@goflag/cli 0.2.9 → 0.2.11

package/dist/{chunk-TAZEAIFI.js → chunk-CWEJ6EXT.js}

@@ -816,53 +816,111 @@ async function probeManifest(href, options = {}) {
   }
 }
 
+// src/lib/core/robots/parse.ts
+var RULE_DIRECTIVES = /* @__PURE__ */ new Set(["allow", "disallow"]);
+var KNOWN_EXTENSIONS = /* @__PURE__ */ new Set(["crawl-delay", "host", "clean-param", "request-rate", "noindex"]);
+function parseRobots(body) {
+  const groups = [];
+  const sitemaps = [];
+  const invalidLines = [];
+  const unknownDirectives = [];
+  let current;
+  let currentTookRule = false;
+  const lines = body.split(/\r\n|\r|\n/);
+  for (const [index, rawLine] of lines.entries()) {
+    const line = index + 1;
+    const withoutComment = rawLine.replace(/#.*$/, "");
+    const trimmed = withoutComment.trim();
+    if (trimmed.length === 0) continue;
+    const separator = trimmed.indexOf(":");
+    if (separator === -1) {
+      invalidLines.push({ line, raw: rawLine, reason: "no `:` separator" });
+      continue;
+    }
+    const name = trimmed.slice(0, separator).trim().toLowerCase();
+    const value = trimmed.slice(separator + 1).trim();
+    if (name === "user-agent") {
+      if (value.length === 0) {
+        invalidLines.push({ line, raw: rawLine, reason: "empty `User-agent`" });
+        continue;
+      }
+      if (!current || currentTookRule) {
+        current = { userAgents: [], rules: [] };
+        groups.push(current);
+        currentTookRule = false;
+      }
+      current.userAgents.push({ value: value.toLowerCase(), line });
+      continue;
+    }
+    if (name === "sitemap") {
+      if (value.length === 0) {
+        invalidLines.push({ line, raw: rawLine, reason: "empty `Sitemap`" });
+        continue;
+      }
+      sitemaps.push({ value, line });
+      continue;
+    }
+    if (RULE_DIRECTIVES.has(name)) {
+      if (!current) {
+        invalidLines.push({
+          line,
+          raw: rawLine,
+          reason: `\`${name}\` before any \`User-agent\` group`
+        });
+        continue;
+      }
+      current.rules.push({ kind: name, pattern: value, line });
+      currentTookRule = true;
+      continue;
+    }
+    if (KNOWN_EXTENSIONS.has(name)) {
+      unknownDirectives.push({ name, line });
+      continue;
+    }
+    invalidLines.push({ line, raw: rawLine, reason: `unknown directive \`${name}\`` });
+  }
+  return { groups, sitemaps, invalidLines, unknownDirectives };
+}
+
 // src/lib/core/probes/robots.ts
 async function probeRobots(origin, options = {}) {
   const url = new URL("/robots.txt", origin).toString();
   const { signal, cleanup } = combineSignals(options.signal, options.timeoutMs ?? 5e3);
+  const empty = { groups: [], sitemaps: [], invalidLines: [], unknownDirectives: [] };
+  const noRedirect = { count: 0, finalUrl: url, crossOrigin: false };
   try {
     const res = await fetch(url, { signal, redirect: "follow" });
+    const redirected = res.url !== url;
+    const redirects = {
+      count: redirected ? 1 : 0,
+      finalUrl: res.url || url,
+      crossOrigin: redirected && !sameOrigin(res.url, url)
+    };
     if (!res.ok) {
-      return { url, status: res.status, found: false, sitemaps: [], blocksAll: false };
+      return { url, status: res.status, found: false, byteLength: 0, redirects, ...empty };
     }
-    const body = await res.text();
+    const raw = await res.text();
     return {
       url,
       status: res.status,
       found: true,
-      raw: body,
-      sitemaps: extractSitemaps(body),
-      blocksAll: blocksAllUserAgents(body)
+      raw,
+      byteLength: Buffer.byteLength(raw, "utf8"),
+      redirects,
+      ...parseRobots(raw)
     };
   } catch {
-    return { url, status: 0, found: false, sitemaps: [], blocksAll: false };
+    return { url, status: 0, found: false, byteLength: 0, redirects: noRedirect, ...empty };
   } finally {
     cleanup();
   }
 }
-function extractSitemaps(body) {
-  const out = [];
-  for (const line of body.split(/\r?\n/)) {
-    const m = /^\s*Sitemap:\s*(\S+)\s*$/i.exec(line);
-    if (m?.[1]) out.push(m[1]);
-  }
-  return out;
-}
-function blocksAllUserAgents(body) {
-  let inWildcard = false;
-  for (const rawLine of body.split(/\r?\n/)) {
-    const line = rawLine.replace(/#.*$/, "").trim();
-    if (line.length === 0) continue;
-    const ua = /^User-agent:\s*(.+)$/i.exec(line);
-    if (ua) {
-      inWildcard = ua[1].trim() === "*";
-      continue;
-    }
-    if (!inWildcard) continue;
-    const dis = /^Disallow:\s*(.*)$/i.exec(line);
-    if (dis && dis[1].trim() === "/") return true;
+function sameOrigin(a, b) {
+  try {
+    return new URL(a).origin === new URL(b).origin;
+  } catch {
+    return true;
   }
-  return false;
 }
 
 // src/lib/core/probes/sitemap.ts
@@ -1293,7 +1351,14 @@ function findingsToIssues(result, rules) {
       severity: finding.severity ?? "info",
       message: finding.message ?? `Expected ${finding.expected}.`,
       origin: finding.origin,
-      fix: byId.get(finding.ruleId)?.fix
+      fix: byId.get(finding.ruleId)?.fix,
+      // The finding has known all four since it was evaluated; this is where
+      // they used to stop. A report that drops the rigor asks every consumer
+      // to re-derive it from a registry it does not have.
+      rigor: finding.rigor,
+      sources: finding.sources,
+      observed: finding.observed,
+      expected: finding.expected
     });
   }
   for (const crash of result.crashes) {
@@ -2594,6 +2659,70 @@ function sortLocales(locales) {
   return [...xDefault, ...rest];
 }
 
+// src/lib/core/robots/match.ts
+function robotsAllows(groups, path, userAgent = "*") {
+  const group = selectGroup(groups, userAgent);
+  if (!group) return { allowed: true };
+  const token = group.userAgents[0]?.value ?? "*";
+  let best;
+  let bestLength = -1;
+  for (const rule of group.rules) {
+    if (rule.pattern.length === 0) continue;
+    if (!patternMatches(rule.pattern, path)) continue;
+    const length = octetLength(rule.pattern);
+    if (length > bestLength) {
+      best = rule;
+      bestLength = length;
+      continue;
+    }
+    if (length === bestLength && rule.kind === "allow") best = rule;
+  }
+  if (!best) return { allowed: true, group: token };
+  return { allowed: best.kind === "allow", rule: best, group: token };
+}
+function selectGroup(groups, userAgent) {
+  const wanted = userAgent.trim().toLowerCase();
+  let bestToken;
+  for (const group of groups) {
+    for (const agent of group.userAgents) {
+      if (agent.value === "*") continue;
+      if (!wanted.startsWith(agent.value)) continue;
+      if (bestToken === void 0 || agent.value.length > bestToken.length) {
+        bestToken = agent.value;
+      }
+    }
+  }
+  const token = bestToken ?? "*";
+  const matching = groups.filter(
+    (group) => group.userAgents.some((agent) => agent.value === token)
+  );
+  if (matching.length === 0) return void 0;
+  if (matching.length === 1) return matching[0];
+  return {
+    userAgents: matching.flatMap((group) => group.userAgents),
+    rules: matching.flatMap((group) => group.rules)
+  };
+}
+function patternMatches(pattern, path) {
+  const anchored = pattern.endsWith("$");
+  const body = anchored ? pattern.slice(0, -1) : pattern;
+  const source = body.split("*").map((literal) => escapeRegExp(normalizeOctets(literal))).join(".*");
+  return new RegExp(`^${source}${anchored ? "$" : ""}`).test(normalizeOctets(path));
+}
+function normalizeOctets(value) {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return value;
+  }
+}
+function octetLength(pattern) {
+  return Buffer.byteLength(normalizeOctets(pattern), "utf8");
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
 // src/lib/rules/site-rules.ts
 function isMultilingual(site) {
   return site.localeAxis.multilingual;
@@ -2612,6 +2741,7 @@ function rowOf(site, url, pathname) {
 }
 function sitemapLocalesByRoute(site) {
   const byRoute = /* @__PURE__ */ new Map();
+  const axis = new Set(site.localeAxis.locales.map((l) => l.toLowerCase()));
   for (const entry of site.discovery?.urls ?? []) {
     let pathname;
     try {
@@ -2621,6 +2751,7 @@ function sitemapLocalesByRoute(site) {
     }
     const { locale } = splitRoute(pathname);
     if (locale === "x-default") continue;
+    if (!axis.has(locale.toLowerCase())) continue;
     const route = rowOf(site, entry.loc, pathname);
     const set = byRoute.get(route) ?? /* @__PURE__ */ new Set();
     set.add(locale.toLowerCase());
@@ -2635,6 +2766,8 @@ var hreflangMissing = {
   id: "hreflang.missing",
   severity: "error",
   summary: "Pages on a multilingual site must advertise their locale alternates",
+  rigor: "vendor-spec",
+  sources: ["google-hreflang", "whatwg-html-link-types"],
   appliesTo: isMultilingual,
   check: ({ site, issue }) => {
     const locales = site.localeAxis.locales.join(", ");
@@ -2668,62 +2801,57 @@ var hreflangMissing = {
     );
   }
 };
-var hreflangSitemapMismatch = {
-  id: "hreflang.sitemap-mismatch",
-  severity: "warning",
-  summary: "`<head>` alternates and sitemap locale coverage must agree",
-  appliesTo: (site) => isMultilingual(site) && (site.discovery?.urls.length ?? 0) > 0,
-  check: ({ site, issue }) => {
-    const bySitemap = sitemapLocalesByRoute(site);
-    const findings = [];
-    for (const page of site.pages) {
-      const head = declaredLocales(page);
-      if (head.size === 0) continue;
-      let pathname;
-      try {
-        pathname = new URL(page.fetch.finalUrl).pathname;
-      } catch {
-        continue;
-      }
-      const route = rowOf(site, page.fetch.finalUrl, pathname);
-      const inSitemap = bySitemap.get(route);
-      if (!inSitemap || inSitemap.size === 0) continue;
-      const onlyInSitemap = sorted(new Set([...inSitemap].filter((l) => !head.has(l))));
-      const onlyInHead = sorted(new Set([...head].filter((l) => !inSitemap.has(l))));
-      if (onlyInSitemap.length === 0 && onlyInHead.length === 0) continue;
-      const parts = [];
-      if (onlyInSitemap.length > 0) {
-        parts.push(
-          `the sitemap lists ${onlyInSitemap.join(", ")} but the \`<head>\` does not advertise ${onlyInSitemap.length > 1 ? "them" : "it"}`
-        );
-      }
-      if (onlyInHead.length > 0) {
-        parts.push(
-          `the \`<head>\` advertises ${onlyInHead.join(", ")} but the sitemap has no entry for ${onlyInHead.length > 1 ? "them" : "it"}`
-        );
-      }
-      findings.push(
-        issue({
-          pageUrl: page.fetch.finalUrl,
-          message: `Route \`${route}\`: ${parts.join("; ")}. Both are derived from the same intent and must not disagree.`,
-          origin: { kind: "link", rel: "alternate" },
-          fix: {
-            title: "Derive both from one locale-availability source",
-            snippet: [
-              "// Compute availability once, feed both the <head> and the sitemap.",
-              "const localesFor = (slug: string) =>",
-              "  allDocs.filter((d) => d.slug === slug && !d.draft).map((d) => d.locale);",
-              "",
-              "// generateMetadata(): alternates.languages \u2190 localesFor(slug)",
-              "// sitemap.ts:        alternates.languages \u2190 localesFor(slug)"
-            ].join("\n"),
-            language: "ts"
-          }
-        })
-      );
+function coverageGaps(site) {
+  const bySitemap = sitemapLocalesByRoute(site);
+  const gaps = [];
