@weft-js/cli 0.1.1 → 0.1.2

package/src/agents-md.mjs

@@ -1,5 +1,5 @@
 // `weft agents-md`: AGENTS.md generated from the installed weft (exports, the codes its compiler reports) and this
-// project's tasks. Under 8 KB (PLAN §7). Never edited by hand: `--check` fails when it is stale.
+// project's tasks. Under 9 KB (PLAN §7, raised from 8 KB in 2026-11). Never edited by hand: `--check` fails when it is stale.
 
 import { existsSync, readFileSync, writeFileSync } from 'node:fs'
 import { join, resolve } from 'node:path'
@@ -10,32 +10,69 @@ import { loadConfig } from './load-config.mjs'
 import { agentsSection } from './contributions.mjs'
 import { tasks } from './tasks.mjs'
 
-export const limit = 8 * 1024
+export const limit = 9 * 1024
 
 /** `T001, T002, T003, P007` → `T001–T003, P007`: runs of consecutive codes as ranges (three or more). */
 export function ranges(codes) {
   const out = []
-  for (let i = 0; i < codes.length; ) {
+  for (let i = 0; i < codes.length;) {
     let j = i
-    const num = c => Number(c.slice(1))
-    while (j + 1 < codes.length && codes[j + 1][0] === codes[i][0] && num(codes[j + 1]) === num(codes[j]) + 1) j++
+    const num = (c) => Number(c.slice(1))
+    while (
+      j + 1 < codes.length &&
+      codes[j + 1][0] === codes[i][0] &&
+      num(codes[j + 1]) === num(codes[j]) + 1
+    )
+      j++
     out.push(j - i >= 2 ? `${codes[i]}–${codes[j]}` : codes.slice(i, j + 1).join(', '))
     i = j + 1
   }
   return out.join(', ')
 }
 /** PLAN §3.1 primitives an agent may reach for; listed as missing when the installed weft doesn't export them. */
-const planned = ['state', 'derived', 'resource', 'Boundary', 'watch', 'onMount', 'onCleanup', 'context', 'defineState', 'flush', 'untrack', 'batch']
+const planned = [
+  'state',
+  'derived',
+  'resource',
+  'Boundary',
+  'watch',
+  'onMount',
+  'onCleanup',
+  'context',
+  'defineState',
+  'flush',
+  'untrack',
+  'batch',
+]
 /** Commands AGENTS.md leaves to `weft tasks --json`: rarely run by hand, or taught in their own section. */
-const elsewhere = new Set(['agents-md', 'doctor', 'mcp', 'plugins', 'start', 'style', 'surfaces', 'tasks', 'tokens'])
+const elsewhere = new Set([
+  'agents-md',
+  'doctor',
+  'mcp',
+  'plugins',
+  'start',
+  'style',
+  'surfaces',
+  'tasks',
+  'tokens',
+])
 /** The app-facing part of subpaths whose other exports are helpers compiled code calls. */
-const entryPoints = { '@weft-js/core/dom': ['render', 'hydrate'], '@weft-js/core/ssr': ['renderToString', 'renderToStringAsync'], '@weft-js/core/browser': ['online', 'visible', 'lifecycle', 'media', 'on', 'interval'] }
+const entryPoints = {
+  '@weft-js/core/dom': ['render', 'hydrate'],
+  '@weft-js/core/ssr': ['renderToString', 'renderToStringAsync'],
+  '@weft-js/core/browser': ['online', 'visible', 'lifecycle', 'media', 'on', 'interval'],
+}
 
 /** The Full stack section, with this app's alias for its source. */
 function fullStack(root) {
   const alias = sourceAlias(root)
   const text = readDoc('start-short')
-  return alias ? text.replaceAll('#/', alias) : text.replace(/ Import your own code as [^(]*\(`src\/server\/todos`\); generated files are/, ' Generated files are')
+  return alias
+    ? text.replaceAll('#/', alias)
+    : text.replace(
+        / Import your own code as [^(]*\(`src\/server\/todos`\); generated files are/,
+        ' Generated files are',
+      )
 }
 
