eaa-kit 0.1.0

package/dist/result-2aZPfM8w.js

@@ -0,0 +1,168 @@
+import axe from "axe-core";
+//#region src/audit/result.ts
+/** WCAG 2.2 AA and everything it builds on. Best-practice rules stay off. */
+const DEFAULT_TAGS = [
+	"wcag2a",
+	"wcag2aa",
+	"wcag21a",
+	"wcag21aa",
+	"wcag22aa"
+];
+function runOptions(tags) {
+	return {
+		runOnly: {
+			type: "tag",
+			values: [...tags]
+		},
+		resultTypes: ["violations", "incomplete"],
+		preload: false
+	};
+}
+/**
+* Turn raw axe-core output into a PageAudit, shared by both engines so their
+* reports are directly comparable.
+*
+* The `blind` map is what differs: jsdom passes the rules it cannot evaluate,
+* a real browser passes an empty map and keeps every verdict axe-core reached.
+*/
+function shapeResults(results, options) {
+	const { blind } = options;
+	const violations = [];
+	const incomplete = [];
+	const passes = [];
+	const inapplicable = [];
+	const claimed = /* @__PURE__ */ new Set();
+	for (const result of results.violations) {
+		if (claimed.has(result.id)) continue;
+		claimed.add(result.id);
+		const rule = blind.get(result.id);
+		if (rule) incomplete.push(toIncomplete(result, "engine-limitation", rule.detail));
+		else violations.push(toFinding(result));
+	}
+	for (const result of results.incomplete) {
+		if (claimed.has(result.id)) continue;
+		claimed.add(result.id);
+		const rule = blind.get(result.id);
+		incomplete.push(rule ? toIncomplete(result, "engine-limitation", rule.detail) : toIncomplete(result, "needs-review", result.description));
+	}
+	for (const result of results.passes) {
+		if (claimed.has(result.id)) continue;
+		claimed.add(result.id);
+		const rule = blind.get(result.id);
+		if (rule) incomplete.push(toIncomplete(result, "engine-limitation", rule.detail));
+		else passes.push(toOutcome(result));
+	}
+	for (const result of results.inapplicable) {
+		if (claimed.has(result.id)) continue;
+		claimed.add(result.id);
+		const rule = blind.get(result.id);
+		if (rule?.applicabilityUnreliable) incomplete.push(toIncomplete(result, "engine-limitation", rule.detail));
+		else inapplicable.push(toOutcome(result));
+	}
+	for (const [ruleId, rule] of blind) {
+		if (claimed.has(ruleId)) continue;
+		const metadata = ruleMetadata(ruleId);
+		if (!metadata) continue;
+		incomplete.push({
+			ruleId,
+			impact: null,
+			help: metadata.help,
+			helpUrl: metadata.helpUrl,
+			successCriteria: successCriteria(metadata.tags),
+			enClauses: enClauses(metadata.tags),
+			tags: metadata.tags,
+			nodes: [],
+			reason: "engine-limitation",
+			reasonDetail: rule.detail
+		});
+	}
+	return {
+		relativePath: options.relativePath,
+		absolutePath: options.absolutePath,
+		url: options.url,
+		engine: options.engine,
+		violations,
+		incomplete: incomplete.sort(byRuleId),
+		passes: passes.sort(byRuleId),
+		inapplicable: inapplicable.sort(byRuleId),
+		durationMs: options.durationMs
+	};
+}
+/** A page that could not be audited: no verdicts, and the reason recorded. */
+function failedPage(options, error) {
+	return {
+		relativePath: options.relativePath,
+		absolutePath: options.absolutePath,
+		url: options.url,
+		engine: options.engine,
+		violations: [],
+		incomplete: [],
+		passes: [],
