create-website-build-kit 0.1.0

package/template/scripts/check-reflow.mjs

@@ -0,0 +1,148 @@
+/**
+ * WCAG 2.2 §1.4.10 Reflow and §1.4.4 Resize Text, against the DEPLOYED site.
+ *
+ *   npm run reflow                                 # every route, staging
+ *   npm run reflow -- --only=/pricing/             # one route, substring match
+ *   npm run reflow -- https://example.com          # a different host
+ *
+ * Reflow: content must work at a 320 CSS-pixel width without a second scroll
+ * axis. Resize: text to 200% without loss of content or function.
+ *
+ * ── WHY THIS EXISTS ────────────────────────────────────────────────────────
+ * `/accessibility/` states that both were tested and passed. On one build that
+ * was true when written and false a day later, because a redesign rebuilt every
+ * route. A published accessibility statement had been carrying a specific
+ * testing claim about a site that no longer existed, and nothing anywhere would
+ * have caught it.
+ *
+ * So this is not really a test, it is the thing that keeps a sentence on a legal
+ * page honest. Re-run it whenever layout moves, and update the `reviewed` date
+ * in src/pages/accessibility.astro when you do.
+ *
+ * ── ROUTES ARE DISCOVERED, NEVER LISTED ────────────────────────────────────
+ * An earlier version carried a hardcoded array. It was one project's routes,
+ * and it shipped inside this template — passing happily while testing pages
+ * that did not exist. See scripts/lib/routes.mjs.
+ */
+
+import puppeteer from 'puppeteer';
+import { discoverRoutes } from './lib/routes.mjs';
+
+const args = process.argv.slice(2);
+const only = (args.find((a) => a.startsWith('--only=')) ?? '').replace('--only=', '');
+const host = args.find((a) => !a.startsWith('--'));
+const BASE = (host ?? process.env.PUBLIC_SITE_URL ?? 'http://localhost:8788').replace(/\/$/, '');
+
+/*
+ * ⚠ PROJECT CONFIG — selectors for fixed-position third-party overlays.
+ *
+ * A chat bubble or cookie banner pinned to the viewport is not layout, but it
+ * is measured as if it were, so a widget hanging off the right edge reports as
+ * a reflow failure on every route at once. Removing it before measuring is
+ * correct; removing anything of your own is cheating.
+ *
+ * Empty by default — add only what a vendor injects, e.g. '[id*=chat-widget]'.
+ */
+const VENDOR_OVERLAYS = [];
+
+const { routes: discovered, source } = await discoverRoutes(BASE);
+
+const ROUTES = discovered
+  .map((url) => new URL(url).pathname)
+  .filter((r) => !only || only.split(',').some((frag) => r.includes(frag.trim())));
+
+if (!discovered.length) {
+  console.error(
+    `No routes found for ${BASE}.\n` +
+      '  Build first (`npm run build:staging`), or pass a host that serves a sitemap.',
+  );
+  process.exit(1);
+}
+if (!ROUTES.length) {
+  console.error(`No route matches --only=${only}. Discovered ${discovered.length} from ${source}.`);
+  process.exit(1);
+}
+
+console.log(`${ROUTES.length} route(s) from ${source}, against ${BASE}`);
+
+/*
+ * The check runs in the page. `scrollWidth - clientWidth` on the documentElement
+ * is the only reliable measure of a second scroll axis; a per-element sweep then
+ * NAMES the widest offender, so one overflowing table is identifiable rather
+ * than the page simply being "broken".
