@goflag/cli 0.2.8 → 0.2.10

package/dist/{chunk-SKX7UCGC.js → chunk-DKGBLJ4H.js}

@@ -816,53 +816,111 @@ async function probeManifest(href, options = {}) {
   }
 }
 
+// src/lib/core/robots/parse.ts
+var RULE_DIRECTIVES = /* @__PURE__ */ new Set(["allow", "disallow"]);
+var KNOWN_EXTENSIONS = /* @__PURE__ */ new Set(["crawl-delay", "host", "clean-param", "request-rate", "noindex"]);
+function parseRobots(body) {
+  const groups = [];
+  const sitemaps = [];
+  const invalidLines = [];
+  const unknownDirectives = [];
+  let current;
+  let currentTookRule = false;
+  const lines = body.split(/\r\n|\r|\n/);
+  for (const [index, rawLine] of lines.entries()) {
+    const line = index + 1;
+    const withoutComment = rawLine.replace(/#.*$/, "");
+    const trimmed = withoutComment.trim();
+    if (trimmed.length === 0) continue;
+    const separator = trimmed.indexOf(":");
+    if (separator === -1) {
+      invalidLines.push({ line, raw: rawLine, reason: "no `:` separator" });
+      continue;
+    }
+    const name = trimmed.slice(0, separator).trim().toLowerCase();
+    const value = trimmed.slice(separator + 1).trim();
+    if (name === "user-agent") {
+      if (value.length === 0) {
+        invalidLines.push({ line, raw: rawLine, reason: "empty `User-agent`" });
+        continue;
+      }
+      if (!current || currentTookRule) {
+        current = { userAgents: [], rules: [] };
+        groups.push(current);
+        currentTookRule = false;
+      }
+      current.userAgents.push({ value: value.toLowerCase(), line });
+      continue;
+    }
+    if (name === "sitemap") {
+      if (value.length === 0) {
+        invalidLines.push({ line, raw: rawLine, reason: "empty `Sitemap`" });
+        continue;
+      }
+      sitemaps.push({ value, line });
+      continue;
+    }
+    if (RULE_DIRECTIVES.has(name)) {
+      if (!current) {
+        invalidLines.push({
+          line,
+          raw: rawLine,
+          reason: `\`${name}\` before any \`User-agent\` group`
+        });
+        continue;
+      }
+      current.rules.push({ kind: name, pattern: value, line });
+      currentTookRule = true;
+      continue;
+    }
+    if (KNOWN_EXTENSIONS.has(name)) {
+      unknownDirectives.push({ name, line });
+      continue;
+    }
+    invalidLines.push({ line, raw: rawLine, reason: `unknown directive \`${name}\`` });
+  }
+  return { groups, sitemaps, invalidLines, unknownDirectives };
+}
+
 // src/lib/core/probes/robots.ts
 async function probeRobots(origin, options = {}) {
   const url = new URL("/robots.txt", origin).toString();
   const { signal, cleanup } = combineSignals(options.signal, options.timeoutMs ?? 5e3);
+  const empty = { groups: [], sitemaps: [], invalidLines: [], unknownDirectives: [] };
+  const noRedirect = { count: 0, finalUrl: url, crossOrigin: false };
   try {
     const res = await fetch(url, { signal, redirect: "follow" });
+    const redirected = res.url !== url;
+    const redirects = {
+      count: redirected ? 1 : 0,
+      finalUrl: res.url || url,
+      crossOrigin: redirected && !sameOrigin(res.url, url)
+    };
     if (!res.ok) {
-      return { url, status: res.status, found: false, sitemaps: [], blocksAll: false };
+      return { url, status: res.status, found: false, byteLength: 0, redirects, ...empty };
     }
-    const body = await res.text();
+    const raw = await res.text();
     return {
       url,
       status: res.status,
       found: true,
-      raw: body,
-      sitemaps: extractSitemaps(body),
-      blocksAll: blocksAllUserAgents(body)
+      raw,
+      byteLength: Buffer.byteLength(raw, "utf8"),
+      redirects,
+      ...parseRobots(raw)
     };
   } catch {
-    return { url, status: 0, found: false, sitemaps: [], blocksAll: false };
+    return { url, status: 0, found: false, byteLength: 0, redirects: noRedirect, ...empty };
   } finally {
     cleanup();
   }
 }
-function extractSitemaps(body) {
-  const out = [];
-  for (const line of body.split(/\r?\n/)) {
-    const m = /^\s*Sitemap:\s*(\S+)\s*$/i.exec(line);
-    if (m?.[1]) out.push(m[1]);
-  }
-  return out;
-}
-function blocksAllUserAgents(body) {
-  let inWildcard = false;
-  for (const rawLine of body.split(/\r?\n/)) {
-    const line = rawLine.replace(/#.*$/, "").trim();
-    if (line.length === 0) continue;
-    const ua = /^User-agent:\s*(.+)$/i.exec(line);
-    if (ua) {
-      inWildcard = ua[1].trim() === "*";
-      continue;
-    }
-    if (!inWildcard) continue;
-    const dis = /^Disallow:\s*(.*)$/i.exec(line);
-    if (dis && dis[1].trim() === "/") return true;
+function sameOrigin(a, b) {
+  try {
+    return new URL(a).origin === new URL(b).origin;
+  } catch {
+    return true;
   }
-  return false;
 }
 
 // src/lib/core/probes/sitemap.ts
@@ -1293,7 +1351,14 @@ function findingsToIssues(result, rules) {
       severity: finding.severity ?? "info",
       message: finding.message ?? `Expected ${finding.expected}.`,
       origin: finding.origin,
-      fix: byId.get(finding.ruleId)?.fix
+      fix: byId.get(finding.ruleId)?.fix,
+      // The finding has known all four since it was evaluated; this is where
+      // they used to stop. A report that drops the rigor asks every consumer
+      // to re-derive it from a registry it does not have.
+      rigor: finding.rigor,
+      sources: finding.sources,
+      observed: finding.observed,
+      expected: finding.expected
     });
   }
   for (const crash of result.crashes) {
@@ -1311,10 +1376,77 @@ var TITLE_IDEAL = [10, 60];
 var TITLE_ACCEPTABLE = [5, 70];
 var DESC_IDEAL = [50, 160];
 var DESC_ACCEPTABLE = [25, 200];
+var RATIO_IDEAL = [1.7, 2.1];
+var RATIO_ACCEPTABLE = [1, 3];
 function tokens(value) {
   if (!value) return [];
   return value.split(",").map((t) => t.trim().toLowerCase()).filter(Boolean);
 }
+function isAbsoluteHttpUrl(value) {
+  try {
+    const url = new URL(value);
+    return url.protocol === "http:" || url.protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+function localeParts(tag) {
+  const subtags = tag.trim().toLowerCase().split(/[-_]/).filter(Boolean);
+  const language = subtags[0];
+  if (!language || !/^[a-z]{2,3}$/.test(language)) return void 0;
+  const region = subtags.slice(1).find((s) => /^([a-z]{2}|\d{3})$/.test(s));
+  return region ? { language, region } : { language };
+}
+function sameLocale(a, b) {
+  const left = localeParts(a);
+  const right = localeParts(b);
+  if (!left || !right || left.language !== right.language) return false;
+  return !left.region || !right.region || left.region === right.region;
+}
+function hreflangCluster(ex) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const annotation of ex.links.hreflang) {
+    if (annotation.isXDefault) continue;
+    const parts = localeParts(annotation.hreflang);
+    if (!parts) continue;
+    seen.add(parts.region ? `${parts.language}-${parts.region}` : parts.language);
+  }
+  return [...seen];
+}
+function describeAsset(status, contentType) {
+  if (status === 0) return "the request failed";
+  if (status >= 400 || status < 200) return `HTTP ${status}`;
+  return `HTTP ${status} with \`${contentType ?? "no content type"}\`, which is not an image`;
+}
+var ICON_RELS = /* @__PURE__ */ new Set([
+  "icon",
+  "shortcut icon",
+  "apple-touch-icon",
+  "apple-touch-icon-precomposed",
+  "mask-icon"
+]);
+var APPLE_ICON_RELS = /* @__PURE__ */ new Set(["apple-touch-icon", "apple-touch-icon-precomposed"]);
+function declaredIcons(ex) {
+  return ex.links.icons.filter((icon) => ICON_RELS.has(icon.rel.trim().toLowerCase()));
+}
+function normalise(value) {
+  return value.trim().toLowerCase().split(/\s+/).sort().join(" ");
+}
+function sameAsset(href, src) {
+  const pathOf = (value) => {
+    try {
+      return new URL(value, "https://goflag.invalid").pathname;
+    } catch {
+      return value.split("?")[0] ?? value;
+    }
+  };
+  return pathOf(href) === pathOf(src);
+}
+function hasOpenGraph(ex) {
+  return Boolean(
+    ex.openGraph.title?.value || ex.openGraph.images.length > 0 || ex.openGraph.url?.value
+  );
+}
 var titleMissing = {
   id: "title.missing",
   kind: "boolean",
@@ -1569,10 +1701,7 @@ var ogDescriptionMissing = {
   evaluate: (ex) => {
     const observed = ex.openGraph.description?.value?.trim();
     if (observed) return { status: "pass", observed };
-    const hasOtherOg = Boolean(
-      ex.openGraph.title?.value || ex.openGraph.images.length > 0 || ex.openGraph.url?.value
-    );
-    if (!hasOtherOg) return { status: "na", observed: null };
+    if (!hasOpenGraph(ex)) return { status: "na", observed: null };
     return {
       status: "fail",
       observed: null,
@@ -1616,6 +1745,476 @@ var ogImageMissing = {
     };
   }
 };
+var ogImageAbsolute = {
+  id: "og.image.absolute",
+  kind: "boolean",
+  category: "opengraph",
+  // The same severity as `og.image.missing`, deliberately: the unfurl is
+  // identical either way, and the registry should not rank the broken
+  // declaration above the absent one when their effect is the same.
+  severity: "warning",
+  title: "`og:image` must be an absolute URL",
+  why: "Unlike a browser, the crawler that builds the preview has no document to resolve a relative path against \u2014 it reads the tag, not the page. A relative `og:image` is therefore not a smaller mistake than a missing one: the unfurl is identical, and the tag makes it look handled.",
+  rigor: "vendor-spec",
+  sources: ["ogp", "meta-og-sharing"],
+  reads: ["openGraph.images"],
+  expected: "every `og:image` URL absolute, scheme included",
+  relates: ["og.image.missing", "canonical.absolute"],
+  fix: {
+    title: "Give Next a metadataBase, or write the origin in",
+    snippet: [
+      "// app/layout.tsx \u2014 every relative metadata URL resolves against this.",
+      "export const metadata = {",
+      "  metadataBase: new URL(process.env.SITE_ORIGIN!),",
+      '  openGraph: { images: ["/og.png"] }, // emitted absolute',
+      "};"
+    ].join("\n"),
+    language: "tsx"
+  },
+  evaluate: (ex) => {
+    if (ex.openGraph.images.length === 0) return { status: "na", observed: null };
+    const declarations = [];
+    for (const image of ex.openGraph.images) {
+      declarations.push({ property: "og:image", value: image.url.value.trim() });
+      if (image.secureUrl) {
+        declarations.push({
+          property: "og:image:secure_url",
+          value: image.secureUrl.value.trim()
+        });
+      }
+    }
+    const observed = declarations.map((d) => d.value);
+    const relative = declarations.filter((d) => !isAbsoluteHttpUrl(d.value));
+    if (relative.length === 0) return { status: "pass", observed };
+    return {
+      status: "fail",
+      observed,
+      message: `Open Graph image URL is not absolute: ${relative.map((d) => `\`${d.property}\` = \`${d.value}\``).join(", ")}. Crawlers cannot resolve it.`,
+      origin: { kind: "meta", property: relative[0].property }
+    };
+  }
+};
+var ogImageAlt = {
+  id: "og.image.alt",
+  kind: "boolean",
+  category: "opengraph",
+  severity: "warning",
+  title: "Describe the shared image with `og:image:alt`",
+  why: "The protocol defines `og:image:alt` as a description of what is in the image, and a generated card usually carries the page's title as pixels. Omitting it leaves that text sighted-only, in the one place a link is seen before anybody has opened the page. Optional in the vocabulary, which is why this is a guideline and not a spec violation.",
+  rigor: "guideline",
+  sources: ["ogp"],
+  reads: ["openGraph.images"],
+  expected: "an `og:image:alt` beside every `og:image`",
+  relates: ["og.image.missing"],
+  fix: {
+    title: "Carry the alt per image, not as a constant",
+    snippet: [
+      "// app/\u2026/opengraph-image.tsx \u2014 `export const alt` is one fixed string, so a",
+      "// translated or data-derived description has to go through the metadata fn.",
+      "export async function generateImageMetadata({ params }) {",
+      "  const t = await getTranslations({ locale: params.locale });",
+      '  return [{ id: "og", size, contentType, alt: t("og.alt") }];',
+      "}"
+    ].join("\n"),
+    language: "tsx"
+  },
+  evaluate: (ex) => {
+    if (ex.openGraph.images.length === 0) return { status: "na", observed: null };
+    const observed = ex.openGraph.images.map((image) => ({
+      url: image.url.value,
+      alt: image.alt?.value ?? null
+    }));
+    const undescribed = observed.filter((image) => !image.alt?.trim());
+    if (undescribed.length === 0) return { status: "pass", observed };
+    return {
+      status: "fail",
+      observed,
+      message: undescribed.length === observed.length ? "Page declares an `og:image` with no `og:image:alt`." : `${undescribed.length} of ${observed.length} \`og:image\` declarations have no \`og:image:alt\`.`,
+      origin: { kind: "meta", property: "og:image:alt" }
+    };
+  }
+};
+var ogImageDimensions = {
+  id: "og.image.dimensions",
+  kind: "boolean",
+  category: "opengraph",
+  severity: "warning",
+  title: "Declare `og:image:width` and `og:image:height`",
+  why: "A crawler that does not know the size cannot lay the card out until it has fetched the image, so the first share of a URL renders without it \u2014 the one share that matters most. The dimensions are the fix, and they cost two tags.",
+  rigor: "vendor-spec",
+  sources: ["ogp", "meta-og-sharing"],
+  reads: ["openGraph.images"],
+  expected: "both `og:image:width` and `og:image:height` on every image",
+  relates: ["og.image.missing", "og.image.ratio"],
+  fix: {
+    title: "Declare the size alongside the URL",
+    snippet: [
+      "// app/\u2026/page.tsx",
+      "export const metadata = {",
+      '  openGraph: { images: [{ url: "/og.png", width: 1200, height: 630 }] },',
+      "};",
+      "// The file convention emits both from `export const size` for free."