+		inapplicable: [],
+		durationMs: options.durationMs,
+		error
+	};
+}
+function byRuleId(a, b) {
+	return a.ruleId.localeCompare(b.ruleId);
+}
+function toOutcome(result) {
+	return {
+		ruleId: result.id,
+		help: result.help,
+		helpUrl: result.helpUrl,
+		successCriteria: successCriteria(result.tags),
+		enClauses: enClauses(result.tags),
+		tags: result.tags
+	};
+}
+function toFinding(result) {
+	return {
+		...toOutcome(result),
+		impact: result.impact ?? null,
+		nodes: result.nodes.map(toFindingNode)
+	};
+}
+function toIncomplete(result, reason, detail) {
+	return {
+		...toFinding(result),
+		reason,
+		reasonDetail: detail
+	};
+}
+function toFindingNode(node) {
+	return {
+		html: node.html,
+		target: node.target.map((selector) => String(selector)),
+		...node.failureSummary ? { failureSummary: node.failureSummary } : {}
+	};
+}
+function ruleMetadata(ruleId) {
+	const rule = axe.getRules().find((candidate) => candidate.ruleId === ruleId);
+	if (!rule) return void 0;
+	return {
+		help: rule.description,
+		helpUrl: rule.helpUrl,
+		tags: rule.tags
+	};
+}
+/** `wcag143` -> `1.4.3`, `wcag258` -> `2.5.8`, `wcag2411` -> `2.4.11`. */
+function successCriteria(tags) {
+	const criteria = /* @__PURE__ */ new Set();
+	for (const tag of tags) {
+		const match = /^wcag(\d)(\d)(\d{1,2})$/.exec(tag);
+		if (match?.[1] && match[2] && match[3]) criteria.add(`${match[1]}.${match[2]}.${match[3]}`);
+	}
+	return [...criteria].sort();
+}
+/** `EN-9.1.4.3` -> `9.1.4.3`. */
+function enClauses(tags) {
+	const clauses = /* @__PURE__ */ new Set();
+	for (const tag of tags) {
+		const match = /^EN-(\d+(?:\.\d+)+)$/.exec(tag);
+		if (match?.[1]) clauses.add(match[1]);
+	}
+	return [...clauses].sort();
+}
+//#endregion
+export { shapeResults as i, failedPage as n, runOptions as r, DEFAULT_TAGS as t };

package/dist/sarif-eSCuI0eX.js

@@ -0,0 +1,192 @@
+import { i as isImpactLevel } from "./impact-DvgBjupx.js";
+import { t as TOOL_VERSION } from "./version-B3v4rNoG.js";
+import { t as elementFingerprint } from "./fingerprint-DRoneAjj.js";
+import path from "node:path";
+//#region src/audit/report/sarif.ts
+const SARIF_VERSION = "2.1.0";
+const SARIF_SCHEMA = "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json";
+/**
+* Map axe-core's impact onto SARIF's level.
+*
+* An unclassified impact becomes `error` rather than something quieter: a
+* missing impact is a gap in what we know, and the rest of the tool already
+* refuses to wave those through (see meetsThreshold).
+*/
+function toSarifLevel(impact) {
+	if (impact === null || !isImpactLevel(impact)) return "error";
+	switch (impact) {
+		case "critical":
+		case "serious": return "error";
+		case "moderate": return "warning";
+		case "minor": return "note";
+	}
+}
+/**
+* SARIF 2.1.0 log for GitHub code scanning.
+*
+* Only violations become results. incomplete findings are deliberately left
+* out: "a human must look at this" and "this engine is blind here" are not
+* defects at a source location, and filing thousands of them as alerts would
+* bury the failures that are real. The counts are kept in `run.properties` so
+* the information survives in the artifact, and the JSON format carries them in
+* full.
