@cparkerwebm/webmonterey 1.1.0 → 1.3.0

package/dist/webm.mjs

@@ -196,6 +196,53 @@ var init_mcp = __esm({
   }
 });
 
+// src/cli/settings.ts
+function projectSettings(repo) {
+  return {
+    "//": `Project settings for ${repo}.`,
+    "//mcp": "A server declared in .mcp.json is INERT until approved on each machine. Without this line the rules that say consult the Astro and MDN docs before using an API would depend on whoever cloned the repo happening to hit Approve.",
+    includeCoAuthoredBy: false,
+    enabledMcpjsonServers: [...MCP_NAMES],
+    "//permissions": PERMISSIONS_NOTE,
+    permissions: { deny: [...DENY_RULES] }
+  };
+}
+function withDenyRules(settings) {
+  const permissions = settings.permissions && typeof settings.permissions === "object" ? { ...settings.permissions } : {};
+  const current = Array.isArray(permissions.deny) ? permissions.deny.filter((r) => typeof r === "string") : [];
+  const removed = current.filter((r) => STALE_RULES.includes(r));
+  const kept = current.filter((r) => !STALE_RULES.includes(r));
+  const added = DENY_RULES.filter((r) => !kept.includes(r));
+  if (!added.length && !removed.length) return { settings, added, removed };
+  permissions.deny = [...kept, ...added];
+  return {
+    settings: { ...settings, "//permissions": PERMISSIONS_NOTE, permissions },
+    added,
+    removed
+  };
+}
+var DENY_RULES, STALE_RULES, PERMISSIONS_NOTE;
+var init_settings = __esm({
+  "src/cli/settings.ts"() {
+    "use strict";
+    init_mcp();
+    DENY_RULES = [
+      "Read(**/.dev.vars)",
+      "Read(**/.dev.vars.*)",
+      "Read(**/.env)",
+      "Read(**/.env.*)",
+      "Read(**/*.pem)",
+      "Read(**/*.key)",
+      "Read(**/.npmrc)",
+      "Edit(**/.dev.vars)",
+      "Edit(**/.env)",
+      "Edit(**/node_modules/**)"
+    ];
+    STALE_RULES = ["Write(**/.dev.vars)", "Write(**/.env)"];
+    PERMISSIONS_NOTE = "The deny list is package-managed: `webm sync` adds any rule that is missing on every install and leaves everything else in this file alone. Edit(**/node_modules/**) is rule 12 of CLAUDE.md made mechanical - a session in this repo never edits the package.";
+  }
+});
+
 // src/cli/scaffold.ts
 function shiftDays(date, days) {
   const shifted = /* @__PURE__ */ new Date(`${date}T00:00:00Z`);
@@ -279,7 +326,7 @@ export default defineConfig({
       worker: n.worker,
       slug: n.slug,
       launched: null,
-      "//environment": "What this deployment is FOR. 'staging' redirects EVERY email the site sends to stagingEmail below, so testing a form on a preview cannot reach the client's real contacts. A new site starts here; /webm:launch flips it to 'production'. Anything served from workers.dev is treated as staging regardless, so a branch preview of a live site is covered too.",
+      "//environment": "What this deployment is FOR. 'staging' makes every build a PREVIEW - every page noindex with no canonical, no sitemap, robots.txt disallowing everything, no Google Tag Manager - on every hostname, main included, so a site that has not launched cannot be indexed before it exists; and it redirects EVERY email the site sends to stagingEmail below, so testing a form on a preview cannot reach the client's real contacts. A new site starts here; /webm:launch flips it to 'production' once the custom domain is live, and that flip is what makes the site indexable. A branch other than main is a preview regardless, and anything served from workers.dev redirects its mail regardless, so a branch preview of a live site is covered too.",
       environment: "staging",
       "//stagingEmail": "Where staging email goes instead of its real recipients. REQUIRED while environment is staging - a staging site with nowhere to send refuses to send rather than guessing. webm doctor checks.",
       stagingEmail: options.stagingEmail ?? "",
@@ -372,31 +419,7 @@ export default defineConfig({
     null,
     2
   ) + "\n";
-  files[".claude/settings.json"] = JSON.stringify(
-    {
-      "//": `Project settings for ${n.repo}.`,
-      "//mcp": "A server declared in .mcp.json is INERT until approved on each machine. Without this line the rules that say consult the Astro and MDN docs before using an API would depend on whoever cloned the repo happening to hit Approve.",
-      includeCoAuthoredBy: false,
-      enabledMcpjsonServers: MCP_NAMES,
-      permissions: {
-        deny: [
-          "Read(**/.dev.vars)",
-          "Read(**/.dev.vars.*)",
-          "Read(**/.env)",
-          "Read(**/.env.*)",
-          "Read(**/*.pem)",
-          "Read(**/*.key)",
-          "Read(**/.npmrc)",
-          "Edit(**/.dev.vars)",
-          "Edit(**/.env)",
-          "Write(**/.dev.vars)",
-          "Write(**/.env)"
-        ]
-      }
-    },
-    null,
-    2
-  ) + "\n";
+  files[".claude/settings.json"] = JSON.stringify(projectSettings(n.repo), null, 2) + "\n";
   files[".mcp.json"] = JSON.stringify(mcpConfig(), null, 2) + "\n";
   files["src/actions/index.ts"] = `/*
  * Form handlers.
