eaa-kit 0.4.0 → 0.6.0

package/dist/{baseline-DB9CZGnV.js → baseline-D2qWmUC6.js}

@@ -1,6 +1,7 @@
-import { a as isoDate$1, c as number, l as object, m as string, p as safeParse, s as nullable, t as array, u as optional, v as withDefault } from "./schema-is6CGX2D.js";
-import { t as elementFingerprint } from "./fingerprint-DRoneAjj.js";
-import { a as findingElements } from "./result-DoamKFsp.js";
+import { c as nullable, d as optional, h as string, l as number, m as safeParse, o as isoDate, t as array, u as object, y as withDefault } from "./schema-DJSF4K05.js";
+import { a as isoDate$1 } from "./text-BF1LHMiV.js";
+import { t as elementFingerprint } from "./fingerprint-BjYV_0F7.js";
+import { o as findingElements } from "./result-DfUru6y_.js";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import path from "node:path";
 /** Default filename, used by the CLI when no path is given. */
@@ -18,7 +19,7 @@ const entrySchema = object({
 	/** ISO date the entry was written. */
 	acceptedOn: withDefault(string(), () => ""),
 	/** ISO date after which this entry stops suppressing anything. */
-	expiresOn: optional(isoDate$1()),
+	expiresOn: optional(isoDate()),
 	/** Why this is being lived with. Free text, for whoever reads the file. */
 	note: optional(string())
 });
@@ -37,7 +38,7 @@ var BaselineError = class extends Error {
 * can still report on what the run actually found.
 */
 function applyBaseline(audits, baseline, options = {}) {
-	const today = isoDate(options.today ?? /* @__PURE__ */ new Date());
+	const today = isoDate$1(options.today ?? /* @__PURE__ */ new Date());
 	const expired = [];
 	const live = /* @__PURE__ */ new Map();
 	for (const entry of baseline.entries) if (entry.expiresOn !== void 0 && entry.expiresOn < today) expired.push(entry);
@@ -93,9 +94,38 @@ function applyBaseline(audits, baseline, options = {}) {
 		accepted
 	};
 }
+/**
+* The baseline without the entries this run showed are gone.
+*
+* `applyBaseline` already decides which those are, and does it carefully: an
+* entry counts as stale only when the page it names was audited and the element
+* was not found. Entries for pages a narrowed run never looked at are not stale
+* and are kept here, because from the outside a page nobody audited and a page
+* that no longer exists are the same thing, and guessing wrong empties the file
+* that is holding the rest of the site's build together.
+*
+* Nothing is added. That is the whole difference between this and recording a
+* baseline again: re-recording accepts whatever the site is failing today,
+* which on a bad day is a new barrier nobody agreed to.
+*/
+function pruneBaseline(baseline, stale) {
+	const gone = new Set(stale.map((entry) => key(entry.page, entry.ruleId, entry.fingerprint)));
+	if (gone.size === 0) return {
+		baseline,
+		removed: []
+	};
+	const kept = baseline.entries.filter((entry) => !gone.has(key(entry.page, entry.ruleId, entry.fingerprint)));
+	return {
+		baseline: {
+			...baseline,
+			entries: kept
+		},
+		removed: baseline.entries.filter((entry) => gone.has(key(entry.page, entry.ruleId, entry.fingerprint)))
+	};
+}
 /** Record every violation a run found, so a later run can fail only on new ones. */
 function buildBaseline(audits, options = {}) {
-	const acceptedOn = isoDate(options.today ?? /* @__PURE__ */ new Date());
+	const acceptedOn = isoDate$1(options.today ?? /* @__PURE__ */ new Date());
 	const entries = [];
 	for (const audit of audits) for (const finding of audit.violations) for (const node of findingElements(finding)) entries.push({
 		page: audit.relativePath,
@@ -109,7 +139,7 @@ function buildBaseline(audits, options = {}) {
 		...options.note ? { note: options.note } : {}
 	});
 	return {
-		schemaVersion: 1,
+		schemaVersion: 2,
 		createdOn: acceptedOn,
 		entries: entries.sort(byEntry)
 	};
@@ -137,7 +167,8 @@ async function readBaseline(file, cwd = process.cwd()) {