+    ].join("\n"),
+    language: "tsx"
+  },
+  evaluate: (ex) => {
+    if (ex.openGraph.images.length === 0) return { status: "na", observed: null };
+    const observed = ex.openGraph.images.map((image) => ({
+      url: image.url.value,
+      width: image.width?.value ?? null,
+      height: image.height?.value ?? null
+    }));
+    const incomplete = observed.filter((image) => image.width === null || image.height === null);
+    if (incomplete.length === 0) return { status: "pass", observed };
+    return {
+      status: "fail",
+      observed,
+      message: `${incomplete.length === observed.length ? "The" : `${incomplete.length} of ${observed.length}`} \`og:image\` declaration${incomplete.length === 1 ? "" : "s"} omit${incomplete.length === 1 ? "s" : ""} \`og:image:width\` or \`og:image:height\`.`,
+      origin: { kind: "meta", property: "og:image:width" }
+    };
+  }
+};
+var ogImageRatio = {
+  id: "og.image.ratio",
+  kind: "scored",
+  category: "opengraph",
+  title: "Keep the shared image near the 1.91:1 the card is laid out for",
+  why: "Meta's recommended 1200\xD7630 is a shape before it is a size. An image far from it is not rejected \u2014 it is cropped to fit, and the crop is chosen by the consumer rather than by you.",
+  rigor: "vendor-spec",
+  sources: ["meta-og-sharing", "x-cards"],
+  reads: ["openGraph.images"],
+  bands: { ideal: RATIO_IDEAL, acceptable: RATIO_ACCEPTABLE },
+  severityByBand: { acceptable: "info", poor: "warning" },
+  expected: `a width \xF7 height between ${RATIO_IDEAL[0]} and ${RATIO_IDEAL[1]} (1.91:1 is 1.9)`,
+  relates: ["og.image.dimensions"],
+  evaluate: (ex) => {
+    const measured = ex.openGraph.images.find((image) => image.width?.value && image.height?.value);
+    if (!measured) return { status: "na", observed: 0 };
+    const ratio = Math.round(measured.width.value / measured.height.value * 100) / 100;
+    const { status, band } = bandFor(ratio, { ideal: RATIO_IDEAL, acceptable: RATIO_ACCEPTABLE });
+    if (status === "pass") return { status, band, observed: ratio };
+    return {
+      status,
+      band,
+      observed: ratio,
+      message: `\`og:image\` is ${measured.width.value}\xD7${measured.height.value} \u2014 a ratio of ${ratio}:1, against the 1.91:1 the preview card is laid out for. Consumers will crop it.`,
+      origin: { kind: "meta", property: "og:image:width" }
+    };
+  }
+};
+var ogLocaleMissing = {
+  id: "og.locale.missing",
+  kind: "boolean",
+  category: "opengraph",
+  severity: "warning",
+  title: "A translated page has to say which locale it is in",
+  why: "`og:locale` defaults to `en_US` in the protocol itself \u2014 so a page that omits it does not decline to answer, it answers wrongly. On a site whose whole point is that the same page exists in several languages, every translation claims to be American English.",
+  rigor: "vendor-spec",
+  sources: ["ogp"],
+  reads: ["openGraph.locale", "links.hreflang"],
+  expected: "an `og:locale` on any page that declares hreflang alternates",
+  relates: ["og.locale.alternates", "hreflang.missing"],
+  fix: {
+    title: "Emit the locale in the page's own metadata",
+    snippet: [
+      "// app/[locale]/\u2026/page.tsx",
+      "export const metadata = {",
+      '  openGraph: { locale: "fr_FR", alternateLocale: ["en_US", "es_ES"] },',
+      "};"
+    ].join("\n"),
+    language: "tsx"
+  },
+  evaluate: (ex) => {
+    const cluster = hreflangCluster(ex);
+    const observed = ex.openGraph.locale?.value?.trim() ?? null;
+    if (cluster.length < 2 || !hasOpenGraph(ex)) return { status: "na", observed };
+    if (observed) return { status: "pass", observed };
+    return {
+      status: "fail",
+      observed: null,
+      message: `Page declares hreflang alternates (${cluster.join(", ")}) but no \`og:locale\`; the protocol default \`en_US\` applies instead.`,
+      origin: { kind: "meta", property: "og:locale" }
+    };
+  }
+};
+var ogLocaleAlternates = {
+  id: "og.locale.alternates",
+  kind: "boolean",
+  category: "opengraph",
+  severity: "warning",
+  title: "`og:locale:alternate` and the hreflang cluster must name the same locales",
+  why: "Two vocabularies describe the same fact \u2014 this page exists in these languages \u2014 and nothing in a build keeps them in step, so they drift silently. Whichever one is short is the one telling a consumer that a translation it could have linked to does not exist.",
+  rigor: "vendor-spec",
+  sources: ["ogp", "google-hreflang"],
+  reads: ["openGraph.locale", "openGraph.localeAlternates", "links.hreflang"],
+  expected: "one `og:locale:alternate` per hreflang locale other than this page's own",
+  relates: ["og.locale.missing", "hreflang.missing"],
+  fix: {
+    title: "Derive both lists from the same cluster",
+    snippet: [
+      "// The hreflang map and the OG locales are one fact stated twice.",
+      "openGraph: {",
+      "  locale: ogLocale(locale),",
+      "  alternateLocale: cluster.filter((l) => l !== locale).map(ogLocale),",
+      "},",
+      "alternates: { languages: cluster },"
+    ].join("\n"),
+    language: "ts"
+  },
+  evaluate: (ex) => {
+    const cluster = hreflangCluster(ex);
+    const own = ex.openGraph.locale?.value?.trim();
+    const declared = ex.openGraph.localeAlternates.map((a) => a.value.trim()).filter(Boolean);
+    const observed = { locale: own ?? null, alternates: declared, hreflang: cluster };
+    if (cluster.length < 2 || !own) return { status: "na", observed };
+    const missing = cluster.filter(
+      (tag) => !sameLocale(tag, own) && !declared.some((d) => sameLocale(d, tag))
+    );
+    const unbacked = declared.filter((d) => !cluster.some((tag) => sameLocale(tag, d)));
+    if (missing.length === 0 && unbacked.length === 0) return { status: "pass", observed };
+    const disagreements = [];
+    if (missing.length > 0) {
+      disagreements.push(`no \`og:locale:alternate\` for ${missing.join(", ")}`);
+    }
+    if (unbacked.length > 0) {
+      disagreements.push(`\`og:locale:alternate\` ${unbacked.join(", ")} has no hreflang`);
+    }
+    return {
+      status: "fail",
+      observed,
+      message: `Open Graph and hreflang disagree about this page's translations: ${disagreements.join("; ")}.`,
+      origin: { kind: "meta", property: "og:locale:alternate" }
+    };
+  }
+};
+var iconsMissing = {
+  id: "icons.missing",
+  kind: "boolean",
+  category: "icons",
+  severity: "warning",
+  title: "Declare an icon \u2014 the tab, the bookmark and the share sheet all read one",
+  why: "No specification requires an icon, which is exactly why nothing complains and every consumer improvises. A browser falls back to `/favicon.ico` at the root, a feed reader or a link unfurler often falls back to nothing, and a bookmark to a site with no icon is a grey square among fifty.",
+  rigor: "guideline",
+  sources: ["whatwg-html-link-types", "mdn-link-rel"],
+  reads: ["links.icons", "links.manifest"],
+  expected: 'at least one `<link rel="icon">`, or icons declared by a manifest',
+  relates: ["icons.apple-touch.missing", "icons.manifest-mismatch"],
+  fix: {
+    title: "Let the file convention declare it",
+    snippet: [
+      '// app/icon.svg (or icon.png) \u2014 Next emits the <link rel="icon"> itself.',
+      '// app/apple-icon.png likewise emits rel="apple-touch-icon".',
+      "// A /favicon.ico at the root is a separate matter: see icons.ico.missing."
+    ].join("\n"),
+    language: "tsx"
+  },
+  evaluate: (ex) => {
+    const head = declaredIcons(ex);
+    const fromManifest = ex.links.manifest?.icons ?? [];
+    const observed = {
+      head: head.map((icon) => ({ rel: icon.rel, href: icon.href })),
+      manifest: fromManifest.map((icon) => icon.src)
+    };
+    if (head.length > 0 || fromManifest.length > 0) return { status: "pass", observed };
+    return {
+      status: "fail",
+      observed,
+      message: 'Page declares no icon: no `<link rel="icon">`, and no icons from a manifest. Consumers fall back to `/favicon.ico` if the site happens to serve one.',
+      origin: { kind: "link", rel: "icon" }
+    };
+  }
+};
+var iconsAppleTouchMissing = {
+  id: "icons.apple-touch.missing",
+  kind: "boolean",
+  category: "icons",
+  severity: "info",
+  title: "Declare an `apple-touch-icon` for the iOS home screen",
+  why: 'iOS does not read `rel="icon"` for a home-screen shortcut. With no `apple-touch-icon` it screenshots the page instead, so what someone saved is a thumbnail of whatever was on screen when they saved it.',
+  rigor: "vendor-spec",
+  sources: ["apple-web-apps", "whatwg-html-link-types"],
+  reads: ["links.icons", "links.manifest"],
+  expected: 'a `<link rel="apple-touch-icon">`',
+  relates: ["icons.missing"],
+  evaluate: (ex) => {
+    const head = declaredIcons(ex);
+    if (head.length === 0) return { status: "na", observed: null };
+    const apple = head.filter((icon) => APPLE_ICON_RELS.has(icon.rel.trim().toLowerCase()));
+    const observed = head.map((icon) => icon.rel);
+    if (apple.length > 0) return { status: "pass", observed };
+    return {
+      status: "fail",
+      observed,
+      message: `Page declares icons (${observed.join(", ")}) but no \`apple-touch-icon\`; iOS will screenshot the page instead.`,
+      origin: { kind: "link", rel: "apple-touch-icon" }
+    };
+  }
+};
+var iconsManifestMismatch = {
+  id: "icons.manifest-mismatch",
+  kind: "boolean",
+  category: "icons",
+  severity: "info",
+  title: "The manifest and the `<head>` must not disagree about the same icon",
+  why: "Two files declare the icons, maintained by different hands, and nothing compares them. The failure worth naming is not that the two lists differ \u2014 they legitimately do, since an apple-touch-icon is not a manifest icon \u2014 but that they describe the *same file* differently, or that the icons exist only in the manifest, where a browser tab never looks.",
+  rigor: "guideline",
+  sources: ["w3c-appmanifest", "whatwg-html-link-types"],
+  reads: ["links.icons", "links.manifest"],
+  expected: "the same size and type wherever an icon is declared twice",
+  relates: ["icons.missing"],
+  evaluate: (ex) => {
+    const manifest = ex.links.manifest;
+    if (!manifest?.parsed || !manifest.icons || manifest.icons.length === 0) {
+      return { status: "na", observed: null };
+    }
+    const head = declaredIcons(ex);
+    const observed = {
+      head: head.map((icon) => ({ href: icon.href, sizes: icon.sizes ?? null })),
+      manifest: manifest.icons.map((icon) => ({ src: icon.src, sizes: icon.sizes ?? null }))
+    };
+    if (head.length === 0) {
+      return {
+        status: "fail",
+        observed,
+        message: `Manifest declares ${manifest.icons.length} icon(s) but the \`<head>\` declares none; a browser tab reads the \`<head>\`, not the manifest.`,
+        origin: { kind: "link", rel: "manifest" }
+      };
+    }
+    const disagreements = [];
+    for (const icon of manifest.icons) {
+      const twin = head.find((candidate) => sameAsset(candidate.href, icon.src));
+      if (!twin) continue;
+      if (icon.sizes && twin.sizes && normalise(icon.sizes) !== normalise(twin.sizes)) {
+        disagreements.push(
+          `\`${icon.src}\` is \`${twin.sizes}\` in the \`<head>\` and \`${icon.sizes}\` in the manifest`
+        );
+      }
+      if (icon.type && twin.type && icon.type.toLowerCase() !== twin.type.toLowerCase()) {
+        disagreements.push(
+          `\`${icon.src}\` is \`${twin.type}\` in the \`<head>\` and \`${icon.type}\` in the manifest`
+        );
+      }
+    }
+    if (disagreements.length === 0) return { status: "pass", observed };
+    return {
+      status: "fail",
+      observed,
+      message: `The manifest and the \`<head>\` describe the same icon differently: ${disagreements.join("; ")}.`,
+      origin: { kind: "link", rel: "manifest" }
+    };
+  }
+};
+var ogImageReachable = {
+  id: "og.image.reachable",
+  kind: "boolean",
+  category: "opengraph",
+  severity: "error",
+  title: "The URL in `og:image` has to answer with an image",
+  why: "Every other check on a preview image judges the tag. This one judges the file, and it is the only one that can catch the failure with no symptom: a URL that is present, well-formed, absolute \u2014 and dead. The card renders empty and nothing in the page says why. Found on this project's own documentation, where eleven pages pointed at a route a redirect had been swallowing since the day it was written.",
+  rigor: "vendor-spec",
+  sources: ["ogp", "meta-og-sharing"],
+  reads: ["openGraph.images", "assets"],
+  expected: "a 2xx image at every `og:image` URL",
+  relates: ["og.image.missing", "og.image.absolute"],
+  evaluate: (ex) => {
+    if (!ex.assets) return { status: "na", observed: null };
+    const probed = ex.openGraph.images.map((image) => ex.assets?.[image.url.value.trim()]).filter((probe) => probe !== void 0);
+    if (probed.length === 0) return { status: "na", observed: null };
+    const observed = probed.map((probe) => ({
+      status: probe.status,
+      contentType: probe.contentType ?? null
+    }));
+    const dead = probed.filter((probe) => !probe.ok);
+    if (dead.length === 0) return { status: "pass", observed };
+    return {
+      status: "fail",
+      observed,
+      message: `\`og:image\` does not serve an image: ${dead.map((probe) => describeAsset(probe.status, probe.contentType)).join("; ")}. The preview card will render without it.`,
+      origin: { kind: "meta", property: "og:image" }
+    };
+  }
+};
+var iconsUnreachable = {
+  id: "icons.unreachable",
+  kind: "boolean",
+  category: "icons",
+  severity: "warning",
+  title: "A declared icon has to answer with an image",
+  why: "An icon that 404s is worse than one never declared: the client asks, gets nothing, and has already skipped the `/favicon.ico` it would have fallen back to. The declaration is what took the fallback away.",
+  rigor: "vendor-spec",
+  sources: ["whatwg-html-link-types", "mdn-link-rel"],
+  reads: ["links.icons", "assets"],
+  expected: "a 2xx image at every declared icon URL",
+  relates: ["icons.missing", "icons.ico.missing"],
+  evaluate: (ex) => {
+    if (!ex.assets) return { status: "na", observed: null };
+    const probed = declaredIcons(ex).map((icon) => ({ icon, probe: ex.assets?.[icon.href] })).filter(
+      (pair) => Boolean(pair.probe)
+    );
+    if (probed.length === 0) return { status: "na", observed: null };
+    const observed = probed.map(({ icon, probe }) => ({
+      rel: icon.rel,
+      href: icon.href,
+      status: probe.status
+    }));
+    const dead = probed.filter(({ probe }) => !probe.ok);
+    if (dead.length === 0) return { status: "pass", observed };
+    return {
+      status: "fail",
+      observed,
+      message: `Declared icon does not serve an image: ${dead.map(
+        ({ icon, probe }) => `\`${icon.rel}\` \u2192 \`${icon.href}\` (${describeAsset(probe.status, probe.contentType)})`
+      ).join("; ")}.`,
+      origin: { kind: "link", rel: "icon" }
+    };
+  }
+};
+var iconsSizesMismatch = {
+  id: "icons.sizes-mismatch",
+  kind: "boolean",
+  category: "icons",
+  severity: "info",
+  title: "A `sizes` attribute must describe the file it points at",
+  why: "`sizes` is how a client picks one icon out of several without fetching them all, so a wrong value costs exactly what the attribute was there to save: the client downloads the file it was told to prefer and gets the wrong resolution. A half-true declaration is the common shape \u2014 a `.ico` carrying 16, 32 and 48 declared as `48x48` advertises one third of itself.",
+  rigor: "guideline",
+  sources: ["whatwg-html-link-types", "mdn-link-rel"],
+  reads: ["links.icons", "assets"],
+  expected: "`sizes` listing what the file actually contains",
+  relates: ["icons.unreachable"],
+  evaluate: (ex) => {
+    if (!ex.assets) return { status: "na", observed: null };
+    const comparable = declaredIcons(ex).map((icon) => ({ icon, probe: ex.assets?.[icon.href] })).filter(
+      (pair) => (
+        // Only where both sides said something. `any` declares no dimension
+        // to check, and a format goflag does not decode leaves `sizes`
+        // absent — which means unknown, and unknown is not a mismatch.
