eaa-kit 0.1.0 → 0.2.0

package/dist/project-CiyzKQud.js

@@ -0,0 +1,258 @@
+import { readFile, stat } from "node:fs/promises";
+import path from "node:path";
+import { glob } from "tinyglobby";
+import { spawn } from "node:child_process";
+//#region src/audit/project.ts
+/**
+* Working out what to audit when nobody said.
+*
+* `eaa-kit audit ./dist` assumes the reader knows which directory their builder
+* fills, that it has been built, and that it produces HTML at all — three
+* assumptions that are wrong often enough to be the main thing standing between
+* installing this tool and getting a report out of it. A Next.js project fails
+* all three at once.
+*
+* So with no directory and no --url, the tool works it out: an existing build
+* output if there is one, the project's own build if there is not, and the
+* project's server if the build produces nothing browsable. Naming a directory
+* or passing --url skips all of it.
+*/
+/** Build output directories, in the order worth trying them. */
+const BUILD_DIRECTORIES = [
+	"dist",
+	"out",
+	"build",
+	"_site",
+	".output/public",
+	"public"
+];
+/** Ports the common dev and preview servers use, tried if nothing is announced. */
+const KNOWN_PORTS = [
+	3e3,
+	4321,
+	5173,
+	8080,
+	4173,
+	3001
+];
+/** How long to wait for a started server to answer. */
+const SERVER_START_TIMEOUT_MS = 9e4;
+async function readPackageJson(cwd) {
+	try {
+		return JSON.parse(await readFile(path.join(cwd, "package.json"), "utf8"));
+	} catch {
+		return;
+	}
+}
+/**
+* The package manager this project uses, from its lockfile.
+*
+* Running the wrong one either fails or, worse, silently installs a second
+* dependency tree, so the lockfile decides rather than a guess.
+*/
+async function detectPackageManager(cwd) {
+	for (const [file, manager] of [
+		["pnpm-lock.yaml", "pnpm"],
+		["yarn.lock", "yarn"],
+		["bun.lockb", "bun"]
+	]) try {
+		await stat(path.join(cwd, file));
+		return manager;
+	} catch {}
+	return "npm";
+}
+/**
+* The first build directory that exists and actually holds HTML.
+*
+* Existence alone is not enough: `.next/` exists after any Next.js build and
+* holds no browsable page, and `public/` exists in most projects and holds
+* assets. What makes a directory the build output is that there is HTML in it.
+*/
+async function findBuildOutput(cwd) {
+	for (const candidate of BUILD_DIRECTORIES) {
+		const directory = path.join(cwd, candidate);
+		try {
+			if (!(await stat(directory)).isDirectory()) continue;
+		} catch {
+			continue;
+		}
+		if ((await glob(["**/*.html", "**/*.htm"], {
+			cwd: directory,
+			ignore: ["**/node_modules/**"],
+			onlyFiles: true,
+			dot: false
+		})).length > 0) return directory;
+	}
+}
+/**
+* Run one of the project's own scripts and wait for it.
+*
+* stdio is inherited so the build's output goes where the user expects it. This
+* runs project code, which is what a build-time tool does — the Astro
+* integration already audits from inside one — but it is announced first and
+* `--no-build` turns it off.
+*/
+async function runScript(cwd, script) {
+	const manager = await detectPackageManager(cwd);
+	const command = `${manager} run ${script}`;
+	return new Promise((resolve) => {
+		const child = spawn(manager, ["run", script], {
+			cwd,
+			stdio: [
+				"ignore",
+				"inherit",
+				"inherit"
+			],
+			shell: process.platform === "win32"
+		});
+		child.on("error", () => resolve({
+			ok: false,
+			command
+		}));
+		child.on("close", (code) => resolve({
+			ok: code === 0,
+			command
+		}));
+	});
+}
+/** Whether something is answering HTTP there yet. */
+async function answers(origin) {
+	try {
+		const controller = new AbortController();
+		const timer = setTimeout(() => controller.abort(), 2e3);
+		try {
+			await fetch(origin, { signal: controller.signal });
+			return true;
+		} finally {
+			clearTimeout(timer);
+		}
+	} catch {
+		return false;
+	}
+}
+/**
+* Start the project's server and wait until it answers.
