@reddoorla/maintenance 0.79.0 → 0.81.0

package/dist/freeze-Y5OJFOST.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/blux/freeze/index.ts","../src/blux/freeze/settle.ts","../src/blux/freeze/map-placeholder.ts","../src/blux/freeze/slider-pin.ts","../src/blux/freeze/resolve-anchors.ts","../src/blux/freeze/bake-images.ts","../src/blux/freeze/types.ts","../src/blux/freeze/section.ts","../src/blux/freeze/tokenize-text.ts","../src/blux/freeze/finalize.ts","../src/blux/freeze/extra-slots.ts"],"sourcesContent":["import { mkdir, writeFile, readFile } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport { settleExport } from \"./settle.js\";\nimport { mapPlaceholder } from \"./map-placeholder.js\";\nimport { pinSliders } from \"./slider-pin.js\";\nimport { resolveAnchors } from \"./resolve-anchors.js\";\nimport { bakeImages } from \"./bake-images.js\";\nimport { tokenizeText } from \"./tokenize-text.js\";\nimport { finalize } from \"./finalize.js\";\nimport { extractMapConfig } from \"../grid/extract-map.js\";\nimport { validateExtraSlots } from \"./extra-slots.js\";\nimport type { FrozenResult } from \"./types.js\";\n\nexport type { Slot, FrozenManifest, FrozenResult, ExtraSlotsFile } from \"./types.js\";\nexport { frozenPageCustomType, FROZEN_PAGE_TYPE } from \"./frozen-page-type.js\";\nexport { validateExtraSlots } from \"./extra-slots.js\";\nexport { EXTRA_SLOT_PREFIX } from \"./types.js\";\n\nexport interface FreezeOptions {\n  /** Path to the export's index.html. */\n  indexHtmlPath: string;\n  /** Site slug — names the emitted template/style/manifest files. */\n  site: string;\n  /** Prismic uid for the page doc (default \"home\"). */\n  uid?: string;\n  /** A site's own extra-slots declaration (parsed `ExtraSlotsFile`), for\n   *  editable content the template carries no token for. See types.ts. */\n  extraSlots?: unknown;\n}\n\n/**\n * Freeze one Blux page into a byte-faithful template + editable slot manifest.\n * Order matters: bake images (their urls become slots) BEFORE tokenizing text,\n * so image tokens live in style attributes and never collide with text tokens.\n */\nexport async function freezeSite(opts: FreezeOptions): Promise<FrozenResult> {\n  const { html: settled, anchorTargets } = await settleExport(opts.indexHtmlPath);\n  // Settled-DOM repairs run before image/text tokenizing: swap the dead\n  // Google-Map DOM for a placeholder (using the raw export for the KML mid),\n  // pin each hero slider to slide 1, and bake nav hashlink targets (settle's\n  // click audit measured them against the export's own runtime).\n  const exportHtml = await readFile(opts.indexHtmlPath, \"utf-8\");\n  const mapped = mapPlaceholder(settled, exportHtml);\n  const pinned = pinSliders(mapped);\n  const anchored = resolveAnchors(pinned, anchorTargets);\n  const baked = bakeImages(anchored);\n  const tokenized = tokenizeText(baked.html);\n  const fin = finalize(tokenized.html);\n\n  // The full map widget config (layers/toggles/styles) lives in the export's\n  // initMap script — carried alongside the template so the render can hydrate\n  // the real map. Only meaningful when its mount survived into the template.\n  const rawMap = extractMapConfig(exportHtml);\n  const mapConfig =\n    rawMap && fin.templateHtml.includes(`id=\"${rawMap.mountId}\"`) ? rawMap : undefined;\n\n  // Derived slots first, then the site's own. Validated against the derived\n  // keys so a declaration can never shadow real page content.\n  const derived = [...baked.slots, ...tokenized.slots];\n  const extra = validateExtraSlots(opts.extraSlots, derived);\n\n  return {\n    manifest: {\n      site: opts.site,\n      uid: opts.uid ?? \"home\",\n      title: fin.title,\n      metaTitle: fin.metaTitle,\n      metaImageUrl: fin.metaImageUrl,\n      fontLinks: fin.fontLinks,\n      slots: [...derived, ...extra],\n    },\n    templateHtml: fin.templateHtml,\n    styleCss: fin.styleCss,\n    mapConfig,\n  };\n}\n\n/**\n * Write the freeze artifacts under `outDir`. Returns their paths.\n *\n * `frozen/` is site-repo-ready: uid-keyed `<uid>.html` / `<uid>.style.css` /\n * `<uid>.fonts.json` (+ `<uid>.map.json` when the export has a map widget),\n * copied verbatim into the site repo's `src/lib/blux-frozen/frozen/` — exactly\n * the names the starter's artifact globs load. The slots manifest stays\n * site-keyed at the out-dir root, where `blux migrate-frozen` finds it.\n */\nexport async function emitFrozen(\n  outDir: string,\n  result: FrozenResult,\n): Promise<{\n  template: string;\n  style: string;\n  fonts: string;\n  manifest: string;\n  map?: string;\n}> {\n  const { site, uid } = result.manifest;\n  const frozenDir = join(outDir, \"frozen\");\n  await mkdir(frozenDir, { recursive: true });\n  const template = join(frozenDir, `${uid}.html`);\n  const style = join(frozenDir, `${uid}.style.css`);\n  const fonts = join(frozenDir, `${uid}.fonts.json`);\n  const manifest = join(outDir, `${site}.slots.json`);\n  await writeFile(template, result.templateHtml, \"utf-8\");\n  await writeFile(style, result.styleCss, \"utf-8\");\n  await writeFile(fonts, JSON.stringify(result.manifest.fontLinks, null, 2), \"utf-8\");\n  await writeFile(manifest, JSON.stringify(result.manifest, null, 2), \"utf-8\");\n  if (!result.mapConfig) return { template, style, fonts, manifest };\n  const map = join(frozenDir, `${uid}.map.json`);\n  await writeFile(map, JSON.stringify(result.mapConfig, null, 2), \"utf-8\");\n  return { template, style, fonts, manifest, map };\n}\n","/// <reference lib=\"dom\" />\n// The evaluate() callbacks below run in the browser page context, so they use\n// DOM globals (document/window). The CLI's base tsconfig is Node-only (lib\n// ES2022); this directive adds DOM types for this file's type-checking.\nimport { createServer, type Server } from \"node:http\";\nimport { readFile } from \"node:fs/promises\";\nimport { dirname, extname, join, normalize, sep } from \"node:path\";\nimport { chromium, type Page } from \"@playwright/test\";\n\n// The Blux export's index.html renders its final layout only after its runtime\n// JS applies height/position adjustments. Freezing the RAW html renders the\n// wrong height (the-pointe: 16873px); freezing the JS-SETTLED DOM renders the\n// live height (15333px). So the freeze hydrates the page once in headless\n// chromium, scrolls top→bottom to trigger the layout pass, and snapshots the\n// settled DOM. (Proven in the design POC scratchpad/freeze-final.mjs.)\n\nexport interface SettleOptions {\n  /** Layout viewport — Blux desktop layout is authored at 1440. */\n  width?: number;\n  height?: number;\n  /** Scroll step in px (smaller = more reliable lazy triggers, slower). */\n  step?: number;\n}\n\nexport interface SettledExport {\n  /** The serialized settled DOM (full document HTML). */\n  html: string;\n  /**\n   * Nav-anchor answer key, measured from the export's OWN runtime: hash index\n   * → the id its JS actually scrolls to. Blux core maps `/#N` to\n   * `page-block-N`, but site-specific custom scripts override that (the-pointe\n   * embeds one sending any \"Contact Us\" link to `footer0`) — behavior no\n   * static rule can recover, so it is recorded by clicking each hashlink with\n   * `scrollPageToTarget` instrumented. Empty when the runtime is absent.\n   */\n  anchorTargets: Record<string, string>;\n}\n\n// Blux runtime globals reached from inside evaluate() callbacks. Types are\n// erased before serialization, so declaring this at module level is safe.\ntype BluxWindow = Window & {\n  DANDOM?: { prototype: { scrollPageToTarget?: (t: string) => unknown } };\n  __rdAnchorCalls?: string[];\n  alreadyScrolling?: boolean;\n};\n\nconst MIME: Record<string, string> = {\n  \".html\": \"text/html; charset=utf-8\",\n  \".css\": \"text/css\",\n  \".js\": \"text/javascript\",\n  \".json\": \"application/json\",\n  \".png\": \"image/png\",\n  \".jpg\": \"image/jpeg\",\n  \".jpeg\": \"image/jpeg\",\n  \".gif\": \"image/gif\",\n  \".svg\": \"image/svg+xml\",\n  \".webp\": \"image/webp\",\n  \".ico\": \"image/x-icon\",\n  \".woff\": \"font/woff\",\n  \".woff2\": \"font/woff2\",\n};\n\n/**\n * One-shot local static server over the export dir, for the anchor audit ONLY.