eaa-kit 0.5.0 → 0.6.0

package/dist/cli/index.js

@@ -1,14 +1,15 @@
 #!/usr/bin/env node
-import { a as impactRank, n as IMPACT_LEVELS, o as isImpactLevel, s as meetsThreshold, t as DEFAULT_FAIL_ON } from "../impact-DZt2oBCP.js";
+import { c as meetsThreshold, n as IMPACT_LEVELS, o as impactRank, s as isImpactLevel, t as DEFAULT_FAIL_ON } from "../impact-luGCnN8F.js";
 import { c as nullable, d as optional, h as string, l as number, m as safeParse, n as boolean, p as record, t as array, u as object, y as withDefault } from "../schema-DJSF4K05.js";
-import { c as ConfigError, i as loadConfig, s as COUNTRIES, u as STATEMENT_LOCALES } from "../load-yAR4wzez.js";
-import { i as readAuditReport, o as StatementError, t as renderStatement } from "../render-DbGOVmhx.js";
-import { n as count, t as collapse } from "../text-CKKpzkYM.js";
+import { c as ConfigError, i as loadConfig, s as COUNTRIES, u as STATEMENT_LOCALES } from "../load-vZdV_fD1.js";
+import { c as StatementError, i as readAuditReport, o as checkStatementEvidence, s as refuses, t as renderStatement } from "../render-CtsqR0k-.js";
+import { n as count, t as collapse } from "../text-BF1LHMiV.js";
 import { t as TOOL_VERSION } from "../version-B3v4rNoG.js";
 import { t as elementFingerprint } from "../fingerprint-BjYV_0F7.js";
-import { i as buildBaseline, n as DEFAULT_BASELINE_FILE, s as writeBaseline, t as BaselineError } from "../baseline-CuAS2lMk.js";
-import { n as runAuditCommand, r as resolvePages, t as OUTPUT_FORMATS } from "../audit-B282A3EA.js";
-import { a as emitDocument, c as runEngine, i as baselineInvocation, l as warn, n as auditDefaults, o as fail, r as auditInvocation, s as note, t as advise } from "../command-C3D7JWn6.js";
+import { a as pruneBaseline, c as writeBaseline, i as buildBaseline, n as DEFAULT_BASELINE_FILE, o as readBaseline, r as applyBaseline, t as BaselineError } from "../baseline-D2qWmUC6.js";
+import { a as emitDocument, c as runEngine, d as parseHeader, i as baselineInvocation, l as warn, n as auditDefaults, o as fail, r as auditInvocation, s as note, t as advise, u as basicAuth } from "../command-CZKp9Wi_.js";
+import { t as DEFAULT_REVIEW_FILE } from "../review-CdMK2GpQ.js";
+import { n as runAuditCommand, r as resolvePages, t as OUTPUT_FORMATS } from "../audit-e_uixhPG.js";
 import { enableCompileCache } from "node:module";
 import { readFile } from "node:fs/promises";
 import path from "node:path";
@@ -42,6 +43,7 @@ async function runBaselineCommand(dir, options = {}) {
 	const baseUrl = options.baseUrl ?? origin;
 	const audits = await runEngine(pages, {
 		cwd,
+		...options.headers === void 0 ? {} : { headers: options.headers },
 		...baseUrl === void 0 ? {} : { baseUrl },
 		...options.timeoutMs === void 0 ? {} : { timeoutMs: options.timeoutMs },
 		...options.browser ? { browser: true } : {},
@@ -60,11 +62,12 @@ async function runBaselineCommand(dir, options = {}) {
 			exitCode: 2
 		};
 	}
+	const target = options.output ?? "eaa-baseline.json";
+	if (options.prune) return await prune(audits, target, cwd);
 	const baseline = buildBaseline(audits, {
 		...options.note ? { note: options.note } : {},
 		...options.expiresOn ? { expiresOn: options.expiresOn } : {}
 	});
-	const target = options.output ?? "eaa-baseline.json";
 	try {
 		await writeBaseline(target, baseline, cwd);
 	} catch (cause) {
@@ -78,13 +81,60 @@ async function runBaselineCommand(dir, options = {}) {
 		throw cause;
 	}
 	const entries = baseline.entries.length;
-	note(`Wrote ${entries} ${entries === 1 ? "entry" : "entries"} to ${target}`);
+	note(`Wrote ${count(entries, "entry")} to ${target}`);
 	if (entries > 0) advise("These are barriers, not exceptions. Commit the file, then work the list down.");
 	return {
 		entries,
 		exitCode: 0
 	};
 }
+/**
+* `--prune`: take out what this run shows is gone, and add nothing.
