@forumulate/cli 0.9.0 → 0.10.0

package/dist/credentials.js

@@ -2,7 +2,9 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.credentialsPath = credentialsPath;
 exports.readCredentials = readCredentials;
+exports.resolveTokenSource = resolveTokenSource;
 exports.resolveToken = resolveToken;
+exports.takeTokenFlag = takeTokenFlag;
 exports.storeToken = storeToken;
 exports.forgetToken = forgetToken;
 exports.normalizeBase = normalizeBase;
@@ -27,11 +29,72 @@ function readCredentials(env = process.env) {
         return { tokens: {} };
     }
 }
-/** The token for a base URL: the environment first, then what `login` stored. */
-function resolveToken(baseUrl, env = process.env) {
+/**
+ * The token for a base URL, and where it was found: `--token` beats
+ * `FORUMULATE_TOKEN` beats `credentials.json`. An integrator with one PAT in
+ * the shell, another in the file and a third in CI could not tell which one a
+ * 401 was about; this is the precedence, said once.
+ */
+function resolveTokenSource(baseUrl, env = process.env, flagToken) {
+    if (flagToken?.trim())
+        return { token: flagToken.trim(), source: 'flag' };
     if (env.FORUMULATE_TOKEN)
-        return env.FORUMULATE_TOKEN;
-    return readCredentials(env).tokens[normalizeBase(baseUrl)];
+        return { token: env.FORUMULATE_TOKEN, source: 'env' };
+    const stored = readCredentials(env).tokens[normalizeBase(baseUrl)];
+    if (stored)
+        return { token: stored, source: 'credentials', path: credentialsPath(env) };
+    return { source: 'none' };
+}
+/**
+ * The token for a base URL, by the same precedence as `resolveTokenSource`:
+ * `--token`, then the environment, then what `login` stored.
+ *
+ * This used to skip the flag. `cli.ts` read `--token` for the SDK client only,
+ * so `whoami --token x` used x while `items list --token x`, `api …`, `doctor
+ * --site` and `validate` (each building its own transport through here) sent
+ * `FORUMULATE_TOKEN` or the stored token instead: the documented precedence
+ * held for two commands (FMU-DOC01). One resolver, every caller.
+ */
+function resolveToken(baseUrl, env = process.env, flagToken) {
+    return resolveTokenSource(baseUrl, env, flagToken).token;
+}
+/**
+ * Take the global `--token <pat>` / `--token=<pat>` out of an argument list.
+ *
+ * The older commands in `run.ts` parse against a fixed list of value flags,
+ * so the flag and its value are removed before they see the arguments. The
+ * `api` and resource commands get the arguments as given: there an operation
+ * that declares a `token` parameter (a registry's, a GitHub connection's)
+ * owns the flag, and `api/request.ts` keeps it out of the query string
+ * everywhere else. Nothing after `--` is touched; the last `--token` wins, as
+ * with every other repeated flag.
+ */
+function takeTokenFlag(argv) {
+    const rest = [];
+    let token;
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        if (a === '--') {
+            rest.push(...argv.slice(i));
+            break;
+        }
+        if (a.startsWith('--token='))
+            token = a.slice('--token='.length);
+        else if (a === '--token') {
+            const next = argv[i + 1];
+            // `--token --json` is a missing value, not a token called "--json".
+            if (next !== undefined && !next.startsWith('-')) {
+                token = next;
+                i += 1;
+            }
+            else
+                token = '';
+        }
+        else
+            rest.push(a);
+    }
+    const trimmed = token?.trim();
+    return { argv: rest, token: trimmed ? trimmed : undefined };
 }
 function storeToken(baseUrl, token, env = process.env) {
     const path = credentialsPath(env);

