eaa-kit 0.5.0 → 0.6.0

package/README.md

@@ -9,11 +9,18 @@ in the DACH region — the BFSG in Germany, the BaFG in Austria — and the stat
 the statute and supervisory body of **seven countries**: Austria, Germany, Switzerland,
 Spain, France, Italy and the Netherlands, each in its own language as well as English.
 
+0.6.0 adds the half no engine can do. Of the 55 WCAG 2.2 A and AA success criteria, 34 have
+no automated rule at all: `checklist` writes those down as a review somebody works through,
+`audit --review` reads the answers back beside what the run measured, and `statement` now
+refuses to publish a claim of full conformance that either one contradicts. Sites behind a
+login or a preview protection are auditable too.
+
 ```bash
 npx eaa-kit audit                 # WCAG 2.2 AA report; finds your build itself
 npx eaa-kit diff a.json b.json    # what a change made worse, and what it fixed
 npx eaa-kit init                  # write an eaa.config.json
 npx eaa-kit statement             # accessibility statement, in one of seven countries
+npx eaa-kit checklist             # the manual review no engine can do for you
 ```
 
 > **Not legal advice.** eaa-kit reports what an automated engine can and cannot determine
@@ -95,6 +102,17 @@ could invent a fix that looks right and is not.
     written in src/components/Header.astro:12
 ```
 
+**Records the part no engine can do.** 34 of the 55 criteria have no automated rule at
+all. `eaa-kit checklist` writes them out as a worksheet and a record; `audit --review`
+reads the record back and reports what a person checked *beside* what the run measured,
+never folded into it. A review never overrules the engine, never counts an entry nobody
+answered, and never counts one that has aged out.
+
+```bash
+eaa-kit checklist --output a11y-review.md
+eaa-kit audit --review eaa-review.json --coverage
+```
+
 **Says how much of WCAG it could reach.** WCAG 2.2 has 55 success criteria at Levels A and
 AA. axe-core has rules touching 23 of them. Every run says so, and `--coverage` lists all
 55 with what this run reached on each — never as a percentage, because most of WCAG cannot
@@ -133,6 +151,16 @@ that instead — following the site's own sitemap, wherever it keeps it.
 eaa-kit audit --url http://localhost:8000 --sitemap /sitemap_index.xml
 ```
 
+**Reaches a site behind a login.** A preview deployment or a staging CMS refuses anonymous
+requests, which used to put both out of reach. `--basic-auth` and a repeatable `--header`
+cover them, on the crawl and in the browser, and the credentials are never written into a
+report, a baseline or a SARIF log — nor accepted from `eaa.config`, which is a committed
+file.
+
+```bash
+eaa-kit audit --url https://preview.example.com --basic-auth user:password
+```
+
 ## Documentation
 
 | | |
@@ -143,6 +171,7 @@ eaa-kit audit --url http://localhost:8000 --sitemap /sitemap_index.xml
 | [Baselines](docs/baseline.md) | Adopting the tool on a site that already has violations |
 | [Comparing two runs](docs/reports.md#comparing-two-runs) | The `diff` command, and what it refuses to call fixed |
 | [Coverage of WCAG](docs/audit.md#how-much-of-wcag-a-run-reaches) | What an automated engine can reach at all, and what it cannot |
+| [Recording a manual review](docs/review.md) | The `checklist` command, the record, and what a review is not allowed to do |
 | [Report formats](docs/reports.md) | The JSON contract, SARIF, and the HTML report |
 | [Integrations](docs/integrations.md) | The build plugins, the GitHub Action, and the two builders that get a command instead |
 
@@ -169,11 +198,15 @@ you](docs/audit.md#what-the-browserless-engine-can-and-cannot-tell-you).
 
 The same applies to the statement: it says what you told it. eaa-kit cannot check whether
 those claims are true, and a statement claiming full conformance for a site that is not
-conformant is worse than no statement at all.
+conformant is worse than no statement at all — which is why, given evidence, it now refuses
+to write that particular one. `statement --audit` will not claim full conformance over a
+report listing barriers, and `--review` will not claim it over criteria somebody recorded as
+not met.
 
