@goflag/cli 0.2.8 → 0.2.9

package/dist/{chunk-SKX7UCGC.js → chunk-TAZEAIFI.js}

@@ -1311,10 +1311,77 @@ var TITLE_IDEAL = [10, 60];
 var TITLE_ACCEPTABLE = [5, 70];
 var DESC_IDEAL = [50, 160];
 var DESC_ACCEPTABLE = [25, 200];
+var RATIO_IDEAL = [1.7, 2.1];
+var RATIO_ACCEPTABLE = [1, 3];
 function tokens(value) {
   if (!value) return [];
   return value.split(",").map((t) => t.trim().toLowerCase()).filter(Boolean);
 }
+function isAbsoluteHttpUrl(value) {
+  try {
+    const url = new URL(value);
+    return url.protocol === "http:" || url.protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+function localeParts(tag) {
+  const subtags = tag.trim().toLowerCase().split(/[-_]/).filter(Boolean);
+  const language = subtags[0];
+  if (!language || !/^[a-z]{2,3}$/.test(language)) return void 0;
+  const region = subtags.slice(1).find((s) => /^([a-z]{2}|\d{3})$/.test(s));
+  return region ? { language, region } : { language };
+}
+function sameLocale(a, b) {
+  const left = localeParts(a);
+  const right = localeParts(b);
+  if (!left || !right || left.language !== right.language) return false;
+  return !left.region || !right.region || left.region === right.region;
+}
+function hreflangCluster(ex) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const annotation of ex.links.hreflang) {
+    if (annotation.isXDefault) continue;
+    const parts = localeParts(annotation.hreflang);
+    if (!parts) continue;
+    seen.add(parts.region ? `${parts.language}-${parts.region}` : parts.language);
+  }
+  return [...seen];
+}
+function describeAsset(status, contentType) {
+  if (status === 0) return "the request failed";
+  if (status >= 400 || status < 200) return `HTTP ${status}`;
+  return `HTTP ${status} with \`${contentType ?? "no content type"}\`, which is not an image`;
+}
+var ICON_RELS = /* @__PURE__ */ new Set([
+  "icon",
+  "shortcut icon",
+  "apple-touch-icon",
+  "apple-touch-icon-precomposed",
+  "mask-icon"
+]);
+var APPLE_ICON_RELS = /* @__PURE__ */ new Set(["apple-touch-icon", "apple-touch-icon-precomposed"]);
+function declaredIcons(ex) {
+  return ex.links.icons.filter((icon) => ICON_RELS.has(icon.rel.trim().toLowerCase()));
+}
+function normalise(value) {
+  return value.trim().toLowerCase().split(/\s+/).sort().join(" ");
+}
+function sameAsset(href, src) {
+  const pathOf = (value) => {
+    try {
+      return new URL(value, "https://goflag.invalid").pathname;
+    } catch {
+      return value.split("?")[0] ?? value;
+    }
+  };
+  return pathOf(href) === pathOf(src);
+}
+function hasOpenGraph(ex) {
+  return Boolean(
+    ex.openGraph.title?.value || ex.openGraph.images.length > 0 || ex.openGraph.url?.value
+  );
+}
 var titleMissing = {
   id: "title.missing",
   kind: "boolean",
@@ -1569,10 +1636,7 @@ var ogDescriptionMissing = {
   evaluate: (ex) => {
     const observed = ex.openGraph.description?.value?.trim();
     if (observed) return { status: "pass", observed };
-    const hasOtherOg = Boolean(
-      ex.openGraph.title?.value || ex.openGraph.images.length > 0 || ex.openGraph.url?.value
-    );
-    if (!hasOtherOg) return { status: "na", observed: null };
+    if (!hasOpenGraph(ex)) return { status: "na", observed: null };
     return {
       status: "fail",
       observed: null,
@@ -1616,6 +1680,476 @@ var ogImageMissing = {
     };
   }
 };
+var ogImageAbsolute = {
+  id: "og.image.absolute",
+  kind: "boolean",
+  category: "opengraph",
+  // The same severity as `og.image.missing`, deliberately: the unfurl is
+  // identical either way, and the registry should not rank the broken
+  // declaration above the absent one when their effect is the same.
