eaa-kit 0.3.0 → 0.5.0

package/dist/index.d.ts

@@ -60,10 +60,17 @@ type DefaultedSchema<T> = Schema<T> & {
 //#endregion
 //#region src/config/define.d.ts
 /** Countries with their own supervisory body and statute text. */
-declare const COUNTRIES: readonly ['AT', 'DE', 'CH'];
+declare const COUNTRIES: readonly ['AT', 'DE', 'CH', 'ES', 'FR', 'IT', 'NL'];
 type Country = (typeof COUNTRIES)[number];
-/** Languages a statement can be rendered in. */
-declare const STATEMENT_LOCALES: readonly ['de', 'en'];
+/**
+ * Languages a statement can be rendered in.
+ *
+ * Not every country has every one: a statement is a document under a particular
+ * legal regime, not a translation of a document under another, so each country
+ * has the language it is published in and English. `renderStatement` says which
+ * ones a country has when asked for one it does not.
+ */
+declare const STATEMENT_LOCALES: readonly ['de', 'en', 'es', 'fr', 'it', 'nl'];
 type StatementLocale = (typeof STATEMENT_LOCALES)[number];
 /**
  * Wording follows the EU model statement: fully, partially, or not conformant
@@ -81,6 +88,61 @@ type AssessmentMethod = (typeof ASSESSMENT_METHODS)[number];
  */
 declare const ISSUE_REASONS: readonly ['disproportionate-burden', 'out-of-scope', 'fix-planned'];
 type IssueReason = (typeof ISSUE_REASONS)[number];
+/**
+ * Defaults for `eaa-kit audit` and `eaa-kit baseline`, so a project says once
+ * what every invocation would otherwise repeat.
+ *
+ * Every field is optional and every one is a default: a flag actually typed on
+ * the command line wins, because the file is the project's usual answer and the
+ * flag is somebody asking for something else right now.
+ *
+ * `baseline` reads the subset that means the same thing to it. `output`,
+ * `format`, `failOn` and `baseline` are audit-only on purpose — a baseline
+ * written to the report's path would overwrite the report, and a threshold for
+ * failing a run means nothing to a command that records what it finds.
+ */
+declare const auditSchema: Schema<ObjectOf<{
+  /** Build directory. The positional argument wins over it. */
+  dir: OptionalSchema<string>;
+  include: OptionalSchema<string[]>;
+  exclude: OptionalSchema<string[]>;
+  /** Audit pages under their real site URL instead of file://. */
+  baseUrl: OptionalSchema<string>;
+  /** Audit a running site instead of a directory. */
+  url: OptionalSchema<string>;
+  /** Crawl a host that is not loopback. Off unless a project says otherwise. */
+  allowRemote: OptionalSchema<boolean>;
+  ignoreRobots: OptionalSchema<boolean>;
+  /** Where the site lists its pages, when that is not /sitemap.xml. */
+  sitemap: OptionalSchema<string>;
+  maxPages: OptionalSchema<number>;
+  /** 0 audits the entry page alone. */
+  maxDepth: OptionalSchema<number>;
+  /** Lowest impact that exits 1. */
+  failOn: OptionalSchema<"critical" | "minor" | "moderate" | "serious">;
+  format: OptionalSchema<"console" | "html" | "json" | "sarif">;
+  /** Write the report here instead of stdout. */
+  output: OptionalSchema<string>;
+  /** Audit in real Chromium. Needs the playwright peer. */
+  browser: OptionalSchema<boolean>;
+  /** Skip the rules the browserless engine cannot decide. No effect with `browser`. */
+  fast: OptionalSchema<boolean>;
+  concurrency: OptionalSchema<number>;
+  /** Path to a baseline; violations it accounts for do not fail the run. */
+  baseline: OptionalSchema<string>;
+  /** List every page and its result under the issues. */
+  perPage: OptionalSchema<boolean>;
+  /** Print the manual check for each rule the engine could not evaluate. */
+  manual: OptionalSchema<boolean>;
+  /** List every WCAG 2.2 A/AA criterion and what the run reached on it. */
+  coverage: OptionalSchema<boolean>;
+  /**
+   * False is `--no-build`: never run the project's build or start its server to
+   * find something to audit. Written in the positive because that is the state
+   * being described, and because a config file has no flags to negate.
+   */
+  build: OptionalSchema<boolean>;
+}>>;
 declare const configSchema: Schema<ObjectOf<{
   site: Schema<ObjectOf<{
     name: Schema<string>;
@@ -132,7 +194,50 @@ declare const configSchema: Schema<ObjectOf<{
   }>>;
   enforcement: Schema<ObjectOf<{
     /** Drives which supervisory body and statute the template names. */
-    country: Schema<"AT" | "CH" | "DE">;
+    country: Schema<"AT" | "CH" | "DE" | "ES" | "FR" | "IT" | "NL">;
+  }>>;
+  /** Defaults for the audit commands. Nothing here reaches the statement. */
+  audit: OptionalSchema<ObjectOf<{
+    /** Build directory. The positional argument wins over it. */
+    dir: OptionalSchema<string>;
+    include: OptionalSchema<string[]>;
+    exclude: OptionalSchema<string[]>;
+    /** Audit pages under their real site URL instead of file://. */
+    baseUrl: OptionalSchema<string>;
+    /** Audit a running site instead of a directory. */
+    url: OptionalSchema<string>;
+    /** Crawl a host that is not loopback. Off unless a project says otherwise. */
+    allowRemote: OptionalSchema<boolean>;
+    ignoreRobots: OptionalSchema<boolean>;
+    /** Where the site lists its pages, when that is not /sitemap.xml. */
+    sitemap: OptionalSchema<string>;
+    maxPages: OptionalSchema<number>;
+    /** 0 audits the entry page alone. */
+    maxDepth: OptionalSchema<number>;
+    /** Lowest impact that exits 1. */
+    failOn: OptionalSchema<"critical" | "minor" | "moderate" | "serious">;
+    format: OptionalSchema<"console" | "html" | "json" | "sarif">;
+    /** Write the report here instead of stdout. */
+    output: OptionalSchema<string>;
+    /** Audit in real Chromium. Needs the playwright peer. */
+    browser: OptionalSchema<boolean>;
+    /** Skip the rules the browserless engine cannot decide. No effect with `browser`. */
+    fast: OptionalSchema<boolean>;
+    concurrency: OptionalSchema<number>;
+    /** Path to a baseline; violations it accounts for do not fail the run. */
+    baseline: OptionalSchema<string>;
+    /** List every page and its result under the issues. */
+    perPage: OptionalSchema<boolean>;
+    /** Print the manual check for each rule the engine could not evaluate. */
+    manual: OptionalSchema<boolean>;
+    /** List every WCAG 2.2 A/AA criterion and what the run reached on it. */
+    coverage: OptionalSchema<boolean>;
+    /**
+     * False is `--no-build`: never run the project's build or start its server to
+     * find something to audit. Written in the positive because that is the state
+     * being described, and because a config file has no flags to negate.
+     */
+    build: OptionalSchema<boolean>;
   }>>;
 }>>;
 /**
@@ -167,6 +272,7 @@ interface EaaConfigInput {
   enforcement: {
     country: Country;
   };
+  audit?: AuditConfig;
 }
 /** One barrier, as written in a config file. */
 interface KnownIssueInput {
@@ -178,6 +284,15 @@ interface KnownIssueInput {
 }
 type EaaConfig = Infer<typeof configSchema>;
 type KnownIssue = EaaConfig['compliance']['knownIssues'][number];
+/**
+ * The `audit` block, as written and as parsed — every field is optional.
+ *
+ * `undefined` is mapped out of the value types rather than left in them:
+ * `s.object` never writes a key it did not parse, so an absent field is an
+ * absent key, and the commands spread this over their own options where a
+ * present-but-undefined key would overwrite a real value.
+ */
+type AuditConfig = { [K in keyof Infer<typeof auditSchema>]?: Exclude<Infer<typeof auditSchema>[K], undefined>; };
 /**
  * Identity function that gives `eaa.config.ts` its types. Deliberately does not
  * validate: a config file is loaded and checked in one place, so that an error