+ */
+const CHECK = () => {
+  const d = document.documentElement;
+  const over = d.scrollWidth - d.clientWidth;
+  const wide = [];
+  if (over > 1) {
+    for (const el of document.querySelectorAll('body *')) {
+      const r = el.getBoundingClientRect();
+      if (r.width > d.clientWidth + 1 && r.height > 0) {
+        const cls =
+          typeof el.className === 'string' && el.className.trim()
+            ? '.' + el.className.trim().split(/\s+/)[0]
+            : '';
+        const sel = el.tagName.toLowerCase() + cls;
+        if (!wide.some((w) => w.sel === sel)) wide.push({ sel, w: Math.round(r.width) });
+      }
+    }
+  }
+  return { over, wide: wide.slice(0, 3) };
+};
+
+const CASES = [
+  { label: 'reflow — 320px wide', w: 320, h: 640, scale: null },
+  { label: 'resize text — 200%', w: 1280, h: 900, scale: '200%' },
+];
+
+const browser = await puppeteer.launch({ args: ['--no-sandbox'] });
+let failures = 0;
+
+try {
+  for (const c of CASES) {
+    console.log(`\n── ${c.label} ${'─'.repeat(Math.max(0, 46 - c.label.length))}`);
+    const page = await browser.newPage();
+    await page.setViewport({ width: c.w, height: c.h });
+
+    for (const route of ROUTES) {
+      try {
+        await page.goto(BASE + route, { waitUntil: 'domcontentloaded', timeout: 45000 });
+        await new Promise((r) => setTimeout(r, 1400));
+
+        if (VENDOR_OVERLAYS.length) {
+          await page.evaluate((selectors) => {
+            for (const s of selectors) document.querySelectorAll(s).forEach((e) => e.remove());
+          }, VENDOR_OVERLAYS);
+        }
+
+        if (c.scale) {
+          await page.evaluate((s) => {
+            document.documentElement.style.fontSize = s;
+          }, c.scale);
+          await new Promise((r) => setTimeout(r, 700));
+        }
+
+        const res = await page.evaluate(CHECK);
+        if (res.over > 1) {
+          failures++;
+          const named = res.wide.map((x) => `${x.sel} (${x.w}px)`).join(', ');
+          console.log(`  FAIL ${route.padEnd(34)} overflow ${res.over}px  ${named}`);
+        }
+      } catch (e) {
+        failures++;
+        console.log(`  ERROR ${route.padEnd(33)} ${e.name}`);
+      }
+    }
+    await page.close();
+  }
+} finally {
+  await browser.close();
+}
+
+console.log(
+  failures === 0
+    ? `\n✓ no horizontal scroll at 320px or at 200% text, across ${ROUTES.length} route(s)`
+    : `\n✗ ${failures} failure(s)`,
+);
+process.exit(failures === 0 ? 0 : 1);

package/template/scripts/check-sitemap.mjs

@@ -0,0 +1,113 @@
+/**
+ * A URL cannot be in the sitemap AND serve `noindex`.
+ *
+ *   node scripts/check-sitemap.mjs        # after a production build
+ *
+ * Runs at the end of `build:production`, against dist/ — so the contradiction
+ * is caught before the deploy rather than after, which is the only part
+ * `npm run verify` cannot do.
+ *
+ * ── THE FAILURE THIS EXISTS FOR ────────────────────────────────────────────
+ * A URL in the sitemap is a request to index it. The same URL serving
+ * `noindex` is a refusal. Search Console reports the pair as **"Submitted URL
+ * marked 'noindex'" — an error, not a warning**, counted against the whole
+ * submission, so one contradictory page devalues the file every other page is
+ * listed in.
+ *
+ * Seen on a live site: a `/search/` page sat in the sitemap and served
+ * `noindex` from the day it was built. Nothing compares the two lists, so it
+ * stayed invisible until the sitemap was actually submitted, weeks later.
+ *
+ * ── WHY A CHECK AND NOT A FIX ──────────────────────────────────────────────
+ * The obvious fix is to make the sitemap derive from the pages' own `noindex`.
+ * It cannot: `@astrojs/sitemap` decides inclusion in astro.config.mjs, which is
+ * evaluated before any page renders, so at that moment nothing knows which
+ * routes will emit the tag. The exclusion list in the config and the pages
+ * themselves are two sources of truth by construction — this is what keeps them
+ * honest.