+  for (const page of site.pages) {
+    const head = declaredLocales(page);
+    if (head.size === 0) continue;
+    let pathname;
+    try {
+      pathname = new URL(page.fetch.finalUrl).pathname;
+    } catch {
+      continue;
     }
-    return findings;
+    const route = rowOf(site, page.fetch.finalUrl, pathname);
+    const inSitemap = bySitemap.get(route);
+    if (!inSitemap || inSitemap.size === 0) continue;
+    gaps.push({
+      page,
+      route,
+      onlyInSitemap: sorted(new Set([...inSitemap].filter((l) => !head.has(l))))
+    });
   }
+  return gaps;
+}
+var ONE_SOURCE_FIX = {
+  title: "Derive both from one locale-availability source",
+  snippet: [
+    "// Compute availability once, feed both the <head> and the sitemap.",
+    "const localesFor = (slug: string) =>",
+    "  allDocs.filter((d) => d.slug === slug && !d.draft).map((d) => d.locale);",
+    "",
+    "// generateMetadata(): alternates.languages \u2190 localesFor(slug)",
+    "// sitemap.ts:        alternates.languages \u2190 localesFor(slug)"
+  ].join("\n"),
+  language: "ts"
+};
+var bothApply = (site) => isMultilingual(site) && (site.discovery?.urls.length ?? 0) > 0;
+var hreflangClusterIncomplete = {
+  id: "hreflang.cluster-incomplete",
+  severity: "warning",
+  summary: "Every locale the sitemap publishes must appear in the route's `hreflang` cluster",
+  rigor: "vendor-spec",
+  sources: ["google-hreflang"],
+  appliesTo: bothApply,
+  check: ({ site, issue }) => coverageGaps(site).filter((gap) => gap.onlyInSitemap.length > 0).map(
+    ({ page, route, onlyInSitemap }) => issue({
+      pageUrl: page.fetch.finalUrl,
+      message: `Route \`${route}\`: the sitemap lists ${onlyInSitemap.join(", ")} but the \`<head>\` does not advertise ${onlyInSitemap.length > 1 ? "them" : "it"}. The site publishes ${onlyInSitemap.length > 1 ? "those versions" : "that version"} and leaves ${onlyInSitemap.length > 1 ? "them" : "it"} outside the cluster, so ${onlyInSitemap.length > 1 ? "they compete" : "it competes"} with this page instead of consolidating with it.`,
+      origin: { kind: "link", rel: "alternate" },
+      fix: ONE_SOURCE_FIX
+    })
+  )
 };
 function metaRobotsTokens(page) {
   const raw = page.meta.robots?.value ?? "";
@@ -2735,7 +2863,9 @@ var robotsBlocksSite = {
   id: "robots.blocks-site",
   severity: "error",
   summary: "`robots.txt` must not forbid crawling a site that asks to be indexed",
-  appliesTo: (site) => site.robots?.found === true && site.robots.blocksAll,
+  rigor: "vendor-spec",
+  sources: ["ietf-rfc9309", "google-robots-intro"],
+  appliesTo: (site) => site.robots?.found === true && !robotsAllows(site.robots.groups, "/").allowed,
   check: ({ site, issue }) => {
     const robotsUrl = site.robots?.url ?? `${site.origin}/robots.txt`;
     const asking = site.pages.filter((page) => metaRobotsTokens(page).has("index"));
@@ -2801,106 +2931,764 @@ var iconsIcoMissing = {
     });
   }
 };
-var SITE_RULES = [
-  hreflangMissing,
-  hreflangSitemapMismatch,
-  iconsIcoMissing,
-  robotsBlocksSite
-];
-function getSiteRule(id) {
-  return SITE_RULES.find((rule) => rule.id === id);
-}
-
-// src/lib/core/lint-site.ts
-function lintSite(site, rules = SITE_RULES) {
-  const drafts = [];
-  for (const rule of rules) {
-    if (rule.appliesTo && !rule.appliesTo(site)) continue;
-    let result;
-    try {
-      result = rule.check({
-        site,
-        issue: (input) => ({
-          ruleId: rule.id,
-          severity: input.severity ?? rule.severity,
-          message: input.message,
-          origin: input.origin,
-          fix: input.fix,
-          suggestion: input.suggestion,
-          pageUrl: input.pageUrl
-        })
-      });
-    } catch (err) {
-      drafts.push({
-        ruleId: "engine.site-rule-crashed",
-        severity: "info",
-        message: `Site rule \`${rule.id}\` threw: ${err instanceof Error ? err.message : String(err)}`,
-        pageUrl: site.origin
+var ROBOTS_BYTE_LIMIT = 500 * 1024;
+var robotstxtUnreachable = {
+  id: "robotstxt.unreachable",
+  severity: "error",
+  summary: "A robots.txt that errors is read as forbidding the whole site",
+  rigor: "spec-required",
+  sources: ["ietf-rfc9309"],
+  // A 404 is not a failure: §2.3.1.3 says an absent file allows everything,
+  // and most sites that have none mean exactly that. Only a server that
+  // answered badly, or did not answer, triggers the disallow-everything rule.
+  appliesTo: (site) => site.robots !== void 0 && isRobotsFailure(site.robots.status),
+  check: ({ site, issue }) => {
+    const probe = site.robots;
+    const detail = probe.status === 0 ? "the request failed" : `the origin answered ${probe.status}`;
+    return issue({
+      pageUrl: probe.url,
+      message: `\`robots.txt\` could not be read: ${detail}. RFC 9309 \xA72.3.1.4 tells a crawler to assume a complete disallow for as long as this lasts \u2014 an outage on this one file takes the whole site out of the index.`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+var robotstxtOversized = {
+  id: "robotstxt.oversized",
+  severity: "error",
+  summary: "Rules past 500 KiB of robots.txt are not guaranteed to be read",
+  rigor: "spec-required",
+  sources: ["ietf-rfc9309"],
+  appliesTo: (site) => (site.robots?.byteLength ?? 0) > ROBOTS_BYTE_LIMIT,
+  check: ({ site, issue }) => {
+    const probe = site.robots;
+    const kib = Math.round(probe.byteLength / 1024);
+    return issue({
+      pageUrl: probe.url,
+      message: `\`robots.txt\` is ${kib} KiB. A parser is only required to honour the first 500 KiB (RFC 9309 \xA72.4), so every rule past that point silently does not exist.`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+var robotstxtInvalidLine = {
+  id: "robotstxt.invalid-line",
+  severity: "warning",
+  summary: "Every line of robots.txt should parse as something",
+  rigor: "spec-required",
+  sources: ["ietf-rfc9309"],
+  appliesTo: (site) => (site.robots?.invalidLines.length ?? 0) > 0,
+  check: ({ site, issue }) => {
+    const probe = site.robots;
+    const shown = probe.invalidLines.slice(0, 5);
+    const rest = probe.invalidLines.length - shown.length;
+    return issue({
+      pageUrl: probe.url,
+      message: `\`robots.txt\` has ${probe.invalidLines.length} line${probe.invalidLines.length === 1 ? "" : "s"} that parse as nothing: ` + shown.map((l) => `line ${l.line} (${l.reason})`).join(", ") + `${rest > 0 ? `, and ${rest} more` : ""}. A crawler drops them silently, so the rule you meant to write is simply absent.`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+var robotstxtUnknownDirective = {
+  id: "robotstxt.unknown-directive",
+  severity: "info",
+  summary: "Non-standard robots.txt directives are read by some crawlers and ignored by others",
+  rigor: "guideline",
+  sources: ["ietf-rfc9309", "google-robots-intro"],
+  appliesTo: (site) => (site.robots?.unknownDirectives.length ?? 0) > 0,
+  check: ({ site, issue }) => {
+    const probe = site.robots;
+    const names = [...new Set(probe.unknownDirectives.map((d) => d.name))];
+    return issue({
+      pageUrl: probe.url,
+      message: `\`robots.txt\` uses ${names.map((n) => `\`${n}\``).join(", ")}, which RFC 9309 does not define. Some crawlers honour ${names.length === 1 ? "it" : "them"} and Google ignores ${names.length === 1 ? "it" : "them"} \u2014 so this is worth knowing, not necessarily worth changing.`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+var robotstxtCrossOrigin = {
+  id: "robotstxt.cross-origin",
+  severity: "warning",
+  summary: "`/robots.txt` should not redirect to another origin",
+  rigor: "vendor-spec",
+  sources: ["ietf-rfc9309"],
+  appliesTo: (site) => site.robots?.redirects.crossOrigin === true,
+  check: ({ site, issue }) => {
+    const probe = site.robots;
+    return issue({
+      pageUrl: probe.url,
+      message: `\`robots.txt\` redirects to \`${probe.redirects.finalUrl}\`, on another origin. RFC 9309 \xA72.3.1.2 permits following it, so this works \u2014 but the policy for this site now lives somewhere this site does not control, and it is usually a proxy accident rather than a decision.`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+var robotstxtSitemapRelative = {
+  id: "robotstxt.sitemap.relative",
+  severity: "error",
+  summary: "A `Sitemap:` declaration must be an absolute URL",
+  rigor: "spec-required",
+  sources: ["sitemaps-protocol", "ietf-rfc9309"],
+  appliesTo: (site) => (site.robots?.sitemaps ?? []).some((s) => !isAbsolute(s.value)),
+  check: ({ site, issue }) => {
+    const probe = site.robots;
+    const relative = probe.sitemaps.filter((s) => !isAbsolute(s.value));
+    return issue({
+      pageUrl: probe.url,
+      message: `\`Sitemap:\` must be a full URL: ${relative.map((s) => `line ${s.line} declares \`${s.value}\``).join(", ")}. robots.txt is fetched on its own, so there is no page for a consumer to resolve a relative path against.`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+var robotsBlocksPage = {
+  id: "robots.blocks-page",
+  severity: "error",
+  summary: "A page asking to be indexed must not be disallowed by robots.txt",
+  rigor: "vendor-spec",
+  sources: ["ietf-rfc9309", "google-robots-intro"],
+  appliesTo: (site) => site.robots?.found === true && robotsAllows(site.robots.groups, "/").allowed,
+  check: ({ site, issue }) => {
+    const probe = site.robots;
+    return site.pages.flatMap((page) => {
+      if (!metaRobotsTokens(page).has("index")) return [];
+      let path;
+      try {
+        const url = new URL(page.fetch.finalUrl);
+        path = `${url.pathname}${url.search}`;
+      } catch {
+        return [];
+      }
+      const decision = robotsAllows(probe.groups, path);
+      if (decision.allowed || !decision.rule) return [];
+      return issue({
+        pageUrl: page.fetch.finalUrl,
+        message: `Page declares \`<meta name="robots" content="index">\` but \`robots.txt\` line ${decision.rule.line} disallows \`${decision.rule.pattern}\` for \`${decision.group}\`. robots.txt wins: the page is never fetched, so the tag asking for it is never read.`,
+        origin: { kind: "computed" }
       });
-      continue;
-    }
-    if (!result) continue;
-    if (Array.isArray(result)) drafts.push(...result);
-    else drafts.push(result);
+    });
   }
-  return sortSiteIssues(drafts);
-}
-function sortSiteIssues(drafts) {
-  const byPage = [...drafts].sort((a, b) => a.pageUrl.localeCompare(b.pageUrl));
-  return sortIssues(byPage);
-}
-
-// src/lib/core/locales.ts
-function localePrefixOf(url) {
-  let pathname;
-  try {
-    pathname = new URL(url).pathname;
-  } catch {
-    return null;
+};
+var CHANGEFREQ = /* @__PURE__ */ new Set(["always", "hourly", "daily", "weekly", "monthly", "yearly", "never"]);
+var SAMPLE = 5;
+function sample(locs) {
+  const shown = locs.slice(0, SAMPLE);
+  const rest = locs.length - shown.length;
+  return `${shown.map((l) => `\`${l}\``).join(", ")}${rest > 0 ? `, and ${rest} more` : ""}`;
+}
+var sitemapMissing = {
+  id: "sitemap.missing",
+  severity: "warning",
+  summary: "A site should publish a sitemap",
+  rigor: "guideline",
+  sources: ["sitemaps-protocol", "google-sitemaps"],
+  // A warning rather than an error, and the plan settles it: a small, fully
+  // linked site genuinely may not need one. Google's own guidance says
+  // "usually worth having", which is exactly a guideline.
