ax-audit 4.2.1 → 6.0.0

package/dist/checks/usage-policy.js

@@ -1,339 +0,0 @@
-import { RSL_MIME } from '../constants.js';
-import { guideUrl } from '../guide-urls.js';
-import { buildResult } from './utils.js';
-import { findLinkTags, getAttribute, getMetaContent } from './html-utils.js';
-import { parseLinkHeader } from './http-headers.js';
-import { parseDictionary } from './structured-fields.js';
-import { AIPREF_TOKENS, AIPREF_VALUES } from '../constants.js';
-import { collectLicenses, parseContentSignalValue, parseContentUsageValue, parseRobotsTxt } from './robots-parser.js';
-/**
- * "usage-policy" — do your machine-readable usage signals agree with each other?
- *
- * A site can now state its AI usage terms in at least five places, written in
- * vocabularies that mirror each other without matching:
- *
- * | Mechanism | Training | Grounding / RAG | Search |
- * | --- | --- | --- | --- |
- * | Content Signals (robots.txt) | `ai-train=yes\|no` | `ai-input=yes\|no` | `search=yes\|no` |
- * | IETF AIPREF (robots.txt or header) | `train-ai=y\|n` | *(no category yet)* | `search=y\|n` |
- * | RSL licence | `ai-train` | `ai-input` | `ai-index`, `search` |
- * | TDMRep | `tdm-reservation: 0\|1` | — | — |
- * | robots meta | `noai` | — | — |
- *
- * Nobody maintains five documents by hand without them drifting. This check
- * normalises every signal onto three questions — may you train on it, may you
- * ground an answer in it, may you index it — and reports where the answers
- * disagree. A site whose robots.txt says `ai-train=no` while its RSL licence
- * permits `ai-train` has published two contradictory legal positions, and which
- * one a crawler honors is then a matter of which file it happened to read.
- *
- * On enforcement, the check is blunt: only robots.txt access rules are
- * documented as honored by Google, OpenAI, Anthropic and Microsoft. Content
- * Signals, AIPREF, RSL and TDMRep are declarations. Their weight is legal — the
- * EU AI Act's opt-out provisions and the GPAI Code of Practice reference several
- * of them — rather than technical, and reports say so rather than implying a
- * crawler will obey.
- */
-export const meta = {
-    id: 'usage-policy',
-    name: 'Usage Policy',
-    description: 'Checks machine-readable AI usage signals for coverage and internal consistency',
-    category: 'policy',
-};
-const DIMENSION_LABEL = {
-    train: 'training on your content',
-    ground: 'grounding an answer in your content',
-    index: 'indexing your content for search',
-};
-function yesNo(value) {
-    if (value === 'yes' || value === 'y')
-        return 'allow';
-    if (value === 'no' || value === 'n')
-        return 'deny';
-    return 'unstated';
-}
-/** Read a Content-Signal value into a declaration. */
-export function fromContentSignal(raw, source) {
-    const pairs = new Map(parseContentSignalValue(raw).valid.map((p) => {
-        const [k, v] = p.split('=');
-        return [k, v];
-    }));
-    return {
-        source,
-        enforceable: false,
-        train: yesNo(pairs.get('ai-train')),
-        ground: yesNo(pairs.get('ai-input')),
-        index: yesNo(pairs.get('search')),
-    };
-}
-/** Read an AIPREF Content-Usage value into a declaration. AIPREF has no grounding category yet. */
-export function fromContentUsage(raw, source) {
-    const pairs = new Map(parseContentUsageValue(raw).valid.map((p) => {
-        const [k, v] = p.split('=');
-        return [k, v];
-    }));
-    return {
-        source,
-        enforceable: false,
-        train: yesNo(pairs.get('train-ai')),
-        ground: 'unstated',
-        index: yesNo(pairs.get('search')),
-    };
-}
-/**
- * Read RSL `permits` / `prohibits` usage tokens into a declaration.
- * `all` and `ai-all` set several dimensions at once.
