blume 2.0.0 → 2.0.2

package/dist/cli/{chunk-j8mw0za6.js → chunk-hqp2ajnh.js}

@@ -19,28 +19,26 @@ import {
   writeAgentReport,
   fixPrompt,
   launchInstalledAgent
-} from "./chunk-bw22s759.js";
+} from "./chunk-6k4ftwze.js";
 import {
   frontmatter_default,
   gradeExternal,
   probeAll,
   deployPlatform
-} from "./chunk-xaz13gwg.js";
+} from "./chunk-v6ya5kcb.js";
 import {
   normalizeBasePath,
   normalizePath,
   withBasePath,
   stripBasePath
-} from "./chunk-jts8mvcz.js";
-import {
-  deployStaticDir
-} from "./chunk-nk3ts2xk.js";
+} from "./chunk-gs7r695n.js";
 import {
+  deployStaticDir,
   examplesRouteBase
-} from "./chunk-mnqj32sj.js";
+} from "./chunk-hr8ne106.js";
 import {
   scanProject
-} from "./chunk-zg2gtj10.js";
+} from "./chunk-5r8g91qn.js";
 
 // src/cli/commands/audit.ts
 import { defineCommand } from "citty";
@@ -71,6 +69,7 @@ var serverRoutes = (context) => {
   return mcp?.enabled ? [normalizePath(mcp.route)] : [];
 };
 var isServed = (context, path) => context.byUrl.has(path) || context.files.has(path) || context.files.has(`${path}/index.html`) || serverRoutes(context).includes(path);
+var underBase = (deployBase, path) => !deployBase || path === deployBase || path.startsWith(`${deployBase}/`);
 var NON_HTTP_SCHEME = /^(?!https?:)[a-z][a-z0-9+.-]*:/iu;
 var decodePath = (path) => {
   try {
@@ -79,6 +78,14 @@ var decodePath = (path) => {
     return path;
   }
 };
+var isHttpUrl = (input) => {
+  try {
+    const { protocol } = new URL(input);
+    return protocol === "http:" || protocol === "https:";
+  } catch {
+    return false;
+  }
+};
 var siteOrigin = (site) => {
   if (!site) {
     return null;
@@ -106,10 +113,14 @@ var resolveHref = (pageUrl, href, origin, deployBase = "") => {
       return { kind: "ignored" };
     }
     if (origin && parsed.origin === origin) {
+      const served = decodePath(parsed.pathname);
+      if (!underBase(deployBase, served)) {
+        return { kind: "outside-base", path: normalizePath(served) };
+      }
       return {
         hash: parsed.hash.slice(1),
         kind: "self-origin",
-        path: normalizePath(stripBasePath(deployBase, decodePath(parsed.pathname)))
+        path: normalizePath(stripBasePath(deployBase, served))
       };
     }
     return { kind: "external", url: parsed.toString() };
@@ -121,14 +132,19 @@ var resolveHref = (pageUrl, href, origin, deployBase = "") => {
   } catch {
     return { kind: "ignored" };
   }
+  const served = decodePath(resolved.pathname);
+  if (target.startsWith("/") && !underBase(deployBase, served)) {
+    return { kind: "outside-base", path: normalizePath(served) };
+  }
   return {
     hash: resolved.hash.slice(1),
     kind: "internal",
-    path: normalizePath(stripBasePath(deployBase, decodePath(resolved.pathname)))
+    path: normalizePath(stripBasePath(deployBase, served))
   };
 };
 
 // src/audit/checks/assets.ts
+var VERCEL_IMAGE_ENDPOINT = "/_vercel/image";
 var formatBytes = (bytes) => bytes < 1024 * 1024 ? `${Math.round(bytes / 1024)} kB` : `${(bytes / 1024 / 1024).toFixed(1)} MB`;
 var resolveAsset = (context, page, asset, missingId, kind, found) => {
   if (asset.src.startsWith("http://")) {
@@ -139,10 +155,18 @@ var resolveAsset = (context, page, asset, missingId, kind, found) => {
     return null;
   }
   const origin = siteOrigin(context.project.config.deployment.options.site);
-  const resolved = resolveHref(page.url, asset.src, origin, normalizeBasePath(context.project.config.deployment.options.base));
+  const deployBase = normalizeBasePath(context.project.config.deployment.options.base);
+  const resolved = resolveHref(page.url, asset.src, origin, deployBase);
   if (resolved.kind === "external" || resolved.kind === "ignored") {
