@reddoorla/maintenance 0.76.0 → 0.79.0

package/dist/chunk-4SOCPK7A.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/db/migrations.ts","../src/db/migrate.ts"],"sourcesContent":["/** Ordered, append-only list of standard-SQL migration scripts. Each runs once,\n *  tracked by `id` in the `_migrations` table (see migrate.ts). Statements use\n *  IF NOT EXISTS so even a partial re-apply is safe. Never edit a shipped script —\n *  add a new one. Every statement in a script MUST be independently idempotent:\n *  `migrate.ts` runs each script via `executeMultiple`, which is NOT transactional,\n *  so a mid-script failure can leave earlier statements applied and the id unrecorded\n *  — a re-run then re-executes the whole script. Standard SQLite SQL only (no\n *  Turso-specific syntax) so the host stays a connection-string swap. */\nexport type Migration = { id: string; sql: string };\n\nexport const MIGRATIONS: Migration[] = [\n  {\n    id: \"0001_init\",\n    sql: `\n      CREATE TABLE IF NOT EXISTS submissions (\n        id TEXT PRIMARY KEY,\n        submission_id INTEGER,\n        site_id TEXT NOT NULL,\n        form_type TEXT NOT NULL,\n        name TEXT NOT NULL,\n        email TEXT NOT NULL,\n        phone TEXT,\n        message TEXT,\n        extra_fields TEXT,\n        source_url TEXT,\n        utm TEXT,\n        submitted_at TEXT,\n        status TEXT NOT NULL DEFAULT 'new',\n        notify_status TEXT NOT NULL DEFAULT 'skipped',\n        resend_message_id TEXT\n      );\n      CREATE INDEX IF NOT EXISTS idx_submissions_site_submitted\n        ON submissions (site_id, submitted_at DESC);\n      CREATE INDEX IF NOT EXISTS idx_submissions_status\n        ON submissions (status);\n      CREATE TABLE IF NOT EXISTS spam_screenouts (\n        site_id TEXT NOT NULL,\n        date TEXT NOT NULL,\n        honeypot INTEGER NOT NULL DEFAULT 0,\n        too_fast INTEGER NOT NULL DEFAULT 0,\n        marked_spam INTEGER NOT NULL DEFAULT 0,\n        PRIMARY KEY (site_id, date)\n      );\n    `,\n  },\n  {\n    id: \"0002_fleet_events\",\n    sql: `\n      CREATE TABLE IF NOT EXISTS fleet_events (\n        id TEXT PRIMARY KEY,\n        ts TEXT NOT NULL,\n        type TEXT NOT NULL,\n        site_id TEXT,\n        site_name TEXT,\n        summary TEXT NOT NULL,\n        data TEXT,\n        created_at TEXT NOT NULL\n      );\n      CREATE INDEX IF NOT EXISTS idx_fleet_events_ts ON fleet_events (ts);\n    `,\n  },\n  {\n    id: \"0003_add_spam_score\",\n    // SQLite `ADD COLUMN` has no `IF NOT EXISTS`, so it is NOT self-idempotent: if the\n    // `_migrations` marker is lost after the column is added (crash between statement\n    // and marker write), a re-run would throw `duplicate column name`. `migrate.ts`\n    // recognizes that error as already-applied and records the marker, keeping the\n    // runner idempotent (see `isAlreadyAppliedError`).\n    sql: `ALTER TABLE submissions ADD COLUMN spam_score REAL;`,\n  },\n  {\n    id: \"0004_add_spam_reason\",\n    sql: `ALTER TABLE submissions ADD COLUMN spam_reason TEXT;`,\n  },\n  {\n    // Outcome of the newsletter fan-out (site webhook + Mailchimp). Before this the\n    // results were console.error-only, so a rotated Mailchimp key or an outage would\n    // silently stop signups reaching the audience with no trace anywhere the operator\n    // looks — the row still read `notify=sent`, healthy. Same non-idempotent\n    // ADD COLUMN caveat as 0003.\n    id: \"0005_add_fanout_status\",\n    sql: `ALTER TABLE submissions ADD COLUMN fanout_status TEXT;`,\n  },\n];\n","import type { Client } from \"@libsql/client\";\nimport { MIGRATIONS } from \"./migrations.js\";\n\n/** True when an error means \"this DDL was already applied\" and re-applying is a\n *  no-op we can safely ignore. `CREATE ... IF NOT EXISTS` never throws, but SQLite\n *  `ALTER TABLE ... ADD COLUMN` has no `IF NOT EXISTS`, so a re-run after a lost\n *  `_migrations` marker throws `duplicate column name: …`. Treating that as\n *  already-applied keeps `runMigrations` idempotent for `ADD COLUMN` migrations —\n *  without it a lost marker would boot-loop `openDb()` on every call. */\nfunction isAlreadyAppliedError(err: unknown): boolean {\n  const message = err instanceof Error ? err.message : String(err);\n  return /duplicate column name/i.test(message);\n}\n\n/** Apply every not-yet-applied migration in order against a raw libSQL client,\n *  tracking applied ids in `_migrations`. Idempotent: ids already present are\n *  skipped, the DDL uses IF NOT EXISTS where it can, and an already-applied\n *  `ADD COLUMN` (recognized by its error) is swallowed so the marker is still\n *  recorded. Returns the ids applied this run. Runs on every openDb() — cheap\n *  (one indexed SELECT) and the gate every fresh Turso database needs before its\n *  first write. */\nexport async function runMigrations(client: Client): Promise<string[]> {\n  await client.execute(\n    \"CREATE TABLE IF NOT EXISTS _migrations (id TEXT PRIMARY KEY, applied_at TEXT NOT NULL)\",\n  );\n  const existing = await client.execute(\"SELECT id FROM _migrations\");\n  const applied = new Set(existing.rows.map((r) => String(r.id)));\n  const ran: string[] = [];\n  for (const m of MIGRATIONS) {\n    if (applied.has(m.id)) continue;\n    try {\n      await client.executeMultiple(m.sql);\n    } catch (err) {\n      // A re-run after a lost marker can re-execute a non-idempotent `ADD COLUMN`;\n      // treat \"already applied\" as success so we still record the marker below and\n      // never boot-loop. Any other error propagates unchanged.\n      if (!isAlreadyAppliedError(err)) throw err;\n    }\n    await client.execute({\n      sql: \"INSERT INTO _migrations (id, applied_at) VALUES (?, ?)\",\n      args: [m.id, new Date().toISOString()],\n    });\n    ran.push(m.id);\n  }\n  return ran;\n}\n"],"mappings":";AAUO,IAAM,aAA0B;AAAA,EACrC;AAAA,IACE,IAAI;AAAA,IACJ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA+BP;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaP;AAAA,EACA;AAAA,IACE,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMJ,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,KAAK;AAAA,EACP;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAME,IAAI;AAAA,IACJ,KAAK;AAAA,EACP;AACF;;;AC1EA,SAAS,sBAAsB,KAAuB;AACpD,QAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,SAAO,yBAAyB,KAAK,OAAO;AAC9C;AASA,eAAsB,cAAc,QAAmC;AACrE,QAAM,OAAO;AAAA,IACX;AAAA,EACF;AACA,QAAM,WAAW,MAAM,OAAO,QAAQ,4BAA4B;AAClE,QAAM,UAAU,IAAI,IAAI,SAAS,KAAK,IAAI,CAAC,MAAM,OAAO,EAAE,EAAE,CAAC,CAAC;AAC9D,QAAM,MAAgB,CAAC;AACvB,aAAW,KAAK,YAAY;AAC1B,QAAI,QAAQ,IAAI,EAAE,EAAE,EAAG;AACvB,QAAI;AACF,YAAM,OAAO,gBAAgB,EAAE,GAAG;AAAA,IACpC,SAAS,KAAK;AAIZ,UAAI,CAAC,sBAAsB,GAAG,EAAG,OAAM;AAAA,IACzC;AACA,UAAM,OAAO,QAAQ;AAAA,MACnB,KAAK;AAAA,MACL,MAAM,CAAC,EAAE,KAAI,oBAAI,KAAK,GAAE,YAAY,CAAC;AAAA,IACvC,CAAC;AACD,QAAI,KAAK,EAAE,EAAE;AAAA,EACf;AACA,SAAO;AACT;","names":[]}

