bfsg-scanner 0.1.0

package/dist/report/render.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"render.js","sourceRoot":"","sources":["../../src/report/render.ts"],"names":[],"mappings":"AACA,OAAO,EAA8B,WAAW,EAAE,MAAM,WAAW,CAAC;AAGpE;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,MAAc;IAC7D,MAAM,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG;QACX,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACjB,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;QACxB,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;QACzB,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;QACzB,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC;KAC3B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,OAAO;QACL,iBAAiB;QACjB,eAAe,MAAM,IAAI;QACzB,QAAQ;QACR,wBAAwB;QACxB,sEAAsE;QACtE,UAAU,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU;QACtE,UAAU,KAAK,UAAU;QACzB,SAAS;QACT,QAAQ;QACR,IAAI;QACJ,SAAS;QACT,SAAS;QACT,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,MAAM,CAAC,MAAc,EAAE,CAAW;IACzC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;IAC7C,OAAO,OAAO,CAAC;UACP,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC;;QAEpB,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACnC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;QACpC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAChD,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAChD,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;UAClC,CAAC,CAAC;AACZ,CAAC;AAED,SAAS,aAAa,CAAC,MAAc,EAAE,CAAW;IAChD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;IAChD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM;QAC7B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC;QACtB,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,eAAe,OAAO,CAAC,4BAA4B,IAAI,GAAG,CACvF,CAAC,CAAC,mBAAmB,CACtB,EAAE,CAAC;IACR,MAAM,QAAQ,GACZ,OAAO,CAAC,kBAAkB,GAAG,CAAC;QAC5B,CAAC,CAAC,uBAAuB,OAAO,CAAC,kBAAkB,IAAI,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM;QAChF,CAAC,CAAC,EAAE,CAAC;IACT,OAAO,sBAAsB,MAAM,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,CAAC;AAC7E,CAAC;AAED,SAAS,cAAc,CAAC,MAAc,EAAE,CAAW;IACjD,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;IACzB,MAAM,OAAO,GAAyC;QACpD,CAAC,UAAU,EAAE,CAAC,CAAC,cAAc,CAAC;QAC9B,CAAC,SAAS,EAAE,CAAC,CAAC,aAAa,CAAC;QAC5B,CAAC,UAAU,EAAE,CAAC,CAAC,cAAc,CAAC;QAC9B,CAAC,OAAO,EAAE,CAAC,CAAC,WAAW,CAAC;QACxB,CAAC,SAAS,EAAE,CAAC,CAAC,aAAa,CAAC;KAC7B,CAAC;IACF,OAAO,OAAO,CAAC;UACP,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC;;QAEvB,GAAG,CAAC,CAAC,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QAC3C,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QACzC,GAAG,CAAC,CAAC,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC;QACzD,GAAG,CAAC,CAAC,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;;UAE/C,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;;QAEjB,OAAO;SACN,GAAG,CACF,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CACf,aAAa,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAC3E;SACA,IAAI,CAAC,UAAU,CAAC;UACf,CAAC,CAAC;AACZ,CAAC;AAED,SAAS,cAAc,CAAC,MAAc,EAAE,CAAW;IACjD,MAAM,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC;IAC5E,IAAI,uBAAuB,CAAC,MAAM,KAAK,CAAC,IAAI,uBAAuB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjF,OAAO,OAAO,CAAC;YACP,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC;WACtB,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,OAAO,CAAC;UACP,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC;oCACK,GAAG,CAAC,CAAC,CAAC,uBAAuB,CAAC,UAAU,KAAK,CAC3E,uBAAuB,CACxB;oCAC+B,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,UAAU,KAAK,CACpE,uBAAuB,CACxB;uBACkB,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,eAAe,CAAC,MAAc,EAAE,CAAW;IAClD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxE,OAAO,OAAO,CAAC;UACP,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC;MAC1B,KAAK,EAAE,CAAC,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,IAAgB,EAAE,CAAW;IAC9C,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAC5B,OAAO;YACC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;+BACK,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,WAAW,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;eAC/D,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAAa,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACvD,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjE,KAAK,CAAC,IAAI,CAAC,iBAAiB,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACzD,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACnD,KAAK,CAAC,IAAI,CAAC,mBAAmB,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC3D,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,yBAAyB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC;AAC/D,CAAC;AAED,SAAS,YAAY,CAAC,CAAgB,EAAE,CAAW;IACjD,OAAO,8BAA8B,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;;cAEnD,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;4BACC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,aAAa,CAAC;;8BAEhD,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;;QAEjC,GAAG,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACpG,GAAG,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACxG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,YAAY,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QAChE,GAAG,CAAC,CAAC,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;;MAEjD,CAAC,CAAC,KAAK;SACN,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CACJ,2BAA2B,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,gBACpC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,2BAA2B,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAC9E,EAAE,CACL;SACA,IAAI,CAAC,IAAI,CAAC;SACR,CAAC;AACV,CAAC;AAED,SAAS,WAAW,CAAC,MAAmB;IACtC,OAAO,MAAM,IAAI,SAAS,CAAC;AAC7B,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,OAAO,YAAY,KAAK,cAAc,CAAC;AACzC,CAAC;AAED,SAAS,GAAG,CAAC,KAAa,EAAE,SAAiB;IAC3C,OAAO,YAAY,GAAG,CAAC,KAAK,CAAC,YAAY,SAAS,aAAa,CAAC;AAClE,CAAC;AAED,SAAS,KAAK,CAAC,MAAyB;IACtC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,IAAI,CAAC,GAAW;IACvB,OAAO,YAAY,GAAG,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;AACjD,CAAC;AAED,iFAAiF;AACjF,SAAS,GAAG,CAAC,KAAa;IACxB,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4Cb,CAAC"}

