eaa-kit 0.4.0 → 0.5.0

package/dist/{json-DjEvy1nX.js → json-DROX33kh.js}

@@ -1,8 +1,8 @@
 import { i as impactLabel, o as isImpactLevel, r as countAtOrAbove } from "./impact-DZt2oBCP.js";
 import { t as TOOL_VERSION } from "./version-B3v4rNoG.js";
-import { t as elementFingerprint } from "./fingerprint-DRoneAjj.js";
-import { s as ruleOutcomes } from "./result-DoamKFsp.js";
-import { t as buildCoverage } from "./coverage-B4IBKMO8.js";
+import { t as elementFingerprint } from "./fingerprint-BjYV_0F7.js";
+import { c as ruleOutcomes } from "./result-BWcYXeRs.js";
+import { t as buildCoverage } from "./coverage-B_Y6l-Ra.js";
 import axe from "axe-core";
 /**
 * Build the machine-readable report.
@@ -17,7 +17,7 @@ import axe from "axe-core";
 function buildJsonReport(audits, options) {
 	const generatedAt = (options.now ?? /* @__PURE__ */ new Date()).toISOString();
 	return {
-		schemaVersion: 1,
+		schemaVersion: 2,
 		tool: {
 			name: "eaa-kit",
 			version: TOOL_VERSION,

package/dist/{json-QQuFIw1W.js → json-D_Mnnft5.js}

@@ -1,2 +1,2 @@
-import { r as serialiseJsonReport, t as buildJsonReport } from "./json-DjEvy1nX.js";
+import { r as serialiseJsonReport, t as buildJsonReport } from "./json-DROX33kh.js";
 export { buildJsonReport, serialiseJsonReport };

package/dist/load-CFq2VQtT.js

@@ -0,0 +1,2 @@
+import { r as loadAuditConfig } from "./load-yAR4wzez.js";
+export { loadAuditConfig };