package/dist/credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":";;AAwBA,0CAOC;AAED,0CASC;AAGD,oCAMC;AAED,gCAcC;AAED,kCAiBC;AAGD,sCAEC;AA3FD,qCAAoF;AACpF,qCAAkC;AAClC,yCAA0C;AAsB1C,SAAgB,eAAe,CAAC,MAAyB,OAAO,CAAC,GAAG;IAClE,MAAM,IAAI,GACR,GAAG,CAAC,qBAAqB;QACzB,CAAC,GAAG,CAAC,eAAe;YAClB,CAAC,CAAC,IAAA,gBAAI,EAAC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC;YACzC,CAAC,CAAC,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;IAChD,OAAO,IAAA,gBAAI,EAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;AACxC,CAAC;AAED,SAAgB,eAAe,CAAC,MAAyB,OAAO,CAAC,GAAG;IAClE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,eAAe,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAyB,CAAC;QAC9F,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,6EAA6E;QAC7E,+BAA+B;QAC/B,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACxB,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,SAAgB,YAAY,CAC1B,OAAe,EACf,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,GAAG,CAAC,gBAAgB;QAAE,OAAO,GAAG,CAAC,gBAAgB,CAAC;IACtD,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,SAAgB,UAAU,CACxB,OAAe,EACf,KAAa,EACb,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACnC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC;IAC7C,IAAA,mBAAS,EAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,IAAA,uBAAa,EAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5E,8EAA8E;IAC9E,0EAA0E;IAC1E,IAAA,mBAAS,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,WAAW,CAAC,OAAe,EAAE,MAAyB,OAAO,CAAC,GAAG;IAC/E,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3C,IAAI,CAAC;YACH,IAAA,gBAAM,EAAC,IAAI,CAAC,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAA,uBAAa,EAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5E,IAAA,mBAAS,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,yEAAyE;AACzE,SAAgB,aAAa,CAAC,OAAe;IAC3C,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AACnD,CAAC"}
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":";;AA0BA,0CAOC;AAED,0CASC;AAWD,gDAUC;AAYD,oCAMC;AAaD,sCAqBC;AAED,gCAcC;AAED,kCAiBC;AAGD,sCAEC;AA7JD,qCAAoF;AACpF,qCAAkC;AAClC,yCAA0C;AAwB1C,SAAgB,eAAe,CAAC,MAAyB,OAAO,CAAC,GAAG;IAClE,MAAM,IAAI,GACR,GAAG,CAAC,qBAAqB;QACzB,CAAC,GAAG,CAAC,eAAe;YAClB,CAAC,CAAC,IAAA,gBAAI,EAAC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC;YACzC,CAAC,CAAC,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;IAChD,OAAO,IAAA,gBAAI,EAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;AACxC,CAAC;AAED,SAAgB,eAAe,CAAC,MAAyB,OAAO,CAAC,GAAG;IAClE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,eAAe,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAyB,CAAC;QAC9F,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,6EAA6E;QAC7E,+BAA+B;QAC/B,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACxB,CAAC;AACH,CAAC;AAKD;;;;;GAKG;AACH,SAAgB,kBAAkB,CAChC,OAAe,EACf,MAAyB,OAAO,CAAC,GAAG,EACpC,SAAkB;IAElB,IAAI,SAAS,EAAE,IAAI,EAAE;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC1E,IAAI,GAAG,CAAC,gBAAgB;QAAE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,gBAAgB,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAChF,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IACnE,IAAI,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;IACxF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,YAAY,CAC1B,OAAe,EACf,MAAyB,OAAO,CAAC,GAAG,EACpC,SAAkB;IAElB,OAAO,kBAAkB,CAAC,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,aAAa,CAAC,IAAc;IAC1C,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,KAAyB,CAAC;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5B,MAAM;QACR,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;aAC5D,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACzB,oEAAoE;YACpE,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChD,KAAK,GAAG,IAAI,CAAC;gBACb,CAAC,IAAI,CAAC,CAAC;YACT,CAAC;;gBAAM,KAAK,GAAG,EAAE,CAAC;QACpB,CAAC;;YAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;AAC9D,CAAC;AAED,SAAgB,UAAU,CACxB,OAAe,EACf,KAAa,EACb,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACnC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC;IAC7C,IAAA,mBAAS,EAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,IAAA,uBAAa,EAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5E,8EAA8E;IAC9E,0EAA0E;IAC1E,IAAA,mBAAS,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,WAAW,CAAC,OAAe,EAAE,MAAyB,OAAO,CAAC,GAAG;IAC/E,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3C,IAAI,CAAC;YACH,IAAA,gBAAM,EAAC,IAAI,CAAC,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAA,uBAAa,EAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5E,IAAA,mBAAS,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,yEAAyE;AACzE,SAAgB,aAAa,CAAC,OAAe;IAC3C,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AACnD,CAAC"}

package/dist/doctor/address-checks.d.ts

@@ -0,0 +1,56 @@
+import type { Check } from '../conformance';
+import { type Get } from './probe';
+/**
+ * Checks about a page that lives at more than one address.
+ *
+ * A hosted docs platform serves every published page twice: on its own host
+ * (`platform.example/p/<org>/<space>/<page>`) and on the customer's domain.
+ * Search engines must be told, by BOTH copies, that the customer's address is
+ * the real one. The platform copy of a LEGAL page redirected to a third
+ * address that named itself canonical (FMU-B01), so the customer's legal pages
+ * competed with a copy on our host. Nothing on the customer's domain showed it.
+ */
+/** One page at its several addresses: the primary (canonical) one first when known. */
+export interface AddressSet {
+    /** What the canonical of every copy should be, when it is known. */
+    expected?: string;
+    urls: string[];
+}
+export declare function canonicalBothAddresses(get: Get, sets: AddressSet[]): Promise<Check>;
+/**
+ * Strip what a browser does not show and a reader cannot click: scripts,
+ * styles, and `<link>` tags (preloads, stylesheets). A white-label site may
+ * well load its JavaScript from the platform's CDN — that is infrastructure,
+ * not branding — so only the markup a person sees, and the links they follow,
+ * are judged.
+ */
+export declare function visibleMarkup(html: string): string;
+/** Platform URLs with a path: a bare-origin link is a "powered by" badge, which is a setting, not a leak. */
+export declare function platformMentions(text: string, platformHost: string): string[];
+/**
+ * `white-label-leaks`: a page on the customer's domain does not send its
+ * readers, or its agents, back to the platform's host.
+ *
+ * The Markdown twin of a reference page on a white-label domain ended with a
+ * "For AI agents" block pointing at the platform's API host for llms-full.txt
+ * and MCP, while the same files existed on the customer's domain (FMU-B15).
+ * The HTML looked clean; the agent-facing copy was the leak. Both are read.
+ */
+export declare function whiteLabelLeaks(get: Get, pageUrl: string, html: string, platformHost: string): Promise<Check>;
+export declare function findCmps(html: string): {
+    name: string;
+    at: number[];
+}[];
+export declare function languageHints(html: string, at: number[]): string[];
+/**
+ * `consent-tag`: the cookie banner speaks the page's language.
+ *
+ * The CMP tag carried no culture, so the banner followed the BROWSER's
+ * language rather than the page's (FMU-B17, S05): a German reader on the
+ * English page got a German banner over English text, and on a translated
+ * page the banner and the page disagree for everyone whose browser is set to
+ * anything else. Consent shown in a language the page is not in is a consent
+ * a regulator can question. No CMP on the page is a skip, not a pass.
+ */
+export declare function consentTag(html: string): Check;
+//# sourceMappingURL=address-checks.d.ts.map

