prodlint 0.9.1 → 0.9.3

package/dist/index.d.ts

@@ -50,7 +50,7 @@ interface CategoryScore {
     score: number;
     findingCount: number;
 }
-interface ScanResult$1 {
+interface ScanResult {
     version: string;
     scannedPath: string;
     filesScanned: number;
@@ -69,20 +69,26 @@ interface ScanOptions {
     ignore?: string[];
 }
 
-declare function scan(options: ScanOptions): Promise<ScanResult$1>;
+declare function scan(options: ScanOptions): Promise<ScanResult>;
 
 declare const rules: Rule[];
 
+interface ReportOptions {
+    quiet?: boolean;
+}
+declare function reportPretty(result: ScanResult, opts?: ReportOptions): string;
+declare function reportJson(result: ScanResult): string;
+declare function reportSummary(result: ScanResult): string;
+declare function reportSarif(result: ScanResult): string;
+
 type CheckStatus = "pass" | "fail" | "warn" | "info";
 type CheckSeverity = "critical" | "high" | "medium" | "low";
-type CheckMaturity = "established" | "emerging";
 interface ScanCheck {
     id: string;
     name: string;
     description: string;
     status: CheckStatus;
     severity: CheckSeverity;
-    maturity: CheckMaturity;
     points: number;
     maxPoints: number;
     details?: string;
@@ -101,7 +107,7 @@ interface CheckContext {
     html: string | null;
     loadTimeMs: number | null;
 }
-interface ScanResult {
+interface WebScanResult {
     url: string;
     domain: string;
     scannedAt: string;
@@ -116,6 +122,6 @@ interface ScanResult {
     };
 }
 
-declare function runWebScan(targetUrl: string): Promise<ScanResult>;
+declare function runWebScan(targetUrl: string): Promise<WebScanResult>;
 
-export { type Category, type CategoryScore, type FileContext, type Finding, type ProjectContext, type Rule, type ScanOptions, type ScanResult$1 as ScanResult, type Severity, type CheckContext as WebCheckContext, type ScanCheck as WebScanCheck, type ScanResult as WebScanResult, rules, runWebScan, scan };
+export { type Category, type CategoryScore, type FileContext, type Finding, type ProjectContext, type Rule, type ScanOptions, type ScanResult, type Severity, type CheckContext as WebCheckContext, type ScanCheck as WebScanCheck, type WebScanResult, reportJson, reportPretty, reportSarif, reportSummary, rules, runWebScan, scan };

package/dist/index.js

@@ -4501,114 +4501,305 @@ async function scan(options) {
   };
 }
 
+// src/reporter.ts
+import pc from "picocolors";
+var SEVERITY_COLORS = {
+  critical: pc.red,
+  warning: pc.yellow,
+  info: pc.blue
+};
+var SEVERITY_LABELS = {
+  critical: "CRIT",
+  warning: "WARN",
+  info: "INFO"
+};
+function scoreColor(score) {
+  if (score >= 80) return pc.green;
+  if (score >= 50) return pc.yellow;
+  return pc.red;
+}
+function groupByFile(findings) {
+  const map = /* @__PURE__ */ new Map();
+  for (const f of findings) {
+    const group = map.get(f.file) ?? [];
+    group.push(f);
+    map.set(f.file, group);
+  }
+  return map;
+}
+function reportPretty(result, opts = {}) {
+  const lines = [];
+  const { critical, warning, info } = result.summary;
+  lines.push("");
+  lines.push(pc.bold("  prodlint") + pc.dim(` v${result.version}`));
+  const headerParts = [`Scanned ${result.filesScanned} files`];
+  if (critical > 0) headerParts.push(`${critical} critical`);
+  if (warning > 0) headerParts.push(`${warning} warnings`);
+  if (info > 0) headerParts.push(`${info} info`);
+  lines.push(pc.dim(`  ${headerParts.join(" \xB7 ")}`));
+  lines.push("");
+  if (result.findings.length > 0) {
+    const grouped = groupByFile(result.findings);
+    for (const [file, findings] of grouped) {
+      lines.push(pc.underline(file));
+      for (const f of findings) {
+        const color = SEVERITY_COLORS[f.severity];
+        const label = SEVERITY_LABELS[f.severity];
+        lines.push(
+          `  ${pc.dim(`${f.line}:${f.column}`)}  ${color(label)}  ${f.message}  ${pc.dim(f.ruleId)}`
+        );
+        if (f.fix) {
+          lines.push(`  ${pc.dim(`      \u21B3 ${f.fix}`)}`);
+        }
+      }
+      lines.push("");
