eaa-kit 0.4.0 → 0.6.0

package/README.md

@@ -3,15 +3,24 @@
 [![CI](https://github.com/likeBloodMoon/eaa-kit/actions/workflows/ci.yml/badge.svg)](https://github.com/likeBloodMoon/eaa-kit/actions/workflows/ci.yml)
 
 Build-time WCAG 2.2 AA auditor and EU accessibility statement generator for static sites,
-aimed at freelancers and small agencies in the DACH region who have to comply with the
-European Accessibility Act (in force since 28 June 2025), the BFSG in Germany and the BaFG
-in Austria.
+built for the freelancers and small agencies who have to comply with the European
+Accessibility Act (in force since 28 June 2025) without an accessibility budget. It started
+in the DACH region — the BFSG in Germany, the BaFG in Austria — and the statement now names
+the statute and supervisory body of **seven countries**: Austria, Germany, Switzerland,
+Spain, France, Italy and the Netherlands, each in its own language as well as English.
+
+0.6.0 adds the half no engine can do. Of the 55 WCAG 2.2 A and AA success criteria, 34 have
+no automated rule at all: `checklist` writes those down as a review somebody works through,
+`audit --review` reads the answers back beside what the run measured, and `statement` now
+refuses to publish a claim of full conformance that either one contradicts. Sites behind a
+login or a preview protection are auditable too.
 
 ```bash
 npx eaa-kit audit                 # WCAG 2.2 AA report; finds your build itself
 npx eaa-kit diff a.json b.json    # what a change made worse, and what it fixed
 npx eaa-kit init                  # write an eaa.config.json
-npx eaa-kit statement             # Barrierefreiheitserklärung from that config
+npx eaa-kit statement             # accessibility statement, in one of seven countries
+npx eaa-kit checklist             # the manual review no engine can do for you
 ```
 
 > **Not legal advice.** eaa-kit reports what an automated engine can and cannot determine
@@ -33,7 +42,9 @@ supported here either.
 **Audits your build.** Globs the HTML out of `./dist`, parses it with jsdom and runs
 axe-core against it. No Chromium download, fast enough for CI, and it never fetches
 anything or executes your site's JavaScript. `--browser` swaps in real Chromium for the
-rules that need layout and CSS.
+rules that need layout and CSS; `--fast` goes the other way and skips the rules the
+browserless engine cannot decide anyway, rather than running them and discarding the
+answer.
 
 ```bash
 eaa-kit audit ./dist --fail-on serious
@@ -46,14 +57,21 @@ export, Nuxt, SvelteKit, anything behind a CMS — are audited running instead:
 eaa-kit audit --url http://localhost:3000
 ```
 
-**Writes the statement.** A Barrierefreiheitserklärung from one config file, in German or
-English, as Markdown or HTML, naming the statute and supervisory body of Austria,
-Switzerland or Germany — and optionally listing the barriers a real audit found.
+**Writes the statement.** A Barrierefreiheitserklärung, a déclaration d'accessibilité, a
+dichiarazione di accessibilità — whatever the country calls it — from one config file, as
+Markdown or HTML, naming that country's statute and supervisory body, and optionally
+listing the barriers a real audit found.
 
 ```bash
 eaa-kit statement --output src/content/a11y.md
+eaa-kit statement --country FR --lang fr    # or ES, IT, NL, AT, DE, CH
 ```
 