+*
+* The audit already tells anybody running it that entries no longer match and
+* can be removed. Acting on that advice meant editing JSON by hand, entry by
+* entry, against a file whose whole purpose is that nobody has to remember what
+* is in it — so most people did not, and a baseline accumulated barriers that
+* were fixed years ago while looking exactly like one that had not been read.
+*
+* Recording a new baseline is not the same operation and is not a substitute:
+* it accepts whatever the site fails today, which on a bad day quietly adopts a
+* barrier nobody agreed to.
+*/
+async function prune(audits, target, cwd) {
+	let existing;
+	try {
+		existing = await readBaseline(target, cwd);
+	} catch (cause) {
+		if (cause instanceof BaselineError) {
+			fail(cause.message);
+			return {
+				entries: 0,
+				exitCode: 2
+			};
+		}
+		throw cause;
+	}
+	const outcome = applyBaseline(audits, existing);
+	const { baseline, removed } = pruneBaseline(existing, outcome.stale);
+	if (removed.length === 0) {
+		note(`Nothing to remove from ${target}: every entry still matches something on this run`);
+		return {
+			entries: existing.entries.length,
+			removed: 0,
+			exitCode: 0
+		};
+	}
+	await writeBaseline(target, baseline, cwd);
+	note(`Removed ${count(removed.length, "entry")} from ${target}; ${count(baseline.entries.length, "entry")} left`);
+	for (const entry of removed) note(`  ${entry.page}  ${entry.ruleId}`);
+	if (outcome.expired.length > 0) advise(`${count(outcome.expired.length, "entry")} have expired and suppress nothing; --prune leaves them for you to decide about`);
+	return {
+		entries: baseline.entries.length,
+		removed: removed.length,
+		exitCode: 0
+	};
+}
 var DiffError = class extends Error {
 	name = "DiffError";
 };
@@ -353,6 +403,23 @@ async function runStatementCommand(options = {}) {
 		});
 		let audit;
 		if (options.audit) audit = await readAuditReport(options.audit, options.cwd ?? process.cwd());
+		let review;
+		if (options.review) {
+			const { readReview } = await import("../review-DIbOTmOM.js");
+			review = await readReview(options.review, options.cwd ?? process.cwd());
+		}
+		const problems = checkStatementEvidence({
+			config,
+			...audit ? { audit } : {},
+			...review ? { review } : {}
+		});
+		for (const problem of problems) if (problem.severity === "refuses") fail(problem.message);
+		else advise(problem.message);
+		if (refuses(problems)) return {
+			document: "",
+			format,
+			exitCode: 2
+		};
 		const statement = await renderStatement(config, {
 			...options.locale ? { locale: options.locale } : {},
 			...options.country ? { country: options.country } : {},
@@ -374,7 +441,8 @@ async function runStatementCommand(options = {}) {
 			exitCode: 0
 		};
 	} catch (cause) {
-		if (cause instanceof ConfigError || cause instanceof StatementError) {
+		const { ReviewError } = await import("../review-DIbOTmOM.js");
+		if (cause instanceof ConfigError || cause instanceof StatementError || cause instanceof ReviewError) {
 			fail(cause.message);
 			if (cause instanceof ConfigError) for (const issue of cause.issues) note(`  ${issue}`);
 			return {
@@ -453,31 +521,60 @@ const parseFormat = oneOf(OUTPUT_FORMATS);
 const parsePositive = wholeNumber(1);
 const parseDepth = wholeNumber(0);
 const parseConcurrency = wholeNumber(1);
+/**
+* `--header` repeated, collected into a list the command turns into a record.
+*
+* Validated here so a typo stops the run before a site is crawled with a
+* malformed credential — and the error names the header rather than repeating
+* the value, because a bad `--header` is exactly the case where the value is a
+* token and the terminal is a CI log.
