pagegraph 0.5.0 → 0.6.0

package/dist/audit.js

@@ -1,2 +1,1932 @@
-import { A as defaultAuditOptions, C as ScannerStatus, D as makeAudit, E as InvalidTarget, M as pageRules, O as ScannerRegistryLive, S as ScannerResult, T as AuditLive, _ as compareAuditReports, a as makeHttpScanner, b as AuditReport, c as writeAuditFiles, d as AuditLayer, f as AuditComparisonResult, g as AuditDiffSummary, h as AuditDiffOutcome, i as parseLighthouseResult, j as evaluateRules, k as makeScannerRegistry, l as ScannerFailure, m as AuditDiffChange, n as lighthouseChromeFlags, o as renderAuditDiff, p as AuditDiff, r as makeLighthouseScanner, s as renderAuditMarkdown, t as makeHostedScanner, u as scanner, v as AuditFinding, w as Audit, x as FindingSeverity, y as AuditPolicy } from "./audit-B96V1x3q.js";
+import { r as extractAnchors } from "./links-sGbLkl-7.js";
+import { mkdir, mkdtemp, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import * as Context from "effect/Context";
+import * as Data$1 from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { Data, Schema } from "effect";
+import { createHash } from "node:crypto";
+import { createServer, request } from "node:http";
+import { request as request$1 } from "node:https";
+import { BlockList, connect, isIP } from "node:net";
+import { checkServerIdentity } from "node:tls";
+import { lookup } from "node:dns/promises";
+import { spawn } from "node:child_process";
+import { createRequire } from "node:module";
+import { tmpdir } from "node:os";
+import * as Option from "effect/Option";
+import * as Schema$1 from "effect/Schema";
+//#region src/audit/rules.ts
+const record = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+const stringAt = (value, ...keys) => {
+	let current = value;
+	for (const key of keys) current = record(current)?.[key];
+	return typeof current === "string" ? current : void 0;
+};
+const firstString = (value, paths) => {
+	for (const path of paths) {
+		const found = stringAt(value, ...path);
+		if (found !== void 0) return found;
+	}
+};
+const pageEvidence = (value) => {
+	if (!Array.isArray(value)) return value;
+	return value.find((entry) => stringAt(entry, "kind") === "page-html") ?? value.find((entry) => stringAt(entry, "kind") === "page-head") ?? value[0];
+};
+const finding = (input, rule, message, fix, observed, severity = "structural") => ({
+	scanner: "rules",
+	target: input.target.url,
+	severity,
+	rule,
+	message,
+	fix,
+	...observed === void 0 ? {} : { observed }
+});
+/** Generic page-quality rules. They accept the normalized evidence shape used
+* by HTTP and hosted scanners, while remaining pure and dependency-free. */
+const pageRules = [
+	{
+		id: "http-status",
+		evaluate: (observation, input) => {
+			const status = record(pageEvidence(observation.evidence))?.status;
+			return typeof status === "number" && status >= 400 ? [finding(input, "http-status", `Fetch returned HTTP ${status}.`, "Return a successful HTTP status.", status)] : [];
+		}
+	},
+	{
+		id: "title-length",
+		evaluate: (observation, input) => {
+			const evidence = pageEvidence(observation.evidence);
+			const title = firstString(evidence, [
+				["title"],
+				["document", "title"],
+				["head", "title"]
+			]);
+			const policy = input.options.policy;
+			const min = policy?.titleMinLength ?? 10;
+			const max = policy?.titleMaxLength ?? 70;
+			if (title === void 0 || title.trim() === "") return [finding(input, "missing-title", "Page is missing a usable title.", "Add a descriptive <title>.")];
+			if (title.length < min || title.length > max) return [finding(input, "title-length", `Title length ${title.length} is outside ${min}-${max} characters.`, `Keep the title between ${min} and ${max} characters.`, title, "editorial")];
+			return [];
+		}
+	},
+	{
+		id: "description-length",
+		evaluate: (observation, input) => {
+			const evidence = pageEvidence(observation.evidence);
+			const description = firstString(evidence, [
+				["description"],
+				["metaDescription"],
+				["document", "description"],
+				["head", "description"]
+			]);
+			const policy = input.options.policy;
+			const min = policy?.descriptionMinLength ?? 50;
+			const max = policy?.descriptionMaxLength ?? 160;
+			if (description === void 0 || description.trim() === "") return [finding(input, "missing-description", "Page is missing a meta description.", "Add a concise description that summarizes the page.")];
+			if (description.length < min || description.length > max) return [finding(input, "description-length", `Meta description length ${description.length} is outside ${min}-${max} characters.`, `Keep the meta description between ${min} and ${max} characters.`, description, "editorial")];
+			return [];
+		}
+	},
+	{
+		id: "canonical",
+		evaluate: (observation, input) => {
+			if (input.options.policy?.requireCanonical === false) return [];
+			const canonical = firstString(pageEvidence(observation.evidence), [
+				["canonical"],
+				["canonicalUrl"],
+				["document", "canonical"],
+				["document", "canonicalUrl"],
+				["head", "canonical"]
+			]);
+			if (canonical === void 0) return [finding(input, "missing-canonical", "Page is missing a canonical URL.", "Add a canonical link that identifies the preferred URL.")];
+			try {
+				const observed = new URL(canonical, input.target.url);
+				const expected = new URL(firstString(pageEvidence(observation.evidence), [["finalUrl"]]) ?? input.target.url);
+				observed.hash = "";
+				expected.hash = "";
+				return observed.href === expected.href ? [] : [finding(input, "canonical-mismatch", `Canonical points to ${observed.href} instead of the audited URL.`, "Use a self-referencing canonical unless this page is intentionally consolidated.", observed.href)];
+			} catch {
+				return [finding(input, "invalid-canonical", "Page canonical is not a valid URL.", "Use an absolute or resolvable canonical URL.", canonical)];
+			}
+		}
+	}
+];
+const evaluateRules = (rules, observation, input) => rules.flatMap((rule) => rule.evaluate(observation, input));
+/** Default policy for a web-page audit. */
+const defaultAuditOptions = {
+	concurrency: 4,
+	policy: {
+		titleMinLength: 10,
+		titleMaxLength: 70,
+		descriptionMinLength: 50,
+		descriptionMaxLength: 160,
+		requireCanonical: true
+	}
+};
+//#endregion
+//#region src/audit/scanner-registry.ts
+let ScannerRegistry;
+(function(_ScannerRegistry) {
+	class Service extends Context.Service()("pagegraph/ScannerRegistry") {}
+	_ScannerRegistry.Service = Service;
+})(ScannerRegistry || (ScannerRegistry = {}));
+const makeScannerRegistry = (scanners) => {
+	const values = [...scanners];
+	const byId = new Map(values.map((value) => [value.id, value]));
+	return {
+		all: () => values,
+		get: (id) => byId.get(id)
+	};
+};
+const ScannerRegistryLive = (scanners) => Layer.succeed(ScannerRegistry.Service, makeScannerRegistry(scanners));
+//#endregion
+//#region src/audit/audit.ts
+var InvalidTarget = class extends Data$1.TaggedError("InvalidTarget") {};
+let Audit;
+(function(_Audit) {
+	class Service extends Context.Service()("pagegraph/Audit") {}
+	_Audit.Service = Service;
+})(Audit || (Audit = {}));
+const validateTarget = (target) => Effect.try({
+	try: () => {
+		const url = new URL(target);
+		if (url.protocol !== "http:" && url.protocol !== "https:") throw new Error("only http and https URLs are supported");
+		if (url.username || url.password) throw new Error("credentials in URLs are not supported");
+		return { url: url.toString() };
+	},
+	catch: (cause) => new InvalidTarget({
+		target,
+		message: cause instanceof Error ? cause.message : "invalid URL"
+	})
+});
+const runOne = Effect.fn("Audit.runScanner")(function* (scanner, target, options) {
+	const input = {
+		target,
+		options
+	};
+	return yield* scanner.scan(input).pipe(Effect.map((observation) => ({
+		scanner: scanner.id,
+		target: target.url,
+		status: "ok",
+		...observation.evidence === void 0 ? {} : { evidence: observation.evidence },
+		findings: [...observation.findings ?? [], ...evaluateRules([...scanner.rules ?? [], ...scanner.id === "http" ? pageRules : []], observation, input)]
+	})), Effect.catchTag("ScannerFailure", (error) => Effect.succeed({
+		scanner: scanner.id,
+		target: target.url,
+		status: "error",
+		findings: [],
+		error: error instanceof Error ? error.message : String(error)
+	})));
+});
+const runAudit = Effect.fn("Audit.run")(function* (registry, request) {
+	const targets = yield* Effect.forEach(request.targets, validateTarget);
+	const options = {
+		...defaultOptions,
+		...request.options ?? {},
+		policy: {
+			...defaultOptions.policy,
+			...request.options?.policy ?? {}
+		}
+	};
+	const available = registry.all();
+	const scanners = request.scanners === void 0 ? available : available.filter((scanner) => request.scanners.includes(scanner.id));
