ax-audit 5.0.0 → 6.0.0

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAErD,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,aAAa,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,CAAC;AAExF,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,OAAO,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8FAA8F;IAC9F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uFAAuF;IACvF,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,iGAAiG;IACjG,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,iDAAiD;AACjD,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC;;;;OAIG;IACH,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;CAChC;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,KAAK,GAAG,OAAO,GAAG,MAAM,GAAG,UAAU,GAAG,KAAK,CAAC;CAC1E;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,CAAC,GAAG,EAAE,YAAY,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IACjD,IAAI,EAAE,SAAS,CAAC;CACjB;AAED,MAAM,WAAW,KAAK;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,KAAK,CAAC;IACb,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,0FAA0F;IAC1F,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,KAAK,GAAG,OAAO,GAAG,MAAM,GAAG,UAAU,GAAG,KAAK,CAAC;IACzE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,8FAA8F;IAC9F,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,YAAa,SAAQ,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC;IAC7D,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,OAAO,EAAE;QACP,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,YAAY,EAAE,MAAM,CAAC;QACrB,KAAK,EAAE,KAAK,CAAC;KACd,CAAC;IACF,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC;AAIrE;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC3B,8EAA8E;IAC9E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,2EAA2E;IAC3E,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,6BAA6B;AAC7B,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED,iEAAiE;AACjE,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,SAAS,EAAE,CAAC;IACpB,WAAW,EAAE,SAAS,EAAE,CAAC;IACzB,YAAY,EAAE,SAAS,EAAE,CAAC;CAC3B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAErD,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,aAAa,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,CAAC;AAExF,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,OAAO,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8FAA8F;IAC9F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uFAAuF;IACvF,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,iGAAiG;IACjG,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,iDAAiD;AACjD,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC;;;;OAIG;IACH,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;CAChC;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,KAAK,GAAG,OAAO,GAAG,MAAM,GAAG,UAAU,GAAG,KAAK,CAAC;CAC1E;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,CAAC,GAAG,EAAE,YAAY,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IACjD,IAAI,EAAE,SAAS,CAAC;CACjB;AAED,MAAM,WAAW,KAAK;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,WAAW;IAC1B,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,KAAK,CAAC;IACb,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,0FAA0F;IAC1F,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,KAAK,GAAG,OAAO,GAAG,MAAM,GAAG,UAAU,GAAG,KAAK,CAAC;IACzE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,8FAA8F;IAC9F,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,YAAa,SAAQ,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC;IAC7D,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,OAAO,EAAE;QACP,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,YAAY,EAAE,MAAM,CAAC;QACrB,KAAK,EAAE,KAAK,CAAC;KACd,CAAC;IACF,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC;AAIrE;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC3B,8EAA8E;IAC9E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,2EAA2E;IAC3E,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,6BAA6B;AAC7B,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED,iEAAiE;AACjE,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,SAAS,EAAE,CAAC;IACpB,WAAW,EAAE,SAAS,EAAE,CAAC;IACzB,YAAY,EAAE,SAAS,EAAE,CAAC;CAC3B"}

package/docs/api.md

@@ -11,7 +11,10 @@ The package is ESM-only (`"type": "module"`), targets Node 18+ (built-in `fetch`
 
 ## `audit(options): Promise<AuditReport>`
 
-Validates your organization key online, then runs all (or selected) checks locally against one URL. Create the key at https://axrush.com/account/api. Only the key is sent to AX Rush; the target URL and page content are not.
+Executes selected checks on the private AX Rush service and returns its report.
+The URL and options are sent to AX Rush; no audit runs on the client. An active
+paid subscription and an organization key from https://axrush.com/account/api
+are required for every call. `apiKey` defaults to `AXRUSH_API_KEY`.
 
 ```typescript
 function audit(options: AuditOptions): Promise<AuditReport>;
@@ -41,7 +44,10 @@ report.results;      // CheckResult[]
 report.duration;     // ms
 ```
 
-`audit` **rejects** with `LicenseError` before any target request when a key is missing, invalid/revoked, its plan is inactive, or online validation is unavailable. The error codes are `MISSING_KEY`, `INVALID_KEY`, `PLAN_REQUIRED` and `VALIDATION_UNAVAILABLE`. It can also reject for an unrecoverable setup error (e.g. an invalid `url` that can't be parsed). Network failure on the homepage fetch does not reject — it surfaces as failing checks.
+`audit` rejects with `LicenseError`: `MISSING_KEY`, `INVALID_KEY`, `PLAN_REQUIRED`,
+`INVALID_INPUT`, `RATE_LIMITED`, or `VALIDATION_UNAVAILABLE`. Network failures,
+malformed service responses and access refusals never trigger a local fallback.
+Only public HTTP(S) targets are supported; the service blocks private addresses.
 
