@orbit-work/oem-sdk 0.1.0

package/dist/audit-brand.js

@@ -0,0 +1,721 @@
+#!/usr/bin/env node
+import { realpath, readFile, stat } from 'fs/promises';
+import { resolve, extname, sep, dirname } from 'path';
+import { gzipSync } from 'zlib';
+import { init, parse } from 'es-module-lexer';
+import { transform } from 'esbuild';
+import { validateDictionary } from '@orbit-work/ui/locale';
+import { UNIFIED_NEUTRAL_TOKENS, BRAND_ACTION_TOKENS, ds2ContrastRatio } from '@orbit-work/ui/appearance';
+import { WORKBENCH_SLOT_DECLARATIONS, WORKBENCH_KEYED_SLOT_KEYS } from '@orbit-work/ui/slot/core';
+
+var BRAND_MANIFEST_SCHEMA = "@orbit-work/oem-sdk/manifest@1";
+var ROOT_KEYS = /* @__PURE__ */ new Set([
+  "$schema",
+  "id",
+  "description",
+  "assistantName",
+  "homepage",
+  "permissions",
+  "entry",
+  "identity",
+  "tokens",
+  "assets",
+  "branding",
+  "locales",
+  "network",
+  "contributes"
+]);
+var IDENTITY_KEYS = /* @__PURE__ */ new Set(["productName", "appId", "versionChannel", "protocolScheme", "userDataNamespace"]);
+var ASSET_KEYS = /* @__PURE__ */ new Set(["appIcon", "tray", "logo"]);
+var MODE_KEYS = /* @__PURE__ */ new Set(["light", "dark"]);
+var CONTRIBUTES_KEYS = /* @__PURE__ */ new Set(["slots"]);
+var NETWORK_KEYS = /* @__PURE__ */ new Set(["allowedOrigins"]);
+var PERMISSIONS_KEYS = /* @__PURE__ */ new Set(["microphoneUsage"]);
+var BRANDING_KEYS = /* @__PURE__ */ new Set(["productName", "companyName", "claim", "claimNote", "slogan"]);
+var SLOT_COMMON_KEYS = /* @__PURE__ */ new Set(["name"]);
+var BRAND_TOKEN_NAMES = /* @__PURE__ */ new Set([...UNIFIED_NEUTRAL_TOKENS, ...BRAND_ACTION_TOKENS]);
+var SLOT_DECLARATIONS = WORKBENCH_SLOT_DECLARATIONS;
+var HEX = /^#(?:[0-9a-f]{3,4}|[0-9a-f]{6}|[0-9a-f]{8})$/i;
+var KEBAB_ID = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+var APP_ID = /^[a-zA-Z][a-zA-Z0-9]*(?:\.[a-zA-Z0-9][a-zA-Z0-9-]*){2,}$/;
+var PROTOCOL_SCHEME = /^[a-z][a-z0-9+.-]*$/;
+var SOURCE_ENTRY = /^\.\/src\/.+\.(?:[cm]?js|[jt]sx?)$/;
+var WINDOWS_DEVICE_NAME = /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\..*)?$/i;
+var OFFICIAL_APP_ID = "ai.orbit.desktop";
+var OFFICIAL_PRODUCT_NAMES = /* @__PURE__ */ new Set(["orbitwork"]);
+var RESERVED_VERSION_CHANNELS = /* @__PURE__ */ new Set([
+  "stable",
+  "preview",
+  "uat",
+  "latest",
+  "desktop",
+  "macos",
+  "windows",
+  "linux"
+]);
+var RESERVED_PROTOCOL_SCHEMES = /* @__PURE__ */ new Set([
+  "about",
+  "blob",
+  "chrome",
+  "chrome-extension",
+  "data",
+  "devtools",
+  "electron",
+  "file",
+  "ftp",
+  "geo",
+  "http",
+  "https",
+  "javascript",
+  "mailto",
+  "orbit",
+  "sms",
+  "tel",
+  "urn",
+  "ws",
+  "wss"
+]);
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function hasUnsafeProductNameCharacter(value) {
+  return [...value].some((character) => {
+    const code = character.charCodeAt(0);
+    return code <= 31 || code === 127 || '<>:"/\\|?*'.includes(character);
+  });
+}
+function productNameNamespace(value) {
+  return value.normalize("NFKD").replace(/\p{M}+/gu, "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+}
+function assertKnownKeys(value, allowed, path) {
+  const unknown = Object.keys(value).find((key) => !allowed.has(key));
+  if (unknown) throw new Error(`${path} contains unsupported field: ${unknown}`);
+}
+function text(value, path, limit = 100) {
+  if (typeof value !== "string" || !value.trim()) throw new Error(`${path} must be a non-empty string`);
+  const result = value.trim();
+  if (result.length > limit) throw new Error(`${path} exceeds ${limit} characters`);
+  return result;
+}
+function canonicalLocale(value, path) {
+  try {
+    const locale = Intl.getCanonicalLocales(value)[0];
+    if (!locale || locale !== value) throw new Error();
+    return locale;
+  } catch {
+    throw new Error(`${path} must be a canonical BCP 47 locale`);
+  }
+}
+function relativePath(value, path) {
+  const result = text(value, path, 240);
+  if (!result.startsWith("./") || result.includes("\\") || result.split("/").includes("..")) {
