@reddoorla/maintenance 0.94.1 → 0.95.0

package/dist/chunk-6VKYQATC.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/recipes/match-harness/index.ts","../src/recipes/match-harness/template.ts"],"sourcesContent":["import { mkdir, readFile, rm, rmdir, writeFile } from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\nimport type { RecipeResult, Site } from \"../../types.js\";\nimport { withRecipe } from \"../_with-recipe.js\";\nimport { ignoreRulesFor, pathsMissingFromHead } from \"../../util/git.js\";\nimport { defaultSpawn, type SpawnFn } from \"../../audits/util/spawn.js\";\nimport { formatWithPrettier, resolveTargetPrettier, PRETTIER_FLAG_NOTE } from \"../_prettier.js\";\nimport {\n  MATCH_HARNESS_FILES,\n  MATCH_HARNESS_PREVIOUS,\n  HARNESS_JSON_RELATIVE,\n  GITIGNORE_MARKER,\n  GITIGNORE_BLOCK,\n  PRETTIERIGNORE_MARKER,\n  PRETTIERIGNORE_BLOCK,\n  CLAUDE_MD_MARKER,\n  CLAUDE_MD_BLOCK,\n} from \"./template.js\";\n\n/** How long the target's own prettier gets. Also what makes the fleet's default\n *  spawn detach the child, so the kill reaches prettier and not just a wrapper.\n *  Same budget as `prismic-ci` and the Prismic pull-down path. */\nconst PRETTIER_TIMEOUT_MS = 60_000;\n\nexport type MatchHarnessOptions = {\n  /** The live reference URL the harness gates against. Required — a harness\n   *  with no reference cannot produce evidence, only an absence of errors. */\n  ref: string;\n  /** Candidate origin. Defaults to the SvelteKit dev server. */\n  cand?: string;\n  /** Breakpoint matrix. Defaults to the fleet's 1440 / 834 / 390. */\n  matrix?: number[];\n};\n\nexport type MatchHarnessDeps = {\n  spawn: SpawnFn;\n  /** Previously shipped renders per relative path; injectable so the\n   *  safe-replace path is testable before a second version exists. */\n  previous?: Readonly<Record<string, readonly string[]>>;\n  /** Resolve the TARGET repo's own prettier. Injected so a test can assert the\n   *  absolute-path spawn without a populated `node_modules`. */\n  resolvePrettier?: (repoRoot: string) => Promise<string | null>;\n};\n\ntype Plan = { ref: string; cand: string; matrix: number[] };\n\nasync function readIfExists(path: string): Promise<string | null> {\n  try {\n    return await readFile(path, \"utf-8\");\n  } catch {\n    return null;\n  }\n}\n\n/** CRLF and trailing whitespace are the only differences a site's formatter is\n *  allowed to introduce before a file stops counting as \"ours\". */\nfunction normalize(s: string): string {\n  return s\n    .replace(/\\r\\n/g, \"\\n\")\n    .replace(/[ \\t]+$/gm, \"\")\n    .trim();\n}\n\n/**\n * Append `block` under `marker` unless the marker is already present. The only\n * append-to-existing-file idiom in this repo is mergeGitignore, and it cannot\n * express a negated whitelist (`matching/*` then `!matching/*.sh`) as one unit:\n * it compares entries by normalized presence, so the ordering that makes the\n * block work would be lost. This keeps the block whole and idempotent.\n */\nexport function mergeBlock(existing: string | null, marker: string, block: string): string | null {\n  if (existing === null) return `${marker}\\n${block}`;\n  if (existing.includes(marker)) return null;\n  const base = existing.endsWith(\"\\n\") ? existing : `${existing}\\n`;\n  return `${base}\\n${marker}\\n${block}`;\n}\n\n/** What to do with one installed file. `flag` never writes. */\nexport function planFileWrite(\n  existing: string | null,\n  template: string,\n  owner: \"recipe\" | \"site\",\n  previous: readonly string[],\n): \"write\" | \"replace\" | \"skip\" | \"flag\" {\n  if (existing === null) return \"write\";\n  if (normalize(existing) === normalize(template)) return \"skip\";\n  if (owner === \"site\") return \"skip\"; // records are never touched again\n  if (previous.some((p) => normalize(existing) === normalize(p))) return \"replace\";\n  return \"flag\";\n}\n\n/** The three files the recipe APPENDS a marked block to rather than writing whole. */\nconst APPENDED_BLOCKS = [\n  [\".gitignore\", GITIGNORE_MARKER, GITIGNORE_BLOCK],\n  [\".prettierignore\", PRETTIERIGNORE_MARKER, PRETTIERIGNORE_BLOCK],\n  [\"CLAUDE.md\", CLAUDE_MD_MARKER, CLAUDE_MD_BLOCK],\n] as const;\n\n/**\n * Every path the installed harness requires to be IN THE COMMIT — deliberately\n * the whole manifest, NOT the paths written on this run. A re-run skips every\n * file already byte-correct on disk, so a check over the written delta would\n * find nothing missing and report a second hollow \"applied\" over the same\n * half-install.\n */\nexport const MATCH_HARNESS_INSTALLED_PATHS: readonly string[] = [\n  ...MATCH_HARNESS_FILES.map((f) => f.rel),\n  ...APPENDED_BLOCKS.map(([rel]) => rel),\n];\n\n/**\n * Installs the matching harness into a site: the dev-guarded `/dev/match/[uid]`\n * route, a `site-pages.js` scaffold and its fixture-vs-model test,\n * `matching/harness.json` + the read layer, the round scripts, the site records,\n * and the `.gitignore` / `.prettierignore` / `CLAUDE.md` blocks.\n *\n * Install-if-absent throughout. Files a site edits are never rewritten. A\n * recipe-owned script that matches a previously shipped render is safe-replaced;\n * one that has been hand-edited is FLAGGED in the notes and left alone.\n */\nexport async function matchHarness(\n  site: Site,\n  opts: MatchHarnessOptions,\n  deps: MatchHarnessDeps = { spawn: defaultSpawn },\n): Promise<RecipeResult> {\n  return withRecipe<Plan>({\n    name: \"match-harness\",\n    site,\n    plan: async () => {\n      if (!opts.ref || !/^https?:\\/\\//.test(opts.ref)) {\n        return {\n          kind: \"failed\",\n          notes:\n            \"--ref <url> is required: the harness gates against a live reference, and a harness with no reference can only ever report an absence of errors\",\n        };\n      }\n      return {\n        kind: \"apply\",\n        plan: {\n          ref: opts.ref.replace(/\\/$/, \"\"),\n          cand: opts.cand ?? \"http://localhost:5173\",\n          matrix: opts.matrix ?? [1440, 834, 390],\n        },\n      };\n    },\n    apply: async (planned, { commit, cwd }) => {\n      const notes: string[] = [];\n      const written: string[] = [];\n      /** For every path this run writes: what was there BEFORE (null = the file\n       *  did not exist). The refusal below restores from this, so a refused run\n       *  leaves the checkout byte-identical to how it found it. */\n      const before = new Map<string, string | null>();\n      const previousAll = deps.previous ?? MATCH_HARNESS_PREVIOUS;\n\n      for (const f of MATCH_HARNESS_FILES) {\n        const target = join(cwd, f.rel);\n        let template = f.template;\n        if (f.rel === HARNESS_JSON_RELATIVE) {\n          // Patch the PARSED object, never the text. The seed is pretty-printed\n          // two-space JSON, so `matrix` renders as a four-line exploded array\n          // and the literal \"[1440, 834, 390]\" does not occur — a string\n          // replace on it is a no-op that drops --matrix with no error.\n          const seed = JSON.parse(template) as Record<string, unknown>;\n          seed.ref = planned.ref;\n          seed.cand = planned.cand;\n          seed.matrix = planned.matrix;\n          template = JSON.stringify(seed, null, 2) + \"\\n\";\n        }\n        const existing = await readIfExists(target);\n        const action = planFileWrite(existing, template, f.owner, previousAll[f.rel] ?? []);\n        if (action === \"flag\") {\n          notes.push(\n            `${f.rel} differs from the shipped template and was left alone (hand-edited?)`,\n          );\n          continue;\n        }\n        if (action === \"skip\") continue;\n        await mkdir(dirname(target), { recursive: true });\n        before.set(f.rel, existing);\n        await writeFile(target, template, \"utf-8\");\n        written.push(f.rel);\n        if (action === \"replace\") notes.push(`${f.rel} upgraded from a previous version`);\n      }\n\n      // Three appended blocks, each idempotent on its own marker.\n      for (const [rel, marker, block] of APPENDED_BLOCKS) {\n        const path = join(cwd, rel);\n        const existing = await readIfExists(path);\n        const merged = mergeBlock(existing, marker, block);\n        if (merged !== null) {\n          before.set(rel, existing);\n          await writeFile(path, merged, \"utf-8\");\n          written.push(rel);\n        }\n      }\n\n      // Format only what the SITE owns, decided by OWNERSHIP and never by path.\n      // A recipe-owned file that a site's prettier reformats is indistinguishable\n      // from a hand edit on the next install, so planFileWrite flags it and the\n      // recipe can never upgrade it again. A path prefix cannot express that:\n      // three recipe-owned files live under src/. This is an ALLOW-list on\n      // purpose — a file added to MATCH_HARNESS_FILES is not formatted until its\n      // owner says \"site\", because the unsafe default is silent and permanent.\n      // The same files are in the .prettierignore block written above, which\n      // stops the site's OWN `prettier --write .` from doing the identical\n      // damage; that block and this filter must agree, and a test asserts it.\n      // CLAUDE.md is not in the file table — it is an append into a file the\n      // site owns — so it is named here.\n      const siteOwned = new Set(\n        MATCH_HARNESS_FILES.filter((f) => f.owner === \"site\").map((f) => f.rel),\n      );\n      const toFormat = written.filter((p) => siteOwned.has(p) || p === \"CLAUDE.md\");\n\n      // Run the SITE's own prettier, resolved POSITIVELY and invoked by absolute\n      // path. `pnpm exec prettier` here would first run a full, unbounded\n      // `pnpm install` in the client's checkout — which on `--fleet` is the\n      // NORMAL path, because `prepareFleetSites` clones and never installs — and\n      // would then, in a repo whose install left no prettier of its own, fall\n      // through to the CALLING repo's binary and exit 0, reporting success for a\n      // format the target never did. A `true` from here must mean the target's\n      // own prettier ran, so nothing about which binary runs is left to\n      // resolution.\n      if (toFormat.length > 0) {\n        const bin = await (deps.resolvePrettier ?? resolveTargetPrettier)(cwd);\n        if (bin === null) {\n          notes.push(PRETTIER_FLAG_NOTE);\n        } else if (\n          !(await formatWithPrettier(deps.spawn, cwd, toFormat, {\n            bin,\n            timeoutMs: PRETTIER_TIMEOUT_MS,\n          }))\n        ) {\n          notes.push(PRETTIER_FLAG_NOTE);\n        }\n      }\n\n      await commit(\n        \"feat: install the matching harness (/dev/match route + matching/ gate scripts)\",\n      );\n\n      // POSITIVE EVIDENCE that the install is real: every installed path is\n      // FOUND in HEAD's tree. `git add -A` honours the site's .gitignore and\n      // exits 0 either way, and git cannot re-include a file whose PARENT\n      // DIRECTORY is excluded — so a site that already ignores `matching/`\n      // (or `**/matching/`, `/matching`, `src/lib/site-pages.js`, …) gets the\n      // files on disk, nothing in the commit, and — before this check — a\n      // result of \"applied\", plus 83 lines of CLAUDE.md rules naming scripts\n      // that exist on no other machine.\n      const missing = await pathsMissingFromHead(cwd, MATCH_HARNESS_INSTALLED_PATHS);\n      if (missing.length > 0) {\n        const rules = await ignoreRulesFor(cwd, missing);\n        const sources = [...new Set(rules.map((r) => r.split(\"\\t\")[0]!))];\n        const explained = new Set(rules.map((r) => r.split(\"\\t\")[1] ?? \"\"));\n        const unexplained = missing.filter((p) => !explained.has(p));\n\n        // Put the checkout back exactly as we found it. Only paths THIS RUN\n        // wrote and git then refused are touched: one that reached the commit\n        // is left to withRecipe's force-checkout, and one we never wrote is\n        // never ours. `git checkout -f` cannot do this job — these paths are\n        // ignored, so git does not know they exist.\n        const removed: string[] = [];\n        for (const rel of written.filter((p) => missing.includes(p))) {\n          const prev = before.get(rel);\n          if (prev === undefined) continue;\n          if (prev === null) {\n            await rm(join(cwd, rel), { force: true });\n            removed.push(rel);\n          } else {\n            await writeFile(join(cwd, rel), prev, \"utf-8\");\n          }\n        }\n        // Deepest-first, so `matching/spec-sections` goes before `matching`.\n        // rmdir refuses a non-empty directory, which is exactly the guard wanted.\n        for (const d of [...new Set(removed.map(dirname))].sort((a, b) => b.length - a.length)) {\n          if (d !== \".\") await rmdir(join(cwd, d)).catch(() => undefined);\n        }\n\n        return {\n          kind: \"failed\",\n          notes:\n            `the harness was NOT installed: ${missing.length} of ${MATCH_HARNESS_INSTALLED_PATHS.length} paths git refused to track, so a fresh clone, CI and the next agent get a harness that does not exist. ` +\n            `Absent from the commit: ${missing.join(\", \")}. ` +\n            (sources.length > 0\n              ? `Excluded by ${sources.join(\", \")} — narrow or remove those rules and re-run. `\n              : \"\") +\n            (unexplained.length > 0\n              ? `No ignore rule matched ${unexplained.join(\", \")} — check .git/info/exclude, core.excludesFile, and whether the directory is a nested repository. `\n              : \"\") +\n            \"Everything this run wrote to those paths has been put back as it was.\",\n        };\n      }\n\n      return notes.length > 0 ? { kind: \"ok\", notes: notes.join(\"; \") } : { kind: \"ok\" };\n    },\n  });\n}\n","// GENERATED by scripts/gen-match-harness-template.mjs. Do NOT hand-edit the\n// string bodies — regenerate. Seven constants are byte-copies of a site with\n// the consolidated harness; the rest are stubs authored in the generator.\n\nexport type OwnedBy = \"recipe\" | \"site\";\nexport type HarnessFile = { rel: string; template: string; owner: OwnedBy };\n\nexport const HARNESS_MJS_RELATIVE = \"matching/harness.mjs\";\nexport const HARNESS_MJS_TEMPLATE = `// The single source for everything the matching gates need to know about this\n// site. DATA lives in matching/harness.json (site-edited); this file is the\n// READ LAYER — edit harness.json, not this. (It is installed and upgraded by\n// the \\`reddoor-maint match-harness\\` recipe, which owns these bytes: a hand\n// edit here is flagged on the next run and never silently overwritten.)\n//\n// It exists because the page table, the two hosts, the matrix, the threshold\n// and the skill path were hand-copied all over matching/. Re-measured\n// 2026-09-09 AFTER the six-probe conversion, over the 216 tracked scripts under\n// matching/ (214 top-level — 212 .mjs + 2 .sh — plus 2 in states/):\n//\n//   • a hand-typed copy of the page table (three or more gate keys sitting next\n//     to their route): 8 files. Exactly ONE of them, probe-chrome-count.mjs,\n//     still carries all nine rows; probe-anchors.mjs carries five; the other\n//     six are three-row detail triples (team/svc/qa).\n//   • the skill path (~/.claude/skills/matching-a-page): 193 copies\n//   • the viewport matrix (1440/834/390): 51 copies\n//   • REF pointed at a host listed in selfHosts — i.e. comparing the candidate\n//     with itself: 12 scripts, one of which (probe-chrome-count.mjs) is also\n//     the last nine-row table carrier\n//\n// The first bullet read \"the nine-row page table: 5 copies — gate.sh,\n// probe-anchor-parity.mjs, sweep-all10.sh, sweep-all16.sh, sweep-final.sh\" when\n// it was written here at 922dde3. It was wrong within the hour and wrong on two\n// counts: 4e2cd7b took the table out of gate.sh, and the list never named\n// states/index.mjs or probe-chrome-count.mjs, which were both carrying nine-row\n// copies at the time. A census is a claim about code; it has to be measured\n// against the tree, not recalled.\n//\n//   node matching/harness.mjs --env        shell-safe KEY='value' lines\n//   node matching/harness.mjs --table      key<TAB>ref<TAB>cand<TAB>anchors\n//   node matching/harness.mjs --check-ref  the D11 preflight; exit 2 on failure\nimport { readFileSync, realpathSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { join } from \"node:path\";\nimport { fileURLToPath, pathToFileURL } from \"node:url\";\n\n// fileURLToPath, not URL#pathname: pathname is percent-encoded, so a checkout\n// under a directory with a space in it would resolve to a path that does not\n// exist.\nconst DIR = fileURLToPath(new URL(\".\", import.meta.url));\nconst CFG = JSON.parse(readFileSync(join(DIR, \"harness.json\"), \"utf8\"));\n\n// Env overrides exist for one-off probes only. They are NOT how a site is\n// configured — harness.json is, so that what a gate ran against is committed.\nexport const REF = process.env.MATCH_REF ?? CFG.ref;\nexport const CAND = process.env.MATCH_CAND ?? process.env.CAND_BASE ?? CFG.cand;\nexport const MATRIX = CFG.matrix;\nexport const THRESHOLD = CFG.threshold;\nexport const MAX_HEIGHT_DELTA = CFG.maxHeightDelta;\nexport const REF_MARK = CFG.refMark;\nexport const CAND_MARK = CFG.candMark;\nexport const SELF_HOSTS = CFG.selfHosts ?? [];\n\n/** One record per gated page, in harness.json order. \\`key\\` is the gate key\n *  (out-<TAG>-<key>, the SPEC heading, spec-sections/<key>.md); \\`uid\\` is the\n *  Prismic uid or null where the page has no /dev/match twin. */\nexport const PAGES = Object.entries(CFG.pages).map(([key, p]) => ({ key, ...p }));\nexport const byKey = Object.fromEntries(PAGES.map((p) => [p.key, p]));\n\n// DERIVED, never hand-typed: page-diff cuts one region before the first anchor\n// (\"top\") plus one per anchor, at every viewport. The old hand-written map went\n// stale the moment an anchor list changed, and a wrong denominator makes the\n// score a lie in the flattering direction.