package/dist/{load-5wRGLvub.js → load-yAR4wzez.js}

@@ -1,4 +1,5 @@
-import { _ as url, a as isoDate, d as pipe, g as union, h as transform, i as enumeration, l as object, m as string, p as safeParse, r as email, t as array, u as optional, v as withDefault } from "./schema-is6CGX2D.js";
+import { n as IMPACT_LEVELS } from "./impact-DZt2oBCP.js";
+import { _ as union, a as integer, d as optional, f as pipe, g as transform, h as string, i as enumeration, m as safeParse, n as boolean, o as isoDate, r as email, t as array, u as object, v as url, y as withDefault } from "./schema-DJSF4K05.js";
 import { r as isFile } from "./fs-BmPtmFke.js";
 import { readFile } from "node:fs/promises";
 import path from "node:path";
@@ -8,10 +9,28 @@ import { pathToFileURL } from "node:url";
 const COUNTRIES = [
 	"AT",
 	"DE",
-	"CH"
+	"CH",
+	"ES",
+	"FR",
+	"IT",
+	"NL"
+];
+/**
+* Languages a statement can be rendered in.
+*
+* Not every country has every one: a statement is a document under a particular
+* legal regime, not a translation of a document under another, so each country
+* has the language it is published in and English. `renderStatement` says which
+* ones a country has when asked for one it does not.
+*/
+const STATEMENT_LOCALES = [
+	"de",
+	"en",
+	"es",
+	"fr",
+	"it",
+	"nl"
 ];
-/** Languages a statement can be rendered in. */
-const STATEMENT_LOCALES = ["de", "en"];
 /**
 * Wording follows the EU model statement: fully, partially, or not conformant
 * with the standard. "partially-compliant" is the honest answer for most sites
@@ -50,6 +69,66 @@ const knownIssueObject = object({
 * rather than a union that callers have to narrow before reading `remedyBy`.
 */
 const knownIssueSchema = union([pipe(transform(string({ min: 1 }), (description) => ({ description })), knownIssueObject), knownIssueObject], "expected a description, or an object with one");
+/**
+* Defaults for `eaa-kit audit` and `eaa-kit baseline`, so a project says once
+* what every invocation would otherwise repeat.
+*
+* Every field is optional and every one is a default: a flag actually typed on
+* the command line wins, because the file is the project's usual answer and the
+* flag is somebody asking for something else right now.
+*
+* `baseline` reads the subset that means the same thing to it. `output`,
+* `format`, `failOn` and `baseline` are audit-only on purpose — a baseline
+* written to the report's path would overwrite the report, and a threshold for
+* failing a run means nothing to a command that records what it finds.
+*/
+const auditSchema = object({
+	/** Build directory. The positional argument wins over it. */
+	dir: optional(string({ min: 1 })),
+	include: optional(array(string({ min: 1 }))),
+	exclude: optional(array(string({ min: 1 }))),
+	/** Audit pages under their real site URL instead of file://. */
+	baseUrl: optional(url()),
+	/** Audit a running site instead of a directory. */
+	url: optional(url()),
+	/** Crawl a host that is not loopback. Off unless a project says otherwise. */
+	allowRemote: optional(boolean()),
+	ignoreRobots: optional(boolean()),
+	/** Where the site lists its pages, when that is not /sitemap.xml. */
+	sitemap: optional(string({ min: 1 })),
+	maxPages: optional(integer({ min: 1 })),
+	/** 0 audits the entry page alone. */
+	maxDepth: optional(integer({ min: 0 })),
+	/** Lowest impact that exits 1. */
+	failOn: optional(enumeration(IMPACT_LEVELS)),
+	format: optional(enumeration([
+		"console",
+		"json",
+		"sarif",
+		"html"
+	])),
+	/** Write the report here instead of stdout. */
+	output: optional(string({ min: 1 })),
+	/** Audit in real Chromium. Needs the playwright peer. */
+	browser: optional(boolean()),
+	/** Skip the rules the browserless engine cannot decide. No effect with `browser`. */
+	fast: optional(boolean()),
+	concurrency: optional(integer({ min: 1 })),
+	/** Path to a baseline; violations it accounts for do not fail the run. */
+	baseline: optional(string({ min: 1 })),
+	/** List every page and its result under the issues. */
+	perPage: optional(boolean()),
+	/** Print the manual check for each rule the engine could not evaluate. */
+	manual: optional(boolean()),
+	/** List every WCAG 2.2 A/AA criterion and what the run reached on it. */
+	coverage: optional(boolean()),
+	/**
+	* False is `--no-build`: never run the project's build or start its server to
