eaa-kit 0.5.0 → 0.7.0

package/dist/{baseline-CuAS2lMk.js → baseline-BpE7DbDq.js}

@@ -1,6 +1,7 @@
-import { c as nullable, d as optional, h as string, l as number, m as safeParse, o as isoDate$1, t as array, u as object, y as withDefault } from "./schema-DJSF4K05.js";
+import { c as nullable, d as optional, h as string, l as number, m as safeParse, o as isoDate, t as array, u as object, y as withDefault } from "./schema-DJSF4K05.js";
+import { a as isoDate$1 } from "./text-BF1LHMiV.js";
 import { t as elementFingerprint } from "./fingerprint-BjYV_0F7.js";
-import { o as findingElements } from "./result-BWcYXeRs.js";
+import { s as findingElements } from "./result-B7_zVxAX.js";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import path from "node:path";
 /** Default filename, used by the CLI when no path is given. */
@@ -18,7 +19,7 @@ const entrySchema = object({
 	/** ISO date the entry was written. */
 	acceptedOn: withDefault(string(), () => ""),
 	/** ISO date after which this entry stops suppressing anything. */
-	expiresOn: optional(isoDate$1()),
+	expiresOn: optional(isoDate()),
 	/** Why this is being lived with. Free text, for whoever reads the file. */
 	note: optional(string())
 });
@@ -37,7 +38,7 @@ var BaselineError = class extends Error {
 * can still report on what the run actually found.
 */
 function applyBaseline(audits, baseline, options = {}) {
-	const today = isoDate(options.today ?? /* @__PURE__ */ new Date());
+	const today = isoDate$1(options.today ?? /* @__PURE__ */ new Date());
 	const expired = [];
 	const live = /* @__PURE__ */ new Map();
 	for (const entry of baseline.entries) if (entry.expiresOn !== void 0 && entry.expiresOn < today) expired.push(entry);
@@ -93,9 +94,38 @@ function applyBaseline(audits, baseline, options = {}) {
 		accepted
 	};
 }
+/**
+* The baseline without the entries this run showed are gone.
+*
+* `applyBaseline` already decides which those are, and does it carefully: an
+* entry counts as stale only when the page it names was audited and the element
+* was not found. Entries for pages a narrowed run never looked at are not stale
+* and are kept here, because from the outside a page nobody audited and a page
+* that no longer exists are the same thing, and guessing wrong empties the file
+* that is holding the rest of the site's build together.
+*
+* Nothing is added. That is the whole difference between this and recording a
+* baseline again: re-recording accepts whatever the site is failing today,
+* which on a bad day is a new barrier nobody agreed to.
+*/
+function pruneBaseline(baseline, stale) {
+	const gone = new Set(stale.map((entry) => key(entry.page, entry.ruleId, entry.fingerprint)));
+	if (gone.size === 0) return {
+		baseline,
+		removed: []
+	};
+	const kept = baseline.entries.filter((entry) => !gone.has(key(entry.page, entry.ruleId, entry.fingerprint)));
+	return {
+		baseline: {
+			...baseline,
+			entries: kept
+		},
+		removed: baseline.entries.filter((entry) => gone.has(key(entry.page, entry.ruleId, entry.fingerprint)))
+	};
+}
 /** Record every violation a run found, so a later run can fail only on new ones. */
 function buildBaseline(audits, options = {}) {
-	const acceptedOn = isoDate(options.today ?? /* @__PURE__ */ new Date());
+	const acceptedOn = isoDate$1(options.today ?? /* @__PURE__ */ new Date());
 	const entries = [];
 	for (const audit of audits) for (const finding of audit.violations) for (const node of findingElements(finding)) entries.push({
 		page: audit.relativePath,
@@ -153,8 +183,5 @@ function key(page, ruleId, fingerprint) {
 function byEntry(a, b) {
 	return a.page.localeCompare(b.page) || a.ruleId.localeCompare(b.ruleId) || a.fingerprint.localeCompare(b.fingerprint);
 }
-function isoDate(date) {
-	return date.toISOString().slice(0, 10);
-}
 //#endregion
-export { readBaseline as a, buildBaseline as i, DEFAULT_BASELINE_FILE as n, serialiseBaseline as o, applyBaseline as r, writeBaseline as s, BaselineError as t };
+export { pruneBaseline as a, writeBaseline as c, buildBaseline as i, DEFAULT_BASELINE_FILE as n, readBaseline as o, applyBaseline as r, serialiseBaseline as s, BaselineError as t };

