@reddoorla/maintenance 0.95.0 → 0.96.0

package/dist/chunk-XG2A6GIG.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/recipes/self-updating/index.ts"],"sourcesContent":["import { mkdir, readFile, writeFile } from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\nimport type { RecipeResult, Site } from \"../../types.js\";\nimport { refusedByGit, undoRefusedWrites, RESTORED_NOTE } from \"../_head-guard.js\";\nimport { templatesByName } from \"../sync-configs/templates.js\";\nimport {\n  renovateActionGaps,\n  withRenovatePinsFrom,\n  RENOVATE_ACTION_CONFIG,\n} from \"../sync-configs/renovate-action.js\";\nimport {\n  resolveOwnerRepo,\n  push as gitPush,\n  branchName,\n  checkoutBranch,\n  createBranch,\n  currentBranch,\n  commit as gitCommit,\n  isWorkingTreeClean,\n} from \"../../util/git.js\";\nimport { siteLabel } from \"../../util/site.js\";\nimport { readGitHubConfig } from \"../../github/config.js\";\nimport { makeGitHub, type GitHub } from \"../../github/gh.js\";\nimport {\n  FLEET_RULESET_NAME,\n  desiredRuleset,\n  healRuleset,\n  rulesetGaps,\n} from \"../../github/rulesets.js\";\n\n// Deliberately NOT ci.yml: that file is per-site parameterized (netlify-site,\n// node-version, permissions), so an exact-match heal against a static template\n// would strip those values in a green auto-mergeable PR — the armed clobber\n// the 2026-08-02 architecture review found. The starter clone owns ci.yml's\n// shape. Its pinned reusable-workflow ref is sometimes bumped by Renovate\n// (v1.2.0 -> v1.3.0 across 17 repos, Jul-Aug 2026) but was not for v1.4.0 or\n// v1.4.1 — the latter was swept by hand on 2026-09-01 — so propagation is a\n// manual step to verify, never a guarantee.\nconst SELF_UPDATING_CONFIGS = [\"renovate-action\", \"renovate-config\"] as const;\n\n// Reusable-workflow jobs report their check as \"<caller-job> / <reusable-job>\".\n// The thin `ci` caller (job `ci`) calls reddoorla/.github's reusable workflow (job `ci`),\n// so the required context is \"ci / ci\", NOT \"ci\". (Provisional — verified empirically on the\n// starter during M7.1 rollout; correct here if the live checks API reports a different string.)\nconst REQUIRED_CHECK = \"ci / ci\";\n\nexport type SelfUpdatingDeps = {\n  github?: GitHub;\n  pushBranch?: (cwd: string, branch: string) => Promise<void>;\n};\n\nfunction resultOf(\n  site: Site,\n  status: RecipeResult[\"status\"],\n  notes: string,\n  commits: string[] = [],\n): RecipeResult {\n  return { recipe: \"self-updating\", site: siteLabel(site), status, commits, notes };\n}\n\n/** True when a file's current content matches the canonical template for drift\n *  purposes. Normalizes line endings + trailing whitespace so a stray trailing\n *  newline (or CRLF) can't read as drift and open a needless PR every nightly run;\n *  any real content change still differs. */\nfunction sameConfigContents(current: string, canonical: string): boolean {\n  const norm = (s: string) => s.replace(/\\r\\n/g, \"\\n\").replace(/\\s+$/, \"\");\n  return norm(current) === norm(canonical);\n}\n\nexport async function selfUpdating(site: Site, deps: SelfUpdatingDeps = {}): Promise<RecipeResult> {\n  const templates = templatesByName([...SELF_UPDATING_CONFIGS]);\n\n  let repo: string | null;\n  try {\n    repo = await resolveOwnerRepo(site);\n  } catch (err) {\n    // A malformed repo identity must abort before any `gh` write — surface it\n    // as a recipe failure rather than letting the token reach an unintended repo.\n    return resultOf(site, \"failed\", err instanceof Error ? err.message : String(err));\n  }\n  if (!repo) {\n    return resultOf(\n      site,\n      \"failed\",\n      \"could not determine a GitHub repo for this site — set Airtable 'Git repo', or give \" +\n        \"the checkout an origin remote whose URL is a GitHub owner/repo\",\n    );\n  }\n\n  const cfg = readGitHubConfig();\n  if (!deps.github && !cfg) return resultOf(site, \"failed\", \"GITHUB_TOKEN not set\");\n  const github = deps.github ?? makeGitHub({ token: cfg!.token });\n\n  const base = await github.defaultBranch(repo).catch(() => \"main\");\n  const actions: string[] = [];\n  const commits: string[] = [];\n  // Hoisted so the `finally` can restore the operator's branch even when a\n  // failure (push/PR error) aborts AFTER we created + checked out the maint\n  // branch. `maintBranch` stays null until createBranch succeeds, so the\n  // restore is a no-op on every path that never left the operator's branch.\n  let original: string | null = null;\n  let maintBranch: string | null = null;\n\n  try {\n    // A. Renovate config on the default branch — compare CONTENT, not just\n    // existence, so a present-but-STALE config (a pre-App workflow, a drifted\n    // Renovate schedule window) is corrected rather than left silently\n    // forever. The prior existence-only gate reported \"already self-updating\" for any\n    // repo that merely HAD the files, however out of date — the very drift this\n    // recipe exists to repair (e.g. the Renovate schedule-window regression).