ax-audit 4.2.1 → 6.0.0

package/docs/architecture.md

@@ -1,104 +1,15 @@
 # Architecture
 
-ax-audit is a dependency-light TypeScript codebase: two runtime dependencies (`chalk`, `commander`), Node 18+ built-in `fetch`, no HTTP libraries, no XML/HTML parser dependencies (regex-based primitives), and the built-in `node:test` runner.
+Version 6 separates the public client from the private audit service.
 
-## Pipeline
+- `src/orchestrator.ts` sends authenticated requests to the fixed AX Rush audit endpoint. It contains no checks, HTML parsers, target fetcher or offline fallback.
+- `src/license.ts` reads the account key and defines actionable client errors. Local validation is only for usability; the server owns authorization.
+- `src/metadata.ts` holds check descriptions and aliases, without executable `run` functions.
+- `src/reporter/`, `src/baseline.ts` and `src/scorer.ts` format, compare and summarize existing results locally.
+- The private AX Rush application owns check implementations, safe outbound HTTP, server-side API-key and billing checks, and shared abuse limits. Authorization runs for every audit.
 
-```
-cli.ts ──► orchestrator.ts ──► checks/* (Promise.allSettled, parallel)
-              │                     │
-              ▼                     ▼
-          fetcher.ts            scorer.ts ──► reporter/{terminal,json,html,markdown}
-        (cache + retries)                          │
-              ▲                                baseline.ts (save / load / diff)
-              └── shared by every check via CheckContext.fetch
-```
+Only URL, check selection, profile, request timeout and retry count are sent in the request body. The account key travels in the Authorization header only. There is no endpoint override or bypass flag. Private network targets are not supported.
 
-1. **cli.ts** parses and validates flags, loads the baseline if requested, and dispatches to single or batch mode.
-2. **orchestrator.ts** (`audit`) creates one fetcher per run, fetches the homepage once, builds the `CheckContext` (`url`, `html`, `headers`, `fetch`), and runs all selected checks in parallel. A check that throws is converted into a score-0 result with the error as a finding — one bad check never kills the audit. `batchAudit` runs `audit` per URL through an order-preserving work queue with configurable `concurrency`.
-3. **fetcher.ts** wraps `fetch` with: per-run in-memory caching keyed on URL + normalized (lowercased, sorted) custom headers — mirroring HTTP `Vary` semantics so a `text/markdown` probe never collides with the HTML fetch; case-insensitive header merging over defaults; timeouts via `AbortController`; and retries with exponential backoff for transient failures (status 0, 408, 425, 429, 5xx). Errors never throw — they become `{ status: 0, ok: false, error }` results, also cached.
-4. **checks/** — one module per check (26). Each exports `default` (async check function) and `meta` (`{ id, name, description, weight, category?, aliases? }`).
-5. **scorer.ts** computes the weighted average over the checks that ran *and apply*; a check reporting `applicable: false` is excluded from both numerator and denominator. When every applicable check has weight 0 it falls back to a plain average.
-6. **reporter/** renders to terminal (chalk), JSON, self-contained HTML, or Markdown, grouping checks by category and showing n/a where a check does not apply.
-7. **baseline.ts** persists minimal score snapshots and computes per-check diffs for regression gating.
+`npm test` checks the public API, report rendering, baselines and the remote transport, including denied access and unavailable service. Engine check tests live with the private server. `npm run prepublishOnly` builds from a clean `dist` and verifies the package allowlist so check implementations cannot accidentally ship.
 
-## Anatomy of a check
-
-```typescript
-import { guideUrl } from '../guide-urls.js';
-import type { CheckContext, CheckResult, CheckMeta, Finding } from '../types.js';
-import { buildResult } from './utils.js';
-
-export const meta: CheckMeta = {
-  id: 'my-check',
-  name: 'My Check',
-  description: 'One-line description shown in reports',
-  category: 'discovery',
-  // No `weight` here: weights live in CHECK_WEIGHTS, and only there.
-};
-
-export default async function check(ctx: CheckContext): Promise<CheckResult> {
-  const start = performance.now();
-  const findings: Finding[] = [];
-  let score = 100;
-
-  const res = await ctx.fetch(`${ctx.url}/something`, { headers: { Accept: 'application/json' } });
-  if (!res.ok) {
-    findings.push({
-      status: 'fail',
-      message: '/something not found',
-      hint: 'Actionable, copy-pasteable advice.',
-      learnMoreUrl: guideUrl(meta.id, 'not-found'),
-    });
-    return buildResult(meta, 0, findings, start);
-  }
-
-  // ... validations, each pushing a pass/warn/fail Finding and adjusting score
-
-  return buildResult(meta, score, findings, start);
-}
-```
-
-Conventions:
-
-- **Findings are actionable.** Every `warn`/`fail` carries a `hint` with concrete remediation and a `learnMoreUrl` pointing to `axrush.com/guides/<check-id>#<anchor>`. Every anchor must have a section in that guide.
-- **Scores are clamped** to [0, 100] by `buildResult`.
-- **Shared HTML primitives** live in `checks/html-utils.ts` (`getMetaContent`, `findLinkTags`, `getAttribute`, `extractVisibleText`, …) — no per-check regex duplication.
