@freeappstore/compliance 0.1.0

package/README.md

@@ -0,0 +1,27 @@
+# @freeappstore/compliance
+
+Compliance checks for apps published on **freeappstore.online**. Same checks the CLI runs locally and the template's CI runs on every push.
+
+```ts
+import { runChecks } from '@freeappstore/compliance';
+
+const results = await runChecks(process.cwd());
+for (const r of results) {
+  console.log(`${r.status}  ${r.name}  ${r.detail}`);
+  for (const s of r.suggestions ?? []) console.log(`   → ${s}`);
+}
+```
+
+## Checks (v0.1.0)
+
+| Name | What it checks | Status on fail |
+|---|---|---|
+| `No template placeholders` | No file still contains `APPNAME` | **fail** |
+| `No tracking SDKs` | No reference to google-analytics / gtag / amplitude / mixpanel / segment / hotjar / plausible / posthog | **fail** |
+| `Brand fonts present` | Manrope + Fraunces referenced in CSS or HTML | **fail** |
+| `PWA manifest` | `web/public/manifest.json` exists and has name / short_name / start_url / display | warn |
+| `Bundle size` | Largest JS in `web/dist/assets/` is ≤ 300 KB gzipped | **fail** if too big; warn if not built yet |
+
+## License
+
+MIT.

package/dist/checks/brand-fonts.d.ts

@@ -0,0 +1,9 @@
+import type { CheckResult } from '../types.js';
+/**
+ * The platform's brand wants Manrope (body) + Fraunces (display) so apps
+ * have a consistent typographic feel across the storefront. We accept any
+ * CSS file referencing both font names — the actual font-loading mechanism
+ * (Google Fonts, self-hosted, etc.) is the app's choice.
+ */
+export declare function checkBrandFonts(repoDir: string): Promise<CheckResult>;
+//# sourceMappingURL=brand-fonts.d.ts.map

package/dist/checks/brand-fonts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"brand-fonts.d.ts","sourceRoot":"","sources":["../../src/checks/brand-fonts.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAK/C;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CA6B3E"}

package/dist/checks/brand-fonts.js

@@ -0,0 +1,43 @@
+import { readFile } from 'node:fs/promises';
+import { extname } from 'node:path';
+import { walk } from '../lib/walk.js';
+const REQUIRED_FONTS = ['Manrope', 'Fraunces'];
+/**
+ * The platform's brand wants Manrope (body) + Fraunces (display) so apps
+ * have a consistent typographic feel across the storefront. We accept any
+ * CSS file referencing both font names — the actual font-loading mechanism
+ * (Google Fonts, self-hosted, etc.) is the app's choice.
+ */
+export async function checkBrandFonts(repoDir) {
+    const found = new Set();
+    for await (const file of walk(repoDir)) {
+        const ext = extname(file).toLowerCase();
+        if (ext !== '.css' && ext !== '.scss' && ext !== '.html')
+            continue;
+        const content = await readFile(file, 'utf8').catch(() => '');
+        for (const font of REQUIRED_FONTS) {
+            if (content.includes(font))
+                found.add(font);
+        }
+        if (found.size === REQUIRED_FONTS.length)
+            break;
+    }
+    const missing = REQUIRED_FONTS.filter((f) => !found.has(f));
+    if (missing.length === 0) {
+        return {
+            name: 'Brand fonts present',
+            status: 'pass',
+            detail: REQUIRED_FONTS.join(' + '),
+        };
+    }
+    return {
+        name: 'Brand fonts present',
+        status: 'fail',
+        detail: `missing: ${missing.join(', ')}`,
+        suggestions: [
+            'Add the Google Fonts <link> for Manrope + Fraunces to web/index.html.',
+            'Use them as your body / display fonts in CSS so storefront and apps feel consistent.',
+        ],
+    };
+}
+//# sourceMappingURL=brand-fonts.js.map

package/dist/checks/brand-fonts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"brand-fonts.js","sourceRoot":"","sources":["../../src/checks/brand-fonts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAEtC,MAAM,cAAc,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;AAE/C;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAe;IACnD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QACxC,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,OAAO;YAAE,SAAS;QACnE,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC7D,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;YAClC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,CAAC,MAAM;YAAE,MAAM;IAClD,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,IAAI,EAAE,qBAAqB;YAC3B,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;SACnC,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,qBAAqB;QAC3B,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,YAAY,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACxC,WAAW,EAAE;YACX,uEAAuE;YACvE,sFAAsF;SACvF;KACF,CAAC;AACJ,CAAC"}

package/dist/checks/brand-fonts.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=brand-fonts.test.d.ts.map

package/dist/checks/brand-fonts.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"brand-fonts.test.d.ts","sourceRoot":"","sources":["../../src/checks/brand-fonts.test.ts"],"names":[],"mappings":""}

