@twango/twiki 0.0.0-stage → 0.1.0-rc.0

package/site/tooling/live-test.ts

@@ -0,0 +1,138 @@
+import { appendFileSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { resolveProject } from './lib/project-config';
+import { CloudflareDeploymentAPI } from './lib/deployment-upload';
+
+const mode = process.argv[2];
+const project = resolveProject();
+const origin = project.site.url;
+const worker = project.cloudflare?.name;
+const requestedPaths = process.env.TWIKI_LIVE_PATHS;
+const testPaths: string[] = requestedPaths ? JSON.parse(requestedPaths) : ['/'];
+if (
+	!Array.isArray(testPaths) ||
+	testPaths.some(
+		(value) => typeof value !== 'string' || !value.startsWith('/') || value.startsWith('//')
+	)
+)
+	throw new Error('TWIKI_LIVE_PATHS must be a JSON array of local URL paths');
+const directory = 'build/benchmarks/live';
+mkdirSync(directory, { recursive: true });
+if (mode === 'capture' || mode === 'verify-rollback') {
+	if (typeof worker !== 'string' || !/^[a-z0-9][a-z0-9-]*$/.test(worker))
+		throw new Error('Configure the Worker name before live capture');
+	const account = process.env.CLOUDFLARE_ACCOUNT_ID;
+	if (!account || !/^[a-f0-9]{32}$/.test(account)) throw new Error('Missing account identity');
+	const api = new CloudflareDeploymentAPI(process.env.CLOUDFLARE_API_TOKEN ?? '');
+	const result = (await api.request(
+		`/accounts/${account}/workers/scripts/${worker}/deployments`
+	)) as {
+		deployments: { versions: { version_id: string; percentage: number }[] }[];
+	};
+	const versions = result.deployments[0]?.versions;
+	if (
+		versions?.length !== 1 ||
+		versions[0].percentage !== 100 ||
+		!/^[a-f0-9-]{36}$/.test(versions[0].version_id)
+	)
+		throw new Error('Expected one active version');
+	const version = versions[0].version_id;
+	if (mode === 'verify-rollback') {
+		if (version !== process.env.ROLLBACK_VERSION) throw new Error('Rollback version is not active');
+		const response = await fetch(origin, { signal: AbortSignal.timeout(10_000) });
+		if (response.status !== 200 || (await response.text()).length < 1000)
+			throw new Error('Rollback HTML unavailable');
+		console.log(`Verified rollback: ${version}`);
+		process.exit(0);
+	}
+	writeFileSync(`${directory}/rollback.json`, JSON.stringify({ version }, null, 2));
+	appendFileSync(process.env.GITHUB_OUTPUT!, `version=${version}\n`);
+	console.log(`Rollback version: ${version}`);
+} else if (mode === 'baseline' || mode === 'measure') {
+	const paths = testPaths;
+	const reports = [];
+	for (const pathname of paths) {
+		const samples = [];
+		for (let index = 0; index < 9; index++) {
+			const started = performance.now();
+			const response = await fetch(origin + pathname, {
+				redirect: 'manual',
+				signal: AbortSignal.timeout(10_000)
+			});
+			const headersMs = performance.now() - started;
