@reddoorla/maintenance 0.93.1 → 0.94.1

package/dist/{chunk-CVJF2IC5.js → chunk-TGUESYGF.js}

@@ -55,14 +55,28 @@ const ALLOWED_CONSOLE_PATTERNS: RegExp[] = [
   // Vimeo iframe embeds + their CDN telemetry endpoints occasionally 403 from
   // cloud IPs due to bot detection.
   /vimeo/i,
-  // Turnstile (Cloudflare) telemetry occasionally surfaces in console.
+  // Turnstile (Cloudflare) telemetry occasionally surfaces in console \u2014 a 403
+  // from a cloud IP, a beacon that didn't land. Console-level ONLY: see
+  // ALLOWED_PAGEERROR_PATTERNS below for why this does not extend to throws.
   /turnstile|challenges\\.cloudflare/i,
 ];
 
+// Uncaught exceptions are held to a stricter bar than console noise, and
+// Turnstile is deliberately NOT on this list. A widget whose sitekey is not
+// allowlisted for the hostname it is served from throws an uncaught
+// \`TurnstileError: [Cloudflare Turnstile] Error: 110200\` and mints no token at
+// all \u2014 on a \`Require Turnstile\` site that buckets 100% of real leads as spam.
+// It shipped that way once (2026-09-04) and this suite watched it happen: the
+// pattern above matched the throw's message and the run stayed green. Telemetry
+// that merely logs is noise; a widget that THROWS is the failure itself.
+const ALLOWED_PAGEERROR_PATTERNS: RegExp[] = [/vimeo/i];
+
 function attachConsoleWatcher(page: Page, extraAllowed: RegExp[] = []) {
   const errors: string[] = [];
   const allowed = [...ALLOWED_CONSOLE_PATTERNS, ...extraAllowed];
+  const allowedThrows = [...ALLOWED_PAGEERROR_PATTERNS, ...extraAllowed];
   const isAllowed = (s: string) => !!s && allowed.some((re) => re.test(s));
+  const isAllowedThrow = (s: string) => !!s && allowedThrows.some((re) => re.test(s));
 
   page.on("console", (msg: ConsoleMessage) => {
     if (msg.type() !== "error") return;
@@ -73,7 +87,7 @@ function attachConsoleWatcher(page: Page, extraAllowed: RegExp[] = []) {
   });
 
   page.on("pageerror", (err) => {
-    if (isAllowed(err.message)) return;
+    if (isAllowedThrow(err.message)) return;
     errors.push(\`[pageerror] \${err.message}\`);
   });
 
@@ -315,4 +329,4 @@ async function smokeSuite(site, deps = { spawn: defaultSpawn }) {
 export {
   smokeSuite
 };
-//# sourceMappingURL=chunk-CVJF2IC5.js.map
+//# sourceMappingURL=chunk-TGUESYGF.js.map

package/dist/{chunk-CVJF2IC5.js.map → chunk-TGUESYGF.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/recipes/smoke-suite/index.ts","../src/recipes/smoke-suite/template.ts"],"sourcesContent":["import { access, mkdir, readdir, readFile, writeFile } from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\nimport type { RecipeResult, Site } from \"../../types.js\";\nimport { withRecipe } from \"../_with-recipe.js\";\nimport { defaultSpawn, type SpawnFn } from \"../../audits/util/spawn.js\";\nimport { formatWithPrettier, PRETTIER_FLAG_NOTE } from \"../_prettier.js\";\nimport {\n  SMOKE_ROUTES_RELATIVE,\n  SMOKE_ROUTES_TEMPLATE,\n  SMOKE_SPEC_RELATIVE,\n  SMOKE_SPEC_TEMPLATE,\n  PLAYWRIGHT_CONFIG_RELATIVE,\n  PLAYWRIGHT_CONFIG_TEMPLATE,\n  PLAYWRIGHT_CONFIG_PRE_R11,\n} from \"./template.js\";\n\nexport type SmokeSuiteDeps = { spawn: SpawnFn };\n\ntype PackageJson = {\n  scripts?: Record<string, string>;\n  devDependencies?: Record<string, string>;\n  dependencies?: Record<string, string>;\n};\n\nasync function fileExists(path: string): Promise<boolean> {\n  try {\n    await access(path);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nasync function readIfExists(path: string): Promise<string | null> {\n  try {\n    return await readFile(path, \"utf-8\");\n  } catch {\n    return null;\n  }\n}\n\n/** The template sentence explaining the default `footer` marker — swapped for a\n *  fallback explanation when the marker deviates. Must match template.ts. */\nconst FOOTER_MARKER_SENTENCE =\n  \"The hydration marker `footer` is the shared\\n// layout footer, present on every page including the error page.\";\n\nfunction fallbackMarkerSentence(marker: string): string {\n  return (\n    `The hydration marker \\`${marker}\\` is a\\n` +\n    \"// fallback: no <footer> element exists in this site's Svelte source. Add a\\n\" +\n    \"// semantic <footer> landmark and point the marker back at it when possible.\"\n  );\n}\n\n/** The starter's default `footer` hydration marker needs the element to exist,\n *  or EVERY route check false-fails (la-homelessness-initiative red'd the first\n *  fleet-smoke run exactly this way). Deviate only on positive evidence of a\n *  bespoke build: svelte files exist under src/ and none renders a literal\n *  lowercase `<footer` element (a capital-F `<Footer` component tag proves\n *  nothing — the element the browser paints lives inside that component). No\n *  svelte files at all → no signal → keep the starter default. */\nasync function detectHydrationMarker(cwd: string): Promise<\"footer\" | \"main\" | \"body\"> {\n  let entries: string[];\n  try {\n    entries = (await readdir(join(cwd, \"src\"), { recursive: true })) as string[];\n  } catch {\n    return \"footer\";\n  }\n  const svelteFiles = entries.filter((p) => p.endsWith(\".svelte\"));\n  if (svelteFiles.length === 0) return \"footer\";\n  let sawMain = false;\n  for (const rel of svelteFiles) {\n    const text = (await readIfExists(join(cwd, \"src\", rel))) ?? \"\";\n    if (/<footer[\\s>/]/.test(text)) return \"footer\";\n    if (/<main[\\s>/]/.test(text)) sawMain = true;\n  }\n  return sawMain ? \"main\" : \"body\";\n}\n\n/**\n * Adds the smoke suite to a site: the `tests/smoke/*` specs, a `test:smoke` /\n * `test:unit` script split, `@playwright/test`, and a `playwright.config.ts`\n * that honors `REDDOOR_SMOKE_PORT` (R1.1). Conservative + partial-apply — every\n * file is noop-if-exists, every `package.json` script/dep is add-if-absent, and\n * an existing config that isn't a recognizable shared-base shape is left\n * untouched and flagged for a manual R1.1 patch (never a destructive write).\n * A site with no `package.json` noops (not a node project). Branch+commit per site.\n */\nexport async function smokeSuite(\n  site: Site,\n  deps: SmokeSuiteDeps = { spawn: defaultSpawn },\n): Promise<RecipeResult> {\n  const pkgPath = join(site.path, \"package.json\");\n  return withRecipe<{ pkgPath: string; pkg: PackageJson }>({\n    name: \"smoke-suite\",\n    site,\n    plan: async () => {\n      // Parse in the read-only plan phase so a missing OR unparseable\n      // package.json noops cleanly (spec: structurally unrecognizable → noop),\n      // BEFORE apply writes any file. A bad JSON that only threw in apply would\n      // leave the (safely-restored) branch as a `failed`, not the graceful noop.