toolroll 0.5.0

package/dist/push.js

@@ -0,0 +1,353 @@
+/**
+ * Web push, zero-dependency (arc 3).
+ *
+ * Three layers, kept apart: CRYPTO (RFC 8291 aes128gcm message encryption
+ * and RFC 8292 VAPID authorization, byte-exact, node:crypto only),
+ * TRANSPORT (one hardened fetch to an allow-listed push service), and the
+ * PASS (claim pairs from the store's ledger, fence, send, settle by the
+ * full outcome table). The payload that transits Apple's and Google's
+ * servers is a fixed phrase keyed on the notification's CLASS plus a
+ * machine-minted console path. Check progress may also send one validated
+ * suite/count line; task titles, branches and repository names stay local.
+ *
+ * 'accepted' means the push service took the message (RFC 8030). Nothing
+ * here ever claims a phone displayed anything, and delivery is
+ * AT-LEAST-ONCE: a crash between acceptance and settlement re-sends after
+ * the pair's lease expires (the payload's tag collapses the duplicate on
+ * the lock screen).
+ */
+import { closeSync, constants as fsConstants, fsyncSync, openSync, readFileSync, writeSync } from "node:fs";
+import { join } from "node:path";
+import { createCipheriv, createECDH, createPrivateKey, hkdfSync, randomBytes, createHash, sign as cryptoSign } from "node:crypto";
+import { isCheckProgressLine } from "./check-progress.js";
+export const VAPID_FILE = "vapid-keys.json";
+/** RFC 8291 §4: rs 4096 leaves room for the record's delimiter and tag. */
+const RECORD_SIZE = 4096;
+/** The plaintext ceiling that keeps one record inside rs (RFC 8291 §4). */
+export const PLAINTEXT_CEILING = 3993;
+const REQUEST_TIMEOUT_MS = 10_000;
+/** The pair lease strictly exceeds the request timeout (finding 12). */
+export const PUSH_CLAIM_TTL_MS = 30_000;
+const BACKOFF_MS = [60_000, 300_000, 1_500_000, 7_200_000];
+const MAX_ATTEMPTS = 8;
+const b64url = (buffer) => buffer.toString("base64url");
+const fromB64url = (text) => Buffer.from(text, "base64url");
+export function vapidFingerprint(publicKey) {
+    return createHash("sha256").update(publicKey, "utf8").digest("hex").slice(0, 16);
+}
+/**
+ * Mint-or-load, atomically across processes (finding 29): exclusive
+ * creation; the loser of a race re-reads the winner's file; and a loaded
+ * pair is VALIDATED — the stored public key must derive from the stored
+ * private key, or the file is refused rather than trusted.
+ */
+export function loadOrCreateVapidKeys(dir) {
+    const path = join(dir, VAPID_FILE);
+    const read = () => {
+        let raw;
+        try {
+            raw = readFileSync(path, "utf8");
+        }
+        catch {
+            return null;
+        }
+        const parsed = JSON.parse(raw);
+        if (typeof parsed.publicKey !== "string" || typeof parsed.privateKey !== "string") {
+            throw new Error(`${VAPID_FILE} is not a key file`);
+        }
+        const check = createECDH("prime256v1");
+        check.setPrivateKey(fromB64url(parsed.privateKey));
+        if (b64url(check.getPublicKey()) !== parsed.publicKey) {
+            throw new Error(`${VAPID_FILE} holds a mismatched key pair — refusing to sign with it`);
+        }
+        return { publicKey: parsed.publicKey, privateKey: parsed.privateKey, fingerprint: vapidFingerprint(parsed.publicKey) };
+    };
+    const existing = read();
+    if (existing !== null)
+        return existing;
+    const minted = createECDH("prime256v1");
+    minted.generateKeys();
+    const fresh = { publicKey: b64url(minted.getPublicKey()), privateKey: b64url(minted.getPrivateKey()) };
+    try {
+        const fd = openSync(path, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL, 0o600);
+        try {
+            writeSync(fd, JSON.stringify(fresh, null, 2));
+            fsyncSync(fd);
+        }
+        finally {
+            closeSync(fd);
+        }
+        return { ...fresh, fingerprint: vapidFingerprint(fresh.publicKey) };
+    }
+    catch {
+        // Another process won the exclusive create — its keys are the keys.
+        const winner = read();
+        if (winner === null)
+            throw new Error(`could not create or read ${VAPID_FILE}`);
+        return winner;
+    }
+}
+// ---- RFC 8291 encryption ----------------------------------------------------
+/**
+ * The deterministic core, exported for the Appendix A vector test: given
+ * the subscriber's materials, an application-server ECDH object, and a
+ * salt, produce the complete aes128gcm body — header || ciphertext.
+ */
+export function encryptWithMaterials(uaPublic, authSecret, asKeys, salt, plaintext) {
+    if (uaPublic.length !== 65 || uaPublic[0] !== 0x04)
+        throw new Error("subscriber key is not a 65-byte uncompressed P-256 point");
+    if (authSecret.length !== 16)
+        throw new Error("auth secret is not 16 bytes");
+    if (salt.length !== 16)
+        throw new Error("salt is not 16 bytes");
+    if (plaintext.length > PLAINTEXT_CEILING)
+        throw new Error(`payload over ${PLAINTEXT_CEILING} bytes`);
+    const asPublic = asKeys.getPublicKey();
+    // computeSecret rejects off-curve points — the caller maps that throw to
+    // an invalid subscription, never a crash.
+    const ecdhSecret = asKeys.computeSecret(uaPublic);
+    const keyInfo = Buffer.concat([Buffer.from("WebPush: info", "ascii"), Buffer.from([0]), uaPublic, asPublic]);
+    const ikm = Buffer.from(hkdfSync("sha256", ecdhSecret, authSecret, keyInfo, 32));
+    const cek = Buffer.from(hkdfSync("sha256", ikm, salt, Buffer.concat([Buffer.from("Content-Encoding: aes128gcm", "ascii"), Buffer.from([0])]), 16));
+    const nonce = Buffer.from(hkdfSync("sha256", ikm, salt, Buffer.concat([Buffer.from("Content-Encoding: nonce", "ascii"), Buffer.from([0])]), 12));
+    // One record: plaintext, the last-record delimiter 0x02, zero padding.
