ax-audit 3.1.0 → 4.0.0

package/dist/baseline.js

@@ -1,19 +1,28 @@
 import { readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { dirname } from 'node:path';
+import { checks as allChecks } from './checks/index.js';
+import { allIdsFor } from './check-ids.js';
 /**
  * Extract a minimal, stable snapshot from an AuditReport suitable for
  * persistence and future comparison.
  */
+/** Scoring model this build produces. Bumped whenever weights or the scoring rules change. */
+export const BASELINE_SCHEMA_VERSION = 2;
 export function toBaselineData(report) {
     const checks = {};
+    const notApplicable = [];
     for (const r of report.results) {
         checks[r.id] = r.score;
+        if (r.applicable === false)
+            notApplicable.push(r.id);
     }
     return {
+        schemaVersion: BASELINE_SCHEMA_VERSION,
         url: report.url,
         timestamp: report.timestamp,
         overallScore: report.overallScore,
         checks,
+        ...(notApplicable.length > 0 ? { notApplicable } : {}),
     };
 }
 /**
@@ -58,19 +67,39 @@ export function loadBaseline(path) {
  * per-check deltas and overall regression/improvement lists.
  */
 export function diffBaseline(baseline, report) {
+    // A baseline saved before a check was renamed still holds the former id, so
+    // look each score up under every id that check answers to. Without this a
+    // rename reads as one check removed (a full regression) and one added at
+    // zero, which would fire `--fail-on-regression` on an unchanged site.
+    const consumedIds = new Set();
+    const previousScoreFor = (id) => {
+        for (const candidate of idsForCheck(id)) {
+            if (Object.hasOwn(baseline.checks, candidate)) {
+                consumedIds.add(candidate);
+                return baseline.checks[candidate];
+            }
+        }
+        return undefined;
+    };
+    const wasNotApplicable = new Set(baseline.notApplicable ?? []);
     const checks = report.results.map((r) => {
-        const previous = baseline.checks[r.id] ?? 0;
+        const previous = previousScoreFor(r.id) ?? 0;
+        const isNotApplicable = r.applicable === false;
+        // A check that is N/A on one side has no comparable score, so its delta
+        // reflects a change in what the site offers rather than in its quality.
+        const applicabilityChanged = isNotApplicable !== wasNotApplicable.has(r.id);
         return {
             id: r.id,
             name: r.name,
             previous,
             current: r.score,
             delta: r.score - previous,
+            ...(applicabilityChanged ? { applicabilityChanged: true } : {}),
         };
     });
     // Include checks that existed in the baseline but were removed from the current run
     for (const [id, score] of Object.entries(baseline.checks)) {
-        if (!checks.some((c) => c.id === id)) {
+        if (!consumedIds.has(id) && !checks.some((c) => c.id === id)) {
             checks.push({
                 id,
                 name: id, // no human-readable name available for removed checks
@@ -81,7 +110,9 @@ export function diffBaseline(baseline, report) {
         }
     }
     const overallDelta = report.overallScore - baseline.overallScore;
+    const scoringModelChanged = (baseline.schemaVersion ?? 1) !== BASELINE_SCHEMA_VERSION;
     return {
+        ...(scoringModelChanged ? { scoringModelChanged: true } : {}),
         url: report.url,
         baselineTimestamp: baseline.timestamp,
         currentTimestamp: report.timestamp,
@@ -89,11 +120,18 @@ export function diffBaseline(baseline, report) {
         overallCurrent: report.overallScore,
         overallDelta,
         checks,
-        regressions: checks.filter((c) => c.delta < 0),
-        improvements: checks.filter((c) => c.delta > 0),
+        // A regression must be something the site did. A check that changed
+        // applicability, or a baseline from a different scoring model, is neither.
+        regressions: scoringModelChanged ? [] : checks.filter((c) => c.delta < 0 && !c.applicabilityChanged),
+        improvements: checks.filter((c) => c.delta > 0 && !c.applicabilityChanged),
     };
 }
 /* ── Internal helpers ─────────────────────────────────────── */
+/** Current id plus every former id a check answers to, for baseline lookup. */
+function idsForCheck(id) {
+    const meta = allChecks.find((c) => c.meta.id === id)?.meta;
+    return meta === undefined ? [id] : allIdsFor(meta);
+}
 function isBaselineData(value) {
     if (typeof value !== 'object' || value === null)
         return false;

