ax-audit 3.6.0 → 4.0.0

package/dist/checks/surface.js

@@ -0,0 +1,106 @@
+import { isHtmlDocument } from './utils.js';
+import { parseLinkHeader } from './http-headers.js';
+const NOT_FOUND = { found: false, reason: '' };
+/** Read the profile a run was invoked with, defaulting to automatic detection. */
+export function profileFrom(ctx) {
+    return ctx.profile ?? 'auto';
+}
+/** Whether the active profile forces this surface applicable. */
+export function forcedBy(profile, surface) {
+    return profile === 'all' || profile === surface;
+}
+async function exists(ctx, path) {
+    const res = await ctx.fetch(`${ctx.url}${path}`);
+    return res.ok && res.body.trim().length > 0 && !isHtmlDocument(res.body);
+}
+/** Links and headers pointing at a named area of the site. */
+function linksTo(ctx, pattern) {
+    if (pattern.test(ctx.html ?? ''))
+        return true;
+    return parseLinkHeader(ctx.headers?.['link'] ?? '').some((entry) => pattern.test(entry.url));
+}
+/**
+ * Does this site offer an HTTP API?
+ *
+ * Evidence: a description at a conventional location, an RFC 9727 catalog, a
+ * `service-desc` relation, or navigation into an API or developer area. The
+ * last is the loosest and the most common: a site with a "Developers" link
+ * almost certainly has an API worth describing.
+ */
+export async function hasApiSurface(ctx) {
+    if (forcedBy(profileFrom(ctx), 'api'))
+        return { found: true, reason: '--profile api' };
+    for (const path of ['/openapi.json', '/.well-known/openapi.json', '/.well-known/api-catalog', '/swagger.json']) {
+        if (await exists(ctx, path))
+            return { found: true, reason: `a document at ${path}` };
+    }
+    if (linksTo(ctx, /rel\s*=\s*["'][^"']*service-desc/i)) {
+        return { found: true, reason: 'a service-desc link relation' };
+    }
+    if (linksTo(ctx, /href\s*=\s*["'][^"']*\/(api|developers?|api-docs|reference)\b/i)) {
+        return { found: true, reason: 'navigation into an API or developer area' };
+    }
+    if (/\bapi\.[a-z0-9-]+\.[a-z]{2,}/i.test(ctx.html ?? '')) {
+        return { found: true, reason: 'references to an API subdomain' };
+    }
+    return NOT_FOUND;
+}
+/** Does this site run an MCP server? */
+export async function hasMcpSurface(ctx) {
+    if (forcedBy(profileFrom(ctx), 'mcp'))
+        return { found: true, reason: '--profile mcp' };
+    for (const path of ['/.well-known/mcp/server-card.json', '/mcp/server-card', '/.well-known/mcp.json']) {
+        if (await exists(ctx, path))
+            return { found: true, reason: `a document at ${path}` };
+    }
+    const catalog = await ctx.fetch(`${ctx.url}/.well-known/ai-catalog.json`);
+    if (catalog.ok && /application\/mcp-server-card\+json/.test(catalog.body)) {
+        return { found: true, reason: 'an MCP entry in the AI catalog' };
+    }
+    if (linksTo(ctx, /href\s*=\s*["'][^"']*\/mcp\b/i)) {
+        return { found: true, reason: 'navigation referencing an MCP endpoint' };
+    }
+    return NOT_FOUND;
+}
+/**
+ * Is this site agent-facing — something an agent would call rather than only
+ * read?
+ *
+ * An Agent Card describes capabilities another agent can invoke. Most sites do
+ * not have any, and asking a restaurant to publish one is noise. A site that
+ * runs an MCP server, offers an API, or already publishes a card is a different
+ * matter.
+ */
+export async function hasAgentSurface(ctx) {
+    if (forcedBy(profileFrom(ctx), 'agent'))
+        return { found: true, reason: '--profile agent' };
+    for (const path of ['/.well-known/agent-card.json', '/.well-known/agent.json']) {
+        if (await exists(ctx, path))
+            return { found: true, reason: `a document at ${path}` };
+    }
+    const catalog = await ctx.fetch(`${ctx.url}/.well-known/ai-catalog.json`);
+    if (catalog.ok && /application\/a2a-agent-card\+json/.test(catalog.body)) {
+        return { found: true, reason: 'an A2A entry in the AI catalog' };
+    }
+    const mcp = await hasMcpSurface(ctx);
+    if (mcp.found)
+        return { found: true, reason: `an MCP surface (${mcp.reason})` };
+    const api = await hasApiSurface(ctx);
+    if (api.found)
+        return { found: true, reason: `an API surface (${api.reason})` };
+    return NOT_FOUND;
+}
+/** Does this site have documentation an agent could be taught to follow? */
+export async function hasDocsSurface(ctx) {
+    if (forcedBy(profileFrom(ctx), 'docs'))
+        return { found: true, reason: '--profile docs' };
+    if (linksTo(ctx, /href\s*=\s*["'][^"']*\/(docs|documentation|guides?|reference|developers?)\b/i)) {
+        return { found: true, reason: 'navigation into a documentation area' };
+    }
+    for (const path of ['/llms.txt', '/openapi.json']) {
+        if (await exists(ctx, path))
+            return { found: true, reason: `a document at ${path}` };
+    }
+    return NOT_FOUND;
+}
+//# sourceMappingURL=surface.js.map

