@zaip-ai/cli 6.3.0 → 7.5.0

package/templates/.agents/skills/zaip-skill-performance-engineering/references/site-budgets.json

@@ -0,0 +1,25 @@
+{
+  "schema_version": 1,
+  "lab": { "lcp_ms": 2500, "tbt_ms": 200, "cls": 0.1, "js_cpu_ms": 1000, "bytes": 1500000 },
+  "scores": { "performance": 91, "seo": 95, "accessibility": 95, "best-practices": 95 },
+  "max_variation_ratio": 0.2,
+  "regression_ratio": 0.1,
+  "absolute_tolerance": {
+    "cls": 0.01,
+    "tbt_ms": 50,
+    "lcp_ms": 100,
+    "js_cpu_ms": 50,
+    "bytes": 1024,
+    "performance": 2
+  },
+  "lighthouse": { "performance": 91, "seo": 95, "accessibility": 95, "best-practices": 95 },
+  "field_p75": { "lcp_ms": 2500, "inp_ms": 200, "cls": 0.1 },
+  "bytes": {
+    "initial": 1500000,
+    "full": 3000000,
+    "images": 2000000,
+    "javascript": 250000,
+    "css": 100000
+  },
+  "note": "ZAIP acceptance minimum 91 independently on mobile and desktop; aim for 95 as headroom, not a Google requirement or guaranteed score. Project changes require owner and rationale; never loosen a budget silently to pass."
+}

package/templates/.agents/skills/zaip-skill-performance-engineering/references/site-performance.md

@@ -0,0 +1,83 @@
+# Site and LP performance
+
+Every site/LP creation composes this workflow automatically through website-readiness.
+For existing sites, measure before editing. Read supplied reports in audit mode without
+changing product. Start with waterfall/LCP, initial and scrolled bytes, JS/CSS, fonts,
+third parties, DOM and long tasks. Work in measured impact order; code splitting is not
+an unconditional improvement. Preserve design, responsiveness, accessibility and conversion.
+
+Reuse [image optimization](../../zaip-skill-image-optimization/SKILL.md) for originals and
+derivatives. Avoid duplicate layouts or CSS-hidden mobile/desktop downloads. Review font
+formats, weights, preload and font-display while retaining typography. Group geometry
+reads before writes to reduce forced layout. Review third parties without breaking
+consent, analytics or conversion. Apply compression and cache rules supported by actual
+hosting; immutable is only for hashed immutable assets, never generic HTML.
+
+Start from [site-budgets.json](site-budgets.json), copy to project-owned configuration
+and document product-specific budgets for images, JS/CSS, initial transfer and full-page
+navigation. Initial goals: Lighthouse Performance >=91 mobile/desktop separately (aim
+for 95 as headroom), SEO/accessibility/
+best-practices >=95; field p75 LCP <=2500 ms, INP <=200 ms, CLS <=0.1. These are goals,
+not a guarantee of a universal 100, ranking, or accessibility conformance. TBT is not INP.
+
+For each run record tool/version, commit, viewport, DPR, CPU, network, cache, URL and
+date. Keep raw reports and before/after summary. Separate initial from scrolled traffic;
+compare equivalent conditions, preferably at least three runs and medians. Native local
+unthrottled capture is useful for regression, not a simulated mobile Lighthouse result.
+
+```text
+node .agents/skills/zaip-skill-performance-engineering/scripts/performance-report.mjs report.json budgets.json
+```
+
+That command is the legacy transfer-review interface, not the new staged gate. Declared
+Lighthouse scores/raw-report paths cannot approve it; absent measurements return nonzero.
+Use [report-contract.md](report-contract.md) and assess-reports.mjs for actual Lighthouse