- */
-export function fromRsl(document, source) {
-    const decl = { source, enforceable: false, train: 'unstated', ground: 'unstated', index: 'unstated' };
-    const body = document.replace(/<!--[\s\S]*?-->/g, '');
-    for (const m of body.matchAll(/<(permits|prohibits)\b([^>]*)>([^<]*)</gi)) {
-        const stance = m[1].toLowerCase() === 'permits' ? 'allow' : 'deny';
-        const type = (getAttribute(m[2], 'type') ?? '').toLowerCase();
-        if (type !== 'usage')
-            continue;
-        for (const token of m[3].trim().toLowerCase().split(/\s+/).filter(Boolean)) {
-            switch (token) {
-                case 'ai-train':
-                    decl.train = stance;
-                    break;
-                case 'ai-input':
-                    decl.ground = stance;
-                    break;
-                case 'ai-index':
-                case 'search':
-                    decl.index = stance;
-                    break;
-                case 'ai-all':
-                    decl.train = stance;
-                    decl.ground = stance;
-                    break;
-                case 'all':
-                    decl.train = stance;
-                    decl.ground = stance;
-                    decl.index = stance;
-                    break;
-                default:
-                    break;
-            }
-        }
-    }
-    return decl;
-}
-/** Collect every usage declaration a site publishes. */
-async function collect(ctx) {
-    const declarations = [];
-    const notes = [];
-    /* robots.txt: Content-Signal and Content-Usage, per group. */
-    const robotsRes = await ctx.fetch(`${ctx.url}/robots.txt`);
-    const robots = robotsRes.ok ? parseRobotsTxt(robotsRes.body) : null;
-    if (robots !== null) {
-        for (const group of robots.groups) {
-            const scope = group.userAgents.join(', ');
-            for (const raw of group.contentSignals) {
-                declarations.push(fromContentSignal(raw, `robots.txt Content-Signal (User-agent: ${scope})`));
-            }
-            for (const raw of group.contentUsage) {
-                declarations.push(fromContentUsage(raw, `robots.txt Content-Usage (User-agent: ${scope})`));
-            }
-        }
-    }
-    /* HTTP headers: the Content-Usage response header, and Cloudflare's content-signal. */
-    const headers = ctx.headers ?? {};
-    if (headers['content-usage'] !== undefined) {
-        declarations.push(fromContentUsage(headers['content-usage'], 'Content-Usage response header'));
-        const dict = parseDictionary(headers['content-usage']);
-        const bad = dict.members.filter((m) => !AIPREF_TOKENS.includes(m.key) || !AIPREF_VALUES.includes(m.value.toLowerCase()));
-        if (bad.length > 0) {
-            notes.push({
-                status: 'warn',
-                message: 'Content-Usage response header uses tokens outside the AIPREF vocabulary',
-                detail: bad.map((m) => m.raw).join(', '),
-                hint: 'The header takes a Structured Fields dictionary over train-ai and search with y/n values.',
-                learnMoreUrl: guideUrl(meta.id, 'header-vocabulary'),
-            });
-        }
-    }
-    if (headers['content-signal'] !== undefined) {
-        declarations.push(fromContentSignal(headers['content-signal'], 'content-signal response header'));
-    }
-    /* RSL licence, discovered the same three ways the rsl check uses. */
-    const licenceUrl = findLicenceUrl(ctx, robots === null ? [] : collectLicenses(robots));
-    if (licenceUrl !== null) {
-        const doc = await ctx.fetch(licenceUrl);
-        if (doc.ok && /<rsl[\s>]/i.test(doc.body)) {
-            declarations.push(fromRsl(doc.body, `RSL licence (${licenceUrl})`));
-        }
-    }
-    /* TDMRep: reservation is specifically about text-and-data-mining, i.e. training. */
-    const tdm = await readTdmRep(ctx);
-    if (tdm !== null)
-        declarations.push(tdm);
-    /* robots meta noai: a declared preference with no committed honorer. */
-    const robotsMeta = (getMetaContent(ctx.html ?? '', 'robots') ?? '').toLowerCase();
-    if (/\bnoai\b/.test(robotsMeta)) {
-        declarations.push({
-            source: '<meta name="robots" content="noai">',
-            enforceable: false,
-            train: 'deny',
-            ground: 'unstated',
-            index: 'unstated',
-        });
-    }
-    return { declarations, notes };
-}
-/** Resolve the first RSL licence URL from robots.txt, the Link header, or an HTML link. */
-function findLicenceUrl(ctx, robotsLicences) {
-    const candidates = [...robotsLicences];
-    for (const entry of parseLinkHeader(ctx.headers?.['link'] ?? '')) {
-        if (entry.params['rel'] === 'license' && (entry.params['type'] ?? '').includes(RSL_MIME)) {
-            candidates.push(entry.url);
-        }
-    }
-    for (const tag of findLinkTags(ctx.html ?? '', 'license')) {
-        const type = (getAttribute(tag, 'type') ?? '').toLowerCase();
-        const href = getAttribute(tag, 'href');
-        if (type.includes(RSL_MIME) && href !== null)
-            candidates.push(href);
-    }
-    if (candidates.length === 0)
-        return null;
-    try {
-        return new URL(candidates[0], `${ctx.url}/`).toString();
-    }
-    catch {
-        return null;
-    }
-}
-/** Read a TDM reservation from headers, meta tags, or the well-known file (precedence: meta > header > file). */
-async function readTdmRep(ctx) {
-    const metaValue = getMetaContent(ctx.html ?? '', 'tdm-reservation');
-    if (metaValue !== null) {
-        return {
-            source: '<meta name="tdm-reservation">',
-            enforceable: false,
-            train: metaValue.trim() === '1' ? 'deny' : 'allow',
-            ground: 'unstated',
-            index: 'unstated',
-        };
-    }
-    const header = ctx.headers?.['tdm-reservation'];
-    if (header !== undefined) {
-        return {
-            source: 'tdm-reservation response header',
-            enforceable: false,
-            train: header.trim() === '1' ? 'deny' : 'allow',
-            ground: 'unstated',
-            index: 'unstated',
-        };
-    }
-    const res = await ctx.fetch(`${ctx.url}/.well-known/tdmrep.json`);
-    if (!res.ok)
-        return null;
-    try {
-        const data = JSON.parse(res.body);
-        if (!Array.isArray(data) || data.length === 0)
-            return null;
-        // The entry covering the site root governs the audited page.
