@reddoorla/maintenance 0.93.1 → 0.94.1

package/dist/prospect/types.d.ts

@@ -582,6 +582,424 @@ type GoalFit = {
 };
 declare function orderRequirements(reqs: GoalRequirement[]): GoalRequirement[];
 
+/**
+ * What they are running, named back to them.
+ *
+ * This is not a check and it must never try to be. Nothing here passes or
+ * fails, nothing here enters the denominator, and no line of it belongs in the
+ * fix list. It exists to answer the reader's first silent question — do these
+ * people know what they are talking about — before a single finding is made.
+ *
+ * "You're on WordPress running the Astra theme with Elementor, your forms are
+ * Gravity Forms, your DNS is at GoDaddy and your mail is Google Workspace" is a
+ * sentence nobody sending a cold audit can write, and it costs us almost
+ * nothing because every receipt for it is already in the crawl.
+ *
+ * The discipline is the same as everywhere else in this codebase, and it is the
+ * whole reason `evidence` is non-optional on `StackItem`: every line is an
+ * OBSERVATION WITH A RECEIPT — the exact URL or header we read it off — never
+ * an inference we cannot show. A reader who disputes a line can go and look at
+ * the thing we looked at.
+ *
+ * The failure this module must not commit is the mirror of the one the checks
+ * must not commit. There, our missing measurement must not become their defect.
+ * Here, our missing measurement must not become "they don't have one": a
+ * WordPress site behind a caching plugin that rewrites asset paths is
+ * completely invisible to this, and so is any site whose markup we never read.
+ * `measured` says whether we were in a position to see anything at all, and the
+ * report must be able to say "we could not tell" rather than implying absence.
+ */
+type StackLayer = "cms" | "theme" | "plugin" | "page-builder" | "framework" | "hosting" | "ecommerce" | "forms" | "analytics" | "fonts";
+/** Display order in the readout. Broadest thing first — a reader wants "you're
+ *  on WordPress" before "you load Hotjar". */
+declare const LAYER_ORDER: StackLayer[];
+declare const LAYER_LABELS: Record<StackLayer, string>;
+type StackItem = {
+    layer: StackLayer;
+    /** What we are naming, spelled the way its own vendor spells it. */
+    name: string;
+    /**
+     * The receipt — the URL or response header we read it off, truncated only for
+     * length. Never optional and never synthesised: a line without a receipt is
+     * an assertion, and this module does not make assertions.
+     */
+    evidence: string;
+};
+type StackReadout = {
+    /**
+     * Were we in a position to see anything?
+     *
+     * False when no page we read carried a `scriptSrcs` array — which is every
+     * report stored before that field existed, and any run whose pages all failed
+     * to fetch. An empty `items` with `measured: false` means "we could not
+     * tell"; with `measured: true` it means "we read the markup and recognised
+     * nothing in it", which is a real and unremarkable answer for a hand-built
+     * site.
+     */
+    measured: boolean;
+    items: StackItem[];
+    /** How many pages' markup we actually read. The honest denominator for any
+     *  sentence that starts "we did not see". */
+    pagesExamined: number;
+    /** Did we also read response headers? They carry the hosting and CDN half,
+     *  and a run without them can say nothing about either. */
+    headersExamined: boolean;
+};
+
+/**
+ * What the domain itself says, as opposed to what the website says.
+ *
+ * Five questions, one lookup each, and none of them touches the prospect's web
+ * server at all — so this is the cheapest section of the whole audit and the
+ * one nobody else sends. "Anyone can send email as you" and "your domain
+ * renews in 41 days" are findings a reader acts on the same afternoon, and
+ * neither is visible from any amount of reading their HTML.
+ *
+ * `basics.ts` deliberately excludes TLS certificate expiry, on the grounds that
+ * a successful https fetch already proved the certificate valid to a real
+ * client. DOMAIN expiry is a different thing entirely — nothing about today's
+ * successful request tells you the registration lapses in six weeks — which is
+ * why it belongs here and that one does not.
+ *
+ * EVERY FAILURE MODE HERE IS OURS. A DNS timeout, a resolver that refuses, an
+ * RDAP service that is down, a TLD that publishes no expiry: each is a gap in
+ * our measurement and each must come back `unmeasured`. The one thing this
+ * module must never do is report "no SPF record" because the lookup failed —
+ * that is our network outage printed as their security hole.