\n      const raw = await readIfExists(pkgPath);\n      if (raw === null) {\n        return { kind: \"noop\", notes: \"no package.json (not a node project)\" };\n      }\n      let pkg: PackageJson;\n      try {\n        pkg = JSON.parse(raw) as PackageJson;\n      } catch {\n        return { kind: \"noop\", notes: \"unparseable package.json — skipped\" };\n      }\n      return { kind: \"apply\", plan: { pkgPath, pkg } };\n    },\n    apply: async (planned, { commit, cwd }) => {\n      const notes: string[] = [];\n      // Relative paths this run actually wrote/changed — prettier-formatted to the\n      // site's own config before committing (never operator files we left alone).\n      const written: string[] = [];\n\n      // 1. Spec files — write if absent (never clobber operator edits). The\n      //    routes manifest ships the starter-verbatim `footer` marker only when\n      //    the site actually renders one; bespoke builds fall back to `main`,\n      //    then `body`, so the suite proves paint instead of false-failing.\n      let routesTemplate = SMOKE_ROUTES_TEMPLATE;\n      if (!(await fileExists(join(cwd, SMOKE_ROUTES_RELATIVE)))) {\n        const marker = await detectHydrationMarker(cwd);\n        if (marker !== \"footer\") {\n          routesTemplate = SMOKE_ROUTES_TEMPLATE.replace(\n            'hydrationMarker: \"footer\"',\n            `hydrationMarker: \"${marker}\"`,\n          ).replace(FOOTER_MARKER_SENTENCE, fallbackMarkerSentence(marker));\n          notes.push(\n            `no <footer> element in src/**/*.svelte — hydration marker set to \"${marker}\" ` +\n              \"(add a semantic <footer> landmark to restore the default)\",\n          );\n        }\n      }\n      const specFiles: Array<[string, string]> = [\n        [SMOKE_ROUTES_RELATIVE, routesTemplate],\n        [SMOKE_SPEC_RELATIVE, SMOKE_SPEC_TEMPLATE],\n      ];\n      for (const [rel, tmpl] of specFiles) {\n        const target = join(cwd, rel);\n        if (!(await fileExists(target))) {\n          await mkdir(dirname(target), { recursive: true });\n          await writeFile(target, tmpl, \"utf-8\");\n          written.push(rel);\n        }\n      }\n\n      // 2. playwright.config.ts — four cases, never an in-place edit: absent →\n      //    write R1.1; already has REDDOOR_SMOKE_PORT → leave; exact pre-R1.1\n      //    shared-base → safe-replace wholesale; anything else → flag for manual.\n      const cfgPath = join(cwd, PLAYWRIGHT_CONFIG_RELATIVE);\n      const existingCfg = await readIfExists(cfgPath);\n      if (existingCfg === null) {\n        await writeFile(cfgPath, PLAYWRIGHT_CONFIG_TEMPLATE, \"utf-8\");\n        written.push(PLAYWRIGHT_CONFIG_RELATIVE);\n      } else if (existingCfg.includes(\"REDDOOR_SMOKE_PORT\")) {\n        // Already R1.1-aware; leave it.\n      } else if (existingCfg.trim() === PLAYWRIGHT_CONFIG_PRE_R11.trim()) {\n        await writeFile(cfgPath, PLAYWRIGHT_CONFIG_TEMPLATE, \"utf-8\");\n        written.push(PLAYWRIGHT_CONFIG_RELATIVE);\n      } else {\n        notes.push(\n          \"playwright.config.ts exists without REDDOOR_SMOKE_PORT — add the R1.1 port block manually\",\n        );\n      }\n\n      // 3. package.json — add-if-absent scripts + @playwright/test. Only rewrite\n      //    when something changed, so a re-run of a fully-adopted site noops\n      //    instead of churning the file. (Parsed in plan; see above.)\n      const pkg = planned.pkg;\n      let pkgChanged = false;\n      pkg.scripts ??= {};\n      if (!pkg.scripts[\"test:smoke\"]) {\n        pkg.scripts[\"test:smoke\"] = \"playwright install chromium && playwright test\";\n        pkgChanged = true;\n      }\n      // Unit-test scripts (`test:unit` / `test` → \"vitest run\") only when the site\n      // actually runs vitest — either it depends on vitest, or it already defines a\n      // `test` script. Adding `test: \"vitest run\"` to a site WITHOUT vitest makes\n      // the shared CI's \"run the test script if present\" step fail with\n      // `vitest: not found` (the whole fleet-smoke batch red'd on exactly this).\n      const hasVitest = !!(pkg.devDependencies?.vitest || pkg.dependencies?.vitest);\n      const existingTest = pkg.scripts[\"test\"];\n      if (hasVitest || existingTest !== undefined) {\n        if (!pkg.scripts[\"test:unit\"]) {\n          pkg.scripts[\"test:unit\"] = existingTest ?? \"vitest run\";\n          pkgChanged = true;\n        }\n        if (pkg.scripts[\"test\"] === undefined) {\n          pkg.scripts[\"test\"] = \"vitest run\";\n          pkgChanged = true;\n        }\n      }\n      let depsChanged = false;\n      const hasPlaywright =\n        !!pkg.devDependencies?.[\"@playwright/test\"] || !!pkg.dependencies?.[\"@playwright/test\"];\n      if (!hasPlaywright) {\n        pkg.devDependencies ??= {};\n        pkg.devDependencies[\"@playwright/test\"] = \"^1.60.0\";\n        depsChanged = true;\n        pkgChanged = true;\n      }\n      if (pkgChanged) {\n        await writeFile(planned.pkgPath, JSON.stringify(pkg, null, 2) + \"\\n\", \"utf-8\");\n        written.push(\"package.json\");\n      }\n\n      // 4. Install only when a dep was added (streaming, so the operator sees\n      //    progress; matches bump-deps). A failed install aborts the recipe.\n      if (depsChanged) {\n        const res = await deps.spawn(\"pnpm\", [\"install\"], { cwd, streaming: true });\n        if (res.code !== 0) {\n          return { kind: \"failed\", notes: `pnpm install failed (exit ${res.code})` };\n        }\n      }\n\n      // 5. Format everything this run wrote to the site's own prettier config, so\n      //    fleet CI's format check stays green across heterogeneous configs\n      //    (quotes/tabs/printWidth vary). Best-effort — a site without prettier\n      //    just commits unformatted with a flag note.\n      if (!(await formatWithPrettier(deps.spawn, cwd, written))) {\n        notes.push(PRETTIER_FLAG_NOTE);\n      }\n\n      // 6. Commit. If nothing was written/changed the commit stages nothing and\n      //    withRecipe reports noop (the flag note, if any, is still surfaced).\n      await commit(\"feat: add smoke suite (test:smoke + playwright config + /health smoke routes)\");\n      return notes.length > 0 ? { kind: \"ok\", notes: notes.join(\"; \") } : { kind: \"ok\" };\n    },\n  });\n}\n","// GENERATED verbatim from the reddoor-starter working tree (tests/smoke/*,\n// playwright.config.ts). Byte-fidelity matters — the smoke spec + config are\n// written into each site unchanged. Regenerate with scratchpad/gen-smoke-template.mjs\n// if the starter's smoke suite changes. Do NOT hand-edit the string bodies.\n\nexport const SMOKE_ROUTES_RELATIVE = \"tests/smoke/routes.ts\";\nexport const SMOKE_ROUTES_TEMPLATE = `// Committed per-site smoke manifest. \\`tests/smoke/pages.spec.ts\\` iterates this\n// list, asserting each route returns its expected status and paints a hydration\n// marker with no console errors. This ships the SAFE DEFAULT every reddoor-starter\n// clone inherits; each site's figma-slices build grows the list as real routes\n// land (add \\`{ path, name, hydrationMarker }\\` entries).