ax-audit 3.6.0 → 4.0.0

package/dist/checks/agent-access.js

@@ -1,18 +1,50 @@
-import { CORE_AI_CRAWLERS } from '../constants.js';
+import { PROBEABLE_CORE_CRAWLERS, crawlerInfo } from '../constants.js';
 import { guideUrl } from '../guide-urls.js';
 import { buildResult } from './utils.js';
-import { extractVisibleText } from './html-utils.js';
-import { parseUserAgents } from './robots-txt.js';
+import { extractVisibleText, findJsonLdBlocks } from './html-utils.js';
+import { parseUserAgents, intentBlocked } from './robots-parser.js';
+import { classifyResponse, INCONCLUSIVE_CAVEAT } from './waf.js';
+/**
+ * "agent-access" — the gap between what robots.txt permits and what the server
+ * actually does.
+ *
+ * The failure this catches is invisible from the inside: robots.txt says
+ * `Allow: /` for GPTBot, and the WAF returns 403 to anything whose user agent
+ * says GPTBot. The operator sees a permissive robots.txt and assumes the site
+ * is reachable. Cloudflare's "Block AI Crawlers" toggle produces exactly this,
+ * and so does a hand-written rule that outlived its reason.
+ *
+ * The check probes the homepage once per core crawler and compares the result
+ * against the default-user-agent baseline. Since 3.7 it classifies *how* a
+ * request was turned away, because the remedies are completely different: a
+ * JavaScript challenge needs a bot-management exception, a hard 403 needs a
+ * firewall rule change, a 402 is a deliberate price, and a signature demand is
+ * the site working as designed.
+ *
+ * Honesty constraint: this probe is unsigned and comes from the auditor's own
+ * network. An edge that verifies crawlers by IP range or Web Bot Auth signature
+ * will reject it while admitting the genuine crawler. Those outcomes are scored
+ * as inconclusive and labelled as such, never as "blocks AI crawlers".
+ */
 export const meta = {
     id: 'agent-access',
     name: 'Agent Access',
     description: 'Checks that AI crawler user-agents are not blocked or served reduced content (cloaking)',
-    weight: 0, // Informational in 3.x — will gain weight in v4.0 (score-affecting changes are treated as breaking).
+    category: 'access',
 };
 /** Content below this fraction of the baseline visible text counts as "reduced". */
 const REDUCED_CONTENT_RATIO = 0.5;
 /** Baselines with less visible text than this are too small for meaningful content comparison. */
 const MIN_BASELINE_TEXT = 200;
+/** Credit each outcome contributes to the access score. */
+const OUTCOME_CREDIT = {
+    ok: 1,
+    'blocked-consistent': 1,
+    conditional: 1,
+    inconclusive: 0.75,
+    reduced: 0.5,
+    blocked: 0,
+};
 /**
  * Build a realistic crawler User-Agent for a given bot token. WAF and
  * bot-management rules match on the token substring, which is what we need
@@ -21,16 +53,31 @@ const MIN_BASELINE_TEXT = 200;
 export function crawlerUserAgent(token) {
     return `Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ${token}/1.0)`;
 }
-/**
- * Whether robots.txt expresses the intent to block this crawler: an explicit
- * full Disallow for it, or a full wildcard Disallow with no explicit entry.
- */
-export function intentBlocked(entries, crawler) {
-    const explicit = entries.find((e) => e.name.toLowerCase() === crawler.toLowerCase());
-    if (explicit)
-        return explicit.disallowed;
-    const wildcard = entries.find((e) => e.name === '*');
-    return wildcard?.disallowed ?? false;
+// `intentBlocked` moved to robots-parser.ts in 3.7; re-exported for compatibility.