+  appliesTo: (site) => site.discovery !== void 0 && !site.discovery.diagnostics.found,
+  check: ({ site, issue }) => issue({
+    pageUrl: `${site.origin}/sitemap.xml`,
+    message: "No sitemap was found \u2014 not declared in `robots.txt`, and not at a well-known path. Discovery then depends entirely on what links to what, which is the part of a site nobody audits.",
+    origin: { kind: "computed" }
+  })
+};
+var sitemapUnparsable = {
+  id: "sitemap.unparsable",
+  severity: "error",
+  summary: "A located sitemap must be a well-formed `<urlset>` or `<sitemapindex>`",
+  rigor: "spec-required",
+  sources: ["sitemaps-protocol"],
+  appliesTo: (site) => site.discovery?.diagnostics.found === true && !site.discovery.diagnostics.wellFormed,
+  check: ({ site, issue }) => {
+    const diagnostics = site.discovery.diagnostics;
+    return issue({
+      pageUrl: diagnostics.sitemapUrl ?? `${site.origin}/sitemap.xml`,
+      message: "A sitemap was served but does not parse as XML. The usual cause is an HTML error page answered with a 200 \u2014 which reads as a healthy sitemap to anything that only checks the status.",
+      origin: { kind: "computed" }
+    });
   }
-  const first = pathname.split("/").filter(Boolean)[0];
-  if (first && looksLikeLocaleSegment(first)) return first.toLowerCase();
-  return null;
-}
-function prefixesIn(urls) {
-  const out = /* @__PURE__ */ new Set();
-  for (const url of urls ?? []) {
-    const locale = localePrefixOf(url);
-    if (locale) out.add(locale);
+};
+var sitemapEmpty = {
+  id: "sitemap.empty",
+  severity: "warning",
+  summary: "A sitemap that parses should list something",
+  rigor: "guideline",
+  sources: ["sitemaps-protocol"],
+  // Only when the crawl found pages: an empty sitemap on a site with no pages
+  // is consistent, and saying otherwise would be noise.
+  appliesTo: (site) => site.discovery?.diagnostics.wellFormed === true && site.discovery.urls.length === 0 && site.pages.length > 0,
+  check: ({ site, issue }) => {
+    const diagnostics = site.discovery.diagnostics;
+    return issue({
+      pageUrl: diagnostics.sitemapUrl ?? `${site.origin}/sitemap.xml`,
+      message: `The sitemap parses and lists no URLs, while the crawl found ${site.pages.length}. goflag falls back to crawling \u2014 a consumer that trusts the sitemap has nothing to read.`,
+      origin: { kind: "computed" }
+    });
   }
-  out.delete("x-default");
-  return out;
-}
-function describeCandidates(pages) {
-  const byTag = /* @__PURE__ */ new Map();
-  for (const page of pages) {
-    const tag = localePrefixOf(page.fetch.finalUrl);
-    if (!tag || tag === "x-default") continue;
-    const entry = byTag.get(tag) ?? { pages: 0, langs: /* @__PURE__ */ new Set() };
-    entry.pages += 1;
-    const lang = page.raw.htmlLang?.trim().toLowerCase();
-    if (lang) entry.langs.add(lang);
-    byTag.set(tag, entry);
+};
+var sitemapIndexChildError = {
+  id: "sitemap.index.child-error",
+  severity: "error",
+  summary: "Every child of a sitemap index must be reachable and parseable",
+  rigor: "spec-required",
+  sources: ["sitemaps-protocol"],
+  appliesTo: (site) => (site.discovery?.diagnostics.childSitemapErrors ?? 0) > 0,
+  check: ({ site, issue }) => {
+    const diagnostics = site.discovery.diagnostics;
+    const total = diagnostics.childSitemapCount;
+    return issue({
+      pageUrl: diagnostics.sitemapUrl ?? `${site.origin}/sitemap.xml`,
+      message: `${diagnostics.childSitemapErrors} of ${total} child sitemaps could not be read. The index declares an inventory and part of it is missing, so whatever those documents listed is invisible \u2014 and nothing says how much that is.`,
+      origin: { kind: "computed" }
+    });
   }
-  const candidates = [];
-  for (const [tag, { pages: n, langs }] of byTag) {
-    const observedLangs = [...langs].sort();
-    const htmlLangAgrees = observedLangs.length === 0 ? void 0 : observedLangs.some((l) => l.split("-")[0] === tag.split("-")[0]);
-    candidates.push({
-      tag,
-      pages: n,
-      isKnownLanguage: isKnownLanguageTag(tag),
-      htmlLangAgrees,
-      observedLangs
+};
+var sitemapEntryInvalidUrl = {
+  id: "sitemap.entry.invalid-url",
+  severity: "error",
+  summary: "Every `<loc>` must be an absolute, parseable URL",
+  rigor: "spec-required",
+  sources: ["sitemaps-protocol"],
+  appliesTo: (site) => (site.discovery?.urls ?? []).some((entry) => !isAbsolute(entry.loc)),
+  check: ({ site, issue }) => {
+    const bad = site.discovery.urls.filter((entry) => !isAbsolute(entry.loc));
+    return issue({
+      pageUrl: site.discovery.diagnostics.sitemapUrl ?? `${site.origin}/sitemap.xml`,
+      message: `${bad.length} \`<loc>\` value${bad.length === 1 ? " is" : "s are"} not an absolute URL: ${sample(bad.map((e) => e.loc))}. A sitemap is fetched on its own, so a consumer has nothing to resolve them against.`,
+      origin: { kind: "computed" }
     });
   }
-  return candidates.sort(
-    (a, b) => Number(b.htmlLangAgrees ?? false) - Number(a.htmlLangAgrees ?? false) || Number(b.isKnownLanguage) - Number(a.isKnownLanguage) || b.pages - a.pages || a.tag.localeCompare(b.tag)
+};
+var DOCUMENT_URL_LIMIT = 5e4;
+var DOCUMENT_BYTE_LIMIT = 52428800;
+function declaredCount(doc) {
+  return doc.kind === "index" ? doc.childLocs.length : doc.urlCount;
+}
+function oversizedDocuments(site) {
+  return (site.discovery?.documents ?? []).filter(
+    (doc) => doc.kind !== "unparsable" && (declaredCount(doc) > DOCUMENT_URL_LIMIT || doc.byteLength > DOCUMENT_BYTE_LIMIT)
   );
 }
-function deriveLocaleAxis(input) {
-  const explicit = new Set(
-    (input.explicit ?? []).map((l) => l.trim().toLowerCase()).filter(Boolean)
+var sitemapLimitsExceeded = {
+  id: "sitemap.limits.exceeded",
+  severity: "error",
+  summary: "No single sitemap document may exceed 50,000 entries or 50 MB",
+  rigor: "spec-required",
+  sources: ["sitemaps-protocol"],
+  appliesTo: (site) => oversizedDocuments(site).length > 0,
+  check: ({ site, issue }) => oversizedDocuments(site).map((doc) => {
+    const count2 = declaredCount(doc);
+    const noun = doc.kind === "index" ? "child sitemaps" : "URLs";
+    const over = [];
+    if (count2 > DOCUMENT_URL_LIMIT) {
+      over.push(`${count2.toLocaleString("en-US")} ${noun} against a ceiling of 50,000`);
+    }
+    if (doc.byteLength > DOCUMENT_BYTE_LIMIT) {
+      over.push(
+        `${(doc.byteLength / 1048576).toFixed(1)} MB uncompressed against a ceiling of 50 MB`
+      );
+    }
+    return issue({
+      pageUrl: doc.url,
+      message: `This sitemap document declares ${over.join(" and ")}. A consumer may stop reading at the limit, so everything past it is published in name only \u2014 split the document and reference the parts from an index.`,
+      origin: { kind: "computed" }
+    });
+  })
+};
+function outOfScopeEntries(site) {
+  const out = [];
+  for (const entry of site.discovery?.urls ?? []) {
+    if (!entry.documentUrl) continue;
+    let scope;
+    let loc;
+    try {
+      scope = new URL(entry.documentUrl);
+      loc = new URL(entry.loc);
+    } catch {
+      continue;
+    }
+    const prefix = scope.pathname.replace(/[^/]*$/, "");
+    if (prefix === "/") continue;
+    if (loc.origin !== scope.origin) continue;
+    if (loc.pathname.startsWith(prefix)) continue;
+    out.push({ loc: entry.loc, from: entry.documentUrl });
+  }
+  return out;
+}
+var sitemapEntryOutOfScope = {
+  id: "sitemap.entry.out-of-scope",
+  severity: "error",
+  summary: "A sitemap may only list URLs under its own directory",
+  rigor: "spec-required",
+  sources: ["sitemaps-protocol"],
+  appliesTo: (site) => outOfScopeEntries(site).length > 0,
+  check: ({ site, issue }) => {
+    const bad = outOfScopeEntries(site);
+    const byDocument = /* @__PURE__ */ new Map();
+    for (const { loc, from } of bad) {
+      byDocument.set(from, [...byDocument.get(from) ?? [], loc]);
+    }
+    return [...byDocument].map(
+      ([from, locs]) => issue({
+        pageUrl: from,
+        message: `${locs.length} entr${locs.length === 1 ? "y is" : "ies are"} outside this sitemap's directory \`${new URL(from).pathname.replace(/[^/]*$/, "")}\`: ${sample(locs)}. A sitemap only speaks for the path it is served from, so a consumer may drop ${locs.length === 1 ? "it" : "them"} \u2014 serve the document from the root, or move the entries into a sitemap that covers them.`,
+        origin: { kind: "computed" }
+      })
+    );
+  }
+};
+var sitemapEntryCrossHost = {
+  id: "sitemap.entry.cross-host",
+  severity: "error",
+  summary: "A sitemap should only list URLs on its own host",
+  rigor: "spec-required",
+  sources: ["sitemaps-protocol"],
+  // `www` and the apex are different hosts to a consumer, which is the case
+  // this actually catches: a sitemap generated against one and served on the
+  // other. The cross-submission escape hatch needs the other host's robots.txt
+  // and arrives with the cross-artefact rules.
+  appliesTo: (site) => crossHostEntries(site).length > 0,
+  check: ({ site, issue }) => {
+    const bad = crossHostEntries(site);
+    return issue({
+      pageUrl: site.discovery.diagnostics.sitemapUrl ?? `${site.origin}/sitemap.xml`,
+      message: `${bad.length} entr${bad.length === 1 ? "y names a host" : "ies name hosts"} other than this sitemap's: ${sample(bad)}. A consumer may drop them \u2014 the sitemap only speaks for the host that serves it.`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+var sitemapEntryProtocolMismatch = {
+  id: "sitemap.entry.protocol-mismatch",
+  severity: "warning",
+  summary: "A sitemap should not mix `http` and `https` entries",
+  rigor: "spec-required",
+  sources: ["sitemaps-protocol"],
+  appliesTo: (site) => protocolsIn(site).size > 1,
+  check: ({ site, issue }) => {
+    const protocols = [...protocolsIn(site)].sort();
+    return issue({
+      pageUrl: site.discovery.diagnostics.sitemapUrl ?? `${site.origin}/sitemap.xml`,
+      message: `The sitemap lists both ${protocols.join(" and ")} URLs. One of the two sets names pages the site does not serve at those addresses, and a consumer has no way to tell which.`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+var sitemapLastmodInvalid = {
+  id: "sitemap.lastmod.invalid",
+  severity: "warning",
+  summary: "`<lastmod>` must be a W3C Datetime, and must not be in the future",
+  rigor: "spec-required",
+  sources: ["sitemaps-protocol", "google-sitemaps"],
+  appliesTo: (site) => badLastmods(site).length > 0,
+  check: ({ site, issue }) => {
+    const bad = badLastmods(site);
+    const malformed = bad.filter((e) => e.reason === "malformed");
+    const future = bad.filter((e) => e.reason === "future");
+    const parts = [];
+    if (malformed.length > 0) {
+      parts.push(
+        `${malformed.length} not a W3C Datetime (${sample(malformed.map((e) => e.value))})`
+      );
+    }
+    if (future.length > 0) {
+      parts.push(`${future.length} dated in the future (${sample(future.map((e) => e.value))})`);
+    }
+    return issue({
+      pageUrl: site.discovery.diagnostics.sitemapUrl ?? `${site.origin}/sitemap.xml`,
+      message: `\`<lastmod>\` values a consumer cannot use: ${parts.join("; ")}. Google ignores the field entirely when it stops trusting it, so one bad batch costs the whole site the signal.`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+var sitemapFieldInvalid = {
+  id: "sitemap.field.invalid",
+  severity: "warning",
+  summary: "`<changefreq>` and `<priority>` must hold the values the protocol defines",
+  rigor: "spec-required",
+  sources: ["sitemaps-protocol", "google-sitemaps"],
+  appliesTo: (site) => badFields(site).length > 0,
+  check: ({ site, issue }) => {
+    const bad = badFields(site);
+    return issue({
+      pageUrl: site.discovery.diagnostics.sitemapUrl ?? `${site.origin}/sitemap.xml`,
+      message: `${bad.length} entr${bad.length === 1 ? "y carries a field" : "ies carry fields"} outside the protocol's values: ${sample(bad)}. Google ignores both fields either way \u2014 so this is worth fixing or deleting, never worth trusting.`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+function sitemapHost(site) {
+  const url = site.discovery?.diagnostics.sitemapUrl;
+  try {
+    return url ? new URL(url).host : new URL(site.origin).host;
+  } catch {
+    return void 0;
+  }
+}
+function crossHostEntries(site) {
+  const host = sitemapHost(site);
+  if (!host) return [];
+  return (site.discovery?.urls ?? []).filter((entry) => {
+    if (!isAbsolute(entry.loc)) return false;
+    try {
+      return new URL(entry.loc).host !== host;
+    } catch {
+      return false;
+    }
+  }).map((entry) => entry.loc);
+}
+function protocolsIn(site) {
+  const protocols = /* @__PURE__ */ new Set();
+  for (const entry of site.discovery?.urls ?? []) {
+    try {
+      protocols.add(new URL(entry.loc).protocol.replace(":", ""));
+    } catch {
+      continue;
+    }
+  }
+  return protocols;
+}
+var W3C_DATETIME = /^\d{4}(-\d{2}(-\d{2}(T\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]\d{2}:\d{2}))?)?)?$/;
+function badLastmods(site) {
+  const out = [];
+  const tomorrow = Date.now() + 24 * 60 * 60 * 1e3;
+  for (const entry of site.discovery?.urls ?? []) {
+    const value = entry.lastmod?.trim();
+    if (!value) continue;
+    if (!W3C_DATETIME.test(value)) {
+      out.push({ value, reason: "malformed" });
+      continue;
+    }
+    const parsed = Date.parse(value);
+    if (Number.isFinite(parsed) && parsed > tomorrow) out.push({ value, reason: "future" });
+  }
+  return out;
+}
+function badFields(site) {
+  const out = [];
+  for (const entry of site.discovery?.urls ?? []) {
+    const changefreq = entry.changefreq?.trim().toLowerCase();
+    if (changefreq && !CHANGEFREQ.has(changefreq)) {
+      out.push(`${entry.loc} \u2014 changefreq \`${entry.changefreq}\``);
+      continue;
+    }
+    const priority = entry.priority?.trim();
+    if (priority === void 0) continue;
+    const value = Number(priority);
+    if (!Number.isFinite(value) || value < 0 || value > 1) {
+      out.push(`${entry.loc} \u2014 priority \`${entry.priority}\``);
+    }
+  }
+  return out;
+}
+function sameUrlKey(url) {
+  try {
+    const parsed = new URL(url);
+    parsed.hash = "";
+    const path = parsed.pathname.replace(/\/+$/, "");
+    return `${parsed.origin}${path || "/"}${parsed.search}`;
+  } catch {
+    return void 0;
+  }
+}
+function pagesByUrl(site) {
+  const byUrl = /* @__PURE__ */ new Map();
+  for (const page of site.pages) {
+    const key = sameUrlKey(page.fetch.finalUrl);
+    if (key) byUrl.set(key, page);
+  }
+  return byUrl;
+}
+function saysNoindex(page) {
+  if (metaRobotsTokens(page).has("noindex")) return true;
+  const header = page.fetch.headers["x-robots-tag"] ?? "";
+  return header.split(",").map((token) => token.trim().toLowerCase()).includes("noindex");
+}
+var sitemapEntryBlockedByRobots = {
+  id: "sitemap.entry.blocked-by-robots",
+  severity: "error",
+  summary: "A sitemap must not list URLs that robots.txt forbids fetching",
+  rigor: "vendor-spec",
+  sources: ["ietf-rfc9309", "sitemaps-protocol"],
+  // Skipped when the whole origin is disallowed: `robots.blocks-site` is that
+  // finding, and repeating it once per sitemap entry would bury it.
