@palate/cli 0.0.0-stage → 0.0.1

package/src/auth.mjs

@@ -0,0 +1,416 @@
+// Invite-code activation. palate asks for a code once, checks it with the waitlist site once, then runs offline.
+// Only the code and a random machine id are ever sent; nothing about the user's projects, taste or machine.
+//
+// The site answers with a signed licence (Ed25519, 45 days, for this machine only), renewed every 14 days.
+// palate checks it offline against the public keys below, so a licence can't be faked, edited or copied to
+// another machine, and a revoked code runs out. It's still local JavaScript: anyone can edit this file to skip
+// the check. The real control is who gets the package and a code. No obfuscation, on purpose.
+import { spawn } from "node:child_process";
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { PALATE_HOME } from "./catalog/store.mjs";
+
+const DEFAULT_SITE = "https://palate.sh"; // The site (Cloudflare Workers).
+export const SITE = (process.env.PALATE_SITE || DEFAULT_SITE).replace(/\/+$/, "");
+
+const AUTH_FILE = path.join(PALATE_HOME, "auth.json");
+const MACHINE_FILE = path.join(PALATE_HOME, "machine-id");
+const REVOKED_FILE = path.join(PALATE_HOME, "revoked.json");
+const DAY_MS = 24 * 3600_000;
+const RECHECK_MS = 14 * DAY_MS; // re-check at most every 14 days
+const RETRY_MS = 3600_000; // after a failed re-check (offline), try again at most once an hour
+const TIMEOUT_MS = 10_000;
+export const CODE_RE = /^palate-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}$/i;
+
+// ---------- licence keys ----------
+// The Ed25519 public keys whose licences palate accepts (kid = first 16 hex of SHA-256 of the raw key; x = the raw
+// key, base64url). To rotate: add the new key here and release palate, then switch LICENSE_SIGNING_KEY on the site;
+// drop the old key in a later release, once the licences it signed have expired (45 days).
+export const LICENCE_KEYS = Object.freeze([{ kid: "27a296b4e3b23b79", x: "BTCxGdPNLnakkZJfPMw1Zj8Nm49HYdMpEeRzmszhmLo" }]);
+const GRACE_MS = 14 * DAY_MS; // an expired licence still works this long while the site can't be reached
+const RENEW_MS = 31 * DAY_MS; // renew once a licence has less than this left (it lasts 45 days, so after 14)
+const TRANSITION_MS = 14 * DAY_MS; // an activation from before licences works this long without one
+const TRANSITION_ENDS = Date.parse("2027-02-01T00:00:00Z"); // and never past this date
+const LICENCE_RE = /^[A-Za-z0-9_-]{16,3000}\.[A-Za-z0-9_-]{16,200}$/;
+export const CHECK_ONCE = "palate needs to check your invite once: connect and run any palate command.";
+const UNVERIFIED = "Your palate licence couldn't be verified: run palate activate again.";
+const OTHER_MACHINE = "This palate licence belongs to another machine: run palate activate <your code> on this one.";
+
+const siteHost = () => {
+  try {
+    return new URL(SITE).host;
+  } catch {
+    return SITE;
+  }
+};
+
+// ---------- free and invite-only ----------
+// Free, with no code: everything that checks and finishes a page you already have (the guard, copy, check, shoot,
+// the finishing pass, the quality gate) and the licence-clean imagery. Invite-only: building from your taste
+// (plan's build briefs, blueprints, research, directions, variants), pointing at what's wrong, critique and fixes,
+// and the rules and taste palate learns. What the free commands record stays in ~/.palate and is there on activation.
