gutterpress 0.11.10 → 0.11.11-alpha.2

package/dist/lib/markdown/renderer.d.ts

@@ -1,11 +1,11 @@
 /**
  * Pure (node-free) markdown rendering core.
  *
- * §1/§8 / ADR 0004: this module imports ONLY pure JS — markdown-it and its
+ * §1/§8: this module imports ONLY pure JS — markdown-it and its
  * plugins, Gutterpress's inlined marker parser (`markers.js`), and the node-free
  * leveled logger (console-only). It contains NO `node:*`,
  * NO `fs`/`path`/`url`, and NO filesystem access, so it can be imported by the
- * browser renderer (the PWA WebAdapter, #33) AND bundled into the
+ * browser AND bundled into the
  * `bun build --compile` CLI binary alike.
  *
  * The plugin *author* types and the markdown-it factory live here (not in
@@ -201,22 +201,18 @@ export declare const BUILTIN_OPTIONAL_PLUGINS: Record<string, GutterpressPlugin>
  * `<dl><dt><dd>`. It is not in CommonMark/markdown-it core; this is the
  * canonical markdown-it plugin for it.
  *
- * Block container syntax (`:::name ... :::`) was removed 2026-05-17 in favor
- * of the @marker family. See docs/migrations/2026-05-removing-container-syntax.md
- * for the migration mapping.
+ * There is no block container syntax (`:::name ... :::`): the @marker family
+ * is the wrapped-block surface. See
+ * docs/migrations/2026-05-removing-container-syntax.md for the mapping.
  *
- * GFM-style `> [!NOTE]` alerts were also moved into the DC plugin on the
- * same date because the emitted classes (dc-alert, dc-vibe-callout, etc.)
- * were DC-branded — core should not leak DC identifiers. #237 (0.10.7)
- * restored a core-owned, unbranded equivalent as an OPT-IN bundled feature —
+ * GFM-style `> [!NOTE]` alerts are an OPT-IN bundled feature (#237) —
  * `gfm-alerts.ts`, registered below as `gutterpress-gfm-alerts` — emitting
  * only the standard GitHub five (NOTE/TIP/IMPORTANT/WARNING/CAUTION) as
  * neutral `gp-alert`/`gp-alert-<type>` structure (see that file's header).
- * This does not re-converge with the DC plugin: DC's branded extra types
- * (`[!DM]`/`[!VIBE]`/`[!ORIGIN]`, etc.) and its own class names stay exactly
- * where they were moved to, layered on top of (or independent from) this
- * primitive. A project using neither plugin still renders `> [!NOTE]` as a
- * literal blockquote, unchanged — this feature is opt-in, not a default.
+ * Core emits no branded identifiers: branded extra types (e.g. DC's
+ * `[!DM]`/`[!VIBE]`/`[!ORIGIN]`) and their class names belong in project
+ * plugins, layered on top of (or independent from) this primitive. A project
+ * using neither renders `> [!NOTE]` as a literal blockquote.
  *
  * #240 — before `gutterpressMarkers` is applied, every loaded plugin's
  * declared `markers` table (if any) is merged into ONE registry via

package/dist/lib/missing-asset-placeholder.d.ts

@@ -1,15 +1,12 @@
 /**
  * A visible stand-in for an image the book references but does not have.
  *
- * WHY THIS EXISTS: a missing image used to abort the whole build
+ * WHY THIS EXISTS: without it, a missing image aborts the whole build
  * (`Could not copy asset … ENOENT`). For a non-technical author that is the
  * worst possible failure mode — one stale image path in a 273-page book and
  * nothing renders at all, with a filesystem error as the only explanation.
  * Worse, it makes the book unbuildable by anyone who does not already have
- * the missing file, which is exactly the state the dc-op-manual field guide
- * was in: two chapters referenced art that exists nowhere in the repo, so
- * every tool and every reviewer had to hand-patch placeholders in to build
- * it at all.
+ * the missing file.
  *
  * The fix is NOT to substitute something invisible. A silently-blank image
  * is how a missing illustration ships to print. This paints an unmistakable

