netlify.com'
-        && new RegExp(`^/(?:sites|projects)/${site}/deploys(?:/[a-zA-Z0-9_-]+)?/?$`).test(target.pathname);
-}
-/** Read a bounded, repository-scoped projection; never expose comments, command errors or credentials. */
-export async function readNetlifyPreviews(owner, repo, dependencies = {}) {
-    const previews = [];
-    if (!/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/.test(owner)
-        || !/^[a-zA-Z0-9_.-]{1,100}$/.test(repo) || repo === '.' || repo === '..') {
-        return { coverage: COVERAGE, previews, error: FAILURE };
-    }
-    const runGh = dependencies.runGh ?? (async (args) => {
-        const { stdout } = await execFileAsync('gh', args, {
-            encoding: 'utf8', timeout: 30_000, maxBuffer: 2 * 1024 * 1024, signal: dependencies.signal,
-        });
-        return stdout;
-    });
-    const base = `/repos/${owner}/${repo}`;
-    async function get(route, limit) {
-        if (dependencies.signal?.aborted)
-            throw new Error();
-        const raw = await runGh(['api', '--hostname', 'github.com', '--method', 'GET', route]);
-        if (dependencies.signal?.aborted)
-            throw new Error();
-        const data = JSON.parse(raw);
-        if (!Array.isArray(data))
-            throw new Error();
-        return data.slice(0, limit);
-    }
-    const [pullRead, commentRead] = await Promise.allSettled([
-        get(`${base}/pulls?state=all&sort=updated&direction=desc&per_page=20`, 20),
-        get(`${base}/issues/comments?sort=updated&direction=desc&per_page=100`, 100),
-    ]);
-    if (pullRead.status === 'rejected')
-        return { coverage: COVERAGE, previews, error: FAILURE };
-    let incomplete = false;
-    const warnings = commentRead.status === 'rejected'
-        ? ['Historical Netlify bot comments could not be read. Current-head status evidence is still checked.'] : [];
-    const pulls = new Map();
-    for (const item of pullRead.value) {
-        const pull = record(item);
-        const headSha = record(pull?.head)?.sha;
-        if (!pull || typeof pull.number !== 'number' || !Number.isSafeInteger(pull.number) || pull.number <= 0
-            || (pull.state !== 'open' && pull.state !== 'closed') || typeof headSha !== 'string' || !/^[a-f0-9]{40}$/.test(headSha))
-            continue;
-        const issueUrl = `https://api.github.com${base}/issues/${pull.number}`;
-        if (!pulls.has(issueUrl))
-            pulls.set(issueUrl, { number: pull.number, state: pull.state, headSha });
-    }
-    const seen = new Set();
-    const statusesBySha = new Map();
-    for (const pull of pulls.values()) {
-        if (dependencies.signal?.aborted) {
-            incomplete = true;
-            break;
-        }
-        try {
-            if (!statusesBySha.has(pull.headSha)) {
-                statusesBySha.set(pull.headSha, get(`${base}/commits/${pull.headSha}/statuses?per_page=100`, 100));
-            }
-            for (const item of await statusesBySha.get(pull.headSha)) {
-                const status = record(item);
-                const site = typeof status?.context === 'string' ? CONTEXT.exec(status.context)?.[1] : undefined;
-                if (!site || seen.has(`${pull.number}:${site}`))
-                    continue;
-                // GitHub returns newest first: even an invalid latest entry must hide older success.
-                seen.add(`${pull.number}:${site}`);
-                const state = STATES.find((state) => state === status?.state);
-                const canonical = urls(pull, site);
-                if (!state || !canonical || !validTarget(status?.target_url, pull, site))
-                    continue;
-                previews.push({ pullRequest: pull.number, state: pull.state, headSha: pull.headSha, site,
-                    status: state, ...canonical, source: 'commit-status', matchesHead: true });
-            }
-        }
-        catch {
-            incomplete = true;
-        }
-    }
-    if (!dependencies.signal?.aborted && commentRead.status === 'fulfilled') {
-        for (const item of commentRead.value) {
-            const comment = record(item);
-            const author = record(comment?.user);
-            const pull = typeof comment?.issue_url === 'string' ? pulls.get(comment.issue_url) : undefined;
-            if (!pull || author?.login !== 'netlify[bot]' || author.type !== 'Bot'
-                || typeof comment?.body !== 'string' || comment.body.length > 65_536)
-                continue;
-            for (const match of comment.body.matchAll(/https:\/\/[^\s<>"'()[\]`]+/gi)) {
-                const url = cleanUrl(match[0].replace(/[.,;:]+$/, ''));
-                const parts = url ? PREVIEW_HOST.exec(url.hostname) : null;
-                if (!url || url.pathname !== '/' || !parts || parts[1] !== String(pull.number))
-                    continue;
-                const site = parts[2];
-                const canonical = urls(pull, site);
-                if (!canonical || seen.has(`${pull.number}:${site}`))
-                    continue;
-                seen.add(`${pull.number}:${site}`);
-                previews.push({ pullRequest: pull.number, state: pull.state, headSha: pull.headSha, site,
-                    status: null, ...canonical, source: 'bot-comment', matchesHead: false });
-            }
-        }
-    }
-    if (dependencies.signal?.aborted)
-        incomplete = true;
-    return { coverage: COVERAGE, previews, ...(warnings.length ? { warnings } : {}), ...(incomplete ? { error: FAILURE } : {}) };
-}

