tewip-ai 0.37.0 → 0.39.0

package/README.md

@@ -624,6 +624,37 @@ compare everywhere else.
 **It never predicts a duration, a capacity, or what a user will feel.** It cannot see your production
 hardware, your real data volume or your real traffic, and every report says so.
 
+### Lighthouse too (Phase 31, new)
+
+```bash
+tewip perf lighthouse-report.json --record
+```
+
+k6 measures what your server does under load. Lighthouse measures what **one page load costs in a real
+browser** — Largest Contentful Paint, layout shift, blocking time — which is nearer to what a person
+actually waits for. `tewip perf` takes either and works out which it was given.
+
+Lighthouse needs the same discipline *more*, not less. **Four real Lighthouse runs of an unchanged
+page gave LCP of 922, 912, 936 and 916ms.** Same rule: three baselines, outside the range by more than
+its own width.
+
+**And Tewip does not invent a verdict.** "Is 2112ms bad?" has a published answer and it is Google's:
+Lighthouse scores every metric on its own curve. Tewip reads that score rather than hard-coding
+thresholds it remembered — which matters, because on the real slowed run FCP and LCP had the *identical*
+value of 2112ms and Lighthouse rates them differently:
+
+```
+- good — `largest-contentful-paint`: 2112ms
+- needs improvement — `first-contentful-paint`: 2112ms
+- **poor** — `server-response-time`: 611ms
+```
+
+One remembered threshold applied to both would have been wrong.
+
+It also surfaces the **ten accessibility audits Lighthouse refuses to score** — logical tab order, focus
+traps, whether visual order follows the DOM. Those are neither failures nor passes, and a page with no
+failures and ten unanswered manual checks is not a page that passed.
+
 One more thing it refuses: if your summary came from `--new-machine-readable-summary`, that export
 records **no threshold results at all** — the word appears in it only inside a copy of your script.
 Tewip says "this export cannot tell me" rather than "nothing was breached".
@@ -719,6 +750,26 @@ A source finding is set aside only when the run opened **that same file** and re
 In a React or Vue project that means nothing is set aside — the source and the rendered output are two
 different artefacts, and neither is evidence about the other.
 
+**Already run Lighthouse instead? That works too** (Phase 32, new):
+
+```bash
+tewip access --report lighthouse-report.json
+```
+
+Lighthouse's accessibility audits *are* axe rules — same rule ids — so the same triage applies. Most
+teams have Lighthouse in CI and no separate axe step; they get the whole of the above from a tool they
+already run.
+
+The catch was that a Lighthouse report strips axe's tags, so it says `landmark-one-main` and nothing
+about which WCAG criterion that is, or whether it is one at all. That distinction covers **30 of axe's
+105 rules**, and a remembered table of a hundred mappings is a table with mistakes in it. So the table
+is **generated from axe-core itself** (`scripts/axe-rules.ts`) — 105 rules, 75 carrying a criterion, 30
+best-practice only, none unclassified.
+
+It also surfaces the **ten audits Lighthouse marks `manual`** — logical tab order, focus traps, whether
+visual order follows the DOM. Those become questions, never passes. A page with no failures and ten
+unanswered manual checks has not passed.
+
 ## Teach it your house rules (Phase 27)
 
 ```bash

package/dist/cli/help.js

@@ -118,17 +118,19 @@ Usage:
                                     is what was asked for covered. Answers ready, not ready, or cannot
                                     say - and cannot say is never rounded up to ready. --json writes a
                                     sealed verdict that can be checked later. No model, no cost.
-  tewip perf <k6-summary.json> [--record] [--label checkout] [--strict] [--out perf.md]
-                                    Is this change slower, and does it matter? Reads a k6 run and
-                                    answers two questions separately: did the thresholds you wrote
-                                    hold, and is this slower than it was. The second is answered only
-                                    from repeated baselines - with fewer than three it says cannot
-                                    say, because one run against one run cannot tell a regression
-                                    from a busy machine. --record adds a run to the baseline, and is
-                                    deliberately not automatic: a regression recorded by accident
-                                    becomes next week's normal. It never predicts a duration or a
-                                    capacity. No model, no cost.
-  tewip access [<file or directory>] [--report axe.json] [--strict] [--out access.md]
+  tewip perf <k6-summary.json | lighthouse.json> [--record] [--label checkout] [--strict] [--out perf.md]
+                                    Is this change slower, and does it matter? Reads a k6 run (what
+                                    the server does under load) or a Lighthouse report (what one
+                                    page load costs in a browser), and answers two questions apart:
+                                    is anything in a bad state now - from the thresholds you wrote,
+                                    or from Lighthouse's own scoring, never a budget Tewip invented
+                                    - and is this slower than it was. The second only from repeated
+                                    baselines: with fewer than three it says cannot say, because one
+                                    run against one cannot tell a regression from a busy machine.
+                                    --record adds a run to the baseline, and is deliberately not
+                                    automatic: a regression recorded by accident becomes next week's
+                                    normal. It never predicts a duration or a capacity. No cost.
+  tewip access [<file or directory>] [--report axe.json|lighthouse.json] [--strict]
                                     Can everybody use this? Reads your markup and names the barriers
                                     that reading alone can prove - a picture with no alt text, a field
                                     with no label, a div only a mouse can use - each against its WCAG
@@ -137,11 +139,13 @@ Usage:
                                     criterion it cannot reach without rendering the page (contrast,
                                     focus order, whether the alt text is any good) is printed every
                                     time. It never says a page is accessible, only what was checked.
-                                    Give it --report with the JSON from an axe run and it reads that
-                                    too: contrast moves out of the unchecked list, axe rules that map
-                                    to no WCAG criterion are reported as advice rather than barriers
-                                    (51 of 174 findings on nine real pages), and what axe could not
-                                    determine becomes a question. No browser, no network, no model.
+                                    Give it --report with the JSON from an axe run or a Lighthouse
+                                    report and it reads that too - Lighthouse runs axe rules, so
+                                    either works. Contrast moves out of the unchecked list, rules
+                                    that map to no WCAG criterion are reported as advice rather than
+                                    barriers (51 of 174 findings on nine real pages), and what the
+                                    tool could not determine becomes a question. Lighthouse's ten
+                                    manual checks are questions too, never passes. No model, no cost.
   tewip standards [--diff main...HEAD] [--strict] [--out standards.md]
                                     Teach Tewip your house rules. Markdown files in
                                     .tewip/standards/ - a forbid or require line is checked and

package/dist/engine/access/access-command.js

@@ -14,9 +14,13 @@ import { sourceFiles } from '../secure/secrets.js';
 import { JS_LIKE, MARKUP, tags } from './markup.js';
 import { checkFile } from './checks.js';
 import { readAxeReport } from './reports.js';
-import { merge, nowChecked, pagesIn, renderBrowserSection, standardOf, stillNotChecked } from './merge.js';
-import { blocks, criterionOf, NOT_CHECKED, RULES } from './wcag.js';
-const ORDER = { blocker: 0, serious: 1, moderate: 2, minor: 3 };
+import { isLighthouseFile, readLighthouse } from '../perf/lighthouse.js';
+import { accessibilityFromLighthouse, criteriaFromLighthouse, rulesRunByLighthouse } from './from-lighthouse.js';
+import { merge, pagesIn } from './merge.js';
+import { renderAccess, worstFirst } from './render.js';
+// Re-exported so callers do not have to know the report moved into its own file.