\nexport const TOTALS = Object.fromEntries(\n  PAGES.map((p) => [p.key, (p.anchors.length + 1) * MATRIX.length]),\n);\n\n/** The SPEC.md heading predicate, shared by gate.sh's preflight and\n *  build-spec.mjs so a section can never build fine and then refuse at the\n *  gate. Matches the key followed by any non-key character (\\`## team\\` matches,\n *  \\`## teamfoo\\` does not, \\`## our-team\\` cannot match \\`team\\`). */\nexport const specHeadingRe = (key) => new RegExp(\\`^##+ +\\${key}([^A-Za-z0-9_-]|$)\\`, \"m\");\n\nexport const SKILL_DIR =\n  process.env.MATCHING_SKILL_DIR ?? join(homedir(), \".claude/skills/matching-a-page\");\nexport const PD = join(SKILL_DIR, \"page-diff.mjs\");\nexport const SC = join(SKILL_DIR, \"style-census.mjs\");\nexport const PLAYWRIGHT = pathToFileURL(join(SKILL_DIR, \"node_modules/playwright/index.mjs\")).href;\n\n/** The report format this site's scripts can read, so gate.sh can compare it\n *  with \\`page-diff --version\\` before spending a run and next.mjs can refuse\n *  rather than quietly drop a page whose newest report came from another\n *  schema. Both do that now — gate.sh preflights \\`page-diff --version\\` against\n *  this value before spending a run, and next.mjs counts a foreign-schema\n *  report as MISSING rather than skipping it. (This said \"neither does that\n *  yet\" — true at 922dde3 where it was written, false from 4e2cd7b, which\n *  gave gate.sh the preflight and did not come back here.) Checked 2026-09-09\n *  against the installed skill: \\`page-diff --version\\` → \\`page-diff 0.1.0\n *  report-schema 1\\`. */\nexport const REPORT_SCHEMA = 1;\n\n/**\n * Fail-closed reference preflight. A 200 is NOT evidence: a host that has been\n * repointed at our own build answers 200, and so does a staging host serving a\n * 404 page. Both have happened on a real site — see the dated measurement in\n * LEDGER.md. A pass here requires an artefact only the reference produces.\n */\nexport async function checkRef() {\n  if (!REF_MARK) {\n    return {\n      ok: false,\n      why: \"harness.json refMark is empty — set it to a string only the reference serves (a Webflow site id, a build hash). A 200 is not evidence.\",\n    };\n  }\n  const host = new URL(REF).host;\n  if (SELF_HOSTS.includes(host)) return { ok: false, why: \\`REF host \\${host} is in selfHosts\\` };\n  if (host === new URL(CAND).host) return { ok: false, why: \\`REF host \\${host} equals CAND's host\\` };\n  let res;\n  try {\n    res = await fetch(\\`\\${REF}/\\`, { redirect: \"manual\" });\n  } catch (e) {\n    return { ok: false, why: \\`GET \\${REF}/ failed: \\${e.message}\\` };\n  }\n  if (res.status !== 200)\n    return { ok: false, why: \\`GET \\${REF}/ → HTTP \\${res.status}, expected 200\\` };\n  const loc = res.headers.get(\"location\");\n  if (loc) return { ok: false, why: \\`GET \\${REF}/ → \\${res.status} redirect to \\${loc}\\` };\n  const body = await res.text();\n  if (!body.includes(REF_MARK))\n    return {\n      ok: false,\n      why: \\`\\${REF}/ served 200 but WITHOUT refMark \\${JSON.stringify(REF_MARK)} — that is not the reference\\`,\n    };\n  if (CAND_MARK && body.includes(CAND_MARK))\n    return {\n      ok: false,\n      why: \\`\\${REF}/ contains candMark \\${JSON.stringify(CAND_MARK)} — REF is serving OUR build\\`,\n    };\n  return { ok: true, why: \\`\\${REF}/ → 200, no redirect, refMark present, candMark absent\\` };\n}\n\n// CLI. Both sides go through realpathSync. \\`import.meta.url\\` is ALREADY the\n// resolved real path (node resolves symlinks unless --preserve-symlinks) while\n// process.argv[1] is the path as typed, so a plain pathToFileURL compare goes\n// false the moment any component of the invoked path is a symlink — and then\n// the CLI prints nothing and exits 0, which every caller reads as success.\n// page-diff.mjs:184-189 records exactly that defect and the same fix: \"The\n// pathToFileURL compare that replaced the old template string is still false\n// whenever ANY component of the invoked path is a symlink — which is how this\n// skill is installed now (~/.claude/skills/matching-a-page -> the claude-skills\n// checkout). isMain() resolves the real path on both sides.\"\nconst isMain = () => {\n  if (!process.argv[1]) return false;\n  try {\n    return realpathSync(fileURLToPath(import.meta.url)) === realpathSync(process.argv[1]);\n  } catch {\n    return false;\n  }\n};\n\nif (isMain()) {\n  const mode = process.argv[2];\n  const q = (v) => \\`'\\${String(v).replace(/'/g, \\`'\\\\\\\\''\\`)}'\\`;\n  if (mode === \"--env\") {\n    const pairs = [\n      [\"REF\", REF],\n      [\"CAND\", CAND],\n      [\"MATRIX\", MATRIX.join(\",\")],\n      [\"VIEWPORTS_SP\", MATRIX.join(\" \")],\n      [\"THRESHOLD\", THRESHOLD],\n      [\"MAX_HEIGHT_DELTA\", MAX_HEIGHT_DELTA],\n      [\"PD\", PD],\n      [\"SC\", SC],\n      [\"REPORT_SCHEMA\", REPORT_SCHEMA],\n    ];\n    for (const [k, v] of pairs) console.log(\\`\\${k}=\\${q(v)}\\`);\n  } else if (mode === \"--table\") {\n    for (const p of PAGES) console.log([p.key, p.ref, p.cand, p.anchors.join(\",\")].join(\"\\\\t\"));\n  } else if (mode === \"--check-ref\") {\n    const r = await checkRef();\n    console.log(\\`\\${r.ok ? \"REF OK\" : \"REF REFUSED\"} — \\${r.why}\\`);\n    process.exit(r.ok ? 0 : 2);\n  } else {\n    console.error(\"usage: harness.mjs --env | --table | --check-ref\");\n    process.exit(2);\n  }\n}\n`;\n\nexport const GATE_SH_RELATIVE = \"matching/gate.sh\";\nexport const GATE_SH_TEMPLATE = `#!/usr/bin/env bash\n# The matching gate. This file is generic — everything specific to a site lives\n# in matching/harness.json (the data) and matching/LEDGER.md (the why). It is\n# installed and upgraded by the \\`reddoor-maint match-harness\\` recipe, which\n# owns these bytes: a hand edit here is flagged on the next run, never\n# silently overwritten.\n#\n#   bash matching/gate.sh <round-tag> [page ...]\n#\n# Runs page-diff for every page in the table (or just the named ones) at the\n# full breakpoint matrix and writes matching/out-<round-tag>-<page>/.\n#\n# The matrix, the anchor lists, the reference and the candidate are DATA. Why a\n# site chose them — which live breakpoint band hid what, why an anchor is a\n# heading and not a button label — belongs in matching/LEDGER.md, which is dated\n# and append-only, because JSON holds no comments.\n#\n# NO MASKS and the threshold from harness.json everywhere: the numbers stay\n# honest and a known floor stays visible as its own region. A media-neutralised\n# secondary read is \\`node \"$PD\" ... --neutralize-media\\`; next.mjs ignores such\n# runs on purpose (next.mjs:57-64).\n#\n# PREFLIGHT (see the matching rules in CLAUDE.md): a page with no section in\n# matching/SPEC.md has not had Phase 1 done, and its geometry must not be\n# touched. Skipping the spec is how a reference's root-font ladder and its\n# per-component height ladders get found reactively, after the region has\n# already failed several rounds. This refuses the run instead of trusting anyone\n# to remember.\nset -u\n# Everything configurable lives in matching/harness.json; harness.mjs is the one\n# reader. --env emits shell-safe assignments (REF, CAND, MATRIX, VIEWPORTS_SP,\n# THRESHOLD, MAX_HEIGHT_DELTA, PD, SC, REPORT_SCHEMA).\neval \"$(node \"$(dirname \"$0\")/harness.mjs\" --env)\"\n\n# The skill must be able to write reports this site's scripts can read. Cheap,\n# local, and it fails before any browser starts.\nPD_SCHEMA=\"$(node \"$PD\" --version 2>/dev/null | awk '{print $4}')\"\nif [ \"$PD_SCHEMA\" != \"$REPORT_SCHEMA\" ]; then\n  echo \"gate.sh: page-diff writes report schema '\\${PD_SCHEMA:-none}', this harness reads $REPORT_SCHEMA.\" >&2\n  echo \"         Update matching/harness.mjs REPORT_SCHEMA or the matching-a-page skill.\" >&2\n  exit 2\nfi\nSPEC=\"$(dirname \"$0\")/SPEC.md\"\nTAG=\"\\${1:?usage: gate.sh <round-tag> [page ...]}\"\n# The tag must not contain a hyphen. Output dirs are \"out-<TAG>-<page>\", and\n# next.mjs recovers the page with /^out-[^-]+-(.+)$/ — it splits on the FIRST\n# hyphen, so a tag like \"r-forms-2026-08-07\" yields the page key\n# \"forms-2026-08-07-yfv\" and that run is silently never counted. It cannot split\n# on the last hyphen instead, because page keys have hyphens of their own\n# (\"our-team\", \"ask-the-doctor\"). Failing here is the cheap end of that: a\n# mis-tagged round otherwise LOOKS green because next.mjs keeps reading an older\n# report for the page you just changed. (Cost this once, 2026-08-07.)\ncase \"$TAG\" in\n  *-*)\n    echo \"gate.sh: round tag must not contain a hyphen (got '$TAG').\" >&2\n    echo \"         out-<TAG>-<page> is parsed on the first hyphen, so a\" >&2\n    echo \"         hyphenated tag hides the run from next.mjs. Try '\\${TAG//-/}'.\" >&2\n    exit 2\n    ;;\nesac\nshift || true\nWANT=(\"$@\")\n\n# Fail closed on the reference before spending a single run. A 200 is NOT\n# evidence: a production host that has cut over to OUR build answers 200, and\n# every region then scores near zero against itself. --check-ref requires an\n# artefact only the reference serves (harness.json refMark) and refuses a\n# redirect, a host listed in selfHosts, and a body carrying candMark. Measured\n# on the site this harness was cut from, 2026-09-09 AFTER the consolidation:\n# 12 of its 214 top-level matching scripts still assign REF a host listed in\n# selfHosts — i.e. compare the candidate with itself. It was 33 of 229 before.\n# (This comment read \"33 of its 230\" while sitting in the post-consolidation\n# tree, contradicting harness.mjs's 12 three files away.)\nif ! node \"$(dirname \"$0\")/harness.mjs\" --check-ref; then\n  echo \"gate.sh: refusing to gate against an unverified reference.\" >&2\n  exit 2\nfi\n\n# Set SPEC_OPTIONAL=1 only for a read-only baseline sweep of pages you are not\n# about to edit. It is recorded in the round tag so the exemption is visible.\nSPEC_OPTIONAL=\"\\${SPEC_OPTIONAL:-0}\"\n\nhas_spec() { # page\n  # NB: the obvious \\`( |$|\\\\b)\\` guard is rejected by ugrep as an empty\n  # subexpression, and a preflight that errors out fails CLOSED — it refused all\n  # 9 pages while SPEC.md was complete. Match the page key followed by any\n  # non-key character (so \\`## team\\` matches but \\`## teamfoo\\` does not; \\`##\n  # our-team\\` cannot match \\`team\\` because the key must follow the spaces).\n  [ -f \"$SPEC\" ] && grep -qE \"^##+ +$1([^A-Za-z0-9_-]|$)\" \"$SPEC\"\n}\n\nrun() { # tag refpath candpath sections\n  local page=\"$1\" refpath=\"$2\" candpath=\"$3\" sections=\"$4\"\n  if [ \\${#WANT[@]} -gt 0 ]; then\n    local hit=0\n    for w in \"\\${WANT[@]}\"; do [ \"$w\" = \"$page\" ] && hit=1; done\n    [ $hit -eq 1 ] || return 0\n  fi\n  if ! has_spec \"$page\"; then\n    if [ \"$SPEC_OPTIONAL\" = \"1\" ]; then\n      echo \"########## $page ##########\"\n      echo \"WARNING: no '## $page' section in matching/SPEC.md — Phase 1 not done.\"\n      echo \"         Running anyway because SPEC_OPTIONAL=1 (baseline read only).\"\n      echo \"         Do NOT apply geometry fixes off this run.\"\n    else\n      echo \"########## $page ##########\"\n      echo \"REFUSED: no '## $page' section in matching/SPEC.md.\"\n      echo \"         Phase 1 (section census + per-section spec, read from\"\n      echo \"         matching/spec/) comes before geometry.\"\n      echo \"         See CLAUDE.md rule 2. SPEC_OPTIONAL=1 for a baseline read.\"\n      FAILED_PREFLIGHT=1\n      return 0\n    fi\n  fi\n  echo \"########## $page ##########\"\n  node \"$PD\" --ref \"$REF$refpath\" --cand \"$CAND$candpath\" \\\\\n    --viewports \"$MATRIX\" --threshold \"$THRESHOLD\" \\\\\n    --sections \"$sections\" --out \"matching/out-$TAG-$page\" \\\\\n    > \"matching/out-$TAG-$page.log\" 2>&1\n  echo \"$page exit=$?\"\n}\n\n# The page table is matching/harness.json. Process substitution, NOT a pipe:\n# a pipe would run this loop in a subshell and FAILED_PREFLIGHT would not\n# survive to the check below, so a refused page would exit 0.\nwhile IFS=$'\\\\t' read -r key refpath candpath anchors; do\n  run \"$key\" \"$refpath\" \"$candpath\" \"$anchors\"\ndone < <(node \"$(dirname \"$0\")/harness.mjs\" --table)\n\nif [ \"\\${FAILED_PREFLIGHT:-0}\" = \"1\" ]; then\n  echo\n  echo \"GATE INCOMPLETE ($TAG) — one or more pages were refused for a missing\"\n  echo \"SPEC.md section. Those pages have NOT been measured; do not report a\"\n  echo \"score for them.\"\n  exit 2\nfi\necho \"ALL DONE ($TAG)\"\n`;\n\nexport const CENSUS_SH_RELATIVE = \"matching/census.sh\";\nexport const CENSUS_SH_TEMPLATE = `#!/usr/bin/env bash\n# Phase 3 style gate — the mechanical net for the type spec.\n#\n#   bash matching/census.sh            # all 9 pages, all 3 viewports\n#   bash matching/census.sh home yfv   # just these\n#\n# style-census diffs the computed type tuple (family, weight, size,\n# line-height, letter-spacing, transform, colour) of every text snippet present\n# on BOTH pages. It is the only gate that catches the 11px footer line and the\n# cyan-vs-teal link that page-diff is structurally blind to — a region can be\n# pixel-clean at 0.10 and still be wearing the wrong colour on small text.\n#\n# Prints a per-page/per-viewport mismatch count and leaves the full runs in\n# matching/census-<page>-<vw>.log. Exits 1 while any count is non-zero, and 2\n# when it cannot honestly report a count at all.\n#\n# EVIDENCE — read before adding a guard here, or removing one. A green here\n# has to be produced by a census that RAN. It was not: with style-census.mjs\n# absent this gate printed \"Phase 3 CLEAN — 0 undeclared type mismatches\" and\n# exited 0. Every run died on module resolution, census-count.mjs read each\n# crash log as \"0 0 0\" (it counts \\`  y=\\` rows and a stack trace has none —\n# census-count.mjs:35-56), and no rows was reported as no mismatches. Measured\n# again with style-census.mjs PRESENT and the candidate host down: identical\n# output, because style-census exits 1 both when it finds mismatches\n# (style-census.mjs:187) and when it dies before it looks — so the exit status\n# cannot tell a finding from a crash and may not grant a green either.\n#\n# The guards below are what next.mjs:83-89 (no parseable gate run — refusing to\n# report a score), strikes.mjs:87-97 (refusing to report \"clear\") and\n# gate.sh:37-42 (preflight page-diff before spending a run) already do. Each\n# demands an artefact only a working census produces; none of them can turn a\n# red green.\nset -uo pipefail\n# Resolved BEFORE the cd. $0 is the path as TYPED, so a relatively invoked\n# census.sh that resolved the harness afterwards would look for it under\n# whatever root the cd landed on.\nHARNESS=\"$(cd \"$(dirname \"$0\")\" && pwd)/harness.mjs\"\ncd \"$(dirname \"$0\")/..\"\n\n# Everything configurable lives in matching/harness.json; harness.mjs is the one\n# reader. --env supplies REF, CAND, SC and VIEWPORTS_SP — this gate held its own\n# copy of all four, and its REF went stale when production cut over to our own\n# build (LEDGER \"REFERENCE MOVED\", verified 2026-08-10) while gate.sh's was\n# repointed the same day.\neval \"$(node \"$HARNESS\" --env)\"\nNODE=\"\\${NODE:-node}\"\n\n# The matrix is DATA, read as VIEWPORTS_SP, the way gate.sh reads MATRIX. The\n# old VIEWPORTS override is retired rather than silently ignored: a census run\n# over a matrix harness.json does not name is a column set the pixel gate never\n# measured, and it would look exactly like a clean one.\nif [ -n \"\\${VIEWPORTS:-}\" ]; then\n  echo \"census.sh: the VIEWPORTS override is retired — the matrix is data now.\" >&2\n  echo \"           Edit \\\\\"matrix\\\\\" in matching/harness.json, then unset it.\" >&2\n  exit 2\nfi\n\n# GUARD 1 — the tool is there and it starts. gate.sh compares \\`page-diff\n# --version\\` with the harness's REPORT_SCHEMA before spending a run\n# (gate.sh:37-42); style-census has no --version to compare (page-diff.mjs\n# defines one at 191-195; nothing in style-census.mjs writes one), so the\n# artefact demanded here is the other one only it produces: the usage banner it\n# prints on exit 2 when --ref/--cand are missing (style-census.mjs:151-157).\n# That banner is not free — \\`import { chromium } from \"playwright\"\\` runs first\n# (style-census.mjs:19) — so a skill directory with no playwright installed\n# fails HERE, once, instead of writing one crash log per page per viewport that\n# every reader downstream counts as zero.\nif [ ! -f \"$SC\" ]; then\n  echo \"census.sh: no style-census at $SC — refusing to report a count.\" >&2\n  echo \"           Install the matching-a-page skill, or point MATCHING_SKILL_DIR\" >&2\n  echo \"           at a checkout that has style-census.mjs.\" >&2\n  exit 2\nfi\nSC_USAGE=\"$(\"$NODE\" \"$SC\" 2>&1)\"\ncase \"$SC_USAGE\" in\n  *\"style-census\"*\"--ref\"*\"--cand\"*\"--vw\"*) ;;\n  *)\n    echo \"census.sh: $SC did not answer with a style-census --ref/--cand/--vw usage\" >&2\n    echo \"           banner — refusing to report a count. It printed:\" >&2\n    echo \"           \\${SC_USAGE:-(nothing at all)}\" >&2\n    exit 2\n    ;;\nesac\n\ndeclare -a WANT=(\"$@\")\n\n# page -> \"refpath candpath\": the same table gate.sh drives, from the same file.\n# cut drops the anchors column, which the style census has no argument for\n# (style-census.mjs: --ref <url> --cand <url> [--vw 1440]).\npages() { node \"$HARNESS\" --table | cut -f1-3; }\n\nTOTAL=0\nAMB=0\nDECL=0\nROWS=0\nRUNS=0\nBROKEN=0\nSEEN=\"\"\n# One column per viewport, from the matrix. Flush with the data rows below, at\n# last: the old header hardcoded four fixed fields separated by a literal space,\n# which the rows do not have, so its labels sat 1/2/3 columns right of them.\nprintf '%-10s' page\nfor vw in $VIEWPORTS_SP; do printf '%8s' \"$vw\"; done\nprintf '\\\\n'\nwhile read -r page refpath candpath; do\n  [ -z \"$page\" ] && continue\n  SEEN=\"$SEEN $page\"\n  if [ \\${#WANT[@]} -gt 0 ]; then\n    hit=0\n    for w in \"\\${WANT[@]}\"; do [ \"$w\" = \"$page\" ] && hit=1; done\n    [ $hit -eq 1 ] || continue\n  fi\n  ROWS=$((ROWS + 1))\n  line=$(printf '%-10s' \"$page\")\n  for vw in $VIEWPORTS_SP; do\n    log=\"matching/census-$page-$vw.log\"\n    RUNS=$((RUNS + 1))\n    \"$NODE\" \"$SC\" --ref \"$REF$refpath\" --cand \"$CAND$candpath\" --vw \"$vw\" >\"$log\" 2>&1\n    # GUARD 2 — this run produced a census. The header and the counts line are\n    # written together at style-census.mjs:166-169 and only after both pages\n    # have been walked, so they are the artefact a completed run leaves and a\n    # crashed one cannot. The viewport is read back out of the header because a\n    # --vw that did not take would otherwise fill three differently named logs\n    # with the same 1440 census. \\`ref runs\\`/\\`cand runs\\` must be non-zero: two\n    # pages that rendered no text at all agree perfectly and mean nothing.