+  severity: "warning",
+  title: "`og:image` must be an absolute URL",
+  why: "Unlike a browser, the crawler that builds the preview has no document to resolve a relative path against \u2014 it reads the tag, not the page. A relative `og:image` is therefore not a smaller mistake than a missing one: the unfurl is identical, and the tag makes it look handled.",
+  rigor: "vendor-spec",
+  sources: ["ogp", "meta-og-sharing"],
+  reads: ["openGraph.images"],
+  expected: "every `og:image` URL absolute, scheme included",
+  relates: ["og.image.missing", "canonical.absolute"],
+  fix: {
+    title: "Give Next a metadataBase, or write the origin in",
+    snippet: [
+      "// app/layout.tsx \u2014 every relative metadata URL resolves against this.",
+      "export const metadata = {",
+      "  metadataBase: new URL(process.env.SITE_ORIGIN!),",
+      '  openGraph: { images: ["/og.png"] }, // emitted absolute',
+      "};"
+    ].join("\n"),
+    language: "tsx"
+  },
+  evaluate: (ex) => {
+    if (ex.openGraph.images.length === 0) return { status: "na", observed: null };
+    const declarations = [];
+    for (const image of ex.openGraph.images) {
+      declarations.push({ property: "og:image", value: image.url.value.trim() });
+      if (image.secureUrl) {
+        declarations.push({
+          property: "og:image:secure_url",
+          value: image.secureUrl.value.trim()
+        });
+      }
+    }
+    const observed = declarations.map((d) => d.value);
+    const relative = declarations.filter((d) => !isAbsoluteHttpUrl(d.value));
+    if (relative.length === 0) return { status: "pass", observed };
+    return {
+      status: "fail",
+      observed,
+      message: `Open Graph image URL is not absolute: ${relative.map((d) => `\`${d.property}\` = \`${d.value}\``).join(", ")}. Crawlers cannot resolve it.`,
+      origin: { kind: "meta", property: relative[0].property }
+    };
+  }
+};
+var ogImageAlt = {
+  id: "og.image.alt",
+  kind: "boolean",
+  category: "opengraph",
+  severity: "warning",
+  title: "Describe the shared image with `og:image:alt`",
+  why: "The protocol defines `og:image:alt` as a description of what is in the image, and a generated card usually carries the page's title as pixels. Omitting it leaves that text sighted-only, in the one place a link is seen before anybody has opened the page. Optional in the vocabulary, which is why this is a guideline and not a spec violation.",
+  rigor: "guideline",
+  sources: ["ogp"],
+  reads: ["openGraph.images"],
+  expected: "an `og:image:alt` beside every `og:image`",
+  relates: ["og.image.missing"],
+  fix: {
+    title: "Carry the alt per image, not as a constant",
+    snippet: [
+      "// app/\u2026/opengraph-image.tsx \u2014 `export const alt` is one fixed string, so a",
+      "// translated or data-derived description has to go through the metadata fn.",
+      "export async function generateImageMetadata({ params }) {",
+      "  const t = await getTranslations({ locale: params.locale });",
+      '  return [{ id: "og", size, contentType, alt: t("og.alt") }];',
+      "}"
+    ].join("\n"),
+    language: "tsx"
+  },
+  evaluate: (ex) => {
+    if (ex.openGraph.images.length === 0) return { status: "na", observed: null };
+    const observed = ex.openGraph.images.map((image) => ({
+      url: image.url.value,
+      alt: image.alt?.value ?? null
+    }));
+    const undescribed = observed.filter((image) => !image.alt?.trim());
+    if (undescribed.length === 0) return { status: "pass", observed };
+    return {
+      status: "fail",
+      observed,
+      message: undescribed.length === observed.length ? "Page declares an `og:image` with no `og:image:alt`." : `${undescribed.length} of ${observed.length} \`og:image\` declarations have no \`og:image:alt\`.`,
+      origin: { kind: "meta", property: "og:image:alt" }
+    };
+  }
+};
+var ogImageDimensions = {
+  id: "og.image.dimensions",
+  kind: "boolean",
+  category: "opengraph",
+  severity: "warning",
+  title: "Declare `og:image:width` and `og:image:height`",
+  why: "A crawler that does not know the size cannot lay the card out until it has fetched the image, so the first share of a URL renders without it \u2014 the one share that matters most. The dimensions are the fix, and they cost two tags.",
+  rigor: "vendor-spec",
+  sources: ["ogp", "meta-og-sharing"],
+  reads: ["openGraph.images"],
+  expected: "both `og:image:width` and `og:image:height` on every image",
+  relates: ["og.image.missing", "og.image.ratio"],
+  fix: {
+    title: "Declare the size alongside the URL",
+    snippet: [
+      "// app/\u2026/page.tsx",
+      "export const metadata = {",
+      '  openGraph: { images: [{ url: "/og.png", width: 1200, height: 630 }] },',
+      "};",
+      "// The file convention emits both from `export const size` for free."
+    ].join("\n"),
+    language: "tsx"
+  },
+  evaluate: (ex) => {
+    if (ex.openGraph.images.length === 0) return { status: "na", observed: null };
+    const observed = ex.openGraph.images.map((image) => ({
+      url: image.url.value,
+      width: image.width?.value ?? null,
+      height: image.height?.value ?? null
+    }));
+    const incomplete = observed.filter((image) => image.width === null || image.height === null);
+    if (incomplete.length === 0) return { status: "pass", observed };
+    return {
+      status: "fail",
+      observed,
+      message: `${incomplete.length === observed.length ? "The" : `${incomplete.length} of ${observed.length}`} \`og:image\` declaration${incomplete.length === 1 ? "" : "s"} omit${incomplete.length === 1 ? "s" : ""} \`og:image:width\` or \`og:image:height\`.`,
+      origin: { kind: "meta", property: "og:image:width" }
+    };
+  }
+};
+var ogImageRatio = {
+  id: "og.image.ratio",
+  kind: "scored",
+  category: "opengraph",
+  title: "Keep the shared image near the 1.91:1 the card is laid out for",
+  why: "Meta's recommended 1200\xD7630 is a shape before it is a size. An image far from it is not rejected \u2014 it is cropped to fit, and the crop is chosen by the consumer rather than by you.",
+  rigor: "vendor-spec",
