@goflag/cli 0.2.9 → 0.2.10

package/dist/{chunk-TAZEAIFI.js → chunk-DKGBLJ4H.js}

@@ -816,53 +816,111 @@ async function probeManifest(href, options = {}) {
   }
 }
 
+// src/lib/core/robots/parse.ts
+var RULE_DIRECTIVES = /* @__PURE__ */ new Set(["allow", "disallow"]);
+var KNOWN_EXTENSIONS = /* @__PURE__ */ new Set(["crawl-delay", "host", "clean-param", "request-rate", "noindex"]);
+function parseRobots(body) {
+  const groups = [];
+  const sitemaps = [];
+  const invalidLines = [];
+  const unknownDirectives = [];
+  let current;
+  let currentTookRule = false;
+  const lines = body.split(/\r\n|\r|\n/);
+  for (const [index, rawLine] of lines.entries()) {
+    const line = index + 1;
+    const withoutComment = rawLine.replace(/#.*$/, "");
+    const trimmed = withoutComment.trim();
+    if (trimmed.length === 0) continue;
+    const separator = trimmed.indexOf(":");
+    if (separator === -1) {
+      invalidLines.push({ line, raw: rawLine, reason: "no `:` separator" });
+      continue;
+    }
+    const name = trimmed.slice(0, separator).trim().toLowerCase();
+    const value = trimmed.slice(separator + 1).trim();
+    if (name === "user-agent") {
+      if (value.length === 0) {
+        invalidLines.push({ line, raw: rawLine, reason: "empty `User-agent`" });
+        continue;
+      }
+      if (!current || currentTookRule) {
+        current = { userAgents: [], rules: [] };
+        groups.push(current);
+        currentTookRule = false;
+      }
+      current.userAgents.push({ value: value.toLowerCase(), line });
+      continue;
+    }
+    if (name === "sitemap") {
+      if (value.length === 0) {
+        invalidLines.push({ line, raw: rawLine, reason: "empty `Sitemap`" });
+        continue;
+      }
+      sitemaps.push({ value, line });
+      continue;
+    }
+    if (RULE_DIRECTIVES.has(name)) {
+      if (!current) {
+        invalidLines.push({
+          line,
+          raw: rawLine,
+          reason: `\`${name}\` before any \`User-agent\` group`
+        });
+        continue;
+      }
+      current.rules.push({ kind: name, pattern: value, line });
+      currentTookRule = true;
+      continue;
+    }
+    if (KNOWN_EXTENSIONS.has(name)) {
+      unknownDirectives.push({ name, line });
+      continue;
+    }
+    invalidLines.push({ line, raw: rawLine, reason: `unknown directive \`${name}\`` });
+  }
+  return { groups, sitemaps, invalidLines, unknownDirectives };
+}
+
 // src/lib/core/probes/robots.ts
 async function probeRobots(origin, options = {}) {
   const url = new URL("/robots.txt", origin).toString();
   const { signal, cleanup } = combineSignals(options.signal, options.timeoutMs ?? 5e3);
+  const empty = { groups: [], sitemaps: [], invalidLines: [], unknownDirectives: [] };
+  const noRedirect = { count: 0, finalUrl: url, crossOrigin: false };
   try {
     const res = await fetch(url, { signal, redirect: "follow" });
+    const redirected = res.url !== url;
+    const redirects = {
+      count: redirected ? 1 : 0,
+      finalUrl: res.url || url,
+      crossOrigin: redirected && !sameOrigin(res.url, url)
+    };
     if (!res.ok) {
-      return { url, status: res.status, found: false, sitemaps: [], blocksAll: false };
+      return { url, status: res.status, found: false, byteLength: 0, redirects, ...empty };
     }
-    const body = await res.text();
+    const raw = await res.text();
     return {
       url,
       status: res.status,
       found: true,
-      raw: body,
-      sitemaps: extractSitemaps(body),
-      blocksAll: blocksAllUserAgents(body)
+      raw,
+      byteLength: Buffer.byteLength(raw, "utf8"),
+      redirects,
+      ...parseRobots(raw)
     };
   } catch {
-    return { url, status: 0, found: false, sitemaps: [], blocksAll: false };
+    return { url, status: 0, found: false, byteLength: 0, redirects: noRedirect, ...empty };
   } finally {
     cleanup();
   }
 }
-function extractSitemaps(body) {
-  const out = [];
-  for (const line of body.split(/\r?\n/)) {
-    const m = /^\s*Sitemap:\s*(\S+)\s*$/i.exec(line);
-    if (m?.[1]) out.push(m[1]);
-  }
-  return out;
-}
-function blocksAllUserAgents(body) {
-  let inWildcard = false;
-  for (const rawLine of body.split(/\r?\n/)) {
-    const line = rawLine.replace(/#.*$/, "").trim();
-    if (line.length === 0) continue;
-    const ua = /^User-agent:\s*(.+)$/i.exec(line);
-    if (ua) {
-      inWildcard = ua[1].trim() === "*";
-      continue;
-    }
-    if (!inWildcard) continue;
-    const dis = /^Disallow:\s*(.*)$/i.exec(line);
-    if (dis && dis[1].trim() === "/") return true;
+function sameOrigin(a, b) {
+  try {
+    return new URL(a).origin === new URL(b).origin;
+  } catch {
+    return true;
   }
-  return false;
 }
 
 // src/lib/core/probes/sitemap.ts
@@ -1293,7 +1351,14 @@ function findingsToIssues(result, rules) {
       severity: finding.severity ?? "info",
       message: finding.message ?? `Expected ${finding.expected}.`,
       origin: finding.origin,
-      fix: byId.get(finding.ruleId)?.fix
+      fix: byId.get(finding.ruleId)?.fix,
+      // The finding has known all four since it was evaluated; this is where
+      // they used to stop. A report that drops the rigor asks every consumer
+      // to re-derive it from a registry it does not have.
+      rigor: finding.rigor,
+      sources: finding.sources,
+      observed: finding.observed,
+      expected: finding.expected
     });
   }
   for (const crash of result.crashes) {
@@ -2594,6 +2659,70 @@ function sortLocales(locales) {
   return [...xDefault, ...rest];
 }
 
+// src/lib/core/robots/match.ts
+function robotsAllows(groups, path, userAgent = "*") {
+  const group = selectGroup(groups, userAgent);
+  if (!group) return { allowed: true };
+  const token = group.userAgents[0]?.value ?? "*";
+  let best;
+  let bestLength = -1;
+  for (const rule of group.rules) {
+    if (rule.pattern.length === 0) continue;
+    if (!patternMatches(rule.pattern, path)) continue;
+    const length = octetLength(rule.pattern);
+    if (length > bestLength) {
+      best = rule;
+      bestLength = length;
+      continue;
+    }
+    if (length === bestLength && rule.kind === "allow") best = rule;
+  }
+  if (!best) return { allowed: true, group: token };
+  return { allowed: best.kind === "allow", rule: best, group: token };
+}
+function selectGroup(groups, userAgent) {
+  const wanted = userAgent.trim().toLowerCase();
+  let bestToken;
+  for (const group of groups) {
+    for (const agent of group.userAgents) {
+      if (agent.value === "*") continue;
+      if (!wanted.startsWith(agent.value)) continue;
+      if (bestToken === void 0 || agent.value.length > bestToken.length) {
+        bestToken = agent.value;
+      }
+    }
+  }
+  const token = bestToken ?? "*";
+  const matching = groups.filter(
+    (group) => group.userAgents.some((agent) => agent.value === token)
+  );
+  if (matching.length === 0) return void 0;
+  if (matching.length === 1) return matching[0];
+  return {
+    userAgents: matching.flatMap((group) => group.userAgents),
+    rules: matching.flatMap((group) => group.rules)
+  };
+}
+function patternMatches(pattern, path) {
+  const anchored = pattern.endsWith("$");
+  const body = anchored ? pattern.slice(0, -1) : pattern;
+  const source = body.split("*").map((literal) => escapeRegExp(normalizeOctets(literal))).join(".*");
+  return new RegExp(`^${source}${anchored ? "$" : ""}`).test(normalizeOctets(path));
+}
+function normalizeOctets(value) {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return value;
+  }
+}
+function octetLength(pattern) {
+  return Buffer.byteLength(normalizeOctets(pattern), "utf8");
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
 // src/lib/rules/site-rules.ts
 function isMultilingual(site) {
   return site.localeAxis.multilingual;
@@ -2735,7 +2864,9 @@ var robotsBlocksSite = {
   id: "robots.blocks-site",
   severity: "error",
   summary: "`robots.txt` must not forbid crawling a site that asks to be indexed",
-  appliesTo: (site) => site.robots?.found === true && site.robots.blocksAll,
+  rigor: "vendor-spec",
+  sources: ["ietf-rfc9309", "google-robots-intro"],
+  appliesTo: (site) => site.robots?.found === true && !robotsAllows(site.robots.groups, "/").allowed,
   check: ({ site, issue }) => {
     const robotsUrl = site.robots?.url ?? `${site.origin}/robots.txt`;
     const asking = site.pages.filter((page) => metaRobotsTokens(page).has("index"));
@@ -2801,75 +2932,653 @@ var iconsIcoMissing = {
     });
   }
 };
-var SITE_RULES = [
-  hreflangMissing,
-  hreflangSitemapMismatch,
-  iconsIcoMissing,
-  robotsBlocksSite
-];
-function getSiteRule(id) {
-  return SITE_RULES.find((rule) => rule.id === id);
+var ROBOTS_BYTE_LIMIT = 500 * 1024;
+var robotstxtUnreachable = {
+  id: "robotstxt.unreachable",
+  severity: "error",
+  summary: "A robots.txt that errors is read as forbidding the whole site",
+  rigor: "spec-required",
+  sources: ["ietf-rfc9309"],
+  // A 404 is not a failure: §2.3.1.3 says an absent file allows everything,
+  // and most sites that have none mean exactly that. Only a server that
+  // answered badly, or did not answer, triggers the disallow-everything rule.