+export const FREE_COMMANDS = Object.freeze(new Set(["check", "copy", "guard", "waive", "shoot", "finish", "states", "details", "animate", "gate", "section", "imagery", "texture", "icons", "context", "plan", "stats"]));
+export const FREE_TOOLS = Object.freeze(new Set(["palate_check", "palate_section", "palate_copy", "palate_guard", "palate_waive", "palate_shoot", "palate_finish", "palate_states", "palate_details", "palate_animate", "palate_gate", "palate_imagery", "palate_texture", "palate_icons", "palate_context", "palate_plan", "palate_stats", "palate_activate"]));
+export const FREE_LIST = "palate guard, copy, check, shoot, finish, states, details, animate, gate, imagery, texture and icons";
+
+export const gateMessage = () => `This part of palate is invite-only: building from your taste, research and directions, variants, pointing at what's wrong, and the rules palate learns. Activate with: palate activate <your code>. No code yet? Join the waitlist at ${SITE}. Free without a code: ${FREE_LIST}.`;
+
+// Never print the whole code after activation: palate-XXXX-XX34.
+export const maskCode = (code) => (typeof code === "string" && code.length >= 2 ? `palate-XXXX-XXXX-XX${code.slice(-2)}` : "palate-XXXX-XXXX-XXXX");
+
+// Server text is printed only after this: no control characters (no terminal escapes), bounded length.
+const CONTROL = new RegExp("[\u0000-\u001f\u007f-\u009f\u200b-\u200f\u2028-\u202e\u2066-\u2069]", "g");
+const clean = (s, max = 254) => String(s).replace(CONTROL, "").slice(0, max);
+
+// ---------- the development checkout ----------
+// Running from a git checkout of the palate repo counts as activated, so the gate never gets in the way of
+// developing palate. It needs a real git repo (a .git directory, or a git worktree's .git file pointing at
+// an existing git dir) at the repo root above packages/palate, plus the repo's own skill file. An npm install
+// lives in node_modules/@palate/cli, so it never qualifies. There is no environment variable for this.
+const PKG_DIR = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+export function devCheckout() {
+  if (path.basename(path.dirname(PKG_DIR)) !== "packages") return null;
+  const root = path.resolve(PKG_DIR, "../..");
+  if (!fs.existsSync(path.join(root, "skill", "palate", "SKILL.md"))) return null;
+  const git = path.join(root, ".git");
+  try {
+    const st = fs.statSync(git);
+    if (st.isDirectory()) return fs.existsSync(path.join(git, "HEAD")) ? root : null;
+    if (st.isFile()) {
+      const m = /^gitdir:\s*(.+)\s*$/m.exec(fs.readFileSync(git, "utf8"));
+      const dir = m && path.resolve(root, m[1].trim());
+      return dir && fs.statSync(dir).isDirectory() && fs.existsSync(path.join(dir, "HEAD")) ? root : null;
+    }
+  } catch {}
+  return null;
+}
+
+// ---------- local files (owner-only) ----------
+function writePrivate(file, data) {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, data, { mode: 0o600 });
+  // mode only applies when the file is created; tighten an existing one too. On Windows this is a no-op and
+  // the user profile's ACL (only the user and administrators) protects ~/.palate.
+  try {
+    fs.chmodSync(file, 0o600);
+  } catch {}
+}
+
+const readJson = (file) => {
+  try {
+    return JSON.parse(fs.readFileSync(file, "utf8"));
+  } catch {
+    return null;
+  }
+};
+
+export function readAuth() {
+  const a = readJson(AUTH_FILE);
+  return a && typeof a.code === "string" && CODE_RE.test(a.code) ? a : null;
+}
+
+// A random id, made once. Never derived from hardware, hostname or username.
+export function machineId() {
+  try {
+    const id = fs.readFileSync(MACHINE_FILE, "utf8").trim();
+    if (/^[0-9a-f-]{36}$/i.test(id)) return id;
+  } catch {}
+  const id = crypto.randomUUID();
+  writePrivate(MACHINE_FILE, id + "\n");
+  return id;
+}
+
+const writeAuth = (a) => writePrivate(AUTH_FILE, JSON.stringify(a, null, 2) + "\n");
+
+// ---------- licences ----------
+// A licence is base64url(JSON payload) + "." + base64url(Ed25519 signature over the first part), with
+// payload { v: 1, kid, sub, email, machine: sha256(machine id), plan, iat, exp } (seconds).
