@eightmedia/flightcheck 0.0.0-stage → 1.0.0

package/dist/checks/runner.js

@@ -0,0 +1,110 @@
+import { CHECK_DEFINITIONS, getCheckDefinition, listChecks, listImplementedChecks, runRegisteredCheck } from "./registry.js";
+import { analyzeRedirect, checksSkippedByRedirect, resolveChecksForRedirect, runRedirectCheck, } from "./redirect.js";
+import { DEFAULT_CHECK_IDS } from "./types.js";
+export function planCheckWaves(requestedChecks) {
+    const requested = new Set(requestedChecks);
+    const waves = [];
+    const independent = ["crawl", "lighthouse", "security-headers", "dns", "robots-txt", "agent-ready"].filter((id) => requested.has(id));
+    if (independent.length > 0) {
+        waves.push(independent);
+    }
+    const afterCrawl = ["sitemap"].filter((id) => requested.has(id));
+    if (afterCrawl.length > 0) {
+        waves.push(afterCrawl);
+    }
+    if (requested.has("analyze")) {
+        waves.push(["analyze"]);
+    }
+    return waves;
+}
+function canRunAnalyze(context) {
+    return Boolean(context.outputs.redirect?.redirectOnly ||
+        context.outputs.crawl ||
+        context.options.analyze?.records ||
+        context.options.analyze?.inputPath);
+}
+function skippedResult(id, message) {
+    return {
+        id,
+        status: "skipped",
+        error: message,
+        durationMs: 0,
+    };
+}
+async function executeCheck(context, id) {
+    const definition = getCheckDefinition(id);
+    if (!definition.implemented) {
+        return {
+            id,
+            status: "unsupported",
+            error: `${definition.name} check is not implemented yet.`,
+            durationMs: 0,
+        };
+    }
+    if (id === "analyze" && !canRunAnalyze(context)) {
+        return {
+            id,
+            status: "skipped",
+            error: "Analyze check requires crawl output, redirect output, or analyze.inputPath / analyze.records.",
+            durationMs: 0,
+        };
+    }
+    if (id === "sitemap" && !context.outputs.crawl) {
+        return {
+            id,
+            status: "skipped",
+            error: "Sitemap check requires crawl output.",
+            durationMs: 0,
+        };
+    }
+    return runRegisteredCheck(context, id);
+}
+export async function runCheck(id, options) {
+    const context = {
+        startUrl: options.startUrl,
+        outputs: {},
+        options,
+    };
+    return executeCheck(context, id);
+}
+export async function probeStartUrlRedirect(startUrl) {
+    return runRedirectCheck(startUrl);
+}
+export async function runChecks(options) {
+    const requestedChecks = options.checks ?? DEFAULT_CHECK_IDS;
+    const context = {
+        startUrl: options.startUrl,
+        outputs: {},
+        options,
+    };
+    const results = [];
+    const redirect = await runRedirectCheck(options.startUrl);
+    context.outputs.redirect = redirect;
+    const effectiveChecks = resolveChecksForRedirect(requestedChecks, redirect);
+    const skippedChecks = checksSkippedByRedirect(requestedChecks, effectiveChecks);
+    const skipMessage = "Skipped because the start URL is a domain redirect (use --checks crawl to force a crawl).";
+    for (const id of skippedChecks) {
+        results.push(skippedResult(id, skipMessage));
+    }
+    const waves = planCheckWaves(effectiveChecks);
+    for (const wave of waves) {
+        const waveResults = options.parallel && wave.length > 1
+            ? await Promise.all(wave.map((id) => executeCheck(context, id)))
+            : await wave.reduce(async (accPromise, id) => {
+                const acc = await accPromise;
+                acc.push(await executeCheck(context, id));
+                return acc;
+            }, Promise.resolve([]));
+        results.push(...waveResults);
+        const failedRequired = waveResults.find((result) => result.status === "failure" && result.id === "crawl" && effectiveChecks.includes("analyze"));
+        if (failedRequired) {
+            break;
+        }
+    }
+    return {
+        results,
+        outputs: context.outputs,
+        redirectOnly: redirect.redirectOnly,
+    };
+}
+export { CHECK_DEFINITIONS, getCheckDefinition, listChecks, listImplementedChecks, analyzeRedirect, resolveChecksForRedirect };

