@woodsportal/hubspot-kit 1.0.41 → 1.0.42-dev.1

package/scripts/cli-smoke-helpers.mjs

@@ -0,0 +1,150 @@
+import { spawnSync } from 'node:child_process'
+import { cpSync, existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { dirname, join, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+export const kitRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..')
+export const cliEntry = join(kitRoot, 'src/cli/index.ts')
+
+const LEGACY_SHIM_SCRIPTS = [
+  'build-cdn.mjs',
+  'run-vite-build.mjs',
+  'run-hubspot-module-postbuild.mjs',
+  'watch-hubspot.mjs',
+]
+
+const FIXTURE_PATHS = {
+  'greenfield/module-hybrid-cdn': join(kitRoot, 'examples/greenfield/module-hybrid-cdn'),
+  'greenfield/module-hybrid-cdn-auth-starter': join(
+    kitRoot,
+    'examples/greenfield/module-hybrid-cdn-auth-starter',
+  ),
+  'fixtures/adopted-module-monolith': join(kitRoot, 'examples/fixtures/adopted-module-monolith'),
+}
+
+/**
+ * @param {string | null | undefined} projectRoot
+ * @param {string[]} args
+ * @param {{ skipProject?: boolean; cwd?: string; extraEnv?: Record<string, string> }} [opts]
+ */
+export function runWp(projectRoot, args, opts = {}) {
+  const globalFlags = opts.skipProject
+    ? ['--ci', '-y']
+    : ['--project', projectRoot, '--ci', '-y']
+
+  return spawnSync(
+    process.execPath,
+    ['--import', 'tsx', cliEntry, ...globalFlags, ...args],
+    {
+      cwd: opts.cwd ?? kitRoot,
+      encoding: 'utf8',
+      env: { ...process.env, NO_COLOR: '1', ...opts.extraEnv },
+    },
+  )
+}
+
+/**
+ * @param {string} stdout
+ */
+export function parseJsonLine(stdout) {
+  const lines = stdout
+    .split('\n')
+    .map((line) => line.trim())
+    .filter(Boolean)
+  for (let i = lines.length - 1; i >= 0; i -= 1) {
+    const line = lines[i]
+    if (!line.startsWith('{')) continue
+    try {
+      return JSON.parse(line)
+    } catch {
+      // continue
+    }
+  }
+  throw new Error(`No JSON line found in stdout:\n${stdout}`)
+}
+
+/**
+ * @param {string} fixtureKey
+ * @param {string} targetDir
+ */
+export function copyFixture(fixtureKey, targetDir) {
+  const source = FIXTURE_PATHS[fixtureKey]
+  if (!source || !existsSync(source)) {
+    throw new Error(`Unknown or missing fixture: ${fixtureKey}`)
+  }
+  cpSync(source, targetDir, { recursive: true })
+}
+
+/**
+ * @param {string} fixtureKey
+ * @param {(dir: string) => void | Promise<void>} fn
+ */
+export async function withTempFixture(fixtureKey, fn) {
+  const dir = mkdtempSync(join(tmpdir(), 'wphs-cli-fixture-'))
+  try {
+    copyFixture(fixtureKey, dir)
+    await fn(dir)
+  } finally {
+    rmSync(dir, { recursive: true, force: true })
+  }
+}
+
+/**
+ * @param {string} dir
+ */
+export function seedModuleBuildId(dir) {
+  writeFileSync(join(dir, '.module-build-id'), '# baseline\nv0.0.1-dev\n')
+}
+
+/**
+ * CDN build/deploy dry-runs need baseline + dev slug (no git user.name in CI).
+ * @param {string} dir
+ */
+export function seedCdnBuildPrereqs(dir) {
+  seedModuleBuildId(dir)
+  const configDir = join(dir, '.wphs', 'config')
+  mkdirSync(configDir, { recursive: true })
+  writeFileSync(join(configDir, 'developer.json'), `${JSON.stringify({ slug: 'cli-smoke' }, null, 2)}\n`)
+}
+
+/**
+ * @param {string} dir
+ */
+export function seedHubspotConfig(dir) {
+  writeFileSync(
+    join(dir, 'hubspot.config.yml'),
+    `defaultPortal: dev
+portals:
+  - name: dev
+    portalId: 12345
+`,
+  )
+}
+
+/**
+ * @param {string} dir
+ */
+export function seedRegressionShims(dir) {
+  const scriptsDir = join(dir, 'scripts')
+  mkdirSync(scriptsDir, { recursive: true })
+  for (const script of LEGACY_SHIM_SCRIPTS) {
+    cpSync(join(kitRoot, 'scripts', script), join(scriptsDir, script))
+  }
+}
+
+/**
+ * @param {number | number[]} expected
+ * @param {import('node:child_process').SpawnSyncReturns<string>} result
+ * @param {string} label
+ */
+export function assertExit(expected, result, label) {
+  const allowed = Array.isArray(expected) ? expected : [expected]
+  if (allowed.includes(result.status ?? -1)) {
+    return
+  }
+  const detail = [result.stderr, result.stdout].filter(Boolean).join('\n')
+  throw new Error(
+    `${label}: expected exit ${allowed.join(' or ')}, got ${result.status}\n${detail}`,
+  )
+}

