eaa-kit 0.4.0 → 0.6.0

package/dist/index.d.ts

@@ -60,10 +60,17 @@ type DefaultedSchema<T> = Schema<T> & {
 //#endregion
 //#region src/config/define.d.ts
 /** Countries with their own supervisory body and statute text. */
-declare const COUNTRIES: readonly ['AT', 'DE', 'CH'];
+declare const COUNTRIES: readonly ['AT', 'DE', 'CH', 'ES', 'FR', 'IT', 'NL'];
 type Country = (typeof COUNTRIES)[number];
-/** Languages a statement can be rendered in. */
-declare const STATEMENT_LOCALES: readonly ['de', 'en'];
+/**
+ * Languages a statement can be rendered in.
+ *
+ * Not every country has every one: a statement is a document under a particular
+ * legal regime, not a translation of a document under another, so each country
+ * has the language it is published in and English. `renderStatement` says which
+ * ones a country has when asked for one it does not.
+ */
+declare const STATEMENT_LOCALES: readonly ['de', 'en', 'es', 'fr', 'it', 'nl'];
 type StatementLocale = (typeof STATEMENT_LOCALES)[number];
 /**
  * Wording follows the EU model statement: fully, partially, or not conformant
@@ -81,6 +88,65 @@ type AssessmentMethod = (typeof ASSESSMENT_METHODS)[number];
  */
 declare const ISSUE_REASONS: readonly ['disproportionate-burden', 'out-of-scope', 'fix-planned'];
 type IssueReason = (typeof ISSUE_REASONS)[number];
+/**
+ * Defaults for `eaa-kit audit` and `eaa-kit baseline`, so a project says once
+ * what every invocation would otherwise repeat.
+ *
+ * Every field is optional and every one is a default: a flag actually typed on
+ * the command line wins, because the file is the project's usual answer and the
+ * flag is somebody asking for something else right now.
+ *
+ * `baseline` reads the subset that means the same thing to it. `output`,
+ * `format`, `failOn` and `baseline` are audit-only on purpose — a baseline
+ * written to the report's path would overwrite the report, and a threshold for
+ * failing a run means nothing to a command that records what it finds.
+ */
+declare const auditSchema: Schema<ObjectOf<{
+  /** Build directory. The positional argument wins over it. */
+  dir: OptionalSchema<string>;
+  include: OptionalSchema<string[]>;
+  exclude: OptionalSchema<string[]>;
+  /** Audit pages under their real site URL instead of file://. */
+  baseUrl: OptionalSchema<string>;
+  /** Audit a running site instead of a directory. */
+  url: OptionalSchema<string>;
+  /** Crawl a host that is not loopback. Off unless a project says otherwise. */
+  allowRemote: OptionalSchema<boolean>;
+  ignoreRobots: OptionalSchema<boolean>;
+  /** Where the site lists its pages, when that is not /sitemap.xml. */
+  sitemap: OptionalSchema<string>;
+  maxPages: OptionalSchema<number>;
+  /** 0 audits the entry page alone. */
+  maxDepth: OptionalSchema<number>;
+  /** Lowest impact that exits 1. */
+  failOn: OptionalSchema<"critical" | "minor" | "moderate" | "serious">;
+  format: OptionalSchema<"console" | "html" | "json" | "sarif">;
+  /** Write the report here instead of stdout. */
+  output: OptionalSchema<string>;
+  /** Audit in real Chromium. Needs the playwright peer. */
+  browser: OptionalSchema<boolean>;
+  /** Skip the rules the browserless engine cannot decide. No effect with `browser`. */
+  fast: OptionalSchema<boolean>;
+  concurrency: OptionalSchema<number>;
+  /** Path to a baseline; violations it accounts for do not fail the run. */
+  baseline: OptionalSchema<string>;
+  /** List every page and its result under the issues. */
+  perPage: OptionalSchema<boolean>;
+  /** Print the manual check for each rule the engine could not evaluate. */
+  manual: OptionalSchema<boolean>;
+  /** List every WCAG 2.2 A/AA criterion and what the run reached on it. */
+  coverage: OptionalSchema<boolean>;
+  /** Path to a review record: what a person checked, for the criteria no engine reaches. */
+  review: OptionalSchema<string>;
+  /** Days after which a recorded review stops counting. */
+  reviewMaxAge: OptionalSchema<number>;
+  /**
+   * False is `--no-build`: never run the project's build or start its server to
+   * find something to audit. Written in the positive because that is the state
+   * being described, and because a config file has no flags to negate.
+   */
+  build: OptionalSchema<boolean>;
+}>>;
 declare const configSchema: Schema<ObjectOf<{
   site: Schema<ObjectOf<{
     name: Schema<string>;