 /** This project's AGENTS.md, written from what the installed weft reports: the text, where it goes, and whether weft's own part is over the limit. */
@@ -43,18 +80,39 @@ export async function agentsMd(root) {
   root = resolve(root)
   const info = installed(root)
   const list = await tasks(root)
-  const sections = (await loadConfig(root)).contributions.filter(c => c.manifest.agents).map(c => agentsSection(c.manifest.agents))
+  const sections = (await loadConfig(root)).contributions
+    .filter((c) => c.manifest.agents)
+    .map((c) => agentsSection(c.manifest.agents))
   const core = info.exports['@weft-js/core'] ?? []
-  const missing = planned.filter(n => !core.includes(n))
+  const missing = planned.filter((n) => !core.includes(n))
 
   // Style-group codes (D0xx, W060) and `weft style` belong to the Styling section, which only a weft with @weft-js/core/style gets.
   const styled = info.exports['@weft-js/core/style']?.includes('group')
-  const dcodes = catalog.filter(e => e.code.startsWith('D0') && (e.by === 'cli' || info.status[e.code]?.implemented)).map(e => e.code).sort()
+  const dcodes = catalog
+    .filter((e) => e.code.startsWith('D0') && (e.by === 'cli' || info.status[e.code]?.implemented))
+    .map((e) => e.code)
+    .sort()
   const startApp = existsSync(join(root, 'src', 'routes'))
-  const tcodes = catalog.filter(e => e.code.startsWith('T') && info.status[e.code]?.implemented).map(e => e.code)
+  const tcodes = catalog
+    .filter((e) => e.code.startsWith('T') && info.status[e.code]?.implemented)
+    .map((e) => e.code)
+
+  const text = page({ root, info, core, missing, tcodes, startApp, styled, dcodes, list }, sections)
+  const bytes = Buffer.byteLength(text)
+  // the limit is weft's own text: plugin sections have their own 1 KB each (P112) on top
+  return {
+    path: join(root, 'AGENTS.md'),
+    text,
+    bytes,
+    overLimit:
+      Buffer.byteLength(
+        page({ root, info, core, missing, tcodes, startApp, styled, dcodes, list }, []),
+      ) > limit,
+  }
+}
 
