ethanplusai/astro-conversion-kit

node <skill-dir>/scripts/fingerprint.mjs https://www.example.com

node <skill-dir>/scripts/capture.mjs https://www.example.com --out capture

node <skill-dir>/scripts/capture.mjs https://www.example.com --out capture --resume --seed-file capture/wayback-unverified.txt

node <skill-dir>/../visual-review/scripts/shoot.mjs --base https://www.example.com --routes capture/templates.json --widths 390,768,1440 --out capture/screens/live

npx --no-install lighthouse https://www.example.com/ --quiet --chrome-flags="--headless=new" --output json --output html --output-path capture/lighthouse-live/home

node <skill-dir>/scripts/capture.mjs https://www.example.com --out capture --resume

#!/usr/bin/env node

const LOGO = /(^|[^A-Za-z]|[a-z](?=L))[Ll][Oo][Gg][Oo][Ss]?([^A-Za-z]|$)/; const SVG_NS = 'http://www.w3.org/2000/svg';

const SVG_NS = 'http://www.w3.org/2000/svg';

const XLINK_NS = 'http://www.w3.org/1999/xlink';

#!/usr/bin/env node

<origin>              the site, e.g. https://www.example.com

}       for (let attempt = 1; ; attempt += 1) {         const res = await this.fetch(url, options);

for (let attempt = 1; ; attempt += 1) {         const res = await this.fetch(url, options);         const verdict = this.judge(res, url);

const res = await this.fetch(url, options);

const path = `/${randomBytes(16).toString('hex')}/`;     const url = new URL(path, this.state.canonicalOrigin).href;     const res = await this.fetch(url, { redirect: 'manual' });

const url = new URL(path, this.state.canonicalOrigin).href;     const res = await this.fetch(url, { redirect: 'manual' });     const verdict = this.judge(res, url);

const res = await this.fetch(url, { redirect: 'manual' });

let current = url;     for (let hop = 0; ; hop += 1) {       const res = await this.fetch(current, { ...options, redirect: 'manual' });

for (let hop = 0; ; hop += 1) {       const res = await this.fetch(current, { ...options, redirect: 'manual' });       const location = res.headers?.location;

const res = await this.fetch(current, { ...options, redirect: 'manual' });

let current = start;     for (let hop = 0; hop <= MAX_HOPS; hop += 1) {       const res = await this.fetch(current, { redirect: 'manual' });

for (let hop = 0; hop <= MAX_HOPS; hop += 1) {       const res = await this.fetch(current, { redirect: 'manual' });       hops.push({ url: current, res });

const res = await this.fetch(current, { redirect: 'manual' });

let current = start;     for (let hop = 0; hop <= MAX_HOPS; hop += 1) {       const res = hops[hop]?.url === current ? hops[hop].res : await this.fetch(current, { redirect: 'manual' });

for (let hop = 0; hop <= MAX_HOPS; hop += 1) {       const res = hops[hop]?.url === current ? hops[hop].res : await this.fetch(current, { redirect: 'manual' });       const verdict = this.judge(res, current, item);

const res = hops[hop]?.url === current ? hops[hop].res : await this.fetch(current, { redirect: 'manual' });

let url = item.url;     for (let hop = 0; ; hop += 1) {       const res = await this.fetch(url, { raw: true, maxBytes: JS_MAX_BYTES });

for (let hop = 0; ; hop += 1) {       const res = await this.fetch(url, { raw: true, maxBytes: JS_MAX_BYTES });       if (BLOCK_STATUSES.has(res.status)) return { res };

const res = await this.fetch(url, { raw: true, maxBytes: JS_MAX_BYTES });

#!/usr/bin/env node

<origin>      the site, e.g. https://www.example.com   --json        print the result as JSON   --delay <ms>  wait between requests (default ${DEFAULT_DELAY_MS})

for (const url of candidates) {     const res = await fetch(url, { redirect: 'follow' });

const res = await fetch(url, { redirect: 'follow' });

// detect: false leaves challenge detection to the caller's fetch (capture.mjs judges every answer).

export async function fingerprint(origin, { fetch = fetchPaced, detect = true } = {}) {   const base = new URL(origin).origin;   const home = await fetch(new URL('/', base).href, { redirect: 'follow' });

const base = new URL(origin).origin;   const home = await fetch(new URL('/', base).href, { redirect: 'follow' });   const html = home.status === 200 ? String(home.body) : '';

const home = await fetch(new URL('/', base).href, { redirect: 'follow' });

const robotsRes = await fetch(new URL('/robots.txt', base).href, { redirect: 'follow' });

Executable file

Executable file

Executable file

Executable file

Executable file

import { mkdir, open, rename, rm } from 'node:fs/promises';

let hopMethod = method;     for (let hop = 0; ; hop += 1) {       res = await fetch(target, { method: hopMethod, redirect: 'manual', headers: { 'User-Agent': ua, Accept: '*/*' }, signal });

for (let hop = 0; ; hop += 1) {       res = await fetch(target, { method: hopMethod, redirect: 'manual', headers: { 'User-Agent': ua, Accept: '*/*' }, signal });       if (hop === 0) answered();

res = await fetch(target, { method: hopMethod, redirect: 'manual', headers: { 'User-Agent': ua, Accept: '*/*' }, signal });

Executable file

Executable file

Executable file

const load = async (url) => {     visited.add(url);     const res = await fetch(url, { redirect: 'follow' });

visited.add(url);     const res = await fetch(url, { redirect: 'follow' });     if (res.status !== 200) return null;

const res = await fetch(url, { redirect: 'follow' });

Executable file

Executable file

Executable file

export const CDX_ENDPOINT = 'http://web.archive.org/cdx/search/cdx';

export async function waybackPaths(host, { fetch, known = [], out = null, endpoint = CDX_ENDPOINT, skip = () => false } = {}) {   const res = await fetch(cdxUrl(host, endpoint), { ...CDX_OPTIONS });

const res = await fetch(cdxUrl(host, endpoint), { ...CDX_OPTIONS });

Executable file

}       const url = pageUrl(type, page);       const res = await fetch(url);

const url = pageUrl(type, page);       const res = await fetch(url);       const data = parseList(res);

const res = await fetch(url);

#!/usr/bin/env node

(streamed to disk; a download with no data for 30 s is a network error)   --sizes referenced|all  which REST-only image sizes and query-string variants to fetch                     (default referenced: none; all: every registered size and e

--sizes referenced|all  which REST-only image sizes and query-string variants to fetch                     (default referenced: none; all: every registered size and every                     variant, for when old emails or other sites may l

#!/usr/bin/env node

#!/usr/bin/env node

git clone https://github.com/ethanplusai/astro-conversion-kit <folder>/astro-conversion-kit

git clone https://github.com/ethanplusai/astro-conversion-kit <folder>/astro-conversion-kit

{ "id": "d12", "path": "/about/", "field": "link", "from": "http://partner.example.com/",

{ "id": "d12", "path": "/about/", "field": "link", "from": "http://partner.example.com/",

"to": "https://partner.example.com/", "reason": "suggestion http-links: <why>",

"to": "https://partner.example.com/", "reason": "suggestion http-links: <why>",

npm run review:shoot -- --base http://localhost:4321 --routes <pages> --widths 390,1440 --out review/new-<id> --delay 0

npm run review:shoot -- --base http://localhost:4321 --routes <pages> --widths 390,1440 --out review/new-<id> --delay 0

can be clicked through, offer it as a proposal: one decision, and a `proposalOn(id)` switch in   a small helper the page body passes through, that rewrites body `<a href>` on the live origin   (`https://`, `http://` or `//`, with or without

can be clicked through, offer it as a proposal: one decision, and a `proposalOn(id)` switch in   a small helper the page body passes through, that rewrites body `<a href>` on the live origin   (`https://`, `http://` or `//`, with or without

a small helper the page body passes through, that rewrites body `<a href>` on the live origin   (`https://`, `http://` or `//`, with or without `www.`) to root-relative. It leaves head tags   (canonical, alternate, og) alone and keeps any h

a small helper the page body passes through, that rewrites body `<a href>` on the live origin   (`https://`, `http://` or `//`, with or without `www.`) to root-relative. It leaves head tags   (canonical, alternate, og) alone and keeps any h

(`https://`, `http://` or `//`, with or without `www.`) to root-relative. It leaves head tags

(`https://`, `http://` or `//`, with or without `www.`) to root-relative. It leaves head tags

changes (`from` the live href form, `to` the root-relative one); no gate compares it, since the   links gate already counts both forms as internal. The helper is a dozen lines: match   `href="https://www.example.com/..."` (and the `http://`

changes (`from` the live href form, `to` the root-relative one); no gate compares it, since the   links gate already counts both forms as internal. The helper is a dozen lines: match   `href="https://www.example.com/..."` (and the `http://`

links gate already counts both forms as internal. The helper is a dozen lines: match   `href="https://www.example.com/..."` (and the `http://`, `//` and apex forms) in the body   markup, replace the origin with nothing when `proposalOn(id)`

links gate already counts both forms as internal. The helper is a dozen lines: match   `href="https://www.example.com/..."` (and the `http://`, `//` and apex forms) in the body   markup, replace the origin with nothing when `proposalOn(id)`