+	* find something to audit. Written in the positive because that is the state
+	* being described, and because a config file has no flags to negate.
+	*/
+	build: optional(boolean())
+});
 const configSchema = object({
 	site: object({
 		name: string({ min: 1 }),
@@ -91,9 +170,20 @@ const configSchema = object({
 	}),
 	enforcement: object({ 
 	/** Drives which supervisory body and statute the template names. */
-country: enumeration(COUNTRIES) })
+country: enumeration(COUNTRIES) }),
+	/** Defaults for the audit commands. Nothing here reaches the statement. */
+	audit: optional(auditSchema)
 });
 /**
+* The `audit` block on its own.
+*
+* A project that only wants audit defaults should not have to write a complete
+* statement config to get them, and `s.object` drops the keys it does not know,
+* so the same file satisfies both readers: `statement` demands the whole
+* document, `audit` reads this and ignores the rest.
+*/
+const auditConfigSchema = object({ audit: optional(auditSchema) });
+/**
 * Identity function that gives `eaa.config.ts` its types. Deliberately does not
 * validate: a config file is loaded and checked in one place, so that an error
 * points at the file rather than at wherever the module happened to be
@@ -112,7 +202,20 @@ var ConfigError = class extends Error {
 };
 /** Validate an already-loaded config object. */
 function parseConfig(value, source = "config") {
-	const result = safeParse(configSchema, value);
+	return parse(configSchema, value, source);
+}
+/**
+* Read only the `audit` block, ignoring whatever else the file holds.
+*
+* Returns undefined where there is no block, which is the common case: most
+* config files exist for the statement alone, and finding one is not a reason
+* to change how an audit runs.
+*/
+function parseAuditConfig(value, source = "config") {
+	return parse(auditConfigSchema, value, source).audit;
+}
+function parse(schema, value, source) {
+	const result = safeParse(schema, value);
 	if (result.success) return result.data;
 	const issues = result.error.issues.map((issue) => {
 		const path = issue.path.join(".");
@@ -145,10 +248,32 @@ async function loadConfig(options = {}) {
 	if (!file) throw new ConfigError(`No config file found in ${cwd} or its parent directories`, CONFIG_FILENAMES.map((name) => `looked for ${name}`));
 	if (!await isFile(file)) throw new ConfigError(`Config file not found: ${file}`);
 	return {
-		config: parseConfig(file.endsWith(".json") ? await importJson(file) : await importModule(file), path.basename(file)),
+		config: parseConfig(await readConfigFile(file), path.basename(file)),
+		path: file
+	};
+}
+/**
+* Find the config file and read its `audit` block, for the commands that take
+* defaults from it.
+*
+* Returns undefined when there is no config file at all. That is not an error
+* here as it is for `statement`: `eaa-kit audit` has always run against a
+* project that has never heard of a config file, and it must keep doing so. An
+* explicit path that is not there is still an error, because somebody named it.
+*/
+async function loadAuditConfig(options = {}) {
+	const cwd = path.resolve(options.cwd ?? process.cwd());
+	const file = options.path ? path.resolve(cwd, options.path) : await findConfigFile(cwd);
+	if (!file) return void 0;
+	if (!await isFile(file)) throw new ConfigError(`Config file not found: ${file}`);
+	return {
+		audit: parseAuditConfig(await readConfigFile(file), path.basename(file)),
 		path: file
 	};
 }
+function readConfigFile(file) {
+	return file.endsWith(".json") ? importJson(file) : importModule(file);
+}
 /** Walks up from `cwd`, so the CLI works from a subdirectory of the project. */
 async function findConfigFile(cwd) {
 	let directory = path.resolve(cwd);
@@ -183,4 +308,4 @@ async function importModule(file) {
 	return module.default;
 }
 //#endregion
-export { COMPLIANCE_STATUSES as a, ISSUE_REASONS as c, defineConfig as d, parseConfig as f, ASSESSMENT_METHODS as i, STATEMENT_LOCALES as l, findConfigFile as n, COUNTRIES as o, loadConfig as r, ConfigError as s, CONFIG_FILENAMES as t, configSchema as u };
+export { ASSESSMENT_METHODS as a, ConfigError as c, configSchema as d, defineConfig as f, loadConfig as i, ISSUE_REASONS as l, findConfigFile as n, COMPLIANCE_STATUSES as o, parseConfig as p, loadAuditConfig as r, COUNTRIES as s, CONFIG_FILENAMES as t, STATEMENT_LOCALES as u };

