@freegamestore/compliance 0.7.0 → 0.8.0

package/README.md

@@ -17,7 +17,7 @@ for (const r of results) {
 | Name | What it checks | Status on fail |
 |---|---|---|
 | `No template placeholders` | No file still contains `APPNAME` | **fail** |
-| `No tracking SDKs` | No reference to google-analytics / gtag / amplitude / mixpanel / segment / hotjar / plausible / posthog | **fail** |
+| `Analytics routed through platform loader` | No direct install of google-analytics / gtag / amplitude / mixpanel / segment / hotjar / plausible / posthog — analytics must flow through `api.freegamestore.online/v1/analytics.js?app=<id>` | **fail** |
 | `Brand fonts present` | Manrope + Fraunces referenced in CSS or HTML | **fail** |
 | `PWA manifest` | `web/public/manifest.json` exists and has name / short_name / start_url / display | warn |
 | `Bundle size` | Largest JS in `web/dist/assets/` is ≤ 300 KB gzipped | **fail** if too big; warn if not built yet |

package/dist/checks/deploy-workflow.d.ts

@@ -0,0 +1,16 @@
+import type { FileSource } from '../lib/file-source.js';
+import type { CheckResult } from '../types.js';
+/**
+ * Games auto-deploy to R2 via GitHub Actions on push to main. Without
+ * `.github/workflows/deploy.yml`, pushes won't trigger a deploy and
+ * the game stays stale on the storefront.
+ *
+ * Simple existence check — the deploy workflow template is provided
+ * by `fgs create` and rarely needs customisation.
+ *
+ * WARN level — some games might use an alternative deploy mechanism
+ * (e.g. deploy.yaml, a different workflow name, or manual deploys
+ * during early development).
+ */
+export declare function checkDeployWorkflow(source: FileSource): Promise<CheckResult>;
+//# sourceMappingURL=deploy-workflow.d.ts.map

package/dist/checks/deploy-workflow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-workflow.d.ts","sourceRoot":"","sources":["../../src/checks/deploy-workflow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAI/C;;;;;;;;;;;GAWG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAoBlF"}

package/dist/checks/deploy-workflow.js

@@ -0,0 +1,33 @@
+const DEPLOY_YML = '.github/workflows/deploy.yml';
+/**
+ * Games auto-deploy to R2 via GitHub Actions on push to main. Without
+ * `.github/workflows/deploy.yml`, pushes won't trigger a deploy and
+ * the game stays stale on the storefront.
+ *
+ * Simple existence check — the deploy workflow template is provided
+ * by `fgs create` and rarely needs customisation.
+ *
+ * WARN level — some games might use an alternative deploy mechanism
+ * (e.g. deploy.yaml, a different workflow name, or manual deploys
+ * during early development).
+ */
+export async function checkDeployWorkflow(source) {
+    const content = await source.read(DEPLOY_YML);
+    if (content !== null) {
+        return {
+            name: 'Deploy workflow',
+            status: 'pass',
+            detail: `${DEPLOY_YML} exists`,
+        };
+    }
+    return {
+        name: 'Deploy workflow',
+        status: 'warn',
+        detail: `${DEPLOY_YML} not found`,
+        suggestions: [
+            'Add a deploy workflow so pushes to main auto-deploy to the storefront.',
+            'Run `fgs create` to scaffold a game with the standard deploy workflow, or copy one from an existing game repo.',
+        ],
+    };
+}
+//# sourceMappingURL=deploy-workflow.js.map

package/dist/checks/deploy-workflow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-workflow.js","sourceRoot":"","sources":["../../src/checks/deploy-workflow.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,GAAG,8BAA8B,CAAC;AAElD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAAkB;IAC1D,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAE9C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,GAAG,UAAU,SAAS;SAC/B,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,GAAG,UAAU,YAAY;QACjC,WAAW,EAAE;YACX,wEAAwE;YACxE,gHAAgH;SACjH;KACF,CAAC;AACJ,CAAC"}

package/dist/checks/game-naming.d.ts

@@ -0,0 +1,4 @@
+import type { FileSource } from '../lib/file-source.js';
+import type { CheckResult } from '../types.js';
+export declare function checkGameNaming(source: FileSource): Promise<CheckResult>;
+//# sourceMappingURL=game-naming.d.ts.map

