@reddoorla/maintenance 0.95.0 → 0.96.0

package/dist/{chunk-WVNDEYXL.js → chunk-GEUC5VGM.js}

@@ -5,7 +5,7 @@ import {
   mapWebsiteRecord,
   scheduleColumnFor,
   siteValueFor
-} from "./chunk-6R56OKJZ.js";
+} from "./chunk-UIITN37J.js";
 import {
   parseAutoEvidence,
   toReportType
@@ -22,7 +22,7 @@ import {
   toPrismicModelsVerdict,
   toVerdict,
   trimToNull
-} from "./chunk-3Z6X3BHU.js";
+} from "./chunk-KN52PM63.js";
 
 // src/db/fleet-state.ts
 import { sql } from "kysely";
@@ -218,6 +218,10 @@ async function getSiteBySlug(db, slug) {
   const r = await joined(db).where("sites.slug", "=", slug).executeTakeFirst();
   return r ? rowFromJoined(r) : null;
 }
+async function siteRowExists(db, siteId) {
+  const r = await db.selectFrom("sites").select("id").where("id", "=", siteId).executeTakeFirst();
+  return r !== void 0;
+}
 async function getSiteById(db, id) {
   const r = await joined(db).where("sites.id", "=", id).executeTakeFirst();
   return r ? rowFromJoined(r) : null;
@@ -329,8 +333,9 @@ async function listReportsForSite(db, siteId) {
   return rows.map((r) => reportRowFromDb(r, r.has_rendered_html !== 0));
 }
 async function mirrorReportPatch(db, reportId, patch) {
-  if (Object.keys(patch).length === 0) return;
-  await db.updateTable("reports").set(patch).where("id", "=", reportId).execute();
+  if (Object.keys(patch).length === 0) return true;
+  const res = await db.updateTable("reports").set(patch).where("id", "=", reportId).executeTakeFirst();
+  return res.numUpdatedRows > 0n;
 }
 async function mirrorReportInsert(db, rec) {
   const row = mapReportRecord(rec, null);
@@ -358,6 +363,7 @@ export {
   mirrorHealthFields,
   mirrorScheduleFields,
   getSiteBySlug,
+  siteRowExists,
   getSiteById,
   listSites,
   REPORT_LIST_COLUMNS,
@@ -369,4 +375,4 @@ export {
   getReportById,
   getReportHtml
 };
-//# sourceMappingURL=chunk-WVNDEYXL.js.map
+//# sourceMappingURL=chunk-GEUC5VGM.js.map

package/dist/chunk-GEUC5VGM.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/db/fleet-state.ts"],"sourcesContent":["/** Phase 2 of the Airtable → Turso migration (#539): the fleet-state READ layer.\n *\n *  Returns the exact `WebsiteRow` shape the Airtable module returns, so every\n *  repoint is an import-only swap at a composition root — the same trick\n *  listSubmissionsForSite used for the hybrid-db cutover. The raw values live\n *  in `sites`/`site_health`/`site_schedule` (written by the importer / hourly\n *  sync); coercion to `WebsiteRow` happens HERE, reusing the Airtable module's\n *  own exported coercers (`toVerdict`, `toFrequency`, `parseNotifyRouting`,\n *  `parseSecurityAdvisories`, `trimToNull`) so there is one truth for each.\n *\n *  The equivalence instrument (tests/db/fleet-state.test.ts) pins this module\n *  to `mapRow` field-by-field: for a fixture record, `mapRow(rec)` must deep-\n *  equal the row read back through here after an import. A new WebsiteRow\n *  field fails that test until this module carries it.\n *\n *  `headerImage` is the ONE deliberate exception (design D5): Airtable stopped\n *  being its source — the bytes belong in `sites.header_image*`. Those columns\n *  ARE now written: the header-image CLI dual-writes on every generation and the\n *  one-shot backfill copied the rest, so as of 2026-08-25 production carries a\n *  BLOB for 12 of the 13 maintained sites (the 13th, LA Homelessness Youth, has\n *  no header image in Airtable either — its reports are blocked at approve for\n *  exactly that). An earlier version of this comment said the columns were empty\n *  fleet-wide; that was true when written and is no longer.\n *\n *  The `url` is \"\" because the bytes live in the row itself, not behind a signed\n *  URL — which is why `url` is NOT a usable handle. A consumer that needs the\n *  image calls `loadHeaderImage(db, siteId)` for the bytes; the send path still\n *  fetches the Airtable attachment, and moving it over is its own change.\n */\nimport { sql, type Selectable, type Updateable } from \"kysely\";\nimport type { Db } from \"./client.js\";\nimport type { ReportsTable, SiteHealthTable, SiteScheduleTable, SitesTable } from \"./schema.js\";\nimport {\n  SITE_FIELDS,\n  siteValueFor,\n  healthColumnFor,\n  scheduleColumnFor,\n  mapReportRecord,\n  mapWebsiteRecord,\n  type RawRecord,\n} from \"./import-airtable.js\";\nimport type { AirtableCellValue } from \"../reports/airtable/websites.js\";\nimport {\n  toReportType,\n  parseAutoEvidence,\n  type ReportRow,\n  type DeliveryStatus,\n} from \"../reports/airtable/reports.js\";\nimport { MAINTENANCE_CHECKLIST, TESTING_CHECKLIST } from \"../reports/checklist.js\";\nimport type { WebsiteRow } from \"../reports/airtable/websites.js\";\nimport { canonicalizeStatus } from \"../reports/airtable/site-status.js\";\nimport {\n  parseNotifyRouting,\n  parseSecurityAdvisories,\n  toFrequency,\n  toPrismicModelsVerdict,\n  toVerdict,\n  trimToNull,\n} from \"../reports/airtable/websites.js\";\n\ntype JoinedRow = Record<string, unknown>;\n\nconst str = (v: unknown): string | null => (typeof v === \"string\" ? v : null);\nconst num = (v: unknown): number | null => (typeof v === \"number\" ? v : null);\n/** Stored 1/0/null (importer's b01n) → boolean | null. */\nconst bool = (v: unknown): boolean | null => (typeof v === \"number\" ? v !== 0 : null);\n\n/** Stored JSON array (importer-normalized) → the trimmed string[] mapRow yields. */\nfunction parseAwc(raw: unknown): string[] {\n  if (typeof raw !== \"string\" || raw.trim() === \"\") return [];\n  try {\n    const parsed: unknown = JSON.parse(raw);\n    if (!Array.isArray(parsed)) return [];\n    return parsed\n      .filter((x): x is string => typeof x === \"string\")\n      .map((s) => s.trim())\n      .filter(Boolean);\n  } catch {\n    return [];\n  }\n}\n\nfunction rowFromJoined(r: JoinedRow): WebsiteRow {\n  const name = String(r.name ?? \"\");\n  const headerFilename = str(r.header_image_filename);\n  const headerType = str(r.header_image_type);\n  return {\n    id: String(r.id),\n    name,\n    url: str(r.url) ?? \"\",\n    // `sites.status` holds the RAW Airtable cell (the importer stores it verbatim\n    // so the hourly parity check compares raw-to-raw). Canonicalizing HERE — the\n    // twin of mapRow's seam — is what keeps the #558 equivalence instrument green.\n    status: canonicalizeStatus(r.status),\n    statusRaw: str(r.status),\n    pointOfContact: str(r.point_of_contact),\n    maintenanceFreq: toFrequency(r.maintenance_freq, `${name} maintenance`),\n    testingFreq: toFrequency(r.testing_freq, `${name} testing`),\n    maintenanceFreqRaw: str(r.maintenance_freq),\n    testingFreqRaw: str(r.testing_freq),\n    maintenanceDay: str(r.maintenance_day),\n    testingDay: str(r.testing_day),\n    ga4PropertyId: str(r.ga4_property_id),\n    searchQuery: str(r.search_query),\n    searchConsoleProperty: str(r.search_console_property),\n    analyticsSoftFailAt: str(r.analytics_soft_fail_at),\n    gitRepo: str(r.git_repo),\n    reportRecipientsTo: str(r.report_recipients_to),\n    reportRecipientsCc: str(r.report_recipients_cc),\n    acceptedWatchConditions: parseAwc(r.accepted_watch_conditions),\n    headerImage:\n      headerFilename !== null && headerType !== null\n        ? { url: \"\", filename: headerFilename, type: headerType }\n        : null,\n    pScore: num(r.p_score),\n    rScore: num(r.r_score),\n    bpScore: num(r.bp_score),\n    seoScore: num(r.seo_score),\n    lastLighthouseAuditAt: str(r.lighthouse_at),\n    a11yViolations: num(r.a11y_violations),\n    depsDrifted: num(r.deps_drifted),\n    depsMajorBehind: num(r.deps_major_behind),\n    depsOutdated: num(r.deps_outdated),\n    depsMajorOutdated: num(r.deps_major_outdated),\n    securityVulnsCritical: num(r.vulns_critical),\n    securityVulnsHigh: num(r.vulns_high),\n    securityVulnsModerate: num(r.vulns_moderate),\n    securityVulnsLow: num(r.vulns_low),\n    securityAutoFixAttempts: num(r.auto_fix_attempts),\n    lastSecurityAuditAt: str(r.security_audit_at),\n    securityAdvisories: parseSecurityAdvisories(r.security_advisories),\n    certDaysRemaining: num(r.cert_days_remaining),\n    domainCheckedAt: str(r.domain_checked_at),\n    netlifyId: trimToNull(r.netlify_id),\n    deployStatus: str(r.deploy_status),\n    lastDeployAt: str(r.last_deploy_at),\n    deployLogUrl: str(r.deploy_log_url),\n    deployCheckedAt: str(r.deploy_checked_at),\n    functionHealth: toVerdict(r.function_health),\n    cmsReachable: toVerdict(r.cms_reachable),\n    turnstileWidget: toVerdict(r.turnstile_widget),\n    functionHealthCheckedAt: str(r.function_health_checked_at),\n    crossbrowserOk: bool(r.crossbrowser_ok),\n    mobileOk: bool(r.mobile_ok),\n    linksOk: bool(r.links_ok),\n    brokenLinks: num(r.broken_links),\n    browserCheckedAt: str(r.browser_checked_at),\n    reachableOk: toVerdict(r.uptime_reachable),\n    titleMetaOk: toVerdict(r.titles_meta_ok),\n    copyIntro: trimToNull(r.copy_intro),\n    copyContact: trimToNull(r.copy_contact),\n    copyFooter: trimToNull(r.copy_footer),\n    launchedAt: str(r.launched_at),\n    newsletterWebhook: trimToNull(r.newsletter_webhook),\n    notifyRouting: parseNotifyRouting(r.notify_routing),\n    notifyRoutingRaw: trimToNull(r.notify_routing),\n    mailchimpApiKey: trimToNull(r.mailchimp_api_key),\n    mailchimpAudienceId: trimToNull(r.mailchimp_audience_id),\n    requireTurnstile: typeof r.require_turnstile === \"number\" ? r.require_turnstile !== 0 : false,\n    renovateFailingCis: num(r.renovate_failing_cis),\n    defaultBranchCi: str(r.default_branch_ci),\n    lastCommitAt: str(r.last_commit_at),\n    githubSignalsAt: str(r.github_signals_at),\n    smokeOk: toVerdict(r.smoke_ok),\n    lastSmokeAt: str(r.last_smoke_at),\n    formE2eOk: toVerdict(r.form_e2e_ok),\n    formE2eCheckedAt: str(r.form_e2e_checked_at),\n    prismicModels: toPrismicModelsVerdict(r.prismic_models),\n    prismicModelsCheckedAt: str(r.prismic_models_checked_at),\n    prismicModelsDrift: str(r.prismic_models_drift),\n    prismicAckUntil: str(r.prismic_ack_until),\n    nextMaintenanceAt: str(r.next_maintenance_at),\n    nextTestingAt: str(r.next_testing_at),\n  };\n}\n\n/** Every sites column EXCEPT the header-image BLOB. Since the 2026-08-24\n *  backfill, header_image holds 0.7–3.5 MB JPEGs — a selectAll would haul\n *  megabytes into every site lookup (per LEAD on the ingest path, ×44 on the\n *  fleet list) and Turso bills the bytes. WebsiteRow only needs the metadata\n *  columns; the bytes have their own dedicated readers when a consumer wants\n *  them. Kept in lockstep with SitesTable by the blob-exclusion test. */\nconst SITE_COLUMNS = [\n  \"sites.id\",\n  \"sites.slug\",\n  \"sites.name\",\n  \"sites.url\",\n  \"sites.status\",\n  \"sites.point_of_contact\",\n  \"sites.maintenance_freq\",\n  \"sites.testing_freq\",\n  \"sites.maintenance_day\",\n  \"sites.testing_day\",\n  \"sites.ga4_property_id\",\n  \"sites.search_query\",\n  \"sites.search_console_property\",\n  \"sites.git_repo\",\n  \"sites.netlify_id\",\n  \"sites.report_recipients_to\",\n  \"sites.report_recipients_cc\",\n  \"sites.copy_intro\",\n  \"sites.copy_contact\",\n  \"sites.copy_footer\",\n  \"sites.newsletter_webhook\",\n  \"sites.mailchimp_api_key\",\n  \"sites.mailchimp_audience_id\",\n  \"sites.notify_routing\",\n  \"sites.require_turnstile\",\n  \"sites.accepted_watch_conditions\",\n  \"sites.prismic_ack_until\",\n  \"sites.launched_at\",\n  \"sites.header_image_filename\",\n  \"sites.header_image_type\",\n  \"sites.header_image_generated_at\",\n  \"sites.legacy\",\n] as const;\n\n/** The three-table join every read composes from. site_health/site_schedule\n *  rows are upserted alongside sites by the importer, but LEFT JOIN anyway —\n *  a site row must never vanish from a surface because a health row is absent. */\nfunction joined(db: Db) {\n  return db\n    .selectFrom(\"sites\")\n    .leftJoin(\"site_health\", \"site_health.site_id\", \"sites.id\")\n    .leftJoin(\"site_schedule\", \"site_schedule.site_id\", \"sites.id\")\n    .select(SITE_COLUMNS)\n    .selectAll([\"site_health\", \"site_schedule\"]);\n}\n\n/** Write-through for the site-detail editor (Phase 2): after the Airtable\n *  write (still the Phase 2 source of truth), mirror the same cell into\n *  `sites` so a Turso-reading page renders the edit immediately instead of\n *  waiting for the next hourly sync. The column mapping is the IMPORTER's own\n *  map — one truth — and the value gets the importer's empty-clears-to-null\n *  semantics. Throws on a column the importer doesn't claim (the lockstep\n *  test makes that unreachable for the editor's allowlist); the caller treats\n *  a mirror failure as non-fatal — the hourly sync converges it.