+    throw new Error(`${path} must be a package-relative ./ path without traversal`);
+  }
+  return result;
+}
+function parseIdentity(value, id, platform) {
+  if (!isRecord(value)) throw new Error("identity must be an object");
+  assertKnownKeys(value, IDENTITY_KEYS, "identity");
+  const productName = text(value.productName, "identity.productName", 64);
+  const appId = text(value.appId, "identity.appId", 160);
+  const versionChannel = text(value.versionChannel, "identity.versionChannel", 64);
+  const protocolScheme = text(value.protocolScheme, "identity.protocolScheme", 64);
+  if (value.userDataNamespace !== void 0 && !KEBAB_ID.test(text(value.userDataNamespace, "identity.userDataNamespace", 64))) {
+    throw new Error("identity.userDataNamespace must be lowercase kebab-case");
+  }
+  if (!APP_ID.test(appId)) throw new Error("identity.appId must be a reverse-DNS identifier");
+  if (!KEBAB_ID.test(versionChannel)) throw new Error("identity.versionChannel must be kebab-case");
+  if (!platform && RESERVED_VERSION_CHANNELS.has(versionChannel)) {
+    throw new Error(`identity.versionChannel is reserved: ${versionChannel}`);
+  }
+  if (!PROTOCOL_SCHEME.test(protocolScheme)) {
+    throw new Error("identity.protocolScheme must be a lowercase URI scheme beginning with a letter");
+  }
+  if (RESERVED_PROTOCOL_SCHEMES.has(protocolScheme)) {
+    throw new Error(`identity.protocolScheme is reserved: ${protocolScheme}`);
+  }
+  if (hasUnsafeProductNameCharacter(productName) || /[. ]$/.test(productName) || productName === "." || productName === ".." || WINDOWS_DEVICE_NAME.test(productName)) {
+    throw new Error("identity.productName must be safe for macOS, Windows, Linux, and release artifact paths");
+  }
+  if (OFFICIAL_PRODUCT_NAMES.has(productName.toLowerCase())) {
+    throw new Error(`identity.productName is reserved for the official application: ${productName}`);
+  }
+  if (appId === OFFICIAL_APP_ID) {
+    throw new Error(`identity.appId is reserved for the official application: ${appId}`);
+  }
+  if (!platform && productNameNamespace(productName) !== id) {
+    throw new Error("identity.productName must normalize to manifest id so installation names cannot collide");
+  }
+  if (!platform && versionChannel !== id) {
+    throw new Error("identity.versionChannel must equal manifest id to keep OEM update feeds namespaced");
+  }
+  if (!platform && protocolScheme !== id) {
+    throw new Error("identity.protocolScheme must equal manifest id to keep OEM deep links namespaced");
+  }
+  if (!platform && !appId.endsWith(`.oem.${id}`)) {
+    throw new Error("identity.appId must end with .oem.<manifest id> to isolate installation and user data");
+  }
+  return {
+    productName,
+    appId,
+    versionChannel,
+    protocolScheme,
+    ...value.userDataNamespace !== void 0 ? { userDataNamespace: text(value.userDataNamespace, "identity.userDataNamespace", 64) } : {}
+  };
+}
+function parseAssets(value) {
+  if (!isRecord(value)) throw new Error("assets must be an object");
+  assertKnownKeys(value, ASSET_KEYS, "assets");
+  const tray = value.tray === void 0 ? void 0 : relativePath(value.tray, "assets.tray");
+  return {
+    appIcon: relativePath(value.appIcon, "assets.appIcon"),
+    ...tray ? { tray } : {},
+    logo: relativePath(value.logo, "assets.logo")
+  };
+}
+function parseBrandCopy(value, path) {
+  if (!isRecord(value)) throw new Error(`${path} must be an object`);
+  assertKnownKeys(value, BRANDING_KEYS, path);
+  const result = {
+    productName: text(value.productName, `${path}.productName`, 64),
+    companyName: text(value.companyName, `${path}.companyName`, 80)
+  };
+  for (const [key, limit] of [
+    ["claim", 40],
+    ["claimNote", 48],
+    ["slogan", 68]
+  ]) {
+    if (value[key] !== void 0) result[key] = text(value[key], `${path}.${key}`, limit);
+  }
+  return result;
+}
+function parseBranding(value) {
+  if (!isRecord(value)) throw new Error("branding must be a locale map");
+  const result = {};