package/dist/baseline.js.map

@@ -1 +1 @@
-{"version":3,"file":"baseline.js","sourceRoot":"","sources":["../src/baseline.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAmB;IAChD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC/B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;IACzB,CAAC;IACD,OAAO;QACL,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,MAAmB;IAC5D,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACpC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;AACrE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;QACjD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,oCAAoC,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,wFAAwF,IAAI,EAAE,CAAC,CAAC;IAClH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,QAAsB,EAAE,MAAmB;IACtE,MAAM,MAAM,GAAgB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACnD,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC5C,OAAO;YACL,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,QAAQ;YACR,OAAO,EAAE,CAAC,CAAC,KAAK;YAChB,KAAK,EAAE,CAAC,CAAC,KAAK,GAAG,QAAQ;SAC1B,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,oFAAoF;IACpF,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE;gBACF,IAAI,EAAE,EAAE,EAAE,sDAAsD;gBAChE,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,CAAC;gBACV,KAAK,EAAE,CAAC,KAAK;aACd,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC;IAEjE,OAAO;QACL,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,iBAAiB,EAAE,QAAQ,CAAC,SAAS;QACrC,gBAAgB,EAAE,MAAM,CAAC,SAAS;QAClC,eAAe,EAAE,QAAQ,CAAC,YAAY;QACtC,cAAc,EAAE,MAAM,CAAC,YAAY;QACnC,YAAY;QACZ,MAAM;QACN,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;QAC9C,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;KAChD,CAAC;AACJ,CAAC;AAED,iEAAiE;AAEjE,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,OAAO,CACL,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;QAC3B,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ;QACjC,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ;QACpC,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;QAC9B,GAAG,CAAC,MAAM,KAAK,IAAI;QACnB,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAC3B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"baseline.js","sourceRoot":"","sources":["../src/baseline.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAG3C;;;GAGG;AACH,8FAA8F;AAC9F,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAEzC,MAAM,UAAU,cAAc,CAAC,MAAmB;IAChD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,MAAM,aAAa,GAAa,EAAE,CAAC;IAEnC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC/B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;QACvB,IAAI,CAAC,CAAC,UAAU,KAAK,KAAK;YAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,OAAO;QACL,aAAa,EAAE,uBAAuB;QACtC,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,MAAM;QACN,GAAG,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,MAAmB;IAC5D,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACpC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;AACrE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;QACjD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,oCAAoC,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,wFAAwF,IAAI,EAAE,CAAC,CAAC;IAClH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,QAAsB,EAAE,MAAmB;IACtE,4EAA4E;IAC5E,0EAA0E;IAC1E,yEAAyE;IACzE,sEAAsE;IACtE,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IAEtC,MAAM,gBAAgB,GAAG,CAAC,EAAU,EAAsB,EAAE;QAC1D,KAAK,MAAM,SAAS,IAAI,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC;YACxC,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;gBAC9C,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC3B,OAAO,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IAEF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;IAE/D,MAAM,MAAM,GAAgB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACnD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,eAAe,GAAG,CAAC,CAAC,UAAU,KAAK,KAAK,CAAC;QAC/C,wEAAwE;QACxE,wEAAwE;QACxE,MAAM,oBAAoB,GAAG,eAAe,KAAK,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAE5E,OAAO;YACL,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,QAAQ;YACR,OAAO,EAAE,CAAC,CAAC,KAAK;YAChB,KAAK,EAAE,CAAC,CAAC,KAAK,GAAG,QAAQ;YACzB,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,oFAAoF;IACpF,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1D,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YAC7D,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE;gBACF,IAAI,EAAE,EAAE,EAAE,sDAAsD;gBAChE,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,CAAC;gBACV,KAAK,EAAE,CAAC,KAAK;aACd,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC;IACjE,MAAM,mBAAmB,GAAG,CAAC,QAAQ,CAAC,aAAa,IAAI,CAAC,CAAC,KAAK,uBAAuB,CAAC;IAEtF,OAAO;QACL,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,iBAAiB,EAAE,QAAQ,CAAC,SAAS;QACrC,gBAAgB,EAAE,MAAM,CAAC,SAAS;QAClC,eAAe,EAAE,QAAQ,CAAC,YAAY;QACtC,cAAc,EAAE,MAAM,CAAC,YAAY;QACnC,YAAY;QACZ,MAAM;QACN,oEAAoE;QACpE,2EAA2E;QAC3E,WAAW,EAAE,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC;QACpG,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC;KAC3E,CAAC;AACJ,CAAC;AAED,iEAAiE;AAEjE,+EAA+E;AAC/E,SAAS,WAAW,CAAC,EAAU;IAC7B,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,CAAC;IAC3D,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,OAAO,CACL,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;QAC3B,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ;QACjC,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ;QACpC,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;QAC9B,GAAG,CAAC,MAAM,KAAK,IAAI;QACnB,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAC3B,CAAC;AACJ,CAAC"}

package/dist/check-ids.d.ts

@@ -0,0 +1,19 @@
+import type { CheckMeta } from './types.js';
+/** Map of alias → current id, built from the registered checks. */
+export declare function buildAliasMap(metas?: CheckMeta[]): Map<string, string>;
+/**
+ * Resolve a possibly-former check id to its current one. Unknown ids are
+ * returned unchanged so callers can report them as invalid with the name the
+ * user actually typed.
+ */
+export declare function resolveCheckId(id: string, metas?: CheckMeta[]): string;
+/** Every id a check answers to, current name first. */
+export declare function allIdsFor(meta: CheckMeta): string[];
+/** Every selectable id across all checks, aliases included. */
+export declare function allSelectableIds(metas?: CheckMeta[]): string[];
+/**
+ * Whether a check should run given a `--checks` selection, matching on its
+ * current id or any alias.
+ */
+export declare function isSelected(meta: CheckMeta, selection: string[]): boolean;
+//# sourceMappingURL=check-ids.d.ts.map

