@reddoorla/maintenance 0.55.0 → 0.57.0

package/dist/recipes/sync-configs.js

@@ -1,508 +1,12 @@
-// src/recipes/sync-configs.ts
-import { readFile, writeFile, mkdir } from "fs/promises";
-import { join, dirname } from "path";
-
-// src/recipes/sync-configs/templates.ts
-var eslint = {
-  config: "eslint",
-  path: "eslint.config.js",
-  contents: `import { createEslintConfig } from "@reddoorla/maintenance/configs/eslint";
-import svelteConfig from "./svelte.config.js";
-
-export default createEslintConfig({ svelteConfig });
-`
-};
-var prettier = {
-  config: "prettier",
-  path: ".prettierrc.json",
-  contents: `{
-  "trailingComma": "all",
-  "singleQuote": false,
-  "printWidth": 100,
-  "plugins": ["prettier-plugin-svelte"]
-}
-`
-};
-var prettierIgnore = {
-  config: "prettier-ignore",
-  path: ".prettierignore",
-  contents: `pnpm-lock.yaml
-.svelte-kit/
-build/
-.netlify/
-dist/
-`
-};
-var lighthouse = {
-  config: "lighthouse",
-  path: "lighthouserc.json",
-  contents: `${JSON.stringify(
-    {
-      $note: "Generated by @reddoorla/maintenance sync-configs; edit src/configs/lighthouse.ts in the package instead.",
-      extends: "@reddoorla/maintenance/configs/lighthouse"
-    },
-    null,
-    2
-  )}
-`
-};
-var playwrightA11y = {
-  config: "playwright-a11y",
-  path: "playwright.config.ts",
-  contents: `export { default } from "@reddoorla/maintenance/configs/playwright-a11y";
-`
-};
-var svelte = {
-  config: "svelte",
-  path: "svelte.config.js",
-  contents: `import { createSvelteConfig } from "@reddoorla/maintenance/configs/svelte";
-import adapter from "@sveltejs/adapter-netlify";
-
-/** @type {import('@sveltejs/kit').Config} */
-export default createSvelteConfig({
-  kit: { adapter: adapter({ edge: false, split: false }) },
-});
-`
-};
-var ci = {
-  config: "ci",
-  path: ".github/workflows/ci.yml",
-  contents: `name: ci
-on:
-  pull_request:
-  push:
-    branches: [main]
-jobs:
-  ci:
-    uses: reddoorla/.github/.github/workflows/ci.yml@78c4da64b675f0f474961f12715f2a4c09d46eb5 # v1.0.0
-`
-};
-var renovateAction = {
-  config: "renovate-action",
-  path: ".github/workflows/renovate.yml",
-  contents: `name: renovate
-on:
-  schedule:
-    - cron: "0 7 * * 1"
-  workflow_dispatch:
-jobs:
-  renovate:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: renovatebot/github-action@v46.1.14
-        with:
-          token: \${{ secrets.RENOVATE_TOKEN }}
-        env:
-          RENOVATE_REPOSITORIES: \${{ github.repository }}
-`
-};
-var renovateConfig = {
-  config: "renovate-config",
-  path: "renovate.json",
-  contents: `{
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": ["github>reddoorla/.github:renovate-config"]
-}
-`
-};
-var netlify = {
-  config: "netlify",
-  path: "netlify.toml",
-  contents: `[build]
-    command = "pnpm build"
-    publish = "build/"
-    functions = "functions/"
-
-[build.environment]
-    NODE_VERSION = "22"
-    COREPACK_INTEGRITY_KEYS = "0"
-
-# Baseline security headers for all responses. CSP is emitted per-response by
-# SvelteKit (see \`kit.csp\` in svelte.config.js) so it is intentionally omitted
-# here to avoid conflicting duplicates.
-[[headers]]
-    for = "/*"
-    [headers.values]
-        Strict-Transport-Security = "max-age=63072000; includeSubDomains; preload"
-        X-Content-Type-Options = "nosniff"
-        X-Frame-Options = "SAMEORIGIN"
-        Referrer-Policy = "strict-origin-when-cross-origin"
-        Permissions-Policy = "camera=(), microphone=(), geolocation=(), interest-cohort=()"
-        Cross-Origin-Opener-Policy = "same-origin"
-
-[[headers]]
-    for = "/favicon.png"
-    [headers.values]
-        Cache-Control = "public, max-age=31536000, immutable"
-
-[[headers]]
-    for = "/_app/immutable/*"
-    [headers.values]
-        Cache-Control = "public, max-age=31536000, immutable"
-`
-};
-var ALL_TEMPLATES = [
-  eslint,
-  prettier,
-  prettierIgnore,
-  lighthouse,
-  playwrightA11y,
-  svelte,
-  ci,
-  renovateAction,
-  renovateConfig,
-  netlify
-];
-function templatesByName(which) {
-  return ALL_TEMPLATES.filter((t) => which.includes(t.config));
-}
-
-// src/recipes/sync-configs/gitignore.ts
-var MANAGED_MARKER = "# canonical entries from @reddoorla/maintenance sync-configs";
-var CANONICAL_GITIGNORE_ENTRIES = [
-  "node_modules/",
-  "build/",
-  "dist/",
-  ".svelte-kit/",
-  "coverage/",
-  ".vitest-cache/",
-  "playwright-report/",
-  "test-results/",
-  ".lighthouseci/",
-  ".tsbuildinfo",
-  ".env",
-  ".env.*",
-  "!.env.example",
-  ".DS_Store",
-  "*.log",
-  ".vercel/",
-  ".netlify/",
-  ".reddoor-a11y/",
-  // The a11y audit's transient spec dir, written inside the checkout and
-  // normally cleaned, but a timeout-SIGKILL of the parent orphans it. Ignored
-  // fleet-wide so it never dirties a self-updating repo's tree (2026-06-10 M-D).
-  ".reddoor-a11y-spec-*/"
-];
-function stripLeadingSlash(s) {
-  return s.startsWith("/") ? s.slice(1) : s;
-}
-function stripTrailingSlash(s) {
-  return s.endsWith("/") ? s.slice(0, -1) : s;
-}
-function normalizePresence(line) {
-  return stripTrailingSlash(stripLeadingSlash(line.trim()));
-}
-function presentSet(existing) {
-  const set = /* @__PURE__ */ new Set();
-  for (const raw of existing.split(/\r?\n/)) {
-    const trimmed = raw.trim();
-    if (!trimmed) continue;
-    if (trimmed.startsWith("#")) continue;
-    set.add(normalizePresence(trimmed));
-  }
-  return set;
-}
-function mergeGitignore(existing, canonical) {
-  if (existing === null) {
-    const body = [MANAGED_MARKER, ...canonical].join("\n") + "\n";
-    return { content: body, added: [...canonical] };
-  }
-  const present = presentSet(existing);
-  const added = [];
-  for (const entry of canonical) {
-    const norm = normalizePresence(entry);
-    if (!present.has(norm)) {
-      added.push(entry);
-      present.add(norm);
-    }
-  }
-  if (added.length === 0) {
-    return { content: existing, added: [] };
-  }
-  let base = existing;
-  if (!base.endsWith("\n")) base += "\n";
-  const block = ["", MANAGED_MARKER, ...added].join("\n") + "\n";
-  return { content: base + block, added };
-}
-function findTrackedArtifacts(tracked, canonical) {
-  const dirEntries = [];
-  for (const raw of canonical) {
-    const t = raw.trim();
-    if (!t) continue;
-    if (t.startsWith("!")) continue;
-    if (/[*?[]/.test(t)) continue;
-    const noLead = stripLeadingSlash(t);
-    if (!noLead.endsWith("/")) continue;
-    const name = stripTrailingSlash(noLead);
-    if (!name) continue;
-    dirEntries.push(name);
-  }
-  const matched = [];
-  for (const path of tracked) {
-    for (const dir of dirEntries) {
-      if (path === dir || path.startsWith(dir + "/")) {
-        matched.push(path);
-        break;
-      }
-    }
-  }
-  return matched;
-}
-
-// src/util/git.ts
-import { execFile } from "child_process";
-import { promisify } from "util";
-var exec = promisify(execFile);
-async function git(cwd, args) {
-  return exec("git", args, { cwd, env: process.env });
-}
-function branchName(recipe, when = /* @__PURE__ */ new Date()) {
