@zappie/check 0.0.0-stage → 0.1.2

package/dist/index.js

@@ -0,0 +1,1950 @@
+// ../sdk/src/site-config/types.ts
+var DEFAULT_BUDGETS = {
+  jsKbGz: 200,
+  cssKbGz: 50,
+  lcpMs: 2500
+};
+var GLOBAL_PACKAGE_ALLOWLIST = [
+  "react",
+  "react-dom",
+  "react-router",
+  "@react-router/*",
+  "@zappie/*",
+  "tailwindcss",
+  "@tailwindcss/*",
+  "clsx",
+  "tailwind-merge",
+  "class-variance-authority",
+  "lucide-react",
+  "date-fns",
+  "embla-carousel-react",
+  "framer-motion/motion",
+  "zod",
+  "@radix-ui/*",
+  "sonner",
+  "vaul"
+];
+
+// ../sdk/src/site-config/helpers.ts
+var record = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+function distance(left, right) {
+  let row = Array.from({ length: right.length + 1 }, (_, index) => index);
+  for (let leftIndex = 1; leftIndex <= left.length; leftIndex += 1) {
+    const next = [leftIndex];
+    for (let rightIndex = 1; rightIndex <= right.length; rightIndex += 1) {
+      next[rightIndex] = Math.min(
+        (next[rightIndex - 1] ?? 0) + 1,
+        (row[rightIndex] ?? 0) + 1,
+        (row[rightIndex - 1] ?? 0) + (left[leftIndex - 1] === right[rightIndex - 1] ? 0 : 1)
+      );
+    }
+    row = next;
+  }
+  return row[right.length] ?? Infinity;
+}
+function unknownKeys(value, allowed, path12, issue) {
+  for (const key of Object.keys(value)) {
+    if (allowed.includes(key)) {
+      continue;
+    }
+    const closest = allowed.map((candidate) => ({ candidate, score: distance(key, candidate) })).sort((left, right) => left.score - right.score)[0];
+    const hint = closest && closest.score <= 2 ? closest.candidate : void 0;
+    issue({
+      path: path12 ? `${path12}.${key}` : key,
+      code: "unknown_key",
+      message: hint ? `Unknown field "${key}". Rename it to "${hint}".` : `Unknown field "${key}". Remove it from the configuration.`,
+      severity: "error"
+    });
+  }
+}
+var nonblank = (value) => typeof value === "string" && value.trim().length > 0;
+var packageName = (value) => value.length <= 214 && /^(?:@[a-z0-9][a-z0-9._~-]*\/[a-z0-9][a-z0-9._~-]*|[a-z0-9][a-z0-9._~-]*)$/.test(
+  value
+);
+var globallyAllowed = (value) => GLOBAL_PACKAGE_ALLOWLIST.some(
+  (allowed) => allowed.endsWith("/*") ? value.startsWith(allowed.slice(0, -1)) : value === allowed
+);
+function hostname(value) {
+  const wildcard = value.startsWith("*.");
+  const host = wildcard ? value.slice(2) : value;
+  if (!host.includes(".") || /^\d+(?:\.\d+){3}$/.test(host) || host.length > 253 || host.includes("..")) {
+    return false;
+  }
+  return host.split(".").every(
+    (label) => label.length > 0 && label.length <= 63 && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/i.test(label)
+  );
+}
+
+// ../sdk/src/site-config/sections.ts
+function nested(value, path12, keys, issue, validate) {
+  if (value === void 0) {
+    return;
+  }
+  if (!record(value)) {
+    issue({
+      path: path12,
+      code: "invalid_type",
+      message: `Expected an object. Set ${path12} to an object or remove it.`,
+      severity: "error"
+    });
+    return;
+  }
+  unknownKeys(value, keys, path12, issue);
+  validate(value);
+}
+function budgets(value, issue, error) {
+  nested(
+    value,
+    "budgets",
+    ["jsKbGz", "cssKbGz", "lcpMs", "override"],
+    issue,
+    (budget) => {
+      nested(
+        budget.override,
+        "budgets.override",
+        ["reason"],
+        issue,
+        (override) => {
+          if (typeof override.reason !== "string" || !override.reason.trim()) {
+            error(
+              "budgets.override.reason",
+              "invalid_format",
+              "Expected a non-blank reason. Explain why the default budget must be raised."
+            );
+          }
+        }
+      );
+      for (const key of ["jsKbGz", "cssKbGz", "lcpMs"]) {
+        const amount = budget[key];
+        if (amount === void 0) {
+          continue;
+        }
+        if (typeof amount !== "number" || !Number.isFinite(amount) || amount <= 0) {
+          error(
+            `budgets.${key}`,
+            "invalid_type",
+            `Expected a positive finite number. Set budgets.${key} to a number greater than zero.`
+          );
+        } else if (amount > DEFAULT_BUDGETS[key]) {
+          const message4 = `The ${key} budget exceeds the ${DEFAULT_BUDGETS[key]} default.`;
+          if (budget.override === void 0) {
+            error(
+              `budgets.${key}`,
+              "budget_override",
+              `${message4} Add budgets.override.reason to explain the increase.`
+            );
+          } else {
+            issue({
+              path: `budgets.${key}`,
+              code: "budget_override",
+              message: `${message4} Lower it to the default when the exception is no longer needed.`,
+              severity: "warning"
+            });
+          }
+        }
+      }
+    }
+  );
+}
+function analytics(value, issue, error) {
+  nested(value, "analytics", ["forward"], issue, (analyticsValue) => {
+    nested(
+      analyticsValue.forward,
+      "analytics.forward",
+      ["ga4", "metaPixel"],
+      issue,
+      (forward) => {
+        if (forward.ga4 !== void 0 && (typeof forward.ga4 !== "string" || !/^G-[A-Z0-9]+$/.test(forward.ga4))) {
+          error(
+            "analytics.forward.ga4",
+            "invalid_format",
+            "Expected a GA4 measurement id beginning with G-. Use a value such as G-XXXXXXXXXX."
+          );
+        }
+        if (forward.metaPixel !== void 0 && (typeof forward.metaPixel !== "string" || !/^\d+$/.test(forward.metaPixel))) {
+          error(
+            "analytics.forward.metaPixel",
+            "invalid_format",
+            "Expected a numeric Meta Pixel id. Use digits only."
+          );
+        }
+      }
+    );
+  });
+}
+
+// ../sdk/src/site-config/validate.ts
+var rootKeys = [
+  "store",
+  "branches",
+  "theme",
+  "prerender",
+  "menu",
+  "packages",
+  "outbound",
+  "budgets",
+  "analytics"
+];
+function validateConfig(input) {
+  const issues = [];
+  const issue = (value) => issues.push(value);
+  const error = (path12, code, message4) => issue({ path: path12, code, message: message4, severity: "error" });
+  if (!record(input)) {
+    return {
+      valid: false,
+      issues: [
+        {
+          path: "$",
+          code: "invalid_type",
+          message: "Expected a configuration object. Export an object from zappie.config.ts.",
+          severity: "error"
+        }
+      ]
+    };
+  }
+  unknownKeys(input, rootKeys, "", issue);
+  requiredSlug(input.store, "store", error);
+  theme(input.theme, error);
+  stringList(input.branches, "branches", error, {
+    nonempty: true,
+    unique: true,
+    slug: true
+  });
+  paths(input.prerender, error);
+  nested(input.menu, "menu", ["hiddenCategories"], issue, (value) => {
+    stringList(value.hiddenCategories, "menu.hiddenCategories", error);
+  });
+  nested(input.packages, "packages", ["allow"], issue, (value) => {
+    const allow = stringList(value.allow, "packages.allow", error);
+    allow?.forEach((name, index) => {
+      if (globallyAllowed(name)) {
+        issue({
+          path: `packages.allow[${index}]`,
+          code: "redundant_allowlist",
+          message: `${name} is already globally allowed. Remove it from packages.allow.`,
+          severity: "warning"
+        });
+      } else if (!packageName(name)) {
+        error(
+          `packages.allow[${index}]`,
+          "invalid_format",
+          "Expected a lowercase npm package name. Use a package name such as lucide-react or @scope/name."
+        );
+      }
+    });
+  });
+  nested(input.outbound, "outbound", ["allow"], issue, (value) => {
+    const allow = stringList(value.allow, "outbound.allow", error);
+    allow?.forEach((host, index) => {
+      if (!hostname(host)) {
+        error(
+          `outbound.allow[${index}]`,
+          "invalid_format",
+          "Expected a hostname or leading *. subdomain pattern without a scheme, path, port or IP. Use a value such as api.example.com."
