@reddoorla/maintenance 0.93.0 → 0.94.0

package/dist/chunk-VELWHWOW.js

@@ -0,0 +1,4194 @@
+import {
+  isPrivateOrLoopbackHost
+} from "./chunk-RARREDQE.js";
+
+// src/prospect/accessibility.ts
+var MAX_REPORTED_RULES = 12;
+var IMPACT_ORDER = { critical: 0, serious: 1, moderate: 2, minor: 3 };
+function summarizeAccessibility(pages) {
+  const withResults = pages.filter((p) => p.axe != null);
+  if (withResults.length === 0) {
+    return {
+      measured: false,
+      pagesExamined: 0,
+      rulesPassed: 0,
+      rulesIncomplete: 0,
+      incompleteIds: [],
+      rulesInapplicable: 0,
+      violations: [],
+      violationsTotal: 0
+    };
+  }
+  const byRule = /* @__PURE__ */ new Map();
+  let passes = 0;
+  let incomplete = 0;
+  const undecided = /* @__PURE__ */ new Set();
+  let inapplicable = 0;
+  for (const page of withResults) {
+    const axe = page.axe;
+    passes = Math.max(passes, axe.passes);
+    incomplete = Math.max(incomplete, axe.incomplete);
+    for (const id of axe.incompleteIds ?? []) undecided.add(id);
+    inapplicable = Math.max(inapplicable, axe.inapplicable ?? 0);
+    for (const v of axe.violations) {
+      const existing = byRule.get(v.id);
+      if (existing) {
+        existing.nodes += v.nodes;
+        if (!existing.pages.includes(page.url)) existing.pages.push(page.url);
+        existing.sample ??= v.sample;
+      } else {
+        byRule.set(v.id, { ...v, pages: [page.url] });
+      }
+    }
+  }
+  const all = [...byRule.values()].sort(
+    (a, b) => (IMPACT_ORDER[a.impact ?? "minor"] ?? 4) - (IMPACT_ORDER[b.impact ?? "minor"] ?? 4) || b.nodes - a.nodes || a.id.localeCompare(b.id)
+  );
+  return {
+    measured: true,
+    pagesExamined: withResults.length,
+    rulesPassed: passes,
+    // The UNION when we have the names, the per-page max otherwise.
+    //
+    // `Math.max` was only ever a proxy for "how many distinct rules", chosen
+    // because summing would have counted the same rule once per page. Now that
+    // the ids are collected, the distinct count is known exactly — and the two
+    // disagreed on our own site, where the report said "3 rules need a human"
+    // and then listed four. A reader who can count is a reader who stops
+    // trusting the numbers.
+    rulesIncomplete: undecided.size > 0 ? undecided.size : incomplete,
+    incompleteIds: [...undecided].sort(),
+    rulesInapplicable: inapplicable,
+    violations: all.slice(0, MAX_REPORTED_RULES),
+    violationsTotal: all.length
+  };
+}
+var MAX_CONSOLE_ERRORS = 8;
+var MAX_FAILED_REQUESTS = 12;
+var MAX_OVERSIZED_IMAGES = 6;
+
+// src/prospect/crawl.ts
+import { parse as parse2, NodeType as NodeType2 } from "node-html-parser";
+
+// src/prospect/pages.ts
+function fetchedOk(page) {
+  return page.status !== null && page.status < 400;
+}
+var INFRA_SEGMENTS = [/^cdn-cgi$/i, /^wp-admin$/i, /^wp-json$/i, /^xmlrpc\.php$/i];
+function isInfraPath(url) {
+  let path;
+  try {
+    path = new URL(url).pathname;
+  } catch {
+    return false;
+  }
+  return path.split("/").filter(Boolean).some((segment) => INFRA_SEGMENTS.some((re) => re.test(segment)));
+}
+function usablePages(pages) {
+  const candidates = pages.filter((p) => fetchedOk(p) && !isInfraPath(p.url));
+  const withRendered = candidates.filter((p) => p.rendered !== null);
+  const withRaw = candidates.filter((p) => p.raw !== null);
+  const view = withRendered.length >= withRaw.length ? "rendered" : "raw";
+  const kept = view === "rendered" ? withRendered : withRaw;
+  const usable = [];
+  for (const page of kept) {
+    const extract = view === "rendered" ? page.rendered : page.raw;
+    if (extract) usable.push({ page, extract });
+  }
+  return {
+    pages: usable,
+    view,
+    excluded: candidates.length - usable.length,
+    anchorsMeasured: usable.length > 0 && usable.every((p) => p.extract.anchors !== void 0)
+  };
+}
+
+// src/prospect/interaction.ts
+var ERROR_WORDS = /\b(required|please\s|cannot be blank|can't be blank|must be|enter a|fill in|invalid|not valid|is not a valid)\b/i;
+var FILLER = {
+  text: "Audit Test",
+  search: "Audit Test",
+  tel: "2085550142",
+  url: "https://example.com",
+  number: "1",
+  date: "2030-01-01",
+  textarea: "Checking that this form validates what it is given."
+};
+var INVALID_EMAIL = "not-an-email";
+var SENTINELS = [INVALID_EMAIL, ...Object.values(FILLER)];
+var REMOVE_MARKER = `() => {
+  document.querySelector("[data-audit-form]")?.removeAttribute("data-audit-form");
+}`;
+var CHOOSE_FORM = `() => {
+  const forms = Array.from(document.querySelectorAll("form"));
+  let best = null;
+  let bestScore = 0;
+  for (const form of forms) {
+    const controls = Array.from(form.querySelectorAll("input, textarea, select"));
+    const typed = (el) => (el.getAttribute("type") || el.tagName.toLowerCase()).toLowerCase();
+    const visible = controls.filter((el) => {
+      const t = typed(el);
+      if (t === "hidden" || t === "submit" || t === "button" || t === "reset") return false;
+      const r = el.getBoundingClientRect();
+      return r.width > 0 && r.height > 0;
+    });
+    if (visible.length === 0) continue;
+
+    const attrs = (el) =>
+      [el.getAttribute("name"), el.getAttribute("id"), el.getAttribute("autocomplete"),
+       el.getAttribute("placeholder"), el.getAttribute("aria-label")]
+        .filter(Boolean).join(" ").toLowerCase();
+    const hasEmail = visible.some(
+      (el) => typed(el) === "email" || /\\bemail\\b|e-mail/.test(attrs(el)),
+    );
+    const hasMessage = visible.some((el) => el.tagName === "TEXTAREA");
+    const action = (form.getAttribute("action") || "").toLowerCase();
+    const looksLikeSearch =
+      visible.length === 1 &&
+      (visible.some((el) => typed(el) === "search") || /search|\\/s\\b|\\?q=/.test(action) ||
+       /search|query/.test(attrs(visible[0])));
+    if (looksLikeSearch) continue;
+    // A password field means this is a login, not an enquiry. Interacting with
+    // one is both useless and rude.
+    if (visible.some((el) => typed(el) === "password")) continue;
+
+    const submit = form.querySelector(
+      'button[type="submit"], input[type="submit"], button:not([type]), button[type="button"]',
+    );
+    if (!submit) continue;
+
+    let score = visible.length;
+    if (hasEmail) score += 4;
+    if (hasMessage) score += 3;
+    if (score > bestScore) {
+      bestScore = score;
+      best = { form, hasEmail, fields: visible.length, action };
+    }
+  }
+  if (!best) return null;
+  best.form.setAttribute("data-audit-form", "");
+  // TARGET REMOVED, and this is a safety measure rather than a tidy-up.
+  // A form posting to target="popupwindow" \u2014 which is how Mailchimp's embed
+  // ships, and how clearleft.com's only form is written \u2014 submits into a NEW
+  // page, and a route registered on this one does not see it. Measured: the
+  // request went out and the server received it. Without the target the
+  // submission is an ordinary main-frame navigation, which the interceptor
+  // already stops. The page is abandoned straight after the probe, so nothing
+  // downstream sees the altered form.
+  best.form.removeAttribute("target");
+  return { fields: best.fields, hasEmail: best.hasEmail, action: best.action };
+}`;
+var FILL_FORM = `(args) => {
+  const form = document.querySelector("[data-audit-form]");
+  if (!form) return false;
+  const controls = Array.from(form.querySelectorAll("input, textarea, select"));
+  const fire = (el) => {
+    el.dispatchEvent(new Event("input", { bubbles: true }));
+    el.dispatchEvent(new Event("change", { bubbles: true }));
+  };
+  for (const el of controls) {
+    const type = (el.getAttribute("type") || el.tagName.toLowerCase()).toLowerCase();
+    if (type === "hidden" || type === "submit" || type === "button" || type === "reset") continue;
+    const attrs = [el.getAttribute("name"), el.getAttribute("id"), el.getAttribute("autocomplete"),
+                   el.getAttribute("placeholder")].filter(Boolean).join(" ").toLowerCase();
+    const isEmail = type === "email" || /\\bemail\\b|e-mail/.test(attrs);
+    if (el.tagName === "SELECT") {
+      if (el.options.length > 1) { el.selectedIndex = 1; fire(el); }
+      continue;
+    }
+    if (type === "checkbox" || type === "radio") {
+      if (!el.checked) { el.checked = true; fire(el); }
+      continue;
+    }
+    el.value = isEmail ? args.invalidEmail : (args.filler[type] || args.filler.text);
+    fire(el);
+  }
+  return true;
+}`;
+var READ_STATE = `(args) => {
+  const form = document.querySelector("[data-audit-form]");
+  if (!form) return null;
+  const nativeInvalid = typeof form.checkValidity === "function" ? !form.checkValidity() : false;
+  const flagged = form.querySelectorAll('[aria-invalid="true"], .error, .is-invalid, .invalid').length;
+  const alerts = Array.from(form.querySelectorAll('[role="alert"], [aria-live]'))
+    .map((el) => (el.textContent || "").trim())
+    .filter(Boolean)
+    .join(" ");
+  const text = (form.textContent || "").replace(/\\s+/g, " ").trim();
+  return {
+    nativeInvalid,
+    flagged,
+    hasErrorText: new RegExp(args.words, "i").test(alerts + " " + text),
+  };
+}`;
+var VALIDATION_SETTLE_MS = 600;
+var PROBE_BUDGET_MS = 45e3;
+function withTimeout(work, ms) {
+  let timer;
+  return Promise.race([
+    work.catch(() => null),
+    new Promise((resolve) => {
+      timer = setTimeout(() => resolve(null), ms);
+    })
+  ]).finally(() => clearTimeout(timer));
+}
+async function probeForms(deps) {
+  const chosen = await deps.evaluate(CHOOSE_FORM);
+  if (!chosen) return null;
+  const guard = await deps.intercept();
+  const probe = {
+    url: deps.url,
+    emptyRefused: void 0,
+    emptyHow: null,
+    invalidEmailRefused: chosen.hasEmail ? void 0 : null,
+    invalidEmailHow: null,
+    blocked: 0
+  };
+  try {
+    const before = await deps.evaluate(READ_STATE, { words: ERROR_WORDS.source });
+    if (before?.nativeInvalid) {
+      probe.emptyRefused = true;
+      probe.emptyHow = "the browser blocks it \u2014 the form marks its fields required";
+    } else {
+      const beforeBlocked = guard.blocked();
+      await deps.clickSubmit();
+      await deps.settle(VALIDATION_SETTLE_MS);
+      const after = await deps.evaluate(READ_STATE, { words: ERROR_WORDS.source });
+      const attempted = guard.blocked() > beforeBlocked;
+      const complained = after !== null && (after.hasErrorText || after.flagged > (before?.flagged ?? 0) || after.nativeInvalid);
+      if (complained) {
+        probe.emptyRefused = true;
+        probe.emptyHow = "the form showed an error rather than submitting";
+      } else if (attempted) {
+        probe.emptyRefused = false;
+        probe.emptyHow = "the form submitted with every field empty \u2014 we stopped the request before it left the browser";
+      } else if (after === null) {
+        probe.emptyRefused = void 0;
+      } else {
+        probe.emptyRefused = false;
+        probe.emptyHow = "the button did nothing at all \u2014 no error, and nothing sent";
+      }
+    }
+    if (chosen.hasEmail) {
+      const back = await guard.reload();
+      const filled = back ? await deps.evaluate(FILL_FORM, {
+        invalidEmail: INVALID_EMAIL,
+        filler: FILLER
+      }) : false;
+      if (!filled) {
+        probe.invalidEmailRefused = void 0;
+      } else {
+        const state = await deps.evaluate(READ_STATE, { words: ERROR_WORDS.source });
+        if (state?.nativeInvalid) {
+          probe.invalidEmailRefused = true;
+          probe.invalidEmailHow = "the browser catches it \u2014 the field is typed as an email";
+        } else {
+          const beforeBlocked = guard.blocked();
+          await deps.clickSubmit();
+          await deps.settle(VALIDATION_SETTLE_MS);
+          const after = await deps.evaluate(READ_STATE, { words: ERROR_WORDS.source });
+          const attempted = guard.blocked() > beforeBlocked;
+          if (after && (after.hasErrorText || after.nativeInvalid || after.flagged > 0)) {
+            probe.invalidEmailRefused = true;
+            probe.invalidEmailHow = "the form showed an error rather than submitting";
+          } else if (attempted) {
+            probe.invalidEmailRefused = false;
+            probe.invalidEmailHow = `the form accepted \u201C${INVALID_EMAIL}\u201D as an email address \u2014 we stopped the request before it left the browser`;
+          } else {
+            probe.invalidEmailRefused = void 0;
+          }
+        }
+      }
+    }
+  } catch {
+  } finally {
+    probe.blocked = guard.stopped();
+    await guard.release();
+  }
+  return probe;
+}
+function pageInteractionDeps(page, url) {
+  return {
+    url,
+    settle: (ms) => page.waitForTimeout(ms),
+    // Playwright evaluates a STRING as an expression and does not call it —
+    // `page.evaluate("() => 1 + 1")` yields a function object, which serialises
+    // to undefined, so every snippet here silently returned nothing. The call
+    // has to be written out, with the argument inlined as JSON (every argument
+    // in this file is our own constant, never anything off the page).
+    evaluate: (fn, arg) => page.evaluate(`(${fn})(${JSON.stringify(arg ?? null)})`),
+    async clickSubmit() {
+      const submit = page.locator(
+        '[data-audit-form] button[type="submit"], [data-audit-form] input[type="submit"], [data-audit-form] button:not([type]), [data-audit-form] button[type="button"]'
+      ).first();
+      await submit.click({ timeout: 5e3, force: true, noWaitAfter: true });
+    },
+    async intercept() {
+      let stopped = 0;
+      let submissions = 0;
+      let allowNavigation = false;
+      let armed = true;
+      let origin = "";
+      try {
+        origin = new URL(url).origin;
+      } catch {
+        origin = "";
+      }
+      const onDialog = (d) => void d.dismiss().catch(() => {
+      });
+      page.on("dialog", onDialog);
+      const router = page.context();
+      await router.route("**/*", (route) => {
+        if (!armed) {
+          void route.continue().catch(() => {
+          });
+          return;
+        }
+        let stop;
+        let looksLikeSubmission = false;
+        try {
+          const req = route.request();
+          const isNav = req.isNavigationRequest();
+          let frame = null;
+          try {
+            frame = req.frame();
+          } catch {
+            frame = null;
+          }
+          const isPopupNav = isNav && frame === null;
+          const isNavigation = isNav && frame === page.mainFrame();
+          const method = req.method().toUpperCase();
+          const sameOrigin = (() => {
+            try {
+              return new URL(req.url()).origin === origin;
+            } catch {
+              return false;
+            }
+          })();
+          stop = isPopupNav || isNavigation && !allowNavigation || method !== "GET";
+          const contentType = (req.headers()["content-type"] ?? "").toLowerCase();
+          const formEncoded = contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data");
+          const carriesOurs = (() => {
+            try {
+              const body = req.postData() ?? "";
+              if (body === "") return false;
+              return SENTINELS.some(
+                (v) => body.includes(v) || body.includes(encodeURIComponent(v))
+              );
+            } catch {
+              return false;
+            }
+          })();
+          looksLikeSubmission = isPopupNav || isNavigation && !allowNavigation || method !== "GET" && (sameOrigin || formEncoded || carriesOurs);
+        } catch {
+          stop = false;
+        }
+        if (stop) stopped++;
+        if (stop && looksLikeSubmission) submissions++;
+        void (stop ? route.abort() : route.continue()).catch(() => {
+        });
+      });
+      return {
+        blocked: () => submissions,
+        stopped: () => stopped,
+        reload: async () => {
+          allowNavigation = true;
+          try {
+            await page.goto(url, { waitUntil: "load", timeout: 2e4 });
+          } catch {
+            return false;
+          } finally {
+            allowNavigation = false;
+          }
+          const again = await page.evaluate(`(${CHOOSE_FORM})(null)`).catch(() => null);
+          return again !== null;
+        },
+        release: async () => {
+          armed = false;
+          page.off("dialog", onDialog);
+          await withTimeout(page.evaluate(`(${REMOVE_MARKER})()`), 5e3);
+          await withTimeout(router.unrouteAll({ behavior: "ignoreErrors" }), 3e3);
+        }
+      };
+    }
+  };
+}
+
+// src/prospect/extract.ts
+import { parse, NodeType } from "node-html-parser";
+var MAX_ANCHORS = 300;
+var MAX_SCRIPTS = 120;
+var MAX_INLINE_URLS = 40;
+var NAMESPACE_URLS = /^https?:\/\/(www\.)?w3\.org\//i;
+function urlsIn(code) {
+  const found = /* @__PURE__ */ new Set();
+  for (const m of code.matchAll(/https?:\/\/[^\s"'`\\)<>]{4,200}/gi)) {
+    if (NAMESPACE_URLS.test(m[0])) continue;
+    found.add(m[0]);
+    if (found.size >= MAX_INLINE_URLS) break;
+  }
+  return [...found];
+}
+var NON_FIELD_INPUTS = /* @__PURE__ */ new Set(["hidden", "submit", "button", "image", "reset"]);
+var CONTACT_FIELD = /\b(e-?mail|phone|tel|mobile|contact)\b/i;
+var toWords = (s) => s.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/[_\-.]+/g, " ");
+var UNRENDERED_TAGS = /* @__PURE__ */ new Set(["STYLE", "NOSCRIPT", "TEMPLATE", "SVG"]);
+var BLOCK = /* @__PURE__ */ new Set([
+  "ADDRESS",
+  "ARTICLE",
+  "ASIDE",
+  "BLOCKQUOTE",
+  "BR",
+  "DD",
+  "DIV",
+  "DL",
+  "DT",
+  "FIELDSET",
+  "FIGCAPTION",
+  "FIGURE",
+  "FOOTER",
+  "FORM",
+  "H1",
+  "H2",
+  "H3",
+  "H4",
+  "H5",
+  "H6",
+  "HEADER",
+  "HR",
+  "LI",
+  "MAIN",
+  "NAV",
+  "OL",
+  "P",
+  "PRE",
+  "SECTION",
+  "TABLE",
+  "TD",
+  "TH",
+  "TR",
+  "UL"
+]);
+var collapse = (s) => s.replace(/\s+/g, " ").trim();
+var MAX_WALK_DEPTH = 100;
+function headingTextOf(el) {
+  const label = (el.getAttribute("aria-label") ?? "").trim();
+  if (label) return collapse(label);
+  const text = textOf(el);
+  if (text) return text;
+  const alts = el.querySelectorAll("img").map((img) => (img.getAttribute("alt") ?? "").trim()).filter((a) => a.length > 0);
+  return collapse(alts.join(" "));
+}
+function textOf(el) {
+  const parts = [];
+  const walk = (node, depth) => {
+    if (depth > MAX_WALK_DEPTH) return;
+    for (const child of node.childNodes) {
+      if (child.nodeType === NodeType.TEXT_NODE) {
+        parts.push(child.text);
+        continue;
+      }
+      if (child.nodeType !== NodeType.ELEMENT_NODE) continue;
+      const e = child;
+      const tag = e.tagName;
+      if (UNRENDERED_TAGS.has(tag) || tag === "SCRIPT" || tag === "TITLE") continue;
+      const block = BLOCK.has(tag);
+      if (block) parts.push("\n");
+      walk(e, depth + 1);
+      if (block) parts.push("\n");
+    }
+  };
+  walk(el, 0);
+  return collapse(parts.join(""));
+}
+function collect(el, out, depth = 0) {
+  if (depth > MAX_WALK_DEPTH) return;
+  for (const child of el.childNodes) {
+    if (child.nodeType !== NodeType.ELEMENT_NODE) continue;
+    const e = child;
+    const tag = e.tagName;
+    if (UNRENDERED_TAGS.has(tag)) continue;
+    switch (tag) {
+      case "META":
+        out.metas.push(e);
+        break;
+      case "LINK":
+        out.links.push(e);
+        break;
+      case "IMG":
+        out.images.push(e);
+        break;
+      case "A":
+        if ((e.getAttribute("href") ?? "").trim()) out.anchors.push(e);
+        break;
+      case "FORM":
+        out.forms.push(e);
+        break;
+      case "TITLE":
+        if (out.title === null) out.title = collapse(e.text) || null;
+        break;
+      case "SCRIPT": {
+        const isJsonLd = (e.getAttribute("type") ?? "").toLowerCase().trim() === "application/ld+json";
+        if (isJsonLd) out.jsonLd.push(e.text);
+        const src = (e.getAttribute("src") ?? "").trim();
+        if (src) {
+          out.scriptSrcs.push(src);
+        } else if (isJsonLd) {
+        } else {
+          for (const url of urlsIn(e.text)) out.inlineScriptUrls.push(url);
+        }
+        continue;
+      }
+      case "H1":
+      case "H2":
+      case "H3":
+      case "H4":
+      case "H5":
+      case "H6": {
+        const text = headingTextOf(e);
+        if (text) out.headings.push({ level: Number(tag.slice(1)), text });
+        break;
+      }
+    }
+    collect(e, out, depth + 1);
+  }
+}
+var NON_ENQUIRY_SEGMENTS = /* @__PURE__ */ new Set([
+  // Account doors
+  "login",
+  "log-in",
+  "log_in",
+  "logon",
+  "signin",
+  "sign-in",
+  "sign_in",
+  "signup",
+  "sign-up",
+  "sign_up",
+  "register",
+  "registration",
+  // Commerce
+  "checkout",
+  "cart",
+  "basket",
+  // Retrieval, not contact
+  "search",
+  // WordPress, whose comment endpoint is a fixed path on a great many sites
+  "wp-login",
+  "wp-signup",
+  "wp-register",
+  "wp-comments-post"
+]);
+function isNonEnquiryAction(action) {
+  if (!action) return false;
+  let path;
+  try {
+    path = new URL(action, "https://form.invalid/").pathname;
+  } catch {
+    path = action;
+  }
+  return path.toLowerCase().split("/").some((segment) => NON_ENQUIRY_SEGMENTS.has(segment.replace(/\.[a-z0-9]+$/, "")));
+}
+function formShape(form) {
+  const controls = form.querySelectorAll("input, textarea, select");
+  let fieldCount = 0;
+  let contactFieldCount = 0;
+  let hasContactField = false;
+  let hasPassword = false;
+  let hasTextarea = false;
+  let hasSubmit = form.querySelectorAll("button").length > 0;
+  const fields = [];
+  for (const control of controls) {
+    const type = (control.getAttribute("type") ?? "").toLowerCase().trim();
+    if (control.tagName === "INPUT" && NON_FIELD_INPUTS.has(type)) {
+      if (type === "submit" || type === "image") hasSubmit = true;
+      continue;
+    }
+    if (control.tagName === "TEXTAREA") hasTextarea = true;
+    if (control.tagName === "INPUT" && type === "password") hasPassword = true;
+    fieldCount += 1;
+    fields.push({
+      // A bare <input> defaults to text, exactly as a browser treats it, so an
+      // author who wrote nothing reads the same as one who wrote type="text".