package/dist/check-ids.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-ids.d.ts","sourceRoot":"","sources":["../src/check-ids.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,mEAAmE;AACnE,wBAAgB,aAAa,CAAC,KAAK,GAAE,SAAS,EAAiC,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAQpG;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,SAAS,EAAE,GAAG,MAAM,CAKtE;AAED,uDAAuD;AACvD,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,EAAE,CAEnD;AAED,+DAA+D;AAC/D,wBAAgB,gBAAgB,CAAC,KAAK,GAAE,SAAS,EAAiC,GAAG,MAAM,EAAE,CAE5F;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAGxE"}

package/dist/check-ids.js

@@ -0,0 +1,53 @@
+/**
+ * Check-id resolution across renames.
+ *
+ * Check ids are a public interface twice over: they appear in `--checks`
+ * invocations that live in CI configs, and as keys in saved baseline files. So
+ * a rename cannot be a silent break — `--checks mcp` must keep working, and a
+ * baseline recorded when the check was called `mcp` must still compare against
+ * the check now called `mcp-discovery` rather than reporting one check removed
+ * and another added.
+ *
+ * A check declares its former names in `meta.aliases`; everything here reads
+ * from that, so adding an alias is a one-line change on the check itself.
+ */
+import { checks as allChecks } from './checks/index.js';
+/** Map of alias → current id, built from the registered checks. */
+export function buildAliasMap(metas = allChecks.map((c) => c.meta)) {
+    const map = new Map();
+    for (const meta of metas) {
+        for (const alias of meta.aliases ?? []) {
+            map.set(alias.toLowerCase(), meta.id);
+        }
+    }
+    return map;
+}
+/**
+ * Resolve a possibly-former check id to its current one. Unknown ids are
+ * returned unchanged so callers can report them as invalid with the name the
+ * user actually typed.
+ */
+export function resolveCheckId(id, metas) {
+    const current = metas ?? allChecks.map((c) => c.meta);
+    const lower = id.toLowerCase();
+    if (current.some((m) => m.id.toLowerCase() === lower))
+        return current.find((m) => m.id.toLowerCase() === lower).id;
+    return buildAliasMap(current).get(lower) ?? id;
+}
+/** Every id a check answers to, current name first. */
+export function allIdsFor(meta) {
+    return [meta.id, ...(meta.aliases ?? [])];
+}
+/** Every selectable id across all checks, aliases included. */
+export function allSelectableIds(metas = allChecks.map((c) => c.meta)) {
+    return metas.flatMap(allIdsFor);
+}
+/**
+ * Whether a check should run given a `--checks` selection, matching on its
+ * current id or any alias.
+ */
+export function isSelected(meta, selection) {
+    const wanted = new Set(selection.map((s) => s.toLowerCase()));
+    return allIdsFor(meta).some((id) => wanted.has(id.toLowerCase()));
+}
+//# sourceMappingURL=check-ids.js.map

package/dist/check-ids.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-ids.js","sourceRoot":"","sources":["../src/check-ids.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAGxD,mEAAmE;AACnE,MAAM,UAAU,aAAa,CAAC,QAAqB,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;YACvC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,EAAU,EAAE,KAAmB;IAC5D,MAAM,OAAO,GAAG,KAAK,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/B,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,KAAK,CAAE,CAAC,EAAE,CAAC;IACpH,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;AACjD,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,SAAS,CAAC,IAAe;IACvC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,gBAAgB,CAAC,QAAqB,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAChF,OAAO,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,IAAe,EAAE,SAAmB;IAC7D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC9D,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AACpE,CAAC"}

package/dist/checks/agent-access.d.ts

@@ -0,0 +1,33 @@
+import type { CheckContext, CheckResult, CheckMeta } from '../types.js';
+/**
+ * "agent-access" — the gap between what robots.txt permits and what the server
+ * actually does.
+ *
+ * The failure this catches is invisible from the inside: robots.txt says
+ * `Allow: /` for GPTBot, and the WAF returns 403 to anything whose user agent
+ * says GPTBot. The operator sees a permissive robots.txt and assumes the site
+ * is reachable. Cloudflare's "Block AI Crawlers" toggle produces exactly this,
+ * and so does a hand-written rule that outlived its reason.
+ *
+ * The check probes the homepage once per core crawler and compares the result
+ * against the default-user-agent baseline. Since 3.7 it classifies *how* a
+ * request was turned away, because the remedies are completely different: a
+ * JavaScript challenge needs a bot-management exception, a hard 403 needs a
+ * firewall rule change, a 402 is a deliberate price, and a signature demand is
+ * the site working as designed.
+ *
+ * Honesty constraint: this probe is unsigned and comes from the auditor's own
+ * network. An edge that verifies crawlers by IP range or Web Bot Auth signature
+ * will reject it while admitting the genuine crawler. Those outcomes are scored
+ * as inconclusive and labelled as such, never as "blocks AI crawlers".
+ */
+export declare const meta: CheckMeta;
+/**
+ * Build a realistic crawler User-Agent for a given bot token. WAF and
+ * bot-management rules match on the token substring, which is what we need
+ * to trigger the same code path the real crawler would hit.
+ */
+export declare function crawlerUserAgent(token: string): string;
+export { intentBlocked } from './robots-parser.js';
+export default function check(ctx: CheckContext): Promise<CheckResult>;
+//# sourceMappingURL=agent-access.d.ts.map