package/dist/baseline-rtnj3RHB.js

@@ -0,0 +1,2 @@
+import { o as readBaseline, r as applyBaseline, t as BaselineError } from "./baseline-BpE7DbDq.js";
+export { BaselineError, applyBaseline, readBaseline };

package/dist/cache-D4dOIuOi.js

@@ -0,0 +1,219 @@
+import { c as nullable, d as optional, h as string, i as enumeration, l as number, m as safeParse, t as array, u as object, y as withDefault } from "./schema-DJSF4K05.js";
+import { a as isoDate } from "./text-BF1LHMiV.js";
+import { mkdir, readFile, readdir, rm, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { createHash } from "node:crypto";
+const MANIFEST_FILE = "manifest.json";
+const outcomeSchema = object({
+	ruleId: string(),
+	help: withDefault(string(), () => ""),
+	helpUrl: withDefault(string(), () => ""),
+	successCriteria: withDefault(array(string()), () => []),
+	enClauses: withDefault(array(string()), () => []),
+	tags: withDefault(array(string()), () => [])
+});
+const nodeSchema = object({
+	html: string(),
+	target: withDefault(array(string()), () => []),
+	failureSummary: optional(string())
+});
+const findingSchema = object({
+	ruleId: string(),
+	help: withDefault(string(), () => ""),
+	helpUrl: withDefault(string(), () => ""),
+	successCriteria: withDefault(array(string()), () => []),
+	enClauses: withDefault(array(string()), () => []),
+	tags: withDefault(array(string()), () => []),
+	impact: withDefault(nullable(string()), () => null),
+	nodes: withDefault(array(nodeSchema), () => [])
+});
+const incompleteSchema = object({
+	ruleId: string(),
+	help: withDefault(string(), () => ""),
+	helpUrl: withDefault(string(), () => ""),
+	successCriteria: withDefault(array(string()), () => []),
+	enClauses: withDefault(array(string()), () => []),
+	tags: withDefault(array(string()), () => []),
+	impact: withDefault(nullable(string()), () => null),
+	nodes: withDefault(array(nodeSchema), () => []),
+	reason: enumeration(["needs-review", "engine-limitation"]),
+	reasonDetail: withDefault(string(), () => "")
+});
+const entrySchema = object({
+	schemaVersion: number(),
+	/** The page this describes, as the run names it. */
+	page: string(),
+	/** ISO date the result was produced, printed by the reports. */
+	cachedOn: string(),
+	violations: withDefault(array(findingSchema), () => []),
+	incomplete: withDefault(array(incompleteSchema), () => []),
+	passes: withDefault(array(outcomeSchema), () => []),
+	inapplicable: withDefault(array(outcomeSchema), () => [])
+});
+const manifestSchema = object({
+	schemaVersion: number(),
+	/** Hash of everything in `CacheInputs`. A mismatch discards the cache. */
+	key: string(),
+	createdOn: withDefault(string(), () => "")
+});
+/**
+* The identity of a page's content.
+*
+* Path and HTML together: the same markup at two paths is two pages, because
+* the path is what a baseline, a diff and every report key on. A full digest
+* rather than the sixteen characters `elementFingerprint` uses — that one is
+* read by people in a committed file, and this one is read only by the tool,
+* where a collision would serve one page's verdicts for another's.
+*/
+function pageKey(page) {
+	return createHash("sha256").update(`${page.relativePath}\n${page.html}`).digest("hex");
+}
+/**
+* The identity of everything else the verdict depends on.
+*
+* Headers are hashed with the rest and never recorded: what a run sent can
+* change what it was served, so it belongs in the key, and a credential does
+* not belong on disk.
+*/
+function inputsKey(inputs) {
+	const headers = Object.entries(inputs.headers ?? {}).map(([name, value]) => `${name.toLowerCase()}=${value}`).sort().join("\n");
+	return createHash("sha256").update([
+		`tool=${inputs.toolVersion}`,
+		`axe=${inputs.axeVersion}`,
+		`tags=${[...inputs.tags].join(",")}`,
+		`engine=${inputs.engine}`,
+		`fast=${inputs.fast}`,
+		`viewport=${inputs.viewport ? `${inputs.viewport.width}x${inputs.viewport.height}` : ""}`,
+		`baseUrl=${inputs.baseUrl ?? ""}`,
+		`timeout=${inputs.timeoutMs ?? ""}`,
+		`headers=${createHash("sha256").update(headers).digest("hex")}`
+	].join("\n")).digest("hex");
+}
+/**
+* Open the cache for a run, discarding it if anything about the run changed.