package/dist/report/types.d.ts

@@ -0,0 +1,78 @@
+import type { PageScanFailure, ScanFinding } from '../scan/index.js';
+import type { Clauses } from './clauses.js';
+import type { ImpactThreshold } from './verdict.js';
+export interface ReportToolInfo {
+    readonly name: string;
+    readonly version: string;
+}
+/** The scan inputs the report echoes back, so a stored report is self-describing. */
+export interface ReportTarget {
+    readonly baseUrl: string;
+    readonly wcagTags: readonly string[];
+    readonly failOn: ImpactThreshold;
+}
+/** Violation (rule) counts bucketed by axe-core impact; `unknown` is impact `null`. */
+export interface ReportImpactCounts {
+    readonly critical: number;
+    readonly serious: number;
+    readonly moderate: number;
+    readonly minor: number;
+    readonly unknown: number;
+}
+export interface ReportSummary {
+    readonly pagesScanned: number;
+    readonly pagesFailed: number;
+    readonly pagesWithViolations: number;
+    /** Total violated rules across all pages (not node count). */
+    readonly totalViolations: number;
+    readonly violationsByImpact: ReportImpactCounts;
+    /**
+     * Distinct WCAG success criteria breached by at least one violation,
+     * dotted and numerically sorted (`["1.1.1", "1.4.3"]`). Incomplete
+     * results do not count — they are unconfirmed, not breaches.
+     */
+    readonly breachedSuccessCriteria: readonly string[];
+    /** Distinct EN 301 549 clauses breached by at least one violation, same shape. */
+    readonly breachedEn301549Clauses: readonly string[];
+}
+/** A scan finding with the standards clauses it breaches attached. */
+export interface ReportFinding extends ScanFinding {
+    readonly clauses: Clauses;
+}
+/** A successfully scanned page, its findings enriched with clause mappings. */
+export interface ReportPageSuccess {
+    readonly status: 'ok';
+    readonly url: string;
+    readonly violations: readonly ReportFinding[];
+    readonly incomplete: readonly ReportFinding[];
+}
+/** Per-page report entry: an enriched success, or a scan failure verbatim. */
+export type ReportPage = ReportPageSuccess | PageScanFailure;
+/**
+ * The pass/fail call against `target.failOn`.
+ *
+ * Scoped to what was actually scanned: a page that failed to load is
+ * reported in `summary.pagesFailed` and drives the CLI exit code, but it
+ * cannot make a verdict pass or fail, because its compliance is unknown.
+ */
+export interface ReportVerdict {
+    /** Violated rules whose impact is at or above `target.failOn`. */
+    readonly violationsAtOrAboveThreshold: number;
+    /** Violated rules whose impact axe left unset, excluded from the count above. */
+    readonly unrankedViolations: number;
+    readonly passed: boolean;
+}
+export interface Report {
+    readonly schemaVersion: number;
+    readonly generatedAt: string;
+    readonly tool: ReportToolInfo;
+    readonly target: ReportTarget;
+    readonly summary: ReportSummary;
+    readonly verdict: ReportVerdict;
+    /**
+     * Per-page results. Scanned pages carry their findings enriched with the
+     * WCAG / EN 301 549 clauses each one breaches; pages that failed to load
+     * are passed through verbatim from the scan engine.
+     */
+    readonly pages: readonly ReportPage[];
+}

