eaa-kit 0.4.0 → 0.5.0

package/dist/command-C3D7JWn6.js

@@ -0,0 +1,160 @@
+import { mkdir, writeFile } from "node:fs/promises";
+import path from "node:path";
+import pc from "picocolors";
+//#region src/cli/command.ts
+/**
+* What every command does around the audit itself: say what is happening, run
+* the engine, and put the document somewhere.
+*
+* `audit` and `baseline` are siblings — one reports what a run found and the
+* other writes it down — so they take the same flags, choose between the same
+* two engines and fail on the same setup problems. Keeping that in one place is
+* what stops the two commands drifting into disagreeing about what a run is.
+*/
+/** Progress and diagnostics go to stderr, so the report can be piped away. */
+function note(message) {
+	process.stderr.write(pc.dim(`${message}\n`));
+}
+function warn(message) {
+	process.stderr.write(`${pc.yellow("warning")} ${message}\n`);
+}
+function fail(message) {
+	process.stderr.write(`${pc.red("error")} ${message}\n`);
+}
+/**
+* Advice the reader should not miss, without the `warning` prefix: nothing has
+* gone wrong, but what happens next is theirs to get right.
+*/
+function advise(message) {
+	process.stderr.write(pc.yellow(`${message}\n`));
+}
+/**
+* Audit the pages with whichever engine was asked for.
+*
+* Returns undefined when the browser was asked for and is not usable, having
+* already said so: Playwright missing is a setup problem with a specific fix,
+* not a crash, and both commands turn it into exit 2.
+*/
+async function runEngine(pages, options) {
+	const runnerOptions = {
+		cwd: options.cwd,
+		...options.baseUrl === void 0 ? {} : { baseUrl: options.baseUrl },
+		...options.timeoutMs === void 0 ? {} : { timeoutMs: options.timeoutMs }
+	};
+	if (!options.browser) {
+		const { runPooledAudit } = await import("./pool-BO25OIez.js");
+		return runPooledAudit(pages, {
+			...runnerOptions,
+			...options.fast ? { fast: true } : {},
+			...options.concurrency === void 0 ? {} : { concurrency: options.concurrency }
+		});
+	}
+	const { BrowserUnavailableError, runBrowserAudit } = await import("./playwright-BojtYVUa.js");
+	try {
+		return await runBrowserAudit(options.directory, pages, {
+			...runnerOptions,
+			...options.concurrency === void 0 ? {} : { concurrency: options.concurrency }
+		});
+	} catch (cause) {
+		if (cause instanceof BrowserUnavailableError) {
+			fail(cause.message);
+			return;
+		}
+		throw cause;
+	}
+}
+/**
+* Write a document to `output`, or to stdout when there is none. Parent
+* directories are created, since a report path in CI usually names one that is
+* not there yet.
+*/
+async function emitDocument(body, output, cwd) {
+	if (output === void 0) {
+		process.stdout.write(body);
+		return;
+	}
+	const target = path.resolve(cwd, output);
+	await mkdir(path.dirname(target), { recursive: true });
+	await writeFile(target, body, "utf8");
+}
+/**
+* Audit defaults from the project's config file.
+*
+* `audit` and `baseline` are run from a build script over and over with the
+* same six flags, and the flags are the only place to say them: the config file
+* has existed since 0.2 and served the statement alone. An `audit` block there
+* is that list written once.
+*
+* Everything it returns is a default. The flags are merged over it by the
+* caller, because the file is the project's usual answer and a flag is somebody
+* asking for something else on this run.
+*
+* No config file at all is not an error, unlike for `statement`: this command
+* has always run against projects that have never heard of one. A file that
+* exists and cannot be read is exit 2 — it was written to be used, and running
+* on different settings than it names would be worse than stopping.
+*/
+async function auditDefaults(options = {}) {
+	const { loadAuditConfig } = await import("./load-CFq2VQtT.js");
+	const loaded = await loadAuditConfig({
+		...options.cwd ? { cwd: options.cwd } : {},
+		...options.config ? { path: options.config } : {}
+	});
+	if (!loaded?.audit) return {};
+	note(`Defaults from ${path.basename(loaded.path)}`);
+	return loaded.audit;
+}
+function auditInvocation(dir, defaults, flags) {
+	const { build, config: _config, ...typed } = flags;
+	const { dir: configDir, build: configBuild, ...fromConfig } = defaults;
+	return {
+		dir: dir ?? configDir,
+		options: {
+			...fromConfig,
+			...typed,
+			...build === false || configBuild === false ? { noBuild: true } : {}
+		}
+	};
+}
+/**
+* The same, for `baseline`, which reads the defaults that mean the same thing
+* to it.
+*
+* Deliberately a subset. `output` names where the report goes for one command
+* and where the baseline goes for the other, so carrying it across would write
+* a baseline over the path somebody set aside for a report; `format`, `failOn`
+* and `baseline` all describe a verdict this command does not reach.
+*/
+function baselineInvocation(dir, defaults, flags) {
+	const { config: _config, ...typed } = flags;
+	return {
+		dir: dir ?? defaults.dir ?? "./dist",
+		options: {
+			...baselineDefaults(defaults),
+			...typed
+		}
+	};
+}
+function baselineDefaults(config) {
+	return pick(config, [
+		"include",
+		"exclude",
+		"baseUrl",
+		"url",
+		"allowRemote",
+		"ignoreRobots",
+		"sitemap",
+		"maxPages",
+		"maxDepth",
+		"browser",
+		"concurrency"
+	]);
+}
+/** Copies the keys that are actually set, so nothing spreads an undefined over a real value. */
+function pick(source, keys) {
+	const out = {};
+	for (const key of keys) if (source[key] !== void 0) out[key] = source[key];
+	return out;
+}
+//#endregion
+export { emitDocument as a, runEngine as c, baselineInvocation as i, warn as l, auditDefaults as n, fail as o, auditInvocation as r, note as s, advise as t };