+			const body = await response.text();
+			if (
+				response.status !== 200 ||
+				!response.headers.get('content-type')?.includes('text/html') ||
+				body.length < 1000
+			)
+				throw new Error('Public HTML acceptance failed');
+			if (mode === 'measure' && !response.headers.get('x-wisconsin-application-version'))
+				throw new Error('SSR version header missing');
+			samples.push({
+				headersMs,
+				totalMs: performance.now() - started,
+				colo: response.headers.get('cf-ray')?.split('-').at(-1)
+			});
+		}
+		const warm = samples
+			.slice(1)
+			.map((value) => value.headersMs)
+			.sort((a, b) => a - b);
+		reports.push({
+			path: pathname,
+			firstRequestMs: samples[0].headersMs,
+			warmMedianMs: (warm[3] + warm[4]) / 2,
+			samples
+		});
+	}
+	writeFileSync(`${directory}/${mode}.json`, JSON.stringify(reports, null, 2));
+	console.log(JSON.stringify({ mode, reports }));
+	if (mode === 'measure') {
+		const descriptor = JSON.parse(
+			readFileSync('build/.svelte-kit/cloudflare/_content/current.json', 'utf8')
+		);
+		for (const pathname of [
+			'/_content/current.json',
+			`/_content/full/${descriptor.snapshots.full}/manifest.json`,
+			'/_published/index.html'
+		]) {
+			const response = await fetch(origin + pathname, {
+				redirect: 'manual',
+				signal: AbortSignal.timeout(10_000)
+			});
+			await response.body?.cancel();
+			if (![401, 403, 404].includes(response.status))
+				throw new Error('Internal asset access was not denied');
+		}
+		for (const cookie of process.env.TWIKI_LIVE_PRIVATE_PATH
+			? ['', 'better-auth.session_token=invalid']
+			: []) {
+			const privatePath = process.env.TWIKI_LIVE_PRIVATE_PATH!;
+			if (!privatePath.startsWith('/') || privatePath.startsWith('//'))
+				throw new Error('Invalid private test path');
+			const response = await fetch(origin + privatePath, {
+				headers: { cookie },
+				signal: AbortSignal.timeout(10_000)
+			});
+			if (response.status !== 200 || !(await response.text()).includes('Content locked'))
+				throw new Error('Private note did not render a locked preview');
+		}
+		const baseline = JSON.parse(
+			readFileSync(`${directory}/baseline.json`, 'utf8')
+		) as typeof reports;
+		for (let i = 0; i < reports.length; i++) {
+			if (
+				reports[i].warmMedianMs > Math.max(500, baseline[i].warmMedianMs * 2) ||
+				reports[i].firstRequestMs > 3000
+			)
+				throw new Error('Live response regression exceeded acceptance bounds');
+		}
+	}
+	writeFileSync(`${directory}/${mode}.json`, JSON.stringify(reports, null, 2));
+	console.log(JSON.stringify({ mode, reports }));
+	if (process.env.GITHUB_STEP_SUMMARY)
+		appendFileSync(
+			process.env.GITHUB_STEP_SUMMARY,
+			`### ${mode}\n\n\`\`\`json\n${JSON.stringify(reports, null, 2)}\n\`\`\`\n`
+		);
+} else throw new Error('Expected capture, baseline or measure');

