@elia97/officina 0.2.0 → 0.4.0

package/dist/lib/gtm-container.js

@@ -0,0 +1,145 @@
+// Lettore del gtm.js pubblico di un container GTM. Dati dentro, dati fuori: la fetch, il
+// rapporto e il codice di uscita restano in scripts/verify-analytics-coverage.mjs.
+// Tag evento GA4. Il tag Google vero e proprio (`__googtag`) configura la proprietà e scatta
+// all'inizializzazione: non traccia nessuna superficie, quindi qui non è un trigger.
+const GA4_EVENT_TAG = '__gaawe';
+// Contabilità interna di GTM: ogni listener nativo scrive gli id dei trigger per cui è
+// scattato, e il tag li rilegge con un `_re`. Da parte nostra non c'è niente da verificare.
+const INTERNAL_VARIABLE = 'gtm.triggers';
+const isRecord = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+const records = (value) => (Array.isArray(value) ? value.filter(isRecord) : []);
+const arrays = (value) => (Array.isArray(value) ? value.filter(Array.isArray) : []);
+function matchingBrace(source, start) {
+    let depth = 0;
+    let inString = false;
+    let escaped = false;
+    for (let index = start; index < source.length; index++) {
+        const char = source[index];
+        if (inString) {
+            if (escaped)
+                escaped = false;
+            else if (char === '\\')
+                escaped = true;
+            else if (char === '"')
+                inString = false;
+            continue;
+        }
+        if (char === '"')
+            inString = true;
+        else if (char === '{')
+            depth++;
+        else if (char === '}' && --depth === 0)
+            return index + 1;
+    }
+    throw new Error('the container literal never closes — truncated download?');
+}
+/** Il container arriva come un solo file JS che contiene un unico letterale `var data = {…}`,
+ *  e a isolarlo è solo un conteggio di graffe che conosce le stringhe: i valori ne contengono. */
+export function parseContainerData(source) {
+    const marker = source.indexOf('var data = {');
+    if (marker === -1)
+        throw new Error('no `var data = {` in the container — the reader is broken, not the container');
+    const start = source.indexOf('{', marker);
+    // La fetta comincia con una `{`, quindi JSON.parse o solleva un errore o restituisce un oggetto.
+    const parsed = JSON.parse(source.slice(start, matchingBrace(source, start)));
+    if (!isRecord(parsed.resource))
+        throw new Error('the container literal carries no `resource` — the reader is broken');
+    const resource = parsed.resource;
+    return {
+        macros: records(resource.macros),
+        tags: records(resource.tags),
+        predicates: records(resource.predicates),
+        rules: arrays(resource.rules),
+    };
+}
+/** L'id del container come lo serve la produzione, incorporato con `define:vars`. Pubblico per
+ *  costruzione, ed è l'unica risposta a "quale container gira su questo host". */
+export function extractGtmId(html) {
+    const at = html.indexOf('__rsAnalyticsConfig');
+    const block = at === -1 ? '' : html.slice(Math.max(0, html.lastIndexOf('<script', at)), at);
+    const id = /gtmId\s*=\s*"([^"]+)"/.exec(block)?.[1];
+    if (id === undefined)
+        throw new Error('no GTM id in the served markup — tracking is off on this host');
+    return id;
+}
+/** Le proprietà GA4 che il container configura. Senza nemmeno una, ogni tag evento scatta nel
+ *  vuoto: un elenco vuoto è un fallimento, non una nota. */
+export function googleTagIds(container) {
+    const ids = container.tags.filter((tag) => tag.function === '__googtag').map((tag) => tag.vtp_tagId);
+    return [...new Set(ids.filter((id) => typeof id === 'string'))];
