jekyll-agent-audit 0.1.0

data/lib/jekyll/agent_audit/rules/publication.rb

@@ -0,0 +1,186 @@
+# frozen_string_literal: true
+
+require "uri"
+
+module Jekyll
+  module AgentAudit
+    module Rules
+      module Publication
+        IDS = %w[
+          architecture.output_collision links.target_missing links.fragment_missing architecture.orphan
+          identity.canonical_invalid identity.canonical_multiple identity.canonical_target_missing
+          structure.title_missing structure.h1_absent structure.heading_empty structure.heading_jump
+          structure.id_duplicate structure.link_unnamed
+        ].freeze
+
+        SEVERITIES = {
+          "architecture.output_collision" => :error, "links.target_missing" => :error,
+          "links.fragment_missing" => :error, "architecture.orphan" => :warning,
+          "identity.canonical_invalid" => :error, "identity.canonical_multiple" => :error,
+          "identity.canonical_target_missing" => :error, "structure.title_missing" => :warning,
+          "structure.h1_absent" => :info, "structure.heading_empty" => :warning,
+          "structure.heading_jump" => :info, "structure.id_duplicate" => :error,
+          "structure.link_unnamed" => :warning
+        }.freeze
+
+        module_function
+
+        def evaluate(id, document, context)
+          return {status: :skipped, findings: [], reason: :unknown_rule} unless IDS.include?(id)
+          return collision(context) if id == "architecture.output_collision"
+          if document && document[:redirect] && %w[architecture.orphan structure.title_missing structure.h1_absent structure.heading_empty structure.heading_jump structure.id_duplicate structure.link_unnamed].include?(id)
+            return {status: :not_applicable, findings: [], reason: :redirect}
+          end
+          if document && !document[:content_confident] && %w[structure.h1_absent structure.heading_empty structure.heading_jump].include?(id)
+            return {status: :skipped, findings: [], reason: :content_extraction_uncertain}
+          end
+          return {status: :evaluated, findings: public_send(id.tr(".", "_"), document, context)}
+        end
+
+        def architecture_output_collision(_document, context)
+          Array(context[:inventory]&.collisions).map do |collision|
+            finding("architecture.output_collision", collision[:primary], "Multiple owners claim #{collision[:output_path]}.", {output_path: collision[:output_path], owners: collision[:owners].map { |o| o[:identity] }})
+          end
+        end
+
+        def links_target_missing(document, context)
+          links(document, context).map do |edge|
+            next unless edge[:resolution][:status] == :missing
+            finding("links.target_missing", document, "Link points to a missing local target.", {href: edge[:occurrence][:href], path: edge[:resolution][:path]}, edge[:occurrence][:line])
+          end.compact
+        end
+
+        def links_fragment_missing(document, context)
+          links(document, context).map do |edge|
+            resolution, occurrence = edge[:resolution], edge[:occurrence]
+            next unless resolution[:status] == :local && resolution[:fragment] && resolution[:target]
+            next if asset_target?(resolution[:target])
+            next if resolution[:target][:ids]&.include?(resolution[:fragment])
+            finding("links.fragment_missing", document, "Local target does not contain the requested fragment.", {href: occurrence[:href], fragment: resolution[:fragment], target: resolution[:target][:identity]}, occurrence[:line])
+          end.compact
+        end
+
+        def architecture_orphan(document, context)
+          return [] if root?(document, context) || document[:redirect]
+          return [] unless document[:content_confident]
+          return [] unless graph(context)
+          return [] unless graph(context).incoming(document).empty?
+          [finding("architecture.orphan", document, "No incoming links in this build.", {incoming: 0})]
+        end
+
+        def identity_canonical_invalid(document, _context)
+          Array(document[:canonicals]).map do |canonical|
+            href = canonical[:href].to_s
+            next if canonical[:href] == ""
+            if canonical[:href].nil?