+        );
+      }
+    });
+  });
+  budgets(input.budgets, issue, error);
+  analytics(input.analytics, issue, error);
+  return {
+    valid: !issues.some((entry) => entry.severity === "error"),
+    issues
+  };
+}
+function requiredSlug(value, path12, error) {
+  if (!nonblank(value)) {
+    error(
+      path12,
+      value === void 0 ? "missing_required" : "invalid_type",
+      `Expected a non-empty storefront slug. Set ${path12} to the slug used by createZappie().`
+    );
+  }
+}
+function theme(value, error) {
+  if (typeof value !== "string") {
+    error(
+      "theme",
+      value === void 0 ? "missing_required" : "invalid_type",
+      "Expected a relative .json path. Set theme to a value such as ./theme.json."
+    );
+  } else if (!/\.json$/.test(value) || /^(?:[a-z][a-z\d+.-]*:|\/|\\)/i.test(value) || value.includes("\\")) {
+    error(
+      "theme",
+      "invalid_format",
+      "Expected a relative .json path. Use a value such as ./theme.json."
+    );
+  }
+}
+function stringList(value, path12, error, options = {}) {
+  if (value === void 0) {
+    return void 0;
+  }
+  if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string")) {
+    error(
+      path12,
+      "invalid_type",
+      `Expected an array of strings. Set ${path12} to string values.`
+    );
+    return void 0;
+  }
+  if (options.nonempty && value.length === 0) {
+    error(
+      path12,
+      "invalid_format",
+      `Expected at least one value. Add a value to ${path12} or remove the field.`
+    );
+  }
+  value.forEach((entry, index) => {
+    if (options.slug && !nonblank(entry)) {
+      error(
+        `${path12}[${index}]`,
+        "invalid_format",
+        "Expected a non-empty branch slug. Remove the empty value or use a branch slug."
+      );
+    }
+  });
+  if (options.unique && new Set(value).size !== value.length) {
+    error(
+      path12,
+      "duplicate",
+      `Expected unique values. Remove duplicates from ${path12}.`
+    );
+  }
+  return value;
+}
+function paths(value, error) {
+  const values = stringList(value, "prerender", error, { unique: true });
+  values?.forEach((path12, index) => {
+    if (!path12.startsWith("/")) {
+      error(
+        `prerender[${index}]`,
+        "invalid_format",
+        "Expected a route starting with /. Prefix the route with /."
+      );
+    }
+  });
+}
+
+// src/allowlist.ts
+import { access, readFile as readFile3 } from "fs/promises";
+import path3 from "path";
+
+// ../tokens/src/names.ts
+var COLOR_TOKENS = [
+  "--z-bg",
+  "--z-surface",
+  "--z-surface-raised",
+  "--z-overlay",
+  "--z-text",
+  "--z-text-muted",
+  "--z-text-inverse",
+  "--z-accent",
+  "--z-accent-contrast",
+  "--z-brand-1",
+  "--z-brand-2",
+  "--z-brand-3",
+  "--z-success",
+  "--z-warning",
+  "--z-danger",
+  "--z-border",
+  "--z-focus-ring"
+];
+var LENGTH_TOKENS = [
+  "--z-radius-sm",
+  "--z-radius-md",
+  "--z-radius-lg",
+  "--z-radius-pill",
+  "--z-space-1",
+  "--z-space-2",
+  "--z-space-3",
+  "--z-space-4",
+  "--z-space-5",
+  "--z-space-6",
+  "--z-space-7",
+  "--z-space-8",
+  "--z-text-xs",
+  "--z-text-sm",
+  "--z-text-md",
+  "--z-text-lg",
+  "--z-text-xl",
+  "--z-text-2xl",
+  "--z-text-3xl",
+  "--z-drawer-width",
+  "--z-dialog-width",
+  "--z-dialog-height",
+  "--z-media-sm"
+];
+var FONT_TOKENS = [
+  "--z-font-display",
+  "--z-font-body",
+  "--z-font-mono"
+];
+var DURATION_TOKENS = [
+  "--z-duration-fast",
+  "--z-duration-base",
+  "--z-duration-slow"
+];
+var EASING_TOKENS = ["--z-ease-out", "--z-ease-in-out"];
+var MOTION_TOKENS = [...DURATION_TOKENS, ...EASING_TOKENS];
+var TOKEN_NAMES = [
+  ...COLOR_TOKENS,
+  ...LENGTH_TOKENS,
+  ...FONT_TOKENS,
+  ...MOTION_TOKENS
+];
+var REQUIRED_TOKENS = [
+  "--z-bg",
+  "--z-text",
+  "--z-accent",
+  "--z-accent-contrast"
+];
+
+// ../tokens/src/defaults.ts
+var DEFAULT_TOKENS = Object.freeze({
+  "--z-bg": "#F9FAFB",
+  "--z-surface": "#FFFFFF",
+  "--z-surface-raised": "#FFFFFF",
+  "--z-overlay": "#00000080",
+  "--z-text": "#101828",
+  "--z-text-muted": "#344054",
+  "--z-text-inverse": "#FFFFFF",
+  "--z-accent": "#9FE870",
+  "--z-accent-contrast": "#163300",
+  "--z-brand-1": "#9FE870",
+  "--z-brand-2": "#163300",
+  "--z-brand-3": "#EDC843",
+  "--z-success": "#027A48",
+  "--z-warning": "#ED7A37",
+  "--z-danger": "#F04438",
+  "--z-border": "#EAECF0",
+  "--z-focus-ring": "#163300",
+  "--z-radius-sm": "6px",
+  "--z-radius-md": "12px",
+  "--z-radius-lg": "20px",
+  "--z-radius-pill": "9999px",
+  "--z-space-1": "4px",
+  "--z-space-2": "8px",
+  "--z-space-3": "12px",
+  "--z-space-4": "16px",
+  "--z-space-5": "24px",
+  "--z-space-6": "32px",
+  "--z-space-7": "48px",
+  "--z-space-8": "64px",
+  "--z-font-display": "system-ui, sans-serif",
+  "--z-font-body": "system-ui, sans-serif",
+  "--z-font-mono": "ui-monospace, monospace",
+  "--z-text-xs": "12px",
+  "--z-text-sm": "14px",
+  "--z-text-md": "16px",
+  "--z-text-lg": "18px",
+  "--z-text-xl": "20px",
+  "--z-text-2xl": "24px",
+  "--z-text-3xl": "32px",
+  "--z-duration-fast": "120ms",
+  "--z-duration-base": "200ms",
+  "--z-duration-slow": "320ms",
+  "--z-ease-out": "cubic-bezier(0, 0, 0.2, 1)",
+  "--z-ease-in-out": "cubic-bezier(0.4, 0, 0.2, 1)",
+  "--z-drawer-width": "420px",
+  "--z-dialog-width": "min(1000px, calc(100vw - 32px))",
+  "--z-dialog-height": "min(780px, 90dvh)",
+  "--z-media-sm": "64px"
+});
+var DEFAULT_THEME = Object.freeze({
+  version: 1,
+  name: "Zappie",
+  tokens: DEFAULT_TOKENS,
+  darkMode: "light",
+  dark: Object.freeze({
+    "--z-bg": "#000000",
+    "--z-surface": "#242424",
+    "--z-surface-raised": "#333333",
+    "--z-text": "#FFFFFF",
+    "--z-text-muted": "#BFBFBF",
+    "--z-text-inverse": "#101828",
+    "--z-border": "#474747",
+    "--z-focus-ring": "#9FE870"
+  })
+});
+
+// ../tokens/src/named-colors.ts
+var NAMED_COLORS = {
+  aliceblue: "f0f8ff",
+  antiquewhite: "faebd7",
+  aqua: "00ffff",
+  aquamarine: "7fffd4",
+  azure: "f0ffff",
+  beige: "f5f5dc",
+  bisque: "ffe4c4",
+  black: "000000",
+  blanchedalmond: "ffebcd",
+  blue: "0000ff",
+  blueviolet: "8a2be2",
+  brown: "a52a2a",
+  burlywood: "deb887",
+  cadetblue: "5f9ea0",
+  chartreuse: "7fff00",
+  chocolate: "d2691e",
+  coral: "ff7f50",
+  cornflowerblue: "6495ed",
+  cornsilk: "fff8dc",
+  crimson: "dc143c",
+  cyan: "00ffff",
+  darkblue: "00008b",
+  darkcyan: "008b8b",
+  darkgoldenrod: "b8860b",
+  darkgray: "a9a9a9",
+  darkgreen: "006400",
+  darkgrey: "a9a9a9",
+  darkkhaki: "bdb76b",
+  darkmagenta: "8b008b",
+  darkolivegreen: "556b2f",
+  darkorange: "ff8c00",
+  darkorchid: "9932cc",
+  darkred: "8b0000",
+  darksalmon: "e9967a",
+  darkseagreen: "8fbc8f",
+  darkslateblue: "483d8b",
+  darkslategray: "2f4f4f",
+  darkslategrey: "2f4f4f",
+  darkturquoise: "00ced1",
+  darkviolet: "9400d3",
+  deeppink: "ff1493",
+  deepskyblue: "00bfff",
+  dimgray: "696969",
+  dimgrey: "696969",
+  dodgerblue: "1e90ff",
+  firebrick: "b22222",
+  floralwhite: "fffaf0",
+  forestgreen: "228b22",
+  fuchsia: "ff00ff",
+  gainsboro: "dcdcdc",
+  ghostwhite: "f8f8ff",
+  gold: "ffd700",
+  goldenrod: "daa520",
+  gray: "808080",
+  green: "008000",
+  greenyellow: "adff2f",