\n    if ! grep -qE \"^=== style census, viewport $vw ===\\\\$\" \"$log\" ||\n      ! grep -qE \"^ref runs: [1-9][0-9]* +cand runs: [1-9][0-9]* +mismatches: [0-9]+ +ambiguous: [0-9]+\\\\$\" \"$log\"; then\n      BROKEN=$((BROKEN + 1))\n      echo \"census.sh: $page @$vw produced no usable census — see $log\" >&2\n      line=\"$line$(printf '%8s' '!!')\"\n      continue\n    fi\n    # census-count splits the log three ways: REAL mismatches, AMBIGUOUS\n    # same-text collisions (style-census's own split), and DECLARED rows the\n    # operator has already ruled on (matching/census-deviations.mjs, the same\n    # contract as floors.mjs). Only the first is outstanding work — without the\n    # third, this gate can never reach zero and its number means nothing.\n    read -r n a d <<<\"$(\"$NODE\" matching/census-count.mjs \"$log\")\"\n    # GUARD 2b — three integers, or the counter did not count. census-count.mjs\n    # is the reader that turned a stack trace into \"0 0 0\"; a run of it that\n    # dies (a broken census-deviations.mjs, a bad path) prints nothing at all,\n    # and bash reads an empty $n as zero in the arithmetic below.\n    counted=1\n    for v in \"\\${n:-}\" \"\\${a:-}\" \"\\${d:-}\"; do\n      case \"$v\" in \"\" | *[!0-9]*) counted=0 ;; esac\n    done\n    if [ \"$counted\" -eq 0 ]; then\n      BROKEN=$((BROKEN + 1))\n      echo \"census.sh: census-count.mjs did not return three counts for $log\" >&2\n      line=\"$line$(printf '%8s' '!!')\"\n      continue\n    fi\n    # GUARD 2c — the number reported is the number the census MEASURED. GUARD 2\n    # matched the counts line for PRESENCE and threw its numbers away, so the\n    # count printed below came from census-count's row parse and nothing ever\n    # compared the two. Measured 2026-09-09: a COMPLETE census whose counts line\n    # said \"mismatches: 3\", whose \\`y=\\` rows carried one leading space instead of\n    # two (census-count.mjs:39 matches /^ {2}y=/), was reported as 0 and this\n    # gate printed \"Phase 3 CLEAN — 0 undeclared type mismatches\", exit 0. The\n    # printer lives in the SKILL (style-census.mjs:171-173) and the parser is\n    # copied into every site, so the two version independently and drift needs\n    # nobody to touch either repo.\n    #\n    # The identity is exact for mismatches: style-census prints at most 100 rows\n    # and states the remainder on its own line (style-census.mjs:175-177), so\n    # parsed + remainder == reported. Ambiguous rows are capped the same way\n    # (:184) but the remainder is NOT stated, so only a floor is checkable\n    # there — any is not none, and the parse may never exceed the report.\n    counts=$(grep -E \"^ref runs: [1-9][0-9]* +cand runs: [1-9][0-9]* +mismatches: [0-9]+ +ambiguous: [0-9]+$\" \"$log\" | tail -1)\n    said_m=\\${counts##*mismatches: }\n    said_m=\\${said_m%% *}\n    said_a=\\${counts##*ambiguous: }\n    more=$(sed -n 's/^ *… and \\\\([0-9][0-9]*\\\\) more (truncated print, all counted)$/\\\\1/p' \"$log\" | tail -1)\n    if [ $((n + d + \\${more:-0})) -ne \"$said_m\" ] ||\n      [ \"$a\" -gt \"$said_a\" ] ||\n      { [ \"$said_a\" -gt 0 ] && [ \"$a\" -eq 0 ]; }; then\n      BROKEN=$((BROKEN + 1))\n      echo \"census.sh: $log reports mismatches: $said_m ambiguous: $said_a, but\" >&2\n      echo \"           census-count.mjs read $((n + d)) mismatch row(s)\\${more:+ (+ $more truncated)} and $a ambiguous.\" >&2\n      echo \"           The census and its reader disagree; there is no count to report.\" >&2\n      line=\"$line$(printf '%8s' '!!')\"\n      continue\n    fi\n    AMB=$((AMB + a))\n    DECL=$((DECL + d))\n    TOTAL=$((TOTAL + n))\n    line=\"$line$(printf '%8s' \"$n\")\"\n  done\n  echo \"$line\"\ndone < <(pages)\n\necho\n# GUARD 3 — something was actually censused. Process substitution above, NOT a\n# pipe: a pipe runs the loop in a subshell and every counter here would still\n# read 0, which is exactly the green this file exists to stop (gate.sh:123-125\n# records the same trap for FAILED_PREFLIGHT). A page name that matches nothing\n# must not report CLEAN either — strikes.mjs:147-156 is the same refusal, and\n# it was written because a typo silently greened rule 3 on six of nine pages.\nif [ \"$ROWS\" -eq 0 ]; then\n  if [ -n \"$SEEN\" ]; then\n    echo \"census.sh: \\\\\"\\${WANT[*]:-}\\\\\" matches no page — refusing to report CLEAN.\" >&2\n    echo \"           known pages:$SEEN\" >&2\n  else\n    echo \"census.sh: the page table is empty — refusing to report CLEAN.\" >&2\n    echo \"           node matching/harness.mjs --table printed no rows; check\" >&2\n    echo \"           \\\\\"pages\\\\\" in matching/harness.json.\" >&2\n  fi\n  exit 2\nfi\nif [ \"$BROKEN\" -gt 0 ]; then\n  echo \"CENSUS INCOMPLETE — $BROKEN of $RUNS run(s) produced no usable census (marked !!).\"\n  echo \"Those page/viewport pairs have NOT been measured; there is no count to\"\n  echo \"report for them, and the totals below would be a floor, not a score.\"\n  echo \"Full runs: matching/census-<page>-<vw>.log\"\n  exit 2\nfi\nif [ \"$TOTAL\" -eq 0 ]; then\n  echo \"Phase 3 CLEAN — 0 undeclared type mismatches ($DECL declared, $AMB ambiguous).\"\n  echo \"($RUNS censused run(s) over $ROWS page(s), each one counted.)\"\n  [ \"$AMB\" -gt 0 ] && echo \"($AMB ambiguous same-text rows remain: each needs ADJUDICATING,\" &&\n    echo \" not fixing — our element matches, another sharing its text does not.)\"\n  exit 0\nfi\necho \"$TOTAL type mismatch(es) remain (+ $AMB ambiguous, $DECL declared).\"\necho \"Full runs: matching/census-<page>-<vw>.log\"\necho \"A mismatch is a defect or a ledgered deviation. An ambiguous row is neither\"\necho \"until you look: the census keys on TEXT, so two different elements sharing a\"\necho \"string land under one key and only one of them may be wrong.\"\nexit 1\n`;\n\nexport const NEXT_MJS_RELATIVE = \"matching/next.mjs\";\nexport const NEXT_MJS_TEMPLATE = `// What is still broken, ranked. Exits 1 while work remains.\n//\n//   node matching/next.mjs\n//\n// Round protocol step 0 (repo CLAUDE.md rule 5). A commit is a CHECKPOINT, not\n// a stopping point: after committing, run this. If it exits 1 there is a named\n// next action and the round continues without handing control back.\n//\n// Reads the most recent gate log per page rather than the whole corpus, so it\n// reflects HEAD rather than history (that is strikes.mjs's job).\nimport { existsSync, readdirSync, readFileSync, statSync } from \"node:fs\";\nimport { join } from \"node:path\";\n\nconst DIR = new URL(\".\", import.meta.url).pathname;\n\n// PAUSE SWITCH. While matching/PAUSED exists this hands out no agenda and\n// exits 0. It is deliberately the FIRST thing that runs: no report is read, no\n// score is printed, nothing tempting is put on screen to argue with.\n//\n// Why an exit code and not a note somewhere: rule 5 is a LOOP — \"after\n// committing, run next.mjs; while it exits 1 there is a named next action and\n// the round continues\". A pause written as prose loses to that loop, because\n// the loop is mechanical and the prose is not. Exiting 0 satisfies rule 5\n// truthfully rather than suspending it: there is no next action.\nconst PAUSE = join(DIR, \"PAUSED\");\nif (existsSync(PAUSE)) {\n  console.log(\"MATCHING PAUSED — no agenda, and none is to be inferred.\\\\n\");\n  console.log(readFileSync(PAUSE, \"utf8\").trimEnd());\n  process.exit(0);\n}\n\nimport { FLOORS, ACCEPTED } from \"./floors.mjs\";\nimport { TOTALS, THRESHOLD, MAX_HEIGHT_DELTA, REPORT_SCHEMA } from \"./harness.mjs\";\n\n// Reports written by a different page-diff, by page key. Kept rather than\n// dropped: silently ignoring them is how a page vanishes from the score.\nconst schemaMismatch = new Set();\n\nconst latest = new Map();\nfor (const d of readdirSync(DIR).filter((d) => d.startsWith(\"out-\"))) {\n  const m = /^out-[^-]+-(.+)$/.exec(d);\n  if (!m || !TOTALS[m[1]]) continue;\n  let report, mtime;\n  try {\n    const p = join(DIR, d, \"report.json\");\n    report = JSON.parse(readFileSync(p, \"utf8\"));\n    mtime = statSync(p).mtimeMs;\n  } catch {\n    continue;\n  }\n  // A masked / media-neutralised run is a DIAGNOSTIC, never the state of the\n  // page. Picking one up as \"latest\" silently reports scores nobody can ship —\n  // it happened immediately: an --mask-photos probe of yfv made \\`top\\` @834 read\n  // 43.9% here while the real gate had it passing at 1.3%.\n  const meta = report.meta ?? {};\n  // Missing schemaVersion means \"written before the field existed\" = 0. It is\n  // not an error on its own; it is only fatal when it would blank a page.\n  if ((meta.schemaVersion ?? 0) !== REPORT_SCHEMA) {\n    schemaMismatch.add(m[1]);\n    continue;\n  }\n  if (\n    (meta.mask?.length ?? 0) > 0 ||\n    meta.neutralizeMedia ||\n    meta.maskPhotos ||\n    meta.truncated\n  )\n    continue;\n  if (meta.threshold !== THRESHOLD) continue;\n  const prev = latest.get(m[1]);\n  if (!prev || mtime > prev.mtime) latest.set(m[1], { dir: d, mtime, report });\n}\n\nconst blanked = [...schemaMismatch].filter((p) => !latest.has(p));\nif (blanked.length) {\n  console.error(\n    \\`next: \\${blanked.length} page(s) have no run at report schema \\${REPORT_SCHEMA} — \\` +\n      \\`their newest reports came from a different page-diff (\\${blanked.sort().join(\", \")}).\\\\n\\` +\n      \\`      Re-run: bash matching/gate.sh <tag> \\${blanked.sort().join(\" \")}\\`,\n  );\n  process.exit(2);\n}\nif (latest.size === 0) {\n  console.error(\n    \"next: no parseable gate run under matching/ — refusing to report a score.\\\\n\" +\n      \"      Run bash matching/gate.sh <tag> first.\",\n  );\n  process.exit(2);\n}\n\nconst rows = [];\nconst accepted = [];\nlet openTotal = 0;\nlet floorTotal = 0;\nfor (const [page, { dir, report }] of latest) {\n  const fails = report.regions.filter((r) => !r.pass);\n  for (const f of fails) {\n    const floor = FLOORS.find((fl) => fl.match(f, page));\n    if (floor) {\n      floorTotal++;\n      continue;\n    }\n    const ack = ACCEPTED.find((a) => a.match(f, page));\n    if (ack) {\n      accepted.push({ page, vw: f.viewport, label: f.label, why: ack.why });\n      continue;\n    }\n    openTotal++;\n    rows.push({\n      page,\n      vw: f.viewport,\n      label: f.label,\n      mm: f.mismatchFraction,\n      dh: f.heightDeltaFraction ?? 0,\n      dir,\n    });\n  }\n}\n\nconst scored = [...latest.entries()]\n  .map(([p, v]) => ({\n    p,\n    pass: v.report.regions.filter((r) => r.pass).length,\n    total: TOTALS[p],\n  }))\n  .sort((a, b) => a.pass / a.total - b.pass / b.total);\n\nconst sum = scored.reduce((a, s) => a + s.pass, 0);\nconst max = scored.reduce((a, s) => a + s.total, 0);\nconsole.log(\\`SCORE \\${sum}/\\${max} regions passing\\\\n\\`);\nconsole.log(\n  scored\n    .map((s) => \\`  \\${s.p.padEnd(9)} \\${String(s.pass).padStart(2)}/\\${s.total}\\`)\n    .join(\"\\\\n\"),\n);\n\nif (accepted.length) {\n  console.log(\\`\\\\nOperator-ACCEPTED failures (left failing on purpose):\\`);\n  for (const a of accepted)\n    console.log(\\`  \\${a.page} @\\${a.vw} \"\\${a.label}\" — \\${a.why.slice(0, 96)}…\\`);\n}\n\nif (!rows.length) {\n  console.log(\n    \\`\\\\nNo open geometry failures. \\${floorTotal} declared floor(s) remain.\\`,\n  );\n  console.log(\n    \"Backlog is empty — Phases 5 (states) and 6 (adversarial review) are what is left.\",\n  );\n  process.exit(0);\n}\n\n// Worst page first, then worst region inside it: fix where the model is most wrong.\nconst worst = scored[0].p;\nrows.sort(\n  (a, b) =>\n    (a.page === worst ? -1 : 0) - (b.page === worst ? -1 : 0) || b.mm - a.mm,\n);\n\nconsole.log(\n  \\`\\\\n\\${openTotal} open failure(s) + \\${floorTotal} declared floor(s).\\`,\n);\nconsole.log(\\`\\\\nNEXT: \\${worst} — worst page. Its open regions:\\\\n\\`);\nfor (const r of rows.filter((r) => r.page === worst)) {\n  const why = [];\n  if (r.mm > THRESHOLD) why.push(\\`pixels \\${(r.mm * 100).toFixed(1)}%\\`);\n  if (Math.abs(r.dh) > MAX_HEIGHT_DELTA)\n    why.push(\\`height \\${(r.dh * 100).toFixed(1)}%\\`);\n  console.log(\n    \\`  @\\${String(r.vw).padEnd(5)} \\${r.label.slice(0, 44).padEnd(45)} \\${why.join(\" + \")}\\`,\n  );\n}\nconsole.log(\\`\\\\nBefore treating any of these as geometry:\\`);\nconsole.log(\n  \\`  node matching/probe-anchor-parity.mjs \\${worst}   # is the gate cutting comparably?\\`,\n);\nconsole.log(\n  \\`  node matching/strikes.mjs \\${worst}               # has it stalled? then change the MODEL\\`,\n);\nconsole.log(\n  \\`\\\\nRound continues. Do not hand back control with work outstanding.\\`,\n);\nprocess.exit(1);\n`;\n\nexport const STRIKES_MJS_RELATIVE = \"matching/strikes.mjs\";\nexport const STRIKES_MJS_TEMPLATE = `// The 3-strike rule, made countable.\n//\n//   node matching/strikes.mjs [page]\n//\n// The matching skill says: \"A region that has not improved after 3 fix ->\n// re-run cycles: stop. Present the three attempts. Do not widen the threshold,\n// mask it, or reclassify it — a stuck region means your model of it is wrong.\"\n//\n// That rule was blown twice on this project (services \\`top\\`, yfv \\`top\\`) purely\n// because nobody was counting. This reads every matching/out-*/report.json,\n// reconstructs each region's history in chronological order, and prints the\n// regions that are OUT OF STRIKES. Exit 1 when any exist, so a round that\n// starts by running this cannot quietly attempt a fourth cycle.\n//\n// WHAT THIS ACTUALLY MEASURES (read before trusting a number): report.json\n// cannot record INTENT, so a \"cycle\" here is any completed gate run in which\n// the region was still failing and did not improve by IMPROVE_PP. Runs aimed at\n// a different region on the same page therefore count too. That makes this a\n// STALL detector, not a literal attempt counter — \"this has been failing,\n// unchanged, across N gate runs while you were working on this page.\" That is\n// the more useful discipline number anyway, and it is honest about being an\n// upper bound. Improvement resets the count: real progress earns a fresh start.\nimport { existsSync, readdirSync, readFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { FLOORS } from \"./floors.mjs\";\nimport {\n  PAGES,\n  THRESHOLD,\n  MAX_HEIGHT_DELTA,\n  REPORT_SCHEMA,\n} from \"./harness.mjs\";\n\n// PAUSE SWITCH — see matching/next.mjs for why this is an exit code. Round\n// protocol step 1 is \"run strikes.mjs; the stalled regions are the agenda\", so\n// this is the second door into the backlog and has to be shut too. Exits 0:\n// there are no strikes to spend when no round is being played.\nconst PAUSED = join(new URL(\".\", import.meta.url).pathname, \"PAUSED\");\nif (existsSync(PAUSED)) {\n  console.log(\"MATCHING PAUSED — no agenda, and none is to be inferred.\\\\n\");\n  console.log(readFileSync(PAUSED, \"utf8\").trimEnd());\n  process.exit(0);\n}\n\nconst IMPROVE_PP = 0.01; // 1 percentage point = the smallest move worth calling progress\nconst MAX_STRIKES = 3;\nconst ROOT = new URL(\".\", import.meta.url).pathname;\nconst only = process.argv[2] ?? null;\n\n// The gate key for a report, from its ref path. Deriving it by string surgery\n// disagreed with the gate on exactly six of the nine rows — yfv, contact, atd,\n// svc, qa and team (measured 2026-09-09 against harness.json); the table knows.\n// keyOf (below) stays as the fallback for a run whose ref was rewritten.\nconst pageOf = (ref) => {\n  const path = new URL(ref).pathname.replace(/\\\\/$/, \"\") || \"/\";\n  return PAGES.find((p) => p.ref === path)?.key ?? null;\n};\n\nconst runs = [];\nconst unreadable = [];\nfor (const dir of readdirSync(ROOT).filter((d) => d.startsWith(\"out-\"))) {\n  let report;\n  try {\n    report = JSON.parse(readFileSync(join(ROOT, dir, \"report.json\"), \"utf8\"));\n  } catch {\n    continue; // not a completed run dir\n  }\n  if (!report.meta?.ref || !Array.isArray(report.regions)) continue;\n  // A report from another schema is still usable for a STALL count as long as\n  // it carries the two fields this reads. Anything else is counted and named,\n  // never silently dropped — an under-counted history reads as \"clear\".\n  const usable = report.regions.every(\n    (r) =>\n      typeof r.mismatchFraction === \"number\" && typeof r.pass === \"boolean\",\n  );\n  if (!usable) {\n    unreadable.push(\\`\\${dir} (schema \\${report.meta.schemaVersion ?? 0})\\`);\n    continue;\n  }\n  runs.push({\n    dir,\n    at: report.meta.generatedAt,\n    meta: report.meta,\n    regions: report.regions,\n  });\n}\n\n// The failure mode of a stall detector is always \"clear\", which is exactly the\n// answer that stops nobody. A corpus this could not read is not a clean one.\nif (runs.length === 0) {\n  console.error(\n    \\`strikes: no parseable gate run under matching/ — refusing to report \"clear\".\\` +\n      (unreadable.length\n        ? \\`\\\\n         \\${unreadable.length} report(s) unreadable at schema \\${REPORT_SCHEMA}: \\${unreadable.slice(0, 5).join(\", \")}\\`\n        : \"\"),\n  );\n  process.exit(2);\n}\nif (unreadable.length) {\n  console.error(\n    \\`strikes: ignored \\${unreadable.length} unreadable report(s) — the history below is incomplete.\\` +\n      \\`\\\\n         \\${unreadable.slice(0, 5).join(\", \")}\\`,\n  );\n}\n\nruns.sort((a, b) => a.at.localeCompare(b.at));\n\n// The gate page KEY, recovered from the run dir the way next.mjs does it\n// (out-<TAG>-<page>, split on the first hyphen — the tag is hyphen-free by\n// gate.sh's own preflight). \\`pageOf\\` now returns that same key off the table,\n// so the two vocabularies agree and the round protocol in CLAUDE.md — \"run\n// \\`strikes.mjs <page>\\` with the key you just passed to gate.sh\", which until\n// 2026-08-13 silently matched nothing — works either way. This stays because\n// a dir key is not always a gate key: 69 of this corpus's 377 run dirs are\n// hand-named probes (out-band3, out-390masked), and FLOORS matches on it.\nconst keyOf = (dir) => /^out-[^-]+-(.+)$/.exec(dir)?.[1] ?? null;\n\n// key -> chronological list of {dir, at, mm, pass, masked}\nconst history = new Map();\nconst seenNames = new Set();\nfor (const run of runs) {\n  const page = pageOf(run.meta.ref) ?? keyOf(run.dir) ?? \"unknown\";\n  const gateKey = keyOf(run.dir);\n  seenNames.add(page);\n  if (gateKey) seenNames.add(gateKey);\n  if (only && page !== only && gateKey !== only) continue;\n  for (const r of run.regions) {\n    // A DECLARED FLOOR is flat by definition — reporting it as stalled is noise\n    // that hides a real stall. It stays in the LEDGER; it does not belong here.