\n//\n// NOTE on the default \\`/\\` entry: it expects 200, which holds once the clone is\n// wired to a real Prismic repo (getByUID(\"page\",\"home\") resolves). On the bare\n// placeholder starter, \\`/\\` returns 404 (the Prismic lookup throws → error(404)),\n// so the \\`/\\` case only goes green after Prismic is wired — by design, since the\n// gate is about real site health. The hydration marker \\`footer\\` is the shared\n// layout footer, present on every page including the error page.\n\nexport type SmokeRoute = {\n  /** Route path to visit, e.g. \"/\" or \"/about\". */\n  path: string;\n  /** Human-readable label used in the test title. */\n  name: string;\n  /** CSS selector asserted visible after load (hydration proof). Default: skip. */\n  hydrationMarker?: string;\n  /** Expected HTTP status. Default: 200. */\n  expectStatus?: number;\n};\n\nexport const smokeRoutes: SmokeRoute[] = [\n  { path: \"/\", name: \"home\", hydrationMarker: \"footer\" },\n];\n`;\n\nexport const SMOKE_SPEC_RELATIVE = \"tests/smoke/pages.spec.ts\";\nexport const SMOKE_SPEC_TEMPLATE = `import { test, expect, type Page, type ConsoleMessage } from \"@playwright/test\";\nimport { smokeRoutes } from \"./routes\";\n\n// Console messages we don't care about. Add patterns here only after seeing them\n// in CI and confirming they aren't actionable. Patterns are matched against both\n// the message text and the offending resource URL — Chromium's \"Failed to load\n// resource\" text omits the URL, so URL matching catches third-party network noise.\nconst ALLOWED_CONSOLE_PATTERNS: RegExp[] = [\n  // Vimeo iframe embeds + their CDN telemetry endpoints occasionally 403 from\n  // cloud IPs due to bot detection.\n  /vimeo/i,\n  // Turnstile (Cloudflare) telemetry occasionally surfaces in console.\n  /turnstile|challenges\\\\.cloudflare/i,\n];\n\nfunction attachConsoleWatcher(page: Page, extraAllowed: RegExp[] = []) {\n  const errors: string[] = [];\n  const allowed = [...ALLOWED_CONSOLE_PATTERNS, ...extraAllowed];\n  const isAllowed = (s: string) => !!s && allowed.some((re) => re.test(s));\n\n  page.on(\"console\", (msg: ConsoleMessage) => {\n    if (msg.type() !== \"error\") return;\n    const text = msg.text();\n    const url = msg.location()?.url ?? \"\";\n    if (isAllowed(text) || isAllowed(url)) return;\n    errors.push(\\`[console.error] \\${text}\\${url ? \\` (\\${url})\\` : \"\"}\\`);\n  });\n\n  page.on(\"pageerror\", (err) => {\n    if (isAllowed(err.message)) return;\n    errors.push(\\`[pageerror] \\${err.message}\\`);\n  });\n\n  return errors;\n}\n\nfor (const route of smokeRoutes) {\n  test(\\`\\${route.path} (\\${route.name}) loads with no console errors\\`, async ({\n    page,\n  }) => {\n    const errors = attachConsoleWatcher(page);\n    const response = await page.goto(route.path, {\n      waitUntil: \"domcontentloaded\",\n    });\n    expect(response?.status(), \\`HTTP status for \\${route.path}\\`).toBe(\n      route.expectStatus ?? 200,\n    );\n    if (route.hydrationMarker) {\n      await expect(\n        page.locator(route.hydrationMarker),\n        \\`hydration marker \"\\${route.hydrationMarker}\" on \\${route.path}\\`,\n      ).toBeVisible();\n    }\n    expect(errors, \\`console errors on \\${route.path}\\`).toEqual([]);\n  });\n}\n\ntest(\"404 page renders the custom error component\", async ({ page }) => {\n  // The browser logs a top-level \"Failed to load resource: 404\" for the page\n  // itself — expected on a 404 route, not a bug. Allow it here.\n  const errors = attachConsoleWatcher(page, [/Failed to load resource.*404/i]);\n  const response = await page.goto(\"/this-uid-does-not-exist\", {\n    waitUntil: \"domcontentloaded\",\n  });\n  expect(response?.status()).toBe(404);\n  // src/routes/+error.svelte renders \\`<h1>{page.status}</h1>\\` → \"404\".\n  await expect(page.getByText(\"404\", { exact: false }).first()).toBeVisible();\n  expect(errors).toEqual([]);\n});\n`;\n\nexport const PLAYWRIGHT_CONFIG_RELATIVE = \"playwright.config.ts\";\n\n/** The R1.1 config: reads REDDOOR_SMOKE_PORT and binds --strictPort. Written\n *  when a site has no playwright.config.ts. */\nexport const PLAYWRIGHT_CONFIG_TEMPLATE = `import { defineConfig } from \"@playwright/test\";\nimport base from \"@reddoorla/maintenance/configs/playwright-a11y\";\n\n// Emulate reduced motion in tests: instant scrollIntoView (no long animated\n// smooth-scroll that flakes Playwright's actionability checks under parallel\n// load) and view transitions fall back to instant. Pairs with the\n// prefers-reduced-motion gate on scroll-behavior in src/app.css.\n//\n// R1.1 (health-gate): the central \\`smoke\\` audit (reddoor-maintenance\n// src/audits/smoke.ts) allocates a free port and passes it as\n// REDDOOR_SMOKE_PORT so a zombie vite already squatting the default 5173 can't\n// silently hijack the run and green a stale build. When it's set, bind vite to\n// exactly that port with --strictPort (forwarded through \\`npm run vite:dev\\` so\n// it stays portable across pnpm/npm) and aim Playwright's baseURL + readiness\n// probe at it. Unset (local \\`pnpm test:smoke\\`) → the shared base's fixed 5173.\nconst smokePort = process.env.REDDOOR_SMOKE_PORT;\n\nexport default defineConfig({\n  ...base,\n  use: {\n    ...base.use,\n    reducedMotion: \"reduce\",\n    ...(smokePort ? { baseURL: \\`http://localhost:\\${smokePort}\\` } : {}),\n  },\n  ...(smokePort\n    ? {\n        webServer: {\n          command: \\`npm run vite:dev -- --port \\${smokePort} --strictPort\\`,\n          url: \\`http://localhost:\\${smokePort}/dev/a11y-fixtures\\`,\n          // Never reuse: the readiness probe cannot tell the server under test\n          // from any other server answering that URL. The shared base does the\n          // same, and allocates its own port when REDDOOR_SMOKE_PORT is unset.\n          reuseExistingServer: false,\n          timeout: 120_000,\n        },\n      }\n    : {}),\n});\n`;\n\n/** The pre-R1.1 shared-base config (no port block). Used ONLY to recognize a\n *  site that adopted the shared base before R1.1, so it can be safely replaced\n *  wholesale with PLAYWRIGHT_CONFIG_TEMPLATE. Any other existing config is left\n *  untouched and flagged for manual patch. */\nexport const PLAYWRIGHT_CONFIG_PRE_R11 = `import { defineConfig } from \"@playwright/test\";\nimport base from \"@reddoorla/maintenance/configs/playwright-a11y\";\n\n// Emulate reduced motion in tests: instant scrollIntoView (no long animated\n// smooth-scroll that flakes Playwright's actionability checks under parallel\n// load) and view transitions fall back to instant. Pairs with the\n// prefers-reduced-motion gate on scroll-behavior in src/app.css.