+      type: control.tagName === "INPUT" ? type || "text" : control.tagName.toLowerCase(),
+      name: (control.getAttribute("name") ?? "").toLowerCase().trim() || null,
+      autocomplete: (control.getAttribute("autocomplete") ?? "").toLowerCase().trim() || null,
+      required: control.hasAttribute("required")
+    });
+    const signature = toWords(
+      [
+        type,
+        control.getAttribute("name") ?? "",
+        control.getAttribute("id") ?? "",
+        control.getAttribute("placeholder") ?? "",
+        control.getAttribute("autocomplete") ?? "",
+        control.getAttribute("aria-label") ?? ""
+      ].join(" ")
+    );
+    if (type === "email" || type === "tel" || CONTACT_FIELD.test(signature)) {
+      hasContactField = true;
+      contactFieldCount += 1;
+    }
+  }
+  const action = form.getAttribute("action")?.trim() || null;
+  const isAccountForm = hasPassword || isNonEnquiryAction(action);
+  const asksSomethingBack = hasTextarea || fieldCount - contactFieldCount >= 2;
+  return {
+    // A lone contact field is a newsletter box, not an enquiry form. See
+    // `FormKind`: on one audited site a footer email box put every page at zero
+    // clicks from "reaching them", when the only form that reaches a person
+    // was the nine-field one on its contact page.
+    kind: isAccountForm || !hasContactField ? "other" : fieldCount >= 2 && asksSomethingBack ? "enquiry" : "subscribe",
+    action,
+    method: (form.getAttribute("method") ?? "get").toLowerCase().trim() || "get",
+    fieldCount,
+    hasContactField,
+    hasSubmit,
+    fields
+  };
+}
+function extractPage(html) {
+  const root = parse(html);
+  const documentEl = root.querySelector("html") ?? root;
+  const out = {
+    metas: [],
+    links: [],
+    jsonLd: [],
+    images: [],
+    headings: [],
+    title: null,
+    anchors: [],
+    forms: [],
+    scriptSrcs: [],
+    inlineScriptUrls: []
+  };
+  collect(documentEl, out);
+  const social = {};
+  const metas = {};
+  let metaDescription = null;
+  let hasViewportMeta = false;
+  for (const m of out.metas) {
+    const charset = (m.getAttribute("charset") ?? "").trim();
+    if (charset) {
+      metas["charset"] = charset;
+      continue;
+    }
+    const key = (m.getAttribute("property") ?? m.getAttribute("name") ?? "").toLowerCase().trim();
+    const content = (m.getAttribute("content") ?? "").trim();
+    if (!key) {
+      const equiv = (m.getAttribute("http-equiv") ?? "").toLowerCase().trim();
+      if (equiv === "content-type" && /charset=/i.test(content)) {
+        metas["charset"] = content.replace(/^.*charset=/i, "").trim();
+      }
+      continue;
+    }
+    if (key === "description") metaDescription = content || null;
+    else if (key === "viewport") hasViewportMeta = content.length > 0;
+    if (key.startsWith("og:") || key.startsWith("twitter:")) social[key] = content;
+    else metas[key] = content;
+  }
+  const canonicalEl = out.links.find(
+    (l) => (l.getAttribute("rel") ?? "").toLowerCase().trim() === "canonical"
+  );
+  return {
+    title: out.title,
+    metaDescription,
+    canonical: canonicalEl?.getAttribute("href")?.trim() || null,
+    social,
+    headings: out.headings,
+    jsonLd: out.jsonLd,
+    images: {
+      total: out.images.length,
+      withAlt: out.images.filter((i) => (i.getAttribute("alt") ?? "").trim().length > 0).length
+    },
+    hasViewportMeta,
+    // Body-scoped: <head> has no visible text, and scoping here rather than
+    // filtering keeps the rule obvious.
+    text: textOf(root.querySelector("body") ?? documentEl),
+    anchors: out.anchors.slice(0, MAX_ANCHORS).map((a) => ({
+      href: (a.getAttribute("href") ?? "").trim(),
+      // The visible label, not the raw text: an anchor wrapping an icon and a
+      // span should read as its span. `textOf` already drops the unrendered
+      // subtrees an icon sprite lives in.
+      text: textOf(a).slice(0, 120),
+      rel: (a.getAttribute("rel") ?? "").toLowerCase().trim(),
+      target: (a.getAttribute("target") ?? "").toLowerCase().trim(),
+      // NOT lower-cased and NOT trimmed to a keyword: this is prose, and the
+      // check that reads it needs to know whether a human wrote a destination
+      // into it. apple.com's “Learn more” links all carry one — `aria-label="Learn
+      // more about accessibility"` — so judging their link text without it
+      // called 60 well-labelled links bare.
+      ariaLabel: (a.getAttribute("aria-label") ?? "").trim().slice(0, 120)
+    })),
+    // The TRUE total, so a capped list is never mistaken for a complete one.
+    anchorCount: out.anchors.length,
+    imageSrcs: out.images.map((i) => (i.getAttribute("src") ?? "").trim()).filter((src) => src.length > 0),
+    forms: out.forms.map(formShape),
+    metas,
+    // A projection of elements `collect` was already gathering — until now only
+    // the canonical one was ever read off them.
+    links: out.links.map((l) => ({
+      rel: (l.getAttribute("rel") ?? "").toLowerCase().trim(),
+      href: (l.getAttribute("href") ?? "").trim(),
+      hreflang: (l.getAttribute("hreflang") ?? "").trim(),
+      type: (l.getAttribute("type") ?? "").toLowerCase().trim()
+    })),
+    scriptSrcs: out.scriptSrcs.slice(0, MAX_SCRIPTS),
+    inlineScriptUrls: [...new Set(out.inlineScriptUrls)].slice(0, MAX_INLINE_URLS),
+    // The TRUE total, for the same reason `anchorCount` exists: a capped list
+    // must never be mistaken for a complete one.
+    scriptCount: out.scriptSrcs.length
+  };
+}
+
+// src/prospect/crawl.ts
+var AI_AGENTS = [
+  "GPTBot",
+  "OAI-SearchBot",
+  "ClaudeBot",
+  "PerplexityBot",
+  "Google-Extended",
+  "CCBot"
+];
+var CLASSICAL_AGENTS = ["Googlebot", "Bingbot"];
+var ALL_AGENTS = [...AI_AGENTS, ...CLASSICAL_AGENTS];
+function parseRobots(txt) {
+  const groups = [];
+  let current = null;
+  let lastWasAgent = false;
+  for (const rawLine of txt.split(/\r?\n/)) {
+    const line = (rawLine.split("#")[0] ?? "").trim();
+    if (!line) continue;
+    const idx = line.indexOf(":");
+    if (idx < 0) continue;
+    const field = line.slice(0, idx).trim().toLowerCase();
+    const value = line.slice(idx + 1).trim();
+    if (field === "user-agent") {
+      if (!current || !lastWasAgent) {
+        current = { agents: [], rules: [] };
+        groups.push(current);
+      }
+      current.agents.push(value.toLowerCase());
+      lastWasAgent = true;
+    } else if (field === "allow" || field === "disallow") {
+      if (!current) continue;
+      current.rules.push({ type: field === "allow" ? "allow" : "disallow", path: value, line });
+      lastWasAgent = false;
+    }
+  }
+  return groups;
+}
+function pathCoversRoot(pattern) {
+  if (!pattern) return false;
+  const anchored = pattern.endsWith("$");
+  const body = anchored ? pattern.slice(0, -1) : pattern;
+  const source = body.split("*").map((part) => part.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join(".*");
+  return new RegExp(`^${source}${anchored ? "$" : ""}`).test("/");
+}
+function robotsPathMatches(pattern, path) {
+  if (!pattern) return false;
+  const anchored = pattern.endsWith("$");
+  const body = anchored ? pattern.slice(0, -1) : pattern;
+  const source = body.split("*").map((part) => part.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join(".*");
+  return new RegExp(`^${source}${anchored ? "$" : ""}`).test(path);
+}
+function robotsAllowsUs(robotsTxt, url, agent) {
+  if (robotsTxt === null) return true;
+  let path;
+  try {
+    const u = new URL(url);
+    path = `${u.pathname}${u.search}`;
+  } catch {
+    return true;
+  }
+  const groups = parseRobots(robotsTxt);
+  const lower = agent.toLowerCase();
+  const named = groups.filter(
+    (g) => g.agents.some((a) => a !== "*" && (lower.includes(a) || a.includes(lower.split("/")[0] ?? "")))
+  );
+  const matched = named.length > 0 ? named : groups.filter((g) => g.agents.includes("*"));
+  let best = null;
+  for (const rule of matched.flatMap((g) => g.rules)) {
+    if (!robotsPathMatches(rule.path, path)) continue;
+    if (best === null || rule.path.length > best.length) {
+      best = { type: rule.type, length: rule.path.length };
+    }
+  }
+  return best === null || best.type === "allow";
+}
+function evaluateAgentAccess(robotsTxt) {
+  if (robotsTxt === null) {
+    return ALL_AGENTS.map((agent) => ({ agent, allowed: true, matchedRule: null }));
+  }
+  const groups = parseRobots(robotsTxt);
+  return ALL_AGENTS.map((agent) => {
+    const lower = agent.toLowerCase();
+    const named = groups.filter((g) => g.agents.includes(lower));
+    const matched = named.length > 0 ? named : groups.filter((g) => g.agents.includes("*"));
+    if (matched.length === 0) return { agent, allowed: true, matchedRule: null };
+    const header = `User-agent: ${named.length > 0 ? agent : "*"}`;
+    const rootRules = matched.flatMap((g) => g.rules).filter((r) => pathCoversRoot(r.path));
+    const block = rootRules.find((r) => r.type === "disallow");
+    const allow = rootRules.find((r) => r.type === "allow");
+    if (block && !allow) return { agent, allowed: false, matchedRule: `${header} \u2192 ${block.line}` };
+    return { agent, allowed: true, matchedRule: allow ? `${header} \u2192 ${allow.line}` : null };
+  });
+}
+var MAX_WALK_DEPTH2 = 100;
+function sameOriginLinks(html, baseUrl) {
+  const site = new URL(baseUrl);
+  const doc = parse2(html);
+  const baseHref = doc.querySelector("base")?.getAttribute("href");
+  let resolveBase = site;
+  if (baseHref) {
+    try {
+      resolveBase = new URL(baseHref, site);
+    } catch {
+    }
+  }
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  const walk = (el, depth) => {
+    if (depth > MAX_WALK_DEPTH2) return;
+    for (const child of el.childNodes) {
+      if (child.nodeType !== NodeType2.ELEMENT_NODE) continue;
+      const e = child;
+      if (UNRENDERED_TAGS.has(e.tagName)) continue;
+      if (e.tagName === "A") {
+        const href = e.getAttribute("href");
+        if (href) {
+          let u;
+          try {
+            u = new URL(href, resolveBase);
+          } catch {
+            u = null;
+          }
+          if (u && u.origin === site.origin && (u.protocol === "http:" || u.protocol === "https:")) {
+            u.hash = "";
+            const norm = u.toString();
+            if (!seen.has(norm)) {
+              seen.add(norm);
+              out.push(norm);
+            }
+          }
+        }
+      }
+      walk(e, depth + 1);
+    }
+  };
+  walk(doc, 0);
+  return out;
+}
+function decodeXmlText(s) {
+  return s.replace(/<!\[CDATA\[([\s\S]*?)\]\]>/g, "$1").replace(/&#x([0-9a-f]+);/gi, (_, hex) => String.fromCodePoint(parseInt(hex, 16))).replace(/&#(\d+);/g, (_, dec) => String.fromCodePoint(Number(dec))).replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&apos;/g, "'").replace(/&amp;/g, "&");
+}
+function parseSitemapLocs(xml) {
+  return [...xml.matchAll(/<(?:[\w-]+:)?loc\b[^>]*>([\s\S]*?)<\/(?:[\w-]+:)?loc>/gi)].map((m) => decodeXmlText(m[1] ?? "").trim()).filter(Boolean);
+}
+function isSafeNestedSitemap(child, origin) {
+  let url;
+  try {
+    url = new URL(child, origin);
+  } catch {
+    return false;
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:") return false;
+  if (url.origin !== origin) return false;
+  return !isPrivateOrLoopbackHost(url.hostname);
+}
+function isSitemapIndex(xml) {
+  return /<(?:[\w-]+:)?sitemapindex[\s>]/i.test(xml);
+}
+function asRendered(v) {
+  if (v === void 0) return null;
+  return typeof v === "string" ? { html: v, axe: null, vitals: null } : v;
+}
+var USER_AGENT = "ReddoorAudit/1.0 (+https://reddoorla.com/; operator-run site audit)";
+var ASSET_EXT = /\.(pdf|jpe?g|png|gif|webp|avif|svg|zip|mp4|mov|css|js|xml|json)$/i;
+var MAX_RESPONSE_BYTES = 5e6;
+var RENDER_SETTLE_MS = 1500;
+var ResponseTooLargeError = class extends Error {
+  constructor(url) {
+    super(`response exceeds the ${MAX_RESPONSE_BYTES}-byte limit: ${url}`);
+    this.name = "ResponseTooLargeError";
+  }
+};
+var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+var MAX_SITEMAP_SAMPLE = 120;
+var MAX_SITEMAP_CHILDREN = 25;
+var CONTENT_BUDGET_MS = 2e4;
+var AXE_BUDGET_MS = 45e3;
+var VITALS_BUDGET_MS = 3e4;
+async function pacedEach(items, delayMs, fn, sleepFn = sleep) {
+  for (let i = 0; i < items.length; i++) {
+    if (i > 0 && delayMs > 0) await sleepFn(delayMs);
+    await fn(items[i]);
+  }
+}
+async function optional(deps, url) {
+  try {
+    const res = await deps.fetchUrl(url);
+    return res.status >= 400 ? { res: null, error: null } : { res, error: null };
+  } catch (err) {
+    if (err instanceof ResponseTooLargeError) return { res: null, error: null };
+    return { res: null, error: err instanceof Error ? err.message : String(err) };
+  }
+}
+async function optionalRobots(deps, url) {
+  const first = await optional(deps, url);
+  return first.error === null ? first : optional(deps, url);
+}
+function textSidecar(res) {
+  if (!res) return null;
+  const body = res.body.trim();
+  if (!body || body.startsWith("<")) return null;
+  return res.body;
+}
+function headerValue(headers, name) {
+  for (const [k, v] of Object.entries(headers)) {
+    if (k.toLowerCase() === name) return v;
+  }
+  return null;
+}
+function samePageKey(u) {
+  const path = u.pathname.replace(/\/+$/, "") || "/";
+  return `${u.origin.toLowerCase()}${path}${u.search}`;
+}
+function normalizeCandidates(urls, origin, max, robotsTxt) {
+  const firstOfPath = [];
+  const variants = [];
+  const seen = /* @__PURE__ */ new Set();
+  const paths = /* @__PURE__ */ new Set();
+  for (const raw of urls) {
+    let u;
+    try {
+      u = new URL(raw);
+    } catch {
+      continue;
+    }
+    if (u.origin !== origin) continue;
+    if (ASSET_EXT.test(u.pathname)) continue;
+    if (isInfraPath(u.toString())) continue;
+    if (!robotsAllowsUs(robotsTxt, u.toString(), USER_AGENT)) continue;
+    u.hash = "";
+    const key = samePageKey(u);
+    if (seen.has(key)) continue;
+    seen.add(key);
+    const path = `${u.origin.toLowerCase()}${u.pathname.replace(/\/+$/, "") || "/"}`;
+    if (paths.has(path)) variants.push(u.toString());
+    else {
+      paths.add(path);
+      firstOfPath.push(u.toString());
+    }
+  }
+  return [...firstOfPath, ...variants].slice(0, max);
+}
+function sitemapTruncatedOf(s) {
+  return s.sitemapTruncated;
+}
+async function fetchSidecars(origin, deps) {
+  const robots = await optionalRobots(deps, `${origin}/robots.txt`);
+  const robotsTxt = textSidecar(robots.res);
+  const agentAccess = evaluateAgentAccess(
+    robotsTxt && /user-agent/i.test(robotsTxt) ? robotsTxt : null
+  );
+  const llms = await optional(deps, `${origin}/llms.txt`);
+  const llmsRaw = textSidecar(llms.res);
+  const llmsTxt = llmsRaw ? {
+    present: true,
+    firstLine: llmsRaw.split(/\r?\n/).find((l) => l.trim())?.trim() ?? null
+  } : { present: false, firstLine: null };
+  const sitemap = await optional(deps, `${origin}/sitemap.xml`);
+  let sitemapUrls = [];
+  let sitemapPresent = false;
+  let sitemapTruncated = false;
+  if (sitemap.res && /<(urlset|sitemapindex)[\s>]/i.test(sitemap.res.body)) {
+    sitemapPresent = true;
+    if (isSitemapIndex(sitemap.res.body)) {
+      const safe2 = parseSitemapLocs(sitemap.res.body).filter(
+        (child) => isSafeNestedSitemap(child, origin)
+      );
+      const children = safe2.slice(0, MAX_SITEMAP_CHILDREN);
+      sitemapTruncated = safe2.length > children.length;
+      for (const child of children) {
+        const nested = await optional(deps, child);
+        if (nested.res) sitemapUrls.push(...parseSitemapLocs(nested.res.body));
+        else sitemapTruncated = true;
+      }
+    } else {
+      sitemapUrls = parseSitemapLocs(sitemap.res.body);
+    }
+  }
+  return {
+    robotsTxt,
+    agentAccess,
+    llmsTxt,
+    sitemapUrls,
+    sitemapPresent,
+    sitemapTruncated,
+    sidecarErrors: { robots: robots.error, llms: llms.error, sitemap: sitemap.error }
+  };
+}
+async function crawlSite(rawUrl, deps) {
+  const start = new URL(rawUrl);
+  start.hash = "";
+  start.username = "";
+  start.password = "";
+  if (isPrivateOrLoopbackHost(start.hostname)) {
+    throw Object.assign(
+      new Error(
+        `${start.toString()} is a private address (${start.hostname}) \u2014 refusing to crawl it.`
+      ),
+      { exitCode: 1 }
+    );
+  }
+  let home;
+  try {
+    home = await deps.fetchUrl(start.toString());
+  } catch (err) {
+    throw Object.assign(
+      new Error(
+        `Could not reach ${start.toString()}: ${err instanceof Error ? err.message : String(err)}`
+      ),
+      { exitCode: 1 }
+    );
+  }
+  if (home.status >= 400) {
+    throw Object.assign(
+      new Error(`${start.toString()} returned HTTP ${home.status} \u2014 nothing to audit.`),
+      { exitCode: 1 }
+    );
+  }
+  let resolved;
+  try {
+    resolved = new URL(home.url ?? start.toString());
+  } catch {
+    resolved = start;
+  }
+  if (isPrivateOrLoopbackHost(resolved.hostname)) {
+    throw Object.assign(
+      new Error(
+        `${start.toString()} redirected to a private address (${resolved.hostname}) \u2014 refusing to crawl it.`
+      ),
+      { exitCode: 1 }
+    );
+  }
+  const resolvedUrl = resolved.toString();
+  const origin = resolved.origin;
+  const sidecars = await fetchSidecars(origin, deps);
+  const pageUrls = normalizeCandidates(
+    [resolvedUrl, ...sidecars.sitemapUrls, ...sameOriginLinks(home.body, resolvedUrl)],
+    origin,
+    deps.maxPages,
+    sidecars.robotsTxt
+  );
+  const rendered = await deps.renderPages(pageUrls).catch(() => /* @__PURE__ */ new Map());
+  const pages = [];
+  for (const url of pageUrls) {
+    let res = null;
+    let error = null;
+    if (url === resolvedUrl) {
+      res = home;
+    } else {
+      if (deps.delayMs > 0) await sleep(deps.delayMs);
+      try {
+        res = await deps.fetchUrl(url);
+      } catch (err) {
+        error = err instanceof Error ? err.message : String(err);
+      }
+    }
+    const renderedPage = asRendered(rendered.get(url));
+    const renderedHtml = renderedPage?.html ?? null;
+    const contentType = res ? headerValue(res.headers, "content-type") : null;
+    const notHtmlReason = contentType !== null && !contentType.toLowerCase().includes("html") ? `not HTML (${contentType})` : null;
+    const usable = res !== null && res.status < 400 && notHtmlReason === null;
+    pages.push({
+      url,
+      status: res?.status ?? null,
+      raw: usable ? extractPage(res.body) : null,
+      // Gated on `usable` for the same reason `raw` is. A browser paints
+      // something for a 404 — Cloudflare's email-protection interstitial is the
+      // case that bit us — and a captured paint is not evidence that the URL is
+      // a page of this website. Leaving it non-null let every cross-page check
+      // that asked "is there an extract?" admit a page the server refused, and
+      // that one URL became the only dead end and the only off-template page
+      // found in the entire stored corpus.