+*
+* The origin is taken from whatever the server prints, since a project may be
+* on any port, and only falls back to probing the common ones. Returns undefined
+* if nothing came up before the timeout, having already stopped the process.
+*/
+async function startServer(cwd, script) {
+	const manager = await detectPackageManager(cwd);
+	const child = spawn(manager, ["run", script], {
+		cwd,
+		stdio: [
+			"ignore",
+			"pipe",
+			"pipe"
+		],
+		shell: process.platform === "win32",
+		detached: process.platform !== "win32"
+	});
+	let announced;
+	const watch = (chunk) => {
+		const match = /https?:\/\/(?:localhost|127\.0\.0\.1|\[::1\]):(\d{2,5})/.exec(String(chunk));
+		if (match && announced === void 0) announced = `http://localhost:${match[1]}`;
+	};
+	child.stdout?.on("data", watch);
+	child.stderr?.on("data", watch);
+	let stopped = false;
+	const stop = async () => {
+		if (stopped) return;
+		stopped = true;
+		const signal = (name) => {
+			try {
+				if (child.pid === void 0) return;
+				if (process.platform === "win32") child.kill(name);
+				else process.kill(-child.pid, name);
+			} catch {}
+		};
+		if (child.exitCode === null && child.signalCode === null) {
+			signal("SIGTERM");
+			await new Promise((resolve) => {
+				const timer = setTimeout(() => {
+					signal("SIGKILL");
+					resolve();
+				}, 5e3);
+				child.once("close", () => {
+					clearTimeout(timer);
+					resolve();
+				});
+			});
+		}
+		child.stdout?.destroy();
+		child.stderr?.destroy();
+		child.unref();
+	};
+	const deadline = Date.now() + SERVER_START_TIMEOUT_MS;
+	while (Date.now() < deadline) {
+		if (child.exitCode !== null) return void 0;
+		for (const origin of announced === void 0 ? KNOWN_PORTS.map((port) => `http://localhost:${port}`) : [announced]) if (await answers(origin)) return {
+			origin,
+			stop
+		};
+		await new Promise((resolve) => setTimeout(resolve, 500));
+	}
+	await stop();
+}
+/**
+* Work out what to audit in this project, building or serving it if need be.
+*
+* Returns undefined when there is nothing it can do, leaving the caller to
+* explain — it has better context for the message than this does.
+*/
+async function autoDetectSource(cwd, options = {}) {
+	const steps = [];
+	const step = (message) => {
+		steps.push(message);
+		options.onStep?.(message);
+	};
+	const existing = await findBuildOutput(cwd);
+	if (existing !== void 0) {
+		step(`Found a build in ${path.relative(cwd, existing) || "."}/`);
+		return {
+			directory: existing,
+			steps
+		};
+	}
+	const pkg = await readPackageJson(cwd);
+	if (pkg === void 0) return void 0;
+	const scripts = pkg.scripts ?? {};
+	if (options.noBuild) return void 0;
+	if (scripts["build"] !== void 0) {
+		step("No build found; running the project build first");
+		const built = await runScript(cwd, "build");
+		if (!built.ok) {
+			step(`${built.command} failed`);
+			return { steps };
+		}
+		const produced = await findBuildOutput(cwd);
+		if (produced !== void 0) {
+			step(`Built ${path.relative(cwd, produced) || "."}/`);
+			return {
+				directory: produced,
+				steps
+			};
+		}
+	}
+	const serveScript = [
+		"start",
+		"preview",
+		"serve"
+	].find((name) => scripts[name] !== void 0);
+	if (serveScript === void 0) return { steps };
+	step(`This site renders on a server; starting it with ${serveScript}`);
+	const server = await startServer(cwd, serveScript);
+	if (server === void 0) {