 		const issues = result.error.issues.map((issue) => `${issue.path.join(".") || "document"}: ${issue.message}`).slice(0, 5);
 		throw new BaselineError(`${path.basename(target)} is not an eaa-kit baseline (${issues.join("; ")})`);
 	}
-	if (result.data.schemaVersion !== 1) throw new BaselineError(`${path.basename(target)} has schemaVersion ${result.data.schemaVersion}; this version of eaa-kit reads 1`);
+	if (result.data.schemaVersion !== 2) throw new BaselineError(`${path.basename(target)} has schemaVersion ${result.data.schemaVersion}; this version of eaa-kit reads 2.\n  Record it again on the current build: eaa-kit baseline\n  Read the new file before committing it: it lists what this run found, which is
+  not necessarily what the old one accepted.`);
 	return result.data;
 }
 async function writeBaseline(file, baseline, cwd = process.cwd()) {
@@ -152,8 +183,5 @@ function key(page, ruleId, fingerprint) {
 function byEntry(a, b) {
 	return a.page.localeCompare(b.page) || a.ruleId.localeCompare(b.ruleId) || a.fingerprint.localeCompare(b.fingerprint);
 }
-function isoDate(date) {
-	return date.toISOString().slice(0, 10);
-}
 //#endregion
-export { readBaseline as a, buildBaseline as i, DEFAULT_BASELINE_FILE as n, serialiseBaseline as o, applyBaseline as r, writeBaseline as s, BaselineError as t };
+export { pruneBaseline as a, writeBaseline as c, buildBaseline as i, DEFAULT_BASELINE_FILE as n, readBaseline as o, applyBaseline as r, serialiseBaseline as s, BaselineError as t };

package/dist/checklist-BtgkxMEa.js

@@ -0,0 +1,44 @@
+import { n as count } from "./text-BF1LHMiV.js";
+import { a as emitDocument, o as fail, s as note } from "./command-CZKp9Wi_.js";
+import "./review-CdMK2GpQ.js";
+import { access } from "node:fs/promises";
+import path from "node:path";
+//#region src/cli/checklist.ts
+async function runChecklistCommand(options = {}) {
+	const cwd = options.cwd ?? process.cwd();
+	const recordPath = options.record ?? "eaa-review.json";
+	const { WCAG22_AA_CRITERIA } = await import("./coverage-7bQqWNfN.js");
+	const { answeredCount, blankReview, readReview, ReviewError, writeReview } = await import("./review-DIbOTmOM.js");
+	let existing;
+	try {
+		existing = await readReview(recordPath, cwd);
+	} catch (cause) {
+		if (!(cause instanceof ReviewError)) throw cause;
+		if (await exists(path.resolve(cwd, recordPath))) {
+			fail(cause.message);
+			return { exitCode: 2 };
+		}
+	}
+	const record = blankReview(WCAG22_AA_CRITERIA, existing);
+	if (options.reviewedBy !== void 0) record.reviewedBy = options.reviewedBy;
+	await writeReview(recordPath, record, cwd);
+	note(existing === void 0 ? `Review record written to ${recordPath}` : `Review record updated at ${recordPath}: ${count(answeredCount(record), "criterion")} already answered`);
+	const { buildWorksheet } = await import("./worksheet-eUjwYLxC.js");
+	await emitDocument(buildWorksheet({
+		recordPath,
+		review: record
+	}), options.output, cwd);
+	if (options.output !== void 0) note(`Worksheet written to ${options.output}`);
+	note("Answers go in the record; the worksheet is generated and never read back.");
+	return { exitCode: 0 };
+}
+async function exists(target) {
+	try {
+		await access(target);
+		return true;
+	} catch {
+		return false;
+	}
+}
+//#endregion
+export { runChecklistCommand };

package/dist/cli/index.js

@@ -1,14 +1,16 @@
 #!/usr/bin/env node
-import { c as number, f as record, l as object, m as string, n as boolean, p as safeParse, s as nullable, t as array, u as optional, v as withDefault } from "../schema-is6CGX2D.js";
-import { l as STATEMENT_LOCALES, o as COUNTRIES, r as loadConfig, s as ConfigError } from "../load-5wRGLvub.js";
-import { i as readAuditReport, o as StatementError, t as renderStatement } from "../render-DrvXRCEn.js";
-import { a as impactRank, n as IMPACT_LEVELS, o as isImpactLevel, s as meetsThreshold, t as DEFAULT_FAIL_ON } from "../impact-DZt2oBCP.js";