+              next finding("identity.canonical_invalid", document, "Canonical declaration has no href.", {href: nil}, canonical[:line])
+            end
+            next if href.match?(/[^\x00-\x7F]/)
+            begin
+              URI.parse(href)
+              nil
+            rescue URI::InvalidURIError
+              finding("identity.canonical_invalid", document, "Canonical declaration is not a valid URI reference.", {href: href}, canonical[:line])
+            end
+          end.compact
+        end
+
+        def identity_canonical_multiple(document, context)
+          declarations = Array(document[:canonicals]).map do |canonical|
+            href = canonical[:href].to_s
+            next if href.empty?
+            [context[:resolver].resolve(href, document)[:url], canonical] rescue [href, canonical]
+          end.compact
+          values = declarations.map(&:first).uniq
+          return [] unless values.length > 1
+          locations = declarations.map { |value, canonical| {line: canonical[:line], href: canonical[:href]} }
+          [finding("identity.canonical_multiple", document, "Multiple distinct canonical URLs are declared.", {canonicals: values}, locations.first[:line], locations.drop(1))]
+        end
+
+        def identity_canonical_target_missing(document, context)
+          Array(document[:canonicals]).map do |canonical|
+            resolution = context[:resolver].resolve(canonical[:href], document)
+            next unless resolution[:status] == :missing
+            finding("identity.canonical_target_missing", document, "Canonical points to a missing local target.", {href: canonical[:href], path: resolution[:path]}, canonical[:line])
+          end.compact
+        end
+
+        def structure_title_missing(document, _context)
+          document[:title].to_s.strip.empty? ? [finding("structure.title_missing", document, "Rendered HTML has no nonempty title.", {})] : []
+        end
+
+        def structure_h1_absent(document, _context)
+          return [] unless document[:content_confident]
+          document[:headings].none? { |h| h[:level] == 1 && h[:name_supported] != false && !h[:hidden] && !h[:name].to_s.empty? } ? [finding("structure.h1_absent", document, "No level-one heading detected within the extracted content.", {})] : []
+        end
+
+        def structure_heading_empty(document, _context)
+          return [] unless document[:content_confident]
+          document[:headings].map { |heading| finding("structure.heading_empty", document, "Heading has no supported accessible name.", {level: heading[:level]}, heading[:line]) if heading[:name_supported] != false && !heading[:hidden] && heading[:name].to_s.empty? }.compact
+        end
+
+        def structure_heading_jump(document, _context)
+          return [] unless document[:content_confident]
+          previous = nil
+          document[:headings].map do |heading|
+            result = if previous && heading[:level] > previous[:level] + 1 && !heading[:hidden] && heading[:name_supported] && previous[:name_supported]
+              finding("structure.heading_jump", document, "Heading level jumps from h#{previous[:level]} to h#{heading[:level]}.", {from: previous[:level], to: heading[:level]}, heading[:line], [{line: previous[:line]}])
+            end
+            previous = heading unless heading[:hidden]
+            result
+          end.compact
+        end
+
+        def structure_id_duplicate(document, _context)
+          locations = document[:duplicate_id_locations] || {}
+          Array(document[:duplicate_ids]).map do |id|
+            lines = Array(locations[id])
+            finding("structure.id_duplicate", document, "ID is declared more than once.", {id: id}, lines.first, lines.drop(1).map { |line| {line: line, id: id} })
+          end
+        end
+
+        def structure_link_unnamed(document, _context)
+          document[:links].map { |link| finding("structure.link_unnamed", document, "Navigation link has no supported accessible name.", {href: link[:href]}, link[:line]) if link[:kind] == :navigation && !link[:hidden] && link[:name_supported] && link[:name].to_s.empty? }.compact
+        end
+
+        def collision(context)
+          {status: :evaluated, findings: architecture_output_collision(nil, context)}
+        end
+
+        def links(document, context)
+          graph = context[:graph]
+          return graph.edges_for(document) if graph && graph.respond_to?(:edges_for)
