eaa-kit 0.1.1 → 0.2.1

package/dist/{audit-CApiPaiG.js → audit-DXpKkXsC.js}

@@ -1,97 +1,83 @@
 import { n as IMPACT_LEVELS, r as countAtOrAbove } from "./impact-DvgBjupx.js";
+import { t as elementFingerprint } from "./fingerprint-DRoneAjj.js";
 import { mkdir, readFile, stat, writeFile } from "node:fs/promises";
 import path from "node:path";
 import pc from "picocolors";
 import { glob } from "tinyglobby";
-//#region src/audit/collect.ts
-/** Every HTML document a static build is expected to emit. */
-const DEFAULT_INCLUDE = ["**/*.html", "**/*.htm"];
-/** Vendored and tooling directories are never part of the shipped site. */
-const DEFAULT_EXCLUDE = ["**/node_modules/**", "**/.git/**"];
-/** Number of files read in parallel; keeps large builds under the fd limit. */
-const READ_CONCURRENCY = 24;
-/**
-* Thrown when the build directory itself is unusable. A missing or wrong
-* `dist/` is a user mistake worth reporting loudly, unlike a directory that
-* simply holds no HTML.
-*/
-var BuildDirectoryError = class extends Error {
-	dir;
-	name = "BuildDirectoryError";
-	constructor(message, dir) {
-		super(message);
-		this.dir = dir;
-	}
-};
+/** Whether this element looks like one component rendered on many pages. */
+function isShared(element) {
+	return element.pages.length >= 3;
+}
 /**
-* Glob HTML files out of a build directory and read them.
+* Fold a run's violations into one entry per rule, and one per element within it.
 *
-* Returns pages sorted by relative path so reports and snapshots are stable
-* across platforms. An empty array means "no HTML found" — the caller decides
-* whether that is an error.
+* Accepted violations are not included: a baseline moves them out of what fails
+* the build, and this is a view of what fails.
 */
-async function collectPages(dir, options = {}) {
-	const root = path.resolve(dir);
-	await assertDirectory(root, dir);
-	const relativePaths = (await glob(options.include ?? DEFAULT_INCLUDE, {
-		cwd: root,
-		ignore: options.exclude ?? DEFAULT_EXCLUDE,
-		onlyFiles: true,
-		dot: false,
-		absolute: false
-	})).map(toPosix).sort();
-	const pages = [];
-	for (let i = 0; i < relativePaths.length; i += READ_CONCURRENCY) {
-		const batch = relativePaths.slice(i, i + READ_CONCURRENCY);
-		pages.push(...await Promise.all(batch.map((relativePath) => readPage(root, relativePath))));
+function groupIssues(audits) {
+	const byRule = /* @__PURE__ */ new Map();
+	for (const audit of audits) for (const finding of audit.violations) {
+		let issue = byRule.get(finding.ruleId);
+		if (issue === void 0) {
+			issue = {
+				ruleId: finding.ruleId,
+				help: finding.help,
+				impact: finding.impact ?? null,
+				successCriteria: finding.successCriteria,
+				enClauses: finding.enClauses,
+				helpUrl: finding.helpUrl,
+				elements: [],
+				pages: [],
+				occurrences: 0
+			};
+			byRule.set(finding.ruleId, issue);
+		}
+		if (!issue.pages.includes(audit.relativePath)) issue.pages.push(audit.relativePath);
+		const nodes = finding.nodes.length > 0 ? finding.nodes.map((node) => ({
+			selector: node.target.join(" "),
+			html: node.html
+		})) : [{
+			selector: "",
+			html: ""
+		}];
+		for (const node of nodes) {
+			issue.occurrences += 1;
+			const fingerprint = elementFingerprint(finding.ruleId, node.selector, node.html);
+			const existing = issue.elements.find((element) => element.fingerprint === fingerprint);
+			if (existing) {
+				if (!existing.pages.includes(audit.relativePath)) existing.pages.push(audit.relativePath);
+				continue;
+			}
+			issue.elements.push({
+				fingerprint,
+				selector: node.selector,
+				html: node.html,
+				pages: [audit.relativePath]
+			});
+		}
 	}
-	return pages;
-}
-async function assertDirectory(root, original) {
-	let stats;
-	try {
-		stats = await stat(root);
-	} catch (cause) {
