@tryvitris/website-harness 0.0.0-stage → 0.1.0-beta.5

package/bin/vitris-launch-preflight.js

@@ -0,0 +1,964 @@
+#!/usr/bin/env node
+import {
+  sealReceipt
+} from "./chunks/chunk-6A3VWYMF.js";
+import {
+  browserVerificationTimeoutMs
+} from "./chunks/chunk-2NW7KSPA.js";
+import {
+  artifactManifest
+} from "./chunks/chunk-XL2DRAYI.js";
+import {
+  templateAdaptationFailures
+} from "./chunks/chunk-3CTBXY5K.js";
+import "./chunks/chunk-DSS2U2OM.js";
+import "./chunks/chunk-M4LNHYYR.js";
+import "./chunks/chunk-DRJQ4OOU.js";
+import "./chunks/chunk-PRLL7B63.js";
+import "./chunks/chunk-5OOPJNGN.js";
+import "./chunks/chunk-BBV7PMFC.js";
+import "./chunks/chunk-TY33XMHW.js";
+import "./chunks/chunk-R7YELY3C.js";
+import {
+  LAUNCH_POLICY_ID
+} from "./chunks/chunk-BIEDSEL2.js";
+import "./chunks/chunk-T7DGRVTP.js";
+import "./chunks/chunk-AUO5I56E.js";
+import "./chunks/chunk-6H3T46F5.js";
+import "./chunks/chunk-M2ETYSVJ.js";
+import "./chunks/chunk-FOXUQXTV.js";
+import {
+  closeLighthouseBrowser,
+  lighthouseBrowser,
+  performancePolicy
+} from "./chunks/chunk-IKNMBGGD.js";
+import "./chunks/chunk-WEFDVXFX.js";
+import "./chunks/chunk-E5Y46VBX.js";
+import "./chunks/chunk-4GZCAWWK.js";
+import {
+  parseFrontmatter
+} from "./chunks/chunk-ANMJRJQ5.js";
+import "./chunks/chunk-HNORQ74T.js";
+import {
+  COOKIE_COMPLIANCE_PATH
+} from "./chunks/chunk-YCVGD2CG.js";
+import "./chunks/chunk-LKN75JGA.js";
+import "./chunks/chunk-YYPYYOEV.js";
+import "./chunks/chunk-GZDLXYZV.js";
+import "./chunks/chunk-G7MNMULR.js";
+import {
+  fingerprint
+} from "./chunks/chunk-T6PE4KN4.js";
+import "./chunks/chunk-7FS67SRF.js";
+
+// scripts/launch-preflight.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2, readdirSync, statSync as statSync2, writeFileSync, mkdirSync } from "node:fs";
+import { join, relative as relative2, resolve as resolve2 } from "node:path";
+import { dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { spawnSync } from "node:child_process";
+
+// src/knowledge/checks.ts
+import { gzipSync } from "node:zlib";
+import { createHash } from "node:crypto";
+import { parse } from "parse5";
+var VERIFIER_VERSION = "2026-09-22";
+var TRANSFER_BUDGETS = {
+  id: "vitris-transfer-2026-09-22",
+  authority: "project-policy",
+  firstPartyJsGzip: 100 * 1024,
+  cssGzip: 100 * 1024,
+  fonts: 200 * 1024,
+  initialTransfer: Math.round(1.5 * 1024 * 1024)
+};
+function finding(partial) {
+  return {
+    ...partial,
+    verifierVersion: VERIFIER_VERSION,
+    policyHash: LAUNCH_POLICY_ID,
+    verifiedAt: partial.verifiedAt || "1970-01-01T00:00:00.000Z"
+  };
+}
+function relChannel(channel) {
+  const c = channel / 255;
+  return c <= 0.03928 ? c / 12.92 : ((c + 0.055) / 1.055) ** 2.4;
+}
+function parseHex(input) {
+  const raw = input.trim().replace("#", "");
+  const hex = raw.length === 3 ? raw.split("").map((ch) => ch + ch).join("") : raw;
+  if (!/^[0-9a-fA-F]{6}$/.test(hex)) return void 0;
+  return [parseInt(hex.slice(0, 2), 16), parseInt(hex.slice(2, 4), 16), parseInt(hex.slice(4, 6), 16)];
+}
+function contrastRatio(foreground, background) {
+  const fg = parseHex(foreground);
+  const bg = parseHex(background);
+  if (!fg || !bg) return void 0;
+  const L = (rgb) => 0.2126 * relChannel(rgb[0]) + 0.7152 * relChannel(rgb[1]) + 0.0722 * relChannel(rgb[2]);
+  const lighter = Math.max(L(fg), L(bg));
+  const darker = Math.min(L(fg), L(bg));
+  return (lighter + 0.05) / (darker + 0.05);
+}
+function elements(html) {
+  const found = [];
+  const walk = (node) => {
+    if (node.tagName) found.push(node);
+    for (const child of node.childNodes || []) walk(child);
+  };
+  walk(parse(html));
+  return found;
+}
+function nodeAttrs(node) {
+  return Object.fromEntries((node.attrs || []).map((item) => [item.name.toLowerCase(), item.value]));
+}
+function nodeText(node) {
+  return (node.value || "") + (node.childNodes || []).map(nodeText).join("");
+}
+function accessibleName(tag, node, all) {
+  const a = nodeAttrs(node);
+  if (a["aria-label"]?.trim()) return true;
+  if (a["aria-labelledby"] && a["aria-labelledby"].split(/\s+/).every((id) => all.some((entry) => nodeAttrs(entry).id === id && nodeText(entry).trim()))) return true;
+  if (a.id && all.some((entry) => entry.tagName === "label" && nodeAttrs(entry).for === a.id && nodeText(entry).trim())) return true;
+  let parent = node.parentNode;
+  while (parent) {
+    if (parent.tagName === "label" && nodeText(parent).trim()) return true;
+    parent = parent.parentNode;
+  }
+  if (tag === "input" && a.type === "image" && a.alt?.trim()) return true;
+  if (a.title?.trim()) return true;
+  return false;
+}
+function auditFragment(html, page = "/") {
+  const findings2 = [];
+  const all = elements(html);
+  const controls = all.filter((node) => ["input", "textarea", "select"].includes(node.tagName || ""));
+  for (const node of controls) {
+    const tag = node.tagName;
+    const a = nodeAttrs(node);
+    const type = (a.type || "").toLowerCase();
+    if (tag === "input" && ["hidden", "submit", "button", "reset"].includes(type)) continue;
+    if ("disabled" in a) {
+      findings2.push(finding({
+        id: `disabled-${a.name || a.id || tag}`,
+        requirementId: "wcag-1.4.3-contrast",
+        domain: "accessibility",
+        severity: "note",
+        confidence: "confirmed",
+        status: "not-applicable",
+        page,
+        evidence: "Disabled controls are a contrast exception.",
+        verifier: "form-name",
+        repairOwner: "pages",
+        applicability: "WCAG contrast does not apply to disabled controls."
