ssrwire 0.1.0 → 0.2.0

package/CHANGELOG.md

@@ -5,6 +5,26 @@ All notable changes to SSRWire are documented here. The project follows
 
 ## [Unreleased]
 
+## [0.2.0] - 2026-08-24
+
+### Added
+
+- Bounded `repeat` configuration and `--repeat` CLI sampling for 1–10 requests
+  per target-agent pair.
+- Per-agent minimum, median, nearest-rank p95, maximum, and spread summaries for
+  response-header, first-byte, required-signal, and completion timings.
+- Response and streamed-HTML stability findings across repeated samples.
+- Sample attribution in terminal and JSON reports.
+
+### Changed
+
+- Added an npm package badge to the README.
+- Samples for one target-agent pair run sequentially while independent pairs
+  retain bounded concurrency.
+- Repeated policy findings are coalesced with occurrence and sample evidence.
+- Exact body-fingerprint variation alone is informational; timing variation
+  alone remains evidence rather than a policy failure.
+
 ## [0.1.0] - 2026-08-22
 
 ### Added
@@ -16,5 +36,6 @@ All notable changes to SSRWire are documented here. The project follows
 - Terminal, JSON, and SARIF reports with CI-safe exit codes.
 - YAML configuration, one-off URL checks, Docker support, and GitHub Actions examples.
 
-[Unreleased]: https://github.com/lame13/ssrwire/compare/v0.1.0...HEAD
+[Unreleased]: https://github.com/lame13/ssrwire/compare/v0.2.0...HEAD
+[0.2.0]: https://github.com/lame13/ssrwire/compare/v0.1.0...v0.2.0
 [0.1.0]: https://github.com/lame13/ssrwire/releases/tag/v0.1.0

package/CONTRIBUTING.md

@@ -29,6 +29,7 @@ Keep each change narrow. Include tests for behavior changes, especially for:
 - redirects, timeouts, aborted bodies, and size limits;
 - malformed, duplicated, late, or body-located metadata;
 - user-agent differences and comparison findings;
+- repeated-sample ordering, aggregation, and instability classification;
 - redaction of configured header values;
 - terminal, JSON, SARIF, and exit-code behavior.
 
@@ -39,11 +40,12 @@ positions instead.
 
 ## Scope
 
-SSRWire is an HTTP stream observer, not a browser, crawler, packet capture,
-performance benchmark, or framework plugin. New features should preserve that
-boundary. In particular, avoid conclusions that claim to reveal the server's
-original flush calls: proxies, compression, TLS, HTTP stacks, and client
-buffering can coalesce data before SSRWire sees it.
+SSRWire is an HTTP stream observer and bounded consistency sampler, not a
+browser, crawler, packet capture, load generator, performance benchmark, or
+framework plugin. New features should preserve that boundary. In particular,
+avoid conclusions that claim to reveal the server's original flush calls:
+proxies, compression, TLS, HTTP stacks, and client buffering can coalesce data
+before SSRWire sees it.
 
 By contributing, you agree that your contribution is licensed under the MIT
 License.

package/PUBLISHING.md

@@ -1,109 +1,124 @@
-# Publish SSRWire from a local machine
+# Publish SSRWire 0.2.0 from a local machine
 
-This repository intentionally includes no npm publishing workflow. Every npm
-release is published from a local interactive terminal after GitHub CI passes.
-Do not configure an `NPM_TOKEN`, trusted publisher, OIDC identity, or automated
-release workflow for npm publication.
+This repository intentionally includes no npm publishing workflow. Publish from
+a foreground local terminal only after the GitHub `CI` workflow passes. Do not
+configure an `NPM_TOKEN`, trusted publisher, OIDC identity, or automated npm
+release job.
 
-## 1. Prepare and verify
+The `main` branch is protected. Land every release change through a pull
+request, and do not use an administrator bypass or a direct push to `main`.
 