package/dist/checks/brand-fonts.test.js

@@ -0,0 +1,45 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { mkdtemp, rm, writeFile, mkdir } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { checkBrandFonts } from './brand-fonts.js';
+let dir;
+beforeEach(async () => {
+    dir = await mkdtemp(join(tmpdir(), 'fas-compliance-'));
+    await mkdir(join(dir, 'web', 'src'), { recursive: true });
+});
+afterEach(async () => {
+    await rm(dir, { recursive: true, force: true });
+});
+describe('checkBrandFonts', () => {
+    it('passes when both Manrope and Fraunces are referenced', async () => {
+        await writeFile(join(dir, 'web', 'src', 'index.css'), 'body { font-family: Manrope, sans-serif; } h1 { font-family: Fraunces; }');
+        const r = await checkBrandFonts(dir);
+        expect(r.status).toBe('pass');
+    });
+    it('passes with fonts split across files', async () => {
+        await writeFile(join(dir, 'web', 'src', 'a.css'), '@import "Manrope";');
+        await writeFile(join(dir, 'web', 'src', 'b.css'), '@import "Fraunces";');
+        const r = await checkBrandFonts(dir);
+        expect(r.status).toBe('pass');
+    });
+    it('passes when fonts are in HTML link tag (Google Fonts)', async () => {
+        await writeFile(join(dir, 'web', 'index.html'), '<link href="https://fonts.googleapis.com/css2?family=Manrope&family=Fraunces" rel="stylesheet">');
+        const r = await checkBrandFonts(dir);
+        expect(r.status).toBe('pass');
+    });
+    it('fails when only one of the two is present', async () => {
+        await writeFile(join(dir, 'web', 'src', 'a.css'), '@import "Manrope";');
+        const r = await checkBrandFonts(dir);
+        expect(r.status).toBe('fail');
+        expect(r.detail).toMatch(/Fraunces/);
+    });
+    it('fails when neither is present', async () => {
+        await writeFile(join(dir, 'web', 'src', 'a.css'), 'body { font: Helvetica; }');
+        const r = await checkBrandFonts(dir);
+        expect(r.status).toBe('fail');
+        expect(r.detail).toMatch(/Manrope/);
+        expect(r.detail).toMatch(/Fraunces/);
+    });
+});
+//# sourceMappingURL=brand-fonts.test.js.map

package/dist/checks/brand-fonts.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"brand-fonts.test.js","sourceRoot":"","sources":["../../src/checks/brand-fonts.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD,IAAI,GAAW,CAAC;AAEhB,UAAU,CAAC,KAAK,IAAI,EAAE;IACpB,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACvD,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAC5D,CAAC,CAAC,CAAC;AACH,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAClD,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,SAAS,CACb,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,EACpC,0EAA0E,CAC3E,CAAC;QACF,MAAM,CAAC,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,oBAAoB,CAAC,CAAC;QACxE,MAAM,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,qBAAqB,CAAC,CAAC;QACzE,MAAM,CAAC,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,SAAS,CACb,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,YAAY,CAAC,EAC9B,iGAAiG,CAClG,CAAC;QACF,MAAM,CAAC,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,oBAAoB,CAAC,CAAC;QACxE,MAAM,CAAC,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,2BAA2B,CAAC,CAAC;QAC/E,MAAM,CAAC,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/checks/bundle-size.d.ts

@@ -0,0 +1,8 @@
+import type { CheckResult } from '../types.js';
+/**
+ * Checks the largest JS asset under web/dist/assets/ against the 300KB-gzip
+ * limit. Returns 'warn' if dist hasn't been built yet (we don't want to
+ * silently pass when there's nothing to measure).
+ */
+export declare function checkBundleSize(repoDir: string): Promise<CheckResult>;
+//# sourceMappingURL=bundle-size.d.ts.map

package/dist/checks/bundle-size.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-size.d.ts","sourceRoot":"","sources":["../../src/checks/bundle-size.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAI/C;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAyD3E"}

package/dist/checks/bundle-size.js

@@ -0,0 +1,64 @@
+import { readdir, readFile, stat } from 'node:fs/promises';
+import { join } from 'node:path';
+import { gzipSync } from 'node:zlib';
+const MAX_GZIP_BYTES = 300 * 1024; // 300 KB — matches the template's compliance.yml
+/**
+ * Checks the largest JS asset under web/dist/assets/ against the 300KB-gzip
+ * limit. Returns 'warn' if dist hasn't been built yet (we don't want to
+ * silently pass when there's nothing to measure).
+ */
+export async function checkBundleSize(repoDir) {
+    const assetsDir = join(repoDir, 'web', 'dist', 'assets');
+    let entries;
+    try {
+        entries = await readdir(assetsDir);
+    }
+    catch {
+        return {
+            name: 'Bundle size',
+            status: 'warn',
+            detail: 'web/dist not built yet — run `pnpm build` to measure',
+        };
+    }
+    const jsFiles = entries.filter((f) => f.endsWith('.js'));
+    if (jsFiles.length === 0) {
+        return {
+            name: 'Bundle size',
+            status: 'warn',
+            detail: `no JS files in ${assetsDir}`,
+        };
+    }
+    // Find the largest JS file (the entry chunk) — same behavior as the
+    // existing compliance.yml in the templates.
+    let largest = '';
+    let largestSize = 0;
+    for (const f of jsFiles) {
+        const s = await stat(join(assetsDir, f));
+        if (s.size > largestSize) {
+            largest = f;
+            largestSize = s.size;
+        }
+    }
+    const content = await readFile(join(assetsDir, largest));
+    const gzipped = gzipSync(content).byteLength;
+    const kb = (gzipped / 1024).toFixed(1);
+    const limitKb = (MAX_GZIP_BYTES / 1024).toFixed(0);
+    if (gzipped > MAX_GZIP_BYTES) {
+        return {
+            name: 'Bundle size',
+            status: 'fail',
+            detail: `${largest}: ${kb} KB gzipped (limit ${limitKb} KB)`,
+            suggestions: [
+                'Find heavy dependencies: `pnpm dlx vite-bundle-visualizer`',
+                'Lazy-load non-critical screens with dynamic import().',
+                'Consider lighter alternatives for the biggest deps.',
+            ],
+        };
+    }
+    return {
+        name: 'Bundle size',
+        status: 'pass',
+        detail: `${largest}: ${kb} KB gzipped (limit ${limitKb} KB)`,
+    };
+}
+//# sourceMappingURL=bundle-size.js.map