package/dist/checks/agent-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-access.d.ts","sourceRoot":"","sources":["../../src/checks/agent-access.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,EAAW,MAAM,aAAa,CAAC;AAMjF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,IAAI,EAAE,SAKlB,CAAC;AA+BF;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEtD;AAGD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAoCnD,wBAA8B,KAAK,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CA8E3E"}

package/dist/checks/agent-access.js

@@ -0,0 +1,256 @@
+import { PROBEABLE_CORE_CRAWLERS, crawlerInfo } from '../constants.js';
+import { guideUrl } from '../guide-urls.js';
+import { buildResult } from './utils.js';
+import { extractVisibleText, findJsonLdBlocks } from './html-utils.js';
+import { parseUserAgents, intentBlocked } from './robots-parser.js';
+import { classifyResponse, INCONCLUSIVE_CAVEAT } from './waf.js';
+/**
+ * "agent-access" — the gap between what robots.txt permits and what the server
+ * actually does.
+ *
+ * The failure this catches is invisible from the inside: robots.txt says
+ * `Allow: /` for GPTBot, and the WAF returns 403 to anything whose user agent
+ * says GPTBot. The operator sees a permissive robots.txt and assumes the site
+ * is reachable. Cloudflare's "Block AI Crawlers" toggle produces exactly this,
+ * and so does a hand-written rule that outlived its reason.
+ *
+ * The check probes the homepage once per core crawler and compares the result
+ * against the default-user-agent baseline. Since 3.7 it classifies *how* a
+ * request was turned away, because the remedies are completely different: a
+ * JavaScript challenge needs a bot-management exception, a hard 403 needs a
+ * firewall rule change, a 402 is a deliberate price, and a signature demand is
+ * the site working as designed.
+ *
+ * Honesty constraint: this probe is unsigned and comes from the auditor's own
+ * network. An edge that verifies crawlers by IP range or Web Bot Auth signature
+ * will reject it while admitting the genuine crawler. Those outcomes are scored
+ * as inconclusive and labelled as such, never as "blocks AI crawlers".
+ */
+export const meta = {
+    id: 'agent-access',
+    name: 'Agent Access',
+    description: 'Checks that AI crawler user-agents are not blocked or served reduced content (cloaking)',
+    category: 'access',
+};
+/** Content below this fraction of the baseline visible text counts as "reduced". */
+const REDUCED_CONTENT_RATIO = 0.5;
+/** Baselines with less visible text than this are too small for meaningful content comparison. */
+const MIN_BASELINE_TEXT = 200;
+/** Credit each outcome contributes to the access score. */
+const OUTCOME_CREDIT = {
+    ok: 1,
+    'blocked-consistent': 1,
+    conditional: 1,
+    inconclusive: 0.75,
+    reduced: 0.5,
+    blocked: 0,
+};
+/**
+ * Build a realistic crawler User-Agent for a given bot token. WAF and
+ * bot-management rules match on the token substring, which is what we need
+ * to trigger the same code path the real crawler would hit.
+ */
+export function crawlerUserAgent(token) {
+    return `Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ${token}/1.0)`;
+}
+// `intentBlocked` moved to robots-parser.ts in 3.7; re-exported for compatibility.
+export { intentBlocked } from './robots-parser.js';
+function shapeOf(html) {
+    const title = html.match(/<title\b[^>]*>([\s\S]*?)<\/title>/i);
+    const h1 = html.match(/<h1\b[^>]*>([\s\S]*?)<\/h1>/i);
+    return {
+        textLength: extractVisibleText(html).length,
+        title: title ? extractVisibleText(title[1]) : null,
+        h1: h1 ? extractVisibleText(h1[1]) : null,
+        jsonLdBlocks: findJsonLdBlocks(html).length,
+    };
+}
+/** Differences between a crawler's page and the baseline, in reader-facing terms. */
+function shapeDiff(baseline, actual) {
+    const diffs = [];
+    if (baseline.title !== null && actual.title !== baseline.title) {
+        diffs.push(`title differs ("${actual.title ?? 'none'}" vs "${baseline.title}")`);
+    }
+    if (baseline.h1 !== null && actual.h1 !== baseline.h1) {
+        diffs.push(`h1 differs ("${actual.h1 ?? 'none'}" vs "${baseline.h1}")`);
+    }
+    if (baseline.jsonLdBlocks > 0 && actual.jsonLdBlocks < baseline.jsonLdBlocks) {
+        diffs.push(`${baseline.jsonLdBlocks - actual.jsonLdBlocks} JSON-LD block(s) missing`);
+    }
+    return diffs;
+}
+export default async function check(ctx) {
+    const start = performance.now();
+    const findings = [];
+    const baseline = await ctx.fetch(ctx.url);
