@freegamestore/compliance 0.1.0

package/dist/lib/file-source.js

@@ -0,0 +1,148 @@
+/**
+ * Filesystem-agnostic file access for compliance checks.
+ *
+ * Why: the CLI scans a real directory on disk; the VibeCode agent runs
+ * in a Cloudflare Worker (no node:fs) and holds files in a Map. Both
+ * call the same checks via this interface so rules stay in one place.
+ *
+ * Conventions:
+ *   - Paths are POSIX-style and relative to the repo root
+ *     (e.g. `web/src/App.tsx`).
+ *   - `read` returns null for missing files — checks decide whether
+ *     missing == fail or missing == not-applicable.
+ *   - `list()` already excludes noise dirs (.git, node_modules, dist,
+ *     etc.). Implementations are responsible for that filtering.
+ */
+import { readdir, readFile } from 'node:fs/promises';
+import { join, relative, sep } from 'node:path';
+const SKIP_DIRS = new Set(['.git', 'node_modules', 'dist', '.next', '.cache', '.wrangler', '.turbo']);
+/**
+ * Filesystem-backed FileSource — used by the CLI and CI. Walks the
+ * directory tree once on first list() iteration; uses node:fs for
+ * read/readBytes/listDir.
+ *
+ * Paths containing `..` segments are rejected — every read returns
+ * null. Defense in depth: today's checks only pass paths that came
+ * from `list()` (which stays inside the root), but a future buggy or
+ * malicious check could try `source.read('../etc/passwd')`. We refuse
+ * rather than letting `path.join` resolve outside repoDir.
+ */
+export function fsFileSource(repoDir) {
+    return {
+        async *list() {
+            yield* walk(repoDir, repoDir);
+        },
+        async read(path) {
+            if (hasTraversal(path))
+                return null;
+            try {
+                return await readFile(join(repoDir, path), 'utf8');
+            }
+            catch {
+                return null;
+            }
+        },
+        async readBytes(path) {
+            if (hasTraversal(path))
+                return null;
+            try {
+                const buf = await readFile(join(repoDir, path));
+                return new Uint8Array(buf);
+            }
+            catch {
+                return null;
+            }
+        },
+        async listDir(dir) {
+            if (hasTraversal(dir))
+                return null;
+            try {
+                return await readdir(join(repoDir, dir));
+            }
+            catch {
+                return null;
+            }
+        },
+    };
+}
+/** True if `path` contains a `..` segment or is absolute. */
+function hasTraversal(path) {
+    if (path.startsWith('/') || /^[a-zA-Z]:/.test(path))
+        return true; // absolute
+    return path.split(/[/\\]/).some((seg) => seg === '..');
+}
+async function* walk(dir, root) {
+    let entries;
+    try {
+        entries = await readdir(dir, { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    for (const entry of entries) {
+        const full = join(dir, entry.name);
+        if (entry.isDirectory()) {
+            if (SKIP_DIRS.has(entry.name))
+                continue;
+            yield* walk(full, root);
+        }
+        else if (entry.isFile()) {
+            // Always emit POSIX-style paths so checks can rely on consistent
+            // separators across platforms.
+            yield relative(root, full).split(sep).join('/');
+        }
+    }
+}
+/**
+ * Map-backed FileSource — used by the VibeCode agent (Workers env).
+ * The agent's session DO holds the virtual filesystem as a Map; this
+ * adapter exposes it through the same interface as the on-disk CLI.
+ *
+ * `readBytes` decodes the stored UTF-8 string back to bytes — fine for
+ * text-only checks. The agent has no built artefacts (it runs pre-
+ * deploy), so bundle-size will return its "not built yet" warn anyway.
+ *
+ * `listDir` synthesises directory listings from the Map keys.
+ */
+export function mapFileSource(files) {
+    return {
+        async *list() {
+            for (const path of files.keys()) {
+                if (isSkippedPath(path))
+                    continue;
+                yield path;
+            }
+        },
+        async read(path) {
+            return files.get(path) ?? null;
+        },
+        async readBytes(path) {
+            const text = files.get(path);
+            if (text === undefined)
+                return null;
+            return new TextEncoder().encode(text);
+        },
+        async listDir(dir) {
+            const prefix = dir.endsWith('/') ? dir : `${dir}/`;
+            const children = new Set();
+            let saw = false;
+            for (const path of files.keys()) {
+                if (!path.startsWith(prefix))
+                    continue;
+                saw = true;
+                const rest = path.slice(prefix.length);
+                const slash = rest.indexOf('/');
+                children.add(slash === -1 ? rest : rest.slice(0, slash));
+            }
+            return saw ? [...children] : null;
+        },
+    };
+}
+function isSkippedPath(path) {
+    for (const seg of path.split('/')) {
+        if (SKIP_DIRS.has(seg))
+            return true;
+    }
+    return false;
+}
+//# sourceMappingURL=file-source.js.map