+  appliesTo: (site) => site.robots?.found === true && robotsAllows(site.robots.groups, "/").allowed && (site.discovery?.urls.length ?? 0) > 0,
+  check: ({ site, issue }) => {
+    const probe = site.robots;
+    const blocked = [];
+    for (const entry of site.discovery.urls) {
+      let path;
+      try {
+        const url = new URL(entry.loc);
+        path = `${url.pathname}${url.search}`;
+      } catch {
+        continue;
+      }
+      if (!robotsAllows(probe.groups, path).allowed) blocked.push(entry.loc);
+    }
+    if (blocked.length === 0) return [];
+    return issue({
+      pageUrl: site.discovery.diagnostics.sitemapUrl ?? `${site.origin}/sitemap.xml`,
+      message: `${blocked.length} sitemap entr${blocked.length === 1 ? "y is" : "ies are"} disallowed by \`robots.txt\`: ${sample(blocked)}. The sitemap says "index this" and robots.txt says "never fetch it" \u2014 both cannot hold, and robots.txt is the one that decides.`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+var sitemapEntryNoindex = {
+  id: "sitemap.entry.noindex",
+  severity: "warning",
+  summary: "A sitemap must not list URLs that ask not to be indexed",
+  rigor: "vendor-spec",
+  sources: ["sitemaps-protocol", "google-robots-meta"],
+  // Only the crawled pages can be judged: a sitemap entry goflag never fetched
+  // has no `noindex` to have seen, and assuming one either way would invent a
+  // finding or hide one.
+  appliesTo: (site) => (site.discovery?.urls.length ?? 0) > 0,
+  check: ({ site, issue }) => {
+    const byUrl = pagesByUrl(site);
+    const conflicting = [];
+    for (const entry of site.discovery.urls) {
+      const key = sameUrlKey(entry.loc);
+      const page = key ? byUrl.get(key) : void 0;
+      if (page && saysNoindex(page)) conflicting.push(entry.loc);
+    }
+    if (conflicting.length === 0) return [];
+    return issue({
+      pageUrl: site.discovery.diagnostics.sitemapUrl ?? `${site.origin}/sitemap.xml`,
+      message: `${conflicting.length} sitemap entr${conflicting.length === 1 ? "y declares" : "ies declare"} \`noindex\`: ${sample(conflicting)}. "Please index this" and "do not index this" are the same site's two answers to one question.`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+var sitemapEntryNonCanonical = {
+  id: "sitemap.entry.non-canonical",
+  severity: "warning",
+  summary: "A sitemap should list canonical URLs",
+  rigor: "vendor-spec",
+  sources: ["sitemaps-protocol", "google-canonicalization"],
+  appliesTo: (site) => (site.discovery?.urls.length ?? 0) > 0,
+  check: ({ site, issue }) => {
+    const byUrl = pagesByUrl(site);
+    const wrong = [];
+    for (const entry of site.discovery.urls) {
+      const key = sameUrlKey(entry.loc);
+      const page = key ? byUrl.get(key) : void 0;
+      const canonical = page?.links.canonical;
+      if (!page || !canonical) continue;
+      const canonicalKey = sameUrlKey(canonical);
+      if (canonicalKey && canonicalKey !== key) {
+        wrong.push(`${entry.loc} \u2192 ${canonical}`);
+      }
+    }
+    if (wrong.length === 0) return [];
+    return issue({
+      pageUrl: site.discovery.diagnostics.sitemapUrl ?? `${site.origin}/sitemap.xml`,
+      message: `${wrong.length} sitemap entr${wrong.length === 1 ? "y names a page whose canonical" : "ies name pages whose canonicals"} point elsewhere: ${sample(wrong)}. The sitemap is a list of what to index, so it should name the URL the site itself prefers.`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+var sitemapOrphans = {
+  id: "sitemap.orphans",
+  severity: "warning",
+  summary: "Indexable pages the crawl found should be listed in the sitemap",
+  rigor: "guideline",
+  sources: ["sitemaps-protocol", "google-sitemaps"],
+  // One finding with a count and a sample, not one per page — the same shape
+  // translation holes take, and for the same reason: forty repeats of one
+  // omission is noise, and the omission is a property of the sitemap.
+  appliesTo: (site) => site.discovery?.diagnostics.found === true && site.discovery.urls.length > 0,
+  check: ({ site, issue }) => {
+    const listed = new Set(
+      site.discovery.urls.map((entry) => sameUrlKey(entry.loc)).filter(Boolean)
+    );
+    const orphans = site.pages.filter((page) => !saysNoindex(page)).map((page) => ({ page, key: sameUrlKey(page.fetch.finalUrl) })).filter(({ key }) => key !== void 0 && !listed.has(key)).map(({ page }) => page.fetch.finalUrl);
+    if (orphans.length === 0) return [];
+    return issue({
+      pageUrl: site.discovery.diagnostics.sitemapUrl ?? `${site.origin}/sitemap.xml`,
+      message: `${orphans.length} crawled page${orphans.length === 1 ? "" : "s"} ask${orphans.length === 1 ? "s" : ""} to be indexed and ${orphans.length === 1 ? "is" : "are"} absent from the sitemap: ${sample(orphans)}. A consumer that reads the sitemap rather than following links will never see ${orphans.length === 1 ? "it" : "them"}.`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+function entryProbes(site) {
+  return [...site.sitemapEntries?.byUrl.values() ?? []];
+}
+function coverageNote(site) {
+  const unprobed = site.sitemapEntries?.unprobed ?? 0;
+  if (unprobed === 0) return "";
+  return ` ${unprobed} further entr${unprobed === 1 ? "y was" : "ies were"} not checked \u2014 this count is a floor, not a total.`;
+}
+var sitemapEntryUnreachable = {
+  id: "sitemap.entry.unreachable",
+  severity: "error",
+  summary: "Every URL a sitemap lists must answer",
+  rigor: "vendor-spec",
+  sources: ["sitemaps-protocol", "google-sitemaps"],
+  appliesTo: (site) => entryProbes(site).some((probe) => isDead(probe.status)),
+  check: ({ site, issue }) => {
+    const dead = entryProbes(site).filter((probe) => isDead(probe.status));
+    return issue({
+      pageUrl: site.discovery.diagnostics.sitemapUrl ?? `${site.origin}/sitemap.xml`,
+      message: `${dead.length} sitemap entr${dead.length === 1 ? "y does" : "ies do"} not answer: ${sample(dead.map((probe) => `${probe.url} (${probe.status === 0 ? "no response" : `HTTP ${probe.status}`})`))}. A sitemap is a list of pages to index, so every dead entry spends crawl budget on a promise the site does not keep.${coverageNote(site)}`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+var sitemapEntryRedirects = {
+  id: "sitemap.entry.redirects",
+  severity: "warning",
+  summary: "A sitemap should list final URLs, not URLs that redirect",
+  rigor: "guideline",
+  sources: ["sitemaps-protocol", "google-sitemaps"],
+  appliesTo: (site) => entryProbes(site).some((probe) => probe.redirected && !isDead(probe.status)),
+  check: ({ site, issue }) => {
+    const moved = entryProbes(site).filter((probe) => probe.redirected && !isDead(probe.status));
+    return issue({
+      pageUrl: site.discovery.diagnostics.sitemapUrl ?? `${site.origin}/sitemap.xml`,
+      message: `${moved.length} sitemap entr${moved.length === 1 ? "y redirects" : "ies redirect"}: ${sample(moved.map((probe) => `${probe.url} \u2192 ${probe.finalUrl}`))}. Google asks for the final URL, and every hop is crawl budget spent plus one more chance for a consumer to disagree about which address is the page.${coverageNote(site)}`,
+      origin: { kind: "computed" }
+    });
+  }
+};
+function isDead(status) {
+  return status === 0 || status >= 400;
+}
+function isRobotsFailure(status) {
+  return status === 0 || status >= 500;
+}
+function isAbsolute(value) {
+  try {
+    const url = new URL(value);
+    return url.protocol === "http:" || url.protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+var SITE_RULES = [
+  hreflangMissing,
+  hreflangClusterIncomplete,
+  iconsIcoMissing,
+  robotsBlocksPage,
+  robotsBlocksSite,
+  robotstxtCrossOrigin,
+  robotstxtInvalidLine,
+  robotstxtOversized,
+  robotstxtSitemapRelative,
+  robotstxtUnknownDirective,
+  robotstxtUnreachable,
+  sitemapEmpty,
+  sitemapEntryBlockedByRobots,
+  sitemapEntryCrossHost,
+  sitemapEntryInvalidUrl,
+  sitemapEntryNoindex,
+  sitemapEntryNonCanonical,
+  sitemapEntryOutOfScope,
+  sitemapEntryProtocolMismatch,
+  sitemapEntryRedirects,
+  sitemapEntryUnreachable,
+  sitemapFieldInvalid,
+  sitemapIndexChildError,
+  sitemapLastmodInvalid,
+  sitemapLimitsExceeded,
+  sitemapMissing,
+  sitemapOrphans,
+  sitemapUnparsable
+];
+function getSiteRule(id) {
+  return SITE_RULES.find((rule) => rule.id === id);
+}
+
+// src/lib/core/lint-site.ts
+function lintSite(site, rules = SITE_RULES) {
+  const drafts = [];
+  for (const rule of rules) {
+    if (rule.appliesTo && !rule.appliesTo(site)) continue;
+    let result;
+    try {
+      result = rule.check({
+        site,
+        issue: (input) => ({
+          ruleId: rule.id,
+          severity: input.severity ?? rule.severity,
+          message: input.message,
+          origin: input.origin,
+          fix: input.fix,
+          suggestion: input.suggestion,
+          pageUrl: input.pageUrl,
+          // Stamped from the descriptor, never from the check: a rule does not
+          // get to claim a rigor per finding. Absent on the three rules that
+          // predate the field, which is how the gap stays visible instead of
+          // being filled with a plausible citation.