+export { renderAccess, worstFirst };
+import { blocks } from './wcag.js';
 /** One line per finding a person has already judged: "<rule> <file>:<line> - reason". */
 export function readAccepted(root) {
     const file = join(root, '.tewip', 'access-accepted.txt');
@@ -30,15 +34,6 @@ export function readAccepted(root) {
 export function keyOf(f) {
     return `${f.rule} ${f.file}:${f.line}`;
 }
-export function worstFirst(a, b) {
-    const sa = ORDER[RULES[a.rule]?.severity ?? 'minor'];
-    const sb = ORDER[RULES[b.rule]?.severity ?? 'minor'];
-    if (sa !== sb)
-        return sa - sb;
-    if (a.file !== b.file)
-        return a.file < b.file ? -1 : 1;
-    return a.line - b.line;
-}
 /** Reads every markup file under `root` and returns what the markup alone can settle. */
 /**
  * Markup written to exercise code, not to be used by a person. An `<img>` with no alt in a
@@ -71,119 +66,24 @@ export function findBarriers(root, only) {
     }
     return { findings, filesRead };
 }
-function group(findings) {
-    const by = new Map();
-    for (const f of findings) {
-        const list = by.get(f.rule);
-        if (list)
-            list.push(f);
-        else
-            by.set(f.rule, [f]);
-    }
-    return by;
-}
-function section(title, findings, lines) {
-    if (findings.length === 0)
-        return;
-    lines.push(`## ${title}`, '');
-    for (const [rule, found] of group(findings)) {
-        const meta = RULES[rule];
-        lines.push(`### ${rule} - ${found.length} ${found.length === 1 ? 'place' : 'places'}`, '');
-        lines.push(`${criterionOf(rule)}, ${meta?.severity ?? 'unrated'}.`, '');
-        if (meta)
-            lines.push(`Who it stops: ${meta.stops}.`, '');
-        for (const f of found.slice(0, 20)) {
-            lines.push(`- \`${f.file}:${f.line}\`  ${f.element}`);
-            lines.push(`  - ${f.why}`);
-            lines.push(`  - do this: ${f.next}`);
-        }
-        if (found.length > 20)
-            lines.push(`- ...and ${found.length - 20} more of the same, in the JSON beside this report.`);
-        lines.push('');
-    }
-}
-export function renderAccess(result, scanned) {
-    const { barriers, questions, accepted, filesRead, browser } = result;
-    const lines = ['# Tewip accessibility check', ''];
-    lines.push(`Read ${filesRead} markup ${filesRead === 1 ? 'file' : 'files'} under \`${scanned}\`, without rendering any of them.`, '');
-    if (browser) {
-        lines.push(`Also read an axe run over ${browser.pages.length} rendered ${browser.pages.length === 1 ? 'page' : 'pages'}, ` +
-            'which settles what reading markup cannot.', '');
-    }
-    if (barriers.length === 0 && questions.length === 0 && !browser) {
-        lines.push('No barrier was found that reading the markup can settle, and nothing needs a decision.', '');
-    }
-    else {
-        const stopping = barriers.filter((f) => blocks(f.rule)).length;
-        const counts = [
-            `${barriers.length} ${barriers.length === 1 ? 'barrier' : 'barriers'} (${stopping} that stop somebody outright)`,
-            `${questions.length} for a person to settle`,
-        ];
-        if (accepted.length > 0)
-            counts.push(`${accepted.length} already accepted`);
-        if (browser) {
-            counts.unshift(`${browser.barriers.length} barriers the browser run proves`);
-            if (browser.questions.length > 0)
-                counts.push(`${browser.questions.length} the browser could not determine`);
-        }
-        lines.push(`**${counts.join(', ')}.**`, '');
-    }
-    if (browser) {
-        renderBrowserSection('Barriers seen in the browser', browser.barriers, lines);
-        renderBrowserSection('The browser could not determine these', browser.questions, lines);
-    }
-    section('Barriers read from the source', [...barriers].sort(worstFirst), lines);
-    section('Only a person can settle these', [...questions].sort(worstFirst), lines);
-    if (browser && browser.advice.length > 0) {
-        // Kept out of the counts above on purpose. These are axe's own best-practice rules, which test
-        // no standard: on nine real pages they were 51 of 174 findings, outnumbering every real barrier.
-        // Reporting them as equals is how a team learns to ignore the whole report.
-        const rules = [...new Set(browser.advice.map((f) => f.rule))].sort();
-        lines.push('## Advice, not barriers', '');
-        lines.push(`${browser.advice.length} findings come from axe rules that map to no WCAG criterion - ` +
-            `${rules.join(', ')}. They are somebody's good idea rather than a standard, so they are not counted as barriers ` +
-            'and never fail a build. Worth reading once; not worth a release.', '');
-    }
-    if (browser && browser.superseded.length > 0) {
-        lines.push('## Set aside, because the browser run checked them', '');
-        lines.push(`${browser.superseded.length} source ${browser.superseded.length === 1 ? 'finding' : 'findings'} ` +
-            'are not listed above: the axe run checked their criterion on a rendered page, so its answer is the better ' +
-            'one and repeating them here would count the same barrier twice. They are in the JSON beside this report.', '');
-    }
-    if (accepted.length > 0) {
-        lines.push('## Already accepted', '');
-        lines.push(`${accepted.length} ${accepted.length === 1 ? 'finding is' : 'findings are'} listed in \`.tewip/access-accepted.txt\`, so they are not repeated here.`, '');
-    }
-    // Coverage comes from every rule that ran, not from the ones that found something: a contrast
-    // check that ran and passed has still checked contrast.
-    const ran = browser?.rulesRun ?? new Set();
-    const settled = nowChecked(ran);
-    const remaining = stillNotChecked(ran);
-    if (settled.length > 0) {
-        lines.push('## Checked here only because a browser run was given', '');
-        for (const n of settled)
-            lines.push(`- **${n.criterion}** - would otherwise be unreachable: ${n.why}`);
-        lines.push('');
-    }
-    lines.push('## What was not checked', '');
-    lines.push(browser
-        ? 'Even with the browser run, none of the following was tested:'
-        : 'This read the markup. It did not render a page, so none of the following was tested:', '');
-    for (const n of remaining)
-        lines.push(`- **${n.criterion}** - ${n.why}`);
-    if (browser) {
-        lines.push('');
-        lines.push(`The run covered ${browser.pages.length} ${browser.pages.length === 1 ? 'page' : 'pages'}. ` +
-            'Nothing is known about a page it did not open, or about a state it did not reach - a dialog that was never ' +
-            'opened, a form that was never submitted, an error that was never triggered.');
-    }
-    lines.push('');
-    lines.push('A clean result here means these checks found nothing, not that the product is accessible. ' +
-        'Roughly a third of WCAG can be judged by a machine at all' +
-        (browser ? '' : ', and reading source rather than a rendered page reaches less than that') +
-        '. The rest needs a person, ideally one who uses a screen reader.', '');
-    lines.push('To accept a finding, add its key to `.tewip/access-accepted.txt`, one per line, with a reason after ` - `.', '');
-    return lines.join('\n');
+/**
+ * Reads whichever browser evidence the team actually has.
+ *
+ * axe and Lighthouse are the same rules - Lighthouse runs axe - so both become one shape and are
+ * triaged identically. A team with Lighthouse in CI and no separate axe step gets the same answers
+ * without adding a tool (Phase 32).
+ */
+export function readBrowserRun(path) {
+    if (!isLighthouseFile(path))
+        return readAxeReport(path);
+    const report = readLighthouse(path);
+    return {
+        source: 'lighthouse',
+        findings: accessibilityFromLighthouse(report),
+        pages: new Set(report.url === '' ? [] : [report.url]),
+        rulesRun: rulesRunByLighthouse(report),
+        criteriaCovered: criteriaFromLighthouse(report),
+    };
 }
 export function runAccess(cmd) {
     const root = resolve(cmd.root);
@@ -193,7 +93,7 @@ export function runAccess(cmd) {
     const open = findings.filter((f) => !alreadyJudged.has(keyOf(f)));
     // Phase 29: a browser run, where one was given. It is the better witness for every criterion it
     // checked, so the source findings for those criteria are set aside rather than repeated.
-    const run = cmd.report ? readAxeReport(resolve(root, cmd.report)) : undefined;
+    const run = cmd.report ? readBrowserRun(resolve(root, cmd.report)) : undefined;
     const graded = run ? merge(open, run, root) : undefined;
     const kept = graded ? graded.kept : open;
     const barriers = kept.filter((f) => f.confidence === 'barrier');
@@ -206,6 +106,7 @@ export function runAccess(cmd) {
             superseded: graded.superseded,
             pages: pagesIn(run),
             rulesRun: run.rulesRun,
+            tool: run.source,
         }
         : undefined;
     const result = { barriers, questions, accepted, filesRead, ...(browser ? { browser } : {}) };

package/dist/engine/access/axe-rules.js

@@ -0,0 +1,128 @@
+// Phase 32: what each axe rule tests, taken from axe-core itself.
+//
+// Lighthouse's accessibility audits are axe rules - the ids are identical - but a Lighthouse report
+// does not carry axe's tags, so it says "landmark-one-main" and nothing about which criterion that
+// is, or whether it is a criterion at all. Phase 29 needs that to tell a legal failure from somebody's
+// good idea, and 42% of axe's output is the latter.
