@elia97/officina 0.3.0 → 0.5.0

package/dist/lib/contract.js

@@ -1,5 +1,6 @@
 import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
 import { join } from 'node:path';
+const MANIFEST = 'package.json';
 export const CONTRACT = [
     { kind: 'file', path: 'src/components/ui/section.astro', reason: 'le sezioni generate la importano' },
     { kind: 'file', path: 'src/components/ui/container.astro', reason: 'le sezioni e le pagine generate lo importano' },
@@ -27,33 +28,77 @@ export const CONTRACT = [
         extension: '.ts',
         reason: 'gen:collection e gen:section scrivono lì gli schemi',
     },
+    {
+        kind: 'anchor',
+        path: 'src/lib/schemas/common.ts',
+        text: 'export const ctaSchema',
+        reason: 'lo schema di ogni sezione generata lo importa da ../common',
+    },
+    {
+        kind: 'anchor',
+        path: 'src/lib/schemas/common.ts',
+        text: 'export function imageSchema',
+        reason: "lo schema di una sezione con immagine lo importa da ../common, e lo chiama con l'helper di Astro",
+    },
+    {
+        kind: 'file',
+        path: 'src/assets/placeholder.jpg',
+        reason: 'il contenuto di una sezione con immagine ci punta appena generato',
+    },
     {
         kind: 'anchor',
         path: 'src/content.config.ts',
         text: 'export const collections',
         reason: 'gen:collection e gen:section registrano lì la collection',
     },
+    {
+        kind: 'dependency',
+        name: 'class-variance-authority',
+        reason: 'il componente che scrive gen:component lo importa',
+    },
+    { kind: 'script', name: 'check', reason: 'il post-gen di ogni generatore lo lancia con `pnpm run check`' },
 ];
 function hasFileWith(directory, extension) {
     if (!existsSync(directory) || !statSync(directory).isDirectory())
         return false;
     return readdirSync(directory, { recursive: true }).some((entry) => String(entry).endsWith(extension));
 }
-function gapFor(root, requirement) {
+function manifestGap(manifest, requirement) {
+    if (requirement.kind === 'script') {
+        return manifest.scripts?.[requirement.name] === undefined
+            ? { path: MANIFEST, message: `manca lo script \`${requirement.name}\`: ${requirement.reason}` }
+            : undefined;
+    }
+    if (requirement.kind !== 'dependency')
+        return undefined;
+    const declared = { ...manifest.dependencies, ...manifest.devDependencies };
+    return declared[requirement.name] === undefined
+        ? { path: MANIFEST, message: `manca la dipendenza \`${requirement.name}\`: ${requirement.reason}` }
+        : undefined;
+}
+function pathGap(root, requirement) {
+    if (requirement.kind === 'dependency' || requirement.kind === 'script')
+        return undefined;
+    const gap = (message) => ({ path: requirement.path, message });
     const target = join(root, requirement.path);
     if (requirement.kind === 'directory') {
-        return hasFileWith(target, requirement.extension) ? undefined : `manca, o è vuota: ${requirement.reason}`;
+        return hasFileWith(target, requirement.extension) ? undefined : gap(`manca, o è vuota: ${requirement.reason}`);
     }
     if (!existsSync(target))
-        return `manca: ${requirement.reason}`;
+        return gap(`manca: ${requirement.reason}`);
     if (requirement.kind === 'anchor' && !readFileSync(target, 'utf8').includes(requirement.text)) {
-        return `manca l'ancoraggio \`${requirement.text}\`: ${requirement.reason}`;
+        return gap(`manca l'ancoraggio \`${requirement.text}\`: ${requirement.reason}`);
     }
     return undefined;
 }
+function readManifest(root) {
+    const target = join(root, MANIFEST);
+    return existsSync(target) ? JSON.parse(readFileSync(target, 'utf8')) : {};
+}
 export function contractGaps(root) {
+    const manifest = readManifest(root);
     return CONTRACT.flatMap((requirement) => {
-        const message = gapFor(root, requirement);
-        return message === undefined ? [] : [{ path: requirement.path, message }];
+        const gap = pathGap(root, requirement) ?? manifestGap(manifest, requirement);
+        return gap === undefined ? [] : [gap];
     });
 }