package/site/tooling/pipeline.ts

@@ -0,0 +1,103 @@
+import { existsSync, readFileSync, rmSync } from 'node:fs';
+import path from 'node:path';
+import { stageFingerprint } from './fingerprint';
+import { trackOutputs, writeChanged } from './lib/output';
+import { contentInputFingerprint, contentOutputFingerprint } from './lib/dev-state';
+import { rRendererIdentity } from './lib/r-runtime';
+import { resolveProject, projectIdentity, writeProjectSiteConfig } from './lib/project-config';
+
+const state = globalThis as typeof globalThis & {
+	wisconsinContentBuilds?: Map<string, Promise<Set<string>>>;
+};
+
+export async function prepareContent(
+	reuse = false,
+	changedInputs?: Set<string>,
+	development = false
+) {
+	const builds = (state.wisconsinContentBuilds ??= new Map());
+	const site = process.cwd();
+	const project = resolveProject(site);
+	const repo = project.root;
+	writeProjectSiteConfig(site, project);
+	const key = JSON.stringify([
+		process.cwd(),
+		projectIdentity(project),
+		process.env.VITE_PUBLIC_EDITION,
+		await stageFingerprint('pipeline'),
+		development,
+		development ? rRendererIdentity(repo) : undefined
+	]);
+	const marker = path.resolve('build/generated/dev-state.json');
+	const started = performance.now();
+	let inputs = development ? contentInputFingerprint(repo, key) : '';
+	if (development && reuse && existsSync(marker)) {
+		try {
+			const saved = JSON.parse(readFileSync(marker, 'utf8'));
+			if (saved.inputs === inputs && saved.outputs === contentOutputFingerprint(site)) {
+				console.log(
+					`content startup: reused saved output in ${Math.round(performance.now() - started)}ms`
+				);
+				return new Set<string>();
+			}
+		} catch {
+			/* Reconcile incomplete or stale generated output. */
+		}
+	}
+	if (
+		!development &&
+		reuse &&
+		process.env.WISCONSIN_PREPARED_CONTENT === key &&
+		existsSync('build/generated/content-manifest.json')
+	)
+		return;
+	if (
+		!development &&
+		reuse &&
+		existsSync(path.resolve('build/generated/content-manifest.json')) &&
+		builds.has(key)
+	)
+		return builds.get(key);
+	rmSync(marker, { force: true });
+	// A changed renderer or configuration must reconcile all courses, including unchanged worksheets.
+	const build = runPipeline(
+		development && process.env.WISCONSIN_PREPARED_CONTENT !== key ? undefined : changedInputs,
+		development
+	);
+	builds.set(key, build);
+	try {
+		const changed = await build;
+		if (development) {
+			let current = contentInputFingerprint(repo, key);
+			while (current !== inputs) {
+				inputs = current;
+				for (const file of await runPipeline(undefined, true)) changed.add(file);
+				current = contentInputFingerprint(repo, key);
+			}
+			writeChanged(marker, JSON.stringify({ inputs, outputs: contentOutputFingerprint(site) }));
+		}
+		process.env.WISCONSIN_PREPARED_CONTENT = key;
+		return changed;
+	} catch (error) {
+		builds.delete(key);
+		delete process.env.WISCONSIN_PREPARED_CONTENT;
+		throw error;
+	}
+}
+
+async function runPipeline(changedInputs?: Set<string>, development = false) {
+	const start = performance.now();
+	// A saved development snapshot does not need the parser or asset renderers.
+	const [{ compileContent }, { prepareAssets }] = await Promise.all([
+		import('./compiler'),
+		import('./assets')
+	]);
+	const changed = await trackOutputs(async () => {
+		await compileContent();
+		await prepareAssets(changedInputs, development);
+	});
+	console.log(
+		`content pipeline: ${((performance.now() - start) / 1000).toFixed(2)}s, ${changed.size} changed outputs`
+	);
+	return changed;
+}

package/site/tooling/prepare.ts

@@ -0,0 +1,3 @@
+import { prepareContent } from './pipeline';
+
+await prepareContent();

package/site/tooling/publish.ts

@@ -0,0 +1,28 @@
+import { execFileSync } from 'node:child_process';
+import path from 'node:path';
+import { coursePolicies, publicationDecision } from './lib/publishing';
+
+const repo = path.resolve(import.meta.dir, '../..');
+const policies = coursePolicies(repo);
+const files = execFileSync(
+	'git',
+	['-C', repo, 'ls-files', '-z', '--recurse-submodules', '--', 'content'],
+	{ maxBuffer: 1 << 28 }
+)
+	.toString()
+	.split('\0')
+	.filter(Boolean);
+const requested = process.argv[2]?.replace(/^content\//, '');
+let count = 0;
+for (const tracked of files) {
+	const relative = tracked.slice(8);
+	if (requested && relative !== requested && !relative.startsWith(requested + '/')) continue;
+	const [course, ...segments] = relative.split('/');
+	const decision = publicationDecision(segments.join('/'), policies.get(course));
+	if (decision.public) count++;
+	if (requested || decision.public)
+		console.log(`${decision.public ? 'PUBLIC ' : 'PRIVATE'} ${relative} — ${decision.reason}`);
+}
+console.log(
+	`${count} files selected for publication; normal content and file safety filters still apply.`
+);

