create-religion 0.5.0 → 1.1.0

package/dist/lib/doctor.js

@@ -26,7 +26,8 @@ const REQUIRED = [
     "history/spikes",
     "reference"
 ];
-const ALLOWED = {
+/** The values each enumerated setting accepts. Other settings are not checked. */
+export const ALLOWED = {
     "workflow.stepReview": ["every", "item"],
     "git.mode": ["trunk", "branch-per-item", "pull-request"],
     "git.checkpoints": ["none", "every-step", "squash"],
@@ -147,6 +148,9 @@ function invalidSettings(config) {
     }
     return problems;
 }
+export function doctorReport(checks) {
+    return { schemaVersion: 1, healthy: checks.every((check) => check.ok), checks: [...checks] };
+}
 export function renderDoctor(results) {
     const failures = results.filter((r) => !r.ok);
     const order = { work: 0, completion: 1, nothing: 2 };

package/dist/lib/install.js

@@ -10,14 +10,17 @@ import crypto from "node:crypto";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { exists, STATE_DIR } from "./paths.js";
-import { hasDamagedMarkers, hasMarkers, replaceManagedBlock, spliceEntry } from "./merge.js";
+import { hasDamagedMarkers, hasMarkers, rebuildEntry, replaceManagedBlock, spliceEntry } from "./merge.js";
 export const ADAPTERS = {
     claude: { label: "Claude Code", trees: [".claude/skills", ".claude/hooks"], entry: ["CLAUDE.md"] },
     codex: { label: "Codex", trees: [".agents/skills"], entry: ["AGENTS.md"] },
     copilot: { label: "GitHub Copilot", trees: [".agents/skills"], entry: ["AGENTS.md"] },
     opencode: { label: "OpenCode", trees: [".agents/skills"], entry: ["AGENTS.md"] }
 };
-const MANIFEST = path.join(STATE_DIR, ".state", "manifest.json");
+const MANIFEST_PATH = `${STATE_DIR}/.state/manifest.json`;
+const MANIFEST = path.join(...MANIFEST_PATH.split("/"));
+/** Where originals are copied before install or update changes them, relative to the project. */
+export const BACKUPS = `${STATE_DIR}/.state/backups`;
 export function hash(contents) {
     return crypto.createHash("sha256").update(contents).digest("hex").slice(0, 16);
 }
@@ -36,6 +39,12 @@ export async function planInstall(templateRoot, target, adapters, previous) {
     for (const relative of await walk(templateRoot)) {
         if (!wanted(relative))
             continue;
+        // Checked before anything else, since `exists` follows links: a dangling one would read as
+        // absent and be created wherever it points.
+        if (await throughLink(target, relative)) {
+            plan.push({ relative, action: "linked" });
+            continue;
+        }
         const destination = path.join(target, relative);
         const source = await fs.readFile(path.join(templateRoot, relative));
         if (!(await exists(destination))) {
@@ -66,37 +75,124 @@ export async function planInstall(templateRoot, target, adapters, previous) {
         if (entries.has(relative)) {
             const text = current.toString("utf8");
             // A damaged marker pair is a conflict, never a fresh merge: splicing a second block
-            // into a file that already has one is worse than the damage.
-            const action = hasMarkers(text) ? "remerge" : hasDamagedMarkers(text) ? "conflict" : "merge";
+            // into a file that already has one is worse than the damage. An unmarked file the
+            // manifest records is one Religion wrote and setup edited, so it already holds
+            // Religion's sections and is rebuilt around the owner's rather than spliced.
+            const action = hasMarkers(text)
+                ? "remerge"
+                : hasDamagedMarkers(text)
+                    ? "conflict"
+                    : recorded
+                        ? await rebuildOrConflict(target, relative, recorded)
+                        : "merge";
             plan.push({ relative, action });
             continue;
         }
         plan.push({ relative, action: "conflict" });
     }
+    return [...plan, ...(await planDropped(templateRoot, target, previous))];
+}
+/**
+ * Files the previous install recorded that the template no longer ships, for any adapter.