+*/
+function collectHeader(value, previous = []) {
+	try {
+		parseHeader(value);
+	} catch (cause) {
+		throw new InvalidArgumentError(cause instanceof Error ? cause.message : String(cause));
+	}
+	return [...previous, value];
+}
+function parseBasicAuth(value) {
+	try {
+		basicAuth(value);
+	} catch (cause) {
+		throw new InvalidArgumentError(cause instanceof Error ? cause.message : String(cause));
+	}
+	return value;
+}
 const program = new Command();
 program.exitOverride();
 program.name("eaa-kit").description("WCAG 2.2 AA auditor and EU accessibility statement generator for static sites.\nNot legal advice.").version(TOOL_VERSION, "-v, --version");
-program.command("audit").description("Audit built HTML against WCAG 2.2 AA").argument("[dir]", "directory holding the built site (default: found automatically)").option("--include <globs...>", "glob patterns to audit, relative to dir").option("--exclude <globs...>", "glob patterns to skip").option("--base-url <url>", "audit pages under their real site URL").option("--url <url>", "audit a running site instead of a build directory").option("--no-build", "never run the project build or start its server").option("--per-page", "also list every page and its result").option("--manual", "what to check by hand for the rules this engine cannot evaluate").option("--coverage", "list every WCAG 2.2 A/AA criterion and what this run reached on it").option("--allow-remote", "allow --url to crawl a host that is not localhost").option("--ignore-robots", "crawl paths robots.txt disallows").option("--sitemap <path>", "where the site lists its pages, if not /sitemap.xml").option("--max-pages <n>", "stop the crawl after this many pages", parsePositive).option("--max-depth <n>", "how far from the entry URL to follow links", parseDepth).option("--fail-on <impact>", `exit 1 on violations at or above this impact (${IMPACT_LEVELS.join("|")}; default: ${DEFAULT_FAIL_ON})`, parseImpact).option("--format <format>", `output format (${OUTPUT_FORMATS.join("|")}; default: console)`, parseFormat).option("--output <path>", "write the report to a file instead of stdout").option("--browser", "audit in real Chromium, covering the rules jsdom cannot evaluate").option("--fast", "skip the rules the browserless engine cannot decide anyway, losing their element lists").option("--concurrency <n>", "pages to audit at once, or 1 for none (default: from the page and core count)", parseConcurrency).option("--baseline <path>", "accept the violations recorded in this file; fail only on new ones").option("--config <path>", "take defaults from this config file, otherwise it is searched for").action(async (dir, flags) => {
+program.command("audit").description("Audit built HTML against WCAG 2.2 AA").argument("[dir]", "directory holding the built site (default: found automatically)").option("--include <globs...>", "glob patterns to audit, relative to dir").option("--exclude <globs...>", "glob patterns to skip").option("--base-url <url>", "audit pages under their real site URL").option("--url <url>", "audit a running site instead of a build directory").option("--no-build", "never run the project build or start its server").option("--per-page", "also list every page and its result").option("--manual", "what to check by hand for the rules this engine cannot evaluate").option("--coverage", "list every WCAG 2.2 A/AA criterion and what this run reached on it").option("--allow-remote", "allow --url to crawl a host that is not localhost").option("--ignore-robots", "crawl paths robots.txt disallows").option("--sitemap <path>", "where the site lists its pages, if not /sitemap.xml").option("--max-pages <n>", "stop the crawl after this many pages", parsePositive).option("--max-depth <n>", "how far from the entry URL to follow links", parseDepth).option("--header <header>", "send this header with every request, e.g. \"Authorization: Bearer …\". Repeatable", collectHeader).option("--basic-auth <user:password>", "send an Authorization header for basic auth", parseBasicAuth).option("--fail-on <impact>", `exit 1 on violations at or above this impact (${IMPACT_LEVELS.join("|")}; default: ${DEFAULT_FAIL_ON})`, parseImpact).option("--format <format>", `output format (${OUTPUT_FORMATS.join("|")}; default: console)`, parseFormat).option("--output <path>", "write the report to a file instead of stdout").option("--browser", "audit in real Chromium, covering the rules jsdom cannot evaluate").option("--fast", "skip the rules the browserless engine cannot decide anyway, losing their element lists").option("--concurrency <n>", "pages to audit at once, or 1 for none (default: from the page and core count)", parseConcurrency).option("--baseline <path>", "accept the violations recorded in this file; fail only on new ones").option("--review <path>", "what a person checked, from eaa-kit checklist").option("--review-max-age <days>", "stop counting review entries older than this", parseDepth).option("--config <path>", "take defaults from this config file, otherwise it is searched for").action(async (dir, flags) => {
 	const defaults = await auditDefaults({ ...flags.config ? { config: flags.config } : {} });
 	const invocation = auditInvocation(dir, defaults, flags);
 	const { exitCode } = await runAuditCommand(invocation.dir, invocation.options);
 	process.exitCode = exitCode;
 });
-program.command("baseline").description("Record the violations a build already has, so later runs fail only on new ones").argument("[dir]", "directory holding the built site (default: ./dist)").option("--include <globs...>", "glob patterns to audit, relative to dir").option("--exclude <globs...>", "glob patterns to skip").option("--base-url <url>", "audit pages under their real site URL").option("--url <url>", "record a baseline from a running site instead of a directory").option("--allow-remote", "allow --url to crawl a host that is not localhost").option("--ignore-robots", "crawl paths robots.txt disallows").option("--sitemap <path>", "where the site lists its pages, if not /sitemap.xml").option("--max-pages <n>", "stop the crawl after this many pages", parsePositive).option("--max-depth <n>", "how far from the entry URL to follow links", parseDepth).option("--output <path>", `where to write it (default: ${DEFAULT_BASELINE_FILE})`).option("--note <text>", "recorded on every entry, for whoever reads the file").option("--expires-on <date>", "ISO date after which the entries stop suppressing", parseDate).option("--browser", "audit in real Chromium instead of jsdom").option("--concurrency <n>", "pages to audit at once, or 1 for none", parseConcurrency).option("--config <path>", "take defaults from this config file, otherwise it is searched for").action(async (dir, flags) => {