package/site/tooling/r-cache.ts

@@ -0,0 +1,45 @@
+import path from 'node:path';
+import { appendFileSync, lstatSync, mkdirSync, realpathSync, writeFileSync } from 'node:fs';
+import { captureRRenderProfile } from './lib/r-runtime';
+import { resolveProject } from './lib/project-config';
+
+const command = process.argv[2];
+const site = path.resolve(import.meta.dirname, '..');
+const options = process.argv.slice(3);
+const ownedOutput = (file: string) => {
+	const absolute = path.resolve(file);
+	mkdirSync(path.dirname(absolute), { recursive: true });
+	const info = lstatSync(absolute, { throwIfNoEntry: false });
+	if (
+		realpathSync(path.dirname(absolute)) !== path.dirname(absolute) ||
+		(info && (!info.isFile() || realpathSync(absolute) !== absolute))
+	)
+		throw new Error('R cache output must be an owned regular file');
+	return absolute;
+};
+if (
+	command === 'capture-profile' &&
+	(!options.length || (options.length === 2 && options[0] === '--output'))
+) {
+	const bytes = JSON.stringify(captureRRenderProfile(), null, 2) + '\n';
+	if (options.length) writeFileSync(ownedOutput(options[1]), bytes);
+	console.log(bytes.trimEnd());
+} else if (
+	command === 'preflight' &&
+	(!options.length || (options.length === 1 && options[0] === '--github-output'))
+) {
+	const { preflightRmdPreviews } = await import('./lib/rmd-preflight');
+	const result = await preflightRmdPreviews(site, resolveProject(site).root);
+	if (options.length) {
+		if (!process.env.GITHUB_OUTPUT)
+			throw new Error('GITHUB_OUTPUT is required with --github-output');
+		appendFileSync(
+			ownedOutput(process.env.GITHUB_OUTPUT),
+			`requiresR=${result.requiresR}\nworksheets=${result.worksheets}\nverified=${result.verified}\n`
+		);
+	}
+	console.log(JSON.stringify(result));
+} else
+	throw new Error(
+		'Use bun tooling/r-cache.ts capture-profile [--output <file>] or preflight [--github-output]'
+	);