+    const record = Buffer.concat([plaintext, Buffer.from([2])]);
+    const cipher = createCipheriv("aes-128-gcm", cek, nonce);
+    const ciphertext = Buffer.concat([cipher.update(record), cipher.final(), cipher.getAuthTag()]);
+    const header = Buffer.alloc(16 + 4 + 1);
+    salt.copy(header, 0);
+    header.writeUInt32BE(RECORD_SIZE, 16);
+    header.writeUInt8(65, 20);
+    return Buffer.concat([header, asPublic, ciphertext]);
+}
+/** The production wrapper: fresh ephemeral keys and a fresh salt per message. */
+export function encryptPushPayload(p256dh, auth, plaintext) {
+    const ephemeral = createECDH("prime256v1");
+    ephemeral.generateKeys();
+    return encryptWithMaterials(fromB64url(p256dh), fromB64url(auth), ephemeral, randomBytes(16), Buffer.from(plaintext, "utf8"));
+}
+// ---- RFC 8292 VAPID ---------------------------------------------------------
+/**
+ * The VAPID authorization header: an ES256 JWT over { aud, exp, sub? },
+ * signed with the STABLE server key (distinct from every message's
+ * ephemeral key), in JWS P1363 form — never DER (finding 4).
+ */
+export function vapidAuthorization(endpoint, keys, now, contact) {
+    const aud = new URL(endpoint).origin;
+    const exp = Math.floor(now.getTime() / 1000) + 12 * 60 * 60; // ≤ 24h per RFC 8292
+    const claims = { aud, exp };
+    if (contact !== undefined && (contact.startsWith("mailto:") || contact.startsWith("https:")))
+        claims["sub"] = contact;
+    const header = b64url(Buffer.from(JSON.stringify({ typ: "JWT", alg: "ES256" }), "utf8"));
+    const body = b64url(Buffer.from(JSON.stringify(claims), "utf8"));
+    const signingInput = `${header}.${body}`;
+    const publicPoint = fromB64url(keys.publicKey);
+    const privateKey = createPrivateKey({
+        format: "jwk",
+        key: {
+            kty: "EC",
+            crv: "P-256",
+            d: keys.privateKey,
+            x: b64url(publicPoint.subarray(1, 33)),
+            y: b64url(publicPoint.subarray(33, 65)),
+        },
+    });
+    const signature = cryptoSign("sha256", Buffer.from(signingInput, "utf8"), { key: privateKey, dsaEncoding: "ieee-p1363" });
+    return `vapid t=${signingInput}.${b64url(signature)}, k=${keys.publicKey}`;
+}
+// ---- endpoint discipline ----------------------------------------------------
+/** The closed allow-list of push services (finding 7): SSRF dies here. */
+const PUSH_HOSTS = [
+    { exact: "fcm.googleapis.com" },
+    { suffix: ".push.apple.com" },
+    { exact: "updates.push.services.mozilla.com" },
+    { suffix: ".push.services.mozilla.com" },
+    { suffix: ".notify.windows.com" },
+];
+export function validatePushEndpoint(raw) {
+    if (raw.length > 1024)
+        return { ok: false, problem: "the endpoint is too long" };
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return { ok: false, problem: "the endpoint is not a URL" };
+    }
+    if (url.protocol !== "https:")
+        return { ok: false, problem: "push endpoints are https" };
+    if (url.username !== "" || url.password !== "" || url.hash !== "")
+        return { ok: false, problem: "the endpoint carries parts a push URL never has" };
+    if (url.port !== "" && url.port !== "443")
+        return { ok: false, problem: "push services answer on 443" };
+    if (/^[0-9.[]/.test(url.hostname))
+        return { ok: false, problem: "push endpoints are named services, not addresses" };
+    const host = url.hostname.toLowerCase();
+    const known = PUSH_HOSTS.some(one => (one.exact !== undefined ? host === one.exact : host.endsWith(one.suffix)));
+    if (!known)
+        return { ok: false, problem: "that host is not a known push service — extending the list is a code change, deliberately" };
+    return { ok: true, url };
+}
+// ---- the payload ------------------------------------------------------------
+/** Fixed words, except for one validated machine-only suite/count line. */
+export const PUSH_WORDS = {
+    decision: { title: "Toolroll", body: "a decision needs you" },
+    pick: { title: "Toolroll", body: "agents finished — pick a winner" },
+    merge: { title: "Toolroll", body: "a pull request needs a person" },
+    attention: { title: "Toolroll", body: "the plane needs attention" },
+    progress: { title: "Toolroll", body: "checks in progress" },
+};
+const LINK_SHAPES = [/^\/next$/, /^\/review$/, /^\/system$/, /^\/routines$/, /^\/routines\/[0-9]{1,15}$/, /^\/d\/[0-9]{1,15}$/, /^\/contest\/[0-9]{1,15}$/, /^\/r\/[0-9]{1,15}$/];
+const CLASS_FALLBACK = {
+    decision: "/next",
+    pick: "/next",
+    merge: "/review",
+    attention: "/next",
+    progress: "/next",
+};
+/** Static words and machine-minted numbers only — re-proved at send time. */
+export function safePushLink(pushClass, link) {
+    if (link !== null && LINK_SHAPES.some(shape => shape.test(link)))
+        return link;
+    return CLASS_FALLBACK[pushClass];
+}
+export function buildPushPayload(notification, waiting = null) {
+    const pushClass = notification.pushClass;
+    const words = PUSH_WORDS[pushClass];
+    return JSON.stringify({
+        title: words.title,
+        body: pushClass === "progress" && isCheckProgressLine(notification.body) ? notification.body : words.body,
+        url: safePushLink(pushClass, notification.link),
+        // The opaque tag collapses a crash-duplicate on the lock screen.
+        tag: pushClass === "progress" && notification.run !== null ? `so-run-${notification.run}` : `so-${notification.id}`,
+        // The app-icon badge (Phase 2E, v2 S4): the server-computed
+        // waiting-on-you COUNT at send time — a number, never content, so the
+        // closed-class discipline holds. The console page recomputes and
+        // clears; a stale push never outranks a fresh page.
+        ...(waiting === null ? {} : { waiting }),
+    });
+}
+function backoffFor(attempts, retryAfter, now) {
+    if (retryAfter !== null) {
+        const seconds = Number(retryAfter);
+        if (Number.isFinite(seconds) && seconds > 0)
+            return new Date(now.getTime() + Math.min(seconds, 7_200) * 1000);
+    }
+    const step = BACKOFF_MS[Math.min(Math.max(attempts - 1, 0), BACKOFF_MS.length - 1)];
+    return new Date(now.getTime() + step);
+}
+/**
+ * One pass: seed, claim, and for each pair — renew, fence, encrypt, send,
+ * settle by the outcome table. Every settle is conditional on the claim's
+ * owner AND generation; a lapsed claim writes nothing.
+ */
+export async function pushPass(store, options) {
+    const clock = options.clock ?? (() => new Date());
+    const owner = options.owner ?? `push-${randomBytes(4).toString("hex")}`;
+    const doFetch = options.fetchImpl ?? (async (url, init) => fetch(url, init));
+    const report = { seeded: 0, accepted: 0, rescheduled: 0, rejected: 0, retired: 0, credentialProblem: false };
+    if (store.isDemo())
+        return report; // a sandbox never pushes
+    const keys = loadOrCreateVapidKeys(options.configDir);
+    // Subscriptions are bound to the key they enrolled under (finding 27):
+    // after a regeneration they reject every message — retire them visibly.