`href="https://www.example.com/..."` (and the `http://`, `//` and apex forms) in the body

`href="https://www.example.com/..."` (and the `http://`, `//` and apex forms) in the body

markup, replace the origin with nothing when `proposalOn(id)` is true, and return the markup   unchanged otherwise. - **WordPress API head links are kept as captured.** `wp-json/` (`rel="https://api.w.org/"`),

markup, replace the origin with nothing when `proposalOn(id)` is true, and return the markup   unchanged otherwise. - **WordPress API head links are kept as captured.** `wp-json/` (`rel="https://api.w.org/"`),

unchanged otherwise. - **WordPress API head links are kept as captured.** `wp-json/` (`rel="https://api.w.org/"`),   `xmlrpc.php?rsd` (`EditURI`) and `wp-json/wp/v2/pages/N` (`alternate`) stay in the head

unchanged otherwise. - **WordPress API head links are kept as captured.** `wp-json/` (`rel="https://api.w.org/"`),   `xmlrpc.php?rsd` (`EditURI`) and `wp-json/wp/v2/pages/N` (`alternate`) stay in the head

- **WordPress API head links are kept as captured.** `wp-json/` (`rel="https://api.w.org/"`),

- **WordPress API head links are kept as captured.** `wp-json/` (`rel="https://api.w.org/"`),

- `action` to the endpoint (`https://formspree.io/f/<form id>`), `method="POST"`;

- `action` to the endpoint (`https://formspree.io/f/<form id>`), `method="POST"`;

Asked here, at the forms step, never at intake, and never a stop: send the person one line ("create a form at formspree.io, send me the id after /f/; ids are not secret") and carry on with the placeholder `https://formspree.io/f/REPLACE`. A

Asked here, at the forms step, never at intake, and never a stop: send the person one line ("create a form at formspree.io, send me the id after /f/; ids are not secret") and carry on with the placeholder `https://formspree.io/f/REPLACE`. A

("create a form at formspree.io, send me the id after /f/; ids are not secret") and carry on with the placeholder `https://formspree.io/f/REPLACE`. Add the needs-you item. While the placeholder is in the build, `pre-launch` fails `placehold

("create a form at formspree.io, send me the id after /f/; ids are not secret") and carry on with the placeholder `https://formspree.io/f/REPLACE`. Add the needs-you item. While the placeholder is in the build, `pre-launch` fails `placehold

the placeholder `https://formspree.io/f/REPLACE`. Add the needs-you item. While the placeholder is

the placeholder `https://formspree.io/f/REPLACE`. Add the needs-you item. While the placeholder is

npm run verify -- --endpoint https://formspree.io/f/<id> --honeypot _gotcha --thank-you /thank-you/

npm run verify -- --endpoint https://formspree.io/f/<id> --honeypot _gotcha --thank-you /thank-you/

The preview is `https://astro-rebuild.<slug>.pages.dev`: that is the staging URL,

The preview is `https://astro-rebuild.<slug>.pages.dev`: that is the staging URL,

https://*.pages.dev/*

https://*.pages.dev/*

[Credential-related source omitted]

[Credential-related source omitted]

This applies only when `publicStaging` is `false`; on the default path there is no bypass secret and no needs-you line for one. A protected deployment answers a request without the bypass with a `302` to `https://vercel.com/sso-api?...`, no

This applies only when `publicStaging` is `false`; on the default path there is no bypass secret and no needs-you line for one. A protected deployment answers a request without the bypass with a `302` to `https://vercel.com/sso-api?...`, no

secret and no needs-you line for one. A protected deployment answers a request without the bypass with a `302` to `https://vercel.com/sso-api?...`, not a 401 or a login page. `verify-live` recognises it and stops with exit 3 and `deployment

secret and no needs-you line for one. A protected deployment answers a request without the bypass with a `302` to `https://vercel.com/sso-api?...`, not a 401 or a login page. `verify-live` recognises it and stops with exit 3 and `deployment

bypass with a `302` to `https://vercel.com/sso-api?...`, not a 401 or a login page. `verify-live` recognises it and stops

bypass with a `302` to `https://vercel.com/sso-api?...`, not a 401 or a login page. `verify-live` recognises it and stops

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

| `gh` not logged in | The repo stays local; "create the repo, push `main` and `astro-rebuild`, open the PR from `.conversion/pr-body.md`" goes on your list | | Hosting CLI not logged in | No staging deploy; `npm run review:serve` locally; 

| `gh` not logged in | The repo stays local; "create the repo, push `main` and `astro-rebuild`, open the PR from `.conversion/pr-body.md`" goes on your list | | Hosting CLI not logged in | No staging deploy; `npm run review:serve` locally; 

| Hosting CLI not logged in | No staging deploy; `npm run review:serve` locally; the staging audit and `verify-live` are "Not covered"; "deploy staging" goes on your list | | No form id yet (asked at the forms step, never here; only when th

| Hosting CLI not logged in | No staging deploy; `npm run review:serve` locally; the staging audit and `verify-live` are "Not covered"; "deploy staging" goes on your list | | No form id yet (asked at the forms step, never here; only when th

| No form id yet (asked at the forms step, never here; only when the capture found a POST form) | Forms post to `https://formspree.io/f/REPLACE`; `pre-launch` fails on `placeholders.form-id` until you give the id; the PR opens as a draft; "

| No form id yet (asked at the forms step, never here; only when the capture found a POST form) | Forms post to `https://formspree.io/f/REPLACE`; `pre-launch` fails on `placeholders.form-id` until you give the id; the PR opens as a draft; "

5. **Oddities**, one decision each, default "reproduce live": a missing or second H1, a dead    tag, a broken internal link, a redirect chain, a sitemap URL that 404s, a slug claimed twice    (category base), a shortcode printed as text, an

5. **Oddities**, one decision each, default "reproduce live": a missing or second H1, a dead    tag, a broken internal link, a redirect chain, a sitemap URL that 404s, a slug claimed twice    (category base), a shortcode printed as text, an

tag, a broken internal link, a redirect chain, a sitemap URL that 404s, a slug claimed twice    (category base), a shortcode printed as text, an `http://` canonical, mixed content, a    noindex page in the sitemap, a font loaded from a font

tag, a broken internal link, a redirect chain, a sitemap URL that 404s, a slug claimed twice    (category base), a shortcode printed as text, an `http://` canonical, mixed content, a    noindex page in the sitemap, a font loaded from a font

(category base), a shortcode printed as text, an `http://` canonical, mixed content, a

(category base), a shortcode printed as text, an `http://` canonical, mixed content, a

node $KIT/skills/convert-site/scripts/init-site.mjs --dir $SITE --origin $LIVE --name "<site name>" --host <hosting> --trailing-slash <always|never> --repo https://github.com/<owner>/<slug>.git

node $KIT/skills/convert-site/scripts/init-site.mjs --dir $SITE --origin $LIVE --name "<site name>" --host <hosting> --trailing-slash <always|never> --repo https://github.com/<owner>/<slug>.git

look, write down every difference, fix from `capture/`, repeat. Never reshoot live to get a match. The proof is `npm run review:diff -- --a capture/screens/live --b review/new --out review/diff` and `npm run review:styles -- --live $LIVE --

look, write down every difference, fix from `capture/`, repeat. Never reshoot live to get a match. The proof is `npm run review:diff -- --a capture/screens/live --b review/new --out review/diff` and `npm run review:styles -- --live $LIVE --

match. The proof is `npm run review:diff -- --a capture/screens/live --b review/new --out review/diff` and `npm run review:styles -- --live $LIVE --new http://localhost:4321 --routes capture/templates.json --widths 390,768,1440 --out review

match. The proof is `npm run review:diff -- --a capture/screens/live --b review/new --out review/diff` and `npm run review:styles -- --live $LIVE --new http://localhost:4321 --routes capture/templates.json --widths 390,768,1440 --out review

review/diff` and `npm run review:styles -- --live $LIVE --new http://localhost:4321 --routes capture/templates.json --widths 390,768,1440 --out review/styles.json` exiting 0 for the template set (with `npm run review:serve` serving the buil

review/diff` and `npm run review:styles -- --live $LIVE --new http://localhost:4321 --routes capture/templates.json --widths 390,768,1440 --out review/styles.json` exiting 0 for the template set (with `npm run review:serve` serving the buil

[Credential-related source omitted]

[Credential-related source omitted]

#!/usr/bin/env node

#!/usr/bin/env node

#!/usr/bin/env node

#!/usr/bin/env node

--base     origin to load, e.g. https://www.example.com

--base     origin to load, e.g. https://www.example.com

#!/usr/bin/env node

#!/usr/bin/env node

[--public public] [--inline-out src/styles/inline]                          [--capture <capture dir>]                          [--widths 390,768,1440] [--origin https://www.example.com]

[--public public] [--inline-out src/styles/inline]                          [--capture <capture dir>]                          [--widths 390,768,1440] [--origin https://www.example.com]

[--capture <capture dir>]                          [--widths 390,768,1440] [--origin https://www.example.com]        node css-prune.mjs --single-sheet --css <capture/css dir> --coverage coverage.json

[--capture <capture dir>]                          [--widths 390,768,1440] [--origin https://www.example.com]        node css-prune.mjs --single-sheet --css <capture/css dir> --coverage coverage.json

[--widths 390,768,1440] [--origin https://www.example.com]

[--widths 390,768,1440] [--origin https://www.example.com]

const DEFAULT_WIDTHS = [390, 768, 1440]; const VIEWPORT_HEIGHT = 900; const PLACEHOLDER = 'http://placeholder.invalid';

const DEFAULT_WIDTHS = [390, 768, 1440]; const VIEWPORT_HEIGHT = 900; const PLACEHOLDER = 'http://placeholder.invalid';

const PLACEHOLDER = 'http://placeholder.invalid';

const PLACEHOLDER = 'http://placeholder.invalid';

// A live URL with a doubled slash (https://site//a.ttf) must not become protocol-relative.