\n * The audit must run on an http origin: there `/#N` is a same-document hash\n * change (exactly the live site's semantics), while on `file://` it resolves\n * to the filesystem ROOT — a cross-document navigation that Blux's handler\n * chain triggers even past preventDefault + timer stubs, tearing the page down\n * mid-audit. Serving beats intercepting.\n */\nasync function serveExport(dir: string): Promise<{ url: string; server: Server }> {\n  const root = normalize(dir);\n  const server = createServer((req, res) => {\n    void (async () => {\n      try {\n        const path = decodeURIComponent((req.url ?? \"/\").split(/[?#]/)[0]!);\n        const rel = path === \"/\" ? \"index.html\" : path.slice(1);\n        // Separator-anchored: a bare prefix test would also pass sibling\n        // dirs that merely share the prefix (/exports/site-secret vs\n        // /exports/site).\n        const file = normalize(join(root, rel));\n        if (!file.startsWith(root + sep)) throw new Error(\"traversal\");\n        const body = await readFile(file);\n        res.writeHead(200, {\n          \"content-type\": MIME[extname(file)] ?? \"application/octet-stream\",\n        });\n        res.end(body);\n      } catch {\n        res.writeHead(404);\n        res.end();\n      }\n    })();\n  });\n  await new Promise<void>((resolve) => server.listen(0, \"127.0.0.1\", resolve));\n  const address = server.address();\n  if (address === null || typeof address === \"string\")\n    throw new Error(\"export server failed to bind\");\n  return { url: `http://127.0.0.1:${address.port}/`, server };\n}\n\n/**\n * Click every distinct `/#N` hashlink on the SERVED page and record the first\n * target the site's runtime passes to `scrollPageToTarget` — first, because on\n * the live site later calls in a click's handler chain are gated by\n * `alreadyScrolling`, so the first call is the one users see. The scroll\n * itself is suppressed (the wrapper records and returns), so clicks leave no\n * scroll state behind; the settle snapshot is taken from a separate file://\n * page that the audit never touches.\n */\nasync function auditAnchors(page: Page): Promise<Record<string, string>> {\n  const ns = await page.evaluate(() => {\n    const found = new Set<string>();\n    for (const a of document.querySelectorAll('a[href^=\"/#\"]')) {\n      const m = /^\\/#(\\d+)$/.exec(a.getAttribute(\"href\") ?? \"\");\n      if (m?.[1]) found.add(m[1]);\n    }\n    return [...found];\n  });\n  if (ns.length === 0) return {};\n\n  const instrumented = await page.evaluate(() => {\n    const w = window as unknown as BluxWindow;\n    const proto = w.DANDOM?.prototype;\n    if (!proto?.scrollPageToTarget) return false;\n    w.__rdAnchorCalls = [];\n    proto.scrollPageToTarget = function (t: string) {\n      w.__rdAnchorCalls?.push(t);\n      return this; // record only — never actually scroll\n    };\n    return true;\n  });\n  if (!instrumented) return {};\n\n  const targets: Record<string, string> = {};\n  for (const n of ns) {\n    // Audit EVERY link sharing this index, not just the first: custom scripts\n    // intercept by link semantics (the-pointe keys on \"Contact Us\" text), so\n    // two /#N links can legitimately scroll to different targets. The bake is\n    // per-index, so disagreement can't be represented — surface it loudly and\n    // bake the first link's (document-order) behavior.\n    const count = await page.evaluate(\n      (nn) => document.querySelectorAll(`a[href=\"/#${nn}\"]`).length,\n      n,\n    );\n    const seen: string[] = [];\n    for (let i = 0; i < count; i++) {\n      await page.evaluate(\n        ({ nn, idx }) => {\n          const w = window as unknown as BluxWindow;\n          w.__rdAnchorCalls = [];\n          w.alreadyScrolling = false;\n          history.replaceState(null, \"\", \"/\");\n          document.querySelectorAll<HTMLElement>(`a[href=\"/#${nn}\"]`)[idx]?.click();\n        },\n        { nn: n, idx: i },\n      );\n      // checkScrollHash defers its core scroll 100ms past the hashchange (and\n      // re-navigates at +50ms); 400ms covers the whole handler chain.\n      await page.waitForTimeout(400);\n      const first = await page.evaluate(\n        () => (window as unknown as BluxWindow).__rdAnchorCalls?.[0] ?? null,\n      );\n      if (first) seen.push(first);\n    }\n    const distinct = [...new Set(seen)];\n    if (distinct.length > 1) {\n      console.warn(\n        `[freeze] anchor /#${n}: links disagree on target (${distinct.join(\", \")}) — ` +\n          `baking \"${seen[0]}\" for all; verify that page's nav fidelity by hand`,\n      );\n    }\n    if (seen[0]) targets[n] = seen[0];\n  }\n  return targets;\n}\n\n/**\n * Render a local `index.html` in headless chromium, let its JS settle the\n * layout, and return the serialized settled DOM plus the measured nav-anchor\n * answer key.\n */\nexport async function settleExport(\n  indexHtmlPath: string,\n  opts: SettleOptions = {},\n): Promise<SettledExport> {\n  const width = opts.width ?? 1440;\n  const height = opts.height ?? 1000;\n  const step = opts.step ?? 500;\n\n  const browser = await chromium.launch();\n  try {\n    const page = await browser.newPage({ viewport: { width, height } });\n    await page.goto(`file://${indexHtmlPath}`, {\n      waitUntil: \"networkidle\",\n      timeout: 60000,\n    });\n    // Trigger the JS layout pass across the whole page.\n    const total = await page.evaluate(() => document.body.scrollHeight);\n    for (let y = 0; y < total + 1000; y += step) {\n      await page.evaluate((yy) => window.scrollTo(0, yy), y);\n      await page.waitForTimeout(120);\n    }\n    await page.evaluate(() => window.scrollTo(0, 0));\n    await page.waitForTimeout(1200);\n    const html = await page.content();\n\n    // Anchor audit on a separate, HTTP-served copy (see serveExport). Media\n    // is aborted for speed — the audit needs handlers, not layout.\n    const { url, server } = await serveExport(dirname(indexHtmlPath));\n    try {\n      const auditPage = await browser.newPage({\n        viewport: { width, height },\n      });\n      await auditPage.route(\n        \"**/*\",\n        (route) =>\n          void ([\"image\", \"media\", \"font\"].includes(route.request().resourceType())\n            ? route.abort()\n            : route.continue()),\n      );\n      await auditPage.goto(url, { waitUntil: \"load\", timeout: 60000 });\n      await auditPage.waitForTimeout(800);\n      const anchorTargets = await auditAnchors(auditPage);\n      await auditPage.close();\n      return { html, anchorTargets };\n    } finally {\n      await new Promise<void>((resolve) => server.close(() => resolve()));\n    }\n  } finally {\n    await browser.close();\n  }\n}\n","import { parse } from \"node-html-parser\";\n\n// The frozen export's Google-Map band is a CUSTOM Google My Maps: a KmlLayer\n// keyed by a My Maps id (`…/kml?…&mid=<ID>`) rendered at runtime. With the Blux\n// JS stripped, the settled `gm-style` DOM Google left behind is dead (broken\n// tiles + CSP console noise). Replace it with a clean, height-preserving\n// placeholder that carries the `mid` so a future (production) hydrator can bring\n// the real map back once a domain-scoped Maps key exists.\n\n// The My Maps id, pulled from the export's KML url (deterministic, not from the\n// settled DOM which no longer holds it).\nconst MID_RE = /[?&]mid=([\\w-]+)/;\n\n/**\n * Convert each rendered Google-Map container into a `.blux-frozen-map`\n * placeholder. A container is an element whose `id` names a map (`/map/i`) AND\n * that actually rendered (has a `.gm-style` descendant); its dead children are\n * removed and the KML `mid` (if found in `exportHtml`) is attached. Its existing\n * id + inline height are kept so the band's box is unchanged. `exportHtml` is the\n * raw Blux export string.\n */\nexport function mapPlaceholder(html: string, exportHtml: string): string {\n  const root = parse(html);\n  const mid = exportHtml.match(MID_RE)?.[1];\n\n  for (const el of root.querySelectorAll(\"[id]\")) {\n    const id = el.getAttribute(\"id\") ?? \"\";\n    if (!