package/dist/{coverage-B4IBKMO8.js → coverage-B_Y6l-Ra.js}

@@ -1,4 +1,4 @@
-import { n as ENGINE_BLIND_RULES, t as DEFAULT_TAGS, u as successCriteria } from "./result-DoamKFsp.js";
+import { d as successCriteria, n as DEFAULT_TAGS, r as ENGINE_BLIND_RULES } from "./result-BWcYXeRs.js";
 import axe from "axe-core";
 //#region src/audit/manual.ts
 /**
@@ -467,6 +467,7 @@ function buildCoverage(audits, tags = DEFAULT_TAGS) {
 	const byCriterion = rulesByCriterion(tags);
 	const decided = decidedRules(audits);
 	const blinded = blindedRules(audits);
+	const jsdomBlindApplies = audits.length === 0 || audits.some((audit) => audit.engine !== "browser");
 	const criteria = WCAG22_AA_CRITERIA.map((criterion) => {
 		const rules = byCriterion.get(criterion.number) ?? [];
 		if (rules.length === 0) return {
@@ -481,7 +482,7 @@ function buildCoverage(audits, tags = DEFAULT_TAGS) {
 			rules,
 			browserWouldAnswer: false
 		};
-		const engineBlind = rules.filter((rule) => blinded.has(rule) || ENGINE_BLIND_RULES[rule] !== void 0);
+		const engineBlind = rules.filter((rule) => blinded.has(rule) || jsdomBlindApplies && ENGINE_BLIND_RULES[rule] !== void 0);
 		if (engineBlind.length > 0) return {
 			...criterion,
 			status: "not-evaluated",