+    }
+  }
+  lines.push(pc.bold("  Scores"));
+  for (const cs of result.categoryScores) {
+    const color = scoreColor(cs.score);
+    const bar = renderBar(cs.score);
+    lines.push(`  ${cs.category.padEnd(14)} ${color(String(cs.score).padStart(3))} ${bar}  ${pc.dim(`(${cs.findingCount} issues)`)}`);
+  }
+  lines.push("");
+  const overallColor = scoreColor(result.overallScore);
+  lines.push(pc.bold(`  Overall: ${overallColor(String(result.overallScore))}/100`));
+  lines.push("");
+  const summaryParts = [];
+  if (critical > 0) summaryParts.push(pc.red(`${critical} critical`));
+  if (warning > 0) summaryParts.push(pc.yellow(`${warning} warnings`));
+  if (info > 0) summaryParts.push(pc.blue(`${info} info`));
+  if (summaryParts.length === 0) {
+    lines.push(pc.green("  No issues found!"));
+  } else {
+    lines.push(`  ${summaryParts.join(pc.dim(" \xB7 "))}`);
+  }
+  lines.push("");
+  if (!opts.quiet) {
+    const badgeColor = result.overallScore >= 80 ? "brightgreen" : result.overallScore >= 60 ? "yellow" : "red";
+    const badgeUrl = `https://img.shields.io/badge/prodlint-${result.overallScore}%2F100-${badgeColor}`;
+    lines.push(pc.dim("  Add to your README:"));
+    lines.push(pc.dim(`  [![prodlint](${badgeUrl})](https://prodlint.com)`));
+    lines.push("");
+  }
+  return lines.join("\n");
+}
+function reportJson(result) {
+  return JSON.stringify(result, null, 2);
+}
+function reportSummary(result) {
+  const lines = [];
+  const { critical, warning, info } = result.summary;
+  const hasCritical = critical > 0;
+  const verdict = hasCritical ? pc.red(pc.bold("FAIL")) : pc.green(pc.bold("PASS"));
+  const scorePart = scoreColor(result.overallScore)(`${result.overallScore}/100`);
+  const countParts = [];
+  if (critical > 0) countParts.push(`${critical} critical`);
+  if (warning > 0) countParts.push(`${warning} warning`);
+  if (info > 0) countParts.push(`${info} info`);
+  lines.push("");
+  if (countParts.length > 0) {
+    lines.push(`  ${verdict} ${pc.dim("\u2014")} ${countParts.join(", ")} ${pc.dim(`(score: ${scorePart})`)}`);
+  } else {
+    lines.push(`  ${verdict} ${pc.dim("\u2014")} no issues ${pc.dim(`(score: ${scorePart})`)}`);
+  }
+  const topFindings = result.findings.filter((f) => f.severity === "critical" || f.severity === "warning").slice(0, 3);
+  if (topFindings.length > 0) {
+    for (let i = 0; i < topFindings.length; i++) {
+      const f = topFindings[i];
+      const color = SEVERITY_COLORS[f.severity];
+      const label = SEVERITY_LABELS[f.severity];
+      lines.push(`  ${pc.dim(`${i + 1}.`)} ${f.file}:${f.line} ${pc.dim("\u2014")} ${color(label)} ${f.message} ${pc.dim(f.ruleId)}`);
+    }
+  }
+  lines.push("");
+  return lines.join("\n");
+}
+var SARIF_SEVERITY_MAP = {
+  critical: "error",
+  warning: "warning",
+  info: "note"
+};
+function reportSarif(result) {
+  const ruleMap = /* @__PURE__ */ new Map();
+  for (const r of rules) {
+    ruleMap.set(r.id, r);
+  }
+  const usedRuleIds = new Set(result.findings.map((f) => f.ruleId));
+  const sarifRules = [...usedRuleIds].map((id) => {
+    const rule = ruleMap.get(id);
+    return {
+      id,
+      name: rule?.name ?? id,
+      shortDescription: { text: rule?.description ?? id },
+      defaultConfiguration: {
+        level: SARIF_SEVERITY_MAP[rule?.severity ?? "info"] ?? "note"
+      },
+      helpUri: `https://prodlint.com/rules/${id}`
+    };
+  });
+  const sarifResults = result.findings.map((f) => {
+    const sarifResult = {
+      ruleId: f.ruleId,
+      level: SARIF_SEVERITY_MAP[f.severity] ?? "note",
+      message: { text: f.message },
+      locations: [
+        {
+          physicalLocation: {
+            artifactLocation: { uri: f.file.replace(/\\/g, "/") },
+            region: { startLine: f.line, startColumn: f.column }
+          }
+        }
+      ]
+    };
+    if (f.fix) {
+      sarifResult.fixes = [
+        {
+          description: { text: f.fix }
+        }
+      ];
+    }
+    return sarifResult;
+  });
+  const sarif = {