+*
+* Everything is read up front and held in memory: an audit asks about every
+* page before it audits any, the entries are small, and a synchronous answer
+* is what lets the caller decide whether to import an engine at all.
+*/
+async function openCache(inputs, options = {}) {
+	const root = path.resolve(options.cwd ?? process.cwd(), options.dir ?? ".eaa-kit/cache");
+	const key = inputsKey(inputs);
+	const today = isoDate(options.today ?? /* @__PURE__ */ new Date());
+	const entries = await manifestMatches(root, key) ? await readEntries(root) : /* @__PURE__ */ new Map();
+	const written = /* @__PURE__ */ new Map();
+	return {
+		get(page) {
+			return entries.get(pageKey(page));
+		},
+		put(page, audit) {
+			if (audit.error !== void 0) return;
+			written.set(pageKey(page), toEntry(page, audit, today));
+		},
+		async flush() {
+			if (written.size === 0) return;
+			try {
+				await mkdir(root, { recursive: true });
+				await writeFile(path.join(root, MANIFEST_FILE), `${JSON.stringify({
+					schemaVersion: 1,
+					key,
+					createdOn: today
+				}, null, 2)}\n`, "utf8");
+				await Promise.all([...written].map(([hash, entry]) => writeFile(path.join(root, `${hash}.json`), `${JSON.stringify(entry)}\n`, "utf8")));
+			} catch {}
+		}
+	};
+}
+/**
+* Whether the stored cache was produced under the same conditions as this run.
+*
+* A mismatch empties the directory rather than leaving entries to be stepped
+* over. They can never be read again — the key that would reach them is gone —
+* and leaving them would grow `.eaa-kit/` without limit.
+*/
+async function manifestMatches(root, key) {
+	let raw;
+	try {
+		raw = await readFile(path.join(root, MANIFEST_FILE), "utf8");
+	} catch {
+		return false;
+	}
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		await discard(root);
+		return false;
+	}
+	const result = safeParse(manifestSchema, parsed);
+	if (!result.success || result.data.schemaVersion !== 1 || result.data.key !== key) {
+		await discard(root);
+		return false;
+	}
+	return true;
+}
+async function discard(root) {
+	try {
+		await rm(root, {
+			recursive: true,
+			force: true
+		});
+	} catch {}
+}
+/** Every entry in the directory, keyed by page hash. A bad file is skipped. */
+async function readEntries(root) {
+	let files;
+	try {
+		files = await readdir(root);
+	} catch {
+		return /* @__PURE__ */ new Map();
+	}
+	const entries = /* @__PURE__ */ new Map();
+	await Promise.all(files.filter((file) => file.endsWith(".json") && file !== MANIFEST_FILE).map(async (file) => {
+		try {
+			const parsed = JSON.parse(await readFile(path.join(root, file), "utf8"));
+			const result = safeParse(entrySchema, parsed);
+			if (!result.success || result.data.schemaVersion !== 1) return;
+			entries.set(path.basename(file, ".json"), result.data);
+		} catch {}
+	}));
+	return entries;
+}
+/** The parts of a result that describe the page rather than the run. */
+function toEntry(page, audit, today) {
+	return {
+		schemaVersion: 1,
+		page: page.relativePath,
+		cachedOn: today,
+		violations: audit.violations,
+		incomplete: audit.incomplete,
+		passes: audit.passes,
+		inapplicable: audit.inapplicable
+	};
+}
+/**
+* A stored result, put back together as this run's audit.
+*
+* The page's own facts come from the cache; everything about *this* run — where
+* the file is, what URL it is audited under, which engine is running — comes
+* from the run, because those are not properties of the result. `durationMs` is
+* zero rather than the duration of a run that happened on another day, and
+* `reused` is what stops every consumer downstream from mistaking this for work
+* that was done just now.