// A live URL with a doubled slash (https://site//a.ttf) must not become protocol-relative.

#!/usr/bin/env node

#!/usr/bin/env node

Options:   --dir <path>              target directory (required)   --origin <url>            live site origin, e.g. https://www.example.com (required)

Options:   --dir <path>              target directory (required)   --origin <url>            live site origin, e.g. https://www.example.com (required)

--dir <path>              target directory (required)   --origin <url>            live site origin, e.g. https://www.example.com (required)   --name <name>             site name (required)

--dir <path>              target directory (required)   --origin <url>            live site origin, e.g. https://www.example.com (required)   --name <name>             site name (required)

--origin <url>            live site origin, e.g. https://www.example.com (required)

--origin <url>            live site origin, e.g. https://www.example.com (required)

Executable file

Executable file

Executable file

Executable file

let pathname;   try {     pathname = new URL(path, 'http://x').pathname;

let pathname;   try {     pathname = new URL(path, 'http://x').pathname;

try {     pathname = new URL(path, 'http://x').pathname;   } catch {

try {     pathname = new URL(path, 'http://x').pathname;   } catch {

pathname = new URL(path, 'http://x').pathname;

pathname = new URL(path, 'http://x').pathname;

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

const API_RELS = new Set(['https://api.w.org/', 'edituri']);

const API_RELS = new Set(['https://api.w.org/', 'edituri']);

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

// // The request mirrors @vercel/blob 2.8.2's put() for a read-write token (dist/chunk-XKVPKJPO.js, // requestApi and createPutHeaders): PUT https://vercel.com/api/blob/?pathname=<key> with the raw

// // The request mirrors @vercel/blob 2.8.2's put() for a read-write token (dist/chunk-XKVPKJPO.js, // requestApi and createPutHeaders): PUT https://vercel.com/api/blob/?pathname=<key> with the raw

// The request mirrors @vercel/blob 2.8.2's put() for a read-write token (dist/chunk-XKVPKJPO.js, // requestApi and createPutHeaders): PUT https://vercel.com/api/blob/?pathname=<key> with the raw // body, x-api-version 13, the store id pars

// The request mirrors @vercel/blob 2.8.2's put() for a read-write token (dist/chunk-XKVPKJPO.js, // requestApi and createPutHeaders): PUT https://vercel.com/api/blob/?pathname=<key> with the raw // body, x-api-version 13, the store id pars

// requestApi and createPutHeaders): PUT https://vercel.com/api/blob/?pathname=<key> with the raw

// requestApi and createPutHeaders): PUT https://vercel.com/api/blob/?pathname=<key> with the raw

export const BLOB_ENDPOINT = 'https://vercel.com/api/blob';

export const BLOB_ENDPOINT = 'https://vercel.com/api/blob';

[Credential-related source omitted]

[Credential-related source omitted]

Executable file

Executable file

export function createR2Store({ env = process.env, endpoint } = {}) {   const base = (endpoint ?? `https://${env.R2_ACCOUNT_ID}.r2.cloudflarestorage.com`).replace(/\/+$/, '');

export function createR2Store({ env = process.env, endpoint } = {}) {   const base = (endpoint ?? `https://${env.R2_ACCOUNT_ID}.r2.cloudflarestorage.com`).replace(/\/+$/, '');

const base = (endpoint ?? `https://${env.R2_ACCOUNT_ID}.r2.cloudflarestorage.com`).replace(/\/+$/, '');

const base = (endpoint ?? `https://${env.R2_ACCOUNT_ID}.r2.cloudflarestorage.com`).replace(/\/+$/, '');

[Credential-related source omitted]

[Credential-related source omitted]

Executable file

Executable file

export async function fetchWithRetry(url, init, { delays = RETRY_DELAYS_MS } = {}) {   for (let attempt = 0; ; attempt += 1) {     const res = await fetch(url, init);

export async function fetchWithRetry(url, init, { delays = RETRY_DELAYS_MS } = {}) {   for (let attempt = 0; ; attempt += 1) {     const res = await fetch(url, init);

for (let attempt = 0; ; attempt += 1) {     const res = await fetch(url, init);     if (!retryable(res.status) || attempt >= delays.length) return res;

for (let attempt = 0; ; attempt += 1) {     const res = await fetch(url, init);     if (!retryable(res.status) || attempt >= delays.length) return res;

const res = await fetch(url, init);

const res = await fetch(url, init);

#!/usr/bin/env node

#!/usr/bin/env node

Appends to --out one "link" exception per href the links gate would find broken in a build that keeps the captured markup:   - every WordPress API head link of each page: wp-json/ (rel="https://api.w.org/"),

Appends to --out one "link" exception per href the links gate would find broken in a build that keeps the captured markup:   - every WordPress API head link of each page: wp-json/ (rel="https://api.w.org/"),

that keeps the captured markup:   - every WordPress API head link of each page: wp-json/ (rel="https://api.w.org/"),     xmlrpc.php?rsd (rel="EditURI"), wp-json/wp/v2/* (rel="alternate") and the oEmbed

that keeps the captured markup:   - every WordPress API head link of each page: wp-json/ (rel="https://api.w.org/"),     xmlrpc.php?rsd (rel="EditURI"), wp-json/wp/v2/* (rel="alternate") and the oEmbed

- every WordPress API head link of each page: wp-json/ (rel="https://api.w.org/"),

- every WordPress API head link of each page: wp-json/ (rel="https://api.w.org/"),

const meta = readJson(join(baseline, 'meta.json'), {});   const captureMeta = readJson(join(capture, 'meta.json'), {});   const origin = originOf(meta.canonicalOrigin ?? '') ?? originOf(meta.origin ?? '') ?? 'http://site.invalid';

const meta = readJson(join(baseline, 'meta.json'), {});   const captureMeta = readJson(join(capture, 'meta.json'), {});   const origin = originOf(meta.canonicalOrigin ?? '') ?? originOf(meta.origin ?? '') ?? 'http://site.invalid';

const captureMeta = readJson(join(capture, 'meta.json'), {});   const origin = originOf(meta.canonicalOrigin ?? '') ?? originOf(meta.origin ?? '') ?? 'http://site.invalid';   const internalOrigins = new Set([originOf(meta.origin ?? ''), ori

const captureMeta = readJson(join(capture, 'meta.json'), {});   const origin = originOf(meta.canonicalOrigin ?? '') ?? originOf(meta.origin ?? '') ?? 'http://site.invalid';   const internalOrigins = new Set([originOf(meta.origin ?? ''), ori

const origin = originOf(meta.canonicalOrigin ?? '') ?? originOf(meta.origin ?? '') ?? 'http://site.invalid';

const origin = originOf(meta.canonicalOrigin ?? '') ?? originOf(meta.origin ?? '') ?? 'http://site.invalid';

#!/usr/bin/env node

#!/usr/bin/env node

#!/usr/bin/env node

#!/usr/bin/env node

#!/usr/bin/env node

#!/usr/bin/env node

[Credential-related source omitted]

[Credential-related source omitted]

#!/usr/bin/env node

#!/usr/bin/env node

function pathnameOf(value) {   try {     return new URL(value, 'http://x.invalid').pathname;

function pathnameOf(value) {   try {     return new URL(value, 'http://x.invalid').pathname;

try {     return new URL(value, 'http://x.invalid').pathname;   } catch {

try {     return new URL(value, 'http://x.invalid').pathname;   } catch {

return new URL(value, 'http://x.invalid').pathname;

return new URL(value, 'http://x.invalid').pathname;

#!/usr/bin/env node

#!/usr/bin/env node

Serves <site>/dist/ at http://localhost:<port> for the review:* steps and applies <site>/vercel.json

