@proappstore/compliance 0.1.0

package/dist/lib/file-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-source.js","sourceRoot":"","sources":["../../src/lib/file-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAehD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,MAAM;IACN,cAAc;IACd,MAAM;IACN,OAAO;IACP,QAAQ;IACR,WAAW;IACX,QAAQ;CACT,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,OAAO;QACL,KAAK,CAAC,CAAC,IAAI;YACT,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAChC,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,IAAI;YACb,IAAI,YAAY,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpC,IAAI,CAAC;gBACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;YACrD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,IAAI;YAClB,IAAI,YAAY,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;gBAChD,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;YAC7B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,GAAG;YACf,IAAI,YAAY,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnC,IAAI,CAAC;gBACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;YAC3C,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,6DAA6D;AAC7D,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,WAAW;IAC7E,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;AACzD,CAAC;AAED,KAAK,SAAS,CAAC,CAAC,IAAI,CAAC,GAAW,EAAE,IAAY;IAC5C,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAS;YACxC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC1B,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1B,iEAAiE;YACjE,+BAA+B;YAC/B,MAAM,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,KAA0B;IACtD,OAAO;QACL,KAAK,CAAC,CAAC,IAAI;YACT,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;gBAChC,IAAI,aAAa,CAAC,IAAI,CAAC;oBAAE,SAAS;gBAClC,MAAM,IAAI,CAAC;YACb,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,IAAI;YACb,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;QACjC,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,IAAI;YAClB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC7B,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACpC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxC,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,GAAG;YACf,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC;YACnD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;YACnC,IAAI,GAAG,GAAG,KAAK,CAAC;YAChB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;gBAChC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;oBAAE,SAAS;gBACvC,GAAG,GAAG,IAAI,CAAC;gBACX,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACvC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAChC,QAAQ,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;YAC3D,CAAC;YACD,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IACtC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/lib/gzip.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Gzip via the Web Streams API. Available in Node 18+ and Cloudflare
+ * Workers, so the same helper works in both the CLI's filesystem
+ * checks and the audit Worker's live checks. Avoids divergence
+ * between source-side and live measurements of bundle size.
+ */
+export declare function gzipByteLength(input: Uint8Array): Promise<number>;
+//# sourceMappingURL=gzip.d.ts.map

package/dist/lib/gzip.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gzip.d.ts","sourceRoot":"","sources":["../../src/lib/gzip.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBvE"}

package/dist/lib/gzip.js

@@ -0,0 +1,26 @@
+/**
+ * Gzip via the Web Streams API. Available in Node 18+ and Cloudflare
+ * Workers, so the same helper works in both the CLI's filesystem
+ * checks and the audit Worker's live checks. Avoids divergence
+ * between source-side and live measurements of bundle size.
+ */
+export async function gzipByteLength(input) {
+    const readable = new ReadableStream({
+        start(controller) {
+            controller.enqueue(input);
+            controller.close();
+        },
+    });
+    const compressed = readable.pipeThrough(new CompressionStream('gzip'));
+    const reader = compressed.getReader();
+    let total = 0;
+    for (;;) {
+        const { value, done } = await reader.read();
+        if (done)
+            break;
+        if (value)
+            total += value.byteLength;
+    }
+    return total;
+}
+//# sourceMappingURL=gzip.js.map

package/dist/lib/gzip.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gzip.js","sourceRoot":"","sources":["../../src/lib/gzip.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAiB;IACpD,MAAM,QAAQ,GAAG,IAAI,cAAc,CAAa;QAC9C,KAAK,CAAC,UAAU;YACd,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC1B,UAAU,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;KACF,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC;IACtC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,SAAS,CAAC;QACR,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,IAAI;YAAE,MAAM;QAChB,IAAI,KAAK;YAAE,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;IACvC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/lib/project-type.d.ts