+ *
+ * Unedited ones are removed, which is what lets a skill or a hook be retired at all. Edited
+ * ones are released: left where they are and dropped from the manifest, since the edit makes
+ * them the owner's. The manifest is a file in someone's repository, so it must not be able to
+ * steer a deletion: only a plain file under one of Religion's own trees is ever a candidate.
+ */
+async function planDropped(templateRoot, target, previous) {
+    const managed = previous?.managed;
+    if (!managed || typeof managed !== "object")
+        return [];
+    const shipped = new Set(await walk(templateRoot));
+    const plan = [];
+    for (const [relative, recorded] of Object.entries(managed)) {
+        if (shipped.has(relative) || !retiringTree(relative) || !(await isPlainFile(target, relative)))
+            continue;
+        const current = await fs.readFile(path.join(target, ...relative.split("/")));
+        plan.push({ relative, action: hash(current) === recorded ? "remove" : "release", recorded });
+    }
     return plan;
 }
+/**
+ * The tree a recorded path can be retired from, or null when it may not be touched.
+ *
+ * Exact case, forward slashes and no climbing, checked as text before the filesystem is
+ * asked anything. A case-insensitive disk would otherwise let `RELIGION/` or `.CLAUDE/`
+ * reach files the comparison was meant to exclude.
+ */
+function retiringTree(relative) {
+    if (relative.includes("\\") || path.posix.isAbsolute(relative))
+        return null;
+    if (path.posix.normalize(relative) !== relative || relative.split("/").includes(".."))
+        return null;
+    const trees = new Set(Object.values(ADAPTERS).flatMap((adapter) => adapter.trees));
+    return [...trees].find((tree) => relative.startsWith(`${tree}/`)) ?? null;
+}
+/** Every component a real directory and the last a regular file, with no symbolic link anywhere. */
+async function isPlainFile(target, relative) {
+    const parts = relative.split("/");
+    let current = target;
+    for (const [index, part] of parts.entries()) {
+        current = path.join(current, part);
+        const stat = await fs.lstat(current).catch(() => null);
+        const last = index === parts.length - 1;
+        if (!stat || stat.isSymbolicLink() || (last ? !stat.isFile() : !stat.isDirectory()))
+            return false;
+    }
+    return true;
+}
 export async function applyInstall(templateRoot, target, plan, options) {
     const written = [];
     const conflicts = [];
     const backups = [];
     const merged = [];
+    const rebuilt = [];
+    const removed = [];
+    const released = [];
+    const declined = [];
+    const linked = [];
+    await refuseLinkedState(target, plan, options);
     for (const entry of plan) {
         if (entry.action === "unchanged" || entry.action === "seed-skip")
             continue;
+        if (entry.action === "release") {
+            released.push(entry.relative);
+            continue;
+        }
+        if (entry.action === "remove") {
+            // Checked again here because a prompt may have waited between planning and now, and a
+            // file edited in that time is the owner's.
+            const tree = retiringTree(entry.relative);
+            const file = path.join(target, ...entry.relative.split("/"));
+            const unchanged = tree !== null && (await isPlainFile(target, entry.relative)) && hash(await fs.readFile(file)) === entry.recorded;
+            if (!unchanged) {
+                released.push(entry.relative);
+                continue;
+            }
+            await fs.rm(file);
+            await pruneEmptyParents(path.join(target, tree), path.dirname(file));
+            removed.push(entry.relative);
+            continue;
+        }
         if (entry.action === "conflict" && !options.force) {
             conflicts.push(entry.relative);
             continue;
         }
         // Replacing only what is between the markers is the whole point of having merged: the
         // user's own prose sits outside them and is never read, let alone rewritten.
+        // Checked again at the write, because a prompt may have waited since planning and a link
+        // swapped in meanwhile would carry the write outside the project.