+    $schema: "https://json.schemastore.org/sarif-2.1.0.json",
+    version: "2.1.0",
+    runs: [
+      {
+        tool: {
+          driver: {
+            name: "prodlint",
+            version: getVersion(),
+            informationUri: "https://prodlint.com",
+            rules: sarifRules
+          }
+        },
+        results: sarifResults
+      }
+    ]
+  };
+  return JSON.stringify(sarif, null, 2);
+}
+function renderBar(score) {
+  const width = 20;
+  const filled = Math.round(score / 100 * width);
+  const empty = width - filled;
+  const color = scoreColor(score);
+  return color("\u2588".repeat(filled)) + pc.dim("\u2591".repeat(empty));
+}
+var STATUS_ICONS = {
+  pass: pc.green,
+  fail: pc.red,
+  warn: pc.yellow,
+  info: pc.blue
+};
+
 // src/web-scanner/checks.ts
-function make(id, name, description, maxPoints, severity, maturity, status, details) {
+function make(id, name, description, maxPoints, severity, status, details) {
   return {
     id,
     name,
     description,
     status,
     severity,
-    maturity,
     details,
     points: status === "pass" ? maxPoints : status === "warn" ? Math.floor(maxPoints / 2) : 0,
     maxPoints
   };
 }
 function checkRobotsTxt(ctx) {
-  if (!ctx.robotsTxt) return make("robots_txt", "robots.txt", "robots.txt exists and is accessible", 7, "medium", "established", "fail", "No robots.txt found.");
-  return make("robots_txt", "robots.txt", "robots.txt exists and is accessible", 7, "medium", "established", "pass", "robots.txt found.");
+  if (!ctx.robotsTxt) return make("robots_txt", "robots.txt", "robots.txt exists and is accessible", 5, "medium", "fail", "No robots.txt found.");
+  return make("robots_txt", "robots.txt", "robots.txt exists and is accessible", 5, "medium", "pass", "robots.txt found.");
 }
 function checkRobotsAiDirectives(ctx) {
-  if (!ctx.robotsTxt) return make("robots_ai_directives", "AI robots.txt Directives", "AI bot user-agents in robots.txt", 15, "critical", "established", "fail", "No robots.txt found. AI bots have no guidance.");
-  const agents = ["GPTBot", "ChatGPT-User", "ClaudeBot", "Claude-Web", "Google-Extended", "PerplexityBot", "Bytespider", "CCBot", "anthropic-ai", "cohere-ai", "Applebot-Extended", "Grok"];
+  if (!ctx.robotsTxt) return make("robots_ai_directives", "AI robots.txt Directives", "AI bot user-agents in robots.txt", 15, "critical", "fail", "No robots.txt found. AI bots have no guidance.");
+  const agents = ["GPTBot", "ChatGPT-User", "ClaudeBot", "Claude-Web", "Google-Extended", "PerplexityBot", "Bytespider", "CCBot", "anthropic-ai", "cohere-ai"];
   const found = agents.filter((a) => ctx.robotsTxt.toLowerCase().includes(a.toLowerCase()));
-  if (found.length === 0) return make("robots_ai_directives", "AI robots.txt Directives", "AI bot user-agents in robots.txt", 15, "critical", "established", "fail", "No AI-specific user-agent directives found.");
-  if (found.length < 3) return make("robots_ai_directives", "AI robots.txt Directives", "AI bot user-agents in robots.txt", 15, "critical", "established", "warn", `Found ${found.length} AI bot directive(s): ${found.join(", ")}.`);
-  return make("robots_ai_directives", "AI robots.txt Directives", "AI bot user-agents in robots.txt", 15, "critical", "established", "pass", `Found ${found.length} AI bot directive(s): ${found.join(", ")}.`);
+  if (found.length === 0) return make("robots_ai_directives", "AI robots.txt Directives", "AI bot user-agents in robots.txt", 15, "critical", "fail", "No AI-specific user-agent directives found.");
+  if (found.length < 3) return make("robots_ai_directives", "AI robots.txt Directives", "AI bot user-agents in robots.txt", 15, "critical", "warn", `Found ${found.length} AI bot directive(s): ${found.join(", ")}.`);
+  return make("robots_ai_directives", "AI robots.txt Directives", "AI bot user-agents in robots.txt", 15, "critical", "pass", `Found ${found.length} AI bot directive(s): ${found.join(", ")}.`);
 }
 function checkContentUsage(ctx) {
   const hasHeader = ctx.headers["content-usage"] != null;