package/dist/playbook/probe-preview.js

@@ -1,67 +0,0 @@
-function redirectGate(location, source) {
-    if (!location)
-        return 'redirected';
-    try {
-        const target = new URL(location, source);
-        if (target.protocol !== 'https:')
-            return 'redirected';
-        if (target.origin === 'https://vercel.com' && target.pathname === '/sso-api'
-            && target.searchParams.has('url'))
-            return 'vercel-protection';
-        if ((target.hostname === 'vercel.com' || target.hostname.endsWith('.vercel.com'))
-            && /^\/login(?:\/|$)/.test(target.pathname))
-            return 'vercel-protection';
-        if (target.hostname.endsWith('.cloudflareaccess.com'))
-            return 'cloudflare-access';
-        if (target.origin === source.origin && /^\/(?:login|sign-in|signin)(?:\/|$)/.test(target.pathname)) {
-            return 'app-sign-in';
-        }
-    }
-    catch {
-        // A malformed redirect reveals nothing about preview protection.
-    }
-    return 'redirected';
-}
-/** An unauthenticated HTTP check only: reachable does not prove this is the intended app. */
-export async function probePreview(url, dependencies = {}) {
-    let target;
-    try {
-        target = new URL(url);
-        if (!isPlatformPreview(target)
-            || /[?#\\\s]/.test(url) || !/^https:\/\//i.test(url))
-            throw new Error();
-    }
-    catch {
-        return { status: null, gate: 'unavailable', error: 'invalid-preview-url' };
-    }
-    const controller = new AbortController();
-    const timeout = setTimeout(() => controller.abort(), 15_000);
-    const signal = dependencies.signal
-        ? AbortSignal.any([controller.signal, dependencies.signal])
-        : controller.signal;
-    try {
-        signal.throwIfAborted();
-        const response = dependencies.fetch ? await dependencies.fetch(target, {
-            method: 'GET',
-            headers: { accept: 'text/html' },
-            credentials: 'omit',
-            redirect: 'manual',
-            signal,
-        }) : await publicPreviewRequest(target, signal);
-        const status = response.status;
-        const gate = status === 401 && response.headers.get('x-vercel-error') === 'UNAUTHORIZED'
-            ? 'vercel-protection' : status >= 300 && status < 400
-            ? redirectGate(response.headers.get('location'), target)
-            : status >= 200 && status < 300 ? 'reachable' : 'unavailable';
-        // Bodies and redirect details may contain credentials; never read or return them.
-        await response.body?.cancel().catch(() => undefined);
-        return { status, gate };
-    }
-    catch {
-        return { status: null, gate: 'unavailable', error: 'request-failed' };
-    }
-    finally {
-        clearTimeout(timeout);
-    }
-}
-import { isPlatformPreview, publicPreviewRequest } from './public-preview-request.js';