\n    //\n    // renovate.yml specifically is compliance-checked rather than byte-matched\n    // (see renovateActionGaps / withRenovatePinsFrom in\n    // ../sync-configs/renovate-action.js): Renovate legitimately bumps its own\n    // digest pins forward, and a site's prettier may legitimately quote the\n    // cron / RENOVATE_* scalars differently — neither is real drift (issue\n    // #651; a byte-match recipe opened reddoor-starter-blux#1, a PR that\n    // DOWNGRADED Renovate's own pin).\n    const drifted: string[] = [];\n    // Captured so the write loop below can carry a drifted renovate.yml's own\n    // pins forward instead of re-fetching (and so a compliant-but-non-byte-\n    // identical file's contents are available for that carry-forward too,\n    // though it won't need healing).\n    const currentContents = new Map<string, string | null>();\n    for (const t of templates) {\n      const current = await github.fileContentsOnBranch(repo, base, t.path);\n      currentContents.set(t.path, current);\n      if (current === null) {\n        drifted.push(t.path);\n        continue;\n      }\n      if (sameConfigContents(current, t.contents)) continue;\n      if (t.config === RENOVATE_ACTION_CONFIG && renovateActionGaps(current).length === 0) {\n        continue;\n      }\n      drifted.push(t.path);\n    }\n    if (drifted.length > 0) {\n      const existingPR = await github.findOpenSelfUpdatingPR(repo);\n      if (existingPR) {\n        actions.push(`self-updating PR already open: ${existingPR}`);\n      } else {\n        if (!(await isWorkingTreeClean(site.path))) {\n          return resultOf(site, \"failed\", \"working tree not clean — commit or stash first\");\n        }\n        // Capture the operator's branch BEFORE creating the maint branch so the\n        // `finally` can return them to it (#2). Best-effort capture: if it fails\n        // we just skip the restore rather than guess.\n        try {\n          original = await currentBranch(site.path);\n        } catch {\n          original = null;\n        }\n        maintBranch = branchName(\"self-updating\");\n        await createBranch(site.path, maintBranch);\n        // Write only the paths that actually drifted — a repo whose\n        // renovate.json is stale but whose renovate.yml already passes\n        // `renovateActionGaps` must not have that compliant renovate.yml\n        // silently rewritten (e.g. un-quoting its scalars) in the same PR.\n        // On a fresh repo every template path is missing, so `drifted`\n        // already contains all of them and bootstrap is unaffected.\n        // What each written path held BEFORE this run, so one git then refuses\n        // can be put back exactly as it was (null = the file did not exist).\n        const before = new Map<string, string | null>();\n        for (const t of templates) {\n          if (!drifted.includes(t.path)) continue;\n          const dest = join(site.path, t.path);\n          before.set(t.path, await readFile(dest, \"utf-8\").catch(() => null));\n          await mkdir(dirname(dest), { recursive: true });\n          // For a genuinely non-compliant renovate.yml, carry the site's own\n          // (still-digest-pinned) action refs forward onto the template before\n          // writing it — writing the template verbatim would put its OLDER\n          // pins over the site's newer ones, re-introducing the downgrade\n          // this compliance check exists to prevent (issue #651).\n          const contents =\n            t.config === RENOVATE_ACTION_CONFIG\n              ? withRenovatePinsFrom(t.contents, currentContents.get(t.path) ?? null)\n              : t.contents;\n          await writeFile(dest, contents, \"utf-8\");\n        }\n        const sha = await gitCommit(site.path, \"ci: enable self-updating (Renovate auto-merge)\");\n        if (sha) commits.push(sha);\n\n        // Did git TAKE the configs? The PARTIAL drop is the one that bites: with\n        // one of the two paths ignored the other still commits, so `commit()`\n        // returns a SHA and — before this check — the branch was pushed and a PR\n        // opened for a repo that would never become self-updating, after which\n        // every later run reported \"self-updating PR already open\" forever.\n        // Checked BEFORE the push, so nothing reaches GitHub on a refusal (#741).\n        const refusal = await refusedByGit(site.path, drifted, \"the Renovate configuration\");\n        if (refusal) {\n          await undoRefusedWrites(site.path, before, refusal.missing);\n          return resultOf(site, \"failed\", refusal.notes + RESTORED_NOTE, commits);\n        }\n\n        await (deps.pushBranch ?? gitPush)(site.path, maintBranch);\n        const pr = await github.openPullRequest(repo, {\n          head: maintBranch,\n          base,\n          title: \"Enable self-updating (Renovate)\",\n          body: \"Adds scheduled Renovate and Renovate-owned merges for patch/minor updates. (ci.yml is deliberately not managed here — its shape comes from the starter and its reusable-workflow pin from Renovate.)