+export const hashMachine = (id) => crypto.createHash("sha256").update(id).digest("hex");
+
+const keyCache = new Map();
+const publicKey = (k) => {
+  if (!keyCache.has(k.x)) keyCache.set(k.x, crypto.createPublicKey({ key: { kty: "OKP", crv: "Ed25519", x: k.x }, format: "jwk" }));
+  return keyCache.get(k.x);
+};
+
+// The payload when `token` carries a good signature from one of `keys` and a well-formed payload; else null. Never throws.
+export function verifyLicence(token, keys = LICENCE_KEYS) {
+  if (typeof token !== "string" || !LICENCE_RE.test(token)) return null;
+  const [body, sig] = token.split(".");
+  try {
+    const p = JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
+    const key = keys.find((k) => k.kid === p?.kid);
+    if (!key || !crypto.verify(null, Buffer.from(body), publicKey(key), Buffer.from(sig, "base64url"))) return null;
+    const ok = p.v === 1 && typeof p.sub === "string" && typeof p.email === "string" && /^[0-9a-f]{64}$/.test(p.machine) && typeof p.plan === "string" && Number.isFinite(p.iat) && Number.isFinite(p.exp);
+    return ok ? p : null;
+  } catch {
+    return null;
+  }
+}
+
+// Scheduling only (when to renew): the expiry a stored licence claims, without checking it.
+const claimedExp = (token) => {
+  try {
+    return JSON.parse(Buffer.from(String(token).split(".")[0], "base64url").toString("utf8")).exp * 1000 || 0;
+  } catch {
+    return 0;
+  }
+};
+
+// A licence from the site is kept only when it verifies and names this machine.
+function forThisMachine(token, keys) {
+  const p = verifyLicence(token, keys);
+  return p && p.machine === hashMachine(machineId()) ? token : undefined;
+}
+
+// What the stored licence says now: valid, grace (expired under 14 days ago), expired, missing, invalid or other-machine.
+export function licenceState(a, { keys = LICENCE_KEYS, now = Date.now() } = {}) {
+  if (a.licence === undefined) return { state: "missing" };
+  const p = verifyLicence(a.licence, keys);
+  // The email beside the licence must be the one inside it, so editing either one fails.
+  if (!p || typeof a.email !== "string" || a.email.toLowerCase() !== p.email.toLowerCase()) return { state: "invalid" };
+  if (p.machine !== hashMachine(machineId())) return { state: "other-machine", p };
+  const exp = p.exp * 1000;
+  return { state: now < exp ? "valid" : now < exp + GRACE_MS ? "grace" : "expired", p, exp };
+}
+
+// ---------- talking to the site ----------
+class SiteError extends Error {}
+
+function endpoint(p) {
+  let u;
+  try {
+    u = new URL(SITE + p);
+  } catch {
+    throw new SiteError(`PALATE_SITE isn't a valid address: ${clean(SITE, 120)}`);
+  }
+  const local = ["localhost", "127.0.0.1", "[::1]"].includes(u.hostname);
+  if (u.protocol !== "https:" && !(u.protocol === "http:" && local)) throw new SiteError(`palate only talks to its site over HTTPS (got ${clean(u.origin, 120)}).`);
+  return u;
+}
+
+// POST { code, machine } and nothing else. Returns { ok: true, email, activatedAt, licence? } or { ok: false, error }.
+async function post(p, code) {
+  const url = endpoint(p);
+  let res;
+  try {
+    res = await fetch(url, {
+      method: "POST",
+      headers: { "content-type": "application/json", accept: "application/json" },
+      body: JSON.stringify({ code, machine: machineId() }),
+      redirect: "error", // never follow a redirect (no downgrade to http, no other host)
+      signal: AbortSignal.timeout(TIMEOUT_MS),
+    });
+  } catch {
+    throw new SiteError(`Can't reach ${siteHost()}; check your connection and try again.`);
+  }
+  // Too many attempts: the site says when to try again (Retry-After, in seconds); only that number is used.
+  if (res.status === 429) {
+    const secs = Number.parseInt(res.headers.get("retry-after") ?? "", 10);
+    const mins = Number.isFinite(secs) && secs > 0 ? Math.min(180, Math.ceil(secs / 60)) : 60;
+    throw new SiteError(`Too many attempts from this network. Try again in ${mins} minute${mins === 1 ? "" : "s"}.`);
+  }
+  let body;
+  try {
+    const raw = await res.text();
+    body = raw.length <= 16_384 ? JSON.parse(raw) : null;
+  } catch {
+    body = null;
+  }
+  // Strict shape: anything else is "an unexpected answer", and none of its text is shown.
