@proappstore/compliance 0.1.0

package/dist/live/index.js

@@ -0,0 +1,317 @@
+/**
+ * Live-URL audit checks. Unlike the file-walking checks in ../checks/,
+ * these run inside a Cloudflare Worker (no filesystem) against published
+ * apps' live URLs to catch post-publish drift.
+ *
+ * What we can check from a live URL:
+ *   - Tracking SDK injection (script src, inline scripts, fetched JS)
+ *   - Brand fonts presence (link href to fonts.googleapis.com)
+ *   - PWA manifest reachable + valid
+ *   - Main bundle size (HEAD request)
+ *
+ * What we CAN'T check post-publish:
+ *   - APPNAME placeholders (build erases these)
+ *   - Brand-override CSS variables (sourcemaps not always shipped)
+ *
+ * The audit Worker runs these on a weekly cron and stores per-app
+ * results in D1 so creators (or platform admins) can see drift over
+ * time without leaving the storefront.
+ */
+import { gzipByteLength } from '../lib/gzip.js';
+const TRACKER_PATTERNS = [
+    /google-analytics\.com/i,
+    /gtag\(/i,
+    /googletagmanager\.com/i,
+    /\bamplitude\b/i,
+    /\bmixpanel\b/i,
+    /\bsegment\.com\b/i,
+    /\bhotjar\.com\b/i,
+    /plausible\.io/i,
+    /posthog\.com/i,
+];
+/**
+ * Fetch with a timeout — Workers' default fetch waits 30s+, too slow
+ * when iterating 50+ apps in one cron tick.
+ */
+async function fetchWithTimeout(url, ms = 8000) {
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), ms);
+    try {
+        return await fetch(url, { signal: ctrl.signal, redirect: 'follow' });
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * Worker subrequest cap errors look like "Too many subrequests by
+ * single Worker invocation." We don't want to record those as "fail"
+ * verdicts because the app isn't actually broken — the audit just
+ * couldn't check. Detect and flag for the caller.
+ */
+function isSubrequestCapError(err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return /too many subrequests|subrequest.*limit/i.test(msg);
+}
+export async function auditLive(input) {
+    const checkedAt = Date.now();
+    const report = {
+        appId: input.appId,
+        liveUrl: input.liveUrl,
+        checkedAt,
+        reachable: false,
+        results: [],
+    };
+    let html;
+    try {
+        const res = await fetchWithTimeout(input.liveUrl);
+        if (!res.ok) {
+            report.results.push({
+                name: 'Reachable',
+                status: 'fail',
+                detail: `HTTP ${res.status} from ${input.liveUrl}`,
+            });
+            return report;
+        }
+        html = await res.text();
+        report.reachable = true;
+        // Always record a Reachable row on success — otherwise stale
+        // "Reachable: fail" rows from previous failed runs (e.g.
+        // subrequest-cap noise) never get overwritten, because the
+        // upsert is keyed on (app_id, check_name).
+        report.results.push({
+            name: 'Reachable',
+            status: 'pass',
+            detail: `${input.liveUrl} → HTTP ${res.status}`,
+        });
+    }
+    catch (err) {
+        // Subrequest cap means we couldn't even fetch — that's a "warn"
+        // (re-check needed), not a "fail" (app broken). Distinguishing
+        // matters: failures show red badges in the storefront.
+        const skipped = isSubrequestCapError(err);
+        report.results.push({
+            name: 'Reachable',
+            status: skipped ? 'warn' : 'fail',
+            detail: skipped
+                ? 'audit Worker hit subrequest cap — re-run needed'
+                : err instanceof Error
+                    ? err.message
+                    : 'fetch failed',
+        });
+        return report;
+    }
+    // Run all checks in parallel — each is independent.