package/site/tooling/r-render-profile.json

@@ -0,0 +1,7 @@
+{
+	"schemaVersion": 1,
+	"platform": "linux",
+	"architecture": "x64",
+	"runtime": "R version 4.3.3 (2024-02-29)knitr 1.45evaluate 0.23highr 0.10xfun 0.41yaml 2.3.8\nstructure(list(platform = \"x86_64-pc-linux-gnu\", arch = \"x86_64\", \n    os = \"linux-gnu\", system = \"x86_64, linux-gnu\", status = \"\", \n    major = \"4\", minor = \"3.3\", year = \"2024\", month = \"02\", \n    day = \"29\", `svn rev` = \"86002\", language = \"R\", version.string = \"R version 4.3.3 (2024-02-29)\", \n    nickname = \"Angel Food Cake\"), class = \"simple.list\")\nc(jpeg = TRUE, png = TRUE, tiff = TRUE, tcltk = TRUE, X11 = FALSE, \naqua = FALSE, `http/ftp` = TRUE, sockets = TRUE, libxml = FALSE, \nfifo = TRUE, cledit = FALSE, iconv = TRUE, NLS = TRUE, Rprof = TRUE, \nprofmem = TRUE, cairo = TRUE, ICU = TRUE, long.double = TRUE, \nlibcurl = TRUE)\nc(zlib = \"1.3\", bzlib = \"1.0.8, 13-Jul-2019\", xz = \"5.4.5\", PCRE = \"10.42 2022-12-11\", \nICU = \"74.2\", TRE = \"TRE 0.8.0 R_fixes (BSD)\", iconv = \"glibc 2.39\", \nreadline = \"8.2\", BLAS = \"/usr/lib/x86_64-linux-gnu/blas/libblas.so.3.12.0\"\n)\nc(cairo = \"1.18.0\", cairoFT = \"\", pango = \"1.52.1\", libpng = \"1.6.43\", \njpeg = \"8.0\", libtiff = \"LIBTIFF, Version 4.5.1\")\n\"LC_CTYPE=C.UTF-8;LC_NUMERIC=C;LC_TIME=C.UTF-8;LC_COLLATE=C.UTF-8;LC_MONETARY=C.UTF-8;LC_MESSAGES=C.UTF-8;LC_PAPER=C.UTF-8;LC_NAME=C;LC_ADDRESS=C;LC_TELEPHONE=C;LC_MEASUREMENT=C.UTF-8;LC_IDENTIFICATION=C\"\n\"Etc/UTC\"\n\n\nabind 1.4-5 4.0.1\nbackports 1.4.1 4.1.2\nbase 4.3.3 4.3.3\nbit 4.0.5 4.2.2\nbit64 4.0.5 4.0.2\nboot 1.3-30 4.3.2\nbrio 1.1.4 4.3.2\nbroom 1.0.5 4.3.0\ncallr 3.7.5 4.3.3\ncar 3.1-2 4.3.1\ncarData 3.0-5 4.1.2\ncaret 6.0-94 4.3.0\ncellranger 1.1.0 4.0.1\nclass 7.3-22 4.3.3\ncli 3.6.2 4.3.2\nclipr 0.8.0 4.1.2\nclock 0.7.0 4.3.1\ncodetools 0.2-19 4.2.2\ncolorspace 2.1-0 4.2.2\ncompiler 4.3.3 4.3.3\nconquer 1.3.3 4.2.2\ncpp11 0.4.7 4.3.2\ncrayon 1.5.2 4.2.2\ncurl 5.2.0 4.3.3\ndata.table 1.14.10 4.3.2\ndatasets 4.3.3 4.3.3\ndesc 1.4.3 4.3.2\ndiagram 1.6.5 4.3.1\ndiffobj 0.3.5 4.1.1\ndigest 0.6.34 4.3.2\ndplyr 1.1.4 4.3.2\ne1071 1.7-14 4.3.2\nellipsis 0.3.2 4.1.1\nevaluate 0.23 4.3.2\nfansi 1.0.5 4.3.2\nfarver 2.1.1 4.2.1\nforcats 1.0.0 4.2.2\nforeach 1.5.2 4.1.2\nforeign 0.8-86 4.3.3\nfs 1.6.3 4.3.3\nfuture 1.33.1 4.3.2\nfuture.apply 1.11.1 4.3.2\ngenerics 0.1.3 4.2.1\nggplot2 3.4.4 4.3.1\nglobals 