@vertaaux/cli 0.5.0 → 0.5.1

package/CHANGELOG.md

@@ -5,6 +5,25 @@ All notable changes to `@vertaaux/cli` will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+## [0.5.1] - 2026-04-07
+
+### Added
+
+- **`--profile <name>` flag on `vertaa audit`** — Phase 1.5 of audit profiles is now live on npm. `vertaa audit <url> --profile wcag-aa` (and any profile with a `categories` subset) skips auditors in the cloud worker rather than running all 7 and filtering post-run. Built-in profiles: `wcag-aa`, `conversion-focus`, `quick-ux`, `ci-gate`, `compliance`. The CLI passes `profile.categories` in the POST body via `apiRequest` when a category subset is resolved; the SDK path is used when no subset applies. See `cli/tests/commands/audit-handler.test.ts` for coverage.
+- **`a11y` command upgrade** — `vertaa a11y <url>` now calls the dedicated `/v1/a11y/audit` endpoint with multi-engine analysis (axe-core + AccessLint + custom analyzers). Added `--mode`, `--fail-on-score`, `--min-impact`, and `--fail-on-findings` flags.
+- **Source tracking** — All CLI-triggered audits now include `source: "cli"` metadata for dashboard visibility.
+
+### Fixed
+
+- **Profile-filtered categories now report `null` instead of a false `100`** — Excluded categories in `scores` are `null` (not a fabricated "perfect 100" from `calculateScore([])`). `metadata.filtered_categories` lists profile exclusions; `metadata.skipped_checks` is reserved for runtime failures. `metadata.partial` stays `false` for profile-filtered audits. Server-side fix shipped in PR #375; this release gets it onto the npm-published CLI output path.
+
+### Changed
+
+- **SDK upgraded to `@vertaaux/sdk@2.0.0`** — Updated to match v2 API surface with snake_case parameter conventions.
+- **Machine-mode hardening** — Payload output routes consistently through the data writer; enveloped JSON input is unwrapped uniformly across `baseline`, `comment`, and `diff` commands.
+
 ## [0.5.0] - 2026-03-19
 
 ### Added

package/README.md

@@ -119,11 +119,27 @@ All AI commands require authentication (`vertaa login` or `VERTAAUX_API_KEY`). T
 | `upload <file>` | Upload audit results to cloud storage |
 | `download <id>` | Download audit results from cloud storage |
 
+### Accessibility
+
+| Command | Description |
+|---------|-------------|
+| `a11y <url>` | Multi-engine accessibility audit (axe-core + AccessLint + custom analyzers) |
+
+The `a11y` command uses a dedicated API endpoint (`/v1/a11y/audit`) and returns WCAG-mapped findings with structured fix suggestions and fixability ratings.
+
+| Option | Description |
+|--------|-------------|
+| `--mode <basic\|standard\|deep>` | Audit depth (default: `basic`) |
+| `--min-impact <minor\|moderate\|serious\|critical>` | Minimum impact level to report |
+| `--fail-on-score <0-100>` | Exit 1 if accessibility score below this value |
+| `--fail-on-findings <n>` | Exit 1 if critical+serious findings exceed n |
+| `--format <json\|md>` | Output format (default: `json`) |
+| `--timeout <ms>` | Wait timeout (default: 60000) |
+
 ### Aliases
 
 | Command | Alias For |
 |---------|-----------|
-| `a11y <url>` | Accessibility-focused audit (filters for a11y issues) |
 | `scan <url>` | UX scan (alias for audit) |
 | `compare <urlA> <urlB>` | Compare audits of two URLs (also supports `--before`/`--after` for LLM-powered comparison) |
 
@@ -134,6 +150,7 @@ Formats are **per-command**, not global. Each command supports a different set o
 | Command | Formats | Default |
 |---------|---------|---------|
 | `audit` | `human`, `json`, `sarif`, `junit`, `html` | `human` |
+| `a11y` | `json`, `md` | `json` |
 | `comment` | `json`, `markdown` | `markdown` |
 | `explain` | `human`, `json` | `human` |
 | `policy show` | `json`, `yaml` | `yaml` |
@@ -419,6 +436,16 @@ vertaa error: invalid value for --mode
   │ valid: basic, standard, deep
 ```
 
+## AI Agent Skill
+
+Teach your AI coding agent (Claude Code, Cursor, Codex, Copilot, Gemini CLI, etc.) how to use the VertaaUX CLI:
+
+```bash
+npx skills add VertaaUX/agent-skills
+```
+
+Covers all CLI commands, CI/CD setup, SDK integration, and 10 use-case playbooks. Published on [skills.sh](https://skills.sh/VertaaUX/agent-skills).