+ */
+type DnsFindings = {
+    /** False when the domain itself could not be determined — nothing below is
+     *  then attributable to the prospect. */
+    measured: boolean;
+    domain: string | null;
+    /** The apex TXT record starting `v=spf1`, or null when there is none.
+     *  `undefined` means the lookup did not answer — a different claim. */
+    spf: string | null | undefined;
+    /** The `_dmarc` TXT record starting `v=DMARC1`. Same three states. */
+    dmarc: string | null | undefined;
+    /** Mail exchangers for the apex, lowest preference first. */
+    mx: string[] | undefined;
+    /** Whether the domain in a published `mailto:` can receive mail. Null when
+     *  the site publishes no email address to check. */
+    contactMx: {
+        domain: string;
+        hasMx: boolean;
+    } | null | undefined;
+    /** ISO date the registration lapses, from RDAP. Undefined when RDAP did not
+     *  answer or the registry publishes no expiry, which many ccTLDs do not. */
+    expiresAt: string | undefined;
+};
+
+/** A URL that answered, that provably did not, or that we could not read.
+ *  The third is not a failure and never enters a denominator. */
+type ProbeVerdict = "ok" | "broken" | "unverified";
+type UrlProbe = {
+    url: string;
+    status: number | null;
+    verdict: ProbeVerdict;
+};
+type HttpFindings = {
+    /** False when we had no origin to probe — nothing below is then about them. */
+    measured: boolean;
+    /** Requests this stage made, reported so the cost is visible. */
+    requests: number;
+    /** The icon a browser tab actually gets. `url` is what the page declared, or
+     *  the conventional `/favicon.ico` when it declared nothing. */
+    favicon: {
+        url: string;
+        declared: boolean;
+        verdict: ProbeVerdict;
+    } | undefined;
+    /** What `http://` does. `hops` counts redirects; `https` is where it landed. */
+    httpUpgrade: {
+        hops: number | null;
+        https: boolean;
+    } | undefined;
+    /** Two homepage samples. Equal statuses mean nothing to report; different
+     *  ones are the only evidence that would justify the word "intermittent". */
+    homeSamples: [number | null, number | null] | undefined;
+    /** A path fetched with and without its trailing slash. `settled` is true when
+     *  the two agree on one address — either by redirect or by canonical. */
+    trailingSlash: {
+        path: string;
+        settled: boolean;
+        detail: string;
+    } | undefined;
+    /** `/index.html`, and whether it duplicates the homepage rather than
+     *  redirecting or declaring the homepage canonical. Null when it 404s, which
+     *  is the correct behaviour and not a finding. */
+    indexAlias: {
+        duplicate: boolean;
+        detail: string;
+    } | null | undefined;
+    /** The same path in a different case. Null when it 404s — also correct. */
+    caseAlias: {
+        path: string;
+        duplicate: boolean;
+        detail: string;
+    } | null | undefined;
+    /** Sampled sitemap URLs. Null when there is no sitemap to sample. */
+    sitemapUrls: {
+        checked: number;
+        total: number;
+        broken: UrlProbe[];
+    } | null | undefined;
+    /** Outbound links to other sites. Null when the site links out nowhere. */
+    externalLinks: {
+        checked: number;
+        total: number;
+        broken: UrlProbe[];
+    } | null | undefined;
+    /** The image that appears when the site is shared. Null when none is
+     *  declared — Tier 1 owns that, and saying it twice reads as two problems. */
+    ogImage: {
+        url: string;
+        verdict: ProbeVerdict;
+        width: number | null;
+        height: number | null;
+    } | null | undefined;
+    /** The header logo, and the rule we used to find it, so a reader can tell
+     *  whether we found the right image. */
+    logo: {
+        url: string;
+        how: string;
+        verdict: ProbeVerdict;
+    } | null | undefined;
+    /** Internal links reached through more than one redirect. */
+    redirectChains: {
+        checked: number;
+        chained: {
+            url: string;
+            hops: number;
+        }[];
+    } | undefined;
+};
+
+type FormProbe = {
+    /** The page we probed, so a finding has an address. */
+    url: string;
+    /**
+     * Whether an empty submit was refused.
