pandorga 1.2.1

data/scripts/test/test-withdrawn-content-export.rb

@@ -0,0 +1,69 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+# Objects taken down for copyright / unpublished drafts must not re-enter the
+# public export. The R2 sync deletes remote keys that are absent locally, so
+# this list is also the prune set for a clean publish.
+
+$stdout.sync = true
+$stderr.sync = true
+
+require "json"
+require "open3"
+require "pathname"
+require "tmpdir"
+
+require_relative "../lib/withdrawn_public_objects"
+
+REPO_ROOT = Pathname.new(__dir__).join("..", "..").expand_path
+EXPORT_SCRIPT = REPO_ROOT.join("scripts/content/export-content-json.rb")
+
+WITHDRAWN_EXPORT_PATHS = WithdrawnPublicObjects::EXPORT_PATHS
+STALE_PUBLIC_PHRASES = WithdrawnPublicObjects::STALE_PHRASES
+
+def fail!(message)
+  warn message
+  exit 1
+end
+
+def check!(condition, message)
+  fail!(message) unless condition
+end
+
+def check_export!(out)
+  manifest = JSON.parse(out.join("manifest.json").read)
+  listed = Array(manifest["files"]).flat_map { |_key, paths| Array(paths) }
+
+  WITHDRAWN_EXPORT_PATHS.each do |relative|
+    check!(!out.join(relative).exist?, "export wrote withdrawn object #{relative}")
+    check!(!listed.include?(relative), "manifest lists withdrawn object #{relative}")
+  end
+
+  export_text = out.glob("**/*.json").map(&:read).join("\n")
+  STALE_PUBLIC_PHRASES.each do |phrase|
+    check!(!export_text.include?(phrase), "export still contains withdrawn phrase #{phrase.inspect}")
+  end
+end
+
+puts "Testing withdrawn objects stay out of the public export..."
+
+existing = ARGV[0]
+if existing
+  out = Pathname.new(existing).expand_path
+  check!(out.directory?, "export dir missing: #{out}")
+  check_export!(out)
+else
+  Dir.mktmpdir("withdrawn-content-export-") do |dir|
+    out = Pathname.new(dir).join("export")
+    stdout, stderr, status = Open3.capture3(
+      { "CONTENT_API_BASE_URL" => "" },
+      "ruby", EXPORT_SCRIPT.to_s, "content", out.to_s,
+      chdir: REPO_ROOT.to_s
+    )
+    fail!("export failed:\n#{stderr}\n#{stdout}") unless status.success?
+
+    check_export!(out)
+  end
+end
+
+puts "Withdrawn content export OK."

data/scripts/test/test-writing-index-export-slugs.rb

@@ -0,0 +1,84 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+# writing_index slugs must point at exported JSON (08-23 vs 08-22 class of bug).
+
+$stdout.sync = true
+$stderr.sync = true
+
+require "fileutils"
+require "json"
+require "pathname"
+require "tmpdir"
+
+require_relative "../lib/writing_index_contract"
+
+def fail!(message)
+  warn message
+  exit 1
+end
+
+def check!(condition, message)
+  fail!(message) unless condition
+end
+
+puts "Testing writing_index ↔ export slug contract..."
+
+Dir.mktmpdir("writing-index-slugs-") do |dir|
+  root = Pathname.new(dir)
+  FileUtils.mkdir_p(root.join("collections/articles"))
+  FileUtils.mkdir_p(root.join("data"))
+
+  root.join("collections/articles/2026-08-22-freshy-cooling-map.json").write(<<~JSON)
+    {"type":"article","slug":"2026-08-22-freshy-cooling-map","key":"freshy-cooling-map"}
+  JSON
+
+  matching = [
+    {
+      "slug" => "2026-08-22-freshy-cooling-map",
+      "key" => "freshy-cooling-map",
+      "type" => "articles",
+      "collection" => "articles"
+    }
+  ]
+  check!(WritingIndexContract.mismatches(root, matching).empty?,
+         "matching 08-22 slug must pass")
+
+  stale = [
+    {
+      "slug" => "2026-08-23-freshy-cooling-map",
+      "key" => "freshy-cooling-map",
+      "type" => "articles",
+      "collection" => "articles"
+    }
+  ]
+  errors = WritingIndexContract.mismatches(root, stale)
+  check!(!errors.empty?, "08-23 index vs 08-22 file must fail")
+  check!(errors.any? { |line| line.include?("2026-08-23-freshy-cooling-map") },
+         "mismatch should name the bad slug (#{errors.inspect})")
+
+  root.join("data/writing_index.json").write(JSON.pretty_generate(stale))
+  begin
+    WritingIndexContract.assert_slugs_match_export!(root)
+    fail!("assert_slugs_match_export! should raise on 08-23 vs 08-22")
+  rescue RuntimeError => e
+    check!(e.message.include?("2026-08-23-freshy-cooling-map"),
+           "assertion message should include the stale slug")
+  end
+end
+
+puts "writing_index export slug contract OK"
+
+existing = ARGV[0]
+if existing
+  out = Pathname.new(existing).expand_path
+  check!(out.directory?, "export dir missing: #{out}")
+  WritingIndexContract.assert_slugs_match_export!(out)
+  index = JSON.parse(out.join("data/writing_index.json").read)
+  freshy = index.find { |entry| entry["key"] == "freshy-cooling-map" }
+  if freshy
+    check!(out.join("collections/articles/#{freshy['slug']}.json").file?,
+           "Freshy writing_index slug must match collections/articles/#{freshy['slug']}.json")
+  end
+  puts "writing_index slugs match #{out}"
+end