package/dist/{chunk-CASCWQQX.js → chunk-73UFRZKY.js}

@@ -60,37 +60,53 @@ export default createSvelteConfig({
 });
 `
 };
-var ci = {
-  config: "ci",
-  path: ".github/workflows/ci.yml",
-  contents: `name: ci
-on:
-  pull_request:
-  push:
-    branches: [main]
-jobs:
-  ci:
-    uses: reddoorla/.github/.github/workflows/ci.yml@78c4da64b675f0f474961f12715f2a4c09d46eb5 # v1.0.0
-`
-};
 var renovateAction = {
   config: "renovate-action",
   path: ".github/workflows/renovate.yml",
   contents: `name: renovate
 on:
   schedule:
-    - cron: "0 7 * * 1"
+    # Twice daily. GitHub's platform auto-merge is disabled fleet-wide, so Renovate
+    # performs its own merges from inside this run \u2014 which means this cron is the
+    # MERGE cadence, not just the PR-creation cadence.
+    - cron: 0 */12 * * *
   workflow_dispatch:
+permissions:
+  contents: read
 jobs:
   renovate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: renovatebot/github-action@v46.1.14
+      # Renovate authenticates as the reddoor-renovate GitHub App (installed
+      # org-wide, "All repositories" \u2014 future repos are auto-covered), NOT as an
+      # operator PAT. Why: the App is a distinct identity, so the audit trail
+      # finally distinguishes bot from human (the 2026-07-26 unreviewed-major
+      # forensics took hours precisely because it couldn't); the credential is
+      # permission-scoped and centrally revocable instead of a fleet-write PAT;
+      # and the installation gets its own API-quota pool instead of sharing the
+      # operator's. The minted token is scoped to THIS repository only
+      # (create-github-app-token's default when owner/repositories are omitted).
+      # RENOVATE_APP_ID / RENOVATE_APP_PRIVATE_KEY are org-level (all-repos
+      # visibility) \u2014 nothing to configure per repo.
+      # Digest-pinned: this workflow mints a repo-write token, so a mutable tag
+      # ref here is a supply-chain hole \u2014 a retagged \`@v3\`/\`@v46\` would run
+      # attacker code with that token. Pin to the commit; Renovate bumps these.
+      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        id: app-token
+        with:
+          app-id: \${{ vars.RENOVATE_APP_ID }}
+          private-key: \${{ secrets.RENOVATE_APP_PRIVATE_KEY }}
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: renovatebot/github-action@1a96852b0384df1837619d04c60b2d10d1f9ff08 # v46.1.21
         with:
-          token: \${{ secrets.RENOVATE_TOKEN }}
+          token: \${{ steps.app-token.outputs.token }}
         env:
           RENOVATE_REPOSITORIES: \${{ github.repository }}
+          # Commit/PR identity = the App's bot user, so gitAuthor matches the
+          # token identity (mismatched authors read as "operator pushed this").
+          # 312185038 = the bot's user id (gh api 'users/reddoor-renovate[bot]' --jq .id).
+          RENOVATE_USERNAME: reddoor-renovate[bot]
+          RENOVATE_GIT_AUTHOR: reddoor-renovate[bot] <312185038+reddoor-renovate[bot]@users.noreply.github.com>
 `
 };
 var renovateConfig = {
@@ -145,7 +161,6 @@ var ALL_TEMPLATES = [
   lighthouse,
   playwrightA11y,
   svelte,
-  ci,
   renovateAction,
   renovateConfig,
   netlify
@@ -158,4 +173,4 @@ export {
   ALL_TEMPLATES,
   templatesByName
 };
-//# sourceMappingURL=chunk-CASCWQQX.js.map
+//# sourceMappingURL=chunk-73UFRZKY.js.map

package/dist/chunk-73UFRZKY.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/recipes/sync-configs/templates.ts"],"sourcesContent":["import type { ConfigName } from \"../../types.js\";\n\nexport type ConfigTemplate = {\n  config: ConfigName;\n  path: string;\n  contents: string;\n};\n\nconst eslint: ConfigTemplate = {\n  config: \"eslint\",\n  path: \"eslint.config.js\",\n  contents: `import { createEslintConfig } from \"@reddoorla/maintenance/configs/eslint\";\nimport svelteConfig from \"./svelte.config.js\";\n\nexport default createEslintConfig({ svelteConfig });\n`,\n};\n\nconst prettier: ConfigTemplate = {\n  config: \"prettier\",\n  path: \".prettierrc.json\",\n  contents: `{\n  \"trailingComma\": \"all\",\n  \"singleQuote\": false,\n  \"printWidth\": 100,\n  \"plugins\": [\"prettier-plugin-svelte\"]\n}\n`,\n};\n\nconst prettierIgnore: ConfigTemplate = {\n  config: \"prettier-ignore\",\n  path: \".prettierignore\",\n  contents: `pnpm-lock.yaml\n.svelte-kit/\nbuild/\n.netlify/\ndist/\n`,\n};\n\nconst lighthouse: ConfigTemplate = {\n  config: \"lighthouse\",\n  path: \"lighthouserc.json\",\n  contents: `${JSON.stringify(\n    {\n      $note:\n        \"Generated by @reddoorla/maintenance sync-configs; edit src/configs/lighthouse.ts in the package instead.\",\n      extends: \"@reddoorla/maintenance/configs/lighthouse\",\n    },\n    null,\n    2,\n  )}\n`,\n};\n\nconst playwrightA11y: ConfigTemplate = {\n  config: \"playwright-a11y\",\n  path: \"playwright.config.ts\",\n  contents: `export { default } from \"@reddoorla/maintenance/configs/playwright-a11y\";\n`,\n};\n\nconst svelte: ConfigTemplate = {\n  config: \"svelte\",\n  path: \"svelte.config.js\",\n  contents: `import { createSvelteConfig } from \"@reddoorla/maintenance/configs/svelte\";\nimport adapter from \"@sveltejs/adapter-netlify\";\n\n/** @type {import('@sveltejs/kit').Config} */\nexport default createSvelteConfig({\n  kit: { adapter: adapter({ edge: false, split: false }) },\n});\n`,\n};\n\n// There is deliberately NO ci.yml template. Every live fleet ci.yml carries\n// per-site values a static template cannot own (`netlify-site:`, plus\n// `permissions:` and `node-version:` inputs) — an exact-match heal against a\n// canonical byte template would strip them fleet-wide in green auto-mergeable\n// PRs (the \"armed clobber\" the 2026-08-02 architecture review flagged; it was\n// this file's `ci` entry). Ownership is split instead: the STARTER clone\n// provides each site's ci.yml shape at bootstrap, and Renovate's\n// github-actions manager bumps the pinned reusable-workflow ref per repo when\n// reddoorla/.github tags a new version. The caller job name `ci` + the\n// reusable workflow's job `ci` produce the check context \"ci / ci\" —\n// REQUIRED_CHECK in src/recipes/self-updating/index.ts depends on that naming.\n\nconst renovateAction: ConfigTemplate = {\n  config: \"renovate-action\",\n  path: \".github/workflows/renovate.yml\",\n  contents: `name: renovate\non:\n  schedule:\n    # Twice daily. GitHub's platform auto-merge is disabled fleet-wide, so Renovate\n    # performs its own merges from inside this run — which means this cron is the\n    # MERGE cadence, not just the PR-creation cadence.\n    - cron: 0 */12 * * *\n  workflow_dispatch:\npermissions:\n  contents: read\njobs:\n  renovate:\n    runs-on: ubuntu-latest\n    steps:\n      # Renovate authenticates as the reddoor-renovate GitHub App (installed\n      # org-wide, \"All repositories\" — future repos are auto-covered), NOT as an\n      # operator PAT. Why: the App is a distinct identity, so the audit trail\n      # finally distinguishes bot from human (the 2026-07-26 unreviewed-major\n      # forensics took hours precisely because it couldn't); the credential is\n      # permission-scoped and centrally revocable instead of a fleet-write PAT;\n      # and the installation gets its own API-quota pool instead of sharing the\n      # operator's. The minted token is scoped to THIS repository only\n      # (create-github-app-token's default when owner/repositories are omitted).\n      # RENOVATE_APP_ID / RENOVATE_APP_PRIVATE_KEY are org-level (all-repos\n      # visibility) — nothing to configure per repo.\n      # Digest-pinned: this workflow mints a repo-write token, so a mutable tag\n      # ref here is a supply-chain hole — a retagged \\`@v3\\`/\\`@v46\\` would run\n      # attacker code with that token. Pin to the commit; Renovate bumps these.\n      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0\n        id: app-token\n        with:\n          app-id: \\${{ vars.RENOVATE_APP_ID }}\n          private-key: \\${{ secrets.RENOVATE_APP_PRIVATE_KEY }}\n      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7\n      - uses: renovatebot/github-action@1a96852b0384df1837619d04c60b2d10d1f9ff08 # v46.1.21\n        with:\n          token: \\${{ steps.app-token.outputs.token }}\n        env:\n          RENOVATE_REPOSITORIES: \\${{ github.repository }}\n          # Commit/PR identity = the App's bot user, so gitAuthor matches the\n          # token identity (mismatched authors read as \"operator pushed this\").\n          # 312185038 = the bot's user id (gh api 'users/reddoor-renovate[bot]' --jq .id).\n          RENOVATE_USERNAME: reddoor-renovate[bot]\n          RENOVATE_GIT_AUTHOR: reddoor-renovate[bot] <312185038+reddoor-renovate[bot]@users.noreply.github.com>\n`,\n};\n\nconst renovateConfig: ConfigTemplate = {\n  config: \"renovate-config\",\n  path: \"renovate.json\",\n  contents: `{\n  \"$schema\": \"https://docs.renovatebot.com/renovate-schema.json\",\n  \"extends\": [\"github>reddoorla/.github:renovate-config\"]\n}\n`,\n};\n\nconst netlify: ConfigTemplate = {\n  config: \"netlify\",\n  path: \"netlify.toml\",\n  contents: `[build]\n    command = \"pnpm build\"\n    publish = \"build/\"\n    functions = \"functions/\"\n\n[build.environment]\n    NODE_VERSION = \"22\"\n    COREPACK_INTEGRITY_KEYS = \"0\"\n\n# Baseline security headers for all responses. CSP is emitted per-response by\n# SvelteKit (see \\`kit.csp\\` in svelte.config.js) so it is intentionally omitted\n# here to avoid conflicting duplicates.\n[[headers]]\n    for = \"/*\"\n    [headers.values]\n        Strict-Transport-Security = \"max-age=63072000; includeSubDomains; preload\"\n        X-Content-Type-Options = \"nosniff\"\n        X-Frame-Options = \"SAMEORIGIN\"\n        Referrer-Policy = \"strict-origin-when-cross-origin\"\n        Permissions-Policy = \"camera=(), microphone=(), geolocation=(), interest-cohort=()\"\n        Cross-Origin-Opener-Policy = \"same-origin\"\n\n[[headers]]\n    for = \"/favicon.png\"\n    [headers.values]\n        Cache-Control = \"public, max-age=31536000, immutable\"\n\n[[headers]]\n    for = \"/_app/immutable/*\"\n    [headers.values]\n        Cache-Control = \"public, max-age=31536000, immutable\"\n`,\n};\n\nexport const ALL_TEMPLATES: ConfigTemplate[] = [\n  eslint,\n  prettier,\n  prettierIgnore,\n  lighthouse,\n  playwrightA11y,\n  svelte,\n  renovateAction,\n  renovateConfig,\n  netlify,\n];\n\nexport function templatesByName(which: ConfigName[]): ConfigTemplate[] {\n  return ALL_TEMPLATES.filter((t) => which.includes(t.config));\n}\n"],"mappings":";AAQA,IAAM,SAAyB;AAAA,EAC7B,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,UAAU;AAAA;AAAA;AAAA;AAAA;AAKZ;AAEA,IAAM,WAA2B;AAAA,EAC/B,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAOZ;AAEA,IAAM,iBAAiC;AAAA,EACrC,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAMZ;AAEA,IAAM,aAA6B;AAAA,EACjC,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,UAAU,GAAG,KAAK;AAAA,IAChB;AAAA,MACE,OACE;AAAA,MACF,SAAS;AAAA,IACX;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAAA;AAEH;AAEA,IAAM,iBAAiC;AAAA,EACrC,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,UAAU;AAAA;AAEZ;AAEA,IAAM,SAAyB;AAAA,EAC7B,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQZ;AAcA,IAAM,iBAAiC;AAAA,EACrC,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA6CZ;AAEA,IAAM,iBAAiC;AAAA,EACrC,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,UAAU;AAAA;AAAA;AAAA;AAAA;AAKZ;AAEA,IAAM,UAA0B;AAAA,EAC9B,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAgCZ;AAEO,IAAM,gBAAkC;AAAA,EAC7C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,SAAS,gBAAgB,OAAuC;AACrE,SAAO,cAAc,OAAO,CAAC,MAAM,MAAM,SAAS,EAAE,MAAM,CAAC;AAC7D;","names":[]}