+	const pairs = targets.flatMap((target) => scanners.map((scanner) => ({
+		target,
+		scanner
+	})));
+	const results = yield* Effect.forEach(pairs, ({ target, scanner }) => runOne(scanner, target, options), { concurrency: Math.max(1, Math.floor(options.concurrency ?? 4)) });
+	const findings = results.flatMap((result) => result.findings);
+	const warnings = results.filter((result) => result.status === "error").map((result) => `${result.scanner} failed for ${result.target}: ${result.error ?? "unknown error"}`);
+	return {
+		schemaVersion: 1,
+		generatedAt: yield* Effect.clockWith((clock) => Effect.map(clock.currentTimeMillis, (millis) => new Date(millis).toISOString())),
+		targets: targets.map(({ url }) => url),
+		results,
+		findings,
+		warnings
+	};
+});
+const defaultOptions = {
+	concurrency: 4,
+	policy: {
+		titleMinLength: 10,
+		titleMaxLength: 70,
+		descriptionMinLength: 50,
+		descriptionMaxLength: 160,
+		requireCanonical: true
+	}
+};
+const makeAudit = (registry) => ({ run: (request) => runAudit(registry, request) });
+const AuditLive = Layer.effect(Audit.Service, Effect.map(ScannerRegistry.Service, makeAudit));
+//#endregion
+//#region src/audit/model.ts
+const FindingSeverity = Schema.Literals(["structural", "editorial"]);
+/** A machine-readable audit finding. Values are intentionally open-ended so
+* scanner authors can retain the evidence that led to a finding. */
+const AuditFinding = Schema.Struct({
+	scanner: Schema.String,
+	target: Schema.String,
+	severity: FindingSeverity,
+	rule: Schema.String,
+	message: Schema.String,
+	fix: Schema.optionalKey(Schema.String),
+	observed: Schema.optionalKey(Schema.Unknown),
+	expected: Schema.optionalKey(Schema.Unknown)
+});
+const ScannerStatus = Schema.Literals(["ok", "error"]);
+/** The result of one scanner against one target. Scanner failures are data in
+* a report rather than an un-attributed failure of the entire audit. */
+const ScannerResult = Schema.Struct({
+	scanner: Schema.String,
+	target: Schema.String,
+	status: ScannerStatus,
+	evidence: Schema.optionalKey(Schema.Unknown),
+	findings: Schema.Array(AuditFinding),
+	error: Schema.optionalKey(Schema.String)
+});
+const AuditPolicy = Schema.Struct({
+	titleMinLength: Schema.optionalKey(Schema.Number),
+	titleMaxLength: Schema.optionalKey(Schema.Number),
+	descriptionMinLength: Schema.optionalKey(Schema.Number),
+	descriptionMaxLength: Schema.optionalKey(Schema.Number),
+	requireCanonical: Schema.optionalKey(Schema.Boolean)
+});
+/** JSON/Markdown report contract for `pagegraph audit`. */
+const AuditReport = Schema.Struct({
+	schemaVersion: Schema.Literal(1),
+	generatedAt: Schema.String,
+	targets: Schema.Array(Schema.String),
+	results: Schema.Array(ScannerResult),
+	findings: Schema.Array(AuditFinding),
+	warnings: Schema.Array(Schema.String)
+});
+//#endregion
+//#region src/audit/diff.ts
+const DiffFindingGroup = Schema.Struct({
+	target: Schema.String,
+	scanner: Schema.String,
+	rule: Schema.String,
+	severity: FindingSeverity,
+	findings: Schema.Array(AuditFinding)
+});
+const FindingAdded = Schema.TaggedStruct("FindingAdded", { group: DiffFindingGroup });
+const FindingRemoved = Schema.TaggedStruct("FindingRemoved", { group: DiffFindingGroup });
+const FindingChanged = Schema.TaggedStruct("FindingChanged", {
+	target: Schema.String,
+	scanner: Schema.String,
+	rule: Schema.String,
+	beforeSeverity: FindingSeverity,
+	afterSeverity: FindingSeverity,
+	before: Schema.Array(AuditFinding),
+	after: Schema.Array(AuditFinding)
+});
+const ScannerDegraded = Schema.TaggedStruct("ScannerDegraded", {
+	target: Schema.String,
+	scanner: Schema.String
+});
+const ScannerRecovered = Schema.TaggedStruct("ScannerRecovered", {
+	target: Schema.String,
+	scanner: Schema.String
+});
+const TargetAdded = Schema.TaggedStruct("TargetAdded", { target: Schema.String });
+const TargetRemoved = Schema.TaggedStruct("TargetRemoved", { target: Schema.String });
+const ScannerAdded = Schema.TaggedStruct("ScannerAdded", {
+	target: Schema.String,
+	scanner: Schema.String,
+	status: ScannerStatus
+});
+const ScannerRemoved = Schema.TaggedStruct("ScannerRemoved", {
+	target: Schema.String,
+	scanner: Schema.String
+});
+/** One normalized semantic change between two audit reports. */
+const AuditDiffChange = Schema.Union([
+	FindingAdded,
+	FindingRemoved,
+	FindingChanged,
+	ScannerDegraded,
+	ScannerRecovered,
+	TargetAdded,
+	TargetRemoved,
+	ScannerAdded,
+	ScannerRemoved
+]).pipe(Schema.toTaggedUnion("_tag"));
+const AuditDiffOutcome = Schema.Literals([
+	"unchanged",
+	"changed",
+	"regressed"
+]);
+const AuditDiffSummary = Schema.Struct({
+	structuralRegressions: Schema.Number,
+	editorialRegressions: Schema.Number,
+	scannerRegressions: Schema.Number,
+	coverageRegressions: Schema.Number,
+	improvements: Schema.Number,
+	informationalChanges: Schema.Number
+});
+const AuditDiffSource = Schema.Struct({
+	reportSchemaVersion: Schema.Literal(1),
+	generatedAt: Schema.String,
+	targets: Schema.Array(Schema.String)
+});
+/** Versioned machine-readable contract emitted by `pagegraph diff --json`. */
+const AuditDiff = Schema.Struct({
+	kind: Schema.Literal("audit-diff"),
+	schemaVersion: Schema.Literal(1),
+	before: AuditDiffSource,
+	after: AuditDiffSource,
+	outcome: AuditDiffOutcome,
+	summary: AuditDiffSummary,
+	changes: Schema.Array(AuditDiffChange),
+	ignored: Schema.Tuple([
+		Schema.Literal("generatedAt"),
+		Schema.Literal("warnings"),
+		Schema.Literal("results[].evidence")
+	])
+});
+const AuditComparisonResult = Data.taggedEnum();
+const compareStrings = (left, right) => left < right ? -1 : left > right ? 1 : 0;
+const canonicalize = (value) => {
+	if (Array.isArray(value)) return value.map(canonicalize);
+	if (value !== null && typeof value === "object") return Object.fromEntries(Object.entries(value).sort(([left], [right]) => compareStrings(left, right)).map(([key, entry]) => [key, canonicalize(entry)]));
+	return value;
+};
+const canonicalJson = (value) => JSON.stringify(canonicalize(value));
+const tupleKey = (...parts) => JSON.stringify(parts);
+const severityOf = (findings) => findings.some((finding) => finding.severity === "structural") ? "structural" : "editorial";
+const findingsByIdentity = (findings) => {
+	const groups = /* @__PURE__ */ new Map();
+	for (const finding of findings) {
+		const key = tupleKey(finding.target, finding.scanner, finding.rule);
+		const group = groups.get(key);
+		if (group) group.push(finding);
+		else groups.set(key, [finding]);
+	}
+	return new Map([...groups.entries()].map(([key, group]) => {
+		const sorted = group.toSorted((left, right) => compareStrings(canonicalJson(left), canonicalJson(right)));
+		const first = sorted[0];
+		return [key, {
+			target: first.target,
+			scanner: first.scanner,
+			rule: first.rule,
+			severity: severityOf(sorted),
+			findings: sorted
+		}];
+	}));
+};
+const validateReport = (label, report) => {
+	const issues = [];
+	const targets = /* @__PURE__ */ new Set();
+	for (const target of report.targets) {
+		if (targets.has(target)) issues.push(`${label}: duplicate target ${target}`);
+		targets.add(target);
+	}
+	const results = /* @__PURE__ */ new Set();
+	for (const result of report.results) {
+		if (!targets.has(result.target)) issues.push(`${label}: scanner ${result.scanner} references undeclared target ${result.target}`);
+		const key = tupleKey(result.target, result.scanner);
+		if (results.has(key)) issues.push(`${label}: duplicate scanner result ${result.scanner} for ${result.target}`);
+		results.add(key);
+		for (const finding of result.findings) if (finding.target !== result.target) issues.push(`${label}: finding ${finding.rule} targets ${finding.target} inside result for ${result.target}`);
+	}
+	const flattened = report.results.flatMap((result) => result.findings).map(canonicalJson).sort(compareStrings);
+	const topLevel = report.findings.map(canonicalJson).sort(compareStrings);
+	if (canonicalJson(flattened) !== canonicalJson(topLevel)) issues.push(`${label}: top-level findings do not match result findings`);
+	return issues;
+};
+const resultMap = (report) => new Map(report.results.map((result) => [tupleKey(result.target, result.scanner), result]));
+const changeSortKey = (change) => {
+	switch (change._tag) {
+		case "FindingAdded":
+		case "FindingRemoved": return tupleKey(change.group.target, change.group.scanner, change.group.rule, change._tag);
+		case "FindingChanged": return tupleKey(change.target, change.scanner, change.rule, change._tag);
+		case "ScannerAdded":
+		case "ScannerRemoved":
+		case "ScannerDegraded":
+		case "ScannerRecovered": return tupleKey(change.target, change.scanner, "", change._tag);
+		case "TargetAdded":
