@lernapps/tooling 0.0.1 → 0.1.0

package/check/validation-report.v1.schema.json

@@ -0,0 +1,116 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://lernapps.net/tooling/schemas/validation-report.v1.schema.json",
+  "title": "Validation report of lernapps check, version 1",
+  "description": "What `lernapps check` checked and found, as YAML: on standard output when a check fails, and always in the file of `--report <file>`. The same input gives the same report. A breaking change gets a new version of this schema.",
+  "type": "object",
+  "properties": {
+    "checked": {
+      "description": "What was checked: the commit of a repo (or its directory outside git), a bundle directory, or a URL and the time it was checked.",
+      "oneOf": [
+        {
+          "type": "object",
+          "properties": { "commit": { "type": "string", "pattern": "^[0-9a-f]{40}$" } },
+          "required": ["commit"],
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "properties": { "directory": { "type": "string", "minLength": 1 } },
+          "required": ["directory"],
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "properties": { "bundle": { "type": "string", "minLength": 1 } },
+          "required": ["bundle"],
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "properties": {
+            "url": { "type": "string", "minLength": 1 },
+            "at": { "type": "string", "description": "ISO 8601 time of the check" }
+          },
+          "required": ["url", "at"],
+          "additionalProperties": false
+        }
+      ]
+    },
+    "parts": {
+      "description": "In a repo: the parts that ran, pre-commit (format, lint, types) and pre-push (unit tests, build, checks of the built app, end-to-end tests).",
+      "type": "array",
+      "items": { "enum": ["pre-commit", "pre-push"] },
+      "uniqueItems": true
+    },
+    "rules": {
+      "description": "The ids of the rules checked: every check that found something to check, checks-pass for the toolchain steps, and app-checkable when a built app or a URL could not be checked at all.",
+      "type": "array",
+      "items": { "$ref": "#/$defs/id" },
+      "uniqueItems": true
+    },
+    "findings": {
+      "description": "Every finding, sorted by rule id and place. Exit code 1 when one has severity error.",
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "rule": { "$ref": "#/$defs/id" },
+          "severity": {
+            "enum": ["error", "warning", "hint"],
+            "description": "The rule's severity; hint also for what a check could not decide, such as a link whose server is rate limited (429). Only error fails"
+          },
+          "where": {
+            "type": "string",
+            "minLength": 1,
+            "description": "File and line, page and element, or the command"
+          },
+          "found": { "type": "string", "minLength": 1, "description": "What was found" },
+          "fix": { "type": "string", "minLength": 1, "description": "How to fix it" },
+          "link": {
+            "type": "string",
+            "pattern": "^https://lernapps\\.net/tooling/rules/#[a-z][a-z0-9]*(-[a-z0-9]+)*$",
+            "description": "The rule's entry on the rule page"
+          }
+        },
+        "required": ["rule", "severity", "where", "found", "fix", "link"],
+        "additionalProperties": false
+      }
+    },
+    "suppressions": {
+      "description": "Warnings suppressed in place, each with its reason.",
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "rule": { "$ref": "#/$defs/id" },
+          "where": { "type": "string", "minLength": 1 },
+          "reason": { "type": "string", "minLength": 1 }
+        },
+        "required": ["rule", "where", "reason"],
+        "additionalProperties": false
+      }
+    },
+    "fitness": {
+      "description": "The fitness values measured on the built app, without a click, in the words of the catalog entry.",
+      "type": "object",
+      "properties": {
+        "storage": {
+          "enum": ["none", "device"],
+          "description": "none: nothing stored; device: only in the browser, also what the app reads on loading and keeps after an input"
+        },
+        "thirdParty": {
+          "enum": ["none", "before-click"],
+          "description": "none: no request to another host before a click; before-click: requests that keep the app from being listed"
+        }
+      },
+      "required": ["storage", "thirdParty"],
+      "additionalProperties": false
+    }
+  },
+  "required": ["checked", "rules", "findings", "suppressions"],
+  "additionalProperties": false,
+  "$defs": {
+    "id": { "type": "string", "pattern": "^[a-z][a-z0-9]*(-[a-z0-9]+)*$" }
+  }
+}