-		if (cause.code === "ENOENT") throw new BuildDirectoryError(`Build directory not found: ${original}`, root);
-		throw new BuildDirectoryError(`Build directory is not readable: ${original} (${cause.message})`, root);
+	const issues = [...byRule.values()];
+	for (const issue of issues) {
+		issue.pages.sort();
+		for (const element of issue.elements) element.pages.sort();
+		issue.elements.sort(byReachThenSelector);
 	}
-	if (!stats.isDirectory()) throw new BuildDirectoryError(`Build path is not a directory: ${original}`, root);
+	issues.sort(bySeverityThenReach);
+	return issues;
 }
-async function readPage(root, relativePath) {
-	const absolutePath = path.join(root, relativePath);
-	const html = await readFile(absolutePath, "utf8");
-	return {
-		absolutePath,
-		relativePath,
-		html: html.charCodeAt(0) === 65279 ? html.slice(1) : html
-	};
-}
-function toPosix(filePath) {
-	return filePath.split(path.sep).join("/");
+/** Widest reach first, then by selector so two runs agree. */
+function byReachThenSelector(a, b) {
+	return b.pages.length - a.pages.length || a.selector.localeCompare(b.selector);
 }
 /**
-* What to suggest when a directory exists but holds no HTML.
+* Worst first, then widest reach, then by rule id.
 *
-* Nearly always the wrong directory rather than a site with no pages, and the
-* commonest way to arrive here is a framework whose build does not emit browsable
-* HTML at all. Naming the one in front of the user beats a generic "check the
-* path", so the project is sniffed for the frameworks that mislead people this
-* way — `./dist` is every tutorial's answer and is wrong for all of them.
+* An unclassified impact sorts with the most severe, on the same reasoning as
+* `--fail-on`: not knowing how bad a barrier is is not evidence that it is mild.
 */
-async function emptyDirectoryHint(dir, cwd = process.cwd()) {
-	const has = async (name) => {
-		try {
-			await stat(path.resolve(cwd, name));
-			return true;
-		} catch {
-			return false;
-		}
-	};
-	if (await has("next.config.js") || await has("next.config.mjs") || await has("next.config.ts")) return `${dir} holds no HTML, and a Next.js build does not put any there.\n  Static export writes to out/: set output: 'export' in next.config, run next build,
-  then: eaa-kit audit ./out
-  A site with SSR, API routes or middleware cannot be exported this way.`;
-	if (await has("nuxt.config.ts")) return `${dir} holds no HTML. Nuxt writes a static build to .output/public — try: eaa-kit audit ./.output/public`;
-	return `${dir} holds no HTML. Point eaa-kit at the directory your build fills with .html files\n  — commonly dist/, build/, out/ or _site/, depending on the builder.`;
+function bySeverityThenReach(a, b) {
+	const rank = (issue) => issue.impact === null ? IMPACT_LEVELS.length : IMPACT_LEVELS.indexOf(issue.impact);
+	return rank(b) - rank(a) || b.pages.length - a.pages.length || a.ruleId.localeCompare(b.ruleId);
 }
 //#endregion
 //#region src/audit/report/console.ts
@@ -116,7 +102,11 @@ function formatConsoleReport(audits, options = {}) {
 		...headerLines(audits, ctx),
 		""
 	];
-	for (const audit of audits) lines.push(...pageSection(audit, ctx));
+	lines.push(...issuesSection(audits, ctx));
+	if (options.perPage) {
+		lines.push("", ...legendLines(ctx), "");
+		for (const audit of audits) lines.push(...pageSection(audit, ctx));
+	}
 	lines.push(...summary(audits, ctx));
 	return lines.join("\n");
 }
@@ -129,6 +119,7 @@ function context(options) {
 		width,
 		maxNodes: options.maxNodes ?? DEFAULT_MAX_NODES,
 		failOn: options.failOn ?? "serious",
+		sourceFor: options.sourceFor ?? (() => void 0),
 		c,
 		symbol: (kind) => {
 			switch (kind) {
@@ -170,7 +161,17 @@ function headerLines(audits, ctx) {
 	}, {
 		text: ` ${pageCount} · ${engineLabel}`,
 		paint: ctx.c.dim
-	}]), render(ctx, [{
+	}])];
+}
+/**
+* What the per-page counts mean.