+		step(`Could not start the site with ${serveScript}`);
+		return { steps };
+	}
+	step(`Auditing ${server.origin}`);
+	return {
+		url: server.origin,
+		cleanup: server.stop,
+		steps
+	};
+}
+//#endregion
+export { autoDetectSource };

package/dist/{render-K9KxDDSA.js → render-BO0nVrrZ.js}

@@ -1,197 +1,10 @@
+import { _ as withDefault, a as isoDateTime, c as object, d as record, f as safeParse, o as nullable, p as string, s as number, t as array } from "./schema-CMZ8ItGk.js";
 import { n as IMPACT_LEVELS } from "./impact-DvgBjupx.js";
 import { n as escapeText, t as escapeAttribute } from "./escape-Dm1o_RAk.js";
 import { t as TOOL_VERSION } from "./version-B3v4rNoG.js";
-import { z } from "zod";
 import { readFile, readdir, stat } from "node:fs/promises";
 import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-//#region src/config/define.ts
-/** Countries with their own supervisory body and statute text. */
-const COUNTRIES = [
-	"AT",
-	"DE",
-	"CH"
-];
-/** Languages a statement can be rendered in. */
-const STATEMENT_LOCALES = ["de", "en"];
-/**
-* Wording follows the EU model statement: fully, partially, or not conformant
-* with the standard. "partially-compliant" is the honest answer for most sites
-* and the one that carries obligations to list what is missing.
-*/
-const COMPLIANCE_STATUSES = [
-	"compliant",
-	"partially-compliant",
-	"non-compliant"
-];
-const ASSESSMENT_METHODS = ["self-assessment", "external-audit"];
-/**
-* Why a known barrier still exists. The first two are the grounds the EU regime
-* recognises for leaving something inaccessible; the third is a plain promise to
-* fix it, which is what most small sites actually mean.
-*/
-const ISSUE_REASONS = [
-	"disproportionate-burden",
-	"out-of-scope",
-	"fix-planned"
-];
-const knownIssueObject = z.object({
-	/** What is not accessible, in the statement's language. */
-	description: z.string().min(1),
-	/** WCAG success criteria, e.g. ['1.4.3']. */
-	successCriteria: z.array(z.string()).default([]),
-	/** EN 301 549 clauses, e.g. ['9.1.4.3']. */
-	en301549: z.array(z.string()).default([]),
-	reason: z.enum(ISSUE_REASONS).optional(),
-	/** ISO date by which the barrier is expected to be removed. */
-	remedyBy: z.iso.date().optional()
-});
-/**
-* A bare string is accepted as shorthand for `{ description }`. It is piped
-* through the object schema so both branches produce the same output type,
-* rather than a union that callers have to narrow before reading `remedyBy`.
-*/
-const knownIssueSchema = z.union([z.string().min(1).transform((description) => ({ description })).pipe(knownIssueObject), knownIssueObject]);
-const configSchema = z.object({
-	site: z.object({
-		name: z.string().min(1),
-		url: z.url(),
-		/** BCP 47 tag of the site itself, e.g. 'de-AT'. */
-		locale: z.string().min(2)
-	}),
-	provider: z.object({
-		/** The legal entity answerable for the service. */
-		legalName: z.string().min(1),
-		/**
-		* The feedback address. Required: the EAA obliges providers to offer a way
-		* to report accessibility barriers, and a statement without one is not
-		* usable for its purpose.
-		*/
-		email: z.email(),
-		phone: z.string().min(1).optional(),
-		address: z.string().min(1).optional(),
-		/**
-		* A contact or feedback form, offered alongside the address rather than
-		* instead of it: the EAA requires a way to report barriers, and a form is
-		* the one channel a visitor who cannot use email may still be able to use.