+      }));
+      continue;
+    }
+    if (!accessibleName(tag, node, all)) {
+      findings2.push(finding({
+        id: `unnamed-${a.name || a.id || tag}`,
+        requirementId: "wcag-3.3.2-labels",
+        domain: "accessibility",
+        severity: "serious",
+        confidence: "confirmed",
+        status: "fail",
+        page,
+        component: "form",
+        evidence: `<${tag}> has no label, aria-label, or aria-labelledby.`,
+        verifier: "form-name",
+        repairOwner: "pages",
+        suggestedRepair: "Associate a visible label with the control."
+      }));
+    }
+    const required = "required" in a || a["aria-required"] === "true";
+    const described = a["aria-describedby"] || a["aria-errormessage"];
+    const describedExists = described?.split(/\s+/).every((id) => all.some((entry) => nodeAttrs(entry).id === id));
+    if (required && !describedExists) {
+      findings2.push(finding({
+        id: `error-${a.name || a.id || tag}`,
+        requirementId: "wcag-3.3.1-error-identification",
+        domain: "accessibility",
+        severity: "warning",
+        confidence: "suspected",
+        status: "warning",
+        page,
+        component: "form",
+        evidence: "Required control has no linked description; browser validation may still identify errors.",
+        verifier: "form-errors",
+        repairOwner: "pages",
+        suggestedRepair: "Point the control at a plain-language error or status element."
+      }));
+    }
+  }
+  const scripts = [...html.matchAll(/<script\b[^>]*>([\s\S]*?)<\/script>/gi)].map((item) => item[1] || "");
+  for (const script of scripts) {
+    const blocksTab = /["']Tab["']|\bTab\b/.test(script) && /preventDefault\s*\(/.test(script);
+    const hasExit = /Escape|dialog\.close|data-trap-exit/.test(script);
+    if (blocksTab && !hasExit) {
+      findings2.push(finding({
+        id: "keyboard-trap",
+        requirementId: "wcag-2.1.1-keyboard",
+        domain: "accessibility",
+        severity: "warning",
+        confidence: "suspected",
+        status: "warning",
+        page,
+        evidence: "Inline script may intercept Tab; exercise the actual keyboard path in a browser.",
+        verifier: "keyboard-trap",
+        repairOwner: "pages",
+        suggestedRepair: "Allow Tab to leave, or provide a keyboard exit."
+      }));
+    }
+  }
+  const sticky = /position\s*:\s*(sticky|fixed)/i.test(html);
+  const focusable = /<(a|button|input|textarea|select)\b/i.test(html);
+  const offset = /scroll-padding-top\s*:/i.test(html) || /data-focus-exception/.test(html);
+  if (sticky && focusable && !offset) {
+    findings2.push(finding({
+      id: "obscured-focus",
+      requirementId: "wcag-2.4.11-focus-not-obscured",
+      domain: "accessibility",
+      severity: "warning",
+      confidence: "suspected",
+      status: "warning",
+      page,
+      evidence: "Fixed or sticky positioning merits a rendered focus-obstruction check.",
+      verifier: "focus-offset",
+      repairOwner: "pages",
+      suggestedRepair: "Add scroll-padding-top at least as tall as the sticky region."
+    }));
+  }
+  for (const match of html.matchAll(/<([a-z0-9]+)\b([^>]*)>/gi)) {
+    const raw = match[2] || "";
+    const style = /style="([^"]*)"/i.exec(raw)?.[1] || "";
+    const color = /(?:^|;)\s*color\s*:\s*(#[0-9a-fA-F]{3,6})/i.exec(style)?.[1];
+    const background = /background(?:-color)?\s*:\s*(#[0-9a-fA-F]{3,6})/i.exec(style)?.[1];
+    if (!color || !background) continue;
+    const ratio = contrastRatio(color, background);
+    if (ratio == null) continue;
+    const font = /font-size\s*:\s*(\d+)px/i.exec(style);
+    const large = font ? Number(font[1]) >= 24 : false;
+    const minimum = large ? 3 : 4.5;
+    if (/\bdisabled\b/i.test(raw)) {
+      findings2.push(finding({
+        id: `contrast-exception-${color}`,
+        requirementId: "wcag-1.4.3-contrast",
+        domain: "accessibility",
+        severity: "note",
+        confidence: "confirmed",
+        status: "not-applicable",
+        page,
+        evidence: "Disabled controls are outside the contrast criterion.",
+        verifier: "contrast",
+        repairOwner: "pages",
+        applicability: "Disabled control exception."
