@freeappstore/compliance 0.2.0 → 0.5.0

package/dist/checks/unsafe-vh.js

@@ -0,0 +1,108 @@
+/**
+ * Flag `100vh` (and Tailwind shortcuts that compile to it) in source.
+ *
+ * Why: on iOS Safari with the URL bar visible, `100vh` resolves to the
+ * *layout* viewport (e.g. 852px on iPhone 15) but the actual visible
+ * area is the *visual* viewport (~750px). An element sized at `100vh`
+ * is then ~100px taller than the screen, forcing the page to scroll on
+ * first load. This is invisible to headless Playwright (no dynamic URL
+ * bar) and to the static audit Worker (no rendering), so this fast
+ * static rule is the cheapest place to catch it.
+ *
+ * Fix: use `100svh` (small viewport height — accounts for visible
+ * browser UI) for "as tall as the screen" intent, or `100dvh` (dynamic
+ * viewport height — recomputes as the URL bar shows/hides) for full-
+ * height containers that should grow when chrome retracts.
+ *
+ * Scope: warn-by-default, not fail. There ARE legitimate uses of
+ * `100vh` (intentionally taking layout-viewport height for hero
+ * sections that should stay constant as URL bar moves). Creators can
+ * acknowledge by leaving an `// allow-100vh` comment on the same line.
+ */
+export async function checkUnsafeVh(source) {
+    const issues = [];
+    for await (const path of source.list()) {
+        if (!SCAN_EXTS.has(extOf(path)))
+            continue;
+        const content = await source.read(path);
+        if (!content)
+            continue;
+        for (const { re, label } of PATTERNS) {
+            // Reset lastIndex defensively; we use `g` to find all matches.
+            re.lastIndex = 0;
+            let m;
+            while ((m = re.exec(content)) !== null) {
+                const line = lineNumberAt(content, m.index);
+                // Allow opt-out via an inline `allow-100vh` comment on the same line.
+                if (lineHasAllowComment(content, m.index))
+                    continue;
+                issues.push(`${path}:${line} ${label} — use 100svh or 100dvh`);
+            }
+        }
+    }
+    if (issues.length === 0) {
+        return {
+            name: 'No unsafe 100vh',
+            status: 'pass',
+            detail: 'no 100vh / h-screen patterns found',
+        };
+    }
+    const head = issues.slice(0, MAX_REPORTED);
+    const tail = issues.length > MAX_REPORTED ? [`...and ${issues.length - MAX_REPORTED} more`] : [];
+    return {
+        name: 'No unsafe 100vh',
+        status: 'warn',
+        detail: `${issues.length} occurrence${issues.length === 1 ? '' : 's'} of 100vh / h-screen — breaks on iOS Safari with URL bar visible`,
+        suggestions: [
+            ...head,
+            ...tail,
+            'Replace with 100svh (preferred) or 100dvh. Add `// allow-100vh` on the line if intentional.',
+        ],
+    };
+}
+const SCAN_EXTS = new Set(['.css', '.scss', '.tsx', '.ts', '.jsx', '.js', '.html']);
+const MAX_REPORTED = 5;
+/**
+ * Patterns to flag. Each is global (`g`) so we find every occurrence.
+ *
+ * Boundary handling:
+ * - `100vh` uses `\b` since CSS values are tokenised normally.
+ * - Tailwind classes use a custom hyphen-aware boundary
+ *   `(?<![\w-])foo(?![\w-])` so `h-screen` doesn't match inside
+ *   `min-h-screen` (and we don't double-count `min-h-screen` as both
+ *   itself and its `h-screen` substring).
+ */
+const PATTERNS = [
+    { re: /\b100vh\b/g, label: '100vh' },
+    // Tailwind: h-screen → height: 100vh; same for min-/max-.
+    { re: /(?<![\w-])h-screen(?![\w-])/g, label: 'h-screen (Tailwind: → 100vh)' },
+    { re: /(?<![\w-])min-h-screen(?![\w-])/g, label: 'min-h-screen (Tailwind: → min-height: 100vh)' },
+    { re: /(?<![\w-])max-h-screen(?![\w-])/g, label: 'max-h-screen (Tailwind: → max-height: 100vh)' },
+];
+function extOf(path) {
+    const dot = path.lastIndexOf('.');
+    const slash = path.lastIndexOf('/');
+    return dot > slash ? path.slice(dot).toLowerCase() : '';
+}
+function lineNumberAt(content, index) {
+    let n = 1;
+    for (let i = 0; i < index; i++)
+        if (content.charCodeAt(i) === 10)
+            n++;
+    return n;
+}
+/**
+ * True if the rest of the line containing `index` includes the literal
+ * string "allow-100vh" (typically inside a comment). Cheap and cheerful
+ * — doesn't validate comment syntax, just trusts the marker.
+ */
+function lineHasAllowComment(content, index) {
+    let end = content.indexOf('\n', index);
+    if (end === -1)
+        end = content.length;
+    let start = content.lastIndexOf('\n', index);
+    if (start === -1)
+        start = 0;
+    return content.slice(start, end).includes('allow-100vh');
+}
+//# sourceMappingURL=unsafe-vh.js.map