package/scripts/dist-cli-pack-smoke.test.mjs

@@ -0,0 +1,79 @@
+import assert from 'node:assert/strict'
+import { spawnSync } from 'node:child_process'
+import { existsSync, mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { test } from 'node:test'
+
+import { copyFixture, kitRoot } from './cli-smoke-helpers.mjs'
+
+const distCli = join(kitRoot, 'dist/cli.js')
+
+test('dist cli: doctor scaffolds .wphs without SyntaxError', () => {
+  if (!existsSync(distCli)) {
+    console.log('skip: dist/cli.js missing — run npm run build first')
+    return
+  }
+
+  const dir = mkdtempSync(join(tmpdir(), 'wphs-dist-pack-'))
+  try {
+    copyFixture('greenfield/module-hybrid-cdn', dir)
+    const result = spawnSync(
+      process.execPath,
+      [distCli, '--project', dir, '--ci', '-y', 'doctor'],
+      {
+        cwd: kitRoot,
+        encoding: 'utf8',
+        env: { ...process.env, NO_COLOR: '1', WP_SKIP_VERSION_CHECK: '1' },
+      },
+    )
+
+    const combined = `${result.stdout}\n${result.stderr}`
+    assert.doesNotMatch(combined, /Invalid or unexpected token/)
+    assert.ok(
+      result.status === 0 || result.status === 2,
+      `unexpected exit ${result.status}: ${combined}`,
+    )
+    assert.ok(existsSync(resolve(dir, '.wphs', 'config')), 'expected .wphs/config after doctor')
+  } finally {
+    rmSync(dir, { recursive: true, force: true })
+  }
+})
+
+test('dist cli: init dry-run completes without SyntaxError', () => {
+  if (!existsSync(distCli)) {
+    console.log('skip: dist/cli.js missing — run npm run build first')
+    return
+  }
+
+  const targetDir = mkdtempSync(join(tmpdir(), 'wphs-dist-init-'))
+  try {
+    const result = spawnSync(
+      process.execPath,
+      [
+        distCli,
+        '--ci',
+        '-y',
+        '--dry-run',
+        'init',
+        '-t',
+        'module-hybrid-cdn',
+        '-n',
+        'dist-init-smoke',
+        '--directory',
+        targetDir,
+      ],
+      {
+        cwd: kitRoot,
+        encoding: 'utf8',
+        env: { ...process.env, NO_COLOR: '1', WP_SKIP_VERSION_CHECK: '1' },
+      },
+    )
+
+    const combined = `${result.stdout}\n${result.stderr}`
+    assert.doesNotMatch(combined, /Invalid or unexpected token/)
+    assert.equal(result.status, 0, combined)
+  } finally {
+    rmSync(targetDir, { recursive: true, force: true })
+  }
+})

package/scripts/ensure-wphs-workspace.mjs

@@ -1,8 +1,9 @@
-#!/usr/bin/env node
 /**
  * Scaffold WoodsCLI `.wphs/` workspace + kit symlinks.
  */
 import { existsSync, mkdirSync, writeFileSync } from 'node:fs'
+import { resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
 
 import { findProjectRoot, getKitRoot } from './project-root.mjs'
 import { wphsPaths, wphsWorkspaceSubdirs } from './wphs-paths.mjs'
@@ -48,7 +49,11 @@ export function ensureWphsWorkspace(projectRoot, kitRoot) {
   return paths
 }
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+const invokedDirectly =
+  process.argv[1] &&
+  resolve(fileURLToPath(import.meta.url)) === resolve(process.argv[1])
+
+if (invokedDirectly) {
   const paths = ensureWphsWorkspace()
   console.log(`[wphs] workspace ready at ${paths.workspaceRoot}`)
 }