+    const [tracking, fonts, manifest, bundle, vh] = await Promise.all([
+        checkNoTrackingLive(html),
+        checkBrandFontsLive(html),
+        checkManifestLive(html, input.liveUrl),
+        checkBundleSizeLive(html, input.liveUrl),
+        checkUnsafeVhLive(html, input.liveUrl),
+    ]);
+    report.results.push(tracking, fonts, manifest, bundle, vh);
+    return report;
+}
+export function checkNoTrackingLive(html) {
+    const found = TRACKER_PATTERNS.filter((re) => re.test(html));
+    if (found.length === 0) {
+        return { name: 'No tracking SDKs (live)', status: 'pass', detail: 'no known trackers in HTML' };
+    }
+    return {
+        name: 'No tracking SDKs (live)',
+        status: 'fail',
+        detail: `${found.length} pattern${found.length === 1 ? '' : 's'} matched`,
+        suggestions: [
+            'Tracking was injected after publish — remove the script tag or third-party loader.',
+        ],
+    };
+}
+export function checkBrandFontsLive(html) {
+    const hasManrope = /manrope/i.test(html);
+    const hasFraunces = /fraunces/i.test(html);
+    if (hasManrope && hasFraunces) {
+        return { name: 'Brand fonts (live)', status: 'pass', detail: 'Manrope + Fraunces referenced' };
+    }
+    const missing = [];
+    if (!hasManrope)
+        missing.push('Manrope');
+    if (!hasFraunces)
+        missing.push('Fraunces');
+    return {
+        name: 'Brand fonts (live)',
+        status: 'fail',
+        detail: `missing: ${missing.join(', ')}`,
+        suggestions: ['Restore the Google Fonts <link> in web/index.html.'],
+    };
+}
+export async function checkManifestLive(html, liveUrl) {
+    // Find the manifest link in the HTML, then fetch + validate it.
+    const m = /<link[^>]*rel=["']manifest["'][^>]*href=["']([^"']+)["']/i.exec(html);
+    if (!m) {
+        return {
+            name: 'PWA manifest (live)',
+            status: 'fail',
+            detail: 'no <link rel="manifest"> in HTML',
+        };
+    }
+    const href = m[1];
+    const manifestUrl = new URL(href, liveUrl).toString();
+    try {
+        const res = await fetchWithTimeout(manifestUrl);
+        if (!res.ok) {
+            return {
+                name: 'PWA manifest (live)',
+                status: 'fail',
+                detail: `${manifestUrl} → HTTP ${res.status}`,
+            };
+        }
+        const body = (await res.json());
+        const missing = [];
+        if (!body.name)
+            missing.push('name');
+        if (!body.display)
+            missing.push('display');
+        if (!body.start_url)
+            missing.push('start_url');
+        if (missing.length > 0) {
+            return {
+                name: 'PWA manifest (live)',
+                status: 'fail',
+                detail: `manifest missing fields: ${missing.join(', ')}`,
+            };
+        }
+        return { name: 'PWA manifest (live)', status: 'pass', detail: manifestUrl };
+    }
+    catch (err) {
+        const skipped = isSubrequestCapError(err);
+        return {
+            name: 'PWA manifest (live)',
+            status: skipped ? 'warn' : 'fail',
+            detail: skipped
+                ? 'audit Worker hit subrequest cap — re-run needed'
+                : err instanceof Error
+                    ? err.message
+                    : 'manifest fetch/parse failed',
+        };
+    }
+}
+export async function checkBundleSizeLive(html, liveUrl) {
+    // Find the largest-looking bundled JS reference. Vite output looks like
+    // src="/assets/index-XYZ.js" — starts with `/`, no chars before. Use
+    // `[^"']*` (zero or more) instead of `[^"']+` (one or more) so the
+    // root-relative path matches; with `+` every Vite app was misreported
+    // as "non-Vite layout" and the audit silently skipped bundle-size.
+    const m = /<script[^>]+src=["']([^"']*\/assets\/[^"']+\.js)["']/i.exec(html);
+    if (!m) {
+        // Plausible miss for non-Vite apps — not a fail, just skip.
