ax-audit 4.2.1 → 6.0.0

package/dist/checks/surface.d.ts

@@ -1,59 +0,0 @@
-/**
- * Does this site have the surface a protocol check is about?
- *
- * From 4.0, protocol checks carry weight. That is only defensible if they apply
- * to the site being audited. A blog has no API to describe and is not an agent;
- * scoring it zero for publishing no OpenAPI document or Agent Card would say
- * something false about the blog and make the overall number useless as a
- * signal.
- *
- * So each protocol check asks first whether the site has the corresponding
- * surface. When it does not, the check reports N/A — visible in the report,
- * excluded from the score — and says what publishing one would enable. When it
- * does, a missing description is a real finding, because the capability exists
- * and agents cannot find it.
- *
- * A `--profile` flag overrides the detection, so a site can be audited against
- * what it intends to become rather than only what it already is.
- */
-import type { CheckContext } from '../types.js';
-/** Surfaces a site can have, each gating one or more protocol checks. */
-export type Surface = 'api' | 'mcp' | 'agent' | 'docs' | 'commerce';
-/**
- * Profiles a user can force with `--profile`. `all` makes every protocol check
- * applicable, which is what a site planning its agent integration wants.
- */
-export type Profile = 'auto' | 'api' | 'mcp' | 'agent' | 'docs' | 'commerce' | 'all';
-export interface SurfaceEvidence {
-    found: boolean;
-    /** What made the check applicable, for the report. */
-    reason: string;
-}
-/** Read the profile a run was invoked with, defaulting to automatic detection. */
-export declare function profileFrom(ctx: CheckContext): Profile;
-/** Whether the active profile forces this surface applicable. */
-export declare function forcedBy(profile: Profile, surface: Surface): boolean;
-/**
- * Does this site offer an HTTP API?
- *
- * Evidence: a description at a conventional location, an RFC 9727 catalog, a
- * `service-desc` relation, or navigation into an API or developer area. The
- * last is the loosest and the most common: a site with a "Developers" link
- * almost certainly has an API worth describing.
- */
-export declare function hasApiSurface(ctx: CheckContext): Promise<SurfaceEvidence>;
-/** Does this site run an MCP server? */
-export declare function hasMcpSurface(ctx: CheckContext): Promise<SurfaceEvidence>;
-/**
- * Is this site agent-facing — something an agent would call rather than only
- * read?
- *
- * An Agent Card describes capabilities another agent can invoke. Most sites do
- * not have any, and asking a restaurant to publish one is noise. A site that
- * runs an MCP server, offers an API, or already publishes a card is a different
- * matter.
- */
-export declare function hasAgentSurface(ctx: CheckContext): Promise<SurfaceEvidence>;
-/** Does this site have documentation an agent could be taught to follow? */
-export declare function hasDocsSurface(ctx: CheckContext): Promise<SurfaceEvidence>;
-//# sourceMappingURL=surface.d.ts.map

package/dist/checks/surface.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"surface.d.ts","sourceRoot":"","sources":["../../src/checks/surface.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAIhD,yEAAyE;AACzE,MAAM,MAAM,OAAO,GAAG,KAAK,GAAG,KAAK,GAAG,OAAO,GAAG,MAAM,GAAG,UAAU,CAAC;AAEpE;;;GAGG;AACH,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,KAAK,GAAG,OAAO,GAAG,MAAM,GAAG,UAAU,GAAG,KAAK,CAAC;AAErF,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,OAAO,CAAC;IACf,sDAAsD;IACtD,MAAM,EAAE,MAAM,CAAC;CAChB;AAID,kFAAkF;AAClF,wBAAgB,WAAW,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAEtD;AAED,iEAAiE;AACjE,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAEpE;AAaD;;;;;;;GAOG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,eAAe,CAAC,CAkB/E;AAED,wCAAwC;AACxC,wBAAsB,aAAa,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,eAAe,CAAC,CAiB/E;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,eAAe,CAAC,CAmBjF;AAED,4EAA4E;AAC5E,wBAAsB,cAAc,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,eAAe,CAAC,CAWhF"}