0.16.2 4.2.2\nglue 1.7.0 4.3.2\ngower 1.0.1 4.2.2\ngraphics 4.3.3 4.3.3\ngrDevices 4.3.3 4.3.3\ngrid 4.3.3 4.3.3\ngtable 0.3.4 4.3.1\nhardhat 1.3.1 4.3.2\nhaven 2.5.4 4.3.2\nhighr 0.10 4.2.2\nhms 1.1.3 4.3.1\nipred 0.9-14 4.3.1\nisoband 0.2.7 4.2.2\niterators 1.0.14 4.1.2\njsonlite 1.8.8 4.3.2\nKernSmooth 2.23-22 4.3.3\nknitr 1.45 4.3.2\nlabeling 0.4.3 4.3.1\nlattice 0.22-5 4.3.3\nlava 1.7.3 4.3.2\nlifecycle 1.0.4 4.3.2\nlistenv 0.9.1 4.3.2\nlittler 0.3.19 4.3.2\nlme4 1.1-35.1 4.3.2\nlubridate 1.9.3 4.3.1\nmagrittr 2.0.3 4.1.2\nmaptools 1.1-8 4.3.1\nMASS 7.3-60.0.1 4.3.2\nMatrix 1.6-5 4.3.2\nMatrixModels 0.5-3 4.3.2\nmatrixStats 1.2.0 4.3.2\nmethods 4.3.3 4.3.3\nmgcv 1.9-1 4.3.2\nminqa 1.2.6 4.3.1\nModelMetrics 1.2.2.2 4.0.1\nmunsell 0.5.0 4.0.1\nnlme 3.1-164 4.3.3\nnloptr 2.0.3 4.2.0\nnnet 7.3-19 4.3.3\nnumDeriv 2016.8-1.1 4.0.1\nopenxlsx 4.2.5.2 4.2.2\nparallel 4.3.3 4.3.3\nparallelly 1.37.1 4.3.3\npbkrtest 0.5.2 4.2.2\npillar 1.9.0 4.3.0\npkgbuild 1.4.3 4.3.2\npkgconfig 2.0.3 4.0.1\npkgKitten 0.2.3 4.2.2\npkgload 1.3.4 4.3.2\nplyr 1.8.9 4.3.1\npraise 1.0.0 4.0.1\nprettyunits 1.2.0 4.3.1\npROC 1.18.5 4.3.2\nprocessx 3.8.3 4.3.2\nprodlim 2023.08.28 4.3.1\nprogress 1.2.3 4.3.2\nprogressr 0.14.0 4.3.1\nproxy 0.4-27 4.2.0\nps 1.7.6 4.3.2\npurrr 1.0.2 4.3.1\nquantreg 5.97 4.3.1\nR.methodsS3 1.8.2 4.2.0\nR.oo 1.26.0 4.3.2\nR.utils 2.12.3 4.3.2\nR6 2.5.1 4.1.1\nRColorBrewer 1.1-3 4.2.0\nRcpp 1.0.12 4.3.2\nRcppArmadillo 0.12.8.1.0 4.3.3\nRcppEigen 0.3.4.0.0 4.3.3\nreadr 2.1.5 4.3.2\nreadxl 1.4.3 4.3.1\nrecipes 1.0.9 4.3.2\nrematch 2.0.0 4.3.1\nrematch2 2.1.2 4.0.1\nreshape2 1.4.4 4.0.1\nrio 1.0.1 4.3.1\nrlang 1.1.3 4.3.2\nrpart 4.1.23 4.3.3\nrprojroot 2.0.4 4.3.2\nscales 1.3.0 4.3.2\nshape 1.4.6 4.1.1\nsp 2.1-2 4.3.2\nSparseM 1.81 4.0.4\nsplines 4.3.3 4.3.3\nSQUAREM 2021.1 4.0.3\nstatmod 1.5.0 4.2.2\nstats 4.3.3 4.3.3\nstats4 4.3.3 4.3.3\nstringi 1.8.3 4.3.2\nstringr 1.5.1 4.3.2\nsurvival 3.5-8 4.3.2\ntcltk 4.3.3 4.3.3\ntestthat 3.2.1 4.3.2\ntibble 3.2.1 4.3.1\ntidyr 1.3.1 4.3.2\ntidyselect 1.2.0 4.2.2\ntimechange 0.3.0 4.3.2\ntimeDate 4032.109 4.3.2\ntools 4.3.3 4.3.3\ntzdb 0.4.0 4.3.1\nutf8 1.2.4 4.3.1\nutils 4.3.3 4.3.3\nvctrs 0.6.5 4.3.2\nviridisLite 0.4.2 4.3.1\nvroom 1.6.5 4.3.2\nwaldo 0.5.2 4.3.2\nwithr 2.5.0 4.1.2\nwritexl 1.5.0 4.3.2\nxfun 0.41 4.3.2\nyaml 2.3.8 4.3.2\nzip 2.3.1 4.3.2\n",
+	"runtimeSha256": "4941ee37cbb4f1b5ffd5ae184b19328a2c828530d7985cbf1e8ace72a4f3d202"
+}

