eaa-kit 0.5.0 → 0.6.0

package/dist/{crawl-BUWPgaGW.js → crawl-BHkJmUkA.js}

@@ -93,7 +93,7 @@ function urlsFromSitemap(xml, origin) {
 	return urls;
 }
 /** One request, with a timeout, returning HTML or a reason it is not a page. */
-async function fetchPage(url, impl, timeoutMs, origin, maxBodyBytes) {
+async function fetchPage(url, impl, timeoutMs, origin, maxBodyBytes, headers) {
 	const controller = new AbortController();
 	const timer = setTimeout(() => controller.abort(), timeoutMs);
 	try {
@@ -102,7 +102,8 @@ async function fetchPage(url, impl, timeoutMs, origin, maxBodyBytes) {
 			redirect: "follow",
 			headers: {
 				accept: "text/html,application/xhtml+xml",
-				"user-agent": "eaa-kit"
+				"user-agent": "eaa-kit",
+				...headers
 			}
 		});
 		if (!response.ok) return {
@@ -213,13 +214,14 @@ function disallowedPaths(robots) {
 * that is not a page. A site that does not publish one is the ordinary case,
 * not a failure, so it comes back empty either way.
 */
-async function fetchSiteFile(entry, impl, name, timeoutMs, maxBodyBytes) {
+async function fetchSiteFile(entry, impl, name, timeoutMs, maxBodyBytes, headers) {
 	const controller = new AbortController();
 	const timer = setTimeout(() => controller.abort(), timeoutMs);
 	try {
 		const response = await impl(new URL(name, entry).href, {
 			redirect: "follow",
-			signal: controller.signal
+			signal: controller.signal,
+			...headers === void 0 ? {} : { headers }
 		});
 		if (!response.ok) return void 0;
 		if (new URL(response.url || new URL(name, entry).href).origin !== entry.origin) return void 0;
@@ -244,7 +246,7 @@ async function crawlSite(entry, options = {}) {
 	const timeoutMs = options.timeoutMs ?? 15e3;
 	const maxBodyBytes = options.maxBodyBytes ?? MAX_BODY_BYTES;
 	const failures = [];
-	const robots = options.ignoreRobots ? void 0 : await fetchSiteFile(entry, impl, "/robots.txt", timeoutMs, maxBodyBytes);
+	const robots = options.ignoreRobots ? void 0 : await fetchSiteFile(entry, impl, "/robots.txt", timeoutMs, maxBodyBytes, options.headers);
 	const blocked = robots === void 0 ? [] : disallowedPaths(robots);
 	const allowed = (url) => !blocked.some((path) => url.pathname.startsWith(path));
 	let discovery = "links";
@@ -258,7 +260,7 @@ async function crawlSite(entry, options = {}) {
 			depth
 		});
 	};
-	const sitemap = await fetchSiteFile(entry, impl, options.sitemap ?? "/sitemap.xml", timeoutMs, maxBodyBytes);
+	const sitemap = await fetchSiteFile(entry, impl, options.sitemap ?? "/sitemap.xml", timeoutMs, maxBodyBytes, options.headers);
 	const listed = sitemap === void 0 ? [] : urlsFromSitemap(sitemap, entry);
 	if (listed.length > 0) {
 		discovery = "sitemap";
@@ -266,11 +268,12 @@ async function crawlSite(entry, options = {}) {
 	}
 	enqueue(entry, 0);
 	const pages = [];
+	const redirects = [];
 	while (queue.length > 0 && pages.length < maxPages) {
 		const batch = queue.splice(0, Math.min(REQUEST_CONCURRENCY, maxPages - pages.length));
 		const results = await Promise.all(batch.map(async (item) => ({
 			item,
-			result: await fetchPage(item.url, impl, timeoutMs, entry.origin, maxBodyBytes)
+			result: await fetchPage(item.url, impl, timeoutMs, entry.origin, maxBodyBytes, options.headers)
 		})));
 		for (const { item, result } of results) {
 			if (!result.ok) {
@@ -281,6 +284,10 @@ async function crawlSite(entry, options = {}) {
 				continue;
 			}
 			const { url, html } = result.value;
+			if (url.href !== item.url.href) redirects.push({
+				requested: item.url.href,
+				landedOn: url.href
+			});
 			pages.push({
 				absolutePath: url.href,
 				relativePath: pageIdentity(url),
@@ -294,11 +301,38 @@ async function crawlSite(entry, options = {}) {
 		pages: byIdentity(pages),
 		origin: entry.origin,
 		failures,
+		redirects,
 		truncated: queue.length > 0,
 		discovery
 	};
 }
 /**
+* The requested URLs that a login wall swallowed, or none.
+*
+* A redirect on its own says nothing: sites normalise trailing slashes and send
+* `/` to `/en/` all day. What is not ordinary is *several* different URLs
+* answering at one address, or a whole crawl coming back as the single page the
+* entry was redirected to. Both are the shape of a sign-in page standing in
+* front of the site, and both otherwise produce a report about a page nobody
+* asked for that says it audited everything it set out to.
+*
+* Returns what was asked for and never reached, which is the one thing the run
+* has to say out loud. Deliberately shy of naming the cause: a single-page site
+* that redirects its entry looks identical from here, and being told where the
+* run actually landed is useful either way.
+*/
+function collapsedOnto(result) {
+	if (result.redirects.length === 0) return [];
+	const byDestination = /* @__PURE__ */ new Map();
+	for (const redirect of result.redirects) byDestination.set(redirect.landedOn, [...byDestination.get(redirect.landedOn) ?? [], redirect.requested]);
+	const collapsed = [];
+	for (const [landedOn, requested] of byDestination) if (requested.length > 1 || result.pages.length === 1) for (const from of requested) collapsed.push({
+		requested: from,
+		landedOn
+	});
+	return collapsed;
+}
+/**
 * One page per identity, in a stable order.
 *
 * The queue already refuses a URL it has seen, so this catches the case the
@@ -315,4 +349,4 @@ function byIdentity(pages) {
 	}).sort((a, b) => a.relativePath.localeCompare(b.relativePath));
 }
 //#endregion
-export { CrawlError, crawlSite, parseEntryUrl };
+export { CrawlError, collapsedOnto, crawlSite, parseEntryUrl };