package/dist/playbook/protection-secrets.js

@@ -1,15 +0,0 @@
-/** Register credential-shaped write fields before a message can be recorded.
- * Do not trust the requested path: even a refused or malformed destination must
- * keep its supplied credentials private. Values remain unchanged in memory.
- */
-export function protectionWriteSecrets(input) {
-    if (!input || typeof input !== 'object' || Array.isArray(input))
-        return [];
-    const body = input.body;
-    if (!body || typeof body !== 'object' || Array.isArray(body))
-        return [];
-    return ['value', 'clientId', 'clientSecret']
-        .map((key) => body[key])
-        .filter((value) => typeof value === 'string' && value.length > 0)
-        .sort((a, b) => b.length - a.length);
-}

package/dist/playbook/public-preview-request.js

@@ -1,96 +0,0 @@
-import { lookup } from 'node:dns/promises';
-import { request } from 'node:https';
-import { BlockList, isIP } from 'node:net';
-const blockedV4 = new BlockList();
-for (const [address, prefix] of [
-    ['0.0.0.0', 8], ['10.0.0.0', 8], ['100.64.0.0', 10], ['127.0.0.0', 8],
-    ['169.254.0.0', 16], ['172.16.0.0', 12], ['192.0.0.0', 24], ['192.0.2.0', 24],
-    ['192.88.99.0', 24], ['192.168.0.0', 16], ['198.18.0.0', 15], ['198.51.100.0', 24],
-    ['203.0.113.0', 24], ['224.0.0.0', 4], ['240.0.0.0', 4],
-])
-    blockedV4.addSubnet(address, prefix, 'ipv4');
-const publicV6 = new BlockList();
-publicV6.addSubnet('2000::', 3, 'ipv6');
-const blockedV6 = new BlockList();
-// Conservatively exclude special-purpose, transition and documentation prefixes.
-for (const [address, prefix] of [
-    ['2001::', 23], ['2001:db8::', 32], ['2002::', 16], ['3fff::', 20],
-])
-    blockedV6.addSubnet(address, prefix, 'ipv6');
-export function isPlatformPreview(target) {
-    return target.protocol === 'https:' && !target.username && !target.password && !target.port
-        && !/[?#]/.test(target.href)
-        && /^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+(?:vercel|netlify)\.app$/.test(target.hostname);
-}
-function isPublicAddress(value) {
-    if (!value || typeof value.address !== 'string' || value.address.includes('%'))
-        return false;
-    const family = isIP(value.address);
-    if (family !== value.family)
-        return false;
-    if (family === 4)
-        return !blockedV4.check(value.address, 'ipv4');
-    return family === 6 && publicV6.check(value.address, 'ipv6') && !blockedV6.check(value.address, 'ipv6');
-}
-/** Resolve once, validate every answer, then connect only to the pinned public addresses. */
-export async function publicPreviewRequest(target, signal, dependencies = {}) {
-    try {
-        if (!isPlatformPreview(target))
-            throw new Error();
-        signal.throwIfAborted();
-        let abortDns = () => { };
-        const aborted = new Promise((_resolve, reject) => {
-            abortDns = () => reject(new Error());
-            signal.addEventListener('abort', abortDns, { once: true });
-        });
-        const addresses = await Promise.race([
-            (dependencies.lookup ?? lookup)(target.hostname, { all: true, verbatim: true }), aborted,
-        ]).finally(() => signal.removeEventListener('abort', abortDns));
-        signal.throwIfAborted();
-        if (!Array.isArray(addresses) || !addresses.length || !addresses.every(isPublicAddress))
-            throw new Error();
-        const pinned = addresses.map(({ address, family }) => ({ address, family }));
-        return await new Promise((resolve, reject) => {
-            const options = {
-                method: 'GET', headers: { accept: 'text/html' }, signal,
-                agent: false, autoSelectFamily: true, rejectUnauthorized: true,
-                lookup(hostname, options, callback) {
-                    if (hostname !== target.hostname)
-                        return callback(new Error('Preview request failed'), '');
-                    if (options.all)
-                        callback(null, pinned.map((address) => ({ ...address })));
-                    else
-                        callback(null, pinned[0].address, pinned[0].family);
-                },
-            };
-            const req = (dependencies.request ?? request)(target, options, (response) => {
-                response.once('error', () => { });
-                try {
-                    const status = response.statusCode;
-                    const headers = new Headers();
-                    for (const name of ['location', 'x-vercel-error']) {
-                        const value = response.headers[name];
-                        if (typeof value === 'string')
-                            headers.set(name, value);
-                    }
-                    if (!status)
-                        reject(new Error());
-                    else
-                        resolve({ status, headers, body: null });
-                }
-                catch {
-                    reject(new Error());
-                }
-                finally {
-                    response.destroy();
-                }
-            });
-            req.once('error', () => reject(new Error()));
-            req.once('upgrade', (_response, socket) => { socket.destroy(); reject(new Error()); });
-            req.end();
-        });
-    }
-    catch {
-        throw new Error('Preview request failed');
-    }
-}