package/dist/report/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/report/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/report/types.ts"],"names":[],"mappings":""}

package/dist/report/verdict.d.ts

@@ -0,0 +1,20 @@
+import type { ImpactValue } from 'axe-core';
+import type { ReportImpactCounts } from './types.js';
+/**
+ * axe-core impacts from least to most severe. Index position is the rank;
+ * a finding meets a threshold when its rank is at or above the threshold's.
+ */
+export declare const IMPACT_RANK: readonly ["minor", "moderate", "serious", "critical"];
+export type ImpactThreshold = (typeof IMPACT_RANK)[number];
+/**
+ * True when `impact` is at least as severe as `threshold`.
+ *
+ * A `null` impact (axe leaves it unset) is deliberately never a match: it
+ * cannot be ranked, so it can neither be trusted to clear a threshold nor
+ * be assumed to breach one. Such findings are counted separately in the
+ * report's `unknown` bucket and surfaced by the CLI, so they are never
+ * silently dropped.
+ */
+export declare function meetsThreshold(impact: ImpactValue, threshold: ImpactThreshold): boolean;
+/** Total violated rules whose impact is at or above `threshold`. */
+export declare function countAtOrAbove(counts: ReportImpactCounts, threshold: ImpactThreshold): number;

package/dist/report/verdict.js

@@ -0,0 +1,28 @@
+/**
+ * axe-core impacts from least to most severe. Index position is the rank;
+ * a finding meets a threshold when its rank is at or above the threshold's.
+ */
+export const IMPACT_RANK = ['minor', 'moderate', 'serious', 'critical'];
+/**
+ * True when `impact` is at least as severe as `threshold`.
+ *
+ * A `null` impact (axe leaves it unset) is deliberately never a match: it
+ * cannot be ranked, so it can neither be trusted to clear a threshold nor
+ * be assumed to breach one. Such findings are counted separately in the
+ * report's `unknown` bucket and surfaced by the CLI, so they are never
+ * silently dropped.
+ */
+export function meetsThreshold(impact, threshold) {
+    if (impact === null) {
+        return false;
+    }
+    // -1 also covers an impact string a future axe version might add: an
+    // unrankable value is treated exactly like null rather than guessed at.
+    const impactRank = IMPACT_RANK.indexOf(impact);
+    return impactRank !== -1 && impactRank >= IMPACT_RANK.indexOf(threshold);
+}
+/** Total violated rules whose impact is at or above `threshold`. */
+export function countAtOrAbove(counts, threshold) {
+    return IMPACT_RANK.filter((impact) => meetsThreshold(impact, threshold)).reduce((sum, impact) => sum + counts[impact], 0);
+}
+//# sourceMappingURL=verdict.js.map

package/dist/report/verdict.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verdict.js","sourceRoot":"","sources":["../../src/report/verdict.ts"],"names":[],"mappings":"AAGA;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,CAAU,CAAC;AAIjF;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,MAAmB,EAAE,SAA0B;IAC5E,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,qEAAqE;IACrE,wEAAwE;IACxE,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,MAAyB,CAAC,CAAC;IAClE,OAAO,UAAU,KAAK,CAAC,CAAC,IAAI,UAAU,IAAI,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAC3E,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,cAAc,CAAC,MAA0B,EAAE,SAA0B;IACnF,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,CAC7E,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,EACrC,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/report/write.d.ts

