ax-audit 3.6.0 → 4.0.0

package/dist/checks/http-headers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-headers.d.ts","sourceRoot":"","sources":["../../src/checks/http-headers.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,EAAW,MAAM,aAAa,CAAC;AAGjF,UAAU,SAAS;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED,6DAA6D;AAC7D,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,CA2B3D;AAoCD,eAAO,MAAM,IAAI,EAAE,SAKlB,CAAC;AAEF,wBAA8B,KAAK,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CA4G3E"}
+{"version":3,"file":"http-headers.d.ts","sourceRoot":"","sources":["../../src/checks/http-headers.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,EAAW,MAAM,aAAa,CAAC;AAGjF,UAAU,SAAS;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED,6DAA6D;AAC7D,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,CA2B3D;AAsFD,eAAO,MAAM,IAAI,EAAE,SAKlB,CAAC;AAwBF,wBAA8B,KAAK,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAoH3E"}

package/dist/checks/http-headers.js

@@ -26,6 +26,49 @@ export function parseLinkHeader(header) {
     }
     return entries;
 }
+/**
+ * Report the discovery relations a site advertises beyond llms.txt and the
+ * Agent Card. Each one saves an agent a round of path guessing, and several
+ * point at resources no amount of guessing would find.
+ */
+function reportDiscoveryRelations(links, headers, findings) {
+    const present = [];
+    const missing = [];
+    for (const { rel, label, note } of DISCOVERY_RELATIONS) {
+        const found = links.some((l) => (l.params['rel'] ?? '').split(/\s+/).includes(rel));
+        if (found)
+            present.push(label);
+        else
+            missing.push({ label, note });
+    }
+    const markdownAlternate = links.some((l) => (l.params['rel'] ?? '').split(/\s+/).includes('alternate') && (l.params['type'] ?? '').includes('text/markdown'));
+    if (markdownAlternate)
+        present.push('alternate (text/markdown)');
+    if (headers['x-llms-txt'] !== undefined) {
+        findings.push({
+            status: 'pass',
+            message: 'X-Llms-Txt header advertises the llms.txt location',
+            detail: headers['x-llms-txt'],
+        });
+    }
+    if (present.length > 0) {
+        findings.push({
+            status: 'pass',
+            message: `${present.length} additional discovery relation(s) advertised: ${present.join(', ')}`,
+        });
+    }
+    if (missing.length === DISCOVERY_RELATIONS.length && !markdownAlternate) {
+        findings.push({
+            status: 'warn',
+            message: 'No machine-readable discovery relations beyond llms.txt and the Agent Card',
+            detail: DISCOVERY_RELATIONS.map((r) => `${r.label} — ${r.note}`).join('\n'),
+            hint: 'Advertise what you publish with Link relations so agents stop guessing paths. Add the ones that apply, ' +
+                'for example: Link: </llms.txt>; rel="describedby", </.well-known/api-catalog>; rel="api-catalog". ' +
+                'Informational in 3.x: this does not affect your score.',
+            learnMoreUrl: guideUrl(meta.id, 'discovery-relations'),
+        });
+    }
+}
 /** Split a Link header value by commas, respecting angle brackets. */
 function splitLinkHeader(header) {
     const parts = [];
@@ -63,8 +106,29 @@ export const meta = {
     id: 'http-headers',
     name: 'HTTP Headers',
     description: 'Checks security headers, AI discovery Link headers, and CORS',
-    weight: 9,
+    category: 'discovery',
 };
+/**
+ * Link relations that tell an agent where a site's machine-readable resources
+ * live. Discovery by link beats discovery by guessing: an agent that has to try
+ * known filenames finds only the ones it already knows to look for.
+ *
+ * Reported, never required — several of these relations come from drafts, and
+ * a site that publishes none of them is not doing anything wrong.
+ */
+const DISCOVERY_RELATIONS = [
+    {
+        rel: 'describedby',
+        label: 'describedby',
+        note: 'llms.txt v2 uses this relation to point a page at the llms.txt that covers it.',
+    },
+    { rel: 'api-catalog', label: 'api-catalog', note: 'RFC 9727: the catalog of APIs this publisher offers.' },
+    { rel: 'service-desc', label: 'service-desc', note: 'RFC 8631: a machine-readable API description.' },
+    { rel: 'service-doc', label: 'service-doc', note: 'RFC 8631: human documentation for the API.' },
+    { rel: 'ai-catalog', label: 'ai-catalog', note: 'Draft: the AI catalog listing agent cards and MCP server cards.' },
+    { rel: 'c2pa-manifest', label: 'c2pa-manifest', note: 'C2PA 2.4: content provenance for media on the page.' },
+    { rel: 'license', label: 'license', note: 'RSL and other machine-readable licensing terms.' },
+];
 export default async function check(ctx) {
     const start = performance.now();
     const findings = [];
@@ -107,22 +171,24 @@ export default async function check(ctx) {
     const linkHeader = headers['link'] ?? '';
     const links = parseLinkHeader(linkHeader);
     const hasLlmsLink = links.some((l) => /llms\.txt/i.test(l.url));
-    const hasAgentLink = links.some((l) => /agent\.json/i.test(l.url));
+    // A2A moved the card to agent-card.json in v0.3.0; both paths count as a
+    // discovery link so a site that upgraded is not marked down for it.
+    const hasAgentLink = links.some((l) => /agent(-card)?\.json/i.test(l.url));
     if (hasLlmsLink && hasAgentLink) {
-        findings.push({ status: 'pass', message: 'Link header references both llms.txt and agent.json' });
+        findings.push({ status: 'pass', message: 'Link header references both llms.txt and the Agent Card' });
     }
     else if (hasLlmsLink) {
         findings.push({ status: 'pass', message: 'Link header references llms.txt' });
         findings.push({
             status: 'warn',
-            message: 'Link header does not reference agent.json',
-            hint: 'Add agent.json to your Link header: Link: </.well-known/agent.json>; rel="alternate"; type="application/json"',
+            message: 'Link header does not reference the Agent Card',
+            hint: 'Add the Agent Card to your Link header: Link: </.well-known/agent-card.json>; rel="alternate"; type="application/json"',
             learnMoreUrl: guideUrl(meta.id, 'missing-agent-link'),
         });
         score -= 5;
     }
     else if (hasAgentLink) {
-        findings.push({ status: 'pass', message: 'Link header references agent.json' });
+        findings.push({ status: 'pass', message: 'Link header references the Agent Card' });
         findings.push({
             status: 'warn',
             message: 'Link header does not reference llms.txt',
@@ -135,7 +201,7 @@ export default async function check(ctx) {
         findings.push({
             status: 'warn',
             message: 'Link header present but does not reference AI discovery files',
-            hint: 'Add AI discovery entries to your Link header: Link: </llms.txt>; rel="alternate"; type="text/plain", </.well-known/agent.json>; rel="alternate"; type="application/json"',
+            hint: 'Add AI discovery entries to your Link header: Link: </llms.txt>; rel="alternate"; type="text/plain", </.well-known/agent-card.json>; rel="alternate"; type="application/json"',
             learnMoreUrl: guideUrl(meta.id, 'no-ai-discovery'),
         });
         score -= 15;
@@ -143,13 +209,17 @@ export default async function check(ctx) {
     else {
         findings.push({
             status: 'warn',
-            message: 'No Link header for AI discovery (llms.txt, agent.json)',
-            hint: 'Add a Link response header pointing to your AI discovery files: Link: </llms.txt>; rel="alternate"; type="text/plain", </.well-known/agent.json>; rel="alternate"; type="application/json"',
+            message: 'No Link header for AI discovery (llms.txt, Agent Card)',
+            hint: 'Add a Link response header pointing to your AI discovery files: Link: </llms.txt>; rel="alternate"; type="text/plain", </.well-known/agent-card.json>; rel="alternate"; type="application/json"',
             learnMoreUrl: guideUrl(meta.id, 'no-link-header'),
         });
         score -= 15;
     }
-    const wellKnownRes = await ctx.fetch(`${ctx.url}/.well-known/agent.json`);
+    // Probe the registered path first, falling back to the pre-0.3 one, so CORS
+    // is evaluated against whichever card the site actually serves.
+    let wellKnownRes = await ctx.fetch(`${ctx.url}/.well-known/agent-card.json`);
+    if (!wellKnownRes.ok)
+        wellKnownRes = await ctx.fetch(`${ctx.url}/.well-known/agent.json`);
     if (wellKnownRes.ok) {
         const cors = wellKnownRes.headers['access-control-allow-origin'];
         if (cors) {
@@ -172,6 +242,8 @@ export default async function check(ctx) {
             message: 'X-Robots-Tag: noindex on /llms.txt (prevents search indexing of raw text)',
         });
     }
+    // Informational in 3.x: new findings inside a weighted check must not deduct.
+    reportDiscoveryRelations(links, headers, findings);
     return buildResult(meta, score, findings, start);
 }
 //# sourceMappingURL=http-headers.js.map

