@weft-js/cli 0.1.1 → 0.1.2

package/src/catalog/deploy.mjs

@@ -0,0 +1,117 @@
+/** deploy diagnostic entries in catalog order. */
+export const deploy = [
+  // Deploy (research 46): what a host can run, the files and env a deploy needs, CDN and media setup. `weft check` reports
+  // them for `deploy.target` (or the host `--preset` names), `weft deploy` before it builds, `weft doctor` for every host.
+  {
+    code: 'E001',
+    severity: 'error',
+    by: 'cli',
+    catches:
+      "A `channel`, `sharedState` or `realtime({ share })` on a deploy target that can't hold a WebSocket (Netlify, Vercel, AWS Lambda): the page loads and never connects (at runtime: R024)",
+    fix: "`deploy: { target: 'fly' }` or `'render'`, `'cloudflare'` (Durable Objects), or the split: pages here, realtime on a server (`weft docs deploy`)",
+  },
+  {
+    code: 'E002',
+    severity: 'error',
+    by: 'cli',
+    catches:
+      'Something that needs a process between requests on a target that keeps none: a `required` live query (R013), or a `remote()` sidecar',
+    fix: "A server host (`fly`, `render`); for a feed, `weft db listen` on one with `listener: 'external'`; for a sidecar, deploy it on its own with `rust.services.<name>.external: true`",
+  },
+  {
+    code: 'E003',
+    severity: 'error',
+    by: 'cli',
+    catches:
+      'A SQLite file or media uploads on local disk, on a target whose disk is gone after a request or a deploy, or on a server host with no volume or disk configured (a warning in `weft deploy hosts`)',
+    fix: '`deploy.fly.volume` or `deploy.render.disk` (both billed; they mount at `/app/.data`), or a hosted database',
+  },
+  {
+    code: 'E004',
+    severity: 'warning',
+    by: 'cli',
+    catches:
+      'A native npm addon (`better-sqlite3`, `sharp`, `bcrypt`…) built on this machine and deployed from here to a Linux function host',
+    fix: "Deploy from CI (`deploy.ci: 'github'` builds on Linux), or drop the addon",
+  },
+  {
+    code: 'E005',
+    severity: 'info',
+    by: 'cli',
+    catches:
+      'No `deploy.target` (`weft doctor`, `weft deploy hosts`): which hosts can run this app, and the one weft suggests',
+    fix: '`weft deploy init <target>`',
+  },
+  {
+    code: 'E006',
+    severity: 'warning',
+    by: 'cli',
+    catches:
+      'A file `weft deploy init` writes for `deploy.target` (`fly.toml`, `Dockerfile`, the workflow…) is missing, or was written from an older config',
+    fix: '`weft deploy init` (a file edited by hand is left alone; `--force` overwrites it)',
+  },
+  {
+    code: 'E007',
+    severity: 'error',
+    by: 'cli',
+    catches:
+      "A variable `weft deploy --yes` reads is unset (an error in CI or for an id the CLI can't find; a warning where the host CLI's own login stands in)",
+    fix: "Set it in the environment, or log in with the host's CLI here. Never in a file",
+  },
+  // oxlint-disable no-template-curly-in-string -- shows the GitHub Actions syntax
+  {
+    code: 'E008',
+    severity: 'error',
+    by: 'cli',
+    catches:
+      'A deploy credential in a committed file: a Netlify or Fly token, a Render deploy hook, a Cloudinary URL with its secret, or a long value for a key named token, secret, api key or password, in the config, a host file or a workflow',
+    fix: 'Move it to the environment (host settings, or GitHub secrets as `${{ secrets.NAME }}`), and rotate it' /* oxlint-enable no-template-curly-in-string */,
+  },
+  {
+    code: 'E009',
+    severity: 'warning',
+    by: 'cli',
+    catches:
+      "The memory bus on a target that runs many instances: a message reaches one instance's clients (`weft build` fails on it as R002)",
+    fix: '`weft add redis` or `weft add nats`, `postgresBus({ url })`, or `durableObjectBus` on Cloudflare',
+  },
+  {
+    code: 'E010',
+    severity: 'warning',
+    by: 'cli',
+    catches:
+      "`deploy.cdn.proxy` is Cloudflare, and `site.url` is the host's own domain (`*.fly.dev`, `*.onrender.com`): nothing goes through the proxy",
+    fix: 'Set `site.url` to the domain Cloudflare proxies',
+  },
+  {
+    code: 'E011',
+    severity: 'warning',
+    by: 'cli',
+    catches:
+      '`deploy.cdn.proxy` in front of a host that is a CDN already (Netlify, Vercel, Cloudflare): two caches, and a deploy purges only its own',
+    fix: 'Drop `cdn.proxy`, or deploy to `fly` or `render` behind it',
+  },
+  {
+    code: 'E012',
+    severity: 'error',
+    by: 'cli',
+    catches: "`deploy.cdn.images` is Cloudinary, and `@weft-js/plugin-media` isn't in `plugins`",
+    fix: '`weft add media`, or drop `cdn.images`',
+  },
+  {
+    code: 'E013',
+    severity: 'error',
+    by: 'cli',
+    catches:
+      '`deploy.cdn.images` with no `cloud` and no `CLOUDINARY_URL`, or the two naming different clouds (a warning when only the env var is unset, at a deploy)',
+    fix: "Set `cdn.images.cloud`, and `CLOUDINARY_URL` in the host's environment",
+  },
+  {
+    code: 'E014',
+    severity: 'info',
+    by: 'cli',
+    catches:
+      "`deploy.cdn.images` is checked, and this weft doesn't send uploads to Cloudinary yet: they go to `media({ server: { dir } })`",
+    fix: 'Nothing yet (research 46 §9); on a function host, uploads need a server host with a disk (E003)',
+  },
+]