+*/
+function buildSarifReport(audits, options) {
+	const rules = buildRules(audits);
+	const ruleIndex = new Map(rules.map((rule, index) => [rule.id, index]));
+	const cwd = options.cwd ?? process.cwd();
+	const results = [];
+	const notifications = [];
+	for (const audit of audits) {
+		const uri = artifactUri(options.directory, audit.relativePath, cwd);
+		if (audit.error) {
+			notifications.push({
+				level: "error",
+				message: { text: `Page could not be audited: ${audit.error}` },
+				locations: [{ physicalLocation: { artifactLocation: { uri } } }]
+			});
+			continue;
+		}
+		for (const finding of audit.violations) {
+			const index = ruleIndex.get(finding.ruleId);
+			if (index === void 0) continue;
+			results.push(...toResults(finding, index, uri));
+		}
+		for (const finding of audit.accepted ?? []) {
+			const index = ruleIndex.get(finding.ruleId);
+			if (index === void 0) continue;
+			results.push(...toResults(finding, index, uri, SUPPRESSED));
+		}
+	}
+	return {
+		$schema: SARIF_SCHEMA,
+		version: SARIF_VERSION,
+		runs: [{
+			tool: { driver: {
+				name: "eaa-kit",
+				version: TOOL_VERSION,
+				rules
+			} },
+			invocations: [{
+				executionSuccessful: notifications.length === 0,
+				endTimeUtc: (options.now ?? /* @__PURE__ */ new Date()).toISOString(),
+				toolExecutionNotifications: notifications
+			}],
+			results,
+			properties: summaryProperties(audits)
+		}]
+	};
+}
+function serialiseSarifReport(log) {
+	return `${JSON.stringify(log, null, 2)}\n`;
+}
+/**
+* One result per offending element, not per rule: a SARIF result carries a
+* single primary location, and one alert per element is what a reviewer acts
+* on. A violation that reported no elements still gets one result on the page.
+*/
+const SUPPRESSED = [{
+	kind: "external",
+	justification: "Recorded in the eaa-kit baseline"
+}];
+function toResults(finding, ruleIndex, uri, suppressions) {
+	const level = toSarifLevel(finding.impact);
+	const location = { physicalLocation: { artifactLocation: { uri } } };
+	if (finding.nodes.length === 0) return [{
+		ruleId: finding.ruleId,
+		ruleIndex,
+		level,
+		kind: "fail",
+		message: { text: finding.help },
+		locations: [location],
+		partialFingerprints: fingerprint(finding.ruleId, "", ""),
+		...suppressions ? { suppressions } : {}
+	}];
+	return finding.nodes.map((node) => {
+		const selector = node.target.join(" ");
+		return {
+			ruleId: finding.ruleId,
+			ruleIndex,
+			level,
+			kind: "fail",
+			message: { text: `${finding.help}. Element: ${selector}` },
+			locations: [location],
+			partialFingerprints: fingerprint(finding.ruleId, selector, node.html),
+			...suppressions ? { suppressions } : {}
+		};
+	});
+}
+/**
+* Identifies an alert across runs. Deliberately excludes the file path, so that
+* moving a page does not close one alert and open an identical one; GitHub
+* combines the fingerprint with the location itself.
+*/
+function fingerprint(ruleId, selector, html) {
+	return { "eaaKit/v1": elementFingerprint(ruleId, selector, html) };
+}
+/** Every rule the run knows about, so the catalogue is complete in GitHub. */
+function buildRules(audits) {
+	const rules = /* @__PURE__ */ new Map();
+	for (const audit of audits) {
+		const outcomes = [
+			...audit.violations,
+			...audit.accepted ?? [],
+			...audit.incomplete,
+			...audit.passes,
+			...audit.inapplicable
+		];
+		for (const outcome of outcomes) {
+			if (rules.has(outcome.ruleId)) continue;
+			rules.set(outcome.ruleId, toSarifRule(outcome));
+		}
+	}
+	return [...rules.values()].sort((a, b) => a.id.localeCompare(b.id));
+}
+function toSarifRule(outcome) {
+	const criteria = outcome.successCriteria.map((criterion) => `WCAG ${criterion}`);
+	const clauses = outcome.enClauses.map((clause) => `EN 301 549 ${clause}`);
+	const references = [...criteria, ...clauses].join(", ");
+	return {
+		id: outcome.ruleId,
+		shortDescription: { text: outcome.help },
+		...outcome.helpUrl ? { helpUri: outcome.helpUrl } : {},
+		help: { text: references ? `${outcome.help}\n\n${references}` : outcome.help },
+		properties: { tags: [
+			"accessibility",
+			...outcome.successCriteria.map((criterion) => `wcag-${criterion}`),
+			...outcome.enClauses.map((clause) => `en-301-549-${clause}`)
+		] }
+	};
+}
+/**
+* Coverage that has no place in `results` but should not vanish: a SARIF log
+* with no results must not be mistaken for "everything was checked".