package/dist/lib/pins.d.ts

@@ -0,0 +1,10 @@
+import { type Hit } from './cli.ts';
+/** Un file che porta il pin di un pacchetto scaricato al volo, e il suo contenuto. */
+export interface PinSite {
+    path: string;
+    source: string;
+}
+export interface PinHit extends Hit {
+    path: string;
+}
+export declare function pinFindings(pkg: string, latest: string, sites: readonly [PinSite, ...PinSite[]]): PinHit[];

package/dist/lib/pins.js

@@ -0,0 +1,48 @@
+import { readLines } from './cli.js';
+const EXACT = /^\d+\.\d+\.\d+$/;
+const escaped = (name) => name.replace(/[.*+?^${}()|[\]\\/]/g, '\\$&');
+function pinsOf(pkg, sites) {
+    const pattern = new RegExp(`(?<![\\w@/.-])${escaped(pkg)}@([\\w.-]+)`);
+    return sites.flatMap(({ path, source }) => readLines(source).flatMap(({ n, text }) => {
+        const version = pattern.exec(text)?.[1];
+        return version === undefined ? [] : [{ path, line: n, version }];
+    }));
+}
+const major = (version) => Number(/^(\d+)\./.exec(version)?.[1]);
+// Il pin esatto è il contratto: `vercel@59` ridà una CLI diversa ogni settimana, e un deploy che
+// fallisce non si riproduce. La major più nuova su npm resta una segnalazione, non un obbligo.
+export function pinFindings(pkg, latest, sites) {
+    const pins = pinsOf(pkg, sites);
+    const home = sites[0].path;
+    if (pins.length === 0) {
+        return [{ path: home, line: 1, message: `nessun \`${pkg}@<x.y.z>\`: il pin è sparito` }];
+    }
+    const loose = pins.filter(({ version }) => !EXACT.test(version));
+    if (loose.length > 0) {
+        return loose.map(({ path, line, version }) => ({
+            path,
+            line,
+            message: `${pkg}@${version}: il pin va scritto per intero, \`x.y.z\``,
+        }));
+    }
+    const versions = [...new Set(pins.map(({ version }) => version))].sort();
+    const [pinned = ''] = versions;
+    if (versions.length > 1) {
+        return pins.map(({ path, line, version }) => ({
+            path,
+            line,
+            message: `${pkg}@${version}: il pin non è lo stesso ovunque (${versions.join(', ')})`,
+        }));
+    }
+    const published = major(latest);
+    if (Number.isNaN(published)) {
+        return [{ path: home, line: 1, message: `versione pubblicata illeggibile: ${JSON.stringify(latest)}` }];
+    }
+    if (major(pinned) >= published)
+        return [];
+    return pins.map(({ path, line }) => ({
+        path,
+        line,
+        message: `${pkg}@${pinned}: su npm è pubblicata la major ${published}`,
+    }));
+}

package/dist/lib/routes.d.ts

@@ -18,6 +18,8 @@ export type VerifiedRoute = {
     path: string;
     type: string;
 };
+/** `/blog/[slug]` → `/blog/hello-world`: il percorso vero che sta per il pattern. */
+export type Representatives = Readonly<Record<string, string>>;
 export declare const ERROR_PAGES: readonly string[];
 export declare const NON_HTML_ROUTES: readonly VerifiedRoute[];
 export declare function filesWithExtension(dir: string, extension: string): string[];
@@ -26,6 +28,8 @@ export declare function routeOf(htmlPath: string, dist: string): string;
 export declare function expectedRoutes(pages: readonly PageFile[], pagesDir: string): Expectations;
 /** [HARD] Guardia fail-open: ogni asserzione per rotta itera sulle pagine emesse, quindi una dist vuota non asserisce niente. */
 export declare function missingRouteFailures(expected: Expectations, emitted: readonly string[], dist: string): string[];
-export declare function auditRoutes(expected: Expectations): string[];
-export declare function smokeRoutes(expected: Expectations, nonHtmlRoutes?: readonly VerifiedRoute[]): VerifiedRoute[];
+/** I pattern dinamici che `officina.config.ts` non ha ancora mandato nessuno a visitare. */
+export declare function missingRepresentatives(expected: Expectations, representatives?: Representatives): string[];
+export declare function auditRoutes(expected: Expectations, representatives?: Representatives): string[];
+export declare function smokeRoutes(expected: Expectations, nonHtmlRoutes?: readonly VerifiedRoute[], representatives?: Representatives): VerifiedRoute[];
 export declare function orphanExceptions(expected: Expectations): string[];