+    if (!baseline.ok) {
+        findings.push({
+            status: 'fail',
+            message: 'Baseline homepage request failed — cannot compare crawler access',
+            detail: `HTTP ${baseline.status || 'network error'}`,
+            learnMoreUrl: guideUrl(meta.id, 'baseline-unavailable'),
+        });
+        return buildResult(meta, 0, findings, start);
+    }
+    const baselineShape = shapeOf(baseline.body);
+    const baselineText = baselineShape.textLength;
+    const robotsRes = await ctx.fetch(`${ctx.url}/robots.txt`);
+    const robotsEntries = robotsRes.ok ? parseUserAgents(robotsRes.body) : [];
+    const outcomes = new Map();
+    for (const crawler of PROBEABLE_CORE_CRAWLERS) {
+        const res = await ctx.fetch(ctx.url, { headers: { 'User-Agent': crawlerUserAgent(crawler) } });
+        const cls = classifyResponse(res);
+        const blockedByRobots = intentBlocked(robotsEntries, crawler);
+        if (cls.kind === 'ok') {
+            const shape = shapeOf(res.body);
+            const diffs = shapeDiff(baselineShape, shape);
+            const textDropped = baselineText >= MIN_BASELINE_TEXT && shape.textLength < baselineText * REDUCED_CONTENT_RATIO;
+            if (textDropped || diffs.length > 0) {
+                outcomes.set(crawler, 'reduced');
+                findings.push({
+                    status: 'warn',
+                    message: `${crawler} receives a different page than a regular client`,
+                    detail: [textDropped ? `${shape.textLength} vs ${baselineText} chars of visible text` : null, ...diffs]
+                        .filter(Boolean)
+                        .join('; '),
+                    hint: 'The server returns 200 but serves this crawler different content — often an interstitial, a consent ' +
+                        'wall, or conditional rendering. Agents index exactly what they receive, so the version they see is the ' +
+                        'version that gets cited.',
+                    learnMoreUrl: guideUrl(meta.id, 'reduced-content'),
+                });
+            }
+            else {
+                outcomes.set(crawler, 'ok');
+            }
+            continue;
+        }
+        outcomes.set(crawler, recordTurnedAway(crawler, cls, blockedByRobots, robotsRes.ok, findings));
+    }
+    const okCount = [...outcomes.values()].filter((o) => o === 'ok').length;
+    if (okCount === PROBEABLE_CORE_CRAWLERS.length) {
+        findings.unshift({
+            status: 'pass',
+            message: `All ${PROBEABLE_CORE_CRAWLERS.length} core AI crawler user-agents receive the same page as a regular client`,
+        });
+    }
+    const inconclusive = [...outcomes.entries()].filter(([, o]) => o === 'inconclusive');
+    if (inconclusive.length > 0) {
+        findings.push({
+            status: 'warn',
+            message: `${inconclusive.length} crawler probe(s) could not be settled from outside`,
+            detail: inconclusive.map(([name]) => name).join(', '),
+            hint: INCONCLUSIVE_CAVEAT,
+            learnMoreUrl: guideUrl(meta.id, 'inconclusive-probe'),
+        });
+    }
+    const credit = [...outcomes.values()].reduce((acc, o) => acc + OUTCOME_CREDIT[o], 0);
+    const score = Math.round((credit / PROBEABLE_CORE_CRAWLERS.length) * 100);
+    return buildResult(meta, score, findings, start);
+}
+/**
+ * Turn a non-200 crawler response into a finding and an outcome. The
+ * classification decides both the wording and the credit: a challenge is not a
+ * block, a price is not a refusal, and a signature demand is a site working as
+ * designed.
+ */
+function recordTurnedAway(crawler, cls, blockedByRobots, robotsAvailable, findings) {
+    const info = crawlerInfo(crawler);
+    const evidence = cls.evidence.length > 0 ? cls.evidence.join('; ') : cls.label;
+    switch (cls.kind) {
+        case 'challenge':
+            findings.push({
+                status: 'warn',
+                message: `${crawler} receives a ${cls.vendor ?? 'JavaScript'} challenge instead of the page`,
+                detail: evidence,
+                hint: 'Challenge pages require running JavaScript. Crawlers that only fetch HTML — which is most of them — never ' +
+                    'get past one, so the page is effectively unavailable to them even though nothing is "blocked". ' +
+                    'Add a bot-management exception for verified AI crawlers. ' +
+                    INCONCLUSIVE_CAVEAT,
+                learnMoreUrl: guideUrl(meta.id, 'challenge-page'),