package/dist/lib/file-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-source.js","sourceRoot":"","sources":["../../src/lib/file-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAehD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEtG;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,OAAO;QACL,KAAK,CAAC,CAAC,IAAI;YACT,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAChC,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,IAAI;YACb,IAAI,YAAY,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpC,IAAI,CAAC;gBACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;YACrD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,IAAI;YAClB,IAAI,YAAY,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;gBAChD,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;YAC7B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,GAAG;YACf,IAAI,YAAY,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnC,IAAI,CAAC;gBACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;YAC3C,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,6DAA6D;AAC7D,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,WAAW;IAC7E,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;AACzD,CAAC;AAED,KAAK,SAAS,CAAC,CAAC,IAAI,CAAC,GAAW,EAAE,IAAY;IAC5C,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAS;YACxC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC1B,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1B,iEAAiE;YACjE,+BAA+B;YAC/B,MAAM,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,KAA0B;IACtD,OAAO;QACL,KAAK,CAAC,CAAC,IAAI;YACT,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;gBAChC,IAAI,aAAa,CAAC,IAAI,CAAC;oBAAE,SAAS;gBAClC,MAAM,IAAI,CAAC;YACb,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,IAAI;YACb,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;QACjC,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,IAAI;YAClB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC7B,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACpC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxC,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,GAAG;YACf,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC;YACnD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;YACnC,IAAI,GAAG,GAAG,KAAK,CAAC;YAChB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;gBAChC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;oBAAE,SAAS;gBACvC,GAAG,GAAG,IAAI,CAAC;gBACX,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACvC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAChC,QAAQ,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;YAC3D,CAAC;YACD,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IACtC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/lib/gzip.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Gzip via the Web Streams API. Available in Node 18+ and Cloudflare
+ * Workers, so the same helper works in both the CLI's filesystem
+ * checks and the audit Worker's live checks. Avoids divergence
+ * between source-side and live measurements of bundle size.
+ */
+export declare function gzipByteLength(input: Uint8Array): Promise<number>;
+//# sourceMappingURL=gzip.d.ts.map

package/dist/lib/gzip.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gzip.d.ts","sourceRoot":"","sources":["../../src/lib/gzip.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBvE"}

package/dist/lib/gzip.js

@@ -0,0 +1,26 @@
+/**
+ * Gzip via the Web Streams API. Available in Node 18+ and Cloudflare
+ * Workers, so the same helper works in both the CLI's filesystem
+ * checks and the audit Worker's live checks. Avoids divergence
+ * between source-side and live measurements of bundle size.
+ */
+export async function gzipByteLength(input) {
+    const readable = new ReadableStream({
+        start(controller) {
+            controller.enqueue(input);
+            controller.close();
+        },
+    });
+    const compressed = readable.pipeThrough(new CompressionStream('gzip'));
+    const reader = compressed.getReader();
+    let total = 0;
+    for (;;) {
+        const { value, done } = await reader.read();
+        if (done)
+            break;
+        if (value)
+            total += value.byteLength;
+    }
+    return total;
+}
+//# sourceMappingURL=gzip.js.map

package/dist/lib/gzip.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gzip.js","sourceRoot":"","sources":["../../src/lib/gzip.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAiB;IACpD,MAAM,QAAQ,GAAG,IAAI,cAAc,CAAa;QAC9C,KAAK,CAAC,UAAU;YACd,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC1B,UAAU,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;KACF,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC;IACtC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,SAAS,CAAC;QACR,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,IAAI;YAAE,MAAM;QAChB,IAAI,KAAK;YAAE,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;IACvC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/lib/project-type.d.ts