\nexport default defineConfig({\n  ...base,\n  use: { ...base.use, reducedMotion: \"reduce\" },\n});\n`;\n"],"mappings":";;;;;;;;;;;;AAAA,SAAS,QAAQ,OAAO,SAAS,UAAU,iBAAiB;AAC5D,SAAS,SAAS,YAAY;;;ACIvB,IAAM,wBAAwB;AAC9B,IAAM,wBAAwB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA6B9B,IAAM,sBAAsB;AAC5B,IAAM,sBAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAuE5B,IAAM,6BAA6B;AAInC,IAAM,6BAA6B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA4CnC,IAAM,4BAA4B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ADnIzC,eAAe,WAAW,MAAgC;AACxD,MAAI;AACF,UAAM,OAAO,IAAI;AACjB,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,aAAa,MAAsC;AAChE,MAAI;AACF,WAAO,MAAM,SAAS,MAAM,OAAO;AAAA,EACrC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAIA,IAAM,yBACJ;AAEF,SAAS,uBAAuB,QAAwB;AACtD,SACE,0BAA0B,MAAM;AAAA;AAAA;AAIpC;AASA,eAAe,sBAAsB,KAAkD;AACrF,MAAI;AACJ,MAAI;AACF,cAAW,MAAM,QAAQ,KAAK,KAAK,KAAK,GAAG,EAAE,WAAW,KAAK,CAAC;AAAA,EAChE,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,cAAc,QAAQ,OAAO,CAAC,MAAM,EAAE,SAAS,SAAS,CAAC;AAC/D,MAAI,YAAY,WAAW,EAAG,QAAO;AACrC,MAAI,UAAU;AACd,aAAW,OAAO,aAAa;AAC7B,UAAM,OAAQ,MAAM,aAAa,KAAK,KAAK,OAAO,GAAG,CAAC,KAAM;AAC5D,QAAI,gBAAgB,KAAK,IAAI,EAAG,QAAO;AACvC,QAAI,cAAc,KAAK,IAAI,EAAG,WAAU;AAAA,EAC1C;AACA,SAAO,UAAU,SAAS;AAC5B;AAWA,eAAsB,WACpB,MACA,OAAuB,EAAE,OAAO,aAAa,GACtB;AACvB,QAAM,UAAU,KAAK,KAAK,MAAM,cAAc;AAC9C,SAAO,WAAkD;AAAA,IACvD,MAAM;AAAA,IACN;AAAA,IACA,MAAM,YAAY;AAKhB,YAAM,MAAM,MAAM,aAAa,OAAO;AACtC,UAAI,QAAQ,MAAM;AAChB,eAAO,EAAE,MAAM,QAAQ,OAAO,uCAAuC;AAAA,MACvE;AACA,UAAI;AACJ,UAAI;AACF,cAAM,KAAK,MAAM,GAAG;AAAA,MACtB,QAAQ;AACN,eAAO,EAAE,MAAM,QAAQ,OAAO,0CAAqC;AAAA,MACrE;AACA,aAAO,EAAE,MAAM,SAAS,MAAM,EAAE,SAAS,IAAI,EAAE;AAAA,IACjD;AAAA,IACA,OAAO,OAAO,SAAS,EAAE,QAAQ,IAAI,MAAM;AACzC,YAAM,QAAkB,CAAC;AAGzB,YAAM,UAAoB,CAAC;AAM3B,UAAI,iBAAiB;AACrB,UAAI,CAAE,MAAM,WAAW,KAAK,KAAK,qBAAqB,CAAC,GAAI;AACzD,cAAM,SAAS,MAAM,sBAAsB,GAAG;AAC9C,YAAI,WAAW,UAAU;AACvB,2BAAiB,sBAAsB;AAAA,YACrC;AAAA,YACA,qBAAqB,MAAM;AAAA,UAC7B,EAAE,QAAQ,wBAAwB,uBAAuB,MAAM,CAAC;AAChE,gBAAM;AAAA,YACJ,0EAAqE,MAAM;AAAA,UAE7E;AAAA,QACF;AAAA,MACF;AACA,YAAM,YAAqC;AAAA,QACzC,CAAC,uBAAuB,cAAc;AAAA,QACtC,CAAC,qBAAqB,mBAAmB;AAAA,MAC3C;AACA,iBAAW,CAAC,KAAK,IAAI,KAAK,WAAW;AACnC,cAAM,SAAS,KAAK,KAAK,GAAG;AAC5B,YAAI,CAAE,MAAM,WAAW,MAAM,GAAI;AAC/B,gBAAM,MAAM,QAAQ,MAAM,GAAG,EAAE,WAAW,KAAK,CAAC;AAChD,gBAAM,UAAU,QAAQ,MAAM,OAAO;AACrC,kBAAQ,KAAK,GAAG;AAAA,QAClB;AAAA,MACF;AAKA,YAAM,UAAU,KAAK,KAAK,0BAA0B;AACpD,YAAM,cAAc,MAAM,aAAa,OAAO;AAC9C,UAAI,gBAAgB,MAAM;AACxB,cAAM,UAAU,SAAS,4BAA4B,OAAO;AAC5D,gBAAQ,KAAK,0BAA0B;AAAA,MACzC,WAAW,YAAY,SAAS,oBAAoB,GAAG;AAAA,MAEvD,WAAW,YAAY,KAAK,MAAM,0BAA0B,KAAK,GAAG;AAClE,cAAM,UAAU,SAAS,4BAA4B,OAAO;AAC5D,gBAAQ,KAAK,0BAA0B;AAAA,MACzC,OAAO;AACL,cAAM;AAAA,UACJ;AAAA,QACF;AAAA,MACF;AAKA,YAAM,MAAM,QAAQ;AACpB,UAAI,aAAa;AACjB,UAAI,YAAY,CAAC;AACjB,UAAI,CAAC,IAAI,QAAQ,YAAY,GAAG;AAC9B,YAAI,QAAQ,YAAY,IAAI;AAC5B,qBAAa;AAAA,MACf;AAMA,YAAM,YAAY,CAAC,EAAE,IAAI,iBAAiB,UAAU,IAAI,cAAc;AACtE,YAAM,eAAe,IAAI,QAAQ,MAAM;AACvC,UAAI,aAAa,iBAAiB,QAAW;AAC3C,YAAI,CAAC,IAAI,QAAQ,WAAW,GAAG;AAC7B,cAAI,QAAQ,WAAW,IAAI,gBAAgB;AAC3C,uBAAa;AAAA,QACf;AACA,YAAI,IAAI,QAAQ,MAAM,MAAM,QAAW;AACrC,cAAI,QAAQ,MAAM,IAAI;AACtB,uBAAa;AAAA,QACf;AAAA,MACF;AACA,UAAI,cAAc;AAClB,YAAM,gBACJ,CAAC,CAAC,IAAI,kBAAkB,kBAAkB,KAAK,CAAC,CAAC,IAAI,eAAe,kBAAkB;AACxF,UAAI,CAAC,eAAe;AAClB,YAAI,oBAAoB,CAAC;AACzB,YAAI,gBAAgB,kBAAkB,IAAI;AAC1C,sBAAc;AACd,qBAAa;AAAA,MACf;AACA,UAAI,YAAY;AACd,cAAM,UAAU,QAAQ,SAAS,KAAK,UAAU,KAAK,MAAM,CAAC,IAAI,MAAM,OAAO;AAC7E,gBAAQ,KAAK,cAAc;AAAA,MAC7B;AAIA,UAAI,aAAa;AACf,cAAM,MAAM,MAAM,KAAK,MAAM,QAAQ,CAAC,SAAS,GAAG,EAAE,KAAK,WAAW,KAAK,CAAC;AAC1E,YAAI,IAAI,SAAS,GAAG;AAClB,iBAAO,EAAE,MAAM,UAAU,OAAO,6BAA6B,IAAI,IAAI,IAAI;AAAA,QAC3E;AAAA,MACF;AAMA,UAAI,CAAE,MAAM,mBAAmB,KAAK,OAAO,KAAK,OAAO,GAAI;AACzD,cAAM,KAAK,kBAAkB;AAAA,MAC/B;AAIA,YAAM,OAAO,+EAA+E;AAC5F,aAAO,MAAM,SAAS,IAAI,EAAE,MAAM,MAAM,OAAO,MAAM,KAAK,IAAI,EAAE,IAAI,EAAE,MAAM,KAAK;AAAA,IACnF;AAAA,EACF,CAAC;AACH;","names":[]}
+{"version":3,"sources":["../src/recipes/smoke-suite/index.ts","../src/recipes/smoke-suite/template.ts"],"sourcesContent":["import { access, mkdir, readdir, readFile, writeFile } from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\nimport type { RecipeResult, Site } from \"../../types.js\";\nimport { withRecipe } from \"../_with-recipe.js\";\nimport { defaultSpawn, type SpawnFn } from \"../../audits/util/spawn.js\";\nimport { formatWithPrettier, PRETTIER_FLAG_NOTE } from \"../_prettier.js\";\nimport {\n  SMOKE_ROUTES_RELATIVE,\n  SMOKE_ROUTES_TEMPLATE,\n  SMOKE_SPEC_RELATIVE,\n  SMOKE_SPEC_TEMPLATE,\n  PLAYWRIGHT_CONFIG_RELATIVE,\n  PLAYWRIGHT_CONFIG_TEMPLATE,\n  PLAYWRIGHT_CONFIG_PRE_R11,\n} from \"./template.js\";\n\nexport type SmokeSuiteDeps = { spawn: SpawnFn };\n\ntype PackageJson = {\n  scripts?: Record<string, string>;\n  devDependencies?: Record<string, string>;\n  dependencies?: Record<string, string>;\n};\n\nasync function fileExists(path: string): Promise<boolean> {\n  try {\n    await access(path);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nasync function readIfExists(path: string): Promise<string | null> {\n  try {\n    return await readFile(path, \"utf-8\");\n  } catch {\n    return null;\n  }\n}\n\n/** The template sentence explaining the default `footer` marker — swapped for a\n *  fallback explanation when the marker deviates. Must match template.ts. */\nconst FOOTER_MARKER_SENTENCE =\n  \"The hydration marker `footer` is the shared\\n// layout footer, present on every page including the error page.\";\n\nfunction fallbackMarkerSentence(marker: string): string {\n  return (\n    `The hydration marker \\`${marker}\\` is a\\n` +\n    \"// fallback: no <footer> element exists in this site's Svelte source. Add a\\n\" +\n    \"// semantic <footer> landmark and point the marker back at it when possible.\"\n  );\n}\n\n/** The starter's default `footer` hydration marker needs the element to exist,\n *  or EVERY route check false-fails (la-homelessness-initiative red'd the first\n *  fleet-smoke run exactly this way). Deviate only on positive evidence of a\n *  bespoke build: svelte files exist under src/ and none renders a literal\n *  lowercase `<footer` element (a capital-F `<Footer` component tag proves\n *  nothing — the element the browser paints lives inside that component). No\n *  svelte files at all → no signal → keep the starter default. */\nasync function detectHydrationMarker(cwd: string): Promise<\"footer\" | \"main\" | \"body\"> {\n  let entries: string[];\n  try {\n    entries = (await readdir(join(cwd, \"src\"), { recursive: true })) as string[];\n  } catch {\n    return \"footer\";\n  }\n  const svelteFiles = entries.filter((p) => p.endsWith(\".svelte\"));\n  if (svelteFiles.length === 0) return \"footer\";\n  let sawMain = false;\n  for (const rel of svelteFiles) {\n    const text = (await readIfExists(join(cwd, \"src\", rel))) ?? \"\";\n    if (/<footer[\\s>/]/.test(text)) return \"footer\";\n    if (/<main[\\s>/]/.test(text)) sawMain = true;\n  }\n  return sawMain ? \"main\" : \"body\";\n}\n\n/**\n * Adds the smoke suite to a site: the `tests/smoke/*` specs, a `test:smoke` /\n * `test:unit` script split, `@playwright/test`, and a `playwright.config.ts`\n * that honors `REDDOOR_SMOKE_PORT` (R1.1). Conservative + partial-apply — every\n * file is noop-if-exists, every `package.json` script/dep is add-if-absent, and\n * an existing config that isn't a recognizable shared-base shape is left\n * untouched and flagged for a manual R1.1 patch (never a destructive write).