+          ...rule.rigor ? { rigor: rule.rigor, sources: rule.sources ?? [] } : {}
+        })
+      });
+    } catch (err) {
+      drafts.push({
+        ruleId: "engine.site-rule-crashed",
+        severity: "info",
+        message: `Site rule \`${rule.id}\` threw: ${err instanceof Error ? err.message : String(err)}`,
+        pageUrl: site.origin
+      });
+      continue;
+    }
+    if (!result) continue;
+    if (Array.isArray(result)) drafts.push(...result);
+    else drafts.push(result);
+  }
+  return sortSiteIssues(drafts);
+}
+function sortSiteIssues(drafts) {
+  const byPage = [...drafts].sort((a, b) => a.pageUrl.localeCompare(b.pageUrl));
+  return sortIssues(byPage);
+}
+
+// src/lib/core/locales.ts
+function localePrefixOf(url) {
+  let pathname;
+  try {
+    pathname = new URL(url).pathname;
+  } catch {
+    return null;
+  }
+  const first = pathname.split("/").filter(Boolean)[0];
+  if (first && looksLikeLocaleSegment(first)) return first.toLowerCase();
+  return null;
+}
+function prefixesIn(urls) {
+  const out = /* @__PURE__ */ new Set();
+  for (const url of urls ?? []) {
+    const locale = localePrefixOf(url);
+    if (locale) out.add(locale);
+  }
+  out.delete("x-default");
+  return out;
+}
+function describeCandidates(pages) {
+  const byTag = /* @__PURE__ */ new Map();
+  for (const page of pages) {
+    const tag = localePrefixOf(page.fetch.finalUrl);
+    if (!tag || tag === "x-default") continue;
+    const entry = byTag.get(tag) ?? { pages: 0, langs: /* @__PURE__ */ new Set() };
+    entry.pages += 1;
+    const lang = page.raw.htmlLang?.trim().toLowerCase();
+    if (lang) entry.langs.add(lang);
+    byTag.set(tag, entry);
+  }
+  const candidates = [];
+  for (const [tag, { pages: n, langs }] of byTag) {
+    const observedLangs = [...langs].sort();
+    const htmlLangAgrees = observedLangs.length === 0 ? void 0 : observedLangs.some((l) => l.split("-")[0] === tag.split("-")[0]);
+    candidates.push({
+      tag,
+      pages: n,
+      isKnownLanguage: isKnownLanguageTag(tag),
+      htmlLangAgrees,
+      observedLangs
+    });
+  }
+  return candidates.sort(
+    (a, b) => Number(b.htmlLangAgrees ?? false) - Number(a.htmlLangAgrees ?? false) || Number(b.isKnownLanguage) - Number(a.isKnownLanguage) || b.pages - a.pages || a.tag.localeCompare(b.tag)
+  );
+}
+function deriveLocaleAxis(input) {
+  const explicit = new Set(
+    (input.explicit ?? []).map((l) => l.trim().toLowerCase()).filter(Boolean)
   );
   explicit.delete("x-default");
   const fromSitemap = prefixesIn(input.sitemapUrls);
@@ -3030,14 +3818,15 @@ async function discoverSitemap(baseUrl, options = {}) {
   };
   const robots = await probeRobots(origin, { signal: options.signal });
   diagnostics.robotsFound = robots.found;
+  const declaredUrls = robots.sitemaps.map((entry) => entry.value);
   const candidates = [];
-  for (const declared of robots.sitemaps) {
+  for (const declared of declaredUrls) {
     candidates.push({ url: declared, source: "robots", declaredInRobots: true });
   }
   candidates.push({
     url: new URL("/sitemap.xml", origin).toString(),
     source: "well-known",
-    declaredInRobots: robots.sitemaps.includes(new URL("/sitemap.xml", origin).toString())
+    declaredInRobots: declaredUrls.includes(new URL("/sitemap.xml", origin).toString())
   });
   candidates.push({
     url: new URL("/sitemap_index.xml", origin).toString(),
@@ -3068,9 +3857,23 @@ async function discoverSitemap(baseUrl, options = {}) {
     diagnostics.atWellKnownPath = isWellKnownPath(candidate.url);
     const collected = [];
     const seen = /* @__PURE__ */ new Set();
+    const documents = [];
     let truncated = false;
+    documents.push({
+      url: candidate.url,
+      status: doc.status,
+      byteLength: doc.byteLength,
+      gzipped: doc.gzipped,
+      kind: parsed.kind === "index" ? "index" : "urlset",
+      childLocs: parsed.kind === "index" ? [...parsed.sitemaps] : [],
+      // What the document declares, not what survived dedupe and the cap: the
+      // ceiling is on the file's contents, and a post-dedupe count would answer
+      // a question the protocol never asked.
+      urlCount: parsed.kind === "urlset" ? parsed.urls.length : 0,
+      declaredInRobots: candidate.declaredInRobots
+    });
     if (parsed.kind === "urlset") {
-      truncated = pushEntries(collected, seen, parsed.urls, maxUrls);
+      truncated = pushEntries(collected, seen, parsed.urls, maxUrls, candidate.url);
     } else {
       diagnostics.isIndex = true;
       const children = parsed.sitemaps.slice(0, maxSitemaps);
@@ -3088,17 +3891,44 @@ async function discoverSitemap(baseUrl, options = {}) {
         }
         const childDoc = await fetchDoc(childUrl, options);
         if (!childDoc.body) {
+          documents.push({
+            url: childUrl,
+            status: childDoc.status,
+            byteLength: childDoc.byteLength,
+            gzipped: childDoc.gzipped,
+            kind: "unparsable",
+            childLocs: [],
+            urlCount: 0,
+            declaredInRobots: declaredUrls.includes(childUrl),
+            parentUrl: candidate.url
+          });
           diagnostics.childSitemapErrors += 1;
           diagnostics.warnings.push(`Child sitemap unreachable: ${childUrl}`);
           continue;
         }
         const childParsed = parseSitemap(childDoc.body);
+        documents.push({
+          url: childUrl,
+          status: childDoc.status,
+          byteLength: childDoc.byteLength,
+          gzipped: childDoc.gzipped,
+          // A child that is itself an index is recorded as one. This run still
+          // treats it as an error below, because that is what it has always
+          // done and replacing that verdict needs a source no specification
+          // provides — see `docs/sitemap-robots-plan.md` §4.3. The tree now
+          // says which of the two it was, which is the part that was lost.
+          kind: childParsed.kind === "unknown" ? "unparsable" : childParsed.kind,
+          childLocs: childParsed.kind === "index" ? [...childParsed.sitemaps] : [],
+          urlCount: childParsed.kind === "urlset" ? childParsed.urls.length : 0,
+          declaredInRobots: declaredUrls.includes(childUrl),
+          parentUrl: candidate.url
+        });
         if (childParsed.kind !== "urlset") {
           diagnostics.childSitemapErrors += 1;
           diagnostics.warnings.push(`Child sitemap not a urlset: ${childUrl}`);
           continue;
         }
-        if (pushEntries(collected, seen, childParsed.urls, maxUrls)) truncated = true;
+        if (pushEntries(collected, seen, childParsed.urls, maxUrls, childUrl)) truncated = true;
       }
     }
     diagnostics.urlCount = collected.length;
@@ -3110,6 +3940,7 @@ async function discoverSitemap(baseUrl, options = {}) {
       baseUrl,
       source: candidate.source,
       urls: collected,
+      documents,
       diagnostics,
       truncated
     };
@@ -3118,95 +3949,497 @@ async function discoverSitemap(baseUrl, options = {}) {
     return crawlSite(baseUrl, origin, options, diagnostics);
   }
   diagnostics.warnings.push("No sitemap found.");
-  return { origin, baseUrl, source: "well-known", urls: [], diagnostics, truncated: false };
+  return {
+    origin,
+    baseUrl,
+    source: "well-known",
+    urls: [],
+    documents: [],
+    diagnostics,
+    truncated: false
+  };
+}
+async function crawlSite(baseUrl, origin, options, diagnostics) {
+  const result = await crawl({
+    entryUrl: baseUrl,
+    depth: options.crawlDepth ?? DEFAULTS.crawlDepth,
+    maxPages: options.crawlMaxPages ?? DEFAULTS.crawlMaxPages,
+    inspectOptions: {
+      mode: "static",
+      probes: false,
+      allowInsecureTls: options.allowInsecureTls,
+      signal: options.signal
+    }
+  });
+  const urls = dedupe(result.visited).map((loc) => ({ loc }));
+  diagnostics.urlCount = urls.length;
+  diagnostics.warnings.push(
+    diagnostics.found ? "Sitemap found but lists no URLs \u2014 crawled the site instead." : "No sitemap found \u2014 URLs were discovered by crawling links."
+  );
+  return {
+    origin,
+    baseUrl,
+    source: "crawl",
+    urls,
+    // No document declared these: the crawl found them by following links. An
+    // empty tree is the honest answer, and the rules that read it are the ones
+    // that judge documents — which this run has none of.