+ */
+
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import { join, relative } from 'node:path';
+
+const RESET = '[0m';
+const RED = '[31m';
+const GREEN = '[32m';
+const DIM = '[2m';
+
+const root = ['dist/client', 'dist'].find((d) => existsSync(d));
+if (!root) {
+  console.error('check-sitemap: no dist/ — run a build first.');
+  process.exit(1);
+}
+
+/* Staging emits no sitemap, deliberately. Nothing to contradict. */
+const sitemaps = readdirSync(root).filter((f) => /^sitemap.*\.xml$/.test(f));
+if (!sitemaps.length) {
+  console.log(`${DIM}· no sitemap in ${root}/ — staging build, nothing to check${RESET}`);
+  process.exit(0);
+}
+
+const listed = new Set();
+for (const file of sitemaps) {
+  const xml = readFileSync(join(root, file), 'utf8');
+  for (const m of xml.matchAll(/<loc>([^<]+)<\/loc>/g)) {
+    const loc = m[1].trim();
+    if (/sitemap.*\.xml$/i.test(loc)) continue; // an index pointing at its children
+    try {
+      listed.add(new URL(loc).pathname);
+    } catch {
+      /* ignore a malformed loc — the build would have failed elsewhere */
+    }
+  }
+}
+
+const walk = (dir) =>
+  readdirSync(dir).flatMap((entry) => {
+    const full = join(dir, entry);
+    return statSync(full).isDirectory() ? walk(full) : [full];
+  });
+
+/*
+ * Match the META TAG, not the word. The accessibility page explains what
+ * `noindex` means in prose, and a substring search reports it as noindex —
+ * a false positive that would train someone to ignore this check.
+ */
+const ROBOTS_META = /<meta[^>]+name=["']robots["'][^>]+content=["'][^"']*\bnoindex\b/i;
+
+const noindexed = walk(root)
+  .filter((f) => f.endsWith('.html'))
+  .filter((f) => ROBOTS_META.test(readFileSync(f, 'utf8')))
+  .map((f) => '/' + relative(root, f).replace(/index\.html$/, '').replace(/\.html$/, '/'))
+  .map((p) => (p.endsWith('/') ? p : `${p}/`));
+
+const contradictions = noindexed.filter((p) => listed.has(p));
+
+if (!contradictions.length) {
+  console.log(
+    `${GREEN}✓${RESET} sitemap and noindex agree ` +
+      `${DIM}(${listed.size} listed, ${noindexed.length} noindex, no overlap)${RESET}`,
+  );
+  process.exit(0);
+}
+
+console.error(`\n${RED}✗ ${contradictions.length} URL(s) are in the sitemap AND serve noindex${RESET}\n`);
+for (const p of contradictions) console.error(`    ${p}`);
+
+console.error(
+  `\n  Search Console reports this as "Submitted URL marked 'noindex'" — an ERROR,\n` +
+    `  counted against the whole submission, not just these pages.\n\n` +
+    `  Fix ONE of the two, never leave both:\n` +
+    `    · exclude the route in the sitemap \`filter\` in astro.config.mjs, or\n` +
+    `    · stop the page emitting noindex\n`,
+);
+
+if (contradictions.includes('/')) {
+  console.error(
+    `  ${DIM}'/' is here because the scaffold home page sets noindex while \`unbuilt\`\n` +
+      `  is true. Replace src/pages/index.astro with the real page — a production\n` +
+      `  build of the template skeleton is not a thing to deploy.${RESET}\n`,
+  );
+}
+
+process.exit(1);

package/template/scripts/dns-snapshot.mjs

@@ -0,0 +1,267 @@
+/**
+ * Snapshot a domain's public DNS, before you touch it — and compare after.
+ *
+ *   npm run dns -- example.com                 # capture → recon/dns.md
+ *   npm run dns -- example.com --compare       # what changed since the capture
+ *
+ * ── WHY THIS EXISTS ────────────────────────────────────────────────────────
+ * A rebuild moves the apex. Everything else in the zone is somebody else's
+ * service, and the kit had **no mention of MX anywhere** before this file.
+ *
+ * **Breaking MX kills the client's email.** That is worse than any failure this
+ * kit documents: a dead site is visible in minutes and someone shouts, while
+ * dead email is silent. Senders get bounces the client never sees, they assume
+ * a quiet week, and it surfaces days later when an invoice did not arrive.
+ *
+ * The same logic as `stacks.md` §1d — paths other systems point at — one layer
+ * down. These are records other systems depend on, and losing one is silent.
+ *
+ * ── IT RECORDS AND WARNS. IT NEVER FAILS THE RUN ───────────────────────────
+ * DNS lives outside the repo, a project can legitimately have no MX, and a
+ * check nobody can make green is a check everybody learns to ignore.
+ *
+ * ── WHAT IT CANNOT SEE ─────────────────────────────────────────────────────
+ * It reads PUBLIC DNS: what the world resolves, not what sits in the
+ * registrar's panel. A record that exists but is not published is invisible
+ * here, and so is anything proxied behind a provider that answers differently
+ * per network. Treat it as a verification tool, never as the source of truth
+ * for the zone.