package/dist/eleventy/index.d.ts

@@ -1,4 +1,4 @@
-import { n as IntegrationOptions, t as BuildAuditError } from "../run-CtcEUhbe.js";
+import { n as IntegrationOptions, t as BuildAuditError } from "../run-YiqyQA2b.js";
 //#region src/eleventy/index.d.ts
 /** What `eleventy.after` is given. Only two of its fields are read. */
 interface EleventyAfterEvent {

package/dist/eleventy/index.js

@@ -1,4 +1,4 @@
-import { n as auditBuild, r as stderrLogger, t as BuildAuditError } from "../run-C2nKFcb-.js";
+import { n as auditBuild, r as stderrLogger, t as BuildAuditError } from "../run-D7hdVXLA.js";
 import path from "node:path";
 //#region src/eleventy/index.ts
 /**

package/dist/{html-C4vktg0A.js → html-Bmh7X_sM.js}

@@ -1,10 +1,12 @@
-import { a as impactRank, i as impactLabel, r as countAtOrAbove } from "./impact-DZt2oBCP.js";
-import { i as escapeText, n as count, o as standardsReference, r as escapeAttribute, t as collapse } from "./text-CKKpzkYM.js";
+import { a as impactLabel, r as byImpactThenRule } from "./impact-luGCnN8F.js";
+import { i as escapeText, n as count, r as escapeAttribute, s as standardsReference, t as collapse } from "./text-BF1LHMiV.js";
 import { t as TOOL_VERSION } from "./version-B3v4rNoG.js";
-import { a as isShared, i as groupIssues, n as blindRules, o as discoveryLabel, r as coverageParts, s as missedParts, t as remediationFor } from "./remediation-CMBIrnpN.js";
-import { r as componentPath } from "./component-C3GL1Mnu.js";
-import { i as understandingUrl, r as manualCheckFor, t as buildCoverage } from "./coverage-B_Y6l-Ra.js";
-import { n as buildSummary } from "./json-DROX33kh.js";
+import { c as runEngine } from "./result-DfUru6y_.js";
+import { l as reviewSentence } from "./review-CdMK2GpQ.js";
+import { r as componentPath } from "./component-ChisoFyY.js";
+import { i as reviewSummary, n as buildCoverage, o as manualCheckFor, s as understandingUrl } from "./coverage-BD2_CYns.js";
+import { a as blindRules, c as isShared, i as remediationFor, l as issueTotals, n as missedParts, o as coverageParts, s as groupIssues, t as discoveryLabel } from "./completeness-Dwq3CPB3.js";
+import { n as buildSummary } from "./json-PNg6BeXp.js";
 import axe from "axe-core";
 //#region src/audit/report/html.ts
 /**
@@ -36,8 +38,8 @@ const MAX_NODES = 5;
 /** Longest element markup shown before it is truncated. */
 const MAX_SNIPPET = 200;
 function buildHtmlReport(audits, options) {
-	const engine = audits[0]?.engine ?? "jsdom";
-	const failing = countAtOrAbove(audits, options.failOn);
+	const engine = runEngine(audits);
+	const totals = buildSummary(audits, options.failOn);
 	const generatedAt = (options.now ?? /* @__PURE__ */ new Date()).toISOString();
 	const title = `Accessibility audit · ${options.directory}`;
 	return `<!doctype html>
@@ -54,15 +56,15 @@ ${STYLES}
 <body>
 <main>
 <h1>Accessibility audit</h1>
-${verdict(audits, failing, options)}
+${verdict(totals, options)}
 ${scoreboard(audits)}
 ${issues(audits, options)}
 ${runDetails(audits, engine, generatedAt, options)}
 ${notMeasured(options)}
-${summary(audits, failing, options)}
+${summary(totals, options)}
 ${pages(audits)}
 ${notEvaluated(audits)}
-${coverageSection(audits)}
+${coverageSection(audits, options)}
 ${footer()}
 </main>
 </body>
@@ -77,11 +79,11 @@ ${footer()}
 * which would be an embarrassing thing for this document in particular to get
 * wrong.
 */
-function verdict(audits, failing, options) {
-	const unaudited = audits.filter((audit) => audit.error).length;
+function verdict(totals, options) {
+	const unaudited = totals.pagesNotAudited;
 	if (unaudited > 0) return banner("broken", "Could not finish", `${count(unaudited, "page")} could not be audited, so this run reached no verdict.`);
-	if (failing > 0) return banner("fail", "Violations found", `${count(failing, "violation")} at or above ${escapeText(options.failOn)}.`);
-	const below = totalViolations(audits) - failing;
+	if (totals.failing > 0) return banner("fail", "Violations found", `${count(totals.failing, "violation")} at or above ${escapeText(options.failOn)}.`);
+	const below = totals.violations - totals.failing;
 	if (below > 0) return banner("pass", "No violations at the threshold", `${count(below, "violation")} below ${escapeText(options.failOn)}, which do not fail the run.`);
 	const completeness = options.completeness;
 	if (completeness && !completeness.complete) return banner("partial", "No violations found, but the whole site was not measured", `${escapeText(missedParts(completeness).join(", "))}. This report describes ${count(completeness.audited, "page")}, not the site.`);
@@ -137,13 +139,12 @@ function notMeasured(options) {
 * the kind of bug nobody notices until a client does, so there is one place
 * that counts.
 */
-function summary(audits, failing, options) {
-	const totals = buildSummary(audits, options.failOn);
+function summary(totals, options) {
 	const impacts = IMPACT_ORDER.filter((impact) => totals.byImpact[impact] > 0).map((impact) => `  <li><span class="badge ${escapeAttribute(impact)}">${escapeText(impact)}</span> ${totals.byImpact[impact]}</li>`).join("\n");
 	return `<h2>Summary</h2>
 <ul class="counts">
   <li><strong>${count(totals.violations, "violation")}</strong> on ${totals.pagesWithViolations} of ${count(totals.pages, "page")}, across ${count(totals.violatingElements, "element")}</li>
-  <li><strong>${failing}</strong> at or above ${escapeText(options.failOn)}</li>
+  <li><strong>${totals.failing}</strong> at or above ${escapeText(options.failOn)}</li>