-import { n as count, t as collapse } from "../text-CKKpzkYM.js";
+import { c as meetsThreshold, n as IMPACT_LEVELS, o as impactRank, s as isImpactLevel, t as DEFAULT_FAIL_ON } from "../impact-luGCnN8F.js";
+import { c as nullable, d as optional, h as string, l as number, m as safeParse, n as boolean, p as record, t as array, u as object, y as withDefault } from "../schema-DJSF4K05.js";
+import { c as ConfigError, i as loadConfig, s as COUNTRIES, u as STATEMENT_LOCALES } from "../load-vZdV_fD1.js";
+import { c as StatementError, i as readAuditReport, o as checkStatementEvidence, s as refuses, t as renderStatement } from "../render-CtsqR0k-.js";
+import { n as count, t as collapse } from "../text-BF1LHMiV.js";
 import { t as TOOL_VERSION } from "../version-B3v4rNoG.js";
-import { t as elementFingerprint } from "../fingerprint-DRoneAjj.js";
-import { i as buildBaseline, n as DEFAULT_BASELINE_FILE, s as writeBaseline, t as BaselineError } from "../baseline-DB9CZGnV.js";
-import { n as runAuditCommand, r as resolvePages, t as OUTPUT_FORMATS } from "../audit-CPoZMXGM.js";
-import { a as runEngine, i as note, n as emitDocument, o as warn, r as fail, t as advise } from "../command-D8l_oYbV.js";
+import { t as elementFingerprint } from "../fingerprint-BjYV_0F7.js";
+import { a as pruneBaseline, c as writeBaseline, i as buildBaseline, n as DEFAULT_BASELINE_FILE, o as readBaseline, r as applyBaseline, t as BaselineError } from "../baseline-D2qWmUC6.js";
+import { a as emitDocument, c as runEngine, d as parseHeader, i as baselineInvocation, l as warn, n as auditDefaults, o as fail, r as auditInvocation, s as note, t as advise, u as basicAuth } from "../command-CZKp9Wi_.js";
+import { t as DEFAULT_REVIEW_FILE } from "../review-CdMK2GpQ.js";
+import { n as runAuditCommand, r as resolvePages, t as OUTPUT_FORMATS } from "../audit-e_uixhPG.js";
+import { enableCompileCache } from "node:module";
 import { readFile } from "node:fs/promises";
 import path from "node:path";
 import { Command, InvalidArgumentError } from "commander";
@@ -36,16 +38,17 @@ async function runBaselineCommand(dir, options = {}) {
 		entries: 0,
 		exitCode: 2
 	};
-	const { pages, origin, label } = resolved;
+	const { pages, origin, label, directory } = resolved;
 	note(`Auditing ${count(pages.length, "page")} in ${label}…`);
 	const baseUrl = options.baseUrl ?? origin;
 	const audits = await runEngine(pages, {
 		cwd,
+		...options.headers === void 0 ? {} : { headers: options.headers },
 		...baseUrl === void 0 ? {} : { baseUrl },
 		...options.timeoutMs === void 0 ? {} : { timeoutMs: options.timeoutMs },
 		...options.browser ? { browser: true } : {},
 		...options.concurrency === void 0 ? {} : { concurrency: options.concurrency },
-		...options.url === void 0 ? { directory: path.resolve(cwd, dir) } : {}
+		...directory === void 0 ? {} : { directory }
 	});
 	if (!audits) return {
 		entries: 0,
@@ -59,11 +62,12 @@ async function runBaselineCommand(dir, options = {}) {
 			exitCode: 2
 		};
 	}
+	const target = options.output ?? "eaa-baseline.json";
+	if (options.prune) return await prune(audits, target, cwd);
 	const baseline = buildBaseline(audits, {
 		...options.note ? { note: options.note } : {},
 		...options.expiresOn ? { expiresOn: options.expiresOn } : {}
 	});
-	const target = options.output ?? "eaa-baseline.json";
 	try {
 		await writeBaseline(target, baseline, cwd);
 	} catch (cause) {
@@ -77,13 +81,60 @@ async function runBaselineCommand(dir, options = {}) {
 		throw cause;
 	}
 	const entries = baseline.entries.length;
-	note(`Wrote ${entries} ${entries === 1 ? "entry" : "entries"} to ${target}`);
+	note(`Wrote ${count(entries, "entry")} to ${target}`);
 	if (entries > 0) advise("These are barriers, not exceptions. Commit the file, then work the list down.");
 	return {
 		entries,
 		exitCode: 0
 	};
 }
+/**
+* `--prune`: take out what this run shows is gone, and add nothing.