data/scripts/test/test-writing-slug-limits.rb

@@ -0,0 +1,61 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require "tmpdir"
+require "fileutils"
+require "pathname"
+
+require_relative "../../_plugins/writing_slug_limits"
+
+def check!(condition, message = "condition was false")
+  raise "Assertion failed: #{message}" unless condition
+end
+
+def assert_equal(expected, actual, message = nil)
+  return if expected == actual
+
+  label = message || "expected #{expected.inspect}, got #{actual.inspect}"
+  raise "Assertion failed: #{label}"
+end
+
+def with_temp_writing_tree
+  Dir.mktmpdir("writing-slug-limits") do |tmpdir|
+    root = Pathname.new(tmpdir)
+    yield root
+  end
+end
+
+puts "Testing WritingSlugLimits..."
+
+check! WritingSlugLimits.ascii_slug?("2026-06-26-escarnio")
+check! !WritingSlugLimits.ascii_slug?("2026-06-26-escárnio"), "accented slug should not be ASCII"
+
+assert_equal "2026-06-26-escarnio", WritingSlugLimits.transliterate_slug("2026-06-26-escárnio")
+assert_equal "2026-04-16-otimismo-na-ciencia", WritingSlugLimits.transliterate_slug("2026-04-16-otimismo-na-ciência")
+assert_equal "2026-06-24-por-que-eu-sai-do-mundo-do-drone", WritingSlugLimits.transliterate_slug("2026-06-24-por-que-eu-saí-do-mundo-do-drone")
+
+with_temp_writing_tree do |root|
+  posts_dir = root.join("content/collections/posts")
+  FileUtils.mkdir_p(posts_dir)
+  File.write(posts_dir.join("2026-06-26-escárnio.md"), "---\ntitle: Test\n---\n")
+
+  errors = WritingSlugLimits.collect_errors(root)
+  check! errors.any? { |error| error.include?("non-ASCII") }, "expected non-ASCII slug error"
+  check! errors.any? { |error| error.include?("2026-06-26-escarnio") }, "expected transliterated suggestion"
+end
+
+with_temp_writing_tree do |root|
+  posts_dir = root.join("content/collections/posts")
+  FileUtils.mkdir_p(posts_dir)
+  long_slug = "#{'a' * 45}"
+  File.write(posts_dir.join("#{long_slug}.md"), "---\ntitle: Test\n---\n")
+
+  errors = WritingSlugLimits.collect_errors(root)
+  check! errors.any? { |error| error.include?("chars (max #{WritingSlugLimits::MAX_LENGTH})") },
+         "expected length error"
+end
+
+repo_errors = WritingSlugLimits.collect_errors(Pathname.new(__dir__).join("..", ".."))
+check! repo_errors.empty?, "repository slug validation failed:\n  - #{repo_errors.join("\n  - ")}"
+
+puts "All WritingSlugLimits tests passed."