package/dist/doctor/address-checks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"address-checks.d.ts","sourceRoot":"","sources":["../../src/doctor/address-checks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAQL,KAAK,GAAG,EACT,MAAM,SAAS,CAAC;AAEjB;;;;;;;;;GASG;AAEH,uFAAuF;AACvF,MAAM,WAAW,UAAU;IACzB,oEAAoE;IACpE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,wBAAsB,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CA4CzF;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMlD;AAED,6GAA6G;AAC7G,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE,CAQ7E;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,KAAK,CAAC,CA+BhB;AA4CD,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,EAAE,CAAA;CAAE,EAAE,CAWvE;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAQlE;AAID;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAuC9C"}

package/dist/doctor/address-checks.js

@@ -0,0 +1,183 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.canonicalBothAddresses = canonicalBothAddresses;
+exports.visibleMarkup = visibleMarkup;
+exports.platformMentions = platformMentions;
+exports.whiteLabelLeaks = whiteLabelLeaks;
+exports.findCmps = findCmps;
+exports.languageHints = languageHints;
+exports.consentTag = consentTag;
+const probe_1 = require("./probe");
+async function canonicalBothAddresses(get, sets) {
+    const title = 'Every address of a page names the same canonical';
+    const usable = sets.filter((s) => s.urls.length >= 2 || s.expected);
+    if (usable.length === 0)
+        return (0, probe_1.check)('canonical-both-addresses', title, 'skip', 'Only one address of this page is known. Pass --also <the other address>, or --site <slug> to have them looked up.', '');
+    const bad = [];
+    const good = [];
+    for (const set of usable) {
+        const before = bad.length;
+        const seen = [];
+        for (const url of [...new Set(set.urls)]) {
+            const { hops, final } = await (0, probe_1.follow)(get, url, { accept: 'text/html' });
+            const landed = hops.length > 1 && final.ok ? final.url : url;
+            if (!final.ok || final.status !== 200) {
+                bad.push(`${url} → ${(0, probe_1.describeProbe)(final)}`);
+                continue;
+            }
+            seen.push({ url, final: landed, canonical: (0, probe_1.canonicalOf)(final.text, landed) });
+        }
+        const expected = set.expected ?? seen.find((s) => s.canonical)?.canonical;
+        for (const s of seen) {
+            const via = s.final !== s.url ? ` (via ${s.final})` : '';
+            if (!s.canonical)
+                bad.push(`${s.url}${via} declares no canonical`);
+            else if (expected && !(0, probe_1.sameUrl)(s.canonical, expected))
+                bad.push(`${s.url}${via} names ${s.canonical}, expected ${expected}`);
+        }
+        if (seen.length && bad.length === before)
+            good.push(`${seen.map((s) => s.url).join(' and ')} → ${expected}`);
+    }
+    return (0, probe_1.check)('canonical-both-addresses', title, bad.length ? 'fail' : 'pass', bad.length ? (0, probe_1.some)(bad) : (0, probe_1.some)(good), bad.length
+        ? 'Two copies with different canonicals compete in search, and the platform copy can outrank the customer’s own domain.'
+        : '');
+}
+/**
+ * Strip what a browser does not show and a reader cannot click: scripts,
+ * styles, and `<link>` tags (preloads, stylesheets). A white-label site may
+ * well load its JavaScript from the platform's CDN — that is infrastructure,
+ * not branding — so only the markup a person sees, and the links they follow,
+ * are judged.
+ */
+function visibleMarkup(html) {
+    return html
+        .replace(/<script\b[\s\S]*?<\/script>/gi, '')
+        .replace(/<style\b[\s\S]*?<\/style>/gi, '')
+        .replace(/<link\b[^>]*>/gi, '')
+        .replace(/<meta\b[^>]*>/gi, '');
+}
+/** Platform URLs with a path: a bare-origin link is a "powered by" badge, which is a setting, not a leak. */
+function platformMentions(text, platformHost) {
+    const host = platformHost.replace(/[.]/g, '\\.');
+    const re = new RegExp(`https?://(?:www\\.)?${host}(/[^\\s"'<>)\\]\`]+)`, 'gi');
+    return [
+        ...new Set([...text.matchAll(re)].map((m) => m[0]).filter((u) => !/^https?:\/\/[^/]+\/?$/.test(u))),
+    ];
+}
+/**
+ * `white-label-leaks`: a page on the customer's domain does not send its
+ * readers, or its agents, back to the platform's host.
+ *
+ * The Markdown twin of a reference page on a white-label domain ended with a
+ * "For AI agents" block pointing at the platform's API host for llms-full.txt
+ * and MCP, while the same files existed on the customer's domain (FMU-B15).
+ * The HTML looked clean; the agent-facing copy was the leak. Both are read.
+ */
+async function whiteLabelLeaks(get, pageUrl, html, platformHost) {
+    const title = 'No platform URLs on a custom-domain page';
+    const host = (0, probe_1.hostOf)(pageUrl);
+    if (!host || host === platformHost.toLowerCase() || host === `www.${platformHost.toLowerCase()}`)
+        return (0, probe_1.check)('white-label-leaks', title, 'skip', `${pageUrl} is on the platform host itself.`, '');
+    const leaks = platformMentions(visibleMarkup(html), platformHost).map((u) => `HTML: ${u}`);
+    const u = new URL(pageUrl);
+    const mdUrl = `${u.origin}${u.pathname.replace(/\/+$/, '')}.md`;
+    const md = await get(mdUrl, { accept: 'text/markdown,text/plain' });