+Each country's statement is a document under its own law rather than a translation of
+another's, so where a national regime asks for more than this — France's RGAA declaration,
+Italy's filing with AgID — the text says so instead of letting a generated file look like
+it settles the matter.
+
 **Fails only on what is new.** The first run on a site that already exists finds
 everything at once. A baseline records what is already wrong so the build fails on
 regressions instead, without ever letting an accepted barrier look like a passing one.
@@ -84,6 +102,17 @@ could invent a fix that looks right and is not.
     written in src/components/Header.astro:12
 ```
 
+**Records the part no engine can do.** 34 of the 55 criteria have no automated rule at
+all. `eaa-kit checklist` writes them out as a worksheet and a record; `audit --review`
+reads the record back and reports what a person checked *beside* what the run measured,
+never folded into it. A review never overrules the engine, never counts an entry nobody
+answered, and never counts one that has aged out.
+
+```bash
+eaa-kit checklist --output a11y-review.md
+eaa-kit audit --review eaa-review.json --coverage
+```
+
 **Says how much of WCAG it could reach.** WCAG 2.2 has 55 success criteria at Levels A and
 AA. axe-core has rules touching 23 of them. Every run says so, and `--coverage` lists all
 55 with what this run reached on each — never as a percentage, because most of WCAG cannot
@@ -96,6 +125,16 @@ fetch forty URLs, no longer produces a report that looks like a complete one.
 SARIF for GitHub code scanning, and a self-contained HTML page for the client whose site
 it is.
 
+**Says it once.** The flags a project runs on every build belong in the project, not in the
+build script that repeats them. `eaa.config` — the same file the statement reads — takes an
+[`audit` block](docs/audit.md#defaults-from-eaaconfig) of defaults, and `baseline` reads the
+keys that mean the same thing to it. A flag you type still wins, so a one-off `--browser`
+check needs no edit to a committed file.
+
+```jsonc
+{ "audit": { "dir": "build", "failOn": "critical", "browser": true } }
+```
+
 **Runs in your build**: a [Vite plugin](docs/integrations.md#vite-plugin) covering SvelteKit
 and Remix too, and integrations for
 [Astro](docs/integrations.md#astro-integration),
@@ -112,15 +151,27 @@ that instead — following the site's own sitemap, wherever it keeps it.
 eaa-kit audit --url http://localhost:8000 --sitemap /sitemap_index.xml
 ```
 
+**Reaches a site behind a login.** A preview deployment or a staging CMS refuses anonymous
+requests, which used to put both out of reach. `--basic-auth` and a repeatable `--header`
+cover them, on the crawl and in the browser, and the credentials are never written into a
+report, a baseline or a SARIF log — nor accepted from `eaa.config`, which is a committed
+file.
+
+```bash
+eaa-kit audit --url https://preview.example.com --basic-auth user:password
+```
+
 ## Documentation
 
 | | |
 | --- | --- |
 | [Auditing a build](docs/audit.md) | The `audit` command, both engines, exit codes, and what an automated run can and cannot tell you |
-| [The statement command](docs/statement.md) | The config file, the three countries, and filling a statement from audit results |
+| [Defaults from eaa.config](docs/audit.md#defaults-from-eaaconfig) | Writing the flags down once, and what still overrides them |
+| [The statement command](docs/statement.md) | The config file, the seven countries, and filling a statement from audit results |
 | [Baselines](docs/baseline.md) | Adopting the tool on a site that already has violations |
 | [Comparing two runs](docs/reports.md#comparing-two-runs) | The `diff` command, and what it refuses to call fixed |
 | [Coverage of WCAG](docs/audit.md#how-much-of-wcag-a-run-reaches) | What an automated engine can reach at all, and what it cannot |
+| [Recording a manual review](docs/review.md) | The `checklist` command, the record, and what a review is not allowed to do |
 | [Report formats](docs/reports.md) | The JSON contract, SARIF, and the HTML report |
 | [Integrations](docs/integrations.md) | The build plugins, the GitHub Action, and the two builders that get a command instead |
 
@@ -147,11 +198,15 @@ you](docs/audit.md#what-the-browserless-engine-can-and-cannot-tell-you).
 
 The same applies to the statement: it says what you told it. eaa-kit cannot check whether
 those claims are true, and a statement claiming full conformance for a site that is not
-conformant is worse than no statement at all.
+conformant is worse than no statement at all — which is why, given evidence, it now refuses
+to write that particular one. `statement --audit` will not claim full conformance over a
+report listing barriers, and `--review` will not claim it over criteria somebody recorded as
+not met.
 
 ## Changelog
 
-See [CHANGELOG.md](CHANGELOG.md).
+See [CHANGELOG.md](CHANGELOG.md), and [ROADMAP.md](ROADMAP.md) for what 0.6.0 is meant to
+add and what it deliberately will not.
 