package/site/tooling/search.js

@@ -0,0 +1,94 @@
+import * as pagefind from 'pagefind';
+import path from 'node:path';
+import { readFileSync, rmSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { fileSearchRecord } from './lib/file-search.js';
+import { searchHtmlInputs } from './lib/search-inputs.js';
+import {
+	restoreSearchCache,
+	saveSearchCache,
+	searchInputKey,
+	selectSearchCache
+} from './lib/search-cache.js';
+
+/** @param {string} directory */
+export async function indexSearch(directory) {
+	const start = performance.now();
+	const manifest = JSON.parse(readFileSync('build/generated/content-manifest.json', 'utf8'));
+	const html = searchHtmlInputs(manifest, (slug) =>
+		JSON.parse(readFileSync(path.join('build/generated/pages', `${slug}.json`), 'utf8'))
+	);
+	const entries = JSON.parse(readFileSync('src/lib/generated/file-entries.json', 'utf8'));
+	const records = entries.map(fileSearchRecord);
+	const edition = process.env.VITE_PUBLIC_EDITION === 'true' ? 'public' : 'full';
+	const pagefindVersion = JSON.parse(
+		readFileSync(
+			path.resolve(path.dirname(fileURLToPath(import.meta.resolve('pagefind'))), '../package.json'),
+			'utf8'
+		)
+	).version;
+	const key = searchInputKey({ html, records, pagefindVersion, edition });
+	const cacheRoot = path.resolve('build/generated/cache');
+	const cache = path.join(cacheRoot, 'search', edition, key);
+	const output = path.join(directory, 'pagefind');
+	if (restoreSearchCache(cache, output, key, edition)) {
+		const saved = JSON.parse(readFileSync(path.join(cache, 'manifest.json'), 'utf8'));
+		selectSearchCache(cacheRoot, edition, [
+			`search/${edition}/${key}/manifest.json`,
+			...saved.files.map(
+				/** @param {{path: string}} file */ (file) => `search/${edition}/${key}/files/${file.path}`
+			)
+		]);
+		console.log(
+			`search: ${html.length} pages + ${entries.length} file records in ${((performance.now() - start) / 1000).toFixed(2)}s (complete index cached)`
+		);
+		return;
+	}
+	try {
+		const { index, errors } = await pagefind.createIndex();
+		if (!index) throw new Error(errors.join('\n'));
+		for (let offset = 0; offset < html.length; offset += 64) {
+			const results = await Promise.all(
+				html.slice(offset, offset + 64).map((input) => index.addHTMLFile(input))
+			);
+			for (const result of results)
+				if (result.errors.length) throw new Error(result.errors.join('\n'));
+		}
+		// Bound submissions rather than queueing the whole catalog at once.
+		for (let offset = 0; offset < records.length; offset += 64) {
+			const results = await Promise.all(
+				records
+					.slice(offset, offset + 64)
+					.map(
+						/** @param {import('pagefind').CustomRecord} record */ (record) =>
+							index.addCustomRecord(record)
+					)
+			);
+			for (const result of results)
+				if (result.errors.length) throw new Error(result.errors.join('\n'));
+		}
+		// The index owns this directory; remove old generations on a cache miss.
+		rmSync(output, { recursive: true, force: true });
+		const written = await index.writeFiles({ outputPath: output });
+		if (written.errors.length) throw new Error(written.errors.join('\n'));
+		try {
+			selectSearchCache(cacheRoot, edition, saveSearchCache(cacheRoot, output, key, edition));
+		} catch {
+			selectSearchCache(cacheRoot, edition, []);
+			console.log(
+				'search: complete index cache could not be saved; generated index remains available'
+			);
+		}
+		console.log(
+			`search: ${html.length} pages + ${entries.length} file records in ${((performance.now() - start) / 1000).toFixed(2)}s`
+		);
+	} finally {
+		await pagefind.close();
+	}
+}
+
+// The build orchestrator runs this in the same Node runtime as Vite's adapter.
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+	if (!process.argv[2]) throw new Error('Expected Pagefind output directory');
+	await indexSearch(process.argv[2]);
+}

