@forumulate/cli 0.9.0 → 0.10.0

package/dist/doctor/probe.js

@@ -0,0 +1,170 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.attr = exports.DEFAULT_TIMEOUT_MS = void 0;
+exports.makeGet = makeGet;
+exports.pool = pool;
+exports.follow = follow;
+exports.tags = tags;
+exports.canonicalOf = canonicalOf;
+exports.metaOf = metaOf;
+exports.htmlLang = htmlLang;
+exports.decodeEntities = decodeEntities;
+exports.hostOf = hostOf;
+exports.sameUrl = sameUrl;
+exports.describeProbe = describeProbe;
+exports.check = check;
+exports.some = some;
+exports.DEFAULT_TIMEOUT_MS = 15_000;
+function makeGet(opts) {
+    const timeoutMs = opts.timeoutMs ?? exports.DEFAULT_TIMEOUT_MS;
+    return async (url, headers = {}) => {
+        const ctl = typeof AbortController === 'function' ? new AbortController() : undefined;
+        const timer = ctl ? setTimeout(() => ctl.abort(), timeoutMs) : undefined;
+        try {
+            const res = await opts.fetchImpl(url, {
+                headers,
+                redirect: 'manual',
+                ...(ctl ? { signal: ctl.signal } : {}),
+            });
+            const text = await res.text();
+            return { ok: true, url, status: res.status, headers: res.headers, text };
+        }
+        catch (e) {
+            const aborted = e instanceof Error && e.name === 'AbortError';
+            return {
+                ok: false,
+                url,
+                error: aborted
+                    ? `no answer within ${timeoutMs} ms`
+                    : e instanceof Error
+                        ? e.message
+                        : String(e),
+            };
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+        }
+    };
+}
+/**
+ * Run `fn` over `items`, at most `limit` at a time, in input order.
+ *
+ * Bounded on purpose: the doctor runs from a laptop or a CI runner against a
+ * customer's production site, and a hundred simultaneous requests is how a
+ * health check becomes the incident it was meant to catch.
+ */
+async function pool(items, limit, fn) {
+    const out = new Array(items.length);
+    let next = 0;
+    const workers = Array.from({ length: Math.max(1, Math.min(limit, items.length)) }, async () => {
+        while (next < items.length) {
+            const i = next++;
+            out[i] = await fn(items[i]);
+        }
+    });
+    await Promise.all(workers);
+    return out;
+}
+/** Follow redirects by hand (bounded), keeping every hop — the hops are what a check judges. */
+async function follow(get, url, headers = {}, maxHops = 5) {
+    const hops = [];
+    let at = url;
+    for (let i = 0; i <= maxHops; i++) {
+        const p = await get(at, headers);
+        hops.push(p);
+        if (!p.ok || p.status < 300 || p.status >= 400)
+            return { hops, final: p };
+        const loc = p.headers.get('location');
+        if (!loc)
+            return { hops, final: p };
+        at = new URL(loc, at).toString();
+    }
+    return { hops, final: hops[hops.length - 1] };
+}
+/** One attribute's value from one tag's source, quoted or not. */
+function attrOf(tag, name) {
+    const m = new RegExp(`\\b${name}\\s*=\\s*(?:"([^"]*)"|'([^']*)'|([^\\s>]+))`, 'i').exec(tag);
+    return m ? (m[1] ?? m[2] ?? m[3]) : undefined;
+}
+function tags(html, name) {
+    return html.match(new RegExp(`<${name}\\b[^>]*>`, 'gi')) ?? [];
+}
+exports.attr = attrOf;
+/** `<link rel="canonical">`, absolute against `base`, or undefined. */
+function canonicalOf(html, base) {
+    for (const t of tags(html, 'link')) {
+        const rel = (attrOf(t, 'rel') ?? '').toLowerCase().split(/\s+/);
+        if (!rel.includes('canonical'))
+            continue;
+        const href = attrOf(t, 'href');
+        if (!href)
+            continue;
+        try {
+            return new URL(decodeEntities(href), base).toString();
+        }
+        catch {
+            return href;
+        }
+    }
+    return undefined;
+}
+/** `<meta name|property=X content=…>`. */
+function metaOf(html, key) {
+    for (const t of tags(html, 'meta')) {
+        const k = (attrOf(t, 'name') ?? attrOf(t, 'property') ?? '').toLowerCase();
+        if (k === key.toLowerCase())
+            return decodeEntities(attrOf(t, 'content') ?? '');
+    }
+    return undefined;
+}
+/** The document's declared language (`<html lang>`), lower-cased, or undefined. */
+function htmlLang(html) {
+    const t = tags(html, 'html')[0];
+    return t ? attrOf(t, 'lang')?.toLowerCase() : undefined;
+}
+function decodeEntities(s) {
+    return s
+        .replace(/&amp;/g, '&')
+        .replace(/&quot;/g, '"')
+        .replace(/&#x27;|&#39;/g, "'")
+        .replace(/&lt;/g, '<')
+        .replace(/&gt;/g, '>');
+}
+function hostOf(href) {
+    try {
+        return new URL(href).host.toLowerCase();
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Compare two URLs the way a search engine would: no fragment, no trailing slash. */
+function sameUrl(a, b) {
+    if (!a || !b)
+        return false;
+    const norm = (u) => {
+        try {
+            const x = new URL(u);
+            x.hash = '';
+            return `${x.protocol}//${x.host.toLowerCase()}${x.pathname.replace(/\/+$/, '') || '/'}${x.search}`;
+        }
+        catch {
+            return u;
+        }
+    };
+    return norm(a) === norm(b);
+}
+function describeProbe(p) {
+    return p.ok ? `${p.status}` : p.error;
+}
+/** A check under construction: the shape `runDoctor` reports. */
+function check(id, title, state, detail, matters = '') {
+    return { id, title, state, detail, matters };
+}
+/** At most `n` items of a list in a detail line, and how many were left out. */
+function some(list, n = 5) {
+    const shown = list.slice(0, n).join('; ');
+    return list.length > n ? `${shown}; …and ${list.length - n} more` : shown;
+}
+//# sourceMappingURL=probe.js.map