+      rendered: usable && renderedHtml ? extractPage(renderedHtml) : null,
+      error: error ?? (res && res.status >= 400 ? `HTTP ${res.status}` : notHtmlReason),
+      // Gated on `usable` for the same reason as `rendered`: a browser paints
+      // something for a 404, and running the rule set over an error page would
+      // report that page's failings as the website's.
+      axe: usable ? renderedPage?.axe ?? null : null,
+      vitals: usable ? renderedPage?.vitals ?? null : null,
+      // Spread, so an absent probe stays absent: `formProbe: undefined` is
+      // rejected under exactOptionalPropertyTypes, and `?? null` would turn
+      // "we never tried" into "we tried and there was nothing".
+      ...usable && renderedPage?.formProbe !== void 0 ? { formProbe: renderedPage.formProbe } : {}
+    });
+  }
+  const homeHeaders = {};
+  for (const [k, v] of Object.entries(home.headers)) homeHeaders[k.toLowerCase()] = v;
+  return {
+    origin,
+    robotsTxt: sidecars.robotsTxt,
+    agentAccess: sidecars.agentAccess,
+    sitemap: {
+      present: sidecars.sitemapPresent,
+      urlCount: sidecars.sitemapUrls.length,
+      // A capped sample, kept so Tier 2 can ask whether the URLs a sitemap
+      // advertises actually answer — `urlCount` alone cannot be probed. Capped
+      // because this lands in `result_json`, and a 4,000-URL sitemap has no
+      // business being stored whole for the sake of sampling twelve of them.
+      sample: sidecars.sitemapUrls.slice(0, MAX_SITEMAP_SAMPLE),
+      truncated: sitemapTruncatedOf(sidecars)
+    },
+    llmsTxt: sidecars.llmsTxt,
+    sidecarErrors: sidecars.sidecarErrors,
+    homeHeaders,
+    pages
+  };
+}
+async function readCapped(res, url) {
+  const declared = res.headers.get("content-length");
+  if (declared !== null && Number(declared) > MAX_RESPONSE_BYTES) {
+    throw new ResponseTooLargeError(url);
+  }
+  if (!res.body) return "";
+  const reader = res.body.getReader();
+  const chunks = [];
+  let total = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    if (!value) continue;
+    total += value.byteLength;
+    if (total > MAX_RESPONSE_BYTES) {
+      await reader.cancel();
+      throw new ResponseTooLargeError(url);
+    }
+    chunks.push(value);
+  }
+  const merged = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    merged.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return new TextDecoder("utf-8").decode(merged);
+}
+var MOBILE_WIDTH = 375;
+var MOBILE_HEIGHT = 812;
+var DESKTOP_WIDTH = 1280;
+var DESKTOP_HEIGHT = 720;
+var OVERFLOW_SETTLE_BUDGET_MS = 5e3;
+var OVERFLOW_SETTLE_STEP_MS = 250;
+async function measureVitals(page, collected) {
+  try {
+    const desktop = await page.evaluate(
+      ({ maxImages }) => {
+        const tiny = { count: 0, sample: null };
+        for (const el of Array.from(document.body.querySelectorAll("*"))) {
+          const ownText = Array.from(el.childNodes).filter((n) => n.nodeType === 3).map((n) => n.textContent ?? "").join("").trim();
+          if (ownText.length < 12) continue;
+          const size = parseFloat(getComputedStyle(el).fontSize);
+          if (Number.isFinite(size) && size > 0 && size < 12) {
+            tiny.count += 1;
+            tiny.sample ??= ownText.slice(0, 80);
+          }
+        }
+        const oversized = [];
+        for (const img of Array.from(document.images)) {
+          const rendered = img.clientWidth;
+          if (rendered > 0 && img.naturalWidth > rendered * 2.5) {
+            oversized.push({
+              src: img.currentSrc || img.src,
+              naturalWidth: img.naturalWidth,
+              renderedWidth: rendered
+            });
+          }
+        }
+        oversized.sort((a, b) => b.naturalWidth - a.naturalWidth);
+        return { tiny, oversized: oversized.slice(0, maxImages) };
+      },
+      { maxImages: MAX_OVERSIZED_IMAGES }
+    );
+    await page.setViewportSize({ width: MOBILE_WIDTH, height: MOBILE_HEIGHT });
+    const overflowAt375 = await settledOverflow(
+      () => page.evaluate(() => {
+        const doc = document.documentElement;
+        return Math.max(0, Math.round(doc.scrollWidth - doc.clientWidth));
+      }),
+      (ms) => page.waitForTimeout(ms)
+    );
+    await page.setViewportSize({ width: DESKTOP_WIDTH, height: DESKTOP_HEIGHT });
+    return {
+      consoleErrors: collected.consoleErrors.slice(0, MAX_CONSOLE_ERRORS),
+      failedRequests: collected.failed.slice(0, MAX_FAILED_REQUESTS),
+      overflowAt375,
+      tinyText: desktop.tiny,
+      oversizedImages: desktop.oversized
+    };
+  } catch {
+    return null;
+  }
+}
+async function settledOverflow(read, wait, budgetMs = OVERFLOW_SETTLE_BUDGET_MS, stepMs = OVERFLOW_SETTLE_STEP_MS) {
+  let last = -1;
+  const deadline = Date.now() + budgetMs;
+  for (; ; ) {
+    await wait(stepMs);
+    const now = await read();
+    if (now === last) return now;
+    if (Date.now() > deadline) return 0;
+    last = now;
+  }
+}
+async function runAxe(page) {
+  try {
+    const { AxeBuilder } = await import("@axe-core/playwright");
+    const results = await new AxeBuilder({ page }).analyze();
+    return {
+      violations: results.violations.map((v) => ({
+        id: v.id,
+        impact: v.impact ?? null,
+        help: v.help,
+        helpUrl: v.helpUrl,
+        nodes: v.nodes.length,
+        // One element, truncated: enough for a reader to find it on the page,
+        // not enough to bloat a stored report with a page of markup.
+        sample: v.nodes[0]?.html?.slice(0, 200) ?? null
+      })),
+      passes: results.passes.length,
+      incomplete: results.incomplete.length,
+      // The ids as well as the count: "three rules need a human" is a worry,
+      // "colour contrast over an image needs a human" is something to look at.
+      incompleteIds: results.incomplete.map((r) => r.id),
+      // Carried so the report can say how many rules had something to check
+      // rather than implying we checked all ninety.
+      inapplicable: results.inapplicable.length
+    };
+  } catch {
+    return null;
+  }
+}
+function defaultCrawlDeps(over = {}) {
+  const { probeForms: pressForms = true, ...deps } = over;
+  const maxPages = over.maxPages ?? 20;
+  const delayMs = over.delayMs ?? 500;
+  return {
+    async fetchUrl(url) {
+      const res = await fetch(url, {
+        headers: {
+          "user-agent": USER_AGENT,
+          accept: "text/html,application/xhtml+xml,text/plain,*/*"
+        },
+        redirect: "follow",
+        signal: AbortSignal.timeout(2e4)
+      });
+      const headers = {};
+      res.headers.forEach((v, k) => {
+        headers[k] = v;
+      });
+      return { status: res.status, body: await readCapped(res, url), headers, url: res.url };
+    },
+    async renderPages(urls) {
+      const { chromium } = await import("@playwright/test");
+      const out = /* @__PURE__ */ new Map();
+      const browser = await chromium.launch();
+      try {
+        const ctx = await browser.newContext({
+          userAgent: USER_AGENT,
+          viewport: { width: DESKTOP_WIDTH, height: DESKTOP_HEIGHT }
+        });
+        const page = await ctx.newPage();
+        const collected = {
+          consoleErrors: [],
+          failed: []
+        };
+        let currentOrigin = "";
+        const noteError = (message) => {
+          const trimmed = message.trim().slice(0, 300);
+          if (trimmed && !collected.consoleErrors.includes(trimmed)) {
+            collected.consoleErrors.push(trimmed);
+          }
+        };
+        page.on("pageerror", (err) => noteError(err.message));
+        page.on("console", (msg) => {
+          if (msg.type() === "error") noteError(msg.text());
+        });
+        const noteFailed = (url, status) => {
+          const firstParty = (() => {
+            try {
+              return new URL(url).origin === currentOrigin;
+            } catch {
+              return false;
+            }
+          })();
+          if (collected.failed.length < MAX_FAILED_REQUESTS * 4) {
+            collected.failed.push({ url: url.slice(0, 200), status, firstParty });
+          }
+        };
+        page.on("requestfailed", (req) => {
+          const why = req.failure()?.errorText ?? "";
+          if (/ERR_ABORTED/i.test(why)) return;
+          noteFailed(req.url(), null);
+        });
+        page.on("response", (res) => {
+          if (res.status() >= 400) noteFailed(res.url(), res.status());
+        });
+        let formProbed = false;
+        await pacedEach(urls, delayMs, async (url) => {
+          try {
+            collected.consoleErrors.length = 0;
+            collected.failed.length = 0;
+            try {
+              currentOrigin = new URL(url).origin;
+            } catch {
+              currentOrigin = "";
+            }
+            await page.goto(url, { waitUntil: "load", timeout: 2e4 });
+            await page.waitForTimeout(RENDER_SETTLE_MS);
+            const html = await withTimeout(page.content(), CONTENT_BUDGET_MS);
+            if (html === null) return;
+            const axe = await withTimeout(runAxe(page), AXE_BUDGET_MS);
+            const vitals = await withTimeout(measureVitals(page, collected), VITALS_BUDGET_MS);
+            if (!pressForms) {
+              out.set(url, { html, axe, vitals });
+            } else {
+              let formProbe = null;
+              if (!formProbed) {
+                formProbe = await withTimeout(
+                  probeForms(pageInteractionDeps(page, url)),
+                  PROBE_BUDGET_MS
+                );
+                if (formProbe) formProbed = true;
+              }
+              out.set(url, { html, axe, vitals, formProbe });
+            }
+          } catch {
+          }
+        });
+      } finally {
+        await browser.close();
+      }
+      return out;
+    },
+    maxPages,
+    delayMs,
+    ...deps
+  };
+}
+
+// src/prospect/stack.ts
+var LAYER_ORDER = [
+  "cms",
+  "theme",
+  "page-builder",
+  "framework",
+  "ecommerce",
+  "plugin",
+  "forms",
+  "analytics",
+  "fonts",
+  "hosting"
+];
+var LAYER_LABELS = {
+  cms: "Platform",
+  theme: "Theme",
+  "page-builder": "Page builder",
+  framework: "Framework",
+  ecommerce: "Store",
+  plugin: "Plugins",
+  forms: "Forms",
+  analytics: "Analytics and tracking",
+  fonts: "Fonts",
+  hosting: "Hosting and CDN"
+};
+var ASSET_SIGNATURES = [
+  // Platforms, by the paths only they serve.
+  { layer: "cms", name: "WordPress", match: /\/wp-(?:content|includes)\// },
+  { layer: "cms", name: "Squarespace", match: /(?:^|\/\/|\.)squarespace\.com\// },
+  { layer: "cms", name: "Wix", match: /(?:^|\/\/|\.)wixstatic\.com\// },
+  { layer: "cms", name: "Webflow", match: /(?:^|\/\/|\.)website-files\.com\// },
+  { layer: "cms", name: "HubSpot CMS", match: /(?:^|\/\/|\.)(?:hs-scripts|hs-banner)\.com\// },
+  { layer: "cms", name: "Duda", match: /(?:^|\/\/|\.)cdn-website\.com\// },
+  { layer: "cms", name: "GoDaddy Website Builder", match: /(?:^|\/\/|\.)wsimg\.com\// },
+  { layer: "cms", name: "Drupal", match: /\/(?:core|modules)\/misc\/drupal\.js/ },
+  { layer: "cms", name: "Ghost", match: /\/assets\/built\/[a-z-]+\.js/ },
+  // Frameworks, by their build output paths.
+  { layer: "framework", name: "Next.js", match: /\/_next\/static\// },
+  { layer: "framework", name: "Nuxt", match: /\/_nuxt\// },
+  { layer: "framework", name: "SvelteKit", match: /\/_app\/immutable\// },
+  { layer: "framework", name: "Gatsby", match: /\/page-data\/|webpack-runtime-[a-f0-9]+\.js/ },
+  { layer: "framework", name: "Angular", match: /\/(?:polyfills|runtime)[.-][a-z0-9]+\.js/ },
+  // Page builders. All WordPress plugins, but a reader thinks of them as the
+  // thing they edit in, so they get their own layer rather than being buried
+  // among thirty plugin names.
+  { layer: "page-builder", name: "Elementor", match: /\/wp-content\/plugins\/elementor/ },
+  { layer: "page-builder", name: "Divi", match: /\/wp-content\/themes\/[Dd]ivi\// },
+  { layer: "page-builder", name: "WPBakery", match: /\/wp-content\/plugins\/js_composer\// },
+  { layer: "page-builder", name: "Beaver Builder", match: /\/wp-content\/plugins\/beaver-builder/ },
+  { layer: "page-builder", name: "Oxygen", match: /\/wp-content\/plugins\/oxygen\// },
+  // Stores.
+  { layer: "ecommerce", name: "WooCommerce", match: /\/wp-content\/plugins\/woocommerce\// },
+  { layer: "ecommerce", name: "Shopify", match: /(?:^|\/\/|\.)shopify\.com\// },
+  { layer: "ecommerce", name: "BigCommerce", match: /(?:^|\/\/|\.)bigcommerce\.com\// },
+  // Forms. Which one matters commercially: it is the thing an enquiry actually
+  // travels through, and half of these have a free tier that silently drops mail.
+  { layer: "forms", name: "Gravity Forms", match: /\/plugins\/gravityforms\// },
+  { layer: "forms", name: "Contact Form 7", match: /\/plugins\/contact-form-7\// },
+  { layer: "forms", name: "WPForms", match: /\/plugins\/wpforms/ },
+  { layer: "forms", name: "Ninja Forms", match: /\/plugins\/ninja-forms\// },
+  { layer: "forms", name: "Typeform", match: /(?:^|\/\/|\.)typeform\.com\// },
+  { layer: "forms", name: "Jotform", match: /(?:^|\/\/|\.)jotform\.com\// },
+  { layer: "forms", name: "HubSpot Forms", match: /(?:^|\/\/|\.)hsforms\.net\// },
+  { layer: "forms", name: "Formspree", match: /(?:^|\/\/|\.)formspree\.io\// },
+  // Analytics and tracking. Absence of ALL of these is its own check (T0-46);
+  // here we are only naming what is there.
+  { layer: "analytics", name: "Google Tag Manager", match: /googletagmanager\.com\/gtm\.js/ },
+  { layer: "analytics", name: "Google Analytics 4", match: /googletagmanager\.com\/gtag\/js/ },
+  {
+    layer: "analytics",
+    name: "Google Analytics (legacy)",
+    match: /google-analytics\.com\/(?:analytics|ga)\.js/
+  },
+  { layer: "analytics", name: "Meta Pixel", match: /connect\.facebook\.net\// },
+  { layer: "analytics", name: "LinkedIn Insight", match: /snap\.licdn\.com\// },
+  { layer: "analytics", name: "Hotjar", match: /(?:static|script)\.hotjar\.com\// },
+  { layer: "analytics", name: "Microsoft Clarity", match: /(?:^|\/\/|\.)clarity\.ms\// },
+  { layer: "analytics", name: "Intercom", match: /(?:widget|js)\.intercom(?:cdn)?\.(?:io|com)\// },
+  { layer: "analytics", name: "Drift", match: /js\.driftt\.com\// },
+  { layer: "analytics", name: "Plausible", match: /plausible\.io\/js\// },
+  { layer: "analytics", name: "Fathom", match: /cdn\.usefathom\.com\// },
+  { layer: "analytics", name: "Segment", match: /cdn\.segment\.(?:com|io)\// },
+  // Headless CMSes, by the asset and API hosts they serve from. A modern
+  // agency-built site is far likelier to be one of these than to be WordPress,
+  // and naming only "SvelteKit and Netlify" back to such a client says we did
+  // not look very hard.
+  { layer: "cms", name: "Prismic", match: /(?:^|\/\/|\.)prismic\.io\// },
+  { layer: "cms", name: "Contentful", match: /(?:^|\/\/|\.)(?:ctfassets\.net|contentful\.com)\// },
+  { layer: "cms", name: "Sanity", match: /(?:^|\/\/|\.)sanity\.io\// },
+  { layer: "cms", name: "Storyblok", match: /(?:^|\/\/|\.)storyblok\.com\// },
+  { layer: "cms", name: "DatoCMS", match: /(?:^|\/\/|\.)datocms-assets\.com\// },
+  { layer: "cms", name: "Strapi", match: /(?:^|\/\/|\.)strapi\.io\// },
+  { layer: "cms", name: "Craft CMS", match: /\/cpresources\// },
+  // Fonts. Typekit is a script; Google Fonts arrives as a stylesheet link, so
+  // it needs the `<link>` set — which is fed in above.
+  { layer: "fonts", name: "Adobe Fonts (Typekit)", match: /use\.typekit\.net\// },
+  { layer: "fonts", name: "Google Fonts", match: /fonts\.(?:googleapis|gstatic)\.com\// }
+];
+var GENERATOR_SIGNATURES = [
+  { layer: "cms", name: "WordPress", match: /wordpress/i },
+  { layer: "cms", name: "Drupal", match: /drupal/i },
+  { layer: "cms", name: "Joomla", match: /joomla/i },
+  { layer: "cms", name: "Webflow", match: /webflow/i },
+  { layer: "cms", name: "Squarespace", match: /squarespace/i },
+  { layer: "cms", name: "Wix", match: /wix\.com/i },
+  { layer: "cms", name: "Ghost", match: /ghost/i },
+  { layer: "cms", name: "Shopify", match: /shopify/i },
+  { layer: "page-builder", name: "Elementor", match: /elementor/i },
+  { layer: "framework", name: "Hugo", match: /hugo/i },
+  { layer: "framework", name: "Jekyll", match: /jekyll/i },
+  { layer: "framework", name: "Gatsby", match: /gatsby/i },
+  { layer: "framework", name: "Next.js", match: /next\.js/i }
+];
+var HEADER_SIGNATURES = [
+  { name: "Cloudflare", header: "cf-ray" },
+  { name: "Netlify", header: "x-nf-request-id" },
+  { name: "Vercel", header: "x-vercel-id" },
+  { name: "AWS CloudFront", header: "x-amz-cf-id" },
+  { name: "Fastly", header: "x-served-by" },
+  { name: "GitHub Pages", header: "x-github-request-id" },
+  { name: "Pantheon", header: "x-pantheon-styx-hostname" },
+  { name: "WP Engine", header: "x-wpe-backend" },
+  { name: "Kinsta", header: "x-kinsta-cache" },
+  { name: "LiteSpeed", header: "x-litespeed-cache" },
+  { name: "Wix", header: "x-wix-request-id" },
+  { name: "Shopify", header: "x-shopid" },
+  { name: "Squarespace", header: "x-contextid" },
+  { name: "Nginx", header: "server", value: /nginx/i },
+  { name: "Apache", header: "server", value: /apache/i },
+  { name: "Microsoft IIS", header: "server", value: /microsoft-iis/i }
+];
+var MAX_EVIDENCE = 120;
+function receipt(url) {
+  return url.length <= MAX_EVIDENCE ? url : `${url.slice(0, MAX_EVIDENCE - 1)}\u2026`;
+}
+function slugsFrom(urls, kind) {
+  const re = new RegExp(`/wp-content/${kind}/([^/?#]+)/`);
+  const found = /* @__PURE__ */ new Map();
+  for (const url of urls) {
+    const m = re.exec(url);
+    const slug = m?.[1];
+    if (slug && !found.has(slug)) found.set(slug, receipt(url));
+  }
+  return found;
+}
+function readStack(crawl) {
+  const set = usablePages(crawl.pages);
+  const headers = crawl.homeHeaders ?? {};
+  const headersExamined = Object.keys(headers).length > 0;
+  const readable = set.pages.filter((p) => p.extract.scriptSrcs !== void 0);
+  const measured = readable.length > 0;
+  const items = [];
+  const seen = /* @__PURE__ */ new Set();
+  const add = (layer, name, evidence) => {
+    const key = `${layer}::${name}`;
+    if (seen.has(key)) return;
+    seen.add(key);
+    items.push({ layer, name, evidence });
+  };
+  const assetUrls = [];
+  for (const { extract } of readable) {
+    assetUrls.push(
+      ...extract.scriptSrcs ?? [],
+      ...extract.imageSrcs ?? [],
+      ...extract.inlineScriptUrls ?? [],
+      ...(extract.links ?? []).map((l) => l.href)
+    );
+  }
+  for (const { extract } of readable) {
+    const generator = extract.metas?.["generator"];
+    if (!generator) continue;
+    for (const sig of GENERATOR_SIGNATURES) {
+      if (sig.match.test(generator)) {
+        add(sig.layer, sig.name, `<meta name="generator"> ${receipt(generator)}`);
+      }
+    }
+  }
+  for (const sig of ASSET_SIGNATURES) {
+    const hit = assetUrls.find((url) => sig.match.test(url));
+    if (hit) add(sig.layer, sig.name, receipt(hit));
+  }
+  for (const [slug, evidence] of slugsFrom(assetUrls, "themes")) add("theme", slug, evidence);
+  for (const [slug, evidence] of slugsFrom(assetUrls, "plugins")) add("plugin", slug, evidence);
+  for (const sig of HEADER_SIGNATURES) {
+    const value = headers[sig.header];
+    if (value === void 0) continue;
+    if (sig.value && !sig.value.test(value)) continue;
+    add(
+      "hosting",
+      sig.name,
+      sig.value ? `${sig.header}: ${receipt(value)}` : `${sig.header} header`
+    );
+  }
+  return {
+    measured,
+    items: items.sort(
+      (a, b) => LAYER_ORDER.indexOf(a.layer) - LAYER_ORDER.indexOf(b.layer) || a.name.localeCompare(b.name)
+    ),
+    pagesExamined: readable.length,
+    headersExamined
+  };
+}
+
+// src/prospect/journey.ts
+function canonicalizeUrl(raw) {
+  try {
+    const u = new URL(raw);
+    if (u.protocol !== "http:" && u.protocol !== "https:") return null;
+    const path = u.pathname.replace(/\/+$/, "") || "/";
+    return `${u.hostname.replace(/^www\./i, "").toLowerCase()}${path}`;
+  } catch {
+    return null;
+  }
+}
+function resolveNavigable(href, pageUrl) {
+  const trimmed = href.trim();
+  if (!trimmed || trimmed.startsWith("#")) return null;
+  if (/^(tel:|mailto:|javascript:|sms:|data:)/i.test(trimmed)) return null;
+  try {
+    return new URL(trimmed, pageUrl).toString();
+  } catch {
+    return null;
+  }
+}
+var TEL_HREF = /^tel:(.+)$/i;
+var MAILTO_HREF = /^mailto:([^?]+)/i;
+function affordancesOn(page, view) {
+  const extract = view ?? page.rendered ?? page.raw;
+  if (!extract) return [];
+  const found = [];
+  for (const anchor of extract.anchors ?? []) {
+    const tel = TEL_HREF.exec(anchor.href);
+    if (tel?.[1]) {
+      found.push({ kind: "tel", page: page.url, detail: tel[1].trim() });
+      continue;
+    }
+    const mail = MAILTO_HREF.exec(anchor.href);
+    if (mail?.[1]) {
+      found.push({ kind: "mailto", page: page.url, detail: mail[1].trim() });
+    }
+  }
+  for (const form of extract.forms ?? []) {
+    if (form.kind !== "enquiry") continue;
+    found.push({ kind: "form", page: page.url, detail: form.action ?? page.url });
+  }
+  return found;
+}
+function buildJourney(pages) {
+  const usable = usablePages(pages);
+  const nodes = /* @__PURE__ */ new Map();
+  for (const entry of usable.pages) {
+    const key = canonicalizeUrl(entry.page.url);
+    if (key) nodes.set(key, entry);
+  }
+  const affordances = [];
+  const hasContact = /* @__PURE__ */ new Set();
+  for (const [key, entry] of nodes) {
+    const found = affordancesOn(entry.page, entry.extract);
+    affordances.push(...found);
+    if (found.length > 0) hasContact.add(key);
+  }
+  const outgoing = /* @__PURE__ */ new Map();
+  const incoming = /* @__PURE__ */ new Map();
+  for (const [key, entry] of nodes) {
+    const out = /* @__PURE__ */ new Set();
+    for (const anchor of entry.extract.anchors ?? []) {
+      const abs = resolveNavigable(anchor.href, entry.page.url);
+      if (!abs) continue;
+      const target = canonicalizeUrl(abs);
+      if (!target || target === key || !nodes.has(target)) continue;
+      out.add(target);
+      if (!incoming.has(target)) incoming.set(target, /* @__PURE__ */ new Set());
+      incoming.get(target)?.add(key);
+    }
+    outgoing.set(key, out);
+  }
+  const distance = /* @__PURE__ */ new Map();
+  let frontier = [...hasContact];
+  for (const key of frontier) distance.set(key, 0);
+  let depth = 0;
+  while (frontier.length > 0) {
+    depth += 1;
+    const next = [];
+    for (const key of frontier) {
+      for (const source of incoming.get(key) ?? []) {
+        if (distance.has(source)) continue;
+        distance.set(source, depth);
+        next.push(source);
+      }
+    }
+    frontier = next;
+  }
+  const journeys = [...nodes.entries()].map(([key, entry]) => ({
+    url: entry.page.url,
+    clicksToContact: usable.anchorsMeasured ? distance.get(key) ?? null : null,
+    internalLinks: outgoing.get(key)?.size ?? 0
+  }));
+  const reachable = journeys.map((j) => j.clicksToContact).filter((d) => d !== null);
+  return {
+    affordances,
+    pages: journeys,
+    // Without recorded anchors there is no evidence either way, so there is no
+    // finding — not "every page is a dead end", which is what reading the
+    // absent array as an empty one used to produce.