data/scripts/test/test-xcite-chronology.rb

@@ -0,0 +1,106 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+# Gate: article/post xcite targets must not be editorially newer than the source.
+# Projects and products may be cited from any dated piece. Same-day companions
+# (EN/PT pairs) may cite each other.
+
+require "date"
+require "pathname"
+require "yaml"
+
+REPO_ROOT = Pathname.new(__dir__).join("..", "..").expand_path
+XCITE_RE = /\{%-?\s*include\s+xcite\.html\s+([^%]+?)-?%\}/i
+KEY_ATTR_RE = /key\s*=\s*["']([^"']+)["']/i
+DATED_KINDS = %w[articles posts].freeze
+FREE_KINDS = %w[projects products].freeze
+
+def check!(condition, message)
+  raise message unless condition
+end
+
+def load_front_matter(path)
+  text = path.read
+  return [{}, ""] unless text.start_with?("---")
+
+  parts = text.split("---", 3)
+  return [{}, text] if parts.length < 3
+
+  [YAML.safe_load(parts[1], permitted_classes: [Date, Time]) || {}, parts[2]]
+end
+
+def editorial_date(path, front_matter)
+  raw = front_matter["date"]
+  case raw
+  when Date then return raw.iso8601
+  when Time then return raw.to_date.iso8601
+  when String
+    day = raw.strip[0, 10]
+    return day if day.match?(/\A\d{4}-\d{2}-\d{2}\z/)
+  end
+
+  stem = path.basename.to_s
+  return Regexp.last_match(1) if stem =~ /\A(\d{4}-\d{2}-\d{2})-/
+
+  nil
+end
+
+def infer_key(path, front_matter, kind)
+  key = front_matter["key"].to_s.strip
+  return key unless key.empty?
+
+  stem = path.basename(".md").to_s
+  return stem.sub(/\A\d{4}-\d{2}-\d{2}-/, "") if DATED_KINDS.include?(kind)
+
+  stem
+end
+
+puts "Testing xcite chronology (newer texts cite older texts; projects/products free)..."
+
+entries = {}
+(DATED_KINDS + FREE_KINDS).each do |kind|
+  dir = REPO_ROOT.join("content/collections", kind)
+  next unless dir.directory?
+
+  dir.glob("*.md").each do |path|
+    front_matter, body = load_front_matter(path)
+    key = infer_key(path, front_matter, kind)
+    check!(!key.empty?, "missing key for #{path.relative_path_from(REPO_ROOT)}")
+
+    entries[key] = {
+      "kind" => kind,
+      "path" => path.relative_path_from(REPO_ROOT).to_s,
+      "date" => editorial_date(path, front_matter),
+      "body" => body
+    }
+  end
+end
+
+violations = []
+DATED_KINDS.each do |kind|
+  entries.each_value do |source|
+    next unless source["kind"] == kind
+
+    source["body"].scan(XCITE_RE).flatten.each do |attrs|
+      match = KEY_ATTR_RE.match(attrs)
+      next unless match
+
+      target_key = match[1]
+      target = entries[target_key]
+      check!(!target.nil?, "unknown xcite key #{target_key.inspect} in #{source['path']}")
+      next if FREE_KINDS.include?(target["kind"])
+      next unless DATED_KINDS.include?(target["kind"])
+
+      src_date = source["date"]
+      tgt_date = target["date"]
+      check!(!src_date.to_s.empty?, "missing editorial date for #{source['path']}")
+      check!(!tgt_date.to_s.empty?, "missing editorial date for #{target['path']}")
+      next if src_date >= tgt_date
+
+      violations << "#{source['path']} (#{src_date}) cites newer #{target['path']} (#{tgt_date}) via key=#{target_key}"
+    end
+  end
+end
+
+check!(violations.empty?, "xcite chronology violations:\n  #{violations.join("\n  ")}")
+puts "All xcite chronology checks passed (#{entries.size} keyed entries)."