package/dist/doctor/probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe.js","sourceRoot":"","sources":["../../src/doctor/probe.ts"],"names":[],"mappings":";;;AAuBA,0BA4BC;AAWD,oBAeC;AAGD,wBAiBC;AAQD,oBAEC;AAKD,kCAaC;AAGD,wBAMC;AAGD,4BAGC;AAED,wCAOC;AAED,wBAMC;AAGD,0BAYC;AAED,sCAEC;AAGD,sBAQC;AAGD,oBAGC;AA5KY,QAAA,kBAAkB,GAAG,MAAM,CAAC;AAEzC,SAAgB,OAAO,CAAC,IAAkB;IACxC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,0BAAkB,CAAC;IACvD,OAAO,KAAK,EAAE,GAAW,EAAE,UAAkC,EAAE,EAAkB,EAAE;QACjF,MAAM,GAAG,GAAG,OAAO,eAAe,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACtF,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE;gBACpC,OAAO;gBACP,QAAQ,EAAE,QAAQ;gBAClB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvC,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC;YAC9D,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,GAAG;gBACH,KAAK,EAAE,OAAO;oBACZ,CAAC,CAAC,oBAAoB,SAAS,KAAK;oBACpC,CAAC,CAAC,CAAC,YAAY,KAAK;wBAClB,CAAC,CAAC,CAAC,CAAC,OAAO;wBACX,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;aAChB,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAID;;;;;;GAMG;AACI,KAAK,UAAU,IAAI,CACxB,KAAU,EACV,KAAa,EACb,EAAwB;IAExB,MAAM,GAAG,GAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE;QAC5F,OAAO,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;YACjB,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gGAAgG;AACzF,KAAK,UAAU,MAAM,CAC1B,GAAQ,EACR,GAAW,EACX,UAAkC,EAAE,EACpC,OAAO,GAAG,CAAC;IAEX,MAAM,IAAI,GAAY,EAAE,CAAC;IACzB,IAAI,EAAE,GAAG,GAAG,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACb,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG;YAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAC1E,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACtC,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACpC,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IACnC,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAE,EAAE,CAAC;AACjD,CAAC;AAED,kEAAkE;AAClE,SAAS,MAAM,CAAC,GAAW,EAAE,IAAY;IACvC,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,MAAM,IAAI,6CAA6C,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7F,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAChD,CAAC;AAED,SAAgB,IAAI,CAAC,IAAY,EAAE,IAAY;IAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,IAAI,WAAW,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;AACjE,CAAC;AAEY,QAAA,IAAI,GAAG,MAAM,CAAC;AAE3B,uEAAuE;AACvE,SAAgB,WAAW,CAAC,IAAY,EAAE,IAAY;IACpD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAChE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,SAAS;QACzC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,0CAA0C;AAC1C,SAAgB,MAAM,CAAC,IAAY,EAAE,GAAW;IAC9C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3E,IAAI,CAAC,KAAK,GAAG,CAAC,WAAW,EAAE;YAAE,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,mFAAmF;AACnF,SAAgB,QAAQ,CAAC,IAAY;IACnC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAChC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1D,CAAC;AAED,SAAgB,cAAc,CAAC,CAAS;IACtC,OAAO,CAAC;SACL,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;SACtB,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC;SAC7B,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;SACrB,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED,SAAgB,MAAM,CAAC,IAAY;IACjC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,SAAgB,OAAO,CAAC,CAAqB,EAAE,CAAqB;IAClE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE;QACzB,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;YACrB,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;YACZ,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;QACrG,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC,CAAC;IACF,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED,SAAgB,aAAa,CAAC,CAAQ;IACpC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACxC,CAAC;AAED,iEAAiE;AACjE,SAAgB,KAAK,CACnB,EAAU,EACV,KAAa,EACb,KAAqB,EACrB,MAAc,EACd,OAAO,GAAG,EAAE;IAEZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC/C,CAAC;AAED,gFAAgF;AAChF,SAAgB,IAAI,CAAC,IAAc,EAAE,CAAC,GAAG,CAAC;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,UAAU,IAAI,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;AAC5E,CAAC"}