+		case "TargetRemoved": return tupleKey(change.target, "", "", change._tag);
+	}
+};
+const summarize = (changes) => {
+	let structuralRegressions = 0;
+	let editorialRegressions = 0;
+	let scannerRegressions = 0;
+	let coverageRegressions = 0;
+	let improvements = 0;
+	let informationalChanges = 0;
+	for (const change of changes) switch (change._tag) {
+		case "FindingAdded":
+			if (change.group.severity === "structural") structuralRegressions++;
+			else editorialRegressions++;
+			break;
+		case "FindingRemoved":
+		case "ScannerRecovered":
+			improvements++;
+			break;
+		case "FindingChanged":
+			if (change.beforeSeverity === "editorial" && change.afterSeverity === "structural") structuralRegressions++;
+			else if (change.beforeSeverity === "structural" && change.afterSeverity === "editorial") improvements++;
+			else informationalChanges++;
+			break;
+		case "ScannerDegraded":
+			scannerRegressions++;
+			break;
+		case "TargetRemoved":
+		case "ScannerRemoved":
+			coverageRegressions++;
+			break;
+		case "TargetAdded":
+			informationalChanges++;
+			break;
+		case "ScannerAdded": if (change.status === "error") scannerRegressions++;
+		else informationalChanges++;
+	}
+	return {
+		structuralRegressions,
+		editorialRegressions,
+		scannerRegressions,
+		coverageRegressions,
+		improvements,
+		informationalChanges
+	};
+};
+const outcomeOf = (summary, changes) => {
+	if (summary.structuralRegressions > 0 || summary.scannerRegressions > 0 || summary.coverageRegressions > 0) return "regressed";
+	return changes.length > 0 ? "changed" : "unchanged";
+};
+/** Compare two decoded audit reports while ignoring non-semantic scanner evidence. */
+const compareAuditReports = (before, after) => {
+	const issues = [...validateReport("before", before), ...validateReport("after", after)];
+	if (issues.length > 0) return AuditComparisonResult.InvalidReport({ issues });
+	const changes = [];
+	const beforeTargets = new Set(before.targets);
+	const afterTargets = new Set(after.targets);
+	for (const target of beforeTargets) if (!afterTargets.has(target)) changes.push({
+		_tag: "TargetRemoved",
+		target
+	});
+	for (const target of afterTargets) if (!beforeTargets.has(target)) changes.push({
+		_tag: "TargetAdded",
+		target
+	});
+	const beforeResults = resultMap(before);
+	const afterResults = resultMap(after);
+	for (const [key, result] of beforeResults) {
+		const next = afterResults.get(key);
+		if (next === void 0) changes.push({
+			_tag: "ScannerRemoved",
+			target: result.target,
+			scanner: result.scanner
+		});
+		else if (result.status === "ok" && next.status === "error") changes.push({
+			_tag: "ScannerDegraded",
+			target: result.target,
+			scanner: result.scanner
+		});
+		else if (result.status === "error" && next.status === "ok") changes.push({
+			_tag: "ScannerRecovered",
+			target: result.target,
+			scanner: result.scanner
+		});
+	}
+	for (const [key, result] of afterResults) if (!beforeResults.has(key)) changes.push({
+		_tag: "ScannerAdded",
+		target: result.target,
+		scanner: result.scanner,
+		status: result.status
+	});
+	const beforeFindings = findingsByIdentity(before.findings);
+	const afterFindings = findingsByIdentity(after.findings);
+	for (const [key, group] of beforeFindings) {
+		const next = afterFindings.get(key);
+		if (next === void 0) changes.push({
+			_tag: "FindingRemoved",
+			group
+		});
+		else if (canonicalJson(group.findings) !== canonicalJson(next.findings)) changes.push({
+			_tag: "FindingChanged",
+			target: group.target,
+			scanner: group.scanner,
+			rule: group.rule,
+			beforeSeverity: group.severity,
+			afterSeverity: next.severity,
+			before: group.findings,
+			after: next.findings
+		});
+	}
+	for (const [key, group] of afterFindings) if (!beforeFindings.has(key)) changes.push({
+		_tag: "FindingAdded",
+		group
+	});
+	changes.sort((left, right) => compareStrings(changeSortKey(left), changeSortKey(right)));
+	const summary = summarize(changes);
+	const targets = (report) => report.targets.toSorted(compareStrings);
+	return AuditComparisonResult.Success({ diff: {
+		kind: "audit-diff",
+		schemaVersion: 1,
+		before: {
+			reportSchemaVersion: 1,
+			generatedAt: before.generatedAt,
+			targets: targets(before)
+		},
+		after: {
+			reportSchemaVersion: 1,
+			generatedAt: after.generatedAt,
+			targets: targets(after)
+		},
+		outcome: outcomeOf(summary, changes),
+		summary,
+		changes,
+		ignored: [
+			"generatedAt",
+			"warnings",
+			"results[].evidence"
+		]
+	} });
+};
+//#endregion
+//#region src/audit/layers.ts
+/** Compose the default audit services with an explicit scanner set. */
+const AuditLayer = (scanners) => AuditLive.pipe(Layer.provide(ScannerRegistryLive(scanners)));
+//#endregion
+//#region src/audit/scanner.ts
+/** A typed, attributed failure from a scanner. The audit service catches this
+* at the scanner boundary and preserves it in the report. */
+var ScannerFailure = class extends Data$1.TaggedError("ScannerFailure") {};
+const scanner = (definition) => definition;
+//#endregion
+//#region src/audit/render.ts
+const cell = (value) => String(value ?? "—").replaceAll("|", "\\|").replaceAll("\n", " ");
+const renderAuditMarkdown = (report) => {
+	const structural = report.findings.filter((finding) => finding.severity === "structural");
+	const editorial = report.findings.filter((finding) => finding.severity === "editorial");
+	const lines = [
+		"# SEO audit",
+		"",
+		`Generated: ${report.generatedAt}`,
+		`Targets: ${report.targets.length} · Structural: ${structural.length} · Editorial: ${editorial.length}`,
+		"",
+		"## Scanner results",
+		"",
+		"| Scanner | Target | Status | Findings |",
+		"| --- | --- | --- | ---: |",
+		...report.results.map((result) => `| ${cell(result.scanner)} | ${cell(result.target)} | ${cell(result.status)} | ${result.findings.length} |`)
+	];
+	if (report.findings.length > 0) lines.push("", "## Findings", "", "| Severity | Rule | Target | Finding |", "| --- | --- | --- | --- |", ...report.findings.map((finding) => `| ${cell(finding.severity)} | ${cell(finding.rule)} | ${cell(finding.target)} | ${cell(finding.message)} |`));
+	if (report.warnings.length > 0) lines.push("", "## Warnings", "", ...report.warnings.map((warning) => `- ${warning}`));
+	return `${lines.join("\n")}\n`;
+};
+const renderDiffChange = (change) => {
+	switch (change._tag) {
+		case "FindingAdded": return `+ [${change.group.severity}] ${change.group.rule} · ${change.group.target} (${change.group.scanner})`;
+		case "FindingRemoved": return `- [${change.group.severity}] ${change.group.rule} · ${change.group.target} (${change.group.scanner})`;
+		case "FindingChanged": return `~ [${change.beforeSeverity} → ${change.afterSeverity}] ${change.rule} · ${change.target} (${change.scanner})`;
+		case "ScannerDegraded": return `✗ scanner ${change.scanner} degraded · ${change.target}`;
+		case "ScannerRecovered": return `✓ scanner ${change.scanner} recovered · ${change.target}`;
+		case "TargetAdded": return `+ target coverage · ${change.target}`;
+		case "TargetRemoved": return `- target coverage · ${change.target}`;
+		case "ScannerAdded": return `+ scanner coverage ${change.scanner} (${change.status}) · ${change.target}`;
+		case "ScannerRemoved": return `- scanner coverage ${change.scanner} · ${change.target}`;
+	}
+};
+const diffSection = (title, changes) => changes.length === 0 ? [] : [
+	"",
+	`## ${title}`,
+	"",
+	...changes.map(renderDiffChange)
+];
+/** Human-readable rendering of the semantic comparison contract. */
+const renderAuditDiff = (diff) => {
+	const regressions = [];
+	const editorial = [];
+	const improvements = [];
+	const informational = [];
+	for (const change of diff.changes) switch (change._tag) {
+		case "FindingAdded":
+			if (change.group.severity === "structural") regressions.push(change);
+			else editorial.push(change);
+			break;
+		case "FindingChanged":
+			if (change.beforeSeverity === "editorial" && change.afterSeverity === "structural") regressions.push(change);
+			else if (change.beforeSeverity === "structural" && change.afterSeverity === "editorial") improvements.push(change);
+			else informational.push(change);
+			break;
+		case "ScannerDegraded":
+		case "TargetRemoved":
+		case "ScannerRemoved":
+			regressions.push(change);
+			break;
+		case "FindingRemoved":
+		case "ScannerRecovered":
+			improvements.push(change);
+			break;
+		case "TargetAdded":
+			informational.push(change);
+			break;
+		case "ScannerAdded": if (change.status === "error") regressions.push(change);
+		else informational.push(change);
+	}
+	const lines = [
+		"# SEO audit diff",
+		"",
+		`${diff.outcome === "regressed" ? "✗" : diff.outcome === "changed" ? "!" : "✓"} Outcome: ${diff.outcome}`,
+		`Before: ${diff.before.generatedAt} · ${diff.before.targets.length} target(s)`,