 ## License
 

package/dist/astro/index.d.ts

@@ -1,4 +1,4 @@
-import { n as IntegrationOptions } from "../run-BMASMmwO.js";
+import { n as IntegrationOptions } from "../run-YiqyQA2b.js";
 //#region src/astro/index.d.ts
 /**
  * An Astro integration that audits the build Astro just produced.

package/dist/astro/index.js

@@ -1,4 +1,4 @@
-import { n as auditBuild, t as BuildAuditError } from "../run-DB34BSOZ.js";
+import { n as auditBuild, t as BuildAuditError } from "../run-D7hdVXLA.js";
 import { fileURLToPath } from "node:url";
 //#region src/astro/index.ts
 var AstroAuditError = class extends Error {

package/dist/audit/runners/worker.js

@@ -1,4 +1,5 @@
-import { t as auditPage } from "../../jsdom-DCpGSLfW.js";
+import { t as auditPage } from "../../jsdom-CQar6OQS.js";
+import { enableCompileCache } from "node:module";
 import { parentPort, workerData } from "node:worker_threads";
 //#region src/audit/runners/worker.ts
 /**
@@ -17,6 +18,9 @@ import { parentPort, workerData } from "node:worker_threads";
 * something catastrophic — the thread running out of memory — reaches the
 * pool's error handler instead.
 */
+try {
+	enableCompileCache();
+} catch {}
 const port = parentPort;
 if (!port) throw new Error("eaa-kit audit worker was started outside a worker thread");
 const options = workerData ?? {};

package/dist/audit-DK2StT1_.js

@@ -0,0 +1,2 @@
+import { n as runAuditCommand } from "./audit-e_uixhPG.js";
+export { runAuditCommand };