package/dist/checks/surface.js

@@ -1,106 +0,0 @@
-import { isHtmlDocument } from './utils.js';
-import { parseLinkHeader } from './http-headers.js';
-const NOT_FOUND = { found: false, reason: '' };
-/** Read the profile a run was invoked with, defaulting to automatic detection. */
-export function profileFrom(ctx) {
-    return ctx.profile ?? 'auto';
-}
-/** Whether the active profile forces this surface applicable. */
-export function forcedBy(profile, surface) {
-    return profile === 'all' || profile === surface;
-}
-async function exists(ctx, path) {
-    const res = await ctx.fetch(`${ctx.url}${path}`);
-    return res.ok && res.body.trim().length > 0 && !isHtmlDocument(res.body);
-}
-/** Links and headers pointing at a named area of the site. */
-function linksTo(ctx, pattern) {
-    if (pattern.test(ctx.html ?? ''))
-        return true;
-    return parseLinkHeader(ctx.headers?.['link'] ?? '').some((entry) => pattern.test(entry.url));
-}
-/**
- * Does this site offer an HTTP API?
- *
- * Evidence: a description at a conventional location, an RFC 9727 catalog, a
- * `service-desc` relation, or navigation into an API or developer area. The
- * last is the loosest and the most common: a site with a "Developers" link
- * almost certainly has an API worth describing.
- */
-export async function hasApiSurface(ctx) {
-    if (forcedBy(profileFrom(ctx), 'api'))
-        return { found: true, reason: '--profile api' };
-    for (const path of ['/openapi.json', '/.well-known/openapi.json', '/.well-known/api-catalog', '/swagger.json']) {
-        if (await exists(ctx, path))
-            return { found: true, reason: `a document at ${path}` };
-    }
-    if (linksTo(ctx, /rel\s*=\s*["'][^"']*service-desc/i)) {
-        return { found: true, reason: 'a service-desc link relation' };
-    }
-    if (linksTo(ctx, /href\s*=\s*["'][^"']*\/(api|developers?|api-docs|reference)\b/i)) {
-        return { found: true, reason: 'navigation into an API or developer area' };
-    }
-    if (/\bapi\.[a-z0-9-]+\.[a-z]{2,}/i.test(ctx.html ?? '')) {
-        return { found: true, reason: 'references to an API subdomain' };
-    }
-    return NOT_FOUND;
-}
-/** Does this site run an MCP server? */
-export async function hasMcpSurface(ctx) {
-    if (forcedBy(profileFrom(ctx), 'mcp'))
-        return { found: true, reason: '--profile mcp' };
-    for (const path of ['/.well-known/mcp/server-card.json', '/mcp/server-card', '/.well-known/mcp.json']) {
-        if (await exists(ctx, path))
-            return { found: true, reason: `a document at ${path}` };
-    }
-    const catalog = await ctx.fetch(`${ctx.url}/.well-known/ai-catalog.json`);
-    if (catalog.ok && /application\/mcp-server-card\+json/.test(catalog.body)) {
-        return { found: true, reason: 'an MCP entry in the AI catalog' };
-    }
-    if (linksTo(ctx, /href\s*=\s*["'][^"']*\/mcp\b/i)) {
-        return { found: true, reason: 'navigation referencing an MCP endpoint' };
-    }
-    return NOT_FOUND;
-}
-/**
- * Is this site agent-facing — something an agent would call rather than only
- * read?
- *
- * An Agent Card describes capabilities another agent can invoke. Most sites do
- * not have any, and asking a restaurant to publish one is noise. A site that
- * runs an MCP server, offers an API, or already publishes a card is a different
- * matter.
- */
-export async function hasAgentSurface(ctx) {
-    if (forcedBy(profileFrom(ctx), 'agent'))
-        return { found: true, reason: '--profile agent' };
-    for (const path of ['/.well-known/agent-card.json', '/.well-known/agent.json']) {
-        if (await exists(ctx, path))
-            return { found: true, reason: `a document at ${path}` };
-    }
-    const catalog = await ctx.fetch(`${ctx.url}/.well-known/ai-catalog.json`);
-    if (catalog.ok && /application\/a2a-agent-card\+json/.test(catalog.body)) {
-        return { found: true, reason: 'an A2A entry in the AI catalog' };
-    }
-    const mcp = await hasMcpSurface(ctx);
-    if (mcp.found)
-        return { found: true, reason: `an MCP surface (${mcp.reason})` };
-    const api = await hasApiSurface(ctx);
-    if (api.found)
-        return { found: true, reason: `an API surface (${api.reason})` };
-    return NOT_FOUND;
-}
-/** Does this site have documentation an agent could be taught to follow? */
-export async function hasDocsSurface(ctx) {
-    if (forcedBy(profileFrom(ctx), 'docs'))
-        return { found: true, reason: '--profile docs' };
-    if (linksTo(ctx, /href\s*=\s*["'][^"']*\/(docs|documentation|guides?|reference|developers?)\b/i)) {
-        return { found: true, reason: 'navigation into a documentation area' };
-    }
-    for (const path of ['/llms.txt', '/openapi.json']) {
-        if (await exists(ctx, path))
-            return { found: true, reason: `a document at ${path}` };
-    }
-    return NOT_FOUND;
-}
-//# sourceMappingURL=surface.js.map