+		`After: ${diff.after.generatedAt} · ${diff.after.targets.length} target(s)`
+	];
+	if (diff.changes.length === 0) lines.push("", "No semantic changes. Volatile scanner evidence was ignored.");
+	else lines.push(...diffSection("Regressions", regressions), ...diffSection("Editorial changes", editorial), ...diffSection("Improvements", improvements), ...diffSection("Other changes", informational));
+	lines.push("", `Ignored: ${diff.ignored.join(", ")}`, "", `Summary: ${diff.summary.structuralRegressions} structural · ${diff.summary.editorialRegressions} editorial · ${diff.summary.scannerRegressions} scanner · ${diff.summary.coverageRegressions} coverage regression(s)`);
+	return `${lines.join("\n")}\n`;
+};
+const atomicWrite = async (path, contents) => {
+	const temporary = `${path}.${process.pid}.${crypto.randomUUID()}.tmp`;
+	await writeFile(temporary, contents, "utf8");
+	await rename(temporary, path);
+};
+const writeAuditFiles = async (report, outputDirectory) => {
+	await mkdir(outputDirectory, { recursive: true });
+	const stamp = report.generatedAt.replaceAll(":", "-");
+	const json = join(outputDirectory, `${stamp}.json`);
+	const markdown = join(outputDirectory, `${stamp}.md`);
+	await Promise.all([atomicWrite(json, `${JSON.stringify(report, null, 2)}\n`), atomicWrite(markdown, renderAuditMarkdown(report))]);
+	return {
+		json,
+		markdown
+	};
+};
+//#endregion
+//#region src/audit/network.ts
+const blockedIpv4Addresses = new BlockList();
+blockedIpv4Addresses.addAddress("168.63.129.16", "ipv4");
+for (const [network, prefix] of [
+	["0.0.0.0", 8],
+	["10.0.0.0", 8],
+	["100.64.0.0", 10],
+	["127.0.0.0", 8],
+	["169.254.0.0", 16],
+	["172.16.0.0", 12],
+	["192.0.0.0", 24],
+	["192.0.2.0", 24],
+	["192.88.99.0", 24],
+	["192.168.0.0", 16],
+	["198.18.0.0", 15],
+	["198.51.100.0", 24],
+	["203.0.113.0", 24],
+	["224.0.0.0", 4],
+	["240.0.0.0", 4]
+]) blockedIpv4Addresses.addSubnet(network, prefix, "ipv4");
+const ipv4Groups = (address) => {
+	const octets = address.split(".").map(Number);
+	if (octets.length !== 4 || octets.some((octet) => !Number.isInteger(octet) || octet < 0 || octet > 255)) throw new Error(`Invalid embedded IPv4 address: ${address}`);
+	return [octets[0] << 8 | octets[1], octets[2] << 8 | octets[3]];
+};
+const ipv6Value = (address) => {
+	const [head = "", tail, extra] = address.toLowerCase().split("::");
+	if (extra !== void 0) throw new Error(`Invalid IPv6 address: ${address}`);
+	const parseGroups = (side) => side === "" ? [] : side.split(":").flatMap((group) => group.includes(".") ? ipv4Groups(group) : [Number.parseInt(group, 16)]);
+	const left = parseGroups(head);
+	const right = parseGroups(tail ?? "");
+	if (left.some((group) => !Number.isInteger(group) || group < 0 || group > 65535)) throw new Error(`Invalid IPv6 address: ${address}`);
+	const missing = 8 - left.length - right.length;
+	if (tail === void 0 && missing !== 0 || missing < 0) throw new Error(`Invalid IPv6 address: ${address}`);
+	return [
+		...left,
+		...Array(missing).fill(0),
+		...right
+	].reduce((value, group) => value << 16n | BigInt(group), 0n);
+};
+const blockedIpv6Ranges = [
+	["::", 128],
+	["::1", 128],
+	["::", 96],
+	["::ffff:0:0", 96],
+	["::ffff:0:0:0", 96],
+	["64:ff9b::", 96],
+	["64:ff9b:1::", 48],
+	["100::", 64],
+	["2001::", 23],
+	["2001:db8::", 32],
+	["2002::", 16],
+	["3fff::", 20],
+	["5f00::", 16],
+	["fc00::", 7],
+	["fe80::", 10],
+	["ff00::", 8]
+];
+const isBlockedIpv6 = (address) => {
+	try {
+		const value = ipv6Value(address);
+		return blockedIpv6Ranges.some(([network, prefix]) => {
+			const shift = BigInt(128 - prefix);
+			return value >> shift === ipv6Value(network) >> shift;
+		});
+	} catch {
+		return true;
+	}
+};
+const networkHostname = (hostname) => hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
+const isPrivateAddress = (address) => {
+	const family = isIP(address);
+	if (family === 4) return blockedIpv4Addresses.check(address, "ipv4");
+	if (family === 6) return isBlockedIpv6(address);
+	return true;
+};
+const resolveHostname = async (hostname) => {
+	const normalized = networkHostname(hostname);
+	const literalFamily = isIP(normalized);
+	if (literalFamily === 4 || literalFamily === 6) return [{
+		address: normalized,
+		family: literalFamily
+	}];
+	return (await lookup(normalized, {
+		all: true,
+		verbatim: true
+	})).flatMap(({ address, family }) => family === 4 || family === 6 ? [{
+		address,
+		family
+	}] : []);
+};
+/** Resolve every DNS answer before connecting. A host is rejected if any answer is private. */
+const resolveTargetUrl = async (url, allowPrivate, resolve = resolveHostname) => {
+	if (url.protocol !== "https:" && url.protocol !== "http:") throw new Error(`Unsupported URL protocol: ${url.protocol}`);
+	if (url.username || url.password) throw new Error("Target URLs must not contain credentials");
+	const hostname = networkHostname(url.hostname).toLowerCase();
+	if (!allowPrivate && (hostname === "localhost" || hostname.endsWith(".local"))) throw new Error(`Private target is not allowed: ${hostname}`);
+	const addresses = await resolve(hostname);
+	if (addresses.length === 0 || addresses.some(({ address, family }) => isIP(address) !== family) || !allowPrivate && addresses.some(({ address }) => isPrivateAddress(address))) throw new Error(`Private target is not allowed: ${hostname}`);
+	return addresses;
+};
+/** A lookup callback pinned to the already validated DNS answers. */
+const pinnedLookup = (addresses) => {
+	const [first] = addresses;
+	if (first === void 0) throw new Error("Cannot create a pinned lookup without an address");
+	return (_hostname, options, callback) => {
+		if (options.all) {
+			callback(null, addresses.map(({ address, family }) => ({
+				address,
+				family
+			})));
+			return;
+		}
+		callback(null, first.address, first.family);
+	};
+};
+//#endregion
+//#region src/audit/scanners/http.ts
+var HttpProbeError = class extends Data$1.TaggedError("HttpProbeError") {};
+const errorMessage$2 = (error) => error instanceof Error ? error.message : String(error);
+const discoveryPaths = [
+	{
+		kind: "robots",
+		path: "/robots.txt",
+		accept: "text/plain, */*;q=0.1"
+	},
+	{
+		kind: "sitemap",
+		path: "/sitemap.xml",
+		accept: "application/xml, text/xml;q=0.9, */*;q=0.1"
+	},
+	{
+		kind: "llms",
+		path: "/llms.txt",
+		accept: "text/plain, text/markdown;q=0.9, */*;q=0.1"
+	}
+];
+const selectedHeaders = [
+	"cache-control",
+	"cf-cache-status",
+	"content-language",
+	"content-length",
+	"content-signal",
+	"content-type",
+	"link",
+	"server",
+	"vary",
+	"x-robots-tag"
+];
+const buildProbeRequests = (targets, extraDiscovery = []) => {
+	const requests = [];
+	const seenDiscoveryOrigins = /* @__PURE__ */ new Set();
+	for (const target of targets) {
+		requests.push({
+			kind: "page-head",
+			method: "HEAD",
+			accept: "text/html, */*;q=0.1",
+			url: target
+		}, {
+			kind: "page-html",
+			method: "GET",
+			accept: "text/html, */*;q=0.1",
+			url: target
+		}, {
+			kind: "page-markdown",
+			method: "GET",
+			accept: "text/markdown, text/plain;q=0.8, */*;q=0.1",
+			url: target
+		});
+		if (seenDiscoveryOrigins.has(target.origin)) continue;
+		seenDiscoveryOrigins.add(target.origin);
+		for (const discovery of [...discoveryPaths, ...extraDiscovery]) requests.push({
+			kind: discovery.kind,
+			method: "GET",
+			accept: discovery.accept,
+			url: new URL(discovery.path, target.origin)
+		});
+	}
+	return requests;
+};
+const responseHeaders = (headers) => {
+	const values = {};
+	for (const header of selectedHeaders) {
+		const value = headers[header];
+		if (value !== void 0) values[header] = Array.isArray(value) ? value.join(", ") : value;
+	}
+	return values;
+};
+const attribute = (tag, name) => {
+	const match = new RegExp(`${name}\\s*=\\s*(?:"([^"]*)"|'([^']*)'|([^\\s>]+))`, "i").exec(tag);
+	return match?.[1] ?? match?.[2] ?? match?.[3] ?? null;
+};
+const metaContent = (html, key) => {
+	for (const match of html.matchAll(/<meta\b[^>]*>/gi)) {
+		const tag = match[0];
+		if (attribute(tag, "name")?.toLowerCase() === key) return attribute(tag, "content");
+	}
+	return null;
+};
+const canonicalUrl = (html) => {
+	for (const match of html.matchAll(/<link\b[^>]*>/gi)) {
+		const tag = match[0];
+		if ((attribute(tag, "rel")?.toLowerCase().split(/\s+/) ?? []).includes("canonical")) return attribute(tag, "href");
+	}
+	return null;
+};
+const countMatches = (value, pattern) => [...value.matchAll(pattern)].length;
+const extractDocumentSignals = (body, contentType, requestedUrl) => {
+	const isHtml = contentType.includes("text/html");
+	const isMarkdown = contentType.includes("text/markdown");
+	const looksJson = contentType.includes("json") || requestedUrl.pathname.endsWith(".json");