package/dist/{audit-CPoZMXGM.js → audit-e_uixhPG.js}

@@ -1,10 +1,13 @@
-import { a as impactRank, i as impactLabel, r as countAtOrAbove } from "./impact-DZt2oBCP.js";
-import { a as plural, n as count, t as collapse } from "./text-CKKpzkYM.js";
-import { a as isShared, c as runCompleteness, i as groupIssues, n as blindRules, r as coverageParts, t as remediationFor } from "./remediation-Dtowi2EC.js";
-import { r as componentPath } from "./component-C3GL1Mnu.js";
-import { i as understandingUrl, n as coverageSummary, r as manualCheckFor, t as buildCoverage } from "./coverage-B4IBKMO8.js";
-import { a as runEngine, i as note, n as emitDocument, o as warn, r as fail, t as advise } from "./command-D8l_oYbV.js";
-import { n as collectPages, r as emptyDirectoryHint, t as BuildDirectoryError } from "./collect-CFM8gEVv.js";
+import { a as impactLabel, i as countAtOrAbove, r as byImpactThenRule } from "./impact-luGCnN8F.js";
+import { n as count, o as plural, t as collapse } from "./text-BF1LHMiV.js";
+import { c as runEngine } from "./result-DfUru6y_.js";
+import { a as emitDocument, c as runEngine$1, l as warn, o as fail, s as note, t as advise } from "./command-CZKp9Wi_.js";
+import { l as reviewSentence } from "./review-CdMK2GpQ.js";
+import { r as componentPath } from "./component-ChisoFyY.js";
+import { i as reviewSummary, n as buildCoverage, o as manualCheckFor, r as coverageSummary, s as understandingUrl } from "./coverage-BD2_CYns.js";
+import { a as blindRules, c as isShared, i as remediationFor, l as issueTotals, o as coverageParts, r as runCompleteness, s as groupIssues } from "./completeness-Dwq3CPB3.js";
+import { n as buildSummary } from "./json-PNg6BeXp.js";
+import { i as holdsHtml, n as collectPages, r as emptyDirectoryHint, t as BuildDirectoryError } from "./collect-Cu1q9NTB.js";
 import path from "node:path";
 import pc from "picocolors";
 //#region src/audit/report/console.ts
@@ -51,6 +54,7 @@ function context(options) {
 		manual: options.manual ?? false,
 		coverage: options.coverage ?? false,
 		framework: options.framework,
+		review: options.review,
 		completeness: options.completeness,
 		c,
 		symbol: (kind) => {
@@ -92,7 +96,7 @@ function line(ctx, text, paint) {
 	}]);
 }
 function headerLines(audits, ctx) {
-	const engineLabel = (audits[0]?.engine ?? "jsdom") === "browser" ? "chromium" : "jsdom (browserless)";
+	const engineLabel = runEngine(audits) === "browser" ? "chromium" : "jsdom (browserless)";
 	return [render(ctx, [{
 		text: "eaa-kit audit",
 		paint: ctx.c.bold
@@ -120,7 +124,7 @@ function pageSection(audit, ctx) {
 		}, { text: audit.error }]), "");
 		return lines;
 	}
-	for (const finding of sortByImpact(audit.violations)) lines.push(...violationLines(finding, ctx));
+	for (const finding of [...audit.violations].sort(byImpactThenRule)) lines.push(...violationLines(finding, ctx));
 	for (const finding of audit.incomplete.filter((item) => item.reason === "needs-review")) lines.push(render(ctx, [
 		{
 			text: `  ${ctx.symbol("review")} `,
@@ -145,7 +149,7 @@ function pageSection(audit, ctx) {
 			paint: clean ? ctx.c.green : ctx.c.dim
 		}]));
 	}
-	for (const finding of sortByImpact(audit.accepted ?? [])) {
+	for (const finding of [...audit.accepted ?? []].sort(byImpactThenRule)) {
 		const elements = count(finding.nodes.length, "element");
 		lines.push(line(ctx, `  · ${finding.ruleId} accepted by the baseline (${elements})`, ctx.c.dim));
 	}
@@ -157,7 +161,7 @@ function coverageLine(audit, ctx) {
 	return line(ctx, `    ${coverageParts(audit).join(" · ")}`, ctx.c.dim);
 }
 function violationLines(finding, ctx) {
-	const impact = finding.impact ?? "unknown";
+	const impact = impactLabel(finding.impact);
 	const lines = [render(ctx, [
 		{
 			text: `  ${ctx.symbol("violation")} `,
@@ -181,33 +185,31 @@ function violationLines(finding, ctx) {
 	return lines;
 }
 function summary(audits, ctx) {
-	const withViolations = audits.filter((audit) => audit.violations.length > 0);
-	const errored = audits.filter((audit) => audit.error);
-	const ruleCount = audits.reduce((total, audit) => total + audit.violations.length, 0);
-	const elementCount = audits.reduce((total, audit) => total + audit.violations.reduce((sum, finding) => sum + finding.nodes.length, 0), 0);
+	const totals = buildSummary(audits, ctx.failOn);
 	const reviewCount = countRules(audits, "needs-review");
 	const pages = count(audits.length, "page");
+	const audited = totals.pages - totals.pagesNotAudited;