package/dist/a11y.mjs

@@ -0,0 +1,30 @@
+// archetypes/shared/a11y.ts
+const regions = /* @__PURE__ */ new Map();
+/** A visually hidden live region, created once per politeness. */
+function region(politeness) {
+	const existing = regions.get(politeness);
+	if (existing?.isConnected) return existing;
+	const element = document.createElement("div");
+	element.setAttribute("aria-live", politeness);
+	element.setAttribute("aria-atomic", "true");
+	element.style.cssText = "position:absolute;width:1px;height:1px;margin:-1px;padding:0;overflow:hidden;clip:rect(0 0 0 0);white-space:nowrap;border:0";
+	document.body.append(element);
+	regions.set(politeness, element);
+	return element;
+}
+/** Says `text` to screen readers, e.g. the feedback after an answer; "assertive" interrupts, for errors only. */
+function announce(text, politeness = "polite") {
+	const live = region(politeness);
+	live.textContent = "";
+	setTimeout(() => {
+		live.textContent = text;
+	}, 50);
+}
+/** Moves the keyboard focus to `element`, e.g. the heading of the next task, making it focusable if needed. */
+function moveFocus(element) {
+	if (!element.matches("a[href], button, input, select, textarea, [tabindex]")) element.tabIndex = -1;
+	element.focus();
+}
+/** Whether the learner asked for less motion: animate only when this is false. */
+const prefersReducedMotion = () => globalThis.matchMedia?.("(prefers-reduced-motion: reduce)").matches ?? false;
+export { announce, moveFocus, prefersReducedMotion };

package/dist/check/rules/accessible.mjs

@@ -0,0 +1,18 @@
+import { n as declaredLimit } from "../../check-cv4I6CCH.mjs";
+// check/rules/accessible.ts
+var accessible_default = {
+	id: "accessible",
+	url: "https://lernapps.net/tooling/rules/#accessible",
+	description: "axe-core finds no violation of WCAG 2.1 A or AA on any page of the built app; warnings when the entry declares the app's limits.",
+	severity: "error",
+	run: (context) => {
+		const severity = declaredLimit(context);
+		return context.app?.pages.flatMap(({ page, axe }) => axe.map(({ id, help, helpUrl, targets }) => ({
+			...severity ? { severity } : {},
+			where: `${page} ${targets[0] ?? ""}${targets.length > 1 ? ` (and ${targets.length - 1} more)` : ""}`.trim(),
+			found: `${help} (axe ${id})`,
+			fix: `${help}: ${helpUrl}`
+		})));
+	}
+};
+export { accessible_default as default };

package/dist/check/rules/app-content-guide.mjs

@@ -0,0 +1,69 @@
+import { c as planFrontMatter, s as currentPlan } from "../../plan-DWKayEnY.mjs";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+// check/rules/app-content-guide.ts
+/** The guide, relative to the app's root. */
+const SKILL = ".agents/skills/app-content/SKILL.md";
+/** Its fixed level-2 headings, in order: the skeleton has them, and a follow-up agent finds each part by them. */
+const HEADINGS = [
+	"Curriculum",
+	"Competencies",
+	"Content structure",
+	"Terminology",
+	"Exercise patterns",
+	"Figures",
+	"Sources",
+	"Adding a chapter or round",
+	"Rules learned from mistakes"
+];
+/** A placeholder of the skeleton: an HTML comment that starts with "FILL IN:". */
+const PLACEHOLDER = "<!-- FILL IN:";
+const RUNTIME = "@lernapps/app-templates";
+/** The `phase` of the current plan's front matter ("" when it has none); undefined when there is no plan. */
+function phase(project) {
+	const plan = currentPlan(project);
+	if (plan === void 0) return void 0;
+	const value = planFrontMatter(join(project, plan))["phase"];
+	return typeof value === "string" ? value : "";
+}
+var app_content_guide_default = {
+	id: "app-content-guide",
+	url: "https://lernapps.net/tooling/rules/#app-content-guide",
+	description: "The app's content guide .agents/skills/app-content/SKILL.md exists with its fixed headings, and has no placeholder left once the plan is in Commit.",
+	severity: "error",
+	run: ({ project }) => {
+		if (project === void 0 || !existsSync(join(project, "package.json"))) return void 0;
+		const manifest = JSON.parse(readFileSync(join(project, "package.json"), "utf8"));
+		const fromTemplate = {
+			...manifest.dependencies,
+			...manifest.devDependencies
+		}[RUNTIME] !== void 0;
+		const current = phase(project);
+		if (!fromTemplate || current === void 0) return void 0;
+		const file = join(project, SKILL);
+		if (!existsSync(file)) return [{
+			where: SKILL,
+			found: "the app has no content guide",
+			fix: "Add the skeleton with npx --yes @lernapps/tooling@latest update, then fill it in from the plan as its comments say"
+		}];
+		const lines = readFileSync(file, "utf8").split("\n");
+		const problems = HEADINGS.filter((heading) => !lines.includes(`## ${heading}`)).map((heading) => ({
+			where: SKILL,
+			found: `the heading "## ${heading}" is missing`,
+			fix: `Keep the fixed headings of the skeleton: ${HEADINGS.map((name) => `"## ${name}"`).join(", ")}`
+		}));
+		if (current !== "commit") return problems;
+		let section = "";
+		lines.forEach((line, index) => {
+			if (line.startsWith("## ")) section = line;
+			if (!line.includes(PLACEHOLDER)) return;
+			problems.push({
+				where: `${SKILL}:${index + 1}${section === "" ? "" : ` (${section})`}`,
+				found: "a placeholder is left, but the app has content (the plan is in Commit)",
+				fix: "Replace it with precise, concrete instructions for this app, from the confirmed plan and what was built: name files, ids, data files and an example"
+			});
+		});
+		return problems;
+	}
+};
+export { HEADINGS, SKILL, app_content_guide_default as default };