   <li><strong>${totals.needsReview}</strong> ${totals.needsReview === 1 ? "rule needs" : "rules need"} manual review</li>
   <li><strong>${totals.notEvaluated}</strong> ${totals.notEvaluated === 1 ? "rule was" : "rules were"} not evaluated by this engine</li>
 ${totals.accepted > 0 ? `  <li><strong>${totals.accepted}</strong> ${totals.accepted === 1 ? "element is" : "elements are"} accepted by the baseline, and not counted above</li>` : ""}
@@ -236,8 +237,8 @@ ${manualBlock(ruleId, finding)}
 * majority of WCAG, and a percentage would present a limit of automated testing
 * as a property of this site.
 */
-function coverageSection(audits) {
-	const coverage = buildCoverage(audits);
+function coverageSection(audits, options) {
+	const coverage = buildCoverage(audits, void 0, options.review);
 	const rows = coverage.criteria.map((criterion) => {
 		const url = understandingUrl(criterion.number);
 		const name = escapeText(`${criterion.number} ${criterion.title}`);
@@ -245,7 +246,7 @@ function coverageSection(audits) {
 		return `  <tr class="${escapeAttribute(criterion.status)}">
     <td>${linked}</td>
     <td>${escapeText(criterion.level)}</td>
-    <td>${statusText(criterion)}</td>
+    <td>${statusText(criterion)}${reviewCell(criterion)}</td>
   </tr>`;
 	}).join("\n");
 	return `<h2>Coverage of WCAG 2.2 AA</h2>
@@ -263,6 +264,7 @@ function coverageSection(audits) {
   of WCAG cannot be automated, and a percentage here would present that limit of automated
   testing as though it were a measurement of this site.
 </p>
+${reviewParagraph(coverage)}
 <div class="scroll">
 <table class="coverage">
 <thead><tr><th>Success criterion</th><th>Level</th><th>This run</th></tr></thead>
@@ -272,6 +274,20 @@ ${rows}
 </table>
 </div>`;
 }
+/**
+* What a person recorded, where a review was supplied.
+*
+* Its own paragraph, under the four counts and visibly apart from them: the
+* counts are what an engine measured and this is what somebody says they
+* checked. This document is the one that leaves the building, so the difference
+* between the two has to survive being quoted.
+*/
+function reviewParagraph(coverage) {
+	const summary = reviewSummary(coverage);
+	if (summary === void 0) return "";
+	return `<p class="note review">${escapeText(summary)} eaa-kit cannot check that anything
+  recorded in a review is true; it reports it as the claim it is.</p>`;
+}
 function statusText(criterion) {
 	const browser = criterion.browserWouldAnswer ? " <em>(a real browser would answer this)</em>" : "";
 	switch (criterion.status) {
@@ -281,6 +297,16 @@ function statusText(criterion) {
 		case "no-automated-rule": return "No automated rule exists; a person must check it";
 	}
 }
+/**
+* What a person recorded about this criterion, in the cell that says what the
+* run reached. The same sentence the console report prints, from the same
+* function, so two documents of one run cannot word it differently.
+*/
+function reviewCell(criterion) {
+	const review = criterion.review;
+	if (review === void 0) return "";
+	return `<br><span class="reviewed">${escapeText(reviewSentence(review))}</span>`;
+}
 function footer() {
 	return `<hr>
 <footer>
@@ -303,12 +329,6 @@ function standards(finding) {
 function standardsText(finding) {
 	return escapeText(standardsReference(finding.successCriteria, finding.enClauses));
 }
-function totalViolations(audits) {
-	return audits.reduce((total, audit) => total + audit.violations.length, 0);
-}
-function byImpactThenRule(a, b) {
-	return impactRank(a.impact) - impactRank(b.impact) || a.ruleId.localeCompare(b.ruleId);
-}
 const STYLES = `:root { color-scheme: light dark; }
 body { margin: 0; background: #ffffff; color: #1a1a1a;
   font-family: system-ui, -apple-system, "Segoe UI", Roboto, sans-serif; line-height: 1.6; }
@@ -362,6 +382,8 @@ table.coverage tr.evaluated td:last-child { color: #216e39; }
 table.coverage em { font-style: normal; opacity: 0.75; }
 ul.unreachable li { margin-bottom: 0.2rem; overflow-wrap: anywhere; }
 code.selector { color: #4a4a4a; }
+.reviewed { color: #4a4a4a; font-size: 0.95em; }
+p.note.review { border-left: 3px solid #c9c9c9; padding-left: 0.75rem; }
 p.clean { color: #216e39; }
 p.note { font-size: 0.95rem; }
 hr { border: 0; border-top: 1px solid #d4d4d4; margin: 3rem 0 1.5rem; }
@@ -401,7 +423,8 @@ ul.page-list { margin: 0.35rem 0 0; padding-left: 1.25rem; }
   pre { background: #1e1e1e; }
   li.finding { border-color: #3a3a3a; }
   p.standards, p.coverage, .reason, li.more, code.selector, footer,
-  p.accepted-heading, ul.accepted { color: #b6b6b6; }
+  p.accepted-heading, ul.accepted, .reviewed { color: #b6b6b6; }
+  p.note.review { border-left-color: #555; }
   p.clean { color: #7ee2a8; }
   .verdict.pass { background: #10240f; border-color: #7ee2a8; }
   .verdict.fail { background: #2b1111; border-color: #ff9d9d; }
@@ -467,8 +490,7 @@ function scoreboard(audits) {
 function issues(audits, options) {
 	const found = groupIssues(audits);
 	if (found.length === 0) return "";
-	const elements = found.reduce((total, issue) => total + issue.elements.length, 0);
-	const occurrences = found.reduce((total, issue) => total + issue.occurrences, 0);
+	const { elements, occurrences } = issueTotals(found);
 	const intro = occurrences === elements ? `${count(elements, "distinct element")} to fix.` : `${count(occurrences, "violation")} across the site, from ${count(elements, "distinct element")}.`;
 	return `<h2 id="issues">What to fix</h2>
 <p class="intro">${escapeText(intro)}</p>

