@freeappstore/compliance 0.2.0 → 0.5.0

package/dist/checks/no-brand-overrides.js

@@ -1,6 +1,3 @@
-import { readFile } from 'node:fs/promises';
-import { extname, relative } from 'node:path';
-import { walk } from '../lib/walk.js';
 /**
  * Apps and games on the platform must look consistent with the storefront
  * and with each other — brand colors, fonts, and layout rhythm come from
@@ -19,23 +16,22 @@ import { walk } from '../lib/walk.js';
  *     red, etc.). We don't try to gate every hex literal — too noisy and
  *     too many false positives.
  */
-export async function checkNoBrandOverrides(repoDir) {
+export async function checkNoBrandOverrides(source) {
     const issues = [];
-    for await (const file of walk(repoDir)) {
-        const ext = extname(file).toLowerCase();
+    for await (const path of source.list()) {
+        const ext = extOf(path);
         if (!SCANNED_EXTS.has(ext))
             continue;
-        const content = await readFile(file, 'utf8').catch(() => '');
+        const content = await source.read(path);
         if (!content)
             continue;
-        const rel = relative(repoDir, file);
         // Canonical theme file: the platform's CSS variables ARE defined here.
         // Apps own this file post-scaffold (they can technically modify token
         // values, and we accept the imperfection — the loud places where a
         // brand override actually causes inconsistency are inline styles +
         // per-component CSS, which this check still covers).
-        const isThemeFile = rel === 'web/src/index.css' || rel === 'web/src/main.css';
-        const fileIssues = scanContent(rel, content, { skipVarRedefs: isThemeFile });
+        const isThemeFile = path === 'web/src/index.css' || path === 'web/src/main.css';
+        const fileIssues = scanContent(path, content, { skipVarRedefs: isThemeFile });
         issues.push(...fileIssues);
         // Cap at 10 — beyond that the user has bigger problems and we don't
         // want a 200-line failure report.
@@ -118,10 +114,6 @@ const ALLOWED_FONT_TOKENS = new Set([
 export function scanContent(filename, content, opts = {}) {
     const out = [];
     // 1. CSS variable overrides for protected tokens.
-    // Match `--accent: <something>;` outside of var() invocations.
-    // The regex looks for "<two dashes><name>:" near the start of a line,
-    // which is how CSS declarations look. var(--accent) won't match because
-    // there's a `(` not a `:`.
     if (!opts.skipVarRedefs) {
         const varDeclRe = /(?:^|[\s;{,])(--[a-z-]+)\s*:/gim;
         let m;
@@ -133,9 +125,7 @@ export function scanContent(filename, content, opts = {}) {
             }
         }
     }
-    // 2. font-family overrides. Pull every string after `font-family:` (in
-    // CSS) or `fontFamily:` (in JSX/TS), parse the comma-separated list,
-    // and flag any quoted token not in ALLOWED_FONT_TOKENS.
+    // 2. font-family overrides.
     const fontRe = /(?:font-family|fontFamily)\s*[:=]\s*["'`]?([^;"'`}\n]+)["'`]?/g;
     let m;
     while ((m = fontRe.exec(content)) !== null) {
@@ -148,12 +138,17 @@ export function scanContent(filename, content, opts = {}) {
             if (!ALLOWED_FONT_TOKENS.has(t)) {
                 const line = lineNumberAt(content, m.index);
                 out.push(`${filename}:${line} non-brand font "${t}"`);
-                break; // one warning per declaration is plenty
+                break;
             }
         }
     }
     return out;
 }
+function extOf(path) {
+    const dot = path.lastIndexOf('.');
+    const slash = path.lastIndexOf('/');
+    return dot > slash ? path.slice(dot).toLowerCase() : '';
+}
 function lineNumberAt(content, index) {
     let n = 1;
     for (let i = 0; i < index; i++)