package/dist/lib/routes.js

@@ -66,30 +66,39 @@ export function expectedRoutes(pages, pagesDir) {
 /** [HARD] Guardia fail-open: ogni asserzione per rotta itera sulle pagine emesse, quindi una dist vuota non asserisce niente. */
 export function missingRouteFailures(expected, emitted, dist) {
     if (emitted.length === 0) {
-        return [`${dist} holds no .html file — no route was measured, so the per-route budgets assert nothing`];
+        return [`${dist} non contiene nessun .html: nessuna rotta misurata, quindi i budget per rotta non affermano niente`];
     }
     const failures = [];
     const routes = new Set(emitted);
     for (const { route, file } of expected.exact) {
         if (!routes.has(route))
-            failures.push(`missing route ${route} — ${file} is prerendered but emitted no HTML`);
+            failures.push(`rotta mancante ${route}: ${file} è prerenderizzata ma non ha emesso HTML`);
     }
     for (const { pattern, label, file } of expected.patterns) {
         if (emitted.some((route) => pattern.test(route)))
             continue;
-        failures.push(`missing route ${label} — ${file} is prerendered but getStaticPaths emitted nothing`);
+        failures.push(`rotta mancante ${label}: ${file} è prerenderizzata ma getStaticPaths non ha emesso niente`);
     }
     return failures;
 }
-// Ordinate: l'ordine nativo di readdirSync cambia da un filesystem all'altro.
-export function auditRoutes(expected) {
-    return expected.exact
-        .map(({ route }) => route)
-        .filter((route) => !ERROR_PAGES.includes(route))
+/** I pattern dinamici che `officina.config.ts` non ha ancora mandato nessuno a visitare. */
+export function missingRepresentatives(expected, representatives = {}) {
+    return expected.patterns
+        .map(({ label }) => label)
+        .filter((label) => representatives[label] === undefined)
         .sort();
 }
-export function smokeRoutes(expected, nonHtmlRoutes = NON_HTML_ROUTES) {
-    return [...auditRoutes(expected).map((path) => ({ path, type: 'text/html' })), ...nonHtmlRoutes];
+// Ordinate: l'ordine nativo di readdirSync cambia da un filesystem all'altro. Un pattern dinamico
+// entra col percorso vero che il progetto gli ha dato: senza, resta una pagina che nessuno guarda.
+export function auditRoutes(expected, representatives = {}) {
+    const exact = expected.exact.map(({ route }) => route).filter((route) => !ERROR_PAGES.includes(route));
+    const stand = expected.patterns
+        .map(({ label }) => representatives[label])
+        .filter((path) => path !== undefined);
+    return [...exact, ...stand].sort();
+}
+export function smokeRoutes(expected, nonHtmlRoutes = NON_HTML_ROUTES, representatives = {}) {
+    return [...auditRoutes(expected, representatives).map((path) => ({ path, type: 'text/html' })), ...nonHtmlRoutes];
 }
 export function orphanExceptions(expected) {
     const routes = new Set(expected.exact.map(({ route }) => route));