package/dist/doctor/reader-auth-atlas.d.ts

@@ -0,0 +1,18 @@
+import type { Check } from '../conformance';
+import type { Http } from '../api/http';
+export declare const READER_AUTH_ATLAS_CHECK = "reader-auth-atlas";
+/**
+ * `reader-auth-atlas` (FMU-X01): does this organization sign its readers in
+ * the recommended way?
+ *
+ * The rule is the API's, not the CLI's: `GET /orgs/{org}/reader-auth`
+ * answers `recommendations`, computed from the org's own configuration (an
+ * Atlas issuer on an `external_jwt` provider, a linked Atlas instance), and
+ * the manifest plan answers the same list. This prints what it says.
+ *
+ * Advice, like `robots-params`: a recommendation is a SKIP with the steps,
+ * never a FAIL, because signing readers in from your own app is a supported
+ * setup and a scheduled doctor must not fail CI over it.
+ */
+export declare function readerAuthAtlasCheck(http: Http, org: string): Promise<Check>;
+//# sourceMappingURL=reader-auth-atlas.d.ts.map

package/dist/doctor/reader-auth-atlas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reader-auth-atlas.d.ts","sourceRoot":"","sources":["../../src/doctor/reader-auth-atlas.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAGxC,eAAO,MAAM,uBAAuB,sBAAsB,CAAC;AAe3D;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAsClF"}

package/dist/doctor/reader-auth-atlas.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.READER_AUTH_ATLAS_CHECK = void 0;
+exports.readerAuthAtlasCheck = readerAuthAtlasCheck;
+const probe_1 = require("./probe");
+exports.READER_AUTH_ATLAS_CHECK = 'reader-auth-atlas';
+const TITLE = 'Readers sign in with the Atlas reader provider when the organization uses Atlas';
+const MATTERS = 'A hand-rolled external_jwt route is code you maintain that the Atlas provider does for you: Forumulate verifies Atlas’s own reader token and keys members on (iss, sub).';
+/**
+ * `reader-auth-atlas` (FMU-X01): does this organization sign its readers in
+ * the recommended way?
+ *
+ * The rule is the API's, not the CLI's: `GET /orgs/{org}/reader-auth`
+ * answers `recommendations`, computed from the org's own configuration (an
+ * Atlas issuer on an `external_jwt` provider, a linked Atlas instance), and
+ * the manifest plan answers the same list. This prints what it says.
+ *
+ * Advice, like `robots-params`: a recommendation is a SKIP with the steps,
+ * never a FAIL, because signing readers in from your own app is a supported
+ * setup and a scheduled doctor must not fail CI over it.
+ */
+async function readerAuthAtlasCheck(http, org) {
+    let body;
+    try {
+        body = (await http.send({ method: 'GET', path: `/orgs/${encodeURIComponent(org)}/reader-auth` }))
+            .data;
+    }
+    catch (e) {
+        const err = e;
+        return (0, probe_1.check)(exports.READER_AUTH_ATLAS_CHECK, TITLE, 'skip', `Could not read the organization's reader sign-in (${err.status ?? 'error'}): it needs a token with org.manage_settings.`, '');
+    }
+    const rec = (body.recommendations ?? []).find((r) => r.code === 'reader_auth.use_atlas');
+    if (!rec) {
+        const methods = (body.providers ?? []).map((p) => p.method);
+        return (0, probe_1.check)(exports.READER_AUTH_ATLAS_CHECK, TITLE, 'pass', methods.includes('atlas_byo')
+            ? 'atlas_byo is configured.'
+            : `Nothing to recommend${methods.length ? ` (${methods.join(', ')})` : ''}.`, '');
+    }
+    const lines = [
+        `Recommended — ${rec.message}`,
+        rec.relink
+            ? `  1. Relink the members: POST /orgs/${org}/members/relink ${JSON.stringify({ from: rec.relink.from, to: rec.relink.to })} (dry run first; ?apply=true writes)`
+            : null,
+        `  ${rec.relink ? '2' : '1'}. Switch: PATCH /orgs/${org}/reader-auth ${JSON.stringify(rec.patch)}`,
+        `     or in a manifest (version 2): ${JSON.stringify(rec.manifest)}`,
+        rec.docs ? `  See ${rec.docs}` : null,
+    ].filter((l) => l !== null);
+    return (0, probe_1.check)(exports.READER_AUTH_ATLAS_CHECK, TITLE, 'skip', lines.join('\n'), MATTERS);
+}
+//# sourceMappingURL=reader-auth-atlas.js.map