+*
+* Only with the per-page listing, which is the only place those words appear:
+* "not applicable" reads like good news unless it is spelled out, and printing
+* the gloss for a section that is not there is noise.
+*/
+function legendLines(ctx) {
+	return [render(ctx, [{
 		text: "passed = checked and met · not applicable = nothing to check",
 		paint: ctx.c.dim
 	}])];
@@ -415,107 +416,443 @@ function collapse(html) {
 function plural(count, word) {
 	return count === 1 ? word : `${word}s`;
 }
+/**
+* What is actually broken, once per element rather than once per page.
+*
+* The page-by-page listing above is the truth, and on a site built from
+* components it is not the work: one header with a missing `alt` reappears on
+* every page that renders it, and nothing in a per-page report says those are
+* one line in one file. This section says it, and orders the result by what
+* fixing it would buy.
+*/
+function issuesSection(audits, ctx) {
+	const issues = groupIssues(audits);
+	if (issues.length === 0) return [];
+	const elements = issues.reduce((total, issue) => total + issue.elements.length, 0);
+	const occurrences = issues.reduce((total, issue) => total + issue.occurrences, 0);
+	const lines = [render(ctx, [{
+		text: "Issues",
+		paint: ctx.c.bold
+	}])];
+	lines.push(render(ctx, [{
+		text: occurrences === elements ? `  ${elements} ${plural(elements, "distinct element")} to fix.` : `  ${occurrences} ${plural(occurrences, "violation")} across the site come from ${elements} ${plural(elements, "distinct element")}.`,
+		paint: ctx.c.dim
+	}]));
+	for (const issue of issues) {
+		lines.push("");
+		lines.push(render(ctx, [
+			{ text: `  ${ctx.symbol("violation")} ` },
+			{
+				text: issue.ruleId,
+				paint: ctx.c.bold
+			},
+			{
+				text: ` ${issue.impact ?? "unclassified"}`,
+				paint: ctx.c.dim
+			},
+			...issue.successCriteria.length > 0 ? [{
+				text: `, WCAG ${issue.successCriteria.join(" ")}`,
+				paint: ctx.c.dim
+			}] : []
+		]));
+		lines.push(render(ctx, [{
+			text: `      ${issue.help}`,
+			paint: ctx.c.dim
+		}]));
+		for (const element of issue.elements.slice(0, ctx.maxNodes)) {
+			lines.push(render(ctx, [{ text: `      ${collapse(element.html)}` }]));
+			lines.push(...whereLines(element, ctx));
+		}
+		if (issue.elements.length > ctx.maxNodes) lines.push(render(ctx, [{
+			text: `      …and ${issue.elements.length - ctx.maxNodes} more ${plural(issue.elements.length - ctx.maxNodes, "element")}`,
+			paint: ctx.c.dim
+		}]));
+	}
+	return lines;
+}
+/** Where one element appears, and what that says about where the fix goes. */
+function whereLines(element, ctx) {
+	const shown = element.pages.slice(0, ctx.maxNodes);
+	const rest = element.pages.length - shown.length;
+	const lines = [render(ctx, [{
+		text: `        on ${element.pages.length} ${plural(element.pages.length, "page")}:`,
+		paint: ctx.c.dim
+	}])];
+	for (const page of shown) {
+		const source = ctx.sourceFor(page);
+		lines.push(render(ctx, [{
+			text: `          ${page}`,
+			paint: ctx.c.dim
+		}, ...source === void 0 ? [] : [{
+			text: `  ${source}`,
+			paint: ctx.c.dim
+		}]]));
+	}
+	if (rest > 0) lines.push(render(ctx, [{
+		text: `          …and ${rest} more ${plural(rest, "page")}`,
+		paint: ctx.c.dim
+	}]));
+	if (isShared(element)) lines.push(render(ctx, [{
+		text: "        identical on each — likely one shared component",
+		paint: ctx.c.dim
+	}]));
+	return lines;
+}
 //#endregion
-//#region src/cli/audit.ts
+//#region src/audit/collect.ts
+/** Every HTML document a static build is expected to emit. */
+const DEFAULT_INCLUDE = ["**/*.html", "**/*.htm"];
+/** Vendored and tooling directories are never part of the shipped site. */
+const DEFAULT_EXCLUDE = ["**/node_modules/**", "**/.git/**"];
+/** Number of files read in parallel; keeps large builds under the fd limit. */
+const READ_CONCURRENCY = 24;
+/**
+* Thrown when the build directory itself is unusable. A missing or wrong
+* `dist/` is a user mistake worth reporting loudly, unlike a directory that
+* simply holds no HTML.