 	const lines = [line(ctx, "Summary", ctx.c.bold), ...completenessLines(ctx)];
-	if (ruleCount === 0) {
-		const clean = ctx.completeness && !ctx.completeness.complete ? `  No violations across the ${pages} that were audited.` : `  No violations across ${pages}.`;
+	if (totals.violations === 0 && audited === 0 && totals.pagesNotAudited > 0) lines.push(line(ctx, "  Nothing was audited: no page could be read.", ctx.c.red));
+	else if (totals.violations === 0) {
+		const clean = totals.pagesNotAudited > 0 || ctx.completeness && !ctx.completeness.complete ? `  No violations across the ${count(audited, "page")} that were audited.` : `  No violations across ${pages}.`;
 		lines.push(line(ctx, clean, ctx.c.green));
 	} else {
 		lines.push(render(ctx, [{
-			text: `  ${count(ruleCount, "violation")} on ${withViolations.length} of ${pages}`,
+			text: `  ${count(totals.violations, "violation")} on ${totals.pagesWithViolations} of ${count(audited, "page")}`,
 			paint: ctx.c.red
 		}, {
-			text: ` (${count(elementCount, "element")})`,
+			text: ` (${count(totals.violatingElements, "element")})`,
 			paint: ctx.c.dim
 		}]));
-		lines.push(thresholdLine(audits, ctx));
+		lines.push(thresholdLine(totals.failing, ctx));
 	}
 	if (reviewCount > 0) {
 		const verb = reviewCount === 1 ? "needs" : "need";
 		lines.push(line(ctx, `  ${count(reviewCount, "rule")} ${verb} manual review`, ctx.c.yellow));
 	}
-	if (errored.length > 0) lines.push(line(ctx, `  ${count(errored.length, "page")} could not be audited`, ctx.c.red));
-	const accepted = audits.reduce((total, audit) => total + (audit.accepted ?? []).reduce((sum, finding) => sum + finding.nodes.length, 0), 0);
-	if (accepted > 0) lines.push(line(ctx, `  ${count(accepted, "element")} accepted by the baseline, not counted above`, ctx.c.dim));
+	if (totals.pagesNotAudited > 0) lines.push(line(ctx, `  ${count(totals.pagesNotAudited, "page")} could not be audited`, ctx.c.red));
+	if (totals.accepted > 0) lines.push(line(ctx, `  ${count(totals.accepted, "element")} accepted by the baseline, not counted above`, ctx.c.dim));
 	lines.push(...blindSection(audits, ctx));
 	lines.push(...coverageSection(audits, ctx));
 	return lines;
@@ -221,12 +223,14 @@ function summary(audits, ctx) {
 * it could be read as boilerplate.
 */
 function coverageSection(audits, ctx) {
-	const coverage = buildCoverage(audits);
+	const coverage = buildCoverage(audits, void 0, ctx.review);
 	const lines = ["", ...wrap(coverageSummary(coverage), ctx.width - 2).map((text) => line(ctx, `  ${text}`, ctx.c.dim))];
 	if (coverage.browserWouldAnswer > 0) {
 		const verb = coverage.browserWouldAnswer === 1 ? "criterion" : "criteria";
 		lines.push(line(ctx, `  --browser would answer ${coverage.browserWouldAnswer} more ${verb}.`, ctx.c.dim));
 	}
+	const review = reviewSummary(coverage);
+	if (review !== void 0) lines.push(...wrap(review, ctx.width - 2).map((text) => line(ctx, `  ${text}`, ctx.c.dim)));
 	if (!ctx.coverage) {
 		lines.push(line(ctx, "  Run with --coverage for the criterion-by-criterion breakdown.", ctx.c.dim));
 		return lines;
@@ -246,6 +250,8 @@ function coverageSection(audits, ctx) {
 				paint
 			}
 		]));
+		const recorded = criterion.review;
+		if (recorded !== void 0) lines.push(line(ctx, `        ${reviewSentence(recorded)}`, ctx.c.dim));
 	}
 	return lines;
 }
@@ -272,7 +278,8 @@ function completenessLines(ctx) {
 	const lines = [];
 	if (completeness.unreachable.length > 0) {
 		const noun = plural(completeness.unreachable.length, "page");
-		lines.push(line(ctx, `  ${completeness.unreachable.length} ${noun} could not be reached, and were not audited`, ctx.c.yellow));
+		const verb = completeness.unreachable.length === 1 ? "was" : "were";
+		lines.push(line(ctx, `  ${completeness.unreachable.length} ${noun} could not be reached, and ${verb} not audited`, ctx.c.yellow));
 	}
 	if (completeness.truncated) lines.push(line(ctx, "  The run stopped at its page limit; the site has more", ctx.c.yellow));
 	if (lines.length > 0) lines.push(line(ctx, "  This report describes what was audited, not the whole site.", ctx.c.dim));
@@ -282,9 +289,8 @@ function completenessLines(ctx) {
 * Why the run passed or failed. Without this, a build that exits 0 while the
 * report lists violations looks like a bug rather than a threshold choice.
 */
-function thresholdLine(audits, ctx) {
+function thresholdLine(failing, ctx) {
 	const failOn = ctx.failOn;
-	const failing = countAtOrAbove(audits, failOn);