package/dist/checks/surface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"surface.js","sourceRoot":"","sources":["../../src/checks/surface.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAiBpD,MAAM,SAAS,GAAoB,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAEhE,kFAAkF;AAClF,MAAM,UAAU,WAAW,CAAC,GAAiB;IAC3C,OAAO,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC;AAC/B,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,QAAQ,CAAC,OAAgB,EAAE,OAAgB;IACzD,OAAO,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,OAAO,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,GAAiB,EAAE,IAAY;IACnD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,IAAI,EAAE,CAAC,CAAC;IACjD,OAAO,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC3E,CAAC;AAED,8DAA8D;AAC9D,SAAS,OAAO,CAAC,GAAiB,EAAE,OAAe;IACjD,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,OAAO,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAiB;IACnD,IAAI,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAEvF,KAAK,MAAM,IAAI,IAAI,CAAC,eAAe,EAAE,2BAA2B,EAAE,0BAA0B,EAAE,eAAe,CAAC,EAAE,CAAC;QAC/G,IAAI,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,IAAI,EAAE,EAAE,CAAC;IACvF,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,EAAE,mCAAmC,CAAC,EAAE,CAAC;QACtD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IACjE,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,EAAE,gEAAgE,CAAC,EAAE,CAAC;QACnF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC;IAC7E,CAAC;IACD,IAAI,+BAA+B,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;QACzD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IACnE,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,wCAAwC;AACxC,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAiB;IACnD,IAAI,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAEvF,KAAK,MAAM,IAAI,IAAI,CAAC,mCAAmC,EAAE,kBAAkB,EAAE,uBAAuB,CAAC,EAAE,CAAC;QACtG,IAAI,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,IAAI,EAAE,EAAE,CAAC;IACvF,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,GAAG,8BAA8B,CAAC,CAAC;IAC1E,IAAI,OAAO,CAAC,EAAE,IAAI,oCAAoC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1E,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IACnE,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,EAAE,+BAA+B,CAAC,EAAE,CAAC;QAClD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;IAC3E,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAiB;IACrD,IAAI,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAE3F,KAAK,MAAM,IAAI,IAAI,CAAC,8BAA8B,EAAE,yBAAyB,CAAC,EAAE,CAAC;QAC/E,IAAI,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,IAAI,EAAE,EAAE,CAAC;IACvF,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,GAAG,8BAA8B,CAAC,CAAC;IAC1E,IAAI,OAAO,CAAC,EAAE,IAAI,mCAAmC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IACnE,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,GAAG,CAAC,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,mBAAmB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;IAEhF,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,GAAG,CAAC,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,mBAAmB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;IAEhF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAiB;IACpD,IAAI,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAEzF,IAAI,OAAO,CAAC,GAAG,EAAE,8EAA8E,CAAC,EAAE,CAAC;QACjG,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC;IACzE,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,eAAe,CAAC,EAAE,CAAC;QAClD,IAAI,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,IAAI,EAAE,EAAE,CAAC;IACvF,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/checks/tls-https.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tls-https.d.ts","sourceRoot":"","sources":["../../src/checks/tls-https.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,EAAW,MAAM,aAAa,CAAC;AAGjF;;;;;;;;GAQG;AACH,eAAO,MAAM,IAAI,EAAE,SAKlB,CAAC;AAKF,wBAA8B,KAAK,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAqI3E"}
+{"version":3,"file":"tls-https.d.ts","sourceRoot":"","sources":["../../src/checks/tls-https.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,EAAW,MAAM,aAAa,CAAC;AAGjF;;;;;;;;GAQG;AACH,eAAO,MAAM,IAAI,EAAE,SAIlB,CAAC;AAKF,wBAA8B,KAAK,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAqI3E"}

package/dist/checks/tls-https.js

@@ -13,7 +13,6 @@ export const meta = {
     id: 'tls-https',
     name: 'TLS / HTTPS',
     description: 'Checks HTTPS, HTTP→HTTPS redirect, and HSTS configuration',
-    weight: 5,
 };
 const HSTS_MIN_MAX_AGE = 15_768_000;
 const HSTS_PRELOAD_MIN_MAX_AGE = 31_536_000;