   const hasInRobots = ctx.robotsTxt?.toLowerCase().includes("content-usage") ?? false;
-  if (!hasHeader && !hasInRobots) return make("content_usage", "Content-Usage (IETF aipref)", "Content-Usage header or directives", 5, "high", "emerging", "fail", "No Content-Usage directives found.");
-  return make("content_usage", "Content-Usage (IETF aipref)", "Content-Usage header or directives", 5, "high", "emerging", "pass", hasHeader ? `Header: ${ctx.headers["content-usage"]}` : "Found in robots.txt.");
+  if (!hasHeader && !hasInRobots) return make("content_usage", "Content-Usage (IETF aipref)", "Content-Usage header or directives", 10, "high", "fail", "No Content-Usage directives found.");
+  return make("content_usage", "Content-Usage (IETF aipref)", "Content-Usage header or directives", 10, "high", "pass", hasHeader ? `Header: ${ctx.headers["content-usage"]}` : "Found in robots.txt.");
 }
 function checkLlmsTxt(ctx) {
-  if (!ctx.llmsTxt) return make("llms_txt", "llms.txt", "LLM-optimized site summary at /llms.txt", 6, "high", "emerging", "fail", "No llms.txt found.");
-  const lines = ctx.llmsTxt.split("\n").filter((l) => l.trim().length > 0 && !l.trim().startsWith("#"));
-  if (lines.length < 3) return make("llms_txt", "llms.txt", "LLM-optimized site summary at /llms.txt", 6, "high", "emerging", "warn", "llms.txt found but appears minimal.");
-  return make("llms_txt", "llms.txt", "LLM-optimized site summary at /llms.txt", 6, "high", "emerging", "pass", `llms.txt found with ${lines.length} content lines.`);
+  if (!ctx.llmsTxt) return make("llms_txt", "llms.txt", "LLM-optimized site summary at /llms.txt", 10, "high", "fail", "No llms.txt found.");
+  const lines = ctx.llmsTxt.split("\n").filter((l) => l.trim().length > 0);
+  if (lines.length < 3) return make("llms_txt", "llms.txt", "LLM-optimized site summary at /llms.txt", 10, "high", "warn", "llms.txt found but appears minimal.");
+  return make("llms_txt", "llms.txt", "LLM-optimized site summary at /llms.txt", 10, "high", "pass", `llms.txt found with ${lines.length} lines.`);
 }
 function checkTdmRep(ctx) {
   const hasWK = ctx.tdmRep != null;
   const hasHeader = ctx.headers["tdm-reservation"] != null;
-  if (!hasWK && !hasHeader) return make("tdmrep", "TDMRep (W3C)", "Text & data mining reservation file or header", 4, "medium", "emerging", "fail", "No TDMRep configuration found.");
-  return make("tdmrep", "TDMRep (W3C)", "Text & data mining reservation file or header", 4, "medium", "emerging", "pass", hasWK ? "/.well-known/tdmrep.json found." : `TDM-Reservation header: ${ctx.headers["tdm-reservation"]}`);
+  if (!hasWK && !hasHeader) return make("tdmrep", "TDMRep (W3C)", "Text & data mining reservation file or header", 8, "medium", "fail", "No TDMRep configuration found.");
+  return make("tdmrep", "TDMRep (W3C)", "Text & data mining reservation file or header", 8, "medium", "pass", hasWK ? "/.well-known/tdmrep.json found." : `TDM-Reservation header: ${ctx.headers["tdm-reservation"]}`);
 }
 function checkAiDisclosure(ctx) {
-  if (!ctx.headers["ai-disclosure"]) return make("ai_disclosure", "AI-Disclosure Header", "Declares AI involvement in content generation", 2, "low", "emerging", "fail", "No AI-Disclosure header found.");
-  return make("ai_disclosure", "AI-Disclosure Header", "Declares AI involvement in content generation", 2, "low", "emerging", "pass", `Header: ${ctx.headers["ai-disclosure"]}`);
+  if (!ctx.headers["ai-disclosure"]) return make("ai_disclosure", "AI-Disclosure Header", "Declares AI involvement in content generation", 5, "low", "fail", "No AI-Disclosure header found.");
+  return make("ai_disclosure", "AI-Disclosure Header", "Declares AI involvement in content generation", 5, "low", "pass", `Header: ${ctx.headers["ai-disclosure"]}`);
 }
 function checkAgentCard(ctx) {
-  if (!ctx.agentCard) return make("agent_card", "A2A AgentCard", "/.well-known/agent-card.json for agent discovery", 5, "high", "emerging", "fail", "No A2A AgentCard found.");