package/dist/doctor/reader-auth-atlas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reader-auth-atlas.js","sourceRoot":"","sources":["../../src/doctor/reader-auth-atlas.ts"],"names":[],"mappings":";;;AAgCA,oDAsCC;AApED,mCAAgC;AAEnB,QAAA,uBAAuB,GAAG,mBAAmB,CAAC;AAE3D,MAAM,KAAK,GAAG,iFAAiF,CAAC;AAChG,MAAM,OAAO,GACX,0KAA0K,CAAC;AAW7K;;;;;;;;;;;;GAYG;AACI,KAAK,UAAU,oBAAoB,CAAC,IAAU,EAAE,GAAW;IAChE,IAAI,IAA8E,CAAC;IACnF,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,kBAAkB,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC;aAC9F,IAAmB,CAAC;IACzB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAA0C,CAAC;QACvD,OAAO,IAAA,aAAK,EACV,+BAAuB,EACvB,KAAK,EACL,MAAM,EACN,qDAAqD,GAAG,CAAC,MAAM,IAAI,OAAO,+CAA+C,EACzH,EAAE,CACH,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,uBAAuB,CAAC,CAAC;IACzF,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC5D,OAAO,IAAA,aAAK,EACV,+BAAuB,EACvB,KAAK,EACL,MAAM,EACN,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC3B,CAAC,CAAC,0BAA0B;YAC5B,CAAC,CAAC,uBAAuB,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAC9E,EAAE,CACH,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG;QACZ,iBAAiB,GAAG,CAAC,OAAO,EAAE;QAC9B,GAAG,CAAC,MAAM;YACR,CAAC,CAAC,uCAAuC,GAAG,mBAAmB,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,sCAAsC;YACjK,CAAC,CAAC,IAAI;QACR,KAAK,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,yBAAyB,GAAG,gBAAgB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE;QAClG,sCAAsC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE;QACpE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI;KACtC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IACzC,OAAO,IAAA,aAAK,EAAC,+BAAuB,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;AAClF,CAAC"}

package/dist/doctor/robots-params.d.ts

@@ -0,0 +1,36 @@
+import type { Check } from '../conformance';
+/**
+ * `robots-params`: the `Disallow` lines that keep crawlers off the re-cut
+ * addresses of a mounted space's lists (SEO spec §1, item 5).
+ *
+ * A reader page offers its sort, order, scope, period, filter, solved and
+ * range choices as GET forms, which crawlers do not submit — but an address
+ * already in a crawler's queue, a backlink, or another site's
+ * `?sort=name&order=desc` link still reaches it. Those copies say `noindex`
+ * (or name the uncut page as canonical), and are still a crawl each. The host's
+ * robots.txt is the one place that can say "do not even fetch these", and for
+ * a space mounted on somebody else's domain (`acme.com/community`) it is THEIR
+ * file — we cannot write it. So the doctor prints the lines to paste.
+ *
+ * Advisory, never a failure: a site that wants those copies crawled is making
+ * a choice. Passes once every line for this host is already in its robots.txt.
+ * Judged by HTTP alone, so it is the same for any host the doctor is pointed at.
+ */
+/**
+ * The query keys a reader list is re-cut by — the web reader's
+ * `VARIANT_PARAMS` (apps/web/src/lib/reader-variant-robots.ts). Never `page`
+ * (a page of a list is a document of its own) and never a search.
+ */
+export declare const VARIANT_PARAMS: readonly ["sort", "order", "scope", "period", "window", "filter", "solved", "range", "replies", "release"];
+/**
+ * The lines for one mount. `*` and the `?` are robots wildcards (RFC 9309 §2.2.3
+ * — Google, Bing and every major crawler read them): `/community*?*sort=` is any
+ * address under the mount whose query names `sort`, first or not.
+ */
+export declare function disallowLines(mountPath: string): string[];
+/** The roots grouped by the origin whose robots.txt would carry them. */
+export declare function linesByOrigin(roots: readonly string[]): Map<string, string[]>;
+export declare function robotsParams(roots: readonly string[], 
+/** The origin whose robots.txt was read. */
+origin: string, robots: string | undefined): Check;
+//# sourceMappingURL=robots-params.d.ts.map