package/site/tooling/verify-deployment.ts

@@ -0,0 +1,109 @@
+import { appendFileSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import path from 'node:path';
+import { site } from '../src/lib/config';
+
+interface Descriptor {
+	schemaVersion: number;
+	applicationVersion: string;
+	snapshots: { public: string; full: string };
+}
+
+export function matchesDeployment(response: Response, descriptor: Descriptor) {
+	return (
+		response.status === 200 &&
+		response.headers.get('content-type')?.includes('text/html') === true &&
+		response.headers.get('x-wisconsin-content-version') === descriptor.snapshots.public &&
+		response.headers.get('x-wisconsin-application-version') === descriptor.applicationVersion
+	);
+}
+
+if (import.meta.main) {
+	const descriptor = JSON.parse(
+		readFileSync('build/.svelte-kit/cloudflare/_content/current.json', 'utf8')
+	) as Descriptor;
+	if (
+		descriptor.schemaVersion !== 1 ||
+		![descriptor.applicationVersion, descriptor.snapshots.public, descriptor.snapshots.full].every(
+			(value) => /^[a-f0-9]{64}$/.test(value)
+		)
+	)
+		throw new Error('Invalid local deployment descriptor');
+	const origin = new URL(process.env.DEPLOYMENT_ORIGIN ?? site.url);
+	if (origin.protocol !== 'https:' && origin.hostname !== '127.0.0.1')
+		throw new Error('Deployment verification requires HTTPS');
+	const started = Date.now();
+	const deadline = started + 45_000;
+	let verified = false;
+	while (Date.now() < deadline) {
+		try {
+			const response = await fetch(origin, {
+				redirect: 'manual',
+				headers: { 'cache-control': 'no-cache' },
+				signal: AbortSignal.timeout(5_000)
+			});
+			const body = await response.text();
+			if (
+				matchesDeployment(response, descriptor) &&
+				(!process.env.DEPLOYMENT_EXPECTED_TEXT ||
+					body.includes(process.env.DEPLOYMENT_EXPECTED_TEXT))
+			) {
+				verified = true;
+				break;
+			}
+		} catch {}
+		await Bun.sleep(500);
+	}
+	if (!verified) throw new Error('The expected application/content version was not verified live');
+	const acceptedAt = Date.now();
+	let deploymentStarted = Number(process.env.DEPLOYMENT_STARTED_AT);
+	let timingSource = 'first-workflow-step';
+	// Job started_at includes runner setup; workflow creation time also includes
+	// queueing, so it is unsuitable for the agreed deployment measurement.
+	if (process.env.GITHUB_TOKEN && process.env.GITHUB_REPOSITORY && process.env.GITHUB_RUN_ID) {
+		try {
+			const jobs = await fetch(
+				`https://api.github.com/repos/${process.env.GITHUB_REPOSITORY}/actions/runs/${process.env.GITHUB_RUN_ID}/attempts/${process.env.GITHUB_RUN_ATTEMPT ?? '1'}/jobs?per_page=100`,
+				{
+					headers: {
+						Authorization: `Bearer ${process.env.GITHUB_TOKEN}`,
+						Accept: 'application/vnd.github+json'
+					},
+					signal: AbortSignal.timeout(5_000)
+				}
+			);
+			if (jobs.ok) {
+				const value = (await jobs.json()) as { jobs?: { name: string; started_at: string }[] };
+				const selected = value.jobs?.find((job) => job.name === process.env.GITHUB_JOB);
+				const timestamp = selected && Date.parse(selected.started_at);
+				if (timestamp && Number.isFinite(timestamp)) {
+					deploymentStarted = timestamp;
+					timingSource = 'github-job-started-at';
+				}
+			}
+		} catch {
+			/* Preserve an explicitly labeled first-step measurement. */
+		}
+	}
+	const report = {
+		verified: true,
+		timingSource,
+		verificationSeconds: (acceptedAt - started) / 1_000,
+		deploymentSeconds:
+			Number.isFinite(deploymentStarted) && deploymentStarted > 0
+				? (acceptedAt - deploymentStarted) / 1_000
+				: null,
+		applicationVersion: descriptor.applicationVersion,
+		publicSnapshot: descriptor.snapshots.public
+	};
+	mkdirSync('build/benchmarks', { recursive: true });
+	writeFileSync(
+		path.join('build/benchmarks', 'deployment.json'),
+		JSON.stringify(report, null, 2) + '\n'
+	);
+	console.log(JSON.stringify(report));
+	if (process.env.GITHUB_STEP_SUMMARY)
+		appendFileSync(
+			process.env.GITHUB_STEP_SUMMARY,
+			`### Verified deployment\n\n\`\`\`json\n${JSON.stringify(report, null, 2)}\n\`\`\`\n`
+		);
+}