+
 ## Related
 
 - [Migration Guide](./MIGRATION.md) -- Breaking changes in this release

package/dist/app/interactive-app.d.ts

@@ -37,6 +37,8 @@ export declare class InteractiveApp {
     private frameIndex;
     private version;
     private resolveRun;
+    /** Saved menu view so we can restore it after help overlay */
+    private savedMenuView;
     constructor(output?: NodeJS.WritableStream);
     /**
      * Start the interactive app.

package/dist/app/interactive-app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interactive-app.d.ts","sourceRoot":"","sources":["../../src/app/interactive-app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAUH,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAa,MAAM,YAAY,CAAC;AAWnE;;;;;;;GAOG;AACH,qBAAa,cAAc;IACzB,yDAAyD;IACzD,MAAM,EAAE,QAAQ,CAId;IAEF;;;OAGG;IACH,OAAO,CAAC,OAAO,CAAS;IAExB,sCAAsC;IACtC,UAAU,UAAS;IAEnB,OAAO,CAAC,MAAM,CAAwB;IACtC,OAAO,CAAC,SAAS,CAA+C;IAChE,OAAO,CAAC,WAAW,CAA8C;IACjE,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,UAAU,CAA6B;gBAEnC,MAAM,GAAE,MAAM,CAAC,cAA+B;IAQ1D;;;;;;OAMG;IACG,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;IAuB1B;;;;OAIG;IACH,UAAU,IAAI,MAAM;IA6BpB;;;;;;OAMG;IACH,MAAM,IAAI,IAAI;IAMd;;;;;;;;OAQG;IACG,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAY/C;;OAEG;IACG,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAUhC;;;;;OAKG;IACH,OAAO,IAAI,IAAI;IAsBf;;;;OAIG;IACH,MAAM,IAAI,IAAI;IAoBd;;OAEG;IACH,OAAO,IAAI,IAAI;IAgCf,8EAA8E;IAC9E,aAAa,IAAI,MAAM;IAMvB,OAAO,CAAC,SAAS;IAUjB,OAAO,CAAC,QAAQ;IAOhB,OAAO,CAAC,QAAQ,CAWd;IAEF,OAAO,CAAC,SAAS,CAmCf;CACH"}
+{"version":3,"file":"interactive-app.d.ts","sourceRoot":"","sources":["../../src/app/interactive-app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAUH,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAa,MAAM,YAAY,CAAC;AAYnE;;;;;;;GAOG;AACH,qBAAa,cAAc;IACzB,yDAAyD;IACzD,MAAM,EAAE,QAAQ,CAId;IAEF;;;OAGG;IACH,OAAO,CAAC,OAAO,CAAS;IAExB,sCAAsC;IACtC,UAAU,UAAS;IAEnB,OAAO,CAAC,MAAM,CAAwB;IACtC,OAAO,CAAC,SAAS,CAA+C;IAChE,OAAO,CAAC,WAAW,CAA8C;IACjE,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,UAAU,CAA6B;IAC/C,8DAA8D;IAC9D,OAAO,CAAC,aAAa,CAA4B;gBAErC,MAAM,GAAE,MAAM,CAAC,cAA+B;IAQ1D;;;;;;OAMG;IACG,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;IAuB1B;;;;OAIG;IACH,UAAU,IAAI,MAAM;IA6BpB;;;;;;OAMG;IACH,MAAM,IAAI,IAAI;IAMd;;;;;;;;OAQG;IACG,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAY/C;;OAEG;IACG,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAUhC;;;;;OAKG;IACH,OAAO,IAAI,IAAI;IAsBf;;;;OAIG;IACH,MAAM,IAAI,IAAI;IAoBd;;OAEG;IACH,OAAO,IAAI,IAAI;IAgCf,8EAA8E;IAC9E,aAAa,IAAI,MAAM;IAMvB,OAAO,CAAC,SAAS;IAUjB,OAAO,CAAC,QAAQ;IAOhB,OAAO,CAAC,QAAQ,CAWd;IAEF,OAAO,CAAC,SAAS,CAmDf;CACH"}

package/dist/app/interactive-app.js

@@ -17,6 +17,7 @@ import { renderHeader } from "./layout/header.js";
 import { renderFooter } from "./layout/footer.js";
 import { renderCanvas } from "./layout/canvas.js";
 import { getVersion } from "../ui/banner.js";
+import { HelpOverlayView } from "./views/help-overlay.js";
 // Default keyboard shortcuts shown in the footer when no view is active
 const DEFAULT_SHORTCUTS = ["↑↓ navigate", "↵ select", "F1 help", "^C quit"];
 // Shortcuts shown when a command view is active
@@ -49,6 +50,8 @@ export class InteractiveApp {
     frameIndex = 0;
     version;
     resolveRun = null;
+    /** Saved menu view so we can restore it after help overlay */
+    savedMenuView = null;
     constructor(output = process.stderr) {
         this.output = output;
         this.version = getVersion();
@@ -273,7 +276,29 @@ export class InteractiveApp {
         const key = data.toString();
