@reddoorla/maintenance 0.89.0 → 0.90.0

package/dist/{chunk-73UFRZKY.js → chunk-MLT4QY5X.js}

@@ -169,8 +169,111 @@ function templatesByName(which) {
   return ALL_TEMPLATES.filter((t) => which.includes(t.config));
 }
 
+// src/recipes/sync-configs/renovate-action.ts
+var DIGEST_RE = /^[0-9a-f]{40}$/;
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function stripComments(contents) {
+  return contents.replace(/^[ \t]*#[^\n]*$/gm, "");
+}
+var USES_LINE_RE = /^([ \t]*(?:- )?)uses:\s*([\w.-]+\/[\w.-]+)@(\S+)(?:[ \t]*#[^\r\n]*)?/gm;
+function usesRefAndComment(contents, slug) {
+  const re = new RegExp(
+    `^[ \\t]*(?:- )?uses:\\s*${escapeRegExp(slug)}@(\\S+)([ \\t]*#[^\\r\\n]*)?`,
+    "m"
+  );
+  const m = contents.match(re);
+  if (!m) return null;
+  return { ref: m[1], comment: m[2] ?? "" };
+}
+function pinGap(slug, contents) {
+  const found = usesRefAndComment(contents, slug);
+  if (!found || !DIGEST_RE.test(found.ref)) {
+    return `${slug} is missing or not digest-pinned (needs @<40-hex-sha>) \u2014 this workflow mints a repo-write token, so a mutable tag ref is a supply-chain hole`;
+  }
+  return null;
+}
+var KNOWN_PINNED_ACTIONS = [
+  "renovatebot/github-action",
+  "actions/create-github-app-token",
+  "actions/checkout"
+];
+var APP_AUTH_MARKERS = [
+  "vars.RENOVATE_APP_ID",
+  "secrets.RENOVATE_APP_PRIVATE_KEY",
+  "steps.app-token.outputs.token"
+];
+function renovateActionGaps(contents) {
+  const gaps = [];
+  const withoutComments = stripComments(contents);
+  for (const slug of KNOWN_PINNED_ACTIONS) {
+    const gap = pinGap(slug, withoutComments);
+    if (gap) gaps.push(gap);
+  }
+  for (const m of withoutComments.matchAll(USES_LINE_RE)) {
+    const slug = m[2];
+    const ref = m[3];
+    if (KNOWN_PINNED_ACTIONS.includes(slug)) continue;
+    if (!DIGEST_RE.test(ref)) {
+      gaps.push(
+        `${slug}@${ref} is not digest-pinned (needs @<40-hex-sha>) \u2014 this workflow mints a repo-write token, so every action reference must be digest-pinned`
+      );
+    }
+  }
+  const missingAuth = APP_AUTH_MARKERS.filter((m) => !withoutComments.includes(m));
+  if (missingAuth.length > 0) {
+    gaps.push(
+      `App auth is not fully wired \u2014 missing ${missingAuth.join(", ")} (Renovate authenticates as the reddoor-renovate GitHub App, not an operator PAT)`
+    );
+  }
+  if (withoutComments.includes("RENOVATE_TOKEN")) {
+    gaps.push(
+      "contains RENOVATE_TOKEN \u2014 that is the retired operator-PAT identity the App migration replaced"
+    );
+  }
+  if (!/RENOVATE_USERNAME:\s*["']?reddoor-renovate\[bot\]/.test(withoutComments)) {
+    gaps.push("RENOVATE_USERNAME does not identify reddoor-renovate[bot]");
+  }
+  if (!/RENOVATE_GIT_AUTHOR:\s*["']?reddoor-renovate\[bot\]/.test(withoutComments)) {
+    gaps.push("RENOVATE_GIT_AUTHOR does not identify reddoor-renovate[bot]");
+  }
+  if (!/RENOVATE_REPOSITORIES:\s*["']?\$\{\{\s*github\.repository\s*\}\}["']?/.test(withoutComments)) {
+    gaps.push(
+      "RENOVATE_REPOSITORIES is not scoped to ${{ github.repository }} \u2014 this workflow must only ever touch its own repo"
+    );
+  }
+  if (!/cron:\s*["']?0 \*\/12 \* \* \*["']?/.test(withoutComments)) {
+    gaps.push(
+      `cron is not the twice-daily "0 */12 * * *" schedule \u2014 this cron IS the fleet's merge cadence (platform auto-merge is disabled fleet-wide, so Renovate merges from inside this run)`
+    );
+  }
+  if (!withoutComments.includes("workflow_dispatch")) {
+    gaps.push("missing workflow_dispatch trigger");
+  }
+  const hasPermissionsKey = withoutComments.includes("permissions:");
+  const hasContentsRead = /^[ \t]*contents:\s*["']?read["']?[ \t]*$/m.test(withoutComments);
+  if (!hasPermissionsKey || !hasContentsRead) {
+    gaps.push("permissions: does not grant contents: read");
+  }
+  return gaps;
+}
+function withRenovatePinsFrom(template, current) {
+  if (current === null) return template;
+  const currentWithoutComments = stripComments(current);
+  return template.replace(USES_LINE_RE, (full, prefix, slug) => {
+    const found = usesRefAndComment(currentWithoutComments, slug);
+    if (!found || !DIGEST_RE.test(found.ref)) return full;
+    return `${prefix}uses: ${slug}@${found.ref}${found.comment}`;
+  });
+}
+var RENOVATE_ACTION_CONFIG = "renovate-action";
+
 export {
   ALL_TEMPLATES,
-  templatesByName
+  templatesByName,
+  renovateActionGaps,
+  withRenovatePinsFrom,
+  RENOVATE_ACTION_CONFIG
 };
-//# sourceMappingURL=chunk-73UFRZKY.js.map
+//# sourceMappingURL=chunk-MLT4QY5X.js.map