+*/
+function summaryProperties(audits) {
+	let needsReview = 0;
+	let notEvaluated = 0;
+	const notEvaluatedRules = /* @__PURE__ */ new Set();
+	for (const audit of audits) for (const finding of audit.incomplete) if (finding.reason === "engine-limitation") {
+		notEvaluated += 1;
+		notEvaluatedRules.add(finding.ruleId);
+	} else needsReview += 1;
+	return {
+		engine: audits[0]?.engine ?? "jsdom",
+		pages: audits.length,
+		needsReview,
+		notEvaluated,
+		notEvaluatedRules: [...notEvaluatedRules].sort()
+	};
+}
+/**
+* Artifact URIs are relative to the working directory and POSIX-separated, so
+* GitHub can line them up with files in the repository.
+*/
+function artifactUri(directory, relativePath, cwd) {
+	const absolute = path.resolve(cwd, directory, relativePath);
+	const relative = path.relative(cwd, absolute);
+	if (!relative || relative.startsWith("..") || path.isAbsolute(relative)) return relativePath;
+	return relative.split(path.sep).join("/");
+}
+//#endregion
+export { buildSarifReport, serialiseSarifReport };

package/dist/statement/templates/at.de.md

@@ -0,0 +1,127 @@
+# Erklärung zur Barrierefreiheit
+
+{{ provider.legalName }} ist bemüht, die Website {{ site.name }} im Einklang mit dem
+österreichischen Barrierefreiheitsgesetz (BaFG) barrierefrei zugänglich zu machen. Das
+BaFG setzt die Richtlinie (EU) 2019/882 (European Accessibility Act) in österreichisches
+Recht um.
+
+Diese Erklärung zur Barrierefreiheit gilt für {{ site.url }}.
+
+## Stand der Vereinbarkeit mit den Anforderungen
+
+{{#if compliance.isCompliant}}
+Diese Website ist mit {{ compliance.standard }} vollständig vereinbar.
+{{/if}}
+{{#if compliance.isPartiallyCompliant}}
+Diese Website ist mit {{ compliance.standard }} teilweise vereinbar. Die im folgenden
+Abschnitt aufgeführten Inhalte sind aus den jeweils genannten Gründen nicht barrierefrei.
+{{/if}}
+{{#if compliance.isNonCompliant}}
+Diese Website ist mit {{ compliance.standard }} nicht vereinbar. Die im folgenden Abschnitt
+aufgeführten Inhalte sind aus den jeweils genannten Gründen nicht barrierefrei.
+{{/if}}
+
+## Nicht barrierefreie Inhalte
+
+{{#if hasKnownIssues}}
+{{#each compliance.knownIssues}}
+- {{ description }}
+{{#if standards}}
+  Betroffene Anforderung: {{ standards }}
+{{/if}}
+{{#if pageList}}
+  Betroffene Seiten: {{ pageList }}{{#if hasMorePages}} und {{ morePages }} weitere{{/if}}
+{{/if}}
+{{#if isDisproportionateBurden}}
+  Grund: unverhältnismäßige Belastung.
+{{/if}}
+{{#if isOutOfScope}}
+  Grund: der Inhalt fällt nicht in den Anwendungsbereich des BaFG.
+{{/if}}
+{{#if isFixPlanned}}
+  Grund: die Barriere ist bekannt und wird behoben.
+{{/if}}
+{{#if remedyByFormatted}}
+  Geplante Behebung bis: {{ remedyByFormatted }}
+{{/if}}
+{{#if isFromAudit}}
+  Automatisiert erkannt (axe-core, Regel {{ ruleId }}); bitte in eigenen Worten beschreiben.