package/dist/checks/http-headers.js.map

@@ -1 +1 @@
-{"version":3,"file":"http-headers.js","sourceRoot":"","sources":["../../src/checks/http-headers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAOzC,6DAA6D;AAC7D,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IAEvB,MAAM,OAAO,GAAgB,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAEtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,SAAS;QAEvB,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ;YAAE,SAAS;QAExB,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,MAAM,GAA2B,EAAE,CAAC;QAE1C,MAAM,UAAU,GAAG,+CAA+C,CAAC;QACnE,IAAI,KAAK,CAAC;QACV,OAAO,CAAC,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAChD,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;QACxD,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;IAChC,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,sEAAsE;AACtE,SAAS,eAAe,CAAC,MAAc;IACrC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAErB,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAC3B,OAAO,GAAG,CAAC,OAAO,CAAC;YACnB,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,OAAO,GAAG,KAAK,CAAC;YAChB,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;YAC9C,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpB,OAAO,GAAG,EAAE,CAAC;QACf,CAAC;aAAM,CAAC;YACN,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,MAAM,IAAI,GAAc;IAC7B,EAAE,EAAE,cAAc;IAClB,IAAI,EAAE,cAAc;IACpB,WAAW,EAAE,8DAA8D;IAC3E,MAAM,EAAE,CAAC;CACV,CAAC;AAEF,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,KAAK,CAAC,GAAiB;IACnD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,KAAK,GAAG,GAAG,CAAC;IAEhB,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC5B,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC,CAAC;QAC/E,OAAO,WAAW,CAAC,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,KAAK,MAAM,MAAM,IAAI,gBAAgB,EAAE,CAAC;QACtC,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,aAAa,EAAE,CAAC;QAClB,CAAC;aAAM,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC3B,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,4BAA4B,MAAM,CAAC,KAAK,EAAE;gBACnD,IAAI,EAAE,WAAW,MAAM,CAAC,KAAK,oFAAoF;gBACjH,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,yBAAyB,CAAC;aAC3D,CAAC,CAAC;YACH,KAAK,IAAI,EAAE,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,aAAa,KAAK,gBAAgB,CAAC,MAAM,EAAE,CAAC;QAC9C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,gBAAgB,CAAC,MAAM,2BAA2B,EAAE,CAAC,CAAC;IACxG,CAAC;SAAM,IAAI,aAAa,IAAI,CAAC,EAAE,CAAC;QAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,IAAI,gBAAgB,CAAC,MAAM,2BAA2B,EAAE,CAAC,CAAC;IACrH,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,QAAQ,aAAa,IAAI,gBAAgB,CAAC,MAAM,2BAA2B;YACpF,IAAI,EAAE,4IAA4I;YAClJ,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,sBAAsB,CAAC;SACxD,CAAC,CAAC;QACH,KAAK,IAAI,CAAC,CAAC;IACb,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChE,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAEnE,IAAI,WAAW,IAAI,YAAY,EAAE,CAAC;QAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC,CAAC;IACpG,CAAC;SAAM,IAAI,WAAW,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC9E,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,2CAA2C;YACpD,IAAI,EAAE,+GAA+G;YACrH,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,oBAAoB,CAAC;SACtD,CAAC,CAAC;QACH,KAAK,IAAI,CAAC,CAAC;IACb,CAAC;SAAM,IAAI,YAAY,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC,CAAC;QAChF,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,yCAAyC;YAClD,IAAI,EAAE,yFAAyF;YAC/F,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,mBAAmB,CAAC;SACrD,CAAC,CAAC;QACH,KAAK,IAAI,CAAC,CAAC;IACb,CAAC;SAAM,IAAI,UAAU,EAAE,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,+DAA+D;YACxE,IAAI,EAAE,0KAA0K;YAChL,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,iBAAiB,CAAC;SACnD,CAAC,CAAC;QACH,KAAK,IAAI,EAAE,CAAC;IACd,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,wDAAwD;YACjE,IAAI,EAAE,4LAA4L;YAClM,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,gBAAgB,CAAC;SAClD,CAAC,CAAC;QACH,KAAK,IAAI,EAAE,CAAC;IACd,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,GAAG,yBAAyB,CAAC,CAAC;IAC1E,IAAI,YAAY,CAAC,EAAE,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC;QACjE,IAAI,IAAI,EAAE,CAAC;YACT,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,CAAC;QACtF,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,0CAA0C;gBACnD,IAAI,EAAE,qIAAqI;gBAC3I,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC;aAC3C,CAAC,CAAC;YACH,KAAK,IAAI,EAAE,CAAC;QACd,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,GAAG,WAAW,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACvE,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,2EAA2E;SACrF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AACnD,CAAC"}
+{"version":3,"file":"http-headers.js","sourceRoot":"","sources":["../../src/checks/http-headers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAOzC,6DAA6D;AAC7D,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IAEvB,MAAM,OAAO,GAAgB,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAEtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,SAAS;QAEvB,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ;YAAE,SAAS;QAExB,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,MAAM,GAA2B,EAAE,CAAC;QAE1C,MAAM,UAAU,GAAG,+CAA+C,CAAC;QACnE,IAAI,KAAK,CAAC;QACV,OAAO,CAAC,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAChD,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;QACxD,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;IAChC,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,SAAS,wBAAwB,CAAC,KAAkB,EAAE,OAA+B,EAAE,QAAmB;IACxG,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAsC,EAAE,CAAC;IAEtD,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,mBAAmB,EAAE,CAAC;QACvD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QACpF,IAAI,KAAK;YAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;;YAC1B,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAClC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CACnH,CAAC;IACF,IAAI,iBAAiB;QAAE,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAEjE,IAAI,OAAO,CAAC,YAAY,CAAC,KAAK,SAAS,EAAE,CAAC;QACxC,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,oDAAoD;YAC7D,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC;SAC9B,CAAC,CAAC;IACL,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,iDAAiD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAChG,CAAC,CAAC;IACL,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,mBAAmB,CAAC,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACxE,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,4EAA4E;YACrF,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAC3E,IAAI,EACF,yGAAyG;gBACzG,oGAAoG;gBACpG,wDAAwD;YAC1D,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,qBAAqB,CAAC;SACvD,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,sEAAsE;AACtE,SAAS,eAAe,CAAC,MAAc;IACrC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAErB,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAC3B,OAAO,GAAG,CAAC,OAAO,CAAC;YACnB,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,OAAO,GAAG,KAAK,CAAC;YAChB,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;YAC9C,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpB,OAAO,GAAG,EAAE,CAAC;QACf,CAAC;aAAM,CAAC;YACN,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,MAAM,IAAI,GAAc;IAC7B,EAAE,EAAE,cAAc;IAClB,IAAI,EAAE,cAAc;IACpB,WAAW,EAAE,8DAA8D;IAC3E,QAAQ,EAAE,WAAW;CACtB,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,mBAAmB,GAAmD;IAC1E;QACE,GAAG,EAAE,aAAa;QAClB,KAAK,EAAE,aAAa;QACpB,IAAI,EAAE,gFAAgF;KACvF;IACD,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,sDAAsD,EAAE;IAC1G,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,+CAA+C,EAAE;IACrG,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,4CAA4C,EAAE;IAChG,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,iEAAiE,EAAE;IACnH,EAAE,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,qDAAqD,EAAE;IAC7G,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,iDAAiD,EAAE;CAC9F,CAAC;AAEF,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,KAAK,CAAC,GAAiB;IACnD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,KAAK,GAAG,GAAG,CAAC;IAEhB,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC5B,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC,CAAC;QAC/E,OAAO,WAAW,CAAC,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,KAAK,MAAM,MAAM,IAAI,gBAAgB,EAAE,CAAC;QACtC,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,aAAa,EAAE,CAAC;QAClB,CAAC;aAAM,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC3B,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,4BAA4B,MAAM,CAAC,KAAK,EAAE;gBACnD,IAAI,EAAE,WAAW,MAAM,CAAC,KAAK,oFAAoF;gBACjH,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,yBAAyB,CAAC;aAC3D,CAAC,CAAC;YACH,KAAK,IAAI,EAAE,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,aAAa,KAAK,gBAAgB,CAAC,MAAM,EAAE,CAAC;QAC9C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,gBAAgB,CAAC,MAAM,2BAA2B,EAAE,CAAC,CAAC;IACxG,CAAC;SAAM,IAAI,aAAa,IAAI,CAAC,EAAE,CAAC;QAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,IAAI,gBAAgB,CAAC,MAAM,2BAA2B,EAAE,CAAC,CAAC;IACrH,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,QAAQ,aAAa,IAAI,gBAAgB,CAAC,MAAM,2BAA2B;YACpF,IAAI,EAAE,4IAA4I;YAClJ,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,sBAAsB,CAAC;SACxD,CAAC,CAAC;QACH,KAAK,IAAI,CAAC,CAAC;IACb,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChE,yEAAyE;IACzE,oEAAoE;IACpE,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAE3E,IAAI,WAAW,IAAI,YAAY,EAAE,CAAC;QAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,yDAAyD,EAAE,CAAC,CAAC;IACxG,CAAC;SAAM,IAAI,WAAW,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC9E,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,+CAA+C;YACxD,IAAI,EAAE,wHAAwH;YAC9H,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,oBAAoB,CAAC;SACtD,CAAC,CAAC;QACH,KAAK,IAAI,CAAC,CAAC;IACb,CAAC;SAAM,IAAI,YAAY,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,CAAC;QACpF,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,yCAAyC;YAClD,IAAI,EAAE,yFAAyF;YAC/F,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,mBAAmB,CAAC;SACrD,CAAC,CAAC;QACH,KAAK,IAAI,CAAC,CAAC;IACb,CAAC;SAAM,IAAI,UAAU,EAAE,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,+DAA+D;YACxE,IAAI,EAAE,+KAA+K;YACrL,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,iBAAiB,CAAC;SACnD,CAAC,CAAC;QACH,KAAK,IAAI,EAAE,CAAC;IACd,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,wDAAwD;YACjE,IAAI,EAAE,iMAAiM;YACvM,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,gBAAgB,CAAC;SAClD,CAAC,CAAC;QACH,KAAK,IAAI,EAAE,CAAC;IACd,CAAC;IAED,4EAA4E;IAC5E,gEAAgE;IAChE,IAAI,YAAY,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,GAAG,8BAA8B,CAAC,CAAC;IAC7E,IAAI,CAAC,YAAY,CAAC,EAAE;QAAE,YAAY,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,GAAG,yBAAyB,CAAC,CAAC;IAC1F,IAAI,YAAY,CAAC,EAAE,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC;QACjE,IAAI,IAAI,EAAE,CAAC;YACT,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,CAAC;QACtF,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,0CAA0C;gBACnD,IAAI,EAAE,qIAAqI;gBAC3I,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC;aAC3C,CAAC,CAAC;YACH,KAAK,IAAI,EAAE,CAAC;QACd,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,GAAG,WAAW,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACvE,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,2EAA2E;SACrF,CAAC,CAAC;IACL,CAAC;IAED,8EAA8E;IAC9E,wBAAwB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAEnD,OAAO,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AACnD,CAAC"}