-  const compact = when.toISOString().replace(/[-:.]/g, "");
-  return `maint/${recipe}-${compact}`;
-}
-async function currentBranch(cwd) {
-  const { stdout } = await git(cwd, ["rev-parse", "--abbrev-ref", "HEAD"]);
-  return stdout.trim();
-}
-async function isWorkingTreeClean(cwd) {
-  const { stdout } = await git(cwd, ["status", "--porcelain"]);
-  return stdout.trim().length === 0;
-}
-async function createBranch(cwd, name) {
-  await git(cwd, ["checkout", "-b", name]);
-}
-async function checkoutBranch(cwd, name) {
-  await git(cwd, ["checkout", name]);
-}
-async function forceCheckoutBranch(cwd, name) {
-  await git(cwd, ["checkout", "-f", name]);
-}
-async function deleteBranch(cwd, name) {
-  await git(cwd, ["branch", "-D", name]);
-}
-async function stageAll(cwd) {
-  await git(cwd, ["add", "-A"]);
-}
-async function listTrackedFiles(cwd) {
-  const { stdout } = await git(cwd, ["ls-files"]);
-  return stdout.split("\n").map((l) => l.trim()).filter((l) => l.length > 0);
-}
-async function removeFromIndex(cwd, paths) {
-  if (paths.length === 0) return;
-  await git(cwd, ["rm", "-r", "--cached", "--", ...paths]);
-}
-async function commit(cwd, message) {
-  await stageAll(cwd);
-  const { stdout: status } = await git(cwd, ["status", "--porcelain"]);
-  if (status.trim().length === 0) return null;
-  await git(cwd, ["commit", "-m", message]);
-  const { stdout: sha } = await git(cwd, ["rev-parse", "HEAD"]);
-  return sha.trim();
-}
-
-// src/util/site.ts
-function siteLabel(site) {
-  return site.name || site.path;
-}
-
-// src/recipes/_with-recipe.ts
-async function withRecipe(body) {
-  const label = siteLabel(body.site);
-  if (body.checkTreeFirst && !await isWorkingTreeClean(body.site.path)) {
-    throw new Error(`refusing to run: working tree is not clean at ${body.site.path}`);
-  }
-  const planned = await body.plan();
-  if (planned.kind === "noop") {
-    return {
-      recipe: body.name,
-      site: label,
-      status: "noop",
-      commits: [],
-      ...planned.notes ? { notes: planned.notes } : {}
-    };
-  }
-  if (planned.kind === "failed") {
-    return {
-      recipe: body.name,
-      site: label,
-      status: "failed",
-      commits: [],
-      notes: planned.notes
-    };
-  }
-  if (!body.checkTreeFirst && !await isWorkingTreeClean(body.site.path)) {
-    throw new Error(`refusing to run: working tree is not clean at ${body.site.path}`);
-  }
-  let original = null;
-  try {
-    original = await currentBranch(body.site.path);
-  } catch {
-    original = null;
-  }
-  const branch = branchName(body.name);
-  await createBranch(body.site.path, branch);
-  const restoreOriginal = async () => {
-    if (original === null || original === branch) return;
-    try {
-      await checkoutBranch(body.site.path, original);
-    } catch (err) {
-      console.warn(
-        `warning: could not restore branch ${original} after ${body.name}: ${err instanceof Error ? err.message : String(err)}`
-      );
-    }
-  };
-  const restoreAfterFailure = async () => {
-    if (original === null || original === branch) return;
-    try {
-      await forceCheckoutBranch(body.site.path, original);
-    } catch (err) {
-      console.warn(
-        `warning: could not force-restore branch ${original} after failed ${body.name}: ${err instanceof Error ? err.message : String(err)}`
-      );
-      return;
-    }
-    try {
-      await deleteBranch(body.site.path, branch);
-    } catch (err) {
-      console.warn(
-        `warning: could not delete recipe branch ${branch} after failed ${body.name}: ${err instanceof Error ? err.message : String(err)}`
-      );
-    }
-  };
-  const shas = [];
-  let result;
-  try {
-    result = await body.apply(planned.plan, {
-      cwd: body.site.path,
-      branch,
-      commit: async (msg) => {
-        const sha = await commit(body.site.path, msg);
-        if (sha) shas.push(sha);
-        return sha;
-      }
-    });
-  } catch (err) {
-    await restoreAfterFailure();
-    throw err;
-  }
-  if (result.kind === "failed") {
-    await restoreAfterFailure();
-    return {
-      recipe: body.name,
-      site: label,
-      status: "failed",
-      commits: shas,
-      notes: result.notes
-    };
-  }
-  if (shas.length === 0) {
-    await restoreOriginal();
-  }
-  const notes = result.notes ? `${result.notes}; branch: ${branch}` : `branch: ${branch}`;
-  return {
-    recipe: body.name,
-    site: label,
-    status: shas.length > 0 ? "applied" : "noop",
-    commits: shas,
-    notes
-  };
-}
-
-// src/recipes/sync-configs.ts
-var GITIGNORE_CONFIG = "gitignore";
-var SVELTE_CONFIG = "svelte";
-var NETLIFY_CONFIG = "netlify";
-function isSvelteConfigCompliant(contents) {
-  return contents.includes("createSvelteConfig") && contents.includes("@sveltejs/adapter-netlify");
-}
-var SECURITY_HEADER_RE = /Strict-Transport-Security|Content-Security-Policy|X-Frame-Options|X-Content-Type-Options|Referrer-Policy|Permissions-Policy|Cross-Origin-Opener-Policy/i;
-function isNetlifyConfigCompliant(contents) {
-  return contents.includes("[[headers]]") && SECURITY_HEADER_RE.test(contents);
-}
-var ALL_CONFIG_NAMES = [
-  "lighthouse",
-  "eslint",
-  "prettier",
-  "prettier-ignore",
-  "playwright-a11y",
-  "svelte",
-  "gitignore",
-  "ci",
-  "renovate-action",
-  "renovate-config",
-  "netlify"
-];
-function isConfigName(value) {
-  return ALL_CONFIG_NAMES.includes(value);
-}
-async function readMaybe(path) {
-  try {
-    return await readFile(path, "utf-8");
-  } catch {
-    return null;
-  }
-}
-async function planTemplateDiffs(cwd, templates) {
-  const diffs = [];
-  for (const t of templates) {
-    const existing = await readMaybe(join(cwd, t.path));
-    if (existing === t.contents) continue;
-    if (t.config === SVELTE_CONFIG && existing !== null && isSvelteConfigCompliant(existing)) {
-      continue;
-    }
-    if (t.config === NETLIFY_CONFIG && existing !== null && isNetlifyConfigCompliant(existing)) {
-      continue;
-    }
-    diffs.push(t);
-  }
-  return diffs;
-}
-async function planGitignore(cwd) {
-  const existing = await readMaybe(join(cwd, ".gitignore"));
-  const merge = mergeGitignore(existing, CANONICAL_GITIGNORE_ENTRIES);
-  const tracked = await listTrackedFiles(cwd);
-  const toUntrack = findTrackedArtifacts(tracked, CANONICAL_GITIGNORE_ENTRIES);
-  if (merge.added.length === 0 && toUntrack.length === 0) return { kind: "noop" };
-  return { kind: "apply", content: merge.content, toUntrack, added: merge.added };
-}
-async function applyGitignore(cwd, plan) {
-  await writeFile(join(cwd, ".gitignore"), plan.content, "utf-8");
-  if (plan.toUntrack.length > 0) {
-    await removeFromIndex(cwd, plan.toUntrack);
-  }
-}
-async function syncConfigs(site, opts = {}) {
-  const requested = opts.which ?? ALL_TEMPLATES.map((t) => t.config).concat(GITIGNORE_CONFIG);
-  const templateNames = requested.filter((c) => c !== GITIGNORE_CONFIG);
-  const templates = templatesByName(templateNames);
-  const includeGitignore = requested.includes(GITIGNORE_CONFIG);
-  return withRecipe({
