ax-audit 4.2.1 → 6.0.0

package/dist/checks/waf.js

@@ -1,203 +0,0 @@
-/** Body markers for challenge interstitials that do not set a header. */
-const CHALLENGE_BODY_MARKERS = [
-    { marker: /\/cdn-cgi\/challenge-platform\//i, vendor: 'Cloudflare' },
-    { marker: /<title>\s*Just a moment/i, vendor: 'Cloudflare' },
-    { marker: /Vercel Security Checkpoint/i, vendor: 'Vercel' },
-    { marker: /challenges\.cloudflare\.com\/turnstile/i, vendor: 'Cloudflare Turnstile' },
-    { marker: /www\.google\.com\/recaptcha\//i, vendor: 'reCAPTCHA' },
-    { marker: /\bhcaptcha\.com\/(1\/api\.js|captcha)/i, vendor: 'hCaptcha' },
-    { marker: /_Incapsula_Resource|Incapsula incident ID/i, vendor: 'Imperva' },
-    { marker: /Checking your browser before accessing/i, vendor: 'Cloudflare' },
-    { marker: /Please enable (JS|JavaScript) and disable any ad ?blocker/i, vendor: 'Cloudflare' },
-    { marker: /Request unsuccessful\. Incapsula/i, vendor: 'Imperva' },
-    { marker: /Pardon Our Interruption/i, vendor: 'Imperva' },
-    { marker: /PerimeterX|px-captcha/i, vendor: 'HUMAN (PerimeterX)' },
-    { marker: /Access Denied.*Reference #[0-9a-f.]+/is, vendor: 'Akamai' },
-];
-/** Identify the CDN or edge from response headers, for context in findings. */
-export function detectEdgeVendor(headers) {
-    if (headers['cf-ray'] !== undefined || /cloudflare/i.test(headers['server'] ?? ''))
-        return 'Cloudflare';
-    if (headers['x-vercel-id'] !== undefined || /vercel/i.test(headers['server'] ?? ''))
-        return 'Vercel';
-    if (headers['x-amzn-waf-action'] !== undefined || headers['x-amz-cf-id'] !== undefined)
-        return 'AWS';
-    if (headers['x-served-by']?.includes('cache-') || /varnish/i.test(headers['via'] ?? ''))
-        return 'Fastly';
-    if (headers['x-akamai-transformed'] !== undefined || /akamai/i.test(headers['server'] ?? ''))
-        return 'Akamai';
-    if (/netlify/i.test(headers['server'] ?? ''))
-        return 'Netlify';
-    return undefined;
-}
-function withVendor(base, vendor) {
-    return vendor === undefined ? base : `${base} (${vendor})`;
-}
-/**
- * Classify a fetch result. Pure and total: any response produces a
- * classification, and unknown shapes fall back to status-based buckets.
- */
-export function classifyResponse(res) {
-    const h = res.headers ?? {};
-    const edge = detectEdgeVendor(h);
-    const body = res.body ?? '';
-    if (res.status === 0) {
-        return {
-            kind: 'network-error',
-            label: res.error ? `Network error: ${res.error}` : 'Network error',
-            evidence: res.error ? [res.error] : [],
-            inconclusive: true,
-        };
-    }
-    /* ── Challenges: an interstitial, not a policy decision ───────────────── */
-    if ((h['cf-mitigated'] ?? '').toLowerCase() === 'challenge') {
-        return {
-            kind: 'challenge',
-            vendor: 'Cloudflare',
-            label: 'Cloudflare served a challenge page',
-            evidence: ['cf-mitigated: challenge'],
-            inconclusive: true,
-        };
-    }
-    if ((h['x-vercel-mitigated'] ?? '').toLowerCase() === 'challenge' || h['x-vercel-challenge-token'] !== undefined) {
-        return {
-            kind: 'challenge',
-            vendor: 'Vercel',
-            label: 'Vercel served a security checkpoint',
-            evidence: [
-                h['x-vercel-mitigated'] !== undefined ? `x-vercel-mitigated: ${h['x-vercel-mitigated']}` : '',
-                h['x-vercel-challenge-token'] !== undefined ? 'x-vercel-challenge-token present' : '',
-            ].filter(Boolean),
-            inconclusive: true,
-        };
-    }
-    if ((h['x-amzn-waf-action'] ?? '').toLowerCase() === 'challenge') {
-        return {
-            kind: 'challenge',
-            vendor: 'AWS WAF',
-            label: `AWS WAF served a challenge (HTTP ${res.status})`,
-            evidence: [`x-amzn-waf-action: challenge`, `status ${res.status}`],
-            inconclusive: true,
-        };
-    }
-    /* ── Payment and licensing: an offer, not a refusal ───────────────────── */
-    if (res.status === 402) {
-        const price = h['crawler-price'];
-        if (price !== undefined) {
-            return {
-                kind: 'paywall',
-                vendor: 'Cloudflare pay-per-crawl',
-                label: `Content is priced for crawlers at ${price}`,
-                evidence: [`crawler-price: ${price}`],
-                inconclusive: false,
-                price,