package/dist/checks/http-hygiene.d.ts

@@ -0,0 +1,26 @@
+import type { CheckContext, CheckResult, CheckMeta } from '../types.js';
+/**
+ * "http-hygiene" — does this site answer honestly at the protocol level?
+ *
+ * An agent has no eyes. It decides what happened from the status code, and it
+ * has no way to notice that the 200 it just received is a "page not found"
+ * screen. A human seeing that page moves on; an agent stores the apology as the
+ * answer, or retries forever, or reports it to the user as content.
+ *
+ * The failures here are unglamorous and common:
+ *
+ * - **Soft 404s.** A missing page answering `200 OK`, or redirecting to the
+ *   homepage. Every "not found" an agent cannot detect becomes a fabricated
+ *   fact or a wasted retry.
+ * - **Rate limits without `Retry-After`.** A `429` with no header tells a
+ *   well-behaved crawler nothing about when to come back, so it either gives up
+ *   or hammers. The header is how backoff is negotiated.
+ * - **Long redirect chains.** Each hop is a round trip an agent pays for, and
+ *   some clients cap their hops well below what browsers allow.
+ * - **`HEAD` refused.** A cheap existence check turned into a full download.
+ * - **Missing charset**, which turns non-ASCII text into replacement characters
+ *   in whatever the agent quotes.
+ */
+export declare const meta: CheckMeta;
+export default function check(ctx: CheckContext): Promise<CheckResult>;
+//# sourceMappingURL=http-hygiene.d.ts.map

package/dist/checks/http-hygiene.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-hygiene.d.ts","sourceRoot":"","sources":["../../src/checks/http-hygiene.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,EAAW,MAAM,aAAa,CAAC;AAKjF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,IAAI,EAAE,SAKlB,CAAC;AAiBF,wBAA8B,KAAK,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAW3E"}