+    deadEnds: usable.anchorsMeasured ? journeys.filter((j) => j.clicksToContact === null).map((j) => j.url) : [],
+    worstClicksToContact: reachable.length > 0 ? Math.max(...reachable) : null,
+    pagesExamined: journeys.length,
+    anchorsMeasured: usable.anchorsMeasured
+  };
+}
+
+// src/prospect/http-probes.ts
+var MAX_SITEMAP_PROBES = 12;
+var MAX_EXTERNAL_PROBES = 15;
+var MAX_REDIRECT_PROBES = 10;
+var MAX_ORDINARY_HOPS = 2;
+var IMAGE_HEADER_BYTES = 32768;
+var MIN_OG_IMAGE_EDGE = 200;
+function classify(status) {
+  if (status === null) return "unverified";
+  if (status >= 200 && status < 300) return "ok";
+  if (status >= 300 && status < 400) return "broken";
+  if (status === 404 || status === 410) return "broken";
+  return "unverified";
+}
+function safe(url) {
+  try {
+    const u = new URL(url);
+    if (u.protocol !== "http:" && u.protocol !== "https:") return null;
+    if (isPrivateOrLoopbackHost(u.hostname)) return null;
+    return u.toString();
+  } catch {
+    return null;
+  }
+}
+function sameAddress(a, b) {
+  if (!a || !b) return false;
+  const key = (u) => canonicalizeUrl(u)?.replace(/^www\./, "").replace(/\/$/, "") ?? u;
+  return key(a) === key(b);
+}
+function extractOf(page) {
+  return page.rendered ?? page.raw;
+}
+function canonicalOf(body) {
+  if (!body) return null;
+  const head = new TextDecoder("utf-8", { fatal: false }).decode(body.slice(0, 65536));
+  const tag = head.match(/<link\b[^>]*\brel\s*=\s*["']?canonical["']?[^>]*>/i)?.[0];
+  const href = tag?.match(/\bhref\s*=\s*["']([^"']+)["']/i)?.[1];
+  return href?.trim() || null;
+}
+function imageSize(bytes) {
+  if (!bytes || bytes.length < 24) return null;
+  const be32 = (o) => (bytes[o] << 24 | bytes[o + 1] << 16 | bytes[o + 2] << 8 | bytes[o + 3]) >>> 0;
+  const be16 = (o) => bytes[o] << 8 | bytes[o + 1];
+  const le16 = (o) => bytes[o] | bytes[o + 1] << 8;
+  if (be32(0) === 2303741511 && be32(4) === 218765834) {
+    return { width: be32(16), height: be32(20) };
+  }
+  if (bytes[0] === 71 && bytes[1] === 73 && bytes[2] === 70) {
+    return { width: le16(6), height: le16(8) };
+  }
+  if (be32(0) === 1380533830 && be32(8) === 1464156752 && bytes.length >= 30) {
+    const fourcc = String.fromCharCode(bytes[12], bytes[13], bytes[14], bytes[15]);
+    if (fourcc === "VP8 ") return { width: le16(26) & 16383, height: le16(28) & 16383 };
+    if (fourcc === "VP8L") {
+      const b = bytes[21] | bytes[22] << 8 | bytes[23] << 16 | bytes[24] << 24;
+      return { width: (b & 16383) + 1, height: (b >> 14 & 16383) + 1 };
+    }
+    if (fourcc === "VP8X") {
+      const dim = (o) => 1 + (bytes[o] | bytes[o + 1] << 8 | bytes[o + 2] << 16);
+      return { width: dim(24), height: dim(27) };
+    }
+    return null;
+  }
+  if (bytes[0] === 255 && bytes[1] === 216) {
+    let i = 2;
+    while (i + 9 < bytes.length) {
+      if (bytes[i] !== 255) {
+        i++;
+        continue;
+      }
+      const marker = bytes[i + 1];
+      if (marker === 216 || marker >= 208 && marker <= 217) {
+        i += 2;
+        continue;
+      }
+      if (marker === 218) return null;
+      const len = be16(i + 2);
+      if (marker >= 192 && marker <= 207 && marker !== 196 && marker !== 200 && marker !== 204) {
+        return { width: be16(i + 7), height: be16(i + 5) };
+      }
+      if (len < 2) return null;
+      i += 2 + len;
+    }
+  }
+  return null;
+}
+function empty(measured) {
+  return {
+    measured,
+    requests: 0,
+    favicon: void 0,
+    httpUpgrade: void 0,
+    homeSamples: void 0,
+    trailingSlash: void 0,
+    indexAlias: void 0,
+    caseAlias: void 0,
+    sitemapUrls: void 0,
+    externalLinks: void 0,
+    ogImage: void 0,
+    logo: void 0,
+    redirectChains: void 0
+  };
+}
+async function probeHttp(crawl, deps) {
+  const origin = (() => {
+    const ok = safe(crawl.origin);
+    return ok ? new URL(ok).origin : null;
+  })();
+  if (!origin) return empty(false);
+  const out = empty(true);
+  const sleep2 = deps.sleep ?? sleep;
+  let requests = 0;
+  const ask = async (url, opts = { method: "HEAD" }) => {
+    const target = safe(url);
+    if (!target) return null;
+    if (requests > 0 && deps.delayMs > 0) await sleep2(deps.delayMs);
+    requests++;
+    try {
+      return await deps.request(target, opts);
+    } catch (err) {
+      return {
+        status: null,
+        headers: {},
+        finalUrl: null,
+        hops: null,
+        body: null,
+        error: err instanceof Error ? err.message : String(err)
+      };
+    }
+  };
+  const home = crawl.pages[0];
+  const homeExtract = home ? extractOf(home) : null;
+  {
+    const declared = homeExtract?.links?.find(
+      (l) => /(^|\s)(icon|shortcut icon|apple-touch-icon)(\s|$)/i.test(l.rel ?? "")
+    );
+    const href = declared?.href ? resolveNavigable(declared.href, home?.url ?? origin) : null;
+    const url = href ?? `${origin}/favicon.ico`;
+    const res = await ask(url, { method: "GET", rangeBytes: 2048 });
+    if (res) {
+      const type = res.headers["content-type"] ?? "";
+      const verdict = classify(res.status);
+      out.favicon = {
+        url,
+        declared: Boolean(href),
+        // A 200 that hands back the HTML of a soft-404 page is not an icon.
+        // The content type is what separates "served" from "answered".
+        verdict: verdict === "ok" && /^(image|text\/xml|application\/xml)/i.test(type) ? "ok" : verdict === "ok" ? "broken" : verdict
+      };
+    }
+  }
+  {
+    const insecure = origin.replace(/^https:/, "http:");
+    if (insecure !== origin) {
+      const res = await ask(insecure, { method: "HEAD" });
+      if (res && res.status !== null) {
+        out.httpUpgrade = { hops: res.hops, https: (res.finalUrl ?? "").startsWith("https:") };
+      }
+    }
+  }
+  {
+    const a = await ask(origin, { method: "HEAD" });
+    const b = await ask(origin, { method: "HEAD" });
+    if (a && b) out.homeSamples = [a.status, b.status];
+  }
+  {
+    const sample = crawl.pages.map((p) => p.url).find((u) => {
+      try {
+        const path = new URL(u).pathname;
+        return path !== "/" && !/\.[a-z0-9]+$/i.test(path);
+      } catch {
+        return false;
+      }
+    });
+    if (sample) {
+      const bare = sample.replace(/\/+$/, "");
+      const slashed = `${bare}/`;
+      const [a, b] = [
+        await ask(bare, { method: "GET", rangeBytes: 65536 }),
+        await ask(slashed, { method: "GET", rangeBytes: 65536 })
+      ];
+      if (a && b && a.status !== null && b.status !== null) {
+        const bothServed = classify(a.status) === "ok" && classify(b.status) === "ok";
+        if (!bothServed) {
+          out.trailingSlash = {
+            path: new URL(bare).pathname,
+            settled: true,
+            detail: "one form redirects to the other"
+          };
+        } else if (a.finalUrl !== null && a.finalUrl === b.finalUrl) {
+          out.trailingSlash = {
+            path: new URL(bare).pathname,
+            settled: true,
+            detail: "both forms resolve to the same address"
+          };
+        } else {
+          const ca = canonicalOf(a.body);
+          const cb = canonicalOf(b.body);
+          const agree = sameAddress(ca, cb);
+          out.trailingSlash = {
+            path: new URL(bare).pathname,
+            settled: agree,
+            detail: agree ? "both forms answer, and both declare the same canonical" : "both forms answer with no canonical to settle which is the real one"
+          };
+        }
+      }
+    }
+  }
+  {
+    const alias = `${origin}/index.html`;
+    const res = await ask(alias, { method: "GET", rangeBytes: 65536 });
+    if (res && res.status !== null) {
+      if (classify(res.status) !== "ok") {
+        out.indexAlias = null;
+      } else if (sameAddress(res.finalUrl, origin)) {
+        out.indexAlias = { duplicate: false, detail: "it redirects to the homepage" };
+      } else {
+        const canonical = canonicalOf(res.body);
+        const points = sameAddress(canonical, origin);
+        out.indexAlias = {
+          duplicate: !points,
+          detail: points ? "it answers, and declares the homepage canonical" : "it answers with the homepage's content and does not point back at it"
+        };
+      }
+    }
+  }
+  {
+    const sample = crawl.pages.map((p) => p.url).find((u) => {
+      try {
+        return /\/[a-z][a-z0-9-]*\/?$/.test(new URL(u).pathname);
+      } catch {
+        return false;
+      }
+    });
+    if (sample) {
+      const url = new URL(sample);
+      const flipped = url.pathname.replace(/\/([a-z])/g, (_m, c) => `/${c.toUpperCase()}`);
+      url.pathname = flipped;
+      const res = await ask(url.toString(), { method: "GET", rangeBytes: 65536 });
+      if (res && res.status !== null) {
+        if (classify(res.status) !== "ok") {
+          out.caseAlias = null;
+        } else {
+          const canonical = canonicalOf(res.body);
+          const points = sameAddress(canonical, sample) || sameAddress(res.finalUrl, sample);
+          out.caseAlias = {
+            path: flipped,
+            duplicate: !points,
+            detail: points ? "it resolves back to the lower-case address" : "it answers as its own page, so the same content has two addresses"
+          };
+        }
+      }
+    }
+  }
+  const sitemapSample = crawl.sitemap.sample ?? [];
+  if (!crawl.sitemap.present || sitemapSample.length === 0) {
+    out.sitemapUrls = crawl.sitemap.present ? void 0 : null;
+  } else {
+    const step = Math.max(1, Math.floor(sitemapSample.length / MAX_SITEMAP_PROBES));
+    const picked = sitemapSample.filter((_, i) => i % step === 0).slice(0, MAX_SITEMAP_PROBES);
+    const broken = [];
+    await pacedEach(picked, 0, async (url) => {
+      const res = await ask(url, { method: "HEAD" });
+      if (!res) return;
+      const verdict = classify(res.status);
+      if (verdict === "broken") broken.push({ url, status: res.status, verdict });
+    });
+    out.sitemapUrls = { checked: picked.length, total: crawl.sitemap.urlCount, broken };
+  }
+  {
+    const originKey = canonicalizeUrl(origin)?.split("/")[0] ?? "";
+    const external = /* @__PURE__ */ new Set();
+    for (const page of crawl.pages) {
+      for (const a of extractOf(page)?.anchors ?? []) {
+        const abs = resolveNavigable(a.href, page.url);
+        if (!abs || !safe(abs)) continue;
+        const host = canonicalizeUrl(abs)?.split("/")[0] ?? "";
+        if (host && host !== originKey) external.add(abs);
+      }
+    }
+    const all = [...external];
+    if (all.length === 0) {
+      out.externalLinks = null;
+    } else {
+      const picked = all.slice(0, MAX_EXTERNAL_PROBES);
+      const broken = [];
+      await pacedEach(picked, 0, async (url) => {
+        const res = await ask(url, { method: "HEAD" });
+        if (!res) return;
+        const verdict = classify(res.status);
+        if (verdict === "broken") broken.push({ url, status: res.status, verdict });
+      });
+      out.externalLinks = { checked: picked.length, total: all.length, broken };
+    }
+  }
+  {
+    const declared = homeExtract?.social?.["og:image"] ?? null;
+    const url = declared ? resolveNavigable(declared, home?.url ?? origin) : null;
+    if (!url) {
+      out.ogImage = null;
+    } else {
+      const res = await ask(url, { method: "GET", rangeBytes: IMAGE_HEADER_BYTES });
+      if (res) {
+        const size = imageSize(res.body);
+        out.ogImage = {
+          url,
+          verdict: classify(res.status),
+          width: size?.width ?? null,
+          height: size?.height ?? null
+        };
+      }
+    }
+  }
+  {
+    const images = homeExtract?.imageSrcs;
+    const byName = images?.find((src) => /logo/i.test(src));
+    const chosen = byName ?? images?.[0] ?? null;
+    const url = chosen ? resolveNavigable(chosen, home?.url ?? origin) : null;
+    if (!images) {
+      out.logo = void 0;
+    } else if (!url) {
+      out.logo = null;
+    } else {
+      const res = await ask(url, { method: "HEAD" });
+      if (res) {
+        out.logo = {
+          url,
+          // Named, because "the logo" is a guess and the reader deserves to
+          // know which guess we made before they act on the verdict.