package/dist/nuxt/index.d.ts

@@ -1,4 +1,4 @@
-import { n as IntegrationOptions, t as BuildAuditError } from "../run-BMASMmwO.js";
+import { n as IntegrationOptions, t as BuildAuditError } from "../run-CtcEUhbe.js";
 //#region src/nuxt/index.d.ts
 /** The part of the Nitro instance this reads, handed over by `nitro:init`. */
 interface NitroLike {

package/dist/nuxt/index.js

@@ -1,4 +1,4 @@
-import { n as auditBuild, r as stderrLogger, t as BuildAuditError } from "../run-DB34BSOZ.js";
+import { n as auditBuild, r as stderrLogger, t as BuildAuditError } from "../run-C2nKFcb-.js";
 import path from "node:path";
 //#region src/nuxt/index.ts
 function eaaKitModule(options = {}, nuxt) {

package/dist/{playwright-BWniOain.js → playwright-BojtYVUa.js}

@@ -1,5 +1,5 @@
 import { r as isFile } from "./fs-BmPtmFke.js";
-import { c as runOptions, i as failedPage, l as shapeResults, o as pageUrl, t as DEFAULT_TAGS } from "./result-DoamKFsp.js";
+import { a as failedPage, l as runOptions, n as DEFAULT_TAGS, s as pageUrl, u as shapeResults } from "./result-BWcYXeRs.js";
 import { createRequire } from "node:module";
 import { stat } from "node:fs/promises";
 import path from "node:path";
@@ -122,6 +122,21 @@ const DEFAULT_VIEWPORT = {
 	height: 720
 };
 /**
+* Pages open at once.
+*
+* This runner used to audit strictly one page at a time while the browserless
+* one had a whole measured worker pool — which had it backwards, since the
+* browser is the slow engine: it fetches the stylesheets and images a real
+* visitor would, and spends most of a page waiting on them rather than on the
+* CPU. Waiting on four at once is close to free.
+*
+* Four rather than more because each open page holds a document tree, its
+* decoded images and its own copy of axe-core, and Chromium's memory is the
+* limit here rather than cores. Past this the gain flattens and the cost does
+* not.
+*/
+const DEFAULT_CONCURRENCY = 4;
+/**
 * Audit a built site in real Chromium.
 *
 * This is the engine that can answer the rules jsdom is blind to: colour
@@ -152,11 +167,20 @@ async function runBrowserAudit(directory, pages, options = {}) {
 			viewport,
 			bypassCSP: true
 		});
-		const audits = [];
-		for (const page of pages) audits.push(await auditOne(context, server?.origin, page, {
-			tags,
-			timeout,
-			...options
+		const audits = Array.from({ length: pages.length });
+		const lanes = Math.max(1, Math.min(options.concurrency ?? DEFAULT_CONCURRENCY, pages.length));
+		let next = 0;
+		await Promise.all(Array.from({ length: lanes }, async () => {
+			while (true) {
+				const index = next;
+				if (index >= pages.length) return;
+				next += 1;
+				audits[index] = await auditOne(context, server?.origin, pages[index], {
+					tags,
+					timeout,
+					...options
+				});
+			}
 		}));
 		await context.close();
 		return audits;

package/dist/{pool-BMevaLWD.js → pool-BO25OIez.js}

@@ -1,5 +1,5 @@
 import { r as isFile } from "./fs-BmPtmFke.js";
-import { i as failedPage, o as pageUrl } from "./result-DoamKFsp.js";
+import { a as failedPage, s as pageUrl } from "./result-BWcYXeRs.js";
 import { Worker } from "node:worker_threads";
 import { availableParallelism } from "node:os";
 //#region src/audit/runners/pool.ts
@@ -52,6 +52,16 @@ const WORK_PER_WORKER_MS = 1600;
 /** Threading at all means at least two, or there is nothing to overlap with. */
 const MIN_WORKERS = 2;
 /**
+* Grace above the runner's own per-page timeout before a worker is killed.
+*
+* The runner races axe-core against a timer, which works whenever the work
+* yields to the event loop: the page is reported with an error and the thread