+ */
+
+import { mkdirSync, readFileSync, writeFileSync, existsSync } from 'node:fs';
+import { Resolver } from 'node:dns/promises';
+
+const RESET = '';
+const RED = '';
+const GREEN = '';
+const YELLOW = '';
+const DIM = '';
+const BOLD = '';
+
+const args = process.argv.slice(2);
+const compare = args.includes('--compare');
+const domain = args.find((a) => !a.startsWith('--'))?.replace(/^https?:\/\//, '').replace(/\/.*$/, '');
+
+if (!domain) {
+  console.error('usage: npm run dns -- example.com [--compare]');
+  process.exit(1);
+}
+
+const OUT = 'recon/dns.md';
+const SNAP = 'recon/dns.json';
+
+/*
+ * A public resolver rather than the system one. The machine running this may
+ * sit behind a split-horizon or corporate resolver that answers differently
+ * from the internet, and the whole point is to see what the world sees.
+ */
+const resolver = new Resolver({ timeout: 5000, tries: 2 });
+resolver.setServers(['1.1.1.1', '8.8.8.8']);
+
+const ask = async (name, fn) => {
+  try {
+    return await fn();
+  } catch (e) {
+    if (['ENODATA', 'ENOTFOUND', 'ESERVFAIL'].includes(e.code)) return [];
+    return [];
+  }
+};
+
+const zone = {
+  domain,
+  capturedAt: new Date().toISOString(),
+  ns: await ask('NS', () => resolver.resolveNs(domain)),
+  a: await ask('A', () => resolver.resolve4(domain, { ttl: true })),
+  aaaa: await ask('AAAA', () => resolver.resolve6(domain, { ttl: true })),
+  mx: await ask('MX', () => resolver.resolveMx(domain)),
+  txt: (await ask('TXT', () => resolver.resolveTxt(domain))).map((r) => r.join('')),
+  caa: await ask('CAA', () => resolver.resolveCaa(domain)),
+  wwwCname: await ask('CNAME', () => resolver.resolveCname(`www.${domain}`)),
+  /* Selectors are per-provider and unguessable in general; these three cover
+     Google Workspace, Microsoft 365 and most ESPs. A miss here is not a
+     finding — it is a limit, and the report says so. */
+  dkim: {},
+  dmarc: (await ask('DMARC', () => resolver.resolveTxt(`_dmarc.${domain}`))).map((r) => r.join('')),
+};
+
+for (const selector of ['google', 'selector1', 'selector2', 'k1', 'default']) {
+  const rec = await ask('DKIM', () => resolver.resolveTxt(`${selector}._domainkey.${domain}`));
+  if (rec.length) zone.dkim[selector] = rec.map((r) => r.join(''));
+}
+
+/* ── Read the zone ─────────────────────────────────────────────────────── */
+
+const spf = zone.txt.filter((t) => /^v=spf1/i.test(t));
+const verifications = zone.txt.filter((t) =>
+  /google-site-verification|MS=|facebook-domain-verification|apple-domain-verification|_?bing|stripe-verification|atlassian|docusign|adobe-idp/i.test(t),
+);
+
+/*
+ * Cloudflare issues certificates through Google Trust Services, Let's Encrypt
+ * and SSL.com. A CAA record that names none of them blocks issuance — the
+ * deploy succeeds, DNS cuts over, and the site serves a TLS error nothing in
+ * the repo can fix. It is the classic launch-day emergency and it is invisible
+ * until the moment it is not.