package/dist/checks/http-hygiene.js

@@ -0,0 +1,257 @@
+import { guideUrl } from '../guide-urls.js';
+import { buildResult } from './utils.js';
+import { extractVisibleText, getTagAttribute } from './html-utils.js';
+import { classifyResponse } from './waf.js';
+/**
+ * "http-hygiene" — does this site answer honestly at the protocol level?
+ *
+ * An agent has no eyes. It decides what happened from the status code, and it
+ * has no way to notice that the 200 it just received is a "page not found"
+ * screen. A human seeing that page moves on; an agent stores the apology as the
+ * answer, or retries forever, or reports it to the user as content.
+ *
+ * The failures here are unglamorous and common:
+ *
+ * - **Soft 404s.** A missing page answering `200 OK`, or redirecting to the
+ *   homepage. Every "not found" an agent cannot detect becomes a fabricated
+ *   fact or a wasted retry.
+ * - **Rate limits without `Retry-After`.** A `429` with no header tells a
+ *   well-behaved crawler nothing about when to come back, so it either gives up
+ *   or hammers. The header is how backoff is negotiated.
+ * - **Long redirect chains.** Each hop is a round trip an agent pays for, and
+ *   some clients cap their hops well below what browsers allow.
+ * - **`HEAD` refused.** A cheap existence check turned into a full download.
+ * - **Missing charset**, which turns non-ASCII text into replacement characters
+ *   in whatever the agent quotes.
+ */
+export const meta = {
+    id: 'http-hygiene',
+    name: 'HTTP Hygiene',
+    description: 'Checks status-code honesty, redirect depth, rate-limit headers and content typing',
+    category: 'access',
+};
+/** Redirect hops tolerated on the homepage before it costs an agent real time. */
+const MAX_REDIRECT_HOPS = 1;
+/** Phrases a soft-404 body uses. Matched only against short bodies, to avoid false hits on articles about 404s. */
+const NOT_FOUND_PHRASES = /\b(404|page not found|not found|no longer exists|doesn'?t exist|does not exist|couldn'?t find|could not find)\b/i;
+/** Body shorter than this is treated as an error page rather than content. */
+const SHORT_BODY_CHARS = 600;
+/** Build a path that cannot plausibly exist, so a 200 proves the site invents pages. */
+function improbablePath() {
+    return `/ax-audit-probe-${Math.random().toString(36).slice(2, 10)}`;
+}
+export default async function check(ctx) {
+    const start = performance.now();
+    const findings = [];
+    let score = 100;
+    score = await checkSoft404(ctx, findings, score);
+    score = await checkRedirects(ctx, findings, score);
+    score = await checkHeadSupport(ctx, findings, score);
+    score = checkContentTyping(ctx, findings, score);
+    return buildResult(meta, score, findings, start);
+}
+/**
+ * Request a path that cannot exist and insist the server say so. A `200`, a
+ * redirect to the homepage, or an error page dressed as content all break the
+ * one signal an agent can rely on.
+ */
+async function checkSoft404(ctx, findings, score) {
+    const path = improbablePath();
+    const res = await ctx.fetch(`${ctx.url}${path}`, { redirect: 'manual' });
+    const cls = classifyResponse(res);
+    if (cls.kind === 'challenge' || cls.kind === 'needs-signature') {
+        findings.push({
+            status: 'warn',
+            message: 'Could not test 404 handling — the probe was challenged',
+            detail: cls.evidence.join('; '),
+            hint: 'Bot management answered a plain GET with an interstitial, so status-code honesty could not be verified from outside.',
+            learnMoreUrl: guideUrl(meta.id, 'probe-challenged'),
+        });
+        return score;
+    }
+    if (res.status === 404 || res.status === 410) {
+        findings.push({ status: 'pass', message: `Missing pages return ${res.status}` });
+        return checkErrorBody(res.body, findings, score);
+    }
+    if (res.status >= 300 && res.status < 400) {
+        const target = res.redirectLocation ?? '';
+        const toRoot = target === '/' || target === ctx.url || target === `${ctx.url}/`;
+        findings.push({
+            status: 'warn',
+            message: `A missing page redirects (${res.status}) instead of returning 404`,
+            detail: `Location: ${target || '(none)'}`,
+            hint: toRoot
+                ? 'Redirecting every unknown URL to the homepage means an agent following a stale link believes it arrived. Return 404 or 410.'
+                : 'A redirect on a nonexistent path hides the error. Return 404 or 410 so a client can tell the difference.',
+            learnMoreUrl: guideUrl(meta.id, 'soft-404-redirect'),
+        });
+        return score - 20;
+    }
+    if (res.status === 200) {
+        const text = extractVisibleText(res.body);
+        const looksLikeError = text.length < SHORT_BODY_CHARS && NOT_FOUND_PHRASES.test(text);
+        findings.push({
+            status: 'fail',
+            message: looksLikeError
+                ? 'A "page not found" screen is served with HTTP 200'
+                : 'A nonexistent path returns HTTP 200',
+            detail: `${path} → 200 (${text.length} chars of visible text)`,
+            hint: 'An agent has no way to see that this page is an apology. It stores the text as the answer, or retries a URL ' +
+                'that will never work. Return 404 for missing pages and 410 for removed ones.',
+            learnMoreUrl: guideUrl(meta.id, 'soft-404'),
+        });
+        return score - 30;
+    }
+    if (res.status === 403 || res.status === 401) {
+        findings.push({
+            status: 'warn',
+            message: `A nonexistent path returns ${res.status} rather than 404`,
+            hint: 'Answering unknown paths with 403 is a defensible hardening choice, but it stops a client distinguishing "missing" from "forbidden".',
+            learnMoreUrl: guideUrl(meta.id, 'not-found-403'),
+        });
+        return score - 5;
+    }
+    findings.push({
+        status: 'warn',
+        message: `A nonexistent path returns ${res.status || 'a network error'}`,
+        hint: 'Missing pages should return 404 or 410.',
+        learnMoreUrl: guideUrl(meta.id, 'soft-404'),