package/dist/checks/unsafe-vh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unsafe-vh.js","sourceRoot":"","sources":["../../src/checks/unsafe-vh.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAkB;IACpD,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACvC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAAE,SAAS;QAC1C,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO;YAAE,SAAS;QAEvB,KAAK,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,QAAQ,EAAE,CAAC;YACrC,+DAA+D;YAC/D,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC;YACjB,IAAI,CAAyB,CAAC;YAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACvC,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;gBAC5C,sEAAsE;gBACtE,IAAI,mBAAmB,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC;oBAAE,SAAS;gBACpD,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,IAAI,KAAK,yBAAyB,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,oCAAoC;SAC7C,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,UAAU,MAAM,CAAC,MAAM,GAAG,YAAY,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjG,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,kEAAkE;QACtI,WAAW,EAAE;YACX,GAAG,IAAI;YACP,GAAG,IAAI;YACP,6FAA6F;SAC9F;KACF,CAAC;AACJ,CAAC;AAED,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AACpF,MAAM,YAAY,GAAG,CAAC,CAAC;AAEvB;;;;;;;;;GASG;AACH,MAAM,QAAQ,GAAyC;IACrD,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE;IACpC,0DAA0D;IAC1D,EAAE,EAAE,EAAE,8BAA8B,EAAE,KAAK,EAAE,8BAA8B,EAAE;IAC7E,EAAE,EAAE,EAAE,kCAAkC,EAAE,KAAK,EAAE,8CAA8C,EAAE;IACjG,EAAE,EAAE,EAAE,kCAAkC,EAAE,KAAK,EAAE,8CAA8C,EAAE;CAClG,CAAC;AAEF,SAAS,KAAK,CAAC,IAAY;IACzB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,OAAO,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,YAAY,CAAC,OAAe,EAAE,KAAa;IAClD,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE;QAAE,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE;YAAE,CAAC,EAAE,CAAC;IACtE,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,OAAe,EAAE,KAAa;IACzD,IAAI,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvC,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;IACrC,IAAI,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC7C,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,KAAK,GAAG,CAAC,CAAC;IAC5B,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;AAC3D,CAAC"}

package/dist/checks/viewport-support.d.ts

@@ -0,0 +1,24 @@
+import type { FileSource } from '../lib/file-source.js';
+import type { CheckResult } from '../types.js';
+/**
+ * Apps and games must declare which screens and orientations they
+ * support, so the storefront can render a coverage badge ("works on
+ * 92% of devices · portrait + landscape") and visitors know what to
+ * expect before they tap.
+ *
+ * Two declarations are required, both in `web/public/manifest.json`:
+ *
+ *   "orientation":           "any" | "portrait" | "landscape" |
+ *                            "portrait-primary" | "landscape-primary"
+ *   "min_viewport_width":     320 | 360 | 414 | 600 | 768 | 1024
+ *
+ * `orientation` is a standard PWA manifest field. `min_viewport_width`
+ * is a custom platform field — the smallest screen width (in CSS px)
+ * the app renders correctly at. The storefront maps that to a global
+ * device-share percentile to render coverage.
+ *
+ * If you genuinely don't care about orientation, set `"any"`. Don't
+ * leave it off — that's the only value that returns a fail.
+ */
+export declare function checkViewportSupport(source: FileSource): Promise<CheckResult>;
+//# sourceMappingURL=viewport-support.d.ts.map

package/dist/checks/viewport-support.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"viewport-support.d.ts","sourceRoot":"","sources":["../../src/checks/viewport-support.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAI/C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAqEnF"}