package/dist/{impact-DZt2oBCP.js → impact-luGCnN8F.js}

@@ -36,6 +36,16 @@ function impactRank(impact) {
 function impactLabel(impact) {
 	return impact !== null && isImpactLevel(impact) ? impact : "unclassified";
 }
+/**
+* Worst first, then by rule id so two runs of the same build agree.
+*
+* The order every format lists a page's findings in. Issues are sorted by
+* `bySeverityThenReach` instead, which adds the reach a grouped issue has and a
+* single page's findings do not.
+*/
+function byImpactThenRule(a, b) {
+	return impactRank(a.impact) - impactRank(b.impact) || a.ruleId.localeCompare(b.ruleId);
+}
 /** Violations at or above `threshold`, counted per rule per page. */
 function countAtOrAbove(audits, threshold) {
 	let total = 0;
@@ -43,4 +53,4 @@ function countAtOrAbove(audits, threshold) {
 	return total;
 }
 //#endregion
-export { impactRank as a, impactLabel as i, IMPACT_LEVELS as n, isImpactLevel as o, countAtOrAbove as r, meetsThreshold as s, DEFAULT_FAIL_ON as t };
+export { impactLabel as a, meetsThreshold as c, countAtOrAbove as i, IMPACT_LEVELS as n, impactRank as o, byImpactThenRule as r, isImpactLevel as s, DEFAULT_FAIL_ON as t };

package/dist/index.d.ts

@@ -136,6 +136,10 @@ declare const auditSchema: Schema<ObjectOf<{
   manual: OptionalSchema<boolean>;
   /** List every WCAG 2.2 A/AA criterion and what the run reached on it. */
   coverage: OptionalSchema<boolean>;
+  /** Path to a review record: what a person checked, for the criteria no engine reaches. */
+  review: OptionalSchema<string>;
+  /** Days after which a recorded review stops counting. */
+  reviewMaxAge: OptionalSchema<number>;
   /**
    * False is `--no-build`: never run the project's build or start its server to
    * find something to audit. Written in the positive because that is the state
@@ -232,6 +236,10 @@ declare const configSchema: Schema<ObjectOf<{
     manual: OptionalSchema<boolean>;
     /** List every WCAG 2.2 A/AA criterion and what the run reached on it. */
     coverage: OptionalSchema<boolean>;
+    /** Path to a review record: what a person checked, for the criteria no engine reaches. */
+    review: OptionalSchema<string>;
+    /** Days after which a recorded review stops counting. */
+    reviewMaxAge: OptionalSchema<number>;
     /**
      * False is `--no-build`: never run the project's build or start its server to
      * find something to audit. Written in the positive because that is the state
@@ -349,6 +357,24 @@ declare class StatementError extends Error {
   readonly name = "StatementError";
 }
 //#endregion
+//#region src/audit/review.d.ts
+declare const reviewSchema: Schema<ObjectOf<{
+  schemaVersion: Schema<number>;
+  /** Who carried out the review, for the record as a whole. */
+  reviewedBy: OptionalSchema<string>;
+  /** Keyed by success criterion number, e.g. '1.2.1'. */
+  criteria: DefaultedSchema<Record<string, ObjectOf<{
+    result: DefaultedSchema<"met" | "not-applicable" | "not-met" | "unreviewed">;
+    /** ISO date the check was done. Without it the entry cannot be aged. */
+    reviewedOn: OptionalSchema<string>;
+    /** Who did it, when that is not the person named on the record. */
+    reviewedBy: OptionalSchema<string>;
+    /** What was checked and what was found. Free text, for whoever reads it. */
+    note: OptionalSchema<string>;
+  }>>>;
+}>>;
+type ReviewRecord = Infer<typeof reviewSchema>;
+//#endregion
 //#region src/statement/findings.d.ts
 /** One rule that failed, folded across every page it failed on. */
 interface AuditFinding {
@@ -394,6 +420,47 @@ declare function summariseAuditReport(value: unknown, source?: string): AuditSum
 /** Read and summarise a report written by `eaa-kit audit --format json`. */