data/scripts/validate.sh

@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+# Platform gates that run against the gem / fixtures / examples.
+# Content-corpus gates stay on the consuming site (website).
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$ROOT"
+
+echo "== pandorga validate =="
+
+# Prefer Bundler so gemspec deps (jekyll, …) resolve the same way in CI and
+# local checkouts. Plain `ruby` only sees the system/mise gem path.
+if [[ -f "${ROOT}/Gemfile.lock" ]] && command -v bundle >/dev/null 2>&1; then
+  if command -v mise >/dev/null 2>&1; then
+    RUBY=(mise exec -- bundle exec ruby)
+  else
+    RUBY=(bundle exec ruby)
+  fi
+elif command -v mise >/dev/null 2>&1; then
+  RUBY=(mise exec -- ruby)
+else
+  RUBY=(ruby)
+fi
+
+export RUBYOPT="-I${ROOT}/lib${RUBYOPT:+ $RUBYOPT}"
+
+# Explicit allowlist — do not glob site-corpus tests copied during extraction.
+TESTS=(
+  scripts/test/test-doctor.rb
+  scripts/test/test-new.rb
+  scripts/test/test-export.rb
+  scripts/test/test-registry-home.rb
+  scripts/test/test-template-packages.rb
+  scripts/test/test-dual-template-instances.rb
+  scripts/test/test-dual-template-runtime.rb
+  scripts/test/test-install-functions.rb
+  scripts/test/test-no-personal-data.rb
+  scripts/test/test-configuration-doc.rb
+  scripts/test/test-cv-export-contract.rb
+  scripts/test/test-css-structure.rb
+  scripts/test/test-form-control-theming.rb
+  scripts/test/test-listing-filter-contract.rb
+  scripts/test/test-studio-api-contract.rb
+  scripts/test/test-studio-rewrite-api-contract.rb
+  scripts/test/test-studio-schema-composition.rb
+  scripts/test/test-text-excerpt.rb
+  scripts/test/test-git-chronology.rb
+  scripts/test/test-math-row-breaks.rb
+  scripts/test/test-detail-render-parity.rb
+  scripts/test/test-absent-field-absent-element.rb
+  scripts/test/test-home-band-art.rb
+  scripts/test/test-r2-json-sync.rb
+  scripts/test/test-writing-slug-limits.rb
+  scripts/test/test-examples-build.rb
+)
+
+failed=0
+for test in "${TESTS[@]}"; do
+  if [[ ! -f "$test" ]]; then
+    echo "-- ${test} (missing, skip)"
+    continue
+  fi
+  echo "-- ${test}"
+  if ! "${RUBY[@]}" "$test"; then
+    failed=1
+  fi
+done
+
+if [[ "$failed" -ne 0 ]]; then
+  echo "VALIDATE FAILED"
+  exit 1
+fi
+
+echo "VALIDATE OK"

data/scripts/visual/build-cv-pages-json.js

@@ -0,0 +1,33 @@
+#!/usr/bin/env node
+// build-cv-pages-json.js — Write the cv-pages.json file used by take-screenshots.js.
+//
+// Extracts the 'cv' array from visual-inspection-pages.json and writes it as a flat
+// array to cv-pages.json in the current working directory.
+//
+// Usage (run from repo root):
+//   node scripts/visual/build-cv-pages-json.js [outputFile]
+//
+// Arguments:
+//   outputFile — Output path for the JSON file (default: cv-pages.json)
+
+'use strict';
+
+const path = require('path');
+const fs = require('fs');
+
+const REPO_ROOT = path.resolve(path.join(__dirname, '..', '..'));
+
+function main() {
+  const outputFile = path.resolve(process.argv[2] || path.join(REPO_ROOT, 'cv-pages.json'));
+
+  const cfg = JSON.parse(
+    fs.readFileSync(path.join(__dirname, 'visual-inspection-pages.json'), 'utf8')
+  );
+
+  fs.writeFileSync(outputFile, JSON.stringify(cfg.cv, null, 2), 'utf8');
+
+  console.log(`Wrote ${cfg.cv.length} page(s) to ${outputFile}`);
+  cfg.cv.forEach((p) => console.log(`  ${p.name} → ${p.url}`));
+}
+
+main();