package/dist/lib/smoke-production.js

@@ -33,9 +33,9 @@ export async function checkPages({ get, baseUrl }, pages) {
             const response = await get(`${baseUrl}${path}`);
             const contentType = response.headers.get('content-type') ?? '';
             if (response.status !== 200)
-                results.push(fail(check, `expected 200, got ${response.status}`));
+                results.push(fail(check, `atteso 200, ricevuto ${response.status}`));
             else if (!contentType.includes(type))
-                results.push(fail(check, `expected a ${type} content-type, got "${contentType}"`));
+                results.push(fail(check, `atteso un content-type ${type}, ricevuto "${contentType}"`));
             else
                 results.push(pass(check));
         }
@@ -51,29 +51,29 @@ export async function checkSecurityHeaders({ get, baseUrl, securityHeaders }) {
         response = await get(baseUrl);
     }
     catch (error) {
-        return [fail('security headers', messageOf(error))];
+        return [fail('header di sicurezza', messageOf(error))];
     }
     const results = Object.entries(securityHeaders).map(([header, expected]) => {
         const check = `header ${header}`;
         const value = response.headers.get(header);
         if (value === null)
-            return fail(check, 'missing');
+            return fail(check, 'assente');
         if (expected !== null && value !== expected)
-            return fail(check, `expected "${expected}", got "${value}"`);
+            return fail(check, `atteso "${expected}", ricevuto "${value}"`);
         return pass(check);
     });
     // Il noindex `has: host = *.vercel.app` di vercel.json applicato al dominio vero farebbe sparire il sito da ogni indice.
-    const check = 'no x-robots-tag on the production host';
+    const check = 'nessun x-robots-tag sull’host di produzione';
     const robots = response.headers.get('x-robots-tag');
-    results.push(robots === null ? pass(check) : fail(check, `present on ${baseUrl}: "${robots}"`));
+    results.push(robots === null ? pass(check) : fail(check, `presente su ${baseUrl}: "${robots}"`));
     return results;
 }
 export async function checkBotIdChallenge({ get, baseUrl }) {
-    const check = 'BotID challenge proxied same-origin';
+    const check = 'challenge di BotID servita dalla stessa origine';
     try {
         const response = await get(`${baseUrl}${BOTID_CHALLENGE}`);
         if (response.status !== 200)
-            return [fail(check, `expected 200 from the rewrite, got ${response.status}`)];
+            return [fail(check, `atteso 200 dal rewrite, ricevuto ${response.status}`)];
         return [pass(check)];
     }
     catch (error) {
@@ -82,16 +82,16 @@ export async function checkBotIdChallenge({ get, baseUrl }) {
 }
 /** Il 308 da www all'apice, da vercel.json: dipende dal DNS e dal dominio del progetto Vercel, non dal deployment. */
 export async function checkCanonicalHost({ get, baseUrl, siteUrl }) {
-    const check = 'www → apex 308';
+    const check = 'www → apice 308';
     if (baseUrl !== siteUrl)
-        return [skip(check, `base URL is not ${siteUrl}`)];
+        return [skip(check, `l’URL di base non è ${siteUrl}`)];
     try {
         const response = await get(`https://www.${new URL(siteUrl).host}/`);
         const location = response.headers.get('location') ?? '';
         if (response.status !== 308)
-            return [fail(check, `expected 308, got ${response.status}`)];
+            return [fail(check, `atteso 308, ricevuto ${response.status}`)];
         if (!location.startsWith(siteUrl))
-            return [fail(check, `location "${location}" does not point at ${siteUrl}`)];
+            return [fail(check, `location "${location}" non punta a ${siteUrl}`)];
         return [pass(check)];
     }
     catch (error) {
@@ -100,16 +100,16 @@ export async function checkCanonicalHost({ get, baseUrl, siteUrl }) {
 }
 export async function checkTrailingSlash({ get, baseUrl }, pages) {
     const page = pages.find(({ path, type }) => type === 'text/html' && path !== '/');
-    const check = 'trailing slash → 308';
+    const check = 'barra finale → 308';
     if (page === undefined)
-        return [skip(check, 'no HTML page other than / to probe')];
+        return [skip(check, 'nessuna pagina HTML oltre a / da sondare')];
     try {
         const response = await get(`${baseUrl}${page.path}/`);
         if (response.status !== 308)
-            return [fail(check, `expected 308 on ${page.path}/, got ${response.status}`)];
+            return [fail(check, `atteso 308 su ${page.path}/, ricevuto ${response.status}`)];
         const location = response.headers.get('location') ?? '';
         if (!location.endsWith(page.path))
-            return [fail(check, `location "${location}" does not point at ${page.path}`)];
+            return [fail(check, `location "${location}" non punta a ${page.path}`)];
         return [pass(check)];
     }
     catch (error) {

package/dist/lib/tooling.d.ts

@@ -0,0 +1,3 @@
+import type { Manifest } from './alignment.ts';
+import type { ContractGap } from './contract.ts';
+export declare function toolingGaps({ devDependencies }: Manifest): ContractGap[];

