@setsquare/review-sdk 0.0.1

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/NOTICE

@@ -0,0 +1,57 @@
+Setsquare
+Copyright (c) 2026 Setsquare
+
+This product includes software developed by the Setsquare project
+(https://setsquare.dev).
+
+--------------------------------------------------------------------------------
+Licence
+--------------------------------------------------------------------------------
+
+The published Setsquare packages are licensed under the Apache License, Version
+2.0. Each package ships the full licence text as its own LICENSE file, and this
+NOTICE alongside it, as Apache-2.0 section 4 requires.
+
+The licence text was retrieved verbatim from
+https://www.apache.org/licenses/LICENSE-2.0.txt and is never retyped. Recorded at
+the moment it was fetched:
+
+    Fetched  2026-09-09T13:44:38Z
+    Bytes    11358
+    sha256   cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30
+
+The canonical copy lives at `licenses/Apache-2.0.txt` in the source repository;
+every package's LICENSE is a byte-identical copy of it, and
+`scripts/verify-packages.mjs` fails the release if any of them drifts.
+
+THIS REPOSITORY AS A WHOLE IS NOT APACHE-2.0, which is why there is no LICENSE
+file at its root. What runs on someone else's machine is Apache-2.0; what runs on
+ours is proprietary, all rights reserved — `apps/api`, `apps/portal` and
+`apps/marketing` are not published and are not covered by this notice. The
+boundary is decision D3.
+
+APACHE-2.0 IS OSI-APPROVED, BUT THIS IS NOT AN OPEN-SOURCE PROJECT. The source
+repository is private and the packages ship built output, so a recipient gets an
+OSI licence over a binary distribution. That is coherent and lawful, and it is not
+the same thing. The accurate phrase is "Apache-2.0 licensed".
+
+--------------------------------------------------------------------------------
+Trademarks
+--------------------------------------------------------------------------------
+
+"Setsquare" and the Setsquare logo are trademarks of the Setsquare project. No
+trademark licence is granted by the Apache License — section 6 reserves this
+expressly — and none is granted by this notice. You may state accurately that
+your software uses or is compatible with Setsquare; you may not use the name or
+the mark in a way that suggests endorsement by, or affiliation with, the project.
+
+The name is never abbreviated. There is no "sq" form, in any surface, ever.
+
+--------------------------------------------------------------------------------
+Third-party software
+--------------------------------------------------------------------------------
+
+Packages that redistribute or depend on third-party software carry their own
+THIRD-PARTY-NOTICES.md alongside this file. See
+`packages/review-sdk/THIRD-PARTY-NOTICES.md` for the axe-core (MPL-2.0) position
+in particular.

package/README.md

@@ -0,0 +1,338 @@
+# @setsquare/review-sdk
+
+Accessibility, e2e and performance evidence from the Playwright suite you already
+have.
+
+One line in your config. No test edits. With no token set, **nothing leaves your
+machine**: scans run, a summary prints, and a JSON evidence file lands on disk
+that is yours to keep.
+
+> The brand is Setsquare and so is everything you type — `setsquare`, written in
+> full, with no short form.
+
+**Licence: Apache License 2.0** (SPDX `Apache-2.0`). Use it, modify it, vendor it,
+mirror it internally — including in CI, Docker layers and a committed
+`node_modules` — and redistribute it, subject to the licence's own conditions:
+retain the notices, state your changes, and ship the `NOTICE` file along with the
+`LICENSE`. It carries an express patent grant (§3) and reserves our trademarks
+(§6). Stated here rather than at the bottom, because if your review process gates
+on licences you should not have to scroll to find that out.
+
+Apache-2.0 is OSI-approved, so this should clear a dependency policy without a
+conversation. It is still not accurate to call Setsquare an open-source project:
+the source repository is private and this package ships built output, so you have
+an OSI licence over a binary distribution. **"Apache-2.0 licensed" is the true
+phrase**, and npm provenance attestation needs a public repository and so is not
+available yet.