+//
+// Writing the table by hand was the reason Phase 31 left this undone: a remembered mapping between a
+// hundred rule ids and WCAG numbers is a mapping with mistakes in it, and a wrong criterion beside a
+// finding is worse than no criterion. So the table is **generated**: axe-core is loaded in a browser
+// and asked for its own rule catalogue, and these are its tags, parsed the same way Phase 29 parses
+// the tags on a live run.
+//
+// Generated from axe-core 4.14.0. 105 rules: 75 carry a WCAG criterion,
+// 30 are tagged best-practice only and test no standard at all.
+// Regenerate with: node scripts/axe-rules.ts - never by editing this file.
+export const AXE_CORE_VERSION = '4.14.0';
+export const AXE_RULES = {
+    'accesskeys': { criterion: null, level: null, en301549: null },
+    'area-alt': { criterion: '2.4.4', level: 'A', en301549: '9.2.4.4' },
+    'aria-allowed-attr': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'aria-allowed-role': { criterion: null, level: null, en301549: null },
+    'aria-braille-equivalent': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'aria-command-name': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'aria-conditional-attr': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'aria-deprecated-role': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'aria-dialog-name': { criterion: null, level: null, en301549: null },
+    'aria-hidden-body': { criterion: '1.3.1', level: 'A', en301549: '9.1.3.1' },
+    'aria-hidden-focus': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'aria-input-field-name': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'aria-meter-name': { criterion: '1.1.1', level: 'A', en301549: '9.1.1.1' },
+    'aria-progressbar-name': { criterion: '1.1.1', level: 'A', en301549: '9.1.1.1' },
+    'aria-prohibited-attr': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'aria-required-attr': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'aria-required-children': { criterion: '1.3.1', level: 'A', en301549: '9.1.3.1' },
+    'aria-required-parent': { criterion: '1.3.1', level: 'A', en301549: '9.1.3.1' },
+    'aria-roledescription': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'aria-roles': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'aria-tab-name': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'aria-text': { criterion: null, level: null, en301549: null },
+    'aria-toggle-field-name': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'aria-tooltip-name': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'aria-treeitem-name': { criterion: null, level: null, en301549: null },
+    'aria-valid-attr': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'aria-valid-attr-value': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'audio-caption': { criterion: '1.2.1', level: 'A', en301549: '9.1.2.1' },
+    'autocomplete-valid': { criterion: '1.3.5', level: 'AA', en301549: '9.1.3.5' },
+    'avoid-inline-spacing': { criterion: '1.4.12', level: 'AA', en301549: '9.1.4.12' },
+    'blink': { criterion: '2.2.2', level: 'A', en301549: '9.2.2.2' },
+    'button-name': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'bypass': { criterion: '2.4.1', level: 'A', en301549: '9.2.4.1' },
+    'color-contrast': { criterion: '1.4.3', level: 'AA', en301549: '9.1.4.3' },
+    'color-contrast-enhanced': { criterion: '1.4.6', level: 'AAA', en301549: null },
+    'css-orientation-lock': { criterion: '1.3.4', level: 'AA', en301549: '9.1.3.4' },
+    'definition-list': { criterion: '1.3.1', level: 'A', en301549: '9.1.3.1' },
+    'dlitem': { criterion: '1.3.1', level: 'A', en301549: '9.1.3.1' },
+    'document-title': { criterion: '2.4.2', level: 'A', en301549: '9.2.4.2' },
+    'duplicate-id': { criterion: '4.1.1', level: null, en301549: null },
+    'duplicate-id-active': { criterion: '4.1.1', level: null, en301549: null },
+    'duplicate-id-aria': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'empty-heading': { criterion: null, level: null, en301549: null },
+    'empty-table-header': { criterion: null, level: null, en301549: null },
+    'focus-order-semantics': { criterion: null, level: null, en301549: null },
+    'form-field-multiple-labels': { criterion: '3.3.2', level: 'A', en301549: '9.3.3.2' },
+    'frame-focusable-content': { criterion: '2.1.1', level: 'A', en301549: '9.2.1.1' },
+    'frame-tested': { criterion: null, level: null, en301549: null },
+    'frame-title': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'frame-title-unique': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'heading-order': { criterion: null, level: null, en301549: null },
+    'hidden-content': { criterion: null, level: null, en301549: null },
+    'html-has-lang': { criterion: '3.1.1', level: 'A', en301549: '9.3.1.1' },
+    'html-lang-valid': { criterion: '3.1.1', level: 'A', en301549: '9.3.1.1' },
+    'html-xml-lang-mismatch': { criterion: '3.1.1', level: 'A', en301549: '9.3.1.1' },
+    'identical-links-same-purpose': { criterion: '2.4.9', level: 'AAA', en301549: null },
+    'image-alt': { criterion: '1.1.1', level: 'A', en301549: '9.1.1.1' },
+    'image-redundant-alt': { criterion: null, level: null, en301549: null },
+    'input-button-name': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'input-image-alt': { criterion: '1.1.1', level: 'A', en301549: '9.1.1.1' },
+    'label': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'label-content-name-mismatch': { criterion: '2.5.3', level: 'A', en301549: '9.2.5.3' },
+    'label-title-only': { criterion: null, level: null, en301549: null },
+    'landmark-banner-is-top-level': { criterion: null, level: null, en301549: null },
+    'landmark-complementary-is-top-level': { criterion: null, level: null, en301549: null },
+    'landmark-contentinfo-is-top-level': { criterion: null, level: null, en301549: null },
+    'landmark-main-is-top-level': { criterion: null, level: null, en301549: null },
+    'landmark-no-duplicate-banner': { criterion: null, level: null, en301549: null },
+    'landmark-no-duplicate-contentinfo': { criterion: null, level: null, en301549: null },
+    'landmark-no-duplicate-main': { criterion: null, level: null, en301549: null },
+    'landmark-one-main': { criterion: null, level: null, en301549: null },
+    'landmark-unique': { criterion: null, level: null, en301549: null },
+    'link-in-text-block': { criterion: '1.4.1', level: 'A', en301549: '9.1.4.1' },
+    'link-name': { criterion: '2.4.4', level: 'A', en301549: '9.2.4.4' },
+    'list': { criterion: '1.3.1', level: 'A', en301549: '9.1.3.1' },
+    'listitem': { criterion: '1.3.1', level: 'A', en301549: '9.1.3.1' },
+    'marquee': { criterion: '2.2.2', level: 'A', en301549: '9.2.2.2' },
+    'meta-refresh': { criterion: '2.2.1', level: 'A', en301549: '9.2.2.1' },
+    'meta-refresh-no-exceptions': { criterion: '2.2.4', level: 'AAA', en301549: null },
+    'meta-viewport': { criterion: '1.4.4', level: 'AA', en301549: '9.1.4.4' },
+    'meta-viewport-large': { criterion: null, level: null, en301549: null },
+    'nested-interactive': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'no-autoplay-audio': { criterion: '1.4.2', level: 'A', en301549: '9.1.4.2' },
+    'object-alt': { criterion: '1.1.1', level: 'A', en301549: '9.1.1.1' },
+    'p-as-heading': { criterion: '1.3.1', level: 'A', en301549: '9.1.3.1' },
+    'page-has-heading-one': { criterion: null, level: null, en301549: null },
+    'presentation-role-conflict': { criterion: null, level: null, en301549: null },
+    'region': { criterion: null, level: null, en301549: null },
+    'role-img-alt': { criterion: '1.1.1', level: 'A', en301549: '9.1.1.1' },
+    'scope-attr-valid': { criterion: null, level: null, en301549: null },
+    'scrollable-region-focusable': { criterion: '2.1.1', level: 'A', en301549: '9.2.1.1' },
+    'select-name': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'server-side-image-map': { criterion: '2.1.1', level: 'A', en301549: '9.2.1.1' },
+    'skip-link': { criterion: null, level: null, en301549: null },
+    'summary-name': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'svg-img-alt': { criterion: '1.1.1', level: 'A', en301549: '9.1.1.1' },
+    'tabindex': { criterion: null, level: null, en301549: null },
+    'table-duplicate-name': { criterion: null, level: null, en301549: null },
+    'table-fake-caption': { criterion: '1.3.1', level: 'A', en301549: '9.1.3.1' },
+    'target-size': { criterion: '2.5.8', level: 'AA', en301549: '9.2.5.8' },
+    'td-has-header': { criterion: '1.3.1', level: 'A', en301549: '9.1.3.1' },
+    'td-headers-attr': { criterion: '1.3.1', level: 'A', en301549: '9.1.3.1' },
+    'th-has-data-cells': { criterion: '1.3.1', level: 'A', en301549: '9.1.3.1' },
+    'valid-lang': { criterion: '3.1.2', level: 'AA', en301549: '9.3.1.2' },
+    'video-caption': { criterion: '1.2.2', level: 'A', en301549: '9.1.2.2' },
+};
+/** What a rule tests, or undefined when axe has no rule by that name. */
+export function factsFor(ruleId) {
+    return AXE_RULES[ruleId];
+}

package/dist/engine/access/from-lighthouse.js

@@ -0,0 +1,74 @@
+import { factsFor } from './axe-rules.js';
+/** WCAG's own ordering: level A is the most basic requirement, so its failures come first. */
+const BY_LEVEL = { A: 'blocker', AA: 'serious', AAA: 'moderate' };
+/**
+ * The accessibility half of a Lighthouse report, as findings the Phase 29 report can print.