package/dist/checks/security-headers.d.ts

@@ -0,0 +1,12 @@
+import { type CheckIssue } from "./issues.js";
+export type AnalyzeSecurityHeadersOptions = {
+    isHttps?: boolean;
+};
+export declare function analyzeSecurityHeaders(headers: Headers, options?: AnalyzeSecurityHeadersOptions): CheckIssue[];
+export type SecurityHeadersCheckResult = {
+    url: string;
+    headers: Record<string, string>;
+    issues: CheckIssue[];
+};
+export declare function runSecurityHeadersCheck(startUrl: string): Promise<SecurityHeadersCheckResult>;
+//# sourceMappingURL=security-headers.d.ts.map

package/dist/checks/security-headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-headers.d.ts","sourceRoot":"","sources":["../../src/checks/security-headers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAS,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAErD,MAAM,MAAM,6BAA6B,GAAG;IAC1C,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAWF,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,6BAAkC,GAC1C,UAAU,EAAE,CA0Cd;AAED,MAAM,MAAM,0BAA0B,GAAG;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,MAAM,EAAE,UAAU,EAAE,CAAC;CACtB,CAAC;AAEF,wBAAsB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAgBnG"}

package/dist/checks/security-headers.js

@@ -0,0 +1,53 @@
+import { issue } from "./issues.js";
+function headerValue(headers, name) {
+    return headers.get(name) ?? undefined;
+}
+function hasFrameAncestorsCsp(csp) {
+    if (!csp)
+        return false;
+    return /frame-ancestors/i.test(csp);
+}
+export function analyzeSecurityHeaders(headers, options = {}) {
+    const isHttps = options.isHttps ?? true;
+    const issues = [];
+    const hsts = headerValue(headers, "strict-transport-security");
+    const csp = headerValue(headers, "content-security-policy");
+    const xFrameOptions = headerValue(headers, "x-frame-options");
+    const nosniff = headerValue(headers, "x-content-type-options");
+    const referrerPolicy = headerValue(headers, "referrer-policy");
+    const permissionsPolicy = headerValue(headers, "permissions-policy");
+    if (isHttps && !hsts) {
+        issues.push(issue("missing-hsts", "error", "Strict-Transport-Security header is missing on HTTPS."));
+    }
+    if (!csp) {
+        issues.push(issue("missing-csp", "warning", "Content-Security-Policy header is missing."));
+    }
+    if (!xFrameOptions && !hasFrameAncestorsCsp(csp)) {
+        issues.push(issue("missing-clickjacking-protection", "warning", "Neither X-Frame-Options nor CSP frame-ancestors is set."));
+    }
+    if (!nosniff || nosniff.toLowerCase() !== "nosniff") {
+        issues.push(issue("missing-nosniff", "warning", "X-Content-Type-Options: nosniff is missing."));
+    }
+    if (!referrerPolicy) {
+        issues.push(issue("missing-referrer-policy", "review", "Referrer-Policy header is missing."));
+    }
+    if (!permissionsPolicy) {
+        issues.push(issue("missing-permissions-policy", "review", "Permissions-Policy header is missing."));
+    }
+    return issues;
+}
+export async function runSecurityHeadersCheck(startUrl) {
+    const url = new URL(startUrl);
+    const response = await fetch(url.origin, { redirect: "follow" });
+    const headers = {};
+    response.headers.forEach((value, key) => {
+        headers[key.toLowerCase()] = value;
+    });
+    const headerBag = new Headers(headers);
+    const issues = analyzeSecurityHeaders(headerBag, { isHttps: url.protocol === "https:" });
+    return {
+        url: url.origin,
+        headers,
+        issues,
+    };
+}