+program.command("baseline").description("Record the violations a build already has, so later runs fail only on new ones").argument("[dir]", "directory holding the built site (default: ./dist)").option("--include <globs...>", "glob patterns to audit, relative to dir").option("--exclude <globs...>", "glob patterns to skip").option("--base-url <url>", "audit pages under their real site URL").option("--url <url>", "record a baseline from a running site instead of a directory").option("--allow-remote", "allow --url to crawl a host that is not localhost").option("--ignore-robots", "crawl paths robots.txt disallows").option("--sitemap <path>", "where the site lists its pages, if not /sitemap.xml").option("--max-pages <n>", "stop the crawl after this many pages", parsePositive).option("--max-depth <n>", "how far from the entry URL to follow links", parseDepth).option("--header <header>", "send this header with every request, e.g. \"Authorization: Bearer …\". Repeatable", collectHeader).option("--basic-auth <user:password>", "send an Authorization header for basic auth", parseBasicAuth).option("--output <path>", `where to write it (default: ${DEFAULT_BASELINE_FILE})`).option("--prune", "remove the entries this run shows are gone, instead of recording a new baseline").option("--note <text>", "recorded on every entry, for whoever reads the file").option("--expires-on <date>", "ISO date after which the entries stop suppressing", parseDate).option("--browser", "audit in real Chromium instead of jsdom").option("--concurrency <n>", "pages to audit at once, or 1 for none", parseConcurrency).option("--config <path>", "take defaults from this config file, otherwise it is searched for").action(async (dir, flags) => {
 	const defaults = await auditDefaults({ ...flags.config ? { config: flags.config } : {} });
 	const invocation = baselineInvocation(dir, defaults, flags);
 	const { exitCode } = await runBaselineCommand(invocation.dir, invocation.options);
 	process.exitCode = exitCode;
 });
+program.command("checklist").description("Write the manual review: the 34 WCAG criteria no automated rule can reach").option("--record <path>", `where the answers live (default: ${DEFAULT_REVIEW_FILE})`).option("--output <path>", "write the worksheet here instead of stdout").option("--reviewed-by <name>", "who is carrying out the review").action(async (flags) => {
+	const { runChecklistCommand } = await import("../checklist-BtgkxMEa.js");
+	const { exitCode } = await runChecklistCommand(flags);
+	process.exitCode = exitCode;
+});
 program.command("diff").description("Compare two JSON reports: what a change made worse, and what it fixed").argument("<before>", "JSON report from before the change").argument("<after>", "JSON report from after it").option("--format <format>", `output format (${DIFF_FORMATS.join("|")})`, oneOf(DIFF_FORMATS)).option("--output <path>", "write the diff here instead of stdout").option("--fail-on <impact>", `exit 1 on NEW violations at or above this impact (${IMPACT_LEVELS.join("|")})`, parseImpact, DEFAULT_FAIL_ON).action(async (before, after, flags) => {
 	const { exitCode } = await runDiffCommand(before, after, flags);
 	process.exitCode = exitCode;
 });
 program.command("init").description("Write an eaa.config.json to generate statements from").option("--output <path>", "write here instead of eaa.config.json").option("--force", "overwrite a config that is already there").option("-y, --yes", "take every default without asking").action(async (flags) => {
-	const { runInitCommand } = await import("../init-CW7LfGT5.js");
+	const { runInitCommand } = await import("../init-BjKYttxc.js");
 	const { exitCode } = await runInitCommand(flags);
 	process.exitCode = exitCode;
 });
-program.command("statement").description("Generate an EU accessibility statement from eaa.config").option("--config <path>", "path to the config file, otherwise it is searched for").option("--lang <locale>", `statement language (${STATEMENT_LOCALES.join("|")})`, parseLocale).option("--country <code>", `override the country template (${COUNTRIES.join("|")})`, parseCountry).option("--audit <path>", "list the barriers from an eaa-kit audit --format json report").option("--format <format>", `output format (${STATEMENT_FORMATS.join("|")}), otherwise from the --output extension`, parseStatementFormat).option("--output <path>", "write the statement to a file instead of stdout").action(async (flags) => {
+program.command("statement").description("Generate an EU accessibility statement from eaa.config").option("--config <path>", "path to the config file, otherwise it is searched for").option("--lang <locale>", `statement language (${STATEMENT_LOCALES.join("|")})`, parseLocale).option("--country <code>", `override the country template (${COUNTRIES.join("|")})`, parseCountry).option("--audit <path>", "list the barriers from an eaa-kit audit --format json report").option("--review <path>", "check the conformance claim against a review record; nothing from it is published").option("--format <format>", `output format (${STATEMENT_FORMATS.join("|")}), otherwise from the --output extension`, parseStatementFormat).option("--output <path>", "write the statement to a file instead of stdout").action(async (flags) => {
 	const { lang, ...options } = flags;
 	const { exitCode } = await runStatementCommand({
 		...options,

package/dist/{command-C3D7JWn6.js → command-CZKp9Wi_.js}

@@ -1,6 +1,86 @@
 import { mkdir, writeFile } from "node:fs/promises";
 import path from "node:path";
 import pc from "picocolors";
+//#region src/audit/headers.ts
+/**
+* Request headers for the pages this tool fetches.