package/dist/check/rules/dependency-licence.mjs

@@ -0,0 +1,82 @@
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join, relative } from "node:path";
+// check/rules/dependency-licence.ts
+/** Licences that allow the app to be shared freely, with or without changes (SPDX identifiers). */
+const ALLOWED = /* @__PURE__ */ new Set([
+	"0BSD",
+	"Apache-2.0",
+	"BlueOak-1.0.0",
+	"BSD-2-Clause",
+	"BSD-3-Clause",
+	"CC-BY-4.0",
+	"CC0-1.0",
+	"ISC",
+	"MIT",
+	"MIT-0",
+	"MPL-2.0",
+	"Python-2.0",
+	"Unlicense",
+	"Zlib"
+]);
+/** An SPDX expression is allowed when one of its alternatives (OR) has only allowed parts (AND). */
+const allowed = (expression) => expression.replace(/[()]/g, " ").split(/\s+OR\s+/).some((alternative) => alternative.split(/\s+AND\s+/).every((part) => ALLOWED.has(part.trim())));
+const read = (file) => JSON.parse(readFileSync(file, "utf8"));
+function licenceOf(manifest) {
+	const { license, licenses } = manifest;
+	if (typeof license === "string") return license;
+	if (typeof license === "object" && license !== null && "type" in license) return String(license.type);
+	if (Array.isArray(licenses)) return licenses.map((entry) => String(entry.type)).join(" OR ");
+	return "";
+}
+/** Where Node would find package `name` required from `from`: the nearest node_modules up to the project. */
+function locate(name, from, project) {
+	for (let dir = from;; dir = dirname(dir)) {
+		const candidate = join(dir, "node_modules", name, "package.json");
+		if (existsSync(candidate)) return candidate;
+		if (dir === project || dirname(dir) === dir) return void 0;
+	}
+}
+var dependency_licence_default = {
+	id: "dependency-licence",
+	url: "https://lernapps.net/tooling/rules/#dependency-licence",
+	description: "Every runtime dependency of the app has a licence from the allowlist.",
+	severity: "error",
+	run: ({ project }) => {
+		if (project === void 0 || !existsSync(join(project, "package.json"))) return void 0;
+		const problems = [];
+		const seen = /* @__PURE__ */ new Set();
+		const walk = (manifest, dir) => {
+			const optional = manifest.optionalDependencies ?? {};
+			for (const name of Object.keys({
+				...manifest.dependencies,
+				...optional
+			}).sort()) {
+				const file = locate(name, dir, project);
+				if (file === void 0) {
+					if (!(name in optional) && !seen.has(name)) {
+						seen.add(name);
+						problems.push({
+							where: relative(project, join(dir, "package.json")) || "package.json",
+							found: `${name} is not installed, so its licence cannot be read`,
+							fix: "Run npm ci, then check again"
+						});
+					}
+					continue;
+				}
+				if (seen.has(file)) continue;
+				seen.add(file);
+				const dependency = read(file);
+				const licence = licenceOf(dependency);
+				if (!allowed(licence)) problems.push({
+					where: relative(project, file),
+					found: `${dependency.name ?? name}@${dependency.version ?? "?"} has ${licence === "" ? "no licence" : `the licence ${licence}`}, which is not on the allowlist`,
+					fix: `Replace it with a package under one of ${[...ALLOWED].join(", ")}`
+				});
+				walk(dependency, dirname(file));
+			}
+		};
+		walk(read(join(project, "package.json")), project);
+		return problems;
+	}
+};
+export { dependency_licence_default as default };