+* lives on to take the next one. That is the better outcome, so it is given
+* room to happen first. This is the backstop for when it cannot — see
+* `watchdog` below.
+*/
+const HARD_TIMEOUT_GRACE_MS = 5e3;
+/**
 * Ceiling on workers regardless of core count. Past this, the run is bounded by
 * memory bandwidth and by each worker's own start-up rather than by cores, and
 * every extra thread holds another jsdom document tree.
@@ -96,10 +106,33 @@ async function runPooledAudit(pages, options = {}) {
 	return runWorkers(pages, runnerOptions, Math.min(workers, pages.length), entry);
 }
 async function auditHere(pages, options) {
-	const { runJsdomAudit } = await import("./jsdom-4IMzv0eE.js");
+	const { runJsdomAudit } = await import("./jsdom-22Bkt65v.js");
 	return runJsdomAudit(pages, options);
 }
+/**
+* The only place a per-page ceiling can actually be enforced.
+*
+* The runner's own timeout is a `Promise.race`, and a race cannot interrupt
+* synchronous work: jsdom's parse and axe-core's walk of the tree both hold the
+* thread, so the timer that is meant to stop them never gets to run. Measured
+* on a 120,000-element document with a two-second ceiling, the audit was still
+* going more than ten minutes later — and because the pool waits on its
+* workers, the whole run went with it. A CI job hung until the platform killed
+* it, which is the failure the ceiling exists to prevent.
+*
+* `worker.terminate()` is the answer, because it stops the thread whatever it
+* is doing. So the supervisor keeps its own deadline per page and kills the
+* thread that overruns it, records that page as unaudited, and lets the rest of
+* the run carry on. The page is reported as a failure rather than as a clean
+* page, which the CLI already turns into exit 2.
+*
+* Two runs still have no hard ceiling, because both refuse the threads that
+* would carry it: `--concurrency 1`, and a machine with too few cores to spare
+* one. Both are documented rather than papered over, and the size cap in
+* `collectPages` is what keeps them bounded in practice.
+*/
 async function runWorkers(pages, options, count, entry) {
+	const deadlineMs = (options.timeoutMs ?? 3e4) + HARD_TIMEOUT_GRACE_MS;
 	const audits = Array.from({ length: pages.length });
 	let next = 0;
 	await Promise.all(Array.from({ length: count }, () => {
@@ -113,7 +146,13 @@ async function runWorkers(pages, options, count, entry) {
 			}
 			let inFlight;
 			let completed = 0;
+			let watchdog;
+			const disarm = () => {
+				if (watchdog !== void 0) clearTimeout(watchdog);
+				watchdog = void 0;
+			};
 			const finish = () => {
+				disarm();
 				worker.terminate();
 				resolve();
 			};
@@ -127,8 +166,18 @@ async function runWorkers(pages, options, count, entry) {
 				next += 1;
 				inFlight = index;
 				worker.postMessage(pages[index]);
+				watchdog = setTimeout(() => {
+					watchdog = void 0;
+					if (inFlight !== void 0) {
+						audits[inFlight] = failedPage(identity(pages[inFlight], options), `the audit worker was stopped after ${deadlineMs}ms on this page`);
+						inFlight = void 0;
+					}
+					finish();
+				}, deadlineMs);
+				watchdog.unref?.();
 			};
 			worker.on("message", (audit) => {
+				disarm();
 				if (inFlight !== void 0) {
 					audits[inFlight] = audit;
 					completed += 1;
@@ -136,6 +185,7 @@ async function runWorkers(pages, options, count, entry) {
 				feed();
 			});
 			worker.on("error", (cause) => {
+				disarm();
 				if (inFlight !== void 0 && completed > 0) audits[inFlight] = failedPage(identity(pages[inFlight], options), `audit worker failed: ${cause.message}`);
 				finish();
 			});

