@reddoorla/maintenance 0.54.4 → 0.56.0

package/dist/chunk-4PY4I5OR.js

@@ -0,0 +1,1167 @@
+import {
+  baselineVersions
+} from "./chunk-LKGVSM2O.js";
+import {
+  defaultSpawn
+} from "./chunk-HVOOCK6L.js";
+import {
+  siteLabel
+} from "./chunk-XXTZBPUY.js";
+import {
+  lighthouseConfig
+} from "./chunk-EYODPUHV.js";
+import {
+  a11yRoutes,
+  smokeRoutes
+} from "./chunk-LYCKN7ZR.js";
+
+// src/audits/deps.ts
+import { readFile } from "fs/promises";
+import { join as join2 } from "path";
+
+// src/audits/deps-outdated.ts
+import { stat } from "fs/promises";
+import { join } from "path";
+async function exists(path) {
+  try {
+    await stat(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function majorOf(version) {
+  const head = version.replace(/^[\^~]/, "").split(".")[0] ?? "0";
+  const n = Number.parseInt(head, 10);
+  return Number.isNaN(n) ? 0 : n;
+}
+async function scanOutdated(sitePath, spawn) {
+  if (!await exists(join(sitePath, "pnpm-lock.yaml"))) return null;
+  try {
+    if (!await exists(join(sitePath, "node_modules"))) {
+      const install = await spawn("pnpm", ["install", "--frozen-lockfile"], {
+        cwd: sitePath,
+        timeoutMs: 18e4
+      });
+      if (install.code !== 0) return null;
+    }
+    const res = await spawn("pnpm", ["outdated", "--json"], {
+      cwd: sitePath,
+      timeoutMs: 6e4
+    });
+    const parsed = JSON.parse(res.stdout || "{}");
+    const entries = Object.values(parsed);
+    return {
+      outdated: entries.length,
+      major: entries.filter((e) => e.current && e.latest && majorOf(e.latest) > majorOf(e.current)).length
+    };
+  } catch {
+    return null;
+  }
+}
+
+// src/audits/deps.ts
+function stripCaret(range) {
+  return range.replace(/^[\^~]/, "");
+}
+function isComparableRange(spec) {
+  return /^[\^~]?\d/.test(spec.trim());
+}
+function parseSemver(v) {
+  const cleaned = stripCaret(v).split("-")[0] ?? "0.0.0";
+  const parts = cleaned.split(".").map((n) => Number.parseInt(n, 10));
+  return [parts[0] ?? 0, parts[1] ?? 0, parts[2] ?? 0];
+}
+function compareSemver(actual, baseline) {
+  const [aMajor, aMinor, aPatch] = parseSemver(actual);
+  const [bMajor, bMinor, bPatch] = parseSemver(baseline);
+  if (aMajor > bMajor) return "newer";
+  if (aMajor < bMajor) return "major";
+  if (aMinor > bMinor) return "newer";
+  if (aMinor < bMinor) return "minor";
+  if (aPatch > bPatch) return "newer";
+  if (aPatch < bPatch) return "patch";
+  return "same";
+}
+async function depsAudit(ctx) {
+  const pkgPath = join2(ctx.site.path, "package.json");
+  let pkgRaw;
+  try {
+    pkgRaw = await readFile(pkgPath, "utf-8");
+  } catch (err) {
+    return {
+      audit: "deps",
+      site: siteLabel(ctx.site),
+      status: "skip",
+      summary: `no package.json at ${pkgPath}`,
+      details: { error: String(err) }
+    };
+  }
+  let pkg;
+  try {
+    pkg = JSON.parse(pkgRaw);
+  } catch (err) {
+    return {
+      audit: "deps",
+      site: siteLabel(ctx.site),
+      status: "fail",
+      summary: `package.json is not valid JSON: ${err.message}`,
+      details: { error: String(err) }
+    };
+  }
+  const installed = {
+    ...pkg.dependencies ?? {},
+    ...pkg.devDependencies ?? {}
+  };
+  const entries = [];
+  for (const [name, baseline] of Object.entries(baselineVersions)) {
+    const actual = installed[name];
+    if (!actual) continue;
+    if (!isComparableRange(actual)) continue;
+    entries.push({
+      pkg: name,
+      baseline,
+      actual,
+      drift: compareSemver(actual, baseline)
+    });
+  }
+  const anyMajor = entries.some((d) => d.drift === "major");
+  const anyMinor = entries.some((d) => d.drift === "minor");
+  const anyNewer = entries.some((d) => d.drift === "newer");
+  const status = anyMajor ? "fail" : anyMinor || anyNewer ? "warn" : "pass";
+  const driftSummary = status === "pass" ? `all ${entries.length} tracked deps in line with baseline` : status === "warn" ? `${entries.filter((d) => d.drift !== "same").length} of ${entries.length} tracked deps drifted` : `${entries.filter((d) => d.drift === "major").length} deps lagging by a major version`;
+  const outdated = await scanOutdated(ctx.site.path, ctx.spawn ?? defaultSpawn);
+  const summary = outdated ? `${driftSummary}; ${outdated.outdated} outdated install(s) (${outdated.major} major)` : driftSummary;
+  return {
+    audit: "deps",
+    site: siteLabel(ctx.site),
+    status,
+    summary,
+    details: { entries, outdated }
+  };
+}
+
+// src/audits/lint.ts
+import { existsSync } from "fs";
+import { readFile as readFile2 } from "fs/promises";
+import { join as join3 } from "path";
+import { ESLint } from "eslint";
+import { check as prettierCheck, resolveConfig as prettierResolveConfig } from "prettier";
+import { glob } from "tinyglobby";
+var TARGET_GLOBS = ["**/*.{ts,js,svelte}"];
+var IGNORE = ["node_modules/**", "dist/**", ".svelte-kit/**", "build/**", ".netlify/**"];
+async function listFiles(cwd) {
+  return glob(TARGET_GLOBS, { cwd, ignore: IGNORE, absolute: false });
+}
+async function lintAudit(ctx) {
+  const { site } = ctx;
+  const configPath = join3(site.path, "eslint.config.js");