package/src/catalog/design.mjs

@@ -0,0 +1,159 @@
+/** design diagnostic entries in catalog order. */
+export const design = [
+  // The design language (PLAN §6, research 37): tokens and layout where the app has warp's tokens, contrast and accessibility everywhere.
+  {
+    code: 'D001',
+    severity: 'error',
+    by: 'cli',
+    catches:
+      "A raw colour in `style`, app CSS, or a Tailwind arbitrary or palette class, in an app with warp's tokens: it won't follow the theme, the dials or dark mode",
+    fix: "Use a colour token or a `tone`. No autofix: a token follows the theme, the raw value didn't",
+  },
+  {
+    code: 'D002',
+    severity: 'error',
+    by: 'cli',
+    catches:
+      'Spacing off the scale, or a scale step written by hand (`padding: 16px`, `p-[13px]`, `gap-3`)',
+    fix: 'A step of `hair tight related group section page`; autofix when the value is exactly one',
+  },
+  {
+    code: 'D003',
+    severity: 'warning',
+    by: 'cli',
+    catches: 'Raw type, radius or shadow (`font-size`, `text-lg`, `rounded-[7px]`, `box-shadow`)',
+    fix: '`<Heading role>` / `<Text role>`, the radius tokens, `--warp-elevation-*`; autofix for an exact radius',
+  },
+  {
+    code: 'D004',
+    severity: 'warning',
+    by: 'cli',
+    catches:
+      'Layout spelled out on an element (`display: flex`, `flex flex-col gap-4`) where a primitive says it',
+    fix: '`<Stack>` or `<Row>`; a suggested edit when nothing else is on the element',
+  },
+  {
+    code: 'D040',
+    severity: 'warning',
+    by: 'cli',
+    catches:
+      'The style gate (`data-weft="styled"`) on the main content or a page heading: the first paint hides what it should show',
+    fix: 'Mark the secondary part that needs its late styles, or drop the marker',
+  },
+  {
+    code: 'D041',
+    severity: 'error',
+    by: 'cli',
+    catches:
+      '`aria-label` or `aria-labelledby` on a `<div>`, `<span>` or other element whose role may not be named: screen readers drop it (axe aria-prohibited-attr)',
+    fix: 'Put the words in the element (a visually hidden `<span data-part="sr-only">` keeps them off screen), or give it a role that takes a name: `role="img"` for a mark or icon that means something',
+  },
+  {
+    code: 'D005',
+    severity: 'warning',
+    by: 'cli',
+    catches:
+      'A browser-painted control in a warp app: `<button>`, `<select>`, `<textarea>`, an input type like `date`, `number` or `range`, or a `title` tooltip',
+    fix: 'The warp component: focus ring, sweep, tones and touch target come with it',
+  },
+  {
+    code: 'D006',
+    severity: 'warning',
+    by: 'cli',
+    catches:
+      'One heading level at two roles across an app (`h1` as both `title` and `display`), or a bare `<hN>` beside `<Heading>`',
+    fix: 'Drop `role`, or match the rest: `Heading` picks the role from `level`. A suggested edit at each site',
+  },
+  {
+    code: 'D007',
+    severity: 'warning',
+    by: 'cli',
+    catches: 'A bare `<a href>` in a warp app',
+    fix: "`<Link>`, or `Shell`'s `nav` for navigation (suggested edit)",
+  },
+  {
+    code: 'D011',
+    severity: 'error',
+    by: 'cli',
+    catches: 'A literal text and background colour pair on one element below 4.5:1',
+    fix: 'Use tokens: they pass at every dial stop',
+  },