package/dist/chunk-MLT4QY5X.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/recipes/sync-configs/templates.ts","../src/recipes/sync-configs/renovate-action.ts"],"sourcesContent":["import type { ConfigName } from \"../../types.js\";\n\nexport type ConfigTemplate = {\n  config: ConfigName;\n  path: string;\n  contents: string;\n};\n\nconst eslint: ConfigTemplate = {\n  config: \"eslint\",\n  path: \"eslint.config.js\",\n  contents: `import { createEslintConfig } from \"@reddoorla/maintenance/configs/eslint\";\nimport svelteConfig from \"./svelte.config.js\";\n\nexport default createEslintConfig({ svelteConfig });\n`,\n};\n\nconst prettier: ConfigTemplate = {\n  config: \"prettier\",\n  path: \".prettierrc.json\",\n  contents: `{\n  \"trailingComma\": \"all\",\n  \"singleQuote\": false,\n  \"printWidth\": 100,\n  \"plugins\": [\"prettier-plugin-svelte\"]\n}\n`,\n};\n\nconst prettierIgnore: ConfigTemplate = {\n  config: \"prettier-ignore\",\n  path: \".prettierignore\",\n  contents: `pnpm-lock.yaml\n.svelte-kit/\nbuild/\n.netlify/\ndist/\n`,\n};\n\nconst lighthouse: ConfigTemplate = {\n  config: \"lighthouse\",\n  path: \"lighthouserc.json\",\n  contents: `${JSON.stringify(\n    {\n      $note:\n        \"Generated by @reddoorla/maintenance sync-configs; edit src/configs/lighthouse.ts in the package instead.\",\n      extends: \"@reddoorla/maintenance/configs/lighthouse\",\n    },\n    null,\n    2,\n  )}\n`,\n};\n\nconst playwrightA11y: ConfigTemplate = {\n  config: \"playwright-a11y\",\n  path: \"playwright.config.ts\",\n  contents: `export { default } from \"@reddoorla/maintenance/configs/playwright-a11y\";\n`,\n};\n\nconst svelte: ConfigTemplate = {\n  config: \"svelte\",\n  path: \"svelte.config.js\",\n  contents: `import { createSvelteConfig } from \"@reddoorla/maintenance/configs/svelte\";\nimport adapter from \"@sveltejs/adapter-netlify\";\n\n/** @type {import('@sveltejs/kit').Config} */\nexport default createSvelteConfig({\n  kit: { adapter: adapter({ edge: false, split: false }) },\n});\n`,\n};\n\n// There is deliberately NO ci.yml template. Every live fleet ci.yml carries\n// per-site values a static template cannot own (`netlify-site:`, plus\n// `permissions:` and `node-version:` inputs) — an exact-match heal against a\n// canonical byte template would strip them fleet-wide in green auto-mergeable\n// PRs (the \"armed clobber\" the 2026-08-02 architecture review flagged; it was\n// this file's `ci` entry). Ownership is split instead: the STARTER clone\n// provides each site's ci.yml shape at bootstrap, and Renovate's\n// github-actions manager bumps the pinned reusable-workflow ref per repo when\n// reddoorla/.github tags a new version. The caller job name `ci` + the\n// reusable workflow's job `ci` produce the check context \"ci / ci\" —\n// REQUIRED_CHECK in src/recipes/self-updating/index.ts depends on that naming.\n\nconst renovateAction: ConfigTemplate = {\n  config: \"renovate-action\",\n  path: \".github/workflows/renovate.yml\",\n  contents: `name: renovate\non:\n  schedule:\n    # Twice daily. GitHub's platform auto-merge is disabled fleet-wide, so Renovate\n    # performs its own merges from inside this run — which means this cron is the\n    # MERGE cadence, not just the PR-creation cadence.\n    - cron: 0 */12 * * *\n  workflow_dispatch:\npermissions:\n  contents: read\njobs:\n  renovate:\n    runs-on: ubuntu-latest\n    steps:\n      # Renovate authenticates as the reddoor-renovate GitHub App (installed\n      # org-wide, \"All repositories\" — future repos are auto-covered), NOT as an\n      # operator PAT. Why: the App is a distinct identity, so the audit trail\n      # finally distinguishes bot from human (the 2026-07-26 unreviewed-major\n      # forensics took hours precisely because it couldn't); the credential is\n      # permission-scoped and centrally revocable instead of a fleet-write PAT;\n      # and the installation gets its own API-quota pool instead of sharing the\n      # operator's. The minted token is scoped to THIS repository only\n      # (create-github-app-token's default when owner/repositories are omitted).\n      # RENOVATE_APP_ID / RENOVATE_APP_PRIVATE_KEY are org-level (all-repos\n      # visibility) — nothing to configure per repo.\n      # Digest-pinned: this workflow mints a repo-write token, so a mutable tag\n      # ref here is a supply-chain hole — a retagged \\`@v3\\`/\\`@v46\\` would run\n      # attacker code with that token. Pin to the commit; Renovate bumps these.\n      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0\n        id: app-token\n        with:\n          app-id: \\${{ vars.RENOVATE_APP_ID }}\n          private-key: \\${{ secrets.RENOVATE_APP_PRIVATE_KEY }}\n      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7\n      - uses: renovatebot/github-action@1a96852b0384df1837619d04c60b2d10d1f9ff08 # v46.1.21\n        with:\n          token: \\${{ steps.app-token.outputs.token }}\n        env:\n          RENOVATE_REPOSITORIES: \\${{ github.repository }}\n          # Commit/PR identity = the App's bot user, so gitAuthor matches the\n          # token identity (mismatched authors read as \"operator pushed this\").\n          # 312185038 = the bot's user id (gh api 'users/reddoor-renovate[bot]' --jq .id).\n          RENOVATE_USERNAME: reddoor-renovate[bot]\n          RENOVATE_GIT_AUTHOR: reddoor-renovate[bot] <312185038+reddoor-renovate[bot]@users.noreply.github.com>\n`,\n};\n\nconst renovateConfig: ConfigTemplate = {\n  config: \"renovate-config\",\n  path: \"renovate.json\",\n  contents: `{\n  \"$schema\": \"https://docs.renovatebot.com/renovate-schema.json\",\n  \"extends\": [\"github>reddoorla/.github:renovate-config\"]\n}\n`,\n};\n\nconst netlify: ConfigTemplate = {\n  config: \"netlify\",\n  path: \"netlify.toml\",\n  contents: `[build]\n    command = \"pnpm build\"\n    publish = \"build/\"\n    functions = \"functions/\"\n\n[build.environment]\n    NODE_VERSION = \"22\"\n    COREPACK_INTEGRITY_KEYS = \"0\"\n\n# Baseline security headers for all responses. CSP is emitted per-response by\n# SvelteKit (see \\`kit.csp\\` in svelte.config.js) so it is intentionally omitted\n# here to avoid conflicting duplicates.