package/dist/checks/game-naming.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"game-naming.d.ts","sourceRoot":"","sources":["../../src/checks/game-naming.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AA2D/C,wBAAsB,eAAe,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAuD9E"}

package/dist/checks/game-naming.js

@@ -0,0 +1,98 @@
+/**
+ * Validates game naming conventions from the platform guidelines:
+ *
+ *   - Package name should be lowercase
+ *   - Should not start with "free" or "pro" (reserved platform prefixes)
+ *   - Should not contain spaces or special characters (beyond hyphens)
+ *   - If CLAUDE.md exists, the subdomain should match the expected
+ *     pattern (`gamename.freegamestore.online`)
+ *
+ * Checks both root `package.json` and `web/package.json`. WARN level —
+ * a bad name won't break the build, but it will cause issues at publish
+ * time when the admin Worker derives the subdomain and repo name.
+ */
+const RESERVED_PREFIXES = ['free', 'pro'];
+function checkName(name, source) {
+    const issues = [];
+    if (name !== name.toLowerCase()) {
+        issues.push({
+            field: source,
+            value: name,
+            problem: 'package name should be lowercase',
+        });
+    }
+    for (const prefix of RESERVED_PREFIXES) {
+        if (name.toLowerCase().startsWith(prefix)) {
+            issues.push({
+                field: source,
+                value: name,
+                problem: `"${prefix}" is a reserved platform prefix`,
+            });
+            break;
+        }
+    }
+    // Allow lowercase letters, digits, hyphens, and npm scoped names (@scope/name).
+    // Reject spaces and other special characters.
+    if (/[^a-z0-9\-@/.]/.test(name)) {
+        issues.push({
+            field: source,
+            value: name,
+            problem: 'contains spaces or special characters',
+        });
+    }
+    return issues;
+}
+export async function checkGameNaming(source) {
+    const issues = [];
+    // Only check web/package.json for naming conventions. The root
+    // package.json name often follows CF Pages project naming (e.g.
+    // "freechessapp") which legitimately uses the "free" prefix — that's
+    // the platform's naming scheme, not the game developer's choice.
+    const webRaw = await source.read('web/package.json');
+    if (webRaw) {
+        try {
+            const webPkg = JSON.parse(webRaw);
+            if (typeof webPkg.name === 'string') {
+                issues.push(...checkName(webPkg.name, 'web/package.json name'));
+            }
+        }
+        catch {
+            // invalid JSON — other checks will flag this
+        }
+    }
+    // Check CLAUDE.md for subdomain pattern consistency
+    const claudeMd = await source.read('CLAUDE.md');
+    if (claudeMd) {
+        const subdomainMatch = claudeMd.match(/([a-z0-9-]+)\.freegamestore\.online/);
+        if (subdomainMatch) {
+            const subdomain = subdomainMatch[1];
+            // The subdomain should be a clean slug — no underscores, no uppercase
+            if (/[^a-z0-9-]/.test(subdomain)) {
+                issues.push({
+                    field: 'CLAUDE.md subdomain',
+                    value: `${subdomain}.freegamestore.online`,
+                    problem: 'subdomain should only contain lowercase letters, digits, and hyphens',
+                });
+            }
+        }
+    }
+    if (issues.length === 0) {
+        return {
+            name: 'Game naming conventions',
+            status: 'pass',
+            detail: 'package names follow platform naming conventions',
+        };
+    }
+    return {
+        name: 'Game naming conventions',
+        status: 'warn',
+        detail: issues
+            .map((i) => `${i.field}: "${i.value}" — ${i.problem}`)
+            .join('; '),
+        suggestions: [
+            'Package names should be lowercase, hyphen-separated, without reserved prefixes (free*, pro*).',
+            'The publish flow derives the subdomain and GitHub repo name from the package name — clean names prevent issues.',
+        ],
+    };
+}
+//# sourceMappingURL=game-naming.js.map