-From the extracted archive:
+## 1. Update the existing repository
+
+Work from a clean clone of the existing public repository. Copy the 0.2.0
+source files into that clone while preserving its `.git` directory.
 
 ```bash
-unzip ssrwire.zip # skip when already inside a source checkout
 cd ssrwire
+git switch main
+git pull --ff-only origin main
+git status --short
+git switch -c release/0.2.0
+```
+
+`git status --short` must be empty before creating the release branch and
+applying the release files.
+
+## 2. Verify the release locally
+
+```bash
 nvm use 24
 node --version
 npm --version
 npm ci
 npm run check
 npm pack --dry-run
+node dist/bin.js --version
 ```
 
-Install and authenticate GitHub CLI if needed:
-
-```bash
-brew install gh
-gh auth login -h github.com --web
-gh auth status -h github.com
-```
+The final command must print `0.2.0`. Inspect the dry-run file list. It must not
+contain `.env`, `.github`, `node_modules`, `test`, ZIP files, or tarballs.
 
-## 2. Create the Git history
+Review the release diff and version references:
 
 ```bash
-git init -b main
-git add -- \
-  .dockerignore .editorconfig .env.example .github .gitignore \
-  CHANGELOG.md CONTRIBUTING.md Dockerfile LICENSE PUBLISHING.md README.md SECURITY.md \
-  biome.json examples package.json package-lock.json scripts src test \
-  tsconfig.build.json tsconfig.json vitest.config.ts
-git commit -m "Initial SSRWire release"
+git diff --check
+git diff --stat
+git diff -- package.json package-lock.json CHANGELOG.md README.md PUBLISHING.md
+rg '0\.1\.0' README.md examples package.json package-lock.json src test
 ```
 
-## 3. Create and push the public repository
+The final search should return nothing. Historical entries in `CHANGELOG.md`
+are excluded intentionally.
+
+## 3. Commit, push the release branch, and open a pull request
 
 ```bash
-gh repo create lame13/ssrwire \
-  --public \
-  --source=. \
-  --remote=origin \
-  --push \
-  --description "Inspect streamed SSR HTML, metadata timing, and crawler-specific delivery from the command line." \
-  --homepage "https://nikom.work"
+gh auth status -h github.com || gh auth login -h github.com --web
+git add --all
+git diff --cached --check
+git diff --cached --stat
+git commit -m "feat: release SSRWire 0.2.0"
+git push --set-upstream origin release/0.2.0
+gh pr create --base main --head release/0.2.0 --fill
+PR_NUMBER="$(gh pr view release/0.2.0 --json number --jq .number)"
+test -n "$PR_NUMBER"
+gh pr checks "$PR_NUMBER" --watch --fail-fast
 ```
 
-## 4. Add repository topics
+Do not merge while any Node, package-smoke, or Docker job is failing. Satisfy
+all review and branch-protection requirements, then merge with GitHub's allowed
+strategy. Running `gh pr merge "$PR_NUMBER"` without a strategy flag lets the
+CLI prompt for one of the repository's permitted methods. Do not select an
+administrator bypass.
 
 ```bash
-gh repo edit lame13/ssrwire \
-  --add-topic technical-seo \
-  --add-topic seo \
-  --add-topic ssr \
-  --add-topic streaming-html \
-  --add-topic nextjs \
-  --add-topic nuxt \
-  --add-topic astro \
-  --add-topic crawler \
-  --add-topic typescript \
-  --add-topic cli \
-  --add-topic seo-tools \
-  --add-topic github-actions \
-  --add-topic sarif
+gh pr merge "$PR_NUMBER"
 ```
 