package/dist/checks/tls-https.js.map

@@ -1 +1 @@
-{"version":3,"file":"tls-https.js","sourceRoot":"","sources":["../../src/checks/tls-https.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,IAAI,GAAc;IAC7B,EAAE,EAAE,WAAW;IACf,IAAI,EAAE,aAAa;IACnB,WAAW,EAAE,2DAA2D;IACxE,MAAM,EAAE,CAAC;CACV,CAAC;AAEF,MAAM,gBAAgB,GAAG,UAAU,CAAC;AACpC,MAAM,wBAAwB,GAAG,UAAU,CAAC;AAE5C,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,KAAK,CAAC,GAAiB;IACnD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,KAAK,GAAG,GAAG,CAAC;IAEhB,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,gBAAgB,GAAG,CAAC,GAAG,EAAE;YAClC,IAAI,EAAE,+DAA+D;YACrE,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,aAAa,CAAC;SAC/C,CAAC,CAAC;QACH,OAAO,WAAW,CAAC,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC,CAAC;IAC1E,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,uBAAuB,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,cAAc;YAC5F,IAAI,EAAE,4GAA4G;YAClH,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC;SAC5C,CAAC,CAAC;QACH,KAAK,IAAI,EAAE,CAAC;IACd,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,UAAU,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QAChE,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;QACnC,IAAI,OAAO,CAAC,EAAE,IAAI,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAChF,CAAC;aAAM,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/C,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,uDAAuD;aACjE,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,OAAO,CAAC,EAAE,IAAI,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtD,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,wCAAwC;gBACjD,MAAM,EAAE,cAAc,QAAQ,EAAE;gBAChC,IAAI,EAAE,2HAA2H;gBACjI,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,aAAa,CAAC;aAC/C,CAAC,CAAC;YACH,KAAK,IAAI,EAAE,CAAC;QACd,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,sCAAsC;gBAC/C,MAAM,EAAE,QAAQ,OAAO,CAAC,MAAM,OAAO,OAAO,EAAE;gBAC9C,IAAI,EAAE,mGAAmG;gBACzG,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,kBAAkB,CAAC;aACpD,CAAC,CAAC;YACH,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACtD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,qCAAqC;YAC9C,IAAI,EAAE,wIAAwI;YAC9I,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC;SAC3C,CAAC,CAAC;QACH,KAAK,IAAI,EAAE,CAAC;IACd,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEtC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,sCAAsC;gBAC/C,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,gDAAgD;gBACtD,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,gBAAgB,CAAC;aAClD,CAAC,CAAC;YACH,KAAK,IAAI,EAAE,CAAC;QACd,CAAC;aAAM,IAAI,MAAM,GAAG,gBAAgB,EAAE,CAAC;YACrC,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,0BAA0B,MAAM,QAAQ,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,QAAQ;gBACnF,IAAI,EAAE,wBAAwB,gBAAgB,0DAA0D,wBAAwB,YAAY;gBAC5I,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,CAAC;aAC9C,CAAC,CAAC;YACH,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,MAAM,EAAE,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,kBAAkB,EAAE,CAAC;YACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACzE,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,kCAAkC;gBAC3C,IAAI,EAAE,oGAAoG;gBAC1G,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,oBAAoB,CAAC;aACtD,CAAC,CAAC;YACH,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;QAED,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,IAAI,wBAAwB,IAAI,kBAAkB,EAAE,CAAC;gBAChF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;YACtE,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,CAAC;oBACZ,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,2EAA2E;oBACpF,IAAI,EAAE,+BAA+B,wBAAwB,sDAAsD;oBACnH,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,sBAAsB,CAAC;iBACxD,CAAC,CAAC;gBACH,KAAK,IAAI,CAAC,CAAC;YACb,CAAC;QACH,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,kCAAkC;gBAC3C,IAAI,EAAE,2JAA2J;gBACjK,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,iBAAiB,CAAC;aACnD,CAAC,CAAC;YACH,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;IACH,CAAC;IAED,OAAO,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAClD,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC"}
+{"version":3,"file":"tls-https.js","sourceRoot":"","sources":["../../src/checks/tls-https.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,IAAI,GAAc;IAC7B,EAAE,EAAE,WAAW;IACf,IAAI,EAAE,aAAa;IACnB,WAAW,EAAE,2DAA2D;CACzE,CAAC;AAEF,MAAM,gBAAgB,GAAG,UAAU,CAAC;AACpC,MAAM,wBAAwB,GAAG,UAAU,CAAC;AAE5C,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,KAAK,CAAC,GAAiB;IACnD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,KAAK,GAAG,GAAG,CAAC;IAEhB,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,gBAAgB,GAAG,CAAC,GAAG,EAAE;YAClC,IAAI,EAAE,+DAA+D;YACrE,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,aAAa,CAAC;SAC/C,CAAC,CAAC;QACH,OAAO,WAAW,CAAC,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC,CAAC;IAC1E,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,uBAAuB,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,cAAc;YAC5F,IAAI,EAAE,4GAA4G;YAClH,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC;SAC5C,CAAC,CAAC;QACH,KAAK,IAAI,EAAE,CAAC;IACd,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,UAAU,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QAChE,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;QACnC,IAAI,OAAO,CAAC,EAAE,IAAI,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAChF,CAAC;aAAM,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/C,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,uDAAuD;aACjE,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,OAAO,CAAC,EAAE,IAAI,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtD,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,wCAAwC;gBACjD,MAAM,EAAE,cAAc,QAAQ,EAAE;gBAChC,IAAI,EAAE,2HAA2H;gBACjI,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,aAAa,CAAC;aAC/C,CAAC,CAAC;YACH,KAAK,IAAI,EAAE,CAAC;QACd,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,sCAAsC;gBAC/C,MAAM,EAAE,QAAQ,OAAO,CAAC,MAAM,OAAO,OAAO,EAAE;gBAC9C,IAAI,EAAE,mGAAmG;gBACzG,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,kBAAkB,CAAC;aACpD,CAAC,CAAC;YACH,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACtD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,qCAAqC;YAC9C,IAAI,EAAE,wIAAwI;YAC9I,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC;SAC3C,CAAC,CAAC;QACH,KAAK,IAAI,EAAE,CAAC;IACd,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEtC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,sCAAsC;gBAC/C,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,gDAAgD;gBACtD,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,gBAAgB,CAAC;aAClD,CAAC,CAAC;YACH,KAAK,IAAI,EAAE,CAAC;QACd,CAAC;aAAM,IAAI,MAAM,GAAG,gBAAgB,EAAE,CAAC;YACrC,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,0BAA0B,MAAM,QAAQ,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,QAAQ;gBACnF,IAAI,EAAE,wBAAwB,gBAAgB,0DAA0D,wBAAwB,YAAY;gBAC5I,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,CAAC;aAC9C,CAAC,CAAC;YACH,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,MAAM,EAAE,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,kBAAkB,EAAE,CAAC;YACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACzE,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,kCAAkC;gBAC3C,IAAI,EAAE,oGAAoG;gBAC1G,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,oBAAoB,CAAC;aACtD,CAAC,CAAC;YACH,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;QAED,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,IAAI,wBAAwB,IAAI,kBAAkB,EAAE,CAAC;gBAChF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;YACtE,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,CAAC;oBACZ,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,2EAA2E;oBACpF,IAAI,EAAE,+BAA+B,wBAAwB,sDAAsD;oBACnH,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,sBAAsB,CAAC;iBACxD,CAAC,CAAC;gBACH,KAAK,IAAI,CAAC,CAAC;YACb,CAAC;QACH,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,kCAAkC;gBAC3C,IAAI,EAAE,2JAA2J;gBACjK,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,iBAAiB,CAAC;aACnD,CAAC,CAAC;YACH,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;IACH,CAAC;IAED,OAAO,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAClD,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC"}