-		*/
-		feedbackUrl: z.url().optional()
-	}),
-	compliance: z.object({
-		status: z.enum(COMPLIANCE_STATUSES),
-		standard: z.string().min(1).default("EN 301 549 V3.2.1 (WCAG 2.2 AA)"),
-		knownIssues: z.array(knownIssueSchema).default([]),
-		/** When the assessment was carried out. */
-		assessedOn: z.iso.date(),
-		assessmentMethod: z.enum(ASSESSMENT_METHODS).default("self-assessment"),
-		/**
-		* Reason attached to barriers taken from an audit report, which carries no
-		* reason of its own. 'fix-planned' is the honest default for a barrier an
-		* automated run just found; the other two are claims only a human can make.
-		*/
-		auditReason: z.enum(ISSUE_REASONS).default("fix-planned")
-	}),
-	enforcement: z.object({ 
-	/** Drives which supervisory body and statute the template names. */
-country: z.enum(COUNTRIES) })
-});
-/**
-* Identity function that gives `eaa.config.ts` its types. Deliberately does not
-* validate: a config file is loaded and checked in one place, so that an error
-* points at the file rather than at wherever the module happened to be
-* imported.
-*/
-function defineConfig(config) {
-	return config;
-}
-var ConfigError = class extends Error {
-	issues;
-	name = "ConfigError";
-	constructor(message, issues = []) {
-		super(message);
-		this.issues = issues;
-	}
-};
-/** Validate an already-loaded config object. */
-function parseConfig(value, source = "config") {
-	const result = configSchema.safeParse(value);
-	if (result.success) return result.data;
-	const issues = result.error.issues.map((issue) => {
-		const path = issue.path.join(".");
-		return path ? `${path}: ${issue.message}` : issue.message;
-	});
-	throw new ConfigError(`${source} is not valid`, issues);
-}
-//#endregion
-//#region src/config/load.ts
-/** Checked in this order, first match wins. */
-const CONFIG_FILENAMES = [
-	"eaa.config.ts",
-	"eaa.config.mts",
-	"eaa.config.js",
-	"eaa.config.mjs",
-	"eaa.config.json"
-];
-/**
-* Find and load `eaa.config.{ts,mts,js,mjs,json}`.
-*
-* TypeScript configs are imported directly: Node strips types natively from
-* 22.18 onwards, which is below this package's floor, so no bundler or loader
-* dependency is needed. The failure mode that remains is a project with no
-* package.json at all, where Node cannot tell ESM from CommonJS; the error says
-* so rather than surfacing "Unexpected token 'export'".
-*/
-async function loadConfig(options = {}) {
-	const cwd = path.resolve(options.cwd ?? process.cwd());
-	const file = options.path ? path.resolve(cwd, options.path) : await findConfigFile(cwd);
-	if (!file) throw new ConfigError(`No config file found in ${cwd} or its parent directories`, CONFIG_FILENAMES.map((name) => `looked for ${name}`));
-	if (!await isFile(file)) throw new ConfigError(`Config file not found: ${file}`);
-	return {
-		config: parseConfig(file.endsWith(".json") ? await importJson(file) : await importModule(file), path.basename(file)),
-		path: file
-	};
-}
-/** Walks up from `cwd`, so the CLI works from a subdirectory of the project. */
-async function findConfigFile(cwd) {
-	let directory = path.resolve(cwd);
-	while (true) {
-		for (const name of CONFIG_FILENAMES) {
-			const candidate = path.join(directory, name);
-			if (await isFile(candidate)) return candidate;
-		}
-		const parent = path.dirname(directory);
-		if (parent === directory) return void 0;
-		directory = parent;
-	}
-}
-async function importJson(file) {
-	const raw = await readFile(file, "utf8");
-	try {
-		return JSON.parse(raw);
-	} catch (cause) {
-		throw new ConfigError(`${path.basename(file)} is not valid JSON`, [cause instanceof Error ? cause.message : String(cause)]);
-	}
-}
-async function importModule(file) {
-	let module;
-	try {
-		module = await import(`${pathToFileURL(file).href}?t=${Date.now()}`);
-	} catch (cause) {
-		const message = cause instanceof Error ? cause.message : String(cause);
-		const hint = message.includes("Unexpected token") ? "If the project has no package.json, Node cannot tell ESM from CommonJS. Add one with \"type\": \"module\", or use eaa.config.json." : message;
-		throw new ConfigError(`Could not load ${path.basename(file)}`, [hint]);
-	}
-	if (module.default === void 0) throw new ConfigError(`${path.basename(file)} has no default export`, ["Expected: export default defineConfig({ … })"]);
-	return module.default;
-}
-async function isFile(candidate) {
-	try {
-		return (await stat(candidate)).isFile();
-	} catch {
-		return false;
-	}
-}
-//#endregion
+import { fileURLToPath } from "node:url";
 //#region src/statement/error.ts
 /**
 * Lives in its own module so that both the renderer and the audit-report reader
@@ -210,25 +23,25 @@ var StatementError = class extends Error {
 * markup, selectors, passes, inapplicable — is audit detail with no place in a
 * legal document, and unknown keys are dropped rather than being carried along.