@@ -132,7 +198,54 @@ declare const configSchema: Schema<ObjectOf<{
   }>>;
   enforcement: Schema<ObjectOf<{
     /** Drives which supervisory body and statute the template names. */
-    country: Schema<"AT" | "CH" | "DE">;
+    country: Schema<"AT" | "CH" | "DE" | "ES" | "FR" | "IT" | "NL">;
+  }>>;
+  /** Defaults for the audit commands. Nothing here reaches the statement. */
+  audit: OptionalSchema<ObjectOf<{
+    /** Build directory. The positional argument wins over it. */
+    dir: OptionalSchema<string>;
+    include: OptionalSchema<string[]>;
+    exclude: OptionalSchema<string[]>;
+    /** Audit pages under their real site URL instead of file://. */
+    baseUrl: OptionalSchema<string>;
+    /** Audit a running site instead of a directory. */
+    url: OptionalSchema<string>;
+    /** Crawl a host that is not loopback. Off unless a project says otherwise. */
+    allowRemote: OptionalSchema<boolean>;
+    ignoreRobots: OptionalSchema<boolean>;
+    /** Where the site lists its pages, when that is not /sitemap.xml. */
+    sitemap: OptionalSchema<string>;
+    maxPages: OptionalSchema<number>;
+    /** 0 audits the entry page alone. */
+    maxDepth: OptionalSchema<number>;
+    /** Lowest impact that exits 1. */
+    failOn: OptionalSchema<"critical" | "minor" | "moderate" | "serious">;
+    format: OptionalSchema<"console" | "html" | "json" | "sarif">;
+    /** Write the report here instead of stdout. */
+    output: OptionalSchema<string>;
+    /** Audit in real Chromium. Needs the playwright peer. */
+    browser: OptionalSchema<boolean>;
+    /** Skip the rules the browserless engine cannot decide. No effect with `browser`. */
+    fast: OptionalSchema<boolean>;
+    concurrency: OptionalSchema<number>;
+    /** Path to a baseline; violations it accounts for do not fail the run. */
+    baseline: OptionalSchema<string>;
+    /** List every page and its result under the issues. */
+    perPage: OptionalSchema<boolean>;
+    /** Print the manual check for each rule the engine could not evaluate. */
+    manual: OptionalSchema<boolean>;
+    /** List every WCAG 2.2 A/AA criterion and what the run reached on it. */
+    coverage: OptionalSchema<boolean>;
+    /** Path to a review record: what a person checked, for the criteria no engine reaches. */
+    review: OptionalSchema<string>;
+    /** Days after which a recorded review stops counting. */
+    reviewMaxAge: OptionalSchema<number>;
+    /**
+     * False is `--no-build`: never run the project's build or start its server to
+     * find something to audit. Written in the positive because that is the state
+     * being described, and because a config file has no flags to negate.
+     */
+    build: OptionalSchema<boolean>;
   }>>;
 }>>;
 /**
@@ -167,6 +280,7 @@ interface EaaConfigInput {
   enforcement: {
     country: Country;
   };
+  audit?: AuditConfig;
 }
 /** One barrier, as written in a config file. */
 interface KnownIssueInput {
@@ -178,6 +292,15 @@ interface KnownIssueInput {
 }
 type EaaConfig = Infer<typeof configSchema>;
 type KnownIssue = EaaConfig['compliance']['knownIssues'][number];
+/**
+ * The `audit` block, as written and as parsed — every field is optional.
+ *
+ * `undefined` is mapped out of the value types rather than left in them:
+ * `s.object` never writes a key it did not parse, so an absent field is an
+ * absent key, and the commands spread this over their own options where a
+ * present-but-undefined key would overwrite a real value.
+ */
+type AuditConfig = { [K in keyof Infer<typeof auditSchema>]?: Exclude<Infer<typeof auditSchema>[K], undefined>; };
 /**
  * Identity function that gives `eaa.config.ts` its types. Deliberately does not
  * validate: a config file is loaded and checked in one place, so that an error
@@ -234,6 +357,24 @@ declare class StatementError extends Error {
   readonly name = "StatementError";
 }
 //#endregion
+//#region src/audit/review.d.ts
+declare const reviewSchema: Schema<ObjectOf<{
+  schemaVersion: Schema<number>;
+  /** Who carried out the review, for the record as a whole. */
+  reviewedBy: OptionalSchema<string>;
+  /** Keyed by success criterion number, e.g. '1.2.1'. */
+  criteria: DefaultedSchema<Record<string, ObjectOf<{
+    result: DefaultedSchema<"met" | "not-applicable" | "not-met" | "unreviewed">;
+    /** ISO date the check was done. Without it the entry cannot be aged. */
+    reviewedOn: OptionalSchema<string>;