+*
+* The audit already tells anybody running it that entries no longer match and
+* can be removed. Acting on that advice meant editing JSON by hand, entry by
+* entry, against a file whose whole purpose is that nobody has to remember what
+* is in it — so most people did not, and a baseline accumulated barriers that
+* were fixed years ago while looking exactly like one that had not been read.
+*
+* Recording a new baseline is not the same operation and is not a substitute:
+* it accepts whatever the site fails today, which on a bad day quietly adopts a
+* barrier nobody agreed to.
+*/
+async function prune(audits, target, cwd) {
+	let existing;
+	try {
+		existing = await readBaseline(target, cwd);
+	} catch (cause) {
+		if (cause instanceof BaselineError) {
+			fail(cause.message);
+			return {
+				entries: 0,
+				exitCode: 2
+			};
+		}
+		throw cause;
+	}
+	const outcome = applyBaseline(audits, existing);
+	const { baseline, removed } = pruneBaseline(existing, outcome.stale);
+	if (removed.length === 0) {
+		note(`Nothing to remove from ${target}: every entry still matches something on this run`);
+		return {
+			entries: existing.entries.length,
+			removed: 0,
+			exitCode: 0
+		};
+	}
+	await writeBaseline(target, baseline, cwd);
+	note(`Removed ${count(removed.length, "entry")} from ${target}; ${count(baseline.entries.length, "entry")} left`);
+	for (const entry of removed) note(`  ${entry.page}  ${entry.ruleId}`);
+	if (outcome.expired.length > 0) advise(`${count(outcome.expired.length, "entry")} have expired and suppress nothing; --prune leaves them for you to decide about`);
+	return {
+		entries: baseline.entries.length,
+		removed: removed.length,
+		exitCode: 0
+	};
+}
 var DiffError = class extends Error {
 	name = "DiffError";
 };
@@ -222,7 +273,7 @@ async function readReport(file, cwd = process.cwd()) {
 		const first = result.error.issues[0];
 		throw new DiffError(`${file} is not an eaa-kit JSON report${first === void 0 || first.path.length === 0 ? "" : ` at ${first.path.join(".")}`}: ${first?.message ?? "unrecognised shape"}`);
 	}
-	if (result.data.schemaVersion !== 1) throw new DiffError(`${file} is schemaVersion ${result.data.schemaVersion}; this version of eaa-kit reads 1`);
+	if (result.data.schemaVersion !== 2) throw new DiffError(`${file} is schemaVersion ${result.data.schemaVersion}; this version of eaa-kit reads 2.\n  Write both reports with the same version of eaa-kit before comparing them.`);
 	return result.data;
 }
 //#endregion
@@ -352,6 +403,23 @@ async function runStatementCommand(options = {}) {
 		});
 		let audit;
 		if (options.audit) audit = await readAuditReport(options.audit, options.cwd ?? process.cwd());
+		let review;
+		if (options.review) {
+			const { readReview } = await import("../review-DIbOTmOM.js");
+			review = await readReview(options.review, options.cwd ?? process.cwd());
+		}
+		const problems = checkStatementEvidence({
+			config,
+			...audit ? { audit } : {},
+			...review ? { review } : {}
+		});
+		for (const problem of problems) if (problem.severity === "refuses") fail(problem.message);
+		else advise(problem.message);
+		if (refuses(problems)) return {
+			document: "",
+			format,
+			exitCode: 2
+		};
 		const statement = await renderStatement(config, {
 			...options.locale ? { locale: options.locale } : {},
 			...options.country ? { country: options.country } : {},
@@ -373,7 +441,8 @@ async function runStatementCommand(options = {}) {
 			exitCode: 0
 		};
 	} catch (cause) {
-		if (cause instanceof ConfigError || cause instanceof StatementError) {
+		const { ReviewError } = await import("../review-DIbOTmOM.js");
+		if (cause instanceof ConfigError || cause instanceof StatementError || cause instanceof ReviewError) {
 			fail(cause.message);
 			if (cause instanceof ConfigError) for (const issue of cause.issues) note(`  ${issue}`);
 			return {
@@ -396,6 +465,30 @@ function formatFor(output) {
 //#endregion
 //#region src/cli/index.ts
 /**
+* Reuse the compiled form of this tool and its dependencies between runs.