package/dist/checks/game-naming.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"game-naming.js","sourceRoot":"","sources":["../../src/checks/game-naming.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;GAYG;AAEH,MAAM,iBAAiB,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAQ1C,SAAS,SAAS,CAAC,IAAY,EAAE,MAAc;IAC7C,MAAM,MAAM,GAAkB,EAAE,CAAC;IAEjC,IAAI,IAAI,KAAK,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,MAAM;YACb,KAAK,EAAE,IAAI;YACX,OAAO,EAAE,kCAAkC;SAC5C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,iBAAiB,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1C,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,MAAM;gBACb,KAAK,EAAE,IAAI;gBACX,OAAO,EAAE,IAAI,MAAM,iCAAiC;aACrD,CAAC,CAAC;YACH,MAAM;QACR,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,8CAA8C;IAC9C,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,MAAM;YACb,KAAK,EAAE,IAAI;YACX,OAAO,EAAE,uCAAuC;SACjD,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAkB;IACtD,MAAM,MAAM,GAAkB,EAAE,CAAC;IAEjC,+DAA+D;IAC/D,gEAAgE;IAChE,qEAAqE;IACrE,iEAAiE;IACjE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACrD,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACpC,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,6CAA6C;QAC/C,CAAC;IACH,CAAC;IAED,oDAAoD;IACpD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAChD,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,cAAc,GAAG,QAAQ,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;QAC7E,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,SAAS,GAAG,cAAc,CAAC,CAAC,CAAE,CAAC;YACrC,sEAAsE;YACtE,IAAI,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBACjC,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,qBAAqB;oBAC5B,KAAK,EAAE,GAAG,SAAS,uBAAuB;oBAC1C,OAAO,EAAE,sEAAsE;iBAChF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO;YACL,IAAI,EAAE,yBAAyB;YAC/B,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,kDAAkD;SAC3D,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,yBAAyB;QAC/B,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,MAAM;aACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC;aACrD,IAAI,CAAC,IAAI,CAAC;QACb,WAAW,EAAE;YACX,+FAA+F;YAC/F,iHAAiH;SAClH;KACF,CAAC;AACJ,CAAC"}

package/dist/checks/gitignore-complete.d.ts

@@ -0,0 +1,4 @@
+import type { FileSource } from '../lib/file-source.js';
+import type { CheckResult } from '../types.js';
+export declare function checkGitignoreComplete(source: FileSource): Promise<CheckResult>;
+//# sourceMappingURL=gitignore-complete.d.ts.map

package/dist/checks/gitignore-complete.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitignore-complete.d.ts","sourceRoot":"","sources":["../../src/checks/gitignore-complete.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAoC/C,wBAAsB,sBAAsB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAwCrF"}

package/dist/checks/gitignore-complete.js

@@ -0,0 +1,51 @@
+const REQUIRED = [
+    {
+        name: 'node_modules',
+        test: (line) => /^node_modules\/?$/.test(line) || line === '**/node_modules',
+    },
+    {
+        name: 'dist',
+        test: (line) => /^dist\/?$/.test(line) || /^web\/dist\/?$/.test(line) || line === '**/dist',
+    },
+    {
+        name: '.env',
+        test: (line) => /^\.env/.test(line),
+    },
+];
+export async function checkGitignoreComplete(source) {
+    const raw = await source.read('.gitignore');
+    if (raw === null) {
+        return {
+            name: 'Gitignore complete',
+            status: 'warn',
+            detail: 'no .gitignore file at repo root',
+            suggestions: [
+                'Add a .gitignore that covers at least: node_modules, dist, .env.',
+                'Run `fgs create` to scaffold a game with a standard .gitignore.',
+            ],
+        };
+    }
+    // Parse non-empty, non-comment lines.
+    const lines = raw
+        .split('\n')
+        .map((l) => l.trim())
+        .filter((l) => l.length > 0 && !l.startsWith('#'));
+    const missing = REQUIRED.filter((req) => !lines.some((line) => req.test(line)));
+    if (missing.length === 0) {
+        return {
+            name: 'Gitignore complete',
+            status: 'pass',
+            detail: '.gitignore covers node_modules, dist, and .env',
+        };
+    }
+    return {
+        name: 'Gitignore complete',
+        status: 'warn',
+        detail: `.gitignore is missing patterns for: ${missing.map((m) => m.name).join(', ')}`,
+        suggestions: [
+            `Add the missing patterns to .gitignore: ${missing.map((m) => m.name).join(', ')}.`,
+            'These prevent build artefacts, dependencies, or secrets from being committed.',
+        ],
+    };
+}
+//# sourceMappingURL=gitignore-complete.js.map