package/dist/checks/no-brand-overrides.js.map

@@ -1 +1 @@
-{"version":3,"file":"no-brand-overrides.js","sourceRoot":"","sources":["../../src/checks/no-brand-overrides.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAE9C,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAEtC;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAAe;IACzD,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QACxC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QACrC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACpC,uEAAuE;QACvE,sEAAsE;QACtE,mEAAmE;QACnE,mEAAmE;QACnE,qDAAqD;QACrD,MAAM,WAAW,GAAG,GAAG,KAAK,mBAAmB,IAAI,GAAG,KAAK,kBAAkB,CAAC;QAC9E,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,CAAC;QAC7E,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC;QAC3B,oEAAoE;QACpE,kCAAkC;QAClC,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE;YAAE,MAAM;IACjC,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO;YACL,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,+CAA+C;SACxD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,qBAAqB,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE;QAC7E,WAAW,EAAE;YACX,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;YACrB,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,MAAM,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,uFAAuF;YACvF,2FAA2F;SAC5F;KACF,CAAC;AACJ,CAAC;AAED,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAEvF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,SAAS;IACT,OAAO;IACP,SAAS;IACT,UAAU;IACV,QAAQ;IACR,eAAe;IACf,SAAS;CACV,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,cAAc;IACd,SAAS;IACT,UAAU;IACV,0CAA0C;IAC1C,OAAO;IACP,YAAY;IACZ,WAAW;IACX,WAAW;IACX,cAAc;IACd,UAAU;IACV,eAAe;IACf,SAAS;IACT,SAAS;IACT,OAAO;IACP,QAAQ;IACR,mEAAmE;IACnE,eAAe;IACf,oBAAoB;IACpB,UAAU;IACV,QAAQ;IACR,WAAW;IACX,gBAAgB;IAChB,OAAO;IACP,SAAS;IACT,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,UAAU;IACV,iBAAiB;IACjB,SAAS;IACT,aAAa;IACb,SAAS;IACT,WAAW;IACX,kBAAkB;IAClB,mBAAmB;IACnB,gBAAgB;IAChB,iBAAiB;CAClB,CAAC,CAAC;AAEH,MAAM,UAAU,WAAW,CACzB,QAAgB,EAChB,OAAe,EACf,OAAoC,EAAE;IAEtC,MAAM,GAAG,GAAa,EAAE,CAAC;IAEzB,kDAAkD;IAClD,+DAA+D;IAC/D,sEAAsE;IACtE,wEAAwE;IACxE,2BAA2B;IAC3B,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,iCAAiC,CAAC;QACpD,IAAI,CAAyB,CAAC;QAC9B,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC9C,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;YACnB,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;gBAC5C,GAAG,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,IAAI,cAAc,IAAI,6BAA6B,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,qEAAqE;IACrE,wDAAwD;IACxD,MAAM,MAAM,GAAG,gEAAgE,CAAC;IAChF,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QACnB,MAAM,MAAM,GAAG,IAAI;aAChB,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;aAC9D,MAAM,CAAC,OAAO,CAAC,CAAC;QACnB,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;gBAC5C,GAAG,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,IAAI,oBAAoB,CAAC,GAAG,CAAC,CAAC;gBACtD,MAAM,CAAC,wCAAwC;YACjD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,OAAe,EAAE,KAAa;IAClD,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE;QAAE,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE;YAAE,CAAC,EAAE,CAAC;IACtE,OAAO,CAAC,CAAC;AACX,CAAC"}
+{"version":3,"file":"no-brand-overrides.js","sourceRoot":"","sources":["../../src/checks/no-brand-overrides.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,MAAkB;IAC5D,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QACrC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,uEAAuE;QACvE,sEAAsE;QACtE,mEAAmE;QACnE,mEAAmE;QACnE,qDAAqD;QACrD,MAAM,WAAW,GAAG,IAAI,KAAK,mBAAmB,IAAI,IAAI,KAAK,kBAAkB,CAAC;QAChF,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,CAAC;QAC9E,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC;QAC3B,oEAAoE;QACpE,kCAAkC;QAClC,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE;YAAE,MAAM;IACjC,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO;YACL,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,+CAA+C;SACxD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,qBAAqB,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE;QAC7E,WAAW,EAAE;YACX,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;YACrB,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,MAAM,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,uFAAuF;YACvF,2FAA2F;SAC5F;KACF,CAAC;AACJ,CAAC;AAED,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAEvF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,SAAS;IACT,OAAO;IACP,SAAS;IACT,UAAU;IACV,QAAQ;IACR,eAAe;IACf,SAAS;CACV,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,cAAc;IACd,SAAS;IACT,UAAU;IACV,0CAA0C;IAC1C,OAAO;IACP,YAAY;IACZ,WAAW;IACX,WAAW;IACX,cAAc;IACd,UAAU;IACV,eAAe;IACf,SAAS;IACT,SAAS;IACT,OAAO;IACP,QAAQ;IACR,mEAAmE;IACnE,eAAe;IACf,oBAAoB;IACpB,UAAU;IACV,QAAQ;IACR,WAAW;IACX,gBAAgB;IAChB,OAAO;IACP,SAAS;IACT,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,UAAU;IACV,iBAAiB;IACjB,SAAS;IACT,aAAa;IACb,SAAS;IACT,WAAW;IACX,kBAAkB;IAClB,mBAAmB;IACnB,gBAAgB;IAChB,iBAAiB;CAClB,CAAC,CAAC;AAEH,MAAM,UAAU,WAAW,CACzB,QAAgB,EAChB,OAAe,EACf,OAAoC,EAAE;IAEtC,MAAM,GAAG,GAAa,EAAE,CAAC;IAEzB,kDAAkD;IAClD,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,iCAAiC,CAAC;QACpD,IAAI,CAAyB,CAAC;QAC9B,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC9C,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;YACnB,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;gBAC5C,GAAG,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,IAAI,cAAc,IAAI,6BAA6B,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;IACH,CAAC;IAED,4BAA4B;IAC5B,MAAM,MAAM,GAAG,gEAAgE,CAAC;IAChF,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QACnB,MAAM,MAAM,GAAG,IAAI;aAChB,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;aAC9D,MAAM,CAAC,OAAO,CAAC,CAAC;QACnB,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;gBAC5C,GAAG,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,IAAI,oBAAoB,CAAC,GAAG,CAAC,CAAC;gBACtD,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,KAAK,CAAC,IAAY;IACzB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,OAAO,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,YAAY,CAAC,OAAe,EAAE,KAAa;IAClD,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE;QAAE,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE;YAAE,CAAC,EAAE,CAAC;IACtE,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/checks/no-env-production.d.ts