package/dist/checks/usage-policy.d.ts

@@ -0,0 +1,53 @@
+import type { CheckContext, CheckResult, CheckMeta } from '../types.js';
+/**
+ * "usage-policy" — do your machine-readable usage signals agree with each other?
+ *
+ * A site can now state its AI usage terms in at least five places, written in
+ * vocabularies that mirror each other without matching:
+ *
+ * | Mechanism | Training | Grounding / RAG | Search |
+ * | --- | --- | --- | --- |
+ * | Content Signals (robots.txt) | `ai-train=yes\|no` | `ai-input=yes\|no` | `search=yes\|no` |
+ * | IETF AIPREF (robots.txt or header) | `train-ai=y\|n` | *(no category yet)* | `search=y\|n` |
+ * | RSL licence | `ai-train` | `ai-input` | `ai-index`, `search` |
+ * | TDMRep | `tdm-reservation: 0\|1` | — | — |
+ * | robots meta | `noai` | — | — |
+ *
+ * Nobody maintains five documents by hand without them drifting. This check
+ * normalises every signal onto three questions — may you train on it, may you
+ * ground an answer in it, may you index it — and reports where the answers
+ * disagree. A site whose robots.txt says `ai-train=no` while its RSL licence
+ * permits `ai-train` has published two contradictory legal positions, and which
+ * one a crawler honors is then a matter of which file it happened to read.
+ *
+ * On enforcement, the check is blunt: only robots.txt access rules are
+ * documented as honored by Google, OpenAI, Anthropic and Microsoft. Content
+ * Signals, AIPREF, RSL and TDMRep are declarations. Their weight is legal — the
+ * EU AI Act's opt-out provisions and the GPAI Code of Practice reference several
+ * of them — rather than technical, and reports say so rather than implying a
+ * crawler will obey.
+ */
+export declare const meta: CheckMeta;
+/** The three questions every usage vocabulary answers, or declines to answer. */
+export type Dimension = 'train' | 'ground' | 'index';
+export type Stance = 'allow' | 'deny' | 'unstated';
+export interface Declaration {
+    /** Human name of the mechanism and where it was found. */
+    source: string;
+    /** Whether the mechanism has any documented honorer among major AI operators. */
+    enforceable: boolean;
+    train: Stance;
+    ground: Stance;
+    index: Stance;
+}
+/** Read a Content-Signal value into a declaration. */
+export declare function fromContentSignal(raw: string, source: string): Declaration;
+/** Read an AIPREF Content-Usage value into a declaration. AIPREF has no grounding category yet. */
+export declare function fromContentUsage(raw: string, source: string): Declaration;
+/**
+ * Read RSL `permits` / `prohibits` usage tokens into a declaration.
+ * `all` and `ai-all` set several dimensions at once.
+ */
+export declare function fromRsl(document: string, source: string): Declaration;
+export default function check(ctx: CheckContext): Promise<CheckResult>;
+//# sourceMappingURL=usage-policy.d.ts.map

package/dist/checks/usage-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"usage-policy.d.ts","sourceRoot":"","sources":["../../src/checks/usage-policy.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,EAAW,MAAM,aAAa,CAAC;AAQjF;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,IAAI,EAAE,SAKlB,CAAC;AAEF,iFAAiF;AACjF,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC;AAErD,MAAM,MAAM,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,UAAU,CAAC;AAEnD,MAAM,WAAW,WAAW;IAC1B,0DAA0D;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,WAAW,EAAE,OAAO,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAcD,sDAAsD;AACtD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,WAAW,CAc1E;AAED,mGAAmG;AACnG,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,WAAW,CAczE;AAED;;;GAGG;AACH,wBAAgB,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,WAAW,CAqCrE;AA6ID,wBAA8B,KAAK,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CA2C3E"}