package/dist/{remediation-Dtowi2EC.js → remediation-CMBIrnpN.js}

@@ -1,6 +1,6 @@
 import { a as impactRank } from "./impact-DZt2oBCP.js";
-import { t as elementFingerprint } from "./fingerprint-DRoneAjj.js";
-import { a as findingElements } from "./result-DoamKFsp.js";
+import { t as elementFingerprint } from "./fingerprint-BjYV_0F7.js";
+import { o as findingElements } from "./result-BWcYXeRs.js";
 //#region src/audit/completeness.ts
 /**
 * Fold what the collector knew together with what the engine managed.

package/dist/{render-DrvXRCEn.js → render-DbGOVmhx.js}

@@ -1,6 +1,7 @@
-import { c as number, f as record, l as object, m as string, o as isoDateTime, p as safeParse, s as nullable, t as array, v as withDefault } from "./schema-is6CGX2D.js";
-import { n as isDirectory } from "./fs-BmPtmFke.js";
 import { a as impactRank, n as IMPACT_LEVELS } from "./impact-DZt2oBCP.js";
+import { c as nullable, h as string, l as number, m as safeParse, p as record, s as isoDateTime, t as array, u as object, y as withDefault } from "./schema-DJSF4K05.js";
+import { u as STATEMENT_LOCALES } from "./load-yAR4wzez.js";
+import { n as isDirectory } from "./fs-BmPtmFke.js";
 import { i as escapeText, o as standardsReference, r as escapeAttribute } from "./text-CKKpzkYM.js";
 import { t as TOOL_VERSION } from "./version-B3v4rNoG.js";
 import { readFile, readdir } from "node:fs/promises";
@@ -58,7 +59,7 @@ function summariseAuditReport(value, source = "audit report") {
 	const result = safeParse(reportSchema, value);
 	if (!result.success) throw new StatementError(`${source} is not an eaa-kit JSON report (${result.error.issues.map((issue) => `${issue.path.join(".") || "document"}: ${issue.message}`).slice(0, 5).join("; ")})`);
 	const report = result.data;
-	if (report.schemaVersion !== 1) throw new StatementError(`${source} has schemaVersion ${report.schemaVersion}; this version of eaa-kit reads 1`);
+	if (report.schemaVersion !== 2) throw new StatementError(`${source} has schemaVersion ${report.schemaVersion}; this version of eaa-kit reads 2`);
 	const byRule = /* @__PURE__ */ new Map();
 	const rules = new Map(Object.entries(report.rules));
 	for (const page of report.pages) for (const violation of page.violations) {
@@ -411,7 +412,7 @@ async function renderStatement(config, options = {}) {
 	const country = options.country ?? config.enforcement.country;
 	const locale = options.locale ?? defaultLocale(config);
 	const template = `${country.toLowerCase()}.${locale}`;
-	const markdown = tidy(renderTemplate(await loadTemplate(template), buildScope(config, locale, options.audit)));
+	const markdown = tidy(renderTemplate(await loadTemplate(country, locale), buildScope(config, locale, options.audit)));
 	return {
 		markdown,
 		html: toHtmlDocument(markdown, {
@@ -423,9 +424,16 @@ async function renderStatement(config, options = {}) {
 		template
 	};
 }
-/** A German-language site gets a German statement unless told otherwise. */
+/**
+* A site gets its statement in its own language where there is one for it.
+*
+* From `site.locale`, which is a BCP 47 tag: `de-AT` and `de` both mean the
+* German document. English is the fallback because every country has an English
+* template, being the language a statement is most often also published in.
+*/
 function defaultLocale(config) {
-	return config.site.locale.toLowerCase().startsWith("de") ? "de" : "en";
+	const language = config.site.locale.toLowerCase().split("-")[0];
+	return STATEMENT_LOCALES.find((candidate) => candidate === language) ?? "en";
 }
 /**
 * Values the templates interpolate.
@@ -522,6 +530,22 @@ function reasonScope(reason) {
 	};
 }
 /**
+* Where each statement language formats its dates.
+*
+* A region is named for every one, because a bare language tag leaves the
+* format to whatever ICU picks: `de` is de-DE, and this tool's German documents
+* have always been dated the Austrian way. `en-GB` for the same reason —
+* 20 August 2026, not August 20, 2026, in a European legal document.
+*/
+const DATE_LOCALES = {
+	de: "de-AT",
+	en: "en-GB",
+	es: "es-ES",
+	fr: "fr-FR",
+	it: "it-IT",
+	nl: "nl-NL"
+};
+/**
 * 2026-08-20 becomes 20. August 2026 or 20 August 2026.
 *
 * Every date reaching this has been through a schema that checks it, so the
@@ -533,7 +557,7 @@ function reasonScope(reason) {
 function formatDate(iso, locale) {
 	const date = /* @__PURE__ */ new Date(`${iso}T00:00:00Z`);
 	if (Number.isNaN(date.getTime())) return iso;
-	return new Intl.DateTimeFormat(locale === "de" ? "de-AT" : "en-GB", {
+	return new Intl.DateTimeFormat(DATE_LOCALES[locale], {
 		day: "numeric",
 		month: "long",
 		year: "numeric",
@@ -549,14 +573,28 @@ function tidy(markdown) {
 	return `${markdown.replace(/[ \t]+$/gm, "").replace(/\n{3,}/g, "\n\n").trim()}\n`;
 }
 let templateDirectory;
-async function loadTemplate(name) {
+/**
+* The document for a country in a language, if there is one.
+*
+* The matrix is deliberately sparse: a country's statement is written under its
+* own law and published in the language the law is administered in, plus
+* English. Asking for a combination nobody wrote is an error naming the
+* languages that country does have — not a fall back to another language, which
+* would hand somebody a document in a language their readers may not have and
+* do it quietly.
+*/
+async function loadTemplate(country, locale) {
 	templateDirectory ??= await findTemplateDirectory();
 	const directory = templateDirectory;
+	const name = `${country.toLowerCase()}.${locale}`;
 	const file = path.join(directory, `${name}.md`);
 	try {
 		return await readFile(file, "utf8");
 	} catch {
-		throw new StatementError(`No statement template for ${name}. Available: ${(await readdir(directory)).filter((entry) => entry.endsWith(".md")).map((entry) => entry.replace(/\.md$/, "")).sort().join(", ")}`);
+		const templates = (await readdir(directory)).filter((entry) => entry.endsWith(".md")).map((entry) => entry.replace(/\.md$/, "")).sort();
+		const prefix = `${country.toLowerCase()}.`;
+		const forCountry = templates.filter((entry) => entry.startsWith(prefix)).map((entry) => entry.slice(prefix.length));
+		throw new StatementError(forCountry.length > 0 ? `No ${country} statement in ${locale}. ${country} has: ${forCountry.join(", ")}` : `No statement template for ${name}. Available: ${templates.join(", ")}`);
 	}
 }
 /**