     return null;
   }
+  if (resolved.path === VERCEL_IMAGE_ENDPOINT) {
+    return null;
+  }
+  if (resolved.kind === "outside-base") {
+    found.push(finding(missingId, pageSite(context, page), `Page references ${asset.src}, which is missing deployment.base (${deployBase}), so the deployed site does not serve it.`));
+    return null;
+  }
   const bytes = context.files.get(resolved.path);
   if (bytes === undefined) {
     found.push(finding(missingId, pageSite(context, page), `Page references ${asset.src}, which is not in the build.`));
@@ -214,6 +238,9 @@ var frontmatterDate = (source) => {
     return null;
   }
 };
+var isGeneratedReference = (page) => page.route?.source.name === "openapi";
+var GENERATED_TITLE_FIX = "This page is generated from an API spec, which titles it with the operation's `summary` (the spec's own title on the overview page) — rewrite it there.";
+var GENERATED_DESCRIPTION_FIX = "This page is generated from an API spec, which describes it with the operation's `description` or `summary` (the spec's own description on the overview page) — rewrite it there.";
 var titleChecks = (context, page) => {
   const { titleMin, titleMax } = context.thresholds;
   const [title] = page.titles;
@@ -229,7 +256,7 @@ var titleChecks = (context, page) => {
   const width = stringWidth(title.replaceAll(WHITESPACE, " "));
   if (width > titleMax || width < titleMin) {
     const direction = width > titleMax ? "long" : "short";
-    found.push(finding("BLUME_AUDIT_TITLE_LENGTH", pageSite(context, page, ["title"]), `Title renders ${width} columns wide — too ${direction} (aim for ${titleMin}–${titleMax}).`));
+    found.push(finding("BLUME_AUDIT_TITLE_LENGTH", pageSite(context, page, ["title"]), `Title renders ${width} columns wide — too ${direction} (aim for ${titleMin}–${titleMax}).`, isGeneratedReference(page) ? GENERATED_TITLE_FIX : undefined));
   }
   return found;
 };
@@ -251,7 +278,7 @@ var descriptionChecks = (context, page) => {
   const width = stringWidth(description.replaceAll(WHITESPACE, " "));
   if (width > descriptionMax || width < descriptionMin) {
     const direction = width > descriptionMax ? "long" : "short";
-    found.push(finding("BLUME_AUDIT_DESCRIPTION_LENGTH", pageSite(context, page, ["description"]), `Meta description renders ${width} columns wide — too ${direction} (aim for ${descriptionMin}–${descriptionMax}).`));
+    found.push(finding("BLUME_AUDIT_DESCRIPTION_LENGTH", pageSite(context, page, ["description"]), `Meta description renders ${width} columns wide — too ${direction} (aim for ${descriptionMin}–${descriptionMax}).`, isGeneratedReference(page) ? GENERATED_DESCRIPTION_FIX : undefined));
   }
   return found;
 };
@@ -467,6 +494,94 @@ var duplicateChecks = {
   tier: "static"
 };
 
+// src/audit/checks/indexability.ts
+var parseCanonical = (canonical) => {
+  try {
+    return new URL(canonical);
+  } catch {
+    return null;
+  }
+};
+var isArchivedLatestCanonical = (context, page, target) => {
+  const version = page.route?.version;
+  const archived = version ? context.project.config.versions?.archived.find((entry) => entry.id === version) : undefined;
+  const latestAlternate = page.route?.versionAlternates.find((alternate) => alternate.version === "");
+  return archived?.canonical === "latest" && latestAlternate !== undefined && normalizePath(latestAlternate.path) === target;
+};
+var canonicalChecks = (context, page) => {
+  const { site } = context.project.config.deployment.options;
+  const origin = siteOrigin(site);
+  if (ERROR_ROUTES.has(page.url)) {
+    return [];
+  }
+  if (!page.canonical) {
+    return site && page.indexable ? [
+      finding("BLUME_AUDIT_CANONICAL_MISSING", pageSite(context, page), "Page has no canonical URL.")