Serves <site>/dist/ at http://localhost:<port> for the review:* steps and applies <site>/vercel.json

let upstream;   try {     upstream = await fetch(destination, { method: req.method, headers, redirect: 'follow' });

let upstream;   try {     upstream = await fetch(destination, { method: req.method, headers, redirect: 'follow' });

try {     upstream = await fetch(destination, { method: req.method, headers, redirect: 'follow' });   } catch (err) {

try {     upstream = await fetch(destination, { method: req.method, headers, redirect: 'follow' });   } catch (err) {

upstream = await fetch(destination, { method: req.method, headers, redirect: 'follow' });

upstream = await fetch(destination, { method: req.method, headers, redirect: 'follow' });

return res.end(`review-serve: ${err.message}\n`);     }     const url = new URL(req.url, 'http://localhost');

return res.end(`review-serve: ${err.message}\n`);     }     const url = new URL(req.url, 'http://localhost');

}     const url = new URL(req.url, 'http://localhost');     const { pathname: path, search } = url;

}     const url = new URL(req.url, 'http://localhost');     const { pathname: path, search } = url;

const url = new URL(req.url, 'http://localhost');

const url = new URL(req.url, 'http://localhost');

process.once('SIGTERM', stop);   process.once('SIGINT', stop);   console.log(`review-serve: serving ${dist} at http://localhost:${port}`);

process.once('SIGTERM', stop);   process.once('SIGINT', stop);   console.log(`review-serve: serving ${dist} at http://localhost:${port}`);

process.once('SIGINT', stop);   console.log(`review-serve: serving ${dist} at http://localhost:${port}`); }

process.once('SIGINT', stop);   console.log(`review-serve: serving ${dist} at http://localhost:${port}`); }

console.log(`review-serve: serving ${dist} at http://localhost:${port}`);

console.log(`review-serve: serving ${dist} at http://localhost:${port}`);

writeFileSync(join(dir, PID_FILE), `${child.pid}\n`);       child.unref();       console.log(`review-serve: running in the background (pid ${child.pid}) at http://localhost:${port}; stop it with --stop`);

writeFileSync(join(dir, PID_FILE), `${child.pid}\n`);       child.unref();       console.log(`review-serve: running in the background (pid ${child.pid}) at http://localhost:${port}; stop it with --stop`);

child.unref();       console.log(`review-serve: running in the background (pid ${child.pid}) at http://localhost:${port}; stop it with --stop`);       return;

child.unref();       console.log(`review-serve: running in the background (pid ${child.pid}) at http://localhost:${port}; stop it with --stop`);       return;

console.log(`review-serve: running in the background (pid ${child.pid}) at http://localhost:${port}; stop it with --stop`);

console.log(`review-serve: running in the background (pid ${child.pid}) at http://localhost:${port}; stop it with --stop`);

#!/usr/bin/env node

#!/usr/bin/env node

Executable file

Executable file

Executable file

Executable file

export STAGING_URL=""     export FORM_ENDPOINT="https://formspree.io/f/REPLACE"

export STAGING_URL=""     export FORM_ENDPOINT="https://formspree.io/f/REPLACE"

export FORM_ENDPOINT="https://formspree.io/f/REPLACE"

export FORM_ENDPOINT="https://formspree.io/f/REPLACE"

are not committed, so a fresh clone cannot run it; there, read the `npm run review:check`       output quoted in the pull request instead. With `npm run review:serve` running in a second terminal,       `npm run review:shoot -- --base http:

are not committed, so a fresh clone cannot run it; there, read the `npm run review:check`       output quoted in the pull request instead. With `npm run review:serve` running in a second terminal,       `npm run review:shoot -- --base http:

output quoted in the pull request instead. With `npm run review:serve` running in a second terminal,       `npm run review:shoot -- --base http://localhost:4321 --routes capture/templates.json --widths 390,768,1440 --out review/new`,       

output quoted in the pull request instead. With `npm run review:serve` running in a second terminal,       `npm run review:shoot -- --base http://localhost:4321 --routes capture/templates.json --widths 390,768,1440 --out review/new`,       

`npm run review:shoot -- --base http://localhost:4321 --routes capture/templates.json --widths 390,768,1440 --out review/new`,

`npm run review:shoot -- --base http://localhost:4321 --routes capture/templates.json --widths 390,768,1440 --out review/new`,

then `npm run review:diff -- --a capture/screens/live --b review/new --out review/diff`       exits 0,       `npm run review:styles -- --live {{ORIGIN}} --new http://localhost:4321 --routes capture/templates.json --widths 390,768,1440 --out

then `npm run review:diff -- --a capture/screens/live --b review/new --out review/diff`       exits 0,       `npm run review:styles -- --live {{ORIGIN}} --new http://localhost:4321 --routes capture/templates.json --widths 390,768,1440 --out

exits 0,       `npm run review:styles -- --live {{ORIGIN}} --new http://localhost:4321 --routes capture/templates.json --widths 390,768,1440 --out review/styles.json`       (it reads the live site, paced),

exits 0,       `npm run review:styles -- --live {{ORIGIN}} --new http://localhost:4321 --routes capture/templates.json --widths 390,768,1440 --out review/styles.json`       (it reads the live site, paced),

`npm run review:styles -- --live {{ORIGIN}} --new http://localhost:4321 --routes capture/templates.json --widths 390,768,1440 --out review/styles.json`

`npm run review:styles -- --live {{ORIGIN}} --new http://localhost:4321 --routes capture/templates.json --widths 390,768,1440 --out review/styles.json`

Executable file

Executable file; content unavailable

Executable file; content unavailable

Executable file; content unavailable

Executable file; content unavailable

Executable file; content unavailable

Executable file; content unavailable

Executable file; content unavailable

Executable file; content unavailable

Executable file; content unavailable

Executable file; content unavailable

Executable file; content unavailable

Executable file; content unavailable

Executable file; content unavailable

Executable file; content unavailable

Executable file

# Cloudflare Pages preview deployments (*.pages.dev) stay out of search; the production # host has no such rule, and the build adds a meta robots noindex unless PUBLIC_INDEXABLE=true. https://*.pages.dev/*

# Cloudflare Pages preview deployments (*.pages.dev) stay out of search; the production # host has no such rule, and the build adds a meta robots noindex unless PUBLIC_INDEXABLE=true. https://*.pages.dev/*

# host has no such rule, and the build adds a meta robots noindex unless PUBLIC_INDEXABLE=true. https://*.pages.dev/*   X-Robots-Tag: noindex

# host has no such rule, and the build adds a meta robots noindex unless PUBLIC_INDEXABLE=true. https://*.pages.dev/*   X-Robots-Tag: noindex

https://*.pages.dev/*

https://*.pages.dev/*

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

### `host.http-not-redirected` — high **Means.** Plain `http://` serves the site instead of redirecting to `https://`.

### `host.http-not-redirected` — high **Means.** Plain `http://` serves the site instead of redirecting to `https://`.

**Means.** Plain `http://` serves the site instead of redirecting to `https://`.

**Means.** Plain `http://` serves the site instead of redirecting to `https://`.

### `host.mixed-content` — high **Means.** A page served over https references a subresource — a script, a stylesheet, an image, an iframe — over plain `http://`.

### `host.mixed-content` — high **Means.** A page served over https references a subresource — a script, a stylesheet, an image, an iframe — over plain `http://`.

**Means.** A page served over https references a subresource — a script, a stylesheet, an image, an iframe — over plain `http://`. **At launch.** Browsers block active mixed content outright, so the script or stylesheet simply

**Means.** A page served over https references a subresource — a script, a stylesheet, an image, an iframe — over plain `http://`. **At launch.** Browsers block active mixed content outright, so the script or stylesheet simply

an iframe — over plain `http://`.

an iframe — over plain `http://`.

content (an image) loads with a warning and strips the padlock, which visitors read as "this site is not safe". **Fix.** Rewrite the reference to `https://`, or to a protocol-relative path if the asset lives on

content (an image) loads with a warning and strips the padlock, which visitors read as "this site is not safe". **Fix.** Rewrite the reference to `https://`, or to a protocol-relative path if the asset lives on

is not safe". **Fix.** Rewrite the reference to `https://`, or to a protocol-relative path if the asset lives on this site. Then find where the url came from — a hard-coded absolute url in a template, a CMS

is not safe". **Fix.** Rewrite the reference to `https://`, or to a protocol-relative path if the asset lives on this site. Then find where the url came from — a hard-coded absolute url in a template, a CMS

**Fix.** Rewrite the reference to `https://`, or to a protocol-relative path if the asset lives on

**Fix.** Rewrite the reference to `https://`, or to a protocol-relative path if the asset lives on

#!/usr/bin/env node

#!/usr/bin/env node

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

//   2. sitemaps            — discovery, then one-level expansion of the FIRST sitemap found //   3. crawl               — seeded with the start url and every expanded sitemap loc //   4. root variants       — http://host/, https://host/, t

//   2. sitemaps            — discovery, then one-level expansion of the FIRST sitemap found //   3. crawl               — seeded with the start url and every expanded sitemap loc //   4. root variants       — http://host/, https://host/, t