+  if (!ctx.agentCard) return make("agent_card", "A2A AgentCard", "/.well-known/agent-card.json for agent discovery", 10, "high", "fail", "No A2A AgentCard found.");
   try {
     const card = JSON.parse(ctx.agentCard);
-    if (!card.name || !Array.isArray(card.skills) || card.skills.length === 0) return make("agent_card", "A2A AgentCard", "/.well-known/agent-card.json for agent discovery", 5, "high", "emerging", "warn", "AgentCard found but missing name or skills.");
-    return make("agent_card", "A2A AgentCard", "/.well-known/agent-card.json for agent discovery", 5, "high", "emerging", "pass", `AgentCard found with ${card.skills.length} skill(s).`);
+    if (!card.name || !Array.isArray(card.skills) || card.skills.length === 0) return make("agent_card", "A2A AgentCard", "/.well-known/agent-card.json for agent discovery", 10, "high", "warn", "AgentCard found but missing name or skills.");
+    return make("agent_card", "A2A AgentCard", "/.well-known/agent-card.json for agent discovery", 10, "high", "pass", `AgentCard found with ${card.skills.length} skill(s).`);
   } catch {
-    return make("agent_card", "A2A AgentCard", "/.well-known/agent-card.json for agent discovery", 5, "high", "emerging", "warn", "AgentCard found but contains invalid JSON.");
+    return make("agent_card", "A2A AgentCard", "/.well-known/agent-card.json for agent discovery", 10, "high", "warn", "AgentCard found but contains invalid JSON.");
   }
 }
 function checkAiTxt(ctx) {
-  if (!ctx.aiTxt) return make("ai_txt", "ai.txt", "AI training permissions per Spawning spec", 3, "medium", "emerging", "fail", "No ai.txt found at site root.");
+  if (!ctx.aiTxt) return make("ai_txt", "ai.txt", "AI training permissions per Spawning spec", 5, "medium", "fail", "No ai.txt found at site root.");
   const lines = ctx.aiTxt.split("\n").filter((l) => l.trim().length > 0 && !l.trim().startsWith("#"));
-  if (lines.length < 2) return make("ai_txt", "ai.txt", "AI training permissions per Spawning spec", 3, "medium", "emerging", "warn", "ai.txt found but appears minimal.");
-  return make("ai_txt", "ai.txt", "AI training permissions per Spawning spec", 3, "medium", "emerging", "pass", `ai.txt found with ${lines.length} directive(s).`);
+  if (lines.length < 2) return make("ai_txt", "ai.txt", "AI training permissions per Spawning spec", 5, "medium", "warn", "ai.txt found but appears minimal.");
+  return make("ai_txt", "ai.txt", "AI training permissions per Spawning spec", 5, "medium", "pass", `ai.txt found with ${lines.length} directive(s).`);
 }
 function checkWebMCP(ctx) {
-  if (!ctx.html) return make("webmcp", "WebMCP Tools", "Chrome 146+ WebMCP tool registration", 5, "high", "emerging", "info", "Could not check for WebMCP tools.");
+  if (!ctx.html) return make("webmcp", "WebMCP Tools", "Chrome 146+ WebMCP tool registration", 10, "high", "info", "Could not check for WebMCP tools.");
   const hasToolname = /toolname=/i.test(ctx.html);
   const hasModelContext = /navigator\.modelContext/i.test(ctx.html) || /registerTool/i.test(ctx.html);
-  if (!hasToolname && !hasModelContext) return make("webmcp", "WebMCP Tools", "Chrome 146+ WebMCP tool registration", 5, "high", "emerging", "fail", "No WebMCP tools detected.");
+  if (!hasToolname && !hasModelContext) return make("webmcp", "WebMCP Tools", "Chrome 146+ WebMCP tool registration", 10, "high", "fail", "No WebMCP tools detected.");
   const count = (ctx.html.match(/toolname=/gi) || []).length;
-  return make("webmcp", "WebMCP Tools", "Chrome 146+ WebMCP tool registration", 5, "high", "emerging", "pass", hasToolname ? `${count} form(s) with toolname attributes.` : "registerTool() usage detected.");
+  return make("webmcp", "WebMCP Tools", "Chrome 146+ WebMCP tool registration", 10, "high", "pass", hasToolname ? `${count} form(s) with toolname attributes.` : "registerTool() usage detected.");
 }
 function checkStructuredData(ctx) {
-  if (!ctx.html) return make("structured_data", "Structured Data", "JSON-LD or Schema.org markup", 12, "medium", "established", "info", "Could not fetch page HTML.");