+  grey: "808080",
+  honeydew: "f0fff0",
+  hotpink: "ff69b4",
+  indianred: "cd5c5c",
+  indigo: "4b0082",
+  ivory: "fffff0",
+  khaki: "f0e68c",
+  lavender: "e6e6fa",
+  lavenderblush: "fff0f5",
+  lawngreen: "7cfc00",
+  lemonchiffon: "fffacd",
+  lightblue: "add8e6",
+  lightcoral: "f08080",
+  lightcyan: "e0ffff",
+  lightgoldenrodyellow: "fafad2",
+  lightgray: "d3d3d3",
+  lightgreen: "90ee90",
+  lightgrey: "d3d3d3",
+  lightpink: "ffb6c1",
+  lightsalmon: "ffa07a",
+  lightseagreen: "20b2aa",
+  lightskyblue: "87cefa",
+  lightslategray: "778899",
+  lightslategrey: "778899",
+  lightsteelblue: "b0c4de",
+  lightyellow: "ffffe0",
+  lime: "00ff00",
+  limegreen: "32cd32",
+  linen: "faf0e6",
+  magenta: "ff00ff",
+  maroon: "800000",
+  mediumaquamarine: "66cdaa",
+  mediumblue: "0000cd",
+  mediumorchid: "ba55d3",
+  mediumpurple: "9370db",
+  mediumseagreen: "3cb371",
+  mediumslateblue: "7b68ee",
+  mediumspringgreen: "00fa9a",
+  mediumturquoise: "48d1cc",
+  mediumvioletred: "c71585",
+  midnightblue: "191970",
+  mintcream: "f5fffa",
+  mistyrose: "ffe4e1",
+  moccasin: "ffe4b5",
+  navajowhite: "ffdead",
+  navy: "000080",
+  oldlace: "fdf5e6",
+  olive: "808000",
+  olivedrab: "6b8e23",
+  orange: "ffa500",
+  orangered: "ff4500",
+  orchid: "da70d6",
+  palegoldenrod: "eee8aa",
+  palegreen: "98fb98",
+  paleturquoise: "afeeee",
+  palevioletred: "db7093",
+  papayawhip: "ffefd5",
+  peachpuff: "ffdab9",
+  peru: "cd853f",
+  pink: "ffc0cb",
+  plum: "dda0dd",
+  powderblue: "b0e0e6",
+  purple: "800080",
+  rebeccapurple: "663399",
+  red: "ff0000",
+  rosybrown: "bc8f8f",
+  royalblue: "4169e1",
+  saddlebrown: "8b4513",
+  salmon: "fa8072",
+  sandybrown: "f4a460",
+  seagreen: "2e8b57",
+  seashell: "fff5ee",
+  sienna: "a0522d",
+  silver: "c0c0c0",
+  skyblue: "87ceeb",
+  slateblue: "6a5acd",
+  slategray: "708090",
+  slategrey: "708090",
+  snow: "fffafa",
+  springgreen: "00ff7f",
+  steelblue: "4682b4",
+  tan: "d2b48c",
+  teal: "008080",
+  thistle: "d8bfd8",
+  tomato: "ff6347",
+  turquoise: "40e0d0",
+  violet: "ee82ee",
+  wheat: "f5deb3",
+  white: "ffffff",
+  whitesmoke: "f5f5f5",
+  yellow: "ffff00",
+  yellowgreen: "9acd32"
+};
+
+// ../tokens/src/parse.ts
+var numberPattern = /^[+-]?(?:\d+(?:\.\d*)?|\.\d+)(?:e[+-]?\d+)?$/i;
+var safeValue = (value) => value.length <= 512 && !/[;{}<>\\\x00-\x1f]|\/\*|url\s*\(|expression\s*\(/i.test(value);
+var clamp = (n) => Math.max(0, Math.min(1, n));
+function numeric(value, scale = 1) {
+  const percent = value.endsWith("%");
+  const raw = percent ? value.slice(0, -1) : value;
+  const parsed = numberPattern.test(raw) ? Number(raw) / (percent ? 100 : scale) : NaN;
+  return Number.isFinite(parsed) ? parsed : NaN;
+}
+function hue(value) {
+  const match = /^(.*?)(deg|rad|grad|turn)?$/.exec(value);
+  if (!match || !numberPattern.test(match[1])) {
+    return NaN;
+  }
+  const factors = {
+    deg: 1,
+    rad: 180 / Math.PI,
+    grad: 0.9,
+    turn: 360
+  };
+  return Number(match[1]) * (factors[match[2] ?? "deg"] ?? 1);
+}
+function parseColor(input) {
+  if (!safeValue(input)) {
+    return null;
+  }
+  let value = input.trim().toLowerCase();
+  if (value === "transparent") {
+    return [0, 0, 0, 0];
+  }
+  if (Object.prototype.hasOwnProperty.call(NAMED_COLORS, value)) {
+    value = "#" + NAMED_COLORS[value];
+  }
+  if (/^#(?:[\da-f]{3,4}|[\da-f]{6}|[\da-f]{8})$/.test(value)) {
+    let hex = value.slice(1);
+    if (hex.length < 5) {
+      hex = [...hex].map((c) => c + c).join("");
+    }
+    if (hex.length === 6) {
+      hex += "ff";
+    }
+    return [0, 2, 4, 6].map(
+      (i) => parseInt(hex.slice(i, i + 2), 16) / 255
+    );
+  }
+  const match = /^(rgba?|hsla?|oklch)\(([^()]*)\)$/.exec(value);
+  if (!match) {
+    return null;
+  }
+  const kind = match[1];
+  const body = match[2].trim();
+  const comma = body.includes(",");
+  if (comma && (body.includes("/") || kind === "oklch")) {
+    return null;
+  }
+  const parts = comma ? body.split(",").map((s) => s.trim()) : body.split(/\s*\/\s*/);
+  let channels, alpha;
+  if (comma) {
+    if (parts.length !== 3 && parts.length !== 4) {
+      return null;
+    }
+    channels = parts.slice(0, 3);
+    alpha = parts[3];
+  } else {
+    if (parts.length > 2) {
+      return null;
+    }
+    channels = parts[0].split(/\s+/);
+    alpha = parts[1];
+  }
+  if (channels.length !== 3) {
+    return null;
+  }
+  const opacity = alpha === void 0 ? 1 : numeric(alpha);
+  let rgb;
+  if (kind.startsWith("rgb")) {
+    if (comma && channels.some((c) => c.endsWith("%")) && !channels.every((c) => c.endsWith("%"))) {
+      return null;
+    }
+    rgb = channels.map((c) => numeric(c, 255));
+  } else if (kind.startsWith("hsl")) {
+    if (!channels[1].endsWith("%") || !channels[2].endsWith("%")) {
+      return null;
+    }
+    const h = (hue(channels[0]) % 360 + 360) % 360;
+    const s = clamp(numeric(channels[1])), l = clamp(numeric(channels[2]));
+    const a = s * Math.min(l, 1 - l);
+    rgb = [0, 8, 4].map((n) => {
+      const k = (n + h / 30) % 12;
+      return l - a * Math.max(-1, Math.min(k - 3, 9 - k, 1));
+    });
+  } else {
+    const l = clamp(numeric(channels[0]));
+    const c = Math.max(
+      0,
+      numeric(channels[1]) * (channels[1].endsWith("%") ? 0.4 : 1)
+    );
+    const h = hue(channels[2]) * Math.PI / 180;
+    const a = c * Math.cos(h), b = c * Math.sin(h);
+    const x = (l + 0.3963377774 * a + 0.2158037573 * b) ** 3;
+    const y = (l - 0.1055613458 * a - 0.0638541728 * b) ** 3;
+    const z = (l - 0.0894841775 * a - 1.291485548 * b) ** 3;
+    rgb = [
+      4.0767416621 * x - 3.3077115913 * y + 0.2309699292 * z,
+      -1.2684380046 * x + 2.6097574011 * y - 0.3413193965 * z,
+      -0.0041960863 * x - 0.7034186147 * y + 1.707614701 * z
+    ].map((v) => v <= 31308e-7 ? 12.92 * v : 1.055 * v ** (1 / 2.4) - 0.055);
+  }
+  return [...rgb, opacity].every(Number.isFinite) ? [...rgb.map(clamp), clamp(opacity)] : null;
+}
+function isLength(value, depth = 0) {
+  if (!safeValue(value) || depth > 8) {
+    return false;
+  }
+  const text = value.trim();
+  if (/^(?:0|(?:\d+(?:\.\d*)?|\.\d+)(?:px|rem|em|%|dvh|vh|vw))$/.test(text)) {
+    return true;
+  }
+  const fn = /^(min|max|clamp|calc)\((.*)\)$/.exec(text);
+  if (!fn) {
+    return false;
+  }
+  let level2 = 0, start = 0;
+  const args = [];
+  for (let i = 0; i < fn[2].length; i++) {
+    const c = fn[2][i];
+    if (c === "(") {
+      level2++;
+    }
+    if (c === ")" && --level2 < 0) {
+      return false;
+    }
+    const separator = fn[1] === "calc" ? (c === "+" || c === "-") && /\s/.test(fn[2][i - 1] ?? "") && /\s/.test(fn[2][i + 1] ?? "") : c === ",";
+    if (level2 === 0 && separator) {
+      args.push(fn[2].slice(start, i));
+      start = i + 1;
+    }
+  }
+  args.push(fn[2].slice(start));
+  return level2 === 0 && (fn[1] !== "clamp" || args.length === 3) && args.every((arg) => isLength(arg, depth + 1));
+}
+var cssWideKeyword = /^(?:inherit|initial|unset|revert|revert-layer|default)$/i;
+function isFontFamily(value) {
+  return safeValue(value) && value.split(",").every((part) => {
+    const family = part.trim();