+  {
+    code: 'D012',
+    severity: 'error',
+    by: 'cli',
+    catches:
+      'A Content-Security-Policy that blocks inline styles, or every script a page could switch its deferred sheets on with, in an app that inlines its CSS; as a warning, one that refuses only inline scripts',
+    fix: '`site: { inlineCss: false }` keeps plain links, or allow `unsafe-inline` in the directive that applies',
+  },
+  {
+    code: 'D030',
+    severity: 'error',
+    by: 'cli',
+    catches: 'An `<input>`, `<select>` or `<textarea>` with no label',
+    fix: "A wrapping `<label>`, `<label for>`, `aria-label`, or warp's `<Input label>`",
+  },
+  {
+    code: 'D031',
+    severity: 'error',
+    by: 'cli',
+    catches: 'A button or link with no accessible name (icon only, or empty)',
+    fix: "Text, or `aria-label`; warp's Button takes `label`",
+  },
+  {
+    code: 'D032',
+    severity: 'error',
+    by: 'cli',
+    catches: '`<img>` with no `alt`',
+    fix: 'Describe the image; `alt=""` when it is decoration',
+  },
+  {
+    code: 'D033',
+    severity: 'error',
+    by: 'cli',
+    catches: '`onClick` on a non-interactive element with no role: mouse only',
+    fix: 'A real `<button type="button">` (suggested edit)',
+  },
+  {
+    code: 'D034',
+    severity: 'error',
+    by: 'cli',
+    catches: 'A control inside a control (`<a><button>`)',
+    fix: 'One control: move the other beside it',
+  },
+  {
+    code: 'D035',
+    severity: 'warning',
+    by: 'cli',
+    catches: 'A heading level that jumps (h1 to h3)',
+    fix: 'Use the next level; `<Heading level role>` keeps the look apart from the outline',
+  },
+  {
+    code: 'D036',
+    severity: 'error',
+    by: 'cli',
+    catches: 'The focus ring removed with nothing in its place (`outline: none`, `outline-none`)',
+    fix: "Remove it: warp's `:focus-visible` is the ring. Or add a `focus-visible:` style",
+  },
+  {
+    code: 'D037',
+    severity: 'error',
+    by: 'cli',
+    catches: 'A positive `tabindex`',
+    fix: '`0`, and the order follows the DOM (autofix)',
+  },
+  {
+    code: 'D038',
+    severity: 'warning',
+    by: 'cli',
+    catches: 'Two solid Buttons side by side',
+    fix: 'One primary action per region: make the others `soft` or `ghost`',
+  },
+  {
+    code: 'D039',
+    severity: 'warning',
+    by: 'cli',
+    catches: '`<html>` with no `lang`',
+    fix: 'Set `lang`',
+  },
+]

package/src/catalog/forms.mjs

@@ -0,0 +1,25 @@
+/** forms diagnostic entries in catalog order. */
+export const forms = [
+  {
+    code: 'F001',
+    severity: 'error',
+    by: 'runtime',
+    catches: "`<Form of>` was given something that isn't a mutation",
+    fix: '`<Form of={addTodo}>`, with `addTodo` a `mutation()` export of a server module',
+  },
+  {
+    code: 'F002',
+    severity: 'error',
+    by: 'start',
+    catches:
+      'A form POST without the same-origin proof (`Origin`, or `Sec-Fetch-Site: same-origin`): 403',
+    fix: 'Submit through a `<Form>` on the same origin; behind a proxy, forward the host so the origins match',
+  },
+  {
+    code: 'F003',
+    severity: 'error',
+    by: 'start',
+    catches: 'A form POST naming no known mutation: the page is older than the server',
+    fix: 'Reload; keep `mutation` exports in server modules',
+  },
+]