+          Array(graph&.edges).select { |edge| edge[:source][:identity] == document[:identity] }
+        end
+
+        def asset_target?(entry)
+          path = entry[:output_path].to_s
+          !path.empty? && !path.end_with?(".html", "/")
+        end
+
+        def graph(context)
+          context[:graph]
+        end
+
+        def root?(document, context)
+          config = context[:configuration].respond_to?(:to_h) ? context[:configuration].to_h : context[:configuration]
+          roots = config.dig(:graph, :roots) || config.dig("graph", "roots") || ["/"]
+          base = context.fetch(:site_config, {}).fetch("baseurl", "").to_s.sub(%r{/\z}, "")
+          roots.map(&:to_s).any? do |root|
+            route = root == "/" && !base.empty? ? "#{base}/" : root
+            document[:route].to_s == route || (root == "/" && document[:route].to_s == "/index.html") || begin
+              URI.parse(document[:url].to_s).path == route
+            rescue URI::InvalidURIError
+              false
+            end
+          end
+        end
+
+        def finding(rule, document, message, observation, line = nil, related_locations = [])
+          {document: document, message: message, observation: observation, line: line,
+           related_locations: related_locations, severity: SEVERITIES[rule]}
+        end
+      end
+    end
+  end
+end

data/lib/jekyll/agent_audit/runner.rb

@@ -0,0 +1,266 @@
+# frozen_string_literal: true
+
+require "tmpdir"
+require "fileutils"
+require "uri"
+require "date"
+require "yaml"
+
+module Jekyll
+  module AgentAudit
+    class Runner
+      def initialize(options = {})
+        @options = options.transform_keys(&:to_s)
+      end
+
+      def run
+        @extraction_diagnostics = []
+        temporary = Dir.mktmpdir("jekyll-agent-audit-")
+        site = nil
+        begin
+          jekyll_options = build_options(temporary)
+          configuration = Configuration.new(jekyll_options.fetch("agent_audit", {}), @options.slice("fail_on", "format"))
+          site = Jekyll::Site.new(jekyll_options)
+          register_context(site, configuration)
+          site.process
+          inventory = site.instance_variable_get(:@agent_audit_inventory)
+          inventory&.finalize!
+          report_from_site(site, inventory)
+        rescue Interrupt
+          operational_report("interrupted", "Audit interrupted", site)
+        rescue StandardError => e
+          operational_report("build_failure", e.message, site)
+        ensure
+          FileUtils.remove_entry(temporary) if temporary && File.directory?(temporary)
+        end
+      end
+
+      private
+
+      def build_options(temporary)
+        options = @options.dup
+        source = File.expand_path(options["source"] || Dir.pwd)
+        destination = File.join(temporary, "site")
+        cache_dir = File.join(temporary, "cache")
+        options["source"] = source
+        options["destination"] = destination
+        options["cache_dir"] = cache_dir
+        options["incremental"] = false
+        options["disable_disk_cache"] = true
+        Jekyll.configuration(options)
+      end
+
+      def register_context(site, configuration)
+        fail ReportError, "inventory_unavailable" unless defined?(BuildInventory)
+        inventory = BuildInventory.new(site, configuration)
+        site.instance_variable_set(:@agent_audit_configuration, configuration)
+        site.instance_variable_set(:@agent_audit_inventory, inventory)
+      end
+
+      def report_from_site(site, inventory)
+        configuration = site.instance_variable_get(:@agent_audit_configuration)
+        entries = inventory.entries
+        fail ReportError, "no_documents" if entries.empty?
+        documents = extract_documents(entries, configuration)
+        hydrate_explicit_data!(documents, site.source)
+        validate_page_suppressions!(documents, configuration)
+        findings, coverage, rule_diagnostics = evaluate_rules(documents, inventory, entries, configuration, site)
+        suppression_diagnostics = apply_suppressions(findings, configuration, documents)
+        diagnostics = Array(inventory&.diagnostics) + @extraction_diagnostics + rule_diagnostics + suppression_diagnostics
+        complete = inventory.nil? || inventory.complete?
+        complete = false if diagnostics.any? { |diagnostic| operational_diagnostic?(diagnostic) }
+        fail ReportError, "no_documents" if documents.empty? && diagnostics.empty?