+    return /^[a-zA-Z][a-zA-Z0-9 -]*$/.test(family) && !cssWideKeyword.test(family);
+  });
+}
+function isDuration(value) {
+  return /^(?:\d+(?:\.\d+)?|\.\d+)(?:ms|s)$/.test(value);
+}
+function isEasing(value) {
+  if (/^(linear|ease|ease-in|ease-out|ease-in-out|step-start|step-end)$/.test(
+    value
+  )) {
+    return true;
+  }
+  const m = /^cubic-bezier\((.*)\)$/.exec(value);
+  if (!m) {
+    return false;
+  }
+  const ns = m[1].split(",").map((s) => numberPattern.test(s.trim()) ? numeric(s.trim()) : NaN);
+  return ns.length === 4 && ns.every(Number.isFinite) && ns[0] >= 0 && ns[0] <= 1 && ns[2] >= 0 && ns[2] <= 1;
+}
+function isAssetUrl(value, relative2 = true) {
+  if (!value || !safeValue(value) || /[\s"'()]/.test(value)) {
+    return false;
+  }
+  if (relative2 && !/^[a-z][\w+.-]*:/i.test(value) && !value.startsWith("//")) {
+    return true;
+  }
+  try {
+    const url = new URL(value);
+    return url.protocol === "https:" && !url.username && !url.password;
+  } catch {
+    return false;
+  }
+}
+
+// ../tokens/src/contrast.ts
+function contrastRatio(fg, bg) {
+  const foreground = parseColor(fg), background = parseColor(bg);
+  if (!foreground || !background || background[3] !== 1) {
+    return NaN;
+  }
+  const luminance = (channels) => channels.map((c) => c <= 0.04045 ? c / 12.92 : ((c + 0.055) / 1.055) ** 2.4).reduce((sum, c, i) => sum + c * [0.2126, 0.7152, 0.0722][i], 0);
+  const a = luminance(
+    foreground.slice(0, 3).map((c, i) => c * foreground[3] + background[i] * (1 - foreground[3]))
+  );
+  const b = luminance(background.slice(0, 3));
+  return (Math.max(a, b) + 0.05) / (Math.min(a, b) + 0.05);
+}
+
+// ../tokens/src/validate.ts
+var record2 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var includes = (values, key) => values.includes(key);
+function validateTheme(input) {
+  const issues = [];
+  const issue = (path12, code, message4, severity = "error") => issues.push({ path: path12, code, message: message4, severity });
+  const keys = (obj, allowed, path12) => {
+    for (const key of Object.keys(obj)) {
+      if (!allowed.includes(key)) {
+        issue(path12 ? `${path12}.${key}` : key, "invalid_theme", "Unknown field");
+      }
+    }
+  };
+  if (!record2(input)) {
+    return {
+      ok: false,
+      issues: [
+        {
+          path: "",
+          code: "invalid_theme",
+          message: "Expected a theme object",
+          severity: "error"
+        }
+      ]
+    };
+  }
+  keys(
+    input,
+    [
+      "$schema",
+      "version",
+      "name",
+      "tokens",
+      "dark",
+      "darkMode",
+      "fonts",
+      "logo",
+      "motion"
+    ],
+    ""
+  );
+  if (input.version !== 1) {
+    issue("version", "invalid_theme", "Expected version 1");
+  }
+  if (typeof input.name !== "string" || !input.name.trim() || input.name.length > 100) {
+    issue("name", "missing_required", "Expected a name of 1\u2013100 characters");
+  }
+  if (input.$schema !== void 0 && (typeof input.$schema !== "string" || !isAssetUrl(input.$schema, false))) {
+    issue("$schema", "invalid_theme", "Expected an HTTPS schema URL");
+  }
+  if (input.darkMode !== void 0 && (typeof input.darkMode !== "string" || !["auto", "light", "dark"].includes(input.darkMode))) {
+    issue("darkMode", "invalid_theme", "Expected auto, light or dark");
+  }
+  for (const group of ["tokens", "dark"]) {
+    const values = input[group];
+    if (group === "dark" && values === void 0) {
+      continue;
+    }
+    if (!record2(values)) {
+      issue(group, "missing_required", "Expected a token object");
+      continue;
+    }
+    if (group === "tokens") {
+      for (const key of REQUIRED_TOKENS) {
+        if (!Object.prototype.hasOwnProperty.call(values, key)) {
+          issue(`${group}.${key}`, "missing_required", "Required token");
+        }
+      }
+    }
+    for (const [key, value] of Object.entries(values)) {
+      const path12 = `${group}.${key}`;
+      if (!includes(TOKEN_NAMES, key)) {
+        issue(path12, "unknown_token", "Unknown semantic token");
+        continue;
+      }
+      let code, valid = false;
+      if (includes(COLOR_TOKENS, key)) {
+        code = "invalid_color";
+        valid = typeof value === "string" && parseColor(value) !== null;
+      } else if (includes(LENGTH_TOKENS, key)) {
+        code = "invalid_length";
+        valid = typeof value === "string" && isLength(value);
+      } else if (includes(FONT_TOKENS, key)) {
+        code = "invalid_font";
+        valid = typeof value === "string" && isFontFamily(value);
+      } else {
+        code = "invalid_motion";
+        valid = typeof value === "string" && safeValue(value) && (includes(DURATION_TOKENS, key) ? isDuration(value) : isEasing(value));
+      }
+      if (!valid) {
+        issue(path12, code, "Invalid or unsafe token value");
+      }
+    }
+  }
+  if (input.fonts !== void 0) {
+    if (!Array.isArray(input.fonts) || input.fonts.length > 3) {
+      issue("fonts", "invalid_font", "Expected at most three fonts");
+    } else {
+      const roles = /* @__PURE__ */ new Set();
+      input.fonts.forEach((font, i) => {
+        const path12 = `fonts[${i}]`;
+        if (!record2(font)) {
+          issue(path12, "invalid_font", "Expected a font object");
+          return;
+        }
+        keys(font, ["family", "source", "url", "weights", "role"], path12);
+        if (typeof font.family !== "string" || !isFontFamily(font.family) || font.family.includes(",")) {
+          issue(
+            `${path12}.family`,
+            "invalid_font",
+            "Expected one unquoted font family"
+          );
+        }
+        if (typeof font.source !== "string" || !["google", "self", "system"].includes(font.source)) {
+          issue(`${path12}.source`, "invalid_font", "Unknown font source");
+        }
+        if (typeof font.role !== "string" || !["display", "body", "mono"].includes(font.role) || roles.has(font.role)) {
+          issue(`${path12}.role`, "invalid_font", "Expected a unique font role");
+        }
+        roles.add(String(font.role));
+        if (font.source === "self" || font.url !== void 0) {
+          if (typeof font.url !== "string" || !isAssetUrl(font.url, false) || !new URL(font.url).pathname.endsWith(".woff2")) {
+            issue(
+              `${path12}.url`,
+              "invalid_font",
+              "Expected an HTTPS .woff2 URL"
+            );
+          }
+        }
+        if (font.weights !== void 0 && (!Array.isArray(font.weights) || !font.weights.length || font.weights.length > 9 || font.weights.some(
+          (w) => typeof w !== "number" || !Number.isInteger(w) || w < 1 || w > 1e3
+        ))) {
+          issue(
+            `${path12}.weights`,
+            "invalid_font",
+            "Expected 1\u20139 integer weights between 1 and 1000"
+          );
+        }
+      });
+    }
+  }
+  if (input.logo !== void 0) {
+    if (!record2(input.logo)) {
+      issue("logo", "invalid_logo", "Expected a logo object");
+    } else {
+      keys(input.logo, ["light", "dark", "mark", "alt"], "logo");
+      if (typeof input.logo.alt !== "string" || !input.logo.alt.trim()) {
+        issue("logo.alt", "invalid_logo", "Logo alternative text is required");