\n * A site with no `package.json` noops (not a node project). Branch+commit per site.\n */\nexport async function smokeSuite(\n  site: Site,\n  deps: SmokeSuiteDeps = { spawn: defaultSpawn },\n): Promise<RecipeResult> {\n  const pkgPath = join(site.path, \"package.json\");\n  return withRecipe<{ pkgPath: string; pkg: PackageJson }>({\n    name: \"smoke-suite\",\n    site,\n    plan: async () => {\n      // Parse in the read-only plan phase so a missing OR unparseable\n      // package.json noops cleanly (spec: structurally unrecognizable → noop),\n      // BEFORE apply writes any file. A bad JSON that only threw in apply would\n      // leave the (safely-restored) branch as a `failed`, not the graceful noop.\n      const raw = await readIfExists(pkgPath);\n      if (raw === null) {\n        return { kind: \"noop\", notes: \"no package.json (not a node project)\" };\n      }\n      let pkg: PackageJson;\n      try {\n        pkg = JSON.parse(raw) as PackageJson;\n      } catch {\n        return { kind: \"noop\", notes: \"unparseable package.json — skipped\" };\n      }\n      return { kind: \"apply\", plan: { pkgPath, pkg } };\n    },\n    apply: async (planned, { commit, cwd }) => {\n      const notes: string[] = [];\n      // Relative paths this run actually wrote/changed — prettier-formatted to the\n      // site's own config before committing (never operator files we left alone).\n      const written: string[] = [];\n\n      // 1. Spec files — write if absent (never clobber operator edits). The\n      //    routes manifest ships the starter-verbatim `footer` marker only when\n      //    the site actually renders one; bespoke builds fall back to `main`,\n      //    then `body`, so the suite proves paint instead of false-failing.\n      let routesTemplate = SMOKE_ROUTES_TEMPLATE;\n      if (!(await fileExists(join(cwd, SMOKE_ROUTES_RELATIVE)))) {\n        const marker = await detectHydrationMarker(cwd);\n        if (marker !== \"footer\") {\n          routesTemplate = SMOKE_ROUTES_TEMPLATE.replace(\n            'hydrationMarker: \"footer\"',\n            `hydrationMarker: \"${marker}\"`,\n          ).replace(FOOTER_MARKER_SENTENCE, fallbackMarkerSentence(marker));\n          notes.push(\n            `no <footer> element in src/**/*.svelte — hydration marker set to \"${marker}\" ` +\n              \"(add a semantic <footer> landmark to restore the default)\",\n          );\n        }\n      }\n      const specFiles: Array<[string, string]> = [\n        [SMOKE_ROUTES_RELATIVE, routesTemplate],\n        [SMOKE_SPEC_RELATIVE, SMOKE_SPEC_TEMPLATE],\n      ];\n      for (const [rel, tmpl] of specFiles) {\n        const target = join(cwd, rel);\n        if (!(await fileExists(target))) {\n          await mkdir(dirname(target), { recursive: true });\n          await writeFile(target, tmpl, \"utf-8\");\n          written.push(rel);\n        }\n      }\n\n      // 2. playwright.config.ts — four cases, never an in-place edit: absent →\n      //    write R1.1; already has REDDOOR_SMOKE_PORT → leave; exact pre-R1.1\n      //    shared-base → safe-replace wholesale; anything else → flag for manual.\n      const cfgPath = join(cwd, PLAYWRIGHT_CONFIG_RELATIVE);\n      const existingCfg = await readIfExists(cfgPath);\n      if (existingCfg === null) {\n        await writeFile(cfgPath, PLAYWRIGHT_CONFIG_TEMPLATE, \"utf-8\");\n        written.push(PLAYWRIGHT_CONFIG_RELATIVE);\n      } else if (existingCfg.includes(\"REDDOOR_SMOKE_PORT\")) {\n        // Already R1.1-aware; leave it.\n      } else if (existingCfg.trim() === PLAYWRIGHT_CONFIG_PRE_R11.trim()) {\n        await writeFile(cfgPath, PLAYWRIGHT_CONFIG_TEMPLATE, \"utf-8\");\n        written.push(PLAYWRIGHT_CONFIG_RELATIVE);\n      } else {\n        notes.push(\n          \"playwright.config.ts exists without REDDOOR_SMOKE_PORT — add the R1.1 port block manually\",\n        );\n      }\n\n      // 3. package.json — add-if-absent scripts + @playwright/test. Only rewrite\n      //    when something changed, so a re-run of a fully-adopted site noops\n      //    instead of churning the file. (Parsed in plan; see above.)\n      const pkg = planned.pkg;\n      let pkgChanged = false;\n      pkg.scripts ??= {};\n      if (!pkg.scripts[\"test:smoke\"]) {\n        pkg.scripts[\"test:smoke\"] = \"playwright install chromium && playwright test\";\n        pkgChanged = true;\n      }\n      // Unit-test scripts (`test:unit` / `test` → \"vitest run\") only when the site\n      // actually runs vitest — either it depends on vitest, or it already defines a\n      // `test` script. Adding `test: \"vitest run\"` to a site WITHOUT vitest makes\n      // the shared CI's \"run the test script if present\" step fail with\n      // `vitest: not found` (the whole fleet-smoke batch red'd on exactly this).\n      const hasVitest = !!(pkg.devDependencies?.vitest || pkg.dependencies?.vitest);\n      const existingTest = pkg.scripts[\"test\"];\n      if (hasVitest || existingTest !== undefined) {\n        if (!pkg.scripts[\"test:unit\"]) {\n          pkg.scripts[\"test:unit\"] = existingTest ?? \"vitest run\";\n          pkgChanged = true;\n        }\n        if (pkg.scripts[\"test\"] === undefined) {\n          pkg.scripts[\"test\"] = \"vitest run\";\n          pkgChanged = true;\n        }\n      }\n      let depsChanged = false;\n      const hasPlaywright =\n        !!pkg.devDependencies?.[\"@playwright/test\"] || !!pkg.dependencies?.[\"@playwright/test\"];\n      if (!hasPlaywright) {\n        pkg.devDependencies ??= {};\n        pkg.devDependencies[\"@playwright/test\"] = \"^1.60.0\";\n        depsChanged = true;\n        pkgChanged = true;\n      }\n      if (pkgChanged) {\n        await writeFile(planned.pkgPath, JSON.stringify(pkg, null, 2) + \"\\n\", \"utf-8\");\n        written.push(\"package.json\");\n      }\n\n      // 4. Install only when a dep was added (streaming, so the operator sees\n      //    progress; matches bump-deps). A failed install aborts the recipe.\n      if (depsChanged) {\n        const res = await deps.spawn(\"pnpm\", [\"install\"], { cwd, streaming: true });\n        if (res.code !== 0) {\n          return { kind: \"failed\", notes: `pnpm install failed (exit ${res.code})` };\n        }\n      }\n\n      // 5. Format everything this run wrote to the site's own prettier config, so\n      //    fleet CI's format check stays green across heterogeneous configs\n      //    (quotes/tabs/printWidth vary). Best-effort — a site without prettier\n      //    just commits unformatted with a flag note.\n      if (!(await formatWithPrettier(deps.spawn, cwd, written))) {\n        notes.push(PRETTIER_FLAG_NOTE);\n      }\n\n      // 6. Commit. If nothing was written/changed the commit stages nothing and\n      //    withRecipe reports noop (the flag note, if any, is still surfaced).