@zappie/check 0.1.3 → 0.2.1

package/dist/index.js

@@ -42,7 +42,7 @@ function distance(left, right) {
   }
   return row[right.length] ?? Infinity;
 }
-function unknownKeys(value, allowed, path13, issue) {
+function unknownKeys(value, allowed, path15, issue) {
   for (const key of Object.keys(value)) {
     if (allowed.includes(key)) {
       continue;
@@ -50,7 +50,7 @@ function unknownKeys(value, allowed, path13, issue) {
     const closest = allowed.map((candidate) => ({ candidate, score: distance(key, candidate) })).sort((left, right) => left.score - right.score)[0];
     const hint = closest && closest.score <= 2 ? closest.candidate : void 0;
     issue({
-      path: path13 ? `${path13}.${key}` : key,
+      path: path15 ? `${path15}.${key}` : key,
       code: "unknown_key",
       message: hint ? `Unknown field "${key}". Rename it to "${hint}".` : `Unknown field "${key}". Remove it from the configuration.`,
       severity: "error"
@@ -76,20 +76,20 @@ function hostname(value) {
 }
 
 // ../sdk/src/site-config/sections.ts
-function nested(value, path13, keys, issue, validate) {
+function nested(value, path15, keys, issue, validate) {
   if (value === void 0) {
     return;
   }
   if (!record(value)) {
     issue({
-      path: path13,
+      path: path15,
       code: "invalid_type",
-      message: `Expected an object. Set ${path13} to an object or remove it.`,
+      message: `Expected an object. Set ${path15} to an object or remove it.`,
       severity: "error"
     });
     return;
   }
-  unknownKeys(value, keys, path13, issue);
+  unknownKeys(value, keys, path15, issue);
   validate(value);
 }
 function budgets(value, issue, error) {
@@ -126,18 +126,18 @@ function budgets(value, issue, error) {
             `Expected a positive finite number. Set budgets.${key} to a number greater than zero.`
           );
         } else if (amount > DEFAULT_BUDGETS[key]) {
-          const message5 = `The ${key} budget exceeds the ${DEFAULT_BUDGETS[key]} default.`;
+          const message6 = `The ${key} budget exceeds the ${DEFAULT_BUDGETS[key]} default.`;
           if (budget.override === void 0) {
             error(
               `budgets.${key}`,
               "budget_override",
-              `${message5} Add budgets.override.reason to explain the increase.`
+              `${message6} Add budgets.override.reason to explain the increase.`
             );
           } else {
             issue({
               path: `budgets.${key}`,
               code: "budget_override",
-              message: `${message5} Lower it to the default when the exception is no longer needed.`,
+              message: `${message6} Lower it to the default when the exception is no longer needed.`,
               severity: "warning"
             });
           }
@@ -181,6 +181,7 @@ var rootKeys = [
   "prerender",
   "menu",
   "packages",
+  "audit",
   "outbound",
   "budgets",
   "readiness",
@@ -189,7 +190,7 @@ var rootKeys = [
 function validateConfig(input) {
   const issues = [];
   const issue = (value) => issues.push(value);
-  const error = (path13, code, message5) => issue({ path: path13, code, message: message5, severity: "error" });
+  const error = (path15, code, message6) => issue({ path: path15, code, message: message6, severity: "error" });
   if (!record(input)) {
     return {
       valid: false,
@@ -284,12 +285,12 @@ function validateConfig(input) {
     issues
   };
 }
-function requiredSlug(value, path13, error) {
+function requiredSlug(value, path15, error) {
   if (!nonblank(value)) {
     error(
-      path13,
+      path15,
       value === void 0 ? "missing_required" : "invalid_type",
-      `Expected a non-empty storefront slug. Set ${path13} to the slug used by createZappie().`
+      `Expected a non-empty storefront slug. Set ${path15} to the slug used by createZappie().`
     );
   }
 }
@@ -308,29 +309,29 @@ function theme(value, error) {
     );
   }
 }
-function stringList(value, path13, error, options = {}) {
+function stringList(value, path15, error, options = {}) {
   if (value === void 0) {
     return void 0;
   }
   if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string")) {
     error(
-      path13,
+      path15,
       "invalid_type",
-      `Expected an array of strings. Set ${path13} to string values.`
+      `Expected an array of strings. Set ${path15} to string values.`
     );
     return void 0;
   }
   if (options.nonempty && value.length === 0) {
     error(
-      path13,
+      path15,
       "invalid_format",
-      `Expected at least one value. Add a value to ${path13} or remove the field.`
+      `Expected at least one value. Add a value to ${path15} or remove the field.`
     );
   }
   value.forEach((entry, index) => {
     if (options.slug && !nonblank(entry)) {
       error(
-        `${path13}[${index}]`,
+        `${path15}[${index}]`,
         "invalid_format",
         "Expected a non-empty branch slug. Remove the empty value or use a branch slug."
       );
@@ -338,17 +339,17 @@ function stringList(value, path13, error, options = {}) {
   });
   if (options.unique && new Set(value).size !== value.length) {
     error(
-      path13,
+      path15,
       "duplicate",
-      `Expected unique values. Remove duplicates from ${path13}.`
+      `Expected unique values. Remove duplicates from ${path15}.`
     );
   }
   return value;
 }
 function paths(value, error) {
   const values = stringList(value, "prerender", error, { unique: true });
-  values?.forEach((path13, index) => {
-    if (!path13.startsWith("/")) {
+  values?.forEach((path15, index) => {
+    if (!path15.startsWith("/")) {
       error(
         `prerender[${index}]`,
         "invalid_format",
@@ -851,11 +852,11 @@ var record2 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 var includes = (values, key) => values.includes(key);
 function validateTheme(input) {
   const issues = [];
-  const issue = (path13, code, message5, severity = "error") => issues.push({ path: path13, code, message: message5, severity });
-  const keys = (obj, allowed, path13) => {
+  const issue = (path15, code, message6, severity = "error") => issues.push({ path: path15, code, message: message6, severity });
+  const keys = (obj, allowed, path15) => {
     for (const key of Object.keys(obj)) {
       if (!allowed.includes(key)) {
-        issue(path13 ? `${path13}.${key}` : key, "invalid_theme", "Unknown field");
+        issue(path15 ? `${path15}.${key}` : key, "invalid_theme", "Unknown field");
       }
     }
   };
@@ -916,9 +917,9 @@ function validateTheme(input) {
       }
     }
     for (const [key, value] of Object.entries(values)) {
-      const path13 = `${group}.${key}`;
+      const path15 = `${group}.${key}`;
       if (!includes(TOKEN_NAMES, key)) {
-        issue(path13, "unknown_token", "Unknown semantic token");
+        issue(path15, "unknown_token", "Unknown semantic token");
         continue;
       }
       let code, valid = false;
@@ -936,7 +937,7 @@ function validateTheme(input) {
         valid = typeof value === "string" && safeValue(value) && (includes(DURATION_TOKENS, key) ? isDuration(value) : isEasing(value));
       }
       if (!valid) {
-        issue(path13, code, "Invalid or unsafe token value");
+        issue(path15, code, "Invalid or unsafe token value");
       }
     }
   }
@@ -946,30 +947,30 @@ function validateTheme(input) {
     } else {
       const roles = /* @__PURE__ */ new Set();
       input.fonts.forEach((font, i) => {
-        const path13 = `fonts[${i}]`;
+        const path15 = `fonts[${i}]`;
         if (!record2(font)) {
-          issue(path13, "invalid_font", "Expected a font object");
+          issue(path15, "invalid_font", "Expected a font object");
           return;
         }
-        keys(font, ["family", "source", "url", "weights", "role"], path13);
+        keys(font, ["family", "source", "url", "weights", "role"], path15);
         if (typeof font.family !== "string" || !isFontFamily(font.family) || font.family.includes(",")) {
           issue(
-            `${path13}.family`,
+            `${path15}.family`,
             "invalid_font",
             "Expected one unquoted font family"
           );
         }
         if (typeof font.source !== "string" || !["google", "self", "system"].includes(font.source)) {
-          issue(`${path13}.source`, "invalid_font", "Unknown font source");
+          issue(`${path15}.source`, "invalid_font", "Unknown font source");
         }
         if (typeof font.role !== "string" || !["display", "body", "mono"].includes(font.role) || roles.has(font.role)) {
-          issue(`${path13}.role`, "invalid_font", "Expected a unique font role");
+          issue(`${path15}.role`, "invalid_font", "Expected a unique font role");
         }
         roles.add(String(font.role));
         if (font.source === "self" || font.url !== void 0) {
           if (typeof font.url !== "string" || !isAssetUrl(font.url, false) || !new URL(font.url).pathname.endsWith(".woff2")) {
             issue(
-              `${path13}.url`,
+              `${path15}.url`,
               "invalid_font",
               "Expected an HTTPS .woff2 URL"
             );
@@ -979,7 +980,7 @@ function validateTheme(input) {
           (w) => typeof w !== "number" || !Number.isInteger(w) || w < 1 || w > 1e3
         ))) {
           issue(
-            `${path13}.weights`,
+            `${path15}.weights`,
             "invalid_font",
             "Expected 1\u20139 integer weights between 1 and 1000"
           );
@@ -1089,13 +1090,13 @@ function escape(value) {
 }
 
 // src/result.ts
-function problem(message5, fix, details = {}) {
-  return { ...details, message: message5, fix };
+function problem(message6, fix, details = {}) {
+  return { ...details, message: message6, fix };
 }
 function step(name, result, problems = []) {
   return { name, result, problems };
 }
-var skipped = (name, message5) => step(name, "skipped", [problem(message5, null)]);
+var skipped = (name, message6) => step(name, "skipped", [problem(message6, null)]);
 