\n[[headers]]\n    for = \"/*\"\n    [headers.values]\n        Strict-Transport-Security = \"max-age=63072000; includeSubDomains; preload\"\n        X-Content-Type-Options = \"nosniff\"\n        X-Frame-Options = \"SAMEORIGIN\"\n        Referrer-Policy = \"strict-origin-when-cross-origin\"\n        Permissions-Policy = \"camera=(), microphone=(), geolocation=(), interest-cohort=()\"\n        Cross-Origin-Opener-Policy = \"same-origin\"\n\n[[headers]]\n    for = \"/favicon.png\"\n    [headers.values]\n        Cache-Control = \"public, max-age=31536000, immutable\"\n\n[[headers]]\n    for = \"/_app/immutable/*\"\n    [headers.values]\n        Cache-Control = \"public, max-age=31536000, immutable\"\n`,\n};\n\nexport const ALL_TEMPLATES: ConfigTemplate[] = [\n  eslint,\n  prettier,\n  prettierIgnore,\n  lighthouse,\n  playwrightA11y,\n  svelte,\n  renovateAction,\n  renovateConfig,\n  netlify,\n];\n\nexport function templatesByName(which: ConfigName[]): ConfigTemplate[] {\n  return ALL_TEMPLATES.filter((t) => which.includes(t.config));\n}\n","import type { ConfigName } from \"../../types.js\";\n\n/**\n * `.github/workflows/renovate.yml` (the `renovate-action` template) is\n * compliance-checked, not byte-matched, for the same reason `svelte.config.js`\n * and `netlify.toml` already are (see `isSvelteConfigCompliant` /\n * `isNetlifyConfigCompliant` in `sync-configs.ts`): an exact overwrite is the\n * wrong operation whenever a file legitimately diverges from the template\n * without being wrong. For renovate.yml there are TWO such legitimate\n * divergences, both observed live on 2026-08-31 (issue #651):\n *\n * 1. Renovate bumps its own digest pins. The template pins\n *    `renovatebot/github-action@1a96852b...` (# v46.1.21); a site Renovate\n *    maintains moves that pin forward on its own (reddoor-starter was already\n *    at `@e09d604f...` / v46.2.2). A byte-match recipe reads that as drift and\n *    opens a PR that DOWNGRADES the pin — reverting Renovate's own\n *    supply-chain update, the exact thing the template's own comment says\n *    Renovate is supposed to do. Observed live: it opened\n *    `reddoorla/reddoor-starter-blux#1`, closed unmerged.\n * 2. YAML scalar quoting. The template writes an unquoted twice-daily cron and\n *    `RENOVATE_USERNAME: reddoor-renovate[bot]` unquoted; a site's prettier\n *    may render both quoted instead. Both forms are prettier-clean (verified\n *    against the repo's own prettier), so prettier never normalizes one\n *    toward the other — once a site's copy diverges in quoting, a byte-match\n *    recipe reports drift FOREVER.\n *\n * The fix, following the svelte.config/netlify.toml precedent exactly: stop\n * asking \"is this file byte-identical to the template?\" and ask \"does it\n * still satisfy the invariants we actually own?\". `renovateActionGaps`\n * returns that — a `string[]` of human-readable gaps, empty meaning\n * compliant and left alone, the same shape as `rulesetGaps` (src/github/rulesets.ts)\n * and `renovateGaps` (src/audits/protection-coverage.ts).\n *\n * When a file genuinely IS non-compliant (e.g. its cron changed) the recipe\n * heals it by writing the template — but writing the template verbatim would\n * itself re-introduce the downgrade bug above, overwriting the site's newer\n * digest pins with the template's older ones. `withRenovatePinsFrom` carries\n * the site's own (still-digest-pinned) refs forward onto the template before\n * it is written — see that function's own doc comment for exactly what\n * guarantee this is (and, as importantly, isn't).\n *\n * Every check below runs against a COMMENT-STRIPPED copy of the file (see\n * `stripComments`). A raw-text `.match()`/`.includes()` takes the FIRST hit\n * anywhere in the file, comments included — a canonical pin, cron, or job\n * body sitting in a `#` comment above the real (non-compliant) line reads as\n * compliant, and worse, `withRenovatePinsFrom` would scrape a sha out of a\n * comment like `# old: uses: actions/checkout@1111…1111 # v4` and carry a\n * *commented* pin forward into the healed file — a pin downgrade delivered by\n * the very recipe that exists to prevent pin downgrades.\n */\n\nconst DIGEST_RE = /^[0-9a-f]{40}$/;\n\nfunction escapeRegExp(s: string): string {\n  return s.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n}\n\n/**\n * Strip full-line `#` comments before any compliance check or ref extraction\n * runs, so a canonical-looking line that exists only in a comment can never\n * read as the real thing.\n *\n * Full-line only: a trailing `# vX.Y.Z` after a real `uses:` line is\n * meaningful (it's the human-readable version tag) and must survive — only\n * strip a line whose first non-whitespace character is `#`. This is safe\n * specifically because this workflow's YAML has no block scalars (`|`/`>`),\n * so there is no line in a compliant or non-compliant renovate.yml where a\n * leading `#` is literal string content rather than a comment.\n */\nfunction stripComments(contents: string): string {\n  return contents.replace(/^[ \\t]*#[^\\n]*$/gm, \"\");\n}\n\n/** A `uses:` line, anchored to the start of a line (allowing only leading\n *  indentation and an optional `- ` list marker before `uses:`) so a match\n *  can only ever land on a real step, never on prose inside a comment that\n *  happens to contain the word `uses:`. Always run against comment-stripped\n *  text (see `stripComments`) — the anchor alone does not exclude comments,\n *  since a full-line comment's content can itself start with `- uses:` at\n *  matching indentation. */\nconst USES_LINE_RE = /^([ \\t]*(?:- )?)uses:\\s*([\\w.