+}
+const macroIndex = (arg) => {
+    if (!Array.isArray(arg) || arg[0] !== 'macro')
+        return null;
+    const index = arg[1];
+    return typeof index === 'number' ? index : null;
+};
+/** Cosa legge un predicato: `event` per il nome dell'evento dataLayer (`__e`), altrimenti il
+ *  nome della variabile stessa (`gtm.element`, `gtm.elementUrl`, `gtm.triggers`). */
+function macroKind(macros, index) {
+    const macro = index === null ? undefined : macros[index];
+    if (macro === undefined)
+        return null;
+    if (macro.function === '__e')
+        return 'event';
+    const name = macro.vtp_name;
+    return typeof name === 'string' ? name : null;
+}
+function applyPredicate(trigger, container, index) {
+    const predicate = typeof index === 'number' ? container.predicates[index] : undefined;
+    if (predicate === undefined) {
+        trigger.unsupported.push(`predicate #${String(index)} does not exist`);
+        return;
+    }
+    const fn = predicate.function;
+    const kind = macroKind(container.macros, macroIndex(predicate.arg0));
+    const value = predicate.arg1;
+    if (kind === INTERNAL_VARIABLE)
+        return;
+    const label = `${String(fn)} on ${kind ?? 'an unreadable variable'}`;
+    if (fn === '_eq' && kind === 'event' && typeof value === 'string')
+        trigger.firesOn.push(value);
+    else if (fn === '_css' && kind === 'gtm.element' && typeof value === 'string')
+        trigger.selectors.push(value);
+    else if (fn === '_cn' && kind === 'gtm.elementUrl' && typeof value === 'string')
+        trigger.urlContains.push(value);
+    else
+        trigger.unsupported.push(`${label} = ${JSON.stringify(value)}`);
+}
+const clausesOf = (rule) => rule.filter(Array.isArray).map((clause) => ({ op: clause[0], args: clause.slice(1) }));
+const targets = (clauses, op, tag) => clauses.some((clause) => clause.op === op && clause.args.includes(tag));
+function conditionsOf(clauses, container, trigger) {
+    for (const clause of clauses) {
+        if (clause.op === 'add' || clause.op === 'block')
+            continue;
+        // `unless` nega i suoi predicati; leggerli come requisiti invertirebbe il senso del
+        // trigger, quindi l'intera clausola si dichiara illeggibile.
+        if (clause.op !== 'if') {
+            trigger.unsupported.push(`\`${String(clause.op)}\` clause`);
+            continue;
+        }
+        for (const index of clause.args)
+            applyPredicate(trigger, container, index);
+    }
+}
+/** GTM tiene separati tag e condizioni: una regola elenca clausole, con `if` e `unless` che
+ *  nominano predicati e `add` e `block` che nominano tag. Un trigger per regola che aggiunge il tag. */
+export function extractTriggers(container) {
+    const triggers = [];
+    for (const [tag, definition] of container.tags.entries()) {
+        if (definition.function !== GA4_EVENT_TAG)
+            continue;
+        const name = definition.vtp_eventName;
+        const eventName = typeof name === 'string' ? name : `tag #${String(tag)}`;
+        const rules = container.rules.map(clausesOf);
+        const blocked = rules.some((clauses) => targets(clauses, 'block', tag));
+        for (const clauses of rules.filter((clauses) => targets(clauses, 'add', tag))) {
+            const trigger = { eventName, firesOn: [], selectors: [], urlContains: [], unsupported: [] };
+            if (blocked)
+                trigger.unsupported.push('a `block` rule targets this tag');
+            conditionsOf(clauses, container, trigger);
+            triggers.push(trigger);
+        }
+    }
+    return triggers;
+}