package/dist/checks/viewport-support.js

@@ -0,0 +1,92 @@
+const MANIFEST_PATH = 'web/public/manifest.json';
+/**
+ * Apps and games must declare which screens and orientations they
+ * support, so the storefront can render a coverage badge ("works on
+ * 92% of devices · portrait + landscape") and visitors know what to
+ * expect before they tap.
+ *
+ * Two declarations are required, both in `web/public/manifest.json`:
+ *
+ *   "orientation":           "any" | "portrait" | "landscape" |
+ *                            "portrait-primary" | "landscape-primary"
+ *   "min_viewport_width":     320 | 360 | 414 | 600 | 768 | 1024
+ *
+ * `orientation` is a standard PWA manifest field. `min_viewport_width`
+ * is a custom platform field — the smallest screen width (in CSS px)
+ * the app renders correctly at. The storefront maps that to a global
+ * device-share percentile to render coverage.
+ *
+ * If you genuinely don't care about orientation, set `"any"`. Don't
+ * leave it off — that's the only value that returns a fail.
+ */
+export async function checkViewportSupport(source) {
+    const raw = await source.read(MANIFEST_PATH);
+    if (raw === null) {
+        return {
+            name: 'Viewport support',
+            status: 'fail',
+            detail: `${MANIFEST_PATH} not found`,
+        };
+    }
+    let manifest;
+    try {
+        manifest = JSON.parse(raw);
+    }
+    catch {
+        return {
+            name: 'Viewport support',
+            status: 'fail',
+            detail: `${MANIFEST_PATH} unparseable`,
+        };
+    }
+    const orientation = manifest['orientation'];
+    const minWidth = manifest['min_viewport_width'];
+    const issues = [];
+    const warnings = [];
+    if (typeof orientation !== 'string' || !VALID_ORIENTATIONS.has(orientation)) {
+        issues.push(`manifest.orientation is "${String(orientation)}" — must be one of: ${[...VALID_ORIENTATIONS].join(', ')}`);
+    }
+    if (typeof minWidth !== 'number') {
+        warnings.push('manifest.min_viewport_width is missing — assuming 320 (strictest). ' +
+            'Set explicitly to e.g. 360 / 414 / 600 / 768 / 1024 to declare which devices the app supports.');
+    }
+    else if (minWidth < 320) {
+        issues.push(`manifest.min_viewport_width=${minWidth} is below the 320px minimum`);
+    }
+    else if (!RECOMMENDED_WIDTHS.includes(minWidth)) {
+        warnings.push(`manifest.min_viewport_width=${minWidth} is unusual — recommended values: ${RECOMMENDED_WIDTHS.join(', ')}`);
+    }
+    if (issues.length > 0) {
+        return {
+            name: 'Viewport support',
+            status: 'fail',
+            detail: `${issues.length} viewport-declaration issue${issues.length === 1 ? '' : 's'}`,
+            suggestions: [
+                ...issues,
+                'Edit web/public/manifest.json: add "orientation": "any" (or portrait/landscape) and "min_viewport_width": 360.',
+            ],
+        };
+    }
+    if (warnings.length > 0) {
+        return {
+            name: 'Viewport support',
+            status: 'warn',
+            detail: warnings[0],
+            suggestions: warnings,
+        };
+    }
+    return {
+        name: 'Viewport support',
+        status: 'pass',
+        detail: `orientation=${orientation} · min ${minWidth}px`,
+    };
+}
+const VALID_ORIENTATIONS = new Set([
+    'any',
+    'portrait',
+    'landscape',
+    'portrait-primary',
+    'landscape-primary',
+]);
+const RECOMMENDED_WIDTHS = [320, 360, 414, 600, 768, 1024];
+//# sourceMappingURL=viewport-support.js.map

package/dist/checks/viewport-support.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"viewport-support.js","sourceRoot":"","sources":["../../src/checks/viewport-support.ts"],"names":[],"mappings":"AAGA,MAAM,aAAa,GAAG,0BAA0B,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAkB;IAC3D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC7C,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,GAAG,aAAa,YAAY;SACrC,CAAC;IACJ,CAAC;IACD,IAAI,QAAiC,CAAC;IACtC,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,GAAG,aAAa,cAAc;SACvC,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,QAAQ,CAAC,oBAAoB,CAAC,CAAC;IAEhD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5E,MAAM,CAAC,IAAI,CACT,4BAA4B,MAAM,CAAC,WAAW,CAAC,uBAAuB,CAAC,GAAG,kBAAkB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3G,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,QAAQ,CAAC,IAAI,CACX,qEAAqE;YACnE,gGAAgG,CACnG,CAAC;IACJ,CAAC;SAAM,IAAI,QAAQ,GAAG,GAAG,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC,+BAA+B,QAAQ,6BAA6B,CAAC,CAAC;IACpF,CAAC;SAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClD,QAAQ,CAAC,IAAI,CACX,+BAA+B,QAAQ,qCAAqC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC5G,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,8BAA8B,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE;YACtF,WAAW,EAAE;gBACX,GAAG,MAAM;gBACT,gHAAgH;aACjH;SACF,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAE;YACpB,WAAW,EAAE,QAAQ;SACtB,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,eAAe,WAAqB,UAAU,QAAQ,IAAI;KACnE,CAAC;AACJ,CAAC;AAED,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,KAAK;IACL,UAAU;IACV,WAAW;IACX,kBAAkB;IAClB,mBAAmB;CACpB,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC"}