+     *
+     * `undefined` means we could not tell — the form sits in a cross-origin
+     * iframe, or the click threw, or the browser pass never ran. It is never a
+     * failure: a form we could not reach is our gap, not their defect.
+     */
+    emptyRefused: boolean | undefined;
+    /** How it refused, in words a report can print. */
+    emptyHow: string | null;
+    /** Same, for an address that is not an address. Null when the form asks for
+     *  no email at all, which is a form we have nothing to say about here. */
+    invalidEmailRefused: boolean | null | undefined;
+    invalidEmailHow: string | null;
+    /** Requests the interceptor stopped. The receipt for "we sent nothing". */
+    blocked: number;
+};
+
+/**
+ * What axe-core found, in the browser the crawl already opened.
+ *
+ * WHAT THIS IS AND IS NOT NEW. The Lighthouse stage we already run IS axe — a
+ * subset of roughly forty-five rules, reported as one number between 0 and 100.
+ * Running it ourselves does not discover a different site; it does three things
+ * that number cannot:
+ *
+ *   - turns "accessibility: 82" into named rules with named fixes, each with an
+ *     element to go and look at;
+ *   - adds the rules Lighthouse omits — every `best-practice` landmark and
+ *     heading rule, which is most of what is structurally wrong with most
+ *     sites, and which a wcag-tags-only scan cannot see at all;
+ *   - absorbs several checks we would otherwise have written worse by hand
+ *     (link names, tap-target size, viewport zoom, `lang`, form labels).
+ *
+ * THE TAG SET IS THE WHOLE POINT. Our own fleet audit scans `wcag2a`,
+ * `wcag2aa`, `wcag21a`, `wcag21aa`, `wcag22aa` and nothing else, and every
+ * landmark and heading-order rule in axe is tagged `best-practice` — so a green
+ * run there proves nothing about structure. This runs the DEFAULT rule set,
+ * which is all of them.
+ *
+ * WHAT IT MAY NOT SAY. Never that a site "is inaccessible", and never a score.
+ * axe finds what a machine can find, which is a minority of what a disabled
+ * person actually encounters; a page can pass every rule here and be unusable.
+ * The report says: we ran N rules, these M produced findings, here is the
+ * element and the rule's own explanation. That is a fact with a receipt, and it
+ * is all this instrument earns.
+ */
+type AxeImpact = "minor" | "moderate" | "serious" | "critical";
+/** One rule that produced findings on one page. Sized for persistence: the
+ *  node COUNT plus a single example, never every matching element. */
+type AxeViolation = {
+    /** axe's rule id — `color-contrast`, `landmark-one-main`. Stable, and the
+     *  thing to search for. */
+    id: string;
+    impact: AxeImpact | null;
+    /** axe's own one-line explanation. Quoted rather than paraphrased: it is
+     *  written by people who know the rule better than we do. */
+    help: string;
+    helpUrl: string;
+    /** Elements on this page the rule matched. */
+    nodes: number;
+    /** One of them, truncated — so a reader can go and find it. */
+    sample: string | null;
+};
+type AxePageResult = {
+    violations: AxeViolation[];
+    /**
+     * Rules that found something to judge on this page and judged it fine.
+     *
+     * NOT "the number of rules axe has". Measured on our own report page, the
+     * default set is 90 rules, of which 42 passed, 47 were INAPPLICABLE — the
+     * page contains no table, no video, no iframe, so those rules had nothing to
+     * look at — and one was incomplete. Printing 90 as though we had checked 90
+     * things would be a number inflated on our own behalf, which is why
+     * `inapplicable` is carried rather than quietly folded into this one.
+     */
+    passes: number;
+    /** Rules axe could not decide — genuinely "we do not know", reported as such
+     *  rather than folded into either column. */
+    incomplete: number;
+    /** WHICH rules those were. A count alone tells a reader three things need a
+     *  human without saying what to look at, which is a worry rather than a job.
+     *  Optional: absent on any result stored before it was captured. */
+    incompleteIds?: string[];
+    /** Rules with nothing on the page to check. Carried so the report can say
+     *  "43 of axe's 90 rules had something to check here" and be exactly right. */
+    inapplicable: number;
+};
+type AccessibilityResult = {
+    /**
+     * Did the rules run anywhere?