+ *
+ * Three kinds come out, the same three an axe run produces:
+ *   - a failing audit whose rule tests a WCAG criterion  -> a barrier;
+ *   - a failing audit whose rule tests nobody's standard -> advice;
+ *   - an audit Lighthouse marks `manual`                 -> a question, because Lighthouse itself
+ *     declines to answer it. Those are not passes, and a page with no failures and ten unanswered
+ *     manual checks has not passed.
+ */
+export function accessibilityFromLighthouse(report) {
+    const out = [];
+    const page = report.url;
+    for (const failure of report.accessibilityFailures) {
+        const facts = factsFor(failure.id);
+        const criterion = facts?.criterion ?? null;
+        out.push({
+            rule: failure.id,
+            tool: 'axe',
+            confidence: criterion === null ? 'advice' : 'barrier',
+            criterion,
+            level: facts?.level ?? null,
+            en301549: facts?.en301549 ?? null,
+            severity: criterion === null ? 'minor' : (BY_LEVEL[facts?.level ?? 'A'] ?? 'serious'),
+            html: failure.snippet,
+            selector: failure.selector,
+            page,
+            why: failure.title,
+            next: failure.explanation || failure.title,
+        });
+    }
+    for (const check of report.manual) {
+        const facts = factsFor(check.id);
+        out.push({
+            rule: check.id,
+            tool: 'axe',
+            confidence: 'ask-a-person',
+            criterion: facts?.criterion ?? null,
+            level: facts?.level ?? null,
+            en301549: facts?.en301549 ?? null,
+            severity: 'moderate',
+            html: '',
+            selector: '',
+            page,
+            why: `${check.title}. Lighthouse does not score this one and hands it to a person`,
+            next: 'check it yourself, ideally with a keyboard and a screen reader; it is neither a pass nor a failure until somebody looks',
+        });
+    }
+    return out;
+}
+/**
+ * Which axe rules a Lighthouse run actually exercised.
+ *
+ * Everything in the accessibility category ran, including the audits that passed and the ones that
+ * did not apply to this page - both are evidence the rule was checked. This is what lets a
+ * Lighthouse run move contrast off the "not checked" list, exactly as an axe run does, since
+ * `color-contrast` is one of the rules it runs.
+ */
+export function rulesRunByLighthouse(report) {
+    return new Set(report.accessibilityAuditIds);
+}
+/** The criteria those rules test, for shrinking what the report has to call unchecked. */
+export function criteriaFromLighthouse(report) {
+    const out = new Set();
+    for (const id of report.accessibilityAuditIds) {
+        const criterion = factsFor(id)?.criterion;
+        if (criterion)
+            out.add(criterion);
+    }
+    return out;
+}

package/dist/engine/access/render.js

@@ -0,0 +1,133 @@
+// Phase 28-32: writing the accessibility report.
+//
+// Split out of access-command.ts to keep every file in this project under 300 lines, which the
+// Lighthouse reader pushed it past. The rendering is the part most worth keeping readable: it is
+// where the distinction between a barrier, a question and a piece of advice is actually made
+// visible to a person, and where what was *not* checked gets said.
+import { nowChecked, renderBrowserSection, stillNotChecked } from './merge.js';
+import { blocks, criterionOf, RULES } from './wcag.js';
+const ORDER = { blocker: 0, serious: 1, moderate: 2, minor: 3 };
+export function worstFirst(a, b) {
+    const sa = ORDER[RULES[a.rule]?.severity ?? 'minor'];
+    const sb = ORDER[RULES[b.rule]?.severity ?? 'minor'];
+    if (sa !== sb)
+        return sa - sb;
+    if (a.file !== b.file)
+        return a.file < b.file ? -1 : 1;
+    return a.line - b.line;
+}
+function group(findings) {
+    const by = new Map();
+    for (const f of findings) {
+        const list = by.get(f.rule);
+        if (list)
+            list.push(f);
+        else
+            by.set(f.rule, [f]);
+    }
+    return by;
+}
+function section(title, findings, lines) {
+    if (findings.length === 0)
+        return;
+    lines.push(`## ${title}`, '');
+    for (const [rule, found] of group(findings)) {
+        const meta = RULES[rule];
+        lines.push(`### ${rule} - ${found.length} ${found.length === 1 ? 'place' : 'places'}`, '');
+        lines.push(`${criterionOf(rule)}, ${meta?.severity ?? 'unrated'}.`, '');
+        if (meta)
+            lines.push(`Who it stops: ${meta.stops}.`, '');
+        for (const f of found.slice(0, 20)) {
+            lines.push(`- \`${f.file}:${f.line}\`  ${f.element}`);
+            lines.push(`  - ${f.why}`);
+            lines.push(`  - do this: ${f.next}`);
+        }
+        if (found.length > 20)
+            lines.push(`- ...and ${found.length - 20} more of the same, in the JSON beside this report.`);
+        lines.push('');
+    }
+}
+export function renderAccess(result, scanned) {
+    const { barriers, questions, accepted, filesRead, browser } = result;
+    const lines = ['# Tewip accessibility check', ''];
+    lines.push(`Read ${filesRead} markup ${filesRead === 1 ? 'file' : 'files'} under \`${scanned}\`, without rendering any of them.`, '');
+    if (browser) {
+        lines.push(`Also read a ${browser.tool === 'lighthouse' ? 'Lighthouse' : 'axe'} run over ${browser.pages.length} rendered ` +
+            `${browser.pages.length === 1 ? 'page' : 'pages'}, ` +
+            'which settles what reading markup cannot.', '');
+    }
+    if (barriers.length === 0 && questions.length === 0 && !browser) {
+        lines.push('No barrier was found that reading the markup can settle, and nothing needs a decision.', '');
+    }
+    else {
+        const stopping = barriers.filter((f) => blocks(f.rule)).length;
+        const counts = [
+            `${barriers.length} ${barriers.length === 1 ? 'barrier' : 'barriers'} (${stopping} that stop somebody outright)`,
+            `${questions.length} for a person to settle`,
+        ];
+        if (accepted.length > 0)
+            counts.push(`${accepted.length} already accepted`);
+        if (browser) {
+            counts.unshift(`${browser.barriers.length} barriers the browser run proves`);
+            if (browser.questions.length > 0)
+                counts.push(`${browser.questions.length} the browser could not determine`);
+        }
+        lines.push(`**${counts.join(', ')}.**`, '');
+    }
+    if (browser) {
+        renderBrowserSection('Barriers seen in the browser', browser.barriers, lines);
+        renderBrowserSection('The browser could not determine these', browser.questions, lines);
+    }
+    section('Barriers read from the source', [...barriers].sort(worstFirst), lines);
+    section('Only a person can settle these', [...questions].sort(worstFirst), lines);
+    if (browser && browser.advice.length > 0) {
+        // Kept out of the counts above on purpose. These are axe's own best-practice rules, which test
+        // no standard: on nine real pages they were 51 of 174 findings, outnumbering every real barrier.
+        // Reporting them as equals is how a team learns to ignore the whole report.