package/dist/index.d.ts

@@ -1,16 +1,37 @@
-import { checkNoPlaceholders } from './checks/no-placeholders.js';
-import { checkNoTracking } from './checks/no-tracking.js';
 import { checkBrandFonts } from './checks/brand-fonts.js';
-import { checkNoBrandOverrides } from './checks/no-brand-overrides.js';
-import { checkManifest } from './checks/manifest.js';
+import { checkBrandTokens } from './checks/brand-tokens.js';
 import { checkBundleSize } from './checks/bundle-size.js';
+import { checkDarkMode } from './checks/dark-mode.js';
+import { checkHtmlMeta } from './checks/html-meta.js';
+import { checkLicenseMit } from './checks/license-mit.js';
+import { checkManifest } from './checks/manifest.js';
+import { checkNoBrandOverrides } from './checks/no-brand-overrides.js';
+import { checkNoEnvProduction } from './checks/no-env-production.js';
+import { checkNoPlaceholders } from './checks/no-placeholders.js';
+import { checkNoScroll } from './checks/no-scroll.js';
+import { checkNoTracking } from './checks/no-tracking.js';
+import { checkPwaMeta } from './checks/pwa-meta.js';
+import { checkStoreLink } from './checks/store-link.js';
+import { checkUnsafeVh } from './checks/unsafe-vh.js';
+import { checkViewportSupport } from './checks/viewport-support.js';
+import { fsFileSource, mapFileSource } from './lib/file-source.js';
+import { isGameProject } from './lib/project-type.js';
 import type { CheckResult } from './types.js';
 export type { CheckStatus, CheckResult } from './types.js';
-export { checkNoPlaceholders, checkNoTracking, checkBrandFonts, checkNoBrandOverrides, checkManifest, checkBundleSize, };
+export type { FileSource } from './lib/file-source.js';
+export { fsFileSource, mapFileSource, isGameProject };
+export { checkBrandFonts, checkBrandTokens, checkBundleSize, checkDarkMode, checkHtmlMeta, checkLicenseMit, checkManifest, checkNoBrandOverrides, checkNoEnvProduction, checkNoPlaceholders, checkNoScroll, checkNoTracking, checkPwaMeta, checkStoreLink, checkUnsafeVh, checkViewportSupport, };
+export { auditLive, checkNoTrackingLive, checkBrandFontsLive, checkManifestLive, checkBundleSizeLive, checkUnsafeVhLive, } from './live/index.js';
+export type { LiveAuditInput, LiveAuditReport } from './live/index.js';
 /**
- * Runs every compliance check against `repoDir` (the root of an app, the
- * directory containing package.json + web/). Returns results in a stable
- * order so callers can render predictable output.
+ * Runs every compliance check against the source. Two front doors:
+ *   - `runChecks(repoDir)`        — CLI / CI; reads from disk.
+ *   - `runChecksFromFiles(map)`   — VibeCode agent; reads from a Map.
+ *
+ * Both call the same underlying check functions via the FileSource
+ * abstraction, so rules stay in one place. Results are returned in a
+ * stable order so callers can render predictable output.
  */
 export declare function runChecks(repoDir: string): Promise<CheckResult[]>;
+export declare function runChecksFromFiles(files: Map<string, string>): Promise<CheckResult[]>;
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,aAAa,EACb,eAAe,GAChB,CAAC;AAEF;;;;GAIG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CASvE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAmB,YAAY,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC3D,YAAY,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC;AACtD,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,aAAa,EACb,eAAe,EACf,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,mBAAmB,EACnB,aAAa,EACb,eAAe,EACf,YAAY,EACZ,cAAc,EACd,aAAa,EACb,oBAAoB,GACrB,CAAC;AAKF,OAAO,EACL,SAAS,EACT,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvE;;;;;;;;GAQG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAEvE;AAED,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAE3F"}