+    });
+    return score - 10;
+}
+/** A correct 404 can still ship an unhelpful body. */
+function checkErrorBody(body, findings, score) {
+    if (body.trim().length === 0) {
+        findings.push({
+            status: 'warn',
+            message: '404 responses have an empty body',
+            hint: 'Send a short explanation and a link back into the site. An agent that hits a dead link can then recover instead of stopping.',
+            learnMoreUrl: guideUrl(meta.id, 'empty-error-body'),
+        });
+        return score - 5;
+    }
+    return score;
+}
+/** Count redirect hops from the audited URL to the page that finally answers. */
+async function checkRedirects(ctx, findings, score) {
+    let url = ctx.url;
+    const chain = [];
+    for (let hop = 0; hop <= 5; hop++) {
+        const res = await ctx.fetch(url, { redirect: 'manual' });
+        if (res.status < 300 || res.status >= 400 || !res.redirectLocation)
+            break;
+        let next;
+        try {
+            next = new URL(res.redirectLocation, url).toString();
+        }
+        catch {
+            break;
+        }
+        chain.push(`${res.status} → ${next}`);
+        if (next === url)
+            break;
+        url = next;
+    }
+    if (chain.length === 0) {
+        findings.push({ status: 'pass', message: 'Homepage answers without a redirect' });
+        return score;
+    }
+    if (chain.length <= MAX_REDIRECT_HOPS) {
+        findings.push({
+            status: 'pass',
+            message: `Homepage answers after ${chain.length} redirect`,
+            detail: chain.join('\n'),
+        });
+        return score;
+    }
+    findings.push({
+        status: 'warn',
+        message: `Homepage takes ${chain.length} redirects to answer`,
+        detail: chain.join('\n'),
+        hint: 'Every hop is a round trip the agent pays for, and some clients cap redirects well below a browser. ' +
+            'Collapse the chain: point the first URL straight at the final one.',
+        learnMoreUrl: guideUrl(meta.id, 'redirect-chain'),
+    });
+    return score - 10;
+}
+/** `HEAD` is how a client checks existence without paying for the body. */
+async function checkHeadSupport(ctx, findings, score) {
+    const res = await ctx.fetch(ctx.url, { method: 'HEAD' });
+    if (res.status === 405 || res.status === 501) {
+        findings.push({
+            status: 'warn',
+            message: `HEAD requests are refused (${res.status})`,
+            hint: 'HEAD lets a client confirm a URL exists, or check Last-Modified, without downloading the page. Refusing it turns every existence check into a full transfer.',
+            learnMoreUrl: guideUrl(meta.id, 'head-refused'),
+        });
+        return score - 10;
+    }
+    if (res.ok) {
+        findings.push({ status: 'pass', message: 'HEAD requests are supported' });
+    }
+    // A rate limit on the second request of an audit is a real finding: nothing
+    // here resembles a crawl.
+    if (res.status === 429) {
+        const retryAfter = res.headers['retry-after'];
+        findings.push({
+            status: retryAfter === undefined ? 'fail' : 'warn',
+            message: retryAfter === undefined
+                ? 'Rate limited with no Retry-After header'
+                : `Rate limited after two requests (Retry-After: ${retryAfter})`,
+            hint: retryAfter === undefined
+                ? 'A 429 without Retry-After tells a well-behaved crawler nothing about when to return, so it either gives up or keeps hammering. Always send the header.'
+                : 'A limit this tight will stall any crawl. Consider a higher allowance for identified AI crawlers.',
+            learnMoreUrl: guideUrl(meta.id, 'rate-limit'),
+        });
+        return score - (retryAfter === undefined ? 20 : 10);
+    }
+    return score;
+}
+/** Character encoding and language declarations, which decide what an agent quotes. */
+function checkContentTyping(ctx, findings, score) {
+    const headers = ctx.headers ?? {};
+    const contentType = headers['content-type'] ?? '';
+    if (contentType === '') {
+        findings.push({
+            status: 'warn',
+            message: 'Homepage has no Content-Type header',
+            hint: 'Send Content-Type: text/html; charset=utf-8 so a client does not have to guess the encoding.',
+            learnMoreUrl: guideUrl(meta.id, 'no-content-type'),
+        });
+        return score - 10;
+    }
+    const hasCharset = /charset=/i.test(contentType);
+    const hasMetaCharset = /<meta[^>]+charset\s*=/i.test(ctx.html ?? '');
+    if (!hasCharset && !hasMetaCharset) {
+        findings.push({
+            status: 'warn',
+            message: 'No character encoding declared in the header or the document',
+            hint: 'Without a charset, non-ASCII text is decoded by guesswork and quoted back with replacement characters. Add charset=utf-8.',
+            learnMoreUrl: guideUrl(meta.id, 'no-charset'),
+        });
+        score -= 10;
+    }
+    else if (!hasCharset) {
+        findings.push({
+            status: 'pass',
+            message: 'Character encoding declared in the document (not in the Content-Type header)',
+        });
+    }
+    else {
+        findings.push({ status: 'pass', message: `Content-Type: ${contentType.split(';')[0]} with charset` });
+    }
+    // `Content-Language` and `<html lang>` should not contradict each other.
+    const htmlLang = (getTagAttribute(ctx.html ?? '', 'html', 'lang') ?? '').toLowerCase();
+    const contentLanguage = (headers['content-language'] ?? '').toLowerCase().split(',')[0].trim();
+    if (htmlLang !== '' && contentLanguage !== '' && htmlLang.split('-')[0] !== contentLanguage.split('-')[0]) {
+        findings.push({
+            status: 'warn',
+            message: `<html lang="${htmlLang}"> disagrees with Content-Language: ${contentLanguage}`,
+            hint: 'Agents pick a language signal and translate or route on it. Make the two agree.',
+            learnMoreUrl: guideUrl(meta.id, 'language-mismatch'),
+        });
+        score -= 5;
+    }
+    return score;
+}
+//# sourceMappingURL=http-hygiene.js.map