+  if (!existsSync(configPath)) {
+    return {
+      audit: "lint",
+      site: siteLabel(site),
+      status: "skip",
+      summary: "no eslint config at site root"
+    };
+  }
+  const eslint = new ESLint({
+    cwd: site.path,
+    overrideConfigFile: configPath,
+    errorOnUnmatchedPattern: false
+  });
+  const relFiles = await listFiles(site.path);
+  const eslintResults = await eslint.lintFiles(relFiles);
+  const eslintErrors = eslintResults.reduce((n, r) => n + r.errorCount, 0);
+  const eslintWarnings = eslintResults.reduce((n, r) => n + r.warningCount, 0);
+  const prettierUnformatted = [];
+  for (const rel of relFiles) {
+    const absForResolve = join3(site.path, rel);
+    const source = await readFile2(absForResolve, "utf-8");
+    const options = await prettierResolveConfig(absForResolve) ?? {};
+    const ok = await prettierCheck(source, { ...options, filepath: absForResolve });
+    if (!ok) prettierUnformatted.push(rel);
+  }
+  const status = eslintErrors > 0 || prettierUnformatted.length > 0 ? "fail" : eslintWarnings > 0 ? "warn" : "pass";
+  const summary = status === "pass" ? `lint clean across ${relFiles.length} files` : `${eslintErrors} eslint errors, ${eslintWarnings} warnings, ${prettierUnformatted.length} unformatted`;
+  return {
+    audit: "lint",
+    site: siteLabel(site),
+    status,
+    summary,
+    details: {
+      eslintErrors,
+      eslintWarnings,
+      prettierUnformatted,
+      files: relFiles.length
+    }
+  };
+}
+
+// src/audits/security.ts
+function classify(v) {
+  if (v.critical > 0 || v.high > 0) return "fail";
+  if (v.moderate > 0 || v.low > 0) return "warn";
+  return "pass";
+}
+function normalizeSeverity(s) {
+  if (s === "low" || s === "moderate" || s === "high" || s === "critical") return s;
+  return "low";
+}
+function extractAdvisoriesFromPnpm(parsed) {
+  const out = [];
+  for (const a of Object.values(parsed.advisories ?? {})) {
+    if (!a) continue;
+    out.push({
+      module: a.module_name ?? "unknown",
+      severity: normalizeSeverity(a.severity),
+      title: a.title ?? "(no title)",
+      ...a.cves ? { cves: a.cves } : {},
+      ...a.url ? { url: a.url } : {}
+    });
+  }
+  return out;
+}
+function resolveNpmAdvisoryRoot(startName, vulnerabilities) {
+  const seen = /* @__PURE__ */ new Set();
+  let current = startName;
+  while (!seen.has(current)) {
+    seen.add(current);
+    const entry = vulnerabilities[current];
+    if (!entry || !Array.isArray(entry.via)) return { rootName: current };
+    const detailed = entry.via.find(
+      (e) => typeof e === "object" && e !== null
+    );
+    if (detailed) return { rootName: current, detail: detailed };
+    const next = entry.via.find((e) => typeof e === "string");
+    if (!next || next === current) return { rootName: current };
+    current = next;
+  }
+  return { rootName: current };
+}
+function extractAdvisoriesFromNpm(parsed) {
+  const vulnerabilities = parsed.vulnerabilities ?? {};
+  const roots = /* @__PURE__ */ new Map();
+  for (const [name, v] of Object.entries(vulnerabilities)) {
+    if (!v) continue;
+    const { rootName, detail } = resolveNpmAdvisoryRoot(name, vulnerabilities);
+    if (roots.has(rootName)) continue;
+    const rootEntry = vulnerabilities[rootName];
+    const severity = normalizeSeverity(rootEntry?.severity ?? v.severity);
+    const title = detail?.title ?? rootName;
+    const url = detail?.url;
+    roots.set(rootName, {
+      module: rootEntry?.name ?? rootName,
+      severity,
+      title,
+      ...url ? { url } : {}
+    });
+  }
+  return [...roots.values()];
+}
+async function runAuditTool(spawn, cmd, args, cwd) {
+  let raw;
+  try {
+    raw = await spawn(cmd, args, { cwd });
+  } catch (err) {
+    const e = err;
+    if (e.code === "ENOENT" || /ENOENT/.test(String(err))) return { kind: "missing" };
+    return { kind: "error", reason: `spawn failed: ${String(err).slice(0, 200)}` };
+  }
+  if (raw.code !== 0 && raw.code !== 1) {
+    return {
+      kind: "error",
+      reason: `exit ${raw.code}${raw.stderr ? `: ${raw.stderr.slice(0, 150)}` : ""}`
+    };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw.stdout || "{}");
+  } catch (err) {
+    return { kind: "error", reason: `unparseable JSON: ${String(err).slice(0, 100)}` };
+  }
+  const errEnvelope = parsed.error;
+  if (errEnvelope && typeof errEnvelope === "object") {
+    return { kind: "error", reason: errEnvelope.code ?? "error envelope returned" };
+  }
+  const vulnsMeta = parsed.metadata?.vulnerabilities;
+  if (!vulnsMeta || Object.keys(vulnsMeta).length === 0) {
+    return { kind: "error", reason: "no metadata.vulnerabilities in output" };
+  }
+  return { kind: "ok", parsed };
+}
+async function securityAudit(ctx) {
+  const spawn = ctx.spawn ?? defaultSpawn;
+  const site = ctx.site;
+  const label = siteLabel(site);
+  let used = "pnpm audit";
+  let result = await runAuditTool(spawn, "pnpm", ["audit", "--json", "--prod"], site.path);
+  if (result.kind !== "ok") {
+    const pnpmReason = result.kind === "missing" ? "not installed" : result.reason;
+    const npmResult = await runAuditTool(
+      spawn,
+      "npm",