package/dist/index.js

@@ -1,23 +1,60 @@
-import { checkNoPlaceholders } from './checks/no-placeholders.js';
-import { checkNoTracking } from './checks/no-tracking.js';
 import { checkBrandFonts } from './checks/brand-fonts.js';
-import { checkNoBrandOverrides } from './checks/no-brand-overrides.js';
-import { checkManifest } from './checks/manifest.js';
+import { checkBrandTokens } from './checks/brand-tokens.js';
 import { checkBundleSize } from './checks/bundle-size.js';
-export { checkNoPlaceholders, checkNoTracking, checkBrandFonts, checkNoBrandOverrides, checkManifest, checkBundleSize, };
+import { checkDarkMode } from './checks/dark-mode.js';
+import { checkHtmlMeta } from './checks/html-meta.js';
+import { checkLicenseMit } from './checks/license-mit.js';
+import { checkManifest } from './checks/manifest.js';
+import { checkNoBrandOverrides } from './checks/no-brand-overrides.js';
+import { checkNoEnvProduction } from './checks/no-env-production.js';
+import { checkNoPlaceholders } from './checks/no-placeholders.js';
+import { checkNoScroll } from './checks/no-scroll.js';
+import { checkNoTracking } from './checks/no-tracking.js';
+import { checkPwaMeta } from './checks/pwa-meta.js';
+import { checkStoreLink } from './checks/store-link.js';
+import { checkUnsafeVh } from './checks/unsafe-vh.js';
+import { checkViewportSupport } from './checks/viewport-support.js';
+import { fsFileSource, mapFileSource } from './lib/file-source.js';
+import { isGameProject } from './lib/project-type.js';
+export { fsFileSource, mapFileSource, isGameProject };
+export { checkBrandFonts, checkBrandTokens, checkBundleSize, checkDarkMode, checkHtmlMeta, checkLicenseMit, checkManifest, checkNoBrandOverrides, checkNoEnvProduction, checkNoPlaceholders, checkNoScroll, checkNoTracking, checkPwaMeta, checkStoreLink, checkUnsafeVh, checkViewportSupport, };
+// Live-URL audit (used by the compliance audit Worker; runs in
+// browser/Workers env, no filesystem). Separate export path so callers
+// don't accidentally pull node:fs in via the file-walking checks.
+export { auditLive, checkNoTrackingLive, checkBrandFontsLive, checkManifestLive, checkBundleSizeLive, checkUnsafeVhLive, } from './live/index.js';
 /**
- * Runs every compliance check against `repoDir` (the root of an app, the
- * directory containing package.json + web/). Returns results in a stable
- * order so callers can render predictable output.
+ * Runs every compliance check against the source. Two front doors:
+ *   - `runChecks(repoDir)`        — CLI / CI; reads from disk.
+ *   - `runChecksFromFiles(map)`   — VibeCode agent; reads from a Map.
+ *
+ * Both call the same underlying check functions via the FileSource
+ * abstraction, so rules stay in one place. Results are returned in a
+ * stable order so callers can render predictable output.
  */
 export async function runChecks(repoDir) {
+    return runChecksOn(fsFileSource(repoDir));
+}
+export async function runChecksFromFiles(files) {
+    return runChecksOn(mapFileSource(files));
+}
+async function runChecksOn(source) {
     return Promise.all([
-        checkNoPlaceholders(repoDir),
-        checkNoTracking(repoDir),
-        checkBrandFonts(repoDir),
-        checkNoBrandOverrides(repoDir),
-        checkManifest(repoDir),
-        checkBundleSize(repoDir),
+        checkLicenseMit(source),
+        checkNoEnvProduction(source),
+        checkNoPlaceholders(source),
+        checkNoTracking(source),
+        checkBrandFonts(source),
+        checkBrandTokens(source),
+        checkNoBrandOverrides(source),
+        checkNoScroll(source),
+        checkViewportSupport(source),
+        checkUnsafeVh(source),
+        checkHtmlMeta(source),
+        checkPwaMeta(source),
+        checkManifest(source),
+        checkStoreLink(source),
+        checkDarkMode(source),
+        checkBundleSize(source),
     ]);
 }
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAI1D,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,aAAa,EACb,eAAe,GAChB,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAe;IAC7C,OAAO,OAAO,CAAC,GAAG,CAAC;QACjB,mBAAmB,CAAC,OAAO,CAAC;QAC5B,eAAe,CAAC,OAAO,CAAC;QACxB,eAAe,CAAC,OAAO,CAAC;QACxB,qBAAqB,CAAC,OAAO,CAAC;QAC9B,aAAa,CAAC,OAAO,CAAC;QACtB,eAAe,CAAC,OAAO,CAAC;KACzB,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAmB,YAAY,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAKtD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC;AACtD,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,aAAa,EACb,eAAe,EACf,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,mBAAmB,EACnB,aAAa,EACb,eAAe,EACf,YAAY,EACZ,cAAc,EACd,aAAa,EACb,oBAAoB,GACrB,CAAC;AAEF,+DAA+D;AAC/D,uEAAuE;AACvE,kEAAkE;AAClE,OAAO,EACL,SAAS,EACT,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AAGzB;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAe;IAC7C,OAAO,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAA0B;IACjE,OAAO,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,MAAkB;IAC3C,OAAO,OAAO,CAAC,GAAG,CAAC;QACjB,eAAe,CAAC,MAAM,CAAC;QACvB,oBAAoB,CAAC,MAAM,CAAC;QAC5B,mBAAmB,CAAC,MAAM,CAAC;QAC3B,eAAe,CAAC,MAAM,CAAC;QACvB,eAAe,CAAC,MAAM,CAAC;QACvB,gBAAgB,CAAC,MAAM,CAAC;QACxB,qBAAqB,CAAC,MAAM,CAAC;QAC7B,aAAa,CAAC,MAAM,CAAC;QACrB,oBAAoB,CAAC,MAAM,CAAC;QAC5B,aAAa,CAAC,MAAM,CAAC;QACrB,aAAa,CAAC,MAAM,CAAC;QACrB,YAAY,CAAC,MAAM,CAAC;QACpB,aAAa,CAAC,MAAM,CAAC;QACrB,cAAc,CAAC,MAAM,CAAC;QACtB,aAAa,CAAC,MAAM,CAAC;QACrB,eAAe,CAAC,MAAM,CAAC;KACxB,CAAC,CAAC;AACL,CAAC"}