package/dist/checks/http-hygiene.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-hygiene.js","sourceRoot":"","sources":["../../src/checks/http-hygiene.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAE5C;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,IAAI,GAAc;IAC7B,EAAE,EAAE,cAAc;IAClB,IAAI,EAAE,cAAc;IACpB,WAAW,EAAE,mFAAmF;IAChG,QAAQ,EAAE,QAAQ;CACnB,CAAC;AAEF,kFAAkF;AAClF,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAE5B,mHAAmH;AACnH,MAAM,iBAAiB,GACrB,kHAAkH,CAAC;AAErH,8EAA8E;AAC9E,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B,wFAAwF;AACxF,SAAS,cAAc;IACrB,OAAO,mBAAmB,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,KAAK,CAAC,GAAiB;IACnD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,KAAK,GAAG,GAAG,CAAC;IAEhB,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACjD,KAAK,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACnD,KAAK,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACrD,KAAK,GAAG,kBAAkB,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAEjD,OAAO,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,YAAY,CAAC,GAAiB,EAAE,QAAmB,EAAE,KAAa;IAC/E,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACzE,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAElC,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,IAAI,GAAG,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC/D,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,wDAAwD;YACjE,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;YAC/B,IAAI,EAAE,sHAAsH;YAC5H,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,kBAAkB,CAAC;SACpD,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC7C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,wBAAwB,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACjF,OAAO,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC;QAChF,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,6BAA6B,GAAG,CAAC,MAAM,4BAA4B;YAC5E,MAAM,EAAE,aAAa,MAAM,IAAI,QAAQ,EAAE;YACzC,IAAI,EAAE,MAAM;gBACV,CAAC,CAAC,6HAA6H;gBAC/H,CAAC,CAAC,0GAA0G;YAC9G,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,mBAAmB,CAAC;SACrD,CAAC,CAAC;QACH,OAAO,KAAK,GAAG,EAAE,CAAC;IACpB,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,GAAG,gBAAgB,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtF,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,cAAc;gBACrB,CAAC,CAAC,mDAAmD;gBACrD,CAAC,CAAC,qCAAqC;YACzC,MAAM,EAAE,GAAG,IAAI,WAAW,IAAI,CAAC,MAAM,yBAAyB;YAC9D,IAAI,EACF,8GAA8G;gBAC9G,8EAA8E;YAChF,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC;SAC5C,CAAC,CAAC;QACH,OAAO,KAAK,GAAG,EAAE,CAAC;IACpB,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC7C,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,8BAA8B,GAAG,CAAC,MAAM,kBAAkB;YACnE,IAAI,EAAE,qIAAqI;YAC3I,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,eAAe,CAAC;SACjD,CAAC,CAAC;QACH,OAAO,KAAK,GAAG,CAAC,CAAC;IACnB,CAAC;IAED,QAAQ,CAAC,IAAI,CAAC;QACZ,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,8BAA8B,GAAG,CAAC,MAAM,IAAI,iBAAiB,EAAE;QACxE,IAAI,EAAE,yCAAyC;QAC/C,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC;KAC5C,CAAC,CAAC;IACH,OAAO,KAAK,GAAG,EAAE,CAAC;AACpB,CAAC;AAED,sDAAsD;AACtD,SAAS,cAAc,CAAC,IAAY,EAAE,QAAmB,EAAE,KAAa;IACtE,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,kCAAkC;YAC3C,IAAI,EAAE,8HAA8H;YACpI,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,kBAAkB,CAAC;SACpD,CAAC,CAAC;QACH,OAAO,KAAK,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,iFAAiF;AACjF,KAAK,UAAU,cAAc,CAAC,GAAiB,EAAE,QAAmB,EAAE,KAAa;IACjF,IAAI,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;IAClB,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzD,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,gBAAgB;YAAE,MAAM;QAC1E,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM;QACR,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;QACtC,IAAI,IAAI,KAAK,GAAG;YAAE,MAAM;QACxB,GAAG,GAAG,IAAI,CAAC;IACb,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC,CAAC;QAClF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,IAAI,iBAAiB,EAAE,CAAC;QACtC,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,0BAA0B,KAAK,CAAC,MAAM,WAAW;YAC1D,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;SACzB,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC;IAED,QAAQ,CAAC,IAAI,CAAC;QACZ,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,kBAAkB,KAAK,CAAC,MAAM,sBAAsB;QAC7D,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;QACxB,IAAI,EACF,qGAAqG;YACrG,oEAAoE;QACtE,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,gBAAgB,CAAC;KAClD,CAAC,CAAC;IACH,OAAO,KAAK,GAAG,EAAE,CAAC;AACpB,CAAC;AAED,2EAA2E;AAC3E,KAAK,UAAU,gBAAgB,CAAC,GAAiB,EAAE,QAAmB,EAAE,KAAa;IACnF,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAEzD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC7C,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,8BAA8B,GAAG,CAAC,MAAM,GAAG;YACpD,IAAI,EAAE,8JAA8J;YACpK,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,cAAc,CAAC;SAChD,CAAC,CAAC;QACH,OAAO,KAAK,GAAG,EAAE,CAAC;IACpB,CAAC;IAED,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;QACX,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,4EAA4E;IAC5E,0BAA0B;IAC1B,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAC9C,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YAClD,OAAO,EACL,UAAU,KAAK,SAAS;gBACtB,CAAC,CAAC,yCAAyC;gBAC3C,CAAC,CAAC,iDAAiD,UAAU,GAAG;YACpE,IAAI,EACF,UAAU,KAAK,SAAS;gBACtB,CAAC,CAAC,wJAAwJ;gBAC1J,CAAC,CAAC,kGAAkG;YACxG,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,CAAC;SAC9C,CAAC,CAAC;QACH,OAAO,KAAK,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uFAAuF;AACvF,SAAS,kBAAkB,CAAC,GAAiB,EAAE,QAAmB,EAAE,KAAa;IAC/E,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;IAClC,MAAM,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAElD,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,qCAAqC;YAC9C,IAAI,EAAE,8FAA8F;YACpG,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,iBAAiB,CAAC;SACnD,CAAC,CAAC;QACH,OAAO,KAAK,GAAG,EAAE,CAAC;IACpB,CAAC;IAED,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACjD,MAAM,cAAc,GAAG,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACrE,IAAI,CAAC,UAAU,IAAI,CAAC,cAAc,EAAE,CAAC;QACnC,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,8DAA8D;YACvE,IAAI,EAAE,2HAA2H;YACjI,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,CAAC;SAC9C,CAAC,CAAC;QACH,KAAK,IAAI,EAAE,CAAC;IACd,CAAC;SAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,8EAA8E;SACxF,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;IACxG,CAAC;IAED,yEAAyE;IACzE,MAAM,QAAQ,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACvF,MAAM,eAAe,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/F,IAAI,QAAQ,KAAK,EAAE,IAAI,eAAe,KAAK,EAAE,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1G,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,eAAe,QAAQ,uCAAuC,eAAe,EAAE;YACxF,IAAI,EAAE,iFAAiF;YACvF,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,mBAAmB,CAAC;SACrD,CAAC,CAAC;QACH,KAAK,IAAI,CAAC,CAAC;IACb,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/checks/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/checks/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAqB/C,eAAO,MAAM,MAAM,EAAE,WAAW,EAmB/B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/checks/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AA6B/C,eAAO,MAAM,MAAM,EAAE,WAAW,EA2B/B,CAAC"}