package/dist/index.js

@@ -1,3 +1,3 @@
-import { a as COMPLIANCE_STATUSES, c as ISSUE_REASONS, d as defineConfig, f as parseConfig, i as ASSESSMENT_METHODS, l as STATEMENT_LOCALES, n as findConfigFile, o as COUNTRIES, r as loadConfig, s as ConfigError, t as CONFIG_FILENAMES, u as configSchema } from "./load-UYXLqGV9.js";
-import { a as summariseAuditReport, i as readAuditReport, n as toHtmlBody, o as StatementError, r as toHtmlDocument, t as renderStatement } from "./render-DI_aCnAZ.js";
+import { a as ASSESSMENT_METHODS, c as ConfigError, d as configSchema, f as defineConfig, i as loadConfig, l as ISSUE_REASONS, n as findConfigFile, o as COMPLIANCE_STATUSES, p as parseConfig, s as COUNTRIES, t as CONFIG_FILENAMES, u as STATEMENT_LOCALES } from "./load-yAR4wzez.js";
+import { a as summariseAuditReport, i as readAuditReport, n as toHtmlBody, o as StatementError, r as toHtmlDocument, t as renderStatement } from "./render-DbGOVmhx.js";
 export { ASSESSMENT_METHODS, COMPLIANCE_STATUSES, CONFIG_FILENAMES, COUNTRIES, ConfigError, ISSUE_REASONS, STATEMENT_LOCALES, StatementError, configSchema, defineConfig, findConfigFile, loadConfig, parseConfig, readAuditReport, renderStatement, summariseAuditReport, toHtmlBody, toHtmlDocument };

package/dist/{init-DiLiYvN1.js → init-CW7LfGT5.js}

@@ -1,6 +1,7 @@
-import { o as COUNTRIES, t as CONFIG_FILENAMES } from "./load-UYXLqGV9.js";
+import { t as DEFAULT_FAIL_ON } from "./impact-DZt2oBCP.js";
+import { s as COUNTRIES, t as CONFIG_FILENAMES } from "./load-yAR4wzez.js";
 import { t as exists } from "./fs-BmPtmFke.js";
-import { i as note, o as warn, r as fail } from "./command-Dxpa00Ha.js";
+import { l as warn, o as fail, s as note } from "./command-C3D7JWn6.js";
 import { readFile, writeFile } from "node:fs/promises";
 import path from "node:path";
 import pc from "picocolors";
@@ -9,7 +10,11 @@ import { createInterface } from "node:readline/promises";
 const COUNTRY_LOCALES = {
 	AT: "de-AT",
 	DE: "de-DE",
-	CH: "de-CH"
+	CH: "de-CH",
+	ES: "es-ES",
+	FR: "fr-FR",
+	IT: "it-IT",
+	NL: "nl-NL"
 };
 /**
 * Everything the project already says about itself.
@@ -83,7 +88,8 @@ async function runInitCommand(options = {}) {
 			assessmentMethod: "self-assessment",
 			knownIssues: []
 		},
-		enforcement: { country }
+		enforcement: { country },
+		audit: { failOn: DEFAULT_FAIL_ON }
 	};
 	try {
 		await writeFile(target, `${JSON.stringify(config, null, 2)}\n`, "utf8");

package/dist/jsdom-22Bkt65v.js

@@ -0,0 +1,3 @@
+import "./result-BWcYXeRs.js";
+import { n as runJsdomAudit } from "./jsdom-B--cEH-G.js";
+export { runJsdomAudit };