package/dist/playbook/publication-wait.js

@@ -1,46 +0,0 @@
-import { setTimeout as sleep } from 'node:timers/promises';
-const INTERVAL_MS = 30_000;
-const DEADLINE_MS = 8 * 60_000;
-/** One publication deadline per setup PR, including time spent checking the preview. */
-export function createPublicationWait(dependencies = {}) {
-    const now = dependencies.now ?? (() => performance.now());
-    const pause = dependencies.sleep ?? ((ms, signal) => sleep(ms, undefined, { signal }));
-    const starts = new Map();
-    return {
-        begin(pr) {
-            if (!starts.has(pr))
-                starts.set(pr, now());
-        },
-        remainingMs(pr) {
-            const start = starts.get(pr);
-            return start === undefined ? null : Math.max(0, DEADLINE_MS - (now() - start));
-        },
-        async wait(pr, signal) {
-            const start = starts.get(pr);
-            if (start === undefined)
-                return null;
-            const result = (status) => {
-                const elapsed = Math.max(0, now() - start);
-                return {
-                    status,
-                    waited_seconds: Math.floor(elapsed / 1000),
-                    remaining_seconds: Math.ceil(Math.max(0, DEADLINE_MS - elapsed) / 1000),
-                };
-            };
-            if (signal?.aborted)
-                return result('cancelled');
-            const remaining = DEADLINE_MS - (now() - start);
-            if (remaining <= 0)
-                return result('timed-out');
-            try {
-                await pause(Math.min(INTERVAL_MS, remaining), signal);
-            }
-            catch {
-                return result('cancelled');
-            }
-            if (signal?.aborted)
-                return result('cancelled');
-            return result(now() - start >= DEADLINE_MS ? 'timed-out' : 'retry');
-        },
-    };
-}