package/dist/doctor/robots-params.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"robots-params.d.ts","sourceRoot":"","sources":["../../src/doctor/robots-params.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAG5C;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;GAIG;AACH,eAAO,MAAM,cAAc,4GAWjB,CAAC;AAEX;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAIzD;AAED,yEAAyE;AACzE,wBAAgB,aAAa,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAc7E;AAUD,wBAAgB,YAAY,CAC1B,KAAK,EAAE,SAAS,MAAM,EAAE;AACxB,4CAA4C;AAC5C,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB,KAAK,CAuBP"}

package/dist/doctor/robots-params.js

@@ -0,0 +1,97 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VARIANT_PARAMS = void 0;
+exports.disallowLines = disallowLines;
+exports.linesByOrigin = linesByOrigin;
+exports.robotsParams = robotsParams;
+const probe_1 = require("./probe");
+/**
+ * `robots-params`: the `Disallow` lines that keep crawlers off the re-cut
+ * addresses of a mounted space's lists (SEO spec §1, item 5).
+ *
+ * A reader page offers its sort, order, scope, period, filter, solved and
+ * range choices as GET forms, which crawlers do not submit — but an address
+ * already in a crawler's queue, a backlink, or another site's
+ * `?sort=name&order=desc` link still reaches it. Those copies say `noindex`
+ * (or name the uncut page as canonical), and are still a crawl each. The host's
+ * robots.txt is the one place that can say "do not even fetch these", and for
+ * a space mounted on somebody else's domain (`acme.com/community`) it is THEIR
+ * file — we cannot write it. So the doctor prints the lines to paste.
+ *
+ * Advisory, never a failure: a site that wants those copies crawled is making
+ * a choice. Passes once every line for this host is already in its robots.txt.
+ * Judged by HTTP alone, so it is the same for any host the doctor is pointed at.
+ */
+/**
+ * The query keys a reader list is re-cut by — the web reader's
+ * `VARIANT_PARAMS` (apps/web/src/lib/reader-variant-robots.ts). Never `page`
+ * (a page of a list is a document of its own) and never a search.
+ */
+exports.VARIANT_PARAMS = [
+    'sort',
+    'order',
+    'scope',
+    'period',
+    'window',
+    'filter',
+    'solved',
+    'range',
+    'replies',
+    'release',
+];
+/**
+ * The lines for one mount. `*` and the `?` are robots wildcards (RFC 9309 §2.2.3
+ * — Google, Bing and every major crawler read them): `/community*?*sort=` is any
+ * address under the mount whose query names `sort`, first or not.
+ */
+function disallowLines(mountPath) {
+    const mount = mountPath.replace(/\/+$/, '');
+    const at = mount ? `${mount}*` : '/*';
+    return exports.VARIANT_PARAMS.map((p) => `Disallow: ${at}?*${p}=`);
+}
+/** The roots grouped by the origin whose robots.txt would carry them. */
+function linesByOrigin(roots) {
+    const out = new Map();
+    for (const root of roots) {
+        let u;
+        try {
+            u = new URL(root);
+        }
+        catch {
+            continue;
+        }
+        const list = out.get(u.origin) ?? [];
+        for (const l of disallowLines(u.pathname))
+            if (!list.includes(l))
+                list.push(l);
+        out.set(u.origin, list);
+    }
+    return out;
+}
+/** Does robots.txt already say `line` (any case, any spacing after the colon)? */
+function has(robots, line) {
+    const want = line.replace(/^disallow:\s*/i, '').trim();
+    return robots
+        .split(/\r?\n/)
+        .some((l) => /^\s*disallow:/i.test(l) && l.replace(/^\s*disallow:\s*/i, '').trim() === want);
+}
+function robotsParams(roots, 
+/** The origin whose robots.txt was read. */
+origin, robots) {
+    const title = "robots.txt keeps crawlers off a space's sorted and filtered copies";
+    const byOrigin = linesByOrigin(roots);
+    if (!byOrigin.size)
+        return (0, probe_1.check)('robots-params', title, 'skip', 'No space root to suggest lines for.', '');
+    const ownLines = byOrigin.get(origin) ?? [];
+    const missing = robots === undefined ? ownLines : ownLines.filter((l) => !has(robots, l));
+    const others = [...byOrigin].filter(([o]) => o !== origin);
+    if (!missing.length && !others.length)
+        return (0, probe_1.check)('robots-params', title, 'pass', `All ${ownLines.length} lines are in ${origin}/robots.txt.`, '');
+    const block = (o, lines) => [`# ${o}/robots.txt`, 'User-agent: *', ...lines].map((l) => `  ${l}`).join('\n');
+    const parts = [
+        ...(missing.length ? [block(origin, missing)] : []),
+        ...others.map(([o, lines]) => block(o, lines)),
+    ];
+    return (0, probe_1.check)('robots-params', title, 'skip', `Suggested — add to the host's robots.txt (the pages already say noindex or name their canonical; this saves the crawl):\n${parts.join('\n')}`, "Every sorted, scoped or filtered copy of a list is a fetch a crawler spends instead of a page that can rank.");
+}
+//# sourceMappingURL=robots-params.js.map

