a11ign 0.1.0

package/dist/scan/axe.js

@@ -0,0 +1,203 @@
+/**
+ * Rule-based layer (ADR 0002): run axe-core over a page and return its
+ * WCAG-tagged violations. This is the deterministic, mechanical/visual layer
+ * (contrast, colour, ARIA, parsing, names/roles) that a screen-reader
+ * read-through cannot perceive. It complements the lived-experience judge; it
+ * does not replace it.
+ *
+ * Scoped to WCAG A/AA to match @a11ign/evidence/wcag and the legal baseline.
+ *
+ * OPTIONAL. Playwright and @axe-core/playwright are optionalDependencies: the layer is
+ * ~100 lines and about a second of wall-clock, but it pulls half a gigabyte of Chromium,
+ * which is a poor trade for anyone who already runs axe in their own pipeline. So the
+ * imports are dynamic and their absence is a supported state, not a crash. The
+ * lived-experience layer — the part only this project does — never depends on them.
+ */
+/**
+ * A/AA across WCAG 2.0/2.1/2.2 (axe tags conformance level + version).
+ *
+ * EXPORTED so a test can hold it against what axe-core actually offers. Verified 2026-08-29: axe's level
+ * tags are exactly `wcag2a`, `wcag2aa`, `wcag21a`, `wcag21aa`, `wcag22aa` and `wcag2aaa` — this list is
+ * every A/AA one, with AAA correctly out of scope, and there is no `wcag22a` (WCAG 2.2's two Level A
+ * additions, 3.2.6 and 3.3.7, have no axe rule at all).
+ *
+ * The reason it is pinned rather than left correct: a tag added by a future axe version would silently
+ * narrow the scan, and a scan that quietly checks less still reports "0 violations".
+ */
+export const WCAG_AA_TAGS = ["wcag2a", "wcag2aa", "wcag21a", "wcag21aa", "wcag22aa"];
+/**
+ * Fold axe's four result buckets into one verdict per criterion.
+ *
+ * A criterion usually has SEVERAL axe rules, so the buckets must be reduced with a precedence and it is
+ * the strict one: a violation anywhere beats review-needed, which beats clean. Two rules for a criterion
+ * where one passes and one needs review leaves the criterion needing review — claiming otherwise would let
+ * a passing fragment vouch for a fragment nobody checked.
+ *
+ * `inapplicable` counts as CLEAN rather than as ACT's `inapplicable`, and that is deliberate. axe means
+ * "this RULE found no elements to test"; the criterion may still have aspects no axe rule covers, so the
+ * page having no images tells you nothing about the rest of 1.1.1. Reporting the criterion inapplicable
+ * from a rule's inapplicability would be a claim about the criterion drawn from a claim about one rule.
+ *
+ * Each entry also names the axe rule ids that VIOLATED the criterion (#1606), so a reason can say which rule axe reported.
+ * A criterion that was not violated names none. An imported file carrying only `violations` records only violated
+ * criteria here, now with their ids, because `axe-results.ts` passes its buckets straight through.
+ */
+export function coverageFrom(buckets) {
+    const out = {};
+    const record = (rules, verdict) => {
+        for (const rule of rules ?? []) {
+            for (const criterion of criteriaFromTags(Array.isArray(rule.tags) ? rule.tags.map(str) : [])) {
+                recordRule(out, criterion, verdict, str(rule.id));
+            }
+        }
+    };
+    // Weakest first, so the precedence above only ever upgrades.
+    record(buckets.inapplicable, "clean");
+    record(buckets.passes, "clean");
+    record(buckets.incomplete, "needsReview");
+    record(buckets.violations, "violated");
+    return out;
+}
+const RANK = { clean: 1, needsReview: 2, violated: 3 };
+/**
+ * #1606: a stronger verdict replaces a criterion's entry and starts its rule list afresh, and a violating rule adds its id
+ * once. Only VIOLATING rules are named: the ids exist so a reason can say which rule axe reported, and a passing or
+ * review-needed rule reported no failure.
+ */
+function recordRule(out, criterion, verdict, id) {
+    const current = out[criterion];
+    if (!current || RANK[verdict] > RANK[current.verdict])
+        out[criterion] = { verdict, rules: [] };
+    const entry = out[criterion];
+    if (verdict === "violated" && entry.verdict === "violated" && id && !entry.rules.includes(id))
+        entry.rules.push(id);
+}
+/** axe tags include "wcag143" for SC 1.4.3; extract criterion numbers. */
+function criteriaFromTags(tags) {
+    const out = [];
+    for (const t of tags) {
+        const m = t.match(/^wcag(\d)(\d)(\d+)$/);
+        if (m)
+            out.push(`${m[1]}.${m[2]}.${m[3]}`);
+    }
+    return out;
+}
+const str = (v) => (typeof v === "string" ? v : "");
+/** Map axe's violations to our findings. Shared so an imported results file and our own
+ * run produce identical output — a finding must not look different depending on who ran
+ * the scan. */
+export function toFindings(violations) {
+    return violations.map((v) => ({
+        source: "axe-core",
+        wcag: criteriaFromTags(Array.isArray(v.tags) ? v.tags.map(str) : []),
+        rule: str(v.id),
+        impact: str(v.impact),
+        help: str(v.help),
+        helpUrl: str(v.helpUrl),
+        nodes: (Array.isArray(v.nodes) ? v.nodes : []).map((n) => ({
+            html: str(n?.html),
+            target: (Array.isArray(n?.target) ? n.target : []).map(String),