package/dist/lib/tooling.js

@@ -0,0 +1,24 @@
+import { peerRange, withinRange } from './versions.js';
+// Strumenti che i preset e le action danno per scontati: senza, il progetto sembra allineato e poi
+// il primo commit o il primo job li cerca e non li trova.
+const REQUIRED = [
+    { name: '@biomejs/biome', reason: 'il progetto estende `@elia97/officina/biome`' },
+    { name: 'lefthook', reason: 'il preset dei git hook è suo, e `prepare` lo installa' },
+    { name: '@commitlint/cli', reason: 'il preset di lefthook lo lancia su ogni messaggio di commit' },
+    { name: '@commitlint/config-conventional', reason: 'è la configurazione che commitlint estende' },
+    { name: 'fallow', reason: '`check:deadcode` e `check:health` lo lanciano' },
+];
+const BIOME = '@biomejs/biome';
+const MANIFEST = 'package.json';
+// Il preset usa una regola `nursery`, che fra una major e l'altra di Biome cambia nome o sparisce:
+// l'intervallo che regge lo dichiara il pacchetto, in un posto solo.
+function biomeRangeGap(declared) {
+    const range = peerRange(BIOME);
+    return withinRange(declared, range) ? undefined : `\`${BIOME}\` è \`${declared}\`: il preset regge \`${range}\``;
+}
+export function toolingGaps({ devDependencies = {} }) {
+    const gaps = REQUIRED.filter(({ name }) => devDependencies[name] === undefined).map(({ name, reason }) => ({ path: MANIFEST, message: `\`${name}\` non è fra le devDependencies: ${reason}` }));
+    const biome = devDependencies[BIOME];
+    const range = biome === undefined ? undefined : biomeRangeGap(biome);
+    return range === undefined ? gaps : [...gaps, { path: MANIFEST, message: range }];
+}

package/dist/lib/validate.d.ts

@@ -0,0 +1,11 @@
+export type Check = (value: unknown, path: string) => string[];
+export declare function typeName(value: unknown): string;
+export declare const problem: (path: string, expected: string, value: unknown) => string;
+export declare const aString: Check;
+export declare const aNumber: Check;
+export declare const aFunction: Check;
+export declare const aStringOrNull: Check;
+export declare const anArrayOf: (item: Check) => Check;
+export declare const aRecordOf: (item: Check) => Check;
+export declare const oneOf: (expected: string, allowed: readonly unknown[]) => Check;
+export declare const aShape: (fields: Record<string, Check>) => Check;

package/dist/lib/validate.js

@@ -0,0 +1,40 @@
+const isRecord = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+const NAMES = new Map([
+    ['string', 'una stringa'],
+    ['number', 'un numero'],
+    ['boolean', 'un booleano'],
+    ['function', 'una funzione'],
+    ['undefined', 'niente'],
+]);
+export function typeName(value) {
+    if (value === null)
+        return 'null';
+    if (Array.isArray(value))
+        return 'un array';
+    return NAMES.get(typeof value) ?? 'un oggetto';
+}
+export const problem = (path, expected, value) => `${path}: atteso ${expected}, ricevuto ${typeName(value)}`;
+export const aString = (value, path) => (typeof value === 'string' ? [] : [problem(path, 'una stringa', value)]);
+export const aNumber = (value, path) => (typeof value === 'number' ? [] : [problem(path, 'un numero', value)]);
+export const aFunction = (value, path) => typeof value === 'function' ? [] : [problem(path, 'una funzione', value)];
+export const aStringOrNull = (value, path) => typeof value === 'string' || value === null ? [] : [problem(path, 'una stringa oppure null', value)];
+export const anArrayOf = (item) => (value, path) => Array.isArray(value)
+    ? value.flatMap((entry, index) => item(entry, `${path}[${index}]`))
+    : [problem(path, 'un array', value)];
+export const aRecordOf = (item) => (value, path) => isRecord(value)
+    ? Object.entries(value).flatMap(([key, entry]) => item(entry, `${path}.${key}`))
+    : [problem(path, 'un oggetto', value)];
+export const oneOf = (expected, allowed) => (value, path) => allowed.includes(value) ? [] : [problem(path, expected, value)];
+// Una voce non dichiarata è un errore: `sitUrl` al posto di `siteUrl` non deve passare in
+// silenzio, che è il modo esatto in cui una configurazione smette di dire qualcosa.
+export const aShape = (fields) => (value, path) => {
+    if (!isRecord(value))
+        return [problem(path, 'un oggetto', value)];
+    const prefix = path === '' ? '' : `${path}.`;
+    return Object.entries(value).flatMap(([key, entry]) => {
+        const check = fields[key];
+        if (check === undefined)
+            return [`${prefix}${key}: voce sconosciuta`];
+        return entry === undefined ? [] : check(entry, `${prefix}${key}`);
+    });
+};