-            };
-        }
-        if (h['payment-signature'] !== undefined || /"(payTo|maxTimeoutSeconds|x402Version)"/.test(body)) {
-            return {
-                kind: 'paywall',
-                vendor: withVendor('x402', edge),
-                label: 'Content is monetised through an x402 payment challenge',
-                evidence: [h['payment-signature'] !== undefined ? 'payment-signature header' : 'x402 fields in body'],
-                inconclusive: false,
-            };
-        }
-        if (/^License\b/i.test(h['www-authenticate'] ?? '')) {
-            return {
-                kind: 'license-required',
-                vendor: 'RSL Open Licensing Protocol',
-                label: 'A licence is required before this content may be used',
-                evidence: [`www-authenticate: ${h['www-authenticate']}`],
-                inconclusive: false,
-            };
-        }
-        return {
-            kind: 'blocked',
-            vendor: edge,
-            label: withVendor('Refused with 402 but no payment mechanism advertised', edge),
-            evidence: ['status 402 with no crawler-price, x402 fields, or licence challenge'],
-            inconclusive: false,
-        };
-    }
-    if (res.status === 401 && /^License\b/i.test(h['www-authenticate'] ?? '')) {
-        return {
-            kind: 'license-required',
-            vendor: 'RSL Open Licensing Protocol',
-            label: 'A licence is required before this content may be used',
-            evidence: [`www-authenticate: ${h['www-authenticate']}`],
-            inconclusive: false,
-        };
-    }
-    /* ── Signature demands: the site wants a verifiable agent ─────────────── */
-    if ((res.status === 401 || res.status === 403) && h['accept-signature'] !== undefined) {
-        return {
-            kind: 'needs-signature',
-            vendor: withVendor('Web Bot Auth', edge),
-            label: 'The origin requires a signed request (Web Bot Auth)',
-            evidence: [`accept-signature: ${h['accept-signature']}`],
-            inconclusive: true,
-        };
-    }
-    if (res.status === 429) {
-        return {
-            kind: 'rate-limited',
-            vendor: edge,
-            label: h['retry-after'] !== undefined ? `Rate limited, retry after ${h['retry-after']}` : 'Rate limited',
-            evidence: h['retry-after'] !== undefined ? [`retry-after: ${h['retry-after']}`] : ['status 429'],
-            inconclusive: true,
-        };
-    }
-    /* ── Body-marker challenges, on any status ────────────────────────────── */
-    const bodyChallenge = CHALLENGE_BODY_MARKERS.find((m) => m.marker.test(body));
-    if (bodyChallenge !== undefined) {
-        return {
-            kind: 'challenge',
-            vendor: bodyChallenge.vendor,
-            label: `${bodyChallenge.vendor} interstitial served instead of the page`,
-            evidence: [`body matched ${bodyChallenge.vendor} challenge markup`, `status ${res.status}`],
-            inconclusive: true,
-        };
-    }
-    if (res.status === 401 || res.status === 403) {
-        return {
-            kind: 'blocked',
-            vendor: edge,
-            label: withVendor(`Refused with HTTP ${res.status}`, edge),
-            evidence: [`status ${res.status}`],
-            // An edge that verifies bots by IP range or signature rejects an unsigned
-            // probe on principle, so a bare 403 from a known bot-managing CDN cannot
-            // prove a policy block.
-            inconclusive: edge !== undefined,
-        };
-    }
-    if (res.status === 404 || res.status === 410) {
-        return { kind: 'not-found', vendor: edge, label: `HTTP ${res.status}`, evidence: [], inconclusive: false };
-    }
-    if (res.status >= 500) {
-        return {
-            kind: 'server-error',
-            vendor: edge,
-            label: `Server error (HTTP ${res.status})`,
-            evidence: [`status ${res.status}`],
-            inconclusive: true,
-        };
-    }
-    if (res.ok) {
-        return { kind: 'ok', vendor: edge, label: `HTTP ${res.status}`, evidence: [], inconclusive: false };
-    }
-    return {
-        kind: 'blocked',
-        vendor: edge,
-        label: `Unexpected HTTP ${res.status}`,
-        evidence: [`status ${res.status}`],
-        inconclusive: true,
-    };
-}
-/**
- * Standard caveat for classifications an unauthenticated probe cannot settle.
- * Appended to hints so a report never overstates what it observed.