+        if (entry.action === "linked" || (await throughLink(target, entry.relative))) {
+            linked.push(entry.relative);
+            continue;
+        }
         if (entry.action === "remerge" || (entry.action === "merge" && options.merge)) {
             const destination = path.join(target, entry.relative);
             const template = await fs.readFile(path.join(templateRoot, entry.relative), "utf8");
             const current = await fs.readFile(destination, "utf8");
             if (entry.action === "merge") {
-                const backup = path.join(target, STATE_DIR, ".state", "backups", entry.relative);
-                await fs.mkdir(path.dirname(backup), { recursive: true });
-                await fs.copyFile(destination, backup);
+                await backUp(target, entry.relative);
                 backups.push(entry.relative);
             }
             const next = entry.action === "merge" ? spliceEntry(current, template) : replaceManagedBlock(current, template);
@@ -111,21 +207,94 @@ export async function applyInstall(templateRoot, target, plan, options) {
             continue;
         }
         if (entry.action === "merge") {
-            conflicts.push(entry.relative);
+            declined.push(entry.relative);
+            continue;
+        }
+        if (entry.action === "rebuild") {
+            // A prompt may have waited since planning; a link swapped in meanwhile is not rewritten.
+            if (!(await isPlainFile(target, entry.relative))) {
+                conflicts.push(entry.relative);
+                continue;
+            }
+            const destination = path.join(target, entry.relative);
+            const template = await fs.readFile(path.join(templateRoot, entry.relative), "utf8");
+            const current = await fs.readFile(destination, "utf8");
+            await backUp(target, entry.relative);
+            backups.push(entry.relative);
+            await fs.writeFile(destination, rebuildEntry(current, template), "utf8");
+            rebuilt.push(entry.relative);
             continue;
         }
         const destination = path.join(target, entry.relative);
         if (entry.action === "conflict") {
-            const backup = path.join(target, STATE_DIR, ".state", "backups", entry.relative);
-            await fs.mkdir(path.dirname(backup), { recursive: true });
-            await fs.copyFile(destination, backup);
+            await backUp(target, entry.relative);
             backups.push(entry.relative);
         }
         await fs.mkdir(path.dirname(destination), { recursive: true });
         await fs.copyFile(path.join(templateRoot, entry.relative), destination);
         written.push(entry.relative);
     }
-    return { written, conflicts, backups, merged };
+    return { written, conflicts, backups, merged, rebuilt, removed, released, declined, linked };
+}
+/**
+ * Rebuild only a file the manifest genuinely recorded, and only a plain one.
+ *
+ * A rebuild rewrites without asking, so it must not be reachable by a forged manifest value
+ * standing in for a hash, or by an entry file that is a link to somewhere else. Either is a
+ * conflict instead, which leaves the file alone and says so.
+ */
+async function rebuildOrConflict(target, relative, recorded) {
+    const genuine = typeof recorded === "string" && /^[0-9a-f]{16}$/.test(recorded);
+    return genuine && (await isPlainFile(target, relative)) ? "rebuild" : "conflict";
+}
+async function backUp(target, relative) {
+    const backup = path.join(target, ...`${BACKUPS}/${relative}`.split("/"));
+    await fs.mkdir(path.dirname(backup), { recursive: true });
+    await fs.copyFile(path.join(target, relative), backup);
+}
+/** Whether any existing component of a project path is a symbolic link. Missing ones are not. */
+async function throughLink(target, relative) {
+    let current = target;
+    for (const part of relative.split("/")) {
+        current = path.join(current, part);
+        const stat = await fs.lstat(current).catch(() => null);
+        if (!stat)
+            return false;
+        if (stat.isSymbolicLink())
+            return true;
+    }
+    return false;
+}
+/**
+ * Refuse, before anything is written, a run whose manifest or backups would pass through a link.
+ *
+ * The state directory is part of someone's repository, and a link at any point on the way
+ * would put the manifest, or a copy of their file, wherever the link points.