package/dist/checks/sitemap.d.ts

@@ -0,0 +1,36 @@
+import { type CheckIssue } from "./issues.js";
+export type SitemapSourceResult = {
+    url: string;
+    status: number | null;
+    pageUrls: string[];
+};
+export type SitemapCheckResult = {
+    sources: SitemapSourceResult[];
+    sitemapPageUrls: string[];
+    crawledUrls: string[];
+    inSitemapNotCrawled: string[];
+    crawledNotInSitemap: string[];
+    mismatchPercent: number;
+    issues: CheckIssue[];
+};
+export type AnalyzeSitemapCompareInput = {
+    sources: SitemapSourceResult[];
+    crawledUrls: string[];
+    mismatchThresholdPercent?: number;
+    excludePatterns?: string[];
+};
+export declare function analyzeSitemapCompare(input: AnalyzeSitemapCompareInput): SitemapCheckResult;
+export declare function discoverSitemapCandidates(origin: string, robotsSitemapUrls?: string[]): string[];
+export declare function loadSitemapSources(candidateUrls: string[], origin: string, timeoutMs: number): Promise<SitemapSourceResult[]>;
+export type RunSitemapCheckOptions = {
+    startUrl: string;
+    crawledUrls: string[];
+    robotsSitemapUrls?: string[];
+    timeoutMs?: number;
+    mismatchThresholdPercent?: number;
+    excludePatterns?: string[];
+};
+export type SitemapCheckOptions = Pick<RunSitemapCheckOptions, "timeoutMs" | "mismatchThresholdPercent" | "excludePatterns">;
+export declare function runSitemapCheck(options: RunSitemapCheckOptions): Promise<SitemapCheckResult>;
+export declare function collectSitemapPageUrls(startUrl: string, timeoutMs: number, robotsSitemapUrls?: string[], customSitemapUrl?: string): Promise<string[]>;
+//# sourceMappingURL=sitemap.d.ts.map

package/dist/checks/sitemap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sitemap.d.ts","sourceRoot":"","sources":["../../src/checks/sitemap.ts"],"names":[],"mappings":"AAGA,OAAO,EAAS,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAMrD,MAAM,MAAM,mBAAmB,GAAG;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,mBAAmB,EAAE,CAAC;IAC/B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,UAAU,EAAE,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,OAAO,EAAE,mBAAmB,EAAE,CAAC;IAC/B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B,CAAC;AAQF,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,0BAA0B,GAAG,kBAAkB,CA6G3F;AAED,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,EAAE,iBAAiB,GAAE,MAAM,EAAO,GAAG,MAAM,EAAE,CAIpG;AAkBD,wBAAsB,kBAAkB,CACtC,aAAa,EAAE,MAAM,EAAE,EACvB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAchC;AAED,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG,IAAI,CACpC,sBAAsB,EACtB,WAAW,GAAG,0BAA0B,GAAG,iBAAiB,CAC7D,CAAC;AAEF,wBAAsB,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAYlG;AAED,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,iBAAiB,GAAE,MAAM,EAAO,EAChC,gBAAgB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,MAAM,EAAE,CAAC,CAmBnB"}