package/dist/lib/output-paths.d.ts

@@ -2,11 +2,10 @@
  * Output location + artifact naming, by convention rather than configuration.
  *
  * A book builds to `<manifestDir>/dist/<title-slug>/`, and its artifacts are
- * `<title-slug>-<format>.pdf`. This replaces the manifest's `output.dir` /
- * `output.filename` / `output.html` block: the slug keeps several books in one
- * tree apart, and the format is in the artifact name because the extension
- * cannot tell a PDF from a PDF/X one (they previously shared a single
- * configured filename, so building both left only the last).
+ * `<title-slug>-<format>.pdf` — a convention, not manifest configuration: the
+ * slug keeps several books in one tree apart, and the format is in the
+ * artifact name because the extension cannot tell a PDF from a PDF/X one (a
+ * shared filename would leave only the last one built).
  *
  * `--out` remains for per-invocation placement (CI, one-offs).
  */

package/dist/lib/pdf-inspect.d.ts

@@ -5,7 +5,7 @@
  * pdfimages, pdftotext) and the general qpdf inspection used by the post-build
  * validation checks. It has ZERO system dependency and — unlike raw pdfjs-dist,
  * whose `legacy` build eagerly evaluates canvas/DOMMatrix code — unpdf bundles
- * cleanly under `bun build --compile` (verified). See ADR 0002.
+ * cleanly under `bun build --compile` (verified).
  *
  * NOT replaced here (still system tools, by design):
  *   - Ghostscript (gs): ink coverage + PDF/X CMYK conversion — no JS equivalent.
@@ -13,7 +13,7 @@
  *     catalog/object access pdfjs has no public API for, and qpdf is already
  *     mandatory whenever PDF/X is produced.
  *
- * Fidelity notes (accepted in ADR 0002):
+ * Fidelity notes (accepted):
  *   - Structural integrity (`isLoadable`) is a "does it parse" gate, not a deep
  *     `qpdf --check` of xref/stream-length integrity.
  *   - Image DPI requires decoding the image to read its pixel dimensions and is
@@ -25,10 +25,10 @@
  */
 import type { PDFDocumentProxy, PDFPageProxy } from "unpdf/pdfjs";
 /**
- * Cap on distinct cached documents (audit B3). One validation run touches a
+ * Cap on distinct cached documents. One validation run touches a
  * single PDF across ~13 checks (one entry), so this only bounds accumulation
  * ACROSS runs in a long-lived host (the Electron desktop validating many
- * projects over a session). Without it, `docCache` grew one never-freed parsed
+ * projects over a session). Without it, `docCache` grows one never-freed parsed
  * document per distinct path ever validated. LRU eviction destroys the evicted
  * document so its decoded pages/fonts/images are released, not just unreferenced.
  * (Exported so tests derive their eviction fixtures from the real cap.)
@@ -146,6 +146,6 @@ export declare function getImageResolutions(doc: PDFDocumentProxy): Promise<Arra
 /**
  * "Does it parse" gate: load every page. Returns true if the whole document is
  * traversable. This is NOT a deep xref/stream-length integrity check — it only
- * catches PDFs that are actually broken/unparseable (ADR 0002).
+ * catches PDFs that are actually broken/unparseable.
  */
 export declare function isLoadable(doc: PDFDocumentProxy): Promise<boolean>;

package/dist/lib/pdf-parse.d.ts

@@ -15,7 +15,7 @@ export declare function readPdfBytes(pdfPath: string): Promise<string>;
 /**
  * Parse ink coverage from `gs -sDEVICE=inkcov` output.
  *
- * Ghostscript has no pure-JS equivalent (it stays a system tool — see ADR 0002),
+ * Ghostscript has no pure-JS equivalent (it stays a system tool),
  * so the inkcov path remains shell-based here.
  */
 export declare function parseInkCov(out: string): {
@@ -34,12 +34,11 @@ interface InkCoveragePage {
     tac: number;
 }
 /**
- * Discriminated result for {@link getPerPageInkCoverage} (finding #51).
- * Ghostscript failing (crash, corrupt PDF, missing binary, a Windows PATH
- * mismatch — see finding #3) must be distinguishable from a legitimately
- * measured, empty-pages result: both used to collapse to the same `[]`,
- * which let the ink-coverage check silently PASS a book it never actually
- * measured.
+ * Discriminated result for {@link getPerPageInkCoverage}. Ghostscript failing
+ * (crash, corrupt PDF, missing binary, a Windows PATH mismatch) must be
+ * distinguishable from a legitimately measured, empty-pages result:
+ * collapsing both to the same `[]` would let the ink-coverage check silently
+ * PASS a book it never actually measured.
  */
 export type InkCoverageResult = {
     ok: true;