+      }
+      for (const key of ["light", "dark", "mark"]) {
+        const value = input.logo[key];
+        if (key === "light" || value !== void 0) {
+          if (typeof value !== "string" || !isAssetUrl(value)) {
+            issue(
+              `logo.${key}`,
+              "invalid_logo",
+              "Expected HTTPS or a relative asset path"
+            );
+          }
+        }
+      }
+    }
+  }
+  if (input.motion !== void 0) {
+    if (!record2(input.motion)) {
+      issue("motion", "invalid_motion", "Expected a motion object");
+    } else {
+      keys(input.motion, ["reduce"], "motion");
+      if (input.motion.reduce !== void 0 && typeof input.motion.reduce !== "boolean") {
+        issue("motion.reduce", "invalid_motion", "Expected a boolean");
+      }
+    }
+  }
+  const tokenGroup = (value) => record2(value) ? value : {};
+  for (const group of record2(input.dark) ? ["tokens", "dark"] : ["tokens"]) {
+    const values = {
+      ...DEFAULT_TOKENS,
+      ...tokenGroup(input.tokens),
+      ...group === "dark" ? tokenGroup(input.dark) : {}
+    };
+    const pairs = [
+      ["--z-text", "--z-bg", 4.5, "error"],
+      ["--z-text", "--z-surface", 4.5, "error"],
+      ["--z-accent-contrast", "--z-accent", 4.5, "error"],
+      ["--z-text-muted", "--z-bg", 3, "warning"]
+    ];
+    for (const [fg, bg, minimum, severity] of pairs) {
+      const foreground = values[fg], background = values[bg];
+      if (typeof foreground !== "string" || typeof background !== "string" || !parseColor(foreground) || !parseColor(background)) {
+        continue;
+      }
+      const ratio = contrastRatio(foreground, background);
+      if (!Number.isFinite(ratio)) {
+        issue(
+          `${group}.${bg}`,
+          "unverified_contrast",
+          "A contrast background must be opaque",
+          "error"
+        );
+      } else if (ratio < minimum) {
+        issue(
+          `${group}.${fg}`,
+          "low_contrast",
+          `Contrast against ${bg} must be at least ${minimum}:1`,
+          severity
+        );
+      }
+    }
+  }
+  return issues.some((i) => i.severity === "error") ? { ok: false, issues } : { ok: true, theme: input, warnings: issues };
+}
+
+// src/config.ts
+import { readFile as readFile2, stat } from "fs/promises";
+import path2 from "path";
+import { pathToFileURL } from "url";
+
+// src/files.ts
+import { readFile } from "fs/promises";
+import path from "path";
+async function json(file) {
+  return JSON.parse(await readFile(file, "utf8"));
+}
+function relative(cwd, file) {
+  return path.relative(cwd, file).split(path.sep).join("/");
+}
+function lineFor(source, issuePath) {
+  const key = issuePath.split(".").at(-1)?.replace(/\[\d+\]$/, "");
+  if (!key || key === "$") {
+    return void 0;
+  }
+  const quoted = JSON.stringify(key);
+  const lines = source.split(/\r?\n/);
+  const index = lines.findIndex(
+    (line) => line.includes(quoted) || new RegExp(`\\b${escape(key)}\\b`).test(line)
+  );
+  return index < 0 ? void 0 : index + 1;
+}
+function escape(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+// src/result.ts
+function problem(message4, fix, details = {}) {
+  return { ...details, message: message4, fix };
+}
+function step(name, result, problems = []) {
+  return { name, result, problems };
+}
+var skipped = (name, message4) => step(name, "skipped", [problem(message4, null)]);
+
+// src/config.ts
+function supportsTypeScriptImport(version = process.versions.node) {
+  const [major = 0, minor = 0] = version.split(".").map(Number);
+  return major > 22 || major === 22 && minor >= 18;
+}
+async function loadConfig(cwd) {
+  const file = path2.join(cwd, "zappie.config.ts");
+  if (!supportsTypeScriptImport()) {
+    throw new Error(
+      "zappie check needs Node 22.18 or later to read zappie.config.ts"
+    );
+  }
+  const source = await readFile2(file, "utf8");
+  const version = (await stat(file)).mtimeMs;
+  const loaded = await import(`${pathToFileURL(file).href}?check=${version}`);
+  return { value: loaded.default, source, file };
+}
+async function checkConfig({
+  cwd,
+  signal
+}) {
+  signal?.throwIfAborted();
+  let loaded;
+  try {
+    loaded = await loadConfig(cwd);
+  } catch (error) {
+    return step("config", "failed", [
+      problem(
+        message(error),
+        "Create a readable zappie.config.ts in the project root.",
+        {
+          file: "zappie.config.ts"
+        }
+      )
+    ]);
+  }
+  const validation = validateConfig(loaded.value);
+  const problems = validation.issues.map(
+    (issue) => configProblem(issue, loaded.source)
+  );
+  let themeFailed = false;
+  const theme2 = configTheme(loaded.value);
+  if (theme2) {
+    const checkedTheme = await themeProblems(cwd, theme2);
+    problems.push(...checkedTheme.problems);
+    themeFailed = checkedTheme.failed;
+  }
+  signal?.throwIfAborted();
+  return step(
+    "config",
+    validation.issues.some((issue) => issue.severity === "error") || themeFailed ? "failed" : "passed",
+    problems
+  );
+}
+function configProblem(issue, source) {
+  const line = lineFor(source, issue.path);
+  return problem(`${issue.path}: ${issue.message}`, issue.message, {
+    rule: `config/${issue.code}`,
+    file: "zappie.config.ts",
+    ...line ? { line } : {}
+  });
+}
+async function themeProblems(cwd, theme2) {
+  const file = path2.resolve(cwd, theme2);
+  try {
+    const source = await readFile2(file, "utf8");
+    const result = validateTheme(JSON.parse(source));
+    const issues = result.ok ? result.warnings : result.issues;
+    return {
+      failed: issues.some((issue) => issue.severity === "error"),
+      problems: issues.map((issue) => themeProblem(issue, source, theme2))
+    };
+  } catch (error) {
+    return {
+      failed: true,
+      problems: [
+        problem(message(error), `Make ${theme2} a readable JSON theme file.`, {
+          rule: "theme/unreadable",
+          file: theme2
+        })
+      ]
+    };
+  }
+}
+function themeProblem(issue, source, file) {
+  const line = lineFor(source, issue.path);
+  return problem(`${issue.path}: ${issue.message}`, issue.message, {
+    rule: `theme/${issue.code}`,
+    file,
+    ...line ? { line } : {}
+  });
+}
+function configTheme(value) {
+  return value && typeof value === "object" && "theme" in value && typeof value.theme === "string" ? value.theme : void 0;
+}
+function message(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
+// src/allowlist.ts
+var BUILTIN_ALLOWLIST_SOURCE = {
+  load: async () => GLOBAL_PACKAGE_ALLOWLIST
+};
+async function checkAllowlist({ cwd, signal }, source = BUILTIN_ALLOWLIST_SOURCE) {
+  signal?.throwIfAborted();
+  const problems = [];
+  let manifest;
+  try {
+    manifest = await json(path3.join(cwd, "package.json"));
+  } catch (error) {
+    return step("allowlist", "failed", [
+      problem(String(error), "Add a valid package.json to the project root.", {
+        file: "package.json"
+      })
+    ]);
+  }
+  if (!await hasLockfile(cwd)) {
+    problems.push(
+      problem(
+        "No supported lockfile was found.",
+        "Install dependencies and commit the generated lockfile."