package/dist/check/rules/entry-fitness-matches.mjs

@@ -0,0 +1,22 @@
+// check/rules/entry-fitness-matches.ts
+var entry_fitness_matches_default = {
+	id: "entry-fitness-matches",
+	url: "https://lernapps.net/tooling/rules/#entry-fitness-matches",
+	description: "The fitness values of the catalog entry match the values measured on the app.",
+	severity: "error",
+	run: ({ entry, app }) => {
+		if (!entry || !app) return void 0;
+		if (entry.value.fitness?.storage !== "none" || app.fitness.storage === "none") return [];
+		const stored = [...new Set(app.pages.flatMap((page) => [
+			...page.storage,
+			...page.cookies,
+			...page.access.map((access) => `${access.area} ${access.name}`)
+		]))];
+		return [{
+			where: `${entry.file}: fitness.storage`,
+			found: `the entry says storage: none, but the app stores on the device (${stored.join(", ")})`,
+			fix: "Set fitness.storage to device in the entry, or let the app store nothing"
+		}];
+	}
+};
+export { entry_fitness_matches_default as default };

package/dist/check/rules/entry-links-resolve.mjs

@@ -0,0 +1,44 @@
+import { n as linkStatus, t as linkProblem } from "../../status-CXoQBgfU.mjs";
+// check/rules/entry-links-resolve.ts
+/** The section a link names: its fragment, decoded; "" when it names none. */
+function sectionOf(link) {
+	const hash = new URL(link).hash.slice(1);
+	try {
+		return decodeURIComponent(hash);
+	} catch {
+		return hash;
+	}
+}
+var entry_links_resolve_default = {
+	id: "entry-links-resolve",
+	url: "https://lernapps.net/tooling/rules/#entry-links-resolve",
+	description: "The app's URL and every topic link of its catalog entry resolve; a topic's #<section> is an element id of its page.",
+	severity: "error",
+	run: async ({ entry }) => {
+		if (!entry) return void 0;
+		const { url, topics = [] } = entry.value;
+		const links = [{
+			where: `${entry.file}: url`,
+			url,
+			section: ""
+		}, ...topics.map((topic, index) => {
+			const link = new URL(topic.path, url).href;
+			return {
+				where: `${entry.file}: topics[${index}].path ${topic.path}`,
+				url: link,
+				section: sectionOf(link)
+			};
+		})];
+		return (await Promise.all(links.map(async ({ where, url: link, section }) => {
+			const { status, ids } = await linkStatus(link, { ids: section !== "" });
+			const broken = linkProblem(where, link, status, "Point the topic's path (relative to url) to a page of the app, or correct the app's url");
+			if (broken !== void 0 || section === "" || ids?.has(section)) return broken;
+			return {
+				where,
+				found: `${link}: the page has no element with the id "${section}", so the link does not lead to its section`,
+				fix: "Point the topic's #<section> to the id of a section of that page (#<section> or #<section>/<sub>, from the content's ids), or leave the anchor out to link the page"
+			};
+		}))).filter((problem) => problem !== void 0);
+	}
+};
+export { entry_links_resolve_default as default };