package/dist/playbook/vercel-protection.js

@@ -1,121 +0,0 @@
-import { execFile } from 'node:child_process';
-import { constants } from 'node:fs';
-import { lstat, open, realpath } from 'node:fs/promises';
-import { join } from 'node:path';
-const METADATA_LIMIT = 16 * 1024;
-const OUTPUT_LIMIT = 2 * 1024 * 1024;
-function record(value) {
-    return value !== null && typeof value === 'object' && !Array.isArray(value)
-        ? value : undefined;
-}
-/** Only the root's small project-link metadata is read; CLI authentication stays with the CLI. */
-async function linkedProject(cwd) {
-    try {
-        const root = await realpath(cwd);
-        const directory = join(root, '.vercel');
-        const directoryStat = await lstat(directory);
-        if (!directoryStat.isDirectory() || directoryStat.isSymbolicLink() || await realpath(directory) !== directory)
-            return;
-        const path = join(directory, 'project.json');
-        if (!(await lstat(path)).isFile())
-            return;
-        const file = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
-        try {
-            const stat = await file.stat();
-            const currentDirectory = await lstat(directory);
-            const currentFile = await lstat(path);
-            if (!stat.isFile() || stat.size > METADATA_LIMIT
-                || currentDirectory.dev !== directoryStat.dev || currentDirectory.ino !== directoryStat.ino
-                || currentFile.isSymbolicLink() || currentFile.dev !== stat.dev || currentFile.ino !== stat.ino
-                || await realpath(path) !== path)
-                return;
-            const buffer = Buffer.alloc(METADATA_LIMIT + 1);
-            const { bytesRead } = await file.read(buffer, 0, buffer.length, 0);
-            if (bytesRead > METADATA_LIMIT)
-                return;
-            const metadata = record(JSON.parse(buffer.toString('utf8', 0, bytesRead)));
-            if (typeof metadata?.projectId !== 'string' || !/^prj_[A-Za-z0-9]{1,128}$/.test(metadata.projectId)
-                || typeof metadata.orgId !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/.test(metadata.orgId))
-                return;
-            return { root, projectId: metadata.projectId, orgId: metadata.orgId };
-        }
-        finally {
-            await file.close();
-        }
-    }
-    catch {
-        return;
-    }
-}
-/** Reuse one existing default automation bypass in memory, without exposing project responses or keys. */
-export async function useExistingVercelBypass(input, dependencies) {
-    const { signal } = dependencies;
-    if (signal?.aborted)
-        return { status: 'cancelled' };
-    if (!/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/.test(input.owner)
-        || !/^[a-zA-Z0-9_.-]{1,100}$/.test(input.repo) || input.repo === '.' || input.repo === '..') {
-        return { status: 'project-mismatch' };
-    }
-    const linked = await linkedProject(input.cwd);
-    if (signal?.aborted)
-        return { status: 'cancelled' };
-    if (!linked)
-        return { status: 'not-linked' };
-    const runVercel = dependencies.runVercel ?? ((args) => new Promise((resolve, reject) => {
-        const child = execFile('vercel', args, {
-            cwd: linked.root, encoding: 'utf8', timeout: 30_000, maxBuffer: OUTPUT_LIMIT, signal,
-        }, (error, stdout) => error ? reject(new Error('Vercel project lookup failed.')) : resolve(stdout));
-        child.stdin?.end();
-    }));
-    // teamId selects the linked team. Legacy personal projects omit it and still require accountId to match.
-    const route = `/v9/projects/${linked.projectId}${linked.orgId.startsWith('team_') ? `?teamId=${linked.orgId}` : ''}`;
-    let selected;
-    try {
-        const stdout = await runVercel(['api', route, '--method', 'GET', '--raw', '--non-interactive'], signal);
-        if (signal?.aborted)
-            return { status: 'cancelled' };
-        if (Buffer.byteLength(stdout, 'utf8') > OUTPUT_LIMIT)
-            return { status: 'unavailable' };
-        const project = record(JSON.parse(stdout));
-        const link = record(project?.link);
-        if (project?.id !== linked.projectId || project.accountId !== linked.orgId
-            || !link || !['github', 'github-limited'].includes(String(link.type))
-            || typeof link.org !== 'string' || link.org.toLowerCase() !== input.owner.toLowerCase()
-            || typeof link.repo !== 'string' || link.repo.toLowerCase() !== input.repo.toLowerCase()) {
-            return { status: 'project-mismatch' };
-        }
-        const bypasses = record(project.protectionBypass);
-        if (!bypasses || Object.keys(bypasses).length > 128)
-            return { status: 'unavailable' };
-        const candidates = [];
-        for (const [value, metadata] of Object.entries(bypasses)) {
-            const bypass = record(metadata);
-            if (bypass?.scope !== 'automation-bypass')
-                continue;
-            if (!/^[A-Za-z0-9]{32}$/.test(value)
-                || (bypass.isEnvVar !== undefined && typeof bypass.isEnvVar !== 'boolean'))
-                return { status: 'unavailable' };
-            // An omitted isEnvVar is the legacy default. Explicit false keys must never be chosen implicitly.
-            if (bypass.isEnvVar !== false)
-                candidates.push(value);
-        }
-        if (candidates.length > 1)
-            return { status: 'ambiguous' };
-        if (candidates.length === 0)
-            return { status: 'unavailable' };
-        selected = candidates[0];
-        dependencies.rememberSecret(selected);
-    }
-    catch {
-        return { status: signal?.aborted ? 'cancelled' : 'unavailable' };
-    }
-    if (signal?.aborted)
-        return { status: 'cancelled' };
-    try {
-        const status = await dependencies.save(selected);
-        return { status: ['saved', 'save-failed', 'partial-save', 'cancelled'].includes(status) ? status : 'save-failed' };
-    }
-    catch {
-        return { status: signal?.aborted ? 'cancelled' : 'save-failed' };
-    }
-}