package/dist/{crawl-BiI1Lau_.js → crawl-BUWPgaGW.js}

@@ -1,6 +1,20 @@
-import { i as stripBom } from "./collect-CFM8gEVv.js";
+import { a as stripBom } from "./collect-Cu1q9NTB.js";
 /** Requests in flight at once. Politeness, not throughput. */
 const REQUEST_CONCURRENCY = 4;
+/**
+* Largest response body this will read, in bytes.
+*
+* A crawl reads whatever the server sends, and nothing obliges a server to send
+* something reasonable — a misconfigured export endpoint, a log streamed as
+* text/html, or a host that simply does not stop. `response.text()` buffers all
+* of it before anyone can object, so the ceiling has to be applied while the
+* body is still arriving.
+*
+* Matches the on-disk page limit: the two paths audit the same kind of
+* document, and a page that would be declined off disk should not be accepted
+* because it arrived over HTTP instead.
+*/
+const MAX_BODY_BYTES = 33554432;
 var CrawlError = class extends Error {
 	name = "CrawlError";
 };
@@ -79,7 +93,7 @@ function urlsFromSitemap(xml, origin) {
 	return urls;
 }
 /** One request, with a timeout, returning HTML or a reason it is not a page. */
-async function fetchPage(url, impl, timeoutMs, origin) {
+async function fetchPage(url, impl, timeoutMs, origin, maxBodyBytes) {
 	const controller = new AbortController();
 	const timer = setTimeout(() => controller.abort(), timeoutMs);
 	try {
@@ -106,11 +120,16 @@ async function fetchPage(url, impl, timeoutMs, origin) {
 			ok: false,
 			reason: `not HTML (${type.split(";")[0] || "no content-type"})`
 		};
+		const body = await readCapped(response, maxBodyBytes);
+		if (body === void 0) return {
+			ok: false,
+			reason: `larger than the ${maxBodyBytes} byte limit for one page`
+		};
 		return {
 			ok: true,
 			value: {
 				url: finalUrl,
-				html: await response.text()
+				html: body
 			}
 		};
 	} catch (cause) {
@@ -123,6 +142,51 @@ async function fetchPage(url, impl, timeoutMs, origin) {
 		clearTimeout(timer);
 	}
 }
+/**
+* A response body, up to a limit, or undefined when it runs past it.
+*
+* Streamed rather than buffered, because `response.text()` has already read
+* everything by the time it could be checked, and a content-length header is
+* both optional and unverified — a chunked response carries no length at all,
+* and one that carries a length is not obliged to tell the truth. Counting the
+* bytes as they arrive is the only check that holds either way, and the body is
+* cancelled the moment it goes over so nothing keeps arriving.
+*/
+async function readCapped(response, limit) {
+	const body = response.body;
+	if (!body) {
+		const text = await response.text();
+		return text.length > limit ? void 0 : text;
+	}
+	const reader = body.getReader();
+	const chunks = [];
+	let total = 0;
+	try {
+		while (true) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			if (value === void 0) continue;
+			total += value.byteLength;
+			if (total > limit) {
+				await reader.cancel();
+				return;
+			}
+			chunks.push(value);
+		}
+	} finally {
+		reader.releaseLock();
+	}
+	return new TextDecoder().decode(concat(chunks, total));
+}
+function concat(chunks, total) {
+	const joined = new Uint8Array(total);
+	let at = 0;
+	for (const chunk of chunks) {
+		joined.set(chunk, at);
+		at += chunk.byteLength;
+	}
+	return joined;
+}
 /** Paths robots.txt disallows for us. Only the wildcard group is read. */
 function disallowedPaths(robots) {
 	const lines = robots.split(/\r?\n/).map((line) => line.replace(/#.*$/, "").trim());
@@ -149,12 +213,21 @@ function disallowedPaths(robots) {
 * that is not a page. A site that does not publish one is the ordinary case,
 * not a failure, so it comes back empty either way.
 */
-async function fetchSiteFile(entry, impl, name) {
+async function fetchSiteFile(entry, impl, name, timeoutMs, maxBodyBytes) {
+	const controller = new AbortController();
+	const timer = setTimeout(() => controller.abort(), timeoutMs);
 	try {
-		const response = await impl(new URL(name, entry).href, { redirect: "follow" });
-		return response.ok ? await response.text() : void 0;
+		const response = await impl(new URL(name, entry).href, {
+			redirect: "follow",
+			signal: controller.signal
+		});
+		if (!response.ok) return void 0;
+		if (new URL(response.url || new URL(name, entry).href).origin !== entry.origin) return void 0;
+		return await readCapped(response, maxBodyBytes);
 	} catch {
 		return;
+	} finally {
+		clearTimeout(timer);
 	}
 }
 /**
@@ -169,8 +242,9 @@ async function crawlSite(entry, options = {}) {
 	const maxPages = options.maxPages ?? 200;
 	const maxDepth = options.maxDepth ?? 3;
 	const timeoutMs = options.timeoutMs ?? 15e3;
+	const maxBodyBytes = options.maxBodyBytes ?? MAX_BODY_BYTES;
 	const failures = [];
-	const robots = options.ignoreRobots ? void 0 : await fetchSiteFile(entry, impl, "/robots.txt");
+	const robots = options.ignoreRobots ? void 0 : await fetchSiteFile(entry, impl, "/robots.txt", timeoutMs, maxBodyBytes);
 	const blocked = robots === void 0 ? [] : disallowedPaths(robots);
 	const allowed = (url) => !blocked.some((path) => url.pathname.startsWith(path));
 	let discovery = "links";
@@ -184,7 +258,7 @@ async function crawlSite(entry, options = {}) {
 			depth
 		});
 	};
-	const sitemap = await fetchSiteFile(entry, impl, options.sitemap ?? "/sitemap.xml");
+	const sitemap = await fetchSiteFile(entry, impl, options.sitemap ?? "/sitemap.xml", timeoutMs, maxBodyBytes);
 	const listed = sitemap === void 0 ? [] : urlsFromSitemap(sitemap, entry);
 	if (listed.length > 0) {
 		discovery = "sitemap";
@@ -196,7 +270,7 @@ async function crawlSite(entry, options = {}) {
 		const batch = queue.splice(0, Math.min(REQUEST_CONCURRENCY, maxPages - pages.length));
 		const results = await Promise.all(batch.map(async (item) => ({
 			item,
-			result: await fetchPage(item.url, impl, timeoutMs, entry.origin)
+			result: await fetchPage(item.url, impl, timeoutMs, entry.origin, maxBodyBytes)
 		})));
 		for (const { item, result } of results) {
 			if (!result.ok) {