package/dist/checks/surface.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"surface.js","sourceRoot":"","sources":["../../src/checks/surface.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAiBpD,MAAM,SAAS,GAAoB,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAEhE,kFAAkF;AAClF,MAAM,UAAU,WAAW,CAAC,GAAiB;IAC3C,OAAO,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC;AAC/B,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,QAAQ,CAAC,OAAgB,EAAE,OAAgB;IACzD,OAAO,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,OAAO,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,GAAiB,EAAE,IAAY;IACnD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,IAAI,EAAE,CAAC,CAAC;IACjD,OAAO,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC3E,CAAC;AAED,8DAA8D;AAC9D,SAAS,OAAO,CAAC,GAAiB,EAAE,OAAe;IACjD,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,OAAO,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAiB;IACnD,IAAI,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAEvF,KAAK,MAAM,IAAI,IAAI,CAAC,eAAe,EAAE,2BAA2B,EAAE,0BAA0B,EAAE,eAAe,CAAC,EAAE,CAAC;QAC/G,IAAI,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,IAAI,EAAE,EAAE,CAAC;IACvF,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,EAAE,mCAAmC,CAAC,EAAE,CAAC;QACtD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IACjE,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,EAAE,gEAAgE,CAAC,EAAE,CAAC;QACnF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC;IAC7E,CAAC;IACD,IAAI,+BAA+B,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;QACzD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IACnE,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,wCAAwC;AACxC,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAiB;IACnD,IAAI,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAEvF,KAAK,MAAM,IAAI,IAAI,CAAC,mCAAmC,EAAE,kBAAkB,EAAE,uBAAuB,CAAC,EAAE,CAAC;QACtG,IAAI,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,IAAI,EAAE,EAAE,CAAC;IACvF,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,GAAG,8BAA8B,CAAC,CAAC;IAC1E,IAAI,OAAO,CAAC,EAAE,IAAI,oCAAoC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1E,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IACnE,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,EAAE,+BAA+B,CAAC,EAAE,CAAC;QAClD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;IAC3E,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAiB;IACrD,IAAI,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAE3F,KAAK,MAAM,IAAI,IAAI,CAAC,8BAA8B,EAAE,yBAAyB,CAAC,EAAE,CAAC;QAC/E,IAAI,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,IAAI,EAAE,EAAE,CAAC;IACvF,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,GAAG,8BAA8B,CAAC,CAAC;IAC1E,IAAI,OAAO,CAAC,EAAE,IAAI,mCAAmC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IACnE,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,GAAG,CAAC,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,mBAAmB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;IAEhF,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,GAAG,CAAC,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,mBAAmB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;IAEhF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAiB;IACpD,IAAI,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAEzF,IAAI,OAAO,CAAC,GAAG,EAAE,8EAA8E,CAAC,EAAE,CAAC;QACjG,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC;IACzE,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,eAAe,CAAC,EAAE,CAAC;QAClD,IAAI,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,IAAI,EAAE,EAAE,CAAC;IACvF,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/checks/tls-https.d.ts