+        Boolean(pair.probe?.ok && pair.probe.sizes?.length) && pair.icon.parsedSizes.some((size) => size !== "any")
+      )
+    );
+    if (comparable.length === 0) return { status: "na", observed: null };
+    const observed = comparable.map(({ icon, probe }) => ({
+      href: icon.href,
+      declared: icon.sizes ?? null,
+      actual: (probe.sizes ?? []).map((size) => `${size.width}x${size.height}`)
+    }));
+    const wrong = observed.filter((entry) => {
+      const declared = new Set(
+        comparable.find((pair) => pair.icon.href === entry.href).icon.parsedSizes.filter((size) => size !== "any").map((size) => `${size.width}x${size.height}`)
+      );
+      const actual = new Set(entry.actual);
+      return declared.size !== actual.size || [...declared].some((size) => !actual.has(size));
+    });
+    if (wrong.length === 0) return { status: "pass", observed };
+    return {
+      status: "fail",
+      observed,
+      message: `\`sizes\` does not describe the file: ${wrong.map(
+        (entry) => `\`${entry.href}\` declares \`${entry.declared}\` and contains ${entry.actual.join(", ")}`
+      ).join("; ")}.`,
+      origin: { kind: "link", rel: "icon" }
+    };
+  }
+};
 var robotsConflict = {
   id: "robots.conflict",
   kind: "boolean",
@@ -1677,8 +2276,20 @@ var RULES = [
   canonicalMissing,
   descriptionLength,
   descriptionMissing,
+  iconsAppleTouchMissing,
+  iconsManifestMismatch,
+  iconsMissing,
+  iconsSizesMismatch,
+  iconsUnreachable,
   ogDescriptionMissing,
+  ogImageAbsolute,
+  ogImageAlt,
+  ogImageDimensions,
   ogImageMissing,
+  ogImageRatio,
+  ogImageReachable,
+  ogLocaleAlternates,
+  ogLocaleMissing,
   ogTitleMissing,
   robotsConflict,
   titleLength,
@@ -1720,11 +2331,44 @@ function openGraphFromPage(page) {
     other: og.unknown
   };
 }
-function linksFromPage(page) {
-  return {
-    hreflang: page.links.alternates,
-    icons: page.links.icons,
-    manifest: page.links.manifest ? { href: page.links.manifest.href } : void 0,
+function optionalString(value) {
+  return typeof value === "string" && value.trim() ? value : void 0;
+}
+function manifestIcons(data) {
+  if (typeof data !== "object" || data === null) return [];
+  const raw = data.icons;
+  if (!Array.isArray(raw)) return [];
+  const icons = [];
+  for (const entry of raw) {
+    if (typeof entry !== "object" || entry === null) continue;
+    const { src, sizes, type, purpose } = entry;
+    const source = optionalString(src);
+    if (!source) continue;
+    icons.push({
+      src: source,
+      sizes: optionalString(sizes),
+      type: optionalString(type),
+      purpose: optionalString(purpose),
+      parsedSizes: parseSizes(optionalString(sizes))
+    });
+  }
+  return icons;
+}
+function manifestFromPage(page) {
+  const link = page.links.manifest;
+  if (!link) return void 0;
+  const probe = page.probes.manifest;
+  if (!probe) return { href: link.href };
+  if (!probe.found || probe.parseError !== void 0) {
+    return { href: link.href, parsed: false };
+  }
+  return { href: link.href, parsed: true, icons: manifestIcons(probe.data) };
+}
+function linksFromPage(page) {
+  return {
+    hreflang: page.links.alternates,
+    icons: page.links.icons,
+    manifest: manifestFromPage(page),
     feeds: page.links.feeds.map(({ type, href, title }) => ({ type, href, title }))
   };
 }
@@ -1761,6 +2405,7 @@ function extractionFromPage(page) {
       keywords: page.meta.keywords
     },
     openGraph: openGraphFromPage(page),
+    ...page.assets ? { assets: page.assets } : {},
     twitter: {
       card: page.twitter.card,
       site: page.twitter.site,
@@ -2014,6 +2659,70 @@ function sortLocales(locales) {
   return [...xDefault, ...rest];
 }
 
+// src/lib/core/robots/match.ts
+function robotsAllows(groups, path, userAgent = "*") {
+  const group = selectGroup(groups, userAgent);
+  if (!group) return { allowed: true };
+  const token = group.userAgents[0]?.value ?? "*";
+  let best;
+  let bestLength = -1;
+  for (const rule of group.rules) {
+    if (rule.pattern.length === 0) continue;
+    if (!patternMatches(rule.pattern, path)) continue;
+    const length = octetLength(rule.pattern);
+    if (length > bestLength) {
+      best = rule;
+      bestLength = length;
+      continue;
+    }
+    if (length === bestLength && rule.kind === "allow") best = rule;
+  }
+  if (!best) return { allowed: true, group: token };
+  return { allowed: best.kind === "allow", rule: best, group: token };
+}
+function selectGroup(groups, userAgent) {
+  const wanted = userAgent.trim().toLowerCase();
+  let bestToken;
+  for (const group of groups) {
+    for (const agent of group.userAgents) {
+      if (agent.value === "*") continue;
+      if (!wanted.startsWith(agent.value)) continue;
+      if (bestToken === void 0 || agent.value.length > bestToken.length) {
+        bestToken = agent.value;
+      }
+    }
+  }
+  const token = bestToken ?? "*";
+  const matching = groups.filter(
+    (group) => group.userAgents.some((agent) => agent.value === token)
+  );
+  if (matching.length === 0) return void 0;
+  if (matching.length === 1) return matching[0];
+  return {
+    userAgents: matching.flatMap((group) => group.userAgents),
+    rules: matching.flatMap((group) => group.rules)
+  };
+}
+function patternMatches(pattern, path) {
+  const anchored = pattern.endsWith("$");
+  const body = anchored ? pattern.slice(0, -1) : pattern;
+  const source = body.split("*").map((literal) => escapeRegExp(normalizeOctets(literal))).join(".*");
+  return new RegExp(`^${source}${anchored ? "$" : ""}`).test(normalizeOctets(path));
+}
+function normalizeOctets(value) {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return value;
+  }
+}
+function octetLength(pattern) {
+  return Buffer.byteLength(normalizeOctets(pattern), "utf8");
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
 // src/lib/rules/site-rules.ts
 function isMultilingual(site) {
   return site.localeAxis.multilingual;
@@ -2155,7 +2864,9 @@ var robotsBlocksSite = {
   id: "robots.blocks-site",
   severity: "error",
   summary: "`robots.txt` must not forbid crawling a site that asks to be indexed",
-  appliesTo: (site) => site.robots?.found === true && site.robots.blocksAll,
+  rigor: "vendor-spec",
+  sources: ["ietf-rfc9309", "google-robots-intro"],
+  appliesTo: (site) => site.robots?.found === true && !robotsAllows(site.robots.groups, "/").allowed,
   check: ({ site, issue }) => {
     const robotsUrl = site.robots?.url ?? `${site.origin}/robots.txt`;
     const asking = site.pages.filter((page) => metaRobotsTokens(page).has("index"));
@@ -2185,10 +2896,620 @@ var robotsBlocksSite = {
     });
   }
 };
+var iconsIcoMissing = {
+  id: "icons.ico.missing",
+  severity: "info",
+  summary: "Serve a `/favicon.ico` at the root for the clients that ask blind",
+  rigor: "guideline",
+  sources: ["whatwg-html-link-types", "mdn-link-rel"],
+  // Only judged when the probe actually ran. No probe means goflag did not
+  // look, and a rule that reported an absence it never checked for would be
+  // inventing a finding.
+  appliesTo: (site) => site.favicon !== void 0,
+  check: ({ site, issue }) => {
+    const probe = site.favicon;
+    if (!probe || probe.found) return [];
+    const detail = probe.status === 0 ? "the request failed outright" : probe.status >= 400 ? `the origin answered ${probe.status}` : `the origin answered ${probe.status} with \`${probe.contentType ?? "no content type"}\`, which is not an image \u2014 a catch-all route serving the app shell looks exactly like this`;
+    return issue({
+      pageUrl: probe.url,
+      message: `No \`/favicon.ico\` at the root: ${detail}. Clients that ask for it blind \u2014 feed readers, link unfurlers, older crawlers \u2014 get nothing.`,
+      origin: { kind: "computed" },
+      fix: {
+        title: "Generate it from the icon you already have",
+        snippet: [
+          "// No framework convention emits an .ico: Next's icon.tsx goes through",
+          "// ImageResponse, which is PNG. The container is a header plus one",
+          "// entry per size plus the PNGs concatenated \u2014 thirty lines and no",
+          "// dependency, over an image library you almost certainly already have.",
+          "//",
+          "// Fingerprint the *inputs* (the source image, the sizes), not the",
+          "// bytes you produce: encoders are not stable across versions, so a",
+          "// script keyed on its own output dirties the file on every commit.",
+          "// Then a --check mode can verify it in CI without writing anything."
+        ].join("\n"),
+        language: "ts"
+      }
+    });
+  }
+};
+var ROBOTS_BYTE_LIMIT = 500 * 1024;
+var robotstxtUnreachable = {
+  id: "robotstxt.unreachable",
+  severity: "error",
+  summary: "A robots.txt that errors is read as forbidding the whole site",
+  rigor: "spec-required",
+  sources: ["ietf-rfc9309"],
+  // A 404 is not a failure: §2.3.1.3 says an absent file allows everything,
+  // and most sites that have none mean exactly that. Only a server that
+  // answered badly, or did not answer, triggers the disallow-everything rule.