+  appliesTo: (site) => site.robots !== void 0 && isRobotsFailure(site.robots.status),
+  check: ({ site, issue }) => {
+    const probe = site.robots;
+    const detail = probe.status === 0 ? "the request failed" : `the origin answered ${probe.status}`;
+    return issue({
+      pageUrl: probe.url,
+      message: `\`robots.txt\` could not be read: ${detail}. RFC 9309 \xA72.3.1.4 tells a crawler to assume a complete disallow for as long as this lasts \u2014 an outage on this one file takes the whole site out of the index.`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+var robotstxtOversized = {
+  id: "robotstxt.oversized",
+  severity: "error",
+  summary: "Rules past 500 KiB of robots.txt are not guaranteed to be read",
+  rigor: "spec-required",
+  sources: ["ietf-rfc9309"],
+  appliesTo: (site) => (site.robots?.byteLength ?? 0) > ROBOTS_BYTE_LIMIT,
+  check: ({ site, issue }) => {
+    const probe = site.robots;
+    const kib = Math.round(probe.byteLength / 1024);
+    return issue({
+      pageUrl: probe.url,
+      message: `\`robots.txt\` is ${kib} KiB. A parser is only required to honour the first 500 KiB (RFC 9309 \xA72.4), so every rule past that point silently does not exist.`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+var robotstxtInvalidLine = {
+  id: "robotstxt.invalid-line",
+  severity: "warning",
+  summary: "Every line of robots.txt should parse as something",
+  rigor: "spec-required",
+  sources: ["ietf-rfc9309"],
+  appliesTo: (site) => (site.robots?.invalidLines.length ?? 0) > 0,
+  check: ({ site, issue }) => {
+    const probe = site.robots;
+    const shown = probe.invalidLines.slice(0, 5);
+    const rest = probe.invalidLines.length - shown.length;
+    return issue({
+      pageUrl: probe.url,
+      message: `\`robots.txt\` has ${probe.invalidLines.length} line${probe.invalidLines.length === 1 ? "" : "s"} that parse as nothing: ` + shown.map((l) => `line ${l.line} (${l.reason})`).join(", ") + `${rest > 0 ? `, and ${rest} more` : ""}. A crawler drops them silently, so the rule you meant to write is simply absent.`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+var robotstxtUnknownDirective = {
+  id: "robotstxt.unknown-directive",
+  severity: "info",
+  summary: "Non-standard robots.txt directives are read by some crawlers and ignored by others",
+  rigor: "guideline",
+  sources: ["ietf-rfc9309", "google-robots-intro"],
+  appliesTo: (site) => (site.robots?.unknownDirectives.length ?? 0) > 0,
+  check: ({ site, issue }) => {
+    const probe = site.robots;
+    const names = [...new Set(probe.unknownDirectives.map((d) => d.name))];
+    return issue({
+      pageUrl: probe.url,
+      message: `\`robots.txt\` uses ${names.map((n) => `\`${n}\``).join(", ")}, which RFC 9309 does not define. Some crawlers honour ${names.length === 1 ? "it" : "them"} and Google ignores ${names.length === 1 ? "it" : "them"} \u2014 so this is worth knowing, not necessarily worth changing.`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+var robotstxtCrossOrigin = {
+  id: "robotstxt.cross-origin",
+  severity: "warning",
+  summary: "`/robots.txt` should not redirect to another origin",
+  rigor: "vendor-spec",
+  sources: ["ietf-rfc9309"],
+  appliesTo: (site) => site.robots?.redirects.crossOrigin === true,
+  check: ({ site, issue }) => {
+    const probe = site.robots;
+    return issue({
+      pageUrl: probe.url,
+      message: `\`robots.txt\` redirects to \`${probe.redirects.finalUrl}\`, on another origin. RFC 9309 \xA72.3.1.2 permits following it, so this works \u2014 but the policy for this site now lives somewhere this site does not control, and it is usually a proxy accident rather than a decision.`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+var robotstxtSitemapRelative = {
+  id: "robotstxt.sitemap.relative",
+  severity: "error",
+  summary: "A `Sitemap:` declaration must be an absolute URL",
+  rigor: "spec-required",
+  sources: ["sitemaps-protocol", "ietf-rfc9309"],
+  appliesTo: (site) => (site.robots?.sitemaps ?? []).some((s) => !isAbsolute(s.value)),
+  check: ({ site, issue }) => {
+    const probe = site.robots;
+    const relative = probe.sitemaps.filter((s) => !isAbsolute(s.value));
+    return issue({
+      pageUrl: probe.url,
+      message: `\`Sitemap:\` must be a full URL: ${relative.map((s) => `line ${s.line} declares \`${s.value}\``).join(", ")}. robots.txt is fetched on its own, so there is no page for a consumer to resolve a relative path against.`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+var robotsBlocksPage = {
+  id: "robots.blocks-page",
+  severity: "error",
+  summary: "A page asking to be indexed must not be disallowed by robots.txt",
+  rigor: "vendor-spec",
+  sources: ["ietf-rfc9309", "google-robots-intro"],
+  appliesTo: (site) => site.robots?.found === true && robotsAllows(site.robots.groups, "/").allowed,
+  check: ({ site, issue }) => {
+    const probe = site.robots;
+    return site.pages.flatMap((page) => {
+      if (!metaRobotsTokens(page).has("index")) return [];
+      let path;
+      try {
+        const url = new URL(page.fetch.finalUrl);
+        path = `${url.pathname}${url.search}`;
+      } catch {
+        return [];
+      }
+      const decision = robotsAllows(probe.groups, path);
+      if (decision.allowed || !decision.rule) return [];
+      return issue({
+        pageUrl: page.fetch.finalUrl,
+        message: `Page declares \`<meta name="robots" content="index">\` but \`robots.txt\` line ${decision.rule.line} disallows \`${decision.rule.pattern}\` for \`${decision.group}\`. robots.txt wins: the page is never fetched, so the tag asking for it is never read.`,
+        origin: { kind: "computed" }
+      });
+    });
+  }
+};
+var CHANGEFREQ = /* @__PURE__ */ new Set(["always", "hourly", "daily", "weekly", "monthly", "yearly", "never"]);
+var SAMPLE = 5;
+function sample(locs) {
+  const shown = locs.slice(0, SAMPLE);
+  const rest = locs.length - shown.length;
+  return `${shown.map((l) => `\`${l}\``).join(", ")}${rest > 0 ? `, and ${rest} more` : ""}`;
+}
+var sitemapMissing = {
+  id: "sitemap.missing",
+  severity: "warning",
+  summary: "A site should publish a sitemap",
+  rigor: "guideline",
+  sources: ["sitemaps-protocol", "google-sitemaps"],
+  // A warning rather than an error, and the plan settles it: a small, fully
+  // linked site genuinely may not need one. Google's own guidance says
+  // "usually worth having", which is exactly a guideline.
+  appliesTo: (site) => site.discovery !== void 0 && !site.discovery.diagnostics.found,
+  check: ({ site, issue }) => issue({
+    pageUrl: `${site.origin}/sitemap.xml`,
+    message: "No sitemap was found \u2014 not declared in `robots.txt`, and not at a well-known path. Discovery then depends entirely on what links to what, which is the part of a site nobody audits.",
+    origin: { kind: "computed" }
+  })
+};
+var sitemapUnparsable = {
+  id: "sitemap.unparsable",
+  severity: "error",
+  summary: "A located sitemap must be a well-formed `<urlset>` or `<sitemapindex>`",
+  rigor: "spec-required",
+  sources: ["sitemaps-protocol"],
+  appliesTo: (site) => site.discovery?.diagnostics.found === true && !site.discovery.diagnostics.wellFormed,
+  check: ({ site, issue }) => {
+    const diagnostics = site.discovery.diagnostics;
+    return issue({
+      pageUrl: diagnostics.sitemapUrl ?? `${site.origin}/sitemap.xml`,
+      message: "A sitemap was served but does not parse as XML. The usual cause is an HTML error page answered with a 200 \u2014 which reads as a healthy sitemap to anything that only checks the status.",
+      origin: { kind: "computed" }
+    });
+  }
+};
+var sitemapEmpty = {
+  id: "sitemap.empty",
+  severity: "warning",
+  summary: "A sitemap that parses should list something",
+  rigor: "guideline",
+  sources: ["sitemaps-protocol"],
+  // Only when the crawl found pages: an empty sitemap on a site with no pages
+  // is consistent, and saying otherwise would be noise.
+  appliesTo: (site) => site.discovery?.diagnostics.wellFormed === true && site.discovery.urls.length === 0 && site.pages.length > 0,
+  check: ({ site, issue }) => {
+    const diagnostics = site.discovery.diagnostics;
+    return issue({
+      pageUrl: diagnostics.sitemapUrl ?? `${site.origin}/sitemap.xml`,
+      message: `The sitemap parses and lists no URLs, while the crawl found ${site.pages.length}. goflag falls back to crawling \u2014 a consumer that trusts the sitemap has nothing to read.`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+var sitemapIndexChildError = {
+  id: "sitemap.index.child-error",
+  severity: "error",
+  summary: "Every child of a sitemap index must be reachable and parseable",
+  rigor: "spec-required",
+  sources: ["sitemaps-protocol"],
+  appliesTo: (site) => (site.discovery?.diagnostics.childSitemapErrors ?? 0) > 0,
+  check: ({ site, issue }) => {
+    const diagnostics = site.discovery.diagnostics;
+    const total = diagnostics.childSitemapCount;
+    return issue({
+      pageUrl: diagnostics.sitemapUrl ?? `${site.origin}/sitemap.xml`,
+      message: `${diagnostics.childSitemapErrors} of ${total} child sitemaps could not be read. The index declares an inventory and part of it is missing, so whatever those documents listed is invisible \u2014 and nothing says how much that is.`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+var sitemapEntryInvalidUrl = {
+  id: "sitemap.entry.invalid-url",
+  severity: "error",
+  summary: "Every `<loc>` must be an absolute, parseable URL",
+  rigor: "spec-required",
+  sources: ["sitemaps-protocol"],
+  appliesTo: (site) => (site.discovery?.urls ?? []).some((entry) => !isAbsolute(entry.loc)),
+  check: ({ site, issue }) => {
+    const bad = site.discovery.urls.filter((entry) => !isAbsolute(entry.loc));
+    return issue({
+      pageUrl: site.discovery.diagnostics.sitemapUrl ?? `${site.origin}/sitemap.xml`,
+      message: `${bad.length} \`<loc>\` value${bad.length === 1 ? " is" : "s are"} not an absolute URL: ${sample(bad.map((e) => e.loc))}. A sitemap is fetched on its own, so a consumer has nothing to resolve them against.`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+var sitemapEntryCrossHost = {
+  id: "sitemap.entry.cross-host",
+  severity: "error",
+  summary: "A sitemap should only list URLs on its own host",
+  rigor: "spec-required",
+  sources: ["sitemaps-protocol"],
+  // `www` and the apex are different hosts to a consumer, which is the case
+  // this actually catches: a sitemap generated against one and served on the
+  // other. The cross-submission escape hatch needs the other host's robots.txt
+  // and arrives with the cross-artefact rules.