 ## Changelog
 
-See [CHANGELOG.md](CHANGELOG.md).
+See [CHANGELOG.md](CHANGELOG.md), and [ROADMAP.md](ROADMAP.md) for what 0.6.0 is meant to
+add and what it deliberately will not.
 
 ## License
 

package/dist/astro/index.d.ts

@@ -1,4 +1,4 @@
-import { n as IntegrationOptions } from "../run-CtcEUhbe.js";
+import { n as IntegrationOptions } from "../run-YiqyQA2b.js";
 //#region src/astro/index.d.ts
 /**
  * An Astro integration that audits the build Astro just produced.

package/dist/astro/index.js

@@ -1,4 +1,4 @@
-import { n as auditBuild, t as BuildAuditError } from "../run-C2nKFcb-.js";
+import { n as auditBuild, t as BuildAuditError } from "../run-D7hdVXLA.js";
 import { fileURLToPath } from "node:url";
 //#region src/astro/index.ts
 var AstroAuditError = class extends Error {

package/dist/audit/runners/worker.js

@@ -1,4 +1,4 @@
-import { t as auditPage } from "../../jsdom-B--cEH-G.js";
+import { t as auditPage } from "../../jsdom-CQar6OQS.js";
 import { enableCompileCache } from "node:module";
 import { parentPort, workerData } from "node:worker_threads";
 //#region src/audit/runners/worker.ts

package/dist/audit-DK2StT1_.js

@@ -0,0 +1,2 @@
+import { n as runAuditCommand } from "./audit-e_uixhPG.js";
+export { runAuditCommand };