@@ -550,8 +573,11 @@ suffix - \`${n.slug}-portal\`.
 
 ## Deploying
 
-Push to deploy. A \`wrangler deploy\` from a laptop creates a version no build produced, so
-history stops describing what is live and the next push reverts it.
+The Worker is created ONCE from a laptop - \`npm run build && npx wrangler deploy\` - and the
+repo is then connected to it in the dashboard (Worker \u2192 Settings \u2192 Builds). /webm:start does
+both. From then on, push to deploy: a \`wrangler deploy\` from a laptop after that creates a
+version no build produced, so history stops describing what is live and the next push
+reverts it.
 `;
   return files;
 }
@@ -560,6 +586,7 @@ var init_scaffold = __esm({
     "use strict";
     init_slug();
     init_mcp();
+    init_settings();
   }
 });
 
@@ -578,7 +605,7 @@ import {
   writeFileSync,
   readdirSync
 } from "node:fs";
-import { basename, join as join2 } from "node:path";
+import { basename, dirname as dirname2, join as join2 } from "node:path";
 function syncDir(source, target) {
   if (!existsSync2(source)) return [];
   mkdirSync(target, { recursive: true });
@@ -604,6 +631,30 @@ function addMissing(source, target) {
   }
   return added.sort();
 }
+function ensureSettings(siteRoot) {
+  const path = join2(siteRoot, ".claude", "settings.json");
+  if (!existsSync2(path)) {
+    mkdirSync(dirname2(path), { recursive: true });
+    writeFileSync(path, JSON.stringify(projectSettings(basename(siteRoot)), null, 2) + "\n");
+    return { added: [...DENY_RULES], removed: [], created: true, skipped: null };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync2(path, "utf8"));
+  } catch {
+    return {
+      added: [],
+      removed: [],
+      created: false,
+      skipped: ".claude/settings.json is not valid JSON, so it was left alone"
+    };
+  }
+  const { settings, added, removed } = withDenyRules(parsed);
+  if (added.length || removed.length) {
+    writeFileSync(path, JSON.stringify(settings, null, 2) + "\n");
+  }
+  return { added, removed, created: false, skipped: null };
+}
 function listSkills(dir) {
   if (!existsSync2(dir)) return [];
   return readdirSync(dir, { withFileTypes: true }).filter((e) => e.isDirectory() && existsSync2(join2(dir, e.name, "SKILL.md"))).map((e) => e.name).sort();
@@ -660,7 +711,8 @@ function sync(siteRoot) {
      * which is how code depending on an unpublished package reached main without a word.