package/dist/checks/sitemap.js

@@ -0,0 +1,140 @@
+import { DEFAULT_SITEMAP_URL_SUFFIX, DEFAULT_TIMEOUT_MS, DEFAULT_USER_AGENT } from "../crawler/defaults.js";
+import { collectUrlsFromSitemap } from "../crawler/sitemap.js";
+import { matchesExcludePattern, normalizeUrl } from "../crawler/urlUtils.js";
+import { issue } from "./issues.js";
+const SITEMAP_URL_NOT_CRAWLED_TIP = "Probable cause: sitemap URLs must match crawled URLs exactly, including hostname (apex vs www). " +
+    "These URLs were not crawled — check page limits, robots blocks, stale sitemap entries, or a failing sitemap regeneration job (cron).";
+function filterComparableUrls(urls, excludePatterns) {
+    const normalized = [...new Set(urls.map((url) => normalizeUrl(url)))];
+    if (excludePatterns.length === 0)
+        return normalized;
+    return normalized.filter((url) => !matchesExcludePattern(url, excludePatterns));
+}
+export function analyzeSitemapCompare(input) {
+    const threshold = input.mismatchThresholdPercent ?? 10;
+    const excludePatterns = input.excludePatterns ?? [];
+    const issues = [];
+    for (const source of input.sources) {
+        if (source.status === null || source.status >= 400) {
+            issues.push(issue("sitemap-unreachable", "error", `Sitemap not reachable: ${source.url} (${source.status ?? "unreachable"}).`));
+        }
+    }
+    const successfulSources = input.sources.filter((source) => source.status !== null && source.status >= 200 && source.status < 300);
+    if (successfulSources.length === 0) {
+        issues.push(issue("sitemap-missing", "error", "No sitemap found."));
+        return {
+            sources: input.sources,
+            sitemapPageUrls: [],
+            crawledUrls: filterComparableUrls(input.crawledUrls, excludePatterns),
+            inSitemapNotCrawled: [],
+            crawledNotInSitemap: [],
+            mismatchPercent: 0,
+            issues,
+        };
+    }
+    const sitemapPageUrls = filterComparableUrls(successfulSources.flatMap((source) => source.pageUrls), excludePatterns);
+    const crawledUrls = filterComparableUrls(input.crawledUrls, excludePatterns);
+    if (sitemapPageUrls.length === 0) {
+        issues.push(issue("sitemap-empty", "error", "Sitemap was reachable but contained no page URLs (check sitemap index nesting and host aliases such as apex vs www)."));
+        return {
+            sources: input.sources,
+            sitemapPageUrls,
+            crawledUrls,
+            inSitemapNotCrawled: [],
+            crawledNotInSitemap: crawledUrls,
+            mismatchPercent: crawledUrls.length === 0 ? 0 : 100,
+            issues,
+        };
+    }
+    const sitemapSet = new Set(sitemapPageUrls);
+    const crawledSet = new Set(crawledUrls);
+    const inSitemapNotCrawled = sitemapPageUrls.filter((url) => !crawledSet.has(url));
+    const crawledNotInSitemap = crawledUrls.filter((url) => !sitemapSet.has(url));
+    if (inSitemapNotCrawled.length > 0) {
+        issues.push(issue("sitemap-url-not-crawled", "critical", `${inSitemapNotCrawled.length} sitemap URL(s) were not crawled. ${SITEMAP_URL_NOT_CRAWLED_TIP}`));
+    }
+    if (crawledNotInSitemap.length > 0) {
+        issues.push(issue("sitemap-missing-crawled-url", "critical", `${crawledNotInSitemap.length} crawled URL(s) are missing from the sitemap.`));
+    }
+    const total = new Set([...sitemapPageUrls, ...crawledUrls]).size;
+    const mismatchCount = new Set([...inSitemapNotCrawled, ...crawledNotInSitemap]).size;
+    const mismatchPercent = total === 0 ? 0 : (mismatchCount / total) * 100;
+    if (mismatchPercent > threshold) {
+        issues.push(issue("sitemap-mismatch-threshold", "critical", `Sitemap mismatch is ${mismatchPercent.toFixed(1)}% (threshold ${threshold}%). ` +
+            "Sitemap URLs must match crawled URLs exactly, including hostname."));
+    }
+    return {
+        sources: input.sources,
+        sitemapPageUrls,
+        crawledUrls,
+        inSitemapNotCrawled,
+        crawledNotInSitemap,
+        mismatchPercent,
+        issues,
+    };
+}
+export function discoverSitemapCandidates(origin, robotsSitemapUrls = []) {
+    const defaultSitemap = normalizeUrl(`${origin}${DEFAULT_SITEMAP_URL_SUFFIX}`);
+    const candidates = [...robotsSitemapUrls.map((url) => normalizeUrl(url)), defaultSitemap];
+    return [...new Set(candidates)];
+}
+async function probeSitemapStatus(url, timeoutMs) {
+    try {
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), timeoutMs);
+        const response = await fetch(url, {
+            redirect: "follow",
+            signal: controller.signal,
+            headers: { "user-agent": DEFAULT_USER_AGENT },
+        });
+        clearTimeout(timeout);
+        return response.status;
+    }
+    catch {
+        return null;
+    }
+}
+export async function loadSitemapSources(candidateUrls, origin, timeoutMs) {
+    const sources = [];
+    for (const url of candidateUrls) {
+        const status = await probeSitemapStatus(url, timeoutMs);
+        if (status !== null && status >= 200 && status < 300) {
+            const pageUrls = Array.from(await collectUrlsFromSitemap(url, origin, timeoutMs));
+            sources.push({ url, status, pageUrls });
+        }
+        else {
+            sources.push({ url, status, pageUrls: [] });
+        }
+    }
+    return sources;
+}
+export async function runSitemapCheck(options) {
+    const origin = new URL(normalizeUrl(options.startUrl)).origin;
+    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const candidates = discoverSitemapCandidates(origin, options.robotsSitemapUrls);
+    const sources = await loadSitemapSources(candidates, origin, timeoutMs);
+    return analyzeSitemapCompare({
+        sources,
+        crawledUrls: options.crawledUrls,
+        mismatchThresholdPercent: options.mismatchThresholdPercent,
+        excludePatterns: options.excludePatterns,
+    });
+}
+export async function collectSitemapPageUrls(startUrl, timeoutMs, robotsSitemapUrls = [], customSitemapUrl) {
+    const origin = new URL(normalizeUrl(startUrl)).origin;
+    const candidates = discoverSitemapCandidates(origin, robotsSitemapUrls);
+    if (customSitemapUrl) {
+        const normalized = normalizeUrl(customSitemapUrl);
+        if (!candidates.includes(normalized)) {
+            candidates.unshift(normalized);
+        }
+    }
+    const pageUrls = new Set();
+    for (const candidate of candidates) {
+        const urls = await collectUrlsFromSitemap(candidate, origin, timeoutMs);
+        for (const url of urls) {
+            pageUrls.add(url);
+        }
+    }
+    return [...pageUrls];
+}