\n *\n *  Handles the non-text columns too (`Require Turnstile` is a checkbox,\n *  `Accepted Watch Conditions` a multi-select): the coercion is NOT repeated\n *  here, it is delegated to the importer's own `siteValueFor`. That delegation\n *  is the whole safety property — parity compares raw-to-raw, so a mirror that\n *  stored `\"true\"` where the importer stores `1` would red every hourly run. */\nexport async function mirrorSiteField(\n  db: Db,\n  siteId: string,\n  airtableColumn: string,\n  value: AirtableCellValue,\n): Promise<void> {\n  await mirrorSiteFields(db, siteId, { [airtableColumn]: value });\n}\n\n/** The multi-column form, and where the work actually happens (#539 Phase 5).\n *\n *  `updateLaunched` is why it exists: it flips `Status` AND stamps `Launched at`\n *  in one Airtable update, and mirroring those as two separate UPDATEs would\n *  open a window where Turso says a site is maintained but never launched.\n *\n *  Same contract as {@link mirrorHealthFields}, deliberately — it takes the\n *  EXACT FieldSet just written to Airtable (the writers return it, so the mirror\n *  cannot carry a different payload), and returns whether a `sites` row matched:\n *  a site the hourly sync hasn't imported yet updates 0 rows → false, so the\n *  caller can count it honestly instead of claiming it mirrored. An empty\n *  FieldSet runs no SQL and returns true — nothing to mirror is not a miss. */\nexport async function mirrorSiteFields(\n  db: Db,\n  siteId: string,\n  fields: Record<string, unknown>,\n): Promise<boolean> {\n  const patch: Record<string, string | number | null> = {};\n  for (const [airtableColumn, value] of Object.entries(fields)) {\n    const col = SITE_FIELDS[airtableColumn];\n    if (!col)\n      throw new Error(`mirrorSiteFields: importer claims no sites column for '${airtableColumn}'`);\n    // Empty text still clears to null (the importer's `s()` does the same); the\n    // non-text columns get their own coercion inside siteValueFor.\n    patch[col] = siteValueFor(col, value);\n  }\n  if (Object.keys(patch).length === 0) return true;\n  const res = await db\n    .updateTable(\"sites\")\n    .set(patch as Updateable<SitesTable>)\n    .where(\"id\", \"=\", siteId)\n    .executeTakeFirst();\n  // kysely/libSQL reports numUpdatedRows as a BigInt — compare in BigInt.\n  return res.numUpdatedRows > 0n;\n}\n\n/** Mirror a NEWLY CREATED Airtable Websites record into Turso (#539 Phase 5).\n *\n *  `ensure-site` CREATES a row, and every other site mirror is an UPDATE, which\n *  does nothing at all for a row that does not exist yet — so a site\n *  bootstrapped at 09:05 was invisible until the 09:20 sync, and every mirror\n *  the rest of the bootstrap fired reported `mirrored=missed` with nothing to\n *  update.\n *\n *  Maps with the IMPORTER's own `mapWebsiteRecord`, which is also exactly what\n *  parity diffs against: that delegation is what makes the mirrored rows\n *  parity-clean by construction rather than by a column list someone has to\n *  remember to extend.\n *\n *  All THREE rows, not just `sites`. Parity reverse-checks `site_health` and\n *  `site_schedule` per site and reports a missing one as `(row) ABSENT`, and a\n *  later `mirrorHealthFields` would return `missed` forever with no row to hit.\n *\n *  Upserts rather than inserts because `ensure-site` is re-run to RESUME a\n *  bootstrap. The header_image* columns survive that by construction —\n *  `mapWebsiteRecord` does not carry them (Airtable stopped being their source,\n *  design D5), so the conflict branch cannot blank a stored plate whose bytes\n *  live in no other store. */\nexport async function mirrorSiteInsert(db: Db, rec: RawRecord, computedAt: string): Promise<void> {\n  const { site, health, schedule } = mapWebsiteRecord(rec, computedAt);\n  await db\n    .insertInto(\"sites\")\n    .values(site)\n    .onConflict((oc) => oc.column(\"id\").doUpdateSet(site))\n    .execute();\n  await db\n    .insertInto(\"site_health\")\n    .values(health)\n    .onConflict((oc) => oc.column(\"site_id\").doUpdateSet(health))\n    .execute();\n  await db\n    .insertInto(\"site_schedule\")\n    .values(schedule)\n    .onConflict((oc) => oc.column(\"site_id\").doUpdateSet(schedule))\n    .execute();\n}\n\n/** Write-through mirror for the nightly health writers (#539 Phase 3). Takes\n *  the EXACT FieldSet just written to Airtable (updateAuditFields /\n *  updateGitHubSignals return it), so the mirror can never carry a different\n *  payload than the Airtable write it shadows. Resolution + coercion come from\n *  the importer's healthColumnFor — one truth; an Airtable column no\n *  site_health column claims throws (same contract as mirrorSiteField).\n *  Partial by design: absent fields stay untouched, matching\n *  updateGitHubSignals' deliberate omission of a null lastCommitAt. Returns\n *  whether a site_health row matched: a site the hourly sync hasn't imported\n *  yet updates 0 rows → false, so the caller can count it honestly\n *  (mirror_missed) instead of claiming it mirrored — it still converges on the\n *  next sync, like every mirror. An empty FieldSet runs no SQL and returns\n *  true: nothing to mirror is not a miss. */\nexport async function mirrorHealthFields(\n  db: Db,\n  siteId: string,\n  fields: Record<string, unknown>,\n): Promise<boolean> {\n  // Per-column value types (number vs text) are guaranteed by healthColumnFor's\n  // coercion — the numeric/text split lives there, once — so the patch builds\n  // untyped and casts at the .set() boundary (the importer's own idiom).\n  const patch: Record<string, string | number | null> = {};\n  for (const [field, value] of Object.entries(fields)) {\n    const m = healthColumnFor(field);\n    if (!m)\n      throw new Error(`mirrorHealthFields: importer claims no site_health column for '${field}'`);\n    patch[m.col] = m.coerce(value);\n  }\n  if (Object.keys(patch).length === 0) return true;\n  const res = await db\n    .updateTable(\"site_health\")\n    .set(patch as Updateable<SiteHealthTable>)\n    .where(\"site_id\", \"=\", siteId)\n    .executeTakeFirst();\n  // kysely/libSQL reports numUpdatedRows as a BigInt — compare in BigInt.\n  return res.numUpdatedRows > 0n;\n}\n\n/** The site_schedule twin of {@link mirrorHealthFields}, for the nightly\n *  next-due write-back. `computedAt` stamps when THIS computation ran — the\n *  hourly sync overwrites it with its own import stamp, same as every mirrored\n *  value. Empty fields → full no-op (no lone computed_at stamp for a write\n *  that carried nothing). Same return contract as mirrorHealthFields: false\n *  when the UPDATE matched no site_schedule row (site not yet imported), true\n *  otherwise — including the empty-fields no-op. */\nexport async function mirrorScheduleFields(\n  db: Db,\n  siteId: string,\n  fields: Record<string, unknown>,\n  computedAt: string,\n): Promise<boolean> {\n  const patch: Record<string, string | null> = {};\n  for (const [field, value] of Object.entries(fields)) {\n    const m = scheduleColumnFor(field);\n    if (!m)\n      throw new Error(\n        `mirrorScheduleFields: importer claims no site_schedule column for '${field}'`,\n      );\n    patch[m.col] = m.coerce(value);\n  }\n  if (Object.keys(patch).length === 0) return true;\n  patch.computed_at = computedAt;\n  const res = await db\n    .updateTable(\"site_schedule\")\n    .set(patch as Updateable<SiteScheduleTable>)\n    .where(\"site_id\", \"=\", siteId)\n    .executeTakeFirst();\n  return res.numUpdatedRows > 0n;\n}\n\n/** Same contract as the Airtable getWebsiteBySlug: slug is siteSlug(Name),\n *  precomputed into the UNIQUE sites.slug column at import time. */\nexport async function getSiteBySlug(db: Db, slug: string): Promise<WebsiteRow | null> {\n  const r = await joined(db).where(\"sites.slug\", \"=\", slug).executeTakeFirst();\n  return r ? rowFromJoined(r as JoinedRow) : null;\n}\n\n/** #645. Does `sites` hold this row at all? One column, no join, no row mapping —\n *  `getSiteById` would answer the same question (its joins are LEFT, so a site\n *  missing its site_health/site_schedule companions still resolves) but it pays\n *  for a full `rowFromJoined` to return a boolean, and it would tie the heal's\n *  decision to whatever that mapper does next. `sites.id` is the PK and it is\n *  exactly what `mirrorSiteInsert` conflicts on. */\nexport async function siteRowExists(db: Db, siteId: string): Promise<boolean> {\n  const r = await db.selectFrom(\"sites\").select(\"id\").where(\"id\", \"=\", siteId).executeTakeFirst();\n  return r !== undefined;\n}\n\n/** By Airtable rec id (the PK) — approve-report's lookup shape. */\nexport async function getSiteById(db: Db, id: string): Promise<WebsiteRow | null> {\n  const r = await joined(db).where(\"sites.id\", \"=\", id).executeTakeFirst();\n  return r ? rowFromJoined(r as JoinedRow) : null;\n}\n\n/** Same contract as the Airtable listWebsites: every site, one row each.\n *  Name-ordered for determinism (Airtable returned table order; no consumer\n *  is order-sensitive — the cockpit groups and sorts itself). */\nexport async function listSites(db: Db): Promise<WebsiteRow[]> {\n  const rows = await joined(db).orderBy(\"sites.name\").execute();\n  return rows.map((r) => rowFromJoined(r as JoinedRow));\n}\n\n// ————————————————————————— reports —————————————————————————\n\n/** stable checklist key → Airtable column name. The importer stores stable keys\n *  (mapReportRecord); `ReportRow.checklist` exposes Airtable column names — one\n *  derived map, built from the checklist definitions themselves. */\nconst CHECKLIST_FIELD_BY_KEY: ReadonlyMap<string, string> = new Map(\n  [...MAINTENANCE_CHECKLIST, ...TESTING_CHECKLIST].map((i) => [i.key, i.field]),\n);\n\nfunction checklistFromStored(raw: string | null): Record<string, boolean> {\n  let stored: Record<string, unknown> = {};\n  if (typeof raw === \"string\" && raw.trim() !