+*/
+var BuildDirectoryError = class extends Error {
+	dir;
+	name = "BuildDirectoryError";
+	constructor(message, dir) {
+		super(message);
+		this.dir = dir;
+	}
+};
 /**
-* The engines and the machine-readable reporters are imported where they are
-* used, not at the top of the file.
+* Glob HTML files out of a build directory and read them.
 *
-* jsdom costs 630 ms to load and axe-core another 94 ms, and a static import
-* here charges that to every invocation — `eaa-kit statement`, `--help` and a
-* mistyped flag included, none of which parse a single page. The audit path
-* pays the same cost either way, a few milliseconds later.
+* Returns pages sorted by relative path so reports and snapshots are stable
+* across platforms. An empty array means "no HTML found" — the caller decides
+* whether that is an error.
 */
-const OUTPUT_FORMATS = [
-	"console",
-	"json",
-	"sarif",
-	"html"
+async function collectPages(dir, options = {}) {
+	const root = path.resolve(dir);
+	await assertDirectory(root, dir);
+	const relativePaths = (await glob(options.include ?? DEFAULT_INCLUDE, {
+		cwd: root,
+		ignore: options.exclude ?? DEFAULT_EXCLUDE,
+		onlyFiles: true,
+		dot: false,
+		absolute: false
+	})).map(toPosix).sort();
+	const pages = [];
+	for (let i = 0; i < relativePaths.length; i += READ_CONCURRENCY) {
+		const batch = relativePaths.slice(i, i + READ_CONCURRENCY);
+		pages.push(...await Promise.all(batch.map((relativePath) => readPage(root, relativePath))));
+	}
+	return pages;
+}
+async function assertDirectory(root, original) {
+	let stats;
+	try {
+		stats = await stat(root);
+	} catch (cause) {
+		if (cause.code === "ENOENT") throw new BuildDirectoryError(`Build directory not found: ${original}`, root);
+		throw new BuildDirectoryError(`Build directory is not readable: ${original} (${cause.message})`, root);
+	}
+	if (!stats.isDirectory()) throw new BuildDirectoryError(`Build path is not a directory: ${original}`, root);
+}
+async function readPage(root, relativePath) {
+	const absolutePath = path.join(root, relativePath);
+	const html = await readFile(absolutePath, "utf8");
+	return {
+		absolutePath,
+		relativePath,
+		html: html.charCodeAt(0) === 65279 ? html.slice(1) : html
+	};
+}
+function toPosix(filePath) {
+	return filePath.split(path.sep).join("/");
+}
+/** Whether a path exists, relative to a project root. */
+async function present(root, name) {
+	try {
+		await stat(path.resolve(root, name));
+		return true;
+	} catch {
+		return false;
+	}
+}
+/** A file's contents, or undefined if it is not there. */
+async function contents(root, name) {
+	try {
+		return await readFile(path.resolve(root, name), "utf8");
+	} catch {
+		return;
+	}
+}
+const NEXT_CONFIGS = [
+	"next.config.js",
+	"next.config.mjs",
+	"next.config.ts"
 ];
-function isOutputFormat(value) {
-	return OUTPUT_FORMATS.includes(value);
+/** Common build output directories, in the order worth suggesting them. */
+const BUILD_DIRECTORIES = [
+	"dist",
+	"build",
+	"out",
+	"_site",
+	"public",
+	".output/public"
+];
+/**
+* Advice for a Next.js project, or undefined if this is not one.
+*
+* Worth a branch of its own because it is the commonest way to arrive here at
+* all: a default `next build` writes a server bundle rather than browsable
+* HTML, and `./dist` — every tutorial's answer — is a directory it never uses.