package/dist/jsdom-B--cEH-G.js

@@ -0,0 +1,89 @@
+import { a as failedPage, i as blindRulesInScope, l as runOptions, n as DEFAULT_TAGS, s as pageUrl, t as DEFAULT_PAGE_TIMEOUT_MS, u as shapeResults } from "./result-BWcYXeRs.js";
+import axe from "axe-core";
+import { Script } from "node:vm";
+import { JSDOM, VirtualConsole } from "jsdom";
+//#region src/audit/runners/jsdom.ts
+/**
+* Per-page ceiling.
+*
+* A soft one, and the limit is worth stating: this races axe-core against a
+* timer, so it only fires where the work yields to the event loop. Neither
+* jsdom's parse nor axe-core's walk of the tree does, so a document pathological
+* enough to hold the thread runs past this unimpeded. The hard ceiling is the
+* worker pool's, which terminates the thread; see the note on `runWorkers`.
+*/
+const DEFAULT_TIMEOUT_MS = DEFAULT_PAGE_TIMEOUT_MS;
+/**
+* Audit collected pages with axe-core inside jsdom.
+*
+* Pages are processed sequentially: jsdom parsing and axe-core are both
+* CPU-bound on the main thread, so concurrency buys nothing here. A page that
+* throws or times out is recorded with an `error` and the run continues.
+*/
+async function runJsdomAudit(pages, options = {}) {
+	const audits = [];
+	for (const page of pages) audits.push(await auditPage(page, options));
+	return audits;
+}
+async function auditPage(page, options = {}) {
+	const tags = options.tags ?? DEFAULT_TAGS;
+	const url = pageUrl(page, options.baseUrl);
+	const startedAt = Date.now();
+	const identity = {
+		relativePath: page.relativePath,
+		absolutePath: page.absolutePath,
+		url,
+		engine: "jsdom"
+	};
+	let dom;
+	try {
+		dom = createDom(page.html, url);
+		injectAxe(dom);
+		const { axe: pageAxe } = dom.window;
+		const results = await withTimeout(pageAxe.run(dom.window.document, runOptions(tags, { skipBlindRules: options.fast === true })), options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+		return shapeResults(results, {
+			...identity,
+			durationMs: Date.now() - startedAt,
+			blind: blindRulesInScope(tags)
+		});
+	} catch (cause) {
+		return failedPage({
+			...identity,
+			durationMs: Date.now() - startedAt
+		}, cause instanceof Error ? cause.message : String(cause));
+	} finally {
+		dom?.window.close();
+	}
+}
+function createDom(html, url) {
+	const virtualConsole = new VirtualConsole();
+	virtualConsole.on("jsdomError", () => {});
+	return new JSDOM(html, {
+		url,
+		virtualConsole,
+		runScripts: "outside-only",
+		pretendToBeVisual: true
+	});
+}
+/**
+* axe-core is 1.3 MB of source. Compiling it once and re-running the compiled
+* script in each window's context avoids re-parsing it for every page.
+*/
+let axeScript;
+function injectAxe(dom) {
+	axeScript ??= new Script(axe.source, { filename: "axe-core.js" });
+	axeScript.runInContext(dom.getInternalVMContext());
+}
+async function withTimeout(promise, ms) {
+	promise.catch(() => {});
+	let timer;
+	try {
+		return await Promise.race([promise, new Promise((_resolve, reject) => {
+			timer = setTimeout(() => reject(/* @__PURE__ */ new Error(`axe-core timed out after ${ms}ms`)), ms);
+		})]);
+	} finally {
+		clearTimeout(timer);
+	}
+}
+//#endregion
+export { runJsdomAudit as n, auditPage as t };