- */
-export const INCONCLUSIVE_CAVEAT = 'ax-audit sends this user agent from its own network without a Web Bot Auth signature, so an edge that verifies ' +
-    'crawlers by IP range or signature will reject the probe while admitting the real crawler. Confirm against your ' +
-    'WAF logs before changing any rule.';
-//# sourceMappingURL=waf.js.map

package/dist/checks/waf.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"waf.js","sourceRoot":"","sources":["../../src/checks/waf.ts"],"names":[],"mappings":"AAsEA,yEAAyE;AACzE,MAAM,sBAAsB,GAAyC;IACnE,EAAE,MAAM,EAAE,kCAAkC,EAAE,MAAM,EAAE,YAAY,EAAE;IACpE,EAAE,MAAM,EAAE,0BAA0B,EAAE,MAAM,EAAE,YAAY,EAAE;IAC5D,EAAE,MAAM,EAAE,6BAA6B,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC3D,EAAE,MAAM,EAAE,yCAAyC,EAAE,MAAM,EAAE,sBAAsB,EAAE;IACrF,EAAE,MAAM,EAAE,gCAAgC,EAAE,MAAM,EAAE,WAAW,EAAE;IACjE,EAAE,MAAM,EAAE,wCAAwC,EAAE,MAAM,EAAE,UAAU,EAAE;IACxE,EAAE,MAAM,EAAE,4CAA4C,EAAE,MAAM,EAAE,SAAS,EAAE;IAC3E,EAAE,MAAM,EAAE,yCAAyC,EAAE,MAAM,EAAE,YAAY,EAAE;IAC3E,EAAE,MAAM,EAAE,4DAA4D,EAAE,MAAM,EAAE,YAAY,EAAE;IAC9F,EAAE,MAAM,EAAE,mCAAmC,EAAE,MAAM,EAAE,SAAS,EAAE;IAClE,EAAE,MAAM,EAAE,0BAA0B,EAAE,MAAM,EAAE,SAAS,EAAE;IACzD,EAAE,MAAM,EAAE,wBAAwB,EAAE,MAAM,EAAE,oBAAoB,EAAE;IAClE,EAAE,MAAM,EAAE,wCAAwC,EAAE,MAAM,EAAE,QAAQ,EAAE;CACvE,CAAC;AAEF,+EAA+E;AAC/E,MAAM,UAAU,gBAAgB,CAAC,OAA+B;IAC9D,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,SAAS,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO,YAAY,CAAC;IACxG,IAAI,OAAO,CAAC,aAAa,CAAC,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO,QAAQ,CAAC;IACrG,IAAI,OAAO,CAAC,mBAAmB,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,aAAa,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACrG,IAAI,OAAO,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO,QAAQ,CAAC;IACzG,IAAI,OAAO,CAAC,sBAAsB,CAAC,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC9G,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,MAA0B;IAC1D,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,MAAM,GAAG,CAAC;AAC7D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAkB;IACjD,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IAE5B,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO;YACL,IAAI,EAAE,eAAe;YACrB,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,kBAAkB,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,eAAe;YAClE,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE;YACtC,YAAY,EAAE,IAAI;SACnB,CAAC;IACJ,CAAC;IAED,6EAA6E;IAE7E,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,WAAW,EAAE,CAAC;QAC5D,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,YAAY;YACpB,KAAK,EAAE,oCAAoC;YAC3C,QAAQ,EAAE,CAAC,yBAAyB,CAAC;YACrC,YAAY,EAAE,IAAI;SACnB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,WAAW,IAAI,CAAC,CAAC,0BAA0B,CAAC,KAAK,SAAS,EAAE,CAAC;QACjH,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,qCAAqC;YAC5C,QAAQ,EAAE;gBACR,CAAC,CAAC,oBAAoB,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;gBAC7F,CAAC,CAAC,0BAA0B,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC,EAAE;aACtF,CAAC,MAAM,CAAC,OAAO,CAAC;YACjB,YAAY,EAAE,IAAI;SACnB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,WAAW,EAAE,CAAC;QACjE,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,SAAS;YACjB,KAAK,EAAE,oCAAoC,GAAG,CAAC,MAAM,GAAG;YACxD,QAAQ,EAAE,CAAC,8BAA8B,EAAE,UAAU,GAAG,CAAC,MAAM,EAAE,CAAC;YAClE,YAAY,EAAE,IAAI;SACnB,CAAC;IACJ,CAAC;IAED,6EAA6E;IAE7E,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,CAAC,CAAC,eAAe,CAAC,CAAC;QACjC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,0BAA0B;gBAClC,KAAK,EAAE,qCAAqC,KAAK,EAAE;gBACnD,QAAQ,EAAE,CAAC,kBAAkB,KAAK,EAAE,CAAC;gBACrC,YAAY,EAAE,KAAK;gBACnB,KAAK;aACN,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,CAAC,mBAAmB,CAAC,KAAK,SAAS,IAAI,yCAAyC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACjG,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC;gBAChC,KAAK,EAAE,wDAAwD;gBAC/D,QAAQ,EAAE,CAAC,CAAC,CAAC,mBAAmB,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,qBAAqB,CAAC;gBACrG,YAAY,EAAE,KAAK;aACpB,CAAC;QACJ,CAAC;QACD,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACpD,OAAO;gBACL,IAAI,EAAE,kBAAkB;gBACxB,MAAM,EAAE,6BAA6B;gBACrC,KAAK,EAAE,uDAAuD;gBAC9D,QAAQ,EAAE,CAAC,qBAAqB,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBACxD,YAAY,EAAE,KAAK;aACpB,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,UAAU,CAAC,sDAAsD,EAAE,IAAI,CAAC;YAC/E,QAAQ,EAAE,CAAC,qEAAqE,CAAC;YACjF,YAAY,EAAE,KAAK;SACpB,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAC1E,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,MAAM,EAAE,6BAA6B;YACrC,KAAK,EAAE,uDAAuD;YAC9D,QAAQ,EAAE,CAAC,qBAAqB,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACxD,YAAY,EAAE,KAAK;SACpB,CAAC;IACJ,CAAC;IAED,6EAA6E;IAE7E,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,kBAAkB,CAAC,KAAK,SAAS,EAAE,CAAC;QACtF,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC;YACxC,KAAK,EAAE,qDAAqD;YAC5D,QAAQ,EAAE,CAAC,qBAAqB,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACxD,YAAY,EAAE,IAAI;SACnB,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO;YACL,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,CAAC,CAAC,aAAa,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc;YACxG,QAAQ,EAAE,CAAC,CAAC,aAAa,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;YAChG,YAAY,EAAE,IAAI;SACnB,CAAC;IACJ,CAAC;IAED,6EAA6E;IAE7E,MAAM,aAAa,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9E,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,aAAa,CAAC,MAAM;YAC5B,KAAK,EAAE,GAAG,aAAa,CAAC,MAAM,0CAA0C;YACxE,QAAQ,EAAE,CAAC,gBAAgB,aAAa,CAAC,MAAM,mBAAmB,EAAE,UAAU,GAAG,CAAC,MAAM,EAAE,CAAC;YAC3F,YAAY,EAAE,IAAI;SACnB,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC7C,OAAO;YACL,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,UAAU,CAAC,qBAAqB,GAAG,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC;YAC1D,QAAQ,EAAE,CAAC,UAAU,GAAG,CAAC,MAAM,EAAE,CAAC;YAClC,0EAA0E;YAC1E,yEAAyE;YACzE,wBAAwB;YACxB,YAAY,EAAE,IAAI,KAAK,SAAS;SACjC,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC7C,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;IAC7G,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QACtB,OAAO;YACL,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,sBAAsB,GAAG,CAAC,MAAM,GAAG;YAC1C,QAAQ,EAAE,CAAC,UAAU,GAAG,CAAC,MAAM,EAAE,CAAC;YAClC,YAAY,EAAE,IAAI;SACnB,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;QACX,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;IACtG,CAAC;IAED,OAAO;QACL,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,mBAAmB,GAAG,CAAC,MAAM,EAAE;QACtC,QAAQ,EAAE,CAAC,UAAU,GAAG,CAAC,MAAM,EAAE,CAAC;QAClC,YAAY,EAAE,IAAI;KACnB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAC9B,iHAAiH;IACjH,iHAAiH;IACjH,oCAAoC,CAAC"}

package/dist/checks/webmcp.d.ts

@@ -1,55 +0,0 @@
-import type { CheckContext, CheckResult, CheckMeta } from '../types.js';
-/**
- * "webmcp" — can a browser agent invoke this page's forms as tools?
- *
- * Today an agent that wants to use a form has to look at pixels, guess which
- * field is which, type into them, and hope. WebMCP lets a page declare a form as
- * a callable tool with named parameters, so the agent calls it instead of
- * driving it. The declarative form is two attributes:
- *
- * ```html
- * <form toolname="searchDocs" tooldescription="Search the documentation">
- *   <input name="q" toolparamdescription="The search query">
- * </form>
- * ```
- *
- * Status, verified 2026-09-04: a W3C Web Machine Learning Community Group draft
- * with a Chrome origin trial running from Chrome 149. Not a standard, not
- * shipped by default, not implemented in Firefox or Safari. Adoption is
- * effectively zero.
- *
- * So this check never asks for WebMCP and never scores a site down for lacking
- * it. It reports N/A on a page with no forms and no WebMCP code at all. What it
- * does do, on pages that have adopted it, is catch the mistakes a static
- * analysis can catch with certainty: a `toolname` with no `tooldescription`,
- * which is the exact condition Lighthouse's `webmcp-schema-validity` audit
- * fails, parameters with no description, and use of the `navigator.modelContext`
- * namespace that Chrome deprecated in favour of `document.modelContext`.