+  appliesTo: (site) => crossHostEntries(site).length > 0,
+  check: ({ site, issue }) => {
+    const bad = crossHostEntries(site);
+    return issue({
+      pageUrl: site.discovery.diagnostics.sitemapUrl ?? `${site.origin}/sitemap.xml`,
+      message: `${bad.length} entr${bad.length === 1 ? "y names a host" : "ies name hosts"} other than this sitemap's: ${sample(bad)}. A consumer may drop them \u2014 the sitemap only speaks for the host that serves it.`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+var sitemapEntryProtocolMismatch = {
+  id: "sitemap.entry.protocol-mismatch",
+  severity: "warning",
+  summary: "A sitemap should not mix `http` and `https` entries",
+  rigor: "spec-required",
+  sources: ["sitemaps-protocol"],
+  appliesTo: (site) => protocolsIn(site).size > 1,
+  check: ({ site, issue }) => {
+    const protocols = [...protocolsIn(site)].sort();
+    return issue({
+      pageUrl: site.discovery.diagnostics.sitemapUrl ?? `${site.origin}/sitemap.xml`,
+      message: `The sitemap lists both ${protocols.join(" and ")} URLs. One of the two sets names pages the site does not serve at those addresses, and a consumer has no way to tell which.`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+var sitemapLastmodInvalid = {
+  id: "sitemap.lastmod.invalid",
+  severity: "warning",
+  summary: "`<lastmod>` must be a W3C Datetime, and must not be in the future",
+  rigor: "spec-required",
+  sources: ["sitemaps-protocol", "google-sitemaps"],
+  appliesTo: (site) => badLastmods(site).length > 0,
+  check: ({ site, issue }) => {
+    const bad = badLastmods(site);
+    const malformed = bad.filter((e) => e.reason === "malformed");
+    const future = bad.filter((e) => e.reason === "future");
+    const parts = [];
+    if (malformed.length > 0) {
+      parts.push(
+        `${malformed.length} not a W3C Datetime (${sample(malformed.map((e) => e.value))})`
+      );
+    }
+    if (future.length > 0) {
+      parts.push(`${future.length} dated in the future (${sample(future.map((e) => e.value))})`);
+    }
+    return issue({
+      pageUrl: site.discovery.diagnostics.sitemapUrl ?? `${site.origin}/sitemap.xml`,
+      message: `\`<lastmod>\` values a consumer cannot use: ${parts.join("; ")}. Google ignores the field entirely when it stops trusting it, so one bad batch costs the whole site the signal.`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+var sitemapFieldInvalid = {
+  id: "sitemap.field.invalid",
+  severity: "warning",
+  summary: "`<changefreq>` and `<priority>` must hold the values the protocol defines",
+  rigor: "spec-required",
+  sources: ["sitemaps-protocol", "google-sitemaps"],
+  appliesTo: (site) => badFields(site).length > 0,
+  check: ({ site, issue }) => {
+    const bad = badFields(site);
+    return issue({
+      pageUrl: site.discovery.diagnostics.sitemapUrl ?? `${site.origin}/sitemap.xml`,
+      message: `${bad.length} entr${bad.length === 1 ? "y carries a field" : "ies carry fields"} outside the protocol's values: ${sample(bad)}. Google ignores both fields either way \u2014 so this is worth fixing or deleting, never worth trusting.`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+function sitemapHost(site) {
+  const url = site.discovery?.diagnostics.sitemapUrl;
+  try {
+    return url ? new URL(url).host : new URL(site.origin).host;
+  } catch {
+    return void 0;
+  }
 }
-
-// src/lib/core/lint-site.ts
-function lintSite(site, rules = SITE_RULES) {
-  const drafts = [];
-  for (const rule of rules) {
-    if (rule.appliesTo && !rule.appliesTo(site)) continue;
-    let result;
+function crossHostEntries(site) {
+  const host = sitemapHost(site);
+  if (!host) return [];
+  return (site.discovery?.urls ?? []).filter((entry) => {
+    if (!isAbsolute(entry.loc)) return false;
     try {
-      result = rule.check({
-        site,
-        issue: (input) => ({
-          ruleId: rule.id,
-          severity: input.severity ?? rule.severity,
-          message: input.message,
-          origin: input.origin,
-          fix: input.fix,
-          suggestion: input.suggestion,
-          pageUrl: input.pageUrl
-        })
-      });
-    } catch (err) {
-      drafts.push({
-        ruleId: "engine.site-rule-crashed",
-        severity: "info",
-        message: `Site rule \`${rule.id}\` threw: ${err instanceof Error ? err.message : String(err)}`,
-        pageUrl: site.origin
-      });
+      return new URL(entry.loc).host !== host;
+    } catch {
+      return false;
+    }
+  }).map((entry) => entry.loc);
+}
+function protocolsIn(site) {
+  const protocols = /* @__PURE__ */ new Set();
+  for (const entry of site.discovery?.urls ?? []) {
+    try {
+      protocols.add(new URL(entry.loc).protocol.replace(":", ""));
+    } catch {
       continue;
     }
-    if (!result) continue;
-    if (Array.isArray(result)) drafts.push(...result);
-    else drafts.push(result);
   }
-  return sortSiteIssues(drafts);
+  return protocols;
 }
-function sortSiteIssues(drafts) {
-  const byPage = [...drafts].sort((a, b) => a.pageUrl.localeCompare(b.pageUrl));
-  return sortIssues(byPage);
+var W3C_DATETIME = /^\d{4}(-\d{2}(-\d{2}(T\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]\d{2}:\d{2}))?)?)?$/;
+function badLastmods(site) {
+  const out = [];
+  const tomorrow = Date.now() + 24 * 60 * 60 * 1e3;
+  for (const entry of site.discovery?.urls ?? []) {
+    const value = entry.lastmod?.trim();
+    if (!value) continue;
+    if (!W3C_DATETIME.test(value)) {
+      out.push({ value, reason: "malformed" });
+      continue;
+    }
+    const parsed = Date.parse(value);
+    if (Number.isFinite(parsed) && parsed > tomorrow) out.push({ value, reason: "future" });
+  }
+  return out;
 }
-
-// src/lib/core/locales.ts
-function localePrefixOf(url) {
-  let pathname;
+function badFields(site) {
+  const out = [];
+  for (const entry of site.discovery?.urls ?? []) {
+    const changefreq = entry.changefreq?.trim().toLowerCase();
+    if (changefreq && !CHANGEFREQ.has(changefreq)) {
+      out.push(`${entry.loc} \u2014 changefreq \`${entry.changefreq}\``);
+      continue;
+    }
+    const priority = entry.priority?.trim();
+    if (priority === void 0) continue;
+    const value = Number(priority);
+    if (!Number.isFinite(value) || value < 0 || value > 1) {
+      out.push(`${entry.loc} \u2014 priority \`${entry.priority}\``);
+    }
+  }
+  return out;
+}
+function sameUrlKey(url) {
   try {
-    pathname = new URL(url).pathname;
+    const parsed = new URL(url);
+    parsed.hash = "";
+    const path = parsed.pathname.replace(/\/+$/, "");
+    return `${parsed.origin}${path || "/"}${parsed.search}`;
   } catch {
-    return null;
+    return void 0;
   }
-  const first = pathname.split("/").filter(Boolean)[0];
-  if (first && looksLikeLocaleSegment(first)) return first.toLowerCase();
-  return null;
 }
-function prefixesIn(urls) {
-  const out = /* @__PURE__ */ new Set();
-  for (const url of urls ?? []) {
-    const locale = localePrefixOf(url);
-    if (locale) out.add(locale);
+function pagesByUrl(site) {
+  const byUrl = /* @__PURE__ */ new Map();
+  for (const page of site.pages) {
+    const key = sameUrlKey(page.fetch.finalUrl);
+    if (key) byUrl.set(key, page);
   }
-  out.delete("x-default");
-  return out;
+  return byUrl;
+}
+function saysNoindex(page) {
+  if (metaRobotsTokens(page).has("noindex")) return true;
+  const header = page.fetch.headers["x-robots-tag"] ?? "";
+  return header.split(",").map((token) => token.trim().toLowerCase()).includes("noindex");
+}
+var sitemapEntryBlockedByRobots = {
+  id: "sitemap.entry.blocked-by-robots",
+  severity: "error",
+  summary: "A sitemap must not list URLs that robots.txt forbids fetching",
+  rigor: "vendor-spec",
+  sources: ["ietf-rfc9309", "sitemaps-protocol"],
+  // Skipped when the whole origin is disallowed: `robots.blocks-site` is that
+  // finding, and repeating it once per sitemap entry would bury it.
+  appliesTo: (site) => site.robots?.found === true && robotsAllows(site.robots.groups, "/").allowed && (site.discovery?.urls.length ?? 0) > 0,
+  check: ({ site, issue }) => {
+    const probe = site.robots;
+    const blocked = [];
+    for (const entry of site.discovery.urls) {
+      let path;
+      try {
+        const url = new URL(entry.loc);
+        path = `${url.pathname}${url.search}`;
+      } catch {
+        continue;
+      }
+      if (!robotsAllows(probe.groups, path).allowed) blocked.push(entry.loc);
+    }
+    if (blocked.length === 0) return [];
+    return issue({
+      pageUrl: site.discovery.diagnostics.sitemapUrl ?? `${site.origin}/sitemap.xml`,
+      message: `${blocked.length} sitemap entr${blocked.length === 1 ? "y is" : "ies are"} disallowed by \`robots.txt\`: ${sample(blocked)}. The sitemap says "index this" and robots.txt says "never fetch it" \u2014 both cannot hold, and robots.txt is the one that decides.`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+var sitemapEntryNoindex = {
+  id: "sitemap.entry.noindex",
+  severity: "warning",
+  summary: "A sitemap must not list URLs that ask not to be indexed",
+  rigor: "vendor-spec",
+  sources: ["sitemaps-protocol", "google-robots-meta"],
+  // Only the crawled pages can be judged: a sitemap entry goflag never fetched
+  // has no `noindex` to have seen, and assuming one either way would invent a
+  // finding or hide one.