package/dist/checks/bundle-size.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-size.js","sourceRoot":"","sources":["../../src/checks/bundle-size.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAGrC,MAAM,cAAc,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,iDAAiD;AAEpF;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAe;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACzD,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,sDAAsD;SAC/D,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACzD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,kBAAkB,SAAS,EAAE;SACtC,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,4CAA4C;IAC5C,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,CAAC,IAAI,GAAG,WAAW,EAAE,CAAC;YACzB,OAAO,GAAG,CAAC,CAAC;YACZ,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC;QACvB,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC;IAC7C,MAAM,EAAE,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAEnD,IAAI,OAAO,GAAG,cAAc,EAAE,CAAC;QAC7B,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,GAAG,OAAO,KAAK,EAAE,sBAAsB,OAAO,MAAM;YAC5D,WAAW,EAAE;gBACX,4DAA4D;gBAC5D,uDAAuD;gBACvD,qDAAqD;aACtD;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,aAAa;QACnB,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,GAAG,OAAO,KAAK,EAAE,sBAAsB,OAAO,MAAM;KAC7D,CAAC;AACJ,CAAC"}

package/dist/checks/bundle-size.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=bundle-size.test.d.ts.map

package/dist/checks/bundle-size.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-size.test.d.ts","sourceRoot":"","sources":["../../src/checks/bundle-size.test.ts"],"names":[],"mappings":""}

package/dist/checks/bundle-size.test.js

@@ -0,0 +1,57 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { mkdtemp, rm, writeFile, mkdir } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { checkBundleSize } from './bundle-size.js';
+let dir;
+beforeEach(async () => {
+    dir = await mkdtemp(join(tmpdir(), 'fas-compliance-'));
+});
+afterEach(async () => {
+    await rm(dir, { recursive: true, force: true });
+});
+async function writeAsset(name, content) {
+    const p = join(dir, 'web', 'dist', 'assets');
+    await mkdir(p, { recursive: true });
+    await writeFile(join(p, name), content);
+}
+describe('checkBundleSize', () => {
+    it('warns when web/dist not built', async () => {
+        const r = await checkBundleSize(dir);
+        expect(r.status).toBe('warn');
+        expect(r.detail).toMatch(/pnpm build/);
+    });
+    it('warns when no JS files in assets', async () => {
+        const p = join(dir, 'web', 'dist', 'assets');
+        await mkdir(p, { recursive: true });
+        await writeFile(join(p, 'styles.css'), 'body{color:red}');
+        const r = await checkBundleSize(dir);
+        expect(r.status).toBe('warn');
+        expect(r.detail).toMatch(/no JS/);
+    });
+    it('passes when largest JS is under 300KB gzipped', async () => {
+        // ~100KB of repetitive content gzips to a few KB
+        await writeAsset('index-abc.js', 'a'.repeat(100_000));
+        const r = await checkBundleSize(dir);
+        expect(r.status).toBe('pass');
+        expect(r.detail).toMatch(/index-abc\.js/);
+        expect(r.detail).toMatch(/limit 300 KB/);
+    });
+    it('picks the largest JS file for measurement', async () => {
+        await writeAsset('small.js', 'tiny');
+        await writeAsset('big.js', 'a'.repeat(200_000));
+        const r = await checkBundleSize(dir);
+        expect(r.detail).toMatch(/big\.js/);
+    });
+    it('fails when largest JS exceeds 300KB gzipped', async () => {
+        // Random bytes don't compress, so 400KB of randomness ~= 400KB gzipped.
+        const random = Buffer.alloc(400 * 1024);
+        for (let i = 0; i < random.length; i++)
+            random[i] = Math.floor(Math.random() * 256);
+        await writeAsset('huge.js', random);
+        const r = await checkBundleSize(dir);
+        expect(r.status).toBe('fail');
+        expect(r.suggestions?.length ?? 0).toBeGreaterThan(0);
+    });
+});
+//# sourceMappingURL=bundle-size.test.js.map

package/dist/checks/bundle-size.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-size.test.js","sourceRoot":"","sources":["../../src/checks/bundle-size.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD,IAAI,GAAW,CAAC;AAEhB,UAAU,CAAC,KAAK,IAAI,EAAE;IACpB,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;AACzD,CAAC,CAAC,CAAC;AACH,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAClD,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,OAAwB;IAC9D,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC7C,MAAM,KAAK,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,CAAC,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;QAChD,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC7C,MAAM,KAAK,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,YAAY,CAAC,EAAE,iBAAiB,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,iDAAiD;QACjD,MAAM,UAAU,CAAC,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACtD,MAAM,CAAC,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAC1C,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACrC,MAAM,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAChD,MAAM,CAAC,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,wEAAwE;QACxE,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;QACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC;QACpF,MAAM,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/checks/manifest.d.ts