+        reference_time = @options["reference_time"] ? Time.iso8601(@options["reference_time"].to_s).utc : Time.now.utc
+        Report.new(findings: findings, coverage: coverage, documents_inspected: documents.length,
+                   options: configuration.to_h, site_config: site.config, complete: complete,
+                   diagnostics: diagnostics, operational_error: !complete, reference_time: reference_time,
+                   effective_configuration: configuration.to_h,
+                   build: {"incremental" => false, "show_drafts" => !!@options["show_drafts"], "future" => !!@options["future"], "timezone" => site.config["timezone"].to_s})
+      end
+
+      def extract_documents(entries, configuration)
+        fail ReportError, "extractor_unavailable" unless defined?(Extractor)
+        extractor = Extractor.new(configuration)
+        entries.filter_map do |entry|
+          output = entry[:output_path] || entry["output_path"]
+          route = entry[:route] || entry["route"]
+          next unless output.to_s.downcase.end_with?(".html") || route.to_s.end_with?("/")
+          extractor.extract(entry)
+        rescue InputError => e
+          @extraction_diagnostics << {"code" => "input_failure", "message" => sanitize_message(e.message)}
+          next
+        end
+      end
+
+      def hydrate_explicit_data!(documents, source)
+        documents.each do |document|
+          path = document[:source_path] || document["source_path"]
+          next if path.to_s.empty?
+          absolute = File.expand_path(path.to_s, source.to_s)
+          next unless File.file?(absolute)
+          text = File.binread(absolute)
+          next unless text.start_with?("---")
+          front = text.split(/^---\s*$\n?/, 3)[1]
+          data = YAML.safe_load(front.to_s, permitted_classes: [Date, Time], aliases: true) || {}
+          document[:explicit_data] = data if document[:explicit_data].to_h.empty? && document.respond_to?(:[]=)
+        rescue Psych::Exception, Errno::ENOENT, Errno::EACCES
+          next
+        end
+      end
+
+      def evaluate_rules(documents, inventory, entries, configuration, site)
+        extracted_by_output = documents.each_with_object({}) do |document, index|
+          index[document[:output_path] || document["output_path"]] = document
+        end
+        resolver_entries = entries.map do |entry|
+          output = entry[:output_path] || entry["output_path"]
+          extracted_by_output.fetch(output, entry)
+        end
+        resolver = defined?(UrlResolver) ? UrlResolver.new(resolver_entries, site.config, configuration) : nil
+        graph = if defined?(LinkGraph) && resolver
+          LinkGraph.new(documents, resolver, configuration, site.config)
+        end
+        context = {documents: documents, inventory: inventory || entries, resolver: resolver, graph: graph,
+                   configuration: configuration, site_config: site.config}
+        findings = []
+        coverage = {}
+        diagnostics = []
+        diagnostics.concat(Array(graph&.diagnostics))
+        if graph && graph.respond_to?(:edges) && graph.edges.length > configuration["limits"]["max_edges"]
+          diagnostics << {"code" => "edge_limit", "limit" => configuration["limits"]["max_edges"], "value" => graph.edges.length}
+        end
+        selected = @options["only"].to_s.split(",").map(&:strip).reject(&:empty?)
+        rules = configuration.enabled_rules
+        rules = rules.select { |id, _| selected.include?(id) } unless selected.empty?
+        Registry.mvp_ids.each do |id|
+          metadata = Registry[id]
+          next if rules.key?(id)
+          coverage[id] = {candidate: 0, evaluated: 0, not_applicable: 0, skipped: 0, status: metadata[:release] == "D" ? "deferred" : "disabled"}
+        end
+        rules.each do |id, metadata|
+          candidates = id == "architecture.output_collision" ? [nil] : documents.select { |doc| doc[:selected] != false && doc["selected"] != false }
+          evaluated = 0
+          not_applicable = 0
+          skipped = 0
+          candidates.each do |document|
+            result = evaluate_one(id, document, context)
+            next unless result
+            status = (result[:status] || :evaluated).to_sym
+            status == :evaluated ? evaluated += 1 : status == :not_applicable ? not_applicable += 1 : skipped += 1
+            Array(result[:findings]).each { |draft| findings << enrich_finding(draft, id, document) }
+            diagnostics.concat(Array(result[:diagnostics]))
+          end
+          coverage[id] = {candidate: candidates.length, evaluated: evaluated, not_applicable: not_applicable, skipped: skipped}
+        end
+        [findings, coverage, diagnostics]
+      end
+
+      def evaluate_one(id, document, context)
+        if id.start_with?("provenance.")