      */
     workflows: syncDir(join2(template, "workflows"), join2(siteRoot, ".github/workflows")),
-    migrations: addMissing(join2(template, "migrations"), join2(siteRoot, "migrations"))
+    migrations: addMissing(join2(template, "migrations"), join2(siteRoot, "migrations")),
+    settings: ensureSettings(siteRoot)
   };
 }
 function ensureGitignored(siteRoot) {
@@ -691,6 +743,19 @@ function run(argv2) {
   for (const m of result.migrations) {
     console.log(`  + migrations/${m}  (apply it: npx wrangler d1 migrations apply <DB> --remote)`);
   }
+  if (result.settings.created) {
+    console.log(`  + .claude/settings.json`);
+  } else if (result.settings.skipped) {
+    console.log(`  ${result.settings.skipped}`);
+  } else if (result.settings.added.length || result.settings.removed.length) {
+    const parts = [
+      result.settings.added.length && `+${result.settings.added.length} deny`,
+      result.settings.removed.length && `-${result.settings.removed.length} stale`
+    ].filter(Boolean);
+    console.log(
+      `  .claude/settings.json: ${parts.join(", ")} (package-managed rules; yours are kept)`
+    );
+  }
   if (ensureGitignored(siteRoot)) {
     console.log(`  gitignored .claude/skills/${NAMESPACE}/`);
   }
@@ -707,13 +772,14 @@ var init_sync = __esm({
   "src/cli/sync.ts"() {
     "use strict";
     init_package_root();
+    init_settings();
     NAMESPACE = "webm";
   }
 });
 
 // src/cli/seed.ts
 import { cpSync as cpSync2, existsSync as existsSync3, mkdirSync as mkdirSync2, readdirSync as readdirSync2, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname2, join as join3, relative } from "node:path";
+import { dirname as dirname3, join as join3, relative } from "node:path";
 function walk(dir) {
   if (!existsSync3(dir)) return [];
   return readdirSync2(dir, { withFileTypes: true }).flatMap((e) => {
@@ -732,7 +798,7 @@ function seed(packageRoot, siteRoot) {
       const rel = relative(source, file);
       const dest = join3(siteRoot, to === "." ? rel : join3(to, rel));
       if (existsSync3(dest)) continue;
-      mkdirSync2(dirname2(dest), { recursive: true });
+      mkdirSync2(dirname3(dest), { recursive: true });
       cpSync2(file, dest);
       written.push(relative(siteRoot, dest));
     }
@@ -800,7 +866,7 @@ __export(new_exports, {
 });
 import { execFileSync } from "node:child_process";
 import { existsSync as existsSync4, mkdirSync as mkdirSync3, readdirSync as readdirSync3, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname as dirname3, join as join4, resolve } from "node:path";
+import { dirname as dirname4, join as join4, resolve } from "node:path";
 function parseArgs(argv2) {
   const positional = argv2.filter((a) => !a.startsWith("--"));
   const flag = (name) => {
@@ -863,7 +929,7 @@ function run2(argv2) {
   });
   for (const [path, contents] of Object.entries(files)) {
     const full = join4(root, path);
-    mkdirSync3(dirname3(full), { recursive: true });
+    mkdirSync3(dirname4(full), { recursive: true });
     writeFileSync3(full, contents);
   }
   const seeded = seed(PACKAGE_ROOT, root);
@@ -1955,17 +2021,17 @@ var init_checks = __esm({
         }
       },
       {
-        id: "agency-credit",
-        title: "Something renders the agency credit",
-        silentAs: 'the site ships with no "Powered by WebMonterey" and nobody notices for months',
+        id: "webmaster-credit",
+        title: "Something renders the webmaster credit",
+        silentAs: 'the site ships with no "Powered by WebMonterey", the /webmaster page is orphaned, and nobody notices for months',
         run(ctx) {
           if (ctx.components.size === 0) return pass;
           if (ctx.site.domain === "webmonterey.com") return pass;
           for (const src of ctx.components.values()) {
-            if (/webmonterey\/credits/.test(stripComments(src))) return pass;
+            if (/webmonterey\/webmaster/.test(stripComments(src))) return pass;
           }
           return warn(
-            "no component imports @cparkerwebm/webmonterey/webmonterey/credits/Credit.astro. The footer component is where it goes."
+            "no component imports @cparkerwebm/webmonterey/webmonterey/webmaster/Webmaster.astro. The footer component is where it goes; it links to the /webmaster page."