/map/i.test(id)) continue;\n    if (!el.querySelector(\".gm-style\")) continue; // only actually-rendered maps\n    el.set_content(\"\"); // drop the dead gm-style DOM\n    el.classList.add(\"blux-frozen-map\");\n    if (mid) el.setAttribute(\"data-kml-mid\", mid);\n  }\n\n  return root.toString();\n}\n","import { parse, HTMLElement } from \"node-html-parser\";\n\n// Blux single-column hero sliders (`.caslider` with `data-columns` 1 or absent)\n// animate through their slides at runtime. The settle snapshot freezes whichever\n// slide happened to be active, which is not reproducible across re-freezes. Pin\n// such a slider to its first slide: force slide 1 visible + in position, hide the\n// rest with `display:none`. Appended declarations win (inline-style last-wins),\n// so the first slide's own styles are preserved and height is unchanged (slide 1\n// keeps the band's natural height).\n//\n// A MULTI-column slider (`data-columns` >= 2) shows several slides at once — the\n// settled snapshot already renders those columns faithfully — so pinning would\n// hide the simultaneously-visible columns and regress the band. Leave those\n// untouched; the pin is only for the single-column hero case.\n\n/**\n * Pin each single-column `.caslider` to its first slide, deterministically.\n * Multi-column sliders (`data-columns` >= 2) are left as settled.\n */\nexport function pinSliders(html: string): string {\n  const root = parse(html);\n\n  for (const slider of root.querySelectorAll(\".caslider\")) {\n    const columns = parseInt(slider.getAttribute(\"data-columns\") ?? \"1\", 10) || 1;\n    if (columns > 1) continue; // multi-column carousel: keep the settled columns\n    const slides = slider.childNodes.filter((n): n is HTMLElement => n instanceof HTMLElement);\n    slides.forEach((slide, i) => {\n      const style = slide.getAttribute(\"style\") ?? \"\";\n      const pin = i === 0 ? \"display:block;transform:translateX(0%);opacity:1\" : \"display:none\";\n      slide.setAttribute(\"style\", style ? `${style};${pin}` : pin);\n    });\n  }\n\n  return root.toString();\n}\n","// Blux nav anchors are JS-driven: core runtime maps `href=\"/#N\"` to the band\n// id `page-block-N` — but site-specific custom scripts embedded in the export\n// can send a link anywhere (the-pointe's sends \"Contact Us\" to `footer0`), so\n// the authoritative mapping is the answer key MEASURED from the export's own\n// runtime by settle's click audit. With the runtime stripped those hrefs are\n// dead; bake the resolved target into the frozen markup. Unmeasured indexes\n// fall back to Blux core's `page-block-N` (when that band is missing, Blux\n// core no-ops — exactly what a dead in-page anchor does, so the fallback is\n// faithful either way). Digit-only fragments only — real named anchors\n// (`/#about`) are untouched. The starter's render-time enhance layer keeps its\n// own `/#N` rewrite as a repair path for pre-bake artifacts; baked hrefs no\n// longer match it.\n\nconst HASHLINK_RE = /href=\"\\/#(\\d+)\"/g;\n\nexport function resolveAnchors(html: string, targets: Record<string, string> = {}): string {\n  return html.replace(\n    HASHLINK_RE,\n    (_full, n: string) => `href=\"#${targets[n] ?? `page-block-${n}`}\"`,\n  );\n}\n","import { parse, HTMLElement } from \"node-html-parser\";\nimport { slotKey, tokenFor, type Slot } from \"./types.js\";\nimport { sectionIndexOf, sectionKeyOf } from \"./section.js\";\nimport { CDN_HOSTS } from \"../assets.js\";\n\nconst isCdnUrl = (v: string): boolean => CDN_HOSTS.some((h) => v.includes(h));\n\n// Blux media elements carry the image as data-attributes, not a live src: the\n// runtime reads `data-base` (CDN folder) + `data-size` (width) + `data-media`\n// (filename) and paints a background on a lazy `.load-media-element` span\n// (loading/unloading per viewport). We assemble the url deterministically —\n// `{data-base}w:{data-size}/{data-media}` (verified 200) — and bake it as an\n// inline background-image token so no runtime is needed. `data-bgmedia` is a\n// full-bleed layer whose filename wins over `data-media`. A second pass catches\n// any other CDN url still living in src/href/poster (e.g. a <video>), so the\n// frozen template leaks no CDN host at all.\n\n// Runtime-only url hints the (removed) Blux JS used; not rendered — drop them so\n// they don't leak a CDN host.\nfunction stripUrlHintAttrs(root: HTMLElement): void {\n  for (const el of root.querySelectorAll(\"*\")) {\n    for (const name of Object.keys(el.attributes)) {\n      if (name === \"data-og-src\" || name.startsWith(\"data-swaps\")) {\n        el.removeAttribute(name);\n      }\n    }\n  }\n}\n\n/**\n * Tokenize every media url in the document as a `⟦i:KEY⟧` image slot. Pass 1:\n * data-attribute backgrounds → inline `background-image:url(token)`. Pass 2: any\n * remaining CDN url in `src`/`href`/`poster` → bare `token`. Keys are\n * `s{section}.i{n}` in document order.\n */\nexport function bakeImages(html: string): { html: string; slots: Slot[] } {\n  const root = parse(html);\n  const sectionIndex = sectionIndexOf(root);\n  const counters = new Map<string, number>();\n  const slots: Slot[] = [];\n\n  const nextKey = (el: HTMLElement): string => {\n    const section = sectionKeyOf(el, sectionIndex);\n    const n = counters.get(section) ?? 0;\n    counters.set(section, n + 1);\n    return slotKey(section, \"image\", n);\n  };\n\n  // Pass 1: data-* backgrounds. The filename is ALWAYS `data-media`;\n  // `data-bgmedia` is a boolean flag (\"1\") marking a full-bleed layer — it is\n  // NOT a filename. When an element is unsized we default full-bleed layers to a\n  // wide variant and inline images to the raw file.\n  for (const el of root.querySelectorAll(\"[data-media]\")) {\n    const base = el.getAttribute(\"data-base\");\n    if (!base) continue;\n    const media = el.getAttribute(\"data-media\");\n    if (!media) continue;\n    const isBg = el.getAttribute(\"data-bgmedia\") != null;\n    const size = el.getAttribute(\"data-size\");\n    const sizeSeg = size ? `w:${size}/` : isBg ? \"w:1600/\" : \"\";\n    const url = `${base}${sizeSeg}${media}`;\n\n    const key = nextKey(el);\n    slots.push({ key, kind: \"image\", url, section: sectionKeyOf(el, sectionIndex) });\n    const decl = `background-image:url(${tokenFor(\"image\", key)})`;\n    const style = el.getAttribute(\"style\");\n    el.setAttribute(\"style\", style ? `${style};${decl}` : decl);\n    el.removeAttribute(\"data-base\");\n  }\n\n  // Pass 2: any remaining CDN url in src/href/poster (video, source, links…).\n  for (const el of root.querySelectorAll(\"[src],[href],[poster]\")) {\n    for (const attr of [\"src\", \"href\", \"poster\"] as const) {\n      const v = el.getAttribute(attr);\n      if (!v || !isCdnUrl(v)) continue;\n      const key = nextKey(el);\n      slots.push({ key, kind: \"image\", url: v, section: sectionKeyOf(el, sectionIndex) });\n      el.setAttribute(attr, tokenFor(\"image\", key));\n    }\n  }\n\n  stripUrlHintAttrs(root);\n  return { html: root.toString(), slots };\n}\n","// Frozen-page freeze: shared types + token contract. A frozen site keeps the\n// Blux export's own markup as the layout (byte-faithful) and exposes only the\n// editable leaves — text runs and image urls — as Prismic slots. The template\n// carries a placeholder token per slot; the render substitutes current Prismic\n// values back in. See docs/superpowers/specs/2026-07-24-blux-frozen-page-design.md.\n\nimport type { MapConfig } from \"../grid/extract-map.js\";\n\nexport type SlotKind = \"text\" | \"image\";\n\nexport interface Slot {\n  /** Stable, document-order key `s{section}.{t|i}{n}` (see `slotKey`). */\n  key: string;\n  kind: SlotKind;\n  /** Present when kind === \"text\": the original text-node value. */\n  text?: string;\n  /** Present when kind === \"image\": the assembled (cloudfront) image url. */\n  url?: string;\n  /** Grouping label for editor sanity — the owning section key. */\n  section: string;\n}\n\n/**\n * Slots a SITE declares, on top of the ones the freeze derives from the export.\n *\n * Every derived slot exists because the template carries a token for it. Some\n * editable content has no token and never can: the render composes it itself,\n * from markup the export never had. Two real cases on the-pointe — a `<video>`\n * poster (the export ships none, so there is no attribute to tokenize) and a\n * data panel the export baked as a flattened PNG (rebuilt as real text, so the\n * text exists only in the render).