+*
+* The two places a small agency stages work are the two this tool could not
+* reach: a preview deployment, which every host protects by default, and a CMS
+* staging site behind basic auth or a session cookie. `--url` sent one fixed
+* pair of headers and had no way to add to it, so auditing either meant putting
+* the site on the public internet first.
+*
+* These values are credentials. They are handled on the principle that the tool
+* never writes one down: nothing here reaches a report, a baseline, a SARIF log
+* or the completeness record, and the errors below name the header rather than
+* echoing what was typed, because a malformed `--header` is exactly the case
+* where the value is a token and the terminal is a CI log.
+*
+* For the same reason there is no `headers` key in `eaa.config`. That file is
+* committed; a token in it is a token in the repository, and a tool that
+* offered the field would be inviting that. Pass them as flags — a shell
+* expands `--header "Authorization: Bearer $TOKEN"` — or as the GitHub Action's
+* input, which reads from `secrets`.
+*/
+/** Thrown for a header this cannot parse. Never carries the value. */
+var HeaderError = class extends Error {
+	name = "HeaderError";
+};
+/**
+* `Name: value` into a pair.
+*
+* Lenient about the space after the colon and about a value containing colons,
+* which `Authorization: Basic …` and a `Cookie` both do. Strict about the name,
+* because a header name is a token by RFC 9110 and anything else is a typo that
+* a server would reject in a way nobody could read.
+*/
+function parseHeader(input) {
+	const at = input.indexOf(":");
+	if (at <= 0) throw new HeaderError("a header must be written \"Name: value\"");
+	const name = input.slice(0, at).trim();
+	const value = input.slice(at + 1).trim();
+	if (!/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/.test(name)) throw new HeaderError(`"${name}" is not a valid header name`);
+	if (value === "") throw new HeaderError(`the ${name} header was given no value`);
+	if (/[\r\n]/.test(value)) throw new HeaderError(`the ${name} header contains a line break`);
+	return [name, value];
+}
+/** Several `Name: value` strings into the record the fetchers take. */
+function parseHeaders(inputs) {
+	const headers = {};
+	for (const input of inputs) {
+		const [name, value] = parseHeader(input);
+		headers[name] = value;
+	}
+	return headers;
+}
+/**
+* `user:password` into an `Authorization` header.
+*
+* Sugar for the header somebody would otherwise have to base64 by hand, which
+* is the one credential a staging site is most likely to be behind. A password
+* may contain colons; a username may not, which is basic auth's own rule.
+*/
+function basicAuth(input) {
+	if (input.indexOf(":") <= 0) throw new HeaderError("basic auth must be written \"user:password\"");
+	return ["Authorization", `Basic ${Buffer.from(input, "utf8").toString("base64")}`];
+}
+/**
+* The headers a run will send, from whichever flags were given.
+*
+* `--basic-auth` first, so an explicit `--header "Authorization: …"` beats it:
+* a typed header is the more specific thing to have asked for.