== \"\") {\n    try {\n      const parsed: unknown = JSON.parse(raw);\n      if (parsed && typeof parsed === \"object\" && !Array.isArray(parsed))\n        stored = parsed as Record<string, unknown>;\n    } catch {\n      // fall through to all-false — a bad blob must not throw the page\n    }\n  }\n  const out: Record<string, boolean> = {};\n  for (const [key, field] of CHECKLIST_FIELD_BY_KEY) out[field] = Boolean(stored[key]);\n  return out;\n}\n\n/**\n * `hasRenderedHtml` is passed separately rather than read off `r`, because the\n * list read deliberately does not fetch the body (see REPORT_LIST_COLUMNS) and\n * only ever needed its null-ness. Taking it as an argument means a list row and a\n * full row are both honest inputs, and nothing here can start depending on body\n * CONTENT without the type changing to say so.\n */\nfunction reportRowFromDb(\n  r: Omit<Selectable<ReportsTable>, \"rendered_html\">,\n  hasRenderedHtml: boolean,\n): ReportRow {\n  const p = r.lighthouse_performance;\n  const a = r.lighthouse_accessibility;\n  const b = r.lighthouse_best_practices;\n  const seo = r.lighthouse_seo;\n  const lighthouse =\n    typeof p === \"number\" &&\n    typeof a === \"number\" &&\n    typeof b === \"number\" &&\n    typeof seo === \"number\"\n      ? { performance: p, accessibility: a, bestPractices: b, seo }\n      : null;\n  return {\n    id: r.id,\n    reportId: r.report_id ?? \"\",\n    siteId: r.site_id ?? \"\",\n    reportType: toReportType(r.report_type ?? undefined),\n    period: r.period,\n    periodStart: r.period_start,\n    periodEnd: r.period_end,\n    completedOn: r.completed_on,\n    lighthouse,\n    gaUsersCurrent: r.ga_users_current,\n    gaUsersPrevious: r.ga_users_previous,\n    searchFoundPage1: bool(r.search_found_page1),\n    searchPosition: r.search_position,\n    lastTestedDate: r.last_tested_date,\n    commentary: r.commentary,\n    subjectOverride: r.subject_override,\n    draftReady: r.draft_ready !== 0,\n    approvedToSend: r.approved_to_send !== 0,\n    sentAt: r.sent_at,\n    approvedAt: r.approved_at,\n    approvedBy: r.approved_by,\n    deliveryStatus: (r.delivery_status ?? \"pending\") as DeliveryStatus,\n    // The body lives IN the row (rendered_html) — the link points at the\n    // dashboard's own preview route instead of an EXPIRING Airtable signed URL.\n    // Strictly better for the operator: the old link 404'd once the URL aged out.\n    renderedHtmlAttachment: hasRenderedHtml\n      ? { url: `/api/reports/${r.id}/preview`, filename: `${r.report_id ?? r.id}.html` }\n      : null,\n    resendMessageId: r.resend_message_id,\n    checklist: checklistFromStored(r.checklist),\n    autoEvidence: parseAutoEvidence(r.checklist_auto_evidence),\n    sendOverride: r.send_override !== 0,\n    overrideReason: r.override_reason,\n    overrideBy: r.override_by,\n    overrideAt: r.override_at,\n  };\n}\n\n/** Every reports column EXCEPT the rendered_html body — the exact hazard\n *  SITE_COLUMNS guards against on `sites`, on the table where it currently costs\n *  more. Live, all 16 reports carry a body: 1.17 MB total, avg 73 KB. A list read\n *  wants the body only to know WHETHER there is one, so `has_rendered_html`\n *  computes that in SQL and the bytes stay in the database. Kept in lockstep with\n *  ReportsTable by the body-exclusion test. */\nexport const REPORT_LIST_COLUMNS = [\n  \"id\",\n  \"site_id\",\n  \"report_id\",\n  \"report_type\",\n  \"period\",\n  \"period_start\",\n  \"period_end\",\n  \"completed_on\",\n  \"lighthouse_performance\",\n  \"lighthouse_accessibility\",\n  \"lighthouse_best_practices\",\n  \"lighthouse_seo\",\n  \"ga_users_current\",\n  \"ga_users_previous\",\n  \"search_found_page1\",\n  \"search_position\",\n  \"last_tested_date\",\n  \"commentary\",\n  \"subject_override\",\n  \"draft_ready\",\n  \"approved_to_send\",\n  \"approved_at\",\n  \"approved_by\",\n  \"send_override\",\n  \"override_reason\",\n  \"override_by\",\n  \"override_at\",\n  \"sent_at\",\n  \"delivery_status\",\n  \"resend_message_id\",\n  \"checklist\",\n  \"checklist_auto_evidence\",\n] as const;\n\n/** The one thing a list read still needs from the body: whether there IS one.\n *  Computed in SQLite so the bytes never cross the wire. */\nconst HAS_RENDERED_HTML = sql<number>`(rendered_html is not null)`.as(\"has_rendered_html\");\n\n/** Same contract as the Airtable listAllReports. Newest-period-first (Airtable\n *  returned manual table order; every consumer filters/sorts itself). */\nexport async function listAllReports(db: Db): Promise<ReportRow[]> {\n  const rows = await db\n    .selectFrom(\"reports\")\n    .select(REPORT_LIST_COLUMNS)\n    .select(HAS_RENDERED_HTML)\n    .orderBy(\"period_start\", \"desc\")\n    .orderBy(\"id\")\n    .execute();\n  return rows.map((r) => reportRowFromDb(r, r.has_rendered_html !== 0));\n}\n\n/** Same contract as the Airtable listReportsForSite — served by idx_reports_site.\n *  Body-free for the same reason as listAllReports: the site-detail page renders\n *  a link, never the HTML. */\nexport async function listReportsForSite(db: Db, siteId: string): Promise<ReportRow[]> {\n  const rows = await db\n    .selectFrom(\"reports\")\n    .select(REPORT_LIST_COLUMNS)\n    .select(HAS_RENDERED_HTML)\n    .where(\"site_id\", \"=\", siteId)\n    .orderBy(\"period_start\", \"desc\")\n    .orderBy(\"id\")\n    .execute();\n  return rows.map((r) => reportRowFromDb(r, r.has_rendered_html !== 0));\n}\n\n/** Columns a report writer mirrors after its Airtable write (same pattern as\n *  mirrorSiteField): the approve/override flow, the resend-webhook's delivery\n *  status, and — since #539 Phase 5 — the drafting path's queue flag and a\n *  re-run's refreshed scores.\n *\n *  `rendered_html` stays deliberately OUT even though the drafting path now\n *  writes it: bodies go through `storeRenderedHtml`, so a request handler\n *  holding a patch cannot accidentally write megabytes of HTML. */\nexport type ReportMirrorPatch = Partial<\n  Pick<\n    ReportsTable,\n    | \"approved_to_send\"\n    | \"approved_at\"\n    | \"approved_by\"\n    | \"send_override\"\n    | \"override_reason\"\n    | \"override_by\"\n    | \"override_at\"\n    | \"delivery_status\"\n    // Phase 4 report review: the console edits commentary and re-renders the\n    // page immediately after the write, so the mirror has to carry it or the\n    // operator sees their own save as a no-op until the next hourly sync.\n    | \"commentary\"\n    // Phase 5 drafting path. `draft_ready` is the queue flag `queueDraft`\n    // writes — for the new draft AND for every row it supersedes, so without it\n    // the console shows a site with two queued reports until the next sync.\n    | \"draft_ready\"\n    // A re-run (announce/launch reuse) refreshes an existing row's scores so the\n    // eventually-sent email is not stale; the console reads the same numbers.\n    | \"lighthouse_performance\"\n    | \"lighthouse_accessibility\"\n    | \"lighthouse_best_practices\"\n    | \"lighthouse_seo\"\n    | \"ga_users_current\"\n    | \"ga_users_previous\"\n    | \"search_found_page1\"\n    | \"search_position\"\n    | \"completed_on\"\n    // #643 (the freeze): the send batch mirrors its own `Sent at` stamp. These\n    // used to stay out because the hourly sync converged them; that sync is\n    // retired, and the console's already-sent guards (approve, the commentary\n    // lock, re-render) read `sent_at` from Turso — an unmirrored stamp would\n    // disarm all three for every post-flip send.\n    | \"sent_at\"\n    | \"resend_message_id\"\n  >\n>;\n\n/** Mirror an Airtable report write into Turso so the page re-render after an\n *  approve/override/bounce shows the new state immediately. Callers route\n *  failures through `mirrorWrite`, which decides fatal vs swallowed by the\n *  freeze switch; an empty patch is a no-op, never invalid SQL.\n *\n *  Returns whether the UPDATE matched a row (#647). Same contract as\n *  `mirrorSiteFields`: this module has no error policy of its own, so the\n *  count is REPORTED and the boundary (`mirrorWrite`, `makeReportMirror`)\n *  decides what a miss means — logged before the freeze, fatal after it, when\n *  no importer exists to converge a row that was never inserted. Discarding\n *  the count is what let a stamp for a row Turso never held mirror\n *  \"successfully\". An empty patch reports `true`: nothing to write is not a\n *  miss. */\nexport async function mirrorReportPatch(\n  db: Db,\n  reportId: string,\n  patch: ReportMirrorPatch,\n): Promise<boolean> {\n  if (Object.keys(patch).length === 0) return true;\n  const res = await db\n    .updateTable(\"reports\")\n    .set(patch)\n    .where(\"id\", \"=\", reportId)\n    .executeTakeFirst();\n  // kysely/libSQL reports numUpdatedRows as a BigInt — compare in BigInt.\n  return res.numUpdatedRows > 0n;\n}\n\n/** Mirror a NEWLY CREATED Airtable Reports record into Turso (#539 Phase 5).\n *\n *  Every other report mirror is an UPDATE, which silently does nothing for a row\n *  that does not exist yet — so a draft created at 09:05 was invisible to the\n *  Turso-backed console until the 09:20 sync. Takes the raw record Airtable\n *  echoed back from the create, and maps it with the IMPORTER's own\n *  `mapReportRecord`: parity diffs Turso against exactly that function, so\n *  delegating is what makes the mirrored row parity-clean by construction rather\n *  than by a column list someone has to remember to extend.\n *\n *  Upsert, not insert, and the conflict branch drops `rendered_html` for the\n *  same reason the importer's does: the body is written later by a separate\n *  sharp-bearing step, so a re-mirror carrying null would blank a render that\n *  had already succeeded. */\nexport async function mirrorReportInsert(db: Db, rec: RawRecord): Promise<void> {\n  const row = mapReportRecord(rec, null);\n  const { rendered_html: _rh, ...rowSansHtml } = row;\n  void _rh;\n  await db\n    .insertInto(\"reports\")\n    .values(row)\n    .onConflict((oc) => oc.column(\"id\").doUpdateSet(rowSansHtml))\n    .execute();\n}\n\n/**\n * Store a freshly rendered report body, replacing whatever was there.\n *\n * Deliberately NOT part of `ReportMirrorPatch`: that patch is the request path's\n * write-through (approve, override, delivery status), and a rendered body is\n * produced by a batch job with sharp, never by a dashboard POST. Keeping it out\n * means a handler cannot accidentally write megabytes of HTML from a request.\n *\n * It REPLACES unconditionally. The importer's `when-missing` mode skips a report\n * that already has a body — correct for an import, wrong here: a refresh whose\n * entire purpose is showing the newest commentary must overwrite.\n */\nexport async function storeRenderedHtml(db: Db, reportId: string, html: string): Promise<void> {\n  await db.updateTable(\"reports\").set({ rendered_html: html }).where(\"id\", \"=\", reportId).execute();\n}\n\n/** By rec id (the PK) — approve-report's read. */\nexport async function getReportById(db: Db, id: string): Promise<ReportRow | null> {\n  const r = await db.selectFrom(\"reports\").selectAll().where(\"id\", \"=\", id).executeTakeFirst();\n  return r ? reportRowFromDb(r, r.rendered_html !