+or PSI JSON. Import hashes prove integrity, not authorship or truthful declared conditions.
+
+Optional Chromium capture uses an already installed project `@playwright/test`, its
+browser and a project-owned config. No automatic installation. Serve a local/sandbox
+site; the capture blocks non-GET/HEAD requests and external hosts. The tool records native
+unthrottled CDP network bytes and screenshots, not scores. Examine the screenshots.
+The existing capture-site.mjs is excluded from the new sanitized report pipeline: its
+legacy raw capture can contain full URLs. Do not feed sensitive pages/URLs into it or
+publish its raw output as sanitized evidence. Its network/write protections remain intact.
+
+## Build performance into creation
+
+Apply [Astro + React Islands](astro-islands.md), [Google diagnostics](google-diagnostics.md)
+and [third-party loading](third-party-performance.md) as the detailed implementation
+contracts. Existing project overrides remain explicit; optimization never grants migration.
+
+Before coding, agree on project-owned budgets and representative mobile/desktop journeys,
+tag/consent scenarios and save baseline evidence when changing existing behavior. Preserve
+visual identity, consent, conversion and accessibility; do not remove required content,
+disable analytics silently or migrate stacks to improve a score.
+
+- Make the real LCP element discoverable in initial HTML; avoid hiding a hero behind a
+  client-only fetch/hydration waterfall. Prioritize the actual hero, not every image.
+- Use measured responsive image sizes, stable dimensions and correct crop; lazy-load
+  noncritical media, not the LCP candidate. Verify initial and scrolled traffic separately.
+- Limit blocking CSS, font weights and preloads; verify fallback metrics, layout shift,
+  font-display and typography without replacing the approved design.
+- Reduce JavaScript parse/execute, hydration and long tasks; defer/split only when useful.
+  Less transfer does not compensate for worse CPU, LCP or interaction responsiveness.
+- Review third-party cost under explicit consent/tag conditions. A blocked isolated run
+  does not prove the full tagged journey. Track cache/compression by actual hosting rules.
+
+Publication checks require the actual published URL/artifact observation under separate
+authorization. Field evidence has its own window and URL/origin/device/p75 scope. A new
+site can pass prepublication lab acceptance while field remains unavailable and explicitly
+scheduled for later observation; never claim field CWV passed without data.
+
+## Reference case, not a transferable promise
+
+User-provided Moradigna React/Vite case: responsive hashed WebP, srcset/sizes, intrinsic
+dimensions, prioritized hero, lazy nonhero images, derivative-only immutable cache and
+batched geometry reads. Controlled local full-page transfer went from 29.97 to 1.34 MB
+mobile and 32.42 to 1.89 MB desktop. These were not Lighthouse or fresh PageSpeed/GTmetrix
+scores. Preserve originals, transparency, crop, visual identity and sharing image;
+That case checked build, assets, SEO, screenshots and the complete sandbox form.
+For subsequent edits, select checks by the changed contract using
+[frontend impact](../../zaip-skill-testing-strategy/references/frontend-impact.md);
+presentation-only changes do not repeat an unchanged form or backend flow.
+Do not carry that project's domain, integrations, secrets or business rules into core.