\",\n        });\n        actions.push(`opened PR ${pr.url}`);\n        // (Branch restore happens in the `finally` below — on success AND on a\n        // failure that aborts after createBranch.)\n      }\n    }\n\n    // B. Repo settings — check-then-ensure, each independent (self-healing).\n    //\n    // Platform auto-merge is DISABLED fleet-wide, and this block self-heals toward\n    // OFF (it used to drive repos ON — do not \"fix\" it back).\n    //\n    // Why: GitHub's platform auto-merge is a per-PR flag that anyone with write\n    // access can arm; the PR then merges itself later, unattended, once checks go\n    // green. The org Renovate preset forbids auto-merging majors and was working\n    // correctly — Renovate never armed them — but the preset has no authority over\n    // a flag someone else set. On 2026-07-26 a bulk `gh pr merge --auto` sweep\n    // armed it across 8 fleet repos, and the next morning two `actions/checkout`\n    // MAJOR bumps merged with zero reviews (reddoor-starter#77,\n    // reddoor-website#111) as soon as Renovate's own rebase cleared their\n    // conflicts. Realized damage, not a hypothetical.\n    //\n    // The fix is to keep merges INSIDE Renovate's own run, where its `packageRules`\n    // actually govern the decision. Renovate can only merge while it is running, so\n    // the workflow cron (see sync-configs templates) is the merge cadence.\n    //\n    // Leaving the self-heal pointed at OFF makes this a drift ALARM: if someone\n    // re-enables platform auto-merge, the next `self-updating` / `launch` run turns\n    // it back off and records the action. `enableRepoAutoMerge` is retained in\n    // `src/github/gh.ts` as the documented rollback path.\n    if (await github.autoMergeEnabled(repo)) {\n      await github.disableRepoAutoMerge(repo);\n      actions.push(\"disabled auto-merge (platform auto-merge is not permitted fleet-wide)\");\n    }\n    const existingContexts = await github.branchProtectionContexts(repo, base);\n    if (!existingContexts.includes(REQUIRED_CHECK)) {\n      // protectBranch issues a full PUT that REPLACES required-status-check contexts.\n      // Send the UNION of the branch's existing required contexts + our REQUIRED_CHECK\n      // so we ADD the CI gate without silently dropping any other checks the repo\n      // already requires. (When the branch has no protection yet, existingContexts is\n      // [] and this is just [REQUIRED_CHECK] — the original behavior.) Dedupe defends\n      // against REQUIRED_CHECK already appearing among the existing contexts.\n      const contexts = [...new Set([...existingContexts, REQUIRED_CHECK])];\n      await github.protectBranch(repo, base, contexts);\n      actions.push(`required \"${REQUIRED_CHECK}\" check on ${base}`);\n    }\n    // Ruleset ensure — the layer that binds ADMINS. Classic protection above\n    // keeps `enforce_admins: false`, which is exactly the hole the 2026-07-26\n    // bulk `gh pr merge --auto` sweep walked through (two unreviewed MAJORS\n    // merged). The 2026-08-01 audit then found the six NEWEST repos with no\n    // ruleset at all — every hand-applied sweep regrows its gap at the next\n    // onboard, so the recipe owns the invariant now. Spec + invariants:\n    // docs/superpowers/specs/2026-08-02-ruleset-self-healing-design.md.\n    //\n    // Private repos are skipped BEFORE any attempt: rulesets there need a paid\n    // plan, so trying would either fail every run or spam a phantom action\n    // that flips this recipe to \"applied\" forever. Classic protection remains\n    // their floor.\n    if ((await github.repoVisibility(repo)) === \"public\") {\n      // Evidence gate: only require \"ci / ci\" once that check-run has actually\n      // been OBSERVED on the default branch. With an empty bypass list, a\n      // required context that never fires would make the repo permanently\n      // unmergeable by EVERYONE — e.g. a workflow_call-only ci.yml emits no\n      // check runs. Unobserved ⇒ refs rules only; the check upgrades on a\n      // later pass once real evidence exists.\n      //\n      // Residual risk, accepted: this proves the check fires on default-branch\n      // PUSHES, not on pull_request events — a hand-edited push-only ci.yml\n      // would pass the gate and then block every PR. ci.yml is deliberately\n      // NOT healed by block A (per-site parameterized; see\n      // SELF_UPDATING_CONFIGS), so this recipe cannot correct that drift —\n      // the exposure is one bricked-PR repo, immediately visible on its next\n      // PR. Un-brick path: edit the ruleset via API (ruleset ADMIN is not\n      // ref-gated), then fix the ci.yml triggers by push.