           );
         }
       },
@@ -1982,7 +2048,7 @@ var init_checks = __esm({
       {
         id: "environment",
         title: "The declared environment matches where the site actually is",
-        silentAs: "a launched site whose client email is still being diverted to the agency's inbox",
+        silentAs: "a launched site whose client email is still being diverted to the agency's inbox, and whose every page is noindex",
         run(ctx) {
           const declared = ctx.site.environment;
           if (declared !== void 0 && declared !== "production" && declared !== "staging") {
@@ -1992,12 +2058,37 @@ var init_checks = __esm({
           }
           if (declared === "staging" && isConfigured(ctx.site.launched)) {
             return fail(
-              `this site launched on ${ctx.site.launched} but is still declared staging, so every email it sends is being redirected away from its real recipients. Set "environment": "production" in webmonterey.json.`
+              `this site launched on ${ctx.site.launched} but is still declared staging, so every email it sends is being redirected away from its real recipients - and since 1.3.0 every build of a staging site is a preview: noindex on every page, no canonical, no sitemap, robots.txt disallowing everything. The live site is dropping out of search. Set "environment": "production" in webmonterey.json.`
             );
           }
           if (declared !== "staging" && !isConfigured(ctx.site.launched)) {
             return warn(
-              `this site has no launch date but is treated as production, so testing a form will email the client's real contacts. Set "environment": "staging" in webmonterey.json until /webm:launch.`
+              `this site has no launch date but is treated as production, so testing a form will email the client's real contacts and every page is indexable on its workers.dev hostname. Set "environment": "staging" in webmonterey.json until /webm:launch.`
+            );
+          }
+          return pass;
+        }
+      },
+      {
+        /*
+         * THE WORKER EXISTS. /webm:start used to end with a repo, a D1 database and an instruction
+         * to create the Worker in the dashboard by hand - and on one site nobody did. Nothing local
+         * notices: the build is green, every other check here is green, and the site is a
+         * workers.dev hostname that answers nothing. The Worker is the one resource whose absence
+         * has no symptom on disk, so this asks Cloudflare through wrangler - the one thing a laptop
+         * can ask - and steps aside with a note when it cannot.
+         */
+        id: "worker-exists",
+        title: "The Worker exists",
+        silentAs: "a site with a repo, a database and nothing serving",
+        run(ctx) {
+          if (ctx.worker.skipped) return { status: "pass", detail: `skipped: ${ctx.worker.skipped}` };
+          if (!ctx.worker.name) {
+            return warn("wrangler.jsonc names no Worker, so there is nothing to look for");
+          }
+          if (!ctx.worker.deployments) {
+            return warn(
+              `no deployment of a Worker named "${ctx.worker.name}" on this account. Create it once from the laptop - npm run build && npx wrangler deploy - then connect the repo to it in the dashboard (Worker \u2192 Settings \u2192 Builds). /webm:start, steps 5 and 6.`
             );
           }
           return pass;
@@ -2079,25 +2170,27 @@ __export(doctor_exports, {
   buildContext: () => buildContext,
   run: () => run5
 });
+import { execFileSync as execFileSync2 } from "node:child_process";
 import { existsSync as existsSync8, readFileSync as readFileSync7, readdirSync as readdirSync6 } from "node:fs";
-import { join as join7, relative as relative3 } from "node:path";
+import { createRequire } from "node:module";
+import { dirname as dirname5, join as join7, relative as relative3, resolve as resolve2 } from "node:path";