+        })),
+    }));
+}
+/** Thrown when the optional browser dependencies are not installed. */
+export class AxeUnavailableError extends Error {
+    constructor(cause) {
+        super("the axe layer needs its optional dependencies: npm install playwright @axe-core/playwright && npx playwright install chromium", { cause });
+        this.name = "AxeUnavailableError";
+    }
+}
+// The NAMED export, not the default. The package exports the same class both ways
+// (`export { AxeBuilder, AxeBuilder as default }`), but under dynamic import the default
+// resolves to the module namespace, which is not constructable.
+async function loadAxe() {
+    try {
+        const [playwright, axe] = await Promise.all([import("playwright"), import("@axe-core/playwright")]);
+        return { chromium: playwright.chromium, AxeBuilder: axe.AxeBuilder };
+    }
+    catch (e) {
+        throw new AxeUnavailableError(e);
+    }
+}
+/** Thrown when NEITHER the bundled browser nor the system channel could be launched. */
+export class AxeLaunchError extends Error {
+    constructor(bundledError, channelError) {
+        super("the axe layer's browser could not be launched: no bundled Chromium " +
+            "(npx playwright install chromium) and no system Edge either", { cause: { bundledError, channelError } });
+        this.name = "AxeLaunchError";
+    }
+}
+/**
+ * Launch a browser for axe to drive — the bundled Chromium first, a system channel as the fallback.
+ *
+ * FOUND 2026-09-06: `chromium.launch()` with no options needs the bundled browser, and the Action
+ * deliberately skips downloading it (`PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1` — half a gigabyte the Windows
+ * runner does not need, since the capture already drives Edge). So on the Action the bundled browser is
+ * ABSENT BY DESIGN, `launch()` threw, the throw was caught in `cli.ts` and reported as `ruleBased: null`
+ * — while the progress line printed "rule-based axe-core + real screen reader" and the smoke test never
+ * read `ruleBased` at all. Every Action consumer got the rule layer silently skipped.
+ *
+ * A hard-coded `channel: "msedge"` is not the fix: the CLI runs on Macs and Linux too, and a developer
+ * with no Edge installed would lose the layer entirely. So: try the bundled browser first (what a local
+ * `npx playwright install chromium` gives you), and only on failure fall back to the system channel —
+ * which the Windows runner has, and which happens to be the SAME engine the capture itself drives, so
+ * the two layers observe one rendering engine rather than two. Which one actually answered is returned
+ * rather than assumed, because it is evidence: a finding depends on the renderer that produced it.
+ */
+export async function launchBrowser(chromium) {
+    try {
+        return { browser: await chromium.launch(), channel: "chromium" };
+    }
+    catch (bundledError) {
+        try {
+            return { browser: await chromium.launch({ channel: "msedge" }), channel: "msedge" };
+        }
+        catch (channelError) {
+            throw new AxeLaunchError(bundledError, channelError);
+        }
+    }
+}
+/**
+ * True when the rule-based layer can run here.
+ *
+ * USED TO BE cheap and wrong: it resolved the modules and stopped, which proves an IMPORT, not a LAUNCH —
+ * exactly the gap that let the Action announce the layer and then silently produce nothing for it. This
+ * now launches for real (bundled Chromium, then the system channel) and closes immediately, so the
+ * answer means what its name says. The cost is the same one `scanWithAxe` already pays once per run.
+ *
+ * `deps.loadAxe` is the injection seam for a test: neither of `loadAxe`'s own two failure modes (modules
+ * missing, no browser launchable) can be produced from inside this repo's CI without either uninstalling
+ * a dependency or faking the launch — so a test supplies a fake `loadAxe` whose `chromium.launch` always
+ * throws, and asserts this still answers `false` rather than the `true` an import-only check would give.
+ */
+export async function axeAvailable(deps = {}) {
+    const resolve = deps.loadAxe ?? loadAxe;
+    try {
+        const { chromium } = await resolve();
+        const { browser } = await launchBrowser(chromium);
+        await browser.close();
+        return true;
+    }
+    catch (e) {
+        if (e instanceof AxeUnavailableError || e instanceof AxeLaunchError)
+            return false;
+        throw e;
+    }
+}
+export async function scanWithAxe(url) {
+    const { chromium, AxeBuilder } = await loadAxe();
+    const { browser, channel } = await launchBrowser(chromium);
+    try {
+        // @axe-core/playwright requires a page from an explicit context.
+        const context = await browser.newContext();
+        const page = await context.newPage();
+        await page.goto(url, { waitUntil: "load" });
+        const title = await page.title();
+        const results = await new AxeBuilder({ page }).withTags(WCAG_AA_TAGS).analyze();
+        return { findings: toFindings(results.violations), title, coverage: coverageFrom(results), browserChannel: channel };
+    }
+    finally {
+        await browser.close();
+    }
+}
+//# sourceMappingURL=axe.js.map

