@reddoorla/maintenance 0.90.0 → 0.90.1

package/dist/{chunk-DXWLWR4Q.js → chunk-A6T2R63Z.js}

@@ -35,7 +35,6 @@ var CANONICAL_GITIGNORE_ENTRIES = [
   "!.env.example",
   ".DS_Store",
   "*.log",
-  ".vercel/",
   ".netlify/",
   ".reddoor-a11y/",
   // The a11y audit's transient spec dir, written inside the checkout and
@@ -112,6 +111,7 @@ function findTrackedArtifacts(tracked, canonical) {
 // src/recipes/sync-configs.ts
 var GITIGNORE_CONFIG = "gitignore";
 var SVELTE_CONFIG = "svelte";
+var PRETTIER_IGNORE_CONFIG = "prettier-ignore";
 var NETLIFY_CONFIG = "netlify";
 function isSvelteConfigCompliant(contents) {
   if (!contents.includes("@sveltejs/adapter-netlify")) return false;
@@ -162,10 +162,19 @@ async function planTemplateDiffs(cwd, templates) {
       diffs.push({ ...t, contents: withRenovatePinsFrom(t.contents, existing) });
       continue;
     }
+    if (t.config === PRETTIER_IGNORE_CONFIG) {
+      const merged = mergeGitignore(existing, canonicalIgnoreEntries(t.contents));
+      if (merged.added.length === 0) continue;
+      diffs.push({ ...t, contents: merged.content });
+      continue;
+    }
     diffs.push(t);
   }
   return diffs;
 }
+function canonicalIgnoreEntries(templateContents) {
+  return templateContents.split("\n").map((l) => l.trim()).filter((l) => l !== "" && !l.startsWith("#"));
+}
 async function planGitignore(cwd) {
   const existing = await readMaybe(join(cwd, ".gitignore"));
   const merge = mergeGitignore(existing, CANONICAL_GITIGNORE_ENTRIES);
@@ -220,4 +229,4 @@ export {
   planTemplateDiffs,
   syncConfigs
 };
-//# sourceMappingURL=chunk-DXWLWR4Q.js.map
+//# sourceMappingURL=chunk-A6T2R63Z.js.map