\n      await commit(\"feat: add smoke suite (test:smoke + playwright config + /health smoke routes)\");\n      return notes.length > 0 ? { kind: \"ok\", notes: notes.join(\"; \") } : { kind: \"ok\" };\n    },\n  });\n}\n","// GENERATED verbatim from the reddoor-starter working tree (tests/smoke/*,\n// playwright.config.ts). Byte-fidelity matters — the smoke spec + config are\n// written into each site unchanged. Regenerate with scratchpad/gen-smoke-template.mjs\n// if the starter's smoke suite changes. Do NOT hand-edit the string bodies.\n\nexport const SMOKE_ROUTES_RELATIVE = \"tests/smoke/routes.ts\";\nexport const SMOKE_ROUTES_TEMPLATE = `// Committed per-site smoke manifest. \\`tests/smoke/pages.spec.ts\\` iterates this\n// list, asserting each route returns its expected status and paints a hydration\n// marker with no console errors. This ships the SAFE DEFAULT every reddoor-starter\n// clone inherits; each site's figma-slices build grows the list as real routes\n// land (add \\`{ path, name, hydrationMarker }\\` entries).\n//\n// NOTE on the default \\`/\\` entry: it expects 200, which holds once the clone is\n// wired to a real Prismic repo (getByUID(\"page\",\"home\") resolves). On the bare\n// placeholder starter, \\`/\\` returns 404 (the Prismic lookup throws → error(404)),\n// so the \\`/\\` case only goes green after Prismic is wired — by design, since the\n// gate is about real site health. The hydration marker \\`footer\\` is the shared\n// layout footer, present on every page including the error page.\n\nexport type SmokeRoute = {\n  /** Route path to visit, e.g. \"/\" or \"/about\". */\n  path: string;\n  /** Human-readable label used in the test title. */\n  name: string;\n  /** CSS selector asserted visible after load (hydration proof). Default: skip. */\n  hydrationMarker?: string;\n  /** Expected HTTP status. Default: 200. */\n  expectStatus?: number;\n};\n\nexport const smokeRoutes: SmokeRoute[] = [\n  { path: \"/\", name: \"home\", hydrationMarker: \"footer\" },\n];\n`;\n\nexport const SMOKE_SPEC_RELATIVE = \"tests/smoke/pages.spec.ts\";\nexport const SMOKE_SPEC_TEMPLATE = `import { test, expect, type Page, type ConsoleMessage } from \"@playwright/test\";\nimport { smokeRoutes } from \"./routes\";\n\n// Console messages we don't care about. Add patterns here only after seeing them\n// in CI and confirming they aren't actionable. Patterns are matched against both\n// the message text and the offending resource URL — Chromium's \"Failed to load\n// resource\" text omits the URL, so URL matching catches third-party network noise.\nconst ALLOWED_CONSOLE_PATTERNS: RegExp[] = [\n  // Vimeo iframe embeds + their CDN telemetry endpoints occasionally 403 from\n  // cloud IPs due to bot detection.\n  /vimeo/i,\n  // Turnstile (Cloudflare) telemetry occasionally surfaces in console — a 403\n  // from a cloud IP, a beacon that didn't land. Console-level ONLY: see\n  // ALLOWED_PAGEERROR_PATTERNS below for why this does not extend to throws.\n  /turnstile|challenges\\\\.cloudflare/i,\n];\n\n// Uncaught exceptions are held to a stricter bar than console noise, and\n// Turnstile is deliberately NOT on this list. A widget whose sitekey is not\n// allowlisted for the hostname it is served from throws an uncaught\n// \\`TurnstileError: [Cloudflare Turnstile] Error: 110200\\` and mints no token at\n// all — on a \\`Require Turnstile\\` site that buckets 100% of real leads as spam.\n// It shipped that way once (2026-09-04) and this suite watched it happen: the\n// pattern above matched the throw's message and the run stayed green. Telemetry\n// that merely logs is noise; a widget that THROWS is the failure itself.\nconst ALLOWED_PAGEERROR_PATTERNS: RegExp[] = [/vimeo/i];\n\nfunction attachConsoleWatcher(page: Page, extraAllowed: RegExp[] = []) {\n  const errors: string[] = [];\n  const allowed = [...ALLOWED_CONSOLE_PATTERNS, ...extraAllowed];\n  const allowedThrows = [...ALLOWED_PAGEERROR_PATTERNS, ...extraAllowed];\n  const isAllowed = (s: string) => !!s && allowed.some((re) => re.test(s));\n  const isAllowedThrow = (s: string) => !!s && allowedThrows.some((re) => re.test(s));\n\n  page.on(\"console\", (msg: ConsoleMessage) => {\n    if (msg.type() !== \"error\") return;\n    const text = msg.text();\n    const url = msg.location()?.url ?? \"\";\n    if (isAllowed(text) || isAllowed(url)) return;\n    errors.push(\\`[console.error] \\${text}\\${url ? \\` (\\${url})\\` : \"\"}\\`);\n  });\n\n  page.on(\"pageerror\", (err) => {\n    if (isAllowedThrow(err.message)) return;\n    errors.push(\\`[pageerror] \\${err.message}\\`);\n  });\n\n  return errors;\n}\n\nfor (const route of smokeRoutes) {\n  test(\\`\\${route.path} (\\${route.name}) loads with no console errors\\`, async ({\n    page,\n  }) => {\n    const errors = attachConsoleWatcher(page);\n    const response = await page.goto(route.path, {\n      waitUntil: \"domcontentloaded\",\n    });\n    expect(response?.status(), \\`HTTP status for \\${route.path}\\`).toBe(\n      route.expectStatus ?? 200,\n    );\n    if (route.hydrationMarker) {\n      await expect(\n        page.locator(route.hydrationMarker),\n        \\`hydration marker \"\\${route.hydrationMarker}\" on \\${route.path}\\`,\n      ).toBeVisible();\n    }\n    expect(errors, \\`console errors on \\${route.path}\\`).toEqual([]);\n  });\n}\n\ntest(\"404 page renders the custom error component\", async ({ page }) => {\n  // The browser logs a top-level \"Failed to load resource: 404\" for the page\n  // itself — expected on a 404 route, not a bug. Allow it here.\n  const errors = attachConsoleWatcher(page, [/Failed to load resource.*404/i]);\n  const response = await page.goto(\"/this-uid-does-not-exist\", {\n    waitUntil: \"domcontentloaded\",\n  });\n  expect(response?.status()).toBe(404);\n  // src/routes/+error.svelte renders \\`<h1>{page.status}</h1>\\` → \"404\".\n  await expect(page.getByText(\"404\", { exact: false }).first()).toBeVisible();\n  expect(errors).toEqual([]);\n});\n`;\n\nexport const PLAYWRIGHT_CONFIG_RELATIVE = \"playwright.config.ts\";\n\n/** The R1.1 config: reads REDDOOR_SMOKE_PORT and binds --strictPort. Written\n *  when a site has no playwright.config.ts. */\nexport const PLAYWRIGHT_CONFIG_TEMPLATE = `import { defineConfig } from \"@playwright/test\";\nimport base from \"@reddoorla/maintenance/configs/playwright-a11y\";\n\n// Emulate reduced motion in tests: instant scrollIntoView (no long animated\n// smooth-scroll that flakes Playwright's actionability checks under parallel\n// load) and view transitions fall back to instant. Pairs with the\n// prefers-reduced-motion gate on scroll-behavior in src/app.css.