+  appliesTo: (site) => (site.discovery?.urls.length ?? 0) > 0,
+  check: ({ site, issue }) => {
+    const byUrl = pagesByUrl(site);
+    const conflicting = [];
+    for (const entry of site.discovery.urls) {
+      const key = sameUrlKey(entry.loc);
+      const page = key ? byUrl.get(key) : void 0;
+      if (page && saysNoindex(page)) conflicting.push(entry.loc);
+    }
+    if (conflicting.length === 0) return [];
+    return issue({
+      pageUrl: site.discovery.diagnostics.sitemapUrl ?? `${site.origin}/sitemap.xml`,
+      message: `${conflicting.length} sitemap entr${conflicting.length === 1 ? "y declares" : "ies declare"} \`noindex\`: ${sample(conflicting)}. "Please index this" and "do not index this" are the same site's two answers to one question.`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+var sitemapEntryNonCanonical = {
+  id: "sitemap.entry.non-canonical",
+  severity: "warning",
+  summary: "A sitemap should list canonical URLs",
+  rigor: "vendor-spec",
+  sources: ["sitemaps-protocol", "google-canonicalization"],
+  appliesTo: (site) => (site.discovery?.urls.length ?? 0) > 0,
+  check: ({ site, issue }) => {
+    const byUrl = pagesByUrl(site);
+    const wrong = [];
+    for (const entry of site.discovery.urls) {
+      const key = sameUrlKey(entry.loc);
+      const page = key ? byUrl.get(key) : void 0;
+      const canonical = page?.links.canonical;
+      if (!page || !canonical) continue;
+      const canonicalKey = sameUrlKey(canonical);
+      if (canonicalKey && canonicalKey !== key) {
+        wrong.push(`${entry.loc} \u2192 ${canonical}`);
+      }
+    }
+    if (wrong.length === 0) return [];
+    return issue({
+      pageUrl: site.discovery.diagnostics.sitemapUrl ?? `${site.origin}/sitemap.xml`,
+      message: `${wrong.length} sitemap entr${wrong.length === 1 ? "y names a page whose canonical" : "ies name pages whose canonicals"} point elsewhere: ${sample(wrong)}. The sitemap is a list of what to index, so it should name the URL the site itself prefers.`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+var sitemapOrphans = {
+  id: "sitemap.orphans",
+  severity: "warning",
+  summary: "Indexable pages the crawl found should be listed in the sitemap",
+  rigor: "guideline",
+  sources: ["sitemaps-protocol", "google-sitemaps"],
+  // One finding with a count and a sample, not one per page — the same shape
+  // translation holes take, and for the same reason: forty repeats of one
+  // omission is noise, and the omission is a property of the sitemap.
+  appliesTo: (site) => site.discovery?.diagnostics.found === true && site.discovery.urls.length > 0,
+  check: ({ site, issue }) => {
+    const listed = new Set(
+      site.discovery.urls.map((entry) => sameUrlKey(entry.loc)).filter(Boolean)
+    );
+    const orphans = site.pages.filter((page) => !saysNoindex(page)).map((page) => ({ page, key: sameUrlKey(page.fetch.finalUrl) })).filter(({ key }) => key !== void 0 && !listed.has(key)).map(({ page }) => page.fetch.finalUrl);
+    if (orphans.length === 0) return [];
+    return issue({
+      pageUrl: site.discovery.diagnostics.sitemapUrl ?? `${site.origin}/sitemap.xml`,
+      message: `${orphans.length} crawled page${orphans.length === 1 ? "" : "s"} ask${orphans.length === 1 ? "s" : ""} to be indexed and ${orphans.length === 1 ? "is" : "are"} absent from the sitemap: ${sample(orphans)}. A consumer that reads the sitemap rather than following links will never see ${orphans.length === 1 ? "it" : "them"}.`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+function entryProbes(site) {
+  return [...site.sitemapEntries?.byUrl.values() ?? []];
+}
+function coverageNote(site) {
+  const unprobed = site.sitemapEntries?.unprobed ?? 0;
+  if (unprobed === 0) return "";
+  return ` ${unprobed} further entr${unprobed === 1 ? "y was" : "ies were"} not checked \u2014 this count is a floor, not a total.`;
+}
+var sitemapEntryUnreachable = {
+  id: "sitemap.entry.unreachable",
+  severity: "error",
+  summary: "Every URL a sitemap lists must answer",
+  rigor: "vendor-spec",
+  sources: ["sitemaps-protocol", "google-sitemaps"],
+  appliesTo: (site) => entryProbes(site).some((probe) => isDead(probe.status)),
+  check: ({ site, issue }) => {
+    const dead = entryProbes(site).filter((probe) => isDead(probe.status));
+    return issue({
+      pageUrl: site.discovery.diagnostics.sitemapUrl ?? `${site.origin}/sitemap.xml`,
+      message: `${dead.length} sitemap entr${dead.length === 1 ? "y does" : "ies do"} not answer: ${sample(dead.map((probe) => `${probe.url} (${probe.status === 0 ? "no response" : `HTTP ${probe.status}`})`))}. A sitemap is a list of pages to index, so every dead entry spends crawl budget on a promise the site does not keep.${coverageNote(site)}`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+var sitemapEntryRedirects = {
+  id: "sitemap.entry.redirects",
+  severity: "warning",
+  summary: "A sitemap should list final URLs, not URLs that redirect",
+  rigor: "guideline",
+  sources: ["sitemaps-protocol", "google-sitemaps"],
+  appliesTo: (site) => entryProbes(site).some((probe) => probe.redirected && !isDead(probe.status)),
+  check: ({ site, issue }) => {
+    const moved = entryProbes(site).filter((probe) => probe.redirected && !isDead(probe.status));
+    return issue({
+      pageUrl: site.discovery.diagnostics.sitemapUrl ?? `${site.origin}/sitemap.xml`,
+      message: `${moved.length} sitemap entr${moved.length === 1 ? "y redirects" : "ies redirect"}: ${sample(moved.map((probe) => `${probe.url} \u2192 ${probe.finalUrl}`))}. Google asks for the final URL, and every hop is crawl budget spent plus one more chance for a consumer to disagree about which address is the page.${coverageNote(site)}`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+function isDead(status) {
+  return status === 0 || status >= 400;
+}
+function isRobotsFailure(status) {
+  return status === 0 || status >= 500;
+}
+function isAbsolute(value) {
+  try {
+    const url = new URL(value);
+    return url.protocol === "http:" || url.protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+var SITE_RULES = [
+  hreflangMissing,
+  hreflangSitemapMismatch,
+  iconsIcoMissing,
+  robotsBlocksPage,
+  robotsBlocksSite,
+  robotstxtCrossOrigin,
+  robotstxtInvalidLine,
+  robotstxtOversized,
+  robotstxtSitemapRelative,
+  robotstxtUnknownDirective,
+  robotstxtUnreachable,
+  sitemapEmpty,
+  sitemapEntryBlockedByRobots,
+  sitemapEntryCrossHost,
+  sitemapEntryInvalidUrl,
+  sitemapEntryNoindex,
+  sitemapEntryNonCanonical,
+  sitemapEntryProtocolMismatch,
+  sitemapEntryRedirects,
+  sitemapEntryUnreachable,
+  sitemapFieldInvalid,
+  sitemapIndexChildError,
+  sitemapLastmodInvalid,
+  sitemapMissing,
+  sitemapOrphans,
+  sitemapUnparsable
+];
+function getSiteRule(id) {
+  return SITE_RULES.find((rule) => rule.id === id);
+}
+
+// src/lib/core/lint-site.ts
+function lintSite(site, rules = SITE_RULES) {
+  const drafts = [];
+  for (const rule of rules) {
+    if (rule.appliesTo && !rule.appliesTo(site)) continue;
+    let result;
+    try {
+      result = rule.check({
+        site,
+        issue: (input) => ({
+          ruleId: rule.id,
+          severity: input.severity ?? rule.severity,
+          message: input.message,
+          origin: input.origin,
+          fix: input.fix,
+          suggestion: input.suggestion,
+          pageUrl: input.pageUrl,
+          // Stamped from the descriptor, never from the check: a rule does not
+          // get to claim a rigor per finding. Absent on the three rules that
+          // predate the field, which is how the gap stays visible instead of
+          // being filled with a plausible citation.