@@ -0,0 +1,21 @@
+import type { Report } from './types.js';
+/** Canonical report filenames inside the configured output directory. */
+export declare const REPORT_FILENAME = "report.json";
+export declare const HTML_REPORT_FILENAME = "report.html";
+export declare const PDF_REPORT_FILENAME = "report.pdf";
+/**
+ * Writes the report as pretty-printed JSON to `<outputDir>/report.json`,
+ * creating the directory if needed and overwriting any previous run.
+ * Returns the path written.
+ */
+export declare function writeReport(report: Report, outputDir: string): Promise<string>;
+/**
+ * Writes a pre-rendered HTML report to `<outputDir>/report.html`, alongside
+ * the JSON. Same overwrite semantics. Returns the path written.
+ */
+export declare function writeHtmlReport(html: string, outputDir: string): Promise<string>;
+/**
+ * Writes pre-rendered PDF bytes to `<outputDir>/report.pdf`, alongside the
+ * JSON and HTML. Same overwrite semantics. Returns the path written.
+ */
+export declare function writePdfReport(pdf: Uint8Array, outputDir: string): Promise<string>;

package/dist/report/write.js

@@ -0,0 +1,35 @@
+import { mkdir, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+/** Canonical report filenames inside the configured output directory. */
+export const REPORT_FILENAME = 'report.json';
+export const HTML_REPORT_FILENAME = 'report.html';
+export const PDF_REPORT_FILENAME = 'report.pdf';
+/**
+ * Writes the report as pretty-printed JSON to `<outputDir>/report.json`,
+ * creating the directory if needed and overwriting any previous run.
+ * Returns the path written.
+ */
+export function writeReport(report, outputDir) {
+    return writeArtifact(outputDir, REPORT_FILENAME, `${JSON.stringify(report, null, 2)}\n`);
+}
+/**
+ * Writes a pre-rendered HTML report to `<outputDir>/report.html`, alongside
+ * the JSON. Same overwrite semantics. Returns the path written.
+ */
+export function writeHtmlReport(html, outputDir) {
+    return writeArtifact(outputDir, HTML_REPORT_FILENAME, html.endsWith('\n') ? html : `${html}\n`);
+}
+/**
+ * Writes pre-rendered PDF bytes to `<outputDir>/report.pdf`, alongside the
+ * JSON and HTML. Same overwrite semantics. Returns the path written.
+ */
+export function writePdfReport(pdf, outputDir) {
+    return writeArtifact(outputDir, PDF_REPORT_FILENAME, pdf);
+}
+async function writeArtifact(outputDir, filename, content) {
+    await mkdir(outputDir, { recursive: true });
+    const path = join(outputDir, filename);
+    await writeFile(path, content);
+    return path;
+}
+//# sourceMappingURL=write.js.map

package/dist/report/write.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"write.js","sourceRoot":"","sources":["../../src/report/write.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,yEAAyE;AACzE,MAAM,CAAC,MAAM,eAAe,GAAG,aAAa,CAAC;AAC7C,MAAM,CAAC,MAAM,oBAAoB,GAAG,aAAa,CAAC;AAClD,MAAM,CAAC,MAAM,mBAAmB,GAAG,YAAY,CAAC;AAEhD;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,MAAc,EAAE,SAAiB;IAC3D,OAAO,aAAa,CAAC,SAAS,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AAC3F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,SAAiB;IAC7D,OAAO,aAAa,CAAC,SAAS,EAAE,oBAAoB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;AAClG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,GAAe,EAAE,SAAiB;IAC/D,OAAO,aAAa,CAAC,SAAS,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,SAAiB,EACjB,QAAgB,EAChB,OAA4B;IAE5B,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACvC,MAAM,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/B,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/scan/index.d.ts

@@ -0,0 +1,2 @@
+export { scan } from './scan.js';
+export type { PageScanFailure, PageScanResult, PageScanSuccess, ScanDeps, ScanFinding, ScanNode, ScanOptions, ScanResult, } from './types.js';

package/dist/scan/index.js

@@ -0,0 +1,2 @@
+export { scan } from './scan.js';
+//# sourceMappingURL=index.js.map

package/dist/scan/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/scan/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC"}

package/dist/scan/scan.d.ts

@@ -0,0 +1,2 @@
+import type { ScanDeps, ScanOptions, ScanResult } from './types.js';
+export declare function scan(urls: readonly string[], options: ScanOptions, deps?: ScanDeps): Promise<ScanResult>;