+    documents: [],
+    diagnostics,
+    truncated: result.truncated
+  };
+}
+function pushEntries(out, seen, entries, cap, documentUrl) {
+  for (const entry of entries) {
+    if (out.length >= cap) return true;
+    if (seen.has(entry.loc)) continue;
+    seen.add(entry.loc);
+    out.push({ ...entry, documentUrl });
+  }
+  return out.length >= cap;
+}
+function dedupe(urls) {
+  return Array.from(new Set(urls));
+}
+function isWellKnownPath(url) {
+  try {
+    const path = new URL(url).pathname.toLowerCase();
+    return path === "/sitemap.xml" || path === "/sitemap_index.xml";
+  } catch {
+    return false;
+  }
+}
+async function fetchDoc(url, options) {
+  const { signal, cleanup } = combineSignals(
+    options.signal,
+    options.timeoutMs ?? DEFAULTS.timeoutMs
+  );
+  const restoreTls = relaxTlsIfRequested2(options.allowInsecureTls);
+  try {
+    const res = await fetch(url, {
+      signal,
+      redirect: "follow",
+      headers: {
+        accept: "application/xml,text/xml,application/gzip;q=0.9,*/*;q=0.5"
+      }
+    });
+    if (!res.ok) return { status: res.status, byteLength: 0, gzipped: false };
+    const encoding = res.headers.get("content-encoding")?.toLowerCase() ?? "";
+    const looksGzip = url.toLowerCase().endsWith(".gz") || encoding.includes("gzip");
+    if (looksGzip) {
+      const buf = Buffer.from(await res.arrayBuffer());
+      try {
+        return withLength(res.status, gunzipSync(buf).toString("utf8"), true);
+      } catch {
+        return withLength(res.status, buf.toString("utf8"), true);
+      }
+    }
+    return withLength(res.status, await res.text(), false);
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    return { status: 0, error: reason || "network error", byteLength: 0, gzipped: false };
+  } finally {
+    cleanup();
+    restoreTls();
+  }
+}
+function withLength(status, body, gzipped) {
+  return { status, body, byteLength: Buffer.byteLength(body, "utf8"), gzipped };
+}
+function relaxTlsIfRequested2(enabled) {
+  if (!enabled) return () => void 0;
+  const previous = process.env.NODE_TLS_REJECT_UNAUTHORIZED;
+  process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
+  return () => {
+    if (previous === void 0) delete process.env.NODE_TLS_REJECT_UNAUTHORIZED;
+    else process.env.NODE_TLS_REJECT_UNAUTHORIZED = previous;
+  };
+}
+
+// src/lib/core/net/fetch-url.ts
+var DEFAULT_USER_AGENT = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36";
+var DEFAULT_TIMEOUT_MS = 8e3;
+var DEFAULT_MAX_BYTES = 3 * 1024 * 1024;
+var DEFAULT_ACCEPT = "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8";
+var TEXTY = /(text\/|application\/(xhtml\+xml|xml|json|.*\+xml|.*\+json|javascript))/;
+async function fetchUrl(url, options = {}) {
+  const method = options.method ?? "GET";
+  const redirect = options.redirect ?? "follow";
+  const maxBytes = options.maxBytes ?? DEFAULT_MAX_BYTES;
+  const startedAt = Date.now();
+  const { signal, cleanup } = combineSignals(
+    options.signal,
+    options.timeoutMs ?? DEFAULT_TIMEOUT_MS
+  );
+  const restoreTls = relaxTlsIfRequested3(options.allowInsecureTls);
+  try {
+    const res = await fetch(url, {
+      method,
+      signal,
+      redirect,
+      headers: {
+        "user-agent": options.userAgent ?? DEFAULT_USER_AGENT,
+        accept: options.accept ?? DEFAULT_ACCEPT
+      }
+    });
+    const contentType = normaliseContentType(res.headers.get("content-type"));
+    const result = {
+      requestedUrl: url,
+      finalUrl: res.url || url,
+      status: res.status,
+      redirected: res.redirected,
+      redirectChain: [],
+      contentType,
+      durationMs: Date.now() - startedAt
+    };
+    const retryAfter = res.headers.get("retry-after");
+    if (retryAfter) result.retryAfter = retryAfter;
+    if (redirect === "manual" && isRedirectStatus(res.status)) {
+      const location = res.headers.get("location");
+      if (location) {
+        try {
+          const next = new URL(location, url).toString();
+          result.finalUrl = next;
+          result.redirectChain = [next];
+          result.redirected = true;
+        } catch {
+        }
+      }
+      await res.body?.cancel().catch(() => void 0);
+      return result;
+    }
+    if (method === "HEAD") {
+      await res.body?.cancel().catch(() => void 0);
+      return result;
+    }
+    if (contentType && !TEXTY.test(contentType)) {
+      await res.body?.cancel().catch(() => void 0);
+      return result;
+    }
+    const { text, truncated } = await readCappedText(res, maxBytes);
+    result.body = text;
+    if (truncated) result.truncated = true;
+    return result;
+  } catch (err) {
+    return {
+      requestedUrl: url,
+      finalUrl: url,
+      status: 0,
+      redirected: false,
+      redirectChain: [],
+      reason: classifyError(err, options.signal),
+      durationMs: Date.now() - startedAt
+    };
+  } finally {
+    cleanup();
+    restoreTls();
+  }
+}
+function isRedirectStatus(status) {
+  return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
+}
+function normaliseContentType(raw) {
+  if (!raw) return void 0;
+  const semi = raw.indexOf(";");
+  return (semi === -1 ? raw : raw.slice(0, semi)).trim().toLowerCase() || void 0;
+}
+async function readCappedText(res, maxBytes) {
+  const reader = res.body?.getReader();
+  if (!reader) {
+    const text = await res.text();
+    if (text.length > maxBytes) {
+      return { text: text.slice(0, maxBytes), truncated: true };
+    }
+    return { text, truncated: false };
+  }
+  const chunks = [];
+  let received = 0;
+  let truncated = false;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    if (!value) continue;
+    chunks.push(value);
+    received += value.byteLength;
+    if (received >= maxBytes) {
+      truncated = true;
+      await reader.cancel().catch(() => void 0);
+      break;
+    }
+  }
+  const buf = Buffer.concat(chunks.map((c) => Buffer.from(c)));
+  const sliced = buf.byteLength > maxBytes ? buf.subarray(0, maxBytes) : buf;
+  return { text: sliced.toString("utf8"), truncated };
+}
+function classifyError(err, callerSignal) {
+  if (isAbortError(err)) {
+    return callerSignal?.aborted ? "abort" : "timeout";
+  }
+  const code = errorCode(err);
+  if (code) {
+    if (code === "ENOTFOUND" || code === "EAI_AGAIN") return "dns";
+    if (code.startsWith("CERT_") || code.includes("SELF_SIGNED") || code.includes("CERT")) {
+      return "tls";
+    }
+  }
+  const message = err instanceof Error ? err.message.toLowerCase() : String(err).toLowerCase();
+  if (message.includes("certificate") || message.includes("tls") || message.includes("ssl")) {
+    return "tls";
+  }
+  return "network";
+}
+function isAbortError(err) {
+  return err instanceof Error && err.name === "AbortError";
+}
+function errorCode(err) {
+  if (err && typeof err === "object") {
+    const direct = err.code;
+    if (typeof direct === "string") return direct;
+    const cause = err.cause;
+    if (cause && typeof cause === "object") {
+      const causeCode = cause.code;
+      if (typeof causeCode === "string") return causeCode;
+    }
+  }
+  return void 0;
+}
+function relaxTlsIfRequested3(enabled) {
+  if (!enabled) return () => void 0;
+  const previous = process.env.NODE_TLS_REJECT_UNAUTHORIZED;
+  process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
+  return () => {
+    if (previous === void 0) delete process.env.NODE_TLS_REJECT_UNAUTHORIZED;
+    else process.env.NODE_TLS_REJECT_UNAUTHORIZED = previous;
+  };
+}
+
+// src/lib/core/links/classify.ts
+function classifyLink(input) {
+  if (input.status === 0) return "broken";
+  if (input.loop) return "broken";
+  if (input.softNotFound) return "warning";
+  if (input.status === 403 || input.status === 429) return "blocked";
+  if (input.status >= 400) return "broken";
+  if (input.status >= 200 && input.status < 300) {
+    return input.redirected ? "redirect" : "ok";
+  }
+  return "broken";
+}
+
+// src/lib/core/links/check.ts
+var DEFAULTS2 = {
+  timeoutMs: 8e3,
+  maxRedirects: 10,
+  retries: 1,
+  backoffBaseMs: 300,
+  maxBackoffMs: 3e3,
+  softBodyBytes: 16 * 1024
+};
+var NOT_FOUND_RE = /\b(not\s+found|page\s+doesn'?t\s+exist|404|no\s+such\s+page)\b/i;
+var SOFT_404_BODY_LIMIT = 2048;
+async function checkLink(url, options = {}) {
+  const checkedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const started = Date.now();
+  const scheme = schemeOf(url);
+  if (scheme !== "http" && scheme !== "https") {
+    return {
+      url,
+      finalUrl: url,
+      status: 0,
+      verdict: "skipped",
+      method: "GET",
+      redirectChain: [],
+      reason: scheme ? `unsupported scheme: ${scheme}` : "not a URL",
+      checkedAt,
+      durationMs: Date.now() - started
+    };
+  }
+  const outcome = await probeWithRetry(url, options);
+  const softNotFound = isSoftNotFound(outcome);
+  const verdict = classifyLink({
+    status: outcome.status,
+    redirected: outcome.redirectChain.length > 0,
+    reason: outcome.reason,
+    softNotFound,
+    loop: outcome.loop
+  });
+  return {
+    url,
+    finalUrl: outcome.finalUrl,
+    status: outcome.status,
+    verdict,
+    method: outcome.method,
+    redirectChain: outcome.redirectChain,
+    reason: describeReason(outcome, softNotFound),
+    checkedAt,
+    durationMs: Date.now() - started
+  };
+}
+async function probeWithRetry(url, options) {
+  const retries = options.retries ?? DEFAULTS2.retries;
+  const sleep = options.sleep ?? defaultSleep;
+  let outcome = await probeWithHeadFallback(url, options);
+  for (let attempt = 0; attempt < retries; attempt++) {
+    if (!isTransient(outcome)) break;
+    if (options.signal?.aborted) break;
+    const delay = backoffDelay(outcome, attempt, options);
+    if (delay > 0) await sleep(delay);
+    outcome = await probeWithHeadFallback(url, options);
+  }
+  return outcome;
+}
+async function probeWithHeadFallback(url, options) {
+  const head = await followRedirects(url, "HEAD", options);
+  if (headRejected(head) || head.status >= 200 && head.status < 300) {
+    const get = await followRedirects(url, "GET", options);
+    if (get.status === 0 && head.status !== 0 && !headRejected(head)) return head;
+    return get;
+  }
+  return head;
+}
+function headRejected(o) {
+  return o.status === 405 || o.status === 501 || o.status === 403 || o.status === 0;
+}
+async function followRedirects(url, method, options) {
+  const maxRedirects = options.maxRedirects ?? DEFAULTS2.maxRedirects;
+  const chain = [];
+  const visited = /* @__PURE__ */ new Set([url]);
+  let current = url;
+  for (let hop = 0; hop <= maxRedirects; hop++) {
+    const res = await fetchUrl(current, {
+      method,
+      redirect: "manual",
+      timeoutMs: options.timeoutMs ?? DEFAULTS2.timeoutMs,
+      allowInsecureTls: options.allowInsecureTls,
+      userAgent: options.userAgent,
+      maxBytes: method === "GET" ? options.softBodyBytes ?? DEFAULTS2.softBodyBytes : void 0
+    });
+    if (res.status === 0) {
+      return {
+        status: 0,
+        finalUrl: current,
+        redirectChain: chain,
+        reason: res.reason,
+        loop: false,
+        method
+      };
+    }
+    const next = res.redirectChain[0];
+    if (next) {
+      chain.push(next);
+      if (visited.has(next)) {
+        return { status: res.status, finalUrl: next, redirectChain: chain, loop: true, method };
+      }
+      visited.add(next);
+      current = next;
+      continue;
+    }
+    return {
+      status: res.status,
+      finalUrl: res.finalUrl,
+      redirectChain: chain,
+      loop: false,
+      body: res.body,
+      retryAfter: res.retryAfter,
+      method
+    };
+  }
+  return { status: 0, finalUrl: current, redirectChain: chain, loop: true, method };
+}
+function isSoftNotFound(o) {
+  if (o.status < 200 || o.status >= 300) return false;
+  if (o.body === void 0) return false;
+  if (o.body.length > SOFT_404_BODY_LIMIT) return false;
+  return NOT_FOUND_RE.test(o.body);
+}
+function isTransient(o) {
+  if (o.status === 0) return true;
+  if (o.status === 429) return true;
+  if (o.status >= 500) return true;
+  return false;
 }
-async function crawlSite(baseUrl, origin, options, diagnostics) {
-  const result = await crawl({
-    entryUrl: baseUrl,
-    depth: options.crawlDepth ?? DEFAULTS.crawlDepth,
-    maxPages: options.crawlMaxPages ?? DEFAULTS.crawlMaxPages,
-    inspectOptions: {
-      mode: "static",
-      probes: false,
-      allowInsecureTls: options.allowInsecureTls,
-      signal: options.signal
-    }
-  });
-  const urls = dedupe(result.visited).map((loc) => ({ loc }));
-  diagnostics.urlCount = urls.length;
-  diagnostics.warnings.push(
-    diagnostics.found ? "Sitemap found but lists no URLs \u2014 crawled the site instead." : "No sitemap found \u2014 URLs were discovered by crawling links."