+          defined?(Rules::Provenance) ? Rules::Provenance.evaluate(id, document, context) : {findings: []}
+        elsif defined?(Rules::Publication)
+          Rules::Publication.evaluate(id, document, context)
+        else
+          {findings: []}
+        end
+      end
+
+      def enrich_finding(draft, id, document)
+        draft = draft.transform_keys(&:to_sym)
+        source_document = draft[:document] || document
+        draft[:rule_id] = id
+        draft[:document_url] ||= source_document && (source_document[:url] || source_document["url"])
+        draft[:source_path] ||= source_document && (source_document[:source_path] || source_document["source_path"])
+        draft[:document_identity] ||= source_document && (source_document[:identity] || source_document["identity"])
+        draft[:extraction_basis] ||= source_document && (source_document[:content_basis] || source_document["content_basis"])
+        draft[:line] ||= draft[:rendered_line]
+        if draft[:rendered_location].nil? && source_document
+          draft[:rendered_location] = {path: source_document[:output_path] || source_document["output_path"], line: draft[:line]}
+        end
+        Finding.new(draft)
+      end
+
+      def apply_suppressions(findings, configuration, documents)
+        used = {}
+        today = (@options["reference_time"] ? Time.iso8601(@options["reference_time"].to_s).utc : Time.now.utc).to_date
+        findings.each do |finding|
+          page = documents.find { |doc| (doc[:source_path] || doc["source_path"]) == finding["source_path"] }
+          page_data = page ? (page[:explicit_data] || page["explicit_data"] || page[:data] || page["data"] || {}) : {}
+          audit_data = page_data["agent_audit"] || page_data[:agent_audit] || {}
+          page_entries = audit_data["suppress"] || audit_data[:suppress] || []
+          page_suppression = Array(page_entries).find do |entry|
+            rule = entry["rule"] || entry[:rule]
+            fingerprint = entry["fingerprint"] || entry[:fingerprint]
+            expiry = entry["until"] || entry[:until]
+            active = !expiry || Date.iso8601(expiry.to_s) >= today
+            fingerprint_match = fingerprint.nil? || fingerprint == finding["fingerprint"]
+            rule == finding["rule_id"] && fingerprint_match && (entry["reason"] || entry[:reason]).to_s.strip != "" && active
+          end
+          suppression = page_suppression || configuration.suppression_for(finding["rule_id"], source_path: finding["source_path"], fingerprint: finding["fingerprint"], now: today).first
+          if suppression
+            finding.data["suppression"] = suppression
+            used[suppression.object_id] = true
+          end
+        end
+        expired = configuration.expired_suppressions(now: today).map { |entry| {"code" => "expired_suppression", "rule" => entry["rule"], "message" => "Suppression has expired"} }
+        page_suppressions = documents.flat_map do |doc|
+          data = doc[:explicit_data] || doc["explicit_data"] || doc[:data] || doc["data"] || {}
+          audit = data["agent_audit"] || data[:agent_audit] || {}
+          Array(audit["suppress"] || audit[:suppress])
+        end
+        page_expired = page_suppressions.filter_map do |suppression|
+          expiry = suppression["until"] || suppression[:until]
+          next unless expiry && Date.iso8601(expiry.to_s) < today
+          {"code" => "expired_suppression", "rule" => suppression["rule"] || suppression[:rule], "message" => "Page suppression has expired"}
+        end
+        page_unused = page_suppressions.filter_map do |suppression|
+          next if used[suppression.object_id]
+          expiry = suppression["until"] || suppression[:until]
+          next if expiry && Date.iso8601(expiry.to_s) < today
+          {"code" => "unused_suppression", "rule" => suppression["rule"] || suppression[:rule], "message" => "Page suppression did not match a finding"}
+        end
+        unused = Array(configuration["suppressions"]).filter_map do |suppression|
+          next if used[suppression.object_id]
+          {"code" => "unused_suppression", "rule" => suppression["rule"], "message" => "Suppression did not match a finding"}
+        end
+        expired + page_expired + page_unused + unused
+      end
+
+      def validate_page_suppressions!(documents, configuration)
+        documents.each do |doc|
+          data = doc[:explicit_data] || doc["explicit_data"] || doc[:data] || doc["data"] || {}
+          audit = data["agent_audit"] || data[:agent_audit] || {}
+          entries = audit["suppress"] || audit[:suppress] || []
+          fail ConfigurationError, "page suppressions must be an array" unless entries.is_a?(Array)
+          entries.each do |entry|
+            fail ConfigurationError, "page suppression must be a mapping" unless entry.is_a?(Hash)
+            keys = entry.keys.map(&:to_s)
+            fail ConfigurationError, "unknown page suppression key" unless (keys - %w[rule reason until fingerprint]).empty?