-  // with plugins: the `weft plugins` command and their sections; without, neither
-  const page = plugins => [
+function pageIntro({ root, info, core, missing }) {
+  return [
     `# AGENTS.md`,
     '',
     `<!-- Generated by \`weft agents-md\` from weft@${info.weft.version}. Do not edit: change weft.config.ts and regenerate. -->`,
@@ -63,50 +121,98 @@ export async function agentsMd(root) {
     `React hooks don't exist. Run \`weft check --json\` after every change; each diagnostic gives code, location, why and fix.`,
     '',
     'Start with `.weft/map.md` (`weft map`): what this app has and what to call.',
+    ...(existsSync(join(root, 'src', 'theme.css'))
+      ? ['', "`src/theme.css` is this app's CSS; `weft docs theme` changes the look."]
+      : []),
     '',
     '## Rules',
     '',
     readDoc('rules'),
     ...(core.includes('resource')
-      ? ['10. **Async data is `resource(signal => fetch(…))`** (`.value .pending .error .refresh()`), never `derived(async …)` (W012).',
-         core.includes('Boundary') ? '    Loading and errors: `<Boundary pending={…} error={(e, retry) => …}>`. More: `weft docs async`.' : '']
+      ? [
+          '10. **Async data is `resource(signal => fetch(…))`** (`.value .pending .error .refresh()`), never `derived(async …)` (W012).',
+          core.includes('Boundary')
+            ? '    Loading and errors: `<Boundary pending={…} error={(e, retry) => …}>`.'
+            : '',
+        ]
       : []),
     '',
     '**Leave props untyped**: `weft docs props`.',
     '',
     `## API in weft@${info.weft.version}`,
     '',
-    `- \`@weft-js/core\`: ${core.filter(n => planned.includes(n)).map(n => `\`${n}\``).join(', ')}` + (core.includes('state') ? ', `state.linked`' : ''),
-    ...['@weft-js/core/dom', '@weft-js/core/ssr'].map((mod, i, all) => {
-      const names = entryPoints[mod].filter(n => info.exports[mod]?.includes(n))
-      const last = all.slice(i + 1).every(m => !entryPoints[m].some(n => info.exports[m]?.includes(n)))
-      return names.length ? `- \`${mod}\`: ${names.map(n => `\`${n}\``).join(', ')}.${last ? ' Never import the rest.' : ''}` : ''
-    }).filter(Boolean),
-    info.exports['@weft-js/core/browser'] ? `- \`@weft-js/core/browser\`: ${entryPoints['@weft-js/core/browser'].filter(n => info.exports['@weft-js/core/browser'].includes(n)).map(n => `\`${n}\``).join(', ')}. Create them in setup (W051); server-rendered \`media\` needs \`ssr\` (W054). More: \`weft docs browser\`; hover and press as state: \`weft docs ui-state\`.` : '',
-    info.exports['@weft-js/core/surface'] ? '- `@weft-js/core/surface`: canvas and WebGL, never raw `<canvas>`: `weft docs surface`.' : '',
-    info.exports['@weft-js/core/test'] ? `- \`@weft-js/core/test\`: ${info.exports['@weft-js/core/test'].filter(n => !['canvasCalls', 'cleanup', 'fakeMeasure', 'leaks'].includes(n)).map(n => `\`${n}\``).join(', ')}, and \`expect(fn).toTouchAtMost(n, { runs })\`. Query by role/label/text; \`user\` actions and \`clock.advance\` end in \`flush()\`, so never sleep or \`waitFor\`.` : '',
-    missing.length ? `- Not in this version yet: ${missing.map(n => `\`${n}\``).join(', ')}. Don't import them.` : '',
+    `- \`@weft-js/core\`: ${core
+      .filter((n) => planned.includes(n))
+      .map((n) => `\`${n}\``)
+      .join(', ')}` + (core.includes('state') ? ', `state.linked`' : ''),
+    ...['@weft-js/core/dom', '@weft-js/core/ssr']
+      .map((mod, i, all) => {
+        const names = entryPoints[mod].filter((n) => info.exports[mod]?.includes(n))
+        const last = all
+          .slice(i + 1)
+          .every((m) => !entryPoints[m].some((n) => info.exports[m]?.includes(n)))
+        return names.length
+          ? `- \`${mod}\`: ${names.map((n) => `\`${n}\``).join(', ')}.${last ? ' Never import the rest.' : ''}`
+          : ''
+      })
+      .filter(Boolean),
+    info.exports['@weft-js/core/browser']
+      ? `- \`@weft-js/core/browser\`: ${entryPoints['@weft-js/core/browser']
+          .filter((n) => info.exports['@weft-js/core/browser'].includes(n))
+          .map((n) => `\`${n}\``)
+          .join(
+            ', ',
+          )}. Create them in setup (W051); server-rendered \`media\` needs \`ssr\` (W054). More: \`weft docs browser\`; hover and press as state: \`weft docs ui-state\`.`
+      : '',
+    info.exports['@weft-js/core/surface']
+      ? '- `@weft-js/core/surface`: canvas and WebGL, never raw `<canvas>`: `weft docs surface`.'
+      : '',
+    info.exports['@weft-js/core/test']
+      ? `- \`@weft-js/core/test\`: ${info.exports['@weft-js/core/test']
+          .filter((n) => !['canvasCalls', 'cleanup', 'fakeMeasure', 'leaks'].includes(n))
+          .map((n) => `\`${n}\``)
+          .join(
+            ', ',