-        const root = data.find((e) => e?.location === '/' || e?.location === '') ?? data[0];
-        const reserved = Number(root?.['tdm-reservation']);
-        if (reserved !== 0 && reserved !== 1)
-            return null;
-        return {
-            source: '/.well-known/tdmrep.json',
-            enforceable: false,
-            train: reserved === 1 ? 'deny' : 'allow',
-            ground: 'unstated',
-            index: 'unstated',
-        };
-    }
-    catch {
-        return null;
-    }
-}
-export default async function check(ctx) {
-    const start = performance.now();
-    const findings = [];
-    let score = 100;
-    const { declarations, notes } = await collect(ctx);
-    findings.push(...notes);
-    if (declarations.length === 0) {
-        findings.push({
-            status: 'warn',
-            message: 'No machine-readable usage policy declared',
-            detail: 'Checked robots.txt Content-Signal and Content-Usage, the Content-Usage and content-signal response headers, ' +
-                'an RSL licence, TDMRep, and the noai meta directive.',
-            hint: 'State your terms where they can be read without a lawyer. The lowest-effort option is a Content-Signal line ' +
-                'in robots.txt: Content-Signal: search=yes, ai-input=yes, ai-train=no. Absence is neutral, not permission — ' +
-                'but it also gives you nothing to point at.',
-            learnMoreUrl: guideUrl(meta.id, 'no-policy'),
-        });
-        return buildResult(meta, 40, findings, start);
-    }
-    findings.push({
-        status: 'pass',
-        message: `${declarations.length} usage declaration(s) found`,
-        detail: declarations.map((d) => d.source).join('\n'),
-    });
-    score = reportConsistency(declarations, findings, score);
-    reportCoverage(declarations, findings);
-    findings.push({
-        status: 'pass',
-        message: 'Enforcement note: only robots.txt access rules are documented as honored by major AI operators',
-        detail: 'Content Signals, AIPREF, RSL and TDMRep are declarations. Their weight is legal — the EU AI Act opt-out ' +
-            'provisions and the GPAI Code of Practice reference several of them — rather than technical. Pair any of them ' +
-            'with robots.txt rules if the intent is to be enforced.',
-    });
-    return buildResult(meta, score, findings, start);
-}
-/**
- * Report where two declarations answer the same question differently. This is
- * the finding this check exists for: contradictory published positions mean the
- * terms a crawler honors depend on which file it happened to read.