package/dist/eleventy/index.d.ts

@@ -1,4 +1,4 @@
-import { n as IntegrationOptions, t as BuildAuditError } from "../run-BMASMmwO.js";
+import { n as IntegrationOptions, t as BuildAuditError } from "../run-CtcEUhbe.js";
 //#region src/eleventy/index.d.ts
 /** What `eleventy.after` is given. Only two of its fields are read. */
 interface EleventyAfterEvent {

package/dist/eleventy/index.js

@@ -1,4 +1,4 @@
-import { n as auditBuild, r as stderrLogger, t as BuildAuditError } from "../run-DB34BSOZ.js";
+import { n as auditBuild, r as stderrLogger, t as BuildAuditError } from "../run-C2nKFcb-.js";
 import path from "node:path";
 //#region src/eleventy/index.ts
 /**

package/dist/fingerprint-BjYV_0F7.js

@@ -0,0 +1,67 @@
+import { createHash } from "node:crypto";
+//#region src/audit/fingerprint.ts
+/**
+* A stable identity for one violating element.
+*
+* Derived from the rule, the selector and the element's own opening tag, and
+* deliberately not from the file it was found in. Two consumers need this and
+* they need it to agree: SARIF, so that moving a page does not close one code
+* scanning alert and open an identical one, and the baseline, so that an
+* accepted violation stays accepted when the surrounding page changes.
+*
+* Sixteen hex characters. This identifies a defect for humans and tooling, not
+* a secret, and a full digest in every entry would make a baseline file for a
+* large site unreadable.
+*/
+function elementFingerprint(ruleId, selector, html) {
+	return createHash("sha256").update(`${ruleId}\n${selector}\n${openingTag(html)}`).digest("hex").slice(0, 16);
+}
+/**
+* The element's own tag, without anything nested inside it.
+*
+* axe-core hands back the failing element's outerHTML, which for a leaf like
+* `<img>` is the element and for a container is the element and every
+* descendant it has. Hashing all of that made the identity of a container
+* depend on its contents — and the container that matters here is `<html>`,
+* which every document-level rule fails against: `html-has-lang`,
+* `document-title`, `landmark-one-main`, `page-has-heading-one`.
+*
+* Their outerHTML is the whole page. So adding one paragraph anywhere changed
+* the fingerprint of every document-level violation on that page, and all three
+* consumers believed it:
+*
+* - the baseline stopped suppressing barriers it had accepted, and the build
+*   went red on a page whose only change was a typo fix;
+* - `diff` reported the same untouched barrier as both new and **fixed**, which
+*   is the one thing it exists to refuse to do;
+* - SARIF churned its partialFingerprints, so code scanning closed an alert and
+*   opened an identical one on every edit.
+*
+* The identity of an element is its own tag and attributes. Where two elements
+* share those, axe-core's selector already tells them apart — it qualifies
+* ambiguous matches with `:nth-child(…)` — so nothing that was distinguishable
+* before stops being distinguishable now.
+*
+* Anything that is not an element — the empty string a rule with no attached
+* node carries — is returned unchanged, so those keep the identity they had.
+*/
+function openingTag(html) {
+	const trimmed = html.trim();
+	if (!trimmed.startsWith("<")) return trimmed;
+	let quote;
+	for (let i = 1; i < trimmed.length; i += 1) {
+		const char = trimmed[i];
+		if (quote !== void 0) {
+			if (char === quote) quote = void 0;
+			continue;
+		}
+		if (char === "\"" || char === "'") {
+			quote = char;
+			continue;
+		}
+		if (char === ">") return trimmed.slice(0, i + 1);
+	}
+	return trimmed;
+}
+//#endregion
+export { elementFingerprint as t };

package/dist/{html-BGTO3ypW.js → html-C4vktg0A.js}

@@ -1,10 +1,10 @@
 import { a as impactRank, i as impactLabel, r as countAtOrAbove } from "./impact-DZt2oBCP.js";
 import { i as escapeText, n as count, o as standardsReference, r as escapeAttribute, t as collapse } from "./text-CKKpzkYM.js";
 import { t as TOOL_VERSION } from "./version-B3v4rNoG.js";
-import { a as isShared, i as groupIssues, n as blindRules, o as discoveryLabel, r as coverageParts, s as missedParts, t as remediationFor } from "./remediation-Dtowi2EC.js";
+import { a as isShared, i as groupIssues, n as blindRules, o as discoveryLabel, r as coverageParts, s as missedParts, t as remediationFor } from "./remediation-CMBIrnpN.js";
 import { r as componentPath } from "./component-C3GL1Mnu.js";
-import { i as understandingUrl, r as manualCheckFor, t as buildCoverage } from "./coverage-B4IBKMO8.js";
-import { n as buildSummary } from "./json-DjEvy1nX.js";
+import { i as understandingUrl, r as manualCheckFor, t as buildCoverage } from "./coverage-B_Y6l-Ra.js";
+import { n as buildSummary } from "./json-DROX33kh.js";
 import axe from "axe-core";
 //#region src/audit/report/html.ts
 /**