+    /** Who did it, when that is not the person named on the record. */
+    reviewedBy: OptionalSchema<string>;
+    /** What was checked and what was found. Free text, for whoever reads it. */
+    note: OptionalSchema<string>;
+  }>>>;
+}>>;
+type ReviewRecord = Infer<typeof reviewSchema>;
+//#endregion
 //#region src/statement/findings.d.ts
 /** One rule that failed, folded across every page it failed on. */
 interface AuditFinding {
@@ -279,6 +420,47 @@ declare function summariseAuditReport(value: unknown, source?: string): AuditSum
 /** Read and summarise a report written by `eaa-kit audit --format json`. */
 declare function readAuditReport(file: string, cwd?: string): Promise<AuditSummary>;
 //#endregion
+//#region src/statement/evidence.d.ts
+/**
+ * Whether the statement's claim survives contact with the evidence beside it.
+ *
+ * The README has said since 0.1 that "a statement claiming full conformance for
+ * a site that is not conformant is worse than no statement at all", and until
+ * now the tool did nothing about it: `compliance.status` came out of the config
+ * file, the audit report came in through `--audit`, and nothing ever put the
+ * two in the same room. A run could print a document claiming full conformance
+ * directly above the list of barriers that disproves it.
+ *
+ * This is the check that was missing. It is deliberately narrow: it does not
+ * decide whether a site is accessible, and it cannot — most of WCAG is not
+ * automatable and the whole tool is built around saying so. It refuses only
+ * claims the evidence in hand already contradicts, and warns where a document
+ * is citing evidence that no longer describes the site.
+ *
+ * Nothing here needs an audit report. Given none, only the dates are checked,
+ * and a project that has never run one gets exactly the statement it always
+ * got — the tool cannot audit what it was not shown.
+ */
+/** How much a problem matters. `refuses` stops the statement being written. */
+type EvidenceSeverity = 'refuses' | 'warns';
+interface EvidenceProblem {
+  severity: EvidenceSeverity;
+  /** One sentence stating the contradiction, and one naming the fix. */
+  message: string;
+}
+interface EvidenceInput {
+  config: EaaConfig;
+  /** From `--audit`. Without it only the dates can be checked. */
+  audit?: AuditSummary;
+  /** From `--review`. Read for this check alone; it does not reach the text. */
+  review?: ReviewRecord;
+  /** Injectable so the ageing checks can be tested without waiting. */
+  today?: Date;
+}
+declare function checkStatementEvidence(input: EvidenceInput): EvidenceProblem[];
+/** Whether any problem is bad enough to stop the document being written. */
+declare function refuses(problems: readonly EvidenceProblem[]): boolean;
+//#endregion
 //#region src/statement/html.d.ts
 /**
  * Markdown-to-HTML for exactly the subset the statement templates emit, and
@@ -351,4 +533,4 @@ interface RenderedStatement {
  */
 declare function renderStatement(config: EaaConfig, options?: RenderStatementOptions): Promise<RenderedStatement>;
 //#endregion
-export { ASSESSMENT_METHODS, type AssessmentMethod, type AuditFinding, type AuditSummary, COMPLIANCE_STATUSES, CONFIG_FILENAMES, COUNTRIES, type ComplianceStatus, ConfigError, type Country, type EaaConfig, type EaaConfigInput, type HtmlDocumentOptions, ISSUE_REASONS, type IssueReason, type KnownIssue, type LoadConfigOptions, type LoadedConfig, type RenderStatementOptions, type RenderedStatement, STATEMENT_LOCALES, StatementError, type StatementLocale, configSchema, defineConfig, findConfigFile, loadConfig, parseConfig, readAuditReport, renderStatement, summariseAuditReport, toHtmlBody, toHtmlDocument };
+export { ASSESSMENT_METHODS, type AssessmentMethod, type AuditFinding, type AuditSummary, COMPLIANCE_STATUSES, CONFIG_FILENAMES, COUNTRIES, type ComplianceStatus, ConfigError, type Country, type EaaConfig, type EaaConfigInput, type EvidenceInput, type EvidenceProblem, type EvidenceSeverity, type HtmlDocumentOptions, ISSUE_REASONS, type IssueReason, type KnownIssue, type LoadConfigOptions, type LoadedConfig, type RenderStatementOptions, type RenderedStatement, STATEMENT_LOCALES, StatementError, type StatementLocale, checkStatementEvidence, configSchema, defineConfig, findConfigFile, loadConfig, parseConfig, readAuditReport, refuses, renderStatement, summariseAuditReport, toHtmlBody, toHtmlDocument };