package/dist/{audit-B282A3EA.js → audit-e_uixhPG.js}

@@ -1,9 +1,12 @@
-import { a as impactRank, i as impactLabel, r as countAtOrAbove } from "./impact-DZt2oBCP.js";
-import { a as plural, n as count, t as collapse } from "./text-CKKpzkYM.js";
-import { a as isShared, c as runCompleteness, i as groupIssues, n as blindRules, r as coverageParts, t as remediationFor } from "./remediation-CMBIrnpN.js";
-import { r as componentPath } from "./component-C3GL1Mnu.js";
-import { i as understandingUrl, n as coverageSummary, r as manualCheckFor, t as buildCoverage } from "./coverage-B_Y6l-Ra.js";
-import { a as emitDocument, c as runEngine, l as warn, o as fail, s as note, t as advise } from "./command-C3D7JWn6.js";
+import { a as impactLabel, i as countAtOrAbove, r as byImpactThenRule } from "./impact-luGCnN8F.js";
+import { n as count, o as plural, t as collapse } from "./text-BF1LHMiV.js";
+import { c as runEngine } from "./result-DfUru6y_.js";
+import { a as emitDocument, c as runEngine$1, l as warn, o as fail, s as note, t as advise } from "./command-CZKp9Wi_.js";
+import { l as reviewSentence } from "./review-CdMK2GpQ.js";
+import { r as componentPath } from "./component-ChisoFyY.js";
+import { i as reviewSummary, n as buildCoverage, o as manualCheckFor, r as coverageSummary, s as understandingUrl } from "./coverage-BD2_CYns.js";
+import { a as blindRules, c as isShared, i as remediationFor, l as issueTotals, o as coverageParts, r as runCompleteness, s as groupIssues } from "./completeness-Dwq3CPB3.js";
+import { n as buildSummary } from "./json-PNg6BeXp.js";
 import { i as holdsHtml, n as collectPages, r as emptyDirectoryHint, t as BuildDirectoryError } from "./collect-Cu1q9NTB.js";
 import path from "node:path";
 import pc from "picocolors";
@@ -51,6 +54,7 @@ function context(options) {
 		manual: options.manual ?? false,
 		coverage: options.coverage ?? false,
 		framework: options.framework,
+		review: options.review,
 		completeness: options.completeness,
 		c,
 		symbol: (kind) => {
@@ -92,7 +96,7 @@ function line(ctx, text, paint) {
 	}]);
 }
 function headerLines(audits, ctx) {
-	const engineLabel = (audits[0]?.engine ?? "jsdom") === "browser" ? "chromium" : "jsdom (browserless)";
+	const engineLabel = runEngine(audits) === "browser" ? "chromium" : "jsdom (browserless)";
 	return [render(ctx, [{
 		text: "eaa-kit audit",
 		paint: ctx.c.bold
@@ -120,7 +124,7 @@ function pageSection(audit, ctx) {
 		}, { text: audit.error }]), "");
 		return lines;
 	}
-	for (const finding of sortByImpact(audit.violations)) lines.push(...violationLines(finding, ctx));
+	for (const finding of [...audit.violations].sort(byImpactThenRule)) lines.push(...violationLines(finding, ctx));
 	for (const finding of audit.incomplete.filter((item) => item.reason === "needs-review")) lines.push(render(ctx, [
 		{
 			text: `  ${ctx.symbol("review")} `,
@@ -145,7 +149,7 @@ function pageSection(audit, ctx) {
 			paint: clean ? ctx.c.green : ctx.c.dim
 		}]));
 	}
-	for (const finding of sortByImpact(audit.accepted ?? [])) {
+	for (const finding of [...audit.accepted ?? []].sort(byImpactThenRule)) {
 		const elements = count(finding.nodes.length, "element");
 		lines.push(line(ctx, `  · ${finding.ruleId} accepted by the baseline (${elements})`, ctx.c.dim));
 	}
@@ -157,7 +161,7 @@ function coverageLine(audit, ctx) {
 	return line(ctx, `    ${coverageParts(audit).join(" · ")}`, ctx.c.dim);
 }
 function violationLines(finding, ctx) {
-	const impact = finding.impact ?? "unknown";
+	const impact = impactLabel(finding.impact);
 	const lines = [render(ctx, [
 		{
 			text: `  ${ctx.symbol("violation")} `,
@@ -181,35 +185,31 @@ function violationLines(finding, ctx) {
 	return lines;
 }
 function summary(audits, ctx) {
-	const withViolations = audits.filter((audit) => audit.violations.length > 0);
-	const errored = audits.filter((audit) => audit.error);
-	const ruleCount = audits.reduce((total, audit) => total + audit.violations.length, 0);
-	const elementCount = audits.reduce((total, audit) => total + audit.violations.reduce((sum, finding) => sum + finding.nodes.length, 0), 0);
+	const totals = buildSummary(audits, ctx.failOn);
 	const reviewCount = countRules(audits, "needs-review");
 	const pages = count(audits.length, "page");
-	const audited = audits.length - errored.length;
+	const audited = totals.pages - totals.pagesNotAudited;
 	const lines = [line(ctx, "Summary", ctx.c.bold), ...completenessLines(ctx)];
-	if (ruleCount === 0 && audited === 0 && errored.length > 0) lines.push(line(ctx, "  Nothing was audited: no page could be read.", ctx.c.red));
-	else if (ruleCount === 0) {