package/dist/chunk-A3WDWNN5.js

@@ -0,0 +1,70 @@
+// src/forms/client.ts
+var INGEST_TIMEOUT_MS = 2e4;
+async function submitToIngest(opts) {
+  const doFetch = opts.fetch ?? fetch;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), opts.timeoutMs ?? INGEST_TIMEOUT_MS);
+  let res;
+  try {
+    res = await doFetch(opts.url, {
+      method: "POST",
+      headers: { "content-type": "application/json", "x-forms-token": opts.token },
+      body: JSON.stringify(opts.payload),
+      signal: controller.signal
+    });
+  } catch (err) {
+    return { ok: false, status: 0, error: `network error: ${String(err)}` };
+  } finally {
+    clearTimeout(timer);
+  }
+  let body = null;
+  try {
+    body = await res.json();
+  } catch {
+  }
+  const obj = body && typeof body === "object" ? body : null;
+  if (res.ok && obj && obj.ok === true) {
+    return { ok: true, id: String(obj.id ?? "") };
+  }
+  const error = obj && typeof obj.error === "string" ? obj.error : `ingest failed (${res.status})`;
+  return { ok: false, status: res.status, error };
+}
+async function submitScreenOut(opts) {
+  const doFetch = opts.fetch ?? fetch;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), opts.timeoutMs ?? 1500);
+  try {
+    const res = await doFetch(opts.url, {
+      method: "POST",
+      headers: { "content-type": "application/json", "x-forms-token": opts.token },
+      // `_screenOut` is a reserved wire key (underscore-namespaced like `_meta`)
+      // so a site's real form field named "screenOut" can never read as a beacon.
+      body: JSON.stringify({ _screenOut: opts.reason }),
+      signal: controller.signal
+    });
+    return { ok: res.ok, status: res.status };
+  } catch {
+    return { ok: false, status: 0 };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+var MIN_FILL_MS = 800;
+function screenSubmission(input) {
+  if (typeof input.botField === "string" && input.botField.trim().length > 0) {
+    return { ok: false, reason: "honeypot" };
+  }
+  if (typeof input.elapsedMs === "number" && input.elapsedMs < MIN_FILL_MS) {
+    return { ok: false, reason: "too-fast" };
+  }
+  return { ok: true };
+}
+
+export {
+  INGEST_TIMEOUT_MS,
+  submitToIngest,
+  submitScreenOut,
+  MIN_FILL_MS,
+  screenSubmission
+};
+//# sourceMappingURL=chunk-A3WDWNN5.js.map