package/dist/{json-Cnv9nd6U.js → json-DROX33kh.js}

@@ -1,6 +1,8 @@
-import { i as impactLabel, o as isImpactLevel, r as countAtOrAbove } from "./impact-YdoOtFqm.js";
+import { i as impactLabel, o as isImpactLevel, r as countAtOrAbove } from "./impact-DZt2oBCP.js";
 import { t as TOOL_VERSION } from "./version-B3v4rNoG.js";
-import { a as ruleOutcomes } from "./result-DLxd2Eip.js";
+import { t as elementFingerprint } from "./fingerprint-BjYV_0F7.js";
+import { c as ruleOutcomes } from "./result-BWcYXeRs.js";
+import { t as buildCoverage } from "./coverage-B_Y6l-Ra.js";
 import axe from "axe-core";
 /**
 * Build the machine-readable report.
@@ -15,7 +17,7 @@ import axe from "axe-core";
 function buildJsonReport(audits, options) {
 	const generatedAt = (options.now ?? /* @__PURE__ */ new Date()).toISOString();
 	return {
-		schemaVersion: 1,
+		schemaVersion: 2,
 		tool: {
 			name: "eaa-kit",
 			version: TOOL_VERSION,
@@ -30,6 +32,8 @@ function buildJsonReport(audits, options) {
 			baseUrl: options.baseUrl ?? null
 		},
 		summary: buildSummary(audits, options.failOn),
+		completeness: options.completeness,
+		coverage: buildCoverage(audits),
 		rules: buildRuleIndex(audits),
 		pages: audits.map(toJsonPage)
 	};
@@ -115,7 +119,8 @@ function toJsonFinding(finding) {
 		nodes: finding.nodes.map((node) => ({
 			html: node.html,
 			target: node.target,
-			failureSummary: node.failureSummary ?? null
+			failureSummary: node.failureSummary ?? null,
+			fingerprint: elementFingerprint(finding.ruleId, node.target.join(" "), node.html)
 		}))
 	};
 }

package/dist/{json-B0Y7rNjt.js → json-D_Mnnft5.js}

@@ -1,2 +1,2 @@
-import { r as serialiseJsonReport, t as buildJsonReport } from "./json-Cnv9nd6U.js";
+import { r as serialiseJsonReport, t as buildJsonReport } from "./json-DROX33kh.js";
 export { buildJsonReport, serialiseJsonReport };

package/dist/load-CFq2VQtT.js

@@ -0,0 +1,2 @@
+import { r as loadAuditConfig } from "./load-yAR4wzez.js";
+export { loadAuditConfig };