-  );
-  return {
-    origin,
-    baseUrl,
-    source: "crawl",
-    urls,
-    diagnostics,
-    truncated: result.truncated
-  };
+function backoffDelay(o, attempt, options) {
+  const max = options.maxBackoffMs ?? DEFAULTS2.maxBackoffMs;
+  const retryAfterMs = parseRetryAfter(o.retryAfter);
+  if (retryAfterMs !== void 0) return Math.min(retryAfterMs, max);
+  const base = options.backoffBaseMs ?? DEFAULTS2.backoffBaseMs;
+  const exp = base * 2 ** attempt;
+  const jitter = Math.floor(Math.random() * base);
+  return Math.min(exp + jitter, max);
 }
-function pushEntries(out, seen, entries, cap) {
-  for (const entry of entries) {
-    if (out.length >= cap) return true;
-    if (seen.has(entry.loc)) continue;
-    seen.add(entry.loc);
-    out.push(entry);
-  }
-  return out.length >= cap;
+function parseRetryAfter(value) {
+  if (!value) return void 0;
+  const seconds = Number(value);
+  if (Number.isFinite(seconds)) return Math.max(0, seconds * 1e3);
+  const date = Date.parse(value);
+  if (!Number.isNaN(date)) return Math.max(0, date - Date.now());
+  return void 0;
 }
-function dedupe(urls) {
-  return Array.from(new Set(urls));
+function describeReason(o, softNotFound) {
+  if (o.reason) return o.reason;
+  if (o.loop) return "redirect loop";
+  if (softNotFound) return "soft-404";
+  if (o.status === 429) return "429 rate-limited";
+  if (o.status === 403) return "403 forbidden";
+  if (o.status >= 400) return `${o.status}`;
+  return void 0;
 }
-function isWellKnownPath(url) {
+function schemeOf(url) {
   try {
-    const path = new URL(url).pathname.toLowerCase();
-    return path === "/sitemap.xml" || path === "/sitemap_index.xml";
+    return new URL(url).protocol.replace(/:$/, "").toLowerCase();
   } catch {
-    return false;
+    return null;
   }
 }
-async function fetchDoc(url, options) {
-  const { signal, cleanup } = combineSignals(
-    options.signal,
-    options.timeoutMs ?? DEFAULTS.timeoutMs
-  );
-  const restoreTls = relaxTlsIfRequested2(options.allowInsecureTls);
-  try {
-    const res = await fetch(url, {
-      signal,
-      redirect: "follow",
-      headers: {
-        accept: "application/xml,text/xml,application/gzip;q=0.9,*/*;q=0.5"
-      }
-    });
-    if (!res.ok) return { status: res.status };
-    const encoding = res.headers.get("content-encoding")?.toLowerCase() ?? "";
-    const looksGzip = url.toLowerCase().endsWith(".gz") || encoding.includes("gzip");
-    if (looksGzip) {
-      const buf = Buffer.from(await res.arrayBuffer());
-      try {
-        return { status: res.status, body: gunzipSync(buf).toString("utf8") };
-      } catch {
-        return { status: res.status, body: buf.toString("utf8") };
-      }
+function defaultSleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+// src/lib/core/sitemap/entries.ts
+async function probeSitemapEntries(locs, options) {
+  const byUrl = /* @__PURE__ */ new Map();
+  const toFetch = [];
+  for (const loc of locs) {
+    if (byUrl.has(loc)) continue;
+    const crawled = options.crawled.get(loc);
+    if (crawled !== void 0) {
+      byUrl.set(loc, { url: loc, status: crawled, via: "crawl", finalUrl: loc, redirected: false });
+      continue;
     }
-    return { status: res.status, body: await res.text() };
-  } catch (err) {
-    const reason = err instanceof Error ? err.message : String(err);
-    return { status: 0, error: reason || "network error" };
-  } finally {
-    cleanup();
-    restoreTls();
+    const checked = options.checked.get(loc);
+    if (checked) {
+      byUrl.set(loc, fromCheck(loc, checked, "link-audit"));
+      continue;
+    }
+    toFetch.push(loc);
   }
+  const budget = toFetch.slice(0, options.maxProbes);
+  const unprobed = toFetch.length - budget.length;
+  const queue = [...budget];
+  const workers = Math.min(options.concurrency ?? 6, queue.length);
+  await Promise.all(
+    Array.from({ length: workers }, async () => {
+      for (let url = queue.pop(); url !== void 0; url = queue.pop()) {
+        const check = await checkLink(url, {
+          signal: options.signal,
+          timeoutMs: options.timeoutMs,
+          allowInsecureTls: options.allowInsecureTls
+        }).catch(() => void 0);
+        if (check) byUrl.set(url, fromCheck(url, check, "probe"));
+      }
+    })
+  );
+  return { byUrl, unprobed };
 }
-function relaxTlsIfRequested2(enabled) {
-  if (!enabled) return () => void 0;
-  const previous = process.env.NODE_TLS_REJECT_UNAUTHORIZED;
-  process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
-  return () => {
-    if (previous === void 0) delete process.env.NODE_TLS_REJECT_UNAUTHORIZED;
-    else process.env.NODE_TLS_REJECT_UNAUTHORIZED = previous;
+function fromCheck(url, check, via) {
+  return {
+    url,
+    status: check.status,
+    via,
+    finalUrl: check.finalUrl,
+    // A redirect that resolved, or one that did not: either way the entry did
+    // not name the URL that answers, which is what the rule is about.
+    redirected: check.finalUrl !== url || check.redirectChain.length > 0
   };
 }
 
@@ -3697,161 +4930,87 @@ var PROSE_RULES = [
 ];
 var PROSE_RULE_BY_ID = new Map(PROSE_RULES.map((r) => [r.id, r]));
 
-// src/lib/core/net/fetch-url.ts
-var DEFAULT_USER_AGENT = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36";
-var DEFAULT_TIMEOUT_MS = 8e3;
-var DEFAULT_MAX_BYTES = 3 * 1024 * 1024;
-var DEFAULT_ACCEPT = "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8";
-var TEXTY = /(text\/|application\/(xhtml\+xml|xml|json|.*\+xml|.*\+json|javascript))/;
-async function fetchUrl(url, options = {}) {
-  const method = options.method ?? "GET";
-  const redirect = options.redirect ?? "follow";
-  const maxBytes = options.maxBytes ?? DEFAULT_MAX_BYTES;
-  const startedAt = Date.now();
-  const { signal, cleanup } = combineSignals(
-    options.signal,
-    options.timeoutMs ?? DEFAULT_TIMEOUT_MS
-  );
-  const restoreTls = relaxTlsIfRequested3(options.allowInsecureTls);
-  try {
-    const res = await fetch(url, {
-      method,
-      signal,
-      redirect,
-      headers: {
-        "user-agent": options.userAgent ?? DEFAULT_USER_AGENT,
-        accept: options.accept ?? DEFAULT_ACCEPT
-      }
-    });
-    const contentType = normaliseContentType(res.headers.get("content-type"));
-    const result = {
-      requestedUrl: url,
-      finalUrl: res.url || url,
-      status: res.status,
-      redirected: res.redirected,
-      redirectChain: [],
-      contentType,
-      durationMs: Date.now() - startedAt
-    };
-    const retryAfter = res.headers.get("retry-after");
-    if (retryAfter) result.retryAfter = retryAfter;
-    if (redirect === "manual" && isRedirectStatus(res.status)) {
-      const location = res.headers.get("location");
-      if (location) {
-        try {
-          const next = new URL(location, url).toString();
-          result.finalUrl = next;
-          result.redirectChain = [next];
-          result.redirected = true;
-        } catch {
-        }
+// src/lib/rules/site-prose.ts
+var hreflangSitemapMismatch = {
+  id: "hreflang.sitemap-mismatch",
+  summary: "`<head>` alternates advertise a locale the sitemap does not list",
+  prose: "Your `<head>` advertises a translation your sitemap does not list. Is the sitemap missing an entry, or is the alternate pointing at a page you did not mean to publish?",
+  why: "The two are derived from one intent by different code paths, so a disagreement means one of them is wrong. No specification says which: the declaration methods are equivalent, and a page can legitimately be cross-linked and kept out of the sitemap.",
+  appliesTo: (site) => site.localeAxis.multilingual && (site.discovery?.urls.length ?? 0) > 0,
+  ask: (site) => {
+    const axis = new Set(site.localeAxis.locales.map((l) => l.toLowerCase()));
+    const bySitemap = /* @__PURE__ */ new Map();
+    for (const entry of site.discovery?.urls ?? []) {
+      let pathname;
+      try {
+        pathname = new URL(entry.loc).pathname;
+      } catch {
+        continue;
       }
-      await res.body?.cancel().catch(() => void 0);
-      return result;
-    }
-    if (method === "HEAD") {
-      await res.body?.cancel().catch(() => void 0);
-      return result;
-    }
-    if (contentType && !TEXTY.test(contentType)) {
-      await res.body?.cancel().catch(() => void 0);
-      return result;
-    }
-    const { text, truncated } = await readCappedText(res, maxBytes);
-    result.body = text;
-    if (truncated) result.truncated = true;
-    return result;
-  } catch (err) {
-    return {
-      requestedUrl: url,
-      finalUrl: url,
-      status: 0,
-      redirected: false,
-      redirectChain: [],
-      reason: classifyError(err, options.signal),
-      durationMs: Date.now() - startedAt
-    };
-  } finally {
-    cleanup();
-    restoreTls();
-  }
-}
-function isRedirectStatus(status) {
-  return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
-}
-function normaliseContentType(raw) {
-  if (!raw) return void 0;
-  const semi = raw.indexOf(";");
-  return (semi === -1 ? raw : raw.slice(0, semi)).trim().toLowerCase() || void 0;
-}
-async function readCappedText(res, maxBytes) {
-  const reader = res.body?.getReader();
-  if (!reader) {
-    const text = await res.text();
-    if (text.length > maxBytes) {
-      return { text: text.slice(0, maxBytes), truncated: true };
-    }
-    return { text, truncated: false };
-  }
-  const chunks = [];
-  let received = 0;
-  let truncated = false;
-  for (; ; ) {
-    const { done, value } = await reader.read();
-    if (done) break;
-    if (!value) continue;
-    chunks.push(value);
-    received += value.byteLength;
-    if (received >= maxBytes) {
-      truncated = true;
-      await reader.cancel().catch(() => void 0);
-      break;
+      const { locale } = splitRoute(pathname);
+      if (locale === "x-default") continue;
+      if (!axis.has(locale.toLowerCase())) continue;
+      const route = site.clusterRouteOf?.(entry.loc) ?? splitRoute(pathname).route;
+      const set = bySitemap.get(route) ?? /* @__PURE__ */ new Set();
+      set.add(locale.toLowerCase());
+      bySitemap.set(route, set);
     }
-  }
-  const buf = Buffer.concat(chunks.map((c) => Buffer.from(c)));
-  const sliced = buf.byteLength > maxBytes ? buf.subarray(0, maxBytes) : buf;
-  return { text: sliced.toString("utf8"), truncated };
-}
-function classifyError(err, callerSignal) {
-  if (isAbortError(err)) {
-    return callerSignal?.aborted ? "abort" : "timeout";
-  }
-  const code = errorCode(err);
-  if (code) {
-    if (code === "ENOTFOUND" || code === "EAI_AGAIN") return "dns";
-    if (code.startsWith("CERT_") || code.includes("SELF_SIGNED") || code.includes("CERT")) {
-      return "tls";
+    const drafts = [];
+    for (const page of site.pages) {
+      const head = /* @__PURE__ */ new Set();
+      for (const alt of page.links.alternates) {
+        if (alt.isXDefault) continue;
+        const tag = alt.hreflang?.trim().toLowerCase();
+        if (tag) head.add(tag);
+      }
+      if (head.size === 0) continue;
+      let pathname;
+      try {
+        pathname = new URL(page.fetch.finalUrl).pathname;
+      } catch {
+        continue;
+      }
+      const route = site.clusterRouteOf?.(page.fetch.finalUrl) ?? splitRoute(pathname).route;
+      const inSitemap = bySitemap.get(route);
+      if (!inSitemap || inSitemap.size === 0) continue;
+      const unlisted = [...head].filter((l) => !inSitemap.has(l)).sort();
+      if (unlisted.length === 0) continue;
+      drafts.push({
+        pageUrl: page.fetch.finalUrl,
+        evidence: {
+          route,
+          // Both sides, verbatim and sorted, so an agent can see the shape of
+          // the disagreement rather than take our word for its size.
+          headAdvertises: [...head].sort(),
+          sitemapLists: [...inSitemap].sort(),
+          advertisedButUnlisted: unlisted
+        }
+      });
     }
+    return drafts;
   }
-  const message = err instanceof Error ? err.message.toLowerCase() : String(err).toLowerCase();
-  if (message.includes("certificate") || message.includes("tls") || message.includes("ssl")) {
-    return "tls";
-  }
-  return "network";
-}
-function isAbortError(err) {
-  return err instanceof Error && err.name === "AbortError";
-}
-function errorCode(err) {
-  if (err && typeof err === "object") {
-    const direct = err.code;
-    if (typeof direct === "string") return direct;
-    const cause = err.cause;
-    if (cause && typeof cause === "object") {
-      const causeCode = cause.code;
-      if (typeof causeCode === "string") return causeCode;
+};
+var SITE_PROSE_RULES = [hreflangSitemapMismatch];
+function collectSiteAdvisories(site, rules = SITE_PROSE_RULES) {
+  const out = [];
+  for (const rule of rules) {
+    if (rule.appliesTo && !rule.appliesTo(site)) continue;
+    for (const draft of rule.ask(site)) {
+      out.push({
+        ruleId: rule.id,
+        kind: "prose",
+        prose: rule.prose,
+        // `null` where nothing supports the question, which is exactly the
+        // state this rule is in and the reason it stopped being a verdict.