package/templates/.agents/skills/zaip-skill-performance-engineering/references/third-party-performance.md

@@ -0,0 +1,57 @@
+# Tags rápidas sem perder consentimento ou conversões
+
+Componha este contrato em performance, GTM, GA4 e Pixel/CAPI. A skill de cada destino
+continua responsável por identidade, autorização, consentimento e prova de recebimento.
+Otimização local não permite publicar container, chamar API externa ou enviar leads reais.
+
+1. Inventarie cada loader/tag: dono, finalidade, origem, condição de consentimento,
+   trigger, dependências, bytes, CPU e requisições. Remova duplicidade somente com prova
+   de que a integração equivalente permanece. Um container não torna suas tags gratuitas.
+2. Defina consentimento antes dos comandos de medição e teste a ordem CMP/loader/evento.
+   Preserve o modo aprovado: negado/desconhecido bloqueia o contrato padrão; Consent Mode
+   avançado e pings cookieless exigem autorização própria. Termos do formulário não
+   substituem consentimento por finalidade. Revogação bloqueia eventos e retries futuros.
+3. Use snippets e integração suportados pelo fornecedor. `async` não preserva ordem
+   entre scripts nem elimina CPU; `defer` tem semântica distinta em scripts clássicos
+   externos. Não adicione atributos a esmo em loaders dinâmicos/módulos. Prove prontidão
+   por mecanismo suportado, não por um timeout fixo de alguns segundos.
+4. Mantenha conteúdo principal, hero, formulário e CMP fora de dependência do GTM.
+   Escalone widgets dispensáveis por visibilidade/necessidade e meça long tasks. Não
+   atrase todas as tags até interação ou idle: pode perder visitas, atribuição e leads
+   rápidos. Escolha o instante por contrato, consentimento e custo observado.
+5. Prefira templates suportados a Custom HTML quando adequados; escopo de triggers
+   mínimo, listeners únicos, sem polling pesado de DOM. Reutilize a fila `dataLayer`
+   criada antes do loader, sem sobrescrevê-la. Evite Google tag direto + GTM duplicados.
+6. Evento aceito antes do SDK pronto usa fila limitada e ordenada compatível com o
+   contrato existente, com identidade estável, consentimento revalidado no dispatch,
+   tratamento de expiração e falha. Não persistir dados sensíveis para compensar atraso.
+   Não reemitir retroativamente eventos sem consentimento. Um SDK bloqueado não deve
+   impedir salvar o formulário ou converter clique/timeout em sucesso.
+7. Somente novo lead salvo e confirmado origina o evento primário aprovado. Retry,
+   retorno, obrigado recarregado e qualificação posterior não geram outro Lead.
+   Preserve deduplicação do destino: ID local não garante dedupe universal no GA4.
+   CAPI/server-side não elimina todo JS nem substitui automaticamente Pixel/consentimento;
+   mudanças de arquitetura e infraestrutura exigem escopo próprio.
+8. Não colocar contatos, tokens, hashes de contato ou payload completo em dataLayer,
+   logs, bundles ou relatórios. Credenciais CAPI ficam exclusivamente no backend.
+
+## Validação proporcional ao carregamento alterado
+
+| Cenário | Evidência esperada |
+| --- | --- |
+| Negado/desconhecido; concedido inicial/tardio; revogado | Ordem e requisições permitidas/bloqueadas conforme modo aprovado; sem envio posterior à revogação |
+| Submit rápido antes do loader; SDK lento/bloqueado | Cadastro continua independente; fila autorizada preserva ordem/identidade sem duplicação |
+| Timeout/retry, lead existente, BANT, refresh obrigado | Zero novos eventos primários sem novo cadastro confirmado |
+| Voltar/avançar, SPA/transição e remount | Loader/listeners/page_view únicos; parâmetros de atribuição preservados |
+| Jornada completa nas duas telas | CPU, LCP e interação com tags exigidas; screenshots e funcionalidade preservadas |
+
+Use mocks e destinos sandbox nos testes locais; não envie conversões reais. Runner
+isolado continua bloqueando externos/escritas e prova apenas isolamento. Relatórios
+representativos importados precisam de autorização para a coleta e identificação de
+tags/consentimento/cache. Medição pública comum não prova uma sessão de consentimento
+concedido. Não compare cenários diferentes nem escolha só a melhor execução.
+
+Fontes oficiais verificadas em 2026-11-01; recomendações dependem do contrato do projeto:
+- https://web.dev/articles/tag-best-practices
+- https://web.dev/articles/efficiently-load-third-party-javascript
+- https://developers.google.com/tag-platform/security/guides/consent

package/templates/.agents/skills/zaip-skill-performance-engineering/scripts/assess-reports.mjs

@@ -0,0 +1,42 @@
+import { resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { importReport, readBoundedJson } from "./report-import.mjs";
+import { assessSeries } from "./series-gate.mjs";
+
+export async function assessReports(config, root = process.cwd()) {
+  if (
+    !config ||
+    config.schema_version !== 1 ||
+    !Array.isArray(config.after) ||
+    config.after.length > 10 ||
+    !Array.isArray(config.before) ||
+    config.before.length > 10
+  )
+    throw new Error("assessment_config_invalid");
+  const load = async (inputs) =>
+    Promise.all(
+      inputs.map(async (entry) => {
+        const raw = await readBoundedJson(root, entry.path);
+        const normalized = importReport(raw.value, entry.context);
+        if (normalized.status === "imported") normalized.file_sha256 = raw.sha256;
+        return normalized;
+      }),
+    );
+  return assessSeries({
+    ...config,
+    before: await load(config.before),
+    after: await load(config.after),
+  });
+}
+if (process.argv[1] && import.meta.url === pathToFileURL(resolve(process.argv[1])).href) {
+  let result;
+  try {
+    result = await assessReports(
+      (await readBoundedJson(process.cwd(), process.argv[2], 65536)).value,
+    );
+  } catch {
+    result = { status: "invalid_input", exit_code: 1, reason: "report_import_or_contract_invalid" };
+  }
+  console.log(JSON.stringify(result));
+  process.exitCode = result.exit_code;
+}

package/templates/.agents/skills/zaip-skill-performance-engineering/scripts/capture-site.mjs