+          ...rule.rigor ? { rigor: rule.rigor, sources: rule.sources ?? [] } : {}
+        })
+      });
+    } catch (err) {
+      drafts.push({
+        ruleId: "engine.site-rule-crashed",
+        severity: "info",
+        message: `Site rule \`${rule.id}\` threw: ${err instanceof Error ? err.message : String(err)}`,
+        pageUrl: site.origin
+      });
+      continue;
+    }
+    if (!result) continue;
+    if (Array.isArray(result)) drafts.push(...result);
+    else drafts.push(result);
+  }
+  return sortSiteIssues(drafts);
+}
+function sortSiteIssues(drafts) {
+  const byPage = [...drafts].sort((a, b) => a.pageUrl.localeCompare(b.pageUrl));
+  return sortIssues(byPage);
+}
+
+// src/lib/core/locales.ts
+function localePrefixOf(url) {
+  let pathname;
+  try {
+    pathname = new URL(url).pathname;
+  } catch {
+    return null;
+  }
+  const first = pathname.split("/").filter(Boolean)[0];
+  if (first && looksLikeLocaleSegment(first)) return first.toLowerCase();
+  return null;
+}
+function prefixesIn(urls) {
+  const out = /* @__PURE__ */ new Set();
+  for (const url of urls ?? []) {
+    const locale = localePrefixOf(url);
+    if (locale) out.add(locale);
+  }
+  out.delete("x-default");
+  return out;
 }
 function describeCandidates(pages) {
   const byTag = /* @__PURE__ */ new Map();
@@ -3030,14 +3739,15 @@ async function discoverSitemap(baseUrl, options = {}) {
   };
   const robots = await probeRobots(origin, { signal: options.signal });
   diagnostics.robotsFound = robots.found;
+  const declaredUrls = robots.sitemaps.map((entry) => entry.value);
   const candidates = [];
-  for (const declared of robots.sitemaps) {
+  for (const declared of declaredUrls) {
     candidates.push({ url: declared, source: "robots", declaredInRobots: true });
   }
   candidates.push({
     url: new URL("/sitemap.xml", origin).toString(),
     source: "well-known",
-    declaredInRobots: robots.sitemaps.includes(new URL("/sitemap.xml", origin).toString())
+    declaredInRobots: declaredUrls.includes(new URL("/sitemap.xml", origin).toString())
   });
   candidates.push({
     url: new URL("/sitemap_index.xml", origin).toString(),
@@ -3166,47 +3876,434 @@ function isWellKnownPath(url) {
     return false;
   }
 }
-async function fetchDoc(url, options) {
-  const { signal, cleanup } = combineSignals(
-    options.signal,
-    options.timeoutMs ?? DEFAULTS.timeoutMs
-  );
-  const restoreTls = relaxTlsIfRequested2(options.allowInsecureTls);
-  try {
-    const res = await fetch(url, {
-      signal,
-      redirect: "follow",
-      headers: {
-        accept: "application/xml,text/xml,application/gzip;q=0.9,*/*;q=0.5"
-      }
-    });
-    if (!res.ok) return { status: res.status };
-    const encoding = res.headers.get("content-encoding")?.toLowerCase() ?? "";
-    const looksGzip = url.toLowerCase().endsWith(".gz") || encoding.includes("gzip");
-    if (looksGzip) {
-      const buf = Buffer.from(await res.arrayBuffer());
-      try {
-        return { status: res.status, body: gunzipSync(buf).toString("utf8") };
-      } catch {
-        return { status: res.status, body: buf.toString("utf8") };
-      }
+async function fetchDoc(url, options) {
+  const { signal, cleanup } = combineSignals(
+    options.signal,
+    options.timeoutMs ?? DEFAULTS.timeoutMs
+  );
+  const restoreTls = relaxTlsIfRequested2(options.allowInsecureTls);
+  try {
+    const res = await fetch(url, {
+      signal,
+      redirect: "follow",
+      headers: {
+        accept: "application/xml,text/xml,application/gzip;q=0.9,*/*;q=0.5"
+      }
+    });
+    if (!res.ok) return { status: res.status };
+    const encoding = res.headers.get("content-encoding")?.toLowerCase() ?? "";
+    const looksGzip = url.toLowerCase().endsWith(".gz") || encoding.includes("gzip");
+    if (looksGzip) {
+      const buf = Buffer.from(await res.arrayBuffer());
+      try {
+        return { status: res.status, body: gunzipSync(buf).toString("utf8") };
+      } catch {
+        return { status: res.status, body: buf.toString("utf8") };
+      }
+    }
+    return { status: res.status, body: await res.text() };
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    return { status: 0, error: reason || "network error" };
+  } finally {
+    cleanup();
+    restoreTls();
+  }
+}
+function relaxTlsIfRequested2(enabled) {
+  if (!enabled) return () => void 0;
+  const previous = process.env.NODE_TLS_REJECT_UNAUTHORIZED;
+  process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
+  return () => {
+    if (previous === void 0) delete process.env.NODE_TLS_REJECT_UNAUTHORIZED;
+    else process.env.NODE_TLS_REJECT_UNAUTHORIZED = previous;
+  };
+}
+
+// src/lib/core/net/fetch-url.ts
+var DEFAULT_USER_AGENT = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36";
+var DEFAULT_TIMEOUT_MS = 8e3;
+var DEFAULT_MAX_BYTES = 3 * 1024 * 1024;
+var DEFAULT_ACCEPT = "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8";
+var TEXTY = /(text\/|application\/(xhtml\+xml|xml|json|.*\+xml|.*\+json|javascript))/;
+async function fetchUrl(url, options = {}) {
+  const method = options.method ?? "GET";
+  const redirect = options.redirect ?? "follow";
+  const maxBytes = options.maxBytes ?? DEFAULT_MAX_BYTES;
+  const startedAt = Date.now();
+  const { signal, cleanup } = combineSignals(
+    options.signal,
+    options.timeoutMs ?? DEFAULT_TIMEOUT_MS
+  );
+  const restoreTls = relaxTlsIfRequested3(options.allowInsecureTls);
+  try {
+    const res = await fetch(url, {
+      method,
+      signal,
+      redirect,
+      headers: {
+        "user-agent": options.userAgent ?? DEFAULT_USER_AGENT,
+        accept: options.accept ?? DEFAULT_ACCEPT
+      }
+    });
+    const contentType = normaliseContentType(res.headers.get("content-type"));
+    const result = {
+      requestedUrl: url,
+      finalUrl: res.url || url,
+      status: res.status,
+      redirected: res.redirected,
+      redirectChain: [],
+      contentType,
+      durationMs: Date.now() - startedAt
+    };
+    const retryAfter = res.headers.get("retry-after");
+    if (retryAfter) result.retryAfter = retryAfter;
+    if (redirect === "manual" && isRedirectStatus(res.status)) {
+      const location = res.headers.get("location");
+      if (location) {
+        try {
+          const next = new URL(location, url).toString();
+          result.finalUrl = next;
+          result.redirectChain = [next];
+          result.redirected = true;
+        } catch {
+        }
+      }
+      await res.body?.cancel().catch(() => void 0);
+      return result;
+    }
+    if (method === "HEAD") {
+      await res.body?.cancel().catch(() => void 0);
+      return result;
+    }
+    if (contentType && !TEXTY.test(contentType)) {
+      await res.body?.cancel().catch(() => void 0);
+      return result;
+    }
+    const { text, truncated } = await readCappedText(res, maxBytes);
+    result.body = text;
+    if (truncated) result.truncated = true;
+    return result;
+  } catch (err) {
+    return {
+      requestedUrl: url,
+      finalUrl: url,
+      status: 0,
+      redirected: false,
+      redirectChain: [],
+      reason: classifyError(err, options.signal),
+      durationMs: Date.now() - startedAt
+    };
+  } finally {
+    cleanup();
+    restoreTls();
+  }
+}
+function isRedirectStatus(status) {
+  return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
+}
+function normaliseContentType(raw) {
+  if (!raw) return void 0;
+  const semi = raw.indexOf(";");
+  return (semi === -1 ? raw : raw.slice(0, semi)).trim().toLowerCase() || void 0;
+}
+async function readCappedText(res, maxBytes) {
+  const reader = res.body?.getReader();
+  if (!reader) {
+    const text = await res.text();
+    if (text.length > maxBytes) {
+      return { text: text.slice(0, maxBytes), truncated: true };
+    }
+    return { text, truncated: false };
+  }
+  const chunks = [];
+  let received = 0;
+  let truncated = false;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    if (!value) continue;
+    chunks.push(value);
+    received += value.byteLength;
+    if (received >= maxBytes) {
+      truncated = true;
+      await reader.cancel().catch(() => void 0);
+      break;
+    }
+  }
+  const buf = Buffer.concat(chunks.map((c) => Buffer.from(c)));
+  const sliced = buf.byteLength > maxBytes ? buf.subarray(0, maxBytes) : buf;
+  return { text: sliced.toString("utf8"), truncated };
+}
+function classifyError(err, callerSignal) {
+  if (isAbortError(err)) {
+    return callerSignal?.aborted ? "abort" : "timeout";
+  }
+  const code = errorCode(err);
+  if (code) {
+    if (code === "ENOTFOUND" || code === "EAI_AGAIN") return "dns";
+    if (code.startsWith("CERT_") || code.includes("SELF_SIGNED") || code.includes("CERT")) {
+      return "tls";
+    }
+  }
+  const message = err instanceof Error ? err.message.toLowerCase() : String(err).toLowerCase();
+  if (message.includes("certificate") || message.includes("tls") || message.includes("ssl")) {
+    return "tls";
+  }
+  return "network";
+}
+function isAbortError(err) {
+  return err instanceof Error && err.name === "AbortError";
+}
+function errorCode(err) {
+  if (err && typeof err === "object") {
+    const direct = err.code;
+    if (typeof direct === "string") return direct;
+    const cause = err.cause;
+    if (cause && typeof cause === "object") {
+      const causeCode = cause.code;
+      if (typeof causeCode === "string") return causeCode;
+    }
+  }
+  return void 0;
+}
+function relaxTlsIfRequested3(enabled) {
+  if (!enabled) return () => void 0;
+  const previous = process.env.NODE_TLS_REJECT_UNAUTHORIZED;
+  process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
+  return () => {
+    if (previous === void 0) delete process.env.NODE_TLS_REJECT_UNAUTHORIZED;
+    else process.env.NODE_TLS_REJECT_UNAUTHORIZED = previous;
+  };
+}
+
+// src/lib/core/links/classify.ts
+function classifyLink(input) {
+  if (input.status === 0) return "broken";
+  if (input.loop) return "broken";
+  if (input.softNotFound) return "warning";
+  if (input.status === 403 || input.status === 429) return "blocked";
+  if (input.status >= 400) return "broken";
+  if (input.status >= 200 && input.status < 300) {
+    return input.redirected ? "redirect" : "ok";
+  }
+  return "broken";
+}
+
