eaa-kit 0.5.0 → 0.7.0

package/dist/{command-C3D7JWn6.js → command-3r4fht5f.js}

@@ -1,6 +1,86 @@
 import { mkdir, writeFile } from "node:fs/promises";
 import path from "node:path";
 import pc from "picocolors";
+//#region src/audit/headers.ts
+/**
+* Request headers for the pages this tool fetches.
+*
+* The two places a small agency stages work are the two this tool could not
+* reach: a preview deployment, which every host protects by default, and a CMS
+* staging site behind basic auth or a session cookie. `--url` sent one fixed
+* pair of headers and had no way to add to it, so auditing either meant putting
+* the site on the public internet first.
+*
+* These values are credentials. They are handled on the principle that the tool
+* never writes one down: nothing here reaches a report, a baseline, a SARIF log
+* or the completeness record, and the errors below name the header rather than
+* echoing what was typed, because a malformed `--header` is exactly the case
+* where the value is a token and the terminal is a CI log.
+*
+* For the same reason there is no `headers` key in `eaa.config`. That file is
+* committed; a token in it is a token in the repository, and a tool that
+* offered the field would be inviting that. Pass them as flags — a shell
+* expands `--header "Authorization: Bearer $TOKEN"` — or as the GitHub Action's
+* input, which reads from `secrets`.
+*/
+/** Thrown for a header this cannot parse. Never carries the value. */
+var HeaderError = class extends Error {
+	name = "HeaderError";
+};
+/**
+* `Name: value` into a pair.
+*
+* Lenient about the space after the colon and about a value containing colons,
+* which `Authorization: Basic …` and a `Cookie` both do. Strict about the name,
+* because a header name is a token by RFC 9110 and anything else is a typo that
+* a server would reject in a way nobody could read.
+*/
+function parseHeader(input) {
+	const at = input.indexOf(":");
+	if (at <= 0) throw new HeaderError("a header must be written \"Name: value\"");
+	const name = input.slice(0, at).trim();
+	const value = input.slice(at + 1).trim();
+	if (!/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/.test(name)) throw new HeaderError(`"${name}" is not a valid header name`);
+	if (value === "") throw new HeaderError(`the ${name} header was given no value`);
+	if (/[\r\n]/.test(value)) throw new HeaderError(`the ${name} header contains a line break`);
+	return [name, value];
+}
+/** Several `Name: value` strings into the record the fetchers take. */
+function parseHeaders(inputs) {
+	const headers = {};
+	for (const input of inputs) {
+		const [name, value] = parseHeader(input);
+		headers[name] = value;
+	}
+	return headers;
+}
+/**
+* `user:password` into an `Authorization` header.
+*
+* Sugar for the header somebody would otherwise have to base64 by hand, which
+* is the one credential a staging site is most likely to be behind. A password
+* may contain colons; a username may not, which is basic auth's own rule.
+*/
+function basicAuth(input) {
+	if (input.indexOf(":") <= 0) throw new HeaderError("basic auth must be written \"user:password\"");
+	return ["Authorization", `Basic ${Buffer.from(input, "utf8").toString("base64")}`];
+}
+/**
+* The headers a run will send, from whichever flags were given.
+*
+* `--basic-auth` first, so an explicit `--header "Authorization: …"` beats it:
+* a typed header is the more specific thing to have asked for.
+*/
+function requestHeaders(options) {
+	const headers = {};
+	if (options.basicAuth !== void 0) {
+		const [name, value] = basicAuth(options.basicAuth);
+		headers[name] = value;
+	}
+	Object.assign(headers, parseHeaders(options.header ?? []));