+ */
+async function refuseLinkedState(target, plan, options) {
+    const backedUp = plan.filter((entry) => entry.action === "rebuild" ||
+        (entry.action === "merge" && options.merge) ||
+        (entry.action === "conflict" && options.force));
+    const paths = [MANIFEST_PATH, ...backedUp.map((entry) => `${BACKUPS}/${entry.relative}`)];
+    for (const relative of paths) {
+        if (await throughLink(target, relative)) {
+            throw new Error(`Refusing to write ${relative} because part of that path is a symbolic link. Replace the link with a real directory or file and run again.`);
+        }
+    }
+}
+/** Remove directories a removal left empty, walking up and stopping at the tree it came from. */
+async function pruneEmptyParents(tree, dir) {
+    const root = path.resolve(tree);
+    let current = path.resolve(dir);
+    while (current.startsWith(root + path.sep)) {
+        try {
+            await fs.rmdir(current);
+        }
+        catch {
+            return;
+        }
+        current = path.dirname(current);
+    }
 }
 /**
  * Records what was *installed*, not what is currently on disk.
@@ -153,6 +322,9 @@ export async function writeManifest(target, version, adapters, templateRoot, pre
         }
         managed[relative] = hash(await fs.readFile(path.join(templateRoot, relative)));
     }
+    if (await throughLink(target, MANIFEST_PATH)) {
+        throw new Error(`Refusing to write ${MANIFEST_PATH} because part of that path is a symbolic link.`);
+    }
     const manifest = { schemaVersion: 1, version, adapters: [...adapters], managed };
     const file = path.join(target, MANIFEST);
     await fs.mkdir(path.dirname(file), { recursive: true });
@@ -170,12 +342,50 @@ export async function wireHooks(target) {
     const settings = path.join(target, ".claude", "settings.json");
     if (!(await exists(template)))
         return "no-template";
+    if (await throughLink(target, ".claude/settings.json"))
+        return "linked";
     if (await exists(settings))
         return "exists";
     await fs.mkdir(path.dirname(settings), { recursive: true });
     await fs.copyFile(template, settings);
     return "written";
 }
+/**
+ * Why this package must not act on a project, or null when it may.
+ *
+ * An older package applying its template over a newer install is a silent downgrade: it
+ * rewrites managed files to older versions and records them as installed. A version that
+ * cannot be parsed never refuses, since a hand-edited manifest is no evidence of a newer one.
+ */
+export function manifestRefusal(manifest, packageVersion) {
+    if (!manifest)
+        return null;
+    const schema = manifest.schemaVersion;
+    if (typeof schema === "number" && schema > 1) {
+        return `This project's manifest uses format ${schema}, which create-religion ${packageVersion} does not understand. Run \`npx create-religion@latest update\` instead.`;
+    }
+    if (isNewer(manifest.version, packageVersion)) {
+        return `This project was installed by create-religion ${manifest.version}, newer than this ${packageVersion}. Run \`npx create-religion@latest update\` instead.`;
+    }
+    return null;
+}
+function isNewer(candidate, than) {
+    const a = parseVersion(candidate);
+    const b = parseVersion(than);
+    if (!a || !b)
+        return false;
+    for (let i = 0; i < 3; i += 1) {
+        if (a[i] !== b[i])
+            return a[i] > b[i];
+    }
+    return false;
+}
+function parseVersion(version) {
+    if (typeof version !== "string")
+        return null;
+    const match = /^(\d+)\.(\d+)\.(\d+)(?:-.*)?$/.exec(version.trim());
+    return match ? match.slice(1, 4).map(Number) : null;
+}
 export async function readManifest(target) {
     try {
         return JSON.parse(await fs.readFile(path.join(target, MANIFEST), "utf8"));

package/dist/lib/merge.js

@@ -104,6 +104,29 @@ export function spliceEntry(existing, templateEntry) {
         parts.push("", commands);
     return parts.join("\n") + "\n";
 }
+/**
+ * Rebuild an unmarked entry file Religion installed, around what its owner wrote.