+export { intentBlocked } from './robots-parser.js';
+function shapeOf(html) {
+    const title = html.match(/<title\b[^>]*>([\s\S]*?)<\/title>/i);
+    const h1 = html.match(/<h1\b[^>]*>([\s\S]*?)<\/h1>/i);
+    return {
+        textLength: extractVisibleText(html).length,
+        title: title ? extractVisibleText(title[1]) : null,
+        h1: h1 ? extractVisibleText(h1[1]) : null,
+        jsonLdBlocks: findJsonLdBlocks(html).length,
+    };
+}
+/** Differences between a crawler's page and the baseline, in reader-facing terms. */
+function shapeDiff(baseline, actual) {
+    const diffs = [];
+    if (baseline.title !== null && actual.title !== baseline.title) {
+        diffs.push(`title differs ("${actual.title ?? 'none'}" vs "${baseline.title}")`);
+    }
+    if (baseline.h1 !== null && actual.h1 !== baseline.h1) {
+        diffs.push(`h1 differs ("${actual.h1 ?? 'none'}" vs "${baseline.h1}")`);
+    }
+    if (baseline.jsonLdBlocks > 0 && actual.jsonLdBlocks < baseline.jsonLdBlocks) {
+        diffs.push(`${baseline.jsonLdBlocks - actual.jsonLdBlocks} JSON-LD block(s) missing`);
+    }
+    return diffs;
 }
 export default async function check(ctx) {
     const start = performance.now();
@@ -45,66 +92,165 @@ export default async function check(ctx) {
         });
         return buildResult(meta, 0, findings, start);
     }
-    const baselineText = extractVisibleText(baseline.body).length;
+    const baselineShape = shapeOf(baseline.body);
+    const baselineText = baselineShape.textLength;
     const robotsRes = await ctx.fetch(`${ctx.url}/robots.txt`);
     const robotsEntries = robotsRes.ok ? parseUserAgents(robotsRes.body) : [];
     const outcomes = new Map();
-    for (const crawler of CORE_AI_CRAWLERS) {
+    for (const crawler of PROBEABLE_CORE_CRAWLERS) {
         const res = await ctx.fetch(ctx.url, { headers: { 'User-Agent': crawlerUserAgent(crawler) } });
+        const cls = classifyResponse(res);
         const blockedByRobots = intentBlocked(robotsEntries, crawler);
-        if (!res.ok) {
-            outcomes.set(crawler, blockedByRobots ? 'blocked-consistent' : 'blocked');
-            const detail = `HTTP ${res.status || 'network error'} for User-Agent containing "${crawler}"`;
+        if (cls.kind === 'ok') {
+            const shape = shapeOf(res.body);
+            const diffs = shapeDiff(baselineShape, shape);
+            const textDropped = baselineText >= MIN_BASELINE_TEXT && shape.textLength < baselineText * REDUCED_CONTENT_RATIO;
+            if (textDropped || diffs.length > 0) {
+                outcomes.set(crawler, 'reduced');
+                findings.push({
+                    status: 'warn',
+                    message: `${crawler} receives a different page than a regular client`,
+                    detail: [textDropped ? `${shape.textLength} vs ${baselineText} chars of visible text` : null, ...diffs]
+                        .filter(Boolean)
+                        .join('; '),
+                    hint: 'The server returns 200 but serves this crawler different content — often an interstitial, a consent ' +
+                        'wall, or conditional rendering. Agents index exactly what they receive, so the version they see is the ' +
+                        'version that gets cited.',
+                    learnMoreUrl: guideUrl(meta.id, 'reduced-content'),
+                });
+            }
+            else {
+                outcomes.set(crawler, 'ok');
+            }
+            continue;
+        }
+        outcomes.set(crawler, recordTurnedAway(crawler, cls, blockedByRobots, robotsRes.ok, findings));
+    }
+    const okCount = [...outcomes.values()].filter((o) => o === 'ok').length;
+    if (okCount === PROBEABLE_CORE_CRAWLERS.length) {
+        findings.unshift({
+            status: 'pass',
+            message: `All ${PROBEABLE_CORE_CRAWLERS.length} core AI crawler user-agents receive the same page as a regular client`,
+        });
+    }
+    const inconclusive = [...outcomes.entries()].filter(([, o]) => o === 'inconclusive');
+    if (inconclusive.length > 0) {
+        findings.push({
+            status: 'warn',
+            message: `${inconclusive.length} crawler probe(s) could not be settled from outside`,
+            detail: inconclusive.map(([name]) => name).join(', '),
+            hint: INCONCLUSIVE_CAVEAT,
+            learnMoreUrl: guideUrl(meta.id, 'inconclusive-probe'),
+        });
+    }
+    const credit = [...outcomes.values()].reduce((acc, o) => acc + OUTCOME_CREDIT[o], 0);
+    const score = Math.round((credit / PROBEABLE_CORE_CRAWLERS.length) * 100);
+    return buildResult(meta, score, findings, start);
+}
+/**
+ * Turn a non-200 crawler response into a finding and an outcome. The
+ * classification decides both the wording and the credit: a challenge is not a
+ * block, a price is not a refusal, and a signature demand is a site working as
+ * designed.