-		const clean = errored.length > 0 || ctx.completeness && !ctx.completeness.complete ? `  No violations across the ${count(audited, "page")} that were audited.` : `  No violations across ${pages}.`;
+	if (totals.violations === 0 && audited === 0 && totals.pagesNotAudited > 0) lines.push(line(ctx, "  Nothing was audited: no page could be read.", ctx.c.red));
+	else if (totals.violations === 0) {
+		const clean = totals.pagesNotAudited > 0 || ctx.completeness && !ctx.completeness.complete ? `  No violations across the ${count(audited, "page")} that were audited.` : `  No violations across ${pages}.`;
 		lines.push(line(ctx, clean, ctx.c.green));
 	} else {
 		lines.push(render(ctx, [{
-			text: `  ${count(ruleCount, "violation")} on ${withViolations.length} of ${count(audited, "page")}`,
+			text: `  ${count(totals.violations, "violation")} on ${totals.pagesWithViolations} of ${count(audited, "page")}`,
 			paint: ctx.c.red
 		}, {
-			text: ` (${count(elementCount, "element")})`,
+			text: ` (${count(totals.violatingElements, "element")})`,
 			paint: ctx.c.dim
 		}]));
-		lines.push(thresholdLine(audits, ctx));
+		lines.push(thresholdLine(totals.failing, ctx));
 	}
 	if (reviewCount > 0) {
 		const verb = reviewCount === 1 ? "needs" : "need";
 		lines.push(line(ctx, `  ${count(reviewCount, "rule")} ${verb} manual review`, ctx.c.yellow));
 	}
-	if (errored.length > 0) lines.push(line(ctx, `  ${count(errored.length, "page")} could not be audited`, ctx.c.red));
-	const accepted = audits.reduce((total, audit) => total + (audit.accepted ?? []).reduce((sum, finding) => sum + finding.nodes.length, 0), 0);
-	if (accepted > 0) lines.push(line(ctx, `  ${count(accepted, "element")} accepted by the baseline, not counted above`, ctx.c.dim));
+	if (totals.pagesNotAudited > 0) lines.push(line(ctx, `  ${count(totals.pagesNotAudited, "page")} could not be audited`, ctx.c.red));
+	if (totals.accepted > 0) lines.push(line(ctx, `  ${count(totals.accepted, "element")} accepted by the baseline, not counted above`, ctx.c.dim));
 	lines.push(...blindSection(audits, ctx));
 	lines.push(...coverageSection(audits, ctx));
 	return lines;
@@ -223,12 +223,14 @@ function summary(audits, ctx) {
 * it could be read as boilerplate.
 */
 function coverageSection(audits, ctx) {
-	const coverage = buildCoverage(audits);
+	const coverage = buildCoverage(audits, void 0, ctx.review);
 	const lines = ["", ...wrap(coverageSummary(coverage), ctx.width - 2).map((text) => line(ctx, `  ${text}`, ctx.c.dim))];
 	if (coverage.browserWouldAnswer > 0) {
 		const verb = coverage.browserWouldAnswer === 1 ? "criterion" : "criteria";
 		lines.push(line(ctx, `  --browser would answer ${coverage.browserWouldAnswer} more ${verb}.`, ctx.c.dim));
 	}
+	const review = reviewSummary(coverage);
+	if (review !== void 0) lines.push(...wrap(review, ctx.width - 2).map((text) => line(ctx, `  ${text}`, ctx.c.dim)));
 	if (!ctx.coverage) {
 		lines.push(line(ctx, "  Run with --coverage for the criterion-by-criterion breakdown.", ctx.c.dim));
 		return lines;
@@ -248,6 +250,8 @@ function coverageSection(audits, ctx) {
 				paint
 			}
 		]));
+		const recorded = criterion.review;
+		if (recorded !== void 0) lines.push(line(ctx, `        ${reviewSentence(recorded)}`, ctx.c.dim));
 	}
 	return lines;
 }
@@ -285,9 +289,8 @@ function completenessLines(ctx) {
 * Why the run passed or failed. Without this, a build that exits 0 while the
 * report lists violations looks like a bug rather than a threshold choice.
 */
-function thresholdLine(audits, ctx) {
+function thresholdLine(failing, ctx) {
 	const failOn = ctx.failOn;
-	const failing = countAtOrAbove(audits, failOn);
 	if (failing === 0) return line(ctx, `  none at or above ${failOn} (--fail-on ${failOn}), so this run passes`, ctx.c.green);
 	return line(ctx, `  ${failing} at or above ${failOn} (--fail-on ${failOn})`, ctx.c.red);
 }
@@ -332,9 +335,6 @@ function countRules(audits, reason) {
 	for (const audit of audits) for (const finding of audit.incomplete) if (finding.reason === reason) ruleIds.add(finding.ruleId);
 	return ruleIds.size;
 }
-function sortByImpact(findings) {
-	return [...findings].sort((a, b) => impactRank(a.impact) - impactRank(b.impact) || a.ruleId.localeCompare(b.ruleId));
-}
 function criteria(finding) {
 	return finding.successCriteria.length > 0 ? `, WCAG ${finding.successCriteria.join(" ")}` : "";
 }
@@ -350,8 +350,7 @@ function criteria(finding) {
 function issuesSection(audits, ctx) {
 	const issues = groupIssues(audits);
 	if (issues.length === 0) return [];
-	const elements = issues.reduce((total, issue) => total + issue.elements.length, 0);
-	const occurrences = issues.reduce((total, issue) => total + issue.occurrences, 0);
+	const { elements, occurrences } = issueTotals(issues);