\n      const check = (await github.checkContextObserved(repo, base, REQUIRED_CHECK))\n        ? REQUIRED_CHECK\n        : null;\n      const existingRuleset = (await github.listRepoRulesets(repo)).find(\n        (r) => r.name === FLEET_RULESET_NAME,\n      );\n      if (!existingRuleset) {\n        await github.createRuleset(repo, desiredRuleset(check));\n        actions.push(\n          check === null\n            ? `created ruleset \"${FLEET_RULESET_NAME}\" (refs rules only — \"${REQUIRED_CHECK}\" not yet observed on ${base})`\n            : `created ruleset \"${FLEET_RULESET_NAME}\"`,\n        );\n      } else {\n        const full = await github.getRuleset(repo, existingRuleset.id);\n        const gaps = rulesetGaps(full, check);\n        if (gaps.length > 0) {\n          // PUT the healed payload (merge TOWARD the floor, never away — see\n          // healRuleset). Recording the specific gaps makes this the drift\n          // ALARM, same as the auto-merge-off action above.\n          await github.updateRuleset(repo, existingRuleset.id, healRuleset(full, check));\n          actions.push(`healed ruleset drift: ${gaps.join(\"; \")}`);\n        }\n      }\n    }\n    // (No per-repo RENOVATE_TOKEN planting anymore: Renovate authenticates as\n    // the reddoor-renovate GitHub App, whose RENOVATE_APP_ID / _PRIVATE_KEY are\n    // org-level with all-repos visibility — a new repo needs NOTHING set. The\n    // old step was already redundant for new sites (the PAT was an org secret\n    // too); existing per-repo copies are inert and left to rot harmlessly.\n    // docs/runbooks/renovate-app-identity.md covers the migration + rollback.)\n  } catch (err) {\n    const done = actions.length ? ` (completed: ${actions.join(\"; \")})` : \"\";\n    const message = err instanceof Error ? err.message : String(err);\n    return resultOf(site, \"failed\", `${message}${done}`, commits);\n  } finally {\n    // Restore the operator's branch whenever we created + checked out a maint\n    // branch — on SUCCESS and, critically, on FAILURE. Without this, a push/PR\n    // error after createBranch strands the checkout on the maint branch with an\n    // unpushed commit, and the retry then fails at createBranch (\"branch already\n    // exists\"). Best-effort: a restore failure must not mask the real outcome.\n    if (maintBranch !== null && original !== null && original !== maintBranch) {\n      try {\n        await checkoutBranch(site.path, original);\n      } catch (err) {\n        console.warn(\n          `warning: could not restore branch ${original} after self-updating: ${\n            err instanceof Error ? err.message : String(err)\n          }`,\n        );\n      }\n    }\n  }\n\n  return actions.length\n    ? resultOf(site, \"applied\", actions.join(\"; \"), commits)\n    : resultOf(site, \"noop\", \"already self-updating\", commits);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,OAAO,UAAU,iBAAiB;AAC3C,SAAS,SAAS,YAAY;AAqC9B,IAAM,wBAAwB,CAAC,mBAAmB,iBAAiB;AAMnE,IAAM,iBAAiB;AAOvB,SAAS,SACP,MACA,QACA,OACA,UAAoB,CAAC,GACP;AACd,SAAO,EAAE,QAAQ,iBAAiB,MAAM,UAAU,IAAI,GAAG,QAAQ,SAAS,MAAM;AAClF;AAMA,SAAS,mBAAmB,SAAiB,WAA4B;AACvE,QAAM,OAAO,CAAC,MAAc,EAAE,QAAQ,SAAS,IAAI,EAAE,QAAQ,QAAQ,EAAE;AACvE,SAAO,KAAK,OAAO,MAAM,KAAK,SAAS;AACzC;AAEA,eAAsB,aAAa,MAAY,OAAyB,CAAC,GAA0B;AACjG,QAAM,YAAY,gBAAgB,CAAC,GAAG,qBAAqB,CAAC;AAE5D,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,iBAAiB,IAAI;AAAA,EACpC,SAAS,KAAK;AAGZ,WAAO,SAAS,MAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,EAClF;AACA,MAAI,CAAC,MAAM;AACT,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,IAEF;AAAA,EACF;AAEA,QAAM,MAAM,iBAAiB;AAC7B,MAAI,CAAC,KAAK,UAAU,CAAC,IAAK,QAAO,SAAS,MAAM,UAAU,sBAAsB;AAChF,QAAM,SAAS,KAAK,UAAU,WAAW,EAAE,OAAO,IAAK,MAAM,CAAC;AAE9D,QAAM,OAAO,MAAM,OAAO,cAAc,IAAI,EAAE,MAAM,MAAM,MAAM;AAChE,QAAM,UAAoB,CAAC;AAC3B,QAAM,UAAoB,CAAC;AAK3B,MAAI,WAA0B;AAC9B,MAAI,cAA6B;AAEjC,MAAI;AAeF,UAAM,UAAoB,CAAC;AAK3B,UAAM,kBAAkB,oBAAI,IAA2B;AACvD,eAAW,KAAK,WAAW;AACzB,YAAM,UAAU,MAAM,OAAO,qBAAqB,MAAM,MAAM,EAAE,IAAI;AACpE,sBAAgB,IAAI,EAAE,MAAM,OAAO;AACnC,UAAI,YAAY,MAAM;AACpB,gBAAQ,KAAK,EAAE,IAAI;AACnB;AAAA,MACF;AACA,UAAI,mBAAmB,SAAS,EAAE,QAAQ,EAAG;AAC7C,UAAI,EAAE,WAAW,0BAA0B,mBAAmB,OAAO,EAAE,WAAW,GAAG;AACnF;AAAA,MACF;AACA,cAAQ,KAAK,EAAE,IAAI;AAAA,IACrB;AACA,QAAI,QAAQ,SAAS,GAAG;AACtB,YAAM,aAAa,MAAM,OAAO,uBAAuB,IAAI;AAC3D,UAAI,YAAY;AACd,gBAAQ,KAAK,kCAAkC,UAAU,EAAE;AAAA,MAC7D,OAAO;AACL,YAAI,CAAE,MAAM,mBAAmB,KAAK,IAAI,GAAI;AAC1C,iBAAO,SAAS,MAAM,UAAU,qDAAgD;AAAA,QAClF;AAIA,YAAI;AACF,qBAAW,MAAM,cAAc,KAAK,IAAI;AAAA,QAC1C,QAAQ;AACN,qBAAW;AAAA,QACb;AACA,sBAAc,WAAW,eAAe;AACxC,cAAM,aAAa,KAAK,MAAM,WAAW;AASzC,cAAM,SAAS,oBAAI,IAA2B;AAC9C,mBAAW,KAAK,WAAW;AACzB,cAAI,CAAC,QAAQ,SAAS,EAAE,IAAI,EAAG;AAC/B,gBAAM,OAAO,KAAK,KAAK,MAAM,EAAE,IAAI;AACnC,iBAAO,IAAI,EAAE,MAAM,MAAM,SAAS,MAAM,OAAO,EAAE,MAAM,MAAM,IAAI,CAAC;AAClE,gBAAM,MAAM,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AAM9C,gBAAM,WACJ,EAAE,WAAW,yBACT,qBAAqB,EAAE,UAAU,gBAAgB,IAAI,EAAE,IAAI,KAAK,IAAI,IACpE,EAAE;AACR,gBAAM,UAAU,MAAM,UAAU,OAAO;AAAA,QACzC;AACA,cAAM,MAAM,MAAM,OAAU,KAAK,MAAM,gDAAgD;AACvF,YAAI,IAAK,SAAQ,KAAK,GAAG;AAQzB,cAAM,UAAU,MAAM,aAAa,KAAK,MAAM,SAAS,4BAA4B;AACnF,YAAI,SAAS;AACX,gBAAM,kBAAkB,KAAK,MAAM,QAAQ,QAAQ,OAAO;AAC1D,iBAAO,SAAS,MAAM,UAAU,QAAQ,QAAQ,eAAe,OAAO;AAAA,QACxE;AAEA,eAAO,KAAK,cAAc,MAAS,KAAK,MAAM,WAAW;AACzD,cAAM,KAAK,MAAM,OAAO,gBAAgB,MAAM;AAAA,UAC5C,MAAM;AAAA,UACN;AAAA,UACA,OAAO;AAAA,UACP,MAAM;AAAA,QACR,CAAC;AACD,gBAAQ,KAAK,aAAa,GAAG,GAAG,EAAE;AAAA,MAGpC;AAAA,IACF;AAyBA,QAAI,MAAM,OAAO,iBAAiB,IAAI,GAAG;AACvC,YAAM,OAAO,qBAAqB,IAAI;AACtC,cAAQ,KAAK,uEAAuE;AAAA,IACtF;AACA,UAAM,mBAAmB,MAAM,OAAO,yBAAyB,MAAM,IAAI;AACzE,QAAI,CAAC,iBAAiB,SAAS,cAAc,GAAG;AAO9C,YAAM,WAAW,CAAC,GAAG,oBAAI,IAAI,CAAC,GAAG,kBAAkB,cAAc,CAAC,CAAC;AACnE,YAAM,OAAO,cAAc,MAAM,MAAM,QAAQ;AAC/C,cAAQ,KAAK,aAAa,cAAc,cAAc,IAAI,EAAE;AAAA,IAC9D;AAaA,QAAK,MAAM,OAAO,eAAe,IAAI,MAAO,UAAU;AAgBpD,YAAM,QAAS,MAAM,OAAO,qBAAqB,MAAM,MAAM,cAAc,IACvE,iBACA;AACJ,YAAM,mBAAmB,MAAM,OAAO,iBAAiB,IAAI,GAAG;AAAA,QAC5D,CAAC,MAAM,EAAE,SAAS;AAAA,MACpB;AACA,UAAI,CAAC,iBAAiB;AACpB,cAAM,OAAO,cAAc,MAAM,eAAe,KAAK,CAAC;AACtD,gBAAQ;AAAA,UACN,UAAU,OACN,oBAAoB,kBAAkB,8BAAyB,cAAc,yBAAyB,IAAI,MAC1G,oBAAoB,kBAAkB;AAAA,QAC5C;AAAA,MACF,OAAO;AACL,cAAM,OAAO,MAAM,OAAO,WAAW,MAAM,gBAAgB,EAAE;AAC7D,cAAM,OAAO,YAAY,MAAM,KAAK;AACpC,YAAI,KAAK,SAAS,GAAG;AAInB,gBAAM,OAAO,cAAc,MAAM,gBAAgB,IAAI,YAAY,MAAM,KAAK,CAAC;AAC7E,kBAAQ,KAAK,yBAAyB,KAAK,KAAK,IAAI,CAAC,EAAE;AAAA,QACzD;AAAA,MACF;AAAA,IACF;AAAA,EAOF,SAAS,KAAK;AACZ,UAAM,OAAO,QAAQ,SAAS,gBAAgB,QAAQ,KAAK,IAAI,CAAC,MAAM;AACtE,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,WAAO,SAAS,MAAM,UAAU,GAAG,OAAO,GAAG,IAAI,IAAI,OAAO;AAAA,EAC9D,UAAE;AAMA,QAAI,gBAAgB,QAAQ,aAAa,QAAQ,aAAa,aAAa;AACzE,UAAI;AACF,cAAM,eAAe,KAAK,MAAM,QAAQ;AAAA,MAC1C,SAAS,KAAK;AACZ,gBAAQ;AAAA,UACN,qCAAqC,QAAQ,yBAC3C,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CACjD;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO,QAAQ,SACX,SAAS,MAAM,WAAW,QAAQ,KAAK,IAAI,GAAG,OAAO,IACrD,SAAS,MAAM,QAAQ,yBAAyB,OAAO;AAC7D;","names":[]}

package/dist/{chunk-TO7DJYLZ.js → chunk-XY7YV2YQ.js}

@@ -3,14 +3,14 @@ import {
 } from "./chunk-LKGVSM2O.js";
 import {
   readGitHubConfig
-} from "./chunk-GASBX52O.js";
+} from "./chunk-CGQZFQAY.js";
 import {
   assertUrlSegment
-} from "./chunk-XHHMM5HX.js";
+} from "./chunk-43SW3FGW.js";
 import {
   lighthouseAudit,
   readSiteConfig
-} from "./chunk-2NQUCS7O.js";
+} from "./chunk-BIYQN7FH.js";
 import {
   smokeAudit
 } from "./chunk-UDRHAQT7.js";
@@ -29,7 +29,7 @@ import {
 import {
   a11yRoutes,
   smokeRoutes
-} from "./chunk-YLYXW5PH.js";
+} from "./chunk-CXICCLNM.js";
 
 // src/audits/deps.ts
 import { readFile } from "fs/promises";
@@ -247,6 +247,7 @@ function mapDependabotAlert(raw) {
   const cveId = typeof adv["cve_id"] === "string" ? adv["cve_id"] : null;
   const rawScope = dependency["scope"];
   const rawRelationship = dependency["relationship"];
+  const rawManifest = dependency["manifest_path"];
   return {
     package: packageName,
     severity: typeof adv["severity"] === "string" ? adv["severity"] : "",
@@ -254,7 +255,8 @@ function mapDependabotAlert(raw) {
     cves: cveId ? [cveId] : [],
     url: typeof raw["html_url"] === "string" ? raw["html_url"] : null,
     scope: rawScope === "runtime" || rawScope === "development" ? rawScope : null,
-    relationship: rawRelationship === "direct" || rawRelationship === "transitive" ? rawRelationship : null
+    relationship: rawRelationship === "direct" || rawRelationship === "transitive" || rawRelationship === "inconclusive" ? rawRelationship : null,
+    manifestPath: typeof rawManifest === "string" && rawManifest ? rawManifest : null
   };
 }
 function makeGitHubRest(deps) {
@@ -397,6 +399,23 @@ function makeGitHubRest(deps) {
         url = nextLink(res.headers.get("link"));
       }
       return out;
+    },
+    async manifestExists(repo, path) {
+      const { owner, name } = splitRepo(repo);
+      assertUrlSegment("path", owner);
+      assertUrlSegment("path", name);
+      const encoded = path.split("/").map(encodeURIComponent).join("/");
+      const res = await doFetch(`${GITHUB_API}/repos/${owner}/${name}/contents/${encoded}`, {
+        headers: baseHeaders,
+        signal: AbortSignal.timeout(DEPENDABOT_FETCH_TIMEOUT_MS)
+      });
+      if (res.status === 404) return false;
+      if (!res.ok) {
+        throw new Error(
+          `GitHub GET contents/${path} ${owner}/${name} failed (${res.status}): ${await bodyText(res)}`
+        );
+      }
+      return true;
     }
   };
 }
@@ -497,7 +516,25 @@ function defaultDependabotDeps() {
   const cfg = readGitHubConfig();
   if (!cfg) return null;
   const gh = makeGitHubRest({ token: cfg.token });