         const ctrl = key.length === 1 && data[0] < 32 && data[0] !== 27;
         const meta = key.startsWith("\x1b") && key.length > 1;
-        // Delegate to active view first
+        // F1 is always handled at app level (before view delegation)
+        if (key === "\x1bOP" || key === "\x1b[11~") {
+            if (this._state.screen === "help") {
+                // Restore saved view
+                this._state.activeView = this.savedMenuView;
+                this.savedMenuView = null;
+                this._state.screen = "menu";
+            }
+            else {
+                // Save current view and show help overlay
+                this.savedMenuView = this._state.activeView;
+                this._state.activeView = new HelpOverlayView(() => {
+                    this._state.activeView = this.savedMenuView;
+                    this.savedMenuView = null;
+                    this._state.screen = "menu";
+                    this.redraw();
+                });
+                this._state.screen = "help";
+            }
+            this.redraw();
+            return;
+        }
+        // Delegate to active view
         if (this._state.activeView?.handleKey) {
             const consumed = this._state.activeView.handleKey(key, ctrl, meta);
             if (consumed)
@@ -293,12 +318,6 @@ export class InteractiveApp {
                 process.exit(0);
             }
         }
-        else if (key === "\x1bOP" || key === "\x1b[11~") {
-            // F1 — toggle help
-            const next = this._state.screen === "help" ? "menu" : "help";
-            this._state.screen = next;
-            this.redraw();
-        }
         else if (key === "\x1b" || key === "\x1b[") {
             // Escape or Escape sequence
             if (this._state.screen === "command" || this._state.screen === "help") {

package/dist/app/menu/categories.d.ts

@@ -1,12 +1,12 @@
 /**
  * Command category definitions for the interactive menu.
  *
- * 6 groups of 24 commands matching Commander.js registrations in index.ts.
+ * 6 groups of 23 interactive-safe commands matching the TUI runner.
  * Each MenuItem.value must exactly match the Commander command name.
  */
 import type { CommandCategory, MenuItem } from "../types.js";
 /**
- * All 24 commands organized into 6 semantic groups.
+ * All interactive-safe commands organized into 6 semantic groups.
  *
  * Groups follow a natural user workflow:
  *   Audit → Results → Fixes → Reports → Project → Account

package/dist/app/menu/categories.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"categories.d.ts","sourceRoot":"","sources":["../../../src/app/menu/categories.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAE7D;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,eAAe,EAiK/C,CAAC;AAEF;;;GAGG;AACH,wBAAgB,YAAY,IAAI,QAAQ,EAAE,CAEzC"}
+{"version":3,"file":"categories.d.ts","sourceRoot":"","sources":["../../../src/app/menu/categories.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAE7D;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,eAAe,EAkJ/C,CAAC;AAEF;;;GAGG;AACH,wBAAgB,YAAY,IAAI,QAAQ,EAAE,CAEzC"}

package/dist/app/menu/categories.js

@@ -1,11 +1,11 @@
 /**
  * Command category definitions for the interactive menu.
  *
- * 6 groups of 24 commands matching Commander.js registrations in index.ts.
+ * 6 groups of 23 interactive-safe commands matching the TUI runner.
  * Each MenuItem.value must exactly match the Commander command name.
  */
 /**
- * All 24 commands organized into 6 semantic groups.
+ * All interactive-safe commands organized into 6 semantic groups.