package/dist/chunk-A3WDWNN5.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/forms/client.ts"],"sourcesContent":["import { SUBMISSION_FORM_TYPES, type FormType } from \"./types.js\";\nimport type { SubmissionMeta } from \"./meta.js\";\n\n/**\n * The JSON a fleet site forwards to the dashboard ingest endpoint. Typed fields\n * are optional; the index signature lets a site include its own extra fields\n * (e.g. `company`) which the dashboard normalizer captures into `extraFields`.\n *\n * Each typed field allows `string | undefined` (not just `string`) so a\n * `buildPayload` mapping can use the idiomatic `form.get(\"name\")?.toString()`\n * pattern under `exactOptionalPropertyTypes` without a cast — an absent field\n * and an explicit `undefined` both serialize away in the JSON body.\n */\nexport type SubmissionPayload = {\n  formType?: FormType | string | undefined;\n  name?: string | undefined;\n  firstName?: string | undefined;\n  lastName?: string | undefined;\n  email?: string | undefined;\n  phone?: string | undefined;\n  message?: string | undefined;\n  sourceUrl?: string | undefined;\n  utm?: string | undefined;\n  /** Reserved transport envelope (token/IP/UA); stripped centrally, never persisted. */\n  _meta?: SubmissionMeta | undefined;\n  [key: string]: unknown;\n};\n\nexport type IngestClientResult =\n  { ok: true; id: string } | { ok: false; status: number; error: string };\n\nexport type SubmitToIngestOptions = {\n  /** Full ingest endpoint incl. the site slug, e.g. https://…/api/forms/reddoor */\n  url: string;\n  /** The shared FORMS_INGEST_TOKEN. */\n  token: string;\n  payload: SubmissionPayload;\n  /** Injectable fetch (pass SvelteKit's `event.fetch`); defaults to global fetch. */\n  fetch?: typeof fetch;\n  /** Abort budget for the central call. Default INGEST_TIMEOUT_MS. */\n  timeoutMs?: number;\n};\n\n/** Default abort budget for the site→central ingest call. A central function hung\n *  mid-deploy otherwise leaves the visitor's submit awaiting until Netlify kills\n *  the SITE function at its sync limit — a broken response instead of the\n *  friendly error copy (espada's 2026-07-10 form-e2e warns caught exactly this).\n *\n *  ABORTING TOO EARLY IS THE WORSE FAILURE, because central persists the lead\n *  BEFORE its best-effort tail (notify → stamp → fan-out, see ingest.ts): once\n *  the row exists the lead is captured, so a client-side abort reports failure\n *  for a submission that is already saved AND emailed. Observed on 1836dig\n *  2026-08-03: row `sub_f4f195ff` stored, operator email delivered, and the\n *  visitor still got the failure copy — the visitor's only signal says the\n *  opposite of the truth, and a retry duplicates the lead.\n *\n *  The old 8s was calibrated against a 10s Netlify sync limit; the envelope is\n *  now 30s (`SYNCHRONOUS_FUNCTION_TIMEOUT`), so that headroom argument no\n *  longer binds. It also did not clear a COLD central call: measured\n *  2026-08-03, cold start ~1.9s + Airtable slug lookup ~2.4s + Turso\n *  open/migrate + insert + Resend ~0.8s lands at ~5-7s, leaving 8s with no real\n *  margin. 20s is ~3x that path and still leaves 10s of the envelope for the\n *  action to render. A visitor waiting is recoverable; a visitor wrongly told\n *  their message was lost is not. */\nexport const INGEST_TIMEOUT_MS = 20_000;\n\n/**\n * Forward a submission to the dashboard ingest endpoint. Never throws — a network\n * failure or a non-2xx response is returned as `{ ok: false }` so the caller can\n * show a friendly error rather than a 500.\n */\nexport async function submitToIngest(opts: SubmitToIngestOptions): Promise<IngestClientResult> {\n  const doFetch = opts.fetch ?? fetch;\n  const controller = new AbortController();\n  const timer = setTimeout(() => controller.abort(), opts.timeoutMs ?? INGEST_TIMEOUT_MS);\n  let res: Response;\n  try {\n    res = await doFetch(opts.url, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/json\", \"x-forms-token\": opts.token },\n      body: JSON.stringify(opts.payload),\n      signal: controller.signal,\n    });\n  } catch (err) {\n    return { ok: false, status: 0, error: `network error: ${String(err)}` };\n  } finally {\n    clearTimeout(timer);\n  }\n  let body: unknown = null;\n  try {\n    body = await res.json();\n  } catch {\n    // non-JSON response — fall through to the error path\n  }\n  const obj = body && typeof body === \"object\" ? (body as Record<string, unknown>) : null;\n  if (res.ok && obj && obj.ok === true) {\n    return { ok: true, id: String(obj.id ?? \"\") };\n  }\n  const error = obj && typeof obj.error === \"string\" ? obj.error : `ingest failed (${res.status})`;\n  return { ok: false, status: res.status, error };\n}\n\nexport type SubmitScreenOutOptions = {\n  /** Same ingest endpoint the site already posts submissions to. */\n  url: string;\n  token: string;\n  reason: \"honeypot\" | \"too-fast\";\n  fetch?: typeof fetch;\n  /** Abort budget so a slow/hung beacon can't delay the (already-successful) response. */\n  timeoutMs?: number;\n};\n\n/**\n * Best-effort screen-out beacon: tells the central ingest \"a bot was screened here\"\n * (no PII) so caught-vs-delivered is observable. Never throws — a failure is returned\n * as { ok: false } and the caller ignores it (the visitor already saw success).\n */\nexport async function submitScreenOut(\n  opts: SubmitScreenOutOptions,\n): Promise<{ ok: boolean; status: number }> {\n  const doFetch = opts.fetch ?? fetch;\n  const controller = new AbortController();\n  const timer = setTimeout(() => controller.abort(), opts.timeoutMs ?? 1500);\n  try {\n    const res = await doFetch(opts.url, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/json\", \"x-forms-token\": opts.token },\n      // `_screenOut` is a reserved wire key (underscore-namespaced like `_meta`)\n      // so a site's real form field named \"screenOut\" can never read as a beacon.\n      body: JSON.stringify({ _screenOut: opts.reason }),\n      signal: controller.signal,\n    });\n    return { ok: res.ok, status: res.status };\n  } catch {\n    return { ok: false, status: 0 };\n  } finally {\n    clearTimeout(timer);\n  }\n}\n\nexport type ScreenInput = { botField?: string | null; elapsedMs?: number | null };\nexport type ScreenResult = { ok: true } | { ok: false; reason: \"honeypot\" | \"too-fast\" };\n\n/**\n * Minimum plausible fill time; faster than this reads as a bot. Kept low (800ms)\n * on purpose: a too-fast fill is dropped *silently* (the visitor sees success),\n * so a real human who happens to be quick — autofill, a short form, a returning\n * visitor — would lose their lead with no trace. Below this, a submit is\n * effectively instant (page render → fill → click → network all under ~0.8s),\n * which a human realistically never beats but a script does. The honeypot is the\n * primary bot signal; this is the secondary one, so it errs toward letting\n * borderline-fast humans through.\n */\nexport const MIN_FILL_MS = 800;\n\n/**\n * Cheap bot screen for the site action. A filled honeypot is a bot; a submission\n * faster than MIN_FILL_MS is a bot. Missing timing data (null/undefined) is NOT a\n * rejection — a prerendered/cached page can't plant a fresh timestamp, and the\n * honeypot remains the primary signal.\n *\n * Any numeric elapsed BELOW the floor — including a NEGATIVE value — is too-fast. A\n * negative elapsed time is impossible for a real fill: it means the client posted a\n * FUTURE timestamp. The earlier `>= 0` guard let that slip through (negative skipped\n * the `< MIN_FILL_MS` branch and returned ok), silently bypassing the timing gate.\n */\nexport function screenSubmission(input: ScreenInput): ScreenResult {\n  if (typeof input.botField === \"string\" && input.botField.trim().length > 0) {\n    return { ok: false, reason: \"honeypot\" };\n  }\n  if (typeof input.elapsedMs === \"number\" && input.elapsedMs < MIN_FILL_MS) {\n    return { ok: false, reason: \"too-fast\" };\n  }\n  return { ok: true };\n}\n\nexport { SUBMISSION_FORM_TYPES, type FormType };\n"],"mappings":";AAgEO,IAAM,oBAAoB;AAOjC,eAAsB,eAAe,MAA0D;AAC7F,QAAM,UAAU,KAAK,SAAS;AAC9B,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,KAAK,aAAa,iBAAiB;AACtF,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,QAAQ,KAAK,KAAK;AAAA,MAC5B,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,oBAAoB,iBAAiB,KAAK,MAAM;AAAA,MAC3E,MAAM,KAAK,UAAU,KAAK,OAAO;AAAA,MACjC,QAAQ,WAAW;AAAA,IACrB,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,WAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,OAAO,kBAAkB,OAAO,GAAG,CAAC,GAAG;AAAA,EACxE,UAAE;AACA,iBAAa,KAAK;AAAA,EACpB;AACA,MAAI,OAAgB;AACpB,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AAAA,EAER;AACA,QAAM,MAAM,QAAQ,OAAO,SAAS,WAAY,OAAmC;AACnF,MAAI,IAAI,MAAM,OAAO,IAAI,OAAO,MAAM;AACpC,WAAO,EAAE,IAAI,MAAM,IAAI,OAAO,IAAI,MAAM,EAAE,EAAE;AAAA,EAC9C;AACA,QAAM,QAAQ,OAAO,OAAO,IAAI,UAAU,WAAW,IAAI,QAAQ,kBAAkB,IAAI,MAAM;AAC7F,SAAO,EAAE,IAAI,OAAO,QAAQ,IAAI,QAAQ,MAAM;AAChD;AAiBA,eAAsB,gBACpB,MAC0C;AAC1C,QAAM,UAAU,KAAK,SAAS;AAC9B,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,KAAK,aAAa,IAAI;AACzE,MAAI;AACF,UAAM,MAAM,MAAM,QAAQ,KAAK,KAAK;AAAA,MAClC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,oBAAoB,iBAAiB,KAAK,MAAM;AAAA;AAAA;AAAA,MAG3E,MAAM,KAAK,UAAU,EAAE,YAAY,KAAK,OAAO,CAAC;AAAA,MAChD,QAAQ,WAAW;AAAA,IACrB,CAAC;AACD,WAAO,EAAE,IAAI,IAAI,IAAI,QAAQ,IAAI,OAAO;AAAA,EAC1C,QAAQ;AACN,WAAO,EAAE,IAAI,OAAO,QAAQ,EAAE;AAAA,EAChC,UAAE;AACA,iBAAa,KAAK;AAAA,EACpB;AACF;AAeO,IAAM,cAAc;AAapB,SAAS,iBAAiB,OAAkC;AACjE,MAAI,OAAO,MAAM,aAAa,YAAY,MAAM,SAAS,KAAK,EAAE,SAAS,GAAG;AAC1E,WAAO,EAAE,IAAI,OAAO,QAAQ,WAAW;AAAA,EACzC;AACA,MAAI,OAAO,MAAM,cAAc,YAAY,MAAM,YAAY,aAAa;AACxE,WAAO,EAAE,IAAI,OAAO,QAAQ,WAAW;AAAA,EACzC;AACA,SAAO,EAAE,IAAI,KAAK;AACpB;","names":[]}