@@ -1,13 +0,0 @@
-import type { CheckContext, CheckResult, CheckMeta } from '../types.js';
-/**
- * "tls-https" — verify the site is served over HTTPS, that bare HTTP redirects to HTTPS,
- * and that HSTS is properly configured (with `preload` + `includeSubDomains` for full
- * coverage). Many AI agents refuse to fetch plaintext HTTP and downgrade trust on
- * misconfigured TLS.
- *
- * The check intentionally avoids verifying the certificate chain — Node's `fetch` already
- * fails on invalid certificates, so a successful HTTPS fetch is itself a positive signal.
- */
-export declare const meta: CheckMeta;
-export default function check(ctx: CheckContext): Promise<CheckResult>;
-//# sourceMappingURL=tls-https.d.ts.map

package/dist/checks/tls-https.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"tls-https.d.ts","sourceRoot":"","sources":["../../src/checks/tls-https.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,EAAW,MAAM,aAAa,CAAC;AAGjF;;;;;;;;GAQG;AACH,eAAO,MAAM,IAAI,EAAE,SAIlB,CAAC;AAKF,wBAA8B,KAAK,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAqI3E"}

package/dist/checks/tls-https.js

@@ -1,163 +0,0 @@
-import { guideUrl } from '../guide-urls.js';
-import { buildResult } from './utils.js';
-/**
- * "tls-https" — verify the site is served over HTTPS, that bare HTTP redirects to HTTPS,
- * and that HSTS is properly configured (with `preload` + `includeSubDomains` for full
- * coverage). Many AI agents refuse to fetch plaintext HTTP and downgrade trust on
- * misconfigured TLS.
- *
- * The check intentionally avoids verifying the certificate chain — Node's `fetch` already
- * fails on invalid certificates, so a successful HTTPS fetch is itself a positive signal.
- */
-export const meta = {
-    id: 'tls-https',
-    name: 'TLS / HTTPS',
-    description: 'Checks HTTPS, HTTP→HTTPS redirect, and HSTS configuration',
-};
-const HSTS_MIN_MAX_AGE = 15_768_000;
-const HSTS_PRELOAD_MIN_MAX_AGE = 31_536_000;
-export default async function check(ctx) {
-    const start = performance.now();
-    const findings = [];
-    let score = 100;
-    let parsed;
-    try {
-        parsed = new URL(ctx.url);
-    }
-    catch {
-        findings.push({
-            status: 'fail',
-            message: `Invalid URL: ${ctx.url}`,
-            hint: 'Provide a fully qualified URL including scheme (https://...).',
-            learnMoreUrl: guideUrl(meta.id, 'invalid-url'),
-        });
-        return buildResult(meta, 0, findings, start);
-    }
-    if (parsed.protocol === 'https:') {
-        findings.push({ status: 'pass', message: 'Site is served over HTTPS' });
-    }
-    else {
-        findings.push({
-            status: 'fail',
-            message: `Site is served over ${parsed.protocol.replace(':', '').toUpperCase()} (not HTTPS)`,
-            hint: 'Serve the site over HTTPS. Most AI crawlers refuse plaintext HTTP and downgrade trust on insecure origins.',
-            learnMoreUrl: guideUrl(meta.id, 'no-https'),
-        });
-        score -= 50;
-    }
-    if (parsed.protocol === 'https:') {
-        const httpUrl = `http://${parsed.host}${parsed.pathname || ''}`;
-        const httpRes = await ctx.fetch(httpUrl);
-        const finalUrl = httpRes.url || '';
-        if (httpRes.ok && /^https:\/\//i.test(finalUrl)) {
-            findings.push({ status: 'pass', message: 'HTTP requests redirect to HTTPS' });
-        }
-        else if (!httpRes.ok && httpRes.status === 0) {
-            findings.push({
-                status: 'pass',
-                message: 'HTTP endpoint not reachable (HTTPS-only — acceptable)',
-            });
-        }
-        else if (httpRes.ok && /^http:\/\//i.test(finalUrl)) {
-            findings.push({
-                status: 'fail',
-                message: 'HTTP request did not redirect to HTTPS',
-                detail: `Final URL: ${finalUrl}`,
-                hint: 'Configure your server to 301-redirect every http:// request to https://. Otherwise agents may cache the insecure variant.',
-                learnMoreUrl: guideUrl(meta.id, 'no-redirect'),