package/dist/lib/presets.d.ts

@@ -24,7 +24,7 @@ export type PresetId = (typeof PRESET_IDS)[number];
 export declare const DTRPG_PRESET: VendorPreset;
 /**
  * A neutral, vendor-agnostic default for authors who aren't targeting a
- * specific print vendor (UX finding M48). Standard 6x9in trade-book trim size,
+ * specific print vendor. Standard 6x9in trade-book trim size,
  * no vendor total-area-coverage (TAC) cap, and no PDF/X forcing:
  *
  * - `page`: 6in x 9in (432 x 648pt) — the common generic trade paperback trim.
@@ -57,8 +57,7 @@ export declare function warnOnce(id: string, message: string, sink?: (msg: strin
 /** Test-only reset hook — clears all warn-once dedup state. */
 export declare function resetWarnOnce(): void;
 /**
- * Resolve a manifest/CLI `preset` value to the {@link VendorPreset} it names
- * (UX finding M48).
+ * Resolve a manifest/CLI `preset` value to the {@link VendorPreset} it names.
  *
  * - Unset (`undefined`): defaults to `dtrpg`. That is the PRODUCT default,
  *   not a compatibility accident (ADR 0008): Gutterpress's primary audience

package/dist/lib/project-source.d.ts

@@ -41,7 +41,7 @@ export type ProjectSource = {
  * What the UI may offer for a given source. Derived purely from the source
  * type; no I/O.
  *
- * NOTE (audit D5): today the desktop only reads `canSnapshot` (it gates the
+ * NOTE: today the desktop only reads `canSnapshot` (it gates the
  * StatusBar "Version history" affordance). The other flags —
  * `canEnableVersionHistory`, `canViewHistory`, `canRestoreSnapshot`, `canRead`,
  * `canWriteLocal`, `authManagedByApp` — are computed and part of the DTO but
@@ -51,9 +51,8 @@ export type ProjectSource = {
  *
  * Deliberately NO `canSync` here: syncability is a credential-aware question
  * only `diagnoseProjectRemote().canSync` (remote-auth/diagnose.ts) can answer.
- * This interface used to carry a second, weaker `canSync` (= hasRemote, any
- * protocol, no credential check), and the two same-named-but-different gates
- * were a recurring source of contradictory sync behavior. Remote PRESENCE, for
+ * A second, weaker `canSync` here (= hasRemote, any protocol, no credential
+ * check) would be a source of contradictory sync behavior. Remote PRESENCE, for
  * display purposes, lives on the classification itself (`source.hasRemote`).
  */
 export interface ProjectCapabilities {

package/dist/lib/publish/command-runner.d.ts

@@ -1,6 +1,6 @@
 import type { CommandRunner } from "./types.ts";
 /**
- * Default idle budget (audit B2 / review): applied BY THE RUNNER whenever
+ * Default idle budget: applied BY THE RUNNER whenever
  * `timeoutMs` is omitted, so no call site (a provider upload, a
  * `commandExists` probe) can silently regain hang-forever behavior by
  * forgetting to pass it. `timeoutMs: 0` is the explicit opt-out. Idle, not

package/dist/lib/publish/connect-google.d.ts

@@ -1,7 +1,7 @@
 /**
  * Shared Google Drive connect flow (#221) — the ONE implementation behind
- * both the CLI's `--connect` branch and (Phase 2) the desktop's connect
- * route, mirroring how `connect.ts` is shared for pasted-token providers.
+ * both the CLI's `--connect` branch and the desktop's connect route, mirroring
+ * how `connect.ts` is shared for pasted-token providers.
  *
  * Unlike `connectPublishProvider` (verify-before-store for a PASTED token),
  * this flow is verify-by-construction: `GoogleAuthProvider.connect()` only