package/dist/lib/file-source.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Filesystem-agnostic file access for compliance checks.
+ *
+ * Why: the CLI scans a real directory on disk; the VibeCode agent runs
+ * in a Cloudflare Worker (no node:fs) and holds files in a Map. Both
+ * call the same checks via this interface so rules stay in one place.
+ *
+ * Conventions:
+ *   - Paths are POSIX-style and relative to the repo root
+ *     (e.g. `web/src/App.tsx`).
+ *   - `read` returns null for missing files — checks decide whether
+ *     missing == fail or missing == not-applicable.
+ *   - `list()` already excludes noise dirs (.git, node_modules, dist,
+ *     etc.). Implementations are responsible for that filtering.
+ */
+export interface FileSource {
+    /** Yield every relevant file path. Implementations skip noise dirs. */
+    list(): AsyncIterable<string>;
+    /** UTF-8 text. Returns null if the path doesn't exist. */
+    read(path: string): Promise<string | null>;
+    /** Raw bytes. Returns null if the path doesn't exist. Optional — only
+     *  bundle-size needs binary access today. */
+    readBytes?(path: string): Promise<Uint8Array | null>;
+    /** Names of direct children of `dir`. Returns null if dir missing.
+     *  Optional — only bundle-size needs directory enumeration. */
+    listDir?(dir: string): Promise<string[] | null>;
+}
+/**
+ * Filesystem-backed FileSource — used by the CLI and CI. Walks the
+ * directory tree once on first list() iteration; uses node:fs for
+ * read/readBytes/listDir.
+ *
+ * Paths containing `..` segments are rejected — every read returns
+ * null. Defense in depth: today's checks only pass paths that came
+ * from `list()` (which stays inside the root), but a future buggy or
+ * malicious check could try `source.read('../etc/passwd')`. We refuse
+ * rather than letting `path.join` resolve outside repoDir.
+ */
+export declare function fsFileSource(repoDir: string): FileSource;
+/**
+ * Map-backed FileSource — used by the VibeCode agent (Workers env).
+ * The agent's session DO holds the virtual filesystem as a Map; this
+ * adapter exposes it through the same interface as the on-disk CLI.
+ *
+ * `readBytes` decodes the stored UTF-8 string back to bytes — fine for
+ * text-only checks. The agent has no built artefacts (it runs pre-
+ * deploy), so bundle-size will return its "not built yet" warn anyway.
+ *
+ * `listDir` synthesises directory listings from the Map keys.
+ */
+export declare function mapFileSource(files: Map<string, string>): FileSource;
+//# sourceMappingURL=file-source.d.ts.map