package/dist/scan/scan.js

@@ -0,0 +1,82 @@
+import { AxeBuilder } from '@axe-core/playwright';
+import { chromium } from 'playwright';
+import { runWithConcurrency } from '../shared/pool.js';
+import { HostRateLimiter } from '../shared/rate-limiter.js';
+import { USER_AGENT } from '../shared/user-agent.js';
+const DEFAULT_TIMEOUT_MS = 15_000;
+const DEFAULT_RETRIES = 1;
+const DEFAULT_CONCURRENCY = 3;
+const DEFAULT_HOST_RATE_LIMIT_MS = 1_000;
+export async function scan(urls, options, deps = {}) {
+    const concurrency = options.concurrency ?? DEFAULT_CONCURRENCY;
+    const rateLimiter = new HostRateLimiter(options.hostRateLimitMs ?? DEFAULT_HOST_RATE_LIMIT_MS);
+    const browser = deps.browser ?? (await chromium.launch());
+    const launchedHere = deps.browser === undefined;
+    try {
+        const pages = await runWithConcurrency(urls, concurrency, (url) => scanPage(browser, url, options, rateLimiter));
+        return { pages };
+    }
+    finally {
+        if (launchedHere) {
+            await browser.close();
+        }
+    }
+}
+async function scanPage(browser, url, options, rateLimiter) {
+    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const retries = options.retries ?? DEFAULT_RETRIES;
+    const host = safeHost(url);
+    let lastError;
+    for (let attempt = 0; attempt <= retries; attempt += 1) {
+        if (host !== null) {
+            await rateLimiter.wait(host);
+        }
+        const context = await browser.newContext({ userAgent: USER_AGENT });
+        try {
+            const page = await context.newPage();
+            await page.goto(url, { waitUntil: 'load', timeout: timeoutMs });
+            const results = await new AxeBuilder({ page }).withTags([...options.wcagTags]).analyze();
+            return {
+                status: 'ok',
+                url,
+                violations: results.violations.map(mapFinding),
+                incomplete: results.incomplete.map(mapFinding),
+            };
+        }
+        catch (error) {
+            lastError = error;
+        }
+        finally {
+            await context.close();
+        }
+    }
+    return {
+        status: 'error',
+        url,
+        error: lastError instanceof Error ? lastError.message : String(lastError),
+    };
+}
+function safeHost(url) {
+    try {
+        return new URL(url).host;
+    }
+    catch {
+        return null;
+    }
+}
+function mapFinding(result) {
+    return {
+        ruleId: result.id,
+        tags: result.tags,
+        impact: result.impact ?? null,
+        description: result.description,
+        help: result.help,
+        helpUrl: result.helpUrl,
+        nodes: result.nodes.map((node) => ({
+            target: node.target,
+            html: node.html,
+            failureSummary: node.failureSummary ?? null,
+        })),
+    };
+}
+//# sourceMappingURL=scan.js.map

package/dist/scan/scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.js","sourceRoot":"","sources":["../../src/scan/scan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAElD,OAAO,EAAgB,QAAQ,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAGrD,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,eAAe,GAAG,CAAC,CAAC;AAC1B,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAC9B,MAAM,0BAA0B,GAAG,KAAK,CAAC;AAEzC,MAAM,CAAC,KAAK,UAAU,IAAI,CACxB,IAAuB,EACvB,OAAoB,EACpB,OAAiB,EAAE;IAEnB,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,mBAAmB,CAAC;IAC/D,MAAM,WAAW,GAAG,IAAI,eAAe,CAAC,OAAO,CAAC,eAAe,IAAI,0BAA0B,CAAC,CAAC;IAE/F,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE,CAChE,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,CAAC,CAC7C,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC;YAAS,CAAC;QACT,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACxB,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,OAAgB,EAChB,GAAW,EACX,OAAoB,EACpB,WAA4B;IAE5B,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC1D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,eAAe,CAAC;IACnD,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAE3B,IAAI,SAAkB,CAAC;IACvB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,OAAO,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QACvD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,MAAM,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;YACrC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;YAChE,MAAM,OAAO,GAAG,MAAM,IAAI,UAAU,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACzF,OAAO;gBACL,MAAM,EAAE,IAAI;gBACZ,GAAG;gBACH,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC;gBAC9C,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC;aAC/C,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,SAAS,GAAG,KAAK,CAAC;QACpB,CAAC;gBAAS,CAAC;YACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACxB,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM,EAAE,OAAO;QACf,GAAG;QACH,KAAK,EAAE,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;KAC1E,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,MAAiC;IACnD,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,EAAE;QACjB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI;QAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACjC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,IAAI;SAC5C,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC"}