package/dist/checks/gitignore-complete.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitignore-complete.js","sourceRoot":"","sources":["../../src/checks/gitignore-complete.ts"],"names":[],"mappings":"AAqBA,MAAM,QAAQ,GAAsB;IAClC;QACE,IAAI,EAAE,cAAc;QACpB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,iBAAiB;KAC7E;IACD;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CACb,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,SAAS;KAC9E;IACD;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;KACpC;CACF,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,MAAkB;IAC7D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAE5C,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,OAAO;YACL,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,iCAAiC;YACzC,WAAW,EAAE;gBACX,kEAAkE;gBAClE,iEAAiE;aAClE;SACF,CAAC;IACJ,CAAC;IAED,sCAAsC;IACtC,MAAM,KAAK,GAAG,GAAG;SACd,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAErD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAEhF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,gDAAgD;SACzD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,uCAAuC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACtF,WAAW,EAAE;YACX,2CAA2C,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YACnF,+EAA+E;SAChF;KACF,CAAC;AACJ,CAAC"}

package/dist/checks/no-any-types.d.ts

@@ -0,0 +1,4 @@
+import type { FileSource } from '../lib/file-source.js';
+import type { CheckResult } from '../types.js';
+export declare function checkNoAnyTypes(source: FileSource): Promise<CheckResult>;
+//# sourceMappingURL=no-any-types.d.ts.map

package/dist/checks/no-any-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-any-types.d.ts","sourceRoot":"","sources":["../../src/checks/no-any-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AA+B/C,wBAAsB,eAAe,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CA4C9E"}

package/dist/checks/no-any-types.js

@@ -0,0 +1,72 @@
+import { stripCommentsAndStrings } from '../lib/strip.js';
+/**
+ * Flags explicit `any` type annotations in game source files. Both
+ * `: any` (parameter/return type) and `as any` (type assertion) are
+ * counted — both are escape hatches that weaken type safety.
+ *
+ * This is a WARN, not a hard fail. Some third-party lib compat genuinely
+ * requires `as any`, and the occasional `: any` parameter in an event
+ * handler is pragmatic. The goal is visibility: developers should know
+ * how many escape hatches they're carrying.
+ *
+ * Exclusions:
+ *   - `web/src/test/` — test helpers often use loose typing
+ *   - `web/src/types.ts` — type definition files may have legitimate `any`
+ */
+const SCAN_EXTS = new Set(['.ts', '.tsx']);
+function extOf(path) {
+    const dot = path.lastIndexOf('.');
+    const slash = path.lastIndexOf('/');
+    return dot > slash ? path.slice(dot).toLowerCase() : '';
+}
+function isExcluded(path) {
+    if (path.startsWith('web/src/test/'))
+        return true;
+    if (path === 'web/src/types.ts')
+        return true;
+    return false;
+}
+export async function checkNoAnyTypes(source) {
+    let totalCount = 0;
+    const hitFiles = [];
+    for await (const path of source.list()) {
+        if (!path.startsWith('web/src/'))
+            continue;
+        if (!SCAN_EXTS.has(extOf(path)))
+            continue;
+        if (isExcluded(path))
+            continue;
+        const raw = await source.read(path);
+        if (!raw)
+            continue;
+        // Strip comments AND strings — `: any` inside a string literal
+        // (e.g. a log message like 'cast to any') is not a real annotation.
+        const stripped = stripCommentsAndStrings(raw);
+        // Match `: any` (type annotation) and `as any` (type assertion).
+        // Word boundaries prevent matching `canary`, `anyString`, etc.
+        const matches = stripped.match(/(?::\s*any|as\s+any)\b/g);
+        if (matches && matches.length > 0) {
+            totalCount += matches.length;
+            hitFiles.push(path);
+        }
+    }
+    if (totalCount === 0) {
+        return {
+            name: 'No explicit any types',
+            status: 'pass',
+            detail: 'no `: any` or `as any` found in web/src/',
+        };
+    }
+    return {
+        name: 'No explicit any types',
+        status: 'warn',
+        detail: `${totalCount} \`any\` usage(s) across ${hitFiles.length} file(s): ${hitFiles
+            .slice(0, 5)
+            .join(', ')}${hitFiles.length > 5 ? '...' : ''}`,
+        suggestions: [
+            'Replace `: any` with a specific type or `unknown` where the shape is genuinely unpredictable.',
+            '`as any` type assertions can often be replaced with `as unknown as TargetType` for safer narrowing.',
+        ],
+    };
+}
+//# sourceMappingURL=no-any-types.js.map