data/scripts/visual/build-site-pages-json.js

@@ -0,0 +1,94 @@
+#!/usr/bin/env node
+// build-site-pages-json.js — Build the site-pages.json file used by take-screenshots.js.
+//
+// Takes the static page list from visual-inspection-pages.json, appends the most
+// recent article and post (from content/), and writes site-pages.json.
+//
+// Usage (run from repo root):
+//   node scripts/visual/build-site-pages-json.js [outputFile]
+//
+// Arguments:
+//   outputFile — Output path for the JSON file (default: site-pages.json)
+
+'use strict';
+
+const path = require('path');
+const fs = require('fs');
+const { execSync } = require('child_process');
+
+const REPO_ROOT = path.resolve(path.join(__dirname, '..', '..'));
+const CONTENT_ROOT = path.join(REPO_ROOT, 'content');
+const ARTICLES_DIR = path.join(CONTENT_ROOT, 'collections', 'articles');
+const POSTS_DIR = path.join(CONTENT_ROOT, 'collections', 'posts');
+
+function gitChronology(repoRelativePath, type) {
+  const quotedPath = repoRelativePath.replace(/'/g, "'\\''");
+  const quotedType = type.replace(/'/g, "'\\''");
+  const raw = execSync(
+    `bundle exec ruby -rjson -e "require_relative '_plugins/git_chronology'; puts JSON.generate(GitChronology.chronology_for(ARGV[0], type: ARGV[1]))" -- '${quotedPath}' '${quotedType}'`,
+    { cwd: REPO_ROOT, encoding: 'utf8' }
+  ).trim();
+  const chronology = JSON.parse(raw || '{}');
+  return {
+    date: chronology.date || '',
+    last_updated: chronology.last_updated || chronology.date || '',
+  };
+}
+
+function latestMarkdownSlug(dir, repoRelativeDir) {
+  if (!fs.existsSync(dir)) {
+    throw new Error(`Directory not found: ${dir}`);
+  }
+
+  const files = fs
+    .readdirSync(dir)
+    .filter((f) => f.endsWith('.md'));
+
+  if (files.length === 0) {
+    throw new Error(`No markdown files found in ${dir}`);
+  }
+
+  return files
+    .map((file) => {
+      const slug = file.replace(/\.md$/, '');
+      const writingType = repoRelativeDir.includes('posts') ? 'post' : 'article';
+      const chronology = gitChronology(path.posix.join(repoRelativeDir, file), writingType);
+      return {
+        slug,
+        sortKey: chronology.last_updated || chronology.date || slug,
+      };
+    })
+    .sort((a, b) => String(b.sortKey).localeCompare(String(a.sortKey)))[0].slug;
+}
+
+function main() {
+  const outputFile = path.resolve(process.argv[2] || path.join(REPO_ROOT, 'site-pages.json'));
+
+  const cfg = JSON.parse(
+    fs.readFileSync(path.join(__dirname, 'visual-inspection-pages.json'), 'utf8')
+  );
+
+  const latestArticleSlug = latestMarkdownSlug(ARTICLES_DIR, 'content/collections/articles');
+  const latestPostSlug = latestMarkdownSlug(POSTS_DIR, 'content/collections/posts');
+
+  const pages = [
+    ...cfg.site,
+    {
+      id: 'latest-article',
+      name: 'Latest Article',
+      url: `/articles/${encodeURIComponent(latestArticleSlug)}/`,
+    },
+    {
+      id: 'latest-post',
+      name: 'Latest Post',
+      url: `/posts/${encodeURIComponent(latestPostSlug)}/`,
+    },
+  ];
+
+  fs.writeFileSync(outputFile, JSON.stringify(pages, null, 2), 'utf8');
+
+  console.log(`Wrote ${pages.length} page(s) to ${outputFile}`);
+  pages.forEach((p) => console.log(`  ${p.name} → ${p.url}`));
+}
+
+main();