 	const lines = [line(ctx, "Issues", ctx.c.bold)];
 	const intro = occurrences === elements ? `  ${count(elements, "distinct element")} to fix.` : `  ${count(occurrences, "violation")} across the site come from ${count(elements, "distinct element")}.`;
 	lines.push(line(ctx, intro, ctx.c.dim));
@@ -522,7 +521,7 @@ async function resolvePages(directory, options = {}) {
 * exit 2 — a run that reached no verdict, not a clean one.
 */
 async function crawlPages(url, options) {
-	const { crawlSite, CrawlError, parseEntryUrl } = await import("./crawl-BUWPgaGW.js");
+	const { collapsedOnto, crawlSite, CrawlError, parseEntryUrl } = await import("./crawl-BHkJmUkA.js");
 	let entry;
 	try {
 		entry = parseEntryUrl(url, options.allowRemote ?? false);
@@ -540,7 +539,8 @@ async function crawlPages(url, options) {
 		...options.sitemap === void 0 ? {} : { sitemap: options.sitemap },
 		...options.maxPages === void 0 ? {} : { maxPages: options.maxPages },
 		...options.maxDepth === void 0 ? {} : { maxDepth: options.maxDepth },
-		...options.timeoutMs === void 0 ? {} : { timeoutMs: options.timeoutMs }
+		...options.timeoutMs === void 0 ? {} : { timeoutMs: options.timeoutMs },
+		...options.headers === void 0 ? {} : { headers: options.headers }
 	});
 	if (result.pages.length === 0 && result.failures.length > 0) {
 		fail(`Could not fetch ${entry.href} (${result.failures[0]?.reason})`);
@@ -556,16 +556,26 @@ async function crawlPages(url, options) {
 		if (result.failures.length > 10) note(`  …and ${result.failures.length - 10} more`);
 	}
 	if (result.truncated) warn(`Stopped at ${count(result.pages.length, "page")}; the site has more. Raise --max-pages to go further.`);
+	const collapsed = collapsedOnto(result);
+	if (collapsed.length > 0) {
+		const landedOn = collapsed[0]?.landedOn ?? "";
+		warn(`Every page requested answered at ${landedOn}, which is not where it was asked.`);
+		note("  A sign-in page in front of the site looks like this.");
+		note("  If it is behind one, pass --basic-auth user:password or --header \"Cookie: …\".");
+	}
 	return {
 		pages: result.pages,
 		origin: result.origin,
 		completeness: {
 			discovery: result.discovery,
 			collected: result.pages.length,
-			unreachable: result.failures.map((failure) => ({
+			unreachable: [...result.failures.map((failure) => ({
 				location: failure.url,
 				reason: failure.reason
-			})),
+			})), ...collapsed.map((redirect) => ({
+				location: redirect.requested,
+				reason: `answered at ${redirect.landedOn} instead, so this page was not audited`
+			}))],
 			truncated: result.truncated
 		}
 	};
@@ -627,11 +637,13 @@ async function runAuditCommand(dir, options = {}) {
 		exitCode: 2
 	};
 	const { pages, origin, label, cleanup, directory, completeness: collection } = resolved;
+	if (options.headers !== void 0 && directory !== void 0 && !options.browser) warn("--header and --basic-auth apply to pages that are fetched; this run read files.");
 	try {
 		note(`Auditing ${count(pages.length, "page")} in ${label}${await describeEngine(pages, options)}…`);
 		const baseUrl = options.baseUrl ?? origin;
-		let audits = await runEngine(pages, {
+		let audits = await runEngine$1(pages, {
 			cwd: options.cwd ?? process.cwd(),
+			...options.headers === void 0 ? {} : { headers: options.headers },
 			...baseUrl === void 0 ? {} : { baseUrl },
 			...options.timeoutMs === void 0 ? {} : { timeoutMs: options.timeoutMs },
 			...options.browser ? { browser: true } : {},
@@ -653,7 +665,12 @@ async function runAuditCommand(dir, options = {}) {
 			audits = applied;
 		}
 		const completeness = runCompleteness(audits, collection);
-		await emit(audits, label, failOn, completeness, options);
+		const review = await loadReview(options);
+		if (review === FAILED) return {
+			audits,
+			exitCode: 2
+		};
+		await emit(audits, label, failOn, completeness, options, review);
 		const unaudited = audits.filter((audit) => audit.error);
 		if (unaudited.length > 0) {
 			fail(`${unaudited.length} of ${audits.length} pages could not be audited`);
@@ -679,7 +696,7 @@ async function runAuditCommand(dir, options = {}) {
 * would be as wrong as silently passing.
 */
 async function acceptBaseline(audits, options) {
-	const { applyBaseline, BaselineError, readBaseline } = await import("./baseline-0u4df12v.js");
+	const { applyBaseline, BaselineError, readBaseline } = await import("./baseline-BscHfFSW.js");
 	try {
 		const outcome = applyBaseline(audits, await readBaseline(options.baseline, options.cwd ?? process.cwd()));
 		if (outcome.accepted > 0) note(`Baseline accepted ${outcome.accepted} violating elements`);
@@ -697,6 +714,32 @@ async function acceptBaseline(audits, options) {