package/dist/checks/no-any-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-any-types.js","sourceRoot":"","sources":["../../src/checks/no-any-types.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAG1D;;;;;;;;;;;;;GAaG;AAEH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAE3C,SAAS,KAAK,CAAC,IAAY;IACzB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,OAAO,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,IAAI,KAAK,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAkB;IACtD,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,SAAS;QAC3C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAAE,SAAS;QAC1C,IAAI,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QAE/B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG;YAAE,SAAS;QAEnB,+DAA+D;QAC/D,oEAAoE;QACpE,MAAM,QAAQ,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;QAE9C,iEAAiE;QACjE,+DAA+D;QAC/D,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC1D,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClC,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC;YAC7B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO;YACL,IAAI,EAAE,uBAAuB;YAC7B,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,0CAA0C;SACnD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,uBAAuB;QAC7B,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,GAAG,UAAU,4BAA4B,QAAQ,CAAC,MAAM,aAAa,QAAQ;aAClF,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;aACX,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;QAClD,WAAW,EAAE;YACX,+FAA+F;YAC/F,qGAAqG;SACtG;KACF,CAAC;AACJ,CAAC"}

package/dist/checks/no-console-log.d.ts

@@ -0,0 +1,4 @@
+import type { FileSource } from '../lib/file-source.js';
+import type { CheckResult } from '../types.js';
+export declare function checkNoConsoleLog(source: FileSource): Promise<CheckResult>;
+//# sourceMappingURL=no-console-log.d.ts.map

package/dist/checks/no-console-log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-console-log.d.ts","sourceRoot":"","sources":["../../src/checks/no-console-log.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAyB/C,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CA0ChF"}

package/dist/checks/no-console-log.js

@@ -0,0 +1,63 @@
+import { stripCommentsAndStrings } from '../lib/strip.js';
+/**
+ * Flags `console.log()` calls in game source files. Production games
+ * should not ship with debug logging — it clutters the browser console
+ * and can leak internal state to curious players.
+ *
+ * `console.error` and `console.warn` are deliberately excluded — those
+ * are legitimate runtime diagnostics that help in production debugging.
+ *
+ * WARN level. Not a hard fail — some games log performance stats or
+ * frame timing intentionally. The goal is visibility.
+ *
+ * Exclusions:
+ *   - `web/src/test/` — test files may log freely
+ */
+const SCAN_EXTS = new Set(['.ts', '.tsx']);
+function extOf(path) {
+    const dot = path.lastIndexOf('.');
+    const slash = path.lastIndexOf('/');
+    return dot > slash ? path.slice(dot).toLowerCase() : '';
+}
+export async function checkNoConsoleLog(source) {
+    let totalCount = 0;
+    const hitFiles = [];
+    for await (const path of source.list()) {
+        if (!path.startsWith('web/src/'))
+            continue;
+        if (path.startsWith('web/src/test/'))
+            continue;
+        if (!SCAN_EXTS.has(extOf(path)))
+            continue;
+        const raw = await source.read(path);
+        if (!raw)
+            continue;
+        // Strip comments and strings so we don't flag console.log inside
+        // a comment or a string literal like 'use console.log for debug'.
+        const stripped = stripCommentsAndStrings(raw);
+        const matches = stripped.match(/\bconsole\.log\s*\(/g);
+        if (matches && matches.length > 0) {
+            totalCount += matches.length;
+            hitFiles.push(path);
+        }
+    }
+    if (totalCount === 0) {
+        return {
+            name: 'No console.log',
+            status: 'pass',
+            detail: 'no console.log() calls found in web/src/',
+        };
+    }
+    return {
+        name: 'No console.log',
+        status: 'warn',
+        detail: `${totalCount} console.log() call(s) across ${hitFiles.length} file(s): ${hitFiles
+            .slice(0, 5)
+            .join(', ')}${hitFiles.length > 5 ? '...' : ''}`,
+        suggestions: [
+            'Remove debug logging before publishing. Use console.error or console.warn for runtime diagnostics that should stay.',
+            'If the logging is intentional (e.g. performance stats), consider gating it behind a DEBUG flag.',
+        ],
+    };
+}
+//# sourceMappingURL=no-console-log.js.map