+  sources: ["meta-og-sharing", "x-cards"],
+  reads: ["openGraph.images"],
+  bands: { ideal: RATIO_IDEAL, acceptable: RATIO_ACCEPTABLE },
+  severityByBand: { acceptable: "info", poor: "warning" },
+  expected: `a width \xF7 height between ${RATIO_IDEAL[0]} and ${RATIO_IDEAL[1]} (1.91:1 is 1.9)`,
+  relates: ["og.image.dimensions"],
+  evaluate: (ex) => {
+    const measured = ex.openGraph.images.find((image) => image.width?.value && image.height?.value);
+    if (!measured) return { status: "na", observed: 0 };
+    const ratio = Math.round(measured.width.value / measured.height.value * 100) / 100;
+    const { status, band } = bandFor(ratio, { ideal: RATIO_IDEAL, acceptable: RATIO_ACCEPTABLE });
+    if (status === "pass") return { status, band, observed: ratio };
+    return {
+      status,
+      band,
+      observed: ratio,
+      message: `\`og:image\` is ${measured.width.value}\xD7${measured.height.value} \u2014 a ratio of ${ratio}:1, against the 1.91:1 the preview card is laid out for. Consumers will crop it.`,
+      origin: { kind: "meta", property: "og:image:width" }
+    };
+  }
+};
+var ogLocaleMissing = {
+  id: "og.locale.missing",
+  kind: "boolean",
+  category: "opengraph",
+  severity: "warning",
+  title: "A translated page has to say which locale it is in",
+  why: "`og:locale` defaults to `en_US` in the protocol itself \u2014 so a page that omits it does not decline to answer, it answers wrongly. On a site whose whole point is that the same page exists in several languages, every translation claims to be American English.",
+  rigor: "vendor-spec",
+  sources: ["ogp"],
+  reads: ["openGraph.locale", "links.hreflang"],
+  expected: "an `og:locale` on any page that declares hreflang alternates",
+  relates: ["og.locale.alternates", "hreflang.missing"],
+  fix: {
+    title: "Emit the locale in the page's own metadata",
+    snippet: [
+      "// app/[locale]/\u2026/page.tsx",
+      "export const metadata = {",
+      '  openGraph: { locale: "fr_FR", alternateLocale: ["en_US", "es_ES"] },',
+      "};"
+    ].join("\n"),
+    language: "tsx"
+  },
+  evaluate: (ex) => {
+    const cluster = hreflangCluster(ex);
+    const observed = ex.openGraph.locale?.value?.trim() ?? null;
+    if (cluster.length < 2 || !hasOpenGraph(ex)) return { status: "na", observed };
+    if (observed) return { status: "pass", observed };
+    return {
+      status: "fail",
+      observed: null,
+      message: `Page declares hreflang alternates (${cluster.join(", ")}) but no \`og:locale\`; the protocol default \`en_US\` applies instead.`,
+      origin: { kind: "meta", property: "og:locale" }
+    };
+  }
+};
+var ogLocaleAlternates = {
+  id: "og.locale.alternates",
+  kind: "boolean",
+  category: "opengraph",
+  severity: "warning",
+  title: "`og:locale:alternate` and the hreflang cluster must name the same locales",
+  why: "Two vocabularies describe the same fact \u2014 this page exists in these languages \u2014 and nothing in a build keeps them in step, so they drift silently. Whichever one is short is the one telling a consumer that a translation it could have linked to does not exist.",
+  rigor: "vendor-spec",
+  sources: ["ogp", "google-hreflang"],
+  reads: ["openGraph.locale", "openGraph.localeAlternates", "links.hreflang"],
+  expected: "one `og:locale:alternate` per hreflang locale other than this page's own",
+  relates: ["og.locale.missing", "hreflang.missing"],
+  fix: {
+    title: "Derive both lists from the same cluster",
+    snippet: [
+      "// The hreflang map and the OG locales are one fact stated twice.",
+      "openGraph: {",
+      "  locale: ogLocale(locale),",
+      "  alternateLocale: cluster.filter((l) => l !== locale).map(ogLocale),",
+      "},",
+      "alternates: { languages: cluster },"
+    ].join("\n"),
+    language: "ts"
+  },
+  evaluate: (ex) => {
+    const cluster = hreflangCluster(ex);
+    const own = ex.openGraph.locale?.value?.trim();
+    const declared = ex.openGraph.localeAlternates.map((a) => a.value.trim()).filter(Boolean);
+    const observed = { locale: own ?? null, alternates: declared, hreflang: cluster };
+    if (cluster.length < 2 || !own) return { status: "na", observed };
+    const missing = cluster.filter(
+      (tag) => !sameLocale(tag, own) && !declared.some((d) => sameLocale(d, tag))
+    );
+    const unbacked = declared.filter((d) => !cluster.some((tag) => sameLocale(tag, d)));
+    if (missing.length === 0 && unbacked.length === 0) return { status: "pass", observed };
+    const disagreements = [];
+    if (missing.length > 0) {
+      disagreements.push(`no \`og:locale:alternate\` for ${missing.join(", ")}`);
+    }
+    if (unbacked.length > 0) {
+      disagreements.push(`\`og:locale:alternate\` ${unbacked.join(", ")} has no hreflang`);
+    }
+    return {
+      status: "fail",
+      observed,
+      message: `Open Graph and hreflang disagree about this page's translations: ${disagreements.join("; ")}.`,
+      origin: { kind: "meta", property: "og:locale:alternate" }
+    };
+  }
+};
+var iconsMissing = {
+  id: "icons.missing",
+  kind: "boolean",
+  category: "icons",
+  severity: "warning",
+  title: "Declare an icon \u2014 the tab, the bookmark and the share sheet all read one",
+  why: "No specification requires an icon, which is exactly why nothing complains and every consumer improvises. A browser falls back to `/favicon.ico` at the root, a feed reader or a link unfurler often falls back to nothing, and a bookmark to a site with no icon is a grey square among fifty.",
+  rigor: "guideline",
+  sources: ["whatwg-html-link-types", "mdn-link-rel"],
+  reads: ["links.icons", "links.manifest"],
+  expected: 'at least one `<link rel="icon">`, or icons declared by a manifest',
+  relates: ["icons.apple-touch.missing", "icons.manifest-mismatch"],
+  fix: {
+    title: "Let the file convention declare it",
+    snippet: [
+      '// app/icon.svg (or icon.png) \u2014 Next emits the <link rel="icon"> itself.',
+      '// app/apple-icon.png likewise emits rel="apple-touch-icon".',
+      "// A /favicon.ico at the root is a separate matter: see icons.ico.missing."