+	const titleMatch = isHtml ? /<title\b[^>]*>([\s\S]*?)<\/title>/i.exec(body) : null;
+	let jsonValid = null;
+	if (looksJson && body.trim().length > 0) try {
+		JSON.parse(body);
+		jsonValid = true;
+	} catch {
+		jsonValid = false;
+	}
+	return {
+		title: titleMatch?.[1]?.replace(/\s+/g, " ").trim() ?? null,
+		description: isHtml ? metaContent(body, "description") : null,
+		canonicalUrl: isHtml ? canonicalUrl(body) : null,
+		robots: isHtml ? metaContent(body, "robots") : null,
+		jsonLdCount: isHtml ? countMatches(body, /<script\b[^>]*type\s*=\s*["']application\/ld\+json["'][^>]*>/gi) : 0,
+		modulePreloadCount: isHtml ? countMatches(body, /<link\b[^>]*rel\s*=\s*["'][^"']*modulepreload[^"']*["'][^>]*>/gi) : 0,
+		scriptCount: isHtml ? countMatches(body, /<script\b/gi) : 0,
+		stylesheetCount: isHtml ? countMatches(body, /<link\b[^>]*rel\s*=\s*["'][^"']*stylesheet[^"']*["'][^>]*>/gi) : 0,
+		wordCount: isMarkdown ? body.trim().split(/\s+/).filter(Boolean).length : null,
+		jsonValid
+	};
+};
+const readBoundedBody = async (response, maxBodyBytes) => {
+	const chunks = [];
+	let length = 0;
+	let truncated = false;
+	for await (const chunk of response) {
+		const value = new Uint8Array(chunk);
+		const remaining = maxBodyBytes - length;
+		if (value.byteLength > remaining) {
+			if (remaining > 0) chunks.push(value.slice(0, remaining));
+			length += Math.max(remaining, 0);
+			truncated = true;
+			response.destroy();
+			break;
+		}
+		chunks.push(value);
+		length += value.byteLength;
+	}
+	const bytes = new Uint8Array(length);
+	let offset = 0;
+	for (const chunk of chunks) {
+		bytes.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return {
+		bytes,
+		truncated
+	};
+};
+const bodyExcerpt = (body, contentType) => {
+	if (contentType.includes("text/html") || body.length === 0) return null;
+	return [...body].filter((character) => {
+		const code = character.charCodeAt(0);
+		return code === 9 || code === 10 || code === 13 || code >= 32;
+	}).join("").slice(0, 600);
+};
+const requestPinned = async (url, request$4, options) => {
+	const addresses = await resolveTargetUrl(url, options.allowPrivate, options.resolve);
+	const transport = url.protocol === "https:" ? request$1 : request;
+	const hostname = networkHostname(url.hostname);
+	return new Promise((resolve, reject) => {
+		const outgoing = transport({
+			hostname,
+			port: url.port || void 0,
+			path: `${url.pathname}${url.search}`,
+			method: request$4.method,
+			headers: {
+				accept: request$4.accept,
+				host: url.host,
+				"user-agent": "pagegraph/0.4 (+https://tanstack.com)"
+			},
+			agent: false,
+			lookup: pinnedLookup(addresses),
+			signal: AbortSignal.timeout(options.timeoutMs),
+			...url.protocol === "https:" ? {
+				servername: isIP(hostname) === 0 ? hostname : void 0,
+				checkServerIdentity: (_host, certificate) => checkServerIdentity(hostname, certificate)
+			} : void 0
+		});
+		outgoing.once("response", resolve);
+		outgoing.once("error", reject);
+		outgoing.end();
+	});
+};
+const probeHttp = async (request, options) => {
+	const startedAt = performance.now();
+	const redirects = [];
+	let headersAt = null;
+	try {
+		let currentUrl = request.url;
+		let response = null;
+		for (let redirectCount = 0; redirectCount <= 10; redirectCount += 1) {
+			response = await requestPinned(currentUrl, request, options);
+			headersAt = performance.now();
+			const location = response.headers.location;
+			const status = response.statusCode ?? 0;
+			if (status < 300 || status >= 400 || location === void 0) break;
+			if (redirectCount === 10) throw new Error("Redirect limit exceeded");
+			response.destroy();
+			currentUrl = new URL(location, currentUrl);
+			redirects.push(currentUrl.href);
+		}
+		if (response === null) throw new Error("Request did not produce a response");
+		const bounded = request.method === "HEAD" ? {
+			bytes: /* @__PURE__ */ new Uint8Array(),
+			truncated: false
+		} : await readBoundedBody(response, options.maxBodyBytes);
+		const contentType = typeof response.headers["content-type"] === "string" ? response.headers["content-type"] : "";
+		const body = new TextDecoder().decode(bounded.bytes);
+		const anchors = options.captureAnchors === true && contentType.includes("text/html") ? extractAnchors(body, currentUrl.href) : void 0;
+		return {
+			kind: request.kind,
+			method: request.method,
+			accept: request.accept,
+			requestedUrl: request.url.href,
+			finalUrl: currentUrl.href,
+			redirects,
+			status: response.statusCode ?? null,
+			ok: response.statusCode !== void 0 && response.statusCode >= 200 && response.statusCode < 300,
+			headersMs: headersAt === null ? null : Math.round((headersAt - startedAt) * 10) / 10,
+			totalMs: Math.round((performance.now() - startedAt) * 10) / 10,
+			responseHeaders: responseHeaders(response.headers),
+			capturedBodyBytes: bounded.bytes.byteLength,
+			capturedBodySha256: bounded.bytes.byteLength === 0 ? null : createHash("sha256").update(bounded.bytes).digest("hex"),
+			bodyTruncated: bounded.truncated,
+			bodyExcerpt: bodyExcerpt(body, contentType),
+			document: body.length === 0 ? null : extractDocumentSignals(body, contentType, currentUrl),
+			anchors,
+			error: null
+		};
+	} catch (error) {
+		return {
+			kind: request.kind,
+			method: request.method,
+			accept: request.accept,
+			requestedUrl: request.url.href,
+			finalUrl: null,
+			redirects,
+			status: null,
+			ok: false,
+			headersMs: headersAt === null ? null : Math.round((headersAt - startedAt) * 10) / 10,
+			totalMs: Math.round((performance.now() - startedAt) * 10) / 10,
+			responseHeaders: {},
+			capturedBodyBytes: 0,
+			capturedBodySha256: null,
+			bodyTruncated: false,
+			bodyExcerpt: null,
+			document: null,
+			error: errorMessage$2(error)
+		};
+	}
+};
+const probeAll = async (requests, options) => {
+	const results = Array.from({ length: requests.length });
+	const pending = requests.map((request, index) => ({
+		index,
+		request
+	}));
+	const workers = Array.from({ length: Math.min(4, Math.max(1, pending.length)) }, async () => {
+		while (pending.length > 0) {
+			const item = pending.shift();
+			if (item !== void 0) results[item.index] = await probeHttp(item.request, options);
+		}
+	});
+	await Promise.all(workers);
+	return results.map((result, index) => {
+		if (result === void 0) throw new Error(`Probe ${index} did not produce a result`);
+		return result;
+	});
+};
+Effect.fn("SeoAudit.probeHttp")(function* (request, options) {
+	return yield* Effect.tryPromise({
+		try: () => probeHttp(request, options),
+		catch: (cause) => new HttpProbeError({
+			message: errorMessage$2(cause),
+			cause
+		})
+	});
+});
+const makeHttpScanner = (options) => ({
+	id: "http",
+	description: "HTTP metadata, discovery, and content-negotiation probes",
+	scan: (input) => Effect.fn("SeoAudit.scanHttp")(function* () {
+		const target = new URL(input.target.url);
+		const evidence = yield* Effect.tryPromise({
+			try: () => probeAll(buildProbeRequests([target], options.discovery), options),
+			catch: (cause) => new ScannerFailure({
+				scanner: "http",
+				target: target.href,
+				message: errorMessage$2(cause),
+				cause
+			})
+		});
+		const acquisitionErrors = evidence.flatMap((probe) => probe.status === null && probe.error !== null ? [probe.error] : []);
+		if (acquisitionErrors.length === evidence.length) return yield* new ScannerFailure({
+			scanner: "http",
+			target: target.href,
+			message: `Every HTTP probe failed: ${[...new Set(acquisitionErrors)].join("; ")}`
+		});
+		return { evidence };
+	})()
+});
+//#endregion
+//#region src/audit/proxy.ts
+const proxyRequestHeaders = (headers, target) => {
+	const forwarded = {
+		...headers,
+		host: target.host
+	};
+	delete forwarded["proxy-authorization"];
+	delete forwarded["proxy-connection"];
+	return forwarded;
+};
+const connectAuthority = (authority) => {
+	const target = new URL(`http://${authority}`);
+	if (target.username || target.password || target.pathname !== "/" || target.search || target.hash) throw new Error("Invalid proxy CONNECT authority");
+	return target;
+};
+const connectPinned = (target, addresses, port, timeoutMs, track) => new Promise((resolve, reject) => {
+	const socket = connect({
+		host: networkHostname(target.hostname),
+		port,
+		autoSelectFamily: true,
+		lookup: pinnedLookup(addresses)
+	});
+	track(socket);
+	socket.setTimeout(timeoutMs, () => socket.destroy(/* @__PURE__ */ new Error("Proxy connection timed out")));
+	socket.once("connect", () => resolve(socket));
+	socket.once("error", reject);
+});
+/**
+* Start a loopback-only validating proxy for browser scanners. Every request,
+* including CONNECT and every redirect hop, is DNS-pinned and revalidated.