- */
-function reportConsistency(declarations, findings, score) {
-    let conflicts = 0;
-    for (const dimension of ['train', 'ground', 'index']) {
-        const allow = declarations.filter((d) => d[dimension] === 'allow');
-        const deny = declarations.filter((d) => d[dimension] === 'deny');
-        if (allow.length > 0 && deny.length > 0) {
-            conflicts++;
-            findings.push({
-                status: 'fail',
-                message: `Your signals disagree about ${DIMENSION_LABEL[dimension]}`,
-                detail: [
-                    `Permitted by: ${allow.map((d) => d.source).join('; ')}`,
-                    `Denied by: ${deny.map((d) => d.source).join('; ')}`,
-                ].join('\n'),
-                hint: 'Two of your published documents state opposite terms, so which one applies depends on which file a crawler ' +
-                    'reads. Pick the position you mean and make every mechanism say it.',
-                learnMoreUrl: guideUrl(meta.id, 'contradiction'),
-            });
-            continue;
-        }
-        if (allow.length + deny.length > 0) {
-            const stance = allow.length > 0 ? 'permitted' : 'denied';
-            findings.push({
-                status: 'pass',
-                message: `Consistent across ${allow.length + deny.length} declaration(s): ${DIMENSION_LABEL[dimension]} is ${stance}`,
-            });
-        }
-    }
-    return score - conflicts * 25;
-}
-/** Note the dimensions no declaration answers, and the vocabularies that cannot answer them. */
-function reportCoverage(declarations, findings) {
-    const unstated = ['train', 'ground', 'index'].filter((d) => declarations.every((decl) => decl[d] === 'unstated'));
-    if (unstated.length === 0)
-        return;
-    findings.push({
-        status: 'warn',
-        message: `No declaration covers ${unstated.map((d) => DIMENSION_LABEL[d]).join(' or ')}`,
-        detail: unstated.includes('ground') && declarations.every((d) => !d.source.includes('Content-Signal'))
-            ? 'Grounding is the dimension that decides whether an assistant may quote you in an answer. AIPREF has no category for it yet; Content Signals ai-input and RSL ai-input do.'
-            : undefined,
-        hint: 'An unstated dimension is "unknown", never "allowed". State it explicitly if you have a position on it.',
-        learnMoreUrl: guideUrl(meta.id, 'coverage'),
-    });
-}
-//# sourceMappingURL=usage-policy.js.map

package/dist/checks/usage-policy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"usage-policy.js","sourceRoot":"","sources":["../../src/checks/usage-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEtH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,MAAM,IAAI,GAAc;IAC7B,EAAE,EAAE,cAAc;IAClB,IAAI,EAAE,cAAc;IACpB,WAAW,EAAE,gFAAgF;IAC7F,QAAQ,EAAE,QAAQ;CACnB,CAAC;AAiBF,MAAM,eAAe,GAA8B;IACjD,KAAK,EAAE,0BAA0B;IACjC,MAAM,EAAE,qCAAqC;IAC7C,KAAK,EAAE,kCAAkC;CAC1C,CAAC;AAEF,SAAS,KAAK,CAAC,KAAyB;IACtC,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,OAAO,CAAC;IACrD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,MAAM,CAAC;IACnD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,iBAAiB,CAAC,GAAW,EAAE,MAAc;IAC3D,MAAM,KAAK,GAAG,IAAI,GAAG,CACnB,uBAAuB,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3C,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,CAAC,CAAC,EAAE,CAAC,CAAU,CAAC;IACzB,CAAC,CAAC,CACH,CAAC;IACF,OAAO;QACL,MAAM;QACN,WAAW,EAAE,KAAK;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACnC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACpC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,MAAc;IAC1D,MAAM,KAAK,GAAG,IAAI,GAAG,CACnB,sBAAsB,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC1C,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,CAAC,CAAC,EAAE,CAAC,CAAU,CAAC;IACzB,CAAC,CAAC,CACH,CAAC;IACF,OAAO;QACL,MAAM;QACN,WAAW,EAAE,KAAK;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACnC,MAAM,EAAE,UAAU;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;KAClC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,QAAgB,EAAE,MAAc;IACtD,MAAM,IAAI,GAAgB,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACnH,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAEtD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,0CAA0C,CAAC,EAAE,CAAC;QAC1E,MAAM,MAAM,GAAW,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;QAC3E,MAAM,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9D,IAAI,IAAI,KAAK,OAAO;YAAE,SAAS;QAE/B,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3E,QAAQ,KAAK,EAAE,CAAC;gBACd,KAAK,UAAU;oBACb,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC;oBACpB,MAAM;gBACR,KAAK,UAAU;oBACb,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;oBACrB,MAAM;gBACR,KAAK,UAAU,CAAC;gBAChB,KAAK,QAAQ;oBACX,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC;oBACpB,MAAM;gBACR,KAAK,QAAQ;oBACX,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC;oBACpB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;oBACrB,MAAM;gBACR,KAAK,KAAK;oBACR,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC;oBACpB