@@ -0,0 +1,11 @@
+import type { FileSource } from './file-source.js';
+/**
+ * "Is this a game project?" — all projects in this repo are games,
+ * but the check remains for compatibility with shared check logic.
+ *
+ * Detection signals (any one is sufficient):
+ *   - `@freegamestore/games` listed in any package.json
+ *   - A TS/JS source file imports from `@freegamestore/games`
+ */
+export declare function isGameProject(source: FileSource): Promise<boolean>;
+//# sourceMappingURL=project-type.d.ts.map

package/dist/lib/project-type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-type.d.ts","sourceRoot":"","sources":["../../src/lib/project-type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD;;;;;;;GAOG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAaxE"}

package/dist/lib/project-type.js

@@ -0,0 +1,27 @@
+/**
+ * "Is this a game project?" — all projects in this repo are games,
+ * but the check remains for compatibility with shared check logic.
+ *
+ * Detection signals (any one is sufficient):
+ *   - `@freegamestore/games` listed in any package.json
+ *   - A TS/JS source file imports from `@freegamestore/games`
+ */
+export async function isGameProject(source) {
+    for await (const path of source.list()) {
+        const base = path.split('/').pop() ?? '';
+        if (base !== 'package.json')
+            continue;
+        const content = await source.read(path);
+        if (content && /@freegamestore\/games/.test(content))
+            return true;
+    }
+    for await (const path of source.list()) {
+        if (!path.endsWith('.ts') && !path.endsWith('.tsx'))
+            continue;
+        const content = await source.read(path);
+        if (content && /from\s+['"]@freegamestore\/games['"]/.test(content))
+            return true;
+    }
+    return false;
+}
+//# sourceMappingURL=project-type.js.map

package/dist/lib/project-type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-type.js","sourceRoot":"","sources":["../../src/lib/project-type.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAkB;IACpD,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;QACzC,IAAI,IAAI,KAAK,cAAc;YAAE,SAAS;QACtC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,OAAO,IAAI,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;IACpE,CAAC;IACD,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,SAAS;QAC9D,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,OAAO,IAAI,sCAAsC,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;IACnF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/live/index.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Live-URL audit checks. Unlike the file-walking checks in ../checks/,
+ * these run inside a Cloudflare Worker (no filesystem) against published
+ * apps' live URLs to catch post-publish drift.
+ *
+ * What we can check from a live URL:
+ *   - Tracking SDK injection (script src, inline scripts, fetched JS)
+ *   - Brand fonts presence (link href to fonts.googleapis.com)
+ *   - PWA manifest reachable + valid
+ *   - Main bundle size (HEAD request)
+ *
+ * What we CAN'T check post-publish:
+ *   - APPNAME placeholders (build erases these)
+ *   - Brand-override CSS variables (sourcemaps not always shipped)
+ *
+ * The audit Worker runs these on a weekly cron and stores per-app
+ * results in D1 so creators (or platform admins) can see drift over
+ * time without leaving the storefront.
+ */
+import type { CheckResult } from '../types.js';
+export interface LiveAuditInput {
+    appId: string;
+    liveUrl: string;
+}
+export interface LiveAuditReport {
+    appId: string;
+    liveUrl: string;
+    checkedAt: number;
+    reachable: boolean;
+    results: CheckResult[];
+}
+export declare function auditLive(input: LiveAuditInput): Promise<LiveAuditReport>;
+export declare function checkNoTrackingLive(html: string): CheckResult;
+export declare function checkBrandFontsLive(html: string): CheckResult;
+export declare function checkManifestLive(html: string, liveUrl: string): Promise<CheckResult>;
+export declare function checkBundleSizeLive(html: string, liveUrl: string): Promise<CheckResult>;
+/**
+ * Live counterpart to checkUnsafeVh. Fetches the first bundled
+ * stylesheet linked from the HTML and scans it for `100vh` (the
+ * unit, not the Tailwind class — by build time those have been
+ * compiled to CSS). Catches whiteboard-class iOS Safari URL-bar
+ * scroll bugs in apps that have already shipped.
+ *
+ * Cost: one extra subrequest per app. The audit Worker runs near the
+ * free-plan subrequest cap; on cap errors we degrade to `warn`
+ * (re-run needed) rather than `fail` (app broken) — the app isn't
+ * actually broken, the audit just couldn't check.
+ */
+export declare function checkUnsafeVhLive(html: string, liveUrl: string): Promise<CheckResult>;
+//# sourceMappingURL=index.d.ts.map