package/scripts/generate-cdn-bundle-breakdown.mjs

@@ -0,0 +1,61 @@
+#!/usr/bin/env node
+/**
+ * Write docs/audit/CDN-BUNDLE-BREAKDOWN.md from cdn-bundle-visualizer.json (rollup-plugin-visualizer v2).
+ */
+import { existsSync, readFileSync, writeFileSync } from 'node:fs'
+import { resolve } from 'node:path'
+import { findProjectRoot } from './project-root.mjs'
+
+const root = findProjectRoot()
+const jsonPath = resolve(root, 'docs/audit/cdn-bundle-visualizer.json')
+const outPath = resolve(root, 'docs/audit/CDN-BUNDLE-BREAKDOWN.md')
+
+if (!existsSync(jsonPath)) {
+  console.error(
+    `[cdn-breakdown] Missing ${jsonPath} — run: yarn audit:cdn-bundle`,
+  )
+  process.exit(1)
+}
+
+const data = JSON.parse(readFileSync(jsonPath, 'utf8'))
+const { nodeParts = {}, nodeMetas = {} } = data
+
+const leaves = Object.entries(nodeParts)
+  .map(([uid, part]) => {
+    const meta = nodeMetas[uid] ?? {}
+    return {
+      name: meta.id ?? uid,
+      gzipSize: part.gzipSize ?? 0,
+      renderedLength: part.renderedLength ?? 0,
+    }
+  })
+  .filter((n) => n.renderedLength > 0)
+  .sort((a, b) => b.gzipSize - a.gzipSize)
+
+const top = leaves.slice(0, 15)
+const generatedAt = new Date().toISOString()
+
+const lines = [
+  '# CDN app bundle breakdown',
+  '',
+  `Generated: ${generatedAt}`,
+  '',
+  'Source: `yarn audit:cdn-bundle` → `docs/audit/cdn-bundle-visualizer.json`',
+  '',
+  'Top 15 modules by gzip size (CDN app graph):',
+  '',
+  '| Rank | Module | Gzip (KiB) | Raw (KiB) |',
+  '|------|--------|------------|-----------|',
+]
+
+top.forEach((node, i) => {
+  const gzip = node.gzipSize / 1024
+  const raw = node.renderedLength / 1024
+  const name = String(node.name).replace(/\|/g, '\\|')
+  lines.push(`| ${i + 1} | \`${name}\` | ${gzip.toFixed(1)} | ${raw.toFixed(1)} |`)
+})
+
+lines.push('', 'See also: [BUNDLE-STRATEGY.md](../BUNDLE-STRATEGY.md), [artifact-sizes.json](./artifact-sizes.json).')
+
+writeFileSync(outPath, `${lines.join('\n')}\n`)
+console.log(`[cdn-breakdown] wrote ${outPath}`)

package/scripts/generate-cdn-manifest.mjs

@@ -15,7 +15,7 @@ const cdnDir = resolve(root, 'dist/cdn')
 const buildId = portalBuildId()
 
 function fileMetrics(file) {
-  const path = resolve(cdnDir, file)
+  const path = resolve(cdnDir, file.replace(/^\//, ''))
   const raw = readFileSync(path)
   return {
     file,
@@ -24,17 +24,31 @@ function fileMetrics(file) {
   }
 }
 
-const jsFiles = readdirSync(cdnDir)
-  .filter((f) => f.endsWith('.js'))
-  .map((file) => {
+function scriptEntry(file) {
+  if (file.startsWith('vendor.')) {
+    return { name: 'vendor', order: 1, preload: true }
+  }
+  if (file.startsWith('app.') && !file.includes('/')) {
+    return { name: 'app', order: 2, preload: true }
+  }
+  if (file.startsWith('chunks/')) {
+    return { name: file.replace(/^chunks\//, ''), order: 99, preload: false }
+  }
+  return { name: file, order: 99, preload: false }
+}
+
+const jsFiles = readdirSync(cdnDir, { recursive: true })
+  .filter((f) => String(f).endsWith('.js'))
+  .map((rel) => {
+    const file = String(rel)
     const metrics = fileMetrics(file)
+    const entry = scriptEntry(file)
     return {
       ...metrics,
-      name: file.startsWith('vendor.') ? 'vendor' : file.startsWith('app.') ? 'app' : file,
-      order: file.startsWith('vendor.') ? 1 : file.startsWith('app.') ? 2 : 99,
+      ...entry,
     }
   })
-  .sort((a, b) => a.order - b.order)
+  .sort((a, b) => a.order - b.order || a.file.localeCompare(b.file))
 