+        const rules = [...new Set(browser.advice.map((f) => f.rule))].sort();
+        lines.push('## Advice, not barriers', '');
+        lines.push(`${browser.advice.length} ${browser.advice.length === 1 ? 'finding comes' : 'findings come'} from axe rules that map to no WCAG criterion - ` +
+            `${rules.join(', ')}. They are somebody's good idea rather than a standard, so they are not counted as barriers ` +
+            'and never fail a build. Worth reading once; not worth a release.', '');
+    }
+    if (browser && browser.superseded.length > 0) {
+        lines.push('## Set aside, because the browser run checked them', '');
+        lines.push(`${browser.superseded.length} source ${browser.superseded.length === 1 ? 'finding' : 'findings'} ` +
+            'are not listed above: the axe run checked their criterion on a rendered page, so its answer is the better ' +
+            'one and repeating them here would count the same barrier twice. They are in the JSON beside this report.', '');
+    }
+    if (accepted.length > 0) {
+        lines.push('## Already accepted', '');
+        lines.push(`${accepted.length} ${accepted.length === 1 ? 'finding is' : 'findings are'} listed in \`.tewip/access-accepted.txt\`, so they are not repeated here.`, '');
+    }
+    // Coverage comes from every rule that ran, not from the ones that found something: a contrast
+    // check that ran and passed has still checked contrast.
+    const ran = browser?.rulesRun ?? new Set();
+    const settled = nowChecked(ran);
+    const remaining = stillNotChecked(ran);
+    if (settled.length > 0) {
+        lines.push('## Checked here only because a browser run was given', '');
+        for (const n of settled)
+            lines.push(`- **${n.criterion}** - would otherwise be unreachable: ${n.why}`);
+        lines.push('');
+    }
+    lines.push('## What was not checked', '');
+    lines.push(browser
+        ? 'Even with the browser run, none of the following was tested:'
+        : 'This read the markup. It did not render a page, so none of the following was tested:', '');
+    for (const n of remaining)
+        lines.push(`- **${n.criterion}** - ${n.why}`);
+    if (browser) {
+        lines.push('');
+        lines.push(`The run covered ${browser.pages.length} ${browser.pages.length === 1 ? 'page' : 'pages'}. ` +
+            'Nothing is known about a page it did not open, or about a state it did not reach - a dialog that was never ' +
+            'opened, a form that was never submitted, an error that was never triggered.');
+    }
+    lines.push('');
+    lines.push('A clean result here means these checks found nothing, not that the product is accessible. ' +
+        'Roughly a third of WCAG can be judged by a machine at all' +
+        (browser ? '' : ', and reading source rather than a rendered page reaches less than that') +
+        '. The rest needs a person, ideally one who uses a screen reader.', '');
+    lines.push('To accept a finding, add its key to `.tewip/access-accepted.txt`, one per line, with a reason after ` - `.', '');
+    return lines.join('\n');
+}

package/dist/engine/access/reports.js

@@ -145,7 +145,7 @@ export function readAxeReport(path) {
     catch {
         throw new Error(`${path} is not JSON. Tewip reads the JSON an axe run writes.`);
     }
-    const run = { findings: [], pages: new Set(), rulesRun: new Set(), criteriaCovered: new Set() };
+    const run = { source: 'axe', findings: [], pages: new Set(), rulesRun: new Set(), criteriaCovered: new Set() };
     const pageOf = (v, fallback) => text(v.url) || text(v.page) || fallback;
     if (looksLikeAxe(parsed)) {
         fromResult(parsed, pageOf(parsed, path), run);

package/dist/engine/perf/history.js

@@ -25,7 +25,8 @@ export function storedRuns(root, label) {
             const parsed = JSON.parse(trimmed);
             // A line Tewip cannot read is skipped rather than throwing: one bad line written by a crashed
             // run must not make the whole baseline unreadable.
-            if (parsed && typeof parsed.at === 'string' && parsed.label === label && parsed.timings)
+            // Either shape counts: `metrics` is what is written now, `timings` what older versions wrote.
+            if (parsed && typeof parsed.at === 'string' && parsed.label === label && (parsed.metrics ?? parsed.timings))
                 out.push(parsed);
         }
         catch {
@@ -34,22 +35,36 @@ export function storedRuns(root, label) {
     }
     return out;
 }
-export function recordRun(root, label, run, requests, gitSha) {
+export function recordRun(root, label, run, gitSha) {
     const stored = {
         at: run.at,
         label,
         ...(gitSha ? { gitSha } : {}),
-        timings: Object.fromEntries(Object.entries(run.timings).map(([m, v]) => [m, { p95: v.p95, med: v.med, avg: v.avg }])),
-        requests,
+        source: run.source,
+        metrics: Object.fromEntries(Object.entries(run.metrics).map(([m, v]) => [m, v.value])),
+        requests: run.volume.n,
     };
     const path = file(root);
     mkdirSync(dirname(path), { recursive: true });
     appendFileSync(path, `${JSON.stringify(stored)}\n`, 'utf8');
     return stored;
 }
-/** Every stored p95 for one metric, oldest first, for the comparison to read the spread from. */
+/**
+ * Every stored value for one metric, oldest first, for the comparison to read the spread from.
+ *
+ * Reads the older shape as well, so upgrading Tewip does not quietly empty a project's baseline -
+ * which would drop it below three runs and make Tewip refuse to judge a project it judged fine the
+ * day before.
+ */
 export function baselineFor(runs, metric) {
-    return runs.map((r) => r.timings[metric]?.p95).filter((v) => typeof v === 'number' && Number.isFinite(v));
+    return runs
+        .map((r) => r.metrics?.[metric] ?? r.timings?.[metric]?.p95)
+        .filter((v) => typeof v === 'number' && Number.isFinite(v));
+}
+/** Runs from the same tool. A k6 p95 and a Lighthouse LCP are not each other's baseline. */
+export function fromSameTool(runs, source) {
+    // Runs recorded before the field existed were all k6, which is what the absence means.
+    return runs.filter((r) => (r.source ?? 'k6') === source);
 }
 /** The labels this project has recorded, so a typo in --label does not look like an empty history. */
 export function knownLabels(root) {

package/dist/engine/perf/lighthouse.js

@@ -0,0 +1,155 @@
+// Phase 31: reading a Lighthouse report.
+//
+// k6 measures what a server does under load. Lighthouse measures what one page load costs in a real
+// browser - Largest Contentful Paint, layout shift, blocking time - which is nearer to what a person
+// actually waits for, and is what most teams already run. Tewip could read neither until now.
+//
+// The same discipline as everywhere else applies, and Lighthouse needs it more than k6 does. Four
+// real Lighthouse runs of an unchanged page, measured here, gave LCP of 922, 912, 936 and 916ms: a
+// 2.6% spread from nothing happening. Lighthouse's own score moved between runs too. So the
+// comparison is the same one k6 gets - outside the baseline range by more than its own width, with
+// three baselines required before anything is called at all.
+//
+// One thing is deliberately not invented. "Is 2112ms bad?" has a published answer, and it is
+// Google's, not Tewip's: Lighthouse scores every metric 0 to 1 on its own curve and renders the
+// bands at 0.9 and 0.5. Tewip reads that score rather than hard-coding thresholds it remembered,
+// so the word "poor" in a report is Lighthouse's judgement and is traceable to it.
+import { readFileSync } from 'node:fs';
+/** The audits worth comparing between runs: what the page load cost, not advice about it. */
+const MEASURED = new Set([
+    'largest-contentful-paint',
+    'first-contentful-paint',
+    'total-blocking-time',
+    'cumulative-layout-shift',
+    'speed-index',
+    'interaction-to-next-paint',
+    'server-response-time',
+    'time-to-first-byte',
+]);
+/** Lighthouse renders green at 0.9 and orange at 0.5. The bands are its own, and so is the word. */
+function rating(score) {
+    if (typeof score !== 'number' || !Number.isFinite(score))
+        return null;
+    if (score >= 0.9)
+        return 'good';
+    if (score >= 0.5)
+        return 'needs-improvement';
+    return 'poor';
+}
+const text = (v) => (typeof v === 'string' ? v : '');
+const num = (v) => (typeof v === 'number' && Number.isFinite(v) ? v : 0);
+function looksLikeLighthouse(v) {
+    if (typeof v !== 'object' || v === null)
+        return false;
+    const o = v;
+    return typeof o.lighthouseVersion === 'string' && typeof o.audits === 'object' && o.audits !== null;
+}
+/** The nodes a failing accessibility audit points at. */
+function failingNodes(audit) {
+    const details = (audit.details ?? {});
+    const items = Array.isArray(details.items) ? details.items : [];
+    const out = [];
+    for (const item of items) {
+        const node = (item?.node ?? {});
+        out.push({
+            selector: text(node.selector),
+            snippet: text(node.snippet).replace(/\s+/g, ' ').slice(0, 160),
+            explanation: text(node.explanation)
+                .split(/\r?\n/)
+                .map((l) => l.trim())
+                .filter((l) => l !== '' && !/^Fix (any|all) of the following:$/.test(l))
+                .join('; '),
+        });
+    }
+    return out;
+}
+export function readLighthouse(path) {
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(path, 'utf8'));
+    }
+    catch {
+        throw new Error(`${path} is not JSON. Tewip reads the JSON Lighthouse writes with --output=json.`);
+    }
+    if (!looksLikeLighthouse(parsed)) {
+        throw new Error(`${path} is JSON, but not a Lighthouse report: Tewip looked for "lighthouseVersion" and an "audits" object. ` +
+            'Write one with: lighthouse <url> --output=json --output-path=report.json');
+    }
+    const o = parsed;
+    // A report can carry a runtime error and still be valid JSON with empty audits. Reporting "no
+    // regression" from a run that never loaded the page would be the worst kind of wrong.