package/dist/{load-UYXLqGV9.js → load-yAR4wzez.js}

@@ -1,4 +1,5 @@
-import { _ as withDefault, c as object, f as safeParse, g as url, h as union, i as isoDate, l as optional, m as transform, n as email, p as string, r as enumeration, t as array, u as pipe } from "./schema-CMZ8ItGk.js";
+import { n as IMPACT_LEVELS } from "./impact-DZt2oBCP.js";
+import { _ as union, a as integer, d as optional, f as pipe, g as transform, h as string, i as enumeration, m as safeParse, n as boolean, o as isoDate, r as email, t as array, u as object, v as url, y as withDefault } from "./schema-DJSF4K05.js";
 import { r as isFile } from "./fs-BmPtmFke.js";
 import { readFile } from "node:fs/promises";
 import path from "node:path";
@@ -8,10 +9,28 @@ import { pathToFileURL } from "node:url";
 const COUNTRIES = [
 	"AT",
 	"DE",
-	"CH"
+	"CH",
+	"ES",
+	"FR",
+	"IT",
+	"NL"
+];
+/**
+* Languages a statement can be rendered in.
+*
+* Not every country has every one: a statement is a document under a particular
+* legal regime, not a translation of a document under another, so each country
+* has the language it is published in and English. `renderStatement` says which
+* ones a country has when asked for one it does not.
+*/
+const STATEMENT_LOCALES = [
+	"de",
+	"en",
+	"es",
+	"fr",
+	"it",
+	"nl"
 ];
-/** Languages a statement can be rendered in. */
-const STATEMENT_LOCALES = ["de", "en"];
 /**
 * Wording follows the EU model statement: fully, partially, or not conformant
 * with the standard. "partially-compliant" is the honest answer for most sites
@@ -50,6 +69,66 @@ const knownIssueObject = object({
 * rather than a union that callers have to narrow before reading `remedyBy`.
 */
 const knownIssueSchema = union([pipe(transform(string({ min: 1 }), (description) => ({ description })), knownIssueObject), knownIssueObject], "expected a description, or an object with one");
+/**
+* Defaults for `eaa-kit audit` and `eaa-kit baseline`, so a project says once
+* what every invocation would otherwise repeat.
+*
+* Every field is optional and every one is a default: a flag actually typed on
+* the command line wins, because the file is the project's usual answer and the
+* flag is somebody asking for something else right now.
+*
+* `baseline` reads the subset that means the same thing to it. `output`,
+* `format`, `failOn` and `baseline` are audit-only on purpose — a baseline
+* written to the report's path would overwrite the report, and a threshold for
+* failing a run means nothing to a command that records what it finds.
+*/
+const auditSchema = object({
+	/** Build directory. The positional argument wins over it. */
+	dir: optional(string({ min: 1 })),
+	include: optional(array(string({ min: 1 }))),
+	exclude: optional(array(string({ min: 1 }))),
+	/** Audit pages under their real site URL instead of file://. */
+	baseUrl: optional(url()),
+	/** Audit a running site instead of a directory. */
+	url: optional(url()),
+	/** Crawl a host that is not loopback. Off unless a project says otherwise. */
+	allowRemote: optional(boolean()),
+	ignoreRobots: optional(boolean()),
+	/** Where the site lists its pages, when that is not /sitemap.xml. */
+	sitemap: optional(string({ min: 1 })),
+	maxPages: optional(integer({ min: 1 })),
+	/** 0 audits the entry page alone. */
+	maxDepth: optional(integer({ min: 0 })),
+	/** Lowest impact that exits 1. */
+	failOn: optional(enumeration(IMPACT_LEVELS)),
+	format: optional(enumeration([
+		"console",
+		"json",
+		"sarif",
+		"html"
+	])),
+	/** Write the report here instead of stdout. */
+	output: optional(string({ min: 1 })),
+	/** Audit in real Chromium. Needs the playwright peer. */
+	browser: optional(boolean()),
+	/** Skip the rules the browserless engine cannot decide. No effect with `browser`. */
+	fast: optional(boolean()),
+	concurrency: optional(integer({ min: 1 })),
+	/** Path to a baseline; violations it accounts for do not fail the run. */
+	baseline: optional(string({ min: 1 })),
+	/** List every page and its result under the issues. */
+	perPage: optional(boolean()),
+	/** Print the manual check for each rule the engine could not evaluate. */
+	manual: optional(boolean()),
+	/** List every WCAG 2.2 A/AA criterion and what the run reached on it. */
+	coverage: optional(boolean()),
+	/**
+	* False is `--no-build`: never run the project's build or start its server to