-    name: "sync-configs",
-    site,
-    plan: async () => {
-      const templateDiffs = await planTemplateDiffs(site.path, templates);
-      const gitignorePlan = includeGitignore ? await planGitignore(site.path) : { kind: "noop" };
-      if (templateDiffs.length === 0 && gitignorePlan.kind === "noop") {
-        return { kind: "noop", notes: "all targeted configs already match" };
-      }
-      return { kind: "apply", plan: { templateDiffs, gitignorePlan } };
-    },
-    apply: async ({ templateDiffs, gitignorePlan }, { commit: commit2 }) => {
-      for (const t of templateDiffs) {
-        const dest = join(site.path, t.path);
-        await mkdir(dirname(dest), { recursive: true });
-        await writeFile(dest, t.contents, "utf-8");
-        await commit2(`chore: sync ${t.config} config from @reddoorla/maintenance`);
-      }
-      if (gitignorePlan.kind === "apply") {
-        await applyGitignore(site.path, gitignorePlan);
-        await commit2(`chore: sync gitignore from @reddoorla/maintenance`);
-      }
-      return { kind: "ok" };
-    }
-  });
-}
+import {
+  ALL_CONFIG_NAMES,
+  isConfigName,
+  syncConfigs
+} from "../chunk-JNXCDUYB.js";
+import "../chunk-CASCWQQX.js";
+import "../chunk-XKOZUVK2.js";
+import "../chunk-XXTZBPUY.js";
+import "../chunk-XTK5VIQB.js";
 export {
   ALL_CONFIG_NAMES,
   isConfigName,

package/dist/recipes/sync-configs.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/recipes/sync-configs.ts","../../src/recipes/sync-configs/templates.ts","../../src/recipes/sync-configs/gitignore.ts","../../src/util/git.ts","../../src/util/site.ts","../../src/recipes/_with-recipe.ts"],"sourcesContent":["import { readFile, writeFile, mkdir } from \"node:fs/promises\";\nimport { join, dirname } from \"node:path\";\nimport type { RecipeResult, Site, ConfigName } from \"../types.js\";\nimport { ALL_TEMPLATES, templatesByName, type ConfigTemplate } from \"./sync-configs/templates.js\";\nimport {\n  CANONICAL_GITIGNORE_ENTRIES,\n  mergeGitignore,\n  findTrackedArtifacts,\n} from \"./sync-configs/gitignore.js\";\nimport { listTrackedFiles, removeFromIndex } from \"../util/git.js\";\nimport { withRecipe } from \"./_with-recipe.js\";\n\nexport type SyncConfigsOptions = {\n  which?: ConfigName[];\n};\n\nconst GITIGNORE_CONFIG: ConfigName = \"gitignore\";\nconst SVELTE_CONFIG: ConfigName = \"svelte\";\nconst NETLIFY_CONFIG: ConfigName = \"netlify\";\n\n/** A site's `svelte.config.js` is \"compliant\" — and left untouched by sync —\n * once it builds on the canonical helpers (createSvelteConfig + adapter-netlify).\n *\n * Unlike the other exact-match templates, svelte.config legitimately carries\n * site-specific `kit.alias` and `compilerOptions`; an exact overwrite would\n * clobber those on every sync (it silently dropped MSOT's $utils alias,\n * 2026-06-04). So once a config is on the canonical pattern we preserve it as-is\n * and only rewrite a genuinely off-pattern (or missing) config. `createSvelteConfig`\n * now provides the canonical `$lib` aliases itself, and a site's own `kit.alias`\n * overrides per key (and may add more), so a site's additive customization is safe\n * to preserve. */\nfunction isSvelteConfigCompliant(contents: string): boolean {\n  return contents.includes(\"createSvelteConfig\") && contents.includes(\"@sveltejs/adapter-netlify\");\n}\n\n/** Any of the baseline security headers — the marker that a netlify.toml is\n * deliberately hardened (vs. e.g. a cache-control-only `[[headers]]` block). */\nconst SECURITY_HEADER_RE =\n  /Strict-Transport-Security|Content-Security-Policy|X-Frame-Options|X-Content-Type-Options|Referrer-Policy|Permissions-Policy|Cross-Origin-Opener-Policy/i;\n\n/** A site's `netlify.toml` is \"compliant\" — and left untouched by sync — once it\n * carries a `[[headers]]` block AND a security header (HSTS/CSP/X-Frame-Options/…).\n *\n * Like svelte.config, netlify.toml legitimately holds site-specific config\n * (custom CSP, redirects, per-route headers). The canonical template ships the\n * baseline security headers, but an exact overwrite would CLOBBER a site's own\n * hardening — that bug stripped gallerysonder's headers on a routine sync\n * (2026-06-10). So a genuinely-hardened file is left alone, while a missing,\n * header-less (previously-stripped), OR merely cache-header file is non-compliant\n * and gets the canonical template, which backfills the security baseline. */\nfunction isNetlifyConfigCompliant(contents: string): boolean {\n  return contents.includes(\"[[headers]]\") && SECURITY_HEADER_RE.test(contents);\n}\n\n/** Runtime enumeration of every `ConfigName`. Mirror of the union in\n * `src/types.ts`. Used by CLI `--only` validation; a missing entry would\n * silently accept typos. The type-test in `tests/types.test.ts` guards\n * against drift between this array and the union. */\nexport const ALL_CONFIG_NAMES: ConfigName[] = [\n  \"lighthouse\",\n  \"eslint\",\n  \"prettier\",\n  \"prettier-ignore\",\n  \"playwright-a11y\",\n  \"svelte\",\n  \"gitignore\",\n  \"ci\",\n  \"renovate-action\",\n  \"renovate-config\",\n  \"netlify\",\n];\n\nexport function isConfigName(value: string): value is ConfigName {\n  return (ALL_CONFIG_NAMES as string[]).includes(value);\n}\n\nasync function readMaybe(path: string): Promise<string | null> {\n  try {\n    return await readFile(path, \"utf-8\");\n  } catch {\n    return null;\n  }\n}\n\nasync function planTemplateDiffs(\n  cwd: string,\n  templates: ConfigTemplate[],\n): Promise<ConfigTemplate[]> {\n  const diffs: ConfigTemplate[] = [];\n  for (const t of templates) {\n    const existing = await readMaybe(join(cwd, t.path));\n    if (existing === t.contents) continue;\n    // svelte.config is compliance-checked, not exact-matched: an existing config\n    // already on the canonical pattern is left alone so its aliases/compilerOptions\n    // survive. A missing (null) or off-pattern config still gets the canonical template.\n    if (t.config === SVELTE_CONFIG && existing !== null && isSvelteConfigCompliant(existing)) {\n      continue;\n    }\n    // netlify.toml is likewise compliance-checked: a file that already carries\n    // `[[headers]]` is hardened and left alone (an exact overwrite would strip\n    // its security headers). A header-less / missing file gets the template.\n    if (t.config === NETLIFY_CONFIG && existing !== null && isNetlifyConfigCompliant(existing)) {\n      continue;\n    }\n    diffs.push(t);\n  }\n  return diffs;\n}\n\ntype GitignorePlan =\n  | { kind: \"noop\" }\n  | { kind: \"apply\"; content: string; toUntrack: string[]; added: string[] };\n\nasync function planGitignore(cwd: string): Promise<GitignorePlan> {\n  const existing = await readMaybe(join(cwd, \".gitignore\"));\n  const merge = mergeGitignore(existing, CANONICAL_GITIGNORE_ENTRIES);\n  const tracked = await listTrackedFiles(cwd);\n  const toUntrack = findTrackedArtifacts(tracked, CANONICAL_GITIGNORE_ENTRIES);\n  if (merge.added.length === 0 && toUntrack.length === 0) return { kind: \"noop\" };\n  return { kind: \"apply\", content: merge.content, toUntrack, added: merge.added };\n}\n\nasync function applyGitignore(\n  cwd: string,\n  plan: Extract<GitignorePlan, { kind: \"apply\" }>,\n): Promise<void> {\n  await writeFile(join(cwd, \".gitignore\"), plan.content, \"utf-8\");\n  if (plan.toUntrack.length > 0) {\n    await removeFromIndex(cwd, plan.toUntrack);\n  }\n}\n\nexport async function syncConfigs(\n  site: Site,\n  opts: SyncConfigsOptions = {},\n): Promise<RecipeResult> {\n  const requested = opts.which ?? ALL_TEMPLATES.map((t) => t.config).concat(GITIGNORE_CONFIG);\n  const templateNames = requested.filter((c): c is ConfigName => c !