+*
+* Most of what a short audit costs is not the audit. jsdom alone is ~700 ms to
+* import on a warm page cache, and V8 pays to parse and compile it from source
+* on every single run — of a CLI somebody invokes from a build script, over and
+* over, against code that has not changed since the last time. Node can cache
+* the compiled bytecode instead, which is exactly the shape of this problem.
+*
+* Measured over ten pages: 2350 ms without, 2075 ms with. The saving is a fixed
+* cost, so it counts for most on the small sites where fixed cost is most of
+* the run.
+*
+* Best-effort by design. It is a cache: a read-only filesystem, a sandbox that
+* forbids the directory, or a Node built without the feature all mean the run
+* is a little slower, and none of them is a reason to fail an audit. Node's own
+* NODE_DISABLE_COMPILE_CACHE is honoured by the call itself.
+*/
+function useCompileCache() {
+	try {
+		enableCompileCache();
+	} catch {}
+}
+useCompileCache();
+/**
 * A parser for a fixed set of words, listing them when the answer is not one.
 *
 * `normalise` is for `--country de`, where the accepted spelling differs from
@@ -428,19 +521,48 @@ const parseFormat = oneOf(OUTPUT_FORMATS);
 const parsePositive = wholeNumber(1);
 const parseDepth = wholeNumber(0);
 const parseConcurrency = wholeNumber(1);
+/**
+* `--header` repeated, collected into a list the command turns into a record.
+*
+* Validated here so a typo stops the run before a site is crawled with a
+* malformed credential — and the error names the header rather than repeating
+* the value, because a bad `--header` is exactly the case where the value is a
+* token and the terminal is a CI log.
+*/
+function collectHeader(value, previous = []) {
+	try {
+		parseHeader(value);
+	} catch (cause) {
+		throw new InvalidArgumentError(cause instanceof Error ? cause.message : String(cause));
+	}
+	return [...previous, value];
+}
+function parseBasicAuth(value) {
+	try {
+		basicAuth(value);
+	} catch (cause) {
+		throw new InvalidArgumentError(cause instanceof Error ? cause.message : String(cause));
+	}
+	return value;
+}
 const program = new Command();
 program.exitOverride();
 program.name("eaa-kit").description("WCAG 2.2 AA auditor and EU accessibility statement generator for static sites.\nNot legal advice.").version(TOOL_VERSION, "-v, --version");
-program.command("audit").description("Audit built HTML against WCAG 2.2 AA").argument("[dir]", "directory holding the built site (default: found automatically)").option("--include <globs...>", "glob patterns to audit, relative to dir").option("--exclude <globs...>", "glob patterns to skip").option("--base-url <url>", "audit pages under their real site URL").option("--url <url>", "audit a running site instead of a build directory").option("--no-build", "never run the project build or start its server").option("--per-page", "also list every page and its result").option("--manual", "what to check by hand for the rules this engine cannot evaluate").option("--coverage", "list every WCAG 2.2 A/AA criterion and what this run reached on it").option("--allow-remote", "allow --url to crawl a host that is not localhost").option("--ignore-robots", "crawl paths robots.txt disallows").option("--sitemap <path>", "where the site lists its pages, if not /sitemap.xml").option("--max-pages <n>", "stop the crawl after this many pages", parsePositive).option("--max-depth <n>", "how far from the entry URL to follow links", parseDepth).option("--fail-on <impact>", `exit 1 on violations at or above this impact (${IMPACT_LEVELS.join("|")})`, parseImpact, DEFAULT_FAIL_ON).option("--format <format>", `output format (${OUTPUT_FORMATS.join("|")})`, parseFormat, "console").option("--output <path>", "write the report to a file instead of stdout").option("--browser", "audit in real Chromium, covering the rules jsdom cannot evaluate").option("--concurrency <n>", "worker threads to audit with, or 1 for none (default: from the page and core count)", parseConcurrency).option("--baseline <path>", "accept the violations recorded in this file; fail only on new ones").action(async (dir, flags) => {
-	const { build, ...options } = flags;
-	const { exitCode } = await runAuditCommand(dir, {
-		...options,