+  if (!ctx.html) return make("structured_data", "Structured Data", "JSON-LD or Schema.org markup", 10, "medium", "info", "Could not fetch page HTML.");
   const jsonLd = ctx.html.match(/<script[^>]*type=["']application\/ld\+json["'][^>]*>/gi);
   const hasMicrodata = ctx.html.includes("itemscope") && ctx.html.includes("itemtype");
-  if (!jsonLd && !hasMicrodata) return make("structured_data", "Structured Data", "JSON-LD or Schema.org markup", 12, "medium", "established", "fail", "No structured data found.");
-  return make("structured_data", "Structured Data", "JSON-LD or Schema.org markup", 12, "medium", "established", "pass", `Found ${(jsonLd?.length || 0) + (hasMicrodata ? 1 : 0)} structured data block(s).`);
+  if (!jsonLd && !hasMicrodata) return make("structured_data", "Structured Data", "JSON-LD or Schema.org markup", 10, "medium", "fail", "No structured data found.");
+  return make("structured_data", "Structured Data", "JSON-LD or Schema.org markup", 10, "medium", "pass", `Found ${(jsonLd?.length || 0) + (hasMicrodata ? 1 : 0)} structured data block(s).`);
 }
 function checkOpenGraph(ctx) {
-  if (!ctx.html) return make("opengraph", "OpenGraph & Meta", "OG tags and meta description", 10, "low", "established", "info", "Could not fetch HTML.");
+  if (!ctx.html) return make("opengraph", "OpenGraph & Meta", "OG tags and meta description", 7, "low", "info", "Could not fetch HTML.");
   const checks = [/og:title/i.test(ctx.html), /og:description/i.test(ctx.html), /og:image/i.test(ctx.html), /name=["']description["']/i.test(ctx.html)];
   const passed = checks.filter(Boolean).length;
-  if (passed === 0) return make("opengraph", "OpenGraph & Meta", "OG tags and meta description", 10, "low", "established", "fail", "No OpenGraph tags or meta description.");
-  if (passed < 3) return make("opengraph", "OpenGraph & Meta", "OG tags and meta description", 10, "low", "established", "warn", `Found ${passed}/4 meta tags.`);
-  if (passed < 4) return make("opengraph", "OpenGraph & Meta", "OG tags and meta description", 10, "low", "established", "pass", `Found ${passed}/4 key meta tags.`);
-  return make("opengraph", "OpenGraph & Meta", "OG tags and meta description", 10, "low", "established", "pass", "All 4 key meta tags present.");
+  if (passed === 0) return make("opengraph", "OpenGraph & Meta", "OG tags and meta description", 7, "low", "fail", "No OpenGraph tags or meta description.");
+  if (passed < 3) return make("opengraph", "OpenGraph & Meta", "OG tags and meta description", 7, "low", "warn", `Found ${passed}/4 meta tags.`);
+  return make("opengraph", "OpenGraph & Meta", "OG tags and meta description", 7, "low", "pass", `All ${passed} key meta tags present.`);
 }
 function checkSitemap(ctx) {
-  if (!ctx.sitemapXml) return make("sitemap", "sitemap.xml", "Sitemap exists and is valid", 10, "medium", "established", "fail", "No sitemap.xml found.");
+  if (!ctx.sitemapXml) return make("sitemap", "sitemap.xml", "Sitemap exists and is valid", 5, "medium", "fail", "No sitemap.xml found.");
   const count = Math.max((ctx.sitemapXml.match(/<url>/gi) || []).length, (ctx.sitemapXml.match(/<loc>/gi) || []).length);
-  if (count === 0 && /<sitemapindex/i.test(ctx.sitemapXml)) return make("sitemap", "sitemap.xml", "Sitemap exists and is valid", 10, "medium", "established", "pass", "Sitemap index found.");
-  if (count === 0) return make("sitemap", "sitemap.xml", "Sitemap exists and is valid", 10, "medium", "established", "warn", "sitemap.xml found but appears empty.");
-  return make("sitemap", "sitemap.xml", "Sitemap exists and is valid", 10, "medium", "established", "pass", `sitemap.xml found with ${count} URL(s).`);
+  if (count === 0 && /<sitemapindex/i.test(ctx.sitemapXml)) return make("sitemap", "sitemap.xml", "Sitemap exists and is valid", 5, "medium", "pass", "Sitemap index found.");
+  if (count === 0) return make("sitemap", "sitemap.xml", "Sitemap exists and is valid", 5, "medium", "warn", "sitemap.xml found but appears empty.");