 declare function readAuditReport(file: string, cwd?: string): Promise<AuditSummary>;
 //#endregion
+//#region src/statement/evidence.d.ts
+/**
+ * Whether the statement's claim survives contact with the evidence beside it.
+ *
+ * The README has said since 0.1 that "a statement claiming full conformance for
+ * a site that is not conformant is worse than no statement at all", and until
+ * now the tool did nothing about it: `compliance.status` came out of the config
+ * file, the audit report came in through `--audit`, and nothing ever put the
+ * two in the same room. A run could print a document claiming full conformance
+ * directly above the list of barriers that disproves it.
+ *
+ * This is the check that was missing. It is deliberately narrow: it does not
+ * decide whether a site is accessible, and it cannot — most of WCAG is not
+ * automatable and the whole tool is built around saying so. It refuses only
+ * claims the evidence in hand already contradicts, and warns where a document
+ * is citing evidence that no longer describes the site.
+ *
+ * Nothing here needs an audit report. Given none, only the dates are checked,
+ * and a project that has never run one gets exactly the statement it always
+ * got — the tool cannot audit what it was not shown.
+ */
+/** How much a problem matters. `refuses` stops the statement being written. */
+type EvidenceSeverity = 'refuses' | 'warns';
+interface EvidenceProblem {
+  severity: EvidenceSeverity;
+  /** One sentence stating the contradiction, and one naming the fix. */
+  message: string;
+}
+interface EvidenceInput {
+  config: EaaConfig;
+  /** From `--audit`. Without it only the dates can be checked. */
+  audit?: AuditSummary;
+  /** From `--review`. Read for this check alone; it does not reach the text. */
+  review?: ReviewRecord;
+  /** Injectable so the ageing checks can be tested without waiting. */
+  today?: Date;
+}
+declare function checkStatementEvidence(input: EvidenceInput): EvidenceProblem[];
+/** Whether any problem is bad enough to stop the document being written. */
+declare function refuses(problems: readonly EvidenceProblem[]): boolean;
+//#endregion
 //#region src/statement/html.d.ts
 /**
  * Markdown-to-HTML for exactly the subset the statement templates emit, and
@@ -466,4 +533,4 @@ interface RenderedStatement {
  */
 declare function renderStatement(config: EaaConfig, options?: RenderStatementOptions): Promise<RenderedStatement>;
 //#endregion
-export { ASSESSMENT_METHODS, type AssessmentMethod, type AuditFinding, type AuditSummary, COMPLIANCE_STATUSES, CONFIG_FILENAMES, COUNTRIES, type ComplianceStatus, ConfigError, type Country, type EaaConfig, type EaaConfigInput, type HtmlDocumentOptions, ISSUE_REASONS, type IssueReason, type KnownIssue, type LoadConfigOptions, type LoadedConfig, type RenderStatementOptions, type RenderedStatement, STATEMENT_LOCALES, StatementError, type StatementLocale, configSchema, defineConfig, findConfigFile, loadConfig, parseConfig, readAuditReport, renderStatement, summariseAuditReport, toHtmlBody, toHtmlDocument };
+export { ASSESSMENT_METHODS, type AssessmentMethod, type AuditFinding, type AuditSummary, COMPLIANCE_STATUSES, CONFIG_FILENAMES, COUNTRIES, type ComplianceStatus, ConfigError, type Country, type EaaConfig, type EaaConfigInput, type EvidenceInput, type EvidenceProblem, type EvidenceSeverity, type HtmlDocumentOptions, ISSUE_REASONS, type IssueReason, type KnownIssue, type LoadConfigOptions, type LoadedConfig, type RenderStatementOptions, type RenderedStatement, STATEMENT_LOCALES, StatementError, type StatementLocale, checkStatementEvidence, configSchema, defineConfig, findConfigFile, loadConfig, parseConfig, readAuditReport, refuses, renderStatement, summariseAuditReport, toHtmlBody, toHtmlDocument };