-- **robots.txt is parsed once**, by `checks/robots-parser.ts`. It returns User-agent groups with their rules plus `Content-Signal`, `Content-Usage`, `License`, `Sitemap` and `Agentmap` directives. `robots-txt`, `rsl` and `agent-access` all consume it, so the grouping rules have one definition.
-- **Responses are classified**, not just status-checked. `checks/waf.ts` turns a response into ok / challenge / paywall / needs-signature / license-required / rate-limited / blocked, with the evidence that produced it and an `inconclusive` flag for what an unsigned probe cannot settle.
-- **Probed paths carry their standing.** `checks/well-known.ts` records every path as IANA-registered, vendor convention, draft or legacy, so a missing draft file is never reported like a missing registered one.
-- **An HTML body means absent, not broken.** `isHtmlDocument` in `checks/utils.ts` gates speculative probes: an SPA catch-all returns its index shell for every unknown path, and reporting that as a malformed document sends operators hunting for a bug in a file they never wrote.
-- **A check that does not apply reports N/A**, via `notApplicable()`, rather than scoring 0. Commerce discovery on a blog, OAuth metadata where nothing needs authorizing, WebMCP on a page with no forms: scoring these zero would say something false about the site. Everything counted against a site must be something the site could have done.
-- **Check ids are a public interface** — they appear in `--checks` flags and in saved baselines. A rename declares the old id in `meta.aliases`; `src/check-ids.ts` resolves aliases for selection and for baseline diffing.
-- **Content-Type validation** uses `checkContentType` from `checks/utils.ts` (−5 convention for mismatches).
-- **Network goes through `ctx.fetch`** — never raw `fetch` — so caching, retries, timeouts, and `--verbose` logging apply uniformly.
-
-## Adding a new check
-
-1. Create `src/checks/your-check.ts` exporting `default` + `meta` (weight 0 — see scoring policy below).
-2. Register it in `src/checks/index.ts`.
-3. Add its weight to `CHECK_WEIGHTS` in `src/constants.ts`.
-4. Add a test suite in `test/checks/your-check.test.js` using `mockContext` / `mockResponse` from `test/helpers.js`. Route values can be functions `(url, fetchOptions) => response` when the response must vary by request headers.
-5. Document it in `docs/checks.md` and the README table.
-6. Write the remediation guide covering every `learnMoreUrl` anchor you emit.
-
-## Scoring policy
-
-Score deltas on the same site are treated as **breaking**. Within a major version:
-
-- New checks ship with **weight 0**: full findings, no effect on the overall score or baselines.
-- New findings inside weighted checks must be informational, with no deduction.
-- Weight redistribution happens in a major version, and the baseline schema version is bumped with it so an existing baseline is not read as a regression.
-
-Weights live in `CHECK_WEIGHTS` in `src/constants.ts`, and only there. Checks used to declare their own `meta.weight` alongside the map; the two drifted, and a redistribution silently did nothing. `CheckMeta.weight` remains as an override that nothing uses, and a test asserts no check declares one.
-
-Two check states exist beyond a score:
-
-- **Weight 0** means the check runs and reports but rests on something too unsettled to score: a draft specification that may be renamed.
-- **Not applicable** means the question does not arise for this site. It leaves the denominator entirely. `--profile` overrides the detection.
-
-## Testing
-
-`npm test` builds (`tsc`) and runs `node --test`. The suite (964 tests) covers every check, the scorer, baseline logic, the Markdown reporter, plus integration tests that spin up real local HTTP servers for the fetcher (per-header caching, retries, HEAD and manual redirects) and the batch orchestrator (ordering, concurrency caps). No test dependencies beyond Node.
-
-Two classes of test exist specifically to keep the 3.x promise that no score goes down: **score-stability tests** assert that a configuration which scored 100 in 3.6 still scores 100, and that findings added inside a weighted check leave the score untouched. When those fail, the change belongs in the next major, not the current minor.
+The server must be deployed and verified before publishing a client version that relies on it.

package/docs/ci.md

@@ -1,5 +1,20 @@
 # CI Integration
 
+For ax-audit 6, create a paid organization API key at
+https://axrush.com/account/api, save it as the `AXRUSH_API_KEY` repository secret,
+and expose it only to trusted audit jobs:
+
+```yaml
+env:
+  AXRUSH_API_KEY: ${{ secrets.AXRUSH_API_KEY }}
+```
+
+Fork pull requests do not receive secrets. Skip licensed audits for those runs;
+never use `pull_request_target` to execute untrusted checkout code with this key.
+The job needs outbound HTTPS to axrush.com; authorization and audit execution
+both happen on AX Rush. License errors fail the command instead of publishing a score.
+
+
 ax-audit's exit codes (see [cli.md](./cli.md)) make it a drop-in quality gate: `0` for Good/Excellent, `1` for Fair/Poor or regressions.
 
 ## GitHub Actions
@@ -87,3 +102,7 @@ jobs:
 ```
 
 `--fail-on-regression 0` makes any per-check drop fail the workflow — appropriate for scheduled runs where every change is unexpected.