+    const isMd = md.ok && md.status === 200 && !/text\/html/i.test(md.headers.get('content-type') ?? '');
+    if (isMd)
+        for (const m of platformMentions(md.text, platformHost))
+            leaks.push(`${mdUrl}: ${m}`);
+    return (0, probe_1.check)('white-label-leaks', title, leaks.length ? 'fail' : 'pass', leaks.length
+        ? (0, probe_1.some)(leaks)
+        : `No ${platformHost} links in the page${isMd ? ' or its Markdown twin' : ''}.`, leaks.length
+        ? `A white-label site that links readers or agents to ${platformHost} exposes the platform behind it and splits its traffic; serve the same resources under the customer's domain.`
+        : '');
+}
+/**
+ * Consent managers, and where each one is told which language to speak.
+ *
+ * Matched on the vendor's loader host or global, so a CMP is recognised
+ * whether it is a `<script>` in the HTML, a preload of a script a framework
+ * injects later, or a config object in a serialized payload. The language
+ * hints are each vendor's documented attribute or query parameter; a vendor
+ * not listed here is still found by the generic hints below.
+ */
+const CMPS = [
+    { name: 'Cookie Munch', match: /cookiemunch\.(?:net|com)/i },
+    { name: 'Cookiebot', match: /consent\.cookiebot\.(?:com|eu)|uc\.js/i },
+    { name: 'OneTrust', match: /otSDKStub|cdn\.cookielaw\.org|onetrust\.com/i },
+    { name: 'Osano', match: /cmp\.osano\.com/i },
+    { name: 'Termly', match: /app\.termly\.io/i },
+    { name: 'Usercentrics', match: /usercentrics\.eu/i },
+    { name: 'Didomi', match: /sdk\.privacy-center\.org|didomi/i },
+    { name: 'iubenda', match: /cdn\.iubenda\.com/i },
+    { name: 'Complianz', match: /complianz/i },
+    { name: 'TCF CMP', match: /__tcfapi/ },
+];
+/**
+ * Where a CMP's language is stated, across vendors: `data-culture` (Cookie
+ * Munch, Cookiebot), `data-language` (OneTrust's `data-document-language`,
+ * Usercentrics), `data-lang`, a `culture`/`language` key in a serialized
+ * config, or a `?culture=`/`?language=`/`?lang=`/`?hl=` loader parameter.
+ */
+const LANGUAGE_HINTS = [
+    /data-(?:document-)?(?:culture|language|lang)\s*=\s*\\?["']([A-Za-z]{2,3}(?:[-_][A-Za-z0-9]{2,8})?)/g,
+    /\\?["'](?:culture|language|lang|uiLanguage)\\?["']\s*:\s*\\?["']([A-Za-z]{2,3}(?:[-_][A-Za-z0-9]{2,8})?)/g,
+    /[?&](?:culture|language|lang|hl)=([A-Za-z]{2,3}(?:[-_][A-Za-z0-9]{2,8})?)/g,
+];
+/**
+ * How far around a vendor mention a language hint still belongs to it. Small
+ * on purpose: a framework's serialized payload also carries the PAGE's
+ * language a few kilobytes away, and reading that as the banner's would pass
+ * exactly the page this check exists to fail.
+ */
+const HINT_WINDOW = 600;
+function findCmps(html) {
+    const out = [];
+    for (const cmp of CMPS) {
+        const re = new RegExp(cmp.match.source, cmp.match.flags.includes('g') ? cmp.match.flags : `${cmp.match.flags}g`);
+        const at = [...html.matchAll(re)].map((m) => m.index ?? 0);
+        if (at.length)
+            out.push({ name: cmp.name, at });
+    }
+    return out;
+}
+function languageHints(html, at) {
+    const found = new Set();
+    for (const i of at) {
+        const win = html.slice(Math.max(0, i - HINT_WINDOW), i + HINT_WINDOW);
+        for (const re of LANGUAGE_HINTS)
+            for (const m of win.matchAll(new RegExp(re.source, re.flags)))
+                found.add(m[1].toLowerCase());
+    }
+    return [...found];
+}
+const primary = (tag) => tag.toLowerCase().split(/[-_]/)[0];
+/**
+ * `consent-tag`: the cookie banner speaks the page's language.
+ *
+ * The CMP tag carried no culture, so the banner followed the BROWSER's
+ * language rather than the page's (FMU-B17, S05): a German reader on the
+ * English page got a German banner over English text, and on a translated
+ * page the banner and the page disagree for everyone whose browser is set to
+ * anything else. Consent shown in a language the page is not in is a consent
+ * a regulator can question. No CMP on the page is a skip, not a pass.
+ */
+function consentTag(html) {
+    const title = 'The consent banner is told the page language';
+    const cmps = findCmps(html);
+    if (cmps.length === 0)
+        return (0, probe_1.check)('consent-tag', title, 'skip', 'No consent manager found on this page.', '');
+    const lang = /<html\b[^>]*\blang\s*=\s*["']?([A-Za-z-]+)/i.exec(html)?.[1]?.toLowerCase();
+    const names = cmps.map((c) => c.name).join(', ');
+    const matters = 'A banner that follows the browser rather than the page asks for consent in a language the page is not written in.';
+    if (!lang)
+        return (0, probe_1.check)('consent-tag', title, 'fail', `${names} found, but the page declares no <html lang>.`, matters);
+    const hints = languageHints(html, cmps.flatMap((c) => c.at));
+    if (hints.length === 0)
+        return (0, probe_1.check)('consent-tag', title, 'fail', `${names} is given no language (no data-culture / data-language / language parameter); the banner will follow the browser, while the page is "${lang}".`, matters);
+    const wrong = hints.filter((h) => primary(h) !== primary(lang));
+    return (0, probe_1.check)('consent-tag', title, wrong.length ? 'fail' : 'pass', wrong.length
+        ? `${names} is told "${wrong.join(', ')}" on a "${lang}" page.`
+        : `${names} is told "${hints.join(', ')}", matching the page ("${lang}").`, wrong.length ? matters : '');
+}
+//# sourceMappingURL=address-checks.js.map