\n    if (FLOORS.some((fl) => fl.match(r, gateKey || page))) continue;\n    const key = \\`\\${page}|\\${r.viewport}|\\${r.label}\\`;\n    if (!history.has(key)) history.set(key, []);\n    history.get(key).push({\n      dir: run.dir,\n      at: run.at,\n      mm: r.mismatchFraction,\n      dh: r.heightDeltaFraction,\n      pass: r.pass,\n      // a run with masks/neutralised media is not comparable to a clean one\n      dirty:\n        (run.meta.mask?.length ?? 0) > 0 ||\n        run.meta.neutralizeMedia ||\n        run.meta.maskPhotos,\n    });\n  }\n}\n\n// A name that matches no run must NOT report \"clear\". This check exists to stop\n// work on a stalled region, so failing open is the one thing it may never do —\n// a typo'd or wrong-vocabulary page silently greened rule 3 for six of the nine\n// pages. Fail loud instead, and say what the vocabulary is.\nif (only && history.size === 0) {\n  console.error(\n    \\`strikes: \"\\${only}\" matches no gate run — refusing to report \"clear\".\\\\n\\` +\n      \\`         known pages: \\${[...seenNames].sort().join(\", \")}\\`,\n  );\n  process.exit(2);\n}\n\nconst stuck = [];\nfor (const [key, all] of history) {\n  const h = all.filter((e) => !e.dirty); // compare like with like\n  if (h.length === 0) continue;\n  const last = h[h.length - 1];\n  if (last.pass) continue;\n\n  let best = Infinity;\n  let strikes = 0;\n  let sinceIdx = 0;\n  for (let i = 0; i < h.length; i++) {\n    if (h[i].mm < best - IMPROVE_PP) {\n      best = Math.min(best, h[i].mm);\n      strikes = 0;\n      sinceIdx = i;\n    } else {\n      best = Math.min(best, h[i].mm);\n      strikes++;\n    }\n  }\n  if (strikes >= MAX_STRIKES) stuck.push({ key, strikes, h, sinceIdx, last });\n}\n\n// Triage order: the worst-matching region that has never moved is the one whose\n// model is most wrong. Sorting by strike count instead would put a 0.3% region\n// that only fails on height above a 76% region that fails on everything.\nstuck.sort((a, b) => b.last.mm - a.last.mm);\n\nif (stuck.length === 0) {\n  console.log(\n    \\`strikes: clear — no failing region has stalled for \\${MAX_STRIKES}+ gate runs\\` +\n      (only ? \\` on \\${only}\\` : \"\") +\n      \".\",\n  );\n  process.exit(0);\n}\n\nconst why = (e) => {\n  const reasons = [];\n  if (e.mm > THRESHOLD) reasons.push(\\`pixels \\${(e.mm * 100).toFixed(1)}%\\`);\n  if (Math.abs(e.dh ?? 0) > MAX_HEIGHT_DELTA)\n    reasons.push(\\`height \\${((e.dh ?? 0) * 100).toFixed(1)}%\\`);\n  return reasons.join(\" + \") || \"marginal\";\n};\n\nconsole.log(\n  \\`STALLED — \\${stuck.length} failing region(s) have not moved in \\${MAX_STRIKES}+ gate runs.\\\\n\\` +\n    \\`These need a new model or the operator, not another attempt. Worst first:\\\\n\\`,\n);\nfor (const { key, strikes, h, sinceIdx, last } of stuck.slice(0, 20)) {\n  const [page, vw, label] = key.split(\"|\");\n  console.log(\n    \\`\\${page} @\\${vw}  \"\\${label}\"  — \\${why(last)}, flat across \\${strikes} runs\\`,\n  );\n  const window = h.slice(Math.max(0, sinceIdx));\n  const shown = window.length > 4 ? [window[0], ...window.slice(-3)] : window;\n  for (const [i, e] of shown.entries()) {\n    const gap =\n      window.length > 4 && i === 1\n        ? \\`    ... \\${window.length - 4} more ...\\\\n\\`\n        : \"\";\n    console.log(\n      gap +\n        \\`    \\${(e.mm * 100).toFixed(1).padStart(5)}%  \\${e.at.slice(0, 16).replace(\"T\", \" \")}  \\${e.dir}\\`,\n    );\n  }\n  console.log();\n}\nif (stuck.length > 20) console.log(\\`... and \\${stuck.length - 20} more.\\\\n\\`);\nconsole.log(\n  \"Per the matching skill: present the attempts to the operator.\\\\n\" +\n    \"Do NOT widen the threshold, add a mask, or reclassify them as a floor.\",\n);\nprocess.exit(1);\n`;\n\nexport const BUILD_SPEC_MJS_RELATIVE = \"matching/build-spec.mjs\";\nexport const BUILD_SPEC_MJS_TEMPLATE = `// Assemble matching/SPEC.md from the per-page sections in spec-sections/.\n//\n//   node matching/build-spec.mjs\n//\n// SPEC.md is the Phase 1 deliverable and the thing matching/gate.sh preflights\n// against, so it is GENERATED rather than hand-maintained: edit the section\n// file, rebuild. The page list comes from matching/harness.mjs (the same\n// reader gate.sh's \\`--table\\` loop uses) and the heading test from its\n// specHeadingRe, whose pattern is has_spec's grep verbatim — so a section can\n// no longer build fine here and then re-block its own page at the gate.\nimport { readFileSync, writeFileSync, existsSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { PAGES, specHeadingRe } from \"./harness.mjs\";\n\nconst DIR = new URL(\".\", import.meta.url).pathname;\nconst SECTIONS = join(DIR, \"spec-sections\");\n\n// Order = live's nav order, then the detail templates. Both fall out of the\n// table's own order within each group, so this is not a second list to keep.\nconst KEYS = [\n  ...PAGES.filter((p) => p.group === \"nav\"),\n  ...PAGES.filter((p) => p.group !== \"nav\"),\n].map((p) => p.spec ?? p.key);\n\nconst parts = [];\nconst missing = [];\n\nconst chrome = join(SECTIONS, \"_chrome.md\");\nif (existsSync(chrome)) parts.push(readFileSync(chrome, \"utf8\").trim());\nelse missing.push(\"_chrome\");\n\nfor (const page of KEYS) {\n  const file = join(SECTIONS, \\`\\${page}.md\\`);\n  if (!existsSync(file)) {\n    missing.push(page);\n    continue;\n  }\n  const body = readFileSync(file, \"utf8\").trim();\n  // The preflight greps \\`^##+ +<page>\\`; a section that does not open with its\n  // own key would build fine here and then refuse at the gate, which is the\n  // most confusing possible failure. Catch it now.\n  if (!specHeadingRe(page).test(body)) {\n    console.error(\n      \\`WARNING: \\${page}.md does not open with a '## \\${page}' heading — gate.sh will still refuse this page.\\`,\n    );\n  }\n  parts.push(body);\n}\n\n// The header is a spec-section like any other, so a site can say what a\n// citation looks like there and what its own ladders are. DEFAULT_HEADER is\n// what a site gets before it writes one: the two paragraphs that are true of\n// every project, and nothing that is not.\nconst DEFAULT_HEADER = \\`# Reference spec\n\nGENERATED by \\\\\\`node matching/build-spec.mjs\\\\\\` from \\\\\\`matching/spec-sections/\\\\\\`.\nEdit the section files, not this one.\n\nThis is the Phase 1 deliverable of the \\\\\\`matching-a-page\\\\\\` skill and the\nprecondition \\\\\\`matching/gate.sh\\\\\\` enforces: a page with no section here does not\nget a geometry round (see the matching rules in CLAUDE.md).\n\n\\`;\nconst headerFile = join(SECTIONS, \"_header.md\");\nconst header = existsSync(headerFile)\n  ? readFileSync(headerFile, \"utf8\").trimEnd() + \"\\\\n\\\\n\"\n  : DEFAULT_HEADER;\n\nwriteFileSync(join(DIR, \"SPEC.md\"), header + parts.join(\"\\\\n\\\\n---\\\\n\\\\n\") + \"\\\\n\");\n\nconst built = KEYS.length - missing.filter((m) => m !== \"_chrome\").length;\nconsole.log(\n  \\`SPEC.md built — \\${built}/\\${KEYS.length} pages\\${missing.length ? \\`, MISSING: \\${missing.join(\", \")}\\` : \"\"}\\`,\n);\nprocess.exit(missing.length ? 1 : 0);\n`;\n\nexport const CENSUS_COUNT_MJS_RELATIVE = \"matching/census-count.mjs\";\nexport const CENSUS_COUNT_MJS_TEMPLATE = `// Count one style-census log, splitting declared deviations out of the total.\n//\n//   node matching/census-count.mjs matching/census-home-1440.log\n//   -> \"<real> <ambiguous> <declared>\"\n//\n// census.sh calls this per page/viewport. Parsing the log rather than importing\n// style-census keeps the project's declared-deviation policy out of the shared\n// skill — the skill reports what it sees; the project decides what it has\n// already agreed to.\nimport { readFileSync } from \"node:fs\";\nimport { DECLARED } from \"./census-deviations.mjs\";\n\nconst path = process.argv[2];\nif (!path) {\n  console.error(\"usage: census-count.mjs <census log>\");\n  process.exit(2);\n}\n\n// A log that cannot be READ is not a log with nothing IN it. This printed\n// \"0 0 0\" and exited 0, and census.sh added that to its total — the same green\n// it used to grant for a style-census that never ran. There is no count to\n// give here; say so and let the caller decide, which is never zero.\nlet text = \"\";\ntry {\n  text = readFileSync(path, \"utf8\");\n} catch (e) {\n  console.error(\\`census-count: cannot read \\${path} — \\${e.message}\\`);\n  console.error(\"              a missing log is not a census with no findings.\");\n  process.exit(2);\n}\n\nconst [head, tail = \"\"] = text.split(\"--- AMBIGUOUS\");\n\n/** Pull \\`{label, ref, cand}\\` rows out of a census section. */\nfunction rows(section) {\n  const out = [];\n  const lines = section.split(\"\\\\n\");\n  for (let i = 0; i < lines.length; i++) {\n    if (!/^ {2}y=/.test(lines[i])) continue;\n    const label = lines[i].replace(/^\\\\s*y=\\\\s*\\\\d+\\\\s*/, \"\").trim();\n    const refs = [];\n    const cands = [];\n    for (\n      let j = i + 1;\n      j < lines.length && /^ {4}(ref|cand):/.test(lines[j]);\n      j++\n    ) {\n      const v = lines[j].replace(/^\\\\s*(ref|cand):\\\\s*/, \"\").trim();\n      (lines[j].trim().startsWith(\"ref:\") ? refs : cands).push(v);\n    }\n    if (refs.length && cands.length)\n      out.push({ label, ref: refs[0], cand: cands[0] });\n    else out.push({ label, ref: refs[0] ?? \"\", cand: cands[0] ?? \"\" });\n  }\n  return out;\n}\n\nconst mism = rows(head);\nconst amb = rows(tail);\nconst declared = mism.filter((r) => DECLARED.some((d) => d.match(r)));\nconsole.log(\n  \\`\\${mism.length - declared.length} \\${amb.length} \\${declared.length}\\`,\n);\n`;\n\nexport const HARNESS_JSON_RELATIVE = \"matching/harness.json\";\nexport const HARNESS_JSON_TEMPLATE = `{\n  \"ref\": \"__REF__\",\n  \"cand\": \"http://localhost:5173\",\n  \"matrix\": [\n    1440,\n    834,\n    390\n  ],\n  \"threshold\": 0.1,\n  \"maxHeightDelta\": 0.05,\n  \"refMark\": \"\",\n  \"candMark\": \"_app/immutable\",\n  \"selfHosts\": [],\n  \"pages\": {\n    \"home\": {\n      \"uid\": \"home\",\n      \"ref\": \"/\",\n      \"cand\": \"/dev/match/home\",\n      \"published\": \"/\",\n      \"anchors\": [],\n      \"spec\": \"home\",\n      \"group\": \"nav\"\n    }\n  }\n}\n`;\n\nexport const FLOORS_MJS_RELATIVE = \"matching/floors.mjs\";\nexport const FLOORS_MJS_TEMPLATE = `// The failures we have already established are NOT geometry. Shared by\n// next.mjs (which reports them separately from the backlog) and strikes.mjs\n// (which must not report them as stalled — a region that cannot move is flat\n// by definition, and three strikes on one is noise that hides a real stall).\n// Every entry needs a matching LEDGER entry to stay honest.\n//\n// NOTE the second matcher argument. Region records carry \\`label\\` and\n// \\`viewport\\` but not the page, so an entry keyed on label+viewport alone is\n// safe only where the label is unique site-wide. \"top\" is not — every page has\n// one — so such an entry would silently accept the \\`top\\` failure on EVERY page\n// and hide every real one. next.mjs and strikes.mjs pass the page key as the\n// second argument: take \\`(r, page)\\` unless you have checked the label.\n\n/** Reference behaviour we cannot reproduce (declared floors). */\nexport const FLOORS = [];\n\n/** Regions the OPERATOR has looked at and chosen to leave failing. These are\n *  not floors and are not silently dropped: next.mjs prints them under their\n *  own heading with the decision, so the number never quietly improves. */\nexport const ACCEPTED = [];\n`;\n\nexport const CENSUS_DEVIATIONS_MJS_RELATIVE = \"matching/census-deviations.mjs\";\nexport const CENSUS_DEVIATIONS_MJS_TEMPLATE = `// Style-census rows the OPERATOR has looked at and chosen to keep. Same\n// contract as matching/floors.mjs: nothing is hidden, everything is counted\n// under its own heading, and every entry needs a LEDGER entry to stay honest.\n//\n//   node matching/census-count.mjs <log>   -> \"<real> <ambiguous> <declared>\"\n//\n// Without this, \\`census.sh\\` can never reach zero and an \"N remaining\" figure\n// says nothing about how much work is left — one permanent decision is counted\n// once per page per viewport, so a single ACK can account for dozens of rows.\n\n/** A row is \\`{ label, ref, cand }\\`, each of ref/cand a \"fam | wt | size | lh |\n *  ls | transform | colour\" tuple string. */\nexport const DECLARED = [];\n`;\n\nexport const SPEC_CHROME_MD_RELATIVE = \"matching/spec-sections/_chrome.md\";\nexport const SPEC_CHROME_MD_TEMPLATE = `## shared chrome\n\nSite-wide furniture that renders identically on every page — header, footer, and\nanything else the per-page sections would otherwise restate. Phase 1 of the\n\\`matching-a-page\\` skill fills this in; until it does, this section is a\nplaceholder and \\`matching/SPEC.md\\` has no shared-chrome contract to cite.\n`;\n\nexport const SPEC_HEADER_MD_RELATIVE = \"matching/spec-sections/_header.md\";\nexport const SPEC_HEADER_MD_TEMPLATE = `# Reference spec\n\nGENERATED by \\`node matching/build-spec.mjs\\` from \\`matching/spec-sections/\\`.\nEdit the section files, not this one.\n\nThis is the Phase 1 deliverable of the \\`matching-a-page\\` skill and the\nprecondition \\`matching/gate.sh\\` enforces: a page with no section here does not\nget a geometry round (see the matching rules in CLAUDE.md).\n`;\n\nexport const LEDGER_MD_RELATIVE = \"matching/LEDGER.md\";\nexport const LEDGER_MD_TEMPLATE = `# Deviations / masks / floors ledger\n\nAppend-only, and written at the moment a decision is made — not reconstructed at\nthe end of a round, when the reason has already been lost. An entry is never\nedited to be right: a later entry corrects an earlier one and says which.\n\nEvery entry in \\`matching/floors.mjs\\` and \\`matching/census-deviations.mjs\\`, and\nevery mask in \\`matching/harness.json\\`, needs a line here. Without one the gate\nhas been quietly widened and nothing records who widened it, or why.\n\n- [deviation | floor | mask | a11y] \\`<region or selector>\\` — what differs, why\n  it is accepted, and the evidence: a spec citation, a census row, a gate run.\n`;\n\nexport const MATCH_ROUTE_SERVER_RELATIVE = \"src/routes/dev/match/[uid]/+page.server.ts\";\nexport const MATCH_ROUTE_SERVER_TEMPLATE = `import { error } from \"@sveltejs/kit\";\nimport { dev } from \"$app/environment\";\nimport { documents } from \"$lib/site-pages.js\";\n\n// Local matching surface: renders the EXACT assembly \\`reddoor-maint\n// prismic-seed\\` publishes, from the same module, so a fix made to pass a gate\n// is a fix to what ships. Not prerendered, SSR-on-demand, dev-only.\nexport const prerender = false;\n\n// The seed resolves images to asset ids; here they only need a URL. Dimensions\n// are nominal — slices size their own image boxes in CSS.\nconst devImg = (u: string) => ({\n  url: u,\n  alt: null,\n  copyright: null,\n  dimensions: { width: 1600, height: 1067 },\n  edit: { x: 0, y: 0, zoom: 1, background: \"transparent\" },\n  id: u,\n});\n\nexport async function load({ params }) {\n  // FIRST statement: everything below reads fixtures that must not be reachable\n  // from a production build. The launch recipe asserts this route 404s on the\n  // deployed URL, with /dev/a11y-fixtures as the 200 control.\n  if (!dev) error(404, { message: \"Not found\" });\n\n  const docs = documents(devImg) as Array<{ uid: string; data: { slices?: unknown[] } }>;\n  const doc = docs.find((d) => d.uid === params.uid);\n  if (!doc)\n    error(404, {\n      message: \\`no assembly for \"\\${params.uid}\" (have: \\${docs.map((d) => d.uid).join(\", \") || \"none\"})\\`,\n    });\n\n  return { uid: params.uid, slices: doc.data.slices ?? [] };\n}\n`;\n\nexport const MATCH_ROUTE_PAGE_RELATIVE = \"src/routes/dev/match/[uid]/+page.svelte\";\nexport const MATCH_ROUTE_PAGE_TEMPLATE = `<script lang=\"ts\">\n  import { SliceZone } from \"@prismicio/svelte\";\n  import { components } from \"$lib/slices\";\n\n  let { data } = $props();\n</script>\n\n<SliceZone slices={data.slices as never} {components} />\n`;\n\nexport const SITE_PAGES_JS_RELATIVE = \"src/lib/site-pages.js\";\nexport const SITE_PAGES_JS_TEMPLATE = `// The page assemblies for this site — the SINGLE source of truth for both\n// consumers: \\`reddoor-maint prismic-seed\\`, which publishes them through the\n// Migration API, and src/routes/dev/match/[uid], the local matching surface.\n// Because both read from here, any fix made to pass a gate is a fix to what\n// ships.\n//\n// THE MIGRATION API DROPS SILENTLY. It validates against the slice models\n// registered in Prismic and discards every field the model does not declare —\n// HTTP 200, no warning. A fixture field with no model behind it renders here and\n// vanishes on the published route. src/lib/site-pages.test.ts is the mechanical\n// check; run it before every seed.\n//\n// PURE by contract: no node:*, no fetch, no token, no side effects at import,\n// so Vite can bundle it into the dev route and node can import it into the seed.\n\nexport const lang = \"en-us\";\n\n/**\n * @param {(url: string) => unknown} img resolves an image URL to whatever the\n *   caller needs — an asset \\`{id}\\` for the seed, a \\`{url}\\` for the dev route.\n * @returns {Array<{type: string, uid: string, title: string, data: Record<string, unknown>}>}\n */\nexport function documents(img) {\n  void img;\n  return [];\n}\n`;\n\nexport const SITE_PAGES_TEST_RELATIVE = \"src/lib/site-pages.test.ts\";\nexport const SITE_PAGES_TEST_TEMPLATE = `// The page assemblies in src/lib/site-pages.js are the SINGLE source of truth\n// shared by two consumers: the local matching route (src/routes/dev/match/[uid])\n// and \\`reddoor-maint prismic-seed\\`, which publishes them to Prismic.\n//\n// Those two consumers do NOT validate the same way. The dev route hands the\n// object straight to the slice components, so any field a fixture sets is\n// simply there. The Migration API validates against the slice models registered\n// in Prismic and SILENTLY DROPS every field the model does not declare — no\n// error, no warning, a 200. A page can gate green locally and publish wrong.\n//\n// This test is the mechanical check. It fails the moment a fixture carries a\n// field its slice model does not declare — before the seed runs, not after the\n// content is published. Run it before every seed.