+
+## Remote execution in v6
+
+Audit a public preview or deployed URL. Localhost and private CI network hosts are not reachable by AX Rush. The target URL and options are sent to AX Rush; no engine is downloaded. Each URL requires an active paid subscription and consumes the service rate limit.

package/docs/cli.md

@@ -1,5 +1,12 @@
 # CLI Reference
 
+Version 6 requires `AXRUSH_API_KEY`, generated at https://axrush.com/account/api
+by an owner/admin of an active paid organization. Set it through your environment
+or CI secret store. It is never a command-line flag, target header or report field.
+The server rejects missing/revoked keys and inactive subscriptions before
+contacting the target. Service failures never trigger a local audit. `--help` and `--version` work without a key.
+
+
 ```bash
 ax-audit <urls...> [options]
 ```
@@ -101,3 +108,7 @@ Each area is reported against its threshold on stderr, so the output survives `-
 ## Baselines across a scoring change
 
 Baselines record which scoring model produced them. Comparing a baseline written by an older version shows the deltas but suspends regression gating, because a rescore is not something the site did. Re-save with `--save-baseline` to resume gating. Checks that changed applicability are excluded from regressions and improvements for the same reason.
+
+## Version 6 service boundary
+
+The CLI sends the URL and options to AX Rush and renders the returned report. The engine is private to the server. Set `AXRUSH_API_KEY` using a key from an active paid account. Public HTTP(S) URLs only, ports 80/443, no URL credentials. `--timeout` is 100–10000 ms per server request, `--retries` is 0–2, and `--concurrency` is 1–4. Verbose output is client-side only; server network traces are not returned. Rate limits and API errors exit with code 2.

package/docs/faq.md

@@ -1,3 +1,21 @@
+# Version 6: remote service
+
+## Can I use the engine without a subscription?
+
+No. The npm package contains only a client. AX Rush authorizes each audit against an active paid subscription. Modifying the client cannot expose engine code that it does not contain.
+
+## Can I audit localhost or run offline?
+
+No. Audit a public preview or deployed site. AX Rush must be able to reach it.
+
+## What data leaves my machine?
+
+The target URL and selected audit options are sent to AX Rush. AX Rush fetches the pages and returns a report. The API key is sent only to AX Rush, never to the target site.
+
+## What about versions 1–5?
+
+They were distributed with local engine code. This release cannot disable downloaded copies or revoke previously granted license rights. They are legacy releases, not the current AX Rush service.
+
 # FAQ & Troubleshooting
 
 ## Scores & results

package/docs/getting-started.md

@@ -1,6 +1,38 @@
 # Getting Started
 
-This walkthrough takes you from zero to a passing AX score: run your first audit, learn to read the report, and fix findings in the order that moves your score most.
+## AX Rush service access (v6)
+
+Install with `npm install ax-audit`. Version 6 is a CLI and SDK for the private
+AX Rush service: **the npm package contains no audit engine or check implementations**.
+
+1. Subscribe at [AX Rush](https://axrush.com/pricing).
+2. Generate an organization key in [Account → API keys](https://axrush.com/account/api).
+3. Store it as `AXRUSH_API_KEY` in your environment or trusted CI secret store.
+4. Run `npx ax-audit@6 https://example.com`.
+
+`audit({ url, apiKey })` can pass a key explicitly. Never commit keys or put them
+in command-line arguments. The service checks the key and an active paid
+subscription for **each audit**; revoked keys, canceled subscriptions, past-due
+payments, trial-only and complimentary-only accounts cannot execute the engine.
+
+The client sends the target URL and audit options to
+`https://axrush.com/api/v1/engine/audit`, with the key in the Authorization header.
+AX Rush fetches the public pages and returns the report. The key is never sent
+to the target website. This endpoint does not save the report to your dashboard;
+use the authenticated site API for stored scan history.
+
+Only publicly reachable HTTP(S) sites on ports 80/443 are supported. Localhost,
+private networks, URL credentials and custom ports are rejected. CI should audit
+a public preview or deployed environment. Internet access to AX Rush is required;
+there is no offline mode or local fallback. Current abuse limits are 10 audits
+per organization per hour and 5 per target per hour, shared across keys and scan
+surfaces. A batch consumes one audit for each URL.
+
+Rendering an existing report, reading check descriptions and comparing saved
+baselines remain local. `checks` contains metadata only; `checks[i].run()` was
+removed. The CLI and client utilities remain Apache-2.0. Earlier releases and
+rights already granted under their licenses cannot be revoked by this release.