package/dist/checks/index.js

@@ -1,39 +1,55 @@
 import llmsTxt, { meta as llmsTxtMeta } from './llms-txt.js';
 import robotsTxt, { meta as robotsTxtMeta } from './robots-txt.js';
-import agentJson, { meta as agentJsonMeta } from './agent-json.js';
+import agentCard, { meta as agentCardMeta } from './agent-card.js';
 import securityTxt, { meta as securityTxtMeta } from './security-txt.js';
 import structuredData, { meta as structuredDataMeta } from './structured-data.js';
 import metaTags, { meta as metaTagsMeta } from './meta-tags.js';
-import openapi, { meta as openapiMeta } from './openapi.js';
+import apiDiscovery, { meta as apiDiscoveryMeta } from './api-discovery.js';
 import httpHeaders, { meta as httpHeadersMeta } from './http-headers.js';
-import mcp, { meta as mcpMeta } from './mcp.js';
+import mcpDiscovery, { meta as mcpDiscoveryMeta } from './mcp-discovery.js';
 import htmlRendering, { meta as htmlRenderingMeta } from './html-rendering.js';
 import sitemap, { meta as sitemapMeta } from './sitemap.js';
 import seoBasics, { meta as seoBasicsMeta } from './seo-basics.js';
 import tlsHttps, { meta as tlsHttpsMeta } from './tls-https.js';
-import wellKnownAi, { meta as wellKnownAiMeta } from './well-known-ai.js';
 import contentNegotiation, { meta as contentNegotiationMeta } from './content-negotiation.js';
 import rsl, { meta as rslMeta } from './rsl.js';
 import agentAccess, { meta as agentAccessMeta } from './agent-access.js';
 import crawlEfficiency, { meta as crawlEfficiencyMeta } from './crawl-efficiency.js';
+import aiDirectives, { meta as aiDirectivesMeta } from './ai-directives.js';
+import usagePolicy, { meta as usagePolicyMeta } from './usage-policy.js';
+import httpHygiene, { meta as httpHygieneMeta } from './http-hygiene.js';
+import aiCatalog, { meta as aiCatalogMeta } from './ai-catalog.js';
+import agentSkills, { meta as agentSkillsMeta } from './agent-skills.js';
+import webmcp, { meta as webmcpMeta } from './webmcp.js';
+import commerceDiscovery, { meta as commerceDiscoveryMeta } from './commerce-discovery.js';
+import authDiscovery, { meta as authDiscoveryMeta } from './auth-discovery.js';
+import agentOperability, { meta as agentOperabilityMeta } from './agent-operability.js';
 export const checks = [
     { run: llmsTxt, meta: llmsTxtMeta },
     { run: robotsTxt, meta: robotsTxtMeta },
-    { run: agentJson, meta: agentJsonMeta },
+    { run: agentCard, meta: agentCardMeta },
     { run: securityTxt, meta: securityTxtMeta },
     { run: structuredData, meta: structuredDataMeta },
     { run: metaTags, meta: metaTagsMeta },
-    { run: openapi, meta: openapiMeta },
+    { run: apiDiscovery, meta: apiDiscoveryMeta },
     { run: httpHeaders, meta: httpHeadersMeta },
-    { run: mcp, meta: mcpMeta },
+    { run: mcpDiscovery, meta: mcpDiscoveryMeta },
     { run: htmlRendering, meta: htmlRenderingMeta },
     { run: sitemap, meta: sitemapMeta },
     { run: seoBasics, meta: seoBasicsMeta },
     { run: tlsHttps, meta: tlsHttpsMeta },
-    { run: wellKnownAi, meta: wellKnownAiMeta },
     { run: contentNegotiation, meta: contentNegotiationMeta },
     { run: rsl, meta: rslMeta },
     { run: agentAccess, meta: agentAccessMeta },
     { run: crawlEfficiency, meta: crawlEfficiencyMeta },
+    { run: aiDirectives, meta: aiDirectivesMeta },
+    { run: usagePolicy, meta: usagePolicyMeta },
+    { run: httpHygiene, meta: httpHygieneMeta },
+    { run: aiCatalog, meta: aiCatalogMeta },
+    { run: agentSkills, meta: agentSkillsMeta },
+    { run: webmcp, meta: webmcpMeta },
+    { run: commerceDiscovery, meta: commerceDiscoveryMeta },
+    { run: authDiscovery, meta: authDiscoveryMeta },
+    { run: agentOperability, meta: agentOperabilityMeta },
 ];
 //# sourceMappingURL=index.js.map