+ */
+function recordTurnedAway(crawler, cls, blockedByRobots, robotsAvailable, findings) {
+    const info = crawlerInfo(crawler);
+    const evidence = cls.evidence.length > 0 ? cls.evidence.join('; ') : cls.label;
+    switch (cls.kind) {
+        case 'challenge':
+            findings.push({
+                status: 'warn',
+                message: `${crawler} receives a ${cls.vendor ?? 'JavaScript'} challenge instead of the page`,
+                detail: evidence,
+                hint: 'Challenge pages require running JavaScript. Crawlers that only fetch HTML — which is most of them — never ' +
+                    'get past one, so the page is effectively unavailable to them even though nothing is "blocked". ' +
+                    'Add a bot-management exception for verified AI crawlers. ' +
+                    INCONCLUSIVE_CAVEAT,
+                learnMoreUrl: guideUrl(meta.id, 'challenge-page'),
+            });
+            return 'inconclusive';
+        case 'needs-signature':
+            findings.push({
+                status: 'pass',
+                message: `${crawler} must present a Web Bot Auth signature`,
+                detail: evidence,
+                hint: 'The origin asks unverified clients to re-request with an HTTP Message Signature. Vendors that sign their ' +
+                    'requests will pass; this probe does not sign, so it cannot confirm the outcome for the real crawler.',
+                learnMoreUrl: guideUrl(meta.id, 'needs-signature'),
+            });
+            return 'inconclusive';
+        case 'paywall':
+            findings.push({
+                status: 'pass',
+                message: `${crawler} is offered priced access${cls.price ? ` at ${cls.price}` : ''}`,
+                detail: evidence,
+                hint: 'Content is monetised for crawlers rather than blocked. Crawlers that support the payment flow can still reach it.',
+                learnMoreUrl: guideUrl(meta.id, 'pay-per-crawl'),
+            });
+            return 'conditional';
+        case 'license-required':
+            findings.push({
+                status: 'pass',
+                message: `${crawler} is asked to obtain a licence before use`,
+                detail: evidence,
+                hint: 'The origin implements the RSL Open Licensing Protocol. Clients that negotiate a licence can reach the content.',
+                learnMoreUrl: guideUrl(meta.id, 'license-required'),
+            });
+            return 'conditional';
+        case 'rate-limited':
+            findings.push({
+                status: 'warn',
+                message: `${crawler} is rate limited on a single request`,
+                detail: evidence,
+                hint: 'One probe should not hit a rate limit. A limit this tight will stall any crawl. Always answer 429 with a ' +
+                    'Retry-After header so well-behaved crawlers back off correctly instead of giving up.',
+                learnMoreUrl: guideUrl(meta.id, 'rate-limited'),
+            });
+            return 'inconclusive';
+        case 'server-error':
+        case 'network-error':
+            findings.push({
+                status: 'warn',
+                message: `${crawler} probe failed: ${cls.label}`,
+                detail: evidence,
+                hint: 'The request did not complete, so access for this crawler is unknown. Re-run the audit; if it persists, check origin health for this user agent.',
+                learnMoreUrl: guideUrl(meta.id, 'probe-failed'),
+            });
+            return 'inconclusive';
+        default: {
+            // A plain refusal. Whether it is a finding depends on robots.txt intent.