+*/
+async function nextJsAdvice(root, dir, head) {
+	const config = (await Promise.all(NEXT_CONFIGS.map(async (name) => await present(root, name) ? name : void 0))).find((name) => name !== void 0);
+	if (config === void 0) return void 0;
+	if (await present(root, "out")) return `${head} A Next.js static export writes to out/, not ${dir}.\n  Try: eaa-kit audit ./out`;
+	const source = await contents(root, config) ?? "";
+	if (!/output\s*:\s*['"`]export['"`]/.test(source)) return `${head} A Next.js build writes a server bundle, not browsable HTML.\n  To audit it, add output: 'export' to ${config}, run your build, then:\n    eaa-kit audit ./out
+  A site with SSR, API routes, middleware or ISR cannot be exported. Audit it
+  running instead:
+    eaa-kit audit --url http://localhost:3000`;
+	return `${head} ${config} sets output: 'export', but there is no out/ directory.\n  Run your build first, then: eaa-kit audit ./out
+  If the build failed, it names what blocks the export — an API route,
+  middleware, getServerSideProps or a revalidate.`;
+}
+/** Advice for a Nuxt project, or undefined if this is not one. */
+async function nuxtAdvice(root, head) {
+	if (!await present(root, "nuxt.config.ts")) return void 0;
+	return `${head} Nuxt writes a static build to .output/public.\n  Try: eaa-kit audit ./.output/public
+  Or audit it running: eaa-kit audit --url http://localhost:3000`;
 }
 /**
-* `eaa-kit audit [dir]`.
+* Advice from whatever build directories are lying around.
 *
-* Writes progress to stderr and the report to stdout, so the report can be
-* piped somewhere without the chatter coming along.
+* Naming one that is actually there beats listing the ones that usually are.
 */
-async function runAuditCommand(dir, options = {}) {
+async function siblingDirectoryAdvice(root, dir, head) {
+	const given = dir.replace(/^\.\//, "");
+	const others = (await Promise.all(BUILD_DIRECTORIES.map(async (name) => name !== given && await present(root, name) ? name : void 0))).filter((name) => name !== void 0);
+	if (others.length === 0) return void 0;
+	return `${head} This project also has ${others.map((name) => `${name}/`).join(", ")} — try one of those.`;
+}
+/**
+* What to suggest when a directory holds no HTML, or is not there at all.
+*
+* Nearly always the wrong directory rather than a site with no pages, and the
+* commonest way to arrive is a framework whose build emits no browsable HTML —
+* so rather than repeating "check the path", each branch names the next step
+* for the project actually in front of the reader. Where a static export cannot
+* work at all, that step is `--url` rather than advice that cannot apply.
+*/
+async function emptyDirectoryHint(dir, cwd = process.cwd()) {
+	const head = await present(cwd, dir) ? `${dir} holds no HTML files.` : `${dir} does not exist.`;
+	return await nextJsAdvice(cwd, dir, head) ?? await nuxtAdvice(cwd, head) ?? await siblingDirectoryAdvice(cwd, dir, head) ?? `${head} Point eaa-kit at the directory your build fills with .html files —\n  commonly dist/, build/, out/ or _site/, depending on the builder.
+  If your site renders on a server and never writes HTML, audit it running:
+    eaa-kit audit --url http://localhost:3000`;
+}
+//#endregion
+//#region src/cli/pages.ts
+/**
+* Collect the pages to audit, reporting to stderr on the way.
+*
+* Returns undefined when there is nothing to audit, having already explained
+* why. Every caller turns that into exit 2 — a run that reached no verdict,
+* which is not the same as a clean one.