+     *
+     * False when no page carried a result — every report stored before this
+     * existed, every run whose browser never started, and every test that stubs
+     * the renderer. An empty `violations` with `measured: false` means "we did
+     * not look"; with `measured: true` it means the rules ran and found nothing,
+     * which is a real and excellent answer.
+     */
+    measured: boolean;
+    pagesExamined: number;
+    /**
+     * Rules that had something to check and passed — the number the report may
+     * print as "we checked N things", and no larger one.
+     *
+     * The MAXIMUM across pages, never the sum. The same rule set runs on every
+     * page, so summing reports "210 checks" for 42 rules over five pages. Max is
+     * a deliberate under-count where pages differ: it can only understate what we
+     * looked at, and understating our own work is the safe direction.
+     */
+    rulesPassed: number;
+    rulesIncomplete: number;
+    /** The undecided rules by name, so the disclosure can say what to look at
+     *  instead of only how many. Empty when none, absent-safe for old reports. */
+    incompleteIds: string[];
+    /** Rules that found nothing on these pages to apply to. Not a pass and not a
+     *  failure — the page simply has no table, video or iframe for them. */
+    rulesInapplicable: number;
+    /** Rules that produced findings, worst impact first, each naming the pages it
+     *  fired on. Capped — see `violationsTotal`. */
+    violations: (AxeViolation & {
+        pages: string[];
+    })[];
+    /** True number of distinct rules with findings, before the cap. A truncated
+     *  list that looks complete is the quiet lie this codebase is built to avoid. */
+    violationsTotal: number;
+};
+/**
+ * What the browser itself reported while the page was open.
+ *
+ * Collected in the SAME pass as the rendered DOM and the axe run — listeners
+ * attached before navigation, one viewport resize after it. A resize reflows
+ * the page the browser has already loaded; it costs no request and puts nothing
+ * extra on the prospect's server, which is why the mobile-overflow measurement
+ * is affordable at all.
+ */
+type PageVitals = {
+    /** Uncaught exceptions and `console.error` calls, capped and deduped. The
+     *  most demonstrable "your site is broken" evidence there is. */
+    consoleErrors: string[];
+    /**
+     * Requests the page made that failed or came back 4xx/5xx.
+     *
+     * `firstParty` decides whether it is a finding at all. A blocked third-party
+     * analytics beacon is our network or an ad blocker; a 404 on the site's own
+     * stylesheet is theirs, and only the second belongs in a report.
+     */
+    failedRequests: {
+        url: string;
+        status: number | null;
+        firstParty: boolean;
+    }[];
+    /**
+     * Pixels the document overflows a 375px viewport, or null when we could not
+     * measure. Zero is the answer a correct site gives.
+     */
+    overflowAt375: number | null;
+    /** Text nodes rendering below 12px, with one example. Null = not measured. */
+    tinyText: {
+        count: number;
+        sample: string | null;
+    } | null;
+    /** Images downloaded far larger than they are drawn — the bytes a visitor
+     *  pays for and never sees. */
+    oversizedImages: {
+        src: string;
+        naturalWidth: number;
+        renderedWidth: number;
+    }[];
+};
+
+/**
+ * The things a careful person would check with a browser and ten minutes.
+ *
+ * Every check here is a pure function of what the crawl already stored. Nothing
+ * in this file makes a request, which is the point: it can be run over every
+ * audit already in the database without touching a prospect's server, and a bug
+ * found by that replay costs nothing to fix.
+ *
+ * FOUR STATES, NOT THREE. The rest of this codebase already knows that our
+ * failed measurement must never render as the site's defect, which is why
+ * `unmeasured` exists. This file adds the state that review kept catching:
+ * `not-applicable`. A site with no `LocalBusiness` schema, no HSTS header and no
+ * RTL content must not silently PASS the checks about those — that inflates
+ * "34 of 35 passed" with checks that never ran, which is the same dishonesty as
+ * a false failure wearing nicer clothes. Both non-verdicts leave the
+ * denominator; see `tally`.
+ *
+ * THE FLOOR IS BARE HTML. A hand-written page with a title, a heading and a
+ * paragraph should pass almost all of this. A check that a careful, ordinary
+ * site fails is not measuring care, it is measuring fashion, and it makes the
+ * report an argument rather than a document. Where a bar had to be set, it is
+ * set generously and the reasoning is written down next to it.