+      ["audit", "--json", "--omit=dev"],
+      site.path
+    );
+    if (npmResult.kind === "ok") {
+      result = npmResult;
+      used = "npm audit";
+    } else {
+      const npmReason = npmResult.kind === "missing" ? "not installed" : npmResult.reason;
+      return {
+        audit: "security",
+        site: label,
+        status: "skip",
+        summary: `cannot run audit \u2014 pnpm: ${pnpmReason}; npm: ${npmReason}`
+      };
+    }
+  }
+  const parsed = result.parsed;
+  const counts = {
+    low: parsed.metadata?.vulnerabilities?.low ?? 0,
+    moderate: parsed.metadata?.vulnerabilities?.moderate ?? 0,
+    high: parsed.metadata?.vulnerabilities?.high ?? 0,
+    critical: parsed.metadata?.vulnerabilities?.critical ?? 0
+  };
+  const advisories = used === "pnpm audit" ? extractAdvisoriesFromPnpm(parsed) : extractAdvisoriesFromNpm(parsed);
+  const status = classify(counts);
+  const total = counts.low + counts.moderate + counts.high + counts.critical;
+  const summary = status === "pass" ? `${used}: 0 vulnerabilities` : `${used}: ${total} vulnerabilities (${counts.critical}C/${counts.high}H/${counts.moderate}M/${counts.low}L)`;
+  return {
+    audit: "security",
+    site: label,
+    status,
+    summary,
+    details: { counts, advisories }
+  };
+}
+
+// src/audits/lighthouse.ts
+import { readFile as readFile4, writeFile, mkdtemp, rm, readdir } from "fs/promises";
+import { tmpdir } from "os";
+import { join as join5 } from "path";
+
+// src/audits/util/site-config.ts
+import { readFile as readFile3 } from "fs/promises";
+import { join as join4 } from "path";
+async function readSiteConfig(sitePath) {
+  let raw;
+  try {
+    raw = await readFile3(join4(sitePath, "package.json"), "utf-8");
+  } catch {
+    return {};
+  }
+  let pkg;
+  try {
+    pkg = JSON.parse(raw);
+  } catch {
+    return {};
+  }
+  if (!pkg || typeof pkg !== "object") return {};
+  const cfg = pkg.reddoor;
+  if (!cfg || typeof cfg !== "object") return {};
+  const out = {};
+  const url = cfg.lighthouseUrl;
+  if (typeof url === "string" && url.length > 0) {
+    out.lighthouseUrl = url;
+  }
+  return out;
+}
+
+// src/util/free-port.ts
+import { createServer } from "net";
+async function findFreePort() {
+  return new Promise((resolve, reject) => {
+    const server = createServer();
+    server.unref();
+    server.on("error", reject);
+    server.listen(0, "127.0.0.1", () => {
+      const addr = server.address();
+      if (typeof addr === "object" && addr) {
+        const port = addr.port;
+        server.close(() => resolve(port));
+      } else {
+        server.close();
+        reject(new Error("findFreePort: could not determine assigned port from socket"));
+      }
+    });
+  });
+}
+function withFreePort(url, port) {
+  const u = new URL(url);
+  u.hostname = "localhost";
+  u.port = String(port);
+  return u.toString();
+}
+
+// src/audits/lighthouse.ts
+async function readJsonMaybe(path) {
+  try {
+    const raw = await readFile4(path, "utf-8");
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+async function readLhrEntries(resultsDir) {
+  const files = await readdir(resultsDir).catch(() => []);
+  const entries = [];
+  for (const f of files) {
+    if (!f.startsWith("lhr-") || !f.endsWith(".json")) continue;
+    const lhr = await readJsonMaybe(join5(resultsDir, f));
+    if (!lhr || !lhr.categories) continue;
+    const summary = {};
+    for (const [k, v] of Object.entries(lhr.categories)) {
+      if (typeof v?.score === "number") summary[k] = v.score;
+    }
+    entries.push({ url: lhr.requestedUrl, summary });
+  }
+  return entries;
+}
+function averageSummaries(entries) {
+  if (entries.length === 0) return {};
+  const sums = {};
+  const counts = {};
+  for (const e of entries) {
+    for (const [k, v] of Object.entries(e.summary ?? {})) {
+      if (typeof v !== "number") continue;
+      sums[k] = (sums[k] ?? 0) + v;
+      counts[k] = (counts[k] ?? 0) + 1;
+    }
+  }
+  const out = {};
+  for (const k of Object.keys(sums)) {
+    const total = sums[k] ?? 0;
+    const count = counts[k] ?? 1;
+    out[k] = total / count;
+  }
+  return out;
+}
+function categoryFromAssertion(a) {
+  const colonIdx = a.name.indexOf(":");
+  return colonIdx >= 0 ? a.name.slice(colonIdx + 1) : a.name;
+}
+function messageForAssertion(a) {
+  const actual = typeof a.actual === "number" ? a.actual.toFixed(2) : "n/a";
+  return `${a.name} ${a.operator} ${a.expected} (actual: ${actual})`;
+}
+async function parseLhciResults(resultsDir, label, raw) {
+  const manifest = await readLhrEntries(resultsDir);
+  if (manifest.length === 0) {
+    return {
+      audit: "lighthouse",
+      site: label,
+      status: "fail",
+      summary: `lighthouse: no lhr-*.json written (exit ${raw.code})${raw.stderr ? ` \u2014 ${raw.stderr.slice(0, 200)}` : ""}`
+    };
+  }
+  const assertionResults = await readJsonMaybe(join5(resultsDir, "assertion-results.json")) ?? [];
+  const failed = assertionResults.filter((a) => !a.passed);
+  const assertions = failed.map((a) => ({
+    category: categoryFromAssertion(a),
+    level: a.level,
+    message: messageForAssertion(a)
+  }));
+  const anyError = assertions.some((a) => a.level === "error");