+  for (const [rawLocale, copy] of Object.entries(value)) {
+    const locale = canonicalLocale(rawLocale, `branding.${rawLocale}`);
+    result[locale] = parseBrandCopy(copy, `branding.${locale}`);
+  }
+  if (!result["en-US"]) throw new Error("branding.en-US is required");
+  return result;
+}
+function parseLocales(value) {
+  if (value === void 0) return void 0;
+  if (!isRecord(value)) throw new Error("locales must be a locale map");
+  const result = {};
+  for (const [rawLocale, source] of Object.entries(value)) {
+    const locale = canonicalLocale(rawLocale, `locales.${rawLocale}`);
+    result[locale] = relativePath(source, `locales.${locale}`);
+  }
+  if (!result["en-US"]) throw new Error("locales.en-US is required when locales are declared");
+  return result;
+}
+function isDevelopmentHostname(hostname) {
+  const lower = hostname.toLowerCase();
+  if (lower === "localhost" || lower.endsWith(".localhost") || lower.endsWith(".local")) return true;
+  if (["::1", "[::1]"].includes(lower) || /^(?:fc|fd|fe8|fe9|fea|feb)/.test(lower.replace(/[\[\]]/g, ""))) {
+    return true;
+  }
+  const ipv4 = lower.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/)?.slice(1).map(Number);
+  if (ipv4) {
+    const [a, b] = ipv4;
+    if (a === 0 || a === 10 || a === 127 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168) {
+      return true;
+    }
+  }
+  return lower.split(/[.-]/).some((label) => ["dev", "development", "test", "testing", "stage", "staging", "uat"].includes(label));
+}
+function parseNetwork(value) {
+  if (value === void 0) return void 0;
+  if (!isRecord(value)) throw new Error("network must be an object");
+  assertKnownKeys(value, NETWORK_KEYS, "network");
+  if (!Array.isArray(value.allowedOrigins) || value.allowedOrigins.length === 0) {
+    throw new Error("network.allowedOrigins must be a non-empty array");
+  }
+  const allowedOrigins = value.allowedOrigins.map((raw, index) => {
+    const path = `network.allowedOrigins[${index}]`;
+    const origin = text(raw, path, 240);
+    let parsed;
+    try {
+      parsed = new URL(origin);
+    } catch {
+      throw new Error(`${path} must be an exact HTTPS origin`);
+    }
+    if (parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash || parsed.origin !== origin) {
+      throw new Error(`${path} must be a canonical exact HTTPS origin without credentials, path, query, or fragment`);
+    }
+    if (isDevelopmentHostname(parsed.hostname)) {
+      throw new Error(`${path} must be a production origin, not localhost, private network, dev, test, staging, or UAT`);
+    }
+    return origin;
+  });
+  if (new Set(allowedOrigins).size !== allowedOrigins.length) {
+    throw new Error("network.allowedOrigins must not contain duplicates");
+  }
+  return { allowedOrigins };
+}
+function parseHomepage(value) {
+  const homepage = text(value, "homepage", 200);
+  let parsed;
+  try {
+    parsed = new URL(homepage);
+  } catch {
+    throw new Error("homepage must be an https URL");
+  }
+  if (parsed.protocol !== "https:" || !parsed.hostname) {
+    throw new Error("homepage must be an https URL");
+  }
+  return homepage;
+}
+function parsePermissions(value) {
+  if (!isRecord(value)) throw new Error("permissions must be an object");
+  assertKnownKeys(value, PERMISSIONS_KEYS, "permissions");
+  return { microphoneUsage: text(value.microphoneUsage, "permissions.microphoneUsage", 120) };
+}
+function parseModeTokens(value, path) {
+  if (!isRecord(value)) throw new Error(`${path} must be an object`);
+  const result = {};
+  for (const [name, raw] of Object.entries(value)) {
+    if (!BRAND_TOKEN_NAMES.has(name)) throw new Error(`${path} contains forbidden token: ${name}`);
+    if (typeof raw !== "string" || !HEX.test(raw)) throw new Error(`${path}.${name} must be a hex color`);
+    result[name] = raw.toLowerCase();
+  }
+  const touchedNeutral = UNIFIED_NEUTRAL_TOKENS.some((name) => result[name] !== void 0);
+  if (touchedNeutral) {
+    const missing = UNIFIED_NEUTRAL_TOKENS.filter((name) => result[name] === void 0);