+      }));
+      continue;
+    }
+    if (ratio < minimum) {
+      findings2.push(finding({
+        id: `contrast-${color}-${background}`,
+        requirementId: "wcag-1.4.3-contrast",
+        domain: "accessibility",
+        severity: "warning",
+        confidence: "suspected",
+        status: "warning",
+        page,
+        evidence: `Inline colors imply contrast ${ratio.toFixed(2)}:1 below ${minimum}:1; verify computed colors in the browser.`,
+        verifier: "contrast",
+        repairOwner: "pages",
+        suggestedRepair: "Darken the text or lighten the background until the ratio clears the threshold."
+      }));
+    }
+  }
+  for (const image of all.filter((node) => node.tagName === "img")) {
+    const a = nodeAttrs(image);
+    if (a.alt == null) {
+      findings2.push(finding({
+        id: `img-alt-${a.src || "unknown"}`,
+        requirementId: "wcag-1.1.1-text-alternative",
+        domain: "accessibility",
+        severity: "serious",
+        confidence: "confirmed",
+        status: "fail",
+        page,
+        evidence: "img is missing an alt attribute.",
+        verifier: "text-alternative",
+        repairOwner: "pages",
+        suggestedRepair: 'Add alt text, or alt="" when the image is decorative.'
+      }));
+    }
+  }
+  return findings2;
+}
+function auditIndexing(input) {
+  const findings2 = [];
+  const paths = new Set(input.pages.map((page) => page.path));
+  for (const page of input.pages) {
+    const noindex = /<meta\b[^>]*name=["']robots["'][^>]*content=["'][^"']*noindex/i.test(page.html);
+    if (input.environment === "preview" && noindex) {
+      findings2.push(finding({
+        id: `preview-noindex-${page.path}`,
+        requirementId: "seo-indexing-intent",
+        domain: "seo",
+        severity: "note",
+        confidence: "confirmed",
+        status: "pass",
+        page: page.path,
+        evidence: "Preview noindex is intentional.",
+        verifier: "indexing",
+        repairOwner: "preview"
+      }));
+      continue;
+    }
+    if (input.environment === "production" && noindex && page.intendedIndex) {
+      findings2.push(finding({
+        id: `production-noindex-${page.path}`,
+        requirementId: "seo-indexing-intent",
+        domain: "seo",
+        severity: "serious",
+        confidence: "confirmed",
+        status: "fail",
+        page: page.path,
+        evidence: "Production page is noindex but is intended to be indexed.",
+        verifier: "indexing",
+        repairOwner: "pages",
+        suggestedRepair: "Rebuild with production indexing and remove the unintended robots noindex."
+      }));
+    }
+    const canonical = /<link\b[^>]*rel=["']canonical["'][^>]*href=["']([^"']+)["']/i.exec(page.html)?.[1];
+    if (input.environment === "production" && page.intendedIndex && !canonical) {
+      findings2.push(finding({
+        id: `canonical-missing-${page.path}`,
+        requirementId: "seo-canonical-origin",
+        domain: "seo",
+        severity: "serious",
+        confidence: "confirmed",
+        status: "fail",
+        page: page.path,
+        evidence: "Indexable production page has no canonical URL.",
+        verifier: "canonical",
+        repairOwner: "compiler"
+      }));
+    }
+    if (input.environment === "production" && input.publicOrigin && canonical) {
+      let host = "";
+      try {
+        host = new URL(canonical).origin;
+      } catch {
+        host = "";
+      }
+      const origin = input.publicOrigin.replace(/\/$/, "");
+      if (host !== origin) {
+        findings2.push(finding({
+          id: `canonical-origin-${page.path}`,
+          requirementId: "seo-canonical-origin",
+          domain: "seo",
+          severity: "serious",
+          confidence: "confirmed",
+          status: "fail",
+          page: page.path,
+          evidence: `Canonical origin ${host || canonical} does not match ${origin}.`,
+          verifier: "canonical",
+          repairOwner: "pages",
+          suggestedRepair: "Set canonical to the production origin."
+        }));
+      }
+      try {
+        const target = new URL(canonical).pathname.replace(/\/$/, "") || "/";
+        if (!paths.has(target)) {
+          findings2.push(finding({
+            id: `canonical-target-${page.path}`,
+            requirementId: "seo-canonical-origin",
+            domain: "seo",
+            severity: "serious",
+            confidence: "confirmed",
+            status: "fail",
+            page: page.path,
+            evidence: `Canonical target ${target} is not a built route.`,
+            verifier: "canonical",
+            repairOwner: "pages",
+            suggestedRepair: "Point canonical at a route that exists."
+          }));
+        }
+      } catch {
+      }
+    }
+    if (input.environment === "production" && !input.publicOrigin) {
+      findings2.push(finding({
+        id: `missing-origin-${page.path}`,
+        requirementId: "seo-canonical-origin",
+        domain: "seo",
+        severity: "serious",
+        confidence: "confirmed",
+        status: "fail",
+        page: page.path,
+        evidence: "Production canonical and sitemap checks need publicOrigin.",
+        verifier: "canonical",
+        repairOwner: "launch",
+        suggestedRepair: "Set publicOrigin before production publication."