package/dist/checks/types.d.ts

@@ -0,0 +1,72 @@
+import type { VerificationRecord } from "../crawler/schema.js";
+import type { AgentReadyCheckResult } from "./agent-ready.js";
+import type { DnsCheckResult } from "./dns.js";
+import type { RedirectCheckResult } from "./redirect.js";
+import type { RobotsTxtCheckResult } from "./robots-txt.js";
+import type { SecurityHeadersCheckResult } from "./security-headers.js";
+import type { SitemapCheckResult } from "./sitemap.js";
+export declare const CHECK_IDS: readonly ["crawl", "analyze", "lighthouse", "security-headers", "dns", "robots-txt", "sitemap", "agent-ready"];
+export type CheckId = (typeof CHECK_IDS)[number];
+export type ImplementedCheckId = "crawl" | "analyze" | "security-headers" | "dns" | "robots-txt" | "sitemap" | "agent-ready";
+export type PlannedCheckId = Exclude<CheckId, ImplementedCheckId>;
+/** Default pipeline: all implemented checks (Tier 1 infra + crawl + analyze). */
+export declare const DEFAULT_CHECK_IDS: CheckId[];
+export type CheckStatus = "success" | "failure" | "skipped" | "unsupported";
+export type CheckExecutionResult<TData = unknown> = {
+    id: CheckId;
+    status: CheckStatus;
+    data?: TData;
+    error?: string;
+    durationMs: number;
+};
+export type CrawlCheckResult = {
+    records: VerificationRecord[];
+    outputPath: string;
+    interrupted: boolean;
+    secretsFound: number;
+};
+export type AnalyzeCheckResult = {
+    inputPath: string;
+    reportPath: string;
+    reportJsonPath: string;
+    markdown: string;
+    report: import("../analyze/structuredReport.js").FlightcheckReport;
+    pagesAnalyzed: number;
+};
+export type CheckOutputs = {
+    crawl?: CrawlCheckResult;
+    analyze?: AnalyzeCheckResult;
+    redirect?: RedirectCheckResult;
+    securityHeaders?: SecurityHeadersCheckResult;
+    dns?: DnsCheckResult;
+    robotsTxt?: RobotsTxtCheckResult;
+    sitemap?: SitemapCheckResult;
+    agentReady?: AgentReadyCheckResult;
+};
+export type CheckDefinition<TData = unknown> = {
+    id: CheckId;
+    name: string;
+    description: string;
+    dependencies: CheckId[];
+    implemented: boolean;
+    run: (context: CheckRunContext) => Promise<CheckExecutionResult<TData>>;
+};
+export type CheckRunContext = {
+    startUrl: string;
+    outputs: CheckOutputs;
+    options: RunChecksOptions;
+};
+export type RunChecksOptions = {
+    startUrl: string;
+    checks?: CheckId[];
+    parallel?: boolean;
+    crawl?: import("./crawl.js").CrawlCheckOptions;
+    analyze?: import("./analyze.js").AnalyzeCheckOptions;
+    sitemap?: import("./sitemap.js").SitemapCheckOptions;
+};
+export type RunChecksResult = {
+    results: CheckExecutionResult[];
+    outputs: CheckOutputs;
+    redirectOnly: boolean;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/checks/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/checks/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,eAAO,MAAM,SAAS,gHASZ,CAAC;AAEX,MAAM,MAAM,OAAO,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjD,MAAM,MAAM,kBAAkB,GAC1B,OAAO,GACP,SAAS,GACT,kBAAkB,GAClB,KAAK,GACL,YAAY,GACZ,SAAS,GACT,aAAa,CAAC;AAElB,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;AAElE,iFAAiF;AACjF,eAAO,MAAM,iBAAiB,EAAE,OAAO,EAQtC,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,CAAC;AAE5E,MAAM,MAAM,oBAAoB,CAAC,KAAK,GAAG,OAAO,IAAI;IAClD,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,WAAW,CAAC;IACpB,IAAI,CAAC,EAAE,KAAK,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,gCAAgC,EAAE,iBAAiB,CAAC;IACnE,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,eAAe,CAAC,EAAE,0BAA0B,CAAC;IAC7C,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,SAAS,CAAC,EAAE,oBAAoB,CAAC;IACjC,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,UAAU,CAAC,EAAE,qBAAqB,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,eAAe,CAAC,KAAK,GAAG,OAAO,IAAI;IAC7C,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,OAAO,EAAE,CAAC;IACxB,WAAW,EAAE,OAAO,CAAC;IACrB,GAAG,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC;CACzE,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,YAAY,CAAC;IACtB,OAAO,EAAE,gBAAgB,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,YAAY,EAAE,iBAAiB,CAAC;IAC/C,OAAO,CAAC,EAAE,OAAO,cAAc,EAAE,mBAAmB,CAAC;IACrD,OAAO,CAAC,EAAE,OAAO,cAAc,EAAE,mBAAmB,CAAC;CACtD,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAChC,OAAO,EAAE,YAAY,CAAC;IACtB,YAAY,EAAE,OAAO,CAAC;CACvB,CAAC"}