package/dist/index.d.ts

@@ -60,10 +60,17 @@ type DefaultedSchema<T> = Schema<T> & {
 //#endregion
 //#region src/config/define.d.ts
 /** Countries with their own supervisory body and statute text. */
-declare const COUNTRIES: readonly ['AT', 'DE', 'CH'];
+declare const COUNTRIES: readonly ['AT', 'DE', 'CH', 'ES', 'FR', 'IT', 'NL'];
 type Country = (typeof COUNTRIES)[number];
-/** Languages a statement can be rendered in. */
-declare const STATEMENT_LOCALES: readonly ['de', 'en'];
+/**
+ * Languages a statement can be rendered in.
+ *
+ * Not every country has every one: a statement is a document under a particular
+ * legal regime, not a translation of a document under another, so each country
+ * has the language it is published in and English. `renderStatement` says which
+ * ones a country has when asked for one it does not.
+ */
+declare const STATEMENT_LOCALES: readonly ['de', 'en', 'es', 'fr', 'it', 'nl'];
 type StatementLocale = (typeof STATEMENT_LOCALES)[number];
 /**
  * Wording follows the EU model statement: fully, partially, or not conformant
@@ -81,6 +88,61 @@ type AssessmentMethod = (typeof ASSESSMENT_METHODS)[number];
  */
 declare const ISSUE_REASONS: readonly ['disproportionate-burden', 'out-of-scope', 'fix-planned'];
 type IssueReason = (typeof ISSUE_REASONS)[number];
+/**
+ * Defaults for `eaa-kit audit` and `eaa-kit baseline`, so a project says once
+ * what every invocation would otherwise repeat.
+ *
+ * Every field is optional and every one is a default: a flag actually typed on
+ * the command line wins, because the file is the project's usual answer and the
+ * flag is somebody asking for something else right now.
+ *
+ * `baseline` reads the subset that means the same thing to it. `output`,
+ * `format`, `failOn` and `baseline` are audit-only on purpose — a baseline
+ * written to the report's path would overwrite the report, and a threshold for
+ * failing a run means nothing to a command that records what it finds.
+ */
+declare const auditSchema: Schema<ObjectOf<{
+  /** Build directory. The positional argument wins over it. */
+  dir: OptionalSchema<string>;
+  include: OptionalSchema<string[]>;
+  exclude: OptionalSchema<string[]>;
+  /** Audit pages under their real site URL instead of file://. */
+  baseUrl: OptionalSchema<string>;
+  /** Audit a running site instead of a directory. */
+  url: OptionalSchema<string>;
+  /** Crawl a host that is not loopback. Off unless a project says otherwise. */
+  allowRemote: OptionalSchema<boolean>;
+  ignoreRobots: OptionalSchema<boolean>;
+  /** Where the site lists its pages, when that is not /sitemap.xml. */
+  sitemap: OptionalSchema<string>;
+  maxPages: OptionalSchema<number>;
+  /** 0 audits the entry page alone. */
+  maxDepth: OptionalSchema<number>;
+  /** Lowest impact that exits 1. */
+  failOn: OptionalSchema<"critical" | "minor" | "moderate" | "serious">;
+  format: OptionalSchema<"console" | "html" | "json" | "sarif">;
+  /** Write the report here instead of stdout. */
+  output: OptionalSchema<string>;
+  /** Audit in real Chromium. Needs the playwright peer. */
+  browser: OptionalSchema<boolean>;
+  /** Skip the rules the browserless engine cannot decide. No effect with `browser`. */
+  fast: OptionalSchema<boolean>;
+  concurrency: OptionalSchema<number>;
+  /** Path to a baseline; violations it accounts for do not fail the run. */
+  baseline: OptionalSchema<string>;
+  /** List every page and its result under the issues. */
+  perPage: OptionalSchema<boolean>;
+  /** Print the manual check for each rule the engine could not evaluate. */
+  manual: OptionalSchema<boolean>;
+  /** List every WCAG 2.2 A/AA criterion and what the run reached on it. */
+  coverage: OptionalSchema<boolean>;
+  /**
+   * False is `--no-build`: never run the project's build or start its server to