package/dist/live/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/live/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAc/C,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,WAAW,EAAE,CAAC;CACxB;AA2BD,wBAAsB,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CA2D/E;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAa7D;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAe7D;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CA8C3F;AAED,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAoD7F;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAgD3F"}

package/dist/live/index.js

@@ -0,0 +1,313 @@
+/**
+ * Live-URL audit checks. Unlike the file-walking checks in ../checks/,
+ * these run inside a Cloudflare Worker (no filesystem) against published
+ * apps' live URLs to catch post-publish drift.
+ *
+ * What we can check from a live URL:
+ *   - Tracking SDK injection (script src, inline scripts, fetched JS)
+ *   - Brand fonts presence (link href to fonts.googleapis.com)
+ *   - PWA manifest reachable + valid
+ *   - Main bundle size (HEAD request)
+ *
+ * What we CAN'T check post-publish:
+ *   - APPNAME placeholders (build erases these)
+ *   - Brand-override CSS variables (sourcemaps not always shipped)
+ *
+ * The audit Worker runs these on a weekly cron and stores per-app
+ * results in D1 so creators (or platform admins) can see drift over
+ * time without leaving the storefront.
+ */
+import { gzipByteLength } from '../lib/gzip.js';
+const TRACKER_PATTERNS = [
+    /google-analytics\.com/i,
+    /gtag\(/i,
+    /googletagmanager\.com/i,
+    /\bamplitude\b/i,
+    /\bmixpanel\b/i,
+    /\bsegment\.com\b/i,
+    /\bhotjar\.com\b/i,
+    /plausible\.io/i,
+    /posthog\.com/i,
+];
+/**
+ * Fetch with a timeout — Workers' default fetch waits 30s+, too slow
+ * when iterating 50+ apps in one cron tick.
+ */
+async function fetchWithTimeout(url, ms = 8000) {
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), ms);
+    try {
+        return await fetch(url, { signal: ctrl.signal, redirect: 'follow' });
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * Worker subrequest cap errors look like "Too many subrequests by
+ * single Worker invocation." We don't want to record those as "fail"
+ * verdicts because the app isn't actually broken — the audit just
+ * couldn't check. Detect and flag for the caller.
+ */
+function isSubrequestCapError(err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return /too many subrequests|subrequest.*limit/i.test(msg);
+}
+export async function auditLive(input) {
+    const checkedAt = Date.now();
+    const report = {
+        appId: input.appId,
+        liveUrl: input.liveUrl,
+        checkedAt,
+        reachable: false,
+        results: [],
+    };
+    let html;
+    try {
+        const res = await fetchWithTimeout(input.liveUrl);
+        if (!res.ok) {
+            report.results.push({
+                name: 'Reachable',
+                status: 'fail',
+                detail: `HTTP ${res.status} from ${input.liveUrl}`,
+            });
+            return report;
+        }
+        html = await res.text();
+        report.reachable = true;
+        // Always record a Reachable row on success — otherwise stale
+        // "Reachable: fail" rows from previous failed runs (e.g.
+        // subrequest-cap noise) never get overwritten, because the
+        // upsert is keyed on (app_id, check_name).
+        report.results.push({
+            name: 'Reachable',
+            status: 'pass',
+            detail: `${input.liveUrl} → HTTP ${res.status}`,
+        });
+    }
+    catch (err) {
+        // Subrequest cap means we couldn't even fetch — that's a "warn"
+        // (re-check needed), not a "fail" (app broken). Distinguishing
+        // matters: failures show red badges in the storefront.
+        const skipped = isSubrequestCapError(err);
+        report.results.push({
+            name: 'Reachable',
+            status: skipped ? 'warn' : 'fail',