package/dist/lib/versions.d.ts

@@ -0,0 +1,5 @@
+export declare const packageVersion: () => string;
+/** L'intervallo che il pacchetto dichiara di reggere: sta in un posto solo, le sue peerDependencies. */
+export declare const peerRange: (name: string) => string;
+/** Vero solo se ogni versione che `spec` può installare sta dentro `range`, scritto `>=x.y.z <a.b.c`. */
+export declare function withinRange(spec: string, range: string): boolean;

package/dist/lib/versions.js

@@ -0,0 +1,38 @@
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+const self = () => JSON.parse(readFileSync(fileURLToPath(new URL('../../package.json', import.meta.url)), 'utf8'));
+export const packageVersion = () => self().version;
+/** L'intervallo che il pacchetto dichiara di reggere: sta in un posto solo, le sue peerDependencies. */
+export const peerRange = (name) => self().peerDependencies?.[name] ?? '';
+const EXACT = /(\d+)\.(\d+)\.(\d+)/;
+function parseVersion(text) {
+    const found = EXACT.exec(text);
+    return found === null ? undefined : [Number(found[1]), Number(found[2]), Number(found[3])];
+}
+const compare = (a, b) => a[0] - b[0] || a[1] - b[1] || a[2] - b[2];
+// Il limite superiore escluso di ciò che lo specificatore può installare: `^` sale fino alla major
+// dopo (fino alla minor dopo, sotto lo zero), `~` fino alla minor dopo, una versione esatta a sé.
+function ceiling(spec, [major, minor, patch]) {
+    if (spec.startsWith('^'))
+        return major === 0 ? [0, minor + 1, 0] : [major + 1, 0, 0];
+    if (spec.startsWith('~'))
+        return [major, minor + 1, 0];
+    return EXACT.test(spec.replace(/^[=v]/, '')) && !/[<>|*x\s]/.test(spec) ? [major, minor, patch + 1] : undefined;
+}
+function parseBounds(range) {
+    const [low = '', high = '', extra] = range.split(' ');
+    if (extra !== undefined || !low.startsWith('>=') || !high.startsWith('<'))
+        return undefined;
+    const min = parseVersion(low);
+    const max = parseVersion(high);
+    return min === undefined || max === undefined ? undefined : { min, max };
+}
+/** Vero solo se ogni versione che `spec` può installare sta dentro `range`, scritto `>=x.y.z <a.b.c`. */
+export function withinRange(spec, range) {
+    const bounds = parseBounds(range);
+    const floor = parseVersion(spec);
+    if (bounds === undefined || floor === undefined)
+        return false;
+    const top = ceiling(spec, floor);
+    return top === undefined ? false : compare(floor, bounds.min) >= 0 && compare(top, bounds.max) <= 0;
+}

package/dist/lib/workflows.d.ts

@@ -0,0 +1,6 @@
+import type { ProjectFiles } from './alignment.ts';
+import type { ContractGap } from './contract.ts';
+export declare const mentions: (source: string | undefined, needle: string) => boolean;
+/** Le action del progetto devono stare alla stessa versione del pacchetto installato. */
+export declare function workflowGaps({ read }: ProjectFiles, version: string): ContractGap[];
+export declare function dependabotGaps({ read }: ProjectFiles): ContractGap[];