+	return Object.keys(headers).length === 0 ? void 0 : headers;
+}
+//#endregion
 //#region src/cli/command.ts
 /**
 * What every command does around the audit itself: say what is happening, run
@@ -42,18 +122,19 @@ async function runEngine(pages, options) {
 		...options.timeoutMs === void 0 ? {} : { timeoutMs: options.timeoutMs }
 	};
 	if (!options.browser) {
-		const { runPooledAudit } = await import("./pool-BO25OIez.js");
+		const { runPooledAudit } = await import("./pool-B4tEUa2S.js");
 		return runPooledAudit(pages, {
 			...runnerOptions,
 			...options.fast ? { fast: true } : {},
 			...options.concurrency === void 0 ? {} : { concurrency: options.concurrency }
 		});
 	}
-	const { BrowserUnavailableError, runBrowserAudit } = await import("./playwright-BojtYVUa.js");
+	const { BrowserUnavailableError, runBrowserAudit } = await import("./playwright-ukCr_5o3.js");
 	try {
 		return await runBrowserAudit(options.directory, pages, {
 			...runnerOptions,
-			...options.concurrency === void 0 ? {} : { concurrency: options.concurrency }
+			...options.concurrency === void 0 ? {} : { concurrency: options.concurrency },
+			...options.headers === void 0 ? {} : { headers: options.headers }
 		});
 	} catch (cause) {
 		if (cause instanceof BrowserUnavailableError) {
@@ -95,7 +176,7 @@ async function emitDocument(body, output, cwd) {
 * on different settings than it names would be worse than stopping.
 */
 async function auditDefaults(options = {}) {
-	const { loadAuditConfig } = await import("./load-CFq2VQtT.js");
+	const { loadAuditConfig } = await import("./load-n62iXDq_.js");
 	const loaded = await loadAuditConfig({
 		...options.cwd ? { cwd: options.cwd } : {},
 		...options.config ? { path: options.config } : {}
@@ -105,14 +186,20 @@ async function auditDefaults(options = {}) {
 	return loaded.audit;
 }
 function auditInvocation(dir, defaults, flags) {
-	const { build, config: _config, ...typed } = flags;
-	const { dir: configDir, build: configBuild, ...fromConfig } = defaults;
+	const { build, cache, config: _config, header, basicAuth, ...typed } = flags;
+	const { dir: configDir, build: configBuild, cache: configCache, headers: _fromFile, ...fromConfig } = defaults;
+	const headers = requestHeaders({
+		...header ? { header } : {},
+		...basicAuth ? { basicAuth } : {}
+	});
 	return {
 		dir: dir ?? configDir,
 		options: {
 			...fromConfig,
 			...typed,
-			...build === false || configBuild === false ? { noBuild: true } : {}
+			...build === false || configBuild === false ? { noBuild: true } : {},
+			...cache === false || configCache === false ? { noCache: true } : {},
+			...headers === void 0 ? {} : { headers }
 		}
 	};
 }
@@ -126,12 +213,17 @@ function auditInvocation(dir, defaults, flags) {
 * and `baseline` all describe a verdict this command does not reach.
 */
 function baselineInvocation(dir, defaults, flags) {
-	const { config: _config, ...typed } = flags;
+	const { config: _config, header, basicAuth, ...typed } = flags;
+	const headers = requestHeaders({
+		...header ? { header } : {},
+		...basicAuth ? { basicAuth } : {}
+	});
 	return {
 		dir: dir ?? defaults.dir ?? "./dist",
 		options: {
 			...baselineDefaults(defaults),
-			...typed
+			...typed,
+			...headers === void 0 ? {} : { headers }
 		}
 	};
 }
@@ -157,4 +249,4 @@ function pick(source, keys) {
 	return out;
 }
 //#endregion
-export { emitDocument as a, runEngine as c, baselineInvocation as i, warn as l, auditDefaults as n, fail as o, auditInvocation as r, note as s, advise as t };
+export { emitDocument as a, runEngine as c, parseHeader as d, baselineInvocation as i, warn as l, auditDefaults as n, fail as o, auditInvocation as r, note as s, advise as t, basicAuth as u };