package/dist/chunk-A6T2R63Z.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/recipes/sync-configs.ts","../src/recipes/sync-configs/gitignore.ts"],"sourcesContent":["import { readFile, writeFile, mkdir } from \"node:fs/promises\";\nimport { join, dirname } from \"node:path\";\nimport type { RecipeResult, Site, ConfigName } from \"../types.js\";\nimport { ALL_TEMPLATES, templatesByName, type ConfigTemplate } from \"./sync-configs/templates.js\";\nimport {\n  CANONICAL_GITIGNORE_ENTRIES,\n  mergeGitignore,\n  findTrackedArtifacts,\n} from \"./sync-configs/gitignore.js\";\nimport { listTrackedFiles, removeFromIndex } from \"../util/git.js\";\nimport { withRecipe } from \"./_with-recipe.js\";\nimport {\n  renovateActionGaps,\n  withRenovatePinsFrom,\n  RENOVATE_ACTION_CONFIG,\n} from \"./sync-configs/renovate-action.js\";\n\nexport type SyncConfigsOptions = {\n  which?: ConfigName[];\n};\n\nconst GITIGNORE_CONFIG: ConfigName = \"gitignore\";\nconst SVELTE_CONFIG: ConfigName = \"svelte\";\nconst PRETTIER_IGNORE_CONFIG: ConfigName = \"prettier-ignore\";\nconst NETLIFY_CONFIG: ConfigName = \"netlify\";\n\n/** A site's `svelte.config.js` is \"compliant\" — and left untouched by sync —\n * once it builds on the canonical helpers (createSvelteConfig + adapter-netlify).\n *\n * Unlike the other exact-match templates, svelte.config legitimately carries\n * site-specific `kit.alias` and `compilerOptions`; an exact overwrite would\n * clobber those on every sync (it silently dropped MSOT's $utils alias,\n * 2026-06-04). So once a config is on the canonical pattern we preserve it as-is\n * and only rewrite a genuinely off-pattern (or missing) config. `createSvelteConfig`\n * now provides the canonical `$lib` aliases itself, and a site's own `kit.alias`\n * overrides per key (and may add more), so a site's additive customization is safe\n * to preserve. */\nfunction isSvelteConfigCompliant(contents: string): boolean {\n  // Not on the canonical adapter (a missing file, or `adapter-auto` from a\n  // stock `npm create svelte`) => bring it to the template.\n  if (!contents.includes(\"@sveltejs/adapter-netlify\")) return false;\n  // The canonical shape: the helper supplies fleet aliases, the warning filter\n  // and CSP defaults.\n  if (contents.includes(\"createSvelteConfig\")) return true;\n  // A hand-authored config with its own `kit` block is deliberate customization,\n  // not drift. Requiring the helper string treated four live sites as off-pattern\n  // — the-pointe-burbank (151 lines), beachfront-dentistry (241), 1836dig,\n  // data-dynamiq — plus reddoor-starter, whose placeholder-repo prerender\n  // tolerance is the only reason a freshly cloned site builds green. Replacing\n  // any of those with the 8-line template is the clobbering bug this predicate\n  // exists to prevent (MSOT's $utils aliases, 2026-06-04), not a fix for it.\n  // A stub with no `kit` config at all still gets the template.\n  return /\\bkit\\s*:/.test(contents);\n}\n\n/** Any of the baseline security headers — the marker that a netlify.toml is\n * deliberately hardened (vs. e.g. a cache-control-only `[[headers]]` block). */\nconst SECURITY_HEADER_RE =\n  /Strict-Transport-Security|Content-Security-Policy|X-Frame-Options|X-Content-Type-Options|Referrer-Policy|Permissions-Policy|Cross-Origin-Opener-Policy/i;\n\n/** A site's `netlify.toml` is \"compliant\" — and left untouched by sync — once it\n * carries a `[[headers]]` block AND a security header (HSTS/CSP/X-Frame-Options/…).\n *\n * Like svelte.config, netlify.toml legitimately holds site-specific config\n * (custom CSP, redirects, per-route headers). The canonical template ships the\n * baseline security headers, but an exact overwrite would CLOBBER a site's own\n * hardening — that bug stripped gallerysonder's headers on a routine sync\n * (2026-06-10). So a genuinely-hardened file is left alone, while a missing,\n * header-less (previously-stripped), OR merely cache-header file is non-compliant\n * and gets the canonical template, which backfills the security baseline. */\nfunction isNetlifyConfigCompliant(contents: string): boolean {\n  return contents.includes(\"[[headers]]\") && SECURITY_HEADER_RE.test(contents);\n}\n\n/** Runtime enumeration of every `ConfigName`. Mirror of the union in\n * `src/types.ts`. Used by CLI `--only` validation; a missing entry would\n * silently accept typos. The type-test in `tests/types.test.ts` guards\n * against drift between this array and the union. */\nexport const ALL_CONFIG_NAMES: ConfigName[] = [\n  \"lighthouse\",\n  \"eslint\",\n  \"prettier\",\n  \"prettier-ignore\",\n  \"playwright-a11y\",\n  \"svelte\",\n  \"gitignore\",\n  \"renovate-action\",\n  \"renovate-config\",\n  \"netlify\",\n];\n\nexport function isConfigName(value: string): value is ConfigName {\n  return (ALL_CONFIG_NAMES as string[]).includes(value);\n}\n\nasync function readMaybe(path: string): Promise<string | null> {\n  try {\n    return await readFile(path, \"utf-8\");\n  } catch {\n    return null;\n  }\n}\n\nexport async function planTemplateDiffs(\n  cwd: string,\n  templates: ConfigTemplate[],\n): Promise<ConfigTemplate[]> {\n  const diffs: ConfigTemplate[] = [];\n  for (const t of templates) {\n    const existing = await readMaybe(join(cwd, t.path));\n    if (existing === t.contents) continue;\n    // svelte.config is compliance-checked, not exact-matched: an existing config\n    // already on the canonical pattern is left alone so its aliases/compilerOptions\n    // survive. A missing (null) or off-pattern config still gets the canonical template.\n    if (t.config === SVELTE_CONFIG && existing !== null && isSvelteConfigCompliant(existing)) {\n      continue;\n    }\n    // netlify.toml is likewise compliance-checked: a file that already carries\n    // `[[headers]]` is hardened and left alone (an exact overwrite would strip\n    // its security headers). A header-less / missing file gets the template.\n    if (t.config === NETLIFY_CONFIG && existing !== null && isNetlifyConfigCompliant(existing)) {\n      continue;\n    }\n    // renovate.yml is likewise compliance-checked, not byte-matched: Renovate\n    // legitimately bumps its own digest pins forward (an exact overwrite would\n    // DOWNGRADE them — reddoorla/reddoor-starter-blux#1, 2026-08-31), and a\n    // site's prettier may legitimately quote the cron / RENOVATE_* scalars\n    // differently than the template (both forms are prettier-clean, so\n    // prettier never converges them — issue #651). A file with zero\n    // `renovateActionGaps` is left alone.\n    if (\n      t.config === RENOVATE_ACTION_CONFIG &&\n      existing !== null &&\n      renovateActionGaps(existing).length === 0\n    ) {\n      continue;\n    }\n    // When renovate.yml genuinely IS non-compliant, heal it with the template\n    // but carry the site's own (still-digest-pinned) action refs forward onto\n    // it first — writing the template verbatim would re-introduce the same\n    // pin downgrade this compliance check exists to prevent.\n    if (t.config === RENOVATE_ACTION_CONFIG) {\n      diffs.push({ ...t, contents: withRenovatePinsFrom(t.contents, existing) });\n      continue;\n    }\n    // .prettierignore is MERGED, not overwritten — the same treatment\n    // .gitignore has always had, because it is the same kind of file: a list a\n    // site legitimately extends. reddoor-starter adds the Slice Machine-\n    // generated `src/prismicio-types.d.ts`, whose reformatting on a prettier\n    // version bump reds `prettier --check` on otherwise-fine dependency PRs.\n    // An exact overwrite silently deleted that and re-armed the failure.\n    if (t.config === PRETTIER_IGNORE_CONFIG) {\n      const merged = mergeGitignore(existing, canonicalIgnoreEntries(t.contents));\n      if (merged.added.length === 0) continue;\n      diffs.push({ ...t, contents: merged.content });\n      continue;\n    }\n    diffs.push(t);\n  }\n  return diffs;\n}\n\n/** The template's own entries, minus comments and blank lines — the set a site\n *  must contain for its .prettierignore to be considered complete. */\nfunction canonicalIgnoreEntries(templateContents: string): string[] {\n  return templateContents\n    .split(\"\\n\")\n    .map((l) => l.trim())\n    .filter((l) => l !== \"\" && !l.startsWith(\"#\"));\n}\n\ntype GitignorePlan =\n  { kind: \"noop\" } | { kind: \"apply\"; content: string; toUntrack: string[]; added: string[] };\n\nasync function planGitignore(cwd: string): Promise<GitignorePlan> {\n  const existing = await readMaybe(join(cwd, \".gitignore\"));\n  const merge = mergeGitignore(existing, CANONICAL_GITIGNORE_ENTRIES);\n  const tracked = await listTrackedFiles(cwd);\n  const toUntrack = findTrackedArtifacts(tracked, CANONICAL_GITIGNORE_ENTRIES);\n  if (merge.added.length === 0 && toUntrack.length === 0) return { kind: \"noop\" };\n  return { kind: \"apply\", content: merge.content, toUntrack, added: merge.added };\n}\n\nasync function applyGitignore(\n  cwd: string,\n  plan: Extract<GitignorePlan, { kind: \"apply\" }>,\n): Promise<void> {\n  await writeFile(join(cwd, \".gitignore\"), plan.content, \"utf-8\");\n  if (plan.toUntrack.length > 0) {\n    await removeFromIndex(cwd, plan.toUntrack);\n  }\n}\n\nexport async function syncConfigs(\n  site: Site,\n  opts: SyncConfigsOptions = {},\n): Promise<RecipeResult> {\n  const requested = opts.which ?? ALL_TEMPLATES.map((t) => t.config).concat(GITIGNORE_CONFIG);\n  const templateNames = requested.filter((c): c is ConfigName => c !