-		...build === false ? { noBuild: true } : {}
-	});
+program.command("audit").description("Audit built HTML against WCAG 2.2 AA").argument("[dir]", "directory holding the built site (default: found automatically)").option("--include <globs...>", "glob patterns to audit, relative to dir").option("--exclude <globs...>", "glob patterns to skip").option("--base-url <url>", "audit pages under their real site URL").option("--url <url>", "audit a running site instead of a build directory").option("--no-build", "never run the project build or start its server").option("--per-page", "also list every page and its result").option("--manual", "what to check by hand for the rules this engine cannot evaluate").option("--coverage", "list every WCAG 2.2 A/AA criterion and what this run reached on it").option("--allow-remote", "allow --url to crawl a host that is not localhost").option("--ignore-robots", "crawl paths robots.txt disallows").option("--sitemap <path>", "where the site lists its pages, if not /sitemap.xml").option("--max-pages <n>", "stop the crawl after this many pages", parsePositive).option("--max-depth <n>", "how far from the entry URL to follow links", parseDepth).option("--header <header>", "send this header with every request, e.g. \"Authorization: Bearer …\". Repeatable", collectHeader).option("--basic-auth <user:password>", "send an Authorization header for basic auth", parseBasicAuth).option("--fail-on <impact>", `exit 1 on violations at or above this impact (${IMPACT_LEVELS.join("|")}; default: ${DEFAULT_FAIL_ON})`, parseImpact).option("--format <format>", `output format (${OUTPUT_FORMATS.join("|")}; default: console)`, parseFormat).option("--output <path>", "write the report to a file instead of stdout").option("--browser", "audit in real Chromium, covering the rules jsdom cannot evaluate").option("--fast", "skip the rules the browserless engine cannot decide anyway, losing their element lists").option("--concurrency <n>", "pages to audit at once, or 1 for none (default: from the page and core count)", parseConcurrency).option("--baseline <path>", "accept the violations recorded in this file; fail only on new ones").option("--review <path>", "what a person checked, from eaa-kit checklist").option("--review-max-age <days>", "stop counting review entries older than this", parseDepth).option("--config <path>", "take defaults from this config file, otherwise it is searched for").action(async (dir, flags) => {
+	const defaults = await auditDefaults({ ...flags.config ? { config: flags.config } : {} });
+	const invocation = auditInvocation(dir, defaults, flags);
+	const { exitCode } = await runAuditCommand(invocation.dir, invocation.options);
+	process.exitCode = exitCode;
+});
+program.command("baseline").description("Record the violations a build already has, so later runs fail only on new ones").argument("[dir]", "directory holding the built site (default: ./dist)").option("--include <globs...>", "glob patterns to audit, relative to dir").option("--exclude <globs...>", "glob patterns to skip").option("--base-url <url>", "audit pages under their real site URL").option("--url <url>", "record a baseline from a running site instead of a directory").option("--allow-remote", "allow --url to crawl a host that is not localhost").option("--ignore-robots", "crawl paths robots.txt disallows").option("--sitemap <path>", "where the site lists its pages, if not /sitemap.xml").option("--max-pages <n>", "stop the crawl after this many pages", parsePositive).option("--max-depth <n>", "how far from the entry URL to follow links", parseDepth).option("--header <header>", "send this header with every request, e.g. \"Authorization: Bearer …\". Repeatable", collectHeader).option("--basic-auth <user:password>", "send an Authorization header for basic auth", parseBasicAuth).option("--output <path>", `where to write it (default: ${DEFAULT_BASELINE_FILE})`).option("--prune", "remove the entries this run shows are gone, instead of recording a new baseline").option("--note <text>", "recorded on every entry, for whoever reads the file").option("--expires-on <date>", "ISO date after which the entries stop suppressing", parseDate).option("--browser", "audit in real Chromium instead of jsdom").option("--concurrency <n>", "pages to audit at once, or 1 for none", parseConcurrency).option("--config <path>", "take defaults from this config file, otherwise it is searched for").action(async (dir, flags) => {