+      }));
+    }
+    const jsonLd = /<script\b[^>]*type=["']application\/ld\+json["'][^>]*>([\s\S]*?)<\/script>/i.exec(page.html)?.[1];
+    if (jsonLd) {
+      if (jsonLd.includes("</")) {
+        findings2.push(finding({
+          id: `jsonld-breakout-${page.path}`,
+          requirementId: "seo-structured-data-consistency",
+          domain: "seo",
+          severity: "serious",
+          confidence: "confirmed",
+          status: "fail",
+          page: page.path,
+          evidence: "Structured data contains a literal script-closing sequence.",
+          verifier: "structured-data",
+          repairOwner: "compiler",
+          suggestedRepair: "Serialize < as \\u003c."
+        }));
+      }
+      try {
+        const data = JSON.parse(jsonLd);
+        const visible = page.html.replace(/<script[\s\S]*?<\/script>/gi, " ").replace(/<[^>]+>/g, " ");
+        if (data["@type"] === "LocalBusiness" && !data.address) {
+          findings2.push(finding({
+            id: `local-business-${page.path}`,
+            requirementId: "seo-structured-data-consistency",
+            domain: "seo",
+            severity: "serious",
+            confidence: "confirmed",
+            status: "fail",
+            page: page.path,
+            evidence: "LocalBusiness is used without an address.",
+            verifier: "structured-data",
+            repairOwner: "compiler",
+            suggestedRepair: "Use Organization unless a real address is in the facts."
+          }));
+        }
+        if (typeof data.name === "string" && data.name && !visible.includes(data.name)) {
+          findings2.push(finding({
+            id: `schema-name-${page.path}`,
+            requirementId: "seo-structured-data-consistency",
+            domain: "seo",
+            severity: "serious",
+            confidence: "confirmed",
+            status: "fail",
+            page: page.path,
+            evidence: "Structured data name is not in the visible text.",
+            verifier: "structured-data",
+            repairOwner: "pages",
+            suggestedRepair: "Keep the entity name visible."
+          }));
+        }
+      } catch {
+        findings2.push(finding({
+          id: `jsonld-parse-${page.path}`,
+          requirementId: "seo-structured-data-consistency",
+          domain: "seo",
+          severity: "serious",
+          confidence: "confirmed",
+          status: "fail",
+          page: page.path,
+          evidence: "Structured data is not valid JSON.",
+          verifier: "structured-data",
+          repairOwner: "compiler"
+        }));
+      }
+    }
+  }
+  const redirects = input.redirects || [];
+  const graph = /* @__PURE__ */ new Map();
+  for (const route of redirects) {
+    if (route.disposition !== "redirect" && route.disposition !== "consolidate") continue;
+    graph.set(route.from, route.to);
+    if (!paths.has(route.to) && route.to !== "/") {
+      findings2.push(finding({
+        id: `redirect-target-${route.from}`,
+        requirementId: "seo-redirect-integrity",
+        domain: "seo",
+        severity: "serious",
+        confidence: "confirmed",
+        status: "fail",
+        page: route.from,
+        evidence: `Redirect destination ${route.to} is not a built route.`,
+        verifier: "redirects",
+        repairOwner: "storyboard",
+        suggestedRepair: "Choose keep, a real destination, or retire."
+      }));
+    }
+    if (route.to === "/" && route.from !== "/" && !route.intentionalHomepage) {
+      findings2.push(finding({
+        id: `homepage-redirect-${route.from}`,
+        requirementId: "seo-redirect-integrity",
+        domain: "seo",
+        severity: "serious",
+        confidence: "confirmed",
+        status: "fail",
+        page: route.from,
+        evidence: "Material URL redirects to the homepage without an explicit decision.",
+        verifier: "redirects",
+        repairOwner: "storyboard",
+        suggestedRepair: "Mark intentionalHomepage or choose a specific destination."
+      }));
+    }
+  }
+  for (const start of graph.keys()) {
+    const seen = /* @__PURE__ */ new Set();
+    let cursor = start;
+    while (cursor && graph.has(cursor)) {
+      if (seen.has(cursor)) {
+        findings2.push(finding({
+          id: `redirect-loop-${start}`,
+          requirementId: "seo-redirect-integrity",
+          domain: "seo",
+          severity: "serious",
+          confidence: "confirmed",
+          status: "fail",
+          page: start,
+          evidence: `Redirect loop includes ${[...seen, cursor].join(" -> ")}.`,
+          verifier: "redirects",
+          repairOwner: "storyboard",
+          suggestedRepair: "Break the cycle."
+        }));
+        break;
+      }
+      seen.add(cursor);
+      cursor = graph.get(cursor);
+    }
+  }
+  if (input.sitemap) {
+    const locs = [...input.sitemap.matchAll(/<loc>([^<]+)<\/loc>/g)].map((item) => item[1] || "");
+    const banned = /* @__PURE__ */ new Set();
+    for (const page of input.pages) if (!page.intendedIndex) banned.add(page.path);
+    for (const route of redirects) if (route.disposition === "redirect" || route.disposition === "retire") banned.add(route.from);
+    for (const loc of locs) {
+      let path = loc;
+      try {
+        path = new URL(loc, "https://example.invalid").pathname.replace(/\/$/, "") || "/";
+      } catch {
+      }
+      if (banned.has(path)) {
+        findings2.push(finding({
+          id: `sitemap-${path}`,
+          requirementId: "seo-sitemap-exclusions",
+          domain: "seo",
+          severity: "serious",
+          confidence: "confirmed",
+          status: "fail",
+          page: path,
+          evidence: "Sitemap includes a noindex, redirect, or retired URL.",
+          verifier: "sitemap",
+          repairOwner: "compiler",
+          suggestedRepair: "Omit that URL from the sitemap."