             if (blockedByRobots) {
                 findings.push({
                     status: 'pass',
                     message: `${crawler} blocked at the server — consistent with its robots.txt Disallow`,
-                    detail,
+                    detail: evidence,
                 });
+                return 'blocked-consistent';
             }
-            else {
+            if (cls.inconclusive) {
                 findings.push({
                     status: 'warn',
-                    message: `${crawler} is ${robotsRes.ok ? 'allowed in robots.txt' : 'not restricted'} but its User-Agent is blocked`,
-                    detail,
-                    hint: 'Your WAF or bot management rejects this crawler token even though robots.txt permits it — the block is invisible to you but fatal for the agent. ' +
-                        'Check your firewall rules and AI-bot toggles (e.g., Cloudflare "Block AI Crawlers"). ' +
-                        'Note: if your WAF verifies bots cryptographically (Web Bot Auth / verified-bots lists), the real crawler may still pass while this unverified probe is rejected — verify against your WAF logs.',
+                    message: `${crawler} is refused by ${cls.vendor ?? 'the origin'} while robots.txt permits it`,
+                    detail: evidence,
+                    hint: (info ? `${info.impact} ` : '') +
+                        'This edge verifies crawlers by IP range or signature, so the refusal may be correct anti-spoofing rather ' +
+                        'than a policy block. ' +
+                        INCONCLUSIVE_CAVEAT,
                     learnMoreUrl: guideUrl(meta.id, 'blocked-crawler'),
                 });
+                return 'inconclusive';
             }
-            continue;
-        }
-        const text = extractVisibleText(res.body).length;
-        if (baselineText >= MIN_BASELINE_TEXT && text < baselineText * REDUCED_CONTENT_RATIO) {
-            outcomes.set(crawler, 'reduced');
             findings.push({
                 status: 'warn',
-                message: `${crawler} receives reduced content (${text} vs ${baselineText} chars of visible text)`,
-                hint: 'The server returns 200 but serves this crawler substantially less content than a regular client — ' +
-                    'often an interstitial, a challenge page, or conditional rendering. Agents index what they receive.',
-                learnMoreUrl: guideUrl(meta.id, 'reduced-content'),
+                message: `${crawler} is ${robotsAvailable ? 'allowed in robots.txt' : 'not restricted'} but its User-Agent is refused`,
+                detail: evidence,
+                hint: (info ? `${info.impact} ` : '') +
+                    'Your firewall rejects this crawler token even though robots.txt permits it — the block is invisible to you ' +
+                    'but fatal for the agent. Check your firewall rules and AI-bot toggles (for example Cloudflare "Block AI Crawlers").',
+                learnMoreUrl: guideUrl(meta.id, 'blocked-crawler'),
             });
-        }
-        else {
-            outcomes.set(crawler, 'ok');
+            return 'blocked';
         }
     }
-    const okCount = [...outcomes.values()].filter((o) => o === 'ok').length;
-    if (okCount === CORE_AI_CRAWLERS.length) {
-        findings.unshift({
-            status: 'pass',
-            message: `All ${CORE_AI_CRAWLERS.length} core AI crawler user-agents receive equivalent responses`,
-        });
-    }
-    const credit = [...outcomes.values()].reduce((acc, o) => {
-        if (o === 'ok' || o === 'blocked-consistent')
-            return acc + 1;
-        if (o === 'reduced')
-            return acc + 0.5;
-        return acc;
-    }, 0);
-    const score = Math.round((credit / CORE_AI_CRAWLERS.length) * 100);
-    return buildResult(meta, score, findings, start);
 }
 //# sourceMappingURL=agent-access.js.map