 		throw cause;
 	}
 }
+/** Distinguishes "no review asked for" from "the review could not be read". */
+const FAILED = Symbol("review-failed");
+/**
+* Read the review record, when one was asked for.
+*
+* Returns undefined when no `--review` was given, which is the ordinary case,
+* and the sentinel when one was given and could not be read.
+*/
+async function loadReview(options) {
+	if (options.review === void 0) return void 0;
+	const { answeredCount, readReview, ReviewError } = await import("./review-DIbOTmOM.js");
+	try {
+		const record = await readReview(options.review, options.cwd ?? process.cwd());
+		note(`Review record: ${count(answeredCount(record), "criterion")} answered`);
+		return {
+			record,
+			...options.reviewMaxAge === void 0 ? {} : { maxAgeDays: options.reviewMaxAge }
+		};
+	} catch (cause) {
+		if (cause instanceof ReviewError) {
+			fail(cause.message);
+			return FAILED;
+		}
+		throw cause;
+	}
+}
 /**
 * What the progress line says about the engine.
 *
@@ -706,7 +749,7 @@ async function acceptBaseline(audits, options) {
 */
 async function describeEngine(pages, options) {
 	if (options.browser) return " with Chromium";
-	const { plannedWorkers } = await import("./pool-BO25OIez.js");
+	const { plannedWorkers } = await import("./pool-dkexq5xo.js");
 	const workers = options.concurrency ?? plannedWorkers(pages);
 	const threads = workers > 1 ? ` across ${workers} threads` : "";
 	return options.fast ? `${threads}, skipping what this engine cannot decide` : threads;
@@ -716,38 +759,41 @@ async function describeEngine(pages, options) {
 * otherwise. Colour is dropped when writing to a file, since escape codes in a
 * saved report are noise.
 */
-async function emit(audits, dir, failOn, completeness, options) {
-	const body = await renderReport(audits, dir, failOn, completeness, options.format ?? "console", typeof options.output === "string", options);
+async function emit(audits, dir, failOn, completeness, options, review) {
+	const body = await renderReport(audits, dir, failOn, completeness, options.format ?? "console", typeof options.output === "string", options, review);
 	await emitDocument(body, options.output, options.cwd ?? process.cwd());
 	if (options.output !== void 0) note(`Report written to ${options.output}`);
 }
-async function renderReport(audits, dir, failOn, completeness, format, toFile, options) {
+async function renderReport(audits, dir, failOn, completeness, format, toFile, options, review) {
 	switch (format) {
 		case "json": {
-			const { buildJsonReport, serialiseJsonReport } = await import("./json-D_Mnnft5.js");
+			const { buildJsonReport, serialiseJsonReport } = await import("./json-HJDgJp09.js");
 			return serialiseJsonReport(buildJsonReport(audits, {
 				directory: dir,
 				...options.url === void 0 ? {} : { sourceKind: "url" },
 				failOn,
 				completeness,
+				...review === void 0 ? {} : { review },
 				...options.baseUrl ? { baseUrl: options.baseUrl } : {}
 			}));
 		}
 		case "sarif": {
-			const { buildSarifReport, serialiseSarifReport } = await import("./sarif-B-UBcVu8.js");
+			const { buildSarifReport, serialiseSarifReport } = await import("./sarif-BKvq_AUm.js");
 			return serialiseSarifReport(buildSarifReport(audits, {
 				directory: dir,
-				completeness
+				completeness,
+				...review === void 0 ? {} : { review }
 			}));
 		}
 		case "html": {
-			const { buildHtmlReport } = await import("./html-C4vktg0A.js");
+			const { buildHtmlReport } = await import("./html-Bmh7X_sM.js");
 			const framework = await detectedFramework(options.cwd ?? process.cwd());
 			return buildHtmlReport(audits, {
 				...await sourceLookups(options.cwd ?? process.cwd(), audits),
 				directory: dir,
 				failOn,
 				completeness,
+				...review === void 0 ? {} : { review },
 				...framework === void 0 ? {} : { framework },
 				...options.baseUrl ? { baseUrl: options.baseUrl } : {}
 			});
@@ -759,6 +805,7 @@ async function renderReport(audits, dir, failOn, completeness, format, toFile, o
 				dir,
 				failOn,
 				completeness,
+				...review === void 0 ? {} : { review },
 				...options.perPage ? { perPage: true } : {},
 				...options.manual ? { manual: true } : {},
 				...options.coverage ? { coverage: true } : {},
@@ -786,7 +833,7 @@ async function sourceLookups(cwd, audits) {
 		sourceFor: (page) => sourceFor(routes, page),
 		componentFor: () => void 0
 	};
-	const { buildComponentIndex, componentFor } = await import("./component-DKd3EHOg.js");
+	const { buildComponentIndex, componentFor } = await import("./component-DcCn3BJS.js");
 	const components = await buildComponentIndex(cwd);
 	return {
 		sourceFor: (page) => sourceFor(routes, page),