== null) : null;\n}\n\n/** The preview route's read: the stored rendered body, or null when the report\n *  has none (imported while its signed URL was expired, or predates rendering). */\nexport async function getReportHtml(\n  db: Db,\n  id: string,\n): Promise<{ html: string; reportId: string | null } | null> {\n  const r = await db\n    .selectFrom(\"reports\")\n    .select([\"rendered_html\", \"report_id\"])\n    .where(\"id\", \"=\", id)\n    .executeTakeFirst();\n  if (!r || r.rendered_html === null) return null;\n  return { html: r.rendered_html, reportId: r.report_id };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,SAAS,WAA6C;AAiCtD,IAAM,MAAM,CAAC,MAA+B,OAAO,MAAM,WAAW,IAAI;AACxE,IAAM,MAAM,CAAC,MAA+B,OAAO,MAAM,WAAW,IAAI;AAExE,IAAM,OAAO,CAAC,MAAgC,OAAO,MAAM,WAAW,MAAM,IAAI;AAGhF,SAAS,SAAS,KAAwB;AACxC,MAAI,OAAO,QAAQ,YAAY,IAAI,KAAK,MAAM,GAAI,QAAO,CAAC;AAC1D,MAAI;AACF,UAAM,SAAkB,KAAK,MAAM,GAAG;AACtC,QAAI,CAAC,MAAM,QAAQ,MAAM,EAAG,QAAO,CAAC;AACpC,WAAO,OACJ,OAAO,CAAC,MAAmB,OAAO,MAAM,QAAQ,EAChD,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,OAAO;AAAA,EACnB,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,SAAS,cAAc,GAA0B;AAC/C,QAAM,OAAO,OAAO,EAAE,QAAQ,EAAE;AAChC,QAAM,iBAAiB,IAAI,EAAE,qBAAqB;AAClD,QAAM,aAAa,IAAI,EAAE,iBAAiB;AAC1C,SAAO;AAAA,IACL,IAAI,OAAO,EAAE,EAAE;AAAA,IACf;AAAA,IACA,KAAK,IAAI,EAAE,GAAG,KAAK;AAAA;AAAA;AAAA;AAAA,IAInB,QAAQ,mBAAmB,EAAE,MAAM;AAAA,IACnC,WAAW,IAAI,EAAE,MAAM;AAAA,IACvB,gBAAgB,IAAI,EAAE,gBAAgB;AAAA,IACtC,iBAAiB,YAAY,EAAE,kBAAkB,GAAG,IAAI,cAAc;AAAA,IACtE,aAAa,YAAY,EAAE,cAAc,GAAG,IAAI,UAAU;AAAA,IAC1D,oBAAoB,IAAI,EAAE,gBAAgB;AAAA,IAC1C,gBAAgB,IAAI,EAAE,YAAY;AAAA,IAClC,gBAAgB,IAAI,EAAE,eAAe;AAAA,IACrC,YAAY,IAAI,EAAE,WAAW;AAAA,IAC7B,eAAe,IAAI,EAAE,eAAe;AAAA,IACpC,aAAa,IAAI,EAAE,YAAY;AAAA,IAC/B,uBAAuB,IAAI,EAAE,uBAAuB;AAAA,IACpD,qBAAqB,IAAI,EAAE,sBAAsB;AAAA,IACjD,SAAS,IAAI,EAAE,QAAQ;AAAA,IACvB,oBAAoB,IAAI,EAAE,oBAAoB;AAAA,IAC9C,oBAAoB,IAAI,EAAE,oBAAoB;AAAA,IAC9C,yBAAyB,SAAS,EAAE,yBAAyB;AAAA,IAC7D,aACE,mBAAmB,QAAQ,eAAe,OACtC,EAAE,KAAK,IAAI,UAAU,gBAAgB,MAAM,WAAW,IACtD;AAAA,IACN,QAAQ,IAAI,EAAE,OAAO;AAAA,IACrB,QAAQ,IAAI,EAAE,OAAO;AAAA,IACrB,SAAS,IAAI,EAAE,QAAQ;AAAA,IACvB,UAAU,IAAI,EAAE,SAAS;AAAA,IACzB,uBAAuB,IAAI,EAAE,aAAa;AAAA,IAC1C,gBAAgB,IAAI,EAAE,eAAe;AAAA,IACrC,aAAa,IAAI,EAAE,YAAY;AAAA,IAC/B,iBAAiB,IAAI,EAAE,iBAAiB;AAAA,IACxC,cAAc,IAAI,EAAE,aAAa;AAAA,IACjC,mBAAmB,IAAI,EAAE,mBAAmB;AAAA,IAC5C,uBAAuB,IAAI,EAAE,cAAc;AAAA,IAC3C,mBAAmB,IAAI,EAAE,UAAU;AAAA,IACnC,uBAAuB,IAAI,EAAE,cAAc;AAAA,IAC3C,kBAAkB,IAAI,EAAE,SAAS;AAAA,IACjC,yBAAyB,IAAI,EAAE,iBAAiB;AAAA,IAChD,qBAAqB,IAAI,EAAE,iBAAiB;AAAA,IAC5C,oBAAoB,wBAAwB,EAAE,mBAAmB;AAAA,IACjE,mBAAmB,IAAI,EAAE,mBAAmB;AAAA,IAC5C,iBAAiB,IAAI,EAAE,iBAAiB;AAAA,IACxC,WAAW,WAAW,EAAE,UAAU;AAAA,IAClC,cAAc,IAAI,EAAE,aAAa;AAAA,IACjC,cAAc,IAAI,EAAE,cAAc;AAAA,IAClC,cAAc,IAAI,EAAE,cAAc;AAAA,IAClC,iBAAiB,IAAI,EAAE,iBAAiB;AAAA,IACxC,gBAAgB,UAAU,EAAE,eAAe;AAAA,IAC3C,cAAc,UAAU,EAAE,aAAa;AAAA,IACvC,iBAAiB,UAAU,EAAE,gBAAgB;AAAA,IAC7C,yBAAyB,IAAI,EAAE,0BAA0B;AAAA,IACzD,gBAAgB,KAAK,EAAE,eAAe;AAAA,IACtC,UAAU,KAAK,EAAE,SAAS;AAAA,IAC1B,SAAS,KAAK,EAAE,QAAQ;AAAA,IACxB,aAAa,IAAI,EAAE,YAAY;AAAA,IAC/B,kBAAkB,IAAI,EAAE,kBAAkB;AAAA,IAC1C,aAAa,UAAU,EAAE,gBAAgB;AAAA,IACzC,aAAa,UAAU,EAAE,cAAc;AAAA,IACvC,WAAW,WAAW,EAAE,UAAU;AAAA,IAClC,aAAa,WAAW,EAAE,YAAY;AAAA,IACtC,YAAY,WAAW,EAAE,WAAW;AAAA,IACpC,YAAY,IAAI,EAAE,WAAW;AAAA,IAC7B,mBAAmB,WAAW,EAAE,kBAAkB;AAAA,IAClD,eAAe,mBAAmB,EAAE,cAAc;AAAA,IAClD,kBAAkB,WAAW,EAAE,cAAc;AAAA,IAC7C,iBAAiB,WAAW,EAAE,iBAAiB;AAAA,IAC/C,qBAAqB,WAAW,EAAE,qBAAqB;AAAA,IACvD,kBAAkB,OAAO,EAAE,sBAAsB,WAAW,EAAE,sBAAsB,IAAI;AAAA,IACxF,oBAAoB,IAAI,EAAE,oBAAoB;AAAA,IAC9C,iBAAiB,IAAI,EAAE,iBAAiB;AAAA,IACxC,cAAc,IAAI,EAAE,cAAc;AAAA,IAClC,iBAAiB,IAAI,EAAE,iBAAiB;AAAA,IACxC,SAAS,UAAU,EAAE,QAAQ;AAAA,IAC7B,aAAa,IAAI,EAAE,aAAa;AAAA,IAChC,WAAW,UAAU,EAAE,WAAW;AAAA,IAClC,kBAAkB,IAAI,EAAE,mBAAmB;AAAA,IAC3C,eAAe,uBAAuB,EAAE,cAAc;AAAA,IACtD,wBAAwB,IAAI,EAAE,yBAAyB;AAAA,IACvD,oBAAoB,IAAI,EAAE,oBAAoB;AAAA,IAC9C,iBAAiB,IAAI,EAAE,iBAAiB;AAAA,IACxC,mBAAmB,IAAI,EAAE,mBAAmB;AAAA,IAC5C,eAAe,IAAI,EAAE,eAAe;AAAA,EACtC;AACF;AAQA,IAAM,eAAe;AAAA,EACnB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAKA,SAAS,OAAO,IAAQ;AACtB,SAAO,GACJ,WAAW,OAAO,EAClB,SAAS,eAAe,uBAAuB,UAAU,EACzD,SAAS,iBAAiB,yBAAyB,UAAU,EAC7D,OAAO,YAAY,EACnB,UAAU,CAAC,eAAe,eAAe,CAAC;AAC/C;AAgBA,eAAsB,gBACpB,IACA,QACA,gBACA,OACe;AACf,QAAM,iBAAiB,IAAI,QAAQ,EAAE,CAAC,cAAc,GAAG,MAAM,CAAC;AAChE;AAcA,eAAsB,iBACpB,IACA,QACA,QACkB;AAClB,QAAM,QAAgD,CAAC;AACvD,aAAW,CAAC,gBAAgB,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AAC5D,UAAM,MAAM,YAAY,cAAc;AACtC,QAAI,CAAC;AACH,YAAM,IAAI,MAAM,0DAA0D,cAAc,GAAG;AAG7F,UAAM,GAAG,IAAI,aAAa,KAAK,KAAK;AAAA,EACtC;AACA,MAAI,OAAO,KAAK,KAAK,EAAE,WAAW,EAAG,QAAO;AAC5C,QAAM,MAAM,MAAM,GACf,YAAY,OAAO,EACnB,IAAI,KAA+B,EACnC,MAAM,MAAM,KAAK,MAAM,EACvB,iBAAiB;AAEpB,SAAO,IAAI,iBAAiB;AAC9B;AAwBA,eAAsB,iBAAiB,IAAQ,KAAgB,YAAmC;AAChG,QAAM,EAAE,MAAM,QAAQ,SAAS,IAAI,iBAAiB,KAAK,UAAU;AACnE,QAAM,GACH,WAAW,OAAO,EAClB,OAAO,IAAI,EACX,WAAW,CAAC,OAAO,GAAG,OAAO,IAAI,EAAE,YAAY,IAAI,CAAC,EACpD,QAAQ;AACX,QAAM,GACH,WAAW,aAAa,EACxB,OAAO,MAAM,EACb,WAAW,CAAC,OAAO,GAAG,OAAO,SAAS,EAAE,YAAY,MAAM,CAAC,EAC3D,QAAQ;AACX,QAAM,GACH,WAAW,eAAe,EAC1B,OAAO,QAAQ,EACf,WAAW,CAAC,OAAO,GAAG,OAAO,SAAS,EAAE,YAAY,QAAQ,CAAC,EAC7D,QAAQ;AACb;AAeA,eAAsB,mBACpB,IACA,QACA,QACkB;AAIlB,QAAM,QAAgD,CAAC;AACvD,aAAW,CAAC,OAAO,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACnD,UAAM,IAAI,gBAAgB,KAAK;AAC/B,QAAI,CAAC;AACH,YAAM,IAAI,MAAM,kEAAkE,KAAK,GAAG;AAC5F,UAAM,EAAE,GAAG,IAAI,EAAE,OAAO,KAAK;AAAA,EAC/B;AACA,MAAI,OAAO,KAAK,KAAK,EAAE,WAAW,EAAG,QAAO;AAC5C,QAAM,MAAM,MAAM,GACf,YAAY,aAAa,EACzB,IAAI,KAAoC,EACxC,MAAM,WAAW,KAAK,MAAM,EAC5B,iBAAiB;AAEpB,SAAO,IAAI,iBAAiB;AAC9B;AASA,eAAsB,qBACpB,IACA,QACA,QACA,YACkB;AAClB,QAAM,QAAuC,CAAC;AAC9C,aAAW,CAAC,OAAO,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACnD,UAAM,IAAI,kBAAkB,KAAK;AACjC,QAAI,CAAC;AACH,YAAM,IAAI;AAAA,QACR,sEAAsE,KAAK;AAAA,MAC7E;AACF,UAAM,EAAE,GAAG,IAAI,EAAE,OAAO,KAAK;AAAA,EAC/B;AACA,MAAI,OAAO,KAAK,KAAK,EAAE,WAAW,EAAG,QAAO;AAC5C,QAAM,cAAc;AACpB,QAAM,MAAM,MAAM,GACf,YAAY,eAAe,EAC3B,IAAI,KAAsC,EAC1C,MAAM,WAAW,KAAK,MAAM,EAC5B,iBAAiB;AACpB,SAAO,IAAI,iBAAiB;AAC9B;AAIA,eAAsB,cAAc,IAAQ,MAA0C;AACpF,QAAM,IAAI,MAAM,OAAO,EAAE,EAAE,MAAM,cAAc,KAAK,IAAI,EAAE,iBAAiB;AAC3E,SAAO,IAAI,cAAc,CAAc,IAAI;AAC7C;AAQA,eAAsB,cAAc,IAAQ,QAAkC;AAC5E,QAAM,IAAI,MAAM,GAAG,WAAW,OAAO,EAAE,OAAO,IAAI,EAAE,MAAM,MAAM,KAAK,MAAM,EAAE,iBAAiB;AAC9F,SAAO,MAAM;AACf;AAGA,eAAsB,YAAY,IAAQ,IAAwC;AAChF,QAAM,IAAI,MAAM,OAAO,EAAE,EAAE,MAAM,YAAY,KAAK,EAAE,EAAE,iBAAiB;AACvE,SAAO,IAAI,cAAc,CAAc,IAAI;AAC7C;AAKA,eAAsB,UAAU,IAA+B;AAC7D,QAAM,OAAO,MAAM,OAAO,EAAE,EAAE,QAAQ,YAAY,EAAE,QAAQ;AAC5D,SAAO,KAAK,IAAI,CAAC,MAAM,cAAc,CAAc,CAAC;AACtD;AAOA,IAAM,yBAAsD,IAAI;AAAA,EAC9D,CAAC,GAAG,uBAAuB,GAAG,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC;AAC9E;AAEA,SAAS,oBAAoB,KAA6C;AACxE,MAAI,SAAkC,CAAC;AACvC,MAAI,OAAO,QAAQ,YAAY,IAAI,KAAK,MAAM,IAAI;AAChD,QAAI;AACF,YAAM,SAAkB,KAAK,MAAM,GAAG;AACtC,UAAI,UAAU,OAAO,WAAW,YAAY,CAAC,MAAM,QAAQ,MAAM;AAC/D,iBAAS;AAAA,IACb,QAAQ;AAAA,IAER;AAAA,EACF;AACA,QAAM,MAA+B,CAAC;AACtC,aAAW,CAAC,KAAK,KAAK,KAAK,uBAAwB,KAAI,KAAK,IAAI,QAAQ,OAAO,GAAG,CAAC;AACnF,SAAO;AACT;AASA,SAAS,gBACP,GACA,iBACW;AACX,QAAM,IAAI,EAAE;AACZ,QAAM,IAAI,EAAE;AACZ,QAAM,IAAI,EAAE;AACZ,QAAM,MAAM,EAAE;AACd,QAAM,aACJ,OAAO,MAAM,YACb,OAAO,MAAM,YACb,OAAO,MAAM,YACb,OAAO,QAAQ,WACX,EAAE,aAAa,GAAG,eAAe,GAAG,eAAe,GAAG,IAAI,IAC1D;AACN,SAAO;AAAA,IACL,IAAI,EAAE;AAAA,IACN,UAAU,EAAE,aAAa;AAAA,IACzB,QAAQ,EAAE,WAAW;AAAA,IACrB,YAAY,aAAa,EAAE,eAAe,MAAS;AAAA,IACnD,QAAQ,EAAE;AAAA,IACV,aAAa,EAAE;AAAA,IACf,WAAW,EAAE;AAAA,IACb,aAAa,EAAE;AAAA,IACf;AAAA,IACA,gBAAgB,EAAE;AAAA,IAClB,iBAAiB,EAAE;AAAA,IACnB,kBAAkB,KAAK,EAAE,kBAAkB;AAAA,IAC3C,gBAAgB,EAAE;AAAA,IAClB,gBAAgB,EAAE;AAAA,IAClB,YAAY,EAAE;AAAA,IACd,iBAAiB,EAAE;AAAA,IACnB,YAAY,EAAE,gBAAgB;AAAA,IAC9B,gBAAgB,EAAE,qBAAqB;AAAA,IACvC,QAAQ,EAAE;AAAA,IACV,YAAY,EAAE;AAAA,IACd,YAAY,EAAE;AAAA,IACd,gBAAiB,EAAE,mBAAmB;AAAA;AAAA;AAAA;AAAA,IAItC,wBAAwB,kBACpB,EAAE,KAAK,gBAAgB,EAAE,EAAE,YAAY,UAAU,GAAG,EAAE,aAAa,EAAE,EAAE,QAAQ,IAC/E;AAAA,IACJ,iBAAiB,EAAE;AAAA,IACnB,WAAW,oBAAoB,EAAE,SAAS;AAAA,IAC1C,cAAc,kBAAkB,EAAE,uBAAuB;AAAA,IACzD,cAAc,EAAE,kBAAkB;AAAA,IAClC,gBAAgB,EAAE;AAAA,IAClB,YAAY,EAAE;AAAA,IACd,YAAY,EAAE;AAAA,EAChB;AACF;AAQO,IAAM,sBAAsB;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAIA,IAAM,oBAAoB,iCAAyC,GAAG,mBAAmB;AAIzF,eAAsB,eAAe,IAA8B;AACjE,QAAM,OAAO,MAAM,GAChB,WAAW,SAAS,EACpB,OAAO,mBAAmB,EAC1B,OAAO,iBAAiB,EACxB,QAAQ,gBAAgB,MAAM,EAC9B,QAAQ,IAAI,EACZ,QAAQ;AACX,SAAO,KAAK,IAAI,CAAC,MAAM,gBAAgB,GAAG,EAAE,sBAAsB,CAAC,CAAC;AACtE;AAKA,eAAsB,mBAAmB,IAAQ,QAAsC;AACrF,QAAM,OAAO,MAAM,GAChB,WAAW,SAAS,EACpB,OAAO,mBAAmB,EAC1B,OAAO,iBAAiB,EACxB,MAAM,WAAW,KAAK,MAAM,EAC5B,QAAQ,gBAAgB,MAAM,EAC9B,QAAQ,IAAI,EACZ,QAAQ;AACX,SAAO,KAAK,IAAI,CAAC,MAAM,gBAAgB,GAAG,EAAE,sBAAsB,CAAC,CAAC;AACtE;AA+DA,eAAsB,kBACpB,IACA,UACA,OACkB;AAClB,MAAI,OAAO,KAAK,KAAK,EAAE,WAAW,EAAG,QAAO;AAC5C,QAAM,MAAM,MAAM,GACf,YAAY,SAAS,EACrB,IAAI,KAAK,EACT,MAAM,MAAM,KAAK,QAAQ,EACzB,iBAAiB;AAEpB,SAAO,IAAI,iBAAiB;AAC9B;AAgBA,eAAsB,mBAAmB,IAAQ,KAA+B;AAC9E,QAAM,MAAM,gBAAgB,KAAK,IAAI;AACrC,QAAM,EAAE,eAAe,KAAK,GAAG,YAAY,IAAI;AAC/C,OAAK;AACL,QAAM,GACH,WAAW,SAAS,EACpB,OAAO,GAAG,EACV,WAAW,CAAC,OAAO,GAAG,OAAO,IAAI,EAAE,YAAY,WAAW,CAAC,EAC3D,QAAQ;AACb;AAcA,eAAsB,kBAAkB,IAAQ,UAAkB,MAA6B;AAC7F,QAAM,GAAG,YAAY,SAAS,EAAE,IAAI,EAAE,eAAe,KAAK,CAAC,EAAE,MAAM,MAAM,KAAK,QAAQ,EAAE,QAAQ;AAClG;AAGA,eAAsB,cAAc,IAAQ,IAAuC;AACjF,QAAM,IAAI,MAAM,GAAG,WAAW,SAAS,EAAE,UAAU,EAAE,MAAM,MAAM,KAAK,EAAE,EAAE,iBAAiB;AAC3F,SAAO,IAAI,gBAAgB,GAAG,EAAE,kBAAkB,IAAI,IAAI;AAC5D;AAIA,eAAsB,cACpB,IACA,IAC2D;AAC3D,QAAM,IAAI,MAAM,GACb,WAAW,SAAS,EACpB,OAAO,CAAC,iBAAiB,WAAW,CAAC,EACrC,MAAM,MAAM,KAAK,EAAE,EACnB,iBAAiB;AACpB,MAAI,CAAC,KAAK,EAAE,kBAAkB,KAAM,QAAO;AAC3C,SAAO,EAAE,MAAM,EAAE,eAAe,UAAU,EAAE,UAAU;AACxD;","names":[]}

package/dist/{chunk-Z2K4JPQ3.js → chunk-H445EH33.js}

@@ -30,7 +30,7 @@ async function resolveSites(input) {
   }
   if (input.fleet === "airtable") {
     const { openBase, readAirtableConfig } = await import("./client-EPVO3FEH.js");
-    const { fromAirtableBase } = await import("./airtable-JGCPS7JH.js");
+    const { fromAirtableBase } = await import("./airtable-SJV4ZSMS.js");
     const base = openBase(readAirtableConfig());
     const provider = fromAirtableBase(base, input.workdir ? { workdir: input.workdir } : {});
     return provider();
@@ -61,4 +61,4 @@ async function resolveSites(input) {
 export {
   resolveSites
 };
-//# sourceMappingURL=chunk-Z2K4JPQ3.js.map
+//# sourceMappingURL=chunk-H445EH33.js.map

package/dist/chunk-IHHAYXKY.js

@@ -0,0 +1,351 @@
+import {
+  CLAUDE_MD_BLOCK,
+  CLAUDE_MD_MARKER,
+  GITIGNORE_BLOCK,
+  GITIGNORE_MARKER,
+  HARNESS_JSON_RELATIVE,
+  MATCH_HARNESS_COUPLED,
+  MATCH_HARNESS_FILES,
+  MATCH_HARNESS_PREVIOUS,
+  PRETTIERIGNORE_BLOCK,
+  PRETTIERIGNORE_MARKER
+} from "./chunk-Y6FCXRIC.js";
+import {
+  PRETTIER_FLAG_NOTE,
+  formatWithPrettier,
+  resolveTargetPrettier
+} from "./chunk-5CJVUPJU.js";
+import {
+  withRecipe
+} from "./chunk-SQ4FSNYL.js";
+import {
+  defaultSpawn
+} from "./chunk-LBYOLBW7.js";
+import {
+  ignoreRulesFor,
+  pathsMissingFromHead
+} from "./chunk-EASYCD6F.js";
+
+// src/recipes/match-harness/index.ts
+import { mkdir, readFile, rm, rmdir, writeFile } from "fs/promises";
+import { dirname, join } from "path";
+
+// src/recipes/match-harness/previous.ts
+var CLAUDE_MD_BLOCK_0_95_1 = `
+The \`matching-a-page\` skill governs a live-reference rebuild. These five rules
+exist because the skill alone did not hold on the project this harness came
+from \u2014 each one is a drift that actually happened, with the mechanical check
+that now catches it. \`matching/harness.json\` is this site's configuration;
+\`matching/LEDGER.md\` is the dated record of every deviation, floor and mask.
+
+### 1. Source prescribes, rects only verify
+
+Every geometry fix must cite the rule it came from: a line in the captured
+reference stylesheet under \`matching/spec/\`, or the reference's HTML. "The probe
+says the gap is 40px" is not a source. If you cannot name the line you are
+guessing \u2014 go read the stylesheet first.
+
+**Check:** the commit body must name the file:line for each fix.