+        }));
+      }
+    }
+  }
+  return findings2;
+}
+function gzipSize(bytes) {
+  return gzipSync(typeof bytes === "string" ? Buffer.from(bytes) : bytes).length;
+}
+function auditTransfer(files) {
+  const findings2 = [];
+  let js = 0;
+  let css = 0;
+  let fonts = 0;
+  let total = 0;
+  for (const file of files) {
+    total += file.bytes.length;
+    if (/\.m?js$/i.test(file.path)) js += gzipSize(file.bytes);
+    if (/\.css$/i.test(file.path)) css += gzipSize(file.bytes);
+    if (/\.(woff2?|ttf|otf)$/i.test(file.path)) fonts += file.bytes.length;
+    if (file.bytes.length === 0 && /\.(m?js|css|png|jpg|webp|woff2?)$/i.test(file.path)) {
+      findings2.push(finding({
+        id: `empty-${file.path}`,
+        requirementId: "perf-broken-resource",
+        domain: "performance",
+        severity: "serious",
+        confidence: "confirmed",
+        status: "fail",
+        evidence: `${file.path} is empty.`,
+        verifier: "transfer-budget",
+        repairOwner: "pages",
+        suggestedRepair: "Remove the failed resource or replace it."
+      }));
+    }
+  }
+  const limits = [
+    ["js", js, TRANSFER_BUDGETS.firstPartyJsGzip],
+    ["css", css, TRANSFER_BUDGETS.cssGzip],
+    ["fonts", fonts, TRANSFER_BUDGETS.fonts],
+    ["transfer", total, TRANSFER_BUDGETS.initialTransfer]
+  ];
+  for (const [kind, actual, limit] of limits) {
+    if (actual > limit) {
+      findings2.push(finding({
+        id: `budget-${kind}`,
+        requirementId: "perf-transfer-budget",
+        domain: "performance",
+        severity: "serious",
+        confidence: "confirmed",
+        status: "fail",
+        evidence: `${kind} is ${actual} bytes against the Vitris starting budget of ${limit}. This is a project policy, not a Core Web Vital.`,
+        verifier: "transfer-budget",
+        repairOwner: "pages",
+        suggestedRepair: "Reduce the asset or record an explicit media exception."
+      }));
+    }
+  }
+  return findings2;
+}
+function contentHash(text) {
+  return createHash("sha256").update(text).digest("hex");
+}
+
+// src/knowledge/page-transfer.ts
+import { readFileSync, existsSync, statSync } from "node:fs";
+import { isAbsolute, relative, resolve, sep } from "node:path";
+import { parse as parse2 } from "parse5";
+var assetType = /\.(?:m?js|css|woff2?|ttf|otf)$/i;
+function pageTransferAssets(dist2, page, publicOrigin2) {
+  const base = new URL(publicOrigin2 || "https://vitris.invalid");
+  const pageUrl = new URL("/" + relative(dist2, page.path).replaceAll("\\", "/"), base);
+  const resources = /* @__PURE__ */ new Map();
+  const inlineCss = [], inlineJs = [];
+  function localFile(ref, owner) {
+    let url;
+    try {
+      url = new URL(ref, owner);
+    } catch {
+      return;
+    }
+    if (url.origin !== base.origin || !/^https?:$/.test(url.protocol)) return;
+    let pathname;
+    try {
+      pathname = decodeURIComponent(url.pathname);
+    } catch {
+      return;
+    }
+    const file = resolve(dist2, "." + pathname), rel = relative(resolve(dist2), file);
+    if (!rel || rel === ".." || rel.startsWith(".." + sep) || isAbsolute(rel) || !assetType.test(file)) return;
+    return file;
+  }
+  function cssReferences(css, owner) {
+    const source = css.replace(/\/\*[\s\S]*?\*\//g, "");
+    for (const match of source.matchAll(/url\(\s*(?:"([^"]*)"|'([^']*)'|([^\s)]+))\s*\)|@import\s+["']([^"']+)["']/gi)) {
+      add(match[1] ?? match[2] ?? match[3] ?? match[4], owner);
+    }
+  }
+  function add(ref, owner) {
+    const file = localFile(ref, owner);
+    if (!file || resources.has(file)) return;
+    if (!existsSync(file) || !statSync(file).isFile()) return;
+    const asset = { path: file, bytes: readFileSync(file) };
+    resources.set(file, asset);
+    if (/\.css$/i.test(file)) cssReferences(Buffer.from(asset.bytes).toString("utf8"), new URL(ref, owner));
+  }
+  function walk(node) {
+    if ("tagName" in node) {
+      if (node.tagName === "template" || node.tagName === "noscript") return;
