@iterant/site-runtime 3.0.2

package/scripts/scan-copy.mjs

@@ -0,0 +1,204 @@
+#!/usr/bin/env node
+// @ts-check
+/**
+ * Scan component code for hardcoded visible copy.
+ *
+ * The project convention (AGENTS.md "Content") is that no visible string
+ * lives in TSX — copy comes from JSON entries via typed props. This scanner
+ * finds violations with the TypeScript AST (not grep — class strings,
+ * imports and icon names would drown a text search):
+ *
+ *   - JSX text nodes containing letters:      <h1>Pricing plans</h1>
+ *   - String-literal JSX expression children: <h1>{"Pricing plans"}</h1>
+ *   - Prose-looking string attributes:        aria-label="Close menu"
+ *     (multi-word values starting with an uppercase letter; code-bearing
+ *     attributes like className/href/src are exempt)
+ *   - Literal search terms in string transforms:
+ *       heading.replace("agentssss", "agents")
+ *     A transform's operands come from entry fields, never TSX literals —
+ *     a lettered literal here rewrites copy at render time, so the entry,
+ *     the editor, and the rendered page disagree (typo masking, hardcoded
+ *     highlight targets). Letterless separators (.replace(" ", "<br/>"),
+ *     .replace(/\s+/g, "-")) stay legal.
+ *
+ * Output: one `file:line: "text"` per finding, empty on a clean tree.
+ * Always exits 0 — the caller decides severity (the platform save gate
+ * reports findings as warnings).
+ */
+
+import { readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import ts from "typescript";
+
+const ROOTS = ["src/components", "src/pages"];
+const MAX_FINDINGS = 20;
+
+// Attributes whose values are code/config, never copy.
+const CODE_ATTRIBUTES = new Set([
+  "className",
+  "class",
+  "id",
+  "key",
+  "href",
+  "src",
+  "srcSet",
+  "sizes",
+  "target",
+  "rel",
+  "type",
+  "name",
+  "value",
+  "loading",
+  "decoding",
+  "width",
+  "height",
+  "viewBox",
+  "fill",
+  "stroke",
+  "strokeWidth",
+  "strokeLinecap",
+  "strokeLinejoin",
+  "d",
+  "points",
+  "xmlns",
+  "style",
+  "lang",
+  "dir",
+  "role",
+  "method",
+  "action",
+  "autoComplete",
+  "inputMode",
+]);
+
+/** @param {string} dir @returns {string[]} */
+function tsxFiles(dir) {
+  /** @type {string[]} */
+  const out = [];
+  let entries;
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return out;
+  }
+  for (const entry of entries) {
+    const path = join(dir, entry.name);
+    if (entry.isDirectory()) out.push(...tsxFiles(path));
+    else if (entry.name.endsWith(".tsx")) out.push(path);
+  }
+  return out;
+}
+
+/** @param {string} text */
+function hasLetters(text) {
+  // HTML entities (&ldquo; &amp;) are punctuation, not copy.
+  return /[a-zA-Z]{2,}/.test(text.replace(/&#?[a-zA-Z0-9]+;/g, ""));
+}
+
+/** Prose heuristic for attribute values: multi-word, uppercase start. */
+/** @param {string} text */
+function looksLikeProse(text) {
+  return /^[A-Z].*\s\S/.test(text.trim());
+}
+
+/**
+ * Lettered literal search operand of .replace()/.replaceAll(). Legitimate
+ * operands are entry-field references (identifiers, member access) — a
+ * lettered literal rewrites copy at render time. Returns the literal text,
+ * or undefined when the argument is not one.
+ * @param {ts.Node} arg @returns {string | undefined}
+ */
+function literalSearchTerm(arg) {
+  if (ts.isStringLiteral(arg) || ts.isNoSubstitutionTemplateLiteral(arg)) {
+    return hasLetters(arg.text) ? arg.text : undefined;
+  }
+  if (ts.isRegularExpressionLiteral(arg)) {
+    // /pattern/flags — flags are single letters; strip before testing.