+**Operator's challenge:** _"which line of the reference stylesheet says that?"_
+
+### 2. Phase 1 before Phase 4
+
+A page gets its section census and per-section spec in \`matching/SPEC.md\` BEFORE
+its geometry is touched. No SPEC section, no geometry round. The census is the
+coverage denominator; skipping it is how a reference's root-font ladder and its
+per-component height ladders get discovered reactively, after the region has
+already failed several rounds.
+
+**Check:** \`matching/gate.sh\` refuses to run a page with no \`SPEC.md\` section.
+**Operator's challenge:** _"show me the SPEC section for that region."_
+
+### 3. Three strikes, then stop
+
+A failing region that has not improved across 3+ gate runs does not get a fourth
+attempt. Present the attempts. Never widen the threshold, add a mask, or
+reclassify it as a floor to make it go away.
+
+**Check:** \`node matching/strikes.mjs <page>\` \u2014 exits 1 while any region is
+stalled, and is the first thing a geometry round runs.
+**Operator's challenge:** _"how many runs has that region been flat?"_
+
+### 4. A gate closes an item, nothing else
+
+No fix is "done" because the code changed. Paste the gate header \u2014 it is
+self-describing, so a nonstandard threshold or an undisclosed mask is visible.
+The threshold and the matrix are whatever \`matching/harness.json\` says, on every
+page, never a subset.
+
+**Operator's challenge:** _"paste the gate header."_
+
+### 5. A commit is a checkpoint, not a stopping point
+
+Do not hand control back between rounds. After committing, run
+\`node matching/next.mjs\`: while it exits 1 there is a named next action, and the
+round continues. Report when the backlog is empty, when a decision is genuinely
+the operator's (three strikes, a novel floor, a threshold change), or when
+asked \u2014 not because a commit felt like a natural place to summarise.
+
+This exists because the failure was habitual, not deliberate: a turn ends when
+user-facing prose gets written, and "I just committed something good" is the
+moment that invites writing it. The gate stops incorrect work; this stops
+premature stopping.
+
+**Pausing:** create \`matching/PAUSED\` holding a note that says what the pause
+means; \`next.mjs\` and \`strikes.mjs\` then exit 0 while it exists. This rule says
+"do not stop while work is named"; it never said "find work to name". An empty
+agenda and a paused one end the round the same way. Deleting the switch is the
+operator's call.
+
+**Check:** \`node matching/next.mjs\` \u2014 exits 1 while any non-floor region fails.
+**Operator's challenge:** _"what does next.mjs say?"_
+
+### Round protocol
+
+1. \`node matching/strikes.mjs <page>\` \u2014 if it exits 1, the stalled regions are
+   the agenda, and stalled ones get escalated rather than re-attempted.
+2. Confirm the page has a \`matching/SPEC.md\` section; write
+   \`matching/spec-sections/<page>.md\` and run \`node matching/build-spec.mjs\` if
+   not.
+3. Fix, each change citing its source line.
+4. \`bash matching/gate.sh <tag> <page>\` \u2014 paste the header.
+5. Append to \`matching/LEDGER.md\` at the moment a deviation, floor or mask is
+   decided, not reconstructed at the end.
+6. \`pnpm verify\`, then commit and push.
+`;
+var MATCH_HARNESS_BLOCK_PREVIOUS = {
+  "CLAUDE.md": [CLAUDE_MD_BLOCK_0_95_1]
+};
+
+// src/recipes/match-harness/index.ts
+var PRETTIER_TIMEOUT_MS = 6e4;
+async function readIfExists(path) {
+  try {
+    return await readFile(path, "utf-8");
+  } catch {
+    return null;
+  }
+}
+function normalize(s) {
+  return s.replace(/\r\n/g, "\n").replace(/[ \t]+$/gm, "").trim();
+}
+function planBlockWrite(existing, marker, endMarker, block, previous) {
+  const region = `${marker}
+${block}
+${endMarker}`;
+  if (existing === null) return { action: "write", content: `${region}
+` };
+  const start = existing.indexOf(marker);
+  if (start === -1) {
+    const base = existing.endsWith("\n") ? existing : `${existing}
+`;
+    return { action: "write", content: `${base}
+${region}
+` };
+  }
+  const head = existing.slice(0, start);
+  const bodyStart = start + marker.length + 1;
+  const endAt = existing.indexOf(endMarker, bodyStart);
+  if (endAt !== -1) {
+    const body = existing.slice(bodyStart, endAt);
+    if (normalize(body) === normalize(block)) return { action: "skip" };
+    if (previous.some((p) => normalize(body) === normalize(p)))
+      return {
+        action: "replace",
+        content: head + region + existing.slice(endAt + endMarker.length)
+      };
+    return { action: "flag" };
+  }
+  for (const candidate of [block, ...previous]) {
+    if (!existing.startsWith(candidate, bodyStart)) continue;
+    const content = `${head}${region}
+${existing.slice(bodyStart + candidate.length)}`;
+    return candidate === block ? { action: "terminate", content } : { action: "replace", content };
+  }
+  return { action: "flag" };
+}
+function commitMessage(installed, upgraded) {
+  const what = "(/dev/match route + matching/ gate scripts)";
+  if (upgraded.length === 0) return `feat: install the matching harness ${what}`;
+  const subject = installed.length > 0 ? `feat: install and upgrade the matching harness ${what}` : `chore: upgrade the matching harness (${upgraded.length} file${upgraded.length === 1 ? "" : "s"} from a previously shipped version)`;
+  const body = [
+    installed.length > 0 ? `installed: ${installed.join(", ")}` : "",
+    `upgraded from a previously shipped version: ${upgraded.join(", ")}`
+  ].filter(Boolean).join("\n");
+  return `${subject}
+
+${body}`;
+}
+function planFileWrite(existing, template, owner, previous) {
+  if (existing === null) return "write";
+  if (normalize(existing) === normalize(template)) return "skip";
+  if (owner === "site") return "skip";
+  if (previous.some((p) => normalize(existing) === normalize(p))) return "replace";
+  return "flag";
+}
+var GITIGNORE_END_MARKER = "# end reddoor-maint match-harness";
+var PRETTIERIGNORE_END_MARKER = "# end reddoor-maint match-harness";
+var CLAUDE_MD_END_MARKER = "<!-- end reddoor-maint match-harness -->";
+var APPENDED_BLOCKS = [
+  [".gitignore", GITIGNORE_MARKER, GITIGNORE_END_MARKER, GITIGNORE_BLOCK],
+  [".prettierignore", PRETTIERIGNORE_MARKER, PRETTIERIGNORE_END_MARKER, PRETTIERIGNORE_BLOCK],
+  ["CLAUDE.md", CLAUDE_MD_MARKER, CLAUDE_MD_END_MARKER, CLAUDE_MD_BLOCK]
+];
+var MATCH_HARNESS_INSTALLED_PATHS = [
+  ...MATCH_HARNESS_FILES.map((f) => f.rel),
+  ...APPENDED_BLOCKS.map(([rel]) => rel)
+];
+async function matchHarness(site, opts, deps = { spawn: defaultSpawn }) {
+  return withRecipe({
+    name: "match-harness",
+    site,
+    plan: async () => {
+      if (!opts.ref || !/^https?:\/\//.test(opts.ref)) {
+        return {
+          kind: "failed",
+          notes: "--ref <url> is required: the harness gates against a live reference, and a harness with no reference can only ever report an absence of errors"
+        };
+      }
+      return {
+        kind: "apply",
+        plan: {
+          ref: opts.ref.replace(/\/$/, ""),
+          cand: opts.cand ?? "http://localhost:5173",
+          matrix: opts.matrix ?? [1440, 834, 390]
+        }
+      };
+    },
+    apply: async (planned, { commit, cwd }) => {
+      const notes = [];
+      const written = [];
+      const installed = [];
+      const upgraded = [];
+      const before = /* @__PURE__ */ new Map();
+      const previousAll = deps.previous ?? MATCH_HARNESS_PREVIOUS;
+      const blockPreviousAll = deps.blockPrevious ?? MATCH_HARNESS_BLOCK_PREVIOUS;
+      const plans = [];
+      for (const f of MATCH_HARNESS_FILES) {
+        const target = join(cwd, f.rel);
+        let template = f.template;
+        if (f.rel === HARNESS_JSON_RELATIVE) {
+          const seed = JSON.parse(template);
+          seed.ref = planned.ref;
+          seed.cand = planned.cand;
+          seed.matrix = planned.matrix;
+          template = JSON.stringify(seed, null, 2) + "\n";
+        }
+        const existing = await readIfExists(target);
+        plans.push({
+          f,
+          template,
+          existing,
+          action: planFileWrite(existing, template, f.owner, previousAll[f.rel] ?? [])
+        });
+      }
+      const coupled = new Set(MATCH_HARNESS_COUPLED);
+      const blockedBy = plans.filter((p) => coupled.has(p.f.rel) && p.action === "flag").map((p) => p.f.rel);
+      const demoted = plans.filter(
+        (p) => coupled.has(p.f.rel) && p.action === "replace" && !blockedBy.includes(p.f.rel)
+      );
+      if (blockedBy.length > 0 && demoted.length > 0) {
+        for (const p of demoted) p.action = "flag";
+        notes.push(
+          `${blockedBy.join(", ")} differs from the shipped template, so the whole coupled set was left alone: ${MATCH_HARNESS_COUPLED.join(", ")} upgrade together. matching/gate.sh calls \`harness.mjs --check-run\` and matching/next.mjs imports from harness.mjs, so upgrading one without the others leaves a harness that cannot run.`
+        );
+      }
+      const demotedRels = new Set(demoted.map((p) => p.f.rel));
+      for (const { f, template, existing, action } of plans) {
+        if (action === "flag") {
+          if (demotedRels.has(f.rel)) continue;
+          notes.push(
+            `${f.rel} differs from the shipped template and was left alone (hand-edited?)`
+          );
+          continue;
+        }
+        if (action === "skip") continue;
+        const target = join(cwd, f.rel);
+        await mkdir(dirname(target), { recursive: true });
+        before.set(f.rel, existing);
+        await writeFile(target, template, "utf-8");
+        written.push(f.rel);
+        (action === "write" ? installed : upgraded).push(f.rel);
+        if (action === "replace") notes.push(`${f.rel} upgraded from a previous version`);
+      }
+      for (const [rel, marker, endMarker, block] of APPENDED_BLOCKS) {
+        const path = join(cwd, rel);
+        const existing = await readIfExists(path);
+        const plan = planBlockWrite(
+          existing,
+          marker,
+          endMarker,
+          block,
+          blockPreviousAll[rel] ?? []
+        );
+        if (plan.action === "skip") continue;
+        if (plan.action === "flag") {
+          notes.push(
+            `${rel} carries a match-harness block that differs from every block this recipe has shipped, and was left alone (hand-edited?)`
+          );
+          continue;
+        }
+        before.set(rel, existing);
+        await writeFile(path, plan.content, "utf-8");
+        written.push(rel);
+        (plan.action === "write" ? installed : upgraded).push(`${rel} (match-harness block)`);
+        if (plan.action === "replace")
+          notes.push(`${rel}'s match-harness block upgraded from a previous version`);
+        if (plan.action === "terminate")
+          notes.push(
+            `${rel}'s match-harness block region was terminated so a future version can update it`
+          );
+      }
+      const siteOwned = new Set(
+        MATCH_HARNESS_FILES.filter((f) => f.owner === "site").map((f) => f.rel)
+      );
+      const toFormat = written.filter((p) => siteOwned.has(p) || p === "CLAUDE.md");
+      if (toFormat.length > 0) {
+        const bin = await (deps.resolvePrettier ?? resolveTargetPrettier)(cwd);
+        if (bin === null) {
+          notes.push(PRETTIER_FLAG_NOTE);
+        } else if (!await formatWithPrettier(deps.spawn, cwd, toFormat, {
+          bin,
+          timeoutMs: PRETTIER_TIMEOUT_MS
+        })) {
+          notes.push(PRETTIER_FLAG_NOTE);
+        }
+      }
+      await commit(commitMessage(installed, upgraded));
+      const missing = await pathsMissingFromHead(cwd, MATCH_HARNESS_INSTALLED_PATHS);
+      if (missing.length > 0) {
+        const rules = await ignoreRulesFor(cwd, missing);
+        const sources = [...new Set(rules.map((r) => r.split("	")[0]))];
+        const explained = new Set(rules.map((r) => r.split("	")[1] ?? ""));
+        const unexplained = missing.filter((p) => !explained.has(p));
+        const removed = [];
+        for (const rel of written.filter((p) => missing.includes(p))) {
+          const prev = before.get(rel);
+          if (prev === void 0) continue;
+          if (prev === null) {
+            await rm(join(cwd, rel), { force: true });
+            removed.push(rel);
+          } else {
+            await writeFile(join(cwd, rel), prev, "utf-8");
+          }
+        }
+        for (const d of [...new Set(removed.map(dirname))].sort((a, b) => b.length - a.length)) {
+          if (d !== ".") await rmdir(join(cwd, d)).catch(() => void 0);
+        }
+        return {
+          kind: "failed",
+          notes: `the harness was NOT installed: ${missing.length} of ${MATCH_HARNESS_INSTALLED_PATHS.length} paths git refused to track, so a fresh clone, CI and the next agent get a harness that does not exist. Absent from the commit: ${missing.join(", ")}. ` + (sources.length > 0 ? `Excluded by ${sources.join(", ")} \u2014 narrow or remove those rules and re-run. ` : "") + (unexplained.length > 0 ? `No ignore rule matched ${unexplained.join(", ")} \u2014 check .git/info/exclude, core.excludesFile, and whether the directory is a nested repository. ` : "") + "Everything this run wrote to those paths has been put back as it was."