+   * find something to audit. Written in the positive because that is the state
+   * being described, and because a config file has no flags to negate.
+   */
+  build: OptionalSchema<boolean>;
+}>>;
 declare const configSchema: Schema<ObjectOf<{
   site: Schema<ObjectOf<{
     name: Schema<string>;
@@ -132,7 +194,50 @@ declare const configSchema: Schema<ObjectOf<{
   }>>;
   enforcement: Schema<ObjectOf<{
     /** Drives which supervisory body and statute the template names. */
-    country: Schema<"AT" | "CH" | "DE">;
+    country: Schema<"AT" | "CH" | "DE" | "ES" | "FR" | "IT" | "NL">;
+  }>>;
+  /** Defaults for the audit commands. Nothing here reaches the statement. */
+  audit: OptionalSchema<ObjectOf<{
+    /** Build directory. The positional argument wins over it. */
+    dir: OptionalSchema<string>;
+    include: OptionalSchema<string[]>;
+    exclude: OptionalSchema<string[]>;
+    /** Audit pages under their real site URL instead of file://. */
+    baseUrl: OptionalSchema<string>;
+    /** Audit a running site instead of a directory. */
+    url: OptionalSchema<string>;
+    /** Crawl a host that is not loopback. Off unless a project says otherwise. */
+    allowRemote: OptionalSchema<boolean>;
+    ignoreRobots: OptionalSchema<boolean>;
+    /** Where the site lists its pages, when that is not /sitemap.xml. */
+    sitemap: OptionalSchema<string>;
+    maxPages: OptionalSchema<number>;
+    /** 0 audits the entry page alone. */
+    maxDepth: OptionalSchema<number>;
+    /** Lowest impact that exits 1. */
+    failOn: OptionalSchema<"critical" | "minor" | "moderate" | "serious">;
+    format: OptionalSchema<"console" | "html" | "json" | "sarif">;
+    /** Write the report here instead of stdout. */
+    output: OptionalSchema<string>;
+    /** Audit in real Chromium. Needs the playwright peer. */
+    browser: OptionalSchema<boolean>;
+    /** Skip the rules the browserless engine cannot decide. No effect with `browser`. */
+    fast: OptionalSchema<boolean>;
+    concurrency: OptionalSchema<number>;
+    /** Path to a baseline; violations it accounts for do not fail the run. */
+    baseline: OptionalSchema<string>;
+    /** List every page and its result under the issues. */
+    perPage: OptionalSchema<boolean>;
+    /** Print the manual check for each rule the engine could not evaluate. */
+    manual: OptionalSchema<boolean>;
+    /** List every WCAG 2.2 A/AA criterion and what the run reached on it. */
+    coverage: OptionalSchema<boolean>;
+    /**
+     * False is `--no-build`: never run the project's build or start its server to
+     * find something to audit. Written in the positive because that is the state
+     * being described, and because a config file has no flags to negate.
+     */
+    build: OptionalSchema<boolean>;
   }>>;
 }>>;
 /**
@@ -167,6 +272,7 @@ interface EaaConfigInput {
   enforcement: {
     country: Country;
   };
+  audit?: AuditConfig;
 }
 /** One barrier, as written in a config file. */
 interface KnownIssueInput {
@@ -178,6 +284,15 @@ interface KnownIssueInput {
 }
 type EaaConfig = Infer<typeof configSchema>;
 type KnownIssue = EaaConfig['compliance']['knownIssues'][number];
+/**
+ * The `audit` block, as written and as parsed — every field is optional.
+ *
+ * `undefined` is mapped out of the value types rather than left in them:
+ * `s.object` never writes a key it did not parse, so an absent field is an
+ * absent key, and the commands spread this over their own options where a
+ * present-but-undefined key would overwrite a real value.
+ */
+type AuditConfig = { [K in keyof Infer<typeof auditSchema>]?: Exclude<Infer<typeof auditSchema>[K], undefined>; };
 /**
  * Identity function that gives `eaa.config.ts` its types. Deliberately does not
  * validate: a config file is loaded and checked in one place, so that an error