+ *
+ * A fresh install writes the entry file without markers and setup then edits it in place,
+ * so on the next update it matches neither the template nor the manifest. Splicing a block
+ * into it would repeat every section Religion already put there. Instead the file keeps its
+ * leading lines and every section Religion does not manage, and Religion's own sections are
+ * replaced by the current managed block. A file that already has markers only has its block
+ * replaced, so rebuilding twice changes nothing.
+ */
+export function rebuildEntry(existing, templateEntry) {
+    if (hasMarkers(existing))
+        return replaceManagedBlock(existing, templateEntry) ?? existing;
+    const { lead, sections } = parse(existing);
+    const managed = new Set(parse(templateEntry).sections.map((s) => s.heading).filter((h) => !USER_OWNED.has(h)));
+    const head = lead.filter((line) => !line.startsWith("@")).join("\n");
+    const kept = sections.filter((s) => !managed.has(s.heading) && s.heading !== "Commands");
+    const commands = sections.filter((s) => s.heading === "Commands");
+    return ([head, render(kept), managedBlock(templateEntry), render(commands)]
+        .map((part) => part.replace(/\n+$/, ""))
+        .filter(Boolean)
+        .join("\n\n") + "\n");
+}
 /**
  * Replace the managed block in a merged file, leaving everything outside it untouched.
  *

package/dist/lib/state.js

@@ -6,6 +6,7 @@
  * because the commands that use this are how someone finds out what is wrong.
  */
 import crypto from "node:crypto";
+import fs from "node:fs/promises";
 import { readIfPresent, statePath } from "./paths.js";
 const CHECKBOX = /^(\s*)- \[( |x|X)\]\s*(.*)$/;
 export function parsePlan(source) {
@@ -46,28 +47,184 @@ export function parseWork(source) {
     };
     if (!source || /_Nothing in progress\./.test(source))
         return empty;
-    const steps = [...source.matchAll(/^\s*- \[( |x|X)\]\s*(?:\*\*)?(.+?)(?:\*\*)?(?:\s+-\s|$)/gim)];
+    // The step's name is its bold text, which itself contains " - " in the template's shape.
+    // Spaces and tabs only: `\s` here crosses newlines, which made blank lines quadratic and
+    // joined consecutive unbolded steps into one.
+    const steps = [...source.matchAll(/^[ \t]*- \[( |x|X)\][ \t]*(?:\*\*(.+?)\*\*|(.+?)(?:[ \t]-[ \t]|$))/gim)];
     const done = steps.filter((s) => (s[1] ?? " ").toLowerCase() === "x").length;
+    const next = steps.find((s) => (s[1] ?? " ").toLowerCase() !== "x");
     return {
         active: true,
-        title: /^#\s+(.+)$/m.exec(source)?.[1]?.trim() ?? null,
-        type: /^\*\*Type:\*\*\s*(.+)$/m.exec(source)?.[1]?.trim() ?? null,
-        status: /^\*\*Status:\*\*\s*(.+)$/m.exec(source)?.[1]?.trim() ?? null,
+        title: field(source, "#"),
+        type: field(source, "Type"),
+        status: field(source, "Status"),
         stepsDone: done,
         stepsTotal: steps.length,
-        nextStep: steps.find((s) => (s[1] ?? " ").toLowerCase() !== "x")?.[2]?.trim() ?? null
+        nextStep: (next?.[2] ?? next?.[3])?.trim() ?? null
     };
 }
-export function parseFindings(source) {
+function field(source, name) {
+    const pattern = name === "#" ? /^#\s+(.+)$/m : new RegExp(`^\\*\\*${name}:\\*\\*\\s*(.+)$`, "m");
+    return pattern.exec(source)?.[1]?.trim() ?? null;
+}
+/** The active spec as written, for showing rather than deciding. Null when nothing is in progress. */
+export function parseSpec(source) {
+    if (!source || /_Nothing in progress\./.test(source))
+        return null;
+    const section = sections(source);
+    return {
+        title: field(source, "#"),
+        type: field(source, "Type"),