@@ -0,0 +1,155 @@
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { createRequire } from "node:module";
+import { resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+
+export async function captureSite(config, { chromium } = {}) {
+  if (!config.outputDir || !config.commit || !config.url)
+    throw Error("Declare outputDir, commit and sandbox URL");
+  if (!/^[a-f0-9]{40}$/.test(config.commit))
+    throw Error("Capture requires the exact candidate Git SHA");
+  if (config.workingTreeDirty && !/^[a-f0-9]{40}$/.test(config.sourceTree ?? ""))
+    throw Error("Uncommitted source requires its exact Git tree SHA");
+  const url = new URL(config.url);
+  if (
+    !["http:", "https:"].includes(url.protocol) ||
+    url.username ||
+    url.password ||
+    !["127.0.0.1", "localhost", "[::1]"].includes(url.hostname)
+  )
+    throw Error(
+      "Capture requires credential-free local HTTP preview; live-site audit uses separately authorized tools",
+    );
+  if (!chromium) {
+    const require = createRequire(resolve(config.projectRoot ?? process.cwd(), "package.json"));
+    ({ chromium } = require("@playwright/test"));
+  }
+  const browser = await chromium.launch({ headless: true });
+  try {
+    const viewport = config.viewport ?? { width: 390, height: 844 };
+    const context = await browser.newContext({
+      viewport,
+      deviceScaleFactor: config.dpr ?? 1,
+      reducedMotion: "reduce",
+      serviceWorkers: "block",
+    });
+    const blocked = [];
+    if (typeof context.routeWebSocket !== "function")
+      throw Error("Read-only capture requires Playwright WebSocket routing support");
+    await context.routeWebSocket("**/*", (socket) => {
+      blocked.push({ url: socket.url(), method: "WEBSOCKET" });
+      socket.close();
+    });
+    await context.route("**/*", (route) => {
+      const req = route.request();
+      if (new URL(req.url()).origin !== url.origin || !["GET", "HEAD"].includes(req.method())) {
+        blocked.push({ url: req.url(), method: req.method() });
+        return route.abort();
+      }
+      return route.continue();
+    });
+    const page = await context.newPage();
+    const cdp = await context.newCDPSession(page);
+    await cdp.send("Network.enable");
+    await cdp.send("Network.setCacheDisabled", { cacheDisabled: true });
+    const requests = new Map();
+    let phase = "initial";
+    cdp.on("Network.responseReceived", (e) =>
+      requests.set(e.requestId, {
+        url: e.response.url,
+        mime: e.response.mimeType,
+        status: e.response.status,
+        phase,
+        bytes: 0,
+      }),
+    );
+    cdp.on("Network.loadingFinished", (e) => {
+      const r = requests.get(e.requestId);
+      if (r) r.bytes = e.encodedDataLength;
+    });
+    const response = await page.goto(url.href, { waitUntil: "networkidle" });
+    if (
+      !response ||
+      response.status() !== 200 ||
+      !/^text\/html\b/i.test(response.headers()["content-type"] ?? "")
+    )
+      throw Error("Capture preview must return HTTP 200 HTML");
+    await page.evaluate(() => document.fonts.ready);