package/dist/{component-C3GL1Mnu.js → component-ChisoFyY.js}

@@ -1,5 +1,5 @@
 import { i as toPosix } from "./fs-BmPtmFke.js";
-import { t as collapse } from "./text-CKKpzkYM.js";
+import { t as collapse } from "./text-BF1LHMiV.js";
 import { readFile } from "node:fs/promises";
 import path from "node:path";
 import { glob } from "tinyglobby";

package/dist/{component-DKd3EHOg.js → component-DcCn3BJS.js}

@@ -1,2 +1,2 @@
-import { n as componentFor, t as buildComponentIndex } from "./component-C3GL1Mnu.js";
+import { n as componentFor, t as buildComponentIndex } from "./component-ChisoFyY.js";
 export { buildComponentIndex, componentFor };

package/dist/{coverage-B_Y6l-Ra.js → coverage-cb5kPp48.js}

@@ -1,4 +1,6 @@
-import { d as successCriteria, n as DEFAULT_TAGS, r as ENGINE_BLIND_RULES } from "./result-BWcYXeRs.js";
+import { t as WCAG22_AA_CRITERIA } from "./criteria-CnPJKGeb.js";
+import { n as DEFAULT_TAGS, p as successCriteria, r as ENGINE_BLIND_RULES } from "./result-B7_zVxAX.js";
+import { s as criterionReview } from "./review-CdMK2GpQ.js";
 import axe from "axe-core";
 //#region src/audit/manual.ts
 /**
@@ -137,289 +139,6 @@ function manualCheckFor(ruleId) {
 //#endregion
 //#region src/audit/coverage.ts
 /**
-* WCAG 2.2 at Levels A and AA, which is what this tool audits against.
-*
-* 4.1.1 Parsing is deliberately absent: it was removed in WCAG 2.2 and counting
-* it would inflate the denominator with a criterion nobody has to meet.
-*/
-const WCAG22_AA_CRITERIA = [
-	{
-		number: "1.1.1",
-		title: "Non-text Content",
-		level: "A"
-	},
-	{
-		number: "1.2.1",
-		title: "Audio-only and Video-only (Prerecorded)",
-		level: "A"
-	},
-	{
-		number: "1.2.2",
-		title: "Captions (Prerecorded)",
-		level: "A"
-	},
-	{
-		number: "1.2.3",
-		title: "Audio Description or Media Alternative (Prerecorded)",
-		level: "A"
-	},
-	{
-		number: "1.2.4",
-		title: "Captions (Live)",
-		level: "AA"
-	},
-	{
-		number: "1.2.5",
-		title: "Audio Description (Prerecorded)",
-		level: "AA"
-	},
-	{
-		number: "1.3.1",
-		title: "Info and Relationships",
-		level: "A"
-	},
-	{
-		number: "1.3.2",
-		title: "Meaningful Sequence",
-		level: "A"
-	},
-	{
-		number: "1.3.3",
-		title: "Sensory Characteristics",
-		level: "A"
-	},
-	{
-		number: "1.3.4",
-		title: "Orientation",
-		level: "AA"
-	},
-	{
-		number: "1.3.5",
-		title: "Identify Input Purpose",
-		level: "AA"
-	},
-	{
-		number: "1.4.1",
-		title: "Use of Color",
-		level: "A"
-	},
-	{
-		number: "1.4.2",
-		title: "Audio Control",
-		level: "A"
-	},
-	{
-		number: "1.4.3",
-		title: "Contrast (Minimum)",
-		level: "AA"
-	},
-	{
-		number: "1.4.4",
-		title: "Resize Text",
-		level: "AA"
-	},
-	{
-		number: "1.4.5",
-		title: "Images of Text",
-		level: "AA"
-	},
-	{
-		number: "1.4.10",
-		title: "Reflow",
-		level: "AA"
-	},
-	{
-		number: "1.4.11",
-		title: "Non-text Contrast",
-		level: "AA"
-	},
-	{
-		number: "1.4.12",
-		title: "Text Spacing",
-		level: "AA"
-	},
-	{
-		number: "1.4.13",
-		title: "Content on Hover or Focus",
-		level: "AA"
-	},
-	{
-		number: "2.1.1",
-		title: "Keyboard",
-		level: "A"
-	},
-	{
-		number: "2.1.2",
-		title: "No Keyboard Trap",