+	const defaults = await auditDefaults({ ...flags.config ? { config: flags.config } : {} });
+	const invocation = baselineInvocation(dir, defaults, flags);
+	const { exitCode } = await runBaselineCommand(invocation.dir, invocation.options);
 	process.exitCode = exitCode;
 });
-program.command("baseline").description("Record the violations a build already has, so later runs fail only on new ones").argument("[dir]", "directory holding the built site", "./dist").option("--include <globs...>", "glob patterns to audit, relative to dir").option("--exclude <globs...>", "glob patterns to skip").option("--base-url <url>", "audit pages under their real site URL").option("--url <url>", "record a baseline from a running site instead of a directory").option("--allow-remote", "allow --url to crawl a host that is not localhost").option("--ignore-robots", "crawl paths robots.txt disallows").option("--sitemap <path>", "where the site lists its pages, if not /sitemap.xml").option("--max-pages <n>", "stop the crawl after this many pages", parsePositive).option("--max-depth <n>", "how far from the entry URL to follow links", parseDepth).option("--output <path>", `where to write it (default: ${DEFAULT_BASELINE_FILE})`).option("--note <text>", "recorded on every entry, for whoever reads the file").option("--expires-on <date>", "ISO date after which the entries stop suppressing", parseDate).option("--browser", "audit in real Chromium instead of jsdom").option("--concurrency <n>", "worker threads to audit with, or 1 for none", parseConcurrency).action(async (dir, flags) => {
-	const { exitCode } = await runBaselineCommand(dir, flags);
+program.command("checklist").description("Write the manual review: the 34 WCAG criteria no automated rule can reach").option("--record <path>", `where the answers live (default: ${DEFAULT_REVIEW_FILE})`).option("--output <path>", "write the worksheet here instead of stdout").option("--reviewed-by <name>", "who is carrying out the review").action(async (flags) => {
+	const { runChecklistCommand } = await import("../checklist-BtgkxMEa.js");
+	const { exitCode } = await runChecklistCommand(flags);
 	process.exitCode = exitCode;
 });
 program.command("diff").description("Compare two JSON reports: what a change made worse, and what it fixed").argument("<before>", "JSON report from before the change").argument("<after>", "JSON report from after it").option("--format <format>", `output format (${DIFF_FORMATS.join("|")})`, oneOf(DIFF_FORMATS)).option("--output <path>", "write the diff here instead of stdout").option("--fail-on <impact>", `exit 1 on NEW violations at or above this impact (${IMPACT_LEVELS.join("|")})`, parseImpact, DEFAULT_FAIL_ON).action(async (before, after, flags) => {
@@ -448,11 +570,11 @@ program.command("diff").description("Compare two JSON reports: what a change mad
 	process.exitCode = exitCode;
 });
 program.command("init").description("Write an eaa.config.json to generate statements from").option("--output <path>", "write here instead of eaa.config.json").option("--force", "overwrite a config that is already there").option("-y, --yes", "take every default without asking").action(async (flags) => {
-	const { runInitCommand } = await import("../init-DIWDE35F.js");
+	const { runInitCommand } = await import("../init-BjKYttxc.js");
 	const { exitCode } = await runInitCommand(flags);
 	process.exitCode = exitCode;
 });
-program.command("statement").description("Generate an EU accessibility statement from eaa.config").option("--config <path>", "path to the config file, otherwise it is searched for").option("--lang <locale>", `statement language (${STATEMENT_LOCALES.join("|")})`, parseLocale).option("--country <code>", `override the country template (${COUNTRIES.join("|")})`, parseCountry).option("--audit <path>", "list the barriers from an eaa-kit audit --format json report").option("--format <format>", `output format (${STATEMENT_FORMATS.join("|")}), otherwise from the --output extension`, parseStatementFormat).option("--output <path>", "write the statement to a file instead of stdout").action(async (flags) => {