\n *\n * Without this, that content can only live in committed files and a deploy is\n * required to change a leasing number. Declaring it here puts it in Prismic\n * alongside everything else, and — because `blux migrate-frozen` PUTs the whole\n * document — keeps it there across re-migrations, which a row added by hand in\n * the Prismic UI would not survive.\n *\n * Kept generic on purpose: the tool serves several frozen sites, so it knows\n * only that extra slots exist, never what any one site puts in them.\n */\nexport interface ExtraSlotsFile {\n  /** Free-form note for whoever opens the file; ignored by the freeze. */\n  comment?: string;\n  slots: Slot[];\n}\n\n/** Prefix reserved for site-declared slots, so a synthetic key can never\n *  collide with a derived `s{n}.t{n}` / `h.i{n}` one. */\nexport const EXTRA_SLOT_PREFIX = \"x.\";\n\nexport interface FrozenManifest {\n  site: string;\n  uid: string;\n  title: string;\n  metaTitle?: string | undefined;\n  metaImageUrl?: string | undefined;\n  /** External stylesheet hrefs from the export <head> (e.g. Google Fonts) that\n   *  the render must re-inject — font metrics are load-bearing for layout. */\n  fontLinks: string[];\n  slots: Slot[];\n}\n\n/** The emitted freeze artifact: the manifest plus the repo files' bodies. */\nexport interface FrozenResult {\n  manifest: FrozenManifest;\n  /** Tokenized `<body>` innerHTML — the repo template. */\n  templateHtml: string;\n  /** The extracted `<style>` block text — the repo style file. */\n  styleCss: string;\n  /** Present when the export carries a Blux map widget whose mount survives\n   *  in the template — emitted as `frozen/<uid>.map.json`, hydrated by the\n   *  starter's frozen-map layer. */\n  mapConfig?: MapConfig | undefined;\n}\n\n/** The placeholder a slot's value is substituted for at render time.\n *  Text: replaces the whole text node. Image: sits inside `url(...)`. */\nexport function tokenFor(kind: SlotKind, key: string): string {\n  return `⟦${kind === \"text\" ? \"t\" : \"i\"}:${key}⟧`;\n}\n\n/** Build a slot key. `section` is the nearest-ancestor <section> index (or\n *  \"h\" for chrome above the first section); `n` is a per-kind counter. */\nexport function slotKey(section: string, kind: SlotKind, n: number): string {\n  return `${section}.${kind === \"text\" ? \"t\" : \"i\"}${n}`;\n}\n\n/** Matches any slot token; group 1 = \"t\"|\"i\", group 2 = key. Global — callers\n *  that reuse it across `.test()`/`.replace()` should construct a fresh copy or\n *  reset `lastIndex`. Use `TOKEN_RE()` to get a fresh instance. */\nexport const TOKEN_RE = (): RegExp => /⟦([ti]):([^⟧]+)⟧/g;\n","import { HTMLElement } from \"node-html-parser\";\n\n/** Map each <section> element to its document-order index. */\nexport function sectionIndexOf(root: HTMLElement): Map<HTMLElement, number> {\n  const index = new Map<HTMLElement, number>();\n  root.querySelectorAll(\"section\").forEach((s, i) => index.set(s, i));\n  return index;\n}\n\n/** Nearest-ancestor <section> key (`s{index}`), or `h` for chrome (nav/footer)\n *  that lives above/outside any <section>. */\nexport function sectionKeyOf(el: HTMLElement, sectionIndex: Map<HTMLElement, number>): string {\n  let a: HTMLElement | null | undefined = el;\n  while (a) {\n    if (a.tagName === \"SECTION\" && sectionIndex.has(a)) {\n      return `s${sectionIndex.get(a)}`;\n    }\n    a = a.parentNode as HTMLElement | null | undefined;\n  }\n  return \"h\";\n}\n","import { parse, HTMLElement, NodeType } from \"node-html-parser\";\nimport { slotKey, tokenFor, type Slot } from \"./types.js\";\nimport { sectionIndexOf, sectionKeyOf } from \"./section.js\";\n\n// Elements whose text is not editable page copy.\nconst SKIP = new Set([\"SCRIPT\", \"STYLE\", \"NOSCRIPT\", \"HEAD\", \"TITLE\", \"SVG\"]);\n\n/**\n * Replace every text node that carries CONTENT with a `⟦t:KEY⟧` token and\n * collect the originals as text slots. Keys are `s{section}.t{n}` in document\n * order so the template + manifest stay stable across re-freezes (golden\n * canary). The raw source text is preserved verbatim (entities and surrounding\n * whitespace) so a frozen render is byte-faithful before any Prismic edit.\n *\n * \"Carries content\" is decided on the DECODED text, not the raw source. Page\n * builders emit whitespace-only leaves as layout — a list item or table cell\n * holding `&nbsp;` purely to occupy a line — and those must stay literal in the\n * template rather than becoming CMS fields, for two reasons:\n *\n * 1. They are not editable copy. Nobody wants a Prismic field whose only\n *    correct value is \"one blank line\".\n * 2. Prismic Rich Text CANNOT store a whitespace-only value. It round-trips to\n *    \"\", the row collapses to its padding, and the page silently loses a line\n *    of vertical rhythm — a defect that only shows up after the migration, on\n *    the live site, in a place nobody thought to re-measure.\n *\n * `rawText.trim()` cannot see this: for a `&nbsp;` leaf it trims to the literal\n * string \"&nbsp;\", which is not empty, so the leaf looked like content. Testing\n * the decoded `.text` catches every spelling — `&nbsp;`, `&#160;`, `&#xa0;`,\n * `&emsp;`, `&thinsp;` — because JS `String.trim()` strips the whole Unicode\n * whitespace class. A real character such as `&amp;` still decodes to content\n * and is tokenized as before.\n */\nexport function tokenizeText(html: string): { html: string; slots: Slot[] } {\n  const root = parse(html);\n  const sectionIndex = sectionIndexOf(root);\n\n  const counters = new Map<string, number>();\n  const slots: Slot[] = [];\n\n  const walk = (el: HTMLElement): void => {\n    for (const child of el.childNodes) {\n      if (child.nodeType === NodeType.TEXT_NODE) {\n        const raw = child.rawText;\n        // Decoded, so entity-encoded whitespace is treated as the whitespace it\n        // is. A skipped leaf does not advance the section counter — same as a\n        // plain-whitespace leaf, which this check has always skipped.\n        if (raw && child.text.trim() !== \"\") {\n          const section = sectionKeyOf(el, sectionIndex);\n          const n = counters.get(section) ?? 0;\n          counters.set(section, n + 1);\n          const key = slotKey(section, \"text\", n);\n          slots.push({ key, kind: \"text\", text: raw, section });\n          child.rawText = tokenFor(\"text\", key);\n        }\n      } else if (child.nodeType === NodeType.ELEMENT_NODE) {\n        const elChild = child as HTMLElement;\n        if (!SKIP.has(elChild.tagName)) walk(elChild);\n      }\n    }\n  };\n  walk(root);\n\n  return { html: root.toString(), slots };\n}\n","import { parse } from \"node-html-parser\";\n\n// Reveal effects hide content until the Blux runtime adds `block-effects-applied`\n// on scroll. With the runtime stripped, force the end-state so everything is\n// visible without JS. (`.block-effects{opacity:0}` is the initial rule.)\nexport const REVEAL_FORCE_CSS =\n  \".block-effects{opacity:1!important;transform:none!important;animation:none!important;visibility:visible!important}\";\n\nexport interface Finalized {\n  /** `<body>` inner HTML wrapped so the body's own class/style survive. */\n  templateHtml: string;\n  /** All page `<style>` blocks + the reveal-force override. */\n  styleCss: string;\n  title: string;\n  metaTitle?: string | undefined;\n  metaImageUrl?: string | undefined;\n  /** External stylesheet hrefs (Google Fonts) to re-inject at render. */\n  fontLinks: string[];\n}\n\n/**\n * Turn a tokenized settled document into the two repo artifacts: strip all\n * `<script>`, extract every `<style>` block (+ reveal-force) into a stylesheet,\n * and wrap the body's inner HTML in a `.frozen-root` div that carries the\n * body's own class/style (which `body.innerHTML` would otherwise drop).