+
 
 ## 1. Run your first audit
 

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "ax-audit",
-  "version": "4.2.1",
-  "description": "Audit websites for AI Agent Experience (AX) readiness. Lighthouse for AI Agents.",
+  "version": "6.0.0",
+  "description": "CLI and SDK for the private AX Rush audit service. Requires an active paid subscription and API key.",
   "type": "module",
   "license": "Apache-2.0",
   "author": "Durani Technologies (https://axrush.com)",
   "repository": {
     "type": "git",
-    "url": "https://github.com/duranitech/ax-audit.git"
+    "url": "git+https://github.com/duranitech/ax-audit.git"
   },
   "homepage": "https://axrush.com",
   "bugs": {
@@ -36,7 +36,7 @@
     "typescript"
   ],
   "bin": {
-    "ax-audit": "./bin/ax-audit.js"
+    "ax-audit": "bin/ax-audit.js"
   },
   "exports": {
     ".": {
@@ -66,7 +66,7 @@
     "format": "prettier --write \"src/**/*.ts\"",
     "format:check": "prettier --check \"src/**/*.ts\"",
     "prepare": "husky",
-    "prepublishOnly": "npm run build"
+    "prepublishOnly": "npm run build && node scripts/verify-package.mjs"
   },
   "lint-staged": {
     "src/**/*.ts": [

package/dist/checks/agent-access.d.ts

@@ -1,33 +0,0 @@
-import type { CheckContext, CheckResult, CheckMeta } from '../types.js';
-/**
- * "agent-access" — the gap between what robots.txt permits and what the server
- * actually does.
- *
- * The failure this catches is invisible from the inside: robots.txt says
- * `Allow: /` for GPTBot, and the WAF returns 403 to anything whose user agent
- * says GPTBot. The operator sees a permissive robots.txt and assumes the site
- * is reachable. Cloudflare's "Block AI Crawlers" toggle produces exactly this,
- * and so does a hand-written rule that outlived its reason.
- *
- * The check probes the homepage once per core crawler and compares the result
- * against the default-user-agent baseline. Since 3.7 it classifies *how* a
- * request was turned away, because the remedies are completely different: a
- * JavaScript challenge needs a bot-management exception, a hard 403 needs a
- * firewall rule change, a 402 is a deliberate price, and a signature demand is
- * the site working as designed.
- *
- * Honesty constraint: this probe is unsigned and comes from the auditor's own
- * network. An edge that verifies crawlers by IP range or Web Bot Auth signature
- * will reject it while admitting the genuine crawler. Those outcomes are scored
- * as inconclusive and labelled as such, never as "blocks AI crawlers".
- */
-export declare const meta: CheckMeta;
-/**
- * Build a realistic crawler User-Agent for a given bot token. WAF and
- * bot-management rules match on the token substring, which is what we need
- * to trigger the same code path the real crawler would hit.
- */
-export declare function crawlerUserAgent(token: string): string;
-export { intentBlocked } from './robots-parser.js';
-export default function check(ctx: CheckContext): Promise<CheckResult>;
-//# sourceMappingURL=agent-access.d.ts.map

package/dist/checks/agent-access.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent-access.d.ts","sourceRoot":"","sources":["../../src/checks/agent-access.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,EAAW,MAAM,aAAa,CAAC;AAMjF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,IAAI,EAAE,SAKlB,CAAC;AA+BF;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEtD;AAGD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAoCnD,wBAA8B,KAAK,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CA8E3E"}

package/dist/checks/agent-access.js

@@ -1,256 +0,0 @@
-import { PROBEABLE_CORE_CRAWLERS, crawlerInfo } from '../constants.js';
-import { guideUrl } from '../guide-urls.js';
-import { buildResult } from './utils.js';
-import { extractVisibleText, findJsonLdBlocks } from './html-utils.js';
-import { parseUserAgents, intentBlocked } from './robots-parser.js';
-import { classifyResponse, INCONCLUSIVE_CAVEAT } from './waf.js';
-/**
- * "agent-access" — the gap between what robots.txt permits and what the server
- * actually does.
- *
- * The failure this catches is invisible from the inside: robots.txt says
- * `Allow: /` for GPTBot, and the WAF returns 403 to anything whose user agent
- * says GPTBot. The operator sees a permissive robots.txt and assumes the site
- * is reachable. Cloudflare's "Block AI Crawlers" toggle produces exactly this,
- * and so does a hand-written rule that outlived its reason.
- *
- * The check probes the homepage once per core crawler and compares the result
- * against the default-user-agent baseline. Since 3.7 it classifies *how* a
- * request was turned away, because the remedies are completely different: a
- * JavaScript challenge needs a bot-management exception, a hard 403 needs a
- * firewall rule change, a 402 is a deliberate price, and a signature demand is
- * the site working as designed.
- *
- * Honesty constraint: this probe is unsigned and comes from the auditor's own
- * network. An edge that verifies crawlers by IP range or Web Bot Auth signature
- * will reject it while admitting the genuine crawler. Those outcomes are scored
- * as inconclusive and labelled as such, never as "blocks AI crawlers".
- */
-export const meta = {
-    id: 'agent-access',
-    name: 'Agent Access',
-    description: 'Checks that AI crawler user-agents are not blocked or served reduced content (cloaking)',
-    category: 'access',
-};
-/** Content below this fraction of the baseline visible text counts as "reduced". */
-const REDUCED_CONTENT_RATIO = 0.5;
-/** Baselines with less visible text than this are too small for meaningful content comparison. */
-const MIN_BASELINE_TEXT = 200;
-/** Credit each outcome contributes to the access score. */
-const OUTCOME_CREDIT = {
-    ok: 1,
-    'blocked-consistent': 1,
-    conditional: 1,
-    inconclusive: 0.75,
-    reduced: 0.5,
-    blocked: 0,
-};
-/**
- * Build a realistic crawler User-Agent for a given bot token. WAF and
- * bot-management rules match on the token substring, which is what we need
- * to trigger the same code path the real crawler would hit.