 const cssFiles = readdirSync(cdnDir)
   .filter((f) => f.endsWith('.css'))
@@ -64,10 +78,11 @@ const manifest = {
   buildId,
   baseUrl: resolveCdnBaseUrl(),
   publishMode: process.env.VITE_PORTAL_CDN_PUBLISH_MODE ?? 'jsdelivr',
-  scripts: jsFiles.map(({ name, file, order, rawBytes, gzipBytes }) => ({
+  scripts: jsFiles.map(({ name, file, order, preload, rawBytes, gzipBytes }) => ({
     name,
     file,
     order,
+    preload,
     rawBytes,
     gzipBytes,
     url: `${resolveCdnBaseUrl()}/${file}`,

package/scripts/portal-vite-env.mjs

@@ -1,17 +1,91 @@
 /**
- * Vite env for HubSpot/CDN builds — .env.[mode] wins over stale shell VITE_* vars.
+ * Vite env for HubSpot/CDN builds — .env.[mode] wins over stale shell / .env.local VITE_* vars.
  */
+import { existsSync, readFileSync } from 'node:fs'
+import { resolve } from 'node:path'
 import { loadEnv } from 'vite'
 import { envWithPortalBuildId } from './resolve-portal-build-id.mjs'
 import { envWithPortalCdnConfig } from './load-portal-cdn-config.mjs'
 
+/** @param {string} content */
+export function parseEnvFile(content) {
+  const result = {}
+  for (const line of content.split('\n')) {
+    const trimmed = line.trim()
+    if (!trimmed || trimmed.startsWith('#')) continue
+    const eq = trimmed.indexOf('=')
+    if (eq <= 0) continue
+    const key = trimmed.slice(0, eq).trim()
+    let value = trimmed.slice(eq + 1).trim()
+    if (
+      (value.startsWith('"') && value.endsWith('"')) ||
+      (value.startsWith("'") && value.endsWith("'"))
+    ) {
+      value = value.slice(1, -1)
+    }
+    result[key] = value
+  }
+  return result
+}
+
+/** @param {'local' | 'dev' | 'stg' | 'prod'} mode @param {string} root */
+export function readPortalTierEnvFile(mode, root) {
+  const path = resolve(root, `.env.${mode}`)
+  if (!existsSync(path)) return {}
+  return parseEnvFile(readFileSync(path, 'utf8'))
+}
+
+function stashViteProcessEnv() {
+  const stashed = {}
+  for (const key of Object.keys(process.env)) {
+    if (key.startsWith('VITE_')) {
+      stashed[key] = process.env[key]
+      delete process.env[key]
+    }
+  }
+  return stashed
+}
+
+/** @param {Record<string, string | undefined>} stashed */
+function restoreViteProcessEnv(stashed) {
+  for (const [key, value] of Object.entries(stashed)) {
+    if (value != null) process.env[key] = value
+  }
+}
+
+/** loadEnv without shell / .env.local VITE_* polluting tier resolution */
+/** @param {'local' | 'dev' | 'stg' | 'prod'} mode @param {string} root */
+export function loadPortalFileEnv(mode, root) {
+  const stashed = stashViteProcessEnv()
+  try {
+    return loadEnv(mode, root, '')
+  } finally {
+    restoreViteProcessEnv(stashed)
+  }
+}
+
+/**
+ * API URL baked into CDN bundles for a deploy tier — reads `.env.[mode]` only.
+ * @param {'local' | 'dev' | 'stg' | 'prod'} mode
+ * @param {string} root
+ */
+export function resolveTierApiEndpoint(mode, root) {
+  const tier = readPortalTierEnvFile(mode, root)
+  const fromTier = tier.VITE_PUBLIC_REST_API_ENDPOINT
+  if (fromTier) return fromTier.replace(/\/$/, '')
+  const fromFile = loadPortalFileEnv(mode, root).VITE_PUBLIC_REST_API_ENDPOINT
+  const fromCi =
+    process.env.WOODPORTAL_API_BASE_URL || process.env.VITE_PUBLIC_REST_API_ENDPOINT
+  return (fromFile || fromCi)?.replace(/\/$/, '')
+}
+
 /**
  * @param {'local' | 'dev' | 'stg' | 'prod'} mode
  * @param {string} root
  * @param {NodeJS.ProcessEnv} [extra]
  */
 export function envForPortalBuild(mode, root, extra = {}) {
-  const fileEnv = loadEnv(mode, root, '')
+  const fileEnv = loadPortalFileEnv(mode, root)
   const base = { ...process.env }
 