-]+\\/[\\w.-]+)@(\\S+)(?:[ \\t]*#[^\\r\\n]*)?/gm;\n\n/** The ref (and trailing `# vX.Y.Z` comment, if any) a `uses: <slug>@<ref>`\n *  line carries in `contents`, or null if that action isn't referenced.\n *  Callers must pass comment-stripped text — see `stripComments`. */\nfunction usesRefAndComment(\n  contents: string,\n  slug: string,\n): { ref: string; comment: string } | null {\n  const re = new RegExp(\n    `^[ \\\\t]*(?:- )?uses:\\\\s*${escapeRegExp(slug)}@(\\\\S+)([ \\\\t]*#[^\\\\r\\\\n]*)?`,\n    \"m\",\n  );\n  const m = contents.match(re);\n  if (!m) return null;\n  return { ref: m[1]!, comment: m[2] ?? \"\" };\n}\n\n/** Gap text for one `uses:` action that must be present AND digest-pinned.\n *  This workflow mints a repo-write token (the App-token step), so a mutable\n *  tag ref on ANY step here is a supply-chain hole — a retagged `@v3`/`@v46`\n *  would run attacker code with that token. (The three actions checked here\n *  are the ones this workflow ships with by default; `renovateActionGaps`\n *  separately widens this to ANY `uses:` line, so an action added later is\n *  covered too.) `contents` must already be comment-stripped. */\nfunction pinGap(slug: string, contents: string): string | null {\n  const found = usesRefAndComment(contents, slug);\n  if (!found || !DIGEST_RE.test(found.ref)) {\n    return `${slug} is missing or not digest-pinned (needs @<40-hex-sha>) — this workflow mints a repo-write token, so a mutable tag ref is a supply-chain hole`;\n  }\n  return null;\n}\n\n/** The three actions this workflow ships with by default and always requires,\n *  present and digest-pinned. Checked individually (via `pinGap`, above) so a\n *  gap can say which one of the three is the problem; the widen loop in\n *  `renovateActionGaps` then covers every OTHER `uses:` line so a step added\n *  later can't slip in on a mutable ref unnoticed. */\nconst KNOWN_PINNED_ACTIONS = [\n  \"renovatebot/github-action\",\n  \"actions/create-github-app-token\",\n  \"actions/checkout\",\n];\n\nconst APP_AUTH_MARKERS = [\n  \"vars.RENOVATE_APP_ID\",\n  \"secrets.RENOVATE_APP_PRIVATE_KEY\",\n  \"steps.app-token.outputs.token\",\n];\n\n/** Gaps in a site's `.github/workflows/renovate.yml`. Empty = compliant,\n *  leave it alone — see the module doc comment above for why this is\n *  compliance-checked rather than byte-matched. */\nexport function renovateActionGaps(contents: string): string[] {\n  const gaps: string[] = [];\n  const withoutComments = stripComments(contents);\n\n  for (const slug of KNOWN_PINNED_ACTIONS) {\n    const gap = pinGap(slug, withoutComments);\n    if (gap) gaps.push(gap);\n  }\n\n  // Widen the pin check to every OTHER `uses:` line in the file — the doc\n  // comment on `pinGap` says a mutable ref on ANY step is a supply-chain\n  // hole; without this, a step added later (e.g. `pnpm/action-setup@v4`)\n  // would pass clean just because it isn't one of the three known actions.\n  // A local `uses: ./.github/actions/foo` path ref never matches — the regex\n  // requires a literal `@<ref>`, which a bare path reference doesn't have.\n  for (const m of withoutComments.matchAll(USES_LINE_RE)) {\n    const slug = m[2]!;\n    const ref = m[3]!;\n    if (KNOWN_PINNED_ACTIONS.includes(slug)) continue; // already covered above\n    if (!DIGEST_RE.test(ref)) {\n      gaps.push(\n        `${slug}@${ref} is not digest-pinned (needs @<40-hex-sha>) — this workflow mints a repo-write token, so every action reference must be digest-pinned`,\n      );\n    }\n  }\n\n  const missingAuth = APP_AUTH_MARKERS.filter((m) => !withoutComments.includes(m));\n  if (missingAuth.length > 0) {\n    gaps.push(\n      `App auth is not fully wired — missing ${missingAuth.join(\", \")} (Renovate authenticates as the reddoor-renovate GitHub App, not an operator PAT)`,\n    );\n  }\n\n  if (withoutComments.includes(\"RENOVATE_TOKEN\")) {\n    gaps.push(\n      \"contains RENOVATE_TOKEN — that is the retired operator-PAT identity the App migration replaced\",\n    );\n  }\n\n  // Checked (and reported) as two independent gaps, not one folded string, so\n  // a caller can tell which field actually failed.\n  if (!/RENOVATE_USERNAME:\\s*[\"']?reddoor-renovate\\[bot\\]/.test(withoutComments)) {\n    gaps.push(\"RENOVATE_USERNAME does not identify reddoor-renovate[bot]\");\n  }\n  if (!/RENOVATE_GIT_AUTHOR:\\s*[\"']?reddoor-renovate\\[bot\\]/.test(withoutComments)) {\n    gaps.push(\"RENOVATE_GIT_AUTHOR does not identify reddoor-renovate[bot]\");\n  }\n\n  if (\n    !/RENOVATE_REPOSITORIES:\\s*[\"']?\\$\\{\\{\\s*github\\.repository\\s*\\}\\}[\"']?/.test(withoutComments)\n  ) {\n    gaps.push(\n      \"RENOVATE_REPOSITORIES is not scoped to ${{ github.repository }} — this workflow must only ever touch its own repo\",\n    );\n  }\n\n  if (!/cron:\\s*[\"']?0 \\*\\/12 \\* \\* \\*[\"']?/.test(withoutComments)) {\n    gaps.push(\n      'cron is not the twice-daily \"0 */12 * * *\" schedule — this cron IS the fleet\\'s merge cadence (platform auto-merge is disabled fleet-wide, so Renovate merges from inside this run)',\n    );\n  }\n\n  if (!withoutComments.includes(\"workflow_dispatch\")) {\n    gaps.push(\"missing workflow_dispatch trigger\");\n  }\n\n  // A `permissions:` key is present somewhere AND a `contents: read` line\n  // (optionally quoted) exists somewhere — not anchored to top-level-first-key,\n  // since this predicate doesn't actually need to assert that shape (a\n  // job-level permissions block satisfies the same invariant), and requiring\n  // `contents: read` to be the first entry under `permissions:` false-positived\n  // on both quoting (`contents: \"read\"`) and ordering (`contents: read` listed\n  // after another key, e.g. `pull-requests: write`).