+ */
+const CF_ISSUERS = ['pki.goog', 'letsencrypt.org', 'ssl.com', 'digicert.com', 'comodoca.com'];
+const caaIssuers = zone.caa.map((r) => r.issue ?? r.issuewild).filter(Boolean);
+const caaBlocks =
+  caaIssuers.length > 0 && !caaIssuers.some((i) => CF_ISSUERS.some((ok) => String(i).includes(ok)));
+
+/* ── Report ────────────────────────────────────────────────────────────── */
+
+console.log(`${BOLD}── ${domain} ${'─'.repeat(Math.max(0, 50 - domain.length))}${RESET}`);
+
+const line = (mark, label, value) => console.log(`  ${mark} ${label.padEnd(26)} ${value}`);
+
+line(zone.ns.length ? `${GREEN}✓${RESET}` : `${RED}✗${RESET}`, 'nameservers', zone.ns.join(', ') || '—');
+line(zone.a.length ? `${GREEN}✓${RESET}` : `${DIM}·${RESET}`, 'A',
+  zone.a.map((r) => `${r.address} (ttl ${r.ttl}s)`).join(', ') || '—');
+line(zone.wwwCname.length ? `${GREEN}✓${RESET}` : `${DIM}·${RESET}`, 'www', zone.wwwCname.join(', ') || '—');
+
+if (zone.mx.length) {
+  line(`${YELLOW}!${RESET}`, 'MX — EMAIL LIVES HERE',
+    zone.mx.map((m) => `${m.exchange} (${m.priority})`).join(', '));
+  console.log(
+    `      ${DIM}Carry these across before you move the apex. Losing MX kills the\n` +
+      `      client's email, and it fails silently — the bounces go to senders.${RESET}`,
+  );
+} else {
+  line(`${DIM}·${RESET}`, 'MX', 'none — email is not on this domain');
+}
+
+line(spf.length ? `${GREEN}✓${RESET}` : `${DIM}·${RESET}`, 'SPF', spf[0] ?? '—');
+line(zone.dmarc.length ? `${GREEN}✓${RESET}` : `${DIM}·${RESET}`, 'DMARC', zone.dmarc[0] ?? '—');
+line(Object.keys(zone.dkim).length ? `${GREEN}✓${RESET}` : `${DIM}·${RESET}`, 'DKIM selectors',
+  Object.keys(zone.dkim).join(', ') || 'none found at common selectors');
+
+if (caaBlocks) {
+  line(`${RED}✗${RESET}`, 'CAA', caaIssuers.join(', '));
+  console.log(
+    `      ${DIM}None of these is a CA Cloudflare issues through. Certificate\n` +
+      `      issuance will FAIL after cutover and the site will serve a TLS\n` +
+      `      error nothing in the repo can fix. Add one before you cut over.${RESET}`,
+  );
+} else {
+  line(zone.caa.length ? `${GREEN}✓${RESET}` : `${DIM}·${RESET}`, 'CAA',
+    caaIssuers.join(', ') || 'none — any CA may issue');
+}
+
+if (verifications.length) {
+  line(`${YELLOW}!${RESET}`, 'verification TXT', `${verifications.length} record(s)`);
+  for (const v of verifications) console.log(`      ${DIM}${v.slice(0, 78)}${RESET}`);
+  console.log(`      ${DIM}Each one belongs to a service that will silently lose access.${RESET}`);
+}
+
+const lowestTtl = Math.min(...zone.a.map((r) => r.ttl), Infinity);
+if (Number.isFinite(lowestTtl)) {
+  const ready = lowestTtl <= 600;
+  line(ready ? `${GREEN}✓${RESET}` : `${YELLOW}!${RESET}`, 'TTL on A',
+    `${lowestTtl}s${ready ? '' : ' — lower to 300s at least 24h before cutover'}`);
+}
+
+/* ── Compare, or capture ───────────────────────────────────────────────── */
+
+mkdirSync('recon', { recursive: true });
+
+if (compare) {
+  if (!existsSync(SNAP)) {
+    console.error(`\n${RED}✗${RESET} no ${SNAP} to compare against. Run without --compare first.`);
+    process.exit(1);
+  }
+  const before = JSON.parse(readFileSync(SNAP, 'utf8'));
+  console.log(`\n${BOLD}── Changed since ${before.capturedAt.slice(0, 10)} ${'─'.repeat(24)}${RESET}`);
+
+  const sets = {
+    MX: [before.mx.map((m) => m.exchange).sort(), zone.mx.map((m) => m.exchange).sort()],
+    SPF: [before.txt.filter((t) => /^v=spf1/i.test(t)), spf],
+    DMARC: [before.dmarc, zone.dmarc],
+    'verification TXT': [
+      before.txt.filter((t) => /verification|MS=/i.test(t)),
+      verifications,
+    ],
+    CAA: [before.caa.map((r) => r.issue ?? r.issuewild), caaIssuers],
+    nameservers: [before.ns.sort(), zone.ns.sort()],
+  };
+
+  let lost = 0;