\n */\nexport function finalize(html: string): Finalized {\n  const root = parse(html);\n  const title = root.querySelector(\"title\")?.text?.trim() ?? \"\";\n  const metaOf = (prop: string): string | undefined =>\n    root.querySelector(`meta[property=\"${prop}\"]`)?.getAttribute(\"content\") ?? undefined;\n  const metaTitle = metaOf(\"og:title\") ?? (title || undefined);\n  const metaImageUrl = metaOf(\"og:image\");\n\n  const fontLinks = root\n    .querySelectorAll('link[rel=\"stylesheet\"]')\n    .map((l) => l.getAttribute(\"href\"))\n    .filter((h): h is string => !!h);\n\n  const styles: string[] = [];\n  for (const s of root.querySelectorAll(\"style\")) {\n    styles.push(s.innerHTML);\n    s.remove();\n  }\n  for (const sc of root.querySelectorAll(\"script\")) sc.remove();\n  // Remove the Blux runtime's lazy media spans: they carry raw cloudfront urls\n  // for whichever images were on-screen at snapshot (the rest unloaded), and the\n  // deterministic baked token on the parent media div is what renders instead.\n  for (const holder of root.querySelectorAll(\".load-media-holder, .load-media-element\")) {\n    holder.remove();\n  }\n\n  const body = root.querySelector(\"body\");\n  const inner = body ? body.innerHTML : root.toString();\n  const bodyClass = body?.getAttribute(\"class\") ?? \"\";\n  const bodyStyle = body?.getAttribute(\"style\") ?? \"\";\n  const cls = `frozen-root ${bodyClass}`.trim();\n  const styleAttr = bodyStyle ? ` style=\"${bodyStyle}\"` : \"\";\n  const templateHtml = `<div class=\"${cls}\"${styleAttr}>${inner}</div>`;\n\n  const styleCss = [...styles, REVEAL_FORCE_CSS].join(\"\\n\");\n  return { templateHtml, styleCss, title, metaTitle, metaImageUrl, fontLinks };\n}\n","// Site-declared slots, merged into the freeze manifest alongside the derived\n// ones. See `ExtraSlotsFile` in types.ts for why they exist.\n//\n// This module is deliberately incurious about what a site declares: it checks\n// the shape, the reserved prefix and key uniqueness, and nothing else. The\n// freeze tool serves several frozen sites and must not learn any one site's\n// content model.\n\nimport { EXTRA_SLOT_PREFIX, type Slot } from \"./types.js\";\n\n/** Thrown with the offending path so a bad declaration names itself. */\nfunction fail(path: string, why: string): never {\n  throw new Error(`extra slots: ${path} ${why}`);\n}\n\nfunction asString(v: unknown, path: string): string {\n  if (typeof v !== \"string\" || v.trim() === \"\") {\n    fail(path, `must be a non-empty string (got ${JSON.stringify(v)})`);\n  }\n  return v as string;\n}\n\n/**\n * Validate a site's extra-slots declaration against the slots the freeze\n * derived, returning the extras to append.\n *\n * A declaration that is wrong must stop the freeze rather than ship: these\n * slots become live CMS fields, and a key that collides with a derived one\n * would let a site-declared value silently overwrite real page content when\n * the render builds its value map.\n */\nexport function validateExtraSlots(file: unknown, derived: Slot[]): Slot[] {\n  if (file === undefined || file === null) return [];\n  if (typeof file !== \"object\" || Array.isArray(file)) {\n    fail(\"root\", \"must be an object with a `slots` array\");\n  }\n  // Read as `unknown`, not as `ExtraSlotsFile` — the whole point here is that\n  // the input has not been checked yet, and typing it as the target would make\n  // every access below assert what this function is supposed to prove.\n  const slots: unknown = (file as { slots?: unknown }).slots;\n  if (!Array.isArray(slots)) fail(\"slots\", \"must be an array\");\n\n  const derivedKeys = new Set(derived.map((s) => s.key));\n  const seen = new Set<string>();\n  const out: Slot[] = [];\n\n  slots.forEach((raw, i) => {\n    const at = `slots[${i}]`;\n    if (typeof raw !== \"object\" || raw === null) fail(at, \"must be an object\");\n    const s = raw as Record<string, unknown>;\n\n    const key = asString(s.key, `${at}.key`);\n    if (!key.startsWith(EXTRA_SLOT_PREFIX)) {\n      fail(\n        `${at}.key`,\n        `must start with \"${EXTRA_SLOT_PREFIX}\" so it cannot collide with a derived slot (got \"${key}\")`,\n      );\n    }\n    if (derivedKeys.has(key)) fail(`${at}.key`, `collides with a derived slot (\"${key}\")`);\n    if (seen.has(key)) fail(`${at}.key`, `is declared twice (\"${key}\")`);\n    seen.add(key);\n\n    const kind = s.kind;\n    if (kind !== \"text\" && kind !== \"image\") {\n      fail(`${at}.kind`, `must be \"text\" or \"image\" (got ${JSON.stringify(kind)})`);\n    }\n\n    const section = typeof s.section === \"string\" && s.section.trim() ? s.section : \"x\";\n    if (kind === \"text\") {\n      out.push({ key, kind, text: asString(s.text, `${at}.text`), section });\n    } else {\n      out.push({ key, kind, url: asString(s.url, `${at}.url`), section });\n    }\n  });\n\n  return out;\n}\n"],"mappings":";;;;;;;;;;AAAA,SAAS,OAAO,WAAW,YAAAA,iBAAgB;AAC3C,SAAS,QAAAC,aAAY;;;ACGrB,SAAS,oBAAiC;AAC1C,SAAS,gBAAgB;AACzB,SAAS,SAAS,SAAS,MAAM,WAAW,WAAW;AACvD,SAAS,gBAA2B;AAuCpC,IAAM,OAA+B;AAAA,EACnC,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,OAAO;AAAA,EACP,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,UAAU;AACZ;AAUA,eAAe,YAAY,KAAuD;AAChF,QAAM,OAAO,UAAU,GAAG;AAC1B,QAAM,SAAS,aAAa,CAAC,KAAK,QAAQ;AACxC,UAAM,YAAY;AAChB,UAAI;AACF,cAAM,OAAO,oBAAoB,IAAI,OAAO,KAAK,MAAM,MAAM,EAAE,CAAC,CAAE;AAClE,cAAM,MAAM,SAAS,MAAM,eAAe,KAAK,MAAM,CAAC;AAItD,cAAM,OAAO,UAAU,KAAK,MAAM,GAAG,CAAC;AACtC,YAAI,CAAC,KAAK,WAAW,OAAO,GAAG,EAAG,OAAM,IAAI,MAAM,WAAW;AAC7D,cAAM,OAAO,MAAM,SAAS,IAAI;AAChC,YAAI,UAAU,KAAK;AAAA,UACjB,gBAAgB,KAAK,QAAQ,IAAI,CAAC,KAAK;AAAA,QACzC,CAAC;AACD,YAAI,IAAI,IAAI;AAAA,MACd,QAAQ;AACN,YAAI,UAAU,GAAG;AACjB,YAAI,IAAI;AAAA,MACV;AAAA,IACF,GAAG;AAAA,EACL,CAAC;AACD,QAAM,IAAI,QAAc,CAAC,YAAY,OAAO,OAAO,GAAG,aAAa,OAAO,CAAC;AAC3E,QAAM,UAAU,OAAO,QAAQ;AAC/B,MAAI,YAAY,QAAQ,OAAO,YAAY;AACzC,UAAM,IAAI,MAAM,8BAA8B;AAChD,SAAO,EAAE,KAAK,oBAAoB,QAAQ,IAAI,KAAK,OAAO;AAC5D;AAWA,eAAe,aAAa,MAA6C;AACvE,QAAM,KAAK,MAAM,KAAK,SAAS,MAAM;AACnC,UAAM,QAAQ,oBAAI,IAAY;AAC9B,eAAW,KAAK,SAAS,iBAAiB,eAAe,GAAG;AAC1D,YAAM,IAAI,aAAa,KAAK,EAAE,aAAa,MAAM,KAAK,EAAE;AACxD,UAAI,IAAI,CAAC,EAAG,OAAM,IAAI,EAAE,CAAC,CAAC;AAAA,IAC5B;AACA,WAAO,CAAC,GAAG,KAAK;AAAA,EAClB,CAAC;AACD,MAAI,GAAG,WAAW,EAAG,QAAO,CAAC;AAE7B,QAAM,eAAe,MAAM,KAAK,SAAS,MAAM;AAC7C,UAAM,IAAI;AACV,UAAM,QAAQ,EAAE,QAAQ;AACxB,QAAI,CAAC,OAAO,mBAAoB,QAAO;AACvC,MAAE,kBAAkB,CAAC;AACrB,UAAM,qBAAqB,SAAU,GAAW;AAC9C,QAAE,iBAAiB,KAAK,CAAC;AACzB,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT,CAAC;AACD,MAAI,CAAC,aAAc,QAAO,CAAC;AAE3B,QAAM,UAAkC,CAAC;AACzC,aAAW,KAAK,IAAI;AAMlB,UAAM,QAAQ,MAAM,KAAK;AAAA,MACvB,CAAC,OAAO,SAAS,iBAAiB,aAAa,EAAE,IAAI,EAAE;AAAA,MACvD;AAAA,IACF;AACA,UAAM,OAAiB,CAAC;AACxB,aAAS,IAAI,GAAG,IAAI,OAAO,KAAK;AAC9B,YAAM,KAAK;AAAA,QACT,CAAC,EAAE,IAAI,IAAI,MAAM;AACf,gBAAM,IAAI;AACV,YAAE,kBAAkB,CAAC;AACrB,YAAE,mBAAmB;AACrB,kBAAQ,aAAa,MAAM,IAAI,GAAG;AAClC,mBAAS,iBAA8B,aAAa,EAAE,IAAI,EAAE,GAAG,GAAG,MAAM;AAAA,QAC1E;AAAA,QACA,EAAE,IAAI,GAAG,KAAK,EAAE;AAAA,MAClB;AAGA,YAAM,KAAK,eAAe,GAAG;AAC7B,YAAM,QAAQ,MAAM,KAAK;AAAA,QACvB,MAAO,OAAiC,kBAAkB,CAAC,KAAK;AAAA,MAClE;AACA,UAAI,MAAO,MAAK,KAAK,KAAK;AAAA,IAC5B;AACA,UAAM,WAAW,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC;AAClC,QAAI,SAAS,SAAS,GAAG;AACvB,cAAQ;AAAA,QACN,qBAAqB,CAAC,+BAA+B,SAAS,KAAK,IAAI,CAAC,oBAC3D,KAAK,CAAC,CAAC;AAAA,MACtB;AAAA,IACF;AACA,QAAI,KAAK,CAAC,EAAG,SAAQ,CAAC,IAAI,KAAK,CAAC;AAAA,EAClC;AACA,SAAO;AACT;AAOA,eAAsB,aACpB,eACA,OAAsB,CAAC,GACC;AACxB,QAAM,QAAQ,KAAK,SAAS;AAC5B,QAAM,SAAS,KAAK,UAAU;AAC9B,QAAM,OAAO,KAAK,QAAQ;AAE1B,QAAM,UAAU,MAAM,SAAS,OAAO;AACtC,MAAI;AACF,UAAM,OAAO,MAAM,QAAQ,QAAQ,EAAE,UAAU,EAAE,OAAO,OAAO,EAAE,CAAC;AAClE,UAAM,KAAK,KAAK,UAAU,aAAa,IAAI;AAAA,MACzC,WAAW;AAAA,MACX,SAAS;AAAA,IACX,CAAC;AAED,UAAM,QAAQ,MAAM,KAAK,SAAS,MAAM,SAAS,KAAK,YAAY;AAClE,aAAS,IAAI,GAAG,IAAI,QAAQ,KAAM,KAAK,MAAM;AAC3C,YAAM,KAAK,SAAS,CAAC,OAAO,OAAO,SAAS,GAAG,EAAE,GAAG,CAAC;AACrD,YAAM,KAAK,eAAe,GAAG;AAAA,IAC/B;AACA,UAAM,KAAK,SAAS,MAAM,OAAO,SAAS,GAAG,CAAC,CAAC;AAC/C,UAAM,KAAK,eAAe,IAAI;AAC9B,UAAM,OAAO,MAAM,KAAK,QAAQ;AAIhC,UAAM,EAAE,KAAK,OAAO,IAAI,MAAM,YAAY,QAAQ,aAAa,CAAC;AAChE,QAAI;AACF,YAAM,YAAY,MAAM,QAAQ,QAAQ;AAAA,QACtC,UAAU,EAAE,OAAO,OAAO;AAAA,MAC5B,CAAC;AACD,YAAM,UAAU;AAAA,QACd;AAAA,QACA,CAAC,UACC,MAAM,CAAC,SAAS,SAAS,MAAM,EAAE,SAAS,MAAM,QAAQ,EAAE,aAAa,CAAC,IACpE,MAAM,MAAM,IACZ,MAAM,SAAS;AAAA,MACvB;AACA,YAAM,UAAU,KAAK,KAAK,EAAE,WAAW,QAAQ,SAAS,IAAM,CAAC;AAC/D,YAAM,UAAU,eAAe,GAAG;AAClC,YAAM,gBAAgB,MAAM,aAAa,SAAS;AAClD,YAAM,UAAU,MAAM;AACtB,aAAO,EAAE,MAAM,cAAc;AAAA,IAC/B,UAAE;AACA,YAAM,IAAI,QAAc,CAAC,YAAY,OAAO,MAAM,MAAM,QAAQ,CAAC,CAAC;AAAA,IACpE;AAAA,EACF,UAAE;AACA,UAAM,QAAQ,MAAM;AAAA,EACtB;AACF;;;ACvOA,SAAS,aAAa;AAWtB,IAAM,SAAS;AAUR,SAAS,eAAe,MAAc,YAA4B;AACvE,QAAM,OAAO,MAAM,IAAI;AACvB,QAAM,MAAM,WAAW,MAAM,MAAM,IAAI,CAAC;AAExC,aAAW,MAAM,KAAK,iBAAiB,MAAM,GAAG;AAC9C,UAAM,KAAK,GAAG,aAAa,IAAI,KAAK;AACpC,QAAI,CAAC,OAAO,KAAK,EAAE,EAAG;AACtB,QAAI,CAAC,GAAG,cAAc,WAAW,EAAG;AACpC,OAAG,YAAY,EAAE;AACjB,OAAG,UAAU,IAAI,iBAAiB;AAClC,QAAI,IAAK,IAAG,aAAa,gBAAgB,GAAG;AAAA,EAC9C;AAEA,SAAO,KAAK,SAAS;AACvB;;;ACnCA,SAAS,SAAAC,QAAO,mBAAmB;AAmB5B,SAAS,WAAW,MAAsB;AAC/C,QAAM,OAAOA,OAAM,IAAI;AAEvB,aAAW,UAAU,KAAK,iBAAiB,WAAW,GAAG;AACvD,UAAM,UAAU,SAAS,OAAO,aAAa,cAAc,KAAK,KAAK,EAAE,KAAK;AAC5E,QAAI,UAAU,EAAG;AACjB,UAAM,SAAS,OAAO,WAAW,OAAO,CAAC,MAAwB,aAAa,WAAW;AACzF,WAAO,QAAQ,CAAC,OAAO,MAAM;AAC3B,YAAM,QAAQ,MAAM,aAAa,OAAO,KAAK;AAC7C,YAAM,MAAM,MAAM,IAAI,qDAAqD;AAC3E,YAAM,aAAa,SAAS,QAAQ,GAAG,KAAK,IAAI,GAAG,KAAK,GAAG;AAAA,IAC7D,CAAC;AAAA,EACH;AAEA,SAAO,KAAK,SAAS;AACvB;;;ACrBA,IAAM,cAAc;AAEb,SAAS,eAAe,MAAc,UAAkC,CAAC,GAAW;AACzF,SAAO,KAAK;AAAA,IACV;AAAA,IACA,CAAC,OAAO,MAAc,UAAU,QAAQ,CAAC,KAAK,cAAc,CAAC,EAAE;AAAA,EACjE;AACF;;;ACpBA,SAAS,SAAAC,cAA0B;;;ACiD5B,IAAM,oBAAoB;AA6B1B,SAAS,SAAS,MAAgB,KAAqB;AAC5D,SAAO,SAAI,SAAS,SAAS,MAAM,GAAG,IAAI,GAAG;AAC/C;AAIO,SAAS,QAAQ,SAAiB,MAAgB,GAAmB;AAC1E,SAAO,GAAG,OAAO,IAAI,SAAS,SAAS,MAAM,GAAG,GAAG,CAAC;AACtD;;;ACnFO,SAAS,eAAe,MAA6C;AAC1E,QAAM,QAAQ,oBAAI,IAAyB;AAC3C,OAAK,iBAAiB,SAAS,EAAE,QAAQ,CAAC,GAAG,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC;AAClE,SAAO;AACT;AAIO,SAAS,aAAa,IAAiB,cAAgD;AAC5F,MAAI,IAAoC;AACxC,SAAO,GAAG;AACR,QAAI,EAAE,YAAY,aAAa,aAAa,IAAI,CAAC,GAAG;AAClD,aAAO,IAAI,aAAa,IAAI,CAAC,CAAC;AAAA,IAChC;AACA,QAAI,EAAE;AAAA,EACR;AACA,SAAO;AACT;;;AFfA,IAAM,WAAW,CAAC,MAAuB,UAAU,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAc5E,SAAS,kBAAkB,MAAyB;AAClD,aAAW,MAAM,KAAK,iBAAiB,GAAG,GAAG;AAC3C,eAAW,QAAQ,OAAO,KAAK,GAAG,UAAU,GAAG;AAC7C,UAAI,SAAS,iBAAiB,KAAK,WAAW,YAAY,GAAG;AAC3D,WAAG,gBAAgB,IAAI;AAAA,MACzB;AAAA,IACF;AAAA,EACF;AACF;AAQO,SAAS,WAAW,MAA+C;AACxE,QAAM,OAAOC,OAAM,IAAI;AACvB,QAAM,eAAe,eAAe,IAAI;AACxC,QAAM,WAAW,oBAAI,IAAoB;AACzC,QAAM,QAAgB,CAAC;AAEvB,QAAM,UAAU,CAAC,OAA4B;AAC3C,UAAM,UAAU,aAAa,IAAI,YAAY;AAC7C,UAAM,IAAI,SAAS,IAAI,OAAO,KAAK;AACnC,aAAS,IAAI,SAAS,IAAI,CAAC;AAC3B,WAAO,QAAQ,SAAS,SAAS,CAAC;AAAA,EACpC;AAMA,aAAW,MAAM,KAAK,iBAAiB,cAAc,GAAG;AACtD,UAAM,OAAO,GAAG,aAAa,WAAW;AACxC,QAAI,CAAC,KAAM;AACX,UAAM,QAAQ,GAAG,aAAa,YAAY;AAC1C,QAAI,CAAC,MAAO;AACZ,UAAM,OAAO,GAAG,aAAa,cAAc,KAAK;AAChD,UAAM,OAAO,GAAG,aAAa,WAAW;AACxC,UAAM,UAAU,OAAO,KAAK,IAAI,MAAM,OAAO,YAAY;AACzD,UAAM,MAAM,GAAG,IAAI,GAAG,OAAO,GAAG,KAAK;AAErC,UAAM,MAAM,QAAQ,EAAE;AACtB,UAAM,KAAK,EAAE,KAAK,MAAM,SAAS,KAAK,SAAS,aAAa,IAAI,YAAY,EAAE,CAAC;AAC/E,UAAM,OAAO,wBAAwB,SAAS,SAAS,GAAG,CAAC;AAC3D,UAAM,QAAQ,GAAG,aAAa,OAAO;AACrC,OAAG,aAAa,SAAS,QAAQ,GAAG,KAAK,IAAI,IAAI,KAAK,IAAI;AAC1D,OAAG,gBAAgB,WAAW;AAAA,EAChC;AAGA,aAAW,MAAM,KAAK,iBAAiB,uBAAuB,GAAG;AAC/D,eAAW,QAAQ,CAAC,OAAO,QAAQ,QAAQ,GAAY;AACrD,YAAM,IAAI,GAAG,aAAa,IAAI;AAC9B,UAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAG;AACxB,YAAM,MAAM,QAAQ,EAAE;AACtB,YAAM,KAAK,EAAE,KAAK,MAAM,SAAS,KAAK,GAAG,SAAS,aAAa,IAAI,YAAY,EAAE,CAAC;AAClF,SAAG,aAAa,MAAM,SAAS,SAAS,GAAG,CAAC;AAAA,IAC9C;AAAA,EACF;AAEA,oBAAkB,IAAI;AACtB,SAAO,EAAE,MAAM,KAAK,SAAS,GAAG,MAAM;AACxC;;;AGnFA,SAAS,SAAAC,QAAoB,gBAAgB;AAK7C,IAAM,OAAO,oBAAI,IAAI,CAAC,UAAU,SAAS,YAAY,QAAQ,SAAS,KAAK,CAAC;AA4BrE,SAAS,aAAa,MAA+C;AAC1E,QAAM,OAAOC,OAAM,IAAI;AACvB,QAAM,eAAe,eAAe,IAAI;AAExC,QAAM,WAAW,oBAAI,IAAoB;AACzC,QAAM,QAAgB,CAAC;AAEvB,QAAM,OAAO,CAAC,OAA0B;AACtC,eAAW,SAAS,GAAG,YAAY;AACjC,UAAI,MAAM,aAAa,SAAS,WAAW;AACzC,cAAM,MAAM,MAAM;AAIlB,YAAI,OAAO,MAAM,KAAK,KAAK,MAAM,IAAI;AACnC,gBAAM,UAAU,aAAa,IAAI,YAAY;AAC7C,gBAAM,IAAI,SAAS,IAAI,OAAO,KAAK;AACnC,mBAAS,IAAI,SAAS,IAAI,CAAC;AAC3B,gBAAM,MAAM,QAAQ,SAAS,QAAQ,CAAC;AACtC,gBAAM,KAAK,EAAE,KAAK,MAAM,QAAQ,MAAM,KAAK,QAAQ,CAAC;AACpD,gBAAM,UAAU,SAAS,QAAQ,GAAG;AAAA,QACtC;AAAA,MACF,WAAW,MAAM,aAAa,SAAS,cAAc;AACnD,cAAM,UAAU;AAChB,YAAI,CAAC,KAAK,IAAI,QAAQ,OAAO,EAAG,MAAK,OAAO;AAAA,MAC9C;AAAA,IACF;AAAA,EACF;AACA,OAAK,IAAI;AAET,SAAO,EAAE,MAAM,KAAK,SAAS,GAAG,MAAM;AACxC;;;AChEA,SAAS,SAAAC,cAAa;AAKf,IAAM,mBACX;AAoBK,SAAS,SAAS,MAAyB;AAChD,QAAM,OAAOA,OAAM,IAAI;AACvB,QAAM,QAAQ,KAAK,cAAc,OAAO,GAAG,MAAM,KAAK,KAAK;AAC3D,QAAM,SAAS,CAAC,SACd,KAAK,cAAc,kBAAkB,IAAI,IAAI,GAAG,aAAa,SAAS,KAAK;AAC7E,QAAM,YAAY,OAAO,UAAU,MAAM,SAAS;AAClD,QAAM,eAAe,OAAO,UAAU;AAEtC,QAAM,YAAY,KACf,iBAAiB,wBAAwB,EACzC,IAAI,CAAC,MAAM,EAAE,aAAa,MAAM,CAAC,EACjC,OAAO,CAAC,MAAmB,CAAC,CAAC,CAAC;AAEjC,QAAM,SAAmB,CAAC;AAC1B,aAAW,KAAK,KAAK,iBAAiB,OAAO,GAAG;AAC9C,WAAO,KAAK,EAAE,SAAS;AACvB,MAAE,OAAO;AAAA,EACX;AACA,aAAW,MAAM,KAAK,iBAAiB,QAAQ,EAAG,IAAG,OAAO;AAI5D,aAAW,UAAU,KAAK,iBAAiB,yCAAyC,GAAG;AACrF,WAAO,OAAO;AAAA,EAChB;AAEA,QAAM,OAAO,KAAK,cAAc,MAAM;AACtC,QAAM,QAAQ,OAAO,KAAK,YAAY,KAAK,SAAS;AACpD,QAAM,YAAY,MAAM,aAAa,OAAO,KAAK;AACjD,QAAM,YAAY,MAAM,aAAa,OAAO,KAAK;AACjD,QAAM,MAAM,eAAe,SAAS,GAAG,KAAK;AAC5C,QAAM,YAAY,YAAY,WAAW,SAAS,MAAM;AACxD,QAAM,eAAe,eAAe,GAAG,IAAI,SAAS,IAAI,KAAK;AAE7D,QAAM,WAAW,CAAC,GAAG,QAAQ,gBAAgB,EAAE,KAAK,IAAI;AACxD,SAAO,EAAE,cAAc,UAAU,OAAO,WAAW,cAAc,UAAU;AAC7E;;;ACnDA,SAAS,KAAK,MAAc,KAAoB;AAC9C,QAAM,IAAI,MAAM,gBAAgB,IAAI,IAAI,GAAG,EAAE;AAC/C;AAEA,SAAS,SAAS,GAAY,MAAsB;AAClD,MAAI,OAAO,MAAM,YAAY,EAAE,KAAK,MAAM,IAAI;AAC5C,SAAK,MAAM,mCAAmC,KAAK,UAAU,CAAC,CAAC,GAAG;AAAA,EACpE;AACA,SAAO;AACT;AAWO,SAAS,mBAAmB,MAAe,SAAyB;AACzE,MAAI,SAAS,UAAa,SAAS,KAAM,QAAO,CAAC;AACjD,MAAI,OAAO,SAAS,YAAY,MAAM,QAAQ,IAAI,GAAG;AACnD,SAAK,QAAQ,wCAAwC;AAAA,EACvD;AAIA,QAAM,QAAkB,KAA6B;AACrD,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,MAAK,SAAS,kBAAkB;AAE3D,QAAM,cAAc,IAAI,IAAI,QAAQ,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC;AACrD,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,MAAc,CAAC;AAErB,QAAM,QAAQ,CAAC,KAAK,MAAM;AACxB,UAAM,KAAK,SAAS,CAAC;AACrB,QAAI,OAAO,QAAQ,YAAY,QAAQ,KAAM,MAAK,IAAI,mBAAmB;AACzE,UAAM,IAAI;AAEV,UAAM,MAAM,SAAS,EAAE,KAAK,GAAG,EAAE,MAAM;AACvC,QAAI,CAAC,IAAI,WAAW,iBAAiB,GAAG;AACtC;AAAA,QACE,GAAG,EAAE;AAAA,QACL,oBAAoB,iBAAiB,oDAAoD,GAAG;AAAA,MAC9F;AAAA,IACF;AACA,QAAI,YAAY,IAAI,GAAG,EAAG,MAAK,GAAG,EAAE,QAAQ,kCAAkC,GAAG,IAAI;AACrF,QAAI,KAAK,IAAI,GAAG,EAAG,MAAK,GAAG,EAAE,QAAQ,uBAAuB,GAAG,IAAI;AACnE,SAAK,IAAI,GAAG;AAEZ,UAAM,OAAO,EAAE;AACf,QAAI,SAAS,UAAU,SAAS,SAAS;AACvC,WAAK,GAAG,EAAE,SAAS,kCAAkC,KAAK,UAAU,IAAI,CAAC,GAAG;AAAA,IAC9E;AAEA,UAAM,UAAU,OAAO,EAAE,YAAY,YAAY,EAAE,QAAQ,KAAK,IAAI,EAAE,UAAU;AAChF,QAAI,SAAS,QAAQ;AACnB,UAAI,KAAK,EAAE,KAAK,MAAM,MAAM,SAAS,EAAE,MAAM,GAAG,EAAE,OAAO,GAAG,QAAQ,CAAC;AAAA,IACvE,OAAO;AACL,UAAI,KAAK,EAAE,KAAK,MAAM,KAAK,SAAS,EAAE,KAAK,GAAG,EAAE,MAAM,GAAG,QAAQ,CAAC;AAAA,IACpE;AAAA,EACF,CAAC;AAED,SAAO;AACT;;;AVzCA,eAAsB,WAAW,MAA4C;AAC3E,QAAM,EAAE,MAAM,SAAS,cAAc,IAAI,MAAM,aAAa,KAAK,aAAa;AAK9E,QAAM,aAAa,MAAMC,UAAS,KAAK,eAAe,OAAO;AAC7D,QAAM,SAAS,eAAe,SAAS,UAAU;AACjD,QAAM,SAAS,WAAW,MAAM;AAChC,QAAM,WAAW,eAAe,QAAQ,aAAa;AACrD,QAAM,QAAQ,WAAW,QAAQ;AACjC,QAAM,YAAY,aAAa,MAAM,IAAI;AACzC,QAAM,MAAM,SAAS,UAAU,IAAI;AAKnC,QAAM,SAAS,iBAAiB,UAAU;AAC1C,QAAM,YACJ,UAAU,IAAI,aAAa,SAAS,OAAO,OAAO,OAAO,GAAG,IAAI,SAAS;AAI3E,QAAM,UAAU,CAAC,GAAG,MAAM,OAAO,GAAG,UAAU,KAAK;AACnD,QAAM,QAAQ,mBAAmB,KAAK,YAAY,OAAO;AAEzD,SAAO;AAAA,IACL,UAAU;AAAA,MACR,MAAM,KAAK;AAAA,MACX,KAAK,KAAK,OAAO;AAAA,MACjB,OAAO,IAAI;AAAA,MACX,WAAW,IAAI;AAAA,MACf,cAAc,IAAI;AAAA,MAClB,WAAW,IAAI;AAAA,MACf,OAAO,CAAC,GAAG,SAAS,GAAG,KAAK;AAAA,IAC9B;AAAA,IACA,cAAc,IAAI;AAAA,IAClB,UAAU,IAAI;AAAA,IACd;AAAA,EACF;AACF;AAWA,eAAsB,WACpB,QACA,QAOC;AACD,QAAM,EAAE,MAAM,IAAI,IAAI,OAAO;AAC7B,QAAM,YAAYC,MAAK,QAAQ,QAAQ;AACvC,QAAM,MAAM,WAAW,EAAE,WAAW,KAAK,CAAC;AAC1C,QAAM,WAAWA,MAAK,WAAW,GAAG,GAAG,OAAO;AAC9C,QAAM,QAAQA,MAAK,WAAW,GAAG,GAAG,YAAY;AAChD,QAAM,QAAQA,MAAK,WAAW,GAAG,GAAG,aAAa;AACjD,QAAM,WAAWA,MAAK,QAAQ,GAAG,IAAI,aAAa;AAClD,QAAM,UAAU,UAAU,OAAO,cAAc,OAAO;AACtD,QAAM,UAAU,OAAO,OAAO,UAAU,OAAO;AAC/C,QAAM,UAAU,OAAO,KAAK,UAAU,OAAO,SAAS,WAAW,MAAM,CAAC,GAAG,OAAO;AAClF,QAAM,UAAU,UAAU,KAAK,UAAU,OAAO,UAAU,MAAM,CAAC,GAAG,OAAO;AAC3E,MAAI,CAAC,OAAO,UAAW,QAAO,EAAE,UAAU,OAAO,OAAO,SAAS;AACjE,QAAM,MAAMA,MAAK,WAAW,GAAG,GAAG,WAAW;AAC7C,QAAM,UAAU,KAAK,KAAK,UAAU,OAAO,WAAW,MAAM,CAAC,GAAG,OAAO;AACvE,SAAO,EAAE,UAAU,OAAO,OAAO,UAAU,IAAI;AACjD;","names":["readFile","join","parse","parse","parse","parse","parse","parse","readFile","join"]}