-            });
-            score -= 15;
-        }
-        else {
-            findings.push({
-                status: 'warn',
-                message: 'Could not verify HTTP→HTTPS redirect',
-                detail: `HTTP ${httpRes.status} on ${httpUrl}`,
-                hint: 'Test manually: a request to http://your-site.com should respond with 301 → https://your-site.com.',
-                learnMoreUrl: guideUrl(meta.id, 'redirect-unknown'),
-            });
-            score -= 5;
-        }
-    }
-    const hsts = ctx.headers['strict-transport-security'];
-    if (!hsts) {
-        findings.push({
-            status: 'warn',
-            message: 'No Strict-Transport-Security header',
-            hint: 'Add: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload. This locks browsers and many agents to HTTPS for 1 year.',
-            learnMoreUrl: guideUrl(meta.id, 'no-hsts'),
-        });
-        score -= 15;
-    }
-    else {
-        const maxAge = parseHstsMaxAge(hsts);
-        const includesSubDomains = /includeSubDomains/i.test(hsts);
-        const preload = /preload/i.test(hsts);
-        if (maxAge === null) {
-            findings.push({
-                status: 'warn',
-                message: 'HSTS header has no max-age directive',
-                detail: hsts,
-                hint: 'Set a numeric max-age, e.g., max-age=31536000.',
-                learnMoreUrl: guideUrl(meta.id, 'hsts-no-maxage'),
-            });
-            score -= 10;
-        }
-        else if (maxAge < HSTS_MIN_MAX_AGE) {
-            findings.push({
-                status: 'warn',
-                message: `HSTS max-age is short (${maxAge}s = ~${Math.round(maxAge / 86400)} days)`,
-                hint: `Use at least max-age=${HSTS_MIN_MAX_AGE} (~6 months); preload list submission requires max-age=${HSTS_PRELOAD_MIN_MAX_AGE} (1 year).`,
-                learnMoreUrl: guideUrl(meta.id, 'hsts-short'),
-            });
-            score -= 5;
-        }
-        else {
-            findings.push({ status: 'pass', message: `HSTS max-age=${maxAge}` });
-        }
-        if (includesSubDomains) {
-            findings.push({ status: 'pass', message: 'HSTS includes subdomains' });
-        }
-        else {
-            findings.push({
-                status: 'warn',
-                message: 'HSTS does not include subdomains',
-                hint: 'Add includeSubDomains to apply HSTS across api., docs., etc. Required for preload list submission.',
-                learnMoreUrl: guideUrl(meta.id, 'hsts-no-subdomains'),
-            });
-            score -= 5;
-        }
-        if (preload) {
-            if (maxAge !== null && maxAge >= HSTS_PRELOAD_MIN_MAX_AGE && includesSubDomains) {
-                findings.push({ status: 'pass', message: 'HSTS preload-eligible' });
-            }
-            else {
-                findings.push({
-                    status: 'warn',
-                    message: 'HSTS has preload directive but does not satisfy preload-list requirements',
-                    hint: `Preload requires max-age >= ${HSTS_PRELOAD_MIN_MAX_AGE} and includeSubDomains. See https://hstspreload.org.`,
-                    learnMoreUrl: guideUrl(meta.id, 'hsts-preload-invalid'),
-                });
-                score -= 5;
-            }
-        }
-        else {
-            findings.push({
-                status: 'warn',
-                message: 'HSTS lacks the preload directive',
-                hint: 'Add preload (and ensure max-age >= 31536000 + includeSubDomains) and submit the domain at https://hstspreload.org for browser-built-in HTTPS enforcement.',
-                learnMoreUrl: guideUrl(meta.id, 'hsts-no-preload'),
-            });
-            score -= 3;
-        }
-    }
-    return buildResult(meta, score, findings, start);
-}
-function parseHstsMaxAge(value) {
-    const m = value.match(/max-age\s*=\s*"?(\d+)"?/i);
-    if (!m)
-        return null;
-    const n = Number(m[1]);
-    return Number.isFinite(n) ? n : null;
-}
-//# sourceMappingURL=tls-https.js.map