+    const runtimeError = (o.runtimeError ?? null);
+    if (runtimeError && text(runtimeError.code) !== 'NO_ERROR' && text(runtimeError.message) !== '') {
+        throw new Error(`that Lighthouse run did not complete: ${text(runtimeError.message)}`);
+    }
+    const audits = (o.audits ?? {});
+    const categories = (o.categories ?? {});
+    const metrics = {};
+    for (const [id, audit] of Object.entries(audits)) {
+        if (!MEASURED.has(id) || typeof audit.numericValue !== 'number')
+            continue;
+        metrics[id] = {
+            value: num(audit.numericValue),
+            unit: audit.numericUnit === 'millisecond' ? 'ms' : 'unitless',
+            rating: rating(audit.score),
+        };
+    }
+    // The category score itself is worth tracking: it is the number teams quote at each other.
+    for (const [name, category] of Object.entries(categories)) {
+        if (typeof category?.score === 'number') {
+            metrics[`${name}-score`] = { value: category.score, unit: 'score', rating: rating(category.score) };
+        }
+    }
+    const accessibilityFailures = [];
+    const manual = [];
+    const accessibilityAuditIds = [];
+    const a11yRefs = (categories.accessibility?.auditRefs ?? []);
+    for (const ref of a11yRefs) {
+        const audit = audits[text(ref.id)];
+        if (!audit)
+            continue;
+        const id = text(audit.id);
+        // Recorded before the outcome is looked at: a rule that passed, or did not apply to this page,
+        // has still been checked, and that is what coverage means.
+        if (id !== '')
+            accessibilityAuditIds.push(id);
+        if (audit.scoreDisplayMode === 'manual') {
+            manual.push({ id, title: text(audit.title) });
+            continue;
+        }
+        if (typeof audit.score === 'number' && audit.score < 1) {
+            const nodes = failingNodes(audit);
+            if (nodes.length === 0)
+                accessibilityFailures.push({ id, title: text(audit.title), selector: '', snippet: '', explanation: '' });
+            for (const node of nodes)
+                accessibilityFailures.push({ id, title: text(audit.title), ...node });
+        }
+    }
+    return {
+        run: {
+            source: 'lighthouse',
+            at: text(o.fetchTime) || new Date().toISOString(),
+            metrics,
+            // Lighthouse has no user-written thresholds the way a k6 script does. That is an absence of
+            // the feature, not an export that forgot to record them, so an empty list is the honest value.
+            thresholds: [],
+            volume: { kind: 'page load', n: 1 },
+        },
+        categories: Object.fromEntries(Object.entries(categories).map(([k, v]) => [k, num(v?.score)])),
+        accessibilityFailures,
+        manual,
+        accessibilityAuditIds,
+        url: text(o.finalDisplayedUrl) || text(o.finalUrl) || text(o.requestedUrl),
+        lighthouseVersion: text(o.lighthouseVersion),
+    };
+}
+/** True of a Lighthouse report, for a command that accepts either tool's output. */
+export function isLighthouseFile(path) {
+    try {
+        const parsed = JSON.parse(readFileSync(path, 'utf8'));
+        return looksLikeLighthouse(parsed);
+    }
+    catch {
+        return false;
+    }
+}

package/dist/engine/perf/perf-command.js

@@ -1,111 +1,156 @@
-// Phase 30: `tewip perf` - is this change slower, and does it matter?
+// Phase 30, extended in Phase 31: `tewip perf` - is this change slower, and does it matter?
 //
-// Two questions, answered separately because they fail separately:
+// Reads a k6 run (what a server does under load) or a Lighthouse report (what one page load costs in
+// a browser), whichever it is handed, and answers two questions separately because they fail
+// separately:
 //
-//   1. **Did your own thresholds hold?** The team already wrote what "fast enough" means, in the k6
-//      script. Tewip reads the result rather than asking them to write a budget twice. When the
-//      export does not record thresholds - which the machine-readable one does not - the answer is
-//      "this export cannot tell me", never "nothing was breached".
-//   2. **Is it slower than it was?** Answered only from repeated baseline runs, and refused when
-//      there are not enough of them, because one run against one run is not evidence.
+//   1. **Is anything in a bad state right now?** From the team's own k6 thresholds, or from
+//      Lighthouse's published scoring bands. Never from a budget Tewip invented.
+//   2. **Is it slower than it was?** Only from repeated baselines, and refused below three, because
+//      one run against one run is not evidence. Four real k6 runs of unchanged code gave p95 of
+//      60.8-62.8ms; four real Lighthouse runs of an unchanged page gave LCP of 912-936ms. Both move
+//      on their own, and a tool that calls that a regression is muted within a week.
 //
-// It never estimates a duration, a capacity or a user impact. It has no idea what the production
-// hardware is, what the data volume is, or how many people use the endpoint, and a number invented
-// for any of those is worse than silence.
+// It never predicts a duration, a capacity or a user impact: it cannot see the production hardware,
+// the real data volume or the real traffic, and an invented number for any of those is worse than
+// silence.
 import { mkdirSync, writeFileSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
-import { MAIN_TIMING, readK6Summary, requestCount } from './k6.js';
-import { compareMetric, ENOUGH_BASELINES, ENOUGH_REQUESTS, timingsToCompare } from './compare.js';
-import { baselineFor, knownLabels, recordRun, storedRuns } from './history.js';
-const ms = (n) => `${Math.round(n * 10) / 10}ms`;
-export function renderPerf(run, comparisons, requests, label, baselineCount, recorded) {
+import { readK6Summary, requestCount } from './k6.js';
+import { isLighthouseFile, readLighthouse } from './lighthouse.js';
+import { fromK6, metricsInOrder, show } from './run.js';
+import { compareMetric, ENOUGH_BASELINES } from './compare.js';
+import { baselineFor, fromSameTool, knownLabels, recordRun, storedRuns } from './history.js';
+/** Enough requests for a percentile to mean anything. Below this, p95 is three data points. */
+export const ENOUGH_REQUESTS = 100;
+export function readPerfFile(path) {
+    if (isLighthouseFile(path)) {
+        const report = readLighthouse(path);
+        return { run: report.run, manual: report.manual, url: report.url };
+    }
+    const k6 = readK6Summary(path);
+    return { run: fromK6(k6, requestCount(k6)), manual: [], url: '' };
+}
+export function renderPerf(run, comparisons, label, baselineCount, recorded, manual = []) {
     const lines = ['# Tewip performance check', ''];
     const breaches = (run.thresholds ?? []).filter((t) => t.breached);
+    const poor = Object.entries(run.metrics).filter(([, m]) => m.rating === 'poor');
     const slower = comparisons.filter((c) => c.direction === 'slower');
     const faster = comparisons.filter((c) => c.direction === 'faster');
     const unsure = comparisons.filter((c) => c.direction === 'cannot-say');
-    lines.push(`Read a k6 run of **${requests} requests**, compared against **${baselineCount}** recorded baseline ${baselineCount === 1 ? 'run' : 'runs'} for \`${label}\`.`, '');
-    // Headline, in the order that decides what a person does next.