package/dist/checks/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/checks/index.ts"],"names":[],"mappings":"AAEA,OAAO,OAAO,EAAE,EAAE,IAAI,IAAI,WAAW,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,SAAS,EAAE,EAAE,IAAI,IAAI,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,SAAS,EAAE,EAAE,IAAI,IAAI,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,WAAW,EAAE,EAAE,IAAI,IAAI,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,cAAc,EAAE,EAAE,IAAI,IAAI,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAClF,OAAO,QAAQ,EAAE,EAAE,IAAI,IAAI,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,OAAO,EAAE,EAAE,IAAI,IAAI,WAAW,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,WAAW,EAAE,EAAE,IAAI,IAAI,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,GAAG,EAAE,EAAE,IAAI,IAAI,OAAO,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,aAAa,EAAE,EAAE,IAAI,IAAI,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,OAAO,OAAO,EAAE,EAAE,IAAI,IAAI,WAAW,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,SAAS,EAAE,EAAE,IAAI,IAAI,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,QAAQ,EAAE,EAAE,IAAI,IAAI,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,WAAW,EAAE,EAAE,IAAI,IAAI,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,kBAAkB,EAAE,EAAE,IAAI,IAAI,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAC9F,OAAO,GAAG,EAAE,EAAE,IAAI,IAAI,OAAO,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,WAAW,EAAE,EAAE,IAAI,IAAI,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,eAAe,EAAE,EAAE,IAAI,IAAI,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAErF,MAAM,CAAC,MAAM,MAAM,GAAkB;IACnC,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE;IACnC,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE;IACvC,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE;IACvC,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,eAAe,EAAE;IAC3C,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,kBAAkB,EAAE;IACjD,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE;IACrC,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE;IACnC,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,eAAe,EAAE;IAC3C,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE;IAC3B,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,iBAAiB,EAAE;IAC/C,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE;IACnC,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE;IACvC,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE;IACrC,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,eAAe,EAAE;IAC3C,EAAE,GAAG,EAAE,kBAAkB,EAAE,IAAI,EAAE,sBAAsB,EAAE;IACzD,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE;IAC3B,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,eAAe,EAAE;IAC3C,EAAE,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,mBAAmB,EAAE;CACpD,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/checks/index.ts"],"names":[],"mappings":"AAEA,OAAO,OAAO,EAAE,EAAE,IAAI,IAAI,WAAW,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,SAAS,EAAE,EAAE,IAAI,IAAI,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,SAAS,EAAE,EAAE,IAAI,IAAI,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,WAAW,EAAE,EAAE,IAAI,IAAI,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,cAAc,EAAE,EAAE,IAAI,IAAI,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAClF,OAAO,QAAQ,EAAE,EAAE,IAAI,IAAI,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,YAAY,EAAE,EAAE,IAAI,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,WAAW,EAAE,EAAE,IAAI,IAAI,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,YAAY,EAAE,EAAE,IAAI,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,aAAa,EAAE,EAAE,IAAI,IAAI,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,OAAO,OAAO,EAAE,EAAE,IAAI,IAAI,WAAW,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,SAAS,EAAE,EAAE,IAAI,IAAI,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,QAAQ,EAAE,EAAE,IAAI,IAAI,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,kBAAkB,EAAE,EAAE,IAAI,IAAI,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAC9F,OAAO,GAAG,EAAE,EAAE,IAAI,IAAI,OAAO,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,WAAW,EAAE,EAAE,IAAI,IAAI,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,eAAe,EAAE,EAAE,IAAI,IAAI,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACrF,OAAO,YAAY,EAAE,EAAE,IAAI,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,WAAW,EAAE,EAAE,IAAI,IAAI,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,WAAW,EAAE,EAAE,IAAI,IAAI,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,SAAS,EAAE,EAAE,IAAI,IAAI,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,WAAW,EAAE,EAAE,IAAI,IAAI,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,MAAM,EAAE,EAAE,IAAI,IAAI,UAAU,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,iBAAiB,EAAE,EAAE,IAAI,IAAI,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAC3F,OAAO,aAAa,EAAE,EAAE,IAAI,IAAI,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,OAAO,gBAAgB,EAAE,EAAE,IAAI,IAAI,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAExF,MAAM,CAAC,MAAM,MAAM,GAAkB;IACnC,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE;IACnC,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE;IACvC,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE;IACvC,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,eAAe,EAAE;IAC3C,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,kBAAkB,EAAE;IACjD,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE;IACrC,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,gBAAgB,EAAE;IAC7C,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,eAAe,EAAE;IAC3C,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,gBAAgB,EAAE;IAC7C,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,iBAAiB,EAAE;IAC/C,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE;IACnC,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE;IACvC,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE;IACrC,EAAE,GAAG,EAAE,kBAAkB,EAAE,IAAI,EAAE,sBAAsB,EAAE;IACzD,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE;IAC3B,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,eAAe,EAAE;IAC3C,EAAE,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,mBAAmB,EAAE;IACnD,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,gBAAgB,EAAE;IAC7C,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,eAAe,EAAE;IAC3C,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,eAAe,EAAE;IAC3C,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE;IACvC,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,eAAe,EAAE;IAC3C,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE;IACjC,EAAE,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE,qBAAqB,EAAE;IACvD,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,iBAAiB,EAAE;IAC/C,EAAE,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,oBAAoB,EAAE;CACtD,CAAC"}

package/dist/checks/llms-txt.d.ts

@@ -1,4 +1,19 @@
 import type { CheckContext, CheckResult, CheckMeta } from '../types.js';
+/**
+ * "llms-txt" — the curated index a site publishes for language models.
+ *
+ * Two things are worth being honest about in the report. Google has stated
+ * plainly that Search ignores llms.txt, and adoption studies find the large
+ * majority of published files are never fetched by any AI search crawler. The
+ * consumers that *do* read it are coding agents — Claude Code, Cursor,
+ * OpenCode — which makes it a developer-tooling signal rather than a search
+ * visibility one. A report that implies otherwise is selling something.
+ *
+ * The specification was revised in 2026 ("v2"), adding three things this check
+ * now looks for: files scoped to a subpath, a `describedby` link relation
+ * pointing a page at the file that covers it, and per-page Markdown mirrors
+ * reached by appending `.md`.
+ */
 export declare const meta: CheckMeta;
 export default function check(ctx: CheckContext): Promise<CheckResult>;
 //# sourceMappingURL=llms-txt.d.ts.map

package/dist/checks/llms-txt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"llms-txt.d.ts","sourceRoot":"","sources":["../../src/checks/llms-txt.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,EAAW,MAAM,aAAa,CAAC;AAGjF,eAAO,MAAM,IAAI,EAAE,SAKlB,CAAC;AAEF,wBAA8B,KAAK,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAqH3E"}
+{"version":3,"file":"llms-txt.d.ts","sourceRoot":"","sources":["../../src/checks/llms-txt.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,EAAW,MAAM,aAAa,CAAC;AAKjF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,IAAI,EAAE,SAKlB,CAAC;AAOF,wBAA8B,KAAK,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CA6H3E"}