  *
  * Groups follow a natural user workflow:
  *   Audit → Results → Fixes → Reports → Project → Account
@@ -84,11 +84,6 @@ export const COMMAND_CATEGORIES = [
                 value: "fix-plan",
                 description: "Generate a structured remediation plan",
             },
-            {
-                name: "Review Patch",
-                value: "patch-review",
-                description: "Review a generated patch before applying",
-            },
         ],
     },
     {
@@ -104,11 +99,6 @@ export const COMMAND_CATEGORIES = [
                 value: "comment",
                 description: "Add audit annotations to source code",
             },
-            {
-                name: "Release Notes",
-                value: "release-notes",
-                description: "Generate release notes from audit improvements",
-            },
         ],
     },
     {
@@ -134,11 +124,6 @@ export const COMMAND_CATEGORIES = [
                 value: "download",
                 description: "Download audit results from VertaaUX cloud",
             },
-            {
-                name: "Verify Quality Gate",
-                value: "verify",
-                description: "Check if results meet quality gate thresholds",
-            },
         ],
     },
     {
@@ -160,7 +145,7 @@ export const COMMAND_CATEGORIES = [
                 description: "Show currently authenticated account",
             },
             {
-                name: "Health Check",
+                name: "Health Check (doctor)",
                 value: "doctor",
                 description: "Run diagnostics on CLI configuration and connectivity",
             },

package/dist/app/views/command-runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"command-runner.d.ts","sourceRoot":"","sources":["../../../src/app/views/command-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAWH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAwF5D,qBAAa,iBAAkB,YAAW,WAAW;IACnD,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,UAAU,CAAM;IACxB,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,GAAG,CAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAa;IAG7B,OAAO,CAAC,OAAO,CAAW;IAC1B,OAAO,CAAC,aAAa,CAA8B;IACnD,OAAO,CAAC,eAAe,CAAK;IAC5B,OAAO,CAAC,WAAW,CAAM;IAGzB,OAAO,CAAC,oBAAoB,CAA6B;IAGzD,OAAO,CAAC,cAAc,CAAwB;IAG9C,OAAO,CAAC,YAAY,CAAgB;IAGpC,OAAO,CAAC,YAAY,CAAK;gBAGvB,YAAY,EAAE,MAAM,EACpB,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,MAAM,IAAI;IAStB,MAAM,IAAI,MAAM;IA0EhB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO;IAsFxD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;YA+BhB,cAAc;CA0F7B"}
+{"version":3,"file":"command-runner.d.ts","sourceRoot":"","sources":["../../../src/app/views/command-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAaH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAsH5D,qBAAa,iBAAkB,YAAW,WAAW;IACnD,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,UAAU,CAAM;IACxB,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,GAAG,CAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAa;IAG7B,OAAO,CAAC,OAAO,CAAW;IAC1B,OAAO,CAAC,aAAa,CAA8B;IACnD,OAAO,CAAC,eAAe,CAAK;IAC5B,OAAO,CAAC,WAAW,CAAM;IAGzB,OAAO,CAAC,oBAAoB,CAA6B;IAGzD,OAAO,CAAC,cAAc,CAAwB;IAG9C,OAAO,CAAC,YAAY,CAAgB;IAGpC,OAAO,CAAC,YAAY,CAAK;gBAGvB,YAAY,EAAE,MAAM,EACpB,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,MAAM,IAAI;IAStB,MAAM,IAAI,MAAM;IA0EhB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO;IAsFxD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;YA+BhB,cAAc;CA4G7B"}

package/dist/app/views/command-runner.js

@@ -11,6 +11,8 @@
  *
  * Each command's handler is called directly (no program.parse()).
  */
+import fs from "fs";
+import path from "path";
 import { dim, bold, colorize, brand, renderError, setRendererOverride, setKeyboardOverrideActive, renderStepList, getTerminalWidth, getTerminalHeight, } from "@vertaaux/tui";
 import { setOutputBuffer } from "../../output/envelope.js";
 // Command handler imports
@@ -38,6 +40,17 @@ import { handleVerify } from "../../commands/verify.js";
 import { handleLogin, handleLogout, handleWhoami } from "../../commands/login.js";
 import { handleDoctor } from "../../commands/doctor.js";
 import { handlePolicy } from "../../commands/policy.js";
+function resolveJobOrFile(value) {
+    const trimmed = value.trim();
+    const resolved = path.resolve(process.cwd(), trimmed);
+    if (trimmed.toLowerCase().endsWith(".json") ||
+        trimmed.includes("/") ||
+        trimmed.includes("\\") ||
+        fs.existsSync(resolved)) {
+        return { file: trimmed };
+    }
+    return { job: trimmed };
+}
 /**
  * Get the argument definitions for a command.