package/src/catalog/hydration.mjs

@@ -0,0 +1,29 @@
+/** hydration diagnostic entries in catalog order. */
+export const hydration = [
+  // Metadata and share cards (research 20 §6; H for head, M is media). `start`: reported by @weft-js/start at request or
+  // render time, and by `weft routes --meta` for every route.
+  {
+    code: 'H009',
+    severity: 'error',
+    by: 'runtime',
+    catches:
+      "A prop of an island is something JSON can't carry (a function, a Date, a class instance), found as the server renders",
+    fix: 'Pass plain data, or put `/* @weft client */` on the component that renders it',
+  },
+  {
+    code: 'H010',
+    severity: 'info',
+    by: 'cli',
+    catches:
+      "An island has to load with the page for a reason its code could avoid: work that reaches past it, a module that runs as it loads, a box at module level, code the compiler can't see into. `.weft/hydration.json` says why for every island",
+    fix: '`/* @weft visible */` above the component when its work only matters on screen, `/* @weft interaction */` when it only matters to someone using it; otherwise the fix the diagnostic names',
+  },
+  {
+    code: 'H017',
+    severity: 'info',
+    by: 'cli',
+    catches:
+      "A prop on a component holds a function over local names, which can't cross to an island, so the component around it hydrates whole",
+    fix: 'Nothing, when that component is mostly controls; otherwise move each control and what its function reads into a small component of its own, which becomes the island and leaves the rest static',
+  },
+]

package/src/catalog/icons.mjs

@@ -0,0 +1,24 @@
+/** icons diagnostic entries in catalog order. */
+export const icons = [
+  {
+    code: 'I001',
+    severity: 'error',
+    by: 'cli',
+    catches: '`<Icon name="as">`, or `Icons.As`, where no such icon exists',
+    fix: 'Use the name it suggests. `weft docs icons` has the set; an editor completes it from the type.',
+  },
+  {
+    code: 'I002',
+    severity: 'info',
+    by: 'cli',
+    catches: 'An icon name only known at runtime, so that use loads the pack',
+    fix: 'Nothing to do if the name comes from data. To fetch single icons instead, set `icons({ source })`. A list of literals, or a map over one, ships only those.',
+  },
+  {
+    code: 'I003',
+    severity: 'info',
+    by: 'cli',
+    catches: 'The icon pack used as a value, so all of it ships with the page',
+    fix: 'Use `Icons.X`, or `Icons[name]`, which loads lazily.',
+  },
+]

