eaa-kit 0.5.0 → 0.7.0

package/README.md

@@ -9,11 +9,26 @@ in the DACH region — the BFSG in Germany, the BaFG in Austria — and the stat
 the statute and supervisory body of **seven countries**: Austria, Germany, Switzerland,
 Spain, France, Italy and the Netherlands, each in its own language as well as English.
 
+0.7.0 makes a run cost what it should. A page that has not changed byte for byte is not
+audited again, and a run with nothing to re-audit never loads an engine at all: twenty
+pages go from ~2,520 ms to ~230 ms, which is about what starting the process costs. A
+reused result is never passed off as a fresh one — every report says how much was reused
+and from when, and `diff` will not call a page fixed that this run did not look at. The
+statement now also says how many of WCAG's 55 criteria a person checked by hand, and
+`pnpm bench` prints the numbers in this paragraph for your own machine.
+
+0.6.0 added the half no engine can do. Of the 55 WCAG 2.2 A and AA success criteria, 34
+have no automated rule at all: `checklist` writes those down as a review somebody works
+through, `audit --review` reads the answers back beside what the run measured, and
+`statement` refuses to publish a claim of full conformance that either one contradicts.
+Sites behind a login or a preview protection are auditable too.
+
 ```bash
 npx eaa-kit audit                 # WCAG 2.2 AA report; finds your build itself
 npx eaa-kit diff a.json b.json    # what a change made worse, and what it fixed
 npx eaa-kit init                  # write an eaa.config.json
 npx eaa-kit statement             # accessibility statement, in one of seven countries
+npx eaa-kit checklist             # the manual review no engine can do for you
 ```
 
 > **Not legal advice.** eaa-kit reports what an automated engine can and cannot determine
@@ -95,14 +110,32 @@ could invent a fix that looks right and is not.
     written in src/components/Header.astro:12
 ```
 
+**Records the part no engine can do.** 34 of the 55 criteria have no automated rule at
+all. `eaa-kit checklist` writes them out as a worksheet and a record; `audit --review`
+reads the record back and reports what a person checked *beside* what the run measured,
+never folded into it. A review never overrules the engine, never counts an entry nobody
+answered, and never counts one that has aged out.
+
+```bash
+eaa-kit checklist --output a11y-review.md
+eaa-kit audit --review eaa-review.json --coverage
+```
+
 **Says how much of WCAG it could reach.** WCAG 2.2 has 55 success criteria at Levels A and
-AA. axe-core has rules touching 23 of them. Every run says so, and `--coverage` lists all
-55 with what this run reached on each — never as a percentage, because most of WCAG cannot
-be automated and a score would present that as a fact about your site.
+AA. This tool has rules for 21 of them, and 34 need a person. Every run says so, and
+`--coverage` lists all 55 with what this run reached on each — never as a percentage,
+because most of WCAG cannot be automated and a score would present that as a fact about
+your site.
 
 **Says what it did not measure.** A crawl that stopped at its page limit, or could not
 fetch forty URLs, no longer produces a report that looks like a complete one.
 
+**Audits only what changed.** A page whose markup is byte-identical to the last run's keeps
+the result it already had, and a run with nothing to re-audit never loads an engine —
+twenty pages in ~230 ms instead of ~2,520 ms, which is about what starting the process
+costs. Reuse is counted apart from auditing in all four reports, and `diff` will not call a
+page fixed that this run did not look at. `--no-cache` audits everything regardless.
+
 **Reports in four shapes**: a console report for whoever ran it, JSON for other tools,
 SARIF for GitHub code scanning, and a self-contained HTML page for the client whose site
 it is.
@@ -133,6 +166,16 @@ that instead — following the site's own sitemap, wherever it keeps it.
 eaa-kit audit --url http://localhost:8000 --sitemap /sitemap_index.xml
 ```
 
+**Reaches a site behind a login.** A preview deployment or a staging CMS refuses anonymous
+requests, which used to put both out of reach. `--basic-auth` and a repeatable `--header`
+cover them, on the crawl and in the browser, and the credentials are never written into a
+report, a baseline or a SARIF log — nor accepted from `eaa.config`, which is a committed
+file.
+
+```bash
+eaa-kit audit --url https://preview.example.com --basic-auth user:password
+```
+
 ## Documentation
 
 | | |
@@ -143,6 +186,7 @@ eaa-kit audit --url http://localhost:8000 --sitemap /sitemap_index.xml
 | [Baselines](docs/baseline.md) | Adopting the tool on a site that already has violations |
 | [Comparing two runs](docs/reports.md#comparing-two-runs) | The `diff` command, and what it refuses to call fixed |
 | [Coverage of WCAG](docs/audit.md#how-much-of-wcag-a-run-reaches) | What an automated engine can reach at all, and what it cannot |
+| [Recording a manual review](docs/review.md) | The `checklist` command, the record, and what a review is not allowed to do |
 | [Report formats](docs/reports.md) | The JSON contract, SARIF, and the HTML report |
 | [Integrations](docs/integrations.md) | The build plugins, the GitHub Action, and the two builders that get a command instead |
 
@@ -169,11 +213,15 @@ you](docs/audit.md#what-the-browserless-engine-can-and-cannot-tell-you).
 
 The same applies to the statement: it says what you told it. eaa-kit cannot check whether
 those claims are true, and a statement claiming full conformance for a site that is not
-conformant is worse than no statement at all.
+conformant is worse than no statement at all — which is why, given evidence, it now refuses
+to write that particular one. `statement --audit` will not claim full conformance over a
+report listing barriers, and `--review` will not claim it over criteria somebody recorded as
+not met.
 
 ## Changelog
 
-See [CHANGELOG.md](CHANGELOG.md).
+See [CHANGELOG.md](CHANGELOG.md), and [ROADMAP.md](ROADMAP.md) for what 0.6.0 is meant to
+add and what it deliberately will not.
 
 ## License
 

package/dist/astro/index.d.ts

@@ -1,4 +1,4 @@
-import { n as IntegrationOptions } from "../run-CtcEUhbe.js";
+import { n as IntegrationOptions } from "../run-BK2blxMI.js";
 //#region src/astro/index.d.ts
 /**
  * An Astro integration that audits the build Astro just produced.

package/dist/astro/index.js

@@ -1,4 +1,4 @@
-import { n as auditBuild, t as BuildAuditError } from "../run-C2nKFcb-.js";
+import { n as auditBuild, t as BuildAuditError } from "../run-DrS0Komf.js";
 import { fileURLToPath } from "node:url";
 //#region src/astro/index.ts
 var AstroAuditError = class extends Error {

package/dist/audit/runners/worker.js

@@ -1,4 +1,4 @@
-import { t as auditPage } from "../../jsdom-B--cEH-G.js";
+import { t as auditPage } from "../../jsdom-CsW_xVcA.js";
 import { enableCompileCache } from "node:module";
 import { parentPort, workerData } from "node:worker_threads";
 //#region src/audit/runners/worker.ts

package/dist/audit-Bwm1xBdJ.js

@@ -0,0 +1,2 @@
+import { n as runAuditCommand } from "./audit-DRjAY2iY.js";
+export { runAuditCommand };