 function parseJsonc(source) {
   const stripped = source.replace(/\\"|"(?:\\"|[^"])*"|(\/\/.*|\/\*[\s\S]*?\*\/)/g, (m, comment) => comment ? "" : m).replace(/,(\s*[}\]])/g, "$1");
   return JSON.parse(stripped);
 }
 function readTree(root, dir, exts) {
   const out = /* @__PURE__ */ new Map();
-  const walk3 = (d) => {
+  const walk4 = (d) => {
     if (!existsSync8(d)) return;
     for (const entry2 of readdirSync6(d, { withFileTypes: true })) {
       const full = join7(d, entry2.name);
-      if (entry2.isDirectory()) walk3(full);
+      if (entry2.isDirectory()) walk4(full);
       else if (exts.some((e) => entry2.name.endsWith(e))) {
         out.set(relative3(root, full), readFileSync7(full, "utf8"));
       }
     }
   };
-  walk3(join7(root, dir));
+  walk4(join7(root, dir));
   return out;
 }
 function placeholderFiles(siteRoot) {
@@ -2140,13 +2233,63 @@ function readMcp(siteRoot) {
     enabled: read(".claude/settings.json", (p) => p.enabledMcpjsonServers ?? null)
   };
 }
+function workerState(siteRoot, name) {
+  const worker = { name: name ?? null, deployments: null, skipped: null };
+  if (!worker.name) return worker;
+  let bin;
+  try {
+    const require2 = createRequire(join7(resolve2(siteRoot), "package.json"));
+    bin = join7(dirname5(require2.resolve("wrangler/package.json")), "bin/wrangler.js");
+  } catch {
+    return {
+      ...worker,
+      skipped: "wrangler is not installed here, so the Worker was not looked for"
+    };
+  }
+  try {
+    const out = execFileSync2(
+      process.execPath,
+      [bin, "deployments", "list", "--name", worker.name, "--json"],
+      {
+        cwd: siteRoot,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"],
+        timeout: 3e4,
+        env: { ...process.env, WRANGLER_SEND_METRICS: "false", NO_COLOR: "1" }
+      }
+    );
+    const start = out.indexOf("[");
+    const parsed = start >= 0 ? JSON.parse(out.slice(start)) : [];
+    return { ...worker, deployments: Array.isArray(parsed) ? parsed.length : 0 };
+  } catch (error) {
+    const e = error;
+    const text = `${e.stdout ?? ""}
+${e.stderr ?? ""}
+${e.message ?? ""}`;
+    if (/code: 10007\]|does not exist on your account/i.test(text)) {
+      return { ...worker, deployments: 0 };
+    }
+    if (/CLOUDFLARE_API_TOKEN|not (logged in|authenticated)|Authentication error|code: (10000|6111|9109)\]/i.test(
+      text
+    )) {
+      return {
+        ...worker,
+        skipped: "wrangler is not logged in (npx wrangler login), so whether the Worker exists was not checked"
+      };
+    }
+    const line = text.split("\n").map((l) => l.replace(/\x1b\[[0-9;]*m/g, "").trim()).find((l) => l && !l.startsWith("\u{1FAB5}"));
+    return { ...worker, skipped: `wrangler could not answer: ${line ?? "no output"}` };
+  }
+}
 function buildContext(siteRoot) {
   const { site } = loadSiteFiles(siteRoot);
   const wranglerPath = ["wrangler.jsonc", "wrangler.json"].map((f) => join7(siteRoot, f)).find(existsSync8);
   const syncPath = join7(siteRoot, ".claude/skills/webm/.webm-sync.json");
+  const wrangler = wranglerPath ? parseJsonc(readFileSync7(wranglerPath, "utf8")) : null;
   return {
     site,
-    wrangler: wranglerPath ? parseJsonc(readFileSync7(wranglerPath, "utf8")) : null,
+    wrangler,
+    worker: workerState(siteRoot, wrangler?.name),
     pages: readTree(siteRoot, "src/pages", [".astro", ".ts"]),
     components: readTree(siteRoot, "src/components", [".astro", ".ts"]),
     today: (/* @__PURE__ */ new Date()).toISOString().slice(0, 10),
@@ -2213,6 +2356,243 @@ var init_doctor = __esm({
   }
 });
 
+// src/cli/audit.ts
+var audit_exports = {};
+__export(audit_exports, {
+  attr: () => attr,
+  audit: () => audit,
+  auditSitemap: () => auditSitemap,
+  hasAttr: () => hasAttr,
+  imagesWithoutAlt: () => imagesWithoutAlt,
+  links: () => links,
+  locs: () => locs,
+  resolves: () => resolves,
+  run: () => run6
+});