package/dist/index.js

@@ -1,3 +1,3 @@
-import { a as COMPLIANCE_STATUSES, c as ISSUE_REASONS, d as defineConfig, f as parseConfig, i as ASSESSMENT_METHODS, l as STATEMENT_LOCALES, n as findConfigFile, o as COUNTRIES, r as loadConfig, s as ConfigError, t as CONFIG_FILENAMES, u as configSchema } from "./load-5wRGLvub.js";
-import { a as summariseAuditReport, i as readAuditReport, n as toHtmlBody, o as StatementError, r as toHtmlDocument, t as renderStatement } from "./render-DrvXRCEn.js";
-export { ASSESSMENT_METHODS, COMPLIANCE_STATUSES, CONFIG_FILENAMES, COUNTRIES, ConfigError, ISSUE_REASONS, STATEMENT_LOCALES, StatementError, configSchema, defineConfig, findConfigFile, loadConfig, parseConfig, readAuditReport, renderStatement, summariseAuditReport, toHtmlBody, toHtmlDocument };
+import { a as ASSESSMENT_METHODS, c as ConfigError, d as configSchema, f as defineConfig, i as loadConfig, l as ISSUE_REASONS, n as findConfigFile, o as COMPLIANCE_STATUSES, p as parseConfig, s as COUNTRIES, t as CONFIG_FILENAMES, u as STATEMENT_LOCALES } from "./load-vZdV_fD1.js";
+import { a as summariseAuditReport, c as StatementError, i as readAuditReport, n as toHtmlBody, o as checkStatementEvidence, r as toHtmlDocument, s as refuses, t as renderStatement } from "./render-CtsqR0k-.js";
+export { ASSESSMENT_METHODS, COMPLIANCE_STATUSES, CONFIG_FILENAMES, COUNTRIES, ConfigError, ISSUE_REASONS, STATEMENT_LOCALES, StatementError, checkStatementEvidence, configSchema, defineConfig, findConfigFile, loadConfig, parseConfig, readAuditReport, refuses, renderStatement, summariseAuditReport, toHtmlBody, toHtmlDocument };

package/dist/{init-DIWDE35F.js → init-BjKYttxc.js}

@@ -1,6 +1,7 @@
-import { o as COUNTRIES, t as CONFIG_FILENAMES } from "./load-5wRGLvub.js";
+import { t as DEFAULT_FAIL_ON } from "./impact-luGCnN8F.js";
+import { s as COUNTRIES, t as CONFIG_FILENAMES } from "./load-vZdV_fD1.js";
 import { t as exists } from "./fs-BmPtmFke.js";
-import { i as note, o as warn, r as fail } from "./command-D8l_oYbV.js";
+import { l as warn, o as fail, s as note } from "./command-CZKp9Wi_.js";
 import { readFile, writeFile } from "node:fs/promises";
 import path from "node:path";
 import pc from "picocolors";
@@ -9,7 +10,11 @@ import { createInterface } from "node:readline/promises";
 const COUNTRY_LOCALES = {
 	AT: "de-AT",
 	DE: "de-DE",
-	CH: "de-CH"
+	CH: "de-CH",
+	ES: "es-ES",
+	FR: "fr-FR",
+	IT: "it-IT",
+	NL: "nl-NL"
 };
 /**
 * Everything the project already says about itself.
@@ -83,7 +88,8 @@ async function runInitCommand(options = {}) {
 			assessmentMethod: "self-assessment",
 			knownIssues: []
 		},
-		enforcement: { country }
+		enforcement: { country },
+		audit: { failOn: DEFAULT_FAIL_ON }
 	};
 	try {
 		await writeFile(target, `${JSON.stringify(config, null, 2)}\n`, "utf8");