+    ] : [];
+  }
+  const canonical = parseCanonical(page.canonical);
+  if (!canonical) {
+    return [
+      finding("BLUME_AUDIT_CANONICAL_BAD_TARGET", pageSite(context, page, ["seo", "canonical"]), `Canonical "${page.canonical}" is not a valid absolute URL.`)
+    ];
+  }
+  const found = [];
+  if (origin && canonical.origin !== origin) {
+    const sameHost = canonical.host === new URL(origin).host;
+    if (sameHost) {
+      found.push(finding("BLUME_AUDIT_CANONICAL_PROTOCOL_MISMATCH", pageSite(context, page, ["seo", "canonical"]), `Canonical uses ${canonical.protocol}// but the site is ${new URL(origin).protocol}//.`));
+    }
+    return found;
+  }
+  const target = normalizePath(stripBasePath(normalizeBasePath(context.project.config.deployment.options.base), decodePath(canonical.pathname)));
+  if (target === normalizePath(page.url)) {
+    return found;
+  }
+  const redirect = context.redirects.find((entry) => normalizePath(entry.from) === target);
+  if (redirect) {
+    found.push(finding("BLUME_AUDIT_CANONICAL_BAD_TARGET", pageSite(context, page, ["seo", "canonical"]), `Canonical points at ${target}, which is a redirect to ${redirect.to}.`));
+  } else if (context.byUrl.has(target)) {
+    if (!(page.route?.fallback === true || isArchivedLatestCanonical(context, page, target))) {
+      found.push(finding("BLUME_AUDIT_CANONICAL_NOT_SELF", pageSite(context, page, ["seo", "canonical"]), `Page declares ${target} as its canonical, so it will not be indexed itself.`));
+    }
+  } else {
+    found.push(finding("BLUME_AUDIT_CANONICAL_BAD_TARGET", pageSite(context, page, ["seo", "canonical"]), `Canonical points at ${target}, which is not a page on this site.`));
+  }
+  return found;
+};
+var indexabilityChecks = {
+  category: "indexability",
+  run(context) {
+    const found = [];
+    if (!context.project.config.deployment.options.site) {
+      const { deployment } = context.project.config;
+      const site = {
+        file: context.project.context.configFile ?? undefined,
+        url: "/"
+      };
+      found.push(deployPlatform(deployment).env ? finding("BLUME_AUDIT_SITE_INFERRED_AT_DEPLOY", site, `deployment.site is not set in this build — on ${deployment.kind} it is inferred from the platform env at deploy time, so canonical URLs, Open Graph images, and the sitemap are only missing from this local artifact.`) : finding("BLUME_AUDIT_SITE_NOT_SET", site, "deployment.site is not set, so no canonical URLs, Open Graph images, or sitemap can be generated."));
+    }
+    for (const page of context.pages) {
+      found.push(...canonicalChecks(context, page));
+      if (page.robots && !page.indexable && !ERROR_ROUTES.has(page.url)) {
+        found.push(finding("BLUME_AUDIT_ROBOTS_META_UNEXPECTED", pageSite(context, page, ["noindex"]), `Page declares robots "${page.robots}" and will not be indexed.`));
+        if (!page.indexable && page.canonical) {
+          found.push(finding("BLUME_AUDIT_CANONICAL_ON_NOINDEX", pageSite(context, page, ["noindex"]), `Page is noindex but declares ${page.canonical} as its canonical.`));
+        }
+      }
+      if (page.route?.draft) {
+        found.push(finding("BLUME_AUDIT_DRAFT_PAGE_PUBLISHED", pageSite(context, page, ["draft"]), `${page.url} is marked draft in its front matter but is in the build.`));
+      }
+      if (page.bytes > context.thresholds.maxHtmlBytes) {
+        const mb = (page.bytes / 1024 / 1024).toFixed(1);
+        found.push(finding("BLUME_AUDIT_HTML_TOO_LARGE", pageSite(context, page), `Page HTML is ${mb} MB — past Googlebot's 2 MB limit, the rest is not crawled.`));
+      }
+    }
+    return found;
+  },
+  tier: "static"
+};
+
 // src/audit/checks/i18n.ts
 var deployBaseOf = (context) => normalizeBasePath(context.project.config.deployment.options.base);
 var X_DEFAULT = "x-default";