package/dist/lib/icon-specs.d.ts

@@ -0,0 +1,6 @@
+export interface IconSpec {
+    file: string;
+    size: number;
+    purpose: 'any' | 'maskable';
+}
+export declare const ICON_SPECS: readonly IconSpec[];

package/dist/lib/icon-specs.js

@@ -0,0 +1,6 @@
+// Senza sharp: il manifest del sito le confronta con le proprie icone senza caricare il disegnatore.
+export const ICON_SPECS = [
+    { file: 'icon-192.png', size: 192, purpose: 'any' },
+    { file: 'icon-512.png', size: 512, purpose: 'any' },
+    { file: 'icon-maskable-512.png', size: 512, purpose: 'maskable' },
+];

package/dist/lib/icons.d.ts

@@ -0,0 +1,6 @@
+import { type IconSpec } from './icon-specs.ts';
+export declare function renderIcon(svg: Buffer, spec: IconSpec, background: string): Promise<Buffer>;
+export declare function writeIcons(root: string, background: string): Promise<{
+    path: string;
+    bytes: number;
+}[]>;

package/dist/lib/icons.js

@@ -0,0 +1,32 @@
+import { readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import sharp from 'sharp';
+import { ICON_SPECS } from './icon-specs.js';
+// Il launcher ritaglia la maskable: resta intatto solo il cerchio centrale di diametro pari all'80%
+// del lato (W3C Web App Manifest, `purpose`), e il glifo sta nel quadrato inscritto in quel cerchio.
+const MASKABLE_GLYPH_SCALE = 0.8 / Math.SQRT2;
+async function rasterize(svg, side) {
+    const { width } = await sharp(svg).metadata();
+    return sharp(svg, { density: (72 * side) / width })
+        .resize(side, side, { fit: 'contain', background: { r: 0, g: 0, b: 0, alpha: 0 } })
+        .png()
+        .toBuffer();
+}
+export async function renderIcon(svg, spec, background) {
+    const glyphSide = Math.round(spec.purpose === 'maskable' ? spec.size * MASKABLE_GLYPH_SCALE : spec.size);
+    return sharp({ create: { width: spec.size, height: spec.size, channels: 4, background } })
+        .composite([{ input: await rasterize(svg, glyphSide), gravity: 'centre' }])
+        .png()
+        .toBuffer();
+}
+export async function writeIcons(root, background) {
+    const svg = readFileSync(join(root, 'public', 'favicon.svg'));
+    const written = [];
+    for (const spec of ICON_SPECS) {
+        const path = `public/${spec.file}`;
+        const png = await renderIcon(svg, spec, background);
+        writeFileSync(join(root, path), png);
+        written.push({ path, bytes: png.length });
+    }
+    return written;
+}

package/dist/lib/language-words.d.ts

@@ -0,0 +1,2 @@
+export declare const ITALIAN: RegExp;
+export declare const ENGLISH: RegExp;

package/dist/lib/lighthouse.d.ts

@@ -0,0 +1,17 @@
+export interface LighthouseRc {
+    ci: {
+        collect: {
+            url?: string[];
+            numberOfRuns?: number;
+            startServerCommand?: string;
+            startServerReadyPattern?: string;
+            startServerReadyTimeout?: number;
+            settings?: Record<string, unknown>;
+        };
+        upload?: Record<string, unknown>;
+        [section: string]: unknown;
+    };
+}
+export type LighthouseEnv = Partial<Record<'LH_PORT' | 'LH_RUNS' | 'LH_EXTERNAL_SERVER' | 'LH_CHROME_FLAGS' | 'LH_OUT', string>>;
+/** Le rotte arrivano da src/pages, il resto dal `.lighthouserc.json` del progetto; l'ambiente lo piega al giro locale. */
+export declare function lighthouseConfig(rc: LighthouseRc, routes: readonly string[], env: LighthouseEnv): LighthouseRc;

package/dist/lib/lighthouse.js

@@ -0,0 +1,23 @@
+const DEFAULT_PORT = '4321';
+/** Le rotte arrivano da src/pages, il resto dal `.lighthouserc.json` del progetto; l'ambiente lo piega al giro locale. */
+export function lighthouseConfig(rc, routes, env) {
+    const port = env.LH_PORT ?? DEFAULT_PORT;
+    const collect = { ...rc.ci.collect, url: routes.map((route) => `http://localhost:${port}${route}`) };
+    if (env.LH_RUNS)
+        collect.numberOfRuns = Number(env.LH_RUNS);
+    // Il server è già in ascolto: lo avvia lhci-local.sh, per servire una directory diversa.
+    if (env.LH_EXTERNAL_SERVER) {
+        delete collect.startServerCommand;
+        delete collect.startServerReadyPattern;
+        delete collect.startServerReadyTimeout;
+    }
+    else if (collect.startServerCommand !== undefined) {
+        collect.startServerCommand = collect.startServerCommand.replace(/--listen \d+/, `--listen ${port}`);
+    }
+    if (env.LH_CHROME_FLAGS)
+        collect.settings = { ...collect.settings, chromeFlags: env.LH_CHROME_FLAGS };
+    const ci = { ...rc.ci, collect };
+    if (env.LH_OUT)
+        ci.upload = { target: 'filesystem', outputDir: env.LH_OUT };
+    return { ci };
+}