+          )}, and \`expect(fn).toTouchAtMost(n, { runs })\`. Query by role/label/text; \`user\` actions and \`clock.advance\` end in \`flush()\`, so never sleep or \`waitFor\`.`
+      : '',
+    missing.length
+      ? `- Not in this version yet: ${missing.map((n) => `\`${n}\``).join(', ')}. Don't import them.`
+      : '',
     '',
+  ]
+}
+
+// with plugins: the `weft plugins` command and their sections; without, neither
+function page({ root, info, core, missing, tcodes, startApp, styled, dcodes, list }, plugins) {
+  return [
+    ...pageIntro({ root, info, core, missing }),
     '## Diagnostics',
     '',
-    '`weft docs <code>` explains one. Also flagged: raw `addEventListener`, `setInterval` or sockets with no cleanup (W050), and a `watch` that folds a stream (W052) or copies a live value into `state` (W056).',
+    '`weft docs <code>` explains one. Also flagged: an early `return` in a `.map` callback (W013), raw `addEventListener`, `setInterval` or sockets with no cleanup (W050), and a `watch` that folds a stream (W052) or copies a live value into `state` (W056).',
     '',
-    tcodes.length ? `Test checks (\`weft check\` on test files): ${ranges(tcodes)}. No assertion, tautologies, sleeps, \`container\`/selectors/test ids, mocking weft, snapshots, conditional \`expect\`, \`.only\`/\`.skip\`. To allow one: \`// weft-allow T00x: <reason>\`.` : '',
+    tcodes.length
+      ? `Test checks (\`weft check\` on test files): ${ranges(tcodes)}. No assertion, tautologies, sleeps, \`container\`/selectors/test ids, mocking weft, snapshots, conditional \`expect\`, \`.only\`/\`.skip\`. To allow one: \`// weft-allow T00x: <reason>\`.`
+      : '',
     '',
-    'Before a change is done, see it work (`weft browser snapshot|act|assert`, or `__weft__.agent` in your own browser) and run `weft test --gate`: new tests must fail on the old code and kill a mutant (T010, T011, T020). `weft build` ends by auditing the pages it built at a phone\'s and a desktop\'s width (L-codes: names, contrast, console, the head, sideways scroll, layout shift) and fails on an error; `weft audit --url <deploy>` checks a live site. More: `weft docs verify`.',
+    "Before a change is done, see it work (`weft browser snapshot|act|assert`, or `__weft__.agent` in your own browser) and run `weft test --gate`: new tests must fail on the old code and kill a mutant (T010, T011, T020). `weft build` ends by auditing the pages it built at a phone's and a desktop's width (L-codes: names, contrast, console, the head, sideways scroll, layout shift) and fails on an error; `weft audit --url <deploy>` checks a live site. More: `weft docs verify`.",
     '',
-    ...(startApp
-      ? ['## Full stack', '', fullStack(root), '']
-      : []),
+    'Before publishing, choose `build.audit.indexing`: `public` makes noindex an error; `private` preserves intentional exclusions. Audit the actual deployed URL with `weft audit --url <url> --indexing public` for public search: a proxy header can override correct markup. Never remove private indexing directives just to improve a score.',
+    '',
+    ...(startApp ? ['## Full stack', '', fullStack(root), ''] : []),
     ...(styled
-      ? ['## Styling',
-         '',
-         `**Run \`weft style find <what it is>\` first**, then reuse a group or add an axis value; never class lists. New: \`const card = group('card', { base: { pad: 'group' }, axes: { status: { late: { tone: 'critical' } } } })\` from \`@weft-js/core/style\`, \`<li {...card({ status })}>\`. Tokens only. ${ranges(dcodes)}, W060: \`weft docs style\`, \`weft docs design\`; \`weft fix\` applies the safe fixes.`,
-         '']
+      ? [
+          '## Styling',
+          '',
+          `**Run \`weft style find <what it is>\` first**, then reuse a group or add an axis value; never class lists. New: \`const card = group('card', { base: { pad: 'group' }, axes: { status: { late: { tone: 'critical' } } } })\` from \`@weft-js/core/style\`, \`<li {...card({ status })}>\`. Tokens only. ${ranges(dcodes)}, W060: \`weft docs style\`, \`weft docs design\`; \`weft fix\` applies the safe fixes.`,
+          '',
+        ]
       : []),
     '## Commands',
     '',
-    commandsPage({ ...list, tasks: list.tasks.filter(t => !elsewhere.has(t.name)) }, { planned: false }),
+    commandsPage(
+      { ...list, tasks: list.tasks.filter((t) => !elsewhere.has(t.name)) },
+      { planned: false },
+    ),
     '',
     '`weft tasks --json` lists the rest.',
     '',
@@ -118,11 +224,6 @@ export async function agentsMd(root) {
   ]
     .filter((line, i, all) => !(line === '' && all[i - 1] === ''))
     .join('\n')
-
-  const text = page(sections)
-  const bytes = Buffer.byteLength(text)
-  // the limit is weft's own text: plugin sections have their own 1 KB each (P112) on top
-  return { path: join(root, 'AGENTS.md'), text, bytes, overLimit: Buffer.byteLength(page([])) > limit }
 }
 