package/dist/scan/types.d.ts

@@ -0,0 +1,56 @@
+import type { ImpactValue, UnlabelledFrameSelector } from 'axe-core';
+import type { Browser } from 'playwright';
+export interface ScanNode {
+    readonly target: UnlabelledFrameSelector;
+    readonly html: string;
+    readonly failureSummary: string | null;
+}
+export interface ScanFinding {
+    readonly ruleId: string;
+    /**
+     * The axe-core rule's tags, verbatim. Carries the standards mapping the
+     * report layer turns into clauses: `wcag<digits>` (a WCAG success
+     * criterion), `EN-9.x.x.x` (an EN 301 549 clause), plus category and
+     * ruleset markers. See `src/report/clauses.ts`.
+     */
+    readonly tags: readonly string[];
+    readonly impact: ImpactValue;
+    readonly description: string;
+    readonly help: string;
+    readonly helpUrl: string;
+    readonly nodes: readonly ScanNode[];
+}
+export interface PageScanSuccess {
+    readonly status: 'ok';
+    readonly url: string;
+    readonly violations: readonly ScanFinding[];
+    readonly incomplete: readonly ScanFinding[];
+}
+export interface PageScanFailure {
+    readonly status: 'error';
+    readonly url: string;
+    readonly error: string;
+}
+export type PageScanResult = PageScanSuccess | PageScanFailure;
+export interface ScanResult {
+    readonly pages: readonly PageScanResult[];
+}
+export interface ScanOptions {
+    readonly wcagTags: readonly string[];
+    /** Navigation timeout per attempt, in milliseconds. Defaults to 15000. */
+    readonly timeoutMs?: number;
+    /** Extra attempts after the first one fails. Defaults to 1 (two attempts total). */
+    readonly retries?: number;
+    /** Maximum number of pages scanned in parallel. Defaults to 3. */
+    readonly concurrency?: number;
+    /** Minimum time between two requests to the same host, in milliseconds. Defaults to 1000. */
+    readonly hostRateLimitMs?: number;
+}
+export interface ScanDeps {
+    /**
+     * Reuse an already-launched browser instead of launching one per call.
+     * The caller owns its lifecycle: `scan` never closes a browser it did
+     * not launch. Each page still gets its own fresh, isolated context.
+     */
+    readonly browser?: Browser;
+}

package/dist/scan/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/scan/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/scan/types.ts"],"names":[],"mappings":""}

package/dist/shared/index.d.ts

@@ -0,0 +1,4 @@
+export { type ToolInfo, toolInfo } from './package-info.js';
+export { runWithConcurrency } from './pool.js';
+export { HostRateLimiter } from './rate-limiter.js';
+export { fetchWithUserAgent, USER_AGENT } from './user-agent.js';

package/dist/shared/index.js

@@ -0,0 +1,5 @@
+export { toolInfo } from './package-info.js';
+export { runWithConcurrency } from './pool.js';
+export { HostRateLimiter } from './rate-limiter.js';
+export { fetchWithUserAgent, USER_AGENT } from './user-agent.js';
+//# sourceMappingURL=index.js.map

package/dist/shared/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/shared/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/shared/package-info.d.ts