package/dist/doctor/address-checks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"address-checks.js","sourceRoot":"","sources":["../../src/doctor/address-checks.ts"],"names":[],"mappings":";;AA8BA,wDA4CC;AASD,sCAMC;AAGD,4CAQC;AAWD,0CAoCC;AA4CD,4BAWC;AAED,sCAQC;AAcD,gCAuCC;AAxQD,mCASiB;AAoBV,KAAK,UAAU,sBAAsB,CAAC,GAAQ,EAAE,IAAkB;IACvE,MAAM,KAAK,GAAG,kDAAkD,CAAC;IACjE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC;IACpE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QACrB,OAAO,IAAA,aAAK,EACV,0BAA0B,EAC1B,KAAK,EACL,MAAM,EACN,mHAAmH,EACnH,EAAE,CACH,CAAC;IACJ,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QAC1B,MAAM,IAAI,GAAyD,EAAE,CAAC;QACtE,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACzC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAA,cAAM,EAAC,GAAG,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;YACxE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YAC7D,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACtC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,MAAM,IAAA,qBAAa,EAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAC7C,SAAS;YACX,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,IAAA,mBAAW,EAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;QAC1E,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,IAAI,CAAC,CAAC,CAAC,SAAS;gBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,GAAG,wBAAwB,CAAC,CAAC;iBAC9D,IAAI,QAAQ,IAAI,CAAC,IAAA,eAAO,EAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC;gBAClD,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,GAAG,UAAU,CAAC,CAAC,SAAS,cAAc,QAAQ,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;YACtC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,QAAQ,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,IAAA,aAAK,EACV,0BAA0B,EAC1B,KAAK,EACL,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAC5B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAA,YAAI,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAA,YAAI,EAAC,IAAI,CAAC,EACnC,GAAG,CAAC,MAAM;QACR,CAAC,CAAC,sHAAsH;QACxH,CAAC,CAAC,EAAE,CACP,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,aAAa,CAAC,IAAY;IACxC,OAAO,IAAI;SACR,OAAO,CAAC,+BAA+B,EAAE,EAAE,CAAC;SAC5C,OAAO,CAAC,6BAA6B,EAAE,EAAE,CAAC;SAC1C,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC;SAC9B,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,6GAA6G;AAC7G,SAAgB,gBAAgB,CAAC,IAAY,EAAE,YAAoB;IACjE,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACjD,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,uBAAuB,IAAI,sBAAsB,EAAE,IAAI,CAAC,CAAC;IAC/E,OAAO;QACL,GAAG,IAAI,GAAG,CACR,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CACxF;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACI,KAAK,UAAU,eAAe,CACnC,GAAQ,EACR,OAAe,EACf,IAAY,EACZ,YAAoB;IAEpB,MAAM,KAAK,GAAG,0CAA0C,CAAC;IACzD,MAAM,IAAI,GAAG,IAAA,cAAM,EAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,YAAY,CAAC,WAAW,EAAE,IAAI,IAAI,KAAK,OAAO,YAAY,CAAC,WAAW,EAAE,EAAE;QAC9F,OAAO,IAAA,aAAK,EACV,mBAAmB,EACnB,KAAK,EACL,MAAM,EACN,GAAG,OAAO,kCAAkC,EAC5C,EAAE,CACH,CAAC;IACJ,MAAM,KAAK,GAAa,gBAAgB,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC,GAAG,CAC7E,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,CACpB,CAAC;IACF,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC;IAChE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC,CAAC;IACpE,MAAM,IAAI,GACR,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1F,IAAI,IAAI;QAAE,KAAK,MAAM,CAAC,IAAI,gBAAgB,CAAC,EAAE,CAAC,IAAI,EAAE,YAAY,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC;IAChG,OAAO,IAAA,aAAK,EACV,mBAAmB,EACnB,KAAK,EACL,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAC9B,KAAK,CAAC,MAAM;QACV,CAAC,CAAC,IAAA,YAAI,EAAC,KAAK,CAAC;QACb,CAAC,CAAC,MAAM,YAAY,qBAAqB,IAAI,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,GAAG,EACjF,KAAK,CAAC,MAAM;QACV,CAAC,CAAC,sDAAsD,YAAY,+GAA+G;QACnL,CAAC,CAAC,EAAE,CACP,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,IAAI,GAAsC;IAC9C,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,2BAA2B,EAAE;IAC5D,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,wCAAwC,EAAE;IACtE,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,8CAA8C,EAAE;IAC3E,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE;IAC5C,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,kBAAkB,EAAE;IAC7C,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,mBAAmB,EAAE;IACpD,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,kCAAkC,EAAE;IAC7D,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,oBAAoB,EAAE;IAChD,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE;IAC1C,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE;CACvC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,cAAc,GAAG;IACrB,qGAAqG;IACrG,2GAA2G;IAC3G,4EAA4E;CAC7E,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,GAAG,GAAG,CAAC;AAExB,SAAgB,QAAQ,CAAC,IAAY;IACnC,MAAM,GAAG,GAAqC,EAAE,CAAC;IACjD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,IAAI,MAAM,CACnB,GAAG,CAAC,KAAK,CAAC,MAAM,EAChB,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CACxE,CAAC;QACF,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;QAC3D,IAAI,EAAE,CAAC,MAAM;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAgB,aAAa,CAAC,IAAY,EAAE,EAAY;IACtD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC;QACtE,KAAK,MAAM,EAAE,IAAI,cAAc;YAC7B,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,CAAC;AAErE;;;;;;;;;GASG;AACH,SAAgB,UAAU,CAAC,IAAY;IACrC,MAAM,KAAK,GAAG,8CAA8C,CAAC;IAC7D,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QACnB,OAAO,IAAA,aAAK,EAAC,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,EAAE,EAAE,CAAC,CAAC;IAC3F,MAAM,IAAI,GAAG,6CAA6C,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IAC1F,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,OAAO,GACX,mHAAmH,CAAC;IACtH,IAAI,CAAC,IAAI;QACP,OAAO,IAAA,aAAK,EACV,aAAa,EACb,KAAK,EACL,MAAM,EACN,GAAG,KAAK,+CAA+C,EACvD,OAAO,CACR,CAAC;IACJ,MAAM,KAAK,GAAG,aAAa,CACzB,IAAI,EACJ,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAC1B,CAAC;IACF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QACpB,OAAO,IAAA,aAAK,EACV,aAAa,EACb,KAAK,EACL,MAAM,EACN,GAAG,KAAK,wIAAwI,IAAI,IAAI,EACxJ,OAAO,CACR,CAAC;IACJ,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,OAAO,IAAA,aAAK,EACV,aAAa,EACb,KAAK,EACL,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAC9B,KAAK,CAAC,MAAM;QACV,CAAC,CAAC,GAAG,KAAK,aAAa,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,SAAS;QAC/D,CAAC,CAAC,GAAG,KAAK,aAAa,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,0BAA0B,IAAI,KAAK,EAC5E,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAC5B,CAAC;AACJ,CAAC"}