+        };
+      }
+      return notes.length > 0 ? { kind: "ok", notes: notes.join("; ") } : { kind: "ok" };
+    }
+  });
+}
+
+export {
+  matchHarness
+};
+//# sourceMappingURL=chunk-IHHAYXKY.js.map

package/dist/chunk-IHHAYXKY.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/recipes/match-harness/index.ts","../src/recipes/match-harness/previous.ts"],"sourcesContent":["import { mkdir, readFile, rm, rmdir, writeFile } from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\nimport type { RecipeResult, Site } from \"../../types.js\";\nimport { withRecipe } from \"../_with-recipe.js\";\nimport { ignoreRulesFor, pathsMissingFromHead } from \"../../util/git.js\";\nimport { defaultSpawn, type SpawnFn } from \"../../audits/util/spawn.js\";\nimport { formatWithPrettier, resolveTargetPrettier, PRETTIER_FLAG_NOTE } from \"../_prettier.js\";\nimport {\n  MATCH_HARNESS_FILES,\n  MATCH_HARNESS_PREVIOUS,\n  MATCH_HARNESS_COUPLED,\n  HARNESS_JSON_RELATIVE,\n  GITIGNORE_MARKER,\n  GITIGNORE_BLOCK,\n  PRETTIERIGNORE_MARKER,\n  PRETTIERIGNORE_BLOCK,\n  CLAUDE_MD_MARKER,\n  CLAUDE_MD_BLOCK,\n} from \"./template.js\";\nimport { MATCH_HARNESS_BLOCK_PREVIOUS } from \"./previous.js\";\n\n/** How long the target's own prettier gets. Also what makes the fleet's default\n *  spawn detach the child, so the kill reaches prettier and not just a wrapper.\n *  Same budget as `prismic-ci` and the Prismic pull-down path. */\nconst PRETTIER_TIMEOUT_MS = 60_000;\n\nexport type MatchHarnessOptions = {\n  /** The live reference URL the harness gates against. Required — a harness\n   *  with no reference cannot produce evidence, only an absence of errors. */\n  ref: string;\n  /** Candidate origin. Defaults to the SvelteKit dev server. */\n  cand?: string;\n  /** Breakpoint matrix. Defaults to the fleet's 1440 / 834 / 390. */\n  matrix?: number[];\n};\n\nexport type MatchHarnessDeps = {\n  spawn: SpawnFn;\n  /** Previously shipped renders per relative path; injectable so the\n   *  safe-replace path is testable before a second version exists. */\n  previous?: Readonly<Record<string, readonly string[]>>;\n  /** Previously shipped BLOCK bodies per target file; injectable for the same\n   *  reason, and empty in the shipped table until a body is superseded. */\n  blockPrevious?: Readonly<Record<string, readonly string[]>>;\n  /** Resolve the TARGET repo's own prettier. Injected so a test can assert the\n   *  absolute-path spawn without a populated `node_modules`. */\n  resolvePrettier?: (repoRoot: string) => Promise<string | null>;\n};\n\ntype Plan = { ref: string; cand: string; matrix: number[] };\n\nasync function readIfExists(path: string): Promise<string | null> {\n  try {\n    return await readFile(path, \"utf-8\");\n  } catch {\n    return null;\n  }\n}\n\n/** CRLF and trailing whitespace are the only differences a site's formatter is\n *  allowed to introduce before a file stops counting as \"ours\". */\nfunction normalize(s: string): string {\n  return s\n    .replace(/\\r\\n/g, \"\\n\")\n    .replace(/[ \\t]+$/gm, \"\")\n    .trim();\n}\n\n/** What to do with one marked block region. `flag` and `skip` never write.\n *  One member per action, so `content` narrows on the discriminant alone. */\nexport type BlockPlan =\n  | { action: \"write\"; content: string }\n  | { action: \"replace\"; content: string }\n  | { action: \"terminate\"; content: string }\n  | { action: \"skip\" }\n  | { action: \"flag\" };\n\n/**\n * Plan one marked block region. The only append-to-existing-file idiom in this\n * repo is mergeGitignore, and it cannot express a negated whitelist\n * (`matching/*` then `!matching/*.sh`) as one unit: it compares entries by\n * normalized presence, so the ordering that makes the block work would be lost.\n * So the block is kept whole — and, being whole, it needs an END as well as a\n * start if it is ever to be CORRECTED rather than only appended.\n *\n * That was #739. The predecessor returned \"already done\" the instant the marker\n * was present, which is right for \"never append twice\" and wrong for everything\n * else: the block's CONTENTS could then never change on a site that had already\n * installed. On `.gitignore` that is not staleness but a brick — the block is a\n * negated whitelist, so a harness file at a path it does not re-include is\n * absent from the commit, `pathsMissingFromHead` refuses the install, and the\n * remedy (widen the whitelist) is the one edit that cannot land.\n *\n * Four states, and the third is the one that made this worth doing properly:\n *\n * - No marker: append the region, terminator included.\n * - Marker AND terminator: the extent is KNOWN. Body still current -> skip.\n *   Body byte-matches something we shipped before -> replace IN PLACE, keeping\n *   everything before and after the region. Anything else -> flag, write\n *   nothing.\n * - Marker, NO terminator — every site installed from 0.95.0: the extent is not\n *   known, so it is never guessed. A candidate qualifies only by matching\n *   EXACTLY, byte-for-byte, at the exact offset the body starts; what follows\n *   is the site's own and is preserved verbatim. Guessing end-of-file instead\n *   would eat whatever mergeGitignore appended after us.\n * - Anything unrecognised: flag. Anchoring is on the FIRST occurrence of the\n *   marker, so a marker quoted in the site's own prose mis-anchors into text\n *   that matches no candidate — which degrades to a flag, never to a write.\n */\nexport function planBlockWrite(\n  existing: string | null,\n  marker: string,\n  endMarker: string,\n  block: string,\n  previous: readonly string[],\n): BlockPlan {\n  const region = `${marker}\\n${block}\\n${endMarker}`;\n  if (existing === null) return { action: \"write\", content: `${region}\\n` };\n\n  const start = existing.indexOf(marker);\n  if (start === -1) {\n    const base = existing.endsWith(\"\\n\") ? existing : `${existing}\\n`;\n    return { action: \"write\", content: `${base}\\n${region}\\n` };\n  }\n\n  const head = existing.slice(0, start);\n  const bodyStart = start + marker.length + 1;\n\n  const endAt = existing.indexOf(endMarker, bodyStart);\n  if (endAt !== -1) {\n    const body = existing.slice(bodyStart, endAt);\n    if (normalize(body) === normalize(block)) return { action: \"skip\" };\n    if (previous.some((p) => normalize(body) === normalize(p)))\n      return {\n        action: \"replace\",\n        content: head + region + existing.slice(endAt + endMarker.length),\n      };\n    return { action: \"flag\" };\n  }\n\n  for (const candidate of [block, ...previous]) {\n    if (!existing.startsWith(candidate, bodyStart)) continue;\n    const content = `${head}${region}\\n${existing.slice(bodyStart + candidate.length)}`;\n    // Matching the CURRENT block means the bytes do not change at all and only\n    // the terminator is added — the migration write is content-neutral.\n    return candidate === block ? { action: \"terminate\", content } : { action: \"replace\", content };\n  }\n  return { action: \"flag\" };\n}\n\n/**\n * The commit message says what the run DID. Every run used to commit as\n * `feat: install …`, including one that installed nothing — measured on 29-navy:\n * three scripts upgraded, three block regions terminated, 6 files and 436\n * lines, labelled a first install (#760). The notes distinguished the two the\n * whole time; the message is what a reader bisecting `git log` sees.\n *\n * `write` anywhere is an install; only replace/terminate is an upgrade; both is\n * both. A pristine install keeps the historical one-line message byte-for-byte.\n * An upgrade names its paths in the body, so `git log` answers \"when did this\n * site's gate.sh change\" without a diff.\n */\nexport function commitMessage(installed: readonly string[], upgraded: readonly string[]): string {\n  const what = \"(/dev/match route + matching/ gate scripts)\";\n  if (upgraded.length === 0) return `feat: install the matching harness ${what}`;\n  const subject =\n    installed.length > 0\n      ? `feat: install and upgrade the matching harness ${what}`\n      : `chore: upgrade the matching harness (${upgraded.length} file${upgraded.length === 1 ? \"\" : \"s\"} from a previously shipped version)`;\n  const body = [\n    installed.length > 0 ? `installed: ${installed.join(\", \")}` : \"\",\n    `upgraded from a previously shipped version: ${upgraded.join(\", \")}`,\n  ]\n    .filter(Boolean)\n    .join(\"\\n\");\n  return `${subject}\\n\\n${body}`;\n}\n\n/** What to do with one installed file. `flag` never writes. */\nexport function planFileWrite(\n  existing: string | null,\n  template: string,\n  owner: \"recipe\" | \"site\",\n  previous: readonly string[],\n): \"write\" | \"replace\" | \"skip\" | \"flag\" {\n  if (existing === null) return \"write\";\n  if (normalize(existing) === normalize(template)) return \"skip\";\n  if (owner === \"site\") return \"skip\"; // records are never touched again\n  if (previous.some((p) => normalize(existing) === normalize(p))) return \"replace\";\n  return \"flag\";\n}\n\n/**\n * Where each block region ENDS. Deliberately NOT in template.ts beside the\n * start markers, and the split is a real smell being paid for on purpose:\n * template.ts is GENERATED, and regenerating it today drags in undeclared drift\n * from the source site and would flag three already-installed scripts forever.\n * Reuniting them belongs to #753, which makes the generator's\n * `MATCH_HARNESS_PREVIOUS` emission trustworthy enough to regenerate against.\n * That table stays in template.ts and stays POPULATED in the meantime: it is\n * what upgrades an installed site's gate.sh past #744, so pointing this recipe\n * at an empty one un-ships that fix to every site already carrying the v1 gate.\n *\n * None of the three contains its own start marker as a substring — `# end\n * reddoor-maint …` never yields `# reddoor-maint …` — which is what keeps\n * `indexOf(marker)` from anchoring the region on its own terminator. A test\n * asserts it in both directions.\n */\nexport const GITIGNORE_END_MARKER = \"# end reddoor-maint match-harness\";\nexport const PRETTIERIGNORE_END_MARKER = \"# end reddoor-maint match-harness\";\nexport const CLAUDE_MD_END_MARKER = \"<!-- end reddoor-maint match-harness -->\";\n\n/** The three files the recipe APPENDS a marked block to rather than writing whole. */\nconst APPENDED_BLOCKS = [\n  [\".gitignore\", GITIGNORE_MARKER, GITIGNORE_END_MARKER, GITIGNORE_BLOCK],\n  [\".prettierignore\", PRETTIERIGNORE_MARKER, PRETTIERIGNORE_END_MARKER, PRETTIERIGNORE_BLOCK],\n  [\"CLAUDE.md\", CLAUDE_MD_MARKER, CLAUDE_MD_END_MARKER, CLAUDE_MD_BLOCK],\n] as const;\n\n/**\n * Every path the installed harness requires to be IN THE COMMIT — deliberately\n * the whole manifest, NOT the paths written on this run. A re-run skips every\n * file already byte-correct on disk, so a check over the written delta would\n * find nothing missing and report a second hollow \"applied\" over the same\n * half-install.\n */\nexport const MATCH_HARNESS_INSTALLED_PATHS: readonly string[] = [\n  ...MATCH_HARNESS_FILES.map((f) => f.rel),\n  ...APPENDED_BLOCKS.map(([rel]) => rel),\n];\n\n/**\n * Installs the matching harness into a site: the dev-guarded `/dev/match/[uid]`\n * route, a `site-pages.js` scaffold and its fixture-vs-model test,\n * `matching/harness.json` + the read layer, the round scripts, the site records,\n * and the `.gitignore` / `.prettierignore` / `CLAUDE.md` blocks.\n *\n * Install-if-absent throughout. Files a site edits are never rewritten. A\n * recipe-owned script that matches a previously shipped render is safe-replaced;\n * one that has been hand-edited is FLAGGED in the notes and left alone.\n *\n * ONE EXCEPTION TO PER-FILE INDEPENDENCE: the scripts in MATCH_HARNESS_COUPLED\n * upgrade as a SET. If any one of them is hand-edited, none of them is written,\n * because gate.sh calls `harness.mjs --check-run` and next.mjs imports from\n * harness.mjs — upgrading the others around a pinned one leaves a harness that\n * cannot run at all. See the measurement on MATCH_HARNESS_COUPLED.\n */\nexport async function matchHarness(\n  site: Site,\n  opts: MatchHarnessOptions,\n  deps: MatchHarnessDeps = { spawn: defaultSpawn },\n): Promise<RecipeResult> {\n  return withRecipe<Plan>({\n    name: \"match-harness\",\n    site,\n    plan: async () => {\n      if (!opts.ref || !/^https?:\\/\\//.test(opts.ref)) {\n        return {\n          kind: \"failed\",\n          notes:\n            \"--ref <url> is required: the harness gates against a live reference, and a harness with no reference can only ever report an absence of errors\",\n        };\n      }\n      return {\n        kind: \"apply\",\n        plan: {\n          ref: opts.ref.replace(/\\/$/, \"\"),\n          cand: opts.cand ?? \"http://localhost:5173\",\n          matrix: opts.matrix ?? [1440, 834, 390],\n        },\n      };\n    },\n    apply: async (planned, { commit, cwd }) => {\n      const notes: string[] = [];\n      const written: string[] = [];\n      /** What this run did, for the commit message: paths written for the\n       *  FIRST time, and paths replaced or terminated from a previously shipped\n       *  render. The notes already tell them apart; the message is what\n       *  survives into `git log` (#760). */\n      const installed: string[] = [];\n      const upgraded: string[] = [];\n      /** For every path this run writes: what was there BEFORE (null = the file\n       *  did not exist). The refusal below restores from this, so a refused run\n       *  leaves the checkout byte-identical to how it found it. */\n      const before = new Map<string, string | null>();\n      const previousAll = deps.previous ?? MATCH_HARNESS_PREVIOUS;\n      const blockPreviousAll = deps.blockPrevious ?? MATCH_HARNESS_BLOCK_PREVIOUS;\n\n      // PASS 1 — decide everything, write nothing. The coupled-set demotion\n      // below needs the whole picture before the first byte is written.