 	if (failing === 0) return line(ctx, `  none at or above ${failOn} (--fail-on ${failOn}), so this run passes`, ctx.c.green);
 	return line(ctx, `  ${failing} at or above ${failOn} (--fail-on ${failOn})`, ctx.c.red);
 }
@@ -329,9 +335,6 @@ function countRules(audits, reason) {
 	for (const audit of audits) for (const finding of audit.incomplete) if (finding.reason === reason) ruleIds.add(finding.ruleId);
 	return ruleIds.size;
 }
-function sortByImpact(findings) {
-	return [...findings].sort((a, b) => impactRank(a.impact) - impactRank(b.impact) || a.ruleId.localeCompare(b.ruleId));
-}
 function criteria(finding) {
 	return finding.successCriteria.length > 0 ? `, WCAG ${finding.successCriteria.join(" ")}` : "";
 }
@@ -347,8 +350,7 @@ function criteria(finding) {
 function issuesSection(audits, ctx) {
 	const issues = groupIssues(audits);
 	if (issues.length === 0) return [];
-	const elements = issues.reduce((total, issue) => total + issue.elements.length, 0);
-	const occurrences = issues.reduce((total, issue) => total + issue.occurrences, 0);
+	const { elements, occurrences } = issueTotals(issues);
 	const lines = [line(ctx, "Issues", ctx.c.bold)];
 	const intro = occurrences === elements ? `  ${count(elements, "distinct element")} to fix.` : `  ${count(occurrences, "violation")} across the site come from ${count(elements, "distinct element")}.`;
 	lines.push(line(ctx, intro, ctx.c.dim));
@@ -484,6 +486,13 @@ async function resolvePages(directory, options = {}) {
 		return;
 	}
 	if (pages.length === 0) {
+		if ((options.include !== void 0 || options.exclude !== void 0) && await holdsHtml(directory)) {
+			warn(`No page in ${shown} matched the filters, so nothing was audited.`);
+			if (options.include !== void 0) note(`  --include ${options.include.join(" ")}`);
+			if (options.exclude !== void 0) note(`  --exclude ${options.exclude.join(" ")}`);
+			note("  Patterns are relative to the audited directory, with POSIX separators.");
+			return;
+		}
 		warn(await emptyDirectoryHint(shown, cwd));
 		return;
 	}
@@ -495,6 +504,7 @@ async function resolvePages(directory, options = {}) {
 	}
 	return {
 		pages,
+		directory,
 		label: shown,
 		completeness: {
 			discovery: "directory",
@@ -511,7 +521,7 @@ async function resolvePages(directory, options = {}) {
 * exit 2 — a run that reached no verdict, not a clean one.
 */
 async function crawlPages(url, options) {
-	const { crawlSite, CrawlError, parseEntryUrl } = await import("./crawl-BiI1Lau_.js");
+	const { collapsedOnto, crawlSite, CrawlError, parseEntryUrl } = await import("./crawl-BHkJmUkA.js");
 	let entry;
 	try {
 		entry = parseEntryUrl(url, options.allowRemote ?? false);
@@ -529,7 +539,8 @@ async function crawlPages(url, options) {
 		...options.sitemap === void 0 ? {} : { sitemap: options.sitemap },
 		...options.maxPages === void 0 ? {} : { maxPages: options.maxPages },
 		...options.maxDepth === void 0 ? {} : { maxDepth: options.maxDepth },
-		...options.timeoutMs === void 0 ? {} : { timeoutMs: options.timeoutMs }
+		...options.timeoutMs === void 0 ? {} : { timeoutMs: options.timeoutMs },
+		...options.headers === void 0 ? {} : { headers: options.headers }
 	});
 	if (result.pages.length === 0 && result.failures.length > 0) {
 		fail(`Could not fetch ${entry.href} (${result.failures[0]?.reason})`);
@@ -545,16 +556,26 @@ async function crawlPages(url, options) {
 		if (result.failures.length > 10) note(`  …and ${result.failures.length - 10} more`);
 	}
 	if (result.truncated) warn(`Stopped at ${count(result.pages.length, "page")}; the site has more. Raise --max-pages to go further.`);
+	const collapsed = collapsedOnto(result);
+	if (collapsed.length > 0) {
+		const landedOn = collapsed[0]?.landedOn ?? "";
+		warn(`Every page requested answered at ${landedOn}, which is not where it was asked.`);
+		note("  A sign-in page in front of the site looks like this.");
+		note("  If it is behind one, pass --basic-auth user:password or --header \"Cookie: …\".");
+	}
 	return {
 		pages: result.pages,
 		origin: result.origin,
 		completeness: {
 			discovery: result.discovery,
 			collected: result.pages.length,
-			unreachable: result.failures.map((failure) => ({
+			unreachable: [...result.failures.map((failure) => ({
 				location: failure.url,
 				reason: failure.reason
-			})),
+			})), ...collapsed.map((redirect) => ({
+				location: redirect.requested,
+				reason: `answered at ${redirect.landedOn} instead, so this page was not audited`