+  const anyWarn = assertions.some((a) => a.level === "warn");
+  const status = anyError ? "fail" : anyWarn ? "warn" : "pass";
+  const normalized = {
+    summary: averageSummaries(manifest),
+    assertionsFailed: failed.length,
+    assertions
+  };
+  const summary = status === "pass" ? "lighthouse: all categories passing" : `lighthouse: ${failed.length} assertion(s) failed`;
+  return { audit: "lighthouse", site: label, status, summary, details: normalized };
+}
+async function checkoutLighthouse(spawn, site, label) {
+  const siteCfg = await readSiteConfig(site.path);
+  const port = await findFreePort();
+  const baseUrl = siteCfg.lighthouseUrl ?? lighthouseConfig.ci.collect.url[0];
+  const resolvedConfig = {
+    ...lighthouseConfig,
+    ci: {
+      ...lighthouseConfig.ci,
+      collect: {
+        ...lighthouseConfig.ci.collect,
+        url: [withFreePort(baseUrl, port)],
+        startServerCommand: `npm run vite:dev -- --port ${port} --strictPort`
+      }
+    }
+  };
+  const configDir = await mkdtemp(join5(tmpdir(), "reddoor-lhci-"));
+  const configPath = join5(configDir, "lighthouserc.json");
+  await writeFile(configPath, JSON.stringify(resolvedConfig), "utf-8");
+  const resultsDir = join5(site.path, ".lighthouseci");
+  await rm(resultsDir, { recursive: true, force: true });
+  let raw;
+  try {
+    raw = await spawn("npx", ["--yes", "@lhci/cli", "autorun", `--config=${configPath}`], {
+      cwd: site.path,
+      timeoutMs: 5 * 6e4
+    });
+  } catch (err) {
+    await rm(configDir, { recursive: true, force: true });
+    const e = err;
+    if (e.code === "ENOENT" || /ENOENT/.test(String(err))) {
+      return {
+        audit: "lighthouse",
+        site: label,
+        status: "skip",
+        summary: "npx/@lhci/cli not available"
+      };
+    }
+    throw err;
+  }
+  await rm(configDir, { recursive: true, force: true });
+  return parseLhciResults(resultsDir, label, raw);
+}
+async function deployedLighthouse(spawn, deployedUrl, label) {
+  const workDir = await mkdtemp(join5(tmpdir(), "reddoor-lh-deployed-"));
+  const resolvedConfig = {
+    ci: {
+      // Deliberately NOT spread from lighthouseConfig.ci.collect: deployed mode
+      // must omit startServerCommand and the dev-server settings entirely.
+      collect: {
+        url: [deployedUrl],
+        // 3 runs to damp Lighthouse's run-to-run variance; parseLhciResults
+        // averages the lhr files. (Median is a tracked future refinement.)
+        numberOfRuns: 3,
+        settings: { preset: "desktop", skipAudits: ["uses-http2"] }
+      },
+      assert: lighthouseConfig.ci.assert,
+      upload: { target: "filesystem", outputDir: join5(workDir, "lhci-report") }
+    }
+  };
+  const configPath = join5(workDir, "lighthouserc.json");
+  await writeFile(configPath, JSON.stringify(resolvedConfig), "utf-8");
+  const resultsDir = join5(workDir, ".lighthouseci");
+  let raw;
+  try {
+    raw = await spawn("npx", ["--yes", "@lhci/cli", "autorun", `--config=${configPath}`], {
+      cwd: workDir,
+      // 3 serial cold runs of a slow deployed site (lhci's own maxWaitForLoad
+      // ~45-60s each) + first-use Chrome download can plausibly exceed 3 min →
+      // SIGTERM → no lhr-*.json → spurious "no scores". Match the 5-min budget
+      // the checkout path already gives (erp-industrials nightly flake,
+      // morning-brief 2026-06-10 MEDIUM-F).
+      timeoutMs: 5 * 6e4
+    });
+  } catch (err) {
+    await rm(workDir, { recursive: true, force: true });
+    const e = err;
+    if (e.code === "ENOENT" || /ENOENT/.test(String(err))) {
+      return {
+        audit: "lighthouse",
+        site: label,
+        status: "skip",
+        summary: "npx/@lhci/cli not available"
+      };
+    }
+    throw err;
+  }
+  try {
+    return await parseLhciResults(resultsDir, label, raw);
+  } finally {
+    await rm(workDir, { recursive: true, force: true });
+  }
+}
+async function lighthouseAudit(ctx) {
+  const spawn = ctx.spawn ?? defaultSpawn;
+  const site = ctx.site;
+  const label = siteLabel(site);
+  return site.deployedUrl ? deployedLighthouse(spawn, site.deployedUrl, label) : checkoutLighthouse(spawn, site, label);
+}
+
+// src/audits/a11y.ts
+import { readFile as readFile5, writeFile as writeFile2, mkdtemp as mkdtemp2, rm as rm2 } from "fs/promises";
+import { join as join6 } from "path";
+var RESULTS_REL = ".reddoor-a11y/results.json";
+async function readJsonMaybe2(path) {
+  try {
+    const raw = await readFile5(path, "utf-8");
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+function buildPlaywrightConfig(port, sitePath) {
+  return `import { defineConfig } from "@playwright/test";
+
+export default defineConfig({
+  testDir: ".",
+  testMatch: /.*\\.spec\\.ts$/,
+  fullyParallel: true,
+  forbidOnly: !!process.env.CI,
+  retries: process.env.CI ? 2 : 0,
+  reporter: process.env.CI ? "github" : "list",
+  use: {
+    baseURL: "http://localhost:${port}",
+    trace: "on-first-retry",
+  },
+  webServer: {
+    // --strictPort: refuse to bump to a different port if ours is taken,
+    //   so the audit fails loudly instead of probing a zombie.