package/dist/check/rules/explainer-readable-without-js.mjs

@@ -0,0 +1,66 @@
+// check/rules/explainer-readable-without-js.ts
+/** For what the content cannot cause: the runtime writes it into the page, visible without JavaScript. */
+const RUNTIME_BUG = `The explainer runtime writes it into the page, visible without JavaScript: build with it (vp build), change no page after the build, and add no script or style that hides content. If that is so, this is a bug of the runtime: open an issue at https://github.com/lernapps/app-templates/issues with this report`;
+const WHAT = {
+	heading: "the heading",
+	formula: "the formula",
+	figure: "the figure"
+};
+var explainer_readable_without_js_default = {
+	id: "explainer-readable-without-js",
+	url: "https://lernapps.net/tooling/rules/#explainer-readable-without-js",
+	description: "Each explainer page shows its headings, formulas, named figures, every Lösung and every nojs text without JavaScript.",
+	severity: "error",
+	run: ({ app }) => {
+		const marked = app?.pages.filter((page) => page.withoutJavaScript !== void 0) ?? [];
+		if (marked.length === 0) return void 0;
+		return marked.flatMap(({ page, withoutJavaScript }) => {
+			if (withoutJavaScript === void 0) return [];
+			const { h1, parts, exercises, components } = withoutJavaScript;
+			const problems = [];
+			if (h1 === "") problems.push({
+				where: page,
+				found: "without JavaScript the page shows no h1 heading: its content is not in the HTML, or hidden",
+				fix: RUNTIME_BUG
+			});
+			for (const part of parts) {
+				const what = WHAT[part.kind];
+				if (!part.visible) problems.push({
+					where: `${page} ${part.where}`,
+					found: `${what} is hidden without JavaScript`,
+					fix: RUNTIME_BUG
+				});
+				else if (part.text === "") problems.push({
+					where: `${page} ${part.where}`,
+					found: part.kind === "figure" ? `${what} has no accessible name` : `${what} is empty`,
+					fix: part.kind === "figure" ? "Give the figure its alt text and caption in every language (the block's alt and caption)" : RUNTIME_BUG
+				});
+			}
+			for (const { where, solutions } of exercises) {
+				if (solutions.length === 0) problems.push({
+					where: `${page} ${where}`,
+					found: "the exercise has no Lösung",
+					fix: RUNTIME_BUG
+				});
+				solutions.forEach((solution, index) => {
+					if (solution !== "") return;
+					problems.push({
+						where: `${page} ${where}`,
+						found: `${solutions.length > 1 ? `Lösung ${index + 1}` : "the Lösung"} is empty without JavaScript`,
+						fix: `Give the exercise its right answer in the content. ${RUNTIME_BUG}`
+					});
+				});
+			}
+			for (const { where, nojs } of components) {
+				if (nojs !== void 0 && nojs !== "") continue;
+				problems.push({
+					where: `${page} ${where}`,
+					found: nojs === void 0 ? "the component has no nojs text" : "the component's nojs text is empty, or hidden, without JavaScript",
+					fix: "Give the vue-component block a nojs text in every language: what the component shows and does, with its content (vue-component-nojs)"
+				});
+			}
+			return problems;
+		});
+	}
+};
+export { explainer_readable_without_js_default as default };

package/dist/check/rules/links-resolve.mjs

@@ -0,0 +1,10 @@
+import { t as linkProblem } from "../../status-CXoQBgfU.mjs";
+// check/rules/links-resolve.ts
+var links_resolve_default = {
+	id: "links-resolve",
+	url: "https://lernapps.net/tooling/rules/#links-resolve",
+	description: "Every link and resource of the built app below its address resolves.",
+	severity: "error",
+	run: ({ app }) => app?.pages.flatMap(({ page, links }) => links.flatMap(({ url, status }) => linkProblem(page, url.slice(app.base.length) || "./", status, "Point the link to a page or file the build writes, or remove it") ?? []))
+};
+export { links_resolve_default as default };