+            rule = entry["rule"] || entry[:rule]
+            reason = entry["reason"] || entry[:reason]
+            fail ConfigurationError, "page suppression requires known MVP rule" unless Registry.mvp_ids.include?(rule.to_s)
+            fail ConfigurationError, "page suppression requires a nonempty reason" if reason.to_s.strip.empty?
+            Date.iso8601((entry["until"] || entry[:until]).to_s) if entry["until"] || entry[:until]
+          rescue Date::Error
+            fail ConfigurationError, "page suppression until must be an ISO date"
+          end
+        end
+      end
+
+      def operational_diagnostic?(diagnostic)
+        return false unless diagnostic.is_a?(Hash)
+        code = (diagnostic[:code] || diagnostic["code"]).to_s
+        code.match?(/resource|limit|incomplete|invalid_graph_root|input_failure|ownership_outside|capture_failed|no_documents/)
+      end
+
+      def operational_report(code, message, site)
+        Report.new(complete: false, operational_error: true, options: @options.merge("fail_on" => @options.fetch("fail_on", "error")),
+                   site_config: site ? site.config : {}, diagnostics: [{"code" => code, "message" => sanitize_message(message)}])
+      end
+
+      def sanitize_message(message)
+        message.to_s.gsub(%r{(?:/private/var|/var/folders|/tmp|/private/tmp)[^\s"']*}, "[temporary-path]")[0, 500]
+      end
+    end
+  end
+end

data/lib/jekyll/agent_audit/url_resolver.rb

@@ -0,0 +1,98 @@
+# frozen_string_literal: true
+
+require "uri"
+
+module Jekyll
+  module AgentAudit
+    class UrlResolver
+      def initialize(entries, site_config, configuration)
+        @entries, @site_config, @configuration = Array(entries), site_config || {}, configuration
+        @by_path = {}
+        @entries.each { |entry| index(entry) }
+      end
+
+      def resolve(href, document, base: true)
+        raw = href.to_s.strip
+        if raw.empty?
+          target = @by_path[canonical_path(document[:route] || document[:url])]
+          return result(target ? :local : :missing, url: document[:url], path: document[:route], target: target, reason: target ? nil : :target_missing)
+        end
+        return result(:unsupported, reason: raw.split(":", 2).first) if raw.match?(/\A(?:mailto|tel|javascript|data):/i)
+        URI.parse(raw)
+        base_uri = URI.parse(document[:url].to_s)
+        if base && document[:base_href].to_s != ""
+          base_uri = URI.join(base_uri.to_s, document[:base_href].to_s)
+        end
+        resolved = URI.join(base_uri.to_s, raw)
+        configured = URI.parse(@site_config.fetch("url", @site_config[:url]).to_s) rescue nil
+        if resolved.host && configured&.host && !same_origin?(resolved, configured)
+          return result(:external, url: resolved.to_s, path: resolved.path, fragment: fragment(resolved.fragment))
+        end
+        baseurl = @site_config.fetch("baseurl", @site_config[:baseurl]).to_s.sub(%r{/\z}, "")
+        if baseurl != "" && raw.start_with?("/") && resolved.path != baseurl && !resolved.path.start_with?("#{baseurl}/")
+          return result(:unsupported, url: resolved.to_s, path: resolved.path, fragment: fragment(resolved.fragment), reason: :outside_baseurl)
+        end
+        baseurl = @site_config.fetch("baseurl", @site_config[:baseurl]).to_s.sub(%r{/\z}, "")