+          how: byName ? "the first image with 'logo' in its file name" : "the first image on the homepage",
+          verdict: classify(res.status)
+        };
+      }
+    }
+  }
+  {
+    const originKey = canonicalizeUrl(origin)?.split("/")[0] ?? "";
+    const internal = /* @__PURE__ */ new Set();
+    for (const page of crawl.pages) {
+      for (const a of extractOf(page)?.anchors ?? []) {
+        const abs = resolveNavigable(a.href, page.url);
+        if (!abs || !safe(abs)) continue;
+        const host = canonicalizeUrl(abs)?.split("/")[0] ?? "";
+        if (host === originKey && !sameAddress(abs, page.url)) internal.add(abs);
+      }
+    }
+    const all = [...internal];
+    const step = Math.max(1, Math.floor(all.length / MAX_REDIRECT_PROBES));
+    const picked = all.filter((_, i) => i % step === 0).slice(0, MAX_REDIRECT_PROBES);
+    if (picked.length > 0) {
+      const chained = [];
+      await pacedEach(picked, 0, async (url) => {
+        const res = await ask(url, { method: "HEAD" });
+        if (res?.hops != null && res.hops > MAX_ORDINARY_HOPS) {
+          chained.push({ url, hops: res.hops });
+        }
+      });
+      out.redirectChains = { checked: picked.length, chained };
+    }
+  }
+  out.requests = requests;
+  return out;
+}
+var MAX_HOPS = 6;
+function defaultHttpProbeDeps(userAgent, fetchImpl = fetch) {
+  return {
+    delayMs: 150,
+    async request(url, opts) {
+      const headers = {
+        "user-agent": userAgent,
+        accept: "text/html,image/*,*/*"
+      };
+      if (opts.rangeBytes) headers.range = `bytes=0-${opts.rangeBytes - 1}`;
+      let current = url;
+      let hops = 0;
+      for (; ; ) {
+        if (!safe(current)) {
+          return { status: null, headers: {}, finalUrl: null, hops, body: null, error: "refused" };
+        }
+        const res = await fetchImpl(current, {
+          method: opts.method,
+          headers,
+          redirect: "manual",
+          signal: AbortSignal.timeout(15e3)
+        });
+        const flat = Object.fromEntries(
+          [...res.headers].map(([k, v]) => [k.toLowerCase(), v])
+        );
+        const location = flat["location"];
+        if (res.status >= 300 && res.status < 400 && location && hops < MAX_HOPS) {
+          await res.body?.cancel();
+          const next = resolveNavigable(location, current);
+          if (!next) break;
+          current = next;
+          hops++;
+          continue;
+        }
+        let body = null;
+        if (opts.rangeBytes) {
+          const buf = await res.arrayBuffer();
+          body = new Uint8Array(buf.slice(0, opts.rangeBytes));
+        } else {
+          await res.body?.cancel();
+        }
+        return { status: res.status, headers: flat, finalUrl: current, hops, body, error: null };
+      }
+      return {
+        status: null,
+        headers: {},
+        finalUrl: current,
+        hops,
+        body: null,
+        error: "redirect loop"
+      };
+    }
+  };
+}
+
+// src/prospect/site-checks.ts
+function countOf(n, singular, plural) {
+  return n === 1 ? `the one ${singular}` : `all ${n} ${plural}`;
+}
+function tally(checks) {
+  const passed = checks.filter((c) => c.status === "pass").length;
+  const failed = checks.filter((c) => c.status === "fail").length;
+  return { passed, failed, total: passed + failed };
+}
+function check(key, label, why, scope, ok, evidence) {
+  return { key, label, status: ok ? "pass" : "fail", evidence, why, scope };
+}
+function skip(key, label, why, scope, note) {
+  return { key, label, status: "not-applicable", evidence: note, why, scope };
+}
+function unknown(key, label, why, scope, note = null) {
+  return { key, label, status: "unmeasured", evidence: note, why, scope };
+}
+var VAGUE_LINK_TEXT = /* @__PURE__ */ new Set([
+  "click here",
+  "here",
+  "read more",
+  "learn more",
+  "more",
+  "more info",
+  "more information",
+  "find out more",
+  "this",
+  "link",
+  "this link",
+  "continue",
+  "go"
+]);
+var LOCAL_HOST = /^(localhost|127\.0\.0\.1|0\.0\.0\.0|\[::1\]|.*\.local|.*\.test|.*\.localhost)$/i;
+var PLACEHOLDER_SOCIAL = /^(?:https?:\/\/)?(?:www\.)?(?:facebook|twitter|x|instagram|linkedin|youtube|tiktok|pinterest)\.com\/?(?:(?:in|company|user|channel|@)\/)?(?:yourhandle|username|yourusername|yourpage|yourcompany|your-business|profile\.php|home)?\/?$/i;
+var DIALABLE_TEL = /^tel:\+?[0-9().\-\s]{6,}$/i;
+function anchorChecks(pages, origin) {
+  const out = [];
+  const measured = pages.length > 0 && pages.every((p) => p.extract.anchors !== void 0);
+  const WHY_DEAD = "A link that goes nowhere reads as a broken site to the person who clicks it.";
+  if (!measured) {
+    return [
+      unknown("dead-links", "Links that go nowhere", WHY_DEAD, "quick"),
+      unknown(
+        "staging-links",
+        "Links pointing at a development address",
+        "A link to localhost or a staging host takes the visitor to a browser error page with your name on it.",
+        "quick"
+      ),
+      unknown(
+        "insecure-links",
+        "Links back to your own http address",
+        "A link to the http:// spelling of your own address makes the visitor ask for the page in the clear before your redirect sends them back, and costs them a round trip to do it.",
+        "quick"
+      ),
+      unknown(
+        "link-text",
+        "Links that say where they go",
+        "\u201CRead more\u201D tells a visitor nothing, and it is the whole label a screen reader announces.",
+        "content"
+      ),
+      unknown(
+        "tel-dialable",
+        "Phone links a phone can dial",
+        "A tel: link that is not a number does nothing at all when tapped.",
+        "quick"
+      ),
+      unknown(
+        "social-placeholders",
+        "Social links that go to your accounts",
+        "An unedited theme placeholder sends visitors to a login page or a stranger.",
+        "quick"
+      ),
+      unknown(
+        "nav-consistency",
+        "Navigation that agrees with itself",
+        "The same menu item leading to two different pages is confusing in a way visitors blame on you.",
+        "quick"
+      )
+    ];
+  }
+  const all = [];
+  for (const p of pages) for (const a of p.extract.anchors ?? []) all.push({ a, page: p.url });
+  const trueTotal = pages.reduce((n, p) => n + (p.extract.anchorCount ?? 0), 0);
+  const ofTrue = trueTotal > all.length ? ` \u2014 of ${trueTotal} on these pages` : "";
+  const dead = all.filter(({ a }) => /^javascript:\s*(void\s*\(\s*0\s*\)|;)?\s*$/i.test(a.href));
+  out.push(
+    check(
+      "dead-links",
+      "Links that go nowhere",
+      WHY_DEAD,
+      "quick",
+      dead.length === 0,
+      dead.length === 0 ? `none among the ${all.length} links we read` : `${dead.length} of ${all.length}: ${dead.slice(0, 3).map((d) => `\u201C${d.a.text || d.a.href}\u201D on ${d.page}`).join(", ")}`
+    )
+  );
+  let ownHost = null;
+  try {
+    ownHost = new URL(origin).hostname.toLowerCase();
+  } catch {
+    ownHost = null;
+  }
+  const staging = all.filter(({ a, page }) => {
+    const abs = resolveNavigable(a.href, page);
+    if (!abs) return false;
+    try {
+      const host = new URL(abs).hostname.toLowerCase();
+      return host !== ownHost && LOCAL_HOST.test(host);
+    } catch {
+      return false;
+    }
+  });
+  out.push(
+    check(
+      "staging-links",
+      "Links pointing at a development address",
+      "A link to localhost or a staging host takes the visitor to a browser error page with your name on it.",
+      "quick",
+      staging.length === 0,
+      staging.length === 0 ? "none" : `${staging.length} ${staging.length === 1 ? "link" : "links"}, including ${staging.slice(0, 3).map((s) => s.a.href).join(", ")}`
+    )
+  );
+  if (origin.startsWith("https://")) {
+    const insecure = all.filter(({ a }) => {
+      const href = a.href.trim();
+      if (!/^http:\/\//i.test(href)) return false;
+      try {
+        return new URL(href).hostname.replace(/^www\./i, "") === ownHost?.replace(/^www\./i, "");
+      } catch {
+        return false;
+      }
+    });
+    out.push(
+      check(
+        "insecure-links",
+        "Links back to your own http address",
+        "A link to the http:// spelling of your own address makes the visitor ask for the page in the clear before your redirect sends them back, and costs them a round trip to do it.",
+        "quick",
+        insecure.length === 0,
+        insecure.length === 0 ? "every link to your own pages stays on https" : `${insecure.length} ${insecure.length === 1 ? "link" : "links"} to your own http:// address, including ${insecure.slice(0, 3).map((s) => s.a.href).join(", ")}`
+      )
+    );
+  } else {
+    out.push(
+      skip(
+        "insecure-links",
+        "Links back to your own http address",
+        "A link to the http:// spelling of your own address makes the visitor ask for the page in the clear before your redirect sends them back, and costs them a round trip to do it.",
+        "quick",
+        "the site is not served over https, which is the finding above instead"
+      )
+    );
+  }
+  const labelled = all.every(({ a }) => a.ariaLabel !== void 0);
+  const WHY_TEXT = "\u201CRead more\u201D tells a visitor nothing, and with no aria-label behind it, it is the whole label a screen reader announces when it lists the links on your page.";
+  if (!labelled) {
+    out.push(unknown("link-text", "Links that say where they go", WHY_TEXT, "content"));
+  } else {
+    const vague = all.filter(
+      ({ a }) => VAGUE_LINK_TEXT.has((a.ariaLabel || a.text).trim().toLowerCase())
+    );
+    const VAGUE_LIMIT = 5;
+    out.push(
+      check(
+        "link-text",
+        "Links that say where they go",
+        WHY_TEXT,
+        "content",
+        vague.length <= VAGUE_LIMIT,
+        vague.length === 0 ? `all ${all.length} links we read${ofTrue} name their destination` : `${vague.length} of the ${all.length} we read${ofTrue} say only \u201C${[...new Set(vague.map((v) => (v.a.ariaLabel || v.a.text).trim()))].slice(0, 3).join("\u201D, \u201C")}\u201D`
+      )
+    );
+  }
+  const tels = all.filter(({ a }) => /^tel:/i.test(a.href.trim()));
+  const badTels = tels.filter(({ a }) => !DIALABLE_TEL.test(a.href.trim()));
+  const WHY_TEL = "A tel: link that is not a number does nothing at all when it is tapped.";
+  out.push(
+    tels.length === 0 ? skip(
+      "tel-dialable",
+      "Phone links a phone can dial",
+      WHY_TEL,
+      "quick",
+      "no tel: links on the pages we read"
+    ) : check(
+      "tel-dialable",
+      "Phone links a phone can dial",
+      WHY_TEL,
+      "quick",
+      badTels.length === 0,
+      badTels.length === 0 ? `all ${tels.length} dial a number` : badTels.map((b) => b.a.href).slice(0, 3).join(", ")
+    )
+  );
+  const placeholders = all.filter(({ a }) => PLACEHOLDER_SOCIAL.test(a.href.trim()));
+  out.push(
+    check(
+      "social-placeholders",
+      "Social links that go to your accounts",
+      "An unedited theme placeholder sends a visitor to a login page or to somebody else entirely.",
+      "quick",
+      placeholders.length === 0,
+      placeholders.length === 0 ? "none left unedited" : placeholders.map((p) => p.a.href).slice(0, 3).join(", ")
+    )
+  );
+  out.push(navConsistency(pages));
+  return out;
+}
+function navConsistency(pages) {
+  const WHY = "The same menu item leading to two different pages is the kind of confusion visitors blame on you rather than on the menu.";
+  if (pages.length < 2) {
+    return skip(
+      "nav-consistency",
+      "Navigation that agrees with itself",
+      WHY,
+      "quick",
+      "only one page was read, so there is no shared navigation to compare"
+    );
+  }
+  const perPage = pages.map(({ url, extract }) => {
+    const m = /* @__PURE__ */ new Map();
+    for (const a of extract.anchors ?? []) {
+      const text = a.text.trim().toLowerCase();
+      const abs = resolveNavigable(a.href, url);
+      if (!text || !abs) continue;
+      if (!m.has(text)) m.set(text, /* @__PURE__ */ new Set());
+      m.get(text).add(abs);
+    }
+    return m;
+  });
+  const shared = [...perPage[0]?.keys() ?? []].filter(
+    (text) => perPage.every((m) => m.has(text))
+  );
+  if (shared.length === 0) {
+    return skip(
+      "nav-consistency",
+      "Navigation that agrees with itself",
+      WHY,
+      "quick",
+      "no link text appears on every page, so we could not identify a shared navigation"
+    );
+  }
+  const drifting = shared.filter((text) => {
+    let common = null;
+    for (const m of perPage) {
+      const here = m.get(text) ?? /* @__PURE__ */ new Set();
+      const kept = common === null ? [...here] : [...common].filter((t) => here.has(t));
+      common = new Set(kept);
+      if (common.size === 0) return true;
+    }
+    return common === null || common.size === 0;
+  });
+  return check(
+    "nav-consistency",
+    "Navigation that agrees with itself",
+    WHY,
+    "quick",
+    drifting.length === 0,
+    drifting.length === 0 ? `${shared.length} shared menu ${shared.length === 1 ? "item goes" : "items go"} to the same place on every page` : `${drifting.map((d) => `\u201C${d}\u201D`).slice(0, 3).join(
+      ", "
+    )} ${drifting.length === 1 ? "leads" : "lead"} somewhere different depending on the page`
+  );
+}
+var LOREM = /\b(lorem ipsum|dolor sit amet|consectetur adipiscing)\b/i;
+var PLACEHOLDER_COPY = /\b(your (?:text|content|title|headline|company name|business name) here|insert (?:text|content|your) |add your (?:text|content) here|edit this text|this is a sample|sample text|placeholder text|coming soon\.{3})/i;
+var TEMPLATE_LEAKAGE = /(\{\{[^}]{0,80}\}\}|\[object Object\]|<%=?[^%]{0,80}%>|\$\{[^}]{0,60}\})/;
+var MOJIBAKE = /(â€[™œ“”˜]|Ã[©¨¤¡«»]||Â[\s£©®])/;
+var UNDER_CONSTRUCTION = /\b(under construction|coming soon|site is being (?:built|updated)|check back soon)\b/i;
+function textChecks(pages, businessName) {
+  const out = [];
+  const firstMatch = (re) => {
+    for (const p of pages) {
+      const m = re.exec(p.extract.text);
+      if (m) {
+        const at = Math.max(0, m.index - 40);
+        return { page: p.url, snippet: `\u2026${p.extract.text.slice(at, m.index + 60).trim()}\u2026` };
+      }
+    }
+    return null;
+  };
+  const cases = [
+    [
+      "lorem",
+      "Placeholder Latin left in the copy",
+      "Lorem ipsum on a live page tells a visitor the site was never finished.",
+      "quick",
+      LOREM
+    ],
+    [
+      "placeholder-copy",
+      "Theme placeholder text left in the copy",
+      "\u201CYour text here\u201D on a live page reads as a site nobody has looked at since it was built.",
+      "quick",
+      PLACEHOLDER_COPY
+    ],
+    [
+      "template-leakage",
+      "Template code showing as text",
+      "A visitor sees the machinery instead of the sentence, which reads as broken rather than unfinished.",
+      "quick",
+      TEMPLATE_LEAKAGE
+    ],
+    [
+      "mojibake",
+      "Text with broken characters",
+      "Apostrophes and quotes rendering as \xE2\u20AC\u2122 is the most visible sign of a migration nobody checked, and it is a one-line fix at the source.",
+      "quick",
+      MOJIBAKE
+    ]
+  ];
+  for (const [key, label, why, scope, re] of cases) {
+    if (pages.length === 0) {
+      out.push(unknown(key, label, why, scope));
+      continue;
+    }
+    const hit = firstMatch(re);
+    out.push(
+      check(
+        key,
+        label,
+        why,
+        scope,
+        hit === null,
+        hit === null ? `none across the ${pages.length} pages we read` : `${hit.page}: ${hit.snippet}`
+      )
+    );
+  }
+  out.push(underConstruction(pages));
+  out.push(nameInTitle(pages, businessName));
+  return out;
+}
+function underConstruction(pages) {
+  const KEY = "under-construction";
+  const LABEL = "Pages that say they are unfinished";
+  const WHY = "A live page announcing it is coming soon is a page better unlinked until it is not.";
+  if (pages.length === 0) return unknown(KEY, LABEL, WHY, "content");
+  for (const p of pages) {
+    const headlines = [p.extract.title ?? "", ...p.extract.headings.map((h) => h.text)];
+    for (const line of headlines) {
+      const m = UNDER_CONSTRUCTION.exec(line);
+      if (m) {
+        return check(KEY, LABEL, WHY, "content", false, `${p.url}: \u201C${line.trim()}\u201D`);
+      }
+    }
+  }
+  return check(
+    KEY,
+    LABEL,
+    WHY,
+    "content",
+    true,
+    `no page announces itself unfinished, across the ${pages.length} we read`
+  );
+}
+var LEADING_ARTICLES = /* @__PURE__ */ new Set(["the"]);
+function nameInTitle(pages, businessName) {
+  const WHY = "The title is the line in a search result, a browser tab and a shared link. Without your name in it, all three are anonymous.";
+  const LABEL = "Your name in the page title";
+  if (!businessName) return unknown("name-in-title", LABEL, WHY, "quick");
+  const home = pages[0];
+  if (!home || !home.extract.title) {
+    return unknown("name-in-title", LABEL, WHY, "quick");
+  }
+  const words = businessName.toLowerCase().split(/[^\p{L}\p{N}]+/u).filter((w) => w.length > 2 && !LEADING_ARTICLES.has(w));
+  const head = words[0];
+  const title = home.extract.title.toLowerCase();
+  const hit = head !== void 0 && title.includes(head);
+  return check("name-in-title", LABEL, WHY, "quick", hit, `\u201C${home.extract.title}\u201D`);
+}
+function headingChecks(pages, businessName) {
+  const WHY_PRESENT = "The h1 is the page's headline. A page without one gives a reader \u2014 and an assistant looking for something to quote \u2014 nothing that says what the page is about.";
+  const WHY_ONE = "When everything on the page is marked as the page's headline, none of it is, and whatever gets quoted back is whichever one came first in the markup.";
+  if (pages.length === 0) {
+    return [
+      unknown("h1-present", "A headline on every page", WHY_PRESENT, "content"),
+      unknown("h1-one-headline", "One headline, not a list of them", WHY_ONE, "content"),
+      unknown(
+        "h1-not-name",
+        "Headlines that say what the page is about",
+        "A headline that is just your company name on every page describes none of them.",
+        "content"
+      ),
+      unknown(
+        "h1-distinct",
+        "A different headline on each page",
+        "Identical headlines make every page look like the same page, to a reader and to a search engine.",
+        "content"
+      )
+    ];
+  }
+  const counted = contentPages(pages);
+  if (counted.length === 0) {
+    const HIDDEN = "every page we read asks not to be indexed, which is reported under meta-noindex";
+    return [
+      skip("h1-present", "A headline on every page", WHY_PRESENT, "content", HIDDEN),
+      skip("h1-one-headline", "One headline, not a list of them", WHY_ONE, "content", HIDDEN),
+      skip(
+        "h1-not-name",
+        "Headlines that say what the page is about",
+        "A headline that is just your company name on every page describes none of them.",
+        "content",
+        HIDDEN
+      ),
+      skip(
+        "h1-distinct",
+        "A different headline on each page",
+        "Identical headlines make every page look like the same page, to a reader and to a search engine.",
+        "content",
+        HIDDEN
+      )
+    ];
+  }
+  const h1sPerPage = counted.map((p) => ({
+    url: p.url,
+    h1s: p.extract.headings.filter((h) => h.level === 1).map((h) => h.text.trim())
+  }));
+  const missing = h1sPerPage.filter((p) => p.h1s.length === 0);
+  const out = [
+    check(
+      "h1-present",
+      "A headline on every page",
+      WHY_PRESENT,
+      "content",
+      missing.length === 0,
+      missing.length === 0 ? `all ${counted.length} pages carry one` : `${missing.length} of ${counted.length}: ${missing.slice(0, 3).map((p) => p.url).join(", ")}`
+    )
+  ];
+  const CROWDED_AT = 3;
+  const crowded = h1sPerPage.filter((p) => p.h1s.length >= CROWDED_AT);
+  out.push(
+    check(
+      "h1-one-headline",
+      "One headline, not a list of them",
+      WHY_ONE,
+      "content",
+      crowded.length === 0,
+      crowded.length === 0 ? `no page marks more than two of its lines as the headline, across the ${counted.length} we read` : crowded.slice(0, 3).map((p) => `${p.url} has ${p.h1s.length}`).join(", ")
+    )
+  );
+  const WHY_NAME = "A headline that is only your company name describes none of the page below it.";
+  const LABEL_NAME = "Headlines that say what the page is about";
+  const named = h1sPerPage.filter((p) => p.h1s.length === 1);
+  if (!businessName || named.length === 0) {
+    out.push(unknown("h1-not-name", LABEL_NAME, WHY_NAME, "content"));
+  } else {
+    const bare = named.filter(
+      (p) => p.h1s[0].toLowerCase().replace(/[^\p{L}\p{N}]+/gu, "") === businessName.toLowerCase().replace(/[^\p{L}\p{N}]+/gu, "")
+    );
+    out.push(
+      check(
+        "h1-not-name",
+        LABEL_NAME,
+        WHY_NAME,
+        "content",
+        bare.length === 0,
+        bare.length === 0 ? "every headline describes its page" : `${bare.length} ${bare.length === 1 ? "page's headline is" : "pages' headlines are"} just \u201C${businessName}\u201D`
+      )
+    );
+  }
+  const WHY_DISTINCT = "Identical headlines make every page look like the same page, to a reader scanning tabs and to a search engine choosing which one to show.";
+  const LABEL_DISTINCT = "A different headline on each page";
+  if (counted.length < 2) {
+    out.push(
+      skip(
+        "h1-distinct",
+        LABEL_DISTINCT,
+        WHY_DISTINCT,
+        "content",
+        "only one page was read, so there is nothing to compare it with"
+      )
+    );
+  } else {
+    const distinct = counted.filter(
+      (p) => p.extract.headings.filter((h) => h.level === 1).length === 1
+    );
+    if (distinct.length < 2) {
+      out.push(
+        skip(
+          "h1-distinct",
+          LABEL_DISTINCT,
+          WHY_DISTINCT,
+          "content",
+          distinct.length === 0 ? "no page we read carries exactly one headline, which is reported above" : "the pages we read all declare the same address, so there is nothing to compare"
+        )
+      );
+    } else {
+      const texts = distinct.map(
+        (p) => p.extract.headings.find((h) => h.level === 1).text.trim().toLowerCase()
+      );
+      const dupes = texts.filter((t, i) => texts.indexOf(t) !== i);
+      out.push(
+        check(
+          "h1-distinct",
+          LABEL_DISTINCT,
+          WHY_DISTINCT,
+          "content",
+          dupes.length === 0,
+          dupes.length === 0 ? `${texts.length} pages, ${new Set(texts).size} different headlines` : `\u201C${[...new Set(dupes)].slice(0, 2).join("\u201D, \u201C")}\u201D appears on more than one page`
+        )
+      );
+    }
+  }
+  return out;
+}
+function collectNodes(node, into, depth = 0) {
+  if (depth > 8) return;
+  if (Array.isArray(node)) {
+    for (const n of node) collectNodes(n, into, depth + 1);
+    return;
+  }
+  if (!node || typeof node !== "object") return;
+  const obj = node;
+  if (obj["@type"]) into.push(obj);
+  for (const [k, v] of Object.entries(obj)) {
+    if (k === "@type") continue;
+    if (v && typeof v === "object") collectNodes(v, into, depth + 1);
+  }
+}
+var typeOf = (n) => {
+  const t = n["@type"];
+  const raw = typeof t === "string" ? [t] : Array.isArray(t) ? t.filter((x) => typeof x === "string") : [];
+  return raw.map((s) => String(s).replace(/^https?:\/\/schema\.org\//i, ""));
+};
+var isType = (n, names) => typeOf(n).some((t) => names.some((name) => t.toLowerCase() === name.toLowerCase()));
+var str = (v) => typeof v === "string" && v.trim() ? v.trim() : null;
+function schemaUrl(value, nodes, depth = 0) {
+  if (depth > 3) return null;
+  const direct = str(value);
+  if (direct) return direct;
+  if (Array.isArray(value)) {
+    for (const v of value) {
+      const hit = schemaUrl(v, nodes, depth + 1);
+      if (hit) return hit;
+    }
+    return null;
+  }
+  if (!value || typeof value !== "object") return null;
+  const obj = value;
+  const inline = str(obj["url"]) ?? str(obj["contentUrl"]);
+  if (inline) return inline;
+  const id = str(obj["@id"]);
+  if (!id) return null;
+  const target = nodes.find((n) => n !== obj && str(n["@id"]) === id);
+  return target ? schemaUrl(target, nodes, depth + 1) : null;
+}
+function schemaChecks(pages, origin, phones) {
+  const nodes = [];
+  const declaredOn = /* @__PURE__ */ new Map();
+  let parsedAny = false;
+  for (const p of pages) {
+    for (const block of p.extract.jsonLd) {
+      const before = nodes.length;
+      try {
+        collectNodes(JSON.parse(block), nodes);
+        parsedAny = true;
+      } catch {
+      }
+      for (let i = before; i < nodes.length; i++) declaredOn.set(nodes[i], p.url);
+    }
+  }
+  const ORG = ["Organization", "LocalBusiness", "ProfessionalService", "Corporation"];
+  const org = nodes.find((n) => isType(n, ORG));
+  const local = nodes.find((n) => isType(n, ["LocalBusiness", "ProfessionalService"]));
+  const noSchema = (key, label, why) => skip(
+    key,
+    label,
+    why,
+    "content",
+    parsedAny ? "no such block in your structured data" : "this site publishes no structured data"
+  );
+  const out = [];
+  const WHY_ORG = "This is the block an assistant reads to learn who you are. Half-filled, it answers half the question and the rest gets taken from a directory you do not control.";
+  if (!org) {
+    out.push(noSchema("schema-org-complete", "Your business details in structured data", WHY_ORG));
+  } else {
+    const missing = ["name", "url", "logo"].filter(
+      (f) => f === "name" ? !str(org[f]) : !schemaUrl(org[f], nodes)
+    );
+    out.push(
+      check(
+        "schema-org-complete",
+        "Your business details in structured data",
+        WHY_ORG,
+        "content",
+        missing.length === 0,
+        missing.length === 0 ? `name, url and logo all present on your ${typeOf(org)[0]} block` : `your ${typeOf(org)[0]} block is missing ${missing.join(", ")}`
+      )
+    );
+  }
+  const WHY_LOCAL = "A local business block without an address, a phone or opening hours is the one an assistant will fill in from elsewhere.";
+  if (!local) {
+    out.push(
+      noSchema("schema-local-complete", "Your address and hours in structured data", WHY_LOCAL)
+    );
+  } else {
+    const missing = ["address", "telephone", "openingHours"].filter(
+      (f) => local[f] === void 0 && local[`${f}Specification`] === void 0
+    );
+    out.push(
+      check(
+        "schema-local-complete",
+        "Your address and hours in structured data",
+        WHY_LOCAL,
+        "content",
+        missing.length === 0,
+        missing.length === 0 ? "address, telephone and opening hours all present" : `missing ${missing.join(", ")}`
+      )
+    );
+  }
+  const WHY_URL = "A structured-data url pointing at a domain you no longer use tells every assistant that reads it to go and look somewhere else.";
+  const declaredUrl = org ? schemaUrl(org["url"], nodes) : null;
+  if (!declaredUrl) {
+    out.push(noSchema("schema-url-matches", "Structured data pointing at this site", WHY_URL));
+  } else {
+    const base = (org ? declaredOn.get(org) : null) ?? origin;
+    const absolute = (() => {
+      try {
+        return new URL(declaredUrl, base).toString();
+      } catch {
+        return null;
+      }
+    })();
+    const host = (u) => {
+      try {
+        return new URL(u).hostname.replace(/^www\./i, "").toLowerCase();
+      } catch {
+        return null;
+      }
+    };
+    const declaredHost = absolute === null ? null : host(absolute);
+    const sameHost = declaredHost !== null && declaredHost === host(origin);
+    out.push(
+      check(
+        "schema-url-matches",
+        "Structured data pointing at this site",
+        WHY_URL,
+        "content",
+        sameHost,
+        // The resolved address, since that is the one we compared. Printing the
+        // raw "/" back at a reader who passed would read as a bug in us.