+    // reuseExistingServer:false: never reuse \u2014 we control the lifecycle.
+    // cwd: playwright's default webServer.cwd is the config file's
+    //   directory. Our config lives in /tmp so without this override,
+    //   "npm run vite:dev" tries to read /tmp/.../package.json and
+    //   ENOENTs before vite ever starts. Caltex 2026-05-28 (0.10.5).
+    command: "npm run vite:dev -- --port ${port} --strictPort",
+    url: "http://localhost:${port}/dev/a11y-fixtures",
+    cwd: ${JSON.stringify(sitePath)},
+    reuseExistingServer: false,
+    timeout: 120_000,
+  },
+});
+`;
+}
+function buildSpec() {
+  return `import { test, expect } from "@playwright/test";
+import AxeBuilder from "@axe-core/playwright";
+import { mkdir, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
+
+const pages = ${JSON.stringify(a11yRoutes)};
+const smokePages = ${JSON.stringify(smokeRoutes)};
+const OUTPUT = process.env.REDDOOR_A11Y_OUTPUT;
+
+// Playwright's default per-test timeout is 30s. We loop through every
+// configured route in a single test, so the budget needs to scale.
+test.setTimeout(5 * 60_000);
+
+test("a11y + hydration across configured routes", async ({ page }) => {
+  const violations = [];
+
+  // Capture uncaught client-side exceptions across every route we visit. A page
+  // that builds + SSRs cleanly can still throw on hydrate and blank itself
+  // (data-dynamiq: a Svelte 4->5 run() referenced a $state declared after it) --
+  // axe never sees that, so we listen for it directly and tag the route in scope.
+  let currentRoute = "";
+  page.on("pageerror", (err) => {
+    violations.push({
+      id: "client-error",
+      impact: "critical",
+      route: currentRoute,
+      help: String(err && err.message ? err.message : err),
+    });
+  });
+
+  for (const { path, name } of pages) {
+    currentRoute = name;
+    await page.goto(path);
+    // Snap CSS transitions/animations to their resting state before axe runs.
+    // AnimateIn-style fixtures transition opacity 0->1; sampling mid-transition
+    // makes axe compute color-contrast against semi-transparent text, yielding a
+    // flaky "serious" color-contrast violation (~1/3 of runs on /dev/animate-in).
+    // Disabling transitions/animations forces the final, rendered state
+    // deterministically -- which is also what users (and prefers-reduced-motion
+    // users) actually see, so it's the correct thing to assert.
+    await page.addStyleTag({
+      content: "*,*::before,*::after{transition:none!important;animation:none!important;}",
+    });
+    const results = await new AxeBuilder({ page })
+      .withTags(["wcag2a","wcag2aa","wcag21a","wcag21aa","wcag22aa"])
+      .analyze();
+    for (const v of results.violations) {
+      violations.push({
+        id: v.id,
+        impact: v.impact ?? "moderate",
+        route: name,
+        help: v.help,
+        helpUrl: v.helpUrl,
+        nodes: v.nodes.map((n) => ({ html: n.html, target: n.target })),
+      });
+    }
+  }
+
+  // Hydration smoke check: load real routes (the homepage) and fail on any
+  // uncaught client-side error. No axe here -- real routes carry pre-existing
+  // a11y debt we don't gate on; we only assert they don't crash on hydrate.
+  // HTTP/SSR errors don't fire 'pageerror', so a data-less CI homepage that
+  // renders empty-but-valid won't false-fail -- only a real client crash does.
+  for (const { path, name } of smokePages) {
+    currentRoute = name;
+    await page.goto(path);
+    // Let hydration + first effects run so a TDZ/ReferenceError surfaces.
+    await page.waitForTimeout(2000);
+  }
+
+  const byImpact = {};
+  for (const v of violations) {
+    byImpact[v.impact] = (byImpact[v.impact] ?? 0) + 1;
+  }
+  if (OUTPUT) {
+    await mkdir(dirname(OUTPUT), { recursive: true });
+    await writeFile(
+      OUTPUT,
+      JSON.stringify({ totalViolations: violations.length, byImpact, violations }, null, 2),
+    );
+  }
+  expect(violations).toEqual([]);
+});
+`;
+}
+async function a11yAudit(ctx) {
+  const spawn = ctx.spawn ?? defaultSpawn;
+  const site = ctx.site;
+  const label = siteLabel(site);
+  const specDir = await mkdtemp2(join6(site.path, ".reddoor-a11y-spec-"));
+  try {
+    const specPath = join6(specDir, "a11y.spec.ts");
+    await writeFile2(specPath, buildSpec(), "utf-8");
+    const port = await findFreePort();
+    const configPath = join6(specDir, "playwright.config.ts");
+    await writeFile2(configPath, buildPlaywrightConfig(port, site.path), "utf-8");
+    const resultsPath = join6(site.path, RESULTS_REL);
+    await rm2(join6(site.path, ".reddoor-a11y"), { recursive: true, force: true });
+    let raw;
+    try {
+      raw = await spawn(
+        "npx",
+        ["--yes", "playwright", "test", `--config=${configPath}`, "--reporter=line", specPath],
+        {
+          cwd: site.path,
+          env: { ...process.env, REDDOOR_A11Y_OUTPUT: resultsPath },
+          // playwright on a cold tree downloads Chrome, boots the site's dev
+          // server, and runs axe over every configured route. The shared 30 s
+          // default in runAudits is fine for deps/lint/security but starves
+          // playwright (mirrors the lighthouse fix shipped earlier).