   for (const key of Object.keys(base)) {

package/scripts/publish-cdn-github.mjs

@@ -98,6 +98,9 @@ function authRemote(remote, token) {
 function copyCdnArtifacts(sourceDir, targetDir) {
   mkdirSync(targetDir, { recursive: true })
   for (const entry of readdirSync(sourceDir)) {
+    if (entry.endsWith('.map')) {
+      fail(`Refusing to publish source map: ${entry}`)
+    }
     const src = join(sourceDir, entry)
     const dest = join(targetDir, entry)
     rmSync(dest, { recursive: true, force: true })
@@ -152,22 +155,81 @@ async function assertGithubRepoPublic(github) {
   }
 }
 
-async function checkJsDelivr(config, vendorFile, appFile, appCssFile) {
-  const base = jsDelivrBaseUrl(config.github, config.cdnPathInRepo, config.defaultBranch)
-  for (const file of [appCssFile, vendorFile, appFile]) {
-    const url = `${base}/${file}`
-    log(`Checking jsDelivr (may take a minute on first publish): ${url}`)
-    try {
-      const res = await fetch(url, { method: 'HEAD' })
-      if (res.ok) {
-        log(`  OK ${res.status} ${file}`)
-      } else {
-        log(`  ${file} → HTTP ${res.status} (jsDelivr may still be propagating — wait 5–15 min)`)
+async function headJsDelivrFile(base, file, { required = false } = {}) {
+  const url = `${base}/${file}`
+  log(`Checking jsDelivr (may take a minute on first publish): ${url}`)
+  try {
+    const res = await fetch(url, { method: 'HEAD' })
+    if (res.ok) {
+      log(`  OK ${res.status} ${file}`)
+      return true
+    }
+    const msg = `${file} → HTTP ${res.status}${required ? '' : ' (jsDelivr may still be propagating — wait 5–15 min)'}`
+    if (required) {
+      fail(msg)
+    }
+    log(`  ${msg}`)
+    return false
+  } catch (err) {
+    const msg = `Could not reach jsDelivr for ${file}: ${err.message}`
+    if (required) {
+      fail(msg)
+    }
+    log(`  ${msg}`)
+    return false
+  }
+}
+
+async function headJsDelivrFiles(base, files, { required = false, concurrency = 5 } = {}) {
+  if (files.length === 0) {
+    return { ok: true, failed: [] }
+  }
+  log(`Checking ${files.length} lazy chunk(s) on jsDelivr`)
+  const failed = []
+  for (let i = 0; i < files.length; i += concurrency) {
+    const batch = files.slice(i, i + concurrency)
+    const results = await Promise.all(
+      batch.map(async (file) => {
+        const ok = await headJsDelivrFile(base, file, { required: false })
+        return { file, ok }
+      }),
+    )
+    for (const result of results) {
+      if (!result.ok) {
+        failed.push(result.file)
       }
-    } catch (err) {
-      log(`  Could not reach jsDelivr for ${file}: ${err.message}`)
     }
   }
+  if (failed.length > 0) {
+    const msg = `jsDelivr lazy chunk(s) not reachable: ${failed.join(', ')}`
+    if (required) {
+      fail(msg)
+    }
+    log(`  ${msg}`)
+  }
+  return { ok: failed.length === 0, failed }
+}
+
+async function checkJsDelivr(config, vendorFile, appFile, appCssFile, lazyChunkFiles = []) {
+  const base = jsDelivrBaseUrl(config.github, config.cdnPathInRepo, config.defaultBranch)
+  for (const file of [appCssFile, vendorFile, appFile]) {
+    await headJsDelivrFile(base, file)
+  }
+  if (lazyChunkFiles.length > 0) {
+    await headJsDelivrFiles(base, lazyChunkFiles, { required: true })
+  } else {
+    log('  No lazy chunks/ in manifest — skipping lazy chunk HEAD check')
+  }
+}
+
+function readLazyChunkFilesFromManifest(manifestPath) {
+  if (!existsSync(manifestPath)) {
+    return []
+  }
+  const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'))
+  return (manifest.scripts ?? [])
+    .map((entry) => entry?.file)
+    .filter((file) => typeof file === 'string' && file.startsWith('chunks/'))
 }
 