== GITIGNORE_CONFIG);\n  const templates = templatesByName(templateNames);\n  const includeGitignore = requested.includes(GITIGNORE_CONFIG);\n\n  return withRecipe({\n    name: \"sync-configs\",\n    site,\n    plan: async () => {\n      const templateDiffs = await planTemplateDiffs(site.path, templates);\n      const gitignorePlan: GitignorePlan = includeGitignore\n        ? await planGitignore(site.path)\n        : { kind: \"noop\" };\n      if (templateDiffs.length === 0 && gitignorePlan.kind === \"noop\") {\n        return { kind: \"noop\", notes: \"all targeted configs already match\" };\n      }\n      return { kind: \"apply\", plan: { templateDiffs, gitignorePlan } };\n    },\n    apply: async ({ templateDiffs, gitignorePlan }, { commit }) => {\n      for (const t of templateDiffs) {\n        const dest = join(site.path, t.path);\n        await mkdir(dirname(dest), { recursive: true });\n        await writeFile(dest, t.contents, \"utf-8\");\n        await commit(`chore: sync ${t.config} config from @reddoorla/maintenance`);\n      }\n      if (gitignorePlan.kind === \"apply\") {\n        await applyGitignore(site.path, gitignorePlan);\n        await commit(`chore: sync gitignore from @reddoorla/maintenance`);\n      }\n      return { kind: \"ok\" };\n    },\n  });\n}\n","/**\n * Comment line written above the appended block so future runs (and humans)\n * can recognize the managed section. Presence of this line is incidental —\n * the merge logic is keyed on each entry's normalized form, not on the marker.\n */\nexport const MANAGED_MARKER = \"# canonical entries from @reddoorla/maintenance sync-configs\";\n\n/**\n * Build artifacts, test outputs, deploy caches, and secrets that should never\n * be tracked across the reddoor fleet. Sites may keep additional site-specific\n * entries — they are preserved on merge.\n */\nexport const CANONICAL_GITIGNORE_ENTRIES: readonly string[] = [\n  \"node_modules/\",\n  \"build/\",\n  \"dist/\",\n  \".svelte-kit/\",\n  \"coverage/\",\n  \".vitest-cache/\",\n  \"playwright-report/\",\n  \"test-results/\",\n  \".lighthouseci/\",\n  \".tsbuildinfo\",\n  \".env\",\n  \".env.*\",\n  \"!.env.example\",\n  \".DS_Store\",\n  \"*.log\",\n  \".netlify/\",\n  \".reddoor-a11y/\",\n  // The a11y audit's transient spec dir, written inside the checkout and\n  // normally cleaned, but a timeout-SIGKILL of the parent orphans it. Ignored\n  // fleet-wide so it never dirties a self-updating repo's tree (2026-06-10 M-D).\n  \".reddoor-a11y-spec-*/\",\n];\n\nexport type MergeResult = { content: string; added: string[] };\n\nfunction stripLeadingSlash(s: string): string {\n  return s.startsWith(\"/\") ? s.slice(1) : s;\n}\n\nfunction stripTrailingSlash(s: string): string {\n  return s.endsWith(\"/\") ? s.slice(0, -1) : s;\n}\n\n/**\n * Normalize for presence comparison only: strip leading `/`, trailing `/`,\n * and surrounding whitespace. `build`, `/build`, `build/`, and `/build/` all\n * collapse to the same key.\n */\nfunction normalizePresence(line: string): string {\n  return stripTrailingSlash(stripLeadingSlash(line.trim()));\n}\n\nfunction presentSet(existing: string): Set<string> {\n  const set = new Set<string>();\n  for (const raw of existing.split(/\\r?\\n/)) {\n    const trimmed = raw.trim();\n    if (!trimmed) continue;\n    if (trimmed.startsWith(\"#\")) continue;\n    set.add(normalizePresence(trimmed));\n  }\n  return set;\n}\n\n/**\n * Merge `canonical` entries into `existing` .gitignore content.\n *\n * - Missing entries are appended under a managed marker comment.\n * - Existing entries (in any normalized variant — `/build`, `build/`, etc.)\n *   are preserved as-is; we never rewrite the site's own lines.\n * - When every canonical entry is already present, returns the original\n *   content unchanged with `added: []` — the recipe can treat that as noop.\n */\nexport function mergeGitignore(existing: string | null, canonical: readonly string[]): MergeResult {\n  if (existing === null) {\n    const body = [MANAGED_MARKER, ...canonical].join(\"\\n\") + \"\\n\";\n    return { content: body, added: [...canonical] };\n  }\n  const present = presentSet(existing);\n  const added: string[] = [];\n  for (const entry of canonical) {\n    const norm = normalizePresence(entry);\n    if (!present.has(norm)) {\n      added.push(entry);\n      present.add(norm);\n    }\n  }\n  if (added.length === 0) {\n    return { content: existing, added: [] };\n  }\n  let base = existing;\n  if (!base.endsWith(\"\\n\")) base += \"\\n\";\n  const block = [\"\", MANAGED_MARKER, ...added].join(\"\\n\") + \"\\n\";\n  return { content: base + block, added };\n}\n\n/**\n * Of the tracked paths, return those that fall under a canonical *directory*\n * entry — i.e., paths that the freshly-synced .gitignore now wants ignored\n * but which git currently has in the index.\n *\n * File-pattern entries (`.env`, `*.log`, `.DS_Store`) are intentionally\n * skipped: they may contain user-meaningful data, and `git rm --cached`\n * cannot scrub secrets from history anyway. Surfaced for manual review\n * instead of auto-removing.\n */\nexport function findTrackedArtifacts(\n  tracked: readonly string[],\n  canonical: readonly string[],\n): string[] {\n  const dirEntries: string[] = [];\n  for (const raw of canonical) {\n    const t = raw.trim();\n    if (!t) continue;\n    if (t.startsWith(\"!\")) continue;\n    if (/[*?[]/.test(t)) continue;\n    const noLead = stripLeadingSlash(t);\n    if (!noLead.endsWith(\"/\")) continue;\n    const name = stripTrailingSlash(noLead);\n    if (!name) continue;\n    dirEntries.push(name);\n  }\n  const matched: string[] = [];\n  for (const path of tracked) {\n    for (const dir of dirEntries) {\n      if (path === dir || path.startsWith(dir + \"/\")) {\n        matched.push(path);\n        break;\n      }\n    }\n  }\n  return matched;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAAA,SAAS,UAAU,WAAW,aAAa;AAC3C,SAAS,MAAM,eAAe;;;ACIvB,IAAM,iBAAiB;AAOvB,IAAM,8BAAiD;AAAA,EAC5D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAIA;AACF;AAIA,SAAS,kBAAkB,GAAmB;AAC5C,SAAO,EAAE,WAAW,GAAG,IAAI,EAAE,MAAM,CAAC,IAAI;AAC1C;AAEA,SAAS,mBAAmB,GAAmB;AAC7C,SAAO,EAAE,SAAS,GAAG,IAAI,EAAE,MAAM,GAAG,EAAE,IAAI;AAC5C;AAOA,SAAS,kBAAkB,MAAsB;AAC/C,SAAO,mBAAmB,kBAAkB,KAAK,KAAK,CAAC,CAAC;AAC1D;AAEA,SAAS,WAAW,UAA+B;AACjD,QAAM,MAAM,oBAAI,IAAY;AAC5B,aAAW,OAAO,SAAS,MAAM,OAAO,GAAG;AACzC,UAAM,UAAU,IAAI,KAAK;AACzB,QAAI,CAAC,QAAS;AACd,QAAI,QAAQ,WAAW,GAAG,EAAG;AAC7B,QAAI,IAAI,kBAAkB,OAAO,CAAC;AAAA,EACpC;AACA,SAAO;AACT;AAWO,SAAS,eAAe,UAAyB,WAA2C;AACjG,MAAI,aAAa,MAAM;AACrB,UAAM,OAAO,CAAC,gBAAgB,GAAG,SAAS,EAAE,KAAK,IAAI,IAAI;AACzD,WAAO,EAAE,SAAS,MAAM,OAAO,CAAC,GAAG,SAAS,EAAE;AAAA,EAChD;AACA,QAAM,UAAU,WAAW,QAAQ;AACnC,QAAM,QAAkB,CAAC;AACzB,aAAW,SAAS,WAAW;AAC7B,UAAM,OAAO,kBAAkB,KAAK;AACpC,QAAI,CAAC,QAAQ,IAAI,IAAI,GAAG;AACtB,YAAM,KAAK,KAAK;AAChB,cAAQ,IAAI,IAAI;AAAA,IAClB;AAAA,EACF;AACA,MAAI,MAAM,WAAW,GAAG;AACtB,WAAO,EAAE,SAAS,UAAU,OAAO,CAAC,EAAE;AAAA,EACxC;AACA,MAAI,OAAO;AACX,MAAI,CAAC,KAAK,SAAS,IAAI,EAAG,SAAQ;AAClC,QAAM,QAAQ,CAAC,IAAI,gBAAgB,GAAG,KAAK,EAAE,KAAK,IAAI,IAAI;AAC1D,SAAO,EAAE,SAAS,OAAO,OAAO,MAAM;AACxC;AAYO,SAAS,qBACd,SACA,WACU;AACV,QAAM,aAAuB,CAAC;AAC9B,aAAW,OAAO,WAAW;AAC3B,UAAM,IAAI,IAAI,KAAK;AACnB,QAAI,CAAC,EAAG;AACR,QAAI,EAAE,WAAW,GAAG,EAAG;AACvB,QAAI,QAAQ,KAAK,CAAC,EAAG;AACrB,UAAM,SAAS,kBAAkB,CAAC;AAClC,QAAI,CAAC,OAAO,SAAS,GAAG,EAAG;AAC3B,UAAM,OAAO,mBAAmB,MAAM;AACtC,QAAI,CAAC,KAAM;AACX,eAAW,KAAK,IAAI;AAAA,EACtB;AACA,QAAM,UAAoB,CAAC;AAC3B,aAAW,QAAQ,SAAS;AAC1B,eAAW,OAAO,YAAY;AAC5B,UAAI,SAAS,OAAO,KAAK,WAAW,MAAM,GAAG,GAAG;AAC9C,gBAAQ,KAAK,IAAI;AACjB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;;;ADjHA,IAAM,mBAA+B;AACrC,IAAM,gBAA4B;AAClC,IAAM,yBAAqC;AAC3C,IAAM,iBAA6B;AAanC,SAAS,wBAAwB,UAA2B;AAG1D,MAAI,CAAC,SAAS,SAAS,2BAA2B,EAAG,QAAO;AAG5D,MAAI,SAAS,SAAS,oBAAoB,EAAG,QAAO;AASpD,SAAO,YAAY,KAAK,QAAQ;AAClC;AAIA,IAAM,qBACJ;AAYF,SAAS,yBAAyB,UAA2B;AAC3D,SAAO,SAAS,SAAS,aAAa,KAAK,mBAAmB,KAAK,QAAQ;AAC7E;AAMO,IAAM,mBAAiC;AAAA,EAC5C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,SAAS,aAAa,OAAoC;AAC/D,SAAQ,iBAA8B,SAAS,KAAK;AACtD;AAEA,eAAe,UAAU,MAAsC;AAC7D,MAAI;AACF,WAAO,MAAM,SAAS,MAAM,OAAO;AAAA,EACrC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,kBACpB,KACA,WAC2B;AAC3B,QAAM,QAA0B,CAAC;AACjC,aAAW,KAAK,WAAW;AACzB,UAAM,WAAW,MAAM,UAAU,KAAK,KAAK,EAAE,IAAI,CAAC;AAClD,QAAI,aAAa,EAAE,SAAU;AAI7B,QAAI,EAAE,WAAW,iBAAiB,aAAa,QAAQ,wBAAwB,QAAQ,GAAG;AACxF;AAAA,IACF;AAIA,QAAI,EAAE,WAAW,kBAAkB,aAAa,QAAQ,yBAAyB,QAAQ,GAAG;AAC1F;AAAA,IACF;AAQA,QACE,EAAE,WAAW,0BACb,aAAa,QACb,mBAAmB,QAAQ,EAAE,WAAW,GACxC;AACA;AAAA,IACF;AAKA,QAAI,EAAE,WAAW,wBAAwB;AACvC,YAAM,KAAK,EAAE,GAAG,GAAG,UAAU,qBAAqB,EAAE,UAAU,QAAQ,EAAE,CAAC;AACzE;AAAA,IACF;AAOA,QAAI,EAAE,WAAW,wBAAwB;AACvC,YAAM,SAAS,eAAe,UAAU,uBAAuB,EAAE,QAAQ,CAAC;AAC1E,UAAI,OAAO,MAAM,WAAW,EAAG;AAC/B,YAAM,KAAK,EAAE,GAAG,GAAG,UAAU,OAAO,QAAQ,CAAC;AAC7C;AAAA,IACF;AACA,UAAM,KAAK,CAAC;AAAA,EACd;AACA,SAAO;AACT;AAIA,SAAS,uBAAuB,kBAAoC;AAClE,SAAO,iBACJ,MAAM,IAAI,EACV,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,CAAC,MAAM,MAAM,MAAM,CAAC,EAAE,WAAW,GAAG,CAAC;AACjD;AAKA,eAAe,cAAc,KAAqC;AAChE,QAAM,WAAW,MAAM,UAAU,KAAK,KAAK,YAAY,CAAC;AACxD,QAAM,QAAQ,eAAe,UAAU,2BAA2B;AAClE,QAAM,UAAU,MAAM,iBAAiB,GAAG;AAC1C,QAAM,YAAY,qBAAqB,SAAS,2BAA2B;AAC3E,MAAI,MAAM,MAAM,WAAW,KAAK,UAAU,WAAW,EAAG,QAAO,EAAE,MAAM,OAAO;AAC9E,SAAO,EAAE,MAAM,SAAS,SAAS,MAAM,SAAS,WAAW,OAAO,MAAM,MAAM;AAChF;AAEA,eAAe,eACb,KACA,MACe;AACf,QAAM,UAAU,KAAK,KAAK,YAAY,GAAG,KAAK,SAAS,OAAO;AAC9D,MAAI,KAAK,UAAU,SAAS,GAAG;AAC7B,UAAM,gBAAgB,KAAK,KAAK,SAAS;AAAA,EAC3C;AACF;AAEA,eAAsB,YACpB,MACA,OAA2B,CAAC,GACL;AACvB,QAAM,YAAY,KAAK,SAAS,cAAc,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,gBAAgB;AAC1F,QAAM,gBAAgB,UAAU,OAAO,CAAC,MAAuB,MAAM,gBAAgB;AACrF,QAAM,YAAY,gBAAgB,aAAa;AAC/C,QAAM,mBAAmB,UAAU,SAAS,gBAAgB;AAE5D,SAAO,WAAW;AAAA,IAChB,MAAM;AAAA,IACN;AAAA,IACA,MAAM,YAAY;AAChB,YAAM,gBAAgB,MAAM,kBAAkB,KAAK,MAAM,SAAS;AAClE,YAAM,gBAA+B,mBACjC,MAAM,cAAc,KAAK,IAAI,IAC7B,EAAE,MAAM,OAAO;AACnB,UAAI,cAAc,WAAW,KAAK,cAAc,SAAS,QAAQ;AAC/D,eAAO,EAAE,MAAM,QAAQ,OAAO,qCAAqC;AAAA,MACrE;AACA,aAAO,EAAE,MAAM,SAAS,MAAM,EAAE,eAAe,cAAc,EAAE;AAAA,IACjE;AAAA,IACA,OAAO,OAAO,EAAE,eAAe,cAAc,GAAG,EAAE,OAAO,MAAM;AAC7D,iBAAW,KAAK,eAAe;AAC7B,cAAM,OAAO,KAAK,KAAK,MAAM,EAAE,IAAI;AACnC,cAAM,MAAM,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AAC9C,cAAM,UAAU,MAAM,EAAE,UAAU,OAAO;AACzC,cAAM,OAAO,eAAe,EAAE,MAAM,qCAAqC;AAAA,MAC3E;AACA,UAAI,cAAc,SAAS,SAAS;AAClC,cAAM,eAAe,KAAK,MAAM,aAAa;AAC7C,cAAM,OAAO,mDAAmD;AAAA,MAClE;AACA,aAAO,EAAE,MAAM,KAAK;AAAA,IACtB;AAAA,EACF,CAAC;AACH;","names":[]}