@@ -0,0 +1,10 @@
+export interface ToolInfo {
+    readonly name: string;
+    readonly version: string;
+}
+/**
+ * The tool's own name and version, read once from the package manifest that
+ * ships next to the compiled code. Used to stamp reports and to answer
+ * `--version`.
+ */
+export declare function toolInfo(): ToolInfo;

package/dist/shared/package-info.js

@@ -0,0 +1,11 @@
+import { readFileSync } from 'node:fs';
+/**
+ * The tool's own name and version, read once from the package manifest that
+ * ships next to the compiled code. Used to stamp reports and to answer
+ * `--version`.
+ */
+export function toolInfo() {
+    const pkg = JSON.parse(readFileSync(new URL('../../package.json', import.meta.url), 'utf8'));
+    return { name: pkg.name ?? 'bfsg-scanner', version: pkg.version ?? '0.0.0' };
+}
+//# sourceMappingURL=package-info.js.map

package/dist/shared/package-info.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-info.js","sourceRoot":"","sources":["../../src/shared/package-info.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAOvC;;;;GAIG;AACH,MAAM,UAAU,QAAQ;IACtB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAG1F,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,cAAc,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,OAAO,EAAE,CAAC;AAC/E,CAAC"}

package/dist/shared/pool.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Runs `worker` over `items` with at most `concurrency` calls in flight at
+ * once. Results are returned in input order regardless of completion order,
+ * so callers that care about stable output (e.g. per-page scan results)
+ * don't need to sort anything themselves.
+ */
+export declare function runWithConcurrency<T, R>(items: readonly T[], concurrency: number, worker: (item: T, index: number) => Promise<R>): Promise<R[]>;

package/dist/shared/pool.js

@@ -0,0 +1,25 @@
+/**
+ * Runs `worker` over `items` with at most `concurrency` calls in flight at
+ * once. Results are returned in input order regardless of completion order,
+ * so callers that care about stable output (e.g. per-page scan results)
+ * don't need to sort anything themselves.
+ */
+export async function runWithConcurrency(items, concurrency, worker) {
+    const results = new Array(items.length);
+    let nextIndex = 0;
+    async function runWorker() {
+        for (;;) {
+            const index = nextIndex;
+            nextIndex += 1;
+            if (index >= items.length) {
+                return;
+            }
+            const item = items[index];
+            results[index] = await worker(item, index);
+        }
+    }
+    const workerCount = Math.max(1, Math.min(concurrency, items.length));
+    await Promise.all(Array.from({ length: workerCount }, () => runWorker()));
+    return results;
+}
+//# sourceMappingURL=pool.js.map

package/dist/shared/pool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pool.js","sourceRoot":"","sources":["../../src/shared/pool.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAmB,EACnB,WAAmB,EACnB,MAA8C;IAE9C,MAAM,OAAO,GAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,KAAK,UAAU,SAAS;QACtB,SAAS,CAAC;YACR,MAAM,KAAK,GAAG,SAAS,CAAC;YACxB,SAAS,IAAI,CAAC,CAAC;YACf,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC1B,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAM,CAAC;YAC/B,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACrE,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IAE1E,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/shared/rate-limiter.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Spaces out requests to the same host by at least `intervalMs`, so a
+ * concurrency pool of several workers never bursts a target server with
+ * simultaneous requests. Different hosts are independent of one another.
+ */
+export declare class HostRateLimiter {
+    private readonly intervalMs;
+    private readonly nextAvailableAt;
+    constructor(intervalMs?: number);
+    wait(host: string): Promise<void>;
+}

package/dist/shared/rate-limiter.js

@@ -0,0 +1,26 @@
+/**
+ * Spaces out requests to the same host by at least `intervalMs`, so a
+ * concurrency pool of several workers never bursts a target server with
+ * simultaneous requests. Different hosts are independent of one another.
+ */
+export class HostRateLimiter {
+    intervalMs;
+    nextAvailableAt = new Map();
+    constructor(intervalMs = 1000) {
+        this.intervalMs = intervalMs;
+    }
+    async wait(host) {
+        const now = Date.now();
+        const earliest = this.nextAvailableAt.get(host) ?? now;
+        const scheduledAt = Math.max(now, earliest);
+        this.nextAvailableAt.set(host, scheduledAt + this.intervalMs);
+        const delay = scheduledAt - now;
+        if (delay > 0) {
+            await sleep(delay);
+        }
+    }
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+//# sourceMappingURL=rate-limiter.js.map

package/dist/shared/rate-limiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.js","sourceRoot":"","sources":["../../src/shared/rate-limiter.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,OAAO,eAAe;IACT,UAAU,CAAS;IACnB,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE7D,YAAY,UAAU,GAAG,IAAI;QAC3B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAY;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;QACvD,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC5C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;QAE9D,MAAM,KAAK,GAAG,WAAW,GAAG,GAAG,CAAC;QAChC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;CACF;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC"}