+  appliesTo: (site) => site.robots !== void 0 && isRobotsFailure(site.robots.status),
+  check: ({ site, issue }) => {
+    const probe = site.robots;
+    const detail = probe.status === 0 ? "the request failed" : `the origin answered ${probe.status}`;
+    return issue({
+      pageUrl: probe.url,
+      message: `\`robots.txt\` could not be read: ${detail}. RFC 9309 \xA72.3.1.4 tells a crawler to assume a complete disallow for as long as this lasts \u2014 an outage on this one file takes the whole site out of the index.`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+var robotstxtOversized = {
+  id: "robotstxt.oversized",
+  severity: "error",
+  summary: "Rules past 500 KiB of robots.txt are not guaranteed to be read",
+  rigor: "spec-required",
+  sources: ["ietf-rfc9309"],
+  appliesTo: (site) => (site.robots?.byteLength ?? 0) > ROBOTS_BYTE_LIMIT,
+  check: ({ site, issue }) => {
+    const probe = site.robots;
+    const kib = Math.round(probe.byteLength / 1024);
+    return issue({
+      pageUrl: probe.url,
+      message: `\`robots.txt\` is ${kib} KiB. A parser is only required to honour the first 500 KiB (RFC 9309 \xA72.4), so every rule past that point silently does not exist.`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+var robotstxtInvalidLine = {
+  id: "robotstxt.invalid-line",
+  severity: "warning",
+  summary: "Every line of robots.txt should parse as something",
+  rigor: "spec-required",
+  sources: ["ietf-rfc9309"],
+  appliesTo: (site) => (site.robots?.invalidLines.length ?? 0) > 0,
+  check: ({ site, issue }) => {
+    const probe = site.robots;
+    const shown = probe.invalidLines.slice(0, 5);
+    const rest = probe.invalidLines.length - shown.length;
+    return issue({
+      pageUrl: probe.url,
+      message: `\`robots.txt\` has ${probe.invalidLines.length} line${probe.invalidLines.length === 1 ? "" : "s"} that parse as nothing: ` + shown.map((l) => `line ${l.line} (${l.reason})`).join(", ") + `${rest > 0 ? `, and ${rest} more` : ""}. A crawler drops them silently, so the rule you meant to write is simply absent.`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+var robotstxtUnknownDirective = {
+  id: "robotstxt.unknown-directive",
+  severity: "info",
+  summary: "Non-standard robots.txt directives are read by some crawlers and ignored by others",
+  rigor: "guideline",
+  sources: ["ietf-rfc9309", "google-robots-intro"],
+  appliesTo: (site) => (site.robots?.unknownDirectives.length ?? 0) > 0,
+  check: ({ site, issue }) => {
+    const probe = site.robots;
+    const names = [...new Set(probe.unknownDirectives.map((d) => d.name))];
+    return issue({
+      pageUrl: probe.url,
+      message: `\`robots.txt\` uses ${names.map((n) => `\`${n}\``).join(", ")}, which RFC 9309 does not define. Some crawlers honour ${names.length === 1 ? "it" : "them"} and Google ignores ${names.length === 1 ? "it" : "them"} \u2014 so this is worth knowing, not necessarily worth changing.`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+var robotstxtCrossOrigin = {
+  id: "robotstxt.cross-origin",
+  severity: "warning",
+  summary: "`/robots.txt` should not redirect to another origin",
+  rigor: "vendor-spec",
+  sources: ["ietf-rfc9309"],
+  appliesTo: (site) => site.robots?.redirects.crossOrigin === true,
+  check: ({ site, issue }) => {
+    const probe = site.robots;
+    return issue({
+      pageUrl: probe.url,
+      message: `\`robots.txt\` redirects to \`${probe.redirects.finalUrl}\`, on another origin. RFC 9309 \xA72.3.1.2 permits following it, so this works \u2014 but the policy for this site now lives somewhere this site does not control, and it is usually a proxy accident rather than a decision.`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+var robotstxtSitemapRelative = {
+  id: "robotstxt.sitemap.relative",
+  severity: "error",
+  summary: "A `Sitemap:` declaration must be an absolute URL",
+  rigor: "spec-required",
+  sources: ["sitemaps-protocol", "ietf-rfc9309"],
+  appliesTo: (site) => (site.robots?.sitemaps ?? []).some((s) => !isAbsolute(s.value)),
+  check: ({ site, issue }) => {
+    const probe = site.robots;
+    const relative = probe.sitemaps.filter((s) => !isAbsolute(s.value));
+    return issue({
+      pageUrl: probe.url,
+      message: `\`Sitemap:\` must be a full URL: ${relative.map((s) => `line ${s.line} declares \`${s.value}\``).join(", ")}. robots.txt is fetched on its own, so there is no page for a consumer to resolve a relative path against.`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+var robotsBlocksPage = {
+  id: "robots.blocks-page",
+  severity: "error",
+  summary: "A page asking to be indexed must not be disallowed by robots.txt",
+  rigor: "vendor-spec",
+  sources: ["ietf-rfc9309", "google-robots-intro"],
+  appliesTo: (site) => site.robots?.found === true && robotsAllows(site.robots.groups, "/").allowed,
+  check: ({ site, issue }) => {
+    const probe = site.robots;
+    return site.pages.flatMap((page) => {
+      if (!metaRobotsTokens(page).has("index")) return [];
+      let path;
+      try {
+        const url = new URL(page.fetch.finalUrl);
+        path = `${url.pathname}${url.search}`;
+      } catch {
+        return [];
+      }
+      const decision = robotsAllows(probe.groups, path);
+      if (decision.allowed || !decision.rule) return [];
+      return issue({
+        pageUrl: page.fetch.finalUrl,
+        message: `Page declares \`<meta name="robots" content="index">\` but \`robots.txt\` line ${decision.rule.line} disallows \`${decision.rule.pattern}\` for \`${decision.group}\`. robots.txt wins: the page is never fetched, so the tag asking for it is never read.`,
+        origin: { kind: "computed" }
+      });
+    });
+  }
+};
+var CHANGEFREQ = /* @__PURE__ */ new Set(["always", "hourly", "daily", "weekly", "monthly", "yearly", "never"]);
+var SAMPLE = 5;
+function sample(locs) {
+  const shown = locs.slice(0, SAMPLE);
+  const rest = locs.length - shown.length;
+  return `${shown.map((l) => `\`${l}\``).join(", ")}${rest > 0 ? `, and ${rest} more` : ""}`;
+}
+var sitemapMissing = {
+  id: "sitemap.missing",
+  severity: "warning",
+  summary: "A site should publish a sitemap",
+  rigor: "guideline",
+  sources: ["sitemaps-protocol", "google-sitemaps"],
+  // A warning rather than an error, and the plan settles it: a small, fully
+  // linked site genuinely may not need one. Google's own guidance says
+  // "usually worth having", which is exactly a guideline.
+  appliesTo: (site) => site.discovery !== void 0 && !site.discovery.diagnostics.found,
+  check: ({ site, issue }) => issue({
+    pageUrl: `${site.origin}/sitemap.xml`,
+    message: "No sitemap was found \u2014 not declared in `robots.txt`, and not at a well-known path. Discovery then depends entirely on what links to what, which is the part of a site nobody audits.",
+    origin: { kind: "computed" }
+  })
+};
+var sitemapUnparsable = {
+  id: "sitemap.unparsable",
+  severity: "error",
+  summary: "A located sitemap must be a well-formed `<urlset>` or `<sitemapindex>`",
+  rigor: "spec-required",
+  sources: ["sitemaps-protocol"],
+  appliesTo: (site) => site.discovery?.diagnostics.found === true && !site.discovery.diagnostics.wellFormed,
+  check: ({ site, issue }) => {
+    const diagnostics = site.discovery.diagnostics;
+    return issue({
+      pageUrl: diagnostics.sitemapUrl ?? `${site.origin}/sitemap.xml`,
+      message: "A sitemap was served but does not parse as XML. The usual cause is an HTML error page answered with a 200 \u2014 which reads as a healthy sitemap to anything that only checks the status.",
+      origin: { kind: "computed" }
+    });
+  }
+};
+var sitemapEmpty = {
+  id: "sitemap.empty",
+  severity: "warning",
+  summary: "A sitemap that parses should list something",
+  rigor: "guideline",
+  sources: ["sitemaps-protocol"],
+  // Only when the crawl found pages: an empty sitemap on a site with no pages
+  // is consistent, and saying otherwise would be noise.
+  appliesTo: (site) => site.discovery?.diagnostics.wellFormed === true && site.discovery.urls.length === 0 && site.pages.length > 0,
+  check: ({ site, issue }) => {
+    const diagnostics = site.discovery.diagnostics;
+    return issue({
+      pageUrl: diagnostics.sitemapUrl ?? `${site.origin}/sitemap.xml`,
+      message: `The sitemap parses and lists no URLs, while the crawl found ${site.pages.length}. goflag falls back to crawling \u2014 a consumer that trusts the sitemap has nothing to read.`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+var sitemapIndexChildError = {
+  id: "sitemap.index.child-error",
+  severity: "error",
+  summary: "Every child of a sitemap index must be reachable and parseable",
+  rigor: "spec-required",
+  sources: ["sitemaps-protocol"],
+  appliesTo: (site) => (site.discovery?.diagnostics.childSitemapErrors ?? 0) > 0,
+  check: ({ site, issue }) => {
+    const diagnostics = site.discovery.diagnostics;
+    const total = diagnostics.childSitemapCount;
+    return issue({
+      pageUrl: diagnostics.sitemapUrl ?? `${site.origin}/sitemap.xml`,
+      message: `${diagnostics.childSitemapErrors} of ${total} child sitemaps could not be read. The index declares an inventory and part of it is missing, so whatever those documents listed is invisible \u2014 and nothing says how much that is.`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+var sitemapEntryInvalidUrl = {
+  id: "sitemap.entry.invalid-url",
+  severity: "error",
+  summary: "Every `<loc>` must be an absolute, parseable URL",
+  rigor: "spec-required",
+  sources: ["sitemaps-protocol"],
+  appliesTo: (site) => (site.discovery?.urls ?? []).some((entry) => !isAbsolute(entry.loc)),
+  check: ({ site, issue }) => {
+    const bad = site.discovery.urls.filter((entry) => !isAbsolute(entry.loc));
+    return issue({
+      pageUrl: site.discovery.diagnostics.sitemapUrl ?? `${site.origin}/sitemap.xml`,
+      message: `${bad.length} \`<loc>\` value${bad.length === 1 ? " is" : "s are"} not an absolute URL: ${sample(bad.map((e) => e.loc))}. A sitemap is fetched on its own, so a consumer has nothing to resolve them against.`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+var sitemapEntryCrossHost = {
+  id: "sitemap.entry.cross-host",
+  severity: "error",
+  summary: "A sitemap should only list URLs on its own host",
+  rigor: "spec-required",
+  sources: ["sitemaps-protocol"],
+  // `www` and the apex are different hosts to a consumer, which is the case
+  // this actually catches: a sitemap generated against one and served on the
+  // other. The cross-submission escape hatch needs the other host's robots.txt
+  // and arrives with the cross-artefact rules.
+  appliesTo: (site) => crossHostEntries(site).length > 0,
+  check: ({ site, issue }) => {
+    const bad = crossHostEntries(site);
+    return issue({
+      pageUrl: site.discovery.diagnostics.sitemapUrl ?? `${site.origin}/sitemap.xml`,
+      message: `${bad.length} entr${bad.length === 1 ? "y names a host" : "ies name hosts"} other than this sitemap's: ${sample(bad)}. A consumer may drop them \u2014 the sitemap only speaks for the host that serves it.`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+var sitemapEntryProtocolMismatch = {
+  id: "sitemap.entry.protocol-mismatch",
+  severity: "warning",
+  summary: "A sitemap should not mix `http` and `https` entries",
+  rigor: "spec-required",
+  sources: ["sitemaps-protocol"],
+  appliesTo: (site) => protocolsIn(site).size > 1,
+  check: ({ site, issue }) => {
+    const protocols = [...protocolsIn(site)].sort();
+    return issue({
+      pageUrl: site.discovery.diagnostics.sitemapUrl ?? `${site.origin}/sitemap.xml`,
+      message: `The sitemap lists both ${protocols.join(" and ")} URLs. One of the two sets names pages the site does not serve at those addresses, and a consumer has no way to tell which.`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+var sitemapLastmodInvalid = {
+  id: "sitemap.lastmod.invalid",
+  severity: "warning",
+  summary: "`<lastmod>` must be a W3C Datetime, and must not be in the future",
+  rigor: "spec-required",
+  sources: ["sitemaps-protocol", "google-sitemaps"],
+  appliesTo: (site) => badLastmods(site).length > 0,
+  check: ({ site, issue }) => {
+    const bad = badLastmods(site);
+    const malformed = bad.filter((e) => e.reason === "malformed");
+    const future = bad.filter((e) => e.reason === "future");
+    const parts = [];
+    if (malformed.length > 0) {
+      parts.push(
+        `${malformed.length} not a W3C Datetime (${sample(malformed.map((e) => e.value))})`
+      );
+    }
+    if (future.length > 0) {
+      parts.push(`${future.length} dated in the future (${sample(future.map((e) => e.value))})`);
+    }
+    return issue({
+      pageUrl: site.discovery.diagnostics.sitemapUrl ?? `${site.origin}/sitemap.xml`,
+      message: `\`<lastmod>\` values a consumer cannot use: ${parts.join("; ")}. Google ignores the field entirely when it stops trusting it, so one bad batch costs the whole site the signal.`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+var sitemapFieldInvalid = {
+  id: "sitemap.field.invalid",
+  severity: "warning",
+  summary: "`<changefreq>` and `<priority>` must hold the values the protocol defines",
+  rigor: "spec-required",
+  sources: ["sitemaps-protocol", "google-sitemaps"],
+  appliesTo: (site) => badFields(site).length > 0,
+  check: ({ site, issue }) => {
+    const bad = badFields(site);
+    return issue({
+      pageUrl: site.discovery.diagnostics.sitemapUrl ?? `${site.origin}/sitemap.xml`,
+      message: `${bad.length} entr${bad.length === 1 ? "y carries a field" : "ies carry fields"} outside the protocol's values: ${sample(bad)}. Google ignores both fields either way \u2014 so this is worth fixing or deleting, never worth trusting.`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+function sitemapHost(site) {
+  const url = site.discovery?.diagnostics.sitemapUrl;
+  try {
+    return url ? new URL(url).host : new URL(site.origin).host;
+  } catch {
+    return void 0;
+  }
+}
+function crossHostEntries(site) {
+  const host = sitemapHost(site);
+  if (!host) return [];
+  return (site.discovery?.urls ?? []).filter((entry) => {
+    if (!isAbsolute(entry.loc)) return false;
+    try {
+      return new URL(entry.loc).host !== host;
+    } catch {
+      return false;
+    }
+  }).map((entry) => entry.loc);
+}
+function protocolsIn(site) {
+  const protocols = /* @__PURE__ */ new Set();
+  for (const entry of site.discovery?.urls ?? []) {
+    try {
+      protocols.add(new URL(entry.loc).protocol.replace(":", ""));
+    } catch {
+      continue;
+    }
+  }
+  return protocols;
+}
+var W3C_DATETIME = /^\d{4}(-\d{2}(-\d{2}(T\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]\d{2}:\d{2}))?)?)?$/;
+function badLastmods(site) {
+  const out = [];
+  const tomorrow = Date.now() + 24 * 60 * 60 * 1e3;
+  for (const entry of site.discovery?.urls ?? []) {
+    const value = entry.lastmod?.trim();
+    if (!value) continue;
+    if (!W3C_DATETIME.test(value)) {
+      out.push({ value, reason: "malformed" });
+      continue;
+    }
+    const parsed = Date.parse(value);
+    if (Number.isFinite(parsed) && parsed > tomorrow) out.push({ value, reason: "future" });
+  }
+  return out;
+}
+function badFields(site) {
+  const out = [];
+  for (const entry of site.discovery?.urls ?? []) {
+    const changefreq = entry.changefreq?.trim().toLowerCase();
+    if (changefreq && !CHANGEFREQ.has(changefreq)) {
+      out.push(`${entry.loc} \u2014 changefreq \`${entry.changefreq}\``);
+      continue;
+    }
+    const priority = entry.priority?.trim();
+    if (priority === void 0) continue;
+    const value = Number(priority);
+    if (!Number.isFinite(value) || value < 0 || value > 1) {
+      out.push(`${entry.loc} \u2014 priority \`${entry.priority}\``);
+    }
+  }
+  return out;
+}
+function sameUrlKey(url) {
+  try {
+    const parsed = new URL(url);
+    parsed.hash = "";
+    const path = parsed.pathname.replace(/\/+$/, "");
+    return `${parsed.origin}${path || "/"}${parsed.search}`;
+  } catch {
+    return void 0;
+  }
+}
+function pagesByUrl(site) {
+  const byUrl = /* @__PURE__ */ new Map();
+  for (const page of site.pages) {
+    const key = sameUrlKey(page.fetch.finalUrl);
+    if (key) byUrl.set(key, page);
+  }
+  return byUrl;
+}
+function saysNoindex(page) {
+  if (metaRobotsTokens(page).has("noindex")) return true;
+  const header = page.fetch.headers["x-robots-tag"] ?? "";
+  return header.split(",").map((token) => token.trim().toLowerCase()).includes("noindex");
+}
+var sitemapEntryBlockedByRobots = {
+  id: "sitemap.entry.blocked-by-robots",
+  severity: "error",
+  summary: "A sitemap must not list URLs that robots.txt forbids fetching",
+  rigor: "vendor-spec",
+  sources: ["ietf-rfc9309", "sitemaps-protocol"],
+  // Skipped when the whole origin is disallowed: `robots.blocks-site` is that
+  // finding, and repeating it once per sitemap entry would bury it.