 ## `batchAudit(urls, options?): Promise<BatchAuditReport>`
 
@@ -53,7 +59,7 @@ interface BatchOptions extends Omit<AuditOptions, 'url'> {
 }
 ```
 
-A batch validates once before any target requests and shares that authorization only within the running batch. Report order always matches input order, regardless of `concurrency`. `concurrency < 1` is treated as 1.
+A batch accepts 1–100 URLs and concurrency 1–4 (default 1). Each URL is a separate authenticated service request and consumes the shared rate limit. Report order matches input order. Invalid options reject before any request.
 
 ```typescript
 const batch = await batchAudit(urls, { concurrency: 4, retries: 2 });
@@ -70,6 +76,7 @@ batch.summary.grade;     // Grade for the average
 ```typescript
 interface AuditReport {
   url: string;
+  engine?: string;          // private server engine provenance
   timestamp: string;        // ISO 8601
   overallScore: number;     // 0–100
   grade: Grade;
@@ -122,6 +129,7 @@ function diffBaseline(baseline: BaselineData, report: AuditReport): BaselineDiff
 
 interface BaselineData {
   url: string;
+  engine?: string;          // private server engine provenance
   timestamp: string;
   overallScore: number;
   checks: Record<string, number>; // checkId → score
@@ -256,4 +264,4 @@ Within a major version, the exported function signatures and the `AuditReport` J
 
 `AuditOptions`, `BatchOptions`, `AuditReport`, `BatchAuditReport`, `CheckResult`, `CheckMeta`, `CheckContext`, `CheckModule`, `Finding`, `FindingStatus`, `FetchOptions`, `FetchResponse`, `Grade`, `OutputFormat`, `BaselineData`, `BaselineDiff`, `CheckDiff`.
 
-`checks` exposes metadata without authorization. Calling `checks[i].run(context)` requires `AXRUSH_API_KEY`; use `audit({ apiKey, ... })` to supply a key programmatically. Keys must only be used server-side.
+`checks` exposes metadata only, with no `run` function. Execute checks through `audit({ url, checks: [id], apiKey })`, which calls AX Rush. Keep keys out of browser bundles.

package/docs/architecture.md

@@ -1,104 +1,15 @@
 # Architecture
 
-ax-audit is a dependency-light TypeScript codebase: two runtime dependencies (`chalk`, `commander`), Node 18+ built-in `fetch`, no HTTP libraries, no XML/HTML parser dependencies (regex-based primitives), and the built-in `node:test` runner.
+Version 6 separates the public client from the private audit service.
 
-## Pipeline
+- `src/orchestrator.ts` sends authenticated requests to the fixed AX Rush audit endpoint. It contains no checks, HTML parsers, target fetcher or offline fallback.
+- `src/license.ts` reads the account key and defines actionable client errors. Local validation is only for usability; the server owns authorization.
+- `src/metadata.ts` holds check descriptions and aliases, without executable `run` functions.
+- `src/reporter/`, `src/baseline.ts` and `src/scorer.ts` format, compare and summarize existing results locally.
+- The private AX Rush application owns check implementations, safe outbound HTTP, server-side API-key and billing checks, and shared abuse limits. Authorization runs for every audit.
 
-```
-cli.ts ──► orchestrator.ts ──► checks/* (Promise.allSettled, parallel)
-              │                     │
-              ▼                     ▼
-          fetcher.ts            scorer.ts ──► reporter/{terminal,json,html,markdown}
-        (cache + retries)                          │
-              ▲                                baseline.ts (save / load / diff)
-              └── shared by every check via CheckContext.fetch
-```
+Only URL, check selection, profile, request timeout and retry count are sent in the request body. The account key travels in the Authorization header only. There is no endpoint override or bypass flag. Private network targets are not supported.
 
-1. **cli.ts** parses and validates flags, loads the baseline if requested, and dispatches to single or batch mode.
-2. **orchestrator.ts** (`audit`) creates one fetcher per run, fetches the homepage once, builds the `CheckContext` (`url`, `html`, `headers`, `fetch`), and runs all selected checks in parallel. A check that throws is converted into a score-0 result with the error as a finding — one bad check never kills the audit. `batchAudit` runs `audit` per URL through an order-preserving work queue with configurable `concurrency`.