- */
-export function crawlerUserAgent(token) {
-    return `Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ${token}/1.0)`;
-}
-// `intentBlocked` moved to robots-parser.ts in 3.7; re-exported for compatibility.
-export { intentBlocked } from './robots-parser.js';
-function shapeOf(html) {
-    const title = html.match(/<title\b[^>]*>([\s\S]*?)<\/title>/i);
-    const h1 = html.match(/<h1\b[^>]*>([\s\S]*?)<\/h1>/i);
-    return {
-        textLength: extractVisibleText(html).length,
-        title: title ? extractVisibleText(title[1]) : null,
-        h1: h1 ? extractVisibleText(h1[1]) : null,
-        jsonLdBlocks: findJsonLdBlocks(html).length,
-    };
-}
-/** Differences between a crawler's page and the baseline, in reader-facing terms. */
-function shapeDiff(baseline, actual) {
-    const diffs = [];
-    if (baseline.title !== null && actual.title !== baseline.title) {
-        diffs.push(`title differs ("${actual.title ?? 'none'}" vs "${baseline.title}")`);
-    }
-    if (baseline.h1 !== null && actual.h1 !== baseline.h1) {
-        diffs.push(`h1 differs ("${actual.h1 ?? 'none'}" vs "${baseline.h1}")`);
-    }
-    if (baseline.jsonLdBlocks > 0 && actual.jsonLdBlocks < baseline.jsonLdBlocks) {
-        diffs.push(`${baseline.jsonLdBlocks - actual.jsonLdBlocks} JSON-LD block(s) missing`);
-    }
-    return diffs;
-}
-export default async function check(ctx) {
-    const start = performance.now();
-    const findings = [];
-    const baseline = await ctx.fetch(ctx.url);
-    if (!baseline.ok) {
-        findings.push({
-            status: 'fail',
-            message: 'Baseline homepage request failed — cannot compare crawler access',
-            detail: `HTTP ${baseline.status || 'network error'}`,
-            learnMoreUrl: guideUrl(meta.id, 'baseline-unavailable'),
-        });
-        return buildResult(meta, 0, findings, start);
-    }
-    const baselineShape = shapeOf(baseline.body);
-    const baselineText = baselineShape.textLength;
-    const robotsRes = await ctx.fetch(`${ctx.url}/robots.txt`);
-    const robotsEntries = robotsRes.ok ? parseUserAgents(robotsRes.body) : [];
-    const outcomes = new Map();
-    for (const crawler of PROBEABLE_CORE_CRAWLERS) {
-        const res = await ctx.fetch(ctx.url, { headers: { 'User-Agent': crawlerUserAgent(crawler) } });
-        const cls = classifyResponse(res);
-        const blockedByRobots = intentBlocked(robotsEntries, crawler);
-        if (cls.kind === 'ok') {
-            const shape = shapeOf(res.body);
-            const diffs = shapeDiff(baselineShape, shape);
-            const textDropped = baselineText >= MIN_BASELINE_TEXT && shape.textLength < baselineText * REDUCED_CONTENT_RATIO;
-            if (textDropped || diffs.length > 0) {
-                outcomes.set(crawler, 'reduced');
-                findings.push({
-                    status: 'warn',
-                    message: `${crawler} receives a different page than a regular client`,
-                    detail: [textDropped ? `${shape.textLength} vs ${baselineText} chars of visible text` : null, ...diffs]
-                        .filter(Boolean)
-                        .join('; '),
-                    hint: 'The server returns 200 but serves this crawler different content — often an interstitial, a consent ' +
-                        'wall, or conditional rendering. Agents index exactly what they receive, so the version they see is the ' +
-                        'version that gets cited.',
-                    learnMoreUrl: guideUrl(meta.id, 'reduced-content'),
-                });
-            }
-            else {
-                outcomes.set(crawler, 'ok');
-            }
-            continue;
-        }
-        outcomes.set(crawler, recordTurnedAway(crawler, cls, blockedByRobots, robotsRes.ok, findings));
-    }
-    const okCount = [...outcomes.values()].filter((o) => o === 'ok').length;
-    if (okCount === PROBEABLE_CORE_CRAWLERS.length) {
-        findings.unshift({
-            status: 'pass',
-            message: `All ${PROBEABLE_CORE_CRAWLERS.length} core AI crawler user-agents receive the same page as a regular client`,
-        });
-    }
-    const inconclusive = [...outcomes.entries()].filter(([, o]) => o === 'inconclusive');
-    if (inconclusive.length > 0) {
-        findings.push({
-            status: 'warn',
-            message: `${inconclusive.length} crawler probe(s) could not be settled from outside`,
-            detail: inconclusive.map(([name]) => name).join(', '),
-            hint: INCONCLUSIVE_CAVEAT,
-            learnMoreUrl: guideUrl(meta.id, 'inconclusive-probe'),
-        });
-    }
-    const credit = [...outcomes.values()].reduce((acc, o) => acc + OUTCOME_CREDIT[o], 0);
-    const score = Math.round((credit / PROBEABLE_CORE_CRAWLERS.length) * 100);
-    return buildResult(meta, score, findings, start);
-}
-/**
- * Turn a non-200 crawler response into a finding and an outcome. The
- * classification decides both the wording and the credit: a challenge is not a
- * block, a price is not a refusal, and a signature demand is a site working as
- * designed.