== GITIGNORE_CONFIG);\n  const templates = templatesByName(templateNames);\n  const includeGitignore = requested.includes(GITIGNORE_CONFIG);\n\n  return withRecipe({\n    name: \"sync-configs\",\n    site,\n    plan: async () => {\n      const templateDiffs = await planTemplateDiffs(site.path, templates);\n      const gitignorePlan: GitignorePlan = includeGitignore\n        ? await planGitignore(site.path)\n        : { kind: \"noop\" };\n      if (templateDiffs.length === 0 && gitignorePlan.kind === \"noop\") {\n        return { kind: \"noop\", notes: \"all targeted configs already match\" };\n      }\n      return { kind: \"apply\", plan: { templateDiffs, gitignorePlan } };\n    },\n    apply: async ({ templateDiffs, gitignorePlan }, { commit }) => {\n      for (const t of templateDiffs) {\n        const dest = join(site.path, t.path);\n        await mkdir(dirname(dest), { recursive: true });\n        await writeFile(dest, t.contents, \"utf-8\");\n        await commit(`chore: sync ${t.config} config from @reddoorla/maintenance`);\n      }\n      if (gitignorePlan.kind === \"apply\") {\n        await applyGitignore(site.path, gitignorePlan);\n        await commit(`chore: sync gitignore from @reddoorla/maintenance`);\n      }\n      return { kind: \"ok\" };\n    },\n  });\n}\n","import type { ConfigName } from \"../../types.js\";\n\nexport type ConfigTemplate = {\n  config: ConfigName;\n  path: string;\n  contents: string;\n};\n\nconst eslint: ConfigTemplate = {\n  config: \"eslint\",\n  path: \"eslint.config.js\",\n  contents: `import { createEslintConfig } from \"@reddoorla/maintenance/configs/eslint\";\nimport svelteConfig from \"./svelte.config.js\";\n\nexport default createEslintConfig({ svelteConfig });\n`,\n};\n\nconst prettier: ConfigTemplate = {\n  config: \"prettier\",\n  path: \".prettierrc.json\",\n  contents: `{\n  \"trailingComma\": \"all\",\n  \"singleQuote\": false,\n  \"printWidth\": 100,\n  \"plugins\": [\"prettier-plugin-svelte\"]\n}\n`,\n};\n\nconst prettierIgnore: ConfigTemplate = {\n  config: \"prettier-ignore\",\n  path: \".prettierignore\",\n  contents: `pnpm-lock.yaml\n.svelte-kit/\nbuild/\n.netlify/\ndist/\n`,\n};\n\nconst lighthouse: ConfigTemplate = {\n  config: \"lighthouse\",\n  path: \"lighthouserc.json\",\n  contents: `${JSON.stringify(\n    {\n      $note:\n        \"Generated by @reddoorla/maintenance sync-configs; edit src/configs/lighthouse.ts in the package instead.\",\n      extends: \"@reddoorla/maintenance/configs/lighthouse\",\n    },\n    null,\n    2,\n  )}\n`,\n};\n\nconst playwrightA11y: ConfigTemplate = {\n  config: \"playwright-a11y\",\n  path: \"playwright.config.ts\",\n  contents: `export { default } from \"@reddoorla/maintenance/configs/playwright-a11y\";\n`,\n};\n\nconst svelte: ConfigTemplate = {\n  config: \"svelte\",\n  path: \"svelte.config.js\",\n  contents: `import { createSvelteConfig } from \"@reddoorla/maintenance/configs/svelte\";\nimport adapter from \"@sveltejs/adapter-netlify\";\n\n/** @type {import('@sveltejs/kit').Config} */\nexport default createSvelteConfig({\n  kit: { adapter: adapter({ edge: false, split: false }) },\n});\n`,\n};\n\n// The `ci:` job name below + the reusable workflow's `ci` job name produce the\n// branch-protection check context \"ci / ci\" — kept in sync with REQUIRED_CHECK in\n// src/recipes/self-updating/index.ts. Renaming this job means updating that constant.\nconst ci: ConfigTemplate = {\n  config: \"ci\",\n  path: \".github/workflows/ci.yml\",\n  contents: `name: ci\non:\n  pull_request:\n  push:\n    branches: [main]\njobs:\n  ci:\n    uses: reddoorla/.github/.github/workflows/ci.yml@78c4da64b675f0f474961f12715f2a4c09d46eb5 # v1.0.0\n`,\n};\n\nconst renovateAction: ConfigTemplate = {\n  config: \"renovate-action\",\n  path: \".github/workflows/renovate.yml\",\n  contents: `name: renovate\non:\n  schedule:\n    - cron: \"0 7 * * 1\"\n  workflow_dispatch:\njobs:\n  renovate:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n      - uses: renovatebot/github-action@v46.1.14\n        with:\n          token: \\${{ secrets.RENOVATE_TOKEN }}\n        env:\n          RENOVATE_REPOSITORIES: \\${{ github.repository }}\n`,\n};\n\nconst renovateConfig: ConfigTemplate = {\n  config: \"renovate-config\",\n  path: \"renovate.json\",\n  contents: `{\n  \"$schema\": \"https://docs.renovatebot.com/renovate-schema.json\",\n  \"extends\": [\"github>reddoorla/.github:renovate-config\"]\n}\n`,\n};\n\nconst netlify: ConfigTemplate = {\n  config: \"netlify\",\n  path: \"netlify.toml\",\n  contents: `[build]\n    command = \"pnpm build\"\n    publish = \"build/\"\n    functions = \"functions/\"\n\n[build.environment]\n    NODE_VERSION = \"22\"\n    COREPACK_INTEGRITY_KEYS = \"0\"\n\n# Baseline security headers for all responses. CSP is emitted per-response by\n# SvelteKit (see \\`kit.csp\\` in svelte.config.js) so it is intentionally omitted\n# here to avoid conflicting duplicates.\n[[headers]]\n    for = \"/*\"\n    [headers.values]\n        Strict-Transport-Security = \"max-age=63072000; includeSubDomains; preload\"\n        X-Content-Type-Options = \"nosniff\"\n        X-Frame-Options = \"SAMEORIGIN\"\n        Referrer-Policy = \"strict-origin-when-cross-origin\"\n        Permissions-Policy = \"camera=(), microphone=(), geolocation=(), interest-cohort=()\"\n        Cross-Origin-Opener-Policy = \"same-origin\"\n\n[[headers]]\n    for = \"/favicon.png\"\n    [headers.values]\n        Cache-Control = \"public, max-age=31536000, immutable\"\n\n[[headers]]\n    for = \"/_app/immutable/*\"\n    [headers.values]\n        Cache-Control = \"public, max-age=31536000, immutable\"\n`,\n};\n\nexport const ALL_TEMPLATES: ConfigTemplate[] = [\n  eslint,\n  prettier,\n  prettierIgnore,\n  lighthouse,\n  playwrightA11y,\n  svelte,\n  ci,\n  renovateAction,\n  renovateConfig,\n  netlify,\n];\n\nexport function templatesByName(which: ConfigName[]): ConfigTemplate[] {\n  return ALL_TEMPLATES.filter((t) => which.includes(t.config));\n}\n","/**\n * Comment line written above the appended block so future runs (and humans)\n * can recognize the managed section. Presence of this line is incidental —\n * the merge logic is keyed on each entry's normalized form, not on the marker.\n */\nexport const MANAGED_MARKER = \"# canonical entries from @reddoorla/maintenance sync-configs\";\n\n/**\n * Build artifacts, test outputs, deploy caches, and secrets that should never\n * be tracked across the reddoor fleet. Sites may keep additional site-specific\n * entries — they are preserved on merge.