-  return { listAlerts: (repo) => gh.listDependabotAlerts(repo, { state: "open" }) };
+  return {
+    listAlerts: (repo) => gh.listDependabotAlerts(repo, { state: "open" }),
+    manifestExists: (repo, path) => gh.manifestExists(repo, path)
+  };
+}
+async function absentManifests(deps, repo, alerts, label) {
+  const absent = /* @__PURE__ */ new Set();
+  if (!deps.manifestExists) return absent;
+  const paths = new Set(alerts.flatMap((a) => a.manifestPath ? [a.manifestPath] : []));
+  for (const path of paths) {
+    try {
+      if (!await deps.manifestExists(repo, path)) absent.add(path);
+    } catch (e) {
+      console.error(
+        `[security] ${label}: could not resolve manifest ${path} \u2014 counting its alerts: ${e instanceof Error ? e.message : String(e)}`
+      );
+    }
+  }
+  return absent;
 }
 function ghSeverityToApp(s) {
   if (s === "critical" || s === "high" || s === "low") return s;
@@ -514,12 +551,13 @@ async function dependabotAudit(deps, repo, label) {
     );
     return null;
   }
+  const absent = await absentManifests(deps, repo, alerts, label);
   const counts = { low: 0, moderate: 0, high: 0, critical: 0 };
   const advisories = [];
+  const ghostAdvisories = [];
   for (const a of alerts) {
     const severity = ghSeverityToApp(a.severity);
-    counts[severity] += 1;
-    advisories.push({
+    const entry = {
       module: a.package,
       severity,
       title: a.summary || "(no title)",
@@ -527,12 +565,36 @@ async function dependabotAudit(deps, repo, label) {
       ...a.url ? { url: a.url } : {},
       ...a.scope ? { scope: a.scope } : {},
       ...a.relationship ? { relationship: a.relationship } : {}
-    });
+    };
+    if (a.manifestPath && absent.has(a.manifestPath)) {
+      ghostAdvisories.push({ ...entry, manifestPath: a.manifestPath });
+      continue;
+    }
+    counts[severity] += 1;
+    advisories.push(entry);
   }
-  const status = classify(counts);
+  const liveStatus = classify(counts);
   const total = counts.low + counts.moderate + counts.high + counts.critical;
-  const summary = status === "pass" ? "Dependabot: 0 alerts" : `Dependabot: ${total} alert(s) (${counts.critical}C/${counts.high}H/${counts.moderate}M/${counts.low}L)`;
-  return { audit: "security", site: label, status, summary, details: { counts, advisories } };
+  const liveSummary = liveStatus === "pass" ? ghostAdvisories.length > 0 ? "Dependabot: 0 live alert(s)" : "Dependabot: 0 alerts" : `Dependabot: ${total} alert(s) (${counts.critical}C/${counts.high}H/${counts.moderate}M/${counts.low}L)`;
+  if (ghostAdvisories.length === 0) {
+    return {
+      audit: "security",
+      site: label,
+      status: liveStatus,
+      summary: liveSummary,
+      details: { counts, advisories }
+    };
+  }
+  const status = liveStatus === "pass" ? "warn" : liveStatus;
+  const manifests = [...new Set(ghostAdvisories.map((g) => g.manifestPath))].join(", ");
+  const summary = `${liveSummary}; ${ghostAdvisories.length} alert(s) on a manifest GitHub no longer tracks (${manifests}) \u2014 dismiss as inaccurate`;
+  return {
+    audit: "security",
+    site: label,
+    status,
+    summary,
+    details: { counts, advisories, ghostAdvisories }
+  };
 }
 async function securityAudit(ctx) {
   const spawn = ctx.spawn ?? defaultSpawn;
@@ -600,7 +662,36 @@ async function readJsonMaybe(path) {
     return null;
   }
 }
-function buildPlaywrightConfig(port, sitePath) {
+var DEV_SERVER_TIMEOUT_MS = 12e4;
+var PREVIEW_SERVER_TIMEOUT_MS = 5 * 6e4;
+var PLAYWRIGHT_TIMEOUT_MS = 5 * 6e4;
+var PLAYWRIGHT_PREVIEW_TIMEOUT_MS = 10 * 6e4;
+function webServerBlock(opts) {
+  return `{
+      command: ${JSON.stringify(opts.command)},
+      url: ${JSON.stringify(opts.url)},
+      cwd: ${JSON.stringify(opts.sitePath)},
+      reuseExistingServer: false,
+      timeout: ${opts.timeoutMs},
+    }`;
+}
+function buildPlaywrightConfig(port, sitePath, previewPort) {
+  const dev = webServerBlock({
+    command: `npm run vite:dev -- --port ${port} --strictPort`,
+    url: `http://localhost:${port}/dev/a11y-fixtures`,
+    sitePath,
+    timeoutMs: DEV_SERVER_TIMEOUT_MS
+  });
+  const preview = previewPort === void 0 ? void 0 : webServerBlock({
+    command: `npm run build && npm run preview -- --port ${previewPort} --strictPort`,
+    url: `http://localhost:${previewPort}/`,
+    sitePath,
+    timeoutMs: PREVIEW_SERVER_TIMEOUT_MS
+  });
+  const webServer = preview === void 0 ? dev : `[
+    ${dev},
+    ${preview},
+  ]`;
   return `import { defineConfig } from "@playwright/test";
 
 export default defineConfig({
@@ -614,24 +705,18 @@ export default defineConfig({
     baseURL: "http://localhost:${port}",
     trace: "on-first-retry",
   },
-  webServer: {
-    // --strictPort: refuse to bump to a different port if ours is taken,
-    //   so the audit fails loudly instead of probing a zombie.