+  for (const [label, [was, now]] of Object.entries(sets)) {
+    const gone = was.filter((v) => !now.includes(v));
+    if (gone.length) {
+      lost++;
+      console.log(`  ${RED}✗${RESET} ${label} LOST: ${gone.join(', ')}`);
+    } else if (JSON.stringify(was) !== JSON.stringify(now)) {
+      console.log(`  ${YELLOW}!${RESET} ${label} changed (nothing lost)`);
+    }
+  }
+  console.log(
+    lost
+      ? `\n${RED}${lost} record group(s) lost something that was there before cutover.${RESET}\n`
+      : `\n${GREEN}✓ nothing that was published before the cutover has been lost.${RESET}\n`,
+  );
+} else {
+  writeFileSync(SNAP, JSON.stringify(zone, null, 2) + '\n');
+  writeFileSync(OUT, report());
+  console.log(`\n${GREEN}✓${RESET} ${OUT} and ${SNAP}`);
+  console.log(
+    `${DIM}  Commit both. The JSON is the rollback artefact — after cutover run\n` +
+      `  \`npm run dns -- ${domain} --compare\` and it will tell you what was lost.${RESET}`,
+  );
+}
+
+console.log(
+  `${DIM}\n  Reads PUBLIC DNS: what the world resolves, not what is in the registrar's\n` +
+    `  panel. A record that exists but is not published is invisible here.${RESET}\n`,
+);
+
+function report() {
+  const rows = (title, items) =>
+    `### ${title}\n\n` + (items.length ? items.map((i) => `- \`${i}\``).join('\n') : '_none_') + '\n\n';
+
+  return `# DNS — ${domain}
+
+Captured ${zone.capturedAt}. **Public DNS only** — what the world resolves, not what is in
+the registrar's panel.
+
+⚠ **This is the rollback artefact for the cutover.** Commit it. After moving the apex, run
+\`npm run dns -- ${domain} --compare\` to see what stopped resolving.
+
+## The two that end launches
+
+**MX — ${zone.mx.length ? `${zone.mx.length} record(s). EMAIL LIVES ON THIS DOMAIN.` : 'none. Email is not on this domain.'}**
+
+${
+  zone.mx.length
+    ? zone.mx.map((m) => `- \`${m.exchange}\` priority ${m.priority}`).join('\n') +
+      `\n\nCarry these before moving the apex. Losing MX kills the client's email and does it\nsilently — the bounce goes to the sender, not to them. A dead site gets a phone call in\nminutes; dead email gets noticed when an invoice does not arrive.\n\n`
+    : 'Nothing to preserve. Confirm it with the client anyway — email on a subdomain or a\nseparate provider still breaks if the nameservers move.\n\n'
+}**CAA — ${caaIssuers.length ? caaIssuers.join(', ') : 'none, any CA may issue'}**
+
+${
+  caaBlocks
+    ? '⚠ **None of these is a CA Cloudflare issues through** (Google Trust Services, ' +
+      "Let's Encrypt, SSL.com). Certificate issuance will fail after cutover and the site will\nserve a TLS error that nothing in the repo can fix. Fix this before the cutover, not during.\n\n"
+    : 'No blocker. If a CAA record is added later it must include the host\'s CA.\n\n'
+}## Records
+
+${rows('Nameservers', zone.ns)}${rows('A', zone.a.map((r) => `${r.address}  ttl ${r.ttl}s`))}${rows('AAAA', zone.aaaa.map((r) => r.address))}${rows(`CNAME on www.${domain}`, zone.wwwCname)}
+## Email authentication
+
+Losing any of these does not bounce mail immediately — it degrades deliverability, so the
+symptom is "our emails started going to spam" weeks later.
+
+${rows('SPF', spf)}${rows('DMARC', zone.dmarc)}${rows('DKIM selectors found', Object.keys(zone.dkim))}
+DKIM selectors are per-provider and cannot be enumerated. Only common ones were probed, so an
+empty list here means *not found*, never *not present*.
+
+## Verification records
+
+${rows('Ownership / verification TXT', verifications)}
+Each belongs to a service — Search Console, Bing, Meta, a payment provider — that loses access
+silently when the record goes. Same rule as the file-based verification in \`stacks.md\` §1d.
+
+## All TXT
+
+${rows('TXT', zone.txt)}
+`;
+}