+*/
+async function resolvePages(directory, options = {}) {
+	if (directory === void 0 && options.url === void 0) return resolveAutomatically(options);
+	if (options.url !== void 0) {
+		const crawled = await crawlPages(options.url, options);
+		if (!crawled) return void 0;
+		if (crawled.pages.length === 0) {
+			process.stderr.write(`${pc.yellow("warning")} No pages could be fetched from ${options.url}\n`);
+			return;
+		}
+		return {
+			pages: crawled.pages,
+			origin: crawled.origin,
+			label: options.url
+		};
+	}
+	const cwd = options.cwd ?? process.cwd();
+	const shown = options.label ?? directory;
 	let pages;
 	try {
-		pages = await collectPages(dir, {
+		pages = await collectPages(directory, {
 			...options.include ? { include: options.include } : {},
 			...options.exclude ? { exclude: options.exclude } : {}
 		});
 	} catch (cause) {
-		if (cause instanceof BuildDirectoryError) {
+		if (!(cause instanceof BuildDirectoryError)) throw cause;
+		process.stderr.write(`${pc.red("error")} ${cause.message}\n`);
+		process.stderr.write(pc.dim(`${await emptyDirectoryHint(shown, cwd)}\n`));
+		return;
+	}
+	if (pages.length === 0) {
+		process.stderr.write(`${pc.yellow("warning")} ${await emptyDirectoryHint(shown, cwd)}\n`);
+		return;
+	}
+	return {
+		pages,
+		label: shown
+	};
+}
+/**
+* Fetch the pages of a running site, reporting what happened on the way.
+*
+* Returns undefined when the crawl could not start, which the caller turns into
+* exit 2 — a run that reached no verdict, not a clean one.
+*/
+async function crawlPages(url, options) {
+	const { crawlSite, CrawlError, parseEntryUrl } = await import("./crawl-CtJbMNNb.js");
+	let entry;
+	try {
+		entry = parseEntryUrl(url, options.allowRemote ?? false);
+	} catch (cause) {
+		if (cause instanceof CrawlError) {
 			process.stderr.write(`${pc.red("error")} ${cause.message}\n`);
-			process.stderr.write(pc.dim("Point eaa-kit at your build output, e.g. eaa-kit audit ./dist\n"));
-			return {
-				audits: [],
-				exitCode: 2
-			};
+			return;
 		}
 		throw cause;
 	}
-	if (pages.length === 0) {
-		process.stderr.write(`${pc.yellow("warning")} ${await emptyDirectoryHint(dir, options.cwd ?? process.cwd())}\n`);
+	process.stderr.write(pc.dim(`Crawling ${entry.origin}…\n`));
+	const result = await crawlSite(entry, {
+		...options.allowRemote ? { allowRemote: true } : {},
+		...options.ignoreRobots ? { ignoreRobots: true } : {},
+		...options.maxPages === void 0 ? {} : { maxPages: options.maxPages },
+		...options.maxDepth === void 0 ? {} : { maxDepth: options.maxDepth },
+		...options.timeoutMs === void 0 ? {} : { timeoutMs: options.timeoutMs }
+	});
+	if (result.pages.length === 0 && result.failures.length > 0) {
+		process.stderr.write(`${pc.red("error")} Could not fetch ${entry.href} (${result.failures[0]?.reason})\n`);
+		process.stderr.write(pc.dim("  Is the site running at that address?\n"));
+		return;
+	}
+	process.stderr.write(pc.dim(`Found ${result.pages.length} ${result.pages.length === 1 ? "page" : "pages"} from ${result.discovery === "sitemap" ? "sitemap.xml and links" : "links"}\n`));
+	if (result.failures.length > 0) {
+		process.stderr.write(`${pc.yellow("warning")} ${result.failures.length} ${result.failures.length === 1 ? "URL was" : "URLs were"} not fetched, and so not audited:\n`);
+		for (const failure of result.failures.slice(0, 10)) process.stderr.write(pc.dim(`  ${failure.url} — ${failure.reason}\n`));
+		if (result.failures.length > 10) process.stderr.write(pc.dim(`  …and ${result.failures.length - 10} more\n`));
+	}
+	if (result.truncated) process.stderr.write(`${pc.yellow("warning")} Stopped at ${result.pages.length} ${result.pages.length === 1 ? "page" : "pages"}; the site has more. Raise --max-pages to go further.\n`);
+	return {
+		pages: result.pages,
+		origin: result.origin
+	};
+}
+/**
+* No directory and no URL: work out what this project needs.
+*
+* The point is that `eaa-kit audit` on its own does something useful. Anything
+* this starts is handed back as `cleanup` so the caller can stop it once the
+* report is written.