+  return make("sitemap", "sitemap.xml", "Sitemap exists and is valid", 5, "medium", "pass", `sitemap.xml found with ${count} URL(s).`);
 }
 function checkHttpSignatures(ctx) {
   const hasDirectory = ctx.httpSigDirectory != null;
   const hasSignatureHeader = ctx.headers["signature"] != null || ctx.headers["signature-input"] != null;
   const hasSignatureAgent = ctx.headers["signature-agent"] != null;
-  if (!hasDirectory && !hasSignatureHeader && !hasSignatureAgent) return make("http_signatures", "HTTP Message Signatures (RFC 9421)", "Agent identity verification via cryptographic signatures", 3, "medium", "emerging", "fail", "No HTTP signature support detected.");
-  if (hasDirectory) return make("http_signatures", "HTTP Message Signatures (RFC 9421)", "Agent identity verification via cryptographic signatures", 3, "medium", "emerging", "pass", "/.well-known/http-message-signatures-directory found.");
-  return make("http_signatures", "HTTP Message Signatures (RFC 9421)", "Agent identity verification via cryptographic signatures", 3, "medium", "emerging", "pass", hasSignatureAgent ? "Signature-Agent header detected." : "Signature/Signature-Input headers detected.");
+  if (!hasDirectory && !hasSignatureHeader && !hasSignatureAgent) return make("http_signatures", "HTTP Message Signatures (RFC 9421)", "Agent identity verification via cryptographic signatures", 5, "medium", "fail", "No HTTP signature support detected.");
+  if (hasDirectory) return make("http_signatures", "HTTP Message Signatures (RFC 9421)", "Agent identity verification via cryptographic signatures", 5, "medium", "pass", "/.well-known/http-message-signatures-directory found.");
+  return make("http_signatures", "HTTP Message Signatures (RFC 9421)", "Agent identity verification via cryptographic signatures", 5, "medium", "pass", hasSignatureAgent ? "Signature-Agent header detected." : "Signature/Signature-Input headers detected.");
 }
 function checkPageSpeed(ctx) {
-  if (ctx.loadTimeMs == null) return make("page_speed", "Page Load Time", "Response time for AI agent interactions", 8, "low", "established", "info", "Could not measure.");
-  if (ctx.loadTimeMs > 5e3) return make("page_speed", "Page Load Time", "Response time for AI agent interactions", 8, "low", "established", "fail", `${(ctx.loadTimeMs / 1e3).toFixed(1)}s \u2014 agents may time out.`);
-  if (ctx.loadTimeMs > 2e3) return make("page_speed", "Page Load Time", "Response time for AI agent interactions", 8, "low", "established", "warn", `${(ctx.loadTimeMs / 1e3).toFixed(1)}s \u2014 consider optimizing.`);
-  return make("page_speed", "Page Load Time", "Response time for AI agent interactions", 8, "low", "established", "pass", `${(ctx.loadTimeMs / 1e3).toFixed(1)}s.`);
+  if (ctx.loadTimeMs == null) return make("page_speed", "Page Load Time", "Response time for AI agent interactions", 5, "low", "info", "Could not measure.");
+  if (ctx.loadTimeMs > 5e3) return make("page_speed", "Page Load Time", "Response time for AI agent interactions", 5, "low", "fail", `${(ctx.loadTimeMs / 1e3).toFixed(1)}s \u2014 agents may time out.`);
+  if (ctx.loadTimeMs > 2e3) return make("page_speed", "Page Load Time", "Response time for AI agent interactions", 5, "low", "warn", `${(ctx.loadTimeMs / 1e3).toFixed(1)}s \u2014 consider optimizing.`);
+  return make("page_speed", "Page Load Time", "Response time for AI agent interactions", 5, "low", "pass", `${(ctx.loadTimeMs / 1e3).toFixed(1)}s.`);
 }
 var allChecks = [
   checkRobotsTxt,
@@ -4647,29 +4838,6 @@ function isPrivateHost(hostname) {
   if (PRIVATE_HOSTNAMES.has(hostname.toLowerCase())) return true;
   const h = hostname.replace(/^\[|\]$/g, "").toLowerCase();
   if (h === "::1" || h.startsWith("fe80:") || h.startsWith("fc") || h.startsWith("fd") || h === "::") return true;
-  const v4mapped = h.match(/^(?:::ffff:)(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
-  if (v4mapped) {
-    const [, a, b] = v4mapped.map(Number);
-    if (a === 10 || a === 127 || a === 0) return true;
-    if (a === 172 && b >= 16 && b <= 31) return true;
-    if (a === 192 && b === 168) return true;