package/dist/{result-DoamKFsp.js → result-BWcYXeRs.js}

@@ -1,6 +1,15 @@
 import { pathToFileURL } from "node:url";
 import axe from "axe-core";
 //#region src/audit/result.ts
+/**
+* Per-page ceiling for an audit, in milliseconds.
+*
+* Lives here rather than in the jsdom runner because the worker pool needs it
+* to set its own deadline, and the pool deliberately does not import jsdom —
+* loading 630 ms of dependency to supervise threads that each load their own
+* would be pure overhead. The same reason ENGINE_BLIND_RULES sits here.
+*/
+const DEFAULT_PAGE_TIMEOUT_MS = 3e4;
 /** WCAG 2.2 AA and everything it builds on. Best-practice rules stay off. */
 const DEFAULT_TAGS = [
 	"wcag2a",
@@ -122,17 +131,42 @@ function ruleOutcomes(audit) {
 		...audit.inapplicable
 	];
 }
-function runOptions(tags) {
+function runOptions(tags, options = {}) {
 	return {
 		runOnly: {
 			type: "tag",
 			values: [...tags]
 		},
 		resultTypes: ["violations", "incomplete"],
-		preload: false
+		preload: false,
+		...options.skipBlindRules ? { rules: disabledBlindRules() } : {}
 	};
 }
 /**
+* The rules this engine cannot decide, switched off rather than run.
+*
+* Normally they are run and their verdict discarded: axe-core computes colour
+* contrast against a stylesheet jsdom never fetched, and `shapeResults` throws
+* the answer away as untrustworthy. The work is wasted either way, and it is
+* not a small amount — measured at 14-19% of a page, since colour contrast is
+* the most expensive rule axe-core has.
+*
+* What is lost is the element list. A rule that runs reports *which* elements
+* it could not decide, and those are the elements a person has to check by
+* hand; a rule that never runs cannot name them. That is the whole trade, and
+* it is why this is behind a flag rather than the default.
+*
+* What does not change is the verdict. `shapeResults` already has a pass for
+* rules axe-core skipped entirely — the preload-dependent ones arrive that way
+* — and files them as unevaluated with the same reason. A criterion this run
+* could not reach still reads as unreached.
+*/
+function disabledBlindRules() {
+	const rules = {};
+	for (const ruleId of Object.keys(ENGINE_BLIND_RULES)) rules[ruleId] = { enabled: false };
+	return rules;
+}
+/**
 * Turn raw axe-core output into a PageAudit, shared by both engines so their
 * reports are directly comparable.
 *
@@ -279,4 +313,4 @@ function enClauses(tags) {
 	return [...clauses].sort();
 }
 //#endregion
-export { findingElements as a, runOptions as c, failedPage as i, shapeResults as l, ENGINE_BLIND_RULES as n, pageUrl as o, blindRulesInScope as r, ruleOutcomes as s, DEFAULT_TAGS as t, successCriteria as u };
+export { failedPage as a, ruleOutcomes as c, successCriteria as d, blindRulesInScope as i, runOptions as l, DEFAULT_TAGS as n, findingElements as o, ENGINE_BLIND_RULES as r, pageUrl as s, DEFAULT_PAGE_TIMEOUT_MS as t, shapeResults as u };