+// src/lib/core/links/check.ts
+var DEFAULTS2 = {
+  timeoutMs: 8e3,
+  maxRedirects: 10,
+  retries: 1,
+  backoffBaseMs: 300,
+  maxBackoffMs: 3e3,
+  softBodyBytes: 16 * 1024
+};
+var NOT_FOUND_RE = /\b(not\s+found|page\s+doesn'?t\s+exist|404|no\s+such\s+page)\b/i;
+var SOFT_404_BODY_LIMIT = 2048;
+async function checkLink(url, options = {}) {
+  const checkedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const started = Date.now();
+  const scheme = schemeOf(url);
+  if (scheme !== "http" && scheme !== "https") {
+    return {
+      url,
+      finalUrl: url,
+      status: 0,
+      verdict: "skipped",
+      method: "GET",
+      redirectChain: [],
+      reason: scheme ? `unsupported scheme: ${scheme}` : "not a URL",
+      checkedAt,
+      durationMs: Date.now() - started
+    };
+  }
+  const outcome = await probeWithRetry(url, options);
+  const softNotFound = isSoftNotFound(outcome);
+  const verdict = classifyLink({
+    status: outcome.status,
+    redirected: outcome.redirectChain.length > 0,
+    reason: outcome.reason,
+    softNotFound,
+    loop: outcome.loop
+  });
+  return {
+    url,
+    finalUrl: outcome.finalUrl,
+    status: outcome.status,
+    verdict,
+    method: outcome.method,
+    redirectChain: outcome.redirectChain,
+    reason: describeReason(outcome, softNotFound),
+    checkedAt,
+    durationMs: Date.now() - started
+  };
+}
+async function probeWithRetry(url, options) {
+  const retries = options.retries ?? DEFAULTS2.retries;
+  const sleep = options.sleep ?? defaultSleep;
+  let outcome = await probeWithHeadFallback(url, options);
+  for (let attempt = 0; attempt < retries; attempt++) {
+    if (!isTransient(outcome)) break;
+    if (options.signal?.aborted) break;
+    const delay = backoffDelay(outcome, attempt, options);
+    if (delay > 0) await sleep(delay);
+    outcome = await probeWithHeadFallback(url, options);
+  }
+  return outcome;
+}
+async function probeWithHeadFallback(url, options) {
+  const head = await followRedirects(url, "HEAD", options);
+  if (headRejected(head) || head.status >= 200 && head.status < 300) {
+    const get = await followRedirects(url, "GET", options);
+    if (get.status === 0 && head.status !== 0 && !headRejected(head)) return head;
+    return get;
+  }
+  return head;
+}
+function headRejected(o) {
+  return o.status === 405 || o.status === 501 || o.status === 403 || o.status === 0;
+}
+async function followRedirects(url, method, options) {
+  const maxRedirects = options.maxRedirects ?? DEFAULTS2.maxRedirects;
+  const chain = [];
+  const visited = /* @__PURE__ */ new Set([url]);
+  let current = url;
+  for (let hop = 0; hop <= maxRedirects; hop++) {
+    const res = await fetchUrl(current, {
+      method,
+      redirect: "manual",
+      timeoutMs: options.timeoutMs ?? DEFAULTS2.timeoutMs,
+      allowInsecureTls: options.allowInsecureTls,
+      userAgent: options.userAgent,
+      maxBytes: method === "GET" ? options.softBodyBytes ?? DEFAULTS2.softBodyBytes : void 0
+    });
+    if (res.status === 0) {
+      return {
+        status: 0,
+        finalUrl: current,
+        redirectChain: chain,
+        reason: res.reason,
+        loop: false,
+        method
+      };
+    }
+    const next = res.redirectChain[0];
+    if (next) {
+      chain.push(next);
+      if (visited.has(next)) {
+        return { status: res.status, finalUrl: next, redirectChain: chain, loop: true, method };
+      }
+      visited.add(next);
+      current = next;
+      continue;
+    }
+    return {
+      status: res.status,
+      finalUrl: res.finalUrl,
+      redirectChain: chain,
+      loop: false,
+      body: res.body,
+      retryAfter: res.retryAfter,
+      method
+    };
+  }
+  return { status: 0, finalUrl: current, redirectChain: chain, loop: true, method };
+}
+function isSoftNotFound(o) {
+  if (o.status < 200 || o.status >= 300) return false;
+  if (o.body === void 0) return false;
+  if (o.body.length > SOFT_404_BODY_LIMIT) return false;
+  return NOT_FOUND_RE.test(o.body);
+}
+function isTransient(o) {
+  if (o.status === 0) return true;
+  if (o.status === 429) return true;
+  if (o.status >= 500) return true;
+  return false;
+}
+function backoffDelay(o, attempt, options) {
+  const max = options.maxBackoffMs ?? DEFAULTS2.maxBackoffMs;
+  const retryAfterMs = parseRetryAfter(o.retryAfter);
+  if (retryAfterMs !== void 0) return Math.min(retryAfterMs, max);
+  const base = options.backoffBaseMs ?? DEFAULTS2.backoffBaseMs;
+  const exp = base * 2 ** attempt;
+  const jitter = Math.floor(Math.random() * base);
+  return Math.min(exp + jitter, max);
+}
+function parseRetryAfter(value) {
+  if (!value) return void 0;
+  const seconds = Number(value);
+  if (Number.isFinite(seconds)) return Math.max(0, seconds * 1e3);
+  const date = Date.parse(value);
+  if (!Number.isNaN(date)) return Math.max(0, date - Date.now());
+  return void 0;
+}
+function describeReason(o, softNotFound) {
+  if (o.reason) return o.reason;
+  if (o.loop) return "redirect loop";
+  if (softNotFound) return "soft-404";
+  if (o.status === 429) return "429 rate-limited";
+  if (o.status === 403) return "403 forbidden";
+  if (o.status >= 400) return `${o.status}`;
+  return void 0;
+}
+function schemeOf(url) {
+  try {
+    return new URL(url).protocol.replace(/:$/, "").toLowerCase();
+  } catch {
+    return null;
+  }
+}
+function defaultSleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+// src/lib/core/sitemap/entries.ts
+async function probeSitemapEntries(locs, options) {
+  const byUrl = /* @__PURE__ */ new Map();
+  const toFetch = [];
+  for (const loc of locs) {
+    if (byUrl.has(loc)) continue;
+    const crawled = options.crawled.get(loc);
+    if (crawled !== void 0) {
+      byUrl.set(loc, { url: loc, status: crawled, via: "crawl", finalUrl: loc, redirected: false });
+      continue;
     }
-    return { status: res.status, body: await res.text() };
-  } catch (err) {
-    const reason = err instanceof Error ? err.message : String(err);
-    return { status: 0, error: reason || "network error" };
-  } finally {
-    cleanup();
-    restoreTls();
+    const checked = options.checked.get(loc);
+    if (checked) {
+      byUrl.set(loc, fromCheck(loc, checked, "link-audit"));
+      continue;
+    }
+    toFetch.push(loc);
   }
+  const budget = toFetch.slice(0, options.maxProbes);
+  const unprobed = toFetch.length - budget.length;
+  const queue = [...budget];
+  const workers = Math.min(options.concurrency ?? 6, queue.length);
+  await Promise.all(
+    Array.from({ length: workers }, async () => {
+      for (let url = queue.pop(); url !== void 0; url = queue.pop()) {
+        const check = await checkLink(url, {
+          signal: options.signal,
+          timeoutMs: options.timeoutMs,
+          allowInsecureTls: options.allowInsecureTls
+        }).catch(() => void 0);
+        if (check) byUrl.set(url, fromCheck(url, check, "probe"));
+      }
+    })
+  );
+  return { byUrl, unprobed };
 }
-function relaxTlsIfRequested2(enabled) {
-  if (!enabled) return () => void 0;
-  const previous = process.env.NODE_TLS_REJECT_UNAUTHORIZED;
-  process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
-  return () => {
-    if (previous === void 0) delete process.env.NODE_TLS_REJECT_UNAUTHORIZED;
-    else process.env.NODE_TLS_REJECT_UNAUTHORIZED = previous;
+function fromCheck(url, check, via) {
+  return {
+    url,
+    status: check.status,
+    via,
+    finalUrl: check.finalUrl,
+    // A redirect that resolved, or one that did not: either way the entry did
+    // not name the URL that answers, which is what the rule is about.
+    redirected: check.finalUrl !== url || check.redirectChain.length > 0
   };
 }
 
@@ -3654,205 +4751,48 @@ var titleDescriptive = {
 var descriptionAccurate = {
   id: "description.accurate",
   kind: "prose",
-  category: "meta",
-  title: "The meta description summarizes this page truthfully",
-  why: "The description is the one sentence you get to write in a search result. A boilerplate line repeated site-wide, or one that promises something the page does not deliver, gets replaced by improvised page text \u2014 or gets the click and loses the visitor.",
-  rigor: "guideline",
-  sources: ["google-snippet", "moz-meta-description"],
-  reads: ["meta.description", "document.title", "http.finalUrl"],
-  relates: ["description.missing", "description.length"],
-  appliesTo: (ex) => Boolean(ex.meta.description?.value?.trim()),
-  prose: "Does the description accurately summarize this page's content, and is it written for this page rather than copied across the site?"
-};
-var langMatchesContent = {
-  id: "lang.matches-content",
-  kind: "prose",
-  category: "i18n",
-  title: "The declared `lang` is the language the page is actually written in",
-  why: "A wrong `lang` is worse than a missing one: screen readers switch to the wrong pronunciation rules, browsers offer to translate a page that is already in the reader's language, and search engines file the page under the wrong audience. Nothing in the markup contradicts it, so no mechanical check can catch it.",
-  rigor: "spec-required",
-  sources: ["whatwg-html-lang", "w3c-i18n-language-tags"],
-  reads: ["document.lang", "document.title", "meta.description", "openGraph.locale"],
-  appliesTo: (ex) => Boolean(ex.document.lang?.value?.trim()),
-  prose: "Is the text of this page actually written in the language its `lang` attribute declares?"
-};
-var ogImageRepresentative = {
-  id: "og.image.representative",
-  kind: "prose",
-  category: "opengraph",
-  title: "The `og:image` represents this page and survives the unfurl crop",
-  why: "The preview image is the whole payload of a shared link. A generic site-wide banner, or artwork whose subject sits outside the ~1.91:1 crop, is present enough to pass every mechanical check and still communicate nothing.",
-  rigor: "guideline",
-  sources: ["ogp", "meta-og-sharing"],
-  reads: ["openGraph.images", "openGraph.title", "document.title", "http.finalUrl"],
-  relates: ["og.image.missing"],
-  appliesTo: (ex) => ex.openGraph.images.length > 0,
-  prose: "Does the og:image represent what this page is about, rather than being a site-wide default, and does its subject survive being cropped to the 1.91:1 aspect ratio consumers render?"