+    const pattern = arg.text.replace(/\/[a-z]*$/, "").slice(1);
+    return hasLetters(pattern) ? pattern : undefined;
+  }
+  return undefined;
+}
+
+/** @type {string[]} */
+const findings = [];
+
+/** @param {ts.SourceFile} source @param {ts.Node} node @param {string} text */
+function report(source, node, text) {
+  const { line } = source.getLineAndCharacterOfPosition(node.getStart(source));
+  const preview = text.trim().replace(/\s+/g, " ").slice(0, 60);
+  findings.push(`${source.fileName}:${line + 1}: "${preview}"`);
+}
+
+/** @param {ts.SourceFile} source */
+function scan(source) {
+  /** @param {ts.Node} node */
+  const visit = (node) => {
+    if (ts.isJsxText(node)) {
+      if (hasLetters(node.text)) report(source, node, node.text);
+    } else if (
+      ts.isJsxExpression(node) &&
+      node.expression &&
+      (ts.isStringLiteral(node.expression) ||
+        ts.isNoSubstitutionTemplateLiteral(node.expression)) &&
+      node.parent &&
+      (ts.isJsxElement(node.parent) || ts.isJsxFragment(node.parent)) &&
+      hasLetters(node.expression.text)
+    ) {
+      report(source, node, node.expression.text);
+    } else if (
+      ts.isJsxAttribute(node) &&
+      node.initializer &&
+      ts.isStringLiteral(node.initializer) &&
+      !CODE_ATTRIBUTES.has(node.name.getText(source)) &&
+      !node.name.getText(source).startsWith("data-") &&
+      !node.name.getText(source).startsWith("aria-hidden") &&
+      looksLikeProse(node.initializer.text)
+    ) {
+      report(source, node, node.initializer.text);
+    } else if (
+      ts.isCallExpression(node) &&
+      ts.isPropertyAccessExpression(node.expression) &&
+      /^replace(All)?$/.test(node.expression.name.text) &&
+      node.arguments.length > 0
+    ) {
+      const term = literalSearchTerm(node.arguments[0]);
+      if (term !== undefined) {
+        const shown = term.length > 12 ? `${term.slice(0, 12)}…` : term;
+        report(
+          source,
+          node.arguments[0],
+          `.replace("${shown}") — term must be an entry field`,
+        );
+      }
+    }
+    ts.forEachChild(node, visit);
+  };
+  visit(source);
+}
+
+// With file arguments, scan exactly those files (the platform's builder
+// gate scans one just-written component); with none, walk ROOTS.
+const argFiles = process.argv.slice(2);
+const files =
+  argFiles.length > 0 ? argFiles : ROOTS.flatMap((root) => tsxFiles(root));
+
+for (const file of files) {
+  {
+    const source = ts.createSourceFile(
+      file,
+      readFileSync(file, "utf8"),
+      ts.ScriptTarget.Latest,
+      true,
+      ts.ScriptKind.TSX,
+    );
+    scan(source);
+  }
+}
+
+if (findings.length > 0) {
+  for (const finding of findings.slice(0, MAX_FINDINGS)) console.log(finding);
+  if (findings.length > MAX_FINDINGS) {
+    console.log(`… and ${findings.length - MAX_FINDINGS} more`);
+  }
+}

package/scripts/scan-island-imports.mjs

@@ -0,0 +1,207 @@
+#!/usr/bin/env node
+// @ts-check
+/**
+ * Island-import gate. Registered sections are server-rendered, never
+ * hydrated — the registry map cannot trace client:* directives, so an
+ * island-grade ui primitive imported from src/components/sections/ renders
+ * a DEAD widget with zero build signal. The grade of each primitive lives
+ * in src/components/ui/index.ts (UI_PRIMITIVE_GRADES); this gate fails the
+ * build when any file under src/components/sections/ imports an
+ * island-grade module from src/components/ui/.
+ *
+ * Caught (verify fails):
+ *   - direct module imports, alias or relative at any depth:
+ *     "@/components/ui/tabs", "../ui/carousel", "../../ui/tabs"
+ *   - barrel imports that name an island primitive:
+ *     import { Tabs } from "@/components/ui"  (the barrel re-exports them;
+ *     the import is resolved to names, so { Accordion } via barrel passes)
+ *   - namespace/star imports of the barrel or an island module
+ *     (import * as UI / export * — can't prove islands go unused)
+ *
+ * Ignored (no false positive):
+ *   - `import type { ... }` and specifier lists that are all `type X`
+ *     (erased at build — no runtime dependency, no dead widget)
+ *
+ * KNOWN LIMITATION — transitive imports are out of scope: a section that
+ * imports a helper module which itself imports an island primitive is NOT
+ * caught. Tracing the full module graph belongs to a bundler, not a regex
+ * gate; the helper indirection is rare and reviewable. If it bites, the
+ * fix is the same as for a direct import: move the section to a bespoke
+ * page with a page-private component.