\nimport { describe, expect, it } from \"vitest\";\nimport { readFileSync, readdirSync, existsSync } from \"node:fs\";\nimport { fileURLToPath } from \"node:url\";\nimport { dirname, join } from \"node:path\";\nimport { documents } from \"./site-pages.js\";\n\nconst HERE = dirname(fileURLToPath(import.meta.url));\nconst SLICES = join(HERE, \"slices\");\n\ntype Variation = { primary: string[]; items: string[] };\ntype Slice = {\n  slice_type: string;\n  variation: string;\n  primary?: Record<string, unknown>;\n  items?: Array<Record<string, unknown>>;\n};\n\n/** Every slice model in src/lib/slices, indexed by its Prismic slice id. */\nfunction loadModels(): Record<string, Record<string, Variation>> {\n  const out: Record<string, Record<string, Variation>> = {};\n  if (!existsSync(SLICES)) return out;\n  for (const dir of readdirSync(SLICES)) {\n    const file = join(SLICES, dir, \"model.json\");\n    if (!existsSync(file)) continue;\n    const model = JSON.parse(readFileSync(file, \"utf8\"));\n    out[model.id] = Object.fromEntries(\n      (model.variations ?? []).map((v: Record<string, unknown>) => [\n        v.id,\n        {\n          primary: Object.keys((v.primary as object) ?? {}),\n          items: Object.keys((v.items as object) ?? {}),\n        },\n      ]),\n    );\n  }\n  return out;\n}\n\n/** Image resolver stub — shape only; this test never reads image values. */\nconst stubImg = () => ({ url: \"https://example.test/x.jpg\" });\n\ndescribe(\"site-pages documents vs slice models\", () => {\n  const models = loadModels();\n  const docs = documents(stubImg) as Array<{ uid: string; data: { slices?: Slice[] } }>;\n  const pages: Array<[string, Slice[]]> = docs.map((d) => [d.uid, d.data.slices ?? []]);\n\n  it(\"declares every slice type the documents use\", () => {\n    const missing = new Set<string>();\n    for (const [, slices] of pages)\n      for (const s of slices) if (!models[s.slice_type]) missing.add(s.slice_type);\n    expect([...missing]).toEqual([]);\n  });\n\n  it(\"declares every variation the documents use\", () => {\n    const missing: string[] = [];\n    for (const [uid, slices] of pages)\n      for (const s of slices) {\n        const model = models[s.slice_type];\n        if (model && !model[s.variation]) missing.push(\\`\\${uid}: \\${s.slice_type}/\\${s.variation}\\`);\n      }\n    expect(missing).toEqual([]);\n  });\n\n  // The one that catches a silent Migration-API drop.\n  it(\"declares every field the documents set, so Prismic strips nothing\", () => {\n    const stripped: string[] = [];\n    for (const [uid, slices] of pages)\n      for (const s of slices) {\n        const variation = models[s.slice_type]?.[s.variation];\n        if (!variation) continue;\n        for (const key of Object.keys(s.primary ?? {}))\n          if (!variation.primary.includes(key))\n            stripped.push(\\`\\${uid} \\${s.slice_type}/\\${s.variation} primary.\\${key}\\`);\n        const itemKeys = new Set((s.items ?? []).flatMap((i) => Object.keys(i)));\n        for (const key of itemKeys)\n          if (!variation.items.includes(key))\n            stripped.push(\\`\\${uid} \\${s.slice_type}/\\${s.variation} items.\\${key}\\`);\n      }\n    expect(stripped).toEqual([]);\n  });\n});\n`;\n\nexport const MATCH_HARNESS_FILES: readonly HarnessFile[] = [\n  { rel: HARNESS_MJS_RELATIVE, template: HARNESS_MJS_TEMPLATE, owner: \"recipe\" },\n  { rel: GATE_SH_RELATIVE, template: GATE_SH_TEMPLATE, owner: \"recipe\" },\n  { rel: CENSUS_SH_RELATIVE, template: CENSUS_SH_TEMPLATE, owner: \"recipe\" },\n  { rel: NEXT_MJS_RELATIVE, template: NEXT_MJS_TEMPLATE, owner: \"recipe\" },\n  { rel: STRIKES_MJS_RELATIVE, template: STRIKES_MJS_TEMPLATE, owner: \"recipe\" },\n  { rel: BUILD_SPEC_MJS_RELATIVE, template: BUILD_SPEC_MJS_TEMPLATE, owner: \"recipe\" },\n  { rel: CENSUS_COUNT_MJS_RELATIVE, template: CENSUS_COUNT_MJS_TEMPLATE, owner: \"recipe\" },\n  { rel: HARNESS_JSON_RELATIVE, template: HARNESS_JSON_TEMPLATE, owner: \"site\" },\n  { rel: FLOORS_MJS_RELATIVE, template: FLOORS_MJS_TEMPLATE, owner: \"site\" },\n  { rel: CENSUS_DEVIATIONS_MJS_RELATIVE, template: CENSUS_DEVIATIONS_MJS_TEMPLATE, owner: \"site\" },\n  { rel: SPEC_CHROME_MD_RELATIVE, template: SPEC_CHROME_MD_TEMPLATE, owner: \"site\" },\n  { rel: SPEC_HEADER_MD_RELATIVE, template: SPEC_HEADER_MD_TEMPLATE, owner: \"site\" },\n  { rel: LEDGER_MD_RELATIVE, template: LEDGER_MD_TEMPLATE, owner: \"site\" },\n  { rel: MATCH_ROUTE_SERVER_RELATIVE, template: MATCH_ROUTE_SERVER_TEMPLATE, owner: \"recipe\" },\n  { rel: MATCH_ROUTE_PAGE_RELATIVE, template: MATCH_ROUTE_PAGE_TEMPLATE, owner: \"recipe\" },\n  { rel: SITE_PAGES_JS_RELATIVE, template: SITE_PAGES_JS_TEMPLATE, owner: \"site\" },\n  { rel: SITE_PAGES_TEST_RELATIVE, template: SITE_PAGES_TEST_TEMPLATE, owner: \"recipe\" },\n];\n\n/** Renders previously shipped by this recipe, per relative path. A file that\n *  byte-matches one of these is SAFE-REPLACED on re-run; anything else that\n *  differs is flagged, never overwritten. Empty at v1 — nothing has shipped. */\nexport const MATCH_HARNESS_PREVIOUS: Readonly<Record<string, readonly string[]>> = {};\n\nexport const GITIGNORE_MARKER =\n  \"# reddoor-maint match-harness: scripts + records tracked, workspace ignored\";\nexport const GITIGNORE_BLOCK = `scratch-diff*/\nmatching/*\n!matching/*.sh\n!matching/*.mjs\n!matching/*.md\n# The pause switch. Extensionless on purpose (it is a sentinel, not a doc), so\n# the whitelist above misses it — and an ignored switch is not a switch: it\n# would work on one machine and be absent from every fresh clone, CI run and\n# agent that most needs to see it.\n!matching/PAUSED\n!matching/spec-sections/\n!matching/states/\nmatching/states/*\n!matching/states/*.mjs\n# derived artefacts, even where the extensions above would catch them\nmatching/*.log\nmatching/*.json\n# ...except the page table itself, which is the harness's configuration and the\n# one thing a fresh clone cannot reconstruct.\n!matching/harness.json\nmatching/*.png\n`;\n\nexport const PRETTIERIGNORE_MARKER = \"# reddoor-maint match-harness\";\nexport const PRETTIERIGNORE_BLOCK = `# Matching harness — every file the \\`match-harness\\` recipe OWNS. It installs\n# them byte-for-byte and byte-compares them on the next install, so a site whose\n# prettier config differs must not reformat them: a reformatted file is\n# indistinguishable from a hand edit, and the recipe refuses to overwrite a hand\n# edit. Measured on a \\`useTabs\\`/\\`singleQuote\\` site, all three src/ entries\n# below are rewritten by \\`prettier --write .\\`, and the next upgrade is refused\n# for all three.\n#\n# The bracketed route segment MUST stay backslash-escaped. This file is\n# gitignore glob syntax, in which \\`[uid]\\` is a CHARACTER CLASS matching one of\n# \\`u\\`, \\`i\\`, \\`d\\` — an unescaped entry silently ignores nothing at all.\n#\n# \\`matching/*.mjs\\` also catches two SITE-owned records (floors.mjs,\n# census-deviations.mjs). Accepted, not overlooked: eslint lints .mjs, so those\n# two keep a style check either way, and naming seven scripts instead of one\n# glob goes stale on the next script the harness gains.\n#\n# harness.json is here because it is a TABLE, not prose: it carries a\n# hand-chosen row layout that prettier reflows.\n#\n# Everything else under matching/ (SPEC.md, LEDGER.md, spec-sections/,\n# states/*.mjs) stays inside \\`prettier --check .\\`. That is deliberately narrow:\n# eslint does not lint Markdown, so for the records prettier is the ONLY style\n# check there is, and a blanket \\`matching/\\` entry would leave them with none.\nmatching/*.mjs\nmatching/*.sh\nmatching/harness.json\nsrc/routes/dev/match/\\\\[uid\\\\]/+page.server.ts\nsrc/routes/dev/match/\\\\[uid\\\\]/+page.svelte\nsrc/lib/site-pages.test.ts\n`;\n\nexport const CLAUDE_MD_MARKER = \"## Matching rules (installed by reddoor-maint match-harness)\";\nexport const CLAUDE_MD_BLOCK = `\nThe \\`matching-a-page\\` skill governs a live-reference rebuild. These five rules\nexist because the skill alone did not hold on the project this harness came\nfrom — each one is a drift that actually happened, with the mechanical check\nthat now catches it. \\`matching/harness.json\\` is this site's configuration;\n\\`matching/LEDGER.md\\` is the dated record of every deviation, floor and mask.\n\n### 1. Source prescribes, rects only verify\n\nEvery geometry fix must cite the rule it came from: a line in the captured\nreference stylesheet under \\`matching/spec/\\`, or the reference's HTML. \"The probe\nsays the gap is 40px\" is not a source. If you cannot name the line you are\nguessing — go read the stylesheet first.\n\n**Check:** the commit body must name the file:line for each fix.\n**Operator's challenge:** _\"which line of the reference stylesheet says that?\"_\n\n### 2. Phase 1 before Phase 4\n\nA page gets its section census and per-section spec in \\`matching/SPEC.md\\` BEFORE\nits geometry is touched. No SPEC section, no geometry round. The census is the\ncoverage denominator; skipping it is how a reference's root-font ladder and its\nper-component height ladders get discovered reactively, after the region has\nalready failed several rounds.\n\n**Check:** \\`matching/gate.sh\\` refuses to run a page with no \\`SPEC.md\\` section.\n**Operator's challenge:** _\"show me the SPEC section for that region.\"_\n\n### 3. Three strikes, then stop\n\nA failing region that has not improved across 3+ gate runs does not get a fourth\nattempt. Present the attempts. Never widen the threshold, add a mask, or\nreclassify it as a floor to make it go away.\n\n**Check:** \\`node matching/strikes.mjs <page>\\` — exits 1 while any region is\nstalled, and is the first thing a geometry round runs.\n**Operator's challenge:** _\"how many runs has that region been flat?\"_\n\n### 4. A gate closes an item, nothing else\n\nNo fix is \"done\" because the code changed. Paste the gate header — it is\nself-describing, so a nonstandard threshold or an undisclosed mask is visible.\nThe threshold and the matrix are whatever \\`matching/harness.json\\` says, on every\npage, never a subset.\n\n**Operator's challenge:** _\"paste the gate header.\"_\n\n### 5. A commit is a checkpoint, not a stopping point\n\nDo not hand control back between rounds. After committing, run\n\\`node matching/next.mjs\\`: while it exits 1 there is a named next action, and the\nround continues. Report when the backlog is empty, when a decision is genuinely\nthe operator's (three strikes, a novel floor, a threshold change), or when\nasked — not because a commit felt like a natural place to summarise.\n\nThis exists because the failure was habitual, not deliberate: a turn ends when\nuser-facing prose gets written, and \"I just committed something good\" is the\nmoment that invites writing it. The gate stops incorrect work; this stops\npremature stopping.\n\n**Pausing:** create \\`matching/PAUSED\\` holding a note that says what the pause\nmeans; \\`next.mjs\\` and \\`strikes.mjs\\` then exit 0 while it exists. This rule says\n\"do not stop while work is named\"; it never said \"find work to name\". An empty\nagenda and a paused one end the round the same way. Deleting the switch is the\noperator's call.\n\n**Check:** \\`node matching/next.mjs\\` — exits 1 while any non-floor region fails.\n**Operator's challenge:** _\"what does next.mjs say?\"_\n\n### Round protocol\n\n1. \\`node matching/strikes.mjs <page>\\` — if it exits 1, the stalled regions are\n   the agenda, and stalled ones get escalated rather than re-attempted.\n2. Confirm the page has a \\`matching/SPEC.md\\` section; write\n   \\`matching/spec-sections/<page>.md\\` and run \\`node matching/build-spec.mjs\\` if\n   not.\n3. Fix, each change citing its source line.\n4. \\`bash matching/gate.sh <tag> <page>\\` — paste the header.\n5. Append to \\`matching/LEDGER.md\\` at the moment a deviation, floor or mask is\n   decided, not reconstructed at the end.\n6. \\`pnpm verify\\`, then commit and push.\n`;\n"],"mappings":";;;;;;;;;;;;;;;;;AAAA,SAAS,OAAO,UAAU,IAAI,OAAO,iBAAiB;AACtD,SAAS,SAAS,YAAY;;;ACMvB,IAAM,uBAAuB;AAC7B,IAAM,uBAAuB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAoL7B,IAAM,mBAAmB;AACzB,IAAM,mBAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA2IzB,IAAM,qBAAqB;AAC3B,IAAM,qBAAqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAuO3B,IAAM,oBAAoB;AAC1B,IAAM,oBAAoB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAyL1B,IAAM,uBAAuB;AAC7B,IAAM,uBAAuB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA0O7B,IAAM,0BAA0B;AAChC,IAAM,0BAA0B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA6EhC,IAAM,4BAA4B;AAClC,IAAM,4BAA4B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAiElC,IAAM,wBAAwB;AAC9B,IAAM,wBAAwB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA2B9B,IAAM,sBAAsB;AAC5B,IAAM,sBAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAsB5B,IAAM,iCAAiC;AACvC,IAAM,iCAAiC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAevC,IAAM,0BAA0B;AAChC,IAAM,0BAA0B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQhC,IAAM,0BAA0B;AAChC,IAAM,0BAA0B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAUhC,IAAM,qBAAqB;AAC3B,IAAM,qBAAqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAc3B,IAAM,8BAA8B;AACpC,IAAM,8BAA8B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAqCpC,IAAM,4BAA4B;AAClC,IAAM,4BAA4B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAUlC,IAAM,yBAAyB;AAC/B,IAAM,yBAAyB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA4B/B,IAAM,2BAA2B;AACjC,IAAM,2BAA2B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAgGjC,IAAM,sBAA8C;AAAA,EACzD,EAAE,KAAK,sBAAsB,UAAU,sBAAsB,OAAO,SAAS;AAAA,EAC7E,EAAE,KAAK,kBAAkB,UAAU,kBAAkB,OAAO,SAAS;AAAA,EACrE,EAAE,KAAK,oBAAoB,UAAU,oBAAoB,OAAO,SAAS;AAAA,EACzE,EAAE,KAAK,mBAAmB,UAAU,mBAAmB,OAAO,SAAS;AAAA,EACvE,EAAE,KAAK,sBAAsB,UAAU,sBAAsB,OAAO,SAAS;AAAA,EAC7E,EAAE,KAAK,yBAAyB,UAAU,yBAAyB,OAAO,SAAS;AAAA,EACnF,EAAE,KAAK,2BAA2B,UAAU,2BAA2B,OAAO,SAAS;AAAA,EACvF,EAAE,KAAK,uBAAuB,UAAU,uBAAuB,OAAO,OAAO;AAAA,EAC7E,EAAE,KAAK,qBAAqB,UAAU,qBAAqB,OAAO,OAAO;AAAA,EACzE,EAAE,KAAK,gCAAgC,UAAU,gCAAgC,OAAO,OAAO;AAAA,EAC/F,EAAE,KAAK,yBAAyB,UAAU,yBAAyB,OAAO,OAAO;AAAA,EACjF,EAAE,KAAK,yBAAyB,UAAU,yBAAyB,OAAO,OAAO;AAAA,EACjF,EAAE,KAAK,oBAAoB,UAAU,oBAAoB,OAAO,OAAO;AAAA,EACvE,EAAE,KAAK,6BAA6B,UAAU,6BAA6B,OAAO,SAAS;AAAA,EAC3F,EAAE,KAAK,2BAA2B,UAAU,2BAA2B,OAAO,SAAS;AAAA,EACvF,EAAE,KAAK,wBAAwB,UAAU,wBAAwB,OAAO,OAAO;AAAA,EAC/E,EAAE,KAAK,0BAA0B,UAAU,0BAA0B,OAAO,SAAS;AACvF;AAKO,IAAM,yBAAsE,CAAC;AAE7E,IAAM,mBACX;AACK,IAAM,kBAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAuBxB,IAAM,wBAAwB;AAC9B,IAAM,uBAAuB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAgC7B,IAAM,mBAAmB;AACzB,IAAM,kBAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ADx7C/B,IAAM,sBAAsB;AAwB5B,eAAe,aAAa,MAAsC;AAChE,MAAI;AACF,WAAO,MAAM,SAAS,MAAM,OAAO;AAAA,EACrC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAIA,SAAS,UAAU,GAAmB;AACpC,SAAO,EACJ,QAAQ,SAAS,IAAI,EACrB,QAAQ,aAAa,EAAE,EACvB,KAAK;AACV;AASO,SAAS,WAAW,UAAyB,QAAgB,OAA8B;AAChG,MAAI,aAAa,KAAM,QAAO,GAAG,MAAM;AAAA,EAAK,KAAK;AACjD,MAAI,SAAS,SAAS,MAAM,EAAG,QAAO;AACtC,QAAM,OAAO,SAAS,SAAS,IAAI,IAAI,WAAW,GAAG,QAAQ;AAAA;AAC7D,SAAO,GAAG,IAAI;AAAA,EAAK,MAAM;AAAA,EAAK,KAAK;AACrC;AAGO,SAAS,cACd,UACA,UACA,OACA,UACuC;AACvC,MAAI,aAAa,KAAM,QAAO;AAC9B,MAAI,UAAU,QAAQ,MAAM,UAAU,QAAQ,EAAG,QAAO;AACxD,MAAI,UAAU,OAAQ,QAAO;AAC7B,MAAI,SAAS,KAAK,CAAC,MAAM,UAAU,QAAQ,MAAM,UAAU,CAAC,CAAC,EAAG,QAAO;AACvE,SAAO;AACT;AAGA,IAAM,kBAAkB;AAAA,EACtB,CAAC,cAAc,kBAAkB,eAAe;AAAA,EAChD,CAAC,mBAAmB,uBAAuB,oBAAoB;AAAA,EAC/D,CAAC,aAAa,kBAAkB,eAAe;AACjD;AASO,IAAM,gCAAmD;AAAA,EAC9D,GAAG,oBAAoB,IAAI,CAAC,MAAM,EAAE,GAAG;AAAA,EACvC,GAAG,gBAAgB,IAAI,CAAC,CAAC,GAAG,MAAM,GAAG;AACvC;AAYA,eAAsB,aACpB,MACA,MACA,OAAyB,EAAE,OAAO,aAAa,GACxB;AACvB,SAAO,WAAiB;AAAA,IACtB,MAAM;AAAA,IACN;AAAA,IACA,MAAM,YAAY;AAChB,UAAI,CAAC,KAAK,OAAO,CAAC,eAAe,KAAK,KAAK,GAAG,GAAG;AAC/C,eAAO;AAAA,UACL,MAAM;AAAA,UACN,OACE;AAAA,QACJ;AAAA,MACF;AACA,aAAO;AAAA,QACL,MAAM;AAAA,QACN,MAAM;AAAA,UACJ,KAAK,KAAK,IAAI,QAAQ,OAAO,EAAE;AAAA,UAC/B,MAAM,KAAK,QAAQ;AAAA,UACnB,QAAQ,KAAK,UAAU,CAAC,MAAM,KAAK,GAAG;AAAA,QACxC;AAAA,MACF;AAAA,IACF;AAAA,IACA,OAAO,OAAO,SAAS,EAAE,QAAQ,IAAI,MAAM;AACzC,YAAM,QAAkB,CAAC;AACzB,YAAM,UAAoB,CAAC;AAI3B,YAAM,SAAS,oBAAI,IAA2B;AAC9C,YAAM,cAAc,KAAK,YAAY;AAErC,iBAAW,KAAK,qBAAqB;AACnC,cAAM,SAAS,KAAK,KAAK,EAAE,GAAG;AAC9B,YAAI,WAAW,EAAE;AACjB,YAAI,EAAE,QAAQ,uBAAuB;AAKnC,gBAAM,OAAO,KAAK,MAAM,QAAQ;AAChC,eAAK,MAAM,QAAQ;AACnB,eAAK,OAAO,QAAQ;AACpB,eAAK,SAAS,QAAQ;AACtB,qBAAW,KAAK,UAAU,MAAM,MAAM,CAAC,IAAI;AAAA,QAC7C;AACA,cAAM,WAAW,MAAM,aAAa,MAAM;AAC1C,cAAM,SAAS,cAAc,UAAU,UAAU,EAAE,OAAO,YAAY,EAAE,GAAG,KAAK,CAAC,CAAC;AAClF,YAAI,WAAW,QAAQ;AACrB,gBAAM;AAAA,YACJ,GAAG,EAAE,GAAG;AAAA,UACV;AACA;AAAA,QACF;AACA,YAAI,WAAW,OAAQ;AACvB,cAAM,MAAM,QAAQ,MAAM,GAAG,EAAE,WAAW,KAAK,CAAC;AAChD,eAAO,IAAI,EAAE,KAAK,QAAQ;AAC1B,cAAM,UAAU,QAAQ,UAAU,OAAO;AACzC,gBAAQ,KAAK,EAAE,GAAG;AAClB,YAAI,WAAW,UAAW,OAAM,KAAK,GAAG,EAAE,GAAG,mCAAmC;AAAA,MAClF;AAGA,iBAAW,CAAC,KAAK,QAAQ,KAAK,KAAK,iBAAiB;AAClD,cAAM,OAAO,KAAK,KAAK,GAAG;AAC1B,cAAM,WAAW,MAAM,aAAa,IAAI;AACxC,cAAM,SAAS,WAAW,UAAU,QAAQ,KAAK;AACjD,YAAI,WAAW,MAAM;AACnB,iBAAO,IAAI,KAAK,QAAQ;AACxB,gBAAM,UAAU,MAAM,QAAQ,OAAO;AACrC,kBAAQ,KAAK,GAAG;AAAA,QAClB;AAAA,MACF;AAcA,YAAM,YAAY,IAAI;AAAA,QACpB,oBAAoB,OAAO,CAAC,MAAM,EAAE,UAAU,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG;AAAA,MACxE;AACA,YAAM,WAAW,QAAQ,OAAO,CAAC,MAAM,UAAU,IAAI,CAAC,KAAK,MAAM,WAAW;AAW5E,UAAI,SAAS,SAAS,GAAG;AACvB,cAAM,MAAM,OAAO,KAAK,mBAAmB,uBAAuB,GAAG;AACrE,YAAI,QAAQ,MAAM;AAChB,gBAAM,KAAK,kBAAkB;AAAA,QAC/B,WACE,CAAE,MAAM,mBAAmB,KAAK,OAAO,KAAK,UAAU;AAAA,UACpD;AAAA,UACA,WAAW;AAAA,QACb,CAAC,GACD;AACA,gBAAM,KAAK,kBAAkB;AAAA,QAC/B;AAAA,MACF;AAEA,YAAM;AAAA,QACJ;AAAA,MACF;AAUA,YAAM,UAAU,MAAM,qBAAqB,KAAK,6BAA6B;AAC7E,UAAI,QAAQ,SAAS,GAAG;AACtB,cAAM,QAAQ,MAAM,eAAe,KAAK,OAAO;AAC/C,cAAM,UAAU,CAAC,GAAG,IAAI,IAAI,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,GAAI,EAAE,CAAC,CAAE,CAAC,CAAC;AAChE,cAAM,YAAY,IAAI,IAAI,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,GAAI,EAAE,CAAC,KAAK,EAAE,CAAC;AAClE,cAAM,cAAc,QAAQ,OAAO,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,CAAC;AAO3D,cAAM,UAAoB,CAAC;AAC3B,mBAAW,OAAO,QAAQ,OAAO,CAAC,MAAM,QAAQ,SAAS,CAAC,CAAC,GAAG;AAC5D,gBAAM,OAAO,OAAO,IAAI,GAAG;AAC3B,cAAI,SAAS,OAAW;AACxB,cAAI,SAAS,MAAM;AACjB,kBAAM,GAAG,KAAK,KAAK,GAAG,GAAG,EAAE,OAAO,KAAK,CAAC;AACxC,oBAAQ,KAAK,GAAG;AAAA,UAClB,OAAO;AACL,kBAAM,UAAU,KAAK,KAAK,GAAG,GAAG,MAAM,OAAO;AAAA,UAC/C;AAAA,QACF;AAGA,mBAAW,KAAK,CAAC,GAAG,IAAI,IAAI,QAAQ,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG;AACtF,cAAI,MAAM,IAAK,OAAM,MAAM,KAAK,KAAK,CAAC,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,QAChE;AAEA,eAAO;AAAA,UACL,MAAM;AAAA,UACN,OACE,kCAAkC,QAAQ,MAAM,OAAO,8BAA8B,MAAM,mIAChE,QAAQ,KAAK,IAAI,CAAC,QAC5C,QAAQ,SAAS,IACd,eAAe,QAAQ,KAAK,IAAI,CAAC,sDACjC,OACH,YAAY,SAAS,IAClB,0BAA0B,YAAY,KAAK,IAAI,CAAC,2GAChD,MACJ;AAAA,QACJ;AAAA,MACF;AAEA,aAAO,MAAM,SAAS,IAAI,EAAE,MAAM,MAAM,OAAO,MAAM,KAAK,IAAI,EAAE,IAAI,EAAE,MAAM,KAAK;AAAA,IACnF;AAAA,EACF,CAAC;AACH;","names":[]}