package/dist/doctor/robots-params.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"robots-params.js","sourceRoot":"","sources":["../../src/doctor/robots-params.ts"],"names":[],"mappings":";;;AA4CA,sCAIC;AAGD,sCAcC;AAUD,oCA4BC;AAtGD,mCAAgC;AAEhC;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;GAIG;AACU,QAAA,cAAc,GAAG;IAC5B,MAAM;IACN,OAAO;IACP,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,SAAS;IACT,SAAS;CACD,CAAC;AAEX;;;;GAIG;AACH,SAAgB,aAAa,CAAC,SAAiB;IAC7C,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5C,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACtC,OAAO,sBAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;AAC7D,CAAC;AAED,yEAAyE;AACzE,SAAgB,aAAa,CAAC,KAAwB;IACpD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAoB,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAM,CAAC;QACX,IAAI,CAAC;YACH,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/E,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,kFAAkF;AAClF,SAAS,GAAG,CAAC,MAAc,EAAE,IAAY;IACvC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvD,OAAO,MAAM;SACV,KAAK,CAAC,OAAO,CAAC;SACd,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,CAAC;AACjG,CAAC;AAED,SAAgB,YAAY,CAC1B,KAAwB;AACxB,4CAA4C;AAC5C,MAAc,EACd,MAA0B;IAE1B,MAAM,KAAK,GAAG,oEAAoE,CAAC;IACnF,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,CAAC,QAAQ,CAAC,IAAI;QAChB,OAAO,IAAA,aAAK,EAAC,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,EAAE,EAAE,CAAC,CAAC;IAC1F,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC;IAC3D,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM;QACnC,OAAO,IAAA,aAAK,EAAC,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,QAAQ,CAAC,MAAM,iBAAiB,MAAM,cAAc,EAAE,EAAE,CAAC,CAAC;IAChH,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,KAAe,EAAE,EAAE,CAC3C,CAAC,KAAK,CAAC,aAAa,EAAE,eAAe,EAAE,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnF,MAAM,KAAK,GAAG;QACZ,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;KAC/C,CAAC;IACF,OAAO,IAAA,aAAK,EACV,eAAe,EACf,KAAK,EACL,MAAM,EACN,4HAA4H,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC9I,8GAA8G,CAC/G,CAAC;AACJ,CAAC"}

package/dist/doctor/site.d.ts

@@ -0,0 +1,42 @@
+import type { Http } from '../api/http';
+import type { AddressSet } from './address-checks';
+import type { Get } from './probe';
+/**
+ * `doctor --site <slug|id>`: every address of every space on a site, from the API.
+ *
+ * From a URL alone the doctor sees one copy of a page. The defects that bit
+ * the integrator were in the OTHER copy — the platform address of a legal page
+ * naming itself canonical (FMU-B01) — which nobody opens because readers never
+ * get there. The API knows every address a space is served at (its
+ * `readerEndpoints`: the customer's domain first, then the platform's), so this
+ * asks it, and the checks then compare the copies.
+ */
+export interface ReaderEndpoint {
+    url: string;
+    kind?: string;
+    primary?: boolean;
+}
+export interface ResolvedSpace {
+    id: string;
+    /** Primary first. */
+    endpoints: ReaderEndpoint[];
+}
+export interface ResolvedSite {
+    id: string;
+    slug?: string;
+    name?: string;
+    spaces: ResolvedSpace[];
+    /** The address the report is run against: the first space's primary root. */
+    url?: string;
+    /** Spaces whose addresses could not be read, and why. */
+    problems: string[];
+}
+export declare function resolveSite(http: Http, org: string, site: string): Promise<ResolvedSite>;
+/**
+ * The address sets the two-address check compares: each space's ROOT at every
+ * address, and one real PAGE per space — the first its sitemap lists under the
+ * primary root — mapped onto every other address by its path below the root.
+ * A root alone would miss the legal-page defect, which only pages had.
+ */
+export declare function addressSetsFor(get: Get, site: ResolvedSite): Promise<AddressSet[]>;
+//# sourceMappingURL=site.d.ts.map