-Enable the private vulnerability-reporting channel referenced by
-`SECURITY.md` (this requires repository admin permission):
+After GitHub reports the pull request as merged, update local `main` and wait
+for the CI run on the exact merged commit:
 
 ```bash
-gh api --method PUT repos/lame13/ssrwire/private-vulnerability-reporting
+git switch main
+git pull --ff-only origin main
+git status --short
+gh pr view "$PR_NUMBER" --json state,mergedAt,mergeCommit
+COMMIT_SHA="$(git rev-parse HEAD)"
+RUN_ID="$(gh run list --workflow CI --branch main --commit "$COMMIT_SHA" \
+  --limit 1 --json databaseId --jq '.[0].databaseId')"
+test -n "$RUN_ID"
+gh run watch "$RUN_ID" --exit-status
 ```
 
-Alternatively, enable **Private vulnerability reporting** in the repository's
-Settings → Security settings before publishing the first release.
+`git status --short` must be empty. Do not publish until the merged-commit CI
+run succeeds.
 
-Recommended repository description:
+## 4. Verify npm state
 
-> Inspect streamed SSR HTML, metadata timing, and crawler-specific delivery from the command line.
+```bash
+npm view ssrwire version dist-tags homepage keywords repository.url --json
+npm config get registry
+npm config get provenance
+```
 
-Wait for the repository's `CI` workflow to pass before publishing.
+The published version and `latest` tag must still be `0.1.0`. If npm already
+reports `0.2.0`, stop: never reuse a version that npm accepted.
 
-## 5. Publish version 0.1.0 to npm locally
+In the npm package settings, select **Require two-factor authentication and
+disallow tokens**. npm documents this as the strongest package publishing
+setting:
 
-Verify the release from a clean checkout before starting npm's short-lived
-authenticated session:
+- <https://docs.npmjs.com/requiring-2fa-for-package-publishing-and-settings-modification/>
+- <https://docs.npmjs.com/about-two-factor-authentication/>
 
-```bash
-npm ci
-npm run check
-npm pack --dry-run
-npm view ssrwire
-```
+## 5. Publish interactively
 
-For the first release, `npm view` returning a 404 means the name is not
-currently published. Start authentication only after verification so the
-session remains fresh for publication:
+Remove inherited automation credentials before starting the interactive
+session:
 
 ```bash
+unset NODE_AUTH_TOKEN NPM_TOKEN NPM_CONFIG_OTP npm_config_otp
 npm login --auth-type=web --registry=https://registry.npmjs.org
 npm whoami --registry=https://registry.npmjs.org
 npm publish --access public --registry=https://registry.npmjs.org
@@ -111,24 +126,23 @@ npm view ssrwire version dist-tags homepage keywords repository.url --json
 npm logout --registry=https://registry.npmjs.org
 ```
 
-Run login and publish in a foreground interactive terminal. Complete npm's
-browser, passkey, or two-factor-authentication challenge when prompted. Never
-put an OTP in a command argument, and do not add an `NPM_TOKEN` to this
-repository.
+Complete npm's browser, passkey, or two-factor-authentication challenge when
+prompted. Do not use a token with bypass 2FA, put an OTP in a command argument,
+or add an npm credential to the repository or GitHub Actions. The package-level
+"disallow tokens" setting ensures that publication remains interactive.
 
-If the package is not immediately visible after `npm publish` succeeds, wait
-for npm's publish-time scanning to finish instead of publishing the same
-version again.
+If npm's publish-time scanning delays package visibility, wait. Do not publish
+`0.2.0` again or change the tag to work around propagation.
 
-After npm confirms `0.1.0`, create the matching source release:
+## 6. Tag the exact published commit
 
 ```bash
 node scripts/clean.mjs
 rm -rf node_modules/.vite
 git status --short
-git tag -a v0.1.0 -m "SSRWire v0.1.0"
-git push origin v0.1.0
-gh release create v0.1.0 --generate-notes --title "SSRWire v0.1.0"
+git tag -a v0.2.0 -m "SSRWire v0.2.0"
+git push origin v0.2.0
+gh release create v0.2.0 --generate-notes --title "SSRWire v0.2.0"
 ```
 
-`git status --short` must print nothing before tagging the release.
+`git status --short` must print nothing before tagging.