+      const attrs = Object.fromEntries(node.attrs.map((a) => [a.name, a.value]));
+      const text = ("childNodes" in node ? node.childNodes : []).map((c) => "value" in c ? c.value : "").join("");
+      if (node.tagName === "script") {
+        if (attrs.src) add(attrs.src, pageUrl);
+        else if (!attrs.type || /^(?:module|(?:text|application)\/javascript)$/i.test(attrs.type)) inlineJs.push(text);
+      }
+      if (node.tagName === "link" && /(?:^|\s)(?:stylesheet|modulepreload|preload)(?:\s|$)/i.test(attrs.rel || "") && attrs.href) add(attrs.href, pageUrl);
+      if (node.tagName === "style") {
+        inlineCss.push(text);
+        cssReferences(text, pageUrl);
+      }
+      if (attrs.style) {
+        inlineCss.push(attrs.style);
+        cssReferences(attrs.style, pageUrl);
+      }
+    }
+    if ("childNodes" in node) for (const child of node.childNodes) walk(child);
+  }
+  walk(parse2(page.html));
+  return [
+    { path: page.path, bytes: Buffer.from(page.html) },
+    ...resources.values(),
+    ...inlineCss.length ? [{ path: page.path + ".inline.css", bytes: Buffer.from(inlineCss.join("\n")), inline: true }] : [],
+    ...inlineJs.length ? [{ path: page.path + ".inline.js", bytes: Buffer.from(inlineJs.join("\n")), inline: true }] : []
+  ];
+}
+function auditPageTransfers(dist2, pages, publicOrigin2) {
+  return pages.flatMap((page) => {
+    const assets = pageTransferAssets(dist2, page, publicOrigin2);
+    const findings2 = [
+      ...auditTransfer(assets).filter((f) => f.id !== "budget-transfer"),
+      ...auditTransfer(assets.filter((a) => !a.inline)).filter((f) => f.id === "budget-transfer")
+    ];
+    return findings2.map((finding2) => ({
+      ...finding2,
+      id: finding2.id + "-" + relative(dist2, page.path).replaceAll("\\", "/").replace(/[^a-z0-9]+/gi, "-"),
+      page: page.path,
+      evidence: relative(dist2, page.path).replaceAll("\\", "/") + ": " + finding2.evidence
+    }));
+  });
+}
+
+// src/knowledge/launch-policy.ts
+function blocksProduction(finding2) {
+  if (finding2.status === "waived" || finding2.status === "pass" || finding2.status === "not-applicable") return false;
+  if (finding2.status === "tool-error" || finding2.status === "stale") return true;
+  if (finding2.status === "unknown" && finding2.severity === "serious") return true;
+  return finding2.status === "fail" && finding2.severity === "serious" && finding2.confidence === "confirmed";
+}
+function applyOverrides(findings2, overrides = [], buildHash2 = "", activePolicy = LAUNCH_POLICY_ID) {
+  return findings2.map((item) => {
+    const override = overrides.find((entry) => entry.findingId === item.id);
+    if (!override) return item;
+    const matches = override.buildHash === buildHash2 && override.policyHash === activePolicy && override.reason.trim() && override.scope.trim();
+    if (!matches) return item;
+    return { ...item, status: "waived", evidence: `${item.evidence} Waived for scope ${override.scope}: ${override.reason}` };
+  });
+}
+function evaluateLaunchDecision(input) {
+  const adjusted = applyOverrides(input.findings, input.overrides, input.buildHash, LAUNCH_POLICY_ID);
+  const findings2 = [...adjusted];
+  if (input.environment === "production" && input.requiredVerifierStatus && input.requiredVerifierStatus !== "ok") {
+    findings2.push({
+      id: "required-verifier",
+      requirementId: "vitris-launch-evidence-binding",
+      domain: "publication",
+      severity: "serious",
+      confidence: "confirmed",
+      status: input.requiredVerifierStatus === "stale" ? "stale" : "tool-error",
+      evidence: `Required browser verification is ${input.requiredVerifierStatus}.`,
+      verifier: "launch-policy",
+      verifierVersion: "2026-09-22",
+      policyHash: LAUNCH_POLICY_ID,
+      repairOwner: "browser",
+      verifiedAt: "1970-01-01T00:00:00.000Z",
+      suggestedRepair: "Produce a trusted browser receipt for this exact build, or stay on preview."