@@ -480,11 +595,22 @@ var isValidBcp47 = (tag) => {
 };
 var alternatePath = (href, deployBase) => {
   try {
-    return normalizePath(stripBasePath(deployBase, new URL(href).pathname));
+    return normalizePath(stripBasePath(deployBase, decodePath(new URL(href).pathname)));
   } catch {
     return null;
   }
 };
+var isFallbackCopy = (page) => page.route?.fallback === true;
+var canonicalizesElsewhere = (context, target, deployBase) => {
+  if (!target.canonical) {
+    return false;
+  }
+  const canonical = alternatePath(target.canonical, deployBase);
+  if (canonical === normalizePath(target.url)) {
+    return false;
+  }
+  return !(canonical !== null && isArchivedLatestCanonical(context, target, canonical));
+};
 var langChecks = (context, page) => {
   if (!page.lang) {
     return [
@@ -521,7 +647,7 @@ var hreflangChecks = (context, page) => {
       found.push(finding("BLUME_AUDIT_HREFLANG_BAD_TARGET", pageSite(context, page), `hreflang="${alternate.lang}" points at ${path}, which redirects to ${redirect.to}.`));
     } else if (!target) {
       found.push(finding("BLUME_AUDIT_HREFLANG_BAD_TARGET", pageSite(context, page), `hreflang="${alternate.lang}" points at ${path}, which the build does not serve.`));
-    } else if (target.canonical && alternatePath(target.canonical, deployBase) !== normalizePath(target.url)) {
+    } else if (canonicalizesElsewhere(context, target, deployBase)) {
       found.push(finding("BLUME_AUDIT_HREFLANG_BAD_TARGET", pageSite(context, page), `hreflang="${alternate.lang}" points at ${path}, which canonicalizes elsewhere.`));
     }
   }
@@ -547,6 +673,9 @@ var returnTagChecks = (context) => {
   const found = [];
   const deployBase = deployBaseOf(context);
   for (const page of context.pages) {
+    if (isFallbackCopy(page)) {
+      continue;
+    }
     for (const alternate of page.hreflang) {
       if (alternate.lang === X_DEFAULT) {
         continue;
@@ -573,7 +702,7 @@ var i18nChecks = {
     const found = [];
     for (const page of context.pages) {
       found.push(...langChecks(context, page));
-      if (page.hreflang.length > 0) {
+      if (page.hreflang.length > 0 && !isFallbackCopy(page)) {
         found.push(...hreflangChecks(context, page));
       }
     }
@@ -583,92 +712,6 @@ var i18nChecks = {
   tier: "static"
 };
 
-// src/audit/checks/indexability.ts
-var parseCanonical = (canonical) => {
-  try {
-    return new URL(canonical);
-  } catch {
-    return null;
-  }
-};
-var canonicalChecks = (context, page) => {
-  const { site } = context.project.config.deployment.options;
-  const origin = siteOrigin(site);
-  if (ERROR_ROUTES.has(page.url)) {
-    return [];
-  }
-  if (!page.canonical) {
-    return site ? [
-      finding("BLUME_AUDIT_CANONICAL_MISSING", pageSite(context, page), "Page has no canonical URL.")
-    ] : [];
-  }
-  const canonical = parseCanonical(page.canonical);
-  if (!canonical) {
-    return [
-      finding("BLUME_AUDIT_CANONICAL_BAD_TARGET", pageSite(context, page, ["seo", "canonical"]), `Canonical "${page.canonical}" is not a valid absolute URL.`)
-    ];
-  }
-  const found = [];
-  if (origin && canonical.origin !== origin) {
-    const sameHost = canonical.host === new URL(origin).host;
-    if (sameHost) {
-      found.push(finding("BLUME_AUDIT_CANONICAL_PROTOCOL_MISMATCH", pageSite(context, page, ["seo", "canonical"]), `Canonical uses ${canonical.protocol}// but the site is ${new URL(origin).protocol}//.`));
-    }
-    return found;
-  }
-  const target = normalizePath(stripBasePath(normalizeBasePath(context.project.config.deployment.options.base), decodePath(canonical.pathname)));
-  if (target === normalizePath(page.url)) {
-    return found;
-  }
-  const redirect = context.redirects.find((entry) => normalizePath(entry.from) === target);
-  if (redirect) {