package/README.md

@@ -1,6 +1,7 @@
 # SSRWire
 
 [![CI](https://github.com/lame13/ssrwire/actions/workflows/ci.yml/badge.svg)](https://github.com/lame13/ssrwire/actions/workflows/ci.yml)
+[![npm version](https://img.shields.io/npm/v/ssrwire.svg)](https://www.npmjs.com/package/ssrwire)
 [![MIT License](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 
 Inspect streamed SSR HTML, metadata timing, and crawler-specific delivery from
@@ -25,6 +26,7 @@ Modern SSR output is not always one complete HTML document delivered at once:
   crawler while blocking for an HTML-limited bot;
 - browser, search-crawler, and social-crawler user agents may receive different
   titles, canonicals, robots directives, redirects, or statuses;
+- the same URL and user agent may receive inconsistent SSR output between requests;
 - an interrupted or oversized stream may never deliver the expected elements;
 - a working hydrated page can hide thin or incomplete source HTML.
 
@@ -84,7 +86,7 @@ form of `npx ssrwire check URL`.
 
 ## What it observes
 
-For each target and agent, SSRWire captures:
+For each target, agent, and configured sample, SSRWire captures:
 
 - response status, final URL, redirect chain, and an allowlisted response-header snapshot;
 - time to response headers, first response-body bytes, and completed body;
@@ -109,6 +111,9 @@ It then checks:
 | JSON-LD block/count exceeds the bounded analysis budget | Warning |
 | Critical metadata in `<body>` for a profile that requires head metadata | Error |
 | Status, final URL, title, canonical, or robots drift between profiles | Warning |
+| Completion, status, final URL, or redirect-chain drift between samples | Warning |
+| Metadata value or document-location drift between complete samples | Warning |
+| Exact body fingerprint drift without metadata drift | Information |
 | First byte or required-signal arrival over a configured limit | Warning |
 | Timeout, truncation, network error, or another incomplete probe | Error / incomplete run |
 
@@ -198,6 +203,7 @@ headers:
 timeoutMs: 15000
 maxBytes: 10485760
 maxRedirects: 10
+repeat: 1
 ```
 
 A target can also be a plain URL string when defaults are sufficient:
@@ -215,7 +221,8 @@ Defaults:
 - agents: `browser`, `googlebot`, `bingbot`, and `twitterbot`;
 - timeout: 15 seconds per probe;
 - response limit: 10 MiB;
-- redirect limit: 10.
+- redirect limit: 10;
+- samples per target and agent: 1, with an allowed range of 1–10.
 
 Unknown configuration keys are rejected. URLs must be absolute HTTP or HTTPS
 URLs and cannot contain embedded credentials.
@@ -276,6 +283,38 @@ transfer-size or packet-boundary evidence. They count bytes delivered by the
 Fetch implementation to SSRWire; those bytes are post-content-decoding when a
 server ignores SSRWire's `Accept-Encoding: identity` request.
 
+## Repeated sampling
+
+Use repeated sampling when one successful request does not prove that SSR output
+is stable:
+
+```bash
+npx ssrwire check --repeat 3
+```
+
+`repeat` is the total number of samples, not a retry count. SSRWire retains
+failures instead of replacing them with a later success. Samples for one
+target-agent pair run sequentially; different target-agent pairs may still run
+concurrently. SSRWire does not add delays, cache-busting parameters, or special
+cache headers.
+
+The request count is `targets × agents × repeat`, plus redirect hops. Configured
+same-origin headers are sent for every sample and retain the existing
+cross-origin stripping and report-redaction behavior.
+
+For repeated runs, terminal reports include individual sample numbers and a
+per-agent timing table. JSON retains every probe and adds per-agent stability
+summaries. The summaries report sample count, minimum, median, nearest-rank p95,
+maximum, and spread for available header, first-byte, required-signal, and
+completion timings. With small sample counts, nearest-rank p95 will often equal
+the maximum.
+
+Timing spread alone is evidence, not a failure. Network and cache variation can
+change timings without changing the response contract. SSRWire warns when HTTP
+response evidence or streamed metadata changes across samples. Exact body-hash
+variation by itself is informational because timestamps, nonces, and other
+legitimate dynamic values commonly change source HTML.
+
 ## CLI reference
 