package/dist/lib/file-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-source.d.ts","sourceRoot":"","sources":["../../src/lib/file-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH,MAAM,WAAW,UAAU;IACzB,uEAAuE;IACvE,IAAI,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9B,0DAA0D;IAC1D,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC3C;iDAC6C;IAC7C,SAAS,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACrD;mEAC+D;IAC/D,OAAO,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;CACjD;AAID;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,CA+BxD;AA4BD;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,UAAU,CA8BpE"}

package/dist/lib/file-source.js

@@ -0,0 +1,148 @@
+/**
+ * Filesystem-agnostic file access for compliance checks.
+ *
+ * Why: the CLI scans a real directory on disk; the VibeCode agent runs
+ * in a Cloudflare Worker (no node:fs) and holds files in a Map. Both
+ * call the same checks via this interface so rules stay in one place.
+ *
+ * Conventions:
+ *   - Paths are POSIX-style and relative to the repo root
+ *     (e.g. `web/src/App.tsx`).
+ *   - `read` returns null for missing files — checks decide whether
+ *     missing == fail or missing == not-applicable.
+ *   - `list()` already excludes noise dirs (.git, node_modules, dist,
+ *     etc.). Implementations are responsible for that filtering.
+ */
+import { readdir, readFile } from 'node:fs/promises';
+import { join, relative, sep } from 'node:path';
+const SKIP_DIRS = new Set(['.git', 'node_modules', 'dist', '.next', '.cache', '.wrangler', '.turbo']);
+/**
+ * Filesystem-backed FileSource — used by the CLI and CI. Walks the
+ * directory tree once on first list() iteration; uses node:fs for
+ * read/readBytes/listDir.
+ *
+ * Paths containing `..` segments are rejected — every read returns
+ * null. Defense in depth: today's checks only pass paths that came
+ * from `list()` (which stays inside the root), but a future buggy or
+ * malicious check could try `source.read('../etc/passwd')`. We refuse
+ * rather than letting `path.join` resolve outside repoDir.
+ */
+export function fsFileSource(repoDir) {
+    return {
+        async *list() {
+            yield* walk(repoDir, repoDir);
+        },
+        async read(path) {
+            if (hasTraversal(path))
+                return null;
+            try {
+                return await readFile(join(repoDir, path), 'utf8');
+            }
+            catch {
+                return null;
+            }
+        },
+        async readBytes(path) {
+            if (hasTraversal(path))
+                return null;
+            try {
+                const buf = await readFile(join(repoDir, path));
+                return new Uint8Array(buf);
+            }
+            catch {
+                return null;
+            }
+        },
+        async listDir(dir) {
+            if (hasTraversal(dir))
+                return null;
+            try {
+                return await readdir(join(repoDir, dir));
+            }
+            catch {
+                return null;
+            }
+        },
+    };
+}
+/** True if `path` contains a `..` segment or is absolute. */
+function hasTraversal(path) {
+    if (path.startsWith('/') || /^[a-zA-Z]:/.test(path))
+        return true; // absolute
+    return path.split(/[/\\]/).some((seg) => seg === '..');
+}
+async function* walk(dir, root) {
+    let entries;
+    try {
+        entries = await readdir(dir, { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    for (const entry of entries) {
+        const full = join(dir, entry.name);
+        if (entry.isDirectory()) {
+            if (SKIP_DIRS.has(entry.name))
+                continue;
+            yield* walk(full, root);
+        }
+        else if (entry.isFile()) {
+            // Always emit POSIX-style paths so checks can rely on consistent
+            // separators across platforms.
+            yield relative(root, full).split(sep).join('/');
+        }
+    }
+}
+/**
+ * Map-backed FileSource — used by the VibeCode agent (Workers env).
+ * The agent's session DO holds the virtual filesystem as a Map; this
+ * adapter exposes it through the same interface as the on-disk CLI.
+ *
+ * `readBytes` decodes the stored UTF-8 string back to bytes — fine for
+ * text-only checks. The agent has no built artefacts (it runs pre-
+ * deploy), so bundle-size will return its "not built yet" warn anyway.
+ *
+ * `listDir` synthesises directory listings from the Map keys.
+ */
+export function mapFileSource(files) {
+    return {
+        async *list() {
+            for (const path of files.keys()) {
+                if (isSkippedPath(path))
+                    continue;
+                yield path;
+            }
+        },
+        async read(path) {
+            return files.get(path) ?? null;
+        },
+        async readBytes(path) {
+            const text = files.get(path);
+            if (text === undefined)
+                return null;
+            return new TextEncoder().encode(text);
+        },
+        async listDir(dir) {
+            const prefix = dir.endsWith('/') ? dir : `${dir}/`;
+            const children = new Set();
+            let saw = false;
+            for (const path of files.keys()) {
+                if (!path.startsWith(prefix))
+                    continue;
+                saw = true;
+                const rest = path.slice(prefix.length);
+                const slash = rest.indexOf('/');
+                children.add(slash === -1 ? rest : rest.slice(0, slash));
+            }
+            return saw ? [...children] : null;
+        },
+    };
+}
+function isSkippedPath(path) {
+    for (const seg of path.split('/')) {
+        if (SKIP_DIRS.has(seg))
+            return true;
+    }
+    return false;
+}
+//# sourceMappingURL=file-source.js.map