+    });
+  }
+  if (input.environment === "production" && input.evidenceTrusted === false) {
+    findings2.push({
+      id: "untrusted-evidence",
+      requirementId: "vitris-launch-evidence-binding",
+      domain: "publication",
+      severity: "serious",
+      confidence: "confirmed",
+      status: "fail",
+      evidence: "Browser evidence was not marked trusted. Agent-authored receipts are not accepted.",
+      verifier: "launch-policy",
+      verifierVersion: "2026-09-22",
+      policyHash: LAUNCH_POLICY_ID,
+      repairOwner: "launch",
+      verifiedAt: "1970-01-01T00:00:00.000Z"
+    });
+  }
+  const blockers = findings2.filter(blocksProduction);
+  const waived = findings2.filter((item) => item.status === "waived");
+  const warnings = findings2.filter((item) => item.status === "warning" || item.severity === "warning" && item.status !== "fail");
+  const unknowns = findings2.filter((item) => item.status === "unknown" && item.severity !== "serious");
+  const launchAllowed = input.environment === "production" && blockers.length === 0;
+  const summary = launchAllowed ? "Production launch checks passed. This is not a WCAG conformance claim. Manual coverage stays disclosed." : input.environment === "preview" ? `Preview remains available. ${blockers.length} production blocker(s) would stop launch.` : `Production launch blocked: ${blockers.map((item) => item.id).join(", ") || "verification incomplete"}.`;
+  return {
+    policyId: LAUNCH_POLICY_ID,
+    environment: input.environment,
+    launchAllowed,
+    previewAllowed: true,
+    conformanceClaim: "none",
+    blockers,
+    warnings,
+    unknowns,
+    waived,
+    summary
+  };
+}
+
+// scripts/launch-preflight.ts
+function arg(name) {
+  const index = process.argv.indexOf(name);
+  return index >= 0 ? process.argv[index + 1] : void 0;
+}
+if (process.argv.includes("--help")) {
+  console.log("Usage: vitris-launch-preflight --site DIR --environment preview|production [--origin URL]");
+  process.exit(0);
+}
+var root = resolve2(arg("--site") || ".");
+var environment = arg("--environment") === "production" ? "production" : "preview";
+process.env.VITRIS_SITE_ENVIRONMENT = environment;
+var launch = existsSync2(join(root, "launch.json")) ? JSON.parse(readFileSync2(join(root, "launch.json"), "utf8")) : {};
+var siteConfig = existsSync2(join(root, "site.json")) ? JSON.parse(readFileSync2(join(root, "site.json"), "utf8")) : {};
+var publicOrigin = arg("--origin") || process.env.VITRIS_PUBLIC_ORIGIN || launch.publicOrigin;
+if (publicOrigin) process.env.VITRIS_PUBLIC_ORIGIN = publicOrigin;
+var dist = join(root, "dist");
+var findings = [];
+if (environment === "production") for (const failure of templateAdaptationFailures(root, "launch")) findings.push({
+  id: "template-adaptation-" + findings.length,
+  requirementId: "vitris-launch-evidence-binding",
+  domain: "publication",
+  severity: "serious",
+  confidence: "confirmed",
+  status: "fail",
+  evidence: failure,
+  verifier: "launch-preflight",
+  verifierVersion: "2026-10-10",
+  repairOwner: "template-adaptation",
+  verifiedAt: (/* @__PURE__ */ new Date()).toISOString()
+});
+var browserStatus = "unavailable";
+var evidenceTrusted = false;
+var initialTransferBytes;
+var browserReportHash;
+var screenshotSetHash;
+var browserPrerequisite = true;
+if (environment === "production" && existsSync2(dist) && performancePolicy(root).enabled) {
+  try {
+    const chrome = await lighthouseBrowser();
+    await closeLighthouseBrowser(chrome);
+  } catch (error) {
+    browserPrerequisite = false;
+    findings.push({
+      id: "performance-browser-unavailable",
+      requirementId: "perf-field-cwv",
+      domain: "performance",
+      severity: "serious",
+      confidence: "confirmed",
+      status: "tool-error",
+      evidence: `Lighthouse Chrome could not start: ${error instanceof Error ? error.message : String(error)}`,
+      verifier: "lighthouse-readiness",
+      verifierVersion: "2026-10-24",
+      repairOwner: "browser",
+      verifiedAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+  }
+}
+if (environment === "production" && existsSync2(dist) && browserPrerequisite) {
+  const sibling = dirname(fileURLToPath(import.meta.url));
+  const bundled = join(sibling, "vitris-verify-browser.js");
+  const verifier = existsSync2(bundled) ? bundled : join(sibling, "verify-browser.ts");
+  const run = spawnSync(process.execPath, [
+    ...verifier.endsWith(".ts") ? ["--experimental-strip-types"] : [],
+    verifier,
+    "--site",
+    root
+  ], { encoding: "utf8", env: { ...process.env, VITRIS_SITE_ENVIRONMENT: environment }, timeout: browserVerificationTimeoutMs() });
+  if (run.status === 0) {
+    try {
+      const report = JSON.parse(readFileSync2(join(root, "agent/reviews/browser.json"), "utf8"));
+      const shots = report.checks.flatMap((check) => [check, ...check.firstVisit ? [check.firstVisit] : []]);
+      if (report.checks.length > 0 && report.checks.every((check) => check.failures.length === 0) && report.distHash === fingerprint(root, ["dist"]) && shots.every((shot) => shot.screenshotHash === fingerprint(root, [shot.screenshot]))) {
+        browserStatus = "ok";
+        evidenceTrusted = true;
+        initialTransferBytes = report.checks.find((check) => check.path === "/" && check.width === 375)?.initialTransferBytes;
+        browserReportHash = contentHash(readFileSync2(join(root, "agent/reviews/browser.json"), "utf8"));
+        screenshotSetHash = contentHash(JSON.stringify(shots.map((shot) => ({ path: shot.screenshot, hash: shot.screenshotHash }))));
+      } else browserStatus = "stale";