 ```text
@@ -294,6 +333,7 @@ Check options:
 | `--timeout <ms>` | Override request timeout |
 | `--max-bytes <bytes>` | Override response-body limit |
 | `--max-redirects <count>` | Override redirect limit |
+| `--repeat <count>` | Run 1–10 sequential samples per URL and agent |
 | `-f, --format <format>` | `terminal`, `json`, or `sarif` |
 | `-o, --output <path>` | Write the report to a file |
 | `--fail-on <level>` | `error`, `warning`, or `never` |
@@ -304,9 +344,9 @@ removed.
 
 ## Reports and exit codes
 
-- `terminal`: compact tables and findings for local use.
+- `terminal`: compact sample, aggregate-timing, and finding tables for local use.
 - `json`: structured machine-readable evidence, including every probe and timing
-  signal.
+  signal plus repeated-run stability summaries.
 - `sarif`: findings suitable for GitHub Code Scanning and other SARIF 2.1.0
   consumers.
 
@@ -369,7 +409,7 @@ by the CLI:
 ```ts
 import { loadConfig, renderJson, runAudit } from "ssrwire";
 
-const config = await loadConfig({ urls: ["https://example.com/"] });
+const config = await loadConfig({ urls: ["https://example.com/"], repeat: 3 });
 const audit = await runAudit(config);
 process.stdout.write(renderJson(audit));
 ```
@@ -381,14 +421,16 @@ versions.
 ## Scope
 
 SSRWire does not execute JavaScript, inspect a hydrated DOM, measure Core Web
-Vitals, discover URLs, validate indexing, bypass access controls, or emulate a
-crawler's rendering pipeline. Use [RoutePlay](https://github.com/lame13/routeplay)
-when the question is server HTML versus a cold browser versus real client-side
-navigation.
+Vitals, discover URLs, validate indexing, bypass access controls, perform load
+testing, or emulate a crawler's rendering pipeline. Use
+[RoutePlay](https://github.com/lame13/routeplay) for server HTML versus a cold
+browser versus real client-side navigation. Use
+[RouteLint](https://github.com/lame13/routelint) for route discovery,
+indexability, and technical SEO policy.
 
 Run SSRWire only against targets you are authorized to inspect. Keep target
-lists intentionally small; one run starts one probe per target/profile pair,
-with additional requests for redirect hops.
+lists and repeat counts intentionally small. It is a consistency sampler, not a
+load generator.
 
 ## Development
 

package/SECURITY.md

@@ -20,7 +20,11 @@ report. You should receive an initial response within seven days.
 ## Operational safety
 
 SSRWire sends real HTTP requests to every configured target for every selected
-agent profile. Run it only against systems you are authorized to test. Treat
-custom headers as secrets, prefer environment-variable interpolation, and do
-not commit populated `.env` files or generated reports containing private
-URLs.
+agent profile and sample. The base request count is
+`targets × agents × repeat`, plus redirect hops. Samples for one target-agent
+pair are sequential, but different pairs may run concurrently. Keep `repeat`
+bounded and use SSRWire only against systems you are authorized to test.
+
+Treat custom headers as secrets and remember that they are sent on every
+same-origin sample. Prefer environment-variable interpolation, and do not
+commit populated `.env` files or generated reports containing private URLs.