-		level: "A"
-	},
-	{
-		number: "2.1.4",
-		title: "Character Key Shortcuts",
-		level: "A"
-	},
-	{
-		number: "2.2.1",
-		title: "Timing Adjustable",
-		level: "A"
-	},
-	{
-		number: "2.2.2",
-		title: "Pause, Stop, Hide",
-		level: "A"
-	},
-	{
-		number: "2.3.1",
-		title: "Three Flashes or Below Threshold",
-		level: "A"
-	},
-	{
-		number: "2.4.1",
-		title: "Bypass Blocks",
-		level: "A"
-	},
-	{
-		number: "2.4.2",
-		title: "Page Titled",
-		level: "A"
-	},
-	{
-		number: "2.4.3",
-		title: "Focus Order",
-		level: "A"
-	},
-	{
-		number: "2.4.4",
-		title: "Link Purpose (In Context)",
-		level: "A"
-	},
-	{
-		number: "2.4.5",
-		title: "Multiple Ways",
-		level: "AA"
-	},
-	{
-		number: "2.4.6",
-		title: "Headings and Labels",
-		level: "AA"
-	},
-	{
-		number: "2.4.7",
-		title: "Focus Visible",
-		level: "AA"
-	},
-	{
-		number: "2.4.11",
-		title: "Focus Not Obscured (Minimum)",
-		level: "AA"
-	},
-	{
-		number: "2.5.1",
-		title: "Pointer Gestures",
-		level: "A"
-	},
-	{
-		number: "2.5.2",
-		title: "Pointer Cancellation",
-		level: "A"
-	},
-	{
-		number: "2.5.3",
-		title: "Label in Name",
-		level: "A"
-	},
-	{
-		number: "2.5.4",
-		title: "Motion Actuation",
-		level: "A"
-	},
-	{
-		number: "2.5.7",
-		title: "Dragging Movements",
-		level: "AA"
-	},
-	{
-		number: "2.5.8",
-		title: "Target Size (Minimum)",
-		level: "AA"
-	},
-	{
-		number: "3.1.1",
-		title: "Language of Page",
-		level: "A"
-	},
-	{
-		number: "3.1.2",
-		title: "Language of Parts",
-		level: "AA"
-	},
-	{
-		number: "3.2.1",
-		title: "On Focus",
-		level: "A"
-	},
-	{
-		number: "3.2.2",
-		title: "On Input",
-		level: "A"
-	},
-	{
-		number: "3.2.3",
-		title: "Consistent Navigation",
-		level: "AA"
-	},
-	{
-		number: "3.2.4",
-		title: "Consistent Identification",
-		level: "AA"
-	},
-	{
-		number: "3.2.6",
-		title: "Consistent Help",
-		level: "A"
-	},
-	{
-		number: "3.3.1",
-		title: "Error Identification",
-		level: "A"
-	},
-	{
-		number: "3.3.2",
-		title: "Labels or Instructions",
-		level: "A"
-	},
-	{
-		number: "3.3.3",
-		title: "Error Suggestion",
-		level: "AA"
-	},
-	{
-		number: "3.3.4",
-		title: "Error Prevention (Legal, Financial, Data)",
-		level: "AA"
-	},
-	{
-		number: "3.3.7",
-		title: "Redundant Entry",
-		level: "A"
-	},
-	{
-		number: "3.3.8",
-		title: "Accessible Authentication (Minimum)",
-		level: "AA"
-	},
-	{
-		number: "4.1.2",
-		title: "Name, Role, Value",
-		level: "A"
-	},
-	{
-		number: "4.1.3",
-		title: "Status Messages",
-		level: "AA"
-	}
-];
-/**
 * Rules axe-core would run under these tags, mapped to the criteria they cover.
 *
 * Experimental rules are excluded, matching `blindRulesInScope`: axe-core leaves
@@ -463,7 +182,7 @@ function blindedRules(audits) {
 * the criterion is met on this site, and saying otherwise would be a coverage
 * claim resting on an empty page.
 */
-function buildCoverage(audits, tags = DEFAULT_TAGS) {
+function buildCoverage(audits, tags = DEFAULT_TAGS, review) {
 	const byCriterion = rulesByCriterion(tags);
 	const decided = decidedRules(audits);
 	const blinded = blindedRules(audits);
@@ -496,15 +215,36 @@ function buildCoverage(audits, tags = DEFAULT_TAGS) {