package/dist/lib/past-tense.d.ts

@@ -0,0 +1 @@
+export declare const PAST_TENSE: RegExp[];

package/dist/lib/routes.d.ts

@@ -0,0 +1,31 @@
+export type PageFile = {
+    file: string;
+    source: string;
+};
+export type Expectations = {
+    exact: {
+        route: string;
+        file: string;
+    }[];
+    patterns: {
+        pattern: RegExp;
+        label: string;
+        file: string;
+    }[];
+    ssr: string[];
+};
+export type VerifiedRoute = {
+    path: string;
+    type: string;
+};
+export declare const ERROR_PAGES: readonly string[];
+export declare const NON_HTML_ROUTES: readonly VerifiedRoute[];
+export declare function filesWithExtension(dir: string, extension: string): string[];
+export declare function readPageFiles(pagesDir: string): PageFile[];
+export declare function routeOf(htmlPath: string, dist: string): string;
+export declare function expectedRoutes(pages: readonly PageFile[], pagesDir: string): Expectations;
+/** [HARD] Guardia fail-open: ogni asserzione per rotta itera sulle pagine emesse, quindi una dist vuota non asserisce niente. */
+export declare function missingRouteFailures(expected: Expectations, emitted: readonly string[], dist: string): string[];
+export declare function auditRoutes(expected: Expectations): string[];
+export declare function smokeRoutes(expected: Expectations, nonHtmlRoutes?: readonly VerifiedRoute[]): VerifiedRoute[];
+export declare function orphanExceptions(expected: Expectations): string[];