+*/
+function requestHeaders(options) {
+	const headers = {};
+	if (options.basicAuth !== void 0) {
+		const [name, value] = basicAuth(options.basicAuth);
+		headers[name] = value;
+	}
+	Object.assign(headers, parseHeaders(options.header ?? []));
+	return Object.keys(headers).length === 0 ? void 0 : headers;
+}
+//#endregion
 //#region src/cli/command.ts
 /**
 * What every command does around the audit itself: say what is happening, run
@@ -42,18 +122,19 @@ async function runEngine(pages, options) {
 		...options.timeoutMs === void 0 ? {} : { timeoutMs: options.timeoutMs }
 	};
 	if (!options.browser) {
-		const { runPooledAudit } = await import("./pool-BO25OIez.js");
+		const { runPooledAudit } = await import("./pool-dkexq5xo.js");
 		return runPooledAudit(pages, {
 			...runnerOptions,
 			...options.fast ? { fast: true } : {},
 			...options.concurrency === void 0 ? {} : { concurrency: options.concurrency }
 		});
 	}
-	const { BrowserUnavailableError, runBrowserAudit } = await import("./playwright-BojtYVUa.js");
+	const { BrowserUnavailableError, runBrowserAudit } = await import("./playwright-C-miJP2b.js");
 	try {
 		return await runBrowserAudit(options.directory, pages, {
 			...runnerOptions,
-			...options.concurrency === void 0 ? {} : { concurrency: options.concurrency }
+			...options.concurrency === void 0 ? {} : { concurrency: options.concurrency },
+			...options.headers === void 0 ? {} : { headers: options.headers }
 		});
 	} catch (cause) {
 		if (cause instanceof BrowserUnavailableError) {
@@ -95,7 +176,7 @@ async function emitDocument(body, output, cwd) {
 * on different settings than it names would be worse than stopping.
 */
 async function auditDefaults(options = {}) {
-	const { loadAuditConfig } = await import("./load-CFq2VQtT.js");
+	const { loadAuditConfig } = await import("./load-Bc_xDGAh.js");
 	const loaded = await loadAuditConfig({
 		...options.cwd ? { cwd: options.cwd } : {},
 		...options.config ? { path: options.config } : {}
@@ -105,14 +186,19 @@ async function auditDefaults(options = {}) {
 	return loaded.audit;
 }
 function auditInvocation(dir, defaults, flags) {
-	const { build, config: _config, ...typed } = flags;
-	const { dir: configDir, build: configBuild, ...fromConfig } = defaults;
+	const { build, config: _config, header, basicAuth, ...typed } = flags;
+	const { dir: configDir, build: configBuild, headers: _fromFile, ...fromConfig } = defaults;
+	const headers = requestHeaders({
+		...header ? { header } : {},
+		...basicAuth ? { basicAuth } : {}
+	});
 	return {
 		dir: dir ?? configDir,
 		options: {
 			...fromConfig,
 			...typed,
-			...build === false || configBuild === false ? { noBuild: true } : {}
+			...build === false || configBuild === false ? { noBuild: true } : {},
+			...headers === void 0 ? {} : { headers }
 		}
 	};
 }
@@ -126,12 +212,17 @@ function auditInvocation(dir, defaults, flags) {
 * and `baseline` all describe a verdict this command does not reach.
 */
 function baselineInvocation(dir, defaults, flags) {
-	const { config: _config, ...typed } = flags;
+	const { config: _config, header, basicAuth, ...typed } = flags;
+	const headers = requestHeaders({
+		...header ? { header } : {},
+		...basicAuth ? { basicAuth } : {}
+	});
 	return {
 		dir: dir ?? defaults.dir ?? "./dist",
 		options: {
 			...baselineDefaults(defaults),
-			...typed
+			...typed,
+			...headers === void 0 ? {} : { headers }
 		}
 	};
 }
@@ -157,4 +248,4 @@ function pick(source, keys) {
 	return out;
 }
 //#endregion
-export { emitDocument as a, runEngine as c, baselineInvocation as i, warn as l, auditDefaults as n, fail as o, auditInvocation as r, note as s, advise as t };
+export { emitDocument as a, runEngine as c, parseHeader as d, baselineInvocation as i, warn as l, auditDefaults as n, fail as o, auditInvocation as r, note as s, advise as t, basicAuth as u };

package/dist/{remediation-CMBIrnpN.js → completeness-Dwq3CPB3.js}

@@ -1,45 +1,6 @@
-import { a as impactRank } from "./impact-DZt2oBCP.js";
+import { o as impactRank } from "./impact-luGCnN8F.js";
 import { t as elementFingerprint } from "./fingerprint-BjYV_0F7.js";
-import { o as findingElements } from "./result-BWcYXeRs.js";
-//#region src/audit/completeness.ts
-/**
-* Fold what the collector knew together with what the engine managed.
-*
-* The audits carry the second half: a page with an `error` was collected and
-* then not audited, and is as unmeasured as one that was never fetched.
-*/
-function runCompleteness(audits, collection) {
-	const errored = audits.filter((audit) => audit.error).length;
-	return {
-		...collection,
-		audited: audits.length - errored,
-		errored,
-		complete: collection.unreachable.length === 0 && !collection.truncated && errored === 0
-	};
-}
-/**
-* What was missed, as phrases both reports print.