 			browserWouldAnswer: false
 		};
 	});
-	const count = (status) => criteria.filter((criterion) => criterion.status === status).length;
+	const reviewed = review === void 0 ? criteria : criteria.map(withReview(review));
+	const count = (status) => reviewed.filter((criterion) => criterion.status === status).length;
+	const counted = reviewed.filter((criterion) => criterion.review?.counts === true);
 	return {
-		criteria,
+		criteria: reviewed,
 		evaluated: count("evaluated"),
 		notEvaluated: count("not-evaluated"),
 		nothingToCheck: count("nothing-to-check"),
 		noAutomatedRule: count("no-automated-rule"),
-		browserWouldAnswer: criteria.filter((criterion) => criterion.browserWouldAnswer).length,
-		total: WCAG22_AA_CRITERIA.length
+		browserWouldAnswer: reviewed.filter((criterion) => criterion.browserWouldAnswer).length,
+		total: WCAG22_AA_CRITERIA.length,
+		reviewed: counted.length,
+		reviewedNotMet: counted.filter((criterion) => criterion.review?.result === "not-met").length,
+		reviewNotCounted: reviewed.filter((criterion) => criterion.review?.counts === false).length
+	};
+}
+/**
+* Attach what a person recorded, without letting it move what the engine found.
+*
+* `status` is untouched here, deliberately and in every branch: a review adds a
+* second kind of claim beside the run's own, and the moment it could rewrite
+* one the report would stop being a record of what was measured.
+*/
+function withReview(review) {
+	return (criterion) => {
+		const recorded = criterionReview(criterion.number, review, criterion.status === "evaluated");
+		return recorded === void 0 ? criterion : {
+			...criterion,
+			review: recorded
+		};
 	};
 }
 /**
@@ -518,5 +258,20 @@ function coverageSummary(coverage) {
 	const unautomatable = coverage.noAutomatedRule;
 	return `Of the ${coverage.total} WCAG 2.2 A and AA success criteria, ${unautomatable} cannot be checked by any automated engine and need a person. This run reached a verdict on ${coverage.evaluated}.`;
 }
+/**
+* What a person added to the run, in one sentence, or nothing when nobody did.
+*
+* Kept out of `coverageSummary` so the sentence about the engine's reach does
+* not change shape depending on whether a review was supplied — and because a
+* reader has to be able to tell the two claims apart at a glance: one is what
+* an engine measured, the other is what somebody says they checked.
+*/
+function reviewSummary(coverage) {
+	if (coverage.reviewed === 0 && coverage.reviewNotCounted === 0) return void 0;
+	const parts = [`A person recorded a result for ${coverage.reviewed} of the criteria this run did not reach`];
+	if (coverage.reviewedNotMet > 0) parts.push(`${coverage.reviewedNotMet} of them as not met`);
+	if (coverage.reviewNotCounted > 0) parts.push(`${coverage.reviewNotCounted} further entries were not counted`);
+	return `${parts.join("; ")}. This is a claim by a person, not a measurement.`;
+}
 //#endregion
-export { understandingUrl as i, coverageSummary as n, manualCheckFor as r, buildCoverage as t };
+export { manualCheckFor as a, rulesByCriterion as i, coverageSummary as n, understandingUrl as o, reviewSummary as r, buildCoverage as t };