+
+*This was previously the Elastic License 2.0, which forbade offering the software
+as a hosted or managed service. That restriction is gone — not narrowed.*
+
+---
+
+## Before you install anything
+
+```bash
+npx @setsquare/review-cli audit
+```
+
+Reads your repository and tells you what your suite already covers — which routes
+it visits, which key journeys have no coverage, whether you already run axe and at
+what level. It writes nothing, changes nothing, and sends nothing anywhere.
+
+## Quickstart
+
+```bash
+npm i -D @setsquare/review-sdk
+npx setsquare init
+npx playwright test
+```
+
+`setsquare init` adds two lines to your Playwright config and tells you what it found.
+If you have more than one config it will ask which, rather than guessing — configs
+often overlap deliberately, and picking one for you is not its call.
+
+The two lines it adds:
+
+```ts
+import { withSetsquare } from '@setsquare/review-sdk';
+
+export default withSetsquare(defineConfig({/* your config, untouched */}));
+```
+
+Then add `.setsquare/` to your `.gitignore`.
+
+## What you get
+
+Every settled page in your suite is scanned against **WCAG 2.2 AA**, and the run
+ends with a summary:
+
+```
+  Setsquare — accessibility evidence
+
+  Scanned 4 surfaces in 2 themes, assessed against WCAG 2.2 AA.
+  1 rule failing on 4 elements. 600 checks passed.
+
+  serious  color-contrast — WCAG 1.4.3
+           4 elements on 4 surfaces: privacy · light, terms · light, cookies ·
+           light, accessibility · light
+           https://dequeuniversity.com/rules/axe/4.13/color-contrast
+
+  4 of 8 scanned contexts had no violations at all.
+```
+
+and an evidence file at `.setsquare/runs/<timestamp>/run.json` — the full findings,
+their WCAG criteria, measured contrast ratios, the exact ruleset used, and
+performance timings.
+
+## Every screenshot on one page
+
+Playwright takes the screenshots; reading them means opening its report and
+clicking into each test in turn. So nobody does, and a change that visibly broke
+a page ships because every assertion still held.
+
+Every run also writes `.setsquare/runs/<timestamp>/screens.html` — one scrollable page
+with each test's name and its captures beneath it, comparisons first, then
+failures, then the rest in the order they ran. It is a contact sheet for a person
+to scan in thirty seconds before they approve something:
+
+```bash
+setsquare screens --open
+```
+
+The same section appears inside `report.html`, so whoever is handed the evidence
+file gets the pictures too.
+
+**Setsquare never takes a screenshot.** It indexes the ones Playwright already
+wrote and links to them where they lie — no pixels are copied, and none are
+written by this package (its test suite fails if any shipped file so much as names
+an image format). Three ways to give it something to index:
+
+- `use: { screenshot: 'on' }` in your Playwright config. One capture per test, and
+  no other change to your suite.
+- `await expect(page).toHaveScreenshot()`. Playwright compares against your
+  committed baseline; the sheet puts expected, actual and difference side by side.
+- Attach your own at the moments that matter, which turns the sheet into a
+  walkthrough of the flow:
+
+  ```ts
+  import { maskLocators } from '@setsquare/review-sdk';
+
+  async function step(page, testInfo, name) {
+    const path = testInfo.outputPath(`${name}.png`);
+    await page.screenshot({ path, mask: maskLocators(page), fullPage: true });
+    await testInfo.attach(name, { path, contentType: 'image/png' });
+  }
+  ```
+
+  `path`, not `body`: an attachment given a body stays in Playwright's memory,
+  never reaches disk, and cannot be linked to. The sheet says so when it happens
+  rather than quietly showing fewer pictures.
+
+What the sheet does **not** do is compare anything of its own. There is no
+baseline here and no history — "is this different from last week?" is the hosted
+platform, deliberately. Where you see a comparison, Playwright made it.
+
+## Naming what you scan
+
+Auto-scan covers what your tests already visit. For states it cannot reach on its
+own — a modal that is open, a form showing validation errors — name them:
+
+```ts
+import { setsquare } from '@setsquare/review-sdk';
+
+test('the editor reports validation errors accessibly', async ({ page }) => {
+  await page.goto('/jobs/42/edit');
+  await page.getByRole('button', { name: 'Save' }).click();
+
+  await setsquare.scan(page, 'job-editor', { state: 'validation-errors' });
+});
+```
+
+An explicit scan always outranks an inferred one for the same context.