+    ].join("\n"),
+    language: "tsx"
+  },
+  evaluate: (ex) => {
+    const head = declaredIcons(ex);
+    const fromManifest = ex.links.manifest?.icons ?? [];
+    const observed = {
+      head: head.map((icon) => ({ rel: icon.rel, href: icon.href })),
+      manifest: fromManifest.map((icon) => icon.src)
+    };
+    if (head.length > 0 || fromManifest.length > 0) return { status: "pass", observed };
+    return {
+      status: "fail",
+      observed,
+      message: 'Page declares no icon: no `<link rel="icon">`, and no icons from a manifest. Consumers fall back to `/favicon.ico` if the site happens to serve one.',
+      origin: { kind: "link", rel: "icon" }
+    };
+  }
+};
+var iconsAppleTouchMissing = {
+  id: "icons.apple-touch.missing",
+  kind: "boolean",
+  category: "icons",
+  severity: "info",
+  title: "Declare an `apple-touch-icon` for the iOS home screen",
+  why: 'iOS does not read `rel="icon"` for a home-screen shortcut. With no `apple-touch-icon` it screenshots the page instead, so what someone saved is a thumbnail of whatever was on screen when they saved it.',
+  rigor: "vendor-spec",
+  sources: ["apple-web-apps", "whatwg-html-link-types"],
+  reads: ["links.icons", "links.manifest"],
+  expected: 'a `<link rel="apple-touch-icon">`',
+  relates: ["icons.missing"],
+  evaluate: (ex) => {
+    const head = declaredIcons(ex);
+    if (head.length === 0) return { status: "na", observed: null };
+    const apple = head.filter((icon) => APPLE_ICON_RELS.has(icon.rel.trim().toLowerCase()));
+    const observed = head.map((icon) => icon.rel);
+    if (apple.length > 0) return { status: "pass", observed };
+    return {
+      status: "fail",
+      observed,
+      message: `Page declares icons (${observed.join(", ")}) but no \`apple-touch-icon\`; iOS will screenshot the page instead.`,
+      origin: { kind: "link", rel: "apple-touch-icon" }
+    };
+  }
+};
+var iconsManifestMismatch = {
+  id: "icons.manifest-mismatch",
+  kind: "boolean",
+  category: "icons",
+  severity: "info",
+  title: "The manifest and the `<head>` must not disagree about the same icon",
+  why: "Two files declare the icons, maintained by different hands, and nothing compares them. The failure worth naming is not that the two lists differ \u2014 they legitimately do, since an apple-touch-icon is not a manifest icon \u2014 but that they describe the *same file* differently, or that the icons exist only in the manifest, where a browser tab never looks.",
+  rigor: "guideline",
+  sources: ["w3c-appmanifest", "whatwg-html-link-types"],
+  reads: ["links.icons", "links.manifest"],
+  expected: "the same size and type wherever an icon is declared twice",
+  relates: ["icons.missing"],
+  evaluate: (ex) => {
+    const manifest = ex.links.manifest;
+    if (!manifest?.parsed || !manifest.icons || manifest.icons.length === 0) {
+      return { status: "na", observed: null };
+    }
+    const head = declaredIcons(ex);
+    const observed = {
+      head: head.map((icon) => ({ href: icon.href, sizes: icon.sizes ?? null })),
+      manifest: manifest.icons.map((icon) => ({ src: icon.src, sizes: icon.sizes ?? null }))
+    };
+    if (head.length === 0) {
+      return {
+        status: "fail",
+        observed,
+        message: `Manifest declares ${manifest.icons.length} icon(s) but the \`<head>\` declares none; a browser tab reads the \`<head>\`, not the manifest.`,
+        origin: { kind: "link", rel: "manifest" }
+      };
+    }
+    const disagreements = [];
+    for (const icon of manifest.icons) {
+      const twin = head.find((candidate) => sameAsset(candidate.href, icon.src));
+      if (!twin) continue;
+      if (icon.sizes && twin.sizes && normalise(icon.sizes) !== normalise(twin.sizes)) {
+        disagreements.push(
+          `\`${icon.src}\` is \`${twin.sizes}\` in the \`<head>\` and \`${icon.sizes}\` in the manifest`
+        );
+      }
+      if (icon.type && twin.type && icon.type.toLowerCase() !== twin.type.toLowerCase()) {
+        disagreements.push(
+          `\`${icon.src}\` is \`${twin.type}\` in the \`<head>\` and \`${icon.type}\` in the manifest`
+        );
+      }
+    }
+    if (disagreements.length === 0) return { status: "pass", observed };
+    return {
+      status: "fail",
+      observed,
+      message: `The manifest and the \`<head>\` describe the same icon differently: ${disagreements.join("; ")}.`,