+            });
+            return 'inconclusive';
+        case 'needs-signature':
+            findings.push({
+                status: 'pass',
+                message: `${crawler} must present a Web Bot Auth signature`,
+                detail: evidence,
+                hint: 'The origin asks unverified clients to re-request with an HTTP Message Signature. Vendors that sign their ' +
+                    'requests will pass; this probe does not sign, so it cannot confirm the outcome for the real crawler.',
+                learnMoreUrl: guideUrl(meta.id, 'needs-signature'),
+            });
+            return 'inconclusive';
+        case 'paywall':
+            findings.push({
+                status: 'pass',
+                message: `${crawler} is offered priced access${cls.price ? ` at ${cls.price}` : ''}`,
+                detail: evidence,
+                hint: 'Content is monetised for crawlers rather than blocked. Crawlers that support the payment flow can still reach it.',
+                learnMoreUrl: guideUrl(meta.id, 'pay-per-crawl'),
+            });
+            return 'conditional';
+        case 'license-required':
+            findings.push({
+                status: 'pass',
+                message: `${crawler} is asked to obtain a licence before use`,
+                detail: evidence,
+                hint: 'The origin implements the RSL Open Licensing Protocol. Clients that negotiate a licence can reach the content.',
+                learnMoreUrl: guideUrl(meta.id, 'license-required'),
+            });
+            return 'conditional';
+        case 'rate-limited':
+            findings.push({
+                status: 'warn',
+                message: `${crawler} is rate limited on a single request`,
+                detail: evidence,
+                hint: 'One probe should not hit a rate limit. A limit this tight will stall any crawl. Always answer 429 with a ' +
+                    'Retry-After header so well-behaved crawlers back off correctly instead of giving up.',
+                learnMoreUrl: guideUrl(meta.id, 'rate-limited'),
+            });
+            return 'inconclusive';
+        case 'server-error':
+        case 'network-error':
+            findings.push({
+                status: 'warn',
+                message: `${crawler} probe failed: ${cls.label}`,
+                detail: evidence,
+                hint: 'The request did not complete, so access for this crawler is unknown. Re-run the audit; if it persists, check origin health for this user agent.',
+                learnMoreUrl: guideUrl(meta.id, 'probe-failed'),
+            });
+            return 'inconclusive';
+        default: {
+            // A plain refusal. Whether it is a finding depends on robots.txt intent.
+            if (blockedByRobots) {
+                findings.push({
+                    status: 'pass',
+                    message: `${crawler} blocked at the server — consistent with its robots.txt Disallow`,
+                    detail: evidence,
+                });
+                return 'blocked-consistent';
+            }
+            if (cls.inconclusive) {
+                findings.push({
+                    status: 'warn',
+                    message: `${crawler} is refused by ${cls.vendor ?? 'the origin'} while robots.txt permits it`,
+                    detail: evidence,
+                    hint: (info ? `${info.impact} ` : '') +
+                        'This edge verifies crawlers by IP range or signature, so the refusal may be correct anti-spoofing rather ' +
+                        'than a policy block. ' +
+                        INCONCLUSIVE_CAVEAT,
+                    learnMoreUrl: guideUrl(meta.id, 'blocked-crawler'),
+                });
+                return 'inconclusive';
+            }
+            findings.push({
+                status: 'warn',
+                message: `${crawler} is ${robotsAvailable ? 'allowed in robots.txt' : 'not restricted'} but its User-Agent is refused`,
+                detail: evidence,
+                hint: (info ? `${info.impact} ` : '') +
+                    'Your firewall rejects this crawler token even though robots.txt permits it — the block is invisible to you ' +
+                    'but fatal for the agent. Check your firewall rules and AI-bot toggles (for example Cloudflare "Block AI Crawlers").',
+                learnMoreUrl: guideUrl(meta.id, 'blocked-crawler'),
+            });
+            return 'blocked';
+        }
+    }
+}
+//# sourceMappingURL=agent-access.js.map