package/dist/doctor/boilerplate.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Descriptions that were written by a template, not by the site's owner.
+ *
+ * A space with no description of its own fell back to the preset's blurb —
+ * "Guides and reference, in a nested tree.", "Community discussions in
+ * Community." — and that sentence became the meta description, the og:description
+ * a link preview shows, and the summary line of llms.txt (FMU-B08). Nothing was
+ * broken in the HTTP sense, so no check noticed; a reader sharing a link noticed.
+ *
+ * One list, in one place, so `meta-description` and `llms-txt` judge the same
+ * strings. Patterns rather than exact strings: the template interpolates the
+ * space or site name, and the point is to recognise the template whatever was
+ * poured into it. They are generic generator phrasings — any docs platform
+ * that fills an empty description from a type preset produces sentences of this
+ * shape — not a list of one vendor's copy.
+ */
+export declare const PRESET_DESCRIPTION_PATTERNS: readonly RegExp[];
+export declare function isPresetDescription(text: string): boolean;
+/**
+ * True when a description is headings run together rather than prose.
+ *
+ * A generated reference landing described itself as its tag names joined with
+ * spaces — "Referalli API Analytics and operations Billing Authentication
+ * Programs and partners Partner portal Payouts…" (FMU-B09). It has words, so
+ * "missing" never fires; it has no sentence in it, which is what this tests:
+ * eight words or more, no sentence punctuation at all, and most of the
+ * non-trivial words capitalised. A run of CamelCase joins (`PayoutsPartners`)
+ * counts too — that is the same list with the spaces lost.
+ */
+export declare function isHeadingSoup(text: string): boolean;
+/** Why a description is not one, or undefined when it reads like one somebody wrote. */
+export declare function descriptionProblem(text: string | undefined): string | undefined;
+//# sourceMappingURL=boilerplate.d.ts.map

package/dist/doctor/boilerplate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"boilerplate.d.ts","sourceRoot":"","sources":["../../src/doctor/boilerplate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,2BAA2B,EAAE,SAAS,MAAM,EAUxD,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGzD;AAKD;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAUnD;AAED,wFAAwF;AACxF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAM/E"}