@@ -0,0 +1,8 @@
+import type { CheckResult } from '../types.js';
+/**
+ * Verifies the PWA manifest exists at the expected location and parses
+ * to JSON. Apps without a manifest can't be "Add to Home Screen"-d on
+ * mobile; required by the platform.
+ */
+export declare function checkManifest(repoDir: string): Promise<CheckResult>;
+//# sourceMappingURL=manifest.d.ts.map

package/dist/checks/manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../../src/checks/manifest.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAuCzE"}

package/dist/checks/manifest.js

@@ -0,0 +1,48 @@
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+/**
+ * Verifies the PWA manifest exists at the expected location and parses
+ * to JSON. Apps without a manifest can't be "Add to Home Screen"-d on
+ * mobile; required by the platform.
+ */
+export async function checkManifest(repoDir) {
+    const path = join(repoDir, 'web', 'public', 'manifest.json');
+    let raw;
+    try {
+        raw = await readFile(path, 'utf8');
+    }
+    catch {
+        return {
+            name: 'PWA manifest',
+            status: 'fail',
+            detail: 'web/public/manifest.json missing',
+            suggestions: [
+                'Add a manifest.json with at least name, short_name, start_url, display, icons.',
+                'See template-standalone for a working example.',
+            ],
+        };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return {
+            name: 'PWA manifest',
+            status: 'fail',
+            detail: `web/public/manifest.json is not valid JSON`,
+        };
+    }
+    const required = ['name', 'short_name', 'start_url', 'display'];
+    const missing = required.filter((k) => typeof parsed[k] !== 'string' || parsed[k] === '');
+    if (missing.length > 0) {
+        return {
+            name: 'PWA manifest',
+            status: 'warn',
+            detail: `missing fields: ${missing.join(', ')}`,
+            suggestions: [`Add the ${missing.join(', ')} field(s) to manifest.json so installs work.`],
+        };
+    }
+    return { name: 'PWA manifest', status: 'pass', detail: 'web/public/manifest.json' };
+}
+//# sourceMappingURL=manifest.js.map

package/dist/checks/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../../src/checks/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAe;IACjD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC7D,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,kCAAkC;YAC1C,WAAW,EAAE;gBACX,gFAAgF;gBAChF,gDAAgD;aACjD;SACF,CAAC;IACJ,CAAC;IAED,IAAI,MAAwF,CAAC;IAC7F,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,4CAA4C;SACrD,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,CAAU,CAAC;IACzE,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC1F,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,mBAAmB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAC/C,WAAW,EAAE,CAAC,WAAW,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,8CAA8C,CAAC;SAC3F,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;AACtF,CAAC"}

package/dist/checks/manifest.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=manifest.test.d.ts.map

package/dist/checks/manifest.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.test.d.ts","sourceRoot":"","sources":["../../src/checks/manifest.test.ts"],"names":[],"mappings":""}

package/dist/checks/manifest.test.js

@@ -0,0 +1,53 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { mkdtemp, rm, writeFile, mkdir } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { checkManifest } from './manifest.js';
+let dir;
+beforeEach(async () => {
+    dir = await mkdtemp(join(tmpdir(), 'fas-compliance-'));
+});
+afterEach(async () => {
+    await rm(dir, { recursive: true, force: true });
+});
+async function withManifest(content) {
+    await mkdir(join(dir, 'web', 'public'), { recursive: true });
+    await writeFile(join(dir, 'web', 'public', 'manifest.json'), content);
+}
+describe('checkManifest', () => {
+    it('fails when manifest.json missing', async () => {
+        const r = await checkManifest(dir);
+        expect(r.status).toBe('fail');
+        expect(r.detail).toMatch(/missing/);
+    });
+    it('fails when manifest.json is not valid JSON', async () => {
+        await withManifest('{ not json');
+        const r = await checkManifest(dir);
+        expect(r.status).toBe('fail');
+        expect(r.detail).toMatch(/JSON/i);
+    });
+    it('warns when required fields are missing', async () => {
+        await withManifest(JSON.stringify({ name: 'My App' }));
+        const r = await checkManifest(dir);
+        expect(r.status).toBe('warn');
+        expect(r.detail).toMatch(/short_name/);
+        expect(r.detail).toMatch(/start_url/);
+    });
+    it('passes with all four required fields present', async () => {
+        await withManifest(JSON.stringify({
+            name: 'My App',
+            short_name: 'MyApp',
+            start_url: '/',
+            display: 'standalone',
+        }));
+        const r = await checkManifest(dir);
+        expect(r.status).toBe('pass');
+    });
+    it('treats empty-string values for required fields as missing', async () => {
+        await withManifest(JSON.stringify({ name: '', short_name: 'X', start_url: '/', display: 'standalone' }));
+        const r = await checkManifest(dir);
+        expect(r.status).toBe('warn');
+        expect(r.detail).toMatch(/name/);
+    });
+});
+//# sourceMappingURL=manifest.test.js.map