+*/
+function fromEntry(entry, page, context) {
+	return {
+		relativePath: page.relativePath,
+		absolutePath: page.absolutePath,
+		url: context.url,
+		engine: context.engine,
+		violations: entry.violations,
+		incomplete: entry.incomplete,
+		passes: entry.passes,
+		inapplicable: entry.inapplicable,
+		durationMs: 0,
+		reused: { on: entry.cachedOn }
+	};
+}
+//#endregion
+export { fromEntry, openCache };

package/dist/checklist-DDd9jewi.js

@@ -0,0 +1,44 @@
+import { n as count } from "./text-BF1LHMiV.js";
+import { a as emitDocument, o as fail, s as note } from "./command-3r4fht5f.js";
+import "./review-CdMK2GpQ.js";
+import { access } from "node:fs/promises";
+import path from "node:path";
+//#region src/cli/checklist.ts
+async function runChecklistCommand(options = {}) {
+	const cwd = options.cwd ?? process.cwd();
+	const recordPath = options.record ?? "eaa-review.json";
+	const { WCAG22_AA_CRITERIA } = await import("./coverage-n1X9CkiG.js");
+	const { answeredCount, blankReview, readReview, ReviewError, writeReview } = await import("./review-DIbOTmOM.js");
+	let existing;
+	try {
+		existing = await readReview(recordPath, cwd);
+	} catch (cause) {
+		if (!(cause instanceof ReviewError)) throw cause;
+		if (await exists(path.resolve(cwd, recordPath))) {
+			fail(cause.message);
+			return { exitCode: 2 };
+		}
+	}
+	const record = blankReview(WCAG22_AA_CRITERIA, existing);
+	if (options.reviewedBy !== void 0) record.reviewedBy = options.reviewedBy;
+	await writeReview(recordPath, record, cwd);
+	note(existing === void 0 ? `Review record written to ${recordPath}` : `Review record updated at ${recordPath}: ${count(answeredCount(record), "criterion")} already answered`);
+	const { buildWorksheet } = await import("./worksheet-BIxMtbUd.js");
+	await emitDocument(buildWorksheet({
+		recordPath,
+		review: record
+	}), options.output, cwd);
+	if (options.output !== void 0) note(`Worksheet written to ${options.output}`);
+	note("Answers go in the record; the worksheet is generated and never read back.");
+	return { exitCode: 0 };
+}
+async function exists(target) {
+	try {
+		await access(target);
+		return true;
+	} catch {
+		return false;
+	}
+}
+//#endregion
+export { runChecklistCommand };

package/dist/cli/index.js

@@ -1,14 +1,15 @@
 #!/usr/bin/env node
-import { a as impactRank, n as IMPACT_LEVELS, o as isImpactLevel, s as meetsThreshold, t as DEFAULT_FAIL_ON } from "../impact-DZt2oBCP.js";
+import { c as meetsThreshold, n as IMPACT_LEVELS, o as impactRank, s as isImpactLevel, t as DEFAULT_FAIL_ON } from "../impact-luGCnN8F.js";
 import { c as nullable, d as optional, h as string, l as number, m as safeParse, n as boolean, p as record, t as array, u as object, y as withDefault } from "../schema-DJSF4K05.js";
-import { c as ConfigError, i as loadConfig, s as COUNTRIES, u as STATEMENT_LOCALES } from "../load-yAR4wzez.js";
-import { i as readAuditReport, o as StatementError, t as renderStatement } from "../render-DbGOVmhx.js";
-import { n as count, t as collapse } from "../text-CKKpzkYM.js";
+import { c as ConfigError, i as loadConfig, s as COUNTRIES, u as STATEMENT_LOCALES } from "../load-BaWMa-G_.js";
+import { c as StatementError, i as readAuditReport, o as checkStatementEvidence, s as refuses, t as renderStatement } from "../render-C1sUZZI_.js";
+import { n as count, t as collapse } from "../text-BF1LHMiV.js";
 import { t as TOOL_VERSION } from "../version-B3v4rNoG.js";
 import { t as elementFingerprint } from "../fingerprint-BjYV_0F7.js";
-import { i as buildBaseline, n as DEFAULT_BASELINE_FILE, s as writeBaseline, t as BaselineError } from "../baseline-CuAS2lMk.js";
-import { n as runAuditCommand, r as resolvePages, t as OUTPUT_FORMATS } from "../audit-B282A3EA.js";
-import { a as emitDocument, c as runEngine, i as baselineInvocation, l as warn, n as auditDefaults, o as fail, r as auditInvocation, s as note, t as advise } from "../command-C3D7JWn6.js";
+import { a as pruneBaseline, c as writeBaseline, i as buildBaseline, n as DEFAULT_BASELINE_FILE, o as readBaseline, r as applyBaseline, t as BaselineError } from "../baseline-BpE7DbDq.js";
+import { a as emitDocument, c as runEngine, d as parseHeader, i as baselineInvocation, l as warn, n as auditDefaults, o as fail, r as auditInvocation, s as note, t as advise, u as basicAuth } from "../command-3r4fht5f.js";
+import { t as DEFAULT_REVIEW_FILE } from "../review-CdMK2GpQ.js";
+import { n as runAuditCommand, r as resolvePages, t as OUTPUT_FORMATS } from "../audit-DRjAY2iY.js";
 import { enableCompileCache } from "node:module";