package/dist/index.js

@@ -1,3 +1,3 @@
-import { a as ASSESSMENT_METHODS, c as ConfigError, d as configSchema, f as defineConfig, i as loadConfig, l as ISSUE_REASONS, n as findConfigFile, o as COMPLIANCE_STATUSES, p as parseConfig, s as COUNTRIES, t as CONFIG_FILENAMES, u as STATEMENT_LOCALES } from "./load-yAR4wzez.js";
-import { a as summariseAuditReport, i as readAuditReport, n as toHtmlBody, o as StatementError, r as toHtmlDocument, t as renderStatement } from "./render-DbGOVmhx.js";
-export { ASSESSMENT_METHODS, COMPLIANCE_STATUSES, CONFIG_FILENAMES, COUNTRIES, ConfigError, ISSUE_REASONS, STATEMENT_LOCALES, StatementError, configSchema, defineConfig, findConfigFile, loadConfig, parseConfig, readAuditReport, renderStatement, summariseAuditReport, toHtmlBody, toHtmlDocument };
+import { a as ASSESSMENT_METHODS, c as ConfigError, d as configSchema, f as defineConfig, i as loadConfig, l as ISSUE_REASONS, n as findConfigFile, o as COMPLIANCE_STATUSES, p as parseConfig, s as COUNTRIES, t as CONFIG_FILENAMES, u as STATEMENT_LOCALES } from "./load-vZdV_fD1.js";
+import { a as summariseAuditReport, c as StatementError, i as readAuditReport, n as toHtmlBody, o as checkStatementEvidence, r as toHtmlDocument, s as refuses, t as renderStatement } from "./render-CtsqR0k-.js";
+export { ASSESSMENT_METHODS, COMPLIANCE_STATUSES, CONFIG_FILENAMES, COUNTRIES, ConfigError, ISSUE_REASONS, STATEMENT_LOCALES, StatementError, checkStatementEvidence, configSchema, defineConfig, findConfigFile, loadConfig, parseConfig, readAuditReport, refuses, renderStatement, summariseAuditReport, toHtmlBody, toHtmlDocument };