+      origin: { kind: "link", rel: "manifest" }
+    };
+  }
+};
+var ogImageReachable = {
+  id: "og.image.reachable",
+  kind: "boolean",
+  category: "opengraph",
+  severity: "error",
+  title: "The URL in `og:image` has to answer with an image",
+  why: "Every other check on a preview image judges the tag. This one judges the file, and it is the only one that can catch the failure with no symptom: a URL that is present, well-formed, absolute \u2014 and dead. The card renders empty and nothing in the page says why. Found on this project's own documentation, where eleven pages pointed at a route a redirect had been swallowing since the day it was written.",
+  rigor: "vendor-spec",
+  sources: ["ogp", "meta-og-sharing"],
+  reads: ["openGraph.images", "assets"],
+  expected: "a 2xx image at every `og:image` URL",
+  relates: ["og.image.missing", "og.image.absolute"],
+  evaluate: (ex) => {
+    if (!ex.assets) return { status: "na", observed: null };
+    const probed = ex.openGraph.images.map((image) => ex.assets?.[image.url.value.trim()]).filter((probe) => probe !== void 0);
+    if (probed.length === 0) return { status: "na", observed: null };
+    const observed = probed.map((probe) => ({
+      status: probe.status,
+      contentType: probe.contentType ?? null
+    }));
+    const dead = probed.filter((probe) => !probe.ok);
+    if (dead.length === 0) return { status: "pass", observed };
+    return {
+      status: "fail",
+      observed,
+      message: `\`og:image\` does not serve an image: ${dead.map((probe) => describeAsset(probe.status, probe.contentType)).join("; ")}. The preview card will render without it.`,
+      origin: { kind: "meta", property: "og:image" }
+    };
+  }
+};
+var iconsUnreachable = {
+  id: "icons.unreachable",
+  kind: "boolean",
+  category: "icons",
+  severity: "warning",
+  title: "A declared icon has to answer with an image",
+  why: "An icon that 404s is worse than one never declared: the client asks, gets nothing, and has already skipped the `/favicon.ico` it would have fallen back to. The declaration is what took the fallback away.",
+  rigor: "vendor-spec",
+  sources: ["whatwg-html-link-types", "mdn-link-rel"],
+  reads: ["links.icons", "assets"],
+  expected: "a 2xx image at every declared icon URL",
+  relates: ["icons.missing", "icons.ico.missing"],
+  evaluate: (ex) => {
+    if (!ex.assets) return { status: "na", observed: null };
+    const probed = declaredIcons(ex).map((icon) => ({ icon, probe: ex.assets?.[icon.href] })).filter(
+      (pair) => Boolean(pair.probe)
+    );
+    if (probed.length === 0) return { status: "na", observed: null };
+    const observed = probed.map(({ icon, probe }) => ({
+      rel: icon.rel,
+      href: icon.href,
+      status: probe.status
+    }));
+    const dead = probed.filter(({ probe }) => !probe.ok);
+    if (dead.length === 0) return { status: "pass", observed };
+    return {
+      status: "fail",
+      observed,
+      message: `Declared icon does not serve an image: ${dead.map(
+        ({ icon, probe }) => `\`${icon.rel}\` \u2192 \`${icon.href}\` (${describeAsset(probe.status, probe.contentType)})`
+      ).join("; ")}.`,
+      origin: { kind: "link", rel: "icon" }
+    };
+  }
+};
+var iconsSizesMismatch = {
+  id: "icons.sizes-mismatch",
+  kind: "boolean",
+  category: "icons",
+  severity: "info",
+  title: "A `sizes` attribute must describe the file it points at",
+  why: "`sizes` is how a client picks one icon out of several without fetching them all, so a wrong value costs exactly what the attribute was there to save: the client downloads the file it was told to prefer and gets the wrong resolution. A half-true declaration is the common shape \u2014 a `.ico` carrying 16, 32 and 48 declared as `48x48` advertises one third of itself.",
+  rigor: "guideline",
+  sources: ["whatwg-html-link-types", "mdn-link-rel"],
+  reads: ["links.icons", "assets"],
+  expected: "`sizes` listing what the file actually contains",
+  relates: ["icons.unreachable"],
+  evaluate: (ex) => {
+    if (!ex.assets) return { status: "na", observed: null };
+    const comparable = declaredIcons(ex).map((icon) => ({ icon, probe: ex.assets?.[icon.href] })).filter(
+      (pair) => (
+        // Only where both sides said something. `any` declares no dimension
+        // to check, and a format goflag does not decode leaves `sizes`
+        // absent — which means unknown, and unknown is not a mismatch.