+
+## Configuration
+
+Everything is optional. An empty options object produces a useful run.
+
+```ts
+export default withSetsquare(defineConfig({/* … */}), {
+  wcag: 'AAA', // default 'AA'
+  bestPractice: true, // axe's advisory rules; not WCAG failures
+  personas: { 'a11y-admin': 'recruiter' },
+  themes: { 'dark-suite': 'dark' },
+  surfaces: { '/jobs/:id/edit': 'job-editor' },
+  mask: ['.candidate-name'],
+  outputDir: '.setsquare',
+  promo: false,
+});
+```
+
+**Why AA by default.** It is what conformance means in practice, and what
+EN 301 549 and procurement ask for. AAA is a deliberate commitment — WCAG itself
+does not recommend it as a general policy — so opting in is the honest default.
+
+**Themes** are read from `data-theme` on the live page when your suite toggles
+them in-test, so a suite whose project names carry no theme still gets one context
+per theme without configuration.
+
+## One logical run across several Playwright invocations
+
+**If you run `playwright test` once — with any number of workers — you already
+get one report and can skip this section.** Worker parallelism inside a single
+invocation needs no setup: the workers observe, the one reporter writes, and
+one run lands on disk. That is the default, and most suites never need more.
+
+You need this section only when one suite execution makes **several**
+`playwright test` calls. In practice that means one thing: Playwright's
+`workers` setting is global, so a suite that needs a serial lane (tests that
+write shared state) _and_ a parallel lane (read-only sweeps at `--workers=4`)
+has to run as two invocations. Without help, each invocation writes its own
+run, and one suite execution looks like two half-runs.
+
+Setsquare cannot detect this by itself — nothing on the machine distinguishes
+"one script making two passes" from "you running your suite twice", and merging
+two unrelated runs would fabricate a run that never happened. So the script
+that makes the calls declares it, with three variables: mint **one id per
+execution** and export it to every invocation:
+
+```bash
+export SETSQUARE_RUN_ID="run-$(date +%s)-$$"   # one id per suite execution
+export SETSQUARE_RUN_PARTS=2                   # how many invocations you will make
+
+SETSQUARE_LANE=functional SETSQUARE_AUTOSCAN=0 npx playwright test --project=functional --workers=1
+SETSQUARE_LANE=a11y                       npx playwright test --project=a11y --workers=4
+```
+
+`SETSQUARE_AUTOSCAN=0` on the functional lane is the cost lever: axe is the bulk of
+the SDK's per-test overhead, and a lane whose surfaces the a11y lane scans
+anyway would pay it twice for evidence the merge deduplicates. The lane still
+contributes everything else — test outcomes, navigation observations (so the
+visited-but-never-scanned accounting stays union-aware), and explicit
+`setsquare.scan()` calls, which always run. Leave it unset on any lane that is your
+only scanner of some surface.
+
+All invocations sharing the id merge into **one** run at
+`.setsquare/runs/group-<id>/` — one `run.json`, one `report.html`, one `screens.html`
+spanning every lane — with every
+accounting computed over the union: a surface visited in pass 1 and scanned in
+pass 2 is covered, not "visited but never scanned". Concurrent invocations are
+safe; so are the parallel workers inside each one.
+
+The merged `run.json` carries the group facts where a consumer can query them:
+`source.runGroup` holds `{ id, coverage, completed, expectedParts }` — where
+`coverage` is `complete` only against a declared census, `partial` when
+evidence is known absent, and `unknown` otherwise — and every result row
+carries its `lane`. Test ids are additionally prefixed (`a11y :: …`) so the
+same test run in two lanes stays two rows. The sidecar `meta.json` holds the
+full per-invocation breakdown.
+
+The variables:
+
+- **`SETSQUARE_RUN_ID`** — the group identity. Mint a **fresh** id per suite
+  execution (a CI build id is ideal; a branch name is not — reusing an id
+  across executions gets the stale parts excluded with a warning). When the
+  variable is absent, nothing changes: a solo `playwright test` behaves exactly
+  as before.