+    report.retired += store.retirePushSubscriptionsOfOtherKeys(keys.fingerprint, clock());
+    report.seeded = store.seedPushPairs(clock());
+    const pairs = store.claimPushPairs(owner, PUSH_CLAIM_TTL_MS, 32, clock());
+    let sawAccepted = false;
+    for (const pair of pairs) {
+        // Renew and re-fence immediately before the network (finding 12).
+        if (!store.renewPushClaim(pair.id, owner, pair.claimGeneration, PUSH_CLAIM_TTL_MS, clock()))
+            continue;
+        const fenced = store.pushSendFence(pair.id, owner, pair.claimGeneration);
+        if (fenced === null)
+            continue; // resolved, retired, rotated, or lost — nothing to send
+        const subscription = fenced.subscriptionRow;
+        const endpoint = validatePushEndpoint(subscription.endpoint);
+        if (!endpoint.ok) {
+            store.retirePushSubscription(subscription.id, "invalid-endpoint", clock());
+            report.retired += 1;
+            continue;
+        }
+        let body;
+        try {
+            body = encryptPushPayload(subscription.p256dh, subscription.auth, 
+            // The badge count rides every push: the same inbox classifier the
+            // console's own sidebar badge reads, unscoped (a phone has no
+            // project pane), computed at send time.
+            buildPushPayload(fenced.notificationRow, store.countInboxScoped(null, clock(), 100, null).count));
+        }
+        catch {
+            // Off-curve or malformed subscriber material: the device, not us.
+            store.retirePushSubscription(subscription.id, "invalid-keys", clock());
+            report.retired += 1;
+            continue;
+        }
+        let status;
+        let retryAfter = null;
+        try {
+            const answer = await doFetch(subscription.endpoint, {
+                method: "POST",
+                redirect: "error",
+                signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+                headers: {
+                    Authorization: vapidAuthorization(subscription.endpoint, keys, clock(), options.contact),
+                    "Content-Encoding": "aes128gcm",
+                    "Content-Type": "application/octet-stream",
+                    TTL: "300",
+                    Urgency: "high",
+                },
+                body,
+            });
+            status = answer.status;
+            retryAfter = answer.headers.get("retry-after");
+        }
+        catch {
+            status = 0; // network / timeout / redirect refusal
+        }
+        // The outcome table (finding 18).
+        if (status >= 200 && status < 300) {
+            if (store.settlePushPair(pair.id, owner, pair.claimGeneration, { kind: "accepted" }, clock()))
+                report.accepted += 1;
+            sawAccepted = true;
+        }
+        else if (status === 404 || status === 410) {
+            store.retirePushSubscription(subscription.id, "gone", clock());
+            report.retired += 1;
+        }
+        else if (status === 400 || status === 413) {
+            if (store.settlePushPair(pair.id, owner, pair.claimGeneration, { kind: "rejected", error: `push service answered ${status}` }, clock())) {
+                report.rejected += 1;
+            }
+        }
+        else if (status === 401 || status === 403) {
+            // A CREDENTIAL problem, never a device problem: no retirement, and
+            // one deduped, UNSTAMPED operator episode (finding 27).
+            report.credentialProblem = true;
+            store.enqueueEpisode(`push-credentials:${keys.fingerprint}`, {
+                source: { installation: true },
+                kind: "push-credentials",
+                subject: "push credentials were rejected",
+                body: "the push service refused this console's signing key — if the key file was replaced, phones must re-enroll from /settings",
+            }, clock().toISOString(), clock());
+            settleRetryOrGiveUp(store, pair.id, owner, pair.claimGeneration, pair.attempts, `push service answered ${status}`, retryAfter, clock(), report);
+        }
+        else {
+            settleRetryOrGiveUp(store, pair.id, owner, pair.claimGeneration, pair.attempts, status === 0 ? "the push service could not be reached" : `push service answered ${status}`, retryAfter, clock(), report);
+        }
+    }
+    // A working credential closes the episode (finding 27).
+    if (sawAccepted)
+        store.resolveEpisodes(`push-credentials:${keys.fingerprint}`, clock());
+    return report;
+}
+function settleRetryOrGiveUp(store, pairId, owner, generation, attempts, error, retryAfter, now, report) {
+    if (attempts + 1 >= MAX_ATTEMPTS) {
+        if (store.settlePushPair(pairId, owner, generation, { kind: "undeliverable", error }, now))
+            report.rejected += 1;
+        return;
+    }
+    if (store.settlePushPair(pairId, owner, generation, { kind: "backoff", nextAttemptAt: backoffFor(attempts + 1, retryAfter, now), error }, now)) {
+        report.rescheduled += 1;
+    }
+}

package/dist/quality.d.ts

@@ -0,0 +1,8 @@
+/**
+ * How much evidence work a task asks Toolroll to do after the
+ * builder finishes. This is deliberately separate from operating modes
+ * (authority/autonomy) and unattended permissions (provider sandboxing).