+  if (body?.ok === true && typeof body.email === "string" && body.email.length <= 254 && typeof body.activatedAt === "string" && !Number.isNaN(Date.parse(body.activatedAt)))
+    return {
+      ok: true,
+      email: clean(body.email),
+      activatedAt: new Date(body.activatedAt).toISOString(),
+      licence: typeof body.licence === "string" && LICENCE_RE.test(body.licence) ? body.licence : undefined,
+    };
+  if (body?.ok === false && ["invalid", "revoked", "limit"].includes(body.error)) return { ok: false, error: body.error };
+  throw new SiteError(`${siteHost()} gave an unexpected answer (HTTP ${res.status}); try again in a minute.`);
+}
+
+const ERRORS = {
+  invalid: "That code isn't valid. Check it against your invite email (codes look like palate-XXXX-XXXX-XXXX).",
+  revoked: "That code has been revoked. If you think that's a mistake, reply to your invite email.",
+  limit: "That code is already active on as many machines as it allows. Reply to your invite email to move it to this one.",
+};
+
+// ---------- activate / deactivate / status ----------
+// `keys` is for tests (a test key pair); palate itself always uses LICENCE_KEYS.
+export async function activate(input, { mcp = false, keys } = {}) {
+  const code = String(input ?? "").trim();
+  if (!CODE_RE.test(code)) throw new Error("That doesn't look like a palate code. Codes look like palate-XXXX-XXXX-XXXX (from your invite email).");
+  const r = await post("/api/activate", code);
+  if (!r.ok) throw new Error(ERRORS[r.error]);
+  const now = new Date().toISOString();
+  const licence = forThisMachine(r.licence, keys);
+  writeAuth({ code, email: r.email, activatedAt: r.activatedAt, checkedAt: now, ...(licence ? { licence } : {}) });
+  fs.rmSync(REVOKED_FILE, { force: true });
+  const next = mcp
+    ? "Next: ask for a screen in your own words, e.g. \"make the pricing section\"."
+    : "Next: connect palate to your agent (Claude Code: claude mcp add palate -- npx @palate/cli mcp), then ask for a screen in your own words.";
+  return `Welcome to palate, ${r.email}. You're in.\n${next}\nEverything palate learns about your taste stays in ${PALATE_HOME} on this machine.`;
+}
+
+export function deactivate() {
+  const had = readAuth();
+  fs.rmSync(AUTH_FILE, { force: true });
+  fs.rmSync(REVOKED_FILE, { force: true });
+  return had ? `palate is deactivated on this machine (${maskCode(had.code)}). Activate again with: palate activate <your code>.` : "palate wasn't activated on this machine.";
+}
+
+const day = (t) => {
+  const d = new Date(t ?? NaN);
+  return t && Number.isFinite(d.getTime()) ? d.toISOString().slice(0, 10) : "never";
+};
+
+function licenceLine(a, opts) {
+  const L = licenceState(a, opts);
+  const plan = L.p ? clean(L.p.plan, 40) : "";
+  switch (L.state) {
+    case "valid":
+      return `Licence: ${plan} plan, valid until ${day(L.exp)}, signed ✓. It renews by itself every 14 days.`;
+    case "grace":
+      return `Licence: ${plan} plan, signed ✓, expired on ${day(L.exp)} and not renewed yet (offline?). palate keeps working until ${day(L.exp + GRACE_MS)}.`;
+    case "expired":
+      return `Licence: expired on ${day(L.exp)}. ${CHECK_ONCE}`;
+    case "missing": {
+      const since = Date.parse(a.licenceMissingSince ?? "") || Date.now();
+      return `Licence: none yet; palate fetches one at its next check (it works without one until ${day(Math.min(since + TRANSITION_MS, TRANSITION_ENDS))}).`;
+    }
+    case "other-machine":
+      return OTHER_MACHINE;
+    default:
+      return UNVERIFIED;
+  }
+}
+
+export function status(opts) {
+  const dev = devCheckout();
+  const a = readAuth();
+  const revoked = readJson(REVOKED_FILE);
+  const lines = [];
+  if (a) {
+    lines.push(`Activated as ${clean(a.email ?? "")} with ${maskCode(a.code)}, on ${day(a.activatedAt)}.`);
+    lines.push(licenceLine(a, opts));