+ *
+ * WHAT PASSES IS ONE LINE. Most of these will be green on most sites, and that
+ * is by design — they cost one row inside a collapsed section and are invisible
+ * until the day one fails, at which point it is the most useful row on the
+ * page. That is what makes a trivial check worth having, and it is the only
+ * thing that makes it worth having.
+ */
+type CheckStatus = "pass" | "fail" | "unmeasured" | "not-applicable";
+type SiteCheck = {
+    key: string;
+    /** What was checked, in the reader's terms rather than ours. */
+    label: string;
+    status: CheckStatus;
+    /**
+     * What we found — the receipt, on a pass as much as on a fail. A green row
+     * saying "we looked and it is fine" is worth more when it says what it
+     * looked at.
+     */
+    evidence: string | null;
+    /** Why it matters to them. Printed only on a fail; a cleared check needs no
+     *  argument. */
+    why: string;
+    scope: Scope;
+};
+declare function tally(checks: SiteCheck[]): {
+    passed: number;
+    failed: number;
+    total: number;
+};
+
 /**
  * Can a visitor actually get from where they landed to a way of contacting you?
  *
@@ -674,6 +1092,18 @@ type PageAnchor = {
     href: string;
     text: string;
     rel: string;
+    /** As authored, lower-cased — `_blank` on a link that opens a new tab.
+     *  Optional: absent on reports stored before it was captured, which reads as
+     *  "not measured" rather than "opens in this tab". */
+    target?: string;
+    /** `aria-label` as authored, empty when there is none. This is the label a
+     *  screen reader actually announces, so a link whose visible text is "Learn
+     *  more" is not necessarily a link that announces "Learn more".
+     *
+     *  Optional for the same reason `target` is: a report stored before it was
+     *  captured has it absent everywhere, and absent must read as "we did not
+     *  look", never as "there is none". */
+    ariaLabel?: string;
 };
 /**
  * What a form is FOR, inferred from its shape.
@@ -698,6 +1128,16 @@ type FormKind = "enquiry" | "subscribe" | "other";
 /** One `<form>`, in enough detail to tell an enquiry form from a newsletter box
  *  or a search field. That distinction is the whole point: a site nobody can
  *  actually reach must not score as though it has a conversion path. */
+/** One control a visitor fills in. Just the three attributes that decide
+ *  whether the form is easy to complete on a phone. */
+type FormField = {
+    /** Lower-cased, defaulting to "text" for a bare `<input>` exactly as a
+     *  browser does; `textarea` and `select` carry their tag name. */
+    type: string;
+    name: string | null;
+    autocomplete: string | null;
+    required: boolean;
+};
 type FormShape = {
     kind: FormKind;
     /** As authored, or null for a form that posts to its own URL. */
@@ -711,6 +1151,9 @@ type FormShape = {
      *  and this is what separates "can be contacted" from "can be searched". */
     hasContactField: boolean;
     hasSubmit: boolean;
+    /** Per-field detail. Optional: absent on reports stored before it existed,
+     *  and absence must read as "not measured", never as "no fields". */
+    fields?: FormField[];
 };
 type PageExtract = {
     title: string | null;
@@ -754,6 +1197,58 @@ type PageExtract = {
     /** `src` of each `<img>`, as authored. Same resolution note as `anchors`. */
     imageSrcs?: string[];
     forms?: FormShape[];
+    /**
+     * Every `<meta>` that is not `og:`/`twitter:` — those are in `social`, and
+     * carrying them twice would double the biggest part of a persisted extract.
+     * Keyed by lower-cased `name` or `property`, so `robots`, `generator`,
+     * `charset` and `viewport` are all reachable by the name they are written by.
+     *
+     * `metaDescription` and `hasViewportMeta` remain projected separately because
+     * older stored reports have them and nothing should have to know that
+     * `metas.description` is the same string.
+     *
+     * Optional: absent on reports stored before it existed, and absence must read
+     * as "not measured", never as "this page declares no metas".
+     */
+    metas?: Record<string, string>;
+    /**
+     * Every `<link>` in the document, as authored.
+     *
+     * The elements were ALREADY collected by the extractor — only the canonical
+     * one was ever projected onto this type — so this is a projection change
+     * rather than a new traversal.