@@ -0,0 +1,16 @@
+import type { FileSource } from '../lib/file-source.js';
+import type { CheckResult } from '../types.js';
+/**
+ * `.env.production` is a frequent accidental commit — Vite reads it at
+ * build time, and it's the file most likely to contain real API keys
+ * for the production deploy. The platform's templates instruct creators
+ * to use Cloudflare Pages env vars or Wrangler secrets instead. This
+ * check is a safety net: even if the creator's gitignore misses it, we
+ * fail compliance before publish.
+ *
+ * Scope: any `.env.production` file anywhere in the repo. We don't try
+ * to differentiate "this one's empty" from "this one has secrets" —
+ * the file shouldn't exist at all.
+ */
+export declare function checkNoEnvProduction(source: FileSource): Promise<CheckResult>;
+//# sourceMappingURL=no-env-production.d.ts.map

package/dist/checks/no-env-production.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-env-production.d.ts","sourceRoot":"","sources":["../../src/checks/no-env-production.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C;;;;;;;;;;;GAWG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAkBnF"}

package/dist/checks/no-env-production.js

@@ -0,0 +1,33 @@
+/**
+ * `.env.production` is a frequent accidental commit — Vite reads it at
+ * build time, and it's the file most likely to contain real API keys
+ * for the production deploy. The platform's templates instruct creators
+ * to use Cloudflare Pages env vars or Wrangler secrets instead. This
+ * check is a safety net: even if the creator's gitignore misses it, we
+ * fail compliance before publish.
+ *
+ * Scope: any `.env.production` file anywhere in the repo. We don't try
+ * to differentiate "this one's empty" from "this one has secrets" —
+ * the file shouldn't exist at all.
+ */
+export async function checkNoEnvProduction(source) {
+    const offenders = [];
+    for await (const path of source.list()) {
+        const base = path.split('/').pop() ?? '';
+        if (base === '.env.production')
+            offenders.push(path);
+    }
+    if (offenders.length === 0) {
+        return { name: 'No .env.production', status: 'pass', detail: 'no production env files committed' };
+    }
+    return {
+        name: 'No .env.production',
+        status: 'fail',
+        detail: `${offenders.length} .env.production file(s): ${offenders.join(', ')}`,
+        suggestions: [
+            'Delete the file and add `.env.production` to .gitignore.',
+            'Use Cloudflare Pages → Settings → Environment Variables for production secrets instead.',
+        ],
+    };
+}
+//# sourceMappingURL=no-env-production.js.map

package/dist/checks/no-env-production.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-env-production.js","sourceRoot":"","sources":["../../src/checks/no-env-production.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAkB;IAC3D,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;QACzC,IAAI,IAAI,KAAK,iBAAiB;YAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC;IACrG,CAAC;IACD,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,6BAA6B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC9E,WAAW,EAAE;YACX,0DAA0D;YAC1D,yFAAyF;SAC1F;KACF,CAAC;AACJ,CAAC"}

package/dist/checks/no-placeholders.d.ts

@@ -1,3 +1,4 @@
+import type { FileSource } from '../lib/file-source.js';
 import type { CheckResult } from '../types.js';
 /**
  * Catches the case where APPNAME placeholders from the template were
@@ -5,5 +6,5 @@ import type { CheckResult } from '../types.js';
  * but if someone clones the template manually and forgets the find/
  * replace step, every page renders with `<title>APPNAME — …</title>`.
  */
-export declare function checkNoPlaceholders(repoDir: string): Promise<CheckResult>;
+export declare function checkNoPlaceholders(source: FileSource): Promise<CheckResult>;
 //# sourceMappingURL=no-placeholders.d.ts.map

package/dist/checks/no-placeholders.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"no-placeholders.d.ts","sourceRoot":"","sources":["../../src/checks/no-placeholders.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAqB/C;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAsB/E"}
+{"version":3,"file":"no-placeholders.d.ts","sourceRoot":"","sources":["../../src/checks/no-placeholders.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAO/C;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAsBlF"}