-3. **fetcher.ts** wraps `fetch` with: per-run in-memory caching keyed on URL + normalized (lowercased, sorted) custom headers — mirroring HTTP `Vary` semantics so a `text/markdown` probe never collides with the HTML fetch; case-insensitive header merging over defaults; timeouts via `AbortController`; and retries with exponential backoff for transient failures (status 0, 408, 425, 429, 5xx). Errors never throw — they become `{ status: 0, ok: false, error }` results, also cached.
-4. **checks/** — one module per check (26). Each exports `default` (async check function) and `meta` (`{ id, name, description, weight, category?, aliases? }`).
-5. **scorer.ts** computes the weighted average over the checks that ran *and apply*; a check reporting `applicable: false` is excluded from both numerator and denominator. When every applicable check has weight 0 it falls back to a plain average.
-6. **reporter/** renders to terminal (chalk), JSON, self-contained HTML, or Markdown, grouping checks by category and showing n/a where a check does not apply.
-7. **baseline.ts** persists minimal score snapshots and computes per-check diffs for regression gating.
+`npm test` checks the public API, report rendering, baselines and the remote transport, including denied access and unavailable service. Engine check tests live with the private server. `npm run prepublishOnly` builds from a clean `dist` and verifies the package allowlist so check implementations cannot accidentally ship.
 
-## Anatomy of a check
-
-```typescript
-import { guideUrl } from '../guide-urls.js';
-import type { CheckContext, CheckResult, CheckMeta, Finding } from '../types.js';
-import { buildResult } from './utils.js';
-
-export const meta: CheckMeta = {
-  id: 'my-check',
-  name: 'My Check',
-  description: 'One-line description shown in reports',
-  category: 'discovery',
-  // No `weight` here: weights live in CHECK_WEIGHTS, and only there.
-};
-
-export default async function check(ctx: CheckContext): Promise<CheckResult> {
-  const start = performance.now();
-  const findings: Finding[] = [];
-  let score = 100;
-
-  const res = await ctx.fetch(`${ctx.url}/something`, { headers: { Accept: 'application/json' } });
-  if (!res.ok) {
-    findings.push({
-      status: 'fail',
-      message: '/something not found',
-      hint: 'Actionable, copy-pasteable advice.',
-      learnMoreUrl: guideUrl(meta.id, 'not-found'),
-    });
-    return buildResult(meta, 0, findings, start);
-  }
-
-  // ... validations, each pushing a pass/warn/fail Finding and adjusting score
-
-  return buildResult(meta, score, findings, start);
-}
-```
-
-Conventions:
-
-- **Findings are actionable.** Every `warn`/`fail` carries a `hint` with concrete remediation and a `learnMoreUrl` pointing to `axrush.com/guides/<check-id>#<anchor>`. Every anchor must have a section in that guide.
-- **Scores are clamped** to [0, 100] by `buildResult`.
-- **Shared HTML primitives** live in `checks/html-utils.ts` (`getMetaContent`, `findLinkTags`, `getAttribute`, `extractVisibleText`, …) — no per-check regex duplication.
-- **robots.txt is parsed once**, by `checks/robots-parser.ts`. It returns User-agent groups with their rules plus `Content-Signal`, `Content-Usage`, `License`, `Sitemap` and `Agentmap` directives. `robots-txt`, `rsl` and `agent-access` all consume it, so the grouping rules have one definition.
-- **Responses are classified**, not just status-checked. `checks/waf.ts` turns a response into ok / challenge / paywall / needs-signature / license-required / rate-limited / blocked, with the evidence that produced it and an `inconclusive` flag for what an unsigned probe cannot settle.
-- **Probed paths carry their standing.** `checks/well-known.ts` records every path as IANA-registered, vendor convention, draft or legacy, so a missing draft file is never reported like a missing registered one.
-- **An HTML body means absent, not broken.** `isHtmlDocument` in `checks/utils.ts` gates speculative probes: an SPA catch-all returns its index shell for every unknown path, and reporting that as a malformed document sends operators hunting for a bug in a file they never wrote.