+ */
+export type QualityMode = "default" | "strict";
+export declare function isQualityMode(value: unknown): value is QualityMode;
+export declare function qualityModeTitle(mode: QualityMode): string;

package/dist/quality.js

@@ -0,0 +1,6 @@
+export function isQualityMode(value) {
+    return value === "default" || value === "strict";
+}
+export function qualityModeTitle(mode) {
+    return mode === "strict" ? "Strict / release" : "Default";
+}

package/dist/recipe-ui.d.ts

@@ -0,0 +1,18 @@
+import { type Recipe, type RecipeDocument, type WorkflowPreview } from "./recipes.js";
+export declare function recipeFromForm(body: URLSearchParams): RecipeDocument;
+export declare function recipeLibraryHtml(starters: Recipe[], saved: Recipe[], project: string | null, csrf: string, revision: number, recent: {
+    name: string;
+    href: string;
+    state: string;
+}[]): string;
+export declare function recipeEditorHtml(recipe: Recipe, repo: string, csrf: string, revision: number, problem?: string | null, values?: URLSearchParams, creator?: boolean): string;
+export declare function workflowPreviewHtml(preview: WorkflowPreview, csrf: string, revision: number, now: Date, readiness: {
+    title: string;
+    detail: string;
+    href?: string;
+}[], auto: boolean): string;
+export declare function recipeDefinitionPreviewHtml(preview: WorkflowPreview, csrf: string, revision: number): string;
+export declare function recipeRunHtml(recipe: Recipe, repo: string, csrf: string, revision: number, problem?: string | null, values?: URLSearchParams, saved?: boolean): string;
+export declare function recipeAnswersFromForm(body: URLSearchParams): Map<string, string>;
+export declare function recipeScript(): string;
+export declare const RECIPE_CSS = "\n.recipe-heading { margin: .5rem 0 1.75rem; max-width: 46rem; }\n.recipe-heading h1 { font-size: clamp(1.65rem,3vw,2.5rem); letter-spacing:-.035em; margin:.35rem 0 .6rem; }\n.recipe-kicker { font-size:.7rem; text-transform:uppercase; letter-spacing:.12em; color:var(--muted-foreground); }\n.recipe-grid { display:grid; grid-template-columns:repeat(3,minmax(0,1fr)); gap:.8rem; margin:1rem 0 2rem; }\n.recipe-card { border:1px solid var(--border); border-radius:var(--radius); padding:1.1rem; background:var(--card); display:flex; flex-direction:column; gap:.5rem; }\n.recipe-card h3 { font-size:1.05rem; margin:0; letter-spacing:-.015em; }\n.recipe-card p { color:var(--muted-foreground); margin:.2rem 0; font-size:.85rem; line-height:1.5; }\n.recipe-card-link { margin-top:auto; padding-top:.75rem; display:flex; justify-content:space-between; }\n.recipe-editor { max-width:52rem; }.recipe-editor h2 { margin-top:0; }\n.recipe-criterion { border:1px solid var(--border); border-radius:calc(var(--radius) - 3px); padding:.8rem; margin:.8rem 0; }\n.recipe-evidence { display:flex; flex-wrap:wrap; gap:.5rem 1rem; }.recipe-evidence label { display:flex; align-items:center; gap:.4rem; font-size:.8rem; }.recipe-evidence input { width:auto; margin:0; }\n.recipe-options { display:grid; grid-template-columns:1fr 1fr; gap:1rem; }\n.recipe-preview-grid { display:grid; grid-template-columns:minmax(0,1.7fr) minmax(16rem,1fr); gap:1rem; }\n.recipe-steps { padding-left:1.4rem; }.recipe-steps li { padding:.4rem 0 .6rem .3rem; }.recipe-steps p { margin:.3rem 0 0; font-size:.85rem; color:var(--muted-foreground); }\n.recipe-launch { display:grid; grid-template-columns:1fr 1fr; gap:1rem; }.recipe-launch form { margin:0 0 .6rem; }\n.recipe-history a { display:flex; justify-content:space-between; gap:1rem; padding:.6rem 0; border-bottom:1px solid var(--border); }.recipe-history span { color:var(--muted-foreground); }\n.recipe-error { border-color:var(--destructive); }\n.recipe-card[hidden] { display:none; }.recipe-search { max-width:28rem; }.recipe-question { border:1px solid var(--border); border-radius:calc(var(--radius) - 3px); margin:1rem 0; padding:.8rem; min-width:0; }.recipe-run { max-width:42rem; }.recipe-run button { margin-top:1rem; }\n@media(max-width:1000px){.recipe-grid { grid-template-columns:repeat(2,minmax(0,1fr)); }}\n@media(max-width:760px){.recipe-grid,.recipe-options,.recipe-preview-grid,.recipe-launch { grid-template-columns:1fr; }.recipe-heading { margin-bottom:1rem; }.recipe-history a { flex-direction:column; gap:.2rem; }}\n";

package/dist/recipe-ui.js

@@ -0,0 +1,152 @@
+import { composerSchedule, scheduleEditorHtml, scheduleEditorScript } from "./task-composer.js";
+import { parseRecipe, workflowSteps, recipeScheduleWords, RecipeError, RECIPE_INPUT_LIMIT } from "./recipes.js";
+import { ACCEPTANCE_LIMITS } from "./scope.js";
+const e = (text) => text.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
+const hidden = (name, value) => `<input type="hidden" name="${e(name)}" value="${e(value)}">`;
+const evidence = [["check", "Passing tests or commands"], ["changed-path", "Changed files"], ["screenshot", "Screenshot"], ["manual-review", "Reviewer assessment"]];
+export function recipeFromForm(body) {
+    for (const name of ["name", "description", "goal", "not", "touches", "planning", "deliverable", "cadence", "repeat", "time", "timezone", "weekday", "interval", "interval-unit", "ceiling", "source", "sourceRevision", "projectRevision", "repo", "preview", "purpose", "sourceFormat"]) {
+        if (body.getAll(name).length > 1)
+            throw new RecipeError(`Choose one ${name} value.`);
+    }
+    if (!["once", "repeat"].includes(body.get("cadence") ?? ""))
+        throw new RecipeError("Choose run once or repeat.");
+    const schedule = body.get("cadence") === "once" ? { ok: true, schedule: null } : composerSchedule(body);
+    if (!schedule.ok)
+        throw new RecipeError(schedule.message);
+    if (body.get("cadence") === "repeat" && schedule.schedule === null)
+        throw new RecipeError("Choose a repeating schedule.");
+    const acceptance = [];
+    for (let i = 0; i < ACCEPTANCE_LIMITS.criteria; i++) {
+        for (const key of ["statement", "how", "id"])
+            if (body.getAll(`criterion-${i}-${key}`).length > 1)
+                throw new RecipeError("A success check has duplicated fields.");
+        const statement = (body.get(`criterion-${i}-statement`) ?? "").trim();
+        const how = (body.get(`criterion-${i}-how`) ?? "").trim();
+        if (!statement && !how)
+            continue;
+        acceptance.push({ id: body.get(`criterion-${i}-id`) || `c${i + 1}`, statement, how: how || null, evidence: body.getAll(`criterion-${i}-evidence`) });
+    }
+    // Never silently omit submitted checks beyond the editor's bounded size.