package/dist/{chunk-XTK5VIQB.js → chunk-AVEQUR44.js}

@@ -40,6 +40,27 @@ async function removeFromIndex(cwd, paths) {
   if (paths.length === 0) return;
   await git(cwd, ["rm", "-r", "--cached", "--", ...paths]);
 }
+async function pathsMissingFromHead(cwd, paths) {
+  if (paths.length === 0) return [];
+  let inTree;
+  try {
+    const { stdout } = await git(cwd, ["ls-tree", "-r", "-z", "--name-only", "HEAD"]);
+    inTree = new Set(stdout.split("\0").filter((p) => p.length > 0));
+  } catch {
+    inTree = /* @__PURE__ */ new Set();
+  }
+  return paths.filter((p) => !inTree.has(p));
+}
+async function ignoreRulesFor(cwd, paths) {
+  if (paths.length === 0) return [];
+  let out;
+  try {
+    ({ stdout: out } = await git(cwd, ["check-ignore", "-v", "--no-index", "--", ...paths]));
+  } catch (err) {
+    out = err.stdout ?? "";
+  }
+  return out.split("\n").filter((l) => l.length > 0);
+}
 async function commit(cwd, message) {
   await stageAll(cwd);
   const { stdout: status } = await git(cwd, ["status", "--porcelain"]);
@@ -71,6 +92,29 @@ async function getRemoteUrl(cwd) {
   const { stdout } = await git(cwd, ["remote", "get-url", "origin"]);
   return stdout.trim();
 }
+async function resolveOwnerRepo(site) {
+  if (site.gitRepo) {
+    if (!isOwnerRepo(site.gitRepo)) {
+      throw new Error(
+        `refusing to act on malformed repo identity: expected "owner/repo", got ${JSON.stringify(site.gitRepo)}`
+      );
+    }
+    return site.gitRepo;
+  }
+  let fromOrigin;
+  try {
+    fromOrigin = parseOwnerRepo(await getRemoteUrl(site.path));
+  } catch {
+    return null;
+  }
+  if (fromOrigin === null) return null;
+  if (!isOwnerRepo(fromOrigin)) {
+    throw new Error(
+      `refusing to act on malformed repo identity from origin: ${JSON.stringify(fromOrigin)}`
+    );
+  }
+  return fromOrigin;
+}
 async function push(cwd, branch) {
   await git(cwd, ["push", "-u", "origin", branch]);
 }
@@ -86,12 +130,15 @@ export {
   stageAll,
   listTrackedFiles,
   removeFromIndex,
+  pathsMissingFromHead,
+  ignoreRulesFor,
   commit,
   OWNER_REPO_RE,
   isOwnerRepo,
   sameOwnerRepo,
   parseOwnerRepo,
   getRemoteUrl,
+  resolveOwnerRepo,
   push
 };
-//# sourceMappingURL=chunk-XTK5VIQB.js.map
+//# sourceMappingURL=chunk-AVEQUR44.js.map

package/dist/chunk-AVEQUR44.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/util/git.ts"],"sourcesContent":["import { execFile } from \"node:child_process\";\nimport { promisify } from \"node:util\";\nimport type { Site } from \"../types.js\";\n\nconst exec = promisify(execFile);\n\nasync function git(cwd: string, args: string[]): Promise<{ stdout: string; stderr: string }> {\n  return exec(\"git\", args, { cwd, env: process.env });\n}\n\nexport function branchName(recipe: string, when: Date = new Date()): string {\n  // ISO with millisecond precision: 2026-05-20T10:30:00.123Z → 20260520T103000123Z.\n  // Millis (vs. second-precision) shrinks the collision window for parallel runs.\n  const compact = when.toISOString().replace(/[-:.]/g, \"\");\n  return `maint/${recipe}-${compact}`;\n}\n\nexport async function currentBranch(cwd: string): Promise<string> {\n  const { stdout } = await git(cwd, [\"rev-parse\", \"--abbrev-ref\", \"HEAD\"]);\n  return stdout.trim();\n}\n\nexport async function isWorkingTreeClean(cwd: string): Promise<boolean> {\n  const { stdout } = await git(cwd, [\"status\", \"--porcelain\"]);\n  return stdout.trim().length === 0;\n}\n\nexport async function createBranch(cwd: string, name: string): Promise<void> {\n  await git(cwd, [\"checkout\", \"-b\", name]);\n}\n\n/** Check out an existing branch. Throws (via git) if the branch is missing or\n *  the checkout is blocked (e.g. uncommitted changes that would be overwritten). */\nexport async function checkoutBranch(cwd: string, name: string): Promise<void> {\n  await git(cwd, [\"checkout\", name]);\n}\n\n/**\n * Force-check-out an existing branch, DISCARDING any uncommitted changes on the\n * current branch. Used by the recipe failure path to return the operator to\n * their original branch even when a recipe left the work-in-progress branch\n * dirty. Only ever called with the operator's ORIGINAL branch as `name`. Does\n * not run `git clean`, so untracked operator files are left untouched.\n */\nexport async function forceCheckoutBranch(cwd: string, name: string): Promise<void> {\n  await git(cwd, [\"checkout\", \"-f\", name]);\n}\n\n/**\n * Delete a local branch with `-D` (force). Used by the recipe failure path to\n * remove the branch the recipe itself created so a re-run starts clean. Callers\n * MUST only ever pass the recipe-created branch here, never the operator's\n * original branch.\n */\nexport async function deleteBranch(cwd: string, name: string): Promise<void> {\n  await git(cwd, [\"branch\", \"-D\", name]);\n}\n\nexport async function stageAll(cwd: string): Promise<void> {\n  await git(cwd, [\"add\", \"-A\"]);\n}\n\nexport async function listTrackedFiles(cwd: string): Promise<string[]> {\n  const { stdout } = await git(cwd, [\"ls-files\"]);\n  return stdout\n    .split(\"\\n\")\n    .map((l) => l.trim())\n    .filter((l) => l.length > 0);\n}\n\nexport async function removeFromIndex(cwd: string, paths: string[]): Promise<void> {\n  if (paths.length === 0) return;\n  await git(cwd, [\"rm\", \"-r\", \"--cached\", \"--\", ...paths]);\n}\n\n/**\n * The subset of `paths` that is NOT in HEAD's tree — what a fresh clone would\n * NOT get. POSITIVE evidence: a path counts as installed only when it is FOUND\n * in `git ls-tree`'s output. `git add -A` honours .gitignore and exits 0 either\n * way, so \"staging did not error\" proves nothing about what landed.\n *\n * `-z`, because `ls-tree` C-quotes any path outside core.quotePath's safe set\n * (`\"caf\\303\\251.txt\"`), which would read as missing. NOT `--full-tree`:\n * without it `ls-tree` reports paths relative to `cwd`, the same base the\n * caller's relative paths use.\n *\n * A git failure (no HEAD yet, not a repo) yields an EMPTY tree, so every path\n * comes back missing. An error may only ever DENY.\n */\nexport async function pathsMissingFromHead(\n  cwd: string,\n  paths: readonly string[],\n): Promise<string[]> {\n  if (paths.length === 0) return [];\n  let inTree: Set<string>;\n  try {\n    const { stdout } = await git(cwd, [\"ls-tree\", \"-r\", \"-z\", \"--name-only\", \"HEAD\"]);\n    inTree = new Set(stdout.split(\"\\0\").filter((p) => p.length > 0));\n  } catch {\n    inTree = new Set();\n  }\n  return paths.filter((p) => !inTree.has(p));\n}\n\n/**\n * Why git is excluding `paths`: `<source>:<line>:<pattern>\\t<path>` rows from\n * `git check-ignore -v --no-index`. A path with no row is absent for some other\n * reason (a nested repository, say) and the caller must say so rather than\n * guess. Never throws: check-ignore exits 1 when NOTHING matches and 128 on\n * error, and both must read as \"no rule found\" — the caller is already\n * reporting a failure and must not lose it to a second one.\n */\nexport async function ignoreRulesFor(cwd: string, paths: readonly string[]): Promise<string[]> {\n  if (paths.length === 0) return [];\n  let out: string;\n  try {\n    ({ stdout: out } = await git(cwd, [\"check-ignore\", \"-v\", \"--no-index\", \"--\", ...paths]));\n  } catch (err) {\n    out = (err as { stdout?: string }).stdout ?? \"\";\n  }\n  return out.split(\"\\n\").filter((l) => l.length > 0);\n}\n\n/**\n * Stages all current changes and commits with `message`. Returns the commit SHA,\n * or `null` if there was nothing to commit.\n */\nexport async function commit(cwd: string, message: string): Promise<string | null> {\n  await stageAll(cwd);\n  const { stdout: status } = await git(cwd, [\"status\", \"--porcelain\"]);\n  if (status.trim().length === 0) return null;\n  await git(cwd, [\"commit\", \"-m\", message]);\n  const { stdout: sha } = await git(cwd, [\"rev-parse\", \"HEAD\"]);\n  return sha.trim();\n}\n\n/**\n * Strict GitHub repo identity: exactly two `[A-Za-z0-9._-]` segments separated\n * by a single slash. Rejects a scheme, host, extra path segment, traversal\n * (`..`), whitespace, or an argv flag — anything that could retarget a `gh`\n * write at an unintended (attacker/typo-controlled) repo.\n */\nexport const OWNER_REPO_RE = /^[A-Za-z0-9._-]+\\/[A-Za-z0-9._-]+$/;\n\n/** True when `repo` is a clean `owner/repo` (see {@link OWNER_REPO_RE}). The\n *  explicit `..` reject covers traversal segments the char-class would otherwise\n *  admit (`.` is a legal repo char, so `../evil` matches the shape regex). */\nexport function isOwnerRepo(repo: string): boolean {\n  if (repo.includes(\"..\")) return false;\n  return OWNER_REPO_RE.test(repo);\n}\n\n/**\n * True when two repo references name the same `owner/repo`. Each side may be a\n * full remote URL (https or scp-style), or already an `owner/repo`. Used to\n * verify an existing checkout's `origin` matches the site's expected repo\n * before reusing it. Returns false if either side is unparseable.\n */\nexport function sameOwnerRepo(a: string, b: string): boolean {\n  const na = isOwnerRepo(a.trim()) ? a.trim() : parseOwnerRepo(a);\n  const nb = isOwnerRepo(b.trim()) ? b.trim() : parseOwnerRepo(b);\n  if (na === null || nb === null) return false;\n  return na.toLowerCase() === nb.toLowerCase();\n}\n\n/** Derive `owner/repo` from a git remote URL (https or scp-style). Null if unparseable. */\nexport function parseOwnerRepo(remoteUrl: string): string | null {\n  const trimmed = remoteUrl\n    .trim()\n    .replace(/\\.git$/, \"\")\n    .replace(/\\/$/, \"\");\n  // scp-style: git@github.com:owner/repo\n  const scp = trimmed.match(/^[A-Za-z0-9._-]+@[A-Za-z0-9._-]+:(.+)$/);\n  const path = scp ? scp[1]! : trimmed.replace(/^https?:\\/\\/[^/]+\\//, \"\");\n  const segments = path.split(\"/\").filter(Boolean);\n  if (segments.length < 2) return null;\n  return `${segments[segments.length - 2]}/${segments[segments.length - 1]}`;\n}\n\n/** `origin` remote URL for a checkout, trimmed. Throws (via git) if there's no origin. */\nexport async function getRemoteUrl(cwd: string): Promise<string> {\n  const { stdout } = await git(cwd, [\"remote\", \"get-url\", \"origin\"]);\n  return stdout.trim();\n}\n\n/**\n * Resolve the `owner/repo` a recipe will act on. An explicit `site.gitRepo`\n * (Airtable, or a JSON inventory) wins; otherwise derive it from the checkout's\n * `origin`.\n *\n * Returns `null` when there is nothing to act on (no `gitRepo`, no origin) — a\n * benign \"nothing wired\" state. THROWS when a value IS present but does not\n * match the strict `owner/repo` shape: callers write repo secrets, branch\n * protection and pull requests at this identity, so a typo'd or\n * attacker-controlled value must be rejected here, before the first `gh` call.\n *\n * Extracted from `self-updating`'s private `resolveRepo` because `prismic-ci`\n * read `site.gitRepo` directly and therefore refused every POSITIONAL run with\n * \"no Git repo on this site\" — `localPath()` (src/inventory/local.ts:11) builds\n * `{ path, name }` and nothing else. A site being bootstrapped is exactly the\n * case that has no Airtable row yet (`--fleet airtable` filters pre-launch\n * statuses), so the positional path is the ONLY one `/new-site` can use.\n */\nexport async function resolveOwnerRepo(site: Site): Promise<string | null> {\n  if (site.gitRepo) {\n    if (!isOwnerRepo(site.gitRepo)) {\n      throw new Error(\n        `refusing to act on malformed repo identity: expected \"owner/repo\", got ${JSON.stringify(site.gitRepo)}`,\n      );\n    }\n    return site.gitRepo;\n  }\n  let fromOrigin: string | null;\n  try {\n    fromOrigin = parseOwnerRepo(await getRemoteUrl(site.path));\n  } catch {\n    return null;\n  }\n  if (fromOrigin === null) return null;\n  if (!isOwnerRepo(fromOrigin)) {\n    throw new Error(\n      `refusing to act on malformed repo identity from origin: ${JSON.stringify(fromOrigin)}`,\n    );\n  }\n  return fromOrigin;\n}\n\n/** Push a branch to origin, setting upstream. Throws on non-zero (execFile rejects). */\nexport async function push(cwd: string, branch: string): Promise<void> {\n  await git(cwd, [\"push\", \"-u\", \"origin\", branch]);\n}\n"],"mappings":";AAAA,SAAS,gBAAgB;AACzB,SAAS,iBAAiB;AAG1B,IAAM,OAAO,UAAU,QAAQ;AAE/B,eAAe,IAAI,KAAa,MAA6D;AAC3F,SAAO,KAAK,OAAO,MAAM,EAAE,KAAK,KAAK,QAAQ,IAAI,CAAC;AACpD;AAEO,SAAS,WAAW,QAAgB,OAAa,oBAAI,KAAK,GAAW;AAG1E,QAAM,UAAU,KAAK,YAAY,EAAE,QAAQ,UAAU,EAAE;AACvD,SAAO,SAAS,MAAM,IAAI,OAAO;AACnC;AAEA,eAAsB,cAAc,KAA8B;AAChE,QAAM,EAAE,OAAO,IAAI,MAAM,IAAI,KAAK,CAAC,aAAa,gBAAgB,MAAM,CAAC;AACvE,SAAO,OAAO,KAAK;AACrB;AAEA,eAAsB,mBAAmB,KAA+B;AACtE,QAAM,EAAE,OAAO,IAAI,MAAM,IAAI,KAAK,CAAC,UAAU,aAAa,CAAC;AAC3D,SAAO,OAAO,KAAK,EAAE,WAAW;AAClC;AAEA,eAAsB,aAAa,KAAa,MAA6B;AAC3E,QAAM,IAAI,KAAK,CAAC,YAAY,MAAM,IAAI,CAAC;AACzC;AAIA,eAAsB,eAAe,KAAa,MAA6B;AAC7E,QAAM,IAAI,KAAK,CAAC,YAAY,IAAI,CAAC;AACnC;AASA,eAAsB,oBAAoB,KAAa,MAA6B;AAClF,QAAM,IAAI,KAAK,CAAC,YAAY,MAAM,IAAI,CAAC;AACzC;AAQA,eAAsB,aAAa,KAAa,MAA6B;AAC3E,QAAM,IAAI,KAAK,CAAC,UAAU,MAAM,IAAI,CAAC;AACvC;AAEA,eAAsB,SAAS,KAA4B;AACzD,QAAM,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC;AAC9B;AAEA,eAAsB,iBAAiB,KAAgC;AACrE,QAAM,EAAE,OAAO,IAAI,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;AAC9C,SAAO,OACJ,MAAM,IAAI,EACV,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC;AAC/B;AAEA,eAAsB,gBAAgB,KAAa,OAAgC;AACjF,MAAI,MAAM,WAAW,EAAG;AACxB,QAAM,IAAI,KAAK,CAAC,MAAM,MAAM,YAAY,MAAM,GAAG,KAAK,CAAC;AACzD;AAgBA,eAAsB,qBACpB,KACA,OACmB;AACnB,MAAI,MAAM,WAAW,EAAG,QAAO,CAAC;AAChC,MAAI;AACJ,MAAI;AACF,UAAM,EAAE,OAAO,IAAI,MAAM,IAAI,KAAK,CAAC,WAAW,MAAM,MAAM,eAAe,MAAM,CAAC;AAChF,aAAS,IAAI,IAAI,OAAO,MAAM,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAAA,EACjE,QAAQ;AACN,aAAS,oBAAI,IAAI;AAAA,EACnB;AACA,SAAO,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;AAC3C;AAUA,eAAsB,eAAe,KAAa,OAA6C;AAC7F,MAAI,MAAM,WAAW,EAAG,QAAO,CAAC;AAChC,MAAI;AACJ,MAAI;AACF,KAAC,EAAE,QAAQ,IAAI,IAAI,MAAM,IAAI,KAAK,CAAC,gBAAgB,MAAM,cAAc,MAAM,GAAG,KAAK,CAAC;AAAA,EACxF,SAAS,KAAK;AACZ,UAAO,IAA4B,UAAU;AAAA,EAC/C;AACA,SAAO,IAAI,MAAM,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC;AACnD;AAMA,eAAsB,OAAO,KAAa,SAAyC;AACjF,QAAM,SAAS,GAAG;AAClB,QAAM,EAAE,QAAQ,OAAO,IAAI,MAAM,IAAI,KAAK,CAAC,UAAU,aAAa,CAAC;AACnE,MAAI,OAAO,KAAK,EAAE,WAAW,EAAG,QAAO;AACvC,QAAM,IAAI,KAAK,CAAC,UAAU,MAAM,OAAO,CAAC;AACxC,QAAM,EAAE,QAAQ,IAAI,IAAI,MAAM,IAAI,KAAK,CAAC,aAAa,MAAM,CAAC;AAC5D,SAAO,IAAI,KAAK;AAClB;AAQO,IAAM,gBAAgB;AAKtB,SAAS,YAAY,MAAuB;AACjD,MAAI,KAAK,SAAS,IAAI,EAAG,QAAO;AAChC,SAAO,cAAc,KAAK,IAAI;AAChC;AAQO,SAAS,cAAc,GAAW,GAAoB;AAC3D,QAAM,KAAK,YAAY,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,IAAI,eAAe,CAAC;AAC9D,QAAM,KAAK,YAAY,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,IAAI,eAAe,CAAC;AAC9D,MAAI,OAAO,QAAQ,OAAO,KAAM,QAAO;AACvC,SAAO,GAAG,YAAY,MAAM,GAAG,YAAY;AAC7C;AAGO,SAAS,eAAe,WAAkC;AAC/D,QAAM,UAAU,UACb,KAAK,EACL,QAAQ,UAAU,EAAE,EACpB,QAAQ,OAAO,EAAE;AAEpB,QAAM,MAAM,QAAQ,MAAM,wCAAwC;AAClE,QAAM,OAAO,MAAM,IAAI,CAAC,IAAK,QAAQ,QAAQ,uBAAuB,EAAE;AACtE,QAAM,WAAW,KAAK,MAAM,GAAG,EAAE,OAAO,OAAO;AAC/C,MAAI,SAAS,SAAS,EAAG,QAAO;AAChC,SAAO,GAAG,SAAS,SAAS,SAAS,CAAC,CAAC,IAAI,SAAS,SAAS,SAAS,CAAC,CAAC;AAC1E;AAGA,eAAsB,aAAa,KAA8B;AAC/D,QAAM,EAAE,OAAO,IAAI,MAAM,IAAI,KAAK,CAAC,UAAU,WAAW,QAAQ,CAAC;AACjE,SAAO,OAAO,KAAK;AACrB;AAoBA,eAAsB,iBAAiB,MAAoC;AACzE,MAAI,KAAK,SAAS;AAChB,QAAI,CAAC,YAAY,KAAK,OAAO,GAAG;AAC9B,YAAM,IAAI;AAAA,QACR,0EAA0E,KAAK,UAAU,KAAK,OAAO,CAAC;AAAA,MACxG;AAAA,IACF;AACA,WAAO,KAAK;AAAA,EACd;AACA,MAAI;AACJ,MAAI;AACF,iBAAa,eAAe,MAAM,aAAa,KAAK,IAAI,CAAC;AAAA,EAC3D,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,eAAe,KAAM,QAAO;AAChC,MAAI,CAAC,YAAY,UAAU,GAAG;AAC5B,UAAM,IAAI;AAAA,MACR,2DAA2D,KAAK,UAAU,UAAU,CAAC;AAAA,IACvF;AAAA,EACF;AACA,SAAO;AACT;AAGA,eAAsB,KAAK,KAAa,QAA+B;AACrE,QAAM,IAAI,KAAK,CAAC,QAAQ,MAAM,UAAU,MAAM,CAAC;AACjD;","names":[]}