package/dist/check/rules/lockfile-matches.mjs

@@ -0,0 +1,57 @@
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+// check/lockfile.ts
+/** The dependency fields npm copies from package.json into the lock file's root entry. */
+const FIELDS = [
+	"dependencies",
+	"devDependencies",
+	"optionalDependencies",
+	"peerDependencies"
+];
+/** The commit a git spec pins (github:owner/repo#<sha>, git+https://…#<sha>), if it pins a full one. */
+const pinnedCommit = (spec) => spec.startsWith("file:") ? void 0 : /#([0-9a-f]{40})$/.exec(spec)?.[1];
+const FIX = "Run npm install, then commit package-lock.json together with package.json";
+/** The mismatches between package.json and package-lock.json in dir; undefined when dir has no lock file. */
+function lockfileProblems(dir) {
+	const lockFile = join(dir, "package-lock.json");
+	if (!existsSync(lockFile) || !existsSync(join(dir, "package.json"))) return void 0;
+	const manifest = JSON.parse(readFileSync(join(dir, "package.json"), "utf8"));
+	const lock = JSON.parse(readFileSync(lockFile, "utf8"));
+	const root = lock.packages?.[""] ?? {};
+	const problems = [];
+	const reported = /* @__PURE__ */ new Set();
+	for (const field of FIELDS) {
+		const wanted = manifest[field] ?? {};
+		const locked = root[field] ?? {};
+		for (const name of [.../* @__PURE__ */ new Set([...Object.keys(wanted), ...Object.keys(locked)])].sort()) {
+			if (wanted[name] === locked[name]) continue;
+			reported.add(name);
+			problems.push({
+				where: "package-lock.json",
+				found: `${field} ${name}: package.json has ${wanted[name] ?? "nothing"}, the lock file ${locked[name] ?? "nothing"}`,
+				fix: FIX
+			});
+		}
+	}
+	for (const field of FIELDS.filter((field) => field !== "peerDependencies")) for (const [name, spec] of Object.entries(manifest[field] ?? {})) {
+		const commit = pinnedCommit(spec);
+		if (commit === void 0 || reported.has(name)) continue;
+		const resolved = lock.packages?.[`node_modules/${name}`]?.resolved;
+		if (resolved?.endsWith(`#${commit}`)) continue;
+		problems.push({
+			where: "package-lock.json",
+			found: `${name}: package.json pins the commit ${commit}, the lock file installs ${resolved ?? "nothing"}`,
+			fix: FIX
+		});
+	}
+	return problems;
+}
+// check/rules/lockfile-matches.ts
+var lockfile_matches_default = {
+	id: "lockfile-matches",
+	url: "https://lernapps.net/tooling/rules/#lockfile-matches",
+	description: "package-lock.json installs what package.json asks for, the commit of every git pin included.",
+	severity: "error",
+	run: ({ project }) => project === void 0 ? void 0 : lockfileProblems(project)
+};
+export { lockfile_matches_default as default };

package/dist/check/rules/no-request-before-click.mjs

@@ -0,0 +1,17 @@
+// check/rules/no-request-before-click.ts
+var no_request_before_click_default = {
+	id: "no-request-before-click",
+	url: "https://lernapps.net/tooling/rules/#no-request-before-click",
+	description: "No page of the built app requests anything from another host before a click.",
+	severity: "error",
+	run: ({ app }) => {
+		if (!app) return void 0;
+		const origin = new URL(app.base).origin;
+		return app.pages.flatMap(({ page, requests }) => [...new Set(requests.map((request) => request.url).filter((url) => new URL(url).origin !== origin))].map((url) => ({
+			where: page,
+			found: `requests ${url} before a click`,
+			fix: "Bundle it with the app at build time; load content of another server only after the learner clicks for it"
+		})));
+	}
+};
+export { no_request_before_click_default as default };

package/dist/check/rules/no-tracking.mjs

@@ -0,0 +1,17 @@
+// check/rules/no-tracking.ts
+var no_tracking_default = {
+	id: "no-tracking",
+	url: "https://lernapps.net/tooling/rules/#no-tracking",
+	description: "No page of the built app sets a cookie or sends data while it loads.",
+	severity: "error",
+	run: ({ app }) => app?.pages.flatMap(({ page, cookies, requests }) => [...cookies.map((cookie) => ({
+		where: page,
+		found: `sets the cookie "${cookie}"`,
+		fix: "Set no cookies; keep what the app must remember in localStorage, on the device"
+	})), ...requests.filter((request) => request.method !== "GET" && request.method !== "HEAD").map((request) => ({
+		where: page,
+		found: `sends data: ${request.method} ${request.url}`,
+		fix: "Send nothing to a server; keep what the app must remember in localStorage, on the device"
+	}))])
+};
+export { no_tracking_default as default };