package/dist/{chunk-D3DQFC32.js → chunk-ATJ6ZA2V.js}

@@ -1,6 +1,6 @@
 import {
   withRecipe
-} from "./chunk-XKOZUVK2.js";
+} from "./chunk-ZTPPCHDB.js";
 import {
   defaultSpawn
 } from "./chunk-HVOOCK6L.js";
@@ -76,4 +76,4 @@ async function bumpDeps(site, opts = {}) {
 export {
   bumpDeps
 };
-//# sourceMappingURL=chunk-D3DQFC32.js.map
+//# sourceMappingURL=chunk-ATJ6ZA2V.js.map

package/dist/{chunk-ZO7WNY57.js → chunk-B5ZUQZFL.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-J7SZQUCW.js";
 import {
   withRecipe
-} from "./chunk-XKOZUVK2.js";
+} from "./chunk-ZTPPCHDB.js";
 import {
   bumpDep,
   readPackageJson,
@@ -243,4 +243,4 @@ async function upgradeSvelte4to5(site, opts = {}) {
 export {
   upgradeSvelte4to5
 };
-//# sourceMappingURL=chunk-ZO7WNY57.js.map
+//# sourceMappingURL=chunk-B5ZUQZFL.js.map

package/dist/{chunk-PH3AGF4Z.js → chunk-DC5H7KEQ.js}

@@ -1,6 +1,6 @@
 import {
   runMigrations
-} from "./chunk-HIN3P4ZN.js";
+} from "./chunk-4SOCPK7A.js";
 import {
   defaultCredentialsPath
 } from "./chunk-6VAL7XJT.js";
@@ -48,4 +48,4 @@ export {
   readDbConfig,
   openDb
 };
-//# sourceMappingURL=chunk-PH3AGF4Z.js.map
+//# sourceMappingURL=chunk-DC5H7KEQ.js.map

package/dist/{chunk-DYKG53IR.js → chunk-FAQIMC26.js}

@@ -1,27 +1,27 @@
 import {
   convertToPnpm
-} from "./chunk-2X322ZES.js";
+} from "./chunk-MGJ72BA4.js";
 import {
   svelteCodemods
-} from "./chunk-BTEBRTW4.js";
+} from "./chunk-LS6QPANO.js";
 import {
   healthEndpoint
-} from "./chunk-7MJBTV2R.js";
+} from "./chunk-FX7RAMGC.js";
 import {
   smokeSuite
-} from "./chunk-PKVZMFEB.js";
+} from "./chunk-K5JZ5KLO.js";
 import {
   onboard
-} from "./chunk-ZYBOT5PM.js";
+} from "./chunk-NT4WIP7I.js";
 import {
   syncConfigs
-} from "./chunk-JNXCDUYB.js";
+} from "./chunk-Q276MZ7E.js";
 import {
   withRecipe
-} from "./chunk-XKOZUVK2.js";
+} from "./chunk-ZTPPCHDB.js";
 import {
   runAudits
-} from "./chunk-3U3IGVAQ.js";
+} from "./chunk-3LWKIKZ2.js";
 import {
   siteLabel
 } from "./chunk-XXTZBPUY.js";
@@ -143,4 +143,4 @@ export {
   DEFAULT_INIT_STEPS,
   init
 };
-//# sourceMappingURL=chunk-DYKG53IR.js.map
+//# sourceMappingURL=chunk-FAQIMC26.js.map

package/dist/{chunk-4VAUSRSS.js → chunk-FVVGDIGX.js}

@@ -20,7 +20,7 @@ import {
 } from "./chunk-WEKL2HYJ.js";
 import {
   recordFleetEventsBestEffort
-} from "./chunk-GYNRZCM6.js";
+} from "./chunk-QG6OSL4M.js";
 import {
   listWebsites,
   siteSlug,
@@ -333,4 +333,4 @@ export {
   parseAddresses,
   isProbablyEmail
 };
-//# sourceMappingURL=chunk-4VAUSRSS.js.map
+//# sourceMappingURL=chunk-FVVGDIGX.js.map

package/dist/{chunk-7MJBTV2R.js → chunk-FX7RAMGC.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-KRDLHAKK.js";
 import {
   withRecipe
-} from "./chunk-XKOZUVK2.js";
+} from "./chunk-ZTPPCHDB.js";
 import {
   defaultSpawn
 } from "./chunk-HVOOCK6L.js";
@@ -142,4 +142,4 @@ async function healthEndpoint(site, deps = { spawn: defaultSpawn }) {
 export {
   healthEndpoint
 };
-//# sourceMappingURL=chunk-7MJBTV2R.js.map
+//# sourceMappingURL=chunk-FX7RAMGC.js.map

package/dist/{chunk-PKVZMFEB.js → chunk-K5JZ5KLO.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-KRDLHAKK.js";
 import {
   withRecipe
-} from "./chunk-XKOZUVK2.js";
+} from "./chunk-ZTPPCHDB.js";
 import {
   defaultSpawn
 } from "./chunk-HVOOCK6L.js";
@@ -312,4 +312,4 @@ async function smokeSuite(site, deps = { spawn: defaultSpawn }) {
 export {
   smokeSuite
 };
-//# sourceMappingURL=chunk-PKVZMFEB.js.map
+//# sourceMappingURL=chunk-K5JZ5KLO.js.map

package/dist/{chunk-CZAMYVOP.js → chunk-KPQXB5CR.js}

@@ -1,6 +1,6 @@
 import {
   approveBlockers
-} from "./chunk-JTRTG5CU.js";
+} from "./chunk-YIQ7IWE3.js";
 import {
   siteSlug
 } from "./chunk-GXVX4HUH.js";
@@ -297,4 +297,4 @@ export {
   readDigestState,
   writeDigestState
 };
-//# sourceMappingURL=chunk-CZAMYVOP.js.map
+//# sourceMappingURL=chunk-KPQXB5CR.js.map

package/dist/{chunk-BTEBRTW4.js → chunk-LS6QPANO.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-J7SZQUCW.js";
 import {
   withRecipe
-} from "./chunk-XKOZUVK2.js";
+} from "./chunk-ZTPPCHDB.js";
 