//   3. crawl               — seeded with the start url and every expanded sitemap loc //   4. root variants       — http://host/, https://host/, the apex root, the www counterpart when //                            the host is one that cou

//   3. crawl               — seeded with the start url and every expanded sitemap loc //   4. root variants       — http://host/, https://host/, the apex root, the www counterpart when //                            the host is one that cou

//   4. root variants       — http://host/, https://host/, the apex root, the www counterpart when

//   4. root variants       — http://host/, https://host/, the apex root, the www counterpart when

// off-origin from a host that exists to host forms, wherever it sits on the page. Off-origin is // required for the host-list branch, because a site *hosted* on one of those domains matches its // own host: `https://acme.netlify.app/widget

// off-origin from a host that exists to host forms, wherever it sits on the page. Off-origin is // required for the host-list branch, because a site *hosted* on one of those domains matches its // own host: `https://acme.netlify.app/widget

// required for the host-list branch, because a site *hosted* on one of those domains matches its // own host: `https://acme.netlify.app/widget.html` in an <iframe> is that site's own page, not an // embedded form. A same-origin script outs

// required for the host-list branch, because a site *hosted* on one of those domains matches its // own host: `https://acme.netlify.app/widget.html` in an <iframe> is that site's own page, not an // embedded form. A same-origin script outs

// own host: `https://acme.netlify.app/widget.html` in an <iframe> is that site's own page, not an

// own host: `https://acme.netlify.app/widget.html` in an <iframe> is that site's own page, not an

const wwwUrl = wwwCounterpart ? `${start.protocol}//${www}/` : null   const variantUrls = [     `http://${host}/`,

const wwwUrl = wwwCounterpart ? `${start.protocol}//${www}/` : null   const variantUrls = [     `http://${host}/`,

const variantUrls = [     `http://${host}/`,     `https://${host}/`,

const variantUrls = [     `http://${host}/`,     `https://${host}/`,

`http://${host}/`,

`http://${host}/`,

`https://${host}/`,

`https://${host}/`,

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

return [emit(httpNotRedirected, {       page: probe.url,       detail: 'The http:// origin serves the site rather than redirecting to https://. Anyone who types the bare domain, or follows an old link, gets an unencrypted page.',

return [emit(httpNotRedirected, {       page: probe.url,       detail: 'The http:// origin serves the site rather than redirecting to https://. Anyone who types the bare domain, or follows an old link, gets an unencrypted page.',

page: probe.url,       detail: 'The http:// origin serves the site rather than redirecting to https://. Anyone who types the bare domain, or follows an old link, gets an unencrypted page.',       evidence: [url(probe.url), status(`HTTP ${pr

page: probe.url,       detail: 'The http:// origin serves the site rather than redirecting to https://. Anyone who types the bare domain, or follows an old link, gets an unencrypted page.',       evidence: [url(probe.url), status(`HTTP ${pr

detail: 'The http:// origin serves the site rather than redirecting to https://. Anyone who types the bare domain, or follows an old link, gets an unencrypted page.',

detail: 'The http:// origin serves the site rather than redirecting to https://. Anyone who types the bare domain, or follows an old link, gets an unencrypted page.',

detail: `The upgrade to https answers ${first.status}, a temporary redirect. Browsers and search engines keep asking for the http url instead of remembering the move.`,       evidence: [url(probe.url), status(`HTTP ${first.status} → ${resol

detail: `The upgrade to https answers ${first.status}, a temporary redirect. Browsers and search engines keep asking for the http url instead of remembering the move.`,       evidence: [url(probe.url), status(`HTTP ${first.status} → ${resol

evidence: [url(probe.url), status(`HTTP ${first.status} → ${resolveHop(first.location, first.url) ?? first.location}`)],       fix: 'Return 301 (or 308) from http:// to https://.',     })]

evidence: [url(probe.url), status(`HTTP ${first.status} → ${resolveHop(first.location, first.url) ?? first.location}`)],       fix: 'Return 301 (or 308) from http:// to https://.',     })]

fix: 'Return 301 (or 308) from http:// to https://.',

fix: 'Return 301 (or 308) from http:// to https://.',

if (!ctx.cert || ctx.cert.valid === true) return []     return [emit(certInvalid, {       page: `https://${ctx.target.host}/`,

if (!ctx.cert || ctx.cert.valid === true) return []     return [emit(certInvalid, {       page: `https://${ctx.target.host}/`,

return [emit(certInvalid, {       page: `https://${ctx.target.host}/`,       detail: 'The certificate served for this host does not validate, so every visitor gets an interstitial security warning before they see anything.',

return [emit(certInvalid, {       page: `https://${ctx.target.host}/`,       detail: 'The certificate served for this host does not validate, so every visitor gets an interstitial security warning before they see anything.',

page: `https://${ctx.target.host}/`,

page: `https://${ctx.target.host}/`,

detail: 'The certificate served for this host does not validate, so every visitor gets an interstitial security warning before they see anything.',       evidence: [         url(`https://${ctx.target.host}/`),

detail: 'The certificate served for this host does not validate, so every visitor gets an interstitial security warning before they see anything.',       evidence: [         url(`https://${ctx.target.host}/`),

evidence: [         url(`https://${ctx.target.host}/`),         cert(`certificate for ${ctx.target.host} did not validate${ctx.cert.error ? `: ${ctx.cert.error}` : ''}`),

evidence: [         url(`https://${ctx.target.host}/`),         cert(`certificate for ${ctx.target.host} did not validate${ctx.cert.error ? `: ${ctx.cert.error}` : ''}`),

url(`https://${ctx.target.host}/`),

url(`https://${ctx.target.host}/`),

if (days === null || days === undefined || days >= CERT_EXPIRY_DAYS) return []     return [emit(certExpiring, {       page: `https://${ctx.target.host}/`,

if (days === null || days === undefined || days >= CERT_EXPIRY_DAYS) return []     return [emit(certExpiring, {       page: `https://${ctx.target.host}/`,

return [emit(certExpiring, {       page: `https://${ctx.target.host}/`,       detail: `The certificate expires in ${days} day${days === 1 ? '' : 's'}. When it does, the site goes down behind a browser warning.`,

return [emit(certExpiring, {       page: `https://${ctx.target.host}/`,       detail: `The certificate expires in ${days} day${days === 1 ? '' : 's'}. When it does, the site goes down behind a browser warning.`,

page: `https://${ctx.target.host}/`,

page: `https://${ctx.target.host}/`,

detail: `The certificate expires in ${days} day${days === 1 ? '' : 's'}. When it does, the site goes down behind a browser warning.`,       evidence: [         url(`https://${ctx.target.host}/`),

detail: `The certificate expires in ${days} day${days === 1 ? '' : 's'}. When it does, the site goes down behind a browser warning.`,       evidence: [         url(`https://${ctx.target.host}/`),

evidence: [         url(`https://${ctx.target.host}/`),         cert(`${days} days left (notAfter ${ctx.cert.validTo ?? 'unknown'})`),

evidence: [         url(`https://${ctx.target.host}/`),         cert(`${days} days left (notAfter ${ctx.cert.validTo ?? 'unknown'})`),

url(`https://${ctx.target.host}/`),

url(`https://${ctx.target.host}/`),

if (uncovered.length === 0) return []     return [emit(certMissingSan, {       page: `https://${ctx.target.host}/`,

if (uncovered.length === 0) return []     return [emit(certMissingSan, {       page: `https://${ctx.target.host}/`,

return [emit(certMissingSan, {       page: `https://${ctx.target.host}/`,       detail: `The certificate's subject alternative names do not cover ${uncovered.join(' or ')}. Any visitor who reaches an uncovered host gets a name-mismatch warn

return [emit(certMissingSan, {       page: `https://${ctx.target.host}/`,       detail: `The certificate's subject alternative names do not cover ${uncovered.join(' or ')}. Any visitor who reaches an uncovered host gets a name-mismatch warn

page: `https://${ctx.target.host}/`,

page: `https://${ctx.target.host}/`,

detail: `The certificate's subject alternative names do not cover ${uncovered.join(' or ')}. Any visitor who reaches an uncovered host gets a name-mismatch warning.`,       evidence: [         url(`https://${ctx.target.host}/`),

detail: `The certificate's subject alternative names do not cover ${uncovered.join(' or ')}. Any visitor who reaches an uncovered host gets a name-mismatch warning.`,       evidence: [         url(`https://${ctx.target.host}/`),

evidence: [         url(`https://${ctx.target.host}/`),         cert(`altNames: ${names.join(', ')}`),

evidence: [         url(`https://${ctx.target.host}/`),         cert(`altNames: ${names.join(', ')}`),

url(`https://${ctx.target.host}/`),

url(`https://${ctx.target.host}/`),

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

// // `ctx.target.url` is what the operator typed; the crawl seeds through `normalizeUrl()`, which // strips the fragment. A person who pastes `https://example.com/#top` out of a browser's address