package/dist/checks/tls-https.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"tls-https.js","sourceRoot":"","sources":["../../src/checks/tls-https.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,IAAI,GAAc;IAC7B,EAAE,EAAE,WAAW;IACf,IAAI,EAAE,aAAa;IACnB,WAAW,EAAE,2DAA2D;CACzE,CAAC;AAEF,MAAM,gBAAgB,GAAG,UAAU,CAAC;AACpC,MAAM,wBAAwB,GAAG,UAAU,CAAC;AAE5C,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,KAAK,CAAC,GAAiB;IACnD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,KAAK,GAAG,GAAG,CAAC;IAEhB,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,gBAAgB,GAAG,CAAC,GAAG,EAAE;YAClC,IAAI,EAAE,+DAA+D;YACrE,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,aAAa,CAAC;SAC/C,CAAC,CAAC;QACH,OAAO,WAAW,CAAC,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC,CAAC;IAC1E,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,uBAAuB,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,cAAc;YAC5F,IAAI,EAAE,4GAA4G;YAClH,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC;SAC5C,CAAC,CAAC;QACH,KAAK,IAAI,EAAE,CAAC;IACd,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,UAAU,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QAChE,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;QACnC,IAAI,OAAO,CAAC,EAAE,IAAI,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAChF,CAAC;aAAM,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/C,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,uDAAuD;aACjE,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,OAAO,CAAC,EAAE,IAAI,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtD,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,wCAAwC;gBACjD,MAAM,EAAE,cAAc,QAAQ,EAAE;gBAChC,IAAI,EAAE,2HAA2H;gBACjI,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,aAAa,CAAC;aAC/C,CAAC,CAAC;YACH,KAAK,IAAI,EAAE,CAAC;QACd,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,sCAAsC;gBAC/C,MAAM,EAAE,QAAQ,OAAO,CAAC,MAAM,OAAO,OAAO,EAAE;gBAC9C,IAAI,EAAE,mGAAmG;gBACzG,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,kBAAkB,CAAC;aACpD,CAAC,CAAC;YACH,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACtD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,qCAAqC;YAC9C,IAAI,EAAE,wIAAwI;YAC9I,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC;SAC3C,CAAC,CAAC;QACH,KAAK,IAAI,EAAE,CAAC;IACd,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEtC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,sCAAsC;gBAC/C,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,gDAAgD;gBACtD,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,gBAAgB,CAAC;aAClD,CAAC,CAAC;YACH,KAAK,IAAI,EAAE,CAAC;QACd,CAAC;aAAM,IAAI,MAAM,GAAG,gBAAgB,EAAE,CAAC;YACrC,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,0BAA0B,MAAM,QAAQ,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,QAAQ;gBACnF,IAAI,EAAE,wBAAwB,gBAAgB,0DAA0D,wBAAwB,YAAY;gBAC5I,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,CAAC;aAC9C,CAAC,CAAC;YACH,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,MAAM,EAAE,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,kBAAkB,EAAE,CAAC;YACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACzE,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,kCAAkC;gBAC3C,IAAI,EAAE,oGAAoG;gBAC1G,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,oBAAoB,CAAC;aACtD,CAAC,CAAC;YACH,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;QAED,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,IAAI,wBAAwB,IAAI,kBAAkB,EAAE,CAAC;gBAChF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;YACtE,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,CAAC;oBACZ,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,2EAA2E;oBACpF,IAAI,EAAE,+BAA+B,wBAAwB,sDAAsD;oBACnH,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,sBAAsB,CAAC;iBACxD,CAAC,CAAC;gBACH,KAAK,IAAI,CAAC,CAAC;YACb,CAAC;QACH,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,kCAAkC;gBAC3C,IAAI,EAAE,2JAA2J;gBACjK,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,iBAAiB,CAAC;aACnD,CAAC,CAAC;YACH,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;IACH,CAAC;IAED,OAAO,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAClD,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC"}