 // src/recipes/svelte-codemods.ts
 import { writeFile } from "fs/promises";
@@ -32,4 +32,4 @@ async function svelteCodemods(site) {
 export {
   svelteCodemods
 };
-//# sourceMappingURL=chunk-BTEBRTW4.js.map
+//# sourceMappingURL=chunk-LS6QPANO.js.map

package/dist/{chunk-2X322ZES.js → chunk-MGJ72BA4.js}

@@ -1,6 +1,6 @@
 import {
   withRecipe
-} from "./chunk-XKOZUVK2.js";
+} from "./chunk-ZTPPCHDB.js";
 import {
   readPackageJson,
   writePackageJson
@@ -96,4 +96,4 @@ async function convertToPnpm(site, opts = {}) {
 export {
   convertToPnpm
 };
-//# sourceMappingURL=chunk-2X322ZES.js.map
+//# sourceMappingURL=chunk-MGJ72BA4.js.map

package/dist/chunk-MNDIED4M.js

@@ -0,0 +1,137 @@
+// src/github/rulesets.ts
+var FLEET_RULESET_NAME = "main: reviewed changes only";
+var DEFAULT_PULL_REQUEST_PARAMS = {
+  required_approving_review_count: 0,
+  dismiss_stale_reviews_on_push: false,
+  require_code_owner_review: false,
+  require_last_push_approval: false,
+  required_review_thread_resolution: false,
+  allowed_merge_methods: ["squash", "merge", "rebase"]
+};
+function coversDefaultBranch(include) {
+  return (include ?? []).some((r) => r === "~DEFAULT_BRANCH" || r === "~ALL");
+}
+function statusChecksOf(rule) {
+  const raw = rule?.parameters?.["required_status_checks"];
+  return Array.isArray(raw) ? raw : [];
+}
+function ruleOfType(rules, type) {
+  return (rules ?? []).find((r) => r.type === type);
+}
+function desiredRuleset(requiredCheck) {
+  return {
+    name: FLEET_RULESET_NAME,
+    target: "branch",
+    enforcement: "active",
+    bypass_actors: [],
+    conditions: { ref_name: { include: ["~DEFAULT_BRANCH"], exclude: [] } },
+    rules: [
+      { type: "deletion" },
+      { type: "non_fast_forward" },
+      { type: "pull_request", parameters: { ...DEFAULT_PULL_REQUEST_PARAMS } },
+      ...requiredCheck === null ? [] : [
+        {
+          type: "required_status_checks",
+          parameters: {
+            strict_required_status_checks_policy: true,
+            do_not_enforce_on_create: false,
+            required_status_checks: [{ context: requiredCheck }]
+          }
+        }
+      ]
+    ]
+  };
+}
+function rulesetGaps(existing, requiredCheck) {
+  const gaps = [];
+  if (existing.enforcement !== "active") {
+    gaps.push(`enforcement is ${JSON.stringify(existing.enforcement ?? "unset")}, not "active"`);
+  }
+  const bypass = existing.bypass_actors ?? [];
+  if (bypass.length > 0) {
+    gaps.push(`${bypass.length} bypass actor(s) present (fleet floor is an empty bypass list)`);
+  }
+  if (!coversDefaultBranch(existing.conditions?.ref_name?.include)) {
+    gaps.push("ref conditions do not cover the default branch");
+  }
+  const exclude = existing.conditions?.ref_name?.exclude ?? [];
+  if (exclude.length > 0) {
+    gaps.push(
+      `${exclude.length} ref exclude pattern(s) present (excludes can only weaken; fleet floor is none)`
+    );
+  }
+  for (const type of ["deletion", "non_fast_forward", "pull_request"]) {
+    if (!ruleOfType(existing.rules, type)) gaps.push(`missing ${type} rule`);
+  }
+  if (requiredCheck !== null) {
+    const rsc = ruleOfType(existing.rules, "required_status_checks");
+    if (!rsc) {
+      gaps.push(`missing required_status_checks rule ("${requiredCheck}" is observed on the repo)`);
+    } else {
+      if (!statusChecksOf(rsc).some((c) => c.context === requiredCheck)) {
+        gaps.push(`"${requiredCheck}" not among the required status checks`);
+      }
+      if (rsc.parameters?.["strict_required_status_checks_policy"] !== true) {
+        gaps.push("strict (branch-up-to-date) status-check policy is off");
+      }
+    }
+  }
+  return gaps;
+}
+function healRuleset(existing, requiredCheck) {
+  const rules = (existing.rules ?? []).map((r) => ({
+    type: r.type,
+    ...r.parameters === void 0 ? {} : { parameters: { ...r.parameters } }
+  }));
+  for (const type of ["deletion", "non_fast_forward"]) {
+    if (!ruleOfType(rules, type)) rules.push({ type });
+  }
+  if (!ruleOfType(rules, "pull_request")) {
+    rules.push({ type: "pull_request", parameters: { ...DEFAULT_PULL_REQUEST_PARAMS } });
+  }
+  if (requiredCheck !== null) {
+    const rsc = ruleOfType(rules, "required_status_checks");
+    if (!rsc) {
+      rules.push({
+        type: "required_status_checks",
+        parameters: {
+          strict_required_status_checks_policy: true,
+          do_not_enforce_on_create: false,
+          required_status_checks: [{ context: requiredCheck }]
+        }
+      });
+    } else {
+      const params = rsc.parameters ??= {};
+      const checks = statusChecksOf(rsc);
+      if (!checks.some((c) => c.context === requiredCheck)) {
+        params["required_status_checks"] = [...checks, { context: requiredCheck }];
+      }
+      params["strict_required_status_checks_policy"] = true;
+    }
+  }
+  const include = existing.conditions?.ref_name?.include ?? [];
+  return {
+    name: existing.name,
+    target: "branch",
+    enforcement: "active",
+    bypass_actors: [],
+    conditions: {
+      ref_name: {
+        include: coversDefaultBranch(include) ? [...include] : [...include, "~DEFAULT_BRANCH"],
+        // Excludes are cleared, never preserved: they can only remove
+        // protection, and the pure logic cannot tell a benign pattern from
+        // one that neutralizes the default branch (see rulesetGaps).
+        exclude: []
+      }
+    },
+    rules
+  };
+}
+
+export {
+  FLEET_RULESET_NAME,
+  desiredRuleset,
+  rulesetGaps,
+  healRuleset
+};
+//# sourceMappingURL=chunk-MNDIED4M.js.map