\n      type Planned = {\n        f: (typeof MATCH_HARNESS_FILES)[number];\n        template: string;\n        existing: string | null;\n        action: ReturnType<typeof planFileWrite>;\n      };\n      const plans: Planned[] = [];\n      for (const f of MATCH_HARNESS_FILES) {\n        const target = join(cwd, f.rel);\n        let template = f.template;\n        if (f.rel === HARNESS_JSON_RELATIVE) {\n          // Patch the PARSED object, never the text. The seed is pretty-printed\n          // two-space JSON, so `matrix` renders as a four-line exploded array\n          // and the literal \"[1440, 834, 390]\" does not occur — a string\n          // replace on it is a no-op that drops --matrix with no error.\n          const seed = JSON.parse(template) as Record<string, unknown>;\n          seed.ref = planned.ref;\n          seed.cand = planned.cand;\n          seed.matrix = planned.matrix;\n          template = JSON.stringify(seed, null, 2) + \"\\n\";\n        }\n        const existing = await readIfExists(target);\n        plans.push({\n          f,\n          template,\n          existing,\n          action: planFileWrite(existing, template, f.owner, previousAll[f.rel] ?? []),\n        });\n      }\n\n      // The coupled set moves together or not at all. Two deliberate limits,\n      // both of them the difference between a guard and an outage:\n      //\n      // ONLY `flag` demotes. `skip` means the file is already byte-correct, and\n      // treating that as a flag would make every re-run refuse itself and the\n      // recipe permanently inert — the demotion's own failure mode is\n      // OVER-refusal, so its test has to GRANT an upgrade, not merely deny one.\n      //\n      // ONLY `replace` is demoted. A file that is ABSENT cannot be \"left\n      // alone\": there is nothing to preserve, and skipping the write leaves the\n      // site with no harness at all rather than an old one. The hazard being\n      // guarded is upgrading HALF of an installed set past a pinned member;\n      // writing a missing file is the only action that makes the set exist.\n      // (Measured: demoting `write` too broke a fresh install alongside one\n      // hand-edited script — 16 files silently unwritten, then a failed run.)\n      const coupled = new Set(MATCH_HARNESS_COUPLED);\n      const blockedBy = plans\n        .filter((p) => coupled.has(p.f.rel) && p.action === \"flag\")\n        .map((p) => p.f.rel);\n      const demoted = plans.filter(\n        (p) => coupled.has(p.f.rel) && p.action === \"replace\" && !blockedBy.includes(p.f.rel),\n      );\n      if (blockedBy.length > 0 && demoted.length > 0) {\n        for (const p of demoted) p.action = \"flag\";\n        notes.push(\n          `${blockedBy.join(\", \")} differs from the shipped template, so the whole coupled set ` +\n            `was left alone: ${MATCH_HARNESS_COUPLED.join(\", \")} upgrade together. ` +\n            `matching/gate.sh calls \\`harness.mjs --check-run\\` and matching/next.mjs imports from ` +\n            `harness.mjs, so upgrading one without the others leaves a harness that cannot run.`,\n        );\n      }\n\n      // PASS 2 — write.\n      const demotedRels = new Set(demoted.map((p) => p.f.rel));\n      for (const { f, template, existing, action } of plans) {\n        if (action === \"flag\") {\n          if (demotedRels.has(f.rel)) continue; // named in the set note above\n          notes.push(\n            `${f.rel} differs from the shipped template and was left alone (hand-edited?)`,\n          );\n          continue;\n        }\n        if (action === \"skip\") continue;\n        const target = join(cwd, f.rel);\n        await mkdir(dirname(target), { recursive: true });\n        before.set(f.rel, existing);\n        await writeFile(target, template, \"utf-8\");\n        written.push(f.rel);\n        (action === \"write\" ? installed : upgraded).push(f.rel);\n        if (action === \"replace\") notes.push(`${f.rel} upgraded from a previous version`);\n      }\n\n      // Three appended blocks, each a delimited region that is replaced in\n      // place when its body is one this recipe shipped, and flagged — never\n      // overwritten — when it is anything else.\n      for (const [rel, marker, endMarker, block] of APPENDED_BLOCKS) {\n        const path = join(cwd, rel);\n        const existing = await readIfExists(path);\n        const plan = planBlockWrite(\n          existing,\n          marker,\n          endMarker,\n          block,\n          blockPreviousAll[rel] ?? [],\n        );\n        if (plan.action === \"skip\") continue;\n        if (plan.action === \"flag\") {\n          // Never enters `written`: not formatted, and not restored by the\n          // refusal path below, because this run did not touch it.\n          notes.push(\n            `${rel} carries a match-harness block that differs from every block this recipe has shipped, and was left alone (hand-edited?)`,\n          );\n          continue;\n        }\n        before.set(rel, existing);\n        await writeFile(path, plan.content, \"utf-8\");\n        written.push(rel);\n        (plan.action === \"write\" ? installed : upgraded).push(`${rel} (match-harness block)`);\n        if (plan.action === \"replace\")\n          notes.push(`${rel}'s match-harness block upgraded from a previous version`);\n        if (plan.action === \"terminate\")\n          notes.push(\n            `${rel}'s match-harness block region was terminated so a future version can update it`,\n          );\n      }\n\n      // Format only what the SITE owns, decided by OWNERSHIP and never by path.\n      // A recipe-owned file that a site's prettier reformats is indistinguishable\n      // from a hand edit on the next install, so planFileWrite flags it and the\n      // recipe can never upgrade it again. A path prefix cannot express that:\n      // three recipe-owned files live under src/. This is an ALLOW-list on\n      // purpose — a file added to MATCH_HARNESS_FILES is not formatted until its\n      // owner says \"site\", because the unsafe default is silent and permanent.\n      // The same files are in the .prettierignore block written above, which\n      // stops the site's OWN `prettier --write .` from doing the identical\n      // damage; that block and this filter must agree, and a test asserts it.\n      // CLAUDE.md is not in the file table — it is an append into a file the\n      // site owns — so it is named here.\n      const siteOwned = new Set(\n        MATCH_HARNESS_FILES.filter((f) => f.owner === \"site\").map((f) => f.rel),\n      );\n      const toFormat = written.filter((p) => siteOwned.has(p) || p === \"CLAUDE.md\");\n\n      // Run the SITE's own prettier, resolved POSITIVELY and invoked by absolute\n      // path. `pnpm exec prettier` here would first run a full, unbounded\n      // `pnpm install` in the client's checkout — which on `--fleet` is the\n      // NORMAL path, because `prepareFleetSites` clones and never installs — and\n      // would then, in a repo whose install left no prettier of its own, fall\n      // through to the CALLING repo's binary and exit 0, reporting success for a\n      // format the target never did. A `true` from here must mean the target's\n      // own prettier ran, so nothing about which binary runs is left to\n      // resolution.\n      if (toFormat.length > 0) {\n        const bin = await (deps.resolvePrettier ?? resolveTargetPrettier)(cwd);\n        if (bin === null) {\n          notes.push(PRETTIER_FLAG_NOTE);\n        } else if (\n          !(await formatWithPrettier(deps.spawn, cwd, toFormat, {\n            bin,\n            timeoutMs: PRETTIER_TIMEOUT_MS,\n          }))\n        ) {\n          notes.push(PRETTIER_FLAG_NOTE);\n        }\n      }\n\n      await commit(commitMessage(installed, upgraded));\n\n      // POSITIVE EVIDENCE that the install is real: every installed path is\n      // FOUND in HEAD's tree. `git add -A` honours the site's .gitignore and\n      // exits 0 either way, and git cannot re-include a file whose PARENT\n      // DIRECTORY is excluded — so a site that already ignores `matching/`\n      // (or `**/matching/`, `/matching`, `src/lib/site-pages.js`, …) gets the\n      // files on disk, nothing in the commit, and — before this check — a\n      // result of \"applied\", plus 83 lines of CLAUDE.md rules naming scripts\n      // that exist on no other machine.\n      const missing = await pathsMissingFromHead(cwd, MATCH_HARNESS_INSTALLED_PATHS);\n      if (missing.length > 0) {\n        const rules = await ignoreRulesFor(cwd, missing);\n        const sources = [...new Set(rules.map((r) => r.split(\"\\t\")[0]!))];\n        const explained = new Set(rules.map((r) => r.split(\"\\t\")[1] ?? \"\"));\n        const unexplained = missing.filter((p) => !explained.has(p));\n\n        // Put the checkout back exactly as we found it. Only paths THIS RUN\n        // wrote and git then refused are touched: one that reached the commit\n        // is left to withRecipe's force-checkout, and one we never wrote is\n        // never ours. `git checkout -f` cannot do this job — these paths are\n        // ignored, so git does not know they exist.\n        const removed: string[] = [];\n        for (const rel of written.filter((p) => missing.includes(p))) {\n          const prev = before.get(rel);\n          if (prev === undefined) continue;\n          if (prev === null) {\n            await rm(join(cwd, rel), { force: true });\n            removed.push(rel);\n          } else {\n            await writeFile(join(cwd, rel), prev, \"utf-8\");\n          }\n        }\n        // Deepest-first, so `matching/spec-sections` goes before `matching`.\n        // rmdir refuses a non-empty directory, which is exactly the guard wanted.\n        for (const d of [...new Set(removed.map(dirname))].sort((a, b) => b.length - a.length)) {\n          if (d !== \".\") await rmdir(join(cwd, d)).catch(() => undefined);\n        }\n\n        return {\n          kind: \"failed\",\n          notes:\n            `the harness was NOT installed: ${missing.length} of ${MATCH_HARNESS_INSTALLED_PATHS.length} paths git refused to track, so a fresh clone, CI and the next agent get a harness that does not exist. ` +\n            `Absent from the commit: ${missing.join(\", \")}. ` +\n            (sources.length > 0\n              ? `Excluded by ${sources.join(\", \")} — narrow or remove those rules and re-run. `\n              : \"\") +\n            (unexplained.length > 0\n              ? `No ignore rule matched ${unexplained.join(\", \")} — check .git/info/exclude, core.excludesFile, and whether the directory is a nested repository. `\n              : \"\") +\n            \"Everything this run wrote to those paths has been put back as it was.\",\n        };\n      }\n\n      return notes.length > 0 ? { kind: \"ok\", notes: notes.join(\"; \") } : { kind: \"ok\" };\n    },\n  });\n}\n","/**\n * Block BODIES this recipe has previously shipped — the block half of what lets\n * it tell \"stale, but ours\" from \"hand-edited by the site\". `planBlockWrite`\n * flags every region it cannot recognise, so without a record of what was\n * shipped, install-once is install-forever for the three marked regions.\n *\n * The whole-FILE table is NOT here. It lives in the generated `template.ts` as\n * `MATCH_HARNESS_PREVIOUS`, it is POPULATED, and it is what upgrades an\n * installed site's `matching/gate.sh` to the one that stopped saying ALL DONE\n * over failed runs (#744). Re-pointing that import at an empty table here would\n * silently un-ship that fix to every site already carrying the v1 gate — which\n * is exactly what this file did on its first draft, and what\n * `tests/recipes/match-harness.test.ts`'s \"UPGRADES a site running the shipped\n * v1 gate.sh rather than flagging it\" caught. The deprecation note and the\n * import switch were written together; the data migration they both depend on\n * is #753, and had not happened. Whatever replaces the generated table has to\n * carry the bodies across in the same commit that moves the import.\n *\n * Two rules for what goes below, and they are why this table is HAND-AUTHORED:\n *\n * 1. An entry is added ONLY when a block body has been SUPERSEDED — at the\n *    moment the shipped body changes, in the same commit that changes it.\n *    Recording a body that is still current makes the table lie in the one\n *    direction that matters: it would let a stale render be replaced by itself.