-    // reuseExistingServer:false: never reuse \u2014 we control the lifecycle.
-    // cwd: playwright's default webServer.cwd is the config file's
-    //   directory. Our config lives in /tmp so without this override,
-    //   "npm run vite:dev" tries to read /tmp/.../package.json and
-    //   ENOENTs before vite ever starts. Caltex 2026-05-28 (0.10.5).
-    command: "npm run vite:dev -- --port ${port} --strictPort",
-    url: "http://localhost:${port}/dev/a11y-fixtures",
-    cwd: ${JSON.stringify(sitePath)},
-    reuseExistingServer: false,
-    timeout: 120_000,
-  },
+  webServer: ${webServer},
 });
 `;
 }
-function buildSpec(axePages) {
+async function allocateDistinctPort(taken) {
+  for (let attempt = 0; attempt < 5; attempt += 1) {
+    const candidate = await findFreePort();
+    if (candidate !== taken) return candidate;
+  }
+  throw new Error(`a11y: could not allocate a second free port distinct from ${taken}`);
+}
+function buildSpec(axePages, smokeOrigin = "") {
   return `import { test, expect } from "@playwright/test";
 import AxeBuilder from "@axe-core/playwright";
 import { mkdir, writeFile } from "node:fs/promises";
@@ -639,6 +724,13 @@ import { dirname } from "node:path";
 
 const pages = ${JSON.stringify(axePages)};
 const smokePages = ${JSON.stringify(smokeRoutes)};
+// Absolute origin for the hydration smoke when the site has opted its gates
+// onto a production build (#700). The axe loop runs against the dev server via
+// baseURL; these routes run against the built bundle on a second port, and the
+// origin has to be explicit or they would silently fall back to baseURL \u2014 i.e.
+// to dev \u2014 and measure exactly what this exists to stop measuring. Empty string
+// = one server for both, the default.
+const SMOKE_ORIGIN = ${JSON.stringify(smokeOrigin)};
 const OUTPUT = process.env.REDDOOR_A11Y_OUTPUT;
 
 // Playwright's default per-test timeout is 30s. We loop through every
@@ -664,7 +756,23 @@ test("a11y + hydration across configured routes", async ({ page }) => {
 
   for (const { path, name } of pages) {
     currentRoute = name;
-    await page.goto(path);
+    const response = await page.goto(path);
+    // A route that does not exist is a config problem, not a markup one. The
+    // audit used to navigate, get a 404, run axe over whatever the error page
+    // was and report the count -- for months that page was a bare fallback with
+    // nothing to flag, so a missing fixture read as green. When reddoor-website
+    // gave its 404 page a designed watermark the count went to 1 with no route
+    // and no rule in the summary, and the "violation" was bisected as markup
+    // (#680). Name it as a missing route and do not scan the error page.
+    if (!response || response.status() !== 200) {
+      violations.push({
+        id: "route-missing",
+        impact: "serious",
+        route: name,
+        help: \`\${path} returned \${response ? response.status() : "no response"}\`,
+      });
+      continue;
+    }
     // Snap CSS transitions/animations to their resting state before axe runs.
     // AnimateIn-style fixtures transition opacity 0->1; sampling mid-transition
     // makes axe compute color-contrast against semi-transparent text, yielding a
@@ -697,7 +805,7 @@ test("a11y + hydration across configured routes", async ({ page }) => {
   // renders empty-but-valid won't false-fail -- only a real client crash does.
   for (const { path, name } of smokePages) {
     currentRoute = name;
-    await page.goto(path);
+    await page.goto(SMOKE_ORIGIN + path);
     // Let hydration + first effects run so a TDZ/ReferenceError surfaces.