- */
-export declare const meta: CheckMeta;
-export interface FormAnalysis {
-    total: number;
-    annotated: number;
-    /** Forms declaring a name but no description — invalid, and Lighthouse fails them. */
-    missingDescription: string[];
-    /** Forms declaring a description but no name: nothing for an agent to call. */
-    missingName: number;
-    /** Tool names that are not usable identifiers. */
-    invalidNames: string[];
-    /** Annotated forms whose named controls lack `toolparamdescription`. */
-    undescribedParams: {
-        tool: string;
-        missing: number;
-        total: number;
-    }[];
-    autoSubmit: string[];
-}
-/** Analyse declarative WebMCP annotations across every form on the page. */
-export declare function analyseForms(html: string): FormAnalysis;
-/** Detect imperative WebMCP registration in inline scripts. */
-export declare function detectImperative(html: string): {
-    registers: boolean;
-    deprecatedNamespace: boolean;
-};
-export default function check(ctx: CheckContext): Promise<CheckResult>;
-//# sourceMappingURL=webmcp.d.ts.map

package/dist/checks/webmcp.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"webmcp.d.ts","sourceRoot":"","sources":["../../src/checks/webmcp.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,EAAW,MAAM,aAAa,CAAC;AAIjF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,IAAI,EAAE,SAKlB,CAAC;AAWF,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,sFAAsF;IACtF,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAC;IACpB,kDAAkD;IAClD,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,wEAAwE;IACxE,iBAAiB,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACtE,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAWD,4EAA4E;AAC5E,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CAiDvD;AAED,+DAA+D;AAC/D,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,mBAAmB,EAAE,OAAO,CAAA;CAAE,CAMnG;AAED,wBAA8B,KAAK,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAmH3E"}

package/dist/checks/webmcp.js

@@ -1,209 +0,0 @@
-import { guideUrl } from '../guide-urls.js';
-import { buildResult, notApplicable } from './utils.js';
-import { getAttribute } from './html-utils.js';
-/**
- * "webmcp" — can a browser agent invoke this page's forms as tools?
- *
- * Today an agent that wants to use a form has to look at pixels, guess which
- * field is which, type into them, and hope. WebMCP lets a page declare a form as
- * a callable tool with named parameters, so the agent calls it instead of
- * driving it. The declarative form is two attributes:
- *
- * ```html
- * <form toolname="searchDocs" tooldescription="Search the documentation">
- *   <input name="q" toolparamdescription="The search query">
- * </form>
- * ```
- *
- * Status, verified 2026-09-04: a W3C Web Machine Learning Community Group draft
- * with a Chrome origin trial running from Chrome 149. Not a standard, not
- * shipped by default, not implemented in Firefox or Safari. Adoption is
- * effectively zero.
- *
- * So this check never asks for WebMCP and never scores a site down for lacking
- * it. It reports N/A on a page with no forms and no WebMCP code at all. What it
- * does do, on pages that have adopted it, is catch the mistakes a static
- * analysis can catch with certainty: a `toolname` with no `tooldescription`,
- * which is the exact condition Lighthouse's `webmcp-schema-validity` audit
- * fails, parameters with no description, and use of the `navigator.modelContext`
- * namespace that Chrome deprecated in favour of `document.modelContext`.
- */
-export const meta = {
-    id: 'webmcp',
-    name: 'WebMCP',
-    description: 'Checks declarative WebMCP tool annotations on forms',
-    category: 'protocols',
-};
-/** Tool names are identifiers an agent calls, so they follow identifier rules. */
-const TOOL_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/;
-/** Form controls that carry a value an agent would need described. */
-const CONTROL_RE = /<(input|select|textarea)\b([^>]*)>/gi;
-/** Input types that carry no user-supplied value worth describing. */
-const VALUELESS_TYPES = new Set(['hidden', 'submit', 'button', 'reset', 'image']);
-/** Split the document into `<form>` blocks, keeping each element's attributes and inner HTML. */
-function forms(html) {
-    const out = [];
-    for (const m of html.matchAll(/<form\b([^>]*)>([\s\S]*?)<\/form>/gi)) {
-        out.push({ attrs: m[1], inner: m[2] });
-    }
-    return out;
-}
-/** Analyse declarative WebMCP annotations across every form on the page. */
-export function analyseForms(html) {
-    const analysis = {
-        total: 0,
-        annotated: 0,
-        missingDescription: [],
-        missingName: 0,
-        invalidNames: [],
-        undescribedParams: [],
-        autoSubmit: [],
-    };
-    for (const form of forms(html)) {
-        analysis.total++;
-        const toolName = getAttribute(form.attrs, 'toolname');