+    lines.push(`Last checked ${day(a.checkedAt)}; the next check is after ${day(Date.parse(a.checkedAt ?? a.activatedAt) + RECHECK_MS)} (in the background, only when online).`);
+  }
+  if (dev) lines.push(`Activated (development checkout): running from the palate repo at ${dev}; no code needed here.`);
+  if (!a && !dev) {
+    if (revoked) lines.push(revokedNote(revoked));
+    lines.push(`Not activated. ${gateMessage()}`);
+  }
+  lines.push(`Site: ${SITE}. Only your code and a random machine id are sent, once at activation and at most every 14 days after.`);
+  return lines.join("\n");
+}
+
+const revokedNote = (r) => `Your invite code (${maskCode(r.code)}) was revoked on ${day(r.at)}, so palate was deactivated on this machine.`;
+
+// ---------- the gate ----------
+// { ok, dev, note?, message?, refresh? }. ok in a development checkout, or with a licence that verifies, names this
+// machine and hasn't expired (or expired under 14 days ago: ok with a note). refresh: a re-check would fix it.
+export function gate(opts) {
+  if (devCheckout()) return { ok: true, dev: true };
+  return licenceGate(opts);
+}
+
+// The gate without the development-checkout pass (tests call this directly).
+export function licenceGate({ keys = LICENCE_KEYS, now = Date.now() } = {}) {
+  const a = readAuth();
+  if (!a) {
+    const revoked = readJson(REVOKED_FILE);
+    return { ok: false, dev: false, message: (revoked ? revokedNote(revoked) + "\n" : "") + gateMessage() };
+  }
+  const L = licenceState(a, { keys, now });
+  switch (L.state) {
+    case "valid":
+      return { ok: true, dev: false };
+    case "grace":
+      return {
+        ok: true,
+        dev: false,
+        grace: true,
+        note: `palate couldn't reach ${siteHost()} to renew its licence (offline?). It keeps working until ${day(L.exp + GRACE_MS)} and renews by itself once you're online.`,
+      };
+    case "expired":
+      return { ok: false, dev: false, refresh: true, message: CHECK_ONCE };
+    case "missing": {
+      // An activation from before licences (or a site that issued none): one 14-day window from first seeing it,
+      // while the re-check fetches a licence.
+      let since = Date.parse(a.licenceMissingSince ?? "");
+      if (!Number.isFinite(since) || since > now) {
+        since = now;
+        writeAuth({ ...a, licenceMissingSince: new Date(now).toISOString() });
+      }
+      if (now - since < TRANSITION_MS && now < TRANSITION_ENDS) return { ok: true, dev: false };
+      return { ok: false, dev: false, refresh: true, message: CHECK_ONCE };
+    }
+    case "other-machine":
+      return { ok: false, dev: false, message: OTHER_MACHINE };
+    default:
+      return { ok: false, dev: false, message: UNVERIFIED };
+  }
+}
+
+// The gate for a command about to run: when a re-check would fix it (no licence past the transition, expired),
+// or the licence is in its grace days, re-check first and decide again. Offline, that costs one short wait.
+// (`check` is for tests, which run from the development checkout and so pass licenceGate.)
+export async function ensureGate(opts = {}, check = gate) {
+  let g = check(opts);
+  if (g.refresh || g.grace) {
+    await recheck({ ...opts, force: Boolean(g.refresh) }).catch(() => {});
+    g = check(opts);
+  }
+  return g;
+}
+
+// ---------- re-check ----------
+function recheckDue(a, now = Date.now()) {
+  const last = Date.parse(a.checkedAt ?? a.activatedAt ?? 0) || 0;
+  const tried = Date.parse(a.attemptedAt ?? 0) || 0;
+  const renew = a.licence === undefined || claimedExp(a.licence) - now < RENEW_MS;
+  return (renew || now - last > RECHECK_MS) && now - tried > RETRY_MS;
+}
+
+// Runs the check now (when due, or always with force). Offline or any error: nothing changes (the licence and its
+// grace days decide). Good: the licence is renewed. Revoked: deactivate, and the next run says so.