+        planItem: field(source, "From build plan")?.replace(/^item\s+/i, "") ?? null,
+        status: field(source, "Status"),
+        goal: (section.get("goal") ?? "").split(/\n\s*\n/).map(join).filter(Boolean),
+        inScope: bullets(section.get("in scope")),
+        outOfScope: bullets(section.get("out of scope")),
+        files: bullets(section.get("files and areas")),
+        steps: bullets(section.get("build steps"), true).map(parseStep)
+    };
+}
+/** Each heading's body, keyed by the lowercased heading; `levels` widens it to `###` too. */
+function sections(source, levels = "##") {
+    const found = new Map();
+    const parts = source.split(new RegExp(`^(?:${levels})\\s+(.+)$`, "m"));
+    for (let index = 1; index < parts.length; index += 2) {
+        found.set((parts[index] ?? "").trim().toLowerCase(), parts[index + 1] ?? "");
+    }
+    return found;
+}
+/** Top-level list items with their wrapped lines joined; with `checkbox`, only `- [ ]` items, tick kept. */
+function bullets(body, checkbox = false) {
+    if (!body)
+        return [];
+    const items = [];
+    for (const line of body.split(/\r?\n/)) {
+        if (/^- /.test(line))
+            items.push(line.slice(2));
+        else if (/^\s+\S/.test(line) && items.length > 0)
+            items[items.length - 1] += " " + line.trim();
+        else if (line.trim() !== "" && items.length > 0)
+            items.push("");
+    }
+    const kept = items.filter(Boolean).map((item) => item.trim());
+    return checkbox ? kept.filter((item) => /^\[( |x|X)\]/.test(item)) : kept;
+}
+function parseStep(item) {
+    const done = /^\[(x|X)\]/.test(item);
+    const text = item.replace(/^\[( |x|X)\]\s*/, "");
+    const bold = /^\*\*(.+?)\*\*\s*(?:-\s+)?([\s\S]*)$/.exec(text);
+    const name = bold?.[1] ?? text.split(" - ")[0] ?? "";
+    const rest = bold ? (bold[2] ?? "") : text.slice(name.length).replace(/^\s*-\s+/, "");
+    const [label, ...title] = name.split(" - ");
+    const [what, doneWhen] = rest.split(/\*Done when:\*\s*/);
+    return {
+        label: title.length > 0 ? (label ?? "").trim() : "",
+        title: (title.length > 0 ? title.join(" - ") : name).trim(),
+        what: (what ?? "").trim(),
+        doneWhen: doneWhen?.trim() ?? null,
+        done
+    };
+}
+export const HISTORY_KINDS = ["features", "fixes", "rollbacks", "refactors", "spikes"];
+/** One archive under `history/<kind>/`, named `NN-slug.md`. */
+export function parseArchive(kind, file, source) {
+    const spec = parseSpec(source);
+    const section = sections(source, "#{2,3}");
+    const repairs = spec?.steps.filter((step) => /^repair\b/i.test(step.label)).length ?? 0;
+    return {
+        kind,
+        file,
+        number: /^0*(\d+[a-z]?)-/i.exec(file)?.[1] ?? null,
+        title: spec?.title ?? null,
+        type: spec?.type ?? null,
+        status: spec?.status ?? null,
+        steps: (spec?.steps.length ?? 0) - repairs,
+        repairs,
+        commits: (labelled(source, "Commits") ?? "").split(/[\s,]+/).filter((sha) => /^[0-9a-f]{7,40}$/.test(sha)),
+        findings: [...source.matchAll(/^###\s+(?:[\w-]+\/)?(F-\d+)\s+\[(P[0-3])\]\s+(\w+)\s+-\s+(.+)$/gm)].map((m) => ({
+            id: m[1],
+            severity: m[2],
+            status: m[3],
+            title: (m[4] ?? "").trim()
+        })),
+        wentWrong: blocks(section.get("what went wrong on the way")),
+        deferred: blocks(section.get("deferred"))
+    };
+}
+/** Every archive, newest first within each kind; an absent folder contributes nothing. */
+export async function readHistory(root) {
+    const archives = [];
+    for (const kind of HISTORY_KINDS) {
+        let names;
+        try {