 /** Write AGENTS.md, or with `check` only compare. Returns whether the file on disk was current. */

package/src/alias.mjs

@@ -18,13 +18,20 @@ function rulesIn(dir) {
   const tsconfig = join(dir, 'tsconfig.json')
   if (existsSync(tsconfig)) {
     const host = { ...ts.sys, readDirectory: () => [] }
-    const { options } = ts.parseJsonConfigFileContent(ts.readConfigFile(tsconfig, path => ts.sys.readFile(path)).config, host, dir)
+    const { options } = ts.parseJsonConfigFileContent(
+      ts.readConfigFile(tsconfig, (path) => ts.sys.readFile(path)).config,
+      host,
+      dir,
+    )
     const base = options.pathsBasePath ?? options.baseUrl ?? dir
-    for (const [pattern, [target]] of Object.entries(options.paths ?? {})) add(pattern, resolve(base, target))
+    for (const [pattern, [target]] of Object.entries(options.paths ?? {}))
+      add(pattern, resolve(base, target))
   }
   const pkg = join(dir, 'package.json')
   if (existsSync(pkg)) {
-    for (const [pattern, target] of Object.entries(JSON.parse(readFileSync(pkg, 'utf8')).imports ?? {})) {
+    for (const [pattern, target] of Object.entries(
+      JSON.parse(readFileSync(pkg, 'utf8')).imports ?? {},
+    )) {
       if (typeof target === 'string' && target.startsWith('.')) add(pattern, resolve(dir, target))
     }
   }
@@ -46,7 +53,9 @@ export function local(fromAbs, spec) {
   if (spec.startsWith('.')) return join(dirname(fromAbs), spec)
   for (const { prefix, suffix, exact, target } of rulesFor(dirname(fromAbs))) {
     if (exact ? spec === prefix : spec.startsWith(prefix) && spec.endsWith(suffix)) {
-      return exact ? target : target.replace('*', spec.slice(prefix.length, spec.length - suffix.length))
+      return exact
+        ? target
+        : target.replace('*', spec.slice(prefix.length, spec.length - suffix.length))
     }
   }
   return null
@@ -54,6 +63,8 @@ export function local(fromAbs, spec) {
 
 /** The prefix that maps to `<root>/src/`, like `#/`; null when the app has none. */
 export function sourceAlias(root) {
-  const rule = rulesFor(resolve(root)).find(r => r.target === join(resolve(root), 'src', '*') && !r.suffix)
+  const rule = rulesFor(resolve(root)).find(
+    (r) => r.target === join(resolve(root), 'src', '*') && !r.suffix,
+  )
   return rule?.prefix ?? null
 }