+export async function recheck({ force = false, keys, now = Date.now() } = {}) {
+  const a = readAuth();
+  if (!a || (!force && !recheckDue(a, now))) return "not due";
+  writeAuth({ ...a, attemptedAt: new Date(now).toISOString() });
+  let r;
+  try {
+    r = await post("/api/activate/check", a.code);
+  } catch {
+    return "unreachable";
+  }
+  if (r.ok) {
+    const { attemptedAt, licenceMissingSince, ...rest } = a;
+    const licence = forThisMachine(r.licence, keys);
+    // Without a new licence, the old one (and the email inside it) stays, and so does the transition's start.
+    const next = licence
+      ? { ...rest, email: r.email, licence }
+      : { ...rest, email: a.licence === undefined ? r.email : a.email, ...(licenceMissingSince ? { licenceMissingSince } : {}) };
+    writeAuth({ ...next, checkedAt: new Date().toISOString() });
+    return "ok";
+  }
+  if (r.error === "revoked") {
+    writePrivate(REVOKED_FILE, JSON.stringify({ code: a.code, at: new Date().toISOString() }, null, 2) + "\n");
+    fs.rmSync(AUTH_FILE, { force: true });
+    return "revoked";
+  }
+  return r.error; // invalid or limit on a re-check: the current licence runs out by itself
+}
+
+// Starts a due re-check without slowing anything down: in this process for the long-lived MCP server,
+// otherwise in a detached child so the command exits at once.
+export function maybeRecheck({ inProcess = false } = {}) {
+  const a = readAuth();
+  if (!a || !recheckDue(a)) return;
+  if (inProcess) return void recheck().catch(() => {});
+  try {
+    spawn(process.execPath, [path.join(PKG_DIR, "src", "auth-recheck.mjs")], { detached: true, stdio: "ignore", windowsHide: true }).unref();
+  } catch {}
+}

package/src/capture.mjs

@@ -0,0 +1,182 @@
+// `palate capture <url>`: look at any public page on the internet the way palate looks at its own work.
+// Screenshots the first screen and the full page, and measures its design system from the DOM:
+// fonts and how much each is used, the type scale, colours, radii and content width. No model calls.
+import fs from "node:fs";
+import path from "node:path";
+import { chromium } from "playwright-core";
+import { CACHE_DIR } from "./catalog/store.mjs";
+
+async function launch() {
+  if (process.env.PALATE_BROWSER) return chromium.launch({ executablePath: process.env.PALATE_BROWSER });
+  for (const channel of ["chrome", "msedge", "chromium"]) {
+    try {
+      return await chromium.launch({ channel });
+    } catch {}
+  }
+  throw new Error("No Chrome or Edge found. Install one, or set PALATE_BROWSER.");
+}
+
+export const MEASURE = `(() => {
+  const vis = (el) => { const r = el.getBoundingClientRect(); const cs = getComputedStyle(el); return r.width > 0 && r.height > 0 && cs.visibility !== "hidden" && cs.display !== "none"; };
+  const sizes = new Map(), fams = new Map(), colors = new Map(), bgs = new Map(), radii = new Map(), weights = new Map();
+  let maxRight = 0, minLeft = innerWidth, headline = { size: 0, text: "", family: "", weight: "", tracking: "", leading: "" };
+  const bump = (m, k, n = 1) => m.set(k, (m.get(k) || 0) + n);
+  for (const el of document.body.querySelectorAll("*")) {
+    if (!vis(el) || el.closest("svg")) continue;
+    const cs = getComputedStyle(el);
+    const own = Array.from(el.childNodes).filter(n => n.nodeType === 3).map(n => n.textContent).join("").trim();
+    if (cs.backgroundColor !== "rgba(0, 0, 0, 0)") bump(bgs, cs.backgroundColor, el.getBoundingClientRect().width * el.getBoundingClientRect().height);