+*/
+const startAuditProxy = async (options) => {
+	const sockets = /* @__PURE__ */ new Set();
+	const timeoutMs = options.timeoutMs ?? 45e3;
+	let closed = false;
+	let closePromise;
+	const track = (socket) => {
+		sockets.add(socket);
+		socket.once("close", () => sockets.delete(socket));
+	};
+	const server = createServer(async (request$3, response) => {
+		try {
+			if (request$3.url === void 0) throw new Error("Proxy request URL is missing");
+			const target = new URL(request$3.url);
+			if (target.protocol !== "http:") throw new Error("HTTPS proxy requests must use CONNECT");
+			const addresses = await resolveTargetUrl(target, options.allowPrivate, options.resolve);
+			if (closed || request$3.destroyed) throw new Error("Audit proxy is closed");
+			const upstream = request({
+				hostname: networkHostname(target.hostname),
+				port: target.port || void 0,
+				path: `${target.pathname}${target.search}`,
+				method: request$3.method,
+				headers: proxyRequestHeaders(request$3.headers, target),
+				agent: false,
+				lookup: pinnedLookup(addresses)
+			});
+			upstream.once("socket", track);
+			upstream.setTimeout(timeoutMs, () => upstream.destroy(/* @__PURE__ */ new Error("Proxy request timed out")));
+			upstream.once("response", (upstreamResponse) => {
+				response.writeHead(upstreamResponse.statusCode ?? 502, upstreamResponse.headers);
+				upstreamResponse.pipe(response);
+			});
+			upstream.once("error", (error) => {
+				if (!response.headersSent) response.writeHead(502, { "content-type": "text/plain" });
+				response.end(error.message);
+			});
+			request$3.pipe(upstream);
+		} catch (error) {
+			response.writeHead(403, { "content-type": "text/plain" });
+			response.end(error instanceof Error ? error.message : String(error));
+		}
+	});
+	server.on("connection", track);
+	server.on("connect", async (request, client, head) => {
+		try {
+			if (request.url === void 0) throw new Error("Proxy CONNECT authority is missing");
+			const target = connectAuthority(request.url);
+			const port = target.port === "" ? 443 : Number(target.port);
+			if (!Number.isInteger(port) || port < 1 || port > 65535) throw new Error("Invalid proxy CONNECT port");
+			const addresses = await resolveTargetUrl(target, options.allowPrivate, options.resolve);
+			if (closed || client.destroyed) throw new Error("Audit proxy is closed");
+			const upstream = await connectPinned(target, addresses, port, timeoutMs, track);
+			client.write("HTTP/1.1 200 Connection Established\r\n\r\n");
+			if (head.byteLength > 0) upstream.write(head);
+			upstream.pipe(client);
+			client.pipe(upstream);
+		} catch (error) {
+			client.end(`HTTP/1.1 403 Forbidden\r\nConnection: close\r\nContent-Type: text/plain\r\n\r\n${error instanceof Error ? error.message : String(error)}`);
+		}
+	});
+	await new Promise((resolve, reject) => {
+		server.once("error", reject);
+		server.listen(0, "127.0.0.1", resolve);
+	});
+	const address = server.address();
+	if (address === null || typeof address === "string") throw new Error("Audit proxy did not bind");
+	return {
+		url: `http://127.0.0.1:${address.port}`,
+		close: () => {
+			closePromise ??= new Promise((resolve, reject) => {
+				closed = true;
+				for (const socket of sockets) socket.destroy();
+				server.close((error) => error ? reject(error) : resolve());
+			});
+			return closePromise;
+		}
+	};
+};
+//#endregion
+//#region src/audit/scanners/lighthouse.ts
+const require = createRequire(import.meta.url);
+const metricIds = [
+	"first-contentful-paint",
+	"largest-contentful-paint",
+	"total-blocking-time",
+	"cumulative-layout-shift",
+	"speed-index"
+];
+const UnknownRecord = Schema$1.Record(Schema$1.String, Schema$1.Unknown);
+const decodeUnknownRecord = Schema$1.decodeUnknownOption(UnknownRecord);
+const asRecord = (value) => Option.getOrNull(decodeUnknownRecord(value));
+const asString = (value) => typeof value === "string" ? value : null;
+const asNumber = (value) => typeof value === "number" && Number.isFinite(value) ? value : null;
+var LighthouseError = class extends Data$1.TaggedError("LighthouseError") {};
+const errorMessage$1 = (error) => error instanceof Error ? error.message : String(error);
+const resolveLighthouse = () => {
+	try {
+		return {
+			packageJson: require.resolve("lighthouse/package.json"),
+			cli: require.resolve("lighthouse/cli/index.js")
+		};
+	} catch (cause) {
+		throw new LighthouseError({
+			message: "Lighthouse is not installed. Install it as an optional dependency to enable browser audits.",
+			cause
+		});
+	}
+};
+const parseCategories = (value) => {
+	const categories = {};
+	for (const [id, candidate] of Object.entries(asRecord(value) ?? {})) {
+		const category = asRecord(candidate);
+		if (category !== null) categories[id] = {
+			id,
+			title: asString(category.title) ?? id,
+			score: asNumber(category.score)
+		};
+	}
+	return categories;
+};
+const parseMetrics = (auditsValue) => {
+	const metrics = {};
+	const audits = asRecord(auditsValue) ?? {};
+	for (const id of metricIds) {
+		const audit = asRecord(audits[id]);
+		if (audit !== null) metrics[id] = {
+			id,
+			title: asString(audit.title) ?? id,
+			numericValue: asNumber(audit.numericValue),
+			numericUnit: asString(audit.numericUnit),
+			displayValue: asString(audit.displayValue),
+			score: asNumber(audit.score)
+		};
+	}
+	return metrics;
+};
+const parseOpportunities = (auditsValue) => {
+	const opportunities = [];
+	for (const [id, candidate] of Object.entries(asRecord(auditsValue) ?? {})) {
+		const audit = asRecord(candidate);
+		const details = asRecord(audit?.details);
+		if (audit === null || details?.type !== "opportunity") continue;
+		const savingsMs = asNumber(details.overallSavingsMs);
+		const savingsBytes = asNumber(details.overallSavingsBytes);
+		if ((savingsMs ?? 0) <= 0 && (savingsBytes ?? 0) <= 0) continue;
+		opportunities.push({
+			id,
+			title: asString(audit.title) ?? id,
+			displayValue: asString(audit.displayValue),
+			savingsMs,
+			savingsBytes
+		});
+	}
+	return opportunities.sort((left, right) => (right.savingsMs ?? 0) - (left.savingsMs ?? 0) || (right.savingsBytes ?? 0) - (left.savingsBytes ?? 0));
+};
+const parseWarnings = (value) => Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+const parseLighthouseResult = (value, requestedUrl, formFactor, run) => {
+	const result = asRecord(value);
+	if (result === null) throw new LighthouseError({ message: "Lighthouse returned a non-object result" });
+	const environment = asRecord(result.environment);
+	return {
+		requestedUrl,
+		finalUrl: asString(result.finalDisplayedUrl) ?? asString(result.finalUrl),
+		formFactor,
+		run,
+		lighthouseVersion: asString(result.lighthouseVersion),
+		userAgent: asString(environment?.hostUserAgent),
+		fetchTime: asString(result.fetchTime),
+		categories: parseCategories(result.categories),
+		metrics: parseMetrics(result.audits),
+		opportunities: parseOpportunities(result.audits),
+		warnings: parseWarnings(result.runWarnings),
+		error: null
+	};
+};
+const lighthouseVersion = async () => {
+	try {
+		const { packageJson } = resolveLighthouse();
+		const value = JSON.parse(await readFile(packageJson, "utf8"));
+		return asString(asRecord(value)?.version);
+	} catch {
+		return null;
+	}
+};
+const lighthouseChromeFlags = (proxyUrl) => [
+	"--headless=new",
+	`--proxy-server=${proxyUrl}`,
+	"--proxy-bypass-list=<-loopback>",
+	"--disable-quic",
+	"--force-webrtc-ip-handling-policy=disable_non_proxied_udp"
+].join(" ");
+const windowsProcessTreeKill = (pid) => ({
+	command: "taskkill",
+	arguments: [
+		"/pid",
+		String(pid),
+		"/T",
+		"/F"
+	]
+});
+const runLighthouseProcess = async (cli, arguments_, timeoutMs, killGraceMs = 1e3) => {
+	const child = spawn(process.execPath, [cli, ...arguments_], {
+		detached: process.platform !== "win32",
+		stdio: [
+			"ignore",
+			"ignore",
+			"pipe"
+		]
+	});
+	let stderr = "";
+	child.stderr.setEncoding("utf8");
+	child.stderr.on("data", (chunk) => {
+		if (stderr.length < 16e3) stderr += chunk;
+	});
+	const signal = (name) => {
+		if (child.pid === void 0) return;
+		if (process.platform === "win32") {
+			const taskkill = windowsProcessTreeKill(child.pid);
+			const killer = spawn(taskkill.command, taskkill.arguments, {
+				stdio: "ignore",
+				windowsHide: true
+			});
+			const fallback = () => {
+				try {
+					child.kill("SIGKILL");
+				} catch {}
+			};
+			killer.once("error", fallback);
+			killer.once("exit", (code) => {
+				if (code !== 0) fallback();
+			});
+			return;
+		}
+		try {
+			process.kill(-child.pid, name);
+		} catch {
+			child.kill(name);
+		}
+	};
+	let timedOut = false;
+	let forceKill;
+	let abandon;
+	let timeout;
+	const exitCode = await new Promise((resolveExit, reject) => {
+		timeout = setTimeout(() => {
+			timedOut = true;
+			signal("SIGTERM");
+			forceKill = setTimeout(() => signal("SIGKILL"), killGraceMs);
+			abandon = setTimeout(() => reject(new LighthouseError({ message: `Lighthouse timed out after ${timeoutMs}ms and did not exit after SIGKILL` })), killGraceMs * 2);
+		}, timeoutMs);
+		child.once("error", reject);
+		child.once("exit", (code) => resolveExit(code ?? 1));
+	}).finally(() => {
+		if (timeout !== void 0) clearTimeout(timeout);
+		if (forceKill !== void 0) clearTimeout(forceKill);
+		if (abandon !== void 0) clearTimeout(abandon);
+	});
+	if (timedOut) throw new LighthouseError({ message: `Lighthouse timed out after ${timeoutMs}ms` });
+	if (exitCode !== 0) throw new LighthouseError({ message: `Lighthouse exited with ${exitCode}${stderr.trim() ? `: ${stderr.trim()}` : ""}` });
+};
+const runLighthouseInDirectory = async (options, directory) => {
+	const version = await lighthouseVersion();
+	const base = {
+		requestedUrl: options.url.href,
+		finalUrl: null,
+		formFactor: options.formFactor,
+		run: options.run,
+		lighthouseVersion: version,
+		userAgent: null,
+		fetchTime: null,
+		categories: {},
+		metrics: {},
+		opportunities: [],
+		warnings: []
+	};
+	let proxy;
+	try {
+		const { cli } = resolveLighthouse();
+		const output = join(directory, "result.json");
+		proxy = await startAuditProxy({
+			allowPrivate: options.allowPrivate,
+			timeoutMs: options.timeoutMs ?? 18e4
+		});
+		const args = [
+			options.url.href,
+			"--output=json",
+			`--output-path=${output}`,
+			"--quiet",
+			"--max-wait-for-load=45000",
+			`--chrome-flags=${lighthouseChromeFlags(proxy.url)}`
+		];
+		if (options.formFactor === "desktop") args.push("--preset=desktop");
+		await runLighthouseProcess(cli, args, options.timeoutMs ?? 18e4);
+		return parseLighthouseResult(JSON.parse(await readFile(output, "utf8")), options.url.href, options.formFactor, options.run);
+	} catch (error) {
+		return {
+			...base,
+			error: errorMessage$1(error)
+		};
+	} finally {
+		await proxy?.close();
+	}
+};
+const runLighthouse = async (options) => {
+	let directory;
+	try {
+		directory = await mkdtemp(join(tmpdir(), "tanstack-seo-lighthouse-"));
+		return await runLighthouseInDirectory(options, directory);
+	} finally {
+		if (directory !== void 0) await rm(directory, {
+			recursive: true,
+			force: true
+		});
+	}
+};
+Effect.fn("SeoAudit.runLighthouse")(function* (options) {
+	const directory = yield* Effect.acquireRelease(Effect.tryPromise({
+		try: () => mkdtemp(join(tmpdir(), "tanstack-seo-lighthouse-")),
+		catch: (cause) => new LighthouseError({
+			message: errorMessage$1(cause),
+			cause
+		})
+	}), (path) => Effect.promise(() => rm(path, {
+		recursive: true,
+		force: true
+	})));
+	return yield* Effect.tryPromise({
+		try: () => runLighthouseInDirectory(options, directory),
+		catch: (cause) => new LighthouseError({
+			message: errorMessage$1(cause),
+			cause
+		})
+	});
+});
+const makeLighthouseScanner = (options, dependencies = {}) => ({
+	id: "lighthouse",
+	description: "Lighthouse performance and accessibility measurements",
+	scan: (input) => Effect.fn("SeoAudit.scanLighthouse")(function* () {
+		const target = new URL(input.target.url);
+		const requestedFormFactors = input.options.formFactors === void 0 || input.options.formFactors.length === 0 ? ["mobile"] : input.options.formFactors;
+		const requestedRuns = Math.max(1, Math.floor(input.options.runs ?? 1));
+		const runs = [...new Set(requestedFormFactors)].flatMap((formFactor) => Array.from({ length: requestedRuns }, (_, index) => ({
+			formFactor,
+			run: index + 1
+		})));
+		const observations = yield* Effect.forEach(runs, ({ formFactor, run }) => Effect.tryPromise({
+			try: () => (dependencies.run ?? runLighthouse)({
+				...options,
+				url: target,
+				formFactor,
+				run
+			}),
+			catch: (cause) => new ScannerFailure({
+				scanner: "lighthouse",
+				target: target.href,
+				message: errorMessage$1(cause),
+				cause
+			})
+		}), { concurrency: 1 });
+		const errors = observations.flatMap((observation) => observation.error === null ? [] : [observation.error]);
+		if (errors.length === observations.length) return yield* new ScannerFailure({
+			scanner: "lighthouse",
+			target: target.href,
+			message: errors[0] ?? "Every Lighthouse run failed."