\n  const hasPermissionsKey = withoutComments.includes(\"permissions:\");\n  const hasContentsRead = /^[ \\t]*contents:\\s*[\"']?read[\"']?[ \\t]*$/m.test(withoutComments);\n  if (!hasPermissionsKey || !hasContentsRead) {\n    gaps.push(\"permissions: does not grant contents: read\");\n  }\n\n  return gaps;\n}\n\n/**\n * The canonical template with each action's `uses:` ref replaced by the ref\n * the site already has, when the site's is digest-pinned.\n *\n * Why: when a file IS genuinely non-compliant (say its cron changed) the\n * recipe heals it by writing the template — and writing the template verbatim\n * would put the template's OLDER pins over the site's newer ones, re-\n * introducing the downgrade this fix removes. So carry the site's pins\n * forward onto the (otherwise-canonical) healed file.\n *\n * This is PIN-NEUTRAL, not downgrade-avoiding: it substitutes the site's ref\n * whenever it is 40 hex characters, with no notion of \"newer\" — digests are\n * unorderable, so there is no way to tell from the strings alone. It never\n * changes a digest-pinned ref in either direction; some fleet sites carry a\n * pin OLDER than the template's and will heal onto their own older pin\n * (defensible — Renovate re-advances it on its own), so \"pin-neutral\" is the\n * accurate description, not \"downgrade-avoiding\".\n *\n * `current === null` (no existing file) returns the template unchanged — there\n * is nothing to carry forward. A non-digest ref on the site (a mutable tag) is\n * never substituted in, since that would carry the mutable-ref hole forward\n * instead of healing it. Likewise, a ref that appears only inside a `#`\n * comment in `current` is never carried forward (see `stripComments`) — a\n * commented sha must never be scraped and pinned into the healed file.\n */\nexport function withRenovatePinsFrom(template: string, current: string | null): string {\n  if (current === null) return template;\n  const currentWithoutComments = stripComments(current);\n  return template.replace(USES_LINE_RE, (full, prefix: string, slug: string) => {\n    const found = usesRefAndComment(currentWithoutComments, slug);\n    if (!found || !DIGEST_RE.test(found.ref)) return full;\n    return `${prefix}uses: ${slug}@${found.ref}${found.comment}`;\n  });\n}\n\n/** The `ConfigName` for `.github/workflows/renovate.yml`. Exported once here\n *  (rather than re-declared as a local constant in both `sync-configs.ts` and\n *  `self-updating/index.ts`) so the two call sites can't drift apart. */\nexport const RENOVATE_ACTION_CONFIG: ConfigName = \"renovate-action\";\n"],"mappings":";AAQA,IAAM,SAAyB;AAAA,EAC7B,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,UAAU;AAAA;AAAA;AAAA;AAAA;AAKZ;AAEA,IAAM,WAA2B;AAAA,EAC/B,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAOZ;AAEA,IAAM,iBAAiC;AAAA,EACrC,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAMZ;AAEA,IAAM,aAA6B;AAAA,EACjC,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,UAAU,GAAG,KAAK;AAAA,IAChB;AAAA,MACE,OACE;AAAA,MACF,SAAS;AAAA,IACX;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAAA;AAEH;AAEA,IAAM,iBAAiC;AAAA,EACrC,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,UAAU;AAAA;AAEZ;AAEA,IAAM,SAAyB;AAAA,EAC7B,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQZ;AAcA,IAAM,iBAAiC;AAAA,EACrC,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA6CZ;AAEA,IAAM,iBAAiC;AAAA,EACrC,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,UAAU;AAAA;AAAA;AAAA;AAAA;AAKZ;AAEA,IAAM,UAA0B;AAAA,EAC9B,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAgCZ;AAEO,IAAM,gBAAkC;AAAA,EAC7C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,SAAS,gBAAgB,OAAuC;AACrE,SAAO,cAAc,OAAO,CAAC,MAAM,MAAM,SAAS,EAAE,MAAM,CAAC;AAC7D;;;ACpJA,IAAM,YAAY;AAElB,SAAS,aAAa,GAAmB;AACvC,SAAO,EAAE,QAAQ,uBAAuB,MAAM;AAChD;AAcA,SAAS,cAAc,UAA0B;AAC/C,SAAO,SAAS,QAAQ,qBAAqB,EAAE;AACjD;AASA,IAAM,eAAe;AAKrB,SAAS,kBACP,UACA,MACyC;AACzC,QAAM,KAAK,IAAI;AAAA,IACb,2BAA2B,aAAa,IAAI,CAAC;AAAA,IAC7C;AAAA,EACF;AACA,QAAM,IAAI,SAAS,MAAM,EAAE;AAC3B,MAAI,CAAC,EAAG,QAAO;AACf,SAAO,EAAE,KAAK,EAAE,CAAC,GAAI,SAAS,EAAE,CAAC,KAAK,GAAG;AAC3C;AASA,SAAS,OAAO,MAAc,UAAiC;AAC7D,QAAM,QAAQ,kBAAkB,UAAU,IAAI;AAC9C,MAAI,CAAC,SAAS,CAAC,UAAU,KAAK,MAAM,GAAG,GAAG;AACxC,WAAO,GAAG,IAAI;AAAA,EAChB;AACA,SAAO;AACT;AAOA,IAAM,uBAAuB;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,mBAAmB;AAAA,EACvB;AAAA,EACA;AAAA,EACA;AACF;AAKO,SAAS,mBAAmB,UAA4B;AAC7D,QAAM,OAAiB,CAAC;AACxB,QAAM,kBAAkB,cAAc,QAAQ;AAE9C,aAAW,QAAQ,sBAAsB;AACvC,UAAM,MAAM,OAAO,MAAM,eAAe;AACxC,QAAI,IAAK,MAAK,KAAK,GAAG;AAAA,EACxB;AAQA,aAAW,KAAK,gBAAgB,SAAS,YAAY,GAAG;AACtD,UAAM,OAAO,EAAE,CAAC;AAChB,UAAM,MAAM,EAAE,CAAC;AACf,QAAI,qBAAqB,SAAS,IAAI,EAAG;AACzC,QAAI,CAAC,UAAU,KAAK,GAAG,GAAG;AACxB,WAAK;AAAA,QACH,GAAG,IAAI,IAAI,GAAG;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AAEA,QAAM,cAAc,iBAAiB,OAAO,CAAC,MAAM,CAAC,gBAAgB,SAAS,CAAC,CAAC;AAC/E,MAAI,YAAY,SAAS,GAAG;AAC1B,SAAK;AAAA,MACH,8CAAyC,YAAY,KAAK,IAAI,CAAC;AAAA,IACjE;AAAA,EACF;AAEA,MAAI,gBAAgB,SAAS,gBAAgB,GAAG;AAC9C,SAAK;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAIA,MAAI,CAAC,oDAAoD,KAAK,eAAe,GAAG;AAC9E,SAAK,KAAK,2DAA2D;AAAA,EACvE;AACA,MAAI,CAAC,sDAAsD,KAAK,eAAe,GAAG;AAChF,SAAK,KAAK,6DAA6D;AAAA,EACzE;AAEA,MACE,CAAC,wEAAwE,KAAK,eAAe,GAC7F;AACA,SAAK;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,sCAAsC,KAAK,eAAe,GAAG;AAChE,SAAK;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,gBAAgB,SAAS,mBAAmB,GAAG;AAClD,SAAK,KAAK,mCAAmC;AAAA,EAC/C;AASA,QAAM,oBAAoB,gBAAgB,SAAS,cAAc;AACjE,QAAM,kBAAkB,4CAA4C,KAAK,eAAe;AACxF,MAAI,CAAC,qBAAqB,CAAC,iBAAiB;AAC1C,SAAK,KAAK,4CAA4C;AAAA,EACxD;AAEA,SAAO;AACT;AA2BO,SAAS,qBAAqB,UAAkB,SAAgC;AACrF,MAAI,YAAY,KAAM,QAAO;AAC7B,QAAM,yBAAyB,cAAc,OAAO;AACpD,SAAO,SAAS,QAAQ,cAAc,CAAC,MAAM,QAAgB,SAAiB;AAC5E,UAAM,QAAQ,kBAAkB,wBAAwB,IAAI;AAC5D,QAAI,CAAC,SAAS,CAAC,UAAU,KAAK,MAAM,GAAG,EAAG,QAAO;AACjD,WAAO,GAAG,MAAM,SAAS,IAAI,IAAI,MAAM,GAAG,GAAG,MAAM,OAAO;AAAA,EAC5D,CAAC;AACH;AAKO,IAAM,yBAAqC;","names":[]}