package/dist/lib/routes.js

@@ -0,0 +1,97 @@
+import { readdirSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+export const ERROR_PAGES = ['/404', '/500'];
+// Non escono da una pagina .astro: `robots.txt.ts` e `site.webmanifest.ts` sono endpoint,
+// `sitemap-index.xml` lo emette @astrojs/sitemap e `/api/health` è `prerender = false`.
+export const NON_HTML_ROUTES = [
+    { path: '/robots.txt', type: 'text/plain' },
+    { path: '/sitemap-index.xml', type: 'xml' },
+    // In produzione il MIME viene dall'estensione .webmanifest, non dall'intestazione che
+    // l'endpoint imposta: si verifica la famiglia json invece di fissarne una delle due forme.
+    { path: '/site.webmanifest', type: 'json' },
+    { path: '/api/health', type: 'application/json' },
+];
+export function filesWithExtension(dir, extension) {
+    return readdirSync(dir, { withFileTypes: true }).flatMap((entry) => {
+        const path = join(dir, entry.name);
+        if (entry.isDirectory())
+            return filesWithExtension(path, extension);
+        return entry.name.endsWith(extension) ? [path] : [];
+    });
+}
+export function readPageFiles(pagesDir) {
+    return filesWithExtension(pagesDir, '.astro').map((file) => ({ file, source: readFileSync(file, 'utf8') }));
+}
+const toPosix = (path, prefix) => path.slice(prefix.length).split(/[\\/]/).join('/');
+export function routeOf(htmlPath, dist) {
+    const route = toPosix(htmlPath, dist).replace(/\/index\.html$/, '');
+    return route.replace(/\.html$/, '') || '/';
+}
+const SSR_OPT_OUT = /^\s*export\s+const\s+prerender\s*=\s*false\b/m;
+function pageRouteOf(file, pagesDir) {
+    return (toPosix(file, pagesDir)
+        .replace(/\.astro$/, '')
+        .replace(/\/index$/, '') || '/');
+}
+function segmentPattern(segment) {
+    if (segment.startsWith('['))
+        return '[^/]+';
+    return segment.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+const TRAILING_REST_SEGMENT = /\/\[\.\.\.[^/]*\]$/;
+// Anche un segmento rest finale fa match col vuoto: `paginate()` emette la prima pagina come
+// percorso nudo (`/news`, mai `/news/1`), quindi esigere un segmento boccia un archivio di una pagina.
+function routePattern(route) {
+    const body = (path) => path.split('/').map(segmentPattern).join('/');
+    if (!TRAILING_REST_SEGMENT.test(route))
+        return new RegExp(`^${body(route)}$`);
+    return new RegExp(`^${body(route.replace(TRAILING_REST_SEGMENT, ''))}(?:/.*)?$`);
+}
+export function expectedRoutes(pages, pagesDir) {
+    const expectations = { exact: [], patterns: [], ssr: [] };
+    for (const { file, source } of pages) {
+        if (SSR_OPT_OUT.test(source)) {
+            expectations.ssr.push(file);
+            continue;
+        }
+        const route = pageRouteOf(file, pagesDir);
+        if (!route.includes('[')) {
+            expectations.exact.push({ route, file });
+            continue;
+        }
+        expectations.patterns.push({ pattern: routePattern(route), label: route, file });
+    }
+    return expectations;
+}
+/** [HARD] Guardia fail-open: ogni asserzione per rotta itera sulle pagine emesse, quindi una dist vuota non asserisce niente. */
+export function missingRouteFailures(expected, emitted, dist) {
+    if (emitted.length === 0) {
+        return [`${dist} non contiene nessun .html: nessuna rotta misurata, quindi i budget per rotta non affermano niente`];