package/dist/shared/user-agent.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Sent on every request the scanner makes — Playwright navigations and the
+ * plain fetch() calls used for sitemap/robots.txt/crawl discovery — so a
+ * site operator can identify, and if they choose, block traffic from this
+ * tool. Never omit it and never spoof a real browser's User-Agent.
+ */
+export declare const USER_AGENT = "bfsg-scanner (+https://github.com/MihaelaAghirculesei/bfsg-scanner)";
+/** Default fetch for discovery (sitemap/robots.txt/crawl): identical to the
+ * global fetch, but always carries USER_AGENT. Tests inject their own
+ * fetchFn and bypass this. */
+export declare const fetchWithUserAgent: typeof fetch;

package/dist/shared/user-agent.js

@@ -0,0 +1,12 @@
+/**
+ * Sent on every request the scanner makes — Playwright navigations and the
+ * plain fetch() calls used for sitemap/robots.txt/crawl discovery — so a
+ * site operator can identify, and if they choose, block traffic from this
+ * tool. Never omit it and never spoof a real browser's User-Agent.
+ */
+export const USER_AGENT = 'bfsg-scanner (+https://github.com/MihaelaAghirculesei/bfsg-scanner)';
+/** Default fetch for discovery (sitemap/robots.txt/crawl): identical to the
+ * global fetch, but always carries USER_AGENT. Tests inject their own
+ * fetchFn and bypass this. */
+export const fetchWithUserAgent = (input, init) => fetch(input, { ...init, headers: { ...init?.headers, 'User-Agent': USER_AGENT } });
+//# sourceMappingURL=user-agent.js.map

package/dist/shared/user-agent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-agent.js","sourceRoot":"","sources":["../../src/shared/user-agent.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,qEAAqE,CAAC;AAEhG;;8BAE8B;AAC9B,MAAM,CAAC,MAAM,kBAAkB,GAAiB,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAC9D,KAAK,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC"}

package/docs/SCANNING-ETHICS.md

@@ -0,0 +1,52 @@
+# Responsible use
+
+`bfsg-scanner` drives a real browser against whatever URL you give it and
+follows links across the site. That is ordinary web traffic, but it is
+traffic *you are causing to someone else's infrastructure*. Use it
+accordingly.
+
+## Scan only what you are allowed to scan
+
+Run it against:
+
+- sites you own or operate, or
+- sites you have explicit permission from the operator to test (a client
+  engagement, an employer's property, a written authorisation).
+
+Accessibility testing is not a licence to crawl arbitrary third-party sites.
+"It's just an audit" is not consent.
+
+## What the tool already does to be a good citizen
+
+- **Identifiable User-Agent.** Every request — page navigations and the
+  `fetch` calls for `sitemap.xml` / `robots.txt` / crawling — carries
+  `bfsg-scanner (+https://github.com/MihaelaAghirculesei/bfsg-scanner)`. It
+  never spoofs a real browser's User-Agent, so an operator can see it in
+  their logs and block it if they want to.
+- **Respects `robots.txt`.** The crawl obeys `Disallow` rules for its
+  User-Agent. If `robots.txt` disallows everything, the run discovers
+  nothing and exits `3`.
+- **Rate-limited per host** (default: one request per second per host) and
+  **bounded** (`maxPages`, default 50). Raise these only against
+  infrastructure you know can take it.
+
+Do not patch these safeguards out to scan a site that is trying to keep you
+out.
+
+## Handle the output carefully
+
+A report can contain substantial excerpts of the scanned site's markup —
+copy, structure, sometimes data. Treat `report.*` files and any list of
+client URLs as you would any other client material:
+
+- The repo's `.gitignore` already excludes `/reports/`, `/private/`,
+  `sites.private.*`, and `*.bfsg-report.*`. Keep it that way.
+- Don't paste report contents into public issues or chats without checking
+  what's in them.
+
+## Not legal advice
+
+A passing scan is evidence, not a legal conclusion. WCAG and EN 301 549
+cover only what automated tooling can check; conformance and the BFSG
+obligations around it are broader. Treat the report as one input to a
+compliance assessment, not the assessment itself.