package/dist/baseline-BscHfFSW.js

@@ -0,0 +1,2 @@
+import { o as readBaseline, r as applyBaseline, t as BaselineError } from "./baseline-D2qWmUC6.js";
+export { BaselineError, applyBaseline, readBaseline };

package/dist/{baseline-CuAS2lMk.js → baseline-D2qWmUC6.js}

@@ -1,6 +1,7 @@
-import { c as nullable, d as optional, h as string, l as number, m as safeParse, o as isoDate$1, t as array, u as object, y as withDefault } from "./schema-DJSF4K05.js";
+import { c as nullable, d as optional, h as string, l as number, m as safeParse, o as isoDate, t as array, u as object, y as withDefault } from "./schema-DJSF4K05.js";
+import { a as isoDate$1 } from "./text-BF1LHMiV.js";
 import { t as elementFingerprint } from "./fingerprint-BjYV_0F7.js";
-import { o as findingElements } from "./result-BWcYXeRs.js";
+import { o as findingElements } from "./result-DfUru6y_.js";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import path from "node:path";
 /** Default filename, used by the CLI when no path is given. */
@@ -18,7 +19,7 @@ const entrySchema = object({
 	/** ISO date the entry was written. */
 	acceptedOn: withDefault(string(), () => ""),
 	/** ISO date after which this entry stops suppressing anything. */
-	expiresOn: optional(isoDate$1()),
+	expiresOn: optional(isoDate()),
 	/** Why this is being lived with. Free text, for whoever reads the file. */
 	note: optional(string())
 });
@@ -37,7 +38,7 @@ var BaselineError = class extends Error {
 * can still report on what the run actually found.
 */
 function applyBaseline(audits, baseline, options = {}) {
-	const today = isoDate(options.today ?? /* @__PURE__ */ new Date());
+	const today = isoDate$1(options.today ?? /* @__PURE__ */ new Date());
 	const expired = [];
 	const live = /* @__PURE__ */ new Map();
 	for (const entry of baseline.entries) if (entry.expiresOn !== void 0 && entry.expiresOn < today) expired.push(entry);
@@ -93,9 +94,38 @@ function applyBaseline(audits, baseline, options = {}) {
 		accepted
 	};
 }
+/**
+* The baseline without the entries this run showed are gone.
+*
+* `applyBaseline` already decides which those are, and does it carefully: an
+* entry counts as stale only when the page it names was audited and the element
+* was not found. Entries for pages a narrowed run never looked at are not stale
+* and are kept here, because from the outside a page nobody audited and a page
+* that no longer exists are the same thing, and guessing wrong empties the file
+* that is holding the rest of the site's build together.
+*
+* Nothing is added. That is the whole difference between this and recording a
+* baseline again: re-recording accepts whatever the site is failing today,
+* which on a bad day is a new barrier nobody agreed to.
+*/
+function pruneBaseline(baseline, stale) {
+	const gone = new Set(stale.map((entry) => key(entry.page, entry.ruleId, entry.fingerprint)));
+	if (gone.size === 0) return {
+		baseline,
+		removed: []
+	};
+	const kept = baseline.entries.filter((entry) => !gone.has(key(entry.page, entry.ruleId, entry.fingerprint)));
+	return {
+		baseline: {
+			...baseline,
+			entries: kept
+		},
+		removed: baseline.entries.filter((entry) => gone.has(key(entry.page, entry.ruleId, entry.fingerprint)))
+	};
+}
 /** Record every violation a run found, so a later run can fail only on new ones. */
 function buildBaseline(audits, options = {}) {
-	const acceptedOn = isoDate(options.today ?? /* @__PURE__ */ new Date());
+	const acceptedOn = isoDate$1(options.today ?? /* @__PURE__ */ new Date());
 	const entries = [];
 	for (const audit of audits) for (const finding of audit.violations) for (const node of findingElements(finding)) entries.push({
 		page: audit.relativePath,
@@ -153,8 +183,5 @@ function key(page, ruleId, fingerprint) {
 function byEntry(a, b) {
 	return a.page.localeCompare(b.page) || a.ruleId.localeCompare(b.ruleId) || a.fingerprint.localeCompare(b.fingerprint);
 }
-function isoDate(date) {
-	return date.toISOString().slice(0, 10);
-}
 //#endregion
-export { readBaseline as a, buildBaseline as i, DEFAULT_BASELINE_FILE as n, serialiseBaseline as o, applyBaseline as r, writeBaseline as s, BaselineError as t };
+export { pruneBaseline as a, writeBaseline as c, buildBaseline as i, DEFAULT_BASELINE_FILE as n, readBaseline as o, applyBaseline as r, serialiseBaseline as s, BaselineError as t };