package/dist/lib/workflows.js

@@ -0,0 +1,70 @@
+// I workflow restano una ricerca testuale — non c'è un parser YAML nel pacchetto — ma una riga
+// commentata non deve soddisfare niente: è il modo più facile per avere un progetto «a posto»
+// che in CI non lancia nessuno di questi passi.
+const liveLines = (source) => source.split(/\r?\n/).filter((line) => !line.trimStart().startsWith('#'));
+export const mentions = (source, needle) => source !== undefined && liveLines(source).some((line) => line.includes(needle));
+const ACTIONS = [
+    { workflow: '.github/workflows/ci.yml', action: 'ci' },
+    { workflow: '.github/workflows/ci.yml', action: 'review' },
+    { workflow: '.github/workflows/deploy.yml', action: 'deploy' },
+    { workflow: '.github/workflows/lighthouse.yml', action: 'lighthouse' },
+];
+// Un tag di versione o uno SHA intero: `@main` farebbe girare in produzione passi mai collaudati.
+const TAG = /^v\d+\.\d+\.\d+$/;
+const SHA = /^[0-9a-f]{40}$/;
+const COMMENTED_VERSION = /#\s*(v\d+\.\d+\.\d+)/;
+function refOf(source, name) {
+    const pattern = new RegExp(`${name}@(\\S+)`);
+    for (const line of liveLines(source)) {
+        const ref = pattern.exec(line)?.[1];
+        if (ref !== undefined)
+            return { line, ref };
+    }
+    return undefined;
+}
+function refGap(line, ref, name, expected) {
+    if (TAG.test(ref)) {
+        return ref === expected ? undefined : `\`${name}@${ref}\`: il pacchetto installato è la ${expected.slice(1)}`;
+    }
+    if (!SHA.test(ref))
+        return `\`${name}@${ref}\`: il riferimento va fissato a un tag di versione o a uno SHA`;
+    const declared = COMMENTED_VERSION.exec(line)?.[1];
+    if (declared === undefined) {
+        return `\`${name}@${ref.slice(0, 7)}…\`: uno SHA non dice che versione è — scrivila nel commento (\`# ${expected}\`)`;
+    }
+    return declared === expected
+        ? undefined
+        : `\`${name}@${ref.slice(0, 7)}… ${declared}\`: il pacchetto installato è la ${expected.slice(1)}`;
+}
+function actionGap(source, action, version) {
+    const name = `Elia97/officina/actions/${action}`;
+    if (source === undefined)
+        return `manca: i suoi passi arrivano da \`${name}\``;
+    const found = refOf(source, name);
+    return found === undefined ? `non usa \`${name}\`` : refGap(found.line, found.ref, name, `v${version}`);
+}
+/** Le action del progetto devono stare alla stessa versione del pacchetto installato. */
+export function workflowGaps({ read }, version) {
+    return ACTIONS.flatMap(({ workflow, action }) => {
+        const message = actionGap(read(workflow), action, version);
+        return message === undefined ? [] : [{ path: workflow, message }];
+    });
+}
+const DEPENDABOT = '.github/dependabot.yml';
+// Senza il gruppo, Dependabot apre due PR — una per il pacchetto npm, una per le action — e il
+// controllo di coerenza qui sopra le boccia entrambe, perché nessuna delle due allinea l'altra.
+const GROUPED = [
+    { needle: 'multi-ecosystem-groups', reason: 'il pacchetto e le sue action si alzano in una PR sola' },
+    { needle: '@elia97/officina', reason: 'il gruppo deve prendere il pacchetto da npm' },
+    { needle: 'Elia97/officina/*', reason: 'il gruppo deve prendere le action da github-actions' },
+];
+export function dependabotGaps({ read }) {
+    const source = read(DEPENDABOT);
+    if (source === undefined) {
+        return [{ path: DEPENDABOT, message: 'manca: senza, il pacchetto e le sue action si alzano separati' }];
+    }
+    return GROUPED.filter(({ needle }) => !mentions(source, needle)).map(({ needle, reason }) => ({
+        path: DEPENDABOT,
+        message: `non nomina \`${needle}\`: ${reason}`,
+    }));
+}