+            detail: skipped
+                ? 'audit Worker hit subrequest cap — re-run needed'
+                : err instanceof Error
+                    ? err.message
+                    : 'fetch failed',
+        });
+        return report;
+    }
+    // Run all checks in parallel — each is independent.
+    const [tracking, fonts, manifest, bundle, vh] = await Promise.all([
+        checkNoTrackingLive(html),
+        checkBrandFontsLive(html),
+        checkManifestLive(html, input.liveUrl),
+        checkBundleSizeLive(html, input.liveUrl),
+        checkUnsafeVhLive(html, input.liveUrl),
+    ]);
+    report.results.push(tracking, fonts, manifest, bundle, vh);
+    return report;
+}
+export function checkNoTrackingLive(html) {
+    const found = TRACKER_PATTERNS.filter((re) => re.test(html));
+    if (found.length === 0) {
+        return { name: 'No tracking SDKs (live)', status: 'pass', detail: 'no known trackers in HTML' };
+    }
+    return {
+        name: 'No tracking SDKs (live)',
+        status: 'fail',
+        detail: `${found.length} pattern${found.length === 1 ? '' : 's'} matched`,
+        suggestions: [
+            'Tracking was injected after publish — remove the script tag or third-party loader.',
+        ],
+    };
+}
+export function checkBrandFontsLive(html) {
+    const hasManrope = /manrope/i.test(html);
+    const hasFraunces = /fraunces/i.test(html);
+    if (hasManrope && hasFraunces) {
+        return { name: 'Brand fonts (live)', status: 'pass', detail: 'Manrope + Fraunces referenced' };
+    }
+    const missing = [];
+    if (!hasManrope)
+        missing.push('Manrope');
+    if (!hasFraunces)
+        missing.push('Fraunces');
+    return {
+        name: 'Brand fonts (live)',
+        status: 'fail',
+        detail: `missing: ${missing.join(', ')}`,
+        suggestions: ['Restore the Google Fonts <link> in web/index.html.'],
+    };
+}
+export async function checkManifestLive(html, liveUrl) {
+    // Find the manifest link in the HTML, then fetch + validate it.
+    const m = /<link[^>]*rel=["']manifest["'][^>]*href=["']([^"']+)["']/i.exec(html);
+    if (!m) {
+        return {
+            name: 'PWA manifest (live)',
+            status: 'fail',
+            detail: 'no <link rel="manifest"> in HTML',
+        };
+    }
+    const href = m[1];
+    const manifestUrl = new URL(href, liveUrl).toString();
+    try {
+        const res = await fetchWithTimeout(manifestUrl);
+        if (!res.ok) {
+            return {
+                name: 'PWA manifest (live)',
+                status: 'fail',
+                detail: `${manifestUrl} → HTTP ${res.status}`,
+            };
+        }
+        const body = (await res.json());
+        const missing = [];
+        if (!body.name)
+            missing.push('name');
+        if (!body.display)
+            missing.push('display');
+        if (!body.start_url)
+            missing.push('start_url');
+        if (missing.length > 0) {
+            return {
+                name: 'PWA manifest (live)',
+                status: 'fail',
+                detail: `manifest missing fields: ${missing.join(', ')}`,
+            };
+        }
+        return { name: 'PWA manifest (live)', status: 'pass', detail: manifestUrl };
+    }
+    catch (err) {
+        const skipped = isSubrequestCapError(err);
+        return {
+            name: 'PWA manifest (live)',
+            status: skipped ? 'warn' : 'fail',
+            detail: skipped
+                ? 'audit Worker hit subrequest cap — re-run needed'
+                : err instanceof Error
+                    ? err.message
+                    : 'manifest fetch/parse failed',
+        };
+    }
+}
+export async function checkBundleSizeLive(html, liveUrl) {
+    // Find the largest-looking bundled JS reference. Vite output looks like
+    // src="/assets/index-XYZ.js" — starts with `/`, no chars before. Use
+    // `[^"']*` (zero or more) instead of `[^"']+` (one or more) so the