+        Boolean(pair.probe?.ok && pair.probe.sizes?.length) && pair.icon.parsedSizes.some((size) => size !== "any")
+      )
+    );
+    if (comparable.length === 0) return { status: "na", observed: null };
+    const observed = comparable.map(({ icon, probe }) => ({
+      href: icon.href,
+      declared: icon.sizes ?? null,
+      actual: (probe.sizes ?? []).map((size) => `${size.width}x${size.height}`)
+    }));
+    const wrong = observed.filter((entry) => {
+      const declared = new Set(
+        comparable.find((pair) => pair.icon.href === entry.href).icon.parsedSizes.filter((size) => size !== "any").map((size) => `${size.width}x${size.height}`)
+      );
+      const actual = new Set(entry.actual);
+      return declared.size !== actual.size || [...declared].some((size) => !actual.has(size));
+    });
+    if (wrong.length === 0) return { status: "pass", observed };
+    return {
+      status: "fail",
+      observed,
+      message: `\`sizes\` does not describe the file: ${wrong.map(
+        (entry) => `\`${entry.href}\` declares \`${entry.declared}\` and contains ${entry.actual.join(", ")}`
+      ).join("; ")}.`,
+      origin: { kind: "link", rel: "icon" }
+    };
+  }
+};
 var robotsConflict = {
   id: "robots.conflict",
   kind: "boolean",
@@ -1677,8 +2211,20 @@ var RULES = [
   canonicalMissing,
   descriptionLength,
   descriptionMissing,
+  iconsAppleTouchMissing,
+  iconsManifestMismatch,
+  iconsMissing,
+  iconsSizesMismatch,
+  iconsUnreachable,
   ogDescriptionMissing,
+  ogImageAbsolute,
+  ogImageAlt,
+  ogImageDimensions,
   ogImageMissing,
+  ogImageRatio,
+  ogImageReachable,
+  ogLocaleAlternates,
+  ogLocaleMissing,
   ogTitleMissing,
   robotsConflict,
   titleLength,
@@ -1720,11 +2266,44 @@ function openGraphFromPage(page) {
     other: og.unknown
   };
 }
+function optionalString(value) {
+  return typeof value === "string" && value.trim() ? value : void 0;
+}
+function manifestIcons(data) {
+  if (typeof data !== "object" || data === null) return [];
+  const raw = data.icons;
+  if (!Array.isArray(raw)) return [];
+  const icons = [];
+  for (const entry of raw) {
+    if (typeof entry !== "object" || entry === null) continue;
+    const { src, sizes, type, purpose } = entry;
+    const source = optionalString(src);
+    if (!source) continue;
+    icons.push({
+      src: source,
+      sizes: optionalString(sizes),
+      type: optionalString(type),
+      purpose: optionalString(purpose),
+      parsedSizes: parseSizes(optionalString(sizes))
+    });
+  }
+  return icons;
+}
+function manifestFromPage(page) {
+  const link = page.links.manifest;
+  if (!link) return void 0;
+  const probe = page.probes.manifest;
+  if (!probe) return { href: link.href };
+  if (!probe.found || probe.parseError !== void 0) {
+    return { href: link.href, parsed: false };
+  }
+  return { href: link.href, parsed: true, icons: manifestIcons(probe.data) };
+}
 function linksFromPage(page) {
   return {
     hreflang: page.links.alternates,
     icons: page.links.icons,
-    manifest: page.links.manifest ? { href: page.links.manifest.href } : void 0,
+    manifest: manifestFromPage(page),
     feeds: page.links.feeds.map(({ type, href, title }) => ({ type, href, title }))
   };
 }
@@ -1761,6 +2340,7 @@ function extractionFromPage(page) {
       keywords: page.meta.keywords
     },
     openGraph: openGraphFromPage(page),
+    ...page.assets ? { assets: page.assets } : {},
     twitter: {
       card: page.twitter.card,
       site: page.twitter.site,
@@ -2185,9 +2765,46 @@ var robotsBlocksSite = {
     });
   }
 };
+var iconsIcoMissing = {
+  id: "icons.ico.missing",
+  severity: "info",
+  summary: "Serve a `/favicon.ico` at the root for the clients that ask blind",
+  rigor: "guideline",
+  sources: ["whatwg-html-link-types", "mdn-link-rel"],
+  // Only judged when the probe actually ran. No probe means goflag did not
+  // look, and a rule that reported an absence it never checked for would be
+  // inventing a finding.
+  appliesTo: (site) => site.favicon !== void 0,
+  check: ({ site, issue }) => {
+    const probe = site.favicon;
+    if (!probe || probe.found) return [];
+    const detail = probe.status === 0 ? "the request failed outright" : probe.status >= 400 ? `the origin answered ${probe.status}` : `the origin answered ${probe.status} with \`${probe.contentType ?? "no content type"}\`, which is not an image \u2014 a catch-all route serving the app shell looks exactly like this`;
+    return issue({
+      pageUrl: probe.url,
+      message: `No \`/favicon.ico\` at the root: ${detail}. Clients that ask for it blind \u2014 feed readers, link unfurlers, older crawlers \u2014 get nothing.`,
+      origin: { kind: "computed" },
+      fix: {
+        title: "Generate it from the icon you already have",
+        snippet: [
+          "// No framework convention emits an .ico: Next's icon.tsx goes through",
+          "// ImageResponse, which is PNG. The container is a header plus one",
+          "// entry per size plus the PNGs concatenated \u2014 thirty lines and no",
+          "// dependency, over an image library you almost certainly already have.",
+          "//",
+          "// Fingerprint the *inputs* (the source image, the sizes), not the",
+          "// bytes you produce: encoders are not stable across versions, so a",
+          "// script keyed on its own output dirties the file on every commit.",
+          "// Then a --check mode can verify it in CI without writing anything."