package/dist/lib/file-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-source.js","sourceRoot":"","sources":["../../src/lib/file-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAehD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEtG;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,OAAO;QACL,KAAK,CAAC,CAAC,IAAI;YACT,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAChC,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,IAAI;YACb,IAAI,YAAY,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpC,IAAI,CAAC;gBACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;YACrD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,IAAI;YAClB,IAAI,YAAY,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;gBAChD,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;YAC7B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,GAAG;YACf,IAAI,YAAY,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnC,IAAI,CAAC;gBACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;YAC3C,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,6DAA6D;AAC7D,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,WAAW;IAC7E,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;AACzD,CAAC;AAED,KAAK,SAAS,CAAC,CAAC,IAAI,CAAC,GAAW,EAAE,IAAY;IAC5C,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAS;YACxC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC1B,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1B,iEAAiE;YACjE,+BAA+B;YAC/B,MAAM,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,KAA0B;IACtD,OAAO;QACL,KAAK,CAAC,CAAC,IAAI;YACT,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;gBAChC,IAAI,aAAa,CAAC,IAAI,CAAC;oBAAE,SAAS;gBAClC,MAAM,IAAI,CAAC;YACb,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,IAAI;YACb,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;QACjC,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,IAAI;YAClB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC7B,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACpC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxC,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,GAAG;YACf,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC;YACnD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;YACnC,IAAI,GAAG,GAAG,KAAK,CAAC;YAChB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;gBAChC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;oBAAE,SAAS;gBACvC,GAAG,GAAG,IAAI,CAAC;gBACX,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACvC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAChC,QAAQ,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;YAC3D,CAAC;YACD,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IACtC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/lib/gzip.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Gzip via the Web Streams API. Available in Node 18+ and Cloudflare
+ * Workers, so the same helper works in both the CLI's filesystem
+ * checks and the audit Worker's live checks. Avoids divergence
+ * between source-side and live measurements of bundle size.
+ */
+export declare function gzipByteLength(input: Uint8Array): Promise<number>;
+//# sourceMappingURL=gzip.d.ts.map

package/dist/lib/gzip.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gzip.d.ts","sourceRoot":"","sources":["../../src/lib/gzip.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBvE"}

package/dist/lib/gzip.js

@@ -0,0 +1,26 @@
+/**
+ * Gzip via the Web Streams API. Available in Node 18+ and Cloudflare
+ * Workers, so the same helper works in both the CLI's filesystem
+ * checks and the audit Worker's live checks. Avoids divergence
+ * between source-side and live measurements of bundle size.
+ */
+export async function gzipByteLength(input) {
+    const readable = new ReadableStream({
+        start(controller) {
+            controller.enqueue(input);
+            controller.close();
+        },
+    });
+    const compressed = readable.pipeThrough(new CompressionStream('gzip'));
+    const reader = compressed.getReader();
+    let total = 0;
+    for (;;) {
+        const { value, done } = await reader.read();
+        if (done)
+            break;
+        if (value)
+            total += value.byteLength;
+    }
+    return total;
+}
+//# sourceMappingURL=gzip.js.map

package/dist/lib/gzip.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gzip.js","sourceRoot":"","sources":["../../src/lib/gzip.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAiB;IACpD,MAAM,QAAQ,GAAG,IAAI,cAAc,CAAa;QAC9C,KAAK,CAAC,UAAU;YACd,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC1B,UAAU,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;KACF,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC;IACtC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,SAAS,CAAC;QACR,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,IAAI;YAAE,MAAM;QAChB,IAAI,KAAK;YAAE,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;IACvC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}