package/dist/checks/no-console-log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-console-log.js","sourceRoot":"","sources":["../../src/checks/no-console-log.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAG1D;;;;;;;;;;;;;GAaG;AAEH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAE3C,SAAS,KAAK,CAAC,IAAY;IACzB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,OAAO,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAkB;IACxD,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,SAAS;QAC3C,IAAI,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;YAAE,SAAS;QAC/C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAAE,SAAS;QAE1C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG;YAAE,SAAS;QAEnB,iEAAiE;QACjE,kEAAkE;QAClE,MAAM,QAAQ,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;QAE9C,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACvD,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClC,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC;YAC7B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO;YACL,IAAI,EAAE,gBAAgB;YACtB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,0CAA0C;SACnD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,GAAG,UAAU,iCAAiC,QAAQ,CAAC,MAAM,aAAa,QAAQ;aACvF,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;aACX,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;QAClD,WAAW,EAAE;YACX,qHAAqH;YACrH,iGAAiG;SAClG;KACF,CAAC;AACJ,CAAC"}

package/dist/checks/no-cookies.d.ts

@@ -0,0 +1,13 @@
+import type { FileSource } from '../lib/file-source.js';
+import type { CheckResult } from '../types.js';
+/**
+ * All player data must stay in localStorage (or the platform KV SDK).
+ * Cookies are not allowed — they leak data to servers on every request
+ * and conflict with the cookieless analytics mandate.
+ *
+ * Scans source files for `document.cookie`, js-cookie, cookie-parser,
+ * and `Cookies.set`/`Cookies.get` patterns. Comments are stripped
+ * before scanning to avoid false positives from documentation.
+ */
+export declare function checkNoCookies(source: FileSource): Promise<CheckResult>;
+//# sourceMappingURL=no-cookies.d.ts.map

package/dist/checks/no-cookies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-cookies.d.ts","sourceRoot":"","sources":["../../src/checks/no-cookies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAiB/C;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAmC7E"}

package/dist/checks/no-cookies.js

@@ -0,0 +1,64 @@
+import { stripCommentsForExt } from '../lib/strip.js';
+// Patterns that indicate cookie usage — either the native DOM API or
+// popular helper libraries. Each pattern is SDK-specific enough to avoid
+// false positives against bare English words.
+const COOKIE_PATTERNS = [
+    { name: 'document.cookie', pattern: /\bdocument\s*\.\s*cookie\b/i },
+    { name: 'js-cookie', pattern: /from\s+['"]js-cookie['"]/i },
+    { name: 'js-cookie (require)', pattern: /require\(['"]js-cookie['"]\)/i },
+    { name: 'cookie-parser', pattern: /from\s+['"]cookie-parser['"]/i },
+    { name: 'cookie-parser (require)', pattern: /require\(['"]cookie-parser['"]\)/i },
+    { name: 'Cookies.set', pattern: /\bCookies\s*\.\s*set\s*\(/i },
+    { name: 'Cookies.get', pattern: /\bCookies\s*\.\s*get\s*\(/i },
+];
+const SCAN_EXTS = new Set(['.ts', '.tsx', '.js', '.jsx', '.html']);
+/**
+ * All player data must stay in localStorage (or the platform KV SDK).
+ * Cookies are not allowed — they leak data to servers on every request
+ * and conflict with the cookieless analytics mandate.
+ *
+ * Scans source files for `document.cookie`, js-cookie, cookie-parser,
+ * and `Cookies.set`/`Cookies.get` patterns. Comments are stripped
+ * before scanning to avoid false positives from documentation.
+ */
+export async function checkNoCookies(source) {
+    const hits = [];
+    for await (const path of source.list()) {
+        const ext = extOf(path);
+        if (!SCAN_EXTS.has(ext))
+            continue;
+        const raw = await source.read(path);
+        if (!raw)
+            continue;
+        const content = stripCommentsForExt(raw, ext);
+        const matches = COOKIE_PATTERNS.filter((p) => p.pattern.test(content)).map((p) => p.name);
+        if (matches.length > 0) {
+            hits.push({ file: path, matches });
+        }
+    }
+    if (hits.length === 0) {
+        return {
+            name: 'No cookies',
+            status: 'pass',
+            detail: 'no cookie usage found — player data stays in localStorage',
+        };
+    }
+    return {
+        name: 'No cookies',
+        status: 'fail',
+        detail: `${hits.length} file(s) use cookies: ${hits
+            .slice(0, 3)
+            .map((h) => `${h.file} (${h.matches.join(', ')})`)
+            .join('; ')}${hits.length > 3 ? '...' : ''}`,
+        suggestions: [
+            'Replace cookie usage with localStorage or the platform KV SDK (@freegamestore/games provides app.kv for per-user storage).',
+            'Cookies leak data to servers on every request and conflict with the platform cookieless analytics mandate.',
+        ],
+    };
+}
+function extOf(path) {
+    const dot = path.lastIndexOf('.');
+    const slash = path.lastIndexOf('/');
+    return dot > slash ? path.slice(dot).toLowerCase() : '';
+}
+//# sourceMappingURL=no-cookies.js.map