package/dist/{chunk-DFLN2KO3.js → chunk-QD427NIO.js}

@@ -29,7 +29,7 @@ import {
 import {
   a11yRoutes,
   smokeRoutes
-} from "./chunk-O3GT46R2.js";
+} from "./chunk-YLYXW5PH.js";
 
 // src/audits/deps.ts
 import { readFile } from "fs/promises";
@@ -1979,4 +1979,4 @@ export {
   runAudits,
   runAuditsAcross
 };
-//# sourceMappingURL=chunk-DFLN2KO3.js.map
+//# sourceMappingURL=chunk-QD427NIO.js.map

package/dist/{chunk-DCDF5A7N.js → chunk-UXJZU23T.js}

@@ -15,13 +15,13 @@ import {
 } from "./chunk-7RJ2HMMJ.js";
 import {
   syncConfigs
-} from "./chunk-DXWLWR4Q.js";
+} from "./chunk-A6T2R63Z.js";
 import {
   withRecipe
 } from "./chunk-3G25KIWW.js";
 import {
   runAudits
-} from "./chunk-DFLN2KO3.js";
+} from "./chunk-QD427NIO.js";
 import {
   siteLabel
 } from "./chunk-XXTZBPUY.js";
@@ -143,4 +143,4 @@ export {
   DEFAULT_INIT_STEPS,
   init
 };
-//# sourceMappingURL=chunk-DCDF5A7N.js.map
+//# sourceMappingURL=chunk-UXJZU23T.js.map

package/dist/{chunk-O3GT46R2.js → chunk-YLYXW5PH.js}

@@ -38,7 +38,19 @@ var playwrightA11yConfig = defineConfig({
   reporter: process.env.CI ? "github" : "list",
   use: {
     baseURL: `http://localhost:${port}`,
-    trace: "on-first-retry"
+    trace: "on-first-retry",
+    // Emulate reduced motion fleet-wide: scrollIntoView lands instantly rather
+    // than animating, so Playwright's actionability checks don't flake under
+    // parallel load, and view transitions fall back to instant. Pairs with the
+    // prefers-reduced-motion gate on scroll-behavior in every site's app.css.
+    //
+    // It MUST sit under `contextOptions` — `reducedMotion` is a
+    // BrowserContextOptions member, not a top-level test option. reddoor-starter
+    // carried it at the top level of `use` from 2026-06 until 2026-09-01, where
+    // Playwright silently ignored it (unknown keys are dropped at runtime) and
+    // `pnpm check` never flagged it because svelte-check does not typecheck
+    // playwright.config.ts. The emulation was inert that whole time.
+    contextOptions: { reducedMotion: "reduce" }
   },
   projects: [
     {
@@ -93,4 +105,4 @@ export {
   smokeRoutes,
   playwright_a11y_default
 };
-//# sourceMappingURL=chunk-O3GT46R2.js.map
+//# sourceMappingURL=chunk-YLYXW5PH.js.map