package/dist/cli/bin.js

@@ -111,7 +111,7 @@ cli.command("sync-configs [site]", "Sync canonical configs into a site.").option
   'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../sync-configs-LVBITPLU.js")).runSyncConfigsCommand(site, opts),
+    async () => (await import("../sync-configs-ZYLTMUNX.js")).runSyncConfigsCommand(site, opts),
     opts
   )
 );
@@ -129,7 +129,7 @@ cli.command(
   "Bootstrap a repo to keep itself updated (Renovate + protection; platform auto-merge off; ci.yml is the starter's, not managed here)."
 ).option("--dry", "List what would be enabled without writing or opening PRs").option("--fleet <inventory>", 'Inventory file (.json or .mjs/.js), or "airtable"').option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../self-updating-NTCCWJYZ.js")).runSelfUpdatingCommand(site, opts),
+    async () => (await import("../self-updating-VQIW24RZ.js")).runSelfUpdatingCommand(site, opts),
     opts
   )
 );
@@ -138,7 +138,7 @@ cli.command(
   "Add the Prismic model delivery workflow to a site via PR (one PR per repo; never pushes to main)."
 ).option("--dry", "List the sites that would be offered the workflow, without opening any PR").option("--fleet <inventory>", 'Inventory file (.json or .mjs/.js), or "airtable"').option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../prismic-ci-PZ5LCPWT.js")).runPrismicCiCommand(site, opts),
+    async () => (await import("../prismic-ci-6YGRIOHT.js")).runPrismicCiCommand(site, opts),
     opts
   )
 );
@@ -153,7 +153,7 @@ cli.command(
   "Write the report to this file (the CI workflow posts it as a PR comment)"
 ).action(
   async (site, opts) => runOrExit(
-    async () => (await import("../prismic-models-6OYYZUR5.js")).runPrismicModelsCommand(site, opts),
+    async () => (await import("../prismic-models-VNGIKS2B.js")).runPrismicModelsCommand(site, opts),
     opts
   )
 );
@@ -230,14 +230,14 @@ cli.command(
   "--fleet <inventory>",
   'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
-  async (site, opts) => runOrExit(async () => (await import("../init-NHKADHB6.js")).runInitCommand(site, opts), opts)
+  async (site, opts) => runOrExit(async () => (await import("../init-S4MJ3Y6W.js")).runInitCommand(site, opts), opts)
 );
 cli.command(
   "launch <site>",
   "Bootstrap + first-audit a site, then draft its launch email for approval."
 ).action(
   async (site, opts) => runOrExit(
-    async () => (await import("../launch-VQJ4Z35C.js")).runLaunchCommand(site, opts),
+    async () => (await import("../launch-7FT4EYEO.js")).runLaunchCommand(site, opts),
     opts
   )
 );
@@ -252,7 +252,7 @@ cli.command(
   "Draft the monthly-report announcement email for maintenance sites (all, or one) for approval."
 ).action(
   async (site, opts) => runOrExit(
-    async () => (await import("../announce-OJFAS5JT.js")).runAnnounceCommand(site, opts),
+    async () => (await import("../announce-NDTLRQCN.js")).runAnnounceCommand(site, opts),
     opts
   )
 );
@@ -261,7 +261,7 @@ cli.command(
   "Show who a form submission would email, and optionally flip the pre-launch guard (read-back confirmed)."
 ).option("--set <on|off>", "Flip the guard: on = route to operator, off = restore.").option("--restore <status>", "Status to restore with --set off. Required; never inferred.").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../forms-notify-target-LYSKME5L.js")).runFormsNotifyTargetCommand(
+    async () => (await import("../forms-notify-target-IHJX7NWA.js")).runFormsNotifyTargetCommand(
       site,
       opts
     ),
@@ -291,7 +291,7 @@ cli.command(
 );
 cli.command("ensure-site <slug>", "Create/verify the Airtable Websites row for a new site.").option("--name <display name>", "Human Name for the row (client-facing copy uses it verbatim).").option("--url <url>", "Deployed URL (e.g. the Netlify site URL).").option("--contact <email>", "point of contact \u2014 the client address reports resolve to.").option("--git-repo <owner/repo>", "GitHub identity. Default on create: reddoorla/<slug>.").action(
   async (slug, opts) => runOrExit(
-    async () => (await import("../ensure-site-NSNY2QHN.js")).runEnsureSiteCommand(slug, opts),
+    async () => (await import("../ensure-site-FFDUMY6E.js")).runEnsureSiteCommand(slug, opts),
     opts
   )
 );
@@ -309,7 +309,7 @@ cli.command(
   "Email the internal sheet (scores, what wasn't measured, top fixes, the link) to PROSPECT_AUDIT_RECIPIENTS."
 ).action(
   async (url, opts) => runOrExit(
-    async () => (await import("../prospect-audit-DBBXL7EG.js")).runProspectAuditCommand(url, opts),
+    async () => (await import("../prospect-audit-JCWTKJTS.js")).runProspectAuditCommand(url, opts),
     opts
   )
 );
@@ -330,7 +330,7 @@ cli.command("report [site]", "Draft or send maintenance/testing reports.").optio
   "Regenerate one UNSENT report's stored HTML from its current row, so the console preview shows edited commentary. Refuses a sent report."
 ).action(
   async (site, opts) => runOrExit(
-    async () => (await import("../report-2N4PXO3L.js")).runReportCommand(site, opts),
+    async () => (await import("../report-AAY2HZZR.js")).runReportCommand(site, opts),
     opts
   )
 );
@@ -339,7 +339,7 @@ cli.command(
   "Sweep the fleet for GitHub signals (Renovate-failing/CI/last-commit) and write Airtable."
 ).option("--fleet", "Run across every site in the Airtable inventory.").option("--write-airtable", "Write each site's signals back to its Websites row.").action(
   async (opts) => runOrExit(
-    async () => (await import("../github-signals-4YML6NY5.js")).runGitHubSignalsCommand({
+    async () => (await import("../github-signals-FCLNHKMF.js")).runGitHubSignalsCommand({
       fleet: opts.fleet,
       writeAirtable: opts.writeAirtable
     }),
@@ -370,7 +370,7 @@ cli.command(
   "--force",
   "import-airtable / sync: run despite the freeze (#643) \u2014 a deliberate rollback-window converge from the frozen Airtable shadow. Without it both refuse while Turso is authoritative, because an import overwrites authoritative rows."
 ).action(
-  async (action, opts) => runOrExit(async () => (await import("../db-DAJX7NNW.js")).runDbCommand(action, opts), opts)
+  async (action, opts) => runOrExit(async () => (await import("../db-LOSJ74ZJ.js")).runDbCommand(action, opts), opts)
 );
 cli.command(
   "submissions <action>",
@@ -380,7 +380,7 @@ cli.command(
   "Write the re-buckets: status \u2192 spam_auto, spam_score/spam_reason replaced with the new verdict + 'retro-rescore' marker."
 ).action(
   async (action, opts) => runOrExit(
-    async () => (await import("../submissions-TEHPBSZJ.js")).runSubmissionsCommand(action, opts),
+    async () => (await import("../submissions-7LGJJSDL.js")).runSubmissionsCommand(action, opts),
     opts
   )
 );
@@ -392,7 +392,7 @@ cli.command(
     async () => (await import("../renovate-dispatch-6GQWTRKX.js")).runRenovateDispatchCommand({
       fleet: opts.fleet,
       // #539 Phase 5: mirror the auto-fix counter into site_health.
-      siteMirror: await (await import("../site-mirror-RQTEAID5.js")).makeSiteMirror()
+      siteMirror: await (await import("../site-mirror-GCFLBBWK.js")).makeSiteMirror()
     }),
     opts
   )
@@ -417,7 +417,7 @@ cli.command(
   "freeze: JSON declaring slots the template has no token for (video poster, a panel rebuilt from a baked image). Keys must start with 'x.'"
 ).action(
   async (action, dir, opts) => runOrExit(
-    async () => (await import("../blux-EATHOHKK.js")).runBluxCommand(action, dir, opts),
+    async () => (await import("../blux-YGBGS24U.js")).runBluxCommand(action, dir, opts),
     opts
   )
 );

package/dist/cli/commands/audit.js

@@ -12,7 +12,7 @@ import {
 import {
   ALL_AUDIT_NAMES,
   runOneAudit
-} from "../../chunk-AEXJDCJN.js";
+} from "../../chunk-DFLN2KO3.js";
 import "../../chunk-LKGVSM2O.js";
 import "../../chunk-GASBX52O.js";
 import "../../chunk-XHHMM5HX.js";
@@ -20,16 +20,16 @@ import "../../chunk-Z3JXLULD.js";
 import {
   recordFleetEventsBestEffort
 } from "../../chunk-W45FZEGE.js";
+import "../../chunk-WS6NU475.js";
+import "../../chunk-UDRHAQT7.js";
 import {
   isHttpUrl
 } from "../../chunk-RARREDQE.js";
-import "../../chunk-WS6NU475.js";
 import "../../chunk-MFHS7IQ2.js";
 import "../../chunk-A3WDWNN5.js";
 import "../../chunk-2OP4JKIQ.js";
 import "../../chunk-XTK5VIQB.js";
 import "../../chunk-2NQUCS7O.js";
-import "../../chunk-UDRHAQT7.js";
 import "../../chunk-PTDMVGKL.js";
 import "../../chunk-LBYOLBW7.js";
 import "../../chunk-XXTZBPUY.js";
@@ -267,7 +267,7 @@ ${wb.summary}`;
               task.output = "writing scores\u2026";
               writeSummary = await writeAuditsToAirtable({ base, websites, slug, results });
               if (writeSummary.siteId && writeSummary.fields) {
-                const { makeSiteMirror } = await import("../../site-mirror-RQTEAID5.js");
+                const { makeSiteMirror } = await import("../../site-mirror-GCFLBBWK.js");
                 await (await makeSiteMirror()).health(writeSummary.siteId, writeSummary.fields);
               }
               task.title = `Wrote to Websites[${writeSummary.siteName}] (${writeSummary.writes.length} audit type${writeSummary.writes.length === 1 ? "" : "s"})`;
@@ -304,7 +304,7 @@ async function runFleetWriteBack(args) {
   const { listWebsites } = await import("../../websites-D6WYFAES.js");
   const websites = await listWebsites(base);
   const makeMirror = deps.makeMirror ?? (async () => {
-    const { makeHealthMirrorBestEffort } = await import("../../health-mirror-7LKC7Q5Z.js");
+    const { makeHealthMirrorBestEffort } = await import("../../health-mirror-GMSF3Z5R.js");
     return makeHealthMirrorBestEffort();
   });
   const mirror = await makeMirror();

package/dist/{db-DAJX7NNW.js → db-LOSJ74ZJ.js}

@@ -350,4 +350,4 @@ export {
   freezeGuardsDbWrite,
   runDbCommand
 };
-//# sourceMappingURL=db-DAJX7NNW.js.map
+//# sourceMappingURL=db-LOSJ74ZJ.js.map

package/dist/{digest-T6TAZNLF.js → digest-CS6KLCZB.js}

@@ -23,11 +23,11 @@ import {
   isPendingApproval,
   listAllReports
 } from "./chunk-F3JWOPTG.js";
+import "./chunk-VAD43MOR.js";
 import {
   diffAttention,
   writeDigestState
 } from "./chunk-BRYXFH77.js";
-import "./chunk-VAD43MOR.js";
 import "./chunk-IY6256GK.js";
 import {
   openBase,
@@ -48,8 +48,8 @@ import {
   defaultResendClient
 } from "./chunk-WEKL2HYJ.js";
 import "./chunk-W45FZEGE.js";
-import "./chunk-RARREDQE.js";
 import "./chunk-WS6NU475.js";
+import "./chunk-RARREDQE.js";
 import "./chunk-MFHS7IQ2.js";
 import "./chunk-6VAL7XJT.js";
 