+        ].join("\n"),
+        language: "ts"
+      }
+    });
+  }
+};
 var SITE_RULES = [
   hreflangMissing,
   hreflangSitemapMismatch,
+  iconsIcoMissing,
   robotsBlocksSite
 ];
 function getSiteRule(id) {
@@ -2594,7 +3211,7 @@ function relaxTlsIfRequested2(enabled) {
 }
 
 // src/lib/core/clusters.ts
-function normalise(raw) {
+function normalise2(raw) {
   let url;
   try {
     url = new URL(raw);
@@ -2613,7 +3230,7 @@ function indexOf(rows, conflicts, refused) {
   return {
     rows,
     routeOf: (url) => {
-      const key = normalise(url);
+      const key = normalise2(url);
       return key === null ? void 0 : rows.get(key);
     },
     size: clusterCount(rows),
@@ -2633,7 +3250,7 @@ function buildClusterIndex(entries) {
       refused++;
       continue;
     }
-    const anchorUrl = normalise(xDefault.href);
+    const anchorUrl = normalise2(xDefault.href);
     if (!anchorUrl) {
       refused++;
       continue;
@@ -2641,7 +3258,7 @@ function buildClusterIndex(entries) {
     const { route: anchorRoute } = splitRoute(new URL(anchorUrl).pathname);
     const members = [entry.loc, ...alternates.map((a) => a.href)];
     for (const member of members) {
-      const url = normalise(member);
+      const url = normalise2(member);
       if (!url) continue;
       const existing = rows.get(url);
       if (existing === void 0) {
@@ -2656,12 +3273,12 @@ function buildClusterIndex(entries) {
 function readHeads(pages) {
   const seen = /* @__PURE__ */ new Map();
   for (const page of pages) {
-    const self = normalise(page.fetch.finalUrl);
+    const self = normalise2(page.fetch.finalUrl);
     if (self === null || seen.has(self)) continue;
     const peers = /* @__PURE__ */ new Set();
     const xDefaults = /* @__PURE__ */ new Set();
     for (const alt of page.links.alternates) {
-      const href = normalise(alt.href);
+      const href = normalise2(alt.href);
       if (href === null) continue;
       if (alt.isXDefault) xDefaults.add(href);
       else if (href !== self) peers.add(href);
@@ -2826,6 +3443,98 @@ function selectByStructure(urls, options = {}) {
   };
 }
 
+// src/lib/core/probes/assets.ts
+var HEAD_BYTES = 8 * 1024;
+function isImageContentType(contentType) {
+  if (!contentType) return false;
+  return contentType.startsWith("image/") || contentType === "application/ico" || contentType === "application/x-ico";
+}
+async function probeAsset(url, options = {}) {
+  const { signal, cleanup } = combineSignals(options.signal, options.timeoutMs ?? 8e3);
+  try {
+    const res = await fetch(url, {
+      signal,
+      redirect: "follow",
+      headers: { range: `bytes=0-${HEAD_BYTES - 1}`, accept: "image/*,*/*;q=0.8" }
+    });
+    const contentType = res.headers.get("content-type")?.split(";")[0]?.trim().toLowerCase();
+    const served = res.status === 200 || res.status === 206;
+    const ok = served && isImageContentType(contentType);
+    const head = served ? await readHead(res) : void 0;
+    const sizes = head ? decodeSizes(head) : void 0;
+    return { url, status: res.status, ok, contentType, ...sizes ? { sizes } : {} };
+  } catch {
+    return { url, status: 0, ok: false };
+  } finally {
+    cleanup();
+  }
+}
+async function readHead(res) {
+  if (!res.body) return void 0;
+  const reader = res.body.getReader();
+  const chunks = [];
+  let total = 0;
+  try {
+    while (total < HEAD_BYTES) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      if (value) {
+        chunks.push(value);
+        total += value.byteLength;
+      }
+    }
+  } catch {
+    return chunks.length > 0 ? Buffer.concat(chunks) : void 0;
+  } finally {
+    await reader.cancel().catch(() => void 0);
+  }
+  return chunks.length > 0 ? Buffer.concat(chunks) : void 0;
+}
+var PNG_SIGNATURE = Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]);
+function decodeSizes(head) {
+  if (head.length >= 24 && head.subarray(0, 8).equals(PNG_SIGNATURE)) {
+    return [{ width: head.readUInt32BE(16), height: head.readUInt32BE(20) }];
+  }
+  if (head.length >= 6 && head.readUInt16LE(0) === 0 && head.readUInt16LE(2) === 1) {
+    const count2 = head.readUInt16LE(4);
+    if (count2 === 0 || head.length < 6 + 16 * count2) return void 0;
+    const sizes = [];
+    for (let index = 0; index < count2; index++) {
+      const at = 6 + 16 * index;
+      sizes.push({ width: head[at] || 256, height: head[at + 1] || 256 });
+    }
+    return sizes;
+  }
+  return void 0;
+}
+
+// src/lib/core/probes/favicon.ts
+async function probeFavicon(origin, options = {}) {
+  const url = new URL("/favicon.ico", origin).toString();
+  const { signal, cleanup } = combineSignals(options.signal, options.timeoutMs ?? 5e3);
+  try {
+    let res = await fetch(url, { method: "HEAD", signal, redirect: "follow" });
+    if (res.status === 405 || res.status === 501) {
+      res = await fetch(url, { signal, redirect: "follow" });
+    }
+    const contentType = res.headers.get("content-type")?.split(";")[0]?.trim().toLowerCase();
+    return {
+      url,
+      status: res.status,
+      found: res.ok && isIconType(contentType),
+      contentType
+    };
+  } catch {
+    return { url, status: 0, found: false };
+  } finally {
+    cleanup();
+  }
+}
+function isIconType(contentType) {
+  if (!contentType) return false;
+  return contentType.startsWith("image/") || contentType === "application/ico" || contentType === "application/x-ico";
+}
+
 // src/lib/rules/advisory.ts
 function resolveEvidencePath(extraction, path) {
   let current = extraction;
@@ -3493,6 +4202,18 @@ async function runLinkAudit(discovery, options = {}) {
     {
       concurrency: options.checkConcurrency ?? DEFAULTS3.checkConcurrency,
       perHost: options.maxPerHost ?? DEFAULTS3.maxPerHost,
+      // The origin is exempt, and the scan phase above is the precedent: it
+      // fetches these same pages at `scanConcurrency` with `perHost: Infinity`.