+    }
+    const failures = [];
+    const routes = new Set(emitted);
+    for (const { route, file } of expected.exact) {
+        if (!routes.has(route))
+            failures.push(`rotta mancante ${route}: ${file} è prerenderizzata ma non ha emesso HTML`);
+    }
+    for (const { pattern, label, file } of expected.patterns) {
+        if (emitted.some((route) => pattern.test(route)))
+            continue;
+        failures.push(`rotta mancante ${label}: ${file} è prerenderizzata ma getStaticPaths non ha emesso niente`);
+    }
+    return failures;
+}
+// Ordinate: l'ordine nativo di readdirSync cambia da un filesystem all'altro.
+export function auditRoutes(expected) {
+    return expected.exact
+        .map(({ route }) => route)
+        .filter((route) => !ERROR_PAGES.includes(route))
+        .sort();
+}
+export function smokeRoutes(expected, nonHtmlRoutes = NON_HTML_ROUTES) {
+    return [...auditRoutes(expected).map((path) => ({ path, type: 'text/html' })), ...nonHtmlRoutes];
+}
+export function orphanExceptions(expected) {
+    const routes = new Set(expected.exact.map(({ route }) => route));
+    return ERROR_PAGES.filter((page) => !routes.has(page));
+}

package/dist/lib/smoke-production.d.ts

@@ -0,0 +1,35 @@
+import type { VerifiedRoute } from './routes.ts';
+export interface SmokeResponse {
+    ok: boolean;
+    status: number;
+    headers: {
+        get: (name: string) => string | null;
+    };
+}
+export type Fetcher = (url: string) => Promise<SmokeResponse>;
+export interface SmokeContext {
+    get: Fetcher;
+    baseUrl: string;
+    siteUrl: string;
+    securityHeaders: Record<string, string | null>;
+}
+export type SmokeCheck = (context: SmokeContext, pages: readonly VerifiedRoute[]) => Promise<CheckResult[]>;
+export interface CheckResult {
+    check: string;
+    status: 'pass' | 'fail' | 'skip';
+    detail?: string;
+}
+export declare const SECURITY_HEADERS: Record<string, string | null>;
+/** Deve corrispondere al `source` del rewrite in vercel.json. */
+export declare const BOTID_CHALLENGE = "/149e9513-01fa-4fb0-aad4-566afd725d1b/2d206a39-8ed7-437e-a3be-862e0f06eea3/a-4-a/c.js";
+/** L'alias di produzione di Vercel impiega un attimo a puntare al deployment appena caricato. */
+export declare function waitForAlias({ get, baseUrl }: SmokeContext, sleep: (ms: number) => Promise<void>, attempts?: number): Promise<void>;
+export declare function checkPages({ get, baseUrl }: SmokeContext, pages: readonly VerifiedRoute[]): Promise<CheckResult[]>;
+export declare function checkSecurityHeaders({ get, baseUrl, securityHeaders }: SmokeContext): Promise<CheckResult[]>;
+export declare function checkBotIdChallenge({ get, baseUrl }: SmokeContext): Promise<CheckResult[]>;
+/** Il 308 da www all'apice, da vercel.json: dipende dal DNS e dal dominio del progetto Vercel, non dal deployment. */
+export declare function checkCanonicalHost({ get, baseUrl, siteUrl }: SmokeContext): Promise<CheckResult[]>;
+export declare function checkTrailingSlash({ get, baseUrl }: SmokeContext, pages: readonly VerifiedRoute[]): Promise<CheckResult[]>;
+export declare const DEFAULT_CHECKS: readonly SmokeCheck[];
+/** In sequenza, non in parallelo: l'ordine dei risultati è quello dei controlli. */
+export declare function runChecks(context: SmokeContext, pages: readonly VerifiedRoute[], checks?: readonly SmokeCheck[]): Promise<CheckResult[]>;