\n */\nexport const CANONICAL_GITIGNORE_ENTRIES: readonly string[] = [\n  \"node_modules/\",\n  \"build/\",\n  \"dist/\",\n  \".svelte-kit/\",\n  \"coverage/\",\n  \".vitest-cache/\",\n  \"playwright-report/\",\n  \"test-results/\",\n  \".lighthouseci/\",\n  \".tsbuildinfo\",\n  \".env\",\n  \".env.*\",\n  \"!.env.example\",\n  \".DS_Store\",\n  \"*.log\",\n  \".vercel/\",\n  \".netlify/\",\n  \".reddoor-a11y/\",\n  // The a11y audit's transient spec dir, written inside the checkout and\n  // normally cleaned, but a timeout-SIGKILL of the parent orphans it. Ignored\n  // fleet-wide so it never dirties a self-updating repo's tree (2026-06-10 M-D).\n  \".reddoor-a11y-spec-*/\",\n];\n\nexport type MergeResult = { content: string; added: string[] };\n\nfunction stripLeadingSlash(s: string): string {\n  return s.startsWith(\"/\") ? s.slice(1) : s;\n}\n\nfunction stripTrailingSlash(s: string): string {\n  return s.endsWith(\"/\") ? s.slice(0, -1) : s;\n}\n\n/**\n * Normalize for presence comparison only: strip leading `/`, trailing `/`,\n * and surrounding whitespace. `build`, `/build`, `build/`, and `/build/` all\n * collapse to the same key.\n */\nfunction normalizePresence(line: string): string {\n  return stripTrailingSlash(stripLeadingSlash(line.trim()));\n}\n\nfunction presentSet(existing: string): Set<string> {\n  const set = new Set<string>();\n  for (const raw of existing.split(/\\r?\\n/)) {\n    const trimmed = raw.trim();\n    if (!trimmed) continue;\n    if (trimmed.startsWith(\"#\")) continue;\n    set.add(normalizePresence(trimmed));\n  }\n  return set;\n}\n\n/**\n * Merge `canonical` entries into `existing` .gitignore content.\n *\n * - Missing entries are appended under a managed marker comment.\n * - Existing entries (in any normalized variant — `/build`, `build/`, etc.)\n *   are preserved as-is; we never rewrite the site's own lines.\n * - When every canonical entry is already present, returns the original\n *   content unchanged with `added: []` — the recipe can treat that as noop.\n */\nexport function mergeGitignore(existing: string | null, canonical: readonly string[]): MergeResult {\n  if (existing === null) {\n    const body = [MANAGED_MARKER, ...canonical].join(\"\\n\") + \"\\n\";\n    return { content: body, added: [...canonical] };\n  }\n  const present = presentSet(existing);\n  const added: string[] = [];\n  for (const entry of canonical) {\n    const norm = normalizePresence(entry);\n    if (!present.has(norm)) {\n      added.push(entry);\n      present.add(norm);\n    }\n  }\n  if (added.length === 0) {\n    return { content: existing, added: [] };\n  }\n  let base = existing;\n  if (!base.endsWith(\"\\n\")) base += \"\\n\";\n  const block = [\"\", MANAGED_MARKER, ...added].join(\"\\n\") + \"\\n\";\n  return { content: base + block, added };\n}\n\n/**\n * Of the tracked paths, return those that fall under a canonical *directory*\n * entry — i.e., paths that the freshly-synced .gitignore now wants ignored\n * but which git currently has in the index.\n *\n * File-pattern entries (`.env`, `*.log`, `.DS_Store`) are intentionally\n * skipped: they may contain user-meaningful data, and `git rm --cached`\n * cannot scrub secrets from history anyway. Surfaced for manual review\n * instead of auto-removing.\n */\nexport function findTrackedArtifacts(\n  tracked: readonly string[],\n  canonical: readonly string[],\n): string[] {\n  const dirEntries: string[] = [];\n  for (const raw of canonical) {\n    const t = raw.trim();\n    if (!t) continue;\n    if (t.startsWith(\"!\")) continue;\n    if (/[*?[]/.test(t)) continue;\n    const noLead = stripLeadingSlash(t);\n    if (!noLead.endsWith(\"/\")) continue;\n    const name = stripTrailingSlash(noLead);\n    if (!name) continue;\n    dirEntries.push(name);\n  }\n  const matched: string[] = [];\n  for (const path of tracked) {\n    for (const dir of dirEntries) {\n      if (path === dir || path.startsWith(dir + \"/\")) {\n        matched.push(path);\n        break;\n      }\n    }\n  }\n  return matched;\n}\n","import { execFile } from \"node:child_process\";\nimport { promisify } from \"node:util\";\n\nconst exec = promisify(execFile);\n\nasync function git(cwd: string, args: string[]): Promise<{ stdout: string; stderr: string }> {\n  return exec(\"git\", args, { cwd, env: process.env });\n}\n\nexport function branchName(recipe: string, when: Date = new Date()): string {\n  // ISO with millisecond precision: 2026-05-20T10:30:00.123Z → 20260520T103000123Z.\n  // Millis (vs. second-precision) shrinks the collision window for parallel runs.\n  const compact = when.toISOString().replace(/[-:.]/g, \"\");\n  return `maint/${recipe}-${compact}`;\n}\n\nexport async function currentBranch(cwd: string): Promise<string> {\n  const { stdout } = await git(cwd, [\"rev-parse\", \"--abbrev-ref\", \"HEAD\"]);\n  return stdout.trim();\n}\n\nexport async function isWorkingTreeClean(cwd: string): Promise<boolean> {\n  const { stdout } = await git(cwd, [\"status\", \"--porcelain\"]);\n  return stdout.trim().length === 0;\n}\n\nexport async function createBranch(cwd: string, name: string): Promise<void> {\n  await git(cwd, [\"checkout\", \"-b\", name]);\n}\n\n/** Check out an existing branch. Throws (via git) if the branch is missing or\n *  the checkout is blocked (e.g. uncommitted changes that would be overwritten). */\nexport async function checkoutBranch(cwd: string, name: string): Promise<void> {\n  await git(cwd, [\"checkout\", name]);\n}\n\n/**\n * Force-check-out an existing branch, DISCARDING any uncommitted changes on the\n * current branch. Used by the recipe failure path to return the operator to\n * their original branch even when a recipe left the work-in-progress branch\n * dirty. Only ever called with the operator's ORIGINAL branch as `name`. Does\n * not run `git clean`, so untracked operator files are left untouched.\n */\nexport async function forceCheckoutBranch(cwd: string, name: string): Promise<void> {\n  await git(cwd, [\"checkout\", \"-f\", name]);\n}\n\n/**\n * Delete a local branch with `-D` (force). Used by the recipe failure path to\n * remove the branch the recipe itself created so a re-run starts clean. Callers\n * MUST only ever pass the recipe-created branch here, never the operator's\n * original branch.\n */\nexport async function deleteBranch(cwd: string, name: string): Promise<void> {\n  await git(cwd, [\"branch\", \"-D\", name]);\n}\n\nexport async function stageAll(cwd: string): Promise<void> {\n  await git(cwd, [\"add\", \"-A\"]);\n}\n\nexport async function listTrackedFiles(cwd: string): Promise<string[]> {\n  const { stdout } = await git(cwd, [\"ls-files\"]);\n  return stdout\n    .split(\"\\n\")\n    .map((l) => l.trim())\n    .filter((l) => l.length > 0);\n}\n\nexport async function removeFromIndex(cwd: string, paths: string[]): Promise<void> {\n  if (paths.length === 0) return;\n  await git(cwd, [\"rm\", \"-r\", \"--cached\", \"--\", ...paths]);\n}\n\n/**\n * Stages all current changes and commits with `message`. Returns the commit SHA,\n * or `null` if there was nothing to commit.