package/dist/checks/manifest.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.test.js","sourceRoot":"","sources":["../../src/checks/manifest.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9C,IAAI,GAAW,CAAC;AAEhB,UAAU,CAAC,KAAK,IAAI,EAAE;IACpB,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;AACzD,CAAC,CAAC,CAAC;AACH,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAClD,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,YAAY,CAAC,OAAe;IACzC,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,MAAM,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,CAAC,EAAE,OAAO,CAAC,CAAC;AACxE,CAAC;AAED,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;QAChD,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,YAAY,CAAC,YAAY,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QACvD,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACvC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,YAAY,CAChB,IAAI,CAAC,SAAS,CAAC;YACb,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,OAAO;YACnB,SAAS,EAAE,GAAG;YACd,OAAO,EAAE,YAAY;SACtB,CAAC,CACH,CAAC;QACF,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,YAAY,CAChB,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CACrF,CAAC;QACF,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/checks/no-placeholders.d.ts

@@ -0,0 +1,9 @@
+import type { CheckResult } from '../types.js';
+/**
+ * Catches the case where APPNAME placeholders from the template were
+ * never substituted. The CLI's `fas init` substitutes correctly today
+ * but if someone clones the template manually and forgets the find/
+ * replace step, every page renders with `<title>APPNAME — …</title>`.
+ */
+export declare function checkNoPlaceholders(repoDir: string): Promise<CheckResult>;
+//# sourceMappingURL=no-placeholders.d.ts.map

package/dist/checks/no-placeholders.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-placeholders.d.ts","sourceRoot":"","sources":["../../src/checks/no-placeholders.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAqB/C;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAsB/E"}

package/dist/checks/no-placeholders.js

@@ -0,0 +1,52 @@
+import { readFile } from 'node:fs/promises';
+import { extname } from 'node:path';
+import { walk } from '../lib/walk.js';
+const TEXT_EXTS = new Set([
+    '.md',
+    '.txt',
+    '.json',
+    '.ts',
+    '.tsx',
+    '.js',
+    '.jsx',
+    '.html',
+    '.htm',
+    '.css',
+    '.scss',
+    '.yaml',
+    '.yml',
+    '.toml',
+    '.svg',
+]);
+/**
+ * Catches the case where APPNAME placeholders from the template were
+ * never substituted. The CLI's `fas init` substitutes correctly today
+ * but if someone clones the template manually and forgets the find/
+ * replace step, every page renders with `<title>APPNAME — …</title>`.
+ */
+export async function checkNoPlaceholders(repoDir) {
+    const offenders = [];
+    for await (const file of walk(repoDir)) {
+        if (!TEXT_EXTS.has(extname(file).toLowerCase()))
+            continue;
+        const content = await readFile(file, 'utf8').catch(() => '');
+        if (content.includes('APPNAME')) {
+            offenders.push(file.replace(repoDir + '/', ''));
+            if (offenders.length >= 5)
+                break; // don't spam, summarize
+        }
+    }
+    if (offenders.length === 0) {
+        return { name: 'No template placeholders', status: 'pass', detail: 'all APPNAME substituted' };
+    }
+    return {
+        name: 'No template placeholders',
+        status: 'fail',
+        detail: `${offenders.length === 5 ? '5+' : offenders.length} file(s) still contain APPNAME: ${offenders.join(', ')}`,
+        suggestions: [
+            'Run `fas init <id>` instead of cloning the template manually — it does the substitution.',
+            'Or do a project-wide find/replace: APPNAME → your app id (lowercase, hyphenated).',
+        ],
+    };
+}
+//# sourceMappingURL=no-placeholders.js.map

package/dist/checks/no-placeholders.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-placeholders.js","sourceRoot":"","sources":["../../src/checks/no-placeholders.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAEtC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,KAAK;IACL,MAAM;IACN,OAAO;IACP,KAAK;IACL,MAAM;IACN,KAAK;IACL,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;CACP,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAAe;IACvD,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;YAAE,SAAS;QAC1D,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC7D,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,GAAG,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;YAChD,IAAI,SAAS,CAAC,MAAM,IAAI,CAAC;gBAAE,MAAM,CAAC,wBAAwB;QAC5D,CAAC;IACH,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,IAAI,EAAE,0BAA0B,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IACjG,CAAC;IACD,OAAO;QACL,IAAI,EAAE,0BAA0B;QAChC,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,mCAAmC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACpH,WAAW,EAAE;YACX,0FAA0F;YAC1F,mFAAmF;SACpF;KACF,CAAC;AACJ,CAAC"}

package/dist/checks/no-placeholders.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=no-placeholders.test.d.ts.map

package/dist/checks/no-placeholders.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-placeholders.test.d.ts","sourceRoot":"","sources":["../../src/checks/no-placeholders.test.ts"],"names":[],"mappings":""}