+        absolute ?? declaredUrl
+      )
+    );
+  }
+  const WHY_PHONE = "When the number in your structured data is not the number on your page, an assistant may quote either one.";
+  const schemaPhone = org ? str(org["telephone"]) : null;
+  const digits = (s) => s.replace(/\D/g, "").replace(/^1(?=\d{10}$)/, "");
+  if (!schemaPhone || phones.length === 0) {
+    out.push(
+      skip(
+        "schema-phone-matches",
+        "One phone number, everywhere",
+        WHY_PHONE,
+        "quick",
+        !schemaPhone ? "no telephone in your structured data" : "we found no phone number in the page text to compare it with"
+      )
+    );
+  } else {
+    const match = phones.some((p) => digits(p) === digits(schemaPhone));
+    out.push(
+      check(
+        "schema-phone-matches",
+        "One phone number, everywhere",
+        WHY_PHONE,
+        "quick",
+        match,
+        match ? `${schemaPhone}, matching the page` : `${schemaPhone} in schema, not among the numbers on your pages`
+      )
+    );
+  }
+  const WHY_REVIEW = "Google does not show star ratings a business publishes about itself, so the markup does nothing but sit there.";
+  const selfReview = nodes.filter(
+    (n) => isType(n, ["AggregateRating", "Review"]) && org !== void 0
+  );
+  const selfServing = org ? selfReview.filter(() => org["aggregateRating"] !== void 0 || org["review"] !== void 0) : [];
+  if (!org || selfReview.length === 0) {
+    out.push(
+      skip(
+        "schema-self-review",
+        "Ratings you publish about yourself",
+        WHY_REVIEW,
+        "content",
+        "no review or rating markup on this site"
+      )
+    );
+  } else {
+    out.push(
+      check(
+        "schema-self-review",
+        "Ratings you publish about yourself",
+        WHY_REVIEW,
+        "content",
+        selfServing.length === 0,
+        selfServing.length === 0 ? "your rating markup is attached to something other than your own organisation" : `an aggregateRating sits on your own ${typeOf(org)[0]} block`
+      )
+    );
+  }
+  return out;
+}
+var SECURITY_HEADER_CHECKS = [
+  {
+    header: "strict-transport-security",
+    label: "Telling browsers to always use https",
+    why: "Without it, the first visit of the day can still be made over plain http before the redirect happens."
+  },
+  {
+    header: "content-security-policy",
+    label: "A policy for what may run on your pages",
+    why: "It is the difference between a compromised script running on your site and being blocked by the browser."
+  },
+  {
+    header: "x-content-type-options",
+    label: "Stopping browsers guessing file types",
+    why: "One line that prevents a browser treating an uploaded file as something executable."
+  },
+  {
+    header: "x-frame-options",
+    label: "Stopping other sites framing yours",
+    why: "Without it, anyone can put your site inside theirs and collect what visitors type into it."
+  },
+  {
+    header: "permissions-policy",
+    label: "Declaring what your pages may ask for",
+    // NOT "it stops an embedded third party quietly asking for their camera",
+    // which is what this said and is not true. Tested in a browser: a
+    // cross-origin iframe is refused camera and geolocation with no header set
+    // at all, and is GRANTED them with no header set the moment the site writes
+    // `allow="geolocation"` on the iframe itself. The gate is the attribute the
+    // site author types, so nothing here happens quietly. What the header adds
+    // is the ability to say no to code already running on the page — including
+    // code the owner did not write, if a dependency is ever compromised.
+    why: "It limits what code running on your own pages may ask visitors for \u2014 including code you did not write, if a dependency is ever compromised.",
+    // At least one directive whose allowlist is not `*`. `camera=()` denies it
+    // outright, `camera=(self)` keeps it to your own code, `camera=*` grants it
+    // to anything the page delegates to — which is the browser default, so a
+    // header made only of those changes nothing.
+    restricts: (value) => value.split(",").map((d) => d.trim()).filter(Boolean).some((d) => {
+      const eq = d.indexOf("=");
+      if (eq < 0) return false;
+      const allow = d.slice(eq + 1).trim();
+      return allow !== "*";
+    })
+  }
+];
+var VERSIONED = /\d+\.\d+/;
+var LEAKS_MORE_THAN_DEFAULT = /* @__PURE__ */ new Set(["unsafe-url", "no-referrer-when-downgrade"]);
+function referrerPolicyCheck(headers, measured) {
+  const LABEL = "Not leaking more of your addresses than the browser already does";
+  const WHY = "Browsers already trim the page address to your bare domain before handing it to a site a visitor clicks through to. Two values of this header undo that and send the whole address, query string included.";
+  if (!measured) return unknown("header-referrer-policy", LABEL, WHY, "quick");
+  const raw = headers["referrer-policy"];
+  if (raw === void 0) {
+    return skip(
+      "header-referrer-policy",
+      LABEL,
+      WHY,
+      "quick",
+      "no referrer-policy header, so the browser's own default applies \u2014 which does not leak the address"
+    );
+  }
+  const values = raw.split(",").map((v) => v.trim().toLowerCase()).filter(Boolean);
+  const effective = [...values].reverse().find((v) => KNOWN_REFERRER_POLICIES.has(v)) ?? null;
+  if (effective === null) {
+    return skip(
+      "header-referrer-policy",
+      LABEL,
+      WHY,
+      "quick",
+      `referrer-policy names no value a browser recognises (\u201C${raw.slice(0, 60)}\u201D), so the default applies`
+    );
+  }
+  const leaks = LEAKS_MORE_THAN_DEFAULT.has(effective);
+  return check(
+    "header-referrer-policy",
+    LABEL,
+    WHY,
+    "quick",
+    !leaks,
+    leaks ? `referrer-policy: ${effective} \u2014 that sends the full address, query string and all, to every site your visitors click through to` : `referrer-policy: ${effective}`
+  );
+}
+var KNOWN_REFERRER_POLICIES = /* @__PURE__ */ new Set([
+  "no-referrer",
+  "no-referrer-when-downgrade",
+  "origin",
+  "origin-when-cross-origin",
+  "same-origin",
+  "strict-origin",
+  "strict-origin-when-cross-origin",
+  "unsafe-url"
+]);
+function headerChecks(headers, measured) {
+  const out = [];
+  for (const { header, label, why, restricts } of SECURITY_HEADER_CHECKS) {
+    if (!measured) {
+      out.push(unknown(`header-${header}`, label, why, "quick"));
+      continue;
+    }
+    const value = headers[header];
+    const present = value !== void 0;
+    const ok = present && (restricts === void 0 || restricts(value));
+    out.push(
+      check(
+        `header-${header}`,
+        label,
+        why,
+        "quick",
+        ok,
+        !present ? `no ${header} header` : ok ? `${header} is set` : `${header} is set, but every directive in it is \u201C*\u201D \u2014 which is what the browser does without the header`
+      )
+    );
+  }
+  out.push(referrerPolicyCheck(headers, measured));
+  const WHY_LEAK = "Naming the exact version you run tells anyone looking which published vulnerabilities to try first.";
+  if (!measured) {
+    out.push(
+      unknown("header-version-leak", "Not advertising your software versions", WHY_LEAK, "quick")
+    );
+  } else {
+    const leaks = ["server", "x-powered-by"].filter((h) => headers[h] && VERSIONED.test(headers[h])).map((h) => `${h}: ${headers[h]}`);
+    out.push(
+      check(
+        "header-version-leak",
+        "Not advertising your software versions",
+        WHY_LEAK,
+        "quick",
+        leaks.length === 0,
+        leaks.length === 0 ? "no version numbers in your response headers" : leaks.join(", ")
+      )
+    );
+  }
+  const WHY_GZIP = "Uncompressed HTML is roughly four times the bytes for the same page, paid for by every visitor on a phone.";
+  if (!measured) {
+    out.push(unknown("header-compression", "Pages sent compressed", WHY_GZIP, "quick"));
+  } else {
+    const enc = headers["content-encoding"] ?? "";
+    const ok = /gzip|br|zstd|deflate/i.test(enc);
+    out.push(
+      check(
+        "header-compression",
+        "Pages sent compressed",
+        WHY_GZIP,
+        "quick",
+        ok,
+        ok ? `content-encoding: ${enc}` : "your HTML is served uncompressed"
+      )
+    );
+  }
+  const WHY_MAXAGE = "A max-age of a few minutes gives almost none of the protection the header exists for.";
+  const hsts = headers["strict-transport-security"];
+  const SIX_MONTHS = 15552e3;
+  if (!measured || !hsts) {
+    out.push(
+      skip(
+        "header-hsts-age",
+        "An https policy that lasts",
+        WHY_MAXAGE,
+        "quick",
+        "no strict-transport-security header to read a max-age from"
+      )
+    );
+  } else {
+    const m = /max-age\s*=\s*(\d+)/i.exec(hsts);
+    const age = m ? Number(m[1]) : 0;
+    out.push(
+      check(
+        "header-hsts-age",
+        "An https policy that lasts",
+        WHY_MAXAGE,
+        "quick",
+        age >= SIX_MONTHS,
+        `max-age=${age}${age >= SIX_MONTHS ? "" : " \u2014 six months is the usual minimum"}`
+      )
+    );
+  }
+  return out;
+}
+function sidecarChecks(crawl, linkedPages) {
+  const discoveredLinks = linkedPages.size;
+  const out = [];
+  const robotsMeasured = crawl.sidecarErrors.robots === null;
+  const WHY_DISALLOW = "A blanket Disallow tells every search engine and every assistant to stay off the whole site. It is usually left over from a staging server.";
+  if (!robotsMeasured) {
+    out.push(
+      unknown(
+        "robots-not-blocking",
+        "robots.txt not blocking your whole site",
+        WHY_DISALLOW,
+        "quick"
+      )
+    );
+  } else if (crawl.robotsTxt === null) {
+    out.push(
+      check(
+        "robots-not-blocking",
+        "robots.txt not blocking your whole site",
+        WHY_DISALLOW,
+        "quick",
+        true,
+        "no robots.txt, so nothing is disallowed"
+      )
+    );
+  } else {
+    const blocked = /user-agent\s*:\s*\*[^]*?^\s*disallow\s*:\s*\/\s*$/im.test(crawl.robotsTxt);
+    out.push(
+      check(
+        "robots-not-blocking",
+        "robots.txt not blocking your whole site",
+        WHY_DISALLOW,
+        "quick",
+        !blocked,
+        blocked ? "Disallow: / applies to every crawler" : "nothing site-wide is disallowed"
+      )
+    );
+  }
+  const WHY_SITEMAP_LINE = "Naming the sitemap in robots.txt is how a crawler that has never seen your site finds the list of your pages.";
+  if (!robotsMeasured || crawl.robotsTxt === null) {
+    out.push(
+      skip(
+        "robots-names-sitemap",
+        "robots.txt naming your sitemap",
+        WHY_SITEMAP_LINE,
+        "quick",
+        robotsMeasured ? "this site has no robots.txt" : "we could not read robots.txt on this run"
+      )
+    );
+  } else {
+    const named = /^\s*sitemap\s*:/im.test(crawl.robotsTxt);
+    out.push(
+      check(
+        "robots-names-sitemap",
+        "robots.txt naming your sitemap",
+        WHY_SITEMAP_LINE,
+        "quick",
+        named,
+        named ? "a Sitemap: line is present" : "no Sitemap: line in robots.txt"
+      )
+    );
+  }
+  const sitemapMeasured = crawl.sidecarErrors.sitemap === null;
+  const WHY_COVERAGE = "A sitemap listing fewer pages than your own navigation links to leaves the rest to be found by luck.";
+  if (!sitemapMeasured || !crawl.sitemap.present) {
+    out.push(
+      skip(
+        "sitemap-coverage",
+        "A sitemap that lists your pages",
+        WHY_COVERAGE,
+        "content",
+        sitemapMeasured ? "this site has no sitemap.xml" : "we could not read the sitemap on this run"
+      )
+    );
+  } else if (discoveredLinks === 0) {
+    out.push(
+      unknown("sitemap-coverage", "A sitemap that lists your pages", WHY_COVERAGE, "content")
+    );
+  } else if (crawl.sitemap.truncated !== false) {
+    out.push(
+      unknown("sitemap-coverage", "A sitemap that lists your pages", WHY_COVERAGE, "content")
+    );
+  } else {
+    const ok = crawl.sitemap.urlCount >= discoveredLinks;
+    const sample = crawl.sitemap.sample;
+    const whole = sample !== void 0 && crawl.sitemap.urlCount <= sample.length;
+    const listed = new Set(sample?.map((u) => norm2(u) ?? u));
+    const unlisted = whole ? [...linkedPages].filter((a) => !listed.has(a)) : [];
+    out.push(
+      check(
+        "sitemap-coverage",
+        "A sitemap that lists your pages",
+        WHY_COVERAGE,
+        "content",
+        ok && unlisted.length === 0,
+        unlisted.length > 0 ? `${unlisted.length} ${unlisted.length === 1 ? "page your own links point to is" : "pages your own links point to are"} missing from it \u2014 ${unlisted[0]}` : `${crawl.sitemap.urlCount} URLs listed, against ${discoveredLinks} distinct pages your own links point to`
+      )
+    );
+  }
+  const WHY_LLMS = "A short llms.txt states, in your own words, what you do and which pages matter. No answer engine has published that it reads one, so this is recorded rather than counted against you.";
+  const llmsMeasured = crawl.sidecarErrors.llms === null;
+  if (!llmsMeasured) {
+    out.push(unknown("llms-txt", "A file written for AI assistants", WHY_LLMS, "content"));
+  } else if (crawl.llmsTxt.present) {
+    out.push(
+      check(
+        "llms-txt",
+        "A file written for AI assistants",
+        WHY_LLMS,
+        "content",
+        true,
+        crawl.llmsTxt.firstLine ?? "present"
+      )
+    );
+  } else {
+    out.push(
+      skip(
+        "llms-txt",
+        "A file written for AI assistants",
+        WHY_LLMS,
+        "content",
+        "no llms.txt \u2014 recorded, not counted against you, because no engine has published that it reads one"
+      )
+    );
+  }
+  return out;
+}
+var FIRST_PARTY_BUNDLE = 10;
+var ANALYTICS_MARKERS = /(googletagmanager\.com|google-analytics\.com|plausible\.io|usefathom\.com|clarity\.ms|segment\.(?:com|io)|matomo|piwik|statcounter|hotjar\.com|posthog\.com|umami|simpleanalytics|cloudflareinsights\.com)/i;
+function analyticsCheck(pages) {
+  const WHY = "Without any analytics you cannot tell whether a change helped, which visit turned into an enquiry, or whether the work was worth doing.";
+  const LABEL = "Something measuring whether any of this works";
+  const readable = pages.filter((p) => p.extract.scriptSrcs !== void 0);
+  if (readable.length === 0) return unknown("analytics", LABEL, WHY, "quick");
+  const loaded = readable.flatMap((p) => p.extract.scriptSrcs ?? []);
+  const named = readable.flatMap((p) => p.extract.inlineScriptUrls ?? []);
+  const hit = loaded.find((s) => ANALYTICS_MARKERS.test(s));
+  const deferred = hit ? void 0 : named.find((h) => ANALYTICS_MARKERS.test(h));
+  const thirdParty = loaded.filter((src) => /^https?:\/\//i.test(src));
+  if (!hit && !deferred && thirdParty.length === 0 && loaded.length >= FIRST_PARTY_BUNDLE) {
+    return unknown("analytics", LABEL, WHY, "quick");
+  }
+  return check(
+    "analytics",
+    LABEL,
+    WHY,
+    "quick",
+    hit !== void 0 || deferred !== void 0,
+    hit ?? (deferred ? `${deferred}, loaded on first interaction` : "no third-party analytics on the pages we read")
+  );
+}
+function metaChecks(pages) {
+  const out = [];
+  const readable = pages.filter((p) => p.extract.metas !== void 0);
+  const WHY_NOINDEX = "This one line tells every search engine and assistant to leave the page out of their results entirely. It is almost always left over from a staging site, and nothing on the page looks wrong.";
+  const WHY_NOFOLLOW = "It tells search engines not to follow any link on the page, so nothing you link to gets credit from it.";
+  const WHY_CHARSET = "Without a declared character set the browser guesses, and a wrong guess is what turns apostrophes into \xE2\u20AC\u2122.";
+  if (readable.length === 0) {
+    return [
+      unknown("meta-noindex", "Pages search engines are allowed to list", WHY_NOINDEX, "quick"),
+      unknown("meta-nofollow", "Links search engines are allowed to follow", WHY_NOFOLLOW, "quick"),
+      unknown("meta-charset", "A declared character set", WHY_CHARSET, "quick"),
+      unknown(
+        "title-length",
+        "Titles that survive a search result",
+        "A title that is too long is cut off mid-word in the result, and one that is too short wastes the most valuable line you get.",
+        "content"
+      ),
+      unknown(
+        "description-length",
+        "Descriptions that survive a search result",
+        "The description is the sentence under your link. Too long and it is truncated; too short and the engine writes its own.",
+        "content"
+      ),
+      unknown(
+        "og-image-absolute",
+        "A share image with a full web address",
+        "A relative og:image renders no card at all on Slack, LinkedIn or iMessage \u2014 the link arrives as bare text.",
+        "quick"
+      ),
+      unknown(
+        "duplicate-descriptions",
+        "A different description on each page",
+        "Identical descriptions make every page look like the same page in a search result.",
+        "content"
+      )
+    ];
+  }
+  const flagged = (token) => readable.filter((p) => token.test(p.extract.metas?.["robots"] ?? "")).map((p) => ({ url: p.url, value: p.extract.metas["robots"] }));
+  const noindex = flagged(/\bnoindex\b/i);
+  out.push(
+    check(
+      "meta-noindex",
+      "Pages search engines are allowed to list",
+      WHY_NOINDEX,
+      "quick",
+      noindex.length === 0,
+      noindex.length === 0 ? `none of the ${readable.length} pages we read asks to be hidden` : `${noindex.length} ${noindex.length === 1 ? "page carries" : "pages carry"} noindex: ${noindex.slice(0, 3).map((n) => n.url).join(", ")}`
+    )
+  );
+  const nofollow = flagged(/\bnofollow\b/i);
+  out.push(
+    check(
+      "meta-nofollow",
+      "Links search engines are allowed to follow",
+      WHY_NOFOLLOW,
+      "quick",
+      nofollow.length === 0,
+      nofollow.length === 0 ? "no page-wide nofollow" : `${nofollow.length} ${nofollow.length === 1 ? "page" : "pages"}`
+    )
+  );
+  const noCharset = readable.filter((p) => !p.extract.metas?.["charset"]);
+  out.push(
+    check(
+      "meta-charset",
+      "A declared character set",
+      WHY_CHARSET,
+      "quick",
+      noCharset.length === 0,
+      noCharset.length === 0 ? `declared on all ${readable.length} pages` : `missing on ${noCharset.length} ${noCharset.length === 1 ? "page" : "pages"}`
+    )
+  );
+  const TITLE_MIN = 10;
+  const TITLE_MAX = 70;
+  const titled = pages.filter((p) => p.extract.title);
+  if (titled.length === 0) {
+    out.push(
+      skip(
+        "title-length",
+        "Titles that survive a search result",
+        "A title that is too long is cut off mid-word in the result, and one that is too short wastes the most valuable line you get.",
+        "content",
+        "no page we read carries a title, which is reported separately"
+      )
+    );
+  } else {
+    const bad = titled.filter(
+      (p) => p.extract.title.length < TITLE_MIN || p.extract.title.length > TITLE_MAX
+    );
+    out.push(
+      check(
+        "title-length",
+        "Titles that survive a search result",
+        "A title that is too long is cut off mid-word in the result, and one that is too short wastes the most valuable line you get.",
+        "content",
+        bad.length === 0,
+        bad.length === 0 ? `all ${titled.length} are between ${TITLE_MIN} and ${TITLE_MAX} characters` : bad.slice(0, 2).map((p) => `${p.url}: ${p.extract.title.length} characters`).join(", ")
+      )
+    );
+  }
+  const DESC_MIN = 40;
+  const DESC_MAX = 200;
+  const described = contentPages(pages).filter((p) => p.extract.metaDescription);
+  if (described.length === 0) {
+    out.push(
+      skip(
+        "description-length",
+        "Descriptions that survive a search result",
+        "The description is the sentence under your link. Too long and it is truncated; too short and the engine writes its own.",
+        "content",
+        "no page we read carries a description, which is reported separately"
+      )
+    );
+  } else {
+    const bad = described.filter(
+      (p) => p.extract.metaDescription.length < DESC_MIN || p.extract.metaDescription.length > DESC_MAX
+    );
+    out.push(
+      check(
+        "description-length",
+        "Descriptions that survive a search result",