 import { readFile } from "node:fs/promises";
 import path from "node:path";
@@ -42,6 +43,7 @@ async function runBaselineCommand(dir, options = {}) {
 	const baseUrl = options.baseUrl ?? origin;
 	const audits = await runEngine(pages, {
 		cwd,
+		...options.headers === void 0 ? {} : { headers: options.headers },
 		...baseUrl === void 0 ? {} : { baseUrl },
 		...options.timeoutMs === void 0 ? {} : { timeoutMs: options.timeoutMs },
 		...options.browser ? { browser: true } : {},
@@ -60,11 +62,12 @@ async function runBaselineCommand(dir, options = {}) {
 			exitCode: 2
 		};
 	}
+	const target = options.output ?? "eaa-baseline.json";
+	if (options.prune) return await prune(audits, target, cwd);
 	const baseline = buildBaseline(audits, {
 		...options.note ? { note: options.note } : {},
 		...options.expiresOn ? { expiresOn: options.expiresOn } : {}
 	});
-	const target = options.output ?? "eaa-baseline.json";
 	try {
 		await writeBaseline(target, baseline, cwd);
 	} catch (cause) {
@@ -78,13 +81,60 @@ async function runBaselineCommand(dir, options = {}) {
 		throw cause;
 	}
 	const entries = baseline.entries.length;
-	note(`Wrote ${entries} ${entries === 1 ? "entry" : "entries"} to ${target}`);
+	note(`Wrote ${count(entries, "entry")} to ${target}`);
 	if (entries > 0) advise("These are barriers, not exceptions. Commit the file, then work the list down.");
 	return {
 		entries,
 		exitCode: 0
 	};
 }
+/**
+* `--prune`: take out what this run shows is gone, and add nothing.
+*
+* The audit already tells anybody running it that entries no longer match and
+* can be removed. Acting on that advice meant editing JSON by hand, entry by
+* entry, against a file whose whole purpose is that nobody has to remember what
+* is in it — so most people did not, and a baseline accumulated barriers that
+* were fixed years ago while looking exactly like one that had not been read.
+*
+* Recording a new baseline is not the same operation and is not a substitute:
+* it accepts whatever the site fails today, which on a bad day quietly adopts a
+* barrier nobody agreed to.
+*/
+async function prune(audits, target, cwd) {
+	let existing;
+	try {
+		existing = await readBaseline(target, cwd);
+	} catch (cause) {
+		if (cause instanceof BaselineError) {
+			fail(cause.message);
+			return {
+				entries: 0,
+				exitCode: 2
+			};
+		}
+		throw cause;
+	}
+	const outcome = applyBaseline(audits, existing);
+	const { baseline, removed } = pruneBaseline(existing, outcome.stale);
+	if (removed.length === 0) {
+		note(`Nothing to remove from ${target}: every entry still matches something on this run`);
+		return {
+			entries: existing.entries.length,
+			removed: 0,
+			exitCode: 0
+		};
+	}
+	await writeBaseline(target, baseline, cwd);
+	note(`Removed ${count(removed.length, "entry")} from ${target}; ${count(baseline.entries.length, "entry")} left`);
+	for (const entry of removed) note(`  ${entry.page}  ${entry.ruleId}`);
+	if (outcome.expired.length > 0) advise(`${count(outcome.expired.length, "entry")} have expired and suppress nothing; --prune leaves them for you to decide about`);
+	return {
+		entries: baseline.entries.length,
+		removed: removed.length,
+		exitCode: 0
+	};
+}
 var DiffError = class extends Error {
 	name = "DiffError";
 };
@@ -105,6 +155,8 @@ const reportSchema = object({
 	pages: withDefault(array(object({
 		path: string(),
 		error: withDefault(nullable(string()), () => null),
+		/** Present when the later run reused this page rather than auditing it. */
+		reusedFrom: optional(string()),
 		violations: withDefault(array(object({
 			ruleId: string(),
 			impact: withDefault(nullable(string()), () => null),
@@ -155,9 +207,22 @@ function entriesOf(report) {
 	}
 	return entries;
 }
-/** Pages a run reached a verdict on. A page that errored is not one of them. */
+/**
+* Pages a run reached a verdict on *itself*.
+*
+* A page that errored is not one of them, and neither is a page whose result
+* was reused from a cache: this comparison exists to say what changed between
+* two runs, and a run that did not look at a page learned nothing about it. The
+* difference matters in one direction only, and it is the direction that lies —
+* a violation present in the earlier report and absent from a reused page would
+* otherwise be announced as fixed, which is a changelog of work nobody did.
+*
+* A report written before reuse existed carries no marker, and is read exactly
+* as it was meant when it was written: those runs audited every page they
+* listed.