package/dist/checks/types.js

@@ -0,0 +1,20 @@
+export const CHECK_IDS = [
+    "crawl",
+    "analyze",
+    "lighthouse",
+    "security-headers",
+    "dns",
+    "robots-txt",
+    "sitemap",
+    "agent-ready",
+];
+/** Default pipeline: all implemented checks (Tier 1 infra + crawl + analyze). */
+export const DEFAULT_CHECK_IDS = [
+    "crawl",
+    "security-headers",
+    "dns",
+    "robots-txt",
+    "sitemap",
+    "agent-ready",
+    "analyze",
+];

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":""}

package/dist/cli.js

@@ -0,0 +1,125 @@
+#!/usr/bin/env node
+import { Command } from "commander";
+import { runChecks } from "./checks/runner.js";
+import { DEFAULT_CHECK_IDS } from "./checks/types.js";
+import { DEFAULT_BURST_DELAY_MS, DEFAULT_CONCURRENCY, DEFAULT_DELAY_MS, DEFAULT_MAX_PAGES, DEFAULT_TIMEOUT_MS, } from "./crawler/defaults.js";
+import { buildDefaultOutputPaths } from "./crawler/outputPaths.js";
+import { isHttpUrl, normalizeUrl, parseExcludePatterns } from "./crawler/urlUtils.js";
+async function main() {
+    const sanitizedArgv = [...process.argv];
+    const separatorIndex = sanitizedArgv.indexOf("--");
+    if (separatorIndex >= 2) {
+        sanitizedArgv.splice(separatorIndex, 1);
+    }
+    const program = new Command();
+    program
+        .name("flightcheck")
+        .description("Crawl a website and generate crawl JSON plus structured report JSON/Markdown.")
+        .argument("<startUrl>", "Start URL for the crawl")
+        .option("--output <file>", "Output crawl JSON file path")
+        .option("--report <file>", "Output Markdown report path")
+        .option("--json-only", "Skip analyze report generation", false)
+        .option("--errors-only", "Include only critical/error findings in the Markdown report", false)
+        .option("--parallel", "Run independent checks in parallel", false)
+        .option("--checks <ids>", "Comma-separated checks to run (crawl,analyze,lighthouse,security-headers,dns,robots-txt,sitemap,agent-ready)")
+        .option("--max-pages <n>", "Maximum number of pages", String(DEFAULT_MAX_PAGES))
+        .option("--delay-ms <n>", "Delay between requests in ms", String(DEFAULT_DELAY_MS))
+        .option("--timeout-ms <n>", "Request timeout in ms", String(DEFAULT_TIMEOUT_MS))
+        .option("--concurrency <n>", "Maximum concurrent requests", String(DEFAULT_CONCURRENCY))
+        .option("--burst-delay-ms <n>", "Pause after each burst in ms", String(DEFAULT_BURST_DELAY_MS))
+        .option("--sitemap-start", "Seed crawl with sitemap URLs", false)
+        .option("--sitemap-url <url>", "Custom sitemap URL")
+        .option("--respect-robots-txt", "Respect robots.txt disallow rules", false)
+        .option("--quiet", "Suppress Crawlee info/statistics logs (only warnings and errors)", false)
+        .option("--exclude <patterns>", "Exclude patterns (comma-separated, repeatable)", (value, acc) => {
+        acc.push(value);
+        return acc;
+    }, [])
+        .option("--only <groups>", "Run only these check groups (comma-separated): meta,icons,social,tracking,stack,security,images,a11y-static")
+        .option("--skip <groups>", "Skip these check groups (comma-separated)")
+        .option("--reveal-secrets", "Show full secret values instead of masked ones", false)
+        .action(async (startUrl, opts) => {
+        if (!isHttpUrl(startUrl)) {
+            throw new Error("<start-url> must be a valid http(s) URL.");
+        }
+        const normalizedStartUrl = normalizeUrl(startUrl);
+        const defaultPaths = buildDefaultOutputPaths(normalizedStartUrl);
+        const outputPath = opts.output;