+        return {
+            name: 'Bundle size (live)',
+            status: 'warn',
+            detail: 'no /assets/*.js found — non-Vite layout?',
+        };
+    }
+    const jsUrl = new URL(m[1], liveUrl).toString();
+    try {
+        const res = await fetchWithTimeout(jsUrl);
+        if (!res.ok) {
+            return { name: 'Bundle size (live)', status: 'fail', detail: `${jsUrl} → ${res.status}` };
+        }
+        const body = await res.arrayBuffer();
+        // Real gzip via the shared helper — same math the source-side
+        // check uses, so live and source verdicts can never disagree on
+        // a borderline app.
+        const rawKb = Math.round(body.byteLength / 1024);
+        const gzippedBytes = await gzipByteLength(new Uint8Array(body));
+        const gzipKb = Math.round(gzippedBytes / 1024);
+        if (gzipKb > 300) {
+            return {
+                name: 'Bundle size (live)',
+                status: 'fail',
+                detail: `${gzipKb} KB gzipped (raw ${rawKb} KB) — over 300 KB limit`,
+            };
+        }
+        return {
+            name: 'Bundle size (live)',
+            status: 'pass',
+            detail: `${gzipKb} KB gzipped (raw ${rawKb} KB)`,
+        };
+    }
+    catch (err) {
+        const skipped = isSubrequestCapError(err);
+        return {
+            name: 'Bundle size (live)',
+            status: 'warn',
+            detail: skipped
+                ? 'audit Worker hit subrequest cap — re-run needed'
+                : err instanceof Error
+                    ? err.message
+                    : 'bundle fetch failed',
+        };
+    }
+}
+/**
+ * Live counterpart to checkUnsafeVh. Fetches the first bundled
+ * stylesheet linked from the HTML and scans it for `100vh` (the
+ * unit, not the Tailwind class — by build time those have been
+ * compiled to CSS). Catches whiteboard-class iOS Safari URL-bar
+ * scroll bugs in apps that have already shipped.
+ *
+ * Cost: one extra subrequest per app. The audit Worker runs near the
+ * free-plan subrequest cap; on cap errors we degrade to `warn`
+ * (re-run needed) rather than `fail` (app broken) — the app isn't
+ * actually broken, the audit just couldn't check.
+ */
+export async function checkUnsafeVhLive(html, liveUrl) {
+    // Find the first bundled stylesheet. Vite output looks like
+    // <link rel="stylesheet" href="/assets/index-XYZ.css">. Be
+    // tolerant of attribute order — rel and href can appear either way.
+    const m = /<link[^>]+rel=["']stylesheet["'][^>]*href=["']([^"']+\.css[^"']*)["']/i.exec(html) ??
+        /<link[^>]+href=["']([^"']+\.css[^"']*)["'][^>]*rel=["']stylesheet["']/i.exec(html);
+    if (!m) {
+        // No stylesheet link — could be inline-only styles, or styles
+        // injected at runtime. Not a fail; just nothing to check.