+	* find something to audit. Written in the positive because that is the state
+	* being described, and because a config file has no flags to negate.
+	*/
+	build: optional(boolean())
+});
 const configSchema = object({
 	site: object({
 		name: string({ min: 1 }),
@@ -91,9 +170,20 @@ const configSchema = object({
 	}),
 	enforcement: object({ 
 	/** Drives which supervisory body and statute the template names. */
-country: enumeration(COUNTRIES) })
+country: enumeration(COUNTRIES) }),
+	/** Defaults for the audit commands. Nothing here reaches the statement. */
+	audit: optional(auditSchema)
 });
 /**
+* The `audit` block on its own.
+*
+* A project that only wants audit defaults should not have to write a complete
+* statement config to get them, and `s.object` drops the keys it does not know,
+* so the same file satisfies both readers: `statement` demands the whole
+* document, `audit` reads this and ignores the rest.
+*/
+const auditConfigSchema = object({ audit: optional(auditSchema) });
+/**
 * Identity function that gives `eaa.config.ts` its types. Deliberately does not
 * validate: a config file is loaded and checked in one place, so that an error
 * points at the file rather than at wherever the module happened to be
@@ -112,7 +202,20 @@ var ConfigError = class extends Error {
 };
 /** Validate an already-loaded config object. */
 function parseConfig(value, source = "config") {
-	const result = safeParse(configSchema, value);
+	return parse(configSchema, value, source);
+}
+/**
+* Read only the `audit` block, ignoring whatever else the file holds.
+*
+* Returns undefined where there is no block, which is the common case: most
+* config files exist for the statement alone, and finding one is not a reason
+* to change how an audit runs.
+*/
+function parseAuditConfig(value, source = "config") {
+	return parse(auditConfigSchema, value, source).audit;
+}
+function parse(schema, value, source) {
+	const result = safeParse(schema, value);
 	if (result.success) return result.data;
 	const issues = result.error.issues.map((issue) => {
 		const path = issue.path.join(".");
@@ -145,10 +248,32 @@ async function loadConfig(options = {}) {
 	if (!file) throw new ConfigError(`No config file found in ${cwd} or its parent directories`, CONFIG_FILENAMES.map((name) => `looked for ${name}`));
 	if (!await isFile(file)) throw new ConfigError(`Config file not found: ${file}`);
 	return {
-		config: parseConfig(file.endsWith(".json") ? await importJson(file) : await importModule(file), path.basename(file)),
+		config: parseConfig(await readConfigFile(file), path.basename(file)),
+		path: file
+	};
+}
+/**
+* Find the config file and read its `audit` block, for the commands that take
+* defaults from it.
+*
+* Returns undefined when there is no config file at all. That is not an error
+* here as it is for `statement`: `eaa-kit audit` has always run against a
+* project that has never heard of a config file, and it must keep doing so. An
+* explicit path that is not there is still an error, because somebody named it.
+*/
+async function loadAuditConfig(options = {}) {
+	const cwd = path.resolve(options.cwd ?? process.cwd());
+	const file = options.path ? path.resolve(cwd, options.path) : await findConfigFile(cwd);
+	if (!file) return void 0;
+	if (!await isFile(file)) throw new ConfigError(`Config file not found: ${file}`);
+	return {
+		audit: parseAuditConfig(await readConfigFile(file), path.basename(file)),
 		path: file
 	};
 }
+function readConfigFile(file) {
+	return file.endsWith(".json") ? importJson(file) : importModule(file);
+}
 /** Walks up from `cwd`, so the CLI works from a subdirectory of the project. */
 async function findConfigFile(cwd) {
 	let directory = path.resolve(cwd);
@@ -183,4 +308,4 @@ async function importModule(file) {
 	return module.default;
 }
 //#endregion
-export { COMPLIANCE_STATUSES as a, ISSUE_REASONS as c, defineConfig as d, parseConfig as f, ASSESSMENT_METHODS as i, STATEMENT_LOCALES as l, findConfigFile as n, COUNTRIES as o, loadConfig as r, ConfigError as s, CONFIG_FILENAMES as t, configSchema as u };
+export { ASSESSMENT_METHODS as a, ConfigError as c, configSchema as d, defineConfig as f, loadConfig as i, ISSUE_REASONS as l, findConfigFile as n, COMPLIANCE_STATUSES as o, parseConfig as p, loadAuditConfig as r, COUNTRIES as s, CONFIG_FILENAMES as t, STATEMENT_LOCALES as u };