-    if (breaches.length > 0) {
+    const tool = run.source === 'k6' ? 'k6' : 'Lighthouse';
+    lines.push(`Read a ${tool} run of **${run.volume.n} ${run.volume.kind}${run.volume.n === 1 ? '' : 's'}**, compared against **${baselineCount}** recorded ` +
+        `${tool} baseline ${baselineCount === 1 ? 'run' : 'runs'} for \`${label}\`.`, '');
+    if (breaches.length > 0)
         lines.push(`**${breaches.length} of your own thresholds ${breaches.length === 1 ? 'was' : 'were'} breached.**`, '');
-    }
+    if (poor.length > 0)
+        lines.push(`**${poor.length} ${poor.length === 1 ? 'metric is' : 'metrics are'} in ${tool}'s worst band.**`, '');
     if (slower.length > 0)
         lines.push(`**${slower.length} ${slower.length === 1 ? 'metric is' : 'metrics are'} slower than the baseline runs can explain.**`, '');
-    if (breaches.length === 0 && slower.length === 0) {
+    if (breaches.length === 0 && poor.length === 0 && slower.length === 0) {
         lines.push(run.thresholds === null
             ? '**No regression this baseline can detect.** Your thresholds are not in this export, so nothing is said about them.'
-            : '**No threshold breached, and no regression this baseline can detect.**', '');
+            : '**Nothing in a bad state, and no regression this baseline can detect.**', '');
     }
-    lines.push('## Did your own thresholds hold?', '');
-    if (run.thresholds === null) {
-        lines.push('**Cannot say.** This summary came from `--new-machine-readable-summary`, and that export records no threshold ' +
-            'results at all - the word appears in it only inside the copy of your script. Tewip will not report "nothing was ' +
-            'breached" from a file that does not say. Re-run with plain `--summary-export` to get the answer.', '');
-    }
-    else if (run.thresholds.length === 0) {
-        lines.push('This run has no thresholds. Add them to your k6 script and the team decides what "fast enough" means, rather than Tewip.', '');
+    lines.push('## Is anything in a bad state right now?', '');
+    if (run.source === 'k6') {
+        if (run.thresholds === null) {
+            lines.push('**Cannot say.** This summary came from `--new-machine-readable-summary`, and that export records no threshold ' +
+                'results at all - the word appears in it only inside the copy of your script. Tewip will not report "nothing was ' +
+                'breached" from a file that does not say. Re-run with plain `--summary-export` to get the answer.', '');
+        }
+        else if (run.thresholds.length === 0) {
+            lines.push('This run has no thresholds. Add them to your k6 script and the team decides what "fast enough" means, rather than Tewip.', '');
+        }
+        else {
+            for (const t of run.thresholds)
+                lines.push(`- ${t.breached ? '**breached**' : 'held'} — \`${t.metric}\`: \`${t.expression}\``);
+            lines.push('');
+        }
     }
     else {
-        for (const t of run.thresholds) {
-            lines.push(`- ${t.breached ? '**breached**' : 'held'} — \`${t.metric}\`: \`${t.expression}\``);
+        // The bands are Lighthouse's own, computed by Lighthouse. Tewip is relaying a judgement with a
+        // published basis, not applying numbers it chose.
+        lines.push("Rated by Lighthouse's own scoring, not by any threshold Tewip invented:", '');
+        for (const name of metricsInOrder(run)) {
+            const m = run.metrics[name];
+            if (m.rating === null)
+                continue;
+            const mark = m.rating === 'poor' ? '**poor**' : m.rating === 'needs-improvement' ? 'needs improvement' : 'good';
+            lines.push(`- ${mark} — \`${name}\`: ${show(m)}`);
         }
         lines.push('');
     }
     lines.push('## Is it slower than it was?', '');
     if (baselineCount < ENOUGH_BASELINES) {
-        lines.push(`**Cannot say.** There ${baselineCount === 1 ? 'is' : 'are'} ${baselineCount} recorded ${baselineCount === 1 ? 'run' : 'runs'} for \`${label}\`, ` +
-            `and Tewip needs ${ENOUGH_BASELINES} before it will call anything a regression. Performance numbers move between identical ` +
-            'runs, and without several of them there is no way to tell a change from the machine having a busy moment. ' +
-            `Record baselines on your main branch with \`tewip perf <summary.json> --record\`.`, '');
+        lines.push(`**Cannot say.** There ${baselineCount === 1 ? 'is' : 'are'} ${baselineCount} recorded ${tool} ${baselineCount === 1 ? 'run' : 'runs'} ` +
+            `for \`${label}\`, and Tewip needs ${ENOUGH_BASELINES} before it will call anything a regression. Performance numbers move ` +
+            'between identical runs, and without several of them there is no way to tell a change from the machine having a busy moment. ' +
+            'Record baselines on your main branch with `tewip perf <file> --record`.', '');
     }
     for (const c of [...slower, ...faster, ...unsure]) {
         const verdict = c.direction === 'slower' ? '**slower**' : c.direction === 'faster' ? 'faster' : 'cannot say';
-        lines.push(`- \`${c.metric}\` p95 ${ms(c.now)} — ${verdict}`);
-        lines.push(`  - baseline ${ms(c.baselineLow)}–${ms(c.baselineHigh)} over ${c.baselineRuns} runs, middle ${ms(c.before)}`);
+        const unit = run.metrics[c.metric]?.unit ?? 'ms';
+        const u = (n) => (unit === 'ms' ? `${n}ms` : `${n}`);
+        lines.push(`- \`${c.metric}\` ${u(c.now)} — ${verdict}`);
+        lines.push(`  - baseline ${u(c.baselineLow)}–${u(c.baselineHigh)} over ${c.baselineRuns} runs, middle ${u(c.before)}`);
         lines.push(`  - ${c.why}`);
     }
     lines.push('');
-    if (requests < ENOUGH_REQUESTS) {
-        lines.push(`**${requests} requests is thin.** A p95 from this few is a handful of data points and will move on its own. ` +
+    if (run.source === 'k6' && run.volume.n < ENOUGH_REQUESTS) {
+        lines.push(`**${run.volume.n} requests is thin.** A p95 from this few is a handful of data points and will move on its own. ` +
             'Treat everything above as indicative and lengthen the run before deciding anything.', '');
     }
     lines.push('## What this does not tell you', '');
     lines.push('- **Nothing about production.** This is the hardware the run happened on, with that data volume and that ' +
-        'concurrency. Tewip cannot see your real machines, your real data or your real traffic, and will not guess.', '- **No duration is predicted.** How long a real user waits depends on network, device and cache, none of which are here.', '- **Only what the script exercised.** An endpoint the test never called is not covered, however green this looks.', '- **Not capacity.** This says whether it changed, not how many users it would hold.', '');
+        'concurrency. Tewip cannot see your real machines, your real data or your real traffic, and will not guess.', '- **No duration is predicted.** How long a real user waits depends on network, device and cache, none of which are here.', '- **Only what the run exercised.** A page or endpoint it never touched is not covered, however green this looks.', '- **Not capacity.** This says whether it changed, not how many users it would hold.');
+    if (run.source === 'lighthouse') {
+        lines.push(`- **One page load.** k6 reports a percentile over many requests; this is a single load of one page, and a single ` +
+            'load is the noisiest measurement either tool offers.');
+        if (manual.length > 0) {
+            lines.push(`- **${manual.length} accessibility checks Lighthouse refuses to score** and hands to a person - ` +
+                `${manual.slice(0, 3).map((m) => `\`${m.id}\``).join(', ')} and others. They are not failures and not passes. ` +
+                'Run `tewip access` for the accessibility side.');
+        }
+    }
+    lines.push('');
     if (recorded)
         lines.push(`This run was added to the baseline for \`${label}\`.`, '');
     else
-        lines.push(`This run was **not** recorded. Add \`--record\` on your main branch to make it part of the baseline; a regression recorded by accident becomes next week's normal.`, '');
+        lines.push('This run was **not** recorded. Add `--record` on your main branch to make it part of the baseline; a regression recorded by accident becomes next week\'s normal.', '');
     return lines.join('\n');
 }
 export function runPerf(cmd) {
     const root = resolve(cmd.root);
     const label = cmd.label ?? 'default';
-    const run = readK6Summary(resolve(root, cmd.summary));
-    const requests = requestCount(run);
-    const history = storedRuns(root, label);
-    if (history.length === 0) {
+    const { run, manual } = readPerfFile(resolve(root, cmd.summary));
+    const all = storedRuns(root, label);
+    const history = fromSameTool(all, run.source);
+    if (all.length === 0) {
         const known = knownLabels(root);
-        // A typo in --label would otherwise look exactly like "no history yet", and the team would
-        // record a second baseline under the wrong name without noticing.
         if (known.length > 0 && !known.includes(label)) {
             console.error(`[tewip] no recorded runs for label "${label}". This project has: ${known.join(', ')}.`);
         }
     }
-    const comparisons = timingsToCompare(run)
-        .map((metric) => compareMetric(metric, run.timings[metric].p95, baselineFor(history, metric)))
-        // A metric that is zero now and was zero every time before says nothing. http_req_blocked is
-        // zero on a local run, and printing "0ms is within 0-0ms" three times buries the real lines.