package/dist/protection-audit-X3BHT2MB.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/audits/protection-coverage.ts","../src/cli/commands/protection-audit.ts"],"sourcesContent":["import { rulesetGaps, type ExistingRuleset } from \"../github/rulesets.js\";\nimport type { WorkflowHealth } from \"../github/gh.js\";\n\n/**\n * Org-wide protection-coverage sweep (spec:\n * docs/superpowers/specs/2026-08-02-ruleset-self-healing-design.md).\n *\n * The `self-updating` recipe HEALS fleet sites, but it runs only when someone\n * runs it, and only over Airtable-listed sites — which is exactly how the\n * `.github` repo (no Airtable row) sat with zero protection until 2026-08-01.\n * This sweep is the layer that would have caught that on its own: it\n * enumerates the org FROM THE GITHUB API — never a hand-typed or\n * Airtable-scoped list, both of which have already produced false \"all\n * clear\"s — and judges every public repo's protection by SHAPE, not by name,\n * so a differently-named but sound ruleset (reddoor-maintenance's \"Main\n * Protection\") counts.\n *\n * Since 2026-08-02 the same sweep also verifies two more posture surfaces per\n * public repo, because both regress silently and neither has any other\n * watcher:\n *  - secret scanning + push protection stay ENABLED (a repo transferred in,\n *    or an org-default flip, arrives with them off);\n *  - the renovate workflow is registered, active, and has actually RUN\n *    recently. GitHub auto-disables schedules after 60 quiet days, and\n *    schedule triggers in template-cloned files may never register at all —\n *    either way a fully-quiet repo stops receiving updates with zero signal\n *    (the 2026-08-02 sweep found two never-run and two 5-days-stale repos on\n *    its first pass).\n */\nexport type ProtectionCoverageRow = {\n  repo: string; // owner/repo\n  status: \"covered\" | \"gap\" | \"skipped\";\n  /** Human-readable: covering ruleset + whether it gates on CI, the specific\n   *  gaps, or why the repo was skipped. */\n  detail: string;\n};\n\n/** The reads the sweep needs — a subset of the GitHub factory, injected so the\n *  sweep is pure + testable (same pattern as collectGitHubSignals). */\nexport type ProtectionCoverageDeps = {\n  listOrgRepos: (org: string) => Promise<\n    Array<{\n      name: string;\n      visibility: string;\n      archived: boolean;\n      secretScanning: string;\n      pushProtection: string;\n    }>\n  >;\n  listRepoRulesets: (repo: string) => Promise<Array<{ id: number; name: string }>>;\n  getRuleset: (repo: string, id: number) => Promise<ExistingRuleset>;\n  workflowHealth: (repo: string, filename: string) => Promise<WorkflowHealth>;\n};\n\nexport const RENOVATE_WORKFLOW_FILE = \"renovate.yml\";\n\n/** Cron is twice daily, so 3 days without a SUCCESSFUL run = 6+ consecutive\n *  missed-or-failing runs — dead scheduling, dead credential, or broken\n *  config, never jitter. (Success, not run-existence: a revoked App key still\n *  creates a fresh failing run every tick.) */\nexport const RENOVATE_STALE_AFTER_DAYS = 3;\n\n/**\n * Operator-accepted gaps — the protection-audit analogue of the cockpit's\n * accepted-Watch acks: a KNOWN condition pending a real decision must not\n * comment the tracking issue every night, or the channel is tuned out by the\n * time a genuinely new gap lands in it. Constraints that keep this honest:\n * every entry is PR-reviewed, names ONE repo + ONE surface (never a blanket\n * mute), states the pending decision, and EXPIRES — past `until` the gap\n * returns on its own, so an acceptance can never quietly become permanent.\n */\nexport type AcceptedGap = {\n  repo: string; // owner/repo\n  /** Matched as a prefix of the gap detail line — surface-scoped, so an\n   *  accepted renovate gap never swallows a ruleset or secret-scanning gap. */\n  detailPrefix: string;\n  reason: string;\n  until: string; // ISO date; exclusive — the gap is live again ON this date\n};\n\n// Currently EMPTY — the only two entries (no-renovate on reddoor-maintenance\n// and .github, pending an operator supply-chain call) were retired 2026-08-02\n// when the operator approved planting Renovate on both. Add entries only for\n// a named pending decision, never as a mute.\nexport const ACCEPTED_GAPS: AcceptedGap[] = [];\n\n/** Split gaps into live vs accepted-for-now. Acceptance is per-surface (detail\n *  prefix) and expires: an entry past `until` accepts nothing. */\nexport function partitionAcceptedGaps(\n  repo: string,\n  gaps: string[],\n  now: Date,\n  accepted: AcceptedGap[] = ACCEPTED_GAPS,\n): { live: string[]; accepted: string[] } {\n  const live: string[] = [];\n  const acceptedOut: string[] = [];\n  for (const gap of gaps) {\n    const match = accepted.find(\n      (a) => a.repo === repo && gap.startsWith(a.detailPrefix) && now < new Date(a.until),\n    );\n    if (match) acceptedOut.push(`${gap} [accepted until ${match.until}: ${match.reason}]`);\n    else live.push(gap);\n  }\n  return { live, accepted: acceptedOut };\n}\n\n/** Public repos only — secret scanning is plan-gated off on private Free\n *  repos, and those are skipped before this is consulted. \"unavailable\" means\n *  the listing couldn't read security_and_analysis (token lacks admin read),\n *  which must read as unverified, not as fine. */\nexport function secretScanningGaps(repo: {\n  secretScanning: string;\n  pushProtection: string;\n}): string[] {\n  const gaps: string[] = [];\n  if (repo.secretScanning !== \"enabled\")\n    gaps.push(`secret scanning ${repo.secretScanning} (fleet floor is enabled)`);\n  if (repo.pushProtection !== \"enabled\")\n    gaps.push(`push protection ${repo.pushProtection} (fleet floor is enabled)`);\n  return gaps;\n}\n\n/** Renovate liveness verdict — judged on the last SUCCESSFUL run. The cron IS\n *  the merge cadence (platform auto-merge is off fleet-wide), so a workflow\n *  that isn't succeeding means the repo silently stops updating — the exact\n *  class the 2026-07-26 incident review called \"zero-run blindness\". */\nexport function renovateGaps(health: WorkflowHealth, now: Date): string[] {\n  if (!health.present) return [\"no renovate workflow (dependency updates never run here)\"];\n  if (health.state !== \"active\")\n    return [\n      // A disabled workflow REJECTS workflow_dispatch (HTTP 403) — it must be\n      // re-enabled first; \"just dispatch it\" is a dead-end runbook line here.\n      `renovate workflow is ${health.state} (re-enable it: \\`gh workflow enable renovate.yml -R <repo>\\`, then dispatch once)`,\n    ];\n  if (health.lastSuccessAt === null)\n    return [\n      \"renovate workflow has never succeeded (dispatch it once; if this gap returns, the schedule never registered — push a commit touching the workflow file)\",\n    ];\n  const succeededAt = Date.parse(health.lastSuccessAt);\n  if (Number.isNaN(succeededAt))\n    return [`renovate last-success timestamp unreadable: ${health.lastSuccessAt}`];\n  const days = (now.getTime() - succeededAt) / 86_400_000;\n  if (days > RENOVATE_STALE_AFTER_DAYS)\n    return [`renovate last succeeded ${Math.floor(days)}d ago (cron is twice daily)`];\n  return [];\n}\n\n/**\n * One row per org repo. Coverage = SOME repo-sourced ruleset with zero\n * stage-1 gaps (active, empty bypass, default branch covered, deletion +\n * non_fast_forward + pull_request) AND secret scanning enabled AND a live\n * renovate workflow. Whether a covering ruleset also gates on CI is reported\n * as detail, not judged: each repo's required context differs (and\n * reddoor-maintenance deliberately has none pending release-path review), so\n * the CI-gate invariant belongs to the per-site heal, which has the evidence\n * to require the RIGHT context safely.\n *\n * Private/archived repos are skipped (rulesets on private repos need a paid\n * plan; archived repos are read-only). A repo whose probe THROWS is a `gap`,\n * not a skip — \"couldn't verify\" reading as \"fine\" is the silent-green\n * failure mode this sweep exists to kill, and the tracking issue auto-closes\n * on the next clean pass, so a transient API blip costs one issue-comment.\n */\nexport async function collectProtectionCoverage(\n  org: string,\n  deps: ProtectionCoverageDeps,\n  now: Date = new Date(),\n  accepted: AcceptedGap[] = ACCEPTED_GAPS,\n): Promise<ProtectionCoverageRow[]> {\n  const rows: ProtectionCoverageRow[] = [];\n  for (const r of await deps.listOrgRepos(org)) {\n    const repo = `${org}/${r.name}`;\n    if (r.archived || r.visibility !