+        rigor: rule.rigor ?? null,
+        sources: rule.sources ?? [],
+        evidence: draft.evidence,
+        verdict: "needs-judgment",
+        pageUrl: draft.pageUrl
+      });
     }
   }
-  return void 0;
-}
-function relaxTlsIfRequested3(enabled) {
-  if (!enabled) return () => void 0;
-  const previous = process.env.NODE_TLS_REJECT_UNAUTHORIZED;
-  process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
-  return () => {
-    if (previous === void 0) delete process.env.NODE_TLS_REJECT_UNAUTHORIZED;
-    else process.env.NODE_TLS_REJECT_UNAUTHORIZED = previous;
-  };
+  return out;
 }
 
 // src/lib/core/links/extract.ts
@@ -3937,188 +5096,6 @@ function resolveBase2($, pageUrl) {
   return pageUrl;
 }
 
-// src/lib/core/links/classify.ts
-function classifyLink(input) {
-  if (input.status === 0) return "broken";
-  if (input.loop) return "broken";
-  if (input.softNotFound) return "warning";
-  if (input.status === 403 || input.status === 429) return "blocked";
-  if (input.status >= 400) return "broken";
-  if (input.status >= 200 && input.status < 300) {
-    return input.redirected ? "redirect" : "ok";
-  }
-  return "broken";
-}
-
-// src/lib/core/links/check.ts
-var DEFAULTS2 = {
-  timeoutMs: 8e3,
-  maxRedirects: 10,
-  retries: 1,
-  backoffBaseMs: 300,
-  maxBackoffMs: 3e3,
-  softBodyBytes: 16 * 1024
-};
-var NOT_FOUND_RE = /\b(not\s+found|page\s+doesn'?t\s+exist|404|no\s+such\s+page)\b/i;
-var SOFT_404_BODY_LIMIT = 2048;
-async function checkLink(url, options = {}) {
-  const checkedAt = (/* @__PURE__ */ new Date()).toISOString();
-  const started = Date.now();
-  const scheme = schemeOf(url);
-  if (scheme !== "http" && scheme !== "https") {
-    return {
-      url,
-      finalUrl: url,
-      status: 0,
-      verdict: "skipped",
-      method: "GET",
-      redirectChain: [],
-      reason: scheme ? `unsupported scheme: ${scheme}` : "not a URL",
-      checkedAt,
-      durationMs: Date.now() - started
-    };
-  }
-  const outcome = await probeWithRetry(url, options);
-  const softNotFound = isSoftNotFound(outcome);
-  const verdict = classifyLink({
-    status: outcome.status,
-    redirected: outcome.redirectChain.length > 0,
-    reason: outcome.reason,
-    softNotFound,
-    loop: outcome.loop
-  });
-  return {
-    url,
-    finalUrl: outcome.finalUrl,
-    status: outcome.status,
-    verdict,
-    method: outcome.method,
-    redirectChain: outcome.redirectChain,
-    reason: describeReason(outcome, softNotFound),
-    checkedAt,
-    durationMs: Date.now() - started
-  };
-}
-async function probeWithRetry(url, options) {
-  const retries = options.retries ?? DEFAULTS2.retries;
-  const sleep = options.sleep ?? defaultSleep;
-  let outcome = await probeWithHeadFallback(url, options);
-  for (let attempt = 0; attempt < retries; attempt++) {
-    if (!isTransient(outcome)) break;
-    if (options.signal?.aborted) break;
-    const delay = backoffDelay(outcome, attempt, options);
-    if (delay > 0) await sleep(delay);
-    outcome = await probeWithHeadFallback(url, options);
-  }
-  return outcome;
-}
-async function probeWithHeadFallback(url, options) {
-  const head = await followRedirects(url, "HEAD", options);
-  if (headRejected(head) || head.status >= 200 && head.status < 300) {
-    const get = await followRedirects(url, "GET", options);
-    if (get.status === 0 && head.status !== 0 && !headRejected(head)) return head;
-    return get;
-  }
-  return head;
-}
-function headRejected(o) {
-  return o.status === 405 || o.status === 501 || o.status === 403 || o.status === 0;
-}
-async function followRedirects(url, method, options) {
-  const maxRedirects = options.maxRedirects ?? DEFAULTS2.maxRedirects;
-  const chain = [];
-  const visited = /* @__PURE__ */ new Set([url]);
-  let current = url;
-  for (let hop = 0; hop <= maxRedirects; hop++) {
-    const res = await fetchUrl(current, {
-      method,
-      redirect: "manual",
-      timeoutMs: options.timeoutMs ?? DEFAULTS2.timeoutMs,
-      allowInsecureTls: options.allowInsecureTls,
-      userAgent: options.userAgent,
-      maxBytes: method === "GET" ? options.softBodyBytes ?? DEFAULTS2.softBodyBytes : void 0
-    });
-    if (res.status === 0) {
-      return {
-        status: 0,
-        finalUrl: current,
-        redirectChain: chain,
-        reason: res.reason,
-        loop: false,
-        method
-      };
-    }
-    const next = res.redirectChain[0];
-    if (next) {
-      chain.push(next);
-      if (visited.has(next)) {
-        return { status: res.status, finalUrl: next, redirectChain: chain, loop: true, method };
-      }
-      visited.add(next);
-      current = next;
-      continue;
-    }
-    return {
-      status: res.status,
-      finalUrl: res.finalUrl,
-      redirectChain: chain,
-      loop: false,
-      body: res.body,
-      retryAfter: res.retryAfter,
-      method
-    };
-  }
-  return { status: 0, finalUrl: current, redirectChain: chain, loop: true, method };
-}
-function isSoftNotFound(o) {
-  if (o.status < 200 || o.status >= 300) return false;
-  if (o.body === void 0) return false;
-  if (o.body.length > SOFT_404_BODY_LIMIT) return false;
-  return NOT_FOUND_RE.test(o.body);
-}
-function isTransient(o) {
-  if (o.status === 0) return true;
-  if (o.status === 429) return true;
-  if (o.status >= 500) return true;
-  return false;
-}
-function backoffDelay(o, attempt, options) {
-  const max = options.maxBackoffMs ?? DEFAULTS2.maxBackoffMs;
-  const retryAfterMs = parseRetryAfter(o.retryAfter);
-  if (retryAfterMs !== void 0) return Math.min(retryAfterMs, max);
-  const base = options.backoffBaseMs ?? DEFAULTS2.backoffBaseMs;
-  const exp = base * 2 ** attempt;
-  const jitter = Math.floor(Math.random() * base);
-  return Math.min(exp + jitter, max);
-}
-function parseRetryAfter(value) {
-  if (!value) return void 0;
-  const seconds = Number(value);
-  if (Number.isFinite(seconds)) return Math.max(0, seconds * 1e3);
-  const date = Date.parse(value);
-  if (!Number.isNaN(date)) return Math.max(0, date - Date.now());
-  return void 0;
-}
-function describeReason(o, softNotFound) {
-  if (o.reason) return o.reason;
-  if (o.loop) return "redirect loop";
-  if (softNotFound) return "soft-404";
-  if (o.status === 429) return "429 rate-limited";
-  if (o.status === 403) return "403 forbidden";
-  if (o.status >= 400) return `${o.status}`;
-  return void 0;
-}
-function schemeOf(url) {
-  try {
-    return new URL(url).protocol.replace(/:$/, "").toLowerCase();
-  } catch {
-    return null;
-  }
-}
-function defaultSleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-
 // src/lib/core/links/types.ts
 function emptyVerdictSummary() {
   return { ok: 0, redirect: 0, broken: 0, blocked: 0, warning: 0, skipped: 0 };
@@ -4450,14 +5427,14 @@ async function attachManifests(pages, options) {
   }
 }
 async function probeAssets(pages, options) {
-  const sameOrigin = (url) => {
+  const sameOrigin2 = (url) => {
     try {
       return new URL(url).origin === new URL(options.origin).origin;
     } catch {
       return false;
     }
   };
-  const wantedUrl = (url) => /^https?:\/\//i.test(url) && (options.checkExternal || sameOrigin(url));
+  const wantedUrl = (url) => /^https?:\/\//i.test(url) && (options.checkExternal || sameOrigin2(url));
   const wanted = /* @__PURE__ */ new Set();
   for (const page of pages) {
     for (const image of page.openGraph.images) {
@@ -4630,7 +5607,14 @@ async function runAudit(inputUrl, options = {}) {
         severity: issue.severity,
         message: issue.message,
         why: rule?.title,
-        fix: issue.fix?.snippet
+        fix: issue.fix?.snippet,
+        // The fingerprint above is unchanged on purpose: it keys on the rule,
+        // the route and the occurrence, so carrying more of the finding cannot
+        // move a baseline entry (`./diff.ts` matches on `id` alone).
+        rigor: issue.rigor,
+        sources: issue.sources,
+        observed: issue.observed,
+        expected: issue.expected
       });
     }
   }
@@ -4677,6 +5661,33 @@ async function runAudit(inputUrl, options = {}) {
     ),
     ...issue
   }));
+  const linkDiscovery = syntheticDiscovery(origin, entry, okPages, crawlResult.truncated);
+  const linkReport = await runLinkAudit(linkDiscovery, {
+    allowInsecureTls: options.allowInsecureTls,
+    checkExternal,
+    timeoutMs: options.timeoutMs,
+    maxPages: effectiveMaxPages,
+    signal: options.signal,
+    onProgress: (p) => options.onProgress?.({
+      phase: p.phase === "scan" ? "scan" : "links",
+      done: p.done,
+      total: p.total
+    })
+  });
+  warnings.push(...linkReport.diagnostics.warnings);
+  const sitemapEntries = discovery ? await probeSitemapEntries(
+    discovery.urls.map((entry2) => entry2.loc),
+    {
+      crawled: new Map(
+        crawlResult.pages.map((page) => [page.fetch.finalUrl, page.fetch.status])
+      ),
+      checked: new Map(Object.values(linkReport.checks).map((check) => [check.url, check])),
+      maxProbes: effectiveMaxPages,
+      signal: options.signal,
+      timeoutMs: options.timeoutMs,
+      allowInsecureTls: options.allowInsecureTls
+    }
+  ) : void 0;
   const siteContext = {
     origin,
     pages: htmlPages,
@@ -4685,6 +5696,7 @@ async function runAudit(inputUrl, options = {}) {
     discovery,
     robots,
     favicon,
+    sitemapEntries,
     // Same index the matrix was built from, so a rule that groups by route
     // and the grid that reports holes cannot disagree about which URLs are
     // one page.
@@ -4703,23 +5715,19 @@ async function runAudit(inputUrl, options = {}) {
       severity: draft.severity,
       message: draft.message,
       why: rule?.summary,
-      fix: draft.fix?.snippet
+      fix: draft.fix?.snippet,
+      rigor: draft.rigor,
+      sources: draft.sources
     };
   });
-  const linkDiscovery = syntheticDiscovery(origin, entry, okPages, crawlResult.truncated);
-  const linkReport = await runLinkAudit(linkDiscovery, {
-    allowInsecureTls: options.allowInsecureTls,
-    checkExternal,
-    timeoutMs: options.timeoutMs,
-    maxPages: effectiveMaxPages,
-    signal: options.signal,
-    onProgress: (p) => options.onProgress?.({
-      phase: p.phase === "scan" ? "scan" : "links",
-      done: p.done,
-      total: p.total
-    })
-  });
-  warnings.push(...linkReport.diagnostics.warnings);
+  if (options.advisories) {
+    for (const advisory of collectSiteAdvisories(siteContext)) {
+      advisories.push({
+        ...advisory,
+        id: fingerprint("advisory", advisory.ruleId, routeKey(advisory.pageUrl))
+      });
+    }
+  }
   const brokenLinks = [];
   for (const { pageUrl, broken } of linkReport.brokenByPage) {
     for (const check of broken) {
@@ -4856,6 +5864,10 @@ function syntheticDiscovery(origin, baseUrl, pages, truncated) {
     baseUrl,
     source: "crawl",
     urls: pages.map((p) => ({ loc: p.fetch.finalUrl })),
+    // Crawl-derived: no sitemap document was read, so the tree is empty rather
+    // than absent. The document rules ask "what did each document declare?" and
+    // must see that nothing declared anything.
+    documents: [],
     diagnostics: {
       found: false,
       status: 0,
@@ -5209,7 +6221,8 @@ function rollupRows(issues, c) {
   const lines = [];
   for (const issue of issues) {
     const sev = issue.severity === "error" ? c(ANSI2.red, "error") : issue.severity === "warning" ? c(ANSI2.yellow, "warn ") : c(ANSI2.dim, "info ");
-    lines.push(`  ${sev} ${c(ANSI2.cyan, issue.ruleId)} ${c(ANSI2.dim, `\xD7${issue.count}`)}`);
+    const rigor = issue.rigor ? c(ANSI2.dim, ` [${issue.rigor}]`) : "";
+    lines.push(`  ${sev} ${c(ANSI2.cyan, issue.ruleId)}${rigor} ${c(ANSI2.dim, `\xD7${issue.count}`)}`);
     if (issue.why) lines.push(`    ${c(ANSI2.dim, stripBackticks2(issue.why))}`);
     if (issue.fix) {
       const [head, ...rest] = issue.fix.split("\n");
@@ -5288,6 +6301,7 @@ function rollupByRule(issues) {
       groups.set(issue.ruleId, {
         ruleId: issue.ruleId,
         severity: issue.severity,
+        rigor: issue.rigor,
         why: issue.why,
         fix: issue.fix,
         sample: issue.message,
@@ -5494,6 +6508,7 @@ export {
   PROFILES,
   PROFILE_NAMES,
   PROSE_RULES,
+  SITE_PROSE_RULES,
   routeKey,
   targetKey,
   fingerprint,
@@ -5506,4 +6521,4 @@ export {
   summarize,
   Logger
 };
-//# sourceMappingURL=chunk-TAZEAIFI.js.map
+//# sourceMappingURL=chunk-CWEJ6EXT.js.map