package/dist/checks/usage-policy.js

@@ -0,0 +1,339 @@
+import { RSL_MIME } from '../constants.js';
+import { guideUrl } from '../guide-urls.js';
+import { buildResult } from './utils.js';
+import { findLinkTags, getAttribute, getMetaContent } from './html-utils.js';
+import { parseLinkHeader } from './http-headers.js';
+import { parseDictionary } from './structured-fields.js';
+import { AIPREF_TOKENS, AIPREF_VALUES } from '../constants.js';
+import { collectLicenses, parseContentSignalValue, parseContentUsageValue, parseRobotsTxt } from './robots-parser.js';
+/**
+ * "usage-policy" — do your machine-readable usage signals agree with each other?
+ *
+ * A site can now state its AI usage terms in at least five places, written in
+ * vocabularies that mirror each other without matching:
+ *
+ * | Mechanism | Training | Grounding / RAG | Search |
+ * | --- | --- | --- | --- |
+ * | Content Signals (robots.txt) | `ai-train=yes\|no` | `ai-input=yes\|no` | `search=yes\|no` |
+ * | IETF AIPREF (robots.txt or header) | `train-ai=y\|n` | *(no category yet)* | `search=y\|n` |
+ * | RSL licence | `ai-train` | `ai-input` | `ai-index`, `search` |
+ * | TDMRep | `tdm-reservation: 0\|1` | — | — |
+ * | robots meta | `noai` | — | — |
+ *
+ * Nobody maintains five documents by hand without them drifting. This check
+ * normalises every signal onto three questions — may you train on it, may you
+ * ground an answer in it, may you index it — and reports where the answers
+ * disagree. A site whose robots.txt says `ai-train=no` while its RSL licence
+ * permits `ai-train` has published two contradictory legal positions, and which
+ * one a crawler honors is then a matter of which file it happened to read.
+ *
+ * On enforcement, the check is blunt: only robots.txt access rules are
+ * documented as honored by Google, OpenAI, Anthropic and Microsoft. Content
+ * Signals, AIPREF, RSL and TDMRep are declarations. Their weight is legal — the
+ * EU AI Act's opt-out provisions and the GPAI Code of Practice reference several
+ * of them — rather than technical, and reports say so rather than implying a
+ * crawler will obey.
+ */
+export const meta = {
+    id: 'usage-policy',
+    name: 'Usage Policy',
+    description: 'Checks machine-readable AI usage signals for coverage and internal consistency',
+    category: 'policy',
+};
+const DIMENSION_LABEL = {
+    train: 'training on your content',
+    ground: 'grounding an answer in your content',
+    index: 'indexing your content for search',
+};
+function yesNo(value) {
+    if (value === 'yes' || value === 'y')
+        return 'allow';
+    if (value === 'no' || value === 'n')
+        return 'deny';
+    return 'unstated';
+}
+/** Read a Content-Signal value into a declaration. */
+export function fromContentSignal(raw, source) {
+    const pairs = new Map(parseContentSignalValue(raw).valid.map((p) => {
+        const [k, v] = p.split('=');
+        return [k, v];
+    }));
+    return {
+        source,
+        enforceable: false,
+        train: yesNo(pairs.get('ai-train')),
+        ground: yesNo(pairs.get('ai-input')),
+        index: yesNo(pairs.get('search')),
+    };
+}
+/** Read an AIPREF Content-Usage value into a declaration. AIPREF has no grounding category yet. */
+export function fromContentUsage(raw, source) {
+    const pairs = new Map(parseContentUsageValue(raw).valid.map((p) => {
+        const [k, v] = p.split('=');
+        return [k, v];
+    }));
+    return {
+        source,
+        enforceable: false,
+        train: yesNo(pairs.get('train-ai')),
+        ground: 'unstated',
+        index: yesNo(pairs.get('search')),
+    };
+}
+/**
+ * Read RSL `permits` / `prohibits` usage tokens into a declaration.
+ * `all` and `ai-all` set several dimensions at once.
+ */
+export function fromRsl(document, source) {
+    const decl = { source, enforceable: false, train: 'unstated', ground: 'unstated', index: 'unstated' };
+    const body = document.replace(/<!--[\s\S]*?-->/g, '');
+    for (const m of body.matchAll(/<(permits|prohibits)\b([^>]*)>([^<]*)</gi)) {
+        const stance = m[1].toLowerCase() === 'permits' ? 'allow' : 'deny';
+        const type = (getAttribute(m[2], 'type') ?? '').toLowerCase();
+        if (type !== 'usage')
+            continue;
+        for (const token of m[3].trim().toLowerCase().split(/\s+/).filter(Boolean)) {
+            switch (token) {
+                case 'ai-train':
+                    decl.train = stance;
+                    break;
+                case 'ai-input':
+                    decl.ground = stance;
+                    break;
+                case 'ai-index':
+                case 'search':
+                    decl.index = stance;
+                    break;
+                case 'ai-all':
+                    decl.train = stance;
+                    decl.ground = stance;
+                    break;
+                case 'all':
+                    decl.train = stance;
+                    decl.ground = stance;
+                    decl.index = stance;
+                    break;
+                default:
+                    break;
+            }
+        }
+    }
+    return decl;
+}
+/** Collect every usage declaration a site publishes. */
+async function collect(ctx) {
+    const declarations = [];
+    const notes = [];
+    /* robots.txt: Content-Signal and Content-Usage, per group. */
+    const robotsRes = await ctx.fetch(`${ctx.url}/robots.txt`);
+    const robots = robotsRes.ok ? parseRobotsTxt(robotsRes.body) : null;
+    if (robots !== null) {
+        for (const group of robots.groups) {
+            const scope = group.userAgents.join(', ');
+            for (const raw of group.contentSignals) {
+                declarations.push(fromContentSignal(raw, `robots.txt Content-Signal (User-agent: ${scope})`));
+            }
+            for (const raw of group.contentUsage) {
+                declarations.push(fromContentUsage(raw, `robots.txt Content-Usage (User-agent: ${scope})`));
+            }
+        }
+    }
+    /* HTTP headers: the Content-Usage response header, and Cloudflare's content-signal. */
+    const headers = ctx.headers ?? {};
+    if (headers['content-usage'] !== undefined) {
+        declarations.push(fromContentUsage(headers['content-usage'], 'Content-Usage response header'));
+        const dict = parseDictionary(headers['content-usage']);
+        const bad = dict.members.filter((m) => !AIPREF_TOKENS.includes(m.key) || !AIPREF_VALUES.includes(m.value.toLowerCase()));
+        if (bad.length > 0) {
+            notes.push({
+                status: 'warn',
+                message: 'Content-Usage response header uses tokens outside the AIPREF vocabulary',
+                detail: bad.map((m) => m.raw).join(', '),
+                hint: 'The header takes a Structured Fields dictionary over train-ai and search with y/n values.',
+                learnMoreUrl: guideUrl(meta.id, 'header-vocabulary'),
+            });
+        }
+    }
+    if (headers['content-signal'] !== undefined) {
+        declarations.push(fromContentSignal(headers['content-signal'], 'content-signal response header'));
+    }
+    /* RSL licence, discovered the same three ways the rsl check uses. */
+    const licenceUrl = findLicenceUrl(ctx, robots === null ? [] : collectLicenses(robots));
+    if (licenceUrl !== null) {
+        const doc = await ctx.fetch(licenceUrl);
+        if (doc.ok && /<rsl[\s>]/i.test(doc.body)) {
+            declarations.push(fromRsl(doc.body, `RSL licence (${licenceUrl})`));
+        }
+    }
+    /* TDMRep: reservation is specifically about text-and-data-mining, i.e. training. */
+    const tdm = await readTdmRep(ctx);
+    if (tdm !== null)