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;oBACrB,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC;oBACpB,MAAM;gBACR;oBACE,MAAM;YACV,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wDAAwD;AACxD,KAAK,UAAU,OAAO,CAAC,GAAiB;IACtC,MAAM,YAAY,GAAkB,EAAE,CAAC;IACvC,MAAM,KAAK,GAAc,EAAE,CAAC;IAE5B,8DAA8D;IAC9D,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,GAAG,aAAa,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEpE,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1C,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;gBACvC,YAAY,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,0CAA0C,KAAK,GAAG,CAAC,CAAC,CAAC;YAChG,CAAC;YACD,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;gBACrC,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,yCAAyC,KAAK,GAAG,CAAC,CAAC,CAAC;YAC9F,CAAC;QACH,CAAC;IACH,CAAC;IAED,uFAAuF;IACvF,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;IAClC,IAAI,OAAO,CAAC,eAAe,CAAC,KAAK,SAAS,EAAE,CAAC;QAC3C,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,+BAA+B,CAAC,CAAC,CAAC;QAC/F,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CACxF,CAAC;QACF,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnB,KAAK,CAAC,IAAI,CAAC;gBACT,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,yEAAyE;gBAClF,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;gBACxC,IAAI,EAAE,2FAA2F;gBACjG,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,mBAAmB,CAAC;aACrD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,gBAAgB,CAAC,KAAK,SAAS,EAAE,CAAC;QAC5C,YAAY,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,gCAAgC,CAAC,CAAC,CAAC;IACpG,CAAC;IAED,qEAAqE;IACrE,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IACvF,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,GAAG,CAAC,EAAE,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,gBAAgB,UAAU,GAAG,CAAC,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED,oFAAoF;IACpF,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,GAAG,KAAK,IAAI;QAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEzC,wEAAwE;IACxE,MAAM,UAAU,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAClF,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAChC,YAAY,CAAC,IAAI,CAAC;YAChB,MAAM,EAAE,qCAAqC;YAC7C,WAAW,EAAE,KAAK;YAClB,KAAK,EAAE,MAAM;YACb,MAAM,EAAE,UAAU;YAClB,KAAK,EAAE,UAAU;SAClB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;AACjC,CAAC;AAED,2FAA2F;AAC3F,SAAS,cAAc,CAAC,GAAiB,EAAE,cAAwB;IACjE,MAAM,UAAU,GAAa,CAAC,GAAG,cAAc,CAAC,CAAC;IAEjD,KAAK,MAAM,KAAK,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QACjE,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzF,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAC7D,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACvC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,KAAK,IAAI;YAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,iHAAiH;AACjH,KAAK,UAAU,UAAU,CAAC,GAAiB;IACzC,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,iBAAiB,CAAC,CAAC;IACpE,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO;YACL,MAAM,EAAE,+BAA+B;YACvC,WAAW,EAAE,KAAK;YAClB,KAAK,EAAE,SAAS,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;YAClD,MAAM,EAAE,UAAU;YAClB,KAAK,EAAE,UAAU;SAClB,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,iBAAiB,CAAC,CAAC;IAChD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO;YACL,MAAM,EAAE,iCAAiC;YACzC,WAAW,EAAE,KAAK;YAClB,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;YAC/C,MAAM,EAAE,UAAU;YAClB,KAAK,EAAE,UAAU;SAClB,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,GAAG,0BAA0B,CAAC,CAAC;IAClE,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3D,6DAA6D;QAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,KAAK,GAAG,IAAI,CAAC,EAAE,QAAQ,KAAK,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;QACpF,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACnD,IAAI,QAAQ,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAClD,OAAO;YACL,MAAM,EAAE,0BAA0B;YAClC,WAAW,EAAE,KAAK;YAClB,KAAK,EAAE,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;YACxC,MAAM,EAAE,UAAU;YAClB,KAAK,EAAE,UAAU;SAClB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,KAAK,CAAC,GAAiB;IACnD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,KAAK,GAAG,GAAG,CAAC;IAEhB,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;IACnD,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;IAExB,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,2CAA2C;YACpD,MAAM,EACJ,8GAA8G;gBAC9G,sDAAsD;YACxD,IAAI,EACF,8GAA8G;gBAC9G,6GAA6G;gBAC7G,4CAA4C;YAC9C,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC;SAC7C,CAAC,CAAC;QACH,OAAO,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAChD,CAAC;IAED,QAAQ,CAAC,IAAI,CAAC;QACZ,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,GAAG,YAAY,CAAC,MAAM,6BAA6B;QAC5D,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;KACrD,CAAC,CAAC;IAEH,KAAK,GAAG,iBAAiB,CAAC,YAAY,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACzD,cAAc,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IAEvC,QAAQ,CAAC,IAAI,CAAC;QACZ,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,gGAAgG;QACzG,MAAM,EACJ,0GAA0G;YAC1G,+GAA+G;YAC/G,wDAAwD;KAC3D,CAAC