-    found.push(finding("BLUME_AUDIT_CANONICAL_BAD_TARGET", pageSite(context, page, ["seo", "canonical"]), `Canonical points at ${target}, which is a redirect to ${redirect.to}.`));
-  } else if (context.byUrl.has(target)) {
-    const version = page.route?.version;
-    const archived = version ? context.project.config.versions?.archived.find((entry) => entry.id === version) : undefined;
-    const latestAlternate = page.route?.versionAlternates.find((alternate) => alternate.version === "");
-    const intentional = archived?.canonical === "latest" && latestAlternate !== undefined && normalizePath(latestAlternate.path) === target;
-    if (!intentional) {
-      found.push(finding("BLUME_AUDIT_CANONICAL_NOT_SELF", pageSite(context, page, ["seo", "canonical"]), `Page declares ${target} as its canonical, so it will not be indexed itself.`));
-    }
-  } else {
-    found.push(finding("BLUME_AUDIT_CANONICAL_BAD_TARGET", pageSite(context, page, ["seo", "canonical"]), `Canonical points at ${target}, which is not a page on this site.`));
-  }
-  return found;
-};
-var indexabilityChecks = {
-  category: "indexability",
-  run(context) {
-    const found = [];
-    if (!context.project.config.deployment.options.site) {
-      const { deployment } = context.project.config;
-      const site = {
-        file: context.project.context.configFile ?? undefined,
-        url: "/"
-      };
-      found.push(deployPlatform(deployment).env ? finding("BLUME_AUDIT_SITE_INFERRED_AT_DEPLOY", site, `deployment.site is not set in this build — on ${deployment.kind} it is inferred from the platform env at deploy time, so canonical URLs, Open Graph images, and the sitemap are only missing from this local artifact.`) : finding("BLUME_AUDIT_SITE_NOT_SET", site, "deployment.site is not set, so no canonical URLs, Open Graph images, or sitemap can be generated."));
-    }
-    for (const page of context.pages) {
-      found.push(...canonicalChecks(context, page));
-      if (page.robots && !page.indexable && !ERROR_ROUTES.has(page.url)) {
-        found.push(finding("BLUME_AUDIT_ROBOTS_META_UNEXPECTED", pageSite(context, page, ["noindex"]), `Page declares robots "${page.robots}" and will not be indexed.`));
-        if (!page.indexable && page.canonical) {
-          found.push(finding("BLUME_AUDIT_CANONICAL_ON_NOINDEX", pageSite(context, page, ["noindex"]), `Page is noindex but declares ${page.canonical} as its canonical.`));
-        }
-      }
-      if (page.route?.draft) {
-        found.push(finding("BLUME_AUDIT_DRAFT_PAGE_PUBLISHED", pageSite(context, page, ["draft"]), `${page.url} is marked draft in its front matter but is in the build.`));
-      }
-      if (page.bytes > context.thresholds.maxHtmlBytes) {
-        const mb = (page.bytes / 1024 / 1024).toFixed(1);
-        found.push(finding("BLUME_AUDIT_HTML_TOO_LARGE", pageSite(context, page), `Page HTML is ${mb} MB — past Googlebot's 2 MB limit, the rest is not crawled.`));
-      }
-    }
-    return found;
-  },
-  tier: "static"
-};
-
 // src/audit/graph.ts
 var add = (map, key, value) => {
   const existing = map.get(key);
@@ -746,6 +789,14 @@ var linkChecks = {
       if (resolved.kind === "external" || resolved.kind === "ignored") {
         return;
       }
+      if (resolved.kind === "outside-base") {
+        if (link.content) {
+          found.push(finding("BLUME_AUDIT_LINK_TO_BROKEN", pageSite(context, page), `Link to ${link.href} is missing deployment.base (${deployBase}), so the deployed site does not serve it.`));
+        } else if (!brokenChrome.has(resolved.path)) {
+          brokenChrome.set(resolved.path, page);
+        }
+        return;
+      }
       const anchorTarget = resolved.hash ? context.byUrl.get(resolved.path) : undefined;
       if (anchorTarget) {
         checkAnchor(page, link, anchorTarget, resolved.hash);
@@ -858,7 +909,7 @@ var llmsChecks = {