package/dist/lib/publish/types.d.ts

@@ -6,7 +6,7 @@
  * (DriveThruRPG, Amazon KDP), stages a validated upload package and hands the
  * author a checklist + the platform's upload URL ("guided" publishing).
  *
- * Architecture mirrors the remote-auth subsystem (ADR 0006):
+ * Architecture mirrors the remote-auth subsystem:
  *   - The lib NEVER touches OS keychains, the network, or child processes
  *     directly through ambient globals — hosts inject a {@link TokenStore},
  *     and tests inject {@link PublishDeps.fetch} / {@link PublishDeps.runCommand}.
@@ -89,7 +89,7 @@ export interface PublishProviderInfo {
          * browser consent flow (see `google-auth.ts`'s `GoogleAuthProvider` for
          * the gdrive precedent). UIs branch on this to swap the paste-a-key form
          * for a "Connect …" button; {@link connectPublishProvider} REJECTS oauth
-         * providers outright so the old paste-a-token path can never store an
+         * providers outright so the paste-a-token path can never store an
          * unverifiable credential for one (#221).
          */
         connect?: "token" | "oauth";
@@ -135,7 +135,7 @@ export type CommandRunner = (cmd: string, args: string[], options?: {
     /** Called once per output line — drives live progress logs. */
     onOutput?: (line: string) => void;
     /**
-     * Idle-kill budget in ms (audit B2). If the child produces no output and
+     * Idle-kill budget in ms. If the child produces no output and
      * has not exited within this window, it is SIGKILL'd and the run rejects
      * with a timeout error, so a stalled upload can't hang publish forever.
      * Omitted / undefined = the runner's default (defaultCommandRunner applies

package/dist/lib/remote-auth/clone.d.ts

@@ -54,9 +54,9 @@ export interface CloneRepositoryResult {
  */
 export declare function sanitizeCloneFolderName(name: string): string;
 /**
- * Clone a remote repository over smart HTTPS into `dir` (ADR 0006 D2).
+ * Clone a remote repository over smart HTTPS into `dir`.
  *
- * - HTTPS only (isomorphic-git has no SSH — ADR 0006 D6).
+ * - HTTPS only (isomorphic-git has no SSH).
  * - `singleBranch` always; `depth` opts into shallow (full by default — see
  *   the WHY on {@link CloneRepositoryOptions.depth}).
  * - Tokens embedded in the URL are stripped and (when a `tokenStore` is

package/dist/lib/remote-auth/converge-merge.d.ts

@@ -32,7 +32,7 @@ export interface ConvergeResult {
 export declare const CONVERGE_PREPARE_MESSAGE = "Getting your changes ready to combine with the online version";
 /** Snapshot message for the post-merge restore commit (kept-both/edits). */
 export declare const CONVERGE_RESTORE_MESSAGE = "Kept both versions of the files that can't be combined";
-/** The merge commit message (same wording the old sync used). */
+/** The merge commit message. */
 export declare const CONVERGE_MERGE_MESSAGE = "Combined your changes with the online version";
 /**
  * diff3 merge that NEVER reports a conflict: clean hunks merge exactly like

package/dist/lib/remote-auth/diagnose.d.ts

@@ -1,5 +1,5 @@
 /**
- * Project remote diagnostics (#14, ADR 0006 D7).
+ * Project remote diagnostics (#14).
  *
  * Pure-lib replacement for the issue's original shell diagnostics
  * (`git status` / `git remote -v` / `git branch --show-current` — all
@@ -26,7 +26,7 @@ export type ForgeKind = "github" | "gitea" | "forgejo" | "gitlab" | "bitbucket"
  * - `ready-to-sync` — HTTPS remote with a stored credential (sync lands
  *   with #15's sync phase; the plumbing is in place).
  * - `ssh-use-own-tools` — SSH remote: full local features, sync externally
- *   (ADR 0006 D6). The UI layers the "switch to HTTPS" hint on recognized hosts.
+ *  . The UI layers the "switch to HTTPS" hint on recognized hosts.
  */
 export type RemoteGuidanceId = "local-only" | "connect-github-to-sync" | "https-connect-server" | "ready-to-sync" | "ssh-use-own-tools";
 export interface ProjectRemoteDiagnosis {
@@ -45,7 +45,7 @@ export interface ProjectRemoteDiagnosis {
     /** Token-settings deep link for recognized non-GitHub forges. */
     tokenSettingsUrl: string | null;
     /**
-     * ADR 0006 D4: hasRemote && smart-HTTPS && credential stored. The sync
+     * hasRemote && smart-HTTPS && credential stored. The sync
      * flow (#15 D5) is live, so this is the real "offer the Sync action"
      * gate, not a future-capability hint.
      */

package/dist/lib/remote-auth/generic-auth.d.ts

@@ -1,5 +1,5 @@
 /**
- * Generic token auth provider (#14, ADR 0006 D3 layer 3).
+ * Generic token auth provider (#14).
  *
  * The universal floor for every smart-HTTPS Git host that is not github.com:
  * the user pastes a host URL + (optional) username + access token collected by