+		});
+		return { evidence: observations };
+	})()
+});
+//#endregion
+//#region src/audit/scanners/hosted.ts
+var HostedScannerError = class extends Data$1.TaggedError("HostedScannerError") {};
+const errorMessage = (error) => error instanceof Error ? error.message : String(error);
+const userAgent = "TanStackSeoAudit/1.0";
+const IsitagentreadyCheck = Schema$1.Struct({
+	status: Schema$1.String,
+	message: Schema$1.optionalKey(Schema$1.String)
+});
+const IsitagentreadyPayload = Schema$1.Struct({
+	scannedAt: Schema$1.optionalKey(Schema$1.String),
+	scanned_at: Schema$1.optionalKey(Schema$1.String),
+	level: Schema$1.optionalKey(Schema$1.Finite),
+	levelName: Schema$1.optionalKey(Schema$1.String),
+	level_name: Schema$1.optionalKey(Schema$1.String),
+	checks: Schema$1.optionalKey(Schema$1.Record(Schema$1.String, Schema$1.Record(Schema$1.String, IsitagentreadyCheck))),
+	nextLevel: Schema$1.optionalKey(Schema$1.Struct({
+		name: Schema$1.optionalKey(Schema$1.String),
+		requirements: Schema$1.optionalKey(Schema$1.Array(Schema$1.Struct({
+			check: Schema$1.optionalKey(Schema$1.String),
+			description: Schema$1.optionalKey(Schema$1.String),
+			prompt: Schema$1.optionalKey(Schema$1.String)
+		})))
+	})),
+	next_level: Schema$1.optionalKey(Schema$1.Struct({
+		name: Schema$1.optionalKey(Schema$1.String),
+		requirements: Schema$1.optionalKey(Schema$1.Array(Schema$1.Struct({
+			check: Schema$1.optionalKey(Schema$1.String),
+			description: Schema$1.optionalKey(Schema$1.String),
+			prompt: Schema$1.optionalKey(Schema$1.String)
+		})))
+	}))
+});
+const IsAgenticPayload = Schema$1.Struct({
+	score: Schema$1.optionalKey(Schema$1.Finite),
+	score_label: Schema$1.optionalKey(Schema$1.String),
+	report_url: Schema$1.optionalKey(Schema$1.String),
+	scanned_at: Schema$1.optionalKey(Schema$1.String),
+	score_breakdown: Schema$1.optionalKey(Schema$1.Struct({
+		essential: Schema$1.optionalKey(Schema$1.Struct({
+			earned: Schema$1.Finite,
+			available: Schema$1.Finite
+		})),
+		recommended: Schema$1.optionalKey(Schema$1.Struct({
+			earned: Schema$1.Finite,
+			available: Schema$1.Finite
+		}))
+	})),
+	issues: Schema$1.optionalKey(Schema$1.Array(Schema$1.Struct({
+		result: Schema$1.String,
+		tier: Schema$1.optionalKey(Schema$1.String),
+		name: Schema$1.String,
+		details: Schema$1.optionalKey(Schema$1.String),
+		recommendation: Schema$1.optionalKey(Schema$1.String)
+	})))
+});
+const SseEvent = Schema$1.Struct({ type: Schema$1.String });
+const IsitagentreadyJson = Schema$1.fromJsonString(IsitagentreadyPayload);
+const IsAgenticJson = Schema$1.fromJsonString(IsAgenticPayload);
+const SseEventJson = Schema$1.fromJsonString(SseEvent);
+const decodeIsitagentready = Schema$1.decodeUnknownSync(IsitagentreadyPayload);
+const decodeIsAgentic = Schema$1.decodeUnknownSync(IsAgenticPayload);
+const decodeIsitagentreadyJson = Schema$1.decodeUnknownEffect(IsitagentreadyJson);
+const decodeIsAgenticJson = Schema$1.decodeUnknownEffect(IsAgenticJson);
+const decodeSseEventJson = Schema$1.decodeUnknownOption(SseEventJson);
+const enabledChecks = [
+	"robotsTxt",
+	"sitemap",
+	"linkHeaders",
+	"dnsAid",
+	"markdownNegotiation",
+	"robotsTxtAiRules",
+	"contentSignals",
+	"webBotAuth",
+	"apiCatalog",
+	"oauthDiscovery",
+	"oauthProtectedResource",
+	"authMd",
+	"mcpServerCard",
+	"agentSkills",
+	"webMcp",
+	"ard",
+	"x402",
+	"mpp",
+	"ucp",
+	"acp"
+];
+const encodeRequest = Schema$1.encodeSync(Schema$1.fromJsonString(Schema$1.Struct({
+	url: Schema$1.String,
+	enabledChecks: Schema$1.Array(Schema$1.Literals(enabledChecks))
+})));
+const parseSseDataFrames = (buffer) => {
+	let rest = buffer.replaceAll("\r\n", "\n");
+	const events = [];
+	let boundary = rest.indexOf("\n\n");
+	while (boundary !== -1) {
+		const frame = rest.slice(0, boundary);
+		rest = rest.slice(boundary + 2);
+		const data = frame.split("\n").filter((line) => line.startsWith("data:")).map((line) => line.slice(5).trimStart()).join("\n");
+		if (data.length > 0) {
+			const event = Option.getOrNull(decodeSseEventJson(data));
+			if (event !== null) events.push(event);
+		}
+		boundary = rest.indexOf("\n\n");
+	}
+	return {
+		events,
+		rest
+	};
+};
+const pinnedResponse = async (request$2) => {
+	const addresses = await resolveTargetUrl(request$2.url, request$2.allowPrivate);
+	const transport = request$2.url.protocol === "https:" ? request$1 : request;
+	const hostname = networkHostname(request$2.url.hostname);
+	const headers = {
+		...request$2.headers,
+		host: request$2.url.host,
+		"user-agent": userAgent
+	};
+	if (request$2.body !== void 0) headers["content-length"] = Buffer.byteLength(request$2.body);
+	return new Promise((resolve, reject) => {
+		const outgoing = transport({
+			hostname,
+			port: request$2.url.port || void 0,
+			path: `${request$2.url.pathname}${request$2.url.search}`,
+			method: request$2.method,
+			headers,
+			agent: false,
+			lookup: pinnedLookup(addresses),
+			signal: AbortSignal.timeout(request$2.timeoutMs),
+			...request$2.url.protocol === "https:" ? {
+				servername: isIP(hostname) === 0 ? hostname : void 0,
+				checkServerIdentity: (_host, certificate) => checkServerIdentity(hostname, certificate)
+			} : void 0
+		});
+		outgoing.once("response", resolve);
+		outgoing.once("error", reject);
+		outgoing.end(request$2.body);
+	});
+};
+const readBody = async (response, maxBodyBytes) => {
+	const chunks = [];
+	let length = 0;
+	for await (const chunk of response) {
+		const value = new Uint8Array(chunk);
+		if (length + value.byteLength > maxBodyBytes) {
+			response.destroy();
+			throw new Error("Hosted scanner response exceeded byte limit");
+		}
+		chunks.push(value);
+		length += value.byteLength;
+	}
+	const bytes = new Uint8Array(length);
+	let offset = 0;
+	for (const chunk of chunks) {
+		bytes.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	const body = new TextDecoder().decode(bytes);
+	if (body.trim().length === 0) throw new Error("Hosted scanner returned an empty body");
+	return body;
+};
+const consumeStream = async (response, maxBodyBytes) => {
+	let buffer = "";
+	let length = 0;
+	let complete = false;
+	const decoder = new TextDecoder();
+	try {
+		for await (const chunk of response) {
+			const value = new Uint8Array(chunk);
+			length += value.byteLength;
+			if (length > maxBodyBytes) throw new Error("Hosted scanner stream exceeded byte limit");
+			buffer += decoder.decode(value, { stream: true });
+			const parsed = parseSseDataFrames(buffer);
+			buffer = parsed.rest;
+			if (parsed.events.some((event) => event.type === "error")) throw new Error("is-agentic scan failed");
+			if (parsed.events.some((event) => event.type === "scan_complete" || event.type === "scan_archived")) {
+				complete = true;
+				response.destroy();
+				break;
+			}
+		}
+	} catch (cause) {
+		if (complete) return;
+		throw cause;
+	}
+	buffer += decoder.decode();
+	if (!complete) throw new Error("is-agentic scan ended before a report was available");
+};
+const originHeader = (origin, path) => {
+	const base = origin.replace(/\/$/, "");
+	return {
+		origin: base,
+		referer: `${base}${path}`
+	};
+};
+const complete = (parsed, requestedUrl, startedAt) => ({
+	...parsed,
+	requestedUrl,
+	totalMs: Math.round((performance.now() - startedAt) * 10) / 10,
+	error: null
+});
+const failed = (scanner, target, requestedUrl, startedAt, error) => ({
+	scanner,
+	target: target.href,
+	requestedUrl,
+	reportUrl: null,
+	scannedAt: null,
+	score: null,
+	scoreLabel: null,
+	level: null,
+	levelName: null,
+	summary: null,
+	checks: [],
+	findings: [],
+	totalMs: Math.round((performance.now() - startedAt) * 10) / 10,
+	error: errorMessage(error)
+});
+const parseIsitagentready = (payload, target, origin) => {
+	const record = decodeIsitagentready(payload);
+	const checks = Object.entries(record.checks ?? {}).flatMap(([category, group]) => Object.entries(group).map(([id, check]) => ({
+		id,
+		category,
+		status: check.status,
+		message: check.message ?? null
+	})));
+	const passed = checks.filter((check) => check.status === "pass").length;
+	const failedCount = checks.filter((check) => check.status === "fail").length;
+	const level = record.level ?? null;
+	const levelName = record.levelName ?? record.level_name ?? null;
+	const next = record.nextLevel ?? record.next_level;
+	const findings = (next?.requirements ?? []).flatMap((requirement) => {
+		const name = requirement.check ?? requirement.description;
+		return name === void 0 ? [] : [{