+{{/if}}
+{{/each}}
+{{/if}}
+{{#if hasNoKnownIssues}}
+Zum Zeitpunkt der Prüfung sind keine nicht barrierefreien Inhalte bekannt.
+{{/if}}
+
+## Erstellung dieser Erklärung
+
+Diese Erklärung wurde am {{ compliance.assessedOnFormatted }} erstellt.
+
+{{#if compliance.isSelfAssessment}}
+Grundlage ist eine Selbstbewertung durch {{ provider.legalName }}.
+{{/if}}
+{{#if compliance.isExternalAudit}}
+Grundlage ist eine Prüfung durch Dritte.
+{{/if}}
+
+{{#if audit.isSinglePage}}
+Die automatisierte Prüfung vom {{ audit.checkedOnFormatted }} umfasste eine Seite dieser
+Website.
+{{/if}}
+{{#if audit.isMultiPage}}
+Die automatisierte Prüfung vom {{ audit.checkedOnFormatted }} umfasste {{ audit.pages }}
+Seiten dieser Website.
+{{/if}}
+{{#if audit.needsReviewIsSingle}}
+Bei einer weiteren Regelprüfung ist eine manuelle Beurteilung erforderlich.
+{{/if}}
+{{#if audit.needsReviewIsPlural}}
+Bei {{ audit.needsReview }} weiteren Regelprüfungen ist eine manuelle Beurteilung
+erforderlich.
+{{/if}}
+{{#if audit.notEvaluatedIsSingle}}
+Bei einer Regelprüfung erreichte das verwendete Werkzeug kein Ergebnis; sie wird nicht als
+erfüllt ausgewiesen.
+{{/if}}
+{{#if audit.notEvaluatedIsPlural}}
+Bei {{ audit.notEvaluated }} Regelprüfungen erreichte das verwendete Werkzeug kein
+Ergebnis; sie werden nicht als erfüllt ausgewiesen.
+{{/if}}
+{{#if hasAudit}}
+
+{{/if}}
+Die Bewertung stützt sich unter anderem auf eine automatisierte Prüfung. Automatisierte
+Werkzeuge erkennen nur einen Teil der möglichen Barrieren; sie ersetzen keine manuelle
+Prüfung und keine Prüfung mit assistiven Technologien.
+
+## Feedback und Kontaktangaben
+
+Sie haben eine Barriere gefunden oder benötigen Informationen in einer barrierefreien
+Form? Melden Sie sich bitte bei uns:
+
+- E-Mail: {{ provider.email }}
+{{#if provider.feedbackUrl}}
+- Kontaktformular: {{ provider.feedbackUrl }}
+{{/if}}
+{{#if provider.phone}}
+- Telefon: {{ provider.phone }}
+{{/if}}
+{{#if provider.address}}
+- Anschrift: {{ provider.address }}
+{{/if}}
+
+Wir bemühen uns, Ihre Rückmeldung zeitnah zu beantworten.
+
+## Beschwerdeverfahren
+
+Wenn Sie mit unserer Antwort nicht zufrieden sind, können Sie sich an das
+Sozialministeriumservice wenden. Das Sozialministeriumservice ist in Österreich die für
+die Marktüberwachung nach dem BaFG zuständige Stelle.
+
+Sozialministeriumservice
+https://www.sozialministeriumservice.at
+
+---
+
+Diese Erklärung wurde mit eaa-kit erstellt und ist keine Rechtsberatung. Prüfen Sie den
+Inhalt vor der Veröffentlichung und lassen Sie ihn im Zweifel rechtlich prüfen.

package/dist/statement/templates/at.en.md

@@ -0,0 +1,121 @@
+# Accessibility Statement
+
+{{ provider.legalName }} is committed to making the website {{ site.name }} accessible in
+accordance with the Austrian Accessibility Act (Barrierefreiheitsgesetz, BaFG), which
+transposes Directive (EU) 2019/882 (the European Accessibility Act) into Austrian law.
+
+This accessibility statement applies to {{ site.url }}.