+        const reportPath = opts.report;
+        const jsonOnly = Boolean(opts.jsonOnly);
+        const errorsOnly = Boolean(opts.errorsOnly);
+        const checks = opts.checks
+            ? opts.checks.split(",").map((value) => value.trim()).filter(Boolean)
+            : jsonOnly
+                ? ["crawl"]
+                : DEFAULT_CHECK_IDS;
+        const { outputs, results } = await runChecks({
+            startUrl: normalizedStartUrl,
+            checks,
+            parallel: Boolean(opts.parallel),
+            crawl: {
+                startUrl: normalizedStartUrl,
+                outputPath: outputPath ?? defaultPaths.rawJson,
+                maxPages: Number(opts.maxPages),
+                delayMs: Number(opts.delayMs),
+                timeoutMs: Number(opts.timeoutMs),
+                concurrency: Number(opts.concurrency),
+                burstDelayMs: Number(opts.burstDelayMs),
+                sitemapStart: opts.sitemapStart,
+                sitemapUrl: opts.sitemapUrl,
+                excludePatterns: parseExcludePatterns(opts.exclude),
+                respectRobotsTxt: opts.respectRobotsTxt,
+                only: opts.only,
+                skip: opts.skip,
+                revealSecrets: opts.revealSecrets,
+                quiet: opts.quiet,
+            },
+            analyze: {
+                reportPath: reportPath ?? defaultPaths.reportMd,
+                reportJsonPath: defaultPaths.reportJson,
+                errorsOnly,
+                siteUrl: normalizedStartUrl,
+            },
+        });
+        const crawlResult = outputs.crawl;
+        const analyzeResult = outputs.analyze;
+        const crawlFailure = results.find((result) => result.id === "crawl" && result.status === "failure");
+        if (crawlFailure) {
+            throw new Error(crawlFailure.error ?? "Crawl check failed.");
+        }
+        const summary = {
+            message: crawlResult?.interrupted ? "Flightcheck interrupted, partial reports written" : "Flightcheck reports written",
+            redirectOnly: outputs.redirect?.redirectOnly ?? false,
+            checks: results.map((result) => ({ id: result.id, status: result.status, durationMs: result.durationMs })),
+        };
+        if (outputs.redirect?.redirectOnly) {
+            summary.redirect = {
+                url: outputs.redirect.url,
+                status: outputs.redirect.status,
+                location: outputs.redirect.location,
+                resolvedTarget: outputs.redirect.resolvedTarget,
+                issues: outputs.redirect.issues.length,
+            };
+        }
+        if (crawlResult) {
+            summary.output = crawlResult.outputPath;
+            summary.pages = crawlResult.records.length;
+            summary.secretsFound = crawlResult.secretsFound;
+            summary.interrupted = crawlResult.interrupted;
+            if (crawlResult.secretsFound > 0 && !opts.revealSecrets) {
+                summary.hint = `${crawlResult.secretsFound} secret(s) found (masked). Re-run with --reveal-secrets to show full values.`;
+            }
+        }
+        if (analyzeResult) {
+            summary.report = analyzeResult.reportPath;
+            summary.reportJson = analyzeResult.reportJsonPath;
+            summary.findings = analyzeResult.report.findings.length;
+        }
+        process.stdout.write(`${JSON.stringify(summary, null, 2)}\n`);
+    });
+    await program.parseAsync(sanitizedArgv);
+}
+main().catch((error) => {
+    process.stderr.write(`Error: ${error instanceof Error ? error.message : String(error)}\n`);
+    process.exit(1);
+});