package/src/audit/page.mjs

@@ -0,0 +1,313 @@
+import { readFileSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+import { fail, sleep } from './utils.mjs'
+
+/**
+ * axe-core is what Lighthouse runs for Accessibility and for Agentic Browsing's accessibility tree: the WCAG 2 A and AA
+ * rules, and the best-practice ones Lighthouse also grades. `region` (all content in landmarks) Lighthouse leaves out.
+ */
+const AXE = {
+  runOnly: { type: 'tag', values: ['wcag2a', 'wcag2aa', 'wcag21a', 'wcag21aa', 'wcag22aa'] },
+  rules: {
+    'heading-order': { enabled: true },
+    'empty-heading': { enabled: true },
+    tabindex: { enabled: true },
+    'duplicate-id-aria': { enabled: true },
+    'image-redundant-alt': { enabled: true },
+    'skip-link': { enabled: true },
+    'landmark-one-main': { enabled: true },
+    list: { enabled: true },
+    listitem: { enabled: true },
+    region: { enabled: false },
+  },
+  resultTypes: ['violations'],
+}
+/** axe rules with a code of their own; every other violation is L004, with the rule's id. */
+const RULES = {
+  ...Object.fromEntries(
+    [
+      'button-name',
+      'link-name',
+      'input-button-name',
+      'label',
+      'select-name',
+      'aria-command-name',
+      'aria-input-field-name',
+      'aria-toggle-field-name',
+      'aria-progressbar-name',
+      'aria-meter-name',
+      'aria-tooltip-name',
+      'aria-treeitem-name',
+      'aria-dialog-name',
+      'frame-title',
+      'summary-name',
+    ].map((r) => [r, 'L001']),
+  ),
+  ...Object.fromEntries(
+    ['image-alt', 'role-img-alt', 'svg-img-alt', 'input-image-alt', 'object-alt', 'area-alt'].map(
+      (r) => [r, 'L002'],
+    ),
+  ),
+  'color-contrast': 'L003',
+}
+let axe
+const axeSource = () =>
+  (axe ??= readFileSync(fileURLToPath(import.meta.resolve('axe-core/axe.min.js')), 'utf8'))
+/** The issue types Lighthouse's `inspector-issues` audit counts (low contrast is axe's, as L003). */
+const ISSUES = new Set([
+  'MixedContentIssue',
+  'CookieIssue',
+  'BlockedByResponseIssue',
+  'HeavyAdIssue',
+  'ContentSecurityPolicyIssue',
+  'SharedArrayBufferIssue',
+  'CorsIssue',
+  'AttributionReportingIssue',
+  'QuirksModeIssue',
+  'FederatedAuthRequestIssue',
+  'BounceTrackingIssue',
+  'StylesheetLoadingIssue',
+])
+
+/** In the page: how far the layout moved without a person asking (CLS, summed), and the first elements that moved. */
+const SHIFT = `new Promise(ok => {
+  let cls = 0
+  const moved = []
+  new PerformanceObserver(list => {
+    for (const e of list.getEntries()) {
+      if (e.hadRecentInput) continue
+      cls += e.value
+      for (const s of e.sources ?? []) {
+        if (!s.node || s.node.nodeType !== 1 || moved.length === 3) continue
+        const open = s.node.outerHTML.slice(0, s.node.outerHTML.indexOf('>') + 1)
+        moved.push(open.length > 120 ? open.slice(0, 117) + '…>' : open)
+      }
+    }
+  }).observe({ type: 'layout-shift', buffered: true })
+  setTimeout(() => ok({ cls: Math.round(cls * 1000) / 1000, moved }), 50)
+})`
+
+/** In the page: what a crawler reads from the head, and what pokes past a phone's right edge. */
+const HEAD = `(() => {
+  const meta = n => document.querySelector('meta[name="' + n + '"]')?.getAttribute('content')?.trim() ?? null
+  const wide = []
+  const edge = innerWidth + 1
+  if (document.documentElement.scrollWidth > edge) {
+    for (const el of document.body.querySelectorAll('*')) {
+      const r = el.getBoundingClientRect()
+      if (r.right > edge && r.width > 0 && getComputedStyle(el).position !== 'fixed' && !(el.parentElement && el.parentElement.getBoundingClientRect().right > edge)) {
+        const open = el.outerHTML.slice(0, el.outerHTML.indexOf('>') + 1)
+        wide.push(open.length > 120 ? open.slice(0, 117) + '…>' : open)
+        if (wide.length === 3) break
+      }
+    }
+  }
+  return {