+    for (const key of body.keys())
+        if (/^criterion-/.test(key) && (!/^criterion-(?:[0-9]|1[01])-(?:statement|how|id|evidence)$/.test(key)))
+            throw new RecipeError("A recipe supports at most 12 success checks.");
+    const inputs = [];
+    for (let i = 0; i < RECIPE_INPUT_LIMIT; i++) {
+        for (const key of ["key", "label", "default"])
+            if (body.getAll(`input-${i}-${key}`).length > 1)
+                throw new RecipeError("A question has duplicated fields.");
+        const key = (body.get(`input-${i}-key`) ?? "").trim(), label = (body.get(`input-${i}-label`) ?? "").trim(), defaultValue = (body.get(`input-${i}-default`) ?? "").trim();
+        if (key || label || defaultValue)
+            inputs.push({ key, label, defaultValue: defaultValue || null });
+    }
+    for (const key of body.keys())
+        if (key.startsWith("input-") && !/^input-[0-7]-(?:key|label|default)$/.test(key))
+            throw new RecipeError("A recipe supports at most 8 questions.");
+    const sourceFormat = body.get("sourceFormat") ?? "1";
+    if (!["1", "2"].includes(sourceFormat))
+        throw new RecipeError("Choose a supported source recipe format.");
+    if (sourceFormat === "2" && inputs.length === 0 && [body.get("name"), body.get("description"), body.get("goal"), body.get("not"), ...acceptance.map(one => one.statement)].some(text => /\{\{|\}\}/.test(text ?? "")))
+        throw new RecipeError("Remove the input placeholders before saving a fixed recipe, or keep a question for each one.");
+    const ceiling = (body.get("ceiling") ?? "").trim();
+    return parseRecipe({ format: "standing-orders-recipe", version: inputs.length ? 2 : 1, ...(inputs.length ? { inputs } : {}), name: body.get("name") ?? "", description: body.get("description") ?? "", goal: body.get("goal") ?? "", outOfScope: body.get("not") || null,
+        touches: (body.get("touches") ?? "").split(/[\n,]/).map(one => one.trim()).filter(Boolean), acceptance, planning: body.get("planning") ?? "auto", deliverable: body.get("deliverable") ?? "branch", schedule: schedule.schedule, costCeilingUsd: ceiling === "" ? null : Number(ceiling) });
+}
+export function recipeLibraryHtml(starters, saved, project, csrf, revision, recent) {
+    const cards = (recipes, reusable = false) => `<div class="recipe-grid"${reusable ? ' data-saved-recipes' : ''}>${recipes.map(recipe => `<article class="recipe-card" data-recipe-card data-recipe-search="${e(recipe.document.name + " " + recipe.document.description)}"><p class="recipe-kicker">${recipe.document.deliverable === "report" ? "Report" : recipe.document.schedule === null ? "One-time work" : "Recurring care"}${recipe.document.version === 2 ? ` · ${recipe.document.inputs.length} question${recipe.document.inputs.length === 1 ? "" : "s"}` : ""}</p><h3>${e(recipe.document.name)}</h3><p>${e(recipe.document.description)}</p><a class="recipe-card-link" href="/recipes/${reusable ? "run" : "start"}?recipe=${e(recipe.id)}&revision=${recipe.revision}">${reusable ? "Use recipe" : "Customize recipe"} <span aria-hidden="true">→</span></a>${reusable ? `<a class="meta" href="/recipes/start?recipe=${e(recipe.id)}&revision=${recipe.revision}">Edit a copy</a>` : ""}</article>`).join("")}</div>`;
+    const savedSection = `<h2>Your project’s recipes</h2>${saved.length >= 100 ? `<p class="meta">Showing 100 recipes, with recently used recipes first.</p>` : ""}${saved.length ? `<p class="hint">Your usual work, ready to go. Recently used recipes come first.</p><label class="recipe-search">Find a recipe<input type="search" data-recipe-search-input placeholder="Search your recipes…"></label>${cards(saved, true)}<p data-recipe-empty hidden>No recipes match. Try another search.</p>` : `<p class="hint">Save work you do often. Teammates with project access can use the same recipe.</p>`}`;
+    return `<div class="recipe-heading"><p class="recipe-kicker">Workflows</p><h1>Good work, on repeat.</h1><p class="hint">Save the work you do often. Answer what changes this time. Kick it off.</p><p><a href="/recipes/new" class="new-task">Create a recipe</a> <a href="/routines">Manage scheduled work →</a></p></div>` +
+        (project === null ? `<div class="card"><strong>Choose a project to get started.</strong><p>Browse recipes now; <a href="/projects">open a project</a> to customize, save, or run one.</p></div>` : "") +
+        (saved.length ? savedSection : "") + `<h2>Start here</h2>${cards(starters)}` + (saved.length ? "" : savedSection) +
+        (recent.length ? `<h2>Recent workflows</h2><div class="card recipe-history">${recent.map(one => `<a href="${e(one.href)}"><strong>${e(one.name)}</strong><span>${e(one.state)} →</span></a>`).join("")}</div>` : "") +
+        (project === null ? "" : `<details class="card"><summary>Import a shared recipe</summary><p class="hint">Paste exported recipe JSON. You’ll review it in this project before creating any work.</p><form method="post" action="/recipes/import">${hidden("csrf", csrf)}${hidden("repo", project)}${hidden("projectRevision", String(revision))}<label>Recipe JSON<textarea name="document" rows="7" required maxlength="32768" spellcheck="false"></textarea></label><button type="submit">Review imported recipe</button></form></details>`);
+}
+function criterionHtml(index, criterion, values) {
+    const prefix = `criterion-${index}-`;
+    const value = (name, fallback) => values?.get(prefix + name) ?? fallback;
+    const selected = values ? values.getAll(prefix + "evidence") : criterion?.evidence ?? ["check"];
+    return `<fieldset class="recipe-criterion"><legend>${criterion || index === 0 ? `Success check ${index + 1}` : "Additional success check (optional)"}</legend>${hidden(prefix + "id", value("id", criterion?.id ?? `c${index + 1}`))}<label>What should be true?<textarea name="${prefix}statement" rows="2" maxlength="300">${e(value("statement", criterion?.statement ?? ""))}</textarea></label><div class="recipe-evidence">${evidence.map(([id, label]) => `<label><input type="checkbox" name="${prefix}evidence" value="${id}"${selected.includes(id) ? " checked" : ""}>${label}</label>`).join("")}</div><label>How to check it <span class="meta">optional; command or review instructions</span><input type="text" name="${prefix}how" value="${e(value("how", criterion?.how ?? ""))}" maxlength="500"></label></fieldset>`;
+}
+export function recipeEditorHtml(recipe, repo, csrf, revision, problem = null, values, creator = false) {
+    const d = recipe.document;
+    const value = (name, fallback) => values?.get(name) ?? fallback;
+    const cadence = value("cadence", d.schedule === null ? "once" : "repeat");
+    const planning = value("planning", d.planning), deliverable = value("deliverable", d.deliverable);