+  appliesTo: (site) => site.robots?.found === true && robotsAllows(site.robots.groups, "/").allowed && (site.discovery?.urls.length ?? 0) > 0,
+  check: ({ site, issue }) => {
+    const probe = site.robots;
+    const blocked = [];
+    for (const entry of site.discovery.urls) {
+      let path;
+      try {
+        const url = new URL(entry.loc);
+        path = `${url.pathname}${url.search}`;
+      } catch {
+        continue;
+      }
+      if (!robotsAllows(probe.groups, path).allowed) blocked.push(entry.loc);
+    }
+    if (blocked.length === 0) return [];
+    return issue({
+      pageUrl: site.discovery.diagnostics.sitemapUrl ?? `${site.origin}/sitemap.xml`,
+      message: `${blocked.length} sitemap entr${blocked.length === 1 ? "y is" : "ies are"} disallowed by \`robots.txt\`: ${sample(blocked)}. The sitemap says "index this" and robots.txt says "never fetch it" \u2014 both cannot hold, and robots.txt is the one that decides.`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+var sitemapEntryNoindex = {
+  id: "sitemap.entry.noindex",
+  severity: "warning",
+  summary: "A sitemap must not list URLs that ask not to be indexed",
+  rigor: "vendor-spec",
+  sources: ["sitemaps-protocol", "google-robots-meta"],
+  // Only the crawled pages can be judged: a sitemap entry goflag never fetched
+  // has no `noindex` to have seen, and assuming one either way would invent a
+  // finding or hide one.
+  appliesTo: (site) => (site.discovery?.urls.length ?? 0) > 0,
+  check: ({ site, issue }) => {
+    const byUrl = pagesByUrl(site);
+    const conflicting = [];
+    for (const entry of site.discovery.urls) {
+      const key = sameUrlKey(entry.loc);
+      const page = key ? byUrl.get(key) : void 0;
+      if (page && saysNoindex(page)) conflicting.push(entry.loc);
+    }
+    if (conflicting.length === 0) return [];
+    return issue({
+      pageUrl: site.discovery.diagnostics.sitemapUrl ?? `${site.origin}/sitemap.xml`,
+      message: `${conflicting.length} sitemap entr${conflicting.length === 1 ? "y declares" : "ies declare"} \`noindex\`: ${sample(conflicting)}. "Please index this" and "do not index this" are the same site's two answers to one question.`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+var sitemapEntryNonCanonical = {
+  id: "sitemap.entry.non-canonical",
+  severity: "warning",
+  summary: "A sitemap should list canonical URLs",
+  rigor: "vendor-spec",
+  sources: ["sitemaps-protocol", "google-canonicalization"],
+  appliesTo: (site) => (site.discovery?.urls.length ?? 0) > 0,
+  check: ({ site, issue }) => {
+    const byUrl = pagesByUrl(site);
+    const wrong = [];
+    for (const entry of site.discovery.urls) {
+      const key = sameUrlKey(entry.loc);
+      const page = key ? byUrl.get(key) : void 0;
+      const canonical = page?.links.canonical;
+      if (!page || !canonical) continue;
+      const canonicalKey = sameUrlKey(canonical);
+      if (canonicalKey && canonicalKey !== key) {
+        wrong.push(`${entry.loc} \u2192 ${canonical}`);
+      }
+    }
+    if (wrong.length === 0) return [];
+    return issue({
+      pageUrl: site.discovery.diagnostics.sitemapUrl ?? `${site.origin}/sitemap.xml`,
+      message: `${wrong.length} sitemap entr${wrong.length === 1 ? "y names a page whose canonical" : "ies name pages whose canonicals"} point elsewhere: ${sample(wrong)}. The sitemap is a list of what to index, so it should name the URL the site itself prefers.`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+var sitemapOrphans = {
+  id: "sitemap.orphans",
+  severity: "warning",
+  summary: "Indexable pages the crawl found should be listed in the sitemap",
+  rigor: "guideline",
+  sources: ["sitemaps-protocol", "google-sitemaps"],
+  // One finding with a count and a sample, not one per page — the same shape
+  // translation holes take, and for the same reason: forty repeats of one
+  // omission is noise, and the omission is a property of the sitemap.
+  appliesTo: (site) => site.discovery?.diagnostics.found === true && site.discovery.urls.length > 0,
+  check: ({ site, issue }) => {
+    const listed = new Set(
+      site.discovery.urls.map((entry) => sameUrlKey(entry.loc)).filter(Boolean)
+    );
+    const orphans = site.pages.filter((page) => !saysNoindex(page)).map((page) => ({ page, key: sameUrlKey(page.fetch.finalUrl) })).filter(({ key }) => key !== void 0 && !listed.has(key)).map(({ page }) => page.fetch.finalUrl);
+    if (orphans.length === 0) return [];
+    return issue({
+      pageUrl: site.discovery.diagnostics.sitemapUrl ?? `${site.origin}/sitemap.xml`,
+      message: `${orphans.length} crawled page${orphans.length === 1 ? "" : "s"} ask${orphans.length === 1 ? "s" : ""} to be indexed and ${orphans.length === 1 ? "is" : "are"} absent from the sitemap: ${sample(orphans)}. A consumer that reads the sitemap rather than following links will never see ${orphans.length === 1 ? "it" : "them"}.`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+function entryProbes(site) {
+  return [...site.sitemapEntries?.byUrl.values() ?? []];
+}
+function coverageNote(site) {
+  const unprobed = site.sitemapEntries?.unprobed ?? 0;
+  if (unprobed === 0) return "";
+  return ` ${unprobed} further entr${unprobed === 1 ? "y was" : "ies were"} not checked \u2014 this count is a floor, not a total.`;
+}
+var sitemapEntryUnreachable = {
+  id: "sitemap.entry.unreachable",
+  severity: "error",
+  summary: "Every URL a sitemap lists must answer",
+  rigor: "vendor-spec",
+  sources: ["sitemaps-protocol", "google-sitemaps"],
+  appliesTo: (site) => entryProbes(site).some((probe) => isDead(probe.status)),
+  check: ({ site, issue }) => {
+    const dead = entryProbes(site).filter((probe) => isDead(probe.status));
+    return issue({
+      pageUrl: site.discovery.diagnostics.sitemapUrl ?? `${site.origin}/sitemap.xml`,
+      message: `${dead.length} sitemap entr${dead.length === 1 ? "y does" : "ies do"} not answer: ${sample(dead.map((probe) => `${probe.url} (${probe.status === 0 ? "no response" : `HTTP ${probe.status}`})`))}. A sitemap is a list of pages to index, so every dead entry spends crawl budget on a promise the site does not keep.${coverageNote(site)}`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+var sitemapEntryRedirects = {
+  id: "sitemap.entry.redirects",
+  severity: "warning",
+  summary: "A sitemap should list final URLs, not URLs that redirect",
+  rigor: "guideline",
+  sources: ["sitemaps-protocol", "google-sitemaps"],
+  appliesTo: (site) => entryProbes(site).some((probe) => probe.redirected && !isDead(probe.status)),
+  check: ({ site, issue }) => {
+    const moved = entryProbes(site).filter((probe) => probe.redirected && !isDead(probe.status));
+    return issue({
+      pageUrl: site.discovery.diagnostics.sitemapUrl ?? `${site.origin}/sitemap.xml`,
+      message: `${moved.length} sitemap entr${moved.length === 1 ? "y redirects" : "ies redirect"}: ${sample(moved.map((probe) => `${probe.url} \u2192 ${probe.finalUrl}`))}. Google asks for the final URL, and every hop is crawl budget spent plus one more chance for a consumer to disagree about which address is the page.${coverageNote(site)}`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+function isDead(status) {
+  return status === 0 || status >= 400;
+}
+function isRobotsFailure(status) {
+  return status === 0 || status >= 500;
+}
+function isAbsolute(value) {
+  try {
+    const url = new URL(value);
+    return url.protocol === "http:" || url.protocol === "https:";
+  } catch {
+    return false;
+  }
+}
 var SITE_RULES = [
   hreflangMissing,
   hreflangSitemapMismatch,
-  robotsBlocksSite
+  iconsIcoMissing,
+  robotsBlocksPage,
+  robotsBlocksSite,
+  robotstxtCrossOrigin,
+  robotstxtInvalidLine,
+  robotstxtOversized,
+  robotstxtSitemapRelative,
+  robotstxtUnknownDirective,
+  robotstxtUnreachable,
+  sitemapEmpty,
+  sitemapEntryBlockedByRobots,
+  sitemapEntryCrossHost,
+  sitemapEntryInvalidUrl,
+  sitemapEntryNoindex,
+  sitemapEntryNonCanonical,
+  sitemapEntryProtocolMismatch,
+  sitemapEntryRedirects,
+  sitemapEntryUnreachable,
+  sitemapFieldInvalid,
+  sitemapIndexChildError,
+  sitemapLastmodInvalid,
+  sitemapMissing,
+  sitemapOrphans,
+  sitemapUnparsable
 ];
 function getSiteRule(id) {
   return SITE_RULES.find((rule) => rule.id === id);
@@ -2210,7 +3531,12 @@ function lintSite(site, rules = SITE_RULES) {
           origin: input.origin,
           fix: input.fix,
           suggestion: input.suggestion,
-          pageUrl: input.pageUrl
+          pageUrl: input.pageUrl,
+          // Stamped from the descriptor, never from the check: a rule does not
+          // get to claim a rigor per finding. Absent on the three rules that
+          // predate the field, which is how the gap stays visible instead of
+          // being filled with a plausible citation.