  */
@@ -49,10 +62,24 @@ function getArgDefs(cmd) {
             return [{ label: "Target URL", key: "url" }];
         case "status":
             return [{ label: "Job ID", key: "jobId" }];
+        case "diff":
+        case "triage":
+        case "explain":
+        case "fix-plan":
+        case "doc":
+        case "baseline":
+            return [{ label: "Audit job ID or JSON file", key: "auditSource" }];
+        case "compare":
+            return [
+                { label: "URL A", key: "urlA" },
+                { label: "URL B", key: "urlB" },
+            ];
         case "fix":
             return [{ label: "Job ID to fix", key: "jobId" }];
         case "suggest":
             return [{ label: "Describe the fix you need", key: "intent" }];
+        case "comment":
+            return [{ label: "Audit JSON file", key: "input" }];
         case "fix-all":
             return [
                 { label: "Job ID", key: "jobId" },
@@ -261,7 +288,7 @@ export class CommandRunnerView {
             });
         }
         // Set overrides so command handlers use our canvas renderer,
-        // don't steal stdin, and buffer their output instead of writing to stderr.
+        // don't steal stdin, and buffer their output instead of writing to stdout.
         this.status = "running";
         setRendererOverride(this.canvasRenderer);
         setKeyboardOverrideActive(true);
@@ -312,28 +339,39 @@ export class CommandRunnerView {
                 });
                 break;
             case "diff":
-                await handleDiff({});
+                await handleDiff(args.auditSource
+                    ? (() => {
+                        const source = resolveJobOrFile(args.auditSource);
+                        return source.file
+                            ? { fromFile: source.file }
+                            : { jobIdArg: source.job };
+                    })()
+                    : {});
                 break;
             case "compare":
-                await handleCompare({});
+                await handleCompare({
+                    urlA: args.urlA,
+                    urlB: args.urlB,
+                    wait: true,
+                });
                 break;
             case "triage":
-                await handleTriage({});
+                await handleTriage(resolveJobOrFile(args.auditSource));
                 break;
             case "explain":
-                await handleExplain({});
+                await handleExplain(resolveJobOrFile(args.auditSource));
                 break;
             case "fix-plan":
-                await handleFixPlan({});
+                await handleFixPlan(resolveJobOrFile(args.auditSource));
                 break;
             case "patch-review":
                 await handlePatchReview({});
                 break;
             case "doc":
-                await handleDoc({});
+                await handleDoc(resolveJobOrFile(args.auditSource));
                 break;
             case "comment":
-                await handleComment({});
+                await handleComment({ input: args.input });
                 break;
             case "release-notes":
                 await handleReleaseNotes({});
@@ -342,7 +380,12 @@ export class CommandRunnerView {
                 await handleInit({});
                 break;
             case "baseline":
-                await handleBaseline(undefined, {});
+                await (() => {
+                    const source = resolveJobOrFile(args.auditSource);
+                    return source.file
+                        ? handleBaseline(undefined, { fromFile: source.file })
+                        : handleBaseline(source.job, {});
+                })();
                 break;
             case "upload":
                 await handleUpload(undefined, {});

package/dist/app/views/help-overlay.d.ts

@@ -15,7 +15,7 @@ export declare class HelpOverlayView implements CommandView {
     constructor(onDismiss: () => void);
     /** Render the help overlay as a box */
     render(): string;
-    /** Handle H and Esc to dismiss the overlay */
+    /** Handle Esc to dismiss the overlay (F1 toggle handled at app level) */
     handleKey(key: string, _ctrl: boolean, _meta: boolean): boolean;
 }
 //# sourceMappingURL=help-overlay.d.ts.map

package/dist/app/views/help-overlay.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"help-overlay.d.ts","sourceRoot":"","sources":["../../../src/app/views/help-overlay.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAY/C;;;;GAIG;AACH,qBAAa,eAAgB,YAAW,WAAW;IACjD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAa;gBAE3B,SAAS,EAAE,MAAM,IAAI;IAIjC,uCAAuC;IACvC,MAAM,IAAI,MAAM;IAehB,8CAA8C;IAC9C,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO;CAOhE"}
+{"version":3,"file":"help-overlay.d.ts","sourceRoot":"","sources":["../../../src/app/views/help-overlay.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAY/C;;;;GAIG;AACH,qBAAa,eAAgB,YAAW,WAAW;IACjD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAa;gBAE3B,SAAS,EAAE,MAAM,IAAI;IAIjC,uCAAuC;IACvC,MAAM,IAAI,MAAM;IAehB,yEAAyE;IACzE,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO;CAQhE"}

package/dist/app/views/help-overlay.js

@@ -11,7 +11,7 @@ const DEFAULT_SHORTCUTS = [
     ["Enter", "Select / confirm"],
     ["/", "Start search (or type any character)"],
     ["Esc", "Clear search / go back"],
-    ["H", "Toggle this help overlay"],
+    ["F1", "Toggle this help overlay"],
     ["Ctrl+C", "Exit vertaa"],
 ];
 /**
@@ -34,12 +34,13 @@ export class HelpOverlayView {
         ].join("\n");
         return box(content, { padding: 1 });
     }
-    /** Handle H and Esc to dismiss the overlay */
+    /** Handle Esc to dismiss the overlay (F1 toggle handled at app level) */
     handleKey(key, _ctrl, _meta) {
-        if (key === "h" || key === "H" || key === "\x1b") {
+        if (key === "\x1b") {
             this.onDismiss();
             return true;
         }
-        return false;
+        // Consume all other keys while overlay is visible
+        return true;
     }
 }

package/dist/commands/a11y.d.ts

@@ -1,9 +1,11 @@
 /**
- * Legacy a11y command handler.