 // src/config.ts
 function supportsTypeScriptImport(version = process.versions.node) {
@@ -1318,22 +1319,500 @@ async function installedManifest(cwd, name) {
   }
 }
 
+// src/audit.ts
+import { access as access2, readFile as readFile4 } from "fs/promises";
+import path4 from "path";
+
+// src/command.ts
+import { spawn } from "child_process";
+function command(executable, args, cwd, signal) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(executable, args, {
+      cwd,
+      env: { ...process.env, NO_COLOR: "1", FORCE_COLOR: "0" },
+      stdio: ["ignore", "pipe", "pipe"],
+      ...signal ? { signal } : {}
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.on("data", (value) => {
+      stdout += String(value);
+    });
+    child.stderr.on("data", (value) => {
+      stderr += String(value);
+    });
+    child.on("error", reject);
+    child.on("close", (code) => {
+      resolve({ code: code ?? 1, stdout, stderr });
+    });
+  });
+}
+function execArgs(manager, binary, args) {
+  if (manager === "npm") {
+    return { executable: "npm", args: ["exec", "--no", "--", binary, ...args] };
+  }
+  if (manager === "yarn") {
+    return { executable: "yarn", args: ["exec", binary, ...args] };
+  }
+  if (manager === "bun") {
+    return { executable: "bun", args: ["x", "--no-install", binary, ...args] };
+  }
+  return { executable: "pnpm", args: ["exec", binary, ...args] };
+}
+function scriptArgs(manager, name) {
+  if (manager === "bun") {
+    return { executable: "bun", args: ["run", name] };
+  }
+  if (manager === "npm") {
+    return { executable: "npm", args: ["run", name] };
+  }
+  return { executable: manager, args: [name] };
+}
+
+// src/audit.ts
+var AUDIT_TIMEOUT_MS = 6e4;
+async function checkAudit(options, dependencies = {}) {
+  const mode = options.audit ?? "report";
+  if (mode === "off") {
+    return skipped("audit", "Dependency auditing is off.");
+  }
+  options.signal?.throwIfAborted();
+  let invalidIgnores = [];
+  let ignores = [];
+  try {
+    const parsed = await auditIgnores(options.cwd);
+    ignores = parsed.ignores;
+    invalidIgnores = parsed.problems;
+  } catch (error) {
+    invalidIgnores.push(
+      problem(
+        `Could not use audit.ignore: ${message2(error)}`,
+        "Fix or remove the invalid acknowledgement. The advisory remains unacknowledged.",
+        { rule: "audit/invalid-ignore", file: "zappie.config.ts", line: 1 }
+      )
+    );
+  }
+  if (options.packageManager === "yarn" || options.packageManager === "bun") {
+    return withProblems(
+      unavailable(
+        mode,
+        `Could not audit dependencies: ${options.packageManager} is not supported.`,
+        "Use npm or pnpm for dependency auditing, or run with --audit=off.",
+        "package.json"
+      ),
+      invalidIgnores,
+      mode
+    );
+  }
+  const lockfile2 = await findLockfile(options.cwd, options.packageManager);
+  if (!lockfile2) {
+    return withProblems(
+      unavailable(
+        mode,
+        "Could not audit dependencies: no lockfile was found.",
+        "Commit the package manager lockfile and run zappie check again.",
+        "package.json"
+      ),
+      invalidIgnores,
+      mode
+    );
+  }
+  const invocation = auditCommand(options.packageManager);
+  const timeoutMs = dependencies.timeoutMs ?? AUDIT_TIMEOUT_MS;
+  const timeout = AbortSignal.timeout(timeoutMs);
+  const signal = options.signal ? AbortSignal.any([options.signal, timeout]) : timeout;
+  let result;
+  try {
+    result = await (dependencies.run ?? command)(
+      invocation.executable,
+      invocation.args,
+      options.cwd,
+      signal
+    );
+  } catch (error) {
+    options.signal?.throwIfAborted();
+    const detail = timeout.aborted ? `the audit timed out after ${Math.ceil(timeoutMs / 1e3)} seconds` : message2(error);
+    return withProblems(
+      unavailable(
+        mode,
+        `Could not audit dependencies: ${detail}.`,
+        "Check registry access and run zappie check again.",
+        relativeLockfile(options.cwd, lockfile2)
+      ),
+      invalidIgnores,
+      mode
+    );
+  }
+  options.signal?.throwIfAborted();
+  let advisories;
+  try {
+    advisories = parseAuditOutput(options.packageManager, result.stdout);
+    if (result.code > 1) {
+      throw new Error(`the audit command exited with status ${result.code}`);
+    }
+  } catch (error) {
+    return withProblems(
+      unavailable(
+        mode,
+        `Could not audit dependencies: ${message2(error)}.`,
+        "Check registry access and run zappie check again.",
+        relativeLockfile(options.cwd, lockfile2)
+      ),
+      invalidIgnores,
+      mode
+    );
+  }
+  return withProblems(
+    evaluateAudit(
+      advisories,
+      mode,
+      ignores,
+      relativeLockfile(options.cwd, lockfile2)
+    ),
+    invalidIgnores,
+    mode
+  );
+}
+function evaluateAudit(advisories, mode, ignores = [], file) {
+  const problems = [];
+  const applied = advisories.map((advisory) => {
+    const acknowledged = ignores.find(
+      ({ id }) => normalizedId(id) === normalizedId(advisory.id)
+    );
+    if (acknowledged && malicious(advisory.id)) {
+      problems.push(
+        problem(
+          `${advisory.id} is a malicious-package advisory and cannot be acknowledged.`,
+          `Remove ${advisory.package} and replace it with a trusted package or release.`,
+          {
+            rule: "audit/invalid-ignore",
+            advisory,
+            ...file ? { file, line: 1 } : {}
+          }
+        )
+      );
+      return advisory;
+    }
+    if (acknowledged && (advisory.fixedVersion || advisory.upgradeVersion || advisory.fixCommand)) {
+      const upgradePackage = advisory.upgradePackage ?? advisory.package;
+      const upgradeVersion = advisory.upgradeVersion ?? advisory.fixedVersion;
+      const fix = advisory.fixCommand ? `Run ${advisory.fixCommand}.` : `Upgrade ${upgradePackage} to ${upgradeVersion} or later.`;
+      const reason = advisory.fixCommand ? `${advisory.id} has an available fix and cannot be acknowledged.` : `${advisory.id} has a fixed version and cannot be acknowledged.`;
+      problems.push(
+        problem(reason, fix, {
+          rule: "audit/invalid-ignore",
+          advisory,
+          ...file ? { file, line: 1 } : {}
+        })
+      );
+      return advisory;
+    }
+    return acknowledged ? { ...advisory, ignored: true, ignoredUntil: acknowledged.until } : advisory;
+  });
+  problems.push(...applied.map((advisory) => advisoryProblem(advisory, file)));
+  const critical = applied.some(
+    ({ severity, ignored }) => severity === "critical" && !ignored
+  );
+  const invalidIgnore2 = problems.some(
+    ({ rule }) => rule === "audit/invalid-ignore"
+  );
+  return step(
+    "audit",
+    mode === "enforce" && (critical || invalidIgnore2) ? "failed" : "passed",
+    problems
+  );
+}
+function unavailable(mode, message6, fix, file) {
+  return step("audit", mode === "enforce" ? "failed" : "passed", [
+    problem(message6, fix, { rule: "audit/unavailable", file, line: 1 })
+  ]);
+}
+function withProblems(checked, extra, mode) {
+  if (extra.length === 0) {
+    return checked;
+  }
+  return step("audit", mode === "enforce" ? "failed" : checked.result, [
+    ...extra,
+    ...checked.problems
+  ]);
+}
+async function findLockfile(cwd, manager) {
+  const names = manager === "npm" ? ["package-lock.json", "npm-shrinkwrap.json"] : ["pnpm-lock.yaml"];
+  let directory = path4.resolve(cwd);
+  for (; ; ) {
+    if (directory !== path4.resolve(cwd) && manager === "pnpm" && await workspaceExcludes(directory, path4.resolve(cwd))) {
+      return null;
+    }
+    for (const name of names) {
+      const candidate = path4.join(directory, name);
+      try {
+        await access2(candidate);
+        return candidate;
+      } catch {
+      }
+    }
+    const parent = path4.dirname(directory);
+    if (parent === directory) {
+      return null;
+    }
+    directory = parent;
+  }
+}
+async function workspaceExcludes(directory, cwd) {
+  try {
+    const source = await readFile4(
+      path4.join(directory, "pnpm-workspace.yaml"),
+      "utf8"
+    );
+    const block = /^packages:\s*\n((?:[ \t]+.*(?:\n|$))*)/m.exec(source)?.[1];
+    if (!block) {
+      return false;
+    }
+    const relative2 = path4.relative(directory, cwd).replaceAll(path4.sep, "/");
+    const patterns = [
+      ...block.matchAll(/^\s*-\s*["']?([^"'\s]+)["']?\s*$/gm)
+    ].map((match) => match[1] ?? "");
+    return !patterns.some((pattern) => workspacePattern(pattern, relative2));
+  } catch {
+    return false;
+  }
+}
+function workspacePattern(pattern, relative2) {
+  if (pattern === ".") {
+    return relative2 === "";
+  }
+  const expression = pattern.split("*").map((part) => part.replace(/[.*+?^$()|[\]\\]/g, "\\$&")).join("[^/]+");
+  return new RegExp(`^${expression}$`).test(relative2);
+}
+function relativeLockfile(cwd, lockfile2) {
+  return path4.relative(cwd, lockfile2).replaceAll(path4.sep, "/");
+}
+function auditCommand(manager) {
+  return manager === "pnpm" ? { executable: "pnpm", args: ["audit", "--json"] } : { executable: "npm", args: ["audit", "--json"] };
+}
+function parseAuditOutput(manager, source) {
+  const value = JSON.parse(source);
+  requireAuditReport(manager, value);
+  const parsed = manager === "npm" ? npmAdvisories(value) : pnpmAdvisories(value);
+  return parsed.filter(({ severity }) => severity === "high" || severity === "critical").sort((left, right) => left.id.localeCompare(right.id));
+}
+function requireAuditReport(manager, value) {
+  if (record3(value.error)) {
+    throw new Error(
+      string(value.error.message) ?? string(value.error.code) ?? string(value.message) ?? "the package manager returned an error"
+    );
+  }
+  if (manager === "npm" && !record3(value.vulnerabilities)) {
+    throw new Error("npm returned no vulnerability report");
+  }
+  if (manager === "pnpm" && !record3(value.advisories) && !record3(value.metadata)) {
+    throw new Error("pnpm returned no advisory report");
+  }
+}
+function pnpmAdvisories(value) {
+  if (!record3(value.advisories)) {
+    return [];
+  }
+  return Object.entries(value.advisories).flatMap(([key, raw]) => {
+    if (!record3(raw)) {
+      return [];
+    }
+    const findings = Array.isArray(raw.findings) ? raw.findings : [];
+    const versions = findings.flatMap(
+      (finding) => record3(finding) && typeof finding.version === "string" ? [finding.version] : []
+    );
+    const severity = normalizedSeverity(raw.severity);
+    if (!severity) {
+      return [];
+    }
+    return [
+      {
+        id: string(raw.github_advisory_id) ?? string(raw.id) ?? key,
+        package: string(raw.module_name) ?? "unknown package",
+        severity,
+        vulnerableVersion: versions.join(", ") || string(raw.vulnerable_versions) || "unknown",
+        fixedVersion: firstFixed(string(raw.patched_versions)),
+        ignored: false
+      }
+    ];
+  });
+}
+function npmAdvisories(value) {
+  if (!record3(value.vulnerabilities)) {
+    return [];
+  }
+  const advisories = /* @__PURE__ */ new Map();
+  for (const [packageName2, raw] of Object.entries(value.vulnerabilities)) {
+    if (!record3(raw) || !Array.isArray(raw.via)) {
+      continue;
+    }
+    for (const via of raw.via) {
+      if (!record3(via)) {
+        continue;
+      }
+      const severity = normalizedSeverity(via.severity);
+      if (!severity) {
+        continue;
+      }
+      const id = ghsaFrom(string(via.url)) ?? string(via.name) ?? String(via.source ?? packageName2);
+      const upgrade = npmUpgrade(raw.fixAvailable);
+      advisories.set(id, {
+        id,
+        package: packageName2,
+        severity,
+        vulnerableVersion: string(via.range) ?? string(raw.range) ?? "unknown",
+        fixedVersion: upgrade.upgradePackage === packageName2 ? upgrade.upgradeVersion ?? null : null,
+        ...upgrade,
+        ignored: false
+      });
+    }
+  }
+  return [...advisories.values()];
+}
+function advisoryProblem(advisory, file) {
+  const acknowledged = advisory.ignored ? ` Acknowledged until ${advisory.ignoredUntil}.` : "";
+  const upgradePackage = advisory.upgradePackage ?? advisory.package;
+  const upgradeVersion = advisory.upgradeVersion ?? advisory.fixedVersion;
+  const fix = malicious(advisory.id) ? `Remove ${advisory.package} and replace it with a trusted package or release.` : advisory.fixCommand ? `Run ${advisory.fixCommand}.` : upgradeVersion ? `Upgrade ${upgradePackage} to ${upgradeVersion} or later.` : `Review ${advisory.id}. If no fix exists, add a reason and an expiry of at most 90 days to audit.ignore.`;
+  return problem(
+    `${advisory.id}: ${advisory.package} ${advisory.vulnerableVersion} has ${advisory.severity} severity.${acknowledged}`,
+    fix,
+    {
+      rule: `audit/${advisory.id}`,
+      advisory,
+      ...file ? { file, line: 1 } : {}
+    }
+  );
+}
+async function auditIgnores(cwd) {
+  let loaded;
+  try {
+    loaded = await loadConfig(cwd);
+  } catch (error) {
+    if (missing(error)) {
+      return { ignores: [], problems: [] };
+    }
+    throw error;
+  }
+  if (!record3(loaded.value) || !record3(loaded.value.audit)) {
+    return { ignores: [], problems: [] };
+  }
+  const problems = [];
+  const ignores = parseAuditIgnores(loaded.value.audit.ignore, problems);
+  return { ignores, problems };
+}
+function parseAuditIgnores(value, problems = []) {
+  if (value === void 0) {
+    return [];
+  }
+  if (!Array.isArray(value)) {
+    problems.push(invalidIgnore("audit.ignore must be an array."));
+    return [];
+  }
+  const today = Date.parse(
+    `${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}T00:00:00.000Z`
+  );
+  const ninetyDays = 90 * 24 * 60 * 60 * 1e3;
+  const ids = /* @__PURE__ */ new Set();
+  const ignores = [];
+  value.forEach((entry, index) => {
+    if (!ignoreEntry(entry) || !entry.id.trim() || !entry.reason.trim()) {
+      problems.push(
+        invalidIgnore(
+          `audit.ignore[${index}] must have a non-blank id, reason and until.`
+        )
+      );
+      return;
+    }
+    const id = normalizedId(entry.id);
+    if (ids.has(id)) {
+      problems.push(
+        invalidIgnore(`audit.ignore contains duplicate id ${entry.id}.`)
+      );
+      return;
+    }
+    const expiry = Date.parse(`${entry.until}T00:00:00.000Z`);
+    if (!/^\d{4}-\d{2}-\d{2}$/.test(entry.until) || !Number.isFinite(expiry) || new Date(expiry).toISOString().slice(0, 10) !== entry.until || expiry < today || expiry - today > ninetyDays) {
+      problems.push(
+        invalidIgnore(
+          `audit.ignore[${index}].until must be a real, unexpired date at most 90 days away.`
+        )
+      );
+      return;
+    }
+    ids.add(id);
+    ignores.push(entry);
+  });
+  return ignores;
+}
+function invalidIgnore(message6) {
+  return problem(
+    message6,
+    "Fix or remove the invalid acknowledgement. The advisory remains unacknowledged.",
+    { rule: "audit/invalid-ignore", file: "zappie.config.ts", line: 1 }
+  );
+}
+function ignoreEntry(value) {
+  return record3(value) && typeof value.id === "string" && typeof value.reason === "string" && typeof value.until === "string";
+}
+function npmUpgrade(value) {
+  if (record3(value) && typeof value.name === "string" && typeof value.version === "string") {
+    return { upgradePackage: value.name, upgradeVersion: value.version };
+  }
+  if (value === true) {
+    return { fixCommand: "npm audit fix" };
+  }
+  return {};
+}
+function firstFixed(value) {
+  if (!value || value === "<0.0.0") {
+    return null;
+  }
+  return /(?:^|\s)>=?\s*([^\s|]+)/.exec(value)?.[1] ?? null;
+}
+function ghsaFrom(value) {
+  const id = value ? /GHSA-[\w-]+/i.exec(value)?.[0] : void 0;
+  return id ? `GHSA-${id.slice(5).toLowerCase()}` : void 0;
+}
+function normalizedId(value) {
+  return value.trim().toLowerCase();
+}
+function malicious(value) {
+  return /^MAL-/i.test(value.trim());
+}
+function normalizedSeverity(value) {
+  const severity = typeof value === "string" ? value.toLowerCase() : "";
+  return severity === "high" || severity === "critical" ? severity : void 0;
+}
+function string(value) {
+  return typeof value === "string" ? value : void 0;
+}
+function message2(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function missing(error) {
+  return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
+function record3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
 // src/budgets.ts
-import { access as access2, readFile as readFile6 } from "fs/promises";
-import path6 from "path";
+import { access as access3, readFile as readFile7 } from "fs/promises";
+import path7 from "path";
 