package/dist/index.js

@@ -1,3 +1,3 @@
-import { a as COMPLIANCE_STATUSES, c as ISSUE_REASONS, d as defineConfig, f as parseConfig, i as ASSESSMENT_METHODS, l as STATEMENT_LOCALES, n as findConfigFile, o as COUNTRIES, r as loadConfig, s as ConfigError, t as CONFIG_FILENAMES, u as configSchema } from "./load-5wRGLvub.js";
-import { a as summariseAuditReport, i as readAuditReport, n as toHtmlBody, o as StatementError, r as toHtmlDocument, t as renderStatement } from "./render-DrvXRCEn.js";
+import { a as ASSESSMENT_METHODS, c as ConfigError, d as configSchema, f as defineConfig, i as loadConfig, l as ISSUE_REASONS, n as findConfigFile, o as COMPLIANCE_STATUSES, p as parseConfig, s as COUNTRIES, t as CONFIG_FILENAMES, u as STATEMENT_LOCALES } from "./load-yAR4wzez.js";
+import { a as summariseAuditReport, i as readAuditReport, n as toHtmlBody, o as StatementError, r as toHtmlDocument, t as renderStatement } from "./render-DbGOVmhx.js";
 export { ASSESSMENT_METHODS, COMPLIANCE_STATUSES, CONFIG_FILENAMES, COUNTRIES, ConfigError, ISSUE_REASONS, STATEMENT_LOCALES, StatementError, configSchema, defineConfig, findConfigFile, loadConfig, parseConfig, readAuditReport, renderStatement, summariseAuditReport, toHtmlBody, toHtmlDocument };