package/dist/audit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAgB,aAAa,EAAqB,MAAM,YAAY,CAAC;AAoC9F,wBAAsB,QAAQ,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,CAiD1E"}
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,WAAW,EAIX,aAAa,EAEd,MAAM,YAAY,CAAC;AAgHpB,wBAAsB,QAAQ,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,CAyE1E"}

package/dist/audit.js

@@ -1,6 +1,7 @@
 import { analyzeTarget, summarizeAudit } from "./analyze.js";
 import { probeUrl } from "./http-probe.js";
 import { redactAudit } from "./redact.js";
+import { analyzeStability } from "./stability.js";
 import { VERSION } from "./version.js";
 const DEFAULT_CONCURRENCY = 4;
 async function runPool(inputs, limit, worker) {
@@ -21,8 +22,63 @@ async function runPool(inputs, limit, worker) {
     await Promise.all(workers);
     return results;
 }
+function repeatCount(value) {
+    const repeat = value ?? 1;
+    if (!Number.isInteger(repeat) || repeat < 1 || repeat > 10) {
+        throw new RangeError("repeat must be an integer between 1 and 10.");
+    }
+    return repeat;
+}
+function mergeEvidence(sampled, repeat) {
+    const merged = {};
+    const keys = [
+        ...new Set(sampled.flatMap(({ finding }) => Object.keys(finding.evidence ?? {}))),
+    ].sort();
+    for (const key of keys) {
+        const values = sampled.flatMap(({ finding }) => {
+            const value = finding.evidence?.[key];
+            return value === undefined ? [] : [value];
+        });
+        const unique = [
+            ...new Map(values.map((value) => [`${typeof value}:${String(value)}`, value])).values(),
+        ];
+        const first = unique[0];
+        if (first !== undefined) {
+            merged[key] = unique.length === 1 ? first : unique.map(String).join(" | ");
+        }
+    }
+    merged.sampleNumbers = [...new Set(sampled.map((item) => item.sample))]
+        .sort((a, b) => a - b)
+        .join(", ");
+    merged.occurrences = sampled.length;
+    merged.totalSamples = repeat;
+    return merged;
+}
+function coalesceFindings(sampled, repeat) {
+    const groups = new Map();
+    for (const item of sampled) {
+        const { finding } = item;
+        const key = JSON.stringify([
+            finding.code,
+            finding.severity,
+            finding.message,
+            finding.url,
+            finding.agent ?? "",
+        ]);
+        const group = groups.get(key) ?? [];
+        group.push(item);
+        groups.set(key, group);
+    }
+    return [...groups.values()].map((group) => {
+        const first = group[0]?.finding;
+        if (first === undefined)
+            throw new Error("Cannot coalesce an empty finding group.");
+        return { ...first, evidence: mergeEvidence(group, repeat) };
+    });
+}
 export async function runAudit(config) {
     const started = performance.now();
+    const repeat = repeatCount(config.repeat);
     const tasks = [];
     for (const [targetIndex, target] of config.targets.entries()) {
         for (const [agentIndex, agent] of config.agents.entries()) {
@@ -42,25 +98,44 @@ export async function runAudit(config) {
         }
     }
     const secrets = Object.values(config.headers);
-    const probes = await runPool(tasks, DEFAULT_CONCURRENCY, async (task) => {
-        const probe = await probeUrl(task.options);
-        return { task, probe };
+    const lanes = await runPool(tasks, DEFAULT_CONCURRENCY, async (task) => {
+        const probes = [];
+        for (let sample = 1; sample <= repeat; sample += 1) {
+            const probe = await probeUrl(task.options);
+            probes.push(repeat === 1 ? probe : { ...probe, sample });
+        }
+        return { task, probes };
     });
     const results = config.targets.map((target, targetIndex) => {
-        const targetProbes = probes
-            .filter((item) => item.task.targetIndex === targetIndex)
+        const targetProbes = lanes
+            .filter((lane) => lane.task.targetIndex === targetIndex)
             .sort((a, b) => a.task.agentIndex - b.task.agentIndex)
-            .map((item) => item.probe);
+            .flatMap((lane) => lane.probes);
+        if (repeat === 1) {
+            return {
+                target,
+                probes: targetProbes,
+                findings: analyzeTarget(target, targetProbes),
+            };
+        }
+        const sampledFindings = [];
+        for (let sample = 1; sample <= repeat; sample += 1) {
+            const sampleProbes = targetProbes.filter((probe) => probe.sample === sample);
+            sampledFindings.push(...analyzeTarget(target, sampleProbes).map((finding) => ({ sample, finding })));
+        }
+        const stability = analyzeStability(target, targetProbes);
         return {
             target,
             probes: targetProbes,
-            findings: analyzeTarget(target, targetProbes),
+            findings: [...coalesceFindings(sampledFindings, repeat), ...stability.findings],
+            stability: stability.stability,
         };
     });
     const audit = {
         version: VERSION,
         generatedAt: new Date().toISOString(),
         durationMs: Math.round(performance.now() - started),
+        ...(repeat === 1 ? {} : { repeat }),
         results,
         summary: summarizeAudit(results),
     };