+    const comparisons = metricsInOrder(run)
+        .map((metric) => compareMetric(metric, run.metrics[metric].value, baselineFor(history, metric)))
+        // A metric that is zero now and was zero every time before says nothing, and printing
+        // "0ms is within 0-0ms" three times buries the real lines.
         .filter((c) => c.now > 0 || c.baselineHigh > 0);
     const recorded = cmd.record === true;
     if (recorded)
-        recordRun(root, label, run, requests, cmd.gitSha);
+        recordRun(root, label, run, cmd.gitSha);
     const breached = (run.thresholds ?? []).some((t) => t.breached);
+    const poor = Object.values(run.metrics).some((m) => m.rating === 'poor');
     const regressed = comparisons.some((c) => c.direction === 'slower');
-    const report = renderPerf(run, comparisons, requests, label, history.length, recorded);
+    const report = renderPerf(run, comparisons, label, history.length, recorded, manual);
     console.log(report);
-    if (cmd.gate && (breached || regressed)) {
-        const why = [breached ? 'a threshold you wrote was breached' : '', regressed ? 'something is slower than the baselines explain' : '']
+    if (cmd.gate && (breached || regressed || poor)) {
+        const why = [
+            breached ? 'a threshold you wrote was breached' : '',
+            poor ? "something is in Lighthouse's worst band" : '',
+            regressed ? 'something is slower than the baselines explain' : '',
+        ]
             .filter(Boolean)
             .join(', and ');
         console.error(`${String.fromCharCode(10)}Performance gate failed: ${why}.`);
@@ -116,5 +161,5 @@ export function runPerf(cmd) {
         mkdirSync(dirname(path), { recursive: true });
         writeFileSync(path, report, 'utf8');
     }
-    return { run, comparisons, requests, regressed, breached, report };
+    return { run, comparisons, regressed, breached: breached || poor, report };
 }

package/dist/engine/perf/run.js

@@ -0,0 +1,39 @@
+/** k6's percentiles, reduced to the one number a comparison needs: p95. */
+export function fromK6(run, requests) {
+    const metrics = {};
+    for (const [name, m] of Object.entries(run.timings)) {
+        // Tagged duplicates (`http_req_duration{expected_response:true}`) are the same measurement
+        // sliced, and comparing both says the same thing twice.
+        if (name.includes('{'))
+            continue;
+        // k6 publishes no bands. It reports numbers and leaves "fast enough" to the team's thresholds,
+        // which is the right division and the reason rating is null here.
+        metrics[name] = { value: m.p95, unit: 'ms', rating: null };
+    }
+    return { source: 'k6', at: run.at, metrics, thresholds: run.thresholds, volume: { kind: 'request', n: requests } };
+}
+/** Metrics worth putting in front of a person, most important first. */
+const ORDER = [
+    'largest-contentful-paint',
+    'cumulative-layout-shift',
+    'total-blocking-time',
+    'interaction-to-next-paint',
+    'first-contentful-paint',
+    'speed-index',
+    'server-response-time',
+    'http_req_duration',
+];
+export function metricsInOrder(run) {
+    const names = Object.keys(run.metrics);
+    const known = ORDER.filter((m) => names.includes(m));
+    const rest = names.filter((m) => !ORDER.includes(m)).sort();
+    return [...known, ...rest];
+}
+/** How a metric is written in a report: 2112ms, 0.08, 97. */
+export function show(metric) {
+    if (metric.unit === 'ms')
+        return `${Math.round(metric.value)}ms`;
+    if (metric.unit === 'score')
+        return `${Math.round(metric.value * 100)}`;
+    return `${Math.round(metric.value * 1000) / 1000}`;
+}

package/dist/mcp/tools-prove.js

@@ -109,18 +109,18 @@ export function registerProofTools(server, { answer, readOnly, project }) {
             throw new Error(`project must be an existing absolute path, got "${root}"`);
         // Never records: an assistant adding runs to a team's baseline unasked is how a regression
         // silently becomes the new normal. Recording stays a deliberate act on the command line.
-        const { readK6Summary, requestCount } = await import('../engine/perf/k6.js');
-        const { compareMetric, timingsToCompare } = await import('../engine/perf/compare.js');
-        const { baselineFor, storedRuns } = await import('../engine/perf/history.js');
-        const { renderPerf } = await import('../engine/perf/perf-command.js');
+        const { compareMetric } = await import('../engine/perf/compare.js');
+        const { baselineFor, fromSameTool, storedRuns } = await import('../engine/perf/history.js');
+        const { readPerfFile, renderPerf } = await import('../engine/perf/perf-command.js');
+        const { metricsInOrder } = await import('../engine/perf/run.js');
         const { isAbsolute: abs, resolve } = await import('node:path');
-        const run = readK6Summary(abs(summary) ? summary : resolve(root, summary));
+        const { run, manual } = readPerfFile(abs(summary) ? summary : resolve(root, summary));
         const name = label ?? 'default';
-        const history = storedRuns(root, name);
-        const comparisons = timingsToCompare(run)
-            .map((m) => compareMetric(m, run.timings[m].p95, baselineFor(history, m)))
+        const history = fromSameTool(storedRuns(root, name), run.source);
+        const comparisons = metricsInOrder(run)
+            .map((m) => compareMetric(m, run.metrics[m].value, baselineFor(history, m)))
             .filter((c) => c.now > 0 || c.baselineHigh > 0);
-        return renderPerf(run, comparisons, requestCount(run), name, history.length, false);
+        return renderPerf(run, comparisons, name, history.length, false, manual);
     }));
     server.registerTool('accessibility_barriers', {
         title: 'Can everybody use this interface?',
@@ -131,20 +131,19 @@ export function registerProofTools(server, { answer, readOnly, project }) {
             axeReport: z
                 .string()
                 .optional()
-                .describe('The JSON from an axe run, if the project has one. It settles contrast, which reading markup cannot, and its findings are triaged rather than relayed: axe rules that map to no WCAG criterion are reported as advice, and what axe could not determine becomes a question.'),
+                .describe('The JSON from an axe run OR a Lighthouse report, if the project has either - Lighthouse runs axe rules, so both work. It settles contrast, which reading markup cannot, and its findings are triaged rather than relayed: rules that map to no WCAG criterion are reported as advice, and what the tool could not determine becomes a question.'),
         },
         annotations: readOnly,
     }, ({ project: root, path, axeReport }) => answer(async () => {
         if (!isAbsolute(root) || !existsSync(root))
             throw new Error(`project must be an existing absolute path, got "${root}"`);
         // The pure functions, not runAccess: that one prints, and anything on stdout breaks JSON-RPC.
-        const { findBarriers, keyOf, readAccepted, renderAccess } = await import('../engine/access/access-command.js');
+        const { findBarriers, keyOf, readAccepted, readBrowserRun, renderAccess } = await import('../engine/access/access-command.js');
         const { merge, pagesIn } = await import('../engine/access/merge.js');
-        const { readAxeReport } = await import('../engine/access/reports.js');
         const { findings, filesRead } = findBarriers(root, path);
         const judged = readAccepted(root);
         const open = findings.filter((f) => !judged.has(keyOf(f)));
-        const run = axeReport ? readAxeReport(isAbsolute(axeReport) ? axeReport : `${root}/${axeReport}`) : undefined;
+        const run = axeReport ? readBrowserRun(isAbsolute(axeReport) ? axeReport : `${root}/${axeReport}`) : undefined;
         const graded = run ? merge(open, run, root) : undefined;
         const kept = graded ? graded.kept : open;
         return renderAccess({
@@ -161,6 +160,7 @@ export function registerProofTools(server, { answer, readOnly, project }) {
                         superseded: graded.superseded,
                         pages: pagesIn(run),
                         rulesRun: run.rulesRun,
+                        tool: run.source,
                     },
                 }
                 : {}),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tewip-ai",
-  "version": "0.37.0",
+  "version": "0.39.0",
   "mcpName": "io.github.hmamut39/tewip",
   "description": "Tewip finds why each failing test failed - real bug, flaky test, environment, test data or changed selector - for any stack, from the command line, CI, or your editor.",
   "keywords": [