+          ...rule.rigor ? { rigor: rule.rigor, sources: rule.sources ?? [] } : {}
         })
       });
     } catch (err) {
@@ -2413,14 +3739,15 @@ async function discoverSitemap(baseUrl, options = {}) {
   };
   const robots = await probeRobots(origin, { signal: options.signal });
   diagnostics.robotsFound = robots.found;
+  const declaredUrls = robots.sitemaps.map((entry) => entry.value);
   const candidates = [];
-  for (const declared of robots.sitemaps) {
+  for (const declared of declaredUrls) {
     candidates.push({ url: declared, source: "robots", declaredInRobots: true });
   }
   candidates.push({
     url: new URL("/sitemap.xml", origin).toString(),
     source: "well-known",
-    declaredInRobots: robots.sitemaps.includes(new URL("/sitemap.xml", origin).toString())
+    declaredInRobots: declaredUrls.includes(new URL("/sitemap.xml", origin).toString())
   });
   candidates.push({
     url: new URL("/sitemap_index.xml", origin).toString(),
@@ -2593,9 +3920,396 @@ function relaxTlsIfRequested2(enabled) {
   };
 }
 
-// src/lib/core/clusters.ts
-function normalise(raw) {
-  let url;
+// src/lib/core/net/fetch-url.ts
+var DEFAULT_USER_AGENT = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36";
+var DEFAULT_TIMEOUT_MS = 8e3;
+var DEFAULT_MAX_BYTES = 3 * 1024 * 1024;
+var DEFAULT_ACCEPT = "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8";
+var TEXTY = /(text\/|application\/(xhtml\+xml|xml|json|.*\+xml|.*\+json|javascript))/;
+async function fetchUrl(url, options = {}) {
+  const method = options.method ?? "GET";
+  const redirect = options.redirect ?? "follow";
+  const maxBytes = options.maxBytes ?? DEFAULT_MAX_BYTES;
+  const startedAt = Date.now();
+  const { signal, cleanup } = combineSignals(
+    options.signal,
+    options.timeoutMs ?? DEFAULT_TIMEOUT_MS
+  );
+  const restoreTls = relaxTlsIfRequested3(options.allowInsecureTls);
+  try {
+    const res = await fetch(url, {
+      method,
+      signal,
+      redirect,
+      headers: {
+        "user-agent": options.userAgent ?? DEFAULT_USER_AGENT,
+        accept: options.accept ?? DEFAULT_ACCEPT
+      }
+    });
+    const contentType = normaliseContentType(res.headers.get("content-type"));
+    const result = {
+      requestedUrl: url,
+      finalUrl: res.url || url,
+      status: res.status,
+      redirected: res.redirected,
+      redirectChain: [],
+      contentType,
+      durationMs: Date.now() - startedAt
+    };
+    const retryAfter = res.headers.get("retry-after");
+    if (retryAfter) result.retryAfter = retryAfter;
+    if (redirect === "manual" && isRedirectStatus(res.status)) {
+      const location = res.headers.get("location");
+      if (location) {
+        try {
+          const next = new URL(location, url).toString();
+          result.finalUrl = next;
+          result.redirectChain = [next];
+          result.redirected = true;
+        } catch {
+        }
+      }
+      await res.body?.cancel().catch(() => void 0);
+      return result;
+    }
+    if (method === "HEAD") {
+      await res.body?.cancel().catch(() => void 0);
+      return result;
+    }
+    if (contentType && !TEXTY.test(contentType)) {
+      await res.body?.cancel().catch(() => void 0);
+      return result;
+    }
+    const { text, truncated } = await readCappedText(res, maxBytes);
+    result.body = text;
+    if (truncated) result.truncated = true;
+    return result;
+  } catch (err) {
+    return {
+      requestedUrl: url,
+      finalUrl: url,
+      status: 0,
+      redirected: false,
+      redirectChain: [],
+      reason: classifyError(err, options.signal),
+      durationMs: Date.now() - startedAt
+    };
+  } finally {
+    cleanup();
+    restoreTls();
+  }
+}
+function isRedirectStatus(status) {
+  return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
+}
+function normaliseContentType(raw) {
+  if (!raw) return void 0;
+  const semi = raw.indexOf(";");
+  return (semi === -1 ? raw : raw.slice(0, semi)).trim().toLowerCase() || void 0;
+}
+async function readCappedText(res, maxBytes) {
+  const reader = res.body?.getReader();
+  if (!reader) {
+    const text = await res.text();
+    if (text.length > maxBytes) {
+      return { text: text.slice(0, maxBytes), truncated: true };
+    }
+    return { text, truncated: false };
+  }
+  const chunks = [];
+  let received = 0;
+  let truncated = false;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    if (!value) continue;
+    chunks.push(value);
+    received += value.byteLength;
+    if (received >= maxBytes) {
+      truncated = true;
+      await reader.cancel().catch(() => void 0);
+      break;
+    }
+  }
+  const buf = Buffer.concat(chunks.map((c) => Buffer.from(c)));
+  const sliced = buf.byteLength > maxBytes ? buf.subarray(0, maxBytes) : buf;
+  return { text: sliced.toString("utf8"), truncated };
+}
+function classifyError(err, callerSignal) {
+  if (isAbortError(err)) {
+    return callerSignal?.aborted ? "abort" : "timeout";
+  }
+  const code = errorCode(err);
+  if (code) {
+    if (code === "ENOTFOUND" || code === "EAI_AGAIN") return "dns";
+    if (code.startsWith("CERT_") || code.includes("SELF_SIGNED") || code.includes("CERT")) {
+      return "tls";
+    }
+  }
+  const message = err instanceof Error ? err.message.toLowerCase() : String(err).toLowerCase();
+  if (message.includes("certificate") || message.includes("tls") || message.includes("ssl")) {
+    return "tls";
+  }
+  return "network";
+}
+function isAbortError(err) {
+  return err instanceof Error && err.name === "AbortError";
+}
+function errorCode(err) {
+  if (err && typeof err === "object") {
+    const direct = err.code;
+    if (typeof direct === "string") return direct;
+    const cause = err.cause;
+    if (cause && typeof cause === "object") {
+      const causeCode = cause.code;
+      if (typeof causeCode === "string") return causeCode;
+    }
+  }
+  return void 0;
+}
+function relaxTlsIfRequested3(enabled) {
+  if (!enabled) return () => void 0;
+  const previous = process.env.NODE_TLS_REJECT_UNAUTHORIZED;
+  process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
+  return () => {
+    if (previous === void 0) delete process.env.NODE_TLS_REJECT_UNAUTHORIZED;
+    else process.env.NODE_TLS_REJECT_UNAUTHORIZED = previous;
+  };
+}
+
+// src/lib/core/links/classify.ts
+function classifyLink(input) {
+  if (input.status === 0) return "broken";
+  if (input.loop) return "broken";
+  if (input.softNotFound) return "warning";
+  if (input.status === 403 || input.status === 429) return "blocked";
+  if (input.status >= 400) return "broken";
+  if (input.status >= 200 && input.status < 300) {
+    return input.redirected ? "redirect" : "ok";
+  }
+  return "broken";
+}
+
+// src/lib/core/links/check.ts
+var DEFAULTS2 = {
+  timeoutMs: 8e3,
+  maxRedirects: 10,
+  retries: 1,
+  backoffBaseMs: 300,
+  maxBackoffMs: 3e3,
+  softBodyBytes: 16 * 1024
+};
+var NOT_FOUND_RE = /\b(not\s+found|page\s+doesn'?t\s+exist|404|no\s+such\s+page)\b/i;
+var SOFT_404_BODY_LIMIT = 2048;
+async function checkLink(url, options = {}) {
+  const checkedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const started = Date.now();
+  const scheme = schemeOf(url);
+  if (scheme !== "http" && scheme !== "https") {
+    return {
+      url,
+      finalUrl: url,
+      status: 0,
+      verdict: "skipped",
+      method: "GET",
+      redirectChain: [],
+      reason: scheme ? `unsupported scheme: ${scheme}` : "not a URL",
+      checkedAt,
+      durationMs: Date.now() - started
+    };
+  }
+  const outcome = await probeWithRetry(url, options);
+  const softNotFound = isSoftNotFound(outcome);
+  const verdict = classifyLink({
+    status: outcome.status,
+    redirected: outcome.redirectChain.length > 0,
+    reason: outcome.reason,
+    softNotFound,
+    loop: outcome.loop
+  });
+  return {
+    url,
+    finalUrl: outcome.finalUrl,
+    status: outcome.status,
+    verdict,
+    method: outcome.method,
+    redirectChain: outcome.redirectChain,
+    reason: describeReason(outcome, softNotFound),
+    checkedAt,
+    durationMs: Date.now() - started
+  };
+}
+async function probeWithRetry(url, options) {
+  const retries = options.retries ?? DEFAULTS2.retries;
+  const sleep = options.sleep ?? defaultSleep;
+  let outcome = await probeWithHeadFallback(url, options);
+  for (let attempt = 0; attempt < retries; attempt++) {
+    if (!isTransient(outcome)) break;
+    if (options.signal?.aborted) break;
+    const delay = backoffDelay(outcome, attempt, options);
+    if (delay > 0) await sleep(delay);
+    outcome = await probeWithHeadFallback(url, options);
+  }
+  return outcome;
+}
+async function probeWithHeadFallback(url, options) {
+  const head = await followRedirects(url, "HEAD", options);
+  if (headRejected(head) || head.status >= 200 && head.status < 300) {
+    const get = await followRedirects(url, "GET", options);
+    if (get.status === 0 && head.status !== 0 && !headRejected(head)) return head;
+    return get;
+  }
+  return head;
+}
+function headRejected(o) {
+  return o.status === 405 || o.status === 501 || o.status === 403 || o.status === 0;
+}
+async function followRedirects(url, method, options) {
+  const maxRedirects = options.maxRedirects ?? DEFAULTS2.maxRedirects;
+  const chain = [];
+  const visited = /* @__PURE__ */ new Set([url]);
+  let current = url;
+  for (let hop = 0; hop <= maxRedirects; hop++) {
+    const res = await fetchUrl(current, {
+      method,
+      redirect: "manual",
+      timeoutMs: options.timeoutMs ?? DEFAULTS2.timeoutMs,
+      allowInsecureTls: options.allowInsecureTls,
+      userAgent: options.userAgent,
+      maxBytes: method === "GET" ? options.softBodyBytes ?? DEFAULTS2.softBodyBytes : void 0
+    });
+    if (res.status === 0) {
+      return {
+        status: 0,
+        finalUrl: current,
+        redirectChain: chain,
+        reason: res.reason,
+        loop: false,
+        method
+      };
+    }
+    const next = res.redirectChain[0];
+    if (next) {
+      chain.push(next);
+      if (visited.has(next)) {
+        return { status: res.status, finalUrl: next, redirectChain: chain, loop: true, method };
+      }
+      visited.add(next);
+      current = next;
+      continue;
+    }
+    return {
+      status: res.status,
+      finalUrl: res.finalUrl,
+      redirectChain: chain,
+      loop: false,
+      body: res.body,
+      retryAfter: res.retryAfter,
+      method
+    };
+  }
+  return { status: 0, finalUrl: current, redirectChain: chain, loop: true, method };
+}
+function isSoftNotFound(o) {
+  if (o.status < 200 || o.status >= 300) return false;
+  if (o.body === void 0) return false;
+  if (o.body.length > SOFT_404_BODY_LIMIT) return false;
+  return NOT_FOUND_RE.test(o.body);
+}
+function isTransient(o) {
+  if (o.status === 0) return true;
+  if (o.status === 429) return true;
+  if (o.status >= 500) return true;
+  return false;
+}
+function backoffDelay(o, attempt, options) {
+  const max = options.maxBackoffMs ?? DEFAULTS2.maxBackoffMs;
+  const retryAfterMs = parseRetryAfter(o.retryAfter);
+  if (retryAfterMs !== void 0) return Math.min(retryAfterMs, max);
+  const base = options.backoffBaseMs ?? DEFAULTS2.backoffBaseMs;
+  const exp = base * 2 ** attempt;
+  const jitter = Math.floor(Math.random() * base);
+  return Math.min(exp + jitter, max);
+}
+function parseRetryAfter(value) {
+  if (!value) return void 0;
+  const seconds = Number(value);
+  if (Number.isFinite(seconds)) return Math.max(0, seconds * 1e3);
+  const date = Date.parse(value);
+  if (!Number.isNaN(date)) return Math.max(0, date - Date.now());
+  return void 0;
+}
+function describeReason(o, softNotFound) {
+  if (o.reason) return o.reason;
+  if (o.loop) return "redirect loop";
+  if (softNotFound) return "soft-404";
+  if (o.status === 429) return "429 rate-limited";
+  if (o.status === 403) return "403 forbidden";
+  if (o.status >= 400) return `${o.status}`;
+  return void 0;
+}
+function schemeOf(url) {
+  try {
+    return new URL(url).protocol.replace(/:$/, "").toLowerCase();
+  } catch {
+    return null;
+  }
+}
+function defaultSleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+// src/lib/core/sitemap/entries.ts
+async function probeSitemapEntries(locs, options) {
+  const byUrl = /* @__PURE__ */ new Map();
+  const toFetch = [];
+  for (const loc of locs) {
+    if (byUrl.has(loc)) continue;
+    const crawled = options.crawled.get(loc);
+    if (crawled !== void 0) {
+      byUrl.set(loc, { url: loc, status: crawled, via: "crawl", finalUrl: loc, redirected: false });
+      continue;
+    }
+    const checked = options.checked.get(loc);
+    if (checked) {
+      byUrl.set(loc, fromCheck(loc, checked, "link-audit"));
+      continue;
+    }
+    toFetch.push(loc);
+  }
+  const budget = toFetch.slice(0, options.maxProbes);
+  const unprobed = toFetch.length - budget.length;
+  const queue = [...budget];
+  const workers = Math.min(options.concurrency ?? 6, queue.length);
+  await Promise.all(
+    Array.from({ length: workers }, async () => {
+      for (let url = queue.pop(); url !== void 0; url = queue.pop()) {
+        const check = await checkLink(url, {
+          signal: options.signal,
+          timeoutMs: options.timeoutMs,
+          allowInsecureTls: options.allowInsecureTls
+        }).catch(() => void 0);
+        if (check) byUrl.set(url, fromCheck(url, check, "probe"));
+      }
+    })
+  );
+  return { byUrl, unprobed };
+}
+function fromCheck(url, check, via) {
+  return {
+    url,
+    status: check.status,
+    via,
+    finalUrl: check.finalUrl,
+    // A redirect that resolved, or one that did not: either way the entry did
+    // not name the URL that answers, which is what the rule is about.