package/dist/checklist-BtgkxMEa.js

@@ -0,0 +1,44 @@
+import { n as count } from "./text-BF1LHMiV.js";
+import { a as emitDocument, o as fail, s as note } from "./command-CZKp9Wi_.js";
+import "./review-CdMK2GpQ.js";
+import { access } from "node:fs/promises";
+import path from "node:path";
+//#region src/cli/checklist.ts
+async function runChecklistCommand(options = {}) {
+	const cwd = options.cwd ?? process.cwd();
+	const recordPath = options.record ?? "eaa-review.json";
+	const { WCAG22_AA_CRITERIA } = await import("./coverage-7bQqWNfN.js");
+	const { answeredCount, blankReview, readReview, ReviewError, writeReview } = await import("./review-DIbOTmOM.js");
+	let existing;
+	try {
+		existing = await readReview(recordPath, cwd);
+	} catch (cause) {
+		if (!(cause instanceof ReviewError)) throw cause;
+		if (await exists(path.resolve(cwd, recordPath))) {
+			fail(cause.message);
+			return { exitCode: 2 };
+		}
+	}
+	const record = blankReview(WCAG22_AA_CRITERIA, existing);
+	if (options.reviewedBy !== void 0) record.reviewedBy = options.reviewedBy;
+	await writeReview(recordPath, record, cwd);
+	note(existing === void 0 ? `Review record written to ${recordPath}` : `Review record updated at ${recordPath}: ${count(answeredCount(record), "criterion")} already answered`);
+	const { buildWorksheet } = await import("./worksheet-eUjwYLxC.js");
+	await emitDocument(buildWorksheet({
+		recordPath,
+		review: record
+	}), options.output, cwd);
+	if (options.output !== void 0) note(`Worksheet written to ${options.output}`);
+	note("Answers go in the record; the worksheet is generated and never read back.");
+	return { exitCode: 0 };
+}
+async function exists(target) {
+	try {
+		await access(target);
+		return true;
+	} catch {
+		return false;
+	}
+}
+//#endregion
+export { runChecklistCommand };