- * Runs accessibility-focused audit (alias for audit with a11y filter).
+ * A11y command handler.
+ * Runs a dedicated multi-engine accessibility audit via POST /v1/a11y/audit.
+ * Uses axe-core (101 WCAG rules) + @accesslint/core (structured fixes) + custom analyzers.
  */
 import type { Command } from "commander";
 import type { Flags } from "../types.js";
+export declare function runA11yAudit(base: string, url: string, flags: Flags): Promise<void>;
 export declare function handleA11y(rawUrl: string, cmdOptions: Flags): Promise<void>;
 export declare function registerA11yCommand(program: Command): void;
 //# sourceMappingURL=a11y.d.ts.map

package/dist/commands/a11y.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"a11y.d.ts","sourceRoot":"","sources":["../../src/commands/a11y.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKzC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAGzC,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAgDjF;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAuB1D"}
+{"version":3,"file":"a11y.d.ts","sourceRoot":"","sources":["../../src/commands/a11y.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAYzC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAqEzC,wBAAsB,YAAY,CAChC,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,KAAK,GACX,OAAO,CAAC,IAAI,CAAC,CAkDf;AAED,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAgDjF;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA0B1D"}

package/dist/commands/a11y.js

@@ -1,12 +1,82 @@
 /**
- * Legacy a11y command handler.
- * Runs accessibility-focused audit (alias for audit with a11y filter).
+ * A11y command handler.
+ * Runs a dedicated multi-engine accessibility audit via POST /v1/a11y/audit.
+ * Uses axe-core (101 WCAG rules) + @accesslint/core (structured fixes) + custom analyzers.
  */
 import { renderError, runSteps, createRenderer } from "@vertaaux/tui";
 import { ExitCode } from "../utils/exit-codes.js";
 import { parseMode, parseTimeout, parseInterval, parseScore } from "../utils/validators.js";
-import { resolveApiBase } from "../utils/api-client.js";
-import { runAuditCommand } from "./scan.js";
+import { resolveApiBase, getString, getNumber, resolveFormat, } from "../utils/api-client.js";
+import { apiRequest, getApiKey } from "../utils/client.js";
+import { printOutput } from "../utils/formatters.js";
+function formatA11yMarkdown(result) {
+    const lines = [
+        `## Accessibility Audit: ${result.url}`,
+        "",
+        `**Total findings:** ${result.total_findings}`,
+        `**Severity:** ${result.severity_counts.critical || 0} critical, ${result.severity_counts.serious || 0} serious, ${result.severity_counts.moderate || 0} moderate, ${result.severity_counts.minor || 0} minor`,
+    ];
+    if (result.tier_shaping) {
+        lines.push("", `> ${result.tier_shaping.gated_findings} additional findings available on a paid plan.`, `> Upgrade: ${result.tier_shaping.upgrade_url}`);
+    }
+    if (result.findings.length > 0) {
+        lines.push("", "### Findings", "");
+        for (const f of result.findings.slice(0, 20)) {
+            const wcag = f.wcagCriteria?.length ? ` [WCAG ${f.wcagCriteria.join(", ")}]` : "";
+            lines.push(`- **[${f.impact.toUpperCase()}]** \`${f.engineId}/${f.ruleId}\`${wcag}`);
+            lines.push(`  ${f.message}`);
+            lines.push(`  Element: \`${f.selector}\``);
+            if (f.fix?.suggestion) {
+                lines.push(`  Fix: ${f.fix.suggestion}`);
+            }
+            else if (f.fix?.attribute) {
+                lines.push(`  Fix: ${f.fix.type} ${f.fix.attribute}="${f.fix.value || ""}"`);
+            }
+            if (f.fixability) {
+                lines.push(`  Fixability: ${f.fixability}`);
+            }
+            lines.push("");
+        }
+        if (result.findings.length > 20) {
+            lines.push(`... and ${result.findings.length - 20} more findings.`);
+        }
+    }
+    return lines.join("\n");
+}
+export async function runA11yAudit(base, url, flags) {
+    const minImpact = getString(flags, "min-impact");
+    const mode = getString(flags, "mode");
+    const format = resolveFormat(flags);
+    const apiKey = getApiKey();
+    const body = { url, source: "cli" };
+    if (minImpact)
+        body.min_impact = minImpact;
+    if (mode)
+        body.mode = mode;
+    const result = await apiRequest(base, "/a11y/audit", { method: "POST", body }, apiKey);
+    // Compute an accessibility score from findings for --fail-on-score
+    // Starts at 100, subtracts 15 per critical, 10 per serious, 5 per moderate, 2 per minor