package/dist/lib/remote-auth/git-http.d.ts

@@ -1,5 +1,5 @@
 /**
- * Timeout wrapper for the isomorphic-git HTTP client (audit B1).
+ * Timeout wrapper for the isomorphic-git HTTP client.
  *
  * Every git transport call in this subsystem (`git.fetch`/`git.push`/
  * `git.clone`) is invoked with no timeout: if the TCP connection succeeds but
@@ -11,7 +11,7 @@
  * guard every fetch with `AbortSignal.timeout`; this brings the same discipline
  * to the git transport, at the one place a default client is chosen.
  *
- * Design (review finding: a naive deadline on `request()` is WRONG for pushes):
+ * Design (a naive deadline on `request()` is WRONG for pushes):
  * isomorphic-git passes upload bodies as an ARRAY of buffers, which the node
  * client collects and sends with Content-Length — `request()` then resolves
  * only when the response HEADERS arrive, i.e. after the ENTIRE pack upload.
@@ -67,9 +67,9 @@ export declare const SMALL_BODY_MAX_BYTES: number;
  * {@link SMALL_BODY_MAX_BYTES}. isomorphic-git always passes bodies as arrays
  * of byte chunks, so small ones are sizable synchronously. Any chunk WITHOUT
  * a numeric byteLength makes the body unsizable → NOT small, so it gets the
- * long upload backstop rather than the idle deadline as a total cap (review
- * finding: the old reduce counted unsizable chunks as 0 bytes — the exact
- * opposite of that intent).
+ * long upload backstop rather than the idle deadline as a total cap (do not
+ * count unsizable chunks as 0 bytes — that is the exact opposite of that
+ * intent).
  */
 export declare function isSmallBody(body: unknown): boolean;
 /**

package/dist/lib/remote-auth/github-auth.d.ts

@@ -10,7 +10,7 @@ export interface DeviceCodeInfo {
     /** Minimum seconds between token polls. */
     interval: number;
 }
-/** Host-supplied callbacks for the interactive connect flow (ADR 0006 D3). */
+/** Host-supplied callbacks for the interactive connect flow. */
 export interface HostCallbacks {
     /** Called once with the code/URL so the UI can display them. */
     onUserCode(info: DeviceCodeInfo): void;
@@ -25,7 +25,7 @@ export interface HostCallbacks {
  */
 export declare function resolveGitHubClientId(explicit?: string): string;
 export declare const GITHUB_HOST = "github.com";
-/** Author-friendly message for connectivity failures (ADR 0006 D7). */
+/** Author-friendly message for connectivity failures. */
 export declare const OFFLINE_MESSAGE = "Couldn't reach GitHub. Check your connection and try again.";
 export interface GitHubAuthProviderOptions {
     /** Explicit client id (overrides env + default). */
@@ -35,7 +35,7 @@ export interface GitHubAuthProviderOptions {
     /** Injectable sleep for tests (so polling tests run instantly). */
     sleepImpl?: (ms: number) => Promise<void>;
 }
-/** GitHub device-flow credential acquisition (ADR 0006 D1). */
+/** GitHub device-flow credential acquisition. */
 export declare class GitHubAuthProvider {
     private readonly clientId;
     private readonly fetchImpl;

package/dist/lib/remote-auth/github-repos.d.ts

@@ -1,9 +1,9 @@
 /**
- * GitHub repo discovery (#15, ADR 0006 D3 layer 4).
+ * GitHub repo discovery (#15).
  *
  * Plain `fetch` against the GitHub REST API — deliberately no `@octokit`
  * dependency. Lists every repository the user can access (`GET /user/repos`,
- * the OAuth `repo`-scope model — ADR 0006 D1 amendment 2026-06-10), the
+ * the OAuth `repo`-scope model), the
  * branches of a chosen repository, and (via the Git Trees API) the gutterpress
  * book projects inside a repo. The two REST listings paginate; the Git Trees
  * call is a single request that handles the API's `truncated` flag instead. All
@@ -31,8 +31,8 @@ export interface GitHubApiOptions {
 /**
  * List every repository the user can access — own, collaborator, and org
  * member — via `GET /user/repos` (paginated). The OAuth `repo` scope makes
- * the full set visible with zero install/selection steps (ADR 0006 D1
- * amendment). `sort=pushed` puts recently-active books first; callers must
+ * the full set visible with zero install/selection steps. `sort=pushed` puts
+ * recently-active books first; callers must
  * PRESERVE this order (the picker renders it as "most recent first").
  */
 export declare function listGitHubRepositories(credential: HostCredential, options?: GitHubApiOptions): Promise<RemoteRepository[]>;