-        const toolDescription = getAttribute(form.attrs, 'tooldescription');
-        if (toolName === null && toolDescription === null)
-            continue;
-        const label = toolName ?? '(unnamed)';
-        analysis.annotated++;
-        if (toolName === null || toolName.trim() === '') {
-            analysis.missingName++;
-        }
-        if (toolDescription === null || toolDescription.trim() === '') {
-            analysis.missingDescription.push(label);
-        }
-        if (toolName !== null && !TOOL_NAME_RE.test(toolName)) {
-            analysis.invalidNames.push(toolName);
-        }
-        if (/\btoolautosubmit\b/i.test(form.attrs)) {
-            analysis.autoSubmit.push(label);
-        }
-        let total = 0;
-        let missing = 0;
-        for (const control of form.inner.matchAll(CONTROL_RE)) {
-            const attrs = control[2];
-            const type = (getAttribute(attrs, 'type') ?? '').toLowerCase();
-            if (VALUELESS_TYPES.has(type))
-                continue;
-            if (getAttribute(attrs, 'name') === null)
-                continue;
-            total++;
-            if (getAttribute(attrs, 'toolparamdescription') === null)
-                missing++;
-        }
-        if (total > 0 && missing > 0) {
-            analysis.undescribedParams.push({ tool: label, missing, total });
-        }
-    }
-    return analysis;
-}
-/** Detect imperative WebMCP registration in inline scripts. */
-export function detectImperative(html) {
-    const scripts = [...html.matchAll(/<script\b[^>]*>([\s\S]*?)<\/script>/gi)].map((m) => m[1]).join('\n');
-    return {
-        registers: /\bmodelContext\s*\.\s*(registerTool|provideContext)\s*\(/.test(scripts),
-        deprecatedNamespace: /\bnavigator\s*\.\s*modelContext\b/.test(scripts),
-    };
-}
-export default async function check(ctx) {
-    const start = performance.now();
-    const findings = [];
-    let score = 100;
-    const html = ctx.html ?? '';
-    const analysis = analyseForms(html);
-    const imperative = detectImperative(html);
-    if (analysis.total === 0 && !imperative.registers && !imperative.deprecatedNamespace) {
-        findings.push({
-            status: 'pass',
-            message: 'No forms and no WebMCP code — nothing here for an agent to invoke as a tool',
-        });
-        return notApplicable(meta, findings, start);
-    }
-    if (imperative.registers) {
-        findings.push({
-            status: 'pass',
-            message: 'Imperative WebMCP registration detected in page scripts',
-            detail: 'A static audit cannot enumerate the registered tools or validate their schemas; that needs a browser.',
-        });
-    }
-    if (imperative.deprecatedNamespace) {
-        findings.push({
-            status: 'warn',
-            message: 'Page uses the deprecated navigator.modelContext namespace',
-            hint: 'Chrome moved the API to document.modelContext. Feature-detect both while the origin trial runs: const ctx = document.modelContext ?? navigator.modelContext.',
-            learnMoreUrl: guideUrl(meta.id, 'deprecated-namespace'),
-        });
-        score -= 10;
-    }
-    if (analysis.annotated === 0) {
-        findings.push({
-            status: 'warn',
-            message: `${analysis.total} form(s) on the page, none declared as agent tools`,
-            detail: 'WebMCP is a W3C Community Group draft in a Chrome origin trial. It is not a standard and adoption is minimal, ' +
-                'so this is a forward-looking note, not a defect.',
-            hint: 'A declared form is called by an agent rather than driven pixel by pixel. Add toolname and tooldescription to ' +
-                'the forms worth automating — search, filter, subscribe — and toolparamdescription to each field.',
-            learnMoreUrl: guideUrl(meta.id, 'no-annotations'),
-        });
-        return buildResult(meta, score, findings, start);
-    }
-    findings.push({
-        status: 'pass',
-        message: `${analysis.annotated}/${analysis.total} form(s) declared as agent tools`,
-    });
-    if (analysis.missingDescription.length > 0) {
-        findings.push({
-            status: 'fail',
-            message: `${analysis.missingDescription.length} tool form(s) declare a name but no description`,
-            detail: analysis.missingDescription.join(', '),
-            hint: 'The description is what an agent reads to decide whether to call the tool; a named tool without one is ' +
-                'unusable. Both attributes are required together.',
-            learnMoreUrl: guideUrl(meta.id, 'missing-description'),
-        });
-        score -= 30;
-    }
-    if (analysis.missingName > 0) {
-        findings.push({
-            status: 'fail',
-            message: `${analysis.missingName} form(s) declare a tool description but no tool name`,