package/dist/checks/no-placeholders.js

@@ -1,22 +1,6 @@
-import { readFile } from 'node:fs/promises';
-import { extname } from 'node:path';
-import { walk } from '../lib/walk.js';
 const TEXT_EXTS = new Set([
-    '.md',
-    '.txt',
-    '.json',
-    '.ts',
-    '.tsx',
-    '.js',
-    '.jsx',
-    '.html',
-    '.htm',
-    '.css',
-    '.scss',
-    '.yaml',
-    '.yml',
-    '.toml',
-    '.svg',
+    '.md', '.txt', '.json', '.ts', '.tsx', '.js', '.jsx',
+    '.html', '.htm', '.css', '.scss', '.yaml', '.yml', '.toml', '.svg',
 ]);
 /**
  * Catches the case where APPNAME placeholders from the template were
@@ -24,14 +8,14 @@ const TEXT_EXTS = new Set([
  * but if someone clones the template manually and forgets the find/
  * replace step, every page renders with `<title>APPNAME — …</title>`.
  */
-export async function checkNoPlaceholders(repoDir) {
+export async function checkNoPlaceholders(source) {
     const offenders = [];
-    for await (const file of walk(repoDir)) {
-        if (!TEXT_EXTS.has(extname(file).toLowerCase()))
+    for await (const path of source.list()) {
+        if (!TEXT_EXTS.has(extOf(path)))
             continue;
-        const content = await readFile(file, 'utf8').catch(() => '');
-        if (content.includes('APPNAME')) {
-            offenders.push(file.replace(repoDir + '/', ''));
+        const content = await source.read(path);
+        if (content && content.includes('APPNAME')) {
+            offenders.push(path);
             if (offenders.length >= 5)
                 break; // don't spam, summarize
         }
@@ -49,4 +33,9 @@ export async function checkNoPlaceholders(repoDir) {
         ],
     };
 }
+function extOf(path) {
+    const dot = path.lastIndexOf('.');
+    const slash = path.lastIndexOf('/');
+    return dot > slash ? path.slice(dot).toLowerCase() : '';
+}
 //# sourceMappingURL=no-placeholders.js.map

package/dist/checks/no-placeholders.js.map

@@ -1 +1 @@
-{"version":3,"file":"no-placeholders.js","sourceRoot":"","sources":["../../src/checks/no-placeholders.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAEtC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,KAAK;IACL,MAAM;IACN,OAAO;IACP,KAAK;IACL,MAAM;IACN,KAAK;IACL,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;CACP,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAAe;IACvD,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;YAAE,SAAS;QAC1D,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC7D,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,GAAG,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;YAChD,IAAI,SAAS,CAAC,MAAM,IAAI,CAAC;gBAAE,MAAM,CAAC,wBAAwB;QAC5D,CAAC;IACH,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,IAAI,EAAE,0BAA0B,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IACjG,CAAC;IACD,OAAO;QACL,IAAI,EAAE,0BAA0B;QAChC,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,mCAAmC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACpH,WAAW,EAAE;YACX,0FAA0F;YAC1F,mFAAmF;SACpF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"no-placeholders.js","sourceRoot":"","sources":["../../src/checks/no-placeholders.ts"],"names":[],"mappings":"AAGA,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;IACpD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CACnE,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAAkB;IAC1D,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACvC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAAE,SAAS;QAC1C,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3C,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,IAAI,SAAS,CAAC,MAAM,IAAI,CAAC;gBAAE,MAAM,CAAC,wBAAwB;QAC5D,CAAC;IACH,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,IAAI,EAAE,0BAA0B,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IACjG,CAAC;IACD,OAAO;QACL,IAAI,EAAE,0BAA0B;QAChC,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,mCAAmC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACpH,WAAW,EAAE;YACX,0FAA0F;YAC1F,mFAAmF;SACpF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,IAAY;IACzB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,OAAO,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1D,CAAC"}

package/dist/checks/no-scroll.d.ts

@@ -0,0 +1,25 @@
+import type { FileSource } from '../lib/file-source.js';
+import type { CheckResult } from '../types.js';
+/**
+ * Games on FreeGameStore must fit the viewport — no horizontal or
+ * vertical scroll at the document level. Static analysis catches the
+ * common CSS / inline-style anti-patterns:
+ *
+ *   - `overflow: scroll` or `overflow: auto` on `html` or `body`.
+ *   - `min-height: 100vh` on `html` / `body` (creates page that's at
+ *     least viewport-tall, but content + topbar = > 100vh = scroll).
+ *   - Missing the `100svh` / `100vh` height constraint on the layout
+ *     wrapper (loose check — "at least one root element should hard-cap
+ *     to viewport height").
+ *
+ * Runtime guarantees (real DOM measurement) live in the e2e Playwright
+ * suite; this check exists as a fast pre-publish gate so creators
+ * don't ship trivially-scrolling games.
+ *
+ * Apps (FreeAppStore) are not subject to this check — the apps Shell
+ * wraps them in a sidebar+main layout that legitimately scrolls. We
+ * detect "is this a game project" by looking for the @freeappstore/games
+ * dep, the canonical signal that the app uses GameShell.
+ */
+export declare function checkNoScroll(source: FileSource): Promise<CheckResult>;
+//# sourceMappingURL=no-scroll.d.ts.map

package/dist/checks/no-scroll.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-scroll.d.ts","sourceRoot":"","sources":["../../src/checks/no-scroll.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAuE5E"}