+    if (missing.length) throw new Error(`${path} neutral group is incomplete: ${missing.join(", ")}`);
+    for (const textToken of ["--ow-text", "--ow-text-2"]) {
+      for (const surfaceToken of ["--ow-bg", "--ow-surface", "--ow-surface-2"]) {
+        const ratio = ds2ContrastRatio(result[textToken], result[surfaceToken]);
+        if (ratio < 4.5) {
+          throw new Error(
+            `${path} contrast ${textToken} on ${surfaceToken} is ${ratio.toFixed(2)}:1; expected >= 4.5:1`
+          );
+        }
+      }
+    }
+  }
+  const touchedAction = BRAND_ACTION_TOKENS.some((name) => result[name] !== void 0);
+  if (touchedAction) {
+    const missing = BRAND_ACTION_TOKENS.filter((name) => result[name] === void 0);
+    if (missing.length) throw new Error(`${path} action pole group is incomplete: ${missing.join(", ")}`);
+    for (const background of ["--ow-btn-primary-bg", "--ow-btn-primary-hover", "--ow-btn-primary-press"]) {
+      const ratio = ds2ContrastRatio(result[background], result["--ow-btn-primary-fg"]);
+      if (ratio < 4.5) {
+        throw new Error(
+          `${path} contrast --ow-btn-primary-fg on ${background} is ${ratio.toFixed(2)}:1; expected >= 4.5:1`
+        );
+      }
+    }
+  }
+  return result;
+}
+function parseTokens(value) {
+  if (value === void 0) return void 0;
+  if (!isRecord(value)) throw new Error("tokens must be an object");
+  assertKnownKeys(value, MODE_KEYS, "tokens");
+  const light = value.light === void 0 ? void 0 : parseModeTokens(value.light, "tokens.light");
+  const dark = value.dark === void 0 ? void 0 : parseModeTokens(value.dark, "tokens.dark");
+  if (!light && !dark) throw new Error("tokens must define light or dark");
+  return { ...light ? { light } : {}, ...dark ? { dark } : {} };
+}
+function slotAllowedKeys(kind) {
+  return /* @__PURE__ */ new Set([
+    ...SLOT_COMMON_KEYS,
+    ...kind === "list" ? ["id", "order"] : [],
+    ...kind === "keyed" ? ["key"] : []
+  ]);
+}
+function parseSlotContribution(value, index) {
+  const path = `contributes.slots[${index}]`;
+  if (!isRecord(value)) throw new Error(`${path} must be an object`);
+  const name = text(value.name, `${path}.name`, 120);
+  const declaration = SLOT_DECLARATIONS[name];
+  if (!declaration) throw new Error(`${path}.name is not in the host slot whitelist: ${name}`);
+  assertKnownKeys(value, slotAllowedKeys(declaration.kind), path);
+  const common = { name };
+  if (declaration.kind === "list") {
+    const id = text(value.id, `${path}.id`, 100);
+    if (typeof value.order !== "number" || !Number.isFinite(value.order)) {
+      throw new Error(`${path}.order must be a finite number`);
+    }
+    return { ...common, id, order: value.order };
+  }
+  if (declaration.kind === "keyed") {
+    const key = text(value.key, `${path}.key`, 100);
+    const allowed = WORKBENCH_KEYED_SLOT_KEYS[name];
+    if (!allowed?.includes(key)) throw new Error(`${path}.key is not reachable by the host: ${key}`);
+    return { ...common, key };
+  }
+  return common;
+}
+function contributionCell(value) {
+  if ("id" in value) return value.id;
+  if ("key" in value) return value.key;
+  return "single";
+}
+function parseContributes(value) {
+  if (value === void 0) return void 0;
+  if (!isRecord(value)) throw new Error("contributes must be an object");
+  assertKnownKeys(value, CONTRIBUTES_KEYS, "contributes");
+  if (!Array.isArray(value.slots)) throw new Error("contributes.slots must be an array");
+  const slots = value.slots.map(parseSlotContribution);
+  const seen = /* @__PURE__ */ new Set();
+  for (const slot of slots) {
+    const identity = `${slot.name}\0${contributionCell(slot)}`;
+    if (seen.has(identity)) throw new Error(`duplicate slot contribution: ${slot.name} / ${contributionCell(slot)}`);
+    seen.add(identity);
+  }
+  return { slots };
+}
+function parseBrandManifest(input, options) {
+  try {
+    const platform = options?.platform === true;
+    if (!isRecord(input)) throw new Error("brand manifest must be a JSON object");