+*/
 function auditedPages(report) {
-	return new Set(report.pages.filter((page) => page.error === null).map((page) => page.path));
+	return new Set(report.pages.filter((page) => page.error === null && page.reusedFrom === void 0).map((page) => page.path));
 }
 function sideOf(report) {
 	return {
@@ -353,10 +418,28 @@ async function runStatementCommand(options = {}) {
 		});
 		let audit;
 		if (options.audit) audit = await readAuditReport(options.audit, options.cwd ?? process.cwd());
+		let review;
+		if (options.review) {
+			const { readReview } = await import("../review-DIbOTmOM.js");
+			review = await readReview(options.review, options.cwd ?? process.cwd());
+		}
+		const problems = checkStatementEvidence({
+			config,
+			...audit ? { audit } : {},
+			...review ? { review } : {}
+		});
+		for (const problem of problems) if (problem.severity === "refuses") fail(problem.message);
+		else advise(problem.message);
+		if (refuses(problems)) return {
+			document: "",
+			format,
+			exitCode: 2
+		};
 		const statement = await renderStatement(config, {
 			...options.locale ? { locale: options.locale } : {},
 			...options.country ? { country: options.country } : {},
-			...audit ? { audit } : {}
+			...audit ? { audit } : {},
+			...review ? { review } : {}
 		});
 		note(`Statement for ${config.site.url} from ${path.basename(configPath)} (${statement.template}, ${format})`);
 		if (audit) {
@@ -374,7 +457,8 @@ async function runStatementCommand(options = {}) {
 			exitCode: 0
 		};
 	} catch (cause) {
-		if (cause instanceof ConfigError || cause instanceof StatementError) {
+		const { ReviewError } = await import("../review-DIbOTmOM.js");
+		if (cause instanceof ConfigError || cause instanceof StatementError || cause instanceof ReviewError) {
 			fail(cause.message);
 			if (cause instanceof ConfigError) for (const issue of cause.issues) note(`  ${issue}`);
 			return {
@@ -453,31 +537,60 @@ const parseFormat = oneOf(OUTPUT_FORMATS);
 const parsePositive = wholeNumber(1);
 const parseDepth = wholeNumber(0);
 const parseConcurrency = wholeNumber(1);
+/**
+* `--header` repeated, collected into a list the command turns into a record.
+*
+* Validated here so a typo stops the run before a site is crawled with a
+* malformed credential — and the error names the header rather than repeating
+* the value, because a bad `--header` is exactly the case where the value is a
+* token and the terminal is a CI log.
+*/
+function collectHeader(value, previous = []) {
+	try {
+		parseHeader(value);
+	} catch (cause) {
+		throw new InvalidArgumentError(cause instanceof Error ? cause.message : String(cause));
+	}
+	return [...previous, value];
+}
+function parseBasicAuth(value) {
+	try {
+		basicAuth(value);
+	} catch (cause) {
+		throw new InvalidArgumentError(cause instanceof Error ? cause.message : String(cause));
+	}
+	return value;
+}
 const program = new Command();
 program.exitOverride();
 program.name("eaa-kit").description("WCAG 2.2 AA auditor and EU accessibility statement generator for static sites.\nNot legal advice.").version(TOOL_VERSION, "-v, --version");
-program.command("audit").description("Audit built HTML against WCAG 2.2 AA").argument("[dir]", "directory holding the built site (default: found automatically)").option("--include <globs...>", "glob patterns to audit, relative to dir").option("--exclude <globs...>", "glob patterns to skip").option("--base-url <url>", "audit pages under their real site URL").option("--url <url>", "audit a running site instead of a build directory").option("--no-build", "never run the project build or start its server").option("--per-page", "also list every page and its result").option("--manual", "what to check by hand for the rules this engine cannot evaluate").option("--coverage", "list every WCAG 2.2 A/AA criterion and what this run reached on it").option("--allow-remote", "allow --url to crawl a host that is not localhost").option("--ignore-robots", "crawl paths robots.txt disallows").option("--sitemap <path>", "where the site lists its pages, if not /sitemap.xml").option("--max-pages <n>", "stop the crawl after this many pages", parsePositive).option("--max-depth <n>", "how far from the entry URL to follow links", parseDepth).option("--fail-on <impact>", `exit 1 on violations at or above this impact (${IMPACT_LEVELS.join("|")}; default: ${DEFAULT_FAIL_ON})`, parseImpact).option("--format <format>", `output format (${OUTPUT_FORMATS.join("|")}; default: console)`, parseFormat).option("--output <path>", "write the report to a file instead of stdout").option("--browser", "audit in real Chromium, covering the rules jsdom cannot evaluate").option("--fast", "skip the rules the browserless engine cannot decide anyway, losing their element lists").option("--concurrency <n>", "pages to audit at once, or 1 for none (default: from the page and core count)", parseConcurrency).option("--baseline <path>", "accept the violations recorded in this file; fail only on new ones").option("--config <path>", "take defaults from this config file, otherwise it is searched for").action(async (dir, flags) => {