+          timeoutMs: 5 * 6e4
+        }
+      );
+    } catch (err) {
+      const e = err;
+      if (e.code === "ENOENT" || /ENOENT/.test(String(err))) {
+        return {
+          audit: "a11y",
+          site: label,
+          status: "skip",
+          summary: "npx/playwright not available"
+        };
+      }
+      throw err;
+    }
+    const artifact = await readJsonMaybe2(resultsPath);
+    if (!artifact) {
+      return {
+        audit: "a11y",
+        site: label,
+        status: "fail",
+        summary: `a11y: no results written (exit ${raw.code})${raw.stderr ? ` \u2014 ${raw.stderr.slice(0, 200)}` : ""}`
+      };
+    }
+    const hasSerious = (artifact.byImpact.serious ?? 0) > 0 || (artifact.byImpact.critical ?? 0) > 0;
+    const hasAny = artifact.totalViolations > 0;
+    const status = hasSerious ? "fail" : hasAny ? "warn" : "pass";
+    const summary = status === "pass" ? `a11y: 0 violations across ${a11yRoutes.length} routes (+${smokeRoutes.length} hydration smoke)` : `a11y: ${artifact.totalViolations} violations`;
+    return {
+      audit: "a11y",
+      site: label,
+      status,
+      summary,
+      details: artifact
+    };
+  } finally {
+    await rm2(specDir, { recursive: true, force: true });
+  }
+}
+
+// src/audits/domain.ts
+import { promises as dnsPromises } from "dns";
+import tls from "tls";
+var MS_PER_DAY = 24 * 60 * 60 * 1e3;
+async function checkDomain(url, deps) {
+  let host;
+  try {
+    host = new URL(url).hostname;
+  } catch {
+    return { resolved: false, certDaysRemaining: null };
+  }
+  try {
+    await deps.lookup(host);
+  } catch {
+    return { resolved: false, certDaysRemaining: null };
+  }
+  let validTo;
+  try {
+    validTo = await deps.certValidTo(host);
+  } catch {
+    validTo = null;
+  }
+  if (!validTo || Number.isNaN(validTo.getTime()))
+    return { resolved: true, certDaysRemaining: null };
+  return {
+    resolved: true,
+    certDaysRemaining: Math.floor((validTo.getTime() - deps.now.getTime()) / MS_PER_DAY)
+  };
+}
+function defaultDomainDeps(now) {
+  return {
+    lookup: async (host) => {
+      await dnsPromises.lookup(host);
+    },
+    certValidTo: (host) => new Promise((resolvePromise) => {
+      const socket = tls.connect(
+        { host, port: 443, servername: host, timeout: 1e4, rejectUnauthorized: true },
+        () => {
+          const cert = socket.authorized ? socket.getPeerCertificate() : null;
+          socket.end();
+          const validTo = cert && cert.valid_to ? new Date(cert.valid_to) : null;
+          resolvePromise(validTo);
+        }
+      );
+      socket.on("error", () => resolvePromise(null));
+      socket.on("timeout", () => {
+        socket.destroy();
+        resolvePromise(null);
+      });
+    }),
+    now
+  };
+}
+async function domainAudit(ctx) {
+  const { site } = ctx;
+  const label = siteLabel(site);
+  if (!site.deployedUrl) {
+    return { audit: "domain", site: label, status: "skip", summary: "no deployed URL" };
+  }
+  const now = ctx.now ?? /* @__PURE__ */ new Date();
+  const deps = ctx.domainDeps ?? defaultDomainDeps(now);
+  const check = await checkDomain(site.deployedUrl, deps);
+  const checkedAt = now.toISOString();
+  const status = check.resolved && check.certDaysRemaining !== null && check.certDaysRemaining > 14 ? "pass" : "warn";
+  const summary = !check.resolved ? "did not resolve" : check.certDaysRemaining === null ? "resolved, no usable TLS cert" : `resolved, cert ${check.certDaysRemaining}d remaining`;
+  return {
+    audit: "domain",
+    site: label,
+    status,
+    summary,
+    details: { resolved: check.resolved, certDaysRemaining: check.certDaysRemaining, checkedAt }
+  };
+}
+
+// src/audits/route-discovery.ts
+var DEFAULT_CAP = 15;
+function parseSitemapUrls(xml) {
+  const out = [];
+  const re = /<loc>\s*([^<\s]+)\s*<\/loc>/gi;
+  let m;
+  while ((m = re.exec(xml)) !== null) {
+    const url = m[1];
+    if (url) out.push(url.trim());
+  }
+  return out;
+}
+function parseHtmlLinks(html, baseUrl) {
+  const out = /* @__PURE__ */ new Set();
+  const re = /<a\b[^>]*\bhref\s*=\s*["']([^"']+)["']/gi;
+  let m;
+  while ((m = re.exec(html)) !== null) {
+    const href = m[1];
+    if (!href || href.startsWith("#") || /^(mailto:|tel:|javascript:)/i.test(href)) continue;
+    try {
+      const u = new URL(href, baseUrl);
+      if (u.origin !== new URL(baseUrl).origin) continue;
+      out.add(u.pathname);
+    } catch {
+    }
+  }
+  return [...out];
+}
+function family(pathname) {
+  return pathname.split("/").filter(Boolean)[0] ?? "";
+}
+function sampleRoutePaths(urlsOrPaths, cap = DEFAULT_CAP) {
+  const seen = /* @__PURE__ */ new Set(["/"]);
+  const buckets = /* @__PURE__ */ new Map();
+  for (const raw of urlsOrPaths) {
+    let pathname;
+    try {
+      pathname = raw.startsWith("/") ? new URL(raw, "https://x.invalid").pathname : new URL(raw).pathname;
+    } catch {
+      continue;
+    }
+    if (pathname === "/") continue;
+    if (seen.has(pathname)) continue;
+    seen.add(pathname);
+    const fam = family(pathname);