 // src/budget-files.ts
-import { readFile as readFile4, readdir } from "fs/promises";
-import path4 from "path";
+import { readFile as readFile5, readdir } from "fs/promises";
+import path5 from "path";
 import { gzipSync } from "zlib";
 async function cssSizes(cwd) {
-  const root = path4.join(cwd, "build/client");
+  const root = path5.join(cwd, "build/client");
   const files = [];
   await collect(root, files);
   return Promise.all(
     files.filter((file) => file.endsWith(".css")).map(async (file) => ({
-      file: path4.relative(root, file).split(path4.sep).join("/"),
-      bytes: gzipSync(await readFile4(file, "utf8")).byteLength
+      file: path5.relative(root, file).split(path5.sep).join("/"),
+      bytes: gzipSync(await readFile5(file, "utf8")).byteLength
     }))
   );
 }
@@ -1342,7 +1821,7 @@ async function collect(directory, files) {
     if (entry.isSymbolicLink()) {
       continue;
     }
-    const file = path4.join(directory, entry.name);
+    const file = path5.join(directory, entry.name);
     if (entry.isDirectory()) {
       await collect(file, files);
     } else if (entry.isFile()) {
@@ -1352,8 +1831,8 @@ async function collect(directory, files) {
 }
 
 // src/budget-manifest.ts
-import { readFile as readFile5 } from "fs/promises";
-import path5 from "path";
+import { readFile as readFile6 } from "fs/promises";
+import path6 from "path";
 import { gzipSync as gzipSync2 } from "zlib";
 function routeKeys(manifest) {
   return Object.entries(manifest).filter(([key, entry]) => routeSource(entry.src ?? key)).map(([key]) => key).sort();
@@ -1367,7 +1846,7 @@ async function graphSizes(cwd, manifest, roots) {
     [...keys].map((key) => manifest[key]).filter((entry) => Boolean(entry)).filter(({ file }) => file.endsWith(".js")).map(async ({ file }) => ({
       file,
       bytes: gzipSync2(
-        await readFile5(path5.join(cwd, "build/client", file), "utf8")
+        await readFile6(path6.join(cwd, "build/client", file), "utf8")
       ).byteLength
     }))
   );
@@ -1401,16 +1880,16 @@ async function checkBudgets({
   signal
 }) {
   signal?.throwIfAborted();
-  const manifestFile = path6.join(cwd, "build/client/.vite/manifest.json");
+  const manifestFile = path7.join(cwd, "build/client/.vite/manifest.json");
   try {
-    await access2(manifestFile);
+    await access3(manifestFile);
   } catch {
     return skipped(
       "budgets",
       "No build/client/.vite/manifest.json is available."
     );
   }
-  const manifest = JSON.parse(await readFile6(manifestFile, "utf8"));
+  const manifest = JSON.parse(await readFile7(manifestFile, "utf8"));
   const config = (await loadConfig(cwd)).value;
   const limits = { ...DEFAULT_BUDGETS, ...config.budgets };
   const routes = routeKeys(manifest);
@@ -1442,124 +1921,850 @@ async function checkBudgets({
   signal?.throwIfAborted();
   return step("budgets", failed ? "failed" : "passed", problems);
 }
-function routeProblem(route, sizes, limitKb, over) {
-  const bytes = total(sizes);
-  const largest = [...sizes].sort((left, right) => right.bytes - left.bytes).slice(0, 3).map(({ file, bytes: size }) => `${file} (${size} B)`).join(", ");
-  return problem(
-    `${route}: ${bytes} B gzip (limit ${limitKb * KIB} B).${over ? ` Largest chunks: ${largest}.` : ""}`,
-    over ? "Reduce the route's client JavaScript or raise the reviewed budget override." : null,
-    {
-      rule: over ? "budgets/js-over" : "budgets/js-route",
-      file: "build/client/.vite/manifest.json"
+function routeProblem(route, sizes, limitKb, over) {
+  const bytes = total(sizes);
+  const largest = [...sizes].sort((left, right) => right.bytes - left.bytes).slice(0, 3).map(({ file, bytes: size }) => `${file} (${size} B)`).join(", ");
+  return problem(
+    `${route}: ${bytes} B gzip (limit ${limitKb * KIB} B).${over ? ` Largest chunks: ${largest}.` : ""}`,
+    over ? "Reduce the route's client JavaScript or raise the reviewed budget override." : null,
+    {
+      rule: over ? "budgets/js-over" : "budgets/js-route",
+      file: "build/client/.vite/manifest.json"
+    }
+  );
+}
+function cssProblem(sizes, limitKb, over) {
+  const bytes = total(sizes);
+  return problem(
+    `Client CSS: ${bytes} B gzip (limit ${limitKb * KIB} B).`,
+    over ? "Reduce client CSS or raise the reviewed budget override." : null,
+    { rule: over ? "budgets/css-over" : "budgets/css" }
+  );
+}
+var total = (sizes) => sizes.reduce((sum, asset) => sum + asset.bytes, 0);
+
+// src/build.ts
+import { readFile as readFile8 } from "fs/promises";
+import path8 from "path";
+async function checkBuild({
+  cwd,
+  packageManager,
+  signal
+}) {
+  signal?.throwIfAborted();
+  const manifest = JSON.parse(
+    await readFile8(path8.join(cwd, "package.json"), "utf8")
+  );
+  const invocation = manifest.dependencies?.["react-router"] ? execArgs(packageManager, "react-router", ["build"]) : manifest.scripts?.build ? scriptArgs(packageManager, "build") : void 0;
+  if (!invocation) {
+    return skipped(
+      "build",
+      "No react-router dependency or build script is defined in package.json."
+    );
+  }
+  const result = await command(
+    invocation.executable,
+    invocation.args,
+    cwd,
+    signal
+  );
+  signal?.throwIfAborted();
+  if (result.code === 0) {
+    return step("build", "passed");
+  }
+  return step("build", "failed", [
+    problem(
+      `The project build failed.
+${usefulTail(result.stdout, result.stderr)}`,
+      "Fix the reported build errors and run zappie check again.",
+      { rule: "build/failed" }
+    )
+  ]);
+}
+function usefulTail(stdout, stderr) {
+  const lines = `${stdout}
+${stderr}`.split(/\r?\n/).map((line) => line.trimEnd()).filter(Boolean).slice(-12);
+  return lines.length > 0 ? lines.join("\n") : "The build exited without output.";
+}
+
+// src/css-files.ts
+import { lstat, readFile as readFile9, readdir as readdir2 } from "fs/promises";
+import path9 from "path";
+var FILE_SIZE_CAP = 1024 * 1024;
+var BUILD_FILE_SIZE_CAP = 8 * 1024 * 1024;
+var ignoredDirectories = /* @__PURE__ */ new Set([
+  "node_modules",
+  "build",
+  "dist",
+  "coverage",
+  "public",
+  "vendor",
+  "test",
+  "tests",
+  "e2e",
+  "test-results",
+  "playwright-report"
+]);
+var codeExtension = /\.(?:[cm]?[jt]sx?|html|mdx)$/;
+var testFile = /\.(?:test|spec)\.[^.]+$/;
+async function readCssInputs(cwd) {
+  const source = [];
+  await collect2(cwd, source, (name) => {
+    return !name.startsWith(".") && !ignoredDirectories.has(name);
+  });
+  const built = [];
+  await collect2(path9.join(cwd, "build/client"), built, () => true);
+  const read = (files, cap) => texts(cwd, files, cap);
+  return {
+    sourceCss: await read(
+      source.filter((file) => file.endsWith(".css")),
+      FILE_SIZE_CAP
+    ),
+    sourceCode: await read(
+      source.filter(
+        (file) => codeExtension.test(file) && !testFile.test(file) && !/(?:^|[/\\])[^/\\]+\.config\.[^.]+$/.test(file)
+      ),
+      FILE_SIZE_CAP
+    ),
+    builtCss: await read(
+      built.filter((file) => file.endsWith(".css")),
+      BUILD_FILE_SIZE_CAP
+    ),
+    builtCode: await read(
+      built.filter((file) => file.endsWith(".js")),
+      BUILD_FILE_SIZE_CAP
+    )
+  };
+}
+async function texts(cwd, files, cap) {
+  const result = [];
+  for (const file of files.sort()) {
+    const info = await lstat(file);
+    if (!info.isFile() || info.size > cap) {
+      continue;
+    }
+    result.push({
+      file: relative(cwd, file),
+      text: await readFile9(file, "utf8")
+    });
+  }
+  return result;
+}
+async function collect2(directory, files, enter) {
+  let entries;
+  try {
+    entries = await readdir2(directory, { withFileTypes: true });
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+      return;
+    }
+    throw error;
+  }
+  for (const entry of entries) {
+    if (entry.isSymbolicLink()) {
+      continue;
+    }
+    const file = path9.join(directory, entry.name);
+    if (entry.isDirectory()) {
+      if (enter(entry.name)) {
+        await collect2(file, files, enter);
+      }
+    } else if (entry.isFile()) {
+      files.push(file);
+    }
+  }
+}
+
+// src/css-rules.ts
+import postcss from "postcss";
+var CSS_ERRORS = /* @__PURE__ */ new Set([
+  "css/important",
+  "css/class-patch"
+]);
+function analyseCss(inputs) {
+  const source = parseAll(inputs.sourceCss);
+  const built = parseAll(inputs.builtCss);
+  return [
+    ...source.problems,
+    ...built.problems,
+    ...important(source.parsed, inputs.sourceCode),
+    ...duplicateKeyframes(source.parsed, built.parsed),
+    ...duplicateSelectors(source.parsed),
+    ...arbitraryTokens(source.parsed, inputs.sourceCode),
+    ...unusedCustomProperties(source.parsed, built.parsed, inputs),
+    ...reducedMotion(source.parsed),
+    ...classPatches(source.parsed),
+    ...literalTokens(source.parsed)
+  ];
+}
+function parseAll(files) {
+  const parsed = [];
+  const problems = [];
+  for (const entry of files) {
+    try {
+      parsed.push({
+        ...entry,
+        root: postcss.parse(entry.text, { from: entry.file }),
+        lines: entry.text.split(/\r?\n/)
+      });
+    } catch (error) {
+      const line = error && typeof error === "object" && "line" in error ? Number(error.line) : void 0;
+      problems.push(
+        problem(
+          `${entry.file} could not be read as CSS: ${error instanceof Error ? error.message : String(error)}`,
+          "Fix the CSS syntax so zappie check can read the file.",
+          {
+            rule: "css/unreadable",
+            file: entry.file,
+            ...line && line > 0 ? { line } : {}
+          }
+        )
+      );
+    }
+  }
+  return { parsed, problems };
+}
+var allowImportant = /zappie-allow-important:\s*\S/;
+function important(css, code) {
+  const problems = [];
+  const allowed = (lines, line) => line !== void 0 && allowImportant.test(lines[line - 1] ?? "");
+  for (const entry of css) {
+    entry.root.walkDecls((decl) => {
+      const line = decl.source?.start?.line;
+      if (decl.important && !allowed(entry.lines, line) && !insideMedia(decl.parent, "reduce")) {
+        problems.push(
+          importantProblem(
+            `${decl.prop} is marked !important.`,
+            entry.file,
+            line
+          )
+        );
+      }
+    });
+    entry.root.walkAtRules("apply", (rule) => {
+      const line = rule.source?.start?.line;
+      const flagged = rule.params.split(/\s+/).filter((token) => importantUtility(token));
+      if ((flagged.length > 0 || /!important\b/.test(rule.params)) && !allowed(entry.lines, line)) {
+        problems.push(
+          importantProblem(
+            `@apply ${rule.params} forces !important.`,
+            entry.file,
+            line
+          )
+        );
+      }
+    });
+  }
+  for (const entry of code) {
+    const lines = entry.text.split(/\r?\n/);
+    lines.forEach((text, index) => {
+      if (allowImportant.test(text)) {
+        return;
+      }
+      for (const list of classLists(text)) {
+        for (const token of list.split(/\s+/)) {
+          if (importantUtility(token)) {
+            problems.push(
+              importantProblem(
+                `The utility ${token} forces !important.`,
+                entry.file,
+                index + 1
+              )
+            );
+          }
+        }
+      }
+    });
+  }
+  return problems;
+}
+function importantProblem(message6, file, line) {
+  return problem(
+    message6,
+    "Raise the selector's specificity or reorder the rules instead. For a reviewed case, add /* zappie-allow-important: <reason> */ on the same line.",
+    { rule: "css/important", file, ...line ? { line } : {} }
+  );
+}
+var utilityToken = /^!?-?[a-z0-9@[\]_\-:/.%()#,'=&>*~+!]*[a-z0-9\])%]!?$/;
+function importantUtility(token) {
+  const utility = withoutVariants(token).utility;
+  if (utility.length < 3) {
+    return false;
+  }
+  if (/^!-?[a-z[]/.test(utility)) {
+    return true;
+  }
+  return /[a-z0-9\])%]!$/.test(utility) && /[-[]/.test(utility);
+}
+function classLists(line) {
+  const lists = [];
+  for (const match of line.matchAll(/(["'`])([^"'`]*?)\1/g)) {
+    const value = match[2]?.trim() ?? "";
+    if (!value) {
+      continue;
+    }
+    const tokens = value.split(/\s+/);
+    if (tokens.every((token) => utilityToken.test(token)) && tokens.some((token) => token.includes("-"))) {
+      lists.push(value);
+    }
+  }
+  return lists;
+}
+function withoutVariants(token) {
+  let depth = 0;
+  let cut = 0;
+  for (let index = 0; index < token.length; index++) {
+    const character = token[index];
+    if (character === "[" || character === "(") {
+      depth++;
+    } else if (character === "]" || character === ")") {
+      depth--;
+    } else if (character === ":" && depth === 0) {
+      cut = index + 1;
+    }
+  }
+  return { variants: token.slice(0, cut), utility: token.slice(cut) };
+}
+function keyframesIn(files) {
+  const found = [];
+  for (const entry of files) {
+    entry.root.walkAtRules(/keyframes$/i, (rule) => {
+      const line = rule.source?.start?.line;
+      found.push({
+        name: rule.params.trim(),
+        vendor: rule.name.toLowerCase().replace(/keyframes$/, ""),
+        body: framesBody(rule),
+        file: entry.file,
+        ...line ? { line } : {}
+      });
+    });
+  }
+  return found;
+}
+function framesBody(rule) {
+  const frames = [];
+  rule.each((node) => {
+    if (node.type !== "rule") {
+      return;
+    }
+    const declarations = [];
+    node.walkDecls((decl) => {
+      declarations.push(
+        `${decl.prop.toLowerCase()}:${normaliseValue(decl.value)}${decl.important ? "!" : ""}`
+      );
+    });
+    const selector = node.selectors.map(
+      (value) => value.trim().toLowerCase().replace(/^from$/, "0%").replace(/^to$/, "100%")
+    ).join(",");
+    frames.push(`${selector}{${declarations.join(";")}}`);
+  });
+  return frames.join("");
+}
+function normaliseValue(value) {
+  return value.toLowerCase().replace(/\s+/g, "").replace(/(^|[^\d.])0+(\.\d)/g, "$1$2").replace(/(\d)\.0+(?!\d)/g, "$1");
+}
+function duplicateKeyframes(source, built) {
+  const problems = [];
+  const reported = /* @__PURE__ */ new Set();
+  const sourceFrames = keyframesIn(source);
+  const builtFrames = keyframesIn(built);
+  const fix = "Keep one @keyframes for each animation and refer to it by that name.";
+  const byName = (frames) => {
+    const groups = /* @__PURE__ */ new Map();
+    for (const frame of frames) {
+      const key = `${frame.vendor}${frame.name}`;
+      groups.set(key, [...groups.get(key) ?? [], frame]);
+    }
+    return groups;
+  };
+  for (const [key, group] of byName(sourceFrames)) {
+    if (group.length > 1) {
+      reported.add(key);
+      const [first, ...rest] = group;
+      for (const frame of rest) {
+        problems.push(
+          problem(
+            `@keyframes ${frame.name} is defined again (first in ${first?.file}${first?.line ? `:${first.line}` : ""}).`,
+            fix,
+            location("css/duplicate-keyframes", frame)
+          )
+        );
+      }
+    }
+  }
+  for (const [key, group] of byName(builtFrames)) {
+    if (reported.has(key) || new Set(group.map(({ body }) => body)).size < 2) {
+      continue;
+    }
+    reported.add(key);
+    const first = group[0];
+    problems.push(
+      problem(
+        `@keyframes ${first?.name} is defined more than once with different frames in the built CSS, so the last one wins.`,