+        return {
+            name: 'No unsafe 100vh (live)',
+            status: 'warn',
+            detail: 'no <link rel="stylesheet"> found in HTML — skipped',
+        };
+    }
+    const cssUrl = new URL(m[1], liveUrl).toString();
+    try {
+        const res = await fetchWithTimeout(cssUrl);
+        if (!res.ok) {
+            return {
+                name: 'No unsafe 100vh (live)',
+                status: 'warn',
+                detail: `${cssUrl} → HTTP ${res.status}`,
+            };
+        }
+        const css = await res.text();
+        const matches = css.match(/\b100vh\b/g) ?? [];
+        if (matches.length === 0) {
+            return { name: 'No unsafe 100vh (live)', status: 'pass', detail: `scanned ${cssUrl}` };
+        }
+        return {
+            name: 'No unsafe 100vh (live)',
+            status: 'warn',
+            detail: `${matches.length} occurrence(s) of 100vh in ${cssUrl}`,
+            suggestions: [
+                '100vh resolves to the layout viewport on iOS Safari — when the URL bar is visible the page scrolls.',
+                'Replace with 100svh (small viewport — accounts for visible browser UI) or 100dvh (dynamic — recomputes as URL bar moves).',
+            ],
+        };
+    }
+    catch (err) {
+        const skipped = isSubrequestCapError(err);
+        return {
+            name: 'No unsafe 100vh (live)',
+            status: 'warn',
+            detail: skipped
+                ? 'audit Worker hit subrequest cap — re-run needed'
+                : err instanceof Error
+                    ? err.message
+                    : 'CSS fetch failed',
+        };
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/live/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/live/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAGhD,MAAM,gBAAgB,GAAG;IACvB,wBAAwB;IACxB,SAAS;IACT,wBAAwB;IACxB,gBAAgB;IAChB,eAAe;IACf,mBAAmB;IACnB,kBAAkB;IAClB,gBAAgB;IAChB,eAAe;CAChB,CAAC;AAeF;;;GAGG;AACH,KAAK,UAAU,gBAAgB,CAAC,GAAW,EAAE,EAAE,GAAG,IAAI;IACpD,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IACjD,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACvE,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,GAAY;IACxC,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7D,OAAO,yCAAyC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAqB;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAoB;QAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS;QACT,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,EAAE;KACZ,CAAC;IAEF,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;gBAClB,IAAI,EAAE,WAAW;gBACjB,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,QAAQ,GAAG,CAAC,MAAM,SAAS,KAAK,CAAC,OAAO,EAAE;aACnD,CAAC,CAAC;YACH,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC;QACxB,6DAA6D;QAC7D,yDAAyD;QACzD,2DAA2D;QAC3D,2CAA2C;QAC3C,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;YAClB,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,WAAW,GAAG,CAAC,MAAM,EAAE;SAChD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,gEAAgE;QAChE,+DAA+D;QAC/D,uDAAuD;QACvD,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;YAClB,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YACjC,MAAM,EAAE,OAAO;gBACb,CAAC,CAAC,iDAAiD;gBACnD,CAAC,CAAC,GAAG,YAAY,KAAK;oBACpB,CAAC,CAAC,GAAG,CAAC,OAAO;oBACb,CAAC,CAAC,cAAc;SACrB,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,oDAAoD;IACpD,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAChE,mBAAmB,CAAC,IAAI,CAAC;QACzB,mBAAmB,CAAC,IAAI,CAAC;QACzB,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC;QACtC,mBAAmB,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC;QACxC,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC;KACvC,CAAC,CAAC;IACH,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IAC3D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,MAAM,KAAK,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,IAAI,EAAE,yBAAyB,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IAClG,CAAC;IACD,OAAO;QACL,IAAI,EAAE,yBAAyB;QAC/B,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,WAAW,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,UAAU;QACzE,WAAW,EAAE;YACX,oFAAoF;SACrF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,UAAU,IAAI,WAAW,EAAE,CAAC;QAC9B,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;IACjG,CAAC;IACD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,UAAU;QAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,WAAW;QAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3C,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,YAAY,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACxC,WAAW,EAAE,CAAC,oDAAoD,CAAC;KACpE,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAY,EAAE,OAAe;IACnE,gEAAgE;IAChE,MAAM,CAAC,GAAG,2DAA2D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjF,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,OAAO;YACL,IAAI,EAAE,qBAAqB;YAC3B,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