package/dist/checks/agent-access.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-access.js","sourceRoot":"","sources":["../../src/checks/agent-access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAiB,MAAM,iBAAiB,CAAC;AAEjE,MAAM,CAAC,MAAM,IAAI,GAAc;IAC7B,EAAE,EAAE,cAAc;IAClB,IAAI,EAAE,cAAc;IACpB,WAAW,EAAE,yFAAyF;IACtG,MAAM,EAAE,CAAC,EAAE,qGAAqG;CACjH,CAAC;AAEF,oFAAoF;AACpF,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAClC,kGAAkG;AAClG,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAI9B;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,kEAAkE,KAAK,OAAO,CAAC;AACxF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,OAAmB,EAAE,OAAe;IAChE,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACrF,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,UAAU,CAAC;IACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;IACrD,OAAO,QAAQ,EAAE,UAAU,IAAI,KAAK,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,KAAK,CAAC,GAAiB;IACnD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,kEAAkE;YAC3E,MAAM,EAAE,QAAQ,QAAQ,CAAC,MAAM,IAAI,eAAe,EAAE;YACpD,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,sBAAsB,CAAC;SACxD,CAAC,CAAC;QACH,OAAO,WAAW,CAAC,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,YAAY,GAAG,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;IAE9D,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,GAAG,aAAa,CAAC,CAAC;IAC3D,MAAM,aAAa,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE1E,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAC;IAE5C,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/F,MAAM,eAAe,GAAG,aAAa,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAE9D,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC1E,MAAM,MAAM,GAAG,QAAQ,GAAG,CAAC,MAAM,IAAI,eAAe,+BAA+B,OAAO,GAAG,CAAC;YAC9F,IAAI,eAAe,EAAE,CAAC;gBACpB,QAAQ,CAAC,IAAI,CAAC;oBACZ,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,GAAG,OAAO,kEAAkE;oBACrF,MAAM;iBACP,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,CAAC;oBACZ,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,GAAG,OAAO,OAAO,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,gBAAgB,gCAAgC;oBACnH,MAAM;oBACN,IAAI,EACF,mJAAmJ;wBACnJ,uFAAuF;wBACvF,iMAAiM;oBACnM,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,iBAAiB,CAAC;iBACnD,CAAC,CAAC;YACL,CAAC;YACD,SAAS;QACX,CAAC;QAED,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;QACjD,IAAI,YAAY,IAAI,iBAAiB,IAAI,IAAI,GAAG,YAAY,GAAG,qBAAqB,EAAE,CAAC;YACrF,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YACjC,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,GAAG,OAAO,8BAA8B,IAAI,OAAO,YAAY,yBAAyB;gBACjG,IAAI,EACF,oGAAoG;oBACpG,oGAAoG;gBACtG,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,iBAAiB,CAAC;aACnD,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;IACxE,IAAI,OAAO,KAAK,gBAAgB,CAAC,MAAM,EAAE,CAAC;QACxC,QAAQ,CAAC,OAAO,CAAC;YACf,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,OAAO,gBAAgB,CAAC,MAAM,2DAA2D;SACnG,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACtD,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,oBAAoB;YAAE,OAAO,GAAG,GAAG,CAAC,CAAC;QAC7D,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,GAAG,GAAG,GAAG,CAAC;QACtC,OAAO,GAAG,CAAC;IACb,CAAC,EAAE,CAAC,CAAC,CAAC;IACN,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC;IAEnE,OAAO,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AACnD,CAAC"}
+{"version":3,"file":"agent-access.js","sourceRoot":"","sources":["../../src/checks/agent-access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAsB,MAAM,UAAU,CAAC;AAErF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,IAAI,GAAc;IAC7B,EAAE,EAAE,cAAc;IAClB,IAAI,EAAE,cAAc;IACpB,WAAW,EAAE,yFAAyF;IACtG,QAAQ,EAAE,QAAQ;CACnB,CAAC;AAEF,oFAAoF;AACpF,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAClC,kGAAkG;AAClG,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAgB9B,2DAA2D;AAC3D,MAAM,cAAc,GAA4B;IAC9C,EAAE,EAAE,CAAC;IACL,oBAAoB,EAAE,CAAC;IACvB,WAAW,EAAE,CAAC;IACd,YAAY,EAAE,IAAI;IAClB,OAAO,EAAE,GAAG;IACZ,OAAO,EAAE,CAAC;CACX,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,kEAAkE,KAAK,OAAO,CAAC;AACxF,CAAC;AAED,mFAAmF;AACnF,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAUnD,SAAS,OAAO,CAAC,IAAY;IAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAC/D,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACtD,OAAO;QACL,UAAU,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,MAAM;QAC3C,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;QAClD,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;QACzC,YAAY,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC,MAAM;KAC5C,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,SAAS,SAAS