package/dist/lib/smoke-production.js

@@ -0,0 +1,132 @@
+const pass = (check) => ({ check, status: 'pass' });
+const fail = (check, detail) => ({ check, status: 'fail', detail });
+const skip = (check, detail) => ({ check, status: 'skip', detail });
+const messageOf = (error) => (error instanceof Error ? error.message : String(error));
+// Dalla regola globale `/(.*)` di vercel.json. `null` = verifica solo la presenza; src/vercel-headers.test.ts fissa i valori.
+export const SECURITY_HEADERS = {
+    'content-security-policy': null,
+    'strict-transport-security': null,
+    'x-content-type-options': 'nosniff',
+    'x-frame-options': 'DENY',
+    'referrer-policy': null,
+    'permissions-policy': null,
+};
+/** Deve corrispondere al `source` del rewrite in vercel.json. */
+export const BOTID_CHALLENGE = '/149e9513-01fa-4fb0-aad4-566afd725d1b/2d206a39-8ed7-437e-a3be-862e0f06eea3/a-4-a/c.js';
+/** L'alias di produzione di Vercel impiega un attimo a puntare al deployment appena caricato. */
+export async function waitForAlias({ get, baseUrl }, sleep, attempts = 5) {
+    for (let attempt = 1; attempt <= attempts; attempt++) {
+        try {
+            if ((await get(baseUrl)).ok)
+                return;
+        }
+        catch { }
+        if (attempt < attempts)
+            await sleep(attempt * 2000);
+    }
+}
+export async function checkPages({ get, baseUrl }, pages) {
+    const results = [];
+    for (const { path, type } of pages) {
+        const check = `GET ${path}`;
+        try {
+            const response = await get(`${baseUrl}${path}`);
+            const contentType = response.headers.get('content-type') ?? '';
+            if (response.status !== 200)
+                results.push(fail(check, `atteso 200, ricevuto ${response.status}`));
+            else if (!contentType.includes(type))
+                results.push(fail(check, `atteso un content-type ${type}, ricevuto "${contentType}"`));
+            else
+                results.push(pass(check));
+        }
+        catch (error) {
+            results.push(fail(check, messageOf(error)));
+        }
+    }
+    return results;
+}
+export async function checkSecurityHeaders({ get, baseUrl, securityHeaders }) {
+    let response;
+    try {
+        response = await get(baseUrl);
+    }
+    catch (error) {
+        return [fail('header di sicurezza', messageOf(error))];
+    }
+    const results = Object.entries(securityHeaders).map(([header, expected]) => {
+        const check = `header ${header}`;
+        const value = response.headers.get(header);
+        if (value === null)
+            return fail(check, 'assente');
+        if (expected !== null && value !== expected)
+            return fail(check, `atteso "${expected}", ricevuto "${value}"`);
+        return pass(check);
+    });
+    // Il noindex `has: host = *.vercel.app` di vercel.json applicato al dominio vero farebbe sparire il sito da ogni indice.
+    const check = 'nessun x-robots-tag sull’host di produzione';
+    const robots = response.headers.get('x-robots-tag');
+    results.push(robots === null ? pass(check) : fail(check, `presente su ${baseUrl}: "${robots}"`));
+    return results;
+}
+export async function checkBotIdChallenge({ get, baseUrl }) {
+    const check = 'challenge di BotID servita dalla stessa origine';
+    try {
+        const response = await get(`${baseUrl}${BOTID_CHALLENGE}`);
+        if (response.status !== 200)
+            return [fail(check, `atteso 200 dal rewrite, ricevuto ${response.status}`)];
+        return [pass(check)];
+    }
+    catch (error) {
+        return [fail(check, messageOf(error))];
+    }
+}
+/** Il 308 da www all'apice, da vercel.json: dipende dal DNS e dal dominio del progetto Vercel, non dal deployment. */
+export async function checkCanonicalHost({ get, baseUrl, siteUrl }) {
+    const check = 'www → apice 308';
+    if (baseUrl !== siteUrl)
+        return [skip(check, `l’URL di base non è ${siteUrl}`)];
+    try {
+        const response = await get(`https://www.${new URL(siteUrl).host}/`);
+        const location = response.headers.get('location') ?? '';
+        if (response.status !== 308)
+            return [fail(check, `atteso 308, ricevuto ${response.status}`)];
+        if (!location.startsWith(siteUrl))
+            return [fail(check, `location "${location}" non punta a ${siteUrl}`)];
+        return [pass(check)];
+    }
+    catch (error) {
+        return [fail(check, messageOf(error))];
+    }
+}
+export async function checkTrailingSlash({ get, baseUrl }, pages) {
+    const page = pages.find(({ path, type }) => type === 'text/html' && path !== '/');
+    const check = 'barra finale → 308';
+    if (page === undefined)
+        return [skip(check, 'nessuna pagina HTML oltre a / da sondare')];
+    try {
+        const response = await get(`${baseUrl}${page.path}/`);
+        if (response.status !== 308)
+            return [fail(check, `atteso 308 su ${page.path}/, ricevuto ${response.status}`)];
+        const location = response.headers.get('location') ?? '';
+        if (!location.endsWith(page.path))
+            return [fail(check, `location "${location}" non punta a ${page.path}`)];
+        return [pass(check)];
+    }
+    catch (error) {
+        return [fail(check, messageOf(error))];
+    }
+}
+export const DEFAULT_CHECKS = [
+    checkPages,
+    checkSecurityHeaders,
+    checkBotIdChallenge,
+    checkCanonicalHost,
+    checkTrailingSlash,
+];
+/** In sequenza, non in parallelo: l'ordine dei risultati è quello dei controlli. */
+export async function runChecks(context, pages, checks = DEFAULT_CHECKS) {
+    const results = [];
+    for (const check of checks)
+        results.push(...(await check(context, pages)));
+    return results;
+}

package/dist/lib/vercel-cli-pin.d.ts

@@ -0,0 +1,2 @@
+import { type Hit } from './cli.ts';
+export declare function pinFindings(workflow: string, latest: string): Hit[];