+      )
+    );
+  }
+  const global = await source.load(signal);
+  const local = await localAllowlist(cwd);
+  for (const name of Object.keys(manifest.dependencies ?? {})) {
+    if (![...global, ...local].some((entry) => matches(entry, name))) {
+      problems.push(
+        problem(
+          `${name} is not in the package allowlist.`,
+          `Add ${name} to packages.allow in zappie.config.ts after reviewing it.`,
+          { rule: "allowlist/package", file: "package.json" }
+        )
+      );
+    }
+    await checkInstallScripts(cwd, name, problems);
+  }
+  signal?.throwIfAborted();
+  return step("allowlist", problems.length ? "failed" : "passed", problems);
+}
+async function localAllowlist(cwd) {
+  try {
+    const loaded = await loadConfig(cwd);
+    const value = loaded.value;
+    return Array.isArray(value?.packages?.allow) ? value.packages.allow.filter(
+      (entry) => typeof entry === "string"
+    ) : [];
+  } catch {
+    return [];
+  }
+}
+async function hasLockfile(cwd) {
+  for (let directory = cwd; ; directory = path3.dirname(directory)) {
+    for (const name of [
+      "pnpm-lock.yaml",
+      "package-lock.json",
+      "yarn.lock",
+      "bun.lock",
+      "bun.lockb"
+    ]) {
+      try {
+        await access(path3.join(directory, name));
+        return true;
+      } catch {
+        continue;
+      }
+    }
+    if (path3.dirname(directory) === directory) {
+      return false;
+    }
+  }
+}
+async function checkInstallScripts(cwd, name, problems) {
+  try {
+    const dependency = await installedManifest(cwd, name);
+    for (const script of ["preinstall", "install", "postinstall"]) {
+      if (dependency.scripts?.[script]) {
+        problems.push(
+          problem(
+            `${name} declares a ${script} script.`,
+            `Remove ${name} or use a dependency without install scripts.`,
+            { rule: "allowlist/install-script", file: "package.json" }
+          )
+        );
+      }
+    }
+  } catch {
+    problems.push(
+      problem(
+        `${name} is not installed.`,
+        "Install dependencies from the committed lockfile.",
+        {
+          rule: "allowlist/not-installed",
+          file: "package.json"
+        }
+      )
+    );
+  }
+}
+function matches(pattern, value) {
+  return pattern.endsWith("/*") ? value.startsWith(pattern.slice(0, -1)) : pattern === value;
+}
+async function installedManifest(cwd, name) {
+  for (let directory = cwd; ; directory = path3.dirname(directory)) {
+    const file = path3.join(
+      directory,
+      "node_modules",
+      ...name.split("/"),
+      "package.json"
+    );
+    try {
+      return JSON.parse(await readFile3(file, "utf8"));
+    } catch (error) {
+      if (path3.dirname(directory) === directory) {
+        throw error;
+      }
+    }
+  }
+}
+
+// src/budgets.ts
+import { access as access2, readFile as readFile6 } from "fs/promises";
+import path6 from "path";
+
+// src/budget-files.ts
+import { readFile as readFile4, readdir } from "fs/promises";
+import path4 from "path";
+import { gzipSync } from "zlib";
+async function cssSizes(cwd) {
+  const root = path4.join(cwd, "build/client");
+  const files = [];
+  await collect(root, files);
+  return Promise.all(
+    files.filter((file) => file.endsWith(".css")).map(async (file) => ({
+      file: path4.relative(root, file).split(path4.sep).join("/"),
+      bytes: gzipSync(await readFile4(file, "utf8")).byteLength
+    }))
+  );
+}
+async function collect(directory, files) {
+  for (const entry of await readdir(directory, { withFileTypes: true })) {
+    if (entry.isSymbolicLink()) {
+      continue;
+    }
+    const file = path4.join(directory, entry.name);
+    if (entry.isDirectory()) {
+      await collect(file, files);
+    } else if (entry.isFile()) {
+      files.push(file);
+    }
+  }
+}
+
+// src/budget-manifest.ts
+import { readFile as readFile5 } from "fs/promises";
+import path5 from "path";
+import { gzipSync as gzipSync2 } from "zlib";
+function routeKeys(manifest) {
+  return Object.entries(manifest).filter(([key, entry]) => routeSource(entry.src ?? key)).map(([key]) => key).sort();
+}
+function clientKeys(manifest) {
+  return Object.entries(manifest).filter(([key, entry]) => entry.isEntry && !routeSource(entry.src ?? key)).map(([key]) => key).sort();
+}
+async function graphSizes(cwd, manifest, roots) {
+  const keys = closure(manifest, roots);
+  return Promise.all(
+    [...keys].map((key) => manifest[key]).filter((entry) => Boolean(entry)).filter(({ file }) => file.endsWith(".js")).map(async ({ file }) => ({
+      file,
+      bytes: gzipSync2(
+        await readFile5(path5.join(cwd, "build/client", file), "utf8")
+      ).byteLength
+    }))
+  );
+}
+function closure(manifest, roots) {
+  const visited = /* @__PURE__ */ new Set();
+  const visit = (key) => {
+    if (visited.has(key)) {
+      return;
+    }
+    const entry = manifest[key];
+    if (!entry) {
+      throw new Error(`Manifest import ${key} has no entry.`);
+    }
+    visited.add(key);
+    for (const dependency of entry.imports ?? []) {
+      visit(dependency);
+    }
+  };
+  roots.forEach(visit);
+  return visited;
+}
+function routeSource(value) {
+  return value.replace(/^\/?/, "").startsWith("app/routes/");
+}
+
+// src/budgets.ts
+var KIB = 1024;
+async function checkBudgets({
+  cwd,
+  signal
+}) {
+  signal?.throwIfAborted();
+  const manifestFile = path6.join(cwd, "build/client/.vite/manifest.json");
+  try {
+    await access2(manifestFile);
+  } catch {
+    return skipped(
+      "budgets",
+      "No build/client/.vite/manifest.json is available."
+    );
+  }
+  const manifest = JSON.parse(await readFile6(manifestFile, "utf8"));
+  const config = (await loadConfig(cwd)).value;
+  const limits = { ...DEFAULT_BUDGETS, ...config.budgets };
+  const routes = routeKeys(manifest);
+  const clients = clientKeys(manifest);
+  if (routes.length === 0 || clients.length === 0) {
+    throw new Error(
+      "The Vite manifest needs a client entry and app/routes entries."