package/dist/doctor/boilerplate.js

@@ -0,0 +1,78 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PRESET_DESCRIPTION_PATTERNS = void 0;
+exports.isPresetDescription = isPresetDescription;
+exports.isHeadingSoup = isHeadingSoup;
+exports.descriptionProblem = descriptionProblem;
+/**
+ * Descriptions that were written by a template, not by the site's owner.
+ *
+ * A space with no description of its own fell back to the preset's blurb —
+ * "Guides and reference, in a nested tree.", "Community discussions in
+ * Community." — and that sentence became the meta description, the og:description
+ * a link preview shows, and the summary line of llms.txt (FMU-B08). Nothing was
+ * broken in the HTTP sense, so no check noticed; a reader sharing a link noticed.
+ *
+ * One list, in one place, so `meta-description` and `llms-txt` judge the same
+ * strings. Patterns rather than exact strings: the template interpolates the
+ * space or site name, and the point is to recognise the template whatever was
+ * poured into it. They are generic generator phrasings — any docs platform
+ * that fills an empty description from a type preset produces sentences of this
+ * shape — not a list of one vendor's copy.
+ */
+exports.PRESET_DESCRIPTION_PATTERNS = [
+    /^guides and reference, in a nested tree\.?$/i,
+    /^community discussions in .+\.?$/i,
+    /^the latest posts from .+\.?$/i,
+    /^published documentation for .+\.?$/i,
+    /^documentation for .+\.?$/i,
+    /^welcome to .+ (?:docs|documentation)\.?$/i,
+    // A not-found page's title used as a description: the address in the
+    // sitemap or llms.txt is dead, and the preview says so to everybody.
+    /this page isn[’']t here/i,
+];
+function isPresetDescription(text) {
+    const t = text.trim();
+    return exports.PRESET_DESCRIPTION_PATTERNS.some((re) => re.test(t));
+}
+/** Small words a real sentence has and a list of headings also has. */
+const STOP = new Set(['and', 'or', 'the', 'of', 'a', 'an', 'to', 'in', 'for', 'with', 'on', '&']);
+/**
+ * True when a description is headings run together rather than prose.
+ *
+ * A generated reference landing described itself as its tag names joined with
+ * spaces — "Referalli API Analytics and operations Billing Authentication
+ * Programs and partners Partner portal Payouts…" (FMU-B09). It has words, so
+ * "missing" never fires; it has no sentence in it, which is what this tests:
+ * eight words or more, no sentence punctuation at all, and most of the
+ * non-trivial words capitalised. A run of CamelCase joins (`PayoutsPartners`)
+ * counts too — that is the same list with the spaces lost.
+ */
+function isHeadingSoup(text) {
+    const t = text.replace(/(?:…|\.\.\.)\s*$/, '').trim();
+    if ((t.match(/[a-z][A-Z][a-z]/g) ?? []).length >= 2 && !/[.,;:!?]/.test(t))
+        return true;
+    if (/[.,;:!?—–()]/.test(t))
+        return false;
+    const words = t.split(/\s+/).filter(Boolean);
+    if (words.length < 8)
+        return false;
+    const content = words.filter((w) => !STOP.has(w.toLowerCase()));
+    if (content.length === 0)
+        return false;
+    const capped = content.filter((w) => /^[A-Z0-9]/.test(w)).length;
+    return capped / content.length >= 0.5;
+}
+/** Why a description is not one, or undefined when it reads like one somebody wrote. */
+function descriptionProblem(text) {
+    if (text === undefined)
+        return 'missing';
+    if (!text.trim())
+        return 'empty';
+    if (isPresetDescription(text))
+        return `preset text "${text.trim()}"`;
+    if (isHeadingSoup(text))
+        return `headings run together "${text.trim().slice(0, 80)}…"`;
+    return undefined;
+}
+//# sourceMappingURL=boilerplate.js.map

package/dist/doctor/boilerplate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"boilerplate.js","sourceRoot":"","sources":["../../src/doctor/boilerplate.ts"],"names":[],"mappings":";;;AA4BA,kDAGC;AAgBD,sCAUC;AAGD,gDAMC;AAlED;;;;;;;;;;;;;;;GAeG;AACU,QAAA,2BAA2B,GAAsB;IAC5D,8CAA8C;IAC9C,mCAAmC;IACnC,gCAAgC;IAChC,sCAAsC;IACtC,4BAA4B;IAC5B,4CAA4C;IAC5C,qEAAqE;IACrE,qEAAqE;IACrE,0BAA0B;CAC3B,CAAC;AAEF,SAAgB,mBAAmB,CAAC,IAAY;IAC9C,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACtB,OAAO,mCAA2B,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,uEAAuE;AACvE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;AAElG;;;;;;;;;;GAUG;AACH,SAAgB,aAAa,CAAC,IAAY;IACxC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtD,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACxF,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAChE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACjE,OAAO,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC;AACxC,CAAC;AAED,wFAAwF;AACxF,SAAgB,kBAAkB,CAAC,IAAwB;IACzD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,OAAO,CAAC;IACjC,IAAI,mBAAmB,CAAC,IAAI,CAAC;QAAE,OAAO,gBAAgB,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC;IACrE,IAAI,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,0BAA0B,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC;IACvF,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/doctor/command.d.ts