package/dist/crawler/checkGroups.d.ts

@@ -0,0 +1,7 @@
+export declare const CHECK_GROUPS: readonly ["meta", "icons", "social", "tracking", "stack", "security", "images", "a11y-static"];
+export type CheckGroup = (typeof CHECK_GROUPS)[number];
+export declare function resolveActiveGroups(opts: {
+    only?: string;
+    skip?: string;
+}): Set<CheckGroup>;
+//# sourceMappingURL=checkGroups.d.ts.map

package/dist/crawler/checkGroups.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkGroups.d.ts","sourceRoot":"","sources":["../../src/crawler/checkGroups.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,YAAY,gGAAiG,CAAC;AAE3H,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AAmBvD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,GAAG,CAAC,UAAU,CAAC,CAY3F"}

package/dist/crawler/checkGroups.js

@@ -0,0 +1,29 @@
+export const CHECK_GROUPS = ["meta", "icons", "social", "tracking", "stack", "security", "images", "a11y-static"];
+function parseList(value) {
+    return value
+        .split(",")
+        .map((part) => part.trim())
+        .filter((part) => part.length > 0);
+}
+function assertValid(names) {
+    const valid = new Set(CHECK_GROUPS);
+    for (const name of names) {
+        if (!valid.has(name)) {
+            throw new Error(`Unknown check group "${name}". Valid groups: ${CHECK_GROUPS.join(", ")}.`);
+        }
+    }
+    return names;
+}
+export function resolveActiveGroups(opts) {
+    if (opts.only && opts.skip) {
+        throw new Error("--only and --skip are mutually exclusive. Use one or the other.");
+    }
+    if (opts.only) {
+        return new Set(assertValid(parseList(opts.only)));
+    }
+    if (opts.skip) {
+        const skip = new Set(assertValid(parseList(opts.skip)));
+        return new Set(CHECK_GROUPS.filter((group) => !skip.has(group)));
+    }
+    return new Set(CHECK_GROUPS);
+}

package/dist/crawler/crawlState.d.ts

@@ -0,0 +1,7 @@
+import type { VerificationRecord } from "./schema.js";
+export type CrawlState = {
+    records: VerificationRecord[];
+    interrupted: boolean;
+};
+export declare function createCrawlState(): CrawlState;
+//# sourceMappingURL=crawlState.d.ts.map

package/dist/crawler/crawlState.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crawlState.d.ts","sourceRoot":"","sources":["../../src/crawler/crawlState.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEtD,MAAM,MAAM,UAAU,GAAG;IACvB,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,WAAW,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF,wBAAgB,gBAAgB,IAAI,UAAU,CAK7C"}

package/dist/crawler/crawlState.js

@@ -0,0 +1,6 @@
+export function createCrawlState() {
+    return {
+        records: [],
+        interrupted: false,
+    };
+}