+    const initial = [...requests.values()].reduce((s, r) => s + r.bytes, 0);
+    const images = await page.locator("img").evaluateAll((nodes) =>
+      nodes.map((n) => ({
+        src: n.currentSrc,
+        width: n.naturalWidth,
+        height: n.naturalHeight,
+        loading: n.loading,
+        fetchpriority: n.fetchPriority,
+      })),
+    );
+    await mkdir(config.outputDir, { recursive: true });
+    await page.screenshot({ path: resolve(config.outputDir, "first-fold.png") });
+    phase = "scroll";
+    for (let i = 0; i < 100; i++) {
+      const more = await page.evaluate(() => {
+        window.scrollBy(0, Math.max(100, window.innerHeight * 0.8));
+        return window.scrollY + window.innerHeight < document.documentElement.scrollHeight;
+      });
+      await page.waitForTimeout(80);
+      if (!more) break;
+    }
+    await page.waitForLoadState("networkidle");
+    await page.screenshot({ path: resolve(config.outputDir, "full-page.png"), fullPage: true });
+    const entries = [...requests.values()];
+    const total = (filter) => entries.filter(filter).reduce((s, r) => s + r.bytes, 0);
+    const result = {
+      conditions: {
+        tool: "Chromium CDP",
+        tool_version: browser.version(),
+        commit: config.commit,
+        viewport,
+        dpr: config.dpr ?? 1,
+        cpu: "native unthrottled",
+        network: "local unthrottled",
+        cache: "disabled, new context",
+        url: url.href,
+        date: new Date().toISOString(),
+      },
+      bytes: {
+        initial,
+        full: total(() => true),
+        images: total((r) => r.mime.startsWith("image/")),
+        javascript: total((r) => /javascript/.test(r.mime)),
+        css: total((r) => r.mime === "text/css"),
+      },
+      requests: entries,
+      images,
+      blocked,
+      originalHeavyImagesRequested: entries
+        .filter((r) => (config.forbiddenOriginals ?? []).some((s) => r.url.endsWith(s)))
+        .map((r) => r.url),
+      oppositeViewportImagesRequested: entries
+        .filter((r) => (config.oppositeViewportAssets ?? []).some((s) => r.url.endsWith(s)))
+        .map((r) => r.url),
+      limitations: [
+        "Not Lighthouse or field CWV. Screenshots require inspection. Third parties and writes blocked; this may differ from production.",
+      ],
+    };
+    result.conditions.working_tree_dirty = Boolean(config.workingTreeDirty);
+    if (config.sourceTree) result.conditions.source_tree = config.sourceTree;
+    if (config.workingTreeDirty)
+      result.limitations.push(
+        "commit identifies the baseline; source_tree identifies the uncommitted tested source snapshot",
+      );
+    await writeFile(
+      resolve(config.outputDir, "capture.json"),
+      JSON.stringify(result, null, 2) + "\n",
+    );
+    return result;
+  } finally {
+    await browser.close();
+  }
+}
+if (process.argv[1] && import.meta.url === pathToFileURL(resolve(process.argv[1])).href) {
+  if (process.argv.length !== 3) throw Error("Usage: node capture-site.mjs capture-config.json");
+  const config = JSON.parse(await readFile(process.argv[2], "utf8"));
+  await captureSite(config);
+}