@@ -0,0 +1,18 @@
+import type { FileSource } from './file-source.js';
+/**
+ * "Is this a game project?" — used by checks that diverge between apps
+ * (ProAppStore) and games (ProAppStore (games)). Apps run inside a sidebar+
+ * scrolling Shell; games run inside a viewport-locked GameShell with
+ * different brand tokens. Several rules need to know which they're
+ * looking at.
+ *
+ * Detection signals (any one is sufficient):
+ *   - `@proappstore/games` listed in any package.json
+ *   - A TS/JS source file imports from `@proappstore/games`
+ *
+ * Both signals exist because workspace hoisting can put the dep in the
+ * root package.json (where a per-app scan would miss it) and template
+ * scaffolds put the import in app source.
+ */
+export declare function isGameProject(source: FileSource): Promise<boolean>;
+//# sourceMappingURL=project-type.d.ts.map

package/dist/lib/project-type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-type.d.ts","sourceRoot":"","sources":["../../src/lib/project-type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAaxE"}

package/dist/lib/project-type.js

@@ -0,0 +1,34 @@
+/**
+ * "Is this a game project?" — used by checks that diverge between apps
+ * (ProAppStore) and games (ProAppStore (games)). Apps run inside a sidebar+
+ * scrolling Shell; games run inside a viewport-locked GameShell with
+ * different brand tokens. Several rules need to know which they're
+ * looking at.
+ *
+ * Detection signals (any one is sufficient):
+ *   - `@proappstore/games` listed in any package.json
+ *   - A TS/JS source file imports from `@proappstore/games`
+ *
+ * Both signals exist because workspace hoisting can put the dep in the
+ * root package.json (where a per-app scan would miss it) and template
+ * scaffolds put the import in app source.
+ */
+export async function isGameProject(source) {
+    for await (const path of source.list()) {
+        const base = path.split('/').pop() ?? '';
+        if (base !== 'package.json')
+            continue;
+        const content = await source.read(path);
+        if (content && /@proappstore\/games/.test(content))
+            return true;
+    }
+    for await (const path of source.list()) {
+        if (!path.endsWith('.ts') && !path.endsWith('.tsx'))
+            continue;
+        const content = await source.read(path);
+        if (content && /from\s+['"]@proappstore\/games['"]/.test(content))
+            return true;
+    }
+    return false;
+}
+//# sourceMappingURL=project-type.js.map

package/dist/lib/project-type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-type.js","sourceRoot":"","sources":["../../src/lib/project-type.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAkB;IACpD,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;QACzC,IAAI,IAAI,KAAK,cAAc;YAAE,SAAS;QACtC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,OAAO,IAAI,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;IAClE,CAAC;IACD,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,SAAS;QAC9D,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,OAAO,IAAI,oCAAoC,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;IACjF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/lib/strip.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Source-stripping helpers shared by checks that run regex against raw
+ * source files. The whole class of bugs these prevent: a regex matches
+ * a token (like `<meta name="viewport">`, `new Audio(`, `100vh`,
+ * `@amplitude`) that lives inside a comment or a string literal —
+ * never actually evaluated, but the static check fires anyway.
+ *
+ * Two design rules:
+ *   1. All strippers preserve character positions — they replace
+ *      removed bytes with spaces (newlines kept), so any `regex.index`
+ *      result still refers to the same line/column in the real source.
+ *   2. The strippers don't try to be a full tokenizer. They handle the
+ *      common cases (escapes inside strings, nested comment-like text
+ *      inside strings) and accept that pathological constructs
+ *      (template-literal `${...}` containing braces, regex literals
+ *      with asymmetric braces) need a real parser. In practice the
+ *      compliance fixtures don't hit these.
+ */
+/** Replace `<!-- ... -->` comment bodies with spaces. */
+export declare function stripHtmlComments(src: string): string;
+/**
+ * Replace JS/TS line + block comment bodies AND string-literal
+ * contents with spaces. Use this when a regex against the source
+ * shouldn't match documentation strings or commented-out code (the
+ * common pattern: matching SDK names, API calls, CSS unit tokens).
+ *
+ * Handles single, double, and backtick strings with `\` escapes.
+ * Doesn't track template-literal `${...}` interpolation contents and
+ * doesn't recognise regex literals — both edge cases would need a
+ * tokenizer.
+ */
+export declare function stripCommentsAndStrings(src: string): string;
+/**
+ * Like `stripCommentsAndStrings` but preserves string contents.
+ * Use when the regex needs to see string values — e.g. inspecting
+ * `font-family: "Comic Sans"` inside JSX, where the string value IS
+ * the thing being audited.
+ */
+export declare function stripCommentsOnly(src: string): string;
+/**
+ * Replace `/* ... *​/` comment bodies with spaces. CSS doesn't have
+ * `//` line comments at the language level (some preprocessors add
+ * them, but plain CSS doesn't), so this is the simpler variant.
+ */
+export declare function stripCssComments(src: string): string;
+/**
+ * Dispatch to the right stripper based on file extension. For unknown
+ * extensions, falls back to `stripCommentsAndStrings` (JS-style) —
+ * conservative because most source files compliance checks touch are
+ * JS-flavoured.
+ */
+export declare function stripForExt(src: string, ext: string): string;
+/**
+ * Like `stripForExt` but preserves string-literal contents — useful
+ * when the regex needs to match tokens that legitimately appear inside
+ * strings (e.g. `@amplitude/` inside an `import from "@amplitude/..."`,
+ * which is the literal package-name string we want to catch).
+ */
+export declare function stripCommentsForExt(src: string, ext: string): string;
+//# sourceMappingURL=strip.d.ts.map