 const config = loadPortalCdnConfig()
@@ -331,6 +393,9 @@ log('     yarn build:hubspot:prod   # prod API')
 log('  3. yarn upload:hubspot')
 log('  Or: yarn deploy:dev  |  yarn deploy:prod')
 
+const manifestPath = join(sourceCdn, 'manifest.json')
+const lazyChunkFiles = readLazyChunkFilesFromManifest(manifestPath)
+
 if (!skipJsDelivrCheck) {
-  await checkJsDelivr(config, vendorFile, appFile, appCssFile)
+  await checkJsDelivr(config, vendorFile, appFile, appCssFile, lazyChunkFiles)
 }

package/scripts/refresh-artifact-sizes.mjs

@@ -0,0 +1,77 @@
+#!/usr/bin/env node
+/**
+ * Refresh docs/audit/artifact-sizes.json from dist/cdn + HubSpot module output.
+ */
+import { existsSync, readFileSync, readdirSync, statSync, writeFileSync } from 'node:fs'
+import { resolve, join } from 'node:path'
+import { gzipSync } from 'node:zlib'
+import { findProjectRoot } from './project-root.mjs'
+import { moduleOutDir, readWoodsportalConfig } from './read-woodsportal-config.mjs'
+
+const root = findProjectRoot()
+const { config } = readWoodsportalConfig(root)
+
+function metrics(path) {
+  const raw = readFileSync(path)
+  const gzip = gzipSync(raw)
+  return {
+    rawBytes: raw.length,
+    gzipBytes: gzip.length,
+    rawMiB: Number((raw.length / (1024 * 1024)).toFixed(3)),
+    gzipKiB: Number((gzip.length / 1024).toFixed(1)),
+    overValidationLimit: raw.length > 1.5 * 1024 * 1024,
+  }
+}
+
+function walkJs(dir, prefix = '') {
+  const out = []
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    const rel = prefix ? `${prefix}/${entry.name}` : entry.name
+    const full = join(dir, entry.name)
+    if (entry.isDirectory()) {
+      out.push(...walkJs(full, rel))
+    } else if (entry.name.endsWith('.js')) {
+      out.push(rel)
+    }
+  }
+  return out
+}
+
+const moduleDir = moduleOutDir(root)
+const cdnDir = resolve(root, 'dist/cdn')
+const artifacts = {}
+
+for (const name of ['module.js', 'module.css', 'module.html', 'fields.json']) {
+  const p = resolve(moduleDir, name)
+  if (existsSync(p)) {
+    artifacts[name] = metrics(p)
+  }
+}
+
+const cdn = {}
+if (existsSync(cdnDir)) {
+  let manifest = null
+  const manifestPath = resolve(cdnDir, 'manifest.json')
+  if (existsSync(manifestPath)) {
+    manifest = JSON.parse(readFileSync(manifestPath, 'utf8'))
+    cdn['manifest.json'] = { generatedAt: manifest.generatedAt, buildId: manifest.buildId }
+  }
+  for (const file of walkJs(cdnDir)) {
+    cdn[file] = metrics(resolve(cdnDir, file))
+  }
+  for (const file of readdirSync(cdnDir).filter((f) => f.endsWith('.css'))) {
+    cdn[file] = metrics(resolve(cdnDir, file))
+  }
+}
+
+const doc = {
+  generatedAt: new Date().toISOString(),
+  embedMode: 'cdn',
+  hubspotLimits: { validationMiB: 1.5, bufferMiB: 2 },
+  artifacts,
+  cdn,
+}
+
+const outPath = resolve(root, 'docs/audit/artifact-sizes.json')
+writeFileSync(outPath, JSON.stringify(doc, null, 2))
+console.log(`[artifact-sizes] wrote ${outPath}`)