package/dist/checks/no-cookies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-cookies.js","sourceRoot":"","sources":["../../src/checks/no-cookies.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAGtD,qEAAqE;AACrE,yEAAyE;AACzE,8CAA8C;AAC9C,MAAM,eAAe,GAAwC;IAC3D,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,6BAA6B,EAAE;IACnE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,2BAA2B,EAAE;IAC3D,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,+BAA+B,EAAE;IACzE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,+BAA+B,EAAE;IACnE,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,mCAAmC,EAAE;IACjF,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,4BAA4B,EAAE;IAC9D,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,4BAA4B,EAAE;CAC/D,CAAC;AAEF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAEnE;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAkB;IACrD,MAAM,IAAI,GAA0C,EAAE,CAAC;IAEvD,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAClC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1F,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,IAAI,EAAE,YAAY;YAClB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,2DAA2D;SACpE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,yBAAyB,IAAI;aAChD,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;aACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;aACjD,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;QAC9C,WAAW,EAAE;YACX,4HAA4H;YAC5H,4GAA4G;SAC7G;KACF,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,IAAY;IACzB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,OAAO,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1D,CAAC"}

package/dist/checks/no-excessive-inline-styles.d.ts

@@ -0,0 +1,4 @@
+import type { FileSource } from '../lib/file-source.js';
+import type { CheckResult } from '../types.js';
+export declare function checkNoExcessiveInlineStyles(source: FileSource): Promise<CheckResult>;
+//# sourceMappingURL=no-excessive-inline-styles.d.ts.map

package/dist/checks/no-excessive-inline-styles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-excessive-inline-styles.d.ts","sourceRoot":"","sources":["../../src/checks/no-excessive-inline-styles.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAiC/C,wBAAsB,4BAA4B,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CA2D3F"}

package/dist/checks/no-excessive-inline-styles.js

@@ -0,0 +1,82 @@
+import { stripCommentsAndStrings } from '../lib/strip.js';
+/**
+ * Flags excessive use of React inline style objects (`style={{ ... }}`)
+ * in TSX files under web/src/. Some inline styles are fine — dynamic
+ * values, canvas positioning, animation transforms. But heavy reliance
+ * on `style={{` means the game isn't leveraging Tailwind CSS or the
+ * design system, making theming and dark mode harder.
+ *
+ * Thresholds:
+ *   - Any single file with > 15 inline style objects → warn
+ *   - Total across all TSX files > 30 → warn
+ *
+ * Strips comments before scanning. Excludes test files.
+ *
+ * WARN level — guidelines, not a hard gate.
+ */
+const PER_FILE_THRESHOLD = 15;
+const TOTAL_THRESHOLD = 30;
+const INLINE_STYLE_RE = /\bstyle\s*=\s*\{\{/g;
+function extOf(path) {
+    const dot = path.lastIndexOf('.');
+    const slash = path.lastIndexOf('/');
+    return dot > slash ? path.slice(dot).toLowerCase() : '';
+}
+function isTestFile(path) {
+    return /\.(?:test|spec)\.[jt]sx?$/.test(path) || /(?:^|\/)(?:test|tests|__tests__)\//.test(path);
+}
+export async function checkNoExcessiveInlineStyles(source) {
+    let totalCount = 0;
+    const heavyFiles = [];
+    let fileCount = 0;
+    for await (const path of source.list()) {
+        if (!path.startsWith('web/src/'))
+            continue;
+        if (extOf(path) !== '.tsx')
+            continue;
+        if (isTestFile(path))
+            continue;
+        const raw = await source.read(path);
+        if (!raw)
+            continue;
+        const stripped = stripCommentsAndStrings(raw);
+        const matches = stripped.match(INLINE_STYLE_RE);
+        const count = matches ? matches.length : 0;
+        if (count > 0) {
+            totalCount += count;
+            fileCount++;
+            if (count > PER_FILE_THRESHOLD) {
+                heavyFiles.push({ file: path, count });
+            }
+        }
+    }
+    const perFileViolation = heavyFiles.length > 0;
+    const totalViolation = totalCount > TOTAL_THRESHOLD;
+    if (!perFileViolation && !totalViolation) {
+        return {
+            name: 'No excessive inline styles',
+            status: 'pass',
+            detail: `${totalCount} inline style(s) across ${fileCount} TSX file(s) (thresholds: ${PER_FILE_THRESHOLD}/file, ${TOTAL_THRESHOLD} total)`,
+        };
+    }
+    const parts = [];
+    if (totalViolation) {
+        parts.push(`${totalCount} total inline styles (threshold: ${TOTAL_THRESHOLD})`);
+    }
+    if (perFileViolation) {
+        parts.push(`${heavyFiles.length} file(s) exceed ${PER_FILE_THRESHOLD}/file: ${heavyFiles
+            .slice(0, 3)
+            .map((h) => `${h.file} (${h.count})`)
+            .join(', ')}${heavyFiles.length > 3 ? '...' : ''}`);
+    }
+    return {
+        name: 'No excessive inline styles',
+        status: 'warn',
+        detail: parts.join('; '),
+        suggestions: [
+            'Replace inline style objects with Tailwind CSS utility classes where possible.',
+            'Keep inline styles for truly dynamic values (e.g. computed positions, animation transforms).',
+        ],
+    };
+}
+//# sourceMappingURL=no-excessive-inline-styles.js.map