package/dist/sh/lhci-local.sh

@@ -0,0 +1,106 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+PORT="${LHCI_PORT:-4399}"
+OUT_DIR='dist/lh-prod'
+REPORT_DIR="${LHCI_REPORT_DIR:-.lighthouseci/local}"
+
+export TMPDIR="${TMPDIR:-/tmp}"
+
+detect_chrome() {
+  local candidate
+  for candidate in \
+    "${CHROME_PATH:-}" \
+    $(ls -d "$HOME"/.cache/ms-playwright/chromium-*/chrome-linux/chrome 2>/dev/null | sort -V -r) \
+    $(ls -d "$HOME"/.cache/puppeteer/chrome/*/chrome-linux*/chrome 2>/dev/null | sort -V -r) \
+    /usr/bin/google-chrome /usr/bin/chromium /usr/bin/chromium-browser
+  do
+    [[ -n "${candidate}" && -x "${candidate}" && "${candidate}" != *.exe ]] || continue
+    if "${candidate}" --version >/dev/null 2>&1; then
+      echo "${candidate}"
+      return 0
+    fi
+  done
+  return 1
+}
+
+if ! CHROME_PATH="$(detect_chrome)"; then
+  echo "✗ nessun Chrome/Chromium per Linux utilizzabile." >&2
+  echo "  Installane uno con: pnpm dlx playwright@latest install chromium" >&2
+  echo "  Oppure indica il binario: CHROME_PATH=/percorso/di/chrome pnpm run lhci:local" >&2
+  exit 1
+fi
+export CHROME_PATH
+echo "✓ chrome: ${CHROME_PATH} ($("${CHROME_PATH}" --version 2>/dev/null))"
+
+SERVER_PID=''
+
+cleanup() {
+  if [[ -n "${SERVER_PID}" ]]; then
+    kill -- "-${SERVER_PID}" 2>/dev/null || kill "${SERVER_PID}" 2>/dev/null || true
+    pkill -f "serve@14 .*--listen ${PORT}" 2>/dev/null || true
+  fi
+  find . -maxdepth 1 \( -name '*wsl.localhost*' -o -name 'undefined*' \) -exec rm -rf {} + 2>/dev/null || true
+}
+trap cleanup EXIT
+
+echo "→ build equivalente alla produzione in ${OUT_DIR}"
+VERCEL_ENV=production pnpm build --outDir "${OUT_DIR}"
+
+if ! grep -qx 'Allow: /' "${OUT_DIR}/client/robots.txt"; then
+  echo "✗ ${OUT_DIR}/client/robots.txt non ha 'Allow: /': la build non equivale alla produzione." >&2
+  head -3 "${OUT_DIR}/client/robots.txt" >&2
+  exit 1
+fi
+echo "✓ robots.txt: Allow: /"
+
+echo "→ avvio del server statico su :${PORT}"
+setsid pnpm dlx serve@14 "${OUT_DIR}/client" --listen "${PORT}" --no-clipboard >/dev/null 2>&1 &
+SERVER_PID=$!
+
+for _ in $(seq 1 60); do
+  if curl -fs -o /dev/null "http://localhost:${PORT}/"; then break; fi
+  sleep 1
+done
+if ! curl -fs -o /dev/null "http://localhost:${PORT}/"; then
+  echo "✗ il server non ha risposto su :${PORT} entro 60s." >&2
+  echo "  Riprova su un’altra porta: LHCI_PORT=4400 pnpm run lhci:local" >&2
+  exit 1
+fi
+echo "✓ server pronto"
+
+rm -rf "${REPORT_DIR}"
+
+LH_PORT="${PORT}" \
+LH_RUNS="${LHCI_RUNS:-1}" \
+LH_OUT="${REPORT_DIR}" \
+LH_EXTERNAL_SERVER=1 \
+LH_CHROME_FLAGS='--no-sandbox --disable-dev-shm-usage' \
+  node "${OFFICINA_BIN}" check lighthouse
+
+echo
+echo "→ punteggio per URL (mediana su ${LHCI_RUNS:-1} giro/i, come la calcola LHCI)"
+node -e '
+const fs = require("fs")
+const dir = process.argv[1]
+const byUrl = new Map()
+for (const f of fs.readdirSync(dir).filter((f) => f.endsWith(".report.json"))) {
+  const r = JSON.parse(fs.readFileSync(`${dir}/${f}`))
+  const url = String(r.finalDisplayedUrl)
+  if (!byUrl.has(url)) byUrl.set(url, [])
+  byUrl.get(url).push(r.categories)
+}
+const median = (xs) => {
+  const s = [...xs].sort((a, b) => a - b)
+  return s[Math.floor(s.length / 2)]
+}
+for (const [url, runs] of [...byUrl].sort()) {
+  const pick = (k) => median(runs.map((c) => c[k].score)).toFixed(2)
+  console.log(
+    url.padEnd(46),
+    "perf", pick("performance"),
+    "a11y", pick("accessibility"),
+    "bp", pick("best-practices"),
+    "seo", pick("seo"),
+  )
+}' "${REPORT_DIR}"