package/dist/{chunk-B6NUZ2ZX.js → chunk-BCKEP5S6.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-J7SZQUCW.js";
 import {
   withRecipe
-} from "./chunk-ZTPPCHDB.js";
+} from "./chunk-ZQV7UQNE.js";
 import {
   bumpDep,
   readPackageJson,
@@ -243,4 +243,4 @@ async function upgradeSvelte4to5(site, opts = {}) {
 export {
   upgradeSvelte4to5
 };
-//# sourceMappingURL=chunk-B6NUZ2ZX.js.map
+//# sourceMappingURL=chunk-BCKEP5S6.js.map

package/dist/{chunk-5FCBYK6L.js → chunk-BVEDKMNG.js}

@@ -1,24 +1,24 @@
+import {
+  onboard
+} from "./chunk-S7RYFUIK.js";
 import {
   convertToPnpm
-} from "./chunk-7CJ3DVZW.js";
+} from "./chunk-CWXTNPNZ.js";
 import {
   svelteCodemods
-} from "./chunk-LS6QPANO.js";
+} from "./chunk-2LYOAB2E.js";
 import {
   healthEndpoint
-} from "./chunk-4R3YAQNV.js";
+} from "./chunk-WSJ7RO54.js";
 import {
   smokeSuite
-} from "./chunk-TGUESYGF.js";
-import {
-  onboard
-} from "./chunk-NTLSMJHW.js";
+} from "./chunk-DFKBTBO3.js";
 import {
   syncConfigs
-} from "./chunk-3HS6LPFX.js";
+} from "./chunk-FUWFLAWQ.js";
 import {
   withRecipe
-} from "./chunk-ZTPPCHDB.js";
+} from "./chunk-ZQV7UQNE.js";
 import {
   runAudits
 } from "./chunk-TO7DJYLZ.js";
@@ -143,4 +143,4 @@ export {
   DEFAULT_INIT_STEPS,
   init
 };
-//# sourceMappingURL=chunk-5FCBYK6L.js.map
+//# sourceMappingURL=chunk-BVEDKMNG.js.map

package/dist/{chunk-PPIZHDJL.js → chunk-CJ2RMTT7.js}

@@ -1,6 +1,6 @@
 import {
   withRecipe
-} from "./chunk-ZTPPCHDB.js";
+} from "./chunk-ZQV7UQNE.js";
 import {
   defaultSpawn
 } from "./chunk-LBYOLBW7.js";
@@ -76,4 +76,4 @@ async function bumpDeps(site, opts = {}) {
 export {
   bumpDeps
 };
-//# sourceMappingURL=chunk-PPIZHDJL.js.map
+//# sourceMappingURL=chunk-CJ2RMTT7.js.map

package/dist/{chunk-7CJ3DVZW.js → chunk-CWXTNPNZ.js}

@@ -1,6 +1,6 @@
 import {
   withRecipe
-} from "./chunk-ZTPPCHDB.js";
+} from "./chunk-ZQV7UQNE.js";
 import {
   readPackageJson,
   writePackageJson
@@ -96,4 +96,4 @@ async function convertToPnpm(site, opts = {}) {
 export {
   convertToPnpm
 };
-//# sourceMappingURL=chunk-7CJ3DVZW.js.map
+//# sourceMappingURL=chunk-CWXTNPNZ.js.map

package/dist/{chunk-TGUESYGF.js → chunk-DFKBTBO3.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-R53VL3RI.js";
 import {
   withRecipe
-} from "./chunk-ZTPPCHDB.js";
+} from "./chunk-ZQV7UQNE.js";
 import {
   defaultSpawn
 } from "./chunk-LBYOLBW7.js";
@@ -329,4 +329,4 @@ async function smokeSuite(site, deps = { spawn: defaultSpawn }) {
 export {
   smokeSuite
 };
-//# sourceMappingURL=chunk-TGUESYGF.js.map
+//# sourceMappingURL=chunk-DFKBTBO3.js.map

package/dist/{chunk-WHWVYL7B.js → chunk-FSGICFXB.js}

@@ -9,7 +9,7 @@ import {
   renovateActionGaps,
   templatesByName,
   withRenovatePinsFrom
-} from "./chunk-MLT4QY5X.js";
+} from "./chunk-SLFG7Y76.js";
 import {
   readGitHubConfig
 } from "./chunk-GASBX52O.js";
@@ -25,12 +25,10 @@ import {
   commit,
   createBranch,
   currentBranch,
-  getRemoteUrl,
-  isOwnerRepo,
   isWorkingTreeClean,
-  parseOwnerRepo,
-  push
-} from "./chunk-XTK5VIQB.js";
+  push,
+  resolveOwnerRepo
+} from "./chunk-AVEQUR44.js";
 
 // src/recipes/self-updating/index.ts
 import { mkdir, writeFile } from "fs/promises";
@@ -44,34 +42,11 @@ function sameConfigContents(current, canonical) {
   const norm = (s) => s.replace(/\r\n/g, "\n").replace(/\s+$/, "");
   return norm(current) === norm(canonical);
 }
-async function resolveRepo(site) {
-  if (site.gitRepo) {
-    if (!isOwnerRepo(site.gitRepo)) {
-      throw new Error(
-        `refusing to act on malformed repo identity: expected "owner/repo", got ${JSON.stringify(site.gitRepo)}`
-      );
-    }
-    return site.gitRepo;
-  }
-  let fromOrigin;
-  try {
-    fromOrigin = parseOwnerRepo(await getRemoteUrl(site.path));
-  } catch {
-    return null;
-  }
-  if (fromOrigin === null) return null;
-  if (!isOwnerRepo(fromOrigin)) {
-    throw new Error(
-      `refusing to act on malformed repo identity from origin: ${JSON.stringify(fromOrigin)}`
-    );
-  }
-  return fromOrigin;
-}
 async function selfUpdating(site, deps = {}) {
   const templates = templatesByName([...SELF_UPDATING_CONFIGS]);
   let repo;
   try {
-    repo = await resolveRepo(site);
+    repo = await resolveOwnerRepo(site);
   } catch (err) {
     return resultOf(site, "failed", err instanceof Error ? err.message : String(err));
   }
@@ -79,7 +54,7 @@ async function selfUpdating(site, deps = {}) {
     return resultOf(
       site,
       "failed",
-      "no Git repo (set Airtable 'Git repo' or add an origin remote)"
+      "could not determine a GitHub repo for this site \u2014 set Airtable 'Git repo', or give the checkout an origin remote whose URL is a GitHub owner/repo"
     );
   }
   const cfg = readGitHubConfig();
@@ -190,4 +165,4 @@ async function selfUpdating(site, deps = {}) {
 export {
   selfUpdating
 };
-//# sourceMappingURL=chunk-WHWVYL7B.js.map
+//# sourceMappingURL=chunk-FSGICFXB.js.map