package/dist/checks/no-excessive-inline-styles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-excessive-inline-styles.js","sourceRoot":"","sources":["../../src/checks/no-excessive-inline-styles.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAG1D;;;;;;;;;;;;;;GAcG;AAEH,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,MAAM,eAAe,GAAG,EAAE,CAAC;AAE3B,MAAM,eAAe,GAAG,qBAAqB,CAAC;AAE9C,SAAS,KAAK,CAAC,IAAY;IACzB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,OAAO,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,oCAAoC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,MAAkB;IACnE,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,MAAM,UAAU,GAAsC,EAAE,CAAC;IACzD,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,SAAS;QAC3C,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM;YAAE,SAAS;QACrC,IAAI,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QAE/B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG;YAAE,SAAS;QAEnB,MAAM,QAAQ,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAE3C,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,UAAU,IAAI,KAAK,CAAC;YACpB,SAAS,EAAE,CAAC;YACZ,IAAI,KAAK,GAAG,kBAAkB,EAAE,CAAC;gBAC/B,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,gBAAgB,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;IAC/C,MAAM,cAAc,GAAG,UAAU,GAAG,eAAe,CAAC;IAEpD,IAAI,CAAC,gBAAgB,IAAI,CAAC,cAAc,EAAE,CAAC;QACzC,OAAO;YACL,IAAI,EAAE,4BAA4B;YAClC,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,GAAG,UAAU,2BAA2B,SAAS,6BAA6B,kBAAkB,UAAU,eAAe,SAAS;SAC3I,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,cAAc,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,GAAG,UAAU,oCAAoC,eAAe,GAAG,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,gBAAgB,EAAE,CAAC;QACrB,KAAK,CAAC,IAAI,CACR,GAAG,UAAU,CAAC,MAAM,mBAAmB,kBAAkB,UAAU,UAAU;aAC1E,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;aACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC;aACpC,IAAI,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CACrD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,4BAA4B;QAClC,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;QACxB,WAAW,EAAE;YACX,gFAAgF;YAChF,8FAA8F;SAC/F;KACF,CAAC;AACJ,CAAC"}

package/dist/checks/no-external-fetch.d.ts

@@ -0,0 +1,4 @@
+import type { FileSource } from '../lib/file-source.js';
+import type { CheckResult } from '../types.js';
+export declare function checkNoExternalFetch(source: FileSource): Promise<CheckResult>;
+//# sourceMappingURL=no-external-fetch.d.ts.map

package/dist/checks/no-external-fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-external-fetch.d.ts","sourceRoot":"","sources":["../../src/checks/no-external-fetch.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAmD/C,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CA4DnF"}