package/dist/chunk-MNDIED4M.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/github/rulesets.ts"],"sourcesContent":["/**\n * The pure invariant core of ruleset self-healing (spec:\n * docs/superpowers/specs/2026-08-02-ruleset-self-healing-design.md).\n *\n * Everything here is pure data-in/data-out so the brick-risk logic — \"when is\n * it safe to require a status check\", \"what does healing preserve\" — is unit\n * tested directly. The API I/O lives in gh.ts as thin wrappers.\n *\n * Why rulesets at all, when `protectBranch` (classic protection) already\n * exists: classic protection's `enforce_admins: false` exempts admins, and on\n * 2026-07-26 that hole let a bulk `gh pr merge --auto` sweep land two\n * unreviewed MAJOR bumps (reddoor-starter#77, reddoor-website#111). A ruleset\n * with an EMPTY bypass list binds everyone, including admins. Classic\n * protection stays in place (union-enforced) — this is the stronger layer on\n * top, and the one the fleet actually relies on.\n */\n\n/** One rule inside a ruleset. Kept structurally loose (`parameters` is an open\n *  record) so a GitHub-added rule type or parameter can never crash the parse —\n *  unknown shapes flow through healing untouched. */\nexport type RulesetRule = {\n  type: string;\n  parameters?: Record<string, unknown>;\n};\n\n/** The subset of a GET /repos/{repo}/rulesets/{id} response the logic reads.\n *  Extra fields (timestamps, node_id, _links, current_user_can_bypass) are\n *  ignored on read and never echoed back on PUT. */\nexport type ExistingRuleset = {\n  id: number;\n  name: string;\n  enforcement?: string;\n  bypass_actors?: unknown[];\n  conditions?: { ref_name?: { include?: string[]; exclude?: string[] } };\n  rules?: RulesetRule[];\n};\n\n/** The payload shape POST/PUT accepts. */\nexport type RulesetPayload = {\n  name: string;\n  target: \"branch\";\n  enforcement: \"active\";\n  bypass_actors: unknown[];\n  conditions: { ref_name: { include: string[]; exclude: string[] } };\n  rules: RulesetRule[];\n};\n\n/** Canonical fleet ruleset name — matches the 22 hand-applied 2026-07-31/08-01. */\nexport const FLEET_RULESET_NAME = \"main: reviewed changes only\";\n\n/** `pull_request` defaults for a CREATED ruleset. 0 approvals is deliberate:\n *  one-member org + GitHub forbids self-approval, so any required approval\n *  deadlocks every PR (operator- and Renovate-authored alike) until the\n *  Renovate App identity exists. On HEAL these are never imposed — existing\n *  parameters are preserved so a hand-hardened repo (e.g.\n *  `required_review_thread_resolution: true`) is not fought back down. */\nconst DEFAULT_PULL_REQUEST_PARAMS: Record<string, unknown> = {\n  required_approving_review_count: 0,\n  dismiss_stale_reviews_on_push: false,\n  require_code_owner_review: false,\n  require_last_push_approval: false,\n  required_review_thread_resolution: false,\n  allowed_merge_methods: [\"squash\", \"merge\", \"rebase\"],\n};\n\n/** The ref-condition tokens that cover the default branch. `~ALL` is a\n *  superset of `~DEFAULT_BRANCH`, so either satisfies the floor. */\nfunction coversDefaultBranch(include: string[] | undefined): boolean {\n  return (include ?? []).some((r) => r === \"~DEFAULT_BRANCH\" || r === \"~ALL\");\n}\n\nfunction statusChecksOf(rule: RulesetRule | undefined): Array<{ context?: string }> {\n  const raw = rule?.parameters?.[\"required_status_checks\"];\n  return Array.isArray(raw) ? (raw as Array<{ context?: string }>) : [];\n}\n\nfunction ruleOfType(rules: RulesetRule[] | undefined, type: string): RulesetRule | undefined {\n  return (rules ?? []).find((r) => r.type === type);\n}\n\n/**\n * The desired payload for a repo with NO existing fleet ruleset.\n *\n * `requiredCheck` is the two-stage gate: pass the context string ONLY when\n * that check-run has been observed on the default branch (see\n * `checkContextObserved` in gh.ts); pass `null` otherwise and the ruleset is\n * created with the refs rules alone. Requiring a context that never fires\n * would make the repo permanently unmergeable by EVERYONE — bypass_actors is\n * empty by design, so there is no admin escape. (`.github` sits at stage 1\n * forever for exactly this reason: its ci.yml is `workflow_call`-only and\n * emits no check runs.)\n */\nexport function desiredRuleset(requiredCheck: string | null): RulesetPayload {\n  return {\n    name: FLEET_RULESET_NAME,\n    target: \"branch\",\n    enforcement: \"active\",\n    bypass_actors: [],\n    conditions: { ref_name: { include: [\"~DEFAULT_BRANCH\"], exclude: [] } },\n    rules: [\n      { type: \"deletion\" },\n      { type: \"non_fast_forward\" },\n      { type: \"pull_request\", parameters: { ...DEFAULT_PULL_REQUEST_PARAMS } },\n      ...(requiredCheck === null\n        ? []\n        : [\n            {\n              type: \"required_status_checks\",\n              parameters: {\n                strict_required_status_checks_policy: true,\n                do_not_enforce_on_create: false,\n                required_status_checks: [{ context: requiredCheck }],\n              },\n            },\n          ]),\n    ],\n  };\n}\n\n/**\n * Human-readable floor violations of an existing ruleset; empty array = the\n * ruleset satisfies the fleet floor and must NOT be touched (the noop path).\n *\n * The floor is deliberately a MINIMUM, not an exact shape: extra rules and\n * stronger `pull_request` parameters are not gaps. The one aggressive check is\n * `bypass_actors` — ANY entry is drift, because an empty bypass list is the\n * entire point of the ruleset layer (it is what binds admins). When the\n * Renovate App identity someday warrants a bypass actor, this is the single\n * place that decision gets encoded.\n *\n * `requiredCheck: null` scopes the floor to stage 1 (refs rules only); a\n * string additionally demands that context among required status checks with\n * strict (up-to-date) policy.\n */\nexport function rulesetGaps(existing: ExistingRuleset, requiredCheck: string | null): string[] {\n  const gaps: string[] = [];\n  if (existing.enforcement !== \"active\") {\n    gaps.push(`enforcement is ${JSON.stringify(existing.enforcement ?? \"unset\")}, not \"active\"`);\n  }\n  const bypass = existing.bypass_actors ?? [];\n  if (bypass.length > 0) {\n    gaps.push(`${bypass.length} bypass actor(s) present (fleet floor is an empty bypass list)`);\n  }\n  if (!coversDefaultBranch(existing.conditions?.ref_name?.include)) {\n    gaps.push(\"ref conditions do not cover the default branch\");\n  }\n  // Exclude patterns can ONLY remove protection (GitHub applies exclude over\n  // include), and the pure floor cannot resolve which patterns match the\n  // default branch — `exclude: [\"refs/heads/main\"]` neutralizes the entire\n  // ruleset while every other check here still passes. It is also the\n  // least-destructive-LOOKING admin edit (\"I'll just exclude main for a\n  // minute\"), i.e. exactly the bypass drift this layer alarms on. The fleet\n  // floor is therefore NO excludes at all.\n  const exclude = existing.conditions?.ref_name?.exclude ?? [];\n  if (exclude.length > 0) {\n    gaps.push(\n      `${exclude.length} ref exclude pattern(s) present (excludes can only weaken; fleet floor is none)`,\n    );\n  }\n  for (const type of [\"deletion\", \"non_fast_forward\", \"pull_request\"]) {\n    if (!ruleOfType(existing.rules, type)) gaps.push(`missing ${type} rule`);\n  }\n  if (requiredCheck !== null) {\n    const rsc = ruleOfType(existing.rules, \"required_status_checks\");\n    if (!rsc) {\n      gaps.push(`missing required_status_checks rule (\"${requiredCheck}\" is observed on the repo)`);\n    } else {\n      if (!statusChecksOf(rsc).some((c) => c.context === requiredCheck)) {\n        gaps.push(`\"${requiredCheck}\" not among the required status checks`);\n      }\n      if (rsc.parameters?.[\"strict_required_status_checks_policy\"] !== true) {\n        gaps.push(\"strict (branch-up-to-date) status-check policy is off\");\n      }\n    }\n  }\n  return gaps;\n}\n\n/**\n * The healed PUT payload for a drifted ruleset: existing content merged TOWARD\n * the floor, never away from it.\n *\n * Preserved verbatim: extra rule types (a hand-added `required_linear_history`\n * survives), existing `pull_request` parameters (hand-hardening survives),\n * other required status-check contexts (union, never replace — the same\n * lesson the classic protectBranch PUT learned), and existing ref INCLUDES\n * beyond the default-branch guarantee (extra includes only strengthen).\n *\n * Healed: enforcement → active, bypass_actors → [], and ref excludes → []\n * (both deliberate exceptions to never-weaken, because both are pure\n * weakenings — a bypass actor or an exclude matching the default branch IS\n * the drift being alarmed on), missing rules added, and — only when\n * `requiredCheck` is non-null — the context unioned in with strict policy\n * forced on.\n */\nexport function healRuleset(\n  existing: ExistingRuleset,\n  requiredCheck: string | null,\n): RulesetPayload {\n  const rules: RulesetRule[] = (existing.rules ?? []).map((r) => ({\n    type: r.type,\n    ...(r.parameters === undefined ? {} : { parameters: { ...r.parameters } }),\n  }));\n  for (const type of [\"deletion\", \"non_fast_forward\"]) {\n    if (!ruleOfType(rules, type)) rules.push({ type });\n  }\n  if (!ruleOfType(rules, \"pull_request\")) {\n    rules.push({ type: \"pull_request\", parameters: { ...DEFAULT_PULL_REQUEST_PARAMS } });\n  }\n  if (requiredCheck !== null) {\n    const rsc = ruleOfType(rules, \"required_status_checks\");\n    if (!rsc) {\n      rules.push({\n        type: \"required_status_checks\",\n        parameters: {\n          strict_required_status_checks_policy: true,\n          do_not_enforce_on_create: false,\n          required_status_checks: [{ context: requiredCheck }],\n        },\n      });\n    } else {\n      const params = (rsc.parameters ??= {});\n      const checks = statusChecksOf(rsc);\n      if (!checks.some((c) => c.context === requiredCheck)) {\n        params[\"required_status_checks\"] = [...checks, { context: requiredCheck }];\n      }\n      params[\"strict_required_status_checks_policy\"] = true;\n    }\n  }\n\n  const include = existing.conditions?.ref_name?.include ?? [];\n  return {\n    name: existing.name,\n    target: \"branch\",\n    enforcement: \"active\",\n    bypass_actors: [],\n    conditions: {\n      ref_name: {\n        include: coversDefaultBranch(include) ? [...include] : [...include, \"~DEFAULT_BRANCH\"],\n        // Excludes are cleared, never preserved: they can only remove\n        // protection, and the pure logic cannot tell a benign pattern from\n        // one that neutralizes the default branch (see rulesetGaps).\n        exclude: [],\n      },\n    },\n    rules,\n  };\n}\n"],"mappings":";AAgDO,IAAM,qBAAqB;AAQlC,IAAM,8BAAuD;AAAA,EAC3D,iCAAiC;AAAA,EACjC,+BAA+B;AAAA,EAC/B,2BAA2B;AAAA,EAC3B,4BAA4B;AAAA,EAC5B,mCAAmC;AAAA,EACnC,uBAAuB,CAAC,UAAU,SAAS,QAAQ;AACrD;AAIA,SAAS,oBAAoB,SAAwC;AACnE,UAAQ,WAAW,CAAC,GAAG,KAAK,CAAC,MAAM,MAAM,qBAAqB,MAAM,MAAM;AAC5E;AAEA,SAAS,eAAe,MAA4D;AAClF,QAAM,MAAM,MAAM,aAAa,wBAAwB;AACvD,SAAO,MAAM,QAAQ,GAAG,IAAK,MAAsC,CAAC;AACtE;AAEA,SAAS,WAAW,OAAkC,MAAuC;AAC3F,UAAQ,SAAS,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,SAAS,IAAI;AAClD;AAcO,SAAS,eAAe,eAA8C;AAC3E,SAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,aAAa;AAAA,IACb,eAAe,CAAC;AAAA,IAChB,YAAY,EAAE,UAAU,EAAE,SAAS,CAAC,iBAAiB,GAAG,SAAS,CAAC,EAAE,EAAE;AAAA,IACtE,OAAO;AAAA,MACL,EAAE,MAAM,WAAW;AAAA,MACnB,EAAE,MAAM,mBAAmB;AAAA,MAC3B,EAAE,MAAM,gBAAgB,YAAY,EAAE,GAAG,4BAA4B,EAAE;AAAA,MACvE,GAAI,kBAAkB,OAClB,CAAC,IACD;AAAA,QACE;AAAA,UACE,MAAM;AAAA,UACN,YAAY;AAAA,YACV,sCAAsC;AAAA,YACtC,0BAA0B;AAAA,YAC1B,wBAAwB,CAAC,EAAE,SAAS,cAAc,CAAC;AAAA,UACrD;AAAA,QACF;AAAA,MACF;AAAA,IACN;AAAA,EACF;AACF;AAiBO,SAAS,YAAY,UAA2B,eAAwC;AAC7F,QAAM,OAAiB,CAAC;AACxB,MAAI,SAAS,gBAAgB,UAAU;AACrC,SAAK,KAAK,kBAAkB,KAAK,UAAU,SAAS,eAAe,OAAO,CAAC,gBAAgB;AAAA,EAC7F;AACA,QAAM,SAAS,SAAS,iBAAiB,CAAC;AAC1C,MAAI,OAAO,SAAS,GAAG;AACrB,SAAK,KAAK,GAAG,OAAO,MAAM,gEAAgE;AAAA,EAC5F;AACA,MAAI,CAAC,oBAAoB,SAAS,YAAY,UAAU,OAAO,GAAG;AAChE,SAAK,KAAK,gDAAgD;AAAA,EAC5D;AAQA,QAAM,UAAU,SAAS,YAAY,UAAU,WAAW,CAAC;AAC3D,MAAI,QAAQ,SAAS,GAAG;AACtB,SAAK;AAAA,MACH,GAAG,QAAQ,MAAM;AAAA,IACnB;AAAA,EACF;AACA,aAAW,QAAQ,CAAC,YAAY,oBAAoB,cAAc,GAAG;AACnE,QAAI,CAAC,WAAW,SAAS,OAAO,IAAI,EAAG,MAAK,KAAK,WAAW,IAAI,OAAO;AAAA,EACzE;AACA,MAAI,kBAAkB,MAAM;AAC1B,UAAM,MAAM,WAAW,SAAS,OAAO,wBAAwB;AAC/D,QAAI,CAAC,KAAK;AACR,WAAK,KAAK,yCAAyC,aAAa,4BAA4B;AAAA,IAC9F,OAAO;AACL,UAAI,CAAC,eAAe,GAAG,EAAE,KAAK,CAAC,MAAM,EAAE,YAAY,aAAa,GAAG;AACjE,aAAK,KAAK,IAAI,aAAa,wCAAwC;AAAA,MACrE;AACA,UAAI,IAAI,aAAa,sCAAsC,MAAM,MAAM;AACrE,aAAK,KAAK,uDAAuD;AAAA,MACnE;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAmBO,SAAS,YACd,UACA,eACgB;AAChB,QAAM,SAAwB,SAAS,SAAS,CAAC,GAAG,IAAI,CAAC,OAAO;AAAA,IAC9D,MAAM,EAAE;AAAA,IACR,GAAI,EAAE,eAAe,SAAY,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,WAAW,EAAE;AAAA,EAC1E,EAAE;AACF,aAAW,QAAQ,CAAC,YAAY,kBAAkB,GAAG;AACnD,QAAI,CAAC,WAAW,OAAO,IAAI,EAAG,OAAM,KAAK,EAAE,KAAK,CAAC;AAAA,EACnD;AACA,MAAI,CAAC,WAAW,OAAO,cAAc,GAAG;AACtC,UAAM,KAAK,EAAE,MAAM,gBAAgB,YAAY,EAAE,GAAG,4BAA4B,EAAE,CAAC;AAAA,EACrF;AACA,MAAI,kBAAkB,MAAM;AAC1B,UAAM,MAAM,WAAW,OAAO,wBAAwB;AACtD,QAAI,CAAC,KAAK;AACR,YAAM,KAAK;AAAA,QACT,MAAM;AAAA,QACN,YAAY;AAAA,UACV,sCAAsC;AAAA,UACtC,0BAA0B;AAAA,UAC1B,wBAAwB,CAAC,EAAE,SAAS,cAAc,CAAC;AAAA,QACrD;AAAA,MACF,CAAC;AAAA,IACH,OAAO;AACL,YAAM,SAAU,IAAI,eAAe,CAAC;AACpC,YAAM,SAAS,eAAe,GAAG;AACjC,UAAI,CAAC,OAAO,KAAK,CAAC,MAAM,EAAE,YAAY,aAAa,GAAG;AACpD,eAAO,wBAAwB,IAAI,CAAC,GAAG,QAAQ,EAAE,SAAS,cAAc,CAAC;AAAA,MAC3E;AACA,aAAO,sCAAsC,IAAI;AAAA,IACnD;AAAA,EACF;AAEA,QAAM,UAAU,SAAS,YAAY,UAAU,WAAW,CAAC;AAC3D,SAAO;AAAA,IACL,MAAM,SAAS;AAAA,IACf,QAAQ;AAAA,IACR,aAAa;AAAA,IACb,eAAe,CAAC;AAAA,IAChB,YAAY;AAAA,MACV,UAAU;AAAA,QACR,SAAS,oBAAoB,OAAO,IAAI,CAAC,GAAG,OAAO,IAAI,CAAC,GAAG,SAAS,iBAAiB;AAAA;AAAA;AAAA;AAAA,QAIrF,SAAS,CAAC;AAAA,MACZ;AAAA,IACF;AAAA,IACA;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-ZYBOT5PM.js → chunk-NT4WIP7I.js}