package/dist/checks/no-scroll.js

@@ -0,0 +1,111 @@
+import { isGameProject } from '../lib/project-type.js';
+/**
+ * Games on FreeGameStore must fit the viewport — no horizontal or
+ * vertical scroll at the document level. Static analysis catches the
+ * common CSS / inline-style anti-patterns:
+ *
+ *   - `overflow: scroll` or `overflow: auto` on `html` or `body`.
+ *   - `min-height: 100vh` on `html` / `body` (creates page that's at
+ *     least viewport-tall, but content + topbar = > 100vh = scroll).
+ *   - Missing the `100svh` / `100vh` height constraint on the layout
+ *     wrapper (loose check — "at least one root element should hard-cap
+ *     to viewport height").
+ *
+ * Runtime guarantees (real DOM measurement) live in the e2e Playwright
+ * suite; this check exists as a fast pre-publish gate so creators
+ * don't ship trivially-scrolling games.
+ *
+ * Apps (FreeAppStore) are not subject to this check — the apps Shell
+ * wraps them in a sidebar+main layout that legitimately scrolls. We
+ * detect "is this a game project" by looking for the @freeappstore/games
+ * dep, the canonical signal that the app uses GameShell.
+ */
+export async function checkNoScroll(source) {
+    // Skip apps — only games are subject to no-scroll.
+    if (!(await isGameProject(source))) {
+        return {
+            name: 'No scroll (games only)',
+            status: 'pass',
+            detail: 'not a game project — check skipped',
+        };
+    }
+    const issues = [];
+    let sawViewportLock = false;
+    for await (const path of source.list()) {
+        const ext = extOf(path);
+        if (!SCAN_EXTS.has(ext))
+            continue;
+        const content = await source.read(path);
+        if (!content)
+            continue;
+        for (const re of FORBIDDEN_OVERFLOW) {
+            const m = re.exec(content);
+            if (m) {
+                const line = lineNumberAt(content, m.index);
+                issues.push(`${path}:${line} ${m[0]} — root scrolling not allowed in games`);
+            }
+        }
+        for (const re of FORBIDDEN_MIN_HEIGHT) {
+            const m = re.exec(content);
+            if (m) {
+                const line = lineNumberAt(content, m.index);
+                issues.push(`${path}:${line} ${m[0]} — use exact viewport height (100svh) instead`);
+            }
+        }
+        if (VIEWPORT_LOCK.test(content))
+            sawViewportLock = true;
+        if (issues.length >= 8)
+            break;
+    }
+    if (issues.length > 0) {
+        return {
+            name: 'No scroll (games only)',
+            status: 'fail',
+            detail: `${issues.length} scroll-enabling pattern${issues.length === 1 ? '' : 's'}`,
+            suggestions: [
+                ...issues.slice(0, 5),
+                ...(issues.length > 5 ? [`...and ${issues.length - 5} more`] : []),
+                'Use <GameShell> from @freeappstore/games — it locks layout to 100svh.',
+                'Inside the play area, use overflow: hidden instead of overflow: auto.',
+            ],
+        };
+    }
+    if (!sawViewportLock) {
+        return {
+            name: 'No scroll (games only)',
+            status: 'warn',
+            detail: 'no 100svh/100vh viewport lock detected — game may scroll on small viewports',
+            suggestions: [
+                'Wrap your game in <GameShell> from @freeappstore/games, or',
+                'Add `height: 100svh` to your root container.',
+            ],
+        };
+    }
+    return {
+        name: 'No scroll (games only)',
+        status: 'pass',
+        detail: 'viewport-locked layout detected',
+    };
+}
+const SCAN_EXTS = new Set(['.css', '.scss', '.tsx', '.ts', '.jsx', '.js', '.html']);
+const FORBIDDEN_OVERFLOW = [
+    /(?:^|[\s,{])(?:html|body)\s*\{[^}]*overflow\s*:\s*(?:scroll|auto)/im,
+    /(?:^|[\s,{])(?:html|body)\s*\{[^}]*overflow-(?:x|y)\s*:\s*(?:scroll|auto)/im,
+];
+const FORBIDDEN_MIN_HEIGHT = [
+    /(?:^|[\s,{])(?:html|body)\s*\{[^}]*min-height\s*:\s*100vh/im,
+];
+const VIEWPORT_LOCK = /(?:height|max-height)\s*:\s*100(?:s?vh)|GameShell|@freeappstore\/games/i;
+function extOf(path) {
+    const dot = path.lastIndexOf('.');
+    const slash = path.lastIndexOf('/');
+    return dot > slash ? path.slice(dot).toLowerCase() : '';
+}
+function lineNumberAt(content, index) {
+    let n = 1;
+    for (let i = 0; i < index; i++)
+        if (content.charCodeAt(i) === 10)
+            n++;
+    return n;
+}
+//# sourceMappingURL=no-scroll.js.map