+			result: "missing",
+			tier: next?.name ?? null,
+			name,
+			details: requirement.description ?? null,
+			recommendation: requirement.prompt ?? null
+		}];
+	});
+	return {
+		scanner: "isitagentready",
+		target: target.href,
+		reportUrl: `${origin.replace(/\/$/, "")}/${target.hostname}`,
+		scannedAt: record.scannedAt ?? record.scanned_at ?? null,
+		score: null,
+		scoreLabel: null,
+		level,
+		levelName,
+		summary: level === null && levelName === null ? `${passed} pass, ${failedCount} fail` : `Level ${level ?? "?"} ${levelName ?? ""}`.trim() + `, ${passed} pass, ${failedCount} fail`,
+		checks,
+		findings
+	};
+};
+const parseIsAgentic = (payload, target) => {
+	const record = decodeIsAgentic(payload);
+	const findings = (record.issues ?? []).map((issue) => ({
+		result: issue.result,
+		tier: issue.tier ?? null,
+		name: issue.name,
+		details: issue.details ?? null,
+		recommendation: issue.recommendation ?? null
+	}));
+	const failedCount = findings.filter((finding) => finding.result === "failed").length;
+	const partial = findings.filter((finding) => finding.result === "partial").length;
+	const bucket = (label, value) => value === void 0 ? null : `${label} ${value.earned}/${value.available}`;
+	return {
+		scanner: "is-agentic",
+		target: target.href,
+		reportUrl: record.report_url ?? null,
+		scannedAt: record.scanned_at ?? null,
+		score: record.score ?? null,
+		scoreLabel: record.score_label ?? null,
+		level: null,
+		levelName: null,
+		summary: [
+			record.score_label,
+			bucket("Essential", record.score_breakdown?.essential),
+			bucket("Recommended", record.score_breakdown?.recommended),
+			`${failedCount} failed, ${partial} partial`
+		].filter((part) => part !== null && part !== void 0 && part.length > 0).join(", "),
+		checks: [],
+		findings
+	};
+};
+const scanIsAgentic = Effect.fn("SeoAudit.scanHostedIsAgentic")(function* (target, options) {
+	const requested = new URL("/api/scan/stream", options.origins.isAgentic);
+	requested.searchParams.set("target", target.href);
+	requested.searchParams.set("force", "1");
+	const headers = originHeader(options.origins.isAgentic, `/scan/${target.hostname}`);
+	const response = yield* Effect.tryPromise({
+		try: () => pinnedResponse({
+			method: "GET",
+			url: requested,
+			headers: {
+				accept: "text/event-stream",
+				"cache-control": "no-cache",
+				pragma: "no-cache",
+				...headers
+			},
+			allowPrivate: options.allowPrivate,
+			timeoutMs: options.timeoutMs
+		}),
+		catch: (cause) => new HostedScannerError({
+			message: errorMessage(cause),
+			cause
+		})
+	});
+	const status = response.statusCode ?? 0;
+	if (status < 200 || status >= 300) {
+		const retry = response.headers["retry-after"];
+		response.destroy();
+		return yield* new HostedScannerError({ message: `is-agentic.com scan stream returned HTTP ${status}${typeof retry === "string" ? `, retry after ${retry}s` : ""}` });
+	}
+	yield* Effect.tryPromise({
+		try: () => consumeStream(response, options.maxBodyBytes),
+		catch: (cause) => new HostedScannerError({
+			message: errorMessage(cause),
+			cause
+		})
+	});
+	const report = new URL("/api/v1/report", options.origins.isAgentic);
+	report.searchParams.set("url", target.href);
+	let lastError = new HostedScannerError({ message: "is-agentic report is not available yet" });
+	for (let attempt = 0; attempt < 5; attempt += 1) {
+		const reportResponse = yield* Effect.tryPromise({
+			try: () => pinnedResponse({
+				method: "GET",
+				url: report,
+				headers: { accept: "application/json" },
+				allowPrivate: options.allowPrivate,
+				timeoutMs: options.timeoutMs
+			}),
+			catch: (cause) => new HostedScannerError({
+				message: errorMessage(cause),
+				cause
+			})
+		});
+		const reportStatus = reportResponse.statusCode ?? 0;
+		const body = yield* Effect.tryPromise({
+			try: () => readBody(reportResponse, options.maxBodyBytes),
+			catch: (cause) => new HostedScannerError({
+				message: errorMessage(cause),
+				cause
+			})
+		});
+		if (reportStatus >= 200 && reportStatus < 300) {
+			const payload = yield* decodeIsAgenticJson(body).pipe(Effect.mapError((cause) => new HostedScannerError({
+				message: errorMessage(cause),
+				cause
+			})));
+			return {
+				requested,
+				parsed: parseIsAgentic(payload, target)
+			};
+		}
+		lastError = new HostedScannerError({ message: `is-agentic report returned HTTP ${reportStatus}` });
+		yield* Effect.sleep(`${250 * (attempt + 1)} millis`);
+	}
+	return yield* lastError;
+});
+const scanIsitagentready = Effect.fn("SeoAudit.scanHostedIsitagentready")(function* (target, options) {
+	const requested = new URL("/api/scan", options.origins.isitagentready);
+	const headers = originHeader(options.origins.isitagentready, `/${target.hostname}`);
+	const response = yield* Effect.tryPromise({
+		try: () => pinnedResponse({
+			method: "POST",
+			url: requested,
+			headers: {
+				accept: "application/json",
+				"content-type": "application/json",
+				...headers
+			},
+			body: encodeRequest({
+				url: target.href,
+				enabledChecks: [...enabledChecks]
+			}),
+			allowPrivate: options.allowPrivate,
+			timeoutMs: options.timeoutMs
+		}),
+		catch: (cause) => new HostedScannerError({
+			message: errorMessage(cause),
+			cause
+		})
+	});
+	const status = response.statusCode ?? 0;
+	if (status < 200 || status >= 300) {
+		response.destroy();
+		return yield* new HostedScannerError({ message: `isitagentready.com returned HTTP ${status}` });
+	}
+	const body = yield* Effect.tryPromise({
+		try: () => readBody(response, options.maxBodyBytes),
+		catch: (cause) => new HostedScannerError({
+			message: errorMessage(cause),
+			cause
+		})
+	});
+	const payload = yield* decodeIsitagentreadyJson(body).pipe(Effect.mapError((cause) => new HostedScannerError({
+		message: errorMessage(cause),
+		cause
+	})));
+	return {
+		requested,
+		parsed: parseIsitagentready(payload, target, options.origins.isitagentready)
+	};
+});
+/** Opt-in hosted scanners. Results are attributed failures, never fatal audit failures. */
+const scanHosted = async (target, options) => {
+	const output = [];
+	const readyStartedAt = performance.now();
+	try {
+		const result = await Effect.runPromise(scanIsitagentready(target, options));
+		output.push(complete(result.parsed, result.requested.href, readyStartedAt));
+	} catch (error) {
+		output.push(failed("isitagentready", target, new URL("/api/scan", options.origins.isitagentready).href, readyStartedAt, error));
+	}
+	const agenticStartedAt = performance.now();
+	try {
+		const result = await Effect.runPromise(scanIsAgentic(target, options));
+		output.push(complete(result.parsed, result.requested.href, agenticStartedAt));
+	} catch (error) {
+		output.push(failed("is-agentic", target, new URL("/api/scan/stream", options.origins.isAgentic).href, agenticStartedAt, error));
+	}
+	return output;
+};
+const makeHostedScanner = (options) => ({
+	id: "hosted",
+	description: "Opt-in external agent-readiness reports",
+	scan: (input) => Effect.fn("SeoAudit.scanHosted")(function* () {
+		const target = new URL(input.target.url);
+		if (options.allowPrivateTargets !== true) yield* Effect.tryPromise({
+			try: () => resolveTargetUrl(target, false),
+			catch: (cause) => new ScannerFailure({
+				scanner: "hosted",
+				target: target.href,
+				message: "Hosted scanners only accept public target URLs.",
+				cause
+			})
+		});
+		const evidence = yield* Effect.tryPromise({
+			try: () => scanHosted(target, options),
+			catch: (cause) => new ScannerFailure({
+				scanner: "hosted",
+				target: target.href,
+				message: errorMessage(cause),
+				cause
+			})
+		});
+		if (evidence.every((report) => report.error !== null)) return yield* new ScannerFailure({
+			scanner: "hosted",
+			target: target.href,
+			message: evidence.map((report) => report.error).join("; ")
+		});
+		return { evidence };
+	})()
+});
+//#endregion
 export { Audit, AuditComparisonResult, AuditDiff, AuditDiffChange, AuditDiffOutcome, AuditDiffSummary, AuditFinding, AuditLayer, AuditLive, AuditPolicy, AuditReport, FindingSeverity, InvalidTarget, ScannerFailure, ScannerRegistryLive, ScannerResult, ScannerStatus, compareAuditReports, defaultAuditOptions, evaluateRules, lighthouseChromeFlags, makeAudit, makeHostedScanner, makeHttpScanner, makeLighthouseScanner, makeScannerRegistry, pageRules, parseLighthouseResult, renderAuditDiff, renderAuditMarkdown, scanner, writeAuditFiles };
+
+//# sourceMappingURL=audit.js.map