package/src/catalog/media.mjs

@@ -0,0 +1,163 @@
+/** media diagnostic entries in catalog order. */
+export const media = [
+  {
+    code: 'M001',
+    severity: 'error',
+    by: 'plugin',
+    owner: '@weft-js/plugin-media',
+    catches:
+      'Raw `<img>`/`<video>` without `width`/`height` or `aspect-ratio`, outside a `<Boundary>` (inside it is X030)',
+    fix: 'Insert the intrinsic `width`/`height` (autofix for an imported file), or use `<Media>`',
+  },
+  {
+    code: 'M002',
+    severity: 'error',
+    by: 'plugin',
+    owner: '@weft-js/plugin-media',
+    catches: 'An image rendered through a `?url` import or a string path, bypassing the optimizer',
+    fix: '`import x from \'./x.jpg?media\'` and `<Media src={x} alt="…" />`',
+  },
+  {
+    code: 'M003',
+    severity: 'warning',
+    by: 'plugin',
+    owner: '@weft-js/plugin-media',
+    catches:
+      'A raw `<img>` whose file is wider than its `width` × 2 (DPR) × 1.25: bytes nobody sees',
+    fix: '`<Media>`, which resizes',
+  },
+  {
+    code: 'M004',
+    severity: 'warning',
+    by: 'plugin',
+    owner: '@weft-js/plugin-media',
+    catches: 'A GIF over 256 KB rendered raw',
+    fix: '`<Media>` with `mediaFfmpeg()` in `plugins`, which turns GIFs into video when that saves 15%',
+  },
+  {
+    code: 'M005',
+    severity: 'error',
+    by: 'plugin',
+    owner: '@weft-js/plugin-media',
+    catches:
+      '`<video autoplay>` without `muted`: browsers block it, and sound before a gesture is hostile',
+    fix: 'Add `muted` (autofix)',
+  },
+  {
+    code: 'M006',
+    severity: 'warning',
+    by: 'plugin',
+    owner: '@weft-js/plugin-media',
+    catches: '`<video>` without `poster`: a blank box until the first frame decodes',
+    fix: 'Add a `poster` image',
+  },
+  {
+    code: 'M007',
+    severity: 'error',
+    by: 'plugin',
+    owner: '@weft-js/plugin-media',
+    catches:
+      'Missing `alt` on `<Media>`/`<img>`, `<Media alt="">` without `decorative`, or `alt` equal to the file name',
+    fix: 'Describe what the image shows; `alt="" decorative` for purely visual media',
+  },
+  {
+    code: 'M008',
+    severity: 'warning',
+    by: 'plugin',
+    owner: '@weft-js/plugin-media',
+    catches:
+      'A route\'s first media is `loading="lazy"`, or `priority` media is lazy: the likely LCP image loads late',
+    fix: 'Mark the hero `priority` and drop `loading="lazy"`',
+  },
+  {
+    code: 'M009',
+    severity: 'warning',
+    by: 'plugin',
+    owner: '@weft-js/plugin-media',
+    catches: '`priority` on more than 2 media in one route: they compete for the first bytes',
+    fix: 'Keep `priority` on the one hero image',
+  },
+  {
+    code: 'M010',
+    severity: 'warning',
+    by: 'plugin',
+    owner: '@weft-js/plugin-media',
+    catches:
+      'A `priority` `<Media>` without `width` or `sizes`: eager images can\'t use `sizes="auto"`, so the browser assumes 100vw',
+    fix: 'Pass `width="1/2"` (a viewport fraction or CSS length) or `sizes`',
+  },
+  {
+    code: 'M011',
+    severity: 'warning',
+    by: 'plugin',
+    owner: '@weft-js/plugin-media',
+    catches:
+      '`<video autoplay loop>` without `controls`, or a GIF in a raw `<img>`: endless motion with no pause (WCAG 2.2.2)',
+    fix: '`<Media>` (pause control, poster under reduced motion), or add `controls`',
+  },
+  {
+    code: 'M012',
+    severity: 'error',
+    by: 'plugin',
+    owner: '@weft-js/plugin-media',
+    catches:
+      'An SVG with `<script>`, `foreignObject`, `on*=` handlers or external references, used as an image',
+    fix: 'Sanitise the file; the build refuses to optimise it',
+  },
+  {
+    code: 'M013',
+    severity: 'warning',
+    by: 'plugin',
+    owner: '@weft-js/plugin-media',
+    catches: 'A file in `public/` referenced by string: untracked, unoptimised, no dimensions',
+    fix: "Move it next to the code and `import x from './x.jpg?media'`",
+  },
+  {
+    code: 'M014',
+    severity: 'info',
+    by: 'plugin',
+    owner: '@weft-js/plugin-media',
+    catches: "What `encoder: 'compatible'` adds to the build for compatible copies",
+    fix: 'Nothing: it says what the toggle costs',
+  },
+  {
+    code: 'M015',
+    severity: 'warning',
+    by: 'plugin',
+    owner: '@weft-js/plugin-media',
+    catches: 'An HDR or over-8-bit video that comes out 8-bit SDR',
+    fix: 'Convert the source on purpose, or accept the flattening',
+  },
+  {
+    code: 'M016',
+    severity: 'warning',
+    by: 'plugin',
+    owner: '@weft-js/plugin-media',
+    catches:
+      '`<Media src>` given a string: nothing knows its size before it loads, so the page shifts',
+    fix: 'Import it with `?media`, or store what `ctx.media.ingest` returns and type the field `z.media()`',
+  },
+  {
+    code: 'M017',
+    severity: 'error',
+    by: 'start',
+    catches: '`ctx.media` or a `/_weft/m/` URL used with no `media.server` provider',
+    fix: 'Add `media()` from `@weft-js/plugin-media` to `plugins` in weft.config.ts',
+  },
+  {
+    code: 'M019',
+    severity: 'error',
+    by: 'plugin',
+    owner: '@weft-js/plugin-media-ffmpeg',
+    catches: 'ffmpeg did not run, is not the pinned binary, or has no encoder for a codec',
+    fix: 'Install ffmpeg, or give `mediaFfmpeg({ binary })` its path',
+  },
+  {
+    code: 'M018',
+    severity: 'error',
+    by: 'start',
+    catches:
+      "An upload refused: it isn't an image weft can read, or it's over the size limit (422)",
+    fix: 'Raise `media({ server: { maxBytes } })`, or check the file on the client first',
+  },
+]