\n */\nexport async function commit(cwd: string, message: string): Promise<string | null> {\n  await stageAll(cwd);\n  const { stdout: status } = await git(cwd, [\"status\", \"--porcelain\"]);\n  if (status.trim().length === 0) return null;\n  await git(cwd, [\"commit\", \"-m\", message]);\n  const { stdout: sha } = await git(cwd, [\"rev-parse\", \"HEAD\"]);\n  return sha.trim();\n}\n\n/**\n * Strict GitHub repo identity: exactly two `[A-Za-z0-9._-]` segments separated\n * by a single slash. Rejects a scheme, host, extra path segment, traversal\n * (`..`), whitespace, or an argv flag — anything that could retarget a `gh`\n * write at an unintended (attacker/typo-controlled) repo.\n */\nexport const OWNER_REPO_RE = /^[A-Za-z0-9._-]+\\/[A-Za-z0-9._-]+$/;\n\n/** True when `repo` is a clean `owner/repo` (see {@link OWNER_REPO_RE}). The\n *  explicit `..` reject covers traversal segments the char-class would otherwise\n *  admit (`.` is a legal repo char, so `../evil` matches the shape regex). */\nexport function isOwnerRepo(repo: string): boolean {\n  if (repo.includes(\"..\")) return false;\n  return OWNER_REPO_RE.test(repo);\n}\n\n/**\n * True when two repo references name the same `owner/repo`. Each side may be a\n * full remote URL (https or scp-style), or already an `owner/repo`. Used to\n * verify an existing checkout's `origin` matches the site's expected repo\n * before reusing it. Returns false if either side is unparseable.\n */\nexport function sameOwnerRepo(a: string, b: string): boolean {\n  const na = isOwnerRepo(a.trim()) ? a.trim() : parseOwnerRepo(a);\n  const nb = isOwnerRepo(b.trim()) ? b.trim() : parseOwnerRepo(b);\n  if (na === null || nb === null) return false;\n  return na.toLowerCase() === nb.toLowerCase();\n}\n\n/** Derive `owner/repo` from a git remote URL (https or scp-style). Null if unparseable. */\nexport function parseOwnerRepo(remoteUrl: string): string | null {\n  const trimmed = remoteUrl\n    .trim()\n    .replace(/\\.git$/, \"\")\n    .replace(/\\/$/, \"\");\n  // scp-style: git@github.com:owner/repo\n  const scp = trimmed.match(/^[A-Za-z0-9._-]+@[A-Za-z0-9._-]+:(.+)$/);\n  const path = scp ? scp[1]! : trimmed.replace(/^https?:\\/\\/[^/]+\\//, \"\");\n  const segments = path.split(\"/\").filter(Boolean);\n  if (segments.length < 2) return null;\n  return `${segments[segments.length - 2]}/${segments[segments.length - 1]}`;\n}\n\n/** `origin` remote URL for a checkout, trimmed. Throws (via git) if there's no origin. */\nexport async function getRemoteUrl(cwd: string): Promise<string> {\n  const { stdout } = await git(cwd, [\"remote\", \"get-url\", \"origin\"]);\n  return stdout.trim();\n}\n\n/** Push a branch to origin, setting upstream. Throws on non-zero (execFile rejects). */\nexport async function push(cwd: string, branch: string): Promise<void> {\n  await git(cwd, [\"push\", \"-u\", \"origin\", branch]);\n}\n","import type { Site } from \"../types.js\";\n\n/** Human-friendly label for log/output formatting. Prefer the inventory's\n * `name` when present (e.g. \"caltex-landing\") and fall back to the\n * filesystem `path` when unnamed. Every audit + recipe uses this.\n *\n * Uses `||` (not `??`) deliberately: an Airtable Name that slugs to the EMPTY\n * string (`siteSlug(\"!!!\")` → \"\") is `\"\"`, not null/undefined, so `??` would let\n * it through and render a blank label. `||` falls back to the path. */\nexport function siteLabel(site: Site): string {\n  return site.name || site.path;\n}\n","import type { RecipeName, RecipeResult, Site } from \"../types.js\";\nimport {\n  branchName,\n  checkoutBranch,\n  commit as gitCommit,\n  createBranch,\n  currentBranch,\n  deleteBranch,\n  forceCheckoutBranch,\n  isWorkingTreeClean,\n} from \"../util/git.js\";\nimport { siteLabel } from \"../util/site.js\";\n\n/** Outcome of the read-only planning phase. `noop` and `failed` short-circuit\n * without creating a branch; `apply` carries the recipe-specific plan data\n * forward to the apply phase. */\nexport type RecipePlan<P> =\n  | { kind: \"noop\"; notes?: string }\n  | { kind: \"failed\"; notes: string }\n  | { kind: \"apply\"; plan: P };\n\nexport type RecipeApplyCtx = {\n  /** Stage all current changes and commit. Returns the SHA, or null if\n   * nothing was staged. The wrapper accumulates SHAs into the final\n   * RecipeResult. */\n  commit: (message: string) => Promise<string | null>;\n  /** Branch name that was created for this run. */\n  branch: string;\n  /** Site path — same as `site.path`. */\n  cwd: string;\n};\n\nexport type RecipeApplyResult = { kind: \"ok\"; notes?: string } | { kind: \"failed\"; notes: string };\n\nexport type RecipeBody<P> = {\n  name: RecipeName;\n  site: Site;\n  /** Inspect the site and decide: noop, failed, or proceed (with plan data\n   * passed to apply). Runs before the working-tree clean check unless\n   * `checkTreeFirst: true` is set, so most recipes can noop on a dirty\n   * tree without throwing. */\n  plan: () => Promise<RecipePlan<P>>;\n  /** Make the actual changes. Use `ctx.commit(msg)` for each logical step;\n   * the wrapper collects SHAs into `RecipeResult.commits`. Return\n   * `{ kind: \"failed\", notes }` to abort partway and surface the failure. */\n  apply: (plan: P, ctx: RecipeApplyCtx) => Promise<RecipeApplyResult>;\n  /** Check working tree clean BEFORE `plan()` runs. Use only when plan\n   * itself mutates the tree (e.g. `bump-deps` runs `pnpm install` in plan\n   * for an accurate outdated probe). Default false — clean check happens\n   * after plan only if plan returns proceed, allowing noop-on-dirty for\n   * read-only plans (a tree with stray edits + no recipe work to do\n   * should not throw). */\n  checkTreeFirst?: boolean;\n};\n\n/** Wrap a recipe's plan/apply phases. Centralises the siteLabel /\n * clean-tree check / branch creation / commit accumulation / RecipeResult\n * construction boilerplate that every recipe used to re-implement. */\nexport async function withRecipe<P>(body: RecipeBody<P>): Promise<RecipeResult> {\n  const label = siteLabel(body.site);\n\n  if (body.checkTreeFirst && !(await isWorkingTreeClean(body.site.path))) {\n    throw new Error(`refusing to run: working tree is not clean at ${body.site.path}`);\n  }\n\n  const planned = await body.plan();\n\n  if (planned.kind === \"noop\") {\n    return {\n      recipe: body.name,\n      site: label,\n      status: \"noop\",\n      commits: [],\n      ...(planned.notes ? { notes: planned.notes } : {}),\n    };\n  }\n  if (planned.kind === \"failed\") {\n    return {\n      recipe: body.name,\n      site: label,\n      status: \"failed\",\n      commits: [],\n      notes: planned.notes,\n    };\n  }\n\n  if (!body.checkTreeFirst && !(await isWorkingTreeClean(body.site.path))) {\n    throw new Error(`refusing to run: working tree is not clean at ${body.site.path}`);\n  }\n\n  // Capture the operator's branch BEFORE we create the recipe branch, so we can\n  // return them to it afterwards (#2) and so the failure path (#3) knows which\n  // branch to force-restore to. Best-effort: if we can't read it (detached HEAD,\n  // git error) we proceed with `original = null` and skip any force operations\n  // rather than guess — we must NEVER force-discard/delete a branch we're unsure\n  // of.