+    const count = values ? Math.min(ACCEPTANCE_LIMITS.criteria, Math.max(d.acceptance.length + 1, ...[...values.keys()].map(key => Number(/^criterion-(\d+)-statement$/.exec(key)?.[1] ?? -1) + 1))) : Math.min(ACCEPTANCE_LIMITS.criteria, d.acceptance.length + 1);
+    return `<a href="/recipes" class="meta">← All recipes</a><div class="recipe-heading"><p class="recipe-kicker">${creator ? "1 · Describe → 2 · Preview → 3 · Save" : "1 · Choose → 2 · Customize → 3 · Preview"}</p><h1>${creator ? "Create a reusable recipe" : "Make this workflow yours"}</h1><p class="hint">${e(repo.split(/[\\/]/).pop() || repo)} · Choose the outcome, boundaries, and proof you want back.</p></div>` +
+        (problem === null ? "" : `<p role="alert" class="card recipe-error">${e(problem)}</p>`) +
+        `<form method="post" action="/recipes/preview" class="recipe-editor">${hidden("csrf", csrf)}${hidden("repo", repo)}${hidden("projectRevision", String(revision))}${hidden("source", recipe.id)}${hidden("sourceRevision", String(recipe.revision))}${hidden("sourceFormat", value("sourceFormat", String(d.version)))}` +
+        `<section class="card"><h2>The outcome</h2><label>${creator ? "Recipe name" : "Workflow name"}<input type="text" name="name" value="${e(value("name", d.name))}" maxlength="200" required></label><label>Short description<input type="text" name="description" value="${e(value("description", d.description))}" maxlength="400"></label><label>What should the agent do?<textarea name="goal" rows="5" maxlength="2000" required>${e(value("goal", d.goal))}</textarea></label><label>What should it leave alone?<textarea name="not" rows="3" maxlength="2000">${e(value("not", d.outOfScope ?? ""))}</textarea></label><label>Allowed files or folders <span class="meta">optional; one per line</span><textarea name="touches" rows="2" placeholder="src/&#10;tests/">${e(value("touches", d.touches.join("\n")))}</textarea></label><p class="meta">Blank allows work across this project. Add paths to keep the workflow focused.</p></section>` +
+        recipeQuestionsHtml(d, values) +
+        `<section class="card"><h2>What does success look like?</h2><p class="hint">Give each outcome the evidence you want to see. The workflow checks these before calling the work done.</p><div data-recipe-criteria>${Array.from({ length: count }, (_, i) => criterionHtml(i, d.acceptance[i], values)).join("")}</div><button type="button" data-add-criterion hidden>Add another success check</button><template data-criterion-template>${criterionHtml(11).replaceAll("criterion-11-", "criterion-INDEX-").replaceAll('value="c12"', 'value="cNEXT"')}</template></section>` +
+        `<section class="card"><h2>How it should run</h2><div class="recipe-options"><label>Result<select name="deliverable"><option value="branch"${deliverable === "branch" ? " selected" : ""}>Code change with evidence</option><option value="report"${deliverable === "report" ? " selected" : ""}>Report without code changes</option></select></label><label>Planning<select name="planning">${[["auto", "Plan when helpful"], ["required", "Always plan first"], ["skip", "Use this scope directly"]].map(([id, label]) => `<option value="${id}"${planning === id ? " selected" : ""}>${label}</option>`).join("")}</select></label></div><p class="meta">Report work investigates directly. Repeating work reuses its approved scope; plan-first workflows run once.</p><label>Frequency<select name="cadence" data-recipe-cadence><option value="once"${cadence === "once" ? " selected" : ""}>Run once</option><option value="repeat"${cadence === "repeat" ? " selected" : ""}>Repeat on a schedule</option></select></label><div data-recipe-recurring>${scheduleEditorHtml(d.schedule, values)}<label>Weekly spending limit <span class="meta">optional, USD</span><input type="number" name="ceiling" min="0.01" step="0.01" value="${e(value("ceiling", d.costCeilingUsd === null ? "" : String(d.costCeilingUsd)))}"></label><p class="meta">One instance at a time. A spending limit requires an agent that reports dollar costs; approval checks this.</p></div></section>` +
+        `<div class="sticky-actions"><button type="submit" name="purpose" value="${creator ? "recipe" : "workflow"}">${creator ? "Preview recipe →" : "Preview workflow →"}</button>${creator ? "" : `<button type="submit" name="purpose" value="recipe" class="quiet">Preview recipe to save</button>`}<p class="meta">${creator ? "Save the instructions once. You can use the recipe whenever this work comes up." : "Previewing runs no agents. You’ll see the approval and scheduling steps next."}</p></div></form>`;
+}
+export function workflowPreviewHtml(preview, csrf, revision, now, readiness, auto) {
+    const d = preview.document;
+    const common = hidden("csrf", csrf) + hidden("repo", preview.repo) + hidden("projectRevision", String(revision)) + hidden("preview", preview.token);
+    const target = preview.taskId === null ? preview.routineId === null ? null : `/routines/${preview.routineId}` : `/t/${encodeURIComponent(preview.taskId)}`;
+    return `<a href="/recipes/edit?preview=${preview.token}" class="meta">← Edit this workflow</a><div class="recipe-heading"><p class="recipe-kicker">3 · Preview</p><h1>${e(d.name)}</h1><p class="hint">${e(d.description)}</p></div>` +
+        `<div class="recipe-preview-grid"><div><section class="card"><h2>What will happen</h2><ol class="recipe-steps">${workflowSteps(d).map(step => `<li><strong>${e(step.title)}</strong><p>${e(step.detail)}</p></li>`).join("")}</ol></section><section class="card"><h2>The agreed work</h2><p class="recap">${e(d.goal)}</p><h3>Leave alone</h3><p class="recap">${e(d.outOfScope ?? "No additional exclusions.")}</p><h3>Allowed paths</h3><p>${d.touches.length ? d.touches.map(e).join(", ") : "This project"}</p><h3>Success checks</h3><ul>${d.acceptance.map(c => `<li><strong>${e(c.statement)}</strong><p class="meta">${c.evidence.map(kind => e(evidence.find(([id]) => id === kind)?.[1] ?? kind)).join(" · ")}${c.how ? ` · ${e(c.how)}` : ""}</p></li>`).join("")}</ul></section></div>` +
+        `<aside><section class="card"><h2>Before it starts</h2>${readiness.map(one => `<p><strong>${e(one.title)}</strong><br><span class="meta">${e(one.detail)}${one.href ? ` <a href="${e(one.href)}">Open settings →</a>` : ""}</span></p>`).join("")}<p class="meta">These checks describe current setup. Agent availability and approval are checked again when work starts.</p></section><section class="card"><h2>Schedule & control</h2><p>${e(recipeScheduleWords(d, now))}</p><p>${d.costCeilingUsd === null ? "Uses existing project and agent budget controls." : `Up to $${d.costCeilingUsd.toFixed(2)} per rolling seven days.`}</p><p>${d.schedule !== null ? "Approve the routine once on the next screen. Pause it any time from scheduled work." : auto ? "Your signed project policy will be evaluated when you create this workflow." : "Review and approve on the task page. You can stop or resume there."}</p></section></aside></div>` +