+        `${fix} Rename yours if it clashes with one from a library or Tailwind.`,
+        location("css/duplicate-keyframes", first)
+      )
+    );
+  }
+  const byBody = /* @__PURE__ */ new Map();
+  for (const frame of [...sourceFrames, ...builtFrames]) {
+    if (!frame.body) {
+      continue;
+    }
+    const key = `${frame.vendor}${frame.body}`;
+    const group = byBody.get(key) ?? [];
+    if (!group.some(({ name }) => name === frame.name)) {
+      group.push(frame);
+    }
+    byBody.set(key, group);
+  }
+  for (const group of byBody.values()) {
+    if (group.length < 2) {
+      continue;
+    }
+    const names = group.map(({ name }) => name);
+    const [first, ...rest] = group;
+    problems.push(
+      problem(
+        `@keyframes ${names.join(", ")} have the same frames under different names.`,
+        `${fix} Use ${first?.name} for all of them.`,
+        location("css/duplicate-keyframes", rest[0])
+      )
+    );
+  }
+  return problems;
+}
+function location(rule, entry) {
+  return {
+    rule,
+    ...entry ? { file: entry.file } : {},
+    ...entry?.line ? { line: entry.line } : {}
+  };
+}
+function contextOf(node) {
+  const parts = [];
+  for (let parent = node; parent && parent.type !== "root"; parent = parent.parent) {
+    if (parent.type === "atrule") {
+      const rule = parent;
+      parts.unshift(`@${rule.name} ${rule.params.replace(/\s+/g, " ").trim()}`);
+    } else if (parent.type === "rule") {
+      parts.unshift(
+        parent.selectors.map(normaliseSelector).join(",")
+      );
     }
-  );
+  }
+  return parts.join(" > ");
 }
-function cssProblem(sizes, limitKb, over) {
-  const bytes = total(sizes);
-  return problem(
-    `Client CSS: ${bytes} B gzip (limit ${limitKb * KIB} B).`,
-    over ? "Reduce client CSS or raise the reviewed budget override." : null,
-    { rule: over ? "budgets/css-over" : "budgets/css" }
-  );
+var normaliseSelector = (selector) => selector.replace(/\s+/g, " ").replace(/\s*([>+~,])\s*/g, "$1").trim();
+function duplicateSelectors(source) {
+  const seen = /* @__PURE__ */ new Map();
+  const problems = [];
+  for (const entry of source) {
+    entry.root.walkRules((rule) => {
+      if (rule.parent?.type === "atrule" && /keyframes$/i.test(rule.parent.name)) {
+        return;
+      }
+      const context = contextOf(rule.parent);
+      const line = rule.source?.start?.line;
+      const selectors = [...new Set(rule.selectors.map(normaliseSelector))];
+      const keys = selectors.length === 1 ? selectors : [[...selectors].sort().join(",")];
+      for (const selector of keys) {
+        const key = `${context}\0${selector}`;
+        const first = seen.get(key);
+        if (!first) {
+          seen.set(key, { file: entry.file, ...line ? { line } : {} });
+          continue;
+        }
+        problems.push(
+          problem(
+            `${selector}${context ? ` (inside ${context})` : ""} is already styled in ${first.file}${first.line ? `:${first.line}` : ""}.`,
+            "Merge the declarations into one rule so the cascade order cannot change the result.",
+            location("css/duplicate-selector", {
+              file: entry.file,
+              ...line ? { line } : {}
+            })
+          )
+        );
+      }
+    });
+  }
+  return problems;
 }
-var total = (sizes) => sizes.reduce((sum, asset) => sum + asset.bytes, 0);
-
-// src/build.ts
-import { readFile as readFile7 } from "fs/promises";
-import path7 from "path";
-
-// src/command.ts
-import { spawn } from "child_process";
-function command(executable, args, cwd, signal) {
-  return new Promise((resolve, reject) => {
-    const child = spawn(executable, args, {
-      cwd,
-      env: { ...process.env, NO_COLOR: "1", FORCE_COLOR: "0" },
-      stdio: ["ignore", "pipe", "pipe"],
-      ...signal ? { signal } : {}
+var namespaces = [
+  ["font-weight", ["font"]],
+  ["inset-shadow", ["inset-shadow"]],
+  ["drop-shadow", ["drop-shadow"]],
+  ["text-shadow", ["text-shadow"]],
+  [
+    "color",
+    [
+      "text",
+      "bg",
+      "border",
+      "border-x",
+      "border-y",
+      "border-t",
+      "border-r",
+      "border-b",
+      "border-l",
+      "border-s",
+      "border-e",
+      "ring",
+      "ring-offset",
+      "outline",
+      "fill",
+      "stroke",
+      "decoration",
+      "accent",
+      "caret",
+      "divide",
+      "placeholder",
+      "from",
+      "via",
+      "to",
+      "shadow",
+      "inset-shadow",
+      "inset-ring"
+    ]
+  ],
+  [
+    "radius",
+    [
+      "rounded",
+      "rounded-t",
+      "rounded-r",
+      "rounded-b",
+      "rounded-l",
+      "rounded-tl",
+      "rounded-tr",
+      "rounded-br",
+      "rounded-bl",
+      "rounded-s",
+      "rounded-e",
+      "rounded-ss",
+      "rounded-se",
+      "rounded-es",
+      "rounded-ee"
+    ]
+  ],
+  ["font", ["font"]],
+  ["text", ["text"]],
+  ["tracking", ["tracking"]],
+  ["leading", ["leading"]],
+  ["shadow", ["shadow"]],
+  ["blur", ["blur"]],
+  ["ease", ["ease"]],
+  ["animate", ["animate"]],
+  ["container", ["max-w", "min-w", "w"]]
+];
+function themeTokens(source) {
+  const tokens = [];
+  for (const entry of source) {
+    entry.root.walkAtRules("theme", (rule) => {
+      rule.walkDecls(/^--/, (decl) => {
+        for (const [namespace, utilities] of namespaces) {
+          const prefix = `--${namespace}-`;
+          if (decl.prop.startsWith(prefix) && decl.prop.length > prefix.length) {
+            tokens.push({
+              variable: decl.prop,
+              value: compact(decl.value),
+              utilities,
+              name: decl.prop.slice(prefix.length)
+            });
+            break;
+          }
+        }
+      });
     });
-    let stdout = "";
-    let stderr = "";
-    child.stdout.on("data", (value) => {
-      stdout += String(value);
+  }
+  return tokens;
+}
+var compact = (value) => value.toLowerCase().replace(/_/g, " ").replace(/\s+/g, "");
+var arbitraryUtility = /(?<![\w-])((?:[^\s"'`<>{}]*:)?)(!?)(-?)([a-z][a-z-]*?)-(\[([^\]\s"'`]+)\]|\((--[a-z0-9_-]+)\))((?:\/[\w.%]+)?!?)(?![\w-])/g;
+function arbitraryTokens(source, code) {
+  const tokens = themeTokens(source);
+  if (tokens.length === 0) {
+    return [];
+  }
+  const problems = [];
+  const scan = (text, file, lineOffset = 0) => {
+    text.split(/\r?\n/).forEach((line, index) => {
+      for (const match of line.matchAll(arbitraryUtility)) {
+        const [
+          whole,
+          variants = "",
+          bang = "",
+          negative = "",
+          utility = "",
+          ,
+          bracket,
+          parenthesis,
+          modifier = ""
+        ] = match;
+        const raw = bracket ?? `var(${parenthesis})`;
+        const value = compact(raw.replace(/^[a-z-]+:(?!\/)/, ""));
+        const token = tokens.find(
+          (candidate) => candidate.utilities.includes(utility) && (value === candidate.value || value === `var(${candidate.variable})`)
+        );
+        if (!token) {
+          continue;
+        }
+        const replacement = `${variants}${bang}${negative}${utility}-${token.name}${modifier}`;
+        problems.push(
+          problem(
+            `${whole} restates the theme token ${token.variable}.`,
+            `Use ${replacement}.`,
+            { rule: "css/arbitrary-token", file, line: lineOffset + index + 1 }
+          )
+        );
+      }
     });
-    child.stderr.on("data", (value) => {
-      stderr += String(value);
+  };
+  for (const entry of code) {
+    scan(entry.text, entry.file);
+  }
+  for (const entry of source) {
+    entry.root.walkAtRules("apply", (rule) => {
+      scan(rule.params, entry.file, (rule.source?.start?.line ?? 1) - 1);
     });
-    child.on("error", reject);
-    child.on("close", (code) => {
-      resolve({ code: code ?? 1, stdout, stderr });
+  }
+  return problems;
+}
+function unusedCustomProperties(source, built, inputs) {
+  const definitions = /* @__PURE__ */ new Map();
+  for (const entry of source) {
+    entry.root.walkDecls(/^--/, (decl) => {
+      if (insideTheme(decl.parent) || definitions.has(decl.prop)) {
+        return;
+      }
+      const line = decl.source?.start?.line;
+      definitions.set(decl.prop, {
+        file: entry.file,
+        ...line ? { line } : {}
+      });
     });
-  });
+  }
+  if (definitions.size === 0) {
+    return [];
+  }
+  const read = /* @__PURE__ */ new Set();
+  const cssReads = /var\(\s*(--[\w-]+)/g;
+  for (const entry of [...source, ...built]) {
+    for (const match of entry.text.matchAll(cssReads)) {
+      read.add(match[1] ?? "");
+    }
+  }
+  const scriptMentions = /(?<![\w-])(--[a-zA-Z][\w-]*)/g;
+  for (const entry of [...inputs.sourceCode, ...inputs.builtCode]) {
+    for (const match of entry.text.matchAll(scriptMentions)) {
+      read.add(match[1] ?? "");
+    }
+  }
+  const problems = [];
+  for (const [name, where] of definitions) {
+    if (!read.has(name)) {
+      problems.push(
+        problem(
+          `${name} is defined but nothing reads it.`,
+          "Remove the custom property, or read it with var().",
+          location("css/unused-custom-property", where)
+        )
+      );
+    }
+  }
+  return problems;
 }
-function execArgs(manager, binary, args) {
-  if (manager === "npm") {
-    return { executable: "npm", args: ["exec", "--no", "--", binary, ...args] };
+function insideTheme(node) {
+  for (let parent = node; parent; parent = parent.parent) {
+    if (parent.type === "atrule" && parent.name === "theme") {
+      return true;
+    }
   }
-  if (manager === "yarn") {
-    return { executable: "yarn", args: ["exec", binary, ...args] };
+  return false;
+}
+var motionProperties = /* @__PURE__ */ new Set([
+  "animation",
+  "animation-name",
+  "transition",
+  "transition-property"
+]);
+var stillValue = /^(?:none|0m?s|initial|unset|inherit)$/i;
+var reducedMotionQuery = (rule, preference) => rule.name === "media" && new RegExp(`prefers-reduced-motion\\s*:\\s*${preference}`, "i").test(
+  rule.params
+);
+function insideMedia(node, preference) {
+  for (let parent = node; parent; parent = parent.parent) {
+    if (parent.type === "atrule" && reducedMotionQuery(parent, preference)) {
+      return true;
+    }
   }
-  if (manager === "bun") {
-    return { executable: "bun", args: ["x", "--no-install", binary, ...args] };
+  return false;
+}
+var globalSelector = /^(?:\*|html|:root|body|\*::?before|\*::?after|::?before|::?after)$/;
+function reducedMotion(source) {
+  let global = false;
+  const stilled = /* @__PURE__ */ new Set();
+  for (const entry of source) {
+    entry.root.walkAtRules("media", (media) => {
+      if (!reducedMotionQuery(media, "reduce")) {
+        return;
+      }
+      media.walkRules((rule) => {
+        let touchesMotion = false;
+        rule.walkDecls((decl) => {
+          if (/^(?:animation|transition)/.test(decl.prop)) {
+            touchesMotion = true;
+          }
+        });
+        if (!touchesMotion) {
+          return;
+        }
+        for (const selector of rule.selectors.map(normaliseSelector)) {
+          stilled.add(selector);
+          if (globalSelector.test(selector)) {
+            global = true;
+          }
+        }
+      });
+    });
   }
-  return { executable: "pnpm", args: ["exec", binary, ...args] };
+  if (global) {
+    return [];
+  }
+  const problems = [];
+  for (const entry of source) {
+    entry.root.walkDecls((decl) => {
+      if (!motionProperties.has(decl.prop) || stillValue.test(decl.value.trim())) {
+        return;
+      }
+      const parent = decl.parent;
+      if (insideMedia(parent, "reduce") || insideMedia(parent, "no-preference") || insideTheme(parent) || parent?.type !== "rule") {
+        return;
+      }
+      const selectors = parent.selectors.map(
+        normaliseSelector
+      );
+      if (selectors.every((selector) => stilled.has(selector))) {
+        return;
+      }
+      const line = decl.source?.start?.line;
+      problems.push(
+        problem(
+          `${selectors.join(", ")} sets ${decl.prop} with no prefers-reduced-motion path.`,
+          "Wrap the motion in @media (prefers-reduced-motion: no-preference), or still it in a @media (prefers-reduced-motion: reduce) block.",
+          location("css/reduced-motion", {
+            file: entry.file,
+            ...line ? { line } : {}
+          })
+        )
+      );
+    });
+  }
+  return problems;
 }
-function scriptArgs(manager, name) {
-  if (manager === "bun") {
-    return { executable: "bun", args: ["run", name] };
+var classAttribute = /\[\s*class\s*[*^$~|]?=\s*(?:"[^"]*"|'[^']*'|[^\]\s]+)\s*(?:[is]\s*)?\]/gi;
+function classPatches(source) {
+  const problems = [];
+  for (const entry of source) {
+    entry.root.walkRules((rule) => {
+      for (const match of rule.selector.matchAll(classAttribute)) {
+        const line = rule.source?.start?.line;
+        problems.push(
+          problem(
+            `${match[0]} patches elements by their class attribute.`,
+            "Style the element through a theme token or its own class. Dark mode goes through tokens, not by matching utility classes.",
+            location("css/class-patch", {
+              file: entry.file,
+              ...line ? { line } : {}
+            })
+          )
+        );
+      }
+    });
   }
-  if (manager === "npm") {
-    return { executable: "npm", args: ["run", name] };
+  return problems;
+}
+var colourLiteral = /#[0-9a-f]{3,8}\b|(?:rgba?|hsla?|oklch|oklab|lab|lch|color)\([^()]*\)/gi;
+var trivialValue = /^(?:0|none|inherit|initial|unset|auto|transparent|currentcolor|0px)$/;
+function literalTokens(source) {
+  const tokens = /* @__PURE__ */ new Map();
+  for (const entry of source) {
+    entry.root.walkDecls(/^--/, (decl) => {
+      const value = compact(decl.value);
+      if (value.includes("var(") || trivialValue.test(value) || tokens.has(value)) {
+        return;
+      }
+      const parent = decl.parent;
+      const rootLevel = parent?.type === "rule" && parent.selectors.some(
+        (selector) => /^(?::root|html)$/.test(selector.trim())
+      );
+      if (insideTheme(parent) || rootLevel) {
+        tokens.set(value, decl.prop);
+      }
+    });
   }
-  return { executable: manager, args: [name] };
+  if (tokens.size === 0) {
+    return [];
+  }
+  const problems = [];
+  for (const entry of source) {
+    entry.root.walkDecls((decl) => {
+      if (decl.prop.startsWith("--") || insideTheme(decl.parent)) {
+        return;
+      }
+      const prop = decl.prop.toLowerCase();
+      const candidates = [];
+      if (/radius$/.test(prop) || /shadow$/.test(prop)) {
+        candidates.push(decl.value);
+      }
+      if (/(?:^|-)(?:color|background|border|outline|fill|stroke|shadow|decoration)/.test(
+        prop
+      ) || prop === "color" || prop === "fill" || prop === "stroke") {
+        candidates.push(...decl.value.match(colourLiteral) ?? []);
+      }
+      for (const candidate of new Set(candidates.map(compact))) {
+        const token = tokens.get(candidate);
+        if (!token || trivialValue.test(candidate)) {
+          continue;
+        }
+        const line = decl.source?.start?.line;
+        problems.push(
+          problem(
+            `${decl.prop}: ${decl.value} restates the token ${token}.`,
+            `Use var(${token}).`,
+            location("css/literal-token", {
+              file: entry.file,
+              ...line ? { line } : {}
+            })
+          )
+        );
+        break;
+      }
+    });
+  }
+  return problems;
 }
 