+    const counts = result.severity_counts;
+    const a11yScore = Math.max(0, 100 -
+        (counts.critical || 0) * 15 -
+        (counts.serious || 0) * 10 -
+        (counts.moderate || 0) * 5 -
+        (counts.minor || 0) * 2);
+    printOutput(format, { ...result, accessibility_score: a11yScore }, formatA11yMarkdown(result));
+    // Exit non-zero if --fail-on-score and computed score is below threshold
+    const failOnScore = getNumber(flags, "fail-on-score");
+    if (failOnScore !== undefined && a11yScore < failOnScore) {
+        process.exitCode = 1;
+    }
+    // Exit non-zero if --fail-on-findings and critical/serious findings exceed threshold
+    const failOnFindings = getNumber(flags, "fail-on-findings");
+    if (failOnFindings !== undefined) {
+        const criticalAndSerious = (counts.critical || 0) + (counts.serious || 0);
+        if (criticalAndSerious > failOnFindings) {
+            process.exitCode = 1;
+        }
+    }
+}
 export async function handleA11y(rawUrl, cmdOptions) {
     const url = /^https?:\/\//i.test(rawUrl) ? rawUrl : `https://${rawUrl}`;
     const renderer = createRenderer("auto");
@@ -27,11 +97,11 @@ export async function handleA11y(rawUrl, cmdOptions) {
     const steps = [
         {
             id: "a11y",
-            actionText: "Running accessibility audit...",
+            actionText: "Running multi-engine accessibility audit...",
             summaryText: "Accessibility audit complete",
             run: async () => {
                 const base = resolveApiBase(cmdOptions);
-                await runAuditCommand(base, url, { ...cmdOptions, wait: cmdOptions.wait ?? true }, "a11y");
+                await runA11yAudit(base, url, cmdOptions);
             },
         },
     ];
@@ -54,12 +124,15 @@ export async function handleA11y(rawUrl, cmdOptions) {
 export function registerA11yCommand(program) {
     program
         .command("a11y <url>")
-        .description("Run accessibility-focused audit (alias for audit with a11y filter)")
+        .description("Run multi-engine accessibility audit (axe-core + accesslint + custom analyzers)")
         .option("--mode <mode>", "Audit depth: basic|standard|deep", parseMode, "basic")
-        .option("--wait", "Wait for audit completion")
+        .option("--min-impact <level>", "Minimum impact level: minor|moderate|serious|critical")
+        .option("--fail-on-score <n>", "Exit non-zero if accessibility score below n (0-100)", parseScore)
+        .option("--fail-on-findings <n>", "Exit non-zero if critical+serious findings exceed n")
+        .option("--wait", "Wait for audit completion (default: true)")
         .option("--timeout <ms>", "Wait timeout in milliseconds (1-300000)", parseTimeout, 60000)
         .option("--interval <ms>", "Poll interval in milliseconds (1-300000)", parseInterval, 5000)
-        .option("--fail-on-score <n>", "Exit non-zero if score below n (0-100)", parseScore)
+        .option("--format <fmt>", "Output format: json|md", "json")
         .action(async (url, cmdOptions) => {
         try {
             await handleA11y(url, cmdOptions);

package/dist/commands/audit/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/audit/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AA+D7D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAuFtD;;GAEG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,mBAAmB,EAC5B,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,IAAI,CAAC,CA6Sf;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAyP3D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/audit/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AA+D7D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAwFtD;;GAEG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,mBAAmB,EAC5B,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,IAAI,CAAC,CA+Uf;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA0P3D"}

package/dist/commands/audit/index.js

@@ -29,13 +29,13 @@ import { normalizeIssues, filterBySeverity, filterByCategory } from "./filters.j
 import { mapStatusToPhase, getOverallScoreFromResult, extractNumericScores, countTotalIssues } from "./scoring.js";
 import { saveReproArtifacts, saveArtifactBundle } from "./artifacts.js";
 import { outputFireAndForget, outputFormattedResults, outputQualityGateResult } from "./output.js";
-import { loadAndResolvePolicy, buildQualityGateConfig } from "./policy.js";
+import { loadAndResolvePolicy, buildQualityGateConfig, resolveAuditProfile } from "./policy.js";
 import { runInlineExplanation } from "./explain.js";
 /**
  * Apply filters, evaluate quality gate, and output results after audit completes.