data/scripts/visual/publish-visual-inspection-to-r2.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+# Upload visual-inspection PNG screenshots to Cloudflare R2.
+# Used by .github/workflows/visual-inspection.yml (manual dispatch only).
+set -euo pipefail
+
+LOCAL_DIR="${1:?Usage: publish-visual-inspection-to-r2.sh <local-dir> <run-prefix> [subdir]}"
+RUN_PREFIX="${2:?Usage: publish-visual-inspection-to-r2.sh <local-dir> <run-prefix> [subdir]}"
+SUBDIR="${3:-}"
+
+: "${R2_ENDPOINT:?Set R2_ENDPOINT}"
+: "${R2_BUCKET:?Set R2_BUCKET}"
+: "${R2_ACCESS_KEY_ID:?Set R2_ACCESS_KEY_ID}"
+: "${R2_SECRET_ACCESS_KEY:?Set R2_SECRET_ACCESS_KEY}"
+
+export AWS_ACCESS_KEY_ID="$R2_ACCESS_KEY_ID"
+export AWS_SECRET_ACCESS_KEY="$R2_SECRET_ACCESS_KEY"
+export AWS_DEFAULT_REGION="${R2_REGION:-auto}"
+
+if ! command -v aws >/dev/null 2>&1; then
+  echo "aws CLI is required." >&2
+  exit 1
+fi
+
+if [ ! -d "$LOCAL_DIR" ]; then
+  echo "Local directory not found: $LOCAL_DIR" >&2
+  exit 1
+fi
+
+DEST="visual-inspection/${RUN_PREFIX}"
+if [ -n "$SUBDIR" ]; then
+  DEST="${DEST}/${SUBDIR}"
+fi
+
+echo "==> R2 sync ${LOCAL_DIR}/ → s3://${R2_BUCKET}/${DEST}/"
+aws s3 sync "$LOCAL_DIR" "s3://${R2_BUCKET}/${DEST}/" \
+  --endpoint-url "$R2_ENDPOINT" \
+  --exclude "*" \
+  --include "*.png" \
+  --cache-control "public,max-age=31536000,immutable" \
+  --content-type "image/png"
+
+echo "==> Visual inspection upload complete: ${DEST}/"

data/scripts/visual/take-screenshots.js

@@ -0,0 +1,88 @@
+#!/usr/bin/env node
+// take-screenshots.js — Screenshot site pages using Puppeteer for visual inspection.
+//
+// Usage:
+//   node scripts/visual/take-screenshots.js <outputDir> <baseUrl> <pagesJsonFile>
+//
+// Arguments:
+//   outputDir     — Directory to save screenshots (created if missing)
+//   baseUrl       — Base URL of the local server (e.g. http://localhost:4000 for the
+//                   public site; the workflow uses 4001 for the private CV build)
+//   pagesJsonFile — Path to a flat JSON array: [{ id, name, url }, ...]
+//
+// Output: saves <id>.png for each page in outputDir.
+//
+// Exit codes:
+//   0 — all screenshots successful
+//   1 — one or more screenshots failed (partial output may exist)
+
+'use strict';
+
+const puppeteer = require('puppeteer');
+const path = require('path');
+const fs = require('fs');
+
+async function main() {
+  const outputDir = path.resolve(process.argv[2] || 'screenshots');
+  const baseUrl = (process.argv[3] || 'http://localhost:4000').replace(/\/$/, '');
+  const pagesFile = path.resolve(process.argv[4] || 'pages.json');
+
+  const pages = JSON.parse(fs.readFileSync(pagesFile, 'utf8'));
+
+  fs.mkdirSync(outputDir, { recursive: true });
+
+  const browser = await puppeteer.launch({
+    args: ['--no-sandbox', '--disable-setuid-sandbox'],
+  });
+
+  let failures = 0;
+
+  try {
+    const executing = new Set();
+    const CONCURRENCY_LIMIT = 5;
+
+    for (const pageConfig of pages) {
+      const task = async () => {
+        const url = `${baseUrl}${pageConfig.url}`;
+        console.log(`Screenshotting: ${pageConfig.name} → ${url}`);
+
+        const page = await browser.newPage();
+        await page.setViewport({ width: 1440, height: 1200 });
+
+        try {
+          await page.goto(url, { waitUntil: 'networkidle0', timeout: 60000 });
+          const outputPath = path.join(outputDir, `${pageConfig.id}.png`);
+          await page.screenshot({ path: outputPath, fullPage: true });
+          console.log(`  ✓ ${path.basename(outputPath)}`);
+        } catch (err) {
+          console.error(`  ✗ ${pageConfig.name}: ${err.message}`);
+          failures += 1;
+        } finally {
+          await page.close();
+        }
+      };
+
+      const promise = task();
+      executing.add(promise);
+      promise.finally(() => executing.delete(promise));
+
+      if (executing.size >= CONCURRENCY_LIMIT) {
+        await Promise.race(executing);
+      }
+    }
+
+    await Promise.all(executing);
+  } finally {
+    await browser.close();
+  }
+
+  if (failures > 0) {
+    console.error(`\n${failures} screenshot(s) failed.`);
+    process.exit(1);
+  }
+}
+
+main().catch((err) => {
+  console.error(err);
+  process.exit(1);
+});