-// src/build.ts
-async function checkBuild({
+// src/css.ts
+async function checkCss({
   cwd,
-  packageManager,
   signal
 }) {
   signal?.throwIfAborted();
-  const manifest = JSON.parse(
-    await readFile7(path7.join(cwd, "package.json"), "utf8")
-  );
-  const invocation = manifest.dependencies?.["react-router"] ? execArgs(packageManager, "react-router", ["build"]) : manifest.scripts?.build ? scriptArgs(packageManager, "build") : void 0;
-  if (!invocation) {
-    return skipped(
-      "build",
-      "No react-router dependency or build script is defined in package.json."
-    );
+  const inputs = await readCssInputs(cwd);
+  if (inputs.sourceCss.length === 0 && inputs.builtCss.length === 0) {
+    return skipped("css", "No source or built CSS files were found.");
   }
-  const result = await command(
-    invocation.executable,
-    invocation.args,
-    cwd,
-    signal
-  );
+  const problems = analyseCss(inputs);
   signal?.throwIfAborted();
-  if (result.code === 0) {
-    return step("build", "passed");
-  }
-  return step("build", "failed", [
-    problem(
-      `The project build failed.
-${usefulTail(result.stdout, result.stderr)}`,
-      "Fix the reported build errors and run zappie check again.",
-      { rule: "build/failed" }
-    )
-  ]);
-}
-function usefulTail(stdout, stderr) {
-  const lines = `${stdout}
-${stderr}`.split(/\r?\n/).map((line) => line.trimEnd()).filter(Boolean).slice(-12);
-  return lines.length > 0 ? lines.join("\n") : "The build exited without output.";
+  const failed = problems.some(({ rule }) => CSS_ERRORS.has(rule));
+  return step("css", failed ? "failed" : "passed", problems);
 }
 