\n *\n * 2. A body's source is a PUBLISHED GIT TAG — `git show v0.95.0:<path>` — never\n *    the working tree. Reading the tree is how a mutant gets banked as a\n *    legitimate prior release: mutate, regenerate, revert, and the mutation is\n *    now a body this recipe will happily install over a real site. Measured on\n *    this branch: one mutate/regenerate/revert cycle added 693 lines and two\n *    copies of the same predicate.\n *\n * EMPTY at 0.95.1 on purpose. 0.95.1 changes no block body at all: its whole\n * job is to install the region terminators, which is what makes the first\n * exercise of the block replace path provably content-neutral.\n *\n * First entry after 0.95.1: the CLAUDE.md block, superseded when rule 4 and the\n * round protocol gained `census.sh` (#736). Sourced from `git show v0.95.1`,\n * per rule 2, and identical at v0.95.0.\n */\n\n/** The CLAUDE.md block as shipped at v0.95.0 and v0.95.1 — `git show\n *  v0.95.1:src/recipes/match-harness/template.ts` → `CLAUDE_MD_BLOCK`, byte-\n *  identical at both tags. Superseded by the block that names `census.sh`\n *  (#736): the recipe installed the Phase 3 style gate and the rules that would\n *  make anyone run it did not mention it. Exported so a test can seed exactly\n *  this body and prove the shipped table upgrades it. */\nexport const CLAUDE_MD_BLOCK_0_95_1 = `\nThe \\`matching-a-page\\` skill governs a live-reference rebuild. These five rules\nexist because the skill alone did not hold on the project this harness came\nfrom — each one is a drift that actually happened, with the mechanical check\nthat now catches it. \\`matching/harness.json\\` is this site's configuration;\n\\`matching/LEDGER.md\\` is the dated record of every deviation, floor and mask.\n\n### 1. Source prescribes, rects only verify\n\nEvery geometry fix must cite the rule it came from: a line in the captured\nreference stylesheet under \\`matching/spec/\\`, or the reference's HTML. \"The probe\nsays the gap is 40px\" is not a source. If you cannot name the line you are\nguessing — go read the stylesheet first.\n\n**Check:** the commit body must name the file:line for each fix.\n**Operator's challenge:** _\"which line of the reference stylesheet says that?\"_\n\n### 2. Phase 1 before Phase 4\n\nA page gets its section census and per-section spec in \\`matching/SPEC.md\\` BEFORE\nits geometry is touched. No SPEC section, no geometry round. The census is the\ncoverage denominator; skipping it is how a reference's root-font ladder and its\nper-component height ladders get discovered reactively, after the region has\nalready failed several rounds.\n\n**Check:** \\`matching/gate.sh\\` refuses to run a page with no \\`SPEC.md\\` section.\n**Operator's challenge:** _\"show me the SPEC section for that region.\"_\n\n### 3. Three strikes, then stop\n\nA failing region that has not improved across 3+ gate runs does not get a fourth\nattempt. Present the attempts. Never widen the threshold, add a mask, or\nreclassify it as a floor to make it go away.\n\n**Check:** \\`node matching/strikes.mjs <page>\\` — exits 1 while any region is\nstalled, and is the first thing a geometry round runs.\n**Operator's challenge:** _\"how many runs has that region been flat?\"_\n\n### 4. A gate closes an item, nothing else\n\nNo fix is \"done\" because the code changed. Paste the gate header — it is\nself-describing, so a nonstandard threshold or an undisclosed mask is visible.\nThe threshold and the matrix are whatever \\`matching/harness.json\\` says, on every\npage, never a subset.\n\n**Operator's challenge:** _\"paste the gate header.\"_\n\n### 5. A commit is a checkpoint, not a stopping point\n\nDo not hand control back between rounds. After committing, run\n\\`node matching/next.mjs\\`: while it exits 1 there is a named next action, and the\nround continues. Report when the backlog is empty, when a decision is genuinely\nthe operator's (three strikes, a novel floor, a threshold change), or when\nasked — not because a commit felt like a natural place to summarise.\n\nThis exists because the failure was habitual, not deliberate: a turn ends when\nuser-facing prose gets written, and \"I just committed something good\" is the\nmoment that invites writing it. The gate stops incorrect work; this stops\npremature stopping.\n\n**Pausing:** create \\`matching/PAUSED\\` holding a note that says what the pause\nmeans; \\`next.mjs\\` and \\`strikes.mjs\\` then exit 0 while it exists. This rule says\n\"do not stop while work is named\"; it never said \"find work to name\". An empty\nagenda and a paused one end the round the same way. Deleting the switch is the\noperator's call.\n\n**Check:** \\`node matching/next.mjs\\` — exits 1 while any non-floor region fails.\n**Operator's challenge:** _\"what does next.mjs say?\"_\n\n### Round protocol\n\n1. \\`node matching/strikes.mjs <page>\\` — if it exits 1, the stalled regions are\n   the agenda, and stalled ones get escalated rather than re-attempted.\n2. Confirm the page has a \\`matching/SPEC.md\\` section; write\n   \\`matching/spec-sections/<page>.md\\` and run \\`node matching/build-spec.mjs\\` if\n   not.\n3. Fix, each change citing its source line.\n4. \\`bash matching/gate.sh <tag> <page>\\` — paste the header.\n5. Append to \\`matching/LEDGER.md\\` at the moment a deviation, floor or mask is\n   decided, not reconstructed at the end.\n6. \\`pnpm verify\\`, then commit and push.\n`;\n\n/** Block BODIES previously shipped per target file, for the three marked\n *  regions in `.gitignore`, `.prettierignore` and `CLAUDE.md`. */\nexport const MATCH_HARNESS_BLOCK_PREVIOUS: Readonly<Record<string, readonly string[]>> = {\n  \"CLAUDE.md\": [CLAUDE_MD_BLOCK_0_95_1],\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,OAAO,UAAU,IAAI,OAAO,iBAAiB;AACtD,SAAS,SAAS,YAAY;;;AC8CvB,IAAM,yBAAyB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAqF/B,IAAM,+BAA4E;AAAA,EACvF,aAAa,CAAC,sBAAsB;AACtC;;;AD9GA,IAAM,sBAAsB;AA2B5B,eAAe,aAAa,MAAsC;AAChE,MAAI;AACF,WAAO,MAAM,SAAS,MAAM,OAAO;AAAA,EACrC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAIA,SAAS,UAAU,GAAmB;AACpC,SAAO,EACJ,QAAQ,SAAS,IAAI,EACrB,QAAQ,aAAa,EAAE,EACvB,KAAK;AACV;AA2CO,SAAS,eACd,UACA,QACA,WACA,OACA,UACW;AACX,QAAM,SAAS,GAAG,MAAM;AAAA,EAAK,KAAK;AAAA,EAAK,SAAS;AAChD,MAAI,aAAa,KAAM,QAAO,EAAE,QAAQ,SAAS,SAAS,GAAG,MAAM;AAAA,EAAK;AAExE,QAAM,QAAQ,SAAS,QAAQ,MAAM;AACrC,MAAI,UAAU,IAAI;AAChB,UAAM,OAAO,SAAS,SAAS,IAAI,IAAI,WAAW,GAAG,QAAQ;AAAA;AAC7D,WAAO,EAAE,QAAQ,SAAS,SAAS,GAAG,IAAI;AAAA,EAAK,MAAM;AAAA,EAAK;AAAA,EAC5D;AAEA,QAAM,OAAO,SAAS,MAAM,GAAG,KAAK;AACpC,QAAM,YAAY,QAAQ,OAAO,SAAS;AAE1C,QAAM,QAAQ,SAAS,QAAQ,WAAW,SAAS;AACnD,MAAI,UAAU,IAAI;AAChB,UAAM,OAAO,SAAS,MAAM,WAAW,KAAK;AAC5C,QAAI,UAAU,IAAI,MAAM,UAAU,KAAK,EAAG,QAAO,EAAE,QAAQ,OAAO;AAClE,QAAI,SAAS,KAAK,CAAC,MAAM,UAAU,IAAI,MAAM,UAAU,CAAC,CAAC;AACvD,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,SAAS,OAAO,SAAS,SAAS,MAAM,QAAQ,UAAU,MAAM;AAAA,MAClE;AACF,WAAO,EAAE,QAAQ,OAAO;AAAA,EAC1B;AAEA,aAAW,aAAa,CAAC,OAAO,GAAG,QAAQ,GAAG;AAC5C,QAAI,CAAC,SAAS,WAAW,WAAW,SAAS,EAAG;AAChD,UAAM,UAAU,GAAG,IAAI,GAAG,MAAM;AAAA,EAAK,SAAS,MAAM,YAAY,UAAU,MAAM,CAAC;AAGjF,WAAO,cAAc,QAAQ,EAAE,QAAQ,aAAa,QAAQ,IAAI,EAAE,QAAQ,WAAW,QAAQ;AAAA,EAC/F;AACA,SAAO,EAAE,QAAQ,OAAO;AAC1B;AAcO,SAAS,cAAc,WAA8B,UAAqC;AAC/F,QAAM,OAAO;AACb,MAAI,SAAS,WAAW,EAAG,QAAO,sCAAsC,IAAI;AAC5E,QAAM,UACJ,UAAU,SAAS,IACf,kDAAkD,IAAI,KACtD,wCAAwC,SAAS,MAAM,QAAQ,SAAS,WAAW,IAAI,KAAK,GAAG;AACrG,QAAM,OAAO;AAAA,IACX,UAAU,SAAS,IAAI,cAAc,UAAU,KAAK,IAAI,CAAC,KAAK;AAAA,IAC9D,+CAA+C,SAAS,KAAK,IAAI,CAAC;AAAA,EACpE,EACG,OAAO,OAAO,EACd,KAAK,IAAI;AACZ,SAAO,GAAG,OAAO;AAAA;AAAA,EAAO,IAAI;AAC9B;AAGO,SAAS,cACd,UACA,UACA,OACA,UACuC;AACvC,MAAI,aAAa,KAAM,QAAO;AAC9B,MAAI,UAAU,QAAQ,MAAM,UAAU,QAAQ,EAAG,QAAO;AACxD,MAAI,UAAU,OAAQ,QAAO;AAC7B,MAAI,SAAS,KAAK,CAAC,MAAM,UAAU,QAAQ,MAAM,UAAU,CAAC,CAAC,EAAG,QAAO;AACvE,SAAO;AACT;AAkBO,IAAM,uBAAuB;AAC7B,IAAM,4BAA4B;AAClC,IAAM,uBAAuB;AAGpC,IAAM,kBAAkB;AAAA,EACtB,CAAC,cAAc,kBAAkB,sBAAsB,eAAe;AAAA,EACtE,CAAC,mBAAmB,uBAAuB,2BAA2B,oBAAoB;AAAA,EAC1F,CAAC,aAAa,kBAAkB,sBAAsB,eAAe;AACvE;AASO,IAAM,gCAAmD;AAAA,EAC9D,GAAG,oBAAoB,IAAI,CAAC,MAAM,EAAE,GAAG;AAAA,EACvC,GAAG,gBAAgB,IAAI,CAAC,CAAC,GAAG,MAAM,GAAG;AACvC;AAkBA,eAAsB,aACpB,MACA,MACA,OAAyB,EAAE,OAAO,aAAa,GACxB;AACvB,SAAO,WAAiB;AAAA,IACtB,MAAM;AAAA,IACN;AAAA,IACA,MAAM,YAAY;AAChB,UAAI,CAAC,KAAK,OAAO,CAAC,eAAe,KAAK,KAAK,GAAG,GAAG;AAC/C,eAAO;AAAA,UACL,MAAM;AAAA,UACN,OACE;AAAA,QACJ;AAAA,MACF;AACA,aAAO;AAAA,QACL,MAAM;AAAA,QACN,MAAM;AAAA,UACJ,KAAK,KAAK,IAAI,QAAQ,OAAO,EAAE;AAAA,UAC/B,MAAM,KAAK,QAAQ;AAAA,UACnB,QAAQ,KAAK,UAAU,CAAC,MAAM,KAAK,GAAG;AAAA,QACxC;AAAA,MACF;AAAA,IACF;AAAA,IACA,OAAO,OAAO,SAAS,EAAE,QAAQ,IAAI,MAAM;AACzC,YAAM,QAAkB,CAAC;AACzB,YAAM,UAAoB,CAAC;AAK3B,YAAM,YAAsB,CAAC;AAC7B,YAAM,WAAqB,CAAC;AAI5B,YAAM,SAAS,oBAAI,IAA2B;AAC9C,YAAM,cAAc,KAAK,YAAY;AACrC,YAAM,mBAAmB,KAAK,iBAAiB;AAU/C,YAAM,QAAmB,CAAC;AAC1B,iBAAW,KAAK,qBAAqB;AACnC,cAAM,SAAS,KAAK,KAAK,EAAE,GAAG;AAC9B,YAAI,WAAW,EAAE;AACjB,YAAI,EAAE,QAAQ,uBAAuB;AAKnC,gBAAM,OAAO,KAAK,MAAM,QAAQ;AAChC,eAAK,MAAM,QAAQ;AACnB,eAAK,OAAO,QAAQ;AACpB,eAAK,SAAS,QAAQ;AACtB,qBAAW,KAAK,UAAU,MAAM,MAAM,CAAC,IAAI;AAAA,QAC7C;AACA,cAAM,WAAW,MAAM,aAAa,MAAM;AAC1C,cAAM,KAAK;AAAA,UACT;AAAA,UACA;AAAA,UACA;AAAA,UACA,QAAQ,cAAc,UAAU,UAAU,EAAE,OAAO,YAAY,EAAE,GAAG,KAAK,CAAC,CAAC;AAAA,QAC7E,CAAC;AAAA,MACH;AAiBA,YAAM,UAAU,IAAI,IAAI,qBAAqB;AAC7C,YAAM,YAAY,MACf,OAAO,CAAC,MAAM,QAAQ,IAAI,EAAE,EAAE,GAAG,KAAK,EAAE,WAAW,MAAM,EACzD,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG;AACrB,YAAM,UAAU,MAAM;AAAA,QACpB,CAAC,MAAM,QAAQ,IAAI,EAAE,EAAE,GAAG,KAAK,EAAE,WAAW,aAAa,CAAC,UAAU,SAAS,EAAE,EAAE,GAAG;AAAA,MACtF;AACA,UAAI,UAAU,SAAS,KAAK,QAAQ,SAAS,GAAG;AAC9C,mBAAW,KAAK,QAAS,GAAE,SAAS;AACpC,cAAM;AAAA,UACJ,GAAG,UAAU,KAAK,IAAI,CAAC,gFACF,sBAAsB,KAAK,IAAI,CAAC;AAAA,QAGvD;AAAA,MACF;AAGA,YAAM,cAAc,IAAI,IAAI,QAAQ,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC;AACvD,iBAAW,EAAE,GAAG,UAAU,UAAU,OAAO,KAAK,OAAO;AACrD,YAAI,WAAW,QAAQ;AACrB,cAAI,YAAY,IAAI,EAAE,GAAG,EAAG;AAC5B,gBAAM;AAAA,YACJ,GAAG,EAAE,GAAG;AAAA,UACV;AACA;AAAA,QACF;AACA,YAAI,WAAW,OAAQ;AACvB,cAAM,SAAS,KAAK,KAAK,EAAE,GAAG;AAC9B,cAAM,MAAM,QAAQ,MAAM,GAAG,EAAE,WAAW,KAAK,CAAC;AAChD,eAAO,IAAI,EAAE,KAAK,QAAQ;AAC1B,cAAM,UAAU,QAAQ,UAAU,OAAO;AACzC,gBAAQ,KAAK,EAAE,GAAG;AAClB,SAAC,WAAW,UAAU,YAAY,UAAU,KAAK,EAAE,GAAG;AACtD,YAAI,WAAW,UAAW,OAAM,KAAK,GAAG,EAAE,GAAG,mCAAmC;AAAA,MAClF;AAKA,iBAAW,CAAC,KAAK,QAAQ,WAAW,KAAK,KAAK,iBAAiB;AAC7D,cAAM,OAAO,KAAK,KAAK,GAAG;AAC1B,cAAM,WAAW,MAAM,aAAa,IAAI;AACxC,cAAM,OAAO;AAAA,UACX;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,iBAAiB,GAAG,KAAK,CAAC;AAAA,QAC5B;AACA,YAAI,KAAK,WAAW,OAAQ;AAC5B,YAAI,KAAK,WAAW,QAAQ;AAG1B,gBAAM;AAAA,YACJ,GAAG,GAAG;AAAA,UACR;AACA;AAAA,QACF;AACA,eAAO,IAAI,KAAK,QAAQ;AACxB,cAAM,UAAU,MAAM,KAAK,SAAS,OAAO;AAC3C,gBAAQ,KAAK,GAAG;AAChB,SAAC,KAAK,WAAW,UAAU,YAAY,UAAU,KAAK,GAAG,GAAG,wBAAwB;AACpF,YAAI,KAAK,WAAW;AAClB,gBAAM,KAAK,GAAG,GAAG,yDAAyD;AAC5E,YAAI,KAAK,WAAW;AAClB,gBAAM;AAAA,YACJ,GAAG,GAAG;AAAA,UACR;AAAA,MACJ;AAcA,YAAM,YAAY,IAAI;AAAA,QACpB,oBAAoB,OAAO,CAAC,MAAM,EAAE,UAAU,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG;AAAA,MACxE;AACA,YAAM,WAAW,QAAQ,OAAO,CAAC,MAAM,UAAU,IAAI,CAAC,KAAK,MAAM,WAAW;AAW5E,UAAI,SAAS,SAAS,GAAG;AACvB,cAAM,MAAM,OAAO,KAAK,mBAAmB,uBAAuB,GAAG;AACrE,YAAI,QAAQ,MAAM;AAChB,gBAAM,KAAK,kBAAkB;AAAA,QAC/B,WACE,CAAE,MAAM,mBAAmB,KAAK,OAAO,KAAK,UAAU;AAAA,UACpD;AAAA,UACA,WAAW;AAAA,QACb,CAAC,GACD;AACA,gBAAM,KAAK,kBAAkB;AAAA,QAC/B;AAAA,MACF;AAEA,YAAM,OAAO,cAAc,WAAW,QAAQ,CAAC;AAU/C,YAAM,UAAU,MAAM,qBAAqB,KAAK,6BAA6B;AAC7E,UAAI,QAAQ,SAAS,GAAG;AACtB,cAAM,QAAQ,MAAM,eAAe,KAAK,OAAO;AAC/C,cAAM,UAAU,CAAC,GAAG,IAAI,IAAI,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,GAAI,EAAE,CAAC,CAAE,CAAC,CAAC;AAChE,cAAM,YAAY,IAAI,IAAI,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,GAAI,EAAE,CAAC,KAAK,EAAE,CAAC;AAClE,cAAM,cAAc,QAAQ,OAAO,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,CAAC;AAO3D,cAAM,UAAoB,CAAC;AAC3B,mBAAW,OAAO,QAAQ,OAAO,CAAC,MAAM,QAAQ,SAAS,CAAC,CAAC,GAAG;AAC5D,gBAAM,OAAO,OAAO,IAAI,GAAG;AAC3B,cAAI,SAAS,OAAW;AACxB,cAAI,SAAS,MAAM;AACjB,kBAAM,GAAG,KAAK,KAAK,GAAG,GAAG,EAAE,OAAO,KAAK,CAAC;AACxC,oBAAQ,KAAK,GAAG;AAAA,UAClB,OAAO;AACL,kBAAM,UAAU,KAAK,KAAK,GAAG,GAAG,MAAM,OAAO;AAAA,UAC/C;AAAA,QACF;AAGA,mBAAW,KAAK,CAAC,GAAG,IAAI,IAAI,QAAQ,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG;AACtF,cAAI,MAAM,IAAK,OAAM,MAAM,KAAK,KAAK,CAAC,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,QAChE;AAEA,eAAO;AAAA,UACL,MAAM;AAAA,UACN,OACE,kCAAkC,QAAQ,MAAM,OAAO,8BAA8B,MAAM,mIAChE,QAAQ,KAAK,IAAI,CAAC,QAC5C,QAAQ,SAAS,IACd,eAAe,QAAQ,KAAK,IAAI,CAAC,sDACjC,OACH,YAAY,SAAS,IAClB,0BAA0B,YAAY,KAAK,IAAI,CAAC,2GAChD,MACJ;AAAA,QACJ;AAAA,MACF;AAEA,aAAO,MAAM,SAAS,IAAI,EAAE,MAAM,MAAM,OAAO,MAAM,KAAK,IAAI,EAAE,IAAI,EAAE,MAAM,KAAK;AAAA,IACnF;AAAA,EACF,CAAC;AACH;","names":[]}

package/dist/{chunk-FUWFLAWQ.js → chunk-IMYL67JV.js}

@@ -1,6 +1,6 @@
 import {
   withRecipe
-} from "./chunk-ZQV7UQNE.js";
+} from "./chunk-SQ4FSNYL.js";
 import {
   ALL_TEMPLATES,
   RENOVATE_ACTION_CONFIG,
@@ -11,7 +11,7 @@ import {
 import {
   listTrackedFiles,
   removeFromIndex
-} from "./chunk-AVEQUR44.js";
+} from "./chunk-EASYCD6F.js";
 
 // src/recipes/sync-configs.ts
 import { readFile, writeFile, mkdir } from "fs/promises";
@@ -229,4 +229,4 @@ export {
   planTemplateDiffs,
   syncConfigs
 };
-//# sourceMappingURL=chunk-FUWFLAWQ.js.map
+//# sourceMappingURL=chunk-IMYL67JV.js.map