- */
-function recordTurnedAway(crawler, cls, blockedByRobots, robotsAvailable, findings) {
-    const info = crawlerInfo(crawler);
-    const evidence = cls.evidence.length > 0 ? cls.evidence.join('; ') : cls.label;
-    switch (cls.kind) {
-        case 'challenge':
-            findings.push({
-                status: 'warn',
-                message: `${crawler} receives a ${cls.vendor ?? 'JavaScript'} challenge instead of the page`,
-                detail: evidence,
-                hint: 'Challenge pages require running JavaScript. Crawlers that only fetch HTML — which is most of them — never ' +
-                    'get past one, so the page is effectively unavailable to them even though nothing is "blocked". ' +
-                    'Add a bot-management exception for verified AI crawlers. ' +
-                    INCONCLUSIVE_CAVEAT,
-                learnMoreUrl: guideUrl(meta.id, 'challenge-page'),
-            });
-            return 'inconclusive';
-        case 'needs-signature':
-            findings.push({
-                status: 'pass',
-                message: `${crawler} must present a Web Bot Auth signature`,
-                detail: evidence,
-                hint: 'The origin asks unverified clients to re-request with an HTTP Message Signature. Vendors that sign their ' +
-                    'requests will pass; this probe does not sign, so it cannot confirm the outcome for the real crawler.',
-                learnMoreUrl: guideUrl(meta.id, 'needs-signature'),
-            });
-            return 'inconclusive';
-        case 'paywall':
-            findings.push({
-                status: 'pass',
-                message: `${crawler} is offered priced access${cls.price ? ` at ${cls.price}` : ''}`,
-                detail: evidence,
-                hint: 'Content is monetised for crawlers rather than blocked. Crawlers that support the payment flow can still reach it.',
-                learnMoreUrl: guideUrl(meta.id, 'pay-per-crawl'),
-            });
-            return 'conditional';
-        case 'license-required':
-            findings.push({
-                status: 'pass',
-                message: `${crawler} is asked to obtain a licence before use`,
-                detail: evidence,
-                hint: 'The origin implements the RSL Open Licensing Protocol. Clients that negotiate a licence can reach the content.',
-                learnMoreUrl: guideUrl(meta.id, 'license-required'),
-            });
-            return 'conditional';
-        case 'rate-limited':
-            findings.push({
-                status: 'warn',
-                message: `${crawler} is rate limited on a single request`,
-                detail: evidence,
-                hint: 'One probe should not hit a rate limit. A limit this tight will stall any crawl. Always answer 429 with a ' +
-                    'Retry-After header so well-behaved crawlers back off correctly instead of giving up.',
-                learnMoreUrl: guideUrl(meta.id, 'rate-limited'),
-            });
-            return 'inconclusive';
-        case 'server-error':
-        case 'network-error':
-            findings.push({
-                status: 'warn',
-                message: `${crawler} probe failed: ${cls.label}`,
-                detail: evidence,
-                hint: 'The request did not complete, so access for this crawler is unknown. Re-run the audit; if it persists, check origin health for this user agent.',
-                learnMoreUrl: guideUrl(meta.id, 'probe-failed'),
-            });
-            return 'inconclusive';
-        default: {
-            // A plain refusal. Whether it is a finding depends on robots.txt intent.
-            if (blockedByRobots) {
-                findings.push({
-                    status: 'pass',
-                    message: `${crawler} blocked at the server — consistent with its robots.txt Disallow`,
-                    detail: evidence,
-                });
-                return 'blocked-consistent';
-            }
-            if (cls.inconclusive) {
-                findings.push({
-                    status: 'warn',
-                    message: `${crawler} is refused by ${cls.vendor ?? 'the origin'} while robots.txt permits it`,
-                    detail: evidence,
-                    hint: (info ? `${info.impact} ` : '') +
-                        'This edge verifies crawlers by IP range or signature, so the refusal may be correct anti-spoofing rather ' +
-                        'than a policy block. ' +
-                        INCONCLUSIVE_CAVEAT,
-                    learnMoreUrl: guideUrl(meta.id, 'blocked-crawler'),
-                });
-                return 'inconclusive';
-            }
-            findings.push({
-                status: 'warn',
-                message: `${crawler} is ${robotsAvailable ? 'allowed in robots.txt' : 'not restricted'} but its User-Agent is refused`,
-                detail: evidence,
-                hint: (info ? `${info.impact} ` : '') +
-                    'Your firewall rejects this crawler token even though robots.txt permits it — the block is invisible to you ' +