 // src/lint.ts
 import zappie from "eslint-plugin-zappie";
 import { createRequire } from "module";
-import path8 from "path";
+import path10 from "path";
 import { pathToFileURL as pathToFileURL2 } from "url";
 async function checkLint({
   cwd,
@@ -1568,12 +2773,12 @@ async function checkLint({
   signal?.throwIfAborted();
   let ESLint;
   try {
-    const require2 = createRequire(path8.join(cwd, "package.json"));
+    const require2 = createRequire(path10.join(cwd, "package.json"));
     const loadedEslint = await import(pathToFileURL2(require2.resolve("eslint")).href);
     ESLint = loadedEslint.ESLint;
   } catch (error) {
     return step("lint", "failed", [
-      problem(message2(error), "Install ESLint in the project.", {
+      problem(message3(error), "Install ESLint in the project.", {
         rule: "lint/unavailable"
       })
     ]);
@@ -1604,7 +2809,7 @@ async function checkLint({
   } catch (error) {
     return step("lint", "failed", [
       problem(
-        message2(error),
+        message3(error),
         "Fix the project ESLint configuration and run lint again.",
         {
           rule: "lint/config"
@@ -1634,7 +2839,9 @@ function recommendedRules() {
     Object.assign(result, config.rules ?? {});
   }
   return Object.fromEntries(
-    Object.entries(result).filter(([name]) => name.startsWith("zappie/"))
+    Object.entries(result).filter(
+      ([name]) => name.startsWith("zappie/") || name.startsWith("jsx-a11y/")
+    )
   );
 }
 function level(value) {
@@ -1657,7 +2864,7 @@ async function sourceFile(cwd) {
   for (const candidate of candidates) {
     try {
       await import("fs/promises").then(
-        ({ access: access3 }) => access3(path8.join(cwd, candidate))
+        ({ access: access4 }) => access4(path10.join(cwd, candidate))
       );
       return candidate;
     } catch {
@@ -1666,13 +2873,13 @@ async function sourceFile(cwd) {
   }
   return "eslint.config.mjs";
 }
-function message2(error) {
+function message3(error) {
   return error instanceof Error ? error.message : String(error);
 }
 