package/dist/lib/remote-auth/sync-types.d.ts

@@ -1,6 +1,6 @@
 /**
  * Type/interface declarations for snapshot-first sync
- * (#15, ADR 0006 D5). Shared by the orchestrator, transport and
+ * (#15). Shared by the orchestrator, transport and
  * convergence modules share ONE definition of each result/option shape.
  * Pure type surface — no runtime code.
  */

package/dist/lib/remote-auth/sync.d.ts

@@ -17,7 +17,7 @@ export declare function isPushRejected(e: unknown): boolean;
  */
 export declare function isUnrelatedHistories(e: unknown): boolean;
 /**
- * Snapshot-first sync (ADR 0006 D5). Serialized on the per-repo lock; one
+ * Snapshot-first sync. Serialized on the per-repo lock; one
  * function-scoped object cache, released on return.
  *
  * If someone pushes between our fetch and our push, the push is rejected and

package/dist/lib/remote-auth/test-access.d.ts

@@ -39,7 +39,7 @@ export declare const FAILURE_MESSAGES: Record<RemoteAccessFailureReason, string>
  * - Never throws — every outcome is a classified {@link RemoteAccessResult}.
  * - SSH URLs return `ssh-unsupported` with zero network traffic.
  * - Credentials embedded in the URL are stripped and used for auth when no
- *   explicit credential is supplied (ADR 0006 D7) — they never leak onward.
+ *   explicit credential is supplied — they never leak onward.
  * - `defaultBranch` comes from the server's `HEAD` symref when advertised.
  */
 export declare function testRemoteAccess(options: TestRemoteAccessOptions): Promise<RemoteAccessResult>;

package/dist/lib/remote-auth/token-store.d.ts

@@ -14,7 +14,7 @@ export interface HostCredential {
     createdAt: number;
 }
 /**
- * Host-keyed credential vault contract (ADR 0006 D3 layer 2). Implementations
+ * Host-keyed credential vault contract. Implementations
  * are provided by the HOST APP (Electron safeStorage, CLI 0600 file); the lib
  * only consumes this interface.
  */

package/dist/lib/remote-auth/transport.d.ts

@@ -19,8 +19,8 @@ export declare function isCredentialTransmissionSafe(url: string): boolean;
 /**
  * Thrown by {@link onAuthFor} when a stored credential EXISTS but the remote
  * URL fails {@link isCredentialTransmissionSafe} (non-loopback http). Loud and
- * typed on purpose: the old behavior (silently withholding the credential)
- * surfaced as a 401 → "auth" → "reconnect" loop. The `code` string is the
+ * typed on purpose: silently withholding the credential surfaces as a 401 →
+ * "auth" → "reconnect" loop. The `code` string is the
  * STABLE contract (matchable across dynamic-import boundaries).
  */
 export declare class InsecureTransportError extends Error {
@@ -70,7 +70,7 @@ export declare function failureOutcome(e: unknown, snapshotId?: string): {
 export declare function setupErrorMessage(e: unknown): string | null;
 /**
  * Snapshot-first step used by syncProject
- * (ADR 0006 D5): commit any unsaved work in the WHOLE repo BEFORE any network
+ *: commit any unsaved work in the WHOLE repo BEFORE any network
  * or merge step, so a forced post-merge checkout can never discard it. The
  * working-tree check runs lazily at action time on the caller's function-scoped
  * object cache (released with the operation).

package/dist/lib/render-parity-raster.d.ts

@@ -0,0 +1,28 @@
+import type { Diff } from "./render-parity.ts";
+export interface RgbImage {
+    w: number;
+    h: number;
+    /** Packed RGB, 3 bytes per pixel. */
+    data: Uint8Array;
+}
+/** Parse a binary PPM (P6, maxval 255) — what `pdftoppm` writes by default. */
+export declare function parsePpm(buf: Uint8Array): RgbImage;
+/**
+ * Count pixels where any channel differs by more than `tolerance` (a fraction
+ * of 255; 0.01 = 1%), and return a copy of `cand` with those pixels painted
+ * red. Images of different sizes differ everywhere and get no diff image.
+ */
+export declare function comparePixels(base: RgbImage, cand: RgbImage, tolerance: number): {
+    differing: number;
+    marked: RgbImage | null;
+};
+/** Encode an RGB image as a PNG (8-bit truecolour, no filtering). */
+export declare function encodePng(img: RgbImage): Uint8Array;
+/**
+ * Raster-compare the first `pageCount` pages of two PDFs. Returns one `raster`
+ * diff per differing page and writes `diff-NNN.png` for each into `outDir`.
+ */
+export declare function rasterDiffs(basePdf: string, candPdf: string, pageCount: number, outDir: string, options?: {
+    dpi?: number;
+    tolerance?: number;
+}): Promise<Diff[]>;