+    const arr = buckets.get(fam) ?? [];
+    arr.push(pathname);
+    buckets.set(fam, arr);
+  }
+  const result = ["/"];
+  const families = [...buckets.values()];
+  let guard = 0;
+  while (result.length < cap && families.some((f) => f.length > 0) && guard++ < 1e4) {
+    for (const fam of families) {
+      if (result.length >= cap) break;
+      const next = fam.shift();
+      if (next) result.push(next);
+    }
+  }
+  return result;
+}
+function familyCountsOf(paths) {
+  const counts = {};
+  for (const p of paths) {
+    const key = p === "/" ? "/" : `/${family(p)}`;
+    counts[key] = (counts[key] ?? 0) + 1;
+  }
+  return counts;
+}
+async function discoverRoutes(deployedUrl, deps, cap = DEFAULT_CAP) {
+  const origin = new URL(deployedUrl).origin;
+  const abs = (paths) => paths.map((p) => new URL(p, origin).href);
+  const sitemapXml = await deps.fetchText(new URL("/sitemap.xml", origin).href);
+  if (sitemapXml) {
+    const urls = parseSitemapUrls(sitemapXml);
+    if (urls.length > 0) {
+      const paths = sampleRoutePaths(urls, cap);
+      return { routes: abs(paths), source: "sitemap", familyCounts: familyCountsOf(paths) };
+    }
+  }
+  const homeHtml = await deps.fetchText(origin);
+  if (homeHtml) {
+    const links = parseHtmlLinks(homeHtml, origin);
+    if (links.length > 0) {
+      const paths = sampleRoutePaths(links, cap);
+      return { routes: abs(paths), source: "homepage-links", familyCounts: familyCountsOf(paths) };
+    }
+  }
+  return { routes: [new URL("/", origin).href], source: "root-only", familyCounts: { "/": 1 } };
+}
+
+// src/audits/browser.ts
+function isBroken(status) {
+  return status === null || status >= 400;
+}
+function summarizeBrowser(routes, links, familyCounts) {
+  const desktopChecks = routes.flatMap((r) => r.desktop);
+  const mobileChecks = routes.flatMap((r) => r.mobile);
+  const desktopOk = routes.length > 0 && routes.every((r) => r.desktop.length > 0 && r.desktop.every((d) => d.ok));
+  const mobileOk = routes.length > 0 && routes.every((r) => r.mobile.length > 0 && r.mobile.every((m) => m.ok));
+  const brokenLinks = links.filter((l) => isBroken(l.status)).length;
+  const linksOk = links.length > 0 && brokenLinks === 0;
+  const engines = [...new Set(desktopChecks.map((d) => d.engine))];
+  const devices = [...new Set(mobileChecks.map((m) => m.device))];
+  const families = Object.entries(familyCounts).map(([f, n]) => f === "/" ? "/" : `${f} \xD7${n}`).join(", ");
+  const note = `${routes.length} routes (${families}); desktop ${engines.join("/") || "\u2014"}; mobile ${devices.join("/") || "\u2014"}; ${links.length} links, ${brokenLinks} broken`;
+  return { desktopOk, mobileOk, linksOk, brokenLinks, routesChecked: routes.length, note };
+}
+async function browserAudit(ctx) {
+  const { site } = ctx;
+  const label = siteLabel(site);
+  if (!site.deployedUrl) {
+    return { audit: "browser", site: label, status: "skip", summary: "no deployed URL" };
+  }
+  const now = ctx.now ?? /* @__PURE__ */ new Date();
+  const discoverDeps = ctx.discoverDeps ?? defaultDiscoverDeps();
+  const runner = ctx.browserRunner ?? await defaultBrowserRunner();
+  try {
+    const discovered = await discoverRoutes(site.deployedUrl, discoverDeps);
+    const routeResults = await runner.probe(discovered.routes);
+    const internalLinks = [...new Set(routeResults.flatMap((r) => r.links))];
+    const linkResults = await runner.checkLinks(internalLinks);
+    const summary = summarizeBrowser(
+      routeResults,
+      linkResults,
+      discovered.familyCounts ?? familyCountsOf(discovered.routes)
+    );
+    const status = summary.desktopOk && summary.mobileOk && summary.linksOk ? "pass" : "warn";
+    return {
+      audit: "browser",
+      site: label,
+      status,
+      summary: summary.note,
+      details: { ...summary, checkedAt: now.toISOString() }
+    };
+  } finally {
+    await runner.close?.();
+  }
+}
+var FETCH_TIMEOUT_MS = 1e4;
+function defaultDiscoverDeps() {
+  return {
+    fetchText: async (url) => {
+      try {
+        const res = await fetch(url, {
+          redirect: "follow",
+          signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+        });
+        if (!res.ok) return null;
+        return await res.text();
+      } catch {
+        return null;
+      }
+    }
+  };
+}
+var DESKTOP_VIEWPORT = { width: 1366, height: 900 };
+var PAGE_TIMEOUT_MS = 3e4;
+async function defaultBrowserRunner() {
+  const { chromium, firefox, webkit, devices } = await import("@playwright/test");
+  const desktopEngines = [
+    { engine: "chromium", type: chromium },
+    { engine: "firefox", type: firefox },
+    { engine: "webkit", type: webkit }
+  ];
+  const mobileTargets = [
+    { device: "Pixel 7", descriptor: devices["Pixel 7"] },
+    { device: "iPhone 14", descriptor: devices["iPhone 14"] }
+  ];
+  return {
+    async probe(urls) {
+      const results = [];
+      const browsers = await Promise.all(desktopEngines.map((e) => e.type.launch()));
+      const mobileBrowsers = await Promise.all(mobileTargets.map(() => chromium.launch()));
+      try {