== \"public\") {\n      rows.push({\n        repo,\n        status: \"skipped\",\n        detail: r.archived ? \"archived\" : `${r.visibility} (rulesets need a paid plan)`,\n      });\n      continue;\n    }\n    try {\n      const gaps: string[] = [];\n      let coveredDetail = \"\";\n      const rulesets = await deps.listRepoRulesets(repo);\n      if (rulesets.length === 0) {\n        gaps.push(\"no repo rulesets at all\");\n      } else {\n        const judged = await Promise.all(\n          rulesets.map(async (rs) => {\n            const full = await deps.getRuleset(repo, rs.id);\n            return { name: rs.name, full, gaps: rulesetGaps(full, null) };\n          }),\n        );\n        const covering = judged.find((j) => j.gaps.length === 0);\n        if (covering) {\n          const ciGated = (covering.full.rules ?? []).some(\n            (rule) => rule.type === \"required_status_checks\",\n          );\n          coveredDetail = `\"${covering.name}\"${ciGated ? \"\" : \" — NO CI gate (refs rules only)\"}`;\n        } else {\n          gaps.push(judged.map((j) => `\"${j.name}\": ${j.gaps.join(\"; \")}`).join(\" | \"));\n        }\n      }\n      gaps.push(...secretScanningGaps(r));\n      gaps.push(...renovateGaps(await deps.workflowHealth(repo, RENOVATE_WORKFLOW_FILE), now));\n      const { live, accepted: acked } = partitionAcceptedGaps(repo, gaps, now, accepted);\n      if (live.length > 0) {\n        // Accepted annotations still ride along for context, but only LIVE\n        // gaps make the row a gap (and thus the sweep exit 1).\n        rows.push({ repo, status: \"gap\", detail: [...live, ...acked].join(\" | \") });\n      } else if (acked.length > 0) {\n        // Judged, found wanting, deliberately acked — reported as skipped\n        // (visible every night with the reason + expiry), never as covered.\n        rows.push({ repo, status: \"skipped\", detail: acked.join(\" | \") });\n      } else {\n        rows.push({ repo, status: \"covered\", detail: coveredDetail });\n      }\n    } catch (e) {\n      rows.push({\n        repo,\n        status: \"gap\",\n        detail: `probe failed: ${e instanceof Error ? e.message : String(e)}`,\n      });\n    }\n  }\n  return rows;\n}\n","import {\n  collectProtectionCoverage,\n  type ProtectionCoverageDeps,\n} from \"../../audits/protection-coverage.js\";\nimport { makeGitHub } from \"../../github/gh.js\";\n\n/** Exit 1 on ANY gap: unlike the fleet write sweeps (majority-rule), a single\n *  unprotected public repo is a real hole, not a flake to tolerate. */\nexport function protectionAuditExitCode(gaps: number): number {\n  return gaps > 0 ? 1 : 0;\n}\n\n/** `protection-audit --org <org>`: verify every public repo in the org carries\n *  a sound branch ruleset, live secret scanning + push protection, and a\n *  renovate workflow that actually runs (see collectProtectionCoverage for the\n *  verdicts). Emits one line per repo + a machine-readable PROTECTION_AUDIT\n *  summary the nightly workflow gates its tracking issue on. A missing fleet\n *  token is a clean skip (local runs), matching github-signals. */\nexport async function runProtectionAuditCommand(\n  opts: { org?: string | undefined },\n  // Injected in tests; defaults to the real gh-CLI-backed factory.\n  depsOverride?: ProtectionCoverageDeps,\n): Promise<{ output: string; code: number }> {\n  const org = opts.org?.trim();\n  if (!org) {\n    return { output: \"protection-audit requires --org <org>\", code: 2 };\n  }\n  const token = process.env.RENOVATE_TOKEN?.trim() || process.env.GH_TOKEN?.trim();\n  if (!depsOverride && !token) {\n    return {\n      output: \"protection-audit skipped: no RENOVATE_TOKEN/GH_TOKEN (fleet read) configured.\",\n      code: 0,\n    };\n  }\n  const deps = depsOverride ?? makeGitHub({ token: token! });\n\n  const rows = await collectProtectionCoverage(org, deps);\n  const gaps = rows.filter((r) => r.status === \"gap\");\n  const covered = rows.filter((r) => r.status === \"covered\");\n  const skipped = rows.filter((r) => r.status === \"skipped\");\n\n  const lines = rows.map((r) => `${r.status.toUpperCase().padEnd(7)} ${r.repo} — ${r.detail}`);\n  lines.push(\n    `PROTECTION_AUDIT gaps=${gaps.length} covered=${covered.length} skipped=${skipped.length} total=${rows.length}`,\n  );\n  return { output: lines.join(\"\\n\"), code: protectionAuditExitCode(gaps.length) };\n}\n"],"mappings":";;;;;;;;;AAsDO,IAAM,yBAAyB;AAM/B,IAAM,4BAA4B;AAwBlC,IAAM,gBAA+B,CAAC;AAItC,SAAS,sBACd,MACA,MACA,KACA,WAA0B,eACc;AACxC,QAAM,OAAiB,CAAC;AACxB,QAAM,cAAwB,CAAC;AAC/B,aAAW,OAAO,MAAM;AACtB,UAAM,QAAQ,SAAS;AAAA,MACrB,CAAC,MAAM,EAAE,SAAS,QAAQ,IAAI,WAAW,EAAE,YAAY,KAAK,MAAM,IAAI,KAAK,EAAE,KAAK;AAAA,IACpF;AACA,QAAI,MAAO,aAAY,KAAK,GAAG,GAAG,oBAAoB,MAAM,KAAK,KAAK,MAAM,MAAM,GAAG;AAAA,QAChF,MAAK,KAAK,GAAG;AAAA,EACpB;AACA,SAAO,EAAE,MAAM,UAAU,YAAY;AACvC;AAMO,SAAS,mBAAmB,MAGtB;AACX,QAAM,OAAiB,CAAC;AACxB,MAAI,KAAK,mBAAmB;AAC1B,SAAK,KAAK,mBAAmB,KAAK,cAAc,2BAA2B;AAC7E,MAAI,KAAK,mBAAmB;AAC1B,SAAK,KAAK,mBAAmB,KAAK,cAAc,2BAA2B;AAC7E,SAAO;AACT;AAMO,SAAS,aAAa,QAAwB,KAAqB;AACxE,MAAI,CAAC,OAAO,QAAS,QAAO,CAAC,0DAA0D;AACvF,MAAI,OAAO,UAAU;AACnB,WAAO;AAAA;AAAA;AAAA,MAGL,wBAAwB,OAAO,KAAK;AAAA,IACtC;AACF,MAAI,OAAO,kBAAkB;AAC3B,WAAO;AAAA,MACL;AAAA,IACF;AACF,QAAM,cAAc,KAAK,MAAM,OAAO,aAAa;AACnD,MAAI,OAAO,MAAM,WAAW;AAC1B,WAAO,CAAC,+CAA+C,OAAO,aAAa,EAAE;AAC/E,QAAM,QAAQ,IAAI,QAAQ,IAAI,eAAe;AAC7C,MAAI,OAAO;AACT,WAAO,CAAC,2BAA2B,KAAK,MAAM,IAAI,CAAC,6BAA6B;AAClF,SAAO,CAAC;AACV;AAkBA,eAAsB,0BACpB,KACA,MACA,MAAY,oBAAI,KAAK,GACrB,WAA0B,eACQ;AAClC,QAAM,OAAgC,CAAC;AACvC,aAAW,KAAK,MAAM,KAAK,aAAa,GAAG,GAAG;AAC5C,UAAM,OAAO,GAAG,GAAG,IAAI,EAAE,IAAI;AAC7B,QAAI,EAAE,YAAY,EAAE,eAAe,UAAU;AAC3C,WAAK,KAAK;AAAA,QACR;AAAA,QACA,QAAQ;AAAA,QACR,QAAQ,EAAE,WAAW,aAAa,GAAG,EAAE,UAAU;AAAA,MACnD,CAAC;AACD;AAAA,IACF;AACA,QAAI;AACF,YAAM,OAAiB,CAAC;AACxB,UAAI,gBAAgB;AACpB,YAAM,WAAW,MAAM,KAAK,iBAAiB,IAAI;AACjD,UAAI,SAAS,WAAW,GAAG;AACzB,aAAK,KAAK,yBAAyB;AAAA,MACrC,OAAO;AACL,cAAM,SAAS,MAAM,QAAQ;AAAA,UAC3B,SAAS,IAAI,OAAO,OAAO;AACzB,kBAAM,OAAO,MAAM,KAAK,WAAW,MAAM,GAAG,EAAE;AAC9C,mBAAO,EAAE,MAAM,GAAG,MAAM,MAAM,MAAM,YAAY,MAAM,IAAI,EAAE;AAAA,UAC9D,CAAC;AAAA,QACH;AACA,cAAM,WAAW,OAAO,KAAK,CAAC,MAAM,EAAE,KAAK,WAAW,CAAC;AACvD,YAAI,UAAU;AACZ,gBAAM,WAAW,SAAS,KAAK,SAAS,CAAC,GAAG;AAAA,YAC1C,CAAC,SAAS,KAAK,SAAS;AAAA,UAC1B;AACA,0BAAgB,IAAI,SAAS,IAAI,IAAI,UAAU,KAAK,sCAAiC;AAAA,QACvF,OAAO;AACL,eAAK,KAAK,OAAO,IAAI,CAAC,MAAM,IAAI,EAAE,IAAI,MAAM,EAAE,KAAK,KAAK,IAAI,CAAC,EAAE,EAAE,KAAK,KAAK,CAAC;AAAA,QAC9E;AAAA,MACF;AACA,WAAK,KAAK,GAAG,mBAAmB,CAAC,CAAC;AAClC,WAAK,KAAK,GAAG,aAAa,MAAM,KAAK,eAAe,MAAM,sBAAsB,GAAG,GAAG,CAAC;AACvF,YAAM,EAAE,MAAM,UAAU,MAAM,IAAI,sBAAsB,MAAM,MAAM,KAAK,QAAQ;AACjF,UAAI,KAAK,SAAS,GAAG;AAGnB,aAAK,KAAK,EAAE,MAAM,QAAQ,OAAO,QAAQ,CAAC,GAAG,MAAM,GAAG,KAAK,EAAE,KAAK,KAAK,EAAE,CAAC;AAAA,MAC5E,WAAW,MAAM,SAAS,GAAG;AAG3B,aAAK,KAAK,EAAE,MAAM,QAAQ,WAAW,QAAQ,MAAM,KAAK,KAAK,EAAE,CAAC;AAAA,MAClE,OAAO;AACL,aAAK,KAAK,EAAE,MAAM,QAAQ,WAAW,QAAQ,cAAc,CAAC;AAAA,MAC9D;AAAA,IACF,SAAS,GAAG;AACV,WAAK,KAAK;AAAA,QACR;AAAA,QACA,QAAQ;AAAA,QACR,QAAQ,iBAAiB,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,CAAC;AAAA,MACrE,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO;AACT;;;AC1NO,SAAS,wBAAwB,MAAsB;AAC5D,SAAO,OAAO,IAAI,IAAI;AACxB;AAQA,eAAsB,0BACpB,MAEA,cAC2C;AAC3C,QAAM,MAAM,KAAK,KAAK,KAAK;AAC3B,MAAI,CAAC,KAAK;AACR,WAAO,EAAE,QAAQ,yCAAyC,MAAM,EAAE;AAAA,EACpE;AACA,QAAM,QAAQ,QAAQ,IAAI,gBAAgB,KAAK,KAAK,QAAQ,IAAI,UAAU,KAAK;AAC/E,MAAI,CAAC,gBAAgB,CAAC,OAAO;AAC3B,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,MAAM;AAAA,IACR;AAAA,EACF;AACA,QAAM,OAAO,gBAAgB,WAAW,EAAE,MAAc,CAAC;AAEzD,QAAM,OAAO,MAAM,0BAA0B,KAAK,IAAI;AACtD,QAAM,OAAO,KAAK,OAAO,CAAC,MAAM,EAAE,WAAW,KAAK;AAClD,QAAM,UAAU,KAAK,OAAO,CAAC,MAAM,EAAE,WAAW,SAAS;AACzD,QAAM,UAAU,KAAK,OAAO,CAAC,MAAM,EAAE,WAAW,SAAS;AAEzD,QAAM,QAAQ,KAAK,IAAI,CAAC,MAAM,GAAG,EAAE,OAAO,YAAY,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI,WAAM,EAAE,MAAM,EAAE;AAC3F,QAAM;AAAA,IACJ,yBAAyB,KAAK,MAAM,YAAY,QAAQ,MAAM,YAAY,QAAQ,MAAM,UAAU,KAAK,MAAM;AAAA,EAC/G;AACA,SAAO,EAAE,QAAQ,MAAM,KAAK,IAAI,GAAG,MAAM,wBAAwB,KAAK,MAAM,EAAE;AAChF;","names":[]}