@@ -0,0 +1,18 @@
+import { Http } from '../api/http';
+import { type DoctorReport } from '../doctor';
+export declare const DOCTOR_CHECK_IDS: readonly string[];
+export declare const DOCTOR_HELP = "forumulate doctor \u2014 check a live site from the outside\n\nUsage:\n  forumulate doctor <readerUrl> [flags]\n  forumulate doctor --site <slug|id> [--org <slug|id>] [flags]\n\nPlain HTTP, no token needed for a URL: the same report against our platform, a\nstaging mount or any other docs host. --site asks the API for every address of\nevery space on a site (needs a token), and checks each copy.\n\nFlags:\n  --site <slug|id>     every member space, at its custom domain AND its\n                       platform copy (token: FORUMULATE_TOKEN or `login`)\n  --org <slug|id>      the org --site is in (default: FORUMULATE_ORG / config)\n  --also <url>         another address of the same page, e.g. the platform copy\n                       of a custom-domain page (repeatable)\n  --only a,b           run just these checks (ids below)\n  --json               the full report as JSON on stdout (nothing else there)\n  --api-base <origin>  where /api/health lives, when not on the page's host\n  --platform-host <h>  the hosting platform's hostname, for white-label and\n                       canonical checks (default: FORUMULATE_URL's host, else\n                       forumulate.com)\n  --limit <n>          sitemap URLs to sample (default 60)\n  --timeout <ms>       per-request timeout (default 15000)\n\nChecks (id \u2014 what fails it):\n  health                    /api/health not 2xx JSON (also tried under the mount)\n  public-read               a logged-out reader is sent to sign-in\n  canonical                 the page's canonical names another host\n  html-untouched            a proxy rewrites the markup (email obfuscation)\n  cache-headers             no Cache-Control, or no-store, on the page\n  robots / sitemap          robots.txt missing, disallows the path, no Sitemap:\n  crawler-access            a crawler gets a different status than a reader\n  feeds                     an advertised feed does not answer 200\n  images                    a picture on the page does not load\n  canonical-both-addresses  a page's copies (custom domain, platform) name\n                            different canonicals, or not the primary address\n  sitemap-crawl             a sitemap URL redirects, 404s, is on another host or\n                            names another canonical\n  cache-consistency         pages of one space cached differently (public vs\n                            private/no-store) with no x-forumulate-cache-reason\n  root-redirect             a space root answers 302/307, or a redirect with a\n                            body over 1 KB, or lands on a page canonical elsewhere\n  meta-description          missing description/og:description, template text\n                            (\"Guides and reference, in a nested tree.\"), or\n                            headings run together\n  llms-txt                  /llms.txt missing, no H1, preset summary, links on\n                            another host, slugs in titles, no sections/descriptions\n  favicon                   /favicon.ico or <link rel=icon> not an image; an\n                            asset path answering a large HTML page\n  consent-tag               a consent manager (any CMP: Cookie Munch, Cookiebot,\n                            OneTrust, Osano, Termly, Usercentrics, Didomi,\n                            iubenda, Complianz, TCF) not told the page language\n  white-label-leaks         a custom-domain page or its .md twin links to the\n                            platform host\n  robots-params             (advice) prints the Disallow lines that keep crawlers\n                            off each mount's ?sort= / ?period= / ?range= copies\n  reader-auth-atlas         (advice, needs --org and a token) the organization\n                            uses Atlas but signs readers in another way (an\n                            external_jwt route): prints the relink and the switch\n                            to the Atlas reader provider (readerAuth: atlas)\n\nExamples:\n  forumulate doctor https://docs.acme.com/docs\n  forumulate doctor https://acme.com/legal/privacy --also https://forumulate.com/p/acme/legal/privacy\n  forumulate doctor --site main --org acme --json > doctor.json\n  forumulate doctor https://acme.com/docs --only sitemap-crawl,root-redirect\n\nIn CI: packages/cli/examples/github-action-doctor.yml runs this on a schedule and\non every push, uploads the JSON report and fails the job on any FAIL.\n\nExit status:\n  0  ok          1  failed (verification mismatch, doctor FAIL)\n  2  usage       3  auth (no token, 401, token not allowed)\n  4  not found   5  conflict (409/412, edited in the studio since your last publish)\n  124 --wait timed out (the job keeps running; with --wait, a failed job is 1)\n  doctor: 1 when any check FAILs; a SKIP is not a failure.";
+export interface DoctorCommandDeps {
+    out: (line: string) => void;
+    err: (line: string) => void;
+    env?: NodeJS.ProcessEnv;
+    fetchImpl?: typeof fetch;
+    http?: Http;
+    userAgent?: string;
+    /** The global `--token` (FMU-DOC01); beats FORUMULATE_TOKEN and the stored token. */
+    flagToken?: string;
+}
+/** `forumulate doctor …` → an exit code. */
+export declare function runDoctorCommand(argv: string[], deps: DoctorCommandDeps): Promise<number>;
+export declare function printReport(report: DoctorReport, out: (l: string) => void): void;
+//# sourceMappingURL=command.d.ts.map

package/dist/doctor/command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command.d.ts","sourceRoot":"","sources":["../../src/doctor/command.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAKnC,OAAO,EAA6B,KAAK,YAAY,EAAE,MAAM,WAAW,CAAC;AAOzE,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAI7C,CAAC;AAEF,eAAO,MAAM,WAAW,gtJAwEmC,CAAC;AAE5D,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAID,4CAA4C;AAC5C,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CA4H/F;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAUhF"}