package/dist/checks/agent-access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-access.js","sourceRoot":"","sources":["../../src/checks/agent-access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAsB,MAAM,UAAU,CAAC;AAErF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,IAAI,GAAc;IAC7B,EAAE,EAAE,cAAc;IAClB,IAAI,EAAE,cAAc;IACpB,WAAW,EAAE,yFAAyF;IACtG,QAAQ,EAAE,QAAQ;CACnB,CAAC;AAEF,oFAAoF;AACpF,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAClC,kGAAkG;AAClG,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAgB9B,2DAA2D;AAC3D,MAAM,cAAc,GAA4B;IAC9C,EAAE,EAAE,CAAC;IACL,oBAAoB,EAAE,CAAC;IACvB,WAAW,EAAE,CAAC;IACd,YAAY,EAAE,IAAI;IAClB,OAAO,EAAE,GAAG;IACZ,OAAO,EAAE,CAAC;CACX,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,kEAAkE,KAAK,OAAO,CAAC;AACxF,CAAC;AAED,mFAAmF;AACnF,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAUnD,SAAS,OAAO,CAAC,IAAY;IAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAC/D,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACtD,OAAO;QACL,UAAU,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,MAAM;QAC3C,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;QAClD,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;QACzC,YAAY,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC,MAAM;KAC5C,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,SAAS,SAAS,CAAC,QAAmB,EAAE,MAAiB;IACvD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,QAAQ,CAAC,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC/D,KAAK,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,KAAK,IAAI,MAAM,SAAS,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,QAAQ,CAAC,EAAE,KAAK,IAAI,IAAI,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,EAAE,CAAC;QACtD,KAAK,CAAC,IAAI,CAAC,gBAAgB,MAAM,CAAC,EAAE,IAAI,MAAM,SAAS,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,QAAQ,CAAC,YAAY,GAAG,CAAC,IAAI,MAAM,CAAC,YAAY,GAAG,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC7E,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,2BAA2B,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,KAAK,CAAC,GAAiB;IACnD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,kEAAkE;YAC3E,MAAM,EAAE,QAAQ,QAAQ,CAAC,MAAM,IAAI,eAAe,EAAE;YACpD,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,sBAAsB,CAAC;SACxD,CAAC,CAAC;QACH,OAAO,WAAW,CAAC,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,YAAY,GAAG,aAAa,CAAC,UAAU,CAAC;IAE9C,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,GAAG,aAAa,CAAC,CAAC;IAC3D,MAAM,aAAa,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE1E,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAC;IAE5C,KAAK,MAAM,OAAO,IAAI,uBAAuB,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/F,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,eAAe,GAAG,aAAa,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAE9D,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAChC,MAAM,KAAK,GAAG,SAAS,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;YAC9C,MAAM,WAAW,GAAG,YAAY,IAAI,iBAAiB,IAAI,KAAK,CAAC,UAAU,GAAG,YAAY,GAAG,qBAAqB,CAAC;YAEjH,IAAI,WAAW,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;gBACjC,QAAQ,CAAC,IAAI,CAAC;oBACZ,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,GAAG,OAAO,kDAAkD;oBACrE,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,UAAU,OAAO,YAAY,wBAAwB,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC;yBACpG,MAAM,CAAC,OAAO,CAAC;yBACf,IAAI,CAAC,IAAI,CAAC;oBACb,IAAI,EACF,sGAAsG;wBACtG,yGAAyG;wBACzG,0BAA0B;oBAC5B,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,iBAAiB,CAAC;iBACnD,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC9B,CAAC;YACD,SAAS;QACX,CAAC;QAED,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,SAAS,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;IACjG,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;IACxE,IAAI,OAAO,KAAK,uBAAuB,CAAC,MAAM,EAAE,CAAC;QAC/C,QAAQ,CAAC,OAAO,CAAC;YACf,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,OAAO,uBAAuB,CAAC,MAAM,wEAAwE;SACvH,CAAC,CAAC;IACL,CAAC;IAED,MAAM,YAAY,GAAG,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,cAAc,CAAC,CAAC;IACrF,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,YAAY,CAAC,MAAM,qDAAqD;YACpF,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YACrD,IAAI,EAAE,mBAAmB;YACzB,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,oBAAoB,CAAC;SACtD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,uBAAuB,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC;IAE1E,OAAO,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CACvB,OAAe,EACf,GAAkB,EAClB,eAAwB,EACxB,eAAwB,EACxB,QAAmB;IAEnB,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;IAE/E,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,WAAW;YACd,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,GAAG,OAAO,eAAe,GAAG,CAAC,MAAM,IAAI,YAAY,gCAAgC;gBAC5F,MAAM,EAAE,QAAQ;gBAChB,IAAI,EACF,4GAA4G;oBAC5G,iGAAiG;oBACjG,2DAA2D;oBAC3D,mBAAmB;gBACrB,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,gBAAgB,CAAC;aAClD,CAAC,CAAC;YACH,OAAO,cAAc,CAAC;QAExB,KAAK,iBAAiB;YACpB,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,GAAG,OAAO,wCAAwC;gBAC3D,MAAM,EAAE,QAAQ;gBAChB,IAAI,EACF,2GAA2G;oBAC3G,sGAAsG;gBACxG,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,iBAAiB,CAAC;aACnD,CAAC,CAAC;YACH,OAAO,cAAc,CAAC;QAExB,KAAK,SAAS;YACZ,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,GAAG,OAAO,4BAA4B,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;gBACpF,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,mHAAmH;gBACzH,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,eAAe,CAAC;aACjD,CAAC,CAAC;YACH,OAAO,aAAa,CAAC;QAEvB,KAAK,kBAAkB;YACrB,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,GAAG,OAAO,0CAA0C;gBAC7D,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,gHAAgH;gBACtH,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,kBAAkB,CAAC;aACpD,CAAC,CAAC;YACH,OAAO,aAAa,CAAC;QAEvB,KAAK,cAAc;YACjB,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,GAAG,OAAO,sCAAsC;gBACzD,MAAM,EAAE,QAAQ;gBAChB,IAAI,EACF,2GAA2G;oBAC3G,sFAAsF;gBACxF,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,cAAc,CAAC;aAChD,CAAC,CAAC;YACH,OAAO,cAAc,CAAC;QAExB,KAAK,cAAc,CAAC;QACpB,KAAK,eAAe;YAClB,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,GAAG,OAAO,kBAAkB,GAAG,CAAC,KAAK,EAAE;gBAChD,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,iJAAiJ;gBACvJ,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,cAAc,CAAC;aAChD,CAAC,CAAC;YACH,OAAO,cAAc,CAAC;QAExB,OAAO,CAAC,CAAC,CAAC;YACR,yEAAyE;YACzE,IAAI,eAAe,EAAE,CAAC;gBACpB,QAAQ,CAAC,IAAI,CAAC;oBACZ,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,GAAG,OAAO,kEAAkE;oBACrF,MAAM,EAAE,QAAQ;iBACjB,CAAC,CAAC;gBACH,OAAO,oBAAoB,CAAC;YAC9B,CAAC;YAED,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;gBACrB,QAAQ,CAAC,IAAI,CAAC;oBACZ,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,GAAG,OAAO,kBAAkB,GAAG,CAAC,MAAM,IAAI,YAAY,8BAA8B;oBAC7F,MAAM,EAAE,QAAQ;oBAChB,IAAI,EACF,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC/B,2GAA2G;wBAC3G,uBAAuB;wBACvB,mBAAmB;oBACrB,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,iBAAiB,CAAC;iBACnD,CAAC,CAAC;gBACH,OAAO,cAAc,CAAC;YACxB,CAAC;YAED,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,GAAG,OAAO,OAAO,eAAe,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,gBAAgB,gCAAgC;gBACtH,MAAM,EAAE,QAAQ;gBAChB,IAAI,EACF,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/B,6GAA6G;oBAC7G,qHAAqH;gBACvH,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,iBAAiB,CAAC;aACnD,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/checks/agent-card.d.ts