-    if (a === 169 && b === 254) return true;
-    return false;
-  }
-  if (/^(0[xX][0-9a-fA-F]+|0[0-7]+)(\.|$)/.test(hostname)) return true;
-  if (/^\d+$/.test(hostname)) {
-    const dec = parseInt(hostname, 10);
-    if (dec >= 0 && dec <= 4294967295) {
-      const a = dec >>> 24 & 255;
-      const b = dec >>> 16 & 255;
-      if (a === 10 || a === 127 || a === 0) return true;
-      if (a === 172 && b >= 16 && b <= 31) return true;
-      if (a === 192 && b === 168) return true;
-      if (a === 169 && b === 254) return true;
-      if (a === 100 && b >= 64 && b <= 127) return true;
-      if (a === 198 && (b === 18 || b === 19)) return true;
-    }
-  }
   const ipv4 = hostname.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
   if (ipv4) {
     const [, a, b] = ipv4.map(Number);
@@ -4682,49 +4850,22 @@ function isPrivateHost(hostname) {
   }
   return false;
 }
-function isAllowedProtocol(url) {
-  try {
-    const p = new URL(url).protocol;
-    return p === "https:" || p === "http:";
-  } catch {
-    return false;
-  }
-}
 function validateRedirectUrl(responseUrl) {
   try {
     const parsed = new URL(responseUrl);
-    if (!isAllowedProtocol(responseUrl)) return false;
     return !isPrivateHost(parsed.hostname);
   } catch {
     return false;
   }
 }
-var MAX_REDIRECTS = 5;
-async function safeFetch(url, timeout, signal) {
-  let current = url;
-  for (let i = 0; i < MAX_REDIRECTS; i++) {
-    const r = await fetch(current, { signal, headers: { "User-Agent": "Prodlint-WebScanner/1.0" }, redirect: "manual" });
-    const status = r.status;
-    if (status >= 300 && status < 400) {
-      const location = r.headers.get("location");
-      if (!location) return null;
-      const resolved = new URL(location, current).toString();
-      if (!validateRedirectUrl(resolved)) return null;
-      current = resolved;
-      continue;
-    }
-    return r;
-  }
-  return null;
-}
 async function fetchText(url, timeout = 8e3) {
   try {
     const c = new AbortController();
     const t = setTimeout(() => c.abort(), timeout);
-    const r = await safeFetch(url, timeout, c.signal);
+    const r = await fetch(url, { signal: c.signal, headers: { "User-Agent": "Prodlint-WebScanner/1.0" }, redirect: "follow" });
     clearTimeout(t);
-    if (!r || !r.ok) return null;
-    return await r.text();
+    if (r.url && !validateRedirectUrl(r.url)) return null;
+    return r.ok ? await r.text() : null;
   } catch {
     return null;
   }
@@ -4733,9 +4874,9 @@ async function fetchHeaders(url, timeout = 8e3) {
   try {
     const c = new AbortController();
     const t = setTimeout(() => c.abort(), timeout);
-    const r = await safeFetch(url, timeout, c.signal);
+    const r = await fetch(url, { signal: c.signal, headers: { "User-Agent": "Prodlint-WebScanner/1.0" }, redirect: "follow" });
     clearTimeout(t);
-    if (!r) return {};
+    if (r.url && !validateRedirectUrl(r.url)) return {};
     const h = {};
     r.headers.forEach((v, k) => {
       h[k.toLowerCase()] = v;
@@ -4750,11 +4891,11 @@ async function fetchWithTiming(url, timeout = 15e3) {
     const c = new AbortController();
     const t = setTimeout(() => c.abort(), timeout);
     const start = Date.now();
-    const r = await safeFetch(url, timeout, c.signal);
-    clearTimeout(t);
-    if (!r || !r.ok) return { html: null, loadTimeMs: null };
+    const r = await fetch(url, { signal: c.signal, headers: { "User-Agent": "Prodlint-WebScanner/1.0" }, redirect: "follow" });
     const html = await r.text();
-    return { html, loadTimeMs: Date.now() - start };
+    clearTimeout(t);
+    if (r.url && !validateRedirectUrl(r.url)) return { html: null, loadTimeMs: null };
+    return r.ok ? { html, loadTimeMs: Date.now() - start } : { html: null, loadTimeMs: null };
   } catch {
     return { html: null, loadTimeMs: null };
   }
@@ -4793,6 +4934,10 @@ async function runWebScan(targetUrl) {
   };
 }
 export {
+  reportJson,
+  reportPretty,
+  reportSarif,
+  reportSummary,
   rules,
   runWebScan,
   scan