// // `ctx.target.url` is what the operator typed; the crawl seeds through `normalizeUrl()`, which // strips the fragment. A person who pastes `https://example.com/#top` out of a browser's address

// `ctx.target.url` is what the operator typed; the crawl seeds through `normalizeUrl()`, which // strips the fragment. A person who pastes `https://example.com/#top` out of a browser's address // bar therefore had the two compared by equal

// `ctx.target.url` is what the operator typed; the crawl seeds through `normalizeUrl()`, which // strips the fragment. A person who pastes `https://example.com/#top` out of a browser's address // bar therefore had the two compared by equal

// strips the fragment. A person who pastes `https://example.com/#top` out of a browser's address

// strips the fragment. A person who pastes `https://example.com/#top` out of a browser's address

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

const src = typeof text === 'string' ? text.replace(/^<U+FEFF>/, '') : String(text ?? '')

const src = typeof text === 'string' ? text.replace(/^<U+FEFF>/, '') : String(text ?? '')

Executable file

Executable file

[Credential-related source omitted]

[Credential-related source omitted]

Executable file

Executable file

//   every field, and the checks that would have used those fields skip with a reason. A wrong //   framework hint sends somebody looking for a sitemap integration nobody configured. // - **Regexes read config, they do not evaluate it.** `s

//   every field, and the checks that would have used those fields skip with a reason. A wrong //   framework hint sends somebody looking for a sitemap integration nobody configured. // - **Regexes read config, they do not evaluate it.** `s

//   framework hint sends somebody looking for a sitemap integration nobody configured. // - **Regexes read config, they do not evaluate it.** `site: 'https://x'` written across two lines //   or built from a variable is simply not found, w

//   framework hint sends somebody looking for a sitemap integration nobody configured. // - **Regexes read config, they do not evaluate it.** `site: 'https://x'` written across two lines //   or built from a variable is simply not found, w

// - **Regexes read config, they do not evaluate it.** `site: 'https://x'` written across two lines

// - **Regexes read config, they do not evaluate it.** `site: 'https://x'` written across two lines

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

{   "fetched": "2026-09-13",   "source": "https://github.com/OWASP/www-project-secure-headers (ci/headers_add.json, ci/headers_remove.json)",

{   "fetched": "2026-09-13",   "source": "https://github.com/OWASP/www-project-secure-headers (ci/headers_add.json, ci/headers_remove.json)",

"fetched": "2026-09-13",   "source": "https://github.com/OWASP/www-project-secure-headers (ci/headers_add.json, ci/headers_remove.json)",   "add": [

"fetched": "2026-09-13",   "source": "https://github.com/OWASP/www-project-secure-headers (ci/headers_add.json, ci/headers_remove.json)",   "add": [

"source": "https://github.com/OWASP/www-project-secure-headers (ci/headers_add.json, ci/headers_remove.json)",

"source": "https://github.com/OWASP/www-project-secure-headers (ci/headers_add.json, ci/headers_remove.json)",

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

export const USER_AGENT = 'website-launch-skills/0.1 (+https://github.com/ethanplusai/website-launch-skills)'

export const USER_AGENT = 'website-launch-skills/0.1 (+https://github.com/ethanplusai/website-launch-skills)'

Executable file

Executable file

// The fixture shape is a flat map of absolute url to recording: // //   { "https://example.test/": { "status": 200, "headers": {...}, "body": "<html>…" } }

// The fixture shape is a flat map of absolute url to recording: // //   { "https://example.test/": { "status": 200, "headers": {...}, "body": "<html>…" } }

// //   { "https://example.test/": { "status": 200, "headers": {...}, "body": "<html>…" } } //

// //   { "https://example.test/": { "status": 200, "headers": {...}, "body": "<html>…" } } //

//   { "https://example.test/": { "status": 200, "headers": {...}, "body": "<html>…" } }

//   { "https://example.test/": { "status": 200, "headers": {...}, "body": "<html>…" } }

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

// returns one entry per typed node: // //   { type: 'Organization', missing: ['url'], urlsToVerify: ['https://acme.test/logo.png'] }

// returns one entry per typed node: // //   { type: 'Organization', missing: ['url'], urlsToVerify: ['https://acme.test/logo.png'] }

// //   { type: 'Organization', missing: ['url'], urlsToVerify: ['https://acme.test/logo.png'] } //

// //   { type: 'Organization', missing: ['url'], urlsToVerify: ['https://acme.test/logo.png'] } //

//   { type: 'Organization', missing: ['url'], urlsToVerify: ['https://acme.test/logo.png'] }

//   { type: 'Organization', missing: ['url'], urlsToVerify: ['https://acme.test/logo.png'] }

Executable file

Executable file

Executable file

Executable file

A captured row (any `source` but `decision`) is a live URL and holds no parameters: for Vercel every `:` and `*` in it is escaped (`/foo:bar/` is written `/foo\:bar/`, and so is `/trackshttps://www.example.com/x/`, a broken live href the ca

A captured row (any `source` but `decision`) is a live URL and holds no parameters: for Vercel every `:` and `*` in it is escaped (`/foo:bar/` is written `/foo\:bar/`, and so is `/trackshttps://www.example.com/x/`, a broken live href the ca

every `:` and `*` in it is escaped (`/foo:bar/` is written `/foo\:bar/`, and so is `/trackshttps://www.example.com/x/`, a broken live href the capture followed); `//` is kept. Only a `decision` row uses `:name` parameters and `*` splats, an

every `:` and `*` in it is escaped (`/foo:bar/` is written `/foo\:bar/`, and so is `/trackshttps://www.example.com/x/`, a broken live href the capture followed); `//` is kept. Only a `decision` row uses `:name` parameters and `*` splats, an

`/trackshttps://www.example.com/x/`, a broken live href the capture followed); `//` is kept.

`/trackshttps://www.example.com/x/`, a broken live href the capture followed); `//` is kept.

npm run build     npm run verify -- --endpoint https://forms.example.com/f/abc --thank-you /thank-you/

npm run build     npm run verify -- --endpoint https://forms.example.com/f/abc --thank-you /thank-you/

npm run verify -- --endpoint https://forms.example.com/f/abc --thank-you /thank-you/

npm run verify -- --endpoint https://forms.example.com/f/abc --thank-you /thank-you/

node <skill-dir>/scripts/verify/run-all.mjs --endpoint https://forms.example.com/f/abc --thank-you /thank-you/    # fallback

node <skill-dir>/scripts/verify/run-all.mjs --endpoint https://forms.example.com/f/abc --thank-you /thank-you/    # fallback

|---|---|---| | `forms` | Each live form is on its page with the same field names in order and method; a POST form's action is `--endpoint` and it carries `--honeypot`; a GET form (a search box) keeps live's action path and needs neither ("

|---|---|---| | `forms` | Each live form is on its page with the same field names in order and method; a POST form's action is `--endpoint` and it carries `--honeypot`; a GET form (a search box) keeps live's action path and needs neither ("

| `forms` | Each live form is on its page with the same field names in order and method; a POST form's action is `--endpoint` and it carries `--honeypot`; a GET form (a search box) keeps live's action path and needs neither ("N search/GET f

| `forms` | Each live form is on its page with the same field names in order and method; a POST form's action is `--endpoint` and it carries `--honeypot`; a GET form (a search box) keeps live's action path and needs neither ("N search/GET f

| `headers` | Host config sends nosniff, Referrer-Policy, X-Frame-Options or CSP frame-ancestors on every path, and, when not indexable, `X-Robots-Tag: noindex` on every path or (Vercel) the meta robots noindex on every built page; a previe

| `headers` | Host config sends nosniff, Referrer-Policy, X-Frame-Options or CSP frame-ancestors on every path, and, when not indexable, `X-Robots-Tag: noindex` on every path or (Vercel) the meta robots noindex on every built page; a previe

npm run verify:live -- --base https://my-site.vercel.app --expect-noindex

npm run verify:live -- --base https://my-site.vercel.app --expect-noindex

node <skill-dir>/scripts/verify-live.mjs --base https://my-site.vercel.app --expect-noindex    # fallback

node <skill-dir>/scripts/verify-live.mjs --base https://my-site.vercel.app --expect-noindex    # fallback

[Credential-related source omitted]

[Credential-related source omitted]

{ "/about/": { "title": "About Us | Example", "description": "...", "canonical": "https://www.example.com/about/",

{ "/about/": { "title": "About Us | Example", "description": "...", "canonical": "https://www.example.com/about/",

{ "/contact/": [{ "action": "https://www.example.com/wp-admin/admin-post.php", "method": "post",

{ "/contact/": [{ "action": "https://www.example.com/wp-admin/admin-post.php", "method": "post",

[{ "src": "https://www.example.com/wp-content/themes/x/js/menu.js?ver=1.2", "file": "js/1.js",

[{ "src": "https://www.example.com/wp-content/themes/x/js/menu.js?ver=1.2", "file": "js/1.js",

[{ "href": "https://www.example.com/wp-content/themes/x/style.css?ver=1.2", "file": "css/1.css",