,CAAC;IAEH,OAAO,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,YAA2B,EAAE,QAAmB,EAAE,KAAa;IACxF,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,KAAK,MAAM,SAAS,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAgB,EAAE,CAAC;QACpE,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC,CAAC;QAEjE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxC,SAAS,EAAE,CAAC;YACZ,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,+BAA+B,eAAe,CAAC,SAAS,CAAC,EAAE;gBACpE,MAAM,EAAE;oBACN,iBAAiB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;oBACxD,cAAc,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iBACrD,CAAC,IAAI,CAAC,IAAI,CAAC;gBACZ,IAAI,EACF,6GAA6G;oBAC7G,oEAAoE;gBACtE,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,eAAe,CAAC;aACjD,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;YACzD,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,qBAAqB,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,oBAAoB,eAAe,CAAC,SAAS,CAAC,OAAO,MAAM,EAAE;aACtH,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,KAAK,GAAG,SAAS,GAAG,EAAE,CAAC;AAChC,CAAC;AAED,gGAAgG;AAChG,SAAS,cAAc,CAAC,YAA2B,EAAE,QAAmB;IACtE,MAAM,QAAQ,GAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAC1E,YAAY,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,CACrD,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAElC,QAAQ,CAAC,IAAI,CAAC;QACZ,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,yBAAyB,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;QACxF,MAAM,EACJ,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;YAC5F,CAAC,CAAC,2KAA2K;YAC7K,CAAC,CAAC,SAAS;QACf,IAAI,EAAE,wGAAwG;QAC9G,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC;KAC5C,CAAC,CAAC;AACL,CAAC"}

package/dist/checks/utils.d.ts

@@ -1,40 +0,0 @@
-import type { CheckMeta, CheckResult, FetchResponse, Finding } from '../types.js';
-export declare function clampScore(score: number): number;
-export declare function buildResult(meta: CheckMeta, score: number, findings: Finding[], start: number, options?: {
-    applicable?: boolean;
-}): CheckResult;
-/**
- * Result for a check whose subject the site does not have: no API to describe,
- * no commerce surface, no MCP server. Reported as N/A and excluded from the
- * score rather than counted as a failure.
- */
-export declare function notApplicable(meta: CheckMeta, findings: Finding[], start: number): CheckResult;
-/**
- * Whether a response body is a web page rather than the machine-readable
- * document that was asked for.
- *
- * Single-page applications answer every unmatched path with their index shell,
- * status 200. Probing `/.well-known/agent-card.json` or `/mcp/server-card` on
- * such a site returns HTML, and a check that trusts the status code reports a
- * *malformed* document where the honest answer is that the document is absent.
- * That mistake is worse than a miss: it sends an operator hunting for a bug in
- * a file they never wrote.
- *
- * Detection is deliberately narrow — a doctype or an `<html>` tag near the top
- * of the body. Anything else is handed to the real parser, which reports its own
- * problems precisely.
- */
-export declare function isHtmlDocument(body: string): boolean;
-/**
- * Validate the `Content-Type` of a fetched resource against a list of acceptable MIME types.
- *
- * Returns:
- * - `null` when the content type is acceptable (no finding to add)
- * - a `Finding` describing the mismatch otherwise (caller decides whether to apply a score penalty)
- */
-export declare function checkContentType(res: FetchResponse, expected: string[], context: {
-    checkId: string;
-    resourceLabel: string;
-    anchor: string;
-}): Finding | null;
-//# sourceMappingURL=utils.d.ts.map

package/dist/checks/utils.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/checks/utils.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAElF,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,wBAAgB,WAAW,CACzB,IAAI,EAAE,SAAS,EACf,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,OAAO,EAAE,EACnB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;IAAE,UAAU,CAAC,EAAE,OAAO,CAAA;CAAO,GACrC,WAAW,CAab;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,WAAW,CAE9F;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGpD;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,aAAa,EAClB,QAAQ,EAAE,MAAM,EAAE,EAClB,OAAO,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAClE,OAAO,GAAG,IAAI,CAkBhB"}

package/dist/checks/utils.js

@@ -1,74 +0,0 @@
-import { CHECK_CATEGORIES } from '../constants.js';
-import { guideUrl } from '../guide-urls.js';
-export function clampScore(score) {
-    return Math.max(0, Math.min(100, score));
-}
-export function buildResult(meta, score, findings, start, options = {}) {
-    return {
-        id: meta.id,
-        name: meta.name,
-        description: meta.description,
-        score: clampScore(score),
-        findings,
-        duration: Math.round(performance.now() - start),
-        // Falls back to the central map so every result carries its category,
-        // including in JSON output where no reporter is there to resolve it.