package/dist/chunk-FSGICFXB.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/recipes/self-updating/index.ts"],"sourcesContent":["import { mkdir, writeFile } from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\nimport type { RecipeResult, Site } from \"../../types.js\";\nimport { templatesByName } from \"../sync-configs/templates.js\";\nimport {\n  renovateActionGaps,\n  withRenovatePinsFrom,\n  RENOVATE_ACTION_CONFIG,\n} from \"../sync-configs/renovate-action.js\";\nimport {\n  resolveOwnerRepo,\n  push as gitPush,\n  branchName,\n  checkoutBranch,\n  createBranch,\n  currentBranch,\n  commit as gitCommit,\n  isWorkingTreeClean,\n} from \"../../util/git.js\";\nimport { siteLabel } from \"../../util/site.js\";\nimport { readGitHubConfig } from \"../../github/config.js\";\nimport { makeGitHub, type GitHub } from \"../../github/gh.js\";\nimport {\n  FLEET_RULESET_NAME,\n  desiredRuleset,\n  healRuleset,\n  rulesetGaps,\n} from \"../../github/rulesets.js\";\n\n// Deliberately NOT ci.yml: that file is per-site parameterized (netlify-site,\n// node-version, permissions), so an exact-match heal against a static template\n// would strip those values in a green auto-mergeable PR — the armed clobber\n// the 2026-08-02 architecture review found. The starter clone owns ci.yml's\n// shape. Its pinned reusable-workflow ref is sometimes bumped by Renovate\n// (v1.2.0 -> v1.3.0 across 17 repos, Jul-Aug 2026) but was not for v1.4.0 or\n// v1.4.1 — the latter was swept by hand on 2026-09-01 — so propagation is a\n// manual step to verify, never a guarantee.\nconst SELF_UPDATING_CONFIGS = [\"renovate-action\", \"renovate-config\"] as const;\n\n// Reusable-workflow jobs report their check as \"<caller-job> / <reusable-job>\".\n// The thin `ci` caller (job `ci`) calls reddoorla/.github's reusable workflow (job `ci`),\n// so the required context is \"ci / ci\", NOT \"ci\". (Provisional — verified empirically on the\n// starter during M7.1 rollout; correct here if the live checks API reports a different string.)\nconst REQUIRED_CHECK = \"ci / ci\";\n\nexport type SelfUpdatingDeps = {\n  github?: GitHub;\n  pushBranch?: (cwd: string, branch: string) => Promise<void>;\n};\n\nfunction resultOf(\n  site: Site,\n  status: RecipeResult[\"status\"],\n  notes: string,\n  commits: string[] = [],\n): RecipeResult {\n  return { recipe: \"self-updating\", site: siteLabel(site), status, commits, notes };\n}\n\n/** True when a file's current content matches the canonical template for drift\n *  purposes. Normalizes line endings + trailing whitespace so a stray trailing\n *  newline (or CRLF) can't read as drift and open a needless PR every nightly run;\n *  any real content change still differs. */\nfunction sameConfigContents(current: string, canonical: string): boolean {\n  const norm = (s: string) => s.replace(/\\r\\n/g, \"\\n\").replace(/\\s+$/, \"\");\n  return norm(current) === norm(canonical);\n}\n\nexport async function selfUpdating(site: Site, deps: SelfUpdatingDeps = {}): Promise<RecipeResult> {\n  const templates = templatesByName([...SELF_UPDATING_CONFIGS]);\n\n  let repo: string | null;\n  try {\n    repo = await resolveOwnerRepo(site);\n  } catch (err) {\n    // A malformed repo identity must abort before any `gh` write — surface it\n    // as a recipe failure rather than letting the token reach an unintended repo.\n    return resultOf(site, \"failed\", err instanceof Error ? err.message : String(err));\n  }\n  if (!repo) {\n    return resultOf(\n      site,\n      \"failed\",\n      \"could not determine a GitHub repo for this site — set Airtable 'Git repo', or give \" +\n        \"the checkout an origin remote whose URL is a GitHub owner/repo\",\n    );\n  }\n\n  const cfg = readGitHubConfig();\n  if (!deps.github && !cfg) return resultOf(site, \"failed\", \"GITHUB_TOKEN not set\");\n  const github = deps.github ?? makeGitHub({ token: cfg!.token });\n\n  const base = await github.defaultBranch(repo).catch(() => \"main\");\n  const actions: string[] = [];\n  const commits: string[] = [];\n  // Hoisted so the `finally` can restore the operator's branch even when a\n  // failure (push/PR error) aborts AFTER we created + checked out the maint\n  // branch. `maintBranch` stays null until createBranch succeeds, so the\n  // restore is a no-op on every path that never left the operator's branch.\n  let original: string | null = null;\n  let maintBranch: string | null = null;\n\n  try {\n    // A. Renovate config on the default branch — compare CONTENT, not just\n    // existence, so a present-but-STALE config (a pre-App workflow, a drifted\n    // Renovate schedule window) is corrected rather than left silently\n    // forever. The prior existence-only gate reported \"already self-updating\" for any\n    // repo that merely HAD the files, however out of date — the very drift this\n    // recipe exists to repair (e.g. the Renovate schedule-window regression).\n    //\n    // renovate.yml specifically is compliance-checked rather than byte-matched\n    // (see renovateActionGaps / withRenovatePinsFrom in\n    // ../sync-configs/renovate-action.js): Renovate legitimately bumps its own\n    // digest pins forward, and a site's prettier may legitimately quote the\n    // cron / RENOVATE_* scalars differently — neither is real drift (issue\n    // #651; a byte-match recipe opened reddoor-starter-blux#1, a PR that\n    // DOWNGRADED Renovate's own pin).\n    const drifted: string[] = [];\n    // Captured so the write loop below can carry a drifted renovate.yml's own\n    // pins forward instead of re-fetching (and so a compliant-but-non-byte-\n    // identical file's contents are available for that carry-forward too,\n    // though it won't need healing).\n    const currentContents = new Map<string, string | null>();\n    for (const t of templates) {\n      const current = await github.fileContentsOnBranch(repo, base, t.path);\n      currentContents.set(t.path, current);\n      if (current === null) {\n        drifted.push(t.path);\n        continue;\n      }\n      if (sameConfigContents(current, t.contents)) continue;\n      if (t.config === RENOVATE_ACTION_CONFIG && renovateActionGaps(current).length === 0) {\n        continue;\n      }\n      drifted.push(t.path);\n    }\n    if (drifted.length > 0) {\n      const existingPR = await github.findOpenSelfUpdatingPR(repo);\n      if (existingPR) {\n        actions.push(`self-updating PR already open: ${existingPR}`);\n      } else {\n        if (!(await isWorkingTreeClean(site.path))) {\n          return resultOf(site, \"failed\", \"working tree not clean — commit or stash first\");\n        }\n        // Capture the operator's branch BEFORE creating the maint branch so the\n        // `finally` can return them to it (#2). Best-effort capture: if it fails\n        // we just skip the restore rather than guess.\n        try {\n          original = await currentBranch(site.path);\n        } catch {\n          original = null;\n        }\n        maintBranch = branchName(\"self-updating\");\n        await createBranch(site.path, maintBranch);\n        // Write only the paths that actually drifted — a repo whose\n        // renovate.json is stale but whose renovate.yml already passes\n        // `renovateActionGaps` must not have that compliant renovate.yml\n        // silently rewritten (e.g. un-quoting its scalars) in the same PR.\n        // On a fresh repo every template path is missing, so `drifted`\n        // already contains all of them and bootstrap is unaffected.\n        for (const t of templates) {\n          if (!drifted.includes(t.path)) continue;\n          const dest = join(site.path, t.path);\n          await mkdir(dirname(dest), { recursive: true });\n          // For a genuinely non-compliant renovate.yml, carry the site's own\n          // (still-digest-pinned) action refs forward onto the template before\n          // writing it — writing the template verbatim would put its OLDER\n          // pins over the site's newer ones, re-introducing the downgrade\n          // this compliance check exists to prevent (issue #651).\n          const contents =\n            t.config === RENOVATE_ACTION_CONFIG\n              ? withRenovatePinsFrom(t.contents, currentContents.get(t.path) ?? null)\n              : t.contents;\n          await writeFile(dest, contents, \"utf-8\");\n        }\n        const sha = await gitCommit(site.path, \"ci: enable self-updating (Renovate auto-merge)\");\n        if (sha) commits.push(sha);\n        await (deps.pushBranch ?? gitPush)(site.path, maintBranch);\n        const pr = await github.openPullRequest(repo, {\n          head: maintBranch,\n          base,\n          title: \"Enable self-updating (Renovate)\",\n          body: \"Adds scheduled Renovate and Renovate-owned merges for patch/minor updates. (ci.yml is deliberately not managed here — its shape comes from the starter and its reusable-workflow pin from Renovate.)\",\n        });\n        actions.push(`opened PR ${pr.url}`);\n        // (Branch restore happens in the `finally` below — on success AND on a\n        // failure that aborts after createBranch.)\n      }\n    }\n\n    // B. Repo settings — check-then-ensure, each independent (self-healing).\n    //\n    // Platform auto-merge is DISABLED fleet-wide, and this block self-heals toward\n    // OFF (it used to drive repos ON — do not \"fix\" it back).\n    //\n    // Why: GitHub's platform auto-merge is a per-PR flag that anyone with write\n    // access can arm; the PR then merges itself later, unattended, once checks go\n    // green. The org Renovate preset forbids auto-merging majors and was working\n    // correctly — Renovate never armed them — but the preset has no authority over\n    // a flag someone else set. On 2026-07-26 a bulk `gh pr merge --auto` sweep\n    // armed it across 8 fleet repos, and the next morning two `actions/checkout`\n    // MAJOR bumps merged with zero reviews (reddoor-starter#77,\n    // reddoor-website#111) as soon as Renovate's own rebase cleared their\n    // conflicts. Realized damage, not a hypothetical.\n    //\n    // The fix is to keep merges INSIDE Renovate's own run, where its `packageRules`\n    // actually govern the decision. Renovate can only merge while it is running, so\n    // the workflow cron (see sync-configs templates) is the merge cadence.\n    //\n    // Leaving the self-heal pointed at OFF makes this a drift ALARM: if someone\n    // re-enables platform auto-merge, the next `self-updating` / `launch` run turns\n    // it back off and records the action. `enableRepoAutoMerge` is retained in\n    // `src/github/gh.ts` as the documented rollback path.\n    if (await github.autoMergeEnabled(repo)) {\n      await github.disableRepoAutoMerge(repo);\n      actions.push(\"disabled auto-merge (platform auto-merge is not permitted fleet-wide)\");\n    }\n    const existingContexts = await github.branchProtectionContexts(repo, base);\n    if (!existingContexts.includes(REQUIRED_CHECK)) {\n      // protectBranch issues a full PUT that REPLACES required-status-check contexts.\n      // Send the UNION of the branch's existing required contexts + our REQUIRED_CHECK\n      // so we ADD the CI gate without silently dropping any other checks the repo\n      // already requires. (When the branch has no protection yet, existingContexts is\n      // [] and this is just [REQUIRED_CHECK] — the original behavior.) Dedupe defends\n      // against REQUIRED_CHECK already appearing among the existing contexts.\n      const contexts = [...new Set([...existingContexts, REQUIRED_CHECK])];\n      await github.protectBranch(repo, base, contexts);\n      actions.push(`required \"${REQUIRED_CHECK}\" check on ${base}`);\n    }\n    // Ruleset ensure — the layer that binds ADMINS. Classic protection above\n    // keeps `enforce_admins: false`, which is exactly the hole the 2026-07-26\n    // bulk `gh pr merge --auto` sweep walked through (two unreviewed MAJORS\n    // merged). The 2026-08-01 audit then found the six NEWEST repos with no\n    // ruleset at all — every hand-applied sweep regrows its gap at the next\n    // onboard, so the recipe owns the invariant now. Spec + invariants:\n    // docs/superpowers/specs/2026-08-02-ruleset-self-healing-design.md.\n    //\n    // Private repos are skipped BEFORE any attempt: rulesets there need a paid\n    // plan, so trying would either fail every run or spam a phantom action\n    // that flips this recipe to \"applied\" forever. Classic protection remains\n    // their floor.\n    if ((await github.repoVisibility(repo)) === \"public\") {\n      // Evidence gate: only require \"ci / ci\" once that check-run has actually\n      // been OBSERVED on the default branch. With an empty bypass list, a\n      // required context that never fires would make the repo permanently\n      // unmergeable by EVERYONE — e.g. a workflow_call-only ci.yml emits no\n      // check runs. Unobserved ⇒ refs rules only; the check upgrades on a\n      // later pass once real evidence exists.\n      //\n      // Residual risk, accepted: this proves the check fires on default-branch\n      // PUSHES, not on pull_request events — a hand-edited push-only ci.yml\n      // would pass the gate and then block every PR. ci.yml is deliberately\n      // NOT healed by block A (per-site parameterized; see\n      // SELF_UPDATING_CONFIGS), so this recipe cannot correct that drift —\n      // the exposure is one bricked-PR repo, immediately visible on its next\n      // PR. Un-brick path: edit the ruleset via API (ruleset ADMIN is not\n      // ref-gated), then fix the ci.yml triggers by push.\n      const check = (await github.checkContextObserved(repo, base, REQUIRED_CHECK))\n        ? REQUIRED_CHECK\n        : null;\n      const existingRuleset = (await github.listRepoRulesets(repo)).find(\n        (r) => r.name === FLEET_RULESET_NAME,\n      );\n      if (!existingRuleset) {\n        await github.createRuleset(repo, desiredRuleset(check));\n        actions.push(\n          check === null\n            ? `created ruleset \"${FLEET_RULESET_NAME}\" (refs rules only — \"${REQUIRED_CHECK}\" not yet observed on ${base})`\n            : `created ruleset \"${FLEET_RULESET_NAME}\"`,\n        );\n      } else {\n        const full = await github.getRuleset(repo, existingRuleset.id);\n        const gaps = rulesetGaps(full, check);\n        if (gaps.length > 0) {\n          // PUT the healed payload (merge TOWARD the floor, never away — see\n          // healRuleset). Recording the specific gaps makes this the drift\n          // ALARM, same as the auto-merge-off action above.\n          await github.updateRuleset(repo, existingRuleset.id, healRuleset(full, check));\n          actions.push(`healed ruleset drift: ${gaps.join(\"; \")}`);\n        }\n      }\n    }\n    // (No per-repo RENOVATE_TOKEN planting anymore: Renovate authenticates as\n    // the reddoor-renovate GitHub App, whose RENOVATE_APP_ID / _PRIVATE_KEY are\n    // org-level with all-repos visibility — a new repo needs NOTHING set. The\n    // old step was already redundant for new sites (the PAT was an org secret\n    // too); existing per-repo copies are inert and left to rot harmlessly.\n    // docs/runbooks/renovate-app-identity.md covers the migration + rollback.)\n  } catch (err) {\n    const done = actions.length ? ` (completed: ${actions.join(\"; \")})` : \"\";\n    const message = err instanceof Error ? err.message : String(err);\n    return resultOf(site, \"failed\", `${message}${done}`, commits);\n  } finally {\n    // Restore the operator's branch whenever we created + checked out a maint\n    // branch — on SUCCESS and, critically, on FAILURE. Without this, a push/PR\n    // error after createBranch strands the checkout on the maint branch with an\n    // unpushed commit, and the retry then fails at createBranch (\"branch already\n    // exists\"). Best-effort: a restore failure must not mask the real outcome.\n    if (maintBranch !== null && original !== null && original !== maintBranch) {\n      try {\n        await checkoutBranch(site.path, original);\n      } catch (err) {\n        console.warn(\n          `warning: could not restore branch ${original} after self-updating: ${\n            err instanceof Error ? err.message : String(err)\n          }`,\n        );\n      }\n    }\n  }\n\n  return actions.length\n    ? resultOf(site, \"applied\", actions.join(\"; \"), commits)\n    : resultOf(site, \"noop\", \"already self-updating\", commits);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,OAAO,iBAAiB;AACjC,SAAS,SAAS,YAAY;AAoC9B,IAAM,wBAAwB,CAAC,mBAAmB,iBAAiB;AAMnE,IAAM,iBAAiB;AAOvB,SAAS,SACP,MACA,QACA,OACA,UAAoB,CAAC,GACP;AACd,SAAO,EAAE,QAAQ,iBAAiB,MAAM,UAAU,IAAI,GAAG,QAAQ,SAAS,MAAM;AAClF;AAMA,SAAS,mBAAmB,SAAiB,WAA4B;AACvE,QAAM,OAAO,CAAC,MAAc,EAAE,QAAQ,SAAS,IAAI,EAAE,QAAQ,QAAQ,EAAE;AACvE,SAAO,KAAK,OAAO,MAAM,KAAK,SAAS;AACzC;AAEA,eAAsB,aAAa,MAAY,OAAyB,CAAC,GAA0B;AACjG,QAAM,YAAY,gBAAgB,CAAC,GAAG,qBAAqB,CAAC;AAE5D,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,iBAAiB,IAAI;AAAA,EACpC,SAAS,KAAK;AAGZ,WAAO,SAAS,MAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,EAClF;AACA,MAAI,CAAC,MAAM;AACT,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,IAEF;AAAA,EACF;AAEA,QAAM,MAAM,iBAAiB;AAC7B,MAAI,CAAC,KAAK,UAAU,CAAC,IAAK,QAAO,SAAS,MAAM,UAAU,sBAAsB;AAChF,QAAM,SAAS,KAAK,UAAU,WAAW,EAAE,OAAO,IAAK,MAAM,CAAC;AAE9D,QAAM,OAAO,MAAM,OAAO,cAAc,IAAI,EAAE,MAAM,MAAM,MAAM;AAChE,QAAM,UAAoB,CAAC;AAC3B,QAAM,UAAoB,CAAC;AAK3B,MAAI,WAA0B;AAC9B,MAAI,cAA6B;AAEjC,MAAI;AAeF,UAAM,UAAoB,CAAC;AAK3B,UAAM,kBAAkB,oBAAI,IAA2B;AACvD,eAAW,KAAK,WAAW;AACzB,YAAM,UAAU,MAAM,OAAO,qBAAqB,MAAM,MAAM,EAAE,IAAI;AACpE,sBAAgB,IAAI,EAAE,MAAM,OAAO;AACnC,UAAI,YAAY,MAAM;AACpB,gBAAQ,KAAK,EAAE,IAAI;AACnB;AAAA,MACF;AACA,UAAI,mBAAmB,SAAS,EAAE,QAAQ,EAAG;AAC7C,UAAI,EAAE,WAAW,0BAA0B,mBAAmB,OAAO,EAAE,WAAW,GAAG;AACnF;AAAA,MACF;AACA,cAAQ,KAAK,EAAE,IAAI;AAAA,IACrB;AACA,QAAI,QAAQ,SAAS,GAAG;AACtB,YAAM,aAAa,MAAM,OAAO,uBAAuB,IAAI;AAC3D,UAAI,YAAY;AACd,gBAAQ,KAAK,kCAAkC,UAAU,EAAE;AAAA,MAC7D,OAAO;AACL,YAAI,CAAE,MAAM,mBAAmB,KAAK,IAAI,GAAI;AAC1C,iBAAO,SAAS,MAAM,UAAU,qDAAgD;AAAA,QAClF;AAIA,YAAI;AACF,qBAAW,MAAM,cAAc,KAAK,IAAI;AAAA,QAC1C,QAAQ;AACN,qBAAW;AAAA,QACb;AACA,sBAAc,WAAW,eAAe;AACxC,cAAM,aAAa,KAAK,MAAM,WAAW;AAOzC,mBAAW,KAAK,WAAW;AACzB,cAAI,CAAC,QAAQ,SAAS,EAAE,IAAI,EAAG;AAC/B,gBAAM,OAAO,KAAK,KAAK,MAAM,EAAE,IAAI;AACnC,gBAAM,MAAM,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AAM9C,gBAAM,WACJ,EAAE,WAAW,yBACT,qBAAqB,EAAE,UAAU,gBAAgB,IAAI,EAAE,IAAI,KAAK,IAAI,IACpE,EAAE;AACR,gBAAM,UAAU,MAAM,UAAU,OAAO;AAAA,QACzC;AACA,cAAM,MAAM,MAAM,OAAU,KAAK,MAAM,gDAAgD;AACvF,YAAI,IAAK,SAAQ,KAAK,GAAG;AACzB,eAAO,KAAK,cAAc,MAAS,KAAK,MAAM,WAAW;AACzD,cAAM,KAAK,MAAM,OAAO,gBAAgB,MAAM;AAAA,UAC5C,MAAM;AAAA,UACN;AAAA,UACA,OAAO;AAAA,UACP,MAAM;AAAA,QACR,CAAC;AACD,gBAAQ,KAAK,aAAa,GAAG,GAAG,EAAE;AAAA,MAGpC;AAAA,IACF;AAyBA,QAAI,MAAM,OAAO,iBAAiB,IAAI,GAAG;AACvC,YAAM,OAAO,qBAAqB,IAAI;AACtC,cAAQ,KAAK,uEAAuE;AAAA,IACtF;AACA,UAAM,mBAAmB,MAAM,OAAO,yBAAyB,MAAM,IAAI;AACzE,QAAI,CAAC,iBAAiB,SAAS,cAAc,GAAG;AAO9C,YAAM,WAAW,CAAC,GAAG,oBAAI,IAAI,CAAC,GAAG,kBAAkB,cAAc,CAAC,CAAC;AACnE,YAAM,OAAO,cAAc,MAAM,MAAM,QAAQ;AAC/C,cAAQ,KAAK,aAAa,cAAc,cAAc,IAAI,EAAE;AAAA,IAC9D;AAaA,QAAK,MAAM,OAAO,eAAe,IAAI,MAAO,UAAU;AAgBpD,YAAM,QAAS,MAAM,OAAO,qBAAqB,MAAM,MAAM,cAAc,IACvE,iBACA;AACJ,YAAM,mBAAmB,MAAM,OAAO,iBAAiB,IAAI,GAAG;AAAA,QAC5D,CAAC,MAAM,EAAE,SAAS;AAAA,MACpB;AACA,UAAI,CAAC,iBAAiB;AACpB,cAAM,OAAO,cAAc,MAAM,eAAe,KAAK,CAAC;AACtD,gBAAQ;AAAA,UACN,UAAU,OACN,oBAAoB,kBAAkB,8BAAyB,cAAc,yBAAyB,IAAI,MAC1G,oBAAoB,kBAAkB;AAAA,QAC5C;AAAA,MACF,OAAO;AACL,cAAM,OAAO,MAAM,OAAO,WAAW,MAAM,gBAAgB,EAAE;AAC7D,cAAM,OAAO,YAAY,MAAM,KAAK;AACpC,YAAI,KAAK,SAAS,GAAG;AAInB,gBAAM,OAAO,cAAc,MAAM,gBAAgB,IAAI,YAAY,MAAM,KAAK,CAAC;AAC7E,kBAAQ,KAAK,yBAAyB,KAAK,KAAK,IAAI,CAAC,EAAE;AAAA,QACzD;AAAA,MACF;AAAA,IACF;AAAA,EAOF,SAAS,KAAK;AACZ,UAAM,OAAO,QAAQ,SAAS,gBAAgB,QAAQ,KAAK,IAAI,CAAC,MAAM;AACtE,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,WAAO,SAAS,MAAM,UAAU,GAAG,OAAO,GAAG,IAAI,IAAI,OAAO;AAAA,EAC9D,UAAE;AAMA,QAAI,gBAAgB,QAAQ,aAAa,QAAQ,aAAa,aAAa;AACzE,UAAI;AACF,cAAM,eAAe,KAAK,MAAM,QAAQ;AAAA,MAC1C,SAAS,KAAK;AACZ,gBAAQ;AAAA,UACN,qCAAqC,QAAQ,yBAC3C,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CACjD;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO,QAAQ,SACX,SAAS,MAAM,WAAW,QAAQ,KAAK,IAAI,GAAG,OAAO,IACrD,SAAS,MAAM,QAAQ,yBAAyB,OAAO;AAC7D;","names":[]}

package/dist/{chunk-3HS6LPFX.js → chunk-FUWFLAWQ.js}

@@ -1,17 +1,17 @@
 import {
   withRecipe
-} from "./chunk-ZTPPCHDB.js";
+} from "./chunk-ZQV7UQNE.js";
 import {
   ALL_TEMPLATES,
   RENOVATE_ACTION_CONFIG,
   renovateActionGaps,
   templatesByName,
   withRenovatePinsFrom
-} from "./chunk-MLT4QY5X.js";
+} from "./chunk-SLFG7Y76.js";
 import {
   listTrackedFiles,
   removeFromIndex
-} from "./chunk-XTK5VIQB.js";
+} from "./chunk-AVEQUR44.js";
 
 // src/recipes/sync-configs.ts
 import { readFile, writeFile, mkdir } from "fs/promises";
@@ -229,4 +229,4 @@ export {
   planTemplateDiffs,
   syncConfigs
 };
-//# sourceMappingURL=chunk-3HS6LPFX.js.map
+//# sourceMappingURL=chunk-FUWFLAWQ.js.map