+    if (cs.borderTopLeftRadius !== "0px") bump(radii, parseFloat(cs.borderTopLeftRadius) > 999 ? "pill" : cs.borderTopLeftRadius);
+    if (!own) continue;
+    const r = el.getBoundingClientRect();
+    const size = parseFloat(cs.fontSize);
+    bump(sizes, Math.round(size), own.length);
+    bump(fams, cs.fontFamily.split(",")[0].replace(/["']/g, "").trim(), own.length);
+    bump(colors, cs.color, own.length);
+    bump(weights, cs.fontWeight, own.length);
+    if (r.top < innerHeight) { minLeft = Math.min(minLeft, r.left); maxRight = Math.max(maxRight, r.right); }
+    if (r.top < innerHeight * 1.2 && size > headline.size) headline = { size, text: own.slice(0, 80), family: cs.fontFamily.split(",")[0].replace(/["']/g, ""), weight: cs.fontWeight, tracking: cs.letterSpacing, leading: cs.lineHeight };
+  }
+  const top = (m, n) => [...m.entries()].sort((a, b) => b[1] - a[1]).slice(0, n).map(([k]) => k);
+  return {
+    title: document.title,
+    pageHeight: document.documentElement.scrollHeight,
+    headline,
+    fonts: top(fams, 4),
+    typeScale: [...sizes.keys()].sort((a, b) => b - a).slice(0, 10),
+    bodySize: top(sizes, 1)[0],
+    weights: top(weights, 4),
+    textColors: top(colors, 4),
+    backgrounds: top(bgs, 5),
+    radii: top(radii, 4),
+    contentWidth: Math.round(maxRight - minLeft),
+  };
+})()`;
+
+const slugFor = (url) => {
+  const u = new URL(url);
+  return (u.hostname + u.pathname).replace(/[^a-z0-9]+/gi, "-").replace(/-+$/, "");
+};
+
+// palate's own record of a site it has captured before (used to improve future picks).
+export function measuresFor(url) {
+  try {
+    const file = path.join(CACHE_DIR, "captures", slugFor(url), "measures.json");
+    return JSON.parse(fs.readFileSync(file, "utf8")).measures?.[1440];
+  } catch {
+    return undefined;
+  }
+}
+
+// Headings that mark where a section lives on a page, so a "pricing" pick shows the pricing, not the hero.
+const FOCUS = {
+  pricing: "pricing|plans|choose your plan",
+  faq: "faq|frequently asked|questions",
+  testimonials: "testimonial|what (people|customers|teams) (say|think)|loved by|wall of love|reviews|customers",
+  "logo-cloud": "trusted by|used by|powering|loved by teams|companies",
+  stats: "by the numbers|in numbers|scale",
+  integrations: "integrat|connect|works with",
+  "how-it-works": "how it works|how .* works|get started in",
+  features: "features|everything you need|built for",
+  changelog: "changelog|what's new|release",
+  customers: "customers|stories|case stud",
+};
+
+export async function capture(url, { widths = [1440], full = true, shelf } = {}) {
+  const slug = slugFor(url);
+  const outDir = path.join(CACHE_DIR, "captures", slug);
+  fs.mkdirSync(outDir, { recursive: true });
+  const browser = await launch();
+  const result = { url, files: [], measures: {} };
+  try {
+    for (const width of widths) {
+      const ctx = await browser.newContext({ viewport: { width, height: width < 600 ? 844 : 900 }, userAgent: undefined });
+      const page = await ctx.newPage();
+      await page.goto(url, { waitUntil: "domcontentloaded", timeout: 45_000 });
+      await page.waitForLoadState("networkidle", { timeout: 15_000 }).catch(() => {});
+      // Cookie banners: decline, never accept. With no decline button, hide the banner from the screenshot without
+      // answering it (the same as palate research).