\n//\n// R1.1 (health-gate): the central \\`smoke\\` audit (reddoor-maintenance\n// src/audits/smoke.ts) allocates a free port and passes it as\n// REDDOOR_SMOKE_PORT so a zombie vite already squatting the default 5173 can't\n// silently hijack the run and green a stale build. When it's set, bind vite to\n// exactly that port with --strictPort (forwarded through \\`npm run vite:dev\\` so\n// it stays portable across pnpm/npm) and aim Playwright's baseURL + readiness\n// probe at it. Unset (local \\`pnpm test:smoke\\`) → the shared base's fixed 5173.\nconst smokePort = process.env.REDDOOR_SMOKE_PORT;\n\nexport default defineConfig({\n  ...base,\n  use: {\n    ...base.use,\n    reducedMotion: \"reduce\",\n    ...(smokePort ? { baseURL: \\`http://localhost:\\${smokePort}\\` } : {}),\n  },\n  ...(smokePort\n    ? {\n        webServer: {\n          command: \\`npm run vite:dev -- --port \\${smokePort} --strictPort\\`,\n          url: \\`http://localhost:\\${smokePort}/dev/a11y-fixtures\\`,\n          // Never reuse: the readiness probe cannot tell the server under test\n          // from any other server answering that URL. The shared base does the\n          // same, and allocates its own port when REDDOOR_SMOKE_PORT is unset.\n          reuseExistingServer: false,\n          timeout: 120_000,\n        },\n      }\n    : {}),\n});\n`;\n\n/** The pre-R1.1 shared-base config (no port block). Used ONLY to recognize a\n *  site that adopted the shared base before R1.1, so it can be safely replaced\n *  wholesale with PLAYWRIGHT_CONFIG_TEMPLATE. Any other existing config is left\n *  untouched and flagged for manual patch. */\nexport const PLAYWRIGHT_CONFIG_PRE_R11 = `import { defineConfig } from \"@playwright/test\";\nimport base from \"@reddoorla/maintenance/configs/playwright-a11y\";\n\n// Emulate reduced motion in tests: instant scrollIntoView (no long animated\n// smooth-scroll that flakes Playwright's actionability checks under parallel\n// load) and view transitions fall back to instant. Pairs with the\n// prefers-reduced-motion gate on scroll-behavior in src/app.css.\nexport default defineConfig({\n  ...base,\n  use: { ...base.use, reducedMotion: \"reduce\" },\n});\n`;\n"],"mappings":";;;;;;;;;;;;AAAA,SAAS,QAAQ,OAAO,SAAS,UAAU,iBAAiB;AAC5D,SAAS,SAAS,YAAY;;;ACIvB,IAAM,wBAAwB;AAC9B,IAAM,wBAAwB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA6B9B,IAAM,sBAAsB;AAC5B,IAAM,sBAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAqF5B,IAAM,6BAA6B;AAInC,IAAM,6BAA6B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA4CnC,IAAM,4BAA4B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ADjJzC,eAAe,WAAW,MAAgC;AACxD,MAAI;AACF,UAAM,OAAO,IAAI;AACjB,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,aAAa,MAAsC;AAChE,MAAI;AACF,WAAO,MAAM,SAAS,MAAM,OAAO;AAAA,EACrC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAIA,IAAM,yBACJ;AAEF,SAAS,uBAAuB,QAAwB;AACtD,SACE,0BAA0B,MAAM;AAAA;AAAA;AAIpC;AASA,eAAe,sBAAsB,KAAkD;AACrF,MAAI;AACJ,MAAI;AACF,cAAW,MAAM,QAAQ,KAAK,KAAK,KAAK,GAAG,EAAE,WAAW,KAAK,CAAC;AAAA,EAChE,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,cAAc,QAAQ,OAAO,CAAC,MAAM,EAAE,SAAS,SAAS,CAAC;AAC/D,MAAI,YAAY,WAAW,EAAG,QAAO;AACrC,MAAI,UAAU;AACd,aAAW,OAAO,aAAa;AAC7B,UAAM,OAAQ,MAAM,aAAa,KAAK,KAAK,OAAO,GAAG,CAAC,KAAM;AAC5D,QAAI,gBAAgB,KAAK,IAAI,EAAG,QAAO;AACvC,QAAI,cAAc,KAAK,IAAI,EAAG,WAAU;AAAA,EAC1C;AACA,SAAO,UAAU,SAAS;AAC5B;AAWA,eAAsB,WACpB,MACA,OAAuB,EAAE,OAAO,aAAa,GACtB;AACvB,QAAM,UAAU,KAAK,KAAK,MAAM,cAAc;AAC9C,SAAO,WAAkD;AAAA,IACvD,MAAM;AAAA,IACN;AAAA,IACA,MAAM,YAAY;AAKhB,YAAM,MAAM,MAAM,aAAa,OAAO;AACtC,UAAI,QAAQ,MAAM;AAChB,eAAO,EAAE,MAAM,QAAQ,OAAO,uCAAuC;AAAA,MACvE;AACA,UAAI;AACJ,UAAI;AACF,cAAM,KAAK,MAAM,GAAG;AAAA,MACtB,QAAQ;AACN,eAAO,EAAE,MAAM,QAAQ,OAAO,0CAAqC;AAAA,MACrE;AACA,aAAO,EAAE,MAAM,SAAS,MAAM,EAAE,SAAS,IAAI,EAAE;AAAA,IACjD;AAAA,IACA,OAAO,OAAO,SAAS,EAAE,QAAQ,IAAI,MAAM;AACzC,YAAM,QAAkB,CAAC;AAGzB,YAAM,UAAoB,CAAC;AAM3B,UAAI,iBAAiB;AACrB,UAAI,CAAE,MAAM,WAAW,KAAK,KAAK,qBAAqB,CAAC,GAAI;AACzD,cAAM,SAAS,MAAM,sBAAsB,GAAG;AAC9C,YAAI,WAAW,UAAU;AACvB,2BAAiB,sBAAsB;AAAA,YACrC;AAAA,YACA,qBAAqB,MAAM;AAAA,UAC7B,EAAE,QAAQ,wBAAwB,uBAAuB,MAAM,CAAC;AAChE,gBAAM;AAAA,YACJ,0EAAqE,MAAM;AAAA,UAE7E;AAAA,QACF;AAAA,MACF;AACA,YAAM,YAAqC;AAAA,QACzC,CAAC,uBAAuB,cAAc;AAAA,QACtC,CAAC,qBAAqB,mBAAmB;AAAA,MAC3C;AACA,iBAAW,CAAC,KAAK,IAAI,KAAK,WAAW;AACnC,cAAM,SAAS,KAAK,KAAK,GAAG;AAC5B,YAAI,CAAE,MAAM,WAAW,MAAM,GAAI;AAC/B,gBAAM,MAAM,QAAQ,MAAM,GAAG,EAAE,WAAW,KAAK,CAAC;AAChD,gBAAM,UAAU,QAAQ,MAAM,OAAO;AACrC,kBAAQ,KAAK,GAAG;AAAA,QAClB;AAAA,MACF;AAKA,YAAM,UAAU,KAAK,KAAK,0BAA0B;AACpD,YAAM,cAAc,MAAM,aAAa,OAAO;AAC9C,UAAI,gBAAgB,MAAM;AACxB,cAAM,UAAU,SAAS,4BAA4B,OAAO;AAC5D,gBAAQ,KAAK,0BAA0B;AAAA,MACzC,WAAW,YAAY,SAAS,oBAAoB,GAAG;AAAA,MAEvD,WAAW,YAAY,KAAK,MAAM,0BAA0B,KAAK,GAAG;AAClE,cAAM,UAAU,SAAS,4BAA4B,OAAO;AAC5D,gBAAQ,KAAK,0BAA0B;AAAA,MACzC,OAAO;AACL,cAAM;AAAA,UACJ;AAAA,QACF;AAAA,MACF;AAKA,YAAM,MAAM,QAAQ;AACpB,UAAI,aAAa;AACjB,UAAI,YAAY,CAAC;AACjB,UAAI,CAAC,IAAI,QAAQ,YAAY,GAAG;AAC9B,YAAI,QAAQ,YAAY,IAAI;AAC5B,qBAAa;AAAA,MACf;AAMA,YAAM,YAAY,CAAC,EAAE,IAAI,iBAAiB,UAAU,IAAI,cAAc;AACtE,YAAM,eAAe,IAAI,QAAQ,MAAM;AACvC,UAAI,aAAa,iBAAiB,QAAW;AAC3C,YAAI,CAAC,IAAI,QAAQ,WAAW,GAAG;AAC7B,cAAI,QAAQ,WAAW,IAAI,gBAAgB;AAC3C,uBAAa;AAAA,QACf;AACA,YAAI,IAAI,QAAQ,MAAM,MAAM,QAAW;AACrC,cAAI,QAAQ,MAAM,IAAI;AACtB,uBAAa;AAAA,QACf;AAAA,MACF;AACA,UAAI,cAAc;AAClB,YAAM,gBACJ,CAAC,CAAC,IAAI,kBAAkB,kBAAkB,KAAK,CAAC,CAAC,IAAI,eAAe,kBAAkB;AACxF,UAAI,CAAC,eAAe;AAClB,YAAI,oBAAoB,CAAC;AACzB,YAAI,gBAAgB,kBAAkB,IAAI;AAC1C,sBAAc;AACd,qBAAa;AAAA,MACf;AACA,UAAI,YAAY;AACd,cAAM,UAAU,QAAQ,SAAS,KAAK,UAAU,KAAK,MAAM,CAAC,IAAI,MAAM,OAAO;AAC7E,gBAAQ,KAAK,cAAc;AAAA,MAC7B;AAIA,UAAI,aAAa;AACf,cAAM,MAAM,MAAM,KAAK,MAAM,QAAQ,CAAC,SAAS,GAAG,EAAE,KAAK,WAAW,KAAK,CAAC;AAC1E,YAAI,IAAI,SAAS,GAAG;AAClB,iBAAO,EAAE,MAAM,UAAU,OAAO,6BAA6B,IAAI,IAAI,IAAI;AAAA,QAC3E;AAAA,MACF;AAMA,UAAI,CAAE,MAAM,mBAAmB,KAAK,OAAO,KAAK,OAAO,GAAI;AACzD,cAAM,KAAK,kBAAkB;AAAA,MAC/B;AAIA,YAAM,OAAO,+EAA+E;AAC5F,aAAO,MAAM,SAAS,IAAI,EAAE,MAAM,MAAM,OAAO,MAAM,KAAK,IAAI,EAAE,IAAI,EAAE,MAAM,KAAK;AAAA,IACnF;AAAA,EACF,CAAC;AACH;","names":[]}

package/dist/{chunk-JB4Q3C3M.js → chunk-TO7DJYLZ.js}

@@ -1671,6 +1671,19 @@ function budgetThinSummary(probeElapsedMs) {
   const s = (ms) => `${(ms / 1e3).toFixed(1)}s`;
   return `BUDGET_THIN: probe ${s(probeElapsedMs)} + ~${s(TESTMODE_SKIPPED_WORK_MS)} of sink work the probe skips \u2248 ${s(projectRealSubmissionMs(probeElapsedMs))} projected against a ${s(INGEST_TIMEOUT_MS)} abort budget \u2014 a real submission may be reported to the visitor as failed while central still captures the lead`;
 }
+var TURNSTILE_HOSTNAME_REJECTED = /\[Cloudflare Turnstile\][^\n]*?\b110200\b/;
+var TURNSTILE_WIDGET_ERROR = /\[Cloudflare Turnstile\][^\n]*?\b(?:110(?!200\b)\d{3}|400020|400070)\b/;
+var TURNSTILE_INIT_FAILED = /\[turnstile\] widget did not render/;
+var TURNSTILE_API_JS = /challenges\.cloudflare\.com\/turnstile\/v0\/api\.js/;
+function turnstileVerdict(health, observed) {
+  if (health.turnstile === false) return "fail";
+  if (!observed) return null;
+  if (observed.hostnameRejected) return "fail";
+  if (!observed.containerPresent) return null;
+  if (!observed.scriptLoaded || observed.initFailed) return null;