package/dist/lib/strip.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"strip.d.ts","sourceRoot":"","sources":["../../src/lib/strip.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,yDAAyD;AACzD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAwBrD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAepD;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAa5D;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAapE"}

package/dist/lib/strip.js

@@ -0,0 +1,169 @@
+/**
+ * Source-stripping helpers shared by checks that run regex against raw
+ * source files. The whole class of bugs these prevent: a regex matches
+ * a token (like `<meta name="viewport">`, `new Audio(`, `100vh`,
+ * `@amplitude`) that lives inside a comment or a string literal —
+ * never actually evaluated, but the static check fires anyway.
+ *
+ * Two design rules:
+ *   1. All strippers preserve character positions — they replace
+ *      removed bytes with spaces (newlines kept), so any `regex.index`
+ *      result still refers to the same line/column in the real source.
+ *   2. The strippers don't try to be a full tokenizer. They handle the
+ *      common cases (escapes inside strings, nested comment-like text
+ *      inside strings) and accept that pathological constructs
+ *      (template-literal `${...}` containing braces, regex literals
+ *      with asymmetric braces) need a real parser. In practice the
+ *      compliance fixtures don't hit these.
+ */
+/** Replace `<!-- ... -->` comment bodies with spaces. */
+export function stripHtmlComments(src) {
+    const out = src.split('');
+    let i = 0;
+    while (i < src.length) {
+        if (src[i] === '<' &&
+            src[i + 1] === '!' &&
+            src[i + 2] === '-' &&
+            src[i + 3] === '-') {
+            const start = i;
+            i += 4;
+            while (i < src.length &&
+                !(src[i] === '-' && src[i + 1] === '-' && src[i + 2] === '>'))
+                i++;
+            i = Math.min(src.length, i + 3);
+            blank(out, start, i);
+            continue;
+        }
+        i++;
+    }
+    return out.join('');
+}
+/**
+ * Replace JS/TS line + block comment bodies AND string-literal
+ * contents with spaces. Use this when a regex against the source
+ * shouldn't match documentation strings or commented-out code (the
+ * common pattern: matching SDK names, API calls, CSS unit tokens).
+ *
+ * Handles single, double, and backtick strings with `\` escapes.
+ * Doesn't track template-literal `${...}` interpolation contents and
+ * doesn't recognise regex literals — both edge cases would need a
+ * tokenizer.
+ */
+export function stripCommentsAndStrings(src) {
+    return stripCode(src, { strings: true });
+}
+/**
+ * Like `stripCommentsAndStrings` but preserves string contents.
+ * Use when the regex needs to see string values — e.g. inspecting
+ * `font-family: "Comic Sans"` inside JSX, where the string value IS
+ * the thing being audited.
+ */
+export function stripCommentsOnly(src) {
+    return stripCode(src, { strings: false });
+}
+/**
+ * Replace `/* ... *​/` comment bodies with spaces. CSS doesn't have
+ * `//` line comments at the language level (some preprocessors add