-        ...((meta.category ?? CHECK_CATEGORIES[meta.id]) ? { category: meta.category ?? CHECK_CATEGORIES[meta.id] } : {}),
-        ...(options.applicable === false ? { applicable: false } : {}),
-    };
-}
-/**
- * Result for a check whose subject the site does not have: no API to describe,
- * no commerce surface, no MCP server. Reported as N/A and excluded from the
- * score rather than counted as a failure.
- */
-export function notApplicable(meta, findings, start) {
-    return buildResult(meta, 0, findings, start, { applicable: false });
-}
-/**
- * Whether a response body is a web page rather than the machine-readable
- * document that was asked for.
- *
- * Single-page applications answer every unmatched path with their index shell,
- * status 200. Probing `/.well-known/agent-card.json` or `/mcp/server-card` on
- * such a site returns HTML, and a check that trusts the status code reports a
- * *malformed* document where the honest answer is that the document is absent.
- * That mistake is worse than a miss: it sends an operator hunting for a bug in
- * a file they never wrote.
- *
- * Detection is deliberately narrow — a doctype or an `<html>` tag near the top
- * of the body. Anything else is handed to the real parser, which reports its own
- * problems precisely.
- */
-export function isHtmlDocument(body) {
-    const head = body.slice(0, 1024).trimStart();
-    return /^<!doctype\s+html/i.test(head) || /^<html[\s>]/i.test(head) || /<html[\s>]/i.test(head.slice(0, 512));
-}
-/**
- * Validate the `Content-Type` of a fetched resource against a list of acceptable MIME types.
- *
- * Returns:
- * - `null` when the content type is acceptable (no finding to add)
- * - a `Finding` describing the mismatch otherwise (caller decides whether to apply a score penalty)
- */
-export function checkContentType(res, expected, context) {
-    const ct = (res.headers['content-type'] ?? '').toLowerCase();
-    if (!ct) {
-        return {
-            status: 'warn',
-            message: `${context.resourceLabel} has no Content-Type header`,
-            hint: `Serve ${context.resourceLabel} with one of: ${expected.join(', ')}.`,
-            learnMoreUrl: guideUrl(context.checkId, context.anchor),
-        };
-    }
-    if (expected.some((mime) => ct.includes(mime)))
-        return null;
-    return {
-        status: 'warn',
-        message: `${context.resourceLabel} Content-Type is "${ct.split(';')[0]}"`,
-        detail: `Expected one of: ${expected.join(', ')}`,
-        hint: `Configure your server to serve ${context.resourceLabel} as ${expected[0]} so AI agents parse it correctly.`,
-        learnMoreUrl: guideUrl(context.checkId, context.anchor),
-    };
-}
-//# sourceMappingURL=utils.js.map

package/dist/checks/utils.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../src/checks/utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAG5C,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,IAAe,EACf,KAAa,EACb,QAAmB,EACnB,KAAa,EACb,UAAoC,EAAE;IAEtC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC;QACxB,QAAQ;QACR,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QAC/C,sEAAsE;QACtE,qEAAqE;QACrE,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjH,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,IAAe,EAAE,QAAmB,EAAE,KAAa;IAC/E,OAAO,WAAW,CAAC,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;IAC7C,OAAO,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;AAChH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAkB,EAClB,QAAkB,EAClB,OAAmE;IAEnE,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC7D,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,OAAO;YACL,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,OAAO,CAAC,aAAa,6BAA6B;YAC9D,IAAI,EAAE,SAAS,OAAO,CAAC,aAAa,iBAAiB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YAC3E,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC;SACxD,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,OAAO;QACL,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,GAAG,OAAO,CAAC,aAAa,qBAAqB,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG;QACzE,MAAM,EAAE,oBAAoB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACjD,IAAI,EAAE,kCAAkC,OAAO,CAAC,aAAa,OAAO,QAAQ,CAAC,CAAC,CAAC,mCAAmC;QAClH,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC;KACxD,CAAC;AACJ,CAAC"}

package/dist/checks/waf.d.ts

@@ -1,75 +0,0 @@
-/**
- * Classify what actually happened to a request, beyond `res.ok`.
- *
- * An audit that probes a site with a crawler user agent gets back a status code
- * and has to answer one question honestly: *does this site block AI crawlers?*
- * A bare 403 does not answer it. The same 403 can mean:
- *
- * - a deliberate AI-crawler block in the WAF (a real finding);
- * - a JavaScript challenge that any fetch-only client fails, real crawler
- *   included (a different, usually accidental, finding);
- * - anti-spoofing: the edge verifies crawlers by IP range or by Web Bot Auth
- *   signature, so it rejects *this* probe precisely because the probe is
- *   unsigned and comes from the wrong network, while admitting the genuine
- *   crawler (not a finding at all — the site is behaving correctly).