+    assertKnownKeys(input, ROOT_KEYS, "manifest");
+    if (input.$schema !== BRAND_MANIFEST_SCHEMA) throw new Error(`$schema must equal ${BRAND_MANIFEST_SCHEMA}`);
+    const id = text(input.id, "id", 64);
+    if (!KEBAB_ID.test(id)) throw new Error("id must be lowercase kebab-case");
+    const entry = input.entry === void 0 ? void 0 : relativePath(input.entry, "entry");
+    if (entry && !SOURCE_ENTRY.test(entry)) {
+      throw new Error("entry must point to reviewed source under ./src using .js, .mjs, .jsx, .ts, or .tsx");
+    }
+    const contributes = parseContributes(input.contributes);
+    if ((contributes?.slots.length ?? 0) > 0 && !entry)
+      throw new Error("entry is required when contributes.slots is not empty");
+    const tokens = parseTokens(input.tokens);
+    const locales = parseLocales(input.locales);
+    const network = parseNetwork(input.network);
+    const identity = parseIdentity(input.identity, id, platform);
+    if (!platform && productNameNamespace(identity.productName) !== id) {
+      throw new Error("identity.productName must normalize to manifest id so installation names cannot collide");
+    }
+    if (!platform && identity.versionChannel !== id) {
+      throw new Error("identity.versionChannel must equal manifest id to keep OEM update feeds namespaced");
+    }
+    if (!platform && identity.protocolScheme !== id) {
+      throw new Error("identity.protocolScheme must equal manifest id to keep OEM deep links namespaced");
+    }
+    if (!platform && !identity.appId.endsWith(`.oem.${id}`)) {
+      throw new Error("identity.appId must end with .oem.<manifest id> to isolate installation and user data");
+    }
+    return {
+      ok: true,
+      manifest: {
+        $schema: BRAND_MANIFEST_SCHEMA,
+        id,
+        ...input.description !== void 0 ? { description: text(input.description, "description", 200) } : {},
+        ...input.assistantName !== void 0 ? { assistantName: text(input.assistantName, "assistantName", 48) } : {},
+        ...input.homepage !== void 0 ? { homepage: parseHomepage(input.homepage) } : {},
+        ...input.permissions !== void 0 ? { permissions: parsePermissions(input.permissions) } : {},
+        ...entry ? { entry } : {},
+        identity,
+        ...tokens ? { tokens } : {},
+        assets: parseAssets(input.assets),
+        branding: parseBranding(input.branding),
+        ...locales ? { locales } : {},
+        ...network ? { network } : {},
+        ...contributes ? { contributes } : {}
+      }
+    };
+  } catch (cause) {
+    return { ok: false, error: cause instanceof Error ? cause.message : String(cause) };
+  }
+}
+
+// src/audit-brand.ts
+var ENTRY_GZIP_BUDGET = 256 * 1024;
+var ASSET_BUDGET = 5 * 1024 * 1024;
+var LOCALE_BUDGET = 256 * 1024;
+var IMPORT_ALLOWLIST = /* @__PURE__ */ new Set([
+  "@orbit-work/oem-sdk",
+  "@orbit-work/oem-sdk/runtime",
+  "@orbit-work/ui",
+  "react",
+  "react-dom",
+  "react/jsx-runtime",
+  "react/jsx-dev-runtime"
+]);
+var CREDENTIAL_ASSIGNMENT = /\b(?:api[_-]?key|client[_-]?secret|access[_-]?token|password)\b\s*[:=]\s*([^\n;]+)/gi;
+var STATIC_STRING = /"([^"\n]*(?:\\.[^"\n]*)*)"|'([^'\n]*(?:\\.[^'\n]*)*)'|`([^`\n]*(?:\\.[^`\n]*)*)`/g;
+var CODE_EXTENSIONS = /* @__PURE__ */ new Set([".js", ".mjs", ".cjs", ".jsx", ".ts", ".tsx"]);
+var ASSET_EXTENSIONS = /* @__PURE__ */ new Set([".png", ".svg", ".webp", ".jpg", ".jpeg", ".gif", ".woff", ".woff2"]);
+var DATA_EXTENSIONS = /* @__PURE__ */ new Set([".json"]);
+var CSS_IMPORT = /@import\s+(?:url\(\s*)?["']([^"']+)["']\s*\)?/g;
+var CSS_URL = /url\(\s*["']?([^"')]+)["']?\s*\)/g;
+var STATIC_HTTP_URL = /https?:\/\/[^\s"'`<>)]+/g;
+Object.freeze([...IMPORT_ALLOWLIST].sort());
+function containsLikelyHardCodedCredential(source) {
+  CREDENTIAL_ASSIGNMENT.lastIndex = 0;
+  for (const assignment of source.matchAll(CREDENTIAL_ASSIGNMENT)) {
+    const rightHandSide = assignment[1] ?? "";
+    const literalValue = [...rightHandSide.matchAll(STATIC_STRING)].map((match) => match[1] ?? match[2] ?? match[3] ?? "").join("");