package/dist/doctor/site.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"site.d.ts","sourceRoot":"","sources":["../../src/doctor/site.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,SAAS,CAAC;AAEnC;;;;;;;;;GASG;AAEH,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,qBAAqB;IACrB,SAAS,EAAE,cAAc,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yDAAyD;IACzD,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AASD,wBAAsB,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAwC9F;AAID;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CA2BxF"}

package/dist/doctor/site.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveSite = resolveSite;
+exports.addressSetsFor = addressSetsFor;
+const crawl_1 = require("./crawl");
+async function resolveSite(http, org, site) {
+    const enc = encodeURIComponent;
+    const { data } = await http.send({ method: 'GET', path: `/orgs/${enc(org)}/sites` });
+    const rows = (data.sites ??
+        data.data ??
+        []);
+    const row = rows.find((s) => s.id === site || s.slug === site);
+    if (!row) {
+        const known = rows.map((s) => s.slug ?? s.id).join(', ') || 'none';
+        throw Object.assign(new Error(`No site "${site}" in ${org}. Sites: ${known}.`), {
+            status: 404,
+        });
+    }
+    const spaces = [];
+    const problems = [];
+    for (const spaceId of row.spaceIds ?? []) {
+        try {
+            const res = await http.send({
+                method: 'GET',
+                path: `/orgs/${enc(org)}/spaces/${enc(spaceId)}/reader-auth`,
+            });
+            const endpoints = (res.data.readerEndpoints ?? []).filter((e) => typeof e.url === 'string' && /^https?:/.test(e.url));
+            // Primary first, whatever order the answer used.
+            endpoints.sort((a, b) => Number(!!b.primary) - Number(!!a.primary));
+            if (endpoints.length)
+                spaces.push({ id: spaceId, endpoints });
+            else
+                problems.push(`${spaceId}: no reader addresses (private, or not published)`);
+        }
+        catch (e) {
+            problems.push(`${spaceId}: ${e.message}`);
+        }
+    }
+    return {
+        id: row.id,
+        slug: row.slug,
+        name: row.name,
+        spaces,
+        url: spaces[0]?.endpoints[0]?.url,
+        problems,
+    };
+}
+const trim = (u) => u.replace(/\/+$/, '');
+/**
+ * The address sets the two-address check compares: each space's ROOT at every
+ * address, and one real PAGE per space — the first its sitemap lists under the
+ * primary root — mapped onto every other address by its path below the root.
+ * A root alone would miss the legal-page defect, which only pages had.
+ */
+async function addressSetsFor(get, site) {
+    const sets = [];
+    // One sitemap read per host: a site's spaces usually share one domain.
+    const urlsByOrigin = new Map();
+    for (const space of site.spaces) {
+        if (space.endpoints.length < 2)
+            continue;
+        const roots = space.endpoints.map((e) => trim(e.url));
+        const primary = roots[0];
+        sets.push({ expected: primary, urls: roots });
+        const origin = new URL(primary).origin;
+        if (!urlsByOrigin.has(origin)) {
+            const r = await get(`${origin}/robots.txt`);
+            const robots = r.ok && r.status === 200 ? r.text : '';
+            const { lists } = await (0, crawl_1.readSitemaps)(get, (0, crawl_1.sitemapsFromRobots)(robots, origin));
+            urlsByOrigin.set(origin, lists.flatMap((l) => l.urls));
+        }
+        const page = urlsByOrigin
+            .get(origin)
+            .find((u) => u.startsWith(`${primary}/`) && u.length > primary.length + 1);
+        if (!page)
+            continue;
+        const rest = page.slice(primary.length);
+        sets.push({ expected: page, urls: roots.map((r) => `${r}${rest}`) });
+    }
+    return sets;
+}
+//# sourceMappingURL=site.js.map