package/dist/{init-DIWDE35F.js → init-CW7LfGT5.js}

@@ -1,6 +1,7 @@
-import { o as COUNTRIES, t as CONFIG_FILENAMES } from "./load-5wRGLvub.js";
+import { t as DEFAULT_FAIL_ON } from "./impact-DZt2oBCP.js";
+import { s as COUNTRIES, t as CONFIG_FILENAMES } from "./load-yAR4wzez.js";
 import { t as exists } from "./fs-BmPtmFke.js";
-import { i as note, o as warn, r as fail } from "./command-D8l_oYbV.js";
+import { l as warn, o as fail, s as note } from "./command-C3D7JWn6.js";
 import { readFile, writeFile } from "node:fs/promises";
 import path from "node:path";
 import pc from "picocolors";
@@ -9,7 +10,11 @@ import { createInterface } from "node:readline/promises";
 const COUNTRY_LOCALES = {
 	AT: "de-AT",
 	DE: "de-DE",
-	CH: "de-CH"
+	CH: "de-CH",
+	ES: "es-ES",
+	FR: "fr-FR",
+	IT: "it-IT",
+	NL: "nl-NL"
 };
 /**
 * Everything the project already says about itself.
@@ -83,7 +88,8 @@ async function runInitCommand(options = {}) {
 			assessmentMethod: "self-assessment",
 			knownIssues: []
 		},
-		enforcement: { country }
+		enforcement: { country },
+		audit: { failOn: DEFAULT_FAIL_ON }
 	};
 	try {
 		await writeFile(target, `${JSON.stringify(config, null, 2)}\n`, "utf8");

package/dist/jsdom-22Bkt65v.js

@@ -0,0 +1,3 @@
+import "./result-BWcYXeRs.js";
+import { n as runJsdomAudit } from "./jsdom-B--cEH-G.js";
+export { runJsdomAudit };

package/dist/{jsdom-DCpGSLfW.js → jsdom-B--cEH-G.js}

@@ -1,10 +1,18 @@
-import { c as runOptions, i as failedPage, l as shapeResults, o as pageUrl, r as blindRulesInScope, t as DEFAULT_TAGS } from "./result-DoamKFsp.js";
+import { a as failedPage, i as blindRulesInScope, l as runOptions, n as DEFAULT_TAGS, s as pageUrl, t as DEFAULT_PAGE_TIMEOUT_MS, u as shapeResults } from "./result-BWcYXeRs.js";
 import axe from "axe-core";
 import { Script } from "node:vm";
 import { JSDOM, VirtualConsole } from "jsdom";
 //#region src/audit/runners/jsdom.ts
-/** Per-page ceiling; one pathological document must not stall a CI run. */
-const DEFAULT_TIMEOUT_MS = 3e4;
+/**
+* Per-page ceiling.
+*
+* A soft one, and the limit is worth stating: this races axe-core against a
+* timer, so it only fires where the work yields to the event loop. Neither
+* jsdom's parse nor axe-core's walk of the tree does, so a document pathological
+* enough to hold the thread runs past this unimpeded. The hard ceiling is the
+* worker pool's, which terminates the thread; see the note on `runWorkers`.
+*/
+const DEFAULT_TIMEOUT_MS = DEFAULT_PAGE_TIMEOUT_MS;
 /**
 * Audit collected pages with axe-core inside jsdom.
 *
@@ -32,7 +40,7 @@ async function auditPage(page, options = {}) {
 		dom = createDom(page.html, url);
 		injectAxe(dom);
 		const { axe: pageAxe } = dom.window;
-		const results = await withTimeout(pageAxe.run(dom.window.document, runOptions(tags)), options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+		const results = await withTimeout(pageAxe.run(dom.window.document, runOptions(tags, { skipBlindRules: options.fast === true })), options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
 		return shapeResults(results, {
 			...identity,
 			durationMs: Date.now() - startedAt,