,kCAAkC;SAC3C,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IACnB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO;gBACL,IAAI,EAAE,qBAAqB;gBAC3B,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,GAAG,WAAW,WAAW,GAAG,CAAC,MAAM,EAAE;aAC9C,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4D,CAAC;QAC3F,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC/C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO;gBACL,IAAI,EAAE,qBAAqB;gBAC3B,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,4BAA4B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aACzD,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC9E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC1C,OAAO;YACL,IAAI,EAAE,qBAAqB;YAC3B,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YACjC,MAAM,EAAE,OAAO;gBACb,CAAC,CAAC,iDAAiD;gBACnD,CAAC,CAAC,GAAG,YAAY,KAAK;oBACpB,CAAC,CAAC,GAAG,CAAC,OAAO;oBACb,CAAC,CAAC,6BAA6B;SACpC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAY,EAAE,OAAe;IACrE,wEAAwE;IACxE,qEAAqE;IACrE,mEAAmE;IACnE,sEAAsE;IACtE,mEAAmE;IACnE,MAAM,CAAC,GAAG,uDAAuD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7E,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,4DAA4D;QAC5D,OAAO;YACL,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,0CAA0C;SACnD,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,MAAM,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;QAC5F,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC;QACrC,8DAA8D;QAC9D,gEAAgE;QAChE,oBAAoB;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;QACjD,MAAM,YAAY,GAAG,MAAM,cAAc,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;QAC/C,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;YACjB,OAAO;gBACL,IAAI,EAAE,oBAAoB;gBAC1B,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,GAAG,MAAM,oBAAoB,KAAK,0BAA0B;aACrE,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,GAAG,MAAM,oBAAoB,KAAK,MAAM;SACjD,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC1C,OAAO;YACL,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,OAAO;gBACb,CAAC,CAAC,iDAAiD;gBACnD,CAAC,CAAC,GAAG,YAAY,KAAK;oBACpB,CAAC,CAAC,GAAG,CAAC,OAAO;oBACb,CAAC,CAAC,qBAAqB;SAC5B,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAY,EAAE,OAAe;IACnE,4DAA4D;IAC5D,2DAA2D;IAC3D,oEAAoE;IACpE,MAAM,CAAC,GACL,wEAAwE,CAAC,IAAI,CAAC,IAAI,CAAC;QACnF,wEAAwE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtF,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,8DAA8D;QAC9D,0DAA0D;QAC1D,OAAO;YACL,IAAI,EAAE,wBAAwB;YAC9B,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,oDAAoD;SAC7D,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO;gBACL,IAAI,EAAE,wBAAwB;gBAC9B,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,GAAG,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE;aACzC,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAC9C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,IAAI,EAAE,wBAAwB,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,MAAM,EAAE,EAAE,CAAC;QACzF,CAAC;QACD,OAAO;YACL,IAAI,EAAE,wBAAwB;YAC9B,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,8BAA8B,MAAM,EAAE;YAC/D,WAAW,EAAE;gBACX,qGAAqG;gBACrG,2HAA2H;aAC5H;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC1C,OAAO;YACL,IAAI,EAAE,wBAAwB;YAC9B,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,OAAO;gBACb,CAAC,CAAC,iDAAiD;gBACnD,CAAC,CAAC,GAAG,YAAY,KAAK;oBACpB,CAAC,CAAC,GAAG,CAAC,OAAO;oBACb,CAAC,CAAC,kBAAkB;SACzB,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,12 @@
+export type CheckStatus = 'pass' | 'warn' | 'fail';
+export interface CheckResult {
+    /** Short human-readable name. */
+    name: string;
+    /** pass | warn | fail. fail is a hard gate; warn is informational. */
+    status: CheckStatus;
+    /** One-line context (file path, count, current value). */
+    detail: string;
+    /** Optional actionable advice for fixing a fail/warn. */
+    suggestions?: string[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAEnD,MAAM,WAAW,WAAW;IAC1B,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,MAAM,EAAE,WAAW,CAAC;IACpB,0DAA0D;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,47 @@
+{
+  "name": "@proappstore/compliance",
+  "version": "0.1.0",
+  "description": "Compliance checks for apps published on proappstore.online — used by the CLI for local feedback and by CI for gating.",
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "homepage": "https://github.com/proappstore-online/platform#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/proappstore-online/platform.git",
+    "directory": "packages/compliance"
+  },
+  "bugs": {
+    "url": "https://github.com/proappstore-online/platform/issues"
+  },
+  "keywords": [
+    "proappstore",
+    "compliance",
+    "lint",
+    "audit",
+    "ci"
+  ],
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.7.0"
+  },
+  "sideEffects": false,
+  "scripts": {
+    "build": "tsc",
+    "typecheck": "tsc --noEmit"
+  }
+}