+program.command("audit").description("Audit built HTML against WCAG 2.2 AA").argument("[dir]", "directory holding the built site (default: found automatically)").option("--include <globs...>", "glob patterns to audit, relative to dir").option("--exclude <globs...>", "glob patterns to skip").option("--base-url <url>", "audit pages under their real site URL").option("--url <url>", "audit a running site instead of a build directory").option("--no-build", "never run the project build or start its server").option("--per-page", "also list every page and its result").option("--manual", "what to check by hand for the rules this engine cannot evaluate").option("--coverage", "list every WCAG 2.2 A/AA criterion and what this run reached on it").option("--allow-remote", "allow --url to crawl a host that is not localhost").option("--ignore-robots", "crawl paths robots.txt disallows").option("--sitemap <path>", "where the site lists its pages, if not /sitemap.xml").option("--max-pages <n>", "stop the crawl after this many pages", parsePositive).option("--max-depth <n>", "how far from the entry URL to follow links", parseDepth).option("--header <header>", "send this header with every request, e.g. \"Authorization: Bearer …\". Repeatable", collectHeader).option("--basic-auth <user:password>", "send an Authorization header for basic auth", parseBasicAuth).option("--fail-on <impact>", `exit 1 on violations at or above this impact (${IMPACT_LEVELS.join("|")}; default: ${DEFAULT_FAIL_ON})`, parseImpact).option("--format <format>", `output format (${OUTPUT_FORMATS.join("|")}; default: console)`, parseFormat).option("--output <path>", "write the report to a file instead of stdout").option("--browser", "audit in real Chromium, covering the rules jsdom cannot evaluate").option("--fast", "skip the rules the browserless engine cannot decide anyway, losing their element lists").option("--concurrency <n>", "pages to audit at once, or 1 for none (default: from the page and core count)", parseConcurrency).option("--baseline <path>", "accept the violations recorded in this file; fail only on new ones").option("--no-cache", "audit every page, reusing no result from an earlier run").option("--review <path>", "what a person checked, from eaa-kit checklist").option("--review-max-age <days>", "stop counting review entries older than this", parseDepth).option("--config <path>", "take defaults from this config file, otherwise it is searched for").action(async (dir, flags) => {
 	const defaults = await auditDefaults({ ...flags.config ? { config: flags.config } : {} });
 	const invocation = auditInvocation(dir, defaults, flags);
 	const { exitCode } = await runAuditCommand(invocation.dir, invocation.options);
 	process.exitCode = exitCode;
 });
-program.command("baseline").description("Record the violations a build already has, so later runs fail only on new ones").argument("[dir]", "directory holding the built site (default: ./dist)").option("--include <globs...>", "glob patterns to audit, relative to dir").option("--exclude <globs...>", "glob patterns to skip").option("--base-url <url>", "audit pages under their real site URL").option("--url <url>", "record a baseline from a running site instead of a directory").option("--allow-remote", "allow --url to crawl a host that is not localhost").option("--ignore-robots", "crawl paths robots.txt disallows").option("--sitemap <path>", "where the site lists its pages, if not /sitemap.xml").option("--max-pages <n>", "stop the crawl after this many pages", parsePositive).option("--max-depth <n>", "how far from the entry URL to follow links", parseDepth).option("--output <path>", `where to write it (default: ${DEFAULT_BASELINE_FILE})`).option("--note <text>", "recorded on every entry, for whoever reads the file").option("--expires-on <date>", "ISO date after which the entries stop suppressing", parseDate).option("--browser", "audit in real Chromium instead of jsdom").option("--concurrency <n>", "pages to audit at once, or 1 for none", parseConcurrency).option("--config <path>", "take defaults from this config file, otherwise it is searched for").action(async (dir, flags) => {