package/dist/nuxt/index.d.ts

@@ -0,0 +1,35 @@
+import { n as IntegrationOptions, t as BuildAuditError } from "../run-CtcEUhbe.js";
+//#region src/nuxt/index.d.ts
+/** The part of the Nitro instance this reads, handed over by `nitro:init`. */
+interface NitroLike {
+  options: {
+    output?: {
+      publicDir?: string;
+    };
+    /** True for `nuxt generate`; absent for a server build. */
+    static?: boolean;
+  };
+}
+interface NuxtOptionsLike {
+  rootDir?: string;
+}
+interface NuxtLike {
+  options: NuxtOptionsLike;
+  hook(name: 'nitro:init', handler: (nitro: NitroLike) => void): void;
+  hook(name: 'close', handler: () => Promise<void>): void;
+}
+interface EaaKitNuxtOptions extends IntegrationOptions {
+  /** Directory to audit. Defaults to the one Nitro says it wrote. */
+  directory?: string;
+  /**
+   * Let a server build pass without auditing anything.
+   *
+   * Off by default: `nuxt build` writes no browsable HTML, and a silent pass
+   * over a directory with no pages in it is indistinguishable from a clean
+   * site.
+   */
+  allowServerBuild?: boolean;
+}
+declare function eaaKitModule(options?: EaaKitNuxtOptions, nuxt?: NuxtLike): void;
+//#endregion
+export { BuildAuditError, EaaKitNuxtOptions, NitroLike, NuxtLike, NuxtOptionsLike, eaaKitModule as default };