 // src/readiness.ts
-import { readFile as readFile8 } from "fs/promises";
-import path9 from "path";
+import { readFile as readFile10 } from "fs/promises";
+import path11 from "path";
 import { pathToFileURL as pathToFileURL3 } from "url";
 async function checkReadiness({
   cwd,
@@ -1690,9 +2897,9 @@ async function checkReadiness({
       )
     ]);
   }
-  const file = path9.join(cwd, "react-router.config.ts");
+  const file = path11.join(cwd, "react-router.config.ts");
   try {
-    await readFile8(file, "utf8");
+    await readFile10(file, "utf8");
     const version = Date.now();
     const config = await import(`${pathToFileURL3(file).href}?readiness=${version}`);
     if (config.default?.routeDiscovery?.mode === "initial") {
@@ -1701,7 +2908,7 @@ async function checkReadiness({
   } catch (error) {
     return step("readiness", "failed", [
       problem(
-        message3(error),
+        message4(error),
         'Create react-router.config.ts and set routeDiscovery: { mode: "initial" }.',
         {
           rule: "readiness/route-discovery",
@@ -1718,13 +2925,15 @@ async function checkReadiness({
     )
   ]);
 }
-function message3(error) {
+function message4(error) {
   return error instanceof Error ? error.message : String(error);
 }
 
 // src/secrets.ts
-import { lstat, readFile as readFile9, readdir as readdir2 } from "fs/promises";
-import path10 from "path";
+import { execFile } from "child_process";
+import { lstat as lstat2, readFile as readFile11, readdir as readdir3 } from "fs/promises";
+import path12 from "path";
+import { promisify } from "util";
 
 // src/secret-patterns.ts
 var FIX = "Move the value to a server environment variable and rotate it.";
@@ -1765,6 +2974,35 @@ function secretMatches(source, envFile) {
     fix: FIX,
     severity: "error"
   }));
+  const gitleaksDefaults = [
+    [/\bghp_[A-Za-z0-9]{36}\b/g, "github-pat", "GitHub personal access token"],
+    [
+      /\bgithub_pat_[A-Za-z0-9_]{82}\b/g,
+      "github-fine-grained-pat",
+      "GitHub fine-grained access token"
+    ],
+    [
+      /\bglpat-[A-Za-z0-9_-]{20,}\b/g,
+      "gitlab-pat",
+      "GitLab personal access token"
+    ],
+    [/\bnpm_[A-Za-z0-9]{36}\b/g, "npm-token", "npm access token"],
+    [/\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, "slack-token", "Slack token"],
+    [/\bAIza[0-9A-Za-z_-]{35}\b/g, "google-api-key", "Google API key"],
+    [
+      /\bSG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}\b/g,
+      "sendgrid-api-key",
+      "SendGrid API key"
+    ]
+  ];
+  for (const [pattern, rule, label] of gitleaksDefaults) {
+    add(matches2, source, pattern, () => ({
+      rule: `secrets/${rule}`,
+      message: `Detected a ${label}.`,
+      fix: FIX,
+      severity: "error"
+    }));
+  }
   const occupied = matches2.map(({ index }) => index);
   const assignment = /\b([A-Za-z_$][\w$]*(?:secret|token|password|api[_-]?key)[\w$]*)\s*[:=]\s*(["'])([^"'\r\n]{24,})\2/gi;
   for (const found of source.matchAll(assignment)) {
@@ -1802,21 +3040,31 @@ function entropy(value) {
 