-- **A check that does not apply reports N/A**, via `notApplicable()`, rather than scoring 0. Commerce discovery on a blog, OAuth metadata where nothing needs authorizing, WebMCP on a page with no forms: scoring these zero would say something false about the site. Everything counted against a site must be something the site could have done.
-- **Check ids are a public interface** — they appear in `--checks` flags and in saved baselines. A rename declares the old id in `meta.aliases`; `src/check-ids.ts` resolves aliases for selection and for baseline diffing.
-- **Content-Type validation** uses `checkContentType` from `checks/utils.ts` (−5 convention for mismatches).
-- **Network goes through `ctx.fetch`** — never raw `fetch` — so caching, retries, timeouts, and `--verbose` logging apply uniformly.
-
-## Adding a new check
-
-1. Create `src/checks/your-check.ts` exporting `default` + `meta` (weight 0 — see scoring policy below).
-2. Register it in `src/checks/index.ts`.
-3. Add its weight to `CHECK_WEIGHTS` in `src/constants.ts`.
-4. Add a test suite in `test/checks/your-check.test.js` using `mockContext` / `mockResponse` from `test/helpers.js`. Route values can be functions `(url, fetchOptions) => response` when the response must vary by request headers.
-5. Document it in `docs/checks.md` and the README table.
-6. Write the remediation guide covering every `learnMoreUrl` anchor you emit.
-
-## Scoring policy
-
-Score deltas on the same site are treated as **breaking**. Within a major version:
-
-- New checks ship with **weight 0**: full findings, no effect on the overall score or baselines.
-- New findings inside weighted checks must be informational, with no deduction.
-- Weight redistribution happens in a major version, and the baseline schema version is bumped with it so an existing baseline is not read as a regression.
-
-Weights live in `CHECK_WEIGHTS` in `src/constants.ts`, and only there. Checks used to declare their own `meta.weight` alongside the map; the two drifted, and a redistribution silently did nothing. `CheckMeta.weight` remains as an override that nothing uses, and a test asserts no check declares one.
-
-Two check states exist beyond a score:
-
-- **Weight 0** means the check runs and reports but rests on something too unsettled to score: a draft specification that may be renamed.
-- **Not applicable** means the question does not arise for this site. It leaves the denominator entirely. `--profile` overrides the detection.
-
-## Testing
-
-`npm test` builds (`tsc`) and runs `node --test`. The suite (964 tests) covers every check, the scorer, baseline logic, the Markdown reporter, plus integration tests that spin up real local HTTP servers for the fetcher (per-header caching, retries, HEAD and manual redirects) and the batch orchestrator (ordering, concurrency caps). No test dependencies beyond Node.
-
-Two classes of test exist specifically to keep the 3.x promise that no score goes down: **score-stability tests** assert that a configuration which scored 100 in 3.6 still scores 100, and that findings added inside a weighted check leave the score untouched. When those fail, the change belongs in the next major, not the current minor.
+The server must be deployed and verified before publishing a client version that relies on it.

package/docs/ci.md

@@ -1,6 +1,6 @@
 # CI Integration
 
-For ax-audit 5, create a paid organization API key at
+For ax-audit 6, create a paid organization API key at
 https://axrush.com/account/api, save it as the `AXRUSH_API_KEY` repository secret,
 and expose it only to trusted audit jobs:
 
@@ -11,8 +11,8 @@ env:
 
 Fork pull requests do not receive secrets. Skip licensed audits for those runs;
 never use `pull_request_target` to execute untrusted checkout code with this key.
-The job needs outbound HTTPS to axrush.com for license validation before the
-local audit. License errors fail the command instead of publishing a score.
+The job needs outbound HTTPS to axrush.com; authorization and audit execution
+both happen on AX Rush. License errors fail the command instead of publishing a score.
 
 
 ax-audit's exit codes (see [cli.md](./cli.md)) make it a drop-in quality gate: `0` for Good/Excellent, `1` for Fair/Poor or regressions.
@@ -102,3 +102,7 @@ jobs:
 ```
 