package/dist/coverage-n1X9CkiG.js

@@ -0,0 +1,3 @@
+import { t as WCAG22_AA_CRITERIA } from "./criteria-CnPJKGeb.js";
+import "./coverage-cb5kPp48.js";
+export { WCAG22_AA_CRITERIA };

package/dist/{crawl-BUWPgaGW.js → crawl-BHkJmUkA.js}

@@ -93,7 +93,7 @@ function urlsFromSitemap(xml, origin) {
 	return urls;
 }
 /** One request, with a timeout, returning HTML or a reason it is not a page. */
-async function fetchPage(url, impl, timeoutMs, origin, maxBodyBytes) {
+async function fetchPage(url, impl, timeoutMs, origin, maxBodyBytes, headers) {
 	const controller = new AbortController();
 	const timer = setTimeout(() => controller.abort(), timeoutMs);
 	try {
@@ -102,7 +102,8 @@ async function fetchPage(url, impl, timeoutMs, origin, maxBodyBytes) {
 			redirect: "follow",
 			headers: {
 				accept: "text/html,application/xhtml+xml",
-				"user-agent": "eaa-kit"
+				"user-agent": "eaa-kit",
+				...headers
 			}
 		});
 		if (!response.ok) return {
@@ -213,13 +214,14 @@ function disallowedPaths(robots) {
 * that is not a page. A site that does not publish one is the ordinary case,
 * not a failure, so it comes back empty either way.
 */
-async function fetchSiteFile(entry, impl, name, timeoutMs, maxBodyBytes) {
+async function fetchSiteFile(entry, impl, name, timeoutMs, maxBodyBytes, headers) {
 	const controller = new AbortController();
 	const timer = setTimeout(() => controller.abort(), timeoutMs);
 	try {
 		const response = await impl(new URL(name, entry).href, {
 			redirect: "follow",
-			signal: controller.signal
+			signal: controller.signal,
+			...headers === void 0 ? {} : { headers }
 		});
 		if (!response.ok) return void 0;
 		if (new URL(response.url || new URL(name, entry).href).origin !== entry.origin) return void 0;
@@ -244,7 +246,7 @@ async function crawlSite(entry, options = {}) {
 	const timeoutMs = options.timeoutMs ?? 15e3;
 	const maxBodyBytes = options.maxBodyBytes ?? MAX_BODY_BYTES;
 	const failures = [];
-	const robots = options.ignoreRobots ? void 0 : await fetchSiteFile(entry, impl, "/robots.txt", timeoutMs, maxBodyBytes);
+	const robots = options.ignoreRobots ? void 0 : await fetchSiteFile(entry, impl, "/robots.txt", timeoutMs, maxBodyBytes, options.headers);
 	const blocked = robots === void 0 ? [] : disallowedPaths(robots);
 	const allowed = (url) => !blocked.some((path) => url.pathname.startsWith(path));
 	let discovery = "links";
@@ -258,7 +260,7 @@ async function crawlSite(entry, options = {}) {
 			depth
 		});
 	};
-	const sitemap = await fetchSiteFile(entry, impl, options.sitemap ?? "/sitemap.xml", timeoutMs, maxBodyBytes);
+	const sitemap = await fetchSiteFile(entry, impl, options.sitemap ?? "/sitemap.xml", timeoutMs, maxBodyBytes, options.headers);
 	const listed = sitemap === void 0 ? [] : urlsFromSitemap(sitemap, entry);
 	if (listed.length > 0) {
 		discovery = "sitemap";
@@ -266,11 +268,12 @@ async function crawlSite(entry, options = {}) {
 	}
 	enqueue(entry, 0);
 	const pages = [];
+	const redirects = [];
 	while (queue.length > 0 && pages.length < maxPages) {
 		const batch = queue.splice(0, Math.min(REQUEST_CONCURRENCY, maxPages - pages.length));
 		const results = await Promise.all(batch.map(async (item) => ({
 			item,
-			result: await fetchPage(item.url, impl, timeoutMs, entry.origin, maxBodyBytes)
+			result: await fetchPage(item.url, impl, timeoutMs, entry.origin, maxBodyBytes, options.headers)
 		})));
 		for (const { item, result } of results) {
 			if (!result.ok) {
@@ -281,6 +284,10 @@ async function crawlSite(entry, options = {}) {
 				continue;
 			}
 			const { url, html } = result.value;
+			if (url.href !== item.url.href) redirects.push({
+				requested: item.url.href,
+				landedOn: url.href
+			});
 			pages.push({
 				absolutePath: url.href,
 				relativePath: pageIdentity(url),
@@ -294,11 +301,38 @@ async function crawlSite(entry, options = {}) {
 		pages: byIdentity(pages),
 		origin: entry.origin,
 		failures,
+		redirects,
 		truncated: queue.length > 0,
 		discovery
 	};
 }
 /**
+* The requested URLs that a login wall swallowed, or none.
+*
+* A redirect on its own says nothing: sites normalise trailing slashes and send
+* `/` to `/en/` all day. What is not ordinary is *several* different URLs
+* answering at one address, or a whole crawl coming back as the single page the
+* entry was redirected to. Both are the shape of a sign-in page standing in
+* front of the site, and both otherwise produce a report about a page nobody
+* asked for that says it audited everything it set out to.
+*
+* Returns what was asked for and never reached, which is the one thing the run
+* has to say out loud. Deliberately shy of naming the cause: a single-page site
+* that redirects its entry looks identical from here, and being told where the
+* run actually landed is useful either way.
+*/
+function collapsedOnto(result) {
+	if (result.redirects.length === 0) return [];
+	const byDestination = /* @__PURE__ */ new Map();
+	for (const redirect of result.redirects) byDestination.set(redirect.landedOn, [...byDestination.get(redirect.landedOn) ?? [], redirect.requested]);
+	const collapsed = [];
+	for (const [landedOn, requested] of byDestination) if (requested.length > 1 || result.pages.length === 1) for (const from of requested) collapsed.push({
+		requested: from,
+		landedOn
+	});
+	return collapsed;
+}
+/**
 * One page per identity, in a stable order.
 *
 * The queue already refuses a URL it has seen, so this catches the case the
@@ -315,4 +349,4 @@ function byIdentity(pages) {
 	}).sort((a, b) => a.relativePath.localeCompare(b.relativePath));
 }
 //#endregion
-export { CrawlError, crawlSite, parseEntryUrl };
+export { CrawlError, collapsedOnto, crawlSite, parseEntryUrl };