+    if (literalValue.length >= 8) return true;
+  }
+  return false;
+}
+function parseLocaleDictionary(source, label) {
+  let value;
+  try {
+    value = JSON.parse(source);
+  } catch {
+    throw new Error(`${label} must contain valid JSON`);
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`${label} must contain a JSON object`);
+  }
+  const dictionary = value;
+  if (Object.keys(dictionary).length === 0) throw new Error(`${label} must not be empty`);
+  const invalidKey = Object.keys(dictionary).find((key) => !/^[A-Za-z][A-Za-z0-9]*(?:[._-][A-Za-z0-9]+)*$/.test(key));
+  if (invalidKey) throw new Error(`${label} contains an invalid translation key: ${invalidKey}`);
+  const invalidValue = Object.entries(dictionary).find(([, text2]) => typeof text2 !== "string");
+  if (invalidValue) throw new Error(`${label}.${invalidValue[0]} must be a string`);
+  return dictionary;
+}
+async function auditLocaleDictionaries(packageRoot, locales) {
+  const dictionaries = /* @__PURE__ */ new Map();
+  for (const [locale, relative] of Object.entries(locales)) {
+    const file = await resolvePackageFile(packageRoot, relative, `locales.${locale}`);
+    const info = await stat(file);
+    if (!info.isFile()) throw new Error(`locales.${locale} must point to a file`);
+    if (info.size > LOCALE_BUDGET) throw new Error(`locales.${locale} exceeds 256 KiB`);
+    dictionaries.set(locale, parseLocaleDictionary(await readFile(file, "utf8"), `locales.${locale}`));
+  }
+  const baseline = dictionaries.get("en-US");
+  for (const [locale, dictionary] of dictionaries) {
+    const result = validateDictionary(baseline, dictionary);
+    if (!result.ok) {
+      throw new Error(
+        `locales.${locale} must match en-US keys (missing: ${result.missing.join(", ") || "none"}; unknown: ${result.unknown.join(", ") || "none"}; invalid: ${result.invalid.join(", ") || "none"})`
+      );
+    }
+  }
+  return Object.keys(locales);
+}
+async function resolvePackageFile(packageRoot, relative, label) {
+  const candidate = resolve(packageRoot, relative);
+  if (candidate !== packageRoot && !candidate.startsWith(`${packageRoot}${sep}`)) {
+    throw new Error(`${label} escapes the brand package`);
+  }
+  const actual = await realpath(candidate);
+  if (actual !== packageRoot && !actual.startsWith(`${packageRoot}${sep}`)) {
+    throw new Error(`${label} resolves outside the brand package`);
+  }
+  return actual;
+}
+async function assertAsset(packageRoot, relative, kind) {
+  const file = await resolvePackageFile(packageRoot, relative, `assets.${kind}`);
+  const info = await stat(file);
+  if (!info.isFile()) throw new Error(`assets.${kind} must point to a file`);
+  if (info.size > ASSET_BUDGET) throw new Error(`assets.${kind} exceeds 5 MiB`);
+  const extension = extname(file).toLowerCase();
+  const allowed = kind === "logo" ? /* @__PURE__ */ new Set([".svg", ".png", ".webp"]) : /* @__PURE__ */ new Set([".png"]);
+  if (!allowed.has(extension)) throw new Error(`assets.${kind} has unsupported extension: ${extension}`);
+  if (kind === "appIcon" || kind === "tray") {
+    const bytes = await readFile(file);
+    if (bytes.length < 24 || bytes.toString("hex", 0, 8) !== "89504e470d0a1a0a") {
+      throw new Error(`assets.${kind} must be a valid PNG`);
+    }
+    const width = bytes.readUInt32BE(16);
+    const height = bytes.readUInt32BE(20);
+    if (kind === "appIcon") {
+      if (width !== height || width < 512) throw new Error("assets.appIcon must be square and at least 512x512");
+    } else if (width !== 32 || height !== 32) {
+      throw new Error("assets.tray must be a 32x32 PNG (single asset used on macOS, Windows, and Linux)");
+    }
+  }
+  return file;
+}
+function moduleKind(file, specifier) {
+  const extension = extname(file).toLowerCase();
+  if (CODE_EXTENSIONS.has(extension)) return "code";
+  if (extension === ".css") {
+    if (!file.endsWith(".module.css")) {