package/dist/checks/no-scroll.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-scroll.js","sourceRoot":"","sources":["../../src/checks/no-scroll.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAGvD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAkB;IACpD,mDAAmD;IACnD,IAAI,CAAC,CAAC,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACnC,OAAO;YACL,IAAI,EAAE,wBAAwB;YAC9B,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,oCAAoC;SAC7C,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,eAAe,GAAG,KAAK,CAAC;IAE5B,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAClC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO;YAAE,SAAS;QAEvB,KAAK,MAAM,EAAE,IAAI,kBAAkB,EAAE,CAAC;YACpC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3B,IAAI,CAAC,EAAE,CAAC;gBACN,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;gBAC5C,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,wCAAwC,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;QAED,KAAK,MAAM,EAAE,IAAI,oBAAoB,EAAE,CAAC;YACtC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3B,IAAI,CAAC,EAAE,CAAC;gBACN,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;gBAC5C,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,+CAA+C,CAAC,CAAC;YACtF,CAAC;QACH,CAAC;QAED,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,eAAe,GAAG,IAAI,CAAC;QAExD,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC;YAAE,MAAM;IAChC,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,IAAI,EAAE,wBAAwB;YAC9B,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,2BAA2B,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE;YACnF,WAAW,EAAE;gBACX,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;gBACrB,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,MAAM,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClE,uEAAuE;gBACvE,uEAAuE;aACxE;SACF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO;YACL,IAAI,EAAE,wBAAwB;YAC9B,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,6EAA6E;YACrF,WAAW,EAAE;gBACX,4DAA4D;gBAC5D,8CAA8C;aAC/C;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,wBAAwB;QAC9B,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,iCAAiC;KAC1C,CAAC;AACJ,CAAC;AAED,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAEpF,MAAM,kBAAkB,GAAG;IACzB,qEAAqE;IACrE,6EAA6E;CAC9E,CAAC;AAEF,MAAM,oBAAoB,GAAG;IAC3B,6DAA6D;CAC9D,CAAC;AAEF,MAAM,aAAa,GAAG,yEAAyE,CAAC;AAEhG,SAAS,KAAK,CAAC,IAAY;IACzB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,OAAO,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,YAAY,CAAC,OAAe,EAAE,KAAa;IAClD,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE;QAAE,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE;YAAE,CAAC,EAAE,CAAC;IACtE,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/checks/no-tracking.d.ts

@@ -1,3 +1,4 @@
+import type { FileSource } from '../lib/file-source.js';
 import type { CheckResult } from '../types.js';
-export declare function checkNoTracking(repoDir: string): Promise<CheckResult>;
+export declare function checkNoTracking(source: FileSource): Promise<CheckResult>;
 //# sourceMappingURL=no-tracking.d.ts.map

package/dist/checks/no-tracking.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"no-tracking.d.ts","sourceRoot":"","sources":["../../src/checks/no-tracking.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAkB/C,wBAAsB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAgC3E"}
+{"version":3,"file":"no-tracking.d.ts","sourceRoot":"","sources":["../../src/checks/no-tracking.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAiB/C,wBAAsB,eAAe,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAiC9E"}

package/dist/checks/no-tracking.js

@@ -1,6 +1,3 @@
-import { readFile } from 'node:fs/promises';
-import { extname } from 'node:path';
-import { walk } from '../lib/walk.js';
 // Same forbidden list the template's compliance.yml enforces — kept in
 // sync because both are downstream consumers of this package long-term.
 const FORBIDDEN = [
@@ -14,15 +11,17 @@ const FORBIDDEN = [
     'posthog',
 ];
 const SCAN_EXTS = new Set(['.ts', '.tsx', '.js', '.jsx', '.html', '.json']);
-export async function checkNoTracking(repoDir) {
+export async function checkNoTracking(source) {
     const hits = [];
-    for await (const file of walk(repoDir)) {
-        if (!SCAN_EXTS.has(extname(file).toLowerCase()))
+    for await (const path of source.list()) {
+        if (!SCAN_EXTS.has(extOf(path)))
+            continue;
+        const content = await source.read(path);
+        if (!content)
             continue;
-        const content = await readFile(file, 'utf8').catch(() => '');
         const matches = FORBIDDEN.filter((sdk) => content.includes(sdk));
         if (matches.length > 0) {
-            hits.push({ file: file.replace(repoDir + '/', ''), matches });
+            hits.push({ file: path, matches });
         }
     }
     if (hits.length === 0) {
@@ -45,4 +44,9 @@ export async function checkNoTracking(repoDir) {
         ],
     };
 }
+function extOf(path) {
+    const dot = path.lastIndexOf('.');
+    const slash = path.lastIndexOf('/');
+    return dot > slash ? path.slice(dot).toLowerCase() : '';
+}
 //# sourceMappingURL=no-tracking.js.map