package/dist/{jsdom-DCpGSLfW.js → jsdom-CQar6OQS.js}

@@ -1,10 +1,18 @@
-import { c as runOptions, i as failedPage, l as shapeResults, o as pageUrl, r as blindRulesInScope, t as DEFAULT_TAGS } from "./result-DoamKFsp.js";
+import { a as failedPage, i as blindRulesInScope, l as runOptions, n as DEFAULT_TAGS, s as pageUrl, t as DEFAULT_PAGE_TIMEOUT_MS, u as shapeResults } from "./result-DfUru6y_.js";
 import axe from "axe-core";
 import { Script } from "node:vm";
 import { JSDOM, VirtualConsole } from "jsdom";
 //#region src/audit/runners/jsdom.ts
-/** Per-page ceiling; one pathological document must not stall a CI run. */
-const DEFAULT_TIMEOUT_MS = 3e4;
+/**
+* Per-page ceiling.
+*
+* A soft one, and the limit is worth stating: this races axe-core against a
+* timer, so it only fires where the work yields to the event loop. Neither
+* jsdom's parse nor axe-core's walk of the tree does, so a document pathological
+* enough to hold the thread runs past this unimpeded. The hard ceiling is the
+* worker pool's, which terminates the thread; see the note on `runWorkers`.
+*/
+const DEFAULT_TIMEOUT_MS = DEFAULT_PAGE_TIMEOUT_MS;
 /**
 * Audit collected pages with axe-core inside jsdom.
 *
@@ -32,7 +40,7 @@ async function auditPage(page, options = {}) {
 		dom = createDom(page.html, url);
 		injectAxe(dom);
 		const { axe: pageAxe } = dom.window;
-		const results = await withTimeout(pageAxe.run(dom.window.document, runOptions(tags)), options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+		const results = await withTimeout(pageAxe.run(dom.window.document, runOptions(tags, { skipBlindRules: options.fast === true })), options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
 		return shapeResults(results, {
 			...identity,
 			durationMs: Date.now() - startedAt,

package/dist/jsdom-DMvU2h-f.js

@@ -0,0 +1,3 @@
+import "./result-DfUru6y_.js";
+import { n as runJsdomAudit } from "./jsdom-CQar6OQS.js";
+export { runJsdomAudit };

package/dist/{json-QQuFIw1W.js → json-HJDgJp09.js}

@@ -1,2 +1,2 @@
-import { r as serialiseJsonReport, t as buildJsonReport } from "./json-DjEvy1nX.js";
+import { r as serialiseJsonReport, t as buildJsonReport } from "./json-PNg6BeXp.js";
 export { buildJsonReport, serialiseJsonReport };

package/dist/{json-DjEvy1nX.js → json-PNg6BeXp.js}

@@ -1,8 +1,8 @@
-import { i as impactLabel, o as isImpactLevel, r as countAtOrAbove } from "./impact-DZt2oBCP.js";
+import { a as impactLabel, i as countAtOrAbove, s as isImpactLevel } from "./impact-luGCnN8F.js";
 import { t as TOOL_VERSION } from "./version-B3v4rNoG.js";
-import { t as elementFingerprint } from "./fingerprint-DRoneAjj.js";
-import { s as ruleOutcomes } from "./result-DoamKFsp.js";
-import { t as buildCoverage } from "./coverage-B4IBKMO8.js";
+import { t as elementFingerprint } from "./fingerprint-BjYV_0F7.js";
+import { c as runEngine, f as uniqueRuleOutcomes } from "./result-DfUru6y_.js";
+import { n as buildCoverage } from "./coverage-BD2_CYns.js";
 import axe from "axe-core";
 /**
 * Build the machine-readable report.
@@ -17,14 +17,14 @@ import axe from "axe-core";
 function buildJsonReport(audits, options) {
 	const generatedAt = (options.now ?? /* @__PURE__ */ new Date()).toISOString();
 	return {
-		schemaVersion: 1,
+		schemaVersion: 2,
 		tool: {
 			name: "eaa-kit",
 			version: TOOL_VERSION,
 			axeCore: axe.version
 		},
 		generatedAt,
-		engine: audits[0]?.engine ?? "jsdom",
+		engine: runEngine(audits),
 		target: {
 			source: options.directory,
 			kind: options.sourceKind ?? "directory",
@@ -33,24 +33,19 @@ function buildJsonReport(audits, options) {
 		},
 		summary: buildSummary(audits, options.failOn),
 		completeness: options.completeness,
-		coverage: buildCoverage(audits),
+		coverage: buildCoverage(audits, void 0, options.review),
 		rules: buildRuleIndex(audits),
 		pages: audits.map(toJsonPage)
 	};
 }
 /** Every rule mentioned by any page, keyed by id and sorted for stable diffs. */
 function buildRuleIndex(audits) {
-	const index = /* @__PURE__ */ new Map();
-	for (const audit of audits) for (const outcome of ruleOutcomes(audit)) {
-		if (index.has(outcome.ruleId)) continue;
-		index.set(outcome.ruleId, {
-			help: outcome.help,
-			helpUrl: outcome.helpUrl,
-			successCriteria: outcome.successCriteria,
-			en301549: outcome.enClauses
-		});
-	}
-	return Object.fromEntries([...index].sort(([a], [b]) => a.localeCompare(b)));
+	return Object.fromEntries(uniqueRuleOutcomes(audits).map((outcome) => [outcome.ruleId, {
+		help: outcome.help,
+		helpUrl: outcome.helpUrl,
+		successCriteria: outcome.successCriteria,
+		en301549: outcome.enClauses
+	}]));
 }
 /** Serialised form written to stdout or to --output, with a trailing newline. */
 function serialiseJsonReport(report) {