+- **`SETSQUARE_LANE`** _(optional)_ — a label for this invocation. It prefixes the
+  merged run's test ids (`a11y :: suite > spec > test`), groups the report's
+  provenance table, and keeps the same test's results from two lanes apart.
+- **`SETSQUARE_RUN_PARTS`** _(optional but recommended)_ — how many invocations this
+  execution will make. This is the **only** way the merged artifact can say
+  "complete": an invocation that crashes before it starts is invisible, so
+  without a declared count the honest verdict is "unknown". A wrong count fails
+  safe — it reads as partial, never as falsely complete.
+
+If an invocation crashes mid-run, the merged run still exists, is marked
+partial, and says which invocation's evidence is absent — absent, never clean.
+Sharding works the same way: `SETSQUARE_RUN_ID` shared across shards,
+`SETSQUARE_LANE=shard-1` and so on.
+
+Two cautions. Every invocation must resolve the same `.setsquare` directory (same
+config directory and `outputDir`), or the group silently splits. And truly
+_concurrent_ invocations should give Playwright itself distinct `outputDir` /
+report folders — Playwright's own artifacts are not merge-aware; setsquare's are.
+
+## What it will not do
+
+- **Fail your build.** A scan error warns; your tests keep their own verdicts.
+- **Phone home.** No telemetry, no error reporting, no version checks — with or
+  without a token. There is no network client in this package at all, and its test
+  suite asserts that there never will be.
+- **Write images.** The contact sheet above indexes and links to the screenshots
+  Playwright wrote; it copies none of them and this package writes none of its
+  own. Masking is built and proven, but the local path holds no pixels, so an
+  unmasked screenshot cannot end up on your disk through us.
+- **Compare screenshots.** Pixel comparison against a stored baseline is a
+  platform capability. Locally you get Playwright's own comparisons, presented.
+- **Compare runs.** No history, no baselines, ever, locally. The moment the
+  question is "better or worse than last week", that is the hosted platform.
+
+## Untrusted content
+
+Selectors and class names come from your page's DOM, which routinely contains
+third-party embeds and user-generated content. This SDK treats every page-derived
+string as attacker-influenceable: capped at ten representative selectors, length
+limited, and stripped of control, zero-width and bidi characters — while leaving
+genuine content intact, because encoding belongs at each sink rather than at the
+source.
+
+There is a deliberately malicious page in the test suite, permanently.
+
+## Supply chain
+
+This SDK runs inside your CI, so a compromised release would be the worst thing
+that could happen to us. Builds come from CI and never from a laptop, publishing
+is token-less (npm trusted publishing over OIDC, so there is no long-lived
+credential to steal), and the runtime dependency tree is `axe-core` and our own
+contract package.
+
+Two people review every release. That is a practice we hold ourselves to, not a
+control the platform enforces — branch protection is unavailable on a private
+repository on our plan, so treat it as a statement about how we work rather than
+a guarantee you can verify.
+
+**What we do not have, said plainly: npm provenance attestation.** It requires a
+public source repository and ours is private, so no attestation is generated —
+and a supply-chain section that implied otherwise would be exactly the kind of
+unearned claim this tool exists to catch. Keeping the source private is a
+decision we have taken rather than one we are still weighing, so attestation is
+not on its way. If it is a hard requirement for you, tell us — that is useful to
+know, and it is the kind of thing that changes a decision.
+
+The `repository` field names `Worktree-Amigos/setsquare` — the team's GitHub org,
+which is private. The org name and the product name differ on purpose.
+
+## Compatibility
+
+**Node 22 or later.** That is the oldest active LTS line, and the floor our
+compatibility matrix tests. `@playwright/test` itself allows Node 20, so we will
+never be the reason an install fails on a runtime Playwright supports — we simply
+do not claim a floor we have decided not to verify, and Node 20 left support in
+April 2026.
+
+`@playwright/test` (JS/TS) only. The fixture and reporter model this is built on
+exists only in the JS/TS runner; other language bindings would be separate SDKs
+speaking the same versioned wire contract. The **application** you scan can be
+written in anything — axe runs against the rendered DOM.