+			}))],
 			truncated: result.truncated
 		}
 	};
@@ -609,22 +630,26 @@ const OUTPUT_FORMATS = [
 * piped somewhere without the chatter coming along.
 */
 async function runAuditCommand(dir, options = {}) {
+	if (options.fast && options.browser) warn("--fast has no effect with --browser: a real browser can decide those rules.");
 	const resolved = await resolvePages(dir, options);
 	if (!resolved) return {
 		audits: [],
 		exitCode: 2
 	};
-	const { pages, origin, label, cleanup, completeness: collection } = resolved;
+	const { pages, origin, label, cleanup, directory, completeness: collection } = resolved;
+	if (options.headers !== void 0 && directory !== void 0 && !options.browser) warn("--header and --basic-auth apply to pages that are fetched; this run read files.");
 	try {
 		note(`Auditing ${count(pages.length, "page")} in ${label}${await describeEngine(pages, options)}…`);
 		const baseUrl = options.baseUrl ?? origin;
-		let audits = await runEngine(pages, {
+		let audits = await runEngine$1(pages, {
 			cwd: options.cwd ?? process.cwd(),
+			...options.headers === void 0 ? {} : { headers: options.headers },
 			...baseUrl === void 0 ? {} : { baseUrl },
 			...options.timeoutMs === void 0 ? {} : { timeoutMs: options.timeoutMs },
 			...options.browser ? { browser: true } : {},
+			...options.fast && !options.browser ? { fast: true } : {},
 			...options.concurrency === void 0 ? {} : { concurrency: options.concurrency },
-			...options.url === void 0 && dir !== void 0 ? { directory: dir } : {}
+			...directory === void 0 ? {} : { directory }
 		});
 		if (!audits) return {
 			audits: [],
@@ -640,7 +665,12 @@ async function runAuditCommand(dir, options = {}) {
 			audits = applied;
 		}
 		const completeness = runCompleteness(audits, collection);
-		await emit(audits, label, failOn, completeness, options);
+		const review = await loadReview(options);
+		if (review === FAILED) return {
+			audits,
+			exitCode: 2
+		};
+		await emit(audits, label, failOn, completeness, options, review);
 		const unaudited = audits.filter((audit) => audit.error);
 		if (unaudited.length > 0) {
 			fail(`${unaudited.length} of ${audits.length} pages could not be audited`);
@@ -666,7 +696,7 @@ async function runAuditCommand(dir, options = {}) {
 * would be as wrong as silently passing.
 */
 async function acceptBaseline(audits, options) {
-	const { applyBaseline, BaselineError, readBaseline } = await import("./baseline-22Y1NWxM.js");
+	const { applyBaseline, BaselineError, readBaseline } = await import("./baseline-BscHfFSW.js");
 	try {
 		const outcome = applyBaseline(audits, await readBaseline(options.baseline, options.cwd ?? process.cwd()));
 		if (outcome.accepted > 0) note(`Baseline accepted ${outcome.accepted} violating elements`);
@@ -684,6 +714,32 @@ async function acceptBaseline(audits, options) {
 		throw cause;
 	}
 }
+/** Distinguishes "no review asked for" from "the review could not be read". */
+const FAILED = Symbol("review-failed");
+/**
+* Read the review record, when one was asked for.
+*
+* Returns undefined when no `--review` was given, which is the ordinary case,
+* and the sentinel when one was given and could not be read.
+*/
+async function loadReview(options) {
+	if (options.review === void 0) return void 0;
+	const { answeredCount, readReview, ReviewError } = await import("./review-DIbOTmOM.js");
+	try {
+		const record = await readReview(options.review, options.cwd ?? process.cwd());
+		note(`Review record: ${count(answeredCount(record), "criterion")} answered`);
+		return {
+			record,
+			...options.reviewMaxAge === void 0 ? {} : { maxAgeDays: options.reviewMaxAge }
+		};
+	} catch (cause) {
+		if (cause instanceof ReviewError) {
+			fail(cause.message);
+			return FAILED;
+		}
+		throw cause;
+	}
+}
 /**
 * What the progress line says about the engine.
 *
@@ -693,47 +749,51 @@ async function acceptBaseline(audits, options) {
 */
 async function describeEngine(pages, options) {
 	if (options.browser) return " with Chromium";
-	const { plannedWorkers } = await import("./pool-BMevaLWD.js");
+	const { plannedWorkers } = await import("./pool-dkexq5xo.js");
 	const workers = options.concurrency ?? plannedWorkers(pages);
-	return workers > 1 ? ` across ${workers} threads` : "";
+	const threads = workers > 1 ? ` across ${workers} threads` : "";
+	return options.fast ? `${threads}, skipping what this engine cannot decide` : threads;
 }
 /**