+    redirected: check.finalUrl !== url || check.redirectChain.length > 0
+  };
+}
+
+// src/lib/core/clusters.ts
+function normalise2(raw) {
+  let url;
   try {
     url = new URL(raw);
   } catch {
@@ -2613,7 +4327,7 @@ function indexOf(rows, conflicts, refused) {
   return {
     rows,
     routeOf: (url) => {
-      const key = normalise(url);
+      const key = normalise2(url);
       return key === null ? void 0 : rows.get(key);
     },
     size: clusterCount(rows),
@@ -2633,7 +4347,7 @@ function buildClusterIndex(entries) {
       refused++;
       continue;
     }
-    const anchorUrl = normalise(xDefault.href);
+    const anchorUrl = normalise2(xDefault.href);
     if (!anchorUrl) {
       refused++;
       continue;
@@ -2641,7 +4355,7 @@ function buildClusterIndex(entries) {
     const { route: anchorRoute } = splitRoute(new URL(anchorUrl).pathname);
     const members = [entry.loc, ...alternates.map((a) => a.href)];
     for (const member of members) {
-      const url = normalise(member);
+      const url = normalise2(member);
       if (!url) continue;
       const existing = rows.get(url);
       if (existing === void 0) {
@@ -2656,12 +4370,12 @@ function buildClusterIndex(entries) {
 function readHeads(pages) {
   const seen = /* @__PURE__ */ new Map();
   for (const page of pages) {
-    const self = normalise(page.fetch.finalUrl);
+    const self = normalise2(page.fetch.finalUrl);
     if (self === null || seen.has(self)) continue;
     const peers = /* @__PURE__ */ new Set();
     const xDefaults = /* @__PURE__ */ new Set();
     for (const alt of page.links.alternates) {
-      const href = normalise(alt.href);
+      const href = normalise2(alt.href);
       if (href === null) continue;
       if (alt.isXDefault) xDefaults.add(href);
       else if (href !== self) peers.add(href);
@@ -2826,6 +4540,98 @@ function selectByStructure(urls, options = {}) {
   };
 }
 
+// src/lib/core/probes/assets.ts
+var HEAD_BYTES = 8 * 1024;
+function isImageContentType(contentType) {
+  if (!contentType) return false;
+  return contentType.startsWith("image/") || contentType === "application/ico" || contentType === "application/x-ico";
+}
+async function probeAsset(url, options = {}) {
+  const { signal, cleanup } = combineSignals(options.signal, options.timeoutMs ?? 8e3);
+  try {
+    const res = await fetch(url, {
+      signal,
+      redirect: "follow",
+      headers: { range: `bytes=0-${HEAD_BYTES - 1}`, accept: "image/*,*/*;q=0.8" }
+    });
+    const contentType = res.headers.get("content-type")?.split(";")[0]?.trim().toLowerCase();
+    const served = res.status === 200 || res.status === 206;
+    const ok = served && isImageContentType(contentType);
+    const head = served ? await readHead(res) : void 0;
+    const sizes = head ? decodeSizes(head) : void 0;
+    return { url, status: res.status, ok, contentType, ...sizes ? { sizes } : {} };
+  } catch {
+    return { url, status: 0, ok: false };
+  } finally {
+    cleanup();
+  }
+}
+async function readHead(res) {
+  if (!res.body) return void 0;
+  const reader = res.body.getReader();
+  const chunks = [];
+  let total = 0;
+  try {
+    while (total < HEAD_BYTES) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      if (value) {
+        chunks.push(value);
+        total += value.byteLength;
+      }
+    }
+  } catch {
+    return chunks.length > 0 ? Buffer.concat(chunks) : void 0;
+  } finally {
+    await reader.cancel().catch(() => void 0);
+  }
+  return chunks.length > 0 ? Buffer.concat(chunks) : void 0;
+}
+var PNG_SIGNATURE = Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]);
+function decodeSizes(head) {
+  if (head.length >= 24 && head.subarray(0, 8).equals(PNG_SIGNATURE)) {
+    return [{ width: head.readUInt32BE(16), height: head.readUInt32BE(20) }];
+  }
+  if (head.length >= 6 && head.readUInt16LE(0) === 0 && head.readUInt16LE(2) === 1) {
+    const count2 = head.readUInt16LE(4);
+    if (count2 === 0 || head.length < 6 + 16 * count2) return void 0;
+    const sizes = [];
+    for (let index = 0; index < count2; index++) {
+      const at = 6 + 16 * index;
+      sizes.push({ width: head[at] || 256, height: head[at + 1] || 256 });
+    }
+    return sizes;
+  }
+  return void 0;
+}
+
+// src/lib/core/probes/favicon.ts
+async function probeFavicon(origin, options = {}) {
+  const url = new URL("/favicon.ico", origin).toString();
+  const { signal, cleanup } = combineSignals(options.signal, options.timeoutMs ?? 5e3);
+  try {
+    let res = await fetch(url, { method: "HEAD", signal, redirect: "follow" });
+    if (res.status === 405 || res.status === 501) {
+      res = await fetch(url, { signal, redirect: "follow" });
+    }
+    const contentType = res.headers.get("content-type")?.split(";")[0]?.trim().toLowerCase();
+    return {
+      url,
+      status: res.status,
+      found: res.ok && isIconType(contentType),
+      contentType
+    };
+  } catch {
+    return { url, status: 0, found: false };
+  } finally {
+    cleanup();
+  }
+}
+function isIconType(contentType) {
+  if (!contentType) return false;
+  return contentType.startsWith("image/") || contentType === "application/ico" || contentType === "application/x-ico";
+}
+
 // src/lib/rules/advisory.ts
 function resolveEvidencePath(extraction, path) {
   let current = extraction;
@@ -2974,176 +4780,19 @@ var ogImageRepresentative = {
   title: "The `og:image` represents this page and survives the unfurl crop",
   why: "The preview image is the whole payload of a shared link. A generic site-wide banner, or artwork whose subject sits outside the ~1.91:1 crop, is present enough to pass every mechanical check and still communicate nothing.",
   rigor: "guideline",
-  sources: ["ogp", "meta-og-sharing"],
-  reads: ["openGraph.images", "openGraph.title", "document.title", "http.finalUrl"],
-  relates: ["og.image.missing"],
-  appliesTo: (ex) => ex.openGraph.images.length > 0,
-  prose: "Does the og:image represent what this page is about, rather than being a site-wide default, and does its subject survive being cropped to the 1.91:1 aspect ratio consumers render?"
-};
-var PROSE_RULES = [
-  descriptionAccurate,
-  langMatchesContent,
-  ogImageRepresentative,
-  titleDescriptive
-];
-var PROSE_RULE_BY_ID = new Map(PROSE_RULES.map((r) => [r.id, r]));
-
-// src/lib/core/net/fetch-url.ts
-var DEFAULT_USER_AGENT = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36";
-var DEFAULT_TIMEOUT_MS = 8e3;
-var DEFAULT_MAX_BYTES = 3 * 1024 * 1024;
-var DEFAULT_ACCEPT = "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8";
-var TEXTY = /(text\/|application\/(xhtml\+xml|xml|json|.*\+xml|.*\+json|javascript))/;
-async function fetchUrl(url, options = {}) {
-  const method = options.method ?? "GET";
-  const redirect = options.redirect ?? "follow";
-  const maxBytes = options.maxBytes ?? DEFAULT_MAX_BYTES;
-  const startedAt = Date.now();
-  const { signal, cleanup } = combineSignals(
-    options.signal,
-    options.timeoutMs ?? DEFAULT_TIMEOUT_MS
-  );
-  const restoreTls = relaxTlsIfRequested3(options.allowInsecureTls);
-  try {
-    const res = await fetch(url, {
-      method,
-      signal,
-      redirect,
-      headers: {
-        "user-agent": options.userAgent ?? DEFAULT_USER_AGENT,
-        accept: options.accept ?? DEFAULT_ACCEPT
-      }
-    });
-    const contentType = normaliseContentType(res.headers.get("content-type"));
-    const result = {
-      requestedUrl: url,
-      finalUrl: res.url || url,
-      status: res.status,
-      redirected: res.redirected,
-      redirectChain: [],
-      contentType,
-      durationMs: Date.now() - startedAt
-    };
-    const retryAfter = res.headers.get("retry-after");
-    if (retryAfter) result.retryAfter = retryAfter;
-    if (redirect === "manual" && isRedirectStatus(res.status)) {
-      const location = res.headers.get("location");
-      if (location) {
-        try {
-          const next = new URL(location, url).toString();
-          result.finalUrl = next;
-          result.redirectChain = [next];
-          result.redirected = true;
-        } catch {
-        }
-      }
-      await res.body?.cancel().catch(() => void 0);
-      return result;
-    }
-    if (method === "HEAD") {
-      await res.body?.cancel().catch(() => void 0);
-      return result;
-    }
-    if (contentType && !TEXTY.test(contentType)) {
-      await res.body?.cancel().catch(() => void 0);
-      return result;
-    }
-    const { text, truncated } = await readCappedText(res, maxBytes);
-    result.body = text;
-    if (truncated) result.truncated = true;
-    return result;
-  } catch (err) {
-    return {
-      requestedUrl: url,
-      finalUrl: url,
-      status: 0,
-      redirected: false,
-      redirectChain: [],
-      reason: classifyError(err, options.signal),
-      durationMs: Date.now() - startedAt
-    };
-  } finally {
-    cleanup();
-    restoreTls();
-  }
-}
-function isRedirectStatus(status) {
-  return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
-}
-function normaliseContentType(raw) {
-  if (!raw) return void 0;
-  const semi = raw.indexOf(";");
-  return (semi === -1 ? raw : raw.slice(0, semi)).trim().toLowerCase() || void 0;
-}
-async function readCappedText(res, maxBytes) {
-  const reader = res.body?.getReader();
-  if (!reader) {
-    const text = await res.text();
-    if (text.length > maxBytes) {
-      return { text: text.slice(0, maxBytes), truncated: true };
-    }
-    return { text, truncated: false };
-  }
-  const chunks = [];
-  let received = 0;
-  let truncated = false;
-  for (; ; ) {
-    const { done, value } = await reader.read();
-    if (done) break;
-    if (!value) continue;
-    chunks.push(value);
-    received += value.byteLength;
-    if (received >= maxBytes) {
-      truncated = true;
-      await reader.cancel().catch(() => void 0);
-      break;
-    }
-  }
-  const buf = Buffer.concat(chunks.map((c) => Buffer.from(c)));
-  const sliced = buf.byteLength > maxBytes ? buf.subarray(0, maxBytes) : buf;
-  return { text: sliced.toString("utf8"), truncated };
-}
-function classifyError(err, callerSignal) {
-  if (isAbortError(err)) {
-    return callerSignal?.aborted ? "abort" : "timeout";
-  }
-  const code = errorCode(err);
-  if (code) {
-    if (code === "ENOTFOUND" || code === "EAI_AGAIN") return "dns";
-    if (code.startsWith("CERT_") || code.includes("SELF_SIGNED") || code.includes("CERT")) {
-      return "tls";
-    }
-  }
-  const message = err instanceof Error ? err.message.toLowerCase() : String(err).toLowerCase();
-  if (message.includes("certificate") || message.includes("tls") || message.includes("ssl")) {
-    return "tls";
-  }
-  return "network";
-}
-function isAbortError(err) {
-  return err instanceof Error && err.name === "AbortError";
-}
-function errorCode(err) {
-  if (err && typeof err === "object") {
-    const direct = err.code;
-    if (typeof direct === "string") return direct;
-    const cause = err.cause;
-    if (cause && typeof cause === "object") {
-      const causeCode = cause.code;
-      if (typeof causeCode === "string") return causeCode;
-    }
-  }
-  return void 0;
-}
-function relaxTlsIfRequested3(enabled) {
-  if (!enabled) return () => void 0;
-  const previous = process.env.NODE_TLS_REJECT_UNAUTHORIZED;
-  process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
-  return () => {
-    if (previous === void 0) delete process.env.NODE_TLS_REJECT_UNAUTHORIZED;
-    else process.env.NODE_TLS_REJECT_UNAUTHORIZED = previous;
-  };
-}
+  sources: ["ogp", "meta-og-sharing"],
+  reads: ["openGraph.images", "openGraph.title", "document.title", "http.finalUrl"],
+  relates: ["og.image.missing"],
+  appliesTo: (ex) => ex.openGraph.images.length > 0,
+  prose: "Does the og:image represent what this page is about, rather than being a site-wide default, and does its subject survive being cropped to the 1.91:1 aspect ratio consumers render?"