package/dist/checks/no-tracking.js.map

@@ -1 +1 @@
-{"version":3,"file":"no-tracking.js","sourceRoot":"","sources":["../../src/checks/no-tracking.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAEtC,uEAAuE;AACvE,wEAAwE;AACxE,MAAM,SAAS,GAAG;IAChB,kBAAkB;IAClB,MAAM;IACN,WAAW;IACX,UAAU;IACV,SAAS;IACT,QAAQ;IACR,WAAW;IACX,SAAS;CACV,CAAC;AAEF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAE5E,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAe;IACnD,MAAM,IAAI,GAA0C,EAAE,CAAC;IAEvD,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;YAAE,SAAS;QAC1D,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QACjE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,GAAG,GAAG,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,eAAe,SAAS,CAAC,MAAM,iBAAiB;SACzD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,gCAAgC,IAAI;aACvD,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;aACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;aACjD,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC5C,WAAW,EAAE;YACX,gFAAgF;YAChF,uFAAuF;SACxF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"no-tracking.js","sourceRoot":"","sources":["../../src/checks/no-tracking.ts"],"names":[],"mappings":"AAGA,uEAAuE;AACvE,wEAAwE;AACxE,MAAM,SAAS,GAAG;IAChB,kBAAkB;IAClB,MAAM;IACN,WAAW;IACX,UAAU;IACV,SAAS;IACT,QAAQ;IACR,WAAW;IACX,SAAS;CACV,CAAC;AAEF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAE5E,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAkB;IACtD,MAAM,IAAI,GAA0C,EAAE,CAAC;IAEvD,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACvC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAAE,SAAS;QAC1C,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QACjE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,eAAe,SAAS,CAAC,MAAM,iBAAiB;SACzD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,gCAAgC,IAAI;aACvD,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;aACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;aACjD,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC5C,WAAW,EAAE;YACX,gFAAgF;YAChF,uFAAuF;SACxF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,IAAY;IACzB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,OAAO,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1D,CAAC"}

package/dist/checks/pwa-meta.d.ts

@@ -0,0 +1,19 @@
+import type { FileSource } from '../lib/file-source.js';
+import type { CheckResult } from '../types.js';
+/**
+ * For an "Add to Home Screen" install on iOS Safari to launch the app
+ * standalone (no browser chrome), `web/index.html` needs at least one
+ * of:
+ *
+ *   <meta name="apple-mobile-web-app-capable" content="yes" />
+ *   <meta name="mobile-web-app-capable" content="yes" />
+ *
+ * Without this, iOS opens the installed icon as a normal Safari tab,
+ * defeating the PWA install. Android Chrome reads the manifest's
+ * `display: standalone` instead, but iOS still requires the meta tag.
+ *
+ * The manifest itself is a separate check (`checkManifest`); this one
+ * is specifically the iOS install hint that lives in the HTML head.
+ */
+export declare function checkPwaMeta(source: FileSource): Promise<CheckResult>;
+//# sourceMappingURL=pwa-meta.d.ts.map

package/dist/checks/pwa-meta.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pwa-meta.d.ts","sourceRoot":"","sources":["../../src/checks/pwa-meta.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAI/C;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,YAAY,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAoB3E"}

package/dist/checks/pwa-meta.js

@@ -0,0 +1,38 @@
+const HTML_PATH = 'web/index.html';
+/**
+ * For an "Add to Home Screen" install on iOS Safari to launch the app
+ * standalone (no browser chrome), `web/index.html` needs at least one
+ * of:
+ *
+ *   <meta name="apple-mobile-web-app-capable" content="yes" />
+ *   <meta name="mobile-web-app-capable" content="yes" />
+ *
+ * Without this, iOS opens the installed icon as a normal Safari tab,
+ * defeating the PWA install. Android Chrome reads the manifest's
+ * `display: standalone` instead, but iOS still requires the meta tag.
+ *
+ * The manifest itself is a separate check (`checkManifest`); this one
+ * is specifically the iOS install hint that lives in the HTML head.
+ */
+export async function checkPwaMeta(source) {
+    const html = await source.read(HTML_PATH);
+    if (html === null) {
+        return {
+            name: 'PWA meta tags',
+            status: 'fail',
+            detail: `${HTML_PATH} not found`,
+        };
+    }
+    if (/<meta[^>]*\bname\s*=\s*["'](?:apple-)?mobile-web-app-capable["']/i.test(html)) {
+        return { name: 'PWA meta tags', status: 'pass', detail: 'iOS install hint present' };
+    }
+    return {
+        name: 'PWA meta tags',
+        status: 'warn',
+        detail: 'no apple-mobile-web-app-capable / mobile-web-app-capable meta',
+        suggestions: [
+            'Add `<meta name="apple-mobile-web-app-capable" content="yes" />` to <head> so iOS installs launch standalone.',
+        ],
+    };
+}
+//# sourceMappingURL=pwa-meta.js.map

package/dist/checks/pwa-meta.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pwa-meta.js","sourceRoot":"","sources":["../../src/checks/pwa-meta.ts"],"names":[],"mappings":"AAGA,MAAM,SAAS,GAAG,gBAAgB,CAAC;AAEnC;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAkB;IACnD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO;YACL,IAAI,EAAE,eAAe;YACrB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,GAAG,SAAS,YAAY;SACjC,CAAC;IACJ,CAAC;IACD,IAAI,mEAAmE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnF,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IACvF,CAAC;IACD,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,+DAA+D;QACvE,WAAW,EAAE;YACX,+GAA+G;SAChH;KACF,CAAC;AACJ,CAAC"}