package/dist/{init-CW7LfGT5.js → init-BjKYttxc.js}

@@ -1,7 +1,7 @@
-import { t as DEFAULT_FAIL_ON } from "./impact-DZt2oBCP.js";
-import { s as COUNTRIES, t as CONFIG_FILENAMES } from "./load-yAR4wzez.js";
+import { t as DEFAULT_FAIL_ON } from "./impact-luGCnN8F.js";
+import { s as COUNTRIES, t as CONFIG_FILENAMES } from "./load-vZdV_fD1.js";
 import { t as exists } from "./fs-BmPtmFke.js";
-import { l as warn, o as fail, s as note } from "./command-C3D7JWn6.js";
+import { l as warn, o as fail, s as note } from "./command-CZKp9Wi_.js";
 import { readFile, writeFile } from "node:fs/promises";
 import path from "node:path";
 import pc from "picocolors";

package/dist/{jsdom-B--cEH-G.js → jsdom-CQar6OQS.js}

@@ -1,4 +1,4 @@
-import { a as failedPage, i as blindRulesInScope, l as runOptions, n as DEFAULT_TAGS, s as pageUrl, t as DEFAULT_PAGE_TIMEOUT_MS, u as shapeResults } from "./result-BWcYXeRs.js";
+import { a as failedPage, i as blindRulesInScope, l as runOptions, n as DEFAULT_TAGS, s as pageUrl, t as DEFAULT_PAGE_TIMEOUT_MS, u as shapeResults } from "./result-DfUru6y_.js";
 import axe from "axe-core";
 import { Script } from "node:vm";
 import { JSDOM, VirtualConsole } from "jsdom";

package/dist/jsdom-DMvU2h-f.js

@@ -0,0 +1,3 @@
+import "./result-DfUru6y_.js";
+import { n as runJsdomAudit } from "./jsdom-CQar6OQS.js";
+export { runJsdomAudit };

package/dist/{json-D_Mnnft5.js → json-HJDgJp09.js}

@@ -1,2 +1,2 @@
-import { r as serialiseJsonReport, t as buildJsonReport } from "./json-DROX33kh.js";
+import { r as serialiseJsonReport, t as buildJsonReport } from "./json-PNg6BeXp.js";
 export { buildJsonReport, serialiseJsonReport };

package/dist/{json-DROX33kh.js → json-PNg6BeXp.js}

@@ -1,8 +1,8 @@
-import { i as impactLabel, o as isImpactLevel, r as countAtOrAbove } from "./impact-DZt2oBCP.js";
+import { a as impactLabel, i as countAtOrAbove, s as isImpactLevel } from "./impact-luGCnN8F.js";
 import { t as TOOL_VERSION } from "./version-B3v4rNoG.js";
 import { t as elementFingerprint } from "./fingerprint-BjYV_0F7.js";
-import { c as ruleOutcomes } from "./result-BWcYXeRs.js";
-import { t as buildCoverage } from "./coverage-B_Y6l-Ra.js";
+import { c as runEngine, f as uniqueRuleOutcomes } from "./result-DfUru6y_.js";
+import { n as buildCoverage } from "./coverage-BD2_CYns.js";
 import axe from "axe-core";
 /**
 * Build the machine-readable report.
@@ -24,7 +24,7 @@ function buildJsonReport(audits, options) {
 			axeCore: axe.version
 		},
 		generatedAt,
-		engine: audits[0]?.engine ?? "jsdom",
+		engine: runEngine(audits),
 		target: {
 			source: options.directory,
 			kind: options.sourceKind ?? "directory",
@@ -33,24 +33,19 @@ function buildJsonReport(audits, options) {
 		},
 		summary: buildSummary(audits, options.failOn),
 		completeness: options.completeness,
-		coverage: buildCoverage(audits),
+		coverage: buildCoverage(audits, void 0, options.review),
 		rules: buildRuleIndex(audits),
 		pages: audits.map(toJsonPage)
 	};
 }
 /** Every rule mentioned by any page, keyed by id and sorted for stable diffs. */
 function buildRuleIndex(audits) {
-	const index = /* @__PURE__ */ new Map();
-	for (const audit of audits) for (const outcome of ruleOutcomes(audit)) {
-		if (index.has(outcome.ruleId)) continue;
-		index.set(outcome.ruleId, {
-			help: outcome.help,
-			helpUrl: outcome.helpUrl,
-			successCriteria: outcome.successCriteria,
-			en301549: outcome.enClauses
-		});
-	}
-	return Object.fromEntries([...index].sort(([a], [b]) => a.localeCompare(b)));
+	return Object.fromEntries(uniqueRuleOutcomes(audits).map((outcome) => [outcome.ruleId, {
+		help: outcome.help,
+		helpUrl: outcome.helpUrl,
+		successCriteria: outcome.successCriteria,
+		en301549: outcome.enClauses
+	}]));
 }
 /** Serialised form written to stdout or to --output, with a trailing newline. */
 function serialiseJsonReport(report) {