+
+## Compliance status
+
+{{#if compliance.isCompliant}}
+This website is fully compliant with {{ compliance.standard }}.
+{{/if}}
+{{#if compliance.isPartiallyCompliant}}
+This website is partially compliant with {{ compliance.standard }}. The content listed in
+the following section is not accessible, for the reasons given.
+{{/if}}
+{{#if compliance.isNonCompliant}}
+This website is not compliant with {{ compliance.standard }}. The content listed in the
+following section is not accessible, for the reasons given.
+{{/if}}
+
+## Non-accessible content
+
+{{#if hasKnownIssues}}
+{{#each compliance.knownIssues}}
+- {{ description }}
+{{#if standards}}
+  Requirement affected: {{ standards }}
+{{/if}}
+{{#if pageList}}
+  Pages affected: {{ pageList }}{{#if hasMorePages}} and {{ morePages }} more{{/if}}
+{{/if}}
+{{#if isDisproportionateBurden}}
+  Reason: disproportionate burden.
+{{/if}}
+{{#if isOutOfScope}}
+  Reason: the content falls outside the scope of the BaFG.
+{{/if}}
+{{#if isFixPlanned}}
+  Reason: the barrier is known and is being addressed.
+{{/if}}
+{{#if remedyByFormatted}}
+  Expected to be resolved by: {{ remedyByFormatted }}
+{{/if}}
+{{#if isFromAudit}}
+  Detected by automated testing (axe-core, rule {{ ruleId }}); describe it in your own words.
+{{/if}}
+{{/each}}
+{{/if}}
+{{#if hasNoKnownIssues}}
+No non-accessible content was known at the time of assessment.
+{{/if}}
+
+## Preparation of this statement
+
+This statement was prepared on {{ compliance.assessedOnFormatted }}.
+
+{{#if compliance.isSelfAssessment}}
+It is based on a self-assessment carried out by {{ provider.legalName }}.
+{{/if}}
+{{#if compliance.isExternalAudit}}
+It is based on an assessment carried out by a third party.
+{{/if}}
+
+{{#if audit.isSinglePage}}
+The automated test run of {{ audit.checkedOnFormatted }} covered one page of this website.
+{{/if}}
+{{#if audit.isMultiPage}}
+The automated test run of {{ audit.checkedOnFormatted }} covered {{ audit.pages }}
+pages of this website.
+{{/if}}
+{{#if audit.needsReviewIsSingle}}
+One further rule check requires a manual decision.
+{{/if}}
+{{#if audit.needsReviewIsPlural}}
+{{ audit.needsReview }} further rule checks require a manual decision.
+{{/if}}
+{{#if audit.notEvaluatedIsSingle}}
+One rule check could not be decided by the tool that was used; it is not reported as met.
+{{/if}}
+{{#if audit.notEvaluatedIsPlural}}
+{{ audit.notEvaluated }} rule checks could not be decided by the tool that was used; they
+are not reported as met.
+{{/if}}
+{{#if hasAudit}}
+
+{{/if}}
+The assessment relies in part on automated testing. Automated tools detect only a subset
+of possible barriers; they are not a substitute for manual testing or for testing with
+assistive technologies.
+
+## Feedback and contact
+
+Found a barrier, or need information in an accessible format? Please get in touch:
+
+- Email: {{ provider.email }}
+{{#if provider.feedbackUrl}}
+- Contact form: {{ provider.feedbackUrl }}
+{{/if}}
+{{#if provider.phone}}
+- Phone: {{ provider.phone }}
+{{/if}}
+{{#if provider.address}}
+- Address: {{ provider.address }}
+{{/if}}
+
+We aim to respond to your feedback promptly.
+
+## Enforcement procedure
+
+If you are not satisfied with our response, you can contact the Sozialministeriumservice,
+the authority responsible for market surveillance under the BaFG in Austria.
+
+Sozialministeriumservice
+https://www.sozialministeriumservice.at
+
+---
+
+This statement was generated with eaa-kit and is not legal advice. Review it before
+publishing, and have it checked by a lawyer if in doubt.