package/dist/audit.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit.js","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAQ9B,KAAK,UAAU,OAAO,CACpB,MAAoB,EACpB,KAAa,EACb,MAAgC;IAEhC,MAAM,OAAO,GAAG,IAAI,KAAK,CAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,KAAK,UAAU,OAAO;QACpB,OAAO,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,MAAM,CAAC;YACrB,MAAM,IAAI,CAAC,CAAC;YACZ,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,SAAS;YACX,CAAC;YACD,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACxF,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,MAAqB;IAClD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAClC,MAAM,KAAK,GAAgB,EAAE,CAAC;IAE9B,KAAK,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7D,KAAK,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;YAC1D,KAAK,CAAC,IAAI,CAAC;gBACT,WAAW;gBACX,UAAU;gBACV,OAAO,EAAE;oBACP,GAAG,EAAE,MAAM,CAAC,GAAG;oBACf,KAAK;oBACL,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,kBAAkB,EAAE,KAAK;iBAC1B;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtE,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAwB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE;QAC9E,MAAM,YAAY,GAAG,MAAM;aACxB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,KAAK,WAAW,CAAC;aACvD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;aACrD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAE7B,OAAO;YACL,MAAM;YACN,MAAM,EAAE,YAAY;YACpB,QAAQ,EAAE,aAAa,CAAC,MAAM,EAAE,YAAY,CAAC;SAC9C,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAgB;QACzB,OAAO,EAAE,OAAO;QAChB,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;QACnD,OAAO;QACP,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC;KACjC,CAAC;IACF,OAAO,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AACrC,CAAC"}
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AASlD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAkB9B,KAAK,UAAU,OAAO,CACpB,MAAoB,EACpB,KAAa,EACb,MAAgC;IAEhC,MAAM,OAAO,GAAG,IAAI,KAAK,CAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,KAAK,UAAU,OAAO;QACpB,OAAO,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,MAAM,CAAC;YACrB,MAAM,IAAI,CAAC,CAAC;YACZ,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,SAAS;YACX,CAAC;YACD,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACxF,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,WAAW,CAAC,KAAyB;IAC5C,MAAM,MAAM,GAAG,KAAK,IAAI,CAAC,CAAC;IAC1B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,EAAE,EAAE,CAAC;QAC3D,MAAM,IAAI,UAAU,CAAC,6CAA6C,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CACpB,OAAiC,EACjC,MAAc;IAEd,MAAM,MAAM,GAIR,EAAE,CAAC;IACP,MAAM,IAAI,GAAG;QACX,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;KAClF,CAAC,IAAI,EAAE,CAAC;IAET,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE;YAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;YACtC,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG;YACb,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,GAAG,OAAO,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE;SACxF,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAED,MAAM,CAAC,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;SACpE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;SACrB,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,CAAC,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;IACpC,MAAM,CAAC,YAAY,GAAG,MAAM,CAAC;IAC7B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAiC,EAAE,MAAc;IACzE,MAAM,MAAM,GAAG,IAAI,GAAG,EAA2B,CAAC;IAClD,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC;YACzB,OAAO,CAAC,IAAI;YACZ,OAAO,CAAC,QAAQ;YAChB,OAAO,CAAC,OAAO;YACf,OAAO,CAAC,GAAG;YACX,OAAO,CAAC,KAAK,IAAI,EAAE;SACpB,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC;IAED,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;QAChC,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QACpF,OAAO,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,MAAqB;IAClD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAgB,EAAE,CAAC;IAE9B,KAAK,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7D,KAAK,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;YAC1D,KAAK,CAAC,IAAI,CAAC;gBACT,WAAW;gBACX,UAAU;gBACV,OAAO,EAAE;oBACP,GAAG,EAAE,MAAM,CAAC,GAAG;oBACf,KAAK;oBACL,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,kBAAkB,EAAE,KAAK;iBAC1B;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,MAAM,OAAO,CAAuB,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAC3F,MAAM,MAAM,GAAkB,EAAE,CAAC;QACjC,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,IAAI,MAAM,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC;YACnD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAwB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE;QAC9E,MAAM,YAAY,GAAG,KAAK;aACvB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,KAAK,WAAW,CAAC;aACvD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;aACrD,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAElC,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;YACjB,OAAO;gBACL,MAAM;gBACN,MAAM,EAAE,YAAY;gBACpB,QAAQ,EAAE,aAAa,CAAC,MAAM,EAAE,YAAY,CAAC;aAC9C,CAAC;QACJ,CAAC;QAED,MAAM,eAAe,GAAoB,EAAE,CAAC;QAC5C,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,IAAI,MAAM,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC;YACnD,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;YAC7E,eAAe,CAAC,IAAI,CAClB,GAAG,aAAa,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAC/E,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAEzD,OAAO;YACL,MAAM;YACN,MAAM,EAAE,YAAY;YACpB,QAAQ,EAAE,CAAC,GAAG,gBAAgB,CAAC,eAAe,EAAE,MAAM,CAAC,EAAE,GAAG,SAAS,CAAC,QAAQ,CAAC;YAC/E,SAAS,EAAE,SAAS,CAAC,SAAS;SAC/B,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAgB;QACzB,OAAO,EAAE,OAAO;QAChB,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;QACnD,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;QACnC,OAAO;QACP,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC;KACjC,CAAC;IACF,OAAO,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AACrC,CAAC"}