+        declarations.push(tdm);
+    /* robots meta noai: a declared preference with no committed honorer. */
+    const robotsMeta = (getMetaContent(ctx.html ?? '', 'robots') ?? '').toLowerCase();
+    if (/\bnoai\b/.test(robotsMeta)) {
+        declarations.push({
+            source: '<meta name="robots" content="noai">',
+            enforceable: false,
+            train: 'deny',
+            ground: 'unstated',
+            index: 'unstated',
+        });
+    }
+    return { declarations, notes };
+}
+/** Resolve the first RSL licence URL from robots.txt, the Link header, or an HTML link. */
+function findLicenceUrl(ctx, robotsLicences) {
+    const candidates = [...robotsLicences];
+    for (const entry of parseLinkHeader(ctx.headers?.['link'] ?? '')) {
+        if (entry.params['rel'] === 'license' && (entry.params['type'] ?? '').includes(RSL_MIME)) {
+            candidates.push(entry.url);
+        }
+    }
+    for (const tag of findLinkTags(ctx.html ?? '', 'license')) {
+        const type = (getAttribute(tag, 'type') ?? '').toLowerCase();
+        const href = getAttribute(tag, 'href');
+        if (type.includes(RSL_MIME) && href !== null)
+            candidates.push(href);
+    }
+    if (candidates.length === 0)
+        return null;
+    try {
+        return new URL(candidates[0], `${ctx.url}/`).toString();
+    }
+    catch {
+        return null;
+    }
+}
+/** Read a TDM reservation from headers, meta tags, or the well-known file (precedence: meta > header > file). */
+async function readTdmRep(ctx) {
+    const metaValue = getMetaContent(ctx.html ?? '', 'tdm-reservation');
+    if (metaValue !== null) {
+        return {
+            source: '<meta name="tdm-reservation">',
+            enforceable: false,
+            train: metaValue.trim() === '1' ? 'deny' : 'allow',
+            ground: 'unstated',
+            index: 'unstated',
+        };
+    }
+    const header = ctx.headers?.['tdm-reservation'];
+    if (header !== undefined) {
+        return {
+            source: 'tdm-reservation response header',
+            enforceable: false,
+            train: header.trim() === '1' ? 'deny' : 'allow',
+            ground: 'unstated',
+            index: 'unstated',
+        };
+    }
+    const res = await ctx.fetch(`${ctx.url}/.well-known/tdmrep.json`);
+    if (!res.ok)
+        return null;
+    try {
+        const data = JSON.parse(res.body);
+        if (!Array.isArray(data) || data.length === 0)
+            return null;
+        // The entry covering the site root governs the audited page.
+        const root = data.find((e) => e?.location === '/' || e?.location === '') ?? data[0];
+        const reserved = Number(root?.['tdm-reservation']);
+        if (reserved !== 0 && reserved !== 1)
+            return null;
+        return {
+            source: '/.well-known/tdmrep.json',
+            enforceable: false,
+            train: reserved === 1 ? 'deny' : 'allow',
+            ground: 'unstated',
+            index: 'unstated',
+        };
+    }
+    catch {
+        return null;
+    }
+}
+export default async function check(ctx) {
+    const start = performance.now();
+    const findings = [];
+    let score = 100;
+    const { declarations, notes } = await collect(ctx);
+    findings.push(...notes);
+    if (declarations.length === 0) {
+        findings.push({
+            status: 'warn',
+            message: 'No machine-readable usage policy declared',
+            detail: 'Checked robots.txt Content-Signal and Content-Usage, the Content-Usage and content-signal response headers, ' +
+                'an RSL licence, TDMRep, and the noai meta directive.',
+            hint: 'State your terms where they can be read without a lawyer. The lowest-effort option is a Content-Signal line ' +
+                'in robots.txt: Content-Signal: search=yes, ai-input=yes, ai-train=no. Absence is neutral, not permission — ' +
+                'but it also gives you nothing to point at.',
+            learnMoreUrl: guideUrl(meta.id, 'no-policy'),
+        });
+        return buildResult(meta, 40, findings, start);
+    }
+    findings.push({
+        status: 'pass',
+        message: `${declarations.length} usage declaration(s) found`,
+        detail: declarations.map((d) => d.source).join('\n'),
+    });
+    score = reportConsistency(declarations, findings, score);
+    reportCoverage(declarations, findings);
+    findings.push({
+        status: 'pass',
+        message: 'Enforcement note: only robots.txt access rules are documented as honored by major AI operators',
+        detail: 'Content Signals, AIPREF, RSL and TDMRep are declarations. Their weight is legal — the EU AI Act opt-out ' +
+            'provisions and the GPAI Code of Practice reference several of them — rather than technical. Pair any of them ' +
+            'with robots.txt rules if the intent is to be enforced.',
+    });
+    return buildResult(meta, score, findings, start);
+}
+/**
+ * Report where two declarations answer the same question differently. This is
+ * the finding this check exists for: contradictory published positions mean the
+ * terms a crawler honors depend on which file it happened to read.
+ */
+function reportConsistency(declarations, findings, score) {
+    let conflicts = 0;
+    for (const dimension of ['train', 'ground', 'index']) {
+        const allow = declarations.filter((d) => d[dimension] === 'allow');
+        const deny = declarations.filter((d) => d[dimension] === 'deny');
+        if (allow.length > 0 && deny.length > 0) {
+            conflicts++;
+            findings.push({
+                status: 'fail',
+                message: `Your signals disagree about ${DIMENSION_LABEL[dimension]}`,
+                detail: [
+                    `Permitted by: ${allow.map((d) => d.source).join('; ')}`,
+                    `Denied by: ${deny.map((d) => d.source).join('; ')}`,
+                ].join('\n'),
+                hint: 'Two of your published documents state opposite terms, so which one applies depends on which file a crawler ' +
+                    'reads. Pick the position you mean and make every mechanism say it.',
+                learnMoreUrl: guideUrl(meta.id, 'contradiction'),
+            });
+            continue;
+        }
+        if (allow.length + deny.length > 0) {
+            const stance = allow.length > 0 ? 'permitted' : 'denied';
+            findings.push({
+                status: 'pass',
+                message: `Consistent across ${allow.length + deny.length} declaration(s): ${DIMENSION_LABEL[dimension]} is ${stance}`,
+            });
+        }
+    }
+    return score - conflicts * 25;
+}
+/** Note the dimensions no declaration answers, and the vocabularies that cannot answer them. */
+function reportCoverage(declarations, findings) {
+    const unstated = ['train', 'ground', 'index'].filter((d) => declarations.every((decl) => decl[d] === 'unstated'));
+    if (unstated.length === 0)
+        return;
+    findings.push({
+        status: 'warn',
+        message: `No declaration covers ${unstated.map((d) => DIMENSION_LABEL[d]).join(' or ')}`,
+        detail: unstated.includes('ground') && declarations.every((d) => !d.source.includes('Content-Signal'))
+            ? 'Grounding is the dimension that decides whether an assistant may quote you in an answer. AIPREF has no category for it yet; Content Signals ai-input and RSL ai-input do.'
+            : undefined,
+        hint: 'An unstated dimension is "unknown", never "allowed". State it explicitly if you have a position on it.',
+        learnMoreUrl: guideUrl(meta.id, 'coverage'),
+    });
+}
+//# sourceMappingURL=usage-policy.js.map