+ *
+ * Runs inside `bun run verify` (imported by scripts/verify.mjs) and
+ * standalone: `node scripts/scan-island-imports.mjs [rootDir]`.
+ */
+
+import { readdir, readFile } from "node:fs/promises";
+import { basename, dirname, join, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+
+/**
+ * import/export-from statements, single or multi line:
+ *   import <clause> from "<spec>"    export <clause> from "<spec>"
+ * m[1] keyword, m[2] clause (may start with `type`), m[3] spec.
+ */
+const IMPORT_FROM_PATTERN =
+  /(?:^|[\n;])\s*(import|export)\s+([\s\S]*?)\s*from\s+["']([^"']+)["']/g;
+
+/**
+ * What a clause actually binds at runtime after TS erasure.
+ *
+ * @param {string} clause
+ * @returns {{ erased: boolean; namespace: boolean; names: string[] }}
+ */
+function parseClause(clause) {
+  const trimmed = clause.trim();
+  // `import type { ... }` / `export type { ... }` / `import type * as ns`
+  if (/^type[\s{]/.test(trimmed)) {
+    return { erased: true, namespace: false, names: [] };
+  }
+  const namespace = trimmed.includes("*");
+  const braces = trimmed.match(/\{([^}]*)\}/);
+  const names = braces
+    ? braces[1]
+        .split(",")
+        .map((s) => s.trim())
+        .filter(Boolean)
+        .filter((s) => !/^type\s/.test(s))
+        .map((s) => s.split(/\s+as\s+/)[0].trim())
+    : [];
+  const hasDefault = /^[A-Za-z_$][\w$]*\s*(,|$)/.test(trimmed);
+  // `import { type Foo } from ...` with no value bindings is erased too.
+  const erased =
+    !namespace && !hasDefault && braces !== null && names.length === 0;
+  return { erased, namespace, names };
+}
+
+/**
+ * Resolve an import specifier to an absolute, extensionless path — or null
+ * for bare package specifiers.
+ *
+ * @param {string} spec
+ * @param {string} fromFile absolute path of the importing file
+ * @param {string} srcDir absolute path of <root>/src (the `@/` alias target)
+ */
+function resolveSpec(spec, fromFile, srcDir) {
+  let abs = null;
+  if (spec.startsWith("@/")) abs = join(srcDir, spec.slice(2));
+  else if (spec.startsWith(".")) abs = resolve(dirname(fromFile), spec);
+  if (abs === null) return null;
+  return abs.replace(/\.(tsx|ts|jsx|js|mjs)$/, "");
+}
+
+/**
+ * @param {string} rootDir project root (contains src/)
+ * @returns {Promise<string[]>} human-readable problems, empty when clean
+ */
+export async function checkIslandImports(rootDir = process.cwd()) {
+  /** @type {string[]} */
+  const problems = [];
+  const srcDir = join(rootDir, "src");
+  const uiDir = join(srcDir, "components", "ui");
+
+  // Parse the grade manifest ("<name>: \"island\"") from the ui barrel.
+  let manifest = "";
+  try {
+    manifest = await readFile(join(uiDir, "index.ts"), "utf8");
+  } catch {
+    return problems; // no ui barrel — nothing to gate
+  }
+  const islands = new Set(
+    [...manifest.matchAll(/(\w+):\s*"island"/g)].map((m) => m[1]),
+  );
+  if (islands.size === 0) return problems;
+
+  // Resolve which of the barrel's re-exported NAMES are island-grade, so a
+  // barrel import is judged by what it binds, not by the path alone.