package/dist/lib/render-parity.d.ts

@@ -41,7 +41,7 @@ export declare function extractReport(pdfPath: string): Promise<Report>;
  * rounded to 3 decimals before it gets here.
  */
 export declare function serializeReport(report: Report): string;
-export type WaiverKind = "page-count" | "page-size" | "text" | "image";
+export type WaiverKind = "page-count" | "page-size" | "text" | "image" | "raster";
 export interface Waiver {
     /** 1-based page number. Omit for kind "page-count" (there is no page). */
     page?: number;
@@ -70,6 +70,9 @@ export interface CompareOptions {
     /** Points. Applies to text run and image extents (x/y/w/h). Default 0.5. */
     tolerance?: number;
     waivers?: Waiver[];
+    /** Diffs found outside the report — the `raster` diffs of `compare
+     *  --raster` (render-parity-raster.ts) — waived like every other kind. */
+    extraDiffs?: Diff[];
 }
 export interface CompareResult {
     /** Diffs NOT excused by any waiver — non-empty means the gate fails. */

package/dist/lib/source-provider.d.ts

@@ -105,7 +105,7 @@ export interface SourceProvider {
 /**
  * Run `fn` exclusively per resolved project dir (FIFO promise chaining).
  * Exported for the remote-clone surface (#15) so clone/fetch operations share
- * the SAME queue as snapshot/restore — ADR 0006 D2 requires one per-repo lock.
+ * the SAME queue as snapshot/restore — one per-repo lock.
  */
 export declare function withRepoLock<T>(projectDir: string, fn: () => Promise<T>): Promise<T>;
 /**
@@ -164,7 +164,7 @@ export declare function stageChanges(dir: string, changes: WorkdirChanges, cache
 /**
  * True when the working tree differs from the index (added/modified/deleted
  * files). Used to skip empty snapshots. Exported (lock-free) for the sync
- * surface (#15, ADR 0006 D5) — callers outside a lock should prefer the
+ * surface (#15) — callers outside a lock should prefer the
  * provider operations.
  */
 export declare function hasPendingChanges(dir: string, cache?: GitCache): Promise<boolean>;
@@ -177,14 +177,13 @@ export declare function hasPendingChanges(dir: string, cache?: GitCache): Promis
  * sync-check path per the sync-simplicity mandate): this is for build
  * *provenance* — the build fingerprint records whether the tree was clean at
  * build time, where a `git add`-ed-but-not-committed change must still count
- * as dirty (the old `git status --porcelain` fingerprint reported it; the
- * WORKDIR-vs-STAGE-only check silently dropped it).
+ * as dirty (the WORKDIR-vs-STAGE-only check silently drops it).
  */
 export declare function hasUncommittedChanges(dir: string, cache?: GitCache): Promise<boolean>;
 /**
  * Lock-free snapshot of the full working tree (stage everything + commit).
  *
- * Exported for the sync surface (#15, ADR 0006 D5): `syncProject` holds
+ * Exported for the sync surface (#15): `syncProject` holds
  * the per-repo lock for snapshot → fetch → merge → push as ONE sequence, so it
  * needs the lock-free internal rather than `provider.snapshot()` (taking the
  * per-method lock inside the sync lock would deadlock the FIFO queue).