+      let declined = false;
+      for (const label of ["Reject all", "Reject All", "Reject", "Decline", "Decline all", "Only necessary", "Necessary only", "Use necessary cookies only", "Deny"]) {
+        const b = page.getByRole("button", { name: label, exact: true }).first();
+        if (await b.isVisible().catch(() => false)) {
+          await b.click({ timeout: 2000 }).catch(() => {});
+          declined = true;
+          break;
+        }
+      }
+      if (!declined)
+        await page
+          .evaluate(() => {
+            for (const el of document.querySelectorAll('[id*="cookie" i],[class*="cookie" i],[id*="consent" i],[class*="consent" i],[aria-label*="cookie" i],#onetrust-banner-sdk,#CybotCookiebotDialog,.cc-window')) {
+              const p = getComputedStyle(el).position;
+              if (p === "fixed" || p === "sticky") el.style.setProperty("display", "none", "important");
+            }
+          })
+          .catch(() => {});
+      await page.waitForTimeout(1200);
+      const fold = path.join(outDir, `w${width}-fold.png`);
+      await page.screenshot({ path: fold });
+      result.files.push(fold);
+      // A section pick: also screenshot the part of the page where that section lives.
+      if (shelf && shelf !== "hero" && shelf !== "website") {
+        const found = await page.evaluate(
+          ([pattern, isFooter]) => {
+            if (isFooter) {
+              window.scrollTo(0, document.documentElement.scrollHeight);
+              return true;
+            }
+            const re = new RegExp(pattern, "i");
+            const h = Array.from(document.querySelectorAll("h1,h2,h3,[role=heading]")).find((el) => re.test(el.textContent || "") && el.getBoundingClientRect().height > 0);
+            if (!h) return false;
+            h.scrollIntoView({ block: "start" });
+            window.scrollBy(0, -96);
+            return true;
+          },
+          [FOCUS[shelf] ?? shelf.replace(/-/g, " "), shelf === "footer" || shelf === "cta"],
+        );
+        if (found) {
+          await page.waitForTimeout(900);
+          const focus = path.join(outDir, `w${width}-${shelf}.png`);
+          await page.screenshot({ path: focus });
+          result.files.unshift(focus);
+          result.focus = shelf;
+        }
+        await page.evaluate(() => window.scrollTo(0, 0));
+      }
+      if (full) {
+        await page.evaluate(async () => {
+          for (let y = 0; y < Math.min(document.documentElement.scrollHeight, 9000); y += 700) {
+            window.scrollTo(0, y);
+            await new Promise((r) => setTimeout(r, 150));
+          }
+          window.scrollTo(0, 0);
+        });
+        const fullFile = path.join(outDir, `w${width}-full.jpg`);
+        await page.screenshot({ path: fullFile, fullPage: true, type: "jpeg", quality: 70, clip: undefined }).catch(() => {});
+        if (fs.existsSync(fullFile)) result.files.push(fullFile);
+      }
+      result.measures[width] = await page.evaluate(MEASURE);
+      await ctx.close();
+    }
+  } finally {
+    await browser.close();
+  }
+  fs.writeFileSync(path.join(outDir, "measures.json"), JSON.stringify(result, null, 2));
+  return result;
+}
+
+export function captureReport(res) {
+  const out = [`# ${res.url}`, ""];
+  for (const [w, m] of Object.entries(res.measures)) {
+    out.push(`## ${w}px · ${m.title}`);
+    out.push(`- Headline: ${m.headline.size}px ${m.headline.family} weight ${m.headline.weight}, tracking ${m.headline.tracking}, leading ${m.headline.leading}: "${m.headline.text}"`);
+    out.push(`- Fonts by use: ${m.fonts.join(", ")} · weights ${m.weights.join(", ")}`);
+    out.push(`- Type scale (px): ${m.typeScale.join(", ")} · body ${m.bodySize}px`);
+    out.push(`- Text colours: ${m.textColors.join(" · ")}`);
+    out.push(`- Main backgrounds: ${m.backgrounds.join(" · ")}`);
+    out.push(`- Radii: ${m.radii.join(", ") || "none"} · first-screen content width ${m.contentWidth}px · page ${m.pageHeight}px tall`);
+  }
+  out.push("", `Screenshots: ${res.files.join(" , ")}`);
+  return out.join("\n");
+}