@@ -0,0 +1,37 @@
+import type { CheckContext, CheckResult, CheckMeta } from '../types.js';
+/**
+ * "agent-card" — the A2A (Agent2Agent) Agent Card.
+ *
+ * Two things changed since this check was written, and both matter:
+ *
+ * 1. **The path moved.** A2A v0.3.0 (2025-07-30) relocated the card from
+ *    `/.well-known/agent.json` to `/.well-known/agent-card.json`, which is now
+ *    an IANA-registered well-known URI. A site serving only the old path is
+ *    invisible to a current client.
+ *
+ * 2. **The shape changed.** A2A 1.0 (2026-03-12, breaking) folded the
+ *    top-level `url`, `protocolVersion`, `preferredTransport` and
+ *    `additionalInterfaces` fields into a single `supportedInterfaces[]` array,
+ *    and renamed `supportsAuthenticatedExtendedCard` to
+ *    `capabilities.extendedAgentCard`. Most deployed cards are still 0.3-shaped.
+ *
+ * Validating a 1.0 card against 0.3 rules (or the reverse) produces nonsense,
+ * so the check detects which generation a card belongs to from its own
+ * structure and applies the matching rules. `authentication`, dropped back in
+ * 0.2.x in favour of `securitySchemes`, is flagged wherever it appears.
+ *
+ * Spec: https://a2a-protocol.org/latest/specification/
+ * Normative field list: specification/a2a.proto in github.com/a2aproject/A2A
+ */
+export declare const meta: CheckMeta;
+/** Which generation of the A2A spec a card was written against. */
+type Generation = 'v1' | 'v0.3' | 'unknown';
+/**
+ * Detect the card generation from its own structure rather than from a version
+ * field, because 0.3 cards state `protocolVersion` at the top level and 1.0
+ * cards state it per interface.
+ */
+export declare function detectGeneration(data: Record<string, unknown>): Generation;
+export default function check(ctx: CheckContext): Promise<CheckResult>;
+export {};
+//# sourceMappingURL=agent-card.d.ts.map

package/dist/checks/agent-card.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-card.d.ts","sourceRoot":"","sources":["../../src/checks/agent-card.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,EAA0B,MAAM,aAAa,CAAC;AAKhG;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,IAAI,EAAE,SAMlB,CAAC;AAKF,mEAAmE;AACnE,KAAK,UAAU,GAAG,IAAI,GAAG,MAAM,GAAG,SAAS,CAAC;AAE5C;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,CAI1E;AAqBD,wBAA8B,KAAK,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAkF3E"}