+*/
+async function resolveAutomatically(options) {
+	const cwd = options.cwd ?? process.cwd();
+	const { autoDetectSource } = await import("./project-CufCqIE2.js");
+	const detected = await autoDetectSource(cwd, {
+		...options.noBuild ? { noBuild: true } : {},
+		onStep: (message) => process.stderr.write(pc.dim(`${message}\n`))
+	});
+	if (detected?.directory !== void 0) return await resolvePages(detected.directory, {
+		...options,
+		label: path.relative(cwd, detected.directory) || "."
+	});
+	if (detected?.url !== void 0) {
+		const resolved = await resolvePages(void 0, {
+			...options,
+			url: detected.url
+		});
+		if (resolved === void 0) {
+			await detected.cleanup?.();
+			return;
+		}
 		return {
-			audits: [],
-			exitCode: 2
+			...resolved,
+			...detected.cleanup ? { cleanup: detected.cleanup } : {}
 		};
 	}
-	const engineNote = await describeEngine(pages, options);
-	process.stderr.write(pc.dim(`Auditing ${pages.length} ${pages.length === 1 ? "page" : "pages"} in ${dir}${engineNote}…\n`));
-	const runnerOptions = {
-		...options.baseUrl ? { baseUrl: options.baseUrl } : {},
-		...options.timeoutMs === void 0 ? {} : { timeoutMs: options.timeoutMs }
+	await detected?.cleanup?.();
+	process.stderr.write(`${pc.yellow("warning")} ${await emptyDirectoryHint("./dist", cwd)}\n`);
+}
+//#endregion
+//#region src/cli/audit.ts
+const OUTPUT_FORMATS = [
+	"console",
+	"json",
+	"sarif",
+	"html"
+];
+function isOutputFormat(value) {
+	return OUTPUT_FORMATS.includes(value);
+}
+/**
+* `eaa-kit audit [dir]`.
+*
+* Writes progress to stderr and the report to stdout, so the report can be
+* piped somewhere without the chatter coming along.
+*/
+async function runAuditCommand(dir, options = {}) {
+	const resolved = await resolvePages(dir, options);
+	if (!resolved) return {
+		audits: [],
+		exitCode: 2
 	};
-	let audits;
-	if (options.browser) {
-		const { BrowserUnavailableError, runBrowserAudit } = await import("./playwright-BfWuTG_u.js");
-		try {
-			audits = await runBrowserAudit(dir, pages, runnerOptions);
-		} catch (cause) {
-			if (cause instanceof BrowserUnavailableError) {
-				process.stderr.write(`${pc.red("error")} ${cause.message}\n`);
-				return {
-					audits: [],
-					exitCode: 2
-				};
+	const { pages, origin, label, cleanup } = resolved;
+	try {
+		const engineNote = await describeEngine(pages, options);
+		process.stderr.write(pc.dim(`Auditing ${pages.length} ${pages.length === 1 ? "page" : "pages"} in ${label}${engineNote}…\n`));
+		const effectiveBaseUrl = options.baseUrl ?? origin;
+		const runnerOptions = {
+			cwd: options.cwd ?? process.cwd(),
+			...effectiveBaseUrl === void 0 ? {} : { baseUrl: effectiveBaseUrl },
+			...options.timeoutMs === void 0 ? {} : { timeoutMs: options.timeoutMs }
+		};
+		let audits;
+		if (options.browser) {
+			const { BrowserUnavailableError, runBrowserAudit } = await import("./playwright-DSRnXmcd.js");
+			try {
+				audits = await runBrowserAudit(options.url === void 0 ? dir : void 0, pages, runnerOptions);
+			} catch (cause) {
+				if (cause instanceof BrowserUnavailableError) {
+					process.stderr.write(`${pc.red("error")} ${cause.message}\n`);
+					return {
+						audits: [],
+						exitCode: 2
+					};
+				}
+				throw cause;
 			}
-			throw cause;
+		} else {
+			const { runPooledAudit } = await import("./pool-DixLeu8L.js");
+			audits = await runPooledAudit(pages, {
+				...runnerOptions,
+				...options.concurrency === void 0 ? {} : { concurrency: options.concurrency }
+			});
+		}
+		const failOn = options.failOn ?? "serious";
+		if (options.baseline) {