  */
 async function runPostAuditAnalysis(params) {
-    const { result, createdJobId, targetUrl, format, formatter, groupBy, options, config, interactive, quiet } = params;
+    const { result, createdJobId, targetUrl, format, formatter, groupBy, options, config, interactive, quiet, profile } = params;
     // Save repro artifacts if requested
     if (createdJobId) {
         saveReproArtifacts(createdJobId, result, options, quiet);
@@ -49,8 +49,8 @@ async function runPostAuditAnalysis(params) {
     const filteredResult = { ...result, issues };
     // Load and apply policy (CICD-17)
     await loadAndResolvePolicy(options, quiet);
-    // Build quality gate config and evaluate
-    const gateConfig = buildQualityGateConfig(config, options);
+    // Build quality gate config and evaluate (profile applied between config and CLI flags)
+    const gateConfig = buildQualityGateConfig(config, options, profile);
     const baselinePath = options.baseline || config.baseline?.path;
     const baseline = baselinePath ? await loadBaseline(baselinePath) : null;
     const prLabels = detectPRLabels();
@@ -114,8 +114,10 @@ export async function handleAudit(rawUrl, options, config) {
         process.exitCode = ExitCode.ERROR;
         return;
     }
-    // Resolve options with precedence: flags > env > config > defaults
-    const mode = options.mode || config.mode || "basic";
+    // Resolve audit profile (bundles categories, weights, thresholds, mode)
+    const profile = resolveAuditProfile(options.profile || config.profile, config.profiles);
+    // Resolve options with precedence: flags > config > profile > defaults
+    const mode = options.mode || config.mode || profile?.mode || "basic";
     const timeout = options.timeout || config.timeout || 60000;
     const interval = options.interval || config.interval || 5000;
     const wait = options.wait ?? true; // Default to waiting for completion
@@ -219,8 +221,29 @@ export async function handleAudit(rawUrl, options, config) {
                     createdJobId = created.job_id;
                 }
                 else {
-                    // Public URL — send to cloud API
-                    const created = await sdkClient.audits.create({ url: targetUrl, mode: mode });
+                    // Public URL — send to cloud API.
+                    //
+                    // When the resolved profile declares a `categories` subset, we bypass
+                    // `sdkClient.audits.create` and POST directly via `apiRequest`
+                    // because the published @vertaaux/sdk typings don't yet include the
+                    // `categories` field (Phase 1.5 wire format). The wire format is
+                    // identical to the SDK's — same path, same auth — so this is a
+                    // targeted escape hatch, not a fork. Once the SDK typings are bumped
+                    // to include `categories?`, both branches collapse back to the SDK.
+                    const profileCategories = profile?.categories;
+                    const created = profileCategories && profileCategories.length > 0
+                        ? await apiRequest(base, "/audit", {
+                            method: "POST",
+                            body: {
+                                url: targetUrl,
+                                mode: mode,
+                                categories: profileCategories,
+                            },
+                        }, apiKey)
+                        : await sdkClient.audits.create({
+                            url: targetUrl,
+                            mode: mode,
+                        });
                     auditResult = created;
                     createdJobId = created.job_id;
                     // If not waiting, just output the job info and stop processing.
@@ -352,6 +375,7 @@ export async function handleAudit(rawUrl, options, config) {
             config,
             interactive,
             quiet,
+            profile,
         });
     }
 }
@@ -415,6 +439,7 @@ export function registerAuditCommand(program) {
         .option("--json-logs", "Output structured JSON logs for CI")
         // Policy options (CICD-17)
         .option("--policy <file>", "Path to policy file (default: auto-detect vertaa.policy.yml)")
+        .option("--profile <name>", "Audit profile: wcag-aa|conversion-focus|quick-ux|ci-gate|compliance")
         .option("--explain", "Append AI explanation to audit results")
         .option("--strict", "Fail immediately on first step error")
         .option("--continue-on-error", "Continue on step errors even in CI")