-*
-* Separate clauses rather than one total, for the same reason the coverage
-* parts are: a page that could not be fetched and a page that could not be
-* parsed are different problems with different fixes, and summing them would
-* name neither.
-*/
-function missedParts(completeness) {
-	const parts = [];
-	if (completeness.unreachable.length > 0) parts.push(`${completeness.unreachable.length} could not be reached`);
-	if (completeness.errored > 0) parts.push(`${completeness.errored} could not be audited`);
-	if (completeness.truncated) parts.push("the run stopped at its page limit");
-	return parts;
-}
-/** How the pages were found, in words, for the run details both reports show. */
-function discoveryLabel(discovery) {
-	switch (discovery) {
-		case "directory": return "files in the build directory";
-		case "sitemap": return "sitemap.xml and links";
-		case "links": return "links from the entry page";
-	}
-}
+import { o as findingElements } from "./result-DfUru6y_.js";
 /** Whether this element looks like one component rendered on many pages. */
 function isShared(element) {
 	return element.pages.length >= 3;
@@ -95,6 +56,23 @@ function groupIssues(audits) {
 	return issues;
 }
 /**
+* What the grouped issues add up to: distinct elements, and the violations they
+* account for. Both reports open their issues section with these two numbers,
+* and say something different when they are equal.
+*/
+function issueTotals(issues) {
+	let elements = 0;
+	let occurrences = 0;
+	for (const issue of issues) {
+		elements += issue.elements.length;
+		occurrences += issue.occurrences;
+	}
+	return {
+		elements,
+		occurrences
+	};
+}
+/**
 * Unevaluated rules folded across the site, sorted by rule id.
 *
 * Both reports list these once at the end rather than under every page: on a
@@ -318,4 +296,44 @@ function remediationFor(ruleId, framework) {
 	};
 }
 //#endregion
-export { isShared as a, runCompleteness as c, groupIssues as i, blindRules as n, discoveryLabel as o, coverageParts as r, missedParts as s, remediationFor as t };
+//#region src/audit/completeness.ts
+/**
+* Fold what the collector knew together with what the engine managed.
+*
+* The audits carry the second half: a page with an `error` was collected and
+* then not audited, and is as unmeasured as one that was never fetched.
+*/
+function runCompleteness(audits, collection) {
+	const errored = audits.filter((audit) => audit.error).length;
+	return {
+		...collection,
+		audited: audits.length - errored,
+		errored,
+		complete: collection.unreachable.length === 0 && !collection.truncated && errored === 0
+	};
+}
+/**
+* What was missed, as phrases both reports print.
+*
+* Separate clauses rather than one total, for the same reason the coverage
+* parts are: a page that could not be fetched and a page that could not be
+* parsed are different problems with different fixes, and summing them would
+* name neither.
+*/
+function missedParts(completeness) {
+	const parts = [];
+	if (completeness.unreachable.length > 0) parts.push(`${completeness.unreachable.length} could not be reached`);
+	if (completeness.errored > 0) parts.push(`${completeness.errored} could not be audited`);
+	if (completeness.truncated) parts.push("the run stopped at its page limit");
+	return parts;
+}
+/** How the pages were found, in words, for the run details both reports show. */
+function discoveryLabel(discovery) {
+	switch (discovery) {
+		case "directory": return "files in the build directory";
+		case "sitemap": return "sitemap.xml and links";
+		case "links": return "links from the entry page";
+	}
+}
+//#endregion
+export { blindRules as a, isShared as c, remediationFor as i, issueTotals as l, missedParts as n, coverageParts as o, runCompleteness as r, groupIssues as s, discoveryLabel as t };

package/dist/{component-C3GL1Mnu.js → component-ChisoFyY.js}

@@ -1,5 +1,5 @@
 import { i as toPosix } from "./fs-BmPtmFke.js";
-import { t as collapse } from "./text-CKKpzkYM.js";
+import { t as collapse } from "./text-BF1LHMiV.js";
 import { readFile } from "node:fs/promises";
 import path from "node:path";
 import { glob } from "tinyglobby";

package/dist/{component-DKd3EHOg.js → component-DcCn3BJS.js}

@@ -1,2 +1,2 @@
-import { n as componentFor, t as buildComponentIndex } from "./component-C3GL1Mnu.js";
+import { n as componentFor, t as buildComponentIndex } from "./component-ChisoFyY.js";
 export { buildComponentIndex, componentFor };

package/dist/coverage-7bQqWNfN.js

@@ -0,0 +1,2 @@
+import { t as WCAG22_AA_CRITERIA } from "./coverage-BD2_CYns.js";
+export { WCAG22_AA_CRITERIA };

package/dist/{coverage-B_Y6l-Ra.js → coverage-BD2_CYns.js}

@@ -1,4 +1,5 @@
-import { d as successCriteria, n as DEFAULT_TAGS, r as ENGINE_BLIND_RULES } from "./result-BWcYXeRs.js";
+import { d as successCriteria, n as DEFAULT_TAGS, r as ENGINE_BLIND_RULES } from "./result-DfUru6y_.js";
+import { s as criterionReview } from "./review-CdMK2GpQ.js";
 import axe from "axe-core";
 //#region src/audit/manual.ts
 /**
@@ -463,7 +464,7 @@ function blindedRules(audits) {
 * the criterion is met on this site, and saying otherwise would be a coverage
 * claim resting on an empty page.