package/dist/{run-DB34BSOZ.js → run-C2nKFcb-.js}

@@ -35,7 +35,7 @@ async function auditBuild(directory, options, logger) {
 		logger.info("skipped (enabled: false)");
 		return;
 	}
-	const { runAuditCommand } = await import("./audit-CpXH2Mk8.js");
+	const { runAuditCommand } = await import("./audit-DyHPmGeD.js");
 	const { exitCode } = await runAuditCommand(directory, auditOptions);
 	if (exitCode === 0) {
 		logger.info("no violations at or above the threshold");

package/dist/{run-BMASMmwO.d.ts → run-CtcEUhbe.d.ts}

@@ -20,6 +20,13 @@ interface IntegrationOptions {
   baseUrl?: string;
   /** Audit in real Chromium. Needs the playwright peer. */
   browser?: boolean;
+  /**
+   * Skip the rules the browserless engine cannot decide rather than running
+   * them and discarding the answer. The verdict does not move — those rules are
+   * still reported as not evaluated — so what a build gives up is the list of
+   * elements a person would check by hand. No effect under `browser`.
+   */
+  fast?: boolean;
   concurrency?: number;
   baseline?: string;
   format?: OutputFormat;

package/dist/{sarif-SR3_lLYd.js → sarif-B-UBcVu8.js}

@@ -1,8 +1,8 @@
 import { o as isImpactLevel } from "./impact-DZt2oBCP.js";
 import { o as standardsReference } from "./text-CKKpzkYM.js";
 import { t as TOOL_VERSION } from "./version-B3v4rNoG.js";
-import { t as elementFingerprint } from "./fingerprint-DRoneAjj.js";
-import { a as findingElements, s as ruleOutcomes } from "./result-DoamKFsp.js";
+import { t as elementFingerprint } from "./fingerprint-BjYV_0F7.js";
+import { c as ruleOutcomes, o as findingElements } from "./result-BWcYXeRs.js";
 import path from "node:path";
 //#region src/audit/report/sarif.ts
 const SARIF_VERSION = "2.1.0";
@@ -111,7 +111,7 @@ function toResults(finding, ruleIndex, uri, suppressions) {
 * combines the fingerprint with the location itself.
 */
 function fingerprint(ruleId, selector, html) {
-	return { "eaaKit/v1": elementFingerprint(ruleId, selector, html) };
+	return { "eaaKit/v2": elementFingerprint(ruleId, selector, html) };
 }
 /** Every rule the run knows about, so the catalogue is complete in GitHub. */
 function buildRules(audits) {

package/dist/{schema-is6CGX2D.js → schema-DJSF4K05.js}

@@ -70,6 +70,20 @@ function boolean() {
 function number() {
 	return { read: (value, path, issues) => typeof value === "number" && Number.isFinite(value) ? value : fail(issues, path, "expected a number") };
 }
+/**
+* A whole number, with an optional floor.
+*
+* `number` would accept 2.5 pages and a concurrency of 0, both of which the
+* CLI's own parsers refuse. A config file is the same instruction typed
+* somewhere else, so it is held to the same rule.
+*/
+function integer(options = {}) {
+	return { read: (value, path, issues) => {
+		if (typeof value !== "number" || !Number.isInteger(value)) return fail(issues, path, "expected a whole number");
+		if (options.min !== void 0 && value < options.min) return fail(issues, path, `must be ${options.min} or more`);
+		return value;
+	} };
+}
 /** One of a fixed set. The message lists them, since that is the useful part. */
 function enumeration(values) {
 	return { read: (value, path, issues) => typeof value === "string" && values.includes(value) ? value : fail(issues, path, `expected one of ${values.join(", ")}`) };
@@ -192,4 +206,4 @@ function email() {
 	} };
 }
 //#endregion
-export { url as _, isoDate as a, number as c, pipe as d, record as f, union as g, transform as h, enumeration as i, object as l, string as m, boolean as n, isoDateTime as o, safeParse as p, email as r, nullable as s, array as t, optional as u, withDefault as v };
+export { union as _, integer as a, nullable as c, optional as d, pipe as f, transform as g, string as h, enumeration as i, number as l, safeParse as m, boolean as n, isoDate as o, record as p, email as r, isoDateTime as s, array as t, object as u, url as v, withDefault as y };