+    } catch {
+      browserStatus = "stale";
+    }
+  } else {
+    console.error(`Browser verification failed: ${(run.stderr || run.stdout || run.error?.message || "unknown error").slice(-2e3)}`);
+  }
+}
+if (!existsSync2(dist)) {
+  findings.push({
+    id: "dist-missing",
+    requirementId: "vitris-launch-evidence-binding",
+    domain: "publication",
+    severity: "serious",
+    confidence: "confirmed",
+    status: "tool-error",
+    evidence: "dist/ is missing, so production evidence cannot be bound.",
+    verifier: "launch-preflight",
+    verifierVersion: "2026-09-22",
+    policyHash: LAUNCH_POLICY_ID,
+    repairOwner: "preview",
+    verifiedAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
+} else {
+  const htmlFiles = [];
+  const walk = (dir) => {
+    for (const name of readdirSync(dir)) {
+      const path = join(dir, name);
+      if (statSync2(path).isDirectory()) walk(path);
+      else if (name.endsWith(".html")) htmlFiles.push({ path, html: readFileSync2(path, "utf8") });
+    }
+  };
+  walk(dist);
+  for (const file of htmlFiles) findings.push(...auditFragment(file.html, file.path));
+  findings.push(...auditPageTransfers(dist, htmlFiles, publicOrigin));
+  if (environment === "production" && browserStatus === "ok" && initialTransferBytes !== void 0 && initialTransferBytes > TRANSFER_BUDGETS.initialTransfer) findings.push({
+    id: "budget-initial-transfer",
+    requirementId: "perf-transfer-budget",
+    domain: "performance",
+    severity: "serious",
+    confidence: "confirmed",
+    status: "fail",
+    evidence: `Homepage initial requests transferred ${initialTransferBytes} bytes against the ${TRANSFER_BUDGETS.initialTransfer} byte Vitris starting budget.`,
+    verifier: "browser-transfer",
+    verifierVersion: "2026-09-22",
+    policyHash: LAUNCH_POLICY_ID,
+    repairOwner: "pages",
+    verifiedAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  const pages = htmlFiles.map((file) => {
+    let rel = relative2(dist, file.path).replaceAll("\\", "/");
+    if (rel === "index.html") rel = "";
+    else if (rel.endsWith("/index.html")) rel = rel.slice(0, -"/index.html".length);
+    const route = `/${rel}`.replace(/\/$/, "") || "/";
+    const pageFile = rel ? join(root, "pages", `${rel}.html`) : join(root, "pages/index.html");
+    const nestedFile = rel ? join(root, "pages", rel, "index.html") : pageFile;
+    const source = existsSync2(pageFile) ? pageFile : nestedFile;
+    const pageIndexing = existsSync2(source) ? parseFrontmatter(readFileSync2(source, "utf8")).meta.indexing : void 0;
+    return {
+      path: route,
+      html: file.html,
+      intendedIndex: route !== "/404.html" && route !== "/404" && route !== COOKIE_COMPLIANCE_PATH && siteConfig.indexing !== "noindex" && pageIndexing !== "noindex"
+    };
+  });
+  findings.push(...auditIndexing({ environment, pages, publicOrigin, sitemap: existsSync2(join(dist, "sitemap.xml")) ? readFileSync2(join(dist, "sitemap.xml"), "utf8") : void 0 }));
+}
+var manifest = existsSync2(dist) ? artifactManifest(dist) : void 0;
+var buildHash = manifest?.sha256 || "missing-dist";
+var decision = evaluateLaunchDecision({
+  environment,
+  findings,
+  buildHash,
+  requiredVerifierStatus: environment === "production" ? browserStatus : "ok",
+  evidenceTrusted: environment !== "production" || evidenceTrusted
+});
+mkdirSync(join(root, "agent", "reviews"), { recursive: true });
+if (manifest) writeFileSync(join(root, "agent", "reviews", "launch-artifact-manifest.json"), JSON.stringify(manifest, null, 2));
+var buildEvidence = existsSync2(join(dist, "build-evidence.json")) ? JSON.parse(readFileSync2(join(dist, "build-evidence.json"), "utf8")) : {};
+var knowledgeManifest = join(dirname(fileURLToPath(import.meta.url)), "../design-system/knowledge/v2/manifest.json");
+var knowledgeHash = existsSync2(knowledgeManifest) ? contentHash(readFileSync2(knowledgeManifest, "utf8")) : "unavailable";
+var sourceHash = contentHash(JSON.stringify({ source: buildEvidence.sourceHash, compiler: buildEvidence.compilerHash }));
+var configHash = contentHash(["launch.json", "site.json", "onboarding/storyboard.json"].map((path) => existsSync2(join(root, path)) ? contentHash(readFileSync2(join(root, path), "utf8")) : "missing").join("|"));
+var receipt = sealReceipt({
+  id: "launch-preflight",
+  scope: "launch",
+  buildHash,
+  policyHash: LAUNCH_POLICY_ID,
+  knowledgeHash,
+  sourceHash,
+  configHash,
+  themeHash: existsSync2(join(root, "theme/defaults.json")) ? contentHash(readFileSync2(join(root, "theme/defaults.json"), "utf8")) : "missing",
+  mediaHash: existsSync2(join(root, "media")) ? fingerprint(root, ["media"]) : "missing",
+  screenshotHash: screenshotSetHash,
+  contentHash: browserReportHash,
+  passed: decision.launchAllowed,
+  findings
+});
+writeFileSync(join(root, "agent", "reviews", "launch-evidence.json"), JSON.stringify(receipt, null, 2));
+writeFileSync(join(root, "agent", "reviews", "launch-preflight.json"), JSON.stringify({
+  schemaVersion: 1,
+  policyId: decision.policyId,
+  environment,
+  launchAllowed: decision.launchAllowed,
+  previewAllowed: decision.previewAllowed,
+  conformanceClaim: decision.conformanceClaim,
+  summary: decision.summary,
+  blockerIds: decision.blockers.map((item) => item.id),
+  warningIds: decision.warnings.map((item) => item.id),
+  buildHash,
+  evidenceDigest: receipt.digest,
+  manualCoverage: "pending",
+  note: "Automated checks only. This receipt is not a WCAG certification."
+}, null, 2));
+console.log(decision.summary);
+if (environment === "production" && !decision.launchAllowed) process.exit(1);