package/dist/load-Bc_xDGAh.js

@@ -0,0 +1,2 @@
+import { r as loadAuditConfig } from "./load-vZdV_fD1.js";
+export { loadAuditConfig };

package/dist/{load-5wRGLvub.js → load-vZdV_fD1.js}

@@ -1,4 +1,5 @@
-import { _ as url, a as isoDate, d as pipe, g as union, h as transform, i as enumeration, l as object, m as string, p as safeParse, r as email, t as array, u as optional, v as withDefault } from "./schema-is6CGX2D.js";
+import { n as IMPACT_LEVELS } from "./impact-luGCnN8F.js";
+import { _ as union, a as integer, d as optional, f as pipe, g as transform, h as string, i as enumeration, m as safeParse, n as boolean, o as isoDate, r as email, t as array, u as object, v as url, y as withDefault } from "./schema-DJSF4K05.js";
 import { r as isFile } from "./fs-BmPtmFke.js";
 import { readFile } from "node:fs/promises";
 import path from "node:path";
@@ -8,10 +9,28 @@ import { pathToFileURL } from "node:url";
 const COUNTRIES = [
 	"AT",
 	"DE",
-	"CH"
+	"CH",
+	"ES",
+	"FR",
+	"IT",
+	"NL"
+];
+/**
+* Languages a statement can be rendered in.
+*
+* Not every country has every one: a statement is a document under a particular
+* legal regime, not a translation of a document under another, so each country
+* has the language it is published in and English. `renderStatement` says which
+* ones a country has when asked for one it does not.
+*/
+const STATEMENT_LOCALES = [
+	"de",
+	"en",
+	"es",
+	"fr",
+	"it",
+	"nl"
 ];
-/** Languages a statement can be rendered in. */
-const STATEMENT_LOCALES = ["de", "en"];
 /**
 * Wording follows the EU model statement: fully, partially, or not conformant
 * with the standard. "partially-compliant" is the honest answer for most sites
@@ -50,6 +69,70 @@ const knownIssueObject = object({
 * rather than a union that callers have to narrow before reading `remedyBy`.
 */
 const knownIssueSchema = union([pipe(transform(string({ min: 1 }), (description) => ({ description })), knownIssueObject), knownIssueObject], "expected a description, or an object with one");
+/**
+* Defaults for `eaa-kit audit` and `eaa-kit baseline`, so a project says once
+* what every invocation would otherwise repeat.
+*
+* Every field is optional and every one is a default: a flag actually typed on
+* the command line wins, because the file is the project's usual answer and the
+* flag is somebody asking for something else right now.
+*
+* `baseline` reads the subset that means the same thing to it. `output`,
+* `format`, `failOn` and `baseline` are audit-only on purpose — a baseline
+* written to the report's path would overwrite the report, and a threshold for
+* failing a run means nothing to a command that records what it finds.
+*/
+const auditSchema = object({
+	/** Build directory. The positional argument wins over it. */
+	dir: optional(string({ min: 1 })),
+	include: optional(array(string({ min: 1 }))),
+	exclude: optional(array(string({ min: 1 }))),
+	/** Audit pages under their real site URL instead of file://. */
+	baseUrl: optional(url()),
+	/** Audit a running site instead of a directory. */
+	url: optional(url()),
+	/** Crawl a host that is not loopback. Off unless a project says otherwise. */
+	allowRemote: optional(boolean()),
+	ignoreRobots: optional(boolean()),
+	/** Where the site lists its pages, when that is not /sitemap.xml. */
+	sitemap: optional(string({ min: 1 })),
+	maxPages: optional(integer({ min: 1 })),
+	/** 0 audits the entry page alone. */
+	maxDepth: optional(integer({ min: 0 })),
+	/** Lowest impact that exits 1. */
+	failOn: optional(enumeration(IMPACT_LEVELS)),
+	format: optional(enumeration([
+		"console",
+		"json",
+		"sarif",
+		"html"
+	])),
+	/** Write the report here instead of stdout. */
+	output: optional(string({ min: 1 })),
+	/** Audit in real Chromium. Needs the playwright peer. */
+	browser: optional(boolean()),
+	/** Skip the rules the browserless engine cannot decide. No effect with `browser`. */
+	fast: optional(boolean()),
+	concurrency: optional(integer({ min: 1 })),
+	/** Path to a baseline; violations it accounts for do not fail the run. */
+	baseline: optional(string({ min: 1 })),
+	/** List every page and its result under the issues. */
+	perPage: optional(boolean()),
+	/** Print the manual check for each rule the engine could not evaluate. */
+	manual: optional(boolean()),
+	/** List every WCAG 2.2 A/AA criterion and what the run reached on it. */
+	coverage: optional(boolean()),
+	/** Path to a review record: what a person checked, for the criteria no engine reaches. */
+	review: optional(string({ min: 1 })),