package/dist/checks/usage-policy.d.ts

@@ -1,53 +0,0 @@
-import type { CheckContext, CheckResult, CheckMeta } from '../types.js';
-/**
- * "usage-policy" — do your machine-readable usage signals agree with each other?
- *
- * A site can now state its AI usage terms in at least five places, written in
- * vocabularies that mirror each other without matching:
- *
- * | Mechanism | Training | Grounding / RAG | Search |
- * | --- | --- | --- | --- |
- * | Content Signals (robots.txt) | `ai-train=yes\|no` | `ai-input=yes\|no` | `search=yes\|no` |
- * | IETF AIPREF (robots.txt or header) | `train-ai=y\|n` | *(no category yet)* | `search=y\|n` |
- * | RSL licence | `ai-train` | `ai-input` | `ai-index`, `search` |
- * | TDMRep | `tdm-reservation: 0\|1` | — | — |
- * | robots meta | `noai` | — | — |
- *
- * Nobody maintains five documents by hand without them drifting. This check
- * normalises every signal onto three questions — may you train on it, may you
- * ground an answer in it, may you index it — and reports where the answers
- * disagree. A site whose robots.txt says `ai-train=no` while its RSL licence
- * permits `ai-train` has published two contradictory legal positions, and which
- * one a crawler honors is then a matter of which file it happened to read.
- *
- * On enforcement, the check is blunt: only robots.txt access rules are
- * documented as honored by Google, OpenAI, Anthropic and Microsoft. Content
- * Signals, AIPREF, RSL and TDMRep are declarations. Their weight is legal — the
- * EU AI Act's opt-out provisions and the GPAI Code of Practice reference several
- * of them — rather than technical, and reports say so rather than implying a
- * crawler will obey.
- */
-export declare const meta: CheckMeta;
-/** The three questions every usage vocabulary answers, or declines to answer. */
-export type Dimension = 'train' | 'ground' | 'index';
-export type Stance = 'allow' | 'deny' | 'unstated';
-export interface Declaration {
-    /** Human name of the mechanism and where it was found. */
-    source: string;
-    /** Whether the mechanism has any documented honorer among major AI operators. */
-    enforceable: boolean;
-    train: Stance;
-    ground: Stance;
-    index: Stance;
-}
-/** Read a Content-Signal value into a declaration. */
-export declare function fromContentSignal(raw: string, source: string): Declaration;
-/** Read an AIPREF Content-Usage value into a declaration. AIPREF has no grounding category yet. */
-export declare function fromContentUsage(raw: string, source: string): Declaration;
-/**
- * Read RSL `permits` / `prohibits` usage tokens into a declaration.
- * `all` and `ai-all` set several dimensions at once.
- */
-export declare function fromRsl(document: string, source: string): Declaration;
-export default function check(ctx: CheckContext): Promise<CheckResult>;
-//# sourceMappingURL=usage-policy.d.ts.map

package/dist/checks/usage-policy.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"usage-policy.d.ts","sourceRoot":"","sources":["../../src/checks/usage-policy.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,EAAW,MAAM,aAAa,CAAC;AAQjF;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,IAAI,EAAE,SAKlB,CAAC;AAEF,iFAAiF;AACjF,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC;AAErD,MAAM,MAAM,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,UAAU,CAAC;AAEnD,MAAM,WAAW,WAAW;IAC1B,0DAA0D;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,WAAW,EAAE,OAAO,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAcD,sDAAsD;AACtD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,WAAW,CAc1E;AAED,mGAAmG;AACnG,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,WAAW,CAczE;AAED;;;GAGG;AACH,wBAAgB,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,WAAW,CAqCrE;AA6ID,wBAA8B,KAAK,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CA2C3E"}