 */
-function buildCoverage(audits, tags = DEFAULT_TAGS) {
+function buildCoverage(audits, tags = DEFAULT_TAGS, review) {
 	const byCriterion = rulesByCriterion(tags);
 	const decided = decidedRules(audits);
 	const blinded = blindedRules(audits);
@@ -496,15 +497,36 @@ function buildCoverage(audits, tags = DEFAULT_TAGS) {
 			browserWouldAnswer: false
 		};
 	});
-	const count = (status) => criteria.filter((criterion) => criterion.status === status).length;
+	const reviewed = review === void 0 ? criteria : criteria.map(withReview(review));
+	const count = (status) => reviewed.filter((criterion) => criterion.status === status).length;
+	const counted = reviewed.filter((criterion) => criterion.review?.counts === true);
 	return {
-		criteria,
+		criteria: reviewed,
 		evaluated: count("evaluated"),
 		notEvaluated: count("not-evaluated"),
 		nothingToCheck: count("nothing-to-check"),
 		noAutomatedRule: count("no-automated-rule"),
-		browserWouldAnswer: criteria.filter((criterion) => criterion.browserWouldAnswer).length,
-		total: WCAG22_AA_CRITERIA.length
+		browserWouldAnswer: reviewed.filter((criterion) => criterion.browserWouldAnswer).length,
+		total: WCAG22_AA_CRITERIA.length,
+		reviewed: counted.length,
+		reviewedNotMet: counted.filter((criterion) => criterion.review?.result === "not-met").length,
+		reviewNotCounted: reviewed.filter((criterion) => criterion.review?.counts === false).length
+	};
+}
+/**
+* Attach what a person recorded, without letting it move what the engine found.
+*
+* `status` is untouched here, deliberately and in every branch: a review adds a
+* second kind of claim beside the run's own, and the moment it could rewrite
+* one the report would stop being a record of what was measured.
+*/
+function withReview(review) {
+	return (criterion) => {
+		const recorded = criterionReview(criterion.number, review, criterion.status === "evaluated");
+		return recorded === void 0 ? criterion : {
+			...criterion,
+			review: recorded
+		};
 	};
 }
 /**
@@ -518,5 +540,20 @@ function coverageSummary(coverage) {
 	const unautomatable = coverage.noAutomatedRule;
 	return `Of the ${coverage.total} WCAG 2.2 A and AA success criteria, ${unautomatable} cannot be checked by any automated engine and need a person. This run reached a verdict on ${coverage.evaluated}.`;
 }
+/**
+* What a person added to the run, in one sentence, or nothing when nobody did.
+*
+* Kept out of `coverageSummary` so the sentence about the engine's reach does
+* not change shape depending on whether a review was supplied — and because a
+* reader has to be able to tell the two claims apart at a glance: one is what
+* an engine measured, the other is what somebody says they checked.
+*/
+function reviewSummary(coverage) {
+	if (coverage.reviewed === 0 && coverage.reviewNotCounted === 0) return void 0;
+	const parts = [`A person recorded a result for ${coverage.reviewed} of the criteria this run did not reach`];
+	if (coverage.reviewedNotMet > 0) parts.push(`${coverage.reviewedNotMet} of them as not met`);
+	if (coverage.reviewNotCounted > 0) parts.push(`${coverage.reviewNotCounted} further entries were not counted`);
+	return `${parts.join("; ")}. This is a claim by a person, not a measurement.`;
+}
 //#endregion
-export { understandingUrl as i, coverageSummary as n, manualCheckFor as r, buildCoverage as t };
+export { rulesByCriterion as a, reviewSummary as i, buildCoverage as n, manualCheckFor as o, coverageSummary as r, understandingUrl as s, WCAG22_AA_CRITERIA as t };