package/dist/checks/usage-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"usage-policy.js","sourceRoot":"","sources":["../../src/checks/usage-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEtH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,MAAM,IAAI,GAAc;IAC7B,EAAE,EAAE,cAAc;IAClB,IAAI,EAAE,cAAc;IACpB,WAAW,EAAE,gFAAgF;IAC7F,QAAQ,EAAE,QAAQ;CACnB,CAAC;AAiBF,MAAM,eAAe,GAA8B;IACjD,KAAK,EAAE,0BAA0B;IACjC,MAAM,EAAE,qCAAqC;IAC7C,KAAK,EAAE,kCAAkC;CAC1C,CAAC;AAEF,SAAS,KAAK,CAAC,KAAyB;IACtC,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,OAAO,CAAC;IACrD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,MAAM,CAAC;IACnD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,iBAAiB,CAAC,GAAW,EAAE,MAAc;IAC3D,MAAM,KAAK,GAAG,IAAI,GAAG,CACnB,uBAAuB,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3C,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,CAAC,CAAC,EAAE,CAAC,CAAU,CAAC;IACzB,CAAC,CAAC,CACH,CAAC;IACF,OAAO;QACL,MAAM;QACN,WAAW,EAAE,KAAK;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACnC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACpC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,MAAc;IAC1D,MAAM,KAAK,GAAG,IAAI,GAAG,CACnB,sBAAsB,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC1C,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,CAAC,CAAC,EAAE,CAAC,CAAU,CAAC;IACzB,CAAC,CAAC,CACH,CAAC;IACF,OAAO;QACL,MAAM;QACN,WAAW,EAAE,KAAK;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACnC,MAAM,EAAE,UAAU;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;KAClC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,QAAgB,EAAE,MAAc;IACtD,MAAM,IAAI,GAAgB,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACnH,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAEtD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,0CAA0C,CAAC,EAAE,CAAC;QAC1E,MAAM,MAAM,GAAW,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;QAC3E,MAAM,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9D,IAAI,IAAI,KAAK,OAAO;YAAE,SAAS;QAE/B,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3E,QAAQ,KAAK,EAAE,CAAC;gBACd,KAAK,UAAU;oBACb,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC;oBACpB,MAAM;gBACR,KAAK,UAAU;oBACb,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;oBACrB,MAAM;gBACR,KAAK,UAAU,CAAC;gBAChB,KAAK,QAAQ;oBACX,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC;oBACpB,MAAM;gBACR,KAAK,QAAQ;oBACX,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC;oBACpB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;oBACrB,MAAM;gBACR,KAAK,KAAK;oBACR,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC;oBACpB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;oBACrB,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC;oBACpB,MAAM;gBACR;oBACE,MAAM;YACV,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wDAAwD;AACxD,KAAK,UAAU,OAAO,CAAC,GAAiB;IACtC,MAAM,YAAY,GAAkB,EAAE,CAAC;IACvC,MAAM,KAAK,GAAc,EAAE,CAAC;IAE5B,8DAA8D;IAC9D,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,GAAG,aAAa,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEpE,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1C,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;gBACvC,YAAY,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,0CAA0C,KAAK,GAAG,CAAC,CAAC,CAAC;YAChG,CAAC;YACD,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;gBACrC,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,yCAAyC,KAAK,GAAG,CAAC,CAAC,CAAC;YAC9F,CAAC;QACH,CAAC;IACH,CAAC;IAED,uFAAuF;IACvF,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;IAClC,IAAI,OAAO,CAAC,eAAe,CAAC,KAAK,SAAS,EAAE,CAAC;QAC3C,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,+BAA+B,CAAC,CAAC,CAAC;QAC/F,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CACxF,CAAC;QACF,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnB,KAAK,CAAC,IAAI,CAAC;gBACT,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,yEAAyE;gBAClF,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;gBACxC,IAAI,EAAE,2FAA2F;gBACjG,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,mBAAmB,CAAC;aACrD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,gBAAgB,CAAC,KAAK,SAAS,EAAE,CAAC;QAC5C,YAAY,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,gCAAgC,CAAC,CAAC,CAAC;IACpG,CAAC;IAED,qEAAqE;IACrE,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IACvF,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,GAAG,CAAC,EAAE,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,gBAAgB,UAAU,GAAG,CAAC,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED,oFAAoF;IACpF,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,GAAG,KAAK,IAAI;QAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEzC,wEAAwE;IACxE,MAAM,UAAU,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAClF,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAChC,YAAY,CAAC,IAAI,CAAC;YAChB,MAAM,EAAE,qCAAqC;YAC7C,WAAW,EAAE,KAAK;YAClB,KAAK,EAAE,MAAM;YACb,MAAM,EAAE,UAAU;YAClB,KAAK,EAAE,UAAU;SAClB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;AACjC,CAAC;AAED,2FAA2F;AAC3F,SAAS,cAAc,CAAC,GAAiB,EAAE,cAAwB;IACjE,MAAM,UAAU,GAAa,CAAC,GAAG,cAAc,CAAC,CAAC;IAEjD,KAAK,MAAM,KAAK,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QACjE,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzF,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAC7D,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACvC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,KAAK,IAAI;YAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,iHAAiH;AACjH,KAAK,UAAU,UAAU,CAAC,GAAiB;IACzC,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,iBAAiB,CAAC,CAAC;IACpE,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO;YACL,MAAM,EAAE,+BAA+B;YACvC,WAAW,EAAE,KAAK;YAClB,KAAK,EAAE,SAAS,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;YAClD,MAAM,EAAE,UAAU;YAClB,KAAK,EAAE,UAAU;SAClB,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,iBAAiB,CAAC,CAAC;IAChD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO;YACL,MAAM,EAAE,iCAAiC;YACzC,WAAW,EAAE,KAAK;YAClB,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;YAC/C,MAAM,EAAE,UAAU;YAClB,KAAK,EAAE,UAAU;SAClB,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,GAAG,0BAA0B,CAAC,CAAC;IAClE,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3D,6DAA6D;QAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,KAAK,GAAG,IAAI,CAAC,EAAE,QAAQ,KAAK,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;QACpF,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACnD,IAAI,QAAQ,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAClD,OAAO;YACL,MAAM,EAAE,0BAA0B;YAClC,WAAW,EAAE,KAAK;YAClB,KAAK,EAAE,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;YACxC,MAAM,EAAE,UAAU;YAClB,KAAK,EAAE,UAAU;SAClB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,KAAK,CAAC,GAAiB;IACnD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,KAAK,GAAG,GAAG,CAAC;IAEhB,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;IACnD,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;IAExB,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,2CAA2C;YACpD,MAAM,EACJ,8GAA8G;gBAC9G,sDAAsD;YACxD,IAAI,EACF,8GAA8G;gBAC9G,6GAA6G;gBAC7G,4CAA4C;YAC9C,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC;SAC7C,CAAC,CAAC;QACH,OAAO,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAChD,CAAC;IAED,QAAQ,CAAC,IAAI,CAAC;QACZ,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,GAAG,YAAY,CAAC,MAAM,6BAA6B;QAC5D,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;KACrD,CAAC,CAAC;IAEH,KAAK,GAAG,iBAAiB,CAAC,YAAY,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACzD,cAAc,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IAEvC,QAAQ,CAAC,IAAI,CAAC;QACZ,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,gGAAgG;QACzG,MAAM,EACJ,0GAA0G;YAC1G,+GAA+G;YAC/G,wDAAwD;KAC3D,CAAC,CAAC;IAEH,OAAO,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,YAA2B,EAAE,QAAmB,EAAE,KAAa;IACxF,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,KAAK,MAAM,SAAS,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAgB,EAAE,CAAC;QACpE,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC,CAAC;QAEjE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxC,SAAS,EAAE,CAAC;YACZ,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,+BAA+B,eAAe,CAAC,SAAS,CAAC,EAAE;gBACpE,MAAM,EAAE;oBACN,iBAAiB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;oBACxD,cAAc,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iBACrD,CAAC,IAAI,CAAC,IAAI,CAAC;gBACZ,IAAI,EACF,6GAA6G;oBAC7G,oEAAoE;gBACtE,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,eAAe,CAAC;aACjD,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;YACzD,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,qBAAqB,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,oBAAoB,eAAe,CAAC,SAAS,CAAC,OAAO,MAAM,EAAE;aACtH,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,KAAK,GAAG,SAAS,GAAG,EAAE,CAAC;AAChC,CAAC;AAED,gGAAgG;AAChG,SAAS,cAAc,CAAC,YAA2B,EAAE,QAAmB;IACtE,MAAM,QAAQ,GAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAC1E,YAAY,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,CACrD,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAElC,QAAQ,CAAC,IAAI,CAAC;QACZ,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,yBAAyB,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;QACxF,MAAM,EACJ,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;YAC5F,CAAC,CAAC,2KAA2K;YAC7K,CAAC,CAAC,SAAS;QACf,IAAI,EAAE,wGAAwG;QAC9G,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC;KAC5C,CAAC,CAAC;AACL,CAAC"}