+import { existsSync as existsSync9, readdirSync as readdirSync7, readFileSync as readFileSync8, statSync as statSync3 } from "node:fs";
+import { join as join8, relative as relative4, resolve as resolve3 } from "node:path";
+function attr(tag, name) {
+  const m = new RegExp(`\\s${name}\\s*=\\s*(?:"([^"]*)"|'([^']*)'|([^\\s>]+))`, "i").exec(tag);
+  if (!m) return null;
+  return m[1] ?? m[2] ?? m[3] ?? "";
+}
+function hasAttr(tag, name) {
+  return new RegExp(`\\s${name}(?=[\\s=>/])`, "i").test(tag);
+}
+function imagesWithoutAlt(html) {
+  const out = [];
+  for (const m of html.matchAll(/<img\b[^>]*>/gi)) {
+    const tag = m[0];
+    if (hasAttr(tag, "alt")) continue;
+    out.push(attr(tag, "src") ?? "(no src)");
+  }
+  return out;
+}
+function links(html, origin) {
+  const internal = /* @__PURE__ */ new Set();
+  const external = /* @__PURE__ */ new Set();
+  for (const m of html.matchAll(/<a\b[^>]*>/gi)) {
+    const href = attr(m[0], "href");
+    if (!href || SKIP_SCHEMES.test(href)) continue;
+    if (/^https?:\/\//i.test(href)) {
+      if (origin && href.startsWith(origin)) internal.add(href.slice(origin.length) || "/");
+      else external.add(href);
+      continue;
+    }
+    if (href.startsWith("//")) {
+      external.add(`https:${href}`);
+      continue;
+    }
+    internal.add(href);
+  }
+  return { internal: [...internal], external: [...external] };
+}
+function resolves(href, input) {
+  let path = href.split("#")[0].split("?")[0];
+  try {
+    path = decodeURIComponent(path);
+  } catch {
+  }
+  if (!path.startsWith("/")) return true;
+  if (path === "/") return input.exists("index.html");
+  const bare = path.replace(/\/$/, "");
+  const rel = bare.slice(1);
+  if (input.exists(rel) || input.exists(`${rel}.html`) || input.exists(`${rel}/index.html`)) {
+    return true;
+  }
+  return input.workerFirst.some(
+    (entry2) => entry2.endsWith("/*") ? bare === entry2.slice(0, -2) || bare.startsWith(entry2.slice(0, -1)) : entry2 === bare || entry2 === `${bare}/`
+  );
+}
+function locs(xml) {
+  return [...xml.matchAll(/<loc>\s*([^<]+?)\s*<\/loc>/g)].map((m) => m[1]);
+}
+function auditSitemap(input) {
+  const problems = [];
+  const index = input.read("sitemap-index.xml");
+  if (!index) {
+    return {
+      problems: [
+        input.origin ? "sitemap-index.xml was not built" : "no sitemap - `domain` in webmonterey.json is unset, so nothing has an absolute URL"
+      ],
+      urls: 0
+    };
+  }
+  const robots = input.read("robots.txt") ?? "";
+  if (!/^Sitemap:\s*\S+/m.test(robots)) problems.push("robots.txt has no Sitemap: line");
+  let urls = 0;
+  for (const childUrl of locs(index)) {
+    const childRel = childUrl.replace(/^https?:\/\/[^/]+\//, "");
+    const child = input.read(childRel);
+    if (!child) {
+      problems.push(`${childRel} is listed in the index and was not built`);
+      continue;
+    }
+    for (const url of locs(child)) {
+      urls++;
+      if (input.origin && !url.startsWith(input.origin)) {
+        problems.push(`${url} is not on ${input.origin}`);
+        continue;
+      }
+      const path = url.replace(/^https?:\/\/[^/]+/, "") || "/";
+      if (!resolves(path, input)) problems.push(`${url} is in the sitemap and has no page`);
+    }
+  }
+  if (urls === 0) problems.push("the sitemap lists no URLs");
+  return { problems, urls };
+}
+function audit(input) {
+  const missingAlt = [];
+  const brokenInternal = [];
+  const external = /* @__PURE__ */ new Set();
+  for (const [page, html] of input.pages) {
+    for (const src of imagesWithoutAlt(html)) missingAlt.push({ page, src });
+    const found = links(html, input.origin);
+    for (const href of found.internal) {
+      if (!resolves(href, input)) brokenInternal.push({ page, href });
+    }
+    for (const url of found.external) external.add(url);
+  }
+  return {
+    missingAlt,
+    brokenInternal,
+    external: [...external].sort(),
+    sitemap: auditSitemap(input)