package/src/catalog/metadata.mjs

@@ -0,0 +1,116 @@
+/** metadataHead diagnostic entries in catalog order. */
+export const metadataHead = [
+  {
+    code: 'H001',
+    severity: 'warning',
+    by: 'cli',
+    catches:
+      "No `site.url`: a build has no absolute canonical, og:url or og:image, and a server takes them from the request's Host header",
+    fix: 'Set `site.url`, or `WEFT_SITE_URL` in the deploy environment',
+  },
+  {
+    code: 'H002',
+    severity: 'error',
+    by: 'cli',
+    catches:
+      'Param route with an `auto` image on a static-only preset and no `prerender` (`weft routes --meta --preset static`)',
+    fix: 'Export `prerender`, or set `og.image`',
+  },
+  {
+    code: 'H003',
+    severity: 'warning',
+    by: 'cli',
+    catches:
+      'No description after merging the config, layouts and route (`weft check`, per route and on `site`)',
+    fix: "Set `site.description` (or the route's `meta.description`)",
+  },
+  {
+    code: 'H004',
+    severity: 'warning',
+    by: 'cli',
+    catches: 'Title over 60 characters or description over 160 (search results and cards cut them)',
+    fix: 'Shorten it',
+  },
+  {
+    code: 'H011',
+    severity: 'warning',
+    by: 'cli',
+    catches:
+      'A page sets no `meta`, or leaves out its title or description: they come from what it renders (its `h1`, its first paragraph) or the site default',
+    fix: 'Add `meta` when you build the page, in words written for it; the diagnostic carries a starting point',
+  },
+  {
+    code: 'H012',
+    severity: 'warning',
+    by: 'cli',
+    catches: 'Two routes have the same title',
+    fix: 'Give each page a title from what is on it',
+  },
+  {
+    code: 'H013',
+    severity: 'warning',
+    by: 'cli',
+    catches: 'Two routes have the same description, usually the site default',
+    fix: 'Give each page a description from what is on it',
+  },
+  {
+    code: 'H014',
+    severity: 'warning',
+    by: 'cli',
+    catches:
+      'A param route whose `meta` ignores `data` and `params`, or whose real pages all have the same title or description',
+    fix: 'Build `meta` from `data` and `params`: `({ data }) => ({ title: data.name, description: data.summary })`',
+  },
+  {
+    code: 'H015',
+    severity: 'warning',
+    by: 'cli',
+    catches:
+      'A written description that reads like code, a markdown fragment or a cut-off sentence',
+    fix: 'Write one plain sentence. Never slice raw markdown or code into `description`',
+  },
+  {
+    code: 'H016',
+    severity: 'info',
+    by: 'cli',
+    catches:
+      "A route `weft check` couldn't fully check: it failed here, or a param route with no page to sample",
+    fix: 'Export `prerender`, or link to a page of it; `check: { routes: false }` turns the route pass off',
+  },
+]
+
+/** metadataCards diagnostic entries in catalog order. */
+export const metadataCards = [
+  {
+    code: 'H005',
+    severity: 'error',
+    by: 'start',
+    catches:
+      '`.og.tsx` uses a style or element the card renderer does not support (an error in dev; production drops the declaration)',
+    fix: 'Use flexbox, text, images, borders, radius, gradients, shadows',
+  },
+  {
+    code: 'H006',
+    severity: 'error',
+    by: 'cli',
+    catches:
+      '`meta` reads a box or calls a hook (metadata is plain data); found statically by `weft check`',
+    fix: 'Compute it from `params` and `data`',
+  },
+  {
+    code: 'H007',
+    severity: 'error',
+    by: 'start',
+    catches:
+      "`meta` (or a card) reads a deferred (streamed) field of the loader's data: the request fails with 500 instead of a page with missing tags",
+    fix: 'Await the field in `load`, or leave it out of `meta`',
+  },
+  {
+    code: 'H008',
+    severity: 'warning',
+    by: 'start',
+    catches:
+      "A card's `<img>` didn't load (timeout, HTTP error, not an image, too large, host not allowed); the card renders without it",
+    fix: 'Fix the URL, or embed the image with an import',
+  },
+]