+        "The description is the sentence under your link. Too long and it is truncated; too short and the engine writes its own.",
+        "content",
+        bad.length === 0,
+        bad.length === 0 ? `all ${described.length} are between ${DESC_MIN} and ${DESC_MAX} characters` : bad.slice(0, 2).map((p) => `${p.url}: ${p.extract.metaDescription.length} characters`).join(", ")
+      )
+    );
+  }
+  const WHY_OG = "A relative og:image renders no card at all on Slack, LinkedIn or iMessage \u2014 the link arrives as bare text.";
+  const withOg = pages.filter((p) => p.extract.social["og:image"]);
+  if (withOg.length === 0) {
+    out.push(
+      skip(
+        "og-image-absolute",
+        "A share image with a full web address",
+        WHY_OG,
+        "quick",
+        "no page we read declares an og:image"
+      )
+    );
+  } else {
+    const relative = withOg.filter((p) => !/^https?:\/\//i.test(p.extract.social["og:image"]));
+    out.push(
+      check(
+        "og-image-absolute",
+        "A share image with a full web address",
+        WHY_OG,
+        "quick",
+        relative.length === 0,
+        relative.length === 0 ? withOg[0].extract.social["og:image"] : `${relative[0].url} declares \u201C${relative[0].extract.social["og:image"]}\u201D, which has no host`
+      )
+    );
+  }
+  const WHY_DUP_DESC = "Identical descriptions make every page look like the same page in a search result, and the engine usually replaces them with a sentence of its own choosing.";
+  const distinctDescribed = byDeclaredAddress(described);
+  if (distinctDescribed.length < 2) {
+    out.push(
+      skip(
+        "duplicate-descriptions",
+        "A different description on each page",
+        WHY_DUP_DESC,
+        "content",
+        described.length < 2 ? "fewer than two pages carry a description, so there is nothing to compare" : "the pages we read that carry a description all declare the same address, so there is nothing to compare"
+      )
+    );
+  } else {
+    const seen = /* @__PURE__ */ new Map();
+    for (const p of distinctDescribed) {
+      const key = p.extract.metaDescription.trim().toLowerCase();
+      seen.set(key, [...seen.get(key) ?? [], p.url]);
+    }
+    const dupes = [...seen.entries()].filter(([, urls]) => urls.length > 1);
+    out.push(
+      check(
+        "duplicate-descriptions",
+        "A different description on each page",
+        WHY_DUP_DESC,
+        "content",
+        dupes.length === 0,
+        dupes.length === 0 ? `${distinctDescribed.length} pages, ${seen.size} different descriptions` : `${dupes[0][1].length} pages share one description`
+      )
+    );
+  }
+  return out;
+}
+function linkChecks(pages, origin, faviconProbed) {
+  const readable = pages.filter((p) => p.extract.links !== void 0);
+  const WHY_FAVICON = "Without one the browser shows a blank page icon in the tab and the bookmark, which is the smallest possible thing to fix and the most often seen.";
+  const WHY_CANON_SELF = "A canonical naming another page tells search engines to index that page instead of this one. That is right for a genuine duplicate, and the fastest way to remove real pages from search results when it is not.";
+  const WHY_CANON_ORIGIN = "A canonical on another domain hands every page's search ranking to that domain. It is usually a staging host or a site they used to own.";
+  const WHY_HREFLANG = "An hreflang set that does not name itself is ignored, so the translated pages compete with each other instead of being offered to the right reader.";
+  if (readable.length === 0) {
+    return [
+      unknown("favicon-declared", "An icon for the browser tab", WHY_FAVICON, "quick"),
+      unknown("canonical-self", "Pages that point at themselves", WHY_CANON_SELF, "structural"),
+      unknown(
+        "canonical-origin",
+        "Canonicals that stay on your domain",
+        WHY_CANON_ORIGIN,
+        "structural"
+      ),
+      unknown("hreflang-self", "Language alternates that name themselves", WHY_HREFLANG, "content")
+    ];
+  }
+  const out = [];
+  const icon = readable.flatMap((p) => p.extract.links ?? []).find((l) => /(^|\s)(icon|shortcut icon|apple-touch-icon)(\s|$)/.test(l.rel));
+  out.push(
+    faviconProbed ? skip(
+      "favicon-declared",
+      "An icon for the browser tab",
+      WHY_FAVICON,
+      "quick",
+      icon ? "the icon your pages declare is the one we fetched, reported below" : "no icon is declared, so we fetched /favicon.ico instead \u2014 reported below"
+    ) : check(
+      "favicon-declared",
+      "An icon for the browser tab",
+      WHY_FAVICON,
+      "quick",
+      icon !== void 0,
+      icon ? `rel="${icon.rel}" \u2192 ${icon.href}` : "no icon link on the pages we read"
+    )
+  );
+  const host = (u, base) => {
+    try {
+      return new URL(u, base).hostname.replace(/^www\./i, "").toLowerCase();
+    } catch {
+      return null;
+    }
+  };
+  const ownHost = host(origin);
+  const canonical = pages.filter((p) => p.extract.canonical);
+  if (canonical.length === 0) {
+    out.push(
+      skip(
+        "canonical-self",
+        "Pages that point at themselves",
+        WHY_CANON_SELF,
+        "structural",
+        "no page we read declares a canonical, which is reported separately"
+      ),
+      skip(
+        "canonical-origin",
+        "Canonicals that stay on your domain",
+        WHY_CANON_ORIGIN,
+        "structural",
+        "no page we read declares a canonical"
+      )
+    );
+  } else {
+    const norm = (u, base) => {
+      try {
+        const parsed = new URL(u, base);
+        return `${parsed.hostname.replace(/^www\./i, "").toLowerCase()}${parsed.pathname.replace(/\/+$/, "") || "/"}`;
+      } catch {
+        return null;
+      }
+    };
+    const notSelf = canonical.filter((p) => {
+      const a = norm(p.extract.canonical, p.url);
+      const b = norm(p.url, p.url);
+      return a === null || b === null || a !== b;
+    });
+    const soleH1 = (p) => {
+      const h1s = p.extract.headings.filter((h) => h.level === 1);
+      return h1s.length === 1 ? h1s[0].text.trim().toLowerCase() : null;
+    };
+    const byAddress = /* @__PURE__ */ new Map();
+    for (const p of pages) {
+      const key = norm(p.url, p.url);
+      if (key !== null && !byAddress.has(key)) byAddress.set(key, p);
+    }
+    const contradicted = notSelf.filter((p) => {
+      const target = norm(p.extract.canonical, p.url);
+      const other = target === null ? void 0 : byAddress.get(target);
+      if (other === void 0) return false;
+      const mine = soleH1(p);
+      const theirs = soleH1(other);
+      return mine !== null && theirs !== null && mine !== theirs;
+    });
+    const byTarget = /* @__PURE__ */ new Map();
+    for (const p of notSelf) {
+      const t = norm(p.extract.canonical, p.url);
+      if (t !== null) byTarget.set(t, [...byTarget.get(t) ?? [], p]);
+    }
+    const disagreeing = [...byTarget.entries()].filter(([, claimants]) => {
+      const heads = claimants.map(soleH1).filter((h) => h !== null);
+      return heads.length > 1 && new Set(heads).size > 1;
+    });
+    const WIPEOUT_AT = 3;
+    const wipeout = canonical.length >= WIPEOUT_AT && notSelf.length === canonical.length && byTarget.size === 1;
+    const collapsing = contradicted.length > 0 || disagreeing.length > 0 || wipeout;
+    out.push(
+      check(
+        "canonical-self",
+        "Pages that point at themselves",
+        WHY_CANON_SELF,
+        "structural",
+        !collapsing,
+        collapsing ? contradicted.length > 0 ? `${contradicted[0].url} names ${contradicted[0].extract.canonical} canonical, and the two carry different headlines` : wipeout ? `all ${canonical.length} pages we read name ${[...byTarget.keys()][0]} canonical` : `${disagreeing[0][1].length} pages with different headlines all name ${disagreeing[0][0]} canonical` : notSelf.length === 0 ? `all ${canonical.length} canonicals point at their own page` : `${canonical.length - notSelf.length} of ${canonical.length} point at their own page; the ${notSelf.length === 1 ? "other names a page it duplicates" : `other ${notSelf.length} name a page they duplicate`}`
+      )
+    );
+    const offOrigin = canonical.filter((p) => {
+      const h = host(p.extract.canonical, p.url);
+      return h !== null && h !== ownHost;
+    });
+    out.push(
+      check(
+        "canonical-origin",
+        "Canonicals that stay on your domain",
+        WHY_CANON_ORIGIN,
+        "structural",
+        offOrigin.length === 0,
+        offOrigin.length === 0 ? "every canonical stays on this domain" : `${offOrigin[0].url} points at ${offOrigin[0].extract.canonical}`
+      )
+    );
+  }
+  const alternates = readable.filter(
+    (p) => (p.extract.links ?? []).some((l) => l.rel === "alternate" && l.hreflang)
+  );
+  if (alternates.length === 0) {
+    out.push(
+      skip(
+        "hreflang-self",
+        "Language alternates that name themselves",
+        WHY_HREFLANG,
+        "content",
+        "this site publishes no language alternates"
+      )
+    );
+  } else {
+    const own = alternates.filter((p) => {
+      const c = p.extract.canonical ? norm2(p.extract.canonical, p.url) : null;
+      return c === null || c === norm2(p.url);
+    });
+    if (own.length === 0) {
+      out.push(
+        skip(
+          "hreflang-self",
+          "Language alternates that name themselves",
+          WHY_HREFLANG,
+          "content",
+          "every page we read that publishes alternates declares a different page canonical, so the set is not its own to name"
+        )
+      );
+      return out;
+    }
+    const missingSelf = own.filter((p) => {
+      const mine = norm2(p.url);
+      return !(p.extract.links ?? []).some(
+        (l) => l.rel === "alternate" && l.hreflang && norm2(l.href, p.url) === mine
+      );
+    });
+    out.push(
+      check(
+        "hreflang-self",
+        "Language alternates that name themselves",
+        WHY_HREFLANG,
+        "content",
+        missingSelf.length === 0,
+        missingSelf.length === 0 ? `${own.length} ${own.length === 1 ? "page lists" : "pages list"} themselves among their alternates` : `${missingSelf[0].url} is not among its own alternates`
+      )
+    );
+  }
+  return out;
+}
+function declaredAddress(p) {
+  return p.extract.canonical ? norm2(p.extract.canonical, p.url) : norm2(p.url);
+}
+function byDeclaredAddress(pages) {
+  const seen = /* @__PURE__ */ new Map();
+  for (const p of pages) {
+    const key = declaredAddress(p) ?? p.url;
+    if (!seen.has(key)) seen.set(key, p);
+  }
+  return [...seen.values()];
+}
+function hiddenFromSearch(extract) {
+  return /\bnoindex\b/i.test(extract.metas?.["robots"] ?? "");
+}
+function sameDocument(a, b) {
+  const h1s = (e) => e.headings.filter((h) => h.level === 1).map((h) => h.text.trim()).join("\n");
+  return a.extract.title === b.extract.title && a.extract.metaDescription === b.extract.metaDescription && h1s(a.extract) === h1s(b.extract);
+}
+function aliasAddress(p, read) {
+  const declared = declaredAddress(p);
+  if (!declared || declared === norm2(p.url)) return null;
+  const target = read.get(declared);
+  return target !== void 0 && sameDocument(target, p) ? declared : null;
+}
+function contentPages(pages) {
+  const read = /* @__PURE__ */ new Map();
+  for (const p of pages) {
+    const at = norm2(p.url);
+    if (at && !read.has(at)) read.set(at, p);
+  }
+  const counted = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const p of pages) {
+    if (hiddenFromSearch(p.extract)) continue;
+    const at = aliasAddress(p, read) ?? norm2(p.url) ?? p.url;
+    if (counted.has(at)) continue;
+    counted.add(at);
+    out.push(p);
+  }
+  return out;
+}
+function norm2(u, base) {
+  try {
+    const parsed = new URL(u, base);
+    const path = parsed.pathname.replace(/\/+$/, "") || "/";
+    let decoded;
+    try {
+      decoded = decodeURIComponent(path);
+    } catch {
+      decoded = path;
+    }
+    return `${parsed.hostname.replace(/^www\./i, "").toLowerCase()}${decoded}`;
+  } catch {
+    return null;
+  }
+}
+var FORM_PROVIDERS = /(formspree\.io|hsforms\.(?:net|com)|typeform\.com|jotform\.com|wufoo\.com|formstack\.com|getform\.io|basin\.com|netlify|web3forms\.com|formsubmit\.co|google\.com\/forms)/i;
+function formChecks(pages, probes = []) {
+  const WHY_TYPES = "An email field typed as plain text gives a phone the ordinary keyboard, so the visitor hunts for the @ at exactly the moment they had decided to write to you.";
+  const WHY_AUTOCOMPLETE = "With these, a phone offers to fill the whole form in one tap. Without them it does not offer at all.";
+  const WHY_METHOD = "A form that submits with GET puts everything the visitor typed into the address bar, and from there into your server logs and their browser history.";
+  const WHY_ACTION = "A form posting to an endpoint nobody owns any more looks like it worked and silently goes nowhere.";
+  const WHY_REQUIRED = "Without it the browser cannot stop a half-filled form being sent, and the visitor finds out something was missing only if somebody tells them.";
+  const watched = probes.filter((p) => !!p);
+  const jsControlled = new Set(
+    watched.filter((p) => p.emptyRefused === true).map((p) => norm2(p.url) ?? p.url)
+  );
+  const scriptRuns = (url) => jsControlled.has(norm2(url) ?? url);
+  const enquiries = pages.flatMap(
+    (p) => (p.extract.forms ?? []).filter((f) => f.kind === "enquiry").map((f) => ({ form: f, url: p.url }))
+  );
+  const measured = enquiries.filter((e) => e.form.fields !== void 0);
+  if (enquiries.length === 0) {
+    const note = "no enquiry form on the pages we read, which is reported separately";
+    return [
+      skip("form-field-types", "Fields typed for a phone keyboard", WHY_TYPES, "content", note),
+      skip(
+        "form-autocomplete",
+        "Fields a phone can fill in one tap",
+        WHY_AUTOCOMPLETE,
+        "content",
+        note
+      ),
+      skip("form-method", "A form that does not put answers in the URL", WHY_METHOD, "quick", note),
+      skip(
+        "form-action",
+        "A form that posts somewhere we recognise",
+        WHY_ACTION,
+        "structural",
+        note
+      ),
+      skip("form-required", "Fields marked as required", WHY_REQUIRED, "quick", note)
+    ];
+  }
+  if (measured.length === 0) {
+    return [
+      unknown("form-field-types", "Fields typed for a phone keyboard", WHY_TYPES, "content"),
+      unknown(
+        "form-autocomplete",
+        "Fields a phone can fill in one tap",
+        WHY_AUTOCOMPLETE,
+        "content"
+      ),
+      unknown("form-method", "A form that does not put answers in the URL", WHY_METHOD, "quick"),
+      unknown("form-action", "A form that posts somewhere we recognise", WHY_ACTION, "structural"),
+      unknown("form-required", "Fields marked as required", WHY_REQUIRED, "quick")
+    ];
+  }
+  const out = [];
+  const looksLikeEmail = (f) => /e-?mail/i.test(`${f.name ?? ""} ${f.autocomplete ?? ""}`);
+  const looksLikePhone = (f) => /\b(phone|tel|mobile)\b/i.test(`${f.name ?? ""} ${f.autocomplete ?? ""}`);
+  const mistyped = measured.flatMap(
+    ({ form, url }) => (form.fields ?? []).filter(
+      (f) => looksLikeEmail(f) && f.type !== "email" || looksLikePhone(f) && f.type !== "tel"
+    ).map((f) => `${url}: ${f.name ?? "a field"} is type="${f.type}"`)
+  );
+  out.push(
+    check(
+      "form-field-types",
+      "Fields typed for a phone keyboard",
+      WHY_TYPES,
+      "content",
+      mistyped.length === 0,
+      mistyped.length === 0 ? "your email and phone fields use the right input types" : mistyped.slice(0, 2).join(", ")
+    )
+  );
+  const withAuto = measured.filter(({ form }) => (form.fields ?? []).some((f) => f.autocomplete));
+  out.push(
+    check(
+      "form-autocomplete",
+      "Fields a phone can fill in one tap",
+      WHY_AUTOCOMPLETE,
+      "content",
+      withAuto.length === measured.length,
+      withAuto.length === measured.length ? `${countOf(measured.length, "enquiry form", "enquiry forms")} ${measured.length === 1 ? "carries" : "carry"} autocomplete` : `${measured.length - withAuto.length} of ${measured.length} carry none`
+    )
+  );
+  const getForms = measured.filter(({ form, url }) => form.method !== "post" && !scriptRuns(url));
+  const getButScripted = measured.filter(
+    ({ form, url }) => form.method !== "post" && scriptRuns(url)
+  );
+  out.push(
+    getForms.length === 0 && getButScripted.length > 0 ? skip(
+      "form-method",
+      "A form that does not put answers in the URL",
+      WHY_METHOD,
+      "quick",
+      `${getButScripted[0].url} is marked GET, but we watched its script handle the submit instead, so the attribute never decides`
+    ) : check(
+      "form-method",
+      "A form that does not put answers in the URL",
+      WHY_METHOD,
+      "quick",
+      getForms.length === 0,
+      getForms.length === 0 ? "every enquiry form posts" : `${getForms[0].url} submits with ${getForms[0].form.method.toUpperCase()}`
+    )
+  );
+  const offsite = measured.filter(({ form, url }) => {
+    const action = form.action;
+    if (!action) return false;
+    const h = norm2(action, url);
+    const own = norm2(url);
+    return h !== null && own !== null && h.split("/")[0] !== own.split("/")[0];
+  });
+  const unrecognised = offsite.filter(({ form }) => !FORM_PROVIDERS.test(form.action ?? ""));
+  out.push(
+    unrecognised.length > 0 ? unknown("form-action", "A form that posts somewhere we recognise", WHY_ACTION, "structural") : check(
+      "form-action",
+      "A form that posts somewhere we recognise",
+      WHY_ACTION,
+      "structural",
+      true,
+      offsite.length === 0 ? "your forms post to your own site" : `posts to ${offsite[0].form.action}`
+    )
+  );
+  const bare = measured.filter(({ form }) => !(form.fields ?? []).some((f) => f.required));
+  const noRequired = bare.filter(({ url }) => !scriptRuns(url));
+  const bareButChecked = bare.filter(({ url }) => scriptRuns(url));
+  out.push(
+    noRequired.length === 0 && bareButChecked.length > 0 ? skip(
+      "form-required",
+      "Fields marked as required",
+      WHY_REQUIRED,
+      "quick",
+      `${bareButChecked[0].url} marks none, and we watched it refuse an empty submission anyway \u2014 its script does the checking`
+    ) : check(
+      "form-required",
+      "Fields marked as required",
+      WHY_REQUIRED,
+      "quick",
+      noRequired.length === 0,
+      noRequired.length === 0 ? `every enquiry form marks at least one field required` : `${noRequired[0].url} marks none`
+    )
+  );
+  return out;
+}
+function browserChecks(pages) {
+  const WHY_CONSOLE = "A script that throws stops running, so whatever it was doing \u2014 a menu, a form, a gallery \u2014 silently stops working for every visitor from that point on.";
+  const WHY_REQUESTS = "A file the page asks for and does not get is a missing image, an unstyled section or a feature that does nothing.";
+  const WHY_OVERFLOW = "Something on the page is wider than a phone screen, so the whole page scrolls sideways. Most of your visitors are on a phone, and this is the first thing they will notice.";
+  const WHY_TINY = "Text under twelve pixels is uncomfortable on a desktop and unreadable on a phone without pinching.";
+  const WHY_HEAVY = "These images are downloaded at several times the size they are shown at, so every visitor pays for pixels they never see.";
+  const withVitals = pages.filter((p) => p.vitals != null);
+  if (withVitals.length === 0) {
+    return [
+      unknown("console-errors", "Pages without JavaScript errors", WHY_CONSOLE, "structural"),
+      unknown("failed-requests", "Files the page asks for and gets", WHY_REQUESTS, "quick"),
+      unknown("mobile-overflow", "Pages that fit a phone screen", WHY_OVERFLOW, "structural"),
+      unknown("tiny-text", "Text big enough to read", WHY_TINY, "content"),
+      unknown("oversized-images", "Images sized for where they are shown", WHY_HEAVY, "quick")
+    ];
+  }
+  const out = [];
+  const erroring = withVitals.filter((p) => p.vitals.consoleErrors.length > 0);
+  out.push(
+    check(
+      "console-errors",
+      "Pages without JavaScript errors",
+      WHY_CONSOLE,
+      "structural",
+      erroring.length === 0,
+      erroring.length === 0 ? `none on the ${withVitals.length} pages we opened` : `${erroring[0].url}: ${erroring[0].vitals.consoleErrors[0]}`