+    title: document.title.trim(), lang: document.documentElement.getAttribute('lang') ?? '', description: meta('description'),
+    viewport: meta('viewport'), robots: meta('robots'), scroll: document.documentElement.scrollWidth - innerWidth, wide,
+    icon: !!document.querySelector('link[rel~="icon"]'),
+  }
+})()`
+
+function listenPage({ browser, sessionId, found, statics, served, loaded, document }) {
+  const where = (u, line) =>
+    u
+      ? `${u.replace(/^https?:\/\/127\.0\.0\.1:\d+/, '')}${line === undefined ? '' : `:${line + 1}`}`
+      : ''
+  const off = browser.on((m) => {
+    if (m.sessionId !== sessionId) return
+    const p = m.params
+    if (m.method === 'Page.loadEventFired') loaded()
+    else if (m.method === 'Network.responseReceived' && p.type === 'Document' && !document.value)
+      document.value = p.response
+    else if (m.method === 'Runtime.exceptionThrown') {
+      const d = p.exceptionDetails
+      found.push({
+        code: 'L010',
+        key: d.exception?.description?.split('\n')[0] ?? d.text,
+        at: where(d.url, d.lineNumber),
+        text: d.exception?.description?.split('\n')[0] ?? d.text,
+      })
+    } else if (
+      m.method === 'Runtime.consoleAPICalled' &&
+      (p.type === 'error' || p.type === 'assert')
+    ) {
+      const text = p.args
+        .map((a) => a.value ?? a.description ?? '')
+        .join(' ')
+        .split('\n')[0]
+      const top = p.stackTrace?.callFrames?.[0]
+      found.push({ code: 'L010', key: text, at: where(top?.url, top?.lineNumber), text })
+    } else if (m.method === 'Log.entryAdded' && p.entry.level === 'error') {
+      // a build's pages served as files have no server: its realtime and function routes answer 404 here and nowhere else
+      if (statics && /\/_weft\/(rt|ws|fn|data|m|x)\b/.test(`${p.entry.url ?? ''} ${p.entry.text}`))
+        return
+      if (
+        statics &&
+        p.entry.url &&
+        /status of 404/.test(p.entry.text) &&
+        served(new URL(p.entry.url).pathname)
+      )
+        return
+      // the favicon: Chrome asks for it lazily, once a session, so the head probe asks instead (below)
+      if ((p.entry.url ?? '').endsWith('/favicon.ico')) return
+      found.push({
+        code: 'L011',
+        key: `${p.entry.url ?? ''} ${p.entry.text}`,
+        at: where(p.entry.url),
+        text: p.entry.text,
+      })
+    } else if (m.method === 'Audits.issueAdded') {
+      const { code, details } = p.issue
+      if (code === 'DeprecationIssue') {
+        const d = details.deprecationIssueDetails
+        found.push({
+          code: 'L012',
+          key: d.type,
+          at: where(d.sourceCodeLocation?.url, d.sourceCodeLocation?.lineNumber),
+          text: d.type,
+        })
+      } else if (ISSUES.has(code))
+        found.push({
+          code: 'L013',
+          key: code,
+          text: code.replace(/Issue$/, '').replace(/([a-z])([A-Z])/g, '$1 $2'),
+        })
+    }
+  })
+  return off
+}
+
+async function inspectHead(send, document, f, found) {
+  if (document.value && document.value.status >= 400)
+    found.push({
+      code: 'L025',
+      key: String(document.value.status),
+      text: `HTTP ${document.value.status}`,
+    })
+  const header = Object.entries(document.value?.headers ?? {}).find(
+    ([k]) => k.toLowerCase() === 'x-robots-tag',
+  )?.[1]
+  const head = (await send('Runtime.evaluate', { expression: HEAD, returnByValue: true })).result
+    .value
+  if (!head.icon) {
+    const status = (
+      await send('Runtime.evaluate', {
+        expression: `fetch('/favicon.ico', { method: 'HEAD' }).then(r => r.status, () => 0)`,
+        awaitPromise: true,
+        returnByValue: true,
+      })
+    ).result.value
+    if (status >= 400)
+      found.push({ code: 'L011', key: 'favicon', at: '/favicon.ico', text: `HTTP ${status}` })
+  }