+     *
+     * Optional: absent on reports stored before it existed. Absence means "not
+     * measured", never "this page declares no favicon".
+     */
+    links?: {
+        rel: string;
+        href: string;
+        hreflang?: string;
+        type?: string;
+    }[];
+    /**
+     * `src` of each `<script src>`, as authored, CAPPED — see `scriptCount` for
+     * the true total, exactly as `anchors`/`anchorCount` do.
+     *
+     * These are the receipts the stack readout is built from: `/wp-content/
+     * plugins/<name>/`, `/_next/`, `hs-scripts.com`. Inline scripts are not
+     * collected — only ones with a `src`, because a src is an address a reader
+     * can go and check and an inline blob is not.
+     */
+    scriptSrcs?: string[];
+    /**
+     * URLs NAMED inside inline scripts — a different claim from a script that
+     * is loaded, and the one that matters for a site which defers its tags.
+     *
+     * A page that injects `googletagmanager.com` only after the first scroll has
+     * no analytics `src` in the DOM at crawl time. Reading that as "no analytics"
+     * is our missing measurement reported as their defect. Absent on reports
+     * stored before this existed, which reads as "not measured".
+     */
+    inlineScriptUrls?: string[];
+    /** True number of `<script src>` on the page, before `scriptSrcs` was capped. */
+    scriptCount?: number;
 };
 type PageCapture = {
     url: string;
@@ -764,6 +1259,31 @@ type PageCapture = {
     /** Extract of the Playwright-rendered DOM (what a browser sees). */
     rendered: PageExtract | null;
     error: string | null;
+    /**
+     * What the axe rule set found on this page, collected in the SAME browser
+     * pass that produced `rendered` — never a second navigation.
+     *
+     * Null means the rules did not run: an older stored report, a page that
+     * failed to render, or a scan that threw. It must never read as "no
+     * violations", which is the opposite claim.
+     */
+    axe?: AxePageResult | null;
+    /**
+     * What the browser itself reported while this page was open — console errors,
+     * failed requests, mobile overflow. Same pass as `rendered` and `axe`.
+     *
+     * Null means nothing was measured. It must never read as "nothing went
+     * wrong", which is the opposite claim.
+     */
+    vitals?: PageVitals | null;
+    /**
+     * What happened when we pressed this page's enquiry-form submit button.
+     *
+     * Present on at most ONE page per crawl, and null everywhere else — absence
+     * means "we did not interact here", never "the form is fine". Optional for
+     * reports stored before any of this existed.
+     */
+    formProbe?: FormProbe | null;
 };
 type CrawlResult = {
     /** Normalized origin, e.g. "https://example.com". */
@@ -771,9 +1291,27 @@ type CrawlResult = {
     robotsTxt: string | null;
     /** One entry per agent in crawl.ts's ALL_AGENTS (6 AI + 2 classical). */
     agentAccess: RobotsAgentAccess[];
+    /** `sample` is a capped slice of the URLs, absent on reports stored before
+     *  it existed — read absence as "not measured", never as "the sitemap is
+     *  empty". `urlCount` is the true total either way. */
     sitemap: {
         present: boolean;
         urlCount: number;
+        sample?: string[];
+        /**
+         * True when we stopped reading before the sitemap ended, which makes
+         * `urlCount` a FLOOR rather than a count.
+         *
+         * A sitemap index is followed only so far — see `MAX_SITEMAP_CHILDREN` —
+         * and viget.com publishes 35 children holding 1,636 URLs between them. We
+         * read the first few, counted 66, and told them 179 of their own pages were
+         * missing from their sitemap. Our ceiling, reported as their gap, which is
+         * the one mistake this report keeps having to be stopped from making.
+         *
+         * Optional: absent on reports stored before it was tracked, and absent must
+         * read as "we do not know", never as "we read the whole thing".
+         */
+        truncated?: boolean;
     };
     llmsTxt: {
         present: boolean;
@@ -1106,10 +1644,55 @@ type ProspectAuditResult = {
      *  single named goal rather than a generic template — see goals.ts. Optional
      *  for reports stored before it existed. */
     goalFit?: StageResult<GoalFit>;
+    /**
+     * What they are running — platform, theme, plugins, host, forms, analytics.