 `--fail-on-regression 0` makes any per-check drop fail the workflow — appropriate for scheduled runs where every change is unexpected.
+
+## Remote execution in v6
+
+Audit a public preview or deployed URL. Localhost and private CI network hosts are not reachable by AX Rush. The target URL and options are sent to AX Rush; no engine is downloaded. Each URL requires an active paid subscription and consumes the service rate limit.

package/docs/cli.md

@@ -1,10 +1,10 @@
 # CLI Reference
 
-Version 5 requires `AXRUSH_API_KEY`, generated at https://axrush.com/account/api
+Version 6 requires `AXRUSH_API_KEY`, generated at https://axrush.com/account/api
 by an owner/admin of an active paid organization. Set it through your environment
 or CI secret store. It is never a command-line flag, target header or report field.
-Missing, revoked or inactive keys, and unavailable validation, stop execution
-before target requests. `--help` and `--version` work without a key.
+The server rejects missing/revoked keys and inactive subscriptions before
+contacting the target. Service failures never trigger a local audit. `--help` and `--version` work without a key.
 
 
 ```bash
@@ -108,3 +108,7 @@ Each area is reported against its threshold on stderr, so the output survives `-
 ## Baselines across a scoring change
 
 Baselines record which scoring model produced them. Comparing a baseline written by an older version shows the deltas but suspends regression gating, because a rescore is not something the site did. Re-save with `--save-baseline` to resume gating. Checks that changed applicability are excluded from regressions and improvements for the same reason.
+
+## Version 6 service boundary
+
+The CLI sends the URL and options to AX Rush and renders the returned report. The engine is private to the server. Set `AXRUSH_API_KEY` using a key from an active paid account. Public HTTP(S) URLs only, ports 80/443, no URL credentials. `--timeout` is 100–10000 ms per server request, `--retries` is 0–2, and `--concurrency` is 1–4. Verbose output is client-side only; server network traces are not returned. Rate limits and API errors exit with code 2.

package/docs/faq.md

@@ -1,3 +1,21 @@
+# Version 6: remote service
+
+## Can I use the engine without a subscription?
+
+No. The npm package contains only a client. AX Rush authorizes each audit against an active paid subscription. Modifying the client cannot expose engine code that it does not contain.
+
+## Can I audit localhost or run offline?
+
+No. Audit a public preview or deployed site. AX Rush must be able to reach it.
+
+## What data leaves my machine?
+
+The target URL and selected audit options are sent to AX Rush. AX Rush fetches the pages and returns a report. The API key is sent only to AX Rush, never to the target site.
+
+## What about versions 1–5?
+
+They were distributed with local engine code. This release cannot disable downloaded copies or revoke previously granted license rights. They are legacy releases, not the current AX Rush service.
+
 # FAQ & Troubleshooting
 
 ## Scores & results

package/docs/getting-started.md

@@ -1,32 +1,38 @@
 # Getting Started
 
-## AX Rush key required (v5)
+## AX Rush service access (v6)
+
+Install with `npm install ax-audit`. Version 6 is a CLI and SDK for the private
+AX Rush service: **the npm package contains no audit engine or check implementations**.
+
+1. Subscribe at [AX Rush](https://axrush.com/pricing).
+2. Generate an organization key in [Account → API keys](https://axrush.com/account/api).
+3. Store it as `AXRUSH_API_KEY` in your environment or trusted CI secret store.
+4. Run `npx ax-audit@6 https://example.com`.
+
+`audit({ url, apiKey })` can pass a key explicitly. Never commit keys or put them
+in command-line arguments. The service checks the key and an active paid
+subscription for **each audit**; revoked keys, canceled subscriptions, past-due
+payments, trial-only and complimentary-only accounts cannot execute the engine.
+
+The client sends the target URL and audit options to
+`https://axrush.com/api/v1/engine/audit`, with the key in the Authorization header.
+AX Rush fetches the public pages and returns the report. The key is never sent
+to the target website. This endpoint does not save the report to your dashboard;
+use the authenticated site API for stored scan history.
+
+Only publicly reachable HTTP(S) sites on ports 80/443 are supported. Localhost,
+private networks, URL credentials and custom ports are rejected. CI should audit
+a public preview or deployed environment. Internet access to AX Rush is required;
+there is no offline mode or local fallback. Current abuse limits are 10 audits
+per organization per hour and 5 per target per hour, shared across keys and scan
+surfaces. A batch consumes one audit for each URL.
+
+Rendering an existing report, reading check descriptions and comparing saved
+baselines remain local. `checks` contains metadata only; `checks[i].run()` was
+removed. The CLI and client utilities remain Apache-2.0. Earlier releases and