,CAAC,QAAmB,EAAE,MAAiB;IACvD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,QAAQ,CAAC,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC/D,KAAK,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,KAAK,IAAI,MAAM,SAAS,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,QAAQ,CAAC,EAAE,KAAK,IAAI,IAAI,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,EAAE,CAAC;QACtD,KAAK,CAAC,IAAI,CAAC,gBAAgB,MAAM,CAAC,EAAE,IAAI,MAAM,SAAS,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,QAAQ,CAAC,YAAY,GAAG,CAAC,IAAI,MAAM,CAAC,YAAY,GAAG,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC7E,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,2BAA2B,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,KAAK,CAAC,GAAiB;IACnD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,kEAAkE;YAC3E,MAAM,EAAE,QAAQ,QAAQ,CAAC,MAAM,IAAI,eAAe,EAAE;YACpD,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,sBAAsB,CAAC;SACxD,CAAC,CAAC;QACH,OAAO,WAAW,CAAC,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,YAAY,GAAG,aAAa,CAAC,UAAU,CAAC;IAE9C,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,GAAG,aAAa,CAAC,CAAC;IAC3D,MAAM,aAAa,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE1E,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAC;IAE5C,KAAK,MAAM,OAAO,IAAI,uBAAuB,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/F,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,eAAe,GAAG,aAAa,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAE9D,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAChC,MAAM,KAAK,GAAG,SAAS,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;YAC9C,MAAM,WAAW,GAAG,YAAY,IAAI,iBAAiB,IAAI,KAAK,CAAC,UAAU,GAAG,YAAY,GAAG,qBAAqB,CAAC;YAEjH,IAAI,WAAW,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;gBACjC,QAAQ,CAAC,IAAI,CAAC;oBACZ,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,GAAG,OAAO,kDAAkD;oBACrE,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,UAAU,OAAO,YAAY,wBAAwB,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC;yBACpG,MAAM,CAAC,OAAO,CAAC;yBACf,IAAI,CAAC,IAAI,CAAC;oBACb,IAAI,EACF,sGAAsG;wBACtG,yGAAyG;wBACzG,0BAA0B;oBAC5B,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,iBAAiB,CAAC;iBACnD,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC9B,CAAC;YACD,SAAS;QACX,CAAC;QAED,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,SAAS,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;IACjG,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;IACxE,IAAI,OAAO,KAAK,uBAAuB,CAAC,MAAM,EAAE,CAAC;QAC/C,QAAQ,CAAC,OAAO,CAAC;YACf,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,OAAO,uBAAuB,CAAC,MAAM,wEAAwE;SACvH,CAAC,CAAC;IACL,CAAC;IAED,MAAM,YAAY,GAAG,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,cAAc,CAAC,CAAC;IACrF,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,YAAY,CAAC,MAAM,qDAAqD;YACpF,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YACrD,IAAI,EAAE,mBAAmB;YACzB,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,oBAAoB,CAAC;SACtD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,uBAAuB,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC;IAE1E,OAAO,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CACvB,OAAe,EACf,GAAkB,EAClB,eAAwB,EACxB,eAAwB,EACxB,QAAmB;IAEnB,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;IAE/E,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,WAAW;YACd,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,GAAG,OAAO,eAAe,GAAG,CAAC,MAAM,IAAI,YAAY,gCAAgC;gBAC5F,MAAM,EAAE,QAAQ;gBAChB,IAAI,EACF,4GAA4G;oBAC5G,iGAAiG;oBACjG,2DAA2D;oBAC3D,mBAAmB;gBACrB,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,gBAAgB,CAAC;aAClD,CAAC,CAAC;YACH,OAAO,cAAc,CAAC;QAExB,KAAK,iBAAiB;YACpB,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,GAAG,OAAO,wCAAwC;gBAC3D,MAAM,EAAE,QAAQ;gBAChB,IAAI,EACF,2GAA2G;oBAC3G,sGAAsG;gBACxG,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,iBAAiB,CAAC;aACnD,CAAC,CAAC;YACH,OAAO,cAAc,CAAC;QAExB,KAAK,SAAS;YACZ,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,GAAG,OAAO,4BAA4B,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;gBACpF,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,mHAAmH;gBACzH,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,eAAe,CAAC;aACjD,CAAC,CAAC;YACH,OAAO,aAAa,CAAC;QAEvB,KAAK,kBAAkB;YACrB,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