+     *
+     * NOT a check and never part of any denominator: nothing in it passes or
+     * fails. It opens the report because naming a reader's own stack back to them
+     * answers "do these people know what they are talking about" before the first
+     * finding. Optional for reports stored before the stage existed.
+     */
+    stack?: StageResult<StackReadout>;
+    /**
+     * The Tier 0 battery — the things a careful person would check with a
+     * browser and ten minutes, every one of them a pure function of the crawl.
+     *
+     * Four states per check, and only `pass`/`fail` count toward the denominator:
+     * a site with no schema has not failed the schema checks, and printing
+     * "34 of 40" where six were never applicable would be a number inflated on
+     * our own behalf. Optional for reports stored before the stage existed.
+     */
+    siteChecks?: StageResult<SiteCheck[]>;
+    /**
+     * The axe rule set, run against the rendered DOM.
+     *
+     * Named rules with named fixes, where the Lighthouse accessibility score is
+     * one opaque number over a subset of the same rules. Optional for reports
+     * stored before it existed — and absence means the rules did not run, never
+     * that nothing was found.
+     */
+    accessibility?: StageResult<AccessibilityResult>;
+    /**
+     * What the DOMAIN says — SPF, DMARC, mail servers, registration expiry.
+     *
+     * None of it touches their web server, and none of it is visible from any
+     * amount of reading their HTML. Optional for reports stored before it
+     * existed.
+     */
+    dns?: StageResult<DnsFindings>;
+    /**
+     * What the server SERVED, as opposed to what the markup declared — the icon,
+     * the share image, the sitemap's own URLs, and how many hops a link takes.
+     *
+     * The only part of the check battery that costs the prospect requests, which
+     * is why it is capped, paced, and reports the count it made. Optional for
+     * reports stored before it existed.
+     */
+    http?: StageResult<HttpFindings>;
     /** When an engine describes this business, where is it getting that from —
      *  each statement sorted by SOURCE, never by truth. See accuracy.ts. Optional
      *  for reports stored before the stage was wired in. */
     accuracy?: StageResult<AccuracyResult>;
 };
 
-export { type AnalyzeResult, type AnswerSpace, type AssetCheck, type BasicsCheck, type BuyerQuestion, type ChecksResult, type ConsistencyResult, type ContactAffordance, type ContactVariant, type CrawlResult, type Fix, type FormKind, type FormShape, GOAL_LABELS, type GoalFit, type GoalRequirement, type JourneyMap, type LighthouseScores, type PageAnchor, type PageCapture, type PageExtract, type PageJourney, type ProbeAnswer, type ProbedUrl, type ProbesResult, type ProspectAuditResult, type Reachability, type RobotsAgentAccess, type Scope, type Scores, type SiteGoal, type SourceCount, type StageResult, orderRequirements };
+export { type AccessibilityResult, type AnalyzeResult, type AnswerSpace, type AssetCheck, type AxeImpact, type AxePageResult, type AxeViolation, type BasicsCheck, type BuyerQuestion, type CheckStatus, type ChecksResult, type ConsistencyResult, type ContactAffordance, type ContactVariant, type CrawlResult, type DnsFindings, type Fix, type FormField, type FormKind, type FormProbe, type FormShape, GOAL_LABELS, type GoalFit, type GoalRequirement, type HttpFindings, type JourneyMap, LAYER_LABELS, LAYER_ORDER, type LighthouseScores, type PageAnchor, type PageCapture, type PageExtract, type PageJourney, type ProbeAnswer, type ProbedUrl, type ProbesResult, type ProspectAuditResult, type Reachability, type RobotsAgentAccess, type Scope, type Scores, type SiteCheck, type SiteGoal, type SourceCount, type StackItem, type StackLayer, type StackReadout, type StageResult, orderRequirements, tally };

package/dist/prospect/types.js

@@ -1,9 +1,18 @@
+import {
+  LAYER_LABELS,
+  LAYER_ORDER,
+  tally
+} from "../chunk-WJMPCVOR.js";
 import {
   GOAL_LABELS,
   orderRequirements
 } from "../chunk-T7ZUUOZ2.js";
+import "../chunk-RARREDQE.js";
 export {
   GOAL_LABELS,
-  orderRequirements
+  LAYER_LABELS,
+  LAYER_ORDER,
+  orderRequirements,
+  tally
 };
 //# sourceMappingURL=types.js.map