+      throw new Error(`entry styles must use CSS Modules (*.module.css): ${specifier}`);
+    }
+    return "css";
+  }
+  if (ASSET_EXTENSIONS.has(extension)) return "asset";
+  if (DATA_EXTENSIONS.has(extension)) return "data";
+  throw new Error(`entry imports an unsupported module type: ${specifier}`);
+}
+async function resolveRelativeModule(packageRoot, importer, specifier) {
+  if (specifier.includes("?") || specifier.includes("#")) {
+    throw new Error(`entry relative import must not contain a query or fragment: ${specifier}`);
+  }
+  const base = resolve(dirname(importer), specifier);
+  const candidates = extname(base) ? [base] : [base, ...[".js", ".mjs", ".cjs", ".jsx", ".ts", ".tsx"].map((extension) => `${base}${extension}`)];
+  for (const candidate of candidates) {
+    try {
+      const actual = await realpath(candidate);
+      if (actual !== packageRoot && !actual.startsWith(`${packageRoot}${sep}`)) {
+        throw new Error(`entry import resolves outside the brand package: ${specifier}`);
+      }
+      const info = await stat(actual);
+      if (!info.isFile()) throw new Error(`entry import must resolve to a file: ${specifier}`);
+      if (info.size > ASSET_BUDGET) throw new Error(`entry import exceeds 5 MiB: ${specifier}`);
+      return { file: actual, kind: moduleKind(actual, specifier) };
+    } catch (error) {
+      if (error instanceof Error && !error.message.includes("ENOENT")) throw error;
+    }
+  }
+  throw new Error(`entry relative import cannot be resolved: ${specifier}`);
+}
+function assertScopedCss(source, file) {
+  const withoutComments = source.replace(/\/\*[\s\S]*?\*\//g, "");
+  if (/:global\b/.test(withoutComments)) throw new Error(`CSS Module uses forbidden :global selector: ${file}`);
+  if (/(?:^|[,{]\s*)(?:html|body|:root|\*)\b/m.test(withoutComments)) {
+    throw new Error(`CSS Module contains a global root selector: ${file}`);
+  }
+  if (/(?:^|[\s:(,])(?:#(?:[0-9a-f]{3,8})|rgba?\(|hsla?\()/i.test(withoutComments)) {
+    throw new Error(`CSS Module colors must use DS2 --ow-* tokens: ${file}`);
+  }
+}
+function cssRelativeSpecifiers(source, file) {
+  const specifiers = /* @__PURE__ */ new Set();
+  for (const pattern of [CSS_IMPORT, CSS_URL]) {
+    pattern.lastIndex = 0;
+    for (const match of source.matchAll(pattern)) {
+      const specifier = match[1]?.trim();
+      if (!specifier) continue;
+      if (/^(?:data:|https?:|\/\/|\/)/i.test(specifier)) {
+        throw new Error(`CSS Module contains a non-package-relative URL: ${file}: ${specifier}`);
+      }
+      specifiers.add(specifier);
+    }
+  }
+  return [...specifiers];
+}
+function esbuildLoader(file) {
+  switch (extname(file).toLowerCase()) {
+    case ".ts":
+      return "ts";
+    case ".tsx":
+      return "tsx";
+    case ".jsx":
+      return "jsx";
+    default:
+      return "js";
+  }
+}
+function assertDeclaredNetworkOrigins(source, file, allowedOrigins) {
+  STATIC_HTTP_URL.lastIndex = 0;
+  for (const match of source.matchAll(STATIC_HTTP_URL)) {
+    let origin;
+    try {
+      origin = new URL(match[0]).origin;
+    } catch {
+      continue;
+    }
+    if (!allowedOrigins.has(origin)) {
+      throw new Error(`entry module references undeclared network origin ${origin}: ${file}`);
+    }
+  }
+}
+async function auditEntryModuleGraph(packageRoot, entryFile, allowedOrigins) {
+  await init;
+  const pending = [{ file: entryFile, kind: "code" }];
+  const visited = /* @__PURE__ */ new Set();
+  const sources = [];
+  while (pending.length) {
+    const { file, kind } = pending.pop();
+    if (visited.has(file)) continue;
+    visited.add(file);
+    const bytes = await readFile(file);
+    sources.push(Buffer.from(`// ${file.slice(packageRoot.length)}
+`), bytes);
+    if (kind === "asset" || kind === "data") continue;
+    const source = bytes.toString("utf8");
+    if (kind === "css") {
+      assertScopedCss(source, file);
+      for (const specifier of cssRelativeSpecifiers(source, file)) {
+        pending.push(await resolveRelativeModule(packageRoot, file, specifier));