+	/** Days after which a recorded review stops counting. */
+	reviewMaxAge: optional(integer({ min: 0 })),
+	/**
+	* False is `--no-build`: never run the project's build or start its server to
+	* find something to audit. Written in the positive because that is the state
+	* being described, and because a config file has no flags to negate.
+	*/
+	build: optional(boolean())
+});
 const configSchema = object({
 	site: object({
 		name: string({ min: 1 }),
@@ -91,9 +174,20 @@ const configSchema = object({
 	}),
 	enforcement: object({ 
 	/** Drives which supervisory body and statute the template names. */
-country: enumeration(COUNTRIES) })
+country: enumeration(COUNTRIES) }),
+	/** Defaults for the audit commands. Nothing here reaches the statement. */
+	audit: optional(auditSchema)
 });
 /**
+* The `audit` block on its own.
+*
+* A project that only wants audit defaults should not have to write a complete
+* statement config to get them, and `s.object` drops the keys it does not know,
+* so the same file satisfies both readers: `statement` demands the whole
+* document, `audit` reads this and ignores the rest.
+*/
+const auditConfigSchema = object({ audit: optional(auditSchema) });
+/**
 * Identity function that gives `eaa.config.ts` its types. Deliberately does not
 * validate: a config file is loaded and checked in one place, so that an error
 * points at the file rather than at wherever the module happened to be
@@ -112,7 +206,20 @@ var ConfigError = class extends Error {
 };
 /** Validate an already-loaded config object. */
 function parseConfig(value, source = "config") {
-	const result = safeParse(configSchema, value);
+	return parse(configSchema, value, source);
+}
+/**
+* Read only the `audit` block, ignoring whatever else the file holds.
+*
+* Returns undefined where there is no block, which is the common case: most
+* config files exist for the statement alone, and finding one is not a reason
+* to change how an audit runs.
+*/
+function parseAuditConfig(value, source = "config") {
+	return parse(auditConfigSchema, value, source).audit;
+}
+function parse(schema, value, source) {
+	const result = safeParse(schema, value);
 	if (result.success) return result.data;
 	const issues = result.error.issues.map((issue) => {
 		const path = issue.path.join(".");
@@ -145,10 +252,32 @@ async function loadConfig(options = {}) {
 	if (!file) throw new ConfigError(`No config file found in ${cwd} or its parent directories`, CONFIG_FILENAMES.map((name) => `looked for ${name}`));
 	if (!await isFile(file)) throw new ConfigError(`Config file not found: ${file}`);
 	return {
-		config: parseConfig(file.endsWith(".json") ? await importJson(file) : await importModule(file), path.basename(file)),
+		config: parseConfig(await readConfigFile(file), path.basename(file)),
+		path: file
+	};
+}
+/**
+* Find the config file and read its `audit` block, for the commands that take
+* defaults from it.
+*
+* Returns undefined when there is no config file at all. That is not an error
+* here as it is for `statement`: `eaa-kit audit` has always run against a
+* project that has never heard of a config file, and it must keep doing so. An
+* explicit path that is not there is still an error, because somebody named it.
+*/
+async function loadAuditConfig(options = {}) {
+	const cwd = path.resolve(options.cwd ?? process.cwd());
+	const file = options.path ? path.resolve(cwd, options.path) : await findConfigFile(cwd);
+	if (!file) return void 0;
+	if (!await isFile(file)) throw new ConfigError(`Config file not found: ${file}`);
+	return {
+		audit: parseAuditConfig(await readConfigFile(file), path.basename(file)),
 		path: file
 	};
 }
+function readConfigFile(file) {
+	return file.endsWith(".json") ? importJson(file) : importModule(file);
+}
 /** Walks up from `cwd`, so the CLI works from a subdirectory of the project. */
 async function findConfigFile(cwd) {
 	let directory = path.resolve(cwd);
@@ -183,4 +312,4 @@ async function importModule(file) {
 	return module.default;
 }
 //#endregion
-export { COMPLIANCE_STATUSES as a, ISSUE_REASONS as c, defineConfig as d, parseConfig as f, ASSESSMENT_METHODS as i, STATEMENT_LOCALES as l, findConfigFile as n, COUNTRIES as o, loadConfig as r, ConfigError as s, CONFIG_FILENAMES as t, configSchema as u };
+export { ASSESSMENT_METHODS as a, ConfigError as c, configSchema as d, defineConfig as f, loadConfig as i, ISSUE_REASONS as l, findConfigFile as n, COMPLIANCE_STATUSES as o, parseConfig as p, loadAuditConfig as r, COUNTRIES as s, CONFIG_FILENAMES as t, STATEMENT_LOCALES as u };