package/dist/checks/no-placeholders.test.js

@@ -0,0 +1,46 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { mkdtemp, rm, writeFile, mkdir } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { checkNoPlaceholders } from './no-placeholders.js';
+let dir;
+beforeEach(async () => {
+    dir = await mkdtemp(join(tmpdir(), 'fas-compliance-'));
+});
+afterEach(async () => {
+    await rm(dir, { recursive: true, force: true });
+});
+describe('checkNoPlaceholders', () => {
+    it('passes when no APPNAME anywhere', async () => {
+        await writeFile(join(dir, 'README.md'), '# my-app\nNo placeholders here.');
+        await writeFile(join(dir, 'package.json'), '{"name":"my-app"}');
+        const r = await checkNoPlaceholders(dir);
+        expect(r.status).toBe('pass');
+    });
+    it('fails with file list when APPNAME is left in any text file', async () => {
+        await writeFile(join(dir, 'README.md'), '# APPNAME\n');
+        await mkdir(join(dir, 'web'));
+        await writeFile(join(dir, 'web', 'index.html'), '<title>APPNAME — FreeAppStore</title>');
+        const r = await checkNoPlaceholders(dir);
+        expect(r.status).toBe('fail');
+        expect(r.detail).toMatch(/README\.md/);
+        expect(r.detail).toMatch(/index\.html/);
+        expect(r.suggestions?.length ?? 0).toBeGreaterThan(0);
+    });
+    it('skips binary-ish extensions (no false positives on icons etc.)', async () => {
+        // .png file with bytes that happen to spell APPNAME — should be skipped
+        await writeFile(join(dir, 'icon.png'), Buffer.from('APPNAME'));
+        const r = await checkNoPlaceholders(dir);
+        expect(r.status).toBe('pass');
+    });
+    it('caps at 5 reported files when many offend', async () => {
+        await mkdir(join(dir, 'web'));
+        for (let i = 0; i < 10; i++) {
+            await writeFile(join(dir, 'web', `file${i}.ts`), 'const x = "APPNAME";');
+        }
+        const r = await checkNoPlaceholders(dir);
+        expect(r.status).toBe('fail');
+        expect(r.detail).toMatch(/5\+/);
+    });
+});
+//# sourceMappingURL=no-placeholders.test.js.map

package/dist/checks/no-placeholders.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-placeholders.test.js","sourceRoot":"","sources":["../../src/checks/no-placeholders.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAE3D,IAAI,GAAW,CAAC;AAEhB,UAAU,CAAC,KAAK,IAAI,EAAE;IACpB,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;AACzD,CAAC,CAAC,CAAC;AACH,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAClD,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,iCAAiC,CAAC,CAAC;QAC3E,MAAM,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,mBAAmB,CAAC,CAAC;QAChE,MAAM,CAAC,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,aAAa,CAAC,CAAC;QACvD,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QAC9B,MAAM,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,YAAY,CAAC,EAAE,uCAAuC,CAAC,CAAC;QACzF,MAAM,CAAC,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACvC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACxC,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,wEAAwE;QACxE,MAAM,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QAC/D,MAAM,CAAC,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5B,MAAM,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,sBAAsB,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/checks/no-tracking.d.ts

@@ -0,0 +1,3 @@
+import type { CheckResult } from '../types.js';
+export declare function checkNoTracking(repoDir: string): Promise<CheckResult>;
+//# sourceMappingURL=no-tracking.d.ts.map

package/dist/checks/no-tracking.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-tracking.d.ts","sourceRoot":"","sources":["../../src/checks/no-tracking.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAkB/C,wBAAsB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAgC3E"}

package/dist/checks/no-tracking.js

@@ -0,0 +1,48 @@
+import { readFile } from 'node:fs/promises';
+import { extname } from 'node:path';
+import { walk } from '../lib/walk.js';
+// Same forbidden list the template's compliance.yml enforces — kept in
+// sync because both are downstream consumers of this package long-term.
+const FORBIDDEN = [
+    'google-analytics',
+    'gtag',
+    'amplitude',
+    'mixpanel',
+    'segment',
+    'hotjar',
+    'plausible',
+    'posthog',
+];
+const SCAN_EXTS = new Set(['.ts', '.tsx', '.js', '.jsx', '.html', '.json']);
+export async function checkNoTracking(repoDir) {
+    const hits = [];
+    for await (const file of walk(repoDir)) {
+        if (!SCAN_EXTS.has(extname(file).toLowerCase()))
+            continue;
+        const content = await readFile(file, 'utf8').catch(() => '');
+        const matches = FORBIDDEN.filter((sdk) => content.includes(sdk));
+        if (matches.length > 0) {
+            hits.push({ file: file.replace(repoDir + '/', ''), matches });
+        }
+    }
+    if (hits.length === 0) {
+        return {
+            name: 'No tracking SDKs',
+            status: 'pass',
+            detail: `scanned for ${FORBIDDEN.length} known trackers`,
+        };
+    }
+    return {
+        name: 'No tracking SDKs',
+        status: 'fail',
+        detail: `${hits.length} file(s) reference trackers: ${hits
+            .slice(0, 3)
+            .map((h) => `${h.file} (${h.matches.join(', ')})`)
+            .join('; ')}${hits.length > 3 ? '…' : ''}`,
+        suggestions: [
+            'FreeAppStore apps must be tracking-free. Remove the SDK + any analytics calls.',
+            'For private-by-design metrics, CF edge analytics already counts requests anonymously.',
+        ],
+    };
+}
+//# sourceMappingURL=no-tracking.js.map