-                    'but fatal for the agent. Check your firewall rules and AI-bot toggles (for example Cloudflare "Block AI Crawlers").',
-                learnMoreUrl: guideUrl(meta.id, 'blocked-crawler'),
-            });
-            return 'blocked';
-        }
-    }
-}
-//# sourceMappingURL=agent-access.js.map

package/dist/checks/agent-access.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent-access.js","sourceRoot":"","sources":["../../src/checks/agent-access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAsB,MAAM,UAAU,CAAC;AAErF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,IAAI,GAAc;IAC7B,EAAE,EAAE,cAAc;IAClB,IAAI,EAAE,cAAc;IACpB,WAAW,EAAE,yFAAyF;IACtG,QAAQ,EAAE,QAAQ;CACnB,CAAC;AAEF,oFAAoF;AACpF,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAClC,kGAAkG;AAClG,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAgB9B,2DAA2D;AAC3D,MAAM,cAAc,GAA4B;IAC9C,EAAE,EAAE,CAAC;IACL,oBAAoB,EAAE,CAAC;IACvB,WAAW,EAAE,CAAC;IACd,YAAY,EAAE,IAAI;IAClB,OAAO,EAAE,GAAG;IACZ,OAAO,EAAE,CAAC;CACX,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,kEAAkE,KAAK,OAAO,CAAC;AACxF,CAAC;AAED,mFAAmF;AACnF,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAUnD,SAAS,OAAO,CAAC,IAAY;IAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAC/D,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACtD,OAAO;QACL,UAAU,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,MAAM;QAC3C,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;QAClD,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;QACzC,YAAY,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC,MAAM;KAC5C,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,SAAS,SAAS,CAAC,QAAmB,EAAE,MAAiB;IACvD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,QAAQ,CAAC,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC/D,KAAK,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,KAAK,IAAI,MAAM,SAAS,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,QAAQ,CAAC,EAAE,KAAK,IAAI,IAAI,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,EAAE,CAAC;QACtD,KAAK,CAAC,IAAI,CAAC,gBAAgB,MAAM,CAAC,EAAE,IAAI,MAAM,SAAS,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,QAAQ,CAAC,YAAY,GAAG,CAAC,IAAI,MAAM,CAAC,YAAY,GAAG,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC7E,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,2BAA2B,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,KAAK,CAAC,GAAiB;IACnD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,kEAAkE;YAC3E,MAAM,EAAE,QAAQ,QAAQ,CAAC,MAAM,IAAI,eAAe,EAAE;YACpD,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,sBAAsB,CAAC;SACxD,CAAC,CAAC;QACH,OAAO,WAAW,CAAC,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,YAAY,GAAG,aAAa,CAAC,UAAU,CAAC;IAE9C,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,GAAG,aAAa,CAAC,CAAC;IAC3D,MAAM,aAAa,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE1E,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAC;IAE5C,KAAK,MAAM,OAAO,IAAI,uBAAuB,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/F,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,eAAe,GAAG,aAAa,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAE9D,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAChC,MAAM,KAAK,GAAG,SAAS,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;YAC9C,MAAM,WAAW,GAAG,YAAY,IAAI,iBAAiB,IAAI,KAAK,CAAC,UAAU,GAAG,YAAY,GAAG,qBAAqB,CAAC;YAEjH,IAAI,WAAW,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;gBACjC,QAAQ,CAAC,IAAI,CAAC;oBACZ,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,GAAG,OAAO,kDAAkD;oBACrE,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,UAAU,OAAO,YAAY,wBAAwB,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC;yBACpG,MAAM,CAAC,OAAO,CAAC;yBACf,IAAI,CAAC,IAAI,CAAC;oBACb,IAAI,EACF,sGAAsG;wBACtG,yGAAyG;wBACzG,0BAA0B;oBAC5B,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,iBAAiB,CAAC;iBACnD,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC9B,CAAC;YACD,SAAS;QACX,CAAC;QAED,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,SAAS,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;IACjG,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;IACxE,IAAI,OAAO,KAAK,uBAAuB,CAAC,MAAM,EAAE,CAAC;QAC/C,QAAQ,CAAC,OAAO,CAAC;YACf,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,OAAO,uBAAuB,CAAC,MAAM,wEAAwE;SACvH,CAAC,CAAC;IACL,CAAC;IAED,MAAM,YAAY,GAAG,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,cAAc,CAAC,CAAC;IACrF,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,YAAY,CAAC,MAAM,qDAAqD;YACpF,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YACrD,IAAI,EAAE,mBAAmB;YACzB,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,oBAAoB,CAAC;SACtD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,uBAAuB,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC;IAE1E,OAAO,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CACvB,OAAe,EACf,GAAkB,EAClB,eAAwB,EACxB,eAAwB,EACxB,QAAmB;IAEnB,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;IAE/E,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,WAAW;YACd,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,GAAG,OAAO,eAAe,GAAG,CAAC,MAAM,IAAI,YAAY,gCAAgC;gBAC5F,MAAM