-            hint: 'Without a toolname there is nothing for an agent to call. Both attributes are required together.',
-            learnMoreUrl: guideUrl(meta.id, 'missing-name'),
-        });
-        score -= 30;
-    }
-    if (analysis.invalidNames.length > 0) {
-        findings.push({
-            status: 'warn',
-            message: 'Tool name is not a usable identifier',
-            detail: analysis.invalidNames.join(', '),
-            hint: 'A tool name is called like a function. Use letters, digits and underscores, starting with a letter: searchDocs, subscribe_newsletter.',
-            learnMoreUrl: guideUrl(meta.id, 'invalid-name'),
-        });
-        score -= 10;
-    }
-    if (analysis.undescribedParams.length > 0) {
-        const totalMissing = analysis.undescribedParams.reduce((acc, p) => acc + p.missing, 0);
-        findings.push({
-            status: 'warn',
-            message: `${totalMissing} tool parameter(s) have no description`,
-            detail: analysis.undescribedParams.map((p) => `${p.tool}: ${p.missing}/${p.total} fields undescribed`).join('\n'),
-            hint: 'Add toolparamdescription to each named field. Without it an agent has to infer a field’s meaning from its ' +
-                'name, which is how a search box gets an email address in it.',
-            learnMoreUrl: guideUrl(meta.id, 'undescribed-params'),
-        });
-        score -= 15;
-    }
-    else {
-        findings.push({ status: 'pass', message: 'Every tool parameter carries a description' });
-    }
-    if (analysis.autoSubmit.length > 0) {
-        findings.push({
-            status: 'pass',
-            message: `${analysis.autoSubmit.length} tool form(s) declare toolautosubmit`,
-            detail: 'The agent submits without a further confirmation step. Appropriate for read-only actions such as search, not for anything that charges, sends or deletes.',
-        });
-    }
-    return buildResult(meta, score, findings, start);
-}
-//# sourceMappingURL=webmcp.js.map

package/dist/checks/webmcp.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"webmcp.js","sourceRoot":"","sources":["../../src/checks/webmcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,IAAI,GAAc;IAC7B,EAAE,EAAE,QAAQ;IACZ,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,qDAAqD;IAClE,QAAQ,EAAE,WAAW;CACtB,CAAC;AAEF,kFAAkF;AAClF,MAAM,YAAY,GAAG,gCAAgC,CAAC;AAEtD,sEAAsE;AACtE,MAAM,UAAU,GAAG,sCAAsC,CAAC;AAE1D,sEAAsE;AACtE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAgBlF,iGAAiG;AACjG,SAAS,KAAK,CAAC,IAAY;IACzB,MAAM,GAAG,GAAuC,EAAE,CAAC;IACnD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,qCAAqC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,QAAQ,GAAiB;QAC7B,KAAK,EAAE,CAAC;QACR,SAAS,EAAE,CAAC;QACZ,kBAAkB,EAAE,EAAE;QACtB,WAAW,EAAE,CAAC;QACd,YAAY,EAAE,EAAE;QAChB,iBAAiB,EAAE,EAAE;QACrB,UAAU,EAAE,EAAE;KACf,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,QAAQ,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QACtD,MAAM,eAAe,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QACpE,IAAI,QAAQ,KAAK,IAAI,IAAI,eAAe,KAAK,IAAI;YAAE,SAAS;QAE5D,MAAM,KAAK,GAAG,QAAQ,IAAI,WAAW,CAAC;QACtC,QAAQ,CAAC,SAAS,EAAE,CAAC;QAErB,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAChD,QAAQ,CAAC,WAAW,EAAE,CAAC;QACzB,CAAC;QACD,IAAI,eAAe,KAAK,IAAI,IAAI,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC9D,QAAQ,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtD,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;QAED,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACtD,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,IAAI,GAAG,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YAC/D,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS;YACxC,IAAI,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI;gBAAE,SAAS;YACnD,KAAK,EAAE,CAAC;YACR,IAAI,YAAY,CAAC,KAAK,EAAE,sBAAsB,CAAC,KAAK,IAAI;gBAAE,OAAO,EAAE,CAAC;QACtE,CAAC;QACD,IAAI,KAAK,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAC7B,QAAQ,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,uCAAuC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxG,OAAO;QACL,SAAS,EAAE,0DAA0D,CAAC,IAAI,CAAC,OAAO,CAAC;QACnF,mBAAmB,EAAE,mCAAmC,CAAC,IAAI,CAAC,OAAO,CAAC;KACvE,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,KAAK,CAAC,GAAiB;IACnD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,KAAK,GAAG,GAAG,CAAC;IAEhB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAE1C,IAAI,QAAQ,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,IAAI,CAAC,UAAU,CAAC,mBAAmB,EAAE,CAAC;QACrF,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,6EAA6E;SACvF,CAAC,CAAC;QACH,OAAO,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,yDAAyD;YAClE,MAAM,EAAE,uGAAuG;SAChH,CAAC,CAAC;IACL,CAAC;IAED,IAAI,UAAU,CAAC,mBAAmB,EAAE,CAAC;QACnC,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,2DAA2D;YACpE,IAAI,EAAE,8JAA8J;YACpK,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,sBAAsB,CAAC;SACxD,CAAC,CAAC;QACH,KAAK,IAAI,EAAE,CAAC;IACd,CAAC;IAED,IAAI,QAAQ,CAAC,SAAS,KAAK,CAAC,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,QAAQ,CAAC,KAAK,oDAAoD;YAC9E,MAAM,EACJ,gHAAgH;gBAChH,kDAAkD;YACpD,IAAI,EACF,+GAA+G;gBAC/G,kGAAkG;YACpG,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,gBAAgB,CAAC;SAClD,CAAC,CAAC;QACH,OAAO,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACnD,CAAC;IAED,QAAQ,CAAC,IAAI,CAAC;QACZ,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,GAAG,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,KAAK,kCAAkC;KACnF,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3C,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,QAAQ,CAAC,kBAAkB,CAAC,MAAM,iDAAiD;YAC/F,MAAM,EAAE,QAAQ,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;YAC9C,IAAI,EACF,yGAAyG;gBACzG,kDAAkD;YACpD,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,qBAAqB,CAAC;SACvD,CAAC,CAAC;QACH,KAAK,IAAI,EAAE,CAAC;IACd,CAAC;IAED,IAAI,QAAQ,CAAC,WAAW,GAAG,CAAC,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,QAAQ,CAAC,WAAW,sDAAsD;YACtF,IAAI,EAAE,kGAAkG;YACxG,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,cAAc,CAAC;SAChD,CAAC,CAAC;QACH,KAAK,IAAI,EAAE,CAAC;IACd,CAAC;IAED,IAAI,QAAQ,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,sCAAsC;YAC/C,MAAM,EAAE,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;YACxC,IAAI,EAAE,uIAAuI;YAC7I,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,cAAc,CAAC;SAChD,CAAC,CAAC;QACH,KAAK,IAAI,EAAE,CAAC;IACd,CAAC;IAED,IAAI,QAAQ,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,YAAY,GAAG,QAAQ,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACvF,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,YAAY,wCAAwC;YAChE,MAAM,EAAE,QAAQ,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,qBAAqB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YACjH,IAAI,EACF,4GAA4G;gBAC5G,8DAA8D;YAChE,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,oBAAoB,CAAC;SACtD,CAAC,CAAC;QACH,KAAK,IAAI,EAAE,CAAC;IACd,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC,CAAC;IAC3F,CAAC;IAED,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,QAAQ,CAAC,UAAU,CAAC,MAAM,sCAAsC;YAC5E,MAAM,EACJ,2JAA2J;SAC9J,CAAC,CAAC;IACL,CAAC;IAED,OAAO,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AACnD,CAAC"}

package/dist/checks/well-known.d.ts

@@ -1,38 +0,0 @@
-/**
- * Standing of every well-known URI and discovery convention ax-audit probes.
- *
- * The agent web is a mix of IETF-registered URIs, vendor conventions that are
- * widely deployed but unregistered, and drafts that may be renamed next month.
- * Reporting them all as equally authoritative would be misleading, so every
- * probe carries its standing and audiences can weigh a miss accordingly:
- *
- * - `registered` — in the IANA Well-Known URI registry (permanent or provisional).
- * - `convention` — no registration, but shipped by multiple independent vendors.
- * - `draft`      — an open spec PR, individual I-D, or origin-trial-era proposal.
- * - `legacy`     — superseded or abandoned; recognised so we can advise removal.
- *
- * Registry snapshot: https://www.iana.org/assignments/well-known-uris/well-known-uris.xhtml
- * (last verified 2026-09-04, registry last updated 2026-08-19).
- */
-export type Standing = 'registered' | 'convention' | 'draft' | 'legacy';
-export interface WellKnownEntry {
-    /** Path as probed, root-relative. */
-    path: string;
-    standing: Standing;
-    /** Short human label used in findings. */
-    label: string;
-    /** Authoritative reference for the path. */
-    specUrl: string;
-    /** Free-text note surfaced in `detail` when the standing is not `registered`. */
-    note?: string;
-}
-/**
- * Every path ax-audit knows about, keyed by path. Checks look up their probe
- * targets here so a rename in a draft spec is a one-line change in one file.
- */
-export declare const WELL_KNOWN: Record<string, WellKnownEntry>;
-/** Look up a path's standing, defaulting to `convention` for unknown paths. */
-export declare function standingOf(path: string): Standing;
-/** Human sentence describing a path's standing, for finding details. */
-export declare function standingNote(path: string): string | undefined;
-//# sourceMappingURL=well-known.d.ts.map

package/dist/checks/well-known.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"well-known.d.ts","sourceRoot":"","sources":["../../src/checks/well-known.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,QAAQ,GAAG,YAAY,GAAG,YAAY,GAAG,OAAO,GAAG,QAAQ,CAAC;AAExE,MAAM,WAAW,cAAc;IAC7B,qCAAqC;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,CAAC;IACnB,0CAA0C;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,4CAA4C;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;GAGG;AACH,eAAO,MAAM,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAqLrD,CAAC;AAEF,+EAA+E;AAC/E,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,CAEjD;AAED,wEAAwE;AACxE,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAY7D"}