package/dist/scan/axe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"axe.js","sourceRoot":"","sources":["../../src/scan/axe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;AAoBrF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,YAAY,CAAC,OAK5B;IACC,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,CAAC,KAA0C,EAAE,OAAyB,EAAE,EAAE;QACvF,KAAK,MAAM,IAAI,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;YAC/B,KAAK,MAAM,SAAS,IAAI,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC7F,UAAU,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,6DAA6D;IAC7D,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACtC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAC1C,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACvC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,IAAI,GAA2B,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AAI/E;;;;GAIG;AACH,SAAS,UAAU,CAAC,GAAoB,EAAE,SAAiB,EAAE,OAAyB,EAAE,EAAU;IAChG,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;IAC/B,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAC/F,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7B,IAAI,OAAO,KAAK,UAAU,IAAI,KAAK,CAAC,OAAO,KAAK,UAAU,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAAE,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACtH,CAAC;AAED,0EAA0E;AAC1E,SAAS,gBAAgB,CAAC,IAAc;IACtC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAgCD,MAAM,GAAG,GAAG,CAAC,CAAU,EAAU,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAErE;;eAEe;AACf,MAAM,UAAU,UAAU,CAAC,UAAmC;IAC5D,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5B,MAAM,EAAE,UAAmB;QAC3B,IAAI,EAAE,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACf,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;QACrB,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QACjB,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;QACvB,KAAK,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAuC,EAAE,EAAE,CAAC,CAAC;YAC/F,IAAI,EAAE,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC;YAClB,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;SAC/D,CAAC,CAAC;KACJ,CAAC,CAAC,CAAC;AACN,CAAC;AAED,uEAAuE;AACvE,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,KAAc;QACxB,KAAK,CACH,+HAA+H,EAC/H,EAAE,KAAK,EAAE,CACV,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,kFAAkF;AAClF,yFAAyF;AACzF,gEAAgE;AAChE,KAAK,UAAU,OAAO;IACpB,IAAI,CAAC;QACH,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;QACpG,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;IACvE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,mBAAmB,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC;AACH,CAAC;AAKD,wFAAwF;AACxF,MAAM,OAAO,cAAe,SAAQ,KAAK;IACvC,YAAY,YAAqB,EAAE,YAAqB;QACtD,KAAK,CACH,qEAAqE;YACnE,6DAA6D,EAC/D,EAAE,KAAK,EAAE,EAAE,YAAY,EAAE,YAAY,EAAE,EAAE,CAC1C,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAOD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,QAA4B;IAE9D,IAAI,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;IACnE,CAAC;IAAC,OAAO,YAAY,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QACtF,CAAC;QAAC,OAAO,YAAY,EAAE,CAAC;YACtB,MAAM,IAAI,cAAc,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAsE,EAAE;IAExE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,OAAO,EAAE,CAAC;QACrC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,mBAAmB,IAAI,CAAC,YAAY,cAAc;YAAE,OAAO,KAAK,CAAC;QAClF,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW;IAC3C,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,MAAM,OAAO,EAAE,CAAC;IACjD,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,iEAAiE;QACjE,MAAM,OAAO,GAAG,MAAO,OAAoF,CAAC,UAAU,EAAE,CAAC;QACzH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;QACrC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,IAAI,UAAU,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC;QAChF,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;IACvH,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;AACH,CAAC"}