[{ "href": "https://www.example.com/wp-content/themes/x/style.css?ver=1.2", "file": "css/1.css",

{ "origin": "https://www.example.com", "canonicalOrigin": "https://www.example.com",

{ "origin": "https://www.example.com", "canonicalOrigin": "https://www.example.com",

| `text` | text | the page | a phrase in the captured text (or all of it) / its replacement | | `link` | links | the page | the live href (recorded, not compared) / the built href the gate reports as broken | | `redirect` | redirects | the 

| `text` | text | the page | a phrase in the captured text (or all of it) / its replacement | | `link` | links | the page | the live href (recorded, not compared) / the built href the gate reports as broken | | `redirect` | redirects | the 

| `link` | links | the page | the live href (recorded, not compared) / the built href the gate reports as broken | | `redirect` | redirects | the redirect source | the baseline target with the site's origin stripped (`/services/`, not `http

| `link` | links | the page | the live href (recorded, not compared) / the built href the gate reports as broken | | `redirect` | redirects | the redirect source | the baseline target with the site's origin stripped (`/services/`, not `http

| `redirect` | redirects | the redirect source | the baseline target with the site's origin stripped (`/services/`, not `https://www.example.com/services/`) / the new target |

| `redirect` | redirects | the redirect source | the baseline target with the site's origin stripped (`/services/`, not `https://www.example.com/services/`) / the new target |

| `media` | media | the media path | the baseline bytes (a number) / the built bytes, or `""` for a file the build drops | | `markup` | none | the page | a description of the markup before / after (`<a href="https://www.example.com/contact/

| `media` | media | the media path | the baseline bytes (a number) / the built bytes, or `""` for a file the build drops | | `markup` | none | the page | a description of the markup before / after (`<a href="https://www.example.com/contact/

| `markup` | none | the page | a description of the markup before / after (`<a href="https://www.example.com/contact/">` / `<a href="/contact/">`) |

| `markup` | none | the page | a description of the markup before / after (`<a href="https://www.example.com/contact/">` / `<a href="/contact/">`) |

{ "kind": "redirect", "path": "/trackshttps://www.example.com/exhibitor-contact/",

{ "kind": "redirect", "path": "/trackshttps://www.example.com/exhibitor-contact/",

#!/usr/bin/env node

#!/usr/bin/env node

#!/usr/bin/env node

#!/usr/bin/env node

// Escape path-to-regexp's special characters, keeping :name, :name*, :name+ and :name? parameters // (a name starts with a letter or "_"). Any other ":" (/trackshttps://..., a port :8080) becomes

// Escape path-to-regexp's special characters, keeping :name, :name*, :name+ and :name? parameters // (a name starts with a letter or "_"). Any other ":" (/trackshttps://..., a port :8080) becomes

// (a name starts with a letter or "_"). Any other ":" (/trackshttps://..., a port :8080) becomes

// (a name starts with a letter or "_"). Any other ":" (/trackshttps://..., a port :8080) becomes

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

let pathname;   try {     pathname = new URL(path, 'http://x').pathname;

let pathname;   try {     pathname = new URL(path, 'http://x').pathname;

try {     pathname = new URL(path, 'http://x').pathname;   } catch {

try {     pathname = new URL(path, 'http://x').pathname;   } catch {

pathname = new URL(path, 'http://x').pathname;

pathname = new URL(path, 'http://x').pathname;

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

const [header, ...rows] = parseCsvText(text.replace(/^<U+FEFF>/, ''));

const [header, ...rows] = parseCsvText(text.replace(/^<U+FEFF>/, ''));

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

.replace(/<U+00AD>/g, '')

.replace(/<U+00AD>/g, '')

#!/usr/bin/env node

#!/usr/bin/env node

--base <url>            the deploy to check, e.g. https://my-site.vercel.app (required)

--base <url>            the deploy to check, e.g. https://my-site.vercel.app (required)

// Vercel Authentication answers a request without a valid bypass with a 302 to // https://vercel.com/sso-api?url=...: any redirect to a vercel.com host whose URL names sso-api.

// Vercel Authentication answers a request without a valid bypass with a 302 to // https://vercel.com/sso-api?url=...: any redirect to a vercel.com host whose URL names sso-api.

// https://vercel.com/sso-api?url=...: any redirect to a vercel.com host whose URL names sso-api.

// https://vercel.com/sso-api?url=...: any redirect to a vercel.com host whose URL names sso-api.

#!/usr/bin/env node

#!/usr/bin/env node

export function actionTarget(action, page, origins = []) {   const base = 'http://forms.invalid';

export function actionTarget(action, page, origins = []) {   const base = 'http://forms.invalid';

const base = 'http://forms.invalid';

const base = 'http://forms.invalid';

const action = (form.action ?? '').trim();   if (!action) return null;   const base = origins[0] ?? 'http://forms.invalid';

const action = (form.action ?? '').trim();   if (!action) return null;   const base = origins[0] ?? 'http://forms.invalid';

if (!action) return null;   const base = origins[0] ?? 'http://forms.invalid';   let url;

if (!action) return null;   const base = origins[0] ?? 'http://forms.invalid';   let url;

const base = origins[0] ?? 'http://forms.invalid';

const base = origins[0] ?? 'http://forms.invalid';

#!/usr/bin/env node

#!/usr/bin/env node

Only rules for every path count: vercel.json sources /(.*), /:path* and /:path(.*) without has/missing conditions, and the _headers path /*. A _headers whole-host pattern such as https://*.pages.dev/* counts only as the preview host's noind

Only rules for every path count: vercel.json sources /(.*), /:path* and /:path(.*) without has/missing conditions, and the _headers path /*. A _headers whole-host pattern such as https://*.pages.dev/* counts only as the preview host's noind

has/missing conditions, and the _headers path /*. A _headers whole-host pattern such as https://*.pages.dev/* counts only as the preview host's noindex: it meets the noindex requirement, and is ignored when PUBLIC_INDEXABLE=true. PUBLIC_IND

has/missing conditions, and the _headers path /*. A _headers whole-host pattern such as https://*.pages.dev/* counts only as the preview host's noindex: it meets the noindex requirement, and is ignored when PUBLIC_INDEXABLE=true. PUBLIC_IND

https://*.pages.dev/* counts only as the preview host's noindex: it meets the

https://*.pages.dev/* counts only as the preview host's noindex: it meets the

// The same from a _headers file: a path line, then indented "Name: value" lines. Headers of a // whole-host pattern (https://*.pages.dev/*) go to hostHeaders: they cover that host only.

// The same from a _headers file: a path line, then indented "Name: value" lines. Headers of a // whole-host pattern (https://*.pages.dev/*) go to hostHeaders: they cover that host only.

// whole-host pattern (https://*.pages.dev/*) go to hostHeaders: they cover that host only.

// whole-host pattern (https://*.pages.dev/*) go to hostHeaders: they cover that host only.

#!/usr/bin/env node

#!/usr/bin/env node

mediaPaths: new Set(media.map((m) => decode(m.path))),   };   const base = 'http://links.invalid';

mediaPaths: new Set(media.map((m) => decode(m.path))),   };   const base = 'http://links.invalid';

};   const base = 'http://links.invalid';   const internal = new Set([base, originOf(origin), originOf(meta.origin ?? ''), originOf(meta.canonicalOrigin ?? '')].filter(Boolean));

};   const base = 'http://links.invalid';   const internal = new Set([base, originOf(origin), originOf(meta.origin ?? ''), originOf(meta.canonicalOrigin ?? '')].filter(Boolean));

const base = 'http://links.invalid';

const base = 'http://links.invalid';

const args = gateArgs(process.argv.slice(2), NAME, { options: OPTIONS, notes: NOTES });   if (args.origin && !originOf(args.origin)) {     process.stderr.write(`${NAME}: --origin must be a URL such as https://www.example.com, got ${args.ori

const args = gateArgs(process.argv.slice(2), NAME, { options: OPTIONS, notes: NOTES });   if (args.origin && !originOf(args.origin)) {     process.stderr.write(`${NAME}: --origin must be a URL such as https://www.example.com, got ${args.ori

if (args.origin && !originOf(args.origin)) {     process.stderr.write(`${NAME}: --origin must be a URL such as https://www.example.com, got ${args.origin}\n`);     process.exit(2);

if (args.origin && !originOf(args.origin)) {     process.stderr.write(`${NAME}: --origin must be a URL such as https://www.example.com, got ${args.origin}\n`);     process.exit(2);

process.stderr.write(`${NAME}: --origin must be a URL such as https://www.example.com, got ${args.origin}\n`);

process.stderr.write(`${NAME}: --origin must be a URL such as https://www.example.com, got ${args.origin}\n`);