package/templates/.agents/skills/zaip-skill-performance-engineering/scripts/local-preview.mjs

@@ -0,0 +1,84 @@
+import { lstat, readFile, realpath } from "node:fs/promises";
+import { createServer } from "node:http";
+import { relative, resolve, sep } from "node:path";
+
+export async function localPreview(directory, { port = 0 } = {}) {
+  if (!Number.isInteger(port) || port < 0 || port > 65535) throw new Error("preview_port_invalid");
+  const root = await realpath(directory);
+  if ((await lstat(directory)).isSymbolicLink()) throw new Error("preview_link_forbidden");
+  const types = {
+    ".html": "text/html",
+    ".css": "text/css",
+    ".js": "text/javascript",
+    ".json": "application/json",
+    ".svg": "image/svg+xml",
+    ".png": "image/png",
+    ".webp": "image/webp",
+    ".jpg": "image/jpeg",
+    ".woff2": "font/woff2",
+    ".ico": "image/x-icon",
+  };
+  let origin;
+  const counts = { served: 0, blocked: 0 };
+  const server = createServer(async (request, response) => {
+    try {
+      const url = new URL(request.url, origin);
+      if (
+        url.origin !== origin ||
+        !["GET", "HEAD"].includes(request.method) ||
+        url.username ||
+        url.password ||
+        url.search
+      )
+        throw new Error();
+      const path = decodeURIComponent(url.pathname);
+      if (path.includes("\\") || path.includes("\0") || path.split("/").includes(".."))
+        throw new Error();
+      const file = resolve(root, `.${path === "/" ? "/index.html" : path}`),
+        rel = relative(root, file);
+      if (!rel || rel.startsWith("..") || rel.split(sep).some((part) => part.startsWith(".")))
+        throw new Error();
+      let current = root;
+      for (const part of rel.split(sep)) {
+        current = resolve(current, part);
+        if ((await lstat(current)).isSymbolicLink()) throw new Error();
+      }
+      const info = await lstat(file),
+        extension = /\.[^.]+$/.exec(file)?.[0].toLowerCase();
+      if (!info.isFile() || info.size > 2 * 1024 * 1024 || !types[extension]) throw new Error();
+      const bytes = await readFile(file);
+      response.writeHead(200, {
+        "Content-Type": types[extension],
+        "Cache-Control": "no-store",
+        "Content-Length": bytes.length,
+      });
+      response.end(request.method === "HEAD" ? undefined : bytes);
+      counts.served++;
+    } catch {
+      counts.blocked++;
+      response.writeHead(403);
+      response.end("blocked");
+    }
+  });
+  server.on("connect", (_, socket) => {
+    counts.blocked++;
+    socket.end("HTTP/1.1 403 Forbidden\r\n\r\n");
+  });
+  server.on("upgrade", (_, socket) => {
+    counts.blocked++;
+    socket.destroy();
+  });
+  await new Promise((ok, fail) => {
+    server.once("error", fail);
+    server.listen(port, "127.0.0.1", ok);
+  });
+  origin = `http://127.0.0.1:${server.address().port}`;
+  return {
+    origin,
+    counts,
+    close: async () => {
+      server.closeAllConnections();
+      await new Promise((ok) => server.close(ok));
+    },
+  };
+}

package/templates/.agents/skills/zaip-skill-performance-engineering/scripts/performance-report.mjs