+  const islandNames = new Set();
+  for (const m of manifest.matchAll(
+    /export\s+(type\s+)?\{([^}]*)\}\s+from\s+["']\.\/([\w-]+)["']/g,
+  )) {
+    if (m[1] || !islands.has(m[3])) continue;
+    for (const spec of m[2].split(",")) {
+      const s = spec.trim();
+      if (!s || /^type\s/.test(s)) continue;
+      // exported name is the alias when present: `X as Y` exports Y
+      const parts = s.split(/\s+as\s+/);
+      islandNames.add(parts[parts.length - 1].trim());
+    }
+  }
+
+  const fix =
+    `Registered sections are server-rendered and never hydrate, so this widget would be dead on the page. ` +
+    `Move the section to a bespoke page ("mode": "bespoke" in the entry) with a page-private component under src/components/pages/<page>/, or use an ssr-grade primitive.`;
+
+  const sectionsDir = join(srcDir, "components", "sections");
+  /** @param {string} dir */
+  async function walk(dir) {
+    /** @type {import("node:fs").Dirent[]} */
+    let entries = [];
+    try {
+      entries = await readdir(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const path = join(dir, entry.name);
+      if (entry.isDirectory()) {
+        await walk(path);
+        continue;
+      }
+      if (!/\.(tsx|ts)$/.test(entry.name)) continue;
+      const content = await readFile(path, "utf8");
+      for (const match of content.matchAll(IMPORT_FROM_PATTERN)) {
+        const clause = parseClause(match[2]);
+        if (clause.erased) continue; // type-only: gone at build time
+        const resolved = resolveSpec(match[3], path, srcDir);
+        if (resolved === null) continue;
+
+        if (resolved === uiDir || resolved === join(uiDir, "index")) {
+          // Barrel import: judge by the bound names.
+          if (clause.namespace) {
+            problems.push(
+              `${path}: namespace-imports the ui barrel ("${match[3]}"), which re-exports island-grade primitives. ` +
+                `Import the ssr-grade primitives you need by name instead. ${fix}`,
+            );
+            continue;
+          }
+          const bad = clause.names.filter((n) => islandNames.has(n));
+          if (bad.length > 0) {
+            problems.push(
+              `${path}: imports the island-grade ui primitive(s) ${bad.map((n) => `"${n}"`).join(", ")} via the ui barrel ("${match[3]}"). ${fix}`,
+            );
+          }
+          continue;
+        }
+
+        if (dirname(resolved) === uiDir) {
+          const module = basename(resolved);
+          if (islands.has(module)) {
+            problems.push(
+              `${path}: imports the island-grade ui primitive "${module}". ${fix}`,
+            );
+          }
+        }
+      }
+    }
+  }
+  await walk(sectionsDir);
+  return problems;
+}
+
+// Standalone CLI: `node scripts/scan-island-imports.mjs [rootDir]`.
+// Prints problems to stderr and exits 1 when any are found.
+if (
+  process.argv[1] &&
+  import.meta.url === pathToFileURL(resolve(process.argv[1])).href
+) {
+  const problems = await checkIslandImports(
+    process.argv[2] ? resolve(process.argv[2]) : process.cwd(),
+  );
+  if (problems.length > 0) {
+    process.stderr.write(
+      `island-import check failed:\n${problems.join("\n")}\n`,
+    );
+    process.exit(1);
+  }
+}

package/scripts/verify.mjs

@@ -0,0 +1,283 @@
+#!/usr/bin/env node
+// @ts-check
+/**
+ * Verify the project compiles and builds cleanly.
+ *
+ * Runs `astro check` followed by `astro build`. Designed to be called by
+ * agents, CI, or humans — the output rules are the same either way:
+ *
+ *   - No ANSI escape codes in the final output. We set NO_COLOR=1 and
+ *     FORCE_COLOR=0 so anything that honors those (astro CLI, vite, tsc,
+ *     rollup) emits plain text. We *also* strip ANSI post-hoc from the
+ *     captured buffer, because @astrojs/check's diagnostic formatter
+ *     bypasses NO_COLOR and TTY detection and writes raw SGR codes
+ *     regardless. Belt-and-suspenders on purpose.
+ *
+ *   - stdout and stderr are captured into one buffer, roughly interleaved
+ *     as they arrive. Astro writes diagnostics to stderr and progress to
+ *     stdout; a caller who only reads one stream gets half the story and
+ *     has to retry with `2>&1`.
+ *
+ *   - Silent on success, verbose on failure. A successful verify exits 0
+ *     and prints nothing (not even a trailing newline). A failed verify
+ *     prints the full captured output of the step that failed, then
+ *     exits with that step's exit code. Saves tokens in agent tool
+ *     results and puts the useful output front-and-center.
+ *
+ * Run from the repo root via `bun run verify` / `npm run verify` (which map to
+ * `site-runtime verify`). Every path below resolves against process.cwd(), the
+ * repo being verified — the gates themselves live in node_modules.
+ */
+
+import { spawn } from "node:child_process";
+import { delimiter, join } from "node:path";
+import { exit } from "node:process";
+import { fileURLToPath } from "node:url";
+
+/**
+ * A sibling gate's absolute path, wherever the package is installed.