+			const applied = await acceptBaseline(audits, options);
+			if (!applied) return {
+				audits,
+				exitCode: 2
+			};
+			audits = applied;
+		}
+		await emit(audits, label, failOn, options);
+		const unaudited = audits.filter((audit) => audit.error);
+		if (unaudited.length > 0) {
+			process.stderr.write(`${pc.red("error")} ${unaudited.length} of ${audits.length} pages could not be audited\n`);
+			return {
+				audits,
+				exitCode: 2
+			};
 		}
-	} else {
-		const { runPooledAudit } = await import("./pool-DixLeu8L.js");
-		audits = await runPooledAudit(pages, {
-			...runnerOptions,
-			...options.concurrency === void 0 ? {} : { concurrency: options.concurrency }
-		});
-	}
-	const failOn = options.failOn ?? "serious";
-	if (options.baseline) {
-		const applied = await acceptBaseline(audits, options);
-		if (!applied) return {
-			audits,
-			exitCode: 2
-		};
-		audits = applied;
-	}
-	await emit(audits, dir, failOn, options);
-	const unaudited = audits.filter((audit) => audit.error);
-	if (unaudited.length > 0) {
-		process.stderr.write(`${pc.red("error")} ${unaudited.length} of ${audits.length} pages could not be audited\n`);
 		return {
 			audits,
-			exitCode: 2
+			exitCode: countAtOrAbove(audits, failOn) > 0 ? 1 : 0
 		};
+	} finally {
+		await cleanup?.();
 	}
-	return {
-		audits,
-		exitCode: countAtOrAbove(audits, failOn) > 0 ? 1 : 0
-	};
 }
 /**
 * Move the violations the baseline accounts for out of the failing set.
@@ -526,7 +863,7 @@ async function runAuditCommand(dir, options = {}) {
 * would be as wrong as silently passing.
 */
 async function acceptBaseline(audits, options) {
-	const { applyBaseline, BaselineError, readBaseline } = await import("./baseline-Itspu3-Y.js");
+	const { applyBaseline, BaselineError, readBaseline } = await import("./baseline-CV_3lbER.js");
 	try {
 		const outcome = applyBaseline(audits, await readBaseline(options.baseline, options.cwd ?? process.cwd()));
 		if (outcome.accepted > 0) process.stderr.write(pc.dim(`Baseline accepted ${outcome.accepted} violating elements\n`));
@@ -576,9 +913,10 @@ async function emit(audits, dir, failOn, options) {
 async function renderReport(audits, dir, failOn, format, toFile, options) {
 	switch (format) {
 		case "json": {
-			const { buildJsonReport, serialiseJsonReport } = await import("./json-1ESNIiHY.js");
+			const { buildJsonReport, serialiseJsonReport } = await import("./json-C9xS1PNC.js");
 			return serialiseJsonReport(buildJsonReport(audits, {
 				directory: dir,
+				...options.url === void 0 ? {} : { sourceKind: "url" },
 				failOn,
 				...options.baseUrl ? { baseUrl: options.baseUrl } : {}
 			}));
@@ -595,12 +933,18 @@ async function renderReport(audits, dir, failOn, format, toFile, options) {
 				...options.baseUrl ? { baseUrl: options.baseUrl } : {}
 			});
 		}
-		case "console": return `${formatConsoleReport(audits, {
-			dir,
-			failOn,
-			...toFile ? { color: false } : {}
-		})}\n`;
+		case "console": {
+			const { buildRouteMap, sourceFor } = await import("./routes-BxbSZKXC.js");
+			const routes = await buildRouteMap(options.cwd ?? process.cwd());
+			return `${formatConsoleReport(audits, {
+				dir,
+				failOn,
+				sourceFor: (page) => sourceFor(routes, page),
+				...options.perPage ? { perPage: true } : {},
+				...toFile ? { color: false } : {}
+			})}\n`;
+		}
 	}
 }
 //#endregion
-export { collectPages as a, BuildDirectoryError as i, isOutputFormat as n, emptyDirectoryHint as o, runAuditCommand as r, OUTPUT_FORMATS as t };
+export { resolvePages as i, isOutputFormat as n, runAuditCommand as r, OUTPUT_FORMATS as t };