+    // root-relative path matches; with `+` every Vite app was misreported
+    // as "non-Vite layout" and the audit silently skipped bundle-size.
+    const m = /<script[^>]+src=["']([^"']*\/assets\/[^"']+\.js)["']/i.exec(html);
+    if (!m) {
+        // Plausible miss for non-Vite apps — not a fail, just skip.
+        return {
+            name: 'Bundle size (live)',
+            status: 'warn',
+            detail: 'no /assets/*.js found — non-Vite layout?',
+        };
+    }
+    const jsUrl = new URL(m[1], liveUrl).toString();
+    try {
+        const res = await fetchWithTimeout(jsUrl);
+        if (!res.ok) {
+            return { name: 'Bundle size (live)', status: 'fail', detail: `${jsUrl} → ${res.status}` };
+        }
+        const body = await res.arrayBuffer();
+        // Real gzip via the shared helper — same math the source-side
+        // check uses, so live and source verdicts can never disagree on
+        // a borderline app.
+        const rawKb = Math.round(body.byteLength / 1024);
+        const gzippedBytes = await gzipByteLength(new Uint8Array(body));
+        const gzipKb = Math.round(gzippedBytes / 1024);
+        if (gzipKb > 300) {
+            return {
+                name: 'Bundle size (live)',
+                status: 'fail',
+                detail: `${gzipKb} KB gzipped (raw ${rawKb} KB) — over 300 KB limit`,
+            };
+        }
+        return {
+            name: 'Bundle size (live)',
+            status: 'pass',
+            detail: `${gzipKb} KB gzipped (raw ${rawKb} KB)`,
+        };
+    }
+    catch (err) {
+        const skipped = isSubrequestCapError(err);
+        return {
+            name: 'Bundle size (live)',
+            status: 'warn',
+            detail: skipped
+                ? 'audit Worker hit subrequest cap — re-run needed'
+                : err instanceof Error
+                    ? err.message
+                    : 'bundle fetch failed',
+        };
+    }
+}
+/**
+ * Live counterpart to checkUnsafeVh. Fetches the first bundled
+ * stylesheet linked from the HTML and scans it for `100vh` (the
+ * unit, not the Tailwind class — by build time those have been
+ * compiled to CSS). Catches whiteboard-class iOS Safari URL-bar
+ * scroll bugs in apps that have already shipped.
+ *
+ * Cost: one extra subrequest per app. The audit Worker runs near the
+ * free-plan subrequest cap; on cap errors we degrade to `warn`
+ * (re-run needed) rather than `fail` (app broken) — the app isn't
+ * actually broken, the audit just couldn't check.
+ */
+export async function checkUnsafeVhLive(html, liveUrl) {
+    // Find the first bundled stylesheet. Vite output looks like
+    // <link rel="stylesheet" href="/assets/index-XYZ.css">. Be
+    // tolerant of attribute order — rel and href can appear either way.
+    const m = /<link[^>]+rel=["']stylesheet["'][^>]*href=["']([^"']+\.css[^"']*)["']/i.exec(html) ??
+        /<link[^>]+href=["']([^"']+\.css[^"']*)["'][^>]*rel=["']stylesheet["']/i.exec(html);
+    if (!m) {
+        // No stylesheet link — could be inline-only styles, or styles
+        // injected at runtime. Not a fail; just nothing to check.
+        return {
+            name: 'No unsafe 100vh (live)',
+            status: 'warn',
+            detail: 'no <link rel="stylesheet"> found in HTML — skipped',
+        };
+    }
+    const cssUrl = new URL(m[1], liveUrl).toString();
+    try {
+        const res = await fetchWithTimeout(cssUrl);
+        if (!res.ok) {
+            return { name: 'No unsafe 100vh (live)', status: 'warn', detail: `${cssUrl} → HTTP ${res.status}` };
+        }
+        const css = await res.text();
+        const matches = css.match(/\b100vh\b/g) ?? [];
+        if (matches.length === 0) {
+            return { name: 'No unsafe 100vh (live)', status: 'pass', detail: `scanned ${cssUrl}` };
+        }
+        return {
+            name: 'No unsafe 100vh (live)',
+            status: 'warn',
+            detail: `${matches.length} occurrence(s) of 100vh in ${cssUrl}`,