     }
     for (const page of context.pages) {
       const { route } = page;
-      if (!route || route.hidden || route.draft || !page.indexable || ERROR_ROUTES.has(page.url) || !openapi && route.source.name === "openapi" || listed.has(normalizePath(page.url))) {
+      if (!route || route.hidden || route.draft || route.aiExclude || route.fallback || !page.indexable || ERROR_ROUTES.has(page.url) || !openapi && route.source.name === "openapi" || listed.has(normalizePath(page.url))) {
         continue;
       }
       found.push(finding("BLUME_AUDIT_LLMS_TXT_PAGE_MISSING", pageSite(context, page), `${page.url} is built and indexable but is not listed in llms.txt.`));
@@ -934,7 +985,7 @@ var networkChecks = {
       found.push(...servedPageChecks(context, page, result, origin));
     }
     const robots = results.get(robotsUrl);
-    if (robots && !robots.ok) {
+    if (context.project.config.seo.robots && robots && !robots.ok) {
       found.push(finding("BLUME_AUDIT_ROBOTS_NOT_ACCESSIBLE", { url: "/robots.txt" }, `robots.txt is not reachable at ${robotsUrl}.`));
     }
     const sitemap = results.get(sitemapUrl);
@@ -1046,6 +1097,10 @@ var ogImageChecks = {
       if (resolved.kind === "external" || resolved.kind === "ignored") {
         continue;
       }
+      if (resolved.kind === "outside-base") {
+        found.push(finding("BLUME_AUDIT_OG_IMAGE_BROKEN", pageSite(context, page, ["seo", "image"]), `og:image points at ${resolved.path}, which is missing deployment.base (${deployBase}), so the deployed site does not serve it.`));
+        continue;
+      }
       const { path } = resolved;
       if (!(context.files.has(path) || context.files.has(`${path}/index.html`))) {
         found.push(finding("BLUME_AUDIT_OG_IMAGE_BROKEN", pageSite(context, page, ["seo", "image"]), `og:image points at ${path}, which is not in the build.`));
@@ -1117,7 +1172,7 @@ var robotsChecks = {
       ];
     }
     const found = robots.invalid.map((line) => finding("BLUME_AUDIT_ROBOTS_INVALID", { file: robots.file, line: line.line, url: "/robots.txt" }, `robots.txt line ${line.line} is not a directive: "${line.text}"`));
-    if (site && robots.sitemaps.length === 0) {
+    if (site && context.project.config.seo.sitemap && robots.sitemaps.length === 0) {
       found.push(finding("BLUME_AUDIT_ROBOTS_SITEMAP_MISSING", { file: robots.file, url: "/robots.txt" }, "robots.txt does not declare a Sitemap."));
     }
     const parser = robotsParser(`${MATCH_ORIGIN}/robots.txt`, robots.raw);
@@ -1195,6 +1250,15 @@ var checkListedUrl = (context, loc, origin, file, deployBase) => {
   }
   return found;
 };
+var unlistedPages = (context, listed, deployBase) => context.pages.flatMap((page) => {
+  const canonical = page.canonical ? canonicalPath(page.canonical, deployBase) : null;
+  if (!page.indexable || page.route?.fallback || canonical && canonical !== normalizePath(page.url) || ERROR_ROUTES2.has(page.url) || listed.has(normalizePath(page.url))) {
+    return [];
+  }
+  return [
+    finding("BLUME_AUDIT_INDEXABLE_PAGE_NOT_IN_SITEMAP", pageSite(context, page), `${page.url} is built and indexable but is not listed in sitemap.xml.`)
+  ];
+});
 var sitemapChecks = {
   category: "sitemap",
   run(context) {
@@ -1210,11 +1274,21 @@ var sitemapChecks = {
     }
     const found = [];
     if (sitemap.error) {
-      found.push(finding("BLUME_AUDIT_SITEMAP_INVALID", { file: sitemap.file, url: "/sitemap.xml" }, `sitemap.xml is not a valid urlset: ${sitemap.error}`));
+      found.push(finding("BLUME_AUDIT_SITEMAP_INVALID", { file: sitemap.file, url: "/sitemap.xml" }, `sitemap.xml is not a valid urlset or sitemap index: ${sitemap.error}`));
       return found;
     }
-    if (sitemap.bytes > MAX_SITEMAP_BYTES || sitemap.urls.length > MAX_SITEMAP_URLS) {