@@ -424,4 +424,4 @@ export {
   renderDigestHtml,
   runDigest
 };
-//# sourceMappingURL=digest-T6TAZNLF.js.map
+//# sourceMappingURL=digest-CS6KLCZB.js.map

package/dist/digest-collectors-NI2M3UTC.js

@@ -28,8 +28,8 @@ import "./chunk-BGTYPVLT.js";
 import "./chunk-7NYN2P6I.js";
 import "./chunk-WEKL2HYJ.js";
 import "./chunk-W45FZEGE.js";
-import "./chunk-RARREDQE.js";
 import "./chunk-WS6NU475.js";
+import "./chunk-RARREDQE.js";
 import "./chunk-MFHS7IQ2.js";
 import "./chunk-6VAL7XJT.js";
 export {

package/dist/{ensure-site-NSNY2QHN.js → ensure-site-FFDUMY6E.js}

@@ -66,7 +66,7 @@ async function runEnsureSiteCommand(slug, opts) {
   if (!slug) return { output: "Provide a <slug> (e.g. `ensure-site roalson`).", code: 2 };
   try {
     const base = openBase(readAirtableConfig());
-    const { makeSiteMirror } = await import("./site-mirror-RQTEAID5.js");
+    const { makeSiteMirror } = await import("./site-mirror-GCFLBBWK.js");
     const result = await ensureSite(
       base,
       {
@@ -93,4 +93,4 @@ async function runEnsureSiteCommand(slug, opts) {
 export {
   runEnsureSiteCommand
 };
-//# sourceMappingURL=ensure-site-NSNY2QHN.js.map
+//# sourceMappingURL=ensure-site-FFDUMY6E.js.map

package/dist/{forms-notify-target-LYSKME5L.js → forms-notify-target-IHJX7NWA.js}

@@ -2,8 +2,8 @@ import {
   describeNotifyTarget
 } from "./chunk-SJOXWJ5Y.js";
 import "./chunk-JRHIFA5R.js";
-import "./chunk-NO74DXDP.js";
 import "./chunk-5ML7FMBD.js";
+import "./chunk-NO74DXDP.js";
 import {
   openBase,
   readAirtableConfig
@@ -143,7 +143,7 @@ async function runFormsNotifyTargetCommand(site, opts) {
     return { output: `--set must be 'on' or 'off' (got '${opts.set}')`, code: 2 };
   }
   try {
-    const { makeSiteMirror } = await import("./site-mirror-RQTEAID5.js");
+    const { makeSiteMirror } = await import("./site-mirror-GCFLBBWK.js");
     const result = await formsNotifyTarget({
       siteMirror: await makeSiteMirror(),
       site: site.trim(),
@@ -163,4 +163,4 @@ export {
   formatNotifyTarget,
   runFormsNotifyTargetCommand
 };
-//# sourceMappingURL=forms-notify-target-LYSKME5L.js.map
+//# sourceMappingURL=forms-notify-target-IHJX7NWA.js.map

package/dist/{github-signals-4YML6NY5.js → github-signals-FCLNHKMF.js}

@@ -91,7 +91,7 @@ async function runGitHubSignalsCommand(opts, deps = {}) {
   );
   const sweptAt = (/* @__PURE__ */ new Date()).toISOString();
   const makeMirror = deps.makeMirror ?? (async () => {
-    const { makeHealthMirrorBestEffort } = await import("./health-mirror-7LKC7Q5Z.js");
+    const { makeHealthMirrorBestEffort } = await import("./health-mirror-GMSF3Z5R.js");
     return makeHealthMirrorBestEffort();
   });
   const mirror = await makeMirror();
@@ -156,4 +156,4 @@ export {
   githubSignalsExitCode,
   runGitHubSignalsCommand
 };
-//# sourceMappingURL=github-signals-4YML6NY5.js.map
+//# sourceMappingURL=github-signals-FCLNHKMF.js.map

package/dist/{health-mirror-7LKC7Q5Z.js → health-mirror-GMSF3Z5R.js}

@@ -2,10 +2,10 @@ import {
   mirrorHealthFields,
   mirrorScheduleFields
 } from "./chunk-QBAAZY7W.js";
+import "./chunk-P6AORG32.js";
 import {
   TURSO_IS_AUTHORITATIVE
 } from "./chunk-SVAAONYB.js";
-import "./chunk-P6AORG32.js";
 import "./chunk-F3JWOPTG.js";
 import "./chunk-VAD43MOR.js";
 import "./chunk-7NYN2P6I.js";
@@ -43,4 +43,4 @@ export {
   makeHealthMirrorBestEffort,
   makeScheduleMirrorBestEffort
 };
-//# sourceMappingURL=health-mirror-7LKC7Q5Z.js.map
+//# sourceMappingURL=health-mirror-GMSF3Z5R.js.map

package/dist/images/index.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Prismic image helpers for fleet sites.
+ *
+ * Dependency-free on purpose: consuming sites import this subpath directly, so
+ * it must never reach a central-only devDep. The image field is accepted
+ * structurally rather than as `@prismicio/client`'s `ImageField`, which keeps
+ * `@prismicio/client` out of this package's dependency graph while still
+ * type-checking at the call site — a real `ImageField` satisfies the shape.
+ */
+/**
+ * The srcset widths `<PrismicImage>` emits when no `widths` prop is given.
+ * Mirrors `DEFAULT_WIDTHS` in `@prismicio/client`'s `asImageWidthSrcSet()`.
+ */
+declare const PRISMIC_DEFAULT_WIDTHS: readonly [640, 828, 1200, 2048, 3840];
+/** The structural shape `cappedWidths()` needs from a Prismic image field. */
+type ImageFieldLike = {
+    dimensions?: {
+        width?: number | null;
+    } | null;
+} | null;
+/**
+ * Build a srcset width list that never exceeds the image's own pixel width.
+ *
+ * Prismic advertises every default width regardless of how big the source asset
+ * actually is. Because fleet sites also set `sizes` (or fall back to the `100vw`
+ * default), browsers on wide or retina screens genuinely pick those top
+ * candidates — so a 558px photo gets upscaled ~7x on demand, and a 40px logo by
+ * 96x. Those variants are always a cache MISS, are expensive for Prismic to
+ * generate, and are the ones that surface as slow or failed images in production
+ * while the same asset's smaller variants serve fine.
+ *
+ * Capping at the native width keeps the rendered result identical — upscaling
+ * adds no detail — while removing the expensive transforms entirely.
+ *
+ * Sources already at or above the widest candidate keep the default list
+ * untouched: appending their native width there would *add* a candidate wider
+ * than any previously offered, making large images heavier rather than lighter.
+ *
+ * @example
+ * ```svelte
+ * <PrismicImage
+ *   field={slice.primary.image}
+ *   widths={cappedWidths(slice.primary.image)}
+ *   sizes="(min-width: 768px) 50vw, 100vw"
+ * />
+ * ```
+ *
+ * @param field - The Prismic image field being rendered. An empty or
+ *   dimensionless field falls back to the candidate list unchanged.
+ * @param widths - Candidate widths to filter. Defaults to Prismic's own list.
+ * @returns Widths no larger than the source, ascending.
+ */
+declare function cappedWidths(field: ImageFieldLike | undefined, widths?: readonly number[]): number[];
+
+export { type ImageFieldLike, PRISMIC_DEFAULT_WIDTHS, cappedWidths };