+
+## Reporting a problem
+
+Bugs, questions and security reports all go to <https://setsquare.dev/report>,
+which files a tracked issue directly. There is no public issue tracker — this
+repository is private — so the form is the whole route in, and it is watched.
+
+**Not open to outside contributions yet.** The source is not published pre-1.0,
+so there is nowhere to send a pull request. That is a deliberate position rather
+than an oversight, and it will be revisited.
+
+## Licence
+
+Apache License 2.0 — see [LICENSE](./LICENSE) and [NOTICE](./NOTICE). Free to use,
+modify, vendor, mirror and redistribute, provided you retain the notices, state
+your changes and pass on the `NOTICE`. Express patent grant; trademarks reserved.
+
+OSI-approved, but this is not an open-source project — the repository is private
+and the package ships built output. Say "Apache-2.0 licensed". (Decision `P0-D3`,
+revised 2026-09-08 from the Elastic License 2.0, whose hosted-service restriction
+no longer applies.)

package/THIRD-PARTY-NOTICES.md

@@ -0,0 +1,61 @@
+# Third-party notices
+
+`@setsquare/review-sdk` redistributes or depends on the following third-party
+software. Nothing in this file grants rights to Setsquare's own code, which is
+licensed under the **Apache License 2.0** — see [LICENSE](./LICENSE) and
+[NOTICE](./NOTICE).
+
+This file is separate from `NOTICE` on purpose. `NOTICE` is the Apache-2.0 §4(d)
+notice for Setsquare's own work and must be propagated by anyone redistributing
+this package; this file records what other people's software is in here and under
+what terms. Conflating them would make it unclear which obligations travel with a
+redistribution.
+
+## axe-core
+
+- Copyright © Deque Systems, Inc.
+- License: Mozilla Public License 2.0 (MPL-2.0), <https://www.mozilla.org/en-US/MPL/2.0/>
+- Source: <https://github.com/dequelabs/axe-core>
+
+The SDK injects axe-core into pages under test **byte-for-byte, unmodified**,
+including its embedded license banner, which must never be stripped or
+minified away. If a future build step bundles or minifies axe, `/*!`-style
+comments must be preserved. Setsquare's own checks talk to axe through its
+public `configure`/`run` API and are separate files forming a Larger Work
+under MPL-2.0 §3.3; they are implemented from the WCAG and ACT specifications,
+not from axe's rule source.
+
+**Setsquare's own licence changing does not affect this.** MPL-2.0 §3.3 permits
+the Larger Work to be distributed under terms of our choosing so long as the
+Covered Software itself stays under MPL-2.0, which is why the argument held under
+the Elastic License 2.0 and holds unchanged under Apache-2.0. The obligation that
+actually matters is the one above — axe-core travels byte-for-byte with its banner
+intact — and it is a property of how the SDK injects axe, not of our licence.
+
+## text-readability
+
+- Copyright © 2019 Utkarsh Raj
+- License: the repository's LICENSE file is MIT; the npm metadata says ISC.
+  Both are permissive; we record both and retain the copyright either way.
+- Source: <https://github.com/clearnote01/readability>
+
+Used Node-side only (readability scoring for the `setsquare-reading-level`
+heuristic). It is never injected into customer pages; if that ever changes,
+this notice must ship inside the injected bundle too.
+
+## W3C ACT rules test cases
+
+**None are present today**, and this section is the standing rule for if any are
+added rather than a description of what ships. Checked 2026-09-09: `src/checks/`
+holds only our own TypeScript, and no fixture NOTICE file exists anywhere in the
+package. The previous wording described the copied fixtures and their per-directory
+NOTICE files as though they were already here, hedged only by a "(when present)"
+in the heading — which is the kind of sentence this repository keeps having to
+correct, so it is stated the other way round now.
+
+Should ACT test-case fixtures be vendored later: they are copied verbatim from the
+ACT-Rules Community Group repository under the W3C Software and Document Notice
+and License, <https://www.w3.org/copyright/software-license/>; each fixture
+directory carries its own NOTICE naming the rule, the source URI and the W3C
+copyright line (© W3C® — MIT, ERCIM, Keio, Beihang); and fixtures are never edited
+beyond mechanical harness wrapping.