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAkKA,wBAAsB,IAAI,CAAC,IAAI,GAAE,SAAS,MAAM,EAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CA4ChF"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAsKA,wBAAsB,IAAI,CAAC,IAAI,GAAE,SAAS,MAAM,EAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CA4ChF"}

package/dist/cli.js

@@ -25,6 +25,7 @@ agents:
 timeoutMs: 15000
 maxBytes: 10485760
 maxRedirects: 10
+repeat: 1
 
 # Keep preview credentials in environment variables. SSRWire redacts configured values from reports.
 # headers:
@@ -60,6 +61,7 @@ function addCheckOptions(command) {
         .option("--timeout <ms>", "request timeout in milliseconds", parseInteger)
         .option("--max-bytes <bytes>", "maximum response bytes", parseInteger)
         .option("--max-redirects <count>", "maximum redirects", parseInteger)
+        .option("--repeat <count>", "sequential samples per URL and agent", parseInteger)
         .option("-f, --format <format>", "terminal, json, or sarif", parseFormat, "terminal")
         .option("-o, --output <path>", "write the report to a file")
         .option("--fail-on <level>", "error, warning, or never", parseFailOn, "error")
@@ -97,6 +99,7 @@ async function check(urls, options) {
         ...(options.timeout === undefined ? {} : { timeoutMs: options.timeout }),
         ...(options.maxBytes === undefined ? {} : { maxBytes: options.maxBytes }),
         ...(options.maxRedirects === undefined ? {} : { maxRedirects: options.maxRedirects }),
+        ...(options.repeat === undefined ? {} : { repeat: options.repeat }),
     });
     const audit = await runAudit(config);
     const color = options.color &&