+        `<div class="card recipe-launch"><div>${target ? `<a class="new-task" href="${target}">Open created workflow →</a>` : `<form method="post" action="/recipes/launch">${common}<button type="submit">${d.schedule !== null ? "Create scheduled workflow" : auto ? "Create workflow" : "Create task for approval"}</button></form>`}<p class="meta">${d.schedule !== null ? "Nothing repeats until the routine is approved." : "A matching signed policy may start work automatically."} Creating this workflow twice returns the same work.</p></div><div>${preview.savedId ? `<a href="/recipes/start?recipe=${preview.savedId}&revision=${preview.savedRevision}">Recipe saved · reuse it →</a>` : `<form method="post" action="/recipes/save">${common}<button type="submit" class="quiet">Save as a project recipe</button></form>`}<a href="/recipes/export?preview=${preview.token}">Export recipe JSON</a><p class="meta">Save or export without running anything. Sharing includes the work definition, never project access or approvals.</p></div></div>`;
+}
+function inputHtml(index, input, values) {
+    const value = (field, fallback) => values?.get(`input-${index}-${field}`) ?? fallback;
+    return `<fieldset class="recipe-question"><legend>Question ${index + 1}</legend><div class="recipe-options"><label>Short key<input type="text" name="input-${index}-key" value="${e(value("key", input?.key ?? ""))}" maxlength="32" placeholder="module" pattern="[a-z][a-z0-9_]{0,31}"></label><label>What should we ask?<input type="text" name="input-${index}-label" value="${e(value("label", input?.label ?? ""))}" maxlength="80" placeholder="Which module should we work on?"></label></div><label>Default answer <span class="meta">optional</span><input type="text" name="input-${index}-default" value="${e(value("default", input?.defaultValue ?? ""))}" maxlength="500"></label><p class="meta">Use <code data-question-token>{{${e(value("key", input?.key ?? "module")) || "module"}}}</code> in your instructions or a success check. Clear this row and its placeholders to remove the question.</p><button type="button" data-insert-question hidden>Insert into instructions</button></fieldset>`;
+}
+function recipeQuestionsHtml(document, values) {
+    const inputs = document.version === 2 ? document.inputs : [];
+    const submitted = values ? [...values.keys()].filter(key => /^input-[0-7]-/.test(key)).map(key => Number(key.split("-")[1]) + 1) : [];
+    const count = Math.min(RECIPE_INPUT_LIMIT, Math.max(1, inputs.length, ...submitted));
+    return `<details class="card"${inputs.length || submitted.some(i => values?.get(`input-${i - 1}-key`)) ? " open" : ""}><summary>Ask something each time <span class="meta">optional</span></summary><p class="hint">For example: “Test {{module}} and cover {{scenario}}.” Add a question for each placeholder. People answer these when they use the recipe; the saved instructions stay the same.</p><p class="meta">Use answers in the name, instructions, exclusions, or success checks. Keep allowed paths and check commands fixed. Don’t ask for passwords or keys.</p><div data-recipe-questions>${Array.from({ length: count }, (_, i) => inputHtml(i, inputs[i], values)).join("")}</div><button type="button" data-add-question hidden>Add a question</button><template data-question-template>${inputHtml(7).replaceAll("input-7-", "input-INDEX-").replace("Question 8", "Question NEXT")}</template></details>`;
+}
+export function recipeDefinitionPreviewHtml(preview, csrf, revision) {
+    const d = preview.document;
+    const inputs = d.version === 2 ? d.inputs : [];
+    return `<a class="meta" href="/recipes/edit?preview=${preview.token}&purpose=recipe">← Edit recipe</a><div class="recipe-heading"><p class="recipe-kicker">2 · Preview your recipe</p><h1>${e(d.name)}</h1><p class="hint">${e(d.description || "A reusable starting point for work you do often.")}</p></div><section class="card"><h2>When someone uses this recipe</h2>${inputs.length ? `<ol>${inputs.map(input => `<li><strong>${e(input.label)}</strong><p class="meta">{{${e(input.key)}}}${input.defaultValue ? ` · Default: ${e(input.defaultValue)}` : " · Answer required each time"}</p></li>`).join("")}</ol>` : `<p>No questions to answer. The saved scope is ready to preview and use.</p>`}<p>Each use previews the exact work before creating it. The project’s approval and recovery settings still apply.</p></section><section class="card"><h2>Saved instructions</h2><p class="recap">${e(d.goal)}</p><h3>Leave alone</h3><p class="recap">${e(d.outOfScope ?? "No additional exclusions.")}</p><h3>Allowed paths</h3><p>${d.touches.map(e).join(", ") || "This project"}</p><h3>Success checks</h3><ul>${d.acceptance.map(one => `<li>${e(one.statement)}<p class="meta">${one.evidence.map(kind => e(evidence.find(([id]) => id === kind)?.[1] ?? kind)).join(" · ")}${one.how ? ` · ${e(one.how)}` : ""}</p></li>`).join("")}</ul><p class="meta">${d.deliverable === "report" ? "Report" : "Code change"} · ${d.schedule === null ? "Run once" : e(d.schedule)} · ${d.planning === "required" ? "Plan first" : d.planning === "auto" ? "Plan when helpful" : "Use the approved scope directly"}${d.costCeilingUsd === null ? "" : ` · $${d.costCeilingUsd} weekly limit`}</p></section><section class="card recipe-launch"><div>${preview.savedId ? `<a class="new-task" href="/recipes/run?recipe=${preview.savedId}&revision=${preview.savedRevision}">Use recipe →</a>` : `<form method="post" action="/recipes/save">${hidden("csrf", csrf)}${hidden("repo", preview.repo)}${hidden("projectRevision", String(revision))}${hidden("preview", preview.token)}${hidden("next", "use")}<button type="submit">Save recipe</button></form>`}<p class="meta">Saving creates no work. Everyone with project access can reuse this copy.</p></div><a href="/recipes/export?preview=${preview.token}">Export recipe JSON</a></section>`;
+}
+export function recipeRunHtml(recipe, repo, csrf, revision, problem = null, values, saved = false) {
+    const d = recipe.document, inputs = d.version === 2 ? d.inputs : [];