+    );
+  }
+  const problems = [];
+  let failed = false;
+  for (const route of routes) {
+    const sizes = await graphSizes(cwd, manifest, [...clients, route]);
+    const over = total(sizes) > limits.jsKbGz * KIB;
+    failed ||= over;
+    problems.push(routeProblem(route, sizes, limits.jsKbGz, over));
+  }
+  const styles = await cssSizes(cwd);
+  const cssOver = total(styles) > limits.cssKbGz * KIB;
+  failed ||= cssOver;
+  problems.push(cssProblem(styles, limits.cssKbGz, cssOver));
+  problems.push(
+    problem(
+      `LCP is not measured by zappie check; zappie verify enforces the ${limits.lcpMs} ms budget.`,
+      null,
+      { rule: "budgets/lcp" }
+    )
+  );
+  signal?.throwIfAborted();
+  return step("budgets", failed ? "failed" : "passed", problems);
+}
+function routeProblem(route, sizes, limitKb, over) {
+  const bytes = total(sizes);
+  const largest = [...sizes].sort((left, right) => right.bytes - left.bytes).slice(0, 3).map(({ file, bytes: size }) => `${file} (${size} B)`).join(", ");
+  return problem(
+    `${route}: ${bytes} B gzip (limit ${limitKb * KIB} B).${over ? ` Largest chunks: ${largest}.` : ""}`,
+    over ? "Reduce the route's client JavaScript or raise the reviewed budget override." : null,
+    {
+      rule: over ? "budgets/js-over" : "budgets/js-route",
+      file: "build/client/.vite/manifest.json"
+    }
+  );
+}
+function cssProblem(sizes, limitKb, over) {
+  const bytes = total(sizes);
+  return problem(
+    `Client CSS: ${bytes} B gzip (limit ${limitKb * KIB} B).`,
+    over ? "Reduce client CSS or raise the reviewed budget override." : null,
+    { rule: over ? "budgets/css-over" : "budgets/css" }
+  );
+}
+var total = (sizes) => sizes.reduce((sum, asset) => sum + asset.bytes, 0);
+
+// src/build.ts
+import { readFile as readFile7 } from "fs/promises";
+import path7 from "path";
+
+// src/command.ts
+import { spawn } from "child_process";
+function command(executable, args, cwd, signal) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(executable, args, {
+      cwd,
+      env: { ...process.env, NO_COLOR: "1", FORCE_COLOR: "0" },
+      stdio: ["ignore", "pipe", "pipe"],
+      ...signal ? { signal } : {}
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.on("data", (value) => {
+      stdout += String(value);
+    });
+    child.stderr.on("data", (value) => {
+      stderr += String(value);
+    });
+    child.on("error", reject);
+    child.on("close", (code) => {
+      resolve({ code: code ?? 1, stdout, stderr });
+    });
+  });
+}
+function execArgs(manager, binary, args) {
+  if (manager === "npm") {
+    return { executable: "npm", args: ["exec", "--no", "--", binary, ...args] };
+  }
+  if (manager === "yarn") {
+    return { executable: "yarn", args: ["exec", binary, ...args] };
+  }
+  if (manager === "bun") {
+    return { executable: "bun", args: ["x", "--no-install", binary, ...args] };
+  }
+  return { executable: "pnpm", args: ["exec", binary, ...args] };
+}
+function scriptArgs(manager, name) {
+  if (manager === "bun") {
+    return { executable: "bun", args: ["run", name] };
+  }
+  if (manager === "npm") {
+    return { executable: "npm", args: ["run", name] };
+  }
+  return { executable: manager, args: [name] };
+}
+
+// src/build.ts
+async function checkBuild({
+  cwd,
+  packageManager,
+  signal
+}) {
+  signal?.throwIfAborted();
+  const manifest = JSON.parse(
+    await readFile7(path7.join(cwd, "package.json"), "utf8")
+  );
+  const invocation = manifest.dependencies?.["react-router"] ? execArgs(packageManager, "react-router", ["build"]) : manifest.scripts?.build ? scriptArgs(packageManager, "build") : void 0;
+  if (!invocation) {
+    return skipped(
+      "build",
+      "No react-router dependency or build script is defined in package.json."
+    );
+  }
+  const result = await command(
+    invocation.executable,
+    invocation.args,
+    cwd,
+    signal
+  );
+  signal?.throwIfAborted();
+  if (result.code === 0) {
+    return step("build", "passed");
+  }
+  return step("build", "failed", [
+    problem(
+      `The project build failed.
+${usefulTail(result.stdout, result.stderr)}`,
+      "Fix the reported build errors and run zappie check again.",
+      { rule: "build/failed" }
+    )
+  ]);
+}
+function usefulTail(stdout, stderr) {
+  const lines = `${stdout}
+${stderr}`.split(/\r?\n/).map((line) => line.trimEnd()).filter(Boolean).slice(-12);
+  return lines.length > 0 ? lines.join("\n") : "The build exited without output.";
+}
+
+// src/lint.ts
+import zappie from "eslint-plugin-zappie";
+import { createRequire } from "module";
+import path8 from "path";
+import { pathToFileURL as pathToFileURL2 } from "url";
+async function checkLint({
+  cwd,
+  signal
+}) {
+  signal?.throwIfAborted();
+  let ESLint;
+  try {
+    const require2 = createRequire(path8.join(cwd, "package.json"));
+    const loadedEslint = await import(pathToFileURL2(require2.resolve("eslint")).href);
+    ESLint = loadedEslint.ESLint;
+  } catch (error) {
+    return step("lint", "failed", [
+      problem(message2(error), "Install ESLint in the project.", {
+        rule: "lint/unavailable"
+      })
+    ]);
+  }
+  try {
+    const eslint = new ESLint({ cwd });
+    const source = await sourceFile(cwd);
+    const config = await eslint.calculateConfigForFile(source);
+    const problems = recommendedProblems(config?.rules ?? {});
+    if (problems.length > 0) {
+      return step("lint", "failed", problems);
+    }
+    const results = await eslint.lintFiles(["."]);
+    signal?.throwIfAborted();
+    const lintProblems = results.flatMap(
+      (result) => result.messages.map(
+        (entry) => problem(entry.message, null, {
+          ...entry.ruleId ? { rule: entry.ruleId } : {},
+          file: relative(cwd, result.filePath),
+          ...entry.line ? { line: entry.line } : {}
+        })
+      )
+    );
+    const failed = results.some(
+      (result) => result.messages.some((entry) => entry.fatal || entry.severity === 2)
+    );
+    return step("lint", failed ? "failed" : "passed", lintProblems);
+  } catch (error) {
+    return step("lint", "failed", [
+      problem(
+        message2(error),
+        "Fix the project ESLint configuration and run lint again.",
+        {
+          rule: "lint/config"
+        }
+      )
+    ]);
+  }
+}
+function recommendedProblems(applied) {
+  const expected = recommendedRules();
+  return Object.entries(expected).flatMap(([rule, severity]) => {
+    if (level(applied[rule]) >= level(severity)) {
+      return [];
+    }
+    return [
+      problem(
+        `${rule} is not enabled at the recommended severity.`,
+        "Apply every entry from zappie.configs.recommended in eslint.config.mjs.",
+        { rule, file: "eslint.config.mjs" }
+      )
+    ];
+  });
+}
+function recommendedRules() {
+  const result = {};
+  for (const config of zappie.configs.recommended ?? []) {
+    Object.assign(result, config.rules ?? {});
+  }
+  return Object.fromEntries(
+    Object.entries(result).filter(([name]) => name.startsWith("zappie/"))
+  );
+}
+function level(value) {
+  const selected = Array.isArray(value) ? value[0] : value;
+  if (selected === "error" || selected === 2) {
+    return 2;
+  }
+  if (selected === "warn" || selected === 1) {
+    return 1;
+  }
+  return 0;
+}
+async function sourceFile(cwd) {
+  const candidates = [
+    "app/index.ts",
+    "app/root.tsx",
+    "src/index.ts",
+    "index.ts"
+  ];
+  for (const candidate of candidates) {
+    try {
+      await import("fs/promises").then(
+        ({ access: access3 }) => access3(path8.join(cwd, candidate))
+      );
+      return candidate;
+    } catch {
+      continue;
+    }
+  }
+  return "eslint.config.mjs";
+}
+function message2(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
+// src/secrets.ts
+import { lstat, readFile as readFile8, readdir as readdir2 } from "fs/promises";
+import path9 from "path";
+
+// src/secret-patterns.ts
+var FIX = "Move the value to a server environment variable and rotate it.";
+function secretMatches(source, envFile) {
+  const matches2 = [];
+  add(matches2, source, /sk_(test|live)_[A-Za-z0-9]{16,}/g, (value) => {
+    const live = value.startsWith("sk_live_");
+    return {
+      rule: live ? "secrets/sk-live" : "secrets/sk-test",
+      message: `Detected ${live ? "sk_live_" : "sk_test_"}\u2026 secret.`,
+      fix: FIX,
+      severity: "error"
+    };
+  });
+  if (!envFile) {
+    add(matches2, source, /pk_live_[A-Za-z0-9]{16,}/g, () => ({