,GAAG,OAAO,0CAA0C;gBAC7D,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,gHAAgH;gBACtH,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,kBAAkB,CAAC;aACpD,CAAC,CAAC;YACH,OAAO,aAAa,CAAC;QAEvB,KAAK,cAAc;YACjB,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,GAAG,OAAO,sCAAsC;gBACzD,MAAM,EAAE,QAAQ;gBAChB,IAAI,EACF,2GAA2G;oBAC3G,sFAAsF;gBACxF,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,cAAc,CAAC;aAChD,CAAC,CAAC;YACH,OAAO,cAAc,CAAC;QAExB,KAAK,cAAc,CAAC;QACpB,KAAK,eAAe;YAClB,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,GAAG,OAAO,kBAAkB,GAAG,CAAC,KAAK,EAAE;gBAChD,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,iJAAiJ;gBACvJ,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,cAAc,CAAC;aAChD,CAAC,CAAC;YACH,OAAO,cAAc,CAAC;QAExB,OAAO,CAAC,CAAC,CAAC;YACR,yEAAyE;YACzE,IAAI,eAAe,EAAE,CAAC;gBACpB,QAAQ,CAAC,IAAI,CAAC;oBACZ,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,GAAG,OAAO,kEAAkE;oBACrF,MAAM,EAAE,QAAQ;iBACjB,CAAC,CAAC;gBACH,OAAO,oBAAoB,CAAC;YAC9B,CAAC;YAED,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;gBACrB,QAAQ,CAAC,IAAI,CAAC;oBACZ,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,GAAG,OAAO,kBAAkB,GAAG,CAAC,MAAM,IAAI,YAAY,8BAA8B;oBAC7F,MAAM,EAAE,QAAQ;oBAChB,IAAI,EACF,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC/B,2GAA2G;wBAC3G,uBAAuB;wBACvB,mBAAmB;oBACrB,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,iBAAiB,CAAC;iBACnD,CAAC,CAAC;gBACH,OAAO,cAAc,CAAC;YACxB,CAAC;YAED,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,GAAG,OAAO,OAAO,eAAe,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,gBAAgB,gCAAgC;gBACtH,MAAM,EAAE,QAAQ;gBAChB,IAAI,EACF,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/B,6GAA6G;oBAC7G,qHAAqH;gBACvH,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,iBAAiB,CAAC;aACnD,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/checks/agent-card.d.ts

@@ -0,0 +1,37 @@
+import type { CheckContext, CheckResult, CheckMeta } from '../types.js';
+/**
+ * "agent-card" — the A2A (Agent2Agent) Agent Card.
+ *
+ * Two things changed since this check was written, and both matter:
+ *
+ * 1. **The path moved.** A2A v0.3.0 (2025-07-30) relocated the card from
+ *    `/.well-known/agent.json` to `/.well-known/agent-card.json`, which is now
+ *    an IANA-registered well-known URI. A site serving only the old path is
+ *    invisible to a current client.
+ *
+ * 2. **The shape changed.** A2A 1.0 (2026-03-12, breaking) folded the
+ *    top-level `url`, `protocolVersion`, `preferredTransport` and
+ *    `additionalInterfaces` fields into a single `supportedInterfaces[]` array,
+ *    and renamed `supportsAuthenticatedExtendedCard` to
+ *    `capabilities.extendedAgentCard`. Most deployed cards are still 0.3-shaped.
+ *
+ * Validating a 1.0 card against 0.3 rules (or the reverse) produces nonsense,
+ * so the check detects which generation a card belongs to from its own
+ * structure and applies the matching rules. `authentication`, dropped back in
+ * 0.2.x in favour of `securitySchemes`, is flagged wherever it appears.
+ *
+ * Spec: https://a2a-protocol.org/latest/specification/
+ * Normative field list: specification/a2a.proto in github.com/a2aproject/A2A
+ */
+export declare const meta: CheckMeta;
+/** Which generation of the A2A spec a card was written against. */
+type Generation = 'v1' | 'v0.3' | 'unknown';
+/**
+ * Detect the card generation from its own structure rather than from a version
+ * field, because 0.3 cards state `protocolVersion` at the top level and 1.0
+ * cards state it per interface.
+ */
+export declare function detectGeneration(data: Record<string, unknown>): Generation;
+export default function check(ctx: CheckContext): Promise<CheckResult>;
+export {};
+//# sourceMappingURL=agent-card.d.ts.map

package/dist/checks/agent-card.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-card.d.ts","sourceRoot":"","sources":["../../src/checks/agent-card.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,EAA0B,MAAM,aAAa,CAAC;AAKhG;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,IAAI,EAAE,SAMlB,CAAC;AAKF,mEAAmE;AACnE,KAAK,UAAU,GAAG,IAAI,GAAG,MAAM,GAAG,SAAS,CAAC;AAE5C;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,CAI1E;AAqBD,wBAA8B,KAAK,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAkF3E"}