+    return `<a class="meta" href="/recipes">← Your recipes</a><div class="recipe-heading"><p class="recipe-kicker">${saved ? "Recipe saved · ready when you are" : "Use a recipe"}</p><h1>${e(d.name)}</h1><p class="hint">${e(d.description || "Your saved instructions, ready to use again.")}</p></div>${problem ? `<p role="alert" class="card recipe-error">${e(problem)}</p>` : ""}<form class="recipe-run card" method="post" action="/recipes/prepare">${hidden("csrf", csrf)}${hidden("repo", repo)}${hidden("projectRevision", String(revision))}${hidden("recipe", recipe.id)}${hidden("recipeRevision", String(recipe.revision))}<h2>${inputs.length ? "What changes this time?" : "Ready to go"}</h2>${inputs.map(input => `<label>${e(input.label)}<textarea name="answer-${e(input.key)}" rows="2" maxlength="500" required>${e(values?.get(`answer-${input.key}`) ?? input.defaultValue ?? "")}</textarea></label>`).join("")}${inputs.length ? "" : `<p>No setup to repeat. Preview the saved scope and create the work.</p>`}<p class="meta">${d.schedule === null ? "Creates one task each time you use this recipe." : "Creates a new schedule with these answers fixed for every firing. Manage an existing schedule from Routines."}</p><button type="submit">Preview this run →</button><p class="meta">Previewing starts no agents. Existing project approvals apply when you create work.</p></form><details class="card"><summary>Saved instructions and boundaries</summary><p class="recap">${e(d.goal)}</p><p class="recap">Leave alone: ${e(d.outOfScope ?? "No additional exclusions.")}</p><p>Allowed paths: ${d.touches.map(e).join(", ") || "This project"}</p><ul>${d.acceptance.map(one => `<li>${e(one.statement)}</li>`).join("")}</ul><a href="/recipes/start?recipe=${e(recipe.id)}&revision=${recipe.revision}">Edit a copy of this recipe →</a></details>`;
+}
+export function recipeAnswersFromForm(body) {
+    const answers = new Map();
+    for (const key of body.keys())
+        if (key.startsWith("answer-")) {
+            if (body.getAll(key).length !== 1)
+                throw new RecipeError("A question has more than one answer.");
+            answers.set(key.slice(7), body.get(key));
+        }
+    return answers;
+}
+export function recipeScript() {
+    return scheduleEditorScript() + `(function(){
+    document.querySelectorAll('[data-recipe-cadence]').forEach(function(choice){var root=choice.form.querySelector('[data-recipe-recurring]');function update(){root.hidden=choice.value!=='repeat';root.querySelector('[name=ceiling]').disabled=choice.value!=='repeat';}choice.addEventListener('change',update);update();});
+    var button=document.querySelector('[data-add-criterion]');if(button){button.hidden=false;button.addEventListener('click',function(){var root=document.querySelector('[data-recipe-criteria]'),index=root.children.length;if(index>=12)return;var html=document.querySelector('[data-criterion-template]').innerHTML.replaceAll('criterion-INDEX-','criterion-'+index+'-').replaceAll('value="cNEXT"','value="c'+(index+1)+'"');root.insertAdjacentHTML('beforeend',html);root.lastElementChild.querySelector('textarea').focus();button.hidden=index>=11;});}
+    var addQuestion=document.querySelector('[data-add-question]');if(addQuestion){var questions=document.querySelector('[data-recipe-questions]');function enhanceQuestion(row){var insert=row.querySelector('[data-insert-question]');insert.hidden=false;insert.addEventListener('click',function(){var key=row.querySelector('input[name$="-key"]');if(!/^[a-z][a-z0-9_]{0,31}$/.test(key.value)){key.focus();return;}var goal=addQuestion.form.querySelector('[name=goal]');goal.setRangeText(' {{'+key.value+'}} ',goal.selectionStart,goal.selectionEnd,'end');goal.dispatchEvent(new Event('input',{bubbles:true}));goal.focus();});}questions.querySelectorAll('fieldset').forEach(enhanceQuestion);addQuestion.hidden=questions.children.length>=8;addQuestion.addEventListener('click',function(){var index=questions.children.length;if(index>=8)return;questions.insertAdjacentHTML('beforeend',document.querySelector('[data-question-template]').innerHTML.replaceAll('input-INDEX-','input-'+index+'-').replace('Question NEXT','Question '+(index+1)));enhanceQuestion(questions.lastElementChild);questions.lastElementChild.querySelector('input').focus();addQuestion.hidden=index>=7;});questions.addEventListener('input',function(event){if(event.target.name.endsWith('-key'))event.target.closest('fieldset').querySelector('[data-question-token]').textContent='{{'+(event.target.value||'module')+'}}';});}
+    var search=document.querySelector('[data-recipe-search-input]');if(search)search.addEventListener('input',function(){var query=search.value.trim().toLowerCase(),shown=0;document.querySelectorAll('[data-saved-recipes] [data-recipe-card]').forEach(function(card){var visible=card.dataset.recipeSearch.toLowerCase().includes(query);card.hidden=!visible;if(visible)shown++;});document.querySelector('[data-recipe-empty]').hidden=shown>0;});
+  })();`;
+}
+export const RECIPE_CSS = `
+.recipe-heading { margin: .5rem 0 1.75rem; max-width: 46rem; }
+.recipe-heading h1 { font-size: clamp(1.65rem,3vw,2.5rem); letter-spacing:-.035em; margin:.35rem 0 .6rem; }
+.recipe-kicker { font-size:.7rem; text-transform:uppercase; letter-spacing:.12em; color:var(--muted-foreground); }
+.recipe-grid { display:grid; grid-template-columns:repeat(3,minmax(0,1fr)); gap:.8rem; margin:1rem 0 2rem; }
+.recipe-card { border:1px solid var(--border); border-radius:var(--radius); padding:1.1rem; background:var(--card); display:flex; flex-direction:column; gap:.5rem; }
+.recipe-card h3 { font-size:1.05rem; margin:0; letter-spacing:-.015em; }
+.recipe-card p { color:var(--muted-foreground); margin:.2rem 0; font-size:.85rem; line-height:1.5; }
+.recipe-card-link { margin-top:auto; padding-top:.75rem; display:flex; justify-content:space-between; }
+.recipe-editor { max-width:52rem; }.recipe-editor h2 { margin-top:0; }
+.recipe-criterion { border:1px solid var(--border); border-radius:calc(var(--radius) - 3px); padding:.8rem; margin:.8rem 0; }
+.recipe-evidence { display:flex; flex-wrap:wrap; gap:.5rem 1rem; }.recipe-evidence label { display:flex; align-items:center; gap:.4rem; font-size:.8rem; }.recipe-evidence input { width:auto; margin:0; }
+.recipe-options { display:grid; grid-template-columns:1fr 1fr; gap:1rem; }
+.recipe-preview-grid { display:grid; grid-template-columns:minmax(0,1.7fr) minmax(16rem,1fr); gap:1rem; }
+.recipe-steps { padding-left:1.4rem; }.recipe-steps li { padding:.4rem 0 .6rem .3rem; }.recipe-steps p { margin:.3rem 0 0; font-size:.85rem; color:var(--muted-foreground); }
+.recipe-launch { display:grid; grid-template-columns:1fr 1fr; gap:1rem; }.recipe-launch form { margin:0 0 .6rem; }
+.recipe-history a { display:flex; justify-content:space-between; gap:1rem; padding:.6rem 0; border-bottom:1px solid var(--border); }.recipe-history span { color:var(--muted-foreground); }
+.recipe-error { border-color:var(--destructive); }
+.recipe-card[hidden] { display:none; }.recipe-search { max-width:28rem; }.recipe-question { border:1px solid var(--border); border-radius:calc(var(--radius) - 3px); margin:1rem 0; padding:.8rem; min-width:0; }.recipe-run { max-width:42rem; }.recipe-run button { margin-top:1rem; }
+@media(max-width:1000px){.recipe-grid { grid-template-columns:repeat(2,minmax(0,1fr)); }}
+@media(max-width:760px){.recipe-grid,.recipe-options,.recipe-preview-grid,.recipe-launch { grid-template-columns:1fr; }.recipe-heading { margin-bottom:1rem; }.recipe-history a { flex-direction:column; gap:.2rem; }}
+`;