package/dist/load-Bc_xDGAh.js

@@ -0,0 +1,2 @@
+import { r as loadAuditConfig } from "./load-vZdV_fD1.js";
+export { loadAuditConfig };

package/dist/{load-yAR4wzez.js → load-vZdV_fD1.js}

@@ -1,4 +1,4 @@
-import { n as IMPACT_LEVELS } from "./impact-DZt2oBCP.js";
+import { n as IMPACT_LEVELS } from "./impact-luGCnN8F.js";
 import { _ as union, a as integer, d as optional, f as pipe, g as transform, h as string, i as enumeration, m as safeParse, n as boolean, o as isoDate, r as email, t as array, u as object, v as url, y as withDefault } from "./schema-DJSF4K05.js";
 import { r as isFile } from "./fs-BmPtmFke.js";
 import { readFile } from "node:fs/promises";
@@ -122,6 +122,10 @@ const auditSchema = object({
 	manual: optional(boolean()),
 	/** List every WCAG 2.2 A/AA criterion and what the run reached on it. */
 	coverage: optional(boolean()),
+	/** Path to a review record: what a person checked, for the criteria no engine reaches. */
+	review: optional(string({ min: 1 })),
+	/** Days after which a recorded review stops counting. */
+	reviewMaxAge: optional(integer({ min: 0 })),
 	/**
 	* False is `--no-build`: never run the project's build or start its server to
 	* find something to audit. Written in the positive because that is the state

package/dist/nuxt/index.d.ts

@@ -1,4 +1,4 @@
-import { n as IntegrationOptions, t as BuildAuditError } from "../run-CtcEUhbe.js";
+import { n as IntegrationOptions, t as BuildAuditError } from "../run-YiqyQA2b.js";
 //#region src/nuxt/index.d.ts
 /** The part of the Nitro instance this reads, handed over by `nitro:init`. */
 interface NitroLike {

package/dist/nuxt/index.js

@@ -1,4 +1,4 @@
-import { n as auditBuild, r as stderrLogger, t as BuildAuditError } from "../run-C2nKFcb-.js";
+import { n as auditBuild, r as stderrLogger, t as BuildAuditError } from "../run-D7hdVXLA.js";
 import path from "node:path";
 //#region src/nuxt/index.ts
 function eaaKitModule(options = {}, nuxt) {

package/dist/{playwright-BojtYVUa.js → playwright-C-miJP2b.js}

@@ -1,5 +1,5 @@
 import { r as isFile } from "./fs-BmPtmFke.js";
-import { a as failedPage, l as runOptions, n as DEFAULT_TAGS, s as pageUrl, u as shapeResults } from "./result-BWcYXeRs.js";
+import { a as failedPage, l as runOptions, n as DEFAULT_TAGS, s as pageUrl, u as shapeResults } from "./result-DfUru6y_.js";
 import { createRequire } from "node:module";
 import { stat } from "node:fs/promises";
 import path from "node:path";
@@ -165,7 +165,8 @@ async function runBrowserAudit(directory, pages, options = {}) {
 	try {
 		const context = await browser.newContext({
 			viewport,
-			bypassCSP: true
+			bypassCSP: true,
+			...options.headers === void 0 ? {} : { extraHTTPHeaders: options.headers }
 		});
 		const audits = Array.from({ length: pages.length });
 		const lanes = Math.max(1, Math.min(options.concurrency ?? DEFAULT_CONCURRENCY, pages.length));

package/dist/{pool-BO25OIez.js → pool-dkexq5xo.js}

@@ -1,5 +1,5 @@
 import { r as isFile } from "./fs-BmPtmFke.js";
-import { a as failedPage, s as pageUrl } from "./result-BWcYXeRs.js";
+import { a as failedPage, s as pageUrl } from "./result-DfUru6y_.js";
 import { Worker } from "node:worker_threads";
 import { availableParallelism } from "node:os";
 //#region src/audit/runners/pool.ts
@@ -106,7 +106,7 @@ async function runPooledAudit(pages, options = {}) {
 	return runWorkers(pages, runnerOptions, Math.min(workers, pages.length), entry);
 }
 async function auditHere(pages, options) {
-	const { runJsdomAudit } = await import("./jsdom-22Bkt65v.js");
+	const { runJsdomAudit } = await import("./jsdom-DMvU2h-f.js");
 	return runJsdomAudit(pages, options);
 }
 /**