+};
+var PROSE_RULES = [
+  descriptionAccurate,
+  langMatchesContent,
+  ogImageRepresentative,
+  titleDescriptive
+];
+var PROSE_RULE_BY_ID = new Map(PROSE_RULES.map((r) => [r.id, r]));
 
 // src/lib/core/links/extract.ts
 import * as cheerio3 from "cheerio";
@@ -3228,188 +4877,6 @@ function resolveBase2($, pageUrl) {
   return pageUrl;
 }
 
-// src/lib/core/links/classify.ts
-function classifyLink(input) {
-  if (input.status === 0) return "broken";
-  if (input.loop) return "broken";
-  if (input.softNotFound) return "warning";
-  if (input.status === 403 || input.status === 429) return "blocked";
-  if (input.status >= 400) return "broken";
-  if (input.status >= 200 && input.status < 300) {
-    return input.redirected ? "redirect" : "ok";
-  }
-  return "broken";
-}
-
-// src/lib/core/links/check.ts
-var DEFAULTS2 = {
-  timeoutMs: 8e3,
-  maxRedirects: 10,
-  retries: 1,
-  backoffBaseMs: 300,
-  maxBackoffMs: 3e3,
-  softBodyBytes: 16 * 1024
-};
-var NOT_FOUND_RE = /\b(not\s+found|page\s+doesn'?t\s+exist|404|no\s+such\s+page)\b/i;
-var SOFT_404_BODY_LIMIT = 2048;
-async function checkLink(url, options = {}) {
-  const checkedAt = (/* @__PURE__ */ new Date()).toISOString();
-  const started = Date.now();
-  const scheme = schemeOf(url);
-  if (scheme !== "http" && scheme !== "https") {
-    return {
-      url,
-      finalUrl: url,
-      status: 0,
-      verdict: "skipped",
-      method: "GET",
-      redirectChain: [],
-      reason: scheme ? `unsupported scheme: ${scheme}` : "not a URL",
-      checkedAt,
-      durationMs: Date.now() - started
-    };
-  }
-  const outcome = await probeWithRetry(url, options);
-  const softNotFound = isSoftNotFound(outcome);
-  const verdict = classifyLink({
-    status: outcome.status,
-    redirected: outcome.redirectChain.length > 0,
-    reason: outcome.reason,
-    softNotFound,
-    loop: outcome.loop
-  });
-  return {
-    url,
-    finalUrl: outcome.finalUrl,
-    status: outcome.status,
-    verdict,
-    method: outcome.method,
-    redirectChain: outcome.redirectChain,
-    reason: describeReason(outcome, softNotFound),
-    checkedAt,
-    durationMs: Date.now() - started
-  };
-}
-async function probeWithRetry(url, options) {
-  const retries = options.retries ?? DEFAULTS2.retries;
-  const sleep = options.sleep ?? defaultSleep;
-  let outcome = await probeWithHeadFallback(url, options);
-  for (let attempt = 0; attempt < retries; attempt++) {
-    if (!isTransient(outcome)) break;
-    if (options.signal?.aborted) break;
-    const delay = backoffDelay(outcome, attempt, options);
-    if (delay > 0) await sleep(delay);
-    outcome = await probeWithHeadFallback(url, options);
-  }
-  return outcome;
-}
-async function probeWithHeadFallback(url, options) {
-  const head = await followRedirects(url, "HEAD", options);
-  if (headRejected(head) || head.status >= 200 && head.status < 300) {
-    const get = await followRedirects(url, "GET", options);
-    if (get.status === 0 && head.status !== 0 && !headRejected(head)) return head;
-    return get;
-  }
-  return head;
-}
-function headRejected(o) {
-  return o.status === 405 || o.status === 501 || o.status === 403 || o.status === 0;
-}
-async function followRedirects(url, method, options) {
-  const maxRedirects = options.maxRedirects ?? DEFAULTS2.maxRedirects;
-  const chain = [];
-  const visited = /* @__PURE__ */ new Set([url]);
-  let current = url;
-  for (let hop = 0; hop <= maxRedirects; hop++) {
-    const res = await fetchUrl(current, {
-      method,
-      redirect: "manual",
-      timeoutMs: options.timeoutMs ?? DEFAULTS2.timeoutMs,
-      allowInsecureTls: options.allowInsecureTls,
-      userAgent: options.userAgent,
-      maxBytes: method === "GET" ? options.softBodyBytes ?? DEFAULTS2.softBodyBytes : void 0
-    });
-    if (res.status === 0) {
-      return {
-        status: 0,
-        finalUrl: current,
-        redirectChain: chain,
-        reason: res.reason,
-        loop: false,
-        method
-      };
-    }
-    const next = res.redirectChain[0];
-    if (next) {
-      chain.push(next);
-      if (visited.has(next)) {
-        return { status: res.status, finalUrl: next, redirectChain: chain, loop: true, method };
-      }
-      visited.add(next);
-      current = next;
-      continue;
-    }
-    return {
-      status: res.status,
-      finalUrl: res.finalUrl,
-      redirectChain: chain,
-      loop: false,
-      body: res.body,
-      retryAfter: res.retryAfter,
-      method
-    };
-  }
-  return { status: 0, finalUrl: current, redirectChain: chain, loop: true, method };
-}
-function isSoftNotFound(o) {
-  if (o.status < 200 || o.status >= 300) return false;
-  if (o.body === void 0) return false;
-  if (o.body.length > SOFT_404_BODY_LIMIT) return false;
-  return NOT_FOUND_RE.test(o.body);
-}
-function isTransient(o) {
-  if (o.status === 0) return true;
-  if (o.status === 429) return true;
-  if (o.status >= 500) return true;
-  return false;
-}
-function backoffDelay(o, attempt, options) {
-  const max = options.maxBackoffMs ?? DEFAULTS2.maxBackoffMs;
-  const retryAfterMs = parseRetryAfter(o.retryAfter);
-  if (retryAfterMs !== void 0) return Math.min(retryAfterMs, max);
-  const base = options.backoffBaseMs ?? DEFAULTS2.backoffBaseMs;
-  const exp = base * 2 ** attempt;
-  const jitter = Math.floor(Math.random() * base);
-  return Math.min(exp + jitter, max);
-}
-function parseRetryAfter(value) {
-  if (!value) return void 0;
-  const seconds = Number(value);
-  if (Number.isFinite(seconds)) return Math.max(0, seconds * 1e3);
-  const date = Date.parse(value);
-  if (!Number.isNaN(date)) return Math.max(0, date - Date.now());
-  return void 0;
-}
-function describeReason(o, softNotFound) {
-  if (o.reason) return o.reason;
-  if (o.loop) return "redirect loop";
-  if (softNotFound) return "soft-404";
-  if (o.status === 429) return "429 rate-limited";
-  if (o.status === 403) return "403 forbidden";
-  if (o.status >= 400) return `${o.status}`;
-  return void 0;
-}
-function schemeOf(url) {
-  try {
-    return new URL(url).protocol.replace(/:$/, "").toLowerCase();
-  } catch {
-    return null;
-  }
-}
-function defaultSleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-
 // src/lib/core/links/types.ts
 function emptyVerdictSummary() {
   return { ok: 0, redirect: 0, broken: 0, blocked: 0, warning: 0, skipped: 0 };
@@ -3493,6 +4960,18 @@ async function runLinkAudit(discovery, options = {}) {
     {
       concurrency: options.checkConcurrency ?? DEFAULTS3.checkConcurrency,
       perHost: options.maxPerHost ?? DEFAULTS3.maxPerHost,
+      // The origin is exempt, and the scan phase above is the precedent: it
+      // fetches these same pages at `scanConcurrency` with `perHost: Infinity`.
+      // Capping the check phase at 3 against that host made the two phases
+      // disagree about the same server, and on a deployed site it is where the
+      // audit spends itself: measured on openfinanceguide, 3821 same-origin
+      // links at ~700 ms a round trip, three at a time — 14.8 minutes of an
+      // 18.5-minute job. Against a local `--start` run the cap never binds,
+      // which is why the plan's own 7-minute figure held and CI's did not.
+      //
+      // `checkConcurrency` still bounds it: at most 8 in flight, where the scan
+      // phase already runs 4.
+      unlimitedHost: hostOf(discovery.origin),
       signal: options.signal
     },
     async (url) => {
@@ -3576,7 +5055,8 @@ function mapWithHostCaps(items, opts, worker, hostOf2) {
         let pickIndex = -1;
         for (let k = 0; k < pending.length; k++) {
           const entry = pending[k];
-          if ((hostActive.get(entry.host) ?? 0) < perHost) {
+          const cap = entry.host === opts.unlimitedHost ? Infinity : perHost;
+          if ((hostActive.get(entry.host) ?? 0) < cap) {
             pickIndex = k;
             break;
           }
@@ -3709,6 +5189,71 @@ function exitCode(report, failOn = "warning") {
   if (failOn === "error") return report.summary.verdict === "red" ? 1 : 0;
   return 1;
 }
+async function attachManifests(pages, options) {
+  const wanted = new Set(
+    pages.map((page) => page.links.manifest?.href).filter((href) => Boolean(href))
+  );
+  if (wanted.size === 0) return;
+  const probed = /* @__PURE__ */ new Map();
+  await Promise.all(
+    [...wanted].map(async (href) => {
+      const probe = await probeManifest(href, options).catch(() => void 0);
+      if (probe) probed.set(href, probe);
+    })
+  );
+  for (const page of pages) {
+    const href = page.links.manifest?.href;
+    const probe = href ? probed.get(href) : void 0;
+    if (probe) page.probes = { ...page.probes, manifest: probe };
+  }
+}
+async function probeAssets(pages, options) {
+  const sameOrigin2 = (url) => {
+    try {
+      return new URL(url).origin === new URL(options.origin).origin;
+    } catch {
+      return false;
+    }
+  };
+  const wantedUrl = (url) => /^https?:\/\//i.test(url) && (options.checkExternal || sameOrigin2(url));
+  const wanted = /* @__PURE__ */ new Set();
+  for (const page of pages) {
+    for (const image of page.openGraph.images) {
+      const url = image.url.value.trim();
+      if (wantedUrl(url)) wanted.add(url);
+    }
+    for (const icon of page.links.icons) {
+      if (wantedUrl(icon.href)) wanted.add(icon.href);
+    }
+  }
+  if (wanted.size === 0) return;
+  const queue = [...wanted];
+  const probed = /* @__PURE__ */ new Map();
+  const workers = Math.min(options.concurrency ?? 6, queue.length);
+  await Promise.all(
+    Array.from({ length: workers }, async () => {
+      for (let url = queue.pop(); url !== void 0; url = queue.pop()) {
+        const probe = await probeAsset(url, {
+          signal: options.signal,
+          timeoutMs: options.timeoutMs
+        }).catch(() => void 0);
+        if (probe) probed.set(url, probe);
+      }
+    })
+  );
+  for (const page of pages) {
+    const mine = {};
+    for (const image of page.openGraph.images) {
+      const probe = probed.get(image.url.value.trim());
+      if (probe) mine[probe.url] = probe;
+    }
+    for (const icon of page.links.icons) {
+      const probe = probed.get(icon.href);
+      if (probe) mine[probe.url] = probe;
+    }
+    page.assets = mine;
+  }
+}
 function dropCanonicalDuplicates(pages) {
   const crawled = new Set(pages.map((p) => routeKey(p.fetch.finalUrl)));
   const kept = pages.filter((page) => {
@@ -3754,6 +5299,10 @@ async function runAudit(inputUrl, options = {}) {
     signal: options.signal,
     timeoutMs: options.timeoutMs
   }).catch(() => void 0);
+  const favicon = await probeFavicon(origin, {
+    signal: options.signal,
+    timeoutMs: options.timeoutMs
+  }).catch(() => void 0);
   const crawlResult = await crawl({
     entryUrl: entry,
     seedUrls: sitemapUrls,
@@ -3800,6 +5349,13 @@ async function runAudit(inputUrl, options = {}) {
       status: 0
     }))
   ];
+  await attachManifests(htmlPages, { signal: options.signal, timeoutMs: options.timeoutMs });
+  await probeAssets(htmlPages, {
+    origin,
+    checkExternal: options.checkExternal ?? true,
+    signal: options.signal,
+    timeoutMs: options.timeoutMs
+  });
   const seoIssues = [];
   const conformanceRows = [];
   const advisories = [];
@@ -3832,7 +5388,14 @@ async function runAudit(inputUrl, options = {}) {
         severity: issue.severity,
         message: issue.message,
         why: rule?.title,
-        fix: issue.fix?.snippet
+        fix: issue.fix?.snippet,
+        // The fingerprint above is unchanged on purpose: it keys on the rule,
+        // the route and the occurrence, so carrying more of the finding cannot
+        // move a baseline entry (`./diff.ts` matches on `id` alone).
+        rigor: issue.rigor,
+        sources: issue.sources,
+        observed: issue.observed,
+        expected: issue.expected
       });
     }
   }
@@ -3879,6 +5442,33 @@ async function runAudit(inputUrl, options = {}) {
     ),
     ...issue
   }));
+  const linkDiscovery = syntheticDiscovery(origin, entry, okPages, crawlResult.truncated);
+  const linkReport = await runLinkAudit(linkDiscovery, {
+    allowInsecureTls: options.allowInsecureTls,
+    checkExternal,
+    timeoutMs: options.timeoutMs,
+    maxPages: effectiveMaxPages,
+    signal: options.signal,
+    onProgress: (p) => options.onProgress?.({
+      phase: p.phase === "scan" ? "scan" : "links",
+      done: p.done,
+      total: p.total
+    })
+  });
+  warnings.push(...linkReport.diagnostics.warnings);
+  const sitemapEntries = discovery ? await probeSitemapEntries(
+    discovery.urls.map((entry2) => entry2.loc),
+    {
+      crawled: new Map(
+        crawlResult.pages.map((page) => [page.fetch.finalUrl, page.fetch.status])
+      ),
+      checked: new Map(Object.values(linkReport.checks).map((check) => [check.url, check])),
+      maxProbes: effectiveMaxPages,
+      signal: options.signal,
+      timeoutMs: options.timeoutMs,
+      allowInsecureTls: options.allowInsecureTls
+    }
+  ) : void 0;
   const siteContext = {
     origin,
     pages: htmlPages,
@@ -3886,6 +5476,8 @@ async function runAudit(inputUrl, options = {}) {
     localeAxis,
     discovery,
     robots,
+    favicon,
+    sitemapEntries,
     // Same index the matrix was built from, so a rule that groups by route
     // and the grid that reports holes cannot disagree about which URLs are
     // one page.
@@ -3904,23 +5496,11 @@ async function runAudit(inputUrl, options = {}) {
       severity: draft.severity,
       message: draft.message,
       why: rule?.summary,
-      fix: draft.fix?.snippet
+      fix: draft.fix?.snippet,
+      rigor: draft.rigor,
+      sources: draft.sources
     };
   });
-  const linkDiscovery = syntheticDiscovery(origin, entry, okPages, crawlResult.truncated);
-  const linkReport = await runLinkAudit(linkDiscovery, {
-    allowInsecureTls: options.allowInsecureTls,
-    checkExternal,
-    timeoutMs: options.timeoutMs,
-    maxPages: effectiveMaxPages,
-    signal: options.signal,
-    onProgress: (p) => options.onProgress?.({
-      phase: p.phase === "scan" ? "scan" : "links",
-      done: p.done,
-      total: p.total
-    })
-  });
-  warnings.push(...linkReport.diagnostics.warnings);
   const brokenLinks = [];
   for (const { pageUrl, broken } of linkReport.brokenByPage) {
     for (const check of broken) {
@@ -4410,7 +5990,8 @@ function rollupRows(issues, c) {
   const lines = [];
   for (const issue of issues) {
     const sev = issue.severity === "error" ? c(ANSI2.red, "error") : issue.severity === "warning" ? c(ANSI2.yellow, "warn ") : c(ANSI2.dim, "info ");
-    lines.push(`  ${sev} ${c(ANSI2.cyan, issue.ruleId)} ${c(ANSI2.dim, `\xD7${issue.count}`)}`);
+    const rigor = issue.rigor ? c(ANSI2.dim, ` [${issue.rigor}]`) : "";
+    lines.push(`  ${sev} ${c(ANSI2.cyan, issue.ruleId)}${rigor} ${c(ANSI2.dim, `\xD7${issue.count}`)}`);
     if (issue.why) lines.push(`    ${c(ANSI2.dim, stripBackticks2(issue.why))}`);
     if (issue.fix) {
       const [head, ...rest] = issue.fix.split("\n");
@@ -4489,6 +6070,7 @@ function rollupByRule(issues) {
       groups.set(issue.ruleId, {
         ruleId: issue.ruleId,
         severity: issue.severity,
+        rigor: issue.rigor,
         why: issue.why,
         fix: issue.fix,
         sample: issue.message,
@@ -4707,4 +6289,4 @@ export {
   summarize,
   Logger
 };
-//# sourceMappingURL=chunk-SKX7UCGC.js.map
+//# sourceMappingURL=chunk-DKGBLJ4H.js.map