+  if (!head.title) found.push({ code: 'L020', key: 'title' })
+  if (!head.description) found.push({ code: 'L021', key: 'description' })
+  if (!head.lang) found.push({ code: 'L022', key: 'lang' })
+  if (!head.viewport || !/width=device-width/.test(head.viewport))
+    found.push({ code: 'L023', key: 'viewport' })
+  const noindex = [
+    header && /noindex|none/i.test(header) && `the \`x-robots-tag: ${header}\` header`,
+    head.robots &&
+      /noindex|none/i.test(head.robots) &&
+      `<meta name="robots" content="${head.robots}">`,
+  ].filter(Boolean)
+  if (noindex.length)
+    found.push({
+      code: 'L024',
+      key: noindex.join(),
+      text: noindex.join(' and '),
+      header: !!header,
+    })
+  if (f.mobile && head.scroll > 0)
+    found.push({
+      code: 'L030',
+      key: head.wide.join() || 'page',
+      text: `${head.scroll}px`,
+      wide: head.wide,
+    })
+}
+
+async function inspectAxe(send, url, found) {
+  await send('Runtime.evaluate', { expression: axeSource() })
+  const { result, exceptionDetails } = await send('Runtime.evaluate', {
+    expression: `axe.run(document, ${JSON.stringify(AXE)}).then(r => r.violations)`,
+    awaitPromise: true,
+    returnByValue: true,
+  })
+  if (exceptionDetails)
+    throw fail(
+      'E_AUDIT',
+      `axe-core failed on ${url}: ${exceptionDetails.exception?.description ?? exceptionDetails.text}`,
+    )
+  for (const v of result.value) {
+    for (const n of v.nodes) {
+      const tag = n.html.slice(0, n.html.indexOf('>') + 1)
+      found.push({
+        code: RULES[v.id] ?? 'L004',
+        key: `${v.id} ${n.target.join(' ')}`,
+        rule: v.id,
+        help: v.help,
+        fix: n.failureSummary
+          ?.replace(/^Fix (any|all) of the following:\s*/, '')
+          .split('\n')[0]
+          .trim(),
+        selector: n.target.join(' '),
+        tag: tag.length > 160 ? `${tag.slice(0, 157)}…>` : tag,
+        contrast: v.id === 'color-contrast' ? n.any[0]?.data : undefined,
+      })
+    }
+  }
+}
+
+/** Audit one page in one form factor: what Chrome said while it loaded, its head, its layout, and axe-core's rules. */
+export async function auditPage({ browser, url, form, statics, served, forms }) {
+  const { targetId } = await browser.send('Target.createTarget', { url: 'about:blank' })
+  const { sessionId } = await browser.send('Target.attachToTarget', { targetId, flatten: true })
+  const send = (m, p) => browser.send(m, p, sessionId)
+  const found = []
+  const document = { value: null }
+  let loaded
+  const load = new Promise((ok) => {
+    loaded = ok
+  })
+  const off = listenPage({ browser, sessionId, found, statics, served, loaded, document })
+
+  try {
+    const f = forms[form]
+    await Promise.all(
+      ['Page.enable', 'Runtime.enable', 'Log.enable', 'Network.enable', 'Audits.enable'].map((m) =>
+        send(m),
+      ),
+    )
+    await send('Emulation.setDeviceMetricsOverride', {
+      width: f.width,
+      height: f.height,
+      deviceScaleFactor: f.deviceScaleFactor,
+      mobile: f.mobile,
+    })
+    await send('Emulation.setTouchEmulationEnabled', {
+      enabled: f.mobile,
+      maxTouchPoints: f.mobile ? 5 : 1,
+    })
+    await send('Page.navigate', { url })
+    await Promise.race([load, sleep(15_000)])
+    await sleep(800) // hydration's errors, and a font swap's shift, land after load
+    await inspectHead(send, document, f, found)
+    const shift = (
+      await send('Runtime.evaluate', { expression: SHIFT, awaitPromise: true, returnByValue: true })
+    ).result.value
+    if (shift.cls > 0.05)
+      found.push({
+        code: 'L031',
+        key: shift.moved.join() || 'page',
+        cls: shift.cls,
+        moved: shift.moved,
+      })
+    await inspectAxe(send, url, found)
+    return found
+  } finally {
+    off()
+    await browser.send('Target.closeTarget', { targetId }).catch(() => {})
+  }
+}