+      // Capping the check phase at 3 against that host made the two phases
+      // disagree about the same server, and on a deployed site it is where the
+      // audit spends itself: measured on openfinanceguide, 3821 same-origin
+      // links at ~700 ms a round trip, three at a time — 14.8 minutes of an
+      // 18.5-minute job. Against a local `--start` run the cap never binds,
+      // which is why the plan's own 7-minute figure held and CI's did not.
+      //
+      // `checkConcurrency` still bounds it: at most 8 in flight, where the scan
+      // phase already runs 4.
+      unlimitedHost: hostOf(discovery.origin),
       signal: options.signal
     },
     async (url) => {
@@ -3576,7 +4297,8 @@ function mapWithHostCaps(items, opts, worker, hostOf2) {
         let pickIndex = -1;
         for (let k = 0; k < pending.length; k++) {
           const entry = pending[k];
-          if ((hostActive.get(entry.host) ?? 0) < perHost) {
+          const cap = entry.host === opts.unlimitedHost ? Infinity : perHost;
+          if ((hostActive.get(entry.host) ?? 0) < cap) {
             pickIndex = k;
             break;
           }
@@ -3709,6 +4431,71 @@ function exitCode(report, failOn = "warning") {
   if (failOn === "error") return report.summary.verdict === "red" ? 1 : 0;
   return 1;
 }
+async function attachManifests(pages, options) {
+  const wanted = new Set(
+    pages.map((page) => page.links.manifest?.href).filter((href) => Boolean(href))
+  );
+  if (wanted.size === 0) return;
+  const probed = /* @__PURE__ */ new Map();
+  await Promise.all(
+    [...wanted].map(async (href) => {
+      const probe = await probeManifest(href, options).catch(() => void 0);
+      if (probe) probed.set(href, probe);
+    })
+  );
+  for (const page of pages) {
+    const href = page.links.manifest?.href;
+    const probe = href ? probed.get(href) : void 0;
+    if (probe) page.probes = { ...page.probes, manifest: probe };
+  }
+}
+async function probeAssets(pages, options) {
+  const sameOrigin = (url) => {
+    try {
+      return new URL(url).origin === new URL(options.origin).origin;
+    } catch {
+      return false;
+    }
+  };
+  const wantedUrl = (url) => /^https?:\/\//i.test(url) && (options.checkExternal || sameOrigin(url));
+  const wanted = /* @__PURE__ */ new Set();
+  for (const page of pages) {
+    for (const image of page.openGraph.images) {
+      const url = image.url.value.trim();
+      if (wantedUrl(url)) wanted.add(url);
+    }
+    for (const icon of page.links.icons) {
+      if (wantedUrl(icon.href)) wanted.add(icon.href);
+    }
+  }
+  if (wanted.size === 0) return;
+  const queue = [...wanted];
+  const probed = /* @__PURE__ */ new Map();
+  const workers = Math.min(options.concurrency ?? 6, queue.length);
+  await Promise.all(
+    Array.from({ length: workers }, async () => {
+      for (let url = queue.pop(); url !== void 0; url = queue.pop()) {
+        const probe = await probeAsset(url, {
+          signal: options.signal,
+          timeoutMs: options.timeoutMs
+        }).catch(() => void 0);
+        if (probe) probed.set(url, probe);
+      }
+    })
+  );
+  for (const page of pages) {
+    const mine = {};
+    for (const image of page.openGraph.images) {
+      const probe = probed.get(image.url.value.trim());
+      if (probe) mine[probe.url] = probe;
+    }
+    for (const icon of page.links.icons) {
+      const probe = probed.get(icon.href);
+      if (probe) mine[probe.url] = probe;
+    }
+    page.assets = mine;
+  }
+}
 function dropCanonicalDuplicates(pages) {
   const crawled = new Set(pages.map((p) => routeKey(p.fetch.finalUrl)));
   const kept = pages.filter((page) => {
@@ -3754,6 +4541,10 @@ async function runAudit(inputUrl, options = {}) {
     signal: options.signal,
     timeoutMs: options.timeoutMs
   }).catch(() => void 0);
+  const favicon = await probeFavicon(origin, {
+    signal: options.signal,
+    timeoutMs: options.timeoutMs
+  }).catch(() => void 0);
   const crawlResult = await crawl({
     entryUrl: entry,
     seedUrls: sitemapUrls,
@@ -3800,6 +4591,13 @@ async function runAudit(inputUrl, options = {}) {
       status: 0
     }))
   ];
+  await attachManifests(htmlPages, { signal: options.signal, timeoutMs: options.timeoutMs });
+  await probeAssets(htmlPages, {
+    origin,
+    checkExternal: options.checkExternal ?? true,
+    signal: options.signal,
+    timeoutMs: options.timeoutMs
+  });
   const seoIssues = [];
   const conformanceRows = [];
   const advisories = [];
@@ -3886,6 +4684,7 @@ async function runAudit(inputUrl, options = {}) {
     localeAxis,
     discovery,
     robots,
+    favicon,
     // Same index the matrix was built from, so a rule that groups by route
     // and the grid that reports holes cannot disagree about which URLs are
     // one page.
@@ -4707,4 +5506,4 @@ export {
   summarize,
   Logger
 };
-//# sourceMappingURL=chunk-SKX7UCGC.js.map
+//# sourceMappingURL=chunk-TAZEAIFI.js.map