package/dist/nuxt/index.js

@@ -0,0 +1,23 @@
+import { n as auditBuild, r as stderrLogger, t as BuildAuditError } from "../run-C2nKFcb-.js";
+import path from "node:path";
+//#region src/nuxt/index.ts
+function eaaKitModule(options = {}, nuxt) {
+	if (nuxt === void 0) return;
+	let publicDir;
+	let prerendered = false;
+	nuxt.hook("nitro:init", (nitro) => {
+		publicDir = nitro.options.output?.publicDir;
+		prerendered = nitro.options.static === true;
+	});
+	nuxt.hook("close", async () => {
+		const directory = options.directory ?? publicDir;
+		if (options.directory === void 0 && !prerendered) {
+			if (options.allowServerBuild === true) return;
+			throw new BuildAuditError("eaa-kit: this was a server build, so no pages were written to disk and there was nothing to audit. Run `nuxt generate` to prerender them, audit the running site with `eaa-kit audit --url`, or set allowServerBuild to skip this.");
+		}
+		if (directory === void 0) throw new BuildAuditError("eaa-kit: Nitro reported no public directory, so there is no path to audit. Pass `directory` to the module to name one.");
+		await auditBuild(path.resolve(nuxt.options.rootDir ?? process.cwd(), directory), options, stderrLogger());
+	});
+}
+//#endregion
+export { BuildAuditError, eaaKitModule as default };

package/dist/{playwright-DYFsGUNd.js → playwright-BojtYVUa.js}

@@ -1,5 +1,5 @@
 import { r as isFile } from "./fs-BmPtmFke.js";
-import { i as pageUrl, n as failedPage, o as runOptions, s as shapeResults, t as DEFAULT_TAGS } from "./result-DLxd2Eip.js";
+import { a as failedPage, l as runOptions, n as DEFAULT_TAGS, s as pageUrl, u as shapeResults } from "./result-BWcYXeRs.js";
 import { createRequire } from "node:module";
 import { stat } from "node:fs/promises";
 import path from "node:path";
@@ -122,6 +122,21 @@ const DEFAULT_VIEWPORT = {
 	height: 720
 };
 /**
+* Pages open at once.
+*
+* This runner used to audit strictly one page at a time while the browserless
+* one had a whole measured worker pool — which had it backwards, since the
+* browser is the slow engine: it fetches the stylesheets and images a real
+* visitor would, and spends most of a page waiting on them rather than on the
+* CPU. Waiting on four at once is close to free.
+*
+* Four rather than more because each open page holds a document tree, its
+* decoded images and its own copy of axe-core, and Chromium's memory is the
+* limit here rather than cores. Past this the gain flattens and the cost does
+* not.
+*/
+const DEFAULT_CONCURRENCY = 4;
+/**
 * Audit a built site in real Chromium.
 *
 * This is the engine that can answer the rules jsdom is blind to: colour
@@ -152,11 +167,20 @@ async function runBrowserAudit(directory, pages, options = {}) {
 			viewport,
 			bypassCSP: true
 		});
-		const audits = [];
-		for (const page of pages) audits.push(await auditOne(context, server?.origin, page, {
-			tags,
-			timeout,
-			...options
+		const audits = Array.from({ length: pages.length });
+		const lanes = Math.max(1, Math.min(options.concurrency ?? DEFAULT_CONCURRENCY, pages.length));
+		let next = 0;
+		await Promise.all(Array.from({ length: lanes }, async () => {
+			while (true) {
+				const index = next;
+				if (index >= pages.length) return;
+				next += 1;
+				audits[index] = await auditOne(context, server?.origin, pages[index], {
+					tags,
+					timeout,
+					...options
+				});
+			}
 		}));
 		await context.close();
 		return audits;