package/dist/images/index.js

@@ -0,0 +1,16 @@
+// src/images/index.ts
+var PRISMIC_DEFAULT_WIDTHS = [640, 828, 1200, 2048, 3840];
+function cappedWidths(field, widths = PRISMIC_DEFAULT_WIDTHS) {
+  const candidates = [...widths];
+  const native = field?.dimensions?.width;
+  if (typeof native !== "number" || !Number.isFinite(native) || native <= 0) {
+    return candidates;
+  }
+  if (native >= Math.max(...candidates)) return candidates;
+  return [...candidates.filter((w) => w < native), native];
+}
+export {
+  PRISMIC_DEFAULT_WIDTHS,
+  cappedWidths
+};
+//# sourceMappingURL=index.js.map

package/dist/images/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/images/index.ts"],"sourcesContent":["/**\n * Prismic image helpers for fleet sites.\n *\n * Dependency-free on purpose: consuming sites import this subpath directly, so\n * it must never reach a central-only devDep. The image field is accepted\n * structurally rather than as `@prismicio/client`'s `ImageField`, which keeps\n * `@prismicio/client` out of this package's dependency graph while still\n * type-checking at the call site — a real `ImageField` satisfies the shape.\n */\n\n/**\n * The srcset widths `<PrismicImage>` emits when no `widths` prop is given.\n * Mirrors `DEFAULT_WIDTHS` in `@prismicio/client`'s `asImageWidthSrcSet()`.\n */\nexport const PRISMIC_DEFAULT_WIDTHS = [640, 828, 1200, 2048, 3840] as const;\n\n/** The structural shape `cappedWidths()` needs from a Prismic image field. */\nexport type ImageFieldLike = {\n  dimensions?: { width?: number | null } | null;\n} | null;\n\n/**\n * Build a srcset width list that never exceeds the image's own pixel width.\n *\n * Prismic advertises every default width regardless of how big the source asset\n * actually is. Because fleet sites also set `sizes` (or fall back to the `100vw`\n * default), browsers on wide or retina screens genuinely pick those top\n * candidates — so a 558px photo gets upscaled ~7x on demand, and a 40px logo by\n * 96x. Those variants are always a cache MISS, are expensive for Prismic to\n * generate, and are the ones that surface as slow or failed images in production\n * while the same asset's smaller variants serve fine.\n *\n * Capping at the native width keeps the rendered result identical — upscaling\n * adds no detail — while removing the expensive transforms entirely.\n *\n * Sources already at or above the widest candidate keep the default list\n * untouched: appending their native width there would *add* a candidate wider\n * than any previously offered, making large images heavier rather than lighter.\n *\n * @example\n * ```svelte\n * <PrismicImage\n *   field={slice.primary.image}\n *   widths={cappedWidths(slice.primary.image)}\n *   sizes=\"(min-width: 768px) 50vw, 100vw\"\n * />\n * ```\n *\n * @param field - The Prismic image field being rendered. An empty or\n *   dimensionless field falls back to the candidate list unchanged.\n * @param widths - Candidate widths to filter. Defaults to Prismic's own list.\n * @returns Widths no larger than the source, ascending.\n */\nexport function cappedWidths(\n  field: ImageFieldLike | undefined,\n  widths: readonly number[] = PRISMIC_DEFAULT_WIDTHS,\n): number[] {\n  const candidates = [...widths];\n  const native = field?.dimensions?.width;\n\n  if (typeof native !== \"number\" || !Number.isFinite(native) || native <= 0) {\n    return candidates;\n  }\n  if (native >= Math.max(...candidates)) return candidates;\n\n  return [...candidates.filter((w) => w < native), native];\n}\n"],"mappings":";AAcO,IAAM,yBAAyB,CAAC,KAAK,KAAK,MAAM,MAAM,IAAI;AAuC1D,SAAS,aACd,OACA,SAA4B,wBAClB;AACV,QAAM,aAAa,CAAC,GAAG,MAAM;AAC7B,QAAM,SAAS,OAAO,YAAY;AAElC,MAAI,OAAO,WAAW,YAAY,CAAC,OAAO,SAAS,MAAM,KAAK,UAAU,GAAG;AACzE,WAAO;AAAA,EACT;AACA,MAAI,UAAU,KAAK,IAAI,GAAG,UAAU,EAAG,QAAO;AAE9C,SAAO,CAAC,GAAG,WAAW,OAAO,CAAC,MAAM,IAAI,MAAM,GAAG,MAAM;AACzD;","names":[]}

package/dist/index.js

@@ -10,7 +10,7 @@ import {
   DEFAULT_INIT_STEPS,
   a11yFixturesPage,
   init
-} from "./chunk-62NYED6E.js";
+} from "./chunk-DCDF5A7N.js";
 import {
   convertToPnpm
 } from "./chunk-XIDUYLSR.js";
@@ -44,13 +44,13 @@ import {
 import {
   isPendingApproval
 } from "./chunk-F3JWOPTG.js";
-import "./chunk-BRYXFH77.js";
-import "./chunk-NYUYNYQL.js";
 import {
   checklistFor,
   gatingFields,
   isHealthGateClear
 } from "./chunk-VAD43MOR.js";
+import "./chunk-BRYXFH77.js";
+import "./chunk-NYUYNYQL.js";
 import {
   fromAirtableBase
 } from "./chunk-PR343K7F.js";
@@ -84,9 +84,9 @@ import {
 import "./chunk-WEKL2HYJ.js";
 import {
   syncConfigs
-} from "./chunk-3VQWSE3F.js";
+} from "./chunk-DXWLWR4Q.js";
 import "./chunk-3G25KIWW.js";
-import "./chunk-73UFRZKY.js";
+import "./chunk-MLT4QY5X.js";
 import "./chunk-OTGB6YQO.js";
 import {
   ALL_AUDIT_NAMES,
@@ -96,7 +96,7 @@ import {
   runAudits,
   runAuditsAcross,
   securityAudit
-} from "./chunk-AEXJDCJN.js";
+} from "./chunk-DFLN2KO3.js";
 import "./chunk-LKGVSM2O.js";
 import "./chunk-GASBX52O.js";
 import "./chunk-XHHMM5HX.js";
@@ -105,8 +105,9 @@ import {
   localPath
 } from "./chunk-Z3JXLULD.js";
 import "./chunk-W45FZEGE.js";
-import "./chunk-RARREDQE.js";
 import "./chunk-WS6NU475.js";
+import "./chunk-UDRHAQT7.js";
+import "./chunk-RARREDQE.js";
 import "./chunk-MFHS7IQ2.js";
 import "./chunk-A3WDWNN5.js";
 import {
@@ -116,7 +117,6 @@ import "./chunk-XTK5VIQB.js";
 import {
   lighthouseAudit
 } from "./chunk-2NQUCS7O.js";
-import "./chunk-UDRHAQT7.js";
 import "./chunk-PTDMVGKL.js";
 import "./chunk-LBYOLBW7.js";
 import "./chunk-XXTZBPUY.js";