package/dist/checks/store-link.d.ts

@@ -0,0 +1,17 @@
+import type { FileSource } from '../lib/file-source.js';
+import type { CheckResult } from '../types.js';
+/**
+ * Apps and games should link back to their storefront — it's how
+ * visitors discover the rest of the catalog from inside any single
+ * app. The check passes if any source file under `web/src/` references
+ * the appropriate domain:
+ *
+ *   - games  → freegamestore.online
+ *   - apps   → freeappstore.online
+ *
+ * The link can be in JSX (`<a href="https://freeappstore.online">`),
+ * a string constant, or even a footer comment — we don't enforce a
+ * specific component, just that the link exists somewhere visible.
+ */
+export declare function checkStoreLink(source: FileSource): Promise<CheckResult>;
+//# sourceMappingURL=store-link.d.ts.map

package/dist/checks/store-link.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-link.d.ts","sourceRoot":"","sources":["../../src/checks/store-link.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C;;;;;;;;;;;;GAYG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAoB7E"}

package/dist/checks/store-link.js

@@ -0,0 +1,36 @@
+import { isGameProject } from '../lib/project-type.js';
+/**
+ * Apps and games should link back to their storefront — it's how
+ * visitors discover the rest of the catalog from inside any single
+ * app. The check passes if any source file under `web/src/` references
+ * the appropriate domain:
+ *
+ *   - games  → freegamestore.online
+ *   - apps   → freeappstore.online
+ *
+ * The link can be in JSX (`<a href="https://freeappstore.online">`),
+ * a string constant, or even a footer comment — we don't enforce a
+ * specific component, just that the link exists somewhere visible.
+ */
+export async function checkStoreLink(source) {
+    const isGame = await isGameProject(source);
+    const domain = isGame ? 'freegamestore.online' : 'freeappstore.online';
+    for await (const path of source.list()) {
+        if (!path.startsWith('web/src/'))
+            continue;
+        const content = await source.read(path);
+        if (content && content.includes(domain)) {
+            return { name: 'Store link', status: 'pass', detail: `${domain} referenced in ${path}` };
+        }
+    }
+    return {
+        name: 'Store link',
+        status: 'warn',
+        detail: `no link to ${domain} found in web/src/`,
+        suggestions: [
+            `Add a small "Built for ${domain}" link in the footer or about screen.`,
+            'It helps visitors find the rest of the catalog — and it counts for storefront ranking.',
+        ],
+    };
+}
+//# sourceMappingURL=store-link.js.map

package/dist/checks/store-link.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-link.js","sourceRoot":"","sources":["../../src/checks/store-link.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAGvD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAkB;IACrD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,qBAAqB,CAAC;IAEvE,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,SAAS;QAC3C,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACxC,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,kBAAkB,IAAI,EAAE,EAAE,CAAC;QAC3F,CAAC;IACH,CAAC;IACD,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,cAAc,MAAM,oBAAoB;QAChD,WAAW,EAAE;YACX,0BAA0B,MAAM,uCAAuC;YACvE,wFAAwF;SACzF;KACF,CAAC;AACJ,CAAC"}

package/dist/checks/unsafe-vh.d.ts

@@ -0,0 +1,25 @@
+import type { FileSource } from '../lib/file-source.js';
+import type { CheckResult } from '../types.js';
+/**
+ * Flag `100vh` (and Tailwind shortcuts that compile to it) in source.
+ *
+ * Why: on iOS Safari with the URL bar visible, `100vh` resolves to the
+ * *layout* viewport (e.g. 852px on iPhone 15) but the actual visible
+ * area is the *visual* viewport (~750px). An element sized at `100vh`
+ * is then ~100px taller than the screen, forcing the page to scroll on
+ * first load. This is invisible to headless Playwright (no dynamic URL
+ * bar) and to the static audit Worker (no rendering), so this fast
+ * static rule is the cheapest place to catch it.
+ *
+ * Fix: use `100svh` (small viewport height — accounts for visible
+ * browser UI) for "as tall as the screen" intent, or `100dvh` (dynamic
+ * viewport height — recomputes as the URL bar shows/hides) for full-
+ * height containers that should grow when chrome retracts.
+ *
+ * Scope: warn-by-default, not fail. There ARE legitimate uses of
+ * `100vh` (intentionally taking layout-viewport height for hero
+ * sections that should stay constant as URL bar moves). Creators can
+ * acknowledge by leaving an `// allow-100vh` comment on the same line.
+ */
+export declare function checkUnsafeVh(source: FileSource): Promise<CheckResult>;
+//# sourceMappingURL=unsafe-vh.d.ts.map

package/dist/checks/unsafe-vh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unsafe-vh.d.ts","sourceRoot":"","sources":["../../src/checks/unsafe-vh.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAyC5E"}