\n  let original: string | null = null;\n  try {\n    original = await currentBranch(body.site.path);\n  } catch {\n    original = null;\n  }\n\n  const branch = branchName(body.name);\n  await createBranch(body.site.path, branch);\n\n  /**\n   * Best-effort restore to the operator's original branch. Never throws — a\n   * restore failure must not turn an otherwise-clean recipe result into a\n   * failure (#2). Skipped when we couldn't capture the original branch.\n   *\n   * IMPORTANT (composition): this is invoked only on the NOOP-from-apply path\n   * (the recipe created a branch but committed nothing — leaving the operator\n   * parked on an empty maint branch is pure downside). It is deliberately NOT\n   * invoked on the APPLIED path: the fleet onboarding pipeline composes recipes\n   * by running them in sequence against the SAME checkout, each building on the\n   * prior's committed files in the working tree (convert-to-pnpm's lockfile →\n   * onboard's deps → sync-configs → svelte-codemods). Restoring to the base\n   * branch after an applied recipe would strip those files from the working\n   * tree and break composition (verified live across the fleet). selfUpdating,\n   * which PUSHES its branch, does its own post-push restore since its local\n   * branch is disposable.\n   */\n  const restoreOriginal = async (): Promise<void> => {\n    if (original === null || original === branch) return;\n    try {\n      await checkoutBranch(body.site.path, original);\n    } catch (err) {\n      // Leave the operator on the recipe branch rather than fail the result.\n      console.warn(\n        `warning: could not restore branch ${original} after ${body.name}: ${\n          err instanceof Error ? err.message : String(err)\n        }`,\n      );\n    }\n  };\n\n  /**\n   * Failure restore (#3): force the checkout back to the captured original\n   * branch (discarding the recipe branch's uncommitted changes) and delete the\n   * recipe branch, so a re-run starts clean. SAFETY: only ever force-checks-out\n   * the captured `original` and only ever deletes `branch` (the recipe-created\n   * branch); never deletes `original`, never runs `git clean`. If `original` is\n   * unavailable we do nothing (the safe subset) — better to leave the operator\n   * parked than to force anything we're unsure about. Best-effort: never throws.\n   */\n  const restoreAfterFailure = async (): Promise<void> => {\n    if (original === null || original === branch) return;\n    try {\n      await forceCheckoutBranch(body.site.path, original);\n    } catch (err) {\n      console.warn(\n        `warning: could not force-restore branch ${original} after failed ${body.name}: ${\n          err instanceof Error ? err.message : String(err)\n        }`,\n      );\n      // If we couldn't get off the recipe branch, deleting it would fail anyway;\n      // and we must never delete the branch we're still on.\n      return;\n    }\n    try {\n      await deleteBranch(body.site.path, branch);\n    } catch (err) {\n      console.warn(\n        `warning: could not delete recipe branch ${branch} after failed ${body.name}: ${\n          err instanceof Error ? err.message : String(err)\n        }`,\n      );\n    }\n  };\n\n  const shas: string[] = [];\n  let result: RecipeApplyResult;\n  try {\n    result = await body.apply(planned.plan, {\n      cwd: body.site.path,\n      branch,\n      commit: async (msg) => {\n        const sha = await gitCommit(body.site.path, msg);\n        if (sha) shas.push(sha);\n        return sha;\n      },\n    });\n  } catch (err) {\n    // Body threw mid-mutation: force-restore + delete the recipe branch so the\n    // checkout is retriable, then re-throw (preserve the prior throw semantics —\n    // callers like init treat an uncaught throw as an `error` step).\n    await restoreAfterFailure();\n    throw err;\n  }\n\n  if (result.kind === \"failed\") {\n    await restoreAfterFailure();\n    return {\n      recipe: body.name,\n      site: label,\n      status: \"failed\",\n      commits: shas,\n      notes: result.notes,\n    };\n  }\n\n  // NOOP-from-apply only: no commits to compose, so don't leave the operator\n  // parked on an empty maint branch. The APPLIED path intentionally stays on the\n  // maint branch so the onboarding pipeline can compose (see restoreOriginal).\n  if (shas.length === 0) {\n    await restoreOriginal();\n  }\n\n  const notes = result.notes ? `${result.notes}; branch: ${branch}` : `branch: ${branch}`;\n  return {\n    recipe: body.name,\n    site: label,\n    status: shas.length > 0 ? \"applied\" : \"noop\",\n    commits: shas,\n    notes,\n  };\n}\n"],"mappings":";AAAA,SAAS,UAAU,WAAW,aAAa;AAC3C,SAAS,MAAM,eAAe;;;ACO9B,IAAM,SAAyB;AAAA,EAC7B,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,UAAU;AAAA;AAAA;AAAA;AAAA;AAKZ;AAEA,IAAM,WAA2B;AAAA,EAC/B,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAOZ;AAEA,IAAM,iBAAiC;AAAA,EACrC,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAMZ;AAEA,IAAM,aAA6B;AAAA,EACjC,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,UAAU,GAAG,KAAK;AAAA,IAChB;AAAA,MACE,OACE;AAAA,MACF,SAAS;AAAA,IACX;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAAA;AAEH;AAEA,IAAM,iBAAiC;AAAA,EACrC,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,UAAU;AAAA;AAEZ;AAEA,IAAM,SAAyB;AAAA,EAC7B,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQZ;AAKA,IAAM,KAAqB;AAAA,EACzB,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AASZ;AAEA,IAAM,iBAAiC;AAAA,EACrC,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAgBZ;AAEA,IAAM,iBAAiC;AAAA,EACrC,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,UAAU;AAAA;AAAA;AAAA;AAAA;AAKZ;AAEA,IAAM,UAA0B;AAAA,EAC9B,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAgCZ;AAEO,IAAM,gBAAkC;AAAA,EAC7C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,SAAS,gBAAgB,OAAuC;AACrE,SAAO,cAAc,OAAO,CAAC,MAAM,MAAM,SAAS,EAAE,MAAM,CAAC;AAC7D;;;AC3KO,IAAM,iBAAiB;AAOvB,IAAM,8BAAiD;AAAA,EAC5D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAIA;AACF;AAIA,SAAS,kBAAkB,GAAmB;AAC5C,SAAO,EAAE,WAAW,GAAG,IAAI,EAAE,MAAM,CAAC,IAAI;AAC1C;AAEA,SAAS,mBAAmB,GAAmB;AAC7C,SAAO,EAAE,SAAS,GAAG,IAAI,EAAE,MAAM,GAAG,EAAE,IAAI;AAC5C;AAOA,SAAS,kBAAkB,MAAsB;AAC/C,SAAO,mBAAmB,kBAAkB,KAAK,KAAK,CAAC,CAAC;AAC1D;AAEA,SAAS,WAAW,UAA+B;AACjD,QAAM,MAAM,oBAAI,IAAY;AAC5B,aAAW,OAAO,SAAS,MAAM,OAAO,GAAG;AACzC,UAAM,UAAU,IAAI,KAAK;AACzB,QAAI,CAAC,QAAS;AACd,QAAI,QAAQ,WAAW,GAAG,EAAG;AAC7B,QAAI,IAAI,kBAAkB,OAAO,CAAC;AAAA,EACpC;AACA,SAAO;AACT;AAWO,SAAS,eAAe,UAAyB,WAA2C;AACjG,MAAI,aAAa,MAAM;AACrB,UAAM,OAAO,CAAC,gBAAgB,GAAG,SAAS,EAAE,KAAK,IAAI,IAAI;AACzD,WAAO,EAAE,SAAS,MAAM,OAAO,CAAC,GAAG,SAAS,EAAE;AAAA,EAChD;AACA,QAAM,UAAU,WAAW,QAAQ;AACnC,QAAM,QAAkB,CAAC;AACzB,aAAW,SAAS,WAAW;AAC7B,UAAM,OAAO,kBAAkB,KAAK;AACpC,QAAI,CAAC,QAAQ,IAAI,IAAI,GAAG;AACtB,YAAM,KAAK,KAAK;AAChB,cAAQ,IAAI,IAAI;AAAA,IAClB;AAAA,EACF;