package/dist/checks/no-tracking.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-tracking.js","sourceRoot":"","sources":["../../src/checks/no-tracking.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAEtC,uEAAuE;AACvE,wEAAwE;AACxE,MAAM,SAAS,GAAG;IAChB,kBAAkB;IAClB,MAAM;IACN,WAAW;IACX,UAAU;IACV,SAAS;IACT,QAAQ;IACR,WAAW;IACX,SAAS;CACV,CAAC;AAEF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAE5E,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAe;IACnD,MAAM,IAAI,GAA0C,EAAE,CAAC;IAEvD,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;YAAE,SAAS;QAC1D,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QACjE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,GAAG,GAAG,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,eAAe,SAAS,CAAC,MAAM,iBAAiB;SACzD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,gCAAgC,IAAI;aACvD,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;aACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;aACjD,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC5C,WAAW,EAAE;YACX,gFAAgF;YAChF,uFAAuF;SACxF;KACF,CAAC;AACJ,CAAC"}

package/dist/checks/no-tracking.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=no-tracking.test.d.ts.map

package/dist/checks/no-tracking.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-tracking.test.d.ts","sourceRoot":"","sources":["../../src/checks/no-tracking.test.ts"],"names":[],"mappings":""}

package/dist/checks/no-tracking.test.js

@@ -0,0 +1,42 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { mkdtemp, rm, writeFile, mkdir } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { checkNoTracking } from './no-tracking.js';
+let dir;
+beforeEach(async () => {
+    dir = await mkdtemp(join(tmpdir(), 'fas-compliance-'));
+    await mkdir(join(dir, 'web'));
+});
+afterEach(async () => {
+    await rm(dir, { recursive: true, force: true });
+});
+describe('checkNoTracking', () => {
+    it('passes when no tracking strings anywhere', async () => {
+        await writeFile(join(dir, 'web', 'app.ts'), 'export const x = 1;');
+        const r = await checkNoTracking(dir);
+        expect(r.status).toBe('pass');
+    });
+    it('fails on google-analytics in source', async () => {
+        await writeFile(join(dir, 'web', 'index.html'), '<script src="https://www.google-analytics.com/analytics.js"></script>');
+        const r = await checkNoTracking(dir);
+        expect(r.status).toBe('fail');
+        expect(r.detail).toMatch(/google-analytics/);
+    });
+    it('fails on plausible / posthog as deps even though those are privacy-respecting', async () => {
+        // FreeAppStore policy is *no* analytics, even the privacy-respecting ones.
+        await writeFile(join(dir, 'web', 'package.json'), '{"dependencies":{"posthog-js":"1.0.0"}}');
+        const r = await checkNoTracking(dir);
+        expect(r.status).toBe('fail');
+        expect(r.detail).toMatch(/posthog/);
+    });
+    it('does not scan dist or node_modules (skipped by walk)', async () => {
+        await mkdir(join(dir, 'node_modules', 'posthog-js'), { recursive: true });
+        await writeFile(join(dir, 'node_modules', 'posthog-js', 'index.js'), '// posthog stuff');
+        await mkdir(join(dir, 'dist'));
+        await writeFile(join(dir, 'dist', 'bundle.js'), 'amplitude.track("x")');
+        const r = await checkNoTracking(dir);
+        expect(r.status).toBe('pass');
+    });
+});
+//# sourceMappingURL=no-tracking.test.js.map

package/dist/checks/no-tracking.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-tracking.test.js","sourceRoot":"","sources":["../../src/checks/no-tracking.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD,IAAI,GAAW,CAAC;AAEhB,UAAU,CAAC,KAAK,IAAI,EAAE;IACpB,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACvD,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;AAChC,CAAC,CAAC,CAAC;AACH,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAClD,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,qBAAqB,CAAC,CAAC;QACnE,MAAM,CAAC,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,SAAS,CACb,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,YAAY,CAAC,EAC9B,uEAAuE,CACxE,CAAC;QACF,MAAM,CAAC,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;QAC7F,2EAA2E;QAC3E,MAAM,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,cAAc,CAAC,EAAE,yCAAyC,CAAC,CAAC;QAC7F,MAAM,CAAC,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,MAAM,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,kBAAkB,CAAC,CAAC;QACzF,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;QAC/B,MAAM,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,sBAAsB,CAAC,CAAC;QACxE,MAAM,CAAC,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,15 @@
+import { checkNoPlaceholders } from './checks/no-placeholders.js';
+import { checkNoTracking } from './checks/no-tracking.js';
+import { checkBrandFonts } from './checks/brand-fonts.js';
+import { checkManifest } from './checks/manifest.js';
+import { checkBundleSize } from './checks/bundle-size.js';
+import type { CheckResult } from './types.js';
+export type { CheckStatus, CheckResult } from './types.js';
+export { checkNoPlaceholders, checkNoTracking, checkBrandFonts, checkManifest, checkBundleSize, };
+/**
+ * Runs every compliance check against `repoDir` (the root of an app, the
+ * directory containing package.json + web/). Returns results in a stable
+ * order so callers can render predictable output.
+ */
+export declare function runChecks(repoDir: string): Promise<CheckResult[]>;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,aAAa,EACb,eAAe,GAChB,CAAC;AAEF;;;;GAIG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAQvE"}