@@ -0,0 +1,142 @@
+import { resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { readBoundedJson } from "./report-import.mjs";
+export function evaluatePerformance(report, budgets) {
+  const findings = [],
+    unavailable = [];
+  const required = [
+    "tool",
+    "tool_version",
+    "commit",
+    "viewport",
+    "dpr",
+    "cpu",
+    "network",
+    "cache",
+    "url",
+    "date",
+  ];
+  for (const key of required)
+    if (report.conditions?.[key] == null) findings.push(`conditions:${key}`);
+  const c = report.conditions ?? {};
+  const nonempty = (v) => typeof v === "string" && v.trim().length > 0;
+  for (const key of ["tool", "tool_version", "cpu", "network", "cache"])
+    if (!nonempty(c[key])) findings.push(`conditions-invalid:${key}`);
+  if (!/^[a-f0-9]{40}$/i.test(c.commit ?? "")) findings.push("conditions-invalid:commit");
+  if (
+    !Number.isSafeInteger(c.viewport?.width) ||
+    c.viewport.width <= 0 ||
+    !Number.isSafeInteger(c.viewport?.height) ||
+    c.viewport.height <= 0
+  )
+    findings.push("conditions-invalid:viewport");
+  if (!Number.isFinite(c.dpr) || c.dpr <= 0) findings.push("conditions-invalid:dpr");
+  if (!nonempty(c.date) || !Number.isFinite(Date.parse(c.date)))
+    findings.push("conditions-invalid:date");
+  try {
+    if (!["http:", "https:"].includes(new URL(c.url).protocol)) throw Error();
+  } catch {
+    findings.push("conditions-invalid:url");
+  }
+  const check = (name, actual, target, minimum = false) => {
+    if (typeof target !== "number" || !Number.isFinite(target) || target < 0) {
+      findings.push(`budget-invalid:${name}`);
+      return;
+    }
+    if (typeof actual !== "number" || !Number.isFinite(actual)) unavailable.push(name);
+    else if (
+      actual < 0 ||
+      (minimum && actual > 100) ||
+      (name.startsWith("bytes:") && !Number.isSafeInteger(actual))
+    )
+      findings.push(`invalid:${name}`);
+    else if (minimum ? actual < target : actual > target) findings.push(name);
+  };
+  for (const [key, target] of Object.entries(budgets.bytes))
+    check(`bytes:${key}`, report.bytes?.[key], target);
+  if (report.lighthouse) {
+    // Legacy DTO scores are observations only. Import an actual LHR/PSI report through
+    // assess-reports.mjs for the staged gate; a path string is not report evidence.
+    findings.push("lighthouse:unverified-declaration");
+    if (
+      report.lighthouse.tool !== "Lighthouse" ||
+      !nonempty(report.lighthouse.version) ||
+      !nonempty(report.lighthouse.raw_report)
+    )
+      findings.push("lighthouse:provenance");
+    for (const [category, target] of Object.entries(budgets.lighthouse))
+      check(`lighthouse:${category}`, report.lighthouse.scores?.[category], target, true);
+  } else unavailable.push("Lighthouse (not measured by a network/CDP capture)");
+  if (report.field) {
+    if (
+      report.field.percentile !== 75 ||
+      !nonempty(report.field.source) ||
+      !nonempty(report.field.period) ||
+      !["mobile", "desktop"].includes(report.field.device)
+    )
+      findings.push("field:provenance");
+    for (const [metric, target] of Object.entries(budgets.field_p75))
+      check(`field:${metric}`, report.field[metric], target);
+  } else unavailable.push("Field CWV (absence is neither pass nor fail)");
+  for (const url of report.originalHeavyImagesRequested ?? [])
+    findings.push(`original-image:${url}`);
+  for (const url of report.oppositeViewportImagesRequested ?? [])
+    findings.push(`opposite-viewport:${url}`);
+  return {
+    kind: "zaip-performance-evidence-review",
+    measured_checks_passed: findings.length === 0,
+    findings,
+    unavailable,
+    full_approval: findings.length === 0 && unavailable.length === 0,
+  };
+}
+export function compareRuns(before, after) {
+  for (const report of [before, after]) {
+    if (
+      !/^[a-f0-9]{40}$/i.test(report.conditions?.commit ?? "") ||
+      !Number.isFinite(Date.parse(report.conditions?.date ?? ""))
+    )
+      throw Error("Expected exact commit and measurement date");
+  }
+  const conditions = ["tool", "tool_version", "viewport", "dpr", "cpu", "network", "cache", "url"];
+  for (const key of conditions)
+    if (
+      JSON.stringify(before.conditions?.[key]) !== JSON.stringify(after.conditions?.[key]) ||
+      before.conditions?.[key] == null
+    )
+      throw Error(`Non-equivalent conditions: ${key}`);
+  const median = (values) => {
+    if (!values.length || values.some((v) => !Number.isSafeInteger(v) || v < 0))
+      throw Error("Expected nonnegative byte samples");
+    const a = [...values].sort((a, b) => a - b);
+    const i = Math.floor(a.length / 2);
+    return a.length % 2 ? a[i] : (a[i - 1] + a[i]) / 2;
+  };
+  return {
+    initial: {
+      before: median(before.samples.map((s) => s.initial)),
+      after: median(after.samples.map((s) => s.initial)),
+    },
+    full: {
+      before: median(before.samples.map((s) => s.full)),
+      after: median(after.samples.map((s) => s.full)),
+    },
+    runs: { before: before.samples.length, after: after.samples.length },
+    kind: "controlled-transfer-comparison",
+    lighthouse: false,
+  };
+}
+if (process.argv[1] && import.meta.url === pathToFileURL(resolve(process.argv[1])).href) {
+  try {
+    if (process.argv.length !== 4) throw new Error();
+    const [report, budgets] = await Promise.all(
+      process.argv.slice(2).map(async (path) => (await readBoundedJson(process.cwd(), path)).value),
+    );
+    const result = evaluatePerformance(report, budgets);
+    console.log(JSON.stringify(result));
+    process.exitCode = !result.measured_checks_passed ? 1 : result.unavailable.length ? 6 : 0;
+  } catch {
+    console.log(JSON.stringify({ status: "invalid_input", reason: "legacy_report_input_invalid" }));
+    process.exitCode = 1;
+  }
+}