+rights already granted under their licenses cannot be revoked by this release.
 
-Install the package normally with `npm install ax-audit`. To execute an audit,
-you need an active paid AX Rush plan and an organization key created in
-[Account → API keys](https://axrush.com/account/api). Set `AXRUSH_API_KEY` in
-your local environment or your CI secret store. Do not commit it to source
-control or put it in browser code.
-
-```bash
-# AXRUSH_API_KEY is supplied securely by your environment or CI secrets
-npx ax-audit@5 https://example.com
-```
-
-The engine validates the key with AX Rush before each audit or batch, then runs
-locally. Only the key is sent to AX Rush: target URLs, page content and reports
-stay in your execution environment. Validation needs internet access and fails
-closed if unavailable. Revocation or an inactive subscription blocks the next
-execution; authorization is not cached between runs. Public check metadata,
-scoring utilities and rendering existing reports need no key. Calling an
-individual exported check requires `AXRUSH_API_KEY` too.
-
-This is an execution requirement for the official v5 package, not tamper-proof
-DRM. Earlier published releases remain usable, and local JavaScript can be
-modified. The existing source license and notices are unchanged.
-
-
-This walkthrough takes you from zero to a passing AX score: run your first audit, learn to read the report, and fix findings in the order that moves your score most.
 
 ## 1. Run your first audit
 

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "ax-audit",
-  "version": "5.0.0",
-  "description": "Audit websites for AI Agent Experience readiness. Requires an active AX Rush plan and API key.",
+  "version": "6.0.0",
+  "description": "CLI and SDK for the private AX Rush audit service. Requires an active paid subscription and API key.",
   "type": "module",
   "license": "Apache-2.0",
   "author": "Durani Technologies (https://axrush.com)",
   "repository": {
     "type": "git",
-    "url": "https://github.com/duranitech/ax-audit.git"
+    "url": "git+https://github.com/duranitech/ax-audit.git"
   },
   "homepage": "https://axrush.com",
   "bugs": {
@@ -36,7 +36,7 @@
     "typescript"
   ],
   "bin": {
-    "ax-audit": "./bin/ax-audit.js"
+    "ax-audit": "bin/ax-audit.js"
   },
   "exports": {
     ".": {
@@ -66,7 +66,7 @@
     "format": "prettier --write \"src/**/*.ts\"",
     "format:check": "prettier --check \"src/**/*.ts\"",
     "prepare": "husky",
-    "prepublishOnly": "npm run build"
+    "prepublishOnly": "npm run build && node scripts/verify-package.mjs"
   },
   "lint-staged": {
     "src/**/*.ts": [

package/dist/checks/agent-access.d.ts

@@ -1,33 +0,0 @@
-import type { CheckContext, CheckResult, CheckMeta } from '../types.js';
-/**
- * "agent-access" — the gap between what robots.txt permits and what the server
- * actually does.
- *
- * The failure this catches is invisible from the inside: robots.txt says
- * `Allow: /` for GPTBot, and the WAF returns 403 to anything whose user agent
- * says GPTBot. The operator sees a permissive robots.txt and assumes the site
- * is reachable. Cloudflare's "Block AI Crawlers" toggle produces exactly this,
- * and so does a hand-written rule that outlived its reason.
- *
- * The check probes the homepage once per core crawler and compares the result
- * against the default-user-agent baseline. Since 3.7 it classifies *how* a
- * request was turned away, because the remedies are completely different: a
- * JavaScript challenge needs a bot-management exception, a hard 403 needs a
- * firewall rule change, a 402 is a deliberate price, and a signature demand is
- * the site working as designed.
- *
- * Honesty constraint: this probe is unsigned and comes from the auditor's own
- * network. An edge that verifies crawlers by IP range or Web Bot Auth signature
- * will reject it while admitting the genuine crawler. Those outcomes are scored
- * as inconclusive and labelled as such, never as "blocks AI crawlers".
- */
-export declare const meta: CheckMeta;
-/**
- * Build a realistic crawler User-Agent for a given bot token. WAF and
- * bot-management rules match on the token substring, which is what we need
- * to trigger the same code path the real crawler would hit.
- */
-export declare function crawlerUserAgent(token: string): string;
-export { intentBlocked } from './robots-parser.js';
-export default function check(ctx: CheckContext): Promise<CheckResult>;
-//# sourceMappingURL=agent-access.d.ts.map

package/dist/checks/agent-access.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent-access.d.ts","sourceRoot":"","sources":["../../src/checks/agent-access.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,EAAW,MAAM,aAAa,CAAC;AAMjF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,IAAI,EAAE,SAKlB,CAAC;AA+BF;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEtD;AAGD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAoCnD,wBAA8B,KAAK,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CA8E3E"}