+program.command("statement").description("Generate an EU accessibility statement from eaa.config").option("--config <path>", "path to the config file, otherwise it is searched for").option("--lang <locale>", `statement language (${STATEMENT_LOCALES.join("|")})`, parseLocale).option("--country <code>", `override the country template (${COUNTRIES.join("|")})`, parseCountry).option("--audit <path>", "list the barriers from an eaa-kit audit --format json report").option("--review <path>", "check the conformance claim against a review record; nothing from it is published").option("--format <format>", `output format (${STATEMENT_FORMATS.join("|")}), otherwise from the --output extension`, parseStatementFormat).option("--output <path>", "write the statement to a file instead of stdout").action(async (flags) => {
 	const { lang, ...options } = flags;
 	const { exitCode } = await runStatementCommand({
 		...options,
@@ -463,6 +585,12 @@ program.command("statement").description("Generate an EU accessibility statement
 try {
 	await program.parseAsync(process.argv);
 } catch (cause) {
+	if (cause instanceof ConfigError) {
+		fail(cause.message);
+		for (const issue of cause.issues) note(`  ${issue}`);
+		process.exitCode = 2;
+		process.exit(2);
+	}
 	const error = cause;
 	if (typeof error.exitCode === "number") process.exitCode = error.exitCode === 0 ? 0 : 2;
 	else {

package/dist/{collect-CFM8gEVv.js → collect-Cu1q9NTB.js}

@@ -46,11 +46,32 @@ async function collectPages(dir, options = {}) {
 	const pages = [];
 	for (let i = 0; i < relativePaths.length; i += READ_CONCURRENCY) {
 		const batch = relativePaths.slice(i, i + READ_CONCURRENCY);
-		const read = await Promise.all(batch.map((relativePath) => readPage(root, relativePath, options.onUnreadable)));
+		const read = await Promise.all(batch.map((relativePath) => readPage(root, relativePath, options.onUnreadable, options.maxBytes ?? 33554432)));
 		for (const page of read) if (page !== void 0) pages.push(page);
 	}
 	return pages;
 }
+/**
+* Whether the directory holds any HTML at all, ignoring include and exclude.
+*
+* Asked when a run collected nothing, to tell two different mistakes apart: a
+* build directory with no pages in it, and a directory full of pages that the
+* caller's own filters excluded. The advice for the first is wrong for the
+* second — it names another directory to audit — so the question has to be
+* answered before it is given.
+*
+* Globs rather than collecting: this only needs to know whether one file
+* exists, and reading every page of a large build to answer that on a path that
+* is about to print a warning and stop would be work for nothing.
+*/
+async function holdsHtml(dir) {
+	return (await glob([...DEFAULT_INCLUDE], {
+		cwd: path.resolve(dir),
+		ignore: [...DEFAULT_EXCLUDE],
+		onlyFiles: true,
+		dot: false
+	})).length > 0;
+}
 async function assertDirectory(root, original) {
 	let stats;
 	try {
@@ -61,9 +82,15 @@ async function assertDirectory(root, original) {
 	}
 	if (!stats.isDirectory()) throw new BuildDirectoryError(`Build path is not a directory: ${original}`, root);
 }
-async function readPage(root, relativePath, onUnreadable) {
+async function readPage(root, relativePath, onUnreadable, maxBytes) {
 	const absolutePath = path.join(root, relativePath);
 	try {
+		const { size } = await stat(absolutePath);
+		if (size > maxBytes) {
+			if (onUnreadable === void 0) throw new Error(`${relativePath} is ${size} bytes, over the ${maxBytes} byte limit`);
+			onUnreadable(relativePath, `${megabytes(size)} MB, over the ${megabytes(maxBytes)} MB limit for one page`);
+			return;
+		}
 		return {
 			absolutePath,
 			relativePath,
@@ -130,5 +157,9 @@ function generic(head) {
 function article(name) {
 	return /^[aeiou]/i.test(name) ? "an" : "a";
 }
+/** Sizes in the megabytes a person reads, not the bytes a computer counts. */
+function megabytes(bytes) {
+	return (bytes / 1048576).toFixed(1).replace(/\.0$/, "");
+}
 //#endregion
-export { stripBom as i, collectPages as n, emptyDirectoryHint as r, BuildDirectoryError as t };
+export { stripBom as a, holdsHtml as i, collectPages as n, emptyDirectoryHint as r, BuildDirectoryError as t };