 // src/secrets.ts
 var SECRET_FILE_SIZE_CAP = 1024 * 1024;
-async function scanSecrets(dir) {
+var execFileAsync = promisify(execFile);
+var lockfile = /(?:^|\/)(?:package-lock\.json|pnpm-lock\.yaml|yarn\.lock|bun\.lockb?)$/;
+async function scanSecrets(dir, options = {}) {
   const findings = [];
   for (const file of await filesToScan(dir)) {
-    const info = await lstat(file);
+    let info;
+    try {
+      info = await lstat2(file);
+    } catch (error) {
+      if (missing2(error)) {
+        continue;
+      }
+      throw error;
+    }
     if (!info.isFile() || info.size > SECRET_FILE_SIZE_CAP) {
       continue;
     }
-    const contents = await readFile9(file);
+    const contents = await readFile11(file);
     if (contents.includes(0)) {
       continue;
     }
     const source = contents.toString("utf8");
     for (const match of secretMatches(
       source,
-      path10.basename(file).startsWith(".env")
+      path12.basename(file).startsWith(".env")
     )) {
       findings.push({
         rule: match.rule,
@@ -1828,14 +3076,21 @@ async function scanSecrets(dir) {
       });
     }
   }
+  if (options.history) {
+    findings.push(...await scanHistory(dir));
+  }
   return findings;
 }
 async function checkSecrets({
   cwd,
+  history,
   signal
 }) {
   signal?.throwIfAborted();
-  const findings = await scanSecrets(cwd);
+  const findings = await scanSecrets(
+    cwd,
+    history === void 0 ? {} : { history }
+  );
   signal?.throwIfAborted();
   const failed = findings.some(({ severity }) => severity === "error");
   return step(
@@ -1845,45 +3100,116 @@ async function checkSecrets({
   );
 }
 async function filesToScan(cwd) {
+  const files = await trackedFiles(cwd);
+  for (const directory of ["build/client", "build/server", "workers"]) {
+    await collect3(path12.join(cwd, directory), files);
+  }
+  return [...new Set(files)].filter((file) => !lockfile.test(relative(cwd, file))).sort();
+}
+async function trackedFiles(cwd) {
+  try {
+    const { stdout } = await execFileAsync("git", ["ls-files", "-z"], {
+      cwd,
+      encoding: "utf8",
+      maxBuffer: 32 * 1024 * 1024
+    });
+    const files = stdout.split("\0").filter(Boolean).map((file) => path12.join(cwd, file));
+    return files.length > 0 ? files : fallbackFiles(cwd);
+  } catch {
+    return fallbackFiles(cwd);
+  }
+}
+async function fallbackFiles(cwd) {
   const files = [];
   for (const directory of ["app", "public"]) {
-    await collect2(path10.join(cwd, directory), files);
+    await collect3(path12.join(cwd, directory), files);
   }
-  await collect2(
-    path10.join(cwd, "build/client"),
-    files,
-    (file) => file.endsWith(".js")
-  );
   try {
-    for (const entry of await readdir2(cwd, { withFileTypes: true })) {
+    for (const entry of await readdir3(cwd, { withFileTypes: true })) {
       if (entry.isFile() && rootConfig(entry.name)) {
-        files.push(path10.join(cwd, entry.name));
+        files.push(path12.join(cwd, entry.name));
       }
     }
   } catch {
-    return files.sort();
+    return files;
+  }
+  return files;
+}
+async function scanHistory(cwd) {
+  try {
+    const { stdout } = await execFileAsync(
+      "git",
+      [
+        "log",
+        "--all",
+        "--format=commit:%H",
+        "-p",
+        "--no-ext-diff",
+        "--",
+        ".",
+        ":(exclude)package-lock.json",
+        ":(exclude)pnpm-lock.yaml",
+        ":(exclude)yarn.lock",
+        ":(exclude)bun.lock",
+        ":(exclude)bun.lockb"
+      ],
+      { cwd, encoding: "utf8", maxBuffer: 128 * 1024 * 1024 }
+    );
+    return secretMatches(stdout, false).map((match) => {
+      const location2 = historyLocation(stdout, match.index);
+      return {
+        rule: match.rule,
+        file: location2 ?? "git history",
+        line: lineAt(stdout, match.index),
+        message: match.message,
+        fix: match.fix,
+        severity: match.severity
+      };
+    });
+  } catch {
+    return [
+      {
+        rule: "secrets/history-unavailable",
+        file: "git history",
+        line: 1,
+        message: "Could not scan Git history for secrets.",
+        fix: "Check Git access and run zappie check --history again.",
+        severity: "warning"
+      }
+    ];
   }
-  return [...new Set(files)].sort();
 }
-async function collect2(directory, files, accept = () => true) {
+function historyLocation(source, index) {
+  const prefix = source.slice(0, index);
+  const commit = [...prefix.matchAll(/^commit:([0-9a-f]+)$/gm)].at(-1)?.[1];
+  const changedPaths = [
+    ...prefix.matchAll(/^(?:\+\+\+ b\/|--- a\/)(.+)$/gm)
+  ].map((match) => match[1]);
+  const file = changedPaths.at(-1);
+  return commit && file ? `${commit}:${file}` : void 0;
+}
+async function collect3(directory, files, accept = () => true) {
   try {
-    for (const entry of await readdir2(directory, { withFileTypes: true })) {
+    for (const entry of await readdir3(directory, { withFileTypes: true })) {
       if (entry.isSymbolicLink()) {
         continue;
       }
-      const file = path10.join(directory, entry.name);
+      const file = path12.join(directory, entry.name);
       if (entry.isDirectory()) {
-        await collect2(file, files, accept);
+        await collect3(file, files, accept);
       } else if (entry.isFile() && accept(file)) {
         files.push(file);
       }
     }
   } catch (error) {
-    if (!(error instanceof Error && "code" in error && error.code === "ENOENT")) {
+    if (!missing2(error)) {
       throw error;
     }
   }
 }
+function missing2(error) {
+  return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
 function rootConfig(name) {
   return name === "package.json" || name === "wrangler.json" || name === "wrangler.jsonc" || /(?:^|\.)config\.(?:[cm]?[jt]s|json)$/.test(name);
 }
@@ -1892,13 +3218,13 @@ function lineAt(source, index) {
 }
 
 // src/test-step.ts
-import path11 from "path";
+import path13 from "path";
 async function checkTests({
   cwd,
   packageManager,
   signal
 }) {
-  const manifest = await json(path11.join(cwd, "package.json"));
+  const manifest = await json(path13.join(cwd, "package.json"));
   if (!manifest.scripts?.test) {
     return skipped("test", "No test script is defined in package.json.");
   }
@@ -1921,11 +3247,11 @@ async function checkTests({
 }
 
 // src/types-step.ts
-import path12 from "path";
+import path14 from "path";
 async function checkTypes(options) {
   const { cwd, packageManager, signal } = options;
   signal?.throwIfAborted();
-  const manifest = await json(path12.join(cwd, "package.json"));
+  const manifest = await json(path14.join(cwd, "package.json"));
   if (manifest.dependencies?.["react-router"]) {
     const generated = execArgs(packageManager, "react-router", ["typegen"]);
     const result2 = await command(
@@ -1979,13 +3305,15 @@ function outputProblems(output) {
 var runners = [
   { name: "config", run: checkConfig },
   { name: "allowlist", run: checkAllowlist },
+  { name: "audit", run: checkAudit },
   { name: "lint", run: checkLint },
   { name: "types", run: checkTypes },
   { name: "test", run: checkTests },
   { name: "build", run: checkBuild },
   { name: "secrets", run: checkSecrets },
   { name: "readiness", run: checkReadiness },
-  { name: "budgets", run: checkBudgets }
+  { name: "budgets", run: checkBudgets },
+  { name: "css", run: checkCss }
 ];
 async function runCheck(options) {
   const steps = [];
@@ -1998,13 +3326,13 @@ async function runCheck(options) {
       options.signal?.throwIfAborted();
       checked = step(runner.name, "failed", [
         problem(
-          message4(error),
+          message5(error),
           "Fix the step setup and run zappie check again."
         )
       ]);
     }
     steps.push(checked);
-    if (checked.result === "failed" && !options.all) {
+    if (checked.result === "failed" && !options.all && runner.name !== "audit") {
       break;
     }
   }
@@ -2013,22 +3341,28 @@ async function runCheck(options) {
     steps
   };
 }
-function message4(error) {
+function message5(error) {
   return error instanceof Error ? error.message : String(error);
 }
 export {
   BUILTIN_ALLOWLIST_SOURCE,
+  CSS_ERRORS,
   SECRET_FILE_SIZE_CAP,
+  analyseCss,
   checkAllowlist,
+  checkAudit,
   checkBudgets,
   checkBuild,
   checkConfig,
+  checkCss,
   checkLint,
   checkReadiness,
   checkSecrets,
   checkTests,
   checkTypes,
+  evaluateAudit,
   loadConfig,
+  parseAuditOutput,
   runCheck,
   scanSecrets,
   supportsTypeScriptImport