+        if !baseurl.empty? && resolved.path != baseurl && !resolved.path.start_with?("#{baseurl}/")
+          return result(:unsupported, url: resolved.to_s, path: resolved.path, fragment: fragment(resolved.fragment), reason: :outside_baseurl)
+        end
+        path = public_path(resolved)
+        target = @by_path[canonical_path(path)]
+        alias_path = alias_for(path)
+        target ||= @by_path[canonical_path(alias_path)] if alias_path
+        result(target ? :local : :missing, url: resolved.to_s, path: path, fragment: fragment(resolved.fragment), target: target, reason: target ? nil : :target_missing)
+      rescue URI::InvalidURIError, ArgumentError => e
+        result(:invalid, reason: e.message)
+      end
+
+      private
+
+      def index(entry)
+        [entry[:route], entry[:output_path], entry[:url]].compact.each do |path|
+          key = canonical_path(path)
+          @by_path[key] = entry
+          base = @site_config.fetch("baseurl", @site_config[:baseurl]).to_s.sub(%r{/\z}, "")
+          @by_path[canonical_path("#{base}#{key}")] = entry if !base.empty? && !key.start_with?("#{base}/")
+          @by_path[key.sub(%r{/index\.html\z}, "/")] = entry if directory_index? && key.end_with?("/index.html")
+        end
+      end
+
+      def public_path(uri)
+        path = uri.path.to_s
+        path = "/#{path}" unless path.start_with?("/")
+        base = @site_config.fetch("baseurl", @site_config[:baseurl]).to_s.sub(%r{/\z}, "")
+        path = "#{base}#{path}" if !base.empty? && !path.start_with?("#{base}/") && path != base
+        path
+      end
+
+      def canonical_path(path)
+        value = path.to_s.split("?", 2).first.gsub(/%2F/i, "%252F")
+        value = URI::RFC2396_PARSER.unescape(value).gsub("%2F", "%252F")
+        value.gsub(%r{/+}, "/").then { |p| p.start_with?("/") ? p : "/#{p}" }
+      end
+      def fragment(value)
+        value.nil? || value.empty? || value == "top" || value.start_with?(":~:text=") ? nil : URI::RFC2396_PARSER.unescape(value)
+      end
+      def directory_index?
+        (route_config[:directory_index] || "index.html") == "index.html"
+      end
+      def route_config
+        h = @configuration.respond_to?(:to_h) ? @configuration.to_h : @configuration
+        h[:routes] || h["routes"] || {}
+      end
+      def alias_for(path)
+        (route_config[:aliases] || route_config["aliases"] || {})[path]
+      end
+      def same_origin?(left, right)
+        left.scheme.to_s.downcase == right.scheme.to_s.downcase && left.host.to_s.downcase == right.host.to_s.downcase && effective_port(left) == effective_port(right)
+      end
+
+      def effective_port(uri)
+        uri.port || (uri.scheme.to_s.downcase == "https" ? 443 : 80)
+      end
+      def result(status, **values)
+        {status: status, url: values[:url], path: values[:path], fragment: values[:fragment], target: values[:target], reason: values[:reason]}
+      end
+    end
+  end
+end

data/lib/jekyll/agent_audit/version.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module Jekyll
+  module AgentAudit
+    VERSION = "0.1.0"
+  end
+end

data/lib/jekyll-agent-audit.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+require "jekyll"
+require "fileutils"