+            names = await fs.readdir(statePath(root, "history", kind));
+        }
+        catch {
+            continue;
+        }
+        for (const name of names.filter((n) => n.endsWith(".md") && n !== "README.md").sort().reverse()) {
+            const source = await readIfPresent(statePath(root, "history", kind, name));
+            if (source !== null)
+                archives.push(parseArchive(kind, name, source));
+        }
+    }
+    return archives;
+}
+/** The inbox's one-line notes, `- 2026-09-05 - text`, with the date when one leads. */
+export function parseInbox(source) {
     if (!source)
         return [];
-    return [...source.matchAll(/^###\s+(F-\d+)\s+\[(P[0-3])\]\s+(\w+)\s+-\s+(.+)$/gim)].map((m) => ({
-        id: m[1],
-        severity: m[2],
-        status: m[3],
-        title: (m[4] ?? "").trim()
+    return [...source.matchAll(/^- (?:(\d{4}-\d{2}-\d{2}) - )?(.+)$/gm)].map((m) => ({
+        date: m[1] ?? null,
+        text: (m[2] ?? "").trim()
     }));
 }
+/** Paragraphs and list items, each as one line of text. */
+function blocks(body) {
+    if (!body)
+        return [];
+    return body
+        .split(/\n\s*\n/)
+        .flatMap((paragraph) => (/^\s*- /.test(paragraph) ? bullets(paragraph) : [join(paragraph)]))
+        .filter(Boolean);
+}
+function join(paragraph) {
+    return paragraph.split(/\r?\n/).map((line) => line.trim()).join(" ").trim();
+}
+export function parseFindings(source) {
+    if (!source)
+        return [];
+    const entries = source.split(/^(?=###\s)/m);
+    return entries.flatMap((entry) => {
+        const m = /^###\s+(F-\d+)\s+\[(P[0-3])\]\s+(\w+)\s+-\s+(.+)$/im.exec(entry);
+        if (!m)
+            return [];
+        // A finding raised while building has no lens: "2026-09-26 while writing the guide".
+        // Matching from the last parenthesis, with no two parts able to take the same spaces, keeps this linear.
+        const found = labelled(entry, "Found");
+        const paren = found ? found.lastIndexOf("(") : -1;
+        const lensed = found && paren >= 0 ? /^\((?:scope:[^;)]*;\s*)?lens:([^)]+)\)\s*$/.exec(found.slice(paren)) : null;
+        return [
+            {
+                id: m[1],
+                severity: m[2],
+                status: m[3],
+                title: (m[4] ?? "").trim(),
+                file: labelled(entry, "File"),
+                found: lensed && found ? found.slice(0, paren).trim() : found,
+                lens: lensed ? (lensed[1] ?? "").trim() : null,
+                why: labelled(entry, "Why it matters"),
+                fix: labelled(entry, "Suggested fix"),
+                resolution: labelled(entry, "Resolution")
+            }
+        ];
+    });
+}
+/** The text after `**Label:**` on its line, or null when the label is absent or empty. */
+function labelled(entry, label) {
+    const value = new RegExp(`^\\*\\*${label}:\\*\\*[ \\t]*(.*)$`, "m").exec(entry)?.[1]?.trim();
+    return value ? value : null;
+}
 export function parseOpenQuestions(overview) {
     if (!overview)
         return [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-religion",
-  "version": "0.5.0",
+  "version": "1.1.0",
   "description": "A file-backed, spec-driven AI development workflow. Spec before code, small reviewed diffs, and project state in markdown so a cleared context costs nothing.",
   "license": "MIT",
   "author": "Nate",
@@ -31,7 +31,7 @@
     "religion": "dist/bin/religion.js"
   },
   "files": ["dist/", "template/", "README.md", "LICENSE"],
-  "engines": { "node": ">=20" },
+  "engines": { "node": ">=22" },
   "scripts": {
     "build": "tsc -p tsconfig.json",
     "prepack": "npm --prefix ../.. run build && npm run build"