#!/usr/bin/env node

#!/usr/bin/env node

#!/usr/bin/env node

#!/usr/bin/env node

#!/usr/bin/env node

#!/usr/bin/env node

#!/usr/bin/env node

#!/usr/bin/env node

#!/usr/bin/env node

#!/usr/bin/env node

#!/usr/bin/env node

#!/usr/bin/env node

const args = gateArgs(process.argv.slice(2), NAME, { options: OPTIONS, notes: NOTES });   if (args.origin && !originOf(args.origin)) {     process.stderr.write(`${NAME}: --origin must be a URL such as https://www.example.com, got ${args.ori

const args = gateArgs(process.argv.slice(2), NAME, { options: OPTIONS, notes: NOTES });   if (args.origin && !originOf(args.origin)) {     process.stderr.write(`${NAME}: --origin must be a URL such as https://www.example.com, got ${args.ori

if (args.origin && !originOf(args.origin)) {     process.stderr.write(`${NAME}: --origin must be a URL such as https://www.example.com, got ${args.origin}\n`);     process.exit(2);

if (args.origin && !originOf(args.origin)) {     process.stderr.write(`${NAME}: --origin must be a URL such as https://www.example.com, got ${args.origin}\n`);     process.exit(2);

process.stderr.write(`${NAME}: --origin must be a URL such as https://www.example.com, got ${args.origin}\n`);

process.stderr.write(`${NAME}: --origin must be a URL such as https://www.example.com, got ${args.origin}\n`);

#!/usr/bin/env node

#!/usr/bin/env node

const args = gateArgs(process.argv.slice(2), NAME, { options: OPTIONS, notes: NOTES });   if (args.origin && !originOf(args.origin)) {     process.stderr.write(`${NAME}: --origin must be a URL such as https://www.example.com, got ${args.ori

const args = gateArgs(process.argv.slice(2), NAME, { options: OPTIONS, notes: NOTES });   if (args.origin && !originOf(args.origin)) {     process.stderr.write(`${NAME}: --origin must be a URL such as https://www.example.com, got ${args.ori

if (args.origin && !originOf(args.origin)) {     process.stderr.write(`${NAME}: --origin must be a URL such as https://www.example.com, got ${args.origin}\n`);     process.exit(2);

if (args.origin && !originOf(args.origin)) {     process.stderr.write(`${NAME}: --origin must be a URL such as https://www.example.com, got ${args.origin}\n`);     process.exit(2);

process.stderr.write(`${NAME}: --origin must be a URL such as https://www.example.com, got ${args.origin}\n`);

process.stderr.write(`${NAME}: --origin must be a URL such as https://www.example.com, got ${args.origin}\n`);

#!/usr/bin/env node

#!/usr/bin/env node

Executable file

Executable file

if (wrong.length === 0) continue       out.push(emit(dnsUnexpected, {         page: `https://${host}/`,

if (wrong.length === 0) continue       out.push(emit(dnsUnexpected, {         page: `https://${host}/`,

out.push(emit(dnsUnexpected, {         page: `https://${host}/`,         detail: `${wrong.length} of the ${answers.length} public resolvers that answered for ${host} do not carry ${expected.join(', ')}. Until every resolver has it, some sha

out.push(emit(dnsUnexpected, {         page: `https://${host}/`,         detail: `${wrong.length} of the ${answers.length} public resolvers that answered for ${host} do not carry ${expected.join(', ')}. Until every resolver has it, some sha

page: `https://${host}/`,

page: `https://${host}/`,

catches: 'A certificate that did not validate, or that was issued before the host moved and never covered it — every visitor gets an interstitial warning.',   run(ctx) {     const at = `https://${ctx.target.host}/`

catches: 'A certificate that did not validate, or that was issued before the host moved and never covered it — every visitor gets an interstitial warning.',   run(ctx) {     const at = `https://${ctx.target.host}/`

const at = `https://${ctx.target.host}/`

const at = `https://${ctx.target.host}/`

status(chain.length === 0 ? `HTTP ${probe.status} with no redirect` : `HTTP ${first.status} → ${probe.finalUrl}`),       ],       fix: 'Return 301 (or 308) from every http:// url to the same path on https://, at the edge rather than in the 

status(chain.length === 0 ? `HTTP ${probe.status} with no redirect` : `HTTP ${first.status} → ${probe.finalUrl}`),       ],       fix: 'Return 301 (or 308) from every http:// url to the same path on https://, at the edge rather than in the 

],       fix: 'Return 301 (or 308) from every http:// url to the same path on https://, at the edge rather than in the application.',     })]

],       fix: 'Return 301 (or 308) from every http:// url to the same path on https://, at the edge rather than in the application.',     })]

fix: 'Return 301 (or 308) from every http:// url to the same path on https://, at the edge rather than in the application.',

fix: 'Return 301 (or 308) from every http:// url to the same path on https://, at the edge rather than in the application.',

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

#!/usr/bin/env node

#!/usr/bin/env node

{   "production-url": "https://ridgeline-survey.example",

{   "production-url": "https://ridgeline-survey.example",

"production-url": "https://ridgeline-survey.example",

"production-url": "https://ridgeline-survey.example",

"predecessor-url": "https://old.ridgeline-survey.example",

"predecessor-url": "https://old.ridgeline-survey.example",

| Astro | `astro` dep, or `astro.config.*` | `dist` | `site: '…'` | `@astrojs/sitemap` in deps or config | `sitemap-index.xml` | | Next | `next` dep, or `next.config.*` | `.next` | `siteUrl: '…'` (config, or `next-sitemap.config.js`) | `nex

| Astro | `astro` dep, or `astro.config.*` | `dist` | `site: '…'` | `@astrojs/sitemap` in deps or config | `sitemap-index.xml` | | Next | `next` dep, or `next.config.*` | `.next` | `siteUrl: '…'` (config, or `next-sitemap.config.js`) | `nex

| Next | `next` dep, or `next.config.*` | `.next` | `siteUrl: '…'` (config, or `next-sitemap.config.js`) | `next-sitemap` dep | `sitemap.xml` | | Nuxt | `nuxt` dep, or `nuxt.config.*` | `.output/public` | `siteUrl:` / `url: 'https://…'` | `

| Next | `next` dep, or `next.config.*` | `.next` | `siteUrl: '…'` (config, or `next-sitemap.config.js`) | `next-sitemap` dep | `sitemap.xml` | | Nuxt | `nuxt` dep, or `nuxt.config.*` | `.output/public` | `siteUrl:` / `url: 'https://…'` | `

| Nuxt | `nuxt` dep, or `nuxt.config.*` | `.output/public` | `siteUrl:` / `url: 'https://…'` | `@nuxtjs/sitemap`, `nuxt-simple-sitemap` | `sitemap.xml` |

| Nuxt | `nuxt` dep, or `nuxt.config.*` | `.output/public` | `siteUrl:` / `url: 'https://…'` | `@nuxtjs/sitemap`, `nuxt-simple-sitemap` | `sitemap.xml` |

Executable file

Executable file

Executable file

Executable file

//   exec(cmd, args, { cwd, env }) → { code, stdout, stderr }   never throws

//   exec(cmd, args, { cwd, env }) → { code, stdout, stderr }   never throws

return function exec(cmd, args = [], { cwd, env } = {}) {

return function exec(cmd, args = [], { cwd, env } = {}) {

const run = (...args) => exec('git', args, { cwd: dir })

const run = (...args) => exec('git', args, { cwd: dir })

[Credential-related source omitted]

[Credential-related source omitted]

const command = `${pm} run build   const result = exec(pm, ['run', 'build'], { cwd: dir })

const command = `${pm} run build   const result = exec(pm, ['run', 'build'], { cwd: dir })

const result = exec(pm, ['run', 'build'], { cwd: dir })

const result = exec(pm, ['run', 'build'], { cwd: dir })

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

[Credential-related source omitted]

[Credential-related source omitted]

fix: 'git rm --cached the file, add it to .gitignore, rotate every credential it held, and keep a .env.example instead.',

fix: 'git rm --cached the file, add it to .gitignore, rotate every credential it held, and keep a .env.example instead.',

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

#!/usr/bin/env node

#!/usr/bin/env node

| `broken-links` | links | internal links and sitemap entries that answer 4xx/5xx, plus any `links.json` `broken` list | status and linking pages | S | low | no | | `redirect-chains` | links | redirects with intermediate hops | the chain fr

| `broken-links` | links | internal links and sitemap entries that answer 4xx/5xx, plus any `links.json` `broken` list | status and linking pages | S | low | no | | `redirect-chains` | links | redirects with intermediate hops | the chain fr

| `redirect-chains` | links | redirects with intermediate hops | the chain from `redirects.json` `hops[]` | S | low | yes | | `http-links` | links | external links written `http://`; on an https site, an http canonical or og:url | the links

| `redirect-chains` | links | redirects with intermediate hops | the chain from `redirects.json` `hops[]` | S | low | yes | | `http-links` | links | external links written `http://`; on an https site, an http canonical or og:url | the links

| `http-links` | links | external links written `http://`; on an https site, an http canonical or og:url | the links | S | low | yes |

| `http-links` | links | external links written `http://`; on an https site, an http canonical or og:url | the links | S | low | yes |

Executable file

Executable file

Executable file