+        for (const url of urls) {
+          const desktop = [];
+          const linkSet = /* @__PURE__ */ new Set();
+          for (let i = 0; i < desktopEngines.length; i++) {
+            const engine = desktopEngines[i].engine;
+            const browser = browsers[i];
+            const ctx = await browser.newContext({ viewport: DESKTOP_VIEWPORT });
+            const page = await ctx.newPage();
+            const errors = [];
+            page.on("pageerror", (e) => errors.push(String(e)));
+            let ok = false;
+            try {
+              const resp = await page.goto(url, {
+                waitUntil: "domcontentloaded",
+                timeout: PAGE_TIMEOUT_MS
+              });
+              const hasMain = await page.locator("main, [role=main]").first().isVisible().catch(() => false);
+              ok = !!resp && resp.ok() && errors.length === 0 && hasMain;
+              if (engine === "chromium") {
+                const hrefs = await page.evaluate("Array.from(document.querySelectorAll('a[href]')).map((a) => a.href)").catch(() => []);
+                const origin = new URL(url).origin;
+                for (const h of hrefs) {
+                  try {
+                    if (new URL(h).origin === origin) linkSet.add(new URL(h).href);
+                  } catch {
+                  }
+                }
+              }
+            } catch {
+              ok = false;
+            } finally {
+              await ctx.close().catch(() => {
+              });
+            }
+            desktop.push({ engine, ok });
+          }
+          const mobile = [];
+          for (let i = 0; i < mobileTargets.length; i++) {
+            const { device, descriptor } = mobileTargets[i];
+            const browser = mobileBrowsers[i];
+            const ctx = await browser.newContext({ ...descriptor });
+            const page = await ctx.newPage();
+            const errors = [];
+            page.on("pageerror", (e) => errors.push(String(e)));
+            let ok = false;
+            try {
+              const resp = await page.goto(url, {
+                waitUntil: "domcontentloaded",
+                timeout: PAGE_TIMEOUT_MS
+              });
+              const overflow = await page.evaluate("document.documentElement.scrollWidth > window.innerWidth + 2").catch(() => true);
+              ok = !!resp && resp.ok() && errors.length === 0 && !overflow;
+            } catch {
+              ok = false;
+            } finally {
+              await ctx.close().catch(() => {
+              });
+            }
+            mobile.push({ device, ok });
+          }
+          results.push({ url, desktop, mobile, links: [...linkSet] });
+        }
+      } finally {
+        await Promise.all([...browsers, ...mobileBrowsers].map((b) => b.close().catch(() => {
+        })));
+      }
+      return results;
+    },
+    async checkLinks(urls) {
+      const out = [];
+      for (const url of urls) {
+        let status;
+        try {
+          let res = await fetch(url, {
+            method: "HEAD",
+            redirect: "follow",
+            signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+          });
+          if (res.status === 405 || res.status === 501) {
+            res = await fetch(url, {
+              method: "GET",
+              redirect: "follow",
+              signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+            });
+          }
+          status = res.status;
+        } catch {
+          status = null;
+        }
+        out.push({ url, status });
+      }
+      return out;
+    }
+  };
+}
+
+// src/audits/index.ts
+var REGISTRY = {
+  deps: depsAudit,
+  lint: lintAudit,
+  security: securityAudit,
+  lighthouse: lighthouseAudit,
+  a11y: a11yAudit,
+  domain: domainAudit,
+  browser: browserAudit
+};
+var ALL_AUDIT_NAMES = Object.keys(REGISTRY);
+var DEFAULT_AUDIT_TIMEOUT_MS = 3e4;
+function timedSpawn(timeoutMs) {
+  return (cmd, args, opts = {}) => defaultSpawn(cmd, args, { ...opts, timeoutMs: opts.timeoutMs ?? timeoutMs });
+}
+async function runOneAudit(site, name) {
+  if (!(name in REGISTRY)) throw new Error(`unknown audit: ${name}`);
+  const spawn = timedSpawn(DEFAULT_AUDIT_TIMEOUT_MS);
+  const label = site.name || site.path;
+  try {
+    return await REGISTRY[name]({ site, spawn });
+  } catch (err) {
+    return {
+      audit: name,
+      site: label,
+      status: "fail",
+      summary: `${name}: unexpected error \u2014 ${String(err)}`
+    };
+  }
+}
+async function runAudits(site, which) {
+  const names = which ?? ALL_AUDIT_NAMES;
+  for (const n of names) {
+    if (!(n in REGISTRY)) throw new Error(`unknown audit: ${n}`);
+  }
+  return Promise.all(names.map((n) => runOneAudit(site, n)));
+}
+async function runAuditsAcross(sites, which) {
+  const all = await Promise.all(sites.map((s) => runAudits(s, which)));
+  return all.flat();
+}
+
+export {
+  depsAudit,
+  lintAudit,
+  securityAudit,
+  lighthouseAudit,
+  a11yAudit,
+  ALL_AUDIT_NAMES,
+  runOneAudit,
+  runAudits,
+  runAuditsAcross
+};
+//# sourceMappingURL=chunk-4PY4I5OR.js.map