- *
- * Reporting all three as "blocks AI crawlers" would be wrong often enough to
- * make the check untrustworthy. So every classification carries the evidence
- * that produced it and an `inconclusive` flag for the cases an unauthenticated
- * probe genuinely cannot settle.
- *
- * Header signatures verified 2026-09-04:
- * - Cloudflare challenge: `cf-mitigated: challenge`, always `text/html`.
- *   https://developers.cloudflare.com/cloudflare-challenges/challenge-types/challenge-pages/detect-response/
- * - AWS WAF challenge: HTTP **202** with `x-amzn-waf-action: challenge`.
- *   https://docs.aws.amazon.com/waf/latest/developerguide/waf-captcha-and-challenge-actions.html
- * - Vercel challenge: `x-vercel-mitigated: challenge` plus `x-vercel-challenge-token`.
- * - Cloudflare pay-per-crawl: 402 with `crawler-price`.
- *   https://developers.cloudflare.com/ai-crawl-control/features/pay-per-crawl/
- * - AWS WAF / x402 monetization: 402 with `payment-signature` or an x402 body.
- * - Web Bot Auth required: 403 with `Accept-Signature`.
- *   https://datatracker.ietf.org/doc/html/draft-ietf-webbotauth-httpsig-protocol
- * - RSL Open Licensing Protocol: 401/402 with `WWW-Authenticate: License`.
- */
-import type { FetchResponse } from '../types.js';
-export type ResponseKind = 'ok'
-/** An interstitial that requires running JavaScript. Fetch-only clients never get past it. */
- | 'challenge'
-/** 402 with a crawler price attached: content is monetised, not blocked. */
- | 'paywall'
-/** 403 asking the client to re-request with an HTTP Message Signature. */
- | 'needs-signature'
-/** 401/402 pointing at a machine-readable licence (RSL Open Licensing Protocol). */
- | 'license-required' | 'rate-limited'
-/** A plain refusal with no negotiation offered. */
- | 'blocked' | 'not-found' | 'server-error' | 'network-error';
-export interface ResponseClass {
-    kind: ResponseKind;
-    /** Edge or WAF vendor implicated, when the response identifies one. */
-    vendor?: string;
-    /** One sentence describing the outcome, written for a report. */
-    label: string;
-    /** Header names, values or body markers that produced this classification. */
-    evidence: string[];
-    /**
-     * True when this response cannot settle whether the site blocks AI crawlers.
-     * A challenge and a signature demand both reject an unsigned probe from a
-     * non-vendor IP while potentially admitting the genuine crawler.
-     */
-    inconclusive: boolean;
-    /** Price string from a pay-per-crawl response, e.g. `USD 0.01`. */
-    price?: string;
-}
-/** Identify the CDN or edge from response headers, for context in findings. */
-export declare function detectEdgeVendor(headers: Record<string, string>): string | undefined;
-/**
- * Classify a fetch result. Pure and total: any response produces a
- * classification, and unknown shapes fall back to status-based buckets.
- */
-export declare function classifyResponse(res: FetchResponse): ResponseClass;
-/**
- * Standard caveat for classifications an unauthenticated probe cannot settle.
- * Appended to hints so a report never overstates what it observed.
- */
-export declare const INCONCLUSIVE_CAVEAT: string;
-//# sourceMappingURL=waf.d.ts.map

package/dist/checks/waf.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"waf.d.ts","sourceRoot":"","sources":["../../src/checks/waf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,MAAM,MAAM,YAAY,GACpB,IAAI;AACN,8FAA8F;GAC5F,WAAW;AACb,4EAA4E;GAC1E,SAAS;AACX,0EAA0E;GACxE,iBAAiB;AACnB,oFAAoF;GAClF,kBAAkB,GAClB,cAAc;AAChB,mDAAmD;GACjD,SAAS,GACT,WAAW,GACX,cAAc,GACd,eAAe,CAAC;AAEpB,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,YAAY,CAAC;IACnB,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,KAAK,EAAE,MAAM,CAAC;IACd,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB;;;;OAIG;IACH,YAAY,EAAE,OAAO,CAAC;IACtB,mEAAmE;IACnE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAmBD,+EAA+E;AAC/E,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,GAAG,SAAS,CAQpF;AAMD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,aAAa,GAAG,aAAa,CA6KlE;AAED;;;GAGG;AACH,eAAO,MAAM,mBAAmB,QAGM,CAAC"}