+  };
+}
+function walk3(dir) {
+  if (!existsSync9(dir)) return [];
+  return readdirSync7(dir, { withFileTypes: true }).flatMap((e) => {
+    const full = join8(dir, e.name);
+    return e.isDirectory() ? walk3(full) : [full];
+  });
+}
+function parseJsonc2(source) {
+  const stripped = source.replace(/\\"|"(?:\\"|[^"])*"|(\/\/.*|\/\*[\s\S]*?\*\/)/g, (m, comment) => comment ? "" : m).replace(/,(\s*[}\]])/g, "$1");
+  return JSON.parse(stripped);
+}
+async function probe(urls) {
+  const bad = [];
+  const queue = [...urls];
+  const worker = async () => {
+    for (let url = queue.shift(); url; url = queue.shift()) {
+      try {
+        let res = await fetch(url, {
+          method: "HEAD",
+          redirect: "follow",
+          signal: AbortSignal.timeout(8e3)
+        });
+        if (res.status === 405 || res.status === 403) {
+          res = await fetch(url, {
+            method: "GET",
+            redirect: "follow",
+            signal: AbortSignal.timeout(8e3)
+          });
+        }
+        if (res.status >= 400) bad.push({ url, status: String(res.status) });
+      } catch (error) {
+        bad.push({ url, status: error instanceof Error ? error.name : "error" });
+      }
+    }
+  };
+  await Promise.all(Array.from({ length: 6 }, worker));
+  return bad.sort((a, b) => a.url.localeCompare(b.url));
+}
+async function run6(argv2) {
+  const dist = resolve3(argv2.find((a) => !a.startsWith("-")) ?? "dist/client");
+  const noExternal = argv2.includes("--no-external");
+  if (!existsSync9(join8(dist, "index.html"))) {
+    console.error(`webm audit: no build at ${dist}. Run \`npm run build\` first.`);
+    return 1;
+  }
+  const siteRoot = process.cwd();
+  const files = walk3(dist);
+  const rels = new Set(files.map((f) => relative4(dist, f)));
+  const pages = new Map(
+    files.filter((f) => f.endsWith(".html")).map((f) => [relative4(dist, f), readFileSync8(f, "utf8")])
+  );
+  const wranglerPath = ["wrangler.jsonc", "wrangler.json"].map((f) => join8(siteRoot, f)).find(existsSync9);
+  const wrangler = wranglerPath ? parseJsonc2(readFileSync8(wranglerPath, "utf8")) : null;
+  const sitePath = join8(siteRoot, "webmonterey.json");
+  const site = existsSync9(sitePath) ? JSON.parse(readFileSync8(sitePath, "utf8")) : {};
+  const origin = site.domain && site.domain !== "CHANGEME" ? `https://${site.domain}` : void 0;
+  const report = audit({
+    pages,
+    exists: (rel) => rels.has(rel),
+    read: (rel) => rels.has(rel) && statSync3(join8(dist, rel)).isFile() ? readFileSync8(join8(dist, rel), "utf8") : null,
+    workerFirst: wrangler?.assets?.run_worker_first ?? [],
+    origin
+  });
+  let failed = 0;
+  const section = (ok, title) => console.log(`${ok ? "  ok " : "FAIL "} ${title}`);
+  section(report.missingAlt.length === 0, `Every image declares alt text (${pages.size} pages)`);
+  for (const { page, src } of report.missingAlt)
+    console.log(`       ${page}: <img src="${src}"> has no alt attribute`);
+  if (report.missingAlt.length) {
+    failed++;
+    console.log(
+      `       Write alt text for each - what the image shows, in context - or alt="" if it is decorative.`
+    );
+  }
+  section(
+    report.brokenInternal.length === 0,
+    "Every internal link lands on a page or a Worker route"
+  );
+  for (const { page, href } of report.brokenInternal) console.log(`       ${page}: ${href}`);
+  if (report.brokenInternal.length) failed++;
+  section(
+    report.sitemap.problems.length === 0,
+    `The sitemap is complete and advertised (${report.sitemap.urls} URLs)`
+  );
+  for (const p of report.sitemap.problems) console.log(`       ${p}`);
+  if (report.sitemap.problems.length) failed++;
+  if (noExternal) {
+    console.log(`  --  ${report.external.length} external links not probed (--no-external)`);
+  } else if (report.external.length) {
+    const bad = await probe(report.external);
+    console.log(