-      found.push(finding("BLUME_AUDIT_SITEMAP_TOO_LARGE", { file: sitemap.file, url: "/sitemap.xml" }, `sitemap.xml holds ${sitemap.urls.length} URLs in ${Math.round(sitemap.bytes / 1024 / 1024)} MB.`));
+    const parts = sitemap.parts ?? [
+      {
+        bytes: sitemap.bytes,
+        file: sitemap.file,
+        url: "/sitemap.xml",
+        urls: sitemap.urls.length
+      }
+    ];
+    for (const part of parts) {
+      if (part.bytes > MAX_SITEMAP_BYTES || part.urls > MAX_SITEMAP_URLS) {
+        found.push(finding("BLUME_AUDIT_SITEMAP_TOO_LARGE", { file: part.file, url: part.url }, `${part.url.slice(1)} holds ${part.urls} URLs in ${Math.round(part.bytes / 1024 / 1024)} MB.`));
+      }
     }
     for (const [loc, lastmod] of sitemap.lastmod ?? []) {
       const time = Date.parse(lastmod);
@@ -1230,12 +1304,7 @@ var sitemapChecks = {
     for (const loc of sitemap.urls) {
       found.push(...checkListedUrl(context, loc, origin, sitemap.file, deployBase));
     }
-    for (const page of context.pages) {
-      if (!page.indexable || ERROR_ROUTES2.has(page.url) || listed.has(normalizePath(page.url))) {
-        continue;
-      }
-      found.push(finding("BLUME_AUDIT_INDEXABLE_PAGE_NOT_IN_SITEMAP", pageSite(context, page), `${page.url} is built and indexable but is not listed in sitemap.xml.`));
-    }
+    found.push(...unlistedPages(context, listed, deployBase));
     return found;
   },
   tier: "static"
@@ -1317,6 +1386,16 @@ var URL_STYLE = [
   { name: "underscores", test: /_/u },
   { name: "spaces", test: /%20| /u }
 ];
+var authoredPath = (context, url) => {
+  const { basePath, i18n } = context.project.config;
+  if (!i18n) {
+    return url;
+  }
+  const base = normalizeBasePath(basePath);
+  const [, first = "", ...rest] = stripBasePath(base, url).split("/");
+  const isLocale = i18n.locales.some((locale) => locale.code === first);
+  return isLocale ? `${base}/${rest.join("/")}` : url;
+};
 var DOTTED_HOST = /^\/\/[^/]*\./u;
 var doubledSlash = (href) => {
   if (href.startsWith("//")) {
@@ -1343,7 +1422,8 @@ var urlChecks = {
           doubled.set(href, page);
         }
       }
-      const untidy = URL_STYLE.filter((style) => style.test.test(page.url));
+      const authored = authoredPath(context, page.url);
+      const untidy = URL_STYLE.filter((style) => style.test.test(authored));
       if (untidy.length > 0) {
         found.push(finding("BLUME_AUDIT_URL_STYLE", pageSite(context, page), `URL ${page.url} contains ${untidy.map((style) => style.name).join(" and ")}.`));
       }
@@ -1538,6 +1618,7 @@ var sitemapParser = new XMLParser({
   removeNSPrefix: true
 });
 var isUrlsetElement = (value) => typeof value === "object" && value !== null;
+var isSitemapIndexElement = (value) => typeof value === "object" && value !== null;
 var isUrlEntry = (value) => typeof value === "object" && value !== null;
 var isText = (value) => typeof value === "string";
 var parseSitemap = (file, xml, bytes) => {
@@ -1549,8 +1630,14 @@ var parseSitemap = (file, xml, bytes) => {
     doc.error = "no <urlset> element";
     return doc;
   }
+  if (Object.hasOwn(parsed, "sitemapindex")) {
+    const { sitemapindex } = parsed;
+    const children = isSitemapIndexElement(sitemapindex) ? [sitemapindex.sitemap].flat() : [];
+    doc.sitemaps = children.flatMap((child) => isUrlEntry(child) && isText(child.loc) && child.loc.trim() ? [child.loc.trim()] : []);
+    return doc;
+  }
   if (!Object.hasOwn(parsed, "urlset")) {
-    doc.error = Object.hasOwn(parsed, "sitemapindex") ? "sitemap is an index, not a urlset" : "no <urlset> element";
+    doc.error = "no <urlset> element";
     return doc;
   }
   const { urlset } = parsed;
@@ -1615,8 +1702,47 @@ var readIfPresent = async (file) => {
     return null;
   }
 };
+var readSitemap = async (staticDir, files, deployBase) => {
+  const file = join2(staticDir, "sitemap.xml");