     await page.waitForTimeout(2000);
   }
@@ -717,22 +825,45 @@ test("a11y + hydration across configured routes", async ({ page }) => {
 });
 `;
 }
+var NAMED_VIOLATIONS_MAX = 6;
+function describeViolations(violations) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const v of violations) {
+    const key = `${v.id}\0${v.route}`;
+    const g = groups.get(key);
+    if (g) g.n += 1;
+    else groups.set(key, { id: v.id, route: v.route, ...v.help ? { help: v.help } : {}, n: 1 });
+  }
+  const entries = [...groups.values()];
+  const shown = entries.slice(0, NAMED_VIOLATIONS_MAX).map((g) => {
+    const count = g.n > 1 ? ` \xD7${g.n}` : "";
+    const detail = g.id === "route-missing" && g.help ? ` (${g.help})` : "";
+    return `${g.id}${count} on ${g.route}${detail}`;
+  });
+  const rest = entries.length - shown.length;
+  return shown.join(", ") + (rest > 0 ? `, +${rest} more` : "");
+}
 async function a11yAudit(ctx) {
   const spawn = ctx.spawn ?? defaultSpawn;
   const site = ctx.site;
   const label = siteLabel(site);
   const specDir = await mkdtemp(join4(site.path, ".reddoor-a11y-spec-"));
   try {
-    const { a11yRoutes: siteRoutes } = await readSiteConfig(site.path);
+    const { a11yRoutes: siteRoutes, gateServer } = await readSiteConfig(site.path);
     const axePages = [
       ...a11yRoutes,
       ...(siteRoutes ?? []).map((path) => ({ path, name: path }))
     ];
-    const specPath = join4(specDir, "a11y.spec.ts");
-    await writeFile(specPath, buildSpec(axePages), "utf-8");
     const port = await findFreePort();
+    const previewPort = gateServer === "preview" ? await allocateDistinctPort(port) : void 0;
+    const specPath = join4(specDir, "a11y.spec.ts");
+    await writeFile(
+      specPath,
+      buildSpec(axePages, previewPort === void 0 ? "" : `http://localhost:${previewPort}`),
+      "utf-8"
+    );
     const configPath = join4(specDir, "playwright.config.ts");
-    await writeFile(configPath, buildPlaywrightConfig(port, site.path), "utf-8");
+    await writeFile(configPath, buildPlaywrightConfig(port, site.path, previewPort), "utf-8");
     const resultsPath = join4(site.path, RESULTS_REL);
     await rm(join4(site.path, ".reddoor-a11y"), { recursive: true, force: true });
     let raw;
@@ -747,7 +878,10 @@ async function a11yAudit(ctx) {
           // server, and runs axe over every configured route. The shared 30 s
           // default in runAudits is fine for deps/lint/security but starves
           // playwright (mirrors the lighthouse fix shipped earlier).
-          timeoutMs: 5 * 6e4
+          // A preview run pays for a production build before the first
+          // navigation, so the budget sized for "boot vite, then axe" would
+          // SIGKILL it mid-build and report it as an audit failure.
+          timeoutMs: previewPort === void 0 ? PLAYWRIGHT_TIMEOUT_MS : PLAYWRIGHT_PREVIEW_TIMEOUT_MS
         }
       );
     } catch (err) {
@@ -774,7 +908,11 @@ async function a11yAudit(ctx) {
     const hasSerious = (artifact.byImpact.serious ?? 0) > 0 || (artifact.byImpact.critical ?? 0) > 0;
     const hasAny = artifact.totalViolations > 0;
     const status = hasSerious ? "fail" : hasAny ? "warn" : "pass";
-    const summary = status === "pass" ? `a11y: 0 violations across ${a11yRoutes.length} routes (+${smokeRoutes.length} hydration smoke)` : `a11y: ${artifact.totalViolations} violations`;
+    const siteRouteCount = axePages.length - a11yRoutes.length;
+    const scanned = siteRouteCount > 0 ? `${axePages.length} routes (${a11yRoutes.length} fixtures + ${siteRouteCount} from package.json)` : `${axePages.length} routes`;
+    const smokeNote = previewPort === void 0 ? `+${smokeRoutes.length} hydration smoke` : `+${smokeRoutes.length} hydration smoke on a production preview`;
+    const named = describeViolations(artifact.violations ?? []);
+    const summary = status === "pass" ? `a11y: 0 violations across ${scanned} (${smokeNote})` : `a11y: ${artifact.totalViolations} violations across ${scanned}${named ? ` \u2014 ${named}` : ""}`;
     return {
       audit: "a11y",
       site: label,
@@ -1659,6 +1797,7 @@ async function functionHealthAudit(ctx) {
 // src/audits/form-e2e.ts
 var CF_TEST_SITEKEY = "1x00000000000000000000AA";
 var CONTACT_PATHS = ["/contact", "/"];
+var FORM_E2E_TESTMODE_UNDECLARED_SUMMARY = "site /health does not declare forms.testMode \u2014 probe refused (testMode forwarding not yet rolled out here)";
 var TESTMODE_SKIPPED_WORK_MS = 1e3;
 var BUDGET_WARN_RATIO = 0.5;
 function projectRealSubmissionMs(probeElapsedMs) {
@@ -1674,7 +1813,7 @@ function budgetThinSummary(probeElapsedMs) {
 var TURNSTILE_HOSTNAME_REJECTED = /\[Cloudflare Turnstile\][^\n]*?\b110200\b/;
 var TURNSTILE_WIDGET_ERROR = /\[Cloudflare Turnstile\][^\n]*?\b(?:110(?!200\b)\d{3}|400020|400070)\b/;
 var TURNSTILE_INIT_FAILED = /\[turnstile\] widget did not render/;
-var TURNSTILE_API_JS = /challenges\.cloudflare\.com\/turnstile\/v0\/api\.js/;
+var TURNSTILE_API_JS = /challenges\.cloudflare\.com\/turnstile\/v0\/(?:[\w.-]+\/)*api\.js/;
 function turnstileVerdict(health, observed) {
   if (health.turnstile === false) return "fail";
   if (!observed) return null;
@@ -1716,7 +1855,7 @@ async function formE2eAudit(ctx) {
         audit: "form-e2e",
         site: label,
         status: "skip",
-        summary: "site /health does not declare forms.testMode \u2014 probe refused (testMode forwarding not yet rolled out here)",
+        summary: FORM_E2E_TESTMODE_UNDECLARED_SUMMARY,
         details: { checkedAt, turnstileWidget: null }
       };
     }
@@ -2056,4 +2195,4 @@ export {
   runAudits,
   runAuditsAcross
 };
-//# sourceMappingURL=chunk-TO7DJYLZ.js.map
+//# sourceMappingURL=chunk-XY7YV2YQ.js.map