-};
-var PROSE_RULES = [
-  descriptionAccurate,
-  langMatchesContent,
-  ogImageRepresentative,
-  titleDescriptive
-];
-var PROSE_RULE_BY_ID = new Map(PROSE_RULES.map((r) => [r.id, r]));
-
-// src/lib/core/net/fetch-url.ts
-var DEFAULT_USER_AGENT = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36";
-var DEFAULT_TIMEOUT_MS = 8e3;
-var DEFAULT_MAX_BYTES = 3 * 1024 * 1024;
-var DEFAULT_ACCEPT = "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8";
-var TEXTY = /(text\/|application\/(xhtml\+xml|xml|json|.*\+xml|.*\+json|javascript))/;
-async function fetchUrl(url, options = {}) {
-  const method = options.method ?? "GET";
-  const redirect = options.redirect ?? "follow";
-  const maxBytes = options.maxBytes ?? DEFAULT_MAX_BYTES;
-  const startedAt = Date.now();
-  const { signal, cleanup } = combineSignals(
-    options.signal,
-    options.timeoutMs ?? DEFAULT_TIMEOUT_MS
-  );
-  const restoreTls = relaxTlsIfRequested3(options.allowInsecureTls);
-  try {
-    const res = await fetch(url, {
-      method,
-      signal,
-      redirect,
-      headers: {
-        "user-agent": options.userAgent ?? DEFAULT_USER_AGENT,
-        accept: options.accept ?? DEFAULT_ACCEPT
-      }
-    });
-    const contentType = normaliseContentType(res.headers.get("content-type"));
-    const result = {
-      requestedUrl: url,
-      finalUrl: res.url || url,
-      status: res.status,
-      redirected: res.redirected,
-      redirectChain: [],
-      contentType,
-      durationMs: Date.now() - startedAt
-    };
-    const retryAfter = res.headers.get("retry-after");
-    if (retryAfter) result.retryAfter = retryAfter;
-    if (redirect === "manual" && isRedirectStatus(res.status)) {
-      const location = res.headers.get("location");
-      if (location) {
-        try {
-          const next = new URL(location, url).toString();
-          result.finalUrl = next;
-          result.redirectChain = [next];
-          result.redirected = true;
-        } catch {
-        }
-      }
-      await res.body?.cancel().catch(() => void 0);
-      return result;
-    }
-    if (method === "HEAD") {
-      await res.body?.cancel().catch(() => void 0);
-      return result;
-    }
-    if (contentType && !TEXTY.test(contentType)) {
-      await res.body?.cancel().catch(() => void 0);
-      return result;
-    }
-    const { text, truncated } = await readCappedText(res, maxBytes);
-    result.body = text;
-    if (truncated) result.truncated = true;
-    return result;
-  } catch (err) {
-    return {
-      requestedUrl: url,
-      finalUrl: url,
-      status: 0,
-      redirected: false,
-      redirectChain: [],
-      reason: classifyError(err, options.signal),
-      durationMs: Date.now() - startedAt
-    };
-  } finally {
-    cleanup();
-    restoreTls();
-  }
-}
-function isRedirectStatus(status) {
-  return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
-}
-function normaliseContentType(raw) {
-  if (!raw) return void 0;
-  const semi = raw.indexOf(";");
-  return (semi === -1 ? raw : raw.slice(0, semi)).trim().toLowerCase() || void 0;
-}
-async function readCappedText(res, maxBytes) {
-  const reader = res.body?.getReader();
-  if (!reader) {
-    const text = await res.text();
-    if (text.length > maxBytes) {
-      return { text: text.slice(0, maxBytes), truncated: true };
-    }
-    return { text, truncated: false };
-  }
-  const chunks = [];
-  let received = 0;
-  let truncated = false;
-  for (; ; ) {
-    const { done, value } = await reader.read();
-    if (done) break;
-    if (!value) continue;
-    chunks.push(value);
-    received += value.byteLength;
-    if (received >= maxBytes) {
-      truncated = true;
-      await reader.cancel().catch(() => void 0);
-      break;
-    }
-  }
-  const buf = Buffer.concat(chunks.map((c) => Buffer.from(c)));
-  const sliced = buf.byteLength > maxBytes ? buf.subarray(0, maxBytes) : buf;
-  return { text: sliced.toString("utf8"), truncated };
-}
-function classifyError(err, callerSignal) {
-  if (isAbortError(err)) {
-    return callerSignal?.aborted ? "abort" : "timeout";
-  }
-  const code = errorCode(err);
-  if (code) {
-    if (code === "ENOTFOUND" || code === "EAI_AGAIN") return "dns";
-    if (code.startsWith("CERT_") || code.includes("SELF_SIGNED") || code.includes("CERT")) {
-      return "tls";
-    }
-  }
-  const message = err instanceof Error ? err.message.toLowerCase() : String(err).toLowerCase();
-  if (message.includes("certificate") || message.includes("tls") || message.includes("ssl")) {
-    return "tls";
-  }
-  return "network";
-}
-function isAbortError(err) {
-  return err instanceof Error && err.name === "AbortError";
-}
-function errorCode(err) {
-  if (err && typeof err === "object") {
-    const direct = err.code;
-    if (typeof direct === "string") return direct;
-    const cause = err.cause;
-    if (cause && typeof cause === "object") {
-      const causeCode = cause.code;
-      if (typeof causeCode === "string") return causeCode;
-    }
-  }
-  return void 0;
-}
-function relaxTlsIfRequested3(enabled) {
-  if (!enabled) return () => void 0;
-  const previous = process.env.NODE_TLS_REJECT_UNAUTHORIZED;
-  process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
-  return () => {
-    if (previous === void 0) delete process.env.NODE_TLS_REJECT_UNAUTHORIZED;
-    else process.env.NODE_TLS_REJECT_UNAUTHORIZED = previous;
-  };
-}
+  category: "meta",
+  title: "The meta description summarizes this page truthfully",
+  why: "The description is the one sentence you get to write in a search result. A boilerplate line repeated site-wide, or one that promises something the page does not deliver, gets replaced by improvised page text \u2014 or gets the click and loses the visitor.",
+  rigor: "guideline",
+  sources: ["google-snippet", "moz-meta-description"],
+  reads: ["meta.description", "document.title", "http.finalUrl"],
+  relates: ["description.missing", "description.length"],
+  appliesTo: (ex) => Boolean(ex.meta.description?.value?.trim()),
+  prose: "Does the description accurately summarize this page's content, and is it written for this page rather than copied across the site?"
+};
+var langMatchesContent = {
+  id: "lang.matches-content",
+  kind: "prose",
+  category: "i18n",
+  title: "The declared `lang` is the language the page is actually written in",
+  why: "A wrong `lang` is worse than a missing one: screen readers switch to the wrong pronunciation rules, browsers offer to translate a page that is already in the reader's language, and search engines file the page under the wrong audience. Nothing in the markup contradicts it, so no mechanical check can catch it.",
+  rigor: "spec-required",
+  sources: ["whatwg-html-lang", "w3c-i18n-language-tags"],
+  reads: ["document.lang", "document.title", "meta.description", "openGraph.locale"],
+  appliesTo: (ex) => Boolean(ex.document.lang?.value?.trim()),
+  prose: "Is the text of this page actually written in the language its `lang` attribute declares?"
+};
+var ogImageRepresentative = {
+  id: "og.image.representative",
+  kind: "prose",
+  category: "opengraph",
+  title: "The `og:image` represents this page and survives the unfurl crop",
+  why: "The preview image is the whole payload of a shared link. A generic site-wide banner, or artwork whose subject sits outside the ~1.91:1 crop, is present enough to pass every mechanical check and still communicate nothing.",
+  rigor: "guideline",
+  sources: ["ogp", "meta-og-sharing"],
+  reads: ["openGraph.images", "openGraph.title", "document.title", "http.finalUrl"],
+  relates: ["og.image.missing"],
+  appliesTo: (ex) => ex.openGraph.images.length > 0,
+  prose: "Does the og:image represent what this page is about, rather than being a site-wide default, and does its subject survive being cropped to the 1.91:1 aspect ratio consumers render?"