+  if (observed.widgetError) return null;
+  return "pass";
+}
 var LIVE_ENV_VAR = "REDDOOR_FORM_E2E_LIVE";
 function liveRunnerEnabled(env = process.env) {
   return env[LIVE_ENV_VAR] === "1" || env[LIVE_ENV_VAR] === "true";
@@ -1703,7 +1716,8 @@ async function formE2eAudit(ctx) {
         audit: "form-e2e",
         site: label,
         status: "skip",
-        summary: "site /health does not declare forms.testMode \u2014 probe refused (testMode forwarding not yet rolled out here)"
+        summary: "site /health does not declare forms.testMode \u2014 probe refused (testMode forwarding not yet rolled out here)",
+        details: { checkedAt, turnstileWidget: null }
       };
     }
     if (!outcome.formPresent) {
@@ -1712,11 +1726,25 @@ async function formE2eAudit(ctx) {
         site: label,
         status: "skip",
         summary: "no contact form (n/a)",
-        details: { ok: null, formPresent: false, checkedAt }
+        details: {
+          ok: null,
+          formPresent: false,
+          checkedAt,
+          // Written here too: this path DOES refresh `Form E2E checked at`, and
+          // the verdict must never be older than the stamp that ages it.
+          turnstileWidget: turnstileVerdict(
+            outcome.formsHealth ?? { testMode: true, turnstile: null },
+            void 0
+          )
+        }
       };
     }
     const ok = outcome.success ? "pass" : "fail";
-    const details = { ok, formPresent: true, checkedAt };
+    const turnstileWidget = turnstileVerdict(
+      outcome.formsHealth ?? { testMode: true, turnstile: null },
+      outcome.turnstile
+    );
+    const details = { ok, formPresent: true, checkedAt, turnstileWidget };
     if (!outcome.success) {
       return {
         audit: "form-e2e",
@@ -1755,19 +1783,26 @@ async function findFormPath(page, baseUrl, paths = CONTACT_PATHS) {
   }
   return null;
 }
-async function declaresTestModeForwarding(baseUrl) {
+async function readFormsHealth(baseUrl) {
+  const unknown = { testMode: false, turnstile: null };
   try {
     const res = await fetch(new URL("/health", baseUrl), {
       signal: AbortSignal.timeout(HEALTH_TIMEOUT_MS2)
     });
-    if (!res.ok) return false;
+    if (!res.ok) return unknown;
     const body = await res.json();
-    if (typeof body !== "object" || body === null) return false;
+    if (typeof body !== "object" || body === null) return unknown;
     const forms = body.forms;
-    if (typeof forms !== "object" || forms === null) return false;
-    return forms.testMode === true;
+    if (typeof forms !== "object" || forms === null) return unknown;
+    const f = forms;
+    return {
+      testMode: f.testMode === true,
+      // Strictly boolean. A missing or malformed key is unknown, NOT false —
+      // "no sitekey" is a conclusive fail downstream and must be earned.
+      turnstile: typeof f.turnstile === "boolean" ? f.turnstile : null
+    };
   } catch {
-    return false;
+    return unknown;
   }
 }
 function isSameSitePost(postUrl, baseUrl) {
@@ -1797,19 +1832,45 @@ async function defaultFormRunner() {
   const { chromium } = await import("@playwright/test");
   return {
     async submit({ baseUrl, testSitekey }) {
-      if (!await declaresTestModeForwarding(baseUrl)) {
+      const formsHealth = await readFormsHealth(baseUrl);
+      if (!formsHealth.testMode) {
         return { testModeUndeclared: true };
       }
+      let turnstileHostnameRejected = false;
+      let turnstileScriptLoaded = false;
+      let turnstileInitFailed = false;
+      let turnstileWidgetError = false;
+      let containerPresent = false;
       const browser = await chromium.launch();
       try {
         const ctx = await browser.newContext();
         const page = await ctx.newPage();
         let hydrationMismatch = false;
+        const noteTurnstile = (text) => {
+          if (TURNSTILE_HOSTNAME_REJECTED.test(text)) turnstileHostnameRejected = true;
+          if (TURNSTILE_INIT_FAILED.test(text)) turnstileInitFailed = true;
+          if (TURNSTILE_WIDGET_ERROR.test(text)) turnstileWidgetError = true;
+        };
+        page.on("pageerror", (err) => noteTurnstile(String(err?.message ?? err)));
         page.on("console", (msg) => {
           if (msg.text().includes("hydration_mismatch")) hydrationMismatch = true;
+          noteTurnstile(msg.text());
+        });
+        page.on("response", (res) => {
+          if (TURNSTILE_API_JS.test(res.url()) && res.status() >= 200 && res.status() < 300) {
+            turnstileScriptLoaded = true;
+          }
         });
         const found = await findFormPath(page, baseUrl);
-        if (!found) return { formPresent: false };
+        if (!found) return { formPresent: false, formsHealth };
+        containerPresent = await page.locator(".cf-turnstile").count().then((n) => n > 0).catch(() => false);
+        const turnstileSeen = () => ({
+          containerPresent,
+          scriptLoaded: turnstileScriptLoaded,
+          hostnameRejected: turnstileHostnameRejected,
+          initFailed: turnstileInitFailed,
+          widgetError: turnstileWidgetError
+        });
         const tokenValue = `testmode-${testSitekey}`;
         const injectExpr = `
           (function () {
@@ -1885,7 +1946,9 @@ async function defaultFormRunner() {
             success: true,
             elapsedMs,
             ...postElapsedMs !== void 0 ? { postElapsedMs } : {},
-            ...refilled ? { refilled } : {}
+            ...refilled ? { refilled } : {},
+            turnstile: turnstileSeen(),
+            formsHealth
           };
         const actionResp = await postResponse;
         const alertText = await page.locator('[role="alert"]').first().textContent({ timeout: 1e3 }).catch(() => null);
@@ -1911,10 +1974,24 @@ async function defaultFormRunner() {
           formPresent: true,
           success: false,
           ...refilled ? { refilled } : {},
-          detail: noBannerDetail({ post, alertText, formState, hydrationMismatch, refilled })
+          detail: noBannerDetail({ post, alertText, formState, hydrationMismatch, refilled }),
+          turnstile: turnstileSeen(),
+          formsHealth
         };
       } catch (err) {
-        return { formPresent: true, success: false, detail: String(err).slice(0, 120) };
+        return {
+          formPresent: true,
+          success: false,
+          detail: String(err).slice(0, 120),
+          turnstile: {
+            containerPresent,
+            scriptLoaded: turnstileScriptLoaded,
+            hostnameRejected: turnstileHostnameRejected,
+            initFailed: turnstileInitFailed,
+            widgetError: turnstileWidgetError
+          },
+          formsHealth
+        };
       } finally {
         await browser.close().catch(() => {
         });
@@ -1979,4 +2056,4 @@ export {
   runAudits,
   runAuditsAcross
 };
-//# sourceMappingURL=chunk-JB4Q3C3M.js.map
+//# sourceMappingURL=chunk-TO7DJYLZ.js.map