package/dist/{chunk-O3GT46R2.js.map → chunk-YLYXW5PH.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/configs/playwright-a11y.ts"],"sourcesContent":["import { execFileSync } from \"node:child_process\";\nimport { defineConfig, devices, type PlaywrightTestConfig } from \"@playwright/test\";\n\nexport type A11yRoute = { path: string; name: string };\n\nexport const a11yRoutes: A11yRoute[] = [\n  { path: \"/dev/a11y-fixtures\", name: \"a11y fixtures\" },\n  { path: \"/dev/animate-in\", name: \"animate-in demo\" },\n];\n\n// Routes smoke-loaded for client-side (hydration) errors only — NOT axe-scanned.\n// Catches the class of bug where build + SSR succeed but client hydration throws\n// and blanks the page (data-dynamiq 2026-06-09: a Svelte 4->5 `run()` referenced\n// a `$state` declared after it → TDZ ReferenceError on hydrate). `/` is the one\n// route every site has; real routes carry a11y debt we don't gate on here, so we\n// assert only that they don't crash on hydrate.\nexport const smokeRoutes: A11yRoute[] = [{ path: \"/\", name: \"home\" }];\n\n// R1.1 (health-gate): the central `smoke` audit (src/audits/smoke.ts) allocates\n// a free port and passes it as REDDOOR_SMOKE_PORT so a zombie vite already\n// squatting the default 5173 can't silently hijack the run and green a stale\n// build. The per-site R1.1 config template honors it, but sites whose\n// playwright.config.ts merely re-exports this shared base (pre-R1.1 adopters\n// the smoke-suite recipe flags-but-never-rewrites) would otherwise ignore it —\n// so honor it here too and every re-exporter inherits the port binding on its\n// next package bump. Unset (local `pnpm test:smoke`) → the fixed 5173.\nconst smokePort = process.env.REDDOOR_SMOKE_PORT;\n\n/**\n * Allocate a free port SYNCHRONOUSLY, for the local path where nothing handed\n * us one. Same trick as src/util/free-port.ts (bind :0, read the assigned port,\n * release it) — but that is async, and this value is needed at module scope\n * while Playwright is still building the config object.\n *\n * It cannot be an async default export instead: sites consume this base by\n * SPREADING it (`{ ...base, use: { ...base.use } }` — see the smoke-suite\n * recipe template). Spreading a Promise yields none of its properties, so the\n * site would get a silently empty config — the exact false-green this whole\n * change exists to remove. The export must stay a plain object.\n *\n * A subprocess is the cost of that constraint: ~30-50ms, once per Playwright\n * run. On any failure we return null and the caller falls back to 5173, which\n * (with reuseExistingServer now false) degrades to a loud \"port already in use\"\n * rather than a silent wrong-server run.\n */\nfunction allocateFreePortSync(): string | null {\n  try {\n    const out = execFileSync(\n      process.execPath,\n      [\n        \"-e\",\n        'const s=require(\"node:net\").createServer();s.on(\"error\",()=>process.exit(1));' +\n          's.listen(0,\"127.0.0.1\",()=>{const p=s.address().port;s.close(()=>process.stdout.write(String(p)))});',\n      ],\n      { encoding: \"utf8\", timeout: 5_000, stdio: [\"ignore\", \"pipe\", \"ignore\"] },\n    ).trim();\n    return /^\\d+$/.test(out) ? out : null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Resolve the port this run binds to, ONCE per run rather than once per\n * evaluation of this file.\n *\n * REDDOOR_SMOKE_PORT (the central audit already allocated one) wins; otherwise\n * this run allocates its own. The old fallback was the fixed 5173 — the same\n * port a dev server sits on, which is what let `reuseExistingServer` silently\n * hijack local runs (#524).\n *\n * The allocation is pinned back into the environment, and that is the whole\n * point. Playwright re-evaluates the config file in EVERY worker process, not\n * just the main one. Allocating per evaluation gave each worker a different\n * port: the main process started the dev server on one, every worker aimed\n * `baseURL` at another, and the run died with ERR_CONNECTION_REFUSED against a\n * handful of ports nothing was ever serving. Workers are forked and inherit\n * this environment, so writing it back makes every later evaluation agree.\n *\n * It broke on the site suites and not on `audit --only a11y`, which writes its\n * own config and never reads this file — so nothing here caught it.\n */\nfunction resolvePort(): string {\n  if (smokePort) return smokePort;\n  const allocated = allocateFreePortSync() || \"5173\";\n  process.env.REDDOOR_SMOKE_PORT = allocated;\n  return allocated;\n}\n\nconst port = resolvePort();\n\n// NOTE: default export only — sites consume this as `import base from\n// \"@reddoorla/maintenance/configs/playwright-a11y\"` (or re-export the default).\n// The old `playwrightA11yConfig` named alias had zero importers and was removed.\nconst playwrightA11yConfig: PlaywrightTestConfig = defineConfig({\n  testDir: \"tests\",\n  testMatch: /.*\\.spec\\.ts$/,\n  fullyParallel: true,\n  forbidOnly: !!process.env.CI,\n  retries: process.env.CI ? 2 : 0,\n  reporter: process.env.CI ? \"github\" : \"list\",\n  use: {\n    baseURL: `http://localhost:${port}`,\n    trace: \"on-first-retry\",\n  },\n  projects: [\n    {\n      name: \"chromium\",\n      use: { ...devices[\"Desktop Chrome\"] },\n    },\n  ],\n  webServer: {\n    // Portable across pnpm and npm sites — pnpm respects `npm run` too.\n    //\n    // `--port ... --strictPort` in BOTH cases. It used to be applied only when\n    // REDDOOR_SMOKE_PORT allocated one, on the reasoning that we should \"fail\n    // loudly rather than let vite drift to a free port the baseURL doesn't\n    // point at\" — but that argument covers the unset case just as well. 5173 is\n    // equally a fixed port that `baseURL` and the readiness probe below are\n    // pinned to, and vite left to itself drifts off it whenever something else\n    // holds it.\n    //\n    // The symptom that exposed this: a non-vite process on 5173 sends vite to\n    // 5174 while the probe keeps polling 5173, so the run dies on\n    // \"Timed out waiting 120000ms from config.webServer\" — 120 seconds of\n    // nothing, naming neither the port nor the squatter. With --strictPort it\n    // is an immediate \"Port 5173 is already in use\".\n    //\n    // --strictPort now only bites if the allocated port is taken in the window\n    // between releasing and binding it, which is exactly the case worth failing\n    // on.\n    command: `npm run vite:dev -- --port ${port} --strictPort`,\n    url: `http://localhost:${port}/dev/a11y-fixtures`,\n    // NEVER reuse (#524). This used to be `!process.env.CI`, so local runs\n    // reused whatever answered the probe URL. The probe only asks \"does this\n    // respond?\" — never \"is this serving the code I am about to test?\" — so a\n    // dev server left open, or one whose tree changed under it after a\n    // checkout, silently became the system under test. That fails in both\n    // directions: a false red blamed on the code (beachfront 2026-08-12, where\n    // it was investigated as a macOS-vs-Linux difference and written up as one\n    // before being caught), and a false green where a passing suite ran against\n    // an old build. CI already had it false, and that asymmetry is precisely\n    // what made the failure read as a platform bug.\n    //\n    // The cost is a fresh vite boot per run (~10-20s against a ~2min suite).\n    // Because the port above is allocated rather than fixed, your own dev\n    // server on 5173 keeps running untouched.\n    reuseExistingServer: false,\n    timeout: 120_000,\n  },\n});\n\nexport default playwrightA11yConfig;\n"],"mappings":";AAAA,SAAS,oBAAoB;AAC7B,SAAS,cAAc,eAA0C;AAI1D,IAAM,aAA0B;AAAA,EACrC,EAAE,MAAM,sBAAsB,MAAM,gBAAgB;AAAA,EACpD,EAAE,MAAM,mBAAmB,MAAM,kBAAkB;AACrD;AAQO,IAAM,cAA2B,CAAC,EAAE,MAAM,KAAK,MAAM,OAAO,CAAC;AAUpE,IAAM,YAAY,QAAQ,IAAI;AAmB9B,SAAS,uBAAsC;AAC7C,MAAI;AACF,UAAM,MAAM;AAAA,MACV,QAAQ;AAAA,MACR;AAAA,QACE;AAAA,QACA;AAAA,MAEF;AAAA,MACA,EAAE,UAAU,QAAQ,SAAS,KAAO,OAAO,CAAC,UAAU,QAAQ,QAAQ,EAAE;AAAA,IAC1E,EAAE,KAAK;AACP,WAAO,QAAQ,KAAK,GAAG,IAAI,MAAM;AAAA,EACnC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAsBA,SAAS,cAAsB;AAC7B,MAAI,UAAW,QAAO;AACtB,QAAM,YAAY,qBAAqB,KAAK;AAC5C,UAAQ,IAAI,qBAAqB;AACjC,SAAO;AACT;AAEA,IAAM,OAAO,YAAY;AAKzB,IAAM,uBAA6C,aAAa;AAAA,EAC9D,SAAS;AAAA,EACT,WAAW;AAAA,EACX,eAAe;AAAA,EACf,YAAY,CAAC,CAAC,QAAQ,IAAI;AAAA,EAC1B,SAAS,QAAQ,IAAI,KAAK,IAAI;AAAA,EAC9B,UAAU,QAAQ,IAAI,KAAK,WAAW;AAAA,EACtC,KAAK;AAAA,IACH,SAAS,oBAAoB,IAAI;AAAA,IACjC,OAAO;AAAA,EACT;AAAA,EACA,UAAU;AAAA,IACR;AAAA,MACE,MAAM;AAAA,MACN,KAAK,EAAE,GAAG,QAAQ,gBAAgB,EAAE;AAAA,IACtC;AAAA,EACF;AAAA,EACA,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAoBT,SAAS,8BAA8B,IAAI;AAAA,IAC3C,KAAK,oBAAoB,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAe7B,qBAAqB;AAAA,IACrB,SAAS;AAAA,EACX;AACF,CAAC;AAED,IAAO,0BAAQ;","names":[]}
+{"version":3,"sources":["../src/configs/playwright-a11y.ts"],"sourcesContent":["import { execFileSync } from \"node:child_process\";\nimport { defineConfig, devices, type PlaywrightTestConfig } from \"@playwright/test\";\n\nexport type A11yRoute = { path: string; name: string };\n\nexport const a11yRoutes: A11yRoute[] = [\n  { path: \"/dev/a11y-fixtures\", name: \"a11y fixtures\" },\n  { path: \"/dev/animate-in\", name: \"animate-in demo\" },\n];\n\n// Routes smoke-loaded for client-side (hydration) errors only — NOT axe-scanned.\n// Catches the class of bug where build + SSR succeed but client hydration throws\n// and blanks the page (data-dynamiq 2026-06-09: a Svelte 4->5 `run()` referenced\n// a `$state` declared after it → TDZ ReferenceError on hydrate). `/` is the one\n// route every site has; real routes carry a11y debt we don't gate on here, so we\n// assert only that they don't crash on hydrate.\nexport const smokeRoutes: A11yRoute[] = [{ path: \"/\", name: \"home\" }];\n\n// R1.1 (health-gate): the central `smoke` audit (src/audits/smoke.ts) allocates\n// a free port and passes it as REDDOOR_SMOKE_PORT so a zombie vite already\n// squatting the default 5173 can't silently hijack the run and green a stale\n// build. The per-site R1.1 config template honors it, but sites whose\n// playwright.config.ts merely re-exports this shared base (pre-R1.1 adopters\n// the smoke-suite recipe flags-but-never-rewrites) would otherwise ignore it —\n// so honor it here too and every re-exporter inherits the port binding on its\n// next package bump. Unset (local `pnpm test:smoke`) → the fixed 5173.\nconst smokePort = process.env.REDDOOR_SMOKE_PORT;\n\n/**\n * Allocate a free port SYNCHRONOUSLY, for the local path where nothing handed\n * us one. Same trick as src/util/free-port.ts (bind :0, read the assigned port,\n * release it) — but that is async, and this value is needed at module scope\n * while Playwright is still building the config object.\n *\n * It cannot be an async default export instead: sites consume this base by\n * SPREADING it (`{ ...base, use: { ...base.use } }` — see the smoke-suite\n * recipe template). Spreading a Promise yields none of its properties, so the\n * site would get a silently empty config — the exact false-green this whole\n * change exists to remove. The export must stay a plain object.\n *\n * A subprocess is the cost of that constraint: ~30-50ms, once per Playwright\n * run. On any failure we return null and the caller falls back to 5173, which\n * (with reuseExistingServer now false) degrades to a loud \"port already in use\"\n * rather than a silent wrong-server run.\n */\nfunction allocateFreePortSync(): string | null {\n  try {\n    const out = execFileSync(\n      process.execPath,\n      [\n        \"-e\",\n        'const s=require(\"node:net\").createServer();s.on(\"error\",()=>process.exit(1));' +\n          's.listen(0,\"127.0.0.1\",()=>{const p=s.address().port;s.close(()=>process.stdout.write(String(p)))});',\n      ],\n      { encoding: \"utf8\", timeout: 5_000, stdio: [\"ignore\", \"pipe\", \"ignore\"] },\n    ).trim();\n    return /^\\d+$/.test(out) ? out : null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Resolve the port this run binds to, ONCE per run rather than once per\n * evaluation of this file.\n *\n * REDDOOR_SMOKE_PORT (the central audit already allocated one) wins; otherwise\n * this run allocates its own. The old fallback was the fixed 5173 — the same\n * port a dev server sits on, which is what let `reuseExistingServer` silently\n * hijack local runs (#524).\n *\n * The allocation is pinned back into the environment, and that is the whole\n * point. Playwright re-evaluates the config file in EVERY worker process, not\n * just the main one. Allocating per evaluation gave each worker a different\n * port: the main process started the dev server on one, every worker aimed\n * `baseURL` at another, and the run died with ERR_CONNECTION_REFUSED against a\n * handful of ports nothing was ever serving. Workers are forked and inherit\n * this environment, so writing it back makes every later evaluation agree.\n *\n * It broke on the site suites and not on `audit --only a11y`, which writes its\n * own config and never reads this file — so nothing here caught it.\n */\nfunction resolvePort(): string {\n  if (smokePort) return smokePort;\n  const allocated = allocateFreePortSync() || \"5173\";\n  process.env.REDDOOR_SMOKE_PORT = allocated;\n  return allocated;\n}\n\nconst port = resolvePort();\n\n// NOTE: default export only — sites consume this as `import base from\n// \"@reddoorla/maintenance/configs/playwright-a11y\"` (or re-export the default).\n// The old `playwrightA11yConfig` named alias had zero importers and was removed.\nconst playwrightA11yConfig: PlaywrightTestConfig = defineConfig({\n  testDir: \"tests\",\n  testMatch: /.*\\.spec\\.ts$/,\n  fullyParallel: true,\n  forbidOnly: !!process.env.CI,\n  retries: process.env.CI ? 2 : 0,\n  reporter: process.env.CI ? \"github\" : \"list\",\n  use: {\n    baseURL: `http://localhost:${port}`,\n    trace: \"on-first-retry\",\n    // Emulate reduced motion fleet-wide: scrollIntoView lands instantly rather\n    // than animating, so Playwright's actionability checks don't flake under\n    // parallel load, and view transitions fall back to instant. Pairs with the\n    // prefers-reduced-motion gate on scroll-behavior in every site's app.css.\n    //\n    // It MUST sit under `contextOptions` — `reducedMotion` is a\n    // BrowserContextOptions member, not a top-level test option. reddoor-starter\n    // carried it at the top level of `use` from 2026-06 until 2026-09-01, where\n    // Playwright silently ignored it (unknown keys are dropped at runtime) and\n    // `pnpm check` never flagged it because svelte-check does not typecheck\n    // playwright.config.ts. The emulation was inert that whole time.\n    contextOptions: { reducedMotion: \"reduce\" as const },\n  },\n  projects: [\n    {\n      name: \"chromium\",\n      use: { ...devices[\"Desktop Chrome\"] },\n    },\n  ],\n  webServer: {\n    // Portable across pnpm and npm sites — pnpm respects `npm run` too.\n    //\n    // `--port ... --strictPort` in BOTH cases. It used to be applied only when\n    // REDDOOR_SMOKE_PORT allocated one, on the reasoning that we should \"fail\n    // loudly rather than let vite drift to a free port the baseURL doesn't\n    // point at\" — but that argument covers the unset case just as well. 5173 is\n    // equally a fixed port that `baseURL` and the readiness probe below are\n    // pinned to, and vite left to itself drifts off it whenever something else\n    // holds it.\n    //\n    // The symptom that exposed this: a non-vite process on 5173 sends vite to\n    // 5174 while the probe keeps polling 5173, so the run dies on\n    // \"Timed out waiting 120000ms from config.webServer\" — 120 seconds of\n    // nothing, naming neither the port nor the squatter. With --strictPort it\n    // is an immediate \"Port 5173 is already in use\".\n    //\n    // --strictPort now only bites if the allocated port is taken in the window\n    // between releasing and binding it, which is exactly the case worth failing\n    // on.\n    command: `npm run vite:dev -- --port ${port} --strictPort`,\n    url: `http://localhost:${port}/dev/a11y-fixtures`,\n    // NEVER reuse (#524). This used to be `!process.env.CI`, so local runs\n    // reused whatever answered the probe URL. The probe only asks \"does this\n    // respond?\" — never \"is this serving the code I am about to test?\" — so a\n    // dev server left open, or one whose tree changed under it after a\n    // checkout, silently became the system under test. That fails in both\n    // directions: a false red blamed on the code (beachfront 2026-08-12, where\n    // it was investigated as a macOS-vs-Linux difference and written up as one\n    // before being caught), and a false green where a passing suite ran against\n    // an old build. CI already had it false, and that asymmetry is precisely\n    // what made the failure read as a platform bug.\n    //\n    // The cost is a fresh vite boot per run (~10-20s against a ~2min suite).\n    // Because the port above is allocated rather than fixed, your own dev\n    // server on 5173 keeps running untouched.\n    reuseExistingServer: false,\n    timeout: 120_000,\n  },\n});\n\nexport default playwrightA11yConfig;\n"],"mappings":";AAAA,SAAS,oBAAoB;AAC7B,SAAS,cAAc,eAA0C;AAI1D,IAAM,aAA0B;AAAA,EACrC,EAAE,MAAM,sBAAsB,MAAM,gBAAgB;AAAA,EACpD,EAAE,MAAM,mBAAmB,MAAM,kBAAkB;AACrD;AAQO,IAAM,cAA2B,CAAC,EAAE,MAAM,KAAK,MAAM,OAAO,CAAC;AAUpE,IAAM,YAAY,QAAQ,IAAI;AAmB9B,SAAS,uBAAsC;AAC7C,MAAI;AACF,UAAM,MAAM;AAAA,MACV,QAAQ;AAAA,MACR;AAAA,QACE;AAAA,QACA;AAAA,MAEF;AAAA,MACA,EAAE,UAAU,QAAQ,SAAS,KAAO,OAAO,CAAC,UAAU,QAAQ,QAAQ,EAAE;AAAA,IAC1E,EAAE,KAAK;AACP,WAAO,QAAQ,KAAK,GAAG,IAAI,MAAM;AAAA,EACnC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAsBA,SAAS,cAAsB;AAC7B,MAAI,UAAW,QAAO;AACtB,QAAM,YAAY,qBAAqB,KAAK;AAC5C,UAAQ,IAAI,qBAAqB;AACjC,SAAO;AACT;AAEA,IAAM,OAAO,YAAY;AAKzB,IAAM,uBAA6C,aAAa;AAAA,EAC9D,SAAS;AAAA,EACT,WAAW;AAAA,EACX,eAAe;AAAA,EACf,YAAY,CAAC,CAAC,QAAQ,IAAI;AAAA,EAC1B,SAAS,QAAQ,IAAI,KAAK,IAAI;AAAA,EAC9B,UAAU,QAAQ,IAAI,KAAK,WAAW;AAAA,EACtC,KAAK;AAAA,IACH,SAAS,oBAAoB,IAAI;AAAA,IACjC,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAYP,gBAAgB,EAAE,eAAe,SAAkB;AAAA,EACrD;AAAA,EACA,UAAU;AAAA,IACR;AAAA,MACE,MAAM;AAAA,MACN,KAAK,EAAE,GAAG,QAAQ,gBAAgB,EAAE;AAAA,IACtC;AAAA,EACF;AAAA,EACA,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAoBT,SAAS,8BAA8B,IAAI;AAAA,IAC3C,KAAK,oBAAoB,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAe7B,qBAAqB;AAAA,IACrB,SAAS;AAAA,EACX;AACF,CAAC;AAED,IAAO,0BAAQ;","names":[]}