+      `${bad.length ? "warn " : "  ok "} ${report.external.length} external links respond (${bad.length} did not)`
+    );
+    for (const { url, status } of bad) console.log(`       ${status.padEnd(12)} ${url}`);
+    if (bad.length)
+      console.log(
+        `       Open each in a browser before deciding it is broken - many sites refuse bots.`
+      );
+  } else {
+    console.log("  ok  no external links");
+  }
+  console.log(`
+${failed === 0 ? "audit clean" : `${failed} check(s) failed`}`);
+  return failed ? 1 : 0;
+}
+var SKIP_SCHEMES;
+var init_audit = __esm({
+  "src/cli/audit.ts"() {
+    "use strict";
+    SKIP_SCHEMES = /^(mailto:|tel:|sms:|javascript:|data:|#)/i;
+  }
+});
+
 // src/cli/codemods.ts
 function compareVersions(a, b) {
   const pa = a.split(".").map(Number);
@@ -2234,24 +2614,24 @@ var init_codemods = __esm({
 // src/cli/upgrade.ts
 var upgrade_exports = {};
 __export(upgrade_exports, {
-  run: () => run6
+  run: () => run7
 });
-import { execFileSync as execFileSync2 } from "node:child_process";
-import { existsSync as existsSync9, readFileSync as readFileSync8 } from "node:fs";
-import { join as join8 } from "node:path";
+import { execFileSync as execFileSync3 } from "node:child_process";
+import { existsSync as existsSync10, readFileSync as readFileSync9 } from "node:fs";
+import { join as join9 } from "node:path";
 function git(siteRoot, args) {
-  return execFileSync2("git", args, { cwd: siteRoot, encoding: "utf8" }).trim();
+  return execFileSync3("git", args, { cwd: siteRoot, encoding: "utf8" }).trim();
 }
 function installedVersion(siteRoot) {
-  const path = join8(siteRoot, "node_modules", PACKAGE, "package.json");
-  if (!existsSync9(path)) return null;
-  return JSON.parse(readFileSync8(path, "utf8")).version;
+  const path = join9(siteRoot, "node_modules", PACKAGE, "package.json");
+  if (!existsSync10(path)) return null;
+  return JSON.parse(readFileSync9(path, "utf8")).version;
 }
-function run6(argv2) {
+function run7(argv2) {
   const siteRoot = process.cwd();
   const target = argv2.find((a) => !a.startsWith("-")) ?? "latest";
   const dryRun = argv2.includes("--dry-run");
-  if (!existsSync9(join8(siteRoot, "webmonterey.json"))) {
+  if (!existsSync10(join9(siteRoot, "webmonterey.json"))) {
     console.error(`webm upgrade: no webmonterey.json here. Not a WebMonterey site.`);
     return 1;
   }
@@ -2270,7 +2650,7 @@ function run6(argv2) {
     git(siteRoot, ["checkout", "-b", branch]);
     console.log(`Branched to ${branch}. Never upgrade on main.`);
   }
-  execFileSync2("npm", ["install", `${PACKAGE}@${target}`], { cwd: siteRoot, stdio: "inherit" });
+  execFileSync3("npm", ["install", `${PACKAGE}@${target}`], { cwd: siteRoot, stdio: "inherit" });
   const to = installedVersion(siteRoot);
   if (!to) {
     console.error("webm upgrade: install did not produce a version. Check the npm output above.");
@@ -2317,9 +2697,9 @@ var init_upgrade = __esm({
 
 // bin/webm.mjs
 init_package_root();
-import { readFileSync as readFileSync9 } from "node:fs";
-import { join as join9 } from "node:path";
-var pkg = JSON.parse(readFileSync9(join9(PACKAGE_ROOT, "package.json"), "utf8"));
+import { readFileSync as readFileSync10 } from "node:fs";
+import { join as join10 } from "node:path";
+var pkg = JSON.parse(readFileSync10(join10(PACKAGE_ROOT, "package.json"), "utf8"));
 var COMMANDS = {
   new: {
     blurb: "Scaffold a new client site from a domain",
@@ -2341,6 +2721,10 @@ var COMMANDS = {
     blurb: "Check this site against the traps that fail silently",
     load: () => Promise.resolve().then(() => (init_doctor(), doctor_exports))
   },
+  audit: {
+    blurb: "Check a BUILD: image alt text, broken links, the sitemap. For launch.",
+    load: () => Promise.resolve().then(() => (init_audit(), audit_exports))
+  },
   upgrade: {
     blurb: "Move this site to a newer framework version",
     load: () => Promise.resolve().then(() => (init_upgrade(), upgrade_exports))