+ * @param {string} name
+ */
+const gate = (name) => fileURLToPath(new URL(name, import.meta.url));
+
+const env = {
+  ...process.env,
+  // The repo's own binaries (astro, eslint) resolve by name. Package-manager
+  // `run` scripts already put node_modules/.bin on PATH; prepending it here
+  // means a direct `site-runtime verify` invocation works the same way.
+  PATH: [
+    join(process.cwd(), "node_modules", ".bin"),
+    process.env.PATH ?? "",
+  ].join(delimiter),
+  // Disable ANSI at the source for anything that honors these. astro CLI,
+  // vite, tsc, rollup all do. @astrojs/check's diagnostic formatter does
+  // not — that's handled by stripAnsi() below.
+  NO_COLOR: "1",
+  FORCE_COLOR: "0",
+  // CI=1 makes some tools pick their non-interactive, non-TTY code paths
+  // (no spinners, no progress bars, no prompts).
+  CI: "1",
+};
+
+// CSI + simple ESC sequences. Covers SGR colors (\x1b[...m), cursor moves,
+// and OSC hyperlinks — enough to clean any terminal output that leaks
+// through despite NO_COLOR.
+const ANSI_PATTERN =
+  // eslint-disable-next-line no-control-regex
+  /\x1B(?:[@-Z\\-_]|\[[0-?]*[ -/]*[@-~]|\][^\x07\x1B]*(?:\x07|\x1B\\))/g;
+
+/** @param {string} text */
+function stripAnsi(text) {
+  return text.replace(ANSI_PATTERN, "");
+}
+
+/**
+ * Spawn a command, capture stdout+stderr together, resolve with exit code
+ * and combined buffer. Preserves interleaving as best as Node's stream
+ * events allow — good enough for human and LLM reading.
+ *
+ * @param {string} cmd
+ * @param {string[]} args
+ * @returns {Promise<{ code: number; output: string }>}
+ */
+function run(cmd, args) {
+  return new Promise((resolve) => {
+    const proc = spawn(cmd, args, {
+      env,
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+
+    let output = "";
+    proc.stdout.on("data", (chunk) => {
+      output += chunk.toString();
+    });
+    proc.stderr.on("data", (chunk) => {
+      output += chunk.toString();
+    });
+
+    proc.on("error", (err) => {
+      resolve({ code: 1, output: `${output}\n${err.message}` });
+    });
+    proc.on("close", (code) => {
+      resolve({ code: code ?? 1, output });
+    });
+  });
+}
+
+/**
+ * Font integrity gate. Corrupt font binaries fail SILENTLY at runtime:
+ * the build is green, but the browser's OTS sanitizer rejects the file and
+ * every affected element falls back to the default serif — the site ships
+ * looking broken with zero build signal. (Learned the hard way: a woff2
+ * scraped off a live site declared 61375 bytes in its header but was 90034
+ * bytes on disk.) Fonts must come from @fontsource packages, never copied
+ * from crawled sites.
+ *
+ * Checks every public/fonts/*.woff2: WOFF2 magic + header totalSize ===
+ * actual byte length. Also verifies each local url(...) in a globals.css
+ * @font-face resolves to a file under public/.
+ */
+async function checkFonts() {
+  const { readdir, readFile, stat } = await import("node:fs/promises");
+  const { join } = await import("node:path");
+  const problems = [];
+
+  const fontsDir = join(process.cwd(), "public", "fonts");
+  /** @type {string[]} */
+  let entries = [];
+  try {
+    entries = await readdir(fontsDir);
+  } catch {
+    /* no fonts dir — nothing to check */
+  }
+  for (const name of entries.filter((n) => n.endsWith(".woff2"))) {
+    const path = join(fontsDir, name);
+    const buf = await readFile(path);
+    if (buf.length < 12 || buf.toString("latin1", 0, 4) !== "wOF2") {
+      problems.push(`public/fonts/${name}: not a WOFF2 file`);
+      continue;
+    }
+    const declared = buf.readUInt32BE(8);
+    if (declared !== buf.length) {
+      problems.push(
+        `public/fonts/${name}: corrupt — WOFF2 header declares ${declared} bytes, file is ${buf.length}. ` +
+          `Browsers will reject it and text falls back to default serif. ` +
+          `Replace it with the same font from an @fontsource package.`,
+      );
+    }
+  }
+
+  try {
+    const css = await readFile(
+      join(process.cwd(), "src", "styles", "globals.css"),
+      "utf8",
+    );
+    for (const match of css.matchAll(/url\("(\/[^")]+\.woff2?)"\)/g)) {
+      const rel = match[1];
+      const target = join(process.cwd(), "public", rel.slice(1));
+      const exists = await stat(target).then(
+        () => true,
+        () => false,
+      );
+      if (!exists) {
+        problems.push(
+          `globals.css references ${rel} but public${rel} does not exist`,
+        );
+      }
+    }
+  } catch {
+    /* globals.css missing is astro check's problem, not ours */
+  }
+
+  return problems;
+}
+
+const fontProblems = await checkFonts();
+if (fontProblems.length > 0) {
+  process.stderr.write(
+    `font integrity check failed:\n${fontProblems.join("\n")}\n`,
+  );
+  exit(1);
+}
+
+// Island-import gate — registered sections never hydrate, so an island-grade
+// ui primitive imported there ships a dead widget with zero build signal.