package/dist/sh/lhci-local.sh

@@ -25,9 +25,9 @@ detect_chrome() {
 }
 
 if ! CHROME_PATH="$(detect_chrome)"; then
-  echo "✗ no usable Linux Chrome/Chromium found." >&2
-  echo "  Install one with: pnpm dlx playwright@latest install chromium" >&2
-  echo "  Or point at the binary: CHROME_PATH=/path/to/chrome pnpm run lhci:local" >&2
+  echo "✗ nessun Chrome/Chromium per Linux utilizzabile." >&2
+  echo "  Installane uno con: pnpm dlx playwright@latest install chromium" >&2
+  echo "  Oppure indica il binario: CHROME_PATH=/percorso/di/chrome pnpm run lhci:local" >&2
   exit 1
 fi
 export CHROME_PATH
@@ -38,24 +38,24 @@ SERVER_PID=''
 cleanup() {
   if [[ -n "${SERVER_PID}" ]]; then
     kill -- "-${SERVER_PID}" 2>/dev/null || kill "${SERVER_PID}" 2>/dev/null || true
-    pkill -f "serve@14 .*--listen ${PORT}" 2>/dev/null || true
+    pkill -f "serve@14.2.6 .*--listen ${PORT}" 2>/dev/null || true
   fi
   find . -maxdepth 1 \( -name '*wsl.localhost*' -o -name 'undefined*' \) -exec rm -rf {} + 2>/dev/null || true
 }
 trap cleanup EXIT
 
-echo "→ production-equivalent build in ${OUT_DIR}"
+echo "→ build equivalente alla produzione in ${OUT_DIR}"
 VERCEL_ENV=production pnpm build --outDir "${OUT_DIR}"
 
 if ! grep -qx 'Allow: /' "${OUT_DIR}/client/robots.txt"; then
-  echo "✗ ${OUT_DIR}/client/robots.txt has no 'Allow: /' — the build is not production-equivalent." >&2
+  echo "✗ ${OUT_DIR}/client/robots.txt non ha 'Allow: /': la build non equivale alla produzione." >&2
   head -3 "${OUT_DIR}/client/robots.txt" >&2
   exit 1
 fi
 echo "✓ robots.txt: Allow: /"
 
-echo "→ starting the static server on :${PORT}"
-setsid pnpm dlx serve@14 "${OUT_DIR}/client" --listen "${PORT}" --no-clipboard >/dev/null 2>&1 &
+echo "→ avvio del server statico su :${PORT}"
+setsid pnpm dlx serve@14.2.6 "${OUT_DIR}/client" --listen "${PORT}" --no-clipboard >/dev/null 2>&1 &
 SERVER_PID=$!
 
 for _ in $(seq 1 60); do
@@ -63,11 +63,11 @@ for _ in $(seq 1 60); do
   sleep 1
 done
 if ! curl -fs -o /dev/null "http://localhost:${PORT}/"; then
-  echo "✗ the server did not answer on :${PORT} within 60s." >&2
-  echo "  Retry on another port: LHCI_PORT=4400 pnpm run lhci:local" >&2
+  echo "✗ il server non ha risposto su :${PORT} entro 60s." >&2
+  echo "  Riprova su un’altra porta: LHCI_PORT=4400 pnpm run lhci:local" >&2
   exit 1
 fi
-echo "✓ server ready"
+echo "✓ server pronto"
 
 rm -rf "${REPORT_DIR}"
 
@@ -79,7 +79,7 @@ LH_CHROME_FLAGS='--no-sandbox --disable-dev-shm-usage' \
   node "${OFFICINA_BIN}" check lighthouse
 
 echo
-echo "→ score per URL (median over ${LHCI_RUNS:-1} run(s), the way LHCI asserts)"
+echo "→ punteggio per URL (mediana su ${LHCI_RUNS:-1} giro/i, come la calcola LHCI)"
 node -e '
 const fs = require("fs")
 const dir = process.argv[1]

package/dist/smoke.d.ts

@@ -0,0 +1,2 @@
+export { NON_HTML_ROUTES } from './lib/routes.ts';
+export { checkBotIdChallenge, checkCanonicalHost, checkPages, checkSecurityHeaders, checkTrailingSlash, DEFAULT_CHECKS, SECURITY_HEADERS, } from './lib/smoke-production.ts';

package/dist/smoke.js

@@ -0,0 +1,4 @@
+// I pezzi con cui un progetto compone i propri controlli di smoke: `smoke.checks` sostituisce la
+// lista del pacchetto, quindi chi ne toglie uno ricompone la lista da qui.
+export { NON_HTML_ROUTES } from './lib/routes.js';
+export { checkBotIdChallenge, checkCanonicalHost, checkPages, checkSecurityHeaders, checkTrailingSlash, DEFAULT_CHECKS, SECURITY_HEADERS, } from './lib/smoke-production.js';