@@ -1,6 +1,6 @@
 import {
   withRecipe
-} from "./chunk-XKOZUVK2.js";
+} from "./chunk-ZTPPCHDB.js";
 import {
   bumpDep,
   readPackageJson,
@@ -150,4 +150,4 @@ export {
   selfCaretRange,
   onboard
 };
-//# sourceMappingURL=chunk-ZYBOT5PM.js.map
+//# sourceMappingURL=chunk-NT4WIP7I.js.map

package/dist/{chunk-JNXCDUYB.js → chunk-Q276MZ7E.js}

@@ -1,10 +1,10 @@
 import {
   ALL_TEMPLATES,
   templatesByName
-} from "./chunk-CASCWQQX.js";
+} from "./chunk-73UFRZKY.js";
 import {
   withRecipe
-} from "./chunk-XKOZUVK2.js";
+} from "./chunk-ZTPPCHDB.js";
 import {
   listTrackedFiles,
   removeFromIndex
@@ -125,7 +125,6 @@ var ALL_CONFIG_NAMES = [
   "playwright-a11y",
   "svelte",
   "gitignore",
-  "ci",
   "renovate-action",
   "renovate-config",
   "netlify"
@@ -208,4 +207,4 @@ export {
   isConfigName,
   syncConfigs
 };
-//# sourceMappingURL=chunk-JNXCDUYB.js.map
+//# sourceMappingURL=chunk-Q276MZ7E.js.map