package/dist/checks/utils.d.ts

@@ -1,6 +1,30 @@
 import type { CheckMeta, CheckResult, FetchResponse, Finding } from '../types.js';
 export declare function clampScore(score: number): number;
-export declare function buildResult(meta: CheckMeta, score: number, findings: Finding[], start: number): CheckResult;
+export declare function buildResult(meta: CheckMeta, score: number, findings: Finding[], start: number, options?: {
+    applicable?: boolean;
+}): CheckResult;
+/**
+ * Result for a check whose subject the site does not have: no API to describe,
+ * no commerce surface, no MCP server. Reported as N/A and excluded from the
+ * score rather than counted as a failure.
+ */
+export declare function notApplicable(meta: CheckMeta, findings: Finding[], start: number): CheckResult;
+/**
+ * Whether a response body is a web page rather than the machine-readable
+ * document that was asked for.
+ *
+ * Single-page applications answer every unmatched path with their index shell,
+ * status 200. Probing `/.well-known/agent-card.json` or `/mcp/server-card` on
+ * such a site returns HTML, and a check that trusts the status code reports a
+ * *malformed* document where the honest answer is that the document is absent.
+ * That mistake is worse than a miss: it sends an operator hunting for a bug in
+ * a file they never wrote.
+ *
+ * Detection is deliberately narrow — a doctype or an `<html>` tag near the top
+ * of the body. Anything else is handed to the real parser, which reports its own
+ * problems precisely.
+ */
+export declare function isHtmlDocument(body: string): boolean;
 /**
  * Validate the `Content-Type` of a fetched resource against a list of acceptable MIME types.
  *

package/dist/checks/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/checks/utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAElF,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,WAAW,CAS3G;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,aAAa,EAClB,QAAQ,EAAE,MAAM,EAAE,EAClB,OAAO,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAClE,OAAO,GAAG,IAAI,CAkBhB"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/checks/utils.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAElF,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,wBAAgB,WAAW,CACzB,IAAI,EAAE,SAAS,EACf,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,OAAO,EAAE,EACnB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;IAAE,UAAU,CAAC,EAAE,OAAO,CAAA;CAAO,GACrC,WAAW,CAab;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,WAAW,CAE9F;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGpD;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,aAAa,EAClB,QAAQ,EAAE,MAAM,EAAE,EAClB,OAAO,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAClE,OAAO,GAAG,IAAI,CAkBhB"}