package/dist/nuxt/index.d.ts

@@ -1,4 +1,4 @@
-import { n as IntegrationOptions, t as BuildAuditError } from "../run-BMASMmwO.js";
+import { n as IntegrationOptions, t as BuildAuditError } from "../run-YiqyQA2b.js";
 //#region src/nuxt/index.d.ts
 /** The part of the Nitro instance this reads, handed over by `nitro:init`. */
 interface NitroLike {

package/dist/nuxt/index.js

@@ -1,4 +1,4 @@
-import { n as auditBuild, r as stderrLogger, t as BuildAuditError } from "../run-DB34BSOZ.js";
+import { n as auditBuild, r as stderrLogger, t as BuildAuditError } from "../run-D7hdVXLA.js";
 import path from "node:path";
 //#region src/nuxt/index.ts
 function eaaKitModule(options = {}, nuxt) {

package/dist/{playwright-BWniOain.js → playwright-C-miJP2b.js}

@@ -1,5 +1,5 @@
 import { r as isFile } from "./fs-BmPtmFke.js";
-import { c as runOptions, i as failedPage, l as shapeResults, o as pageUrl, t as DEFAULT_TAGS } from "./result-DoamKFsp.js";
+import { a as failedPage, l as runOptions, n as DEFAULT_TAGS, s as pageUrl, u as shapeResults } from "./result-DfUru6y_.js";
 import { createRequire } from "node:module";
 import { stat } from "node:fs/promises";
 import path from "node:path";
@@ -122,6 +122,21 @@ const DEFAULT_VIEWPORT = {
 	height: 720
 };
 /**
+* Pages open at once.
+*
+* This runner used to audit strictly one page at a time while the browserless
+* one had a whole measured worker pool — which had it backwards, since the
+* browser is the slow engine: it fetches the stylesheets and images a real
+* visitor would, and spends most of a page waiting on them rather than on the
+* CPU. Waiting on four at once is close to free.
+*
+* Four rather than more because each open page holds a document tree, its
+* decoded images and its own copy of axe-core, and Chromium's memory is the
+* limit here rather than cores. Past this the gain flattens and the cost does
+* not.
+*/
+const DEFAULT_CONCURRENCY = 4;
+/**
 * Audit a built site in real Chromium.
 *
 * This is the engine that can answer the rules jsdom is blind to: colour
@@ -150,13 +165,23 @@ async function runBrowserAudit(directory, pages, options = {}) {
 	try {
 		const context = await browser.newContext({
 			viewport,
-			bypassCSP: true
+			bypassCSP: true,
+			...options.headers === void 0 ? {} : { extraHTTPHeaders: options.headers }
 		});
-		const audits = [];
-		for (const page of pages) audits.push(await auditOne(context, server?.origin, page, {
-			tags,
-			timeout,
-			...options
+		const audits = Array.from({ length: pages.length });
+		const lanes = Math.max(1, Math.min(options.concurrency ?? DEFAULT_CONCURRENCY, pages.length));
+		let next = 0;
+		await Promise.all(Array.from({ length: lanes }, async () => {
+			while (true) {
+				const index = next;
+				if (index >= pages.length) return;
+				next += 1;
+				audits[index] = await auditOne(context, server?.origin, pages[index], {
+					tags,
+					timeout,
+					...options
+				});
+			}
 		}));
 		await context.close();
 		return audits;