package/dist/cli/bin.js

@@ -111,7 +111,7 @@ cli.command("sync-configs [site]", "Sync canonical configs into a site.").option
   'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../sync-configs-ZYLTMUNX.js")).runSyncConfigsCommand(site, opts),
+    async () => (await import("../sync-configs-PVRLZRKL.js")).runSyncConfigsCommand(site, opts),
     opts
   )
 );
@@ -230,14 +230,14 @@ cli.command(
   "--fleet <inventory>",
   'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
-  async (site, opts) => runOrExit(async () => (await import("../init-S4MJ3Y6W.js")).runInitCommand(site, opts), opts)
+  async (site, opts) => runOrExit(async () => (await import("../init-NXZ4NXTL.js")).runInitCommand(site, opts), opts)
 );
 cli.command(
   "launch <site>",
   "Bootstrap + first-audit a site, then draft its launch email for approval."
 ).action(
   async (site, opts) => runOrExit(
-    async () => (await import("../launch-7FT4EYEO.js")).runLaunchCommand(site, opts),
+    async () => (await import("../launch-5V7RLUV7.js")).runLaunchCommand(site, opts),
     opts
   )
 );

package/dist/cli/commands/audit.js

@@ -12,7 +12,7 @@ import {
 import {
   ALL_AUDIT_NAMES,
   runOneAudit
-} from "../../chunk-DFLN2KO3.js";
+} from "../../chunk-QD427NIO.js";
 import "../../chunk-LKGVSM2O.js";
 import "../../chunk-GASBX52O.js";
 import "../../chunk-XHHMM5HX.js";
@@ -35,7 +35,7 @@ import "../../chunk-LBYOLBW7.js";
 import "../../chunk-XXTZBPUY.js";
 import "../../chunk-6VAL7XJT.js";
 import "../../chunk-NMAWXBJA.js";
-import "../../chunk-O3GT46R2.js";
+import "../../chunk-YLYXW5PH.js";
 
 // src/cli/commands/audit.ts
 import { resolve } from "path";

package/dist/configs/eslint.js

@@ -64,7 +64,11 @@ function createEslintConfig(opts) {
         "node_modules/",
         "static/",
         "customtypes/",
-        "src/lib/slices/**/index.js"
+        "src/lib/slices/**/index.js",
+        // Agency process artifacts: git-ignored in every repo, but present on
+        // disk locally, so `pnpm lint` would otherwise try to parse them.
+        "docs/superpowers/",
+        "scratchpad/"
       ]
     }
   ];