package/dist/doctor/site.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"site.js","sourceRoot":"","sources":["../../src/doctor/site.ts"],"names":[],"mappings":";;AA8CA,kCAwCC;AAUD,wCA2BC;AAzHD,mCAA2D;AA4CpD,KAAK,UAAU,WAAW,CAAC,IAAU,EAAE,GAAW,EAAE,IAAY;IACrE,MAAM,GAAG,GAAG,kBAAkB,CAAC;IAC/B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IACrF,MAAM,IAAI,GAAG,CAAE,IAAgD,CAAC,KAAK;QAClE,IAA6B,CAAC,IAAI;QACnC,EAAE,CAAc,CAAC;IACnB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC/D,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC;QACnE,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,YAAY,IAAI,QAAQ,GAAG,YAAY,KAAK,GAAG,CAAC,EAAE;YAC9E,MAAM,EAAE,GAAG;SACZ,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,OAAO,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC;gBAC1B,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,SAAS,GAAG,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,OAAO,CAAC,cAAc;aAC7D,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,CACf,GAAG,CAAC,IAA+C,CAAC,eAAe,IAAI,EAAE,CAC3E,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACrE,iDAAiD;YACjD,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;YACpE,IAAI,SAAS,CAAC,MAAM;gBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;;gBACzD,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,mDAAmD,CAAC,CAAC;QACpF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,KAAM,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IACD,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,MAAM;QACN,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG;QACjC,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAElD;;;;;GAKG;AACI,KAAK,UAAU,cAAc,CAAC,GAAQ,EAAE,IAAkB;IAC/D,MAAM,IAAI,GAAiB,EAAE,CAAC;IAC9B,uEAAuE;IACvE,MAAM,YAAY,GAAG,IAAI,GAAG,EAAoB,CAAC;IACjD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QACzC,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QACvC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,GAAG,MAAM,aAAa,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAA,oBAAY,EAAC,GAAG,EAAE,IAAA,0BAAkB,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;YAC9E,YAAY,CAAC,GAAG,CACd,MAAM,EACN,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAC7B,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,YAAY;aACtB,GAAG,CAAC,MAAM,CAAE;aACZ,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC7E,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/doctor.d.ts

@@ -1,4 +1,5 @@
 import type { Check } from './conformance';
+import type { AddressSet } from './doctor/address-checks';
 /**
  * Everything that is wrong with a live site, from the outside.
  *
@@ -21,7 +22,27 @@ export interface DoctorInput {
     /** The API base, when it is not the same origin (defaults to the site's). */
     apiBase?: string;
     fetchImpl?: typeof fetch;
+    /**
+     * Only these check ids (`--only`). The single-page checks are cheap and run
+     * regardless, then are filtered; the site-wide ones (a sitemap crawl) are
+     * not started unless asked for.
+     */
+    only?: string[];
+    /** The platform's hostname, for the white-label and two-address checks. Default forumulate.com. */
+    platformHost?: string;
+    /** The platform's API base, for the primary-address lookup. Default `https://<platformHost>/api`. */
+    platformApi?: string;
+    /** Other addresses of the same page (`--also`, or looked up by `--site`). */
+    addressSets?: AddressSet[];
+    /** The space roots to check (`--site` knows them; otherwise derived from the URL). */
+    roots?: string[];
+    /** How many sitemap URLs to sample (`--limit`). */
+    limit?: number;
+    /** Per-request timeout. */
+    timeoutMs?: number;
 }
+/** The single-page checks, in report order; the site-wide ones are `EXTENDED_CHECK_IDS`. */
+export declare const BASE_CHECK_IDS: readonly ["health", "public-read", "canonical", "html-untouched", "cache-headers", "robots", "sitemap", "crawler-access", "feeds", "images"];
 export interface DoctorReport {
     url: string;
     checks: Check[];

package/dist/doctor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAE3C;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,WAAW;IAC1B,yEAAyE;IACzE,GAAG,EAAE,MAAM,CAAC;IACZ,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAKD,wBAAsB,SAAS,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAiUzE;AAoCD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB,SAAS,CAAC"}
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAE3C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAG1D;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,WAAW;IAC1B,yEAAyE;IACzE,GAAG,EAAE,MAAM,CAAC;IACZ,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,mGAAmG;IACnG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qGAAqG;IACrG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC;IAC3B,sFAAsF;IACtF,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,mDAAmD;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2BAA2B;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,4FAA4F;AAC5F,eAAO,MAAM,cAAc,8IAWjB,CAAC;AAEX,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAKD,wBAAsB,SAAS,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CA2XzE;AAoCD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB,SAAS,CAAC"}