+};
+var PROSE_RULES = [
+  descriptionAccurate,
+  langMatchesContent,
+  ogImageRepresentative,
+  titleDescriptive
+];
+var PROSE_RULE_BY_ID = new Map(PROSE_RULES.map((r) => [r.id, r]));
 
 // src/lib/core/links/extract.ts
 import * as cheerio3 from "cheerio";
@@ -3937,188 +4877,6 @@ function resolveBase2($, pageUrl) {
   return pageUrl;
 }
 
-// src/lib/core/links/classify.ts
-function classifyLink(input) {
-  if (input.status === 0) return "broken";
-  if (input.loop) return "broken";
-  if (input.softNotFound) return "warning";
-  if (input.status === 403 || input.status === 429) return "blocked";
-  if (input.status >= 400) return "broken";
-  if (input.status >= 200 && input.status < 300) {
-    return input.redirected ? "redirect" : "ok";
-  }
-  return "broken";
-}
-
-// src/lib/core/links/check.ts
-var DEFAULTS2 = {
-  timeoutMs: 8e3,
-  maxRedirects: 10,
-  retries: 1,
-  backoffBaseMs: 300,
-  maxBackoffMs: 3e3,
-  softBodyBytes: 16 * 1024
-};
-var NOT_FOUND_RE = /\b(not\s+found|page\s+doesn'?t\s+exist|404|no\s+such\s+page)\b/i;
-var SOFT_404_BODY_LIMIT = 2048;
-async function checkLink(url, options = {}) {
-  const checkedAt = (/* @__PURE__ */ new Date()).toISOString();
-  const started = Date.now();
-  const scheme = schemeOf(url);
-  if (scheme !== "http" && scheme !== "https") {
-    return {
-      url,
-      finalUrl: url,
-      status: 0,
-      verdict: "skipped",
-      method: "GET",
-      redirectChain: [],
-      reason: scheme ? `unsupported scheme: ${scheme}` : "not a URL",
-      checkedAt,
-      durationMs: Date.now() - started
-    };
-  }
-  const outcome = await probeWithRetry(url, options);
-  const softNotFound = isSoftNotFound(outcome);
-  const verdict = classifyLink({
-    status: outcome.status,
-    redirected: outcome.redirectChain.length > 0,
-    reason: outcome.reason,
-    softNotFound,
-    loop: outcome.loop
-  });
-  return {
-    url,
-    finalUrl: outcome.finalUrl,
-    status: outcome.status,
-    verdict,
-    method: outcome.method,
-    redirectChain: outcome.redirectChain,
-    reason: describeReason(outcome, softNotFound),
-    checkedAt,
-    durationMs: Date.now() - started
-  };
-}
-async function probeWithRetry(url, options) {
-  const retries = options.retries ?? DEFAULTS2.retries;
-  const sleep = options.sleep ?? defaultSleep;
-  let outcome = await probeWithHeadFallback(url, options);
-  for (let attempt = 0; attempt < retries; attempt++) {
-    if (!isTransient(outcome)) break;
-    if (options.signal?.aborted) break;
-    const delay = backoffDelay(outcome, attempt, options);
-    if (delay > 0) await sleep(delay);
-    outcome = await probeWithHeadFallback(url, options);
-  }
-  return outcome;
-}
-async function probeWithHeadFallback(url, options) {
-  const head = await followRedirects(url, "HEAD", options);
-  if (headRejected(head) || head.status >= 200 && head.status < 300) {
-    const get = await followRedirects(url, "GET", options);
-    if (get.status === 0 && head.status !== 0 && !headRejected(head)) return head;
-    return get;
-  }
-  return head;
-}
-function headRejected(o) {
-  return o.status === 405 || o.status === 501 || o.status === 403 || o.status === 0;
-}
-async function followRedirects(url, method, options) {
-  const maxRedirects = options.maxRedirects ?? DEFAULTS2.maxRedirects;
-  const chain = [];
-  const visited = /* @__PURE__ */ new Set([url]);
-  let current = url;
-  for (let hop = 0; hop <= maxRedirects; hop++) {
-    const res = await fetchUrl(current, {
-      method,
-      redirect: "manual",
-      timeoutMs: options.timeoutMs ?? DEFAULTS2.timeoutMs,
-      allowInsecureTls: options.allowInsecureTls,
-      userAgent: options.userAgent,
-      maxBytes: method === "GET" ? options.softBodyBytes ?? DEFAULTS2.softBodyBytes : void 0
-    });
-    if (res.status === 0) {
-      return {
-        status: 0,
-        finalUrl: current,
-        redirectChain: chain,
-        reason: res.reason,
-        loop: false,
-        method
-      };
-    }
-    const next = res.redirectChain[0];
-    if (next) {
-      chain.push(next);
-      if (visited.has(next)) {
-        return { status: res.status, finalUrl: next, redirectChain: chain, loop: true, method };
-      }
-      visited.add(next);
-      current = next;
-      continue;
-    }
-    return {
-      status: res.status,
-      finalUrl: res.finalUrl,
-      redirectChain: chain,
-      loop: false,
-      body: res.body,
-      retryAfter: res.retryAfter,
-      method
-    };
-  }
-  return { status: 0, finalUrl: current, redirectChain: chain, loop: true, method };
-}
-function isSoftNotFound(o) {
-  if (o.status < 200 || o.status >= 300) return false;
-  if (o.body === void 0) return false;
-  if (o.body.length > SOFT_404_BODY_LIMIT) return false;
-  return NOT_FOUND_RE.test(o.body);
-}
-function isTransient(o) {
-  if (o.status === 0) return true;
-  if (o.status === 429) return true;
-  if (o.status >= 500) return true;
-  return false;
-}
-function backoffDelay(o, attempt, options) {
-  const max = options.maxBackoffMs ?? DEFAULTS2.maxBackoffMs;
-  const retryAfterMs = parseRetryAfter(o.retryAfter);
-  if (retryAfterMs !== void 0) return Math.min(retryAfterMs, max);
-  const base = options.backoffBaseMs ?? DEFAULTS2.backoffBaseMs;
-  const exp = base * 2 ** attempt;
-  const jitter = Math.floor(Math.random() * base);
-  return Math.min(exp + jitter, max);
-}
-function parseRetryAfter(value) {
-  if (!value) return void 0;
-  const seconds = Number(value);
-  if (Number.isFinite(seconds)) return Math.max(0, seconds * 1e3);
-  const date = Date.parse(value);
-  if (!Number.isNaN(date)) return Math.max(0, date - Date.now());
-  return void 0;
-}
-function describeReason(o, softNotFound) {
-  if (o.reason) return o.reason;
-  if (o.loop) return "redirect loop";
-  if (softNotFound) return "soft-404";
-  if (o.status === 429) return "429 rate-limited";
-  if (o.status === 403) return "403 forbidden";
-  if (o.status >= 400) return `${o.status}`;
-  return void 0;
-}
-function schemeOf(url) {
-  try {
-    return new URL(url).protocol.replace(/:$/, "").toLowerCase();
-  } catch {
-    return null;
-  }
-}
-function defaultSleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-
 // src/lib/core/links/types.ts
 function emptyVerdictSummary() {
   return { ok: 0, redirect: 0, broken: 0, blocked: 0, warning: 0, skipped: 0 };
@@ -4450,14 +5208,14 @@ async function attachManifests(pages, options) {
   }
 }
 async function probeAssets(pages, options) {
-  const sameOrigin = (url) => {
+  const sameOrigin2 = (url) => {
     try {
       return new URL(url).origin === new URL(options.origin).origin;
     } catch {
       return false;
     }
   };
-  const wantedUrl = (url) => /^https?:\/\//i.test(url) && (options.checkExternal || sameOrigin(url));
+  const wantedUrl = (url) => /^https?:\/\//i.test(url) && (options.checkExternal || sameOrigin2(url));
   const wanted = /* @__PURE__ */ new Set();
   for (const page of pages) {
     for (const image of page.openGraph.images) {
@@ -4630,7 +5388,14 @@ async function runAudit(inputUrl, options = {}) {
         severity: issue.severity,
         message: issue.message,
         why: rule?.title,
-        fix: issue.fix?.snippet
+        fix: issue.fix?.snippet,
+        // The fingerprint above is unchanged on purpose: it keys on the rule,
+        // the route and the occurrence, so carrying more of the finding cannot
+        // move a baseline entry (`./diff.ts` matches on `id` alone).
+        rigor: issue.rigor,
+        sources: issue.sources,
+        observed: issue.observed,
+        expected: issue.expected
       });
     }
   }
@@ -4677,6 +5442,33 @@ async function runAudit(inputUrl, options = {}) {
     ),
     ...issue
   }));
+  const linkDiscovery = syntheticDiscovery(origin, entry, okPages, crawlResult.truncated);
+  const linkReport = await runLinkAudit(linkDiscovery, {
+    allowInsecureTls: options.allowInsecureTls,
+    checkExternal,
+    timeoutMs: options.timeoutMs,
+    maxPages: effectiveMaxPages,
+    signal: options.signal,
+    onProgress: (p) => options.onProgress?.({
+      phase: p.phase === "scan" ? "scan" : "links",
+      done: p.done,
+      total: p.total
+    })
+  });
+  warnings.push(...linkReport.diagnostics.warnings);
+  const sitemapEntries = discovery ? await probeSitemapEntries(
+    discovery.urls.map((entry2) => entry2.loc),
+    {
+      crawled: new Map(
+        crawlResult.pages.map((page) => [page.fetch.finalUrl, page.fetch.status])
+      ),
+      checked: new Map(Object.values(linkReport.checks).map((check) => [check.url, check])),
+      maxProbes: effectiveMaxPages,
+      signal: options.signal,
+      timeoutMs: options.timeoutMs,
+      allowInsecureTls: options.allowInsecureTls
+    }
+  ) : void 0;
   const siteContext = {
     origin,
     pages: htmlPages,
@@ -4685,6 +5477,7 @@ async function runAudit(inputUrl, options = {}) {
     discovery,
     robots,
     favicon,
+    sitemapEntries,
     // Same index the matrix was built from, so a rule that groups by route
     // and the grid that reports holes cannot disagree about which URLs are
     // one page.
@@ -4703,23 +5496,11 @@ async function runAudit(inputUrl, options = {}) {
       severity: draft.severity,
       message: draft.message,
       why: rule?.summary,
-      fix: draft.fix?.snippet
+      fix: draft.fix?.snippet,
+      rigor: draft.rigor,
+      sources: draft.sources
     };
   });
-  const linkDiscovery = syntheticDiscovery(origin, entry, okPages, crawlResult.truncated);
-  const linkReport = await runLinkAudit(linkDiscovery, {
-    allowInsecureTls: options.allowInsecureTls,
-    checkExternal,
-    timeoutMs: options.timeoutMs,
-    maxPages: effectiveMaxPages,
-    signal: options.signal,
-    onProgress: (p) => options.onProgress?.({
-      phase: p.phase === "scan" ? "scan" : "links",
-      done: p.done,
-      total: p.total
-    })
-  });
-  warnings.push(...linkReport.diagnostics.warnings);
   const brokenLinks = [];
   for (const { pageUrl, broken } of linkReport.brokenByPage) {
     for (const check of broken) {
@@ -5209,7 +5990,8 @@ function rollupRows(issues, c) {
   const lines = [];
   for (const issue of issues) {
     const sev = issue.severity === "error" ? c(ANSI2.red, "error") : issue.severity === "warning" ? c(ANSI2.yellow, "warn ") : c(ANSI2.dim, "info ");
-    lines.push(`  ${sev} ${c(ANSI2.cyan, issue.ruleId)} ${c(ANSI2.dim, `\xD7${issue.count}`)}`);
+    const rigor = issue.rigor ? c(ANSI2.dim, ` [${issue.rigor}]`) : "";
+    lines.push(`  ${sev} ${c(ANSI2.cyan, issue.ruleId)}${rigor} ${c(ANSI2.dim, `\xD7${issue.count}`)}`);
     if (issue.why) lines.push(`    ${c(ANSI2.dim, stripBackticks2(issue.why))}`);
     if (issue.fix) {
       const [head, ...rest] = issue.fix.split("\n");
@@ -5288,6 +6070,7 @@ function rollupByRule(issues) {
       groups.set(issue.ruleId, {
         ruleId: issue.ruleId,
         severity: issue.severity,
+        rigor: issue.rigor,
         why: issue.why,
         fix: issue.fix,
         sample: issue.message,
@@ -5506,4 +6289,4 @@ export {
   summarize,
   Logger
 };
-//# sourceMappingURL=chunk-TAZEAIFI.js.map
+//# sourceMappingURL=chunk-DKGBLJ4H.js.map