+program.command("baseline").description("Record the violations a build already has, so later runs fail only on new ones").argument("[dir]", "directory holding the built site (default: ./dist)").option("--include <globs...>", "glob patterns to audit, relative to dir").option("--exclude <globs...>", "glob patterns to skip").option("--base-url <url>", "audit pages under their real site URL").option("--url <url>", "record a baseline from a running site instead of a directory").option("--allow-remote", "allow --url to crawl a host that is not localhost").option("--ignore-robots", "crawl paths robots.txt disallows").option("--sitemap <path>", "where the site lists its pages, if not /sitemap.xml").option("--max-pages <n>", "stop the crawl after this many pages", parsePositive).option("--max-depth <n>", "how far from the entry URL to follow links", parseDepth).option("--header <header>", "send this header with every request, e.g. \"Authorization: Bearer …\". Repeatable", collectHeader).option("--basic-auth <user:password>", "send an Authorization header for basic auth", parseBasicAuth).option("--output <path>", `where to write it (default: ${DEFAULT_BASELINE_FILE})`).option("--prune", "remove the entries this run shows are gone, instead of recording a new baseline").option("--note <text>", "recorded on every entry, for whoever reads the file").option("--expires-on <date>", "ISO date after which the entries stop suppressing", parseDate).option("--browser", "audit in real Chromium instead of jsdom").option("--concurrency <n>", "pages to audit at once, or 1 for none", parseConcurrency).option("--config <path>", "take defaults from this config file, otherwise it is searched for").action(async (dir, flags) => {
 	const defaults = await auditDefaults({ ...flags.config ? { config: flags.config } : {} });
 	const invocation = baselineInvocation(dir, defaults, flags);
 	const { exitCode } = await runBaselineCommand(invocation.dir, invocation.options);
 	process.exitCode = exitCode;
 });
+program.command("checklist").description("Write the manual review: the 34 WCAG criteria no automated rule can reach").option("--record <path>", `where the answers live (default: ${DEFAULT_REVIEW_FILE})`).option("--output <path>", "write the worksheet here instead of stdout").option("--reviewed-by <name>", "who is carrying out the review").action(async (flags) => {
+	const { runChecklistCommand } = await import("../checklist-DDd9jewi.js");
+	const { exitCode } = await runChecklistCommand(flags);
+	process.exitCode = exitCode;
+});
 program.command("diff").description("Compare two JSON reports: what a change made worse, and what it fixed").argument("<before>", "JSON report from before the change").argument("<after>", "JSON report from after it").option("--format <format>", `output format (${DIFF_FORMATS.join("|")})`, oneOf(DIFF_FORMATS)).option("--output <path>", "write the diff here instead of stdout").option("--fail-on <impact>", `exit 1 on NEW violations at or above this impact (${IMPACT_LEVELS.join("|")})`, parseImpact, DEFAULT_FAIL_ON).action(async (before, after, flags) => {
 	const { exitCode } = await runDiffCommand(before, after, flags);
 	process.exitCode = exitCode;
 });
 program.command("init").description("Write an eaa.config.json to generate statements from").option("--output <path>", "write here instead of eaa.config.json").option("--force", "overwrite a config that is already there").option("-y, --yes", "take every default without asking").action(async (flags) => {
-	const { runInitCommand } = await import("../init-CW7LfGT5.js");
+	const { runInitCommand } = await import("../init-DrFfzjvm.js");
 	const { exitCode } = await runInitCommand(flags);
 	process.exitCode = exitCode;
 });
-program.command("statement").description("Generate an EU accessibility statement from eaa.config").option("--config <path>", "path to the config file, otherwise it is searched for").option("--lang <locale>", `statement language (${STATEMENT_LOCALES.join("|")})`, parseLocale).option("--country <code>", `override the country template (${COUNTRIES.join("|")})`, parseCountry).option("--audit <path>", "list the barriers from an eaa-kit audit --format json report").option("--format <format>", `output format (${STATEMENT_FORMATS.join("|")}), otherwise from the --output extension`, parseStatementFormat).option("--output <path>", "write the statement to a file instead of stdout").action(async (flags) => {
+program.command("statement").description("Generate an EU accessibility statement from eaa.config").option("--config <path>", "path to the config file, otherwise it is searched for").option("--lang <locale>", `statement language (${STATEMENT_LOCALES.join("|")})`, parseLocale).option("--country <code>", `override the country template (${COUNTRIES.join("|")})`, parseCountry).option("--audit <path>", "list the barriers from an eaa-kit audit --format json report").option("--review <path>", "say how many criteria a person checked, and check the conformance claim against them").option("--format <format>", `output format (${STATEMENT_FORMATS.join("|")}), otherwise from the --output extension`, parseStatementFormat).option("--output <path>", "write the statement to a file instead of stdout").action(async (flags) => {
 	const { lang, ...options } = flags;
 	const { exitCode } = await runStatementCommand({
 		...options,