+    )
+  );
+  const broken = withVitals.flatMap(
+    (p) => p.vitals.failedRequests.filter((r) => r.firstParty).map((r) => ({ ...r, page: p.url }))
+  );
+  out.push(
+    check(
+      "failed-requests",
+      "Files the page asks for and gets",
+      WHY_REQUESTS,
+      "quick",
+      broken.length === 0,
+      broken.length === 0 ? "every file your pages asked for came back" : `${broken.length}: ${broken.slice(0, 2).map((b) => `${b.url}${b.status ? ` (${b.status})` : ""}`).join(", ")}`
+    )
+  );
+  const measuredOverflow = withVitals.filter((p) => p.vitals.overflowAt375 !== null);
+  if (measuredOverflow.length === 0) {
+    out.push(
+      unknown("mobile-overflow", "Pages that fit a phone screen", WHY_OVERFLOW, "structural")
+    );
+  } else {
+    const OVERFLOW_TOLERANCE = 4;
+    const wide = measuredOverflow.filter((p) => p.vitals.overflowAt375 > OVERFLOW_TOLERANCE);
+    out.push(
+      check(
+        "mobile-overflow",
+        "Pages that fit a phone screen",
+        WHY_OVERFLOW,
+        "structural",
+        wide.length === 0,
+        wide.length === 0 ? `all ${measuredOverflow.length} fit a 375px screen` : `${wide[0].url} is ${wide[0].vitals.overflowAt375}px wider than the screen`
+      )
+    );
+  }
+  const measuredText = withVitals.filter((p) => p.vitals.tinyText !== null);
+  if (measuredText.length === 0) {
+    out.push(unknown("tiny-text", "Text big enough to read", WHY_TINY, "content"));
+  } else {
+    const tiny = measuredText.filter((p) => p.vitals.tinyText.count > 0);
+    out.push(
+      check(
+        "tiny-text",
+        "Text big enough to read",
+        WHY_TINY,
+        "content",
+        tiny.length === 0,
+        tiny.length === 0 ? "no text under 12px on the pages we opened" : `${tiny[0].url}: ${tiny[0].vitals.tinyText.count} ${tiny[0].vitals.tinyText.count === 1 ? "passage" : "passages"}, e.g. \u201C${tiny[0].vitals.tinyText.sample}\u201D`
+      )
+    );
+  }
+  const heavy = withVitals.flatMap((p) => p.vitals.oversizedImages);
+  out.push(
+    check(
+      "oversized-images",
+      "Images sized for where they are shown",
+      WHY_HEAVY,
+      "quick",
+      heavy.length === 0,
+      heavy.length === 0 ? "every image is close to the size it is drawn at" : `${heavy[0].src} is ${heavy[0].naturalWidth}px wide and drawn at ${heavy[0].renderedWidth}px`
+    )
+  );
+  return out;
+}
+function clipRecord(record, max = 90) {
+  const one = record.replace(/\s+/g, " ").trim();
+  return one.length <= max ? one : `${one.slice(0, max - 1).trimEnd()}\u2026`;
+}
+function dnsChecks(dns) {
+  const WHY_SPF = "Without it, anyone can send email that appears to come from your address, and your own mail is more likely to be filed as spam.";
+  const WHY_DMARC = "SPF says who may send as you. DMARC is what tells the receiving mail server to act on that, and to report attempts to you. Without it the first one is advisory.";
+  const WHY_MX = "There is no mail server listed for your domain, so email sent to any address at it is rejected.";
+  const WHY_CONTACT_MX = "The address you publish is on a domain with no mail server, so anything sent to it bounces.";
+  const WHY_EXPIRY = "Registration dates are public; whether it renews automatically is not, so this is one to confirm at your registrar rather than a fault we can see. When a registration does lapse the site and the email stop together, usually on a weekend, and getting them back is neither quick nor certain.";
+  if (!dns || !dns.measured) {
+    return [
+      unknown("dns-spf", "An SPF record, so your email is trusted", WHY_SPF, "quick"),
+      unknown("dns-dmarc", "A DMARC record, so SPF is enforced", WHY_DMARC, "quick"),
+      unknown("dns-mx", "A mail server for your domain", WHY_MX, "structural"),
+      unknown("dns-contact-mx", "An email address that can receive mail", WHY_CONTACT_MX, "quick"),
+      unknown("domain-expiry", "A domain registration with room to spare", WHY_EXPIRY, "quick")
+    ];
+  }
+  const out = [];
+  out.push(
+    dns.spf === void 0 ? unknown("dns-spf", "An SPF record, so your email is trusted", WHY_SPF, "quick") : check(
+      "dns-spf",
+      "An SPF record, so your email is trusted",
+      WHY_SPF,
+      "quick",
+      dns.spf !== null,
+      (dns.spf ? clipRecord(dns.spf) : null) ?? `no v=spf1 record on ${dns.domain}`
+    )
+  );
+  out.push(
+    dns.dmarc === void 0 ? unknown("dns-dmarc", "A DMARC record, so SPF is enforced", WHY_DMARC, "quick") : check(
+      "dns-dmarc",
+      "A DMARC record, so SPF is enforced",
+      WHY_DMARC,
+      "quick",
+      dns.dmarc !== null,
+      (dns.dmarc ? clipRecord(dns.dmarc) : null) ?? `no record at _dmarc.${dns.domain}`
+    )
+  );
+  out.push(
+    dns.mx === void 0 ? unknown("dns-mx", "A mail server for your domain", WHY_MX, "structural") : check(
+      "dns-mx",
+      "A mail server for your domain",
+      WHY_MX,
+      "structural",
+      dns.mx.length > 0,
+      dns.mx.length > 0 ? dns.mx.slice(0, 2).join(", ") : `no MX record on ${dns.domain}`
+    )
+  );
+  out.push(
+    dns.contactMx === void 0 ? unknown("dns-contact-mx", "An email address that can receive mail", WHY_CONTACT_MX, "quick") : dns.contactMx === null ? skip(
+      "dns-contact-mx",
+      "An email address that can receive mail",
+      WHY_CONTACT_MX,
+      "quick",
+      "the addresses you publish are on your own domain, which is checked above"
+    ) : check(
+      "dns-contact-mx",
+      "An email address that can receive mail",
+      WHY_CONTACT_MX,
+      "quick",
+      dns.contactMx.hasMx,
+      `${dns.contactMx.domain}${dns.contactMx.hasMx ? " accepts mail" : " has no mail server"}`
+    )
+  );
+  const DAYS = 30;
+  if (dns.expiresAt === void 0) {
+    out.push(
+      unknown("domain-expiry", "A domain registration with room to spare", WHY_EXPIRY, "quick")
+    );
+  } else {
+    const on = dns.expiresAt.slice(0, 10);
+    const days = Math.round((Date.parse(dns.expiresAt) - Date.now()) / 864e5);
+    const evidence = days < 0 ? `the registration lapsed on ${on}` : days > DAYS ? `registered through ${on}` : `registered through ${on} \u2014 ${days === 1 ? "1 day" : `${days} days`} away`;
+    out.push(
+      check(
+        "domain-expiry",
+        "A domain registration with room to spare",
+        WHY_EXPIRY,
+        "quick",
+        days > DAYS,
+        evidence
+      )
+    );
+  }
+  return out;
+}
+function httpChecks(http) {
+  const WHY_FAVICON = "The icon in the browser tab and the bookmark bar. When the file is missing the tab shows a blank sheet, which is the difference between a site that looks maintained and one that does not.";
+  const WHY_UPGRADE = "Somebody typing your address without https, or following an old link, should land on the secure version in one step. Every extra redirect is delay on the first impression, and a chain that ends on http means the page is served in the clear.";
+  const WHY_STABLE = "Two requests seconds apart got different answers, which is what an overloaded or half-deployed server looks like from outside. Some visitors are seeing the bad one.";
+  const WHY_SLASH = "When /about and /about/ both answer with the same page and neither says which is real, search engines index both and split the credit between them.";
+  const WHY_INDEX = "Your homepage answers at two addresses. Links, shares and search results scatter across both instead of accumulating on one.";
+  const WHY_CASE = "The same page answers at two spellings, so the same content competes with itself in search results.";
+  const WHY_SITEMAP_LIVE = "A sitemap is a list you hand to search engines saying 'these pages exist'. Entries that no longer answer waste the crawl budget you were trying to direct.";
+  const WHY_EXTERNAL = "A link on your site that leads nowhere is a dead end for the visitor and a small mark against the page for a search engine.";
+  const WHY_OG_SERVED = "This is the picture that appears when your page is shared in a message, on LinkedIn, or in a Slack channel. When the file does not load, the share renders as a bare grey box.";
+  const WHY_OG_SIZE = `A share image under ${MIN_OG_IMAGE_EDGE} pixels on either edge is either cropped to nothing or dropped entirely by the platform showing it.`;
+  const WHY_LOGO = "A logo that does not load leaves a broken-image icon at the top of every page, and it is the first thing on the page.";
+  const WHY_CHAINS = "A link that redirects more than once makes every visitor wait through each hop, and search engines pass less credit along a chain than a direct link.";
+  const ALL = [
+    ["favicon-served", "A favicon that actually loads", WHY_FAVICON, "quick"],
+    ["https-upgrade", "http:// reaching https:// without a detour", WHY_UPGRADE, "structural"],
+    ["home-stable", "A homepage that answers the same way twice", WHY_STABLE, "structural"],
+    ["trailing-slash", "One address per page, slash or no slash", WHY_SLASH, "structural"],
+    ["index-alias", "A homepage that lives at one address", WHY_INDEX, "structural"],
+    ["case-alias", "Paths that do not answer to two spellings", WHY_CASE, "structural"],
+    ["sitemap-urls-live", "A sitemap whose pages still exist", WHY_SITEMAP_LIVE, "quick"],
+    ["external-links-live", "Outbound links that still work", WHY_EXTERNAL, "quick"],
+    ["og-image-served", "A share image that loads", WHY_OG_SERVED, "quick"],
+    ["og-image-size", "A share image big enough to render", WHY_OG_SIZE, "quick"],
+    ["logo-served", "A logo that loads", WHY_LOGO, "quick"],
+    ["redirect-chains", "Internal links that go straight there", WHY_CHAINS, "quick"]
+  ];
+  const meta = new Map(ALL.map(([key, label, why, scope]) => [key, { label, why, scope }]));
+  const unmeasuredAll = () => ALL.map(([key, label, why, scope]) => unknown(key, label, why, scope));
+  if (!http || !http.measured) return unmeasuredAll();
+  const out = [];
+  const add = (key, value, verdict) => {
+    const m = meta.get(key);
+    if (value === void 0) return void out.push(unknown(key, m.label, m.why, m.scope));
+    const v = verdict();
+    if (v === void 0) return void out.push(unknown(key, m.label, m.why, m.scope));
+    if (v === null) return void out.push(skip(key, m.label, m.why, m.scope, notApplicable(key)));
+    out.push(check(key, m.label, m.why, m.scope, v.ok, v.evidence));
+  };
+  const notApplicable = (key) => key === "index-alias" ? "/index.html does not answer, which is the behaviour we were hoping for" : key === "case-alias" ? "a differently-cased path 404s, which is the behaviour we were hoping for" : key === "og-image-served" || key === "og-image-size" ? "the homepage declares no share image, which is covered above" : key === "sitemap-urls-live" ? "there is no sitemap to check, which is covered above" : key === "external-links-live" ? "this site does not link out to anywhere else" : "there was nothing of this kind to check";
+  const fromVerdict = (v, ok, bad) => v === "unverified" ? void 0 : { ok: v === "ok", evidence: v === "ok" ? ok : bad };
+  add("favicon-served", http.favicon, () => {
+    const f = http.favicon;
+    return fromVerdict(
+      f.verdict,
+      f.declared ? "the declared icon is served" : "/favicon.ico is served",
+      f.declared ? `the icon at ${f.url} does not load` : "no icon at /favicon.ico"
+    );
+  });
+  add("https-upgrade", http.httpUpgrade, () => {
+    const u = http.httpUpgrade;
+    if (!u.https) return { ok: false, evidence: "http:// does not end up on https://" };
+    const hops = u.hops;
+    if (hops === null) return { ok: true, evidence: "http:// arrives on https://" };
+    return {
+      ok: hops <= 2,
+      evidence: hops <= 2 ? `http:// arrives on https:// in ${hops === 1 ? "one hop" : `${hops} hops`}` : `http:// takes ${hops} redirects to reach https://`
+    };
+  });
+  add("home-stable", http.homeSamples, () => {
+    const [a, b] = http.homeSamples;
+    if (a === null || b === null) return null;
+    if (a === b)
+      return a >= 200 && a < 400 ? { ok: true, evidence: `two requests, both ${a}` } : null;
+    return { ok: false, evidence: `two requests seconds apart answered ${a} and ${b}` };
+  });
+  add("trailing-slash", http.trailingSlash, () => {
+    const t = http.trailingSlash;
+    return { ok: t.settled, evidence: `${t.path} \u2014 ${t.detail}` };
+  });
+  add("index-alias", http.indexAlias, () => {
+    const i = http.indexAlias;
+    return i === null ? null : { ok: !i.duplicate, evidence: `/index.html \u2014 ${i.detail}` };
+  });
+  add("case-alias", http.caseAlias, () => {
+    const c = http.caseAlias;
+    return c === null ? null : { ok: !c.duplicate, evidence: `${c.path} \u2014 ${c.detail}` };
+  });
+  add("sitemap-urls-live", http.sitemapUrls, () => {
+    const s = http.sitemapUrls;
+    if (s === null) return null;
+    const { checked, total, broken } = s;
+    return broken.length === 0 ? {
+      ok: true,
+      evidence: checked >= total ? `all ${total} answer` : `we sampled ${checked} of ${total}; all of them answer`
+    } : {
+      ok: false,
+      evidence: `${broken.length} of the ${checked} we sampled are gone \u2014 ${broken[0].url}`
+    };
+  });
+  add("external-links-live", http.externalLinks, () => {
+    const e = http.externalLinks;
+    if (e === null) return null;
+    const { checked, total, broken } = e;
+    return broken.length === 0 ? {
+      ok: true,
+      evidence: checked >= total ? `${countOf(total, "outbound link", "outbound links")} ${total === 1 ? "answers" : "answer"}` : `we sampled ${checked} of ${total} outbound links; all of them answer`
+    } : {
+      ok: false,
+      evidence: `${broken.length} of the ${checked} we sampled are dead \u2014 ${broken[0].url}`
+    };
+  });
+  add("og-image-served", http.ogImage, () => {
+    const o = http.ogImage;
+    if (o === null) return null;
+    return fromVerdict(
+      o.verdict,
+      "the share image loads",
+      `the share image does not load \u2014 ${o.url}`
+    );
+  });
+  add("og-image-size", http.ogImage, () => {
+    const o = http.ogImage;
+    if (o === null) return null;
+    if (o.width === null || o.height === null) return null;
+    const small = o.width < MIN_OG_IMAGE_EDGE || o.height < MIN_OG_IMAGE_EDGE;
+    return { ok: !small, evidence: `${o.width}\xD7${o.height}` };
+  });
+  add("logo-served", http.logo, () => {
+    const l = http.logo;
+    if (l === null) return null;
+    return fromVerdict(l.verdict, `${l.how} loads`, `${l.how} does not load \u2014 ${l.url}`);
+  });
+  add("redirect-chains", http.redirectChains, () => {
+    const r = http.redirectChains;
+    return r.chained.length === 0 ? { ok: true, evidence: `${r.checked} internal links, none redirecting twice` } : {
+      ok: false,
+      evidence: `${r.chained.length} of ${r.checked} take ${r.chained[0].hops} hops \u2014 ${r.chained[0].url}`
+    };
+  });
+  return out;
+}
+function formInteractionChecks(probes) {
+  const WHY_EMPTY = "Somebody who taps send too early should be told what is missing. A form that submits anyway puts a blank enquiry in your inbox and tells them it worked, so they never follow up and you have nothing to follow up on.";
+  const WHY_EMAIL = "A mistyped address is the one mistake that costs you the whole enquiry: the message arrives, and there is no way to answer it. Catching it while the visitor is still on the page is the only chance to fix it.";
+  const probe = probes.find((p) => p) ?? null;
+  const neverTried = probes.every((p) => p === void 0);
+  if (neverTried) {
+    const NOTE = "we did not try a form on this run";
+    return [
+      unknown(
+        "form-rejects-empty",
+        "A form that catches an empty submission",
+        WHY_EMPTY,
+        "quick",
+        NOTE
+      ),
+      unknown(
+        "form-rejects-bad-email",
+        "A form that catches a mistyped email",
+        WHY_EMAIL,
+        "quick",
+        NOTE
+      )
+    ];
+  }
+  if (!probe) {
+    return [
+      skip(
+        "form-rejects-empty",
+        "A form that catches an empty submission",
+        WHY_EMPTY,
+        "quick",
+        "we found no enquiry form to try"
+      ),
+      skip(
+        "form-rejects-bad-email",
+        "A form that catches a mistyped email",
+        WHY_EMAIL,
+        "quick",
+        "we found no enquiry form to try"
+      )
+    ];
+  }
+  const out = [
+    probe.emptyRefused === void 0 ? unknown("form-rejects-empty", "A form that catches an empty submission", WHY_EMPTY, "quick") : check(
+      "form-rejects-empty",
+      "A form that catches an empty submission",
+      WHY_EMPTY,
+      "quick",
+      probe.emptyRefused,
+      probe.emptyHow ?? ""
+    )
+  ];
+  out.push(
+    probe.invalidEmailRefused === null ? skip(
+      "form-rejects-bad-email",
+      "A form that catches a mistyped email",
+      WHY_EMAIL,
+      "quick",
+      "this form does not ask for an email address"
+    ) : probe.invalidEmailRefused === void 0 ? unknown(
+      "form-rejects-bad-email",
+      "A form that catches a mistyped email",
+      WHY_EMAIL,
+      "quick"
+    ) : check(
+      "form-rejects-bad-email",
+      "A form that catches a mistyped email",
+      WHY_EMAIL,
+      "quick",
+      probe.invalidEmailRefused,
+      probe.invalidEmailHow ?? ""
+    )
+  );
+  return out;
+}
+var TIER0_CHECK_KEYS = [
+  "dead-links",
+  "staging-links",
+  "insecure-links",
+  "link-text",
+  "tel-dialable",
+  "social-placeholders",
+  "nav-consistency",
+  "lorem",
+  "placeholder-copy",
+  "template-leakage",
+  "mojibake",
+  "under-construction",
+  "name-in-title",
+  "h1-present",
+  "h1-one-headline",
+  "h1-not-name",
+  "h1-distinct",
+  "schema-org-complete",
+  "schema-local-complete",
+  "schema-url-matches",
+  "schema-phone-matches",
+  "schema-self-review",
+  ...SECURITY_HEADER_CHECKS.map((h) => `header-${h.header}`),
+  "header-version-leak",
+  "header-compression",
+  "header-hsts-age",
+  "robots-not-blocking",
+  "robots-names-sitemap",
+  "sitemap-coverage",
+  "llms-txt",
+  "analytics"
+];
+function runSiteChecks(crawl, checks, businessName = null, dns = null, http = null) {
+  const set = usablePages(crawl.pages);
+  const pages = set.pages.map((p) => ({
+    url: p.page.url,
+    extract: p.extract,
+    // Carried through so the browser checks can read what the render pass
+    // observed without a second traversal of the capture list.
+    vitals: p.page.vitals
+  }));
+  const read = /* @__PURE__ */ new Map();
+  for (const p of pages) {
+    const at = norm2(p.url);
+    if (at && !read.has(at)) read.set(at, p);
+  }
+  const linked = /* @__PURE__ */ new Set();
+  for (const { url, extract } of pages) {
+    for (const a of extract.anchors ?? []) {
+      const abs = resolveNavigable(a.href, url);
+      if (!abs) continue;
+      try {
+        if (new URL(abs).origin !== crawl.origin) continue;
+      } catch {
+        continue;
+      }
+      const at = norm2(abs);
+      if (!at) continue;
+      const target = read.get(at);
+      if (target && hiddenFromSearch(target.extract)) continue;
+      linked.add(target ? aliasAddress(target, read) ?? at : at);
+    }
+  }
+  const phones = (checks?.consistency?.phones ?? []).map((p) => p.normalized);
+  const headersMeasured = Object.keys(crawl.homeHeaders ?? {}).length > 0;
+  return [
+    ...anchorChecks(pages, crawl.origin),
+    ...textChecks(pages, businessName),
+    ...headingChecks(pages, businessName),
+    ...schemaChecks(pages, crawl.origin, phones),
+    ...metaChecks(pages),
+    ...linkChecks(
+      pages,
+      crawl.origin,
+      http?.favicon !== void 0 && http.favicon.verdict !== "unverified"
+    ),
+    ...formChecks(
+      pages,
+      crawl.pages.map((p) => p.formProbe)
+    ),
+    ...browserChecks(pages),
+    ...dnsChecks(dns),
+    ...httpChecks(http),
+    ...formInteractionChecks(crawl.pages.map((p) => p.formProbe)),
+    ...headerChecks(crawl.homeHeaders ?? {}, headersMeasured),
+    ...sidecarChecks(crawl, linked),
+    analyticsCheck(pages)
+  ];
+}
+
+export {
+  usablePages,
+  summarizeAccessibility,
+  AI_AGENTS,
+  CLASSICAL_AGENTS,
+  USER_AGENT,
+  sleep,
+  pacedEach,
+  crawlSite,
+  readCapped,
+  defaultCrawlDeps,
+  canonicalizeUrl,
+  resolveNavigable,
+  buildJourney,
+  LAYER_ORDER,
+  LAYER_LABELS,
+  readStack,
+  probeHttp,
+  defaultHttpProbeDeps,
+  tally,
+  runSiteChecks
+};
+//# sourceMappingURL=chunk-VELWHWOW.js.map