package/dist/scan/page-title.d.ts

@@ -0,0 +1,3 @@
+/** The page's `<title>`, or "" if it cannot be determined. */
+export declare function fetchPageTitle(url: string): Promise<string>;
+//# sourceMappingURL=page-title.d.ts.map

package/dist/scan/page-title.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"page-title.d.ts","sourceRoot":"","sources":["../../src/scan/page-title.ts"],"names":[],"mappings":"AA6BA,8DAA8D;AAC9D,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CASjE"}

package/dist/scan/page-title.js

@@ -0,0 +1,41 @@
+/**
+ * The page's own title, fetched from the control plane.
+ *
+ * This exists so capture verification does not depend on the axe layer. The CLI checks
+ * that the screen reader actually read the target page by looking for the page's title in
+ * what was announced; that title used to come from axe's Playwright page, so turning axe
+ * off silently disabled the check.
+ *
+ * It MUST come from a source independent of the capture. Asking the worker what title it
+ * saw and then using that to verify the worker read the right page proves nothing — the
+ * check only has value because the two observations are independent.
+ *
+ * A fetched title is weaker than a rendered one: a page that sets its title in JavaScript
+ * will report whatever the server sent. That is acceptable here, because the check is
+ * deliberately lenient (one significant word) and only ever triggers a re-capture.
+ */
+import { readFile } from "node:fs/promises";
+import { fileURLToPath } from "node:url";
+import { titleOf } from "@a11ign/evidence/verify";
+const TITLE_TIMEOUT_MS = 10_000;
+async function sourceOf(url) {
+    if (url.startsWith("file:"))
+        return readFile(fileURLToPath(url), "utf8");
+    const response = await fetch(url, { signal: AbortSignal.timeout(TITLE_TIMEOUT_MS) });
+    if (!response.ok)
+        throw new Error(`HTTP ${response.status}`);
+    return response.text();
+}
+/** The page's `<title>`, or "" if it cannot be determined. */
+export async function fetchPageTitle(url) {
+    try {
+        return titleOf(await sourceOf(url));
+    }
+    catch (e) {
+        // Not fatal: without a title the CLI simply skips the wrong-page check, which is the
+        // same position it is in for a page that has no title at all.
+        process.stderr.write(`could not read the page title for verification (${e.message})\n`);
+        return "";
+    }
+}
+//# sourceMappingURL=page-title.js.map