AACA,MAAI,MAAM,WAAW,GAAG;AACtB,WAAO,EAAE,SAAS,UAAU,OAAO,CAAC,EAAE;AAAA,EACxC;AACA,MAAI,OAAO;AACX,MAAI,CAAC,KAAK,SAAS,IAAI,EAAG,SAAQ;AAClC,QAAM,QAAQ,CAAC,IAAI,gBAAgB,GAAG,KAAK,EAAE,KAAK,IAAI,IAAI;AAC1D,SAAO,EAAE,SAAS,OAAO,OAAO,MAAM;AACxC;AAYO,SAAS,qBACd,SACA,WACU;AACV,QAAM,aAAuB,CAAC;AAC9B,aAAW,OAAO,WAAW;AAC3B,UAAM,IAAI,IAAI,KAAK;AACnB,QAAI,CAAC,EAAG;AACR,QAAI,EAAE,WAAW,GAAG,EAAG;AACvB,QAAI,QAAQ,KAAK,CAAC,EAAG;AACrB,UAAM,SAAS,kBAAkB,CAAC;AAClC,QAAI,CAAC,OAAO,SAAS,GAAG,EAAG;AAC3B,UAAM,OAAO,mBAAmB,MAAM;AACtC,QAAI,CAAC,KAAM;AACX,eAAW,KAAK,IAAI;AAAA,EACtB;AACA,QAAM,UAAoB,CAAC;AAC3B,aAAW,QAAQ,SAAS;AAC1B,eAAW,OAAO,YAAY;AAC5B,UAAI,SAAS,OAAO,KAAK,WAAW,MAAM,GAAG,GAAG;AAC9C,gBAAQ,KAAK,IAAI;AACjB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;;;ACvIA,SAAS,gBAAgB;AACzB,SAAS,iBAAiB;AAE1B,IAAM,OAAO,UAAU,QAAQ;AAE/B,eAAe,IAAI,KAAa,MAA6D;AAC3F,SAAO,KAAK,OAAO,MAAM,EAAE,KAAK,KAAK,QAAQ,IAAI,CAAC;AACpD;AAEO,SAAS,WAAW,QAAgB,OAAa,oBAAI,KAAK,GAAW;AAG1E,QAAM,UAAU,KAAK,YAAY,EAAE,QAAQ,UAAU,EAAE;AACvD,SAAO,SAAS,MAAM,IAAI,OAAO;AACnC;AAEA,eAAsB,cAAc,KAA8B;AAChE,QAAM,EAAE,OAAO,IAAI,MAAM,IAAI,KAAK,CAAC,aAAa,gBAAgB,MAAM,CAAC;AACvE,SAAO,OAAO,KAAK;AACrB;AAEA,eAAsB,mBAAmB,KAA+B;AACtE,QAAM,EAAE,OAAO,IAAI,MAAM,IAAI,KAAK,CAAC,UAAU,aAAa,CAAC;AAC3D,SAAO,OAAO,KAAK,EAAE,WAAW;AAClC;AAEA,eAAsB,aAAa,KAAa,MAA6B;AAC3E,QAAM,IAAI,KAAK,CAAC,YAAY,MAAM,IAAI,CAAC;AACzC;AAIA,eAAsB,eAAe,KAAa,MAA6B;AAC7E,QAAM,IAAI,KAAK,CAAC,YAAY,IAAI,CAAC;AACnC;AASA,eAAsB,oBAAoB,KAAa,MAA6B;AAClF,QAAM,IAAI,KAAK,CAAC,YAAY,MAAM,IAAI,CAAC;AACzC;AAQA,eAAsB,aAAa,KAAa,MAA6B;AAC3E,QAAM,IAAI,KAAK,CAAC,UAAU,MAAM,IAAI,CAAC;AACvC;AAEA,eAAsB,SAAS,KAA4B;AACzD,QAAM,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC;AAC9B;AAEA,eAAsB,iBAAiB,KAAgC;AACrE,QAAM,EAAE,OAAO,IAAI,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;AAC9C,SAAO,OACJ,MAAM,IAAI,EACV,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC;AAC/B;AAEA,eAAsB,gBAAgB,KAAa,OAAgC;AACjF,MAAI,MAAM,WAAW,EAAG;AACxB,QAAM,IAAI,KAAK,CAAC,MAAM,MAAM,YAAY,MAAM,GAAG,KAAK,CAAC;AACzD;AAMA,eAAsB,OAAO,KAAa,SAAyC;AACjF,QAAM,SAAS,GAAG;AAClB,QAAM,EAAE,QAAQ,OAAO,IAAI,MAAM,IAAI,KAAK,CAAC,UAAU,aAAa,CAAC;AACnE,MAAI,OAAO,KAAK,EAAE,WAAW,EAAG,QAAO;AACvC,QAAM,IAAI,KAAK,CAAC,UAAU,MAAM,OAAO,CAAC;AACxC,QAAM,EAAE,QAAQ,IAAI,IAAI,MAAM,IAAI,KAAK,CAAC,aAAa,MAAM,CAAC;AAC5D,SAAO,IAAI,KAAK;AAClB;;;AC5EO,SAAS,UAAU,MAAoB;AAC5C,SAAO,KAAK,QAAQ,KAAK;AAC3B;;;AC+CA,eAAsB,WAAc,MAA4C;AAC9E,QAAM,QAAQ,UAAU,KAAK,IAAI;AAEjC,MAAI,KAAK,kBAAkB,CAAE,MAAM,mBAAmB,KAAK,KAAK,IAAI,GAAI;AACtE,UAAM,IAAI,MAAM,iDAAiD,KAAK,KAAK,IAAI,EAAE;AAAA,EACnF;AAEA,QAAM,UAAU,MAAM,KAAK,KAAK;AAEhC,MAAI,QAAQ,SAAS,QAAQ;AAC3B,WAAO;AAAA,MACL,QAAQ,KAAK;AAAA,MACb,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,SAAS,CAAC;AAAA,MACV,GAAI,QAAQ,QAAQ,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,IAClD;AAAA,EACF;AACA,MAAI,QAAQ,SAAS,UAAU;AAC7B,WAAO;AAAA,MACL,QAAQ,KAAK;AAAA,MACb,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,SAAS,CAAC;AAAA,MACV,OAAO,QAAQ;AAAA,IACjB;AAAA,EACF;AAEA,MAAI,CAAC,KAAK,kBAAkB,CAAE,MAAM,mBAAmB,KAAK,KAAK,IAAI,GAAI;AACvE,UAAM,IAAI,MAAM,iDAAiD,KAAK,KAAK,IAAI,EAAE;AAAA,EACnF;AAQA,MAAI,WAA0B;AAC9B,MAAI;AACF,eAAW,MAAM,cAAc,KAAK,KAAK,IAAI;AAAA,EAC/C,QAAQ;AACN,eAAW;AAAA,EACb;AAEA,QAAM,SAAS,WAAW,KAAK,IAAI;AACnC,QAAM,aAAa,KAAK,KAAK,MAAM,MAAM;AAmBzC,QAAM,kBAAkB,YAA2B;AACjD,QAAI,aAAa,QAAQ,aAAa,OAAQ;AAC9C,QAAI;AACF,YAAM,eAAe,KAAK,KAAK,MAAM,QAAQ;AAAA,IAC/C,SAAS,KAAK;AAEZ,cAAQ;AAAA,QACN,qCAAqC,QAAQ,UAAU,KAAK,IAAI,KAC9D,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CACjD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAWA,QAAM,sBAAsB,YAA2B;AACrD,QAAI,aAAa,QAAQ,aAAa,OAAQ;AAC9C,QAAI;AACF,YAAM,oBAAoB,KAAK,KAAK,MAAM,QAAQ;AAAA,IACpD,SAAS,KAAK;AACZ,cAAQ;AAAA,QACN,2CAA2C,QAAQ,iBAAiB,KAAK,IAAI,KAC3E,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CACjD;AAAA,MACF;AAGA;AAAA,IACF;AACA,QAAI;AACF,YAAM,aAAa,KAAK,KAAK,MAAM,MAAM;AAAA,IAC3C,SAAS,KAAK;AACZ,cAAQ;AAAA,QACN,2CAA2C,MAAM,iBAAiB,KAAK,IAAI,KACzE,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CACjD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,OAAiB,CAAC;AACxB,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,KAAK,MAAM,QAAQ,MAAM;AAAA,MACtC,KAAK,KAAK,KAAK;AAAA,MACf;AAAA,MACA,QAAQ,OAAO,QAAQ;AACrB,cAAM,MAAM,MAAM,OAAU,KAAK,KAAK,MAAM,GAAG;AAC/C,YAAI,IAAK,MAAK,KAAK,GAAG;AACtB,eAAO;AAAA,MACT;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AAIZ,UAAM,oBAAoB;AAC1B,UAAM;AAAA,EACR;AAEA,MAAI,OAAO,SAAS,UAAU;AAC5B,UAAM,oBAAoB;AAC1B,WAAO;AAAA,MACL,QAAQ,KAAK;AAAA,MACb,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,OAAO,OAAO;AAAA,IAChB;AAAA,EACF;AAKA,MAAI,KAAK,WAAW,GAAG;AACrB,UAAM,gBAAgB;AAAA,EACxB;AAEA,QAAM,QAAQ,OAAO,QAAQ,GAAG,OAAO,KAAK,aAAa,MAAM,KAAK,WAAW,MAAM;AACrF,SAAO;AAAA,IACL,QAAQ,KAAK;AAAA,IACb,MAAM;AAAA,IACN,QAAQ,KAAK,SAAS,IAAI,YAAY;AAAA,IACtC,SAAS;AAAA,IACT;AAAA,EACF;AACF;;;ALzMA,IAAM,mBAA+B;AACrC,IAAM,gBAA4B;AAClC,IAAM,iBAA6B;AAanC,SAAS,wBAAwB,UAA2B;AAC1D,SAAO,SAAS,SAAS,oBAAoB,KAAK,SAAS,SAAS,2BAA2B;AACjG;AAIA,IAAM,qBACJ;AAYF,SAAS,yBAAyB,UAA2B;AAC3D,SAAO,SAAS,SAAS,aAAa,KAAK,mBAAmB,KAAK,QAAQ;AAC7E;AAMO,IAAM,mBAAiC;AAAA,EAC5C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,SAAS,aAAa,OAAoC;AAC/D,SAAQ,iBAA8B,SAAS,KAAK;AACtD;AAEA,eAAe,UAAU,MAAsC;AAC7D,MAAI;AACF,WAAO,MAAM,SAAS,MAAM,OAAO;AAAA,EACrC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,kBACb,KACA,WAC2B;AAC3B,QAAM,QAA0B,CAAC;AACjC,aAAW,KAAK,WAAW;AACzB,UAAM,WAAW,MAAM,UAAU,KAAK,KAAK,EAAE,IAAI,CAAC;AAClD,QAAI,aAAa,EAAE,SAAU;AAI7B,QAAI,EAAE,WAAW,iBAAiB,aAAa,QAAQ,wBAAwB,QAAQ,GAAG;AACxF;AAAA,IACF;AAIA,QAAI,EAAE,WAAW,kBAAkB,aAAa,QAAQ,yBAAyB,QAAQ,GAAG;AAC1F;AAAA,IACF;AACA,UAAM,KAAK,CAAC;AAAA,EACd;AACA,SAAO;AACT;AAMA,eAAe,cAAc,KAAqC;AAChE,QAAM,WAAW,MAAM,UAAU,KAAK,KAAK,YAAY,CAAC;AACxD,QAAM,QAAQ,eAAe,UAAU,2BAA2B;AAClE,QAAM,UAAU,MAAM,iBAAiB,GAAG;AAC1C,QAAM,YAAY,qBAAqB,SAAS,2BAA2B;AAC3E,MAAI,MAAM,MAAM,WAAW,KAAK,UAAU,WAAW,EAAG,QAAO,EAAE,MAAM,OAAO;AAC9E,SAAO,EAAE,MAAM,SAAS,SAAS,MAAM,SAAS,WAAW,OAAO,MAAM,MAAM;AAChF;AAEA,eAAe,eACb,KACA,MACe;AACf,QAAM,UAAU,KAAK,KAAK,YAAY,GAAG,KAAK,SAAS,OAAO;AAC9D,MAAI,KAAK,UAAU,SAAS,GAAG;AAC7B,UAAM,gBAAgB,KAAK,KAAK,SAAS;AAAA,EAC3C;AACF;AAEA,eAAsB,YACpB,MACA,OAA2B,CAAC,GACL;AACvB,QAAM,YAAY,KAAK,SAAS,cAAc,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,gBAAgB;AAC1F,QAAM,gBAAgB,UAAU,OAAO,CAAC,MAAuB,MAAM,gBAAgB;AACrF,QAAM,YAAY,gBAAgB,aAAa;AAC/C,QAAM,mBAAmB,UAAU,SAAS,gBAAgB;AAE5D,SAAO,WAAW;AAAA,IAChB,MAAM;AAAA,IACN;AAAA,IACA,MAAM,YAAY;AAChB,YAAM,gBAAgB,MAAM,kBAAkB,KAAK,MAAM,SAAS;AAClE,YAAM,gBAA+B,mBACjC,MAAM,cAAc,KAAK,IAAI,IAC7B,EAAE,MAAM,OAAO;AACnB,UAAI,cAAc,WAAW,KAAK,cAAc,SAAS,QAAQ;AAC/D,eAAO,EAAE,MAAM,QAAQ,OAAO,qCAAqC;AAAA,MACrE;AACA,aAAO,EAAE,MAAM,SAAS,MAAM,EAAE,eAAe,cAAc,EAAE;AAAA,IACjE;AAAA,IACA,OAAO,OAAO,EAAE,eAAe,cAAc,GAAG,EAAE,QAAAA,QAAO,MAAM;AAC7D,iBAAW,KAAK,eAAe;AAC7B,cAAM,OAAO,KAAK,KAAK,MAAM,EAAE,IAAI;AACnC,cAAM,MAAM,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AAC9C,cAAM,UAAU,MAAM,EAAE,UAAU,OAAO;AACzC,cAAMA,QAAO,eAAe,EAAE,MAAM,qCAAqC;AAAA,MAC3E;AACA,UAAI,cAAc,SAAS,SAAS;AAClC,cAAM,eAAe,KAAK,MAAM,aAAa;AAC7C,cAAMA,QAAO,mDAAmD;AAAA,MAClE;AACA,aAAO,EAAE,MAAM,KAAK;AAAA,IACtB;AAAA,EACF,CAAC;AACH;","names":["commit"]}
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}