package/dist/lib/static-serve.d.ts

@@ -4,20 +4,15 @@ import http from "node:http";
  * in this package: the build-time pagination server and PDF-render server
  * (build-runner.ts) and the live preview server (preview/http-server.ts).
  *
- * Previously two independent 17-entry tables that had to be edited in lockstep
- * (finding #17) — a new asset type added to only one would render differently
- * in preview vs build-time pagination with no error, a silent divergence
- * class. One table now; add a new extension once.
+ * One table for every server: a type added to only one would render
+ * differently in preview vs build-time pagination with no error.
  *
- * That same divergence class recurred once more (2026-07-28 duplication
- * audit): this table and `asset-inline.ts`'s `MIME_BY_EXT` — a separate table
- * answering a separate question, "what Content-Type does a data: URI need
- * when embedding this file inline," vs. this table's "what Content-Type does
- * an HTTP response need" — had drifted again, missing `.webp`/`.avif` here.
- * A copied WebP/AVIF image was served as `application/octet-stream` by both
- * servers above. Added below; if a third image format shows up, add it to
- * BOTH tables in the same commit (asset-inline.ts is out of scope for this
- * PR — see docs/reviews/duplication-audit-2026-07-28.md).
+ * `asset-inline.ts`'s `MIME_BY_EXT` is a separate table answering a separate
+ * question ("what Content-Type does a data: URI need when embedding this file
+ * inline" vs. this table's "what Content-Type does an HTTP response need"). A
+ * new image format must be added to BOTH tables in the same commit, or (as
+ * once happened with `.webp`/`.avif`) a copied image is served as
+ * `application/octet-stream`.
  */
 export declare const STATIC_MIME: Record<string, string>;
 /**

package/dist/lib/style-resolver.d.ts

@@ -34,7 +34,7 @@ export declare function resolveActiveStyles(projectDir: string, manifestStyles?:
  * the way the manifest stores them — project-relative, e.g.
  * `../../shared/styles/components.css` — so toggling one on writes the right
  * entry. Omit it (or pass the project itself) for the single-project case, which
- * behaves exactly as before.
+ * scans only the project.
  */
 export declare function listProjectStyles(projectDir: string, opts?: {
     repoRoot?: string;

package/dist/lib/targets.d.ts

@@ -17,9 +17,6 @@ import { type VendorPreset } from "./presets";
  * skipped because its tools are missing becomes a synthetic error, so
  * "validated for dtrpg" can never silently mean "the dtrpg checks didn't
  * run".
- *
- * Grown from the old `validate --profile dtrpg` (validation-profile.ts,
- * deleted): the profile was this exact idea hardcoded for one destination.
  */
 /** The deep-partial preset shape a target may overlay. */
 export type TargetOverlay = {
@@ -77,8 +74,7 @@ export declare function overlayPreset(preset: VendorPreset, target: PublishTarge
  * The strict-PDF fill-ins applied to EVERY post-build PDF validation
  * regardless of preset/target: any of these left `undefined` by the config
  * becomes an error-severity check, without overwriting an author's explicit
- * choice (including an explicit disable). Moved verbatim from
- * validation-profile.ts (ARCH #21).
+ * choice (including an explicit disable).
  */
 export declare const DEFAULT_STRICT_PDF_CHECKS: readonly ["pdf.structure.qpdf", "pdf.print.pdfx-markers", "pdf.print.pdfx-metadata", "pdf.print.embedded-fonts"];
 export declare function applyDefaultPdfStrictChecks(config: ResolvedConfig): ResolvedConfig;

package/dist/lib/tool-probe.d.ts

@@ -19,9 +19,8 @@
  *
  * One implementation; one place to fix bugs. Spawning goes through
  * exec.ts's `execCapture`, which also owns the shared, correctly
- * delimiter-joined `enhancedPath` (this file used to keep its own copy of
- * that PATH construction, and exec.ts's copy hardcoded `:` — see
- * docs/reviews 2026-07-10-architecture-critical-review.md, finding #3).
+ * delimiter-joined `enhancedPath` — do not keep a second copy of that PATH
+ * construction here.
  */
 /**
  * Returns true if `tool` is resolvable via the platform's path-probe command.

package/dist/lib/validation-exec.d.ts

@@ -30,10 +30,9 @@ export interface ValidationExecutionArgs {
      * only, without touching the manifest's `validate.source.stylelint`
      * setting on disk (#272 — one CSS gate, not two). Set by the build
      * pipeline's `runQualityGates` (build-runner.ts) from `--skip-lint` /
-     * `config.lint.enabled: false`, so that flag disables just the one check
-     * it always meant to gate rather than a whole separate lint pass. Every
-     * other caller (`gutterpress validate`/`preflight`, the desktop Problems
-     * panel) leaves this unset and gets the manifest's own setting.
+     * `config.lint.enabled: false`, so that flag disables just this one check.
+     * Every other caller (`gutterpress validate`/`preflight`, the desktop
+     * Problems panel) leaves this unset and gets the manifest's own setting.
      */
     skipStylelint?: boolean;
     /**