 */
-const reportSchema = z.object({
-	schemaVersion: z.number(),
-	generatedAt: z.iso.datetime(),
-	summary: z.object({
-		pages: z.number(),
-		needsReview: z.number(),
-		notEvaluated: z.number()
+const reportSchema = object({
+	schemaVersion: number(),
+	generatedAt: isoDateTime(),
+	summary: object({
+		pages: number(),
+		needsReview: number(),
+		notEvaluated: number()
 	}),
-	rules: z.record(z.string(), z.object({
-		help: z.string(),
-		successCriteria: z.array(z.string()).default([]),
-		en301549: z.array(z.string()).default([])
+	rules: record(object({
+		help: string(),
+		successCriteria: withDefault(array(string()), () => []),
+		en301549: withDefault(array(string()), () => [])
 	})),
-	pages: z.array(z.object({
-		path: z.string(),
-		violations: z.array(z.object({
-			ruleId: z.string(),
-			impact: z.string().nullable().default(null)
-		})).default([])
+	pages: array(object({
+		path: string(),
+		violations: withDefault(array(object({
+			ruleId: string(),
+			impact: withDefault(nullable(string()), () => null)
+		})), () => [])
 	}))
 });
 /**
@@ -241,7 +54,7 @@ const reportSchema = z.object({
 * statement can say how much the automated run left open.
 */
 function summariseAuditReport(value, source = "audit report") {
-	const result = reportSchema.safeParse(value);
+	const result = safeParse(reportSchema, value);
 	if (!result.success) throw new StatementError(`${source} is not an eaa-kit JSON report (${result.error.issues.map((issue) => `${issue.path.join(".") || "document"}: ${issue.message}`).slice(0, 5).join("; ")})`);
 	const report = result.data;
 	if (report.schemaVersion !== 1) throw new StatementError(`${source} has schemaVersion ${report.schemaVersion}; this version of eaa-kit reads 1`);
@@ -771,4 +584,4 @@ async function findTemplateDirectory() {
 	throw new StatementError(`Could not locate the statement templates. Looked in: ${candidates.join(", ")}`);
 }
 //#endregion
-export { defineConfig as _, summariseAuditReport as a, findConfigFile as c, COMPLIANCE_STATUSES as d, COUNTRIES as f, configSchema as g, STATEMENT_LOCALES as h, readAuditReport as i, loadConfig as l, ISSUE_REASONS as m, toHtmlBody as n, StatementError as o, ConfigError as p, toHtmlDocument as r, CONFIG_FILENAMES as s, renderStatement as t, ASSESSMENT_METHODS as u, parseConfig as v };
+export { summariseAuditReport as a, readAuditReport as i, toHtmlBody as n, StatementError as o, toHtmlDocument as r, renderStatement as t };

package/dist/routes-BxbSZKXC.js

@@ -0,0 +1,123 @@
+import { stat } from "node:fs/promises";
+import path from "node:path";
+import { glob } from "tinyglobby";
+//#region src/audit/routes.ts
+/** Route file conventions, most specific first. */
+const CONVENTIONS = [
+	{
+		framework: "next-app",
+		dir: "app",
+		pattern: "**/page.{tsx,ts,jsx,js,mdx}"
+	},
+	{
+		framework: "next-app",
+		dir: "src/app",
+		pattern: "**/page.{tsx,ts,jsx,js,mdx}"
+	},
+	{
+		framework: "next-pages",
+		dir: "pages",