,EAAE,QAAQ;gBAChB,IAAI,EACF,4GAA4G;oBAC5G,iGAAiG;oBACjG,2DAA2D;oBAC3D,mBAAmB;gBACrB,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,gBAAgB,CAAC;aAClD,CAAC,CAAC;YACH,OAAO,cAAc,CAAC;QAExB,KAAK,iBAAiB;YACpB,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,GAAG,OAAO,wCAAwC;gBAC3D,MAAM,EAAE,QAAQ;gBAChB,IAAI,EACF,2GAA2G;oBAC3G,sGAAsG;gBACxG,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,iBAAiB,CAAC;aACnD,CAAC,CAAC;YACH,OAAO,cAAc,CAAC;QAExB,KAAK,SAAS;YACZ,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,GAAG,OAAO,4BAA4B,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;gBACpF,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,mHAAmH;gBACzH,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,eAAe,CAAC;aACjD,CAAC,CAAC;YACH,OAAO,aAAa,CAAC;QAEvB,KAAK,kBAAkB;YACrB,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,GAAG,OAAO,0CAA0C;gBAC7D,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,gHAAgH;gBACtH,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,kBAAkB,CAAC;aACpD,CAAC,CAAC;YACH,OAAO,aAAa,CAAC;QAEvB,KAAK,cAAc;YACjB,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,GAAG,OAAO,sCAAsC;gBACzD,MAAM,EAAE,QAAQ;gBAChB,IAAI,EACF,2GAA2G;oBAC3G,sFAAsF;gBACxF,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,cAAc,CAAC;aAChD,CAAC,CAAC;YACH,OAAO,cAAc,CAAC;QAExB,KAAK,cAAc,CAAC;QACpB,KAAK,eAAe;YAClB,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,GAAG,OAAO,kBAAkB,GAAG,CAAC,KAAK,EAAE;gBAChD,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,iJAAiJ;gBACvJ,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,cAAc,CAAC;aAChD,CAAC,CAAC;YACH,OAAO,cAAc,CAAC;QAExB,OAAO,CAAC,CAAC,CAAC;YACR,yEAAyE;YACzE,IAAI,eAAe,EAAE,CAAC;gBACpB,QAAQ,CAAC,IAAI,CAAC;oBACZ,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,GAAG,OAAO,kEAAkE;oBACrF,MAAM,EAAE,QAAQ;iBACjB,CAAC,CAAC;gBACH,OAAO,oBAAoB,CAAC;YAC9B,CAAC;YAED,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;gBACrB,QAAQ,CAAC,IAAI,CAAC;oBACZ,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,GAAG,OAAO,kBAAkB,GAAG,CAAC,MAAM,IAAI,YAAY,8BAA8B;oBAC7F,MAAM,EAAE,QAAQ;oBAChB,IAAI,EACF,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC/B,2GAA2G;wBAC3G,uBAAuB;wBACvB,mBAAmB;oBACrB,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,iBAAiB,CAAC;iBACnD,CAAC,CAAC;gBACH,OAAO,cAAc,CAAC;YACxB,CAAC;YAED,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,GAAG,OAAO,OAAO,eAAe,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,gBAAgB,gCAAgC;gBACtH,MAAM,EAAE,QAAQ;gBAChB,IAAI,EACF,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/B,6GAA6G;oBAC7G,qHAAqH;gBACvH,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,iBAAiB,CAAC;aACnD,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/checks/agent-card.d.ts

@@ -1,37 +0,0 @@
-import type { CheckContext, CheckResult, CheckMeta } from '../types.js';
-/**
- * "agent-card" — the A2A (Agent2Agent) Agent Card.
- *
- * Two things changed since this check was written, and both matter:
- *
- * 1. **The path moved.** A2A v0.3.0 (2025-07-30) relocated the card from
- *    `/.well-known/agent.json` to `/.well-known/agent-card.json`, which is now
- *    an IANA-registered well-known URI. A site serving only the old path is
- *    invisible to a current client.
- *
- * 2. **The shape changed.** A2A 1.0 (2026-03-12, breaking) folded the
- *    top-level `url`, `protocolVersion`, `preferredTransport` and
- *    `additionalInterfaces` fields into a single `supportedInterfaces[]` array,
- *    and renamed `supportsAuthenticatedExtendedCard` to
- *    `capabilities.extendedAgentCard`. Most deployed cards are still 0.3-shaped.
- *
- * Validating a 1.0 card against 0.3 rules (or the reverse) produces nonsense,
- * so the check detects which generation a card belongs to from its own
- * structure and applies the matching rules. `authentication`, dropped back in
- * 0.2.x in favour of `securitySchemes`, is flagged wherever it appears.
- *
- * Spec: https://a2a-protocol.org/latest/specification/
- * Normative field list: specification/a2a.proto in github.com/a2aproject/A2A
- */
-export declare const meta: CheckMeta;
-/** Which generation of the A2A spec a card was written against. */
-type Generation = 'v1' | 'v0.3' | 'unknown';
-/**
- * Detect the card generation from its own structure rather than from a version
- * field, because 0.3 cards state `protocolVersion` at the top level and 1.0
- * cards state it per interface.
- */
-export declare function detectGeneration(data: Record<string, unknown>): Generation;
-export default function check(ctx: CheckContext): Promise<CheckResult>;
-export {};
-//# sourceMappingURL=agent-card.d.ts.map

package/dist/checks/agent-card.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent-card.d.ts","sourceRoot":"","sources":["../../src/checks/agent-card.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,EAA0B,MAAM,aAAa,CAAC;AAKhG;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,IAAI,EAAE,SAMlB,CAAC;AAKF,mEAAmE;AACnE,KAAK,UAAU,GAAG,IAAI,GAAG,MAAM,GAAG,SAAS,CAAC;AAE5C;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,CAI1E;AAqBD,wBAA8B,KAAK,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAkF3E"}