+require_relative "jekyll/agent_audit/version"
+require_relative "jekyll/agent_audit/errors"
+require_relative "jekyll/agent_audit/registry"
+require_relative "jekyll/agent_audit/configuration"
+require_relative "jekyll/agent_audit/finding"
+require_relative "jekyll/agent_audit/report"
+require_relative "jekyll/agent_audit/reporters/json"
+require_relative "jekyll/agent_audit/reporters/console"
+require_relative "jekyll/agent_audit/runner"
+require_relative "jekyll/agent_audit/command"
+%w[build_inventory extractor url_resolver link_graph rules/publication rules/provenance].each do |component|
+  require_relative "jekyll/agent_audit/#{component}"
+end
+
+if defined?(Jekyll::Hooks)
+  Jekyll::Hooks.register(:site, :post_render, priority: 1_000) do |site|
+    inventory = site.instance_variable_get(:@agent_audit_inventory)
+    inventory.capture! if inventory
+  end
+end

data/llms.txt

@@ -0,0 +1,35 @@
+# Module Jekyll::AgentAudit <a id="module-Jekyll-AgentAudit"></a>
+
+|  |  |
+| --- | --- |
+| **Defined in** | lib/jekyll/agent_audit/errors.rb, lib/jekyll/agent_audit/report.rb, lib/jekyll/agent_audit/runner.rb, lib/jekyll/agent_audit/finding.rb, lib/jekyll/agent_audit/version.rb, lib/jekyll/agent_audit/registry.rb, lib/jekyll/agent_audit/extractor.rb, lib/jekyll/agent_audit/link_graph.rb, lib/jekyll/agent_audit/url_resolver.rb, lib/jekyll/agent_audit/configuration.rb, lib/jekyll/agent_audit/reporters/json.rb, lib/jekyll/agent_audit/build_inventory.rb, lib/jekyll/agent_audit/rules/provenance.rb, lib/jekyll/agent_audit/reporters/console.rb, lib/jekyll/agent_audit/rules/publication.rb |
+
+## Constants
+### `VERSION` <a id="constant-VERSION"></a> <a id="VERSION-constant"></a>
+Not documented.
+
+# Documentation
+
+- [AgentAudit/BuildInventory.md](doc/Jekyll/AgentAudit/BuildInventory.md)
+- [AgentAudit/Configuration.md](doc/Jekyll/AgentAudit/Configuration.md)
+- [AgentAudit/ConfigurationError.md](doc/Jekyll/AgentAudit/ConfigurationError.md)
+- [AgentAudit/Error.md](doc/Jekyll/AgentAudit/Error.md)
+- [AgentAudit/Extractor.md](doc/Jekyll/AgentAudit/Extractor.md)
+- [AgentAudit/Finding.md](doc/Jekyll/AgentAudit/Finding.md)
+- [AgentAudit/InputError.md](doc/Jekyll/AgentAudit/InputError.md)
+- [AgentAudit/LinkGraph.md](doc/Jekyll/AgentAudit/LinkGraph.md)
+- [AgentAudit/Registry.md](doc/Jekyll/AgentAudit/Registry.md)
+- [AgentAudit/Report.md](doc/Jekyll/AgentAudit/Report.md)
+- [AgentAudit/ReportError.md](doc/Jekyll/AgentAudit/ReportError.md)
+- [AgentAudit/Reporters/Console.md](doc/Jekyll/AgentAudit/Reporters/Console.md)
+- [AgentAudit/Reporters/JSON.md](doc/Jekyll/AgentAudit/Reporters/JSON.md)
+- [AgentAudit/Reporters.md](doc/Jekyll/AgentAudit/Reporters.md)
+- [AgentAudit/Rules/Provenance.md](doc/Jekyll/AgentAudit/Rules/Provenance.md)
+- [AgentAudit/Rules/Publication.md](doc/Jekyll/AgentAudit/Rules/Publication.md)
+- [AgentAudit/Rules.md](doc/Jekyll/AgentAudit/Rules.md)
+- [AgentAudit/Runner.md](doc/Jekyll/AgentAudit/Runner.md)
+- [AgentAudit/UrlResolver.md](doc/Jekyll/AgentAudit/UrlResolver.md)
+- [Commands/AgentAudit/CommandParser.md](doc/Jekyll/Commands/AgentAudit/CommandParser.md)
+- [Commands/AgentAudit/ParserErrors.md](doc/Jekyll/Commands/AgentAudit/ParserErrors.md)
+- [Commands/AgentAudit.md](doc/Jekyll/Commands/AgentAudit.md)
+- [Commands.md](doc/Jekyll/Commands.md)