+		pattern: "**/*.{tsx,ts,jsx,js,mdx}"
+	},
+	{
+		framework: "next-pages",
+		dir: "src/pages",
+		pattern: "**/*.{tsx,ts,jsx,js,mdx}"
+	},
+	{
+		framework: "astro",
+		dir: "src/pages",
+		pattern: "**/*.{astro,md,mdx}"
+	},
+	{
+		framework: "nuxt",
+		dir: "pages",
+		pattern: "**/*.vue"
+	},
+	{
+		framework: "sveltekit",
+		dir: "src/routes",
+		pattern: "**/+page.{svelte,ts,js}"
+	}
+];
+/**
+* The URL path a route file serves.
+*
+* Returns undefined for anything that is not a page: a Next.js route group
+* `(marketing)` contributes no segment, a private folder `_lib` contributes no
+* route at all, and a dynamic segment `[slug]` cannot be resolved to one path
+* without knowing the data behind it.
+*/
+function routePathFor(relativeFile, framework) {
+	let route = relativeFile.split(path.sep).join("/");
+	if (framework === "next-app" || framework === "sveltekit") route = route.includes("/") ? route.replace(/\/[^/]+$/, "") : "";
+	else {
+		route = route.replace(/\.[^./]+$/, "");
+		route = route.replace(/\/index$/, "");
+		if (route === "index") route = "";
+	}
+	const segments = route.split("/").filter((segment) => segment !== "");
+	const kept = [];
+	for (const segment of segments) {
+		if (/^[[(]|^_|^@/.test(segment)) {
+			if (/^\(.*\)$/.test(segment)) continue;
+			return;
+		}
+		kept.push(segment);
+	}
+	return kept.join("/");
+}
+/** Every page path a build could have emitted for one route. */
+function emittedPathsFor(route) {
+	if (route === "") return [
+		"/",
+		"index.html",
+		"index.htm"
+	];
+	return [
+		route,
+		`${route}/`,
+		`${route}.html`,
+		`${route}/index.html`
+	];
+}
+/**
+* Build a page-to-source map by reading the project's route files.
+*
+* Returns undefined when the project uses no convention this understands, which
+* is not a failure — most builds are not framework projects.
+*/
+async function buildRouteMap(cwd) {
+	for (const convention of CONVENTIONS) {
+		const directory = path.join(cwd, convention.dir);
+		try {
+			if (!(await stat(directory)).isDirectory()) continue;
+		} catch {
+			continue;
+		}
+		const files = await glob([convention.pattern], {
+			cwd: directory,
+			ignore: ["**/node_modules/**"],
+			onlyFiles: true
+		});
+		if (files.length === 0) continue;
+		const sources = /* @__PURE__ */ new Map();
+		for (const file of files) {
+			const route = routePathFor(file, convention.framework);
+			if (route === void 0) continue;
+			const source = `${convention.dir}/${file.split(path.sep).join("/")}`;
+			for (const emitted of emittedPathsFor(route)) if (!sources.has(emitted)) sources.set(emitted, source);
+		}
+		if (sources.size > 0) return {
+			framework: convention.framework,
+			sources
+		};
+	}
+}
+/** The source file for an audited page, if the map knows one. */
+function sourceFor(map, pagePath) {
+	if (map === void 0) return void 0;
+	return map.sources.get(pagePath) ?? map.sources.get(pagePath.replace(/^\//, ""));
+}
+//#endregion
+export { buildRouteMap, sourceFor };