+// The check (direct + barrel + any-depth relative imports; type-only imports
+// exempt; transitive imports a documented limitation) lives in
+// scan-island-imports.mjs so its tests can exercise it on fixtures.
+const { checkIslandImports } = await import("./scan-island-imports.mjs");
+const islandProblems = await checkIslandImports(process.cwd());
+if (islandProblems.length > 0) {
+  process.stderr.write(
+    `island-import check failed:\n${islandProblems.join("\n")}\n`,
+  );
+  exit(1);
+}
+
+/** @type {Array<[string, string[]]>} */
+const steps = [
+  ["eslint", ["."]],
+  ["astro", ["check"]],
+  // The repo's own unit tests (bun:test). The content grammar's own suite ships
+  // with this package; what runs here is whatever the brand repo keeps under
+  // src/. bun is the project runner (see CI + bun.lock).
+  ["bun", ["test", "src"]],
+  ["astro", ["build"]],
+  // Bespoke-sibling hydration gate (2.10.0): asserts, against the fresh dist/,
+  // that every non-draft bespoke page satisfies the two conventions its
+  // locale siblings hydrate through, and pins the Astro runtime directive
+  // contract they rely on. Both failure modes are silent at runtime.
+  [process.execPath, [gate("scan-bespoke-siblings.mjs")]],
+];
+
+for (const [cmd, args] of steps) {
+  const { code, output } = await run(cmd, args);
+  if (code !== 0) {
+    // Failure: write the buffer (minus ANSI) to STDERR, then exit with
+    // the step's code. stderr is the right channel for diagnostics, and
+    // it's also the stream that `bun run` / sandbox bash executors tend
+    // to surface on non-zero exit — so the caller actually sees it.
+    process.stderr.write(stripAnsi(output));
+    exit(code);
+  }
+}
+
+/**
+ * Editor-bytes gate. The visual editor is dev-only — injected by
+ * integrations/visual-editor-dev.mjs under `astro dev`, with the vendored
+ * bundle living in vendor/ (NOT public/) — so a production build must
+ * contain ZERO editor bytes. Markers cover the bundle name, its serving
+ * URL, the runtime's log prefix, and its CSS class namespace.
+ */
+async function checkEditorBytes() {
+  const { readdir, readFile } = await import("node:fs/promises");
+  const { join } = await import("node:path");
+  const markers = [
+    "visual-editor.iife",
+    "__visual-editor",
+    "[VisualEditor]",
+    "__ve-",
+  ];
+  /** @type {string[]} */
+  const problems = [];
+
+  /** @param {string} dir */
+  async function walk(dir) {
+    /** @type {import("node:fs").Dirent[]} */
+    let entries = [];
+    try {
+      entries = await readdir(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const path = join(dir, entry.name);
+      if (entry.isDirectory()) {
+        await walk(path);
+        continue;
+      }
+      const content = await readFile(path, "latin1");
+      for (const marker of markers) {
+        if (content.includes(marker)) {
+          problems.push(
+            `${path}: contains editor marker "${marker}" — the visual editor is dev-only and must never ship in a build`,
+          );
+        }
+      }
+    }
+  }
+
+  await walk(join(process.cwd(), "dist"));
+  return problems;
+}
+
+const editorProblems = await checkEditorBytes();
+if (editorProblems.length > 0) {
+  process.stderr.write(
+    `editor-bytes check failed:\n${editorProblems.join("\n")}\n`,
+  );
+  exit(1);
+}
+
+// Success: exit silently. Nothing to print.
+exit(0);