 * Emit the chosen format, to a file when --output is given and to stdout
 * otherwise. Colour is dropped when writing to a file, since escape codes in a
 * saved report are noise.
 */
-async function emit(audits, dir, failOn, completeness, options) {
-	const body = await renderReport(audits, dir, failOn, completeness, options.format ?? "console", typeof options.output === "string", options);
+async function emit(audits, dir, failOn, completeness, options, review) {
+	const body = await renderReport(audits, dir, failOn, completeness, options.format ?? "console", typeof options.output === "string", options, review);
 	await emitDocument(body, options.output, options.cwd ?? process.cwd());
 	if (options.output !== void 0) note(`Report written to ${options.output}`);
 }
-async function renderReport(audits, dir, failOn, completeness, format, toFile, options) {
+async function renderReport(audits, dir, failOn, completeness, format, toFile, options, review) {
 	switch (format) {
 		case "json": {
-			const { buildJsonReport, serialiseJsonReport } = await import("./json-QQuFIw1W.js");
+			const { buildJsonReport, serialiseJsonReport } = await import("./json-HJDgJp09.js");
 			return serialiseJsonReport(buildJsonReport(audits, {
 				directory: dir,
 				...options.url === void 0 ? {} : { sourceKind: "url" },
 				failOn,
 				completeness,
+				...review === void 0 ? {} : { review },
 				...options.baseUrl ? { baseUrl: options.baseUrl } : {}
 			}));
 		}
 		case "sarif": {
-			const { buildSarifReport, serialiseSarifReport } = await import("./sarif-SR3_lLYd.js");
+			const { buildSarifReport, serialiseSarifReport } = await import("./sarif-BKvq_AUm.js");
 			return serialiseSarifReport(buildSarifReport(audits, {
 				directory: dir,
-				completeness
+				completeness,
+				...review === void 0 ? {} : { review }
 			}));
 		}
 		case "html": {
-			const { buildHtmlReport } = await import("./html-BGTO3ypW.js");
+			const { buildHtmlReport } = await import("./html-Bmh7X_sM.js");
 			const framework = await detectedFramework(options.cwd ?? process.cwd());
 			return buildHtmlReport(audits, {
-				...await sourceLookups(options.cwd ?? process.cwd()),
+				...await sourceLookups(options.cwd ?? process.cwd(), audits),
 				directory: dir,
 				failOn,
 				completeness,
+				...review === void 0 ? {} : { review },
 				...framework === void 0 ? {} : { framework },
 				...options.baseUrl ? { baseUrl: options.baseUrl } : {}
 			});
@@ -741,10 +801,11 @@ async function renderReport(audits, dir, failOn, completeness, format, toFile, o
 		case "console": {
 			const framework = await detectedFramework(options.cwd ?? process.cwd());
 			return `${formatConsoleReport(audits, {
-				...await sourceLookups(options.cwd ?? process.cwd()),
+				...await sourceLookups(options.cwd ?? process.cwd(), audits),
 				dir,
 				failOn,
 				completeness,
+				...review === void 0 ? {} : { review },
 				...options.perPage ? { perPage: true } : {},
 				...options.manual ? { manual: true } : {},
 				...options.coverage ? { coverage: true } : {},
@@ -765,15 +826,23 @@ async function detectedFramework(cwd) {
 	const { readPackageJson } = await import("./project-MFrXcw1M.js");
 	return (await detectFramework(cwd, await readPackageJson(cwd)))?.framework.id;
 }
-async function sourceLookups(cwd) {
+async function sourceLookups(cwd, audits) {
 	const { buildRouteMap, sourceFor } = await import("./routes-CmdRUuOs.js");
-	const { buildComponentIndex, componentFor } = await import("./component-DKd3EHOg.js");
 	const routes = await buildRouteMap(cwd);
+	if (!hasElementsToAttribute(audits)) return {
+		sourceFor: (page) => sourceFor(routes, page),
+		componentFor: () => void 0
+	};
+	const { buildComponentIndex, componentFor } = await import("./component-DcCn3BJS.js");
 	const components = await buildComponentIndex(cwd);
 	return {
 		sourceFor: (page) => sourceFor(routes, page),
 		componentFor: (html) => componentFor(components, html)
 	};
 }
+/** Whether any element will be listed, and so looked up against the source. */
+function hasElementsToAttribute(audits) {
+	return audits.some((audit) => audit.violations.length > 0 || (audit.accepted?.length ?? 0) > 0);
+}
 //#endregion
 export { runAuditCommand as n, resolvePages as r, OUTPUT_FORMATS as t };

package/dist/baseline-BscHfFSW.js

@@ -0,0 +1,2 @@
+import { o as readBaseline, r as applyBaseline, t as BaselineError } from "./baseline-D2qWmUC6.js";
+export { BaselineError, applyBaseline, readBaseline };