package/dist/configs/eslint.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/configs/eslint.ts"],"sourcesContent":["import js from \"@eslint/js\";\nimport ts from \"typescript-eslint\";\nimport svelte from \"eslint-plugin-svelte\";\nimport prettier from \"eslint-config-prettier\";\nimport globals from \"globals\";\nimport type { Linter } from \"eslint\";\n\nexport type CreateEslintConfigOptions = {\n  svelteConfig: unknown;\n};\n\nexport function createEslintConfig(opts: CreateEslintConfigOptions): Linter.Config[] {\n  return [\n    js.configs.recommended,\n    ...ts.configs.recommended,\n    ...svelte.configs.recommended,\n    prettier,\n    ...svelte.configs.prettier,\n    {\n      languageOptions: {\n        globals: {\n          ...globals.browser,\n          ...globals.node,\n        },\n      },\n      rules: {\n        \"@typescript-eslint/no-unused-vars\": [\n          \"error\",\n          {\n            argsIgnorePattern: \"^_\",\n            varsIgnorePattern: \"^_\",\n            caughtErrorsIgnorePattern: \"^_\",\n          },\n        ],\n        \"svelte/no-navigation-without-resolve\": \"off\",\n      },\n    },\n    {\n      files: [\"**/*.svelte\", \"**/*.svelte.js\", \"**/*.svelte.ts\"],\n      languageOptions: {\n        parserOptions: {\n          parser: ts.parser,\n          svelteConfig: opts.svelteConfig,\n        },\n      },\n    },\n    {\n      // eslint-plugin-svelte 3.20+ allows only an `error` prop in +error.svelte,\n      // but SvelteKit really does pass merged layout `data` to error pages\n      // (typed by hand since kit generates no ./$types for +error). The rule\n      // takes no options (schema: []), so scope it off for error pages only.\n      files: [\"**/+error.svelte\"],\n      rules: {\n        \"svelte/valid-prop-names-in-kit-pages\": \"off\",\n      },\n    },\n    {\n      files: [\"**/*.d.ts\"],\n      rules: {\n        \"no-var\": \"off\",\n        \"@typescript-eslint/no-unused-vars\": \"off\",\n      },\n    },\n    {\n      ignores: [\n        \"build/\",\n        \".svelte-kit/\",\n        \".netlify/\",\n        \"node_modules/\",\n        \"static/\",\n        \"customtypes/\",\n        \"src/lib/slices/**/index.js\",\n      ],\n    },\n  ] as Linter.Config[];\n}\n\nexport default createEslintConfig;\n"],"mappings":";AAAA,OAAO,QAAQ;AACf,OAAO,QAAQ;AACf,OAAO,YAAY;AACnB,OAAO,cAAc;AACrB,OAAO,aAAa;AAOb,SAAS,mBAAmB,MAAkD;AACnF,SAAO;AAAA,IACL,GAAG,QAAQ;AAAA,IACX,GAAG,GAAG,QAAQ;AAAA,IACd,GAAG,OAAO,QAAQ;AAAA,IAClB;AAAA,IACA,GAAG,OAAO,QAAQ;AAAA,IAClB;AAAA,MACE,iBAAiB;AAAA,QACf,SAAS;AAAA,UACP,GAAG,QAAQ;AAAA,UACX,GAAG,QAAQ;AAAA,QACb;AAAA,MACF;AAAA,MACA,OAAO;AAAA,QACL,qCAAqC;AAAA,UACnC;AAAA,UACA;AAAA,YACE,mBAAmB;AAAA,YACnB,mBAAmB;AAAA,YACnB,2BAA2B;AAAA,UAC7B;AAAA,QACF;AAAA,QACA,wCAAwC;AAAA,MAC1C;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAO,CAAC,eAAe,kBAAkB,gBAAgB;AAAA,MACzD,iBAAiB;AAAA,QACf,eAAe;AAAA,UACb,QAAQ,GAAG;AAAA,UACX,cAAc,KAAK;AAAA,QACrB;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA;AAAA;AAAA;AAAA;AAAA,MAKE,OAAO,CAAC,kBAAkB;AAAA,MAC1B,OAAO;AAAA,QACL,wCAAwC;AAAA,MAC1C;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAO,CAAC,WAAW;AAAA,MACnB,OAAO;AAAA,QACL,UAAU;AAAA,QACV,qCAAqC;AAAA,MACvC;AAAA,IACF;AAAA,IACA;AAAA,MACE,SAAS;AAAA,QACP;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAO,iBAAQ;","names":[]}
+{"version":3,"sources":["../../src/configs/eslint.ts"],"sourcesContent":["import js from \"@eslint/js\";\nimport ts from \"typescript-eslint\";\nimport svelte from \"eslint-plugin-svelte\";\nimport prettier from \"eslint-config-prettier\";\nimport globals from \"globals\";\nimport type { Linter } from \"eslint\";\n\nexport type CreateEslintConfigOptions = {\n  svelteConfig: unknown;\n};\n\nexport function createEslintConfig(opts: CreateEslintConfigOptions): Linter.Config[] {\n  return [\n    js.configs.recommended,\n    ...ts.configs.recommended,\n    ...svelte.configs.recommended,\n    prettier,\n    ...svelte.configs.prettier,\n    {\n      languageOptions: {\n        globals: {\n          ...globals.browser,\n          ...globals.node,\n        },\n      },\n      rules: {\n        \"@typescript-eslint/no-unused-vars\": [\n          \"error\",\n          {\n            argsIgnorePattern: \"^_\",\n            varsIgnorePattern: \"^_\",\n            caughtErrorsIgnorePattern: \"^_\",\n          },\n        ],\n        \"svelte/no-navigation-without-resolve\": \"off\",\n      },\n    },\n    {\n      files: [\"**/*.svelte\", \"**/*.svelte.js\", \"**/*.svelte.ts\"],\n      languageOptions: {\n        parserOptions: {\n          parser: ts.parser,\n          svelteConfig: opts.svelteConfig,\n        },\n      },\n    },\n    {\n      // eslint-plugin-svelte 3.20+ allows only an `error` prop in +error.svelte,\n      // but SvelteKit really does pass merged layout `data` to error pages\n      // (typed by hand since kit generates no ./$types for +error). The rule\n      // takes no options (schema: []), so scope it off for error pages only.\n      files: [\"**/+error.svelte\"],\n      rules: {\n        \"svelte/valid-prop-names-in-kit-pages\": \"off\",\n      },\n    },\n    {\n      files: [\"**/*.d.ts\"],\n      rules: {\n        \"no-var\": \"off\",\n        \"@typescript-eslint/no-unused-vars\": \"off\",\n      },\n    },\n    {\n      ignores: [\n        \"build/\",\n        \".svelte-kit/\",\n        \".netlify/\",\n        \"node_modules/\",\n        \"static/\",\n        \"customtypes/\",\n        \"src/lib/slices/**/index.js\",\n        // Agency process artifacts: git-ignored in every repo, but present on\n        // disk locally, so `pnpm lint` would otherwise try to parse them.\n        \"docs/superpowers/\",\n        \"scratchpad/\",\n      ],\n    },\n  ] as Linter.Config[];\n}\n\nexport default createEslintConfig;\n"],"mappings":";AAAA,OAAO,QAAQ;AACf,OAAO,QAAQ;AACf,OAAO,YAAY;AACnB,OAAO,cAAc;AACrB,OAAO,aAAa;AAOb,SAAS,mBAAmB,MAAkD;AACnF,SAAO;AAAA,IACL,GAAG,QAAQ;AAAA,IACX,GAAG,GAAG,QAAQ;AAAA,IACd,GAAG,OAAO,QAAQ;AAAA,IAClB;AAAA,IACA,GAAG,OAAO,QAAQ;AAAA,IAClB;AAAA,MACE,iBAAiB;AAAA,QACf,SAAS;AAAA,UACP,GAAG,QAAQ;AAAA,UACX,GAAG,QAAQ;AAAA,QACb;AAAA,MACF;AAAA,MACA,OAAO;AAAA,QACL,qCAAqC;AAAA,UACnC;AAAA,UACA;AAAA,YACE,mBAAmB;AAAA,YACnB,mBAAmB;AAAA,YACnB,2BAA2B;AAAA,UAC7B;AAAA,QACF;AAAA,QACA,wCAAwC;AAAA,MAC1C;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAO,CAAC,eAAe,kBAAkB,gBAAgB;AAAA,MACzD,iBAAiB;AAAA,QACf,eAAe;AAAA,UACb,QAAQ,GAAG;AAAA,UACX,cAAc,KAAK;AAAA,QACrB;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA;AAAA;AAAA;AAAA;AAAA,MAKE,OAAO,CAAC,kBAAkB;AAAA,MAC1B,OAAO;AAAA,QACL,wCAAwC;AAAA,MAC1C;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAO,CAAC,WAAW;AAAA,MACnB,OAAO;AAAA,QACL,UAAU;AAAA,QACV,qCAAqC;AAAA,MACvC;AAAA,IACF;AAAA,IACA;AAAA,MACE,SAAS;AAAA,QACP;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA;AAAA;AAAA,QAGA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAO,iBAAQ;","names":[]}

package/dist/configs/playwright-a11y.js

@@ -2,7 +2,7 @@ import {
   a11yRoutes,
   playwright_a11y_default,
   smokeRoutes
-} from "../chunk-O3GT46R2.js";
+} from "../chunk-YLYXW5PH.js";
 export {
   a11yRoutes,
   playwright_a11y_default as default,

package/dist/index.js

@@ -10,7 +10,7 @@ import {
   DEFAULT_INIT_STEPS,
   a11yFixturesPage,
   init
-} from "./chunk-DCDF5A7N.js";
+} from "./chunk-UXJZU23T.js";
 import {
   convertToPnpm
 } from "./chunk-XIDUYLSR.js";
@@ -84,7 +84,7 @@ import {
 import "./chunk-WEKL2HYJ.js";
 import {
   syncConfigs
-} from "./chunk-DXWLWR4Q.js";
+} from "./chunk-A6T2R63Z.js";
 import "./chunk-3G25KIWW.js";
 import "./chunk-MLT4QY5X.js";
 import "./chunk-OTGB6YQO.js";
@@ -96,7 +96,7 @@ import {
   runAudits,
   runAuditsAcross,
   securityAudit
-} from "./chunk-DFLN2KO3.js";
+} from "./chunk-QD427NIO.js";
 import "./chunk-LKGVSM2O.js";
 import "./chunk-GASBX52O.js";
 import "./chunk-XHHMM5HX.js";
@@ -122,7 +122,7 @@ import "./chunk-LBYOLBW7.js";
 import "./chunk-XXTZBPUY.js";
 import "./chunk-6VAL7XJT.js";
 import "./chunk-NMAWXBJA.js";
-import "./chunk-O3GT46R2.js";
+import "./chunk-YLYXW5PH.js";
 
 // src/recipes/index.ts
 var ALL_RECIPE_NAMES = [

package/dist/{init-S4MJ3Y6W.js → init-NXZ4NXTL.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-Q47DU255.js";
 import {
   init
-} from "./chunk-DCDF5A7N.js";
+} from "./chunk-UXJZU23T.js";
 import "./chunk-XIDUYLSR.js";
 import "./chunk-IYSEC543.js";
 import "./chunk-J7SZQUCW.js";
@@ -16,11 +16,11 @@ import "./chunk-BQRFQSGY.js";
 import "./chunk-Y53WOQIJ.js";
 import "./chunk-7RJ2HMMJ.js";
 import "./chunk-R53VL3RI.js";
-import "./chunk-DXWLWR4Q.js";
+import "./chunk-A6T2R63Z.js";
 import "./chunk-3G25KIWW.js";
 import "./chunk-MLT4QY5X.js";
 import "./chunk-OTGB6YQO.js";
-import "./chunk-DFLN2KO3.js";
+import "./chunk-QD427NIO.js";
 import "./chunk-LKGVSM2O.js";
 import "./chunk-GASBX52O.js";
 import "./chunk-XHHMM5HX.js";
@@ -37,7 +37,7 @@ import {
   siteLabel
 } from "./chunk-XXTZBPUY.js";
 import "./chunk-NMAWXBJA.js";
-import "./chunk-O3GT46R2.js";
+import "./chunk-YLYXW5PH.js";
 
 // src/cli/commands/init.ts
 import { resolve } from "path";
@@ -110,4 +110,4 @@ async function runInitCommand(site, opts) {
 export {
   runInitCommand
 };
-//# sourceMappingURL=init-S4MJ3Y6W.js.map
+//# sourceMappingURL=init-NXZ4NXTL.js.map

package/dist/{launch-7FT4EYEO.js → launch-5V7RLUV7.js}

@@ -42,7 +42,7 @@ import {
 import "./chunk-MLT4QY5X.js";
 import {
   runAudits
-} from "./chunk-DFLN2KO3.js";
+} from "./chunk-QD427NIO.js";
 import "./chunk-LKGVSM2O.js";
 import "./chunk-GASBX52O.js";
 import "./chunk-XHHMM5HX.js";
@@ -60,7 +60,7 @@ import {
 } from "./chunk-XXTZBPUY.js";
 import "./chunk-6VAL7XJT.js";
 import "./chunk-NMAWXBJA.js";
-import "./chunk-O3GT46R2.js";
+import "./chunk-YLYXW5PH.js";
 
 // src/cli/commands/launch.ts
 import { resolve } from "path";
@@ -252,4 +252,4 @@ async function runLaunchCommand(site, opts) {
 export {
   runLaunchCommand
 };
-//# sourceMappingURL=launch-7FT4EYEO.js.map
+//# sourceMappingURL=launch-5V7RLUV7.js.map

package/dist/recipes/sync-configs.js

@@ -3,7 +3,7 @@ import {
   isConfigName,
   planTemplateDiffs,
   syncConfigs
-} from "../chunk-DXWLWR4Q.js";
+} from "../chunk-A6T2R63Z.js";
 import "../chunk-3G25KIWW.js";
 import "../chunk-MLT4QY5X.js";
 import "../chunk-XTK5VIQB.js";

package/dist/{sync-configs-ZYLTMUNX.js → sync-configs-PVRLZRKL.js}

@@ -16,7 +16,7 @@ import {
   mergeGitignore,
   planTemplateDiffs,
   syncConfigs
-} from "./chunk-DXWLWR4Q.js";
+} from "./chunk-A6T2R63Z.js";
 import "./chunk-3G25KIWW.js";
 import {
   ALL_TEMPLATES,
@@ -107,4 +107,4 @@ async function runSyncConfigsCommand(site, opts) {
 export {
   runSyncConfigsCommand
 };
-//# sourceMappingURL=sync-configs-ZYLTMUNX.js.map
+//# sourceMappingURL=sync-configs-PVRLZRKL.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reddoorla/maintenance",
-  "version": "0.90.0",
+  "version": "0.90.1",
   "description": "Canonical maintenance configs, audits, and recipes for the reddoor stack.",
   "type": "module",
   "license": "MIT",