+            suggestions: [
+                '100vh resolves to the layout viewport on iOS Safari — when the URL bar is visible the page scrolls.',
+                'Replace with 100svh (small viewport — accounts for visible browser UI) or 100dvh (dynamic — recomputes as URL bar moves).',
+            ],
+        };
+    }
+    catch (err) {
+        const skipped = isSubrequestCapError(err);
+        return {
+            name: 'No unsafe 100vh (live)',
+            status: 'warn',
+            detail: skipped
+                ? 'audit Worker hit subrequest cap — re-run needed'
+                : err instanceof Error
+                    ? err.message
+                    : 'CSS fetch failed',
+        };
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/live/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/live/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAGhD,MAAM,gBAAgB,GAAG;IACvB,wBAAwB;IACxB,SAAS;IACT,wBAAwB;IACxB,gBAAgB;IAChB,eAAe;IACf,mBAAmB;IACnB,kBAAkB;IAClB,gBAAgB;IAChB,eAAe;CAChB,CAAC;AAeF;;;GAGG;AACH,KAAK,UAAU,gBAAgB,CAAC,GAAW,EAAE,EAAE,GAAG,IAAI;IACpD,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IACjD,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACvE,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,GAAY;IACxC,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7D,OAAO,yCAAyC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAqB;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAoB;QAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS;QACT,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,EAAE;KACZ,CAAC;IAEF,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;gBAClB,IAAI,EAAE,WAAW;gBACjB,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,QAAQ,GAAG,CAAC,MAAM,SAAS,KAAK,CAAC,OAAO,EAAE;aACnD,CAAC,CAAC;YACH,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC;QACxB,6DAA6D;QAC7D,yDAAyD;QACzD,2DAA2D;QAC3D,2CAA2C;QAC3C,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;YAClB,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,WAAW,GAAG,CAAC,MAAM,EAAE;SAChD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,gEAAgE;QAChE,+DAA+D;QAC/D,uDAAuD;QACvD,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;YAClB,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YACjC,MAAM,EAAE,OAAO;gBACb,CAAC,CAAC,iDAAiD;gBACnD,CAAC,CAAC,GAAG,YAAY,KAAK;oBACpB,CAAC,CAAC,GAAG,CAAC,OAAO;oBACb,CAAC,CAAC,cAAc;SACrB,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,oDAAoD;IACpD,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAChE,mBAAmB,CAAC,IAAI,CAAC;QACzB,mBAAmB,CAAC,IAAI,CAAC;QACzB,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC;QACtC,mBAAmB,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC;QACxC,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC;KACvC,CAAC,CAAC;IACH,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IAC3D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,MAAM,KAAK,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,IAAI,EAAE,yBAAyB,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IAClG,CAAC;IACD,OAAO;QACL,IAAI,EAAE,yBAAyB;QAC/B,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,WAAW,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,UAAU;QACzE,WAAW,EAAE;YACX,oFAAoF;SACrF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,UAAU,IAAI,WAAW,EAAE,CAAC;QAC9B,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;IACjG,CAAC;IACD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,UAAU;QAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,WAAW;QAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3C,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,YAAY,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACxC,WAAW,EAAE,CAAC,oDAAoD,CAAC;KACpE,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAY,EAAE,OAAe;IACnE,gEAAgE;IAChE,MAAM,CAAC,GAAG,2DAA2D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjF,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,OAAO;YACL,IAAI,EAAE,qBAAqB;YAC3B,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,kCAAkC;SAC3C,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IACnB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO;gBACL,IAAI,EAAE,qBAAqB;gBAC3B,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,GAAG,WAAW,WAAW,GAAG,CAAC,MAAM,EAAE;aAC9C,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4D,CAAC;QAC3F,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC/C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO;gBACL,IAAI,EAAE,qBAAqB;gBAC3B,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,4BAA4B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aACzD,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC9E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC1C,OAAO;YACL,IAAI,EAAE,qBAAqB;YAC3B,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YACjC,MAAM,EAAE,OAAO;gBACb,CAAC,CAAC,iDAAiD;gBACnD,CAAC,CAAC,GAAG,YAAY,KAAK;oBACpB,CAAC,CAAC,GAAG,CAAC,OAAO;oBACb,CAAC,CAAC,6BAA6B;SACpC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAY,EAAE,OAAe;IACrE,wEAAwE;IACxE,qEAAqE;IACrE,mEAAmE;IACnE,sEAAsE;IACtE,mEAAmE;IACnE,MAAM,CAAC,GAAG,uDAAuD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7E,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,4DAA4D;QAC5D,OAAO;YACL,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,0CAA0C;SACnD,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,MAAM,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;QAC5F,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC;QACrC,8DAA8D;QAC9D,gEAAgE;QAChE,oBAAoB;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;QACjD,MAAM,YAAY,GAAG,MAAM,cAAc,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;QAC/C,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;YACjB,OAAO;gBACL,IAAI,EAAE,oBAAoB;gBAC1B,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,GAAG,MAAM,oBAAoB,KAAK,0BAA0B;aACrE,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,GAAG,MAAM,oBAAoB,KAAK,MAAM;SACjD,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC1C,OAAO;YACL,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,OAAO;gBACb,CAAC,CAAC,iDAAiD;gBACnD,CAAC,CAAC,GAAG,YAAY,KAAK;oBACpB,CAAC,CAAC,GAAG,CAAC,OAAO;oBACb,CAAC,CAAC,qBAAqB;SAC5B,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAY,EAAE,OAAe;IACnE,4DAA4D;IAC5D,2DAA2D;IAC3D,oEAAoE;IACpE,MAAM,CAAC,GACL,wEAAwE,CAAC,IAAI,CAAC,IAAI,CAAC;QACnF,wEAAwE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtF,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,8DAA8D;QAC9D,0DAA0D;QAC1D,OAAO;YACL,IAAI,EAAE,wBAAwB;YAC9B,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,oDAAoD;SAC7D,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,EAAE,IAAI,EAAE,wBAAwB,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;QACtG,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAC9C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,IAAI,EAAE,wBAAwB,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,MAAM,EAAE,EAAE,CAAC;QACzF,CAAC;QACD,OAAO;YACL,IAAI,EAAE,wBAAwB;YAC9B,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,8BAA8B,MAAM,EAAE;YAC/D,WAAW,EAAE;gBACX,qGAAqG;gBACrG,2HAA2H;aAC5H;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC1C,OAAO;YACL,IAAI,EAAE,wBAAwB;YAC9B,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,OAAO;gBACb,CAAC,CAAC,iDAAiD;gBACnD,CAAC,CAAC,GAAG,YAAY,KAAK;oBACpB,CAAC,CAAC,GAAG,CAAC,OAAO;oBACb,CAAC,CAAC,kBAAkB;SACzB,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,12 @@
+export type CheckStatus = 'pass' | 'warn' | 'fail';
+export interface CheckResult {
+    /** Short human-readable name. */
+    name: string;
+    /** pass | warn | fail. fail is a hard gate; warn is informational. */
+    status: CheckStatus;
+    /** One-line context (file path, count, current value). */
+    detail: string;
+    /** Optional actionable advice for fixing a fail/warn. */
+    suggestions?: string[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAEnD,MAAM,WAAW,WAAW;IAC1B,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,MAAM,EAAE,WAAW,CAAC;IACpB,0DAA0D;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}