package/dist/scan/page-title.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"page-title.js","sourceRoot":"","sources":["../../src/scan/page-title.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAElD,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEhC,KAAK,UAAU,QAAQ,CAAC,GAAW;IACjC,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;IACrF,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7D,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,8DAA8D;AAC9D,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAW;IAC9C,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,qFAAqF;QACrF,8DAA8D;QAC9D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mDAAoD,CAAW,CAAC,OAAO,KAAK,CAAC,CAAC;QACnG,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/scan/run-axe.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=run-axe.d.ts.map

package/dist/scan/run-axe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-axe.d.ts","sourceRoot":"","sources":["../../src/scan/run-axe.ts"],"names":[],"mappings":""}

package/dist/scan/run-axe.js

@@ -0,0 +1,39 @@
+/**
+ * Run the axe-core rule-based scan against a URL or local file.
+ * Usage: npm run scan -- <url|path>
+ */
+import { existsSync } from "node:fs";
+import { resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { scanWithAxe } from "./axe.js";
+async function main() {
+    let target = process.argv[2];
+    if (!target) {
+        console.error("Usage: npm run scan -- <url|path>");
+        process.exit(1);
+    }
+    if (!/^(https?|file):/.test(target) && existsSync(target)) {
+        target = pathToFileURL(resolve(target)).href;
+    }
+    const { findings } = await scanWithAxe(target);
+    console.log(`\naxe-core (rule-based layer): ${findings.length} violation(s) on ${target}\n`);
+    for (const f of findings) {
+        console.log(`  [${f.impact}] ${f.wcag.join(", ") || "(no SC tag)"}  ${f.rule}`);
+        console.log(`     ${f.help}`);
+        for (const n of f.nodes.slice(0, 2))
+            console.log(`     evidence: ${n.html.slice(0, 100)}`);
+    }
+    console.log("");
+}
+/**
+ * Run ONLY when this file is the program, never when it is imported — so a test (or the `import()` load
+ * check) can reach the functions above without executing the script. See `entry-points.test.ts`.
+ */
+const isProgram = process.argv[1] !== undefined
+    && import.meta.url === pathToFileURL(process.argv[1]).href;
+if (isProgram)
+    main().catch((err) => {
+        console.error(err);
+        process.exit(1);
+    });
+//# sourceMappingURL=run-axe.js.map

package/dist/scan/run-axe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-axe.js","sourceRoot":"","sources":["../../src/scan/run-axe.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAEvC,KAAK,UAAU,IAAI;IACjB,IAAI,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1D,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,kCAAkC,QAAQ,CAAC,MAAM,oBAAoB,MAAM,IAAI,CAAC,CAAC;IAC7F,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,aAAa,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAChF,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;OAC1C,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAE7D,IAAI,SAAS;IAAE,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QAClC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC"}

package/package.json

@@ -0,0 +1,60 @@
+{
+  "name": "a11ign",
+  "version": "0.1.0",
+  "description": "Drives a real screen reader through a real page and reports the WCAG 2.2 AA failures a rule scanner cannot see — alongside axe, never instead of it.",
+  "license": "AGPL-3.0-or-later",
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "bin": {
+    "a11ign": "./dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "dependencies": {
+    "@a11ign/evidence": "0.1.0",
+    "@a11ign/judge": "0.1.0",
+    "@a11ign/scorer": "0.1.0",
+    "@a11ign/worker-fleet": "0.1.0",
+    "yaml": "^2.9.0"
+  },
+  "optionalDependencies": {
+    "@axe-core/playwright": "^4.12.1",
+    "playwright": "^1.61.1"
+  },
+  "devDependencies": {
+    "axe-core": "^4.12.1"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "prepack": "tsc --build"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/a11ign/a11ign.git",
+    "directory": "packages/cli"
+  },
+  "homepage": "https://github.com/a11ign/a11ign",
+  "keywords": [
+    "accessibility",
+    "a11y",
+    "wcag",
+    "screen-reader",
+    "nvda",
+    "axe",
+    "cli"
+  ]
+}