package/dist/chunk-DXWLWR4Q.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/recipes/sync-configs.ts","../src/recipes/sync-configs/gitignore.ts"],"sourcesContent":["import { readFile, writeFile, mkdir } from \"node:fs/promises\";\nimport { join, dirname } from \"node:path\";\nimport type { RecipeResult, Site, ConfigName } from \"../types.js\";\nimport { ALL_TEMPLATES, templatesByName, type ConfigTemplate } from \"./sync-configs/templates.js\";\nimport {\n  CANONICAL_GITIGNORE_ENTRIES,\n  mergeGitignore,\n  findTrackedArtifacts,\n} from \"./sync-configs/gitignore.js\";\nimport { listTrackedFiles, removeFromIndex } from \"../util/git.js\";\nimport { withRecipe } from \"./_with-recipe.js\";\nimport {\n  renovateActionGaps,\n  withRenovatePinsFrom,\n  RENOVATE_ACTION_CONFIG,\n} from \"./sync-configs/renovate-action.js\";\n\nexport type SyncConfigsOptions = {\n  which?: ConfigName[];\n};\n\nconst GITIGNORE_CONFIG: ConfigName = \"gitignore\";\nconst SVELTE_CONFIG: ConfigName = \"svelte\";\nconst NETLIFY_CONFIG: ConfigName = \"netlify\";\n\n/** A site's `svelte.config.js` is \"compliant\" — and left untouched by sync —\n * once it builds on the canonical helpers (createSvelteConfig + adapter-netlify).\n *\n * Unlike the other exact-match templates, svelte.config legitimately carries\n * site-specific `kit.alias` and `compilerOptions`; an exact overwrite would\n * clobber those on every sync (it silently dropped MSOT's $utils alias,\n * 2026-06-04). So once a config is on the canonical pattern we preserve it as-is\n * and only rewrite a genuinely off-pattern (or missing) config. `createSvelteConfig`\n * now provides the canonical `$lib` aliases itself, and a site's own `kit.alias`\n * overrides per key (and may add more), so a site's additive customization is safe\n * to preserve. */\nfunction isSvelteConfigCompliant(contents: string): boolean {\n  // Not on the canonical adapter (a missing file, or `adapter-auto` from a\n  // stock `npm create svelte`) => bring it to the template.\n  if (!contents.includes(\"@sveltejs/adapter-netlify\")) return false;\n  // The canonical shape: the helper supplies fleet aliases, the warning filter\n  // and CSP defaults.\n  if (contents.includes(\"createSvelteConfig\")) return true;\n  // A hand-authored config with its own `kit` block is deliberate customization,\n  // not drift. Requiring the helper string treated four live sites as off-pattern\n  // — the-pointe-burbank (151 lines), beachfront-dentistry (241), 1836dig,\n  // data-dynamiq — plus reddoor-starter, whose placeholder-repo prerender\n  // tolerance is the only reason a freshly cloned site builds green. Replacing\n  // any of those with the 8-line template is the clobbering bug this predicate\n  // exists to prevent (MSOT's $utils aliases, 2026-06-04), not a fix for it.\n  // A stub with no `kit` config at all still gets the template.\n  return /\\bkit\\s*:/.test(contents);\n}\n\n/** Any of the baseline security headers — the marker that a netlify.toml is\n * deliberately hardened (vs. e.g. a cache-control-only `[[headers]]` block). */\nconst SECURITY_HEADER_RE =\n  /Strict-Transport-Security|Content-Security-Policy|X-Frame-Options|X-Content-Type-Options|Referrer-Policy|Permissions-Policy|Cross-Origin-Opener-Policy/i;\n\n/** A site's `netlify.toml` is \"compliant\" — and left untouched by sync — once it\n * carries a `[[headers]]` block AND a security header (HSTS/CSP/X-Frame-Options/…).\n *\n * Like svelte.config, netlify.toml legitimately holds site-specific config\n * (custom CSP, redirects, per-route headers). The canonical template ships the\n * baseline security headers, but an exact overwrite would CLOBBER a site's own\n * hardening — that bug stripped gallerysonder's headers on a routine sync\n * (2026-06-10). So a genuinely-hardened file is left alone, while a missing,\n * header-less (previously-stripped), OR merely cache-header file is non-compliant\n * and gets the canonical template, which backfills the security baseline. */\nfunction isNetlifyConfigCompliant(contents: string): boolean {\n  return contents.includes(\"[[headers]]\") && SECURITY_HEADER_RE.test(contents);\n}\n\n/** Runtime enumeration of every `ConfigName`. Mirror of the union in\n * `src/types.ts`. Used by CLI `--only` validation; a missing entry would\n * silently accept typos. The type-test in `tests/types.test.ts` guards\n * against drift between this array and the union. */\nexport const ALL_CONFIG_NAMES: ConfigName[] = [\n  \"lighthouse\",\n  \"eslint\",\n  \"prettier\",\n  \"prettier-ignore\",\n  \"playwright-a11y\",\n  \"svelte\",\n  \"gitignore\",\n  \"renovate-action\",\n  \"renovate-config\",\n  \"netlify\",\n];\n\nexport function isConfigName(value: string): value is ConfigName {\n  return (ALL_CONFIG_NAMES as string[]).includes(value);\n}\n\nasync function readMaybe(path: string): Promise<string | null> {\n  try {\n    return await readFile(path, \"utf-8\");\n  } catch {\n    return null;\n  }\n}\n\nexport async function planTemplateDiffs(\n  cwd: string,\n  templates: ConfigTemplate[],\n): Promise<ConfigTemplate[]> {\n  const diffs: ConfigTemplate[] = [];\n  for (const t of templates) {\n    const existing = await readMaybe(join(cwd, t.path));\n    if (existing === t.contents) continue;\n    // svelte.config is compliance-checked, not exact-matched: an existing config\n    // already on the canonical pattern is left alone so its aliases/compilerOptions\n    // survive. A missing (null) or off-pattern config still gets the canonical template.\n    if (t.config === SVELTE_CONFIG && existing !== null && isSvelteConfigCompliant(existing)) {\n      continue;\n    }\n    // netlify.toml is likewise compliance-checked: a file that already carries\n    // `[[headers]]` is hardened and left alone (an exact overwrite would strip\n    // its security headers). A header-less / missing file gets the template.\n    if (t.config === NETLIFY_CONFIG && existing !== null && isNetlifyConfigCompliant(existing)) {\n      continue;\n    }\n    // renovate.yml is likewise compliance-checked, not byte-matched: Renovate\n    // legitimately bumps its own digest pins forward (an exact overwrite would\n    // DOWNGRADE them — reddoorla/reddoor-starter-blux#1, 2026-08-31), and a\n    // site's prettier may legitimately quote the cron / RENOVATE_* scalars\n    // differently than the template (both forms are prettier-clean, so\n    // prettier never converges them — issue #651). A file with zero\n    // `renovateActionGaps` is left alone.\n    if (\n      t.config === RENOVATE_ACTION_CONFIG &&\n      existing !== null &&\n      renovateActionGaps(existing).length === 0\n    ) {\n      continue;\n    }\n    // When renovate.yml genuinely IS non-compliant, heal it with the template\n    // but carry the site's own (still-digest-pinned) action refs forward onto\n    // it first — writing the template verbatim would re-introduce the same\n    // pin downgrade this compliance check exists to prevent.\n    if (t.config === RENOVATE_ACTION_CONFIG) {\n      diffs.push({ ...t, contents: withRenovatePinsFrom(t.contents, existing) });\n      continue;\n    }\n    diffs.push(t);\n  }\n  return diffs;\n}\n\ntype GitignorePlan =\n  { kind: \"noop\" } | { kind: \"apply\"; content: string; toUntrack: string[]; added: string[] };\n\nasync function planGitignore(cwd: string): Promise<GitignorePlan> {\n  const existing = await readMaybe(join(cwd, \".gitignore\"));\n  const merge = mergeGitignore(existing, CANONICAL_GITIGNORE_ENTRIES);\n  const tracked = await listTrackedFiles(cwd);\n  const toUntrack = findTrackedArtifacts(tracked, CANONICAL_GITIGNORE_ENTRIES);\n  if (merge.added.length === 0 && toUntrack.length === 0) return { kind: \"noop\" };\n  return { kind: \"apply\", content: merge.content, toUntrack, added: merge.added };\n}\n\nasync function applyGitignore(\n  cwd: string,\n  plan: Extract<GitignorePlan, { kind: \"apply\" }>,\n): Promise<void> {\n  await writeFile(join(cwd, \".gitignore\"), plan.content, \"utf-8\");\n  if (plan.toUntrack.length > 0) {\n    await removeFromIndex(cwd, plan.toUntrack);\n  }\n}\n\nexport async function syncConfigs(\n  site: Site,\n  opts: SyncConfigsOptions = {},\n): Promise<RecipeResult> {\n  const requested = opts.which ?? ALL_TEMPLATES.map((t) => t.config).concat(GITIGNORE_CONFIG);\n  const templateNames = requested.filter((c): c is ConfigName => c !== GITIGNORE_CONFIG);\n  const templates = templatesByName(templateNames);\n  const includeGitignore = requested.includes(GITIGNORE_CONFIG);\n\n  return withRecipe({\n    name: \"sync-configs\",\n    site,\n    plan: async () => {\n      const templateDiffs = await planTemplateDiffs(site.path, templates);\n      const gitignorePlan: GitignorePlan = includeGitignore\n        ? await planGitignore(site.path)\n        : { kind: \"noop\" };\n      if (templateDiffs.length === 0 && gitignorePlan.kind === \"noop\") {\n        return { kind: \"noop\", notes: \"all targeted configs already match\" };\n      }\n      return { kind: \"apply\", plan: { templateDiffs, gitignorePlan } };\n    },\n    apply: async ({ templateDiffs, gitignorePlan }, { commit }) => {\n      for (const t of templateDiffs) {\n        const dest = join(site.path, t.path);\n        await mkdir(dirname(dest), { recursive: true });\n        await writeFile(dest, t.contents, \"utf-8\");\n        await commit(`chore: sync ${t.config} config from @reddoorla/maintenance`);\n      }\n      if (gitignorePlan.kind === \"apply\") {\n        await applyGitignore(site.path, gitignorePlan);\n        await commit(`chore: sync gitignore from @reddoorla/maintenance`);\n      }\n      return { kind: \"ok\" };\n    },\n  });\n}\n","/**\n * Comment line written above the appended block so future runs (and humans)\n * can recognize the managed section. Presence of this line is incidental —\n * the merge logic is keyed on each entry's normalized form, not on the marker.\n */\nexport const MANAGED_MARKER = \"# canonical entries from @reddoorla/maintenance sync-configs\";\n\n/**\n * Build artifacts, test outputs, deploy caches, and secrets that should never\n * be tracked across the reddoor fleet. Sites may keep additional site-specific\n * entries — they are preserved on merge.\n */\nexport const CANONICAL_GITIGNORE_ENTRIES: readonly string[] = [\n  \"node_modules/\",\n  \"build/\",\n  \"dist/\",\n  \".svelte-kit/\",\n  \"coverage/\",\n  \".vitest-cache/\",\n  \"playwright-report/\",\n  \"test-results/\",\n  \".lighthouseci/\",\n  \".tsbuildinfo\",\n  \".env\",\n  \".env.*\",\n  \"!.env.example\",\n  \".DS_Store\",\n  \"*.log\",\n  \".vercel/\",\n  \".netlify/\",\n  \".reddoor-a11y/\",\n  // The a11y audit's transient spec dir, written inside the checkout and\n  // normally cleaned, but a timeout-SIGKILL of the parent orphans it. Ignored\n  // fleet-wide so it never dirties a self-updating repo's tree (2026-06-10 M-D).\n  \".reddoor-a11y-spec-*/\",\n];\n\nexport type MergeResult = { content: string; added: string[] };\n\nfunction stripLeadingSlash(s: string): string {\n  return s.startsWith(\"/\") ? s.slice(1) : s;\n}\n\nfunction stripTrailingSlash(s: string): string {\n  return s.endsWith(\"/\") ? s.slice(0, -1) : s;\n}\n\n/**\n * Normalize for presence comparison only: strip leading `/`, trailing `/`,\n * and surrounding whitespace. `build`, `/build`, `build/`, and `/build/` all\n * collapse to the same key.\n */\nfunction normalizePresence(line: string): string {\n  return stripTrailingSlash(stripLeadingSlash(line.trim()));\n}\n\nfunction presentSet(existing: string): Set<string> {\n  const set = new Set<string>();\n  for (const raw of existing.split(/\\r?\\n/)) {\n    const trimmed = raw.trim();\n    if (!trimmed) continue;\n    if (trimmed.startsWith(\"#\")) continue;\n    set.add(normalizePresence(trimmed));\n  }\n  return set;\n}\n\n/**\n * Merge `canonical` entries into `existing` .gitignore content.\n *\n * - Missing entries are appended under a managed marker comment.\n * - Existing entries (in any normalized variant — `/build`, `build/`, etc.)\n *   are preserved as-is; we never rewrite the site's own lines.\n * - When every canonical entry is already present, returns the original\n *   content unchanged with `added: []` — the recipe can treat that as noop.\n */\nexport function mergeGitignore(existing: string | null, canonical: readonly string[]): MergeResult {\n  if (existing === null) {\n    const body = [MANAGED_MARKER, ...canonical].join(\"\\n\") + \"\\n\";\n    return { content: body, added: [...canonical] };\n  }\n  const present = presentSet(existing);\n  const added: string[] = [];\n  for (const entry of canonical) {\n    const norm = normalizePresence(entry);\n    if (!present.has(norm)) {\n      added.push(entry);\n      present.add(norm);\n    }\n  }\n  if (added.length === 0) {\n    return { content: existing, added: [] };\n  }\n  let base = existing;\n  if (!base.endsWith(\"\\n\")) base += \"\\n\";\n  const block = [\"\", MANAGED_MARKER, ...added].join(\"\\n\") + \"\\n\";\n  return { content: base + block, added };\n}\n\n/**\n * Of the tracked paths, return those that fall under a canonical *directory*\n * entry — i.e., paths that the freshly-synced .gitignore now wants ignored\n * but which git currently has in the index.\n *\n * File-pattern entries (`.env`, `*.log`, `.DS_Store`) are intentionally\n * skipped: they may contain user-meaningful data, and `git rm --cached`\n * cannot scrub secrets from history anyway. Surfaced for manual review\n * instead of auto-removing.\n */\nexport function findTrackedArtifacts(\n  tracked: readonly string[],\n  canonical: readonly string[],\n): string[] {\n  const dirEntries: string[] = [];\n  for (const raw of canonical) {\n    const t = raw.trim();\n    if (!t) continue;\n    if (t.startsWith(\"!\")) continue;\n    if (/[*?[]/.test(t)) continue;\n    const noLead = stripLeadingSlash(t);\n    if (!noLead.endsWith(\"/\")) continue;\n    const name = stripTrailingSlash(noLead);\n    if (!name) continue;\n    dirEntries.push(name);\n  }\n  const matched: string[] = [];\n  for (const path of tracked) {\n    for (const dir of dirEntries) {\n      if (path === dir || path.startsWith(dir + \"/\")) {\n        matched.push(path);\n        break;\n      }\n    }\n  }\n  return matched;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAAA,SAAS,UAAU,WAAW,aAAa;AAC3C,SAAS,MAAM,eAAe;;;ACIvB,IAAM,iBAAiB;AAOvB,IAAM,8BAAiD;AAAA,EAC5D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAIA;AACF;AAIA,SAAS,kBAAkB,GAAmB;AAC5C,SAAO,EAAE,WAAW,GAAG,IAAI,EAAE,MAAM,CAAC,IAAI;AAC1C;AAEA,SAAS,mBAAmB,GAAmB;AAC7C,SAAO,EAAE,SAAS,GAAG,IAAI,EAAE,MAAM,GAAG,EAAE,IAAI;AAC5C;AAOA,SAAS,kBAAkB,MAAsB;AAC/C,SAAO,mBAAmB,kBAAkB,KAAK,KAAK,CAAC,CAAC;AAC1D;AAEA,SAAS,WAAW,UAA+B;AACjD,QAAM,MAAM,oBAAI,IAAY;AAC5B,aAAW,OAAO,SAAS,MAAM,OAAO,GAAG;AACzC,UAAM,UAAU,IAAI,KAAK;AACzB,QAAI,CAAC,QAAS;AACd,QAAI,QAAQ,WAAW,GAAG,EAAG;AAC7B,QAAI,IAAI,kBAAkB,OAAO,CAAC;AAAA,EACpC;AACA,SAAO;AACT;AAWO,SAAS,eAAe,UAAyB,WAA2C;AACjG,MAAI,aAAa,MAAM;AACrB,UAAM,OAAO,CAAC,gBAAgB,GAAG,SAAS,EAAE,KAAK,IAAI,IAAI;AACzD,WAAO,EAAE,SAAS,MAAM,OAAO,CAAC,GAAG,SAAS,EAAE;AAAA,EAChD;AACA,QAAM,UAAU,WAAW,QAAQ;AACnC,QAAM,QAAkB,CAAC;AACzB,aAAW,SAAS,WAAW;AAC7B,UAAM,OAAO,kBAAkB,KAAK;AACpC,QAAI,CAAC,QAAQ,IAAI,IAAI,GAAG;AACtB,YAAM,KAAK,KAAK;AAChB,cAAQ,IAAI,IAAI;AAAA,IAClB;AAAA,EACF;AACA,MAAI,MAAM,WAAW,GAAG;AACtB,WAAO,EAAE,SAAS,UAAU,OAAO,CAAC,EAAE;AAAA,EACxC;AACA,MAAI,OAAO;AACX,MAAI,CAAC,KAAK,SAAS,IAAI,EAAG,SAAQ;AAClC,QAAM,QAAQ,CAAC,IAAI,gBAAgB,GAAG,KAAK,EAAE,KAAK,IAAI,IAAI;AAC1D,SAAO,EAAE,SAAS,OAAO,OAAO,MAAM;AACxC;AAYO,SAAS,qBACd,SACA,WACU;AACV,QAAM,aAAuB,CAAC;AAC9B,aAAW,OAAO,WAAW;AAC3B,UAAM,IAAI,IAAI,KAAK;AACnB,QAAI,CAAC,EAAG;AACR,QAAI,EAAE,WAAW,GAAG,EAAG;AACvB,QAAI,QAAQ,KAAK,CAAC,EAAG;AACrB,UAAM,SAAS,kBAAkB,CAAC;AAClC,QAAI,CAAC,OAAO,SAAS,GAAG,EAAG;AAC3B,UAAM,OAAO,mBAAmB,MAAM;AACtC,QAAI,CAAC,KAAM;AACX,eAAW,KAAK,IAAI;AAAA,EACtB;AACA,QAAM,UAAoB,CAAC;AAC3B,aAAW,QAAQ,SAAS;AAC1B,eAAW,OAAO,YAAY;AAC5B,UAAI,SAAS,OAAO,KAAK,WAAW,MAAM,GAAG,GAAG;AAC9C,gBAAQ,KAAK,IAAI;AACjB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;;;ADlHA,IAAM,mBAA+B;AACrC,IAAM,gBAA4B;AAClC,IAAM,iBAA6B;AAanC,SAAS,wBAAwB,UAA2B;AAG1D,MAAI,CAAC,SAAS,SAAS,2BAA2B,EAAG,QAAO;AAG5D,MAAI,SAAS,SAAS,oBAAoB,EAAG,QAAO;AASpD,SAAO,YAAY,KAAK,QAAQ;AAClC;AAIA,IAAM,qBACJ;AAYF,SAAS,yBAAyB,UAA2B;AAC3D,SAAO,SAAS,SAAS,aAAa,KAAK,mBAAmB,KAAK,QAAQ;AAC7E;AAMO,IAAM,mBAAiC;AAAA,EAC5C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,SAAS,aAAa,OAAoC;AAC/D,SAAQ,iBAA8B,SAAS,KAAK;AACtD;AAEA,eAAe,UAAU,MAAsC;AAC7D,MAAI;AACF,WAAO,MAAM,SAAS,MAAM,OAAO;AAAA,EACrC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,kBACpB,KACA,WAC2B;AAC3B,QAAM,QAA0B,CAAC;AACjC,aAAW,KAAK,WAAW;AACzB,UAAM,WAAW,MAAM,UAAU,KAAK,KAAK,EAAE,IAAI,CAAC;AAClD,QAAI,aAAa,EAAE,SAAU;AAI7B,QAAI,EAAE,WAAW,iBAAiB,aAAa,QAAQ,wBAAwB,QAAQ,GAAG;AACxF;AAAA,IACF;AAIA,QAAI,EAAE,WAAW,kBAAkB,aAAa,QAAQ,yBAAyB,QAAQ,GAAG;AAC1F;AAAA,IACF;AAQA,QACE,EAAE,WAAW,0BACb,aAAa,QACb,mBAAmB,QAAQ,EAAE,WAAW,GACxC;AACA;AAAA,IACF;AAKA,QAAI,EAAE,WAAW,wBAAwB;AACvC,YAAM,KAAK,EAAE,GAAG,GAAG,UAAU,qBAAqB,EAAE,UAAU,QAAQ,EAAE,CAAC;AACzE;AAAA,IACF;AACA,UAAM,KAAK,CAAC;AAAA,EACd;AACA,SAAO;AACT;AAKA,eAAe,cAAc,KAAqC;AAChE,QAAM,WAAW,MAAM,UAAU,KAAK,KAAK,YAAY,CAAC;AACxD,QAAM,QAAQ,eAAe,UAAU,2BAA2B;AAClE,QAAM,UAAU,MAAM,iBAAiB,GAAG;AAC1C,QAAM,YAAY,qBAAqB,SAAS,2BAA2B;AAC3E,MAAI,MAAM,MAAM,WAAW,KAAK,UAAU,WAAW,EAAG,QAAO,EAAE,MAAM,OAAO;AAC9E,SAAO,EAAE,MAAM,SAAS,SAAS,MAAM,SAAS,WAAW,OAAO,MAAM,MAAM;AAChF;AAEA,eAAe,eACb,KACA,MACe;AACf,QAAM,UAAU,KAAK,KAAK,YAAY,GAAG,KAAK,SAAS,OAAO;AAC9D,MAAI,KAAK,UAAU,SAAS,GAAG;AAC7B,UAAM,gBAAgB,KAAK,KAAK,SAAS;AAAA,EAC3C;AACF;AAEA,eAAsB,YACpB,MACA,OAA2B,CAAC,GACL;AACvB,QAAM,YAAY,KAAK,SAAS,cAAc,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,gBAAgB;AAC1F,QAAM,gBAAgB,UAAU,OAAO,CAAC,MAAuB,MAAM,gBAAgB;AACrF,QAAM,YAAY,gBAAgB,aAAa;AAC/C,QAAM,mBAAmB,UAAU,SAAS,gBAAgB;AAE5D,SAAO,WAAW;AAAA,IAChB,MAAM;AAAA,IACN;AAAA,IACA,MAAM,YAAY;AAChB,YAAM,gBAAgB,MAAM,kBAAkB,KAAK,MAAM,SAAS;AAClE,YAAM,gBAA+B,mBACjC,MAAM,cAAc,KAAK,IAAI,IAC7B,EAAE,MAAM,OAAO;AACnB,UAAI,cAAc,WAAW,KAAK,cAAc,SAAS,QAAQ;AAC/D,eAAO,EAAE,MAAM,QAAQ,OAAO,qCAAqC;AAAA,MACrE;AACA,aAAO,EAAE,MAAM,SAAS,MAAM,EAAE,eAAe,cAAc,EAAE;AAAA,IACjE;AAAA,IACA,OAAO,OAAO,EAAE,eAAe,cAAc,GAAG,EAAE,OAAO,MAAM;AAC7D,iBAAW,KAAK,eAAe;AAC7B,cAAM,OAAO,KAAK,KAAK,MAAM,EAAE,IAAI;AACnC,cAAM,MAAM,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AAC9C,cAAM,UAAU,MAAM,EAAE,UAAU,OAAO;AACzC,cAAM,OAAO,eAAe,EAAE,MAAM,qCAAqC;AAAA,MAC3E;AACA,UAAI,cAAc,SAAS,SAAS;AAClC,cAAM,eAAe,KAAK,MAAM,aAAa;AAC7C,cAAM,OAAO,mDAAmD;AAAA,MAClE;AACA,aAAO,EAAE,MAAM,KAAK;AAAA,IACtB;AAAA,EACF,CAAC;AACH;","names":[]}