+ * them, but plain CSS doesn't), so this is the simpler variant.
+ */
+export function stripCssComments(src) {
+    const out = src.split('');
+    let i = 0;
+    while (i < src.length) {
+        if (src[i] === '/' && src[i + 1] === '*') {
+            const start = i;
+            i += 2;
+            while (i < src.length && !(src[i] === '*' && src[i + 1] === '/'))
+                i++;
+            i = Math.min(src.length, i + 2);
+            blank(out, start, i);
+            continue;
+        }
+        i++;
+    }
+    return out.join('');
+}
+/**
+ * Dispatch to the right stripper based on file extension. For unknown
+ * extensions, falls back to `stripCommentsAndStrings` (JS-style) —
+ * conservative because most source files compliance checks touch are
+ * JS-flavoured.
+ */
+export function stripForExt(src, ext) {
+    switch (ext.toLowerCase()) {
+        case '.html':
+        case '.htm':
+            return stripHtmlComments(src);
+        case '.css':
+        case '.scss':
+            return stripCssComments(src);
+        case '.json':
+            return src; // JSON has no comments
+        default:
+            return stripCommentsAndStrings(src);
+    }
+}
+/**
+ * Like `stripForExt` but preserves string-literal contents — useful
+ * when the regex needs to match tokens that legitimately appear inside
+ * strings (e.g. `@amplitude/` inside an `import from "@amplitude/..."`,
+ * which is the literal package-name string we want to catch).
+ */
+export function stripCommentsForExt(src, ext) {
+    switch (ext.toLowerCase()) {
+        case '.html':
+        case '.htm':
+            return stripHtmlComments(src);
+        case '.css':
+        case '.scss':
+            return stripCssComments(src);
+        case '.json':
+            return src;
+        default:
+            return stripCommentsOnly(src);
+    }
+}
+function stripCode(src, opts) {
+    const out = src.split('');
+    let i = 0;
+    while (i < src.length) {
+        const c = src[i];
+        if (c === '/' && src[i + 1] === '/') {
+            const start = i;
+            while (i < src.length && src[i] !== '\n')
+                i++;
+            blank(out, start, i);
+            continue;
+        }
+        if (c === '/' && src[i + 1] === '*') {
+            const start = i;
+            i += 2;
+            while (i < src.length && !(src[i] === '*' && src[i + 1] === '/'))
+                i++;
+            i = Math.min(src.length, i + 2);
+            blank(out, start, i);
+            continue;
+        }
+        if (opts.strings && (c === '"' || c === "'" || c === '`')) {
+            const quote = c;
+            const start = i + 1; // keep the opening quote in place
+            i++;
+            while (i < src.length && src[i] !== quote) {
+                if (src[i] === '\\' && i + 1 < src.length)
+                    i++;
+                i++;
+            }
+            blank(out, start, i);
+            i++; // skip closing quote
+            continue;
+        }
+        i++;
+    }
+    return out.join('');
+}
+function blank(out, from, to) {
+    for (let k = from; k < to; k++)
+        if (out[k] !== '\n')
+            out[k] = ' ';
+}
+//# sourceMappingURL=strip.js.map