package/dist/check/rules/own-data-only.mjs

@@ -0,0 +1,66 @@
+import { t as FOREIGN_KEY } from "../../check-cv4I6CCH.mjs";
+import { basename } from "node:path";
+// check/rules/own-data-only.ts
+const PREFIX = /^lernapps:([a-z0-9]+(?:-[a-z0-9]+)*):/;
+/** The prefix of the learner's settings for more than one app (@lernapps/tooling/storage, createSettings). */
+const SETTINGS = "lernapps:settings:";
+/** Whether `name` is a setting for every app or for every app of `archetype`. */
+function isSetting(name, archetype) {
+	if (!name.startsWith(SETTINGS)) return false;
+	const rest = name.slice(18);
+	const colon = rest.indexOf(":");
+	return colon === -1 ? rest !== "" : archetype !== void 0 && rest.slice(0, colon) === archetype;
+}
+const DOING = {
+	read: "reads",
+	write: "writes",
+	remove: "removes",
+	clear: "clears",
+	open: "opens",
+	delete: "deletes",
+	match: "looks up a request in"
+};
+var own_data_only_default = {
+	id: "own-data-only",
+	url: "https://lernapps.net/tooling/rules/#own-data-only",
+	description: "The app reads and writes only its own data in the browser, under the prefix lernapps:<id>:.",
+	severity: "error",
+	run: ({ app, entry }) => {
+		if (!app) return void 0;
+		const id = entry ? basename(entry.file).replace(/\.ya?ml$/, "") : void 0;
+		const named = app.pages.flatMap((page) => [...page.storage.map((stored) => stored.slice(stored.indexOf(" ") + 1)), ...page.access.filter((access) => access.action === "write" || access.action === "open").map((access) => access.name)]);
+		const read = app.pages.flatMap((page) => page.access.map((access) => access.name));
+		const foreign = PREFIX.exec(FOREIGN_KEY)?.[1];
+		const own = id ?? [...named, ...read].map((name) => PREFIX.exec(name)?.[1]).find((name) => name !== void 0 && name !== foreign && name !== "settings");
+		const prefix = own === void 0 ? void 0 : `lernapps:${own}:`;
+		const fix = prefix === void 0 ? "Name every key, database and cache with the prefix lernapps:<id>:, <id> the app's id in the catalog; with @lernapps/tooling/storage: createStorage(\"<id>\")" : `Name every key, database and cache with the prefix ${prefix} and touch nothing else; with @lernapps/tooling/storage: createStorage("${own}")`;
+		return (id === "settings" && app.pages[0] ? [{
+			where: app.pages[0].page,
+			found: "has the id settings, the prefix of the learner's settings for every app",
+			fix: "Give the entry another name"
+		}] : []).concat(app.pages.flatMap(({ page, access, storage, archetype }) => {
+			const isOwn = (name) => prefix !== void 0 && prefix !== SETTINGS && name.startsWith(prefix) || isSetting(name, archetype);
+			const problems = [];
+			const seen = /* @__PURE__ */ new Set();
+			const add = (found) => {
+				if (seen.has(found)) return;
+				seen.add(found);
+				problems.push({
+					where: page,
+					found,
+					fix
+				});
+			};
+			for (const { area, action, name } of access) if (action === "clear") add(`clears all of ${area}, the data of every app on lernapps.net`);
+			else if (action === "match") add("looks up a request in every cache, also in those of other apps");
+			else if (!isOwn(name)) add(`${DOING[action]} ${area} "${name}", which is not its own`);
+			for (const stored of storage) {
+				const area = stored.slice(0, stored.indexOf(" "));
+				const name = stored.slice(stored.indexOf(" ") + 1);
+				if (!isOwn(name)) add(`writes ${area} "${name}", which is not its own`);
+			}
+			return problems;
+		}));
+	}
+};
+export { own_data_only_default as default };

package/dist/check/rules/pages-reachable.mjs

@@ -0,0 +1,25 @@
+// check/rules/pages-reachable.ts
+var pages_reachable_default = {
+	id: "pages-reachable",
+	url: "https://lernapps.net/tooling/rules/#pages-reachable",
+	description: "Every page of the built app is reachable from the start page by links; on a URL, at most 100 pages are checked.",
+	severity: "error",
+	run: ({ app }) => {
+		if (app === void 0) return void 0;
+		if (app.stopped !== void 0) {
+			const { limit, more } = app.stopped;
+			return [{
+				where: app.base,
+				found: `checked ${limit} pages, the most a check of an app on a URL visits; at least ${more} further pages linked from them were not visited, and no check ran on them`,
+				fix: "Nothing to fix for this: to check every page, check the built app itself (lernapps check in its repo, or lernapps check <dir> on its bundle)",
+				severity: "hint"
+			}];
+		}
+		return (app.unreachable ?? []).map((page) => ({
+			where: page,
+			found: "no link leads to this page from the start page: it is unreachable from the start page",
+			fix: "Link the page from a page learners reach, or leave it out of the build. A page reached another way on purpose gets <meta name=\"robots\" content=\"noindex\">"
+		}));
+	}
+};
+export { pages_reachable_default as default };