+      }
+      continue;
+    }
+    if (containsLikelyHardCodedCredential(source)) {
+      throw new Error(`entry module contains a likely hard-coded credential: ${file}`);
+    }
+    assertDeclaredNetworkOrigins(source, file, allowedOrigins);
+    if (/\brequire\s*\(/.test(source))
+      throw new Error(`entry module uses require(), which is not browser-safe: ${file}`);
+    let imports;
+    try {
+      const transformed = await transform(source, {
+        loader: esbuildLoader(file),
+        format: "esm",
+        jsx: "automatic",
+        sourcemap: false,
+        sourcefile: file
+      });
+      [imports] = parse(transformed.code);
+    } catch (error) {
+      throw new Error(
+        `entry module cannot be parsed: ${file}: ${error instanceof Error ? error.message : String(error)}`
+      );
+    }
+    for (const imported of imports) {
+      const specifier = imported.n;
+      if (!specifier) throw new Error(`entry module uses a non-literal dynamic import: ${file}`);
+      if (imported.d >= 0) throw new Error(`entry module uses dynamic import(), which is not supported: ${file}`);
+      if (specifier.startsWith("node:")) throw new Error(`entry imports Node.js module: ${specifier}`);
+      if (specifier.startsWith(".")) {
+        pending.push(await resolveRelativeModule(packageRoot, file, specifier));
+        continue;
+      }
+      if (!IMPORT_ALLOWLIST.has(specifier)) throw new Error(`entry imports non-public dependency: ${specifier}`);
+    }
+  }
+  return { gzipBytes: gzipSync(Buffer.concat(sources)).byteLength, files: [...visited] };
+}
+async function auditBrandPackage(manifestFile2, options = {}) {
+  const absoluteManifest = await realpath(resolve(manifestFile2));
+  const packageRoot = await realpath(resolve(absoluteManifest, ".."));
+  const raw = JSON.parse(await readFile(absoluteManifest, "utf8"));
+  const parsed = parseBrandManifest(raw, { platform: options.platform === true });
+  if (!parsed.ok) throw new Error(`manifest contract failed: ${parsed.error}`);
+  const manifest = parsed.manifest;
+  const checkedAssets = [];
+  for (const [kind, relative] of Object.entries(manifest.assets)) {
+    await assertAsset(packageRoot, relative, kind);
+    checkedAssets.push(relative);
+  }
+  let entryGzipBytes = 0;
+  let checkedModules = [];
+  const checkedLocales = manifest.locales ? await auditLocaleDictionaries(packageRoot, manifest.locales) : [];
+  if (manifest.entry) {
+    const entryFile = await resolvePackageFile(packageRoot, manifest.entry, "entry");
+    const graph = await auditEntryModuleGraph(
+      packageRoot,
+      entryFile,
+      /* @__PURE__ */ new Set([...manifest.network?.allowedOrigins ?? [], ...options.developmentAllowedOrigins ?? []])
+    );
+    entryGzipBytes = graph.gzipBytes;
+    checkedModules = graph.files.map((file) => `.${file.slice(packageRoot.length)}`);
+    if (entryGzipBytes > ENTRY_GZIP_BUDGET) {
+      throw new Error(`entry gzip size ${entryGzipBytes} exceeds ${ENTRY_GZIP_BUDGET} byte budget`);
+    }
+  }
+  return { manifest, entryGzipBytes, checkedAssets, checkedModules, checkedLocales };
+}
+
+// src/cli.ts
+var manifestFile = process.argv[2];
+if (manifestFile === "--help" || manifestFile === "-h") {
+  console.log("Usage: orbit-audit-brand <path/to/orbit-brand.json>");
+} else if (!manifestFile) {
+  console.error("Usage: orbit-audit-brand <path/to/orbit-brand.json>");
+  process.exitCode = 2;
+} else {
+  try {
+    const report = await auditBrandPackage(manifestFile);
+    console.log(
+      `\u2713 ${report.manifest.id}: ${report.checkedAssets.length} assets, ${report.checkedLocales.length} locale packs, ${report.checkedModules.length} entry modules, ${report.entryGzipBytes} module-graph gzip bytes`
+    );
+  } catch (cause) {
+    console.error(`\u2717 brand audit failed: ${cause instanceof Error ? cause.message : String(cause)}`);
+    process.exitCode = 1;
+  }
+}
+//# sourceMappingURL=audit-brand.js.map
+//# sourceMappingURL=audit-brand.js.map