package/dist/lib/strip.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"strip.js","sourceRoot":"","sources":["../../src/lib/strip.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,yDAAyD;AACzD,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC1B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QACtB,IACE,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG;YACd,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG;YAClB,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG;YAClB,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAClB,CAAC;YACD,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,CAAC,IAAI,CAAC,CAAC;YACP,OACE,CAAC,GAAG,GAAG,CAAC,MAAM;gBACd,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;gBAE7D,CAAC,EAAE,CAAC;YACN,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAChC,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QACD,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACtB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAW;IACjD,OAAO,SAAS,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,OAAO,SAAS,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC1B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QACtB,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;gBAAE,CAAC,EAAE,CAAC;YACtE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAChC,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QACD,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACtB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,GAAW;IAClD,QAAQ,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;QAC1B,KAAK,OAAO,CAAC;QACb,KAAK,MAAM;YACT,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAChC,KAAK,MAAM,CAAC;QACZ,KAAK,OAAO;YACV,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC/B,KAAK,OAAO;YACV,OAAO,GAAG,CAAC,CAAC,uBAAuB;QACrC;YACE,OAAO,uBAAuB,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW,EAAE,GAAW;IAC1D,QAAQ,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;QAC1B,KAAK,OAAO,CAAC;QACb,KAAK,MAAM;YACT,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAChC,KAAK,MAAM,CAAC;QACZ,KAAK,OAAO;YACV,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC/B,KAAK,OAAO;YACV,OAAO,GAAG,CAAC;QACb;YACE,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,GAAW,EAAE,IAA0B;IACxD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC1B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YAC9C,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;gBAAE,CAAC,EAAE,CAAC;YACtE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAChC,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;YAC1D,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,kCAAkC;YACvD,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;gBAC1C,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM;oBAAE,CAAC,EAAE,CAAC;gBAC/C,CAAC,EAAE,CAAC;YACN,CAAC;YACD,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;YACrB,CAAC,EAAE,CAAC,CAAC,qBAAqB;YAC1B,SAAS;QACX,CAAC;QACD,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,KAAK,CAAC,GAAa,EAAE,IAAY,EAAE,EAAU;IACpD,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE;QAAE,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;AACpE,CAAC"}

package/dist/live/index.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Live-URL audit checks. Unlike the file-walking checks in ../checks/,
+ * these run inside a Cloudflare Worker (no filesystem) against published
+ * apps' live URLs to catch post-publish drift.
+ *
+ * What we can check from a live URL:
+ *   - Tracking SDK injection (script src, inline scripts, fetched JS)
+ *   - Brand fonts presence (link href to fonts.googleapis.com)
+ *   - PWA manifest reachable + valid
+ *   - Main bundle size (HEAD request)
+ *
+ * What we CAN'T check post-publish:
+ *   - APPNAME placeholders (build erases these)
+ *   - Brand-override CSS variables (sourcemaps not always shipped)
+ *
+ * The audit Worker runs these on a weekly cron and stores per-app
+ * results in D1 so creators (or platform admins) can see drift over
+ * time without leaving the storefront.
+ */
+import type { CheckResult } from '../types.js';
+export interface LiveAuditInput {
+    appId: string;
+    liveUrl: string;
+}
+export interface LiveAuditReport {
+    appId: string;
+    liveUrl: string;
+    checkedAt: number;
+    reachable: boolean;
+    results: CheckResult[];
+}
+export declare function auditLive(input: LiveAuditInput): Promise<LiveAuditReport>;
+export declare function checkNoTrackingLive(html: string): CheckResult;
+export declare function checkBrandFontsLive(html: string): CheckResult;
+export declare function checkManifestLive(html: string, liveUrl: string): Promise<CheckResult>;
+export declare function checkBundleSizeLive(html: string, liveUrl: string): Promise<CheckResult>;
+/**
+ * Live counterpart to checkUnsafeVh. Fetches the first bundled
+ * stylesheet linked from the HTML and scans it for `100vh` (the
+ * unit, not the Tailwind class — by build time those have been
+ * compiled to CSS). Catches whiteboard-class iOS Safari URL-bar
+ * scroll bugs in apps that have already shipped.
+ *
+ * Cost: one extra subrequest per app. The audit Worker runs near the
+ * free-plan subrequest cap; on cap errors we degrade to `warn`
+ * (re-run needed) rather than `fail` (app broken) — the app isn't
+ * actually broken, the audit just couldn't check.
+ */
+export declare function checkUnsafeVhLive(html: string, liveUrl: string): Promise<CheckResult>;
+//# sourceMappingURL=index.d.ts.map

package/dist/live/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/live/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAc/C,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,WAAW,EAAE,CAAC;CACxB;AA2BD,wBAAsB,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CA2D/E;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAa7D;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAe7D;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CA8C3F;AAED,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAoD7F;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAoD3F"}