+  const xml = await readIfPresent(file);
+  if (xml === null) {
+    return null;
+  }
+  const doc = parseSitemap(file, xml, files.get("/sitemap.xml") ?? Buffer.byteLength(xml, "utf-8"));
+  if (!doc.sitemaps) {
+    return doc;
+  }
+  doc.parts = [];
+  for (const loc of doc.sitemaps) {
+    let url;
+    try {
+      url = stripBasePath(deployBase, decodeURI(new URL(loc).pathname));
+    } catch {
+      doc.error = `the sitemap index lists "${loc}", which is not a valid absolute URL`;
+      return doc;
+    }
+    const childFile = join2(staticDir, url);
+    const childXml = await readIfPresent(childFile);
+    const child = childXml === null ? null : parseSitemap(childFile, childXml, files.get(url) ?? Buffer.byteLength(childXml, "utf-8"));
+    if (!child || child.error || child.sitemaps) {
+      doc.error = `the sitemap index lists ${loc}, which is not a urlset in the build`;
+      return doc;
+    }
+    doc.urls.push(...child.urls);
+    for (const [key, value] of child.lastmod ?? []) {
+      doc.lastmod?.set(key, value);
+    }
+    doc.parts.push({
+      bytes: child.bytes,
+      file: childFile,
+      url,
+      urls: child.urls.length
+    });
+  }
+  return doc;
+};
 var crawlStaticDir = async (options) => {
-  const { staticDir, manifest, basePath } = options;
+  const { staticDir, manifest, basePath, deployBase = "" } = options;
   const routes = routeIndex(manifest, basePath);
   const htmlFiles = await glob("**/*.html", { absolute: true, cwd: staticDir });
   const snapshots = await pMap(htmlFiles.toSorted(), async (file) => {
@@ -1636,8 +1762,6 @@ var crawlStaticDir = async (options) => {
     });
   }, { concurrency: CRAWL_CONCURRENCY });
   const pages = snapshots.filter((page) => page !== null);
-  const sitemapFile = join2(staticDir, "sitemap.xml");
-  const sitemapXml = await readIfPresent(sitemapFile);
   const robotsFile = join2(staticDir, "robots.txt");
   const robotsTxt = await readIfPresent(robotsFile);
   const llmsFile = join2(staticDir, "llms.txt");
@@ -1648,7 +1772,7 @@ var crawlStaticDir = async (options) => {
     llms: llmsText === null ? null : parseLlms(llmsFile, llmsText),
     pages,
     robots: robotsTxt === null ? null : parseRobots(robotsFile, robotsTxt),
-    sitemap: sitemapXml === null ? null : parseSitemap(sitemapFile, sitemapXml, files.get("/sitemap.xml") ?? Buffer.byteLength(sitemapXml, "utf-8"))
+    sitemap: await readSitemap(staticDir, files, deployBase)
   };
 };
 
@@ -1775,6 +1899,7 @@ var runAudit = async (options) => {
   const basePath = normalizeBasePath(project.config.basePath);
   const crawl = await crawlStaticDir({
     basePath,
+    deployBase: normalizeBasePath(project.config.deployment.options.base),
     manifest: project.manifest,
     staticDir
   });
@@ -1916,7 +2041,7 @@ var auditCommand = defineCommand({
     }
     const agents = Object.keys(AGENTS).filter((kind) => args[kind]);
     if (agents.length > 1) {
-      logger.error("Pass at most one of --claude or --codex.");
+      logger.error("Pass at most one of --codex or --claude.");
       process.exit(1);
     }
     const [agent] = agents;
@@ -1924,6 +2049,10 @@ var auditCommand = defineCommand({
       logger.error(`--json and --${agent} are mutually exclusive.`);
       process.exit(1);
     }
+    if (args.url !== undefined && !isHttpUrl(args.url)) {
+      logger.error(`Invalid --url "${args.url}": pass the deployment's full URL, scheme included (e.g. https://${args.url}).`);
+      process.exit(1);
+    }
     const only = splitTerms(args.only);
     const skip = splitTerms(args.skip);
     rejectUnknownTerms([...only, ...skip]);
@@ -1985,5 +2114,5 @@ export {
   shouldFail
 };
 
-//# debugId=938D6EDE48FC146464756E2164756E21
-//# sourceMappingURL=chunk-j8mw0za6.js.map
+//# debugId=B39D0173C92838E764756E2164756E21
+//# sourceMappingURL=chunk-hqp2ajnh.js.map