+      rule: "secrets/pk-live",
+      message: "Warning: detected pk_live_\u2026 outside an .env file.",
+      fix: "Move the publishable key to a server-provided environment variable.",
+      severity: "warning"
+    }));
+  }
+  add(matches2, source, /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY-----/g, () => ({
+    rule: "secrets/private-key",
+    message: "Detected a PEM private key header.",
+    fix: FIX,
+    severity: "error"
+  }));
+  add(matches2, source, /AKIA[0-9A-Z]{16}/g, () => ({
+    rule: "secrets/aws-access-key",
+    message: "Detected an AKIA\u2026 access key.",
+    fix: FIX,
+    severity: "error"
+  }));
+  add(matches2, source, /FLWSECK-[A-Za-z0-9_-]{8,}/g, () => ({
+    rule: "secrets/flutterwave-live",
+    message: "Detected an FLWSECK-\u2026 secret.",
+    fix: FIX,
+    severity: "error"
+  }));
+  const occupied = matches2.map(({ index }) => index);
+  const assignment = /\b([A-Za-z_$][\w$]*(?:secret|token|password|api[_-]?key)[\w$]*)\s*[:=]\s*(["'])([^"'\r\n]{24,})\2/gi;
+  for (const found of source.matchAll(assignment)) {
+    const value = found[3] ?? "";
+    const valueIndex = (found.index ?? 0) + found[0].indexOf(value);
+    if (entropy(value) > 4 && !occupied.some(
+      (index) => index >= valueIndex && index < valueIndex + value.length
+    )) {
+      matches2.push({
+        index: valueIndex,
+        rule: "secrets/high-entropy",
+        message: `Detected a high-entropy value assigned to ${found[1] ?? "a secret-shaped name"}.`,
+        fix: FIX,
+        severity: "error"
+      });
+    }
+  }
+  return matches2.sort((left, right) => left.index - right.index);
+}
+function add(output, source, pattern, details) {
+  for (const match of source.matchAll(pattern)) {
+    output.push({ index: match.index ?? 0, ...details(match[0]) });
+  }
+}
+function entropy(value) {
+  const counts = /* @__PURE__ */ new Map();
+  for (const character of value) {
+    counts.set(character, (counts.get(character) ?? 0) + 1);
+  }
+  return [...counts.values()].reduce((total2, count) => {
+    const probability = count / value.length;
+    return total2 - probability * Math.log2(probability);
+  }, 0);
+}
+
+// src/secrets.ts
+var SECRET_FILE_SIZE_CAP = 1024 * 1024;
+async function scanSecrets(dir) {
+  const findings = [];
+  for (const file of await filesToScan(dir)) {
+    const info = await lstat(file);
+    if (!info.isFile() || info.size > SECRET_FILE_SIZE_CAP) {
+      continue;
+    }
+    const contents = await readFile8(file);
+    if (contents.includes(0)) {
+      continue;
+    }
+    const source = contents.toString("utf8");
+    for (const match of secretMatches(
+      source,
+      path9.basename(file).startsWith(".env")
+    )) {
+      findings.push({
+        rule: match.rule,
+        file: relative(dir, file),
+        line: lineAt(source, match.index),
+        message: match.message,
+        fix: match.fix,
+        severity: match.severity
+      });
+    }
+  }
+  return findings;
+}
+async function checkSecrets({
+  cwd,
+  signal
+}) {
+  signal?.throwIfAborted();
+  const findings = await scanSecrets(cwd);
+  signal?.throwIfAborted();
+  const failed = findings.some(({ severity }) => severity === "error");
+  return step(
+    "secrets",
+    failed ? "failed" : "passed",
+    findings.map(({ severity: _severity, ...finding }) => finding)
+  );
+}
+async function filesToScan(cwd) {
+  const files = [];
+  for (const directory of ["app", "public"]) {
+    await collect2(path9.join(cwd, directory), files);
+  }
+  await collect2(
+    path9.join(cwd, "build/client"),
+    files,
+    (file) => file.endsWith(".js")
+  );
+  try {
+    for (const entry of await readdir2(cwd, { withFileTypes: true })) {
+      if (entry.isFile() && rootConfig(entry.name)) {
+        files.push(path9.join(cwd, entry.name));
+      }
+    }
+  } catch {
+    return files.sort();
+  }
+  return [...new Set(files)].sort();
+}
+async function collect2(directory, files, accept = () => true) {
+  try {
+    for (const entry of await readdir2(directory, { withFileTypes: true })) {
+      if (entry.isSymbolicLink()) {
+        continue;
+      }
+      const file = path9.join(directory, entry.name);
+      if (entry.isDirectory()) {
+        await collect2(file, files, accept);
+      } else if (entry.isFile() && accept(file)) {
+        files.push(file);
+      }
+    }
+  } catch (error) {
+    if (!(error instanceof Error && "code" in error && error.code === "ENOENT")) {
+      throw error;
+    }
+  }
+}
+function rootConfig(name) {
+  return name === "package.json" || name === "wrangler.json" || name === "wrangler.jsonc" || /(?:^|\.)config\.(?:[cm]?[jt]s|json)$/.test(name);
+}
+function lineAt(source, index) {
+  return source.slice(0, index).split(/\r?\n/).length;
+}
+
+// src/test-step.ts
+import path10 from "path";
+async function checkTests({
+  cwd,
+  packageManager,
+  signal
+}) {
+  const manifest = await json(path10.join(cwd, "package.json"));
+  if (!manifest.scripts?.test) {
+    return skipped("test", "No test script is defined in package.json.");
+  }
+  const invocation = scriptArgs(packageManager, "test");
+  const result = await command(
+    invocation.executable,
+    invocation.args,
+    cwd,
+    signal
+  );
+  signal?.throwIfAborted();
+  if (result.code === 0) {
+    return step("test", "passed");
+  }
+  return step("test", "failed", [
+    problem(result.stdout + result.stderr, "Fix the failing project tests.", {
+      rule: "test/failed"
+    })
+  ]);
+}
+
+// src/types-step.ts
+import path11 from "path";
+async function checkTypes(options) {
+  const { cwd, packageManager, signal } = options;
+  signal?.throwIfAborted();
+  const manifest = await json(path11.join(cwd, "package.json"));
+  if (manifest.dependencies?.["react-router"]) {
+    const generated = execArgs(packageManager, "react-router", ["typegen"]);
+    const result2 = await command(
+      generated.executable,
+      generated.args,
+      cwd,
+      signal
+    );
+    if (result2.code !== 0) {
+      return step(
+        "types",
+        "failed",
+        outputProblems(result2.stdout + result2.stderr)
+      );
+    }
+  }
+  const typed = execArgs(packageManager, "tsc", ["--noEmit"]);
+  const result = await command(typed.executable, typed.args, cwd, signal);
+  signal?.throwIfAborted();
+  if (result.code === 0) {
+    return step("types", "passed");
+  }
+  return step("types", "failed", outputProblems(result.stdout + result.stderr));
+}
+function outputProblems(output) {
+  const parsed = output.split(/\r?\n/).flatMap((line) => {
+    const match = /^(.*)\((\d+),(\d+)\): error (TS\d+): (.*)$/.exec(line);
+    if (!match) {
+      return [];
+    }
+    return [
+      problem(match[5] ?? line, "Fix the TypeScript error.", {
+        ...match[4] ? { rule: match[4] } : {},
+        ...match[1] ? { file: match[1] } : {},
+        line: Number(match[2])
+      })
+    ];
+  });
+  if (parsed.length > 0) {
+    return parsed;
+  }
+  return [
+    problem(
+      output.trim() || "TypeScript failed.",
+      "Fix the TypeScript errors."
+    )
+  ];
+}
+
+// src/run.ts
+var runners = [
+  { name: "config", run: checkConfig },
+  { name: "allowlist", run: checkAllowlist },
+  { name: "lint", run: checkLint },
+  { name: "types", run: checkTypes },
+  { name: "test", run: checkTests },
+  { name: "build", run: checkBuild },
+  { name: "secrets", run: checkSecrets },
+  { name: "budgets", run: checkBudgets }
+];
+async function runCheck(options) {
+  const steps = [];
+  for (const runner of runners) {
+    options.signal?.throwIfAborted();
+    let checked;
+    try {
+      checked = await runner.run(options);
+    } catch (error) {
+      options.signal?.throwIfAborted();
+      checked = step(runner.name, "failed", [
+        problem(
+          message3(error),
+          "Fix the step setup and run zappie check again."
+        )
+      ]);
+    }
+    steps.push(checked);
+    if (checked.result === "failed" && !options.all) {
+      break;
+    }
+  }
+  return {
+    result: steps.some((entry) => entry.result === "failed") ? "failed" : "passed",
+    steps
+  };
+}
+function message3(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+export {
+  BUILTIN_ALLOWLIST_SOURCE,
+  SECRET_FILE_SIZE_CAP,
+  checkAllowlist,
+  checkBudgets,
+  checkBuild,
+  checkConfig,
+  checkLint,
+  checkSecrets,
+  checkTests,
+  checkTypes,
+  loadConfig,
+  runCheck,
+  scanSecrets,
+  supportsTypeScriptImport
+};
+//# sourceMappingURL=index.js.map