package/dist/index.js

@@ -0,0 +1,21 @@
+import { checkNoPlaceholders } from './checks/no-placeholders.js';
+import { checkNoTracking } from './checks/no-tracking.js';
+import { checkBrandFonts } from './checks/brand-fonts.js';
+import { checkManifest } from './checks/manifest.js';
+import { checkBundleSize } from './checks/bundle-size.js';
+export { checkNoPlaceholders, checkNoTracking, checkBrandFonts, checkManifest, checkBundleSize, };
+/**
+ * Runs every compliance check against `repoDir` (the root of an app, the
+ * directory containing package.json + web/). Returns results in a stable
+ * order so callers can render predictable output.
+ */
+export async function runChecks(repoDir) {
+    return Promise.all([
+        checkNoPlaceholders(repoDir),
+        checkNoTracking(repoDir),
+        checkBrandFonts(repoDir),
+        checkManifest(repoDir),
+        checkBundleSize(repoDir),
+    ]);
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAI1D,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,aAAa,EACb,eAAe,GAChB,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAe;IAC7C,OAAO,OAAO,CAAC,GAAG,CAAC;QACjB,mBAAmB,CAAC,OAAO,CAAC;QAC5B,eAAe,CAAC,OAAO,CAAC;QACxB,eAAe,CAAC,OAAO,CAAC;QACxB,aAAa,CAAC,OAAO,CAAC;QACtB,eAAe,CAAC,OAAO,CAAC;KACzB,CAAC,CAAC;AACL,CAAC"}

package/dist/lib/walk.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Recursive file iteration that skips noise directories. Used by every
+ * check that needs to scan source files.
+ */
+export declare function walk(dir: string): AsyncGenerator<string>;
+//# sourceMappingURL=walk.d.ts.map

package/dist/lib/walk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"walk.d.ts","sourceRoot":"","sources":["../../src/lib/walk.ts"],"names":[],"mappings":"AAaA;;;GAGG;AACH,wBAAuB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAe/D"}

package/dist/lib/walk.js

@@ -0,0 +1,35 @@
+import { readdir } from 'node:fs/promises';
+import { join } from 'node:path';
+const SKIP_DIRS = new Set([
+    '.git',
+    'node_modules',
+    'dist',
+    '.next',
+    '.cache',
+    '.wrangler',
+    '.turbo',
+]);
+/**
+ * Recursive file iteration that skips noise directories. Used by every
+ * check that needs to scan source files.
+ */
+export async function* walk(dir) {
+    let entries;
+    try {
+        entries = await readdir(dir, { withFileTypes: true });
+    }
+    catch {
+        return; // missing dir is not an error here — caller decides
+    }
+    for (const entry of entries) {
+        if (entry.isDirectory()) {
+            if (SKIP_DIRS.has(entry.name))
+                continue;
+            yield* walk(join(dir, entry.name));
+        }
+        else if (entry.isFile()) {
+            yield join(dir, entry.name);
+        }
+    }
+}
+//# sourceMappingURL=walk.js.map

package/dist/lib/walk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"walk.js","sourceRoot":"","sources":["../../src/lib/walk.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,MAAM;IACN,cAAc;IACd,MAAM;IACN,OAAO;IACP,QAAQ;IACR,WAAW;IACX,QAAQ;CACT,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,IAAI,CAAC,GAAW;IACrC,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,oDAAoD;IAC9D,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAS;YACxC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACrC,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,12 @@
+export type CheckStatus = 'pass' | 'warn' | 'fail';
+export interface CheckResult {
+    /** Short human-readable name. */
+    name: string;
+    /** pass | warn | fail. fail is a hard gate; warn is informational. */
+    status: CheckStatus;
+    /** One-line context (file path, count, current value). */
+    detail: string;
+    /** Optional actionable advice for fixing a fail/warn. */
+    suggestions?: string[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAEnD,MAAM,WAAW,WAAW;IAC1B,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,MAAM,EAAE,WAAW,CAAC;IACpB,0DAA0D;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,47 @@
+{
+  "name": "@freeappstore/compliance",
+  "version": "0.1.0",
+  "description": "Compliance checks for apps published on freeappstore.online — used by the CLI for local feedback and by CI for gating.",
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "homepage": "https://github.com/freeappstore-online/sdk#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/freeappstore-online/sdk.git",
+    "directory": "packages/compliance"
+  },
+  "bugs": {
+    "url": "https://github.com/freeappstore-online/sdk/issues"
+  },
+  "keywords": [
+    "freeappstore",
+    "compliance",
+    "lint",
+    "audit",
+    "ci"
+  ],
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "scripts": {
+    "build": "tsc",
+    "typecheck": "tsc --noEmit"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.7.0"
+  },
+  "sideEffects": false
+}